diff --git a/Makefile b/Makefile
index bfb52c5ddd63ee..c325034bb9da4f 100644
--- a/Makefile
+++ b/Makefile
@@ -14,8 +14,10 @@ $(if $(findstring $(space),$(TOPDIR)),$(error ERROR: The path to the OpenWrt dir
 
 world:
 
-DISTRO_PKG_CONFIG:=$(shell $(TOPDIR)/scripts/command_all.sh pkg-config | grep -E '\/usr' -m 1)
-export PATH:=$(TOPDIR)/staging_dir/host/bin:$(PATH)
+DISTRO_PKG_CONFIG:=$(shell $(TOPDIR)/scripts/command_all.sh pkg-config | grep '/usr' -m 1)
+
+export ORIG_PATH:=$(if $(ORIG_PATH),$(ORIG_PATH),$(PATH))
+export PATH:=$(if $(STAGING_DIR),$(abspath $(STAGING_DIR)/../host/bin),$(TOPDIR)/staging_dir/host/bin):$(PATH)
 
 ifneq ($(OPENWRT_BUILD),1)
   _SINGLE=export MAKEFLAGS=$(space);
diff --git a/README.md b/README.md
index 2eff29232108cf..8bca0ee7b08247 100644
--- a/README.md
+++ b/README.md
@@ -11,6 +11,24 @@ full customization, to use the device in ways never envisioned.
 
 Sunshine!
 
+## Download
+
+Built firmware images are available for many architectures and come with a
+package selection to be used as WiFi home router. To quickly find a factory
+image usable to migrate from a vendor stock firmware to OpenWrt, try the
+*Firmware Selector*.
+
+* [OpenWrt Firmware Selector](https://firmware-selector.openwrt.org/)
+
+If your device is supported, please follow the **Info** link to see install
+instructions or consult the support resources listed below.
+
+## 
+
+An advanced user may require additional or specific package. (Toolchain, SDK, ...) For everything else than simple firmware download, try the wiki download page:
+
+* [OpenWrt Wiki Download](https://openwrt.org/downloads)
+
 ## Development
 
 To build your own firmware you need a GNU/Linux, BSD or MacOSX system (case
@@ -26,7 +44,7 @@ documentation.
 
 ```
 binutils bzip2 diff find flex gawk gcc-6+ getopt grep install libc-dev libz-dev
-make4.1+ perl python3.6+ rsync subversion unzip which
+make4.1+ perl python3.7+ rsync subversion unzip which
 ```
 
 ### Quickstart
diff --git a/config/Config-build.in b/config/Config-build.in
index c2303637cb1eb5..df2d9101ca99c9 100644
--- a/config/Config-build.in
+++ b/config/Config-build.in
@@ -5,7 +5,6 @@
 
 config EXPERIMENTAL
 	bool "Enable experimental features by default"
-	default n
 	help
 	  Set this option to build with latest bleeding edge features
 	  which may or may not work as expected.
@@ -42,7 +41,6 @@ menu "Global build settings"
 
 	config BUILDBOT
 		bool "Set build defaults for automatic builds (e.g. via buildbot)"
-		default n
 		help
 		  This option changes several defaults to be more suitable for
 		  automatic builds. This includes the following changes:
@@ -75,10 +73,8 @@ menu "Global build settings"
 
 	config DISPLAY_SUPPORT
 		bool "Show packages that require graphics support (local or remote)"
-		default n
 
 	config BUILD_PATENTED
-		default n
 		bool "Compile with support for patented functionality"
 		help
 		  When this option is disabled, software which provides patented functionality
@@ -86,7 +82,6 @@ menu "Global build settings"
 		  functionality, this optional support will get disabled for this package.
 
 	config BUILD_NLS
-		default n
 		bool "Compile with full language support"
 		help
 		  When this option is enabled, packages are built with the full versions of
@@ -100,7 +95,6 @@ menu "Global build settings"
 	config CLEAN_IPKG
 		bool
 		prompt "Remove ipkg/opkg status data files in final images"
-		default n
 		help
 		  This removes all ipkg/opkg status data files from the target directory
 		  before building the root filesystem.
@@ -108,14 +102,12 @@ menu "Global build settings"
 	config IPK_FILES_CHECKSUMS
 		bool
 		prompt "Record files checksums in package metadata"
-		default n
 		help
 		  This makes file checksums part of package metadata. It increases size
 		  but provides you with pkg_check command to check for flash corruptions.
 
 	config INCLUDE_CONFIG
 		bool "Include build configuration in firmware" if DEVEL
-		default n
 		help
 		  If enabled, buildinfo files will be stored in /etc/build.* of firmware.
 
@@ -149,10 +141,24 @@ menu "Global build settings"
 	config DEBUG
 		bool
 		prompt "Compile packages with debugging info"
-		default n
 		help
 		  Adds -g3 to the CFLAGS.
 
+	config USE_GC_SECTIONS
+		bool
+		prompt "Dead code and data elimination for all packages (EXPERIMENTAL)"
+		help
+		  Places functions and data items into its own sections to use the linker's
+		  garbage collection capabilites.
+		  Packages can choose to opt-out via setting PKG_BUILD_FLAGS:=no-gc-sections
+
+	config USE_LTO
+		bool
+		prompt "Use the link-time optimizer for all packages (EXPERIMENTAL)"
+		help
+		  Adds LTO flags to the CFLAGS and LDFLAGS.
+		  Packages can choose to opt-out via setting PKG_BUILD_FLAGS:=no-lto
+
 	config IPV6
 		def_bool y
 
diff --git a/config/Config-devel.in b/config/Config-devel.in
index 87f9157106aae9..cbac91c09dacf1 100644
--- a/config/Config-devel.in
+++ b/config/Config-devel.in
@@ -4,11 +4,9 @@
 
 menuconfig DEVEL
 	bool "Advanced configuration options (for developers)"
-	default n
 
 	config BROKEN
 		bool "Show broken platforms / packages / devices" if DEVEL
-		default n
 
 	config BINARY_FOLDER
 		string "Binary folder" if DEVEL
@@ -17,6 +15,20 @@ menuconfig DEVEL
 		  Store built firmware images and filesystem images in this directory.
 		  If not set, uses './bin/$(BOARD)'
 
+	config DOWNLOAD_TOOL_CUSTOM
+		string "Use custom download tool" if DEVEL
+		default ""
+		help
+		  Use and force custom download tool instead of relying on autoselection
+		  between curl if available and wget as a fallback.
+
+		  download.pl supports 3 tools officially aria2c, curl and wget.
+		  If one of the tool is used in this config, download.pl will use the
+		  default args to make use of them.
+
+		  If the provided string is different than aria2c, curl or wget, the command
+		  is used as is and the download url will be appended at the end of such command.
+
 	config DOWNLOAD_FOLDER
 		string "Download folder" if DEVEL
 		default ""
@@ -39,12 +51,17 @@ menuconfig DEVEL
 
 	config AUTOREMOVE
 		bool "Automatic removal of build directories" if DEVEL
-		default n
 		help
 		  Automatically delete build directories after make target completed.
 		  This allows you to symlink build_dir into a scratch location, e.g. a ramdisk,
 		  which does not have enough space to keep a complete build_dir.
 
+	config BUILD_ALL_HOST_TOOLS
+		bool "Compile all host tools" if DEVEL
+		help
+		  Compile all host host tools even if not needed. This is needed to prepare a
+		  universal precompiled host tools archive to use in another buildroot.
+
 	config BUILD_SUFFIX
 		string "Build suffix to append to the target BUILD_DIR variable" if DEVEL
 		default ""
@@ -63,7 +80,6 @@ menuconfig DEVEL
 
 	config CCACHE
 		bool "Use ccache" if DEVEL
-		default n
 		help
 		  Compiler cache; see https://ccache.samba.org/
 
diff --git a/config/Config-images.in b/config/Config-images.in
index dcd7575c3e4535..c37537b1a71cda 100644
--- a/config/Config-images.in
+++ b/config/Config-images.in
@@ -17,6 +17,7 @@ menu "Target Images"
 			default TARGET_INITRAMFS_COMPRESSION_LZMA if TARGET_lantiq
 			default TARGET_INITRAMFS_COMPRESSION_LZMA if TARGET_mpc85xx
 			default TARGET_INITRAMFS_COMPRESSION_LZMA if TARGET_ramips
+			default TARGET_INITRAMFS_COMPRESSION_ZSTD if TARGET_qualcommax
 			default TARGET_INITRAMFS_COMPRESSION_XZ if USES_SEPARATE_INITRAMFS
 			default TARGET_INITRAMFS_COMPRESSION_NONE
 			depends on TARGET_ROOTFS_INITRAMFS
@@ -36,18 +37,15 @@ menu "Target Images"
 				bool "lzma"
 
 			config TARGET_INITRAMFS_COMPRESSION_LZO
-				depends on !TARGET_ROOTFS_INITRAMFS_SEPARATE
 				bool "lzo"
 
 			config TARGET_INITRAMFS_COMPRESSION_LZ4
-				depends on !TARGET_ROOTFS_INITRAMFS_SEPARATE
 				bool "lz4"
 
 			config TARGET_INITRAMFS_COMPRESSION_XZ
 				bool "xz"
 
 			config TARGET_INITRAMFS_COMPRESSION_ZSTD
-				depends on !LINUX_5_4 && !LINUX_4_19
 				bool "zstd"
 		endchoice
 
@@ -61,7 +59,6 @@ menu "Target Images"
 		config TARGET_INITRAMFS_FORCE
 			bool "Force"
 			depends on TARGET_ROOTFS_INITRAMFS
-			default n
 			help
 			  Ignore the initramfs passed by the bootloader.
 
@@ -130,7 +127,6 @@ menu "Target Images"
 		config TARGET_EXT4_JOURNAL
 			bool "Create a journaling filesystem"
 			depends on TARGET_ROOTFS_EXT4FS
-			default n
 			help
 			  Create an ext4 filesystem with a journal.
 
@@ -151,7 +147,7 @@ menu "Target Images"
 		bool "squashfs"
 		default y if USES_SQUASHFS
 		help
-		  Build a squashfs-lzma root filesystem.
+		  Build a squashfs root filesystem.
 
 		config TARGET_SQUASHFS_BLOCK_SIZE
 			int "Block size (in KiB)"
@@ -159,6 +155,9 @@ menu "Target Images"
 			default 64 if LOW_MEMORY_FOOTPRINT
 			default 1024 if (SMALL_FLASH && !LOW_MEMORY_FOOTPRINT)
 			default 256
+			help
+			  Select squashfs block size, must be one of:
+			    4, 8, 16, 32, 64, 128, 256, 512, 1024
 
 	menuconfig TARGET_ROOTFS_UBIFS
 		bool "ubifs"
@@ -205,11 +204,12 @@ menu "Target Images"
 
 	config GRUB_EFI_IMAGES
 		bool "Build GRUB EFI images (Linux x86 or x86_64 host only)"
-		depends on TARGET_x86
+		depends on TARGET_x86 || TARGET_armsr
 		depends on TARGET_ROOTFS_EXT4FS || TARGET_ROOTFS_JFFS2 || TARGET_ROOTFS_SQUASHFS
-		select PACKAGE_grub2
-		select PACKAGE_grub2-efi
-		select PACKAGE_grub2-bios-setup
+		select PACKAGE_grub2 if TARGET_x86
+		select PACKAGE_grub2-efi if TARGET_x86
+		select PACKAGE_grub2-bios-setup if TARGET_x86
+		select PACKAGE_grub2-efi-arm if TARGET_armsr
 		select PACKAGE_kmod-fs-vfat
 		default y
 
@@ -232,7 +232,6 @@ menu "Target Images"
 	config GRUB_FLOWCONTROL
 		bool "Use RTE/CTS on serial console"
 		depends on GRUB_SERIAL != ""
-		default n
 
 	config GRUB_BOOTOPTS
 		string "Extra kernel boot options"
@@ -268,7 +267,7 @@ menu "Target Images"
 
 	config VMDK_IMAGES
 		bool "Build VMware image files (VMDK)"
-		depends on TARGET_x86
+		depends on TARGET_x86 || TARGET_armsr
 		depends on GRUB_IMAGES || GRUB_EFI_IMAGES
 		select PACKAGE_kmod-e1000
 
@@ -280,18 +279,20 @@ menu "Target Images"
 
 	config TARGET_IMAGES_GZIP
 		bool "GZip images"
-		depends on TARGET_ROOTFS_EXT4FS || TARGET_x86 || TARGET_armvirt || TARGET_malta
+		depends on TARGET_ROOTFS_EXT4FS || TARGET_x86 || TARGET_armsr || TARGET_malta
 		default y
 
 	comment "Image Options"
 
 	source "target/linux/*/image/Config.in"
+	source "target/linux/*/*/image/Config.in"
 
 	config TARGET_KERNEL_PARTSIZE
 		int "Kernel partition size (in MiB)"
 		depends on USES_BOOT_PART
 		default 8 if TARGET_apm821xx_sata
 		default 64 if TARGET_bcm27xx
+		default 128 if TARGET_armsr
 		default 16
 
 	config TARGET_ROOTFS_PARTSIZE
@@ -311,7 +312,6 @@ menu "Target Images"
 
 	config TARGET_ROOTFS_PERSIST_VAR
 		bool "Make /var persistent"
-		default n
 		help
 		  Do not symlink /var to /tmp, so that its content will persist
 		  across reboots. When enabled, /var/run will still be linked
diff --git a/config/Config-kernel.in b/config/Config-kernel.in
index f1ee919ee337dc..7de0d17b5eaa58 100644
--- a/config/Config-kernel.in
+++ b/config/Config-kernel.in
@@ -47,12 +47,10 @@ config KERNEL_MIPS_FP_SUPPORT
 
 config KERNEL_ARM_PMU
 	bool
-	default n
 	depends on (arm || aarch64)
 
 config KERNEL_X86_VSYSCALL_EMULATION
 	bool "Enable vsyscall emulation"
-	default n
 	depends on x86_64
 	help
 	  This enables emulation of the legacy vsyscall page.  Disabling
@@ -70,12 +68,10 @@ config KERNEL_X86_VSYSCALL_EMULATION
 
 config KERNEL_PERF_EVENTS
 	bool "Compile the kernel with performance events and counters"
-	default n
 	select KERNEL_ARM_PMU if (arm || aarch64)
 
 config KERNEL_PROFILING
 	bool "Compile the kernel with profiling enabled"
-	default n
 	select KERNEL_PERF_EVENTS
 	help
 	  Enable the extended profiling support mechanisms used by profilers such
@@ -255,7 +251,6 @@ config KERNEL_KCOV_INSTRUMENT_ALL
 
 config KERNEL_TASKSTATS
 	bool "Compile the kernel with task resource/io statistics and accounting"
-	default n
 	help
 	  Enable the collection and publishing of task/io statistics and
 	  accounting.  Enable this option to enable i/o monitoring in system
@@ -283,37 +278,30 @@ config KERNEL_KALLSYMS
 config KERNEL_FTRACE
 	bool "Compile the kernel with tracing support"
 	depends on !TARGET_uml
-	default n
 
 config KERNEL_FTRACE_SYSCALLS
 	bool "Trace system calls"
 	depends on KERNEL_FTRACE
-	default n
 
 config KERNEL_ENABLE_DEFAULT_TRACERS
 	bool "Trace process context switches and events"
 	depends on KERNEL_FTRACE
-	default n
 
 config KERNEL_FUNCTION_TRACER
 	bool "Function tracer"
 	depends on KERNEL_FTRACE
-	default n
 
 config KERNEL_FUNCTION_GRAPH_TRACER
 	bool "Function graph tracer"
 	depends on KERNEL_FUNCTION_TRACER
-	default n
 
 config KERNEL_DYNAMIC_FTRACE
 	bool "Enable/disable function tracing dynamically"
 	depends on KERNEL_FUNCTION_TRACER
-	default n
 
 config KERNEL_FUNCTION_PROFILER
 	bool "Function profiler"
 	depends on KERNEL_FUNCTION_TRACER
-	default n
 
 config KERNEL_IRQSOFF_TRACER
 	bool "Interrupts-off Latency Tracer"
@@ -364,7 +352,6 @@ config KERNEL_HIST_TRIGGERS
 
 config KERNEL_DEBUG_KERNEL
 	bool
-	default n
 
 config KERNEL_DEBUG_INFO
 	bool "Compile the kernel with debug information"
@@ -376,7 +363,6 @@ config KERNEL_DEBUG_INFO
 config KERNEL_DEBUG_INFO_BTF
 
 	bool "Enable additional BTF type information"
-	default n
 	depends on !HOST_OS_MACOS
 	depends on KERNEL_DEBUG_INFO && !KERNEL_DEBUG_INFO_REDUCED
 	select DWARVES
@@ -387,6 +373,16 @@ config KERNEL_DEBUG_INFO_BTF
 
 	  Required to run BPF CO-RE applications.
 
+config KERNEL_MODULE_ALLOW_BTF_MISMATCH
+	bool "Allow loading modules with non-matching BTF type info"
+	depends on KERNEL_DEBUG_INFO_BTF
+	help
+	  For modules whose split BTF does not match vmlinux, load without
+	  BTF rather than refusing to load. The default behavior with
+	  module BTF enabled is to reject modules with such mismatches;
+	  this option will still load module BTF where possible but ignore
+	  it when a mismatch is found.
+
 config KERNEL_DEBUG_INFO_REDUCED
 	bool "Reduce debugging information"
 	default y
@@ -401,6 +397,21 @@ config KERNEL_DEBUG_INFO_REDUCED
 	  DEBUG_INFO build and compile times are reduced too.
 	  Only works with newer gcc versions.
 
+config KERNEL_FRAME_WARN
+	int
+	range 0 8192
+	default 1280 if KERNEL_KASAN && !ARCH_64BIT
+	default 1024 if !ARCH_64BIT
+	default 2048 if ARCH_64BIT
+	help
+	  Tell the compiler to warn at build time for stack frames larger than this.
+	  Setting this too low will cause a lot of warnings.
+	  Setting it to 0 disables the warning.
+
+# KERNEL_DEBUG_LL symbols must have the default value set as otherwise
+# KConfig wont evaluate them unless KERNEL_EARLY_PRINTK is selected
+# which means that buildroot wont override the DEBUG_LL symbols in target
+# kernel configurations and lead to devices that dont have working console
 config KERNEL_DEBUG_LL_UART_NONE
 	bool
 	default n
@@ -417,7 +428,6 @@ config KERNEL_DEBUG_LL
 config KERNEL_DEBUG_VIRTUAL
 	bool "Compile the kernel with VM translations debugging"
 	select KERNEL_DEBUG_KERNEL
-	default n
 	help
 	  Enable checks sanity checks to catch invalid uses of
 	  virt_to_phys()/phys_to_virt() against the non-linear address space.
@@ -425,7 +435,6 @@ config KERNEL_DEBUG_VIRTUAL
 config KERNEL_DYNAMIC_DEBUG
 	bool "Compile the kernel with dynamic printk"
 	select KERNEL_DEBUG_FS
-	default n
 	help
 	  Compiles debug level messages into the kernel, which would not
 	  otherwise be available at runtime. These messages can then be
@@ -437,7 +446,6 @@ config KERNEL_DYNAMIC_DEBUG
 config KERNEL_EARLY_PRINTK
 	bool "Compile the kernel with early printk"
 	default y if TARGET_bcm53xx
-	default n
 	depends on arm
 	select KERNEL_DEBUG_KERNEL
 	select KERNEL_DEBUG_LL if arm
@@ -448,7 +456,6 @@ config KERNEL_EARLY_PRINTK
 
 config KERNEL_KPROBES
 	bool "Compile the kernel with kprobes support"
-	default n
 	select KERNEL_FTRACE
 	select KERNEL_PERF_EVENTS
 	help
@@ -465,7 +472,6 @@ config KERNEL_KPROBE_EVENTS
 
 config KERNEL_BPF_EVENTS
 	bool "Compile the kernel with BPF event support"
-	default n
 	select KERNEL_KPROBES
 	help
 	  Allows to attach BPF programs to kprobe, uprobe and tracepoint events.
@@ -475,8 +481,8 @@ config KERNEL_BPF_EVENTS
 
 config KERNEL_BPF_KPROBE_OVERRIDE
 	bool
-	default n
 	depends on KERNEL_KPROBES
+	default n
 
 config KERNEL_AIO
 	bool "Compile the kernel with asynchronous IO support"
@@ -484,7 +490,8 @@ config KERNEL_AIO
 
 config KERNEL_IO_URING
 	bool "Compile the kernel with io_uring support"
-	default y if !SMALL_FLASH
+	depends on !SMALL_FLASH
+	default y if (x86_64 || aarch64)
 
 config KERNEL_FHANDLE
 	bool "Compile the kernel with support for fhandle syscalls"
@@ -496,7 +503,6 @@ config KERNEL_FANOTIFY
 
 config KERNEL_BLK_DEV_BSG
 	bool "Compile the kernel with SCSI generic v4 support for any block device"
-	default n
 
 config KERNEL_TRANSPARENT_HUGEPAGE
 	bool
@@ -520,7 +526,6 @@ config KERNEL_HUGETLB_PAGE
 	bool "Compile the kernel with HugeTLB support"
 	select KERNEL_TRANSPARENT_HUGEPAGE
 	select KERNEL_HUGETLBFS
-	default n
 
 config KERNEL_MAGIC_SYSRQ
 	bool "Compile the kernel with SysRq support"
@@ -545,7 +550,6 @@ config KERNEL_ELF_CORE
 config KERNEL_PROVE_LOCKING
 	bool "Enable kernel lock checking"
 	select KERNEL_DEBUG_KERNEL
-	default n
 
 config KERNEL_SOFTLOCKUP_DETECTOR
 	bool "Compile the kernel with detect Soft Lockups"
@@ -559,6 +563,18 @@ config KERNEL_SOFTLOCKUP_DETECTOR
 	  chance to run.  The current stack trace is displayed upon
 	  detection and the system will stay locked up.
 
+config KERNEL_HARDLOCKUP_DETECTOR
+	bool "Compile the kernel with detect Hard Lockups"
+	depends on KERNEL_DEBUG_KERNEL
+	help
+	  Say Y here to enable the kernel to act as a watchdog to detect
+	  hard lockups.
+
+	  Hardlockups are bugs that cause the CPU to loop in kernel mode
+	  for more than 10 seconds, without letting other interrupts have a
+	  chance to run.  The current stack trace is displayed upon detection
+	  and the system will stay locked up.
+
 config KERNEL_DETECT_HUNG_TASK
 	bool "Compile the kernel with detect Hung Tasks"
 	depends on KERNEL_DEBUG_KERNEL
@@ -647,11 +663,9 @@ config USE_RFKILL
 
 config USE_SPARSE
 	bool "Enable sparse check during kernel build"
-	default n
 
 config KERNEL_DEVTMPFS
 	bool "Compile the kernel with device tmpfs enabled"
-	default n
 	help
 	  devtmpfs is a simple, kernel-managed /dev filesystem. The kernel creates
 	  devices nodes for all registered devices to simplify boot, but leaves more
@@ -661,7 +675,6 @@ if KERNEL_DEVTMPFS
 
 	config KERNEL_DEVTMPFS_MOUNT
 		bool "Automatically mount devtmpfs after root filesystem is mounted"
-		default n
 
 endif
 
@@ -672,17 +685,14 @@ config KERNEL_KEYS
 config KERNEL_PERSISTENT_KEYRINGS
 	bool "Enable kernel persistent keyrings"
 	depends on KERNEL_KEYS
-	default n
 
 config KERNEL_KEYS_REQUEST_CACHE
 	bool "Enable temporary caching of the last request_key() result"
 	depends on KERNEL_KEYS
-	default n
 
 config KERNEL_BIG_KEYS
 	bool "Enable large payload keys on kernel keyrings"
 	depends on KERNEL_KEYS
-	default n
 
 #
 # CGROUP support symbols
@@ -696,7 +706,6 @@ if KERNEL_CGROUPS
 
 	config KERNEL_CGROUP_DEBUG
 		bool "Example debug cgroup subsystem"
-		default n
 		help
 		  This option enables a simple cgroup subsystem that
 		  exports useful debugging information about the cgroups
@@ -707,7 +716,6 @@ if KERNEL_CGROUPS
 
 	config KERNEL_CGROUP_FREEZER
 		bool "legacy Freezer cgroup subsystem"
-		default n
 		select KERNEL_FREEZER
 		help
 		  Provides a way to freeze and unfreeze all tasks in a
@@ -717,7 +725,6 @@ if KERNEL_CGROUPS
 
 	config KERNEL_CGROUP_DEVICE
 		bool "legacy Device controller for cgroups"
-		default n
 		help
 		  Provides a cgroup implementing whitelists for devices which
 		  a process in the cgroup can mknod or open.
@@ -725,7 +732,6 @@ if KERNEL_CGROUPS
 
 	config KERNEL_CGROUP_HUGETLB
 		bool "HugeTLB controller"
-		default n
 		select KERNEL_HUGETLB_PAGE
 
 	config KERNEL_CGROUP_PIDS
@@ -754,7 +760,6 @@ if KERNEL_CGROUPS
 
 	config KERNEL_PROC_PID_CPUSET
 		bool "Include legacy /proc/<pid>/cpuset file"
-		default n
 		depends on KERNEL_CPUSETS
 
 	config KERNEL_CGROUP_CPUACCT
@@ -779,7 +784,7 @@ if KERNEL_CGROUPS
 		bool "Memory Resource Controller for Control Groups"
 		default y
 		select KERNEL_FREEZER
-		depends on KERNEL_RESOURCE_COUNTERS || !LINUX_3_18
+		depends on KERNEL_RESOURCE_COUNTERS
 		help
 		  Provides a memory resource controller that manages both anonymous
 		  memory and page cache. (See Documentation/cgroups/memory.txt)
@@ -820,7 +825,6 @@ if KERNEL_CGROUPS
 
 	config KERNEL_MEMCG_SWAP_ENABLED
 		bool "Memory Resource Controller Swap Extension enabled by default"
-		default n
 		depends on KERNEL_MEMCG_SWAP
 		help
 		  Memory Resource Controller Swap Extension comes with its price in
@@ -849,7 +853,6 @@ if KERNEL_CGROUPS
 	config KERNEL_CGROUP_PERF
 		bool "Enable perf_event per-cpu per-container group (cgroup) monitoring"
 		select KERNEL_PERF_EVENTS
-		default n
 		help
 		  This option extends the per-cpu mode to restrict monitoring to
 		  threads which belong to the cgroup specified and run on the
@@ -926,7 +929,6 @@ if KERNEL_CGROUPS
 
 	config KERNEL_DEBUG_BLK_CGROUP
 		bool "Enable Block IO controller debugging"
-		default n
 		depends on KERNEL_BLK_CGROUP
 		help
 		  Enable some debugging help. Currently it exports additional stat
@@ -934,15 +936,12 @@ if KERNEL_CGROUPS
 
 	config KERNEL_NET_CLS_CGROUP
 		bool "legacy Control Group Classifier"
-		default n
 
 	config KERNEL_CGROUP_NET_CLASSID
 		bool "legacy Network classid cgroup"
-		default n
 
 	config KERNEL_CGROUP_NET_PRIO
 		bool "legacy Network priority cgroup"
-		default n
 
 endif
 
@@ -1108,6 +1107,28 @@ config KERNEL_NET_L3_MASTER_DEV
 	  This module provides glue between core networking code and device
 	  drivers to support L3 master devices like VRF.
 
+config KERNEL_WIRELESS_EXT
+	def_bool n
+
+config KERNEL_WEXT_CORE
+	def_bool KERNEL_WIRELESS_EXT
+
+config KERNEL_WEXT_PRIV
+	def_bool KERNEL_WIRELESS_EXT
+
+config KERNEL_WEXT_PROC
+	def_bool KERNEL_WIRELESS_EXT
+
+config KERNEL_WEXT_SPY
+	def_bool KERNEL_WIRELESS_EXT
+
+config KERNEL_PAGE_POOL
+	def_bool n
+
+config KERNEL_PAGE_POOL_STATS
+	bool "Page pool stats support"
+	depends on KERNEL_PAGE_POOL
+
 #
 # NFS related symbols
 #
@@ -1145,7 +1166,6 @@ endif
 menu "Filesystem ACL and attr support options"
 	config USE_FS_ACL_ATTR
 		bool "Use filesystem ACL and attr support by default"
-		default n
 		help
 		  Make using ACLs (e.g. POSIX ACL, NFSv4 ACL) the default
 		  for kernel and packages, except tmpfs, flash filesystems,
@@ -1170,17 +1190,14 @@ menu "Filesystem ACL and attr support options"
 	config KERNEL_F2FS_FS_POSIX_ACL
 		bool "Enable POSIX ACL for F2FS Filesystems"
 		select KERNEL_FS_POSIX_ACL
-		default n
 
 	config KERNEL_JFFS2_FS_POSIX_ACL
 		bool "Enable POSIX ACL for JFFS2 Filesystems"
 		select KERNEL_FS_POSIX_ACL
-		default n
 
 	config KERNEL_TMPFS_POSIX_ACL
 		bool "Enable POSIX ACL for TMPFS Filesystems"
 		select KERNEL_FS_POSIX_ACL
-		default n
 
 	config KERNEL_CIFS_ACL
 		bool "Enable CIFS ACLs"
@@ -1203,15 +1220,12 @@ menu "Filesystem ACL and attr support options"
 
 	config KERNEL_NFS_V3_ACL_SUPPORT
 		bool "Enable ACLs for NFSv3"
-		default n
 
 	config KERNEL_NFSD_V2_ACL_SUPPORT
 		bool "Enable ACLs for NFSDv2"
-		default n
 
 	config KERNEL_NFSD_V3_ACL_SUPPORT
 		bool "Enable ACLs for NFSDv3"
-		default n
 
 	config KERNEL_REISER_FS_POSIX_ACL
 		bool "Enable POSIX ACLs for ReiserFS"
diff --git a/feeds.conf.default b/feeds.conf.default
index 50ae67cb9dba99..fc679335e0e47f 100644
--- a/feeds.conf.default
+++ b/feeds.conf.default
@@ -1,8 +1,8 @@
-src-git-full packages https://git.openwrt.org/feed/packages.git
-src-git-full luci https://git.openwrt.org/project/luci.git
-src-git-full routing https://git.openwrt.org/feed/routing.git
-src-git-full telephony https://git.openwrt.org/feed/telephony.git
-#src-git-full video https://github.com/openwrt/video.git
-#src-git-full targets https://github.com/openwrt/targets.git
-#src-git-full oldpackages http://git.openwrt.org/packages.git
+src-git packages https://git.openwrt.org/feed/packages.git
+src-git luci https://git.openwrt.org/project/luci.git
+src-git routing https://git.openwrt.org/feed/routing.git
+src-git telephony https://git.openwrt.org/feed/telephony.git
+#src-git video https://github.com/openwrt/video.git
+#src-git targets https://github.com/openwrt/targets.git
+#src-git oldpackages http://git.openwrt.org/packages.git
 #src-link custom /usr/src/openwrt/custom-feed
diff --git a/include/autotools.mk b/include/autotools.mk
index f659bac3c5beda..d0e4b3642f5371 100644
--- a/include/autotools.mk
+++ b/include/autotools.mk
@@ -23,7 +23,10 @@ AM_TOOL_PATHS:= \
 	LIBTOOLIZE=$(STAGING_DIR_HOST)/bin/libtoolize \
 	LIBTOOL=$(STAGING_DIR_HOST)/bin/libtool \
 	M4=$(STAGING_DIR_HOST)/bin/m4 \
-	AUTOPOINT=true
+	AUTOPOINT=true \
+	GTKDOCIZE=true
+
+AM_TOOL_PATHS_FAKE:=$(subst = ,=,$(patsubst "%,"$(TRUE)",$(subst =,= ",$(AM_TOOL_PATHS))))
 
 # 1: build dir
 # 2: remove files
@@ -123,13 +126,6 @@ ifneq ($(filter libtool-abiver,$(PKG_FIXUP)),)
   Hooks/Configure/Post += set_libtool_abiver
 endif
 
-ifneq ($(filter libtool-ucxx,$(PKG_FIXUP)),)
-  PKG_BUILD_DEPENDS += libtool
- ifeq ($(filter no-autoreconf,$(PKG_FIXUP)),)
-  Hooks/Configure/Pre += autoreconf_target
- endif
-endif
-
 ifneq ($(filter autoreconf,$(PKG_FIXUP)),)
   ifeq ($(filter autoreconf,$(Hooks/Configure/Pre)),)
     Hooks/Configure/Pre += autoreconf_target
@@ -165,12 +161,6 @@ ifneq ($(filter libtool,$(HOST_FIXUP)),)
  endif
 endif
 
-ifneq ($(filter libtool-ucxx,$(HOST_FIXUP)),)
- ifeq ($(filter no-autoreconf,$(HOST_FIXUP)),)
-  Hooks/HostConfigure/Pre += autoreconf_host
- endif
-endif
-
 ifneq ($(filter autoreconf,$(HOST_FIXUP)),)
   ifeq ($(filter autoreconf,$(Hooks/HostConfigure/Pre)),)
     Hooks/HostConfigure/Pre += autoreconf_host
diff --git a/include/bpf.mk b/include/bpf.mk
index 7d0cfbd76db45e..ec3f04e1e9e169 100644
--- a/include/bpf.mk
+++ b/include/bpf.mk
@@ -63,13 +63,15 @@ BPF_CFLAGS := \
 	-Wno-unused-label \
 	-O2 -emit-llvm -Xclang -disable-llvm-passes
 
-ifeq ($(DUMP),)
+ifneq ($(CONFIG_HAS_BPF_TOOLCHAIN),)
+ifeq ($(DUMP)$(filter download refresh,$(MAKECMDGOALS)),)
   CLANG_VER:=$(shell $(CLANG) -dM -E - < /dev/null | grep __clang_major__ | cut -d' ' -f3)
   CLANG_VER_VALID:=$(shell [ "$(CLANG_VER)" -ge "$(CLANG_MIN_VER)" ] && echo 1 )
   ifeq ($(CLANG_VER_VALID),)
     $(error ERROR: LLVM/clang version too old. Minimum required: $(CLANG_MIN_VER), found: $(CLANG_VER))
   endif
 endif
+endif
 
 define CompileBPF
 	$(CLANG) -g -target $(BPF_ARCH)-linux-gnu $(BPF_CFLAGS) $(2) \
diff --git a/include/depends.mk b/include/depends.mk
index 073fb03632ba30..a858d4b033eb47 100644
--- a/include/depends.mk
+++ b/include/depends.mk
@@ -12,6 +12,7 @@
 DEP_FINDPARAMS := -x "*/.svn*" -x ".*" -x "*:*" -x "*\!*" -x "* *" -x "*\\\#*" -x "*/.*_check" -x "*/.*.swp" -x "*/.pkgdir*"
 
 find_md5=find $(wildcard $(1)) -type f $(patsubst -x,-and -not -path,$(DEP_FINDPARAMS) $(2)) -printf "%p%T@\n" | sort | $(MKHASH) md5
+find_md5_reproducible=find $(wildcard $(1)) -type f $(patsubst -x,-and -not -path,$(DEP_FINDPARAMS) $(2)) -print0 | xargs -0 $(MKHASH) md5 | sort | $(MKHASH) md5
 
 define rdep
   .PRECIOUS: $(2)
diff --git a/include/download.mk b/include/download.mk
index 76bd374cf7e349..9ab0b6c08fca7b 100644
--- a/include/download.mk
+++ b/include/download.mk
@@ -18,6 +18,10 @@ endif
 
 DOWNLOAD_RDEP=$(STAMP_PREPARED) $(HOST_STAMP_PREPARED)
 
+# Export options for download.pl
+export DOWNLOAD_CHECK_CERTIFICATE:=$(CONFIG_DOWNLOAD_CHECK_CERTIFICATE)
+export DOWNLOAD_TOOL_CUSTOM:=$(CONFIG_DOWNLOAD_TOOL_CUSTOM)
+
 define dl_method_git
 $(if $(filter https://github.com/% git://github.com/%,$(1)),github_archive,git)
 endef
@@ -183,7 +187,7 @@ define DownloadMethod/svn
 		svn export --non-interactive --trust-server-cert -r$(VERSION) $(URL) $(SUBDIR) || \
 		svn export --non-interactive -r$(VERSION) $(URL) $(SUBDIR) ) && \
 		echo "Packing checkout..." && \
-		export TAR_TIMESTAMP="" && \
+		export TAR_TIMESTAMP="`svn info -r$(VERSION) --show-item last-changed-date $(URL)`" && \
 		$(call dl_tar_pack,$(TMP_DIR)/dl/$(FILE),$(SUBDIR)) && \
 		mv $(TMP_DIR)/dl/$(FILE) $(DL_DIR)/ && \
 		rm -rf $(SUBDIR); \
diff --git a/include/host-build.mk b/include/host-build.mk
index f06dd802301327..dba6b819da6349 100644
--- a/include/host-build.mk
+++ b/include/host-build.mk
@@ -21,11 +21,12 @@ include $(INCLUDE_DIR)/depends.mk
 include $(INCLUDE_DIR)/quilt.mk
 
 BUILD_TYPES += host
-HOST_STAMP_PREPARED=$(HOST_BUILD_DIR)/.prepared$(if $(HOST_QUILT)$(DUMP),,$(shell $(call find_md5,${CURDIR} $(PKG_FILE_DEPENDS),))_$(call confvar,CONFIG_AUTOREMOVE $(HOST_PREPARED_DEPENDS)))
+HOST_STAMP_PREPARED=$(HOST_BUILD_DIR)/.prepared$(if $(HOST_QUILT)$(DUMP),,$(shell $(call $(if $(CONFIG_AUTOREMOVE),find_md5_reproducible,find_md5),${CURDIR} $(PKG_FILE_DEPENDS),))_$(call confvar,CONFIG_AUTOREMOVE $(HOST_PREPARED_DEPENDS)))
 HOST_STAMP_CONFIGURED:=$(HOST_BUILD_DIR)/.configured
 HOST_STAMP_BUILT:=$(HOST_BUILD_DIR)/.built
 HOST_BUILD_PREFIX?=$(if $(IS_PACKAGE_BUILD),$(STAGING_DIR_HOSTPKG),$(STAGING_DIR_HOST))
 HOST_STAMP_INSTALLED:=$(HOST_BUILD_PREFIX)/stamp/.$(PKG_NAME)_installed
+HOST_STAMP_PROGRAMS:=$(foreach program,$(PKG_PROGRAMS),$(subst $(PKG_NAME),$(program),$(HOST_STAMP_INSTALLED)) )
 
 override MAKEFLAGS=
 
@@ -59,6 +60,7 @@ HOST_CONFIGURE_ARGS = \
 	--target=$(GNU_HOST_NAME) \
 	--host=$(GNU_HOST_NAME) \
 	--build=$(GNU_HOST_NAME) \
+	--disable-dependency-tracking \
 	--program-prefix="" \
 	--program-suffix="" \
 	--prefix=$(HOST_BUILD_PREFIX) \
@@ -130,6 +132,7 @@ define Host/Exports/Default
   $(1) : export STAGING_PREFIX=$$(HOST_BUILD_PREFIX)
   $(1) : export PKG_CONFIG_PATH=$$(STAGING_DIR_HOST)/lib/pkgconfig:$$(HOST_BUILD_PREFIX)/lib/pkgconfig
   $(1) : export PKG_CONFIG_LIBDIR=$$(HOST_BUILD_PREFIX)/lib/pkgconfig
+  $(1) : export GIT_CEILING_DIRECTORIES=$$(BUILD_DIR_HOST)
   $(if $(HOST_CONFIG_SITE),$(1) : export CONFIG_SITE:=$(HOST_CONFIG_SITE))
   $(if $(IS_PACKAGE_BUILD),$(1) : export PATH=$$(TARGET_PATH_PKG))
 endef
@@ -170,7 +173,7 @@ ifndef DUMP
 		$(foreach hook,$(Hooks/HostInstall/Post),$(call $(hook))$(sep))
 		mkdir -p $$(shell dirname $$@)
 		touch $(HOST_STAMP_BUILT)
-		touch $$@
+		touch $$@ $(HOST_STAMP_PROGRAMS)
 
   $(call DefaultTargets,$(patsubst %,host-%,$(DEFAULT_SUBDIR_TARGETS)))
   ifndef STAMP_BUILT
@@ -185,7 +188,7 @@ ifndef DUMP
 
   $(_host_target)host-prepare: $(HOST_STAMP_PREPARED)
   $(_host_target)host-configure: $(HOST_STAMP_CONFIGURED)
-  $(_host_target)host-compile: $(HOST_STAMP_BUILT) $(HOST_STAMP_INSTALLED)
+  $(_host_target)host-compile: $(HOST_STAMP_BUILT) $(HOST_STAMP_INSTALLED) $(HOST_STAMP_PROGRAMS)
   host-install: host-compile
 
   host-clean-build: FORCE
@@ -194,7 +197,7 @@ ifndef DUMP
 
   host-clean: host-clean-build
 	$(call Host/Clean)
-	rm -rf $(HOST_STAMP_INSTALLED)
+	rm -rf $(HOST_STAMP_INSTALLED) $(HOST_STAMP_PROGRAMS)
 
     ifneq ($(CONFIG_AUTOREMOVE),)
       host-compile:
@@ -206,5 +209,9 @@ endif
 
 define HostBuild
   $(HostBuild/Core)
-  $(if $(if $(PKG_HOST_ONLY),,$(if $(and $(filter host-%,$(MAKECMDGOALS)),$(PKG_SKIP_DOWNLOAD)),,$(STAMP_PREPARED))),,$(if $(strip $(PKG_SOURCE_URL)),$(call Download,default)))
+  $(if $(if $(PKG_HOST_ONLY),,$(if $(and $(filter host-%,$(MAKECMDGOALS)),$(PKG_SKIP_DOWNLOAD)),,$(STAMP_PREPARED))),,
+	$(if $(and $(CONFIG_AUTOREMOVE), $(wildcard $(HOST_STAMP_INSTALLED), $(wildcard $(HOST_STAMP_BUILT)))),,
+		$(if $(strip $(PKG_SOURCE_URL)),$(call Download,default))
+	)
+  )
 endef
diff --git a/include/image-commands.mk b/include/image-commands.mk
index 6fe2890a1af51c..1d694850195457 100644
--- a/include/image-commands.mk
+++ b/include/image-commands.mk
@@ -4,7 +4,7 @@ IMAGE_KERNEL = $(word 1,$^)
 IMAGE_ROOTFS = $(word 2,$^)
 
 define ModelNameLimit16
-$(shell expr substr "$(word 2, $(subst _, ,$(1)))" 1 16)
+$(shell printf %.16s "$(word 2, $(subst _, ,$(1)))")
 endef
 
 define rootfs_align
@@ -53,6 +53,7 @@ define Build/append-image-stage
 	cp "$(BIN_DIR)/$(DEVICE_IMG_PREFIX)-$(1)" "$@.stripmeta"
 	fwtool -s /dev/null -t "$@.stripmeta" || :
 	fwtool -i /dev/null -t "$@.stripmeta" || :
+	mkdir -p "$(STAGING_DIR_IMAGE)"
 	dd if="$@.stripmeta" of="$(STAGING_DIR_IMAGE)/$(BOARD)$(if $(SUBTARGET),-$(SUBTARGET))-$(DEVICE_NAME)-$(1)"
 	dd if="$@.stripmeta" >> "$@"
 	rm "$@.stripmeta"
@@ -105,7 +106,7 @@ endef
 define Build/append-squashfs-fakeroot-be
 	rm -rf $@.fakefs $@.fakesquashfs
 	mkdir $@.fakefs
-	$(STAGING_DIR_HOST)/bin/mksquashfs-lzma \
+	$(STAGING_DIR_HOST)/bin/mksquashfs3-lzma \
 		$@.fakefs $@.fakesquashfs \
 		-noappend -root-owned -be -nopad -b 65536 \
 		$(if $(SOURCE_DATE_EPOCH),-fixed-time $(SOURCE_DATE_EPOCH))
@@ -125,6 +126,13 @@ define Build/append-string
 	echo -n $(1) >> $@
 endef
 
+define Build/append-md5sum-ascii-salted
+	cp $@ $@.salted
+	echo -ne $(1) >> $@.salted
+	$(STAGING_DIR_HOST)/bin/mkhash md5 $@.salted | head -c32 >> $@
+	rm $@.salted
+endef
+
 define Build/append-ubi
 	sh $(TOPDIR)/scripts/ubinize-image.sh \
 		$(if $(UBOOTENV_IN_UBI),--uboot-env) \
@@ -218,6 +226,11 @@ define Build/copy-file
 	cat "$(1)" > "$@"
 endef
 
+define Build/edimax-header
+	$(STAGING_DIR_HOST)/bin/mkedimaximg -i $@ -o $@.new $(1)
+	@mv $@.new $@
+endef
+
 define Build/elecom-product-header
 	$(eval product=$(word 1,$(1)))
 	$(eval fw=$(if $(word 2,$(1)),$(word 2,$(1)),$@))
@@ -271,7 +284,9 @@ endef
 define Build/initrd_compression
 	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_BZIP2),.bzip2) \
 	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_GZIP),.gzip) \
+	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_LZ4),.lz4) \
 	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_LZMA),.lzma) \
+	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_LZO),.lzo) \
 	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_XZ),.xz) \
 	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_ZSTD),.zstd)
 endef
@@ -291,7 +306,8 @@ define Build/fit
 		-a $(KERNEL_LOADADDR) -e $(if $(KERNEL_ENTRY),$(KERNEL_ENTRY),$(KERNEL_LOADADDR)) \
 		$(if $(DEVICE_FDT_NUM),-n $(DEVICE_FDT_NUM)) \
 		$(if $(DEVICE_DTS_DELIMITER),-l $(DEVICE_DTS_DELIMITER)) \
-		$(if $(DEVICE_DTS_OVERLAY),$(foreach dtso,$(DEVICE_DTS_OVERLAY), -O $(dtso):$(KERNEL_BUILD_DIR)/image-$(dtso).dtb)) \
+		$(if $(DEVICE_DTS_LOADADDR),-s $(DEVICE_DTS_LOADADDR)) \
+		$(if $(DEVICE_DTS_OVERLAY),$(foreach dtso,$(DEVICE_DTS_OVERLAY), -O $(dtso):$(KERNEL_BUILD_DIR)/image-$(dtso).dtbo)) \
 		-c $(if $(DEVICE_DTS_CONFIG),$(DEVICE_DTS_CONFIG),"config-1") \
 		-A $(LINUX_KARCH) -v $(LINUX_VERSION)
 	PATH=$(LINUX_DIR)/scripts/dtc:$(PATH) mkimage $(if $(findstring external,$(word 3,$(1))),\
@@ -299,9 +315,23 @@ define Build/fit
 	@mv $@.new $@
 endef
 
+define Build/libdeflate-gzip
+	$(STAGING_DIR_HOST)/bin/libdeflate-gzip -f -12 -c $@ $(1) > $@.new
+	@mv $@.new $@
+endef
+
 define Build/gzip
-	gzip -f -9n -c $@ $(1) > $@.new
+	$(STAGING_DIR_HOST)/bin/gzip -f -9n -c $@ $(1) > $@.new
+	@mv $@.new $@
+endef
+
+define Build/gzip-filename
+	@mkdir -p $@.tmp
+	@cp $@ $@.tmp/$(word 1,$(1))
+	$(if $(SOURCE_DATE_EPOCH),touch -hcd "@$(SOURCE_DATE_EPOCH)" $@.tmp/$(word 1,$(1)) $(word 2,$(1)))
+	$(STAGING_DIR_HOST)/bin/gzip -f -9 -N -c $@.tmp/$(word 1,$(1)) $(word 2,$(1)) > $@.new
 	@mv $@.new $@
+	@rm -rf $@.tmp
 endef
 
 define Build/install-dtb
@@ -380,7 +410,7 @@ endef
 
 define Build/netgear-dni
 	$(STAGING_DIR_HOST)/bin/mkdniimg \
-		-B $(NETGEAR_BOARD_ID) -v $(VERSION_DIST).$(firstword $(subst -, ,$(REVISION))) \
+		-B $(NETGEAR_BOARD_ID) -v $(shell cat $(VERSION_DIST)| sed -e 's/[[:space:]]/-/g').$(firstword $(subst -, ,$(REVISION))) \
 		$(if $(NETGEAR_HW_ID),-H $(NETGEAR_HW_ID)) \
 		-r "$(1)" \
 		-i $@ -o $@.new
@@ -393,7 +423,7 @@ define Build/netgear-encrypted-factory
 		--output-file $@ \
 		--model $(NETGEAR_ENC_MODEL) \
 		--region $(NETGEAR_ENC_REGION) \
-		--version V1.0.0.0.$(VERSION_DIST).$(firstword $(subst -, ,$(REVISION))) \
+		--version V1.0.0.0.$(shell cat $(VERSION_DIST)| sed -e 's/[[:space:]]/-/g').$(firstword $(subst -, ,$(REVISION))) \
 		--encryption-block-size 0x20000 \
 		--openssl-bin "$(STAGING_DIR_HOST)/bin/openssl" \
 		--key 6865392d342b4d212964363d6d7e7765312c7132613364316e26322a5a5e2538 \
@@ -551,6 +581,7 @@ define Build/tplink-v2-image
 endef
 
 define Build/uImage
+	$(if $(UIMAGE_TIME),SOURCE_DATE_EPOCH="$(UIMAGE_TIME)") \
 	mkimage \
 		-A $(LINUX_KARCH) \
 		-O linux \
diff --git a/include/image.mk b/include/image.mk
index 9e4e9995816857..fae4d32a8bb99d 100644
--- a/include/image.mk
+++ b/include/image.mk
@@ -146,7 +146,7 @@ endif
 
 
 # Disable noisy checks by default as in upstream
-DTC_FLAGS += \
+DTC_WARN_FLAGS := \
   -Wno-unit_address_vs_reg \
   -Wno-simple_bus_reg \
   -Wno-unit_address_format \
@@ -159,6 +159,9 @@ DTC_FLAGS += \
   -Wno-graph_port \
   -Wno-unique_unit_address
 
+DTC_FLAGS += $(DTC_WARN_FLAGS)
+DTCO_FLAGS += $(DTC_WARN_FLAGS)
+
 define Image/pad-to
 	dd if=$(1) of=$(1).new bs=$(2) conv=sync
 	mv $(1).new $(1)
@@ -174,7 +177,7 @@ endef
 # $(2) target dtb file
 # $(3) extra CPP flags
 # $(4) extra DTC flags
-define Image/BuildDTB
+define Image/BuildDTB/sub
 	$(TARGET_CROSS)cpp -nostdinc -x assembler-with-cpp \
 		$(DTS_CPPFLAGS) \
 		-I$(DTS_DIR) \
@@ -183,12 +186,20 @@ define Image/BuildDTB
 		-undef -D__DTS__ $(3) \
 		-o $(2).tmp $(1)
 	$(LINUX_DIR)/scripts/dtc/dtc -O dtb \
-		-i$(dir $(1)) $(DTC_FLAGS) $(4) \
+		-i$(dir $(1)) $(4) \
 	$(if $(CONFIG_HAS_DT_OVERLAY_SUPPORT),-@) \
 		-o $(2) $(2).tmp
 	$(RM) $(2).tmp
 endef
 
+define Image/BuildDTB
+	$(call Image/BuildDTB/sub,$(1),$(2),$(3),$(DTC_FLAGS) $(DEVICE_DTC_FLAGS) $(4))
+endef
+
+define Image/BuildDTBO
+	$(call Image/BuildDTB/sub,$(1),$(2),$(3),$(DTCO_FLAGS) $(DEVICE_DTCO_FLAGS) $(4))
+endef
+
 define Image/mkfs/jffs2/sub-raw
 	$(STAGING_DIR_HOST)/bin/mkfs.jffs2 \
 		$(2) \
@@ -333,6 +344,8 @@ define Device/InitProfile
   DEVICE_ALT0_TITLE = $$(DEVICE_ALT0_VENDOR) $$(DEVICE_ALT0_MODEL)$$(if $$(DEVICE_ALT0_VARIANT), $$(DEVICE_ALT0_VARIANT))
   DEVICE_ALT1_TITLE = $$(DEVICE_ALT1_VENDOR) $$(DEVICE_ALT1_MODEL)$$(if $$(DEVICE_ALT1_VARIANT), $$(DEVICE_ALT1_VARIANT))
   DEVICE_ALT2_TITLE = $$(DEVICE_ALT2_VENDOR) $$(DEVICE_ALT2_MODEL)$$(if $$(DEVICE_ALT2_VARIANT), $$(DEVICE_ALT2_VARIANT))
+  DEVICE_ALT3_TITLE = $$(DEVICE_ALT3_VENDOR) $$(DEVICE_ALT3_MODEL)$$(if $$(DEVICE_ALT3_VARIANT), $$(DEVICE_ALT3_VARIANT))
+  DEVICE_ALT4_TITLE = $$(DEVICE_ALT4_VENDOR) $$(DEVICE_ALT4_MODEL)$$(if $$(DEVICE_ALT4_VARIANT), $$(DEVICE_ALT4_VARIANT))
   DEVICE_VENDOR :=
   DEVICE_MODEL :=
   DEVICE_VARIANT :=
@@ -345,6 +358,12 @@ define Device/InitProfile
   DEVICE_ALT2_VENDOR :=
   DEVICE_ALT2_MODEL :=
   DEVICE_ALT2_VARIANT :=
+  DEVICE_ALT3_VENDOR :=
+  DEVICE_ALT3_MODEL :=
+  DEVICE_ALT3_VARIANT :=
+  DEVICE_ALT4_VENDOR :=
+  DEVICE_ALT4_MODEL :=
+  DEVICE_ALT4_VARIANT :=
   DEVICE_PACKAGES :=
   DEVICE_DESCRIPTION = Build firmware images for $$(DEVICE_TITLE)
 endef
@@ -359,6 +378,7 @@ define Device/Init
   ARTIFACTS :=
   DEVICE_IMG_PREFIX := $(IMG_PREFIX)-$(1)
   DEVICE_IMG_NAME = $$(DEVICE_IMG_PREFIX)-$$(1)-$$(2)
+  FACTORY_IMG_NAME :=
   IMAGE_SIZE :=
   KERNEL_PREFIX = $$(DEVICE_IMG_PREFIX)
   KERNEL_SUFFIX := -kernel.bin
@@ -388,13 +408,17 @@ define Device/Init
   DEVICE_DTS_CONFIG :=
   DEVICE_DTS_DELIMITER :=
   DEVICE_DTS_DIR :=
+  DEVICE_DTS_LOADADDR :=
   DEVICE_DTS_OVERLAY :=
   DEVICE_FDT_NUM :=
+  DEVICE_DTC_FLAGS :=
+  DEVICE_DTCO_FLAGS :=
   SOC :=
 
   BOARD_NAME :=
   UIMAGE_MAGIC :=
   UIMAGE_NAME :=
+  UIMAGE_TIME :=
   DEVICE_COMPAT_VERSION := 1.0
   DEVICE_COMPAT_MESSAGE :=
   SUPPORTED_DEVICES := $(subst _,$(comma),$(1))
@@ -411,16 +435,20 @@ endef
 DEFAULT_DEVICE_VARS := \
   DEVICE_NAME KERNEL KERNEL_INITRAMFS KERNEL_INITRAMFS_IMAGE KERNEL_SIZE \
   CMDLINE UBOOTENV_IN_UBI KERNEL_IN_UBI BLOCKSIZE PAGESIZE SUBPAGESIZE \
-  VID_HDR_OFFSET UBINIZE_OPTS UBINIZE_PARTS MKUBIFS_OPTS DEVICE_DTS \
-  DEVICE_DTS_CONFIG DEVICE_DTS_DELIMITER DEVICE_DTS_DIR DEVICE_DTS_OVERLAY \
+  VID_HDR_OFFSET UBINIZE_OPTS UBINIZE_PARTS MKUBIFS_OPTS DEVICE_DTC_FLAGS \
+  DEVICE_DTCO_FLAGS DEVICE_DTS DEVICE_DTS_CONFIG DEVICE_DTS_DELIMITER \
+  DEVICE_DTS_DIR DEVICE_DTS_OVERLAY DEVICE_DTS_LOADADDR \
   DEVICE_FDT_NUM DEVICE_IMG_PREFIX SOC BOARD_NAME UIMAGE_MAGIC UIMAGE_NAME \
-  SUPPORTED_DEVICES IMAGE_METADATA KERNEL_ENTRY KERNEL_LOADADDR \
+  UIMAGE_TIME SUPPORTED_DEVICES IMAGE_METADATA KERNEL_ENTRY KERNEL_LOADADDR \
   UBOOT_PATH IMAGE_SIZE \
+  FACTORY_IMG_NAME FACTORY_SIZE \
   DEVICE_PACKAGES DEVICE_COMPAT_VERSION DEVICE_COMPAT_MESSAGE \
   DEVICE_VENDOR DEVICE_MODEL DEVICE_VARIANT \
   DEVICE_ALT0_VENDOR DEVICE_ALT0_MODEL DEVICE_ALT0_VARIANT \
   DEVICE_ALT1_VENDOR DEVICE_ALT1_MODEL DEVICE_ALT1_VARIANT \
-  DEVICE_ALT2_VENDOR DEVICE_ALT2_MODEL DEVICE_ALT2_VARIANT
+  DEVICE_ALT2_VENDOR DEVICE_ALT2_MODEL DEVICE_ALT2_VARIANT \
+  DEVICE_ALT3_VENDOR DEVICE_ALT3_MODEL DEVICE_ALT3_VARIANT \
+  DEVICE_ALT4_VENDOR DEVICE_ALT4_MODEL DEVICE_ALT4_VARIANT
 
 define Device/ExportVar
   $(1) : $(2):=$$($(2))
@@ -503,6 +531,12 @@ define Device/Build/initramfs
 	DEVICE_ALT2_VENDOR="$$(DEVICE_ALT2_VENDOR)" \
 	DEVICE_ALT2_MODEL="$$(DEVICE_ALT2_MODEL)" \
 	DEVICE_ALT2_VARIANT="$$(DEVICE_ALT2_VARIANT)" \
+	DEVICE_ALT3_VENDOR="$$(DEVICE_ALT3_VENDOR)" \
+	DEVICE_ALT3_MODEL="$$(DEVICE_ALT3_MODEL)" \
+	DEVICE_ALT3_VARIANT="$$(DEVICE_ALT3_VARIANT)" \
+	DEVICE_ALT4_VENDOR="$$(DEVICE_ALT4_VENDOR)" \
+	DEVICE_ALT4_MODEL="$$(DEVICE_ALT4_MODEL)" \
+	DEVICE_ALT4_VARIANT="$$(DEVICE_ALT4_VARIANT)" \
 	DEVICE_TITLE="$$(DEVICE_TITLE)" \
 	DEVICE_PACKAGES="$$(DEVICE_PACKAGES)" \
 	TARGET="$(BOARD)" \
@@ -517,7 +551,8 @@ endif
 define Device/Build/compile
   $$(_COMPILE_TARGET): $(KDIR)/$(1)
   $(eval $(call Device/Export,$(KDIR)/$(1)))
-  $(KDIR)/$(1):
+  $(KDIR)/$(1): FORCE
+	rm -f $(KDIR)/$(1)
 	$$(call concat_cmd,$(COMPILE/$(1)))
 
 endef
@@ -532,16 +567,33 @@ define Device/Build/dtb
   image_prepare: $(KDIR)/image-$(1).dtb
   endif
 
+endef
+
+define Device/Build/dtbo
+  ifndef BUILD_DTSO_$(1)
+  BUILD_DTSO_$(1) := 1
+  $(KDIR)/image-$(1).dtbo: FORCE
+	$(call Image/BuildDTBO,$(strip $(2))/$(strip $(3)).dtso,$$@)
+
+  image_prepare: $(KDIR)/image-$(1).dtbo
+  endif
+
 endef
 endif
 
 define Device/Build/kernel
-  $$(eval $$(foreach dts,$$(DEVICE_DTS) $$(DEVICE_DTS_OVERLAY), \
+  $$(eval $$(foreach dts,$$(DEVICE_DTS), \
 	$$(call Device/Build/dtb,$$(notdir $$(dts)), \
 		$$(if $$(DEVICE_DTS_DIR),$$(DEVICE_DTS_DIR),$$(DTS_DIR)), \
 		$$(dts) \
 	) \
   ))
+  $$(eval $$(foreach dtso,$$(DEVICE_DTS_OVERLAY), \
+	$$(call Device/Build/dtbo,$$(notdir $$(dtso)), \
+		$$(if $$(DEVICE_DTS_DIR),$$(DEVICE_DTS_DIR),$$(DTS_DIR)), \
+		$$(dtso) \
+	) \
+  ))
 
   $(KDIR)/$$(KERNEL_NAME):: image_prepare
   $$(_TARGET): $$(if $$(KERNEL_INSTALL),$(BIN_DIR)/$$(KERNEL_IMAGE))
@@ -610,6 +662,12 @@ define Device/Build/image
 	DEVICE_ALT2_VENDOR="$(DEVICE_ALT2_VENDOR)" \
 	DEVICE_ALT2_MODEL="$(DEVICE_ALT2_MODEL)" \
 	DEVICE_ALT2_VARIANT="$(DEVICE_ALT2_VARIANT)" \
+	DEVICE_ALT3_VENDOR="$(DEVICE_ALT3_VENDOR)" \
+	DEVICE_ALT3_MODEL="$(DEVICE_ALT3_MODEL)" \
+	DEVICE_ALT3_VARIANT="$(DEVICE_ALT3_VARIANT)" \
+	DEVICE_ALT4_VENDOR="$(DEVICE_ALT4_VENDOR)" \
+	DEVICE_ALT4_MODEL="$(DEVICE_ALT4_MODEL)" \
+	DEVICE_ALT4_VARIANT="$(DEVICE_ALT4_VARIANT)" \
 	DEVICE_TITLE="$(DEVICE_TITLE)" \
 	DEVICE_PACKAGES="$(DEVICE_PACKAGES)" \
 	TARGET="$(BOARD)" \
@@ -655,6 +713,12 @@ define Device/Build/artifact
 	DEVICE_ALT2_VENDOR="$(DEVICE_ALT2_VENDOR)" \
 	DEVICE_ALT2_MODEL="$(DEVICE_ALT2_MODEL)" \
 	DEVICE_ALT2_VARIANT="$(DEVICE_ALT2_VARIANT)" \
+	DEVICE_ALT3_VENDOR="$(DEVICE_ALT3_VENDOR)" \
+	DEVICE_ALT3_MODEL="$(DEVICE_ALT3_MODEL)" \
+	DEVICE_ALT3_VARIANT="$(DEVICE_ALT3_VARIANT)" \
+	DEVICE_ALT4_VENDOR="$(DEVICE_ALT4_VENDOR)" \
+	DEVICE_ALT4_MODEL="$(DEVICE_ALT4_MODEL)" \
+	DEVICE_ALT4_VARIANT="$(DEVICE_ALT4_VARIANT)" \
 	DEVICE_TITLE="$(DEVICE_TITLE)" \
 	DEVICE_PACKAGES="$(DEVICE_PACKAGES)" \
 	TARGET="$(BOARD)" \
@@ -696,6 +760,8 @@ $(if $(strip $(DEVICE_ALT0_TITLE)),Alternative device titles:
 - $(DEVICE_ALT0_TITLE))
 $(if $(strip $(DEVICE_ALT1_TITLE)),- $(DEVICE_ALT1_TITLE))
 $(if $(strip $(DEVICE_ALT2_TITLE)),- $(DEVICE_ALT2_TITLE))
+$(if $(strip $(DEVICE_ALT3_TITLE)),- $(DEVICE_ALT3_TITLE))
+$(if $(strip $(DEVICE_ALT4_TITLE)),- $(DEVICE_ALT4_TITLE))
 @@
 
 endef
@@ -713,6 +779,14 @@ ifneq ($$(strip $$(DEVICE_ALT2_TITLE)),)
 DEVICE_DISPLAY = $$(DEVICE_ALT2_TITLE) ($$(DEVICE_TITLE))
 $$(info $$(call Device/DumpInfo,$(1)))
 endif
+ifneq ($$(strip $$(DEVICE_ALT3_TITLE)),)
+DEVICE_DISPLAY = $$(DEVICE_ALT3_TITLE) ($$(DEVICE_TITLE))
+$$(info $$(call Device/DumpInfo,$(1)))
+endif
+ifneq ($$(strip $$(DEVICE_ALT4_TITLE)),)
+DEVICE_DISPLAY = $$(DEVICE_ALT4_TITLE) ($$(DEVICE_TITLE))
+$$(info $$(call Device/DumpInfo,$(1)))
+endif
 DEVICE_DISPLAY = $$(DEVICE_TITLE)
 $$(eval $$(if $$(DEVICE_TITLE),$$(info $$(call Device/DumpInfo,$(1)))))
 endef
diff --git a/include/kernel-5.15 b/include/kernel-5.15
index 8ebccec7fa386f..fc637450b53dfa 100644
--- a/include/kernel-5.15
+++ b/include/kernel-5.15
@@ -1,2 +1,2 @@
-LINUX_VERSION-5.15 = .67
-LINUX_KERNEL_HASH-5.15.67 = da47d9a80b694548835ccb553b6eb1a1f3f5d5cddd9e2bd6f4886b99ca14f940
+LINUX_VERSION-5.15 = .117
+LINUX_KERNEL_HASH-5.15.117 = a9a8331f3c0e004b40a41f30d688b53bf85405597ac41c2c89be7f4fbcf7239f
diff --git a/include/kernel-6.1 b/include/kernel-6.1
new file mode 100644
index 00000000000000..96a1eadb2a5ea6
--- /dev/null
+++ b/include/kernel-6.1
@@ -0,0 +1,2 @@
+LINUX_VERSION-6.1 = .34
+LINUX_KERNEL_HASH-6.1.34 = b26f7cbcbf8031efc49f11f236f372fc34a4fd5fc6ad3151b893d1aa038ed603
\ No newline at end of file
diff --git a/include/kernel-build.mk b/include/kernel-build.mk
index cc651f29b112a8..5b332258f8b8c5 100644
--- a/include/kernel-build.mk
+++ b/include/kernel-build.mk
@@ -10,7 +10,7 @@ ifneq ($(DUMP),1)
 endif
 
 KERNEL_FILE_DEPENDS=$(GENERIC_BACKPORT_DIR) $(GENERIC_PATCH_DIR) $(GENERIC_HACK_DIR) $(PATCH_DIR) $(GENERIC_FILES_DIR) $(FILES_DIR)
-STAMP_PREPARED=$(LINUX_DIR)/.prepared$(if $(QUILT)$(DUMP),,_$(shell $(call find_md5,$(KERNEL_FILE_DEPENDS),)))
+STAMP_PREPARED=$(LINUX_DIR)/.prepared$(if $(QUILT)$(DUMP),,_$(shell $(call $(if $(CONFIG_AUTOREMOVE),find_md5_reproducible,find_md5),$(KERNEL_FILE_DEPENDS),)))
 STAMP_CONFIGURED:=$(LINUX_DIR)/.configured
 include $(INCLUDE_DIR)/download.mk
 include $(INCLUDE_DIR)/quilt.mk
diff --git a/include/kernel-defaults.mk b/include/kernel-defaults.mk
index 2e2139201689fc..6a0251a9e2c966 100644
--- a/include/kernel-defaults.mk
+++ b/include/kernel-defaults.mk
@@ -21,7 +21,7 @@ Kernel/Patch:=$(Kernel/Patch/Default)
 ifneq (,$(findstring .xz,$(LINUX_SOURCE)))
   LINUX_CAT:=xzcat
 else
-  LINUX_CAT:=gzip -dc
+  LINUX_CAT:=$(STAGING_DIR_HOST)/bin/libdeflate-gzip -dc
 endif
 
 ifeq ($(strip $(CONFIG_EXTERNAL_KERNEL_TREE)),"")
@@ -75,6 +75,7 @@ endif
 	rm -f $(LINUX_DIR)/.config.prev
 	mv $(LINUX_DIR)/.config $(LINUX_DIR)/.config.old
 	$(call Kernel/SetInitramfs/PreConfigure)
+	echo "# CONFIG_INITRAMFS_PRESERVE_MTIME is not set" >> $(LINUX_DIR)/.config
   ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS_SEPARATE),y)
 	echo 'CONFIG_INITRAMFS_ROOT_UID=$(shell id -u)' >> $(LINUX_DIR)/.config
 	echo 'CONFIG_INITRAMFS_ROOT_GID=$(shell id -g)' >> $(LINUX_DIR)/.config
@@ -99,6 +100,7 @@ define Kernel/SetNoInitramfs
 	grep -v INITRAMFS $(LINUX_DIR)/.config.old > $(LINUX_DIR)/.config.set
 	echo 'CONFIG_INITRAMFS_SOURCE=""' >> $(LINUX_DIR)/.config.set
 	echo '# CONFIG_INITRAMFS_FORCE is not set' >> $(LINUX_DIR)/.config.set
+	echo "# CONFIG_INITRAMFS_PRESERVE_MTIME is not set" >> $(LINUX_DIR)/.config.set
 endef
 
 define Kernel/Configure/Default
@@ -117,7 +119,7 @@ define Kernel/Configure/Default
 		cp $(LINUX_DIR)/.config.set $(LINUX_DIR)/.config; \
 		cp $(LINUX_DIR)/.config.set $(LINUX_DIR)/.config.prev; \
 	}
-	$(_SINGLE) [ -d $(LINUX_DIR)/user_headers ] || $(KERNEL_MAKE) INSTALL_HDR_PATH=$(LINUX_DIR)/user_headers headers_install
+	$(_SINGLE) [ -d $(LINUX_DIR)/user_headers ] || $(KERNEL_MAKE) $(if $(findstring uml,$(BOARD)),ARCH=$(ARCH)) INSTALL_HDR_PATH=$(LINUX_DIR)/user_headers headers_install
 	grep '=[ym]' $(LINUX_DIR)/.config.set | LC_ALL=C sort | $(MKHASH) md5 > $(LINUX_DIR)/.vermagic
 endef
 
@@ -153,17 +155,12 @@ define Kernel/CopyImage
 	}
 endef
 
-# Always add "modules" so a proper Module.symvers file is written that
-# also contains symbols from the kernel modules. Without these symbols
-# external packages that depend on exported symbols from kernel modules
-# will fail to build.
 define Kernel/CompileImage/Default
 	rm -f $(TARGET_DIR)/init
-	+$(KERNEL_MAKE) $(KERNEL_MAKEOPTS_IMAGE) $(if $(KERNELNAME),$(KERNELNAME),all) modules
+	+$(KERNEL_MAKE) $(KERNEL_MAKEOPTS_IMAGE) $(if $(KERNELNAME),$(KERNELNAME),all)
 	$(call Kernel/CopyImage)
 endef
 
-# Here as well, always add "modules", see comment above.
 ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
 define Kernel/CompileImage/Initramfs
 	$(call Kernel/Configure/Initramfs)
@@ -177,15 +174,15 @@ else
 	( cd $(TARGET_DIR); find . | LC_ALL=C sort | $(STAGING_DIR_HOST)/bin/cpio --reproducible -o -H newc -R 0:0 > $(KERNEL_BUILD_DIR)/initrd.cpio )
 endif
 	$(if $(SOURCE_DATE_EPOCH),touch -hcd "@$(SOURCE_DATE_EPOCH)" $(KERNEL_BUILD_DIR)/initrd.cpio)
-	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_BZIP2),bzip2 -9 -c < $(KERNEL_BUILD_DIR)/initrd.cpio > $(KERNEL_BUILD_DIR)/initrd.cpio.bzip2)
-	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_GZIP),gzip -n -f -S .gzip -9n $(KERNEL_BUILD_DIR)/initrd.cpio)
+	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_BZIP2),$(STAGING_DIR_HOST)/bin/bzip2 -9 -c < $(KERNEL_BUILD_DIR)/initrd.cpio > $(KERNEL_BUILD_DIR)/initrd.cpio.bzip2)
+	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_GZIP),$(STAGING_DIR_HOST)/bin/libdeflate-gzip -n -f -S .gzip -12 $(KERNEL_BUILD_DIR)/initrd.cpio)
+	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_LZ4),$(STAGING_DIR_HOST)/bin/lz4c -l -c1 -fz --favor-decSpeed $(KERNEL_BUILD_DIR)/initrd.cpio)
 	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_LZMA),$(STAGING_DIR_HOST)/bin/lzma e -lc1 -lp2 -pb2 $(KERNEL_BUILD_DIR)/initrd.cpio $(KERNEL_BUILD_DIR)/initrd.cpio.lzma)
-# ?	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_LZO),)
+	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_LZO),$(STAGING_DIR_HOST)/bin/lzop -9 -f $(KERNEL_BUILD_DIR)/initrd.cpio)
 	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_XZ),$(STAGING_DIR_HOST)/bin/xz -T$(if $(filter 1,$(NPROC)),2,0) -9 -fz --check=crc32 $(KERNEL_BUILD_DIR)/initrd.cpio)
-# ?	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_LZ4),)
 	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_ZSTD),$(STAGING_DIR_HOST)/bin/zstd -T0 -f -o $(KERNEL_BUILD_DIR)/initrd.cpio.zstd $(KERNEL_BUILD_DIR)/initrd.cpio)
 endif
-	+$(KERNEL_MAKE) $(KERNEL_MAKEOPTS_IMAGE) $(if $(KERNELNAME),$(KERNELNAME),all) modules
+	+$(KERNEL_MAKE) $(KERNEL_MAKEOPTS_IMAGE) $(if $(KERNELNAME),$(KERNELNAME),all)
 	$(call Kernel/CopyImage,-initramfs)
 endef
 else
diff --git a/include/kernel-version.mk b/include/kernel-version.mk
index 1edb01df278571..958ed9be0c0b80 100644
--- a/include/kernel-version.mk
+++ b/include/kernel-version.mk
@@ -13,6 +13,15 @@ endif
 
 include $(KERNEL_DETAILS_FILE)
 
+ifdef KERNEL_TESTING_PATCHVER
+  KERNEL_TESTING_DETAILS_FILE=$(INCLUDE_DIR)/kernel-$(KERNEL_TESTING_PATCHVER)
+  ifeq ($(wildcard $(KERNEL_TESTING_DETAILS_FILE)),)
+    $(error Missing kernel version/hash file for $(KERNEL_TESTING_PATCHVER). Please create $(KERNEL_TESTING_DETAILS_FILE))
+  endif
+
+  include $(KERNEL_TESTING_DETAILS_FILE)
+endif
+
 remove_uri_prefix=$(subst git://,,$(subst http://,,$(subst https://,,$(1))))
 sanitize_uri=$(call qstrip,$(subst @,_,$(subst :,_,$(subst .,_,$(subst -,_,$(subst /,_,$(1)))))))
 
diff --git a/include/kernel.mk b/include/kernel.mk
index 001718d89d8b77..b1ae42534dc434 100644
--- a/include/kernel.mk
+++ b/include/kernel.mk
@@ -90,6 +90,8 @@ else ifneq (,$(findstring $(ARCH) , mipsel mips64 mips64el ))
   LINUX_KARCH := mips
 else ifneq (,$(findstring $(ARCH) , powerpc64 ))
   LINUX_KARCH := powerpc
+else ifneq (,$(findstring $(ARCH) , riscv64 ))
+  LINUX_KARCH := riscv
 else ifneq (,$(findstring $(ARCH) , sh2 sh3 sh4 ))
   LINUX_KARCH := sh
 else ifneq (,$(findstring $(ARCH) , i386 x86_64 ))
@@ -125,17 +127,17 @@ ifeq ($(call qstrip,$(CONFIG_EXTERNAL_KERNEL_TREE))$(call qstrip,$(CONFIG_KERNEL
 	KERNELRELEASE=$(LINUX_VERSION)
 endif
 
-KERNEL_MAKEOPTS := -C $(LINUX_DIR) $(KERNEL_MAKE_FLAGS)
+ifneq ($(HOST_OS),Linux)
+  KERNEL_MAKE_FLAGS += CONFIG_STACK_VALIDATION=
+  export SKIP_STACK_VALIDATION:=1
+endif
+
+KERNEL_MAKEOPTS = -C $(LINUX_DIR) $(KERNEL_MAKE_FLAGS)
 
 ifdef CONFIG_USE_SPARSE
   KERNEL_MAKEOPTS += C=1 CHECK=$(STAGING_DIR_HOST)/bin/sparse
 endif
 
-ifneq ($(HOST_OS),Linux)
-  KERNEL_MAKEOPTS += CONFIG_STACK_VALIDATION=
-  export SKIP_STACK_VALIDATION:=1
-endif
-
 PKG_EXTMOD_SUBDIRS ?= .
 
 PKG_SYMVERS_DIR = $(KERNEL_BUILD_DIR)/symvers
diff --git a/include/netfilter.mk b/include/netfilter.mk
index a9c5133ae40dd1..81488fe5c8eb8a 100644
--- a/include/netfilter.mk
+++ b/include/netfilter.mk
@@ -73,7 +73,6 @@ $(eval $(call nf_add,IPT_CONNTRACK,CONFIG_NETFILTER_XT_MATCH_CONNTRACK, $(P_XT)x
 
 $(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_NETFILTER_XT_MATCH_CONNBYTES, $(P_XT)xt_connbytes))
 $(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_NETFILTER_XT_MATCH_CONNLIMIT, $(P_XT)xt_connlimit))
-$(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_NETFILTER_CONNCOUNT, $(P_XT)nf_conncount))
 $(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_NETFILTER_XT_CONNMARK, $(P_XT)xt_connmark))
 $(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_NETFILTER_XT_MATCH_HELPER, $(P_XT)xt_helper))
 $(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_NETFILTER_XT_MATCH_RECENT, $(P_XT)xt_recent))
@@ -278,6 +277,10 @@ $(eval $(call nf_add,NFNETLINK_LOG,CONFIG_NETFILTER_NETLINK_LOG, $(P_XT)nfnetlin
 
 $(eval $(call nf_add,NFNETLINK_QUEUE,CONFIG_NETFILTER_NETLINK_QUEUE, $(P_XT)nfnetlink_queue))
 
+# conncount
+
+$(eval $(if $(NF_KMOD),$(call nf_add,NF_CONNCOUNT,CONFIG_NETFILTER_CONNCOUNT, $(P_XT)nf_conncount),))
+
 #
 # ebtables
 #
@@ -352,6 +355,8 @@ $(eval $(if $(NF_KMOD),$(call nf_add,NFT_COMPAT,CONFIG_NFT_COMPAT, $(P_XT)nft_co
 
 $(eval $(if $(NF_KMOD),$(call nf_add,NFT_XFRM,CONFIG_NFT_XFRM, $(P_XT)nft_xfrm),))
 
+$(eval $(if $(NF_KMOD),$(call nf_add,NFT_CONNLIMIT,CONFIG_NFT_CONNLIMIT, $(P_XT)nft_connlimit),))
+
 # userland only
 IPT_BUILTIN += $(NF_IPT-y) $(NF_IPT-m)
 IPT_BUILTIN += $(IPT_CORE-y) $(IPT_CORE-m)
diff --git a/include/nls.mk b/include/nls.mk
index 90fc27660f9d6b..f054d2bb68af77 100644
--- a/include/nls.mk
+++ b/include/nls.mk
@@ -10,6 +10,7 @@ ifeq ($(CONFIG_BUILD_NLS),y)
 	INTL_PREFIX:=$(STAGING_DIR)/usr/lib/libintl-full
 	INTL_FULL:=1
 
+	CMAKE_OPTIONS += -DCMAKE_PREFIX_PATH="$(ICONV_PREFIX);$(INTL_PREFIX)"
 else
 	ICONV_PREFIX:=
 	ICONV_FULL:=
diff --git a/include/openssl-module.mk b/include/openssl-module.mk
new file mode 100644
index 00000000000000..7348a10dbc4458
--- /dev/null
+++ b/include/openssl-module.mk
@@ -0,0 +1,79 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2022-2023 Enéas Ulir de Queiroz
+
+ENGINES_DIR=engines-3
+
+define Package/openssl/module/Default
+  SECTION:=libs
+  CATEGORY:=Libraries
+  SUBMENU:=SSL
+  DEPENDS:=libopenssl +libopenssl-conf
+endef
+
+define Package/openssl/engine/Default
+  $(Package/openssl/module/Default)
+  DEPENDS+=@OPENSSL_ENGINE
+endef
+
+
+# 1 = moudule type (engine|provider)
+# 2 = module name
+# 3 = directory to save .so file
+# 4 = [ package name, defaults to libopenssl-$(2) ]
+define Package/openssl/add-module
+  $(eval MOD_TYPE:=$(1))
+  $(eval MOD_NAME:=$(2))
+  $(eval MOD_DIR:=$(3))
+  $(eval OSSL_PKG:=$(if $(4),$(4),libopenssl-$(MOD_NAME)))
+  $(info Package/openssl/add-module 1='$(1)'; 2='$(2)'; 3='$(3)' 4='$(4)')
+  $(info MOD_TYPE='$(MOD_TYPE)'; MOD_NAME='$(MOD_NAME)'; MOD_DIR='$(MOD_DIR)' OSSL_PKG='$(OSSL_PKG)')
+  Package/$(OSSL_PKG)/conffiles:=/etc/ssl/modules.cnf.d/$(MOD_NAME).cnf
+
+  define Package/$(OSSL_PKG)/install
+	$$(INSTALL_DIR)  $$(1)/$(MOD_DIR)
+	$$(INSTALL_BIN)  $$(PKG_INSTALL_DIR)/$(MOD_DIR)/$(MOD_NAME).so \
+			 $$(1)/$(MOD_DIR)
+	$$(INSTALL_DIR)  $$(1)/etc/ssl/modules.cnf.d
+	$$(INSTALL_DATA) ./files/$(MOD_NAME).cnf $$(1)/etc/ssl/modules.cnf.d/
+  endef
+
+  define Package/$(OSSL_PKG)/postinst
+#!/bin/sh
+OPENSSL_UCI="$$$${IPKG_INSTROOT}/etc/config/openssl"
+
+[ -z "$$$${IPKG_INSTROOT}" ] \
+	&& uci -q get openssl.$(MOD_NAME) >/dev/null \
+	&& exit 0
+
+cat << EOF >> "$$$${OPENSSL_UCI}"
+
+config $(MOD_TYPE) '$(MOD_NAME)'
+	option enabled '1'
+EOF
+
+[ -n "$$$${IPKG_INSTROOT}" ] || /etc/init.d/openssl reload
+exit 0
+  endef
+
+  define Package/$(OSSL_PKG)/postrm
+#!/bin/sh
+[ -n "$$$${IPKG_INSTROOT}" ] && exit 0
+uci -q delete openssl.$(MOD_NAME) && uci commit openssl
+/etc/init.d/openssl reload
+exit 0
+  endef
+endef
+
+# 1 = engine name
+# 2 - package name, defaults to libopenssl-$(1)
+define Package/openssl/add-engine
+  $(call Package/openssl/add-module,engine,$(1),/usr/lib/$(ENGINES_DIR),$(2))
+endef
+
+# 1 = provider name
+# 2 = [ package name, defaults to libopenssl-$(1) ]
+define Package/openssl/add-provider
+  $(call Package/openssl/add-module,provider,$(1),/usr/lib/ossl-modules,$(2))
+endef
+
diff --git a/include/package-defaults.mk b/include/package-defaults.mk
index 3ee3a965f20a4e..2cff26b531735a 100644
--- a/include/package-defaults.mk
+++ b/include/package-defaults.mk
@@ -2,7 +2,7 @@
 #
 # Copyright (C) 2006-2020 OpenWrt.org
 
-PKG_DEFAULT_DEPENDS = +libc +USE_GLIBC:librt +USE_GLIBC:libpthread
+PKG_DEFAULT_DEPENDS = +libc
 
 ifneq ($(PKG_NAME),toolchain)
   PKG_FIXUP_DEPENDS = $(if $(filter kmod-%,$(1)),$(2),$(PKG_DEFAULT_DEPENDS) $(filter-out $(PKG_DEFAULT_DEPENDS),$(2)))
@@ -80,6 +80,7 @@ CONFIGURE_ARGS = \
 		--target=$(GNU_TARGET_NAME) \
 		--host=$(GNU_TARGET_NAME) \
 		--build=$(GNU_HOST_NAME) \
+		--disable-dependency-tracking \
 		--program-prefix="" \
 		--program-suffix="" \
 		--prefix=$(CONFIGURE_PREFIX) \
diff --git a/include/package.mk b/include/package.mk
index 5861533bf50462..c391d320aa2c50 100644
--- a/include/package.mk
+++ b/include/package.mk
@@ -11,8 +11,6 @@ include $(INCLUDE_DIR)/download.mk
 PKG_BUILD_DIR ?= $(BUILD_DIR)/$(if $(BUILD_VARIANT),$(PKG_NAME)-$(BUILD_VARIANT)/)$(PKG_NAME)$(if $(PKG_VERSION),-$(PKG_VERSION))
 PKG_INSTALL_DIR ?= $(PKG_BUILD_DIR)/ipkg-install
 PKG_BUILD_PARALLEL ?=
-PKG_USE_MIPS16 ?= 1
-PKG_IREMAP ?= 1
 PKG_SKIP_DOWNLOAD=$(USE_SOURCE_DIR)$(USE_GIT_TREE)$(USE_GIT_SRC_CHECKOUT)
 
 MAKE_J:=$(if $(MAKE_JOBSERVER),$(MAKE_JOBSERVER) $(if $(filter 3.% 4.0 4.1,$(MAKE_VERSION)),-j))
@@ -24,15 +22,38 @@ PKG_JOBS?=-j1
 else
 PKG_JOBS?=$(if $(PKG_BUILD_PARALLEL),$(MAKE_J),-j1)
 endif
+
+PKG_BUILD_FLAGS?=
+__unknown_flags=$(filter-out no-iremap no-mips16 gc-sections no-gc-sections lto no-lto,$(PKG_BUILD_FLAGS))
+ifneq ($(__unknown_flags),)
+  $(error unknown PKG_BUILD_FLAGS: $(__unknown_flags))
+endif
+
+# $1=flagname, $2=default (0/1)
+define pkg_build_flag
+$(if $(filter no-$(1),$(PKG_BUILD_FLAGS)),0,$(if $(filter $(1),$(PKG_BUILD_FLAGS)),1,$(2)))
+endef
+
+ifeq ($(call pkg_build_flag,iremap,1),1)
+  IREMAP_CFLAGS = $(call iremap,$(PKG_BUILD_DIR),$(notdir $(PKG_BUILD_DIR)))
+  TARGET_CFLAGS += $(IREMAP_CFLAGS)
+endif
 ifdef CONFIG_USE_MIPS16
-  ifeq ($(strip $(PKG_USE_MIPS16)),1)
+  ifeq ($(call pkg_build_flag,mips16,1),1)
     TARGET_ASFLAGS_DEFAULT = $(filter-out -mips16 -minterlink-mips16,$(TARGET_CFLAGS))
     TARGET_CFLAGS += -mips16 -minterlink-mips16
+    TARGET_CXXFLAGS += -mips16 -minterlink-mips16
   endif
 endif
-ifeq ($(strip $(PKG_IREMAP)),1)
-  IREMAP_CFLAGS = $(call iremap,$(PKG_BUILD_DIR),$(notdir $(PKG_BUILD_DIR)))
-  TARGET_CFLAGS += $(IREMAP_CFLAGS)
+ifeq ($(call pkg_build_flag,gc-sections,$(if $(CONFIG_USE_GC_SECTIONS),1,0)),1)
+  TARGET_CFLAGS+= -ffunction-sections -fdata-sections
+  TARGET_CXXFLAGS+= -ffunction-sections -fdata-sections
+  TARGET_LDFLAGS+= -Wl,--gc-sections
+endif
+ifeq ($(call pkg_build_flag,lto,$(if $(CONFIG_USE_LTO),1,0)),1)
+  TARGET_CFLAGS+= -flto=auto -fno-fat-lto-objects
+  TARGET_CXXFLAGS+= -flto=auto -fno-fat-lto-objects
+  TARGET_LDFLAGS+= -flto=auto -fuse-linker-plugin
 endif
 
 include $(INCLUDE_DIR)/hardening.mk
@@ -85,7 +106,7 @@ ifneq ($(PREV_STAMP_PREPARED),)
   STAMP_PREPARED:=$(PREV_STAMP_PREPARED)
   CONFIG_AUTOREBUILD:=
 else
-  STAMP_PREPARED=$(PKG_BUILD_DIR)/.prepared$(if $(QUILT)$(DUMP),,_$(shell $(call find_md5,${CURDIR} $(PKG_FILE_DEPENDS),))_$(call confvar,CONFIG_AUTOREMOVE $(PKG_PREPARED_DEPENDS)))
+  STAMP_PREPARED=$(PKG_BUILD_DIR)/.prepared$(if $(QUILT)$(DUMP),,_$(shell $(call $(if $(CONFIG_AUTOREMOVE),find_md5_reproducible,find_md5),${CURDIR} $(PKG_FILE_DEPENDS),))_$(call confvar,CONFIG_AUTOREMOVE $(PKG_PREPARED_DEPENDS)))
 endif
 STAMP_CONFIGURED=$(PKG_BUILD_DIR)/.configured$(if $(DUMP),,_$(call confvar,$(PKG_CONFIG_DEPENDS)))
 STAMP_CONFIGURED_WILDCARD=$(PKG_BUILD_DIR)/.configured_*
@@ -173,6 +194,7 @@ define Build/Exports/Default
   $(1) : export CONFIG_SITE:=$$(CONFIG_SITE)
   $(1) : export PKG_CONFIG_PATH:=$$(PKG_CONFIG_PATH)
   $(1) : export PKG_CONFIG_LIBDIR:=$$(PKG_CONFIG_PATH)
+  $(1) : export GIT_CEILING_DIRECTORIES:=$$(BUILD_DIR)
 endef
 Build/Exports=$(Build/Exports/Default)
 
diff --git a/include/prereq-build.mk b/include/prereq-build.mk
index e1687da370dfd7..5b63490ca3c675 100644
--- a/include/prereq-build.mk
+++ b/include/prereq-build.mk
@@ -8,6 +8,13 @@ include $(INCLUDE_DIR)/prereq.mk
 SHELL:=sh
 PKG_NAME:=Build dependency
 
+$(eval $(call TestHostCommand,true, \
+	Please install GNU 'coreutils', \
+	$(TRUE)))
+
+$(eval $(call TestHostCommand,false, \
+	Please install GNU 'coreutils', \
+	$(FALSE); [ $$$$$$$$? = 1 ] && $(TRUE)))
 
 # Required for the toolchain
 $(eval $(call TestHostCommand,working-make, \
@@ -49,10 +56,9 @@ $(eval $(call TestHostCommand,working-g++, \
 		g++ -x c++ -o $(TMP_DIR)/a.out - -lstdc++ && \
 		$(TMP_DIR)/a.out))
 
-$(eval $(call TestHostCommand,ncurses, \
+$(eval $(call RequireCHeader,ncurses.h, \
 	Please install ncurses. (Missing libncurses.so or ncurses.h), \
-	echo 'int main(int argc, char **argv) { initscr(); return 0; }' | \
-		gcc -include ncurses.h -x c -o $(TMP_DIR)/a.out - -lncurses))
+	initscr(), -lncurses))
 
 $(eval $(call SetupHostCommand,git,Please install Git (git-core) >= 1.7.12.2, \
 	git --exec-path | xargs -I % -- grep -q -- --recursive %/git-submodule, \
@@ -88,6 +94,10 @@ $(eval $(call TestHostCommand,perl-thread-queue, \
 	Please install the Perl Thread::Queue module, \
 	perl -MThread::Queue -e 1))
 
+$(eval $(call TestHostCommand,perl-ipc-cmd, \
+	Please install the Perl IPC:Cmd module, \
+	perl -MIPC::Cmd -e 1))
+
 $(eval $(call SetupHostCommand,tar,Please install GNU 'tar', \
 	gtar --version 2>&1 | grep GNU, \
 	gnutar --version 2>&1 | grep GNU, \
@@ -149,6 +159,9 @@ $(eval $(call SetupHostCommand,stat,Cannot find a file stat utility, \
 	gstat -c%s $(TOPDIR)/Makefile, \
 	stat -c%s $(TOPDIR)/Makefile))
 
+$(eval $(call SetupHostCommand,gzip,Please install 'gzip', \
+	gzip --version </dev/null))
+
 $(eval $(call SetupHostCommand,unzip,Please install 'unzip', \
 	unzip 2>&1 | grep zipfile, \
 	unzip))
@@ -166,25 +179,21 @@ $(eval $(call SetupHostCommand,install,Please install GNU 'install', \
 $(eval $(call SetupHostCommand,perl,Please install Perl 5.x, \
 	perl --version | grep "perl.*v5"))
 
-$(eval $(call CleanupPython2))
-
-$(eval $(call SetupHostCommand,python,Please install Python >= 3.6, \
+$(eval $(call SetupHostCommand,python,Please install Python >= 3.7, \
 	python3.11 -V 2>&1 | grep 'Python 3', \
 	python3.10 -V 2>&1 | grep 'Python 3', \
 	python3.9 -V 2>&1 | grep 'Python 3', \
 	python3.8 -V 2>&1 | grep 'Python 3', \
 	python3.7 -V 2>&1 | grep 'Python 3', \
-	python3.6 -V 2>&1 | grep 'Python 3', \
-	python3 -V 2>&1 | grep -E 'Python 3\.([6-9]|[0-9][0-9])\.?'))
+	python3 -V 2>&1 | grep -E 'Python 3\.([7-9]|[0-9][0-9])\.?'))
 
-$(eval $(call SetupHostCommand,python3,Please install Python >= 3.6, \
+$(eval $(call SetupHostCommand,python3,Please install Python >= 3.7, \
 	python3.11 -V 2>&1 | grep 'Python 3', \
 	python3.10 -V 2>&1 | grep 'Python 3', \
 	python3.9 -V 2>&1 | grep 'Python 3', \
 	python3.8 -V 2>&1 | grep 'Python 3', \
 	python3.7 -V 2>&1 | grep 'Python 3', \
-	python3.6 -V 2>&1 | grep 'Python 3', \
-	python3 -V 2>&1 | grep -E 'Python 3\.([6-9]|[0-9][0-9])\.?'))
+	python3 -V 2>&1 | grep -E 'Python 3\.([7-9]|[0-9][0-9])\.?'))
 
 $(eval $(call TestHostCommand,python3-distutils, \
 	Please install the Python3 distutils module, \
@@ -202,6 +211,20 @@ $(eval $(call SetupHostCommand,which,Please install 'which', \
 	/bin/which which, \
 	which which))
 
+ifeq ($(HOST_OS),Linux)
+  $(eval $(call RequireCHeader,argp.h, \
+	Missing argp.h Please install the argp-standalone package if musl libc))
+
+  $(eval $(call RequireCHeader,fts.h, \
+	Missing fts.h Please install the musl-fts-dev package if musl libc))
+
+  $(eval $(call RequireCHeader,obstack.h, \
+	Missing obstack.h Please install the musl-obstack-dev package if musl libc))
+
+  $(eval $(call RequireCHeader,libintl.h, \
+	Missing libintl.h Please install the musl-libintl package if musl libc))
+endif
+
 $(STAGING_DIR_HOST)/bin/mkhash: $(SCRIPT_DIR)/mkhash.c
 	mkdir -p $(dir $@)
 	$(CC) -O2 -I$(TOPDIR)/tools/include -o $@ $<
@@ -213,4 +236,4 @@ prereq: $(STAGING_DIR_HOST)/bin/mkhash $(STAGING_DIR_HOST)/bin/xxd
 
 # Install ldconfig stub
 $(eval $(call TestHostCommand,ldconfig-stub,Failed to install stub, \
-	$(LN) /bin/true $(STAGING_DIR_HOST)/bin/ldconfig))
+	$(LN) $(firstword $(wildcard /bin/true /usr/bin/true)) $(STAGING_DIR_HOST)/bin/ldconfig))
diff --git a/include/prereq.mk b/include/prereq.mk
index 0033535e782a71..546f36b8e3e8a5 100644
--- a/include/prereq.mk
+++ b/include/prereq.mk
@@ -28,8 +28,10 @@ define Require
 
     prereq-$(1): $(if $(PREREQ_PREV),prereq-$(PREREQ_PREV)) FORCE
 		printf "Checking '$(1)'... "
-		if $(NO_TRACE_MAKE) -f $(firstword $(MAKEFILE_LIST)) check-$(1) >/dev/null 2>/dev/null; then \
+		if $(NO_TRACE_MAKE) -f $(firstword $(MAKEFILE_LIST)) check-$(1) PATH="$(ORIG_PATH)" >/dev/null 2>/dev/null; then \
 			echo 'ok.'; \
+		elif $(NO_TRACE_MAKE) -f $(firstword $(MAKEFILE_LIST)) check-$(1) PATH="$(ORIG_PATH)" >/dev/null 2>/dev/null; then \
+			echo 'updated.'; \
 		else \
 			echo 'failed.'; \
 			echo "$(PKG_NAME): $(strip $(2))" >> $(TMP_DIR)/.prereq-error; \
@@ -63,16 +65,16 @@ define RequireHeader
   $$(eval $$(call Require,$(1),$(2)))
 endef
 
-define CleanupPython2
-  define Require/python2-cleanup
-	if [ -f "$(STAGING_DIR_HOST)/bin/python" ] && \
-		$(STAGING_DIR_HOST)/bin/python -V 2>&1 | \
-		grep -q 'Python 2'; then \
-			rm $(STAGING_DIR_HOST)/bin/python; \
-	fi
+# 1: header to test
+# 2: failure message
+# 3: optional compile time test
+# 4: optional link library test (example -lncurses)
+define RequireCHeader
+  define Require/$(1)
+    echo 'int main(int argc, char **argv) { $(3); return 0; }' | gcc -include $(1) -x c -o $(TMP_DIR)/a.out - $(4)
   endef
 
-  $$(eval $$(call Require,python2-cleanup))
+  $$(eval $$(call Require,$(1),$(2)))
 endef
 
 define QuoteHostCommand
@@ -95,19 +97,31 @@ endef
 # 3+: candidates
 define SetupHostCommand
   define Require/$(1)
-	[ -f "$(STAGING_DIR_HOST)/bin/$(strip $(1))" ] && exit 0; \
+	mkdir -p "$(STAGING_DIR_HOST)/bin"; \
 	for cmd in $(call QuoteHostCommand,$(3)) $(call QuoteHostCommand,$(4)) \
 	           $(call QuoteHostCommand,$(5)) $(call QuoteHostCommand,$(6)) \
 	           $(call QuoteHostCommand,$(7)) $(call QuoteHostCommand,$(8)) \
 	           $(call QuoteHostCommand,$(9)) $(call QuoteHostCommand,$(10)) \
 	           $(call QuoteHostCommand,$(11)) $(call QuoteHostCommand,$(12)); do \
 		if [ -n "$$$$$$$$cmd" ]; then \
-			bin="$$$$$$$$(PATH="$(subst $(space),:,$(filter-out $(STAGING_DIR_HOST)/%,$(subst :,$(space),$(PATH))))" \
-				command -v "$$$$$$$${cmd%% *}")"; \
+			bin="$$$$$$$$(command -v "$$$$$$$${cmd%% *}")"; \
 			if [ -x "$$$$$$$$bin" ] && eval "$$$$$$$$cmd" >/dev/null 2>/dev/null; then \
-				mkdir -p "$(STAGING_DIR_HOST)/bin"; \
+				case "$$$$$$$$(ls -dl -- $(STAGING_DIR_HOST)/bin/$(strip $(1)))" in \
+					*" -> $$$$$$$$bin"*) \
+						[ -x "$(STAGING_DIR_HOST)/bin/$(strip $(1))" ] && exit 0 \
+						;; \
+					"-"*) \
+						find "$(STAGING_DIR_HOST)/stamp" | grep $(strip $(1)) && \
+						[ -x "$(STAGING_DIR_HOST)/bin/$(strip $(1))" ] && exit 0 \
+						;; \
+					*" -> /"*) \
+						;; \
+					*" -> "*) \
+						[ -x "$(STAGING_DIR_HOST)/bin/$(strip $(1))" ] && exit 0 \
+						;; \
+				esac; \
 				ln -sf "$$$$$$$$bin" "$(STAGING_DIR_HOST)/bin/$(strip $(1))"; \
-				exit 0; \
+				exit 1; \
 			fi; \
 		fi; \
 	done; \
diff --git a/include/scan.mk b/include/scan.mk
index 5032afa8186c83..33a5832ff5f237 100644
--- a/include/scan.mk
+++ b/include/scan.mk
@@ -11,7 +11,8 @@ TARGET_STAMP:=$(TMP_DIR)/info/.files-$(SCAN_TARGET).stamp
 FILELIST:=$(TMP_DIR)/info/.files-$(SCAN_TARGET)-$(SCAN_COOKIE)
 OVERRIDELIST:=$(TMP_DIR)/info/.overrides-$(SCAN_TARGET)-$(SCAN_COOKIE)
 
-export PATH:=$(TOPDIR)/staging_dir/host/bin:$(PATH)
+export ORIG_PATH:=$(if $(ORIG_PATH),$(ORIG_PATH),$(PATH))
+export PATH:=$(STAGING_DIR_HOST)/bin:$(PATH)
 
 define feedname
 $(if $(patsubst feeds/%,,$(1)),,$(word 2,$(subst /, ,$(1))))
diff --git a/include/site/riscv64 b/include/site/riscv64
new file mode 100644
index 00000000000000..c5aa9c5543d081
--- /dev/null
+++ b/include/site/riscv64
@@ -0,0 +1,30 @@
+#!/bin/sh
+. $TOPDIR/include/site/linux
+ac_cv_c_littleendian=${ac_cv_c_littleendian=yes}
+ac_cv_c_bigendian=${ac_cv_c_bigendian=no}
+
+ac_cv_sizeof___int64=8
+ac_cv_sizeof_char=1
+ac_cv_sizeof_int=4
+ac_cv_sizeof_int16_t=2
+ac_cv_sizeof_int32_t=4
+ac_cv_sizeof_int64_t=8
+ac_cv_sizeof_long_int=8
+ac_cv_sizeof_long_long=8
+ac_cv_sizeof_long=8
+ac_cv_sizeof_off_t=8
+ac_cv_sizeof_short_int=2
+ac_cv_sizeof_short=2
+ac_cv_sizeof_size_t=8
+ac_cv_sizeof_ssize_t=8
+ac_cv_sizeof_u_int16_t=2
+ac_cv_sizeof_u_int32_t=4
+ac_cv_sizeof_u_int64_t=8
+ac_cv_sizeof_uint16_t=2
+ac_cv_sizeof_uint32_t=4
+ac_cv_sizeof_uint64_t=8
+ac_cv_sizeof_unsigned_int=4
+ac_cv_sizeof_unsigned_long=8
+ac_cv_sizeof_unsigned_long_long=8
+ac_cv_sizeof_unsigned_short=2
+ac_cv_sizeof_void_p=8
diff --git a/include/target.mk b/include/target.mk
index a2c8b7bdbf7c14..b5e3e7ff6fdeca 100644
--- a/include/target.mk
+++ b/include/target.mk
@@ -17,7 +17,7 @@ DEFAULT_PACKAGES:=\
 	fstools \
 	libc \
 	libgcc \
-	libustream-wolfssl \
+	libustream-mbedtls \
 	logd \
 	mtd \
 	netifd \
@@ -68,7 +68,7 @@ endif
 
 target_conf=$(subst .,_,$(subst -,_,$(subst /,_,$(1))))
 ifeq ($(DUMP),)
-  PLATFORM_DIR:=$(TOPDIR)/target/linux/$(BOARD)
+  PLATFORM_DIR:=$(firstword $(wildcard $(TOPDIR)/target/linux/feeds/$(BOARD) $(TOPDIR)/target/linux/$(BOARD)))
   SUBTARGET:=$(strip $(foreach subdir,$(patsubst $(PLATFORM_DIR)/%/target.mk,%,$(wildcard $(PLATFORM_DIR)/*/target.mk)),$(if $(CONFIG_TARGET_$(call target_conf,$(BOARD)_$(subdir))),$(subdir))))
 else
   PLATFORM_DIR:=${CURDIR}
@@ -235,6 +235,7 @@ ifeq ($(DUMP),1)
   ifeq ($(ARCH),powerpc)
     CPU_CFLAGS_603e:=-mcpu=603e
     CPU_CFLAGS_8540:=-mcpu=8540
+    CPU_CFLAGS_8548:=-mcpu=8548
     CPU_CFLAGS_405:=-mcpu=405
     CPU_CFLAGS_440:=-mcpu=440
     CPU_CFLAGS_464fp:=-mcpu=464fp
@@ -259,6 +260,10 @@ ifeq ($(DUMP),1)
     CPU_CFLAGS_arc700 = -mcpu=arc700
     CPU_CFLAGS_archs = -mcpu=archs
   endif
+  ifeq ($(ARCH),riscv64)
+    CPU_TYPE ?= riscv64
+    CPU_CFLAGS_riscv64:=-mabi=lp64d -march=rv64imafdc
+  endif
   ifneq ($(CPU_TYPE),)
     ifndef CPU_CFLAGS_$(CPU_TYPE)
       $(warning CPU_TYPE "$(CPU_TYPE)" doesn't correspond to a known type)
diff --git a/include/toplevel.mk b/include/toplevel.mk
index 455fc9c4da0b3c..328214be1bc59f 100644
--- a/include/toplevel.mk
+++ b/include/toplevel.mk
@@ -50,23 +50,24 @@ space:= $(empty) $(empty)
 path:=$(subst :,$(space),$(PATH))
 path:=$(filter-out .%,$(path))
 path:=$(subst $(space),:,$(path))
+export ORIG_PATH:=$(if $(ORIG_PATH),$(ORIG_PATH),$(PATH))
 export PATH:=$(path)
+export STAGING_DIR_HOST:=$(if $(STAGING_DIR),$(abspath $(STAGING_DIR)/../host),$(TOPDIR)/staging_dir/host)
 
 unexport TAR_OPTIONS
 
 ifeq ($(FORCE),)
-  .config scripts/config/conf scripts/config/mconf: staging_dir/host/.prereq-build
+  .config scripts/config/conf scripts/config/mconf: $(STAGING_DIR_HOST)/.prereq-build
 endif
 
 SCAN_COOKIE?=$(shell echo $$$$)
 export SCAN_COOKIE
-export STAGING_DIR_HOST=$(TOPDIR)/staging_dir/host
 
 SUBMAKE:=umask 022; $(SUBMAKE)
 
 ULIMIT_FIX=_limit=`ulimit -n`; [ "$$_limit" = "unlimited" -o "$$_limit" -ge 1024 ] || ulimit -n 1024;
 
-prepare-mk: staging_dir/host/.prereq-build FORCE ;
+prepare-mk: $(STAGING_DIR_HOST)/.prereq-build FORCE ;
 
 ifdef SDK
   IGNORE_PACKAGES = linux
@@ -75,7 +76,7 @@ endif
 _ignore = $(foreach p,$(IGNORE_PACKAGES),--ignore $(p))
 
 prepare-tmpinfo: FORCE
-	@+$(MAKE) -r -s staging_dir/host/.prereq-build $(PREP_MK)
+	@+$(MAKE) -r -s $(STAGING_DIR_HOST)/.prereq-build $(PREP_MK)
 	mkdir -p tmp/info
 	$(_SINGLE)$(NO_TRACE_MAKE) -j1 -r -s -f include/scan.mk SCAN_TARGET="packageinfo" SCAN_DIR="package" SCAN_NAME="package" SCAN_DEPTH=5 SCAN_EXTRA=""
 	$(_SINGLE)$(NO_TRACE_MAKE) -j1 -r -s -f include/scan.mk SCAN_TARGET="targetinfo" SCAN_DIR="target/linux" SCAN_NAME="target" SCAN_DEPTH=3 SCAN_EXTRA="" SCAN_MAKEOPTS="TARGET_BUILD=1"
@@ -152,7 +153,7 @@ xconfig: scripts/config/qconf prepare-tmpinfo FORCE
 
 prepare_kernel_conf: .config toolchain/install FORCE
 
-ifeq ($(wildcard staging_dir/host/bin/quilt),)
+ifeq ($(wildcard $(STAGING_DIR_HOST)/bin/quilt),)
   prepare_kernel_conf:
 	@+$(SUBMAKE) -r tools/quilt/compile
 else
@@ -176,7 +177,7 @@ kernel_nconfig: prepare_kernel_conf
 kernel_xconfig: prepare_kernel_conf
 	$(_SINGLE)$(NO_TRACE_MAKE) -C target/linux xconfig
 
-staging_dir/host/.prereq-build: include/prereq-build.mk
+$(STAGING_DIR_HOST)/.prereq-build: include/prereq-build.mk
 	mkdir -p tmp
 	@$(_SINGLE)$(NO_TRACE_MAKE) -j1 -r -s -f $(TOPDIR)/include/prereq-build.mk prereq 2>/dev/null || { \
 		echo "Prerequisite check failed. Use FORCE=1 to override."; \
@@ -199,7 +200,7 @@ else
   DOWNLOAD_DIRS = package/download
 endif
 
-download: .config FORCE $(if $(wildcard $(TOPDIR)/staging_dir/host/bin/flock),,tools/flock/compile)
+download: .config FORCE $(if $(wildcard $(STAGING_DIR_HOST)/bin/flock),,tools/flock/compile)
 	@+$(foreach dir,$(DOWNLOAD_DIRS),$(SUBMAKE) $(dir);)
 
 clean dirclean: .config
@@ -263,7 +264,7 @@ distclean:
 	@$(_SINGLE)$(SUBMAKE) -C scripts/config clean
 
 ifeq ($(findstring v,$(DEBUG)),)
-  .SILENT: symlinkclean clean dirclean distclean config-clean download help tmpinfo-clean .config scripts/config/mconf scripts/config/conf menuconfig staging_dir/host/.prereq-build tmp/.prereq-package prepare-tmpinfo
+  .SILENT: symlinkclean clean dirclean distclean config-clean download help tmpinfo-clean .config scripts/config/mconf scripts/config/conf menuconfig $(STAGING_DIR_HOST)/.prereq-build tmp/.prereq-package prepare-tmpinfo
 endif
 .PHONY: help FORCE
 .NOTPARALLEL:
diff --git a/include/trusted-firmware-a.mk b/include/trusted-firmware-a.mk
index 46fc52b15e400b..0c0118e092bec5 100644
--- a/include/trusted-firmware-a.mk
+++ b/include/trusted-firmware-a.mk
@@ -1,5 +1,5 @@
 PKG_NAME ?= trusted-firmware-a
-PKG_CPE_ID ?= cpe:/a:arm:arm_trusted_firmware
+PKG_CPE_ID ?= cpe:/a:arm:trusted_firmware-a
 
 ifndef PKG_SOURCE_PROTO
 PKG_SOURCE = trusted-firmware-a-$(PKG_VERSION).tar.gz
@@ -81,6 +81,7 @@ define Build/Compile/Trusted-Firmware-A
 		$(if $(DTC),DTC="$(DTC)") \
 		PLAT=$(PLAT) \
 		BUILD_STRING="OpenWrt v$(PKG_VERSION)-$(PKG_RELEASE) ($(VARIANT))" \
+		$(if $(CONFIG_BINUTILS_VERSION_2_37)$(CONFIG_BINUTILS_VERSION_2_38),,LDFLAGS="-no-warn-rwx-segments") \
 		$(TFA_MAKE_FLAGS)
 endef
 
diff --git a/include/u-boot.mk b/include/u-boot.mk
index 8945e8e2b8f568..2b8106410f5921 100644
--- a/include/u-boot.mk
+++ b/include/u-boot.mk
@@ -83,6 +83,9 @@ endef
 
 define Build/Configure/U-Boot
 	+$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) $(UBOOT_CONFIGURE_VARS) $(UBOOT_CONFIG)_config
+	$(if $(strip $(UBOOT_CUSTOMIZE_CONFIG)),
+		$(PKG_BUILD_DIR)/scripts/config --file $(PKG_BUILD_DIR)/.config $(UBOOT_CUSTOMIZE_CONFIG)
+		+$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) $(UBOOT_CONFIGURE_VARS) oldconfig)
 endef
 
 DTC=$(wildcard $(LINUX_DIR)/scripts/dtc/dtc)
diff --git a/include/unpack.mk b/include/unpack.mk
index ebece69978203d..5959d55f4b1dc1 100644
--- a/include/unpack.mk
+++ b/include/unpack.mk
@@ -18,7 +18,7 @@ ifeq ($(strip $(UNPACK_CMD)),)
 
     ifeq ($(filter gz tgz,$(EXT)),$(EXT))
       EXT:=$(call ext,$(PKG_SOURCE:.$(EXT)=))
-      DECOMPRESS_CMD:=gzip -dc $(DL_DIR)/$(PKG_SOURCE) |
+      DECOMPRESS_CMD:=$(STAGING_DIR_HOST)/bin/libdeflate-gzip -dc $(DL_DIR)/$(PKG_SOURCE) |
     endif
     ifeq ($(filter bzip2 bz2 bz tbz2 tbz,$(EXT)),$(EXT))
       EXT:=$(call ext,$(PKG_SOURCE:.$(EXT)=))
@@ -56,7 +56,7 @@ ifeq ($(strip $(UNPACK_CMD)),)
     endif
     # replace zcat with $(ZCAT), because some system don't support it properly
     ifeq ($(PKG_CAT),zcat)
-      UNPACK_CMD=gzip -dc $(DL_DIR)/$(PKG_SOURCE) | $(TAR_CMD)
+      UNPACK_CMD=$(STAGING_DIR_HOST)/bin/libdeflate-gzip -dc $(DL_DIR)/$(PKG_SOURCE) | $(TAR_CMD)
     endif
   endif
 endif
diff --git a/package/Makefile b/package/Makefile
index 209be34674747a..4b8df7f484de6e 100644
--- a/package/Makefile
+++ b/package/Makefile
@@ -92,6 +92,10 @@ $(curdir)/index: FORCE
 			$(call ERROR_MESSAGE,WARNING: Applying padding in $$d/Packages to workaround usign SHA-512 bug!); \
 			{ echo ""; echo ""; } >> Packages;; \
 		esac; \
+		echo -n '{"architecture": "$(ARCH_PACKAGES)", "packages":{' > index.json; \
+		sed -n -e 's/^Package: \(.*\)$$/"\1":/p' -e 's/^Version: \(.*\)$$/"\1",/p' Packages | tr '\n' ' ' >> index.json; \
+		echo '}}' >> index.json; \
+		sed -i 's/, }}/}}/' index.json; \
 		gzip -9nc Packages > Packages.gz; \
 	); done
 ifdef CONFIG_SIGNED_PACKAGES
diff --git a/package/base-files/Makefile b/package/base-files/Makefile
index 914f0598ff9c18..8732f82fb9815e 100644
--- a/package/base-files/Makefile
+++ b/package/base-files/Makefile
@@ -89,6 +89,19 @@ define ImageConfigOptions
 	echo 'pi_preinit_net_messages="$(CONFIG_TARGET_PREINIT_SHOW_NETMSG)"' >>$(1)/lib/preinit/00_preinit.conf
 	echo 'pi_preinit_no_failsafe_netmsg="$(CONFIG_TARGET_PREINIT_SUPPRESS_FAILSAFE_NETMSG)"' >>$(1)/lib/preinit/00_preinit.conf
 	echo 'pi_preinit_no_failsafe="$(CONFIG_TARGET_PREINIT_DISABLE_FAILSAFE)"' >>$(1)/lib/preinit/00_preinit.conf
+ifeq ($(CONFIG_TARGET_DEFAULT_LAN_IP_FROM_PREINIT),y)
+	mkdir -p $(1)/etc/board.d
+	echo '. /lib/functions/uci-defaults.sh' >$(1)/etc/board.d/99-lan-ip
+	echo 'logger -t 99-lan-ip "setting custom default LAN IP"' >>$(1)/etc/board.d/99-lan-ip
+	echo 'board_config_update' >>$(1)/etc/board.d/99-lan-ip
+	echo 'json_select network' >>$(1)/etc/board.d/99-lan-ip
+	echo 'json_select lan' >>$(1)/etc/board.d/99-lan-ip
+	echo 'json_add_string ipaddr $(if $(CONFIG_TARGET_PREINIT_IP),$(CONFIG_TARGET_PREINIT_IP),"192.168.1.1")' >>$(1)/etc/board.d/99-lan-ip
+	echo 'json_add_string netmask $(if $(CONFIG_TARGET_PREINIT_NETMASK),$(CONFIG_TARGET_PREINIT_NETMASK),"255.255.255.0")' >>$(1)/etc/board.d/99-lan-ip
+	echo 'json_select ..' >>$(1)/etc/board.d/99-lan-ip
+	echo 'json_select ..' >>$(1)/etc/board.d/99-lan-ip
+	echo 'board_config_flush' >>$(1)/etc/board.d/99-lan-ip
+endif
 endef
 
 define Build/Prepare
diff --git a/package/base-files/files/bin/config_generate b/package/base-files/files/bin/config_generate
index 38362813d1924c..be21d0079a8a7f 100755
--- a/package/base-files/files/bin/config_generate
+++ b/package/base-files/files/bin/config_generate
@@ -207,6 +207,15 @@ generate_network() {
 				EOF
 			}
 		;;
+
+		ncm|\
+		qmi|\
+		mbim)
+			uci -q batch <<-EOF
+				set network.$1.proto='${protocol}'
+				set network.$1.pdptype='ipv4'
+			EOF
+		;;
 	esac
 }
 
diff --git a/package/base-files/files/bin/ipcalc.sh b/package/base-files/files/bin/ipcalc.sh
index 5d5eac3ea80b8e..56854b4104105d 100755
--- a/package/base-files/files/bin/ipcalc.sh
+++ b/package/base-files/files/bin/ipcalc.sh
@@ -1,6 +1,5 @@
-#!/bin/sh
+#!/usr/bin/awk -f
 
-awk -f - $* <<EOF
 function bitcount(c) {
 	c=and(rshift(c, 1),0x55555555)+and(c,0x55555555)
 	c=and(rshift(c, 2),0x33333333)+and(c,0x33333333)
@@ -11,14 +10,20 @@ function bitcount(c) {
 }
 
 function ip2int(ip) {
-	for (ret=0,n=split(ip,a,"\."),x=1;x<=n;x++) ret=or(lshift(ret,8),a[x])
+	ret=0
+	n=split(ip,a,"\\.")
+	for (x=1;x<=n;x++)
+		ret=or(lshift(ret,8),a[x])
 	return ret
 }
 
 function int2ip(ip,ret,x) {
 	ret=and(ip,255)
 	ip=rshift(ip,8)
-	for(;x<3;ret=and(ip,255)"."ret,ip=rshift(ip,8),x++);
+	for(;x<3;x++) {
+		ret=and(ip,255)"."ret
+		ip=rshift(ip,8)
+	}
 	return ret
 }
 
@@ -44,28 +49,41 @@ BEGIN {
 	}
 
 	network=and(ipaddr,netmask)
+	prefix=32-bitcount(compl32(netmask))
 	broadcast=or(network,compl32(netmask))
 
+	print "IP="int2ip(ipaddr)
+	print "NETMASK="int2ip(netmask)
+	print "BROADCAST="int2ip(broadcast)
+	print "NETWORK="int2ip(network)
+	print "PREFIX="prefix
+
+	# range calculations:
+	# ipcalc <ip> <netmask> <start> <num>
+
+	if (ARGC <= 3)
+		exit(0)
+
 	start=or(network,and(ip2int(ARGV[3]),compl32(netmask)))
 	limit=network+1
 	if (start<limit) start=limit
+	if (start==ipaddr) start=ipaddr+1
 
 	end=start+ARGV[4]
 	limit=or(network,compl32(netmask))-1
 	if (end>limit) end=limit
+	if (end==ipaddr) end=ipaddr-1
 
-	print "IP="int2ip(ipaddr)
-	print "NETMASK="int2ip(netmask)
-	print "BROADCAST="int2ip(broadcast)
-	print "NETWORK="int2ip(network)
-	print "PREFIX="32-bitcount(compl32(netmask))
-
-	# range calculations:
-	# ipcalc <ip> <netmask> <start> <num>
+	if (start>end) {
+		print "network ("int2ip(network)"/"prefix") too small" > "/dev/stderr"
+		exit(1)
+	}
 
-	if (ARGC > 3) {
-		print "START="int2ip(start)
-		print "END="int2ip(end)
+	if (ipaddr > start && ipaddr < end) {
+		print "ipaddr inside range" > "/dev/stderr"
+		exit(1)
 	}
+
+	print "START="int2ip(start)
+	print "END="int2ip(end)
 }
-EOF
diff --git a/package/base-files/files/etc/init.d/sysfixtime b/package/base-files/files/etc/init.d/sysfixtime
index aab5b153d0714f..93f792266aac22 100755
--- a/package/base-files/files/etc/init.d/sysfixtime
+++ b/package/base-files/files/etc/init.d/sysfixtime
@@ -8,23 +8,33 @@ RTC_DEV=/dev/rtc0
 HWCLOCK=/sbin/hwclock
 
 boot() {
-	start && exit 0
-
-	local maxtime="$(maxtime)"
+	hwclock_load
+	local maxtime="$(find_max_time)"
 	local curtime="$(date +%s)"
-	[ $curtime -lt $maxtime ] && date -s @$maxtime
+	if [ $curtime -lt $maxtime ]; then
+		date -s @$maxtime
+		hwclock_save
+	fi
 }
 
 start() {
-	[ -e "$RTC_DEV" ] && [ -e "$HWCLOCK" ] && $HWCLOCK -s -u -f $RTC_DEV
+	hwclock_load
 }
 
 stop() {
+	hwclock_save
+}
+
+hwclock_load() {
+	[ -e "$RTC_DEV" ] && [ -e "$HWCLOCK" ] && $HWCLOCK -s -u -f $RTC_DEV
+}
+
+hwclock_save(){
 	[ -e "$RTC_DEV" ] && [ -e "$HWCLOCK" ] && $HWCLOCK -w -u -f $RTC_DEV && \
 		logger -t sysfixtime "saved '$(date)' to $RTC_DEV"
 }
 
-maxtime() {
+find_max_time() {
 	local file newest
 
 	for file in $( find /etc -type f ) ; do
diff --git a/package/base-files/files/etc/sysctl.d/10-default.conf b/package/base-files/files/etc/sysctl.d/10-default.conf
index bc8c57969514e6..ee7df2bfa61b85 100644
--- a/package/base-files/files/etc/sysctl.d/10-default.conf
+++ b/package/base-files/files/etc/sysctl.d/10-default.conf
@@ -9,6 +9,7 @@ fs.protected_hardlinks=1
 fs.protected_symlinks=1
 
 net.core.bpf_jit_enable=1
+net.core.bpf_jit_kallsyms=1
 
 net.ipv4.conf.default.arp_ignore=1
 net.ipv4.conf.all.arp_ignore=1
diff --git a/package/base-files/files/lib/functions/network.sh b/package/base-files/files/lib/functions/network.sh
index 055f18c11e0c5f..4851a5817ada07 100644
--- a/package/base-files/files/lib/functions/network.sh
+++ b/package/base-files/files/lib/functions/network.sh
@@ -90,6 +90,13 @@ network_get_prefix6() {
 	__network_ifstatus "$1" "$2" "['ipv6-prefix'][0]['address','mask']" "/"
 }
 
+# determine first IPv6 prefix assignment of given logical interface
+# 1: destination variable
+# 2: interface
+network_get_prefix_assignment6() {
+	__network_ifstatus "$1" "$2" "['ipv6-prefix-assignment'][0]['address','mask']" "/"
+}
+
 # determine all IPv4 addresses of given logical interface
 # 1: destination variable
 # 2: interface
@@ -187,6 +194,13 @@ network_get_prefixes6() {
 	__network_ifstatus "$1" "$2" "['ipv6-prefix'][*]['address','mask']" "/ "
 }
 
+# determine all IPv6 prefix assignments of given logical interface
+# 1: destination variable
+# 2: interface
+network_get_prefix_assignments6() {
+	__network_ifstatus "$1" "$2" "['ipv6-prefix-assignment'][*]['address','mask']" "/ "
+}
+
 # determine IPv4 gateway of given logical interface
 # 1: destination variable
 # 2: interface
diff --git a/package/base-files/files/lib/functions/system.sh b/package/base-files/files/lib/functions/system.sh
index 22eb00c5155e9f..d06354b01f45ef 100644
--- a/package/base-files/files/lib/functions/system.sh
+++ b/package/base-files/files/lib/functions/system.sh
@@ -129,11 +129,22 @@ mtd_get_mac_encrypted_deco() {
 	echo $macaddr
 }
 
+mtd_get_mac_uci_config_ubi() {
+	local volumename="$1"
+
+	. /lib/upgrade/nand.sh
+
+	local ubidev=$(nand_attach_ubi $CI_UBIPART)
+	local part=$(nand_find_volume $ubidev $volumename)
+
+	cat "/dev/$part" | sed -n 's/^\s*option macaddr\s*'"'"'\?\([0-9A-F:]\+\)'"'"'\?/\1/Ip'
+}
+
 mtd_get_mac_text() {
-	local mtdname=$1
-	local offset=$(($2))
+	local mtdname="$1"
+	local offset=$((${2:-0}))
+	local length="${3:-17}"
 	local part
-	local mac_dirty
 
 	part=$(find_mtd_part "$mtdname")
 	if [ -z "$part" ]; then
@@ -141,15 +152,9 @@ mtd_get_mac_text() {
 		return
 	fi
 
-	if [ -z "$offset" ]; then
-		echo "mtd_get_mac_text: offset missing!" >&2
-		return
-	fi
-
-	mac_dirty=$(dd if="$part" bs=1 skip="$offset" count=17 2>/dev/null)
+	[ $((offset + length)) -le $(mtd_get_part_size "$mtdname") ] || return
 
-	# "canonicalize" mac
-	[ -n "$mac_dirty" ] && macaddr_canonicalize "$mac_dirty"
+	macaddr_canonicalize $(dd bs=1 if="$part" skip="$offset" count="$length" 2>/dev/null)
 }
 
 mtd_get_mac_binary() {
@@ -204,6 +209,14 @@ macaddr_add() {
 	echo $oui:$nic
 }
 
+macaddr_generate_from_mmc_cid() {
+	local mmc_dev=$1
+
+	local sd_hash=$(sha256sum /sys/class/block/$mmc_dev/device/cid)
+	local mac_base=$(macaddr_canonicalize "$(echo "${sd_hash}" | dd bs=1 count=12 2>/dev/null)")
+	echo "$(macaddr_unsetbit_mc "$(macaddr_setbit_la "${mac_base}")")"
+}
+
 macaddr_geteui() {
 	local mac=$1
 	local sep=$2
@@ -283,3 +296,7 @@ macaddr_canonicalize() {
 
 	printf "%02x:%02x:%02x:%02x:%02x:%02x" 0x${canon// / 0x} 2>/dev/null
 }
+
+dt_is_enabled() {
+	grep -q okay "/proc/device-tree/$1/status"
+}
diff --git a/package/base-files/files/lib/functions/uci-defaults.sh b/package/base-files/files/lib/functions/uci-defaults.sh
index 4f5b9634bb16b5..a37e8cf82416d3 100644
--- a/package/base-files/files/lib/functions/uci-defaults.sh
+++ b/package/base-files/files/lib/functions/uci-defaults.sh
@@ -96,7 +96,7 @@ ucidef_set_interfaces_lan_wan() {
 
 ucidef_set_bridge_device() {
 	json_select_object bridge
-	json_add_string name "${1:switch0}"
+	json_add_string name "${1:-switch0}"
 	json_select ..
 }
 
@@ -646,6 +646,21 @@ ucidef_set_ntpserver() {
 	json_select ..
 }
 
+ucidef_add_wlan() {
+	local path="$1"; shift
+
+	ucidef_wlan_idx=${ucidef_wlan_idx:-0}
+
+	json_select_object wlan
+	json_select_object "wl$ucidef_wlan_idx"
+	json_add_string path "$path"
+	json_add_fields "$@"
+	json_select ..
+	json_select ..
+
+	ucidef_wlan_idx="$((ucidef_wlan_idx + 1))"
+}
+
 board_config_update() {
 	json_init
 	[ -f ${CFG} ] && json_load "$(cat ${CFG})"
diff --git a/package/base-files/files/lib/preinit/10_indicate_preinit b/package/base-files/files/lib/preinit/10_indicate_preinit
index 87a4f4da3e0aa7..a8f7758c841fe5 100644
--- a/package/base-files/files/lib/preinit/10_indicate_preinit
+++ b/package/base-files/files/lib/preinit/10_indicate_preinit
@@ -95,8 +95,6 @@ preinit_config_board() {
 		json_select "network_device"
 			json_select "$netdev"
 				json_get_vars path path
-				next_eth="$(echo "$netdev" | grep 'eth[0-9]*' | tr -dc '[0-9]')"
-				[ "$next_eth" -gt "$max_eth" ] && max_eth=$next_eth
 				if [ -n "$path" -a -h "/sys/class/net/$netdev" ]; then
 					ip link set "$netdev" down
 					ip link set "$netdev" name eth$((++max_eth))
diff --git a/package/base-files/files/lib/upgrade/common.sh b/package/base-files/files/lib/upgrade/common.sh
index 5af061f6a43990..af1182cb16a383 100644
--- a/package/base-files/files/lib/upgrade/common.sh
+++ b/package/base-files/files/lib/upgrade/common.sh
@@ -127,6 +127,33 @@ get_magic_fat32() {
 	(get_image "$@" | dd bs=1 count=5 skip=82) 2>/dev/null
 }
 
+identify_magic_long() {
+	local magic=$1
+	case "$magic" in
+		"55424923")
+			echo "ubi"
+			;;
+		"31181006")
+			echo "ubifs"
+			;;
+		"68737173")
+			echo "squashfs"
+			;;
+		"d00dfeed")
+			echo "fit"
+			;;
+		"4349"*)
+			echo "combined"
+			;;
+		"1f8b"*)
+			echo "gzip"
+			;;
+		*)
+			echo "unknown $magic"
+			;;
+	esac
+}
+
 part_magic_efi() {
 	local magic=$(get_magic_gpt "$@")
 	[ "$magic" = "EFI PART" ]
@@ -205,7 +232,7 @@ export_partdevice() {
 		while read line; do
 			export -n "$line"
 		done < "$uevent"
-		if [ $BOOTDEV_MAJOR = $MAJOR -a $(($BOOTDEV_MINOR + $offset)) = $MINOR -a -b "/dev/$DEVNAME" ]; then
+		if [ "$BOOTDEV_MAJOR" = "$MAJOR" -a $(($BOOTDEV_MINOR + $offset)) = "$MINOR" -a -b "/dev/$DEVNAME" ]; then
 			export "$var=$DEVNAME"
 			return 0
 		fi
diff --git a/package/base-files/files/lib/upgrade/emmc.sh b/package/base-files/files/lib/upgrade/emmc.sh
index c3b02864aa916b..49cffe1c658b33 100644
--- a/package/base-files/files/lib/upgrade/emmc.sh
+++ b/package/base-files/files/lib/upgrade/emmc.sh
@@ -58,7 +58,7 @@ emmc_copy_config() {
 }
 
 emmc_do_upgrade() {
-	local file_type=$(identify $1)
+	local file_type=$(identify_magic_long "$(get_magic_long "$1")")
 
 	case "$file_type" in
 		"fit")  emmc_upgrade_fit $1;;
diff --git a/package/base-files/files/lib/upgrade/nand.sh b/package/base-files/files/lib/upgrade/nand.sh
index c9960bf9d44d1d..d910bf17915982 100644
--- a/package/base-files/files/lib/upgrade/nand.sh
+++ b/package/base-files/files/lib/upgrade/nand.sh
@@ -7,6 +7,8 @@
 CI_KERNPART="${CI_KERNPART:-kernel}"
 
 # 'ubi' partition on NAND contains UBI
+# There are also CI_KERN_UBIPART and CI_ROOT_UBIPART if kernel
+# and rootfs are on separated UBIs.
 CI_UBIPART="${CI_UBIPART:-ubi}"
 
 # 'rootfs' UBI volume on NAND contains the rootfs
@@ -26,7 +28,7 @@ ubi_mknod() {
 
 nand_find_volume() {
 	local ubidevdir ubivoldir
-	ubidevdir="/sys/devices/virtual/ubi/$1"
+	ubidevdir="/sys/class/ubi/"
 	[ ! -d "$ubidevdir" ] && return 1
 	for ubivoldir in $ubidevdir/${1}_*; do
 		[ ! -d "$ubivoldir" ] && continue
@@ -39,13 +41,12 @@ nand_find_volume() {
 }
 
 nand_find_ubi() {
-	local ubidevdir ubidev mtdnum
+	local ubidevdir ubidev mtdnum cmtdnum
 	mtdnum="$( find_mtd_index $1 )"
 	[ ! "$mtdnum" ] && return 1
-	for ubidevdir in /sys/devices/virtual/ubi/ubi*; do
-		[ ! -d "$ubidevdir" ] && continue
+	for ubidevdir in /sys/class/ubi/ubi*; do
+		[ ! -e "$ubidevdir/mtd_num" ] && continue
 		cmtdnum="$( cat $ubidevdir/mtd_num )"
-		[ ! "$mtdnum" ] && continue
 		if [ "$mtdnum" = "$cmtdnum" ]; then
 			ubidev=$( basename $ubidevdir )
 			ubi_mknod "$ubidevdir"
@@ -56,48 +57,27 @@ nand_find_ubi() {
 }
 
 nand_get_magic_long() {
-	dd if="$1" skip=$2 bs=4 count=1 2>/dev/null | hexdump -v -n 4 -e '1/1 "%02x"'
+	(${3}cat "$1" | dd bs=4 "skip=${2:-0}" count=1 | hexdump -v -n 4 -e '1/1 "%02x"') 2> /dev/null
 }
 
 get_magic_long_tar() {
-	( tar xf $1 $2 -O | dd bs=4 count=1 | hexdump -v -n 4 -e '1/1 "%02x"') 2> /dev/null
+	(tar xO${3}f "$1" "$2" | dd bs=4 count=1 | hexdump -v -n 4 -e '1/1 "%02x"') 2> /dev/null
 }
 
-identify_magic() {
-	local magic=$1
-	case "$magic" in
-		"55424923")
-			echo "ubi"
-			;;
-		"31181006")
-			echo "ubifs"
-			;;
-		"68737173")
-			echo "squashfs"
-			;;
-		"d00dfeed")
-			echo "fit"
-			;;
-		"4349"*)
-			echo "combined"
-			;;
-		*)
-			echo "unknown $magic"
-			;;
-	esac
-}
-
-
 identify() {
-	identify_magic $(nand_get_magic_long "$1" "${2:-0}")
+	identify_magic_long $(nand_get_magic_long "$@")
 }
 
 identify_tar() {
-	identify_magic $(get_magic_long_tar "$1" "$2")
+	identify_magic_long $(get_magic_long_tar "$@")
+}
+
+identify_if_gzip() {
+	if [ "$(identify "$1")" = gzip ]; then echo -n z; fi
 }
 
 nand_restore_config() {
-	local ubidev=$( nand_find_ubi "$CI_UBIPART" )
+	local ubidev=$( nand_find_ubi "${CI_ROOT_UBIPART:-$CI_UBIPART}" )
 	local ubivol="$( nand_find_volume $ubidev rootfs_data )"
 	if [ ! "$ubivol" ]; then
 		ubivol="$( nand_find_volume $ubidev "$CI_ROOTPART" )"
@@ -127,59 +107,104 @@ nand_restore_config() {
 }
 
 nand_remove_ubiblock() {
-	local ubivol=$1
-	local ubiblk=ubiblock${ubivol:3}
-	if [ -e /dev/$ubiblk ]; then
-		echo "removing $ubiblk"
-		if ! ubiblock -r /dev/$ubivol; then
+	local ubivol="$1"
+
+	local ubiblk="ubiblock${ubivol:3}"
+	if [ -e "/dev/$ubiblk" ]; then
+		umount "/dev/$ubiblk" && echo "unmounted /dev/$ubiblk" || :
+		if ! ubiblock -r "/dev/$ubivol"; then
 			echo "cannot remove $ubiblk"
 			return 1
 		fi
 	fi
 }
 
-nand_upgrade_prepare_ubi() {
-	local rootfs_length="$1"
-	local rootfs_type="$2"
-	local rootfs_data_max="$(fw_printenv -n rootfs_data_max 2>/dev/null)"
-	[ -n "$rootfs_data_max" ] && rootfs_data_max=$((rootfs_data_max))
-
-	local kernel_length="$3"
-	local has_env="${4:-0}"
-
-	[ -n "$rootfs_length" -o -n "$kernel_length" ] || return 1
+nand_attach_ubi() {
+	local ubipart="$1"
+	local has_env="${2:-0}"
 
-	local mtdnum="$( find_mtd_index "$CI_UBIPART" )"
+	local mtdnum="$( find_mtd_index "$ubipart" )"
 	if [ ! "$mtdnum" ]; then
-		echo "cannot find ubi mtd partition $CI_UBIPART"
+		>&2 echo "cannot find ubi mtd partition $ubipart"
 		return 1
 	fi
 
-	local ubidev="$( nand_find_ubi "$CI_UBIPART" )"
+	local ubidev="$( nand_find_ubi "$ubipart" )"
 	if [ ! "$ubidev" ]; then
-		ubiattach -m "$mtdnum"
-		ubidev="$( nand_find_ubi "$CI_UBIPART" )"
+		>&2 ubiattach -m "$mtdnum"
+		ubidev="$( nand_find_ubi "$ubipart" )"
 
 		if [ ! "$ubidev" ]; then
-			ubiformat /dev/mtd$mtdnum -y
-			ubiattach -m "$mtdnum"
-			ubidev="$( nand_find_ubi "$CI_UBIPART" )"
+			>&2 ubiformat /dev/mtd$mtdnum -y
+			>&2 ubiattach -m "$mtdnum"
+			ubidev="$( nand_find_ubi "$ubipart" )"
 
 			if [ ! "$ubidev" ]; then
-				echo "cannot attach ubi mtd partition $CI_UBIPART"
+				>&2 echo "cannot attach ubi mtd partition $ubipart"
 				return 1
 			fi
 
 			if [ "$has_env" -gt 0 ]; then
-				ubimkvol /dev/$ubidev -n 0 -N ubootenv -s 1MiB
-				ubimkvol /dev/$ubidev -n 1 -N ubootenv2 -s 1MiB
+				>&2 ubimkvol /dev/$ubidev -n 0 -N ubootenv -s 1MiB
+				>&2 ubimkvol /dev/$ubidev -n 1 -N ubootenv2 -s 1MiB
 			fi
 		fi
 	fi
 
-	local kern_ubivol="$( nand_find_volume $ubidev "$CI_KERNPART" )"
-	local root_ubivol="$( nand_find_volume $ubidev "$CI_ROOTPART" )"
-	local data_ubivol="$( nand_find_volume $ubidev rootfs_data )"
+	echo "$ubidev"
+	return 0
+}
+
+nand_detach_ubi() {
+	local ubipart="$1"
+
+	local mtdnum="$( find_mtd_index "$ubipart" )"
+	if [ ! "$mtdnum" ]; then
+		echo "cannot find ubi mtd partition $ubipart"
+		return 1
+	fi
+
+	local ubidev="$( nand_find_ubi "$ubipart" )"
+	if [ "$ubidev" ]; then
+		for ubivol in $(find /dev -name "${ubidev}_*" -maxdepth 1 | sort); do
+			ubivol="${ubivol:5}"
+			nand_remove_ubiblock "$ubivol" || :
+			umount "/dev/$ubivol" && echo "unmounted /dev/$ubivol" || :
+		done
+		if ! ubidetach -m "$mtdnum"; then
+			echo "cannot detach ubi mtd partition $ubipart"
+			return 1
+		fi
+	fi
+}
+
+nand_upgrade_prepare_ubi() {
+	local rootfs_length="$1"
+	local rootfs_type="$2"
+	local rootfs_data_max="$(fw_printenv -n rootfs_data_max 2> /dev/null)"
+	[ -n "$rootfs_data_max" ] && rootfs_data_max=$((rootfs_data_max))
+
+	local kernel_length="$3"
+	local has_env="${4:-0}"
+	local kern_ubidev
+	local root_ubidev
+
+	[ -n "$rootfs_length" -o -n "$kernel_length" ] || return 1
+
+	if [ -n "$CI_KERN_UBIPART" -a -n "$CI_ROOT_UBIPART" ]; then
+		kern_ubidev="$( nand_attach_ubi "$CI_KERN_UBIPART" "$has_env" )"
+		[ -n "$kern_ubidev" ] || return 1
+		root_ubidev="$( nand_attach_ubi "$CI_ROOT_UBIPART" )"
+		[ -n "$root_ubidev" ] || return 1
+	else
+		kern_ubidev="$( nand_attach_ubi "$CI_UBIPART" "$has_env" )"
+		[ -n "$kern_ubidev" ] || return 1
+		root_ubidev="$kern_ubidev"
+	fi
+
+	local kern_ubivol="$( nand_find_volume $kern_ubidev "$CI_KERNPART" )"
+	local root_ubivol="$( nand_find_volume $root_ubidev "$CI_ROOTPART" )"
+	local data_ubivol="$( nand_find_volume $root_ubidev rootfs_data )"
 	[ "$root_ubivol" = "$kern_ubivol" ] && root_ubivol=
 
 	# remove ubiblocks
@@ -188,13 +213,13 @@ nand_upgrade_prepare_ubi() {
 	[ "$data_ubivol" ] && { nand_remove_ubiblock $data_ubivol || return 1; }
 
 	# kill volumes
-	[ "$kern_ubivol" ] && ubirmvol /dev/$ubidev -N "$CI_KERNPART" || :
-	[ "$root_ubivol" ] && ubirmvol /dev/$ubidev -N "$CI_ROOTPART" || :
-	[ "$data_ubivol" ] && ubirmvol /dev/$ubidev -N rootfs_data || :
+	[ "$kern_ubivol" ] && ubirmvol /dev/$kern_ubidev -N "$CI_KERNPART" || :
+	[ "$root_ubivol" ] && ubirmvol /dev/$root_ubidev -N "$CI_ROOTPART" || :
+	[ "$data_ubivol" ] && ubirmvol /dev/$root_ubidev -N rootfs_data || :
 
 	# create kernel vol
 	if [ -n "$kernel_length" ]; then
-		if ! ubimkvol /dev/$ubidev -N "$CI_KERNPART" -s $kernel_length; then
+		if ! ubimkvol /dev/$kern_ubidev -N "$CI_KERNPART" -s $kernel_length; then
 			echo "cannot create kernel volume"
 			return 1;
 		fi
@@ -208,7 +233,7 @@ nand_upgrade_prepare_ubi() {
 		else
 			rootfs_size_param="-s $rootfs_length"
 		fi
-		if ! ubimkvol /dev/$ubidev -N "$CI_ROOTPART" $rootfs_size_param; then
+		if ! ubimkvol /dev/$root_ubidev -N "$CI_ROOTPART" $rootfs_size_param; then
 			echo "cannot create rootfs volume"
 			return 1;
 		fi
@@ -220,8 +245,8 @@ nand_upgrade_prepare_ubi() {
 		if [ -n "$rootfs_data_max" ]; then
 			rootfs_data_size_param="-s $rootfs_data_max"
 		fi
-		if ! ubimkvol /dev/$ubidev -N rootfs_data $rootfs_data_size_param; then
-			if ! ubimkvol /dev/$ubidev -N rootfs_data -m; then
+		if ! ubimkvol /dev/$root_ubidev -N rootfs_data $rootfs_data_size_param; then
+			if ! ubimkvol /dev/$root_ubidev -N rootfs_data -m; then
 				echo "cannot initialize rootfs_data volume"
 				return 1
 			fi
@@ -231,76 +256,67 @@ nand_upgrade_prepare_ubi() {
 	return 0
 }
 
-nand_do_upgrade_success() {
-	local conf_tar="/tmp/sysupgrade.tgz"
-	if { [ ! -f "$conf_tar" ] || nand_restore_config "$conf_tar"; } && sync; then
-		echo "sysupgrade successful"
-	fi
-	umount -a
-	reboot -f
-}
-
-# Flash the UBI image to MTD partition
+# Write the UBI image to MTD ubi partition
 nand_upgrade_ubinized() {
 	local ubi_file="$1"
-	local mtdnum="$(find_mtd_index "$CI_UBIPART")"
+	local gz="$2"
 
-	if [ ! "$mtdnum" ]; then
-		echo "cannot find mtd device $CI_UBIPART"
-		umount -a
-		reboot -f
-	fi
+	local ubi_length=$( (${gz}cat "$ubi_file" | wc -c) 2> /dev/null)
 
-	local mtddev="/dev/mtd${mtdnum}"
-	ubidetach -p "${mtddev}" || :
-	ubiformat "${mtddev}" -y -f "${ubi_file}"
-	ubiattach -p "${mtddev}"
+	nand_detach_ubi "$CI_UBIPART" || return 1
 
-	nand_do_upgrade_success
+	local mtdnum="$( find_mtd_index "$CI_UBIPART" )"
+	${gz}cat "$ubi_file" | ubiformat "/dev/mtd$mtdnum" -S "$ubi_length" -y -f - && ubiattach -m "$mtdnum"
 }
 
-# Write the UBIFS image to UBI volume
+# Write the UBIFS image to UBI rootfs volume
 nand_upgrade_ubifs() {
-	local rootfs_length=$( (cat $1 | wc -c) 2> /dev/null)
+	local ubifs_file="$1"
+	local gz="$2"
+
+	local ubifs_length=$( (${gz}cat "$ubifs_file" | wc -c) 2> /dev/null)
 
-	nand_upgrade_prepare_ubi "$rootfs_length" "ubifs" "" ""
+	nand_upgrade_prepare_ubi "$ubifs_length" "ubifs" "" "" || return 1
 
 	local ubidev="$( nand_find_ubi "$CI_UBIPART" )"
 	local root_ubivol="$(nand_find_volume $ubidev "$CI_ROOTPART")"
-	ubiupdatevol /dev/$root_ubivol -s $rootfs_length $1
-
-	nand_do_upgrade_success
+	${gz}cat "$ubifs_file" | ubiupdatevol /dev/$root_ubivol -s "$ubifs_length" -
 }
 
+# Write the FIT image to UBI kernel volume
 nand_upgrade_fit() {
 	local fit_file="$1"
-	local fit_length="$(wc -c < "$fit_file")"
+	local gz="$2"
+
+	local fit_length=$( (${gz}cat "$fit_file" | wc -c) 2> /dev/null)
 
-	nand_upgrade_prepare_ubi "" "" "$fit_length" "1"
+	nand_upgrade_prepare_ubi "" "" "$fit_length" "1" || return 1
 
 	local fit_ubidev="$(nand_find_ubi "$CI_UBIPART")"
 	local fit_ubivol="$(nand_find_volume $fit_ubidev "$CI_KERNPART")"
-	ubiupdatevol /dev/$fit_ubivol -s $fit_length $fit_file
-
-	nand_do_upgrade_success
+	${gz}cat "$fit_file" | ubiupdatevol /dev/$fit_ubivol -s "$fit_length" -
 }
 
+# Write images in the TAR file to MTD partitions and/or UBI volumes as required
 nand_upgrade_tar() {
 	local tar_file="$1"
+	local gz="$2"
+	local jffs2_markers="${CI_JFFS2_CLEAN_MARKERS:-0}"
 
-	local board_dir="$(tar tf "$tar_file" | grep -m 1 '^sysupgrade-.*/$')"
+	# WARNING: This fails if tar contains more than one 'sysupgrade-*' directory.
+	local board_dir="$(tar t${gz}f "$tar_file" | grep -m 1 '^sysupgrade-.*/$')"
 	board_dir="${board_dir%/}"
 
 	local kernel_mtd kernel_length
 	if [ "$CI_KERNPART" != "none" ]; then
 		kernel_mtd="$(find_mtd_index "$CI_KERNPART")"
-		kernel_length=$( (tar xf "$tar_file" "$board_dir/kernel" -O | wc -c) 2> /dev/null)
+		kernel_length=$( (tar xO${gz}f "$tar_file" "$board_dir/kernel" | wc -c) 2> /dev/null)
 		[ "$kernel_length" = 0 ] && kernel_length=
 	fi
-	local rootfs_length=$( (tar xf "$tar_file" "$board_dir/root" -O | wc -c) 2> /dev/null)
+	local rootfs_length=$( (tar xO${gz}f "$tar_file" "$board_dir/root" | wc -c) 2> /dev/null)
 	[ "$rootfs_length" = 0 ] && rootfs_length=
 	local rootfs_type
-	[ "$rootfs_length" ] && rootfs_type="$(identify_tar "$tar_file" "$board_dir/root")"
+	[ "$rootfs_length" ] && rootfs_type="$(identify_tar "$tar_file" "$board_dir/root" "$gz")"
 
 	local ubi_kernel_length
 	if [ "$kernel_length" ]; then
@@ -308,58 +324,133 @@ nand_upgrade_tar() {
 			# On some devices, the raw kernel and ubi partitions overlap.
 			# These devices brick if the kernel partition is erased.
 			# Hence only invalidate kernel for now.
-			dd if=/dev/zero bs=4096 count=1 2>/dev/null | \
+			dd if=/dev/zero bs=4096 count=1 2> /dev/null | \
 				mtd write - "$CI_KERNPART"
 		else
 			ubi_kernel_length="$kernel_length"
 		fi
 	fi
+
 	local has_env=0
-	nand_upgrade_prepare_ubi "$rootfs_length" "$rootfs_type" "$ubi_kernel_length" "$has_env"
+	nand_upgrade_prepare_ubi "$rootfs_length" "$rootfs_type" "$ubi_kernel_length" "$has_env" || return 1
 
-	local ubidev="$( nand_find_ubi "$CI_UBIPART" )"
 	if [ "$rootfs_length" ]; then
+		local ubidev="$( nand_find_ubi "${CI_ROOT_UBIPART:-$CI_UBIPART}" )"
 		local root_ubivol="$( nand_find_volume $ubidev "$CI_ROOTPART" )"
-		tar xf "$tar_file" "$board_dir/root" -O | \
-			ubiupdatevol /dev/$root_ubivol -s $rootfs_length -
+		tar xO${gz}f "$tar_file" "$board_dir/root" | \
+			ubiupdatevol /dev/$root_ubivol -s "$rootfs_length" -
 	fi
 	if [ "$kernel_length" ]; then
 		if [ "$kernel_mtd" ]; then
-			tar xf "$tar_file" "$board_dir/kernel" -O | \
-				mtd write - "$CI_KERNPART"
+			if [ "$jffs2_markers" = 1 ]; then
+				flash_erase -j "/dev/mtd${kernel_mtd}" 0 0
+				tar xO${gz}f "$tar_file" "$board_dir/kernel" | \
+					nandwrite "/dev/mtd${kernel_mtd}" -
+			else
+				tar xO${gz}f "$tar_file" "$board_dir/kernel" | \
+					mtd write - "$CI_KERNPART"
+			fi
 		else
+			local ubidev="$( nand_find_ubi "${CI_KERN_UBIPART:-$CI_UBIPART}" )"
 			local kern_ubivol="$( nand_find_volume $ubidev "$CI_KERNPART" )"
-			tar xf "$tar_file" "$board_dir/kernel" -O | \
-				ubiupdatevol /dev/$kern_ubivol -s $kernel_length -
+			tar xO${gz}f "$tar_file" "$board_dir/kernel" | \
+				ubiupdatevol /dev/$kern_ubivol -s "$kernel_length" -
 		fi
 	fi
 
-	nand_do_upgrade_success
+	return 0
 }
 
-# Recognize type of passed file and start the upgrade process
-nand_do_upgrade() {
-	local file_type=$(identify "$1")
+nand_verify_if_gzip_file() {
+	local file="$1"
+	local gz="$2"
+
+	if [ "$gz" = z ]; then
+		echo "verifying compressed sysupgrade file integrity"
+		if ! gzip -t "$file"; then
+			echo "corrupted compressed sysupgrade file"
+			return 1
+		fi
+	fi
+}
+
+nand_verify_tar_file() {
+	local file="$1"
+	local gz="$2"
+
+	echo "verifying sysupgrade tar file integrity"
+	if ! tar xO${gz}f "$file" > /dev/null; then
+		echo "corrupted sysupgrade tar file"
+		return 1
+	fi
+}
+
+nand_do_flash_file() {
+	local file="$1"
+
+	local gz="$(identify_if_gzip "$file")"
+	local file_type="$(identify "$file" "" "$gz")"
 
 	[ ! "$(find_mtd_index "$CI_UBIPART")" ] && CI_UBIPART=rootfs
 
-	sync
 	case "$file_type" in
-		"fit")		nand_upgrade_fit "$1";;
-		"ubi")		nand_upgrade_ubinized "$1";;
-		"ubifs")	nand_upgrade_ubifs "$1";;
-		*)		nand_upgrade_tar "$1";;
+		"fit")
+			nand_verify_if_gzip_file "$file" "$gz" || return 1
+			nand_upgrade_fit "$file" "$gz"
+			;;
+		"ubi")
+			nand_verify_if_gzip_file "$file" "$gz" || return 1
+			nand_upgrade_ubinized "$file" "$gz"
+			;;
+		"ubifs")
+			nand_verify_if_gzip_file "$file" "$gz" || return 1
+			nand_upgrade_ubifs "$file" "$gz"
+			;;
+		*)
+			nand_verify_tar_file "$file" "$gz" || return 1
+			nand_upgrade_tar "$file" "$gz"
+			;;
 	esac
 }
 
-# Check if passed file is a valid one for NAND sysupgrade. Currently it accepts
-# 3 types of files:
-# 1) UBI - should contain an ubinized image, header is checked for the proper
-#    MAGIC
-# 2) UBIFS - should contain UBIFS partition that will replace "rootfs" volume,
-#    header is checked for the proper MAGIC
-# 3) TAR - archive has to include "sysupgrade-BOARD" directory with a non-empty
-#    "CONTROL" file (at this point its content isn't verified)
+nand_do_restore_config() {
+	local conf_tar="/tmp/sysupgrade.tgz"
+	[ ! -f "$conf_tar" ] || nand_restore_config "$conf_tar"
+}
+
+# Recognize type of passed file and start the upgrade process
+nand_do_upgrade() {
+	local file="$1"
+
+	sync
+	nand_do_flash_file "$file" && nand_do_upgrade_success
+	nand_do_upgrade_failed
+}
+
+nand_do_upgrade_success() {
+	if nand_do_restore_config && sync; then
+		echo "sysupgrade successful"
+		umount -a
+		reboot -f
+	fi
+	nand_do_upgrade_failed
+}
+
+nand_do_upgrade_failed() {
+	sync
+	echo "sysupgrade failed"
+	# Should we reboot or bring up some failsafe mode instead?
+	umount -a
+	reboot -f
+}
+
+# Check if passed file is a valid one for NAND sysupgrade.
+# Currently it accepts 4 types of files:
+# 1) UBI: a ubinized image containing required UBI volumes.
+# 2) UBIFS: a UBIFS rootfs volume image.
+# 3) FIT: a FIT image containing kernel and rootfs.
+# 4) TAR: an archive that includes directory "sysupgrade-${BOARD_NAME}" containing
+#         a non-empty "CONTROL" file and required partition and/or volume images.
 #
 # You usually want to call this function in platform_check_image.
 #
@@ -367,14 +458,25 @@ nand_do_upgrade() {
 # $(2): file to be checked
 nand_do_platform_check() {
 	local board_name="$1"
-	local tar_file="$2"
-	local control_length=$( (tar xf $tar_file sysupgrade-$board_name/CONTROL -O | wc -c) 2> /dev/null)
-	local file_type="$(identify $2)"
+	local file="$2"
 
-	[ "$control_length" = 0 -a "$file_type" != "ubi" -a "$file_type" != "ubifs" -a "$file_type" != "fit" ] && {
-		echo "Invalid sysupgrade file."
-		return 1
-	}
+	local gz="$(identify_if_gzip "$file")"
+	local file_type="$(identify "$file" "" "$gz")"
+	local control_length=$( (tar xO${gz}f "$file" "sysupgrade-${board_name//,/_}/CONTROL" | wc -c) 2> /dev/null)
+
+	if [ "$control_length" = 0 ]; then
+		control_length=$( (tar xO${gz}f "$file" "sysupgrade-${board_name//_/,}/CONTROL" | wc -c) 2> /dev/null)
+	fi
+
+	if [ "$control_length" != 0 ]; then
+		nand_verify_tar_file "$file" "$gz" || return 1
+	else
+		nand_verify_if_gzip_file "$file" "$gz" || return 1
+		if [ "$file_type" != "fit" -a "$file_type" != "ubi" -a "$file_type" != "ubifs" ]; then
+			echo "invalid sysupgrade file"
+			return 1
+		fi
+	fi
 
 	return 0
 }
diff --git a/package/base-files/files/lib/upgrade/stage2 b/package/base-files/files/lib/upgrade/stage2
index 5e0d73631b0c73..f4db88d31ea18f 100755
--- a/package/base-files/files/lib/upgrade/stage2
+++ b/package/base-files/files/lib/upgrade/stage2
@@ -39,9 +39,9 @@ switch_to_ramfs() {
 	for binary in \
 		/bin/busybox /bin/ash /bin/sh /bin/mount /bin/umount	\
 		pivot_root mount_root reboot sync kill sleep		\
-		md5sum hexdump cat zcat dd tar				\
+		md5sum hexdump cat zcat dd tar gzip			\
 		ls basename find cp mv rm mkdir rmdir mknod touch chmod \
-		'[' printf wc grep awk sed cut				\
+		'[' printf wc grep awk sed cut sort tail		\
 		mtd partx losetup mkfs.ext4 nandwrite flash_erase	\
 		ubiupdatevol ubiattach ubiblock ubiformat		\
 		ubidetach ubirsvol ubirmvol ubimkvol			\
diff --git a/package/base-files/files/sbin/wifi b/package/base-files/files/sbin/wifi
index 6b9662fe93007b..a3d3206ee732dc 100755
--- a/package/base-files/files/sbin/wifi
+++ b/package/base-files/files/sbin/wifi
@@ -6,7 +6,7 @@
 
 usage() {
 	cat <<EOF
-Usage: $0 [config|up|down|reconf|reload|status]
+Usage: $0 [config|up|down|reconf|reload|status|isup]
 enables (default), disables or configures devices not yet configured.
 EOF
 	exit 1
@@ -17,8 +17,24 @@ ubus_wifi_cmd() {
 	local dev="$2"
 
 	json_init
-	[ -n "$2" ] && json_add_string device "$2"
-	ubus call network.wireless "$1" "$(json_dump)"
+	[ -n "$dev" ] && json_add_string device "$dev"
+	ubus call network.wireless "$cmd" "$(json_dump)"
+}
+
+wifi_isup() {
+	local dev="$1"
+
+	json_load "$(ubus_wifi_cmd "status" "$dev")"
+	json_get_keys devices
+
+	for device in $devices; do
+		json_select "$device"
+			json_get_var up up
+			[ $up -eq 0 ] && return 1
+		json_select ..
+	done
+
+	return 0
 }
 
 find_net_config() {(
@@ -128,14 +144,14 @@ wifi_updown() {
 	[ enable = "$1" ] && {
 		_wifi_updown disable "$2"
 		ubus_wifi_cmd "$cmd" "$2"
+		ubus call network reload
 		scan_wifi
 		cmd=up
-		ubus call network reload
 	}
 	[ reconf = "$1" ] && {
+		ubus call network reload
 		scan_wifi
 		cmd=reconf
-		ubus call network reload
 	}
 	ubus_wifi_cmd "$cmd" "$2"
 	_wifi_updown "$@"
@@ -245,6 +261,7 @@ case "$1" in
 	detect) wifi_detect_notice ;;
 	config) wifi_config ;;
 	status) ubus_wifi_cmd "status" "$2";;
+	isup) wifi_isup "$2"; exit $?;;
 	reload) wifi_reload "$2";;
 	reload_legacy) wifi_reload_legacy "$2";;
 	--help|help) usage;;
diff --git a/package/base-files/image-config.in b/package/base-files/image-config.in
index ac406bc456bd91..2de2130b8490d9 100644
--- a/package/base-files/image-config.in
+++ b/package/base-files/image-config.in
@@ -5,6 +5,13 @@
 # See /LICENSE for more information.
 #
 
+config TARGET_DEFAULT_LAN_IP_FROM_PREINIT
+	bool "Use preinit IP configuration as default LAN IP" if IMAGEOPT
+	default n
+	help
+		Enabling this will set the default LAN IP address and netmask
+		to the preinit values set in the image config.
+
 menuconfig PREINITOPT
 	bool "Preinit configuration options" if IMAGEOPT
 	default n
diff --git a/package/boot/arm-trusted-firmware-bcm63xx/Makefile b/package/boot/arm-trusted-firmware-bcm63xx/Makefile
index 7db1fbfff0c7c4..69289af2d9e887 100644
--- a/package/boot/arm-trusted-firmware-bcm63xx/Makefile
+++ b/package/boot/arm-trusted-firmware-bcm63xx/Makefile
@@ -3,7 +3,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_VERSION:=2.2
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=2
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/bcm63xx/atf.git
diff --git a/package/boot/arm-trusted-firmware-mediatek/Makefile b/package/boot/arm-trusted-firmware-mediatek/Makefile
index c54373f6bdffee..2098d0835f83b3 100644
--- a/package/boot/arm-trusted-firmware-mediatek/Makefile
+++ b/package/boot/arm-trusted-firmware-mediatek/Makefile
@@ -9,7 +9,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=arm-trusted-firmware-mediatek
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=https://github.com/mtk-openwrt/arm-trusted-firmware.git
@@ -30,6 +30,7 @@ define Trusted-Firmware-A/Default
   DDR3_FLYBY:=
   DDR_TYPE:=
   NAND_TYPE:=
+  BOARD_QFN:=
 endef
 
 define Trusted-Firmware-A/mt7622-nor-1ddr
@@ -92,6 +93,46 @@ define Trusted-Firmware-A/mt7622-sdmmc-2ddr
   DDR3_FLYBY:=1
 endef
 
+define Trusted-Firmware-A/mt7981-nor-ddr3
+  NAME:=MediaTek MT7981 (SPI-NOR, DDR3)
+  BOOT_DEVICE:=nor
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7981
+  DDR_TYPE:=ddr3
+endef
+
+define Trusted-Firmware-A/mt7981-emmc-ddr3
+  NAME:=MediaTek MT7981 (eMMC, DDR3)
+  BOOT_DEVICE:=emmc
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7981
+  DDR_TYPE:=ddr3
+endef
+
+define Trusted-Firmware-A/mt7981-sdmmc-ddr3
+  NAME:=MediaTek MT7981 (SD card, DDR3)
+  BOOT_DEVICE:=sdmmc
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7981
+  DDR_TYPE:=ddr3
+endef
+
+define Trusted-Firmware-A/mt7986-snand-ddr3
+  NAME:=MediaTek MT7981 (SPI-NAND via SNFI, DDR3)
+  BOOT_DEVICE:=snand
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7981
+  DDR_TYPE:=ddr3
+endef
+
+define Trusted-Firmware-A/mt7981-spim-nand-ddr3
+  NAME:=MediaTek MT7981 (SPI-NAND via SPIM, DDR3)
+  BOOT_DEVICE:=spim-nand
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7981
+  DDR_TYPE:=ddr3
+endef
+
 define Trusted-Firmware-A/mt7986-nor-ddr4
   NAME:=MediaTek MT7986 (SPI-NOR, DDR4)
   BOOT_DEVICE:=nor
@@ -182,6 +223,11 @@ TFA_TARGETS:= \
 	mt7622-emmc-2ddr \
 	mt7622-sdmmc-1ddr \
 	mt7622-sdmmc-2ddr \
+	mt7981-emmc-ddr3 \
+	mt7981-nor-ddr3 \
+	mt7981-sdmmc-ddr3 \
+	mt7986-snand-ddr3 \
+	mt7981-spim-nand-ddr3 \
 	mt7986-emmc-ddr3 \
 	mt7986-nor-ddr3 \
 	mt7986-sdmmc-ddr3 \
@@ -197,6 +243,7 @@ TFA_MAKE_FLAGS += \
 	BOOT_DEVICE=$(BOOT_DEVICE) \
 	USE_MKIMAGE=1 MKIMAGE=$(STAGING_DIR_HOST)/bin/mkimage \
 	$(if $(findstring ddr4,$(DDR_TYPE)),DRAM_USE_DDR4=1) \
+	$(if $(BOARD_QFN),BOARD_QFN=1,BOARD_BGA=1) \
 	$(if $(NAND_TYPE),NAND_TYPE=$(NAND_TYPE)) \
 	HAVE_DRAM_OBJ_FILE=yes \
 	$(if $(DDR3_FLYBY),DDR3_FLYBY=1) \
diff --git a/package/boot/arm-trusted-firmware-mvebu/Makefile b/package/boot/arm-trusted-firmware-mvebu/Makefile
index dba4836a6b9886..a644ee1e47711f 100644
--- a/package/boot/arm-trusted-firmware-mvebu/Makefile
+++ b/package/boot/arm-trusted-firmware-mvebu/Makefile
@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_VERSION:=2.7
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=6
 PKG_HASH:=53422dc649153838e03820330ba17cb10afe3e330ecde0db11e4d5f1361a33e6
 
 PKG_MAINTAINER:=Vladimir Vid <vladimir.vid@sartura.hr>
@@ -97,6 +97,16 @@ define Trusted-Firmware-A/udpu
   PLAT:=a3700
 endef
 
+define Trusted-Firmware-A/edpu
+  NAME:=Methode eDPU
+  DEPENDS:=+u-boot-eDPU
+  BUILD_DEVICES:=methode_edpu
+  UBOOT:=eDPU
+  DDR_TOPOLOGY:=0
+  CLOCKSPRESET:=CPU_1000_DDR_800
+  PLAT:=a3700
+endef
+
 
 TFA_TARGETS:= \
 	espressobin-512mb \
@@ -105,15 +115,18 @@ TFA_TARGETS:= \
 	espressobin-v3-v5-2gb \
 	espressobin-v7-1gb \
 	espressobin-v7-2gb \
-	udpu
+	udpu \
+	edpu
 
 TFA_MAKE_FLAGS += \
-		CROSS_CM3=$(STAGING_DIR_IMAGE)/$(CM3_GCC_NAME)-$(CM3_GCC_RELEASE)-$(CM3_GCC_VERSION)/bin/arm-none-eabi- \
+		CROSS_CM3=$(BUILD_DIR)/$(CM3_GCC_NAME)-$(CM3_GCC_RELEASE)-$(CM3_GCC_VERSION)/bin/arm-none-eabi- \
 		BL33=$(STAGING_DIR_IMAGE)/$(UBOOT)-u-boot.bin \
-		MV_DDR_PATH=$(STAGING_DIR_IMAGE)/$(MV_DDR_NAME) \
-		WTP=$(STAGING_DIR_IMAGE)/$(A3700_UTILS_NAME) \
-		WTMI_IMG=$(STAGING_DIR_IMAGE)/$(MOX_BB_NAME)-$(MOX_BB_RELEASE)/wtmi_app.bin \
-		CRYPTOPP_PATH=$(STAGING_DIR_IMAGE)/$(CRYPTOPP_NAME) \
+		MV_DDR_PATH=$(BUILD_DIR)/$(MV_DDR_NAME) \
+		WTP=$(BUILD_DIR)/$(A3700_UTILS_NAME) \
+		WTMI_IMG=$(BUILD_DIR)/$(MOX_BB_NAME)-$(MOX_BB_RELEASE)/wtmi_app.bin \
+		CRYPTOPP_PATH=$(BUILD_DIR)/$(CRYPTOPP_NAME) \
+		HOST_LDFLAGS="$(HOST_LDFLAGS)" \
+		HOST_CPPFLAGS="$(HOST_CPPFLAGS)" \
 		USE_COHERENT_MEM=0 \
 		FIP_ALIGN=0x100 \
 		DDR_TOPOLOGY=$(DDR_TOPOLOGY) \
@@ -190,11 +203,11 @@ endef
 
 define Build/Clean
 	rm -rf \
-		$(STAGING_DIR_IMAGE)/$(CRYPTOPP_NAME) \
-		$(STAGING_DIR_IMAGE)/$(A3700_UTILS_NAME) \
-		$(STAGING_DIR_IMAGE)/$(MV_DDR_NAME) \
-		$(STAGING_DIR_IMAGE)/$(MOX_BB_NAME)-$(MOX_BB_RELEASE) \
-		$(STAGING_DIR_IMAGE)/$(CM3_GCC_NAME)-$(CM3_GCC_RELEASE)-$(CM3_GCC_VERSION)
+		$(BUILD_DIR)/$(CRYPTOPP_NAME) \
+		$(BUILD_DIR)/$(A3700_UTILS_NAME) \
+		$(BUILD_DIR)/$(MV_DDR_NAME) \
+		$(BUILD_DIR)/$(MOX_BB_NAME)-$(MOX_BB_RELEASE) \
+		$(BUILD_DIR)/$(CM3_GCC_NAME)-$(CM3_GCC_RELEASE)-$(CM3_GCC_VERSION)
 endef
 
 define Build/Prepare
@@ -207,23 +220,22 @@ define Build/Prepare
 
 	$(call Build/Prepare/Default,)
 
-	mkdir -p $(STAGING_DIR_IMAGE)
-	$(TAR) -C $(STAGING_DIR_IMAGE) -xf $(DL_DIR)/$(CRYPTOPP_SOURCE)
-	$(TAR) -C $(STAGING_DIR_IMAGE) -xf $(DL_DIR)/$(A3700_UTILS_SOURCE)
-	$(call PatchDir/Default,$(STAGING_DIR_IMAGE)/$(A3700_UTILS_NAME),./patches-a3700-utils)
-	$(TAR) -C $(STAGING_DIR_IMAGE) -xf $(DL_DIR)/$(MV_DDR_SOURCE)
-	$(call PatchDir/Default,$(STAGING_DIR_IMAGE)/$(MV_DDR_NAME),./patches-mv-ddr-marvell)
-	$(TAR) -C $(STAGING_DIR_IMAGE) -xf $(DL_DIR)/$(MOX_BB_SOURCE)
-	$(call PatchDir/Default,$(STAGING_DIR_IMAGE)/$(MOX_BB_NAME)-$(MOX_BB_RELEASE),./patches-mox-boot-builder)
-	$(TAR) -C $(STAGING_DIR_IMAGE) -xf $(DL_DIR)/$(CM3_GCC_SOURCE)
+	$(TAR) -C $(BUILD_DIR) -xf $(DL_DIR)/$(CRYPTOPP_SOURCE)
+	$(TAR) -C $(BUILD_DIR) -xf $(DL_DIR)/$(A3700_UTILS_SOURCE)
+	$(call PatchDir/Default,$(BUILD_DIR)/$(A3700_UTILS_NAME),./patches-a3700-utils)
+	$(TAR) -C $(BUILD_DIR) -xf $(DL_DIR)/$(MV_DDR_SOURCE)
+	$(call PatchDir/Default,$(BUILD_DIR)/$(MV_DDR_NAME),./patches-mv-ddr-marvell)
+	$(TAR) -C $(BUILD_DIR) -xf $(DL_DIR)/$(MOX_BB_SOURCE)
+	$(call PatchDir/Default,$(BUILD_DIR)/$(MOX_BB_NAME)-$(MOX_BB_RELEASE),./patches-mox-boot-builder)
+	$(TAR) -C $(BUILD_DIR) -xf $(DL_DIR)/$(CM3_GCC_SOURCE)
 endef
 
 define Build/Compile
 	+$(MAKE) \
-		CROSS_CM3=$(STAGING_DIR_IMAGE)/$(CM3_GCC_NAME)-$(CM3_GCC_RELEASE)-$(CM3_GCC_VERSION)/bin/arm-none-eabi- \
+		CROSS_CM3=$(BUILD_DIR)/$(CM3_GCC_NAME)-$(CM3_GCC_RELEASE)-$(CM3_GCC_VERSION)/bin/arm-none-eabi- \
 		WTMI_VERSION=$(MOX_BB_RELEASE) \
 		CRYPTOPP_PATH=$PWD/cryptopp/ \
-		-C $(STAGING_DIR_IMAGE)/$(MOX_BB_NAME)-$(MOX_BB_RELEASE) \
+		-C $(BUILD_DIR)/$(MOX_BB_NAME)-$(MOX_BB_RELEASE) \
 		wtmi_app.bin
 	$(call Build/Compile/Default)
 endef
diff --git a/package/boot/arm-trusted-firmware-mvebu/patches/002-cryptopp_ldflags.patch b/package/boot/arm-trusted-firmware-mvebu/patches/002-cryptopp_ldflags.patch
new file mode 100644
index 00000000000000..c4de8fe7df1b43
--- /dev/null
+++ b/package/boot/arm-trusted-firmware-mvebu/patches/002-cryptopp_ldflags.patch
@@ -0,0 +1,13 @@
+Forward the host compiler flags to the compilation of the cryptopp library.
+
+--- a/plat/marvell/armada/a3k/common/a3700_common.mk
++++ b/plat/marvell/armada/a3k/common/a3700_common.mk
+@@ -149,7 +149,7 @@ $(TBB): FORCE
+ 	$(if $(wildcard $(CRYPTOPP_LIBDIR)/*),,$(error "Either 'CRYPTOPP_PATH' or 'CRYPTOPP_LIB' was set to '$(CRYPTOPP_LIBDIR)', but '$(CRYPTOPP_LIBDIR)' does not exist"))
+ 	$(if $(wildcard $(CRYPTOPP_INCDIR)/*),,$(error "Either 'CRYPTOPP_PATH' or 'CRYPTOPP_INCDIR' was set to '$(CRYPTOPP_INCDIR)', but '$(CRYPTOPP_INCDIR)' does not exist"))
+ ifdef CRYPTOPP_PATH
+-	$(Q)$(MAKE) --no-print-directory -C $(CRYPTOPP_PATH) -f GNUmakefile
++	$(Q)$(MAKE) --no-print-directory -C $(CRYPTOPP_PATH) -f GNUmakefile LDFLAGS="$(HOST_LDFLAGS)" CPPFLAGS="$(HOST_CPPFLAGS)"
+ endif
+ 	$(Q)$(MAKE) --no-print-directory -C $(WTP)/wtptp/src/TBB_Linux -f TBB_linux.mak LIBDIR=$(CRYPTOPP_LIBDIR) INCDIR=$(CRYPTOPP_INCDIR)
+ 
diff --git a/package/boot/arm-trusted-firmware-sunxi/Makefile b/package/boot/arm-trusted-firmware-sunxi/Makefile
index 178b3958b822e5..0535640f9574bc 100644
--- a/package/boot/arm-trusted-firmware-sunxi/Makefile
+++ b/package/boot/arm-trusted-firmware-sunxi/Makefile
@@ -7,14 +7,10 @@
 
 include $(TOPDIR)/rules.mk
 
-PKG_NAME:=arm-trusted-firmware-sunxi
+PKG_VERSION:=2.8
 PKG_RELEASE:=1
 
-PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL=https://github.com/ARM-software/arm-trusted-firmware
-PKG_SOURCE_DATE:=2020-11-17
-PKG_SOURCE_VERSION:=e2c509a39c6cc4dda8734e6509cdbe6e3603cdfc
-PKG_MIRROR_HASH:=b212d369a5286ebbf6a5616486efa05fa54d4294fd6e9ba2e54fdfae9eda918d
+PKG_HASH:=df4e0f3803479df0ea4cbf3330b59731bc2efc2112c951f9adb3685229163af9
 
 PKG_LICENSE:=BSD-3-Clause
 PKG_LICENSE_FILES:=license.md
@@ -25,40 +21,28 @@ include $(INCLUDE_DIR)/kernel.mk
 include $(INCLUDE_DIR)/trusted-firmware-a.mk
 include $(INCLUDE_DIR)/package.mk
 
-
-define Package/arm-trusted-firmware-sunxi/Default
-    SECTION:=boot
-    CATEGORY:=Boot Loaders
-    TITLE:=ARM Trusted Firmware for Allwinner
-    DEPENDS:=@TARGET_sunxi_cortexa53
+define Trusted-Firmware-A/Default
+	BUILD_TARGET:=sunxi
+	BUILD_SUBTARGET:=cortexa53
 endef
 
-define Package/arm-trusted-firmware-sunxi-a64
-    $(call Package/arm-trusted-firmware-sunxi/Default)
-    VARIANT:=sun50i_a64
+define Trusted-Firmware-A/sunxi-a64
+	NAME:=Allwinner A64
+	PLAT:=sun50i_a64
 endef
 
-define Package/arm-trusted-firmware-sunxi-h6
-    $(call Package/arm-trusted-firmware-sunxi/Default)
-    VARIANT:=sun50i_h6
+define Trusted-Firmware-A/sunxi-h6
+	NAME:=Allwinner H6
+	PLAT:=sun50i_h6
 endef
 
-export GCC_HONOUR_COPTS=s
-
-MAKE_VARS = \
-	CROSS_COMPILE="$(TARGET_CROSS)"
-
-MAKE_FLAGS += \
-	PLAT=$(BUILD_VARIANT) \
-	bl31
+TFA_TARGETS:= \
+	sunxi-a64 \
+	sunxi-h6
 
-define Build/InstallDev
+define Package/trusted-firmware-a/install
 	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
-	$(CP) $(PKG_BUILD_DIR)/build/$(BUILD_VARIANT)/release/bl31.bin $(STAGING_DIR_IMAGE)/bl31_$(BUILD_VARIANT).bin
-endef
-
-define Package/arm-trusted-firmware-sunxi/install
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/build/$(PLAT)/release/bl31.bin $(STAGING_DIR_IMAGE)/bl31_$(BUILD_VARIANT).bin
 endef
 
-$(eval $(call BuildPackage,arm-trusted-firmware-sunxi-a64))
-$(eval $(call BuildPackage,arm-trusted-firmware-sunxi-h6))
+$(eval $(call BuildPackage/Trusted-Firmware-A))
diff --git a/package/boot/grub2/Makefile b/package/boot/grub2/Makefile
index c4cc43de2e60aa..865feee9ad1bfb 100644
--- a/package/boot/grub2/Makefile
+++ b/package/boot/grub2/Makefile
@@ -7,7 +7,7 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=grub
 PKG_VERSION:=2.06
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=5
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@GNU/grub
@@ -25,6 +25,7 @@ ifneq ($(BUILD_VARIANT),none)
 endif
 
 PKG_FLAGS:=nonshared
+PKG_BUILD_FLAGS:=no-lto
 
 include $(INCLUDE_DIR)/host-build.mk
 include $(INCLUDE_DIR)/package.mk
@@ -32,14 +33,15 @@ include $(INCLUDE_DIR)/package.mk
 define Package/grub2/Default
   CATEGORY:=Boot Loaders
   SECTION:=boot
-  TITLE:=GRand Unified Bootloader ($(1))
+  TITLE:=GRand Unified Bootloader ($(2))
   URL:=http://www.gnu.org/software/grub/
-  DEPENDS:=@TARGET_x86
-  VARIANT:=$(1)
+  DEPENDS:=@TARGET_$(1)
+  VARIANT:=$(2)
 endef
 
-Package/grub2=$(call Package/grub2/Default,pc)
-Package/grub2-efi=$(call Package/grub2/Default,efi)
+Package/grub2=$(call Package/grub2/Default,x86,pc)
+Package/grub2-efi=$(call Package/grub2/Default,x86,efi)
+Package/grub2-efi-arm=$(call Package/grub2/Default,armsr,efi)
 
 define Package/grub2-editenv
   CATEGORY:=Utilities
@@ -106,6 +108,10 @@ ifneq ($(BUILD_VARIANT),none)
   MAKE_PATH := grub-core
 endif
 
+ifeq ($(CONFIG_arm),y)
+  TARGET_CFLAGS := $(filter-out -mfloat-abi=hard,$(TARGET_CFLAGS))
+endif
+
 define Host/Configure
 	$(SED) 's,(RANLIB),(TARGET_RANLIB),' $(HOST_BUILD_DIR)/grub-core/Makefile.in
 	$(Host/Configure/Default)
@@ -122,14 +128,14 @@ define Package/grub2/install
 		-O i386-pc \
 		-c $(PKG_BUILD_DIR)/grub-early.cfg \
 		-o $(STAGING_DIR_IMAGE)/grub2/gpt-core.img \
-		at_keyboard biosdisk boot chain configfile fat linux ls part_gpt reboot search serial vga
+		at_keyboard biosdisk boot chain configfile fat linux ls part_gpt reboot search serial test vga
 	$(STAGING_DIR_HOST)/bin/grub-mkimage \
 		-d $(PKG_BUILD_DIR)/grub-core \
 		-p /boot/grub \
 		-O i386-pc \
 		-c ./files/grub-early.cfg \
 		-o $(STAGING_DIR_IMAGE)/grub2/generic-core.img \
-		at_keyboard biosdisk boot chain configfile ext2 linux ls part_msdos reboot search serial vga
+		at_keyboard biosdisk boot chain configfile ext2 linux ls part_msdos reboot search serial test vga
 	$(STAGING_DIR_HOST)/bin/grub-mkimage \
 		-d $(PKG_BUILD_DIR)/grub-core \
 		-p /boot/grub \
@@ -154,16 +160,38 @@ define Package/grub2-efi/install
 		-O $(CONFIG_ARCH)-efi \
 		-c $(PKG_BUILD_DIR)/grub-early.cfg \
 		-o $(STAGING_DIR_IMAGE)/grub2/boot$(if $(CONFIG_x86_64),x64,ia32).efi \
-		at_keyboard boot chain configfile fat linux ls part_gpt reboot serial efi_gop efi_uga
+		at_keyboard boot chain configfile fat linux ls part_gpt reboot serial test efi_gop efi_uga
 	$(STAGING_DIR_HOST)/bin/grub-mkimage \
 		-d $(PKG_BUILD_DIR)/grub-core \
 		-p /boot/grub \
 		-O $(CONFIG_ARCH)-efi \
 		-c ./files/grub-early.cfg \
 		-o $(STAGING_DIR_IMAGE)/grub2/iso-boot$(if $(CONFIG_x86_64),x64,ia32).efi \
-		at_keyboard boot chain configfile fat iso9660 linux ls part_msdos part_gpt reboot serial test efi_gop efi_uga
+		boot chain configfile fat iso9660 linux ls part_msdos part_gpt reboot serial test efi_gop efi_uga
 endef
 
+define Package/grub2-efi-arm/install
+	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)/grub2
+	cp ./files/grub-early-gpt.cfg $(PKG_BUILD_DIR)/grub-early.cfg
+	$(STAGING_DIR_HOST)/bin/grub-mkimage \
+		-d $(PKG_BUILD_DIR)/grub-core \
+		-p /boot/grub \
+		-O arm$(if $(CONFIG_aarch64),64,)-efi \
+		-c $(PKG_BUILD_DIR)/grub-early.cfg \
+		-o $(STAGING_DIR_IMAGE)/grub2/boot$(if $(CONFIG_aarch64),aa64,arm).efi \
+		boot chain configfile fat linux ls part_gpt part_msdos reboot search \
+		search_fs_uuid search_label serial efi_gop lsefi minicmd ext2
+	$(STAGING_DIR_HOST)/bin/grub-mkimage \
+		-d $(PKG_BUILD_DIR)/grub-core \
+		-p /boot/grub \
+		-O arm$(if $(CONFIG_aarch64),64,)-efi \
+		-c ./files/grub-early.cfg \
+		-o $(STAGING_DIR_IMAGE)/grub2/iso-bootaa$(if $(CONFIG_aarch64),aa64,arm).efi \
+		boot chain configfile fat iso9660 linux ls lsefi minicmd part_msdos part_gpt \
+		reboot serial test efi_gop
+endef
+
+
 define Package/grub2-editenv/install
 	$(INSTALL_DIR) $(1)/usr/sbin
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/grub-editenv $(1)/usr/sbin/
@@ -177,5 +205,6 @@ endef
 $(eval $(call HostBuild))
 $(eval $(call BuildPackage,grub2))
 $(eval $(call BuildPackage,grub2-efi))
+$(eval $(call BuildPackage,grub2-efi-arm))
 $(eval $(call BuildPackage,grub2-editenv))
 $(eval $(call BuildPackage,grub2-bios-setup))
diff --git a/package/boot/grub2/files/grub-early-gpt.cfg b/package/boot/grub2/files/grub-early-gpt.cfg
new file mode 100644
index 00000000000000..c295d1f7d775ec
--- /dev/null
+++ b/package/boot/grub2/files/grub-early-gpt.cfg
@@ -0,0 +1,2 @@
+search --set=root --label kernel
+configfile ($root)/efi/openwrt/grub.cfg
diff --git a/package/boot/kexec-tools/Makefile b/package/boot/kexec-tools/Makefile
index 6249efe9e78bef..7f06ec7d642f9f 100644
--- a/package/boot/kexec-tools/Makefile
+++ b/package/boot/kexec-tools/Makefile
@@ -8,15 +8,17 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=kexec-tools
-PKG_VERSION:=2.0.21
-PKG_RELEASE:=2
+PKG_VERSION:=2.0.26
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/linux/utils/kernel/kexec
-PKG_HASH:=e113142dee891638ad96e0f72cf9277b244477619470b30c41999d312e8e8702
+PKG_HASH:=7fe36a064101cd5c515e41b2be393dce3ca88adce59d6ee668e0af7c0c4570cd
 
 PKG_CONFIG_DEPENDS := CONFIG_KEXEC_ZLIB CONFIG_KEXEC_LZMA
 
+PKG_BUILD_FLAGS:=gc-sections
+
 include $(INCLUDE_DIR)/package.mk
 
 define Package/kexec-tools/Default
@@ -82,9 +84,6 @@ CONFIGURE_ARGS = \
 		$(if $(CONFIG_KEXEC_LZMA),--with,--without)-lzma \
 		TARGET_LD="$(TARGET_CROSS)ld"
 
-TARGET_CFLAGS += -ffunction-sections -fdata-sections
-TARGET_LDFLAGS += -Wl,--gc-sections
-
 CONFIGURE_VARS += \
 	BUILD_CC="$(HOSTCC)" \
 	TARGET_CC="$(TARGET_CC)"
diff --git a/package/boot/opensbi/Makefile b/package/boot/opensbi/Makefile
new file mode 100644
index 00000000000000..01348e50aad4a8
--- /dev/null
+++ b/package/boot/opensbi/Makefile
@@ -0,0 +1,63 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2022 OpenWrt.org
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=opensbi
+PKG_RELEASE:=1.2
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL=https://github.com/riscv/opensbi
+PKG_SOURCE_DATE:=2022-12-24
+PKG_SOURCE_VERSION:=6b5188ca14e59ce7bf71afe4e7d3d557c3d31bf8
+PKG_MIRROR_HASH:=edcdd99da6c62975171981c0aa2b73a27091067da11ccd49816b5ad27d000858
+
+PKG_BUILD_DIR=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)
+
+PKG_TARGETS:=bin
+PKG_FLAGS:=nonshared
+PKG_LICENSE:=BSD-2-Clause
+PKG_LICENSE_FILES:=COPYING.BSD
+PKG_BUILD_PARALLEL:=1
+
+PKG_MAINTAINER:=Zoltan HERPAI <wigyori@uid0.hu>
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/opensbi
+    SECTION:=boot
+    CATEGORY:=Boot Loaders
+    DEPENDS:=@TARGET_sifiveu
+    URL:=https://github.com/riscv/opensbi/blob/master/README.md
+    VARIANT:=$(subst _,/,$(subst opensbi_,,$(1)))
+    TITLE:=OpenSBI generic
+    OPENSBI_IMAGE:=
+    PLAT:=
+endef
+
+define Package/opensbi_generic
+  $(Package/opensbi)
+  TITLE:=OpenSBI generic
+  OPENSBI_IMAGE:=fw_dynamic.bin
+  PLAT:=generic
+endef
+
+export GCC_HONOUR_COPTS=s
+
+MAKE_VARS = \
+	CROSS_COMPILE="$(TARGET_CROSS)"
+
+define Build/Compile
+	$(eval $(Package/opensbi_$(BUILD_VARIANT))) \
+		+$(MAKE_VARS) $(MAKE) -C $(PKG_BUILD_DIR) \
+		PLATFORM=$(PLAT)
+endef
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
+	$(CP) $(PKG_BUILD_DIR)/build/platform/$(PLAT)/firmware/fw_dynamic.bin $(STAGING_DIR_IMAGE)/fw_dynamic-${BUILD_VARIANT}.bin
+endef
+
+$(eval $(call BuildPackage,opensbi_generic))
diff --git a/package/boot/tfa-layerscape/Makefile b/package/boot/tfa-layerscape/Makefile
index 1be74216e11bcc..3509658869b6da 100644
--- a/package/boot/tfa-layerscape/Makefile
+++ b/package/boot/tfa-layerscape/Makefile
@@ -8,164 +8,146 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=tfa-layerscape
-PKG_VERSION:=21.08
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_VERSION:=lf-6.1.1-1.0.0
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=https://source.codeaurora.org/external/qoriq/qoriq-components/atf
-PKG_SOURCE_VERSION:=LSDK-21.08
-PKG_MIRROR_HASH:=893f2d28a77dcc9d4413a619b4719ca5f1f4dc78dd824a8488e7d543e66bcf95
+PKG_SOURCE_URL:=https://github.com/nxp-qoriq/atf
+PKG_SOURCE_VERSION:=lf-6.1.1-1.0.0
+PKG_MIRROR_HASH:=c0e3c7d0cc9ee5f9ae68cd705ce7f07f714c4fe3fd4a5a79de5699e7865b759f
 PKG_BUILD_DEPENDS:=tfa-layerscape/host
 
 include $(INCLUDE_DIR)/host-build.mk
+include $(INCLUDE_DIR)/trusted-firmware-a.mk
 include $(INCLUDE_DIR)/package.mk
 
 HOST_CFLAGS += -Wall -Werror -pedantic -std=c99
 define Host/Compile
 	$(MAKE) -C \
 		$(HOST_BUILD_DIR)/tools/fiptool \
+		PLAT_FIPTOOL_HELPER_MK="$(HOST_BUILD_DIR)/tools/nxp/plat_fiptool/plat_fiptool.mk" \
 		CFLAGS="$(HOST_CFLAGS)" \
 		LDFLAGS="$(HOST_LDFLAGS)" \
 		HOSTCCFLAGS="$(HOST_CFLAGS)"
 	$(MAKE) -C \
-		$(HOST_BUILD_DIR)/tools/nxp \
+		$(HOST_BUILD_DIR)/tools/nxp/create_pbl \
 		CFLAGS="$(HOST_CFLAGS)"
 endef
 
 define Host/Install
 	$(INSTALL_BIN) $(HOST_BUILD_DIR)/tools/fiptool/fiptool $(STAGING_DIR_HOST)/bin/fiptool-layerscape
-	$(INSTALL_BIN) $(HOST_BUILD_DIR)/tools/nxp/create_pbl $(STAGING_DIR_HOST)/bin/tfa-create-pbl
-	$(INSTALL_BIN) $(HOST_BUILD_DIR)/tools/nxp/byte_swap $(STAGING_DIR_HOST)/bin/tfa-byte-swap
+	$(INSTALL_BIN) $(HOST_BUILD_DIR)/tools/nxp/create_pbl/create_pbl $(STAGING_DIR_HOST)/bin/tfa-create-pbl
+	$(INSTALL_BIN) $(HOST_BUILD_DIR)/tools/nxp/create_pbl/byte_swap $(STAGING_DIR_HOST)/bin/tfa-byte-swap
 endef
 
-define Package/tfa-generic
-  SECTION:=boot
-  CATEGORY:=Boot Loaders
-  DEPENDS:=@TARGET_layerscape_armv8_64b +layerscape-rcw +u-boot-fsl_$(subst tfa-,,$(1))
-  VARIANT:=$(subst tfa-,,$(1))
+define Trusted-Firmware-A/Default
+  BUILD_TARGET:=layerscape
+  BUILD_SUBTARGET:=armv8_64b
+  DEPENDS:=+layerscape-rcw +u-boot-fsl_$(1)
 endef
 
-define Package/tfa-ls1012a-frdm
-  $(Package/tfa-generic)
-  TITLE:=NXP LS1012AFRDM Trusted Firmware
+define Trusted-Firmware-A/ls1012a-frdm
+  NAME:=NXP LS1012AFRDM
   PLAT:=ls1012afrdm
   BOOT_MODE:=qspi
 endef
 
-define Package/tfa-ls1012a-rdb
-  $(Package/tfa-generic)
-  TITLE:=NXP LS1012ARDB Trusted Firmware
+define Trusted-Firmware-A/ls1012a-rdb
+  NAME:=NXP LS1012ARDB
   PLAT:=ls1012ardb
   BOOT_MODE:=qspi
 endef
 
-define Package/tfa-ls1012a-frwy-sdboot
-  $(Package/tfa-generic)
-  TITLE:=NXP LS1012AFRWY Trusted Firmware
+define Trusted-Firmware-A/ls1012a-frwy-sdboot
+  NAME:=NXP LS1012AFRWY
   PLAT:=ls1012afrwy
   BOOT_MODE:=qspi
 endef
 
-define Package/tfa-ls1043a-rdb
-  $(Package/tfa-generic)
-  TITLE:=NXP LS1043ARDB Trusted Firmware
+define Trusted-Firmware-A/ls1028a-rdb
+  TITLE:=NXP LS1028ARDB
+  PLAT:=ls1028ardb
+  BOOT_MODE:=flexspi_nor
+endef
+
+define Trusted-Firmware-A/ls1028a-rdb-sdboot
+  TITLE:=NXP LS1028ARDB SD Boot
+  PLAT:=ls1028ardb
+  BOOT_MODE:=sd
+endef
+
+define Trusted-Firmware-A/ls1043a-rdb
+  NAME:=NXP LS1043ARDB
   PLAT:=ls1043ardb
   BOOT_MODE:=nor
 endef
 
-define Package/tfa-ls1043a-rdb-sdboot
-  $(Package/tfa-generic)
-  TITLE:=NXP LS1043ARDB SD Boot Trusted Firmware
+define Trusted-Firmware-A/ls1043a-rdb-sdboot
+  NAME:=NXP LS1043ARDB SD Boot
   PLAT:=ls1043ardb
   BOOT_MODE:=sd
 endef
 
-define Package/tfa-ls1046a-frwy
-  $(Package/tfa-generic)
-  TITLE:=NXP LS1046AFRWY Trusted Firmware
+define Trusted-Firmware-A/ls1046a-frwy
+  NAME:=NXP LS1046AFRWY
   PLAT:=ls1046afrwy
   BOOT_MODE:=qspi
 endef
 
-define Package/tfa-ls1046a-frwy-sdboot
-  $(Package/tfa-generic)
-  TITLE:=NXP LS1046AFRWY SD Boot Trusted Firmware
+define Trusted-Firmware-A/ls1046a-frwy-sdboot
+  NAME:=NXP LS1046AFRWY SD Boot
   PLAT:=ls1046afrwy
   BOOT_MODE:=sd
 endef
 
-define Package/tfa-ls1046a-rdb
-  $(Package/tfa-generic)
-  TITLE:=NXP LS1046ARDB Trusted Firmware
+define Trusted-Firmware-A/ls1046a-rdb
+  NAME:=NXP LS1046ARDB
   PLAT:=ls1046ardb
   BOOT_MODE:=qspi
 endef
 
-define Package/tfa-ls1046a-rdb-sdboot
-  $(Package/tfa-generic)
-  TITLE:=NXP LS1046ARDB SD Boot Trusted Firmware
+define Trusted-Firmware-A/ls1046a-rdb-sdboot
+  NAME:=NXP LS1046ARDB SD Boot
   PLAT:=ls1046ardb
   BOOT_MODE:=sd
 endef
 
-define Package/tfa-ls1088a-rdb
-  $(Package/tfa-generic)
-  TITLE:=NXP LS1088ARDB Trusted Firmware
+define Trusted-Firmware-A/ls1088a-rdb
+  NAME:=NXP LS1088ARDB
   PLAT:=ls1088ardb
   BOOT_MODE:=qspi
 endef
 
-define Package/tfa-ls1088a-rdb-sdboot
-  $(Package/tfa-generic)
-  TITLE:=NXP LS1088ARDB SD Boot Trusted Firmware
+define Trusted-Firmware-A/ls1088a-rdb-sdboot
+  NAME:=NXP LS1088ARDB SD Boot
   PLAT:=ls1088ardb
   BOOT_MODE:=sd
 endef
 
-define Package/tfa-ls2088a-rdb
-  $(Package/tfa-generic)
-  TITLE:=NXP LS2088ARDB Trusted Firmware
+define Trusted-Firmware-A/ls2088a-rdb
+  NAME:=NXP LS2088ARDB
   PLAT:=ls2088ardb
   BOOT_MODE:=nor
 endef
 
-define Package/tfa-lx2160a-rdb
-  $(Package/tfa-generic)
-  TITLE:=NXP LX2160ARDB Trusted Firmware
+define Trusted-Firmware-A/lx2160a-rdb
+  NAME:=NXP LX2160ARDB
   PLAT:=lx2160ardb
   BOOT_MODE:=flexspi_nor
 endef
 
-define Package/tfa-lx2160a-rdb-sdboot
-  $(Package/tfa-generic)
-  TITLE:=NXP LX2160ARDB SD Boot Trusted Firmware
+define Trusted-Firmware-A/lx2160a-rdb-sdboot
+  NAME:=NXP LX2160ARDB SD Boot
   PLAT:=lx2160ardb
   BOOT_MODE:=sd
 endef
 
-define Build/InstallDev
-	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
-	$(CP) $(PKG_BUILD_DIR)/build/$(PLAT)/release/bl2_$(BOOT_MODE).pbl \
-		$(STAGING_DIR_IMAGE)/fsl_$(BUILD_VARIANT)-bl2.pbl
-	$(CP) $(PKG_BUILD_DIR)/build/$(PLAT)/release/fip.bin \
-		$(STAGING_DIR_IMAGE)/fsl_$(BUILD_VARIANT)-fip.bin
-endef
-
-define Build/Compile
-	$(eval $(Package/tfa-$(BUILD_VARIANT))) \
-	$(MAKE) -C $(PKG_BUILD_DIR) CROSS_COMPILE=$(TARGET_CROSS) \
-		fip pbl PLAT=$(PLAT) BOOT_MODE=$(BOOT_MODE) \
-		RCW=$(STAGING_DIR_IMAGE)/fsl_$(BUILD_VARIANT)-rcw.bin \
-		BL33=$(STAGING_DIR_IMAGE)/fsl_$(BUILD_VARIANT)-uboot.bin \
-		FIPTOOL=$(STAGING_DIR_HOST)/bin/fiptool-layerscape \
-		CREATE_PBL=$(STAGING_DIR_HOST)/bin/tfa-create-pbl \
-		BYTE_SWAP=$(STAGING_DIR_HOST)/bin/tfa-byte-swap
-endef
-
-TFAS := \
+TFA_TARGETS := \
   ls1012a-frdm \
   ls1012a-rdb \
   ls1012a-frwy-sdboot \
+  ls1028a-rdb \
+  ls1028a-rdb-sdboot \
   ls1043a-rdb \
   ls1043a-rdb-sdboot \
   ls1046a-frwy \
@@ -178,7 +160,25 @@ TFAS := \
   lx2160a-rdb \
   lx2160a-rdb-sdboot
 
+TFA_MAKE_FLAGS += \
+	fip pbl \
+	BOOT_MODE=$(BOOT_MODE) \
+	RCW=$(STAGING_DIR_IMAGE)/fsl_$(BUILD_VARIANT)-rcw.bin \
+	BL33=$(STAGING_DIR_IMAGE)/fsl_$(BUILD_VARIANT)-uboot.bin \
+	FIPTOOL=$(STAGING_DIR_HOST)/bin/fiptool-layerscape \
+	CREATE_PBL=$(STAGING_DIR_HOST)/bin/tfa-create-pbl \
+	BYTE_SWAP=$(STAGING_DIR_HOST)/bin/tfa-byte-swap
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
+	$(CP) $(PKG_BUILD_DIR)/build/$(PLAT)/release/bl2_$(BOOT_MODE).pbl \
+		$(STAGING_DIR_IMAGE)/fsl_$(BUILD_VARIANT)-bl2.pbl
+	$(CP) $(PKG_BUILD_DIR)/build/$(PLAT)/release/fip.bin \
+		$(STAGING_DIR_IMAGE)/fsl_$(BUILD_VARIANT)-fip.bin
+endef
+
+define Package/trusted-firmware-a/install/default
+endef
+
 $(eval $(call HostBuild))
-$(foreach tfa,$(TFAS), \
-  $(eval $(call BuildPackage,tfa-$(tfa))) \
-)
+$(eval $(call BuildPackage/Trusted-Firmware-A))
diff --git a/package/boot/tfa-layerscape/patches/001-fiptool-hostbuild-fixes.patch b/package/boot/tfa-layerscape/patches/001-fiptool-hostbuild-fixes.patch
index 4b74048754fb35..50ce6528d7744b 100644
--- a/package/boot/tfa-layerscape/patches/001-fiptool-hostbuild-fixes.patch
+++ b/package/boot/tfa-layerscape/patches/001-fiptool-hostbuild-fixes.patch
@@ -1,6 +1,6 @@
 --- a/Makefile
 +++ b/Makefile
-@@ -801,10 +801,6 @@ CRTTOOL			?=	${CRTTOOLPATH}/cert_create$
+@@ -914,10 +914,6 @@ CRTTOOL			?=	${CRTTOOLPATH}/cert_create$
  ENCTOOLPATH		?=	tools/encrypt_fw
  ENCTOOL			?=	${ENCTOOLPATH}/encrypt_fw${BIN_EXT}
  
@@ -11,7 +11,7 @@
  # Variables for use with sptool
  SPTOOLPATH		?=	tools/sptool
  SPTOOL			?=	${SPTOOLPATH}/sptool${BIN_EXT}
-@@ -1160,13 +1156,6 @@ endif
+@@ -1322,13 +1318,6 @@ endif
  clean:
  	@echo "  CLEAN"
  	$(call SHELL_REMOVE_DIR,${BUILD_PLAT})
@@ -25,7 +25,7 @@
  	${Q}${MAKE} PLAT=${PLAT} --no-print-directory -C ${CRTTOOLPATH} clean
  	${Q}${MAKE} PLAT=${PLAT} --no-print-directory -C ${ENCTOOLPATH} clean
  	${Q}${MAKE} --no-print-directory -C ${ROMLIBPATH} clean
-@@ -1175,13 +1164,6 @@ realclean distclean:
+@@ -1337,13 +1326,6 @@ realclean distclean:
  	@echo "  REALCLEAN"
  	$(call SHELL_REMOVE_DIR,${BUILD_BASE})
  	$(call SHELL_DELETE_ALL, ${CURDIR}/cscope.*)
@@ -39,37 +39,33 @@
  	${Q}${MAKE} --no-print-directory -C ${SPTOOLPATH} clean
  	${Q}${MAKE} PLAT=${PLAT} --no-print-directory -C ${CRTTOOLPATH} clean
  	${Q}${MAKE} PLAT=${PLAT} --no-print-directory -C ${ENCTOOLPATH} realclean
-@@ -1238,7 +1220,7 @@ certificates: ${CRT_DEPS} ${CRTTOOL}
+@@ -1400,7 +1382,7 @@ certificates: ${CRT_DEPS} ${CRTTOOL}
  	@${ECHO_BLANK_LINE}
  endif
  
 -${BUILD_PLAT}/${FIP_NAME}: ${FIP_DEPS} ${FIPTOOL}
 +${BUILD_PLAT}/${FIP_NAME}: ${FIP_DEPS}
- 	${Q}${FIPTOOL} create ${FIP_ARGS} $@
- 	${Q}${FIPTOOL} info $@
- 	@${ECHO_BLANK_LINE}
-@@ -1254,7 +1236,7 @@ fwu_certificates: ${FWU_CRT_DEPS} ${CRTT
+	$(eval ${CHECK_FIP_CMD})
+	${Q}${FIPTOOL} create ${FIP_ARGS} $@
+	${Q}${FIPTOOL} info $@
+@@ -1417,7 +1399,7 @@ fwu_certificates: ${FWU_CRT_DEPS} ${CRTT
  	@${ECHO_BLANK_LINE}
  endif
  
 -${BUILD_PLAT}/${FWU_FIP_NAME}: ${FWU_FIP_DEPS} ${FIPTOOL}
 +${BUILD_PLAT}/${FWU_FIP_NAME}: ${FWU_FIP_DEPS}
- 	${Q}${FIPTOOL} create ${FWU_FIP_ARGS} $@
- 	${Q}${FIPTOOL} info $@
- 	@${ECHO_BLANK_LINE}
-@@ -1279,24 +1261,10 @@ ${BUILD_PLAT}/${DDR_FIP_NAME}: ${DDR_FIP
+	$(eval ${CHECK_FWU_FIP_CMD})
+	${Q}${FIPTOOL} create ${FWU_FIP_ARGS} $@
+	${Q}${FIPTOOL} info $@
+@@ -1425,19 +1407,9 @@ ${BUILD_PLAT}/${FWU_FIP_NAME}: ${FWU_FIP
  	@echo "Built $@ successfully"
  	@${ECHO_BLANK_LINE}
  
 -fiptool: ${FIPTOOL}
  fip: ${BUILD_PLAT}/${FIP_NAME}
  fwu_fip: ${BUILD_PLAT}/${FWU_FIP_NAME}
- fip_ddr: ${BUILD_PLAT}/${DDR_FIP_NAME}
  
--.PHONY: ${FIPTOOL}
--${FIPTOOL}:
--	@${ECHO_BLANK_LINE}
--	@echo "Building $@"
+-${FIPTOOL}: FORCE
 -ifdef UNIX_MK
 -	${Q}${MAKE} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" FIPTOOL=${FIPTOOL} --no-print-directory -C ${FIPTOOLPATH}
 -else
@@ -77,14 +73,13 @@
 -# to pass the gnumake flags to nmake.
 -	${Q}set MAKEFLAGS= && ${MSVC_NMAKE} /nologo /f ${FIPTOOLPATH}/Makefile.msvc FIPTOOLPATH=$(subst /,\,$(FIPTOOLPATH)) FIPTOOL=$(subst /,\,$(FIPTOOL))
 -endif
--	@${ECHO_BLANK_LINE}
 -
  sptool: ${SPTOOL}
- .PHONY: ${SPTOOL}
- ${SPTOOL}:
+ ${SPTOOL}: FORCE
+	${Q}${MAKE} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" SPTOOL=${SPTOOL} --no-print-directory -C ${SPTOOLPATH}
 --- a/tools/fiptool/Makefile
 +++ b/tools/fiptool/Makefile
-@@ -38,7 +38,7 @@ all: ${PROJECT}
+@@ -48,7 +48,7 @@ all: ${PROJECT}
  
  ${PROJECT}: ${OBJECTS} Makefile
  	@echo "  HOSTLD  $@"
@@ -93,3 +88,19 @@
  	@${ECHO_BLANK_LINE}
  	@echo "Built $@ successfully"
  	@${ECHO_BLANK_LINE}
+--- a/tools/nxp/plat_fiptool/plat_fiptool.mk	2023-05-20 22:28:28.079945619 +0200
++++ b/tools/nxp/plat_fiptool/plat_fiptool.mk	2023-05-20 22:26:59.443307771 +0200
+@@ -22,11 +22,11 @@ INCLUDE_PATHS += -I${PLAT_DEF_UUID_OID_C
+ $(shell rm ${PLAT_DEF_UUID_CONFIG_FILE_PATH}/${PLAT_DEF_UUID_CONFIG_FILE_NAME}.o)
+ 
+ ifeq (${PLAT_DEF_OID},yes)
+-HOSTCCFLAGS += -DPLAT_DEF_OID
++override HOSTCCFLAGS += -DPLAT_DEF_OID
+ endif
+ 
+ ifeq (${PLAT_DEF_UUID},yes)
+-HOSTCCFLAGS += -DPLAT_DEF_FIP_UUID
++override HOSTCCFLAGS += -DPLAT_DEF_FIP_UUID
+ PLAT_OBJECTS += ${PLAT_DEF_UUID_CONFIG_FILE_PATH}/${PLAT_DEF_UUID_CONFIG_FILE_NAME}.o
+ endif
+ 
diff --git a/package/boot/tfa-layerscape/patches/003-plat-nxp-tools-fix-create_pbl-and-byte_swap-host-bui.patch b/package/boot/tfa-layerscape/patches/003-plat-nxp-tools-fix-create_pbl-and-byte_swap-host-bui.patch
index 167549d55b5275..73c5c66cae1723 100644
--- a/package/boot/tfa-layerscape/patches/003-plat-nxp-tools-fix-create_pbl-and-byte_swap-host-bui.patch
+++ b/package/boot/tfa-layerscape/patches/003-plat-nxp-tools-fix-create_pbl-and-byte_swap-host-bui.patch
@@ -11,14 +11,14 @@ Signed-off-by: Biwen Li <biwen.li@nxp.com>
  tools/nxp/pbl_ch3.mk | 5 -----
  2 files changed, 8 deletions(-)
 
---- a/tools/nxp/pbl_ch2.mk
-+++ b/tools/nxp/pbl_ch2.mk
+--- a/tools/nxp/create_pbl/pbl_ch2.mk
++++ b/tools/nxp/create_pbl/pbl_ch2.mk
 @@ -19,8 +19,6 @@ ifeq ($(RCW),"")
  else
  	# Generate header for bl2.bin
  	$(Q)$(CST_DIR)/create_hdr_isbc --in ${BUILD_PLAT}/bl2.bin --out ${BUILD_PLAT}/hdr_bl2 ${BL2_INPUT_FILE}
 -	# Compile create_pbl tool
--	${Q}${MAKE} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" --no-print-directory -C ${PLAT_TOOL_PATH};\
+-	${Q}${MAKE} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" --no-print-directory -C ${CREATE_PBL_TOOL_PATH};\
  	# Add bl2.bin to RCW
  	${CREATE_PBL} -r ${RCW} -i ${BUILD_PLAT}/bl2.bin -b ${BOOT_MODE} -c ${SOC_NUM} -d ${BL2_BASE} -e ${BL2_BASE}\
  			-o ${BUILD_PLAT}/bl2_${BOOT_MODE}.pbl ;\
@@ -26,18 +26,18 @@ Signed-off-by: Biwen Li <biwen.li@nxp.com>
  	${Q}echo "Platform ${PLAT} requires rcw file. Please set RCW to point to the right RCW file for boot mode ${BOOT_MODE}"
  else
  	# -a option appends the image for Chassis 3 devices in case of non secure boot
--	${Q}${MAKE} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" --no-print-directory -C ${PLAT_TOOL_PATH};
+-	${Q}${MAKE} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" --no-print-directory -C ${CREATE_PBL_TOOL_PATH};
  	${CREATE_PBL} -r ${RCW} -i ${BUILD_PLAT}/bl2.bin -b ${BOOT_MODE} -c ${SOC_NUM} -d ${BL2_BASE} -e ${BL2_BASE} \
  	-o ${BUILD_PLAT}/bl2_${BOOT_MODE}.pbl ;
  # Swapping of RCW is required for QSPi Chassis 2 devices
---- a/tools/nxp/pbl_ch3.mk
-+++ b/tools/nxp/pbl_ch3.mk
+--- a/tools/nxp/create_pbl/pbl_ch3.mk
++++ b/tools/nxp/create_pbl/pbl_ch3.mk
 @@ -26,9 +26,6 @@ else
  	# Generate header for bl2.bin
  	$(Q)$(CST_DIR)/create_hdr_isbc --in ${BUILD_PLAT}/bl2.bin --out ${BUILD_PLAT}/hdr_bl2 ${BL2_INPUT_FILE}
  
 -	# Compile create_pbl tool
--	${Q}${MAKE} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" --no-print-directory -C ${PLAT_TOOL_PATH};\
+-	${Q}${MAKE} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" --no-print-directory -C ${CREATE_PBL_TOOL_PATH};\
 -
  	# Add Block Copy command for bl2.bin to RCW
  	${CREATE_PBL} -r ${RCW} -i ${BUILD_PLAT}/bl2.bin -b ${BOOT_MODE} -c ${SOC_NUM} -d ${BL2_BASE} -e ${BL2_BASE}\
@@ -46,7 +46,7 @@ Signed-off-by: Biwen Li <biwen.li@nxp.com>
  ifeq ($(RCW),"")
  	${Q}echo "Platform ${PLAT} requires rcw file. Please set RCW to point to the right RCW file for boot mode ${BOOT_MODE}"
  else
--	${Q}${MAKE} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" --no-print-directory -C ${PLAT_TOOL_PATH};
+-	${Q}${MAKE} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" --no-print-directory -C ${CREATE_PBL_TOOL_PATH};
 -
  	# Add Block Copy command and populate boot loc ptrfor bl2.bin to RCW
  	${CREATE_PBL} -r ${RCW} -i ${BUILD_PLAT}/bl2.bin -b ${BOOT_MODE} -c ${SOC_NUM} -d ${BL2_BASE} -e ${BL2_BASE} \
diff --git a/package/boot/tfa-layerscape/patches/004-plat-nxp-restore-ls1012afrdm-support.patch b/package/boot/tfa-layerscape/patches/004-plat-nxp-restore-ls1012afrdm-support.patch
new file mode 100644
index 00000000000000..fc9504f82fd014
--- /dev/null
+++ b/package/boot/tfa-layerscape/patches/004-plat-nxp-restore-ls1012afrdm-support.patch
@@ -0,0 +1,232 @@
+From 8c6a66feb721f18c930c7df03d1fbb7304107af6 Mon Sep 17 00:00:00 2001
+From: Wojciech Dubowik <Wojciech.Dubowik@protonmail.ch>
+Date: Thu, 20 Apr 2023 16:21:25 +0200
+Subject: [PATCH] tfa-layerscape: Restore ls1012afrdm support
+
+Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@protonmail.ch>
+---
+ plat/nxp/soc-ls1012a/ls1012afrdm/ddr_init.c   | 34 +++++++
+ plat/nxp/soc-ls1012a/ls1012afrdm/plat_def.h   | 92 +++++++++++++++++++
+ plat/nxp/soc-ls1012a/ls1012afrdm/platform.mk  | 25 +++++
+ .../soc-ls1012a/ls1012afrdm/platform_def.h    | 13 +++
+ plat/nxp/soc-ls1012a/ls1012afrdm/policy.h     | 16 ++++
+ 5 files changed, 180 insertions(+)
+ create mode 100644 plat/nxp/soc-ls1012a/ls1012afrdm/ddr_init.c
+ create mode 100644 plat/nxp/soc-ls1012a/ls1012afrdm/plat_def.h
+ create mode 100644 plat/nxp/soc-ls1012a/ls1012afrdm/platform.mk
+ create mode 100644 plat/nxp/soc-ls1012a/ls1012afrdm/platform_def.h
+ create mode 100644 plat/nxp/soc-ls1012a/ls1012afrdm/policy.h
+
+diff --git a/plat/nxp/soc-ls1012a/ls1012afrdm/ddr_init.c b/plat/nxp/soc-ls1012a/ls1012afrdm/ddr_init.c
+new file mode 100644
+index 000000000..8cb518540
+--- /dev/null
++++ b/plat/nxp/soc-ls1012a/ls1012afrdm/ddr_init.c
+@@ -0,0 +1,34 @@
++/*
++ * Copyright 2018-2022 NXP
++ *
++ * SPDX-License-Identifier: BSD-3-Clause
++ */
++
++#include <common/debug.h>
++#include <fsl_mmdc.h>
++
++#include <platform_def.h>
++
++long long init_ddr(void)
++{
++	static const struct fsl_mmdc_info mparam = {
++		.mdctl = U(0x04180000),
++		.mdpdc = U(0x00030035),
++		.mdotc = U(0x12554000),
++		.mdcfg0 = U(0xbabf7954),
++		.mdcfg1 = U(0xdb328f64),
++		.mdcfg2 = U(0x01ff00db),
++		.mdmisc = U(0x00001680),
++		.mdref = U(0x0f3c8000),
++		.mdrwd = U(0x00002000),
++		.mdor = U(0x00bf1023),
++		.mdasp = U(0x0000003f),
++		.mpodtctrl = U(0x0000022a),
++		.mpzqhwctrl = U(0xa1390003),
++	};
++
++	mmdc_init(&mparam, NXP_DDR_ADDR);
++	NOTICE("DDR Init Done\n");
++
++	return NXP_DRAM0_SIZE;
++}
+diff --git a/plat/nxp/soc-ls1012a/ls1012afrdm/plat_def.h b/plat/nxp/soc-ls1012a/ls1012afrdm/plat_def.h
+new file mode 100644
+index 000000000..eb745a0a3
+--- /dev/null
++++ b/plat/nxp/soc-ls1012a/ls1012afrdm/plat_def.h
+@@ -0,0 +1,92 @@
++/*
++ * Copyright 2022 NXP
++ *
++ * SPDX-License-Identifier: BSD-3-Clause
++ */
++
++#ifndef PLAT_DEF_H
++#define PLAT_DEF_H
++
++#include <arch.h>
++/*
++ * Required without TBBR.
++ * To include the defines for DDR PHY
++ * Images.
++ */
++#include <tbbr_img_def.h>
++
++#include <policy.h>
++#include <soc.h>
++
++/* DDR Related definition */
++#define PLAT_DEF_DRAM0_SIZE	0x20000000	/* 512 MB */
++
++#define NXP_SYSCLK_FREQ		125000000
++#define NXP_DDRCLK_FREQ		100000000
++
++/* UART related definition */
++#define NXP_CONSOLE_ADDR	NXP_UART_ADDR
++#define NXP_CONSOLE_BAUDRATE	115200
++
++#define NXP_SPD_EEPROM0         0x51
++
++/* Size of cacheable stacks */
++#if defined(IMAGE_BL2)
++#if defined(TRUSTED_BOARD_BOOT)
++#define PLATFORM_STACK_SIZE	0x2000
++#else
++#define PLATFORM_STACK_SIZE	0x1000
++#endif
++#elif defined(IMAGE_BL31)
++#define PLATFORM_STACK_SIZE	0x1000
++#endif
++
++/* SD block buffer */
++#define NXP_SD_BLOCK_BUF_SIZE	(0x00100000)
++#define NXP_SD_BLOCK_BUF_ADDR	ULL(0x80000000)
++
++#define BL2_LIMIT		(NXP_OCRAM_ADDR + NXP_OCRAM_SIZE)
++
++/* IO defines as needed by IO driver framework */
++#define MAX_IO_DEVICES		3
++#define MAX_IO_BLOCK_DEVICES	1
++#define MAX_IO_HANDLES		4
++
++/*
++ * FIP image defines - Offset at which FIP Image would be present
++ * Image would include Bl31 , Bl33 and Bl32 (optional)
++ */
++#ifdef POLICY_FUSE_PROVISION
++#define MAX_FIP_DEVICES		2
++#endif
++
++#ifndef MAX_FIP_DEVICES
++#define MAX_FIP_DEVICES		1
++#endif
++
++#ifdef PLAT_FIP_OFFSET
++#undef PLAT_FIP_OFFSET
++#endif
++#ifdef PLAT_FIP_MAX_SIZE
++#undef PLAT_FIP_MAX_SIZE
++#endif
++#define PLAT_FIP_OFFSET		0x60000
++#define PLAT_FIP_MAX_SIZE	0x170000
++
++/*
++ * ID of the secure physical generic timer interrupt used by the BL32.
++ */
++#define BL32_IRQ_SEC_PHY_TIMER	29
++
++/*
++ * Define properties of Group 1 Secure and Group 0 interrupts as per GICv3
++ * terminology. On a GICv2 system or mode, the lists will be merged and treated
++ * as Group 0 interrupts.
++ */
++#define PLAT_LS_G1S_IRQ_PROPS(grp) \
++	INTR_PROP_DESC(BL32_IRQ_SEC_PHY_TIMER, GIC_HIGHEST_SEC_PRIORITY, grp, \
++			GIC_INTR_CFG_LEVEL)
++
++#define PLAT_LS_G0_IRQ_PROPS(grp)
++
++#endif
+diff --git a/plat/nxp/soc-ls1012a/ls1012afrdm/platform.mk b/plat/nxp/soc-ls1012a/ls1012afrdm/platform.mk
+new file mode 100644
+index 000000000..270e92420
+--- /dev/null
++++ b/plat/nxp/soc-ls1012a/ls1012afrdm/platform.mk
+@@ -0,0 +1,25 @@
++#
++# Copyright 2018-2022 NXP
++#
++# SPDX-License-Identifier: BSD-3-Clause
++#
++
++# board-specific build parameters
++BOOT_MODE	:= qspi
++BOARD		:= ls1012afrdm
++
++# DDR Compilation Configs
++DDRC_NUM_CS     :=      1
++
++# On-Board Flash Details
++QSPI_FLASH_SZ   :=      0x4000000
++
++BL2_SOURCES	+=	${BOARD_PATH}/ddr_init.c
++
++SUPPORTED_BOOT_MODE	:=	qspi
++
++# Adding platform board build info
++include plat/nxp/common/plat_make_helper/plat_common_def.mk
++
++# Adding SoC build info
++include plat/nxp/soc-ls1012a/soc.mk
+diff --git a/plat/nxp/soc-ls1012a/ls1012afrdm/platform_def.h b/plat/nxp/soc-ls1012a/ls1012afrdm/platform_def.h
+new file mode 100644
+index 000000000..7daf1c02c
+--- /dev/null
++++ b/plat/nxp/soc-ls1012a/ls1012afrdm/platform_def.h
+@@ -0,0 +1,13 @@
++/*
++ * Copyright 2022 NXP
++ *
++ * SPDX-License-Identifier: BSD-3-Clause
++ */
++
++#ifndef PLATFORM_DEF_H
++#define PLATFORM_DEF_H
++
++#include <plat_def.h>
++#include <plat_default_def.h>
++
++#endif /* PLATFORM_DEF_H */
+diff --git a/plat/nxp/soc-ls1012a/ls1012afrdm/policy.h b/plat/nxp/soc-ls1012a/ls1012afrdm/policy.h
+new file mode 100644
+index 000000000..a782d01c7
+--- /dev/null
++++ b/plat/nxp/soc-ls1012a/ls1012afrdm/policy.h
+@@ -0,0 +1,16 @@
++/*
++ * Copyright 2018-2022 NXP
++ *
++ * SPDX-License-Identifier: BSD-3-Clause
++ */
++
++#ifndef POLICY_H
++#define	POLICY_H
++
++/*
++ * Set this to 0x0 to leave the default SMMU page size in sACR
++ * Set this to 0x1 to change the SMMU page size to 64K
++ */
++#define POLICY_SMMU_PAGESZ_64K 0x0
++
++#endif /* POLICY_H */
+-- 
+2.34.1
+
diff --git a/package/boot/uboot-armsr/Makefile b/package/boot/uboot-armsr/Makefile
new file mode 100644
index 00000000000000..ce53d19b79676e
--- /dev/null
+++ b/package/boot/uboot-armsr/Makefile
@@ -0,0 +1,36 @@
+include $(TOPDIR)/rules.mk
+
+PKG_VERSION:=2023.04
+PKG_RELEASE:=1
+
+PKG_HASH:=e31cac91545ff41b71cec5d8c22afd695645cd6e2a442ccdacacd60534069341
+
+include $(INCLUDE_DIR)/u-boot.mk
+include $(INCLUDE_DIR)/package.mk
+
+define U-Boot/Default
+  BUILD_TARGET:=armsr
+endef
+
+define U-Boot/qemu_armv7
+  NAME:=QEMU ARM Virtual Machine 32-bit
+  BUILD_SUBTARGET:=armv7
+  BUILD_DEVICES:=generic
+  UBOOT_CONFIG:=qemu_arm
+endef
+
+define U-Boot/qemu_armv8
+  NAME:=QEMU ARM Virtual Machine 64-bit
+  BUILD_SUBTARGET:=armv8
+  BUILD_DEVICES:=generic
+  UBOOT_CONFIG:=qemu_arm64
+endef
+
+UBOOT_TARGETS := \
+	qemu_armv7 \
+	qemu_armv8
+
+UBOOT_CUSTOMIZE_CONFIG := \
+	--enable CMD_EFIDEBUG
+
+$(eval $(call BuildPackage/U-Boot))
diff --git a/package/boot/uboot-armsr/patches/001-v2023.07-bootstd-Use-blk-uclass-device-numbers-to-set-efi-bootdev.patch b/package/boot/uboot-armsr/patches/001-v2023.07-bootstd-Use-blk-uclass-device-numbers-to-set-efi-bootdev.patch
new file mode 100644
index 00000000000000..f4c811895213ae
--- /dev/null
+++ b/package/boot/uboot-armsr/patches/001-v2023.07-bootstd-Use-blk-uclass-device-numbers-to-set-efi-bootdev.patch
@@ -0,0 +1,62 @@
+From: Simon Glass <sjg@chromium.org>
+To: U-Boot Mailing List <u-boot@lists.denx.de>
+Subject: [PATCH v10 7/9] bootstd: Use blk uclass device numbers to set efi
+ bootdev
+Date: Mon, 24 Apr 2023 13:49:50 +1200
+Message-ID: 
+ <20230424134946.v10.7.Ia5f5e39c882ac22b5f71c4d576941b34e868eeba@changeid>
+
+From: Mathew McBride <matt@traverse.com.au>
+
+When loading a file from a block device, efiload_read_file
+was using the seq_num of the device (e.g "35" of virtio_blk#35)
+instead of the block device id (e.g what you get from running
+the corresponding device scan command, like "virtio 0")
+
+This cause EFI booting from these devices to fail as an
+invalid device number is passed to blk_get_device_part_str:
+
+  Scanning bootdev 'virtio-blk#35.bootdev':
+  distro_efi_read_bootflow_file start (efi,fname=<NULL>)
+  distro_efi_read_bootflow_file start (efi,fname=<NULL>)
+  setting bootdev virtio, 35, efi/boot/bootaa64.efi, 00000000beef9a40, 170800
+  efi_dp_from_name calling blk_get_device_part_str
+  dev=virtio devnr=35 path=efi/boot/bootaa64.efi
+  blk_get_device_part_str (virtio,35)
+  blk_get_device_by_str (virtio, 35)
+  ** Bad device specification virtio 35 **
+  Using default device tree: dtb/qemu-arm.dtb
+  No device tree available
+  0  efi          ready   virtio       1  virtio-blk#35.bootdev.par efi/boot/bootaa64.efi
+  ** Booting bootflow 'virtio-blk#35.bootdev.part_1' with efi
+  blk_get_device_part_str (virtio,0:1)
+  blk_get_device_by_str (virtio, 0)
+  No UEFI binary known at beef9a40 (image buf=00000000beef9a40,addr=0000000000000000)
+  Boot failed (err=-22)
+
+Signed-off-by: Mathew McBride <matt@traverse.com.au>
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Signed-off-by: Petr Štetiar <ynezz@true.cz> [backport to 2023.04]
+---
+
+(no changes since v8)
+
+Changes in v8:
+- Add new patch to use blk uclass device numbers to set efi bootdev
+
+ boot/bootmeth_efi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/boot/bootmeth_efi.c
++++ b/boot/bootmeth_efi.c
+@@ -117,7 +117,9 @@ static int efiload_read_file(struct blk_
+ 	 * this can go away.
+ 	 */
+ 	media_dev = dev_get_parent(bflow->dev);
+-	snprintf(devnum_str, sizeof(devnum_str), "%x", dev_seq(media_dev));
++	snprintf(devnum_str, sizeof(devnum_str), "%x:%x",
++		 desc ? desc->devnum : dev_seq(media_dev),
++		 bflow->part);
+ 
+ 	strlcpy(dirname, bflow->fname, sizeof(dirname));
+ 	last_slash = strrchr(dirname, '/');
diff --git a/package/boot/uboot-at91/Makefile b/package/boot/uboot-at91/Makefile
index f75a3878366814..afab24e8415f55 100644
--- a/package/boot/uboot-at91/Makefile
+++ b/package/boot/uboot-at91/Makefile
@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_VERSION:=linux4sam-2022.04
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=3
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/linux4sam/u-boot-at91.git
diff --git a/package/boot/uboot-bcm4908/Makefile b/package/boot/uboot-bcm4908/Makefile
index 7eacd23a02ca4e..f3051aaf81e009 100644
--- a/package/boot/uboot-bcm4908/Makefile
+++ b/package/boot/uboot-bcm4908/Makefile
@@ -3,13 +3,13 @@
 include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://git.openwrt.org/project/bcm63xx/u-boot.git
-PKG_SOURCE_DATE:=2022-03-15
-PKG_SOURCE_VERSION:=0625aad74d1f5b6f9c068955ad3fd7f6df635e50
-PKG_MIRROR_HASH:=0602e0e4f101ead206940eccca832b75191905c1e81290340a89b07dbee7a6ce
+PKG_SOURCE_DATE:=2022-12-08
+PKG_SOURCE_VERSION:=4435700d18a791dca0d8d767e5414dfac9df4451
+PKG_MIRROR_HASH:=6062ce611d7222eb3b9768bb4944ff1c7bcf26b997280adf5ea8d7afe83f28a8
 
 include $(INCLUDE_DIR)/u-boot.mk
 include $(INCLUDE_DIR)/package.mk
diff --git a/package/boot/uboot-envtools/Makefile b/package/boot/uboot-envtools/Makefile
index 6840b9c586be1b..2e4c1ac39e3e34 100644
--- a/package/boot/uboot-envtools/Makefile
+++ b/package/boot/uboot-envtools/Makefile
@@ -9,15 +9,15 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=uboot-envtools
 PKG_DISTNAME:=u-boot
-PKG_VERSION:=2022.07
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_VERSION:=2023.04
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_DISTNAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:= \
     https://ftp.denx.de/pub/u-boot \
     https://mirror.cyberbits.eu/u-boot \
     ftp://ftp.denx.de/pub/u-boot
-PKG_HASH:=92b08eb49c24da14c1adbf70a71ae8f37cc53eeb4230e859ad8b6733d13dcf5e
+PKG_HASH:=e31cac91545ff41b71cec5d8c22afd695645cd6e2a442ccdacacd60534069341
 PKG_SOURCE_SUBDIR:=$(PKG_DISTNAME)-$(PKG_VERSION)
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_DISTNAME)-$(PKG_VERSION)
 
diff --git a/package/boot/uboot-envtools/files/ath79 b/package/boot/uboot-envtools/files/ath79
index d9e504bf8949a5..7c30aa052a6b39 100644
--- a/package/boot/uboot-envtools/files/ath79
+++ b/package/boot/uboot-envtools/files/ath79
@@ -12,6 +12,7 @@ touch /etc/config/ubootenv
 board=$(board_name)
 
 case "$board" in
+alcatel,hh40v|\
 alfa-network,ap121f|\
 alfa-network,ap121fe|\
 alfa-network,n2q|\
@@ -26,7 +27,11 @@ araknis,an-700-ap-i-ac|\
 arduino,yun|\
 buffalo,bhr-4grv2|\
 devolo,magic-2-wifi|\
+dlink,dir-859-a1|\
+dlink,dir-859-a3|\
+dlink,dir-869-a1|\
 engenius,eap1200h|\
+engenius,eap1750h|\
 engenius,eap300-v2|\
 engenius,eap350-v1|\
 engenius,eap600|\
@@ -37,11 +42,11 @@ engenius,ecb600|\
 engenius,enh202-v1|\
 engenius,ens202ext-v1|\
 engenius,enstationac-v1|\
+engenius,ews660ap|\
 etactica,eg200|\
 glinet,gl-ar750s-nor|\
 glinet,gl-ar750s-nor-nand|\
 librerouter,librerouter-v1|\
-netgear,ex6400|\
 netgear,ex7300|\
 netgear,ex7300-v2|\
 netgear,wndr4300-v2|\
@@ -66,7 +71,15 @@ openmesh,om5p-an|\
 openmesh,om5p-ac-v1|\
 openmesh,om5p-ac-v2|\
 samsung,wam250|\
+ubnt,airrouter|\
+ubnt,bullet-m-ar7240|\
+ubnt,bullet-m-ar7241|\
+ubnt,nanobridge-m|\
+ubnt,nanostation-loco-m|\
 ubnt,nanostation-m|\
+ubnt,picostation-m|\
+ubnt,powerbridge-m|\
+ubnt,rocket-m|\
 watchguard,ap100|\
 watchguard,ap200|\
 watchguard,ap300|\
@@ -79,16 +92,8 @@ ziking,cpe46b|\
 zyxel,nbg6616)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x10000" "0x10000"
 	;;
-buffalo,wzr-hp-ag300h)
-	ubootenv_add_uci_config "/dev/mtd3" "0x0" "0x10000" "0x10000"
-	;;
-buffalo,wzr-hp-g300nh-rb|\
-buffalo,wzr-hp-g300nh-s)
-	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x20000"
-	;;
-domywifi,dw33d)
-	ubootenv_add_uci_config "/dev/mtd4" "0x0" "0x10000" "0x10000"
-	;;
+aruba,ap-105|\
+aruba,ap-175|\
 dongwon,dw02-412h-64m|\
 dongwon,dw02-412h-128m|\
 glinet,gl-ar300m-lite|\
@@ -99,6 +104,17 @@ glinet,gl-ar300m16)
 	[ -n "$idx" ] && \
 		ubootenv_add_uci_config "/dev/mtd$idx" "0x0" "0x10000" "0x10000"
 	;;
+buffalo,wzr-hp-ag300h)
+	ubootenv_add_uci_config "/dev/mtd3" "0x0" "0x10000" "0x10000"
+	;;
+buffalo,wzr-hp-g300nh-rb|\
+buffalo,wzr-hp-g300nh-s|\
+linksys,ea4500-v3)
+	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x20000"
+	;;
+domywifi,dw33d)
+	ubootenv_add_uci_config "/dev/mtd4" "0x0" "0x10000" "0x10000"
+	;;
 glinet,gl-ar150)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x8000" "0x10000"
 	;;
@@ -129,6 +145,12 @@ plasmacloud,pa300e)
 qihoo,c301)
 	ubootenv_add_uci_config "/dev/mtd9" "0x0" "0x10000" "0x10000"
 	;;
+ruckus,zf7025|\
+ruckus,zf7341|\
+ruckus,zf7351|\
+ruckus,zf7363)
+	ubootenv_add_uci_config "/dev/mtd5" "0x0" "0x40000" "0x40000"
+	;;
 ruckus,zf7321|\
 ruckus,zf7372)
 	ubootenv_add_uci_config "/dev/mtd2" "0x0" "0x40000" "0x10000"
diff --git a/package/boot/uboot-envtools/files/ipq40xx b/package/boot/uboot-envtools/files/ipq40xx
index e45e26dcc7f757..8d993fae3668b3 100644
--- a/package/boot/uboot-envtools/files/ipq40xx
+++ b/package/boot/uboot-envtools/files/ipq40xx
@@ -26,6 +26,7 @@ ubootenv_mtdinfo () {
 	fi
 
 	sectors=$(( $ubootenv_size / $mtd_erase ))
+	sectors=$(printf "0x%x" $sectors )
 	echo /dev/$mtd_dev 0x0 $ubootenv_size $mtd_erase $sectors
 }
 
@@ -33,6 +34,7 @@ case "$board" in
 alfa-network,ap120c-ac|\
 devolo,magic-2-wifi-next|\
 edgecore,ecw5211|\
+glinet,gl-a1300 |\
 glinet,gl-ap1300|\
 glinet,gl-b1300|\
 glinet,gl-b2200|\
@@ -61,9 +63,12 @@ linksys,ea8300|\
 linksys,mr8300)
 	ubootenv_add_uci_config "/dev/mtd7" "0x0" "0x40000" "0x20000"
 	;;
-linksys,whw01-v1)
+linksys,whw01)
 	ubootenv_add_uci_config "/dev/mtd6" "0x0" "0x40000" "0x10000"
 	;;
+linksys,whw03v2)
+	ubootenv_add_uci_config "/dev/mtd6" "0x0" "0x80000" "0x20000"
+	;;
 zyxel,nbg6617)
 	ubootenv_add_uci_config "/dev/mtd6" "0x0" "0x10000" "0x10000"
 	;;
diff --git a/package/boot/uboot-envtools/files/ipq806x b/package/boot/uboot-envtools/files/ipq806x
index a8285d145270d7..01a86c7b19fcae 100644
--- a/package/boot/uboot-envtools/files/ipq806x
+++ b/package/boot/uboot-envtools/files/ipq806x
@@ -26,6 +26,7 @@ ubootenv_mtdinfo () {
 	fi
 
 	sectors=$(( $ubootenv_size / $mtd_erase ))
+	sectors=$(printf "0x%x" $sectors )
 	echo /dev/$mtd_dev 0x0 $ubootenv_size $mtd_erase $sectors
 }
 
@@ -44,6 +45,9 @@ linksys,ea8500)
 netgear,r7800)
 	ubootenv_add_uci_config "/dev/mtd2" "0x0" "0x040000" "0x20000"
 	;;
+nokia,ac400i)
+	ubootenv_add_uci_config "/dev/mtd20" "0x0" "0x040000" "0x20000"
+	;;
 qcom,ipq8064-ap148|\
 qcom,ipq8064-db149)
 	ubootenv_add_uci_config $(ubootenv_mtdinfo)
diff --git a/package/boot/uboot-envtools/files/mediatek_filogic b/package/boot/uboot-envtools/files/mediatek_filogic
index a82f140a6e58b3..9df64791b2b7a0 100644
--- a/package/boot/uboot-envtools/files/mediatek_filogic
+++ b/package/boot/uboot-envtools/files/mediatek_filogic
@@ -13,9 +13,9 @@ board=$(board_name)
 
 case "$board" in
 bananapi,bpi-r3)
-	. /lib/upgrade/common.sh
-	export_bootdevice
-	export_partdevice rootdev 0
+	rootdev="$(cmdline_get_var root)"
+	rootdev="${rootdev##*/}"
+	rootdev="${rootdev%%p[0-9]*}"
 	case "$rootdev" in
 	mmc*)
 		local envdev=$(find_mmc_part "ubootenv" $rootdev)
@@ -27,7 +27,7 @@ bananapi,bpi-r3)
 		ubootenv_add_uci_config "$envdev" "0x0" "0x20000" "0x20000" "1"
 		ubootenv_add_uci_config "$envdev" "0x20000" "0x20000" "0x20000" "1"
 		;;
-	*)
+	ubi*)
 		. /lib/upgrade/nand.sh
 		local envubi=$(nand_find_ubi ubi)
 		local envdev=/dev/$(nand_find_volume $envubi ubootenv)
@@ -37,9 +37,32 @@ bananapi,bpi-r3)
 		;;
 	esac
 	;;
+glinet,gl-mt3000)
+	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x80000" "0x20000"
+	;;
+xiaomi,redmi-router-ax6000-stock)
+	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x10000" "0x20000"
+	ubootenv_add_uci_sys_config "/dev/mtd2" "0x0" "0x10000" "0x20000"
+	;;
+qihoo,360t7|\
+tplink,tl-xdr4288|\
+tplink,tl-xdr6086|\
+tplink,tl-xdr6088|\
+xiaomi,redmi-router-ax6000-ubootmod)
+	. /lib/upgrade/nand.sh
+	local envubi=$(nand_find_ubi ubi)
+	local envdev=/dev/$(nand_find_volume $envubi ubootenv)
+	local envdev2=/dev/$(nand_find_volume $envubi ubootenv2)
+	ubootenv_add_uci_config "$envdev" "0x0" "0x1f000" "0x20000" "1"
+	ubootenv_add_uci_config "$envdev2" "0x0" "0x1f000" "0x20000" "1"
+	;;
+zyxel,ex5601-t0)
+	local envdev=/dev/mtd$(find_mtd_index "u-boot-env")
+	ubootenv_add_uci_config "$envdev" "0x0" "0x20000" "0x40000" "2"
+	;;
 esac
 
 config_load ubootenv
-config_foreach ubootenv_add_app_config ubootenv
+config_foreach ubootenv_add_app_config
 
 exit 0
diff --git a/package/boot/uboot-envtools/files/mediatek_mt7622 b/package/boot/uboot-envtools/files/mediatek_mt7622
index 654f78056a8ab7..e01dcc4fefdd0f 100644
--- a/package/boot/uboot-envtools/files/mediatek_mt7622
+++ b/package/boot/uboot-envtools/files/mediatek_mt7622
@@ -17,16 +17,16 @@ linksys,e8450-ubi)
 	ubootenv_add_uci_config "/dev/ubi0_1" "0x0" "0x1f000" "0x1f000" "1"
 	;;
 bananapi,bpi-r64)
-	. /lib/upgrade/common.sh
-	export_bootdevice
-	export_partdevice rootdev 0
+	rootdev="$(cmdline_get_var root)"
+	rootdev="${rootdev##*/}"
+	rootdev="${rootdev%%p[0-9]*}"
 	case "$rootdev" in
 	mmc*)
 		local envdev=$(find_mmc_part "ubootenv" $rootdev)
 		ubootenv_add_uci_config "$envdev" "0x0" "0x80000" "0x80000" "1"
 		ubootenv_add_uci_config "$envdev" "0x80000" "0x80000" "0x80000" "1"
 		;;
-	*)
+	ubi*)
 		ubootenv_add_uci_config "/dev/ubi0_0" "0x0" "0x1f000" "0x1f000" "1"
 		ubootenv_add_uci_config "/dev/ubi0_1" "0x0" "0x1f000" "0x1f000" "1"
 		;;
diff --git a/package/boot/uboot-envtools/files/mpc85xx b/package/boot/uboot-envtools/files/mpc85xx
index 36d9f753a11c4c..a74466ab3a6147 100644
--- a/package/boot/uboot-envtools/files/mpc85xx
+++ b/package/boot/uboot-envtools/files/mpc85xx
@@ -8,6 +8,10 @@ touch /etc/config/ubootenv
 board=$(board_name)
 
 case "$board" in
+enterasys,ws-ap3715i)
+	ubootenv_add_uci_config "$(find_mtd_part 'cfg1')" "0x0" "0x10000" "0x10000"
+	ubootenv_add_uci_config "$(find_mtd_part 'cfg2')" "0x0" "0x10000" "0x10000"
+	;;
 extreme-networks,ws-ap3825i)
 	ubootenv_add_uci_config "$(find_mtd_part 'cfg1')" "0x0" "0x10000" "0x20000"
 	ubootenv_add_uci_config "$(find_mtd_part 'cfg2')" "0x0" "0x10000" "0x20000"
@@ -16,6 +20,9 @@ ocedo,panda)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x20000"
 	ubootenv_add_uci_config "/dev/mtd2" "0x0" "0x20000" "0x20000"
 	;;
+watchguard,firebox-t10)
+	ubootenv_add_uci_config "$(find_mtd_part 'u-boot-env')" "0x0" "0x2000" "0x10000"
+	;;
 aerohive,hiveap-330)
 	ubootenv_add_uci_config "$(find_mtd_part 'u-boot-env')" "0x0" "0x20000" "0x10000"
 	;;
diff --git a/package/boot/uboot-envtools/files/mvebu b/package/boot/uboot-envtools/files/mvebu
index cc1c648f246a5c..63b5132608a694 100644
--- a/package/boot/uboot-envtools/files/mvebu
+++ b/package/boot/uboot-envtools/files/mvebu
@@ -13,6 +13,7 @@ touch /etc/config/ubootenv
 board=$(board_name)
 
 case "$board" in
+buffalo,ls220de|\
 buffalo,ls421de)
 	ubootenv_add_uci_config "/dev/mtd3" "0x0" "0x10000"
 	;;
diff --git a/package/boot/uboot-envtools/files/qualcommax_ipq807x b/package/boot/uboot-envtools/files/qualcommax_ipq807x
new file mode 100644
index 00000000000000..345cdadebee5dd
--- /dev/null
+++ b/package/boot/uboot-envtools/files/qualcommax_ipq807x
@@ -0,0 +1,54 @@
+[ -e /etc/config/ubootenv ] && exit 0
+
+touch /etc/config/ubootenv
+
+. /lib/uboot-envtools.sh
+. /lib/functions.sh
+
+board=$(board_name)
+
+case "$board" in
+dynalink,dl-wrx36|\
+netgear,wax218)
+	idx="$(find_mtd_index 0:appsblenv)"
+	[ -n "$idx" ] && \
+		ubootenv_add_uci_config "/dev/mtd$idx" "0x0" "0x40000" "0x20000" "2"
+	;;
+compex,wpq873|\
+edgecore,eap102|\
+zyxel,nbg7815)
+	idx="$(find_mtd_index 0:appsblenv)"
+	[ -n "$idx" ] && \
+		ubootenv_add_uci_config "/dev/mtd$idx" "0x0" "0x10000" "0x10000" "1"
+	;;
+edimax,cax1800)
+	idx="$(find_mtd_index 0:appsblenv)"
+	[ -n "$idx" ] && \
+		ubootenv_add_uci_config "/dev/mtd$idx" "0x0" "0x10000" "0x20000"
+	;;
+redmi,ax6|\
+xiaomi,ax3600|\
+xiaomi,ax9000)
+	idx="$(find_mtd_index 0:appsblenv)"
+	[ -n "$idx" ] && \
+		ubootenv_add_uci_config "/dev/mtd$idx" "0x0" "0x10000" "0x20000"
+	idx2="$(find_mtd_index bdata)"
+	[ -n "$idx2" ] && \
+		ubootenv_add_uci_sys_config "/dev/mtd$idx2" "0x0" "0x10000" "0x20000"
+	;;
+prpl,haze)
+	mmcpart="$(find_mmc_part 0:APPSBLENV)"
+	[ -n "$mmcpart" ] && \
+		ubootenv_add_uci_config "$mmcpart" "0x0" "0x40000" "0x400" "0x100"
+	;;
+qnap,301w)
+	idx="$(find_mtd_index 0:appsblenv)"
+	[ -n "$idx" ] && \
+		ubootenv_add_uci_config "/dev/mtd$idx" "0x0" "0x20000" "0x20000" "1"
+	;;
+esac
+
+config_load ubootenv
+config_foreach ubootenv_add_app_config
+
+exit 0
diff --git a/package/boot/uboot-envtools/files/ramips b/package/boot/uboot-envtools/files/ramips
index 194f6561d46e38..b3f37c7c3ebdf3 100644
--- a/package/boot/uboot-envtools/files/ramips
+++ b/package/boot/uboot-envtools/files/ramips
@@ -17,10 +17,16 @@ alfa-network,awusfree1|\
 alfa-network,quad-e4g|\
 alfa-network,r36m-e4g|\
 alfa-network,tube-e4g|\
+engenius,epg600|\
 engenius,esr600h|\
-sitecom,wlr-4100-v1-002)
+linksys,re7000|\
+sitecom,wlr-4100-v1-002|\
+zyxel,keenetic-lite-iii-a)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x1000" "0x1000"
 	;;
+arcadyan,we420223-99)
+	ubootenv_add_uci_config "/dev/mtd2" "0x0" "0x1000" "0x1000"
+	;;
 allnet,all0256n-4m|\
 allnet,all0256n-8m|\
 allnet,all5002|\
@@ -32,7 +38,10 @@ ampedwireless,ally-r1900k)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x1000" "0x20000" "4"
 	;;
 beeline,smartbox-giga|\
-beeline,smartbox-turbo)
+beeline,smartbox-turbo|\
+beeline,smartbox-turbo-plus|\
+etisalat,s3|\
+rostelecom,rt-sf-1)
 	ubootenv_add_uci_config "/dev/mtd0" "0x80000" "0x1000" "0x20000"
 	;;
 buffalo,wsr-1166dhp|\
@@ -47,14 +56,22 @@ zbtlink,zbt-wg2626|\
 zte,mf283plus)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x1000" "0x10000"
 	;;
+asus,rt-ax53u|\
+asus,rt-ax54|\
 belkin,rt1800|\
 h3c,tx1800-plus|\
 h3c,tx1801-plus|\
 h3c,tx1806|\
 jcg,q20|\
 linksys,e7350|\
-netgear,wax202)
+netgear,wax202|\
+zyxel,wsm20)
+	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x20000"
+	;;
+haier,har-20s2u1|\
+sim,simax1800t)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x20000"
+	ubootenv_add_uci_sys_config "/dev/mtd1" "0x40000" "0x40000" "0x20000"
 	;;
 hootoo,ht-tm05|\
 ravpower,rp-wd03)
@@ -72,6 +89,18 @@ linksys,ea8100-v2|\
 mts,wg430223)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x1000" "0x20000"
 	;;
+snr,snr-cpe-me1|\
+snr,snr-cpe-me2-sfp|\
+snr,cpe-w4n-mt)
+	idx="$(find_mtd_index uboot-env)"
+	[ -n "$idx" ] && \
+		ubootenv_add_uci_config "/dev/mtd$idx" "0x0" "0x1000" "0x1000"
+	;;
+tplink,ec330-g5u-v1)
+	idx="$(find_mtd_index u-boot-env)"
+	[ -n "$idx" ] && \
+		ubootenv_add_uci_config "/dev/mtd$idx" "0x0" "0x1000" "0x20000"
+	;;
 xiaomi,mi-router-3g-v2|\
 xiaomi,mi-router-4a-gigabit|\
 xiaomi,miwifi-3c)
diff --git a/package/boot/uboot-envtools/files/realtek b/package/boot/uboot-envtools/files/realtek
index f191503876822b..cd2446432d7dac 100644
--- a/package/boot/uboot-envtools/files/realtek
+++ b/package/boot/uboot-envtools/files/realtek
@@ -8,6 +8,14 @@ touch /etc/config/ubootenv
 board=$(board_name)
 
 case "$board" in
+apresia,aplgs120gtss)
+	idx="$(find_mtd_index u-boot-env)"
+	[ -n "$idx" ] && \
+		ubootenv_add_uci_config "/dev/mtd$idx" "0x0" "0x40000" "0x10000"
+	idx2="$(find_mtd_index u-boot-env2)"
+	[ -n "$idx2" ] && \
+		ubootenv_add_uci_sys_config "/dev/mtd$idx2" "0x0" "0x40000" "0x10000"
+	;;
 d-link,dgs-1210-10mp|\
 d-link,dgs-1210-10p|\
 d-link,dgs-1210-16|\
diff --git a/package/boot/uboot-fritz4040/Makefile b/package/boot/uboot-fritz4040/Makefile
index 3aa08081bf0e0e..d19db162d75760 100644
--- a/package/boot/uboot-fritz4040/Makefile
+++ b/package/boot/uboot-fritz4040/Makefile
@@ -14,7 +14,7 @@ PKG_SOURCE_VERSION:=9d89013f9cc963eca25856c61fa066091d35f8de
 PKG_SOURCE_DATE:=2022-05-01
 PKG_MIRROR_HASH:=4f2a3782ba359e6d901b536d1d685026913c14426f8e58ba9673281f20675050
 
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=5
 
 include $(INCLUDE_DIR)/u-boot.mk
 include $(INCLUDE_DIR)/package.mk
@@ -41,6 +41,11 @@ define U-Boot/fritz4040
   BUILD_DEVICES:=avm_fritzbox-4040
 endef
 
+define U-Boot/fritz7520
+  NAME:=FritzBox 7520
+  BUILD_DEVICES:=avm_fritzbox-7530
+endef
+
 define U-Boot/fritz7530
   NAME:=FritzBox 7530
   BUILD_DEVICES:=avm_fritzbox-7530
@@ -72,6 +77,6 @@ define Package/u-boot/install
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/upload-to-f4040.sh $(1)/
 endef
 
-UBOOT_TARGETS := fritz1200 fritz3000 fritz4040 fritz7530
+UBOOT_TARGETS := fritz1200 fritz3000 fritz4040 fritz7520 fritz7530
 
 $(eval $(call BuildPackage/U-Boot))
diff --git a/package/boot/uboot-imx/Makefile b/package/boot/uboot-imx/Makefile
index ade26db7686587..90fc949cfd238b 100644
--- a/package/boot/uboot-imx/Makefile
+++ b/package/boot/uboot-imx/Makefile
@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_VERSION:=2022.01
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=5
 
 PKG_HASH:=81b4543227db228c03f8a1bf5ddbc813b0bb8f6555ce46064ef721a6fc680413
 
diff --git a/package/boot/uboot-kirkwood/Makefile b/package/boot/uboot-kirkwood/Makefile
index d9cb10ce13affd..7f9ae4e1517ab7 100644
--- a/package/boot/uboot-kirkwood/Makefile
+++ b/package/boot/uboot-kirkwood/Makefile
@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_VERSION:=2020.04
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=9
 
 PKG_HASH:=fe732aaf037d9cc3c0909bad8362af366ae964bbdac6913a34081ff4ad565372
 
@@ -17,6 +17,7 @@ include $(INCLUDE_DIR)/package.mk
 
 define U-Boot/Default
   BUILD_TARGET:=kirkwood
+  BUILD_SUBTARGET:=generic
 endef
 
 define U-Boot/dockstar
diff --git a/package/boot/uboot-lantiq/Makefile b/package/boot/uboot-lantiq/Makefile
index 2786f1afdafa23..927fbcb9c0ac0f 100644
--- a/package/boot/uboot-lantiq/Makefile
+++ b/package/boot/uboot-lantiq/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=u-boot
 PKG_VERSION:=2013.10
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=66
 
 PKG_HASH:=0d71e62beb952b41ebafb20a7ee4df2f960db64c31b054721ceb79ff14014c55
 
diff --git a/package/boot/uboot-layerscape/Makefile b/package/boot/uboot-layerscape/Makefile
index 53d21f59dc97cb..e255debfeb826c 100644
--- a/package/boot/uboot-layerscape/Makefile
+++ b/package/boot/uboot-layerscape/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=uboot-layerscape
-PKG_VERSION:=21.08
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_VERSION:=lf-6.1.1-1.0.0
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=https://source.codeaurora.org/external/qoriq/qoriq-components/u-boot
-PKG_SOURCE_VERSION:=LSDK-21.08
-PKG_MIRROR_HASH:=54909a98bdcc26c7f9b35b35fcae09b977ecbf044be7bffa6dad9306c47cccf6
+PKG_SOURCE_URL:=https://github.com/nxp-qoriq/u-boot
+PKG_SOURCE_VERSION:=lf-6.1.1-1.0.0
+PKG_MIRROR_HASH:=f4a3a262fd8923af72dede0348a512c05b756e3925279553eaf1c6667b186fb4
 
 include $(INCLUDE_DIR)/u-boot.mk
 include $(INCLUDE_DIR)/package.mk
@@ -45,6 +45,16 @@ define U-Boot/fsl_ls1012a-frwy-sdboot
   ENV_SIZE:=0x10000
 endef
 
+define U-Boot/fsl_ls1028a-rdb
+  NAME:=NXP LS1028ARDB
+  UBOOT_CONFIG:=ls1028ardb_tfa
+endef
+
+define U-Boot/fsl_ls1028a-rdb-sdboot
+  NAME:=NXP LS1028ARDB SD Card Boot
+  UBOOT_CONFIG:=ls1028ardb_tfa
+endef
+
 define U-Boot/fsl_ls1043a-rdb
   NAME:=NXP LS1043ARDB
   UBOOT_CONFIG:=ls1043ardb_tfa
@@ -127,6 +137,8 @@ UBOOT_TARGETS := \
   fsl_ls1012a-frdm \
   fsl_ls1012a-rdb \
   fsl_ls1012a-frwy-sdboot \
+  fsl_ls1028a-rdb \
+  fsl_ls1028a-rdb-sdboot \
   fsl_ls1043a-rdb \
   fsl_ls1043a-rdb-sdboot \
   fsl_ls1046a-frwy \
diff --git a/package/boot/uboot-layerscape/files/fsl_ls1012a-frdm-uEnv.txt b/package/boot/uboot-layerscape/files/fsl_ls1012a-frdm-uEnv.txt
index b5da9971b60dd5..b9fefb4e0dd95c 100644
--- a/package/boot/uboot-layerscape/files/fsl_ls1012a-frdm-uEnv.txt
+++ b/package/boot/uboot-layerscape/files/fsl_ls1012a-frdm-uEnv.txt
@@ -1,5 +1,5 @@
 fdtaddr=0x8f000000
-loadaddr=0x81000000
+loadaddr=0x88000000
 fdt_high=0x8fffffff
 initrd_high=0xffffffffffffffff
 qspi_boot=sf probe 0:0;sf read $loadaddr 1000000 2800000;bootm $loadaddr
diff --git a/package/boot/uboot-layerscape/files/fsl_ls1012a-frwy-sdboot-uEnv.txt b/package/boot/uboot-layerscape/files/fsl_ls1012a-frwy-sdboot-uEnv.txt
index 592158955e8002..18efdc1bc34e50 100644
--- a/package/boot/uboot-layerscape/files/fsl_ls1012a-frwy-sdboot-uEnv.txt
+++ b/package/boot/uboot-layerscape/files/fsl_ls1012a-frwy-sdboot-uEnv.txt
@@ -1,5 +1,5 @@
 fdtaddr=0x8f000000
-loadaddr=0x81000000
+loadaddr=0x88000000
 fdt_high=0x8fffffff
 initrd_high=0xffffffffffffffff
 sd_boot=ext4load mmc 0:1 $loadaddr fitImage;bootm $loadaddr
diff --git a/package/boot/uboot-layerscape/files/fsl_ls1012a-rdb-uEnv.txt b/package/boot/uboot-layerscape/files/fsl_ls1012a-rdb-uEnv.txt
index 8d57d51ece75c5..0898354e7744b5 100644
--- a/package/boot/uboot-layerscape/files/fsl_ls1012a-rdb-uEnv.txt
+++ b/package/boot/uboot-layerscape/files/fsl_ls1012a-rdb-uEnv.txt
@@ -1,5 +1,5 @@
 fdtaddr=0x8f000000
-loadaddr=0x81000000
+loadaddr=0x88000000
 bootm_size=0x10000000
 qspi_boot=sf probe 0:0;sf read $fdtaddr f00000 100000;sf read $loadaddr 1000000 1000000;bootm $loadaddr - $fdtaddr
 bootargs=root=/dev/mtdblock8 rootfstype=squashfs,jffs2 noinitrd earlycon=uart8250,mmio,0x21c0500 console=ttyS0,115200 mtdparts=1550000.spi:1m(bl2),4m(fip),1m(u-boot-env),4m(reserved-1),3m(pfe),2m(reserved-2),1m(dtb),16m(kernel),32m(rootfs),49m@0xf00000(firmware)
diff --git a/package/boot/uboot-layerscape/files/fsl_ls1021a-iot-sdboot-uEnv.txt b/package/boot/uboot-layerscape/files/fsl_ls1021a-iot-sdboot-uEnv.txt
index 55620d67257c83..f8ec2c10fe869f 100644
--- a/package/boot/uboot-layerscape/files/fsl_ls1021a-iot-sdboot-uEnv.txt
+++ b/package/boot/uboot-layerscape/files/fsl_ls1021a-iot-sdboot-uEnv.txt
@@ -1,8 +1,8 @@
 fdtaddr=0x8f000000
-loadaddr=0x81000000
+loadaddr=0x88000000
 fdt_high=0x8fffffff
 initrd_high=0xffffffff
-sd_boot=ext4load mmc 0:1 $loadaddr fitImage;bootm $loadaddr
+sd_boot=ext4load mmc 0:1 ${loadaddr} fitImage;bootm ${loadaddr}
 bootargs=root=/dev/mmcblk0p2 rw rootwait rootfstype=squashfs,f2fs noinitrd earlycon=uart8250,mmio,0x21c0500 console=ttyS0,115200
 bootcmd=echo starting openwrt ...;run sd_boot
 bootdelay=3
diff --git a/package/boot/uboot-layerscape/files/fsl_ls1021a-twr-sdboot-uEnv.txt b/package/boot/uboot-layerscape/files/fsl_ls1021a-twr-sdboot-uEnv.txt
index 55620d67257c83..d7f67e78ec870c 100644
--- a/package/boot/uboot-layerscape/files/fsl_ls1021a-twr-sdboot-uEnv.txt
+++ b/package/boot/uboot-layerscape/files/fsl_ls1021a-twr-sdboot-uEnv.txt
@@ -1,5 +1,5 @@
 fdtaddr=0x8f000000
-loadaddr=0x81000000
+loadaddr=0x88000000
 fdt_high=0x8fffffff
 initrd_high=0xffffffff
 sd_boot=ext4load mmc 0:1 $loadaddr fitImage;bootm $loadaddr
diff --git a/package/boot/uboot-layerscape/files/fsl_ls1021a-twr-uEnv.txt b/package/boot/uboot-layerscape/files/fsl_ls1021a-twr-uEnv.txt
index 6d4647b1fd6e1c..26fb3e9207b288 100644
--- a/package/boot/uboot-layerscape/files/fsl_ls1021a-twr-uEnv.txt
+++ b/package/boot/uboot-layerscape/files/fsl_ls1021a-twr-uEnv.txt
@@ -1,5 +1,5 @@
 fdtaddr=0x8f000000
-loadaddr=0x81000000
+loadaddr=0x88000000
 bootm_size=0x10000000
 nor_boot=cp.b 60f00000 $fdtaddr 100000;cp.b 61000000 $loadaddr 1000000;bootm $loadaddr - $fdtaddr
 bootargs=root=/dev/mtdblock6 rootfstype=squashfs,jffs2 noinitrd earlycon=uart8250,mmio,0x21c0500 console=ttyS0,115200 mtdparts=60000000.nor:1m(rcw),2m(u-boot),1m(u-boot-env),11m(reserved-1),1m(dtb),16m(kernel),32m(rootfs),49m@0xf00000(firmware) cma=64M@0x0-0xb0000000
diff --git a/package/boot/uboot-layerscape/files/fsl_ls1028a-rdb-sdboot-uEnv.txt b/package/boot/uboot-layerscape/files/fsl_ls1028a-rdb-sdboot-uEnv.txt
new file mode 100644
index 00000000000000..3c39c2263de06d
--- /dev/null
+++ b/package/boot/uboot-layerscape/files/fsl_ls1028a-rdb-sdboot-uEnv.txt
@@ -0,0 +1,10 @@
+fdtaddr=0x8f000000
+loadaddr=0x81000000
+fdt_high=0x8fffffff
+initrd_high=0xffffffffffffffff
+hwconfig=fsl_ddr:bank_intlv=auto
+sd_boot=ext4load mmc 0:1 $loadaddr fitImage;bootm $loadaddr
+bootargs=root=/dev/mmcblk0p2 rw rootwait rootfstype=squashfs,f2fs noinitrd earlycon=uart8250,mmio,0x21c0500 console=ttyS0,115200
+bootcmd=echo starting openwrt ...;run sd_boot
+bootdelay=3
+fsl_bootcmd_mcinitcmd_set=y
diff --git a/package/boot/uboot-layerscape/files/fsl_ls1028a-rdb-uEnv.txt b/package/boot/uboot-layerscape/files/fsl_ls1028a-rdb-uEnv.txt
new file mode 100644
index 00000000000000..21d41d15b53dfa
--- /dev/null
+++ b/package/boot/uboot-layerscape/files/fsl_ls1028a-rdb-uEnv.txt
@@ -0,0 +1,9 @@
+fdtaddr=0x8f000000
+loadaddr=0x81000000
+bootm_size=0x10000000
+hwconfig=fsl_ddr:bank_intlv=auto
+qspi_boot=sf probe 0:0;sf read $loadaddr 1000000 1000000;bootm $loadaddr
+bootargs=rootfstype=squashfs,jffs2 noinitrd earlycon=uart8250,mmio,0x21c0500 console=ttyS0,115200 mtdparts=20c0000.spi:1m(bl2),4m(fip),1m(u-boot-env),128k(secure-boot-headers),48m@0x1000000(firmware)
+bootcmd=echo starting openwrt ...;run qspi_boot
+bootdelay=3
+fsl_bootcmd_mcinitcmd_set=y
diff --git a/package/boot/uboot-layerscape/files/fsl_ls1043a-rdb-sdboot-uEnv.txt b/package/boot/uboot-layerscape/files/fsl_ls1043a-rdb-sdboot-uEnv.txt
index 3c39c2263de06d..591210eea73728 100644
--- a/package/boot/uboot-layerscape/files/fsl_ls1043a-rdb-sdboot-uEnv.txt
+++ b/package/boot/uboot-layerscape/files/fsl_ls1043a-rdb-sdboot-uEnv.txt
@@ -1,5 +1,5 @@
 fdtaddr=0x8f000000
-loadaddr=0x81000000
+loadaddr=0x88000000
 fdt_high=0x8fffffff
 initrd_high=0xffffffffffffffff
 hwconfig=fsl_ddr:bank_intlv=auto
diff --git a/package/boot/uboot-layerscape/files/fsl_ls1043a-rdb-uEnv.txt b/package/boot/uboot-layerscape/files/fsl_ls1043a-rdb-uEnv.txt
index acb61ca00a32db..c601cab92f8b5d 100644
--- a/package/boot/uboot-layerscape/files/fsl_ls1043a-rdb-uEnv.txt
+++ b/package/boot/uboot-layerscape/files/fsl_ls1043a-rdb-uEnv.txt
@@ -1,5 +1,5 @@
 fdtaddr=0x8f000000
-loadaddr=0x81000000
+loadaddr=0x88000000
 bootm_size=0x10000000
 hwconfig=fsl_ddr:bank_intlv=auto
 nor_boot=cp.b 60f00000 $fdtaddr 100000;cp.b 61000000 $loadaddr 1000000;bootm $loadaddr - $fdtaddr
diff --git a/package/boot/uboot-layerscape/files/fsl_ls1046a-frwy-sdboot-uEnv.txt b/package/boot/uboot-layerscape/files/fsl_ls1046a-frwy-sdboot-uEnv.txt
index 303157cb800405..e69332efacbda1 100644
--- a/package/boot/uboot-layerscape/files/fsl_ls1046a-frwy-sdboot-uEnv.txt
+++ b/package/boot/uboot-layerscape/files/fsl_ls1046a-frwy-sdboot-uEnv.txt
@@ -1,5 +1,5 @@
 fdtaddr=0x8f000000
-loadaddr=0x81000000
+loadaddr=0x88000000
 bootm_size=0x10000000
 hwconfig=fsl_ddr:bank_intlv=auto
 sd_boot=ext4load mmc 0:1 ${loadaddr} fitImage;bootm ${loadaddr}
diff --git a/package/boot/uboot-layerscape/files/fsl_ls1046a-frwy-uEnv.txt b/package/boot/uboot-layerscape/files/fsl_ls1046a-frwy-uEnv.txt
index 5461bba9b66716..ad5cc77841dccf 100644
--- a/package/boot/uboot-layerscape/files/fsl_ls1046a-frwy-uEnv.txt
+++ b/package/boot/uboot-layerscape/files/fsl_ls1046a-frwy-uEnv.txt
@@ -1,5 +1,5 @@
 fdtaddr=0x8f000000
-loadaddr=0x81000000
+loadaddr=0x88000000
 bootm_size=0x10000000
 hwconfig=fsl_ddr:bank_intlv=auto
 qspi_boot=sf probe 0:0;sf read $fdtaddr f00000 100000;sf read $loadaddr 1000000 1000000;bootm $loadaddr - $fdtaddr
diff --git a/package/boot/uboot-layerscape/files/fsl_ls1046a-rdb-sdboot-uEnv.txt b/package/boot/uboot-layerscape/files/fsl_ls1046a-rdb-sdboot-uEnv.txt
index 3c39c2263de06d..591210eea73728 100644
--- a/package/boot/uboot-layerscape/files/fsl_ls1046a-rdb-sdboot-uEnv.txt
+++ b/package/boot/uboot-layerscape/files/fsl_ls1046a-rdb-sdboot-uEnv.txt
@@ -1,5 +1,5 @@
 fdtaddr=0x8f000000
-loadaddr=0x81000000
+loadaddr=0x88000000
 fdt_high=0x8fffffff
 initrd_high=0xffffffffffffffff
 hwconfig=fsl_ddr:bank_intlv=auto
diff --git a/package/boot/uboot-layerscape/files/fsl_ls1046a-rdb-uEnv.txt b/package/boot/uboot-layerscape/files/fsl_ls1046a-rdb-uEnv.txt
index e52e48802bc23c..dab8faaf1322ca 100644
--- a/package/boot/uboot-layerscape/files/fsl_ls1046a-rdb-uEnv.txt
+++ b/package/boot/uboot-layerscape/files/fsl_ls1046a-rdb-uEnv.txt
@@ -1,5 +1,5 @@
 fdtaddr=0x8f000000
-loadaddr=0x81000000
+loadaddr=0x88000000
 bootm_size=0x10000000
 hwconfig=fsl_ddr:bank_intlv=auto
 qspi_boot=sf probe 0:0;sf read $fdtaddr f00000 100000;sf read $loadaddr 1000000 1000000;bootm $loadaddr - $fdtaddr
diff --git a/package/boot/uboot-layerscape/files/fsl_ls1088a-rdb-sdboot-uEnv.txt b/package/boot/uboot-layerscape/files/fsl_ls1088a-rdb-sdboot-uEnv.txt
index f616cb1398657f..5b235378448a42 100644
--- a/package/boot/uboot-layerscape/files/fsl_ls1088a-rdb-sdboot-uEnv.txt
+++ b/package/boot/uboot-layerscape/files/fsl_ls1088a-rdb-sdboot-uEnv.txt
@@ -1,5 +1,5 @@
 fdtaddr=0x8f000000
-loadaddr=0x81000000
+loadaddr=0x88000000
 fdt_high=0xa0000000
 initrd_high=0xffffffffffffffff
 hwconfig=fsl_ddr:bank_intlv=auto
diff --git a/package/boot/uboot-layerscape/files/fsl_ls1088a-rdb-uEnv.txt b/package/boot/uboot-layerscape/files/fsl_ls1088a-rdb-uEnv.txt
index 210c18721df2f2..a15717bcb80c81 100644
--- a/package/boot/uboot-layerscape/files/fsl_ls1088a-rdb-uEnv.txt
+++ b/package/boot/uboot-layerscape/files/fsl_ls1088a-rdb-uEnv.txt
@@ -1,5 +1,5 @@
 fdtaddr=0x8f000000
-loadaddr=0x81000000
+loadaddr=0x88000000
 fdt_high=0xa0000000
 initrd_high=0xffffffffffffffff
 hwconfig=fsl_ddr:bank_intlv=auto
diff --git a/package/boot/uboot-layerscape/files/fsl_ls2088a-rdb-uEnv.txt b/package/boot/uboot-layerscape/files/fsl_ls2088a-rdb-uEnv.txt
index 946029d1f16cd2..646aed4427826a 100644
--- a/package/boot/uboot-layerscape/files/fsl_ls2088a-rdb-uEnv.txt
+++ b/package/boot/uboot-layerscape/files/fsl_ls2088a-rdb-uEnv.txt
@@ -1,5 +1,5 @@
 fdtaddr=0x8f000000
-loadaddr=0x81000000
+loadaddr=0x88000000
 fdt_high=0xa0000000
 initrd_high=0xffffffffffffffff
 hwconfig=fsl_ddr:bank_intlv=auto
diff --git a/package/boot/uboot-layerscape/files/fsl_lx2160a-rdb-sdboot-uEnv.txt b/package/boot/uboot-layerscape/files/fsl_lx2160a-rdb-sdboot-uEnv.txt
index d1373199150ae6..2d8043d7b1b28d 100644
--- a/package/boot/uboot-layerscape/files/fsl_lx2160a-rdb-sdboot-uEnv.txt
+++ b/package/boot/uboot-layerscape/files/fsl_lx2160a-rdb-sdboot-uEnv.txt
@@ -1,5 +1,5 @@
 fdtaddr=0x8f000000
-loadaddr=0x81000000
+loadaddr=0x88000000
 bootm_size=0x10000000
 hwconfig=fsl_ddr:bank_intlv=auto
 mc_init=mmc read 80000000 5000 1800;mmc read 80300000 7000 800;fsl_mc start mc 80000000 80300000;mmc read 80400000 6800 800;fsl_mc apply dpl 80400000
diff --git a/package/boot/uboot-layerscape/files/fsl_lx2160a-rdb-uEnv.txt b/package/boot/uboot-layerscape/files/fsl_lx2160a-rdb-uEnv.txt
index 41fde35c88c166..16f905afc685a5 100644
--- a/package/boot/uboot-layerscape/files/fsl_lx2160a-rdb-uEnv.txt
+++ b/package/boot/uboot-layerscape/files/fsl_lx2160a-rdb-uEnv.txt
@@ -1,5 +1,5 @@
 fdtaddr=0x8f000000
-loadaddr=0x81000000
+loadaddr=0x88000000
 bootm_size=0x10000000
 hwconfig=fsl_ddr:bank_intlv=auto
 mc_init=sf probe 0:0;sf read 80000000 a00000 300000;sf read 80300000 e00000 100000;fsl_mc start mc 80000000 80300000;sf read 80400000 d00000 100000;fsl_mc apply dpl 80400000
diff --git a/package/boot/uboot-layerscape/patches/0900-layerscape-adjust-LS1021A-IOT-config-for-OpenWrt.patch b/package/boot/uboot-layerscape/patches/0900-layerscape-adjust-LS1021A-IOT-config-for-OpenWrt.patch
new file mode 100644
index 00000000000000..414f2541acfe17
--- /dev/null
+++ b/package/boot/uboot-layerscape/patches/0900-layerscape-adjust-LS1021A-IOT-config-for-OpenWrt.patch
@@ -0,0 +1,45 @@
+From b382eeafe01df21da3518b2f1dd7d22ee114efb0 Mon Sep 17 00:00:00 2001
+From: Pawel Dembicki <paweldembicki@gmail.com>
+Date: Mon, 24 Oct 2022 14:19:38 +0200
+Subject: [PATCH] layerscape: adjust LS1021A-IOT config for OpenWrt
+
+Two configs are required:
+  - FIT
+  - Ext4load
+
+Let's enable it. U-boot is now bigger than 512K. Let's enlarge it to
+768K. Envs start at 1M, so it will fit.
+
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+---
+ configs/ls1021aiot_sdcard_defconfig | 3 +++
+ include/configs/ls1021aiot.h        | 4 ++--
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+--- a/configs/ls1021aiot_sdcard_defconfig
++++ b/configs/ls1021aiot_sdcard_defconfig
+@@ -27,8 +27,11 @@ CONFIG_CMD_MII=y
+ # CONFIG_CMD_MDIO is not set
+ CONFIG_CMD_PING=y
+ CONFIG_CMD_EXT2=y
++CONFIG_CMD_EXT4=y
+ CONFIG_CMD_FAT=y
+ # CONFIG_SPL_EFI_PARTITION is not set
++CONFIG_FIT=y
++CONFIG_FIT_VERBOSE=y
+ CONFIG_OF_CONTROL=y
+ CONFIG_ENV_OVERWRITE=y
+ CONFIG_ENV_IS_IN_MMC=y
+--- a/include/configs/ls1021aiot.h
++++ b/include/configs/ls1021aiot.h
+@@ -78,8 +78,8 @@
+ 		CONFIG_SYS_MONITOR_LEN)
+ #define CONFIG_SYS_SPL_MALLOC_SIZE	0x100000
+ #define CONFIG_SPL_BSS_START_ADDR	0x80100000
+-#define CONFIG_SPL_BSS_MAX_SIZE		0x80000
+-#define CONFIG_SYS_MONITOR_LEN		0x80000
++#define CONFIG_SPL_BSS_MAX_SIZE		0xc0000
++#define CONFIG_SYS_MONITOR_LEN		0xc0000
+ #endif
+ 
+ #define CONFIG_SYS_DDR_SDRAM_BASE	0x80000000UL
diff --git a/package/boot/uboot-mediatek/Makefile b/package/boot/uboot-mediatek/Makefile
index 7e813b2a5ef7b6..8ea05b9159e627 100644
--- a/package/boot/uboot-mediatek/Makefile
+++ b/package/boot/uboot-mediatek/Makefile
@@ -1,9 +1,9 @@
 include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
-PKG_VERSION:=2022.07
-PKG_HASH:=92b08eb49c24da14c1adbf70a71ae8f37cc53eeb4230e859ad8b6733d13dcf5e
-PKG_BUILD_DEPENDS:=arm-trusted-firmware-tools/host
+PKG_VERSION:=2023.04
+PKG_HASH:=e31cac91545ff41b71cec5d8c22afd695645cd6e2a442ccdacacd60534069341
+PKG_BUILD_DEPENDS:=!(TARGET_ramips||TARGET_mediatek_mt7623):arm-trusted-firmware-tools/host
 
 include $(INCLUDE_DIR)/u-boot.mk
 include $(INCLUDE_DIR)/package.mk
@@ -34,6 +34,7 @@ endif
 define U-Boot/Default
   BUILD_TARGET:=mediatek
   UBOOT_IMAGE:=u-boot-mtk.bin
+  HIDDEN:=1
 endef
 
 define U-Boot/mt7620_rfb
@@ -175,6 +176,18 @@ define U-Boot/mt7629_rfb
   UBOOT_CONFIG:=mt7629_rfb
 endef
 
+define U-Boot/mt7981_qihoo_360t7
+  NAME:=Qihoo 360T7
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=qihoo_360t7
+  UBOOT_CONFIG:=mt7981_qihoo-360t7
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=spim-nand
+  BL2_SOC:=mt7981
+  BL2_DDRTYPE:=ddr3
+  DEPENDS:=+trusted-firmware-a-mt7981-spim-nand-ddr3
+endef
+
 define U-Boot/mt7986_rfb
   NAME:=MT7986 Reference Board
   BUILD_SUBTARGET:=filogic
@@ -236,6 +249,54 @@ define U-Boot/mt7986_bananapi_bpi-r3-nor
   FIP_COMPRESS:=1
 endef
 
+define U-Boot/mt7986_tplink_tl-xdr4288
+  NAME:=TP-LINK TL-XDR4288
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=tplink_tl-xdr4288
+  UBOOT_CONFIG:=mt7986_tplink_tl-xdr4288
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=spim-nand
+  BL2_SOC:=mt7986
+  BL2_DDRTYPE:=ddr3
+  DEPENDS:=+trusted-firmware-a-mt7986-spim-nand-ddr3
+endef
+
+define U-Boot/mt7986_tplink_tl-xdr6086
+  NAME:=TP-LINK TL-XDR6086
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=tplink_tl-xdr6086
+  UBOOT_CONFIG:=mt7986_tplink_tl-xdr6086
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=spim-nand
+  BL2_SOC:=mt7986
+  BL2_DDRTYPE:=ddr3
+  DEPENDS:=+trusted-firmware-a-mt7986-spim-nand-ddr3
+endef
+
+define U-Boot/mt7986_tplink_tl-xdr6088
+  NAME:=TP-LINK TL-XDR6088
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=tplink_tl-xdr6088
+  UBOOT_CONFIG:=mt7986_tplink_tl-xdr6088
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=spim-nand
+  BL2_SOC:=mt7986
+  BL2_DDRTYPE:=ddr3
+  DEPENDS:=+trusted-firmware-a-mt7986-spim-nand-ddr3
+endef
+
+define U-Boot/mt7986_xiaomi_redmi-router-ax6000
+  NAME:=Xiaomi Redmi AX6000
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=xiaomi_redmi-router-ax6000-ubootmod
+  UBOOT_CONFIG:=mt7986_xiaomi_redmi-ax6000
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=spim-nand
+  BL2_SOC:=mt7986
+  BL2_DDRTYPE:=ddr4
+  DEPENDS:=+trusted-firmware-a-mt7986-spim-nand-ddr4
+endef
+
 UBOOT_TARGETS := \
 	mt7620_mt7530_rfb \
 	mt7620_rfb \
@@ -252,10 +313,15 @@ UBOOT_TARGETS := \
 	mt7628_rfb \
 	ravpower_rp-wd009 \
 	mt7629_rfb \
+	mt7981_qihoo_360t7 \
 	mt7986_bananapi_bpi-r3-emmc \
 	mt7986_bananapi_bpi-r3-sdmmc \
 	mt7986_bananapi_bpi-r3-snand \
 	mt7986_bananapi_bpi-r3-nor \
+	mt7986_tplink_tl-xdr4288 \
+	mt7986_tplink_tl-xdr6086 \
+	mt7986_tplink_tl-xdr6088 \
+	mt7986_xiaomi_redmi-router-ax6000 \
 	mt7986_rfb
 
 ifdef CONFIG_TARGET_mediatek
diff --git a/package/boot/uboot-mediatek/patches/000-mtk-20-configs-mt7622-enable-environment-for-mt7622_rfb.patch b/package/boot/uboot-mediatek/patches/000-mtk-20-configs-mt7622-enable-environment-for-mt7622_rfb.patch
index cf2e48d5c4887f..cd9004844c02c3 100644
--- a/package/boot/uboot-mediatek/patches/000-mtk-20-configs-mt7622-enable-environment-for-mt7622_rfb.patch
+++ b/package/boot/uboot-mediatek/patches/000-mtk-20-configs-mt7622-enable-environment-for-mt7622_rfb.patch
@@ -12,16 +12,16 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 
 --- a/configs/mt7622_rfb_defconfig
 +++ b/configs/mt7622_rfb_defconfig
-@@ -5,6 +5,8 @@ CONFIG_SYS_TEXT_BASE=0x41e00000
+@@ -6,6 +6,8 @@ CONFIG_TEXT_BASE=0x41e00000
  CONFIG_SYS_MALLOC_F_LEN=0x4000
  CONFIG_NR_DRAM_BANKS=1
  CONFIG_DEFAULT_DEVICE_TREE="mt7622-rfb"
 +CONFIG_ENV_SIZE=0x20000
 +CONFIG_ENV_OFFSET=0x280000
+ CONFIG_SYS_PROMPT="MT7622> "
  CONFIG_DEBUG_UART_BASE=0x11002000
  CONFIG_DEBUG_UART_CLOCK=25000000
- CONFIG_SYS_LOAD_ADDR=0x4007ff28
-@@ -21,6 +23,9 @@ CONFIG_CMD_SF_TEST=y
+@@ -24,6 +26,9 @@ CONFIG_CMD_SF_TEST=y
  CONFIG_CMD_PING=y
  CONFIG_CMD_SMC=y
  CONFIG_ENV_OVERWRITE=y
@@ -30,4 +30,4 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +CONFIG_ENV_SIZE_REDUND=0x40000
  CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
  CONFIG_NET_RANDOM_ETHADDR=y
- CONFIG_REGMAP=y
+ CONFIG_USE_IPADDR=y
diff --git a/package/boot/uboot-mediatek/patches/001-pinctrl-mediatek-set-R1-R0-in-case-pullen-pullsel-su.patch b/package/boot/uboot-mediatek/patches/001-pinctrl-mediatek-set-R1-R0-in-case-pullen-pullsel-su.patch
new file mode 100644
index 00000000000000..988c78cdfb8316
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/001-pinctrl-mediatek-set-R1-R0-in-case-pullen-pullsel-su.patch
@@ -0,0 +1,88 @@
+From patchwork Wed Apr 12 20:36:43 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 1768270
+Return-Path: <u-boot-bounces@lists.denx.de>
+X-Original-To: incoming@patchwork.ozlabs.org
+Delivered-To: patchwork-incoming@legolas.ozlabs.org
+Date: Wed, 12 Apr 2023 21:36:43 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: u-boot@lists.denx.de, Sam Shih <sam.shih@mediatek.com>,
+ GSS_MTK_Uboot_upstream <GSS_MTK_Uboot_upstream@mediatek.com>,
+ Chunfeng Yun <chunfeng.yun@mediatek.com>,
+ Weijie Gao <weijie.gao@mediatek.com>, Ryder Lee <ryder.lee@mediatek.com>,
+ Frank Wunderlich <frank-w@public-files.de>
+Cc: Steven Liu =?utf-8?b?KOWKieS6uuixqik=?= <steven.liu@mediatek.com>,
+ John Crispin <john@phrozen.org>
+Subject: [PATCH] pinctrl: mediatek: set R1/R0 in case pullen/pullsel succeeded
+Message-ID: <ZDcWW7kLSLn1GMZ1@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+X-BeenThere: u-boot@lists.denx.de
+X-Mailman-Version: 2.1.39
+Precedence: list
+List-Id: U-Boot discussion <u-boot.lists.denx.de>
+Sender: "U-Boot" <u-boot-bounces@lists.denx.de>
+
+Commit dafe0fbfb0f3 ("pinctrl: mediatek: rewrite mtk_pinconf_set and
+related functions") changed the logic deciding to set R0 and R1
+registers for V1 devices.
+
+Before:
+	/* Also set PUPD/R0/R1 if the pin has them */
+	err = mtk_hw_set_value(dev, pin, PINCTRL_PIN_REG_PUPD, !pullup);
+	if (err != -EINVAL) {
+		mtk_hw_set_value(dev, pin, PINCTRL_PIN_REG_R0, r0);
+		mtk_hw_set_value(dev, pin, PINCTRL_PIN_REG_R1, r1);
+	}
+
+After:
+	/* try pupd_r1_r0 if pullen_pullsel return error */
+	err = mtk_pinconf_bias_set_pullen_pullsel(dev, pin, disable, pullup,
+						  val);
+	if (err)
+		return mtk_pinconf_bias_set_pupd_r1_r0(dev, pin, disable,
+						       pullup, val);
+
+Tracing mtk_pinconf_bias_set_pullen_pullsel shows that the function
+always either returns 0 in case of success or -EINVAL in case any error
+has occurred. Hence the logic responsible of the decision to program R0
+and R1 has been inverted.
+
+This leads to problems on BananaPi R2 (MT7623N) when booting from
+SDMMC, it turns out accessing eMMC no longer works since
+U-Boot 2022.07:
+
+MT7623> mmc dev 0
+Card did not respond to voltage select! : -110
+
+The problem wasn't detected for a long time as both eMMC and SDMMC work
+fine if they are used to boot from, and hence R0 and R1 were already
+setup by the bootrom and/or preloader.
+
+Fix the logic to restore the originally intended and correct behavior
+and also change the descriptive comment accordingly.
+
+Fixes: dafe0fbfb0f3 ("pinctrl: mediatek: rewrite mtk_pinconf_set and related functions")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
+@@ -349,10 +349,10 @@ int mtk_pinconf_bias_set_v1(struct udevi
+ {
+ 	int err;
+ 
+-	/* try pupd_r1_r0 if pullen_pullsel return error */
++	/* set pupd_r1_r0 if pullen_pullsel succeeded */
+ 	err = mtk_pinconf_bias_set_pullen_pullsel(dev, pin, disable, pullup,
+ 						  val);
+-	if (err)
++	if (!err)
+ 		return mtk_pinconf_bias_set_pupd_r1_r0(dev, pin, disable,
+ 						       pullup, val);
+ 
diff --git a/package/boot/uboot-mediatek/patches/051-mt7986-enable-pstore.patch b/package/boot/uboot-mediatek/patches/051-mt7986-enable-pstore.patch
index 15484bef5596b4..d6ae7f0f13913f 100644
--- a/package/boot/uboot-mediatek/patches/051-mt7986-enable-pstore.patch
+++ b/package/boot/uboot-mediatek/patches/051-mt7986-enable-pstore.patch
@@ -1,6 +1,6 @@
 --- a/arch/arm/dts/mt7986.dtsi
 +++ b/arch/arm/dts/mt7986.dtsi
-@@ -46,6 +46,35 @@
+@@ -50,6 +50,35 @@
  		};
  	};
  
diff --git a/package/boot/uboot-mediatek/patches/052-mt7981-enable-pstore.patch b/package/boot/uboot-mediatek/patches/052-mt7981-enable-pstore.patch
new file mode 100644
index 00000000000000..9bfea8f7379b69
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/052-mt7981-enable-pstore.patch
@@ -0,0 +1,38 @@
+--- a/arch/arm/dts/mt7981.dtsi
++++ b/arch/arm/dts/mt7981.dtsi
+@@ -32,6 +32,35 @@
+ 		};
+ 	};
+ 
++	psci {
++		compatible  = "arm,psci-0.2";
++		method      = "smc";
++	};
++
++	reserved-memory {
++		#address-cells = <2>;
++		#size-cells = <2>;
++		ranges;
++
++		/* 64 KiB reserved for ramoops/pstore */
++		ramoops@42ff0000 {
++			compatible = "ramoops";
++			reg = <0 0x42ff0000 0 0x10000>;
++			record-size = <0x1000>;
++		};
++
++		/* 192 KiB reserved for ARM Trusted Firmware (BL31) */
++		secmon_reserved: secmon@43000000 {
++			reg = <0 0x43000000 0 0x30000>;
++			no-map;
++		};
++
++		wmcpu_emi: wmcpu-reserved@4fc00000 {
++			no-map;
++			reg = <0 0x4fc00000 0 0x00100000>;
++		};
++	};
++
+ 	gpt_clk: gpt_dummy20m {
+ 		compatible = "fixed-clock";
+ 		clock-frequency = <13000000>;
diff --git a/package/boot/uboot-mediatek/patches/100-00-clk-remove-log_ret-from-clk_get_rate.patch b/package/boot/uboot-mediatek/patches/100-00-clk-remove-log_ret-from-clk_get_rate.patch
index 30dcffd59e88ab..d5f6f7376224f1 100644
--- a/package/boot/uboot-mediatek/patches/100-00-clk-remove-log_ret-from-clk_get_rate.patch
+++ b/package/boot/uboot-mediatek/patches/100-00-clk-remove-log_ret-from-clk_get_rate.patch
@@ -20,7 +20,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 
 --- a/drivers/clk/clk-uclass.c
 +++ b/drivers/clk/clk-uclass.c
-@@ -469,7 +469,6 @@ void clk_free(struct clk *clk)
+@@ -471,7 +471,6 @@ void clk_free(struct clk *clk)
  ulong clk_get_rate(struct clk *clk)
  {
  	const struct clk_ops *ops;
@@ -28,7 +28,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  
  	debug("%s(clk=%p)\n", __func__, clk);
  	if (!clk_valid(clk))
-@@ -479,11 +478,7 @@ ulong clk_get_rate(struct clk *clk)
+@@ -481,11 +480,7 @@ ulong clk_get_rate(struct clk *clk)
  	if (!ops->get_rate)
  		return -ENOSYS;
  
diff --git a/package/boot/uboot-mediatek/patches/100-02-drivers-mtd-add-support-for-MediaTek-SPI-NAND-flash-.patch b/package/boot/uboot-mediatek/patches/100-02-drivers-mtd-add-support-for-MediaTek-SPI-NAND-flash-.patch
index e2316c62c42d42..a6c59d1f6664bb 100644
--- a/package/boot/uboot-mediatek/patches/100-02-drivers-mtd-add-support-for-MediaTek-SPI-NAND-flash-.patch
+++ b/package/boot/uboot-mediatek/patches/100-02-drivers-mtd-add-support-for-MediaTek-SPI-NAND-flash-.patch
@@ -38,7 +38,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 
 --- a/drivers/mtd/Kconfig
 +++ b/drivers/mtd/Kconfig
-@@ -158,6 +158,8 @@ config SYS_MAX_FLASH_BANKS_DETECT
+@@ -238,6 +238,8 @@ config SYS_MAX_FLASH_BANKS_DETECT
  	 to reduce the effective number of flash bank, between 0 and
  	 CONFIG_SYS_MAX_FLASH_BANKS
  
@@ -46,10 +46,10 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +
  source "drivers/mtd/nand/Kconfig"
  
- config SYS_NAND_MAX_CHIPS
+ config SYS_NAND_MAX_OOBFREE
 --- a/drivers/mtd/Makefile
 +++ b/drivers/mtd/Makefile
-@@ -39,3 +39,5 @@ obj-$(CONFIG_$(SPL_TPL_)SPI_FLASH_SUPPOR
+@@ -38,3 +38,5 @@ obj-$(CONFIG_$(SPL_TPL_)SPI_FLASH_SUPPOR
  obj-$(CONFIG_SPL_UBI) += ubispl/
  
  endif
@@ -1337,7 +1337,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +	instr->state = MTD_ERASING;
 +
 +	while (start_addr < end_addr) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		if (mtk_snand_block_isbad(msm->snf, start_addr)) {
 +			if (!instr->scrub) {
@@ -1390,7 +1390,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +	ops->retlen = 0;
 +
 +	while (len || ooblen) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		if (ops->mode == MTD_OPS_AUTO_OOB)
 +			ret = mtk_snand_read_page_auto_oob(msm->snf, addr,
@@ -1518,7 +1518,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +	ops->retlen = 0;
 +
 +	while (len || ooblen) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		if (len) {
 +			/* Move data */
diff --git a/package/boot/uboot-mediatek/patches/100-03-mtd-mtk-snand-add-support-for-SPL.patch b/package/boot/uboot-mediatek/patches/100-03-mtd-mtk-snand-add-support-for-SPL.patch
index ac56638ff74f37..3d7c4a9bf60a6a 100644
--- a/package/boot/uboot-mediatek/patches/100-03-mtd-mtk-snand-add-support-for-SPL.patch
+++ b/package/boot/uboot-mediatek/patches/100-03-mtd-mtk-snand-add-support-for-SPL.patch
@@ -74,7 +74,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +		return -ENODEV;
 +
 +	while (sizeremain) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		leading = off & writesize_mask;
 +		chunksize = cinfo.pagesize - leading;
diff --git a/package/boot/uboot-mediatek/patches/100-04-env-add-support-for-generic-MTD-device.patch b/package/boot/uboot-mediatek/patches/100-04-env-add-support-for-generic-MTD-device.patch
index 9d6beb3ebfbe48..da87978aef31bb 100644
--- a/package/boot/uboot-mediatek/patches/100-04-env-add-support-for-generic-MTD-device.patch
+++ b/package/boot/uboot-mediatek/patches/100-04-env-add-support-for-generic-MTD-device.patch
@@ -27,7 +27,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  	defined(CONFIG_ENV_IS_IN_NAND)		|| \
  	defined(CONFIG_ENV_IS_IN_NVRAM)		|| \
  	defined(CONFIG_ENV_IS_IN_ONENAND)	|| \
-@@ -62,7 +63,7 @@ DECLARE_GLOBAL_DATA_PTR;
+@@ -61,7 +62,7 @@ DECLARE_GLOBAL_DATA_PTR;
  
  #if	!defined(ENV_IS_IN_DEVICE)		&& \
  	!defined(CONFIG_ENV_IS_NOWHERE)
@@ -38,7 +38,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  
 --- a/env/Kconfig
 +++ b/env/Kconfig
-@@ -37,7 +37,7 @@ config ENV_IS_NOWHERE
+@@ -62,7 +62,7 @@ config ENV_IS_NOWHERE
  		     !ENV_IS_IN_MMC && !ENV_IS_IN_NAND && \
  		     !ENV_IS_IN_NVRAM && !ENV_IS_IN_ONENAND && \
  		     !ENV_IS_IN_REMOTE && !ENV_IS_IN_SPI_FLASH && \
@@ -47,9 +47,9 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  	help
  	  Define this if you don't want to or can't have an environment stored
  	  on a storage medium. In this case the environment will still exist
-@@ -226,6 +226,27 @@ config ENV_IS_IN_MMC
- 	  This value is also in units of bytes, but must also be aligned to
- 	  an MMC sector boundary.
+@@ -251,6 +251,27 @@ config ENV_IS_IN_MMC
+ 	  offset: "u-boot,mmc-env-offset", "u-boot,mmc-env-offset-redundant".
+ 	  CONFIG_ENV_OFFSET and CONFIG_ENV_OFFSET_REDUND are not used.
  
 +config ENV_IS_IN_MTD
 +	bool "Environment in a MTD device"
@@ -75,7 +75,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  config ENV_IS_IN_NAND
  	bool "Environment in a NAND device"
  	depends on !CHAIN_OF_TRUST
-@@ -531,10 +552,16 @@ config ENV_ADDR_REDUND
+@@ -558,10 +579,16 @@ config ENV_ADDR_REDUND
  	  Offset from the start of the device (or partition) of the redundant
  	  environment location.
  
@@ -93,7 +93,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  	default 0x3f8000 if ARCH_ROCKCHIP && ENV_IS_IN_MMC
  	default 0x140000 if ARCH_ROCKCHIP && ENV_IS_IN_SPI_FLASH
  	default 0xF0000 if ARCH_SUNXI
-@@ -581,6 +608,12 @@ config ENV_SECT_SIZE
+@@ -609,6 +636,12 @@ config ENV_SECT_SIZE
  	help
  	  Size of the sector containing the environment.
  
@@ -108,7 +108,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  	depends on ENV_IS_IN_UBI
 --- a/env/Makefile
 +++ b/env/Makefile
-@@ -26,6 +26,7 @@ obj-$(CONFIG_$(SPL_TPL_)ENV_IS_NOWHERE)
+@@ -24,6 +24,7 @@ obj-$(CONFIG_$(SPL_TPL_)ENV_IS_NOWHERE)
  obj-$(CONFIG_$(SPL_TPL_)ENV_IS_IN_MMC) += mmc.o
  obj-$(CONFIG_$(SPL_TPL_)ENV_IS_IN_FAT) += fat.o
  obj-$(CONFIG_$(SPL_TPL_)ENV_IS_IN_EXT4) += ext4.o
@@ -389,7 +389,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +};
 --- a/include/env_internal.h
 +++ b/include/env_internal.h
-@@ -130,6 +130,7 @@ enum env_location {
+@@ -109,6 +109,7 @@ enum env_location {
  	ENVL_FAT,
  	ENVL_FLASH,
  	ENVL_MMC,
@@ -399,7 +399,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  	ENVL_ONENAND,
 --- a/tools/Makefile
 +++ b/tools/Makefile
-@@ -41,6 +41,7 @@ ENVCRC-$(CONFIG_ENV_IS_EMBEDDED) = y
+@@ -37,6 +37,7 @@ subdir-$(HOST_TOOLS_ALL) += gdb
  ENVCRC-$(CONFIG_ENV_IS_IN_EEPROM) = y
  ENVCRC-$(CONFIG_ENV_IS_IN_FLASH) = y
  ENVCRC-$(CONFIG_ENV_IS_IN_ONENAND) = y
diff --git a/package/boot/uboot-mediatek/patches/100-05-mtd-add-a-new-mtd-device-type-for-NMBM.patch b/package/boot/uboot-mediatek/patches/100-05-mtd-add-a-new-mtd-device-type-for-NMBM.patch
index 1c62130cf62616..d90ca6470413de 100644
--- a/package/boot/uboot-mediatek/patches/100-05-mtd-add-a-new-mtd-device-type-for-NMBM.patch
+++ b/package/boot/uboot-mediatek/patches/100-05-mtd-add-a-new-mtd-device-type-for-NMBM.patch
@@ -15,7 +15,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 
 --- a/cmd/mtdparts.c
 +++ b/cmd/mtdparts.c
-@@ -1060,6 +1060,9 @@ int mtd_id_parse(const char *id, const c
+@@ -1057,6 +1057,9 @@ int mtd_id_parse(const char *id, const c
  	} else if (strncmp(p, "spi-nand", 8) == 0) {
  		*dev_type = MTD_DEV_TYPE_SPINAND;
  		p += 8;
diff --git a/package/boot/uboot-mediatek/patches/100-06-mtd-add-core-facility-code-of-NMBM.patch b/package/boot/uboot-mediatek/patches/100-06-mtd-add-core-facility-code-of-NMBM.patch
index 9f80deb137c93e..bf04f5b6e49a74 100644
--- a/package/boot/uboot-mediatek/patches/100-06-mtd-add-core-facility-code-of-NMBM.patch
+++ b/package/boot/uboot-mediatek/patches/100-06-mtd-add-core-facility-code-of-NMBM.patch
@@ -31,7 +31,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 
 --- a/drivers/mtd/Kconfig
 +++ b/drivers/mtd/Kconfig
-@@ -174,4 +174,6 @@ source "drivers/mtd/spi/Kconfig"
+@@ -272,4 +272,6 @@ source "drivers/mtd/spi/Kconfig"
  
  source "drivers/mtd/ubi/Kconfig"
  
@@ -40,7 +40,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  endmenu
 --- a/drivers/mtd/Makefile
 +++ b/drivers/mtd/Makefile
-@@ -41,3 +41,4 @@ obj-$(CONFIG_SPL_UBI) += ubispl/
+@@ -40,3 +40,4 @@ obj-$(CONFIG_SPL_UBI) += ubispl/
  endif
  
  obj-$(CONFIG_MTK_SPI_NAND) += mtk-snand/
@@ -750,7 +750,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +	addr = ba2addr(ni, ba);
 +
 +	for (off = 0; off < ni->lower.erasesize; off += ni->lower.writesize) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		ret = nmbm_read_phys_page(ni, addr + off, ni->page_cache, NULL,
 +					  NMBM_MODE_PLACE_OOB);
@@ -789,7 +789,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +	bool success;
 +
 +	while (ba < limit) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		if (nmbm_get_block_state(ni, ba) != BLOCK_ST_GOOD)
 +			goto next_block;
@@ -840,7 +840,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +	addr = ba2addr(ni, ba);
 +
 +	for (off = 0; off < ni->lower.erasesize; off += ni->lower.writesize) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		/* Prepare page data. fill 0xff to unused region */
 +		memcpy(ni->page_cache, data, size);
@@ -884,7 +884,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +	bool success;
 +
 +	while (ba > limit) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		if (nmbm_get_block_state(ni, ba) != BLOCK_ST_GOOD)
 +			goto next_block;
@@ -939,7 +939,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +	int ret;
 +
 +	while (sizeremain) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		leading = off & ni->writesize_mask;
 +		chunksize = ni->lower.writesize - leading;
@@ -989,7 +989,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +	int ret;
 +
 +	while (sizeremain) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		leading = off & ni->writesize_mask;
 +		chunksize = ni->lower.writesize - leading;
@@ -1045,7 +1045,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +	bool success;
 +
 +	while (sizeremain && ba < limit) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		chunksize = sizeremain;
 +		if (chunksize > ni->lower.erasesize)
@@ -1307,7 +1307,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +
 +	/* Try to write new info table next to the existing table */
 +	while (write_ba >= ni->mapping_blocks_ba) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		success = nmbm_write_info_table(ni, write_ba,
 +						ni->mapping_blocks_top_ba,
@@ -1426,7 +1426,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +
 +	/* Try to write temporary info table into spare unmapped blocks */
 +	while (write_ba >= ni->mapping_blocks_ba) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		success = nmbm_write_info_table(ni, write_ba,
 +						ni->mapping_blocks_top_ba,
@@ -1512,7 +1512,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +
 +	/* Write new backup info table. */
 +	while (write_ba >= main_table_end_ba) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		success = nmbm_write_info_table(ni, write_ba,
 +						ni->mapping_blocks_top_ba,
@@ -1901,7 +1901,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +	int ret;
 +
 +	while (sizeremain && ba < limit) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		if (nmbm_get_block_state(ni, ba) != BLOCK_ST_GOOD)
 +			goto next_block;
@@ -1994,7 +1994,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +	bool success;
 +
 +	while (ba < limit - size2blk(ni, ni->info_table_size)) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		success = nmbm_try_load_info_table(ni, ba, table_end_ba,
 +						   write_count,
@@ -2206,7 +2206,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +		limit = block_count - ni->lower.max_reserved_blocks;
 +
 +	while (ba >= limit) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		ba--;
 +		addr = ba2addr(ni, ba);
@@ -2220,7 +2220,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +		 */
 +		for (off = 0; off < ni->lower.erasesize;
 +		     off += ni->lower.writesize) {
-+			WATCHDOG_RESET();
++			schedule();
 +
 +			ret = nmbn_read_data(ni, addr + off, &sig,
 +					     sizeof(sig));
@@ -2592,7 +2592,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +	end_ba = addr2ba(ni, addr + size - 1);
 +
 +	while (start_ba <= end_ba) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		ret = nmbm_erase_logic_block(ni, start_ba);
 +		if (ret) {
@@ -2724,7 +2724,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +	}
 +
 +	while (sizeremain) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		leading = off & ni->writesize_mask;
 +		chunksize = ni->lower.writesize - leading;
@@ -2891,7 +2891,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +	}
 +
 +	while (sizeremain) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		leading = off & ni->writesize_mask;
 +		chunksize = ni->lower.writesize - leading;
diff --git a/package/boot/uboot-mediatek/patches/100-07-mtd-nmbm-add-support-for-mtd.patch b/package/boot/uboot-mediatek/patches/100-07-mtd-nmbm-add-support-for-mtd.patch
index 644ac8f105c48e..718f00e7641c57 100644
--- a/package/boot/uboot-mediatek/patches/100-07-mtd-nmbm-add-support-for-mtd.patch
+++ b/package/boot/uboot-mediatek/patches/100-07-mtd-nmbm-add-support-for-mtd.patch
@@ -280,7 +280,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +	ops->retlen = 0;
 +
 +	while (len || ooblen) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		ret = nmbm_read_single_page(nm->ni, addr, datcache, oobcache,
 +					    mode);
@@ -413,7 +413,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +	ops->retlen = 0;
 +
 +	while (len || ooblen) {
-+		WATCHDOG_RESET();
++		schedule();
 +
 +		if (len) {
 +			/* Move data */
diff --git a/package/boot/uboot-mediatek/patches/100-08-common-board_r-add-support-to-initialize-NMBM-after-.patch b/package/boot/uboot-mediatek/patches/100-08-common-board_r-add-support-to-initialize-NMBM-after-.patch
index 3dab0536774dc7..1d8139e6726f96 100644
--- a/package/boot/uboot-mediatek/patches/100-08-common-board_r-add-support-to-initialize-NMBM-after-.patch
+++ b/package/boot/uboot-mediatek/patches/100-08-common-board_r-add-support-to-initialize-NMBM-after-.patch
@@ -13,7 +13,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 
 --- a/common/board_r.c
 +++ b/common/board_r.c
-@@ -382,6 +382,20 @@ static int initr_nand(void)
+@@ -388,6 +388,20 @@ static int initr_nand(void)
  }
  #endif
  
diff --git a/package/boot/uboot-mediatek/patches/100-09-cmd-add-nmbm-command.patch b/package/boot/uboot-mediatek/patches/100-09-cmd-add-nmbm-command.patch
index e6e155bc146c9f..6b319384d516a8 100644
--- a/package/boot/uboot-mediatek/patches/100-09-cmd-add-nmbm-command.patch
+++ b/package/boot/uboot-mediatek/patches/100-09-cmd-add-nmbm-command.patch
@@ -15,7 +15,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 
 --- a/cmd/Kconfig
 +++ b/cmd/Kconfig
-@@ -1260,6 +1260,12 @@ config CMD_NAND_TORTURE
+@@ -1352,6 +1352,12 @@ config CMD_NAND_TORTURE
  
  endif # CMD_NAND
  
@@ -30,7 +30,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  	depends on NVME
 --- a/cmd/Makefile
 +++ b/cmd/Makefile
-@@ -114,6 +114,7 @@ obj-y += legacy-mtd-utils.o
+@@ -123,6 +123,7 @@ obj-y += legacy-mtd-utils.o
  endif
  obj-$(CONFIG_CMD_MUX) += mux.o
  obj-$(CONFIG_CMD_NAND) += nand.o
@@ -205,9 +205,9 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +#endif
 +	}
 +
-+	ret = mtd_read(mtd, off, sizeof(image_header_t), &retlen,
++	ret = mtd_read(mtd, off, sizeof(struct legacy_img_hdr), &retlen,
 +		       (void *)loadaddr);
-+	if (ret || retlen != sizeof(image_header_t)) {
++	if (ret || retlen != sizeof(struct legacy_img_hdr)) {
 +		printf("Failed to read NMBM at offset 0x%08llx\n", off);
 +		return CMD_RET_FAILURE;
 +	}
@@ -215,7 +215,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +	switch (genimg_get_format((void *)loadaddr)) {
 +#if defined(CONFIG_LEGACY_IMAGE_FORMAT)
 +	case IMAGE_FORMAT_LEGACY:
-+		size = image_get_image_size((image_header_t *)loadaddr);
++		size = image_get_image_size((struct legacy_img_hdr *)loadaddr);
 +		image_name = "legacy";
 +		break;
 +#endif
diff --git a/package/boot/uboot-mediatek/patches/100-10-cmd-mtd-add-markbad-subcommand-for-NMBM-testing.patch b/package/boot/uboot-mediatek/patches/100-10-cmd-mtd-add-markbad-subcommand-for-NMBM-testing.patch
index 6e38ec4ac90ea2..6336fb33f57f8e 100644
--- a/package/boot/uboot-mediatek/patches/100-10-cmd-mtd-add-markbad-subcommand-for-NMBM-testing.patch
+++ b/package/boot/uboot-mediatek/patches/100-10-cmd-mtd-add-markbad-subcommand-for-NMBM-testing.patch
@@ -20,7 +20,7 @@ Signed-off-by: SkyLake.Huang <skylake.huang@mediatek.com>
 
 --- a/cmd/mtd.c
 +++ b/cmd/mtd.c
-@@ -492,6 +492,42 @@ out_put_mtd:
+@@ -504,6 +504,42 @@ out_put_mtd:
  	return CMD_RET_SUCCESS;
  }
  
@@ -63,7 +63,7 @@ Signed-off-by: SkyLake.Huang <skylake.huang@mediatek.com>
  #ifdef CONFIG_AUTO_COMPLETE
  static int mtd_name_complete(int argc, char *const argv[], char last_char,
  			     int maxv, char *cmdv[])
-@@ -540,6 +576,7 @@ static char mtd_help_text[] =
+@@ -552,6 +588,7 @@ static char mtd_help_text[] =
  	"\n"
  	"Specific functions:\n"
  	"mtd bad                               <name>\n"
@@ -71,7 +71,7 @@ Signed-off-by: SkyLake.Huang <skylake.huang@mediatek.com>
  	"\n"
  	"With:\n"
  	"\t<name>: NAND partition/chip name (or corresponding DM device name or OF path)\n"
-@@ -565,4 +602,6 @@ U_BOOT_CMD_WITH_SUBCMDS(mtd, "MTD utils"
+@@ -577,4 +614,6 @@ U_BOOT_CMD_WITH_SUBCMDS(mtd, "MTD utils"
  		U_BOOT_SUBCMD_MKENT_COMPLETE(erase, 4, 0, do_mtd_erase,
  					     mtd_name_complete),
  		U_BOOT_SUBCMD_MKENT_COMPLETE(bad, 2, 1, do_mtd_bad,
diff --git a/package/boot/uboot-mediatek/patches/100-11-env-add-support-for-NMBM-upper-MTD-layer.patch b/package/boot/uboot-mediatek/patches/100-11-env-add-support-for-NMBM-upper-MTD-layer.patch
index 2791332b0490a9..0b4ee32b625261 100644
--- a/package/boot/uboot-mediatek/patches/100-11-env-add-support-for-NMBM-upper-MTD-layer.patch
+++ b/package/boot/uboot-mediatek/patches/100-11-env-add-support-for-NMBM-upper-MTD-layer.patch
@@ -26,8 +26,8 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +	defined(CONFIG_ENV_IS_IN_NMBM)		|| \
  	defined(CONFIG_ENV_IS_IN_NVRAM)		|| \
  	defined(CONFIG_ENV_IS_IN_ONENAND)	|| \
- 	defined(CONFIG_ENV_IS_IN_SATA)		|| \
-@@ -64,7 +65,7 @@ DECLARE_GLOBAL_DATA_PTR;
+ 	defined(CONFIG_ENV_IS_IN_SPI_FLASH)	|| \
+@@ -63,7 +64,7 @@ DECLARE_GLOBAL_DATA_PTR;
  #if	!defined(ENV_IS_IN_DEVICE)		&& \
  	!defined(CONFIG_ENV_IS_NOWHERE)
  # error Define one of CONFIG_ENV_IS_IN_{EEPROM|FLASH|MMC|FAT|EXT4|MTD|\
@@ -38,7 +38,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  /*
 --- a/env/Kconfig
 +++ b/env/Kconfig
-@@ -37,7 +37,7 @@ config ENV_IS_NOWHERE
+@@ -62,7 +62,7 @@ config ENV_IS_NOWHERE
  		     !ENV_IS_IN_MMC && !ENV_IS_IN_NAND && \
  		     !ENV_IS_IN_NVRAM && !ENV_IS_IN_ONENAND && \
  		     !ENV_IS_IN_REMOTE && !ENV_IS_IN_SPI_FLASH && \
@@ -47,9 +47,9 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  	help
  	  Define this if you don't want to or can't have an environment stored
  	  on a storage medium. In this case the environment will still exist
-@@ -285,6 +285,21 @@ config ENV_IS_IN_NAND
- 	  Currently, CONFIG_ENV_OFFSET_REDUND is not supported when
- 	  using CONFIG_ENV_OFFSET_OOB.
+@@ -312,6 +312,21 @@ config ENV_RANGE
+ 	  Specifying a range with more erase blocks than are needed to hold
+ 	  CONFIG_ENV_SIZE allows bad blocks within the range to be avoided.
  
 +config ENV_IS_IN_NMBM
 +	bool "Environment in a NMBM upper MTD layer"
@@ -69,7 +69,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  config ENV_IS_IN_NVRAM
  	bool "Environment in a non-volatile RAM"
  	depends on !CHAIN_OF_TRUST
-@@ -561,7 +576,7 @@ config ENV_MTD_NAME
+@@ -588,7 +603,7 @@ config ENV_MTD_NAME
  config ENV_OFFSET
  	hex "Environment offset"
  	depends on ENV_IS_IN_EEPROM || ENV_IS_IN_MMC || ENV_IS_IN_NAND || \
@@ -80,7 +80,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  	default 0xF0000 if ARCH_SUNXI
 --- a/env/Makefile
 +++ b/env/Makefile
-@@ -28,6 +28,7 @@ obj-$(CONFIG_$(SPL_TPL_)ENV_IS_IN_FAT) +
+@@ -26,6 +26,7 @@ obj-$(CONFIG_$(SPL_TPL_)ENV_IS_IN_FAT) +
  obj-$(CONFIG_$(SPL_TPL_)ENV_IS_IN_EXT4) += ext4.o
  obj-$(CONFIG_$(SPL_TPL_)ENV_IS_IN_MTD) += mtd.o
  obj-$(CONFIG_$(SPL_TPL_)ENV_IS_IN_NAND) += nand.o
@@ -260,7 +260,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +};
 --- a/include/env_internal.h
 +++ b/include/env_internal.h
-@@ -132,6 +132,7 @@ enum env_location {
+@@ -111,6 +111,7 @@ enum env_location {
  	ENVL_MMC,
  	ENVL_MTD,
  	ENVL_NAND,
@@ -270,11 +270,11 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  	ENVL_REMOTE,
 --- a/tools/Makefile
 +++ b/tools/Makefile
-@@ -43,6 +43,7 @@ ENVCRC-$(CONFIG_ENV_IS_IN_FLASH) = y
+@@ -39,6 +39,7 @@ ENVCRC-$(CONFIG_ENV_IS_IN_FLASH) = y
  ENVCRC-$(CONFIG_ENV_IS_IN_ONENAND) = y
  ENVCRC-$(CONFIG_ENV_IS_IN_MTD) = y
  ENVCRC-$(CONFIG_ENV_IS_IN_NAND) = y
 +ENVCRC-$(CONFIG_ENV_IS_IN_NMBM) = y
  ENVCRC-$(CONFIG_ENV_IS_IN_NVRAM) = y
  ENVCRC-$(CONFIG_ENV_IS_IN_SPI_FLASH) = y
- CONFIG_BUILD_ENVCRC ?= $(ENVCRC-y)
+ BUILD_ENVCRC ?= $(ENVCRC-y)
diff --git a/package/boot/uboot-mediatek/patches/100-13-cmd-add-a-new-command-for-NAND-flash-debugging.patch b/package/boot/uboot-mediatek/patches/100-13-cmd-add-a-new-command-for-NAND-flash-debugging.patch
index bf4ed97f13ddb5..31f26be053647f 100644
--- a/package/boot/uboot-mediatek/patches/100-13-cmd-add-a-new-command-for-NAND-flash-debugging.patch
+++ b/package/boot/uboot-mediatek/patches/100-13-cmd-add-a-new-command-for-NAND-flash-debugging.patch
@@ -26,7 +26,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 
 --- a/cmd/Kconfig
 +++ b/cmd/Kconfig
-@@ -1260,6 +1260,14 @@ config CMD_NAND_TORTURE
+@@ -1352,6 +1352,14 @@ config CMD_NAND_TORTURE
  
  endif # CMD_NAND
  
@@ -43,7 +43,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  	bool "nmbm"
 --- a/cmd/Makefile
 +++ b/cmd/Makefile
-@@ -114,6 +114,7 @@ obj-y += legacy-mtd-utils.o
+@@ -123,6 +123,7 @@ obj-y += legacy-mtd-utils.o
  endif
  obj-$(CONFIG_CMD_MUX) += mux.o
  obj-$(CONFIG_CMD_NAND) += nand.o
diff --git a/package/boot/uboot-mediatek/patches/100-14-mtd-spi-nor-add-support-to-read-flash-unique-ID.patch b/package/boot/uboot-mediatek/patches/100-14-mtd-spi-nor-add-support-to-read-flash-unique-ID.patch
index 6a61045955e8c1..3d79731dd14530 100644
--- a/package/boot/uboot-mediatek/patches/100-14-mtd-spi-nor-add-support-to-read-flash-unique-ID.patch
+++ b/package/boot/uboot-mediatek/patches/100-14-mtd-spi-nor-add-support-to-read-flash-unique-ID.patch
@@ -13,7 +13,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 
 --- a/drivers/mtd/spi/spi-nor-core.c
 +++ b/drivers/mtd/spi/spi-nor-core.c
-@@ -2742,6 +2742,100 @@ static int spi_nor_init_params(struct sp
+@@ -2818,6 +2818,100 @@ static int spi_nor_init_params(struct sp
  	return 0;
  }
  
@@ -114,7 +114,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  static int spi_nor_hwcaps2cmd(u32 hwcaps, const int table[][2], size_t size)
  {
  	size_t i;
-@@ -3719,6 +3813,7 @@ int spi_nor_scan(struct spi_nor *nor)
+@@ -3930,6 +4024,7 @@ int spi_nor_scan(struct spi_nor *nor)
  	nor->write = spi_nor_write_data;
  	nor->read_reg = spi_nor_read_reg;
  	nor->write_reg = spi_nor_write_reg;
@@ -124,7 +124,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  
 --- a/include/linux/mtd/spi-nor.h
 +++ b/include/linux/mtd/spi-nor.h
-@@ -28,6 +28,7 @@
+@@ -29,6 +29,7 @@
  #define SNOR_MFR_SPANSION	CFI_MFR_AMD
  #define SNOR_MFR_SST		CFI_MFR_SST
  #define SNOR_MFR_WINBOND	0xef /* Also used by some Spansion */
@@ -132,7 +132,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  #define SNOR_MFR_CYPRESS	0x34
  
  /*
-@@ -547,6 +548,7 @@ struct spi_nor {
+@@ -571,6 +572,7 @@ struct spi_nor {
  	void (*unprepare)(struct spi_nor *nor, enum spi_nor_ops ops);
  	int (*read_reg)(struct spi_nor *nor, u8 opcode, u8 *buf, int len);
  	int (*write_reg)(struct spi_nor *nor, u8 opcode, u8 *buf, int len);
diff --git a/package/boot/uboot-mediatek/patches/100-15-cmd-sf-add-support-to-read-flash-unique-ID.patch b/package/boot/uboot-mediatek/patches/100-15-cmd-sf-add-support-to-read-flash-unique-ID.patch
index 972a022d4ba2d4..ce59cc73aef051 100644
--- a/package/boot/uboot-mediatek/patches/100-15-cmd-sf-add-support-to-read-flash-unique-ID.patch
+++ b/package/boot/uboot-mediatek/patches/100-15-cmd-sf-add-support-to-read-flash-unique-ID.patch
@@ -12,7 +12,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 
 --- a/cmd/sf.c
 +++ b/cmd/sf.c
-@@ -391,6 +391,14 @@ static int do_spi_protect(int argc, char
+@@ -407,6 +407,14 @@ static int do_spi_protect(int argc, char
  	return ret == 0 ? 0 : 1;
  }
  
@@ -27,7 +27,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  enum {
  	STAGE_ERASE,
  	STAGE_CHECK,
-@@ -587,6 +595,8 @@ static int do_spi_flash(struct cmd_tbl *
+@@ -601,6 +609,8 @@ static int do_spi_flash(struct cmd_tbl *
  		ret = do_spi_flash_erase(argc, argv);
  	else if (strcmp(cmd, "protect") == 0)
  		ret = do_spi_protect(argc, argv);
@@ -36,7 +36,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  	else if (IS_ENABLED(CONFIG_CMD_SF_TEST) && !strcmp(cmd, "test"))
  		ret = do_spi_flash_test(argc, argv);
  	else
-@@ -617,7 +627,8 @@ static const char long_help[] =
+@@ -626,7 +636,8 @@ static const char long_help[] =
  	"					  at `addr' to flash at `offset'\n"
  	"					  or to start of mtd `partition'\n"
  	"sf protect lock/unlock sector len	- protect/unprotect 'len' bytes starting\n"
diff --git a/package/boot/uboot-mediatek/patches/100-16-cmd-bootmenu-add-ability-to-select-item-by-shortkey.patch b/package/boot/uboot-mediatek/patches/100-16-cmd-bootmenu-add-ability-to-select-item-by-shortkey.patch
index ee45ff0de63c1f..6a9ac54dfd8604 100644
--- a/package/boot/uboot-mediatek/patches/100-16-cmd-bootmenu-add-ability-to-select-item-by-shortkey.patch
+++ b/package/boot/uboot-mediatek/patches/100-16-cmd-bootmenu-add-ability-to-select-item-by-shortkey.patch
@@ -14,40 +14,41 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 
 --- a/cmd/bootmenu.c
 +++ b/cmd/bootmenu.c
-@@ -87,16 +87,17 @@ static char *bootmenu_choice_entry(void
+@@ -89,6 +89,7 @@ static char *bootmenu_choice_entry(void
  	struct bootmenu_data *menu = data;
  	struct bootmenu_entry *iter;
- 	enum bootmenu_key key = KEY_NONE;
+ 	enum bootmenu_key key = BKEY_NONE;
 +	int choice = -1;
- 	int esc = 0;
  	int i;
  
+ 	cli_ch_init(cch);
+@@ -96,10 +97,10 @@ static char *bootmenu_choice_entry(void
  	while (1) {
  		if (menu->delay >= 0) {
  			/* Autoboot was not stopped */
--			bootmenu_autoboot_loop(menu, &key, &esc);
-+			bootmenu_autoboot_loop(menu, &key, &esc, &choice);
+-			key = bootmenu_autoboot_loop(menu, cch);
++			key = bootmenu_autoboot_loop(menu, cch, &choice);
  		} else {
  			/* Some key was pressed, so autoboot was stopped */
--			bootmenu_loop(menu, &key, &esc);
-+			bootmenu_loop(menu, &key, &esc, &choice);
+-			key = bootmenu_loop(menu, cch);
++			key = bootmenu_loop(menu, cch, &choice);
  		}
  
  		switch (key) {
-@@ -110,6 +111,12 @@ static char *bootmenu_choice_entry(void
+@@ -113,6 +114,12 @@ static char *bootmenu_choice_entry(void
  				++menu->active;
  			/* no menu key selected, regenerate menu */
  			return NULL;
-+		case KEY_CHOICE:
++		case BKEY_CHOICE:
 +			menu->active = choice;
 +			if (!menu->last_choiced) {
 +				menu->last_choiced = true;
 +				return NULL;
 +			}
- 		case KEY_SELECT:
+ 		case BKEY_SELECT:
  			iter = menu->first;
  			for (i = 0; i < menu->active; ++i)
-@@ -167,6 +174,9 @@ static int prepare_bootmenu_entry(struct
+@@ -170,6 +177,9 @@ static int prepare_bootmenu_entry(struct
  	unsigned short int i = *index;
  	struct bootmenu_entry *entry = NULL;
  	struct bootmenu_entry *iter = *current;
@@ -57,7 +58,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  
  	while ((option = bootmenu_getoption(i))) {
  
-@@ -181,11 +191,24 @@ static int prepare_bootmenu_entry(struct
+@@ -184,11 +194,24 @@ static int prepare_bootmenu_entry(struct
  		if (!entry)
  			return -ENOMEM;
  
@@ -83,7 +84,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  
  		entry->command = strdup(sep + 1);
  		if (!entry->command) {
-@@ -331,6 +354,7 @@ static struct bootmenu_data *bootmenu_cr
+@@ -334,6 +357,7 @@ static struct bootmenu_data *bootmenu_cr
  	menu->delay = delay;
  	menu->active = 0;
  	menu->first = NULL;
@@ -91,7 +92,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  
  	default_str = env_get("bootmenu_default");
  	if (default_str)
-@@ -356,9 +380,9 @@ static struct bootmenu_data *bootmenu_cr
+@@ -369,9 +393,9 @@ static struct bootmenu_data *bootmenu_cr
  
  		/* Add Quit entry if entering U-Boot console is disabled */
  		if (!IS_ENABLED(CONFIG_BOOTMENU_DISABLE_UBOOT_CONSOLE))
@@ -105,7 +106,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  			free(entry);
 --- a/common/menu.c
 +++ b/common/menu.c
-@@ -47,6 +47,33 @@ struct menu {
+@@ -49,6 +49,33 @@ struct menu {
  	int item_cnt;
  };
  
@@ -139,84 +140,105 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  /*
   * An iterator function for menu items. callback will be called for each item
   * in m, with m, a pointer to the item, and extra being passed to callback. If
-@@ -426,7 +453,7 @@ int menu_destroy(struct menu *m)
+@@ -428,7 +455,7 @@ int menu_destroy(struct menu *m)
  }
  
- void bootmenu_autoboot_loop(struct bootmenu_data *menu,
--			    enum bootmenu_key *key, int *esc)
-+			    enum bootmenu_key *key, int *esc, int *choice)
+ enum bootmenu_key bootmenu_autoboot_loop(struct bootmenu_data *menu,
+-					 struct cli_ch_state *cch)
++					 struct cli_ch_state *cch, int *choice)
  {
+ 	enum bootmenu_key key = BKEY_NONE;
  	int i, c;
- 
-@@ -456,6 +483,19 @@ void bootmenu_autoboot_loop(struct bootm
+@@ -463,6 +490,19 @@ enum bootmenu_key bootmenu_autoboot_loop
  				break;
  			default:
- 				*key = KEY_NONE;
-+				if (*esc)
+ 				key = BKEY_NONE;
++				if (cch->esc_len || !choice)
 +					break;
 +
 +				*choice = find_choice(c);
 +				if ((*choice >= 0 &&
 +				     *choice < menu->count - 1)) {
-+					*key = KEY_CHOICE;
++					key = BKEY_CHOICE;
 +				} else if (c == '0') {
 +					*choice = menu->count - 1;
-+					*key = KEY_CHOICE;
++					key = BKEY_CHOICE;
 +				} else {
-+					*key = KEY_NONE;
++					key = BKEY_NONE;
 +				}
  				break;
  			}
+ 			break;
+@@ -483,7 +523,8 @@ enum bootmenu_key bootmenu_autoboot_loop
+ 	return key;
+ }
  
-@@ -475,10 +515,16 @@ void bootmenu_autoboot_loop(struct bootm
+-enum bootmenu_key bootmenu_conv_key(int ichar)
++enum bootmenu_key bootmenu_conv_key(struct bootmenu_data *menu, int ichar,
++				    int *choice)
+ {
+ 	enum bootmenu_key key;
+ 
+@@ -515,6 +556,20 @@ enum bootmenu_key bootmenu_conv_key(int
+ 	case ' ':
+ 		key = BKEY_SPACE;
+ 		break;
++	case '0' ... '9':
++	case 'a' ... 'z':
++		if (choice && menu) {
++			*choice = find_choice(ichar);
++			if ((*choice >= 0 && *choice < menu->count - 1)) {
++				key = BKEY_CHOICE;
++				break;
++			} else if (ichar == '0') {
++				*choice = menu->count - 1;
++				key = BKEY_CHOICE;
++				break;
++			}
++		}
++		fallthrough;
+ 	default:
+ 		key = BKEY_NONE;
+ 		break;
+@@ -524,11 +579,16 @@ enum bootmenu_key bootmenu_conv_key(int
  }
  
- void bootmenu_loop(struct bootmenu_data *menu,
--		   enum bootmenu_key *key, int *esc)
-+		   enum bootmenu_key *key, int *esc, int *choice)
+ enum bootmenu_key bootmenu_loop(struct bootmenu_data *menu,
+-				struct cli_ch_state *cch)
++				struct cli_ch_state *cch, int *choice)
  {
+ 	enum bootmenu_key key;
  	int c;
  
 +	if (menu->last_choiced) {
 +		menu->last_choiced = false;
-+		*key = KEY_SELECT;
-+		return;
++		return BKEY_SELECT;
 +	}
 +
- 	if (*esc == 1) {
- 		if (tstc()) {
- 			c = getchar();
-@@ -504,6 +550,14 @@ void bootmenu_loop(struct bootmenu_data
- 		if (c == '\e') {
- 			*esc = 1;
- 			*key = KEY_NONE;
-+		} else {
-+			*choice = find_choice(c);
-+			if ((*choice >= 0 && *choice < menu->count - 1)) {
-+				*key = KEY_CHOICE;
-+			} else if (c == '0') {
-+				*choice = menu->count - 1;
-+				*key = KEY_CHOICE;
-+			}
+ 	c = cli_ch_process(cch, 0);
+ 	if (!c) {
+ 		while (!c && !tstc()) {
+@@ -542,7 +602,7 @@ enum bootmenu_key bootmenu_loop(struct b
  		}
- 		break;
- 	case 1:
+ 	}
+ 
+-	key = bootmenu_conv_key(c);
++	key = bootmenu_conv_key(menu, c, choice);
+ 
+ 	return key;
+ }
 --- a/include/menu.h
 +++ b/include/menu.h
-@@ -2,10 +2,11 @@
- /*
-  * Copyright 2010-2011 Calxeda, Inc.
-  */
--
+@@ -6,6 +6,8 @@
  #ifndef __MENU_H__
  #define __MENU_H__
  
 +#include <linux/ctype.h>
 +
+ struct cli_ch_state;
  struct menu;
  
- struct menu *menu_create(char *title, int timeout, int prompt,
-@@ -18,6 +19,8 @@ int menu_get_choice(struct menu *m, void
+@@ -19,6 +21,8 @@ int menu_get_choice(struct menu *m, void
  int menu_item_add(struct menu *m, char *item_key, void *item_data);
  int menu_destroy(struct menu *m);
  int menu_default_choice(struct menu *m, void **choice);
@@ -225,26 +247,66 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  
  /**
   * menu_show() Show a boot menu
-@@ -40,6 +43,7 @@ struct bootmenu_data {
+@@ -41,6 +45,7 @@ struct bootmenu_data {
  	int active;			/* active menu entry */
  	int count;			/* total count of menu entries */
  	struct bootmenu_entry *first;	/* first menu entry */
 +	bool last_choiced;
  };
  
- enum bootmenu_key {
-@@ -48,11 +52,11 @@ enum bootmenu_key {
- 	KEY_DOWN,
- 	KEY_SELECT,
- 	KEY_QUIT,
-+	KEY_CHOICE,
+ /** enum bootmenu_key - keys that can be returned by the bootmenu */
+@@ -54,6 +59,7 @@ enum bootmenu_key {
+ 	BKEY_MINUS,
+ 	BKEY_SPACE,
+ 	BKEY_SAVE,
++	BKEY_CHOICE,
+ 
+ 	BKEY_COUNT,
  };
+@@ -76,7 +82,7 @@ enum bootmenu_key {
+  *	anything else: KEY_NONE
+  */
+ enum bootmenu_key bootmenu_autoboot_loop(struct bootmenu_data *menu,
+-					 struct cli_ch_state *cch);
++					 struct cli_ch_state *cch, int *choice);
+ 
+ /**
+  * bootmenu_loop() - handle waiting for a keypress when autoboot is disabled
+@@ -102,7 +108,7 @@ enum bootmenu_key bootmenu_autoboot_loop
+  *	Space: BKEY_SPACE
+  */
+ enum bootmenu_key bootmenu_loop(struct bootmenu_data *menu,
+-				struct cli_ch_state *cch);
++				struct cli_ch_state *cch, int *choice);
+ 
+ /**
+  * bootmenu_conv_key() - Convert a U-Boot keypress into a menu key
+@@ -110,6 +116,7 @@ enum bootmenu_key bootmenu_loop(struct b
+  * @ichar: Keypress to convert (ASCII, including control characters)
+  * Returns: Menu key that corresponds to @ichar, or BKEY_NONE if none
+  */
+-enum bootmenu_key bootmenu_conv_key(int ichar);
++enum bootmenu_key bootmenu_conv_key(struct bootmenu_data *menu, int ichar,
++				    int *choice);
  
- void bootmenu_autoboot_loop(struct bootmenu_data *menu,
--			    enum bootmenu_key *key, int *esc);
-+			    enum bootmenu_key *key, int *esc, int *choice);
- void bootmenu_loop(struct bootmenu_data *menu,
--		   enum bootmenu_key *key, int *esc);
--
-+		   enum bootmenu_key *key, int *esc, int *choice);
  #endif /* __MENU_H__ */
+--- a/cmd/eficonfig.c
++++ b/cmd/eficonfig.c
+@@ -239,7 +239,7 @@ char *eficonfig_choice_entry(void *data)
+ 	cli_ch_init(cch);
+ 
+ 	while (1) {
+-		key = bootmenu_loop((struct bootmenu_data *)efi_menu, cch);
++		key = bootmenu_loop((struct bootmenu_data *)efi_menu, cch, NULL);
+ 
+ 		switch (key) {
+ 		case BKEY_UP:
+@@ -1937,7 +1937,7 @@ char *eficonfig_choice_change_boot_order
+ 
+ 	cli_ch_init(cch);
+ 	while (1) {
+-		key = bootmenu_loop(NULL, cch);
++		key = bootmenu_loop(NULL, cch, NULL);
+ 
+ 		switch (key) {
+ 		case BKEY_PLUS:
diff --git a/package/boot/uboot-mediatek/patches/100-18-board-mt7629-add-support-for-booting-from-SPI-NAND.patch b/package/boot/uboot-mediatek/patches/100-18-board-mt7629-add-support-for-booting-from-SPI-NAND.patch
index 571b883fb99a42..797d925e173095 100644
--- a/package/boot/uboot-mediatek/patches/100-18-board-mt7629-add-support-for-booting-from-SPI-NAND.patch
+++ b/package/boot/uboot-mediatek/patches/100-18-board-mt7629-add-support-for-booting-from-SPI-NAND.patch
@@ -163,7 +163,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +CONFIG_SYS_ARCH_TIMER=y
 +CONFIG_SYS_THUMB_BUILD=y
 +CONFIG_ARCH_MEDIATEK=y
-+CONFIG_SYS_TEXT_BASE=0x41e00000
++CONFIG_TEXT_BASE=0x41e00000
 +CONFIG_SYS_MALLOC_F_LEN=0x4000
 +CONFIG_NR_DRAM_BANKS=1
 +CONFIG_ENV_SIZE=0x20000
diff --git a/package/boot/uboot-mediatek/patches/100-19-board-mt7622-use-new-spi-nand-driver.patch b/package/boot/uboot-mediatek/patches/100-19-board-mt7622-use-new-spi-nand-driver.patch
index 6e90f47f35cd65..03555d4a4b77e9 100644
--- a/package/boot/uboot-mediatek/patches/100-19-board-mt7622-use-new-spi-nand-driver.patch
+++ b/package/boot/uboot-mediatek/patches/100-19-board-mt7622-use-new-spi-nand-driver.patch
@@ -55,15 +55,15 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  		reg = <0x11014000 0x1000>;
 --- a/configs/mt7622_rfb_defconfig
 +++ b/configs/mt7622_rfb_defconfig
-@@ -18,6 +18,7 @@ CONFIG_LOG=y
- CONFIG_SYS_PROMPT="MT7622> "
+@@ -21,6 +21,7 @@ CONFIG_SYS_MAXARGS=8
+ CONFIG_SYS_PBSIZE=1049
  CONFIG_CMD_BOOTMENU=y
  CONFIG_CMD_MMC=y
 +CONFIG_CMD_MTD=y
  CONFIG_CMD_PCI=y
  CONFIG_CMD_SF_TEST=y
  CONFIG_CMD_PING=y
-@@ -33,6 +34,10 @@ CONFIG_SYSCON=y
+@@ -40,6 +41,10 @@ CONFIG_SYSCON=y
  CONFIG_CLK=y
  CONFIG_MMC_HS200_SUPPORT=y
  CONFIG_MMC_MTK=y
diff --git a/package/boot/uboot-mediatek/patches/100-20-board-mt7981-add-reference-board-using-new-spi-nand-.patch b/package/boot/uboot-mediatek/patches/100-20-board-mt7981-add-reference-board-using-new-spi-nand-.patch
index 2cd62a2c19a8f7..cf2019fcba6874 100644
--- a/package/boot/uboot-mediatek/patches/100-20-board-mt7981-add-reference-board-using-new-spi-nand-.patch
+++ b/package/boot/uboot-mediatek/patches/100-20-board-mt7981-add-reference-board-using-new-spi-nand-.patch
@@ -18,7 +18,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 
 --- a/arch/arm/dts/Makefile
 +++ b/arch/arm/dts/Makefile
-@@ -1206,6 +1206,7 @@ dtb-$(CONFIG_ARCH_MEDIATEK) += \
+@@ -1288,6 +1288,7 @@ dtb-$(CONFIG_ARCH_MEDIATEK) += \
  	mt7623n-bananapi-bpi-r2.dtb \
  	mt7629-rfb.dtb \
  	mt7981-rfb.dtb \
@@ -167,7 +167,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +CONFIG_ARM=y
 +CONFIG_POSITION_INDEPENDENT=y
 +CONFIG_ARCH_MEDIATEK=y
-+CONFIG_SYS_TEXT_BASE=0x41e00000
++CONFIG_TEXT_BASE=0x41e00000
 +CONFIG_SYS_MALLOC_F_LEN=0x4000
 +CONFIG_NR_DRAM_BANKS=1
 +CONFIG_ENV_SIZE=0x20000
diff --git a/package/boot/uboot-mediatek/patches/100-21-mtd-spi-nor-add-more-flash-ids.patch b/package/boot/uboot-mediatek/patches/100-21-mtd-spi-nor-add-more-flash-ids.patch
index 228bde1567a382..08334248218df5 100644
--- a/package/boot/uboot-mediatek/patches/100-21-mtd-spi-nor-add-more-flash-ids.patch
+++ b/package/boot/uboot-mediatek/patches/100-21-mtd-spi-nor-add-more-flash-ids.patch
@@ -13,7 +13,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 
 --- a/drivers/mtd/spi/spi-nor-core.c
 +++ b/drivers/mtd/spi/spi-nor-core.c
-@@ -641,6 +641,7 @@ static int set_4byte(struct spi_nor *nor
+@@ -672,6 +672,7 @@ static int set_4byte(struct spi_nor *nor
  	case SNOR_MFR_ISSI:
  	case SNOR_MFR_MACRONIX:
  	case SNOR_MFR_WINBOND:
@@ -33,9 +33,9 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  	{ INFO("en25s64",    0x1c3817, 0, 64 * 1024,  128, SECT_4K) },
  #endif
  #ifdef CONFIG_SPI_FLASH_GIGADEVICE	/* GIGADEVICE */
-@@ -119,6 +120,11 @@ const struct flash_info spi_nor_ids[] =
- 			SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB)
- 	},
+@@ -149,6 +150,11 @@ const struct flash_info spi_nor_ids[] =
+ 	{INFO("gd55x02g", 0xc8481C, 0, 64 * 1024, 4096,	SECT_4K |
+ 	SPI_NOR_OCTAL_READ | SPI_NOR_4B_OPCODES)},
  	{
 +		INFO("gd25q256", 0xc84019, 0, 64 * 1024, 512,
 +			SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ |
@@ -45,7 +45,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  		INFO("gd25lq128", 0xc86018, 0, 64 * 1024, 256,
  			SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ |
  			SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB)
-@@ -395,6 +401,16 @@ const struct flash_info spi_nor_ids[] =
+@@ -468,6 +474,16 @@ const struct flash_info spi_nor_ids[] =
  			SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB)
  	},
  	{
@@ -62,7 +62,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  		INFO("w25q128jw", 0xef8018, 0, 64 * 1024, 256,
  			SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ |
  			SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB)
-@@ -439,6 +455,11 @@ const struct flash_info spi_nor_ids[] =
+@@ -517,6 +533,11 @@ const struct flash_info spi_nor_ids[] =
  			SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB)
  	},
  	{ INFO("w25q256", 0xef4019, 0, 64 * 1024, 512, SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) },
diff --git a/package/boot/uboot-mediatek/patches/100-23-mmc-mtk-sd-add-support-to-display-verbose-error-log.patch b/package/boot/uboot-mediatek/patches/100-23-mmc-mtk-sd-add-support-to-display-verbose-error-log.patch
index b6a2229170796f..1709680ebbce60 100644
--- a/package/boot/uboot-mediatek/patches/100-23-mmc-mtk-sd-add-support-to-display-verbose-error-log.patch
+++ b/package/boot/uboot-mediatek/patches/100-23-mmc-mtk-sd-add-support-to-display-verbose-error-log.patch
@@ -15,7 +15,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 
 --- a/drivers/mmc/Kconfig
 +++ b/drivers/mmc/Kconfig
-@@ -789,6 +789,14 @@ config MMC_MTK
+@@ -823,6 +823,14 @@ config MMC_MTK
  	  This is needed if support for any SD/SDIO/MMC devices is required.
  	  If unsure, say N.
  
@@ -29,7 +29,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 +
  endif
  
- config FSL_ESDHC
+ config FSL_SDHC_V2_3
 --- a/drivers/mmc/Makefile
 +++ b/drivers/mmc/Makefile
 @@ -84,3 +84,7 @@ obj-$(CONFIG_RENESAS_SDHI)		+= tmio-comm
diff --git a/package/boot/uboot-mediatek/patches/100-24-cmd-ubi-make-volume-find-create-remove-APIs-public.patch b/package/boot/uboot-mediatek/patches/100-24-cmd-ubi-make-volume-find-create-remove-APIs-public.patch
index ba32fa869dffff..ed74eab1e4baca 100644
--- a/package/boot/uboot-mediatek/patches/100-24-cmd-ubi-make-volume-find-create-remove-APIs-public.patch
+++ b/package/boot/uboot-mediatek/patches/100-24-cmd-ubi-make-volume-find-create-remove-APIs-public.patch
@@ -14,7 +14,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 
 --- a/cmd/ubi.c
 +++ b/cmd/ubi.c
-@@ -148,8 +148,8 @@ bad:
+@@ -213,8 +213,8 @@ bad:
  	return err;
  }
  
@@ -25,7 +25,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  {
  	struct ubi_mkvol_req req;
  	int err;
-@@ -182,7 +182,7 @@ static int ubi_create_vol(char *volume,
+@@ -247,7 +247,7 @@ static int ubi_create_vol(char *volume,
  	return ubi_create_volume(ubi, &req);
  }
  
@@ -34,7 +34,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  {
  	struct ubi_volume *vol = NULL;
  	int i;
-@@ -197,7 +197,7 @@ static struct ubi_volume *ubi_find_volum
+@@ -262,7 +262,7 @@ static struct ubi_volume *ubi_find_volum
  	return NULL;
  }
  
@@ -45,7 +45,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  	struct ubi_volume *vol;
 --- a/include/ubi_uboot.h
 +++ b/include/ubi_uboot.h
-@@ -73,6 +73,10 @@ extern void ubi_exit(void);
+@@ -51,6 +51,10 @@ extern void ubi_exit(void);
  extern int ubi_part(char *part_name, const char *vid_header_offset);
  extern int ubi_volume_write(char *volume, void *buf, size_t size);
  extern int ubi_volume_read(char *volume, char *buf, size_t size);
diff --git a/package/boot/uboot-mediatek/patches/100-25-cmd-ubi-allow-creating-volume-with-all-free-spaces.patch b/package/boot/uboot-mediatek/patches/100-25-cmd-ubi-allow-creating-volume-with-all-free-spaces.patch
index 1d62c05e40acc3..d023b004f7653a 100644
--- a/package/boot/uboot-mediatek/patches/100-25-cmd-ubi-allow-creating-volume-with-all-free-spaces.patch
+++ b/package/boot/uboot-mediatek/patches/100-25-cmd-ubi-allow-creating-volume-with-all-free-spaces.patch
@@ -12,7 +12,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 
 --- a/cmd/ubi.c
 +++ b/cmd/ubi.c
-@@ -161,7 +161,11 @@ int ubi_create_vol(char *volume, int64_t
+@@ -226,7 +226,11 @@ int ubi_create_vol(char *volume, int64_t
  
  	req.vol_id = vol_id;
  	req.alignment = 1;
diff --git a/package/boot/uboot-mediatek/patches/100-26-env-ubi-add-support-to-create-environment-volume-if-.patch b/package/boot/uboot-mediatek/patches/100-26-env-ubi-add-support-to-create-environment-volume-if-.patch
index 08b14a6b291ad7..98c81acdcfdb60 100644
--- a/package/boot/uboot-mediatek/patches/100-26-env-ubi-add-support-to-create-environment-volume-if-.patch
+++ b/package/boot/uboot-mediatek/patches/100-26-env-ubi-add-support-to-create-environment-volume-if-.patch
@@ -14,7 +14,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
 
 --- a/env/Kconfig
 +++ b/env/Kconfig
-@@ -647,6 +647,12 @@ config ENV_UBI_VOLUME_REDUND
+@@ -675,6 +675,12 @@ config ENV_UBI_VOLUME_REDUND
  	help
  	  Name of the redundant volume that you want to store the environment in.
  
@@ -29,7 +29,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  	depends on ENV_IS_IN_UBI
 --- a/env/ubi.c
 +++ b/env/ubi.c
-@@ -100,6 +100,18 @@ static int env_ubi_save(void)
+@@ -106,6 +106,18 @@ static int env_ubi_save(void)
  #endif /* CONFIG_SYS_REDUNDAND_ENVIRONMENT */
  #endif /* CONFIG_CMD_SAVEENV */
  
@@ -48,7 +48,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  #ifdef CONFIG_SYS_REDUNDAND_ENVIRONMENT
  static int env_ubi_load(void)
  {
-@@ -129,6 +141,11 @@ static int env_ubi_load(void)
+@@ -135,6 +147,11 @@ static int env_ubi_load(void)
  		return -EIO;
  	}
  
@@ -60,7 +60,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  	read1_fail = ubi_volume_read(CONFIG_ENV_UBI_VOLUME, (void *)tmp_env1,
  				     CONFIG_ENV_SIZE);
  	if (read1_fail)
-@@ -166,6 +183,9 @@ static int env_ubi_load(void)
+@@ -172,6 +189,9 @@ static int env_ubi_load(void)
  		return -EIO;
  	}
  
diff --git a/package/boot/uboot-mediatek/patches/100-29-board-mediatek-wire-up-NMBM-support.patch b/package/boot/uboot-mediatek/patches/100-29-board-mediatek-wire-up-NMBM-support.patch
index 9808e2c860e883..b561a799444108 100644
--- a/package/boot/uboot-mediatek/patches/100-29-board-mediatek-wire-up-NMBM-support.patch
+++ b/package/boot/uboot-mediatek/patches/100-29-board-mediatek-wire-up-NMBM-support.patch
@@ -114,7 +114,7 @@ Subject: [PATCH] board: mediatek: wire-up NMBM support
 +}
 --- a/board/mediatek/mt7981/mt7981_rfb.c
 +++ b/board/mediatek/mt7981/mt7981_rfb.c
-@@ -4,7 +4,59 @@
+@@ -4,7 +4,58 @@
   * Author: Sam Shih <sam.shih@mediatek.com>
   */
  
@@ -133,9 +133,8 @@ Subject: [PATCH] board: mediatek: wire-up NMBM support
 +
  int board_init(void)
  {
-+	gd->bd->bi_boot_params = CONFIG_SYS_SDRAM_BASE + 0x100;
-+	return 0;
-+}
+ 	return 0;
+ }
 +
 +int board_late_init(void)
 +{
@@ -172,11 +171,11 @@ Subject: [PATCH] board: mediatek: wire-up NMBM support
 +	add_mtd_device(upper);
 +#endif
 +
- 	return 0;
- }
++	return 0;
++}
 --- a/board/mediatek/mt7986/mt7986_rfb.c
 +++ b/board/mediatek/mt7986/mt7986_rfb.c
-@@ -4,7 +4,61 @@
+@@ -4,7 +4,60 @@
   * Author: Sam Shih <sam.shih@mediatek.com>
   */
  
@@ -195,9 +194,8 @@ Subject: [PATCH] board: mediatek: wire-up NMBM support
 +
  int board_init(void)
  {
-+	gd->bd->bi_boot_params = CONFIG_SYS_SDRAM_BASE + 0x100;
-+	return 0;
-+}
+ 	return 0;
+ }
 +
 +int board_late_init(void)
 +{
@@ -236,5 +234,5 @@ Subject: [PATCH] board: mediatek: wire-up NMBM support
 +	add_mtd_device(upper);
 +#endif
 +
- 	return 0;
- }
++	return 0;
++}
diff --git a/package/boot/uboot-mediatek/patches/110-no-kwbimage.patch b/package/boot/uboot-mediatek/patches/110-no-kwbimage.patch
index 5fb896d92d22bb..76921b757e0d48 100644
--- a/package/boot/uboot-mediatek/patches/110-no-kwbimage.patch
+++ b/package/boot/uboot-mediatek/patches/110-no-kwbimage.patch
@@ -1,6 +1,6 @@
 --- a/tools/Makefile
 +++ b/tools/Makefile
-@@ -121,7 +121,6 @@ dumpimage-mkimage-objs := aisimage.o \
+@@ -115,7 +115,6 @@ dumpimage-mkimage-objs := aisimage.o \
  			imximage.o \
  			imx8image.o \
  			imx8mimage.o \
diff --git a/package/boot/uboot-mediatek/patches/120-use-xz-instead-of-lzma.patch b/package/boot/uboot-mediatek/patches/120-use-xz-instead-of-lzma.patch
index 7204c404c042de..7fda30a756b6d5 100644
--- a/package/boot/uboot-mediatek/patches/120-use-xz-instead-of-lzma.patch
+++ b/package/boot/uboot-mediatek/patches/120-use-xz-instead-of-lzma.patch
@@ -1,6 +1,6 @@
 --- a/Makefile
 +++ b/Makefile
-@@ -1061,7 +1061,7 @@ quiet_cmd_pad_cat = CAT     $@
+@@ -1067,7 +1067,7 @@ quiet_cmd_pad_cat = CAT     $@
  cmd_pad_cat = $(cmd_objcopy) && $(append) || { rm -f $@; false; }
  
  quiet_cmd_lzma = LZMA    $@
diff --git a/package/boot/uboot-mediatek/patches/130-fix-mkimage-host-build.patch b/package/boot/uboot-mediatek/patches/130-fix-mkimage-host-build.patch
index 8b110a880f1c09..cd65c1321fc320 100644
--- a/package/boot/uboot-mediatek/patches/130-fix-mkimage-host-build.patch
+++ b/package/boot/uboot-mediatek/patches/130-fix-mkimage-host-build.patch
@@ -1,6 +1,6 @@
 --- a/tools/image-host.c
 +++ b/tools/image-host.c
-@@ -1122,6 +1122,7 @@ static int fit_config_add_verification_d
+@@ -1125,6 +1125,7 @@ static int fit_config_add_verification_d
   * 2) get public key (X509_get_pubkey)
   * 3) provide der format (d2i_RSAPublicKey)
   */
@@ -8,7 +8,7 @@
  static int read_pub_key(const char *keydir, const void *name,
  			unsigned char **pubkey, int *pubkey_len)
  {
-@@ -1175,6 +1176,13 @@ err_cert:
+@@ -1178,6 +1179,13 @@ err_cert:
  	fclose(f);
  	return ret;
  }
diff --git a/package/boot/uboot-mediatek/patches/200-cmd-add-imsz-and-imszb.patch b/package/boot/uboot-mediatek/patches/200-cmd-add-imsz-and-imszb.patch
index cc6aa64cbc5598..7cf0778e47d88e 100644
--- a/package/boot/uboot-mediatek/patches/200-cmd-add-imsz-and-imszb.patch
+++ b/package/boot/uboot-mediatek/patches/200-cmd-add-imsz-and-imszb.patch
@@ -1,6 +1,6 @@
 --- a/cmd/bootm.c
 +++ b/cmd/bootm.c
-@@ -257,6 +257,67 @@ U_BOOT_CMD(
+@@ -259,6 +259,67 @@ U_BOOT_CMD(
  /* iminfo - print header info for a requested image */
  /*******************************************************************/
  #if defined(CONFIG_CMD_IMI)
@@ -70,7 +70,7 @@
  {
 --- a/boot/image-fit.c
 +++ b/boot/image-fit.c
-@@ -1994,6 +1994,51 @@ static const char *fit_get_image_type_pr
+@@ -2051,6 +2051,50 @@ static const char *fit_get_image_type_pr
  	return "unknown";
  }
  
@@ -118,13 +118,12 @@
 +	return max_size;
 +}
 +
-+
- int fit_image_load(bootm_headers_t *images, ulong addr,
+ int fit_image_load(struct bootm_headers *images, ulong addr,
  		   const char **fit_unamep, const char **fit_uname_configp,
- 		   int arch, int image_type, int bootstage_id,
+ 		   int arch, int ph_type, int bootstage_id,
 --- a/include/image.h
 +++ b/include/image.h
-@@ -955,6 +955,7 @@ int fit_parse_subimage(const char *spec,
+@@ -1046,6 +1046,7 @@ int fit_parse_subimage(const char *spec,
  		ulong *addr, const char **image_name);
  
  int fit_get_subimage_count(const void *fit, int images_noffset);
diff --git a/package/boot/uboot-mediatek/patches/211-cmd-bootmenu-custom-title.patch b/package/boot/uboot-mediatek/patches/211-cmd-bootmenu-custom-title.patch
index 72926ea2e7fefd..a99b77be083882 100644
--- a/package/boot/uboot-mediatek/patches/211-cmd-bootmenu-custom-title.patch
+++ b/package/boot/uboot-mediatek/patches/211-cmd-bootmenu-custom-title.patch
@@ -1,6 +1,6 @@
 --- a/cmd/bootmenu.c
 +++ b/cmd/bootmenu.c
-@@ -439,7 +439,11 @@ static void menu_display_statusline(stru
+@@ -452,7 +452,11 @@ static void menu_display_statusline(stru
  	printf(ANSI_CURSOR_POSITION, 1, 1);
  	puts(ANSI_CLEAR_LINE);
  	printf(ANSI_CURSOR_POSITION, 2, 3);
@@ -13,7 +13,7 @@
  	puts(ANSI_CLEAR_LINE_TO_END);
  	printf(ANSI_CURSOR_POSITION, 3, 1);
  	puts(ANSI_CLEAR_LINE);
-@@ -524,6 +528,7 @@ static enum bootmenu_ret bootmenu_show(i
+@@ -537,6 +541,7 @@ static enum bootmenu_ret bootmenu_show(i
  		return BOOTMENU_RET_FAIL;
  	}
  
@@ -23,7 +23,7 @@
  			goto cleanup;
 --- a/include/menu.h
 +++ b/include/menu.h
-@@ -43,6 +43,7 @@ struct bootmenu_data {
+@@ -45,6 +45,7 @@ struct bootmenu_data {
  	int active;			/* active menu entry */
  	int count;			/* total count of menu entries */
  	struct bootmenu_entry *first;	/* first menu entry */
diff --git a/package/boot/uboot-mediatek/patches/212-cmd-bootmenu-hack-restore-ansi.patch b/package/boot/uboot-mediatek/patches/212-cmd-bootmenu-hack-restore-ansi.patch
new file mode 100644
index 00000000000000..cdb1477d42321d
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/212-cmd-bootmenu-hack-restore-ansi.patch
@@ -0,0 +1,11 @@
+--- a/common/menu.c
++++ b/common/menu.c
+@@ -15,7 +15,7 @@
+ 
+ #include "menu.h"
+ 
+-#define ansi 0
++#define ansi 1
+ 
+ /*
+  * Internally, each item in a menu is represented by a struct menu_item.
diff --git a/package/boot/uboot-mediatek/patches/220-cmd-env-readmem.patch b/package/boot/uboot-mediatek/patches/220-cmd-env-readmem.patch
index 4ffbc17208f12c..37956727b26ba6 100644
--- a/package/boot/uboot-mediatek/patches/220-cmd-env-readmem.patch
+++ b/package/boot/uboot-mediatek/patches/220-cmd-env-readmem.patch
@@ -1,6 +1,6 @@
 --- a/cmd/Kconfig
 +++ b/cmd/Kconfig
-@@ -540,6 +540,12 @@ config CMD_ENV_EXISTS
+@@ -601,6 +601,12 @@ config CMD_ENV_EXISTS
  	  Check if a variable is defined in the environment for use in
  	  shell scripting.
  
@@ -15,7 +15,7 @@
  	help
 --- a/cmd/nvedit.c
 +++ b/cmd/nvedit.c
-@@ -409,6 +409,60 @@ int do_env_ask(struct cmd_tbl *cmdtp, in
+@@ -408,6 +408,60 @@ int do_env_ask(struct cmd_tbl *cmdtp, in
  }
  #endif
  
@@ -76,7 +76,7 @@
  #if defined(CONFIG_CMD_ENV_CALLBACK)
  static int print_static_binding(const char *var_name, const char *callback_name,
  				void *priv)
-@@ -1232,6 +1286,9 @@ static struct cmd_tbl cmd_env_sub[] = {
+@@ -1231,6 +1285,9 @@ static struct cmd_tbl cmd_env_sub[] = {
  	U_BOOT_CMD_MKENT(load, 1, 0, do_env_load, "", ""),
  #endif
  	U_BOOT_CMD_MKENT(print, CONFIG_SYS_MAXARGS, 1, do_env_print, "", ""),
@@ -86,7 +86,7 @@
  #if defined(CONFIG_CMD_RUN)
  	U_BOOT_CMD_MKENT(run, CONFIG_SYS_MAXARGS, 1, do_run, "", ""),
  #endif
-@@ -1323,6 +1380,9 @@ static char env_help_text[] =
+@@ -1322,6 +1379,9 @@ static char env_help_text[] =
  #if defined(CONFIG_CMD_NVEDIT_EFI)
  	"env print -e [-guid guid] [-n] [name ...] - print UEFI environment\n"
  #endif
@@ -96,7 +96,7 @@
  #if defined(CONFIG_CMD_RUN)
  	"env run var [...] - run commands in an environment variable\n"
  #endif
-@@ -1432,6 +1492,17 @@ U_BOOT_CMD(
+@@ -1431,6 +1491,17 @@ U_BOOT_CMD(
  );
  #endif
  
diff --git a/package/boot/uboot-mediatek/patches/280-image-fdt-save-name-of-FIT-configuration-in-chosen-node.patch b/package/boot/uboot-mediatek/patches/280-image-fdt-save-name-of-FIT-configuration-in-chosen-node.patch
index ff41c524221d1d..873d80f6f9dcf1 100644
--- a/package/boot/uboot-mediatek/patches/280-image-fdt-save-name-of-FIT-configuration-in-chosen-node.patch
+++ b/package/boot/uboot-mediatek/patches/280-image-fdt-save-name-of-FIT-configuration-in-chosen-node.patch
@@ -16,7 +16,7 @@ Reviewed-by: Tom Rini <trini@konsulko.com>
 
 --- a/boot/image-fdt.c
 +++ b/boot/image-fdt.c
-@@ -639,6 +639,12 @@ int image_setup_libfdt(bootm_headers_t *
+@@ -636,6 +636,12 @@ int image_setup_libfdt(struct bootm_head
  					images->fit_uname_cfg,
  					strlen(images->fit_uname_cfg) + 1, 1);
  
@@ -28,4 +28,4 @@ Reviewed-by: Tom Rini <trini@konsulko.com>
 +
  	/* Update ethernet nodes */
  	fdt_fixup_ethernet(blob);
- #if CONFIG_IS_ENABLED(CMD_PSTORE)
+ #if IS_ENABLED(CONFIG_CMD_PSTORE)
diff --git a/package/boot/uboot-mediatek/patches/300-force-pylibfdt-build.patch b/package/boot/uboot-mediatek/patches/300-force-pylibfdt-build.patch
index 89d3c824756680..d34ed6f2ae55aa 100644
--- a/package/boot/uboot-mediatek/patches/300-force-pylibfdt-build.patch
+++ b/package/boot/uboot-mediatek/patches/300-force-pylibfdt-build.patch
@@ -1,6 +1,6 @@
 --- a/Makefile
 +++ b/Makefile
-@@ -2063,26 +2063,7 @@ endif
+@@ -2000,26 +2000,7 @@ endif
  # Check dtc and pylibfdt, if DTC is provided, else build them
  PHONY += scripts_dtc
  scripts_dtc: scripts_basic
diff --git a/package/boot/uboot-mediatek/patches/301-mt7622-generic-reset-button-ignore-env.patch b/package/boot/uboot-mediatek/patches/301-mt7622-generic-reset-button-ignore-env.patch
index 63301fd5351317..1862a9344ad631 100644
--- a/package/boot/uboot-mediatek/patches/301-mt7622-generic-reset-button-ignore-env.patch
+++ b/package/boot/uboot-mediatek/patches/301-mt7622-generic-reset-button-ignore-env.patch
@@ -17,7 +17,7 @@
  
  #include <mtd.h>
  #include <linux/mtd/mtd.h>
-@@ -25,7 +32,19 @@ int board_init(void)
+@@ -25,7 +32,22 @@ int board_init(void)
  
  int board_late_init(void)
  {
@@ -27,7 +27,10 @@
 +	if (!button_get_by_label(CONFIG_RESET_BUTTON_LABEL, &dev)) {
 +		puts("reset button found\n");
 +#ifdef CONFIG_RESET_BUTTON_SETTLE_DELAY
-+		mdelay(CONFIG_RESET_BUTTON_SETTLE_DELAY);
++		if (CONFIG_RESET_BUTTON_SETTLE_DELAY > 0) {
++			button_get_state(dev);
++			mdelay(CONFIG_RESET_BUTTON_SETTLE_DELAY);
++		}
 +#endif
 +		if (button_get_state(dev) == BUTTON_ON) {
 +			puts("button pushed, resetting environment\n");
@@ -40,7 +43,7 @@
  }
 --- a/arch/arm/mach-mediatek/Kconfig
 +++ b/arch/arm/mach-mediatek/Kconfig
-@@ -140,4 +140,8 @@ config MTK_BROM_HEADER_INFO
+@@ -140,4 +140,11 @@ config MTK_BROM_HEADER_INFO
  
  source "board/mediatek/mt7629/Kconfig"
  
@@ -48,4 +51,7 @@
 +	string "Button to trigger factory reset"
 +	default "reset"
 +
++config RESET_BUTTON_SETTLE_DELAY
++	int "Delay to wait for button to settle"
++	default 0
  endif
diff --git a/package/boot/uboot-mediatek/patches/302-mt7623-generic-reset-button-ignore-env.patch b/package/boot/uboot-mediatek/patches/302-mt7623-generic-reset-button-ignore-env.patch
index e144f42c479770..928dfe8428a3de 100644
--- a/package/boot/uboot-mediatek/patches/302-mt7623-generic-reset-button-ignore-env.patch
+++ b/package/boot/uboot-mediatek/patches/302-mt7623-generic-reset-button-ignore-env.patch
@@ -18,7 +18,7 @@
  
  DECLARE_GLOBAL_DATA_PTR;
  
-@@ -41,3 +50,22 @@ int mmc_get_env_dev(void)
+@@ -41,3 +50,25 @@ int mmc_get_env_dev(void)
  	return mmc_get_boot_dev();
  }
  #endif
@@ -30,7 +30,10 @@
 +	if (!button_get_by_label(CONFIG_RESET_BUTTON_LABEL, &dev)) {
 +		puts("reset button found\n");
 +#ifdef CONFIG_RESET_BUTTON_SETTLE_DELAY
-+		mdelay(CONFIG_RESET_BUTTON_SETTLE_DELAY);
++		if (CONFIG_RESET_BUTTON_SETTLE_DELAY > 0) {
++			button_get_state(dev);
++			mdelay(CONFIG_RESET_BUTTON_SETTLE_DELAY);
++		}
 +#endif
 +		if (button_get_state(dev) == BUTTON_ON) {
 +			puts("button pushed, resetting environment\n");
diff --git a/package/boot/uboot-mediatek/patches/303-mt7986-generic-reset-button-ignore-env.patch b/package/boot/uboot-mediatek/patches/303-mt7986-generic-reset-button-ignore-env.patch
index 5011e74257992a..45290149f3f098 100644
--- a/package/boot/uboot-mediatek/patches/303-mt7986-generic-reset-button-ignore-env.patch
+++ b/package/boot/uboot-mediatek/patches/303-mt7986-generic-reset-button-ignore-env.patch
@@ -17,7 +17,7 @@
  
  #include <mtd.h>
  #include <linux/mtd/mtd.h>
-@@ -25,7 +32,19 @@ int board_init(void)
+@@ -24,7 +31,22 @@ int board_init(void)
  
  int board_late_init(void)
  {
@@ -28,7 +28,10 @@
 +	if (!button_get_by_label(CONFIG_RESET_BUTTON_LABEL, &dev)) {
 +		puts("reset button found\n");
 +#ifdef CONFIG_RESET_BUTTON_SETTLE_DELAY
-+		mdelay(CONFIG_RESET_BUTTON_SETTLE_DELAY);
++		if (CONFIG_RESET_BUTTON_SETTLE_DELAY > 0) {
++			button_get_state(dev);
++			mdelay(CONFIG_RESET_BUTTON_SETTLE_DELAY);
++		}
 +#endif
 +		if (button_get_state(dev) == BUTTON_ON) {
 +			puts("button pushed, resetting environment\n");
diff --git a/package/boot/uboot-mediatek/patches/304-mt7981-generic-reset-button-ignore-env.patch b/package/boot/uboot-mediatek/patches/304-mt7981-generic-reset-button-ignore-env.patch
new file mode 100644
index 00000000000000..fc443349829c05
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/304-mt7981-generic-reset-button-ignore-env.patch
@@ -0,0 +1,43 @@
+--- a/board/mediatek/mt7981/mt7981_rfb.c
++++ b/board/mediatek/mt7981/mt7981_rfb.c
+@@ -6,9 +6,16 @@
+ 
+ #include <common.h>
+ #include <config.h>
++#include <dm.h>
++#include <button.h>
+ #include <env.h>
+ #include <init.h>
+ #include <asm/global_data.h>
++#include <linux/delay.h>
++
++#ifndef CONFIG_RESET_BUTTON_LABEL
++#define CONFIG_RESET_BUTTON_LABEL "reset"
++#endif
+ 
+ #include <mtd.h>
+ #include <linux/mtd/mtd.h>
+@@ -24,7 +31,22 @@ int board_init(void)
+ 
+ int board_late_init(void)
+ {
+-	gd->env_valid = 1; //to load environment variable from persistent store
++	struct udevice *dev;
++
++	gd->env_valid = ENV_VALID;
++	if (!button_get_by_label(CONFIG_RESET_BUTTON_LABEL, &dev)) {
++		puts("reset button found\n");
++#ifdef CONFIG_RESET_BUTTON_SETTLE_DELAY
++		if (CONFIG_RESET_BUTTON_SETTLE_DELAY > 0) {
++			button_get_state(dev);
++			mdelay(CONFIG_RESET_BUTTON_SETTLE_DELAY);
++		}
++#endif
++		if (button_get_state(dev) == BUTTON_ON) {
++			puts("button pushed, resetting environment\n");
++			gd->env_valid = ENV_INVALID;
++		}
++	}
+ 	env_relocate();
+ 	return 0;
+ }
diff --git a/package/boot/uboot-mediatek/patches/400-update-bpir2-defconfig.patch b/package/boot/uboot-mediatek/patches/400-update-bpir2-defconfig.patch
index 3e13427de4ad09..7ebe5c0fc7a6d9 100644
--- a/package/boot/uboot-mediatek/patches/400-update-bpir2-defconfig.patch
+++ b/package/boot/uboot-mediatek/patches/400-update-bpir2-defconfig.patch
@@ -1,17 +1,18 @@
 --- a/configs/mt7623n_bpir2_defconfig
 +++ b/configs/mt7623n_bpir2_defconfig
-@@ -4,53 +4,138 @@ CONFIG_ARCH_MEDIATEK=y
- CONFIG_SYS_TEXT_BASE=0x81e00000
- CONFIG_SYS_MALLOC_F_LEN=0x4000
+@@ -7,35 +7,105 @@ CONFIG_SYS_MALLOC_F_LEN=0x4000
  CONFIG_NR_DRAM_BANKS=1
+ CONFIG_HAS_CUSTOM_SYS_INIT_SP_ADDR=y
+ CONFIG_CUSTOM_SYS_INIT_SP_ADDR=0x81ffff10
 -CONFIG_ENV_SIZE=0x1000
 +CONFIG_ENV_SIZE=0x10000
  CONFIG_ENV_OFFSET=0x100000
  CONFIG_DEFAULT_DEVICE_TREE="mt7623n-bananapi-bpi-r2"
+-CONFIG_SYS_PROMPT="U-Boot> "
 +CONFIG_USE_DEFAULT_ENV_FILE=y
++CONFIG_SYS_PROMPT="MT7623> "
  CONFIG_TARGET_MT7623=y
  CONFIG_SYS_LOAD_ADDR=0x84000000
- CONFIG_DISTRO_DEFAULTS=y
  CONFIG_FIT=y
 -CONFIG_FIT_VERBOSE=y
 +CONFIG_FIT_ENABLE_SHA256_SUPPORT=y
@@ -23,6 +24,9 @@
 +CONFIG_AUTOBOOT_KEYED=y
 +CONFIG_AUTOBOOT_MENU_SHOW=y
 +CONFIG_BOARD_LATE_INIT=y
++# CONFIG_BOOTSTD is not set
++# CONFIG_BOOT_DEFAULTS is not set
+ CONFIG_DISTRO_DEFAULTS=y
  CONFIG_BOOTDELAY=3
 +CONFIG_BOOTP_SEND_HOSTNAME=y
  CONFIG_DEFAULT_FDT_FILE="mt7623n-bananapi-bpi-r2.dtb"
@@ -34,8 +38,9 @@
 +CONFIG_CFB_CONSOLE_ANSI=y
 +CONFIG_CMD_ENV_FLAGS=y
  # CONFIG_DISPLAY_BOARDINFO is not set
--CONFIG_SYS_PROMPT="U-Boot> "
-+CONFIG_SYS_PROMPT="MT7623> "
+ CONFIG_SYS_MAXARGS=8
+ CONFIG_SYS_PBSIZE=1049
+ CONFIG_SYS_BOOTM_LEN=0x4000000
  CONFIG_CMD_BOOTMENU=y
 +CONFIG_CMD_BOOTP=y
 +CONFIG_CMD_BUTTON=y
@@ -63,16 +68,12 @@
 +CONFIG_CMD_LINK_LOCAL=y
 +CONFIG_CMD_MBR=y
  CONFIG_CMD_MMC=y
--CONFIG_CMD_READ=y
+ CONFIG_CMD_READ=y
 -# CONFIG_CMD_SETEXPR is not set
-+CONFIG_CMD_MTD=y
  # CONFIG_CMD_NFS is not set
-+CONFIG_CMD_PCI=y
 +CONFIG_CMD_SF_TEST=y
 +CONFIG_CMD_PING=y
 +CONFIG_CMD_PXE=y
-+CONFIG_CMD_PWM=y
-+CONFIG_CMD_SMC=y
 +CONFIG_CMD_TFTPBOOT=y
 +CONFIG_CMD_TFTPSRV=y
 +CONFIG_CMD_ASKENV=y
@@ -86,71 +87,56 @@
 +CONFIG_CMD_STRINGS=y
 +CONFIG_CMD_USB=y
 +CONFIG_CMD_UUID=y
-+CONFIG_CMD_MMC=y
-+CONFIG_CMD_READ=y
 +CONFIG_CMD_SCSI=y
 +CONFIG_DISPLAY_CPUINFO=y
 +CONFIG_DM_ETH=y
 +CONFIG_DM_GPIO=y
 +CONFIG_DM_SCSI=y
 +CONFIG_DM_MMC=y
-+CONFIG_DM_MTD=y
 +CONFIG_DM_REGULATOR=y
 +CONFIG_DM_REGULATOR_FIXED=y
-+CONFIG_DM_SERIAL=y
 +CONFIG_DM_REGULATOR_GPIO=y
 +CONFIG_DM_USB=y
 +CONFIG_DM_PCI=y
-+CONFIG_DM_PWM=y
 +CONFIG_AHCI=y
 +CONFIG_AHCI_PCI=y
 +CONFIG_SCSI_AHCI=y
 +CONFIG_SCSI=y
-+CONFIG_PWM_MTK=y
 +CONFIG_HUSH_PARSER=y
-+CONFIG_SYS_RELOC_GD_ENV_ADDR=y
  CONFIG_ENV_OVERWRITE=y
  CONFIG_ENV_IS_IN_MMC=y
  CONFIG_SYS_RELOC_GD_ENV_ADDR=y
  CONFIG_NET_RANDOM_ETHADDR=y
 +CONFIG_NETCONSOLE=y
- CONFIG_REGMAP=y
- CONFIG_SYSCON=y
- CONFIG_CLK=y
-+CONFIG_LZMA=y
-+CONFIG_MEDIATEK_ETH=y
- # CONFIG_MMC_QUIRKS is not set
+ CONFIG_USE_IPADDR=y
+ CONFIG_IPADDR="192.168.1.1"
+ CONFIG_USE_SERVERIP=y
+@@ -47,6 +117,12 @@ CONFIG_CLK=y
  CONFIG_SUPPORT_EMMC_BOOT=y
  CONFIG_MMC_HS400_SUPPORT=y
  CONFIG_MMC_MTK=y
-+CONFIG_MTK_AHCI=y
-+CONFIG_MTK_POWER_DOMAIN=y
-+CONFIG_MTK_SERIAL=y
-+CONFIG_MTK_TIMER=y
 +CONFIG_OF_LIBFDT_OVERLAY=y
 +CONFIG_PARTITION_UUIDS=y
 +CONFIG_PCI=y
 +CONFIG_PCIE_MEDIATEK=y
 +CONFIG_PHY=y
++CONFIG_PINCONF=y
  CONFIG_PHY_FIXED=y
--CONFIG_DM_ETH=y
--CONFIG_MEDIATEK_ETH=y
+ CONFIG_MEDIATEK_ETH=y
  CONFIG_PINCTRL=y
- CONFIG_PINCONF=y
- CONFIG_PINCTRL_MT7623=y
- CONFIG_POWER_DOMAIN=y
--CONFIG_MTK_POWER_DOMAIN=y
--CONFIG_DM_SERIAL=y
--CONFIG_MTK_SERIAL=y
+@@ -56,10 +132,13 @@ CONFIG_POWER_DOMAIN=y
+ CONFIG_MTK_POWER_DOMAIN=y
+ CONFIG_DM_SERIAL=y
+ CONFIG_MTK_SERIAL=y
 +CONFIG_RANDOM_UUID=y
 +CONFIG_REGEX=y
  CONFIG_SYSRESET=y
  CONFIG_SYSRESET_WATCHDOG=y
  CONFIG_TIMER=y
--CONFIG_MTK_TIMER=y
+ CONFIG_MTK_TIMER=y
 +CONFIG_VERSION_VARIABLE=y
  CONFIG_WDT_MTK=y
--CONFIG_LZMA=y
+ CONFIG_LZMA=y
  # CONFIG_EFI_GRUB_ARM32_WORKAROUND is not set
 --- /dev/null
 +++ b/bananapi_bpi-r2_env
@@ -195,7 +181,7 @@
 +emmc_read_recovery=mmc dev 0 0 ; part start mmc 0 $part_recovery part_addr && part size mmc 0 $part_recovery part_size && run mmc_read_vol
 +mmc_write_production=if test "$bootedfrom" = "SD" ; then run sdmmc_write_production ; else run emmc_write_production ; fi
 +mmc_write_recovery=if test "$bootedfrom" = "SD" ; run sdmmc_write_recovery ; else run emmc_write_recovery ; fi
-+mmc_write_vol=imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc erase 0x$part_addr 0x$part_size && mmc write $loadaddr 0x$part_addr 0x$image_size
++mmc_write_vol=imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc erase 0x$part_addr 0x$image_size && mmc write $loadaddr 0x$part_addr 0x$image_size
 +mmc_read_vol=mmc read $loadaddr $part_addr 0x8 && imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc read $loadaddr 0x$part_addr 0x$image_size && setexpr filesize $image_size * 0x200
 +reset_factory=eraseenv && reset
 +sdmmc_read_emmc_hdr=mmc dev 1 && mmc read $loadaddr 0x1ff8 0x8
@@ -227,7 +213,15 @@
 +_set_bmf=setenv _set_bmf ; setenv bootmenu_${_menu_next} "Reset all settings to factory defaults.=run reset_factory ; reset" ; setenv _menu_next
 --- a/arch/arm/dts/mt7623n-bananapi-bpi-r2.dts
 +++ b/arch/arm/dts/mt7623n-bananapi-bpi-r2.dts
-@@ -66,6 +66,15 @@
+@@ -6,6 +6,7 @@
+  */
+ 
+ /dts-v1/;
++#include <dt-bindings/input/linux-event-codes.h>
+ #include "mt7623.dtsi"
+ #include "mt7623-u-boot.dtsi"
+ 
+@@ -66,6 +67,16 @@
  			default-state = "off";
  		};
  	};
@@ -238,6 +232,7 @@
 +		factory {
 +			label = "factory";
 +			gpios = <&gpio 256 GPIO_ACTIVE_LOW>;
++			linux,code = <KEY_RESTART>;
 +		};
 +	};
  };
diff --git a/package/boot/uboot-mediatek/patches/401-update-u7623-defconfig.patch b/package/boot/uboot-mediatek/patches/401-update-u7623-defconfig.patch
index f79c86714d8a57..453456c94f92b2 100644
--- a/package/boot/uboot-mediatek/patches/401-update-u7623-defconfig.patch
+++ b/package/boot/uboot-mediatek/patches/401-update-u7623-defconfig.patch
@@ -1,17 +1,18 @@
 --- a/configs/mt7623a_unielec_u7623_02_defconfig
 +++ b/configs/mt7623a_unielec_u7623_02_defconfig
-@@ -4,51 +4,135 @@ CONFIG_ARCH_MEDIATEK=y
- CONFIG_SYS_TEXT_BASE=0x81e00000
- CONFIG_SYS_MALLOC_F_LEN=0x4000
+@@ -7,34 +7,110 @@ CONFIG_SYS_MALLOC_F_LEN=0x4000
  CONFIG_NR_DRAM_BANKS=1
+ CONFIG_HAS_CUSTOM_SYS_INIT_SP_ADDR=y
+ CONFIG_CUSTOM_SYS_INIT_SP_ADDR=0x81ffff10
 -CONFIG_ENV_SIZE=0x1000
 +CONFIG_ENV_SIZE=0x10000
  CONFIG_ENV_OFFSET=0x100000
  CONFIG_DEFAULT_DEVICE_TREE="mt7623a-unielec-u7623-02-emmc"
+-CONFIG_SYS_PROMPT="U-Boot> "
 +CONFIG_USE_DEFAULT_ENV_FILE=y
++CONFIG_SYS_PROMPT="MT7623> "
  CONFIG_TARGET_MT7623=y
  CONFIG_SYS_LOAD_ADDR=0x84000000
- CONFIG_DISTRO_DEFAULTS=y
  CONFIG_FIT=y
 -CONFIG_FIT_VERBOSE=y
 +CONFIG_FIT_ENABLE_SHA256_SUPPORT=y
@@ -23,6 +24,9 @@
 +CONFIG_AUTOBOOT_KEYED=y
 +CONFIG_AUTOBOOT_MENU_SHOW=y
 +CONFIG_BOARD_LATE_INIT=y
++# CONFIG_BOOTSTD is not set
++# CONFIG_BOOT_DEFAULTS is not set
+ CONFIG_DISTRO_DEFAULTS=y
  CONFIG_BOOTDELAY=3
 +CONFIG_BOOTP_SEND_HOSTNAME=y
  CONFIG_DEFAULT_FDT_FILE="mt7623a-unielec-u7623-02-emmc.dtb"
@@ -34,8 +38,9 @@
 +CONFIG_CFB_CONSOLE_ANSI=y
 +CONFIG_CMD_ENV_FLAGS=y
  # CONFIG_DISPLAY_BOARDINFO is not set
--CONFIG_SYS_PROMPT="U-Boot> "
-+CONFIG_SYS_PROMPT="MT7623> "
+ CONFIG_SYS_MAXARGS=8
+ CONFIG_SYS_PBSIZE=1049
+ CONFIG_SYS_BOOTM_LEN=0x4000000
  CONFIG_CMD_BOOTMENU=y
 +CONFIG_CMD_BOOTP=y
 +CONFIG_CMD_BOOTZ=y
@@ -64,16 +69,12 @@
 +CONFIG_CMD_LINK_LOCAL=y
 +CONFIG_CMD_MBR=y
  CONFIG_CMD_MMC=y
--CONFIG_CMD_READ=y
+ CONFIG_CMD_READ=y
 -# CONFIG_CMD_SETEXPR is not set
  # CONFIG_CMD_NFS is not set
--CONFIG_ENV_IS_IN_MMC=y
-+CONFIG_CMD_PCI=y
 +CONFIG_CMD_SF_TEST=y
 +CONFIG_CMD_PING=y
 +CONFIG_CMD_PXE=y
-+CONFIG_CMD_PWM=y
-+CONFIG_CMD_SMC=y
 +CONFIG_CMD_TFTPBOOT=y
 +CONFIG_CMD_TFTPSRV=y
 +CONFIG_CMD_ASKENV=y
@@ -94,62 +95,52 @@
 +CONFIG_DM_GPIO=y
 +CONFIG_DM_SCSI=y
 +CONFIG_DM_MMC=y
-+CONFIG_DM_MTD=y
 +CONFIG_DM_REGULATOR=y
 +CONFIG_DM_REGULATOR_FIXED=y
 +CONFIG_DM_SERIAL=y
 +CONFIG_DM_REGULATOR_GPIO=y
 +CONFIG_DM_USB=y
 +CONFIG_DM_PCI=y
-+CONFIG_DM_PWM=y
 +CONFIG_AHCI=y
 +CONFIG_AHCI_PCI=y
 +CONFIG_SCSI_AHCI=y
 +CONFIG_SCSI=y
-+CONFIG_PWM_MTK=y
 +CONFIG_HUSH_PARSER=y
+ CONFIG_ENV_IS_IN_MMC=y
  CONFIG_SYS_RELOC_GD_ENV_ADDR=y
 +CONFIG_SYS_MMC_ENV_DEV=0
 +CONFIG_ENV_OVERWRITE=y
 +CONFIG_ENV_IS_IN_MMC=y
  CONFIG_NET_RANDOM_ETHADDR=y
 +CONFIG_NETCONSOLE=y
- CONFIG_REGMAP=y
- CONFIG_SYSCON=y
- CONFIG_CLK=y
-+CONFIG_LZMA=y
-+CONFIG_MEDIATEK_ETH=y
- # CONFIG_MMC_QUIRKS is not set
+ CONFIG_USE_IPADDR=y
+ CONFIG_IPADDR="192.168.1.1"
+ CONFIG_USE_SERVERIP=y
+@@ -46,6 +122,11 @@ CONFIG_CLK=y
  CONFIG_SUPPORT_EMMC_BOOT=y
  CONFIG_MMC_HS400_SUPPORT=y
  CONFIG_MMC_MTK=y
-+CONFIG_MTK_POWER_DOMAIN=y
-+CONFIG_MTK_SERIAL=y
-+CONFIG_MTK_TIMER=y
 +CONFIG_OF_LIBFDT_OVERLAY=y
 +CONFIG_PARTITION_UUIDS=y
 +CONFIG_PCI=y
 +CONFIG_PCIE_MEDIATEK=y
 +CONFIG_PHY=y
  CONFIG_PHY_FIXED=y
--CONFIG_DM_ETH=y
--CONFIG_MEDIATEK_ETH=y
+ CONFIG_MEDIATEK_ETH=y
  CONFIG_PINCTRL=y
- CONFIG_PINCONF=y
- CONFIG_PINCTRL_MT7623=y
- CONFIG_POWER_DOMAIN=y
--CONFIG_MTK_POWER_DOMAIN=y
--CONFIG_DM_SERIAL=y
--CONFIG_MTK_SERIAL=y
+@@ -55,9 +136,12 @@ CONFIG_POWER_DOMAIN=y
+ CONFIG_MTK_POWER_DOMAIN=y
+ CONFIG_DM_SERIAL=y
+ CONFIG_MTK_SERIAL=y
 +CONFIG_RANDOM_UUID=y
 +CONFIG_REGEX=y
  CONFIG_SYSRESET=y
  CONFIG_SYSRESET_WATCHDOG=y
  CONFIG_TIMER=y
--CONFIG_MTK_TIMER=y
+ CONFIG_MTK_TIMER=y
 +CONFIG_VERSION_VARIABLE=y
  CONFIG_WDT_MTK=y
--CONFIG_LZMA=y
+ CONFIG_LZMA=y
 --- /dev/null
 +++ b/unielec_u7623-02_env
 @@ -0,0 +1,47 @@
@@ -192,7 +183,7 @@
 +emmc_write_recovery=mmc dev 0 0 ; iminfo $loadaddr && part start mmc 0 $part_recovery part_addr && part size mmc 0 $part_recovery part_size && run mmc_write_vol
 +emmc_read_production=mmc dev 0 0 ; part start mmc 0 $part_default part_addr && part size mmc 0 $part_default part_size && run mmc_read_vol
 +emmc_read_recovery=mmc dev 0 0 ; part start mmc 0 $part_recovery part_addr && part size mmc 0 $part_recovery part_size && run mmc_read_vol
-+mmc_write_vol=imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc erase 0x$part_addr 0x$part_size && mmc write $loadaddr 0x$part_addr 0x$image_size
++mmc_write_vol=imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc erase 0x$part_addr 0x$image_size && mmc write $loadaddr 0x$part_addr 0x$image_size
 +mmc_read_vol=mmc read $loadaddr $part_addr 0x8 && imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc read $loadaddr 0x$part_addr 0x$image_size && setexpr filesize $image_size * 0x200
 +reset_factory=eraseenv && reset
 +_init_env=setenv _init_env ; saveenv ; saveenv
@@ -200,3 +191,52 @@
 +_update_bootdev=setenv _update_bootdev ; setenv bootargs "$console root=/dev/mmcblk0p65"
 +_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
 +_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title                $ver"
+--- a/arch/arm/dts/mt7623a-unielec-u7623-02-emmc.dts
++++ b/arch/arm/dts/mt7623a-unielec-u7623-02-emmc.dts
+@@ -6,6 +6,7 @@
+  */
+ 
+ /dts-v1/;
++#include <dt-bindings/input/linux-event-codes.h>
+ #include "mt7623.dtsi"
+ #include "mt7623-u-boot.dtsi"
+ 
+@@ -50,6 +51,18 @@
+ 		regulator-always-on;
+ 	};
+ 
++	gpio-keys {
++		compatible = "gpio-keys";
++		pinctrl-names = "default";
++		pinctrl-0 = <&key_pins_a>;
++
++		factory {
++			label = "factory";
++			gpios = <&gpio 256 GPIO_ACTIVE_LOW>;
++			linux,code = <KEY_RESTART>;
++		};
++	};
++
+ 	leds {
+ 		compatible = "gpio-leds";
+ 
+@@ -109,6 +122,19 @@
+ 		};
+ 	};
+ 
++	key_pins_a: keys-alt {
++		mux {
++			function = "gpio";
++			groups = "msdc3";
++		};
++
++		conf {
++			pins = "MSDC0E_DAT0", "MSDC0E_DAT1";
++			input-enable;
++			bias-pull-up;
++		};
++	};
++
+ 	mmc0_pins_default: mmc0default {
+ 		mux {
+ 			function = "msdc";
diff --git a/package/boot/uboot-mediatek/patches/402-update-bananapi-bpi-r64-device-tree.patch b/package/boot/uboot-mediatek/patches/402-update-bananapi-bpi-r64-device-tree.patch
index 7aa0ca9c889198..c8066a7e2d4eb6 100644
--- a/package/boot/uboot-mediatek/patches/402-update-bananapi-bpi-r64-device-tree.patch
+++ b/package/boot/uboot-mediatek/patches/402-update-bananapi-bpi-r64-device-tree.patch
@@ -1,6 +1,14 @@
 --- a/arch/arm/dts/mt7622-bananapi-bpi-r64.dts
 +++ b/arch/arm/dts/mt7622-bananapi-bpi-r64.dts
-@@ -20,6 +20,7 @@
+@@ -5,6 +5,7 @@
+  */
+ 
+ /dts-v1/;
++#include <dt-bindings/input/linux-event-codes.h>
+ #include "mt7622.dtsi"
+ #include "mt7622-u-boot.dtsi"
+ 
+@@ -20,6 +21,7 @@
  
  	aliases {
  		spi0 = &snfi;
@@ -8,7 +16,7 @@
  	};
  
  	memory@40000000 {
-@@ -27,6 +28,42 @@
+@@ -27,6 +29,44 @@
  		reg = <0x40000000 0x40000000>;
  	};
  
@@ -18,11 +26,13 @@
 +		reset {
 +			label = "reset";
 +			gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
++			linux,code = <KEY_RESTART>;
 +		};
 +
 +		wps {
 +			label = "wps";
 +			gpios = <&gpio 102 GPIO_ACTIVE_LOW>;
++			linux,code = <KEY_WPS_BUTTON>;
 +		};
 +	};
 +
@@ -51,7 +61,15 @@
  	reg_1p8v: regulator-1p8v {
  		compatible = "regulator-fixed";
  		regulator-name = "fixed-1.8V";
-@@ -197,7 +234,7 @@
+@@ -182,6 +222,7 @@
+ };
+ 
+ &uart0 {
++	mediatek,force-highspeed;
+ 	status = "okay";
+ };
+ 
+@@ -197,7 +238,7 @@
  	status = "okay";
  	bus-width = <8>;
  	max-frequency = <50000000>;
@@ -60,7 +78,7 @@
  	vmmc-supply = <&reg_3p3v>;
  	vqmmc-supply = <&reg_3p3v>;
  	non-removable;
-@@ -208,7 +245,7 @@
+@@ -208,7 +249,7 @@
  	pinctrl-0 = <&mmc1_pins_default>;
  	status = "okay";
  	bus-width = <4>;
diff --git a/package/boot/uboot-mediatek/patches/403-add-bananapi_bpi-r64-snand.patch b/package/boot/uboot-mediatek/patches/403-add-bananapi_bpi-r64-snand.patch
index 1dc2a84893ab15..a414f0a8b5cbc0 100644
--- a/package/boot/uboot-mediatek/patches/403-add-bananapi_bpi-r64-snand.patch
+++ b/package/boot/uboot-mediatek/patches/403-add-bananapi_bpi-r64-snand.patch
@@ -1,6 +1,6 @@
 --- a/arch/arm/dts/mt7622-bananapi-bpi-r64.dts
 +++ b/arch/arm/dts/mt7622-bananapi-bpi-r64.dts
-@@ -19,7 +19,7 @@
+@@ -20,7 +20,7 @@
  	};
  
  	aliases {
@@ -9,7 +9,7 @@
  		ethernet0 = &eth;
  	};
  
-@@ -205,17 +205,11 @@
+@@ -208,17 +208,11 @@
  	};
  };
  
diff --git a/package/boot/uboot-mediatek/patches/404-add-bananapi_bpi-r64_defconfigs.patch b/package/boot/uboot-mediatek/patches/404-add-bananapi_bpi-r64_defconfigs.patch
index de37764b68553a..f3d9499e171db0 100644
--- a/package/boot/uboot-mediatek/patches/404-add-bananapi_bpi-r64_defconfigs.patch
+++ b/package/boot/uboot-mediatek/patches/404-add-bananapi_bpi-r64_defconfigs.patch
@@ -1,13 +1,14 @@
 --- /dev/null
 +++ b/configs/mt7622_bananapi_bpi-r64-sdmmc_defconfig
-@@ -0,0 +1,159 @@
+@@ -0,0 +1,164 @@
 +CONFIG_ARM=y
 +CONFIG_POSITION_INDEPENDENT=y
 +CONFIG_ARCH_MEDIATEK=y
 +CONFIG_TARGET_MT7622=y
-+CONFIG_SYS_TEXT_BASE=0x41e00000
++CONFIG_TEXT_BASE=0x41e00000
 +CONFIG_SYS_MALLOC_F_LEN=0x4000
 +CONFIG_SYS_LOAD_ADDR=0x40080000
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
 +CONFIG_USE_DEFAULT_ENV_FILE=y
 +CONFIG_BOARD_LATE_INIT=y
 +CONFIG_BOOTP_SEND_HOSTNAME=y
@@ -160,6 +161,10 @@
 +CONFIG_USB_XHCI_HCD=y
 +CONFIG_USB_XHCI_MTK=y
 +CONFIG_USB_STORAGE=y
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
 --- /dev/null
 +++ b/bananapi_bpi-r64-sdmmc_env
 @@ -0,0 +1,82 @@
@@ -168,9 +173,9 @@
 +loadaddr=0x48000000
 +bootargs=root=/dev/mmcblk1p65
 +bootcmd=if pstore check ; then run boot_recovery ; else run boot_sdmmc ; fi
-+bootconf=config-mt7622-bananapi-bpi-r64-pcie1
-+bootconf_pcie=config-mt7622-bananapi-bpi-r64-pcie1
-+bootconf_sata=config-mt7622-bananapi-bpi-r64-sata
++bootconf=config-1#mt7622-bananapi-bpi-r64-pcie1
++bootconf_pcie=config-1#mt7622-bananapi-bpi-r64-pcie1
++bootconf_sata=config-1#mt7622-bananapi-bpi-r64-sata
 +bootdelay=0
 +bootfile=openwrt-mediatek-mt7622-bananapi_bpi-r64-initramfs-recovery.itb
 +bootfile_emmcbl2=openwrt-mediatek-mt7622-bananapi_bpi-r64-emmc-preloader.bin
@@ -214,7 +219,7 @@
 +emmc_write_hdr=mmc dev 0 0 && mmc erase 0x0 0x40 && mmc write $loadaddr 0x0 0x40
 +emmc_write_production=mmc dev 0 && part start mmc 0 $part_default part_addr && part size mmc 0 $part_default part_size && run mmc_write_vol
 +emmc_write_recovery=mmc dev 0 && part start mmc 0 $part_recovery part_addr && part size mmc 0 $part_recovery part_size && run mmc_write_vol
-+mmc_write_vol=imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc erase 0x$part_addr 0x$part_size && mmc write $loadaddr 0x$part_addr 0x$image_size
++mmc_write_vol=imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc erase 0x$part_addr 0x$image_size && mmc write $loadaddr 0x$part_addr 0x$image_size
 +mmc_read_vol=mmc read $loadaddr $part_addr 0x8 && imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc read $loadaddr 0x$part_addr 0x$image_size && setexpr filesize $image_size * 0x200
 +part_default=production
 +part_recovery=recovery
@@ -247,14 +252,15 @@
 +_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
 --- /dev/null
 +++ b/configs/mt7622_bananapi_bpi-r64-emmc_defconfig
-@@ -0,0 +1,146 @@
+@@ -0,0 +1,151 @@
 +CONFIG_ARM=y
 +CONFIG_POSITION_INDEPENDENT=y
 +CONFIG_ARCH_MEDIATEK=y
 +CONFIG_TARGET_MT7622=y
-+CONFIG_SYS_TEXT_BASE=0x41e00000
++CONFIG_TEXT_BASE=0x41e00000
 +CONFIG_SYS_MALLOC_F_LEN=0x4000
 +CONFIG_SYS_LOAD_ADDR=0x40080000
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
 +CONFIG_USE_DEFAULT_ENV_FILE=y
 +CONFIG_BOARD_LATE_INIT=y
 +CONFIG_BOOTP_SEND_HOSTNAME=y
@@ -394,6 +400,10 @@
 +CONFIG_USB_XHCI_HCD=y
 +CONFIG_USB_XHCI_MTK=y
 +CONFIG_USB_STORAGE=y
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
 --- /dev/null
 +++ b/bananapi_bpi-r64-emmc_env
 @@ -0,0 +1,56 @@
@@ -402,9 +412,9 @@
 +loadaddr=0x48000000
 +bootcmd=if pstore check ; then run boot_recovery ; else run boot_emmc ; fi
 +bootargs=root=/dev/mmcblk0p65
-+bootconf=config-mt7622-bananapi-bpi-r64-pcie1
-+bootconf_pcie=config-mt7622-bananapi-bpi-r64-pcie1
-+bootconf_sata=config-mt7622-bananapi-bpi-r64-sata
++bootconf=config-1#mt7622-bananapi-bpi-r64-pcie1
++bootconf_pcie=config-1#mt7622-bananapi-bpi-r64-pcie1
++bootconf_sata=config-1#mt7622-bananapi-bpi-r64-sata
 +bootdelay=0
 +bootfile=openwrt-mediatek-mt7622-bananapi_bpi-r64-initramfs-recovery.itb
 +bootfile_upg=openwrt-mediatek-mt7622-bananapi_bpi-r64-squashfs-sysupgrade.itb
@@ -444,7 +454,7 @@
 +emmc_write_fip=mmc dev 0 0 && mmc erase 0x1000 0x1000 && mmc write $loadaddr 0x1000 0x1000 && mmc erase 0x2000 0x800
 +emmc_read_production=mmc dev 0 && part start mmc 0 $part_default part_addr && part size mmc 0 $part_default part_size && run mmc_read_vol
 +emmc_read_recovery=mmc dev 0 && part start mmc 0 $part_recovery part_addr && part size mmc 0 $part_recovery part_size && run mmc_read_vol
-+mmc_write_vol=imszb $fileaddr image_size && test 0x$image_size -le 0x$part_size && mmc erase 0x$part_addr 0x$part_size && mmc write $fileaddr 0x$part_addr 0x$image_size
++mmc_write_vol=imszb $fileaddr image_size && test 0x$image_size -le 0x$part_size && mmc erase 0x$part_addr 0x$image_size && mmc write $fileaddr 0x$part_addr 0x$image_size
 +mmc_read_vol=mmc read $loadaddr $part_addr 0x8 && imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc read $loadaddr 0x$part_addr 0x$image_size
 +part_default=production
 +part_recovery=recovery
@@ -455,13 +465,14 @@
 +_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
 --- /dev/null
 +++ b/configs/mt7622_bananapi_bpi-r64-snand_defconfig
-@@ -0,0 +1,140 @@
+@@ -0,0 +1,145 @@
 +CONFIG_ARM=y
 +CONFIG_POSITION_INDEPENDENT=y
 +CONFIG_ARCH_MEDIATEK=y
-+CONFIG_SYS_TEXT_BASE=0x41e00000
++CONFIG_TEXT_BASE=0x41e00000
 +CONFIG_SYS_MALLOC_F_LEN=0x4000
 +CONFIG_SYS_LOAD_ADDR=0x40080000
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
 +CONFIG_USE_DEFAULT_ENV_FILE=y
 +CONFIG_BOARD_LATE_INIT=y
 +CONFIG_BOOTP_SEND_HOSTNAME=y
@@ -596,6 +607,10 @@
 +CONFIG_USB_XHCI_HCD=y
 +CONFIG_USB_XHCI_MTK=y
 +CONFIG_USB_STORAGE=y
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.3"
 --- /dev/null
 +++ b/bananapi_bpi-r64-snand_env
 @@ -0,0 +1,57 @@
@@ -604,9 +619,9 @@
 +loadaddr=0x48000000
 +bootargs=root=/dev/ubiblock0_2p1
 +bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
-+bootconf=config-mt7622-bananapi-bpi-r64-pcie1
-+bootconf_pcie=config-mt7622-bananapi-bpi-r64-pcie1
-+bootconf_sata=config-mt7622-bananapi-bpi-r64-sata
++bootconf=config-1#mt7622-bananapi-bpi-r64-pcie1
++bootconf_pcie=config-1#mt7622-bananapi-bpi-r64-pcie1
++bootconf_sata=config-1#mt7622-bananapi-bpi-r64-sata
 +bootdelay=0
 +bootfile=openwrt-mediatek-mt7622-bananapi_bpi-r64-initramfs-recovery.itb
 +bootfile_fip=openwrt-mediatek-mt7622-bananapi_bpi-r64-snand-bl31-uboot.fip
diff --git a/package/boot/uboot-mediatek/patches/405-dts-mt7623n-bpi-r2-fix-leds.patch b/package/boot/uboot-mediatek/patches/405-dts-mt7623n-bpi-r2-fix-leds.patch
index 874819290266ab..2ebbba8a85445f 100644
--- a/package/boot/uboot-mediatek/patches/405-dts-mt7623n-bpi-r2-fix-leds.patch
+++ b/package/boot/uboot-mediatek/patches/405-dts-mt7623n-bpi-r2-fix-leds.patch
@@ -1,6 +1,6 @@
 --- a/arch/arm/dts/mt7623n-bananapi-bpi-r2.dts
 +++ b/arch/arm/dts/mt7623n-bananapi-bpi-r2.dts
-@@ -50,19 +50,19 @@
+@@ -51,19 +51,19 @@
  
  		blue {
  			label = "bpi-r2:pio:blue";
diff --git a/package/boot/uboot-mediatek/patches/406-dts-mt7623n-bpi-r2-uart0-force-highspeed.patch b/package/boot/uboot-mediatek/patches/406-dts-mt7623n-bpi-r2-uart0-force-highspeed.patch
new file mode 100644
index 00000000000000..6710e3ea4ee2cc
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/406-dts-mt7623n-bpi-r2-uart0-force-highspeed.patch
@@ -0,0 +1,10 @@
+--- a/arch/arm/dts/mt7623n-bananapi-bpi-r2.dts
++++ b/arch/arm/dts/mt7623n-bananapi-bpi-r2.dts
+@@ -245,6 +245,7 @@
+ &uart0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&uart0_pins_a>;
++	mediatek,force-highspeed;
+ 	status = "okay";
+ };
+ 
diff --git a/package/boot/uboot-mediatek/patches/410-add-linksys-e8450.patch b/package/boot/uboot-mediatek/patches/410-add-linksys-e8450.patch
index cbcd098c3bc1f7..3fc2c554bb0beb 100644
--- a/package/boot/uboot-mediatek/patches/410-add-linksys-e8450.patch
+++ b/package/boot/uboot-mediatek/patches/410-add-linksys-e8450.patch
@@ -1,11 +1,11 @@
 --- /dev/null
 +++ b/configs/mt7622_linksys_e8450_defconfig
-@@ -0,0 +1,136 @@
+@@ -0,0 +1,141 @@
 +CONFIG_ARM=y
 +CONFIG_POSITION_INDEPENDENT=y
 +CONFIG_ARCH_MEDIATEK=y
 +CONFIG_TARGET_MT7622=y
-+CONFIG_SYS_TEXT_BASE=0x41e00000
++CONFIG_TEXT_BASE=0x41e00000
 +CONFIG_SYS_MALLOC_F_LEN=0x4000
 +CONFIG_SYS_LOAD_ADDR=0x40080000
 +CONFIG_USE_DEFAULT_ENV_FILE=y
@@ -58,7 +58,7 @@
 +CONFIG_CMD_LINK_LOCAL=y
 +# CONFIG_CMD_MBR is not set
 +CONFIG_CMD_MTD=y
-+CONFIG_CMD_MTDPART=y
++CONFIG_CMD_MTDPARTS=y
 +CONFIG_CMD_PCI=y
 +CONFIG_CMD_SF_TEST=y
 +CONFIG_CMD_PING=y
@@ -126,12 +126,17 @@
 +CONFIG_MTK_SPI_NAND=y
 +CONFIG_MTK_SPI_NAND_MTD=y
 +CONFIG_SYSRESET_WATCHDOG=y
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
 +CONFIG_WDT_MTK=y
 +CONFIG_LZO=y
 +CONFIG_ZSTD=y
 +CONFIG_HEXDUMP=y
 +CONFIG_RANDOM_UUID=y
 +CONFIG_REGEX=y
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
 +CONFIG_USB=y
 +CONFIG_USB_HOST=y
 +CONFIG_USB_XHCI_HCD=y
@@ -139,7 +144,7 @@
 +CONFIG_USB_STORAGE=y
 --- /dev/null
 +++ b/arch/arm/dts/mt7622-linksys-e8450-ubi.dts
-@@ -0,0 +1,193 @@
+@@ -0,0 +1,197 @@
 +// SPDX-License-Identifier: GPL-2.0
 +/*
 + * Copyright (c) 2019 MediaTek Inc.
@@ -147,6 +152,7 @@
 + */
 +
 +/dts-v1/;
++#include <dt-bindings/input/linux-event-codes.h>
 +#include "mt7622.dtsi"
 +#include "mt7622-u-boot.dtsi"
 +
@@ -170,11 +176,13 @@
 +		factory {
 +			label = "reset";
 +			gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
++			linux,code = <KEY_RESTART>;
 +		};
 +
 +		wps {
 +			label = "wps";
 +			gpios = <&gpio 102 GPIO_ACTIVE_LOW>;
++			linux,code = <KEY_WPS_BUTTON>;
 +		};
 +	};
 +
@@ -302,6 +310,7 @@
 +};
 +
 +&uart0 {
++	mediatek,force-highspeed;
 +	status = "okay";
 +};
 +
@@ -335,7 +344,7 @@
 +};
 --- a/arch/arm/dts/Makefile
 +++ b/arch/arm/dts/Makefile
-@@ -1203,6 +1203,7 @@ dtb-$(CONFIG_ARCH_MEDIATEK) += \
+@@ -1285,6 +1285,7 @@ dtb-$(CONFIG_ARCH_MEDIATEK) += \
  	mt7622-rfb.dtb \
  	mt7623a-unielec-u7623-02-emmc.dtb \
  	mt7622-bananapi-bpi-r64.dtb \
diff --git a/package/boot/uboot-mediatek/patches/412-add-ubnt-unifi-6-lr.patch b/package/boot/uboot-mediatek/patches/412-add-ubnt-unifi-6-lr.patch
index 8279d250f3e059..1955958b9b0b04 100644
--- a/package/boot/uboot-mediatek/patches/412-add-ubnt-unifi-6-lr.patch
+++ b/package/boot/uboot-mediatek/patches/412-add-ubnt-unifi-6-lr.patch
@@ -1,11 +1,11 @@
 --- /dev/null
 +++ b/configs/mt7622_ubnt_unifi-6-lr_defconfig
-@@ -0,0 +1,142 @@
+@@ -0,0 +1,147 @@
 +CONFIG_ARM=y
 +CONFIG_POSITION_INDEPENDENT=y
 +CONFIG_ARCH_MEDIATEK=y
 +CONFIG_TARGET_MT7622=y
-+CONFIG_SYS_TEXT_BASE=0x41e00000
++CONFIG_TEXT_BASE=0x41e00000
 +CONFIG_SYS_MALLOC_F_LEN=0x4000
 +CONFIG_SYS_LOAD_ADDR=0x40080000
 +CONFIG_USE_DEFAULT_ENV_FILE=y
@@ -64,7 +64,7 @@
 +CONFIG_CMD_LINK_LOCAL=y
 +# CONFIG_CMD_MBR is not set
 +CONFIG_CMD_MTD=y
-+CONFIG_CMD_MTDPART=y
++CONFIG_CMD_MTDPARTS=y
 +# CONFIG_CMD_PCI is not set
 +CONFIG_CMD_SF_TEST=y
 +CONFIG_CMD_PING=y
@@ -143,9 +143,14 @@
 +CONFIG_SPI_FLASH_WINBOND=y
 +CONFIG_SPI_FLASH_XMC=y
 +CONFIG_SPI_FLASH_USE_4K_SECTORS=y
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
 --- /dev/null
 +++ b/arch/arm/dts/mt7622-ubnt-unifi-6-lr.dts
-@@ -0,0 +1,187 @@
+@@ -0,0 +1,188 @@
 +// SPDX-License-Identifier: GPL-2.0
 +/*
 + * Copyright (c) 2019 MediaTek Inc.
@@ -153,6 +158,7 @@
 + */
 +
 +/dts-v1/;
++#include <dt-bindings/input/linux-event-codes.h>
 +#include "mt7622.dtsi"
 +#include "mt7622-u-boot.dtsi"
 +
@@ -173,12 +179,11 @@
 +
 +	gpio-keys {
 +		compatible = "gpio-keys";
-+		u-boot,dm-pre-reloc;
 +
 +		reset {
 +			label = "reset";
 +			gpios = <&gpio 62 GPIO_ACTIVE_LOW>;
-+			u-boot,dm-pre-reloc;
++			linux,code = <KEY_RESTART>;
 +		};
 +	};
 +
@@ -299,6 +304,7 @@
 +};
 +
 +&uart0 {
++	mediatek,force-highspeed;
 +	status = "okay";
 +};
 +
@@ -335,7 +341,7 @@
 +};
 --- a/arch/arm/dts/Makefile
 +++ b/arch/arm/dts/Makefile
-@@ -1204,6 +1204,7 @@ dtb-$(CONFIG_ARCH_MEDIATEK) += \
+@@ -1286,6 +1286,7 @@ dtb-$(CONFIG_ARCH_MEDIATEK) += \
  	mt7623a-unielec-u7623-02-emmc.dtb \
  	mt7622-bananapi-bpi-r64.dtb \
  	mt7622-linksys-e8450-ubi.dtb \
@@ -398,7 +404,7 @@
 +_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
 --- a/common/board_r.c
 +++ b/common/board_r.c
-@@ -62,6 +62,7 @@
+@@ -66,6 +66,7 @@
  #include <asm-generic/gpio.h>
  #include <efi_loader.h>
  #include <relocate.h>
@@ -406,7 +412,7 @@
  
  DECLARE_GLOBAL_DATA_PTR;
  
-@@ -406,6 +407,20 @@ static int initr_onenand(void)
+@@ -412,6 +413,20 @@ static int initr_onenand(void)
  }
  #endif
  
diff --git a/package/boot/uboot-mediatek/patches/420-add-support-for-RAVPower-RP-WD009.patch b/package/boot/uboot-mediatek/patches/420-add-support-for-RAVPower-RP-WD009.patch
index 80af85a9596b36..3cd4d1b2df3253 100644
--- a/package/boot/uboot-mediatek/patches/420-add-support-for-RAVPower-RP-WD009.patch
+++ b/package/boot/uboot-mediatek/patches/420-add-support-for-RAVPower-RP-WD009.patch
@@ -125,10 +125,12 @@ Subject: [PATCH] add support for RAVPower RP-WD009
 +}
 --- /dev/null
 +++ b/configs/ravpower-rp-wd009-ram_defconfig
-@@ -0,0 +1,61 @@
+@@ -0,0 +1,71 @@
 +CONFIG_MIPS=y
 +CONFIG_SYS_LOAD_ADDR=0x80010000
 +CONFIG_NR_DRAM_BANKS=1
++CONFIG_SYS_MEMTEST_START=0x80100000
++CONFIG_SYS_MEMTEST_END=0x80400000
 +CONFIG_ARCH_MTMIPS=y
 +CONFIG_SOC_MT7628=y
 +CONFIG_MIPS_BOOT_FDT=y
@@ -140,6 +142,8 @@ Subject: [PATCH] add support for RAVPower RP-WD009
 +CONFIG_SYS_CONSOLE_INFO_QUIET=y
 +CONFIG_VERSION_VARIABLE=y
 +CONFIG_BOARD_RAVPOWER_RP_WD009=y
++CONFIG_SYS_MIPS_TIMER_FREQ=290000000
++CONFIG_SYS_BOOTPARAMS_LEN=0x20000
 +CONFIG_HUSH_PARSER=y
 +CONFIG_CMD_LICENSE=y
 +# CONFIG_CMD_ELF is not set
@@ -187,9 +191,15 @@ Subject: [PATCH] add support for RAVPower RP-WD009
 +CONFIG_WDT_MT7621=y
 +CONFIG_LZMA=y
 +CONFIG_BAUDRATE=57600
++CONFIG_SYS_MAXARGS=64
++CONFIG_SYS_CBSIZE=512
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
 --- /dev/null
 +++ b/include/configs/ravpower-rp-wd009.h
-@@ -0,0 +1,42 @@
+@@ -0,0 +1,17 @@
 +/* SPDX-License-Identifier: GPL-2.0+ */
 +/*
 + * Copyright (C) 2018 Stefan Roese <sr@denx.de>
@@ -198,39 +208,14 @@ Subject: [PATCH] add support for RAVPower RP-WD009
 +#ifndef __CONFIG_RAVPOWER_RP_WD009_H
 +#define __CONFIG_RAVPOWER_RP_WD009_H
 +
-+/* CPU */
-+#define CONFIG_SYS_MIPS_TIMER_FREQ	290000000
-+
 +/* RAM */
-+#define CONFIG_SYS_SDRAM_BASE		0x80000000
-+
-+#define CONFIG_SYS_INIT_SP_OFFSET	0x400000
++#define CFG_SYS_SDRAM_BASE		0x80000000
 +
-+#ifdef CONFIG_BOOT_RAM
-+#define CONFIG_SKIP_LOWLEVEL_INIT
-+#endif
++#define CFG_SYS_INIT_SP_OFFSET		0x400000
 +
 +/* UART */
-+#define CONFIG_SYS_BAUDRATE_TABLE	{ 9600, 19200, 38400, 57600, 115200, \
++#define CFG_SYS_BAUDRATE_TABLE		{ 9600, 19200, 38400, 57600, 115200, \
 +					  230400, 460800, 921600 }
-+
-+/* RAM */
-+#define CONFIG_SYS_MEMTEST_START	0x80100000
-+#define CONFIG_SYS_MEMTEST_END		0x80400000
-+
-+/* Memory usage */
-+#define CONFIG_SYS_MAXARGS		64
-+#define CONFIG_SYS_BOOTPARAMS_LEN	(128 * 1024)
-+#define CONFIG_SYS_CBSIZE		512
-+
-+/* Environment settings */
-+
-+/*
-+ * Environment is right behind U-Boot in flash. Make sure U-Boot
-+ * doesn't grow into the environment area.
-+ */
-+#define CONFIG_BOARD_SIZE_LIMIT		CONFIG_ENV_OFFSET
-+
 +#endif /* __CONFIG_RAVPOWER_RP_WD009_H */
 --- a/arch/mips/mach-mtmips/mt7628/Kconfig
 +++ b/arch/mips/mach-mtmips/mt7628/Kconfig
diff --git a/package/boot/uboot-mediatek/patches/430-add-bpi-r3.patch b/package/boot/uboot-mediatek/patches/430-add-bpi-r3.patch
index 834fc730b0e4b7..bcd29b974e52e9 100644
--- a/package/boot/uboot-mediatek/patches/430-add-bpi-r3.patch
+++ b/package/boot/uboot-mediatek/patches/430-add-bpi-r3.patch
@@ -1,6 +1,6 @@
 --- a/arch/arm/dts/Makefile
 +++ b/arch/arm/dts/Makefile
-@@ -1211,6 +1211,8 @@ dtb-$(CONFIG_ARCH_MEDIATEK) += \
+@@ -1293,6 +1293,8 @@ dtb-$(CONFIG_ARCH_MEDIATEK) += \
  	mt7981-snfi-nand-rfb.dtb \
  	mt7981-emmc-rfb.dtb \
  	mt7981-sd-rfb.dtb \
@@ -11,13 +11,14 @@
  	mt7986a-sd-rfb.dtb \
 --- /dev/null
 +++ b/configs/mt7986a_bpi-r3-emmc_defconfig
-@@ -0,0 +1,192 @@
+@@ -0,0 +1,196 @@
 +CONFIG_ARM=y
 +CONFIG_POSITION_INDEPENDENT=y
 +CONFIG_ARCH_MEDIATEK=y
 +CONFIG_TARGET_MT7986=y
-+CONFIG_SYS_TEXT_BASE=0x41e00000
++CONFIG_TEXT_BASE=0x41e00000
 +CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
 +CONFIG_NR_DRAM_BANKS=1
 +CONFIG_DEFAULT_DEVICE_TREE="mt7986a-bpi-r3-emmc"
 +CONFIG_DEFAULT_ENV_FILE="bananapi_bpi-r3_emmc_env"
@@ -27,7 +28,6 @@
 +CONFIG_DEBUG_UART_CLOCK=40000000
 +CONFIG_DEBUG_UART=y
 +CONFIG_SYS_LOAD_ADDR=0x46000000
-+CONFIG_NET_RANDOM_ETHADDR=y
 +CONFIG_SMBIOS_PRODUCT_NAME=""
 +CONFIG_AUTOBOOT_KEYED=y
 +CONFIG_BOOTDELAY=30
@@ -200,20 +200,24 @@
 +CONFIG_SPI_FLASH_MTD=y
 +CONFIG_SPI_FLASH_WINBOND=y
 +# CONFIG_SPI_FLASH_USE_4K_SECTORS is not set
-+CONFIG_CMD_MTD=y
 +CONFIG_CMD_SF=y
 +CONFIG_CMD_NAND=y
 +CONFIG_CMD_NAND_TRIMFFS=y
-+# CONFIG_ENABLE_NAND_NMBM is not set
++CONFIG_LMB_MAX_REGIONS=64
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
 --- /dev/null
 +++ b/configs/mt7986a_bpi-r3-nor_defconfig
-@@ -0,0 +1,193 @@
+@@ -0,0 +1,195 @@
 +CONFIG_ARM=y
 +CONFIG_POSITION_INDEPENDENT=y
 +CONFIG_ARCH_MEDIATEK=y
 +CONFIG_TARGET_MT7986=y
-+CONFIG_SYS_TEXT_BASE=0x41e00000
++CONFIG_TEXT_BASE=0x41e00000
 +CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
 +CONFIG_NR_DRAM_BANKS=1
 +CONFIG_DEFAULT_DEVICE_TREE="mt7986a-bpi-r3-emmc"
 +CONFIG_DEFAULT_ENV_FILE="bananapi_bpi-r3_nor_env"
@@ -223,7 +227,6 @@
 +CONFIG_DEBUG_UART_CLOCK=40000000
 +CONFIG_DEBUG_UART=y
 +CONFIG_SYS_LOAD_ADDR=0x46000000
-+CONFIG_NET_RANDOM_ETHADDR=y
 +CONFIG_SMBIOS_PRODUCT_NAME=""
 +CONFIG_AUTOBOOT_KEYED=y
 +CONFIG_BOOTDELAY=30
@@ -397,20 +400,22 @@
 +CONFIG_SPI_FLASH_MTD=y
 +CONFIG_SPI_FLASH_WINBOND=y
 +# CONFIG_SPI_FLASH_USE_4K_SECTORS is not set
-+CONFIG_CMD_MTD=y
 +CONFIG_CMD_SF=y
-+#CONFIG_CMD_NAND=y
-+#CONFIG_CMD_NAND_TRIMFFS=y
-+# CONFIG_ENABLE_NAND_NMBM is not set
++CONFIG_LMB_MAX_REGIONS=64
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
 --- /dev/null
 +++ b/configs/mt7986a_bpi-r3-sd_defconfig
-@@ -0,0 +1,192 @@
+@@ -0,0 +1,196 @@
 +CONFIG_ARM=y
 +CONFIG_POSITION_INDEPENDENT=y
 +CONFIG_ARCH_MEDIATEK=y
 +CONFIG_TARGET_MT7986=y
-+CONFIG_SYS_TEXT_BASE=0x41e00000
++CONFIG_TEXT_BASE=0x41e00000
 +CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
 +CONFIG_NR_DRAM_BANKS=1
 +CONFIG_DEFAULT_DEVICE_TREE="mt7986a-bpi-r3-sd"
 +CONFIG_DEFAULT_ENV_FILE="bananapi_bpi-r3_sdmmc_env"
@@ -420,7 +425,6 @@
 +CONFIG_DEBUG_UART_CLOCK=40000000
 +CONFIG_DEBUG_UART=y
 +CONFIG_SYS_LOAD_ADDR=0x46000000
-+CONFIG_NET_RANDOM_ETHADDR=y
 +CONFIG_SMBIOS_PRODUCT_NAME=""
 +CONFIG_AUTOBOOT_KEYED=y
 +CONFIG_BOOTDELAY=30
@@ -593,20 +597,24 @@
 +CONFIG_SPI_FLASH_MTD=y
 +CONFIG_SPI_FLASH_WINBOND=y
 +# CONFIG_SPI_FLASH_USE_4K_SECTORS is not set
-+CONFIG_CMD_MTD=y
 +CONFIG_CMD_SF=y
 +CONFIG_CMD_NAND=y
 +CONFIG_CMD_NAND_TRIMFFS=y
-+# CONFIG_ENABLE_NAND_NMBM is not set
++CONFIG_LMB_MAX_REGIONS=64
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
 --- /dev/null
 +++ b/configs/mt7986a_bpi-r3-snand_defconfig
-@@ -0,0 +1,193 @@
+@@ -0,0 +1,197 @@
 +CONFIG_ARM=y
 +CONFIG_POSITION_INDEPENDENT=y
 +CONFIG_ARCH_MEDIATEK=y
 +CONFIG_TARGET_MT7986=y
-+CONFIG_SYS_TEXT_BASE=0x41e00000
++CONFIG_TEXT_BASE=0x41e00000
 +CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
 +CONFIG_NR_DRAM_BANKS=1
 +CONFIG_DEFAULT_DEVICE_TREE="mt7986a-bpi-r3-emmc"
 +CONFIG_DEFAULT_ENV_FILE="bananapi_bpi-r3_snand_env"
@@ -616,7 +624,6 @@
 +CONFIG_DEBUG_UART_CLOCK=40000000
 +CONFIG_DEBUG_UART=y
 +CONFIG_SYS_LOAD_ADDR=0x46000000
-+CONFIG_NET_RANDOM_ETHADDR=y
 +CONFIG_SMBIOS_PRODUCT_NAME=""
 +CONFIG_AUTOBOOT_KEYED=y
 +CONFIG_BOOTDELAY=30
@@ -790,11 +797,14 @@
 +#CONFIG_SPI_FLASH_MTD=y
 +#CONFIG_SPI_FLASH_WINBOND=y
 +# CONFIG_SPI_FLASH_USE_4K_SECTORS is not set
-+CONFIG_CMD_MTD=y
 +#CONFIG_CMD_SF=y
 +CONFIG_CMD_NAND=y
 +CONFIG_CMD_NAND_TRIMFFS=y
-+# CONFIG_ENABLE_NAND_NMBM is not set
++CONFIG_LMB_MAX_REGIONS=64
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
 --- /dev/null
 +++ b/arch/arm/dts/mt7986a-bpi-r3-emmc.dts
 @@ -0,0 +1,33 @@
@@ -833,7 +843,7 @@
 +
 --- /dev/null
 +++ b/arch/arm/dts/mt7986a-bpi-r3-sd.dts
-@@ -0,0 +1,269 @@
+@@ -0,0 +1,272 @@
 +// SPDX-License-Identifier: GPL-2.0
 +/*
 + * Copyright (c) 2021 MediaTek Inc.
@@ -841,6 +851,7 @@
 + */
 +
 +/dts-v1/;
++#include <dt-bindings/input/linux-event-codes.h>
 +#include "mt7986.dtsi"
 +#include <dt-bindings/gpio/gpio.h>
 +
@@ -875,6 +886,7 @@
 +		wps {
 +			label = "reset";
 +			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
++			linux,code = <KEY_RESTART>;
 +		};
 +	};
 +
@@ -895,6 +907,7 @@
 +};
 +
 +&uart0 {
++	mediatek,force-highspeed;
 +	status = "okay";
 +};
 +
@@ -1105,7 +1118,7 @@
 +
 --- /dev/null
 +++ b/bananapi_bpi-r3_sdmmc_env
-@@ -0,0 +1,75 @@
+@@ -0,0 +1,80 @@
 +ipaddr=192.168.1.1
 +serverip=192.168.1.254
 +loadaddr=0x46000000
@@ -1113,6 +1126,11 @@
 +bootargs=root=/dev/mmcblk0p65
 +bootcmd=if pstore check ; then run boot_recovery ; else run boot_sdmmc ; fi
 +bootconf=config-mt7986a-bananapi-bpi-r3
++bootconf_base=config-mt7986a-bananapi-bpi-r3
++bootconf_nor=mt7986a-bananapi-bpi-r3-nor
++bootconf_nand=mt7986a-bananapi-bpi-r3-nand
++bootconf_sd=mt7986a-bananapi-bpi-r3-sd
++bootconf_emmc=mt7986a-bananapi-bpi-r3-emmc
 +bootdelay=0
 +bootfile=openwrt-mediatek-filogic-bananapi_bpi-r3-initramfs-recovery.itb
 +bootfile_upg=openwrt-mediatek-filogic-bananapi_bpi-r3-squashfs-sysupgrade.itb
@@ -1133,7 +1151,7 @@
 +bootmenu_7=Install bootloader, recovery and production to NAND.=if nand info ; then run ubi_init ; else echo "NAND not detected" ; fi ; run bootmenu_confirm_return
 +bootmenu_8=Reboot.=reset
 +bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
-+boot_update_conf=if nand info ; then setenv bootconf config-mt7986a-bananapi-bpi-r3-snand ; else if sf probe ; then setenv bootconf config-mt7986a-bananapi-bpi-r3-nor ; else setenv bootconf config-mt7986a-bananapi-bpi-r3 ; fi ; fi
++boot_update_conf=if nand info ; then setenv bootconf $bootconf_base#$bootconf_sd#$bootconf_nand ; else if sf probe ; then setenv bootconf $bootconf_base#$bootconf_sd#$bootconf_nor ; else setenv bootconf $bootconf_base#$bootconf_sd ; fi ; fi
 +boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
 +boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
 +boot_production=led $bootled_pwr on ; run boot_update_conf ; run sdmmc_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
@@ -1143,7 +1161,7 @@
 +boot_tftp_production=run boot_update_conf ; tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run sdmmc_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
 +boot_tftp_recovery=run boot_update_conf ; tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run sdmmc_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
 +boot_tftp=run boot_update_conf ; tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
-+mmc_write_vol=imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc erase 0x$part_addr 0x$part_size && mmc write $loadaddr 0x$part_addr 0x$image_size
++mmc_write_vol=imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc erase 0x$part_addr 0x$image_size && mmc write $loadaddr 0x$part_addr 0x$image_size
 +mmc_read_vol=mmc read $loadaddr $part_addr 0x8 && imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc read $loadaddr 0x$part_addr 0x$image_size && setexpr filesize $image_size * 0x200
 +part_default=production
 +part_recovery=recovery
@@ -1183,14 +1201,19 @@
 +_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
 --- /dev/null
 +++ b/bananapi_bpi-r3_nor_env
-@@ -0,0 +1,55 @@
+@@ -0,0 +1,60 @@
 +ipaddr=192.168.1.1
 +serverip=192.168.1.254
 +loadaddr=0x46000000
 +console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
 +bootargs=root=/dev/mtdblock0p1
 +bootcmd=if pstore check ; then run boot_recovery ; else run boot_nor ; fi
-+bootconf=config-mt7986a-bananapi-bpi-r3-emmc-nor
++bootconf=config-mt7986a-bananapi-bpi-r3
++bootconf_base=config-mt7986a-bananapi-bpi-r3
++bootconf_nor=mt7986a-bananapi-bpi-r3-nor
++bootconf_nand=mt7986a-bananapi-bpi-r3-nand
++bootconf_sd=mt7986a-bananapi-bpi-r3-sd
++bootconf_emmc=mt7986a-bananapi-bpi-r3-emmc
 +bootdelay=0
 +bootfile=openwrt-mediatek-filogic-bananapi_bpi-r3-initramfs-recovery.itb
 +bootfile_bl2=openwrt-mediatek-filogic-bananapi_bpi-r3-nor-preloader.bin
@@ -1225,7 +1248,7 @@
 +boot_tftp=run boot_update_conf ; tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
 +boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run boot_write_fip
 +boot_tftp_write_preloader=tftpboot $loadaddr $bootfile_bl2 && run boot_write_preloader
-+boot_update_conf=if mmc partconf 0 ; then setenv bootconf config-mt7986a-bananapi-bpi-r3-emmc-nor ; else setenv bootconf config-mt7986a-bananapi-bpi-r3-nor ; fi
++boot_update_conf=if mmc partconf 0 ; then setenv bootconf $bootconf_base#$bootconf_nor#$bootconf_emmc ; else setenv bootconf $bootconf_base#$bootconf_nor#$bootconf_sd ; fi
 +boot_nor=run boot_production ; run boot_recovery
 +boot_write_fip=mtd erase fip && mtd write fip $loadaddr
 +boot_write_preloader=mtd erase bl2 && mtd write bl2 $loadaddr
@@ -1241,13 +1264,18 @@
 +_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
 --- /dev/null
 +++ b/bananapi_bpi-r3_snand_env
-@@ -0,0 +1,69 @@
+@@ -0,0 +1,74 @@
 +ipaddr=192.168.1.1
 +serverip=192.168.1.254
 +loadaddr=0x46000000
 +console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
 +bootargs=root=/dev/ubiblock0_2p1
-+bootconf=config-mt7986a-bananapi-bpi-r3-snand
++bootconf=config-mt7986a-bananapi-bpi-r3
++bootconf_base=config-mt7986a-bananapi-bpi-r3
++bootconf_nor=mt7986a-bananapi-bpi-r3-nor
++bootconf_nand=mt7986a-bananapi-bpi-r3-nand
++bootconf_sd=mt7986a-bananapi-bpi-r3-sd
++bootconf_emmc=mt7986a-bananapi-bpi-r3-emmc
 +bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
 +bootdelay=0
 +bootfile=openwrt-mediatek-filogic-bananapi_bpi-r3-initramfs-recovery.itb
@@ -1283,7 +1311,7 @@
 +boot_tftp=run boot_update_conf ; tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
 +boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
 +boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
-+boot_update_conf=if mmc partconf 0 ; then setenv bootconf config-mt7986a-bananapi-bpi-r3-emmc-snand ; else setenv bootconf config-mt7986a-bananapi-bpi-r3-snand ; fi
++boot_update_conf=if mmc partconf 0 ; then setenv bootconf $bootconf_base#$bootconf_nand#$bootconf_emmc ; else setenv bootconf  $bootconf_base#$bootconf_nand#$bootconf_sd ; fi
 +part_default=production
 +part_recovery=recovery
 +reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
@@ -1298,7 +1326,7 @@
 +ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
 +ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic 2 && ubi write $loadaddr fit $filesize
 +ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic 3 && ubi write $loadaddr recovery $filesize
-+mmc_write_vol=imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc erase 0x$part_addr 0x$part_size && mmc write $loadaddr 0x$part_addr 0x$image_size
++mmc_write_vol=imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc erase 0x$part_addr 0x$image_size && mmc write $loadaddr 0x$part_addr 0x$image_size
 +emmc_init=mmc dev 0 && mmc bootbus 0 0 0 0 && run emmc_init_bl && run emmc_init_openwrt ; env default bootcmd ; saveenv ; saveenv
 +emmc_init_bl=run ubi_read_emmc_install && setenv fileaddr $loadaddr && run emmc_write_bl2 && setexpr fileaddr $loadaddr + 0x100000 && run emmc_write_fip && setexpr fileaddr $loadaddr + 0x500000 && run emmc_write_hdr
 +emmc_init_openwrt=run ubi_read_recovery && iminfo $loadaddr && run emmc_write_recovery ; run ubi_read_production && iminfo $loadaddr && run emmc_write_production
@@ -1313,14 +1341,19 @@
 +_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
 --- /dev/null
 +++ b/bananapi_bpi-r3_emmc_env
-@@ -0,0 +1,56 @@
+@@ -0,0 +1,61 @@
 +ipaddr=192.168.1.1
 +serverip=192.168.1.254
 +loadaddr=0x46000000
 +console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
 +bootargs=root=/dev/mmcblk0p65
 +bootcmd=if pstore check ; then run boot_recovery ; else run boot_emmc ; fi
-+bootconf=config-mt7986a-bananapi-bpi-r3-emmc
++bootconf=config-mt7986a-bananapi-bpi-r3
++bootconf_base=config-mt7986a-bananapi-bpi-r3
++bootconf_nor=mt7986a-bananapi-bpi-r3-nor
++bootconf_nand=mt7986a-bananapi-bpi-r3-nand
++bootconf_sd=mt7986a-bananapi-bpi-r3-sd
++bootconf_emmc=mt7986a-bananapi-bpi-r3-emmc
 +bootdelay=0
 +bootfile=openwrt-mediatek-filogic-bananapi_bpi-r3-initramfs-recovery.itb
 +bootfile_bl2=openwrt-mediatek-filogic-bananapi_bpi-r3-emmc-preloader.bin
@@ -1354,8 +1387,8 @@
 +boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run emmc_write_fip
 +boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run emmc_write_bl2
 +boot_tftp=run boot_update_conf ; tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
-+boot_update_conf=if nand info ; then setenv bootconf config-mt7986a-bananapi-bpi-r3-emmc-snand ; else setenv bootconf config-mt7986a-bananapi-bpi-r3-emmc-nor ; fi
-+mmc_write_vol=imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc erase 0x$part_addr 0x$part_size && mmc write $loadaddr 0x$part_addr 0x$image_size
++boot_update_conf=if nand info ; then setenv bootconf $bootconf_base#$bootconf_emmc#$bootconf_nand ; else setenv bootconf $bootconf_base#$bootconf_emmc#$bootconf_nor ; fi
++mmc_write_vol=imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc erase 0x$part_addr 0x$image_size && mmc write $loadaddr 0x$part_addr 0x$image_size
 +mmc_read_vol=mmc read $loadaddr $part_addr 0x8 && imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc read $loadaddr 0x$part_addr 0x$image_size && setexpr filesize $image_size * 0x200
 +part_default=production
 +part_recovery=recovery
diff --git a/package/boot/uboot-mediatek/patches/431-add-xiaomi_redmi-ax6000.patch b/package/boot/uboot-mediatek/patches/431-add-xiaomi_redmi-ax6000.patch
new file mode 100644
index 00000000000000..88e426366ba21d
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/431-add-xiaomi_redmi-ax6000.patch
@@ -0,0 +1,399 @@
+--- /dev/null
++++ b/configs/mt7986_xiaomi_redmi-ax6000_defconfig
+@@ -0,0 +1,179 @@
++CONFIG_ARM=y
++CONFIG_POSITION_INDEPENDENT=y
++CONFIG_ARCH_MEDIATEK=y
++CONFIG_TARGET_MT7986=y
++CONFIG_TEXT_BASE=0x41e00000
++CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_DEFAULT_DEVICE_TREE="mt7986a-xiaomi_redmi-ax6000"
++CONFIG_DEFAULT_ENV_FILE="xiaomi_redmi-ax6000_env"
++CONFIG_DEFAULT_FDT_FILE="mediatek/mt7986a-xiaomi_redmi-ax6000.dtb"
++CONFIG_OF_LIBFDT_OVERLAY=y
++CONFIG_DEBUG_UART_BASE=0x11002000
++CONFIG_DEBUG_UART_CLOCK=40000000
++CONFIG_DEBUG_UART=y
++CONFIG_SYS_LOAD_ADDR=0x46000000
++CONFIG_SMBIOS_PRODUCT_NAME=""
++CONFIG_AUTOBOOT_KEYED=y
++CONFIG_BOOTDELAY=30
++CONFIG_AUTOBOOT_MENU_SHOW=y
++CONFIG_CFB_CONSOLE_ANSI=y
++CONFIG_BOARD_LATE_INIT=y
++CONFIG_BUTTON=y
++CONFIG_BUTTON_GPIO=y
++CONFIG_GPIO_HOG=y
++CONFIG_CMD_ENV_FLAGS=y
++CONFIG_FIT=y
++CONFIG_FIT_ENABLE_SHA256_SUPPORT=y
++# CONFIG_LED is not set
++# CONFIG_LED_BLINK is not set
++# CONFIG_LED_GPIO is not set
++CONFIG_LOGLEVEL=7
++CONFIG_LOG=y
++CONFIG_SYS_PROMPT="MT7986> "
++CONFIG_CMD_BOOTMENU=y
++CONFIG_CMD_BOOTP=y
++CONFIG_CMD_BUTTON=y
++CONFIG_CMD_CACHE=y
++CONFIG_CMD_CDP=y
++CONFIG_CMD_CPU=y
++CONFIG_CMD_DHCP=y
++CONFIG_CMD_DM=y
++CONFIG_CMD_DNS=y
++CONFIG_CMD_ECHO=y
++CONFIG_CMD_ENV_READMEM=y
++CONFIG_CMD_ERASEENV=y
++# CONFIG_CMD_EXT4 is not set
++# CONFIG_CMD_FAT is not set
++CONFIG_CMD_FDT=y
++# CONFIG_CMD_FS_GENERIC is not set
++# CONFIG_CMD_FS_UUID is not set
++CONFIG_CMD_GPIO=y
++# CONFIG_CMD_GPT is not set
++CONFIG_CMD_HASH=y
++CONFIG_CMD_ITEST=y
++# CONFIG_CMD_LED is not set
++CONFIG_CMD_LICENSE=y
++CONFIG_CMD_LINK_LOCAL=y
++# CONFIG_CMD_MBR is not set
++CONFIG_CMD_MTD=y
++# CONFIG_CMD_PCI is not set
++CONFIG_CMD_PSTORE=y
++CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
++CONFIG_CMD_SF_TEST=y
++CONFIG_CMD_PING=y
++CONFIG_CMD_PXE=y
++# CONFIG_CMD_PWM is not set
++CONFIG_CMD_SMC=y
++CONFIG_CMD_TFTPBOOT=y
++CONFIG_CMD_TFTPSRV=y
++CONFIG_CMD_UBI=y
++CONFIG_CMD_UBI_RENAME=y
++CONFIG_CMD_UBIFS=y
++CONFIG_CMD_ASKENV=y
++CONFIG_CMD_PART=y
++CONFIG_CMD_RARP=y
++CONFIG_CMD_SETEXPR=y
++CONFIG_CMD_SLEEP=y
++CONFIG_CMD_SNTP=y
++CONFIG_CMD_SOURCE=y
++CONFIG_CMD_STRINGS=y
++# CONFIG_CMD_USB is not set
++# CONFIG_CMD_FLASH is not set
++CONFIG_CMD_UUID=y
++CONFIG_DISPLAY_CPUINFO=y
++CONFIG_DM_MTD=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_REGULATOR_GPIO=y
++# CONFIG_DM_USB is not set
++# CONFIG_DM_PWM is not set
++# CONFIG_PWM_MTK is not set
++CONFIG_HUSH_PARSER=y
++CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
++CONFIG_SYS_RELOC_GD_ENV_ADDR=y
++CONFIG_VERSION_VARIABLE=y
++CONFIG_PARTITION_UUIDS=y
++CONFIG_NETCONSOLE=y
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_CLK=y
++CONFIG_DM_GPIO=y
++# CONFIG_DM_SCSI is not set
++# CONFIG_AHCI is not set
++CONFIG_PHY=y
++# CONFIG_PHY_MTK_TPHY is not set
++CONFIG_PHY_FIXED=y
++CONFIG_DM_ETH=y
++CONFIG_MEDIATEK_ETH=y
++# CONFIG_PCI is not set
++# CONFIG_MMC is not set
++# CONFIG_DM_MMC is not set
++CONFIG_MTD=y
++CONFIG_MTD_UBI_FASTMAP=y
++# CONFIG_DM_PCI is not set
++# CONFIG_PCIE_MEDIATEK is not set
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++# CONFIG_PINCTRL_MT7622 is not set
++CONFIG_POWER_DOMAIN=y
++CONFIG_PRE_CONSOLE_BUFFER=y
++CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_RAM=y
++CONFIG_DM_SERIAL=y
++CONFIG_MTK_SERIAL=y
++CONFIG_SPI=y
++# CONFIG_I2C is not set
++CONFIG_DM_SPI=y
++CONFIG_MTK_SPI_NAND=y
++CONFIG_MTK_SPI_NAND_MTD=y
++CONFIG_SYSRESET_WATCHDOG=y
++CONFIG_WDT_MTK=y
++CONFIG_LZO=y
++CONFIG_ZSTD=y
++CONFIG_HEXDUMP=y
++CONFIG_RANDOM_UUID=y
++CONFIG_REGEX=y
++# CONFIG_USB is not set
++# CONFIG_USB_HOST is not set
++# CONFIG_USB_XHCI_HCD is not set
++# CONFIG_USB_XHCI_MTK is not set
++# CONFIG_USB_STORAGE is not set
++CONFIG_OF_EMBED=y
++CONFIG_ENV_OVERWRITE=y
++CONFIG_ENV_IS_IN_UBI=y
++CONFIG_ENV_UBI_PART="ubi"
++CONFIG_ENV_SIZE=0x1f000
++CONFIG_ENV_SIZE_REDUND=0x1f000
++CONFIG_ENV_UBI_VOLUME="ubootenv"
++CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_CLK=y
++CONFIG_PHY_FIXED=y
++CONFIG_DM_ETH=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7986=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_SERIAL=y
++CONFIG_MTK_SERIAL=y
++CONFIG_HEXDUMP=y
++CONFIG_USE_DEFAULT_ENV_FILE=y
++CONFIG_MTD_SPI_NAND=y
++CONFIG_MTK_SPIM=y
++CONFIG_CMD_NAND=y
++CONFIG_CMD_NAND_TRIMFFS=y
++CONFIG_LMB_MAX_REGIONS=64
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
+--- /dev/null
++++ b/arch/arm/dts/mt7986a-xiaomi_redmi-ax6000.dts
+@@ -0,0 +1,156 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (c) 2021 MediaTek Inc.
++ * Author: Sam Shih <sam.shih@mediatek.com>
++ */
++
++/dts-v1/;
++#include <dt-bindings/input/linux-event-codes.h>
++#include "mt7986.dtsi"
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	#address-cells = <1>;
++	#size-cells = <1>;
++	model = "Xiaomi Redmi AX6000";
++	compatible = "mediatek,mt7986", "mediatek,mt7986-sd-rfb";
++
++	chosen {
++		stdout-path = &uart0;
++		tick-timer = &timer0;
++	};
++
++	keys {
++		compatible = "gpio-keys";
++		factory {
++			label = "reset";
++			gpios = <&gpio 9 GPIO_ACTIVE_LOW>;
++			linux,code = <KEY_RESTART>;
++		};
++		mesh {
++			label = "mesh";
++			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
++			linux,code = <KEY_WPS_BUTTON>;
++		};
++	};
++};
++
++&uart0 {
++	mediatek,force-highspeed;
++	status = "okay";
++};
++
++&uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart1_pins>;
++	status = "disabled";
++};
++
++&eth {
++	status = "okay";
++	mediatek,gmac-id = <0>;
++	phy-mode = "sgmii";
++	mediatek,switch = "mt7531";
++	reset-gpios = <&gpio 5 GPIO_ACTIVE_HIGH>;
++
++	fixed-link {
++		speed = <1000>;
++		full-duplex;
++	};
++};
++
++&pinctrl {
++	spic_pins: spi1-pins-func-1 {
++		mux {
++			function = "spi";
++			groups = "spi1_2";
++		};
++	};
++
++	uart1_pins: spi1-pins-func-3 {
++		mux {
++			function = "uart";
++			groups = "uart1_2";
++		};
++	};
++
++	spi_flash_pins: spi0-pins-func-1 {
++		mux {
++			function = "flash";
++			groups = "spi0", "spi0_wp_hold";
++		};
++
++		conf-pu {
++			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-up = <MTK_PUPD_SET_R1R0_00>;
++		};
++
++		conf-pd {
++			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-down = <MTK_PUPD_SET_R1R0_00>;
++		};
++	};
++};
++
++&spi0 {
++	#address-cells = <1>;
++	#size-cells = <0>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi_flash_pins>;
++	status = "okay";
++	must_tx;
++	enhance_timing;
++	dma_ext;
++	ipm_design;
++	support_quad;
++	tick_dly = <1>;
++	sample_sel = <0>;
++
++	spi_nand@0 {
++		compatible = "spi-nand";
++		reg = <0>;
++		spi-max-frequency = <52000000>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition@0 {
++				label = "bl2";
++				reg = <0x0 0x80000>;
++			};
++
++			partition@100000 {
++				label = "nvram";
++				reg = <0x100000 0x40000>;
++			};
++
++			partition@140000 {
++				label = "bdata";
++				reg = <0x140000 0x40000>;
++			};
++
++			partition@180000 {
++				label = "factory";
++				reg = <0x180000 0x200000>;
++			};
++
++			partition@380000 {
++				label = "fip";
++				reg = <0x380000 0x200000>;
++			};
++
++			partition@600000 {
++				label = "ubi";
++				reg = <0x580000 0x7a80000>;
++			};
++		};
++	};
++};
++
++&watchdog {
++	status = "disabled";
++};
+--- /dev/null
++++ b/xiaomi_redmi-ax6000_env
+@@ -0,0 +1,55 @@
++ethaddr_factory=mtd read factory 0x40080000 0x0 0x20000 && env readmem -b ethaddr 0x40080004 0x6 ; setenv ethaddr_factory
++ipaddr=192.168.1.1
++serverip=192.168.1.254
++loadaddr=0x46000000
++console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
++bootargs=console=ttyS0,115200n8 console_msg_format=syslog
++bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
++bootconf=config-1
++bootdelay=0
++bootfile=openwrt-mediatek-filogic-xiaomi_redmi-router-ax6000-ubootmod-initramfs-recovery.itb
++bootfile_bl2=openwrt-mediatek-filogic-xiaomi_redmi-router-ax6000-ubootmod-preloader.bin
++bootfile_fip=openwrt-mediatek-filogic-xiaomi_redmi-router-ax6000-ubootmod-bl31-uboot.fip
++bootfile_upg=openwrt-mediatek-filogic-xiaomi_redmi-router-ax6000-ubootmod-squashfs-sysupgrade.itb
++bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
++bootmenu_default=0
++bootmenu_delay=0
++bootmenu_title=      ( ( ( OpenWrt ) ) )
++bootmenu_0=Initialize environment.=run _firstboot
++bootmenu_0d=Run default boot command.=run boot_default
++bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
++bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
++bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
++bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_6=Load BL31+U-Boot FIP via TFTP then write to NAND.=run boot_tftp_write_fip ; run bootmenu_confirm_return
++bootmenu_7=Load BL2 preloader via TFTP then write to NAND.=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
++bootmenu_8=Reboot.=reset
++bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
++boot_first=if button reset ; then run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
++boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
++boot_production=run ubi_read_production && bootm $loadaddr#$bootconf
++boot_recovery=run ubi_read_recovery && bootm $loadaddr#$bootconf
++boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
++boot_tftp_forever=while true ; do run boot_tftp_recovery ; sleep 1 ; done
++boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
++boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
++boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
++part_fit=fit
++reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
++mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
++mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
++ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic 0 ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic 1
++ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
++ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
++ubi_read_production=ubi read $loadaddr $part_fit && iminfo $loadaddr && run ubi_prepare_rootfs
++ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
++ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
++ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
++ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
++_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
++_firstboot=setenv _firstboot ; run ethaddr_factory ; run _switch_to_menu ; run _init_env ; run boot_first
++_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
++_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
diff --git a/package/boot/uboot-mediatek/patches/432-add-tplink-xdr608x.patch b/package/boot/uboot-mediatek/patches/432-add-tplink-xdr608x.patch
new file mode 100644
index 00000000000000..4e876fe20fd89f
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/432-add-tplink-xdr608x.patch
@@ -0,0 +1,929 @@
+--- /dev/null
++++ b/configs/mt7986_tplink_tl-xdr4288_defconfig
+@@ -0,0 +1,182 @@
++CONFIG_ARM=y
++CONFIG_POSITION_INDEPENDENT=y
++CONFIG_ARCH_MEDIATEK=y
++CONFIG_TARGET_MT7986=y
++CONFIG_TEXT_BASE=0x41e00000
++CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_DEFAULT_DEVICE_TREE="mt7986a-tplink-tl-xdr608x"
++CONFIG_DEFAULT_ENV_FILE="tplink_tl-xdr4288_env"
++CONFIG_DEFAULT_FDT_FILE="mediatek/mt7986a-tplink-tl-xdr608x.dtb"
++CONFIG_OF_LIBFDT_OVERLAY=y
++CONFIG_DEBUG_UART_BASE=0x11002000
++CONFIG_DEBUG_UART_CLOCK=40000000
++CONFIG_DEBUG_UART=y
++CONFIG_SYS_LOAD_ADDR=0x46000000
++CONFIG_SMBIOS_PRODUCT_NAME=""
++CONFIG_AUTOBOOT_KEYED=y
++CONFIG_BOOTDELAY=30
++CONFIG_AUTOBOOT_MENU_SHOW=y
++CONFIG_CFB_CONSOLE_ANSI=y
++CONFIG_BOARD_LATE_INIT=y
++CONFIG_BUTTON=y
++CONFIG_BUTTON_GPIO=y
++CONFIG_GPIO_HOG=y
++CONFIG_CMD_ENV_FLAGS=y
++CONFIG_FIT=y
++CONFIG_FIT_ENABLE_SHA256_SUPPORT=y
++CONFIG_LED=y
++CONFIG_LED_BLINK=y
++CONFIG_LED_GPIO=y
++CONFIG_LOGLEVEL=7
++CONFIG_LOG=y
++CONFIG_SYS_PROMPT="MT7986> "
++CONFIG_CMD_BOOTMENU=y
++CONFIG_CMD_BOOTP=y
++CONFIG_CMD_BUTTON=y
++CONFIG_CMD_CACHE=y
++CONFIG_CMD_CDP=y
++CONFIG_CMD_CPU=y
++CONFIG_CMD_DHCP=y
++CONFIG_CMD_DM=y
++CONFIG_CMD_DNS=y
++CONFIG_CMD_ECHO=y
++CONFIG_CMD_ENV_READMEM=y
++CONFIG_CMD_ERASEENV=y
++CONFIG_CMD_EXT4=y
++CONFIG_CMD_FAT=y
++CONFIG_CMD_FDT=y
++CONFIG_CMD_FS_GENERIC=y
++CONFIG_CMD_FS_UUID=y
++CONFIG_CMD_GPIO=y
++CONFIG_CMD_GPT=y
++CONFIG_CMD_HASH=y
++CONFIG_CMD_ITEST=y
++CONFIG_CMD_LED=y
++CONFIG_CMD_LICENSE=y
++CONFIG_CMD_LINK_LOCAL=y
++# CONFIG_CMD_MBR is not set
++CONFIG_CMD_PCI=y
++CONFIG_CMD_PSTORE=y
++CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
++CONFIG_CMD_SF_TEST=y
++CONFIG_CMD_PING=y
++CONFIG_CMD_PXE=y
++CONFIG_CMD_PWM=y
++CONFIG_CMD_SMC=y
++CONFIG_CMD_TFTPBOOT=y
++CONFIG_CMD_TFTPSRV=y
++CONFIG_CMD_UBI=y
++CONFIG_CMD_UBI_RENAME=y
++CONFIG_CMD_UBIFS=y
++CONFIG_CMD_ASKENV=y
++CONFIG_CMD_PART=y
++CONFIG_CMD_RARP=y
++CONFIG_CMD_SETEXPR=y
++CONFIG_CMD_SLEEP=y
++CONFIG_CMD_SNTP=y
++CONFIG_CMD_SOURCE=y
++CONFIG_CMD_STRINGS=y
++CONFIG_CMD_USB=y
++CONFIG_CMD_UUID=y
++CONFIG_DISPLAY_CPUINFO=y
++CONFIG_DM_MTD=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_REGULATOR_GPIO=y
++CONFIG_DM_USB=y
++CONFIG_DM_PWM=y
++CONFIG_PWM_MTK=y
++CONFIG_HUSH_PARSER=y
++CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
++CONFIG_SYS_RELOC_GD_ENV_ADDR=y
++CONFIG_VERSION_VARIABLE=y
++CONFIG_PARTITION_UUIDS=y
++CONFIG_NETCONSOLE=y
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_CLK=y
++CONFIG_DM_GPIO=y
++CONFIG_DM_SCSI=y
++CONFIG_AHCI=y
++CONFIG_AHCI_PCI=y
++CONFIG_SCSI_AHCI=y
++CONFIG_SCSI=y
++CONFIG_CMD_SCSI=y
++CONFIG_PHY=y
++CONFIG_PHY_MTK_TPHY=y
++CONFIG_PHY_FIXED=y
++CONFIG_MTK_AHCI=y
++CONFIG_DM_ETH=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PCI=y
++# CONFIG_MMC is not set
++# CONFIG_DM_MMC is not set
++CONFIG_MTD=y
++CONFIG_MTD_UBI_FASTMAP=y
++CONFIG_DM_PCI=y
++CONFIG_PCIE_MEDIATEK=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7622=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_PRE_CONSOLE_BUFFER=y
++CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_RAM=y
++CONFIG_DM_SERIAL=y
++CONFIG_MTK_SERIAL=y
++CONFIG_SPI=y
++CONFIG_DM_SPI=y
++CONFIG_MTK_SPI_NAND=y
++CONFIG_MTK_SPI_NAND_MTD=y
++CONFIG_SYSRESET_WATCHDOG=y
++CONFIG_WDT_MTK=y
++CONFIG_LZO=y
++CONFIG_ZSTD=y
++CONFIG_HEXDUMP=y
++CONFIG_RANDOM_UUID=y
++CONFIG_REGEX=y
++CONFIG_USB=y
++CONFIG_USB_HOST=y
++CONFIG_USB_XHCI_HCD=y
++CONFIG_USB_XHCI_MTK=y
++CONFIG_USB_STORAGE=y
++CONFIG_OF_EMBED=y
++CONFIG_ENV_OVERWRITE=y
++CONFIG_ENV_IS_IN_UBI=y
++CONFIG_ENV_UBI_PART="ubi"
++CONFIG_ENV_SIZE=0x1f000
++CONFIG_ENV_SIZE_REDUND=0x1f000
++CONFIG_ENV_UBI_VOLUME="ubootenv"
++CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_CLK=y
++CONFIG_PHY_FIXED=y
++CONFIG_DM_ETH=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7986=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_SERIAL=y
++CONFIG_MTK_SERIAL=y
++CONFIG_HEXDUMP=y
++CONFIG_USE_DEFAULT_ENV_FILE=y
++CONFIG_MTD_SPI_NAND=y
++CONFIG_MTK_SPIM=y
++CONFIG_CMD_MTD=y
++CONFIG_CMD_NAND=y
++CONFIG_CMD_NAND_TRIMFFS=y
++CONFIG_LMB_MAX_REGIONS=64
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
+--- /dev/null
++++ b/configs/mt7986_tplink_tl-xdr6086_defconfig
+@@ -0,0 +1,182 @@
++CONFIG_ARM=y
++CONFIG_POSITION_INDEPENDENT=y
++CONFIG_ARCH_MEDIATEK=y
++CONFIG_TARGET_MT7986=y
++CONFIG_TEXT_BASE=0x41e00000
++CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_DEFAULT_DEVICE_TREE="mt7986a-tplink-tl-xdr608x"
++CONFIG_DEFAULT_ENV_FILE="tplink_tl-xdr6086_env"
++CONFIG_DEFAULT_FDT_FILE="mediatek/mt7986a-tplink-tl-xdr608x.dtb"
++CONFIG_OF_LIBFDT_OVERLAY=y
++CONFIG_DEBUG_UART_BASE=0x11002000
++CONFIG_DEBUG_UART_CLOCK=40000000
++CONFIG_DEBUG_UART=y
++CONFIG_SYS_LOAD_ADDR=0x46000000
++CONFIG_SMBIOS_PRODUCT_NAME=""
++CONFIG_AUTOBOOT_KEYED=y
++CONFIG_BOOTDELAY=30
++CONFIG_AUTOBOOT_MENU_SHOW=y
++CONFIG_CFB_CONSOLE_ANSI=y
++CONFIG_BOARD_LATE_INIT=y
++CONFIG_BUTTON=y
++CONFIG_BUTTON_GPIO=y
++CONFIG_GPIO_HOG=y
++CONFIG_CMD_ENV_FLAGS=y
++CONFIG_FIT=y
++CONFIG_FIT_ENABLE_SHA256_SUPPORT=y
++CONFIG_LED=y
++CONFIG_LED_BLINK=y
++CONFIG_LED_GPIO=y
++CONFIG_LOGLEVEL=7
++CONFIG_LOG=y
++CONFIG_SYS_PROMPT="MT7986> "
++CONFIG_CMD_BOOTMENU=y
++CONFIG_CMD_BOOTP=y
++CONFIG_CMD_BUTTON=y
++CONFIG_CMD_CACHE=y
++CONFIG_CMD_CDP=y
++CONFIG_CMD_CPU=y
++CONFIG_CMD_DHCP=y
++CONFIG_CMD_DM=y
++CONFIG_CMD_DNS=y
++CONFIG_CMD_ECHO=y
++CONFIG_CMD_ENV_READMEM=y
++CONFIG_CMD_ERASEENV=y
++CONFIG_CMD_EXT4=y
++CONFIG_CMD_FAT=y
++CONFIG_CMD_FDT=y
++CONFIG_CMD_FS_GENERIC=y
++CONFIG_CMD_FS_UUID=y
++CONFIG_CMD_GPIO=y
++CONFIG_CMD_GPT=y
++CONFIG_CMD_HASH=y
++CONFIG_CMD_ITEST=y
++CONFIG_CMD_LED=y
++CONFIG_CMD_LICENSE=y
++CONFIG_CMD_LINK_LOCAL=y
++# CONFIG_CMD_MBR is not set
++CONFIG_CMD_PCI=y
++CONFIG_CMD_PSTORE=y
++CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
++CONFIG_CMD_SF_TEST=y
++CONFIG_CMD_PING=y
++CONFIG_CMD_PXE=y
++CONFIG_CMD_PWM=y
++CONFIG_CMD_SMC=y
++CONFIG_CMD_TFTPBOOT=y
++CONFIG_CMD_TFTPSRV=y
++CONFIG_CMD_UBI=y
++CONFIG_CMD_UBI_RENAME=y
++CONFIG_CMD_UBIFS=y
++CONFIG_CMD_ASKENV=y
++CONFIG_CMD_PART=y
++CONFIG_CMD_RARP=y
++CONFIG_CMD_SETEXPR=y
++CONFIG_CMD_SLEEP=y
++CONFIG_CMD_SNTP=y
++CONFIG_CMD_SOURCE=y
++CONFIG_CMD_STRINGS=y
++CONFIG_CMD_USB=y
++CONFIG_CMD_UUID=y
++CONFIG_DISPLAY_CPUINFO=y
++CONFIG_DM_MTD=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_REGULATOR_GPIO=y
++CONFIG_DM_USB=y
++CONFIG_DM_PWM=y
++CONFIG_PWM_MTK=y
++CONFIG_HUSH_PARSER=y
++CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
++CONFIG_SYS_RELOC_GD_ENV_ADDR=y
++CONFIG_VERSION_VARIABLE=y
++CONFIG_PARTITION_UUIDS=y
++CONFIG_NETCONSOLE=y
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_CLK=y
++CONFIG_DM_GPIO=y
++CONFIG_DM_SCSI=y
++CONFIG_AHCI=y
++CONFIG_AHCI_PCI=y
++CONFIG_SCSI_AHCI=y
++CONFIG_SCSI=y
++CONFIG_CMD_SCSI=y
++CONFIG_PHY=y
++CONFIG_PHY_MTK_TPHY=y
++CONFIG_PHY_FIXED=y
++CONFIG_MTK_AHCI=y
++CONFIG_DM_ETH=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PCI=y
++# CONFIG_MMC is not set
++# CONFIG_DM_MMC is not set
++CONFIG_MTD=y
++CONFIG_MTD_UBI_FASTMAP=y
++CONFIG_DM_PCI=y
++CONFIG_PCIE_MEDIATEK=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7622=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_PRE_CONSOLE_BUFFER=y
++CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_RAM=y
++CONFIG_DM_SERIAL=y
++CONFIG_MTK_SERIAL=y
++CONFIG_SPI=y
++CONFIG_DM_SPI=y
++CONFIG_MTK_SPI_NAND=y
++CONFIG_MTK_SPI_NAND_MTD=y
++CONFIG_SYSRESET_WATCHDOG=y
++CONFIG_WDT_MTK=y
++CONFIG_LZO=y
++CONFIG_ZSTD=y
++CONFIG_HEXDUMP=y
++CONFIG_RANDOM_UUID=y
++CONFIG_REGEX=y
++CONFIG_USB=y
++CONFIG_USB_HOST=y
++CONFIG_USB_XHCI_HCD=y
++CONFIG_USB_XHCI_MTK=y
++CONFIG_USB_STORAGE=y
++CONFIG_OF_EMBED=y
++CONFIG_ENV_OVERWRITE=y
++CONFIG_ENV_IS_IN_UBI=y
++CONFIG_ENV_UBI_PART="ubi"
++CONFIG_ENV_SIZE=0x1f000
++CONFIG_ENV_SIZE_REDUND=0x1f000
++CONFIG_ENV_UBI_VOLUME="ubootenv"
++CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_CLK=y
++CONFIG_PHY_FIXED=y
++CONFIG_DM_ETH=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7986=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_SERIAL=y
++CONFIG_MTK_SERIAL=y
++CONFIG_HEXDUMP=y
++CONFIG_USE_DEFAULT_ENV_FILE=y
++CONFIG_MTD_SPI_NAND=y
++CONFIG_MTK_SPIM=y
++CONFIG_CMD_MTD=y
++CONFIG_CMD_NAND=y
++CONFIG_CMD_NAND_TRIMFFS=y
++CONFIG_LMB_MAX_REGIONS=64
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
+--- /dev/null
++++ b/configs/mt7986_tplink_tl-xdr6088_defconfig
+@@ -0,0 +1,182 @@
++CONFIG_ARM=y
++CONFIG_POSITION_INDEPENDENT=y
++CONFIG_ARCH_MEDIATEK=y
++CONFIG_TARGET_MT7986=y
++CONFIG_TEXT_BASE=0x41e00000
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
++CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_DEFAULT_DEVICE_TREE="mt7986a-tplink-tl-xdr608x"
++CONFIG_DEFAULT_ENV_FILE="tplink_tl-xdr6088_env"
++CONFIG_DEFAULT_FDT_FILE="mediatek/mt7986a-tplink-tl-xdr608x.dtb"
++CONFIG_OF_LIBFDT_OVERLAY=y
++CONFIG_DEBUG_UART_BASE=0x11002000
++CONFIG_DEBUG_UART_CLOCK=40000000
++CONFIG_DEBUG_UART=y
++CONFIG_SYS_LOAD_ADDR=0x46000000
++CONFIG_SMBIOS_PRODUCT_NAME=""
++CONFIG_AUTOBOOT_KEYED=y
++CONFIG_BOOTDELAY=30
++CONFIG_AUTOBOOT_MENU_SHOW=y
++CONFIG_CFB_CONSOLE_ANSI=y
++CONFIG_BOARD_LATE_INIT=y
++CONFIG_BUTTON=y
++CONFIG_BUTTON_GPIO=y
++CONFIG_GPIO_HOG=y
++CONFIG_CMD_ENV_FLAGS=y
++CONFIG_FIT=y
++CONFIG_FIT_ENABLE_SHA256_SUPPORT=y
++CONFIG_LED=y
++CONFIG_LED_BLINK=y
++CONFIG_LED_GPIO=y
++CONFIG_LOGLEVEL=7
++CONFIG_LOG=y
++CONFIG_SYS_PROMPT="MT7986> "
++CONFIG_CMD_BOOTMENU=y
++CONFIG_CMD_BOOTP=y
++CONFIG_CMD_BUTTON=y
++CONFIG_CMD_CACHE=y
++CONFIG_CMD_CDP=y
++CONFIG_CMD_CPU=y
++CONFIG_CMD_DHCP=y
++CONFIG_CMD_DM=y
++CONFIG_CMD_DNS=y
++CONFIG_CMD_ECHO=y
++CONFIG_CMD_ENV_READMEM=y
++CONFIG_CMD_ERASEENV=y
++CONFIG_CMD_EXT4=y
++CONFIG_CMD_FAT=y
++CONFIG_CMD_FDT=y
++CONFIG_CMD_FS_GENERIC=y
++CONFIG_CMD_FS_UUID=y
++CONFIG_CMD_GPIO=y
++CONFIG_CMD_GPT=y
++CONFIG_CMD_HASH=y
++CONFIG_CMD_ITEST=y
++CONFIG_CMD_LED=y
++CONFIG_CMD_LICENSE=y
++CONFIG_CMD_LINK_LOCAL=y
++# CONFIG_CMD_MBR is not set
++CONFIG_CMD_PCI=y
++CONFIG_CMD_PSTORE=y
++CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
++CONFIG_CMD_SF_TEST=y
++CONFIG_CMD_PING=y
++CONFIG_CMD_PXE=y
++CONFIG_CMD_PWM=y
++CONFIG_CMD_SMC=y
++CONFIG_CMD_TFTPBOOT=y
++CONFIG_CMD_TFTPSRV=y
++CONFIG_CMD_UBI=y
++CONFIG_CMD_UBI_RENAME=y
++CONFIG_CMD_UBIFS=y
++CONFIG_CMD_ASKENV=y
++CONFIG_CMD_PART=y
++CONFIG_CMD_RARP=y
++CONFIG_CMD_SETEXPR=y
++CONFIG_CMD_SLEEP=y
++CONFIG_CMD_SNTP=y
++CONFIG_CMD_SOURCE=y
++CONFIG_CMD_STRINGS=y
++CONFIG_CMD_USB=y
++CONFIG_CMD_UUID=y
++CONFIG_DISPLAY_CPUINFO=y
++CONFIG_DM_MTD=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_REGULATOR_GPIO=y
++CONFIG_DM_USB=y
++CONFIG_DM_PWM=y
++CONFIG_PWM_MTK=y
++CONFIG_HUSH_PARSER=y
++CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
++CONFIG_SYS_RELOC_GD_ENV_ADDR=y
++CONFIG_VERSION_VARIABLE=y
++CONFIG_PARTITION_UUIDS=y
++CONFIG_NETCONSOLE=y
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_CLK=y
++CONFIG_DM_GPIO=y
++CONFIG_DM_SCSI=y
++CONFIG_AHCI=y
++CONFIG_AHCI_PCI=y
++CONFIG_SCSI_AHCI=y
++CONFIG_SCSI=y
++CONFIG_CMD_SCSI=y
++CONFIG_PHY=y
++CONFIG_PHY_MTK_TPHY=y
++CONFIG_PHY_FIXED=y
++CONFIG_MTK_AHCI=y
++CONFIG_DM_ETH=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PCI=y
++# CONFIG_MMC is not set
++# CONFIG_DM_MMC is not set
++CONFIG_MTD=y
++CONFIG_MTD_UBI_FASTMAP=y
++CONFIG_DM_PCI=y
++CONFIG_PCIE_MEDIATEK=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7622=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_PRE_CONSOLE_BUFFER=y
++CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_RAM=y
++CONFIG_DM_SERIAL=y
++CONFIG_MTK_SERIAL=y
++CONFIG_SPI=y
++CONFIG_DM_SPI=y
++CONFIG_MTK_SPI_NAND=y
++CONFIG_MTK_SPI_NAND_MTD=y
++CONFIG_SYSRESET_WATCHDOG=y
++CONFIG_WDT_MTK=y
++CONFIG_LZO=y
++CONFIG_ZSTD=y
++CONFIG_HEXDUMP=y
++CONFIG_RANDOM_UUID=y
++CONFIG_REGEX=y
++CONFIG_USB=y
++CONFIG_USB_HOST=y
++CONFIG_USB_XHCI_HCD=y
++CONFIG_USB_XHCI_MTK=y
++CONFIG_USB_STORAGE=y
++CONFIG_OF_EMBED=y
++CONFIG_ENV_OVERWRITE=y
++CONFIG_ENV_IS_IN_UBI=y
++CONFIG_ENV_UBI_PART="ubi"
++CONFIG_ENV_SIZE=0x1f000
++CONFIG_ENV_SIZE_REDUND=0x1f000
++CONFIG_ENV_UBI_VOLUME="ubootenv"
++CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_CLK=y
++CONFIG_PHY_FIXED=y
++CONFIG_DM_ETH=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7986=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_SERIAL=y
++CONFIG_MTK_SERIAL=y
++CONFIG_HEXDUMP=y
++CONFIG_USE_DEFAULT_ENV_FILE=y
++CONFIG_MTD_SPI_NAND=y
++CONFIG_MTK_SPIM=y
++CONFIG_CMD_MTD=y
++CONFIG_CMD_NAND=y
++CONFIG_CMD_NAND_TRIMFFS=y
++CONFIG_LMB_MAX_REGIONS=64
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
+--- /dev/null
++++ b/arch/arm/dts/mt7986a-tplink-tl-xdr608x.dts
+@@ -0,0 +1,191 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (c) 2021 MediaTek Inc.
++ * Author: Sam Shih <sam.shih@mediatek.com>
++ */
++
++/dts-v1/;
++#include "mt7986.dtsi"
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/input/linux-event-codes.h>
++
++/ {
++	#address-cells = <1>;
++	#size-cells = <1>;
++	model = "TP-Link TL-XDR608x";
++	compatible = "mediatek,mt7986", "mediatek,mt7986-rfb";
++
++	chosen {
++		stdout-path = &uart0;
++		tick-timer = &timer0;
++	};
++
++	keys {
++		compatible = "gpio-keys";
++
++		factory {
++			label = "reset";
++			linux,code = <KEY_RESTART>;
++			gpios = <&gpio 9 GPIO_ACTIVE_LOW>;
++		};
++
++		wps {
++			label = "wps";
++			linux,code = <KEY_WPS_BUTTON>;
++			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
++		};
++
++		turbo {
++			label = "turbo";
++			linux,code = <BTN_1>;
++			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	leds {
++		compatible = "gpio-leds";
++
++		status_red {
++			label = "red:status";
++			gpios = <&gpio 7 GPIO_ACTIVE_HIGH>;
++		};
++
++		status_green {
++			label = "green:status";
++			gpios = <&gpio 8 GPIO_ACTIVE_HIGH>;
++		};
++
++		turbo {
++			label = "green:turbo";
++			gpios = <&gpio 12 GPIO_ACTIVE_HIGH>;
++		};
++	};
++};
++
++&uart0 {
++	mediatek,force-highspeed;
++	status = "okay";
++};
++
++&uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart1_pins>;
++	status = "disabled";
++};
++
++&eth {
++	status = "okay";
++	mediatek,gmac-id = <0>;
++	phy-mode = "sgmii";
++	mediatek,switch = "mt7531";
++	reset-gpios = <&gpio 5 GPIO_ACTIVE_HIGH>;
++
++	fixed-link {
++		speed = <1000>;
++		full-duplex;
++	};
++};
++
++&pinctrl {
++	spi_flash_pins: spi0-pins-func-1 {
++		mux {
++			function = "flash";
++			groups = "spi0", "spi0_wp_hold";
++		};
++
++		conf-pu {
++			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-up = <MTK_PUPD_SET_R1R0_00>;
++		};
++
++		conf-pd {
++			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-down = <MTK_PUPD_SET_R1R0_00>;
++		};
++	};
++
++	spic_pins: spi1-pins-func-1 {
++		mux {
++			function = "spi";
++			groups = "spi1_2";
++		};
++	};
++
++	uart1_pins: spi1-pins-func-3 {
++		mux {
++			function = "uart";
++			groups = "uart1_2";
++		};
++	};
++
++	pwm_pins: pwm0-pins-func-1 {
++		mux {
++			function = "pwm";
++			groups = "pwm0";
++		};
++	};
++};
++
++&pwm {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pwm_pins>;
++	status = "okay";
++};
++
++&spi0 {
++	#address-cells = <1>;
++	#size-cells = <0>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi_flash_pins>;
++	status = "okay";
++	must_tx;
++	enhance_timing;
++	dma_ext;
++	ipm_design;
++	support_quad;
++	tick_dly = <1>;
++	sample_sel = <0>;
++
++	spi_nand@1 {
++		compatible = "spi-nand";
++		reg = <1>;
++		spi-max-frequency = <52000000>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition@0 {
++				label = "bl2";
++				reg = <0x0 0x80000>;
++			};
++
++			partition@100000 {
++				label = "config";
++				reg = <0x100000 0x60000>;
++			};
++
++			partition@160000 {
++				label = "factory";
++				reg = <0x160000 0x60000>;
++			};
++
++			partition@380000 {
++				label = "fip";
++				reg = <0x380000 0x200000>;
++			};
++
++			partition@580000 {
++				label = "ubi";
++				reg = <0x580000 0x7800000>;
++			};
++		};
++	};
++};
++
++&watchdog {
++	status = "disabled";
++};
+--- /dev/null
++++ b/tplink_tl-xdr4288_env
+@@ -0,0 +1,57 @@
++ethaddr_factory=mtd read config 0x40080000 0x0 0x20000 && env readmem -b ethaddr 0x4008001c 0x6 ; setenv ethaddr_factory
++ipaddr=192.168.1.1
++serverip=192.168.1.254
++loadaddr=0x46000000
++console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
++bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
++bootconf=config-1
++bootdelay=0
++bootfile=openwrt-mediatek-filogic-tplink_tl-xdr4288-initramfs-recovery.itb
++bootfile_bl2=openwrt-mediatek-filogic-tplink_tl-xdr4288-preloader.bin
++bootfile_fip=openwrt-mediatek-filogic-tplink_tl-xdr4288-bl31-uboot.fip
++bootfile_upg=openwrt-mediatek-filogic-tplink_tl-xdr4288-squashfs-sysupgrade.itb
++bootled_pwr=green:status
++bootled_rec=red:status
++bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
++bootmenu_default=0
++bootmenu_delay=0
++bootmenu_title=      ( ( ( OpenWrt ) ) )
++bootmenu_0=Initialize environment.=run _firstboot
++bootmenu_0d=Run default boot command.=run boot_default
++bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
++bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
++bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
++bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_6=Load BL31+U-Boot FIP via TFTP then write to NAND.=run boot_tftp_write_fip ; run bootmenu_confirm_return
++bootmenu_7=Load BL2 preloader via TFTP then write to NAND.=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
++bootmenu_8=Reboot.=reset
++bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
++boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
++boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
++boot_production=led $bootled_pwr on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
++boot_recovery=led $bootled_rec on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
++boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
++boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
++boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
++boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
++boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
++part_default=production
++part_recovery=recovery
++reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
++mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
++mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
++ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic 0 || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic 1 || run ubi_format
++ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
++ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
++ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
++ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
++ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
++ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic 2 && ubi write $loadaddr fit $filesize
++ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic 3 && ubi write $loadaddr recovery $filesize
++_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
++_firstboot=setenv _firstboot ; run ethaddr_factory ; run _switch_to_menu ; run _init_env ; run boot_first
++_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
++_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
+--- /dev/null
++++ b/tplink_tl-xdr6086_env
+@@ -0,0 +1,57 @@
++ethaddr_factory=mtd read config 0x40080000 0x0 0x20000 && env readmem -b ethaddr 0x4008001c 0x6 ; setenv ethaddr_factory
++ipaddr=192.168.1.1
++serverip=192.168.1.254
++loadaddr=0x46000000
++console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
++bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
++bootconf=config-1
++bootdelay=0
++bootfile=openwrt-mediatek-filogic-tplink_tl-xdr6086-initramfs-recovery.itb
++bootfile_bl2=openwrt-mediatek-filogic-tplink_tl-xdr6086-preloader.bin
++bootfile_fip=openwrt-mediatek-filogic-tplink_tl-xdr6086-bl31-uboot.fip
++bootfile_upg=openwrt-mediatek-filogic-tplink_tl-xdr6086-squashfs-sysupgrade.itb
++bootled_pwr=green:status
++bootled_rec=red:status
++bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
++bootmenu_default=0
++bootmenu_delay=0
++bootmenu_title=      ( ( ( OpenWrt ) ) )
++bootmenu_0=Initialize environment.=run _firstboot
++bootmenu_0d=Run default boot command.=run boot_default
++bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
++bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
++bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
++bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_6=Load BL31+U-Boot FIP via TFTP then write to NAND.=run boot_tftp_write_fip ; run bootmenu_confirm_return
++bootmenu_7=Load BL2 preloader via TFTP then write to NAND.=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
++bootmenu_8=Reboot.=reset
++bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
++boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
++boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
++boot_production=led $bootled_pwr on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
++boot_recovery=led $bootled_rec on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
++boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
++boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
++boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
++boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
++boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
++part_default=production
++part_recovery=recovery
++reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
++mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
++mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
++ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic 0 || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic 1 || run ubi_format
++ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
++ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
++ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
++ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
++ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
++ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic 2 && ubi write $loadaddr fit $filesize
++ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic 3 && ubi write $loadaddr recovery $filesize
++_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
++_firstboot=setenv _firstboot ; run ethaddr_factory ; run _switch_to_menu ; run _init_env ; run boot_first
++_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
++_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
+--- /dev/null
++++ b/tplink_tl-xdr6088_env
+@@ -0,0 +1,57 @@
++ethaddr_factory=mtd read config 0x40080000 0x0 0x20000 && env readmem -b ethaddr 0x4008001c 0x6 ; setenv ethaddr_factory
++ipaddr=192.168.1.1
++serverip=192.168.1.254
++loadaddr=0x46000000
++console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
++bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
++bootconf=config-1
++bootdelay=0
++bootfile=openwrt-mediatek-filogic-tplink_tl-xdr6088-initramfs-recovery.itb
++bootfile_bl2=openwrt-mediatek-filogic-tplink_tl-xdr6088-preloader.bin
++bootfile_fip=openwrt-mediatek-filogic-tplink_tl-xdr6088-bl31-uboot.fip
++bootfile_upg=openwrt-mediatek-filogic-tplink_tl-xdr6088-squashfs-sysupgrade.itb
++bootled_pwr=green:status
++bootled_rec=red:status
++bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
++bootmenu_default=0
++bootmenu_delay=0
++bootmenu_title=      ( ( ( OpenWrt ) ) )
++bootmenu_0=Initialize environment.=run _firstboot
++bootmenu_0d=Run default boot command.=run boot_default
++bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
++bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
++bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
++bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_6=Load BL31+U-Boot FIP via TFTP then write to NAND.=run boot_tftp_write_fip ; run bootmenu_confirm_return
++bootmenu_7=Load BL2 preloader via TFTP then write to NAND.=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
++bootmenu_8=Reboot.=reset
++bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
++boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
++boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
++boot_production=led $bootled_pwr on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
++boot_recovery=led $bootled_rec on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
++boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
++boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
++boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
++boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
++boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
++part_default=production
++part_recovery=recovery
++reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
++mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
++mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
++ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic 0 || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic 1 || run ubi_format
++ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
++ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
++ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
++ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
++ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
++ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic 2 && ubi write $loadaddr fit $filesize
++ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic 3 && ubi write $loadaddr recovery $filesize
++_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
++_firstboot=setenv _firstboot ; run ethaddr_factory ; run _switch_to_menu ; run _init_env ; run boot_first
++_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
++_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
diff --git a/package/boot/uboot-mediatek/patches/433-add-qihoo_360t7.patch b/package/boot/uboot-mediatek/patches/433-add-qihoo_360t7.patch
new file mode 100644
index 00000000000000..2be7e18c6ec94d
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/433-add-qihoo_360t7.patch
@@ -0,0 +1,420 @@
+--- /dev/null
++++ b/configs/mt7981_qihoo-360t7_defconfig
+@@ -0,0 +1,175 @@
++CONFIG_ARM=y
++CONFIG_POSITION_INDEPENDENT=y
++CONFIG_ARCH_MEDIATEK=y
++CONFIG_TARGET_MT7981=y
++CONFIG_TEXT_BASE=0x41e00000
++CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_DEFAULT_DEVICE_TREE="mt7981_qihoo-360t7"
++CONFIG_DEFAULT_ENV_FILE="qihoo-360t7_env"
++CONFIG_DEFAULT_FDT_FILE="mediatek/mt7981_qihoo-360t7.dtb"
++CONFIG_OF_LIBFDT_OVERLAY=y
++CONFIG_DEBUG_UART_BASE=0x11002000
++CONFIG_DEBUG_UART_CLOCK=40000000
++CONFIG_DEBUG_UART=y
++CONFIG_SYS_LOAD_ADDR=0x46000000
++CONFIG_SMBIOS_PRODUCT_NAME=""
++CONFIG_AUTOBOOT_KEYED=y
++CONFIG_BOOTDELAY=30
++CONFIG_AUTOBOOT_MENU_SHOW=y
++CONFIG_CFB_CONSOLE_ANSI=y
++CONFIG_BOARD_LATE_INIT=y
++CONFIG_BUTTON=y
++CONFIG_BUTTON_GPIO=y
++CONFIG_GPIO_HOG=y
++CONFIG_CMD_ENV_FLAGS=y
++CONFIG_FIT=y
++CONFIG_FIT_ENABLE_SHA256_SUPPORT=y
++CONFIG_LED=y
++CONFIG_LED_BLINK=y
++CONFIG_LED_GPIO=y
++CONFIG_LOGLEVEL=7
++CONFIG_LOG=y
++CONFIG_SYS_PROMPT="MT7981> "
++CONFIG_CMD_BOOTMENU=y
++CONFIG_CMD_BOOTP=y
++CONFIG_CMD_BUTTON=y
++CONFIG_CMD_CACHE=y
++CONFIG_CMD_CDP=y
++CONFIG_CMD_CPU=y
++CONFIG_CMD_DHCP=y
++CONFIG_CMD_DM=y
++CONFIG_CMD_DNS=y
++CONFIG_CMD_ECHO=y
++CONFIG_CMD_ENV_READMEM=y
++CONFIG_CMD_ERASEENV=y
++CONFIG_CMD_EXT4=y
++CONFIG_CMD_FAT=y
++CONFIG_CMD_FDT=y
++CONFIG_CMD_FS_GENERIC=y
++CONFIG_CMD_FS_UUID=y
++CONFIG_CMD_GPIO=y
++CONFIG_CMD_GPT=y
++CONFIG_CMD_HASH=y
++CONFIG_CMD_ITEST=y
++CONFIG_CMD_LED=y
++CONFIG_CMD_LICENSE=y
++CONFIG_CMD_LINK_LOCAL=y
++# CONFIG_CMD_MBR is not set
++CONFIG_CMD_PCI=y
++CONFIG_CMD_PSTORE=y
++CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
++CONFIG_CMD_SF_TEST=y
++CONFIG_CMD_PING=y
++CONFIG_CMD_PXE=y
++CONFIG_CMD_PWM=y
++CONFIG_CMD_SMC=y
++CONFIG_CMD_TFTPBOOT=y
++CONFIG_CMD_TFTPSRV=y
++CONFIG_CMD_UBI=y
++CONFIG_CMD_UBI_RENAME=y
++CONFIG_CMD_UBIFS=y
++CONFIG_CMD_ASKENV=y
++CONFIG_CMD_PART=y
++CONFIG_CMD_RARP=y
++CONFIG_CMD_SETEXPR=y
++CONFIG_CMD_SLEEP=y
++CONFIG_CMD_SNTP=y
++CONFIG_CMD_SOURCE=y
++CONFIG_CMD_STRINGS=y
++CONFIG_CMD_UUID=y
++CONFIG_DISPLAY_CPUINFO=y
++CONFIG_DM_MTD=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_REGULATOR_GPIO=y
++CONFIG_DM_PWM=y
++CONFIG_PWM_MTK=y
++CONFIG_HUSH_PARSER=y
++CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
++CONFIG_SYS_RELOC_GD_ENV_ADDR=y
++CONFIG_VERSION_VARIABLE=y
++CONFIG_PARTITION_UUIDS=y
++CONFIG_NETCONSOLE=y
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_CLK=y
++CONFIG_DM_GPIO=y
++CONFIG_DM_SCSI=y
++CONFIG_AHCI=y
++CONFIG_AHCI_PCI=y
++CONFIG_SCSI_AHCI=y
++CONFIG_SCSI=y
++CONFIG_CMD_SCSI=y
++CONFIG_PHY=y
++CONFIG_PHY_MTK_TPHY=y
++CONFIG_PHY_FIXED=y
++CONFIG_MTK_AHCI=y
++CONFIG_DM_ETH=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PCI=y
++# CONFIG_MMC is not set
++# CONFIG_DM_MMC is not set
++CONFIG_MTD=y
++CONFIG_MTD_UBI_FASTMAP=y
++CONFIG_DM_PCI=y
++CONFIG_PCIE_MEDIATEK=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7622=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_PRE_CONSOLE_BUFFER=y
++CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_RAM=y
++CONFIG_DM_SERIAL=y
++CONFIG_MTK_SERIAL=y
++CONFIG_SPI=y
++CONFIG_DM_SPI=y
++CONFIG_MTK_SPI_NAND=y
++CONFIG_MTK_SPI_NAND_MTD=y
++CONFIG_SYSRESET_WATCHDOG=y
++CONFIG_WDT_MTK=y
++CONFIG_LZO=y
++CONFIG_ZSTD=y
++CONFIG_HEXDUMP=y
++CONFIG_RANDOM_UUID=y
++CONFIG_REGEX=y
++CONFIG_OF_EMBED=y
++CONFIG_ENV_OVERWRITE=y
++CONFIG_ENV_IS_IN_UBI=y
++CONFIG_ENV_UBI_PART="ubi"
++CONFIG_ENV_SIZE=0x1f000
++CONFIG_ENV_SIZE_REDUND=0x1f000
++CONFIG_ENV_UBI_VOLUME="ubootenv"
++CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_CLK=y
++CONFIG_PHY_FIXED=y
++CONFIG_DM_ETH=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7981=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_SERIAL=y
++CONFIG_MTK_SERIAL=y
++CONFIG_HEXDUMP=y
++CONFIG_USE_DEFAULT_ENV_FILE=y
++CONFIG_MTD_SPI_NAND=y
++CONFIG_MTK_SPIM=y
++CONFIG_CMD_MTD=y
++CONFIG_CMD_NAND=y
++CONFIG_CMD_NAND_TRIMFFS=y
++CONFIG_LMB_MAX_REGIONS=64
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
+--- /dev/null
++++ b/arch/arm/dts/mt7981_qihoo-360t7.dts
+@@ -0,0 +1,180 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (c) 2022 MediaTek Inc.
++ * Author: Sam Shih <sam.shih@mediatek.com>
++ */
++
++/dts-v1/;
++#include "mt7981.dtsi"
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/input/linux-event-codes.h>
++
++/ {
++	#address-cells = <1>;
++	#size-cells = <1>;
++	model = "Qihoo 360T7";
++	compatible = "mediatek,mt7981", "mediatek,mt7981-rfb";
++
++	chosen {
++		stdout-path = &uart0;
++		tick-timer = &timer0;
++	};
++
++	keys {
++		compatible = "gpio-keys";
++
++		factory {
++			label = "reset";
++			linux,code = <KEY_RESTART>;
++			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
++		};
++
++		wps {
++			label = "wps";
++			linux,code = <KEY_WPS_BUTTON>;
++			gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	leds {
++		compatible = "gpio-leds";
++
++		status_red {
++			label = "red:status";
++			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
++		};
++
++		status_green {
++			label = "green:status";
++			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
++
++&uart0 {
++	mediatek,force-highspeed;
++	status = "okay";
++};
++
++&uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart1_pins>;
++	status = "disabled";
++};
++
++&eth {
++	status = "okay";
++	mediatek,gmac-id = <0>;
++	phy-mode = "sgmii";
++	mediatek,switch = "mt7531";
++	reset-gpios = <&gpio 39 GPIO_ACTIVE_HIGH>;
++
++	fixed-link {
++		speed = <1000>;
++		full-duplex;
++	};
++};
++
++&pinctrl {
++	spi_flash_pins: spi0-pins-func-1 {
++		mux {
++			function = "flash";
++			groups = "spi0", "spi0_wp_hold";
++		};
++
++		conf-pu {
++			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-up = <MTK_PUPD_SET_R1R0_00>;
++		};
++
++		conf-pd {
++			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-down = <MTK_PUPD_SET_R1R0_00>;
++		};
++	};
++
++	spic_pins: spi1-pins-func-1 {
++		mux {
++			function = "spi";
++			groups = "spi1_1";
++		};
++	};
++
++	uart1_pins: spi1-pins-func-3 {
++		mux {
++			function = "uart";
++			groups = "uart1_2";
++		};
++	};
++
++	pwm_pins: pwm0-pins-func-1 {
++		mux {
++			function = "pwm";
++			groups = "pwm0_1", "pwm1_0";
++		};
++	};
++};
++
++&pwm {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pwm_pins>;
++	status = "okay";
++};
++
++&spi0 {
++	#address-cells = <1>;
++	#size-cells = <0>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi_flash_pins>;
++	status = "okay";
++	must_tx;
++	enhance_timing;
++	dma_ext;
++	ipm_design;
++	support_quad;
++	tick_dly = <2>;
++	sample_sel = <0>;
++
++	spi_nand@0 {
++		compatible = "spi-nand";
++		reg = <0>;
++		spi-max-frequency = <52000000>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition@0 {
++				label = "bl2";
++				reg = <0x0 0x100000>;
++			};
++
++			partition@100000 {
++				label = "orig-env";
++				reg = <0x100000 0x80000>;
++			};
++
++			partition@160000 {
++				label = "factory";
++				reg = <0x180000 0x200000>;
++			};
++
++			partition@380000 {
++				label = "fip";
++				reg = <0x380000 0x200000>;
++			};
++
++			partition@580000 {
++				label = "ubi";
++				reg = <0x580000 0x6c00000>;
++			};
++		};
++	};
++};
++
++&watchdog {
++	status = "disabled";
++};
+--- /dev/null
++++ b/qihoo-360t7_env
+@@ -0,0 +1,56 @@
++ipaddr=192.168.1.1
++serverip=192.168.1.254
++loadaddr=0x46000000
++console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
++bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
++bootconf=config-1
++bootdelay=0
++bootfile=openwrt-mediatek-filogic-qihoo_360t7-initramfs-recovery.itb
++bootfile_bl2=openwrt-mediatek-filogic-qihoo_360t7-preloader.bin
++bootfile_fip=openwrt-mediatek-filogic-qihoo_360t7-bl31-uboot.fip
++bootfile_upg=openwrt-mediatek-filogic-qihoo_360t7-squashfs-sysupgrade.itb
++bootled_pwr=green:status
++bootled_rec=red:status
++bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
++bootmenu_default=0
++bootmenu_delay=0
++bootmenu_title=      ( ( ( OpenWrt ) ) )
++bootmenu_0=Initialize environment.=run _firstboot
++bootmenu_0d=Run default boot command.=run boot_default
++bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
++bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
++bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
++bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_6=Load BL31+U-Boot FIP via TFTP then write to NAND.=run boot_tftp_write_fip ; run bootmenu_confirm_return
++bootmenu_7=Load BL2 preloader via TFTP then write to NAND.=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
++bootmenu_8=Reboot.=reset
++bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
++boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
++boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
++boot_production=led $bootled_pwr on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
++boot_recovery=led $bootled_rec on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
++boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
++boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
++boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
++boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
++boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
++part_default=production
++part_recovery=recovery
++reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
++mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
++mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
++ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic 0 || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic 1 || run ubi_format
++ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
++ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
++ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
++ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
++ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
++ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic 2 && ubi write $loadaddr fit $filesize
++ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic 3 && ubi write $loadaddr recovery $filesize
++_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
++_firstboot=setenv _firstboot ; run _switch_to_menu ; run _init_env ; run boot_first
++_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
++_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
diff --git a/package/boot/uboot-mvebu/Makefile b/package/boot/uboot-mvebu/Makefile
index 5bf5d59b023efd..e3f1582f23fa47 100644
--- a/package/boot/uboot-mvebu/Makefile
+++ b/package/boot/uboot-mvebu/Makefile
@@ -8,10 +8,10 @@
 include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
-PKG_VERSION:=2022.07
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_VERSION:=2023.01
+PKG_RELEASE:=1
 
-PKG_HASH:=92b08eb49c24da14c1adbf70a71ae8f37cc53eeb4230e859ad8b6733d13dcf5e
+PKG_HASH:=69423bad380f89a0916636e89e6dcbd2e4512d584308d922d1039d1e4331950f
 
 include $(INCLUDE_DIR)/u-boot.mk
 include $(INCLUDE_DIR)/package.mk
@@ -26,14 +26,14 @@ define U-Boot/clearfog
   NAME:=SolidRun ClearFog A1
   BUILD_DEVICES:=solidrun_clearfog-base-a1 solidrun_clearfog-pro-a1
   BUILD_SUBTARGET:=cortexa9
-  UBOOT_IMAGE:=u-boot-spl.kwb
+  UBOOT_IMAGE:=u-boot-with-spl.kwb
 endef
 
 define U-Boot/helios4
   NAME:=Kobol Helios 4
   BUILD_DEVICES:=kobol_helios4
   BUILD_SUBTARGET:=cortexa9
-  UBOOT_IMAGE:=u-boot-spl.kwb
+  UBOOT_IMAGE:=u-boot-with-spl.kwb
 endef
 
 define U-Boot/omnia
@@ -41,7 +41,7 @@ define U-Boot/omnia
   BUILD_DEVICES:=cznic_turris-omnia
   BUILD_SUBTARGET:=cortexa9
   UBOOT_CONFIG:=turris_omnia
-  UBOOT_IMAGE:=u-boot-spl.kwb
+  UBOOT_IMAGE:=u-boot-with-spl.kwb
 endef
 
 define U-Boot/espressobin
@@ -55,12 +55,18 @@ define U-Boot/uDPU
   BUILD_SUBTARGET:=cortexa53
 endef
 
+define U-Boot/eDPU
+  NAME:=Methode eDPU
+  BUILD_SUBTARGET:=cortexa53
+endef
+
 UBOOT_TARGETS:= \
 	clearfog \
 	helios4 \
 	omnia \
 	espressobin \
-	uDPU
+	uDPU \
+	eDPU
 
 define Package/u-boot/install
 	$(if $(findstring cortexa53,$(BUILD_SUBTARGET)),,$(Package/u-boot/install/default))
diff --git a/package/boot/uboot-mxs/Makefile b/package/boot/uboot-mxs/Makefile
index 3c908874faa36b..6ae767f67739e7 100644
--- a/package/boot/uboot-mxs/Makefile
+++ b/package/boot/uboot-mxs/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_VERSION:=2020.04
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=5
 
 PKG_HASH:=fe732aaf037d9cc3c0909bad8362af366ae964bbdac6913a34081ff4ad565372
 
@@ -19,6 +19,7 @@ include $(INCLUDE_DIR)/host-build.mk
 
 define U-Boot/Default
   BUILD_TARGET:=mxs
+  BUILD_SUBTARGET:=generic
   UBOOT_IMAGE:=u-boot.sb
   DEFAULT:=y
   HIDDEN:=1
diff --git a/package/boot/uboot-omap/Makefile b/package/boot/uboot-omap/Makefile
index 4c12eec29dcbab..af2327893f0fe5 100644
--- a/package/boot/uboot-omap/Makefile
+++ b/package/boot/uboot-omap/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_VERSION:=2021.07
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=21
 
 PKG_HASH:=312b7eeae44581d1362c3a3f02c28d806647756c82ba8c72241c7cdbe68ba77e
 
@@ -18,6 +18,7 @@ include $(INCLUDE_DIR)/package.mk
 
 define U-Boot/Default
   BUILD_TARGET:=omap
+  BUILD_SUBTARGET:=generic
   UBOOT_IMAGE:=u-boot.img MLO
 endef
 
diff --git a/package/boot/uboot-oxnas/Makefile b/package/boot/uboot-oxnas/Makefile
index 98c6cee8e1e5ca..fc06f01dcbe1e5 100644
--- a/package/boot/uboot-oxnas/Makefile
+++ b/package/boot/uboot-oxnas/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_VERSION:=2014.10
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=16
 
 PKG_HASH:=d3b132a7a9b3f3182b7aad71c2dfbd4fc15bea83e12c76134eb3ffefc07d1c71
 
diff --git a/package/boot/uboot-rockchip/Makefile b/package/boot/uboot-rockchip/Makefile
index 441028fe7f1e98..59b8be84cfb61b 100644
--- a/package/boot/uboot-rockchip/Makefile
+++ b/package/boot/uboot-rockchip/Makefile
@@ -6,7 +6,7 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_VERSION:=2021.07
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=5
 
 PKG_HASH:=312b7eeae44581d1362c3a3f02c28d806647756c82ba8c72241c7cdbe68ba77e
 
@@ -24,55 +24,86 @@ endef
 
 # RK3328 boards
 
-define U-Boot/nanopi-r2s-rk3328
+define U-Boot/rk3328/Default
   BUILD_SUBTARGET:=armv8
+  DEPENDS:=+PACKAGE_u-boot-$(1):arm-trusted-firmware-rockchip
+  ATF:=rk3328_bl31.elf
+  OF_PLATDATA:=$(1)
+endef
+
+define U-Boot/nanopi-r2c-rk3328
+  $(U-Boot/rk3328/Default)
+  NAME:=NanoPi R2C
+  BUILD_DEVICES:= \
+    friendlyarm_nanopi-r2c
+endef
+
+define U-Boot/nanopi-r2s-rk3328
+  $(U-Boot/rk3328/Default)
   NAME:=NanoPi R2S
   BUILD_DEVICES:= \
     friendlyarm_nanopi-r2s
-  DEPENDS:=+PACKAGE_u-boot-nanopi-r2s-rk3328:arm-trusted-firmware-rockchip
-  PKG_BUILD_DEPENDS:=arm-trusted-firmware-rockchip
-  ATF:=rk3328_bl31.elf
-  OF_PLATDATA:=$(1)
 endef
 
+define U-Boot/orangepi-r1-plus-rk3328
+  $(U-Boot/rk3328/Default)
+  NAME:=Orange Pi R1 Plus
+  BUILD_DEVICES:= \
+    xunlong_orangepi-r1-plus
+endef
+
+define U-Boot/orangepi-r1-plus-lts-rk3328
+  $(U-Boot/rk3328/Default)
+  NAME:=Orange Pi R1 Plus LTS
+  BUILD_DEVICES:= \
+    xunlong_orangepi-r1-plus-lts
+endef
+
+define U-Boot/roc-cc-rk3328
+  $(U-Boot/rk3328/Default)
+  NAME:=ROC-RK3328-CC
+  BUILD_DEVICES:= \
+    firefly_roc-rk3328-cc
+endef
 
 # RK3399 boards
 
-define U-Boot/nanopi-r4s-rk3399
+define U-Boot/rk3399/Default
   BUILD_SUBTARGET:=armv8
+  DEPENDS:=+PACKAGE_u-boot-$(1):arm-trusted-firmware-rockchip
+  ATF:=rk3399_bl31.elf
+endef
+
+define U-Boot/nanopi-r4s-rk3399
+  $(U-Boot/rk3399/Default)
   NAME:=NanoPi R4S
   BUILD_DEVICES:= \
     friendlyarm_nanopi-r4s
-  DEPENDS:=+PACKAGE_u-boot-nanopi-r4s-rk3399:arm-trusted-firmware-rockchip
-  PKG_BUILD_DEPENDS:=arm-trusted-firmware-rockchip
-  ATF:=rk3399_bl31.elf
 endef
 
 define U-Boot/rock-pi-4-rk3399
-  BUILD_SUBTARGET:=armv8
+  $(U-Boot/rk3399/Default)
   NAME:=Rock Pi 4
   BUILD_DEVICES:= \
     radxa_rock-pi-4a
-  DEPENDS:=+PACKAGE_u-boot-rock-pi-4-rk3399:arm-trusted-firmware-rockchip
-  PKG_BUILD_DEPENDS:=arm-trusted-firmware-rockchip
-  ATF:=rk3399_bl31.elf
 endef
 
 define U-Boot/rockpro64-rk3399
-  BUILD_SUBTARGET:=armv8
+  $(U-Boot/rk3399/Default)
   NAME:=RockPro64
   BUILD_DEVICES:= \
     pine64_rockpro64
-  DEPENDS:=+PACKAGE_u-boot-rockpro64-rk3399:arm-trusted-firmware-rockchip
-  PKG_BUILD_DEPENDS:=arm-trusted-firmware-rockchip
-  ATF:=rk3399_bl31.elf
 endef
 
 UBOOT_TARGETS := \
   nanopi-r4s-rk3399 \
   rock-pi-4-rk3399 \
   rockpro64-rk3399 \
-  nanopi-r2s-rk3328
+  nanopi-r2c-rk3328 \
+  nanopi-r2s-rk3328 \
+  orangepi-r1-plus-rk3328 \
+  orangepi-r1-plus-lts-rk3328 \
+  roc-cc-rk3328
 
 UBOOT_CONFIGURE_VARS += USE_PRIVATE_LIBGCC=yes
 
diff --git a/package/boot/uboot-rockchip/patches/101-rock64pro-disable-CONFIG_USE_PREBOOT.patch b/package/boot/uboot-rockchip/patches/101-rock64pro-disable-CONFIG_USE_PREBOOT.patch
index f630818358d2f1..174c9ea29c630d 100644
--- a/package/boot/uboot-rockchip/patches/101-rock64pro-disable-CONFIG_USE_PREBOOT.patch
+++ b/package/boot/uboot-rockchip/patches/101-rock64pro-disable-CONFIG_USE_PREBOOT.patch
@@ -17,9 +17,9 @@ Signed-off-by: Marty Jones <mj8263788@gmail.com>
 
 --- a/configs/rockpro64-rk3399_defconfig
 +++ b/configs/rockpro64-rk3399_defconfig
-@@ -12,7 +12,6 @@ CONFIG_SPL_SPI_FLASH_SUPPORT=y
+@@ -12,7 +12,6 @@ CONFIG_DEBUG_UART_CLOCK=24000000
+ CONFIG_SPL_SPI_FLASH_SUPPORT=y
  CONFIG_SPL_SPI_SUPPORT=y
- CONFIG_DEFAULT_DEVICE_TREE="rk3399-rockpro64"
  CONFIG_DEBUG_UART=y
 -CONFIG_USE_PREBOOT=y
  CONFIG_DEFAULT_FDT_FILE="rockchip/rk3399-rockpro64.dtb"
diff --git a/package/boot/uboot-rockchip/patches/102-rockchip-rk3328-Add-support-for-FriendlyARM-NanoPi-R2C.patch b/package/boot/uboot-rockchip/patches/102-rockchip-rk3328-Add-support-for-FriendlyARM-NanoPi-R2C.patch
new file mode 100644
index 00000000000000..bc450b0dd412e2
--- /dev/null
+++ b/package/boot/uboot-rockchip/patches/102-rockchip-rk3328-Add-support-for-FriendlyARM-NanoPi-R2C.patch
@@ -0,0 +1,199 @@
+From 7000a609473ffe14d32c656cdd0ff3ca0d3ecbd7 Mon Sep 17 00:00:00 2001
+From: Tianling Shen <cnsztl@gmail.com>
+Date: Tue, 11 Apr 2023 18:14:49 +0800
+Subject: [PATCH] rockchip: rk3328: Add support for FriendlyARM NanoPi R2C
+
+The NanoPi R2C is a minor variant of NanoPi R2S with the on-board NIC
+chip changed from rtl8211e to yt8521s, and otherwise identical to R2S.
+
+The device tree is taken from the kernel linux-next branch:
+https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=004589ff9df5b75672a78b6c3c4cba93202b14c9
+
+Signed-off-by: Tianling Shen <cnsztl@gmail.com>
+Reviewed-by: Kever Yang <kever.yang@rock-chips.com>
+---
+ arch/arm/dts/Makefile                      |   1 +
+ arch/arm/dts/rk3328-nanopi-r2c-u-boot.dtsi |   3 +
+ arch/arm/dts/rk3328-nanopi-r2c.dts         |  40 ++++++++
+ board/rockchip/evb_rk3328/MAINTAINERS      |   6 ++
+ configs/nanopi-r2c-rk3328_defconfig        | 112 +++++++++++++++++++++
+ 5 files changed, 162 insertions(+)
+ create mode 100644 arch/arm/dts/rk3328-nanopi-r2c-u-boot.dtsi
+ create mode 100644 arch/arm/dts/rk3328-nanopi-r2c.dts
+ create mode 100644 configs/nanopi-r2c-rk3328_defconfig
+
+--- a/arch/arm/dts/Makefile
++++ b/arch/arm/dts/Makefile
+@@ -108,6 +108,7 @@ dtb-$(CONFIG_ROCKCHIP_RK3308) += \
+ 
+ dtb-$(CONFIG_ROCKCHIP_RK3328) += \
+ 	rk3328-evb.dtb \
++	rk3328-nanopi-r2c.dtb \
+ 	rk3328-nanopi-r2s.dtb \
+ 	rk3328-roc-cc.dtb \
+ 	rk3328-rock64.dtb \
+--- /dev/null
++++ b/arch/arm/dts/rk3328-nanopi-r2c-u-boot.dtsi
+@@ -0,0 +1,3 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++
++#include "rk3328-nanopi-r2s-u-boot.dtsi"
+--- /dev/null
++++ b/arch/arm/dts/rk3328-nanopi-r2c.dts
+@@ -0,0 +1,40 @@
++// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
++/*
++ * Copyright (c) 2021 FriendlyElec Computer Tech. Co., Ltd.
++ * (http://www.friendlyarm.com)
++ *
++ * Copyright (c) 2021-2023 Tianling Shen <cnsztl@gmail.com>
++ */
++
++/dts-v1/;
++#include "rk3328-nanopi-r2s.dts"
++
++/ {
++	model = "FriendlyElec NanoPi R2C";
++	compatible = "friendlyarm,nanopi-r2c", "rockchip,rk3328";
++};
++
++&gmac2io {
++	phy-handle = <&yt8521s>;
++	tx_delay = <0x22>;
++	rx_delay = <0x12>;
++
++	mdio {
++		/delete-node/ ethernet-phy@1;
++
++		yt8521s: ethernet-phy@3 {
++			compatible = "ethernet-phy-ieee802.3-c22";
++			reg = <3>;
++
++			motorcomm,clk-out-frequency-hz = <125000000>;
++			motorcomm,keep-pll-enabled;
++			motorcomm,auto-sleep-disabled;
++
++			pinctrl-0 = <&eth_phy_reset_pin>;
++			pinctrl-names = "default";
++			reset-assert-us = <10000>;
++			reset-deassert-us = <50000>;
++			reset-gpios = <&gpio1 RK_PC2 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
+--- a/board/rockchip/evb_rk3328/MAINTAINERS
++++ b/board/rockchip/evb_rk3328/MAINTAINERS
+@@ -5,6 +5,12 @@ F:      board/rockchip/evb_rk3328
+ F:      include/configs/evb_rk3328.h
+ F:      configs/evb-rk3328_defconfig
+ 
++NANOPI-R2C-RK3328
++M:      Tianling Shen <cnsztl@gmail.com>
++S:      Maintained
++F:      configs/nanopi-r2c-rk3328_defconfig
++F:      arch/arm/dts/rk3328-nanopi-r2c-u-boot.dtsi
++
+ NANOPI-R2S-RK3328
+ M:      David Bauer <mail@david-bauer.net>
+ S:      Maintained
+--- /dev/null
++++ b/configs/nanopi-r2c-rk3328_defconfig
+@@ -0,0 +1,98 @@
++CONFIG_ARM=y
++CONFIG_ARCH_ROCKCHIP=y
++CONFIG_SYS_TEXT_BASE=0x00200000
++CONFIG_SPL_GPIO_SUPPORT=y
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_ENV_OFFSET=0x3F8000
++CONFIG_DEFAULT_DEVICE_TREE="rk3328-nanopi-r2c"
++CONFIG_ROCKCHIP_RK3328=y
++CONFIG_TPL_ROCKCHIP_COMMON_BOARD=y
++CONFIG_TPL_LIBCOMMON_SUPPORT=y
++CONFIG_TPL_LIBGENERIC_SUPPORT=y
++CONFIG_SPL_DRIVERS_MISC_SUPPORT=y
++CONFIG_SPL_STACK_R_ADDR=0x600000
++CONFIG_DEBUG_UART_BASE=0xFF130000
++CONFIG_DEBUG_UART_CLOCK=24000000
++CONFIG_DEBUG_UART=y
++CONFIG_TPL_SYS_MALLOC_F_LEN=0x800
++# CONFIG_ANDROID_BOOT_IMAGE is not set
++CONFIG_FIT=y
++CONFIG_FIT_VERBOSE=y
++CONFIG_SPL_LOAD_FIT=y
++CONFIG_DEFAULT_FDT_FILE="rockchip/rk3328-nanopi-r2c.dtb"
++# CONFIG_DISPLAY_CPUINFO is not set
++CONFIG_DISPLAY_BOARDINFO_LATE=y
++CONFIG_MISC_INIT_R=y
++# CONFIG_SPL_RAW_IMAGE_SUPPORT is not set
++CONFIG_TPL_SYS_MALLOC_SIMPLE=y
++CONFIG_SPL_STACK_R=y
++CONFIG_SPL_I2C_SUPPORT=y
++CONFIG_SPL_POWER_SUPPORT=y
++CONFIG_SPL_ATF=y
++CONFIG_SPL_ATF_NO_PLATFORM_PARAM=y
++CONFIG_CMD_BOOTZ=y
++CONFIG_CMD_GPT=y
++CONFIG_CMD_MMC=y
++CONFIG_CMD_USB=y
++# CONFIG_CMD_SETEXPR is not set
++CONFIG_CMD_TIME=y
++CONFIG_SPL_OF_CONTROL=y
++CONFIG_TPL_OF_CONTROL=y
++CONFIG_OF_SPL_REMOVE_PROPS="clock-names interrupt-parent assigned-clocks assigned-clock-rates assigned-clock-parents"
++CONFIG_TPL_OF_PLATDATA=y
++CONFIG_ENV_IS_IN_MMC=y
++CONFIG_SYS_RELOC_GD_ENV_ADDR=y
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_TPL_DM=y
++CONFIG_REGMAP=y
++CONFIG_SPL_REGMAP=y
++CONFIG_TPL_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_SPL_SYSCON=y
++CONFIG_TPL_SYSCON=y
++CONFIG_CLK=y
++CONFIG_SPL_CLK=y
++CONFIG_FASTBOOT_BUF_ADDR=0x800800
++CONFIG_FASTBOOT_CMD_OEM_FORMAT=y
++CONFIG_ROCKCHIP_GPIO=y
++CONFIG_SYS_I2C_ROCKCHIP=y
++CONFIG_MMC_DW=y
++CONFIG_MMC_DW_ROCKCHIP=y
++CONFIG_SF_DEFAULT_SPEED=20000000
++CONFIG_DM_ETH=y
++CONFIG_ETH_DESIGNWARE=y
++CONFIG_GMAC_ROCKCHIP=y
++CONFIG_PINCTRL=y
++CONFIG_SPL_PINCTRL=y
++CONFIG_DM_PMIC=y
++CONFIG_PMIC_RK8XX=y
++CONFIG_SPL_DM_REGULATOR=y
++CONFIG_REGULATOR_PWM=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_SPL_DM_REGULATOR_FIXED=y
++CONFIG_REGULATOR_RK8XX=y
++CONFIG_PWM_ROCKCHIP=y
++CONFIG_RAM=y
++CONFIG_SPL_RAM=y
++CONFIG_TPL_RAM=y
++CONFIG_DM_RESET=y
++CONFIG_BAUDRATE=1500000
++CONFIG_DEBUG_UART_SHIFT=2
++CONFIG_SYSINFO=y
++CONFIG_SYSRESET=y
++# CONFIG_TPL_SYSRESET is not set
++CONFIG_USB=y
++CONFIG_USB_XHCI_HCD=y
++CONFIG_USB_XHCI_DWC3=y
++CONFIG_USB_EHCI_HCD=y
++CONFIG_USB_EHCI_GENERIC=y
++CONFIG_USB_OHCI_HCD=y
++CONFIG_USB_OHCI_GENERIC=y
++CONFIG_USB_DWC2=y
++CONFIG_USB_DWC3=y
++# CONFIG_USB_DWC3_GADGET is not set
++CONFIG_USB_GADGET=y
++CONFIG_USB_GADGET_DWC2_OTG=y
++CONFIG_SPL_TINY_MEMSET=y
++CONFIG_TPL_TINY_MEMSET=y
++CONFIG_ERRNO_STR=y
diff --git a/package/boot/uboot-rockchip/patches/103-rockchip-rk3328-Add-support-for-Orange-Pi-R1-Plus.patch b/package/boot/uboot-rockchip/patches/103-rockchip-rk3328-Add-support-for-Orange-Pi-R1-Plus.patch
new file mode 100644
index 00000000000000..ff17559c2fe6b0
--- /dev/null
+++ b/package/boot/uboot-rockchip/patches/103-rockchip-rk3328-Add-support-for-Orange-Pi-R1-Plus.patch
@@ -0,0 +1,564 @@
+From ff312af37d5f263f181468639aab83f645d331f1 Mon Sep 17 00:00:00 2001
+From: Tianling Shen <cnsztl@gmail.com>
+Date: Sat, 20 May 2023 18:50:38 +0800
+Subject: [PATCH] rockchip: rk3328: Add support for Orange Pi R1 Plus
+
+Orange Pi R1 Plus is a Rockchip RK3328 based SBC by Xunlong.
+
+This device is similar to the NanoPi R2S, and has a 16MB
+SPI NOR (mx25l12805d). The reset button is changed to
+directly reset the power supply, another detail is that
+both network ports have independent MAC addresses.
+
+The device tree and description are taken from kernel v6.3-rc1.
+
+Reviewed-by: Kever Yang <kever.yang@rock-chips.com>
+Signed-off-by: Tianling Shen <cnsztl@gmail.com>
+---
+ arch/arm/dts/Makefile                         |   1 +
+ .../dts/rk3328-orangepi-r1-plus-u-boot.dtsi   |  46 +++
+ arch/arm/dts/rk3328-orangepi-r1-plus.dts      | 373 ++++++++++++++++++
+ board/rockchip/evb_rk3328/MAINTAINERS         |   6 +
+ configs/orangepi-r1-plus-rk3328_defconfig     | 114 ++++++
+ 5 files changed, 540 insertions(+)
+ create mode 100644 arch/arm/dts/rk3328-orangepi-r1-plus-u-boot.dtsi
+ create mode 100644 arch/arm/dts/rk3328-orangepi-r1-plus.dts
+ create mode 100644 configs/orangepi-r1-plus-rk3328_defconfig
+
+--- a/arch/arm/dts/Makefile
++++ b/arch/arm/dts/Makefile
+@@ -110,6 +110,7 @@ dtb-$(CONFIG_ROCKCHIP_RK3328) += \
+ 	rk3328-evb.dtb \
+ 	rk3328-nanopi-r2c.dtb \
+ 	rk3328-nanopi-r2s.dtb \
++	rk3328-orangepi-r1-plus.dtb \
+ 	rk3328-roc-cc.dtb \
+ 	rk3328-rock64.dtb \
+ 	rk3328-rock-pi-e.dtb
+--- /dev/null
++++ b/arch/arm/dts/rk3328-orangepi-r1-plus-u-boot.dtsi
+@@ -0,0 +1,46 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * (C) Copyright 2018-2019 Rockchip Electronics Co., Ltd
++ * (C) Copyright 2020 David Bauer
++ */
++
++#include "rk3328-u-boot.dtsi"
++#include "rk3328-sdram-ddr4-666.dtsi"
++/ {
++	chosen {
++		u-boot,spl-boot-order = "same-as-spl", &sdmmc, &emmc;
++	};
++};
++
++&gpio0 {
++	u-boot,dm-spl;
++};
++
++&pinctrl {
++	u-boot,dm-spl;
++};
++
++&sdmmc0m1_gpio {
++	u-boot,dm-spl;
++};
++
++&pcfg_pull_up_4ma {
++	u-boot,dm-spl;
++};
++
++/* Need this and all the pinctrl/gpio stuff above to set pinmux */
++&vcc_sd {
++	u-boot,dm-spl;
++};
++
++&gmac2io {
++	snps,reset-gpio = <&gpio1 RK_PC2 GPIO_ACTIVE_LOW>;
++	snps,reset-active-low;
++	snps,reset-delays-us = <0 10000 50000>;
++};
++
++&spi0 {
++	spi_flash: spiflash@0 {
++		u-boot,dm-pre-reloc;
++	};
++};
+--- /dev/null
++++ b/arch/arm/dts/rk3328-orangepi-r1-plus.dts
+@@ -0,0 +1,359 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Based on rk3328-nanopi-r2s.dts, which is:
++ *   Copyright (c) 2020 David Bauer <mail@david-bauer.net>
++ */
++
++/dts-v1/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/leds/common.h>
++#include "rk3328.dtsi"
++
++/ {
++	model = "Xunlong Orange Pi R1 Plus";
++	compatible = "xunlong,orangepi-r1-plus", "rockchip,rk3328";
++
++	aliases {
++		mmc0 = &sdmmc;
++	};
++
++	chosen {
++		stdout-path = "serial2:1500000n8";
++	};
++
++	gmac_clk: gmac-clock {
++		compatible = "fixed-clock";
++		clock-frequency = <125000000>;
++		clock-output-names = "gmac_clkin";
++		#clock-cells = <0>;
++	};
++
++	leds {
++		compatible = "gpio-leds";
++		pinctrl-0 = <&lan_led_pin>, <&sys_led_pin>, <&wan_led_pin>;
++		pinctrl-names = "default";
++
++		led-0 {
++			function = LED_FUNCTION_LAN;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&gpio2 RK_PB7 GPIO_ACTIVE_HIGH>;
++		};
++
++		led-1 {
++			function = LED_FUNCTION_STATUS;
++			color = <LED_COLOR_ID_RED>;
++			gpios = <&gpio3 RK_PC5 GPIO_ACTIVE_HIGH>;
++			linux,default-trigger = "heartbeat";
++		};
++
++		led-2 {
++			function = LED_FUNCTION_WAN;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&gpio2 RK_PC2 GPIO_ACTIVE_HIGH>;
++		};
++	};
++
++	vcc_sd: sdmmc-regulator {
++		compatible = "regulator-fixed";
++		gpio = <&gpio0 RK_PD6 GPIO_ACTIVE_LOW>;
++		pinctrl-0 = <&sdmmc0m1_gpio>;
++		pinctrl-names = "default";
++		regulator-name = "vcc_sd";
++		regulator-boot-on;
++		vin-supply = <&vcc_io>;
++	};
++
++	vcc_sys: vcc-sys-regulator {
++		compatible = "regulator-fixed";
++		regulator-name = "vcc_sys";
++		regulator-always-on;
++		regulator-boot-on;
++		regulator-min-microvolt = <5000000>;
++		regulator-max-microvolt = <5000000>;
++	};
++
++	vdd_5v_lan: vdd-5v-lan-regulator {
++		compatible = "regulator-fixed";
++		enable-active-high;
++		gpio = <&gpio2 RK_PC6 GPIO_ACTIVE_HIGH>;
++		pinctrl-0 = <&lan_vdd_pin>;
++		pinctrl-names = "default";
++		regulator-name = "vdd_5v_lan";
++		regulator-always-on;
++		regulator-boot-on;
++		vin-supply = <&vcc_sys>;
++	};
++};
++
++&cpu0 {
++	cpu-supply = <&vdd_arm>;
++};
++
++&cpu1 {
++	cpu-supply = <&vdd_arm>;
++};
++
++&cpu2 {
++	cpu-supply = <&vdd_arm>;
++};
++
++&cpu3 {
++	cpu-supply = <&vdd_arm>;
++};
++
++&display_subsystem {
++	status = "disabled";
++};
++
++&gmac2io {
++	assigned-clocks = <&cru SCLK_MAC2IO>, <&cru SCLK_MAC2IO_EXT>;
++	assigned-clock-parents = <&gmac_clk>, <&gmac_clk>;
++	clock_in_out = "input";
++	phy-handle = <&rtl8211e>;
++	phy-mode = "rgmii";
++	phy-supply = <&vcc_io>;
++	pinctrl-0 = <&rgmiim1_pins>;
++	pinctrl-names = "default";
++	snps,aal;
++	rx_delay = <0x18>;
++	tx_delay = <0x24>;
++	status = "okay";
++
++	mdio {
++		compatible = "snps,dwmac-mdio";
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		rtl8211e: ethernet-phy@1 {
++			reg = <1>;
++			pinctrl-0 = <&eth_phy_reset_pin>;
++			pinctrl-names = "default";
++			reset-assert-us = <10000>;
++			reset-deassert-us = <50000>;
++			reset-gpios = <&gpio1 RK_PC2 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
++
++&i2c1 {
++	status = "okay";
++
++	rk805: pmic@18 {
++		compatible = "rockchip,rk805";
++		reg = <0x18>;
++		interrupt-parent = <&gpio1>;
++		interrupts = <24 IRQ_TYPE_LEVEL_LOW>;
++		#clock-cells = <1>;
++		clock-output-names = "xin32k", "rk805-clkout2";
++		gpio-controller;
++		#gpio-cells = <2>;
++		pinctrl-0 = <&pmic_int_l>;
++		pinctrl-names = "default";
++		rockchip,system-power-controller;
++		wakeup-source;
++
++		vcc1-supply = <&vcc_sys>;
++		vcc2-supply = <&vcc_sys>;
++		vcc3-supply = <&vcc_sys>;
++		vcc4-supply = <&vcc_sys>;
++		vcc5-supply = <&vcc_io>;
++		vcc6-supply = <&vcc_sys>;
++
++		regulators {
++			vdd_log: DCDC_REG1 {
++				regulator-name = "vdd_log";
++				regulator-always-on;
++				regulator-boot-on;
++				regulator-min-microvolt = <712500>;
++				regulator-max-microvolt = <1450000>;
++				regulator-ramp-delay = <12500>;
++
++				regulator-state-mem {
++					regulator-on-in-suspend;
++					regulator-suspend-microvolt = <1000000>;
++				};
++			};
++
++			vdd_arm: DCDC_REG2 {
++				regulator-name = "vdd_arm";
++				regulator-always-on;
++				regulator-boot-on;
++				regulator-min-microvolt = <712500>;
++				regulator-max-microvolt = <1450000>;
++				regulator-ramp-delay = <12500>;
++
++				regulator-state-mem {
++					regulator-on-in-suspend;
++					regulator-suspend-microvolt = <950000>;
++				};
++			};
++
++			vcc_ddr: DCDC_REG3 {
++				regulator-name = "vcc_ddr";
++				regulator-always-on;
++				regulator-boot-on;
++
++				regulator-state-mem {
++					regulator-on-in-suspend;
++				};
++			};
++
++			vcc_io: DCDC_REG4 {
++				regulator-name = "vcc_io";
++				regulator-always-on;
++				regulator-boot-on;
++				regulator-min-microvolt = <3300000>;
++				regulator-max-microvolt = <3300000>;
++
++				regulator-state-mem {
++					regulator-on-in-suspend;
++					regulator-suspend-microvolt = <3300000>;
++				};
++			};
++
++			vcc_18: LDO_REG1 {
++				regulator-name = "vcc_18";
++				regulator-always-on;
++				regulator-boot-on;
++				regulator-min-microvolt = <1800000>;
++				regulator-max-microvolt = <1800000>;
++
++				regulator-state-mem {
++					regulator-on-in-suspend;
++					regulator-suspend-microvolt = <1800000>;
++				};
++			};
++
++			vcc18_emmc: LDO_REG2 {
++				regulator-name = "vcc18_emmc";
++				regulator-always-on;
++				regulator-boot-on;
++				regulator-min-microvolt = <1800000>;
++				regulator-max-microvolt = <1800000>;
++
++				regulator-state-mem {
++					regulator-on-in-suspend;
++					regulator-suspend-microvolt = <1800000>;
++				};
++			};
++
++			vdd_10: LDO_REG3 {
++				regulator-name = "vdd_10";
++				regulator-always-on;
++				regulator-boot-on;
++				regulator-min-microvolt = <1000000>;
++				regulator-max-microvolt = <1000000>;
++
++				regulator-state-mem {
++					regulator-on-in-suspend;
++					regulator-suspend-microvolt = <1000000>;
++				};
++			};
++		};
++	};
++};
++
++&io_domains {
++	pmuio-supply = <&vcc_io>;
++	vccio1-supply = <&vcc_io>;
++	vccio2-supply = <&vcc18_emmc>;
++	vccio3-supply = <&vcc_io>;
++	vccio4-supply = <&vcc_io>;
++	vccio5-supply = <&vcc_io>;
++	vccio6-supply = <&vcc_io>;
++	status = "okay";
++};
++
++&pinctrl {
++	gmac2io {
++		eth_phy_reset_pin: eth-phy-reset-pin {
++			rockchip,pins = <1 RK_PC2 RK_FUNC_GPIO &pcfg_pull_down>;
++		};
++	};
++
++	leds {
++		lan_led_pin: lan-led-pin {
++			rockchip,pins = <2 RK_PB7 RK_FUNC_GPIO &pcfg_pull_none>;
++		};
++
++		sys_led_pin: sys-led-pin {
++			rockchip,pins = <3 RK_PC5 RK_FUNC_GPIO &pcfg_pull_none>;
++		};
++
++		wan_led_pin: wan-led-pin {
++			rockchip,pins = <2 RK_PC2 RK_FUNC_GPIO &pcfg_pull_none>;
++		};
++	};
++
++	lan {
++		lan_vdd_pin: lan-vdd-pin {
++			rockchip,pins = <2 RK_PC6 RK_FUNC_GPIO &pcfg_pull_none>;
++		};
++	};
++
++	pmic {
++		pmic_int_l: pmic-int-l {
++			rockchip,pins = <1 RK_PD0 RK_FUNC_GPIO &pcfg_pull_up>;
++		};
++	};
++};
++
++&pwm2 {
++	status = "okay";
++};
++
++&sdmmc {
++	bus-width = <4>;
++	cap-sd-highspeed;
++	disable-wp;
++	pinctrl-0 = <&sdmmc0_clk>, <&sdmmc0_cmd>, <&sdmmc0_dectn>, <&sdmmc0_bus4>;
++	pinctrl-names = "default";
++	vmmc-supply = <&vcc_sd>;
++	status = "okay";
++};
++
++&spi0 {
++	status = "okay";
++
++	flash@0 {
++		compatible = "jedec,spi-nor";
++		reg = <0>;
++		spi-max-frequency = <50000000>;
++	};
++};
++
++&tsadc {
++	rockchip,hw-tshut-mode = <0>;
++	rockchip,hw-tshut-polarity = <0>;
++	status = "okay";
++};
++
++&u2phy {
++	status = "okay";
++};
++
++&u2phy_host {
++	status = "okay";
++};
++
++&u2phy_otg {
++	status = "okay";
++};
++
++&uart2 {
++	status = "okay";
++};
++
++&usb20_otg {
++	dr_mode = "host";
++	status = "okay";
++};
++
++&usb_host0_ehci {
++	status = "okay";
++};
++
++&usb_host0_ohci {
++	status = "okay";
++};
+--- a/board/rockchip/evb_rk3328/MAINTAINERS
++++ b/board/rockchip/evb_rk3328/MAINTAINERS
+@@ -18,6 +18,12 @@ F:      configs/nanopi-r2s-rk3328_defcon
+ F:      arch/arm/dts/rk3328-nanopi-r2s-u-boot.dtsi
+ F:      arch/arm/dts/rk3328-nanopi-r2s.dts
+ 
++ORANGEPI-R1-PLUS-RK3328
++M:      Tianling Shen <cnsztl@gmail.com>
++S:      Maintained
++F:      configs/orangepi-r1-plus-rk3328_defconfig
++F:      arch/arm/dts/rk3328-orangepi-r1-plus-u-boot.dtsi
++
+ ROC-RK3328-CC
+ M:      Loic Devulder <ldevulder@suse.com>
+ M:      Chen-Yu Tsai <wens@csie.org>
+--- /dev/null
++++ b/configs/orangepi-r1-plus-rk3328_defconfig
+@@ -0,0 +1,98 @@
++CONFIG_ARM=y
++CONFIG_ARCH_ROCKCHIP=y
++CONFIG_SYS_TEXT_BASE=0x00200000
++CONFIG_SPL_GPIO_SUPPORT=y
++CONFIG_ENV_OFFSET=0x3F8000
++CONFIG_ROCKCHIP_RK3328=y
++CONFIG_TPL_ROCKCHIP_COMMON_BOARD=y
++CONFIG_TPL_LIBCOMMON_SUPPORT=y
++CONFIG_TPL_LIBGENERIC_SUPPORT=y
++CONFIG_SPL_DRIVERS_MISC_SUPPORT=y
++CONFIG_SPL_STACK_R_ADDR=0x600000
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_DEBUG_UART_BASE=0xFF130000
++CONFIG_DEBUG_UART_CLOCK=24000000
++CONFIG_SYSINFO=y
++CONFIG_DEBUG_UART=y
++CONFIG_TPL_SYS_MALLOC_F_LEN=0x800
++# CONFIG_ANDROID_BOOT_IMAGE is not set
++CONFIG_FIT=y
++CONFIG_FIT_VERBOSE=y
++CONFIG_SPL_LOAD_FIT=y
++CONFIG_DEFAULT_FDT_FILE="rockchip/rk3328-orangepi-r1-plus.dtb"
++CONFIG_MISC_INIT_R=y
++# CONFIG_DISPLAY_CPUINFO is not set
++CONFIG_DISPLAY_BOARDINFO_LATE=y
++# CONFIG_SPL_RAW_IMAGE_SUPPORT is not set
++CONFIG_TPL_SYS_MALLOC_SIMPLE=y
++CONFIG_SPL_STACK_R=y
++CONFIG_SPL_I2C_SUPPORT=y
++CONFIG_SPL_POWER_SUPPORT=y
++CONFIG_SPL_ATF=y
++CONFIG_SPL_ATF_NO_PLATFORM_PARAM=y
++CONFIG_CMD_BOOTZ=y
++CONFIG_CMD_GPT=y
++CONFIG_CMD_MMC=y
++CONFIG_CMD_USB=y
++# CONFIG_CMD_SETEXPR is not set
++CONFIG_CMD_TIME=y
++CONFIG_SPL_OF_CONTROL=y
++CONFIG_TPL_OF_CONTROL=y
++CONFIG_DEFAULT_DEVICE_TREE="rk3328-orangepi-r1-plus"
++CONFIG_OF_SPL_REMOVE_PROPS="clock-names interrupt-parent assigned-clocks assigned-clock-rates assigned-clock-parents"
++CONFIG_TPL_OF_PLATDATA=y
++CONFIG_ENV_IS_IN_MMC=y
++CONFIG_SYS_RELOC_GD_ENV_ADDR=y
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_TPL_DM=y
++CONFIG_REGMAP=y
++CONFIG_SPL_REGMAP=y
++CONFIG_TPL_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_SPL_SYSCON=y
++CONFIG_TPL_SYSCON=y
++CONFIG_CLK=y
++CONFIG_SPL_CLK=y
++CONFIG_FASTBOOT_BUF_ADDR=0x800800
++CONFIG_FASTBOOT_CMD_OEM_FORMAT=y
++CONFIG_ROCKCHIP_GPIO=y
++CONFIG_SYS_I2C_ROCKCHIP=y
++CONFIG_MMC_DW=y
++CONFIG_MMC_DW_ROCKCHIP=y
++CONFIG_SF_DEFAULT_SPEED=20000000
++CONFIG_DM_ETH=y
++CONFIG_ETH_DESIGNWARE=y
++CONFIG_GMAC_ROCKCHIP=y
++CONFIG_PINCTRL=y
++CONFIG_SPL_PINCTRL=y
++CONFIG_DM_PMIC=y
++CONFIG_PMIC_RK8XX=y
++CONFIG_SPL_DM_REGULATOR=y
++CONFIG_REGULATOR_PWM=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_SPL_DM_REGULATOR_FIXED=y
++CONFIG_REGULATOR_RK8XX=y
++CONFIG_PWM_ROCKCHIP=y
++CONFIG_RAM=y
++CONFIG_SPL_RAM=y
++CONFIG_TPL_RAM=y
++CONFIG_DM_RESET=y
++CONFIG_BAUDRATE=1500000
++CONFIG_DEBUG_UART_SHIFT=2
++CONFIG_SYSRESET=y
++# CONFIG_TPL_SYSRESET is not set
++CONFIG_USB=y
++CONFIG_USB_XHCI_HCD=y
++CONFIG_USB_XHCI_DWC3=y
++CONFIG_USB_EHCI_HCD=y
++CONFIG_USB_EHCI_GENERIC=y
++CONFIG_USB_OHCI_HCD=y
++CONFIG_USB_OHCI_GENERIC=y
++CONFIG_USB_DWC2=y
++CONFIG_USB_DWC3=y
++# CONFIG_USB_DWC3_GADGET is not set
++CONFIG_USB_GADGET=y
++CONFIG_USB_GADGET_DWC2_OTG=y
++CONFIG_SPL_TINY_MEMSET=y
++CONFIG_TPL_TINY_MEMSET=y
++CONFIG_ERRNO_STR=y
diff --git a/package/boot/uboot-rockchip/patches/104-rockchip-rk3328-Add-support-for-Orange-Pi-R1-Plus-LT.patch b/package/boot/uboot-rockchip/patches/104-rockchip-rk3328-Add-support-for-Orange-Pi-R1-Plus-LT.patch
new file mode 100644
index 00000000000000..05d569e7203bd0
--- /dev/null
+++ b/package/boot/uboot-rockchip/patches/104-rockchip-rk3328-Add-support-for-Orange-Pi-R1-Plus-LT.patch
@@ -0,0 +1,242 @@
+From 7a9326a96098bc63d2b60538f657c3a533415276 Mon Sep 17 00:00:00 2001
+From: Tianling Shen <cnsztl@gmail.com>
+Date: Sat, 20 May 2023 18:52:14 +0800
+Subject: [PATCH] rockchip: rk3328: Add support for Orange Pi R1 Plus LTS
+
+The OrangePi R1 Plus LTS is a minor variant of OrangePi R1 Plus with
+the on-board NIC chip changed from rtl8211e to yt8531c, and RAM type
+changed from DDR4 to LPDDR3.
+
+The device tree is taken from kernel v6.4-rc1.
+
+Signed-off-by: Tianling Shen <cnsztl@gmail.com>
+
+---
+ arch/arm/dts/Makefile                         |   1 +
+ .../rk3328-orangepi-r1-plus-lts-u-boot.dtsi   |  46 +++++++
+ arch/arm/dts/rk3328-orangepi-r1-plus-lts.dts  |  40 ++++++
+ board/rockchip/evb_rk3328/MAINTAINERS         |   6 +
+ configs/orangepi-r1-plus-lts-rk3328_defconfig | 114 ++++++++++++++++++
+ 5 files changed, 207 insertions(+)
+ create mode 100644 arch/arm/dts/rk3328-orangepi-r1-plus-lts-u-boot.dtsi
+ create mode 100644 arch/arm/dts/rk3328-orangepi-r1-plus-lts.dts
+ create mode 100644 configs/orangepi-r1-plus-lts-rk3328_defconfig
+
+--- a/arch/arm/dts/Makefile
++++ b/arch/arm/dts/Makefile
+@@ -111,6 +111,7 @@ dtb-$(CONFIG_ROCKCHIP_RK3328) += \
+ 	rk3328-nanopi-r2c.dtb \
+ 	rk3328-nanopi-r2s.dtb \
+ 	rk3328-orangepi-r1-plus.dtb \
++	rk3328-orangepi-r1-plus-lts.dtb \
+ 	rk3328-roc-cc.dtb \
+ 	rk3328-rock64.dtb \
+ 	rk3328-rock-pi-e.dtb
+--- /dev/null
++++ b/arch/arm/dts/rk3328-orangepi-r1-plus-lts-u-boot.dtsi
+@@ -0,0 +1,46 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * (C) Copyright 2018-2019 Rockchip Electronics Co., Ltd
++ * (C) Copyright 2020 David Bauer
++ */
++
++#include "rk3328-u-boot.dtsi"
++#include "rk3328-sdram-lpddr3-666.dtsi"
++/ {
++	chosen {
++		u-boot,spl-boot-order = "same-as-spl", &sdmmc, &emmc;
++	};
++};
++
++&gpio0 {
++	u-boot,dm-spl;
++};
++
++&pinctrl {
++	u-boot,dm-spl;
++};
++
++&sdmmc0m1_gpio {
++	u-boot,dm-spl;
++};
++
++&pcfg_pull_up_4ma {
++	u-boot,dm-spl;
++};
++
++/* Need this and all the pinctrl/gpio stuff above to set pinmux */
++&vcc_sd {
++	u-boot,dm-spl;
++};
++
++&gmac2io {
++	snps,reset-gpio = <&gpio1 RK_PC2 GPIO_ACTIVE_LOW>;
++	snps,reset-active-low;
++	snps,reset-delays-us = <0 10000 50000>;
++};
++
++&spi0 {
++	spi_flash: spiflash@0 {
++		u-boot,dm-pre-reloc;
++	};
++};
+--- /dev/null
++++ b/arch/arm/dts/rk3328-orangepi-r1-plus-lts.dts
+@@ -0,0 +1,40 @@
++// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
++/*
++ * Copyright (c) 2016 Xunlong Software. Co., Ltd.
++ * (http://www.orangepi.org)
++ *
++ * Copyright (c) 2021-2023 Tianling Shen <cnsztl@gmail.com>
++ */
++
++/dts-v1/;
++#include "rk3328-orangepi-r1-plus.dts"
++
++/ {
++	model = "Xunlong Orange Pi R1 Plus LTS";
++	compatible = "xunlong,orangepi-r1-plus-lts", "rockchip,rk3328";
++};
++
++&gmac2io {
++	phy-handle = <&yt8531c>;
++	tx_delay = <0x19>;
++	rx_delay = <0x05>;
++
++	mdio {
++		/delete-node/ ethernet-phy@1;
++
++		yt8531c: ethernet-phy@0 {
++			compatible = "ethernet-phy-ieee802.3-c22";
++			reg = <0>;
++
++			motorcomm,clk-out-frequency-hz = <125000000>;
++			motorcomm,keep-pll-enabled;
++			motorcomm,auto-sleep-disabled;
++
++			pinctrl-0 = <&eth_phy_reset_pin>;
++			pinctrl-names = "default";
++			reset-assert-us = <15000>;
++			reset-deassert-us = <50000>;
++			reset-gpios = <&gpio1 RK_PC2 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
+--- a/board/rockchip/evb_rk3328/MAINTAINERS
++++ b/board/rockchip/evb_rk3328/MAINTAINERS
+@@ -24,6 +24,12 @@ S:      Maintained
+ F:      configs/orangepi-r1-plus-rk3328_defconfig
+ F:      arch/arm/dts/rk3328-orangepi-r1-plus-u-boot.dtsi
+ 
++ORANGEPI-R1-PLUS-LTS-RK3328
++M:      Tianling Shen <cnsztl@gmail.com>
++S:      Maintained
++F:      configs/orangepi-r1-plus-lts-rk3328_defconfig
++F:      arch/arm/dts/rk3328-orangepi-r1-plus-lts-u-boot.dtsi
++
+ ROC-RK3328-CC
+ M:      Loic Devulder <ldevulder@suse.com>
+ M:      Chen-Yu Tsai <wens@csie.org>
+--- /dev/null
++++ b/configs/orangepi-r1-plus-lts-rk3328_defconfig
+@@ -0,0 +1,98 @@
++CONFIG_ARM=y
++CONFIG_ARCH_ROCKCHIP=y
++CONFIG_SYS_TEXT_BASE=0x00200000
++CONFIG_SPL_GPIO_SUPPORT=y
++CONFIG_ENV_OFFSET=0x3F8000
++CONFIG_ROCKCHIP_RK3328=y
++CONFIG_TPL_ROCKCHIP_COMMON_BOARD=y
++CONFIG_TPL_LIBCOMMON_SUPPORT=y
++CONFIG_TPL_LIBGENERIC_SUPPORT=y
++CONFIG_SPL_DRIVERS_MISC_SUPPORT=y
++CONFIG_SPL_STACK_R_ADDR=0x600000
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_DEBUG_UART_BASE=0xFF130000
++CONFIG_DEBUG_UART_CLOCK=24000000
++CONFIG_SYSINFO=y
++CONFIG_DEBUG_UART=y
++CONFIG_TPL_SYS_MALLOC_F_LEN=0x800
++# CONFIG_ANDROID_BOOT_IMAGE is not set
++CONFIG_FIT=y
++CONFIG_FIT_VERBOSE=y
++CONFIG_SPL_LOAD_FIT=y
++CONFIG_DEFAULT_FDT_FILE="rockchip/rk3328-orangepi-r1-plus-lts.dtb"
++CONFIG_MISC_INIT_R=y
++# CONFIG_DISPLAY_CPUINFO is not set
++CONFIG_DISPLAY_BOARDINFO_LATE=y
++# CONFIG_SPL_RAW_IMAGE_SUPPORT is not set
++CONFIG_TPL_SYS_MALLOC_SIMPLE=y
++CONFIG_SPL_STACK_R=y
++CONFIG_SPL_I2C_SUPPORT=y
++CONFIG_SPL_POWER_SUPPORT=y
++CONFIG_SPL_ATF=y
++CONFIG_SPL_ATF_NO_PLATFORM_PARAM=y
++CONFIG_CMD_BOOTZ=y
++CONFIG_CMD_GPT=y
++CONFIG_CMD_MMC=y
++CONFIG_CMD_USB=y
++# CONFIG_CMD_SETEXPR is not set
++CONFIG_CMD_TIME=y
++CONFIG_SPL_OF_CONTROL=y
++CONFIG_TPL_OF_CONTROL=y
++CONFIG_DEFAULT_DEVICE_TREE="rk3328-orangepi-r1-plus-lts"
++CONFIG_OF_SPL_REMOVE_PROPS="clock-names interrupt-parent assigned-clocks assigned-clock-rates assigned-clock-parents"
++CONFIG_TPL_OF_PLATDATA=y
++CONFIG_ENV_IS_IN_MMC=y
++CONFIG_SYS_RELOC_GD_ENV_ADDR=y
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_TPL_DM=y
++CONFIG_REGMAP=y
++CONFIG_SPL_REGMAP=y
++CONFIG_TPL_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_SPL_SYSCON=y
++CONFIG_TPL_SYSCON=y
++CONFIG_CLK=y
++CONFIG_SPL_CLK=y
++CONFIG_FASTBOOT_BUF_ADDR=0x800800
++CONFIG_FASTBOOT_CMD_OEM_FORMAT=y
++CONFIG_ROCKCHIP_GPIO=y
++CONFIG_SYS_I2C_ROCKCHIP=y
++CONFIG_MMC_DW=y
++CONFIG_MMC_DW_ROCKCHIP=y
++CONFIG_SF_DEFAULT_SPEED=20000000
++CONFIG_DM_ETH=y
++CONFIG_ETH_DESIGNWARE=y
++CONFIG_GMAC_ROCKCHIP=y
++CONFIG_PINCTRL=y
++CONFIG_SPL_PINCTRL=y
++CONFIG_DM_PMIC=y
++CONFIG_PMIC_RK8XX=y
++CONFIG_SPL_DM_REGULATOR=y
++CONFIG_REGULATOR_PWM=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_SPL_DM_REGULATOR_FIXED=y
++CONFIG_REGULATOR_RK8XX=y
++CONFIG_PWM_ROCKCHIP=y
++CONFIG_RAM=y
++CONFIG_SPL_RAM=y
++CONFIG_TPL_RAM=y
++CONFIG_DM_RESET=y
++CONFIG_BAUDRATE=1500000
++CONFIG_DEBUG_UART_SHIFT=2
++CONFIG_SYSRESET=y
++# CONFIG_TPL_SYSRESET is not set
++CONFIG_USB=y
++CONFIG_USB_XHCI_HCD=y
++CONFIG_USB_XHCI_DWC3=y
++CONFIG_USB_EHCI_HCD=y
++CONFIG_USB_EHCI_GENERIC=y
++CONFIG_USB_OHCI_HCD=y
++CONFIG_USB_OHCI_GENERIC=y
++CONFIG_USB_DWC2=y
++CONFIG_USB_DWC3=y
++# CONFIG_USB_DWC3_GADGET is not set
++CONFIG_USB_GADGET=y
++CONFIG_USB_GADGET_DWC2_OTG=y
++CONFIG_SPL_TINY_MEMSET=y
++CONFIG_TPL_TINY_MEMSET=y
++CONFIG_ERRNO_STR=y
diff --git a/package/boot/uboot-rockchip/src/of-platdata/nanopi-r2c-rk3328/dt-decl.h b/package/boot/uboot-rockchip/src/of-platdata/nanopi-r2c-rk3328/dt-decl.h
new file mode 100644
index 00000000000000..0919e4ed5374f3
--- /dev/null
+++ b/package/boot/uboot-rockchip/src/of-platdata/nanopi-r2c-rk3328/dt-decl.h
@@ -0,0 +1,23 @@
+/*
+ * DO NOT MODIFY
+ *
+ * Declares externs for all device/uclass instances.
+ * This was generated by dtoc from a .dtb (device tree binary) file.
+ */
+
+#include <dm/device-internal.h>
+#include <dm/uclass-internal.h>
+
+/* driver declarations - these allow DM_DRIVER_GET() to be used */
+extern U_BOOT_DRIVER(rockchip_rk3328_cru);
+extern U_BOOT_DRIVER(rockchip_rk3328_dmc);
+extern U_BOOT_DRIVER(rockchip_rk3288_dw_mshc);
+extern U_BOOT_DRIVER(ns16550_serial);
+extern U_BOOT_DRIVER(rockchip_rk3328_grf);
+
+/* uclass driver declarations - needed for DM_UCLASS_DRIVER_REF() */
+extern UCLASS_DRIVER(clk);
+extern UCLASS_DRIVER(mmc);
+extern UCLASS_DRIVER(ram);
+extern UCLASS_DRIVER(serial);
+extern UCLASS_DRIVER(syscon);
diff --git a/package/boot/uboot-rockchip/src/of-platdata/nanopi-r2c-rk3328/dt-plat.c b/package/boot/uboot-rockchip/src/of-platdata/nanopi-r2c-rk3328/dt-plat.c
new file mode 100644
index 00000000000000..e5b330c9d9756b
--- /dev/null
+++ b/package/boot/uboot-rockchip/src/of-platdata/nanopi-r2c-rk3328/dt-plat.c
@@ -0,0 +1,155 @@
+/*
+ * DO NOT MODIFY
+ *
+ * Declares the U_BOOT_DRIVER() records and platform data.
+ * This was generated by dtoc from a .dtb (device tree binary) file.
+ */
+
+/* Allow use of U_BOOT_DRVINFO() in this file */
+#define DT_PLAT_C
+
+#include <common.h>
+#include <dm.h>
+#include <dt-structs.h>
+
+/*
+ * driver_info declarations, ordered by 'struct driver_info' linker_list idx:
+ *
+ * idx  driver_info          driver
+ * ---  -------------------- --------------------
+ *   0: clock_controller_at_ff440000 rockchip_rk3328_cru
+ *   1: dmc                  rockchip_rk3328_dmc
+ *   2: mmc_at_ff500000      rockchip_rk3288_dw_mshc
+ *   3: serial_at_ff130000   ns16550_serial
+ *   4: syscon_at_ff100000   rockchip_rk3328_grf
+ * ---  -------------------- --------------------
+ */
+
+/*
+ * Node /clock-controller@ff440000 index 0
+ * driver rockchip_rk3328_cru parent None
+ */
+static struct dtd_rockchip_rk3328_cru dtv_clock_controller_at_ff440000 = {
+	.reg			= {0xff440000, 0x1000},
+	.rockchip_grf		= 0x3a,
+};
+U_BOOT_DRVINFO(clock_controller_at_ff440000) = {
+	.name		= "rockchip_rk3328_cru",
+	.plat		= &dtv_clock_controller_at_ff440000,
+	.plat_size	= sizeof(dtv_clock_controller_at_ff440000),
+	.parent_idx	= -1,
+};
+
+/*
+ * Node /dmc index 1
+ * driver rockchip_rk3328_dmc parent None
+ */
+static struct dtd_rockchip_rk3328_dmc dtv_dmc = {
+	.reg			= {0xff400000, 0x1000, 0xff780000, 0x3000, 0xff100000, 0x1000, 0xff440000, 0x1000,
+		0xff720000, 0x1000, 0xff798000, 0x1000},
+	.rockchip_sdram_params	= {0x1, 0xa, 0x2, 0x1, 0x0, 0x0, 0x11, 0x0,
+		0x11, 0x0, 0x0, 0x94291288, 0x0, 0x27, 0x462, 0x15,
+		0x242, 0xff, 0x14d, 0x0, 0x1, 0x0, 0x0, 0x0,
+		0x43049010, 0x64, 0x28003b, 0xd0, 0x20053, 0xd4, 0x220000, 0xd8,
+		0x100, 0xdc, 0x40000, 0xe0, 0x0, 0xe4, 0x110000, 0xe8,
+		0x420, 0xec, 0x400, 0xf4, 0xf011f, 0x100, 0x9060b06, 0x104,
+		0x20209, 0x108, 0x505040a, 0x10c, 0x40400c, 0x110, 0x5030206, 0x114,
+		0x3030202, 0x120, 0x3030b03, 0x124, 0x20208, 0x180, 0x1000040, 0x184,
+		0x0, 0x190, 0x7030003, 0x198, 0x5001100, 0x1a0, 0xc0400003, 0x240,
+		0x6000604, 0x244, 0x201, 0x250, 0xf00, 0x490, 0x1, 0xffffffff,
+		0xffffffff, 0xffffffff, 0xffffffff, 0x4, 0xc, 0x28, 0xa, 0x2c,
+		0x0, 0x30, 0x9, 0xffffffff, 0xffffffff, 0x77, 0x88, 0x79,
+		0x79, 0x87, 0x97, 0x87, 0x78, 0x77, 0x78, 0x87,
+		0x88, 0x87, 0x87, 0x77, 0x78, 0x78, 0x78, 0x78,
+		0x78, 0x78, 0x78, 0x78, 0x78, 0x69, 0x9, 0x77,
+		0x78, 0x77, 0x78, 0x77, 0x78, 0x77, 0x78, 0x77,
+		0x79, 0x9, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78,
+		0x78, 0x78, 0x78, 0x69, 0x9, 0x77, 0x78, 0x77,
+		0x77, 0x77, 0x77, 0x77, 0x77, 0x77, 0x79, 0x9,
+		0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78,
+		0x78, 0x69, 0x9, 0x77, 0x78, 0x77, 0x78, 0x77,
+		0x78, 0x77, 0x78, 0x77, 0x79, 0x9, 0x78, 0x78,
+		0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x69,
+		0x9, 0x77, 0x78, 0x77, 0x77, 0x77, 0x77, 0x77,
+		0x77, 0x77, 0x79, 0x9},
+};
+U_BOOT_DRVINFO(dmc) = {
+	.name		= "rockchip_rk3328_dmc",
+	.plat		= &dtv_dmc,
+	.plat_size	= sizeof(dtv_dmc),
+	.parent_idx	= -1,
+};
+
+/*
+ * Node /mmc@ff500000 index 2
+ * driver rockchip_rk3288_dw_mshc parent None
+ */
+static struct dtd_rockchip_rk3288_dw_mshc dtv_mmc_at_ff500000 = {
+	.bus_width		= 0x4,
+	.cap_sd_highspeed	= true,
+	.clocks			= {
+			{0, {317}},
+			{0, {33}},
+			{0, {74}},
+			{0, {78}},},
+	.disable_wp		= true,
+	.fifo_depth		= 0x100,
+	.interrupts		= {0x0, 0xc, 0x4},
+	.max_frequency		= 0x8f0d180,
+	.pinctrl_0		= {0x47, 0x48, 0x49, 0x4a},
+	.pinctrl_names		= "default",
+	.reg			= {0xff500000, 0x4000},
+	.sd_uhs_sdr104		= true,
+	.sd_uhs_sdr12		= true,
+	.sd_uhs_sdr25		= true,
+	.sd_uhs_sdr50		= true,
+	.u_boot_spl_fifo_mode	= true,
+	.vmmc_supply		= 0x4b,
+	.vqmmc_supply		= 0x1e,
+};
+U_BOOT_DRVINFO(mmc_at_ff500000) = {
+	.name		= "rockchip_rk3288_dw_mshc",
+	.plat		= &dtv_mmc_at_ff500000,
+	.plat_size	= sizeof(dtv_mmc_at_ff500000),
+	.parent_idx	= -1,
+};
+
+/*
+ * Node /serial@ff130000 index 3
+ * driver ns16550_serial parent None
+ */
+static struct dtd_ns16550_serial dtv_serial_at_ff130000 = {
+	.clock_frequency	= 0x16e3600,
+	.clocks			= {
+			{0, {40}},
+			{0, {212}},},
+	.dma_names		= {"tx", "rx"},
+	.dmas			= {0x10, 0x6, 0x10, 0x7},
+	.interrupts		= {0x0, 0x39, 0x4},
+	.pinctrl_0		= 0x26,
+	.pinctrl_names		= "default",
+	.reg			= {0xff130000, 0x100},
+	.reg_io_width		= 0x4,
+	.reg_shift		= 0x2,
+};
+U_BOOT_DRVINFO(serial_at_ff130000) = {
+	.name		= "ns16550_serial",
+	.plat		= &dtv_serial_at_ff130000,
+	.plat_size	= sizeof(dtv_serial_at_ff130000),
+	.parent_idx	= -1,
+};
+
+/*
+ * Node /syscon@ff100000 index 4
+ * driver rockchip_rk3328_grf parent None
+ */
+static struct dtd_rockchip_rk3328_grf dtv_syscon_at_ff100000 = {
+	.reg			= {0xff100000, 0x1000},
+};
+U_BOOT_DRVINFO(syscon_at_ff100000) = {
+	.name		= "rockchip_rk3328_grf",
+	.plat		= &dtv_syscon_at_ff100000,
+	.plat_size	= sizeof(dtv_syscon_at_ff100000),
+	.parent_idx	= -1,
+};
+
diff --git a/package/boot/uboot-rockchip/src/of-platdata/nanopi-r2c-rk3328/dt-structs-gen.h b/package/boot/uboot-rockchip/src/of-platdata/nanopi-r2c-rk3328/dt-structs-gen.h
new file mode 100644
index 00000000000000..b1ff08a9278d2f
--- /dev/null
+++ b/package/boot/uboot-rockchip/src/of-platdata/nanopi-r2c-rk3328/dt-structs-gen.h
@@ -0,0 +1,51 @@
+/*
+ * DO NOT MODIFY
+ *
+ * Defines the structs used to hold devicetree data.
+ * This was generated by dtoc from a .dtb (device tree binary) file.
+ */
+
+#include <stdbool.h>
+#include <linux/libfdt.h>
+struct dtd_ns16550_serial {
+	fdt32_t		clock_frequency;
+	struct phandle_1_arg clocks[2];
+	const char *	dma_names[2];
+	fdt32_t		dmas[4];
+	fdt32_t		interrupts[3];
+	fdt32_t		pinctrl_0;
+	const char *	pinctrl_names;
+	fdt64_t		reg[2];
+	fdt32_t		reg_io_width;
+	fdt32_t		reg_shift;
+};
+struct dtd_rockchip_rk3288_dw_mshc {
+	fdt32_t		bus_width;
+	bool		cap_sd_highspeed;
+	struct phandle_1_arg clocks[4];
+	bool		disable_wp;
+	fdt32_t		fifo_depth;
+	fdt32_t		interrupts[3];
+	fdt32_t		max_frequency;
+	fdt32_t		pinctrl_0[4];
+	const char *	pinctrl_names;
+	fdt64_t		reg[2];
+	bool		sd_uhs_sdr104;
+	bool		sd_uhs_sdr12;
+	bool		sd_uhs_sdr25;
+	bool		sd_uhs_sdr50;
+	bool		u_boot_spl_fifo_mode;
+	fdt32_t		vmmc_supply;
+	fdt32_t		vqmmc_supply;
+};
+struct dtd_rockchip_rk3328_cru {
+	fdt64_t		reg[2];
+	fdt32_t		rockchip_grf;
+};
+struct dtd_rockchip_rk3328_dmc {
+	fdt64_t		reg[12];
+	fdt32_t		rockchip_sdram_params[196];
+};
+struct dtd_rockchip_rk3328_grf {
+	fdt64_t		reg[2];
+};
diff --git a/package/boot/uboot-rockchip/src/of-platdata/orangepi-r1-plus-lts-rk3328/dt-decl.h b/package/boot/uboot-rockchip/src/of-platdata/orangepi-r1-plus-lts-rk3328/dt-decl.h
new file mode 100644
index 00000000000000..75795aa6cc7af2
--- /dev/null
+++ b/package/boot/uboot-rockchip/src/of-platdata/orangepi-r1-plus-lts-rk3328/dt-decl.h
@@ -0,0 +1,24 @@
+/*
+ * DO NOT MODIFY
+ *
+ * Declares externs for all device/uclass instances.
+ * This was generated by dtoc from a .dtb (device tree binary) file.
+ */
+
+#include <dm/device-internal.h>
+#include <dm/uclass-internal.h>
+
+/* driver declarations - these allow DM_DRIVER_GET() to be used */
+extern U_BOOT_DRIVER(rockchip_rk3328_cru);
+extern U_BOOT_DRIVER(rockchip_rk3328_dmc);
+extern U_BOOT_DRIVER(rockchip_rk3288_dw_mshc);
+extern U_BOOT_DRIVER(ns16550_serial);
+extern U_BOOT_DRIVER(rockchip_rk3328_spi);
+extern U_BOOT_DRIVER(rockchip_rk3328_grf);
+
+/* uclass driver declarations - needed for DM_UCLASS_DRIVER_REF() */
+extern UCLASS_DRIVER(clk);
+extern UCLASS_DRIVER(mmc);
+extern UCLASS_DRIVER(ram);
+extern UCLASS_DRIVER(serial);
+extern UCLASS_DRIVER(syscon);
diff --git a/package/boot/uboot-rockchip/src/of-platdata/orangepi-r1-plus-lts-rk3328/dt-plat.c b/package/boot/uboot-rockchip/src/of-platdata/orangepi-r1-plus-lts-rk3328/dt-plat.c
new file mode 100644
index 00000000000000..12081b19e021a0
--- /dev/null
+++ b/package/boot/uboot-rockchip/src/of-platdata/orangepi-r1-plus-lts-rk3328/dt-plat.c
@@ -0,0 +1,170 @@
+/*
+ * DO NOT MODIFY
+ *
+ * Declares the U_BOOT_DRIVER() records and platform data.
+ * This was generated by dtoc from a .dtb (device tree binary) file.
+ */
+
+/* Allow use of U_BOOT_DRVINFO() in this file */
+#define DT_PLAT_C
+
+#include <common.h>
+#include <dm.h>
+#include <dt-structs.h>
+
+/*
+ * driver_info declarations, ordered by 'struct driver_info' linker_list idx:
+ *
+ * idx  driver_info          driver
+ * ---  -------------------- --------------------
+ *   0: clock_controller_at_ff440000 rockchip_rk3328_cru
+ *   1: dmc                  rockchip_rk3328_dmc
+ *   2: mmc_at_ff500000      rockchip_rk3288_dw_mshc
+ *   3: serial_at_ff130000   ns16550_serial
+ *   4: spi_at_ff190000      rockchip_rk3328_spi
+ *   5: syscon_at_ff100000   rockchip_rk3328_grf
+ * ---  -------------------- --------------------
+ */
+
+/*
+ * Node /clock-controller@ff440000 index 0
+ * driver rockchip_rk3328_cru parent None
+ */
+static struct dtd_rockchip_rk3328_cru dtv_clock_controller_at_ff440000 = {
+	.reg			= {0xff440000, 0x1000},
+	.rockchip_grf		= 0x38,
+};
+U_BOOT_DRVINFO(clock_controller_at_ff440000) = {
+	.name		= "rockchip_rk3328_cru",
+	.plat		= &dtv_clock_controller_at_ff440000,
+	.plat_size	= sizeof(dtv_clock_controller_at_ff440000),
+	.parent_idx	= -1,
+};
+
+/*
+ * Node /dmc index 1
+ * driver rockchip_rk3328_dmc parent None
+ */
+static struct dtd_rockchip_rk3328_dmc dtv_dmc = {
+	.reg			= {0xff400000, 0x1000, 0xff780000, 0x3000, 0xff100000, 0x1000, 0xff440000, 0x1000,
+		0xff720000, 0x1000, 0xff798000, 0x1000},
+	.rockchip_sdram_params	= {0x1, 0xc, 0x3, 0x1, 0x0, 0x0, 0x10, 0x10,
+		0x10, 0x10, 0x0, 0x8c48a18a, 0x0, 0x21, 0x482, 0x15,
+		0x21a, 0xff, 0x14d, 0x6, 0x1, 0x0, 0x0, 0x0,
+		0x43041008, 0x64, 0x140023, 0xd0, 0x220002, 0xd4, 0x10000, 0xd8,
+		0x703, 0xdc, 0x830004, 0xe0, 0x10000, 0xe4, 0x70003, 0xf4,
+		0xf011f, 0x100, 0x6090b07, 0x104, 0x2020b, 0x108, 0x2030506, 0x10c,
+		0x505000, 0x110, 0x3020204, 0x114, 0x1010303, 0x118, 0x2020003, 0x120,
+		0x303, 0x138, 0x25, 0x180, 0x3c000f, 0x184, 0x900000, 0x190,
+		0x7020000, 0x198, 0x5001100, 0x1a0, 0xc0400003, 0x240, 0x900090c, 0x244,
+		0x101, 0x250, 0xf00, 0x490, 0x1, 0xffffffff, 0xffffffff, 0xffffffff,
+		0xffffffff, 0xffffffff, 0xffffffff, 0x4, 0xb, 0x28, 0x6, 0x2c,
+		0x0, 0x30, 0x3, 0xffffffff, 0xffffffff, 0x77, 0x88, 0x79,
+		0x79, 0x87, 0x97, 0x87, 0x78, 0x77, 0x78, 0x87,
+		0x88, 0x87, 0x87, 0x77, 0x78, 0x78, 0x78, 0x78,
+		0x78, 0x78, 0x78, 0x78, 0x78, 0x69, 0x9, 0x77,
+		0x78, 0x77, 0x78, 0x77, 0x78, 0x77, 0x78, 0x77,
+		0x79, 0x9, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78,
+		0x78, 0x78, 0x78, 0x69, 0x9, 0x77, 0x78, 0x77,
+		0x77, 0x77, 0x77, 0x77, 0x77, 0x77, 0x79, 0x9,
+		0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78,
+		0x78, 0x69, 0x9, 0x77, 0x78, 0x77, 0x78, 0x77,
+		0x78, 0x77, 0x78, 0x77, 0x79, 0x9, 0x78, 0x78,
+		0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x69,
+		0x9, 0x77, 0x78, 0x77, 0x77, 0x77, 0x77, 0x77,
+		0x77, 0x77, 0x79, 0x9},
+};
+U_BOOT_DRVINFO(dmc) = {
+	.name		= "rockchip_rk3328_dmc",
+	.plat		= &dtv_dmc,
+	.plat_size	= sizeof(dtv_dmc),
+	.parent_idx	= -1,
+};
+
+/*
+ * Node /mmc@ff500000 index 2
+ * driver rockchip_rk3288_dw_mshc parent None
+ */
+static struct dtd_rockchip_rk3288_dw_mshc dtv_mmc_at_ff500000 = {
+	.bus_width		= 0x4,
+	.cap_sd_highspeed	= true,
+	.clocks			= {
+			{0, {317}},
+			{0, {33}},
+			{0, {74}},
+			{0, {78}},},
+	.disable_wp		= true,
+	.fifo_depth		= 0x100,
+	.interrupts		= {0x0, 0xc, 0x4},
+	.max_frequency		= 0x8f0d180,
+	.pinctrl_0		= {0x45, 0x46, 0x47, 0x48},
+	.pinctrl_names		= "default",
+	.reg			= {0xff500000, 0x4000},
+	.u_boot_spl_fifo_mode	= true,
+	.vmmc_supply		= 0x49,
+};
+U_BOOT_DRVINFO(mmc_at_ff500000) = {
+	.name		= "rockchip_rk3288_dw_mshc",
+	.plat		= &dtv_mmc_at_ff500000,
+	.plat_size	= sizeof(dtv_mmc_at_ff500000),
+	.parent_idx	= -1,
+};
+
+/*
+ * Node /serial@ff130000 index 3
+ * driver ns16550_serial parent None
+ */
+static struct dtd_ns16550_serial dtv_serial_at_ff130000 = {
+	.clock_frequency	= 0x16e3600,
+	.clocks			= {
+			{0, {40}},
+			{0, {212}},},
+	.dma_names		= {"tx", "rx"},
+	.dmas			= {0x10, 0x6, 0x10, 0x7},
+	.interrupts		= {0x0, 0x39, 0x4},
+	.pinctrl_0		= 0x24,
+	.pinctrl_names		= "default",
+	.reg			= {0xff130000, 0x100},
+	.reg_io_width		= 0x4,
+	.reg_shift		= 0x2,
+};
+U_BOOT_DRVINFO(serial_at_ff130000) = {
+	.name		= "ns16550_serial",
+	.plat		= &dtv_serial_at_ff130000,
+	.plat_size	= sizeof(dtv_serial_at_ff130000),
+	.parent_idx	= -1,
+};
+
+/* Node /spi@ff190000 index 4 */
+static struct dtd_rockchip_rk3328_spi dtv_spi_at_ff190000 = {
+	.clocks			= {
+			{0, {32}},
+			{0, {209}},},
+	.dma_names		= {"tx", "rx"},
+	.dmas			= {0x10, 0x8, 0x10, 0x9},
+	.interrupts		= {0x0, 0x31, 0x4},
+	.pinctrl_0		= {0x2c, 0x2d, 0x2e, 0x2f},
+	.pinctrl_names		= "default",
+	.reg			= {0xff190000, 0x1000},
+};
+U_BOOT_DRVINFO(spi_at_ff190000) = {
+	.name		= "rockchip_rk3328_spi",
+	.plat		= &dtv_spi_at_ff190000,
+	.plat_size	= sizeof(dtv_spi_at_ff190000),
+	.parent_idx	= -1,
+};
+
+/*
+ * Node /syscon@ff100000 index 5
+ * driver rockchip_rk3328_grf parent None
+ */
+static struct dtd_rockchip_rk3328_grf dtv_syscon_at_ff100000 = {
+	.reg			= {0xff100000, 0x1000},
+};
+U_BOOT_DRVINFO(syscon_at_ff100000) = {
+	.name		= "rockchip_rk3328_grf",
+	.plat		= &dtv_syscon_at_ff100000,
+	.plat_size	= sizeof(dtv_syscon_at_ff100000),
+	.parent_idx	= -1,
+};
+
diff --git a/package/boot/uboot-rockchip/src/of-platdata/orangepi-r1-plus-lts-rk3328/dt-structs-gen.h b/package/boot/uboot-rockchip/src/of-platdata/orangepi-r1-plus-lts-rk3328/dt-structs-gen.h
new file mode 100644
index 00000000000000..d09583153103cf
--- /dev/null
+++ b/package/boot/uboot-rockchip/src/of-platdata/orangepi-r1-plus-lts-rk3328/dt-structs-gen.h
@@ -0,0 +1,55 @@
+/*
+ * DO NOT MODIFY
+ *
+ * Defines the structs used to hold devicetree data.
+ * This was generated by dtoc from a .dtb (device tree binary) file.
+ */
+
+#include <stdbool.h>
+#include <linux/libfdt.h>
+struct dtd_ns16550_serial {
+	fdt32_t		clock_frequency;
+	struct phandle_1_arg clocks[2];
+	const char *	dma_names[2];
+	fdt32_t		dmas[4];
+	fdt32_t		interrupts[3];
+	fdt32_t		pinctrl_0;
+	const char *	pinctrl_names;
+	fdt64_t		reg[2];
+	fdt32_t		reg_io_width;
+	fdt32_t		reg_shift;
+};
+struct dtd_rockchip_rk3288_dw_mshc {
+	fdt32_t		bus_width;
+	bool		cap_sd_highspeed;
+	struct phandle_1_arg clocks[4];
+	bool		disable_wp;
+	fdt32_t		fifo_depth;
+	fdt32_t		interrupts[3];
+	fdt32_t		max_frequency;
+	fdt32_t		pinctrl_0[4];
+	const char *	pinctrl_names;
+	fdt64_t		reg[2];
+	bool		u_boot_spl_fifo_mode;
+	fdt32_t		vmmc_supply;
+};
+struct dtd_rockchip_rk3328_cru {
+	fdt64_t		reg[2];
+	fdt32_t		rockchip_grf;
+};
+struct dtd_rockchip_rk3328_dmc {
+	fdt64_t		reg[12];
+	fdt32_t		rockchip_sdram_params[196];
+};
+struct dtd_rockchip_rk3328_grf {
+	fdt64_t		reg[2];
+};
+struct dtd_rockchip_rk3328_spi {
+	struct phandle_1_arg clocks[2];
+	const char *	dma_names[2];
+	fdt32_t		dmas[4];
+	fdt32_t		interrupts[3];
+	fdt32_t		pinctrl_0[4];
+	const char *	pinctrl_names;
+	fdt64_t		reg[2];
+};
diff --git a/package/boot/uboot-rockchip/src/of-platdata/orangepi-r1-plus-rk3328/dt-decl.h b/package/boot/uboot-rockchip/src/of-platdata/orangepi-r1-plus-rk3328/dt-decl.h
new file mode 100644
index 00000000000000..75795aa6cc7af2
--- /dev/null
+++ b/package/boot/uboot-rockchip/src/of-platdata/orangepi-r1-plus-rk3328/dt-decl.h
@@ -0,0 +1,24 @@
+/*
+ * DO NOT MODIFY
+ *
+ * Declares externs for all device/uclass instances.
+ * This was generated by dtoc from a .dtb (device tree binary) file.
+ */
+
+#include <dm/device-internal.h>
+#include <dm/uclass-internal.h>
+
+/* driver declarations - these allow DM_DRIVER_GET() to be used */
+extern U_BOOT_DRIVER(rockchip_rk3328_cru);
+extern U_BOOT_DRIVER(rockchip_rk3328_dmc);
+extern U_BOOT_DRIVER(rockchip_rk3288_dw_mshc);
+extern U_BOOT_DRIVER(ns16550_serial);
+extern U_BOOT_DRIVER(rockchip_rk3328_spi);
+extern U_BOOT_DRIVER(rockchip_rk3328_grf);
+
+/* uclass driver declarations - needed for DM_UCLASS_DRIVER_REF() */
+extern UCLASS_DRIVER(clk);
+extern UCLASS_DRIVER(mmc);
+extern UCLASS_DRIVER(ram);
+extern UCLASS_DRIVER(serial);
+extern UCLASS_DRIVER(syscon);
diff --git a/package/boot/uboot-rockchip/src/of-platdata/orangepi-r1-plus-rk3328/dt-plat.c b/package/boot/uboot-rockchip/src/of-platdata/orangepi-r1-plus-rk3328/dt-plat.c
new file mode 100644
index 00000000000000..90656fc306d85a
--- /dev/null
+++ b/package/boot/uboot-rockchip/src/of-platdata/orangepi-r1-plus-rk3328/dt-plat.c
@@ -0,0 +1,170 @@
+/*
+ * DO NOT MODIFY
+ *
+ * Declares the U_BOOT_DRIVER() records and platform data.
+ * This was generated by dtoc from a .dtb (device tree binary) file.
+ */
+
+/* Allow use of U_BOOT_DRVINFO() in this file */
+#define DT_PLAT_C
+
+#include <common.h>
+#include <dm.h>
+#include <dt-structs.h>
+
+/*
+ * driver_info declarations, ordered by 'struct driver_info' linker_list idx:
+ *
+ * idx  driver_info          driver
+ * ---  -------------------- --------------------
+ *   0: clock_controller_at_ff440000 rockchip_rk3328_cru
+ *   1: dmc                  rockchip_rk3328_dmc
+ *   2: mmc_at_ff500000      rockchip_rk3288_dw_mshc
+ *   3: serial_at_ff130000   ns16550_serial
+ *   4: spi_at_ff190000      rockchip_rk3328_spi
+ *   5: syscon_at_ff100000   rockchip_rk3328_grf
+ * ---  -------------------- --------------------
+ */
+
+/*
+ * Node /clock-controller@ff440000 index 0
+ * driver rockchip_rk3328_cru parent None
+ */
+static struct dtd_rockchip_rk3328_cru dtv_clock_controller_at_ff440000 = {
+	.reg			= {0xff440000, 0x1000},
+	.rockchip_grf		= 0x38,
+};
+U_BOOT_DRVINFO(clock_controller_at_ff440000) = {
+	.name		= "rockchip_rk3328_cru",
+	.plat		= &dtv_clock_controller_at_ff440000,
+	.plat_size	= sizeof(dtv_clock_controller_at_ff440000),
+	.parent_idx	= -1,
+};
+
+/*
+ * Node /dmc index 1
+ * driver rockchip_rk3328_dmc parent None
+ */
+static struct dtd_rockchip_rk3328_dmc dtv_dmc = {
+	.reg			= {0xff400000, 0x1000, 0xff780000, 0x3000, 0xff100000, 0x1000, 0xff440000, 0x1000,
+		0xff720000, 0x1000, 0xff798000, 0x1000},
+	.rockchip_sdram_params	= {0x1, 0xa, 0x2, 0x1, 0x0, 0x0, 0x11, 0x0,
+		0x11, 0x0, 0x0, 0x94291288, 0x0, 0x27, 0x462, 0x15,
+		0x242, 0xff, 0x14d, 0x0, 0x1, 0x0, 0x0, 0x0,
+		0x43049010, 0x64, 0x28003b, 0xd0, 0x20053, 0xd4, 0x220000, 0xd8,
+		0x100, 0xdc, 0x40000, 0xe0, 0x0, 0xe4, 0x110000, 0xe8,
+		0x420, 0xec, 0x400, 0xf4, 0xf011f, 0x100, 0x9060b06, 0x104,
+		0x20209, 0x108, 0x505040a, 0x10c, 0x40400c, 0x110, 0x5030206, 0x114,
+		0x3030202, 0x120, 0x3030b03, 0x124, 0x20208, 0x180, 0x1000040, 0x184,
+		0x0, 0x190, 0x7030003, 0x198, 0x5001100, 0x1a0, 0xc0400003, 0x240,
+		0x6000604, 0x244, 0x201, 0x250, 0xf00, 0x490, 0x1, 0xffffffff,
+		0xffffffff, 0xffffffff, 0xffffffff, 0x4, 0xc, 0x28, 0xa, 0x2c,
+		0x0, 0x30, 0x9, 0xffffffff, 0xffffffff, 0x77, 0x88, 0x79,
+		0x79, 0x87, 0x97, 0x87, 0x78, 0x77, 0x78, 0x87,
+		0x88, 0x87, 0x87, 0x77, 0x78, 0x78, 0x78, 0x78,
+		0x78, 0x78, 0x78, 0x78, 0x78, 0x69, 0x9, 0x77,
+		0x78, 0x77, 0x78, 0x77, 0x78, 0x77, 0x78, 0x77,
+		0x79, 0x9, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78,
+		0x78, 0x78, 0x78, 0x69, 0x9, 0x77, 0x78, 0x77,
+		0x77, 0x77, 0x77, 0x77, 0x77, 0x77, 0x79, 0x9,
+		0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78,
+		0x78, 0x69, 0x9, 0x77, 0x78, 0x77, 0x78, 0x77,
+		0x78, 0x77, 0x78, 0x77, 0x79, 0x9, 0x78, 0x78,
+		0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x69,
+		0x9, 0x77, 0x78, 0x77, 0x77, 0x77, 0x77, 0x77,
+		0x77, 0x77, 0x79, 0x9},
+};
+U_BOOT_DRVINFO(dmc) = {
+	.name		= "rockchip_rk3328_dmc",
+	.plat		= &dtv_dmc,
+	.plat_size	= sizeof(dtv_dmc),
+	.parent_idx	= -1,
+};
+
+/*
+ * Node /mmc@ff500000 index 2
+ * driver rockchip_rk3288_dw_mshc parent None
+ */
+static struct dtd_rockchip_rk3288_dw_mshc dtv_mmc_at_ff500000 = {
+	.bus_width		= 0x4,
+	.cap_sd_highspeed	= true,
+	.clocks			= {
+			{0, {317}},
+			{0, {33}},
+			{0, {74}},
+			{0, {78}},},
+	.disable_wp		= true,
+	.fifo_depth		= 0x100,
+	.interrupts		= {0x0, 0xc, 0x4},
+	.max_frequency		= 0x8f0d180,
+	.pinctrl_0		= {0x45, 0x46, 0x47, 0x48},
+	.pinctrl_names		= "default",
+	.reg			= {0xff500000, 0x4000},
+	.u_boot_spl_fifo_mode	= true,
+	.vmmc_supply		= 0x49,
+};
+U_BOOT_DRVINFO(mmc_at_ff500000) = {
+	.name		= "rockchip_rk3288_dw_mshc",
+	.plat		= &dtv_mmc_at_ff500000,
+	.plat_size	= sizeof(dtv_mmc_at_ff500000),
+	.parent_idx	= -1,
+};
+
+/*
+ * Node /serial@ff130000 index 3
+ * driver ns16550_serial parent None
+ */
+static struct dtd_ns16550_serial dtv_serial_at_ff130000 = {
+	.clock_frequency	= 0x16e3600,
+	.clocks			= {
+			{0, {40}},
+			{0, {212}},},
+	.dma_names		= {"tx", "rx"},
+	.dmas			= {0x10, 0x6, 0x10, 0x7},
+	.interrupts		= {0x0, 0x39, 0x4},
+	.pinctrl_0		= 0x24,
+	.pinctrl_names		= "default",
+	.reg			= {0xff130000, 0x100},
+	.reg_io_width		= 0x4,
+	.reg_shift		= 0x2,
+};
+U_BOOT_DRVINFO(serial_at_ff130000) = {
+	.name		= "ns16550_serial",
+	.plat		= &dtv_serial_at_ff130000,
+	.plat_size	= sizeof(dtv_serial_at_ff130000),
+	.parent_idx	= -1,
+};
+
+/* Node /spi@ff190000 index 4 */
+static struct dtd_rockchip_rk3328_spi dtv_spi_at_ff190000 = {
+	.clocks			= {
+			{0, {32}},
+			{0, {209}},},
+	.dma_names		= {"tx", "rx"},
+	.dmas			= {0x10, 0x8, 0x10, 0x9},
+	.interrupts		= {0x0, 0x31, 0x4},
+	.pinctrl_0		= {0x2c, 0x2d, 0x2e, 0x2f},
+	.pinctrl_names		= "default",
+	.reg			= {0xff190000, 0x1000},
+};
+U_BOOT_DRVINFO(spi_at_ff190000) = {
+	.name		= "rockchip_rk3328_spi",
+	.plat		= &dtv_spi_at_ff190000,
+	.plat_size	= sizeof(dtv_spi_at_ff190000),
+	.parent_idx	= -1,
+};
+
+/*
+ * Node /syscon@ff100000 index 5
+ * driver rockchip_rk3328_grf parent None
+ */
+static struct dtd_rockchip_rk3328_grf dtv_syscon_at_ff100000 = {
+	.reg			= {0xff100000, 0x1000},
+};
+U_BOOT_DRVINFO(syscon_at_ff100000) = {
+	.name		= "rockchip_rk3328_grf",
+	.plat		= &dtv_syscon_at_ff100000,
+	.plat_size	= sizeof(dtv_syscon_at_ff100000),
+	.parent_idx	= -1,
+};
+
diff --git a/package/boot/uboot-rockchip/src/of-platdata/orangepi-r1-plus-rk3328/dt-structs-gen.h b/package/boot/uboot-rockchip/src/of-platdata/orangepi-r1-plus-rk3328/dt-structs-gen.h
new file mode 100644
index 00000000000000..d09583153103cf
--- /dev/null
+++ b/package/boot/uboot-rockchip/src/of-platdata/orangepi-r1-plus-rk3328/dt-structs-gen.h
@@ -0,0 +1,55 @@
+/*
+ * DO NOT MODIFY
+ *
+ * Defines the structs used to hold devicetree data.
+ * This was generated by dtoc from a .dtb (device tree binary) file.
+ */
+
+#include <stdbool.h>
+#include <linux/libfdt.h>
+struct dtd_ns16550_serial {
+	fdt32_t		clock_frequency;
+	struct phandle_1_arg clocks[2];
+	const char *	dma_names[2];
+	fdt32_t		dmas[4];
+	fdt32_t		interrupts[3];
+	fdt32_t		pinctrl_0;
+	const char *	pinctrl_names;
+	fdt64_t		reg[2];
+	fdt32_t		reg_io_width;
+	fdt32_t		reg_shift;
+};
+struct dtd_rockchip_rk3288_dw_mshc {
+	fdt32_t		bus_width;
+	bool		cap_sd_highspeed;
+	struct phandle_1_arg clocks[4];
+	bool		disable_wp;
+	fdt32_t		fifo_depth;
+	fdt32_t		interrupts[3];
+	fdt32_t		max_frequency;
+	fdt32_t		pinctrl_0[4];
+	const char *	pinctrl_names;
+	fdt64_t		reg[2];
+	bool		u_boot_spl_fifo_mode;
+	fdt32_t		vmmc_supply;
+};
+struct dtd_rockchip_rk3328_cru {
+	fdt64_t		reg[2];
+	fdt32_t		rockchip_grf;
+};
+struct dtd_rockchip_rk3328_dmc {
+	fdt64_t		reg[12];
+	fdt32_t		rockchip_sdram_params[196];
+};
+struct dtd_rockchip_rk3328_grf {
+	fdt64_t		reg[2];
+};
+struct dtd_rockchip_rk3328_spi {
+	struct phandle_1_arg clocks[2];
+	const char *	dma_names[2];
+	fdt32_t		dmas[4];
+	fdt32_t		interrupts[3];
+	fdt32_t		pinctrl_0[4];
+	const char *	pinctrl_names;
+	fdt64_t		reg[2];
+};
diff --git a/package/boot/uboot-rockchip/src/of-platdata/roc-cc-rk3328/dt-decl.h b/package/boot/uboot-rockchip/src/of-platdata/roc-cc-rk3328/dt-decl.h
new file mode 100644
index 00000000000000..72675609cd21d6
--- /dev/null
+++ b/package/boot/uboot-rockchip/src/of-platdata/roc-cc-rk3328/dt-decl.h
@@ -0,0 +1,24 @@
+/*
+ * DO NOT MODIFY
+ *
+ * Declares externs for all device/uclass instances.
+ * This was generated by dtoc from a .dtb (device tree binary) file.
+ */
+
+#include <dm/device-internal.h>
+#include <dm/uclass-internal.h>
+
+/* driver declarations - these allow DM_DRIVER_GET() to be used */
+extern U_BOOT_DRIVER(rockchip_rk3328_cru);
+extern U_BOOT_DRIVER(rockchip_rk3328_dmc);
+extern U_BOOT_DRIVER(rockchip_rk3288_dw_mshc);
+extern U_BOOT_DRIVER(rockchip_rk3288_dw_mshc);
+extern U_BOOT_DRIVER(ns16550_serial);
+extern U_BOOT_DRIVER(rockchip_rk3328_grf);
+
+/* uclass driver declarations - needed for DM_UCLASS_DRIVER_REF() */
+extern UCLASS_DRIVER(clk);
+extern UCLASS_DRIVER(mmc);
+extern UCLASS_DRIVER(ram);
+extern UCLASS_DRIVER(serial);
+extern UCLASS_DRIVER(syscon);
diff --git a/package/boot/uboot-rockchip/src/of-platdata/roc-cc-rk3328/dt-plat.c b/package/boot/uboot-rockchip/src/of-platdata/roc-cc-rk3328/dt-plat.c
new file mode 100644
index 00000000000000..aa03298e584696
--- /dev/null
+++ b/package/boot/uboot-rockchip/src/of-platdata/roc-cc-rk3328/dt-plat.c
@@ -0,0 +1,189 @@
+/*
+ * DO NOT MODIFY
+ *
+ * Declares the U_BOOT_DRIVER() records and platform data.
+ * This was generated by dtoc from a .dtb (device tree binary) file.
+ */
+
+/* Allow use of U_BOOT_DRVINFO() in this file */
+#define DT_PLAT_C
+
+#include <common.h>
+#include <dm.h>
+#include <dt-structs.h>
+
+/*
+ * driver_info declarations, ordered by 'struct driver_info' linker_list idx:
+ *
+ * idx  driver_info          driver
+ * ---  -------------------- --------------------
+ *   0: clock_controller_at_ff440000 rockchip_rk3328_cru
+ *   1: dmc                  rockchip_rk3328_dmc
+ *   2: mmc_at_ff500000      rockchip_rk3288_dw_mshc
+ *   3: mmc_at_ff520000      rockchip_rk3288_dw_mshc
+ *   4: serial_at_ff130000   ns16550_serial
+ *   5: syscon_at_ff100000   rockchip_rk3328_grf
+ * ---  -------------------- --------------------
+ */
+
+/*
+ * Node /clock-controller@ff440000 index 0
+ * driver rockchip_rk3328_cru parent None
+ */
+static struct dtd_rockchip_rk3328_cru dtv_clock_controller_at_ff440000 = {
+	.reg			= {0xff440000, 0x1000},
+	.rockchip_grf		= 0x3a,
+};
+U_BOOT_DRVINFO(clock_controller_at_ff440000) = {
+	.name		= "rockchip_rk3328_cru",
+	.plat		= &dtv_clock_controller_at_ff440000,
+	.plat_size	= sizeof(dtv_clock_controller_at_ff440000),
+	.parent_idx	= -1,
+};
+
+/*
+ * Node /dmc index 1
+ * driver rockchip_rk3328_dmc parent None
+ */
+static struct dtd_rockchip_rk3328_dmc dtv_dmc = {
+	.reg			= {0xff400000, 0x1000, 0xff780000, 0x3000, 0xff100000, 0x1000, 0xff440000, 0x1000,
+		0xff720000, 0x1000, 0xff798000, 0x1000},
+	.rockchip_sdram_params	= {0x1, 0xa, 0x2, 0x1, 0x0, 0x0, 0x11, 0x0,
+		0x11, 0x0, 0x0, 0x94291288, 0x0, 0x27, 0x462, 0x15,
+		0x242, 0xff, 0x14d, 0x0, 0x1, 0x0, 0x0, 0x0,
+		0x43049010, 0x64, 0x28003b, 0xd0, 0x20053, 0xd4, 0x220000, 0xd8,
+		0x100, 0xdc, 0x40000, 0xe0, 0x0, 0xe4, 0x110000, 0xe8,
+		0x420, 0xec, 0x400, 0xf4, 0xf011f, 0x100, 0x9060b06, 0x104,
+		0x20209, 0x108, 0x505040a, 0x10c, 0x40400c, 0x110, 0x5030206, 0x114,
+		0x3030202, 0x120, 0x3030b03, 0x124, 0x20208, 0x180, 0x1000040, 0x184,
+		0x0, 0x190, 0x7030003, 0x198, 0x5001100, 0x1a0, 0xc0400003, 0x240,
+		0x6000604, 0x244, 0x201, 0x250, 0xf00, 0x490, 0x1, 0xffffffff,
+		0xffffffff, 0xffffffff, 0xffffffff, 0x4, 0xc, 0x28, 0xa, 0x2c,
+		0x0, 0x30, 0x9, 0xffffffff, 0xffffffff, 0x77, 0x88, 0x79,
+		0x79, 0x87, 0x97, 0x87, 0x78, 0x77, 0x78, 0x87,
+		0x88, 0x87, 0x87, 0x77, 0x78, 0x78, 0x78, 0x78,
+		0x78, 0x78, 0x78, 0x78, 0x78, 0x69, 0x9, 0x77,
+		0x78, 0x77, 0x78, 0x77, 0x78, 0x77, 0x78, 0x77,
+		0x79, 0x9, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78,
+		0x78, 0x78, 0x78, 0x69, 0x9, 0x77, 0x78, 0x77,
+		0x77, 0x77, 0x77, 0x77, 0x77, 0x77, 0x79, 0x9,
+		0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78,
+		0x78, 0x69, 0x9, 0x77, 0x78, 0x77, 0x78, 0x77,
+		0x78, 0x77, 0x78, 0x77, 0x79, 0x9, 0x78, 0x78,
+		0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x69,
+		0x9, 0x77, 0x78, 0x77, 0x77, 0x77, 0x77, 0x77,
+		0x77, 0x77, 0x79, 0x9},
+};
+U_BOOT_DRVINFO(dmc) = {
+	.name		= "rockchip_rk3328_dmc",
+	.plat		= &dtv_dmc,
+	.plat_size	= sizeof(dtv_dmc),
+	.parent_idx	= -1,
+};
+
+/*
+ * Node /mmc@ff500000 index 2
+ * driver rockchip_rk3288_dw_mshc parent None
+ */
+static struct dtd_rockchip_rk3288_dw_mshc dtv_mmc_at_ff500000 = {
+	.bus_width		= 0x4,
+	.cap_mmc_highspeed	= true,
+	.cap_sd_highspeed	= true,
+	.clocks			= {
+			{0, {317}},
+			{0, {33}},
+			{0, {74}},
+			{0, {78}},},
+	.disable_wp		= true,
+	.fifo_depth		= 0x100,
+	.interrupts		= {0x0, 0xc, 0x4},
+	.max_frequency		= 0x8f0d180,
+	.pinctrl_0		= {0x47, 0x48, 0x49, 0x4a},
+	.pinctrl_names		= "default",
+	.reg			= {0xff500000, 0x4000},
+	.sd_uhs_sdr104		= true,
+	.sd_uhs_sdr12		= true,
+	.sd_uhs_sdr25		= true,
+	.sd_uhs_sdr50		= true,
+	.u_boot_spl_fifo_mode	= true,
+	.vmmc_supply		= 0x4b,
+	.vqmmc_supply		= 0x1e,
+};
+U_BOOT_DRVINFO(mmc_at_ff500000) = {
+	.name		= "rockchip_rk3288_dw_mshc",
+	.plat		= &dtv_mmc_at_ff500000,
+	.plat_size	= sizeof(dtv_mmc_at_ff500000),
+	.parent_idx	= -1,
+};
+
+/*
+ * Node /mmc@ff520000 index 3
+ * driver rockchip_rk3288_dw_mshc parent None
+ */
+static struct dtd_rockchip_rk3288_dw_mshc dtv_mmc_at_ff520000 = {
+	.bus_width		= 0x8,
+	.cap_mmc_highspeed	= true,
+	.clocks			= {
+			{0, {319}},
+			{0, {35}},
+			{0, {76}},
+			{0, {80}},},
+	.fifo_depth		= 0x100,
+	.interrupts		= {0x0, 0xe, 0x4},
+	.max_frequency		= 0x8f0d180,
+	.mmc_ddr_1_8v		= true,
+	.mmc_hs200_1_8v		= true,
+	.non_removable		= true,
+	.pinctrl_0		= {0x4c, 0x4d, 0x4e, 0x0},
+	.pinctrl_names		= "default",
+	.reg			= {0xff520000, 0x4000},
+	.u_boot_spl_fifo_mode	= true,
+	.vmmc_supply		= 0x1c,
+	.vqmmc_supply		= 0x1d,
+};
+U_BOOT_DRVINFO(mmc_at_ff520000) = {
+	.name		= "rockchip_rk3288_dw_mshc",
+	.plat		= &dtv_mmc_at_ff520000,
+	.plat_size	= sizeof(dtv_mmc_at_ff520000),
+	.parent_idx	= -1,
+};
+
+/*
+ * Node /serial@ff130000 index 4
+ * driver ns16550_serial parent None
+ */
+static struct dtd_ns16550_serial dtv_serial_at_ff130000 = {
+	.clock_frequency	= 0x16e3600,
+	.clocks			= {
+			{0, {40}},
+			{0, {212}},},
+	.dma_names		= {"tx", "rx"},
+	.dmas			= {0x10, 0x6, 0x10, 0x7},
+	.interrupts		= {0x0, 0x39, 0x4},
+	.pinctrl_0		= 0x26,
+	.pinctrl_names		= "default",
+	.reg			= {0xff130000, 0x100},
+	.reg_io_width		= 0x4,
+	.reg_shift		= 0x2,
+};
+U_BOOT_DRVINFO(serial_at_ff130000) = {
+	.name		= "ns16550_serial",
+	.plat		= &dtv_serial_at_ff130000,
+	.plat_size	= sizeof(dtv_serial_at_ff130000),
+	.parent_idx	= -1,
+};
+
+/*
+ * Node /syscon@ff100000 index 5
+ * driver rockchip_rk3328_grf parent None
+ */
+static struct dtd_rockchip_rk3328_grf dtv_syscon_at_ff100000 = {
+	.reg			= {0xff100000, 0x1000},
+};
+U_BOOT_DRVINFO(syscon_at_ff100000) = {
+	.name		= "rockchip_rk3328_grf",
+	.plat		= &dtv_syscon_at_ff100000,
+	.plat_size	= sizeof(dtv_syscon_at_ff100000),
+	.parent_idx	= -1,
+};
+
diff --git a/package/boot/uboot-rockchip/src/of-platdata/roc-cc-rk3328/dt-structs-gen.h b/package/boot/uboot-rockchip/src/of-platdata/roc-cc-rk3328/dt-structs-gen.h
new file mode 100644
index 00000000000000..5b729fc57f5343
--- /dev/null
+++ b/package/boot/uboot-rockchip/src/of-platdata/roc-cc-rk3328/dt-structs-gen.h
@@ -0,0 +1,55 @@
+/*
+ * DO NOT MODIFY
+ *
+ * Defines the structs used to hold devicetree data.
+ * This was generated by dtoc from a .dtb (device tree binary) file.
+ */
+
+#include <stdbool.h>
+#include <linux/libfdt.h>
+struct dtd_ns16550_serial {
+	fdt32_t		clock_frequency;
+	struct phandle_1_arg clocks[2];
+	const char *	dma_names[2];
+	fdt32_t		dmas[4];
+	fdt32_t		interrupts[3];
+	fdt32_t		pinctrl_0;
+	const char *	pinctrl_names;
+	fdt64_t		reg[2];
+	fdt32_t		reg_io_width;
+	fdt32_t		reg_shift;
+};
+struct dtd_rockchip_rk3288_dw_mshc {
+	fdt32_t		bus_width;
+	bool		cap_mmc_highspeed;
+	bool		cap_sd_highspeed;
+	struct phandle_1_arg clocks[4];
+	bool		disable_wp;
+	fdt32_t		fifo_depth;
+	fdt32_t		interrupts[3];
+	fdt32_t		max_frequency;
+	bool		mmc_ddr_1_8v;
+	bool		mmc_hs200_1_8v;
+	bool		non_removable;
+	fdt32_t		pinctrl_0[4];
+	const char *	pinctrl_names;
+	fdt64_t		reg[2];
+	bool		sd_uhs_sdr104;
+	bool		sd_uhs_sdr12;
+	bool		sd_uhs_sdr25;
+	bool		sd_uhs_sdr50;
+	bool		u_boot_spl_fifo_mode;
+	fdt32_t		vmmc_supply;
+	fdt32_t		vqmmc_supply;
+};
+struct dtd_rockchip_rk3328_cru {
+	fdt64_t		reg[2];
+	fdt32_t		rockchip_grf;
+};
+struct dtd_rockchip_rk3328_dmc {
+	fdt64_t		reg[12];
+	fdt32_t		rockchip_sdram_params[196];
+};
+struct dtd_rockchip_rk3328_grf {
+	fdt64_t		reg[2];
+};
diff --git a/package/boot/uboot-sifiveu/Makefile b/package/boot/uboot-sifiveu/Makefile
new file mode 100644
index 00000000000000..5def1c1fcb801b
--- /dev/null
+++ b/package/boot/uboot-sifiveu/Makefile
@@ -0,0 +1,63 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2022 OpenWrt.org
+#
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_RELEASE:=1
+PKG_VERSION:=2022.10
+PKG_HASH:=50b4482a505bc281ba8470c399a3c26e145e29b23500bc35c50debd7fa46bdf8
+
+include $(INCLUDE_DIR)/u-boot.mk
+include $(INCLUDE_DIR)/package.mk
+
+define U-Boot/Default
+  BUILD_TARGET:=sifiveu
+  BUILD_DEVICES=$(1)
+  UBOOT_IMAGE:=u-boot.itb
+  DTS_DIR:=arch/riscv/dts
+  UENV:=default
+  DEFAULT:=y
+endef
+
+define U-Boot/sifive_unleashed
+  NAME:=SiFive Unleashed
+  OPENSBI:=generic
+  DEPENDS:=+opensbi_generic
+  UBOOT_DTS:=hifive-unleashed-a00.dtb
+  BUILD_DEVICES:=sifive_unleashed
+endef
+
+define U-Boot/sifive_unmatched
+  NAME:=SiFive Unmatched
+  OPENSBI:=generic
+  DEPENDS:=+opensbi_generic
+  UBOOT_DTS:=hifive-unmatched-a00.dtb
+  BUILD_DEVICES:=sifive_unmatched
+endef
+
+UBOOT_TARGETS := \
+	sifive_unleashed \
+	sifive_unmatched
+
+UBOOT_MAKE_FLAGS += \
+        OPENSBI=$(STAGING_DIR_IMAGE)/fw_dynamic-${OPENSBI}.bin
+
+define Build/Configure
+	$(call Build/Configure/U-Boot)
+	sed -i 's/CONFIG_TOOLS_LIBCRYPTO=y/# CONFIG_TOOLS_LIBCRYPTO is not set/' $(PKG_BUILD_DIR)/.config
+endef
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/$(UBOOT_IMAGE) $(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-$(UBOOT_IMAGE)
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/spl/u-boot-spl.bin $(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-$(UBOOT_IMAGE)-spl
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/$(DTS_DIR)/$(UBOOT_DTS) $(STAGING_DIR_IMAGE)/$(UBOOT_DTS)
+
+	mkimage -C none -A arm -T script -d uEnv-$(UENV).txt \
+		$(STAGING_DIR_IMAGE)/$(BUILD_DEVICES)-boot.scr
+endef
+
+$(eval $(call BuildPackage/U-Boot))
diff --git a/package/boot/uboot-sifiveu/patches/0002-board-sifive-spl-Initialized-the-PWM-setting-in-the-.patch b/package/boot/uboot-sifiveu/patches/0002-board-sifive-spl-Initialized-the-PWM-setting-in-the-.patch
new file mode 100644
index 00000000000000..27cda75326f8a8
--- /dev/null
+++ b/package/boot/uboot-sifiveu/patches/0002-board-sifive-spl-Initialized-the-PWM-setting-in-the-.patch
@@ -0,0 +1,104 @@
+From 725595e667cc4423347c255da8ca4c5b3aa0980a Mon Sep 17 00:00:00 2001
+From: Vincent Chen <vincent.chen@sifive.com>
+Date: Mon, 15 Nov 2021 03:31:04 -0800
+Subject: [PATCH 2/8] board: sifive: spl: Initialized the PWM setting in the
+ SPL stage
+
+LEDs and multiple fans can be controlled by SPL. This patch ensures
+that all fans have been enabled in the SPL stage. In addition, the
+LED's color will be set to yellow.
+---
+ board/sifive/unmatched/Makefile |  1 +
+ board/sifive/unmatched/pwm.c    | 57 +++++++++++++++++++++++++++++++++
+ board/sifive/unmatched/spl.c    |  2 ++
+ 3 files changed, 60 insertions(+)
+ create mode 100644 board/sifive/unmatched/pwm.c
+
+diff --git a/board/sifive/unmatched/Makefile b/board/sifive/unmatched/Makefile
+index 1345330089..5df01982e9 100644
+--- a/board/sifive/unmatched/Makefile
++++ b/board/sifive/unmatched/Makefile
+@@ -9,3 +9,4 @@ obj-y += spl.o
+ else
+ obj-y += unmatched.o
+ endif
++obj-y += pwm.o
+diff --git a/board/sifive/unmatched/pwm.c b/board/sifive/unmatched/pwm.c
+new file mode 100644
+index 0000000000..e1cc02310a
+--- /dev/null
++++ b/board/sifive/unmatched/pwm.c
+@@ -0,0 +1,57 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Copyright (c) 2021, SiFive Inc
++ *
++ * Authors:
++ *   Vincent Chen <vincent.chen@sifive.com>
++ *   David Abdurachmanov <david.abdurachmanov@sifive.com>
++ */
++
++#include <linux/io.h>
++#include <asm/arch/eeprom.h>
++
++struct pwm_sifive_regs {
++	unsigned int cfg;	/* PWM configuration register */
++	unsigned int pad0;	/* Reserved */
++	unsigned int cnt;	/* PWM count register */
++	unsigned int pad1;	/* Reserved */
++	unsigned int pwms;	/* Scaled PWM count register */
++	unsigned int pad2;	/* Reserved */
++	unsigned int pad3;	/* Reserved */
++	unsigned int pad4;	/* Reserved */
++	unsigned int cmp0;	/* PWM 0 compare register */
++	unsigned int cmp1;	/* PWM 1 compare register */
++	unsigned int cmp2;	/* PWM 2 compare register */
++	unsigned int cmp3;	/* PWM 3 compare register */
++};
++
++#define PWM0_BASE		0x10020000
++#define PWM1_BASE		0x10021000
++#define PWM_CFG_INIT		0x1000
++#define PWM_CMP_ENABLE_VAL	0x0
++#define PWM_CMP_DISABLE_VAL	0xffff
++
++void pwm_device_init(void)
++{
++	struct pwm_sifive_regs *pwm0, *pwm1;
++	pwm0 = (struct pwm_sifive_regs *)PWM0_BASE;
++	pwm1 = (struct pwm_sifive_regs *)PWM1_BASE;
++	writel(PWM_CMP_DISABLE_VAL, (void *)&pwm0->cmp0);
++	/* Set the 3-color PWM LEDs to yellow in SPL */
++	writel(PWM_CMP_ENABLE_VAL, (void *)&pwm0->cmp1);
++	writel(PWM_CMP_ENABLE_VAL, (void *)&pwm0->cmp2);
++	writel(PWM_CMP_DISABLE_VAL, (void *)&pwm0->cmp3);
++	writel(PWM_CFG_INIT, (void *)&pwm0->cfg);
++
++	writel(PWM_CMP_DISABLE_VAL, (void *)&pwm0->cmp3);
++	/* Turn on all the fans, (J21), (J23) and (J24), on the unmatched board */
++	/* The SoC fan(J21) on the rev3 board cannot be controled by PWM_COMP0,
++	   so here sets the initial value of PWM_COMP0 as DISABLE */
++	if (get_pcb_revision_from_eeprom() == PCB_REVISION_REV3)
++		writel(PWM_CMP_DISABLE_VAL, (void *)&pwm1->cmp1);
++	else
++		writel(PWM_CMP_ENABLE_VAL, (void *)&pwm1->cmp1);
++	writel(PWM_CMP_ENABLE_VAL, (void *)&pwm1->cmp2);
++	writel(PWM_CMP_ENABLE_VAL, (void *)&pwm1->cmp3);
++	writel(PWM_CFG_INIT, (void *)&pwm1->cfg);
++}
+diff --git a/board/sifive/unmatched/spl.c b/board/sifive/unmatched/spl.c
+index 7c0beedc08..f3a661a81e 100644
+--- a/board/sifive/unmatched/spl.c
++++ b/board/sifive/unmatched/spl.c
+@@ -90,6 +90,8 @@ int spl_board_init_f(void)
+ 		goto end;
+ 	}
+ 
++	pwm_device_init();
++
+ 	ret = spl_gemgxl_init();
+ 	if (ret) {
+ 		debug("Gigabit ethernet PHY (VSC8541) init failed: %d\n", ret);
+-- 
+2.27.0
+
diff --git a/package/boot/uboot-sifiveu/patches/0003-board-sifive-Set-LED-s-color-to-purple-in-the-U-boot.patch b/package/boot/uboot-sifiveu/patches/0003-board-sifive-Set-LED-s-color-to-purple-in-the-U-boot.patch
new file mode 100644
index 00000000000000..9820d2e2f9df9e
--- /dev/null
+++ b/package/boot/uboot-sifiveu/patches/0003-board-sifive-Set-LED-s-color-to-purple-in-the-U-boot.patch
@@ -0,0 +1,68 @@
+From 7ead6d662a2f9d8498af6650ea38418c64b52048 Mon Sep 17 00:00:00 2001
+From: Vincent Chen <vincent.chen@sifive.com>
+Date: Mon, 24 Jan 2022 02:42:02 -0800
+Subject: [PATCH 3/8] board: sifive: Set LED's color to purple in the U-boot
+ stage
+
+Set LED's color to purple in the U-boot stage. Because there are still
+some functions to be executed before board_early_init_f(), it means
+the LED's is not changed to purple instantly when entering the U-boot
+stage.
+---
+ board/sifive/unmatched/pwm.c       | 7 +++++++
+ board/sifive/unmatched/unmatched.c | 6 ++++++
+ configs/sifive_unmatched_defconfig | 1 +
+ 3 files changed, 14 insertions(+)
+
+diff --git a/board/sifive/unmatched/pwm.c b/board/sifive/unmatched/pwm.c
+index e1cc02310a..bd67672c22 100644
+--- a/board/sifive/unmatched/pwm.c
++++ b/board/sifive/unmatched/pwm.c
+@@ -36,6 +36,7 @@ void pwm_device_init(void)
+ 	struct pwm_sifive_regs *pwm0, *pwm1;
+ 	pwm0 = (struct pwm_sifive_regs *)PWM0_BASE;
+ 	pwm1 = (struct pwm_sifive_regs *)PWM1_BASE;
++#ifdef CONFIG_SPL_BUILD
+ 	writel(PWM_CMP_DISABLE_VAL, (void *)&pwm0->cmp0);
+ 	/* Set the 3-color PWM LEDs to yellow in SPL */
+ 	writel(PWM_CMP_ENABLE_VAL, (void *)&pwm0->cmp1);
+@@ -54,4 +55,10 @@ void pwm_device_init(void)
+ 	writel(PWM_CMP_ENABLE_VAL, (void *)&pwm1->cmp2);
+ 	writel(PWM_CMP_ENABLE_VAL, (void *)&pwm1->cmp3);
+ 	writel(PWM_CFG_INIT, (void *)&pwm1->cfg);
++#else
++	/* Set the 3-color PWM LEDs to purple in U-boot */
++	writel(PWM_CMP_DISABLE_VAL, (void *)&pwm0->cmp1);
++	writel(PWM_CMP_ENABLE_VAL, (void *)&pwm0->cmp2);
++	writel(PWM_CMP_ENABLE_VAL, (void *)&pwm0->cmp3);
++#endif
+ }
+diff --git a/board/sifive/unmatched/unmatched.c b/board/sifive/unmatched/unmatched.c
+index 6295deeae2..30c082d001 100644
+--- a/board/sifive/unmatched/unmatched.c
++++ b/board/sifive/unmatched/unmatched.c
+@@ -22,6 +22,12 @@ void *board_fdt_blob_setup(int *err)
+ 	return (ulong *)&_end;
+ }
+ 
++int board_early_init_f(void)
++{
++	pwm_device_init();
++	return 0;
++}
++
+ int board_init(void)
+ {
+ 	/* enable all cache ways */
+diff --git a/configs/sifive_unmatched_defconfig b/configs/sifive_unmatched_defconfig
+index d400ed0b23..0758f8e90f 100644
+--- a/configs/sifive_unmatched_defconfig
++++ b/configs/sifive_unmatched_defconfig
+@@ -51,3 +51,4 @@ CONFIG_DM_SCSI=y
+ CONFIG_USB=y
+ CONFIG_USB_XHCI_HCD=y
+ CONFIG_USB_XHCI_PCI=y
++CONFIG_BOARD_EARLY_INIT_F=y
+-- 
+2.27.0
+
diff --git a/package/boot/uboot-sifiveu/patches/0004-board-sifive-Set-LED-s-color-to-blue-before-jumping-.patch b/package/boot/uboot-sifiveu/patches/0004-board-sifive-Set-LED-s-color-to-blue-before-jumping-.patch
new file mode 100644
index 00000000000000..b5bffd22bd6728
--- /dev/null
+++ b/package/boot/uboot-sifiveu/patches/0004-board-sifive-Set-LED-s-color-to-blue-before-jumping-.patch
@@ -0,0 +1,30 @@
+From 6ef7023c0dcfde320015ab19e0e0d423921be77d Mon Sep 17 00:00:00 2001
+From: Vincent Chen <vincent.chen@sifive.com>
+Date: Mon, 15 Nov 2021 03:39:07 -0800
+Subject: [PATCH 1/2] board: sifive: Set LED's color to blue before jumping to
+ Linux
+
+The LED's color wil be changed from purple to blue before executing
+the sysboot command. Because the sysboot command includes the image loading
+from the boot partition, It means the LED's color is blue when executing
+"Retrieving file: /Image.gz".
+---
+ include/configs/sifive-unmatched.h | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/include/configs/sifive-unmatched.h
++++ b/include/configs/sifive-unmatched.h
+@@ -49,7 +49,12 @@
+ 	"type_guid_gpt_system=" TYPE_GUID_SYSTEM "\0" \
+ 	"partitions=" PARTS_DEFAULT "\0" \
+ 	"fdtfile=" CONFIG_DEFAULT_FDT_FILE "\0" \
+-	BOOTENV
++	"setled_blue=mw.l 0x10020024 0x0000ffff; mw.l 0x10020028 0x0000ffff; mw.l 0x1002002c 0x0\0" \
++	BOOTENV \
++	"boot_extlinux=" \
++		"run setled_blue; " \
++		"sysboot ${devtype} ${devnum}:${distro_bootpart} any " \
++			"${scriptaddr} ${prefix}${boot_syslinux_conf};\0"
+ 
+ #define CONFIG_SYS_EEPROM_BUS_NUM		0
+ 
diff --git a/package/boot/uboot-sifiveu/patches/0005-board-sifive-spl-Set-remote-thermal-of-TMP451-to-85-.patch b/package/boot/uboot-sifiveu/patches/0005-board-sifive-spl-Set-remote-thermal-of-TMP451-to-85-.patch
new file mode 100644
index 00000000000000..dc0d04151faae1
--- /dev/null
+++ b/package/boot/uboot-sifiveu/patches/0005-board-sifive-spl-Set-remote-thermal-of-TMP451-to-85-.patch
@@ -0,0 +1,111 @@
+From 07f84ed283b913cbdf87181ae2ed65467d923df5 Mon Sep 17 00:00:00 2001
+From: Vincent Chen <vincent.chen@sifive.com>
+Date: Mon, 24 Jan 2022 02:57:40 -0800
+Subject: [PATCH 2/2] board: sifive: spl: Set remote thermal of TMP451 to 85
+ deg C for the unmatched board
+
+For TMP451 on the unmatched board, the default value of the remote
+thermal threshold is 108 deg C. This commit initilizes it to 85 deg C at SPL.
+---
+ board/sifive/unmatched/spl.c       | 29 +++++++++++++++++++++++++++++
+ drivers/misc/Kconfig               | 10 ++++++++++
+ include/configs/sifive-unmatched.h |  4 ++++
+ scripts/config_whitelist.txt       |  1 +
+ 4 files changed, 44 insertions(+)
+
+--- a/board/sifive/unmatched/spl.c
++++ b/board/sifive/unmatched/spl.c
+@@ -10,6 +10,8 @@
+ #include <spl.h>
+ #include <misc.h>
+ #include <log.h>
++#include <config.h>
++#include <i2c.h>
+ #include <linux/delay.h>
+ #include <linux/io.h>
+ #include <asm/gpio.h>
+@@ -26,6 +28,27 @@
+ #define MODE_SELECT_SD		0xb
+ #define MODE_SELECT_MASK	GENMASK(3, 0)
+ 
++#define TMP451_REMOTE_THERM_LIMIT_REG_OFFSET	0x19
++#define TMP451_REMOTE_THERM_LIMIT_INIT_VALUE	0x55
++
++static inline int init_tmp451_remote_therm_limit(void)
++{
++	struct udevice *dev;
++	unsigned char r_therm_limit = TMP451_REMOTE_THERM_LIMIT_INIT_VALUE;
++	int ret;
++
++	ret = i2c_get_chip_for_busnum(CONFIG_SYS_TMP451_BUS_NUM,
++				      CONFIG_SYS_I2C_TMP451_ADDR,
++				      CONFIG_SYS_I2C_TMP451_ADDR_LEN,
++				      &dev);
++
++	if (!ret)
++		ret = dm_i2c_write(dev, TMP451_REMOTE_THERM_LIMIT_REG_OFFSET,
++				   &r_therm_limit,
++				   sizeof(unsigned char));
++	return ret;
++}
++
+ static inline int spl_reset_device_by_gpio(const char *label, int pin, int low_width)
+ {
+ 	int ret;
+@@ -92,6 +115,12 @@ int spl_board_init_f(void)
+ 
+ 	pwm_device_init();
+ 
++	ret = init_tmp451_remote_therm_limit();
++	if (ret) {
++		debug("TMP451 remote THERM limit init failed: %d\n", ret);
++		goto end;
++	}
++
+ 	ret = spl_gemgxl_init();
+ 	if (ret) {
+ 		debug("Gigabit ethernet PHY (VSC8541) init failed: %d\n", ret);
+--- a/drivers/misc/Kconfig
++++ b/drivers/misc/Kconfig
+@@ -536,8 +536,18 @@ config SYS_I2C_EEPROM_ADDR
+ 	depends on ID_EEPROM || I2C_EEPROM || SPL_I2C_EEPROM || CMD_EEPROM || ENV_IS_IN_EEPROM
+ 	default 0
+ 
++config SYS_I2C_TMP451_ADDR
++	hex "Chip address of the TMP451 device"
++	default 0
++
+ if I2C_EEPROM
+ 
++config SYS_I2C_TMP451_ADDR_LEN
++	int "Length in bytes of the TMP451 memory array address"
++	default 1
++	help
++	  Note: This is NOT the chip address length!
++
+ config SYS_I2C_EEPROM_ADDR_OVERFLOW
+ 	hex "EEPROM Address Overflow"
+ 	default 0x0
+--- a/include/configs/sifive-unmatched.h
++++ b/include/configs/sifive-unmatched.h
+@@ -15,6 +15,10 @@
+ 
+ #define CONFIG_STANDALONE_LOAD_ADDR	0x80200000
+ 
++#define CONFIG_SYS_TMP451_BUS_NUM	0
++#define CONFIG_SYS_I2C_TMP451_ADDR	0x4c
++#define CONFIG_SYS_I2C_TMP451_ADDR_LEN	0x1
++
+ /* Environment options */
+ 
+ #define BOOT_TARGET_DEVICES(func) \
+--- a/scripts/config_whitelist.txt
++++ b/scripts/config_whitelist.txt
+@@ -1268,6 +1268,7 @@ CONFIG_SYS_TIMER_BASE
+ CONFIG_SYS_TIMER_COUNTER
+ CONFIG_SYS_TIMER_COUNTS_DOWN
+ CONFIG_SYS_TIMER_RATE
++CONFIG_SYS_TMP451_BUS_NUM
+ CONFIG_SYS_TMPVIRT
+ CONFIG_SYS_TSEC1_OFFSET
+ CONFIG_SYS_TX_ETH_BUFFER
diff --git a/package/boot/uboot-sifiveu/patches/0008-riscv-dts-Add-few-PMU-events.patch b/package/boot/uboot-sifiveu/patches/0008-riscv-dts-Add-few-PMU-events.patch
new file mode 100644
index 00000000000000..3f3feb9da70c65
--- /dev/null
+++ b/package/boot/uboot-sifiveu/patches/0008-riscv-dts-Add-few-PMU-events.patch
@@ -0,0 +1,36 @@
+From c29e4d84cfa17ab96eff2a9044f486ba3c8b5c43 Mon Sep 17 00:00:00 2001
+From: Atish Patra <atish.patra@wdc.com>
+Date: Mon, 25 Oct 2021 11:35:41 -0700
+Subject: [PATCH] riscv: dts: Add few PMU events
+
+fu740 has 2 HPM counters and many HPM events defined in the fu740 manual[1].
+This patch adds some of these events and their mapping as per the
+OpenSBI PMU DT binding for now.
+
+[1]https://sifive.cdn.prismic.io/sifive/de1491e5-077c-461d-9605-e8a0ce57337d_fu740-c000-manual-v1p3.pdf
+
+Signed-off-by: Atish Patra <atish.patra@wdc.com>
+---
+ arch/riscv/dts/fu740-c000.dtsi | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/arch/riscv/dts/fu740-c000.dtsi
++++ b/arch/riscv/dts/fu740-c000.dtsi
+@@ -140,6 +140,17 @@
+ 		#size-cells = <2>;
+ 		compatible = "simple-bus";
+ 		ranges;
++		pmu {
++			compatible = "riscv,pmu";
++			riscv,raw-event-to-mhpmcounters = <0x00000000 0x200 0x18
++							 0x00000000 0x400 0x18
++							 0x00000000 0x800 0x18>;
++			riscv,event-to-mhpmcounters = <0x05 0x06 0x18
++						     0x10009 0x10009 0x18>;
++			riscv,event-to-mhpmevent = <0x05 0x00000000 0x4000
++						  0x06 0x00000000 0x4001
++						  0x10008 0x00000000 0x102>;
++		};
+ 		plic0: interrupt-controller@c000000 {
+ 			#interrupt-cells = <1>;
+ 			#address-cells = <0>;
diff --git a/package/boot/uboot-sifiveu/patches/0009-riscv-Fix-build-against-binutils.patch b/package/boot/uboot-sifiveu/patches/0009-riscv-Fix-build-against-binutils.patch
new file mode 100644
index 00000000000000..87dbf984ec54aa
--- /dev/null
+++ b/package/boot/uboot-sifiveu/patches/0009-riscv-Fix-build-against-binutils.patch
@@ -0,0 +1,50 @@
+commit 1dde977518f13824b847e23275001191139bc384
+Author: Alexandre Ghiti <alexandre.ghiti@canonical.com>
+Date:   Mon Oct 3 18:07:54 2022 +0200
+
+    riscv: Fix build against binutils 2.38
+    
+    The following description is copied from the equivalent patch for the
+    Linux Kernel proposed by Aurelien Jarno:
+    
+    >From version 2.38, binutils default to ISA spec version 20191213. This
+    means that the csr read/write (csrr*/csrw*) instructions and fence.i
+    instruction has separated from the `I` extension, become two standalone
+    extensions: Zicsr and Zifencei. As the kernel uses those instruction,
+    this causes the following build failure:
+    
+    arch/riscv/cpu/mtrap.S: Assembler messages:
+    arch/riscv/cpu/mtrap.S:65: Error: unrecognized opcode `csrr a0,scause'
+    arch/riscv/cpu/mtrap.S:66: Error: unrecognized opcode `csrr a1,sepc'
+    arch/riscv/cpu/mtrap.S:67: Error: unrecognized opcode `csrr a2,stval'
+    arch/riscv/cpu/mtrap.S:70: Error: unrecognized opcode `csrw sepc,a0'
+    
+    Signed-off-by: Alexandre Ghiti <alexandre.ghiti@canonical.com>
+    Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+    Tested-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
+    Tested-by: Heiko Stuebner <heiko@sntech.de>
+    Tested-by: Christian Stewart <christian@paral.in>
+    Reviewed-by: Rick Chen <rick@andestech.com>
+
+diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile
+index 0b80eb8d86..53d1194ffb 100644
+--- a/arch/riscv/Makefile
++++ b/arch/riscv/Makefile
+@@ -24,7 +24,16 @@ ifeq ($(CONFIG_CMODEL_MEDANY),y)
+ 	CMODEL = medany
+ endif
+ 
+-ARCH_FLAGS = -march=$(ARCH_BASE)$(ARCH_A)$(ARCH_C) -mabi=$(ABI) \
++RISCV_MARCH = $(ARCH_BASE)$(ARCH_A)$(ARCH_C)
++
++# Newer binutils versions default to ISA spec version 20191213 which moves some
++# instructions from the I extension to the Zicsr and Zifencei extensions.
++toolchain-need-zicsr-zifencei := $(call cc-option-yn, -mabi=$(ABI) -march=$(RISCV_MARCH)_zicsr_zifencei)
++ifeq ($(toolchain-need-zicsr-zifencei),y)
++	RISCV_MARCH := $(RISCV_MARCH)_zicsr_zifencei
++endif
++
++ARCH_FLAGS = -march=$(RISCV_MARCH) -mabi=$(ABI) \
+ 	     -mcmodel=$(CMODEL)
+ 
+ PLATFORM_CPPFLAGS	+= $(ARCH_FLAGS)
diff --git a/package/boot/uboot-sifiveu/patches/100-mkimage-check-environment-for-dtc-binary-location.patch b/package/boot/uboot-sifiveu/patches/100-mkimage-check-environment-for-dtc-binary-location.patch
new file mode 100644
index 00000000000000..482aa1a3693cb0
--- /dev/null
+++ b/package/boot/uboot-sifiveu/patches/100-mkimage-check-environment-for-dtc-binary-location.patch
@@ -0,0 +1,35 @@
+From 637800493945ffed2f454756300437a4ec86e3b1 Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Wed, 19 Jul 2017 22:23:15 +0200
+Subject: mkimage: check environment for dtc binary location
+
+Currently mkimage assumes the dtc binary is in the path and fails
+otherwise. This patch makes it check the DTC environment variable first
+for the dtc binary and then fall back to the default path. This makes
+it possible to call the u-boot build with make DTC=... and build a fit
+image with the dtc binary not being the the default path.
+
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Simon Glass <sjg@chromium.org>
+---
+ tools/fit_image.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/tools/fit_image.c
++++ b/tools/fit_image.c
+@@ -726,9 +726,14 @@ static int fit_handle_file(struct image_
+ 		}
+ 		*cmd = '\0';
+ 	} else if (params->datafile) {
++		const char* dtc = getenv("DTC");
++
++		if (!dtc)
++			dtc = MKIMAGE_DTC;
++
+ 		/* dtc -I dts -O dtb -p 500 -o tmpfile datafile */
+ 		snprintf(cmd, sizeof(cmd), "%s %s -o \"%s\" \"%s\"",
+-			 MKIMAGE_DTC, params->dtc, tmpfile, params->datafile);
++			 dtc, params->dtc, tmpfile, params->datafile);
+ 		debug("Trying to execute \"%s\"\n", cmd);
+ 	} else {
+ 		snprintf(cmd, sizeof(cmd), "cp \"%s\" \"%s\"",
diff --git a/package/boot/uboot-sifiveu/patches/110-no-kwbimage.patch b/package/boot/uboot-sifiveu/patches/110-no-kwbimage.patch
new file mode 100644
index 00000000000000..65d14f5bece8bd
--- /dev/null
+++ b/package/boot/uboot-sifiveu/patches/110-no-kwbimage.patch
@@ -0,0 +1,10 @@
+--- a/tools/Makefile
++++ b/tools/Makefile
+@@ -119,7 +119,6 @@ dumpimage-mkimage-objs := aisimage.o \
+ 			imximage.o \
+ 			imx8image.o \
+ 			imx8mimage.o \
+-			kwbimage.o \
+ 			lib/md5.o \
+ 			lpc32xximage.o \
+ 			mxsimage.o \
diff --git a/package/boot/uboot-sifiveu/patches/130-fix-mkimage-host-build.patch b/package/boot/uboot-sifiveu/patches/130-fix-mkimage-host-build.patch
new file mode 100644
index 00000000000000..cd65c1321fc320
--- /dev/null
+++ b/package/boot/uboot-sifiveu/patches/130-fix-mkimage-host-build.patch
@@ -0,0 +1,24 @@
+--- a/tools/image-host.c
++++ b/tools/image-host.c
+@@ -1125,6 +1125,7 @@ static int fit_config_add_verification_d
+  * 2) get public key (X509_get_pubkey)
+  * 3) provide der format (d2i_RSAPublicKey)
+  */
++#ifdef CONFIG_TOOLS_LIBCRYPTO
+ static int read_pub_key(const char *keydir, const void *name,
+ 			unsigned char **pubkey, int *pubkey_len)
+ {
+@@ -1178,6 +1179,13 @@ err_cert:
+ 	fclose(f);
+ 	return ret;
+ }
++#else
++static int read_pub_key(const char *keydir, const void *name,
++			unsigned char **pubkey, int *pubkey_len)
++{
++	return -ENOSYS;
++}
++#endif
+ 
+ int fit_pre_load_data(const char *keydir, void *keydest, void *fit)
+ {
diff --git a/package/boot/uboot-sifiveu/patches/300-force-pylibfdt-build.patch b/package/boot/uboot-sifiveu/patches/300-force-pylibfdt-build.patch
new file mode 100644
index 00000000000000..4abf13eda869fe
--- /dev/null
+++ b/package/boot/uboot-sifiveu/patches/300-force-pylibfdt-build.patch
@@ -0,0 +1,30 @@
+--- a/Makefile
++++ b/Makefile
+@@ -2028,26 +2028,7 @@ endif
+ # Check dtc and pylibfdt, if DTC is provided, else build them
+ PHONY += scripts_dtc
+ scripts_dtc: scripts_basic
+-	$(Q)if test "$(DTC)" = "$(DTC_INTREE)"; then \
+-		$(MAKE) $(build)=scripts/dtc; \
+-	else \
+-		if ! $(DTC) -v >/dev/null; then \
+-			echo '*** Failed to check dtc version: $(DTC)'; \
+-			false; \
+-		else \
+-			if test "$(call dtc-version)" -lt $(DTC_MIN_VERSION); then \
+-				echo '*** Your dtc is too old, please upgrade to dtc $(DTC_MIN_VERSION) or newer'; \
+-				false; \
+-			else \
+-				if [ -n "$(CONFIG_PYLIBFDT)" ]; then \
+-					if ! echo "import libfdt" | $(PYTHON3) 2>/dev/null; then \
+-						echo '*** pylibfdt does not seem to be available with $(PYTHON3)'; \
+-						false; \
+-					fi; \
+-				fi; \
+-			fi; \
+-		fi; \
+-	fi
++	$(MAKE) $(build)=scripts/dtc
+ 
+ # ---------------------------------------------------------------------------
+ quiet_cmd_cpp_lds = LDS     $@
diff --git a/package/boot/uboot-sifiveu/uEnv-default.txt b/package/boot/uboot-sifiveu/uEnv-default.txt
new file mode 100644
index 00000000000000..8468a3cace04be
--- /dev/null
+++ b/package/boot/uboot-sifiveu/uEnv-default.txt
@@ -0,0 +1,5 @@
+setenv loadkernel fatload mmc 0:3 \$kernel_addr_r Image
+setenv loaddtb fatload mmc 0:3 \$fdt_addr_r dtb
+setenv bootargs console=ttySIF0,115200 earlycon=sbi root=/dev/mmcblk0p4 rootwait
+setenv uenvcmd run loadkernel \&\& run loaddtb \&\& booti \$kernel_addr_r - \$fdt_addr_r
+run uenvcmd
diff --git a/package/boot/uboot-sunxi/Makefile b/package/boot/uboot-sunxi/Makefile
index 5c27407d155116..cb0c93281d4ee5 100644
--- a/package/boot/uboot-sunxi/Makefile
+++ b/package/boot/uboot-sunxi/Makefile
@@ -9,9 +9,9 @@
 include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
-PKG_VERSION:=2020.04
+PKG_VERSION:=2020.07
 
-PKG_HASH:=fe732aaf037d9cc3c0909bad8362af366ae964bbdac6913a34081ff4ad565372
+PKG_HASH:=c1f5bf9ee6bb6e648edbf19ce2ca9452f614b08a9f886f1a566aa42e8cf05f6a
 
 PKG_MAINTAINER:=Zoltan HERPAI <wigyori@uid0.hu>
 
@@ -29,7 +29,7 @@ define U-Boot/a64-olinuxino
   BUILD_SUBTARGET:=cortexa53
   NAME:=Olimex A64-OLinuXino
   BUILD_DEVICES:=olimex_a64-olinuxino
-  DEPENDS:=+PACKAGE_u-boot-olimex_a64-olinuxino:arm-trusted-firmware-sunxi-a64
+  DEPENDS:=+PACKAGE_u-boot-olimex_a64-olinuxino:trusted-firmware-a-sunxi-a64
   UENV:=a64
   ATF:=a64
 endef
@@ -38,7 +38,7 @@ define U-Boot/a64-olinuxino-emmc
   BUILD_SUBTARGET:=cortexa53
   NAME:=Olimex A64-OLinuXino eMMC
   BUILD_DEVICES:=olimex_a64-olinuxino-emmc
-  DEPENDS:=+PACKAGE_u-boot-olimex_a64-olinuxino-emmc:arm-trusted-firmware-sunxi-a64
+  DEPENDS:=+PACKAGE_u-boot-olimex_a64-olinuxino-emmc:trusted-firmware-a-sunxi-a64
   UENV:=a64
   ATF:=a64
 endef
@@ -116,8 +116,8 @@ endef
 
 define U-Boot/Marsboard_A10
   BUILD_SUBTARGET:=cortexa8
-  NAME:=Marsboard
-  BUILD_DEVICES:=marsboard_a10-marsboard
+  NAME:=HAOYU Marsboard A10
+  BUILD_DEVICES:=haoyu_a10-marsboard
 endef
 
 define U-Boot/Mele_M9
@@ -207,7 +207,7 @@ endef
 define U-Boot/orangepi_one_plus
   BUILD_SUBTARGET:=cortexa53
   NAME:=Orange Pi One Plus (H6)
-  DEPENDS:=+PACKAGE_u-boot-orangepi_one_plus:arm-trusted-firmware-sunxi-h6
+  DEPENDS:=+PACKAGE_u-boot-orangepi_one_plus:trusted-firmware-a-sunxi-h6
   BUILD_DEVICES:=xunlong_orangepi-one-plus
   UENV:=h6
   ATF:=h6
@@ -247,7 +247,7 @@ define U-Boot/libretech_all_h3_cc_h5
   BUILD_SUBTARGET:=cortexa53
   NAME:=Libre Computer ALL-H3-CC H5
   BUILD_DEVICES:=libretech_all-h3-cc-h5
-  DEPENDS:=+PACKAGE_u-boot-libretech_all_h3_cc_h5:arm-trusted-firmware-sunxi-a64
+  DEPENDS:=+PACKAGE_u-boot-libretech_all_h3_cc_h5:trusted-firmware-a-sunxi-a64
   UENV:=a64
   ATF:=a64
 endef
@@ -256,7 +256,7 @@ define U-Boot/nanopi_neo_plus2
   BUILD_SUBTARGET:=cortexa53
   NAME:=NanoPi NEO Plus2 (H5)
   BUILD_DEVICES:=friendlyarm_nanopi-neo-plus2
-  DEPENDS:=+PACKAGE_u-boot-nanopi_neo_plus2:arm-trusted-firmware-sunxi-a64
+  DEPENDS:=+PACKAGE_u-boot-nanopi_neo_plus2:trusted-firmware-a-sunxi-a64
   UENV:=a64
   ATF:=a64
 endef
@@ -265,7 +265,7 @@ define U-Boot/nanopi_neo2
   BUILD_SUBTARGET:=cortexa53
   NAME:=NanoPi NEO2 (H5)
   BUILD_DEVICES:=friendlyarm_nanopi-neo2
-  DEPENDS:=+PACKAGE_u-boot-nanopi_neo2:arm-trusted-firmware-sunxi-a64
+  DEPENDS:=+PACKAGE_u-boot-nanopi_neo2:trusted-firmware-a-sunxi-a64
   UENV:=a64
   ATF:=a64
 endef
@@ -274,7 +274,7 @@ define U-Boot/nanopi_r1s_h5
   BUILD_SUBTARGET:=cortexa53
   NAME:=NanoPi R1S (H5)
   BUILD_DEVICES:=friendlyarm_nanopi-r1s-h5
-  DEPENDS:=+PACKAGE_u-boot-nanopi_r1s_h5:arm-trusted-firmware-sunxi-a64
+  DEPENDS:=+PACKAGE_u-boot-nanopi_r1s_h5:trusted-firmware-a-sunxi-a64
   UENV:=a64
   ATF:=a64
 endef
@@ -283,7 +283,7 @@ define U-Boot/pine64_plus
   BUILD_SUBTARGET:=cortexa53
   NAME:=Pine64 Plus A64
   BUILD_DEVICES:=pine64_pine64-plus
-  DEPENDS:=+PACKAGE_u-boot-pine64_plus:arm-trusted-firmware-sunxi-a64
+  DEPENDS:=+PACKAGE_u-boot-pine64_plus:trusted-firmware-a-sunxi-a64
   UENV:=a64
   ATF:=a64
 endef
@@ -298,7 +298,7 @@ define U-Boot/sopine_baseboard
   BUILD_SUBTARGET:=cortexa53
   NAME:=Sopine Baseboard
   BUILD_DEVICES:=pine64_sopine-baseboard
-  DEPENDS:=+PACKAGE_u-boot-sopine_baseboard:arm-trusted-firmware-sunxi-a64
+  DEPENDS:=+PACKAGE_u-boot-sopine_baseboard:trusted-firmware-a-sunxi-a64
   UENV:=a64
   ATF:=a64
 endef
@@ -308,7 +308,7 @@ define U-Boot/orangepi_zero_plus
   BUILD_SUBTARGET:=cortexa53
   NAME:=Xunlong Orange Pi Zero Plus
   BUILD_DEVICES:=xunlong_orangepi-zero-plus
-  DEPENDS:=+PACKAGE_u-boot-orangepi_zero_plus:arm-trusted-firmware-sunxi-a64
+  DEPENDS:=+PACKAGE_u-boot-orangepi_zero_plus:trusted-firmware-a-sunxi-a64
   UENV:=a64
   ATF:=a64
 endef
@@ -317,7 +317,7 @@ define U-Boot/orangepi_pc2
   BUILD_SUBTARGET:=cortexa53
   NAME:=Xunlong Orange Pi PC2
   BUILD_DEVICES:=xunlong_orangepi-pc2
-  DEPENDS:=+PACKAGE_u-boot-orangepi_pc2:arm-trusted-firmware-sunxi-a64
+  DEPENDS:=+PACKAGE_u-boot-orangepi_pc2:trusted-firmware-a-sunxi-a64
   UENV:=a64
   ATF:=a64
 endef
@@ -385,7 +385,7 @@ UBOOT_TARGETS := \
 UBOOT_CONFIGURE_VARS += USE_PRIVATE_LIBGCC=yes
 
 UBOOT_MAKE_FLAGS += \
-	BL31=$(STAGING_DIR_IMAGE)/bl31_sun50i_$(ATF).bin
+	BL31=$(STAGING_DIR_IMAGE)/bl31_sunxi-$(ATF).bin
 
 define Build/InstallDev
 	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
diff --git a/package/boot/uboot-sunxi/patches/003-add-theobroma-a31-pangolin.patch b/package/boot/uboot-sunxi/patches/003-add-theobroma-a31-pangolin.patch
index 29969a71abeb4c..fab06e6a8e712b 100644
--- a/package/boot/uboot-sunxi/patches/003-add-theobroma-a31-pangolin.patch
+++ b/package/boot/uboot-sunxi/patches/003-add-theobroma-a31-pangolin.patch
@@ -1,6 +1,6 @@
 --- a/arch/arm/dts/Makefile
 +++ b/arch/arm/dts/Makefile
-@@ -455,6 +455,7 @@ dtb-$(CONFIG_MACH_SUN6I) += \
+@@ -475,6 +475,7 @@ dtb-$(CONFIG_MACH_SUN6I) += \
  	sun6i-a31-m9.dtb \
  	sun6i-a31-mele-a1000g-quad.dtb \
  	sun6i-a31-mixtile-loftq.dtb \
diff --git a/package/boot/uboot-sunxi/patches/062-A20-improve-gmac-upload.patch b/package/boot/uboot-sunxi/patches/062-A20-improve-gmac-upload.patch
index b805bbd16937e8..27b476472cfefb 100644
--- a/package/boot/uboot-sunxi/patches/062-A20-improve-gmac-upload.patch
+++ b/package/boot/uboot-sunxi/patches/062-A20-improve-gmac-upload.patch
@@ -2,7 +2,7 @@
 
 --- a/configs/A20-OLinuXino-Lime2_defconfig
 +++ b/configs/A20-OLinuXino-Lime2_defconfig
-@@ -22,6 +22,7 @@ CONFIG_ETH_DESIGNWARE=y
+@@ -23,6 +23,7 @@ CONFIG_ETH_DESIGNWARE=y
  CONFIG_RGMII=y
  CONFIG_MII=y
  CONFIG_SUN7I_GMAC=y
diff --git a/package/boot/uboot-sunxi/patches/091-sun6i-sync-PLL1-multdiv-with-Boot1.patch b/package/boot/uboot-sunxi/patches/091-sun6i-sync-PLL1-multdiv-with-Boot1.patch
index f2a2b5e48fc94b..c637ccb792ac45 100644
--- a/package/boot/uboot-sunxi/patches/091-sun6i-sync-PLL1-multdiv-with-Boot1.patch
+++ b/package/boot/uboot-sunxi/patches/091-sun6i-sync-PLL1-multdiv-with-Boot1.patch
@@ -14,7 +14,7 @@ More specifically, the following settings are now used:
 
 --- a/arch/arm/mach-sunxi/clock_sun6i.c
 +++ b/arch/arm/mach-sunxi/clock_sun6i.c
-@@ -112,11 +112,12 @@ void clock_set_pll1(unsigned int clk)
+@@ -114,11 +114,12 @@ void clock_set_pll1(unsigned int clk)
  	struct sunxi_ccm_reg * const ccm =
  		(struct sunxi_ccm_reg *)SUNXI_CCM_BASE;
  	const int p = 0;
diff --git a/package/boot/uboot-sunxi/patches/093-sun6i-fix-PLL-LDO-voltselect.patch b/package/boot/uboot-sunxi/patches/093-sun6i-fix-PLL-LDO-voltselect.patch
index b62209e1dcb96b..c20db1352edfa3 100644
--- a/package/boot/uboot-sunxi/patches/093-sun6i-fix-PLL-LDO-voltselect.patch
+++ b/package/boot/uboot-sunxi/patches/093-sun6i-fix-PLL-LDO-voltselect.patch
@@ -18,7 +18,7 @@ required setting for the PLL LDO is 1.37v as per the A31 manual.
 
 --- a/arch/arm/mach-sunxi/clock_sun6i.c
 +++ b/arch/arm/mach-sunxi/clock_sun6i.c
-@@ -25,13 +25,26 @@ void clock_init_safe(void)
+@@ -27,13 +27,26 @@ void clock_init_safe(void)
  	struct sunxi_prcm_reg * const prcm =
  		(struct sunxi_prcm_reg *)SUNXI_PRCM_BASE;
  
diff --git a/package/boot/uboot-sunxi/patches/101-sun6i-support-console-on-UART2.patch b/package/boot/uboot-sunxi/patches/101-sun6i-support-console-on-UART2.patch
index 823c1568090b7a..4cbf0ea1d8a733 100644
--- a/package/boot/uboot-sunxi/patches/101-sun6i-support-console-on-UART2.patch
+++ b/package/boot/uboot-sunxi/patches/101-sun6i-support-console-on-UART2.patch
@@ -6,7 +6,7 @@ Subject: ARM: sun6i: Support console on UART2 (GPG6/GPG7)
 
 --- a/arch/arm/mach-sunxi/board.c
 +++ b/arch/arm/mach-sunxi/board.c
-@@ -129,6 +129,10 @@ static int gpio_init(void)
+@@ -132,6 +132,10 @@ static int gpio_init(void)
  	sunxi_gpio_set_cfgpin(SUNXI_GPG(3), SUN5I_GPG_UART1);
  	sunxi_gpio_set_cfgpin(SUNXI_GPG(4), SUN5I_GPG_UART1);
  	sunxi_gpio_set_pull(SUNXI_GPG(4), SUNXI_GPIO_PULL_UP);
diff --git a/package/boot/uboot-sunxi/patches/200-mkimage-check-environment-for-dtc-binary-location.patch b/package/boot/uboot-sunxi/patches/200-mkimage-check-environment-for-dtc-binary-location.patch
index 482aa1a3693cb0..8aeae91ef46f94 100644
--- a/package/boot/uboot-sunxi/patches/200-mkimage-check-environment-for-dtc-binary-location.patch
+++ b/package/boot/uboot-sunxi/patches/200-mkimage-check-environment-for-dtc-binary-location.patch
@@ -17,7 +17,7 @@ Cc: Simon Glass <sjg@chromium.org>
 
 --- a/tools/fit_image.c
 +++ b/tools/fit_image.c
-@@ -726,9 +726,14 @@ static int fit_handle_file(struct image_
+@@ -751,9 +751,14 @@ static int fit_handle_file(struct image_
  		}
  		*cmd = '\0';
  	} else if (params->datafile) {
diff --git a/package/boot/uboot-sunxi/patches/210-sunxi-deactivate-binman.patch b/package/boot/uboot-sunxi/patches/210-sunxi-deactivate-binman.patch
index 5efebbd056b092..48ddf6d318dba2 100644
--- a/package/boot/uboot-sunxi/patches/210-sunxi-deactivate-binman.patch
+++ b/package/boot/uboot-sunxi/patches/210-sunxi-deactivate-binman.patch
@@ -12,7 +12,7 @@ old way of generating images.
 
 --- a/Makefile
 +++ b/Makefile
-@@ -1555,8 +1555,10 @@ endif
+@@ -1607,8 +1607,10 @@ endif
  
  ifneq ($(CONFIG_ARCH_SUNXI),)
  ifeq ($(CONFIG_ARM64),)
@@ -27,7 +27,7 @@ old way of generating images.
  	$(call if_changed,cat)
 --- a/arch/arm/Kconfig
 +++ b/arch/arm/Kconfig
-@@ -962,7 +962,6 @@ config ARCH_SOCFPGA
+@@ -995,7 +995,6 @@ config ARCH_SOCFPGA
  
  config ARCH_SUNXI
  	bool "Support sunxi (Allwinner) SoCs"
diff --git a/package/boot/uboot-sunxi/patches/230-disable-axp209-on-a13-olinuxino.diff b/package/boot/uboot-sunxi/patches/230-disable-axp209-on-a13-olinuxino.diff
index b846cbf506d206..bc8bd144d6a4db 100644
--- a/package/boot/uboot-sunxi/patches/230-disable-axp209-on-a13-olinuxino.diff
+++ b/package/boot/uboot-sunxi/patches/230-disable-axp209-on-a13-olinuxino.diff
@@ -8,7 +8,7 @@
  # CONFIG_VIDEO_HDMI is not set
  CONFIG_VIDEO_VGA_VIA_LCD=y
  CONFIG_VIDEO_VGA_VIA_LCD_FORCE_SYNC_ACTIVE_HIGH=y
-@@ -21,7 +20,7 @@ CONFIG_CMD_USB_MASS_STORAGE=y
+@@ -20,7 +19,7 @@ CONFIG_CMD_USB_MASS_STORAGE=y
  CONFIG_DEFAULT_DEVICE_TREE="sun5i-a13-olinuxino"
  CONFIG_DFU_RAM=y
  CONFIG_FASTBOOT_CMD_OEM_FORMAT=y
diff --git a/package/boot/uboot-sunxi/patches/250-sun8i-h3-add-support-for-zeropi.patch b/package/boot/uboot-sunxi/patches/250-sun8i-h3-add-support-for-zeropi.patch
new file mode 100644
index 00000000000000..838d90a7b00ebb
--- /dev/null
+++ b/package/boot/uboot-sunxi/patches/250-sun8i-h3-add-support-for-zeropi.patch
@@ -0,0 +1,148 @@
+From 2527b24f39d8f27ba2fd922ca27a1f14119cfa1b Mon Sep 17 00:00:00 2001
+From: Yu-Tung Chang <mtwget@gmail.com>
+Date: Sat, 19 Jun 2021 16:16:45 +0800
+Subject: [PATCH] sunxi: h3: Add initial ZeroPi support
+
+ZeroPi is a new board of high performance with low cost
+designed by FriendlyElec., using the Allwinner H3 SOC.
+
+ZeroPi features
+- Allwinner H3, Quad-core Cortex-A7@1.2GHz
+- 256MB/512MB DDR3 RAM
+- microsd slot
+- 10/100/1000Mbps Ethernet
+- Debug Serial Port
+- DC 5V/2A power-supply
+
+Signed-off-by: Yu-Tung Chang <mtwget@gmail.com>
+Reviewed-by: Andre Przywara <andre.przywara@arm.com>
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+---
+--- a/arch/arm/dts/Makefile
++++ b/arch/arm/dts/Makefile
+@@ -560,7 +560,8 @@ dtb-$(CONFIG_MACH_SUN8I_H3) += \
+ 	sun8i-h3-orangepi-plus.dtb \
+ 	sun8i-h3-orangepi-plus2e.dtb \
+ 	sun8i-h3-orangepi-zero-plus2.dtb \
+-	sun8i-h3-rervision-dvk.dtb
++	sun8i-h3-rervision-dvk.dtb \
++	sun8i-h3-zeropi.dtb
+ dtb-$(CONFIG_MACH_SUN8I_R40) += \
+ 	sun8i-r40-bananapi-m2-ultra.dtb \
+ 	sun8i-v40-bananapi-m2-berry.dtb
+--- /dev/null
++++ b/arch/arm/dts/sun8i-h3-zeropi.dts
+@@ -0,0 +1,85 @@
++/*
++ * Copyright (C) 2020 Yu-Tung Chang <mtwget@gmail.com>
++ *
++ * This file is dual-licensed: you can use it either under the terms
++ * of the GPL or the X11 license, at your option. Note that this dual
++ * licensing only applies to this file, and not this project as a
++ * whole.
++ *
++ *  a) This file is free software; you can redistribute it and/or
++ *     modify it under the terms of the GNU General Public License as
++ *     published by the Free Software Foundation; either version 2 of the
++ *     License, or (at your option) any later version.
++ *
++ *     This file is distributed in the hope that it will be useful,
++ *     but WITHOUT ANY WARRANTY; without even the implied warranty of
++ *     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ *     GNU General Public License for more details.
++ *
++ * Or, alternatively,
++ *
++ *  b) Permission is hereby granted, free of charge, to any person
++ *     obtaining a copy of this software and associated documentation
++ *     files (the "Software"), to deal in the Software without
++ *     restriction, including without limitation the rights to use,
++ *     copy, modify, merge, publish, distribute, sublicense, and/or
++ *     sell copies of the Software, and to permit persons to whom the
++ *     Software is furnished to do so, subject to the following
++ *     conditions:
++ *
++ *     The above copyright notice and this permission notice shall be
++ *     included in all copies or substantial portions of the Software.
++ *
++ *     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
++ *     EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
++ *     OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
++ *     NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
++ *     HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
++ *     WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
++ *     FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
++ *     OTHER DEALINGS IN THE SOFTWARE.
++ */
++
++#include "sun8i-h3-nanopi.dtsi"
++
++/ {
++	model = "FriendlyARM ZeroPi";
++	compatible = "friendlyarm,zeropi", "allwinner,sun8i-h3";
++
++	aliases {
++		ethernet0 = &emac;
++	};
++
++	reg_gmac_3v3: gmac-3v3 {
++		compatible = "regulator-fixed";
++		regulator-name = "gmac-3v3";
++		regulator-min-microvolt = <3300000>;
++		regulator-max-microvolt = <3300000>;
++		startup-delay-us = <100000>;
++		enable-active-high;
++		gpio = <&pio 3 6 GPIO_ACTIVE_HIGH>; /* PD6 */
++	};
++};
++
++&external_mdio {
++	ext_rgmii_phy: ethernet-phy@7 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <7>;
++	};
++};
++
++&emac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&emac_rgmii_pins>;
++	phy-supply = <&reg_gmac_3v3>;
++	phy-handle = <&ext_rgmii_phy>;
++	phy-mode = "rgmii-id";
++
++	allwinner,leds-active-low;
++	status = "okay";
++};
++
++&usb_otg {
++	status = "okay";
++	dr_mode = "host";
++};
+--- a/board/sunxi/MAINTAINERS
++++ b/board/sunxi/MAINTAINERS
+@@ -508,3 +508,9 @@ YONES TOPTECH BS1078 V2 BOARD
+ M:	Peter Korsgaard <peter@korsgaard.com>
+ S:	Maintained
+ F:	configs/Yones_Toptech_BS1078_V2_defconfig
++
++ZEROPI BOARD
++M:	Yu-Tung Chang <mtwget@gmail.com>
++S:	Maintained
++F:	configs/zeropi_defconfig
++F:	arch/arm/dts/sun8i-h3-zeropi.dts
+--- /dev/null
++++ b/configs/zeropi_defconfig
+@@ -0,0 +1,13 @@
++CONFIG_ARM=y
++CONFIG_ARCH_SUNXI=y
++CONFIG_DEFAULT_DEVICE_TREE="sun8i-h3-zeropi"
++CONFIG_SPL=y
++CONFIG_MACH_SUN8I_H3=y
++CONFIG_DRAM_CLK=408
++CONFIG_MACPWR="PD6"
++# CONFIG_VIDEO_DE2 is not set
++# CONFIG_SYS_MALLOC_CLEAR_ON_INIT is not set
++CONFIG_CONSOLE_MUX=y
++CONFIG_SUN8I_EMAC=y
++CONFIG_USB_EHCI_HCD=y
++CONFIG_USB_OHCI_HCD=y
diff --git a/package/boot/uboot-sunxi/patches/252-sunxi-h3-add-support-for-nanopi-r1.patch b/package/boot/uboot-sunxi/patches/252-sunxi-h3-add-support-for-nanopi-r1.patch
index 0db7be5421c284..5b3a68c602b108 100644
--- a/package/boot/uboot-sunxi/patches/252-sunxi-h3-add-support-for-nanopi-r1.patch
+++ b/package/boot/uboot-sunxi/patches/252-sunxi-h3-add-support-for-nanopi-r1.patch
@@ -14,7 +14,7 @@ Signed-off-by: Jayantajit Gogoi <jayanta.gogoi525@gmail.com>
 
 --- a/arch/arm/dts/Makefile
 +++ b/arch/arm/dts/Makefile
-@@ -531,6 +531,7 @@ dtb-$(CONFIG_MACH_SUN8I_H3) += \
+@@ -551,6 +551,7 @@ dtb-$(CONFIG_MACH_SUN8I_H3) += \
  	sun8i-h3-nanopi-m1-plus.dtb \
  	sun8i-h3-nanopi-neo.dtb \
  	sun8i-h3-nanopi-neo-air.dtb \
@@ -173,7 +173,7 @@ Signed-off-by: Jayantajit Gogoi <jayanta.gogoi525@gmail.com>
 +};
 --- /dev/null
 +++ b/configs/nanopi_r1_defconfig
-@@ -0,0 +1,22 @@
+@@ -0,0 +1,21 @@
 +CONFIG_ARM=y
 +CONFIG_ARCH_SUNXI=y
 +CONFIG_SPL=y
@@ -186,7 +186,6 @@ Signed-off-by: Jayantajit Gogoi <jayanta.gogoi525@gmail.com>
 +CONFIG_NR_DRAM_BANKS=1
 +# CONFIG_SYS_MALLOC_CLEAR_ON_INIT is not set
 +CONFIG_CONSOLE_MUX=y
-+CONFIG_SYS_CLK_FREQ=480000000
 +# CONFIG_CMD_FLASH is not set
 +# CONFIG_SPL_DOS_PARTITION is not set
 +# CONFIG_SPL_EFI_PARTITION is not set
diff --git a/package/boot/uboot-sunxi/patches/253-sunxi-h5-add-support-for-nanopi-r1s-h5.patch b/package/boot/uboot-sunxi/patches/253-sunxi-h5-add-support-for-nanopi-r1s-h5.patch
index b89351d2e9083e..2c8d5a94593a65 100644
--- a/package/boot/uboot-sunxi/patches/253-sunxi-h5-add-support-for-nanopi-r1s-h5.patch
+++ b/package/boot/uboot-sunxi/patches/253-sunxi-h5-add-support-for-nanopi-r1s-h5.patch
@@ -25,11 +25,9 @@ Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
  create mode 100644 arch/arm/dts/sun50i-h5-nanopi-r1s-h5.dts
  create mode 100644 configs/nanopi_r1s_h5_defconfig
 
-diff --git a/arch/arm/dts/Makefile b/arch/arm/dts/Makefile
-index b8a382d1539..ed3d360bb10 100644
 --- a/arch/arm/dts/Makefile
 +++ b/arch/arm/dts/Makefile
-@@ -638,6 +638,7 @@ dtb-$(CONFIG_MACH_SUN50I_H5) += \
+@@ -575,6 +575,7 @@ dtb-$(CONFIG_MACH_SUN50I_H5) += \
  	sun50i-h5-libretech-all-h5-cc.dtb \
  	sun50i-h5-nanopi-neo2.dtb \
  	sun50i-h5-nanopi-neo-plus2.dtb \
@@ -37,9 +35,6 @@ index b8a382d1539..ed3d360bb10 100644
  	sun50i-h5-orangepi-zero-plus.dtb \
  	sun50i-h5-orangepi-pc2.dtb \
  	sun50i-h5-orangepi-prime.dtb \
-diff --git a/arch/arm/dts/sun50i-h5-nanopi-r1s-h5.dts b/arch/arm/dts/sun50i-h5-nanopi-r1s-h5.dts
-new file mode 100644
-index 00000000000..55bcdf8d1a0
 --- /dev/null
 +++ b/arch/arm/dts/sun50i-h5-nanopi-r1s-h5.dts
 @@ -0,0 +1,190 @@
@@ -233,8 +228,6 @@ index 00000000000..55bcdf8d1a0
 +	usb0_vbus-supply = <&reg_usb0_vbus>;
 +	status = "okay";
 +};
-diff --git a/board/sunxi/MAINTAINERS b/board/sunxi/MAINTAINERS
-index 2543c94de79..56a0ee3689b 100644
 --- a/board/sunxi/MAINTAINERS
 +++ b/board/sunxi/MAINTAINERS
 @@ -358,6 +358,11 @@ M:	Jelle van der Waa <jelle@vdwaa.nl>
@@ -249,9 +242,6 @@ index 2543c94de79..56a0ee3689b 100644
  NANOPI-A64 BOARD
  M:	Jagan Teki <jagan@amarulasolutions.com>
  S:	Maintained
-diff --git a/configs/nanopi_r1s_h5_defconfig b/configs/nanopi_r1s_h5_defconfig
-new file mode 100644
-index 00000000000..27cf172d72a
 --- /dev/null
 +++ b/configs/nanopi_r1s_h5_defconfig
 @@ -0,0 +1,14 @@
diff --git a/package/boot/uboot-sunxi/patches/270-arm-sunxi-increase-SYS_MALLOC_F_LEN.patch b/package/boot/uboot-sunxi/patches/270-arm-sunxi-increase-SYS_MALLOC_F_LEN.patch
new file mode 100644
index 00000000000000..6ce2be908dba15
--- /dev/null
+++ b/package/boot/uboot-sunxi/patches/270-arm-sunxi-increase-SYS_MALLOC_F_LEN.patch
@@ -0,0 +1,29 @@
+From 20abdd7feefbb4fccef5c653e045911670237e8b Mon Sep 17 00:00:00 2001
+From: Stijn Tintel <stijn@linux-ipv6.be>
+Date: Thu, 22 Dec 2022 00:35:07 +0200
+Subject: [PATCH] arm: sunxi: increase SYS_MALLOC_F_LEN
+
+Version 2020.10 throws the following output after loading bl31:
+alloc space exhausted
+
+This has been fixed in v2022.07, but the change is too intrusive to
+backport. Instead, just modify the default for ARCH_SUNXI for now.
+
+See e05689242238 ("Kconfig: Change SYS_MALLOC_F_LEN default to 0x2000").
+
+Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
+---
+ Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Kconfig
++++ b/Kconfig
+@@ -146,7 +146,7 @@ config SYS_MALLOC_F_LEN
+ 	default 0x2000 if (ARCH_IMX8 || ARCH_IMX8M || ARCH_MX7 || \
+ 			   ARCH_MX7ULP || ARCH_MX6 || ARCH_MX5 || \
+ 			   ARCH_LS1012A || ARCH_LS1021A || ARCH_LS1043A || \
+-			   ARCH_LS1046A || ARCH_QEMU)
++			   ARCH_LS1046A || ARCH_QEMU || ARCH_SUNXI)
+ 	default 0x400
+ 	help
+ 	  Before relocation, memory is very limited on many platforms. Still,
diff --git a/package/boot/uboot-sunxi/uEnv-default.txt b/package/boot/uboot-sunxi/uEnv-default.txt
index e024954516c860..36e41c59b124b9 100644
--- a/package/boot/uboot-sunxi/uEnv-default.txt
+++ b/package/boot/uboot-sunxi/uEnv-default.txt
@@ -1,6 +1,8 @@
 setenv fdt_high ffffffff
-setenv loadkernel fatload mmc 0 \$kernel_addr_r uImage
-setenv loaddtb fatload mmc 0 \$fdt_addr_r dtb
-setenv bootargs console=ttyS0,115200 earlyprintk root=/dev/mmcblk0p2 rootwait
+setenv mmc_rootpart 2
+part uuid mmc ${mmc_bootdev}:${mmc_rootpart} uuid
+setenv loadkernel fatload mmc \$mmc_bootdev \$kernel_addr_r uImage
+setenv loaddtb fatload mmc \$mmc_bootdev \$fdt_addr_r dtb
+setenv bootargs console=ttyS0,115200 earlyprintk root=PARTUUID=${uuid} rootwait
 setenv uenvcmd run loadkernel \&\& run loaddtb \&\& bootm \$kernel_addr_r - \$fdt_addr_r
 run uenvcmd
diff --git a/package/boot/uboot-tegra/Makefile b/package/boot/uboot-tegra/Makefile
index 582f7be9471c17..d47ef6f6f01a3a 100644
--- a/package/boot/uboot-tegra/Makefile
+++ b/package/boot/uboot-tegra/Makefile
@@ -7,7 +7,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_VERSION := 2020.04
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=3
 
 PKG_HASH := fe732aaf037d9cc3c0909bad8362af366ae964bbdac6913a34081ff4ad565372
 
@@ -18,6 +18,7 @@ include $(INCLUDE_DIR)/package.mk
 
 define U-Boot/Default
   BUILD_TARGET := tegra
+  BUILD_SUBTARGET := generic
   HIDDEN := y
 endef
 
diff --git a/package/boot/uboot-zynq/Makefile b/package/boot/uboot-zynq/Makefile
index c605cfaeb2aa74..0f93c4f4535033 100644
--- a/package/boot/uboot-zynq/Makefile
+++ b/package/boot/uboot-zynq/Makefile
@@ -18,6 +18,7 @@ include $(INCLUDE_DIR)/host-build.mk
 
 define U-Boot/Default
   BUILD_TARGET:=zynq
+  BUILD_SUBTARGET:=generic
   UBOOT_IMAGE:=spl/boot.bin u-boot.img
   UBOOT_CONFIG:=zynq_$(1)
   UENV:=default
diff --git a/package/devel/binutils/Makefile b/package/devel/binutils/Makefile
index 75fdd320cdbb98..8547190e99b14d 100644
--- a/package/devel/binutils/Makefile
+++ b/package/devel/binutils/Makefile
@@ -8,16 +8,16 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=binutils
-PKG_VERSION:=2.38
+PKG_VERSION:=2.40
 PKG_RELEASE:=1
 
 PKG_SOURCE_URL:=@GNU/binutils
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_VERSION:=$(PKG_VERSION)
-PKG_HASH:=e316477a914f567eccc34d5d29785b8b0f5a10208d36bbacedcc39048ecfe024
+PKG_HASH:=0f8a4c272d7f17f369ded10a4aca28b8e304828e95526da482b0ccc4dfc9d8e1
 
 PKG_FIXUP:=patch-libtool
-PKG_LIBTOOL_PATHS:=. gas bfd opcodes gprof binutils ld libiberty gold intl
+PKG_LIBTOOL_PATHS:=. gas bfd opcodes gprof gprofng binutils ld libiberty gold intl libctf libsframe
 PKG_REMOVE_FILES:=libtool.m4
 PKG_INSTALL:=1
 
@@ -25,7 +25,7 @@ PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=GPL-3.0+
 PKG_CPE_ID:=cpe:/a:gnu:binutils
 PKG_BUILD_PARALLEL:=1
-PKG_USE_MIPS16:=0
+PKG_BUILD_FLAGS:=no-mips16
 
 include $(INCLUDE_DIR)/nls.mk
 include $(INCLUDE_DIR)/package.mk
@@ -87,7 +87,11 @@ CONFIGURE_ARGS += \
 	--enable-shared \
 	--enable-install-libiberty \
 	--enable-install-libbfd \
-	--enable-install-libctf
+	--enable-install-libctf \
+	--with-system-zlib \
+	--without-zstd \
+	--without-msgpack \
+	--disable-gprofng
 
 define Build/Install
 	$(call Build/Install/Default)
@@ -105,6 +109,7 @@ endef
 define Package/libbfd/install
 	$(INSTALL_DIR) $(1)/usr/lib
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libbfd*.so* $(1)/usr/lib/
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libsframe*.so* $(1)/usr/lib/
 endef
 
 define Package/libctf/install
diff --git a/package/devel/binutils/patches/001-replace-attribute_const.patch b/package/devel/binutils/patches/001-replace-attribute_const.patch
new file mode 100644
index 00000000000000..5fd855efd16423
--- /dev/null
+++ b/package/devel/binutils/patches/001-replace-attribute_const.patch
@@ -0,0 +1,88 @@
+Fix this compile error:
+----------------------
+./../common/cpuid.c:27:1: error: expected '=', ',', ';', 'asm' or '__attribute__' before '__get_cpuid'
+   27 | __get_cpuid (unsigned int op ATTRIBUTE_UNUSED, unsigned int *eax,
+      | ^~~~~~~~~~~
+----------------------
+
+and this error:
+----------------------
+unwind.c: In function '__collector_ext_return_address':
+unwind.c:236:34: error: '__u64' undeclared (first use in this function)
+  236 |       context->uc_mcontext.sp = (__u64) __builtin_frame_address(0); \
+      |                                  ^~~~~
+unwind.c:490:3: note: in expansion of macro 'FILL_CONTEXT'
+  490 |   FILL_CONTEXT ((&context));
+
+----------------------
+--- a/gprofng/common/cpuid.c
++++ b/gprofng/common/cpuid.c
+@@ -23,7 +23,7 @@
+ #elif defined(__aarch64__)
+ #define ATTRIBUTE_UNUSED __attribute__((unused))
+ 
+-static inline uint_t __attribute_const__
++static inline uint_t __attribute__((__const__))
+ __get_cpuid (unsigned int op ATTRIBUTE_UNUSED, unsigned int *eax,
+ 	     unsigned int *ebx ATTRIBUTE_UNUSED,
+ 	     unsigned int *ecx ATTRIBUTE_UNUSED, unsigned int *edx ATTRIBUTE_UNUSED)
+--- a/gprofng/libcollector/unwind.c
++++ b/gprofng/libcollector/unwind.c
+@@ -233,7 +233,7 @@ memory_error_func (int status ATTRIBUTE_
+ #elif ARCH(Aarch64)
+ #define FILL_CONTEXT(context) \
+     { CALL_UTIL (getcontext) (context);  \
+-      context->uc_mcontext.sp = (__u64) __builtin_frame_address(0); \
++      context->uc_mcontext.sp = (uint64_t) __builtin_frame_address(0); \
+     }
+ 
+ #endif /* ARCH() */
+@@ -4579,11 +4579,11 @@ stack_unwind (char *buf, int size, void
+   if (buf && bptr && eptr && context && size + mode > 0)
+     getByteInstruction ((unsigned char *) eptr);
+   int ind = 0;
+-  __u64 *lbuf = (void *) buf;
+-  int lsize = size / sizeof (__u64);
+-  __u64 pc = context->uc_mcontext.pc;
+-  __u64 sp = context->uc_mcontext.sp;
+-  __u64 stack_base;
++  uint64_t *lbuf = (void *) buf;
++  int lsize = size / sizeof (uint64_t);
++  uint64_t pc = context->uc_mcontext.pc;
++  uint64_t sp = context->uc_mcontext.sp;
++  uint64_t stack_base;
+   unsigned long tbgn = 0;
+   unsigned long tend = 0;
+ 
+@@ -4594,7 +4594,7 @@ stack_unwind (char *buf, int size, void
+     {
+       stack_base = sp + 0x100000;
+       if (stack_base < sp)  // overflow
+-	stack_base = (__u64) -1;
++	stack_base = (uint64_t) -1;
+     }
+   DprintfT (SP_DUMP_UNWIND,
+     "unwind.c:%d stack_unwind %2d pc=0x%llx  sp=0x%llx  stack_base=0x%llx\n",
+@@ -4625,17 +4625,17 @@ stack_unwind (char *buf, int size, void
+ 		      __LINE__, (unsigned long) sp);
+ 	    break;
+ 	  }
+-      pc = ((__u64 *) sp)[1];
+-      __u64 old_sp = sp;
+-      sp = ((__u64 *) sp)[0];
++      pc = ((uint64_t *) sp)[1];
++      uint64_t old_sp = sp;
++      sp = ((uint64_t *) sp)[0];
+       if (sp < old_sp)
+ 	break;
+     }
+   if (ind >= lsize)
+     {
+       ind = lsize - 1;
+-      lbuf[ind++] = (__u64) SP_TRUNC_STACK_MARKER;
++      lbuf[ind++] = (uint64_t) SP_TRUNC_STACK_MARKER;
+     }
+-  return ind * sizeof (__u64);
++  return ind * sizeof (uint64_t);
+ }
+ #endif /* ARCH() */
diff --git a/package/devel/gdb/Makefile b/package/devel/gdb/Makefile
index 7acf26d60b9678..4c0d6469a2fbf5 100644
--- a/package/devel/gdb/Makefile
+++ b/package/devel/gdb/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=gdb
 PKG_VERSION:=12.1
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=3
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@GNU/gdb
@@ -66,6 +66,7 @@ CONFIGURE_ARGS+= \
 	--without-mpc \
 	--without-mpfr \
 	--without-isl \
+	--without-xxhash \
 	--with-libgmp-prefix=$(STAGING_DIR)/usr
 
 CONFIGURE_VARS+= \
diff --git a/package/devel/gdb/patches/001-Add-support-for-readline-8.2.patch b/package/devel/gdb/patches/001-Add-support-for-readline-8.2.patch
new file mode 100644
index 00000000000000..eb93c7f2907a67
--- /dev/null
+++ b/package/devel/gdb/patches/001-Add-support-for-readline-8.2.patch
@@ -0,0 +1,31 @@
+From 1add37b567a7dee39d99f37b37802034c3fce9c4 Mon Sep 17 00:00:00 2001
+From: Andreas Schwab <schwab@linux-m68k.org>
+Date: Sun, 20 Mar 2022 14:01:54 +0100
+Subject: [PATCH] Add support for readline 8.2
+
+In readline 8.2 the type of rl_completer_word_break_characters changed to
+include const.
+---
+ gdb/completer.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/gdb/completer.c
++++ b/gdb/completer.c
+@@ -36,7 +36,7 @@
+    calling a hook instead so we eliminate the CLI dependency.  */
+ #include "gdbcmd.h"
+ 
+-/* Needed for rl_completer_word_break_characters() and for
++/* Needed for rl_completer_word_break_characters and for
+    rl_filename_completion_function.  */
+ #include "readline/readline.h"
+ 
+@@ -2011,7 +2011,7 @@ gdb_completion_word_break_characters_thr
+       rl_basic_quote_characters = NULL;
+     }
+ 
+-  return rl_completer_word_break_characters;
++  return (char *) rl_completer_word_break_characters;
+ }
+ 
+ char *
diff --git a/package/devel/gperf/Makefile b/package/devel/gperf/Makefile
new file mode 100644
index 00000000000000..f0f794ee2d91e8
--- /dev/null
+++ b/package/devel/gperf/Makefile
@@ -0,0 +1,36 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=gperf
+PKG_VERSION:=3.1
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=@GNU/gperf
+PKG_HASH:=588546b945bba4b70b6a3a616e80b4ab466e3f33024a352fc2198112cdbb3ae2
+
+PKG_LICENSE:=GPL-3.0
+PKG_LICENSE_FILES:=COPYING
+
+include $(INCLUDE_DIR)/host-build.mk
+include $(INCLUDE_DIR)/package.mk
+
+HOST_CPPFLAGS:=-I$(HOST_BUILD_DIR)/lib -I$(HOST_BUILD_DIR)/src $(HOST_CPPFLAGS)
+TARGET_CPPFLAGS:=-I$(PKG_BUILD_DIR)/lib -I$(PKG_BUILD_DIR)/src $(TARGET_CPPFLAGS)
+
+define Package/gperf
+  SECTION:=devel
+  CATEGORY:=Development
+  TITLE:=GNU gperf
+  URL:=http://www.gnu.org/software/gperf
+endef
+
+define Package/gperf/description
+ GNU gperf is a perfect hash function generator. For a given list of strings,
+ it produces a hash function and hash table, in form of C or C++ code,
+ for looking up a value depending on the input string.
+ The hash function is perfect, which means that the hash table has no collisions,
+ and the hash table lookup needs a single string comparison only.
+endef
+
+$(eval $(call HostBuild))
+$(eval $(call BuildPackage,gperf))
diff --git a/package/devel/kselftests-bpf/Makefile b/package/devel/kselftests-bpf/Makefile
new file mode 100644
index 00000000000000..ae845486bd45d7
--- /dev/null
+++ b/package/devel/kselftests-bpf/Makefile
@@ -0,0 +1,63 @@
+#
+# Copyright (C) 2021 Tony Ambardar <itugrok@yahoo.com>
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_NAME:=kselftests-bpf
+PKG_VERSION:=$(LINUX_VERSION)
+PKG_RELEASE:=1
+PKG_MAINTAINER:=Tony Ambardar <itugrok@yahoo.com>
+
+PKG_BUILD_FLAGS:=gc-sections lto
+PKG_BUILD_PARALLEL:=1
+PKG_FLAGS:=nonshared
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/nls.mk
+
+define Package/kselftests-bpf
+  SECTION:=devel
+  CATEGORY:=Development
+  DEPENDS:= +libelf +zlib +libpthread +librt @!IN_SDK \
+	    @KERNEL_DEBUG_FS @KERNEL_DEBUG_INFO_BTF @KERNEL_BPF_EVENTS
+  TITLE:=Linux Kernel Selftests (BPF)
+  URL:=http://www.kernel.org
+endef
+
+define Package/kselftests-bpf/description
+  kselftests-bpf is the Linux kernel BPF test suite
+endef
+
+TEST_TARGET = test_verifier
+
+MAKE_PATH:=tools/testing/selftests/bpf
+
+MAKE_VARS = \
+	ARCH="$(LINUX_KARCH)" \
+	CROSS_COMPILE="$(TARGET_CROSS)" \
+	SAN_CFLAGS="$(TARGET_CFLAGS) $(TARGET_CPPFLAGS)" \
+	LDLIBS="$(TARGET_LDFLAGS)" \
+	TOOLCHAIN_INCLUDE="$(TOOLCHAIN_DIR)/include" \
+	VMLINUX_BTF="$(LINUX_DIR)/vmlinux"
+
+MAKE_FLAGS = \
+	$(if $(findstring c,$(OPENWRT_VERBOSE)),V=1,V='') \
+	O=$(PKG_BUILD_DIR)
+
+define Build/Compile
+	+$(MAKE_VARS) \
+	$(MAKE) $(PKG_JOBS) -C $(LINUX_DIR)/$(MAKE_PATH) \
+		$(MAKE_FLAGS) $(TEST_TARGET) ;
+endef
+
+define Package/kselftests-bpf/install
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/$(TEST_TARGET) $(1)/usr/bin/
+endef
+
+$(eval $(call BuildPackage,kselftests-bpf))
diff --git a/package/devel/perf/Makefile b/package/devel/perf/Makefile
index d556e2d9f0200a..c0b2046bd60365 100644
--- a/package/devel/perf/Makefile
+++ b/package/devel/perf/Makefile
@@ -12,7 +12,7 @@ PKG_NAME:=perf
 PKG_VERSION:=$(LINUX_VERSION)
 PKG_RELEASE:=4
 
-PKG_USE_MIPS16:=0
+PKG_BUILD_FLAGS:=no-mips16
 PKG_BUILD_PARALLEL:=1
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_FLAGS:=nonshared
diff --git a/package/devel/strace/Makefile b/package/devel/strace/Makefile
index 71d79450038982..9400608cddfa51 100644
--- a/package/devel/strace/Makefile
+++ b/package/devel/strace/Makefile
@@ -9,12 +9,12 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=strace
-PKG_VERSION:=5.19
+PKG_VERSION:=6.3
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://strace.io/files/$(PKG_VERSION)
-PKG_HASH:=aa3dc1c8e60e4f6ff3d396514aa247f3c7bf719d8a8dc4dd4fa793be786beca3
+PKG_HASH:=e17878e301506c1cc301611118ad14efee7f8bcef63b27ace5d290acce7bb731
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=LGPL-2.1-or-later
diff --git a/package/devel/trace-cmd/Makefile b/package/devel/trace-cmd/Makefile
index 3f96d43b77ee62..687907acaa0b6e 100644
--- a/package/devel/trace-cmd/Makefile
+++ b/package/devel/trace-cmd/Makefile
@@ -1,18 +1,18 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=trace-cmd
-PKG_VERSION:=v3.1.2
-PKG_RELEASE:=2
+PKG_VERSION:=v3.1.6
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://git.kernel.org/pub/scm/utils/trace-cmd/trace-cmd.git/snapshot/
-PKG_HASH:=206672af60aa0bc35cfc44a4be746efa575bac729060e54b6453f7d5dfbcd979
+PKG_HASH:=f9198ea306deee9cda3b262342b03b6029e82c1b9c671ba521739a9703e115b9
 
 PKG_LICENSE:=GPL-2.0-only
 PKG_LICENSE_FILES:=COPYING
 
 PKG_INSTALL:=1
-PKG_USE_MIPS16:=0
+PKG_BUILD_FLAGS:=no-mips16
 PKG_BUILD_PARALLEL:=1
 
 include $(INCLUDE_DIR)/package.mk
diff --git a/package/devel/valgrind/Makefile b/package/devel/valgrind/Makefile
index 270aab6dba2702..f696b28c3c79e9 100644
--- a/package/devel/valgrind/Makefile
+++ b/package/devel/valgrind/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=valgrind
-PKG_VERSION:=3.19.0
+PKG_VERSION:=3.21.0
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
-PKG_SOURCE_URL:=http://sourceware.org/pub/valgrind/
-PKG_HASH:=dd5e34486f1a483ff7be7300cc16b4d6b24690987877c3278d797534d6738f02
+PKG_SOURCE_URL:=https://sourceware.org/pub/valgrind/
+PKG_HASH:=10ce1618bb3e33fad16eb79552b0a3e1211762448a0d7fce11c8a6243b9ac971
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=GPL-2.0+
@@ -22,7 +22,7 @@ PKG_CPE_ID:=cpe:/a:valgrind:valgrind
 PKG_FIXUP = autoreconf
 PKG_INSTALL := 1
 PKG_BUILD_PARALLEL := 1
-PKG_USE_MIPS16:=0
+PKG_BUILD_FLAGS:=no-mips16
 PKG_SSP:=0
 
 STRIP:=:
diff --git a/package/devel/valgrind/patches/010-mips-Fix-new-syscall-numbers.patch b/package/devel/valgrind/patches/010-mips-Fix-new-syscall-numbers.patch
index e84273c973225a..5967b0cadac210 100644
--- a/package/devel/valgrind/patches/010-mips-Fix-new-syscall-numbers.patch
+++ b/package/devel/valgrind/patches/010-mips-Fix-new-syscall-numbers.patch
@@ -1,11 +1,11 @@
-From 86ab9452bd10f08dbfa22d94e1155838f6f9f2e0 Mon Sep 17 00:00:00 2001
+From 82e935c564699456a766044faa39367b47cce793 Mon Sep 17 00:00:00 2001
 From: Hauke Mehrtens <hauke@hauke-m.de>
 Date: Sun, 31 Oct 2021 23:11:11 +0100
 Subject: [PATCH] mips: Fix new syscall numbers
 
 The MIPS32 and MIPS64 O32 ABI are adding 4000 to all syscall numbers.
 The MIPS64 N64 ABI adds 5000 to each syscall and the MIPS64 N32 ABI adds
-6000 to each syscall number. We can not sue the shared file for MIPS and
+6000 to each syscall number. We can not use the shared file for MIPS and
 have to define this for each sycall separately.
 
 Without this change valgrind is not able to detect new syscalls like
@@ -13,10 +13,10 @@ clock_gettime64 correctly.
 
 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
 ---
- include/pub_tool_vkiscnums_asm.h      |  3 ---
- include/vki/vki-scnums-mips32-linux.h | 36 +++++++++++++++++++++++++++
- include/vki/vki-scnums-mips64-linux.h | 32 ++++++++++++++++++++++++
- 3 files changed, 68 insertions(+), 3 deletions(-)
+ include/pub_tool_vkiscnums_asm.h      |  3 --
+ include/vki/vki-scnums-mips32-linux.h | 40 +++++++++++++++++++++++++++
+ include/vki/vki-scnums-mips64-linux.h | 40 +++++++++++++++++++++++++++
+ 3 files changed, 80 insertions(+), 3 deletions(-)
 
 --- a/include/pub_tool_vkiscnums_asm.h
 +++ b/include/pub_tool_vkiscnums_asm.h
@@ -38,7 +38,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  #elif defined(VGP_x86_freebsd) || defined(VGP_amd64_freebsd)
 --- a/include/vki/vki-scnums-mips32-linux.h
 +++ b/include/vki/vki-scnums-mips32-linux.h
-@@ -401,6 +401,42 @@
+@@ -401,6 +401,46 @@
  #define __NR_pkey_free			(__NR_Linux + 365)
  #define __NR_statx			(__NR_Linux + 366)
  
@@ -73,17 +73,21 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
 +#define __NR_fsmount			(__NR_Linux + 432)
 +#define __NR_fspick			(__NR_Linux + 433)
 +
++#define __NR_pidfd_open			(__NR_Linux + 434)
 +#define __NR_clone3			(__NR_Linux + 435)
 +#define __NR_close_range		(__NR_Linux + 436)
++#define __NR_openat2			(__NR_Linux + 437)
 +
 +#define __NR_faccessat2			(__NR_Linux + 439)
++
++#define __NR_epoll_pwait2		(__NR_Linux + 441)
 +
  /*
   * Offset of the last Linux o32 flavoured syscall
   */
 --- a/include/vki/vki-scnums-mips64-linux.h
 +++ b/include/vki/vki-scnums-mips64-linux.h
-@@ -363,6 +363,22 @@
+@@ -363,6 +363,26 @@
  #define __NR_pkey_free              (__NR_Linux + 325)
  #define __NR_statx                  (__NR_Linux + 326)
  
@@ -98,15 +102,19 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
 +#define __NR_fsmount                 (__NR_Linux + 432)
 +#define __NR_fspick                  (__NR_Linux + 433)
 +
++#define __NR_pidfd_open              (__NR_Linux + 434)
 +#define __NR_clone3                  (__NR_Linux + 435)
 +#define __NR_close_range             (__NR_Linux + 436)
++#define __NR_openat2                 (__NR_Linux + 437)
 +
 +#define __NR_faccessat2              (__NR_Linux + 439)
++
++#define __NR_epoll_pwait2            (__NR_Linux + 441)
 +
  #elif defined(VGABI_N32)
  
  /*
-@@ -702,6 +718,22 @@
+@@ -702,6 +722,26 @@
  #define __NR_pkey_free               (__NR_Linux + 329)
  #define __NR_statx                   (__NR_Linux + 330)
  
@@ -121,10 +129,14 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
 +#define __NR_fsmount                 (__NR_Linux + 432)
 +#define __NR_fspick                  (__NR_Linux + 433)
 +
++#define __NR_pidfd_open              (__NR_Linux + 434)
 +#define __NR_clone3                  (__NR_Linux + 435)
 +#define __NR_close_range             (__NR_Linux + 436)
++#define __NR_openat2                 (__NR_Linux + 437)
 +
 +#define __NR_faccessat2              (__NR_Linux + 439)
++
++#define __NR_epoll_pwait2            (__NR_Linux + 441)
 +
  #else
  #error unknown mips64 abi
diff --git a/package/devel/valgrind/patches/100-fix_configure_check.patch b/package/devel/valgrind/patches/100-fix_configure_check.patch
index 38269bb14cd263..5fa51977e7b754 100644
--- a/package/devel/valgrind/patches/100-fix_configure_check.patch
+++ b/package/devel/valgrind/patches/100-fix_configure_check.patch
@@ -1,6 +1,6 @@
 --- a/configure.ac
 +++ b/configure.ac
-@@ -368,7 +368,7 @@ case "${host_os}" in
+@@ -364,7 +364,7 @@ case "${host_os}" in
          # Ok, this is linux. Check the kernel version
          AC_MSG_CHECKING([for the kernel version])
  
diff --git a/package/devel/valgrind/patches/130-fix_arm_arch_detection.patch b/package/devel/valgrind/patches/130-fix_arm_arch_detection.patch
index 957e5c930fb6c4..9a7b591e70794b 100644
--- a/package/devel/valgrind/patches/130-fix_arm_arch_detection.patch
+++ b/package/devel/valgrind/patches/130-fix_arm_arch_detection.patch
@@ -6,7 +6,7 @@ Last-Update: 2013-11-30
 
 --- a/configure.ac
 +++ b/configure.ac
-@@ -275,7 +275,7 @@ case "${host_cpu}" in
+@@ -271,7 +271,7 @@ case "${host_cpu}" in
          ARCH_MAX="s390x"
          ;;
  
diff --git a/package/firmware/ath10k-ct-firmware/Makefile b/package/firmware/ath10k-ct-firmware/Makefile
index b210f1a5e44297..78846fbe9da551 100644
--- a/package/firmware/ath10k-ct-firmware/Makefile
+++ b/package/firmware/ath10k-ct-firmware/Makefile
@@ -4,6 +4,8 @@ PKG_NAME:=ath10k-ct-firmware
 PKG_VERSION:=2020-11-08
 PKG_RELEASE:=1
 
+DL_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
+
 include $(INCLUDE_DIR)/package.mk
 
 CT_FIRMWARE_FILE = $(1)-$($(1)_FIRMWARE_FILE_CT)
diff --git a/package/firmware/ath11k-firmware/Makefile b/package/firmware/ath11k-firmware/Makefile
new file mode 100644
index 00000000000000..fc7968a95764a4
--- /dev/null
+++ b/package/firmware/ath11k-firmware/Makefile
@@ -0,0 +1,77 @@
+#
+# Copyright (C) 2022 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=ath11k-firmware
+PKG_SOURCE_DATE:=2023-03-31
+PKG_SOURCE_VERSION:=a039049a9349722fa5c74185452ab04644a0d351
+PKG_MIRROR_HASH:=ed401e3f6e91d70565b3396139193f7e815f410db93700697205ac8ed1b828c5
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL:=https://github.com/quic/upstream-wifi-fw.git
+
+PKG_LICENSE_FILES:=LICENSE.qca_firmware
+
+PKG_MAINTAINER:=Robert Marko <robimarko@gmail.com>
+
+include $(INCLUDE_DIR)/package.mk
+
+RSTRIP:=:
+STRIP:=:
+
+define Package/ath11k-firmware-default
+  SECTION:=firmware
+  CATEGORY:=Firmware
+  URL:=$(PKG_SOURCE_URL)
+  DEPENDS:=
+endef
+
+define Package/ath11k-firmware-ipq8074
+$(Package/ath11k-firmware-default)
+  TITLE:=IPQ8074 ath11k firmware
+endef
+
+define Package/ath11k-firmware-qcn9074
+$(Package/ath11k-firmware-default)
+  TITLE:=QCN9074 ath11k firmware
+endef
+
+define Build/Compile
+
+endef
+
+QCN9074_BOARD_REV:=8e140c65f36137714b6d8934e09dcd73cb05c2f6
+QCN9074_BOARD_FILE:=board-2.bin.$(QCN9074_BOARD_REV)
+
+define Download/qcn9074-board
+  URL:=https://github.com/kvalo/ath11k-firmware/raw/master/QCN9074/hw1.0/
+  URL_FILE:=board-2.bin
+  FILE:=$(QCN9074_BOARD_FILE)
+  HASH:=dbf0ca14aa1229eccd48f26f1026901b9718b143bd30b51b8ea67c84ba6207f1
+endef
+$(eval $(call Download,qcn9074-board))
+
+define Package/ath11k-firmware-ipq8074/install
+	$(INSTALL_DIR) $(1)/lib/firmware/IPQ8074
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath11k-firmware/IPQ8074/hw2.0/testing/2.9.0.1/WLAN.HK.2.9.0.1-01385-QCAHKSWPL_SILICONZ-1/* \
+		$(1)/lib/firmware/IPQ8074/
+endef
+
+define Package/ath11k-firmware-qcn9074/install
+	$(INSTALL_DIR) $(1)/lib/firmware/ath11k/QCN9074/hw1.0
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath11k-firmware/QCN9074/hw1.0/testing/2.9.0.1/WLAN.HK.2.9.0.1-01385-QCAHKSWPL_SILICONZ-1/* \
+		$(1)/lib/firmware/ath11k/QCN9074/hw1.0/
+	$(INSTALL_BIN) \
+		$(DL_DIR)/$(QCN9074_BOARD_FILE) $(1)/lib/firmware/ath11k/QCN9074/hw1.0/board-2.bin
+endef
+
+$(eval $(call BuildPackage,ath11k-firmware-ipq8074))
+$(eval $(call BuildPackage,ath11k-firmware-qcn9074))
diff --git a/package/firmware/broadcom-sprom/Makefile b/package/firmware/broadcom-sprom/Makefile
new file mode 100644
index 00000000000000..01bca2c35b7dd4
--- /dev/null
+++ b/package/firmware/broadcom-sprom/Makefile
@@ -0,0 +1,295 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=broadcom-sprom
+PKG_SOURCE_DATE:=2023-04-27
+PKG_SOURCE_VERSION:=d36f7fcb37711106a3a2652b576436cb09aa5b6f
+PKG_MIRROR_HASH:=fde251ab4ed26d61c95269316119710d6ccb8fe30ef13305d08b3e7d7d8a4c60
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL:=https://github.com/openwrt/broadcom-sprom.git
+
+PKG_MAINTAINER:=Álvaro Fernández Rojas <noltari@gmail.com>
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/broadcom-sprom-default
+  SECTION:=firmware
+  CATEGORY:=Firmware
+endef
+
+define Build/Compile
+	true
+endef
+
+# BCM4306 Fallback SPROM
+define Package/broadcom-4306-sprom
+  $(Package/broadcom-sprom-default)
+  TITLE:=BCM4306 Fallback SPROM
+endef
+
+define Package/broadcom-4306-sprom/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/bcm4306-sprom.bin \
+		$(1)/lib/firmware/brcm/
+endef
+
+$(eval $(call BuildPackage,broadcom-4306-sprom))
+
+# BCM4313 Fallback SPROM
+define Package/broadcom-4313-sprom
+  $(Package/broadcom-sprom-default)
+  TITLE:=BCM4313 Fallback SPROM
+endef
+
+define Package/broadcom-4313-sprom/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/bcm4313-sprom.bin \
+		$(1)/lib/firmware/brcm/
+endef
+
+$(eval $(call BuildPackage,broadcom-4313-sprom))
+
+# BCM4318 Fallback SPROM
+define Package/broadcom-4318-sprom
+  $(Package/broadcom-sprom-default)
+  TITLE:=BCM4318 Fallback SPROM
+endef
+
+define Package/broadcom-4318-sprom/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/bcm4318-sprom.bin \
+		$(1)/lib/firmware/brcm/
+endef
+
+$(eval $(call BuildPackage,broadcom-4318-sprom))
+
+# BCM4321 Fallback SPROM
+define Package/broadcom-4321-sprom
+  $(Package/broadcom-sprom-default)
+  TITLE:=BCM4321 Fallback SPROM
+endef
+
+define Package/broadcom-4321-sprom/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/bcm4321-sprom.bin \
+		$(1)/lib/firmware/brcm/
+endef
+
+$(eval $(call BuildPackage,broadcom-4321-sprom))
+
+# BCM4322 Fallback SPROM
+define Package/broadcom-4322-sprom
+  $(Package/broadcom-sprom-default)
+  TITLE:=BCM4322 Fallback SPROM
+endef
+
+define Package/broadcom-4322-sprom/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/bcm4322-sprom.bin \
+		$(1)/lib/firmware/brcm/
+endef
+
+$(eval $(call BuildPackage,broadcom-4322-sprom))
+
+# BCM4331 Fallback SPROM
+define Package/broadcom-4331-sprom
+  $(Package/broadcom-sprom-default)
+  TITLE:=BCM4331 Fallback SPROM
+endef
+
+define Package/broadcom-4331-sprom/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/bcm4331-sprom.bin \
+		$(1)/lib/firmware/brcm/
+endef
+
+$(eval $(call BuildPackage,broadcom-4331-sprom))
+
+# BCM4360 Fallback SPROM
+define Package/broadcom-4360-sprom
+  $(Package/broadcom-sprom-default)
+  TITLE:=BCM4360 Fallback SPROM
+endef
+
+define Package/broadcom-4360-sprom/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/bcm4360-sprom.bin \
+		$(1)/lib/firmware/brcm/
+endef
+
+$(eval $(call BuildPackage,broadcom-4360-sprom))
+
+# BCM6362 Fallback SPROM
+define Package/broadcom-6362-sprom
+  $(Package/broadcom-sprom-default)
+  TITLE:=BCM6362 Fallback SPROM
+endef
+
+define Package/broadcom-6362-sprom/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/bcm6362-sprom.bin \
+		$(1)/lib/firmware/brcm/
+endef
+
+$(eval $(call BuildPackage,broadcom-6362-sprom))
+
+# BCM43112 Fallback SPROM
+define Package/broadcom-43112-sprom
+  $(Package/broadcom-sprom-default)
+  TITLE:=BCM43112 Fallback SPROM
+endef
+
+define Package/broadcom-43112-sprom/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/bcm43112-sprom.bin \
+		$(1)/lib/firmware/brcm/
+endef
+
+$(eval $(call BuildPackage,broadcom-43112-sprom))
+
+# BCM43131 Fallback SPROM
+define Package/broadcom-43131-sprom
+  $(Package/broadcom-sprom-default)
+  TITLE:=BCM43131 Fallback SPROM
+endef
+
+define Package/broadcom-43131-sprom/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/bcm43131-sprom.bin \
+		$(1)/lib/firmware/brcm/
+endef
+
+$(eval $(call BuildPackage,broadcom-43131-sprom))
+
+# BCM43217 Fallback SPROM
+define Package/broadcom-43217-sprom
+  $(Package/broadcom-sprom-default)
+  TITLE:=BCM43217 Fallback SPROM
+endef
+
+define Package/broadcom-43217-sprom/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/bcm43217-sprom.bin \
+		$(1)/lib/firmware/brcm/
+endef
+
+$(eval $(call BuildPackage,broadcom-43217-sprom))
+
+# BCM43222 Fallback SPROM
+define Package/broadcom-43222-sprom
+  $(Package/broadcom-sprom-default)
+  TITLE:=BCM43222 Fallback SPROM
+endef
+
+define Package/broadcom-43222-sprom/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/bcm43222-sprom.bin \
+		$(1)/lib/firmware/brcm/
+endef
+
+$(eval $(call BuildPackage,broadcom-43222-sprom))
+
+# BCM43224 Fallback SPROM
+define Package/broadcom-43224-sprom
+  $(Package/broadcom-sprom-default)
+  TITLE:=BCM43224 Fallback SPROM
+endef
+
+define Package/broadcom-43224-sprom/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/bcm43224-sprom.bin \
+		$(1)/lib/firmware/brcm/
+endef
+
+$(eval $(call BuildPackage,broadcom-43224-sprom))
+
+# BCM43225 Fallback SPROM
+define Package/broadcom-43225-sprom
+  $(Package/broadcom-sprom-default)
+  TITLE:=BCM43225 Fallback SPROM
+endef
+
+define Package/broadcom-43225-sprom/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/bcm43225-sprom.bin \
+		$(1)/lib/firmware/brcm/
+endef
+
+$(eval $(call BuildPackage,broadcom-43225-sprom))
+
+# BCM43226 Fallback SPROM
+define Package/broadcom-43226-sprom
+  $(Package/broadcom-sprom-default)
+  TITLE:=BCM43226 Fallback SPROM
+endef
+
+define Package/broadcom-43226-sprom/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/bcm43226-sprom.bin \
+		$(1)/lib/firmware/brcm/
+endef
+
+$(eval $(call BuildPackage,broadcom-43226-sprom))
+
+# BCM43227 Fallback SPROM
+define Package/broadcom-43227-sprom
+  $(Package/broadcom-sprom-default)
+  TITLE:=BCM43227 Fallback SPROM
+endef
+
+define Package/broadcom-43227-sprom/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/bcm43227-sprom.bin \
+		$(1)/lib/firmware/brcm/
+endef
+
+$(eval $(call BuildPackage,broadcom-43227-sprom))
+
+# BCM43228 Fallback SPROM
+define Package/broadcom-43228-sprom
+  $(Package/broadcom-sprom-default)
+  TITLE:=BCM43228 Fallback SPROM
+endef
+
+define Package/broadcom-43228-sprom/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/bcm43228-sprom.bin \
+		$(1)/lib/firmware/brcm/
+endef
+
+$(eval $(call BuildPackage,broadcom-43228-sprom))
+
+# BCM43428 Fallback SPROM
+define Package/broadcom-43428-sprom
+  $(Package/broadcom-sprom-default)
+  TITLE:=BCM43428 Fallback SPROM
+endef
+
+define Package/broadcom-43428-sprom/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/bcm43428-sprom.bin \
+		$(1)/lib/firmware/brcm/
+endef
+
+$(eval $(call BuildPackage,broadcom-43428-sprom))
diff --git a/package/firmware/cypress-firmware/Makefile b/package/firmware/cypress-firmware/Makefile
index 769e69a9731808..6a14ff99380695 100644
--- a/package/firmware/cypress-firmware/Makefile
+++ b/package/firmware/cypress-firmware/Makefile
@@ -1,19 +1,14 @@
-#
-# Copyright (C) 2019-2020 OpenWrt.org
-#
-# This is free software, licensed under the GNU General Public License v2.
-# See /LICENSE for more information.
-#
+# SPDX-License-Identifier: GPL-2.0-or-later
 
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=cypress-firmware
-PKG_VERSION:=5.4.18-2021_0812
+PKG_VERSION:=5.10.9-2022_0909
 PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/Infineon/ifx-linux-firmware/
-PKG_MIRROR_HASH:=ac882b482dd401b53cdecc6004cd2bd3d65e888c19206dcf10931a28033ada4d
+PKG_MIRROR_HASH:=944faae3a80013f1a963b6692d7f50a38c97edcf91fd163de521df755e6922b5
 PKG_SOURCE_VERSION:=release-v$(PKG_VERSION)
 
 PKG_MAINTAINER:=Álvaro Fernández Rojas <noltari@gmail.com>
@@ -38,12 +33,19 @@ define Package/cypress-firmware-43012-sdio
 endef
 
 define Package/cypress-firmware-43012-sdio/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DIR) $(1)/lib/firmware/cypress
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac43012-sdio.bin \
-		$(1)/lib/firmware/brcm/brcmfmac43012-sdio.bin
+		$(1)/lib/firmware/cypress/
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac43012-sdio.clm_blob \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../cypress/cyfmac43012-sdio.bin \
+		$(1)/lib/firmware/brcm/brcmfmac43012-sdio.bin
+	$(LN) \
+		../cypress/cyfmac43012-sdio.clm_blob \
 		$(1)/lib/firmware/brcm/brcmfmac43012-sdio.clm_blob
 endef
 
@@ -56,9 +58,13 @@ define Package/cypress-firmware-43340-sdio
 endef
 
 define Package/cypress-firmware-43340-sdio/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DIR) $(1)/lib/firmware/cypress
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac43340-sdio.bin \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../cypress/cyfmac43340-sdio.bin \
 		$(1)/lib/firmware/brcm/brcmfmac43340-sdio.bin
 endef
 
@@ -73,14 +79,39 @@ define Package/cypress-firmware-43362-sdio
 endef
 
 define Package/cypress-firmware-43362-sdio/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DIR) $(1)/lib/firmware/cypress
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac43362-sdio.bin \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../cypress/cyfmac43362-sdio.bin \
 		$(1)/lib/firmware/brcm/brcmfmac43362-sdio.bin
 endef
 
 $(eval $(call BuildPackage,cypress-firmware-43362-sdio))
 
+# Cypress 4339 SDIO Firmware
+define Package/cypress-firmware-4339-sdio
+  $(Package/cypress-firmware-default)
+  TITLE:=CYW4339 FullMac SDIO firmware
+  PROVIDES:=brcmfmac-firmware-4339-sdio
+  CONFLICTS:=brcmfmac-firmware-4339-sdio
+endef
+
+define Package/cypress-firmware-4339-sdio/install
+	$(INSTALL_DIR) $(1)/lib/firmware/cypress
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/firmware/cyfmac4339-sdio.bin \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../cypress/cyfmac4339-sdio.bin \
+		$(1)/lib/firmware/brcm/brcmfmac4339-sdio.bin
+endef
+
+$(eval $(call BuildPackage,cypress-firmware-4339-sdio))
+
 # Cypress 43430 SDIO Firmware
 define Package/cypress-firmware-43430-sdio
   $(Package/cypress-firmware-default)
@@ -90,17 +121,49 @@ define Package/cypress-firmware-43430-sdio
 endef
 
 define Package/cypress-firmware-43430-sdio/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DIR) $(1)/lib/firmware/cypress
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac43430-sdio.bin \
-		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.bin
+		$(1)/lib/firmware/cypress/
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac43430-sdio.clm_blob \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../cypress/cyfmac43430-sdio.bin \
+		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.bin
+	$(LN) \
+		../cypress/cyfmac43430-sdio.clm_blob \
 		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.clm_blob
 endef
 
 $(eval $(call BuildPackage,cypress-firmware-43430-sdio))
 
+# Cypress 43439 SDIO Firmware
+define Package/cypress-firmware-43439-sdio
+  $(Package/cypress-firmware-default)
+  TITLE:=CYW43439 FullMac SDIO firmware
+endef
+
+define Package/cypress-firmware-43439-sdio/install
+	$(INSTALL_DIR) $(1)/lib/firmware/cypress
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/firmware/cyfmac43439-sdio.bin \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/firmware/cyfmac43439-sdio.clm_blob \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../cypress/cyfmac43439-sdio.bin \
+		$(1)/lib/firmware/brcm/brcmfmac43439-sdio.bin
+	$(LN) \
+		../cypress/cyfmac43439-sdio.clm_blob \
+		$(1)/lib/firmware/brcm/brcmfmac43439-sdio.clm_blob
+endef
+
+$(eval $(call BuildPackage,cypress-firmware-43439-sdio))
+
 # Cypress 43455 SDIO Firmware
 define Package/cypress-firmware-43455-sdio
   $(Package/cypress-firmware-default)
@@ -110,12 +173,19 @@ define Package/cypress-firmware-43455-sdio
 endef
 
 define Package/cypress-firmware-43455-sdio/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DIR) $(1)/lib/firmware/cypress
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac43455-sdio.bin \
-		$(1)/lib/firmware/brcm/brcmfmac43455-sdio.bin
+		$(1)/lib/firmware/cypress/
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac43455-sdio.clm_blob \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../cypress/cyfmac43455-sdio.bin \
+		$(1)/lib/firmware/brcm/brcmfmac43455-sdio.bin
+	$(LN) \
+		../cypress/cyfmac43455-sdio.clm_blob \
 		$(1)/lib/firmware/brcm/brcmfmac43455-sdio.clm_blob
 endef
 
@@ -128,12 +198,19 @@ define Package/cypress-firmware-4354-sdio
 endef
 
 define Package/cypress-firmware-4354-sdio/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DIR) $(1)/lib/firmware/cypress
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac4354-sdio.bin \
-		$(1)/lib/firmware/brcm/brcmfmac4354-sdio.bin
+		$(1)/lib/firmware/cypress/
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac4354-sdio.clm_blob \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../cypress/cyfmac4354-sdio.bin \
+		$(1)/lib/firmware/brcm/brcmfmac4354-sdio.bin
+	$(LN) \
+		../cypress/cyfmac4354-sdio.clm_blob \
 		$(1)/lib/firmware/brcm/brcmfmac4354-sdio.clm_blob
 endef
 
@@ -146,12 +223,19 @@ define Package/cypress-firmware-4356-pcie
 endef
 
 define Package/cypress-firmware-4356-pcie/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DIR) $(1)/lib/firmware/cypress
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac4356-pcie.bin \
-		$(1)/lib/firmware/brcm/brcmfmac4356-pcie.bin
+		$(1)/lib/firmware/cypress/
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac4356-pcie.clm_blob \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../cypress/cyfmac4356-pcie.bin \
+		$(1)/lib/firmware/brcm/brcmfmac4356-pcie.bin
+	$(LN) \
+		../cypress/cyfmac4356-pcie.clm_blob \
 		$(1)/lib/firmware/brcm/brcmfmac4356-pcie.clm_blob
 endef
 
@@ -164,12 +248,19 @@ define Package/cypress-firmware-4356-sdio
 endef
 
 define Package/cypress-firmware-4356-sdio/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DIR) $(1)/lib/firmware/cypress
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac4356-sdio.bin \
-		$(1)/lib/firmware/brcm/brcmfmac4356-sdio.bin
+		$(1)/lib/firmware/cypress/
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac4356-sdio.clm_blob \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../cypress/cyfmac4356-sdio.bin \
+		$(1)/lib/firmware/brcm/brcmfmac4356-sdio.bin
+	$(LN) \
+		../cypress/cyfmac4356-sdio.clm_blob \
 		$(1)/lib/firmware/brcm/brcmfmac4356-sdio.clm_blob
 endef
 
@@ -182,17 +273,49 @@ define Package/cypress-firmware-43570-pcie
 endef
 
 define Package/cypress-firmware-43570-pcie/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DIR) $(1)/lib/firmware/cypress
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac43570-pcie.bin \
-		$(1)/lib/firmware/brcm/brcmfmac43570-pcie.bin
+		$(1)/lib/firmware/cypress/
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac43570-pcie.clm_blob \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../cypress/cyfmac43570-pcie.bin \
+		$(1)/lib/firmware/brcm/brcmfmac43570-pcie.bin
+	$(LN) \
+		../cypress/cyfmac43570-pcie.clm_blob \
 		$(1)/lib/firmware/brcm/brcmfmac43570-pcie.clm_blob
 endef
 
 $(eval $(call BuildPackage,cypress-firmware-43570-pcie))
 
+# Cypress 4373 PCIe Firmware
+define Package/cypress-firmware-4373-pcie
+  $(Package/cypress-firmware-default)
+  TITLE:=CYW4373 FullMac PCIe firmware
+endef
+
+define Package/cypress-firmware-4373-pcie/install
+	$(INSTALL_DIR) $(1)/lib/firmware/cypress
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/firmware/cyfmac4373-pcie.bin \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/firmware/cyfmac4373-pcie.clm_blob \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../cypress/cyfmac4373-pcie.bin \
+		$(1)/lib/firmware/brcm/brcmfmac4373-pcie.bin
+	$(LN) \
+		../cypress/cyfmac4373-pcie.clm_blob \
+		$(1)/lib/firmware/brcm/brcmfmac4373-pcie.clm_blob
+endef
+
+$(eval $(call BuildPackage,cypress-firmware-4373-pcie))
+
 # Cypress 4373 SDIO Firmware
 define Package/cypress-firmware-4373-sdio
   $(Package/cypress-firmware-default)
@@ -200,12 +323,19 @@ define Package/cypress-firmware-4373-sdio
 endef
 
 define Package/cypress-firmware-4373-sdio/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DIR) $(1)/lib/firmware/cypress
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac4373-sdio.bin \
-		$(1)/lib/firmware/brcm/brcmfmac4373-sdio.bin
+		$(1)/lib/firmware/cypress/
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac4373-sdio.clm_blob \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../cypress/cyfmac4373-sdio.bin \
+		$(1)/lib/firmware/brcm/brcmfmac4373-sdio.bin
+	$(LN) \
+		../cypress/cyfmac4373-sdio.clm_blob \
 		$(1)/lib/firmware/brcm/brcmfmac4373-sdio.clm_blob
 endef
 
@@ -218,12 +348,19 @@ define Package/cypress-firmware-4373-usb
 endef
 
 define Package/cypress-firmware-4373-usb/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DIR) $(1)/lib/firmware/cypress
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac4373-usb.bin \
-		$(1)/lib/firmware/brcm/brcmfmac4373-usb.bin
+		$(1)/lib/firmware/cypress/
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac4373.clm_blob \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../cypress/cyfmac4373-usb.bin \
+		$(1)/lib/firmware/brcm/brcmfmac4373-usb.bin
+	$(LN) \
+		../cypress/cyfmac4373.clm_blob \
 		$(1)/lib/firmware/brcm/brcmfmac4373.clm_blob
 endef
 
@@ -236,13 +373,114 @@ define Package/cypress-firmware-54591-pcie
 endef
 
 define Package/cypress-firmware-54591-pcie/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DIR) $(1)/lib/firmware/cypress
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac54591-pcie.bin \
-		$(1)/lib/firmware/brcm/brcmfmac54591-pcie.bin
+		$(1)/lib/firmware/cypress/
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/firmware/cyfmac54591-pcie.clm_blob \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../cypress/cyfmac54591-pcie.bin \
+		$(1)/lib/firmware/brcm/brcmfmac54591-pcie.bin
+	$(LN) \
+		../cypress/cyfmac54591-pcie.clm_blob \
 		$(1)/lib/firmware/brcm/brcmfmac54591-pcie.clm_blob
 endef
 
 $(eval $(call BuildPackage,cypress-firmware-54591-pcie))
+
+# Cypress 54591 SDIO Firmware
+define Package/cypress-firmware-54591-sdio
+  $(Package/cypress-firmware-default)
+  TITLE:=CYW54591 FullMac SDIO firmware
+endef
+
+define Package/cypress-firmware-54591-sdio/install
+	$(INSTALL_DIR) $(1)/lib/firmware/cypress
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/firmware/cyfmac54591-sdio.bin \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/firmware/cyfmac54591-sdio.clm_blob \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../cypress/cyfmac54591-sdio.bin \
+		$(1)/lib/firmware/brcm/brcmfmac54591-sdio.bin
+	$(LN) \
+		../cypress/cyfmac54591-sdio.clm_blob \
+		$(1)/lib/firmware/brcm/brcmfmac54591-sdio.clm_blob
+endef
+
+$(eval $(call BuildPackage,cypress-firmware-54591-sdio))
+
+# Cypress 55560 PCIe Firmware
+define Package/cypress-firmware-55560-pcie
+  $(Package/cypress-firmware-default)
+  TITLE:=CYW55560 FullMac PCIe firmware
+endef
+
+define Package/cypress-firmware-55560-pcie/install
+	$(INSTALL_DIR) $(1)/lib/firmware/cypress
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/firmware/cyfmac55560-pcie.trxse \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../cypress/cyfmac55560-pcie.trxse \
+		$(1)/lib/firmware/brcm/brcmfmac55560-pcie.trxse
+endef
+
+$(eval $(call BuildPackage,cypress-firmware-55560-pcie))
+
+# Cypress 55572 PCIe Firmware
+define Package/cypress-firmware-55572-pcie
+  $(Package/cypress-firmware-default)
+  TITLE:=CYW55572 FullMac PCIe firmware
+endef
+
+define Package/cypress-firmware-55572-pcie/install
+	$(INSTALL_DIR) $(1)/lib/firmware/cypress
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/firmware/cyfmac55572-pcie.trxse \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/firmware/cyfmac55572-pcie.clm_blob \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../cypress/cyfmac55572-pcie.trxse \
+		$(1)/lib/firmware/brcm/brcmfmac55572-pcie.trxse
+	$(LN) \
+		../cypress/cyfmac55572-pcie.clm_blob \
+		$(1)/lib/firmware/brcm/brcmfmac55572-pcie.clm_blob
+endef
+
+$(eval $(call BuildPackage,cypress-firmware-55572-pcie))
+
+# Cypress 55572 SDIO Firmware
+define Package/cypress-firmware-55572-sdio
+  $(Package/cypress-firmware-default)
+  TITLE:=CYW55572 FullMac SDIO firmware
+endef
+
+define Package/cypress-firmware-55572-sdio/install
+	$(INSTALL_DIR) $(1)/lib/firmware/cypress
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/firmware/cyfmac55572-sdio.trxse \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/firmware/cyfmac55572-sdio.clm_blob \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../cypress/cyfmac55572-sdio.trxse \
+		$(1)/lib/firmware/brcm/brcmfmac55572-sdio.trxse
+	$(LN) \
+		../cypress/cyfmac55572-sdio.clm_blob \
+		$(1)/lib/firmware/brcm/brcmfmac55572-sdio.clm_blob
+endef
+
+$(eval $(call BuildPackage,cypress-firmware-55572-sdio))
diff --git a/package/firmware/cypress-nvram/Makefile b/package/firmware/cypress-nvram/Makefile
index f8b45fbef26e2f..dcf09d95998425 100644
--- a/package/firmware/cypress-nvram/Makefile
+++ b/package/firmware/cypress-nvram/Makefile
@@ -1,126 +1,38 @@
-#
-# Copyright (C) 2019 OpenWrt.org
-#
-# This is free software, licensed under the GNU General Public License v2.
-# See /LICENSE for more information.
-#
+# SPDX-License-Identifier: GPL-2.0-or-later
 
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=cypress-nvram
-PKG_SOURCE_DATE:=2019-09-03
-PKG_SOURCE_VERSION:=e7b78df22f2a0c5f56abb7b5880661611de35e5f
-PKG_MIRROR_HASH:=1cb20a749696852be0a512d51961365dd9c031362af0af1a2b9f5a3fb894885f
-PKG_RELEASE:=2
-
-PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=https://github.com/openwrt/cypress-nvram.git
+PKG_RELEASE:=7
 
 PKG_MAINTAINER:=Álvaro Fernández Rojas <noltari@gmail.com>
 
-PKG_FLAGS:=nonshared
-
 include $(INCLUDE_DIR)/package.mk
 
 define Package/cypress-nvram-default
   SECTION:=firmware
   CATEGORY:=Firmware
-  URL:=https://community.cypress.com/community/linux
 endef
 
 define Build/Compile
 	true
 endef
 
-# Cypress 43430 SDIO Raspberry Pi 3B NVRAM
-define Package/cypress-nvram-43430-sdio-rpi-3b
-  $(Package/cypress-nvram-default)
-  TITLE:=CYW43430 NVRAM for Raspberry Pi 3B
-  DEPENDS:=@TARGET_bcm27xx
-  PROVIDES:=brcmfmac-firmware-43430-sdio-rpi-3b
-  CONFLICTS:=brcmfmac-firmware-43430-sdio-rpi-3b
-endef
-
-define Package/cypress-nvram-43430-sdio-rpi-3b/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
-	$(INSTALL_DATA) \
-		$(PKG_BUILD_DIR)/brcmfmac43430-sdio.raspberrypi,3-model-b.txt \
-		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.raspberrypi,3-model-b.txt
-endef
-
-$(eval $(call BuildPackage,cypress-nvram-43430-sdio-rpi-3b))
-
-# Cypress 43430 SDIO Raspberry Pi Zero W NVRAM
-define Package/cypress-nvram-43430-sdio-rpi-zero-w
-  $(Package/cypress-nvram-default)
-  TITLE:=CYW43430 NVRAM for Raspberry Pi Zero W
-  DEPENDS:=@TARGET_bcm27xx
-  PROVIDES:=brcmfmac-firmware-43430-sdio-rpi-zero-w
-  CONFLICTS:=brcmfmac-firmware-43430-sdio-rpi-zero-w
-endef
-
-define Package/cypress-nvram-43430-sdio-rpi-zero-w/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
-	$(INSTALL_DATA) \
-		$(PKG_BUILD_DIR)/brcmfmac43430-sdio.raspberrypi,model-zero-w.txt \
-		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.raspberrypi,model-zero-w.txt
-endef
-
-$(eval $(call BuildPackage,cypress-nvram-43430-sdio-rpi-zero-w))
-
-# Cypress 43455 SDIO Raspberry Pi 3B+ NVRAM
-define Package/cypress-nvram-43455-sdio-rpi-3b-plus
-  $(Package/cypress-nvram-default)
-  TITLE:=CYW43455 NVRAM for Raspberry Pi 3B+
-  DEPENDS:=@TARGET_bcm27xx
-  PROVIDES:=brcmfmac-firmware-43455-sdio-rpi-3b-plus
-  CONFLICTS:=brcmfmac-firmware-43455-sdio-rpi-3b-plus
-endef
-
-define Package/cypress-nvram-43455-sdio-rpi-3b-plus/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
-	$(INSTALL_DATA) \
-		$(PKG_BUILD_DIR)/brcmfmac43455-sdio.raspberrypi,3-model-b-plus.txt \
-		$(1)/lib/firmware/brcm/brcmfmac43455-sdio.raspberrypi,3-model-b-plus.txt
-endef
-
-$(eval $(call BuildPackage,cypress-nvram-43455-sdio-rpi-3b-plus))
-
-# Cypress 43455 SDIO Raspberry Pi 4B NVRAM
-define Package/cypress-nvram-43455-sdio-rpi-4b
-  $(Package/cypress-nvram-default)
-  TITLE:=CYW43455 NVRAM for Raspberry Pi 4B
-  DEPENDS:=@TARGET_bcm27xx
-  PROVIDES:=brcmfmac-firmware-43455-sdio-rpi-4b
-  CONFLICTS:=brcmfmac-firmware-43455-sdio-rpi-4b
-endef
-
-define Package/cypress-nvram-43455-sdio-rpi-4b/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
-	$(INSTALL_DATA) \
-		$(PKG_BUILD_DIR)/brcmfmac43455-sdio.raspberrypi,4-model-b.txt \
-		$(1)/lib/firmware/brcm/brcmfmac43455-sdio.raspberrypi,4-model-b.txt
-	$(INSTALL_DATA) \
-		$(PKG_BUILD_DIR)/brcmfmac43455-sdio.raspberrypi,4-model-b.txt \
-		$(1)/lib/firmware/brcm/brcmfmac43455-sdio.raspberrypi,4-compute-module.txt
-endef
-
-$(eval $(call BuildPackage,cypress-nvram-43455-sdio-rpi-4b))
-
-# Cypress 4339 SDIO PICO-PI-IMX7D
-define Package/cypress-nvram-4339-pico-pi-imx7d
+# Cypress 4339 SDIO NVRAM
+define Package/cypress-nvram-4339-sdio
   $(Package/cypress-nvram-default)
-  TITLE:=BCM4339 NVRAM for TechNexion PICO-PI-IMX7D
-  DEPENDS:=@TARGET_imx_cortexa7
-  PROVIDES:=brcmfmac-firmware-4339-pico-pi-imx7d
-  CONFLICTS:=brcmfmac-firmware-4339-pico-pi-imx7d
+  TITLE:=BCM4339 SDIO NVRAM
+  CONFLICTS:=brcmfmac-nvram-4339-sdio
 endef
 
-define Package/cypress-nvram-4339-pico-pi-imx7d/install
+define Package/cypress-nvram-4339-sdio/install
 	$(INSTALL_DIR) $(1)/lib/firmware/brcm
 	$(INSTALL_DATA) \
-		./files/brcmfmac4339-sdio.technexion,imx7d-pico-pi.txt \
+		./files/brcmfmac4339-sdio.AP6335.txt \
+		$(1)/lib/firmware/brcm/
+	$(LN) \
+		brcmfmac4339-sdio.AP6335.txt \
 		$(1)/lib/firmware/brcm/brcmfmac4339-sdio.technexion,imx7d-pico-pi.txt
 endef
 
-$(eval $(call BuildPackage,cypress-nvram-4339-pico-pi-imx7d))
+$(eval $(call BuildPackage,cypress-nvram-4339-sdio))
diff --git a/package/firmware/cypress-nvram/files/brcmfmac4339-sdio.AP6335.txt b/package/firmware/cypress-nvram/files/brcmfmac4339-sdio.AP6335.txt
new file mode 100644
index 00000000000000..1ddd929504827d
--- /dev/null
+++ b/package/firmware/cypress-nvram/files/brcmfmac4339-sdio.AP6335.txt
@@ -0,0 +1,99 @@
+#AP6335_NVRAM_V1.5_03112014
+NVRAMRev=$Rev: 410316 $
+sromrev=11
+boardrev=0x1203
+boardtype=0x06c5
+boardflags=0x00000c01
+boardflags2=0x00002000
+boardflags3=0x101188
+macaddr=00:90:4c:c5:12:38
+ccode=0
+regrev=0
+antswitch=0
+pdgain2g=7
+pdgain5g=7
+tworangetssi2g=0
+tworangetssi5g=0
+femctrl=7
+pcieingress_war=15
+vendid=0x14e4
+devid=0x43ae
+manfid=0x2d0
+nocrc=1
+otpimagesize=502
+xtalfreq=37400
+extpagain2g=2
+pdetrange2g=2
+extpagain5g=2
+pdetrange5g=2
+rxgains2gelnagaina0=0
+rxgains2gtrisoa0=7
+rxgains2gtrelnabypa0=0
+rxgains5gelnagaina0=0
+rxgains5gtrisoa0=11
+rxgains5gtrelnabypa0=0
+rxchain=1
+txchain=1
+aa2g=1
+aa5g=1
+tssipos5g=0
+tssipos2g=0
+pa2ga0=-161,6269,-723
+pa2gccka0=-116,7568,-852
+pa5ga0=0xFF61,0x163C,0xFD55,0xFF5D,0x1671,0xFD4F,0xFF5F,0x16CA,0xFD45,0xFF60,0x1676,0xFD4D
+pa5gbw40a0=0xFF61,0x163C,0xFD55,0xFF5D,0x1671,0xFD4F,0xFF5F,0x16CA,0xFD45,0xFF60,0x1676,0xFD4D
+pa5gbw80a0=0xFF61,0x163C,0xFD55,0xFF5D,0x1671,0xFD4F,0xFF5F,0x16CA,0xFD45,0xFF60,0x1676,0xFD4D
+pdoffset40ma0=0
+pdoffset80ma0=0
+pdoffsetcckma0=0
+maxp2ga0=75
+maxp5ga0=64,64,72,72
+cckbw202gpo=0x0000
+cckbw20ul2gpo=0x0
+mcsbw202gpo=0x99445533
+mcsbw402gpo=0x99775533
+dot11agofdmhrbw202gpo=0x2233
+ofdmlrbw202gpo=0x0000
+tssifloor2g=500
+mcsbw205glpo=0x66333330
+mcsbw405glpo=0x66665530
+mcsbw805glpo=0xAA555530
+mcsbw1605glpo=0x99555530
+mcsbw205gmpo=0x99BB5530
+mcsbw405gmpo=0x99BB5530
+mcsbw805gmpo=0xEE555530
+mcsbw1605gmpo=0x99555530
+mcsbw205ghpo=0x99995530
+mcsbw405ghpo=0x99BB5530
+mcsbw805ghpo=0xEE555530
+mcsbw1605ghpo=0x99555530
+mcslr5glpo=0x0000
+mcslr5gmpo=0x0000
+mcslr5ghpo=0x0000
+sb20in40hrrpo=0x0
+sb20in80and160hr5glpo=0x0
+sb40and80hr5glpo=0x0
+sb20in80and160hr5gmpo=0x0
+sb40and80hr5gmpo=0x0
+sb20in80and160hr5ghpo=0x0
+sb40and80hr5ghpo=0x0
+sb20in40lrpo=0x0
+sb20in80and160lr5glpo=0x0
+sb40and80lr5glpo=0x0
+sb20in80and160lr5gmpo=0x0
+sb40and80lr5gmpo=0x0
+sb20in80and160lr5ghpo=0x0
+sb40and80lr5ghpo=0x0
+dot11agduphrpo=0x0
+dot11agduplrpo=0x0
+phycal_tempdelta=25
+cckdigfilttype=2
+pacalidx2g=65
+dacrate2g=160
+swctrlmap_5g=0x00000008,0x00000010,0x00000008,0x000000,0x038
+swctrlmap_2g=0x00000001,0x00000002,0x00000001,0x040002,0x0ff
+swctrlmapext_5g=0x00000000,0x00000000,0x00000000,0x000000,0x000
+swctrlmapext_2g=0x00000000,0x00000000,0x00000000,0x000000,0x000
+rssicorrnorm_c0=3,3
+rssicorrnorm5g_c0=2,3,4,2,3,3,0,1,2,0,1,2
+muxenab=0x10
diff --git a/package/firmware/intel-microcode/Makefile b/package/firmware/intel-microcode/Makefile
index 0d51730173e133..4c234ddc846574 100644
--- a/package/firmware/intel-microcode/Makefile
+++ b/package/firmware/intel-microcode/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=intel-microcode
-PKG_VERSION:=20220510
+PKG_VERSION:=20230512
 PKG_RELEASE:=1
 
 PKG_SOURCE:=intel-microcode_3.$(PKG_VERSION).1.tar.xz
-PKG_SOURCE_URL:=@DEBIAN/pool/non-free/i/intel-microcode/
-PKG_HASH:=49752447c1b905dd130699cdef09fb2bba47b6f413d27787c98a5569273e283e
+PKG_SOURCE_URL:=@DEBIAN/pool/non-free-firmware/i/intel-microcode/
+PKG_HASH:=e6717a42d7b6e92280565fbb180cd0d11bc5d14874ef06ff1bed2b7a11d17c67
 PKG_BUILD_DIR:=$(BUILD_DIR)/intel-microcode-3.$(PKG_VERSION).1
 
 PKG_BUILD_DEPENDS:=iucode-tool/host
diff --git a/package/firmware/ipq-wifi/Makefile b/package/firmware/ipq-wifi/Makefile
index 7b683ef0a2a29a..2bffd2a1b74073 100644
--- a/package/firmware/ipq-wifi/Makefile
+++ b/package/firmware/ipq-wifi/Makefile
@@ -3,14 +3,17 @@ include $(INCLUDE_DIR)/version.mk
 
 PKG_NAME:=ipq-wifi
 PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL=$(PROJECT_GIT)/project/firmware/qca-wireless.git
+PKG_SOURCE_DATE:=2023-06-03
+PKG_SOURCE_VERSION:=cd9c30ca47b8e5388b770c523a7f6b8b969e2f92
+PKG_MIRROR_HASH:=45e623fcc512b514ade0f22e217275536aa8de4afba7dfdb11696482b8fa71a2
+
 PKG_FLAGS:=nonshared
 
 include $(INCLUDE_DIR)/package.mk
 
-define Build/Prepare
-	mkdir -p $(PKG_BUILD_DIR)
-endef
-
 define Build/Compile
 endef
 
@@ -25,19 +28,19 @@ endef
 # <https://wireless.wiki.kernel.org/en/users/drivers/ath10k/boardfiles>
 
 ALLWIFIBOARDS:= \
-	aruba_ap-365 \
-	devolo_magic-2-wifi-next \
-	edgecore_ecw5410 \
-	edgecore_oap100 \
-	extreme-networks_ws-ap3915i \
-	glinet_gl-ap1300 \
-	glinet_gl-s1300 \
-	linksys_ea8300 \
-	p2w_r619ac \
-	pakedge_wr-1 \
-	qxwlan_e2600ac-c1 \
-	qxwlan_e2600ac-c2 \
-	teltonika_rutx
+	buffalo_wxr-5950ax12 \
+	compex_wpq873 \
+	dynalink_dl-wrx36 \
+	edgecore_eap102 \
+	edimax_cax1800 \
+	netgear_wax218 \
+	prpl_haze \
+	qnap_301w \
+	redmi_ax6 \
+	wallys_dr40x9 \
+	xiaomi_ax3600 \
+	xiaomi_ax9000 \
+	zyxel_nbg7815
 
 ALLWIFIPACKAGES:=$(foreach BOARD,$(ALLWIFIBOARDS),ipq-wifi-$(BOARD))
 
@@ -45,7 +48,7 @@ define Package/ipq-wifi-default
   SUBMENU:=ath10k Board-Specific Overrides
   SECTION:=firmware
   CATEGORY:=Firmware
-  DEPENDS:=@(TARGET_ipq40xx||TARGET_ipq806x)
+  DEPENDS:=@(TARGET_ipq40xx||TARGET_ipq806x||TARGET_qualcommax)
   TITLE:=Custom Board
 endef
 
@@ -54,15 +57,28 @@ define ipq-wifi-install-one-to
   $(INSTALL_DATA) $(1) $(2)/lib/firmware/ath10k/$(3)/board-2.bin
 endef
 
+define ipq-wifi-install-ath11-one-to
+  $(INSTALL_DIR)  $(2)/lib/firmware/ath11k/$(3)/
+  $(INSTALL_DATA) $(1) $(2)/lib/firmware/ath11k/$(3)/board-2.bin
+endef
+
 define ipq-wifi-install-one
   $(if $(filter $(suffix $(1)),.QCA4019 .qca4019),\
     $(call ipq-wifi-install-one-to,$(1),$(2),QCA4019/hw1.0),\
   $(if $(filter $(suffix $(1)),.QCA9888 .qca9888),\
     $(call ipq-wifi-install-one-to,$(1),$(2),QCA9888/hw2.0),\
+  $(if $(filter $(suffix $(1)),.QCA9889 .qca9889),\
+    $(call ipq-wifi-install-one-to,$(1),$(2),QCA9887/hw1.0),\
   $(if $(filter $(suffix $(1)),.QCA9984 .qca9984),\
     $(call ipq-wifi-install-one-to,$(1),$(2),QCA9984/hw1.0),\
+  $(if $(filter $(suffix $(1)),.QCA99X0 .qca99x0),\
+    $(call ipq-wifi-install-one-to,$(1),$(2),QCA99X0/hw2.0),\
+  $(if $(filter $(suffix $(1)),.IPQ8074 .ipq8074),\
+    $(call ipq-wifi-install-ath11-one-to,$(1),$(2),IPQ8074/hw2.0),\
+  $(if $(filter $(suffix $(1)),.QCN9074 .qcn9074),\
+    $(call ipq-wifi-install-ath11-one-to,$(1),$(2),QCN9074/hw1.0),\
     $(error Unrecognized board-file suffix '$(suffix $(1))' for '$(1)')\
-  )))
+  )))))))
 
 endef
 # Blank line required at end of above define due to foreach context
@@ -87,7 +103,7 @@ Do not install it for any other device!
   endef
 
   define Package/ipq-wifi-$(1)/install-overlay
-    $$$$(foreach IPQ_WIFI_BOARD_FILE,$$$$(wildcard board-$(1).*),\
+    $$$$(foreach IPQ_WIFI_BOARD_FILE,$$$$(wildcard $(PKG_BUILD_DIR)/board-$(1).*),\
       $$$$(call ipq-wifi-install-one,$$$$(IPQ_WIFI_BOARD_FILE),$$(1)))
   endef
 
@@ -95,21 +111,21 @@ Do not install it for any other device!
 endef
 
 # Add board name to ALLWIFIBOARDS
-# Place files in this directory as board-<devicename>.<qca4019|qca9888|qca9984>
+# Place files in this directory as board-<devicename>.<qca4019|qca9888|qca9889|qca9984|qca99x0|ipq8074>
 # Add $(eval $(call generate-ipq-wifi-package,<devicename>,<display name>))
 
-$(eval $(call generate-ipq-wifi-package,aruba_ap-365,Aruba AP-365))
-$(eval $(call generate-ipq-wifi-package,devolo_magic-2-wifi-next,devolo Magic 2 WiFi next))
-$(eval $(call generate-ipq-wifi-package,edgecore_ecw5410,Edgecore ECW5410))
-$(eval $(call generate-ipq-wifi-package,edgecore_oap100,Edgecore OAP100))
-$(eval $(call generate-ipq-wifi-package,extreme-networks_ws-ap3915i,Edgecore OAP100))
-$(eval $(call generate-ipq-wifi-package,glinet_gl-ap1300,GL.iNet GL-AP1300))
-$(eval $(call generate-ipq-wifi-package,glinet_gl-s1300,GL.iNet GL-S1300))
-$(eval $(call generate-ipq-wifi-package,linksys_ea8300,Linksys EA8300))
-$(eval $(call generate-ipq-wifi-package,p2w_r619ac,P&W R619AC))
-$(eval $(call generate-ipq-wifi-package,pakedge_wr-1,Pakedge WR-1))
-$(eval $(call generate-ipq-wifi-package,qxwlan_e2600ac-c1,Qxwlan E2600AC C1))
-$(eval $(call generate-ipq-wifi-package,qxwlan_e2600ac-c2,Qxwlan E2600AC C2))
-$(eval $(call generate-ipq-wifi-package,teltonika_rutx,Teltonika RUTX))
+$(eval $(call generate-ipq-wifi-package,buffalo_wxr-5950ax12,Buffalo WXR-5950AX12))
+$(eval $(call generate-ipq-wifi-package,compex_wpq873,Compex WPQ-873))
+$(eval $(call generate-ipq-wifi-package,dynalink_dl-wrx36,Dynalink DL-WRX36))
+$(eval $(call generate-ipq-wifi-package,edgecore_eap102,Edgecore EAP102))
+$(eval $(call generate-ipq-wifi-package,edimax_cax1800,Edimax CAX1800))
+$(eval $(call generate-ipq-wifi-package,netgear_wax218,Netgear WAX218))
+$(eval $(call generate-ipq-wifi-package,qnap_301w,QNAP 301w))
+$(eval $(call generate-ipq-wifi-package,prpl_haze,prpl Haze))
+$(eval $(call generate-ipq-wifi-package,redmi_ax6,Redmi AX6))
+$(eval $(call generate-ipq-wifi-package,wallys_dr40x9,Wallys DR40X9))
+$(eval $(call generate-ipq-wifi-package,xiaomi_ax3600,Xiaomi AX3600))
+$(eval $(call generate-ipq-wifi-package,xiaomi_ax9000,Xiaomi AX9000))
+$(eval $(call generate-ipq-wifi-package,zyxel_nbg7815,Zyxel NBG7815))
 
 $(foreach PACKAGE,$(ALLWIFIPACKAGES),$(eval $(call BuildPackage,$(PACKAGE))))
diff --git a/package/firmware/layerscape/fman-ucode/Makefile b/package/firmware/layerscape/fman-ucode/Makefile
index 0d2ae68283040a..fdd4659851289f 100644
--- a/package/firmware/layerscape/fman-ucode/Makefile
+++ b/package/firmware/layerscape/fman-ucode/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=fman-ucode
-PKG_VERSION:=21.08
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_VERSION:=lf-6.1.1-1.0.0
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=https://github.com/NXP/qoriq-fm-ucode.git
-PKG_SOURCE_VERSION:=LSDK-21.08
-PKG_MIRROR_HASH:=fc3c249c20b823e9554764f875c3d600b05f2e3659262d79f081e6765e891c96
+PKG_SOURCE_URL:=https://github.com/nxp-qoriq/qoriq-fm-ucode
+PKG_SOURCE_VERSION:=lf-6.1.1-1.0.0
+PKG_MIRROR_HASH:=3614200837945460374570a48822a3efb96a64b93724e7f973e61008baeccf3a
 
 PKG_FLAGS:=nonshared
 
diff --git a/package/firmware/layerscape/ls-ddr-phy/Makefile b/package/firmware/layerscape/ls-ddr-phy/Makefile
index c497825262eeff..28e1355073e855 100644
--- a/package/firmware/layerscape/ls-ddr-phy/Makefile
+++ b/package/firmware/layerscape/ls-ddr-phy/Makefile
@@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ls-ddr-phy
 PKG_VERSION:=21.08
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=3
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/NXP/ddr-phy-binary.git
diff --git a/package/firmware/layerscape/ls-dpl/Makefile b/package/firmware/layerscape/ls-dpl/Makefile
index 330400520108a6..6c53b4541700fa 100644
--- a/package/firmware/layerscape/ls-dpl/Makefile
+++ b/package/firmware/layerscape/ls-dpl/Makefile
@@ -9,10 +9,10 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ls-dpl
 PKG_VERSION:=21.08
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=3
 
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=https://source.codeaurora.org/external/qoriq/qoriq-components/mc-utils
+PKG_SOURCE_URL:=https://github.com/nxp-qoriq/mc-utils
 PKG_SOURCE_VERSION:=LSDK-21.08
 PKG_MIRROR_HASH:=372498ff4b5c8a1ac64ead5856d03ee021332f57771989ed6fe066745372b242
 
diff --git a/package/firmware/layerscape/ls-mc/Makefile b/package/firmware/layerscape/ls-mc/Makefile
index 0ae7299a411a87..49cdfdc0625790 100644
--- a/package/firmware/layerscape/ls-mc/Makefile
+++ b/package/firmware/layerscape/ls-mc/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ls-mc
 PKG_VERSION:=21.08
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=3
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/NXP/qoriq-mc-binary.git
diff --git a/package/firmware/layerscape/ls-rcw/Makefile b/package/firmware/layerscape/ls-rcw/Makefile
index d16b69be2d0a90..1569f1042e7d5c 100644
--- a/package/firmware/layerscape/ls-rcw/Makefile
+++ b/package/firmware/layerscape/ls-rcw/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ls-rcw
-PKG_VERSION:=21.08
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_VERSION:=lf-6.1.1-1.0.0
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=https://source.codeaurora.org/external/qoriq/qoriq-components/rcw
-PKG_SOURCE_VERSION:=LSDK-21.08
-PKG_MIRROR_HASH:=5b6ae3937d8c64f24c2d09d21e892e60b9f60de3573ca64ef19fa71072e6e346
+PKG_SOURCE_URL:=https://github.com/nxp-qoriq/rcw
+PKG_SOURCE_VERSION:=lf-6.1.1-1.0.0
+PKG_MIRROR_HASH:=3127285549a0a7dd3cded20c2fbfb67b06943faa8dab529f61936dc1bea177db
 
 PKG_FLAGS:=nonshared
 
@@ -31,6 +31,8 @@ BOARDS := \
   ls1012a-rdb \
   ls1012a-frdm \
   ls1012a-frwy-sdboot \
+  ls1028a-rdb \
+  ls1028a-rdb-sdboot \
   ls1043a-rdb \
   ls1043a-rdb-sdboot \
   ls1046a-frwy \
@@ -47,6 +49,8 @@ BOARDS := \
 RCW_ls1012a-rdb         :=ls1012ardb/R_SPNH_3508/rcw_1000_default.bin
 RCW_ls1012a-frdm        :=ls1012afrdm/N_SSNP_3305/rcw_800.bin
 RCW_ls1012a-frwy-sdboot :=ls1012afrwy/N_SSNP_3305/rcw_1000_default.bin
+RCW_ls1028a-rdb         :=ls1028ardb/R_SQPP_0x85bb/rcw_1300.bin
+RCW_ls1028a-rdb-sdboot  :=ls1028ardb/R_SQPP_0x85bb/rcw_1500_sdboot.bin
 RCW_ls1043a-rdb         :=ls1043ardb/RR_FQPP_1455/rcw_1600.bin
 RCW_ls1043a-rdb-sdboot  :=ls1043ardb/RR_FQPP_1455/rcw_1600_sdboot.bin
 RCW_ls1046a-frwy        :=ls1046afrwy/NN_NNQNNPNP_3040_0506/rcw_1600_qspiboot.bin
diff --git a/package/firmware/layerscape/ppfe-firmware/Makefile b/package/firmware/layerscape/ppfe-firmware/Makefile
index 80aa15d67ae91f..86f6194125af23 100644
--- a/package/firmware/layerscape/ppfe-firmware/Makefile
+++ b/package/firmware/layerscape/ppfe-firmware/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ppfe
-PKG_VERSION:=21.08
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_VERSION:=lf-6.1.1-1.0.0
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=https://github.com/NXP/qoriq-engine-pfe-bin.git
-PKG_SOURCE_VERSION:=LSDK-21.08
-PKG_MIRROR_HASH:=f2591b12bc02dbfcf113dcb79cce2fc703d8492b7309ad75b3c4915b76966c64
+PKG_SOURCE_URL:=https://github.com/nxp-qoriq/qoriq-engine-pfe-bin
+PKG_SOURCE_VERSION:=lf-6.1.1-1.0.0
+PKG_MIRROR_HASH:=eb1e3efe08980e70594060c84c1620a1dde53e00e96bae63d15dceb236c0bfa8
 
 PKG_FLAGS:=nonshared
 
diff --git a/package/firmware/linux-firmware/Makefile b/package/firmware/linux-firmware/Makefile
index c64dec83f012b1..bed11fdbe1f559 100644
--- a/package/firmware/linux-firmware/Makefile
+++ b/package/firmware/linux-firmware/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=linux-firmware
-PKG_VERSION:=20220708
+PKG_VERSION:=20230515
 PKG_RELEASE:=1
 
 PKG_SOURCE_URL:=@KERNEL/linux/kernel/firmware
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
-PKG_HASH:=0abec827a035c82bdcabdf82aa37ded247bc682ef05861bd409ea6f477bab81d
+PKG_HASH:=8b1acfa16f1ee94732a6acb50d9d6c835cf53af11068bd89ed207bbe04a1e951
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 
@@ -21,6 +21,9 @@ SCAN_DEPS = *.mk
 
 include $(INCLUDE_DIR)/package.mk
 
+RSTRIP:=:
+STRIP:=:
+
 define Package/firmware-default
   SECTION:=firmware
   CATEGORY:=Firmware
diff --git a/package/firmware/linux-firmware/broadcom.mk b/package/firmware/linux-firmware/broadcom.mk
index 26f65346323448..48d986e2183b3d 100644
--- a/package/firmware/linux-firmware/broadcom.mk
+++ b/package/firmware/linux-firmware/broadcom.mk
@@ -1,3 +1,16 @@
+Package/brcmfmac-firmware-4339-sdio = $(call Package/firmware-default,Broadcom 4339 FullMAC SDIO firmware)
+define Package/brcmfmac-firmware-4339-sdio/install
+	$(INSTALL_DIR) $(1)/lib/firmware/cypress
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/cypress/cyfmac4339-sdio.bin \
+		$(1)/lib/firmware/cypress/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../cypress/cyfmac4339-sdio.bin \
+		$(1)/lib/firmware/brcm/brcmfmac4339-sdio.bin
+endef
+$(eval $(call BuildPackage,brcmfmac-firmware-4339-sdio))
+
 Package/brcmfmac-firmware-43602a1-pcie = $(call Package/firmware-default,Broadcom 43602a1 FullMAC PCIe firmware)
 define Package/brcmfmac-firmware-43602a1-pcie/install
 	$(INSTALL_DIR) $(1)/lib/firmware/brcm
@@ -34,23 +47,53 @@ define Package/brcmfmac-firmware-4329-sdio/install
 endef
 $(eval $(call BuildPackage,brcmfmac-firmware-4329-sdio))
 
-Package/brcmfmac-firmware-43430-sdio-rpi-3b = $(call Package/firmware-default,Broadcom BCM43430 NVRAM for Raspberry Pi 3B)
-define Package/brcmfmac-firmware-43430-sdio-rpi-3b/install
+Package/brcmfmac-nvram-43430-sdio = $(call Package/firmware-default,Broadcom BCM43430 SDIO NVRAM)
+define Package/brcmfmac-nvram-43430-sdio/install
 	$(INSTALL_DIR) $(1)/lib/firmware/brcm
 	$(INSTALL_DATA) \
-		$(PKG_BUILD_DIR)/brcm/brcmfmac43430-sdio.raspberrypi,3-model-b.txt \
-		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.raspberrypi,3-model-b.txt
-endef
-$(eval $(call BuildPackage,brcmfmac-firmware-43430-sdio-rpi-3b))
-
-Package/brcmfmac-firmware-43430-sdio-rpi-zero-w = $(call Package/firmware-default,Broadcom BCM43430 NVRAM for Raspberry Pi Zero W)
-define Package/brcmfmac-firmware-43430-sdio-rpi-zero-w/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+		$(PKG_BUILD_DIR)/brcm/brcmfmac43430-sdio.AP6212.txt \
+		$(1)/lib/firmware/brcm/
+	$(LN) \
+		brcmfmac43430-sdio.AP6212.txt \
+		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.sinovoip,bpi-m2-plus.txt
+	$(LN) \
+		brcmfmac43430-sdio.AP6212.txt \
+		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.sinovoip,bpi-m2-zero.txt
+	$(LN) \
+		brcmfmac43430-sdio.AP6212.txt \
+		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.sinovoip,bpi-m2-ultra.txt
+	$(LN) \
+		brcmfmac43430-sdio.AP6212.txt \
+		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.sinovoip,bpi-m3.txt
+	$(LN) \
+		brcmfmac43430-sdio.AP6212.txt \
+		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.friendlyarm,nanopi-r1.txt
+	$(LN) \
+		brcmfmac43430-sdio.AP6212.txt \
+		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.starfive,visionfive-v1.txt
+	$(LN) \
+		brcmfmac43430-sdio.AP6212.txt \
+		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.beagle,beaglev-starlight-jh7100-a1.txt
+	$(LN) \
+		brcmfmac43430-sdio.AP6212.txt \
+		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.beagle,beaglev-starlight-jh7100-r0.txt
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/brcm/brcmfmac43430-sdio.Hampoo-D2D3_Vi8A1.txt \
+		$(1)/lib/firmware/brcm/
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/brcm/brcmfmac43430-sdio.MUR1DX.txt \
+		$(1)/lib/firmware/brcm/
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/brcm/brcmfmac43430-sdio.raspberrypi,3-model-b.txt \
+		$(1)/lib/firmware/brcm/
+	$(LN) \
+		brcmfmac43430-sdio.raspberrypi,3-model-b.txt \
 		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.raspberrypi,model-zero-w.txt
+	$(LN) \
+		brcmfmac43430-sdio.raspberrypi,3-model-b.txt \
+		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.raspberrypi,model-zero-2-w.txt
 endef
-$(eval $(call BuildPackage,brcmfmac-firmware-43430-sdio-rpi-zero-w))
+$(eval $(call BuildPackage,brcmfmac-nvram-43430-sdio))
 
 Package/brcmfmac-firmware-43430a0-sdio = $(call Package/firmware-default,Broadcom BCM43430a0 FullMac SDIO firmware)
 define Package/brcmfmac-firmware-43430a0-sdio/install
@@ -61,23 +104,50 @@ define Package/brcmfmac-firmware-43430a0-sdio/install
 endef
 $(eval $(call BuildPackage,brcmfmac-firmware-43430a0-sdio))
 
-Package/brcmfmac-firmware-43455-sdio-rpi-3b-plus = $(call Package/firmware-default,Broadcom BCM43455 NVRAM for Raspberry Pi 3B+)
-define Package/brcmfmac-firmware-43455-sdio-rpi-3b-plus/install
+Package/brcmfmac-nvram-43455-sdio = $(call Package/firmware-default,Broadcom BCM43455 SDIO NVRAM)
+define Package/brcmfmac-nvram-43455-sdio/install
 	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/brcm/brcmfmac43455-sdio.acepc-t8.txt \
+		$(1)/lib/firmware/brcm/
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/brcm/brcmfmac43455-sdio.raspberrypi,3-model-b-plus.txt \
-		$(1)/lib/firmware/brcm/brcmfmac43455-sdio.raspberrypi,3-model-b-plus.txt
-endef
-$(eval $(call BuildPackage,brcmfmac-firmware-43455-sdio-rpi-3b-plus))
-
-Package/brcmfmac-firmware-43455-sdio-rpi-4b = $(call Package/firmware-default,Broadcom BCM43455 NVRAM for Raspberry Pi 4B)
-define Package/brcmfmac-firmware-43455-sdio-rpi-4b/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+		$(1)/lib/firmware/brcm/
+	$(LN) \
+		brcmfmac43455-sdio.raspberrypi,3-model-b-plus.txt \
+		$(1)/lib/firmware/brcm/brcmfmac43455-sdio.raspberrypi,3-model-a-plus.txt
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/brcm/brcmfmac43455-sdio.raspberrypi,4-model-b.txt \
-		$(1)/lib/firmware/brcm/brcmfmac43455-sdio.raspberrypi,4-model-b.txt
+		$(1)/lib/firmware/brcm/
+	$(LN) \
+		brcmfmac43455-sdio.raspberrypi,4-model-b.txt \
+		$(1)/lib/firmware/brcm/brcmfmac43455-sdio.raspberrypi,4-compute-module.txt
+	$(LN) \
+		brcmfmac43455-sdio.raspberrypi,4-model-b.txt \
+		$(1)/lib/firmware/brcm/brcmfmac43455-sdio.Raspberry\ Pi\ Foundation-Raspberry\ Pi\ 4\ Model\ B.txt
+	$(LN) \
+		brcmfmac43455-sdio.raspberrypi,4-model-b.txt \
+		$(1)/lib/firmware/brcm/brcmfmac43455-sdio.Raspberry\ Pi\ Foundation-Raspberry\ Pi\ Compute\ Module\ 4.txt
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/brcm/brcmfmac43455-sdio.MINIX-NEO\ Z83-4.txt \
+		$(1)/lib/firmware/brcm/
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/brcm/brcmfmac43455-sdio.AW-CM256SM.txt \
+		$(1)/lib/firmware/brcm/
+	$(LN) \
+		brcmfmac43455-sdio.AW-CM256SM.txt \
+		$(1)/lib/firmware/brcm/brcmfmac43455-sdio.beagle,am5729-beagleboneai.txt
+	$(LN) \
+		brcmfmac43455-sdio.AW-CM256SM.txt \
+		$(1)/lib/firmware/brcm/brcmfmac43455-sdio.pine64,pinebook-pro.txt
+	$(LN) \
+		brcmfmac43455-sdio.AW-CM256SM.txt \
+		$(1)/lib/firmware/brcm/brcmfmac43455-sdio.pine64,pinephone-pro.txt
+	$(LN) \
+		brcmfmac43455-sdio.AW-CM256SM.txt \
+		$(1)/lib/firmware/brcm/brcmfmac43455-sdio.pine64,quartz64-b.txt
 endef
-$(eval $(call BuildPackage,brcmfmac-firmware-43455-sdio-rpi-4b))
+$(eval $(call BuildPackage,brcmfmac-nvram-43455-sdio))
 
 Package/brcmfmac-firmware-usb = $(call Package/firmware-default,Broadcom BCM43xx fullmac USB firmware)
 define Package/brcmfmac-firmware-usb/install
diff --git a/package/firmware/linux-firmware/mediatek.mk b/package/firmware/linux-firmware/mediatek.mk
index 9c8f68b8895e55..a0eccb8f4d5811 100644
--- a/package/firmware/linux-firmware/mediatek.mk
+++ b/package/firmware/linux-firmware/mediatek.mk
@@ -1,9 +1,9 @@
 Package/mt7601u-firmware = $(call Package/firmware-default,MediaTek MT7601U firmware)
 define Package/mt7601u-firmware/install
-	$(INSTALL_DIR) $(1)/lib/firmware
+	$(INSTALL_DIR) $(1)/lib/firmware/mediatek
 	$(INSTALL_DATA) \
-		$(PKG_BUILD_DIR)/mt7601u.bin \
-		$(1)/lib/firmware
+		$(PKG_BUILD_DIR)/mediatek/mt7601u.bin \
+		$(1)/lib/firmware/mediatek
 endef
 $(eval $(call BuildPackage,mt7601u-firmware))
 
@@ -68,3 +68,22 @@ define Package/mt7922bt-firmware/install
 		$(1)/lib/firmware/mediatek
 endef
 $(eval $(call BuildPackage,mt7922bt-firmware))
+
+Package/mt7981-wo-firmware = $(call Package/firmware-default,MT7981 offload firmware)
+define Package/mt7981-wo-firmware/install
+	$(INSTALL_DIR) $(1)/lib/firmware/mediatek
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/mediatek/mt7981_wo.bin \
+		$(1)/lib/firmware/mediatek
+endef
+$(eval $(call BuildPackage,mt7981-wo-firmware))
+
+Package/mt7986-wo-firmware = $(call Package/firmware-default,MT7986 offload firmware)
+define Package/mt7986-wo-firmware/install
+	$(INSTALL_DIR) $(1)/lib/firmware/mediatek
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/mediatek/mt7986_wo_0.bin \
+		$(PKG_BUILD_DIR)/mediatek/mt7986_wo_1.bin \
+		$(1)/lib/firmware/mediatek
+endef
+$(eval $(call BuildPackage,mt7986-wo-firmware))
diff --git a/package/firmware/linux-firmware/qca_ath11k.mk b/package/firmware/linux-firmware/qca_ath11k.mk
new file mode 100644
index 00000000000000..b8f6ab8605d9a0
--- /dev/null
+++ b/package/firmware/linux-firmware/qca_ath11k.mk
@@ -0,0 +1,24 @@
+Package/ath11k-firmware-qca6390 = $(call Package/firmware-default,QCA6390 ath11k firmware)
+define Package/ath11k-firmware-qca6390/install
+	$(INSTALL_DIR) $(1)/lib/firmware/ath11k/QCA6390/hw2.0
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath11k/QCA6390/hw2.0/* $(1)/lib/firmware/ath11k/QCA6390/hw2.0/
+endef
+$(eval $(call BuildPackage,ath11k-firmware-qca6390))
+
+Package/ath11k-firmware-wcn6750 = $(call Package/firmware-default,WCN6750 ath11k firmware)
+define Package/ath11k-firmware-wcn6750/install
+	$(INSTALL_DIR) $(1)/lib/firmware/ath11k/WCN6750/hw1.0
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath11k/WCN6750/hw1.0/* $(1)/lib/firmware/ath11k/WCN6750/hw1.0/
+endef
+$(eval $(call BuildPackage,ath11k-firmware-wcn6750))
+
+Package/ath11k-firmware-wcn6855 = $(call Package/firmware-default,WCN6855 ath11k firmware)
+define Package/ath11k-firmware-wcn6855/install
+	$(INSTALL_DIR) $(1)/lib/firmware/ath11k/WCN6855/hw2.0
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath11k/WCN6855/hw2.0/* $(1)/lib/firmware/ath11k/WCN6855/hw2.0/
+	$(LN) ./hw2.0 $(1)/lib/firmware/ath11k/WCN6855/hw2.1
+endef
+$(eval $(call BuildPackage,ath11k-firmware-wcn6855))
diff --git a/package/firmware/linux-firmware/realtek.mk b/package/firmware/linux-firmware/realtek.mk
index e06c3a63694c9a..6d9238b8a435bd 100644
--- a/package/firmware/linux-firmware/realtek.mk
+++ b/package/firmware/linux-firmware/realtek.mk
@@ -86,6 +86,29 @@ define Package/rtl8723bu-firmware/install
 endef
 $(eval $(call BuildPackage,rtl8723bu-firmware))
 
+Package/rtl8761a-firmware = $(call Package/firmware-default,RealTek RTL8761A firmware)
+define Package/rtl8761a-firmware/install
+	$(INSTALL_DIR) $(1)/lib/firmware/rtl_bt
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtl_bt/rtl8761a_fw.bin $(1)/lib/firmware/rtl_bt
+endef
+$(eval $(call BuildPackage,rtl8761a-firmware))
+
+Package/rtl8761b-firmware = $(call Package/firmware-default,RealTek RTL8761B firmware)
+define Package/rtl8761b-firmware/install
+	$(INSTALL_DIR) $(1)/lib/firmware/rtl_bt
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtl_bt/rtl8761b_config.bin $(1)/lib/firmware/rtl_bt
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtl_bt/rtl8761b_fw.bin $(1)/lib/firmware/rtl_bt
+endef
+$(eval $(call BuildPackage,rtl8761b-firmware))
+
+Package/rtl8761bu-firmware = $(call Package/firmware-default,RealTek RTL8761BU firmware)
+define Package/rtl8761bu-firmware/install
+	$(INSTALL_DIR) $(1)/lib/firmware/rtl_bt
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtl_bt/rtl8761bu_config.bin $(1)/lib/firmware/rtl_bt
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtl_bt/rtl8761bu_fw.bin $(1)/lib/firmware/rtl_bt
+endef
+$(eval $(call BuildPackage,rtl8761bu-firmware))
+
 Package/rtl8821ae-firmware = $(call Package/firmware-default,RealTek RTL8821AE firmware)
 define Package/rtl8821ae-firmware/install
 	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
diff --git a/package/firmware/prism54-firmware/Makefile b/package/firmware/prism54-firmware/Makefile
index b74cb682fc50be..9a0bbba3cd3ab0 100644
--- a/package/firmware/prism54-firmware/Makefile
+++ b/package/firmware/prism54-firmware/Makefile
@@ -8,6 +8,8 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=prism54-firmware
 PKG_RELEASE:=1
 
+DL_SUBDIR:=$(PKG_NAME)-$(PKG_RELEASE)
+
 # P54 SoftMAC firmware (jbnore.free.fr seems to be rather slow, so we use daemonizer.de)
 PRG_URL:=https://daemonizer.de/prism54/prism54-fw/
 
diff --git a/package/firmware/wireless-regdb/Makefile b/package/firmware/wireless-regdb/Makefile
index 006974b3d15f5f..9ce2a397ff599e 100644
--- a/package/firmware/wireless-regdb/Makefile
+++ b/package/firmware/wireless-regdb/Makefile
@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wireless-regdb
-PKG_VERSION:=2022.06.06
+PKG_VERSION:=2023.05.03
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/software/network/wireless-regdb/
-PKG_HASH:=ac00f97efecce5046ed069d1d93f3365fdf994c7c7854a8fc50831e959537230
+PKG_HASH:=f254d08ab3765aeae2b856222e11a95d44aef519a6663877c71ef68fae4c8c12
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 
diff --git a/package/kernel/ath10k-ct/Makefile b/package/kernel/ath10k-ct/Makefile
index acdaa5a6fc9146..2bb7c7e2f72906 100644
--- a/package/kernel/ath10k-ct/Makefile
+++ b/package/kernel/ath10k-ct/Makefile
@@ -1,21 +1,21 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ath10k-ct
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=1
 
 PKG_LICENSE:=GPLv2
 PKG_LICENSE_FILES:=
 
 PKG_SOURCE_URL:=https://github.com/greearb/ath10k-ct.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2022-05-13
-PKG_SOURCE_VERSION:=f808496fcc6b1f68942914117aebf8b3f8d52bb3
-PKG_MIRROR_HASH:=39527b3408696594eda5579521a9fb798417be4dda73fa08e8b3a8c7b0d3f3d9
+PKG_SOURCE_DATE:=2023-05-26
+PKG_SOURCE_VERSION:=af342b6171a457e067932615deb203b68b1d076a
+PKG_MIRROR_HASH:=90e145fbe6057da65b637e3a194317c1e4f529b078c7e4a245a286c37e3d1b76
 
-# Build the 5.15 ath10k-ct driver version.
+# Build the 6.2 ath10k-ct driver version.
 # Probably this should match as closely as
 # possible to whatever mac80211 backports version is being used.
-CT_KVER="-5.15"
+CT_KVER="-6.2"
 
 PKG_MAINTAINER:=Ben Greear <greearb@candelatech.com>
 PKG_BUILD_PARALLEL:=1
@@ -29,7 +29,7 @@ include $(INCLUDE_DIR)/package.mk
 define KernelPackage/ath10k-ct
   SUBMENU:=Wireless Drivers
   TITLE:=ath10k-ct driver optimized for CT ath10k firmware
-  DEPENDS:=+kmod-mac80211 +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT @PCI_SUPPORT +kmod-hwmon-core
+  DEPENDS:=+kmod-mac80211 +kmod-ath +@DRIVER_11AC_SUPPORT @PCI_SUPPORT +kmod-hwmon-core
   FILES:=\
 	$(PKG_BUILD_DIR)/ath10k$(CT_KVER)/ath10k_pci.ko \
 	$(PKG_BUILD_DIR)/ath10k$(CT_KVER)/ath10k_core.ko
@@ -111,8 +111,7 @@ ifneq ($(findstring c,$(OPENWRT_VERBOSE)),)
 endif
 
 define Build/Compile
-	+$(MAKE) $(CT_MAKEDEFS) $(PKG_JOBS) -C "$(LINUX_DIR)" \
-		$(KERNEL_MAKE_FLAGS) \
+	+$(KERNEL_MAKE) $(CT_MAKEDEFS) $(PKG_JOBS) \
 		M="$(PKG_BUILD_DIR)/ath10k$(CT_KVER)" \
 		NOSTDINC_FLAGS="$(NOSTDINC_FLAGS)" \
 		modules
diff --git a/package/kernel/ath10k-ct/patches/130-ath10k-read-qcom-coexist-support-as-a-u32.patch b/package/kernel/ath10k-ct/patches/130-ath10k-read-qcom-coexist-support-as-a-u32.patch
new file mode 100644
index 00000000000000..77e2724991ea87
--- /dev/null
+++ b/package/kernel/ath10k-ct/patches/130-ath10k-read-qcom-coexist-support-as-a-u32.patch
@@ -0,0 +1,60 @@
+From 630df9786fdaeb78c21f1e28c9b70ac83a1b482c Mon Sep 17 00:00:00 2001
+From: Vincent Tremblay <vincent@vtremblay.dev>
+Date: Sat, 31 Dec 2022 09:24:00 -0500
+Subject: [PATCH] ath10k: read qcom,coexist-support as a u32
+
+Read qcom,coexist-support as a u32 instead of a u8
+
+When we set the property to <1> in the DT (as specified in the doc),
+"of_property_read_u8" read 0 instead of 1. This is because of the data format. 
+
+By default <1> is written with 32 bits. 
+The problem is that the driver is trying to read a u8.
+
+The difference can be visualized using hexdump in a running device:
+Default 32 bits output:
+=======================
+0000000 0000 0100
+0000004
+
+8 bits output:
+==============
+0000000 0001
+0000001
+
+By changing "of_property_read_u8" by "of_property_read_u32", the driver
+is aligned with the documentation and is able to read the value without
+modifying the DT.
+
+The other solution would be to force the value in the DT to be saved as
+an 8 bits value (qcom,coexist-support = /bits/ 8 <1>), 
+which is against the doc and less intuitive.
+
+Validation:
+===========
+The patch was tested on a real device and we can see in the debug logs
+that the feature is properly initialized:
+
+[  109.102097] ath10k_ahb a000000.wifi: boot coex_support 1 coex_gpio_pin 52
+
+Signed-off-by: Vincent Tremblay <vincent@vtremblay.dev>
+
+--- a/ath10k-6.2/core.c
++++ b/ath10k-6.2/core.c
+@@ -2869,14 +2869,14 @@ done:
+ static void ath10k_core_fetch_btcoex_dt(struct ath10k *ar)
+ {
+ 	struct device_node *node;
+-	u8 coex_support = 0;
++	u32 coex_support = 0;
+ 	int ret;
+ 
+ 	node = ar->dev->of_node;
+ 	if (!node)
+ 		goto out;
+ 
+-	ret = of_property_read_u8(node, "qcom,coexist-support", &coex_support);
++	ret = of_property_read_u32(node, "qcom,coexist-support", &coex_support);
+ 	if (ret) {
+ 		ar->coex_support = true;
+ 		goto out;
diff --git a/package/kernel/ath10k-ct/patches/201-ath10k-add-LED-and-GPIO-controlling-support-for-various-chipsets.patch b/package/kernel/ath10k-ct/patches/201-ath10k-add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
index 2cc7c1e678babb..844c089e888f56 100644
--- a/package/kernel/ath10k-ct/patches/201-ath10k-add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
+++ b/package/kernel/ath10k-ct/patches/201-ath10k-add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
@@ -66,25 +66,25 @@ v13:
 
 * cleanup includes
 
- ath10k-5.15/Kconfig   |  10 +++
- ath10k-5.15/Makefile  |   1 +
- ath10k-5.15/core.c    |  22 +++++++
- ath10k-5.15/core.h    |   9 ++-
- ath10k-5.15/hw.h      |   1 +
- ath10k-5.15/leds.c    | 103 ++++++++++++++++++++++++++++++
- ath10k-5.15/leds.h    |  45 +++++++++++++
- ath10k-5.15/mac.c     |   1 +
- ath10k-5.15/wmi-ops.h |  32 ++++++++++
- ath10k-5.15/wmi-tlv.c |   2 +
- ath10k-5.15/wmi.c     |  54 ++++++++++++++++
- ath10k-5.15/wmi.h     |  35 ++++++++++
+ ath10k-6.2/Kconfig   |  10 +++
+ ath10k-6.2/Makefile  |   1 +
+ ath10k-6.2/core.c    |  22 +++++++
+ ath10k-6.2/core.h    |   9 ++-
+ ath10k-6.2/hw.h      |   1 +
+ ath10k-6.2/leds.c    | 103 ++++++++++++++++++++++++++++++
+ ath10k-6.2/leds.h    |  45 +++++++++++++
+ ath10k-6.2/mac.c     |   1 +
+ ath10k-6.2/wmi-ops.h |  32 ++++++++++
+ ath10k-6.2/wmi-tlv.c |   2 +
+ ath10k-6.2/wmi.c     |  54 ++++++++++++++++
+ ath10k-6.2/wmi.h     |  35 ++++++++++
  12 files changed, 314 insertions(+), 1 deletion(-)
- create mode 100644 ath10k-5.15/leds.c
- create mode 100644 ath10k-5.15/leds.h
+ create mode 100644 ath10k-6.2/leds.c
+ create mode 100644 ath10k-6.2/leds.h
 
---- a/ath10k-5.15/Kconfig
-+++ b/ath10k-5.15/Kconfig
-@@ -66,6 +66,16 @@ config ATH10K_DEBUGFS
+--- a/ath10k-6.2/Kconfig
++++ b/ath10k-6.2/Kconfig
+@@ -67,6 +67,16 @@ config ATH10K_DEBUGFS
  
  	  If unsure, say Y to make it easier to debug problems.
  
@@ -101,8 +101,8 @@ v13:
  config ATH10K_SPECTRAL
  	bool "Atheros ath10k spectral scan support"
  	depends on ATH10K_DEBUGFS
---- a/ath10k-5.15/Makefile
-+++ b/ath10k-5.15/Makefile
+--- a/ath10k-6.2/Makefile
++++ b/ath10k-6.2/Makefile
 @@ -20,6 +20,7 @@ ath10k_core-$(CONFIG_ATH10K_SPECTRAL) +=
  ath10k_core-$(CONFIG_NL80211_TESTMODE) += testmode.o
  ath10k_core-$(CONFIG_ATH10K_TRACING) += trace.o
@@ -111,8 +111,8 @@ v13:
  ath10k_core-$(CONFIG_MAC80211_DEBUGFS) += debugfs_sta.o
  ath10k_core-$(CONFIG_PM) += wow.o
  ath10k_core-$(CONFIG_ATH10K_CE) += ce.o
---- a/ath10k-5.15/core.c
-+++ b/ath10k-5.15/core.c
+--- a/ath10k-6.2/core.c
++++ b/ath10k-6.2/core.c
 @@ -28,6 +28,7 @@
  #include "testmode.h"
  #include "wmi-ops.h"
@@ -121,7 +121,7 @@ v13:
  
  /* Disable ath10k-ct DBGLOG output by default */
  unsigned int ath10k_debug_mask = ATH10K_DBG_NO_DBGLOG;
-@@ -70,6 +71,7 @@ static const struct ath10k_hw_params ath
+@@ -78,6 +79,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA988X_2_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca988x hw2.0",
@@ -129,7 +129,7 @@ v13:
  		.patch_load_addr = QCA988X_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_ALL,
-@@ -143,6 +145,7 @@ static const struct ath10k_hw_params ath
+@@ -159,6 +161,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA9887_1_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca9887 hw1.0",
@@ -137,7 +137,7 @@ v13:
  		.patch_load_addr = QCA9887_HW_1_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_ALL,
-@@ -360,6 +363,7 @@ static const struct ath10k_hw_params ath
+@@ -400,6 +403,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA99X0_2_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca99x0 hw2.0",
@@ -145,7 +145,7 @@ v13:
  		.patch_load_addr = QCA99X0_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.otp_exe_param = 0x00000700,
-@@ -402,6 +406,7 @@ static const struct ath10k_hw_params ath
+@@ -446,6 +450,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA9984_1_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca9984/qca9994 hw1.0",
@@ -153,7 +153,7 @@ v13:
  		.patch_load_addr = QCA9984_HW_1_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
-@@ -451,6 +456,7 @@ static const struct ath10k_hw_params ath
+@@ -499,6 +504,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA9888_2_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca9888 hw2.0",
@@ -161,7 +161,7 @@ v13:
  		.patch_load_addr = QCA9888_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
-@@ -3977,6 +3983,10 @@ int ath10k_core_start(struct ath10k *ar,
+@@ -4080,6 +4086,10 @@ int ath10k_core_start(struct ath10k *ar,
  			ath10k_wmi_check_apply_board_power_ctl_table(ar);
  	}
  
@@ -172,7 +172,7 @@ v13:
  	return 0;
  
  err_hif_stop:
-@@ -4238,9 +4248,18 @@ static void ath10k_core_register_work(st
+@@ -4341,9 +4351,18 @@ static void ath10k_core_register_work(st
  		goto err_spectral_destroy;
  	}
  
@@ -191,7 +191,7 @@ v13:
  err_spectral_destroy:
  	ath10k_spectral_destroy(ar);
  err_debug_destroy:
-@@ -4300,6 +4319,8 @@ void ath10k_core_unregister(struct ath10
+@@ -4403,6 +4422,8 @@ void ath10k_core_unregister(struct ath10
  	if (!test_bit(ATH10K_FLAG_CORE_REGISTERED, &ar->dev_flags))
  		return;
  
@@ -200,8 +200,8 @@ v13:
  	ath10k_thermal_unregister(ar);
  	/* Stop spectral before unregistering from mac80211 to remove the
  	 * relayfs debugfs file cleanly. Otherwise the parent debugfs tree
---- a/ath10k-5.15/core.h
-+++ b/ath10k-5.15/core.h
+--- a/ath10k-6.2/core.h
++++ b/ath10k-6.2/core.h
 @@ -14,6 +14,7 @@
  #include <linux/pci.h>
  #include <linux/uuid.h>
@@ -210,7 +210,7 @@ v13:
  
  #include "htt.h"
  #include "htc.h"
-@@ -1577,6 +1578,13 @@ struct ath10k {
+@@ -1586,6 +1587,13 @@ struct ath10k {
  	} testmode;
  
  	struct {
@@ -224,9 +224,9 @@ v13:
  		/* protected by data_lock */
  		u32 rx_crc_err_drop;
  		u32 fw_crash_counter;
---- a/ath10k-5.15/hw.h
-+++ b/ath10k-5.15/hw.h
-@@ -521,6 +521,7 @@ struct ath10k_hw_params {
+--- a/ath10k-6.2/hw.h
++++ b/ath10k-6.2/hw.h
+@@ -523,6 +523,7 @@ struct ath10k_hw_params {
  	const char *name;
  	u32 patch_load_addr;
  	int uart_pin;
@@ -235,7 +235,7 @@ v13:
  
  	/* Type of hw cycle counter wraparound logic, for more info
 --- /dev/null
-+++ b/ath10k-5.15/leds.c
++++ b/ath10k-6.2/leds.c
 @@ -0,0 +1,103 @@
 +/*
 + * Copyright (c) 2005-2011 Atheros Communications Inc.
@@ -341,7 +341,7 @@ v13:
 +}
 +
 --- /dev/null
-+++ b/ath10k-5.15/leds.h
++++ b/ath10k-6.2/leds.h
 @@ -0,0 +1,41 @@
 +/*
 + * Copyright (c) 2018, The Linux Foundation. All rights reserved.
@@ -384,8 +384,8 @@ v13:
 +
 +#endif
 +#endif /* _LEDS_H_ */
---- a/ath10k-5.15/mac.c
-+++ b/ath10k-5.15/mac.c
+--- a/ath10k-6.2/mac.c
++++ b/ath10k-6.2/mac.c
 @@ -25,6 +25,7 @@
  #include "wmi-tlv.h"
  #include "wmi-ops.h"
@@ -394,8 +394,8 @@ v13:
  
  /*********/
  /* Rates */
---- a/ath10k-5.15/wmi-ops.h
-+++ b/ath10k-5.15/wmi-ops.h
+--- a/ath10k-6.2/wmi-ops.h
++++ b/ath10k-6.2/wmi-ops.h
 @@ -228,7 +228,10 @@ struct wmi_ops {
  			 const struct wmi_bb_timing_cfg_arg *arg);
  	struct sk_buff *(*gen_per_peer_per_tid_cfg)(struct ath10k *ar,
@@ -443,9 +443,9 @@ v13:
  static inline int
  ath10k_wmi_dbglog_cfg(struct ath10k *ar, u64 module_enable, u32 log_level)
  {
---- a/ath10k-5.15/wmi-tlv.c
-+++ b/ath10k-5.15/wmi-tlv.c
-@@ -4594,6 +4594,8 @@ static const struct wmi_ops wmi_tlv_ops
+--- a/ath10k-6.2/wmi-tlv.c
++++ b/ath10k-6.2/wmi-tlv.c
+@@ -4601,6 +4601,8 @@ static const struct wmi_ops wmi_tlv_ops
  	.gen_echo = ath10k_wmi_tlv_op_gen_echo,
  	.gen_vdev_spectral_conf = ath10k_wmi_tlv_op_gen_vdev_spectral_conf,
  	.gen_vdev_spectral_enable = ath10k_wmi_tlv_op_gen_vdev_spectral_enable,
@@ -454,9 +454,9 @@ v13:
  };
  
  static const struct wmi_peer_flags_map wmi_tlv_peer_flags_map = {
---- a/ath10k-5.15/wmi.c
-+++ b/ath10k-5.15/wmi.c
-@@ -8413,6 +8413,49 @@ ath10k_wmi_op_gen_peer_set_param(struct
+--- a/ath10k-6.2/wmi.c
++++ b/ath10k-6.2/wmi.c
+@@ -8438,6 +8438,49 @@ ath10k_wmi_op_gen_peer_set_param(struct
  	return skb;
  }
  
@@ -506,7 +506,7 @@ v13:
  static struct sk_buff *
  ath10k_wmi_op_gen_set_psmode(struct ath10k *ar, u32 vdev_id,
  			     enum wmi_sta_ps_mode psmode)
-@@ -10244,6 +10287,9 @@ static const struct wmi_ops wmi_ops = {
+@@ -10269,6 +10312,9 @@ static const struct wmi_ops wmi_ops = {
  	.fw_stats_fill = ath10k_wmi_main_op_fw_stats_fill,
  	.get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
  	.gen_echo = ath10k_wmi_op_gen_echo,
@@ -516,7 +516,7 @@ v13:
  	/* .gen_bcn_tmpl not implemented */
  	/* .gen_prb_tmpl not implemented */
  	/* .gen_p2p_go_bcn_ie not implemented */
-@@ -10314,6 +10360,8 @@ static const struct wmi_ops wmi_10_1_ops
+@@ -10339,6 +10385,8 @@ static const struct wmi_ops wmi_10_1_ops
  	.fw_stats_fill = ath10k_wmi_10x_op_fw_stats_fill,
  	.get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
  	.gen_echo = ath10k_wmi_op_gen_echo,
@@ -525,7 +525,7 @@ v13:
  	/* .gen_bcn_tmpl not implemented */
  	/* .gen_prb_tmpl not implemented */
  	/* .gen_p2p_go_bcn_ie not implemented */
-@@ -10393,6 +10441,8 @@ static const struct wmi_ops wmi_10_2_ops
+@@ -10418,6 +10466,8 @@ static const struct wmi_ops wmi_10_2_ops
  	.gen_delba_send = ath10k_wmi_op_gen_delba_send,
  	.fw_stats_fill = ath10k_wmi_10x_op_fw_stats_fill,
  	.get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
@@ -534,7 +534,7 @@ v13:
  	/* .gen_pdev_enable_adaptive_cca not implemented */
  };
  
-@@ -10464,6 +10514,8 @@ static const struct wmi_ops wmi_10_2_4_o
+@@ -10489,6 +10539,8 @@ static const struct wmi_ops wmi_10_2_4_o
  		ath10k_wmi_op_gen_pdev_enable_adaptive_cca,
  	.get_vdev_subtype = ath10k_wmi_10_2_4_op_get_vdev_subtype,
  	.gen_bb_timing = ath10k_wmi_10_2_4_op_gen_bb_timing,
@@ -543,7 +543,7 @@ v13:
  	/* .gen_bcn_tmpl not implemented */
  	/* .gen_prb_tmpl not implemented */
  	/* .gen_p2p_go_bcn_ie not implemented */
-@@ -10546,6 +10598,8 @@ static const struct wmi_ops wmi_10_4_ops
+@@ -10571,6 +10623,8 @@ static const struct wmi_ops wmi_10_4_ops
  	.gen_pdev_bss_chan_info_req = ath10k_wmi_10_2_op_gen_pdev_bss_chan_info,
  	.gen_echo = ath10k_wmi_op_gen_echo,
  	.gen_pdev_get_tpc_config = ath10k_wmi_10_2_4_op_gen_pdev_get_tpc_config,
@@ -552,8 +552,8 @@ v13:
  };
  
  int ath10k_wmi_attach(struct ath10k *ar)
---- a/ath10k-5.15/wmi.h
-+++ b/ath10k-5.15/wmi.h
+--- a/ath10k-6.2/wmi.h
++++ b/ath10k-6.2/wmi.h
 @@ -3133,6 +3133,41 @@ enum wmi_10_4_feature_mask {
  
  };
diff --git a/package/kernel/ath10k-ct/patches/202-ath10k-use-tpt-trigger-by-default.patch b/package/kernel/ath10k-ct/patches/202-ath10k-use-tpt-trigger-by-default.patch
index fb8468b9c00e3a..8ac2776f9229fa 100644
--- a/package/kernel/ath10k-ct/patches/202-ath10k-use-tpt-trigger-by-default.patch
+++ b/package/kernel/ath10k-ct/patches/202-ath10k-use-tpt-trigger-by-default.patch
@@ -9,14 +9,14 @@ traffic.
 
 Signed-off-by: Mathias Kresin <dev@kresin.me>
 ---
- ath10k-5.15/core.h | 4 ++++
- ath10k-5.15/leds.c | 4 +---
- ath10k-5.15/mac.c  | 2 +-
+ ath10k-6.2/core.h | 4 ++++
+ ath10k-6.2/leds.c | 4 +---
+ ath10k-6.2/mac.c  | 2 +-
  3 files changed, 6 insertions(+), 4 deletions(-)
 
---- a/ath10k-5.15/core.h
-+++ b/ath10k-5.15/core.h
-@@ -1692,6 +1692,10 @@ struct ath10k {
+--- a/ath10k-6.2/core.h
++++ b/ath10k-6.2/core.h
+@@ -1701,6 +1701,10 @@ struct ath10k {
  	u8 csi_data[4096];
  	u16 csi_data_len;
  
@@ -27,8 +27,8 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
  	/* must be last */
  	u8 drv_priv[] __aligned(sizeof(void *));
  };
---- a/ath10k-5.15/leds.c
-+++ b/ath10k-5.15/leds.c
+--- a/ath10k-6.2/leds.c
++++ b/ath10k-6.2/leds.c
 @@ -81,9 +81,7 @@ int ath10k_leds_register(struct ath10k *
  
  	ar->leds.cdev.name = ar->leds.label;
@@ -40,9 +40,9 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
  
  	ret = led_classdev_register(wiphy_dev(ar->hw->wiphy), &ar->leds.cdev);
  	if (ret)
---- a/ath10k-5.15/mac.c
-+++ b/ath10k-5.15/mac.c
-@@ -11544,7 +11544,7 @@ int ath10k_mac_register(struct ath10k *a
+--- a/ath10k-6.2/mac.c
++++ b/ath10k-6.2/mac.c
+@@ -11617,7 +11617,7 @@ int ath10k_mac_register(struct ath10k *a
  	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
  
  #ifdef CPTCFG_MAC80211_LEDS
diff --git a/package/kernel/ath10k-ct/patches/960-0010-ath10k-limit-htt-rx-ring-size.patch b/package/kernel/ath10k-ct/patches/960-0010-ath10k-limit-htt-rx-ring-size.patch
index d50611b9706068..1471902be3bb51 100644
--- a/package/kernel/ath10k-ct/patches/960-0010-ath10k-limit-htt-rx-ring-size.patch
+++ b/package/kernel/ath10k-ct/patches/960-0010-ath10k-limit-htt-rx-ring-size.patch
@@ -1,5 +1,5 @@
---- a/ath10k-5.15/htt.h
-+++ b/ath10k-5.15/htt.h
+--- a/ath10k-6.2/htt.h
++++ b/ath10k-6.2/htt.h
 @@ -237,7 +237,11 @@ enum htt_rx_ring_flags {
  };
  
diff --git a/package/kernel/ath10k-ct/patches/960-0011-ath10k-limit-pci-buffer-size.patch b/package/kernel/ath10k-ct/patches/960-0011-ath10k-limit-pci-buffer-size.patch
index b8c6c35326685a..145b2e7c3586db 100644
--- a/package/kernel/ath10k-ct/patches/960-0011-ath10k-limit-pci-buffer-size.patch
+++ b/package/kernel/ath10k-ct/patches/960-0011-ath10k-limit-pci-buffer-size.patch
@@ -1,5 +1,5 @@
---- a/ath10k-5.15/pci.c
-+++ b/ath10k-5.15/pci.c
+--- a/ath10k-6.2/pci.c
++++ b/ath10k-6.2/pci.c
 @@ -131,7 +131,11 @@ static const struct ce_attr pci_host_ce_
  		.flags = CE_ATTR_FLAGS,
  		.src_nentries = 0,
diff --git a/package/kernel/bpf-headers/Makefile b/package/kernel/bpf-headers/Makefile
index 6d25a7386f2e27..733f3586727082 100644
--- a/package/kernel/bpf-headers/Makefile
+++ b/package/kernel/bpf-headers/Makefile
@@ -39,7 +39,7 @@ include $(INCLUDE_DIR)/package.mk
 
 define Package/bpf-headers
   SECTION:=kernel
-  CATEGORY:=Kernel
+  CATEGORY:=Kernel modules
   TITLE:=eBPF kernel headers
   BUILDONLY:=1
   HIDDEN:=1
diff --git a/package/kernel/broadcom-wl/Makefile b/package/kernel/broadcom-wl/Makefile
index 7188c4900eae86..a1feacbe2901a4 100644
--- a/package/kernel/broadcom-wl/Makefile
+++ b/package/kernel/broadcom-wl/Makefile
@@ -24,7 +24,7 @@ endif
 
 PKG_EXTMOD_SUBDIRS:=driver driver-mini glue
 
-PKG_USE_MIPS16:=0
+PKG_BUILD_FLAGS:=no-mips16
 PKG_FLAGS:=nonshared
 
 include $(INCLUDE_DIR)/package.mk
@@ -40,7 +40,7 @@ endef
 define KernelPackage/brcm-wl/Default
   $(call Package/broadcom-wl/Default)
   SECTION:=kernel
-  DEPENDS:=@(TARGET_bcm47xx||TARGET_bcm63xx) +wireless-tools
+  DEPENDS:=@(TARGET_bcm47xx||TARGET_bcm63xx) +wireless-tools +@KERNEL_WIRELESS_EXT
   TITLE:=Kernel driver for BCM43xx chipsets
   FILES:=$(PKG_BUILD_DIR)/driver$(1)/wl.ko $(PKG_BUILD_DIR)/glue/wl_glue.ko
   AUTOLOAD:=$(call AutoProbe,wl)
@@ -99,13 +99,21 @@ define Package/nas/description
  proprietary Broadcom wl driver.
 endef
 
-MAKE_KMOD := $(MAKE) -C "$(LINUX_DIR)" \
-		$(KERNEL_MAKE_FLAGS) \
+MAKE_KMOD := $(KERNEL_MAKE) \
 		PATH="$(TARGET_PATH)" \
 		M="$(PKG_BUILD_DIR)/kmod" \
 
 define Build/Prepare
 	$(call Build/Prepare/Default)
+
+	# New kernel version changed the sysmbol exported from printk to _printk
+	# The object file provided by broadcom require modification to correctly
+	# modprobe and generate a .ko
+	$(TARGET_CROSS)objcopy $(PKG_BUILD_DIR)/driver/wl_apsta/wl_prebuilt.o \
+	  --redefine-sym printk=_printk
+	$(TARGET_CROSS)objcopy $(PKG_BUILD_DIR)/driver/wl_apsta_mini/wl_prebuilt.o \
+	  --redefine-sym printk=_printk
+
 	$(CP) $(PKG_BUILD_DIR)/driver $(PKG_BUILD_DIR)/driver-mini
 	$(CP) ./src/glue $(PKG_BUILD_DIR)/glue
 endef
diff --git a/package/kernel/broadcom-wl/patches/101-wl_id-fix-compilation-warning-if-does-not-guard.patch b/package/kernel/broadcom-wl/patches/101-wl_id-fix-compilation-warning-if-does-not-guard.patch
new file mode 100644
index 00000000000000..e5c17cb9b9b3de
--- /dev/null
+++ b/package/kernel/broadcom-wl/patches/101-wl_id-fix-compilation-warning-if-does-not-guard.patch
@@ -0,0 +1,15 @@
+--- a/driver/wl_iw.c
++++ a/driver/wl_iw.c
+@@ -381,9 +381,9 @@ wl_iw_set_freq(
+ 			while (fwrq->e++ < 6)
+ 				fwrq->m /= 10;
+ 		}
+-	/* handle 4.9GHz frequencies as Japan 4 GHz based channelization */
+-	if (fwrq->m > 4000 && fwrq->m < 5000)
+-		sf = WF_CHAN_FACTOR_4_G; /* start factor for 4 GHz */
++		/* handle 4.9GHz frequencies as Japan 4 GHz based channelization */
++		if (fwrq->m > 4000 && fwrq->m < 5000)
++			sf = WF_CHAN_FACTOR_4_G; /* start factor for 4 GHz */
+ 
+ 		chan = wf_mhz2channel(fwrq->m, sf);
+ 	}
diff --git a/package/kernel/broadcom-wl/patches/918-fix-warning-compilation-for-5_15.patch b/package/kernel/broadcom-wl/patches/918-fix-warning-compilation-for-5_15.patch
new file mode 100644
index 00000000000000..4ddb6433733cd3
--- /dev/null
+++ b/package/kernel/broadcom-wl/patches/918-fix-warning-compilation-for-5_15.patch
@@ -0,0 +1,27 @@
+--- a/driver/wl_iw.c
++++ a/driver/wl_iw.c
+@@ -100,7 +100,9 @@ dev_wlc_ioctl(
+ {
+ 	struct ifreq ifr;
+ 	wl_ioctl_t ioc;
++#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 13, 0)
+ 	mm_segment_t fs;
++#endif
+ 	int ret;
+ 
+ 	memset(&ioc, 0, sizeof(ioc));
+@@ -118,10 +120,14 @@ dev_wlc_ioctl(
+ 	dev_open(dev);
+ #endif
+ 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 13, 0)
+ 	fs = get_fs();
+ 	set_fs(KERNEL_DS);
++#endif
+ 	ret = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
++#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 13, 0)
+ 	set_fs(fs);
++#endif
+ 
+ 	return ret;
+ }
diff --git a/package/kernel/broadcom-wl/patches/919-fix-compilation-warning-for-stack-limit.patch b/package/kernel/broadcom-wl/patches/919-fix-compilation-warning-for-stack-limit.patch
new file mode 100644
index 00000000000000..3149ce34b9180b
--- /dev/null
+++ b/package/kernel/broadcom-wl/patches/919-fix-compilation-warning-for-stack-limit.patch
@@ -0,0 +1,297 @@
+--- a/driver/wl_iw.c
++++ b/driver/wl_iw.c
+@@ -495,9 +495,9 @@ wl_iw_get_range(
+ )
+ {
+ 	struct iw_range *range = (struct iw_range *) extra;
+-	int channels[MAXCHANNEL+1];
+-	wl_uint32_list_t *list = (wl_uint32_list_t *) channels;
+-	wl_rateset_t rateset;
++	int *channels;
++	wl_uint32_list_t *list;
++	wl_rateset_t *rateset;
+ 	int error, i;
+ 	uint sf, ch;
+ 
+@@ -506,6 +506,17 @@ wl_iw_get_range(
+ 	if (!extra)
+ 		return -EINVAL;
+ 
++	channels = kcalloc(MAXCHANNEL+1, sizeof(*channels), GFP_KERNEL);
++	if (!channels)
++		return -ENOMEM;
++	list = (wl_uint32_list_t *) channels;
++
++	rateset = kzalloc(sizeof(*rateset), GFP_KERNEL);
++	if (!rateset) {
++		error = -ENOMEM;
++		goto free_channels;
++	}
++
+ 	dwrq->length = sizeof(struct iw_range);
+ 	memset(range, 0, sizeof(range));
+ 
+@@ -514,8 +525,9 @@ wl_iw_get_range(
+ 
+ 	/* Set available channels/frequencies */
+ 	list->count = htod32(MAXCHANNEL);
+-	if ((error = dev_wlc_ioctl(dev, WLC_GET_VALID_CHANNELS, channels, sizeof(channels))))
+-		return error;
++	if ((error = dev_wlc_ioctl(dev, WLC_GET_VALID_CHANNELS, channels,
++				   (MAXCHANNEL+1) * sizeof(*channels))))
++		goto free_rateset;
+ 	for (i = 0; i < dtoh32(list->count) && i < IW_MAX_FREQUENCIES; i++) {
+ 		range->freq[i].i = dtoh32(list->element[i]);
+ 
+@@ -549,19 +561,19 @@ wl_iw_get_range(
+ #endif /* WIRELESS_EXT > 11 */
+ 
+ 	/* Set available bitrates */
+-	if ((error = dev_wlc_ioctl(dev, WLC_GET_CURR_RATESET, &rateset, sizeof(rateset))))
+-		return error;
+-	rateset.count = dtoh32(rateset.count);
+-	range->num_bitrates = rateset.count;
+-	for (i = 0; i < rateset.count && i < IW_MAX_BITRATES; i++)
+-		range->bitrate[i] = (rateset.rates[i] & 0x7f) * 500000; /* convert to bps */
++	if ((error = dev_wlc_ioctl(dev, WLC_GET_CURR_RATESET, rateset, sizeof(*rateset))))
++		goto free_rateset;
++	rateset->count = dtoh32(rateset->count);
++	range->num_bitrates = rateset->count;
++	for (i = 0; i < rateset->count && i < IW_MAX_BITRATES; i++)
++		range->bitrate[i] = (rateset->rates[i] & 0x7f) * 500000; /* convert to bps */
+ 
+ 	/* Set an indication of the max TCP throughput
+ 	 * in bit/s that we can expect using this interface.
+ 	 * May be use for QoS stuff... Jean II
+ 	 */
+ 	if ((error = dev_wlc_ioctl(dev, WLC_GET_PHYTYPE, &i, sizeof(i))))
+-		return error;
++		goto free_rateset;
+ 	i = dtoh32(i);
+ 	if (i == WLC_PHY_TYPE_A)
+ 		range->throughput = 24000000;	/* 24 Mbits/s */
+@@ -624,7 +636,12 @@ wl_iw_get_range(
+ #endif
+ #endif /* WIRELESS_EXT > 17 */
+ 
+-	return 0;
++free_rateset:
++	kfree(rateset);
++free_channels:
++	kfree(channels);
++
++	return error;
+ }
+ 
+ static int
+--- a/driver/bcmsrom.c
++++ b/driver/bcmsrom.c
+@@ -437,20 +437,37 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
+            uint byteoff, uint nbytes, uint16 *buf)
+ {
+ 	uint i, nw, crc_range;
+-	uint16 old[SROM_MAXW], new[SROM_MAXW];
++	uint16 *old, *new;
+ 	uint8 crc;
+ 	volatile uint32 val32;
++	int rc = 0;
+ 
+ 	ASSERT(bustype == BUSTYPE(bustype));
+ 
++	old = MALLOC(osh, SROM_MAXW);
++	ASSERT(old != NULL);
++	if (!old)
++		return -2;
++
++	new = MALLOC(osh, SROM_MAXW);
++	ASSERT(new != NULL);
++	if (!new) {
++		rc = -2;
++		goto free_old;
++	}
++
+ 	/* check input - 16-bit access only. use byteoff 0x55aa to indicate
+ 	 * srclear
+ 	 */
+-	if ((byteoff != 0x55aa) && ((byteoff & 1) || (nbytes & 1)))
+-		return 1;
++	if ((byteoff != 0x55aa) && ((byteoff & 1) || (nbytes & 1))) {
++		rc = 1;
++		goto free_new;
++	}
+ 
+-	if ((byteoff != 0x55aa) && ((byteoff + nbytes) > SROM_MAX))
+-		return 1;
++	if ((byteoff != 0x55aa) && ((byteoff + nbytes) > SROM_MAX)) {
++		rc = 1;
++		goto free_new;
++	}
+ 
+ 	if (BUSTYPE(bustype) == PCMCIA_BUS) {
+ 		crc_range = SROM_MAX;
+@@ -467,8 +484,10 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
+ 
+ 	nw = crc_range / 2;
+ 	/* read first small number words from srom, then adjust the length, read all */
+-	if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE))
+-		return 1;
++	if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE)) {
++		rc = 1;
++		goto free_new;
++	}
+ 
+ 	BS_ERROR(("%s: old[SROM4_SIGN] 0x%x, old[SROM8_SIGN] 0x%x\n",
+ 	          __FUNCTION__, old[SROM4_SIGN], old[SROM8_SIGN]));
+@@ -481,10 +500,13 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
+ 				__FUNCTION__, buf[SROM4_SIGN], buf[SROM8_SIGN]));
+ 
+ 			/* block invalid buffer size */
+-			if (nbytes < SROM4_WORDS * 2)
+-				return BCME_BUFTOOSHORT;
+-			else if (nbytes > SROM4_WORDS * 2)
+-				return BCME_BUFTOOLONG;
++			if (nbytes < SROM4_WORDS * 2) {
++				rc = BCME_BUFTOOSHORT;
++				goto free_new;
++			} else if (nbytes > SROM4_WORDS * 2) {
++				rc = BCME_BUFTOOLONG;
++				goto free_new;
++			}
+ 
+ 			nw = SROM4_WORDS;
+ 		} else if (nbytes == SROM_WORDS * 2){ /* the other possible SROM format */
+@@ -493,17 +515,22 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
+ 			nw = SROM_WORDS;
+ 		} else {
+ 			BS_ERROR(("%s: Invalid input file signature\n", __FUNCTION__));
+-			return BCME_BADARG;
++			rc = BCME_BADARG;
++			goto free_new;
+ 		}
+ 		crc_range = nw * 2;
+-		if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE))
+-			return 1;
++		if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE)) {
++			rc = 1;
++			goto free_new;
++		}
+ 	} else if ((old[SROM4_SIGN] == SROM4_SIGNATURE) ||
+ 	    (old[SROM8_SIGN] == SROM4_SIGNATURE)) {
+ 		nw = SROM4_WORDS;
+ 		crc_range = nw * 2;
+-		if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE))
+-			return 1;
++		if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE)) {
++			rc = 1;
++			goto free_new;
++		}
+ 	} else {
+ 		/* Assert that we have already read enough for sromrev 2 */
+ 		ASSERT(crc_range >= SROM_WORDS * 2);
+@@ -562,8 +589,10 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
+ 		}
+ 	} else if (BUSTYPE(bustype) == PCMCIA_BUS) {
+ 		/* enable writes to the SPROM */
+-		if (sprom_cmd_pcmcia(osh, SROM_WEN))
+-			return 1;
++		if (sprom_cmd_pcmcia(osh, SROM_WEN)) {
++			rc = 1;
++			goto free_new;
++		}
+ 		bcm_mdelay(WRITE_ENABLE_DELAY);
+ 		/* write srom */
+ 		for (i = 0; i < nw; i++) {
+@@ -573,14 +602,15 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
+ 			}
+ 		}
+ 		/* disable writes to the SPROM */
+-		if (sprom_cmd_pcmcia(osh, SROM_WDS))
+-			return 1;
++		if (sprom_cmd_pcmcia(osh, SROM_WDS)) {
++			rc = 1;
++			goto free_new;
++		}
+ 	} else if (BUSTYPE(bustype) == SI_BUS) {
+ #if defined(BCMUSBDEV)
+ 		if (SPROMBUS == PCMCIA_BUS) {
+ 			uint origidx;
+ 			void *regs;
+-			int rc;
+ 			bool wasup;
+ 
+ 			origidx = si_coreidx(sih);
+@@ -596,16 +626,24 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
+ 				si_core_disable(sih, 0);
+ 
+ 			si_setcoreidx(sih, origidx);
+-			return rc;
++			goto free_new;
+ 		}
+ #endif 
+-		return 1;
++		rc = 1;
++		goto free_new;
+ 	} else {
+-		return 1;
++		rc = 1;
++		goto free_new;
+ 	}
+ 
+ 	bcm_mdelay(WRITE_ENABLE_DELAY);
+-	return 0;
++	rc = 0;
++
++free_new:
++	MFREE(osh, new, SROM_MAXW);
++free_old:
++	MFREE(osh, old, SROM_MAXW);
++	return rc;
+ }
+ 
+ #if defined(BCMUSBDEV)
+--- a/driver/linux_osl.c
++++ b/driver/linux_osl.c
+@@ -600,20 +600,29 @@ int
+ osl_printf(const char *format, ...)
+ {
+ 	va_list args;
+-	char buf[1024];
++	char *buf;
+ 	int len;
+ 
++	buf = kcalloc(1024, sizeof(*buf), GFP_KERNEL);
++	if (!buf)
++		return (-ENOMEM);
++
+ 	/* sprintf into a local buffer because there *is* no "vprintk()".. */
+ 	va_start(args, format);
+ 	len = vsnprintf(buf, 1024, format, args);
+ 	va_end(args);
+ 
+-	if (len > sizeof(buf)) {
++	if (len > (sizeof(*buf) * 1024)) {
+ 		printk("osl_printf: buffer overrun\n");
+-		return (0);
++		goto exit;
+ 	}
+ 
+-	return (printk(buf));
++	printk(buf);
++
++exit:
++	kfree(buf);
++
++	return (0);
+ }
+ 
+ int
+--- a/driver/bcmutils.c
++++ b/driver/bcmutils.c
+@@ -13,6 +13,7 @@
+ 
+ #include <typedefs.h>
+ #include <bcmdefs.h>
++#define __need___va_list
+ #include <stdarg.h>
+ #include <bcmutils.h>
+ #ifdef BCMDRIVER
diff --git a/package/kernel/broadcom-wl/patches/920-aiutils-fix-wrong-misleading-if.patch b/package/kernel/broadcom-wl/patches/920-aiutils-fix-wrong-misleading-if.patch
new file mode 100644
index 00000000000000..c43dca9e896f01
--- /dev/null
+++ b/package/kernel/broadcom-wl/patches/920-aiutils-fix-wrong-misleading-if.patch
@@ -0,0 +1,14 @@
+--- a/driver/aiutils.c
++++ b/driver/aiutils.c
+@@ -228,9 +228,10 @@ ai_scan(si_t *sih, void *regs, uint devid)
+ 		do {
+ 			asd = get_asd(sih, &eromptr, 0, j, AD_ST_SLAVE, &addrl, &addrh,
+ 			              &sizel, &sizeh);
+-			if ((asd != 0) && (j == 1) && (sizel == SI_CORE_SIZE))
++			if ((asd != 0) && (j == 1) && (sizel == SI_CORE_SIZE)) {
+ 				sii->coresba2[idx] = addrl;
+ 				sii->coresba2_size[idx] = sizel;
++			}
+ 			j++;
+ 		} while (asd != 0);
+ 
diff --git a/package/kernel/broadcom-wl/patches/921-fix-simple-compilation-warning.patch b/package/kernel/broadcom-wl/patches/921-fix-simple-compilation-warning.patch
new file mode 100644
index 00000000000000..2158dc67b80a5f
--- /dev/null
+++ b/package/kernel/broadcom-wl/patches/921-fix-simple-compilation-warning.patch
@@ -0,0 +1,63 @@
+--- a/driver/hnddma.c
++++ b/driver/hnddma.c
+@@ -1896,7 +1896,8 @@ dma64_txfast(dma_info_t *di, void *p0, bool commit)
+ 	if (!(flags & D64_CTRL1_EOF)) {
+ #if defined(linux) && defined(__mips__)
+ 		if (CHIPID(di->sih->chip) == BCM5356_CHIP_ID && di->sih->chiprev == 0) {
+-			uint32 ctrl1, ctrl2, addrlow, addrhigh;
++			uint32 ctrl2, addrlow, addrhigh;
++			// uint32 ctrl1;
+ 
+ 			addrlow = R_SM((volatile uint32 *)&di->txd64[PREVTXD(txout)].addrlow);
+ 			addrhigh = R_SM((volatile uint32 *)&di->txd64[PREVTXD(txout)].addrhigh);
+ 
+--- a/driver/include/linux_osl.h
++++ b/driver/include/linux_osl.h
+@@ -580,9 +580,9 @@ extern void osl_writew(uint16 v, volatile uint16 *r);
+ extern void osl_writel(uint32 v, volatile uint32 *r);
+ 
+ /* uncached/cached virtual address */
+-#define OSL_UNCACHED(va)	osl_uncached((va))
++#define OSL_UNCACHED(va)	osl_uncached((void *)(va))
+ extern void *osl_uncached(void *va);
+-#define OSL_CACHED(va)		osl_cached((va))
++#define OSL_CACHED(va)		osl_cached((void *)(va))
+ extern void *osl_cached(void *va);
+ 
+ /* get processor cycle count */
+--- a/driver/siutils.c
++++ b/driver/siutils.c
+@@ -495,11 +495,13 @@ BCMATTACHFN(si_doattach)(si_info_t *sii, uint devid, osl_t *osh, void *regs,
+ 	}
+ 
+ 	sih->bustype = bustype;
++#ifdef BCMBUSTYPE
+ 	if (bustype != BUSTYPE(bustype)) {
+ 		SI_ERROR(("si_doattach: bus type %d does not match configured bus type %d\n",
+ 			bustype, BUSTYPE(bustype)));
+ 		return NULL;
+ 	}
++#endif
+ 
+ 	/* bus/core/clk setup for register access */
+ 	if (!si_buscore_prep(sii, bustype, devid, sdh)) {
+@@ -1716,6 +1718,9 @@ si_clkctl_xtal(si_t *sih, uint what, bool on)
+ 			                     outen);
+ 		}
+ 
++		return (0);
++
++
+ 	default:
+ 		return (-1);
+ 	}
+--- a/driver/bcmsrom.c
++++ b/driver/bcmsrom.c
+@@ -1005,6 +1043,7 @@ BCMNMIATTACHFN(srom_parsecis)(osl_t *osh, uint8 *pcis[], uint ciscnt, char **var
+ 					break;
+ 				}
+ 
++				fallthrough;
+ 			case CISTPL_MANFID: FROMHOST();
+ 				varbuf_append(&b, vstr_manfid, (cis[i + 1] << 8) + cis[i]);
+ 				varbuf_append(&b, vstr_prodid, (cis[i + 3] << 8) + cis[i + 2]);
diff --git a/package/kernel/broadcom-wl/patches/930-wl_linux-set-module-license-Proprietary.patch b/package/kernel/broadcom-wl/patches/930-wl_linux-set-module-license-Proprietary.patch
new file mode 100644
index 00000000000000..6d0571711c474d
--- /dev/null
+++ b/package/kernel/broadcom-wl/patches/930-wl_linux-set-module-license-Proprietary.patch
@@ -0,0 +1,10 @@
+--- a/driver/wl_linux.c
++++ b/driver/wl_linux.c
+@@ -1109,6 +1109,7 @@ wl_module_exit(void)
+ 
+ module_init(wl_module_init);
+ module_exit(wl_module_exit);
++MODULE_LICENSE("Proprietary");
+ 
+ /** 
+  * This function frees the WL per-device resources.
diff --git a/package/kernel/button-hotplug/Makefile b/package/kernel/button-hotplug/Makefile
index 55412e56854219..8e8c02609c8bb9 100644
--- a/package/kernel/button-hotplug/Makefile
+++ b/package/kernel/button-hotplug/Makefile
@@ -28,23 +28,8 @@ define KernelPackage/button-hotplug/description
   If your device uses GPIO buttons, see gpio-button-hotplug.
 endef
 
-EXTRA_KCONFIG:= \
-	CONFIG_BUTTON_HOTPLUG=m
-
-EXTRA_CFLAGS:= \
-	$(patsubst CONFIG_%, -DCONFIG_%=1, $(patsubst %=m,%,$(filter %=m,$(EXTRA_KCONFIG)))) \
-	$(patsubst CONFIG_%, -DCONFIG_%=1, $(patsubst %=y,%,$(filter %=y,$(EXTRA_KCONFIG)))) \
-
-MAKE_OPTS:= \
-	$(KERNEL_MAKE_FLAGS) \
-	M="$(PKG_BUILD_DIR)" \
-	EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
-	$(EXTRA_KCONFIG)
-
 define Build/Compile
-	$(MAKE) -C "$(LINUX_DIR)" \
-		$(MAKE_OPTS) \
-		modules
+	$(KERNEL_MAKE) M="$(PKG_BUILD_DIR)" modules
 endef
 
 $(eval $(call KernelPackage,button-hotplug))
diff --git a/package/kernel/button-hotplug/src/Makefile b/package/kernel/button-hotplug/src/Makefile
index 230d604f8c403d..e38fa40bb43fe4 100644
--- a/package/kernel/button-hotplug/src/Makefile
+++ b/package/kernel/button-hotplug/src/Makefile
@@ -1 +1 @@
-obj-${CONFIG_BUTTON_HOTPLUG}	+= button-hotplug.o
\ No newline at end of file
+obj-m := button-hotplug.o
diff --git a/package/kernel/cryptodev-linux/Makefile b/package/kernel/cryptodev-linux/Makefile
index 345036b59d0c36..0c1f63a6055a93 100644
--- a/package/kernel/cryptodev-linux/Makefile
+++ b/package/kernel/cryptodev-linux/Makefile
@@ -11,7 +11,7 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=cryptodev-linux
 PKG_VERSION:=1.12
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=1
 
 PKG_SOURCE_URL:=https://codeload.github.com/$(PKG_NAME)/$(PKG_NAME)/tar.gz/$(PKG_NAME)-$(PKG_VERSION)?
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
diff --git a/package/kernel/gpio-button-hotplug/Makefile b/package/kernel/gpio-button-hotplug/Makefile
index 09f9c00e990f55..7ca6195a03ecff 100644
--- a/package/kernel/gpio-button-hotplug/Makefile
+++ b/package/kernel/gpio-button-hotplug/Makefile
@@ -32,14 +32,8 @@ define KernelPackage/gpio-button-hotplug/description
  an overkill for OpenWrt simple needs.
 endef
 
-MAKE_OPTS:= \
-	$(KERNEL_MAKE_FLAGS) \
-	M="$(PKG_BUILD_DIR)"
-
 define Build/Compile
-	$(MAKE) -C "$(LINUX_DIR)" \
-		$(MAKE_OPTS) \
-		modules
+	$(KERNEL_MAKE) M="$(PKG_BUILD_DIR)" modules
 endef
 
 $(eval $(call KernelPackage,gpio-button-hotplug))
diff --git a/package/kernel/gpio-button-hotplug/src/gpio-button-hotplug.c b/package/kernel/gpio-button-hotplug/src/gpio-button-hotplug.c
index 2b39ec8f3be52e..522085bb2fa2e2 100644
--- a/package/kernel/gpio-button-hotplug/src/gpio-button-hotplug.c
+++ b/package/kernel/gpio-button-hotplug/src/gpio-button-hotplug.c
@@ -506,6 +506,13 @@ static int gpio_keys_button_probe(struct platform_device *pdev,
 			goto out;
 		}
 
+		if (button->irq) {
+			dev_err(dev, "skipping button %s (only gpio buttons supported)\n",
+				button->desc);
+			bdata->b = &pdata->buttons[i];
+			continue;
+		}
+
 		if (gpio_is_valid(button->gpio)) {
 			/* legacy platform data... but is it the lookup table? */
 			bdata->gpiod = devm_gpiod_get_index(dev, desc, i,
diff --git a/package/kernel/gpio-nct5104d/Makefile b/package/kernel/gpio-nct5104d/Makefile
index e85639c94afef5..72b1d58e62ece2 100644
--- a/package/kernel/gpio-nct5104d/Makefile
+++ b/package/kernel/gpio-nct5104d/Makefile
@@ -36,15 +36,11 @@ EXTRA_CFLAGS:= \
 	$(patsubst CONFIG_%, -DCONFIG_%=1, $(patsubst %=m,%,$(filter %=m,$(EXTRA_KCONFIG)))) \
 	$(patsubst CONFIG_%, -DCONFIG_%=1, $(patsubst %=y,%,$(filter %=y,$(EXTRA_KCONFIG)))) \
 
-MAKE_OPTS:= \
-	$(KERNEL_MAKE_FLAGS) \
-	M="$(PKG_BUILD_DIR)" \
-	EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
-	$(EXTRA_KCONFIG)
-
 define Build/Compile
-	 $(MAKE) -C "$(LINUX_DIR)" \
-		$(MAKE_OPTS) \
+	 $(KERNEL_MAKE) \
+		M="$(PKG_BUILD_DIR)" \
+		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
+		$(EXTRA_KCONFIG) \
 		modules
 endef
 
diff --git a/package/kernel/gpio-nct5104d/src/gpio-nct5104d.c b/package/kernel/gpio-nct5104d/src/gpio-nct5104d.c
index 8f180edd33f882..5343d6e3a8d13d 100644
--- a/package/kernel/gpio-nct5104d/src/gpio-nct5104d.c
+++ b/package/kernel/gpio-nct5104d/src/gpio-nct5104d.c
@@ -409,8 +409,6 @@ static int __init nct5104d_gpio_init(void)
 {
 	int err;
 	struct nct5104d_sio sio;
-	const char *board_vendor = dmi_get_system_info(DMI_BOARD_VENDOR);
-	const char *board_name = dmi_get_system_info(DMI_BOARD_NAME);
 
 	if (nct5104d_find(0x2e, &sio) &&
 	    nct5104d_find(0x4e, &sio))
diff --git a/package/kernel/lantiq/ltq-adsl-mei/src/drv_mei_cpe.c b/package/kernel/lantiq/ltq-adsl-mei/src/drv_mei_cpe.c
index df04de73e03533..8ccfb443ed16e0 100644
--- a/package/kernel/lantiq/ltq-adsl-mei/src/drv_mei_cpe.c
+++ b/package/kernel/lantiq/ltq-adsl-mei/src/drv_mei_cpe.c
@@ -28,6 +28,7 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/mod_devicetable.h>
 #include <linux/version.h>
 #include <generated/utsrelease.h>
 #include <linux/types.h>
@@ -1619,7 +1620,9 @@ DSL_BSP_FWDownload (DSL_DEV_Device_t * pDev, const char *buf,
 			IFX_MEI_EMSG ("Firmware size is too small!\n");
 			return retval;
 		}
-		copy_from_user ((char *) &img_hdr_tmp, buf, sizeof (img_hdr_tmp));
+		if (copy_from_user ((char *) &img_hdr_tmp, buf, sizeof (img_hdr_tmp)))
+			return -EFAULT;
+
 		// header of image_size and crc are not included.
 		DSL_DEV_PRIVATE(pDev)->image_size = le32_to_cpu (img_hdr_tmp.size) + 8;
 
@@ -1697,7 +1700,9 @@ DSL_BSP_FWDownload (DSL_DEV_Device_t * pDev, const char *buf,
 			nCopy = SDRAM_SEGMENT_SIZE - offset;
 		else
 			nCopy = size - nRead;
-		copy_from_user (mem_ptr, buf + nRead, nCopy);
+		if (copy_from_user (mem_ptr, buf + nRead, nCopy))
+			return -EFAULT;
+
 		for (offset = 0; offset < (nCopy / 4); offset++) {
 			((unsigned long *) mem_ptr)[offset] = le32_to_cpu (((unsigned long *) mem_ptr)[offset]);
 		}
diff --git a/package/kernel/lantiq/ltq-adsl/patches/201-fix-compilation-warning-fallthrough.patch b/package/kernel/lantiq/ltq-adsl/patches/201-fix-compilation-warning-fallthrough.patch
new file mode 100644
index 00000000000000..dfaf29f44981f5
--- /dev/null
+++ b/package/kernel/lantiq/ltq-adsl/patches/201-fix-compilation-warning-fallthrough.patch
@@ -0,0 +1,36 @@
+--- a/src/pm/drv_dsl_cpe_pm_core.c
++++ b/src/pm/drv_dsl_cpe_pm_core.c
+@@ -2274,16 +2274,18 @@ DSL_Error_t DSL_DRV_PM_CountersReset(
+       }
+ #endif /* #ifdef INCLUDE_DSL_CPE_PM_HISTORY*/
+ 
+-   if (ResetType == DSL_PM_RESET_HISTORY)
+-      break;
++      if (ResetType == DSL_PM_RESET_HISTORY)
++         break;
+ 
++      fallthrough;
+    case DSL_PM_RESET_TOTAL:
+ #ifdef INCLUDE_DSL_CPE_PM_TOTAL_COUNTERS
+       memset(EpData.pRecTotal, 0x0, EpData.nEpRecElementSize);
+ #endif /* #ifdef INCLUDE_DSL_CPE_PM_TOTAL_COUNTERS*/
+-   if (ResetType == DSL_PM_RESET_TOTAL)
+-      break;
++      if (ResetType == DSL_PM_RESET_TOTAL)
++         break;
+ 
++      fallthrough;
+    case DSL_PM_RESET_HISTORY_SHOWTIME:
+ #ifdef INCLUDE_DSL_CPE_PM_SHOWTIME_COUNTERS
+       nErrCode = DSL_DRV_PM_HistoryDelete(pContext, EpData.pHistShowtime );
+--- a/src/device/drv_dsl_cpe_device_danube.c
++++ b/src/device/drv_dsl_cpe_device_danube.c
+@@ -3193,7 +3193,7 @@ DSL_Error_t DSL_DRV_DEV_AutobootHandleTraining(
+                      DSL_DEV_NUM(pContext)));
+                }
+ #endif /* INCLUDE_DSL_DELT*/
+-            /* Pass through */
++               fallthrough ;
+             case DSL_LINESTATE_IDLE:
+ #if defined(INCLUDE_DSL_PM) && defined(INCLUDE_DSL_CPE_PM_LINE_COUNTERS)
+                if ( (pContext->bGotFullInit == DSL_TRUE) &&
diff --git a/package/kernel/lantiq/ltq-adsl/patches/202-g997_danube-dynamically-allocate-hlogdata.patch b/package/kernel/lantiq/ltq-adsl/patches/202-g997_danube-dynamically-allocate-hlogdata.patch
new file mode 100644
index 00000000000000..c3b1047a2ab427
--- /dev/null
+++ b/package/kernel/lantiq/ltq-adsl/patches/202-g997_danube-dynamically-allocate-hlogdata.patch
@@ -0,0 +1,65 @@
+--- a/src/g997/drv_dsl_cpe_api_g997_danube.c
++++ b/src/g997/drv_dsl_cpe_api_g997_danube.c
+@@ -1984,41 +1984,53 @@ DSL_Error_t DSL_DRV_DEV_G997_DeltHlogGet(
+       {
+          if (nDirection == DSL_DOWNSTREAM)
+          {
+-            DSL_G997_DeltHlogData_t HlogData;
++            DSL_G997_DeltHlogData_t *HlogData;
+ 
+-            memset(&HlogData, 0x0, sizeof(DSL_G997_DeltHlogData_t));
++            HlogData = kzalloc(sizeof(*HlogData), GFP_KERNEL);
++            if (!HlogData)
++            {
++               DSL_DEBUG(DSL_DBG_ERR,
++                  (pContext, "DSL[%02d]: ERROR - Alloc HlogData failed!"DSL_DRV_CRLF,
++                  DSL_DEV_NUM(pContext)));
++               return DSL_ERR_MEMORY;
++            }
++
++            memset(HlogData, 0x0, sizeof(DSL_G997_DeltHlogData_t));
+ 
+             /* Get SHOWTIME Hlog values*/
+             nErrCode = DSL_DRV_DANUBE_G997_DeltHlogGet(
+-                          pContext, nDirection, &HlogData);
++                          pContext, nDirection, HlogData);
+             if (nErrCode != DSL_SUCCESS)
+             {
+                DSL_DEBUG(DSL_DBG_ERR,
+                   (pContext, "DSL[%02d]: ERROR - Showtime Hlog get failed!"DSL_DRV_CRLF,
+                   DSL_DEV_NUM(pContext)));
++               kfree(HlogData);
+                return nErrCode;
+             }
+ 
+             /* if actual group size != 1, values should be spread */
+-            if (HlogData.nGroupSize != 1)
++            if (HlogData->nGroupSize != 1)
+             {
+                nErrCode = DSL_DRV_DANUBE_G997_DeltValuesSpread(
+-                             0x1, HlogData.nGroupSize, HlogData.deltHlog.nNumData,
+-                             HlogData.deltHlog.nNSCData, pData->deltHlog.nNSCData);
++                             0x1, HlogData->nGroupSize, HlogData->deltHlog.nNumData,
++                             HlogData->deltHlog.nNSCData, pData->deltHlog.nNSCData);
+ 
+                if (nErrCode == DSL_SUCCESS)
+                {
+                   pData->deltHlog.nNumData = 
+-                     (DSL_uint16_t)(HlogData.deltHlog.nNumData * HlogData.nGroupSize);
++                     (DSL_uint16_t)(HlogData->deltHlog.nNumData * HlogData->nGroupSize);
+                   pData->nGroupSize        = 1;
+-                  pData->nMeasurementTime  = HlogData.nMeasurementTime;
++                  pData->nMeasurementTime  = HlogData->nMeasurementTime;
+                }
+             }
+             else
+             {
+                /* No spread needed, copy data*/
+-               memcpy(pData, &HlogData, sizeof(DSL_G997_DeltHlogData_t));
++               memcpy(pData, HlogData, sizeof(DSL_G997_DeltHlogData_t));
+             }
++
++            kfree(HlogData);
+          }
+          else
+          {
diff --git a/package/kernel/lantiq/ltq-adsl/patches/203-g997_danube-fix-compilation-warning.patch b/package/kernel/lantiq/ltq-adsl/patches/203-g997_danube-fix-compilation-warning.patch
new file mode 100644
index 00000000000000..c6a0e70f1f922a
--- /dev/null
+++ b/package/kernel/lantiq/ltq-adsl/patches/203-g997_danube-fix-compilation-warning.patch
@@ -0,0 +1,26 @@
+--- a/src/g997/drv_dsl_cpe_api_g997_danube.c
++++ b/src/g997/drv_dsl_cpe_api_g997_danube.c
+@@ -2512,6 +2524,7 @@ DSL_Error_t DSL_DRV_DEV_G997_PowerManagementStateForcedTrigger(
+                   else
+                   {
+                      /* read L3 request failure reason */
++                     DSL_uint8_t nErrCodeL3;
+                      nErrCode = DSL_DRV_DANUBE_CmvRead(pContext, DSL_CMV_GROUP_STAT,
+                         DSL_CMV_ADDRESS_STAT_L3_FAILURE_REASON, 0, 1, &nVal);
+                      DSL_DEBUG(DSL_DBG_MSG,
+@@ -2525,11 +2538,13 @@ DSL_Error_t DSL_DRV_DEV_G997_PowerManagementStateForcedTrigger(
+                         nErrCode = DSL_ERR_MSG_EXCHANGE;
+                         break;
+                      }
+-                     if (((nVal >> 4) & 0x15) == 0x5)
++
++                     nErrCodeL3 = (nVal >> 4) & 0x15;
++                     if (nErrCodeL3 == 0x5)
+                      {
+                         nErrCode = DSL_ERR_L3_NOT_IN_L0;
+                      }
+-                     else if (((nVal >> 4) & 0x15) == 0x9)
++                     else if (nErrCodeL3 == 0x9)
+                      {
+                         nErrCode = DSL_ERR_L3_TIMED_OUT;
+                      }
diff --git a/package/kernel/lantiq/ltq-atm/patches/100-ltq_atm-fix-compillation-warning.patch b/package/kernel/lantiq/ltq-atm/patches/100-ltq_atm-fix-compillation-warning.patch
new file mode 100644
index 00000000000000..c74cfcb6b4d5b0
--- /dev/null
+++ b/package/kernel/lantiq/ltq-atm/patches/100-ltq_atm-fix-compillation-warning.patch
@@ -0,0 +1,12 @@
+--- a/ltq_atm.c
++++ b/ltq_atm.c
+@@ -338,7 +338,8 @@ static int ppe_ioctl(struct atm_dev *dev
+ 		break;
+ 
+ 	case PPE_ATM_MIB_VCC:   /*  VCC related MIB */
+-		copy_from_user(&mib_vcc, arg, sizeof(mib_vcc));
++		if (copy_from_user(&mib_vcc, arg, sizeof(mib_vcc)))
++			return -EFAULT;
+ 		conn = find_vpivci(mib_vcc.vpi, mib_vcc.vci);
+ 		if (conn >= 0) {
+ 			mib_vcc.mib_vcc.aal5VccCrcErrors     = g_atm_priv_data.conn[conn].aal5_vcc_crc_err;
diff --git a/package/kernel/lantiq/ltq-deu/Makefile b/package/kernel/lantiq/ltq-deu/Makefile
index 32a3b5c1b09df9..4e8127afabb986 100644
--- a/package/kernel/lantiq/ltq-deu/Makefile
+++ b/package/kernel/lantiq/ltq-deu/Makefile
@@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=ltq-deu
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=45
 
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 PKG_LICENSE:=GPL-2.0+
diff --git a/package/kernel/lantiq/ltq-deu/src/ifxmips_aes.c b/package/kernel/lantiq/ltq-deu/src/ifxmips_aes.c
index c0861a503f68ee..2aa4b09593578a 100644
--- a/package/kernel/lantiq/ltq-deu/src/ifxmips_aes.c
+++ b/package/kernel/lantiq/ltq-deu/src/ifxmips_aes.c
@@ -257,7 +257,7 @@ void ifx_deu_aes (void *ctx_arg, u8 *out_arg, const u8 *in_arg,
 {
     /*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ */
     volatile struct aes_t *aes = (volatile struct aes_t *) AES_START;
-    struct aes_ctx *ctx = (struct aes_ctx *)ctx_arg;
+    //struct aes_ctx *ctx = (struct aes_ctx *)ctx_arg;
     unsigned long flag;
     /*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ */
     int i = 0;
@@ -699,7 +699,7 @@ void ifx_deu_aes_xts (void *ctx_arg, u8 *out_arg, const u8 *in_arg,
 {
     /*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ */
     volatile struct aes_t *aes = (volatile struct aes_t *) AES_START;
-    struct aes_ctx *ctx = (struct aes_ctx *)ctx_arg;
+    //struct aes_ctx *ctx = (struct aes_ctx *)ctx_arg;
     unsigned long flag;
     /*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ */
     u8 oldiv[16];
diff --git a/package/kernel/lantiq/ltq-deu/src/ifxmips_des.c b/package/kernel/lantiq/ltq-deu/src/ifxmips_des.c
index 8c12a2607018b3..953c3feddc7235 100644
--- a/package/kernel/lantiq/ltq-deu/src/ifxmips_des.c
+++ b/package/kernel/lantiq/ltq-deu/src/ifxmips_des.c
@@ -205,12 +205,13 @@ void ifx_deu_des (void *ctx_arg, u8 *out_arg, const u8 *in_arg,
                         des->K3HR = DEU_ENDIAN_SWAP(*((u32 *) key + 4));
                         des->K3LR = DEU_ENDIAN_SWAP(*((u32 *) key + 5));
                         /* no break; */
-
+                        fallthrough;
                 case 16:
                         des->K2HR = DEU_ENDIAN_SWAP(*((u32 *) key + 2));
                         des->K2LR = DEU_ENDIAN_SWAP(*((u32 *) key + 3));
 
                         /* no break; */
+                        fallthrough;
                 case 8:
                         des->K1HR = DEU_ENDIAN_SWAP(*((u32 *) key + 0));
                         des->K1LR = DEU_ENDIAN_SWAP(*((u32 *) key + 1));
diff --git a/package/kernel/lantiq/ltq-deu/src/ifxmips_deu.c b/package/kernel/lantiq/ltq-deu/src/ifxmips_deu.c
index a102568f973231..096b8b5bba83fb 100644
--- a/package/kernel/lantiq/ltq-deu/src/ifxmips_deu.c
+++ b/package/kernel/lantiq/ltq-deu/src/ifxmips_deu.c
@@ -46,6 +46,7 @@
 #include <linux/modversions.h>
 #endif
 #include <linux/module.h>
+#include <linux/mod_devicetable.h>
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/errno.h>
diff --git a/package/kernel/lantiq/ltq-deu/src/ifxmips_md5.c b/package/kernel/lantiq/ltq-deu/src/ifxmips_md5.c
index 51782e0b6a4cb0..ee7e486b565b0b 100644
--- a/package/kernel/lantiq/ltq-deu/src/ifxmips_md5.c
+++ b/package/kernel/lantiq/ltq-deu/src/ifxmips_md5.c
@@ -143,7 +143,7 @@ static inline void md5_transform_helper(struct md5_ctx *ctx)
 static int md5_init(struct shash_desc *desc)
 {
     struct md5_ctx *mctx = shash_desc_ctx(desc);
-    volatile struct deu_hash_t *hash = (struct deu_hash_t *) HASH_START;
+    //volatile struct deu_hash_t *hash = (struct deu_hash_t *) HASH_START;
 
     mctx->byte_count = 0;
     mctx->started = 0;
@@ -200,8 +200,8 @@ static int md5_final(struct shash_desc *desc, u8 *out)
     const unsigned int offset = mctx->byte_count & 0x3f;
     char *p = (char *)mctx->block + offset;
     int padding = 56 - (offset + 1);
-    volatile struct deu_hash_t *hashs = (struct deu_hash_t *) HASH_START;
-    unsigned long flag;
+    //volatile struct deu_hash_t *hashs = (struct deu_hash_t *) HASH_START;
+    //unsigned long flag;
 
     *p++ = 0x80;
     if (padding < 0) {
diff --git a/package/kernel/lantiq/ltq-deu/src/ifxmips_sha1.c b/package/kernel/lantiq/ltq-deu/src/ifxmips_sha1.c
index a20430c448156e..76734917d1e64d 100644
--- a/package/kernel/lantiq/ltq-deu/src/ifxmips_sha1.c
+++ b/package/kernel/lantiq/ltq-deu/src/ifxmips_sha1.c
@@ -43,7 +43,12 @@
 #include <linux/module.h>
 #include <linux/mm.h>
 #include <linux/crypto.h>
+#include <linux/version.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5,11,0)
 #include <crypto/sha.h>
+#else
+#include <crypto/sha1.h>
+#endif
 #include <crypto/hash.h>
 #include <crypto/internal/hash.h>
 #include <linux/types.h>
@@ -194,8 +199,8 @@ static int sha1_final(struct shash_desc *desc, u8 *out)
     u64 t;
     u8 bits[8] = { 0, };
     static const u8 padding[64] = { 0x80, };
-    volatile struct deu_hash_t *hashs = (struct deu_hash_t *) HASH_START;
-    unsigned long flag;
+    //volatile struct deu_hash_t *hashs = (struct deu_hash_t *) HASH_START;
+    //unsigned long flag;
 
     t = sctx->count;
     bits[7] = 0xff & t;
diff --git a/package/kernel/lantiq/ltq-deu/src/ifxmips_sha1_hmac.c b/package/kernel/lantiq/ltq-deu/src/ifxmips_sha1_hmac.c
index 69504efe931028..b58a91a5df7987 100644
--- a/package/kernel/lantiq/ltq-deu/src/ifxmips_sha1_hmac.c
+++ b/package/kernel/lantiq/ltq-deu/src/ifxmips_sha1_hmac.c
@@ -44,7 +44,12 @@
 #include <linux/mm.h>
 #include <linux/crypto.h>
 #include <crypto/internal/hash.h>
+#include <linux/version.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5,11,0)
 #include <crypto/sha.h>
+#else
+#include <crypto/sha1.h>
+#endif
 #include <linux/types.h>
 #include <linux/scatterlist.h>
 #include <asm/byteorder.h>
diff --git a/package/kernel/lantiq/ltq-ifxos/Makefile b/package/kernel/lantiq/ltq-ifxos/Makefile
index bc586faaf12741..d941a9d56ff200 100644
--- a/package/kernel/lantiq/ltq-ifxos/Makefile
+++ b/package/kernel/lantiq/ltq-ifxos/Makefile
@@ -8,7 +8,7 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=ifxos
 PKG_VERSION:=1.7.1
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=4
 
 UGW_VERSION=8.5.2.10
 UGW_BASENAME=$(PKG_NAME)-ugw_$(UGW_VERSION)
@@ -32,7 +32,7 @@ define KernelPackage/ltq-ifxos
   SUBMENU:=Libraries
   TITLE:=Lantiq OS abstraction library
   URL:=http://www.lantiq.com/
-  DEPENDS:=@TARGET_lantiq
+  DEPENDS:=@(TARGET_lantiq||TARGET_ipq40xx)
   FILES:=$(PKG_BUILD_DIR)/src/drv_ifxos.ko
   AUTOLOAD:=$(call AutoLoad,10,drv_ifxos)
 endef
@@ -44,13 +44,11 @@ CONFIGURE_ARGS += \
 	--enable-kernelincl="$(LINUX_DIR)/include" \
 	--with-kernel-module
 
-ifdef CONFIG_TARGET_lantiq
-  define Build/InstallDev
+define Build/InstallDev
 	$(INSTALL_DIR) $(1)/usr/{lib,include/ifxos}
 	$(CP) $(PKG_BUILD_DIR)/src/include/* $(1)/usr/include/ifxos
 	mkdir -p $(1)/usr/lib
 	$(CP) $(PKG_BUILD_DIR)/src/.libs/libifxos.a $(1)/usr/lib/libifxos.a
-  endef
-endif
+endef
 
 $(eval $(call KernelPackage,ltq-ifxos))
diff --git a/package/kernel/lantiq/ltq-ifxos/patches/002-fix-compile.patch b/package/kernel/lantiq/ltq-ifxos/patches/002-fix-compile.patch
index 7d78c126857b2f..be518698e054d4 100644
--- a/package/kernel/lantiq/ltq-ifxos/patches/002-fix-compile.patch
+++ b/package/kernel/lantiq/ltq-ifxos/patches/002-fix-compile.patch
@@ -20,3 +20,14 @@
  
  #include "ifx_types.h"
  #include "ifxos_rt_if_check.h"
+--- a/src/include/linux/ifxos_linux_interrupt.h
++++ b/src/include/linux/ifxos_linux_interrupt.h
+@@ -31,7 +31,7 @@
+    IFX Linux adaptation - Includes
+    ========================================================================= */
+ #include "ifx_types.h"
+-#include <asm/irq.h>
++#include <linux/interrupt.h>
+ 
+ /* ============================================================================
+    IFX Linux adaptation - supported features
diff --git a/package/kernel/lantiq/ltq-ifxos/patches/100-compat.patch b/package/kernel/lantiq/ltq-ifxos/patches/100-compat.patch
index 0fc2c2c5e64da7..45059890e1188c 100644
--- a/package/kernel/lantiq/ltq-ifxos/patches/100-compat.patch
+++ b/package/kernel/lantiq/ltq-ifxos/patches/100-compat.patch
@@ -22,3 +22,71 @@
     if (pVirtAddr == IFX_NULL)
     {
        IFXOS_PRN_USR_ERR_NL( IFXOS, IFXOS_PRN_LEVEL_ERR,
+--- a/src/linux/ifxos_linux_socket_drv.c
++++ b/src/linux/ifxos_linux_socket_drv.c
+@@ -165,8 +165,12 @@ IFX_int_t IFXOS_SocketRecvFrom(
+    IFXOS_sockAddr_t *pSocAddr)
+ {
+    struct msghdr msg;
++#if LINUX_VERSION_CODE < KERNEL_VERSION(5,13,0)
+    struct iovec iov;
+    mm_segment_t old_fs;
++#else
++   struct kvec iov;
++#endif
+    int ret;
+ 
+    IFXOS_RETURN_IF_POINTER_NULL(pBuffer, IFX_ERROR);
+@@ -181,6 +185,8 @@ IFX_int_t IFXOS_SocketRecvFrom(
+    msg.msg_controllen = 0;
+    msg.msg_flags = 0;
+ 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(5,13,0)
++
+ #if (LINUX_VERSION_CODE < KERNEL_VERSION(3,19,0))
+    msg.msg_iov = &iov;
+    msg.msg_iovlen = 1;
+@@ -200,6 +206,10 @@ IFX_int_t IFXOS_SocketRecvFrom(
+ #endif
+    set_fs(old_fs);
+ 
++#else
++   ret = kernel_recvmsg (socFd, &msg, &iov, 1, bufSize_byte, 0);
++#endif
++
+    return ret;
+ }
+ 
+@@ -229,8 +239,12 @@ IFX_int_t IFXOS_SocketSendTo(
+                   IFXOS_sockAddr_t  *pSocAddr)
+ {
+    struct msghdr msg;
++#if LINUX_VERSION_CODE < KERNEL_VERSION(5,13,0)
+    struct iovec iov;
+    mm_segment_t old_fs;
++#else
++   struct kvec iov;
++#endif
+    int ret;
+ 
+    IFXOS_RETURN_IF_POINTER_NULL(pBuffer, IFX_ERROR);
+@@ -245,6 +259,8 @@ IFX_int_t IFXOS_SocketSendTo(
+    msg.msg_controllen = 0;
+    msg.msg_flags = MSG_DONTWAIT;
+ 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(5,13,0)
++
+ #if (LINUX_VERSION_CODE < KERNEL_VERSION(3,19,0))
+    msg.msg_iov = &iov;
+    msg.msg_iovlen = 1;
+@@ -264,6 +280,10 @@ IFX_int_t IFXOS_SocketSendTo(
+ #endif
+    set_fs(old_fs);
+ 
++#else
++   ret = kernel_sendmsg(socFd, &msg, &iov, 1, bufSize_byte);
++#endif
++
+    return ret;
+ }
+ 
diff --git a/package/kernel/lantiq/ltq-ptm/patches/100-fix-compilation-warning-debugfs.patch b/package/kernel/lantiq/ltq-ptm/patches/100-fix-compilation-warning-debugfs.patch
new file mode 100644
index 00000000000000..283982fdef0072
--- /dev/null
+++ b/package/kernel/lantiq/ltq-ptm/patches/100-fix-compilation-warning-debugfs.patch
@@ -0,0 +1,33 @@
+--- a/ifxmips_ptm_adsl.c
++++ b/ifxmips_ptm_adsl.c
+@@ -175,9 +175,11 @@ static INLINE void mailbox_signal(unsign
+  */
+ static INLINE void proc_file_create(void);
+ static INLINE void proc_file_delete(void);
++#if defined(ENABLE_DBG_PROC) && ENABLE_DBG_PROC
+ static int proc_read_version(char *, char **, off_t, int, int *, void *);
+ static int proc_read_wanmib(char *, char **, off_t, int, int *, void *);
+ static int proc_write_wanmib(struct file *, const char *, unsigned long, void *);
++#endif
+ #if defined(ENABLE_FW_PROC) && ENABLE_FW_PROC
+   static int proc_read_genconf(char *, char **, off_t, int, int *, void *);
+ #endif
+@@ -889,6 +891,7 @@ static INLINE void proc_file_delete(void
+     remove_proc_entry("driver/ifx_ptm", NULL);
+ }
+ 
++#if defined(ENABLE_DBG_PROC) && ENABLE_DBG_PROC
+ static int proc_read_version(char *buf, char **start, off_t offset, int count, int *eof, void *data)
+ {
+     int len = 0;
+@@ -963,8 +966,9 @@ static int proc_write_wanmib(struct file
+ 
+     return count;
+ }
++#endif
+ 
+-#if defined(ENABLE_FW_PROC) && ENABLE_FW_PROC
++#if defined(ENABLE_FW_PROC) && ENABLE_FW_PROC && defined(ENABLE_DBG_PROC) && ENABLE_DBG_PROC
+ 
+ static int proc_read_genconf(char *page, char **start, off_t off, int count, int *eof, void *data)
+ {
diff --git a/package/kernel/lantiq/ltq-ptm/patches/101-fix-more-compilation-warning-debugfs.patch b/package/kernel/lantiq/ltq-ptm/patches/101-fix-more-compilation-warning-debugfs.patch
new file mode 100644
index 00000000000000..f854662a07840a
--- /dev/null
+++ b/package/kernel/lantiq/ltq-ptm/patches/101-fix-more-compilation-warning-debugfs.patch
@@ -0,0 +1,38 @@
+--- a/ifxmips_ptm_adsl.c
++++ b/ifxmips_ptm_adsl.c
+@@ -180,7 +180,7 @@ static int proc_read_version(char *, char **, off_t, int, int *, void *);
+ static int proc_read_wanmib(char *, char **, off_t, int, int *, void *);
+ static int proc_write_wanmib(struct file *, const char *, unsigned long, void *);
+ #endif
+-#if defined(ENABLE_FW_PROC) && ENABLE_FW_PROC
++#if defined(ENABLE_FW_PROC) && ENABLE_FW_PROC && defined(ENABLE_DBG_PROC) && ENABLE_DBG_PROC
+   static int proc_read_genconf(char *, char **, off_t, int, int *, void *);
+ #endif
+ #if defined(ENABLE_DBG_PROC) && ENABLE_DBG_PROC
+@@ -191,8 +191,8 @@ static int proc_write_wanmib(struct file *, const char *, unsigned long, void *)
+ /*
+  *  Proc Help Functions
+  */
+-static INLINE int stricmp(const char *, const char *);
+ #if defined(ENABLE_DBG_PROC) && ENABLE_DBG_PROC
++  static INLINE int stricmp(const char *, const char *);
+   static INLINE int strincmp(const char *, const char *, int);
+ #endif
+ static INLINE int ifx_ptm_version(char *);
+@@ -1159,8 +1159,6 @@ static int proc_write_dbg(struct file *file, const char *buf, unsigned long coun
+     return count;
+ }
+ 
+-#endif  //  defined(ENABLE_DBG_PROC) && ENABLE_DBG_PROC
+-
+ static INLINE int stricmp(const char *p1, const char *p2)
+ {
+     int c1, c2;
+@@ -1178,7 +1176,6 @@ static INLINE int stricmp(const char *p1, const char *p2)
+     return *p1 - *p2;
+ }
+ 
+-#if defined(ENABLE_DBG_PROC) && ENABLE_DBG_PROC
+ static INLINE int strincmp(const char *p1, const char *p2, int n)
+ {
+     int c1 = 0, c2;
diff --git a/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c b/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c
index d751680853ac03..dfb57787b9685b 100644
--- a/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c
+++ b/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c
@@ -146,6 +146,8 @@ unsigned int ifx_ptm_dbg_enable = DBG_ENABLE_MASK_ERR;
 
 static void ptm_setup(struct net_device *dev, int ndev)
 {
+    u8 addr[ETH_ALEN];
+
     netif_carrier_off(dev);
 
     dev->netdev_ops      = &g_ptm_netdev_ops;
@@ -154,12 +156,13 @@ static void ptm_setup(struct net_device *dev, int ndev)
     netif_napi_add(dev, &g_ptm_priv_data.itf[ndev].napi, ptm_napi_poll, 16);
     dev->watchdog_timeo  = ETH_WATCHDOG_TIMEOUT;
 
-    dev->dev_addr[0] = 0x00;
-    dev->dev_addr[1] = 0x20;
-	dev->dev_addr[2] = 0xda;
-	dev->dev_addr[3] = 0x86;
-	dev->dev_addr[4] = 0x23;
-	dev->dev_addr[5] = 0x75 + ndev;
+    addr[0] = 0x00;
+    addr[1] = 0x20;
+    addr[2] = 0xda;
+    addr[3] = 0x86;
+    addr[4] = 0x23;
+    addr[5] = 0x75 + ndev;
+    eth_hw_addr_set(dev, addr);
 }
 
 static struct net_device_stats *ptm_get_stats(struct net_device *dev)
@@ -557,7 +560,6 @@ static inline int get_tx_desc(unsigned int itf, unsigned int *f_full)
 static irqreturn_t mailbox_irq_handler(int irq, void *dev_id)
 {
     unsigned int isr;
-    int i;
 
     isr = IFX_REG_R32(MBOX_IGU1_ISR);
     IFX_REG_W32(isr, MBOX_IGU1_ISRC);
diff --git a/package/kernel/lantiq/ltq-tapi/Makefile b/package/kernel/lantiq/ltq-tapi/Makefile
index 77728644f60249..d44eeae5658615 100644
--- a/package/kernel/lantiq/ltq-tapi/Makefile
+++ b/package/kernel/lantiq/ltq-tapi/Makefile
@@ -10,7 +10,7 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=drv_tapi
 PKG_VERSION:=3.13.0
-PKG_RELEASE:=4
+PKG_RELEASE:=5
 
 PKG_SOURCE:=drv_tapi-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=@OPENWRT
diff --git a/package/kernel/lantiq/ltq-tapi/patches/410-custom_pulsedigit_time.patch b/package/kernel/lantiq/ltq-tapi/patches/410-custom_pulsedigit_time.patch
new file mode 100644
index 00000000000000..965b8be9602a63
--- /dev/null
+++ b/package/kernel/lantiq/ltq-tapi/patches/410-custom_pulsedigit_time.patch
@@ -0,0 +1,52 @@
+--- a/src/drv_tapi.h
++++ b/src/drv_tapi.h
+@@ -25,6 +25,7 @@
+ #include <lib_bufferpool.h>
+ #include "drv_tapi_io.h"
+ #include "drv_tapi_event.h"
++#include <linux/module.h>
+ 
+ 
+ /* ============================= */
+--- a/src/drv_tapi_dial.c
++++ b/src/drv_tapi_dial.c
+@@ -20,6 +20,19 @@
+ #include "drv_tapi.h"
+ #include "drv_tapi_errno.h"
+ 
++
++
++static unsigned int min_digit_low = TAPI_MIN_DIGIT_LOW;
++static unsigned int max_digit_low = TAPI_MAX_DIGIT_LOW;
++static unsigned int min_digit_high = TAPI_MIN_DIGIT_HIGH;
++static unsigned int max_digit_high = TAPI_MAX_DIGIT_HIGH;
++static unsigned int min_interdigit = TAPI_MIN_INTERDIGIT;
++module_param(min_digit_low, uint, 0);
++module_param(max_digit_low, uint, 0);
++module_param(min_digit_high, uint, 0);
++module_param(max_digit_high, uint, 0);
++module_param(min_interdigit, uint, 0);
++
+ /*lint -save -esym(749, TAPI_HOOK_STATE_PULSE_H_FLASH_VAL) */
+ /* ============================= */
+ /* Local macros and definitions  */
+@@ -408,14 +421,14 @@ IFX_int32_t IFX_TAPI_Dial_Initialise(TAP
+       }
+    }
+    /* set default values for the validation timers */
+-   pTapiDialData->TapiDigitLowTime.nMinTime      = TAPI_MIN_DIGIT_LOW;
+-   pTapiDialData->TapiDigitLowTime.nMaxTime      = TAPI_MAX_DIGIT_LOW;
+-   pTapiDialData->TapiDigitHighTime.nMinTime     = TAPI_MIN_DIGIT_HIGH;
+-   pTapiDialData->TapiDigitHighTime.nMaxTime     = TAPI_MAX_DIGIT_HIGH;
++   pTapiDialData->TapiDigitLowTime.nMinTime      = min_digit_low;
++   pTapiDialData->TapiDigitLowTime.nMaxTime      = max_digit_low;
++   pTapiDialData->TapiDigitHighTime.nMinTime     = min_digit_high;
++   pTapiDialData->TapiDigitHighTime.nMaxTime     = max_digit_high;
+    pTapiDialData->TapiHookFlashTime.nMinTime     = TAPI_MIN_FLASH;
+    pTapiDialData->TapiHookFlashTime.nMaxTime     = TAPI_MAX_FLASH;
+    pTapiDialData->TapiHookFlashMakeTime.nMinTime = TAPI_MIN_FLASH_MAKE;
+-   pTapiDialData->TapiInterDigitTime.nMinTime    = TAPI_MIN_INTERDIGIT;
++   pTapiDialData->TapiInterDigitTime.nMinTime    = min_interdigit;
+    pTapiDialData->TapiHookOffTime.nMinTime       = TAPI_MIN_OFF_HOOK;
+    pTapiDialData->TapiHookOnTime.nMinTime        = TAPI_MIN_ON_HOOK;
+    /* start hook state FSM in onhook state */
diff --git a/package/kernel/lantiq/ltq-tapi/patches/500-linux-509.patch b/package/kernel/lantiq/ltq-tapi/patches/500-linux-509.patch
index 586af59d856b30..07f61aa6326e56 100644
--- a/package/kernel/lantiq/ltq-tapi/patches/500-linux-509.patch
+++ b/package/kernel/lantiq/ltq-tapi/patches/500-linux-509.patch
@@ -34,6 +34,16 @@
  }
  
  
+@@ -3800,7 +3808,9 @@ module_exit (ifx_tapi_module_exit);
+ 
+ MODULE_AUTHOR           ("Lantiq Deutschland GmbH");
+ MODULE_DESCRIPTION      ("TAPI Driver - www.lantiq.com");
++#if LINUX_VERSION_CODE <= KERNEL_VERSION(5,10,0)
+ MODULE_SUPPORTED_DEVICE ("TAPI DEVICE");
++#endif
+ MODULE_LICENSE          ("Dual BSD/GPL");
+ 
+ EXPORT_SYMBOL (IFX_TAPI_Register_LL_Drv);
 --- a/src/drv_tapi_kpi.c
 +++ b/src/drv_tapi_kpi.c
 @@ -134,7 +134,11 @@ extern IFX_int32_t           block_ingre
diff --git a/package/kernel/lantiq/ltq-tapi/patches/510-linux-515.patch b/package/kernel/lantiq/ltq-tapi/patches/510-linux-515.patch
new file mode 100644
index 00000000000000..ee20c6caf7c196
--- /dev/null
+++ b/package/kernel/lantiq/ltq-tapi/patches/510-linux-515.patch
@@ -0,0 +1,14 @@
+--- a/src/drv_tapi_linux.c
++++ b/src/drv_tapi_linux.c
+@@ -3779,8 +3779,10 @@ IFX_void_t TAPI_OS_ThreadKill(IFXOS_Thre
+          mb();
+ #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+          kill_proc(pThrCntrl->tid, SIGKILL, 1);
+-#else
++#elif LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0)
+          kill_pid(find_vpid(pThrCntrl->tid), SIGKILL, 1);
++#else
++         kill_pid(get_task_pid(pThrCntrl->tid, PIDTYPE_PID), SIGKILL, 1);
+ #endif
+          /* release the big kernel lock */
+ #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,33)
diff --git a/package/kernel/lantiq/ltq-tapi/patches/600-fix-compilation-warning-switch-fallthrough.patch b/package/kernel/lantiq/ltq-tapi/patches/600-fix-compilation-warning-switch-fallthrough.patch
new file mode 100644
index 00000000000000..bb27ff355ad6f5
--- /dev/null
+++ b/package/kernel/lantiq/ltq-tapi/patches/600-fix-compilation-warning-switch-fallthrough.patch
@@ -0,0 +1,114 @@
+--- a/src/drv_tapi_cid.c
++++ b/src/drv_tapi_cid.c
+@@ -1424,6 +1424,8 @@ static IFX_int32_t cid_lookup_transparent(TAPI_CIDTX_DATA_t *pTxData,
+ 
+          cidfsk_set_tx_time (pTxData, &pConfData->TapiCidFskConf);
+ 
++         fallthrough;
++
+       case IFX_TAPI_CID_GEN_TYPE_DTMF:
+          memcpy (pTxData->cidBuf[IFX_TAPI_CID_GEN_TYPE_DTMF].pBuf,
+             pMessage[0].transparent.data, pMessage[0].transparent.len);
+@@ -1497,6 +1499,7 @@ static IFX_int32_t cid_prepare_data(TAPI_CHANNEL *pChannel,
+          break;
+       case IFX_TAPI_CID_STD_KPN_DTMF:
+          /*lint -fallthrough*/
++         fallthrough;
+       case IFX_TAPI_CID_STD_KPN_DTMF_FSK:
+          if (IFX_TAPI_CID_HM_ONHOOK == pTxData->txHookMode)
+          {
+@@ -1506,6 +1509,7 @@ static IFX_int32_t cid_prepare_data(TAPI_CHANNEL *pChannel,
+          }
+          /* KPN CID Type 2 (off-hook) always using FSK */
+          /*lint -fallthrough*/
++         fallthrough;
+       default:
+          pTxData->cidGenType = IFX_TAPI_CID_GEN_TYPE_FSK;
+          break;
+@@ -1532,6 +1536,7 @@ static IFX_int32_t cid_prepare_data(TAPI_CHANNEL *pChannel,
+                break;
+ 
+             /*lint -fallthrough*/
++            fallthrough;
+          case IFX_TAPI_CID_GEN_TYPE_FSK:
+ 
+             if (IFX_TAPI_CID_STD_NTT == pConfData->nStandard)
+@@ -2036,6 +2041,7 @@ static FSM_STATUS_t cid_fsm_alert_exec(TAPI_CHANNEL *pChannel)
+          }
+          pTxData->nCidSubState++;
+          /*lint -fallthrough*/
++         fallthrough;
+       case 1:
+          if (pConfData->OSIoffhook && pConfData->nSAStone)
+          {
+@@ -2052,6 +2058,7 @@ static FSM_STATUS_t cid_fsm_alert_exec(TAPI_CHANNEL *pChannel)
+          }
+          pTxData->nCidSubState++;
+          /*lint -fallthrough*/
++         fallthrough;
+       case 2:
+          if (pConfData->nSAStone)
+          {
+@@ -2069,6 +2076,7 @@ static FSM_STATUS_t cid_fsm_alert_exec(TAPI_CHANNEL *pChannel)
+          }
+          pTxData->nCidSubState++;
+          /*lint -fallthrough*/
++         fallthrough;
+       default:
+          /* Play CAS tone on data channel, use unprotected function, protection
+             is done around cid_fsm_alert_exec */
+@@ -3458,6 +3466,7 @@ IFX_int32_t TAPI_Phone_CID_Stop_Tx(TAPI_CHANNEL *pChannel)
+          }
+          /* deliberately fall through */
+          /*lint -fallthrough*/
++         fallthrough;
+       case TAPI_CID_STATE_ACK:
+          /* deactivate the DTMF override - last two params are ignored */
+          if (ptr_chk(pDrvCtx->SIG.DTMFD_Override, ""))
+@@ -3469,6 +3478,7 @@ IFX_int32_t TAPI_Phone_CID_Stop_Tx(TAPI_CHANNEL *pChannel)
+          }
+          /* deliberately fall through */
+          /*lint -fallthrough*/
++         fallthrough;
+       case TAPI_CID_STATE_SENDING:
+          TAPI_Stop_Timer (pTxData->CidTimerID);
+          break;
+@@ -4066,6 +4076,7 @@ IFX_int32_t TAPI_Phone_Get_CidRxData (TAPI_CHANNEL *pChannel,
+       /* If the fifo is not empty take the data from the fifo first. */
+       /* deliberately fallthrough to default case */
+       /*lint -fallthrough*/
++      fallthrough;
+    default:
+       /* Allow readout of data in all other states not handled above.
+          When there is no data in the fifo TAPI_statusErr is returned. */
+--- a/src/drv_tapi_dial.c
++++ b/src/drv_tapi_dial.c
+@@ -319,6 +319,8 @@ static IFX_void_t ifx_tapi_dial_OnTimer(Timer_ID Timer, IFX_ulong_t nArg)
+          /* NOTE: the "break" statement has been intentionally omitted */
+          /*lint -fallthrough */
+ 
++         fallthrough;
++
+       case TAPI_HOOK_STATE_DIAL_L_VAL:
+          /* digit_l_min expires: onhook has lasted long enough to be a
+             certain low pulse (not noise). The next state is the overlap with
+--- a/src/drv_tapi_event.c
++++ b/src/drv_tapi_event.c
+@@ -1545,6 +1545,7 @@ IFX_int32_t IFX_TAPI_Event_Dispatch_ProcessCtx(IFX_TAPI_EXT_EVENT_PARAM_t*
+                   /**\todo put in device fifo */
+                   pEvent->ch = IFX_TAPI_DEVICE_CH_NUMBER;
+                   /*lint -fallthrough */
++                  fallthrough;
+                case  IFX_TAPI_ERRSRC_LL_CH:
+                   pEvent->data.value |= IFX_TAPI_ERRSRC_LL;
+                   break;
+--- a/src/drv_tapi_ioctl.c
++++ b/src/drv_tapi_ioctl.c
+@@ -1552,6 +1553,7 @@ static IFX_int32_t  TAPI_IoctlCh (IFX_TAPI_DRV_CTX_t* pDrvCtx,
+       /* Dial Services */
+          ret = TAPI_statusNotSupported;
+          /*lint -fallthrough*/
++         fallthrough;
+       default:
+          bHandled = IFX_FALSE;
+          break;
diff --git a/package/kernel/lantiq/ltq-tapi/patches/601-fix-compilation-warning-ret-not-handled.patch b/package/kernel/lantiq/ltq-tapi/patches/601-fix-compilation-warning-ret-not-handled.patch
new file mode 100644
index 00000000000000..b97ced30f8076c
--- /dev/null
+++ b/package/kernel/lantiq/ltq-tapi/patches/601-fix-compilation-warning-ret-not-handled.patch
@@ -0,0 +1,12 @@
+--- a/src/drv_tapi_ioctl.c
++++ b/src/drv_tapi_ioctl.c
+@@ -702,7 +702,8 @@ static IFX_int32_t TAPI_IoctlDev (IFX_TAPI_DRV_CTX_t* pDrvCtx,
+ 
+                if (ret == TAPI_statusOk || ret == 1)
+                {
+-                  copy_to_user ((IFX_void_t*)ioarg, p_tmp, sizeof(IFX_TAPI_CAP_t));
++                  if (copy_to_user ((IFX_void_t*)ioarg, p_tmp, sizeof(IFX_TAPI_CAP_t)))
++                     ret = TAPI_statusErrKernCpy;
+                }
+             }
+             TAPI_OS_Free (p_tmp);
diff --git a/package/kernel/lantiq/ltq-vdsl-vr11-mei/Makefile b/package/kernel/lantiq/ltq-vdsl-vr11-mei/Makefile
new file mode 100644
index 00000000000000..f2dcf8db84d573
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr11-mei/Makefile
@@ -0,0 +1,113 @@
+# Copyright (C) 2012 OpenWrt.org
+# Copyright (C) 2015-2016 Lantiq Beteiligungs GmbH & Co KG.
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_NAME:=ltq-vdsl-vr11-mei
+PKG_VERSION:=1.11.1
+PKG_RELEASE:=2
+PKG_BASE_NAME:=dsl_cpe_mei
+
+UGW_VERSION=8.5.2.10
+UGW_BASENAME=$(PKG_BASE_NAME)-ugw_$(UGW_VERSION)
+
+PKG_SOURCE:=$(UGW_BASENAME).tar.bz2
+PKG_SOURCE_URL:=https://gitlab.com/prpl-foundation/intel/$(PKG_BASE_NAME)/-/archive/ugw_$(UGW_VERSION)/
+PKG_HASH:=337614473d50ed64de010adaed99a16103e08eea8fc67fe9d6caf155bea33d1d
+PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(UGW_BASENAME)
+PKG_LICENSE:=GPL-2.0 BSD-2-Clause
+PKG_LICENSE_FILES:=LICENSE
+PKG_EXTMOD_SUBDIRS:=src
+
+PKG_FIXUP:=autoreconf
+PKG_FLAGS:=nonshared
+
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/ltq-vdsl-vr11-mei
+  TITLE:=mei driver for vdsl
+  SECTION:=sys
+  SUBMENU:=Network Devices
+  DEPENDS:=@TARGET_ipq40xx +kmod-ltq-ifxos +kmod-vrx518_tc
+  FILES:=$(PKG_BUILD_DIR)/src/drv_mei_cpe.ko
+  AUTOLOAD:=$(call AutoLoad,50,drv_mei_cpe)
+endef
+
+define KernelPackage/ltq-vdsl-vr11-mei/description
+  Lantiq MEI CPE Kernel Module Driver
+endef
+
+
+define Package/ltq-vdsl-vr11-mei-test
+  SECTION:=net
+  CATEGORY:=Network
+  TITLE:=Lantiq mei driver test tool
+  URL:=http://www.lantiq.com/
+  DEPENDS:=@TARGET_ipq40xx +kmod-ltq-vdsl-vr11-mei
+endef
+
+define Package/ltq-vdsl-vr11-mei-test/description
+  Userland tool to directly control the mei driver, this is only needed
+  for test and development purposes.
+endef
+
+MAKE_FLAGS += \
+	$(KERNEL_MAKE_FLAGS) \
+	SHELL="$(BASH)"
+
+# ltq-vdsl-app uses a header provided by the MEI driver which has some
+# conditionals.
+# Define the conditionals here to have the same view on both sides. If you
+# change them, you need to change them for the ltq-vdsl-app as well
+MEI_DRV_CFLAGS = \
+	-DMEI_DRV_ATM_PTM_INTERFACE_ENABLE=1 \
+	-DMEI_SUPPORT_DEBUG_STREAMS=1 \
+	-DMEI_SUPPORT_OPTIMIZED_FW_DL=1
+
+#MEI_DRV_CFLAGS+= \
+#	-DMEI_SUPPORT_OPTIMIZED_FW_DL=0 \
+#	-DIRQ_POLLING_FORCE=99
+
+CONFIGURE_ARGS += \
+	--enable-debug-logger-support=no
+#	--enable-debug-stream-support=no
+
+# This looks weird, but it's necessary to address the right device.
+# (pdev->dev.parent instead of pdev->dev)
+MEI_DRV_CFLAGS+= \
+	-DMEI_TARGET_x86=1
+
+CONFIGURE_ARGS += \
+	--enable-kernelincl="$(LINUX_DIR)/include" \
+	--enable-device=vr11 \
+	--enable-debug \
+	--enable-error_print \
+	--enable-ifxos-include="-I$(STAGING_DIR)/usr/include/ifxos/" \
+	--enable-ifxos-library="-L$(STAGING_DIR)/usr/lib" \
+	--enable-add_drv_cflags="$(MEI_DRV_CFLAGS)" \
+	--enable-linux-26 \
+	--enable-kernelbuild="$(LINUX_DIR)" \
+	--enable-drv_test_appl=yes \
+	ARCH=$(LINUX_KARCH)
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include/vdsl
+	$(CP) $(PKG_BUILD_DIR)/src/drv_mei_cpe_api_intern.h $(1)/usr/include/vdsl/
+	$(CP) $(PKG_BUILD_DIR)/src/drv_mei_cpe_api_atm_ptm_intern.h $(1)/usr/include/vdsl/
+	$(CP) $(PKG_BUILD_DIR)/src/drv_mei_cpe_interface.h $(1)/usr/include/vdsl
+	$(CP) $(PKG_BUILD_DIR)/src/drv_mei_cpe_config.h $(1)/usr/include/vdsl/
+	$(CP) $(PKG_BUILD_DIR)/src/cmv_message_format.h $(1)/usr/include/vdsl/
+endef
+
+$(eval $(call KernelPackage,ltq-vdsl-vr11-mei))
+
+define Package/ltq-vdsl-vr11-mei-test/install
+	$(INSTALL_DIR) $(1)/bin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/mei_cpe_drv_test $(1)/bin
+endef
+
+$(eval $(call BuildPackage,ltq-vdsl-vr11-mei-test))
diff --git a/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/001-fix-compile.patch b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/001-fix-compile.patch
new file mode 100644
index 00000000000000..ff46b1f0886b7e
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/001-fix-compile.patch
@@ -0,0 +1,88 @@
+--- a/src/drv_mei_cpe_linux.c
++++ b/src/drv_mei_cpe_linux.c
+@@ -1534,7 +1534,7 @@ struct proc_entry {
+    char name[32];
+    proc_rd_callback_t rd;
+    proc_wr_callback_t wr;
+-   struct file_operations ops;
++   struct proc_ops ops;
+    int entity;
+ };
+ 
+@@ -2068,16 +2068,15 @@ static int mei_proc_single_open(struct i
+ static void mei_proc_entry_create(struct proc_dir_entry *parent_node,
+                                   struct proc_entry *proc_entry)
+ {
+-   memset(&proc_entry->ops, 0, sizeof(struct file_operations));
+-   proc_entry->ops.owner = THIS_MODULE;
++   memset(&proc_entry->ops, 0, sizeof(struct proc_ops));
+ 
+-   proc_entry->ops.open = mei_proc_single_open;
+-   proc_entry->ops.release = single_release;
++   proc_entry->ops.proc_open = mei_proc_single_open;
++   proc_entry->ops.proc_release = single_release;
+ 
+-   proc_entry->ops.read = seq_read;
+-   proc_entry->ops.llseek = seq_lseek;
++   proc_entry->ops.proc_read = seq_read;
++   proc_entry->ops.proc_lseek = seq_lseek;
+    if (proc_entry->wr)
+-      proc_entry->ops.write = proc_entry->wr;
++      proc_entry->ops.proc_write = proc_entry->wr;
+ 
+    proc_create_data(proc_entry->name,
+                      (S_IFREG | S_IRUGO),
+--- a/src/drv_mei_cpe_linux.h
++++ b/src/drv_mei_cpe_linux.h
+@@ -31,6 +31,7 @@
+ #include <linux/module.h>
+ 
+ #include <linux/sched.h>
++#include <linux/sched/signal.h>
+ #include <linux/interrupt.h>
+ #include <linux/version.h>
+ #include <linux/crc32.h>
+@@ -122,7 +123,7 @@ typedef int (*MEI_RequestIrq_WrapLinux_t
+ /**
+    Function typedef for the Linux free_irq()
+ */
+-typedef void (*MEI_FreeIrq_WrapLinux_t)( unsigned int usedIrq,
++typedef const void *(*MEI_FreeIrq_WrapLinux_t)( unsigned int usedIrq,
+                                            void *usedDevId );
+ 
+ 
+--- a/src/drv_mei_cpe_linux_proc_config.c
++++ b/src/drv_mei_cpe_linux_proc_config.c
+@@ -1277,13 +1277,12 @@ static int mei_proc_single_open(struct i
+ 	return single_open(file, mei_seq_single_show, PDE_DATA(inode));
+ }
+ 
+-static struct file_operations proc_ops = {
+-   .owner = THIS_MODULE,
+-   .open = mei_proc_single_open,
+-   .release = single_release,
+-   .read = seq_read,
+-   .llseek = seq_lseek,
+-   .write = MEI_ProcWriteConfig
++static struct proc_ops proc_ops = {
++   .proc_open = mei_proc_single_open,
++   .proc_release = single_release,
++   .proc_read = seq_read,
++   .proc_lseek = seq_lseek,
++   .proc_write = MEI_ProcWriteConfig
+ };
+ 
+ /**
+--- a/src/mei_cpe_appl_osmap.h
++++ b/src/mei_cpe_appl_osmap.h
+@@ -38,10 +38,6 @@ extern "C"
+ #include <errno.h>
+ #include <ctype.h>
+ #include <sys/ioctl.h>
+-
+-extern int snprintf (char *__restrict __s, size_t __maxlen,
+-           __const char *__restrict __format, ...)
+-     __THROW __attribute__ ((__format__ (__printf__, 3, 4)));
+ #endif
+ 
+ /* ==========================================================================
diff --git a/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/010-warnings.patch b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/010-warnings.patch
new file mode 100644
index 00000000000000..f6ee2f7f8bb46c
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/010-warnings.patch
@@ -0,0 +1,20 @@
+--- a/src/drv_mei_cpe_dbg_driver.c
++++ b/src/drv_mei_cpe_dbg_driver.c
+@@ -309,7 +309,7 @@ MEI_STATIC IFX_void_t MEI_DbgMsgDumpLogW
+    IFX_int32_t i;
+    unsigned short paylSize;
+    union {IFX_uint8_t  d8[2]; IFX_uint16_t d16;} temp16;
+-   union {IFX_uint8_t  d8[4]; IFX_uint16_t d32;} temp32;
++   union {IFX_uint8_t  d8[4]; IFX_uint32_t d32;} temp32;
+ 
+    MEI_DbgMsgDumpLogLabel(pCmvMsg, fctOpCode);
+ 
+@@ -368,7 +368,7 @@ MEI_STATIC IFX_void_t MEI_DbgMsgDumpTrcW
+    IFX_int32_t i;
+    unsigned short paylSize;
+    union {IFX_uint8_t  d8[2]; IFX_uint16_t d16;} temp16;
+-   union {IFX_uint8_t  d8[4]; IFX_uint16_t d32;} temp32;
++   union {IFX_uint8_t  d8[4]; IFX_uint32_t d32;} temp32;
+ 
+    MEI_DbgMsgDumpTraceLabel(pCmvMsg, fctOpCode);
+ 
diff --git a/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/020-not-leak-cflags.patch b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/020-not-leak-cflags.patch
new file mode 100644
index 00000000000000..f6fb48ed6ea7ee
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/020-not-leak-cflags.patch
@@ -0,0 +1,12 @@
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -213,8 +213,7 @@ drv_mei_cpe_common_cflags = $(AM_CFLAGS)
+ else
+ 
+ drv_mei_cpe_common_cflags = \
+-	$(AM_CFLAGS) -D__KERNEL__ -DLINUX -D__linux__ -DMODULE -DEXPORT_SYMTAB \
+-	-pipe -Wall -Wimplicit -Wunused -Wuninitialized -Wstrict-aliasing -Wno-date-time
++	-D__KERNEL__ -DLINUX -D__linux__ -DMODULE -DEXPORT_SYMTAB
+ 
+ endif
+ 
diff --git a/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/100-compat.patch b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/100-compat.patch
new file mode 100644
index 00000000000000..a2e42ccb03fa22
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/100-compat.patch
@@ -0,0 +1,10 @@
+--- a/src/drv_mei_cpe_linux.c
++++ b/src/drv_mei_cpe_linux.c
+@@ -4530,7 +4530,6 @@ module_exit (MEI_module_exit);
+ #ifdef MODULE
+ MODULE_AUTHOR("www.lantiq.com");
+ MODULE_DESCRIPTION("MEI CPE Driver - www.lantiq.com");
+-MODULE_SUPPORTED_DEVICE("MEI CPE Interface");
+ MODULE_LICENSE ("GPL");
+ #endif /* #ifdef MODULE*/
+ 
diff --git a/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/101_no-date-time.patch b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/101_no-date-time.patch
new file mode 100644
index 00000000000000..18918b9956c87e
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/101_no-date-time.patch
@@ -0,0 +1,13 @@
+--- a/src/drv_mei_cpe_linux.c
++++ b/src/drv_mei_cpe_linux.c
+@@ -1556,8 +1556,8 @@ static void MEI_GetVersionProc(struct se
+    }
+ 
+    seq_printf(s, "%s" MEI_DRV_CRLF, &MEI_WHATVERSION[4]);
+-   seq_printf(s, "Compiled on %s, %s for Linux kernel %s (jiffies: %ld)" MEI_DRV_CRLF,
+-                                    __DATE__, __TIME__, UTS_RELEASE, jiffies);
++   seq_printf(s, "Compiled for Linux kernel %s (jiffies: %ld)" MEI_DRV_CRLF,
++                                    UTS_RELEASE, jiffies);
+ }
+ 
+ /**
diff --git a/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/110-reset-g_tx_link_rate-on-showtime-exit.patch b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/110-reset-g_tx_link_rate-on-showtime-exit.patch
new file mode 100644
index 00000000000000..f57b8f076fb945
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/110-reset-g_tx_link_rate-on-showtime-exit.patch
@@ -0,0 +1,12 @@
+--- a/src/drv_mei_cpe_api_atm_ptm_intern.c
++++ b/src/drv_mei_cpe_api_atm_ptm_intern.c
+@@ -152,6 +152,9 @@ IFX_int32_t MEI_InternalXtmSwhowtimeExit
+    /* Get line number*/
+    dslLineNum = pMeiDynCntrl->pMeiDev->meiDrvCntrl.dslLineNum;
+ 
++   g_tx_link_rate[dslLineNum][0] = 0;
++   g_tx_link_rate[dslLineNum][1] = 0;
++
+ #ifdef PPA_SUPPORTS_CALLBACKS
+    /* get NULL or function pointer */
+    mei_showtime_exit =
diff --git a/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/120-remove-debug-printk.patch b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/120-remove-debug-printk.patch
new file mode 100644
index 00000000000000..24db470c4ae237
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/120-remove-debug-printk.patch
@@ -0,0 +1,10 @@
+--- a/src/drv_mei_cpe_mei_access_vrx.c
++++ b/src/drv_mei_cpe_mei_access_vrx.c
+@@ -1691,7 +1691,6 @@ IFX_int32_t MEI_InterfaceDetect(
+    {
+       MEI_REG_ACCESS_ME_VERSION_SET(pMeiDrvCntrl, 0x00000000);
+       hwVers = MEI_REG_ACCESS_ME_VERSION_GET(pMeiDrvCntrl);
+-      printk ("hwVers=0x%08X\n", hwVers);
+ 
+       if (MEI_DEVICE_CFG_IS_PLATFORM(e_MEI_DEV_PLATFORM_CONFIG_VR9))
+       {
diff --git a/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/121-cpe-api-intern-dynamically-allocate-dump-msg.patch b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/121-cpe-api-intern-dynamically-allocate-dump-msg.patch
new file mode 100644
index 00000000000000..40ba73f66bb56f
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/121-cpe-api-intern-dynamically-allocate-dump-msg.patch
@@ -0,0 +1,99 @@
+--- a/src/drv_mei_cpe_api_intern.c
++++ b/src/drv_mei_cpe_api_intern.c
+@@ -421,7 +421,9 @@ IFX_int32_t MEI_InternalMsgSend(
+    return retVal;
+ }
+ 
+-static IFX_void_t MEI_Internal_DumpMessage(
++#define MEI_Internal_DumpMessage_bufSize  10
++
++static IFX_int32_t MEI_Internal_DumpMessage(
+                               MEI_DYN_CNTRL_T      *pMeiDynCntrl,
+                               const IFX_uint16_t   nMsgId,
+                               const IFX_uint16_t   *pData,
+@@ -435,15 +437,20 @@ static IFX_void_t MEI_Internal_DumpMessa
+    IFX_uint8_t i;
+    const IFX_uint32_t nCommonPayloadSize = 5*nSize/2;
+    const IFX_uint8_t nInfoSize = 35;
+-   const IFX_uint8_t nBufSize = 10;
+    IFX_uint32_t nMsgSize = nCommonPayloadSize + nInfoSize;
+    IFX_uint32_t nCharsWrittenToBuf = 0;
+-   char msg[nMsgSize];
+-   char buf[nBufSize];
++   char *msg;
++   char buf[MEI_Internal_DumpMessage_bufSize];
+ 
+    if((pData == IFX_NULL) || (nSize < 4))
+    {
+-      return ;
++      return 0;
++   }
++
++   msg = kcalloc(nMsgSize, sizeof(*msg), GFP_KERNEL);
++   if (!msg)
++   {
++      return -ENOMEM;
+    }
+ 
+    pMsg16 = (IFX_uint16_t*)(pData+2);
+@@ -464,7 +471,8 @@ static IFX_void_t MEI_Internal_DumpMessa
+       /* 32-bit payload elements */
+       for (i=0; i<((nSize-4)/4); i++)
+       {
+-         nCharsWrittenToBuf = snprintf(buf, nBufSize, " %08X", pMsg32[i]);
++         nCharsWrittenToBuf = snprintf(buf, MEI_Internal_DumpMessage_bufSize,
++                                       " %08X", pMsg32[i]);
+          strncat(msg, buf, nMsgSize);
+          nMsgSize -= nCharsWrittenToBuf;
+       }
+@@ -474,7 +482,8 @@ static IFX_void_t MEI_Internal_DumpMessa
+       /* 16-bit payload elements */
+       for (i=0; i<((nSize-4)/2); i++)
+       {
+-         nCharsWrittenToBuf = snprintf(buf, nBufSize, " %04X", pMsg16[i]);
++         nCharsWrittenToBuf = snprintf(buf, MEI_Internal_DumpMessage_bufSize,
++                                       " %04X", pMsg16[i]);
+          strncat(msg, buf, nMsgSize);
+          nMsgSize -= nCharsWrittenToBuf;
+       }
+@@ -482,6 +491,10 @@ static IFX_void_t MEI_Internal_DumpMessa
+    strncat(msg, MEI_DRV_CRLF, nMsgSize);
+ 
+    PRN_DBG_USR_RAW(MEI_MSG_DUMP_API, dbg_level, (msg));
++
++   kfree(msg);
++
++   return 0;
+ }
+ 
+ IFX_int32_t MEI_InternalSendMessage(
+@@ -503,18 +516,25 @@ IFX_int32_t MEI_InternalSendMessage(
+    msg.ack_msg.pPayload = (unsigned char *)pDataAck;
+    msg.ack_msg.paylSize_byte = nLenAck;
+ 
+-   MEI_Internal_DumpMessage(pMeiDynCntrl, msg.write_msg.msgId,
++   ret = MEI_Internal_DumpMessage(pMeiDynCntrl, msg.write_msg.msgId,
+       (IFX_uint16_t *)msg.write_msg.pPayload, msg.write_msg.paylSize_byte,
+       IFX_FALSE, MEI_DRV_PRN_LEVEL_NORMAL);
+ 
++   if (ret < 0)
++   {
++      return ret;
++   }
++
+    ret = MEI_InternalMsgSend(pMeiDynCntrl, &msg);
+ 
+-   if (ret >= 0)
++   if (ret < 0)
+    {
+-      MEI_Internal_DumpMessage(pMeiDynCntrl, msg.ack_msg.msgId,
++      return ret;
++   }
++
++   ret = MEI_Internal_DumpMessage(pMeiDynCntrl, msg.ack_msg.msgId,
+          (IFX_uint16_t *)msg.ack_msg.pPayload, msg.ack_msg.paylSize_byte,
+          IFX_TRUE, MEI_DRV_PRN_LEVEL_NORMAL);
+-   }
+ 
+    return ret;
+ }
diff --git a/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/122-cp_linux-fix-compilation-warning.patch b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/122-cp_linux-fix-compilation-warning.patch
new file mode 100644
index 00000000000000..63a530b6c516cc
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/122-cp_linux-fix-compilation-warning.patch
@@ -0,0 +1,52 @@
+--- a/src/drv_mei_cpe_linux.c	
++++ b/src/drv_mei_cpe_linux.c
+@@ -1267,7 +1267,9 @@ static long MEI_Ioctl( struct file *filp,
+ MEI_IOCTL_RETURN:
+ 
+    local_args.drv_ioctl.retCode = ret;
+-   copy_to_user( ((IOCTL_MEI_arg_t *)nArgument), &local_args, retSize);
++   if (copy_to_user( ((IOCTL_MEI_arg_t *)nArgument), &local_args, retSize))
++      PRN_ERR_USR_NL( MEI_DRV, MEI_DRV_PRN_LEVEL_ERR,
++             ("MEI_DRV[??] Error ioctl - copy_to_user failed!" MEI_DRV_CRLF));
+ 
+    return (ret < 0) ? -1 : 0;
+ }
+@@ -3571,9 +3573,11 @@ static int MEI_IoctlMeiDbgAccessWr_Wrap(
+    ret =  MEI_IoctlMeiDbgAccessWr( pMeiDynCntrl, pLocalArgument);
+ 
+    /* return arguments - count */
+-   copy_to_user( (void *)&pUserArgument->count,
++   if (copy_to_user( (void *)&pUserArgument->count,
+                  (void *)&pLocalArgument->count,
+-                 sizeof(pUserArgument->count) ) ;
++                 sizeof(pUserArgument->count) ))
++      PRN_ERR_USR_NL( MEI_DRV, MEI_DRV_PRN_LEVEL_ERR,
++             ("MEI_DRV[??] Error ioctl - copy_to_user failed!" MEI_DRV_CRLF));
+ 
+    return ret;
+ }
+@@ -3600,16 +3604,20 @@ static int MEI_IoctlMeiDbgAccessRd_Wrap(
+    if ( pLocalArgument->count )
+    {
+       /* return the buffer */
+-      copy_to_user( pUserBuf,
++      if (copy_to_user( pUserBuf,
+                     pLocalArgument->pData_32,
+-                    pLocalArgument->count * sizeof(IFX_uint32_t) ) ;
++                    pLocalArgument->count * sizeof(IFX_uint32_t) ))
++         PRN_ERR_USR_NL( MEI_DRV, MEI_DRV_PRN_LEVEL_ERR,
++             ("MEI_DRV[??] Error ioctl - copy_to_user failed!" MEI_DRV_CRLF));
+ 
+    }
+ 
+    /* return count argument */
+-   copy_to_user( (void *)&pUserArgument->count,
++   if (copy_to_user( (void *)&pUserArgument->count,
+                  (void *)&pLocalArgument->count,
+-                 sizeof(pUserArgument->count) ) ;
++                 sizeof(pUserArgument->count) ))
++      PRN_ERR_USR_NL( MEI_DRV, MEI_DRV_PRN_LEVEL_ERR,
++             ("MEI_DRV[??] Error ioctl - copy_to_user failed!" MEI_DRV_CRLF));
+ 
+    return ret;
+ }
diff --git a/package/kernel/lantiq/ltq-vdsl-vr11/Makefile b/package/kernel/lantiq/ltq-vdsl-vr11/Makefile
new file mode 100644
index 00000000000000..8284cba9a7f082
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr11/Makefile
@@ -0,0 +1,80 @@
+# Copyright (C) 2012 OpenWrt.org
+# Copyright (C) 2015-2016 Lantiq Beteiligungs GmbH & Co KG.
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_NAME:=ltq-vdsl-vr11
+PKG_VERSION:=4.23.1
+PKG_RELEASE:=2
+PKG_BASE_NAME:=dsl_cpe_api
+
+UGW_VERSION=8.5.2.10
+UGW_BASENAME=$(PKG_BASE_NAME)-ugw_$(UGW_VERSION)
+
+PKG_SOURCE:=$(UGW_BASENAME).tar.bz2
+PKG_SOURCE_URL:=https://gitlab.com/prpl-foundation/intel/$(PKG_BASE_NAME)/-/archive/ugw_$(UGW_VERSION)/
+PKG_HASH:=5e8bbab841d67dc16e329d9b3774f6db4189dd1d01f575d0e921ccf2c426dd9f
+PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(UGW_BASENAME)
+PKG_LICENSE:=GPL-2.0 BSD-2-Clause
+PKG_LICENSE_FILES:=LICENSE
+
+PKG_FIXUP:=autoreconf
+
+include $(INCLUDE_DIR)/package.mk
+
+# TODO this driver depends on the vrx518 dsl firmware, add this dependency if
+# that ever gets a compatible license
+define KernelPackage/ltq-vdsl-vr11
+  TITLE:=vdsl driver
+  SECTION:=sys
+  SUBMENU:=Network Devices
+  DEPENDS:=@TARGET_ipq40xx +kmod-ltq-vdsl-vr11-mei
+  FILES:=$(PKG_BUILD_DIR)/src/drv_dsl_cpe_api.ko
+  AUTOLOAD:=$(call AutoLoad,51,drv_dsl_cpe_api)
+endef
+
+define Package/ltq-vdsl-vr11/description
+  This package contains the Lantiq DSL CPE API driver.
+
+  Supported Devices:
+  - VRX500 Family
+endef
+
+MAKE_FLAGS += \
+	$(KERNEL_MAKE_FLAGS) \
+	SHELL="$(BASH)"
+
+CONFIGURE_ARGS += \
+	--enable-add-drv-cflags="" \
+	--enable-add_ext_drv_cflags="-DDSL_DRV_ATM_PTM_INTERFACE_ENABLE=1" \
+	--enable-debug-logger-support=no
+
+CONFIGURE_ARGS += --enable-kernel-include="$(LINUX_DIR)/include" \
+	--enable-vrx \
+	--enable-vrx-device=vr11 \
+	--enable-ifxos \
+	--enable-ifxos-include="-I$(STAGING_DIR)/usr/include/ifxos" \
+	--enable-driver-include="-I$(STAGING_DIR)/usr/include/vdsl" \
+	--enable-linux-26 \
+	--enable-kernelbuild="$(LINUX_DIR)" \
+	--enable-debug-prints=no \
+	ARCH=$(LINUX_KARCH)
+
+CONFIGURE_ARGS += \
+	--enable-model=full \
+	--enable-dsl-ceoc=no
+#CONFIGURE_ARGS += --enable-model=lite
+#CONFIGURE_ARGS += --enable-model=footprint
+#CONFIGURE_ARGS += --enable-model=typical
+#CONFIGURE_ARGS += --enable-model=debug
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include/drv_vdsl_cpe_api
+	$(CP) $(PKG_BUILD_DIR)/src/include/drv_dsl_cpe*.h $(1)/usr/include/drv_vdsl_cpe_api/
+endef
+
+$(eval $(call KernelPackage,ltq-vdsl-vr11))
diff --git a/package/kernel/lantiq/ltq-vdsl-vr11/patches/001-fix-compile.patch b/package/kernel/lantiq/ltq-vdsl-vr11/patches/001-fix-compile.patch
new file mode 100644
index 00000000000000..709c3766ded659
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr11/patches/001-fix-compile.patch
@@ -0,0 +1,84 @@
+--- a/src/include/drv_dsl_cpe_os_linux.h
++++ b/src/include/drv_dsl_cpe_os_linux.h
+@@ -36,6 +36,7 @@
+ #endif
+ 
+ #include <linux/sched.h>
++#include <linux/sched/signal.h>
+ 
+ #if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,33))
+    #if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,17))
+--- a/configure.in
++++ b/configure.in
+@@ -422,7 +422,7 @@ AC_ARG_ENABLE(debug-prints,
+             AC_SUBST([DSL_DBG_MAX_LEVEL_SET],[no])
+ 
+             AC_SUBST([DSL_DBG_MAX_LEVEL_PRE],[n/a])
+-            AC_SUBST([INCLUDE_DSL_CPE_DEBUG_LOGGER_SUPPORT],[no])
++            AC_SUBST([INCLUDE_DSL_CPE_DEBUG_LOGGER_SUPPORT],[yes])
+             ;;
+         no | none )
+             AC_DEFINE(DSL_DEBUG_DISABLE,,[Disabled debug prints])
+@@ -433,7 +433,7 @@ AC_ARG_ENABLE(debug-prints,
+             AC_SUBST([DSL_DBG_MAX_LEVEL_SET],[no])
+ 
+             AC_SUBST([DSL_DBG_MAX_LEVEL_PRE],[n/a])
+-            AC_SUBST([INCLUDE_DSL_CPE_DEBUG_LOGGER_SUPPORT],[yes])
++            AC_SUBST([INCLUDE_DSL_CPE_DEBUG_LOGGER_SUPPORT],[no])
+             ;;
+         prn | 0x1 )
+             AC_SUBST([DSL_DEBUG_DISABLE],[no])
+--- a/src/common/drv_dsl_cpe_api.c
++++ b/src/common/drv_dsl_cpe_api.c
+@@ -88,8 +88,12 @@ static DSL_uint32_t g_VRxPD_IOctlWhiteli
+    DSL_FIO_BAND_PLAN_STATUS_GET,
+    DSL_FIO_DBG_MODULE_LEVEL_GET,
+    DSL_FIO_DBG_MODULE_LEVEL_SET,
++#ifdef INCLUDE_DSL_CPE_DEBUG_LOGGER_SUPPORT
++#ifndef DSL_DEBUG_DISABLE
+    DSL_FIO_DBG_MODULE_DESTINATION_GET,
+    DSL_FIO_DBG_MODULE_DESTINATION_SET,
++#endif /* DSL_DEBUG_DISABLE*/
++#endif /* INCLUDE_DSL_CPE_DEBUG_LOGGER_SUPPORT */
+    DSL_FIO_OPERATOR_CONFIG_GET,
+    DSL_FIO_OPERATOR_CONFIG_SET,
+    /* Delimeter only. Keep it! */
+--- a/src/common/drv_dsl_cpe_os_linux.c
++++ b/src/common/drv_dsl_cpe_os_linux.c
+@@ -625,7 +625,7 @@ DSL_void_t* DSL_DRV_VMalloc(
+    DSL_DRV_size_t    nSize)
+ {
+    /* VRX500-BU: Better to use vmalloc or vzmalloc here?! */
+-   return __vmalloc((unsigned long)nSize, GFP_KERNEL, PAGE_KERNEL);
++   return __vmalloc((unsigned long)nSize, GFP_KERNEL);
+    /*   return vmalloc(nSize);*/
+ }
+ 
+--- a/src/include/drv_dsl_cpe_debug.h
++++ b/src/include/drv_dsl_cpe_debug.h
+@@ -99,6 +99,7 @@ DSL_void_t DSL_DRV_ErrorSet(DSL_void_t *
+    /** Terminate execution if assertion fails */
+    #define DSL_ASSERT(exp)                 ((void)0)
+ 
++   #define DSL_DEBUG_LIMIT(level, body)    ((void)0)
+ #else
+ 
+    #define DSL_DEBUG_SET_ERROR(code) DSL_DRV_ErrorSet(pContext, code);
+--- a/src/pm/drv_dsl_cpe_pm_core.c
++++ b/src/pm/drv_dsl_cpe_pm_core.c
+@@ -26,6 +26,7 @@
+ #define DSL_DBG_BLOCK DSL_DBG_PM
+ 
+ #ifdef __LINUX__
++#ifndef DSL_DEBUG_DISABLE
+ #define DSL_PM_CORE_RATELIMIT_INTERVAL     20 * HZ /* for each 20 seconds */
+ #define DSL_PM_CORE_RATELIMIT_BURST        1       /* 1 occurrence */
+ /* struct ratelimit_state to be used in DSL_DEBUG_LIMIT */
+@@ -33,6 +34,7 @@ static DEFINE_RATELIMIT_STATE(
+    DSL_DBG_RATELIMIT_STRUCT_NAME(DSL_DBG_BLOCK),
+    DSL_PM_CORE_RATELIMIT_INTERVAL,
+    DSL_PM_CORE_RATELIMIT_BURST);
++#endif
+ #endif/* __LINUX__ */
+ 
+ DSL_boolean_t DSL_DRV_PM_IsPmReady(
diff --git a/package/kernel/lantiq/ltq-vdsl-vr11/patches/020-not-leak-cflags.patch b/package/kernel/lantiq/ltq-vdsl-vr11/patches/020-not-leak-cflags.patch
new file mode 100644
index 00000000000000..21fc0be18e2b9f
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr11/patches/020-not-leak-cflags.patch
@@ -0,0 +1,23 @@
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -283,10 +283,7 @@ else
+ drv_dsl_cpe_api_common_mod_cflags =
+ endif
+ 
+-drv_dsl_cpe_api_common_cflags = -DLINUX -D__LINUX__ -D__KERNEL__ -DEXPORT_SYMTAB \
+-    -pipe -Wall -Wformat -Wimplicit -Wunused -Wswitch -Wcomment -Winline \
+-    -Wuninitialized -Wparentheses -Wreturn-type \
+-    -Wstrict-prototypes -Wno-trigraphs -fno-strict-aliasing -fno-common
++drv_dsl_cpe_api_common_cflags = -DLINUX -D__LINUX__ -D__KERNEL__ -DEXPORT_SYMTAB
+ 
+ if DSL_DBG_MAX_LEVEL_SET
+ drv_dsl_cpe_api_common_cflags += -DDSL_DBG_MAX_LEVEL=$(DSL_DBG_MAX_LEVEL_PRE)
+@@ -296,7 +293,7 @@ endif
+ drv_dsl_cpe_api_target_cflags = $(ADD_DRV_CFLAGS)
+ 
+ # compile cflags
+-drv_dsl_cpe_api_compile_cflags = $(EXTRA_DRV_CFLAGS)
++drv_dsl_cpe_api_compile_cflags =
+ 
+ if !KERNEL_2_6
+ # the headerfile of linux kernels 2.6.x contain to much arithmetic
diff --git a/package/kernel/lantiq/ltq-vdsl-vr11/patches/100-compat.patch b/package/kernel/lantiq/ltq-vdsl-vr11/patches/100-compat.patch
new file mode 100644
index 00000000000000..eeda611d71591a
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr11/patches/100-compat.patch
@@ -0,0 +1,18 @@
+--- a/src/common/drv_dsl_cpe_os_linux.c
++++ b/src/common/drv_dsl_cpe_os_linux.c
+@@ -1051,12 +1051,11 @@ DSL_int32_t DSL_DRV_ThreadShutdown(
+ 
+ DSL_uint32_t DSL_DRV_SysTimeGet(DSL_uint32_t nOffset)
+ {
+-   struct timeval tv;
++   struct timespec64 now;
+    DSL_uint32_t nTime = 0;
+ 
+-   memset(&tv, 0, sizeof(tv));
+-   do_gettimeofday(&tv);
+-   nTime = (DSL_uint32_t)tv.tv_sec;
++   ktime_get_real_ts64(&now);
++   nTime = (DSL_uint32_t)now.tv_sec;
+ 
+    if ( (nOffset == 0) || (nOffset > nTime) )
+    {
diff --git a/package/kernel/lantiq/ltq-vdsl-vr11/patches/200-fix-elapsed-time.patch b/package/kernel/lantiq/ltq-vdsl-vr11/patches/200-fix-elapsed-time.patch
new file mode 100644
index 00000000000000..2734415d15ceee
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr11/patches/200-fix-elapsed-time.patch
@@ -0,0 +1,122 @@
+--- a/src/include/drv_dsl_cpe_pm_core.h
++++ b/src/include/drv_dsl_cpe_pm_core.h
+@@ -1554,9 +1554,9 @@ typedef struct
+    DSL_boolean_t bShowtimeProcessingStart;
+    /** Showtime reached flag*/
+    DSL_boolean_t bShowtimeInvTrigger;
+-   /** Current Showtime synchronization time to be used, (msec) */
++   /** Current Showtime synchronization time to be used, (sec) */
+    DSL_uint32_t nCurrShowtimeTime;
+-   /** Showtime synchronization time to be used, (msec) */
++   /** Showtime synchronization time to be used, (sec) */
+    DSL_uint32_t nElapsedShowtimeTime;
+    /** Actual Line state*/
+    DSL_LineStateValue_t nLineState;
+--- a/src/pm/drv_dsl_cpe_api_pm.c
++++ b/src/pm/drv_dsl_cpe_api_pm.c
+@@ -1633,7 +1633,7 @@ DSL_Error_t DSL_DRV_PM_ChannelCountersTo
+    }
+ 
+    /* Fill Total Counters elapsed time*/
+-   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime/DSL_PM_MSEC;
++   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime;
+ 
+    pChCounters = DSL_DRV_PM_PTR_CHANNEL_COUNTERS_TOTAL(pCounters->nChannel,pCounters->nDirection);
+ 
+@@ -1693,7 +1693,7 @@ DSL_Error_t DSL_DRV_PM_ChannelCountersEx
+    }
+ 
+    /* Fill Total Counters elapsed time*/
+-   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime/DSL_PM_MSEC;
++   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime;
+ 
+    pChCounters = DSL_DRV_PM_PTR_CHANNEL_COUNTERS_TOTAL_EXT(pCounters->nChannel);
+ 
+@@ -2764,7 +2764,7 @@ DSL_Error_t DSL_DRV_PM_DataPathCountersT
+    }
+ 
+    /* Fill Total Counters elapsed time*/
+-   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime/DSL_PM_MSEC;
++   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime;
+ 
+    pDpCounters = DSL_DRV_PM_PTR_DATAPATH_COUNTERS_TOTAL(pCounters->nChannel,pCounters->nDirection);
+ 
+@@ -3678,7 +3678,7 @@ DSL_Error_t DSL_DRV_PM_DataPathFailureCo
+    }
+ 
+    /* Fill Total Counters elapsed time*/
+-   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime/DSL_PM_MSEC;
++   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime;
+ 
+    pDpCounters = DSL_DRV_PM_PTR_DATAPATH_FAILURE_COUNTERS_TOTAL(pCounters->nChannel,pCounters->nDirection);
+ 
+@@ -4536,7 +4536,7 @@ DSL_Error_t DSL_DRV_PM_LineSecCountersTo
+    }
+ 
+    /* Fill Total Counters elapsed time*/
+-   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime/DSL_PM_MSEC;
++   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime;
+ 
+    pLineCounters = DSL_DRV_PM_PTR_LINE_SEC_COUNTERS_TOTAL(pCounters->nDirection);
+ 
+@@ -5273,7 +5273,7 @@ DSL_Error_t DSL_DRV_PM_LineInitCountersT
+    }
+ 
+    /* Fill Total Counters elapsed time*/
+-   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime/DSL_PM_MSEC;
++   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime;
+ 
+    pLinitCounters = DSL_DRV_PM_PTR_LINE_INIT_COUNTERS_TOTAL();
+ 
+@@ -5774,7 +5774,7 @@ DSL_Error_t DSL_DRV_PM_LineEventShowtime
+    }
+ 
+    /* Fill Total Counters elapsed time*/
+-   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime/DSL_PM_MSEC;
++   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime;
+ 
+    pLfCounters = DSL_DRV_PM_PTR_LINE_EVENT_SHOWTIME_COUNTERS_TOTAL(pCounters->nDirection);
+ 
+@@ -6302,7 +6302,7 @@ DSL_Error_t DSL_DRV_PM_ReTxCountersTotal
+    }
+ 
+    /* Fill Total Counters elapsed time*/
+-   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime/DSL_PM_MSEC;
++   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime;
+ 
+    pReTxCounters = DSL_DRV_PM_PTR_RETX_COUNTERS_TOTAL(pCounters->nDirection);
+ 
+--- a/src/pm/drv_dsl_cpe_pm_core.c
++++ b/src/pm/drv_dsl_cpe_pm_core.c
+@@ -78,6 +78,7 @@ static DSL_Error_t DSL_DRV_PM_SyncTimeUp
+ {
+    DSL_Error_t nErrCode = DSL_SUCCESS;
+    DSL_uint32_t msecTimeFrame = DSL_PM_COUNTER_POLLING_CYCLE,
++                secTimeFrame = DSL_PM_COUNTER_POLLING_CYCLE/DSL_PM_MSEC,
+                 nCurrMsTime = 0;
+ #ifdef INCLUDE_DSL_CPE_PM_HISTORY
+    DSL_uint32_t nCurrSysTime = 0, nPrevElapsedTime = 0;
+@@ -117,10 +118,13 @@ static DSL_Error_t DSL_DRV_PM_SyncTimeUp
+    {
+       /* Get elapsed time [msec] since the last entry*/
+       msecTimeFrame = nCurrMsTime  - DSL_DRV_PM_CONTEXT(pContext)->nLastMsTimeCheck;
++
++      /* Get elapsed time [sec] since the last entry*/
++      secTimeFrame = (nCurrMsTime/DSL_PM_MSEC) - (DSL_DRV_PM_CONTEXT(pContext)->nLastMsTimeCheck/DSL_PM_MSEC);
+    }
+ 
+    /* Get Total Elapsed Time Since the PM module startup*/
+-   DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime += msecTimeFrame;
++   DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime += secTimeFrame;
+ 
+    /* Set last time check to the current time*/
+    DSL_DRV_PM_CONTEXT(pContext)->nLastMsTimeCheck = nCurrMsTime;
+@@ -158,7 +162,7 @@ static DSL_Error_t DSL_DRV_PM_SyncTimeUp
+       else
+       {
+          /* Update current showtime elapsed time*/
+-         DSL_DRV_PM_CONTEXT(pContext)->nCurrShowtimeTime   += (msecTimeFrame/DSL_PM_MSEC);
++         DSL_DRV_PM_CONTEXT(pContext)->nCurrShowtimeTime   += secTimeFrame;
+          DSL_DRV_PM_CONTEXT(pContext)->nElapsedShowtimeTime =
+             DSL_DRV_PM_CONTEXT(pContext)->nCurrShowtimeTime;
+       }
diff --git a/package/kernel/lantiq/ltq-vdsl-vr11/patches/210-fix-us-eftrmin.patch b/package/kernel/lantiq/ltq-vdsl-vr11/patches/210-fix-us-eftrmin.patch
new file mode 100644
index 00000000000000..ad912605b68ce6
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr11/patches/210-fix-us-eftrmin.patch
@@ -0,0 +1,22 @@
+--- a/src/pm/drv_dsl_cpe_api_pm_vrx.c
++++ b/src/pm/drv_dsl_cpe_api_pm_vrx.c
+@@ -1482,9 +1482,16 @@ DSL_Error_t DSL_DRV_PM_DEV_ReTxCountersG
+       /* ignore zero value*/
+       if (nEftrMin)
+       {
+-         /* Fw Format:  kBit/s */
+-         /* API format: bit/s */
+-         pCounters->nEftrMin = nEftrMin*1000;
++         if (nDirection == DSL_NEAR_END)
++         {
++            /* Fw Format:  kBit/s */
++            /* API format: bit/s */
++            pCounters->nEftrMin = nEftrMin*1000;
++         }
++         else
++         {
++            pCounters->nEftrMin = nEftrMin;
++         }
+       }
+    }
+    else
diff --git a/package/kernel/lantiq/ltq-vdsl-vr11/patches/211-fix-compilation-warning-missing-fallthrough.patch b/package/kernel/lantiq/ltq-vdsl-vr11/patches/211-fix-compilation-warning-missing-fallthrough.patch
new file mode 100644
index 00000000000000..96e1ffef972945
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr11/patches/211-fix-compilation-warning-missing-fallthrough.patch
@@ -0,0 +1,49 @@
+--- a/src/device/drv_dsl_cpe_device_vrx.c
++++ b/src/device/drv_dsl_cpe_device_vrx.c
+@@ -8885,6 +8885,9 @@ DSL_Error_t DSL_DRV_DEV_AutobootHandleTr
+             (pContext, SYS_DBG_MSG"DSL[%02d]: ORDERLY_SHUTDOWN state reached"
+             DSL_DRV_CRLF, DSL_DEV_NUM(pContext)));
+          /* do not use break here, continue handling */
++
++         fallthrough;
++
+ #endif /* INCLUDE_DSL_CPE_API_VRX */
+       case DSL_LINESTATE_EXCEPTION:
+          if (!bPreFail)
+--- a/src/pm/drv_dsl_cpe_pm_core.c
++++ b/src/pm/drv_dsl_cpe_pm_core.c
+@@ -2355,15 +2355,19 @@ DSL_Error_t DSL_DRV_PM_CountersReset(
+       }
+ #endif /* #ifdef INCLUDE_DSL_CPE_PM_HISTORY*/
+ 
+-   if (ResetType == DSL_PM_RESET_HISTORY)
+-      break;
++      if (ResetType == DSL_PM_RESET_HISTORY)
++         break;
++
++      fallthrough;
+ 
+    case DSL_PM_RESET_TOTAL:
+ #ifdef INCLUDE_DSL_CPE_PM_TOTAL_COUNTERS
+       memset(EpData.pRecTotal, nFillValue, EpData.nEpRecElementSize);
+ #endif /* #ifdef INCLUDE_DSL_CPE_PM_TOTAL_COUNTERS*/
+-   if (ResetType == DSL_PM_RESET_TOTAL)
+-      break;
++      if (ResetType == DSL_PM_RESET_TOTAL)
++         break;
++
++      fallthrough;
+ 
+    case DSL_PM_RESET_HISTORY_SHOWTIME:
+ #ifdef INCLUDE_DSL_CPE_PM_SHOWTIME_COUNTERS
+--- a/src/common/drv_dsl_cpe_api.c
++++ b/src/common/drv_dsl_cpe_api.c
+@@ -2652,6 +2652,8 @@ DSL_Error_t DSL_DRV_AutobootControlSet(
+                /* no break */
+                /* ... pass to restart*/
+ 
++               fallthrough;
++
+ #if defined (DSL_VRX_DEVICE_VR11)
+             case DSL_AUTOBOOT_CTRL_STOP_PD:
+ #endif
diff --git a/package/kernel/lantiq/ltq-vdsl-vr9-mei/Makefile b/package/kernel/lantiq/ltq-vdsl-vr9-mei/Makefile
new file mode 100644
index 00000000000000..e9c5a681fd0098
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr9-mei/Makefile
@@ -0,0 +1,99 @@
+# Copyright (C) 2012 OpenWrt.org
+# Copyright (C) 2015-2016 Lantiq Beteiligungs GmbH & Co KG.
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_NAME:=ltq-vdsl-vr9-mei
+PKG_VERSION:=1.5.17.6
+PKG_RELEASE:=6
+
+PKG_BASE_NAME:=drv_mei_cpe
+PKG_SOURCE:=$(PKG_BASE_NAME)-$(PKG_VERSION).tar.gz
+PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(PKG_BASE_NAME)-$(PKG_VERSION)
+PKG_SOURCE_URL:=@OPENWRT
+PKG_HASH:=94f6904364348b7f74087e721968abc28b2564fb9bd8899aa930d36490387662
+PKG_FIXUP:=autoreconf
+PKG_FLAGS:=nonshared
+PKG_MAINTAINER:=John Crispin <john@phrozen.org>
+PKG_LICENSE:=GPL-2.0 BSD-2-Clause
+PKG_LICENSE_FILES:=LICENSE
+PKG_EXTMOD_SUBDIRS:=src
+
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/ltq-vdsl-vr9-mei
+  TITLE:=mei driver for vdsl
+  SECTION:=sys
+  SUBMENU:=Network Devices
+  DEPENDS:=@TARGET_lantiq_xrx200 +kmod-ltq-ifxos +kmod-ltq-vectoring
+  FILES:=$(PKG_BUILD_DIR)/src/drv_mei_cpe.ko
+  AUTOLOAD:=$(call AutoLoad,50,drv_mei_cpe)
+endef
+
+define KernelPackage/ltq-vdsl-vr9-mei/description
+	Lantiq MEI CPE Kernel Module Driver
+endef
+
+
+define Package/ltq-vdsl-vr9-mei-test
+  SECTION:=net
+  CATEGORY:=Network
+  TITLE:=Lantiq mei driver test tool
+  URL:=http://www.lantiq.com/
+  DEPENDS:=@TARGET_lantiq_xrx200
+endef
+
+define Package/ltq-vdsl-vr9-mei-test/description
+	Userland tool to directly control the mei driver, this is only needed
+	for test and development purposes.
+endef
+
+MAKE_FLAGS += \
+	$(KERNEL_MAKE_FLAGS) \
+	SHELL="$(BASH)"
+
+# ltq-vdsl-vr9-app uses a header provided by the MEI driver which has some
+# conditionals.
+# Define the conditionals here to have the same view on both sides. If you
+# change them, you need to change them for the ltq-vdsl-vr9-app as well
+MEI_DRV_CFLAGS = \
+	-DMEI_DRV_ATM_PTM_INTERFACE_ENABLE=1 \
+	-DMEI_SUPPORT_DEBUG_STREAMS=1 \
+	-DMEI_SUPPORT_OPTIMIZED_FW_DL=1
+
+CONFIGURE_ARGS += \
+	--enable-kernelincl="$(LINUX_DIR)/include" \
+	--enable-device=vr9 \
+	--with-max-device=1 \
+	--with-lines-per-device=1 \
+	--enable-debug \
+	--enable-error_print \
+	--enable-ifxos-include="-I$(STAGING_DIR)/usr/include/ifxos/" \
+	--enable-ifxos-library="-L$(STAGING_DIR)/usr/lib" \
+	--enable-add_drv_cflags="$(MEI_DRV_CFLAGS)" \
+	--enable-linux-26 \
+	--enable-kernelbuild="$(LINUX_DIR)" \
+	--enable-drv_test_appl=yes \
+	ARCH=$(LINUX_KARCH)
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include/vdsl
+	$(CP) $(PKG_BUILD_DIR)/src/drv_mei_cpe_api_intern.h $(1)/usr/include/vdsl/
+	$(CP) $(PKG_BUILD_DIR)/src/drv_mei_cpe_api_atm_ptm_intern.h $(1)/usr/include/vdsl/
+	$(CP) $(PKG_BUILD_DIR)/src/drv_mei_cpe_interface.h $(1)/usr/include/vdsl
+	$(CP) $(PKG_BUILD_DIR)/src/drv_mei_cpe_config.h $(1)/usr/include/vdsl/
+	$(CP) $(PKG_BUILD_DIR)/src/cmv_message_format.h $(1)/usr/include/vdsl/
+endef
+
+$(eval $(call KernelPackage,ltq-vdsl-vr9-mei))
+
+define Package/ltq-vdsl-vr9-mei-test/install
+	$(INSTALL_DIR) $(1)/bin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/mei_cpe_drv_test $(1)/bin
+endef
+
+$(eval $(call BuildPackage,ltq-vdsl-vr9-mei-test))
diff --git a/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/001-fix-compile.patch b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/001-fix-compile.patch
new file mode 100644
index 00000000000000..6d3e182ec48df3
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/001-fix-compile.patch
@@ -0,0 +1,44 @@
+--- a/src/drv_mei_cpe_linux.h
++++ b/src/drv_mei_cpe_linux.h
+@@ -31,6 +31,9 @@
+ #include <linux/module.h>
+ 
+ #include <linux/sched.h>
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,11,0))
++#include <linux/sched/signal.h>
++#endif
+ #include <linux/interrupt.h>
+ #include <linux/version.h>
+ #include <linux/crc32.h>
+@@ -121,7 +124,11 @@ typedef int (*MEI_RequestIrq_WrapLinux_t
+ /**
+    Function typedef for the Linux free_irq()
+ */
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,12,0))
++typedef const void *(*MEI_FreeIrq_WrapLinux_t)( unsigned int usedIrq,
++#else
+ typedef void (*MEI_FreeIrq_WrapLinux_t)( unsigned int usedIrq,
++#endif
+                                            void *usedDevId );
+ 
+ 
+--- a/src/drv_mei_cpe_linux.c
++++ b/src/drv_mei_cpe_linux.c
+@@ -129,7 +129,7 @@ static int MEI_module_init(void);
+ #endif
+ 
+ #if (MEI_DRV_LKM_ENABLE == 1) && (MEI_SUPPORT_DEVICE_VR10_320 != 1)
+-static void __exit MEI_module_exit(void);
++static void MEI_module_exit(void);
+ #else
+ static void MEI_module_exit(void);
+ #endif
+@@ -2188,7 +2188,7 @@ static int MEI_module_init (void)
+    Called by the kernel.
+ */
+ #if (MEI_DRV_LKM_ENABLE == 1) && (MEI_SUPPORT_DEVICE_VR10_320 != 1)
+-static void __exit MEI_module_exit (void)
++static void MEI_module_exit (void)
+ #else
+ static void MEI_module_exit (void)
+ #endif
diff --git a/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/010-warnings.patch b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/010-warnings.patch
new file mode 100644
index 00000000000000..9a796c65bcb7f7
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/010-warnings.patch
@@ -0,0 +1,26 @@
+--- a/src/drv_mei_cpe_api.h
++++ b/src/drv_mei_cpe_api.h
+@@ -1000,7 +1000,7 @@ typedef struct MEI_dev_s
+ #if ( defined(MEI_DRVOS_HAVE_DRV_SELECT) && (MEI_DRVOS_HAVE_DRV_SELECT == 1) )
+    /** support for select() */
+    IFX_boolean_t         bNfcNeedWakeUp;
+-   MEI_DRVOS_event_t     selNfcWakeupList;
++   IFXOS_drvSelectQueue_t     selNfcWakeupList;
+ #endif
+ 
+    /** list of all open instances which can receive NFC's, EVT's ALM's */
+--- a/src/drv_mei_cpe_linux.c
++++ b/src/drv_mei_cpe_linux.c
+@@ -1302,9 +1302,9 @@ static unsigned int MEI_Poll (struct fil
+    }
+ 
+    MEI_DRVOS_SelectQueueAddTask(
+-               (MEI_DRVOS_select_OSArg_t*) filp,
+-               (MEI_DRVOS_selectQueue_t*)  &(pMeiDev->selNfcWakeupList),
+-               (MEI_DRVOS_selectTable_t*)  wait);
++               filp,
++               &(pMeiDev->selNfcWakeupList),
++               wait);
+ 
+    if (pDynNfc->pRecvDataCntrl[pDynNfc->rdIdxRd].bufCtrl != MEI_RECV_BUF_CTRL_FREE)      /* buffer in use */
+    {
diff --git a/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/020-not-leak-cflags.patch b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/020-not-leak-cflags.patch
new file mode 100644
index 00000000000000..31dbba37b9d92a
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/020-not-leak-cflags.patch
@@ -0,0 +1,21 @@
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -213,8 +213,7 @@ drv_mei_cpe_common_cflags = $(AM_CFLAGS)
+ else
+ 
+ drv_mei_cpe_common_cflags = \
+-	$(AM_CFLAGS) -D__KERNEL__ -DLINUX -D__linux__ -DMODULE -DEXPORT_SYMTAB \
+-	-pipe -Wimplicit -Wunused -Wuninitialized -Wsign-compare -Wstrict-aliasing
++	-D__KERNEL__ -DLINUX -D__linux__ -DMODULE -DEXPORT_SYMTAB
+ 
+ endif
+ 
+@@ -354,7 +353,7 @@ drv_mei_cpe.ko: $(drv_mei_cpe_SOURCES)
+ 	@echo -e "# drv_mei_cpe: Generated to build Linux 2.6.x kernel object" > $(PWD)/Kbuild
+ 	@echo -e "obj-m := $(subst .ko,.o,$@)"			>> $(PWD)/Kbuild
+ 	@echo -e "$(subst .ko,,$@)-y := $(drv_mei_cpe_OBJS)"	>> $(PWD)/Kbuild
+-	@echo -e "EXTRA_CFLAGS := $(CFLAGS) $(drv_mei_cpe_CFLAGS) -I@abs_srcdir@ -I@abs_srcdir@/auto_header $(IFXOS_INCLUDE_PATH)" >> $(PWD)/Kbuild
++	@echo -e "EXTRA_CFLAGS := $(drv_mei_cpe_CFLAGS) -I@abs_srcdir@ -I@abs_srcdir@/auto_header $(IFXOS_INCLUDE_PATH)" >> $(PWD)/Kbuild
+ 	$(MAKE) ARCH=@KERNEL_ARCH@ -C @KERNEL_BUILD_PATH@ O=@KERNEL_BUILD_PATH@ M=$(PWD) modules
+ 
+ clean-generic:
diff --git a/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/030-no-static-linking.patch b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/030-no-static-linking.patch
new file mode 100644
index 00000000000000..8d4fca1eb1b755
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/030-no-static-linking.patch
@@ -0,0 +1,47 @@
+This removes -static compile option. The -static option tells GCC to
+link this statically with the libc, which we do not want in OpenWrt. We
+want to link everything dynamically to the libc. This fixes a compile
+problem with glibc.
+
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -198,10 +198,10 @@ AM_CFLAGS = -Wall -Wimplicit -Wunused -W
+ 
+ if IFXOS_ENABLE
+ AM_LDFLAGS= \
+-	-Bstatic -dn -static @IFXOS_LIBRARY_PATH@
++	-Bstatic -dn @IFXOS_LIBRARY_PATH@
+ else
+ AM_LDFLAGS= \
+-	-Bstatic -dn -static
++	-Bstatic -dn
+ endif
+ 
+ #
+@@ -304,7 +304,7 @@ mei_cpe_appl_ldflags= $(ADD_APPL_LDFLAGS
+ else
+ if TARGET_ADM5120_MIPSEL
+ mei_cpe_appl_cflags =  -O1 -g
+-mei_cpe_appl_ldflags = -static
++mei_cpe_appl_ldflags =
+ else
+ mei_cpe_appl_cflags =  -DPPC
+ endif
+@@ -318,7 +318,7 @@ mei_cpe_drv_test_CPPFLAGS = -I@srcdir@\
+ mei_cpe_drv_test_CFLAGS = $(mei_cpe_app_common_cflags) \
+ 				$(mei_cpe_appl_cflags) $(MEI_DRV_TARGET_OPTIONS)
+ 
+-mei_cpe_drv_test_LDFLAGS = $(mei_cpe_appl_ldflags) -Bstatic -dn -static @IFXOS_LIBRARY_PATH@
++mei_cpe_drv_test_LDFLAGS = $(mei_cpe_appl_ldflags) -Bstatic -dn @IFXOS_LIBRARY_PATH@
+ 
+ mei_cpe_drv_test_LDADD = -lifxos
+ endif
+@@ -333,7 +333,7 @@ mei_cpe_drv_dbg_strm_dmp_CPPFLAGS = -I@s
+ 				-I@KERNEL_INCL_PATH@ $(IFXOS_INCLUDE_PATH)
+ mei_cpe_drv_dbg_strm_dmp_CFLAGS = $(mei_cpe_app_common_cflags) \
+ 				$(mei_cpe_appl_cflags) $(MEI_DRV_TARGET_OPTIONS)
+-mei_cpe_drv_dbg_strm_dmp_LDFLAGS = $(mei_cpe_appl_ldflags) -Bstatic -dn -static @IFXOS_LIBRARY_PATH@
++mei_cpe_drv_dbg_strm_dmp_LDFLAGS = $(mei_cpe_appl_ldflags) -Bstatic -dn @IFXOS_LIBRARY_PATH@
+ mei_cpe_drv_dbg_strm_dmp_LDADD = -lifxos
+ 
+ # linux 2.6 kernel object - dummy to force dependencies
diff --git a/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/100-compat.patch b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/100-compat.patch
new file mode 100644
index 00000000000000..7e7381a3460f29
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/100-compat.patch
@@ -0,0 +1,472 @@
+--- a/src/drv_mei_cpe_common.c
++++ b/src/drv_mei_cpe_common.c
+@@ -19,7 +19,6 @@
+ /* get at first the driver configuration */
+ #include "drv_mei_cpe_config.h"
+ 
+-#include "ifx_types.h"
+ #include "drv_mei_cpe_os.h"
+ #include "drv_mei_cpe_dbg.h"
+ 
+--- a/src/drv_mei_cpe_linux.h
++++ b/src/drv_mei_cpe_linux.h
+@@ -60,12 +60,6 @@
+ #include <linux/poll.h>
+ #include <linux/types.h>
+ 
+-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,10,0))
+-   #include <asm/ifx/ifx_types.h>
+-#else
+-   #include <ifx_types.h>
+-#endif
+-
+ #endif /* #if (MEI_DRV_IFXOS_ENABLE == 0)*/
+ 
+ #include <linux/dma-mapping.h>
+--- a/src/drv_mei_cpe_linux.c
++++ b/src/drv_mei_cpe_linux.c
+@@ -114,6 +114,8 @@
+ 
+ #include "drv_mei_cpe_api_atm_ptm_intern.h"
+ 
++#include <lantiq_soc.h>
++
+ /* ===================================
+    extern function declarations
+    =================================== */
+@@ -220,6 +222,8 @@ static void MEI_NlSendMsg(IFX_char_t* pM
+ /* Local variables (LINUX)             */
+ /* =================================== */
+ static IFX_uint8_t major_number = 0;
++static struct class *mei_class;
++static dev_t mei_devt;
+ #ifdef MODULE
+ #if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0))
+ MODULE_PARM(major_number, "b");
+@@ -1256,7 +1260,9 @@ static long MEI_Ioctl( struct file *filp
+ MEI_IOCTL_RETURN:
+ 
+    local_args.drv_ioctl.retCode = ret;
+-   copy_to_user( ((IOCTL_MEI_arg_t *)nArgument), &local_args, retSize);
++   if ( ret == IFX_SUCCESS &&
++        copy_to_user( ((IOCTL_MEI_arg_t *)nArgument), &local_args, retSize) )
++      ret = -e_MEI_ERR_RETURN_ARG;
+ 
+    return (ret < 0) ? -1 : 0;
+ }
+@@ -1479,7 +1485,11 @@ struct proc_entry {
+    char name[32];
+    proc_rd_callback_t rd;
+    proc_wr_callback_t wr;
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(5,6,0))
+    struct file_operations ops;
++#else
++   struct proc_ops ops;
++#endif
+    int entity;
+ };
+ 
+@@ -1869,6 +1879,7 @@ static int mei_proc_single_open(struct i
+ static void mei_proc_entry_create(struct proc_dir_entry *parent_node,
+                                   struct proc_entry *proc_entry)
+ {
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(5,6,0))
+    memset(&proc_entry->ops, 0, sizeof(struct file_operations));
+    proc_entry->ops.owner = THIS_MODULE;
+ 
+@@ -1879,6 +1890,17 @@ static void mei_proc_entry_create(struct
+    proc_entry->ops.llseek = seq_lseek;
+    if (proc_entry->wr)
+       proc_entry->ops.write = proc_entry->wr;
++#else
++   memset(&proc_entry->ops, 0, sizeof(struct proc_ops));
++
++   proc_entry->ops.proc_open = mei_proc_single_open;
++   proc_entry->ops.proc_release = single_release;
++
++   proc_entry->ops.proc_read = seq_read;
++   proc_entry->ops.proc_lseek = seq_lseek;
++   if (proc_entry->wr)
++      proc_entry->ops.proc_write = proc_entry->wr;
++#endif
+ 
+    proc_create_data(proc_entry->name,
+                      (S_IFREG | S_IRUGO),
+@@ -2174,9 +2196,11 @@ static int MEI_module_init (void)
+       return (result);
+    }
+ 
++#if 0
+ #if (MEI_DRV_ATM_PTM_INTERFACE_ENABLE == 1)
+    ppa_callback_set(LTQ_MEI_SHOWTIME_CHECK, (void *)ltq_mei_showtime_check);
+ #endif /* #if (MEI_DRV_ATM_PTM_INTERFACE_ENABLE == 1) */
++#endif
+ 
+    return 0;
+ }
+@@ -2304,6 +2328,10 @@ static void MEI_module_exit (void)
+ 
+ #else
+    unregister_chrdev ( major_number , DRV_MEI_NAME );
++   device_destroy(mei_class, mei_devt);
++   mei_devt = 0;
++   class_destroy(mei_class);
++   mei_class = NULL;
+ #endif
+ 
+ #if CONFIG_PROC_FS
+@@ -2388,9 +2416,11 @@ static void MEI_module_exit (void)
+             ("MEI_DRV: Chipset Basic Exit failed" MEI_DRV_CRLF));
+    }
+ 
++#if 0
+ #if (MEI_DRV_ATM_PTM_INTERFACE_ENABLE == 1)
+    ppa_callback_set(LTQ_MEI_SHOWTIME_CHECK, (void *)NULL);
+ #endif /* #if (MEI_DRV_ATM_PTM_INTERFACE_ENABLE == 1) */
++#endif
+ 
+ #if (MEI_SUPPORT_DEBUG_LOGGER == 1)
+    if (nl_debug_sock)
+@@ -2514,6 +2544,10 @@ static int MEI_InitModuleRegCharDev(cons
+             ("Using major number %d" MEI_DRV_CRLF, major_number));
+    }
+ 
++   mei_class = class_create(THIS_MODULE, devName);
++   mei_devt = MKDEV(major_number, 0);
++   device_create(mei_class, NULL, mei_devt, NULL, "%s/%i", devName, 0);
++
+    return 0;
+ #endif      /* CONFIG_DEVFS_FS */
+ }
+@@ -2563,21 +2597,32 @@ static int MEI_InitModuleBasics(void)
+ }
+ 
+ #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,10,0))
++
++#define PMU_DFE         BIT(9)
++
+ static int MEI_SysClkEnable(struct clk *clk)
+ {
++#if 0
+    if (IS_ERR(clk))
+       return -1;
+    clk_enable(clk);
++#else
++   ltq_pmu_enable(PMU_DFE);
++#endif
+ 
+    return 0;
+ }
+ 
+ static int MEI_SysClkDisable(struct clk *clk)
+ {
++#if 0
+    if (IS_ERR(clk))
+       return -1;
+    clk_disable(clk);
+    clk_put(clk);
++#else
++   ltq_pmu_disable(PMU_DFE);
++#endif
+ 
+    return 0;
+ }
+@@ -2905,11 +2950,15 @@ IFX_int32_t MEI_IoctlInitDevice(
+             pMeiDev->eModePoll = e_MEI_DEV_ACCESS_MODE_IRQ;
+             pMeiDev->intMask   = ME_ARC2ME_INTERRUPT_UNMASK_ALL;
+ 
++#if 1
++            virq = (IFX_uint32_t)pInitDev->usedIRQ;
++#else
+ #if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0))
+             virq = (IFX_uint32_t)pInitDev->usedIRQ;
+ #else
+             virq = irq_create_mapping(NULL, (IFX_uint32_t)pInitDev->usedIRQ);
+ #endif
++#endif
+ 
+             pTmpXCntrl = MEI_VrxXDevToIrqListAdd(
+                                           MEI_DRV_LINENUM_GET(pMeiDev),
+@@ -3249,9 +3298,11 @@ static int MEI_IoctlMeiDbgAccessWr_Wrap(
+    ret =  MEI_IoctlMeiDbgAccessWr( pMeiDynCntrl, pLocalArgument);
+ 
+    /* return arguments - count */
+-   copy_to_user( (void *)&pUserArgument->count,
+-                 (void *)&pLocalArgument->count,
+-                 sizeof(pUserArgument->count) ) ;
++   if ( ret == IFX_SUCCESS &&
++        copy_to_user( (void *)&pUserArgument->count,
++                      (void *)&pLocalArgument->count,
++                      sizeof(pUserArgument->count) ) )
++      ret = -e_MEI_ERR_RETURN_ARG;
+ 
+    return ret;
+ }
+@@ -3278,16 +3329,18 @@ static int MEI_IoctlMeiDbgAccessRd_Wrap(
+    if ( pLocalArgument->count )
+    {
+       /* return the buffer */
+-      copy_to_user( pUserBuf,
+-                    pLocalArgument->pData_32,
+-                    pLocalArgument->count * sizeof(IFX_uint32_t) ) ;
++      if ( copy_to_user( pUserBuf,
++                         pLocalArgument->pData_32,
++                         pLocalArgument->count * sizeof(IFX_uint32_t) ) )
++         ret = -e_MEI_ERR_RETURN_ARG;
+ 
+    }
+ 
+    /* return count argument */
+-   copy_to_user( (void *)&pUserArgument->count,
+-                 (void *)&pLocalArgument->count,
+-                 sizeof(pUserArgument->count) ) ;
++   if ( copy_to_user( (void *)&pUserArgument->count,
++                      (void *)&pLocalArgument->count,
++                      sizeof(pUserArgument->count) ) )
++      ret = -e_MEI_ERR_RETURN_ARG;
+ 
+    return ret;
+ }
+--- a/src/drv_mei_cpe_api_atm_ptm_intern.c
++++ b/src/drv_mei_cpe_api_atm_ptm_intern.c
+@@ -147,6 +147,7 @@ IFX_int32_t MEI_InternalXtmSwhowtimeExit
+    return retVal;
+ }
+ 
++#if 0
+ IFX_int32_t MEI_InternalTcRequest(
+                               MEI_DYN_CNTRL_T        *pMeiDynCntrl,
+                               MEI_TC_Request_t       *pArgTcRequest)
+@@ -232,6 +233,7 @@ IFX_int32_t MEI_InternalTcReset(
+ 
+    return retVal;
+ }
++#endif
+ 
+ /**
+    Function that is used by the PP subsystem to get some showtime relevant data
+@@ -311,10 +313,57 @@ int ifx_mei_atm_led_blink(void)
+     return IFX_SUCCESS;
+ }
+ 
++#if MEI_MAX_DFE_CHAN_DEVICES > 1
++#error "Compat functions do not support MEI_MAX_DFE_CHAN_DEVICES > 1 yet"
++#else
++int (*ifx_mei_atm_showtime_enter)(struct port_cell_info *, void *) = NULL;
++int (*ifx_mei_atm_showtime_exit)(void) = NULL;
++
++int ltq_ifx_mei_atm_showtime_enter_compat(IFX_uint8_t dslLineNum,
++				      struct port_cell_info *cellInfo,
++				      void *xdata) {
++	if (ifx_mei_atm_showtime_enter)
++		return ifx_mei_atm_showtime_enter(cellInfo, xdata);
++
++	return -e_MEI_ERR_OP_FAILED;
++}
++
++int ltq_ifx_mei_atm_showtime_exit_compat(IFX_uint8_t dslLineNum) {
++	if (ifx_mei_atm_showtime_exit)
++		return ifx_mei_atm_showtime_exit();
++
++	return -e_MEI_ERR_OP_FAILED;
++}
++
++void* ppa_callback_get(e_ltq_mei_cb_type type) {
++	switch (type) {
++		case LTQ_MEI_SHOWTIME_ENTER:
++			return &ltq_ifx_mei_atm_showtime_enter_compat;
++		case LTQ_MEI_SHOWTIME_EXIT:
++			return &ltq_ifx_mei_atm_showtime_exit_compat;
++			break;
++	}
++
++	BUG();
++}
++
++int ifx_mei_atm_showtime_check(int *is_showtime,
++                              struct port_cell_info *port_cell,
++                              void **xdata_addr) {
++	return ltq_mei_showtime_check(0, is_showtime, port_cell, xdata_addr);
++}
++
++EXPORT_SYMBOL(ifx_mei_atm_showtime_enter);
++EXPORT_SYMBOL(ifx_mei_atm_showtime_exit);
++EXPORT_SYMBOL(ifx_mei_atm_showtime_check);
++#endif
++
+ EXPORT_SYMBOL (MEI_InternalXtmSwhowtimeEntrySignal);
+ EXPORT_SYMBOL (MEI_InternalXtmSwhowtimeExitSignal);
++#if 0
+ EXPORT_SYMBOL (MEI_InternalTcRequest);
+ EXPORT_SYMBOL (MEI_InternalTcReset);
++#endif
+ EXPORT_SYMBOL(ifx_mei_atm_led_blink);
+ 
+ #endif      /* #if (MEI_EXPORT_INTERNAL_API == 1) && (MEI_DRV_ATM_PTM_INTERFACE_ENABLE == 1) */
+--- a/src/drv_mei_cpe_api_atm_ptm_intern.h
++++ b/src/drv_mei_cpe_api_atm_ptm_intern.h
+@@ -21,7 +21,6 @@
+ 
+ #include "drv_mei_cpe_config.h"
+ #include "drv_mei_cpe_interface.h"
+-#include <net/ppa_stack_al.h>
+ 
+ #if (MEI_EXPORT_INTERNAL_API == 1) && (MEI_DRV_ATM_PTM_INTERFACE_ENABLE == 1)
+ 
+@@ -59,8 +58,21 @@ extern IFX_int32_t MEI_InternalTcReset(
+                               MEI_DYN_CNTRL_T        *pMeiDynCntrl,
+                               MEI_TC_Reset_t         *pArgTcReset);
+ 
++#if 1
++#include <lantiq_atm.h>
++typedef enum {
++	LTQ_MEI_SHOWTIME_ENTER,
++	LTQ_MEI_SHOWTIME_EXIT
++} e_ltq_mei_cb_type;
++
++typedef void (*ltq_mei_atm_showtime_enter_t)(IFX_uint8_t, struct port_cell_info *, void *);
++typedef void (*ltq_mei_atm_showtime_exit_t)(IFX_uint8_t);
++
++void* ppa_callback_get(e_ltq_mei_cb_type type);
++#else
+ extern int ppa_callback_set(e_ltq_mei_cb_type type, void *func);
+ extern void* ppa_callback_get(e_ltq_mei_cb_type type);
++#endif
+ 
+ int ltq_mei_showtime_check(
+                               const unsigned char line_idx,
+--- a/src/drv_mei_cpe_device_vrx.c
++++ b/src/drv_mei_cpe_device_vrx.c
+@@ -28,17 +28,6 @@
+ #include "drv_mei_cpe_api.h"
+ #include "drv_mei_cpe_mei_vrx.h"
+ 
+-#if defined(LINUX)
+-#  if (LINUX_VERSION_CODE < KERNEL_VERSION(3,10,0))
+-#    if (MEI_SUPPORT_DEVICE_VR10_320 != 1)
+-#       include "ifx_pcie.h"
+-#    else
+-#       include "../drivers/net/ethernet/lantiq/lantiq_pcie.h"
+-#    endif
+-#  else
+-#    include "lantiq_pcie.h"
+-#  endif
+-#endif /* #if defined(LINUX)*/
+ 
+ IFX_int32_t MEI_GPIntProcess(MEI_MeiRegVal_t processInt, MEI_DEV_T *pMeiDev)
+ {
+@@ -86,6 +75,7 @@ IFX_int32_t MEI_GetChipInfo(MEI_DEV_T *p
+ */
+ IFX_int32_t MEI_VR10_PcieEntitiesCheck(IFX_uint8_t nEntityNum)
+ {
++#if 0
+    IFX_uint32_t pcie_entitiesNum;
+ 
+    /* get information from pcie driver */
+@@ -110,6 +100,9 @@ IFX_int32_t MEI_VR10_PcieEntitiesCheck(I
+    }
+ 
+    return IFX_SUCCESS;
++#else
++   return IFX_ERROR;
++#endif
+ }
+ 
+ /**
+@@ -124,6 +117,7 @@ IFX_int32_t MEI_VR10_PcieEntitiesCheck(I
+ */
+ IFX_int32_t MEI_VR10_PcieEntityInit(MEI_MEI_DRV_CNTRL_T *pMeiDrvCntrl)
+ {
++#if 0
+    IFX_uint8_t entityNum;
+ #if (MEI_SUPPORT_DEVICE_VR10_320 != 1)
+    ifx_pcie_ep_dev_t MEI_pcie_ep_dev;
+@@ -156,6 +150,9 @@ IFX_int32_t MEI_VR10_PcieEntityInit(MEI_
+    pMeiDrvCntrl->MEI_pcie_irq = 99;
+ 
+    return IFX_SUCCESS;
++#else
++   return IFX_ERROR;
++#endif
+ }
+ 
+ /**
+@@ -170,6 +167,7 @@ IFX_int32_t MEI_VR10_PcieEntityInit(MEI_
+ */
+ IFX_int32_t MEI_VR10_PcieEntityFree(IFX_uint8_t entityNum)
+ {
++#if 0
+ #if (MEI_SUPPORT_DEVICE_VR10_320 != 1)
+    if (ifx_pcie_ep_dev_info_release(entityNum))
+ #else
+@@ -183,6 +181,9 @@ IFX_int32_t MEI_VR10_PcieEntityFree(IFX_
+    }
+ 
+    return IFX_SUCCESS;
++#else
++   return IFX_ERROR;
++#endif
+ }
+ 
+ /**
+@@ -197,6 +198,7 @@ IFX_int32_t MEI_VR10_PcieEntityFree(IFX_
+ */
+ IFX_int32_t MEI_VR10_InternalInitDevice(MEI_DYN_CNTRL_T *pMeiDynCntrl)
+ {
++#if 0
+    IFX_int32_t         retVal;
+    IOCTL_MEI_devInit_t InitDev;
+    MEI_DEV_T           *pMeiDev = pMeiDynCntrl->pMeiDev;
+@@ -221,6 +223,9 @@ IFX_int32_t MEI_VR10_InternalInitDevice(
+    *MEI_GPIO_U32REG(GPIO_P0_ALSEL1) &= ~((1 << 0) | (1 << 3) | (1 << 8));
+ 
+    return IFX_SUCCESS;
++#else
++   return IFX_ERROR;
++#endif
+ }
+ 
+ IFX_int32_t MEI_PLL_ConfigInit(MEI_DEV_T *pMeiDev)
+--- a/src/drv_mei_cpe_download_vrx.c
++++ b/src/drv_mei_cpe_download_vrx.c
+@@ -3281,12 +3281,14 @@ IFX_int32_t MEI_DEV_IoctlFirmwareDownloa
+    /* reset TC layer */
+    if (ret == 0)
+    {
++#if 0
+       if (MEI_InternalTcReset(pMeiDynCntrl, &tc_reset) != 0)
+       {
+             PRN_ERR_USR_NL( MEI_DRV, MEI_DRV_PRN_LEVEL_WRN,
+                   ("MEI_DRV[%02d]: Could not perform reset of TC-Layer!"
+                    MEI_DRV_CRLF, MEI_DRV_LINENUM_GET(pMeiDev)));
+       }
++#endif
+    }
+ #endif
+ 
+--- a/src/drv_mei_cpe_linux_proc_config.c
++++ b/src/drv_mei_cpe_linux_proc_config.c
+@@ -1039,6 +1039,7 @@ static int mei_proc_single_open(struct i
+ 	return single_open(file, mei_seq_single_show, PDE_DATA(inode));
+ }
+ 
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(5,6,0))
+ static struct file_operations proc_ops = {
+    .owner = THIS_MODULE,
+    .open = mei_proc_single_open,
+@@ -1047,6 +1048,15 @@ static struct file_operations proc_ops =
+    .llseek = seq_lseek,
+    .write = MEI_ProcWriteConfig
+ };
++#else
++static struct proc_ops proc_ops = {
++   .proc_open = mei_proc_single_open,
++   .proc_release = single_release,
++   .proc_read = seq_read,
++   .proc_lseek = seq_lseek,
++   .proc_write = MEI_ProcWriteConfig
++};
++#endif
+ 
+ /**
+    Create an read/write proc entry for configuration.
diff --git a/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/101_no-date-time.patch b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/101_no-date-time.patch
new file mode 100644
index 00000000000000..9785bfc4c18b19
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/101_no-date-time.patch
@@ -0,0 +1,23 @@
+--- a/src/drv_mei_cpe_linux.c
++++ b/src/drv_mei_cpe_linux.c
+@@ -1505,8 +1505,8 @@ struct proc_entry {
+ static void MEI_GetVersionProc(struct seq_file *s)
+ {
+    seq_printf(s, "%s" MEI_DRV_CRLF, &MEI_WHATVERSION[4]);
+-   seq_printf(s, "Compiled on %s, %s for Linux kernel %s (jiffies: %ld)" MEI_DRV_CRLF,
+-                                    __DATE__, __TIME__, UTS_RELEASE, jiffies);
++   seq_printf(s, "Compiled for Linux kernel %s (jiffies: %ld)" MEI_DRV_CRLF,
++                                    UTS_RELEASE, jiffies);
+ }
+ 
+ /**
+@@ -4233,7 +4233,9 @@ module_exit (MEI_module_exit);
+ #ifdef MODULE
+ MODULE_AUTHOR("www.lantiq.com");
+ MODULE_DESCRIPTION("MEI CPE Driver - www.lantiq.com");
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(5,11,0))
+ MODULE_SUPPORTED_DEVICE("MEI CPE Interface");
++#endif
+ MODULE_LICENSE ("GPL");
+ #endif /* #ifdef MODULE*/
+ 
diff --git a/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/110-reset-g_tx_link_rate-on-showtime-exit.patch b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/110-reset-g_tx_link_rate-on-showtime-exit.patch
new file mode 100644
index 00000000000000..c4ca234be84e73
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/110-reset-g_tx_link_rate-on-showtime-exit.patch
@@ -0,0 +1,12 @@
+--- a/src/drv_mei_cpe_api_atm_ptm_intern.c
++++ b/src/drv_mei_cpe_api_atm_ptm_intern.c
+@@ -124,6 +124,9 @@ IFX_int32_t MEI_InternalXtmSwhowtimeExit
+    /* Get line number*/
+    dslLineNum = pMeiDynCntrl->pMeiDev->meiDrvCntrl.dslLineNum;
+ 
++   g_tx_link_rate[dslLineNum][0] = 0;
++   g_tx_link_rate[dslLineNum][1] = 0;
++
+    /* get NULL or function pointer */
+    mei_showtime_exit =
+         (ltq_mei_atm_showtime_exit_t)ppa_callback_get(LTQ_MEI_SHOWTIME_EXIT);
diff --git a/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/200-interrupt-lock.patch b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/200-interrupt-lock.patch
new file mode 100644
index 00000000000000..a677ccec554e96
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/200-interrupt-lock.patch
@@ -0,0 +1,45 @@
+--- a/src/drv_mei_cpe_common.c
++++ b/src/drv_mei_cpe_common.c
+@@ -104,6 +104,8 @@ IFX_uint32_t MEI_FsmStateSetMsgPreAction
+ MEI_DEVCFG_DATA_T MEI_DevCfgData;
+ #endif
+ 
++static DEFINE_SPINLOCK(MEI_InterruptLock);
++
+ /* ============================================================================
+    Proc-FS and debug variable definitions
+    ========================================================================= */
+@@ -2134,6 +2136,9 @@ IFX_int32_t MEI_ProcessIntPerIrq(MEIX_CN
+ #if (MEI_SUPPORT_DEBUG_STREAMS == 1)
+    IFX_int_t   extraDbgStreamLoop = 0;
+ #endif
++   unsigned long flags;
++
++   spin_lock_irqsave(&MEI_InterruptLock, flags);
+ 
+    /* get the actual chip device from the list and step through the VRX devices */
+    while(pNextXCntrl)
+@@ -2167,6 +2172,8 @@ IFX_int32_t MEI_ProcessIntPerIrq(MEIX_CN
+    }
+ #endif
+ 
++   spin_unlock_irqrestore(&MEI_InterruptLock, flags);
++
+    return meiIntCnt;
+ }
+ 
+@@ -2639,9 +2646,14 @@ IFX_int32_t MEI_MsgSendPreAction(
+ */
+ IFX_void_t MEI_DisableDeviceInt(MEI_DEV_T *pMeiDev)
+ {
++   unsigned long flags;
++   spin_lock_irqsave(&MEI_InterruptLock, flags);
++
+    MEI_MaskInterrupts( &pMeiDev->meiDrvCntrl,
+                        ME_ARC2ME_INTERRUPT_MASK_ALL);
+ 
++   spin_unlock_irqrestore(&MEI_InterruptLock, flags);
++
+    return;
+ }
+ 
diff --git a/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/300-fix-simple-compilation-warning.patch b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/300-fix-simple-compilation-warning.patch
new file mode 100644
index 00000000000000..e9f1931227f824
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/300-fix-simple-compilation-warning.patch
@@ -0,0 +1,37 @@
+--- a/src/drv_mei_cpe_linux.c
++++ b/src/drv_mei_cpe_linux.c
+@@ -67,7 +67,7 @@
+ #if (MEI_SUPPORT_DEBUG_LOGGER == 1)
+ #include <linux/skbuff.h>
+ #include <linux/netlink.h>
+-#include <net/sock.h>
++#include <net/netlink.h>
+ #endif
+ 
+ /* add MEI CPE debug/printout part */
+@@ -1718,8 +1718,8 @@ static void MEI_MeminfoProcPerDevGet(struct seq_file *s)
+                      ", CRC = 0x%08X"
+ #endif
+                      MEI_DRV_CRLF,
+-                     chunkIdx, pChunk[chunkIdx].pImageChunk_aligned,
+-                     pChunk[chunkIdx].pImageChunk_allocated,
++                     chunkIdx, (unsigned int)pChunk[chunkIdx].pImageChunk_aligned,
++                     (unsigned int)pChunk[chunkIdx].pImageChunk_allocated,
+                      pChunk[chunkIdx].imageChunkSize_byte,
+                      pChunk[chunkIdx].eImageChunkType
+ #if (MEI_SUPPORT_OPTIMIZED_FW_DL == 1)
+--- a/src/drv_mei_cpe_download_vrx.c
++++ b/src/drv_mei_cpe_download_vrx.c
+@@ -3139,9 +3139,9 @@ IFX_int32_t MEI_DEV_IoctlFirmwareDownload(
+ {
+    IFX_int32_t ret = 0;
+    MEI_DEV_T *pMeiDev = pMeiDynCntrl->pMeiDev;
+-#if (MEI_EXPORT_INTERNAL_API == 1) && (MEI_DRV_ATM_PTM_INTERFACE_ENABLE == 1)
+-   MEI_TC_Reset_t tc_reset = {0};
+-#endif
++// #if (MEI_EXPORT_INTERNAL_API == 1) && (MEI_DRV_ATM_PTM_INTERFACE_ENABLE == 1)
++//    MEI_TC_Reset_t tc_reset = {0};
++// #endif
+ #if (MEI_SUPPORT_OPTIMIZED_FW_DL == 1)
+    IFX_boolean_t bChunksReuse = IFX_FALSE;
+ #endif
diff --git a/package/kernel/lantiq/ltq-vdsl-vr9/Makefile b/package/kernel/lantiq/ltq-vdsl-vr9/Makefile
new file mode 100644
index 00000000000000..ebcb935a739dc4
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr9/Makefile
@@ -0,0 +1,76 @@
+# Copyright (C) 2012 OpenWrt.org
+# Copyright (C) 2015-2016 Lantiq Beteiligungs GmbH & Co KG.
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_NAME:=ltq-vdsl-vr9
+PKG_VERSION:=4.17.18.6
+PKG_RELEASE:=8
+
+PKG_BASE_NAME:=drv_dsl_cpe_api
+PKG_SOURCE:=$(PKG_BASE_NAME)_vrx-$(PKG_VERSION).tar.gz
+PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(PKG_BASE_NAME)-$(PKG_VERSION)
+PKG_SOURCE_URL:=@OPENWRT
+PKG_HASH:=b4966a60653acc49254b168c6cc9c49eb36c54548e763617788aa4f252a29f21
+PKG_LICENSE:=GPL-2.0 BSD-2-Clause
+PKG_LICENSE_FILES:=LICENSE
+
+PKG_FIXUP:=autoreconf
+
+PKG_MAINTAINER:=John Crispin <john@phrozen.org>
+
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/ltq-vdsl-vr9
+  TITLE:=vdsl driver
+  SECTION:=sys
+  SUBMENU:=Network Devices
+  DEPENDS:=@TARGET_lantiq_xrx200 +kmod-ltq-vdsl-vr9-mei
+  FILES:=$(PKG_BUILD_DIR)/src/drv_dsl_cpe_api.ko
+  AUTOLOAD:=$(call AutoLoad,51,drv_dsl_cpe_api)
+endef
+
+define Package/ltq-vdsl-vr9/description
+	This package contains the Lantiq DSL CPE API driver.
+
+	Supported Devices:
+		- VRX200 Family
+endef
+
+MAKE_FLAGS += \
+	$(KERNEL_MAKE_FLAGS) \
+	SHELL="$(BASH)"
+
+CONFIGURE_ARGS += --enable-kernel-include="$(LINUX_DIR)/include" \
+	--with-max-device="1" \
+	--with-lines-per-device="1" \
+	--with-channels-per-line="1" \
+	--enable-vrx \
+	--enable-vrx-device=vr9 \
+	--enable-ifxos \
+	--enable-ifxos-include="-I$(STAGING_DIR)/usr/include/ifxos" \
+	--enable-driver-include="-I$(STAGING_DIR)/usr/include/vdsl" \
+	--enable-add-drv-cflags="-DMODULE -DINCLUDE_DSL_ATM_PTM_INTERFACE_SUPPORT" \
+	--enable-linux-26 \
+	--enable-kernelbuild="$(LINUX_DIR)" \
+	--enable-debug-prints=no \
+	ARCH=mips
+
+CONFIGURE_ARGS += \
+	--enable-model=full \
+	--enable-dsl-ceoc=no
+#CONFIGURE_ARGS += --enable-model=lite
+#CONFIGURE_ARGS += --enable-model=footprint
+#CONFIGURE_ARGS += --enable-model=typical
+#CONFIGURE_ARGS += --enable-model=debug
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include/drv_vdsl_cpe_api
+	$(CP) $(PKG_BUILD_DIR)/src/include/drv_dsl_cpe*.h $(1)/usr/include/drv_vdsl_cpe_api/
+endef
+
+$(eval $(call KernelPackage,ltq-vdsl-vr9))
diff --git a/package/kernel/lantiq/ltq-vdsl-vr9/patches/001-fix-compile.patch b/package/kernel/lantiq/ltq-vdsl-vr9/patches/001-fix-compile.patch
new file mode 100644
index 00000000000000..1355a1a79158d4
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr9/patches/001-fix-compile.patch
@@ -0,0 +1,12 @@
+--- a/src/include/drv_dsl_cpe_os_linux.h
++++ b/src/include/drv_dsl_cpe_os_linux.h
+@@ -33,6 +33,9 @@
+ #endif
+ 
+ #include <linux/sched.h>
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,11,0))
++#include <linux/sched/signal.h>
++#endif
+ 
+ #if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,33))
+    #if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,17))
diff --git a/package/kernel/lantiq/ltq-vdsl-vr9/patches/020-not-leak-cflags.patch b/package/kernel/lantiq/ltq-vdsl-vr9/patches/020-not-leak-cflags.patch
new file mode 100644
index 00000000000000..96e69acca0d6f4
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr9/patches/020-not-leak-cflags.patch
@@ -0,0 +1,32 @@
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -244,10 +244,7 @@ else
+ drv_dsl_cpe_api_common_mod_cflags =
+ endif
+ 
+-drv_dsl_cpe_api_common_cflags = -DLINUX -D__LINUX__ -D__KERNEL__ -DEXPORT_SYMTAB \
+-    -pipe -Wall -Wformat -Wimplicit -Wunused -Wswitch -Wcomment -Winline \
+-    -Wuninitialized -Wparentheses -Wsign-compare -Wreturn-type \
+-    -Wstrict-prototypes -Wno-trigraphs -fno-strict-aliasing -fno-common
++drv_dsl_cpe_api_common_cflags = -DLINUX -D__LINUX__ -D__KERNEL__ -DEXPORT_SYMTAB
+ 
+ if DSL_DBG_MAX_LEVEL_SET
+ drv_dsl_cpe_api_common_cflags += -DDSL_DBG_MAX_LEVEL=$(DSL_DBG_MAX_LEVEL_PRE)
+@@ -257,7 +254,7 @@ endif
+ drv_dsl_cpe_api_target_cflags = $(ADD_DRV_CFLAGS)
+ 
+ # compile cflags
+-drv_dsl_cpe_api_compile_cflags = $(EXTRA_DRV_CFLAGS)
++drv_dsl_cpe_api_compile_cflags =
+ 
+ if !KERNEL_2_6
+ # the headerfile of linux kernels 2.6.x contain to much arithmetic
+@@ -311,7 +308,7 @@ drv_dsl_cpe_api.ko: $(drv_dsl_cpe_api_SO
+ 	@echo -e "# drv_dsl_cpe_api: Generated to build Linux 2.6.x kernel object" > $(PWD)/Kbuild
+ 	@echo -e "obj-m := $(subst .ko,.o,$@)"			>> $(PWD)/Kbuild
+ 	@echo -e "$(subst .ko,,$@)-y := $(drv_dsl_cpe_api_OBJS)"	>> $(PWD)/Kbuild
+-	@echo -e "EXTRA_CFLAGS := $(CFLAGS) -DHAVE_CONFIG_H $(drv_dsl_cpe_api_CFLAGS) $(DSL_DRIVER_INCL_PATH) $(IFXOS_INCLUDE_PATH) -I@abs_srcdir@/include -I$(PWD)/include"	>> $(PWD)/Kbuild
++	@echo -e "EXTRA_CFLAGS := -DHAVE_CONFIG_H $(drv_dsl_cpe_api_CFLAGS) $(DSL_DRIVER_INCL_PATH) $(IFXOS_INCLUDE_PATH) -I@abs_srcdir@/include -I$(PWD)/include"	>> $(PWD)/Kbuild
+ 	$(MAKE) ARCH=@KERNEL_ARCH@ -C @KERNEL_BUILD_PATH@ O=@KERNEL_BUILD_PATH@ M=$(PWD) modules
+ 
+ clean-generic:
diff --git a/package/kernel/lantiq/ltq-vdsl-vr9/patches/100-compat.patch b/package/kernel/lantiq/ltq-vdsl-vr9/patches/100-compat.patch
new file mode 100644
index 00000000000000..7670fe6a00e736
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr9/patches/100-compat.patch
@@ -0,0 +1,129 @@
+--- a/src/Makefile.in
++++ b/src/Makefile.in
+@@ -117,7 +117,7 @@ POST_UNINSTALL = :
+ 
+ # the headerfile of linux kernels 2.6.x contain to much arithmetic
+ # with void pointers (which is allowed for gcc!)
+-@KERNEL_2_6_FALSE@am__append_6 = -Wpointer-arith
++@KERNEL_2_6_FALSE@am__append_6 =
+ subdir = src
+ ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+ am__aclocal_m4_deps = $(top_srcdir)/configure.in
+--- a/src/common/drv_dsl_cpe_os_linux.c
++++ b/src/common/drv_dsl_cpe_os_linux.c
+@@ -11,6 +11,7 @@
+ 
+ #define DSL_INTERN
+ 
++#include <linux/device.h>
+ #include "drv_dsl_cpe_api.h"
+ #include "drv_dsl_cpe_api_ioctl.h"
+ 
+@@ -249,14 +250,7 @@ static DSL_long_t DSL_DRV_Ioctls(DSL_DRV
+    }
+ 
+ #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,36))
+-   if (pFile->f_dentry != DSL_NULL)
+-   {
+-      pINode = pFile->f_dentry->d_inode;
+-   }
+-   else
+-   {
+-      pINode = DSL_NULL;
+-   }
++   pINode = file_inode(pFile);
+ #endif
+ 
+    if (pINode == DSL_NULL)
+@@ -491,7 +485,11 @@ DSL_void_t* DSL_DRV_VMalloc(
+    DSL_DRV_size_t    nSize)
+ {
+    /* VRX500-BU: Better to use vmalloc or vzmalloc here?! */
++#if LINUX_VERSION_CODE < KERNEL_VERSION(5,9,0)
+    return __vmalloc((unsigned long)nSize, GFP_KERNEL, PAGE_KERNEL);
++#else
++   return __vmalloc((unsigned long)nSize, GFP_KERNEL);
++#endif
+    /*   return vmalloc(nSize);*/
+ }
+ 
+@@ -917,12 +915,19 @@ DSL_int32_t DSL_DRV_ThreadShutdown(
+ 
+ DSL_uint32_t DSL_DRV_SysTimeGet(DSL_uint32_t nOffset)
+ {
+-   struct timeval tv;
+    DSL_uint32_t nTime = 0;
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0))
++   struct timeval tv;
+ 
+    memset(&tv, 0, sizeof(tv));
+    do_gettimeofday(&tv);
+    nTime = (DSL_uint32_t)tv.tv_sec;
++#else
++   struct timespec64 now;
++
++   ktime_get_real_ts64(&now);
++   nTime = (DSL_uint32_t)now.tv_sec;
++#endif
+ 
+    if ( (nOffset == 0) || (nOffset > nTime) )
+    {
+@@ -1203,6 +1208,9 @@ static void DSL_DRV_NlSendMsg(DSL_char_t
+ }
+ #endif
+ 
++static struct class *dsl_class;
++static dev_t dsl_devt;
++
+ /* Entry point of driver */
+ int __init DSL_ModuleInit(void)
+ {
+@@ -1241,6 +1249,10 @@ int __init DSL_ModuleInit(void)
+ 
+    DSL_DRV_DevNodeInit();
+ 
++   dsl_class = class_create(THIS_MODULE, DRV_DSL_CPE_API_DEV_NAME);
++   dsl_devt = MKDEV(DRV_DSL_CPE_API_DEV_MAJOR, 0);
++   device_create(dsl_class, NULL, dsl_devt, NULL, "dsl_cpe_api/0");
++
+    return 0;
+ }
+ 
+@@ -1248,6 +1260,11 @@ void __exit DSL_ModuleCleanup(void)
+ {
+    printk("Module will be unloaded"DSL_DRV_CRLF);
+ 
++   device_destroy(dsl_class, dsl_devt);
++   dsl_devt = NULL;
++   class_destroy(dsl_class);
++   dsl_class = NULL;
++
+    unregister_chrdev(nMajorNum, DRV_DSL_CPE_API_DEV_NAME);
+    
+    DSL_DRV_Cleanup();
+--- a/src/device/drv_dsl_cpe_device_vrx.c
++++ b/src/device/drv_dsl_cpe_device_vrx.c
+@@ -5337,6 +5337,7 @@ DSL_Error_t DSL_DRV_DEV_HybridTypeGet(
+ #undef DSL_DBG_BLOCK
+ #define DSL_DBG_BLOCK DSL_DBG_NOTIFICATIONS
+ 
++#if 0
+ DSL_Error_t DSL_DRV_DEV_MeiTcLayerSignaling
+ (
+    DSL_Context_t *pContext,
+@@ -5384,6 +5385,15 @@ DSL_Error_t DSL_DRV_DEV_MeiTcLayerSignal
+ 
+    return nErrCode;
+ }
++#else
++DSL_Error_t DSL_DRV_DEV_MeiTcLayerSignaling
++(
++   DSL_Context_t *pContext,
++   DSL_TcLayerSelection_t nTcLayer)
++{
++   return DSL_SUCCESS;
++}
++#endif
+ 
+ DSL_Error_t DSL_DRV_DEV_MeiShowtimeSignaling
+ (
diff --git a/package/kernel/lantiq/ltq-vdsl-vr9/patches/110-semaphore-lock.patch b/package/kernel/lantiq/ltq-vdsl-vr9/patches/110-semaphore-lock.patch
new file mode 100644
index 00000000000000..12c00c33eccf7c
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr9/patches/110-semaphore-lock.patch
@@ -0,0 +1,107 @@
+--- a/src/include/drv_dsl_cpe_pm_core.h
++++ b/src/include/drv_dsl_cpe_pm_core.h
+@@ -1510,9 +1510,9 @@ typedef struct
+    /** Common PM module mutex*/
+    DSL_DRV_Mutex_t pmMutex;
+    /** PM module direction Near-End mutex*/
+-   DSL_DRV_Mutex_t pmNeMutex;
++   struct semaphore pmNeMutex;
+    /** PM module direction Far-End mutex*/
+-   DSL_DRV_Mutex_t pmFeMutex;
++   struct semaphore pmFeMutex;
+    /** PM module Near-End access mutex*/
+    DSL_DRV_Mutex_t pmNeAccessMutex;
+    /** PM module Far-End access mutex*/
+--- a/src/pm/drv_dsl_cpe_api_pm.c
++++ b/src/pm/drv_dsl_cpe_api_pm.c
+@@ -220,9 +220,9 @@ DSL_Error_t DSL_DRV_PM_Start(
+    /* init PM module common mutex */
+    DSL_DRV_MUTEX_INIT(DSL_DRV_PM_CONTEXT(pContext)->pmMutex);
+    /* init PM module direction Near-End mutex */
+-   DSL_DRV_MUTEX_INIT(DSL_DRV_PM_CONTEXT(pContext)->pmNeMutex);
++   sema_init(&(DSL_DRV_PM_CONTEXT(pContext)->pmNeMutex),1);
+    /* init PM module direction Far-End mutex */
+-   DSL_DRV_MUTEX_INIT(DSL_DRV_PM_CONTEXT(pContext)->pmFeMutex);
++   sema_init(&(DSL_DRV_PM_CONTEXT(pContext)->pmFeMutex),1);
+    /* init PM module Near-End access mutex */
+    DSL_DRV_MUTEX_INIT(DSL_DRV_PM_CONTEXT(pContext)->pmNeAccessMutex);
+    /* init PM module Far-End access mutex */
+@@ -592,7 +592,7 @@ DSL_Error_t DSL_DRV_PM_Stop(
+    if( DSL_DRV_PM_CONTEXT(pContext)->pmThreadFe.bRun != DSL_TRUE )
+    {
+       DSL_DEBUG(DSL_DBG_WRN,
+-         (pContext, SYS_DBG_WRN"DSL[%02d]: PM module Near-End thread already stopped"
++         (pContext, SYS_DBG_WRN"DSL[%02d]: PM module Far-End thread already stopped"
+          DSL_DRV_CRLF, DSL_DEV_NUM(pContext)));
+    }
+    else
+--- a/src/pm/drv_dsl_cpe_pm_core.c
++++ b/src/pm/drv_dsl_cpe_pm_core.c
+@@ -1022,7 +1022,7 @@ DSL_Error_t DSL_DRV_PM_DirectionMutexCon
+    {
+       if( bLock )
+       {
+-         if( DSL_DRV_MUTEX_LOCK(DSL_DRV_PM_CONTEXT(pContext)->pmNeMutex) )
++         if(down_interruptible(&(DSL_DRV_PM_CONTEXT(pContext)->pmNeMutex)))
+          {
+             DSL_DEBUG( DSL_DBG_ERR,
+                (pContext, SYS_DBG_ERR"DSL[%02d]: ERROR - Couldn't lock PM NE mutex!"
+@@ -1034,14 +1034,14 @@ DSL_Error_t DSL_DRV_PM_DirectionMutexCon
+       else
+       {
+           /* Unlock PM module NE Mutex*/
+-          DSL_DRV_MUTEX_UNLOCK(DSL_DRV_PM_CONTEXT(pContext)->pmNeMutex);
++          up(&(DSL_DRV_PM_CONTEXT(pContext)->pmNeMutex));
+       }
+    }
+    else
+    {
+       if( bLock )
+       {
+-         if( DSL_DRV_MUTEX_LOCK(DSL_DRV_PM_CONTEXT(pContext)->pmFeMutex) )
++         if(down_interruptible(&(DSL_DRV_PM_CONTEXT(pContext)->pmFeMutex)))
+          {
+             DSL_DEBUG( DSL_DBG_ERR,
+                (pContext, SYS_DBG_ERR"DSL[%02d]: ERROR - Couldn't lock PM FE mutex!"
+@@ -1053,7 +1053,7 @@ DSL_Error_t DSL_DRV_PM_DirectionMutexCon
+       else
+       {
+          /* Unlock PM module FE Mutex*/
+-         DSL_DRV_MUTEX_UNLOCK(DSL_DRV_PM_CONTEXT(pContext)->pmFeMutex);
++         up(&(DSL_DRV_PM_CONTEXT(pContext)->pmFeMutex));
+       }
+    }
+ 
+@@ -1139,7 +1139,7 @@ DSL_Error_t DSL_DRV_PM_Lock(DSL_Context_
+    if( !(DSL_DRV_PM_CONTEXT(pContext)->bPmLock) )
+    {
+       /* Lock PM module Near-End Mutex*/
+-      if( DSL_DRV_MUTEX_LOCK(DSL_DRV_PM_CONTEXT(pContext)->pmNeMutex) )
++      if(down_interruptible(&(DSL_DRV_PM_CONTEXT(pContext)->pmNeMutex)))
+       {
+          DSL_DEBUG( DSL_DBG_ERR,
+             (pContext, SYS_DBG_ERR"DSL[%02d]: ERROR - Couldn't lock PM NE mutex!"
+@@ -1148,8 +1148,8 @@ DSL_Error_t DSL_DRV_PM_Lock(DSL_Context_
+          return DSL_ERR_SEMAPHORE_GET;
+       }
+ 
+-      /* Lock PM module Near-End Mutex*/
+-      if( DSL_DRV_MUTEX_LOCK(DSL_DRV_PM_CONTEXT(pContext)->pmFeMutex) )
++      /* Lock PM module Far-End Mutex*/
++      if( down_interruptible(&(DSL_DRV_PM_CONTEXT(pContext)->pmFeMutex)) )
+       {
+          DSL_DEBUG( DSL_DBG_ERR,
+             (pContext, SYS_DBG_ERR"DSL[%02d]: ERROR - Couldn't lock PM FE mutex!"
+@@ -1193,10 +1193,10 @@ DSL_Error_t DSL_DRV_PM_UnLock(DSL_Contex
+    if( DSL_DRV_PM_CONTEXT(pContext)->bPmLock )
+    {
+       /* Unlock PM module NE Mutex*/
+-      DSL_DRV_MUTEX_UNLOCK(DSL_DRV_PM_CONTEXT(pContext)->pmNeMutex);
++      up(&(DSL_DRV_PM_CONTEXT(pContext)->pmNeMutex));
+ 
+       /* Unlock PM module FE Mutex*/
+-      DSL_DRV_MUTEX_UNLOCK(DSL_DRV_PM_CONTEXT(pContext)->pmFeMutex);
++      up(&(DSL_DRV_PM_CONTEXT(pContext)->pmFeMutex));
+ 
+       /* Clear bPmLock flag*/
+       DSL_DRV_PM_CONTEXT(pContext)->bPmLock = DSL_FALSE;
diff --git a/package/kernel/lantiq/ltq-vdsl-vr9/patches/200-fix-elapsed-time.patch b/package/kernel/lantiq/ltq-vdsl-vr9/patches/200-fix-elapsed-time.patch
new file mode 100644
index 00000000000000..3ec85460b2433b
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr9/patches/200-fix-elapsed-time.patch
@@ -0,0 +1,122 @@
+--- a/src/include/drv_dsl_cpe_pm_core.h
++++ b/src/include/drv_dsl_cpe_pm_core.h
+@@ -1552,9 +1552,9 @@ typedef struct
+    DSL_boolean_t bShowtimeProcessingStart;
+    /** Showtime reached flag*/
+    DSL_boolean_t bShowtimeInvTrigger;
+-   /** Current Showtime synchronization time to be used, (msec) */
++   /** Current Showtime synchronization time to be used, (sec) */
+    DSL_uint32_t nCurrShowtimeTime;
+-   /** Showtime synchronization time to be used, (msec) */
++   /** Showtime synchronization time to be used, (sec) */
+    DSL_uint32_t nElapsedShowtimeTime;
+    /** Actual Line state*/
+    DSL_LineStateValue_t nLineState;
+--- a/src/pm/drv_dsl_cpe_api_pm.c
++++ b/src/pm/drv_dsl_cpe_api_pm.c
+@@ -1475,7 +1475,7 @@ DSL_Error_t DSL_DRV_PM_ChannelCountersTo
+    }
+ 
+    /* Fill Total Counters elapsed time*/
+-   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime/DSL_PM_MSEC;
++   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime;
+ 
+    pChCounters = DSL_DRV_PM_PTR_CHANNEL_COUNTERS_TOTAL(pCounters->nChannel,pCounters->nDirection);
+ 
+@@ -1535,7 +1535,7 @@ DSL_Error_t DSL_DRV_PM_ChannelCountersEx
+    }
+ 
+    /* Fill Total Counters elapsed time*/
+-   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime/DSL_PM_MSEC;
++   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime;
+ 
+    pChCounters = DSL_DRV_PM_PTR_CHANNEL_COUNTERS_TOTAL_EXT(pCounters->nChannel);
+ 
+@@ -2518,7 +2518,7 @@ DSL_Error_t DSL_DRV_PM_DataPathCountersT
+    }
+ 
+    /* Fill Total Counters elapsed time*/
+-   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime/DSL_PM_MSEC;
++   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime;
+ 
+    pDpCounters = DSL_DRV_PM_PTR_DATAPATH_COUNTERS_TOTAL(pCounters->nChannel,pCounters->nDirection);
+ 
+@@ -3352,7 +3352,7 @@ DSL_Error_t DSL_DRV_PM_DataPathFailureCo
+    }
+ 
+    /* Fill Total Counters elapsed time*/
+-   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime/DSL_PM_MSEC;
++   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime;
+ 
+    pDpCounters = DSL_DRV_PM_PTR_DATAPATH_FAILURE_COUNTERS_TOTAL(pCounters->nChannel,pCounters->nDirection);
+ 
+@@ -4130,7 +4130,7 @@ DSL_Error_t DSL_DRV_PM_LineSecCountersTo
+    }
+ 
+    /* Fill Total Counters elapsed time*/
+-   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime/DSL_PM_MSEC;
++   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime;
+ 
+    pLineCounters = DSL_DRV_PM_PTR_LINE_SEC_COUNTERS_TOTAL(pCounters->nDirection);
+ 
+@@ -4787,7 +4787,7 @@ DSL_Error_t DSL_DRV_PM_LineInitCountersT
+    }
+ 
+    /* Fill Total Counters elapsed time*/
+-   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime/DSL_PM_MSEC;
++   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime;
+ 
+    pLinitCounters = DSL_DRV_PM_PTR_LINE_INIT_COUNTERS_TOTAL();
+ 
+@@ -5240,7 +5240,7 @@ DSL_Error_t DSL_DRV_PM_LineEventShowtime
+    }
+ 
+    /* Fill Total Counters elapsed time*/
+-   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime/DSL_PM_MSEC;
++   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime;
+ 
+    pLfCounters = DSL_DRV_PM_PTR_LINE_EVENT_SHOWTIME_COUNTERS_TOTAL(pCounters->nDirection);
+ 
+@@ -5720,7 +5720,7 @@ DSL_Error_t DSL_DRV_PM_ReTxCountersTotal
+    }
+ 
+    /* Fill Total Counters elapsed time*/
+-   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime/DSL_PM_MSEC;
++   pCounters->total.nElapsedTime = DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime;
+ 
+    pReTxCounters = DSL_DRV_PM_PTR_RETX_COUNTERS_TOTAL(pCounters->nDirection);
+ 
+--- a/src/pm/drv_dsl_cpe_pm_core.c
++++ b/src/pm/drv_dsl_cpe_pm_core.c
+@@ -60,6 +60,7 @@ static DSL_Error_t DSL_DRV_PM_SyncTimeUp
+ {
+    DSL_Error_t nErrCode = DSL_SUCCESS;
+    DSL_uint32_t msecTimeFrame = DSL_PM_COUNTER_POLLING_CYCLE,
++                secTimeFrame = DSL_PM_COUNTER_POLLING_CYCLE/DSL_PM_MSEC,
+                 nCurrMsTime = 0;
+ #ifdef INCLUDE_DSL_CPE_PM_HISTORY
+    DSL_uint32_t nCurrSysTime = 0, nPrevElapsedTime = 0;
+@@ -99,10 +100,13 @@ static DSL_Error_t DSL_DRV_PM_SyncTimeUp
+    {
+       /* Get elapsed time [msec] since the last entry*/
+       msecTimeFrame = nCurrMsTime  - DSL_DRV_PM_CONTEXT(pContext)->nLastMsTimeCheck;
++
++      /* Get elapsed time [sec] since the last entry*/
++      secTimeFrame = (nCurrMsTime/DSL_PM_MSEC) - (DSL_DRV_PM_CONTEXT(pContext)->nLastMsTimeCheck/DSL_PM_MSEC);
+    }
+ 
+    /* Get Total Elapsed Time Since the PM module startup*/
+-   DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime += msecTimeFrame;
++   DSL_DRV_PM_CONTEXT(pContext)->nPmTotalElapsedTime += secTimeFrame;
+ 
+    /* Set last time check to the current time*/
+    DSL_DRV_PM_CONTEXT(pContext)->nLastMsTimeCheck = nCurrMsTime;
+@@ -140,7 +144,7 @@ static DSL_Error_t DSL_DRV_PM_SyncTimeUp
+       else
+       {
+          /* Update current showtime elapsed time*/
+-         DSL_DRV_PM_CONTEXT(pContext)->nCurrShowtimeTime   += (msecTimeFrame/DSL_PM_MSEC);
++         DSL_DRV_PM_CONTEXT(pContext)->nCurrShowtimeTime   += secTimeFrame;
+          DSL_DRV_PM_CONTEXT(pContext)->nElapsedShowtimeTime =
+             DSL_DRV_PM_CONTEXT(pContext)->nCurrShowtimeTime;
+       }
diff --git a/package/kernel/lantiq/ltq-vdsl-vr9/patches/210-fix-us-eftrmin.patch b/package/kernel/lantiq/ltq-vdsl-vr9/patches/210-fix-us-eftrmin.patch
new file mode 100644
index 00000000000000..51651f476a329e
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr9/patches/210-fix-us-eftrmin.patch
@@ -0,0 +1,22 @@
+--- a/src/pm/drv_dsl_cpe_api_pm_vrx.c
++++ b/src/pm/drv_dsl_cpe_api_pm_vrx.c
+@@ -1435,9 +1435,16 @@ DSL_Error_t DSL_DRV_PM_DEV_ReTxCountersG
+       /* ignore zero value*/
+       if (nEftrMin)
+       {
+-         /* Fw Format:  kBit/s */
+-         /* API format: bit/s */
+-         pCounters->nEftrMin = nEftrMin*1000;
++         if (nDirection == DSL_NEAR_END)
++         {
++            /* Fw Format:  kBit/s */
++            /* API format: bit/s */
++            pCounters->nEftrMin = nEftrMin*1000;
++         }
++         else
++         {
++            pCounters->nEftrMin = nEftrMin;
++         }
+       }
+    }
+    else
diff --git a/package/kernel/lantiq/ltq-vdsl-vr9/patches/300-fix-compilation-warning-fallthrough.patch b/package/kernel/lantiq/ltq-vdsl-vr9/patches/300-fix-compilation-warning-fallthrough.patch
new file mode 100644
index 00000000000000..b0e106a5f57ca5
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr9/patches/300-fix-compilation-warning-fallthrough.patch
@@ -0,0 +1,36 @@
+--- a/src/common/drv_dsl_cpe_api.c
++++ b/src/common/drv_dsl_cpe_api.c
+@@ -1922,7 +1922,7 @@ DSL_Error_t DSL_DRV_AutobootControlSet(
+                }
+                /* no break */
+                /* ... pass to restart*/
+-
++               fallthrough;
+             case DSL_AUTOBOOT_CTRL_RESTART:
+             case DSL_AUTOBOOT_CTRL_RESTART_FULL:
+                if (bAutobootDisable && pData->data.nCommand == DSL_AUTOBOOT_CTRL_RESTART)
+--- a/src/pm/drv_dsl_cpe_pm_core.c
++++ b/src/pm/drv_dsl_cpe_pm_core.c
+@@ -2325,16 +2325,18 @@ DSL_Error_t DSL_DRV_PM_CountersReset(
+       }
+ #endif /* #ifdef INCLUDE_DSL_CPE_PM_HISTORY*/
+ 
+-   if (ResetType == DSL_PM_RESET_HISTORY)
+-      break;
++      if (ResetType == DSL_PM_RESET_HISTORY)
++         break;
+ 
++      fallthrough;
+    case DSL_PM_RESET_TOTAL:
+ #ifdef INCLUDE_DSL_CPE_PM_TOTAL_COUNTERS
+       memset(EpData.pRecTotal, nFillValue, EpData.nEpRecElementSize);
+ #endif /* #ifdef INCLUDE_DSL_CPE_PM_TOTAL_COUNTERS*/
+-   if (ResetType == DSL_PM_RESET_TOTAL)
+-      break;
++      if (ResetType == DSL_PM_RESET_TOTAL)
++         break;
+ 
++      fallthrough;
+    case DSL_PM_RESET_HISTORY_SHOWTIME:
+ #ifdef INCLUDE_DSL_CPE_PM_SHOWTIME_COUNTERS
+       nErrCode = DSL_DRV_PM_HistoryDelete(pContext, EpData.pHistShowtime );
\ No newline at end of file
diff --git a/package/kernel/lantiq/ltq-vdsl-vr9/patches/301-fix-compilation-warning-simple-fix.patch b/package/kernel/lantiq/ltq-vdsl-vr9/patches/301-fix-compilation-warning-simple-fix.patch
new file mode 100644
index 00000000000000..99f1908f0fab10
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr9/patches/301-fix-compilation-warning-simple-fix.patch
@@ -0,0 +1,132 @@
+--- a/src/common/drv_dsl_cpe_os_linux.c
++++ b/src/common/drv_dsl_cpe_os_linux.c
+@@ -54,7 +54,7 @@ static int DSL_DRV_Release(DSL_DRV_inode_t * ino, DSL_DRV_file_t * fil);
+ 
+ static DSL_uint_t DSL_DRV_Poll(DSL_DRV_file_t *pFile, DSL_DRV_Poll_Table_t *wait);
+ 
+-#ifdef INCLUDE_DSL_CPE_DEBUG_LOGGER_SUPPORT
++#if defined(INCLUDE_DSL_CPE_DEBUG_LOGGER_SUPPORT) && !defined(DSL_DEBUG_DISABLE)
+ static void DSL_DRV_NlSendMsg(DSL_char_t* pMsg);
+ #endif
+ 
+@@ -368,10 +368,10 @@ int DSL_DRV_debug_printf(DSL_Context_t const *pContext, DSL_char_t const *fmt, .
+ {
+    DSL_int_t nRet = 0;
+ #ifndef _lint
+-   DSL_int_t nLength = 0;
+-   DSL_boolean_t bPrint = DSL_FALSE;
+ #ifdef INCLUDE_DSL_CPE_DEBUG_LOGGER_SUPPORT
+ #ifndef DSL_DEBUG_DISABLE
++   DSL_int_t nLength = 0;
++   DSL_boolean_t bPrint = DSL_FALSE;
+    DSL_char_t debugString[DSL_DBG_MAX_DEBUG_PRINT_CHAR + 1] = {0};
+    va_list ap;   /* points to each unnamed arg in turn */
+ 
+@@ -406,6 +406,8 @@ int DSL_DRV_debug_printf(DSL_Context_t const *pContext, DSL_char_t const *fmt, .
+ #endif /* DSL_DEBUG_DISABLE */
+    return nRet;
+ #else
++   DSL_int_t nLength = 0;
++   DSL_boolean_t bPrint = DSL_FALSE;
+    DSL_char_t msg[DSL_DBG_MAX_DEBUG_PRINT_CHAR + 1] = "\0";
+    va_list ap;   /* points to each unnamed arg in turn */
+ 
+@@ -1172,7 +1174,7 @@ static void DSL_DRV_DebugInit(void)
+    return;
+ }
+ 
+-#ifdef INCLUDE_DSL_CPE_DEBUG_LOGGER_SUPPORT
++#if defined(INCLUDE_DSL_CPE_DEBUG_LOGGER_SUPPORT) && !defined(DSL_DEBUG_DISABLE)
+ static void DSL_DRV_NlSendMsg(DSL_char_t* pMsg)
+ {
+    struct nlmsghdr *pNlMsgHdr;
+@@ -1261,7 +1263,7 @@ void __exit DSL_ModuleCleanup(void)
+    printk("Module will be unloaded"DSL_DRV_CRLF);
+ 
+    device_destroy(dsl_class, dsl_devt);
+-   dsl_devt = NULL;
++   dsl_devt = 0;
+    class_destroy(dsl_class);
+    dsl_class = NULL;
+ 
+--- a/src/device/drv_dsl_cpe_msg_vrx.c
++++ b/src/device/drv_dsl_cpe_msg_vrx.c
+@@ -2456,32 +2456,32 @@ DSL_Error_t DSL_DRV_VRX_SendMsgSnrPerGroupesGet(
+ #endif /* defined(INCLUDE_DSL_G997_PER_TONE) || defined(INCLUDE_DSL_DELT)*/
+ 
+ #ifdef INCLUDE_DSL_DELT
+-static DSL_Error_t DSL_DRV_VRX_SpreadArray(
+-   DSL_void_t* pArray,
+-   DSL_uint16_t valueSize,
+-   DSL_uint16_t valueCount,
+-   DSL_uint16_t multiplier)
+-{
+-   DSL_void_t* pSrc = pArray + valueSize * (valueCount - 1);
+-   DSL_void_t* pDst = pArray + valueSize * (valueCount*multiplier - 1);
+-
+-   if (pArray == DSL_NULL)
+-   {
+-      return DSL_ERROR;
+-   }
+-
+-   for (; valueCount; --valueCount, pSrc -= valueSize)
+-   {
+-      DSL_uint16_t i;
+-
+-      for ( i = multiplier; i; --i, pDst -= valueSize)
+-      {
+-         memcpy(pDst,pSrc,valueSize);
+-      }
+-   }
+-
+-   return DSL_SUCCESS;
+-}
++// static DSL_Error_t DSL_DRV_VRX_SpreadArray(
++//    DSL_void_t* pArray,
++//    DSL_uint16_t valueSize,
++//    DSL_uint16_t valueCount,
++//    DSL_uint16_t multiplier)
++// {
++//    DSL_void_t* pSrc = pArray + valueSize * (valueCount - 1);
++//    DSL_void_t* pDst = pArray + valueSize * (valueCount*multiplier - 1);
++
++//    if (pArray == DSL_NULL)
++//    {
++//       return DSL_ERROR;
++//    }
++
++//    for (; valueCount; --valueCount, pSrc -= valueSize)
++//    {
++//       DSL_uint16_t i;
++
++//       for ( i = multiplier; i; --i, pDst -= valueSize)
++//       {
++//          memcpy(pDst,pSrc,valueSize);
++//       }
++//    }
++
++//    return DSL_SUCCESS;
++// }
+ 
+ /**
+    This function requests a set of up to 60 entries of the DELT data.
+--- a/src/device/drv_dsl_cpe_device_vrx.c
++++ b/src/device/drv_dsl_cpe_device_vrx.c
+@@ -3356,7 +3356,9 @@ static DSL_Error_t DSL_DRV_VRX_TestParametersFeUpdate(
+    DSL_Error_t nErrCode = DSL_SUCCESS;
+    DSL_uint16_t i = 0;
+    DSL_uint16_t nDataLen = 0;
++#ifndef DSL_DEBUG_DISABLE
+    DSL_uint16_t nMsgId = EVT_PMD_TESTPARAMSGET;
++#endif /* DSL_DEBUG_DISABLE */
+ 
+    DSL_DEBUG( DSL_DBG_MSG,
+       (pContext, SYS_DBG_MSG"DSL[%02d]: IN - DSL_DRV_VRX_TestParametersFeUpdate"
+@@ -8312,6 +8314,7 @@ DSL_Error_t DSL_DRV_DEV_AutobootHandleTraining(
+             (pContext, SYS_DBG_MSG"DSL[%02d]: ORDERLY_SHUTDOWN state reached"
+             DSL_DRV_CRLF, DSL_DEV_NUM(pContext)));
+          /* do not use break here, continue handling */
++         fallthrough;
+ #endif /* INCLUDE_DSL_CPE_API_VRX */
+       case DSL_LINESTATE_EXCEPTION:
+          if (!bPreFail)
diff --git a/package/kernel/lantiq/ltq-vectoring/Makefile b/package/kernel/lantiq/ltq-vectoring/Makefile
index b7b1b83a078a3b..7e25422f013760 100644
--- a/package/kernel/lantiq/ltq-vectoring/Makefile
+++ b/package/kernel/lantiq/ltq-vectoring/Makefile
@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ltq-vectoring
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=3
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://gitlab.com/prpl-foundation/intel/ppa_drv.git
 PKG_SOURCE_DATE:=2019-05-20
@@ -51,8 +51,7 @@ define Build/Configure
 endef
 
 define Build/Compile
-	+$(MAKE) $(PKG_JOBS) -C "$(LINUX_DIR)" \
-		$(KERNEL_MAKE_FLAGS) \
+	+$(KERNEL_MAKE) $(PKG_JOBS) \
 		M="$(PKG_BUILD_DIR)/$(MAKE_PATH)" \
 		modules
 endef
diff --git a/package/kernel/lantiq/ltq-vectoring/patches/300-fix-compilation-warning-stack-limit.patch b/package/kernel/lantiq/ltq-vectoring/patches/300-fix-compilation-warning-stack-limit.patch
new file mode 100644
index 00000000000000..4d18f8e3b7a441
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vectoring/patches/300-fix-compilation-warning-stack-limit.patch
@@ -0,0 +1,69 @@
+--- a/src/vectoring/ifxmips_vectoring.c
++++ b/src/vectoring/ifxmips_vectoring.c
+@@ -298,7 +298,7 @@ static int proc_write_dbg(struct file *file, const char __user *buf, size_t coun
+         DBG_ENABLE_MASK_ALL
+     };
+ 
+-    char str[2048];
++    char *str;
+     char *p;
+ 
+     int len, rlen;
+@@ -306,6 +306,10 @@ static int proc_write_dbg(struct file *file, const char __user *buf, size_t coun
+     int f_enable = 0;
+     int i;
+ 
++    str = kcalloc(2048, sizeof(*str), GFP_KERNEL);
++    if (!str)
++        return -ENOMEM;
++
+     len = count < sizeof(str) ? count : sizeof(str) - 1;
+     rlen = len - copy_from_user(str, buf, len);
+     while ( rlen && str[rlen - 1] <= ' ' )
+@@ -365,6 +369,8 @@ static int proc_write_dbg(struct file *file, const char __user *buf, size_t coun
+         }
+     }
+ 
++    kfree(str);
++
+     return count;
+ }
+ 
+--- a/src/vectoring/ifxmips_vectoring_test.c
++++ b/src/vectoring/ifxmips_vectoring_test.c
+@@ -3,6 +3,7 @@
+ #include <linux/module.h>
+ #include <linux/proc_fs.h>
+ #include <linux/seq_file.h>
++#include <linux/slab.h>
+ 
+ #include "ifxmips_vectoring_stub.h"
+ 
+@@ -46,13 +47,17 @@ static int proc_write_vectoring(struct file *file, const char __user *buf, size_
+ {
+     char *p;
+     int len;
+-    char local_buf[1024];
++    char *local_buf;
+ 
+     unsigned long pkt_len;
+     int ret;
+     unsigned long sys_flag;
+     unsigned long start, end;
+ 
++    local_buf = kcalloc(1024, sizeof(*local_buf), GFP_KERNEL);
++    if (!local_buf)
++        return -ENOMEM;
++
+     len = sizeof(local_buf) < count ? sizeof(local_buf) - 1 : count;
+     len = len - copy_from_user(local_buf, buf, len);
+     local_buf[len] = 0;
+@@ -81,6 +86,8 @@ static int proc_write_vectoring(struct file *file, const char __user *buf, size_
+     else
+         printk("echo send <size> > /proc/driver/vectoring_test\n");
+ 
++    kfree(local_buf);
++
+     return count;
+ }
+ 
diff --git a/package/kernel/lantiq/ltq-vmmc/patches/200-compat.patch b/package/kernel/lantiq/ltq-vmmc/patches/200-compat.patch
index bf9f17ed0577ed..dd6451b52d746d 100644
--- a/package/kernel/lantiq/ltq-vmmc/patches/200-compat.patch
+++ b/package/kernel/lantiq/ltq-vmmc/patches/200-compat.patch
@@ -9,6 +9,16 @@
  /* ============================= */
  /* Local Macros & Definitions    */
  /* ============================= */
+@@ -862,7 +864,9 @@ void  vmmc_module_exit(void)
+ #ifdef MODULE
+ MODULE_DESCRIPTION("VMMC(VoiceMacroMipsCore) device driver - www.lantiq.com");
+ MODULE_AUTHOR("Lantiq Deutschland GmbH");
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(5,11,0))
+ MODULE_SUPPORTED_DEVICE("DANUBE, TWINPASS, INCA-IP2, AR9, VR9");
++#endif
+ MODULE_LICENSE("Dual BSD/GPL");
+ 
+ #if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17))
 --- a/src/mps/drv_mps_vmmc_linux.c
 +++ b/src/mps/drv_mps_vmmc_linux.c
 @@ -80,11 +80,15 @@
diff --git a/package/kernel/lantiq/ltq-vmmc/patches/600-fix-compilation-warning-fallthrough.patch b/package/kernel/lantiq/ltq-vmmc/patches/600-fix-compilation-warning-fallthrough.patch
new file mode 100644
index 00000000000000..7282bc446ddb13
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vmmc/patches/600-fix-compilation-warning-fallthrough.patch
@@ -0,0 +1,10 @@
+--- a/src/drv_vmmc_bbd.c
++++ b/src/drv_vmmc_bbd.c
+@@ -1025,6 +1025,7 @@ static IFX_int32_t vmmc_BBD_WhiteListedCmdWr(VMMC_CHANNEL *pCh,
+                }
+             }
+          }
++         fallthrough;
+       case VMMC_WL_SDD_RING_CFG:
+       case VMMC_WL_SDD_DCDC_CFG:
+       case VMMC_WL_SDD_MWI_CFG:
diff --git a/package/kernel/lantiq/ltq-vmmc/patches/601-fix-compilation-warning-ret-not-handled.patch b/package/kernel/lantiq/ltq-vmmc/patches/601-fix-compilation-warning-ret-not-handled.patch
new file mode 100644
index 00000000000000..da7c1c8a268324
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vmmc/patches/601-fix-compilation-warning-ret-not-handled.patch
@@ -0,0 +1,16 @@
+--- a/src/drv_vmmc_ioctl.c
++++ b/src/drv_vmmc_ioctl.c
+@@ -108,9 +108,11 @@ extern IFX_int32_t VMMC_ChipAccessInit (
+               {\
+               arg* p_arg = VMMC_OS_Malloc (sizeof(arg));\
+               VMMC_ASSERT (p_arg != IFX_NULL);\
+-              copy_from_user (p_arg, (IFX_uint8_t*)ioarg, sizeof(arg));\
++              if (copy_from_user (p_arg, (IFX_uint8_t*)ioarg, sizeof(arg)))\
++                ret = -EFAULT;\
+               ret = func((pContext), p_arg);\
+-              copy_to_user ((IFX_uint8_t*)ioarg, p_arg, sizeof(arg));\
++              if (copy_to_user ((IFX_uint8_t*)ioarg, p_arg, sizeof(arg)))\
++                ret = -EFAULT;\
+               VMMC_OS_Free (p_arg);\
+               }\
+               break
diff --git a/package/kernel/lantiq/vrx518_ep/Makefile b/package/kernel/lantiq/vrx518_ep/Makefile
new file mode 100644
index 00000000000000..b6477b19d6d2e2
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_ep/Makefile
@@ -0,0 +1,57 @@
+#
+# Copyright (C) 2019 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_NAME:=vrx518_ep
+PKG_VERSION:=2.1.0
+PKG_RELEASE:=1
+PKG_LICENSE:=GPL-2.0
+
+include $(INCLUDE_DIR)/package.mk
+
+# TODO this driver depends on the vrx518 aca firmware, add this dependency if
+# that ever gets a compatible license
+define KernelPackage/vrx518_ep
+  SECTION:=sys
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=VRX518 EP Support
+  DEPENDS:=@TARGET_ipq40xx
+  AUTOLOAD:=$(call AutoLoad,26,vrx518)
+  FILES:=$(PKG_BUILD_DIR)/vrx518.ko
+endef
+
+define KernelPackage/vrx518_ep/description
+  VRX518 endpoint driver
+endef
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include/net/
+	$(CP) $(PKG_BUILD_DIR)/include/net/dc_ep.h $(1)/usr/include/net/
+endef
+
+EXTRA_KCONFIG:= \
+	CONFIG_VRX518=m
+#	CONFIG_TEST=m
+#	CONFIG_VRX518_PCIE_SWITCH_BONDING=y
+
+EXTRA_CFLAGS:= \
+	$(patsubst CONFIG_%, -DCONFIG_%=1, $(patsubst %=m,%,$(filter %=m,$(EXTRA_KCONFIG)))) \
+	$(patsubst CONFIG_%, -DCONFIG_%=1, $(patsubst %=y,%,$(filter %=y,$(EXTRA_KCONFIG)))) \
+	-I$(PKG_BUILD_DIR)/include
+
+define Build/Compile
+	$(KERNEL_MAKE) \
+		M="$(PKG_BUILD_DIR)" \
+		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
+		$(EXTRA_KCONFIG) \
+		modules
+endef
+
+$(eval $(call KernelPackage,vrx518_ep))
diff --git a/package/kernel/lantiq/vrx518_ep/patches/100-compat.patch b/package/kernel/lantiq/vrx518_ep/patches/100-compat.patch
new file mode 100644
index 00000000000000..f5b917e7078238
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_ep/patches/100-compat.patch
@@ -0,0 +1,73 @@
+--- a/ep.c
++++ b/ep.c
+@@ -373,23 +373,23 @@ int dc_ep_dev_info_req(int dev_idx, enum
+ 
+ 	switch (module) {
+ 	case DC_EP_INT_PPE:
+-		dev->irq = priv->irq_base;
++		dev->irq = pci_irq_vector(priv->pdev, 0);
+ 		if (priv->msi_mode == DC_EP_8_MSI_MODE) {
+-			dev->aca_tx_irq = priv->irq_base + 7;
+-			dev->aca_rx_irq = priv->irq_base + 6;
++			dev->aca_tx_irq = pci_irq_vector(priv->pdev, 7);
++			dev->aca_rx_irq = pci_irq_vector(priv->pdev, 6);
+ 		} else if (priv->msi_mode == DC_EP_4_MSI_MODE) {
+-			dev->aca_tx_irq = priv->irq_base + 2;
+-			dev->aca_rx_irq = priv->irq_base + 3;
++			dev->aca_tx_irq = pci_irq_vector(priv->pdev, 2);
++			dev->aca_rx_irq = pci_irq_vector(priv->pdev, 3);
+ 		} else {
+ 			dev_err(dev->dev, "%s ACA should never occur\n",
+ 				__func__);
+ 		}
+ 		break;
+ 	case DC_EP_INT_MEI:
+-		dev->irq = priv->irq_base + 1;
++		dev->irq = pci_irq_vector(priv->pdev, 1);
+ 		break;
+ 	default:
+-		dev->irq = priv->irq_base;
++		dev->irq = pci_irq_vector(priv->pdev, 0);
+ 		break;
+ 	}
+ 
+@@ -466,8 +466,8 @@ static int dc_ep_msi_enable(struct pci_d
+ 		return -EIO;
+ 	}
+ 
+-	err = pci_enable_msi_exact(pdev, nvec);
+-	if (err) {
++	err = pci_alloc_irq_vectors(pdev, nvec, nvec, PCI_IRQ_MSI | PCI_IRQ_LEGACY);
++	if (err < 0) {
+ 		dev_err(&pdev->dev,
+ 			"%s: Failed to enable MSI interrupts error code: %d\n",
+ 			__func__, err);
+@@ -654,7 +654,7 @@ static int dc_ep_probe(struct pci_dev *p
+ 		goto err_iomap;
+ 
+ 	spin_lock(&dc_ep_lock);
+-	priv->irq_base = pdev->irq;
++	priv->irq_base = pci_irq_vector(pdev, 0);
+ 	spin_unlock(&dc_ep_lock);
+ 
+ #ifndef CONFIG_OF
+@@ -715,7 +715,7 @@ static void dc_ep_remove(struct pci_dev
+ 	dc_ep_icu_disable(priv);
+ 	pci_iounmap(pdev, priv->mem);
+ 	pci_release_region(pdev, DC_EP_BAR_NUM);
+-	pci_disable_msi(pdev);
++	pci_free_irq_vectors(pdev);
+ 	wmb();
+ 	pci_clear_master(pdev);
+ 	pci_disable_device(pdev);
+--- a/aca.c
++++ b/aca.c
+@@ -756,7 +756,7 @@ static void aca_hif_param_init_done(stru
+ 	addr = fw_param->init_addr;
+ 	dev_dbg(priv->dev, "init_addr: %x\n", addr);
+ 	memcpy_toio(priv->mem + addr, hif_params, sizeof(*hif_params));
+-	kzfree(hif_params);
++	kfree(hif_params);
+ 	dev_dbg(priv->dev, "%s\n", __func__);
+ }
+ 
diff --git a/package/kernel/lantiq/vrx518_ep/patches/200-fix-irq-masking.patch b/package/kernel/lantiq/vrx518_ep/patches/200-fix-irq-masking.patch
new file mode 100644
index 00000000000000..b833c72bec3363
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_ep/patches/200-fix-irq-masking.patch
@@ -0,0 +1,49 @@
+Fix double negation of bitmask in dc_ep_icu_disable andwr32_mask.
+Also add locking to ensure the masking is applied atomically.
+
+--- a/misc.c
++++ b/misc.c
+@@ -68,12 +68,22 @@ void dc_ep_icu_disable(struct dc_ep_priv
+ 
+ void dc_ep_icu_dis_intr(struct dc_ep_priv *priv, u32 bits)
+ {
+-	wr32_mask(~bits, 0, ICU_IMER);
++	struct dc_aca *aca = to_aca(priv);
++	unsigned long flags;
++
++	spin_lock_irqsave(&aca->icu_lock, flags);
++	wr32_mask(bits, 0, ICU_IMER);
++	spin_unlock_irqrestore(&aca->icu_lock, flags);
+ }
+ 
+ void dc_ep_icu_en_intr(struct dc_ep_priv *priv, u32 bits)
+ {
++	struct dc_aca *aca = to_aca(priv);
++	unsigned long flags;
++
++	spin_lock_irqsave(&aca->icu_lock, flags);
+ 	wr32_mask(0, bits, ICU_IMER);
++	spin_unlock_irqrestore(&aca->icu_lock, flags);
+ }
+ 
+ void dc_ep_assert_device(struct dc_ep_priv *priv, u32 bits)
+--- a/aca.c
++++ b/aca.c
+@@ -1158,6 +1158,7 @@ void dc_aca_info_init(struct dc_ep_priv
+ 	struct dc_aca *aca = to_aca(priv);
+ 
+ 	aca->initialized = false;
++	spin_lock_init(&aca->icu_lock);
+ 	spin_lock_init(&aca->clk_lock);
+ 	spin_lock_init(&aca->rcu_lock);
+ 	mutex_init(&aca->pin_lock);
+--- a/aca.h
++++ b/aca.h
+@@ -470,6 +470,7 @@ struct aca_hif_params {
+ 
+ struct dc_aca {
+ 	bool initialized;
++	spinlock_t	icu_lock;
+ 	spinlock_t	clk_lock;
+ 	spinlock_t	rcu_lock;
+ 	struct mutex	pin_lock;
diff --git a/package/kernel/lantiq/vrx518_ep/src/Kconfig b/package/kernel/lantiq/vrx518_ep/src/Kconfig
new file mode 100644
index 00000000000000..296bc4c7aae652
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_ep/src/Kconfig
@@ -0,0 +1,9 @@
+config TEST
+	tristate "Intel(R) VRX518 SmartPHY DSL Test Driver"
+	depends on VRX518
+	---help---
+	  This driver supports Intel(R) VRX518 DSL interrupt and ACA test.
+
+	  To compile this driver as a module, choose M here. The module
+	  will be called vrx518.  MSI interrupt support is required for
+	  this driver to work correctly.
diff --git a/package/kernel/lantiq/vrx518_ep/src/Makefile b/package/kernel/lantiq/vrx518_ep/src/Makefile
new file mode 100644
index 00000000000000..b79e74b317042a
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_ep/src/Makefile
@@ -0,0 +1,33 @@
+################################################################################
+#
+# Intel SmartPHY DSL PCIe EP/ACA Linux driver
+# Copyright(c) 2016 Intel Corporation.
+#
+# This program is free software; you can redistribute it and/or modify it
+# under the terms and conditions of the GNU General Public License,
+# version 2, as published by the Free Software Foundation.
+#
+# This program is distributed in the hope it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+# more details.
+#
+# You should have received a copy of the GNU General Public License along with
+# this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# The full GNU General Public License is included in this distribution in
+# the file called "COPYING".
+#
+################################################################################
+
+#
+# Makefile for the Intel(R) SmartPHY PCIe/ACA driver
+#
+
+obj-$(CONFIG_VRX518) += vrx518.o
+
+vrx518-objs := ep.o aca.o misc.o
+
+obj-$(CONFIG_TEST) += test/
+
diff --git a/package/kernel/lantiq/vrx518_ep/src/aca.c b/package/kernel/lantiq/vrx518_ep/src/aca.c
new file mode 100644
index 00000000000000..3fcf454884ab23
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_ep/src/aca.c
@@ -0,0 +1,1209 @@
+/*******************************************************************************
+
+  Intel SmartPHY DSL PCIe Endpoint/ACA Linux driver
+  Copyright(c) 2016 Intel Corporation.
+
+  This program is free software; you can redistribute it and/or modify it
+  under the terms and conditions of the GNU General Public License,
+  version 2, as published by the Free Software Foundation.
+
+  This program is distributed in the hope it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+  more details.
+
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc.,
+  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+
+  The full GNU General Public License is included in this distribution in
+  the file called "COPYING".
+
+*******************************************************************************/
+#define DEBUG
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/delay.h>
+#include <linux/firmware.h>
+
+#include <net/dc_ep.h>
+
+#include "regs.h"
+#include "ep.h"
+#include "misc.h"
+#include "aca.h"
+
+#define ACA_FW_FILE		"aca_fw.bin"
+
+#define set_mask_bit(val, set, mask, bits)		\
+	(val = (((val) & (~((mask) << (bits))))	\
+	| (((set) & (mask)) << (bits))))
+
+static char soc_str[128];
+
+static const char *const aca_img_type_str[ACA_IMG_MAX] = {
+	"vrx518",
+	"vrx618",
+	"falcon-mx",
+	"pmua",
+};
+
+static void soc_type_to_str(u32 soc)
+{
+	memset(soc_str, 0, sizeof(soc_str));
+
+	if ((soc & ACA_SOC_XRX300))
+		strcat(soc_str, "xrx300 ");
+
+	if ((soc & ACA_SOC_XRX500))
+		strcat(soc_str, "xrx500 ");
+
+	if ((soc & ACA_SOC_PUMA))
+		strcat(soc_str, "puma ");
+
+	if ((soc & ACA_SOC_3RD_PARTY))
+		strcat(soc_str, "third party SoC ");
+}
+
+static const char *fw_id_to_str(u32 fw_id)
+{
+	switch (fw_id) {
+	case ACA_FW_TXIN:
+		return "txin";
+
+	case ACA_FW_TXOUT:
+		return "txout";
+
+	case ACA_FW_RXIN:
+		return "rxin";
+
+	case ACA_FW_RXOUT:
+		return "rxout";
+
+	case ACA_FW_GNRC:
+		return "Genrisc";
+
+	default:
+		return "unknow";
+	}
+}
+
+static const char * const sec_id_str[] = {
+	"Unknown", "HIF", "GenRisc", "MAC_HT", "TXIN", "TXIN_PDRING", "TXOUT",
+	"TXOUT_PDRING", "RXIN", "RXIN_PDRING", "RXOUT", "RXOUT_PDRING", "DMA",
+	"FW_INIT",
+};
+static const char *sec_id_to_str(u32 sec_id)
+{
+	switch (sec_id) {
+	case ACA_SEC_HIF:
+	case ACA_SEC_GNR:
+	case ACA_SEC_MAC_HT:
+	case ACA_SEC_MEM_TXIN:
+	case ACA_SEC_MEM_TXIN_PDRING:
+	case ACA_SEC_MEM_TXOUT:
+	case ACA_SEC_MEM_TXOUT_PDRING:
+	case ACA_SEC_MEM_RXIN:
+	case ACA_SEC_MEM_RXIN_PDRING:
+	case ACA_SEC_MEM_RXOUT:
+	case ACA_SEC_MEM_RXOUT_PDRING:
+	case ACA_SEC_DMA:
+	case ACA_SEC_FW_INIT:
+		return sec_id_str[sec_id];
+	case ACA_SEC_FW:
+		return "ACA FW";
+
+	default:
+		return "unknown";
+	}
+}
+
+static inline struct aca_fw_info *to_fw_info(struct dc_ep_priv *priv)
+{
+	return &priv->aca.fw_info;
+}
+
+static inline struct aca_fw_dl_addr *to_fw_addr(struct dc_ep_priv *priv)
+{
+	return &priv->aca.fw_info.fw_dl;
+}
+
+static inline struct aca_mem_layout *to_mem_layout(struct dc_ep_priv *priv)
+{
+	return &priv->aca.fw_info.mem_layout;
+}
+
+static inline struct aca_pdmem_layout *to_pdmem_layout(struct dc_ep_priv *priv)
+{
+	return &priv->aca.fw_info.pdmem_layout;
+}
+
+static inline struct aca_fw_param *to_aca_fw_param(struct dc_ep_priv *priv)
+{
+	return &priv->aca.fw_info.fw_param;
+}
+
+static inline struct aca_hif_params *to_hif_params(struct dc_ep_priv *priv)
+{
+	return priv->aca.hif_params;
+}
+
+static const struct firmware *aca_fetch_fw_file(struct dc_ep_priv *priv,
+	char *dir, const char *file)
+{
+	int ret;
+	char filename[100] = {0};
+	const struct firmware *fw;
+
+	if (file == NULL)
+		return ERR_PTR(-ENOENT);
+
+	if (dir == NULL)
+		dir = ".";
+
+	snprintf(filename, sizeof(filename), "%s/%s", dir, file);
+	ret = request_firmware(&fw, filename, priv->dev);
+	if (ret)
+		return ERR_PTR(ret);
+
+	return fw;
+}
+
+void dc_aca_free_fw_file(struct dc_ep_priv *priv)
+{
+	struct aca_fw_info *fw_info = to_fw_info(priv);
+
+	if (fw_info->fw && !IS_ERR(fw_info->fw))
+		release_firmware(fw_info->fw);
+
+	fw_info->fw = NULL;
+	fw_info->fw_data = NULL;
+	fw_info->fw_len = 0;
+}
+
+static void aca_dma_parse(struct dc_ep_priv *priv, const char *data, int chn)
+{
+	int i;
+	u32 cid, dbase;
+	struct aca_fw_dma *fw_dma;
+	struct aca_fw_info *fw_info = to_fw_info(priv);
+
+	fw_info->chan_num = chn;
+
+	for (i = 0; i < fw_info->chan_num; i++) {
+		fw_dma = (struct aca_fw_dma *)(data + i * sizeof(*fw_dma));
+		cid = be32_to_cpu(fw_dma->cid);
+		dbase = be32_to_cpu(fw_dma->base);
+		fw_info->adma_desc_base[cid] = dbase;
+		dev_dbg(priv->dev, "dma channel %d desc base 0x%08x\n",
+			cid, dbase);
+	}
+}
+
+static void aca_sram_desc_parse(struct dc_ep_priv *priv, const char *data,
+	u32 sid)
+{
+	u32 dbase, dnum;
+	struct aca_sram_desc *desc_base;
+	struct aca_mem_layout *mem_layout = to_mem_layout(priv);
+	struct aca_pdmem_layout *pdmem = to_pdmem_layout(priv);
+
+	desc_base = (struct aca_sram_desc *)data;
+	dbase = be32_to_cpu(desc_base->dbase);
+	dnum = be32_to_cpu(desc_base->dnum);
+
+	dev_dbg(priv->dev, "Sec %s desc base 0x%08x, des_num: %d\n",
+		sec_id_to_str(sid), dbase, dnum);
+
+	switch (sid) {
+	case ACA_SEC_MEM_TXIN:
+		mem_layout->txin_host_desc_base = dbase;
+		mem_layout->txin_host_dnum = dnum;
+		break;
+
+	case ACA_SEC_MEM_TXOUT:
+		mem_layout->txout_host_desc_base = dbase;
+		mem_layout->txout_host_dnum = dnum;
+		break;
+
+	case ACA_SEC_MEM_RXIN:
+		mem_layout->rxin_host_desc_base = dbase;
+		mem_layout->rxin_host_dnum = dnum;
+		break;
+
+	case ACA_SEC_MEM_RXOUT:
+		mem_layout->rxout_host_desc_base = dbase;
+		mem_layout->rxout_host_dnum = dnum;
+		break;
+	case ACA_SEC_MEM_TXIN_PDRING:
+		pdmem->txin_pd_desc_base = dbase;
+		pdmem->txin_pd_dnum = dnum;
+		break;
+	case ACA_SEC_MEM_TXOUT_PDRING:
+		pdmem->txout_pd_desc_base = dbase;
+		pdmem->txout_pd_dnum = dnum;
+		break;
+	case ACA_SEC_MEM_RXIN_PDRING:
+		pdmem->rxin_pd_desc_base = dbase;
+		pdmem->rxin_pd_dnum = dnum;
+		break;
+	case ACA_SEC_MEM_RXOUT_PDRING:
+		pdmem->rxin_pd_desc_base = dbase;
+		pdmem->rxin_pd_dnum = dnum;
+		break;
+	default:
+		dev_err(priv->dev, "Unknow aca sram section %d\n", sid);
+		break;
+	}
+}
+
+static void aca_init_parse(struct dc_ep_priv *priv, const char *data,
+	u32 sid)
+{
+	struct aca_fw_param *fw_param = to_aca_fw_param(priv);
+	struct aca_fw_param *param;
+	u32 hdr_sz, hdr_addr;
+
+	param = (struct aca_fw_param *)data;
+	hdr_sz = be32_to_cpu(param->st_sz);
+	hdr_addr = be32_to_cpu(param->init_addr);
+
+	fw_param->init_addr = hdr_addr;
+	fw_param->st_sz = hdr_sz;
+	dev_dbg(priv->dev, "init st size: %d, addr: 0x%x\n",
+		hdr_sz, hdr_addr);
+}
+
+static void aca_fw_parse(struct dc_ep_priv *priv, const char *data,
+	const char *fw_base, int fw_num)
+{
+	int i;
+	size_t size;
+	u32 id, offset, addr;
+	struct aca_int_hdr *hdr;
+	struct aca_fw_dl_addr *fw_dl = to_fw_addr(priv);
+
+	fw_dl->fw_num = fw_num;
+
+	for (i = 0; i < fw_dl->fw_num; i++) {
+		hdr = (struct aca_int_hdr *)(data + i * sizeof(*hdr));
+		id = be32_to_cpu(hdr->id);
+		offset = be32_to_cpu(hdr->offset);
+		size = be32_to_cpu(hdr->size);
+		addr = be32_to_cpu(hdr->load_addr);
+
+		fw_dl->fw_addr[i].fw_id = id;
+		fw_dl->fw_addr[i].fw_load_addr = addr;
+		fw_dl->fw_addr[i].fw_size = size;
+		fw_dl->fw_addr[i].fw_base = fw_base + offset;
+		dev_dbg(priv->dev,
+			"aca %s fw offset 0x%x size %zd loc 0x%x fw base %p\n",
+			fw_id_to_str(id), offset, size, addr, fw_base + offset);
+	}
+}
+
+/* --------------------------------------------------------
+  |              Fixed header (20Bytes)                   |
+  ---------------------------------------------------------
+  |              Variable header                          |
+  |                ie / payload                           |
+  |-------------------------------------------------------|
+  |               Actual ACA FW                           |
+  ---------------------------------------------------------
+*/
+static int aca_section_parse(struct dc_ep_priv *priv, const char *fw_data)
+{
+	int ret = 0;
+	u32 fixed_hlen;
+	u32 var_hlen;
+	u32 ie_id;
+	size_t ie_len, ie_hlen, ie_dlen;
+	u32 fw_hlen;
+	struct aca_fw_f_hdr *fw_f_hdr;
+	struct aca_fw_ie *ie_hdr;
+	struct aca_int_hdr *aca_hdr;
+	const char *data = fw_data;
+	const char *aca_fw_data;
+	struct device *dev = priv->dev;
+
+	fw_f_hdr = (struct aca_fw_f_hdr *)data;
+
+	fw_hlen = be32_to_cpu(fw_f_hdr->hdr_size);
+	fixed_hlen = sizeof(*fw_f_hdr);
+	var_hlen = fw_hlen - fixed_hlen;
+	ie_hlen = sizeof(*ie_hdr);
+
+	/* Record actual ACA fw data pointer */
+	aca_fw_data = data + fw_hlen;
+
+	/* Point to variable header and parse them */
+	data += fixed_hlen;
+
+	while (var_hlen > ie_hlen) {
+		/* Variable header information element */
+		ie_hdr = (struct aca_fw_ie *)data;
+		ie_id = be32_to_cpu(ie_hdr->id);
+		ie_len = be32_to_cpu(ie_hdr->len);
+		dev_dbg(dev, "Section %s ie_len %zd\n", sec_id_to_str(ie_id),
+			ie_len);
+
+		/* Variable header data conents */
+		data += ie_hlen;
+		var_hlen -= ie_hlen;
+
+		switch (ie_id) {
+		case ACA_SEC_HIF:
+		case ACA_SEC_GNR:
+		case ACA_SEC_MAC_HT:
+			ie_dlen = ie_len * sizeof(struct aca_fw_reg);
+			data += ie_dlen;
+			var_hlen -= ie_dlen;
+
+			break;
+
+		case ACA_SEC_MEM_TXIN:
+		case ACA_SEC_MEM_TXOUT:
+		case ACA_SEC_MEM_RXIN:
+		case ACA_SEC_MEM_RXOUT:
+		case ACA_SEC_MEM_TXIN_PDRING:
+		case ACA_SEC_MEM_TXOUT_PDRING:
+		case ACA_SEC_MEM_RXIN_PDRING:
+		case ACA_SEC_MEM_RXOUT_PDRING:
+			aca_sram_desc_parse(priv, data, ie_id);
+			ie_dlen = ie_len * sizeof(struct aca_sram_desc);
+			data += ie_dlen;
+			var_hlen -= ie_dlen;
+			break;
+
+		case ACA_SEC_DMA:
+			if (ie_len > ACA_DMA_CHAN_MAX) {
+				dev_err(dev, "invalid dma channel %d\n",
+					ie_len);
+				ret = -EINVAL;
+				goto done;
+			}
+			aca_dma_parse(priv, data, ie_len);
+			ie_dlen = ie_len * sizeof(struct aca_fw_dma);
+			data += ie_dlen;
+			var_hlen -= ie_dlen;
+			break;
+
+		case ACA_SEC_FW_INIT:
+			aca_init_parse(priv, data, ie_id);
+			ie_dlen = ie_len * sizeof(struct aca_fw_param);
+			data += ie_dlen;
+			var_hlen -= ie_dlen;
+			break;
+
+		case ACA_SEC_FW:
+			if (ie_len > ACA_FW_MAX) {
+				dev_err(dev, "Too many aca fws %d\n", ie_len);
+				ret = -EINVAL;
+				goto done;
+			}
+			aca_fw_parse(priv, data, aca_fw_data, ie_len);
+			ie_dlen = ie_len * sizeof(*aca_hdr);
+			data += ie_dlen;
+			var_hlen -= ie_dlen;
+			break;
+
+		default:
+			dev_warn(dev, "Unknown Sec id: %u\n", ie_id);
+			break;
+		}
+	}
+done:
+	return ret;
+}
+
+static int aca_fetch_fw_api(struct dc_ep_priv *priv, const char *name)
+{
+	int ret;
+	size_t hdr_len;
+	const u8 *fw_data;
+	size_t fw_len;
+	char dir[8] = {0};
+	union fw_ver ver;
+	union img_soc_type type;
+	struct device *dev = priv->dev;
+	struct aca_fw_f_hdr *fw_f_hdr;
+	struct aca_fw_info *fw_info = to_fw_info(priv);
+
+	sprintf(dir, "%04x", priv->pdev->device);
+	fw_info->fw = aca_fetch_fw_file(priv, dir, name);
+	if (IS_ERR(fw_info->fw)) {
+		dev_err(dev, "Could not fetch firmware file '%s': %ld\n",
+			name, PTR_ERR(fw_info->fw));
+		return PTR_ERR(fw_info->fw);
+	}
+
+	fw_data = fw_info->fw->data;
+	fw_len = fw_info->fw->size;
+
+	/* Parse the fixed header part */
+	fw_f_hdr = (struct aca_fw_f_hdr *)fw_data;
+	ver.all = be32_to_cpu(fw_f_hdr->ver);
+
+	dev_info(dev, "ACA fw build %d branch %d major 0x%2x minor 0x%04x\n",
+		ver.field.build, ver.field.branch,
+		ver.field.major, ver.field.minor);
+
+	type.all = be32_to_cpu(fw_f_hdr->type);
+
+	if (type.field.img_type > (ACA_IMG_MAX - 1)
+		|| ((type.field.soc_type & ACA_SOC_MASK) == 0)) {
+		dev_err(dev, "Invalid aca fw img %d soc %d\n",
+			type.field.img_type, type.field.soc_type);
+		ret = -EINVAL;
+		goto err;
+	}
+
+	soc_type_to_str(type.field.soc_type);
+
+	dev_info(priv->dev, "ACA fw for %s supported SoC type %s\n",
+		aca_img_type_str[type.field.img_type], soc_str);
+
+	hdr_len = be32_to_cpu(fw_f_hdr->hdr_size);
+	/* Sanity Check */
+	if (fw_len < hdr_len) {
+		dev_err(dev, "Invalid aca fw hdr len %zd fw len %zd\n",
+			hdr_len, fw_len);
+		ret = -EINVAL;
+		goto err;
+	}
+	dev_dbg(dev, "Header size 0x%08x fw size 0x%08x\n",
+		hdr_len, be32_to_cpu(fw_f_hdr->fw_size));
+	dev_dbg(dev, "section number %d\n",
+		be32_to_cpu(fw_f_hdr->num_section));
+
+	aca_section_parse(priv, fw_data);
+	return 0;
+err:
+	dc_aca_free_fw_file(priv);
+	return ret;
+}
+
+static int aca_fetch_fw(struct dc_ep_priv *priv)
+{
+	return aca_fetch_fw_api(priv, ACA_FW_FILE);
+}
+
+static int aca_fw_download(struct dc_ep_priv *priv)
+{
+	int i, j;
+	u32 val;
+	size_t size;
+	u32 id, load_addr;
+	const char *fw_base;
+	struct aca_fw_dl_addr *fw_dl = to_fw_addr(priv);
+
+	for (i = 0; i < fw_dl->fw_num; i++) {
+		id = fw_dl->fw_addr[i].fw_id;
+		load_addr = fw_dl->fw_addr[i].fw_load_addr;
+		size = fw_dl->fw_addr[i].fw_size;
+		fw_base = fw_dl->fw_addr[i].fw_base;
+
+		if (size % 4) {
+			dev_err(priv->dev,
+				"aca %s fw size is not a multiple of 4\n",
+				fw_id_to_str(id));
+			return -EINVAL;
+		}
+
+		for (j = 0; j < size; j += 4) {
+			val = *((u32 *)(fw_base + j));
+			wr32(cpu_to_be32(val), load_addr + j);
+		}
+		/* Write flush */
+		rd32(load_addr);
+	#ifdef DEBUG
+		{
+		u32 src, dst;
+
+		for (j = 0; j < size; j += 4) {
+			dst = rd32(load_addr + j);
+			src = *((u32 *)(fw_base + j));
+			if (dst != cpu_to_be32(src)) {
+				dev_info(priv->dev,
+					"dst 0x%08x != src 0x%08x\n", dst, src);
+				return -EIO;
+			}
+		}
+		}
+	#endif /* DEBUG */
+	}
+	return 0;
+}
+
+static void aca_dma_ctrl_init(struct dc_ep_priv *priv)
+{
+	u32 val;
+	struct dc_aca *aca = to_aca(priv);
+
+	/* Global software reset CDMA */
+	wr32_mask(0, BIT(CTRL_RST), ADMA_CTRL);
+	while ((rd32(ADMA_CTRL) & BIT(CTRL_RST)))
+		;
+
+	val = rd32(ADMA_ID);
+	/* Record max dma channels for later usage */
+	aca->adma_chans = MS(val, ADMA_ID_CHNR);
+	val = rd32(ADMA_CTRL);
+	/*
+	 * Enable Packet Arbitration
+	 * Enable Meta data copy
+	 * Enable Dedicated Descriptor port
+	 */
+	val |= BIT(CTRL_PKTARB) | BIT(CTRL_MDC) | BIT(CTRL_DSRAM);
+	set_mask_bit(val, 1, 1, CTRL_ENBE); /* Enable byte enable */
+	set_mask_bit(val, 1, 1, CTRL_DCNF); /* 2DW descriptor format */
+	set_mask_bit(val, 1, 1, CTRL_DDBR); /* Descriptor read back */
+	set_mask_bit(val, 1, 1, CTRL_DRB); /* Dynamic burst read */
+	wr32(val, ADMA_CTRL);
+
+	/* Polling cnt cfg */
+	wr32(ADMA_CPOLL_EN | SM(ADMA_DEFAULT_POLL, ADMA_CPOLL_CNT),
+		ADMA_CPOLL);
+}
+
+static void aca_dma_port_init(struct dc_ep_priv *priv)
+{
+	u32 val;
+
+	/* Only one port /port 0 */
+	wr32(0, ADMA_PS);
+	val = rd32(ADMA_PCTRL);
+	set_mask_bit(val, 1, 1, PCTRL_RXBL16);
+	set_mask_bit(val, 1, 1, PCTRL_TXBL16);
+	set_mask_bit(val, 0, 3, PCTRL_RXBL);
+	set_mask_bit(val, 0, 3, PCTRL_TXBL);
+
+	set_mask_bit(val, 0, 3, PCTRL_TXENDI);
+	set_mask_bit(val, 0, 3, PCTRL_RXENDI);
+	wr32(val, ADMA_PCTRL);
+}
+
+static void aca_dma_ch_init(struct dc_ep_priv *priv, u32 cid,
+	u32 dbase, u32 dlen)
+{
+	/* Select channel */
+	wr32(cid, ADMA_CS);
+
+	/* Reset Channel */
+	wr32_mask(0, BIT(CCTRL_RST), ADMA_CCTRL);
+	while ((rd32(ADMA_CCTRL) & BIT(CCTRL_RST)))
+		;
+
+	/* Set descriptor list base and length */
+	wr32(dbase, ADMA_CDBA);
+	wr32(dlen, ADMA_CDLEN);
+
+	/*Clear Intr */
+	wr32(ADMA_CI_ALL, ADMA_CIS);
+	/* Enable Intr */
+	wr32(ADMA_CI_ALL, ADMA_CIE);
+
+	/* Enable Channel */
+	wr32_mask(0, BIT(CCTRL_ONOFF), ADMA_CCTRL);
+	mb();
+}
+
+static void aca_dma_ch_off(struct dc_ep_priv *priv)
+{
+	int i;
+	struct dc_aca *aca = to_aca(priv);
+
+	/* Shared between OS and ACA FW. Stop ACA first */
+	for (i = 0; i < aca->adma_chans; i++) {
+		wr32(i, ADMA_CS);
+		wr32_mask(BIT(CCTRL_ONOFF), 0, ADMA_CCTRL);
+		while (rd32(ADMA_CCTRL) & BIT(CCTRL_ONOFF))
+			;
+	}
+	dev_dbg(priv->dev, "aca dma channel done\n");
+}
+
+static void aca_xbar_ia_reject_set(struct dc_ep_priv *priv, int ia_id)
+{
+	u32 val;
+	int timeout = 1000;
+	struct device *dev = priv->dev;
+
+	/* Set reject bit */
+	wr32(XBAR_CTRL_REJECT, ACA_AGENT_CTRL(ia_id));
+
+	/* Poll burst, readex, resp_waiting, req_active */
+	val = XBAR_STAT_REQ_ACTIVE | XBAR_STAT_RESP_WAITING
+		| XBAR_STAT_BURST | XBAR_STAT_READEX;
+	while (--timeout && !!(rd32(ACA_AGENT_STATUS(ia_id)) & val))
+		udelay(1);
+
+	if (timeout <= 0) {
+		dev_dbg(dev,
+			"ACA XBAR IA: %d reset timeout, pending on 0x%x\n",
+			ia_id, rd32(ACA_AGENT_STATUS(ia_id)));
+		return;
+	}
+}
+
+static void aca_xbar_ia_reject_clr(struct dc_ep_priv *priv, int ia_id)
+{
+	u32 val;
+
+	/* Check reject bit */
+	val = rd32(ACA_AGENT_CTRL(ia_id));
+	if ((val & XBAR_CTRL_REJECT) == 0)
+		return;
+
+	/* Clear reject bit */
+	val &= ~XBAR_CTRL_REJECT;
+	wr32(val, ACA_AGENT_CTRL(ia_id));
+	rd32(ACA_AGENT_CTRL(ia_id));
+}
+
+static void aca_xbar_ia_reset(struct dc_ep_priv *priv, int ia_id)
+{
+	/* ACA IA reset */
+	wr32(XBAR_CTRL_CORE_RESET, ACA_AGENT_CTRL(ia_id));
+
+	/* Read till status become 1 */
+	while ((rd32(ACA_AGENT_STATUS(ia_id)) & XBAR_STAT_CORE_RESET) == 0)
+		;
+
+	/* Clear the IA Reset signal */
+	wr32(0, ACA_AGENT_CTRL(ia_id));
+
+	/* Read till status become 0 */
+	while ((rd32(ACA_AGENT_STATUS(ia_id)) & XBAR_STAT_CORE_RESET) == 1)
+		;
+
+	dev_dbg(priv->dev, "ACA XBAR IA(%d) reset done\n", ia_id);
+}
+
+void dc_aca_shutdown(struct dc_ep_priv *priv)
+{
+	struct dc_aca *aca = to_aca(priv);
+
+	if (aca->initialized) {
+		aca_xbar_ia_reset(priv, ACA_ACC_IA04);
+		aca_xbar_ia_reset(priv, ACA_M_IA06);
+	}
+}
+
+static void aca_dma_init(struct dc_ep_priv *priv)
+{
+	int i;
+	struct aca_fw_info *fw_info = to_fw_info(priv);
+
+	aca_dma_ctrl_init(priv);
+	aca_dma_port_init(priv);
+
+	for (i = 0; i < fw_info->chan_num; i++) {
+		aca_dma_ch_init(priv, i,
+			fw_info->adma_desc_base[i] | priv->phymem,
+			DESC_NUM_PER_CH);
+	}
+
+	dev_dbg(priv->dev, "aca dma init done\n");
+}
+
+static void aca_basic_init(struct dc_ep_priv *priv)
+{
+	u32 addr, mask;
+
+	/* Low 32 is RX, High 32 is TX */
+	wr32(0x1, UMT_ORDER_CFG);
+	/* TXIN/TXOUT/RXIN/RXOUT All Controlled by Genrisc */
+	wr32(0xF, HOST_TYPE);
+	/* Enable Host Gate CLK */
+	wr32(0x4000, HT_GCLK_ENABLE);
+	/* Host Page/MASK */
+	mask = ~priv->memsize + 1;
+	addr = mask | ((priv->phymem & mask) >> 16);
+	wr32(addr, AHB_ARB_HP_REG);
+	wr32(addr, OCP_ARB_ACC_PAGE_REG);
+	/* Stop all functions first */
+	wr32(0, GNRC_EN_TASK_BITMAP);
+
+	/* Enable XBAR */
+	aca_xbar_ia_reject_clr(priv, ACA_ACC_IA04);
+	aca_xbar_ia_reject_clr(priv, ACA_M_IA06);
+
+	dev_dbg(priv->dev, "aca basic config done\n");
+}
+
+static int aca_hif_param_init(struct dc_ep_priv *priv)
+{
+	struct dc_aca *aca  = to_aca(priv);
+
+	aca->hif_params = kzalloc(sizeof(struct aca_hif_params), GFP_KERNEL);
+	if (!aca->hif_params)
+		return -ENOMEM;
+	aca->hif_params->task_mask = 0x0000000F;
+	dev_dbg(priv->dev, "%s\n", __func__);
+	return 0;
+}
+
+static void aca_hif_param_init_done(struct dc_ep_priv *priv)
+{
+	u32 addr;
+	struct aca_hif_params *hif_params = to_hif_params(priv);
+	struct aca_fw_param *fw_param = to_aca_fw_param(priv);
+
+	/* wr32(ACA_HIF_PARAM_ADDR, ACA_HIF_LOC_POS);*/
+	/* addr = rd32(ACA_HIF_LOC_POS);*/
+
+	addr = fw_param->init_addr;
+	dev_dbg(priv->dev, "init_addr: %x\n", addr);
+	memcpy_toio(priv->mem + addr, hif_params, sizeof(*hif_params));
+	kzfree(hif_params);
+	dev_dbg(priv->dev, "%s\n", __func__);
+}
+
+static bool aca_hif_param_init_check(struct dc_ep_priv *priv)
+{
+	u32 addr;
+	int timeout = ACA_LOOP_CNT;
+	u32 offset = offsetof(struct aca_hif_params, magic);
+	struct aca_fw_param *fw_param = to_aca_fw_param(priv);
+
+	/* addr = rd32(ACA_HIF_LOC_POS);*/
+	addr = fw_param->init_addr;
+	while (--timeout && (rd32(addr + offset) != ACA_MAGIC))
+		udelay(1);
+
+	if (timeout <= 0) {
+		dev_err(priv->dev, "aca hif params init failed\n");
+		return false;
+	}
+
+	return true;
+}
+
+static void aca_txin_init(struct dc_ep_priv *priv,
+	struct aca_cfg_param *aca_txin)
+{
+	u32 val = 0;
+	struct aca_mem_layout *mem_layout = to_mem_layout(priv);
+	struct aca_hif_params *hif_params = to_hif_params(priv);
+	struct aca_hif_param *txin_param = &hif_params->txin;
+
+	if (aca_txin->byteswap)
+		val = BYTE_SWAP_EN;
+
+	val |= (aca_txin->hd_size_in_dw - 1)
+		| SM((aca_txin->pd_size_in_dw - 1), PD_DESC_IN_DW);
+	wr32(val, TXIN_CONV_CFG);
+
+	/* SoC cumulative counter address */
+	wr32(aca_txin->soc_cmlt_cnt_addr, GNRC_TXIN_CMLT_CNT_ADDR);
+
+
+	/* SoC descriptors */
+	txin_param->soc_desc_base = aca_txin->soc_desc_base;
+	txin_param->soc_desc_num = aca_txin->soc_desc_num;
+
+	/* Ping/pong buffer */
+	txin_param->pp_buf_base = priv->phymem
+		+ mem_layout->txin_host_desc_base;
+
+	txin_param->pp_buf_num = mem_layout->txin_host_dnum;
+
+	/* PD ring */
+	txin_param->pd_desc_base = priv->phymem
+		+ aca_txin->pd_desc_base;
+	txin_param->pd_desc_num = aca_txin->pd_desc_num;
+
+	dev_dbg(priv->dev, "aca txin init done\n");
+}
+
+static void aca_txout_init(struct dc_ep_priv *priv,
+	struct aca_cfg_param *aca_txout)
+{
+	u32 val = 0;
+	struct aca_mem_layout *mem_layout = to_mem_layout(priv);
+	struct aca_hif_params *hif_params = to_hif_params(priv);
+	struct aca_hif_param *txout_param = &hif_params->txout;
+
+	if (aca_txout->byteswap)
+		val = BYTE_SWAP_EN;
+
+	val |= (aca_txout->hd_size_in_dw - 1)
+		| SM((aca_txout->pd_size_in_dw - 1), PD_DESC_IN_DW);
+	wr32(val, TXOUT_CONV_CFG);
+
+	/* SoC Ring size */
+	val = aca_txout->soc_desc_num;
+	wr32(val, TXOUT_RING_CFG);
+
+	/* SoC cumulative counter address */
+	wr32(aca_txout->soc_cmlt_cnt_addr, GNRC_TXOUT_CMLT_CNT_ADDR);
+	/* SoC descriptors */
+	txout_param->soc_desc_base = aca_txout->soc_desc_base;
+	txout_param->soc_desc_num = aca_txout->soc_desc_num;
+
+	/* Ping/pong buffer */
+	txout_param->pp_buf_base = priv->phymem
+		+mem_layout->txout_host_desc_base;
+
+	txout_param->pp_buf_num = mem_layout->txout_host_dnum;
+
+	/* PD ring */
+	txout_param->pd_desc_base = priv->phymem
+		+ aca_txout->pd_desc_base;
+	txout_param->pd_desc_num = aca_txout->pd_desc_num;
+
+	txout_param->pd_desc_threshold = aca_txout->pp_buf_desc_num;
+
+	dev_dbg(priv->dev, "aca txout init done\n");
+}
+
+static void aca_rxin_init(struct dc_ep_priv *priv,
+	struct aca_cfg_param *aca_rxin)
+{
+	u32 val = 0;
+	struct aca_mem_layout *mem_layout = to_mem_layout(priv);
+	struct aca_hif_params *hif_params = to_hif_params(priv);
+	struct aca_hif_param *rxin_param = &hif_params->rxin;
+
+	if (aca_rxin->byteswap)
+		val = BYTE_SWAP_EN;
+
+	val |= (aca_rxin->hd_size_in_dw - 1)
+		| SM((aca_rxin->pd_size_in_dw - 1), PD_DESC_IN_DW);
+	wr32(val, RXIN_CONV_CFG);
+
+	/* SoC cumulative counter address */
+	wr32(aca_rxin->soc_cmlt_cnt_addr, GNRC_RXIN_CMLT_CNT_ADDR);
+
+    /* RXIN may not be used */
+	if (!(aca_rxin->soc_desc_base))
+		goto __RXIN_DONE;
+	/* SoC descriptors */
+	rxin_param->soc_desc_base = aca_rxin->soc_desc_base;
+	rxin_param->soc_desc_num = aca_rxin->soc_desc_num;
+
+	/* Ping/pong buffer */
+	rxin_param->pp_buf_base = (u32)priv->phymem
+		+ mem_layout->rxin_host_desc_base;
+
+	rxin_param->pp_buf_num = mem_layout->rxin_host_dnum;
+
+	/* PD ring */
+	rxin_param->pd_desc_base = (u32)priv->phymem
+		+ aca_rxin->pd_desc_base;
+	rxin_param->pd_desc_num = aca_rxin->pd_desc_num;
+
+	rxin_param->pd_desc_threshold = aca_rxin->pp_buf_desc_num;
+
+__RXIN_DONE:
+	dev_dbg(priv->dev, "aca rxin init done\n");
+}
+
+static void aca_rxout_init(struct dc_ep_priv *priv,
+	struct aca_cfg_param *aca_rxout)
+{
+	u32 val = 0;
+	struct aca_mem_layout *mem_layout = to_mem_layout(priv);
+	struct aca_hif_params *hif_params = to_hif_params(priv);
+	struct aca_hif_param *rxout_param = &hif_params->rxout;
+
+	if (aca_rxout->byteswap)
+		val = BYTE_SWAP_EN;
+
+	val |= (aca_rxout->hd_size_in_dw - 1)
+		| SM((aca_rxout->pd_size_in_dw - 1), PD_DESC_IN_DW);
+	wr32(val, RXOUT_CONV_CFG);
+
+	/* SoC Ring size */
+	val = aca_rxout->soc_desc_num;
+	wr32(val, RXOUT_RING_CFG);
+
+	/* SoC cumulative counter address */
+	wr32(aca_rxout->soc_cmlt_cnt_addr, GNRC_RXOUT_CMLT_CNT_ADDR);
+	/* SoC descriptors */
+	rxout_param->soc_desc_base = aca_rxout->soc_desc_base;
+	rxout_param->soc_desc_num = aca_rxout->soc_desc_num;
+
+	/* Ping/pong buffer */
+	rxout_param->pp_buf_base = (u32)priv->phymem
+		+ mem_layout->rxout_host_desc_base;
+
+	rxout_param->pp_buf_num = mem_layout->rxout_host_dnum;
+
+	/* PD ring */
+	rxout_param->pd_desc_base = (u32)priv->phymem
+		+ aca_rxout->pd_desc_base;
+	rxout_param->pd_desc_num = aca_rxout->pd_desc_num;
+
+	rxout_param->pd_desc_threshold = aca_rxout->pp_buf_desc_num;
+	dev_dbg(priv->dev, "aca rxout init done\n");
+}
+
+static void aca_mdm_init(struct dc_ep_priv *priv, struct aca_modem_param *mdm)
+{
+	struct aca_proj_param *param;
+
+	if (!mdm)
+		return;
+
+	param = &mdm->mdm_txout;
+	wr32(param->stat | priv->phymem, GNRC_TXOUT_TGT_STAT);
+	wr32(param->pd | priv->phymem, GNRC_TXOUT_TGT_PD_OFF);
+	wr32(param->acc_cnt | priv->phymem, GNRC_TXOUT_TGT_ACCM_CNT);
+
+	param = &mdm->mdm_rxin;
+	wr32(param->stat | priv->phymem, GNRC_RXIN_TGT_STAT);
+	wr32(param->pd | priv->phymem, GNRC_RXIN_TGT_PD_OFF);
+	wr32(param->acc_cnt | priv->phymem, GNRC_RXIN_TGT_ACCM_CNT);
+
+	param = &mdm->mdm_rxout;
+	wr32(param->stat | priv->phymem, GNRC_RXOUT_TGT_STAT);
+	wr32(param->pd | priv->phymem, GNRC_RXOUT_TGT_PD_OFF);
+	wr32(param->acc_cnt | priv->phymem, GNRC_RXOUT_TGT_ACCM_CNT);
+	dev_dbg(priv->dev, "aca mdm init done\n");
+}
+
+static void dc_aca_clk_on(struct dc_ep_priv *priv)
+{
+	dc_ep_clk_on(priv, PMU_ADMA);
+}
+
+static void dc_aca_clk_off(struct dc_ep_priv *priv)
+{
+	dc_ep_clk_off(priv, PMU_ADMA);
+}
+
+static void dc_aca_reset(struct dc_ep_priv *priv)
+{
+	dc_ep_reset_device(priv, RST_ACA_DMA | RST_ACA_HOSTIF);
+}
+
+static void aca_mem_clear(struct dc_ep_priv *priv)
+{
+	struct aca_fw_dl_addr *fw_dl = to_fw_addr(priv);
+
+	memset_io(priv->mem + fw_dl->fw_addr[0].fw_load_addr,
+		0, ACA_ACC_FW_SIZE);
+	memset_io(priv->mem + ACA_SRAM_BASE, 0, ACA_SRAM_SIZE);
+}
+
+int dc_aca_start(struct dc_ep_priv *priv, u32 func, int start)
+{
+	if (!func)
+		return -EINVAL;
+
+	wr32_mask(0, func, GNRC_EN_TASK_BITMAP);
+
+	/* Only do if requested by caller */
+	if (start) {
+		wr32(0x1, GNRC_START_OP); /* Any write will trigger */
+		rd32(GNRC_START_OP);
+		if (!aca_hif_param_init_check(priv))
+			return -EIO;
+	}
+	return 0;
+}
+
+static void aca_sw_reset(struct dc_ep_priv *priv)
+{
+	u32 val = SW_RST_GENRISC | SW_RST_HOSTIF_REG | SW_RST_RXIN
+		| SW_RST_RXOUT | SW_RST_TXIN | SW_RST_TXOUT;
+
+	wr32(val, HT_SW_RST_ASSRT);
+	udelay(1);
+	wr32(val, HT_SW_RST_RELEASE);
+	wmb();
+}
+
+int dc_aca_stop(struct dc_ep_priv *priv, u32 *func, int reset)
+{
+	u32 val = *func;
+	u32 reg;
+
+	if (!val)
+		return 0;
+
+	*func = 0;
+
+	/* Only do it if reset is required. Otherwise, pending is fine */
+	if (reset) {
+		if (val & ACA_TXIN_EN) {
+			reg = rd32(TXIN_COUNTERS);
+			if (MS(reg, ACA_PENDING_JOB)
+				|| (MS(reg, ACA_AVAIL_BUF) != ACA_PP_BUFS)) {
+				*func = ACA_TXIN_EN;
+				return -EBUSY;
+			}
+		}
+
+		if (val & ACA_TXOUT_EN) {
+			reg = rd32(TXOUT_COUNTERS);
+			if (MS(reg, ACA_PENDING_JOB)
+				|| (MS(reg, ACA_AVAIL_BUF) != ACA_PP_BUFS)) {
+				*func = ACA_TXOUT_EN;
+				return -EBUSY;
+			}
+		}
+
+
+		if (val & ACA_RXIN_EN) {
+			reg = rd32(RXIN_COUNTERS);
+			if (MS(reg, ACA_PENDING_JOB)
+				|| (MS(reg, ACA_AVAIL_BUF) != ACA_PP_BUFS)) {
+				*func = ACA_RXIN_EN;
+				return -EBUSY;
+			}
+		}
+
+		if (val & ACA_RXOUT_EN) {
+			reg = rd32(RXOUT_COUNTERS);
+			if (MS(reg, ACA_PENDING_JOB)
+				|| (MS(reg, ACA_AVAIL_BUF) != ACA_PP_BUFS)) {
+				*func = ACA_RXOUT_EN;
+				return -EBUSY;
+			}
+		}
+	}
+
+	wr32_mask(val, 0, GNRC_EN_TASK_BITMAP);
+
+	if (reset) {
+		aca_dma_ch_off(priv);
+		aca_xbar_ia_reject_set(priv, ACA_ACC_IA04);
+		aca_xbar_ia_reject_set(priv, ACA_M_IA06);
+		aca_sw_reset(priv);
+	}
+	return 0;
+}
+
+#ifdef CONFIG_SOC_TYPE_XWAY
+static void aca_grx330_init(struct dc_ep_priv *priv)
+{
+	wr32(0x0044001E, TXIN_CFG1);
+	wr32(0x0040041F, TXIN_CFG2);
+	wr32(0x007FE020, TXIN_CFG3);
+
+	wr32(0x0044001F, TXOUT_CFG1);
+	wr32(0x0040041F, TXOUT_CFG2);
+	wr32(0x007BE020, TXOUT_CFG3);
+
+	wr32(0x0044001F, RXOUT_CFG1);
+	wr32(0x0040041F, RXOUT_CFG2);
+	wr32(0x007BE020, RXOUT_CFG3);
+
+	wr32(0x0044001E, RXIN_CFG1);
+	wr32(0x0040041F, RXIN_CFG2);
+	wr32(0x007FE020, RXIN_CFG3);
+
+	wr32(0x1, TXIN_DST_OWWBIT_CFG4);
+	wr32(0x1, TXOUT_DST_OWWBIT_CFG4);
+	wr32(0x1, RXOUT_SRC_OWNBIT_CFG3);
+	wr32(0x1, RXIN_SRC_OWNBIT_CFG3);
+
+	wr32(0x0, GNRC_TXIN_BUF_PREFILL);
+	wr32(0x0, GNRC_TXIN_BUF_PREFILL + 0x4);
+	wr32(0x0, GNRC_TXIN_BUF_PREFILL + 0x8);
+	wr32(0x0, GNRC_TXIN_BUF_PREFILL + 0xc);
+	wr32(0x0, GNRC_TXIN_BUF_PREFILL + 0x10);
+	wr32(0x0, GNRC_TXIN_BUF_PREFILL + 0x14);
+	wr32(0x0, GNRC_TXIN_BUF_PREFILL + 0x18);
+	wr32(0x0, GNRC_TXIN_BUF_PREFILL + 0x1c);
+}
+#endif
+
+int dc_aca_init(struct dc_ep_priv *priv, struct aca_param *param,
+	struct aca_modem_param *mdm)
+{
+	int ret;
+	struct dc_aca *aca = to_aca(priv);
+
+	dc_aca_clk_on(priv);
+	dc_aca_reset(priv);
+
+	ret = aca_fetch_fw(priv);
+	if (ret) {
+		dev_err(priv->dev,
+			"could not fetch firmware files %d\n", ret);
+		dc_aca_clk_off(priv);
+		return ret;
+	}
+
+	aca_mem_clear(priv);
+	aca_dma_init(priv);
+	aca_basic_init(priv);
+	aca_fw_download(priv);
+	aca_hif_param_init(priv);
+	aca_txin_init(priv, &param->aca_txin);
+	aca_txout_init(priv, &param->aca_txout);
+	aca_rxout_init(priv, &param->aca_rxout);
+	aca_rxin_init(priv, &param->aca_rxin);
+	aca_hif_param_init_done(priv);
+	aca_mdm_init(priv, mdm);
+#ifdef CONFIG_SOC_TYPE_XWAY
+	aca_grx330_init(priv);
+#endif
+	aca->initialized = true;
+	dev_info(priv->dev, "aca init done\n");
+	return 0;
+}
+
+static int aca_max_gpio(struct dc_ep_priv *priv)
+{
+	return fls(rd32(PADC_AVAIL));
+}
+
+void dc_aca_info_init(struct dc_ep_priv *priv)
+{
+	struct dc_aca *aca = to_aca(priv);
+
+	aca->initialized = false;
+	spin_lock_init(&aca->clk_lock);
+	spin_lock_init(&aca->rcu_lock);
+	mutex_init(&aca->pin_lock);
+	aca->max_gpio = aca_max_gpio(priv);
+}
+
+#define ACA_ENDIAN_ADDR(addr, endian)		\
+{						\
+	if (endian == ACA_BIG_ENDIAN)		\
+		return addr##_BE;		\
+	else					\
+		return addr;			\
+}
+
+u32 aca_umt_msg_addr(struct dc_ep_priv *priv, u32 endian, u32 type)
+{
+	switch (type) {
+	case ACA_TXIN:
+		ACA_ENDIAN_ADDR(TXIN_HD_ACCUM_ADD, endian);
+	case ACA_RXIN:
+		ACA_ENDIAN_ADDR(RXIN_HD_ACCUM_ADD, endian);
+	case ACA_TXOUT:
+		ACA_ENDIAN_ADDR(TXOUT_HD_ACCUM_SUB, endian);
+	case ACA_RXOUT:
+		ACA_ENDIAN_ADDR(RXOUT_HD_ACCUM_SUB, endian);
+	default:
+		ACA_ENDIAN_ADDR(RXIN_HD_ACCUM_ADD, endian);
+	};
+}
+
+void dc_aca_event_addr_get(struct dc_ep_priv *priv,
+	struct aca_event_reg_addr *regs)
+{
+	regs->txin_acc_sub = TXIN_ACA_ACCUM_SUB;
+	regs->txout_acc_add = TXOUT_ACA_ACCUM_ADD;
+	regs->rxin_acc_sub = RXIN_ACA_ACCUM_SUB;
+	regs->rxout_acc_add = RXOUT_ACA_ACCUM_ADD;
+}
+
+void dc_aca_txin_sub_ack(struct dc_ep_priv *priv, u32 val)
+{
+	wr32(val, TXIN_ACA_ACCUM_SUB);
+}
+
+u32 dc_aca_txin_hd_cnt(struct dc_ep_priv *priv)
+{
+	return rd32(TXIN_ACA_HD_ACC_CNT);
+}
+
diff --git a/package/kernel/lantiq/vrx518_ep/src/aca.h b/package/kernel/lantiq/vrx518_ep/src/aca.h
new file mode 100644
index 00000000000000..10f2ecb4c16575
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_ep/src/aca.h
@@ -0,0 +1,481 @@
+/*******************************************************************************
+
+  Intel SmartPHY DSL PCIe Endpoint/ACA Linux driver
+  Copyright(c) 2016 Intel Corporation.
+
+  This program is free software; you can redistribute it and/or modify it
+  under the terms and conditions of the GNU General Public License,
+  version 2, as published by the Free Software Foundation.
+
+  This program is distributed in the hope it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+  more details.
+
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc.,
+  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+
+  The full GNU General Public License is included in this distribution in
+  the file called "COPYING".
+
+*******************************************************************************/
+
+#ifndef ACA_H
+#define ACA_H
+
+#define HOST_IF_BASE		0x50000
+#define ACA_CORE_BASE		0x50800
+#define GENRISC_IRAM_BASE	0x58000
+#define GENRISC_SPRAM_BASE	0x5C000
+#define GENRISC_BASE		0x5D000
+#define MAC_HT_EXT_BASE		0x5D400
+#define ACA_SRAM_BASE		0x100000
+#define ACA_SRAM_SIZE		0x2000 /* Project specific */
+#define ACA_HOSTIF_ADDR_SHIFT	2
+
+#define ACA_HOSTIF_ADDR(addr)	((addr) >> ACA_HOSTIF_ADDR_SHIFT)
+
+#define ACA_HIF_LOC_POS		0x100060
+#define ACA_HIF_PARAM_ADDR	0x100064
+#define ACA_ACC_FW_SIZE		0x400
+#define ACA_LOOP_CNT		1000
+
+/* TODO: change name after karthik explained */
+#define TXIN_DST_OWNBIT		0xC4
+#define TXOUT_DST_OWNBIT	0x1C4
+#define RXOUT_SRC_OWNBIT	0x3C4
+#define RXIN_DST_OWNBIT		0x2C4
+
+/* Genrisc Internal Host Descriptor(Ping/Pong) decided by ACA fw header */
+/* ACA Core */
+#define ACA_CORE_REG(X)	(ACA_CORE_BASE + (X))
+#define TXIN_CFG1	ACA_CORE_REG(0x0)
+#define TXIN_CFG2	ACA_CORE_REG(0x4)
+#define TXIN_CFG3	ACA_CORE_REG(0x8)
+#define TXIN_DST_OWWBIT_CFG4	ACA_CORE_REG(TXIN_DST_OWNBIT)
+
+#define TXOUT_CFG1	ACA_CORE_REG(0x100)
+#define TXOUT_CFG2	ACA_CORE_REG(0x104)
+#define TXOUT_CFG3	ACA_CORE_REG(0x108)
+#define TXOUT_DST_OWWBIT_CFG4	ACA_CORE_REG(TXOUT_DST_OWNBIT)
+
+#define RXOUT_CFG1	ACA_CORE_REG(0x300)
+#define RXOUT_CFG2	ACA_CORE_REG(0x304)
+#define RXOUT_CFG3	ACA_CORE_REG(0x308)
+#define RXOUT_SRC_OWNBIT_CFG3	ACA_CORE_REG(RXOUT_SRC_OWNBIT)
+
+#define RXIN_CFG1	ACA_CORE_REG(0x200)
+#define RXIN_CFG2	ACA_CORE_REG(0x204)
+#define RXIN_CFG3	ACA_CORE_REG(0x208)
+#define RXIN_SRC_OWNBIT_CFG3	ACA_CORE_REG(RXIN_DST_OWNBIT)
+
+/* Genrisc */
+#define GNRC_REG(X)		(GENRISC_BASE + (X))
+#define GNRC_STOP_OP		GNRC_REG(0x60)
+#define GNRC_CONTINUE_OP	GNRC_REG(0x64)
+#define GNRC_START_OP		GNRC_REG(0x90)
+
+/* HOST Interface Register */
+#define HOST_IF_REG(X)		(HOST_IF_BASE + (X))
+#define HD_DESC_IN_DW		0x7u
+#define HD_DESC_IN_DW_S		0
+#define PD_DESC_IN_DW		0x70u
+#define PD_DESC_IN_DW_S		4
+#define BYTE_SWAP_EN		BIT(28)
+
+#define TXIN_CONV_CFG		HOST_IF_REG(0x14)
+#define TXOUT_CONV_CFG		HOST_IF_REG(0x18)
+#define RXIN_CONV_CFG		HOST_IF_REG(0x1C)
+#define RXOUT_CONV_CFG		HOST_IF_REG(0x20)
+
+#define TXIN_COUNTERS		HOST_IF_REG(0x44)
+#define TXOUT_COUNTERS		HOST_IF_REG(0x48)
+#define RXIN_COUNTERS		HOST_IF_REG(0x4c)
+#define RXOUT_COUNTERS		HOST_IF_REG(0x50)
+
+#define TXOUT_RING_CFG		HOST_IF_REG(0x98)
+#define RXOUT_RING_CFG		HOST_IF_REG(0x9C)
+
+#define ACA_PENDING_JOB		0x00000300
+#define ACA_PENDING_JOB_S	8
+#define ACA_AVAIL_BUF		0x00030000
+#define ACA_AVAIL_BUF_S		16
+#define ACA_PP_BUFS		2
+
+#define HOST_TYPE		HOST_IF_REG(0xA0)
+#define TXOUT_COUNTERS_UPDATE	HOST_IF_REG(0xAC)
+#define RXOUT_COUNTERS_UPDATE	HOST_IF_REG(0xB4)
+#define RXIN_HD_ACCUM_ADD	HOST_IF_REG(0xC8) /* UMT Message trigger */
+#define TXIN_HD_ACCUM_ADD	HOST_IF_REG(0xCC) /* UMT Message trigger */
+#define RXOUT_HD_ACCUM_ADD	HOST_IF_REG(0xD0)
+#define TXOUT_HD_ACCUM_ADD	HOST_IF_REG(0xD4)
+#define RXOUT_ACA_ACCUM_ADD	HOST_IF_REG(0xE0) /* PPE FW tigger */
+#define TXOUT_ACA_ACCUM_ADD	HOST_IF_REG(0xE4) /* PPE FW tigger */
+#define RXOUT_HD_ACCUM_SUB	HOST_IF_REG(0xF8)
+#define TXOUT_HD_ACCUM_SUB	HOST_IF_REG(0xFC)
+#define RXIN_ACA_ACCUM_SUB	HOST_IF_REG(0x100)
+#define TXIN_ACA_ACCUM_SUB	HOST_IF_REG(0x104)
+#define TXIN_ACA_HD_ACC_CNT	HOST_IF_REG(0x11C)
+#define UMT_ORDER_CFG		HOST_IF_REG(0x234)
+#define RXIN_HD_ACCUM_ADD_BE	HOST_IF_REG(0x250)
+#define TXIN_HD_ACCUM_ADD_BE	HOST_IF_REG(0x254)
+#define RXOUT_HD_ACCUM_SUB_BE	HOST_IF_REG(0x268)
+#define TXOUT_HD_ACCUM_SUB_BE	HOST_IF_REG(0x26c)
+
+/* MAC_HT_EXTENSION Register */
+#define MAC_HT_EXT_REG(X)	(MAC_HT_EXT_BASE + (X))
+
+#define HT_GCLK_ENABLE		MAC_HT_EXT_REG(0)
+#define HT_SW_RST_RELEASE	MAC_HT_EXT_REG(0x4)
+#define HT_SW_RST_ASSRT		MAC_HT_EXT_REG(0x1C)
+#define SW_RST_GENRISC		BIT(14)
+#define SW_RST_RXOUT		BIT(26)
+#define SW_RST_RXIN		BIT(27)
+#define SW_RST_TXOUT		BIT(28)
+#define SW_RST_TXIN		BIT(29)
+#define SW_RST_HOSTIF_REG	BIT(30)
+#define OCP_ARB_ACC_PAGE_REG	MAC_HT_EXT_REG(0x1C4)
+#define AHB_ARB_HP_REG		MAC_HT_EXT_REG(0x1C8)
+
+/* Genrisc FW Configuration */
+#define GNRC_SPRAM_REG(X)	(GENRISC_SPRAM_BASE + (X))
+
+/* TX IN */
+#define GNRC_TXIN_TGT_STAT		GNRC_SPRAM_REG(0x04)
+#define GNRC_TXIN_TGT_PD_OFF		GNRC_SPRAM_REG(0x08)
+#define GNRC_TXIN_TGT_ACCM_CNT		GNRC_SPRAM_REG(0x0C)
+
+/* TX OUT */
+#define GNRC_TXOUT_TGT_STAT		GNRC_SPRAM_REG(0x10)
+#define GNRC_TXOUT_TGT_PD_OFF		GNRC_SPRAM_REG(0x14)
+#define GNRC_TXOUT_TGT_ACCM_CNT		GNRC_SPRAM_REG(0x18)
+
+/* RX IN */
+#define GNRC_RXIN_TGT_STAT		GNRC_SPRAM_REG(0x1C)
+#define GNRC_RXIN_TGT_PD_OFF		GNRC_SPRAM_REG(0x20)
+#define GNRC_RXIN_TGT_ACCM_CNT		GNRC_SPRAM_REG(0x24)
+
+/* RX OUT XXX not consistent */
+#define GNRC_RXOUT_TGT_STAT		GNRC_SPRAM_REG(0x28)
+#define GNRC_RXOUT_TGT_PD_OFF		GNRC_SPRAM_REG(0x2C)
+#define GNRC_RXOUT_TGT_ACCM_CNT		GNRC_SPRAM_REG(0x30)
+
+/* 4 Ring 8 UMT case SoC cumulative counter address configuration */
+#define GNRC_TXIN_CMLT_CNT_ADDR		GNRC_SPRAM_REG(0x34)
+#define GNRC_TXOUT_CMLT_CNT_ADDR	GNRC_SPRAM_REG(0x38)
+#define GNRC_RXOUT_CMLT_CNT_ADDR	GNRC_SPRAM_REG(0x3C)
+#define GNRC_RXIN_CMLT_CNT_ADDR		GNRC_SPRAM_REG(0x40)
+
+
+#define GNRC_SOURCE_TXIN_CMLT_CNT_ADDR	GNRC_SPRAM_REG(0x54)
+#define GNRC_SOURCE_TXOUT_CMLT_CNT_ADDR	GNRC_SPRAM_REG(0x58)
+#define GNRC_SOURCE_RXOUT_CMLT_CNT_ADDR	GNRC_SPRAM_REG(0x5c)
+#define GNRC_SOURCE_RXIN_CMLT_CNT_ADDR	GNRC_SPRAM_REG(0x60)
+
+/* Txin index prefill */
+#define GNRC_TXIN_BUF_PREFILL		GNRC_SPRAM_REG(0x44)
+/* Task enable bitmap */
+#define GNRC_EN_TASK_BITMAP		GNRC_SPRAM_REG(0x64)
+
+#define ACA_SRAM_REG(X)	(ACA_SRAM_BASE + (X))
+#define ACA_TXOUT_PING_BUFFER_START ACA_SRAM_REG(0x1528)
+
+
+/* XBAR SSX0 */
+#define ACA_SSX0_BASE			0x180000
+#define ACA_SSX0_IA_BASE(id)		(ACA_SSX0_BASE + (((id) - 1) << 10))
+#define ACA_AGENT_CTRL(id)		(ACA_SSX0_IA_BASE(id) + 0x20)
+#define ACA_AGENT_STATUS(id)		(ACA_SSX0_IA_BASE(id) + 0x28)
+
+#define XBAR_CTRL_CORE_RESET		BIT(0)
+#define XBAR_CTRL_REJECT		BIT(4)
+
+#define XBAR_STAT_CORE_RESET		BIT(0)
+#define XBAR_STAT_REQ_ACTIVE		BIT(4)
+#define XBAR_STAT_RESP_WAITING		BIT(5)
+#define XBAR_STAT_BURST			BIT(6)
+#define XBAR_STAT_READEX		BIT(7)
+
+enum {
+	ACA_ACC_IA04 = 4,
+	ACA_M_IA06 = 6,
+};
+
+/* Should be passed from ACA FW header */
+#define DESC_NUM_PER_CH		1
+
+/* ACA DMA REG */
+#define ACA_DMA_BASE		0x60000
+
+#define ACA_DMA_REG(X)		(ACA_DMA_BASE + (X))
+#define ADMA_CLC		ACA_DMA_REG(0x0)
+#define ADMA_ID			ACA_DMA_REG(0x8)
+#define ADMA_CTRL		ACA_DMA_REG(0x10)
+#define ADMA_CPOLL		ACA_DMA_REG(0x14)
+
+#define ADMA_ID_REV		0x1Fu
+#define ADMA_ID_REV_S		0
+#define ADMA_ID_ID		0xFF00u
+#define ADMA_ID_ID_S		8
+#define ADMA_ID_PRTNR		0xF0000u
+#define ADMA_ID_PRTNR_S		16
+#define ADMA_ID_CHNR		0x7F00000u
+#define ADMA_ID_CHNR_S		20
+
+#define ADMA_CPOLL_EN		BIT(31)
+
+#define ADMA_CPOLL_CNT		0xFFF0u
+#define ADMA_CPOLL_CNT_S	4
+#define ADMA_DEFAULT_POLL	24
+#define ADMA_CS			ACA_DMA_REG(0x18)
+#define ADMA_CCTRL		ACA_DMA_REG(0x1C)
+#define ADMA_CDBA		ACA_DMA_REG(0x20)
+#define ADMA_CDLEN		ACA_DMA_REG(0x24)
+#define ADMA_CIS		ACA_DMA_REG(0x28)
+#define ADMA_CIE		ACA_DMA_REG(0x2C)
+
+#define ADMA_CI_EOP		BIT(1)
+#define ADMA_CI_DUR		BIT(2)
+#define ADMA_CI_DESCPT		BIT(3)
+#define ADMA_CI_CHOFF		BIT(4)
+#define ADMA_CI_RDERR		BIT(5)
+#define ADMA_CI_ALL		(ADMA_CI_EOP | ADMA_CI_DUR | ADMA_CI_DESCPT\
+				| ADMA_CI_CHOFF | ADMA_CI_RDERR)
+
+#define ADMA_CDPTNRD		ACA_DMA_REG(0x34)
+#define ADMA_PS			ACA_DMA_REG(0x40)
+#define ADMA_PCTRL		ACA_DMA_REG(0x44)
+
+/* DMA CCTRL BIT */
+#define CCTRL_RST		1 /* Channel Reset */
+#define CCTRL_ONOFF		0 /* Channel On/Off */
+
+/* DMA CTRL BIT */
+#define CTRL_PKTARB		31 /* Packet Arbitration */
+#define CTRL_MDC		15 /* Meta data copy */
+#define CTRL_DDBR		14 /* Dynamic Burst */
+#define CTRL_DCNF		13 /* Descriptor Length CFG*/
+#define CTRL_ENBE		9 /* Byte Enable */
+#define CTRL_DRB		8 /* Descriptor read back */
+#define CTRL_DSRAM		1 /* Dedicated Descriptor Access port Enable */
+#define CTRL_RST		0 /* Global Reset */
+
+/* DMA PORT BIT */
+#define PCTRL_FLUSH		16
+#define PCTRL_TXENDI		10 /* TX DIR Endianess */
+#define PCTRL_RXENDI		8 /* RX DIR Endianess */
+#define PCTRL_TXBL		4 /* TX burst 2/4/8 */
+#define PCTRL_RXBL		2 /* RX burst 2/4/8 */
+#define PCTRL_TXBL16		1 /* TX burst of 16 */
+#define PCTRL_RXBL16		0 /* RX burst of 16 */
+
+/*DMA ID BIT */
+#define ID_CHNR			20 /* Channel Number */
+
+/*DMA POLLING BIT */
+#define POLL_EN			31 /* Polling Enable */
+#define POLL_CNT		4 /* Polling Counter */
+
+#define ACA_DMA_CHAN_MAX	12
+
+enum aca_sec_id {
+	ACA_SEC_HIF = 0x1,
+	ACA_SEC_GNR = 0x2,
+	ACA_SEC_MAC_HT = 0x3,
+	ACA_SEC_MEM_TXIN = 0x4,
+	ACA_SEC_MEM_TXIN_PDRING = 0x5,
+	ACA_SEC_MEM_TXOUT = 0x6,
+	ACA_SEC_MEM_TXOUT_PDRING = 0x7,
+	ACA_SEC_MEM_RXOUT = 0x8,
+	ACA_SEC_MEM_RXOUT_PDRING = 0x9,
+	ACA_SEC_MEM_RXIN = 0xa,
+	ACA_SEC_MEM_RXIN_PDRING = 0xb,
+	ACA_SEC_DMA = 0xc,
+	ACA_SEC_FW_INIT = 0xd,
+	ACA_SEC_FW = 0x88,
+};
+
+enum aca_fw_id {
+	ACA_FW_TXIN = 1,
+	ACA_FW_TXOUT = 2,
+	ACA_FW_RXIN = 3,
+	ACA_FW_RXOUT = 4,
+	ACA_FW_GNRC = 5,
+	ACA_FW_MAX = 5,
+};
+
+enum aca_img_type {
+	ACA_VRX518_IMG,
+	ACA_VRX618_IMG,
+	ACA_FALCON_IMG,
+	ACA_PUMA_IMG,
+	ACA_IMG_MAX,
+};
+
+enum aca_soc_type {
+	ACA_SOC_XRX300 = 1,
+	ACA_SOC_XRX500 = 2,
+	ACA_SOC_PUMA   = 4,
+	ACA_SOC_3RD_PARTY = 8,
+};
+
+#define ACA_SOC_MASK	0xf
+
+/* Common information element, len has different variants */
+struct aca_fw_ie {
+	__be32 id;
+	__be32 len;
+} __packed;
+
+struct aca_fw_reg {
+	__be32 offset;
+	__be32 value;
+} __packed;
+
+struct aca_sram_desc {
+	__be32 dnum;
+	__be32 dbase;
+} __packed;
+
+struct aca_fw_dma {
+	__be32 cid;
+	__be32 base;
+} __packed;
+
+/* ACA internal header part */
+struct aca_int_hdr {
+	__be32 id;
+	__be32 offset;
+	__be32 size;
+	__be32 load_addr;
+} __packed;
+
+struct aca_fw_param {
+	__be32 st_sz;
+	__be32 init_addr;
+} __packed;
+
+struct aca_mem_layout {
+	u32 txin_host_desc_base;
+	u32 txin_host_dnum;
+	u32 txout_host_desc_base;
+	u32 txout_host_dnum;
+	u32 rxin_host_desc_base;
+	u32 rxin_host_dnum;
+	u32 rxout_host_desc_base;
+	u32 rxout_host_dnum;
+};
+
+struct aca_pdmem_layout {
+	u32 txin_pd_desc_base;
+	u32 txin_pd_dnum;
+	u32 txout_pd_desc_base;
+	u32 txout_pd_dnum;
+	u32 rxin_pd_desc_base;
+	u32 rxin_pd_dnum;
+	u32 rxout_pd_desc_base;
+	u32 rxout_pd_dnum;
+};
+
+struct aca_fw_addr_tuple {
+	u32 fw_id;
+	u32 fw_load_addr;
+	size_t fw_size;
+	const char *fw_base;
+};
+
+struct aca_fw_dl_addr {
+	u32 fw_num;
+	struct aca_fw_addr_tuple fw_addr[ACA_FW_MAX];
+};
+
+struct aca_fw_info {
+	const struct firmware *fw;
+	const void *fw_data;
+	size_t fw_len;
+	struct aca_mem_layout mem_layout;
+	struct aca_pdmem_layout pdmem_layout;
+	struct aca_fw_param fw_param;
+	struct aca_fw_dl_addr fw_dl;
+	u32 chan_num;
+	u32 adma_desc_base[ACA_DMA_CHAN_MAX];
+};
+
+union fw_ver {
+#ifdef CONFIG_CPU_BIG_ENDIAN
+	struct {
+		u32 build:4;
+		u32 branch:4;
+		u32 major:8;
+		u32 minor:16;
+	} __packed field;
+#else
+	struct {
+		u32 minor:16;
+		u32 major:8;
+		u32 branch:4;
+		u32 build:4;
+	} __packed field;
+#endif /* CONFIG_CPU_BIG_ENDIAN */
+	u32 all;
+} __packed;
+
+union img_soc_type {
+#ifdef CONFIG_CPU_BIG_ENDIAN
+	struct {
+		u32 img_type:16;
+		u32 soc_type:16;
+	} __packed field;
+#else
+	struct {
+		u32 soc_type:16;
+		u32 img_type:16;
+	} __packed field;
+#endif /* CONFIG_CPU_BIG_ENDIAN */
+	u32 all;
+} __packed;
+
+/* Fixed header part */
+struct aca_fw_f_hdr {
+	__be32 ver;
+	__be32 type;
+	__be32 hdr_size;
+	__be32 fw_size;
+	__be32 num_section;
+} __packed;
+
+struct aca_hif_param {
+	u32 soc_desc_base;
+	u32 soc_desc_num;
+	u32 pp_buf_base;
+	u32 pp_buf_num;
+	u32 pd_desc_base;
+	u32 pd_desc_num;
+	u32 pd_desc_threshold;
+} __packed;
+
+struct aca_hif_params {
+	u32 task_mask;
+	struct aca_hif_param txin;
+	struct aca_hif_param txout;
+	struct aca_hif_param rxin;
+	struct aca_hif_param rxout;
+	u32 dbg_base;
+	u32 dbg_size;
+	u32 magic;
+} __packed;
+
+#define ACA_MAGIC	0x25062016
+
+struct dc_aca {
+	bool initialized;
+	spinlock_t	clk_lock;
+	spinlock_t	rcu_lock;
+	struct mutex	pin_lock;
+	struct aca_fw_info fw_info;
+	struct aca_hif_params *hif_params;
+	u32 max_gpio;
+	u32 adma_chans;
+};
+#endif /* ACA_H */
diff --git a/package/kernel/lantiq/vrx518_ep/src/ep.c b/package/kernel/lantiq/vrx518_ep/src/ep.c
new file mode 100644
index 00000000000000..40fc9d36299a13
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_ep/src/ep.c
@@ -0,0 +1,770 @@
+/*******************************************************************************
+
+  Intel SmartPHY DSL PCIe Endpoint/ACA Linux driver
+  Copyright(c) 2016 Intel Corporation.
+
+  This program is free software; you can redistribute it and/or modify it
+  under the terms and conditions of the GNU General Public License,
+  version 2, as published by the Free Software Foundation.
+
+  This program is distributed in the hope it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+  more details.
+
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc.,
+  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+
+  The full GNU General Public License is included in this distribution in
+  the file called "COPYING".
+
+*******************************************************************************/
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/atomic.h>
+#include <linux/log2.h>
+#include <linux/uaccess.h>
+#include <linux/bitops.h>
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/pci.h>
+#include <linux/pci_regs.h>
+#include <linux/platform_device.h>
+
+#include "ep.h"
+#include "aca.h"
+#include "misc.h"
+
+#define DC_EP_DBG
+
+#define MAJ	2
+#define MIN	1
+#define BUILD	0
+#define DRV_VERSION __stringify(MAJ) "." __stringify(MIN) "." \
+	__stringify(BUILD) "-k"
+
+static bool pcie_switch_exist;
+module_param(pcie_switch_exist, bool, 0644);
+MODULE_PARM_DESC(pcie_switch_exist, "pcie switch existed or not");
+
+static const char dc_ep_driver_name[] = "vrx518";
+static const char dc_ep_driver_version[] = DRV_VERSION;
+static const char dc_ep_driver_string[] =
+			"Intel(R) SmartPHY DSL(VRX518) PCIe EP/ACA Driver";
+static const char dc_ep_copyright[] =
+				"Copyright (c) 2016 Intel Corporation.";
+
+static struct dc_ep_info g_dc_ep_info;
+static DEFINE_SPINLOCK(dc_ep_lock);
+
+static inline void reset_assert_device(struct dc_ep_dev *dev, u32 bits)
+{
+	if (WARN_ON(!dev))
+		return;
+	if (WARN_ON(!dev->priv))
+		return;
+
+	dc_ep_assert_device(dev->priv, bits);
+}
+
+static inline void reset_deassert_device(struct dc_ep_dev *dev, u32 bits)
+{
+	if (WARN_ON(!dev))
+		return;
+	if (WARN_ON(!dev->priv))
+		return;
+
+	dc_ep_deassert_device(dev->priv, bits);
+}
+
+static inline void icu_disable_intr(struct dc_ep_dev *dev, u32 bits)
+{
+	if (WARN_ON(!dev))
+		return;
+	if (WARN_ON(!dev->priv))
+		return;
+
+	dc_ep_icu_dis_intr(dev->priv, bits);
+}
+
+static inline void icu_enable_intr(struct dc_ep_dev *dev, u32 bits)
+{
+	if (WARN_ON(!dev))
+		return;
+	if (WARN_ON(!dev->priv))
+		return;
+
+	dc_ep_icu_en_intr(dev->priv, bits);
+}
+
+static inline int reset_device(struct dc_ep_dev *dev, u32 bits)
+{
+	if (WARN_ON(!dev))
+		return -EINVAL;
+	if (WARN_ON(!dev->priv))
+		return -EINVAL;
+
+	return dc_ep_reset_device(dev->priv, bits);
+}
+
+static inline int clk_on(struct dc_ep_dev *dev, u32 bits)
+{
+	if (WARN_ON(!dev))
+		return -EINVAL;
+	if (WARN_ON(!dev->priv))
+		return -EINVAL;
+
+	return dc_ep_clk_on(dev->priv, bits);
+}
+
+static inline int clk_off(struct dc_ep_dev *dev, u32 bits)
+{
+	if (WARN_ON(!dev))
+		return -EINVAL;
+	if (WARN_ON(!dev->priv))
+		return -EINVAL;
+
+	return dc_ep_clk_off(dev->priv, bits);
+}
+
+static inline int clk_set(struct dc_ep_dev *dev, u32 sysclk, u32 ppeclk)
+{
+	if (WARN_ON(!dev))
+		return -EINVAL;
+	if (WARN_ON(!dev->priv))
+		return -EINVAL;
+
+	return dc_ep_clk_set(dev->priv, sysclk, ppeclk);
+}
+
+static inline int clk_get(struct dc_ep_dev *dev, u32 *sysclk, u32 *ppeclk)
+{
+	if (WARN_ON(!dev || !sysclk || !ppeclk))
+		return -EINVAL;
+	if (WARN_ON(!dev->priv))
+		return -EINVAL;
+
+	return dc_ep_clk_get(dev->priv, sysclk, ppeclk);
+}
+
+static inline int gpio_dir(struct dc_ep_dev *dev, u32 gpio, int dir)
+{
+	if (WARN_ON(!dev))
+		return -EINVAL;
+	if (WARN_ON(!dev->priv))
+		return -EINVAL;
+
+	return dc_ep_gpio_dir(dev->priv, gpio, dir);
+}
+
+static inline int gpio_set(struct dc_ep_dev *dev, u32 gpio, int val)
+{
+	if (WARN_ON(!dev))
+		return -EINVAL;
+	if (WARN_ON(!dev->priv))
+		return -EINVAL;
+
+	return dc_ep_gpio_set(dev->priv, gpio, val);
+}
+
+static inline int gpio_get(struct dc_ep_dev *dev, u32 gpio, int *val)
+{
+	if (WARN_ON(!dev || !val))
+		return -EINVAL;
+	if (WARN_ON(!dev->priv))
+		return -EINVAL;
+
+	return dc_ep_gpio_get(dev->priv, gpio, val);
+}
+
+static inline int pinmux_set(struct dc_ep_dev *dev, u32 gpio, int func)
+{
+	if (WARN_ON(!dev))
+		return -EINVAL;
+	if (WARN_ON(!dev->priv))
+		return -EINVAL;
+
+	return dc_ep_pinmux_set(dev->priv, gpio, func);
+}
+
+static inline int pinmux_get(struct dc_ep_dev *dev, u32 gpio, int *func)
+{
+	if (WARN_ON(!dev || !func))
+		return -EINVAL;
+	if (WARN_ON(!dev->priv))
+		return -EINVAL;
+
+	return dc_ep_pinmux_get(dev->priv, gpio, func);
+}
+
+static inline int gpio_pupd_set(struct dc_ep_dev *dev, u32 gpio, u32 val)
+{
+	if (WARN_ON(!dev))
+		return -EINVAL;
+	if (WARN_ON(!dev->priv))
+		return -EINVAL;
+
+	return dc_ep_gpio_pupd_set(dev->priv, gpio, val);
+}
+
+static inline int gpio_od_set(struct dc_ep_dev *dev, u32 gpio, int val)
+{
+	if (WARN_ON(!dev))
+		return -EINVAL;
+	if (WARN_ON(!dev->priv))
+		return -EINVAL;
+
+	return dc_ep_gpio_od_set(dev->priv, gpio, val);
+}
+
+static inline int gpio_src_set(struct dc_ep_dev *dev, u32 gpio, int val)
+{
+	if (WARN_ON(!dev))
+		return -EINVAL;
+	if (WARN_ON(!dev->priv))
+		return -EINVAL;
+
+	return dc_ep_gpio_src_set(dev->priv, gpio, val);
+}
+
+static inline int gpio_dcc_set(struct dc_ep_dev *dev, u32 gpio, u32 val)
+{
+	if (WARN_ON(!dev))
+		return -EINVAL;
+	if (WARN_ON(!dev->priv))
+		return -EINVAL;
+
+	return dc_ep_gpio_dcc_set(dev->priv, gpio, val);
+}
+
+static inline int aca_start(struct dc_ep_dev *dev, u32 func, int start)
+{
+	if (WARN_ON(!dev))
+		return -EINVAL;
+	if (WARN_ON(!dev->priv))
+		return -EINVAL;
+
+	return dc_aca_start(dev->priv, func, start);
+}
+
+static inline int aca_stop(struct dc_ep_dev *dev, u32 *func, int reset)
+{
+	if (WARN_ON(!dev || !func))
+		return -EINVAL;
+	if (WARN_ON(!dev->priv))
+		return -EINVAL;
+
+	return dc_aca_stop(dev->priv, func, reset);
+}
+
+static inline int aca_init(struct dc_ep_dev *dev, struct aca_param *aca,
+	struct aca_modem_param *mdm)
+{
+	if (WARN_ON(!dev || !aca))
+		return -EINVAL;
+	if (WARN_ON(!dev->priv))
+		return -EINVAL;
+
+	return dc_aca_init(dev->priv, aca, mdm);
+}
+
+static inline void aca_event_addr_get(struct dc_ep_dev *dev,
+	struct aca_event_reg_addr *regs)
+{
+	if (WARN_ON(!dev || !regs))
+		return;
+	if (WARN_ON(!dev->priv))
+		return;
+
+	dc_aca_event_addr_get(dev->priv, regs);
+}
+
+static inline u32 umt_msg_addr(struct dc_ep_dev *dev, u32 endian, u32 type)
+{
+	if (WARN_ON(!dev))
+		return -EINVAL;
+	if (WARN_ON(!dev->priv))
+		return -EINVAL;
+
+	return aca_umt_msg_addr(dev->priv, endian, type);
+}
+
+static inline void aca_txin_sub_ack(struct dc_ep_dev *dev, u32 val)
+{
+	if (WARN_ON(!dev))
+		return;
+	if (WARN_ON(!dev->priv))
+		return;
+
+	dc_aca_txin_sub_ack(dev->priv, val);
+}
+
+static inline u32 aca_txin_hd_cnt(struct dc_ep_dev *dev)
+{
+	if (WARN_ON(!dev))
+		return -EINVAL;
+	if (WARN_ON(!dev->priv))
+		return -EINVAL;
+
+	return dc_aca_txin_hd_cnt(dev->priv);
+}
+
+static const struct aca_hw_ops dc_ep_hw_ops = {
+	.reset_assert = reset_assert_device,
+	.reset_deassert = reset_deassert_device,
+	.reset_device = reset_device,
+	.icu_en = icu_enable_intr,
+	.icu_mask = icu_disable_intr,
+	.clk_on = clk_on,
+	.clk_off = clk_off,
+	.clk_set = clk_set,
+	.clk_get = clk_get,
+	.gpio_dir = gpio_dir,
+	.gpio_set = gpio_set,
+	.gpio_get = gpio_get,
+	.pinmux_set = pinmux_set,
+	.pinmux_get = pinmux_get,
+	.gpio_pupd_set = gpio_pupd_set,
+	.gpio_od_set = gpio_od_set,
+	.gpio_src_set = gpio_src_set,
+	.gpio_dcc_set = gpio_dcc_set,
+	.aca_start = aca_start,
+	.aca_stop = aca_stop,
+	.aca_init = aca_init,
+	.aca_event_addr_get = aca_event_addr_get,
+	.umt_msg_addr = umt_msg_addr,
+	.aca_txin_ack_sub = aca_txin_sub_ack,
+	.aca_txin_hd_cnt = aca_txin_hd_cnt,
+};
+
+int dc_ep_dev_num_get(int *dev_num)
+{
+	if ((g_dc_ep_info.dev_num <= 0)
+		|| (g_dc_ep_info.dev_num > DC_EP_MAX_NUM))
+		return -EIO;
+
+	*dev_num = g_dc_ep_info.dev_num;
+	return 0;
+}
+EXPORT_SYMBOL_GPL(dc_ep_dev_num_get);
+
+int dc_ep_dev_info_req(int dev_idx, enum dc_ep_int module,
+			struct dc_ep_dev *dev)
+{
+	int i;
+	struct dc_ep_priv *priv;
+
+	if ((dev_idx < 0) || (dev_idx >= DC_EP_MAX_NUM)) {
+		dev_err(dev->dev, "%s invalid device index %d\n",
+			__func__, dev_idx);
+		return -EIO;
+	}
+
+	priv = &g_dc_ep_info.pcie_ep[dev_idx];
+	if (atomic_read(&priv->refcnt) >= DC_EP_MAX_REFCNT) {
+		dev_err(dev->dev,
+			"%s mismatch request/release module usage\n", __func__);
+		return -EIO;
+	}
+
+	switch (module) {
+	case DC_EP_INT_PPE:
+		dev->irq = priv->irq_base;
+		if (priv->msi_mode == DC_EP_8_MSI_MODE) {
+			dev->aca_tx_irq = priv->irq_base + 7;
+			dev->aca_rx_irq = priv->irq_base + 6;
+		} else if (priv->msi_mode == DC_EP_4_MSI_MODE) {
+			dev->aca_tx_irq = priv->irq_base + 2;
+			dev->aca_rx_irq = priv->irq_base + 3;
+		} else {
+			dev_err(dev->dev, "%s ACA should never occur\n",
+				__func__);
+		}
+		break;
+	case DC_EP_INT_MEI:
+		dev->irq = priv->irq_base + 1;
+		break;
+	default:
+		dev->irq = priv->irq_base;
+		break;
+	}
+
+	dev->dev = priv->dev;
+	dev->membase = priv->mem;
+	dev->phy_membase = priv->phymem;
+	dev->peer_num = priv->peer_num;
+	for (i = 0; i < dev->peer_num; i++) {
+		dev->peer_membase[i] = priv->peer_mem[i];
+		dev->peer_phy_membase[i] = priv->peer_phymem[i];
+	}
+	dev->switch_attached = priv->switch_attached;
+	dev->priv = priv;
+	dev->hw_ops = &dc_ep_hw_ops;
+	atomic_inc(&priv->refcnt);
+	return 0;
+}
+EXPORT_SYMBOL_GPL(dc_ep_dev_info_req);
+
+int dc_ep_dev_info_release(int dev_idx)
+{
+	struct dc_ep_priv *priv;
+
+	if ((dev_idx < 0) || (dev_idx >= DC_EP_MAX_NUM)) {
+		pr_err("%s invalid device index %d\n",
+			__func__, dev_idx);
+		return -EIO;
+	}
+
+	priv = &g_dc_ep_info.pcie_ep[dev_idx];
+	if (atomic_read(&priv->refcnt) <= 0) {
+		pr_err("%s mismatch request/release module usage\n",
+			__func__);
+		return -EIO;
+	}
+
+	atomic_dec(&priv->refcnt);
+	return 0;
+}
+EXPORT_SYMBOL_GPL(dc_ep_dev_info_release);
+
+static int pci_msi_vec_set(struct pci_dev *dev, int nvec)
+{
+	int pos;
+	u16 msgctl;
+
+	if (!is_power_of_2(nvec))
+		return -EINVAL;
+
+	pos = pci_find_capability(dev, PCI_CAP_ID_MSI);
+	if (!pos)
+		return -EINVAL;
+
+	pci_read_config_word(dev, pos + PCI_MSI_FLAGS, &msgctl);
+	msgctl &= ~PCI_MSI_FLAGS_QSIZE;
+	msgctl |= ((ffs(nvec) - 1) << 4);
+	pci_write_config_word(dev, pos + PCI_MSI_FLAGS, msgctl);
+	pci_read_config_word(dev, pos + PCI_MSI_FLAGS, &msgctl);
+	return 0;
+}
+
+static int dc_ep_msi_enable(struct pci_dev *pdev, int nvec)
+{
+	int err;
+	struct dc_ep_priv *priv = pci_get_drvdata(pdev);
+
+	/* NB, ICU initailize first */
+	dc_ep_icu_init(priv);
+
+	err = pci_msi_vec_set(pdev, nvec);
+	if (err) {
+		dev_err(&pdev->dev, "%s: Failed to set maximum MSI vector\n",
+			__func__);
+		return -EIO;
+	}
+
+	err = pci_enable_msi_exact(pdev, nvec);
+	if (err) {
+		dev_err(&pdev->dev,
+			"%s: Failed to enable MSI interrupts error code: %d\n",
+			__func__, err);
+		return -EIO;
+	}
+	return 0;
+}
+
+static void dc_ep_info_xchange(struct pci_dev *pdev, int card_num)
+{
+	/* More cards supported, exchange address information
+	 * For example, suppose three cards dected.
+	 * 0, <1, 2>
+	 * 1, <0, 2>
+	 * 2, <0, 1>
+	 * For four cards detected
+	 * 0, <1, 2, 3>
+	 * 1, <0, 2, 3>
+	 * 2, <0, 1, 3>
+	 * 3, <0, 1, 2>
+	 * and etc
+	 */
+	int i, j, k;
+	int peer_num;
+#ifdef DC_EP_DBG
+	struct dc_ep_priv *priv;
+#endif /* DC_EP_DBG */
+	spin_lock(&dc_ep_lock);
+	if (card_num > 1) {
+		peer_num = card_num - 1;
+		for (i = 0; i < card_num; i++) {
+			struct dc_ep_priv *ep = &g_dc_ep_info.pcie_ep[i];
+			j = 0;
+			k = 0;
+			ep->peer_num = peer_num;
+			do {
+				struct dc_ep_priv *partner;
+
+				if (j == i) {
+					j++;
+					continue;
+				}
+				partner = &g_dc_ep_info.pcie_ep[j];
+				ep->peer_mem[k] = partner->mem;
+				ep->peer_phymem[k] = partner->phymem;
+				ep->peer_memsize[k] = partner->memsize;
+				k++;
+				j++;
+			} while ((k < peer_num) && (j < card_num));
+		}
+	}
+	spin_unlock(&dc_ep_lock);
+
+#ifdef DC_EP_DBG
+	dev_dbg(&pdev->dev, "Total cards found %d\n", card_num);
+	/* Dump detailed debug information */
+	for (i = 0; i < card_num; i++) {
+		priv = &g_dc_ep_info.pcie_ep[i];
+		dev_dbg(&pdev->dev, "card %d attached\n", priv->ep_idx);
+		dev_dbg(&pdev->dev, "irq base %d irq numbers %d\n",
+			priv->irq_base, priv->irq_num);
+		dev_dbg(&pdev->dev,
+			"its own phymem 0x%08x mem 0x%p size 0x%08x\n",
+			priv->phymem, priv->mem, priv->memsize);
+		if (card_num > 1) {
+			for (j = 0; j < priv->peer_num; j++)
+				dev_dbg(&pdev->dev,
+				"its peer phymem 0x%08x mem 0x%p size 0x%08x\n",
+				priv->peer_phymem[j],
+				priv->peer_mem[j], priv->peer_memsize[j]);
+		}
+	}
+#endif /* DC_EP_DBG */
+}
+
+static int pci_msi_vec_num(struct pci_dev *dev)
+{
+	int ret;
+	u16 msgctl;
+
+	if (!dev->msi_cap)
+		return -EINVAL;
+
+	pci_read_config_word(dev, dev->msi_cap + PCI_MSI_FLAGS, &msgctl);
+	ret = 1 << ((msgctl & PCI_MSI_FLAGS_QMASK) >> 1);
+
+	return ret;
+}
+
+static int dc_ep_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+{
+	int ret;
+	int nvec;
+	bool switch_exist;
+	int current_ep;
+	unsigned long phymem;
+	void __iomem *mem;
+	size_t memsize;
+	int msi_mode;
+	static int cards_found;
+#ifndef CONFIG_OF
+	struct pcie_ep_adapter *adapter;
+#endif
+	struct dc_ep_priv *priv;
+
+	ret = pci_enable_device(pdev);
+	if (ret) {
+		dev_err(&pdev->dev, "can't enable PCI device %d\n", ret);
+		goto err_pci;
+	}
+
+	/* Physical address */
+	ret = pci_request_region(pdev, DC_EP_BAR_NUM, dc_ep_driver_name);
+	if (ret) {
+		dev_err(&pdev->dev, "PCI MMIO reservation error: %d\n", ret);
+		goto err_device;
+	}
+
+	/* Target structures have a limit of 32 bit DMA pointers.
+	 * DMA pointers can be wider than 32 bits by default on some systems.
+	 */
+	ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+	if (ret) {
+		dev_err(&pdev->dev, "32-bit DMA not available: %d\n", ret);
+		goto err_region;
+	}
+
+	ret = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
+	if (ret) {
+		dev_err(&pdev->dev, "cannot enable 32-bit consistent DMA\n");
+		goto err_region;
+	}
+
+	/* Set bus master bit in PCI_COMMAND to enable DMA */
+	pci_set_master(pdev);
+	/* NB, some delay may need due to BME reset */
+	udelay(1);
+
+	/* Arrange for access to Target SoC registers. */
+	mem = pci_iomap(pdev, DC_EP_BAR_NUM, 0);
+	if (!mem) {
+		dev_err(&pdev->dev, "PCI iomap error\n");
+		ret = -EIO;
+		goto err_master;
+	}
+	phymem = pci_resource_start(pdev, DC_EP_BAR_NUM);
+	memsize = pci_resource_len(pdev, DC_EP_BAR_NUM);
+
+	nvec = pci_msi_vec_num(pdev);
+	/* Overwrite maximum vector number according to
+	 * the specific requirement
+	 */
+	if ((DC_PCIE_SWITCH_ATTACH > 0) || pcie_switch_exist)
+		switch_exist = true;
+	else
+		switch_exist = false;
+	/* Always use 4 vector mode */
+	nvec = DC_EP_DEFAULT_MSI_VECTOR;
+	msi_mode = DC_EP_4_MSI_MODE;
+
+	current_ep = cards_found++;
+	priv = &g_dc_ep_info.pcie_ep[current_ep];
+	memset(priv, 0, sizeof(*priv));
+	pci_set_drvdata(pdev, priv);
+
+	/* Collect basic info for further operations */
+	spin_lock(&dc_ep_lock);
+	g_dc_ep_info.dev_num = cards_found;
+	atomic_set(&priv->refcnt, 0);
+	priv->pdev = pdev;
+	priv->device_id = pdev->device;
+	priv->dev = &pdev->dev;
+	priv->ep_idx = current_ep;
+	priv->mem = mem;
+	priv->phymem = phymem;
+	priv->memsize = memsize;
+	priv->irq_num = nvec;
+	priv->switch_attached = switch_exist;
+	priv->msi_mode = msi_mode;
+	spin_unlock(&dc_ep_lock);
+
+	ret = dc_ep_msi_enable(pdev, nvec);
+	if (ret)
+		goto err_iomap;
+
+	spin_lock(&dc_ep_lock);
+	priv->irq_base = pdev->irq;
+	spin_unlock(&dc_ep_lock);
+
+#ifndef CONFIG_OF
+	adapter = kmalloc(sizeof(struct pcie_ep_adapter), GFP_KERNEL);
+	if (adapter == NULL)
+		goto err_iomap;
+	pci_set_drvdata(pdev, adapter);
+	adapter->mei_dev = platform_device_register_data(&pdev->dev, "mei_cpe",
+							 PLATFORM_DEVID_AUTO,
+							 NULL, 0);
+	if (IS_ERR(adapter->mei_dev)) {
+		dev_err(&pdev->dev, "can not register mei device, err: %li, ignore this\n",
+			PTR_ERR(adapter->mei_dev));
+		goto err_msi;
+	}
+#endif
+	dc_ep_info_xchange(pdev, cards_found);
+	/* Disable output clock to save power */
+	dc_ep_clkod_disable(priv);
+	dc_aca_info_init(priv);
+	return 0;
+#ifndef CONFIG_OF
+err_msi:
+	kfree(adapter);
+#endif
+err_iomap:
+	pci_iounmap(pdev, mem);
+err_master:
+	pci_clear_master(pdev);
+err_region:
+	pci_release_region(pdev, DC_EP_BAR_NUM);
+err_device:
+	pci_disable_device(pdev);
+err_pci:
+	return ret;
+}
+
+static void dc_ep_remove(struct pci_dev *pdev)
+{
+	struct dc_ep_priv *priv = pci_get_drvdata(pdev);
+
+#ifndef CONFIG_OF
+	struct pcie_ep_adapter *adapter =
+		(struct pcie_ep_adapter *) pci_get_drvdata(pdev);
+
+	platform_device_unregister(adapter->mei_dev);
+#endif
+	if (priv == NULL)
+		return;
+
+	if (atomic_read(&priv->refcnt) != 0) {
+		dev_err(&pdev->dev, "%s still being used, can't remove\n",
+			__func__);
+		return;
+	}
+	dc_aca_free_fw_file(priv);
+	dc_aca_shutdown(priv);
+	dc_ep_icu_disable(priv);
+	pci_iounmap(pdev, priv->mem);
+	pci_release_region(pdev, DC_EP_BAR_NUM);
+	pci_disable_msi(pdev);
+	wmb();
+	pci_clear_master(pdev);
+	pci_disable_device(pdev);
+}
+
+static const struct pci_device_id dc_ep_id_table[] = {
+	{0x8086, 0x09a9, PCI_ANY_ID, PCI_ANY_ID}, /* VRX518 */
+	{0},
+};
+
+MODULE_DEVICE_TABLE(pci, dc_ep_id_table);
+
+static struct pci_driver dc_ep_driver = {
+	.name = (char *)dc_ep_driver_name,
+	.id_table = dc_ep_id_table,
+	.probe = dc_ep_probe,
+	.remove = dc_ep_remove,
+	.shutdown = dc_ep_remove,
+	/* PM not supported */
+	/* AER is controlled by RC */
+};
+
+static int __init dc_ep_init(void)
+{
+	pr_info("%s - version %s\n",
+		dc_ep_driver_string, dc_ep_driver_version);
+
+	pr_info("%s\n", dc_ep_copyright);
+	memset(&g_dc_ep_info, 0, sizeof(struct dc_ep_info));
+
+	if (pci_register_driver(&dc_ep_driver) < 0) {
+		pr_err("%s: No devices found, driver not installed.\n",
+			__func__);
+		return -ENODEV;
+	}
+	return 0;
+}
+module_init(dc_ep_init);
+
+static void __exit dc_ep_exit(void)
+{
+	pci_unregister_driver(&dc_ep_driver);
+
+	pr_info("%s: %s driver unloaded\n", __func__,
+		dc_ep_driver_name);
+}
+module_exit(dc_ep_exit);
+
+MODULE_AUTHOR("Intel Corporation, <Chuanhua.lei@intel.com>");
+MODULE_DESCRIPTION("Intel(R) SmartPHY PCIe EP/ACA Driver");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(DRV_VERSION);
diff --git a/package/kernel/lantiq/vrx518_ep/src/ep.h b/package/kernel/lantiq/vrx518_ep/src/ep.h
new file mode 100644
index 00000000000000..2e31008ec8397c
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_ep/src/ep.h
@@ -0,0 +1,127 @@
+/*******************************************************************************
+
+  Intel SmartPHY DSL PCIe Endpoint/ACA Linux driver
+  Copyright(c) 2016 Intel Corporation.
+
+  This program is free software; you can redistribute it and/or modify it
+  under the terms and conditions of the GNU General Public License,
+  version 2, as published by the Free Software Foundation.
+
+  This program is distributed in the hope it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+  more details.
+
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc.,
+  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+
+  The full GNU General Public License is included in this distribution in
+  the file called "COPYING".
+
+*******************************************************************************/
+
+#ifndef EP_H
+#define EP_H
+
+#include <net/dc_ep.h>
+
+#include "aca.h"
+
+#define DC_EP_MAX_NUM		(DC_EP_MAX_PEER + 1)
+#define DC_EP_BAR_NUM		0
+
+/* Maximum 8, if PCIe switch attached, 4 is used. 8 is also default one */
+#ifdef CONFIG_VRX518_PCIE_SWITCH_BONDING
+#define DC_PCIE_SWITCH_ATTACH		1
+#else
+#define DC_PCIE_SWITCH_ATTACH		0
+#endif /* CONFIG_VRX518_PCIE_SWITCH_BONDING */
+
+#define DC_EP_DEFAULT_MSI_VECTOR	4
+
+#define DC_EP_MAX_REFCNT	DC_EP_INT_MAX
+
+#define MS(_v, _f)  (((_v) & (_f)) >> _f##_S)
+#define SM(_v, _f)  (((_v) << _f##_S) & (_f))
+
+enum dc_ep_msi_mode {
+	DC_EP_8_MSI_MODE = 0,
+	DC_EP_4_MSI_MODE,
+	DC_EP_1_MSI_MODE,
+};
+
+/* Structure used to extract attached EP detailed information for
+ * PPE/DSL_MEI driver/Bonding
+ */
+struct dc_ep_priv {
+	struct pci_dev *pdev;
+	struct device *dev;
+	u32 ep_idx; /*!< EP logical index, the first found one will be 0
+			regardless of RC physical index
+			*/
+	u32 irq_base; /*!< The first MSI interrupt number */
+	u32 irq_num; /*!< How many MSI interrupt supported */
+	enum dc_ep_msi_mode msi_mode;
+	u8 __iomem *mem;  /*!< The EP inbound memory base address
+				derived from BAR0, SoC virtual address
+				for PPE/DSL_MEI driver
+				*/
+	u32 phymem; /*!< The EP inbound memory base address
+				derived from BAR0, physical address for
+				PPE FW
+				*/
+	size_t memsize; /*!< The EP inbound memory window size */
+	u32 peer_num;  /*!< Bonding peer number available */
+	/*!< The bonding peer EP inbound memory base address derived from
+	 * its BAR0, SoC virtual address for PPE/DSL_MEI driver
+	 */
+
+	u8 __iomem *peer_mem[DC_EP_MAX_PEER];
+
+	/*!< The bonding peer EP inbound memory base address derived from
+	 * its BAR0, physical address for PPE FW
+	 */
+	u32 peer_phymem[DC_EP_MAX_PEER];
+
+	/*!< The bonding peer inbound memory window size */
+	size_t peer_memsize[DC_EP_MAX_PEER];
+	atomic_t refcnt; /*!< The EP mapping driver referenced times
+				by other modules
+				*/
+	u16 device_id; /* Potential usage for different EP */
+	bool switch_attached;
+	struct dc_aca aca;
+};
+
+struct dc_ep_info {
+	int dev_num;
+	int msi_mode;
+	struct dc_ep_priv pcie_ep[DC_EP_MAX_NUM];
+};
+
+static inline struct dc_aca *to_aca(struct dc_ep_priv *priv)
+{
+	return &priv->aca;
+}
+
+void dc_aca_shutdown(struct dc_ep_priv *priv);
+void dc_aca_info_init(struct dc_ep_priv *priv);
+int dc_aca_start(struct dc_ep_priv *priv, u32 func, int start);
+int dc_aca_stop(struct dc_ep_priv *priv, u32 *func, int reset);
+int dc_aca_init(struct dc_ep_priv *priv, struct aca_param *aca,
+	struct aca_modem_param *mdm);
+void dc_aca_event_addr_get(struct dc_ep_priv *priv,
+	struct aca_event_reg_addr *regs);
+void dc_aca_txin_sub_ack(struct dc_ep_priv *priv, u32 val);
+u32 aca_umt_msg_addr(struct dc_ep_priv *priv, u32 endian, u32 type);
+u32 dc_aca_txin_hd_cnt(struct dc_ep_priv *priv);
+void dc_aca_free_fw_file(struct dc_ep_priv *priv);
+
+/* Card specific private data structure */
+struct pcie_ep_adapter {
+	struct platform_device *mei_dev; /* the mei driver */
+};
+
+#endif /* EP_H */
+
diff --git a/package/kernel/lantiq/vrx518_ep/src/include/net/dc_ep.h b/package/kernel/lantiq/vrx518_ep/src/include/net/dc_ep.h
new file mode 100644
index 00000000000000..f1142332e19b34
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_ep/src/include/net/dc_ep.h
@@ -0,0 +1,349 @@
+/*******************************************************************************
+
+  Intel SmartPHY DSL PCIe Endpoint/ACA Linux driver
+  Copyright(c) 2016 Intel Corporation.
+
+  This program is free software; you can redistribute it and/or modify it
+  under the terms and conditions of the GNU General Public License,
+  version 2, as published by the Free Software Foundation.
+
+  This program is distributed in the hope it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+  more details.
+
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc.,
+  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+
+  The full GNU General Public License is included in this distribution in
+  the file called "COPYING".
+
+*******************************************************************************/
+
+#ifndef DC_EP_H
+#define DC_EP_H
+
+#include <linux/types.h>
+#include <linux/pci.h>
+#include <linux/device.h>
+
+/* @{ */
+/*! \def DC_EP_MAX_PEER
+ *  \brief how many EP partners existed. In most cases, this number should be
+ *  one for bonding application. For the future extension, it could be bigger
+ *  value. For example, multiple bonding
+ */
+#define DC_EP_MAX_PEER		1
+
+/* Reset related module bit definition */
+#define RST_GPIO		BIT(2)
+#define RST_DSL_IF		BIT(3)
+#define RST_DFE			BIT(7)
+#define RST_PPE			BIT(8)
+#define RST_CDMA		BIT(9)
+#define RST_SPI			BIT(10)
+#define RST_IMCU		BIT(11)
+#define RST_ACA_DMA		BIT(14)
+#define RST_AFE			BIT(16)
+#define RST_ACA_HOSTIF		BIT(17)
+#define RST_PCIE		BIT(22)
+#define RST_PPE_ATM_TC		BIT(23)
+#define RST_FPI_SLAVE		BIT(25)
+#define RST_GLOBAL		BIT(30)
+
+/* PMU related module definition */
+#define PMU_ADMA		BIT(0)
+#define PMU_CDMA		BIT(2)
+#define PMU_SPI			BIT(8)
+#define PMU_DSL			BIT(9)
+#define PMU_PPE_QSB		BIT(18)
+#define PMU_PPE_SLL01		BIT(19)
+#define PMU_PPE_TC		BIT(21)
+#define PMU_EMA			BIT(22)
+#define PMU_PPM2		BIT(23)
+#define PMU_PPE_TOP		BIT(29)
+
+/* IMER bit definition */
+#define PPE2HOST_INT0		BIT(0)
+#define PPE2HOST_INT1		BIT(1)
+#define DYING_GASP_INT		BIT(3)
+#define MEI_IRQ			BIT(8)
+#define ACA_XBAR_INT		BIT(9)
+#define MODEM_XBAR_INT		BIT(12)
+#define LED0_INT		BIT(13)
+#define LED1_INT		BIT(14)
+#define NMI_PLL			BIT(15)
+#define DMA_TX			BIT(16)
+#define DMA_RX			BIT(17)
+#define ACA_HOSTIF_TX		BIT(20)
+#define ACA_HOSTIF_RX		BIT(21)
+#define ACA_RXOUT_PD_RING_FULL	BIT(22)
+#define ACA_TXOUT_PD_RING_FULL	BIT(23)
+
+/*
+ * Structure used to specify available pin mux functions for gpio pinx
+ * It will be used in pinmux_set() function
+ */
+enum gpio_padc_func {
+	MUX_FUNC_GPIO = 0,
+	MUX_FUNC_ALT1,
+	MUX_FUNC_ALT2,
+	MUX_FUNC_RES,
+};
+
+/*
+ * Structure used to specify interrupt source so that EP can assign unique
+ *  interruot to it
+*/
+enum dc_ep_int {
+	DC_EP_INT_PPE, /*!< PPE2HOST_INT 0/1 */
+	DC_EP_INT_MEI, /*!< DSL MEI_IRQ */
+	DC_EP_INT_MAX,
+};
+
+/* Clock setting for system clock */
+enum {
+	SYS_CLK_36MHZ	= 0,
+	SYS_CLK_288MHZ,
+	SYS_CLK_MAX,
+};
+
+/* Clock setting for PPE clock */
+enum {
+	PPE_CLK_36MHZ	= 0,
+	PPE_CLK_576MHZ,
+	PPE_CLK_494MHZ,
+	PPE_CLK_432MHZ,
+	PPE_CLK_288MHZ,
+	PPE_CLK_MAX,
+};
+
+/* GPIO direction IN/OUT */
+enum {
+	GPIO_DIR_IN = 0,
+	GPIO_DIR_OUT,
+	GPIO_DIR_MAX,
+};
+
+/* GPIO Pullup/Pulldown setting */
+enum {
+	GPIO_PUPD_DISABLE = 0,
+	GPIO_PULL_UP,
+	GPIO_PULL_DOWN,
+	GPIO_PUPD_BOTH,
+};
+
+/* GPIO slew rate setting */
+enum {
+	GPIO_SLEW_RATE_SLOW = 0,
+	GPIO_SLEW_RATE_FAST,
+};
+
+/* GPIO driver current setting */
+enum {
+	GPIO_DRV_CUR_2MA = 0,
+	GPIO_DRV_CUR_4MA,
+	GPIO_DRV_CUR_8MA,
+	GPIO_DRV_CUR_12MA,
+	GPIO_DRV_CUR_MAX,
+};
+
+enum {
+	ACA_LITTLE_ENDIAN = 0,
+	ACA_BIG_ENDIAN,
+	ACA_ENDIAN_MAX,
+};
+
+enum {
+	ACA_TXIN = 0,
+	ACA_TXOUT,
+	ACA_RXIN,
+	ACA_RXOUT,
+	ACA_MAX,
+};
+
+/* ACA four major direction functions for start/stop */
+#define ACA_TXIN_EN	BIT(0)
+#define ACA_TXOUT_EN	BIT(1)
+#define ACA_RXIN_EN	BIT(2)
+#define ACA_RXOUT_EN	BIT(3)
+#define ACA_ALL_EN	0xF
+
+struct dc_ep_dev;
+
+/*
+ * ACA SoC specific parameters. The caller needs to fill up all necessary info
+ * according to specific SoC and specific project
+ * For each function, different parameters are needed.
+ */
+struct aca_cfg_param {
+	u32 soc_desc_base; /*!< SoC CBM or DDR descriptor base address */
+	u32 soc_desc_num; /*!< SoC and HostIF (same) descriptor number */
+	u32 soc_cmlt_cnt_addr; /*! SoC cumulative counter address */
+	u32 pp_buf_desc_num; /*!< ACA ping pong buffer descriptor number */
+	u32 pd_desc_base; /*!< Packet Descriptor base address in modem */
+	u32 pd_desc_num; /*!< Packet Descriptor number in modem */
+	u32 hd_size_in_dw; /*!< Host(SoC) descriptor size in dwords */
+	u32 pd_size_in_dw; /*!< Packet descriptor size in dwords */
+	u32 byteswap; /*!< Byte swap enabled or not in ACA FW */
+	u32 prefill_cnt; /*!< Prefill counter special required for some platform */
+};
+
+struct aca_param {
+	struct aca_cfg_param aca_txin;
+	struct aca_cfg_param aca_txout;
+	struct aca_cfg_param aca_rxin;
+	struct aca_cfg_param aca_rxout;
+};
+
+/* ACA project/modem specific parameters. It is only valid for VRX518 */
+struct aca_proj_param {
+	u32 stat; /*!< Target state */
+	u32 pd; /*!< Target packet descripor */
+	u32 acc_cnt; /*!< Target accumulate counter */
+};
+
+/* Project specific configuration */
+struct aca_modem_param {
+	struct aca_proj_param mdm_txout;
+	struct aca_proj_param mdm_rxin;
+	struct aca_proj_param mdm_rxout;
+};
+
+/* Event trigger register address <offset> */
+struct aca_event_reg_addr {
+	u32 txin_acc_sub;
+	u32 txout_acc_add;
+	u32 rxin_acc_sub;
+	u32 rxout_acc_add;
+};
+
+/*
+ * ACA common hardware low level APIs, presented as callbacks instead of
+ * separate APIs to support mulitple instances
+ */
+struct aca_hw_ops {
+	/* RCU Callbacks */
+	void (*reset_assert)(struct dc_ep_dev *pdev, u32 rd);
+	void (*reset_deassert)(struct dc_ep_dev *pdev, u32 rd);
+	/* For hardware self-clear reset, most apply except PCIe */
+	int (*reset_device)(struct dc_ep_dev *pdev, u32 hd);
+
+	/* PMU Callbacks */
+	int (*clk_on)(struct dc_ep_dev *pdev, u32 cd);
+	int (*clk_off)(struct dc_ep_dev *pdev, u32 cd);
+
+	/* CGU Callbacks */
+	int (*clk_set)(struct dc_ep_dev *pdev, u32 sysclk, u32 ppeclk);
+	int (*clk_get)(struct dc_ep_dev *pdev, u32 *sysclk, u32 *ppeclk);
+
+	/* GPIO Callbacks */
+	int (*gpio_dir)(struct dc_ep_dev *pdev, u32 gpio, int dir);
+	int (*gpio_set)(struct dc_ep_dev *pdev, u32 gpio, int val);
+	int (*gpio_get)(struct dc_ep_dev *pdev, u32 gpio, int *val);
+
+	/* PinMux Callbacks */
+	int (*pinmux_set)(struct dc_ep_dev *pdev, u32 gpio, int func);
+	int (*pinmux_get)(struct dc_ep_dev *pdev, u32 gpio, int *func);
+	int (*gpio_pupd_set)(struct dc_ep_dev *pdev, u32 gpio, u32 val);
+	int (*gpio_od_set)(struct dc_ep_dev *pdev, u32 gpio, int val);
+	int (*gpio_src_set)(struct dc_ep_dev *pdev, u32 gpio, int val);
+	int (*gpio_dcc_set)(struct dc_ep_dev *pdev, u32 gpio, u32 val);
+
+	/* ICU Callbacks */
+	void (*icu_en)(struct dc_ep_dev *pdev, u32 bit);
+	void (*icu_mask)(struct dc_ep_dev *pdev, u32 bit);
+
+	/* ACA related stuff */
+	int (*aca_start)(struct dc_ep_dev *pdev, u32 func, int start);
+	int (*aca_stop)(struct dc_ep_dev *pdev, u32 *func, int reset);
+	/* If there is no project specific parameters, input NULL */
+	int (*aca_init)(struct dc_ep_dev *pdev, struct aca_param *aca,
+		struct aca_modem_param *mdm);
+	void (*aca_event_addr_get)(struct dc_ep_dev *pdev,
+		struct aca_event_reg_addr *regs);
+	/* UMT address needed for SoC filled in to trigger UMT msg */
+	u32 (*umt_msg_addr)(struct dc_ep_dev *pdev, u32 endian, u32 type);
+	/* TXIN accum sub to ack PPE already processed */
+	void (*aca_txin_ack_sub)(struct dc_ep_dev *pdev, u32 val);
+	u32 (*aca_txin_hd_cnt)(struct dc_ep_dev *pdev);
+};
+
+/*
+ * Structure used to extract attached EP detailed information
+ * for PPE/DSL_MEI driver/Bonding
+ */
+struct dc_ep_dev {
+	struct device *dev;
+	u32 irq;          /*!< MSI interrupt number for this device */
+	u32 aca_tx_irq; /*!< ACA Non-empty TX irq number for PPE driver */
+	u32 aca_rx_irq; /*!< ACA Non-empty RX irq number for PPE driver */
+	/*!< The EP inbound memory base address derived from BAR0, SoC
+	     virtual address for PPE/DSL_MEI driver
+	 */
+	bool switch_attached; /*!< EP attach switch */
+	u8 __iomem *membase; /*!< virtual memory base address to access EP */
+	u32 phy_membase;  /*!< The EP inbound memory base address derived
+			from BAR0, physical address for PPE FW
+			*/
+	u32 peer_num;    /*!< Bonding peer number available */
+	/*!< The bonding peer EP inbound memory base address derived from
+	 its BAR0, SoC virtual address for PPE/DSL_MEI driver
+	 */
+	u8 __iomem *peer_membase[DC_EP_MAX_PEER];
+	/*!< The bonding peer EP inbound memory base address derived from
+	     its BAR0, physical address for PPE FW
+	*/
+	u32 peer_phy_membase[DC_EP_MAX_PEER];
+	const struct aca_hw_ops *hw_ops;
+	void *priv; /* Pointer to driver proprietary data for internal use */
+};
+
+/*
+ * This function returns the total number of EPs attached. Normally,
+ * the number should be one <standard smartPHY EP> or two <smartPHY
+ * off-chip bonding cases>. Extended case is also considered
+
+ * \param[in/out]  dev_num   Pointer to detected EP numbers in total.
+ * \return         -EIO      Invalid total EP number which means this
+ * 		     module is not initialized properly
+ * \return         0         Successfully return the detected EP numbers
+ */
+int dc_ep_dev_num_get(int *dev_num);
+
+/*
+ * This function returns detailed EP device information for PPE/DSL/Bonding
+ * partner by its logical index obtained
+ * by \ref dc_ep_dev_num_get and its interrupt module number
+ * \ref dc_ep_int
+
+ * \param[in]      dev_idx   Logical device index referred to the related
+ * 		     device
+ * \param[in]      module    EP interrupt module user<PPE/MEI>
+ * \param[in/out]  dev       Pointer to returned detail device structure
+ * 		     \ref dc_ep_dev
+ * \return         -EIO      Invalid logical device index or too many modules
+ * 		     referred to this module
+ * \return         0         Successfully return required device information
+
+ * \remarks This function normally will be called to trace the detailed device
+ *     information after calling \ref dc_ep_dev_num_get
+ */
+int dc_ep_dev_info_req(int dev_idx, enum dc_ep_int module,
+			struct dc_ep_dev *dev);
+
+/*
+ * This function releases the usage of this module by PPE/DSL
+
+ * \param[in]  dev_idx   Logical device index referred to the related device
+ * \return     -EIO      Invalid logical device index or release too many
+ * 		 times to refer to this module
+ * \return     0         Successfully release the usage of this module
+
+ * \remarks This function should be called once their reference is over.
+ *     The reference usage must matches \ref dc_ep_dev_info_req
+ */
+int dc_ep_dev_info_release(int dev_idx);
+
+#endif /* DC_EP_H */
diff --git a/package/kernel/lantiq/vrx518_ep/src/misc.c b/package/kernel/lantiq/vrx518_ep/src/misc.c
new file mode 100644
index 00000000000000..9140fe79e4db64
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_ep/src/misc.c
@@ -0,0 +1,325 @@
+/*******************************************************************************
+
+  Intel SmartPHY DSL PCIe Endpoint/ACA Linux driver
+  Copyright(c) 2016 Intel Corporation.
+
+  This program is free software; you can redistribute it and/or modify it
+  under the terms and conditions of the GNU General Public License,
+  version 2, as published by the Free Software Foundation.
+
+  This program is distributed in the hope it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+  more details.
+
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc.,
+  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+
+  The full GNU General Public License is included in this distribution in
+  the file called "COPYING".
+
+*******************************************************************************/
+
+#include <linux/delay.h>
+#include <linux/mutex.h>
+
+#include "regs.h"
+#include "ep.h"
+#include "misc.h"
+
+#define padc_getbit(p, r)	(!!(rd32(r) & (1 << p)))
+#define padc_setbit(p, r)	wr32_mask(0, BIT(p), r)
+#define padc_clearbit(p, r)	wr32_mask(BIT(p), 0, r)
+
+void dc_ep_clkod_disable(struct dc_ep_priv *priv)
+{
+	wr32_mask(0, IF_CLKOD_ALL, IF_CLK);
+}
+
+void dc_ep_icu_init(struct dc_ep_priv *priv)
+{
+	/* Enable all interrupts in ICU level */
+	wr32(ICU_DMA_TX_ALL, ICU_DMA_TX_IMER);
+	wr32(ICU_DMA_RX_ALL, ICU_DMA_RX_IMER);
+	wr32(ICU_TOP_ALL, ICU_IMER);
+
+	if (priv->msi_mode == DC_EP_4_MSI_MODE)
+		wr32(PCI_MSI_4_MODE, RCU_MSI);
+	else
+		wr32(PCI_MSI_8_MODE, RCU_MSI);
+
+	/* PCIe app has to enable all MSI interrupts regardless of MSI mode */
+	wr32(PCIE_MSI_EN_ALL, PCIE_APPL_MSI_EN);
+}
+
+void dc_ep_icu_disable(struct dc_ep_priv *priv)
+{
+	/* Disable all PCIe related interrupts */
+	wr32(0, PCIE_APPL_MSI_EN);
+
+	wr32(PCI_MSI_8_MODE, RCU_MSI);
+
+	/* Disable all interrupts in ICU level */
+	wr32(0, ICU_DMA_TX_IMER);
+	wr32(0, ICU_DMA_RX_IMER);
+	wr32(0, ICU_IMER);
+}
+
+void dc_ep_icu_dis_intr(struct dc_ep_priv *priv, u32 bits)
+{
+	wr32_mask(~bits, 0, ICU_IMER);
+}
+
+void dc_ep_icu_en_intr(struct dc_ep_priv *priv, u32 bits)
+{
+	wr32_mask(0, bits, ICU_IMER);
+}
+
+void dc_ep_assert_device(struct dc_ep_priv *priv, u32 bits)
+{
+	struct dc_aca *aca = to_aca(priv);
+
+	spin_lock(&aca->rcu_lock);
+	wr32_mask(0, bits, RCU_REQ);
+	spin_unlock(&aca->rcu_lock);
+}
+
+void dc_ep_deassert_device(struct dc_ep_priv *priv, u32 bits)
+{
+	struct dc_aca *aca = to_aca(priv);
+
+	spin_lock(&aca->rcu_lock);
+	wr32_mask(bits, 0, RCU_REQ);
+	spin_unlock(&aca->rcu_lock);
+}
+
+int dc_ep_reset_device(struct dc_ep_priv *priv, u32 bits)
+{
+	int retry = EP_TIMEOUT;
+
+	wr32(bits, RCU_REQ);
+	do { } while (retry-- && (!(rd32(RCU_STAT) & bits)));
+
+	if (retry == 0) {
+		dev_err(priv->dev, "%s failed to reset\n", __func__);
+		return -ETIME;
+	}
+	return 0;
+}
+
+int dc_ep_clk_on(struct dc_ep_priv *priv, u32 bits)
+{
+	int retry = EP_TIMEOUT;
+	struct dc_aca *aca = to_aca(priv);
+
+	spin_lock(&aca->clk_lock);
+	wr32_mask(bits, 0, PMU_PWDCR);
+	spin_unlock(&aca->clk_lock);
+
+	do { } while (--retry && (rd32(PMU_SR) & bits));
+
+	if (!retry) {
+		dev_err(priv->dev, "%s failed\n", __func__);
+		return -ETIME;
+	}
+	return 0;
+}
+
+int dc_ep_clk_off(struct dc_ep_priv *priv, u32 bits)
+{
+	int retry = EP_TIMEOUT;
+	struct dc_aca *aca = to_aca(priv);
+
+	spin_lock(&aca->clk_lock);
+	wr32_mask(0, bits, PMU_PWDCR);
+	spin_unlock(&aca->clk_lock);
+
+	do {} while (--retry
+		&& (!(rd32(PMU_SR) & bits)));
+	if (!retry) {
+		dev_err(priv->dev, "%s failed\n", __func__);
+		return -ETIME;
+	}
+	return 0;
+}
+
+int dc_ep_clk_set(struct dc_ep_priv *priv, u32 sysclk, u32 ppeclk)
+{
+	struct dc_aca *aca = to_aca(priv);
+
+	if (sysclk > SYS_CLK_MAX || ppeclk > PPE_CLK_MAX)
+		return -EINVAL;
+
+	spin_lock(&aca->clk_lock);
+	wr32_mask(PPE_CLK | SYS_CLK,
+		SM(sysclk, SYS_CLK) | SM(ppeclk, PPE_CLK), PLL_OMCFG);
+	spin_unlock(&aca->clk_lock);
+	return 0;
+}
+
+int dc_ep_clk_get(struct dc_ep_priv *priv, u32 *sysclk, u32 *ppeclk)
+{
+	u32 val;
+
+	val = rd32(PLL_OMCFG);
+	*sysclk = MS(val, SYS_CLK);
+	*ppeclk = MS(val, PPE_CLK);
+	return 0;
+}
+
+int dc_ep_gpio_dir(struct dc_ep_priv *priv, u32 gpio, int dir)
+{
+	struct dc_aca *aca = to_aca(priv);
+
+	if (gpio > aca->max_gpio)
+		return -EINVAL;
+
+	if ((dir != GPIO_DIR_IN) && (dir != GPIO_DIR_OUT))
+		return -EINVAL;
+
+	if (dir == GPIO_DIR_IN)
+		wr32(BIT(gpio), GPIO_DIRCLR);
+	else
+		wr32(BIT(gpio), GPIO_DIRSET);
+	return 0;
+}
+
+int dc_ep_gpio_set(struct dc_ep_priv *priv, u32 gpio, int val)
+{
+	struct dc_aca *aca = to_aca(priv);
+
+	if (gpio > aca->max_gpio)
+		return -EINVAL;
+
+	dc_ep_gpio_dir(priv, gpio, GPIO_DIR_OUT);
+
+	if (val)
+		wr32(BIT(gpio), GPIO_OUTSET);
+	else
+		wr32(BIT(gpio), GPIO_OUTCLR);
+	return 0;
+}
+
+int dc_ep_gpio_get(struct dc_ep_priv *priv, u32 gpio, int *val)
+{
+	u32 dir;
+	struct dc_aca *aca = to_aca(priv);
+
+	if (gpio > aca->max_gpio)
+		return -EINVAL;
+
+	dir = rd32(GPIO_DIR);
+	if ((dir >> gpio) & 0x1)
+		*val = (rd32(GPIO_OUT) >> gpio) & 0x1;
+	else
+		*val = (rd32(GPIO_IN) >> gpio) & 0x1;
+	return 0;
+}
+
+int dc_ep_pinmux_set(struct dc_ep_priv *priv, u32 gpio, int func)
+{
+	struct dc_aca *aca = to_aca(priv);
+
+	if (gpio > aca->max_gpio)
+		return -EINVAL;
+
+	if (func >= MUX_FUNC_RES)
+		return -EINVAL;
+
+	mutex_lock(&aca->pin_lock);
+	wr32_mask(PADC_MUX_M, func, PADC_MUX(gpio));
+	mutex_unlock(&aca->pin_lock);
+	return 0;
+}
+
+int dc_ep_pinmux_get(struct dc_ep_priv *priv, u32 gpio, int *func)
+{
+	struct dc_aca *aca = to_aca(priv);
+
+	if (gpio > aca->max_gpio)
+		return -EINVAL;
+
+	*func = rd32(PADC_MUX(gpio));
+	return 0;
+}
+
+int dc_ep_gpio_pupd_set(struct dc_ep_priv *priv, u32 gpio, u32 val)
+{
+	struct dc_aca *aca = to_aca(priv);
+
+	if (gpio > aca->max_gpio)
+		return -EINVAL;
+
+	/* Not support for both enabled */
+	if (val >= GPIO_PUPD_BOTH)
+		return -EINVAL;
+
+	mutex_lock(&aca->pin_lock);
+	switch (val) {
+	case GPIO_PUPD_DISABLE:
+		padc_clearbit(gpio, PADC_PUEN);
+		padc_clearbit(gpio, PADC_PDEN);
+		break;
+	case GPIO_PULL_UP:
+		padc_setbit(gpio, PADC_PUEN);
+		padc_clearbit(gpio, PADC_PDEN);
+		break;
+	case GPIO_PULL_DOWN:
+		padc_setbit(gpio, PADC_PDEN);
+		padc_clearbit(gpio, PADC_PUEN);
+		break;
+	default:
+		break;
+	}
+	mutex_unlock(&aca->pin_lock);
+	return 0;
+}
+
+int dc_ep_gpio_od_set(struct dc_ep_priv *priv, u32 gpio, int val)
+{
+	struct dc_aca *aca = to_aca(priv);
+
+	if (gpio > aca->max_gpio)
+		return -EINVAL;
+
+	mutex_lock(&aca->pin_lock);
+	if (!!val)
+		padc_setbit(gpio, PADC_OD);
+	else
+		padc_clearbit(gpio, PADC_OD);
+	mutex_unlock(&aca->pin_lock);
+	return 0;
+}
+
+int dc_ep_gpio_src_set(struct dc_ep_priv *priv, u32 gpio, int val)
+{
+	struct dc_aca *aca = to_aca(priv);
+
+	if (gpio > aca->max_gpio)
+		return -EINVAL;
+
+	mutex_lock(&aca->pin_lock);
+	if (!!val)
+		padc_setbit(gpio, PADC_SRC);
+	else
+		padc_clearbit(gpio, PADC_SRC);
+	mutex_unlock(&aca->pin_lock);
+	return 0;
+}
+
+int dc_ep_gpio_dcc_set(struct dc_ep_priv *priv, u32 gpio, u32 val)
+{
+	struct dc_aca *aca = to_aca(priv);
+
+	if (gpio > aca->max_gpio)
+		return -EINVAL;
+
+	if (val >= GPIO_DRV_CUR_MAX)
+		return -EINVAL;
+
+	mutex_lock(&aca->pin_lock);
+	wr32_mask((0x3 << (gpio * 2)), (val << (gpio * 2)), PADC_DCC);
+	mutex_unlock(&aca->pin_lock);
+	return 0;
+}
diff --git a/package/kernel/lantiq/vrx518_ep/src/misc.h b/package/kernel/lantiq/vrx518_ep/src/misc.h
new file mode 100644
index 00000000000000..d92ea83e2fc50a
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_ep/src/misc.h
@@ -0,0 +1,51 @@
+/*******************************************************************************
+
+  Intel SmartPHY DSL PCIe Endpoint/ACA Linux driver
+  Copyright(c) 2016 Intel Corporation.
+
+  This program is free software; you can redistribute it and/or modify it
+  under the terms and conditions of the GNU General Public License,
+  version 2, as published by the Free Software Foundation.
+
+  This program is distributed in the hope it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+  more details.
+
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc.,
+  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+
+  The full GNU General Public License is included in this distribution in
+  the file called "COPYING".
+
+*******************************************************************************/
+
+#ifndef MISC_H
+#define MISC_H
+
+#define EP_TIMEOUT	10000
+
+void dc_ep_clkod_disable(struct dc_ep_priv *priv);
+void dc_ep_icu_init(struct dc_ep_priv *priv);
+void dc_ep_icu_disable(struct dc_ep_priv *priv);
+void dc_ep_assert_device(struct dc_ep_priv *priv, u32 bits);
+void dc_ep_deassert_device(struct dc_ep_priv *priv, u32 bits);
+int dc_ep_reset_device(struct dc_ep_priv *priv, u32 bits);
+int dc_ep_clk_on(struct dc_ep_priv *priv, u32 bits);
+int dc_ep_clk_off(struct dc_ep_priv *priv, u32 bits);
+int dc_ep_clk_set(struct dc_ep_priv *priv, u32 sysclk, u32 ppeclk);
+int dc_ep_clk_get(struct dc_ep_priv *priv, u32 *sysclk, u32 *ppeclk);
+int dc_ep_gpio_dir(struct dc_ep_priv *priv, u32 gpio, int dir);
+int dc_ep_gpio_set(struct dc_ep_priv *priv, u32 gpio, int val);
+int dc_ep_gpio_get(struct dc_ep_priv *priv, u32 gpio, int *val);
+int dc_ep_pinmux_set(struct dc_ep_priv *priv, u32 gpio, int func);
+int dc_ep_pinmux_get(struct dc_ep_priv *priv, u32 gpio, int *func);
+int dc_ep_gpio_pupd_set(struct dc_ep_priv *priv, u32 gpio, u32 val);
+int dc_ep_gpio_od_set(struct dc_ep_priv *priv, u32 gpio, int val);
+int dc_ep_gpio_src_set(struct dc_ep_priv *priv, u32 gpio, int val);
+int dc_ep_gpio_dcc_set(struct dc_ep_priv *priv, u32 gpio, u32 val);
+void dc_ep_icu_dis_intr(struct dc_ep_priv *priv, u32 bits);
+void dc_ep_icu_en_intr(struct dc_ep_priv *priv, u32 bits);
+
+#endif /* MISC_H */
diff --git a/package/kernel/lantiq/vrx518_ep/src/regs.h b/package/kernel/lantiq/vrx518_ep/src/regs.h
new file mode 100644
index 00000000000000..9236453a4f4188
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_ep/src/regs.h
@@ -0,0 +1,138 @@
+/*******************************************************************************
+
+  Intel SmartPHY DSL PCIe Endpoint/ACA Linux driver
+  Copyright(c) 2016 Intel Corporation.
+
+  This program is free software; you can redistribute it and/or modify it
+  under the terms and conditions of the GNU General Public License,
+  version 2, as published by the Free Software Foundation.
+
+  This program is distributed in the hope it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+  more details.
+
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc.,
+  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+
+  The full GNU General Public License is included in this distribution in
+  the file called "COPYING".
+
+*******************************************************************************/
+
+#ifndef REGS_H
+#define REGS_H
+
+#include <linux/bitops.h>
+
+/* APPL defined */
+#define PCIE_APPL_BASE		0x00048000
+#define PCIE_APPL_REG(X)	(PCIE_APPL_BASE + (X))
+
+#define PCIE_APPL_PHY_CFG1	PCIE_APPL_REG(0x3C)
+#define PCIE_APPL_PHY_CFG2	PCIE_APPL_REG(0x40)
+#define PCIE_APPL_PHY_CFG3	PCIE_APPL_REG(0x58)
+#define PCIE_APPL_PHY_CFG4	PCIE_APPL_REG(0x28)
+#define PCIE_APPL_INTR_VEC	PCIE_APPL_REG(0x48)
+#define PCIE_APPL_MSI_EN	PCIE_APPL_REG(0x4C)
+
+#define PCIE_MSI_EN_ALL		0xFF
+
+/* RCU defined */
+#define RCU_BASE		0x00008000
+#define RCU_REG(X)		(RCU_BASE + (X))
+#define RCU_STAT		RCU_REG(0x00)
+#define RCU_REQ			RCU_REG(0x10)
+
+#define RCU_MSI			RCU_REG(0x80)
+#define PCI_MSI_4_MODE		1
+#define PCI_MSI_8_MODE		0
+
+/* CGU */
+#define CGU_BASE		0x00000000
+#define CGU_REG(X)		(CGU_BASE + (X))
+#define PMU_PWDCR		CGU_REG(0x011C)
+#define PMU_SR			CGU_REG(0x0120)
+#define PMU_ALL			0x20ec0305
+
+#define PLL_OMCFG		CGU_REG(0x0064)
+
+#define SYS_CLK			0x3
+#define SYS_CLK_S		0
+#define PPE_CLK			0x700
+#define PPE_CLK_S		8
+
+#define IF_CLK			CGU_REG(0x0024)
+
+#define CLK_PD			BIT(10)
+#define CLK_OD			BIT(11)
+#define PCIE_CLKOD		(BIT(12) | BIT(13))
+#define AFE_CLKOD		BIT(14)
+
+#define IF_CLKOD_ALL		(CLK_PD | CLK_OD | PCIE_CLKOD | AFE_CLKOD)
+
+/* GPIO */
+#define GPIO_BASE		0x00020000
+#define GPIO_REG(X)		(GPIO_BASE + (X))
+#define GPIO_OUT		GPIO_REG(0x00)
+#define GPIO_IN			GPIO_REG(0x04)
+#define GPIO_DIR		GPIO_REG(0x08)
+#define GPIO_OUTSET		GPIO_REG(0x40)
+#define GPIO_OUTCLR		GPIO_REG(0x44)
+#define GPIO_DIRSET		GPIO_REG(0x48)
+#define GPIO_DIRCLR		GPIO_REG(0x4c)
+
+/* PADC */
+#define PADC_BASE		0x00024000
+#define PADC_REG(X)		(PADC_BASE + (X))
+#define PADC_MUX(pin)		PADC_REG(((pin) << 2))
+#define PADC_PUEN		PADC_REG(0x80)
+#define PADC_PDEN		PADC_REG(0x84)
+#define PADC_SRC		PADC_REG(0x88)
+#define PADC_DCC		PADC_REG(0x8c)
+#define PADC_OD			PADC_REG(0x94)
+#define PADC_AVAIL		PADC_REG(0x98)
+#define PADC_MUX_M		0x7
+
+/* ICU defined */
+#define ICU_BASE		0x00010000
+#define ICU_REG(X)		(ICU_BASE + (X))
+#define ICU_IMSR		ICU_REG(0x40)
+#define ICU_IMER		ICU_REG(0x44)
+#define ICU_IMOSR		ICU_REG(0x48)
+#define ICU_DMA_TX_STATUS	ICU_REG(0x50)
+#define ICU_DMA_RX_STATUS	ICU_REG(0x54)
+#define ICU_DMA_TX_IMER		ICU_REG(0x58)
+#define ICU_DMA_RX_IMER		ICU_REG(0x5C)
+#define ICU_DMA_TX_IMOSR	ICU_REG(0x60)
+#define ICU_DMA_RX_IMOSR	ICU_REG(0x64)
+
+#define PPE2HOST_INT0		BIT(0)
+#define PPE2HOST_INT1		BIT(1)
+#define DYING_GASP_INT		BIT(3)
+#define MEI_IRQ			BIT(8)
+#define ACA_XBAR_INT		BIT(9)
+#define MODEM_XBAR_INT		BIT(12)
+#define LED0_INT		BIT(13)
+#define LED1_INT		BIT(14)
+#define NMI_PLL			BIT(15)
+#define DMA_TX			BIT(16)
+#define DMA_RX			BIT(17)
+#define ACA_HOSTIF_TX		BIT(20)
+#define ACA_HOSTIF_RX		BIT(21)
+#define ACA_RXOUT_PD_RING_FULL	BIT(22)
+#define ACA_TXOUT_PD_RING_FULL	BIT(23)
+
+#define ICU_TOP_ALL		0x0003f30B /* Except ACA related */
+#define ICU_DMA_TX_ALL		0x003f03FF
+#define ICU_DMA_RX_ALL		0x003F03FF
+
+#define wr32(value, reg)	(writel(value, (priv->mem + (reg))))
+#define rd32(reg)		(readl(priv->mem + (reg)))
+#define wrfl()			((void)rd32(RCU_STAT))
+
+#define wr32_mask(clr, set, reg)		\
+	wr32(((rd32(reg) & ~(clr)) | (set)), (reg))
+
+#endif /* REGS_H */
diff --git a/package/kernel/lantiq/vrx518_ep/src/test/Makefile b/package/kernel/lantiq/vrx518_ep/src/test/Makefile
new file mode 100644
index 00000000000000..d9e5d43e4aac45
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_ep/src/test/Makefile
@@ -0,0 +1,2 @@
+
+obj-$(CONFIG_TEST) += ep_test.o
\ No newline at end of file
diff --git a/package/kernel/lantiq/vrx518_ep/src/test/ep_test.c b/package/kernel/lantiq/vrx518_ep/src/test/ep_test.c
new file mode 100644
index 00000000000000..ab6139b73eee9a
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_ep/src/test/ep_test.c
@@ -0,0 +1,924 @@
+/*******************************************************************************
+
+  Intel SmartPHY DSL PCIe Endpoint/ACA Linux Test driver
+  Copyright(c) 2016 Intel Corporation.
+
+  This program is free software; you can redistribute it and/or modify it
+  under the terms and conditions of the GNU General Public License,
+  version 2, as published by the Free Software Foundation.
+
+  This program is distributed in the hope it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+  more details.
+
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc.,
+  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+
+  The full GNU General Public License is included in this distribution in
+  the file called "COPYING".
+
+*******************************************************************************/
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/version.h>
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/interrupt.h>
+#include <linux/delay.h>
+
+#include <net/dc_ep.h>
+
+#include "ep_test.h"
+
+#define DRV_VERSION "1.0.0"
+static const char ep_test_driver_version[] = DRV_VERSION;
+static struct dc_ep_dev pcie_dev[DC_EP_MAX_PEER + 1];
+static int ppe_irq_num;
+
+#define ep_wr32(value, reg)	(writel(value, dev->membase + reg))
+#define ep_rd32(reg)		(readl(dev->membase + reg))
+
+#define ep_wr32_mask(clr, set, reg)		\
+	ep_wr32(((ep_rd32(reg) & ~(clr)) | (set)), (reg))
+
+struct aca_hd_desc {
+	void *base;
+	dma_addr_t phy_base;
+	size_t size;/* in bytes */
+};
+
+struct aca_hd_desc_cfg {
+	struct aca_hd_desc txin;
+	struct aca_hd_desc txout;
+	struct aca_hd_desc rxout;
+};
+
+static struct aca_hd_desc_cfg aca_soc_hd_desc[DC_EP_MAX_PEER + 1];
+
+static void ep_mem_write(u8 __iomem *dst, const void *src, size_t len)
+{
+	int i;
+	const u32 *src_addr = src;
+
+	if (len % 4)
+		pr_info("Warning!!: Copy len is not multiple of 4\n");
+
+	len = len >> 2;
+
+	for (i = 0; i < len; i++)
+		writel(src_addr[i], (dst + (i << 2)));
+}
+
+static irqreturn_t dc_ep_ppe_intr(int irq, void *dev_id)
+{
+	struct dc_ep_dev *dev = dev_id;
+
+	ppe_irq_num++;
+	if (ep_rd32(MBOX_IGU0_ISR) == 0) {
+		pr_err("Fatal error, dummy interrupt\n");
+		return IRQ_NONE;
+	}
+
+	ep_wr32(PPE_MBOX_TEST_BIT, MBOX_IGU0_ISRC);
+	ep_rd32(MBOX_IGU0_ISR);
+	return IRQ_HANDLED;
+}
+
+static void dc_ep_ppe_mbox_reg_dump(struct dc_ep_dev *dev)
+{
+	pr_info("MBOX_IGU0_ISRS addr %p data 0x%08x\n",
+		dev->membase + MBOX_IGU0_ISRS,
+		ep_rd32(MBOX_IGU0_ISRS));
+	pr_info("MBOX_IGU0_ISRC addr %p data 0x%08x\n",
+		dev->membase + MBOX_IGU0_ISRC,
+		ep_rd32(MBOX_IGU0_ISRC));
+	pr_info("MBOX_IGU0_ISR  addr %p data 0x%08x\n",
+		dev->membase + MBOX_IGU0_ISR,
+		ep_rd32(MBOX_IGU0_ISR));
+	pr_info("MBOX_IGU0_IER  addr %p data 0x%08x\n",
+		dev->membase + MBOX_IGU0_IER,
+		ep_rd32(MBOX_IGU0_IER));
+}
+
+#define PPE_INT_TIMEOUT		10
+static int dc_ep_ppe_mbox_int_stress_test(struct dc_ep_dev *dev)
+{
+	int i;
+	int j;
+	int ret;
+
+	/* Clear it first */
+	ep_wr32(PPE_MBOX_TEST_BIT, MBOX_IGU0_ISRC);
+
+	ret = request_irq(dev->irq, dc_ep_ppe_intr, 0, "PPE_MSI", dev);
+	if (ret) {
+		pr_err("%s request irq %d failed\n", __func__, dev->irq);
+		return -1;
+	}
+	pr_info("PPE test\n");
+	ep_wr32(PPE_MBOX_TEST_BIT, MBOX_IGU0_IER);
+	ppe_irq_num = 0;
+	/* Purposely trigger interrupt */
+	for (i = 0; i < PPE_MBOX_IRQ_TEST_NUM; i++) {
+		j = 0;
+		while ((ep_rd32(MBOX_IGU0_ISR) & PPE_MBOX_TEST_BIT)) {
+			j++;
+			if (j > PPE_INT_TIMEOUT)
+				break;
+		}
+		ep_wr32(PPE_MBOX_TEST_BIT, MBOX_IGU0_ISRS);
+		/* Write flush */
+		ep_rd32(MBOX_IGU0_ISR);
+	}
+	mdelay(10);
+	pr_info("irq triggered %d expected %d\n", ppe_irq_num,
+		PPE_MBOX_IRQ_TEST_NUM);
+	dc_ep_ppe_mbox_reg_dump(dev);
+	ppe_irq_num = 0;
+	return 0;
+}
+
+static void umt_txin_send(struct dc_ep_dev *dev,
+	u8 __iomem *soc_dbase, int num)
+{
+	int i;
+	struct aca_dma_desc desc;
+
+	memset(&desc, 0, sizeof(desc));
+	desc.own = 0;
+	desc.sop = 1;
+	desc.eop = 1;
+	desc.dic = 1;
+	desc.pdu_type = 1;
+	desc.data_len = 127;
+	desc.data_pointer = 0x26000000;
+	desc.dw1 = 0x700;
+	desc.dw0 = 0x0000007f;
+
+	for (i = 0; i < num; i++) {
+		desc.data_pointer += roundup(desc.data_len, 4);
+		ep_mem_write(soc_dbase + i * sizeof(desc),
+			(void *)&desc, sizeof(desc));
+	}
+
+	ep_wr32(num, TXIN_HD_ACCUM_ADD);
+}
+
+static void ppe_txout_send(struct dc_ep_dev *dev,
+	u8 __iomem *ppe_sb_base, int num)
+{
+	int i;
+	struct aca_dma_desc_2dw desc;
+
+	memset(&desc, 0, sizeof(desc));
+	desc.status.field.own = 1;
+	desc.status.field.sop = 1;
+	desc.status.field.eop = 1;
+	desc.status.field.data_len = 127;
+	desc.data_pointer = 0x26100000;
+
+	for (i = 0; i < num; i++) {
+		desc.data_pointer += roundup(desc.status.field.data_len, 4);
+		ep_mem_write(ppe_sb_base + i * sizeof(desc),
+			(void *)&desc, sizeof(desc));
+	}
+
+	ep_wr32(num, TXOUT_ACA_ACCUM_ADD);
+}
+
+static void ppe_rxout_send(struct dc_ep_dev *dev,
+	u8 __iomem *ppe_sb_base, int num)
+{
+	int i;
+	struct aca_dma_desc_2dw desc;
+
+	memset(&desc, 0, sizeof(desc));
+	desc.status.field.own = 0;
+	desc.status.field.sop = 1;
+	desc.status.field.eop = 1;
+	desc.status.field.meta_data0 = 0x3;
+	desc.status.field.meta_data1 = 0x7f;
+	desc.status.field.data_len = 127;
+	desc.data_pointer = 0x26200000;
+
+	for (i = 0; i < num; i++) {
+		desc.data_pointer += roundup(desc.status.field.data_len, 4);
+		ep_mem_write(ppe_sb_base + i * sizeof(desc),
+			(void *)&desc, sizeof(desc));
+	}
+
+	ep_wr32(num, RXOUT_ACA_ACCUM_ADD);
+}
+
+static void dc_aca_test_init(struct dc_ep_dev *dev, void *soc_base)
+{
+	umt_txin_send(dev, (u8 __iomem *)soc_base, 8);
+	ppe_txout_send(dev, (TXOUT_PD_DBASE + dev->membase), 8);
+	ppe_rxout_send(dev, (RXOUT_PD_DBASE + dev->membase), 8);
+}
+
+static const char *sysclk_str[SYS_CLK_MAX] = {
+	"36MHz",
+	"288MHz",
+};
+
+static const char *ppeclk_str[PPE_CLK_MAX] = {
+	"36MHz",
+	"576MHz",
+	"494MHz",
+	"432MHz",
+	"288MHz",
+};
+
+#define ACA_PMU_CTRL		0x11C
+#define ACA_PMU_DMA		BIT(2)
+#define ACA_PMU_EMA		BIT(22)
+
+enum {
+	DMA_ENDIAN_TYPE0 = 0,
+	DMA_ENDIAN_TYPE1,	/*!< Byte Swap(B0B1B2B3 => B1B0B3B2) */
+	DMA_ENDIAN_TYPE2,	/*!< Word Swap (B0B1B2B3 => B2B3B0B1) */
+	DMA_ENDIAN_TYPE3,	/*!< DWord Swap (B0B1B2B3 => B3B2B1B0) */
+	DMA_ENDIAN_MAX,
+};
+
+#ifdef CONFIG_CPU_BIG_ENDIAN
+#define DMA_ENDIAN_DEFAULT	DMA_ENDIAN_TYPE3
+#else
+#define DMA_ENDIAN_DEFAULT	DMA_ENDIAN_TYPE0
+#endif
+
+enum {
+	DMA_BURSTL_2DW = 1,	/*!< 2 DWORD DMA burst length */
+	DMA_BURSTL_4DW = 2,	/*!< 4 DWORD DMA burst length */
+	DMA_BURSTL_8DW = 3,	/*!< 8 DWORD DMA burst length */
+	DMA_BURSTL_16DW = 16,
+};
+
+#define DMA_BURSTL_DEFAULT	DMA_BURSTL_16DW
+
+#define DMA_TX_PORT_DEFAULT_WEIGHT	1
+/** Default Port Transmit weight value */
+#define DMA_TX_CHAN_DEFAULT_WEIGHT	1
+
+enum {
+	DMA_RX_CH = 0,  /*!< Rx channel */
+	DMA_TX_CH = 1,  /*!< Tx channel */
+};
+
+enum {
+	DMA_PKT_DROP_DISABLE = 0,
+	DMA_PKT_DROP_ENABLE,
+};
+
+#ifdef CONFIG_CPU_BIG_ENDIAN
+/* 2 DWs format descriptor */
+struct rx_desc_2dw {
+	u32 data_pointer; /* Descriptor data pointer */
+	union {
+		struct {
+			u32 own:1;
+			u32 c:1;
+			u32 sop:1;
+			u32 eop:1;
+			u32 meta:2;
+			u32 byte_offset:3;
+			u32 meta_data:7;
+			u32 data_len:16;
+		} __packed field;
+		u32 word;
+	} __packed status;
+} __packed __aligned(8);
+
+struct tx_desc_2dw {
+	u32 data_pointer; /* Descriptor data pointer */
+	union {
+		struct {
+			u32 own:1;
+			u32 c:1;
+			u32 sop:1;
+			u32 eop:1;
+			u32 meta:2;
+			u32 byte_offset:3;
+			u32 meta_data:7;
+			u32 data_len:16;
+		} __packed field;
+		u32 word;
+	} __packed status;
+} __packed __aligned(8);
+#else
+/* 2 DWs format descriptor */
+struct rx_desc_2dw {
+	u32 data_pointer; /* Descriptor data pointer */
+	union {
+		struct {
+			u32 data_len:16;
+			u32 meta_data:7;
+			u32 byte_offset:3;
+			u32 meta:2;
+			u32 eop:1;
+			u32 sop:1;
+			u32 c:1;
+			u32 own:1;
+		} __packed field;
+		u32 word;
+	} __packed status;
+} __packed __aligned(8);
+
+struct tx_desc_2dw {
+	u32 data_pointer; /* Descriptor data pointer */
+	union {
+		struct {
+			u32 data_len:16;
+			u32 meta_data:7;
+			u32 byte_offset:3;
+			u32 meta:2;
+			u32 eop:1;
+			u32 sop:1;
+			u32 c:1;
+			u32 own:1;
+		} __packed field;
+		u32 word;
+	} __packed status;
+} __packed __aligned(8);
+#endif
+
+enum {
+	SOC_TO_EP = 0,
+	EP_TO_SOC,
+};
+
+static int dma_pkt_size = 1024;
+static int dma_mode = SOC_TO_EP;
+static int dma_burst = 16;
+static int desc_num = 32;
+
+module_param(dma_pkt_size, int, 0);
+MODULE_PARM_DESC(dma_pkt_size, "Single packet length");
+
+module_param(dma_mode, int, 0);
+MODULE_PARM_DESC(dma_mode, "mode 0 -- Soc->EP, mode 1-- EP->SoC");
+
+
+static void dma_ctrl_rst(struct dc_ep_dev *dev)
+{
+	ep_wr32_mask(ACA_PMU_DMA | ACA_PMU_EMA, 0, ACA_PMU_CTRL);
+
+	udelay(10);
+	ep_wr32_mask(0, 1, DMA_CTRL);
+	udelay(10);
+	ep_wr32(0, DMA_CLC);
+}
+
+static void dma_chan_rst(struct dc_ep_dev *dev, int cn)
+{
+	ep_wr32(cn, DMA_CS);
+	ep_wr32(0x2, DMA_CCTRL);
+	while (ep_rd32(DMA_CCTRL) & 0x01)
+		udelay(10);
+}
+
+static void dma_port_cfg(struct dc_ep_dev *dev)
+{
+	u32 reg = 0;
+
+	reg |= (DMA_TX_PORT_DEFAULT_WEIGHT << 12);
+	reg |= (DMA_ENDIAN_TYPE0 << 10);
+	reg |= (DMA_ENDIAN_TYPE0 << 8);
+	reg |= (DMA_PKT_DROP_DISABLE << 6);
+	reg |= 0x3;
+	ep_wr32(0, DMA_PS);
+	ep_wr32(reg, DMA_PCTRL);
+}
+
+static void dma_byte_enable(struct dc_ep_dev *dev, int enable)
+{
+	if (enable)
+		ep_wr32_mask(0, BIT(9), DMA_CTRL);
+	else
+		ep_wr32_mask(BIT(9), 0, DMA_CTRL);
+}
+
+static void dma_tx_ch_cfg(struct dc_ep_dev *dev, int ch, u32 desc_base,
+	u32 desc_phys, dma_addr_t data_base, int desc_num)
+{
+	int i;
+	struct tx_desc_2dw *tx_desc;
+
+	for (i = 0; i < desc_num; i++) {
+		tx_desc = (struct tx_desc_2dw *)
+			(desc_base + (i * sizeof(*tx_desc)));
+		tx_desc->data_pointer = (((u32)(data_base +
+			(i * dma_pkt_size))) & 0xfffffff8);
+		tx_desc->status.word = 0;
+		tx_desc->status.field.byte_offset = 0;
+		tx_desc->status.field.data_len = dma_pkt_size;
+
+		tx_desc->status.field.sop = 1;
+		tx_desc->status.field.eop = 1;
+		tx_desc->status.field.own = 1;
+		wmb();
+	#if 0
+		pr_info("Tx desc num %d word 0x%08x data pointer 0x%08x\n",
+			i, tx_desc->status.word, tx_desc->data_pointer);
+	#endif
+	}
+	ep_wr32(ch, DMA_CS);
+	ep_wr32(desc_phys, DMA_CDBA);
+	ep_wr32(desc_num, DMA_CDLEN);
+	ep_wr32(0, DMA_CIE);
+}
+
+static void dma_rx_ch_cfg(struct dc_ep_dev *dev, int ch, u32 desc_base,
+	u32 desc_phys, dma_addr_t data_base, int desc_num)
+{
+	int i;
+	struct rx_desc_2dw *rx_desc;
+
+	for (i = 0; i < desc_num; i++) {
+		rx_desc = (struct rx_desc_2dw *)(desc_base
+			+ (i * sizeof(*rx_desc)));
+		rx_desc->data_pointer = (((u32)(data_base +
+			(i * dma_pkt_size))) & 0xfffffff8);
+
+		rx_desc->status.word = 0;
+		rx_desc->status.field.sop = 1;
+		rx_desc->status.field.eop = 1;
+		rx_desc->status.field.byte_offset = 0;
+		rx_desc->status.field.data_len = dma_pkt_size;
+		rx_desc->status.field.own = 1; /* DMA own the descriptor */
+		wmb();
+	#if 0
+		pr_info("Rx desc num %d word 0x%08x data pointer 0x%08x\n",
+			i, rx_desc->status.word, rx_desc->data_pointer);
+	#endif
+	}
+
+	ep_wr32(ch, DMA_CS);
+	ep_wr32(desc_phys, DMA_CDBA);
+	ep_wr32(desc_num, DMA_CDLEN);
+	ep_wr32(0, DMA_CIE);
+}
+
+static void dma_chan_on(struct dc_ep_dev *dev, u8 cn)
+{
+	ep_wr32(cn, DMA_CS);
+	ep_wr32_mask(0, BIT(0), DMA_CCTRL);
+}
+
+static void dma_chan_off(struct dc_ep_dev *dev, u8 cn)
+{
+	ep_wr32(cn, DMA_CS);
+	ep_wr32_mask(BIT(0), 0,  DMA_CCTRL);
+	udelay(10);
+}
+
+#define DEFAULT_TEST_PATTEN	0x12345678
+
+#define REG32(addr)		(*((volatile u32*)(addr)))
+
+#ifdef CONFIG_CPU_BIG_ENDIAN
+#define ___swab32(x) ((u32)(				\
+	(((u32)(x) & (u32)0x000000ffUL) << 24) |	\
+	(((u32)(x) & (u32)0x0000ff00UL) <<  8) |	\
+	(((u32)(x) & (u32)0x00ff0000UL) >>  8) |	\
+	(((u32)(x) & (u32)0xff000000UL) >> 24)))
+#else
+#define ___swab32(x)		(x)
+#endif
+
+static void dma_sdram_preload(void *sdram_data_tx_ptr, void *sdram_data_rx_ptr)
+{
+	int i;
+	int j;
+
+	u32 testaddr = (u32)sdram_data_tx_ptr;
+
+	for (i = 0; i < desc_num; i++) {
+		for (j = 0; j < dma_pkt_size; j = j + 4) {
+			REG32(testaddr + i * dma_pkt_size + j)
+				= DEFAULT_TEST_PATTEN;
+		}
+	}
+	pr_info("SDR Preload(0x55aa00ff) with data on TX location done\n");
+
+	testaddr = (u32)sdram_data_rx_ptr;
+	pr_info("RX Preload start address:0x%08x\n", (u32)(testaddr));
+
+	for (i = 0; i < desc_num; i++) {
+		for (j = 0; j < roundup(dma_pkt_size,
+			dma_burst << 2); j = j + 4)
+			REG32(testaddr + i * dma_pkt_size + j) = 0xcccccccc;
+	}
+	pr_info("SDR locations for Memcopy RX preset to 0xcccccccc done\n");
+}
+
+static void memcopy_data_check(u32 rx_data_addr)
+{
+	int i, j;
+	u32 read_data;
+
+	for (i = 0; i < desc_num; i++) {
+		for (j = 0; j < dma_pkt_size; j = j + 4) {
+			read_data = REG32(rx_data_addr + i * dma_pkt_size + j);
+			if (read_data != ___swab32(DEFAULT_TEST_PATTEN))
+				pr_info("Memcopy ERROR at addr 0x%08x data 0x%08x\n",
+				(rx_data_addr + j), read_data);
+		}
+	}
+}
+
+static u32 plat_throughput_calc(u32 payload, int cycles)
+{
+	return (u32)((payload * 300) / cycles);
+}
+
+#define DMA_CPOLL_CNT_MASK 0xFFF0u
+
+static void dma_ctrl_global_polling_enable(struct dc_ep_dev *dev, int interval)
+{
+	u32 reg = 0;
+
+	reg |= (1 << 31);
+	reg |= (interval << 4);
+
+	ep_wr32_mask(DMA_CPOLL_CNT_MASK,
+		reg,  DMA_CPOLL);
+}
+
+static void dma_controller_cfg(struct dc_ep_dev *dev)
+{
+	ep_wr32_mask(0, BIT(31), DMA_CTRL);
+	ep_wr32_mask(BIT(30), 0, DMA_CTRL);
+	ep_wr32_mask(0, BIT(1), DMA_CTRL);
+	ep_wr32_mask(0, BIT(13), DMA_CTRL);
+}
+
+#define PDRAM_OFFSET		0x200200
+#define PDRAM_TX_DESC_OFFSET	0x200000
+#define PDRAM_RX_DESC_OFFSET	0x200100
+#define ACA_SRAM_OFFSET		0x100000
+#define PPE_SB_TX_DESC_OFFSET	0x280000
+#define PPE_SB_RX_DESC_OFFSET	0x281000
+
+#define PPE_FPI_TX_DESC_OFFSET	0x320000
+#define PPE_FPI_RX_DESC_OFFSET	0x321000
+
+static void dma_test(struct dc_ep_dev *dev, int mode, int rcn, int tcn)
+{
+	u32 loop = 0;
+	void *tx_data;
+	void *rx_data;
+	dma_addr_t tx_data_phys = 0;
+	dma_addr_t rx_data_phys = 0;
+	u32 start, end;
+	u32 cycles;
+	struct rx_desc_2dw *rx_desc;
+	struct tx_desc_2dw *tx_desc;
+	struct tx_desc_2dw *last_tx_desc;
+	struct rx_desc_2dw *last_rx_desc;
+	dma_addr_t tx_desc_phys;
+	dma_addr_t rx_desc_phys;
+	u32 membase = (u32)(dev->membase);
+
+	rx_desc = (struct rx_desc_2dw *)(membase + PDRAM_RX_DESC_OFFSET);
+	rx_desc_phys = (dev->phy_membase + PDRAM_RX_DESC_OFFSET);
+	tx_desc = (struct tx_desc_2dw *)(membase + PDRAM_TX_DESC_OFFSET);
+	tx_desc_phys = (dev->phy_membase + PDRAM_TX_DESC_OFFSET);
+	last_rx_desc = rx_desc + (desc_num - 1);
+	last_tx_desc = tx_desc + (desc_num - 1);
+
+	if (mode == SOC_TO_EP) { /* Read from SoC DDR to local PDBRAM  */
+		tx_data = dma_alloc_coherent(NULL,
+			desc_num * dma_pkt_size, &tx_data_phys, GFP_DMA);
+		rx_data_phys = (dma_addr_t)(dev->phy_membase + PDRAM_OFFSET);
+		rx_data = (void *)(membase + PDRAM_OFFSET);
+	} else { /* Write from local PDBRAM to remote DDR */
+		tx_data_phys = (dma_addr_t)(dev->phy_membase + PDRAM_OFFSET);
+		tx_data = (void *)(membase + PDRAM_OFFSET);
+		rx_data = dma_alloc_coherent(NULL, desc_num * dma_pkt_size,
+			 &rx_data_phys, GFP_DMA);
+	}
+
+	pr_info("tx_desc_base %p tx_desc_phys 0x%08x tx_data %p tx_data_phys 0x%08x\n",
+		tx_desc, (u32)tx_desc_phys, tx_data, (u32)tx_data_phys);
+
+	pr_info("rx_desc_base %p rx_desc_phys 0x%08x rx_data %p rx_data_phys 0x%08x\n",
+		rx_desc, (u32)rx_desc_phys, rx_data, (u32)rx_data_phys);
+
+	pr_info("dma burst %d desc number %d packet size %d\n",
+		dma_burst, desc_num, dma_pkt_size);
+
+	dma_ctrl_rst(dev);
+	dma_chan_rst(dev, rcn);
+	dma_chan_rst(dev, tcn);
+	dma_port_cfg(dev);
+	dma_controller_cfg(dev);
+	dma_byte_enable(dev, 1);
+
+	dma_ctrl_global_polling_enable(dev, 24);
+
+	dma_sdram_preload(tx_data, rx_data);
+
+	dma_tx_ch_cfg(dev, tcn, (u32)tx_desc, tx_desc_phys,
+		tx_data_phys, desc_num);
+	dma_rx_ch_cfg(dev, rcn, (u32)rx_desc, rx_desc_phys,
+		rx_data_phys, desc_num);
+
+	udelay(5); /* Make sure that RX descriptor prefetched */
+
+	start = get_cycles();
+	dma_chan_on(dev, rcn);
+	dma_chan_on(dev, tcn);
+
+	/* wait till tx chan desc own is 0 */
+	while (last_tx_desc->status.field.own == 1) {
+		loop++;
+		udelay(1);
+	}
+	end = get_cycles();
+	cycles = end - start;
+	pr_info("cylces %d throughput %dMb\n", cycles,
+		plat_throughput_calc(desc_num * dma_pkt_size * 8, cycles));
+	pr_info("loop times %d\n", loop);
+	while (last_rx_desc->status.field.own == 1) {
+		loop++;
+		udelay(1);
+	}
+
+	memcopy_data_check((u32)rx_data);
+	dma_chan_off(dev, rcn);
+	dma_chan_off(dev, tcn);
+	if (mode == SOC_TO_EP) {
+		dma_free_coherent(NULL, desc_num * dma_pkt_size,
+			tx_data, tx_data_phys);
+	} else {
+		dma_free_coherent(NULL, desc_num * dma_pkt_size,
+			rx_data, rx_data_phys);
+	}
+}
+
+static int aca_soc_desc_alloc(int dev)
+{
+	dma_addr_t phy_addr;
+	void *base;
+	u32 size;
+
+	if (dev < 0 || dev > (DC_EP_MAX_PEER + 1))
+		return -EINVAL;
+
+	/* TXIN */
+	size = TXIN_SOC_DES_NUM * TXIN_HD_DES_SIZE * 4;
+	base  = dma_alloc_coherent(NULL, size, &phy_addr, GFP_DMA);
+	if (!base)
+		goto txin;
+	aca_soc_hd_desc[dev].txin.base = base;
+	aca_soc_hd_desc[dev].txin.phy_base = phy_addr;
+	aca_soc_hd_desc[dev].txin.size = size;
+	pr_info("txin soc desc base %p phy 0x%08x size 0x%08x\n",
+		base, (u32)phy_addr, size);
+
+	/* TXOUT */
+	size = TXOUT_SOC_DES_NUM * TXOUT_HD_DES_SIZE * 4;
+	base  = dma_alloc_coherent(NULL, size, &phy_addr, GFP_DMA);
+	if (!base)
+		goto txout;
+	aca_soc_hd_desc[dev].txout.base = base;
+	aca_soc_hd_desc[dev].txout.phy_base = phy_addr;
+	aca_soc_hd_desc[dev].txout.size = size;
+	pr_info("txout soc desc base %p phy 0x%08x size 0x%08x\n",
+		base, (u32)phy_addr, size);
+	/* RXOUT */
+	size = RXOUT_SOC_DES_NUM * RXOUT_HD_DES_SIZE * 4;
+	base  = dma_alloc_coherent(NULL, size, &phy_addr, GFP_DMA);
+	if (!base)
+		goto rxout;
+	aca_soc_hd_desc[dev].rxout.base = base;
+	aca_soc_hd_desc[dev].rxout.phy_base = phy_addr;
+	aca_soc_hd_desc[dev].rxout.size = size;
+	pr_info("rxout soc desc base %p phy 0x%08x size 0x%08x\n",
+		base, (u32)phy_addr, size);
+	return 0;
+rxout:
+	dma_free_coherent(NULL, aca_soc_hd_desc[dev].txout.size,
+		aca_soc_hd_desc[dev].txout.base,
+		aca_soc_hd_desc[dev].txout.phy_base);
+txout:
+	dma_free_coherent(NULL, aca_soc_hd_desc[dev].txin.size,
+		aca_soc_hd_desc[dev].txin.base,
+		aca_soc_hd_desc[dev].txin.phy_base);
+txin:
+	return -ENOMEM;
+}
+
+static int aca_soc_desc_free(int dev)
+{
+	dma_addr_t phy_addr;
+	void *base;
+	size_t size;
+
+	if (dev < 0 || dev > (DC_EP_MAX_PEER + 1))
+		return -EINVAL;
+
+	/* TXIN */
+	base = aca_soc_hd_desc[dev].txin.base;
+	phy_addr = aca_soc_hd_desc[dev].txin.phy_base;
+	size = aca_soc_hd_desc[dev].txin.size;
+	dma_free_coherent(NULL, size, base, phy_addr);
+
+	/* TXOUT */
+	base = aca_soc_hd_desc[dev].txout.base;
+	phy_addr = aca_soc_hd_desc[dev].txout.phy_base;
+	size = aca_soc_hd_desc[dev].txout.size;
+	dma_free_coherent(NULL, size, base, phy_addr);
+
+	/* RXOUT */
+	base = aca_soc_hd_desc[dev].rxout.base;
+	phy_addr = aca_soc_hd_desc[dev].rxout.phy_base;
+	size = aca_soc_hd_desc[dev].rxout.size;
+	dma_free_coherent(NULL, size, base, phy_addr);
+	return 0;
+}
+
+static int __init dc_ep_test_init(void)
+{
+	int i, j;
+	int dev_num;
+	struct dc_ep_dev dev;
+	int func = 0;
+	u32 sysclk = 0;
+	u32 ppeclk = 0;
+
+	if (dc_ep_dev_num_get(&dev_num)) {
+		pr_err("%s failed to get total device number\n", __func__);
+		return -EIO;
+	}
+
+	pr_info("%s: total %d EPs found\n", __func__, dev_num);
+
+	for (i = 0; i < dev_num; i++)
+		aca_soc_desc_alloc(i);
+
+	for (i = 0; i < dev_num; i++) {
+		struct aca_param aca_cfg = {
+			.aca_txin = {
+				.soc_desc_base
+					= aca_soc_hd_desc[i].txin.phy_base,
+				.soc_desc_num = TXIN_SOC_DES_NUM,
+				.pp_buf_desc_num = 32,
+				.pd_desc_base = TXIN_PD_DBASE,
+				.pd_desc_num = TXIN_PD_DES_NUM,
+				.hd_size_in_dw = TXIN_HD_DES_SIZE,
+				.pd_size_in_dw = TXIN_PD_DES_SIZE,
+				.byteswap = 1,
+			},
+			.aca_txout = {
+				.soc_desc_base
+					= aca_soc_hd_desc[i].txout.phy_base,
+				.soc_desc_num = TXOUT_SOC_DES_NUM,
+				.pp_buf_desc_num = 32,
+				.pd_desc_base = TXOUT_PD_DBASE,
+				.pd_desc_num = TXOUT_PD_DES_NUM,
+				.hd_size_in_dw = TXOUT_HD_DES_SIZE,
+				.pd_size_in_dw = TXOUT_PD_DES_SIZE,
+				.byteswap = 1,
+			},
+			.aca_rxout = {
+				.soc_desc_base
+					= aca_soc_hd_desc[i].rxout.phy_base,
+				.soc_desc_num = RXOUT_SOC_DES_NUM,
+				.pp_buf_desc_num = 32,
+				.pd_desc_base = RXOUT_PD_DBASE,
+				.pd_desc_num = RXOUT_PD_DES_NUM,
+				.hd_size_in_dw = RXOUT_HD_DES_SIZE,
+				.pd_size_in_dw = RXOUT_PD_DES_SIZE,
+				.byteswap = 1,
+			},
+		};
+		struct aca_modem_param modem_cfg = {
+			.mdm_txout = {
+				.stat = SB_XBAR_ADDR(__TX_OUT_ACA_ACCUM_STATUS),
+				.pd      = SB_XBAR_ADDR(__TX_OUT_QUEUE_PD_BASE_ADDR_OFFSET),
+				.acc_cnt = SB_XBAR_ADDR(__TX_OUT_ACA_ACCUM_COUNT),
+			},
+			.mdm_rxout = {
+				.stat    = SB_XBAR_ADDR(__RX_OUT_ACA_ACCUM_STATUS),
+				.pd      = SB_XBAR_ADDR(__RX_OUT_QUEUE_PD_BASE_ADDR_OFFSET),
+				.acc_cnt = SB_XBAR_ADDR(__RX_OUT_ACA_ACCUM_COUNT),
+			},
+			.mdm_rxin = {
+				.stat    = SB_XBAR_ADDR(__RX_IN_ACA_ACCUM_STATUS),
+				.pd      = SB_XBAR_ADDR(__RX_IN_QUEUE_PD_BASE_ADDR_OFFSET),
+				.acc_cnt = SB_XBAR_ADDR(__RX_IN_ACA_ACCUM_COUNT),
+			},
+		};
+		if (dc_ep_dev_info_req(i, DC_EP_INT_PPE, &dev))
+			pr_info("%s failed to get pcie ep %d information\n",
+			__func__, i);
+		pr_info("irq %d\n", dev.irq);
+		pr_info("phyiscal membase 0x%08x virtual membase 0x%p\n",
+			dev.phy_membase, dev.membase);
+		if (dev_num > 1) {
+			for (j = 0; j < dev.peer_num; j++) {
+				pr_info("phyiscal peer membase 0x%08x virtual peer membase 0x%p\n",
+					dev.peer_phy_membase[j], dev.peer_membase[j]);
+			}
+		}
+		/* For module unload perpose */
+		memcpy(&pcie_dev[i], &dev, sizeof(struct dc_ep_dev));
+		dc_ep_ppe_mbox_int_stress_test(&pcie_dev[i]);
+		dev.hw_ops->clk_on(&dev, PMU_CDMA | PMU_EMA | PMU_PPM2);
+		dev.hw_ops->clk_set(&dev, SYS_CLK_288MHZ, PPE_CLK_576MHZ);
+		dev.hw_ops->pinmux_set(&dev, 14, MUX_FUNC_ALT1);
+		dev.hw_ops->pinmux_set(&dev, 15, MUX_FUNC_ALT2);
+		dev.hw_ops->pinmux_get(&dev, 15, &func);
+		pr_info("gpio 15 func %d\n", func);
+		dev.hw_ops->pinmux_set(&dev, 13, MUX_FUNC_GPIO);
+		dev.hw_ops->gpio_dir(&dev, 13, GPIO_DIR_OUT);
+		dev.hw_ops->gpio_set(&dev, 13, 1);
+		dev.hw_ops->gpio_get(&dev, 13, &func);
+		pr_info("gpio 13 value %d\n", func);
+		dev.hw_ops->gpio_pupd_set(&dev, 14, GPIO_PULL_DOWN);
+		dev.hw_ops->gpio_od_set(&dev, 0, 1);
+		dev.hw_ops->gpio_src_set(&dev, 0, GPIO_SLEW_RATE_FAST);
+		dev.hw_ops->gpio_dcc_set(&dev, 0, GPIO_DRV_CUR_8MA);
+		dev.hw_ops->clk_get(&dev, &sysclk, &ppeclk);
+		pr_info("ppe clk %s sys clk %s\n", ppeclk_str[ppeclk],
+			sysclk_str[sysclk]);
+		dev.hw_ops->aca_init(&dev, &aca_cfg, &modem_cfg);
+		dev.hw_ops->aca_start(&dev, ACA_ALL_EN, 1);
+
+		pr_info("ACA test\n");
+		dc_aca_test_init(&dev, aca_soc_hd_desc[i].txin.base);
+
+		pr_info("DMA test\n");
+		dma_pkt_size = 64;
+		dma_test(&dev, dma_mode, 0, 1);
+#if 0
+		dma_pkt_size = 128;
+		dma_test(&dev, dma_mode, 0, 1);
+		dma_pkt_size = 256;
+		dma_test(&dev, dma_mode, 0, 1);
+		dma_pkt_size = 512;
+		dma_test(&dev, dma_mode, 0, 1);
+		dma_pkt_size = 1024;
+		dma_test(&dev, dma_mode, 0, 1);
+		dma_pkt_size = 2048;
+		dma_test(&dev, dma_mode, 0, 1);
+
+		dma_mode = EP_TO_SOC;
+		dma_pkt_size = 64;
+		dma_test(&dev, dma_mode, 0, 1);
+		dma_pkt_size = 128;
+		dma_test(&dev, dma_mode, 0, 1);
+		dma_pkt_size = 256;
+		dma_test(&dev, dma_mode, 0, 1);
+		dma_pkt_size = 512;
+		dma_test(&dev, dma_mode, 0, 1);
+		dma_pkt_size = 1024;
+		dma_test(&dev, dma_mode, 0, 1);
+		dma_pkt_size = 2048;
+		dma_test(&dev, dma_mode, 0, 1);
+#endif
+	}
+
+	pr_info("Intel(R) SmartPHY DSL(VRX518) PCIe EP Test Driver - %s\n",
+		ep_test_driver_version);
+	return 0;
+}
+
+static void __exit dc_ep_test_exit(void)
+{
+	int i;
+	int dev_num;
+	u32 func = ACA_ALL_EN;
+	struct dc_ep_dev *dev;
+
+	if (dc_ep_dev_num_get(&dev_num)) {
+		pr_err("%s failed to get total device number\n", __func__);
+		return;
+	}
+	pr_info("%s: total %d EPs found\n", __func__, dev_num);
+	for (i = 0; i < dev_num; i++) {
+		dev = &pcie_dev[i];
+		free_irq(dev->irq, dev);
+		dev->hw_ops->aca_stop(dev, &func, 1);
+		dev->hw_ops->clk_off(dev, PMU_EMA);
+		if (dc_ep_dev_info_release(i)) {
+			pr_info("%s failed to release pcie ep %d information\n",
+				__func__, i);
+		}
+		aca_soc_desc_free(i);
+	}
+}
+
+module_init(dc_ep_test_init);
+module_exit(dc_ep_test_exit);
+
+MODULE_AUTHOR("Intel Corporation, <Chuanhua.lei@intel.com>");
+MODULE_DESCRIPTION("Intel(R) SmartPHY (VRX518) PCIe EP/ACA test driver");
+MODULE_LICENSE("GPL");
diff --git a/package/kernel/lantiq/vrx518_ep/src/test/ep_test.h b/package/kernel/lantiq/vrx518_ep/src/test/ep_test.h
new file mode 100644
index 00000000000000..ef2b847bb26afb
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_ep/src/test/ep_test.h
@@ -0,0 +1,273 @@
+/*******************************************************************************
+
+  Intel SmartPHY DSL PCIe Endpoint/ACA Linux driver
+  Copyright(c) 2016 Intel Corporation.
+
+  This program is free software; you can redistribute it and/or modify it
+  under the terms and conditions of the GNU General Public License,
+  version 2, as published by the Free Software Foundation.
+
+  This program is distributed in the hope it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+  more details.
+
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc.,
+  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+
+  The full GNU General Public License is included in this distribution in
+  the file called "COPYING".
+
+*******************************************************************************/
+
+#ifndef EP_TEST_H
+#define EP_TEST_H
+
+/* SB address on xBar */
+#define SB_XBAR_BASE		0x280000
+#define SB_XBAR_DES_RXBASE	SB_XBAR_BASE
+#define SB_XBAR_DES_TXBASE	(SB_XBAR_BASE + 0x400)
+#define SB_XBAR_DATA_BASE	(SB_XBAR_BASE + 0x800)
+#define SB_XBAR_ADDR(x)		(SB_XBAR_BASE + ((((x) - 0xA000)) << 2))
+
+/*----------------------------------------------------------
+ * ACA Shadow Registers
+ * 3 * 4 = 12
+ * *_STATUS need to be initialized to nonzero by PPE driver
+ *----------------------------------------------------------
+ */
+
+#define __ACA_SHADOW_REG_BASE			0xADF0
+
+#define __TX_IN_ACA_ACCUM_COUNT			0xADF0
+
+#define __TX_IN_ACA_ACCUM_STATUS		0xADF1
+
+#define __TX_IN_QUEUE_PD_BASE_ADDR_OFFSET	0xADF2
+
+#define __TX_OUT_ACA_ACCUM_COUNT		0xADF3
+
+#define __TX_OUT_ACA_ACCUM_STATUS		0xADF4
+
+#define __TX_OUT_QUEUE_PD_BASE_ADDR_OFFSET	0xADF5
+
+#define __RX_IN_ACA_ACCUM_COUNT			0xADF6
+
+#define __RX_IN_ACA_ACCUM_STATUS		0xADF7
+
+#define __RX_IN_QUEUE_PD_BASE_ADDR_OFFSET	0xADF8
+
+#define __RX_OUT_ACA_ACCUM_COUNT		0xADF9
+
+#define __RX_OUT_ACA_ACCUM_STATUS		0xADFA
+
+#define __RX_OUT_QUEUE_PD_BASE_ADDR_OFFSET	0xADFB
+
+#define TXIN_PD_DES_NUM		64
+#define TXIN_PD_DBASE		0x105400
+#define TXIN_SOC_DES_NUM	32
+#define TXIN_SOC_DBASE		0x24000000
+#define TXIN_HOST_DES_NUM	32
+#define TXIN_HD_DES_SIZE	4 /* size in DWORD */
+#define TXIN_PD_DES_SIZE	2 /* size in DWORD */
+
+#define TXOUT_PD_DES_NUM	32
+#define TXOUT_PD_DBASE		0x105700
+#define TXOUT_SOC_DES_NUM	32
+#define TXOUT_SOC_DBASE		0x24001000
+#define TXOUT_HOST_DES_NUM	32
+#define TXOUT_HD_DES_SIZE	1 /* size in DWORD */
+#define TXOUT_PD_DES_SIZE	2 /* size in DWORD */
+
+#define RXOUT_PD_DES_NUM	32
+#define RXOUT_PD_DBASE		0x105C00
+#define RXOUT_SOC_DES_NUM	32
+#define RXOUT_SOC_DBASE		0x24002000
+#define RXOUT_HOST_DES_NUM	32
+#define RXOUT_HD_DES_SIZE	4 /* size in DWORD */
+#define RXOUT_PD_DES_SIZE	2 /* size in DWORD */
+
+/* PPE interrupt */
+#define PPE_MBOX_TEST_BIT	0x1
+#define PPE_MBOX_IRQ_TEST_NUM	100
+
+#define PPE_MBOX_BASE		0x334800
+
+#define MBOX_REG(X)	(PPE_MBOX_BASE + (X))
+#define MBOX_IGU0_ISRS	MBOX_REG(0x0)
+#define MBOX_IGU0_ISRC	MBOX_REG(0x4)
+#define MBOX_IGU0_ISR	MBOX_REG(0x8)
+#define MBOX_IGU0_IER	MBOX_REG(0xc)
+
+#define HOST_IF_BASE		0x50000
+#define HOST_IF_REG(X)		(HOST_IF_BASE + (X))
+#define TXIN_CONV_CFG		HOST_IF_REG(0x14)
+#define RXIN_HD_ACCUM_ADD	HOST_IF_REG(0xC8) /* UMT Message trigger */
+#define TXIN_HD_ACCUM_ADD	HOST_IF_REG(0xCC) /* UMT Message trigger */
+#define RXOUT_ACA_ACCUM_ADD	HOST_IF_REG(0xE0) /* PPE FW tigger */
+#define TXOUT_ACA_ACCUM_ADD	HOST_IF_REG(0xE4) /* PPE FW tigger */
+
+#define CDMA_BASE	0x2D0000
+#define CDMA_REG(X)	(CDMA_BASE + (X))
+
+#define DMA_CLC		CDMA_REG(0x00)
+#define DMA_ID		CDMA_REG(0x08)
+#define DMA_CTRL	CDMA_REG(0x10)
+
+#define DMA_CTRL_RST		BIT(0)
+#define DMA_CTRL_DSRAM_PATH	BIT(1)
+#define DMA_CTRL_CH_FL		BIT(6)
+#define DMA_CTRL_DS_FOD		BIT(7)
+#define DMA_CTRL_DRB		BIT(8)
+#define DMA_CTRL_ENBE		BIT(9)
+#define DMA_CTRL_PRELOAD_INT_S	10
+#define DMA_CTRL_PRELOAD_INT	0x0C00u
+#define DMA_CTRL_PRELOAD_EN	BIT(12)
+#define DMA_CTRL_MBRST_CNT_S	16
+#define DMA_CTRL_MBRST_CNT	0x3FF0000u
+#define DMA_CTRL_MBRSTARB	BIT(30)
+#define DMA_CTRL_PKTARB		BIT(31)
+
+#define DMA_CPOLL	CDMA_REG(0x14)
+#define DMA_CPOLL_CNT_S		4
+#define DMA_CPOLL_CNT		0xFFF0u
+#define DMA_CPOLL_EN		BIT(31)
+
+#define DMA_CS		CDMA_REG(0x18)
+#define DMA_CCTRL	CDMA_REG(0x1C)
+#define DMA_CCTRL_ON		BIT(0)
+#define DMA_CCTRL_RST		BIT(1)
+#define DMA_CCTRL_DIR_TX	BIT(8)
+#define DMA_CCTRL_CLASS_S	9
+#define DMA_CCTRL_CLASS		0xE00u
+#define DMA_CCTRL_PRTNR_S	12
+#define DMA_CCTRL_PRTNR		0xF000u
+#define DMA_CCTRL_TXWGT_S	16
+#define DMA_CCTRL_TXWGT		0x30000u
+#define DMA_CCTRL_CLASSH_S	18
+#define DMA_CCTRL_CLASSH	0xC0000u
+#define DMA_CCTRL_PDEN		BIT(23)
+#define DMA_CCTRL_P2PCPY	BIT(24)
+#define DMA_CCTRL_LBEN		BIT(25)
+#define DMA_CCTRL_LBCHNR_S	26
+#define DMA_CCTRL_LBCHNR	0xFC000000u
+
+#define DMA_CDBA	CDMA_REG(0x20)
+#define DMA_CDLEN	CDMA_REG(0x24)
+#define DMA_CIS		CDMA_REG(0x28)
+#define DMA_CIE		CDMA_REG(0x2C)
+
+#define DMA_CI_EOP		BIT(1)
+#define DMA_CI_DUR		BIT(2)
+#define DMA_CI_DESCPT		BIT(3)
+#define DMA_CI_CHOFF		BIT(4)
+#define DMA_CI_RDERR		BIT(5)
+#define DMA_CI_ALL	(DMA_CI_EOP | DMA_CI_DUR | DMA_CI_DESCPT\
+			| DMA_CI_CHOFF | DMA_CI_RDERR)
+
+#define DMA_CI_DEFAULT	(DMA_CI_EOP | DMA_CI_DESCPT)
+#define DMA_CDPTNRD	CDMA_REG(0x34)
+
+#define DMA_PS		CDMA_REG(0x40)
+#define DMA_PCTRL	CDMA_REG(0x44)
+#define DMA_PCTRL_RXBL16	BIT(0)
+#define DMA_PCTRL_TXBL16	BIT(1)
+#define DMA_PCTRL_RXBL_S	2
+#define DMA_PCTRL_RXBL		0xCu
+#define DMA_PCTRL_TXBL_S	4
+#define DMA_PCTRL_TXBL		0x30u
+#define DMA_PCTRL_PDEN		BIT(6)
+#define DMA_PCTRL_PDEN_S	6
+#define DMA_PCTRL_RXENDI_S	8
+#define DMA_PCTRL_RXENDI	0x300u
+#define DMA_PCTRL_TXENDI_S	10
+#define DMA_PCTRL_TXENDI	0xC00u
+#define DMA_PCTRL_TXWGT_S	12
+#define DMA_PCTRL_TXWGT		0x7000u
+#define DMA_PCTRL_MEM_FLUSH	BIT(16)
+
+#define DMA_IRNEN	CDMA_REG(0xF4)
+#define DMA_IRNCR	CDMA_REG(0xF8)
+#define DMA_IRNICR	CDMA_REG(0xFC)
+
+#ifdef CONFIG_CPU_BIG_ENDIAN
+struct aca_dma_desc {
+	/* DW0 */
+	u32 dw0;
+	/* DW1 */
+	u32 dw1;
+	/* DW2 */
+	u32 data_pointer;
+	/* DW3 */
+	u32 own:1;
+	u32 c:1;
+	u32 sop:1;
+	u32 eop:1;
+	u32 dic:1;
+	u32 pdu_type:1;
+	u32 byte_off:3;
+	u32 qid:4;
+	u32 mpoa_pt:1;
+	u32 mpoa_mode:2;
+	u32 data_len:16;
+}__packed __aligned(16);
+
+/* 2 DWs format descriptor */
+struct aca_dma_desc_2dw {
+	u32 data_pointer; /* Descriptor data pointer */
+	union {
+		struct {
+			u32 own:1;
+			u32 c:1;
+			u32 sop:1;
+			u32 eop:1;
+			u32 meta_data0:2;
+			u32 byte_offset:3;
+			u32 meta_data1:7;
+			u32 data_len:16;
+		} __packed field;
+		u32 word;
+	} __packed status;
+} __packed __aligned(8);
+#else
+struct aca_dma_desc {
+	/* DW0 */
+	u32 dw0;
+	/* DW1 */
+	u32 dw1;
+	/* DW2 */
+	u32 data_pointer;
+	/* DW 3 */
+	u32 data_len:16;
+	u32 mpoa_mode:2;
+	u32 mpoa_pt:1;
+	u32 qid:4;
+	u32 byte_off:3;
+	u32 pdu_type:1;
+	u32 dic:1;
+	u32 eop:1;
+	u32 sop:1;
+	u32 c:1;
+	u32 own:1;
+}__packed __aligned(16);
+
+/* 2 DWs format descriptor */
+struct aca_dma_desc_2dw {
+	u32 data_pointer; /* Descriptor data pointer */
+	union {
+		struct {
+			u32 data_len:16;
+			u32 meta_data1:7;
+			u32 byte_offset:3;
+			u32 meta_data0:2;
+			u32 eop:1;
+			u32 sop:1;
+			u32 c:1;
+			u32 own:1;
+		} __packed field;
+		u32 word;
+	} __packed status;
+} __packed __aligned(8);
+#endif
+#endif /* EP_TEST_H */
diff --git a/package/kernel/lantiq/vrx518_tc/Makefile b/package/kernel/lantiq/vrx518_tc/Makefile
new file mode 100644
index 00000000000000..b05fb4bb637e6c
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_tc/Makefile
@@ -0,0 +1,74 @@
+#
+# Copyright (C) 2019 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_NAME:=vrx518_tc
+PKG_VERSION:=1.5.12.4
+PKG_RELEASE:=3
+PKG_BASE_NAME:=vrx518_tc_drv
+
+UGW_VERSION=8.5.2.10
+UGW_BASENAME=$(PKG_BASE_NAME)-ugw_$(UGW_VERSION)
+
+PKG_SOURCE:=$(UGW_BASENAME).tar.bz2
+PKG_SOURCE_URL:=https://gitlab.com/prpl-foundation/intel/$(PKG_BASE_NAME)/-/archive/ugw_$(UGW_VERSION)/
+PKG_HASH:=0c5bb0f9a06dc4cc4bbb8b930d01a673daba1b66615e8328818356d32c8f1548
+PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(UGW_BASENAME)
+PKG_LICENSE:=GPL-2.0
+PKG_LICENSE_FILES:=LICENSE
+
+include $(INCLUDE_DIR)/package.mk
+
+PLAT_DIR:=dcdp
+PKG_EXTMOD_SUBDIRS:=$(PLAT_DIR)
+
+# TODO this driver depends on the vrx518 ppe firmware, add this dependency if
+# that ever gets a compatible license
+define KernelPackage/$(PKG_NAME)
+  SECTION:=sys
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=VRX518 TC driver
+  KCONFIG:= \
+    CONFIG_ATM_LANE=m \
+    CONFIG_ATM_MPOA=m \
+    CONFIG_ATM_MPOA_INTEL_DSL_PHY_SUPPORT=y
+  DEPENDS:=@TARGET_ipq40xx +kmod-vrx518_ep +kmod-crypto-md5 +kmod-atm +kmod-ipoa +br2684ctl
+  AUTOLOAD:=$(call AutoLoad,27,vrx518_tc)
+  FILES:=$(PKG_BUILD_DIR)/$(PLAT_DIR)/$(PKG_NAME).ko
+endef
+
+define KernelPackage/$(PKG_NAME)/description
+  VRX518 TC Driver
+endef
+
+define Build/Prepare
+	$(PKG_UNPACK)
+	# eliminate all carriage returns / convert to unix encoding
+	(cd $(PKG_BUILD_DIR) && find . -type f -exec sed -i 's/\r//g' {} +)
+	$(Build/Patch)
+endef
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include/net/
+	$(CP) $(PKG_BUILD_DIR)/$(PLAT_DIR)/inc/dsl_tc.h $(1)/usr/include/net/
+endef
+
+EXTRA_CFLAGS:= \
+	-I$(STAGING_DIR)/usr/include
+
+define Build/Compile
+	$(KERNEL_MAKE) \
+		M="$(PKG_BUILD_DIR)/$(PLAT_DIR)" \
+		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
+		FEATURE_VRX518_CPU=y \
+		modules
+endef
+
+$(eval $(call KernelPackage,$(PKG_NAME)))
diff --git a/package/kernel/lantiq/vrx518_tc/patches/100-compat.patch b/package/kernel/lantiq/vrx518_tc/patches/100-compat.patch
new file mode 100644
index 00000000000000..2c92912adef1d4
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_tc/patches/100-compat.patch
@@ -0,0 +1,859 @@
+--- a/dcdp/atm_tc.c
++++ b/dcdp/atm_tc.c
+@@ -44,9 +44,9 @@
+ #include <linux/atmioc.h>
+ #include <linux/skbuff.h>
+ #include "inc/dsl_tc.h"
+-#include <net/datapath_proc_api.h>
++// #include <net/datapath_proc_api.h>
+ #include <linux/atm.h>
+-#include <net/datapath_api.h>
++// #include <net/datapath_api.h>
+ #include <net/dc_ep.h>
+ #include<linux/sched.h>
+ #include<linux/kthread.h>
+@@ -730,20 +730,16 @@ static void atm_aca_init(struct atm_priv
+ 		ACA_TXOUT_EN | ACA_RXIN_EN | ACA_RXOUT_EN, 1);
+ }
+ 
+-static int print_datetime(char *buffer, const struct timespec *datetime)
++static int print_datetime(char *buffer, const struct timespec64 *datetime)
+ {
+-	struct timeval tv;
+ 	struct tm nowtm;
+ 	char tmbuf[64];
+-	s64 nsec;
+ 
+ 	if (buffer == NULL || datetime == NULL) {
+ 		pr_err("%s : Invalid arguments\n", __func__);
+ 		return -1;
+ 	}
+-	nsec = timespec_to_ns(datetime);
+-	tv = ns_to_timeval(nsec);
+-	time_to_tm(tv.tv_sec, 0, &nowtm);
++	time64_to_tm(datetime->tv_sec, 0, &nowtm);
+ 	memset(tmbuf, 0, 64);
+ 
+ 	snprintf(tmbuf, sizeof(tmbuf), "%ld-%d-%d %d:%d:%d",
+@@ -753,7 +749,7 @@ static int print_datetime(char *buffer,
+ 			nowtm.tm_hour,
+ 			nowtm.tm_min,
+ 			nowtm.tm_sec);
+-	snprintf(buffer, sizeof(buffer), "%s.%06d", tmbuf, (int)tv.tv_usec);
++	snprintf(buffer, sizeof(buffer), "%s.%06d", tmbuf, (int)datetime->tv_nsec / 1000);
+ 
+ 	return 0;
+ }
+@@ -1313,7 +1309,7 @@ static int ppe_send(struct atm_vcc *vcc,
+ 	/* assume LLC header + Ethernet ID: 6+2 */
+     if ((priv->conn[conn].mpoa_type == MPOA_TYPE_EOA_WO_FCS) ||
+ 		(priv->conn[conn].mpoa_type == MPOA_TYPE_EOA_W_FCS)) {
+-        if (__skb_put_padto(skb, ETH_ZLEN + 8))
++        if (__skb_put_padto(skb, ETH_ZLEN + 8, false))
+ 		    goto CHECK_SHOWTIME_FAIL;
+ 	}
+ 
+@@ -1418,7 +1414,7 @@ int ppe_send_oam(struct atm_vcc *vcc, vo
+ 	struct atm_priv *priv = g_atm_tc;
+ 	struct sk_buff *skb;
+ 	unsigned int conn;
+-	dp_subif_t dp_id;
++// 	dp_subif_t dp_id;
+ #ifdef OAM_FIX_GRX750
+ 	unsigned char *dest_cell;
+ #endif
+@@ -1465,8 +1461,8 @@ int ppe_send_oam(struct atm_vcc *vcc, vo
+ 		priv->tc_priv->param.oam_prio = 0;
+ 	qid = priv->conn[conn].prio_queue_map[priv->tc_priv->param.oam_prio];
+ 	vid = priv->conn[conn].subif_id;
+-	dp_id.subif = (vid & (~0x7f)) |
+-		ATM_DESC_SUBIF_ID(qid, mpoa_pt, mpoa_type);
++// 	dp_id.subif = (vid & (~0x7f)) |
++// 		ATM_DESC_SUBIF_ID(qid, mpoa_pt, mpoa_type);
+ #ifdef OAM_FIX_GRX750
+ 	dest_cell = kmalloc(CELL_SIZE, GFP_KERNEL);
+ 	if (dest_cell == NULL) {
+@@ -1494,18 +1490,18 @@ int ppe_send_oam(struct atm_vcc *vcc, vo
+ #else
+ 	memcpy(skb->data, cell, CELL_SIZE);
+ #endif
+-	/* SET SUBIFID */
+-	skb->DW0 = (skb->DW0 & ~0x7FFF) | dp_id.subif;
+-	skb->dev = priv->conn[conn].dev;
+-	tc_dbg(priv->tc_priv, MSG_TX, "conn: %d, dev name: %s, qid: 0x%x len:%d\n",
+-		conn, skb->dev->name, dp_id.subif, skb->len);
+-	#ifdef OAM_FIX_GRX750
+-	if (priv->tc_priv->tc_ops.send(NULL,
+-			skb, dp_id.subif, ATM_OAM_PKT) == 0) {
+-	#else
++// 	/* SET SUBIFID */
++// 	skb->DW0 = (skb->DW0 & ~0x7FFF) | dp_id.subif;
++// 	skb->dev = priv->conn[conn].dev;
++// 	tc_dbg(priv->tc_priv, MSG_TX, "conn: %d, dev name: %s, qid: 0x%x len:%d\n",
++// 		conn, skb->dev->name, dp_id.subif, skb->len);
++// 	#ifdef OAM_FIX_GRX750
++// 	if (priv->tc_priv->tc_ops.send(NULL,
++// 			skb, dp_id.subif, ATM_OAM_PKT) == 0) {
++// 	#else
+ 	if (priv->tc_priv->tc_ops.send(NULL,
+ 			skb, qid, ATM_OAM_PKT) == 0) {
+-	#endif
++// 	#endif
+ 		priv->stats.oam_tx_pkts++;
+ 		priv->stats.oam_tx_bytes += skb->len;
+ 		priv->conn[conn].stats.oam_tx_pkts++;
+@@ -1604,7 +1600,7 @@ static void oam_push(struct atm_priv *pr
+ 		conn = -1; /* invalid */
+ 	if (conn_valid(conn) && priv->conn[conn].vcc != NULL) {
+ 		vcc = priv->conn[conn].vcc;
+-		priv->conn[conn].access_time = current_kernel_time();
++		ktime_get_coarse_ts64(&priv->conn[conn].access_time);
+ 
+ 		tc_dbg(priv->tc_priv, MSG_OAM_RX, "conn=%d, vpi: %d, vci:%d\n",
+ 			conn, header->vpi, header->vci);
+@@ -2547,30 +2543,29 @@ static void ppe_atm_fw_hw_init(struct at
+ static int atm_dev_init(struct atm_priv *atm_priv, int ep_id)
+ {
+ 	int i, err;
+-	struct atm_dev *dev;
+-	dev = atm_dev_register(g_atm_dev_name,
+-		atm_priv->tc_priv->ep_dev[ep_id].dev,
+-		&g_ppe_atm_ops, -1, NULL);
+-	if (!dev) {
+-		err = -EIO;
+-		goto ATM_DEV_REGISTER_FAIL;
+-	}
+-	dev->ci_range.vpi_bits = 8;
+-	dev->ci_range.vci_bits = 16;
+-	/* assume 3200 cell rate
+-	 * before get real information
+-	 */
+-	dev->link_rate =
+-		DEFAULT_CELL_RATE;
+-	dev->dev_data = atm_priv;
+-	dev->phy_data =
+-		(void *)(unsigned long)0;
+ 
+ 	for (i = 0; i < ATM_PORT_NUMBER; i++) {
+ 		if (atm_priv->port[i].dev)
+ 			continue;
+ 		atm_priv->port[i].tx_max_cell_rate = DEFAULT_CELL_RATE;
+-		atm_priv->port[i].dev = dev;
++		atm_priv->port[i].dev = atm_dev_register(g_atm_dev_name,
++				atm_priv->tc_priv->ep_dev[ep_id].dev,
++				&g_ppe_atm_ops, -1, NULL);
++		if (!atm_priv->port[i].dev) {
++			err = -EIO;
++			goto ATM_DEV_REGISTER_FAIL;
++		} else {
++			atm_priv->port[i].dev->ci_range.vpi_bits = 8;
++			atm_priv->port[i].dev->ci_range.vci_bits = 16;
++			/* assume 3200 cell rate
++			 * before get real information
++			 */
++			atm_priv->port[i].dev->link_rate =
++				DEFAULT_CELL_RATE;
++			atm_priv->port[i].dev->dev_data = atm_priv;
++			atm_priv->port[i].dev->phy_data =
++				(void *)(unsigned long)i;
++		}
+ 	}
+ 	//TODO : check for SoC PMAC, current fix
+ #ifdef CONFIG_SOC_TYPE_XWAY
+@@ -2985,7 +2980,8 @@ static unsigned int atm_get_pvc_id(struc
+ 		return -EINVAL;
+ 	}
+ 
+-	return (skb->DW0 >> 3) & 0xF;
++// 	return (skb->DW0 >> 3) & 0xF;
++	return 1;
+ }
+ 
+ static int atm_get_qid_by_vcc(struct net_device *dev, struct sk_buff *skb,
+@@ -3292,7 +3288,7 @@ static void atm_push(struct net_device *
+ 					+= skb->len;
+ 			} else
+ 				priv->stats.aal5_rx_errors++;
+-			priv->conn[conn].access_time = current_kernel_time();
++			ktime_get_coarse_ts64(&priv->conn[conn].access_time);
+ 			spin_unlock_bh(&priv->atm_lock);
+ 
+ 			vcc->push(vcc, skb);
+--- a/dcdp/inc/atm_tc.h
++++ b/dcdp/inc/atm_tc.h
+@@ -449,7 +449,7 @@ struct atm_port {
+ struct atm_pvc {
+ 	struct atm_vcc *vcc; /* opened VCC */
+ 	struct net_device *dev; /* net device associated with atm VCC */
+-	struct timespec access_time; /* time when last user cell arrived */
++	struct timespec64 access_time; /* time when last user cell arrived */
+ 	int prio_queue_map[ATM_PRIO_Q_NUM];
+ 	unsigned int prio_tx_packets[ATM_PRIO_Q_NUM];
+ 	struct atm_stats stats;
+--- a/dcdp/inc/tc_api.h
++++ b/dcdp/inc/tc_api.h
+@@ -196,19 +196,6 @@ static inline void aca_ring_addr_init(st
+ 	ring->aca_cnt_phyaddr = ep_dev->phy_membase + addr;
+ }
+ 
+-static inline int __skb_put_padto(struct sk_buff *skb, unsigned int len)
+-{
+-	unsigned int size = skb->len;
+-
+-	if (unlikely(size < len)) {
+-		len -= size;
+-		if (skb_pad(skb, len))
+-			return -ENOMEM;
+-		__skb_put(skb, len);
+-	}
+-	return 0;
+-}
+-
+ extern int showtime_stat(struct tc_priv *);
+ extern void dump_skb_info(struct tc_priv *, struct sk_buff *, u32);
+ extern void *tc_buf_alloc(void *, size_t, u32 *,
+--- a/dcdp/inc/tc_proc.h
++++ b/dcdp/inc/tc_proc.h
+@@ -23,6 +23,8 @@
+ #ifndef __TC_PROC_H__
+ #define __TC_PROC_H__
+ 
++#include <linux/version.h>
++
+ #define TC_PROC_DIR "driver/vrx518"
+ #define TC_PROC_ATM_DIR "atm"
+ #define TC_PROC_PTM_DIR "ptm"
+@@ -41,7 +43,7 @@ enum {
+ struct tc_proc_list {
+ 	char proc_name[32];
+ 	umode_t mode;
+-	const struct file_operations *fops;
++	const struct proc_ops *fops;
+ 	int is_folder;
+ };
+ 
+--- a/dcdp/ptm_tc.c
++++ b/dcdp/ptm_tc.c
+@@ -39,7 +39,7 @@
+ #include <linux/seq_file.h>
+ #include <linux/printk.h>
+ #include <linux/etherdevice.h>
+-#include <net/datapath_proc_api.h>
++// #include <net/datapath_proc_api.h>
+ 
+ #include "inc/tc_main.h"
+ #include "inc/reg_addr.h"
+@@ -182,8 +182,8 @@ static int ptm_get_qid(struct net_device
+ 	return qid;
+ }
+ 
+-static struct rtnl_link_stats64 *ptm_get_stats(struct net_device *dev,
+-					struct rtnl_link_stats64 *storage)
++static void ptm_get_stats(struct net_device *dev,
++			  struct rtnl_link_stats64 *storage)
+ {
+ 	struct ptm_priv *ptm_tc = netdev_priv(dev);
+ 
+@@ -191,8 +191,6 @@ static struct rtnl_link_stats64 *ptm_get
+ 		memcpy(storage, &ptm_tc->stats64, sizeof(ptm_tc->stats64));
+ 	else
+ 		storage->tx_errors += ptm_tc->stats64.tx_errors;
+-
+-	return storage;
+ }
+ 
+ static int ptm_set_mac_address(struct net_device *dev, void *p)
+@@ -209,7 +207,7 @@ static int ptm_set_mac_address(struct ne
+ 	return 0;
+ }
+ 
+-static void ptm_tx_timeout(struct net_device *dev)
++static void ptm_tx_timeout(struct net_device *dev, unsigned int txqueue)
+ {
+ 	struct ptm_priv *ptm_tc = netdev_priv(dev);
+ 
+@@ -503,7 +501,7 @@ static int ptm_xmit(struct sk_buff *skb,
+ 	if (!showtime_stat(ptm_tc->tc_priv))
+ 		goto PTM_XMIT_DROP;
+ 
+-	if (__skb_put_padto(skb, ETH_ZLEN))
++	if (__skb_put_padto(skb, ETH_ZLEN, false))
+ 		goto PTM_XMIT_DROP;
+ 
+ 	dump_skb_info(ptm_tc->tc_priv, skb, (MSG_TX | MSG_TXDATA));
+@@ -632,11 +630,8 @@ static int ptm_dev_init(struct tc_priv *
+ 	struct ptm_priv *ptm_tc;
+ 	const char macaddr[ETH_ALEN]
+ 		= {0xAC, 0x9A, 0x96, 0x11, 0x22, 0x33};
+-#if LINUX_VERSION_CODE < KERNEL_VERSION(4,8,0)
+-	dev = alloc_netdev_mq(sizeof(*ptm_tc), "ptm%d", ptm_setup, 4);
+-#else
+-	dev = alloc_netdev_mq(sizeof(*ptm_tc), "ptm%d",  NET_NAME_ENUM, ptm_setup, 4);
+-#endif
++
++	dev = alloc_netdev_mq(sizeof(*ptm_tc), "dsl%d",  NET_NAME_ENUM, ptm_setup, 4);
+ 	if (!dev) {
+ 		tc_dbg(tc_priv, MSG_INIT, "Cannot alloc net device\n");
+ 		return -ENOMEM;
+@@ -2103,7 +2098,6 @@ static int ptm_showtime_exit(const unsig
+ 	struct ptm_ep_priv *priv = tc_ep_priv(idx);
+ 	u32 stop = ACA_TXIN_EN;
+ 	struct dc_ep_dev *ep;
+-	int i = 0;
+ 
+ 	tc_info(priv->tc_priv, MSG_EVENT, "Line[%d]: show time exit!\n", idx);
+ 	ep = priv->ep;
+--- a/dcdp/tc_api.c
++++ b/dcdp/tc_api.c
+@@ -52,18 +52,24 @@ static const char ppe_fw_name[] = "ppe_f
+ #define VRX518_PPE_FW_ID		0xB
+ #define MD5_LEN				16
+ 
++enum tc_multicast_groups {
++	TC_MCGRP,
++};
++
++/* TC message multicast group */
++static const struct genl_multicast_group tc_ml_grps[] = {
++	[TC_MCGRP] = { .name = TC_MCAST_GRP_NAME, },
++};
++
+ /* TC message genelink family */
+ static struct genl_family tc_gnl_family = {
+-	.id = GENL_ID_GENERATE,	/* To generate an id for the family*/
++// 	.id = GENL_ID_GENERATE,	/* To generate an id for the family*/
+ 	.hdrsize = 0,
+ 	.name = TC_FAMILY_NAME,	/*family name, used by userspace application*/
+ 	.version = 1,		/*version number  */
+ 	.maxattr = TC_A_MAX - 1,
+-};
+-
+-/* TC message multicast group */
+-static struct genl_multicast_group tc_ml_grp = {
+-	.name = TC_MCAST_GRP_NAME,
++	.mcgrps = tc_ml_grps,
++	.n_mcgrps = ARRAY_SIZE(tc_ml_grps),
+ };
+ 
+ /**
+@@ -568,7 +574,8 @@ int tc_ntlk_msg_send(struct tc_priv *pri
+ 	nla_put_u32(skb, TC_A_LINENO, ln_no);
+ 
+ 	genlmsg_end(skb, msg_head);
+-	ret = genlmsg_multicast(skb, pid, tc_ml_grp.id, GFP_KERNEL);
++	ret = genlmsg_multicast(&tc_gnl_family, skb, pid, TC_MCGRP,
++				GFP_KERNEL);
+ 	if (ret) {
+ 		tc_err(priv, MSG_EVENT, "Sent TC multicast message Fail!\n");
+ 		goto err1;
+@@ -590,21 +597,11 @@ int tc_gentlk_init(struct tc_priv *priv)
+ 		return ret;
+ 	}
+ 
+-	ret = genl_register_mc_group(&tc_gnl_family, &tc_ml_grp);
+-	if (ret) {
+-		tc_err(priv, MSG_EVENT, "register mc group fail: %i, grp name: %s\n",
+-			ret, tc_ml_grp.name);
+-		genl_unregister_family(&tc_gnl_family);
+-		return ret;
+-	}
+-
+ 	return 0;
+ }
+ 
+ void tc_gentlk_exit(void)
+ {
+-	/* unregister mc groups */
+-	genl_unregister_mc_group(&tc_gnl_family, &tc_ml_grp);
+ 	/*unregister the family*/
+ 	genl_unregister_family(&tc_gnl_family);
+ }
+@@ -666,7 +663,7 @@ void dump_skb_info(struct tc_priv *tcpri
+ 		(u32)skb->end, skb->len);
+ 	tc_dbg(tcpriv, type,
+ 		"skb: clone: %d, users: %d\n",
+-		skb->cloned, atomic_read(&skb->users));
++		skb->cloned, refcount_read(&skb->users));
+ 	tc_dbg(tcpriv, type,
+ 		"skb: nfrag: %d\n", skb_shinfo(skb)->nr_frags);
+ 
+@@ -936,7 +933,6 @@ static int fw_md5_check(struct tc_priv *
+ 	}
+ 
+ 	desc->tfm = md5;
+-	desc->flags = 0;
+ 
+ 	ret = crypto_shash_init(desc);
+ 	if (ret) {
+--- a/dcdp/tc_proc.c
++++ b/dcdp/tc_proc.c
+@@ -22,7 +22,9 @@
+ *******************************************************************************/
+ #include <linux/fs.h>
+ #include <linux/seq_file.h>
+-#include <net/datapath_api.h>
++// #include <net/datapath_api.h>
++#include <linux/etherdevice.h>
++#include <linux/atmdev.h>
+ #include <net/genetlink.h>
+ #include <linux/time.h>
+ #include "inc/tc_main.h"
+@@ -353,7 +355,7 @@ static ssize_t mem_proc_write(struct fil
+ 	}
+ 	addr = set_val = repeat_cnt = 0;
+ 
+-	if (!access_ok(VERIFY_READ, buf, count))
++	if (!access_ok(buf, count))
+ 		return -EFAULT;
+ 
+ 	len = count < sizeof(str) ? count : sizeof(str) - 1;
+@@ -450,13 +452,12 @@ static int proc_read_mem_seq_open(struct
+ 	return single_open(file, proc_read_mem, NULL);
+ }
+ 
+-static const struct file_operations mem_proc_fops = {
+-	.owner		= THIS_MODULE,
+-	.open		= proc_read_mem_seq_open,
+-	.read		= seq_read,
+-	.llseek		= seq_lseek,
+-	.release	= single_release,
+-	.write		= mem_proc_write,
++static const struct proc_ops mem_proc_fops = {
++	.proc_open	= proc_read_mem_seq_open,
++	.proc_read	= seq_read,
++	.proc_lseek	= seq_lseek,
++	.proc_release	= single_release,
++	.proc_write	= mem_proc_write,
+ };
+ 
+ static ssize_t pp32_proc_write(struct file *file, const char __user *buf,
+@@ -748,13 +749,12 @@ static int proc_read_pp32_seq_open(struc
+ 	return single_open(file, proc_read_pp32, PDE_DATA(inode));
+ }
+ 
+-static const struct file_operations pp32_proc_fops = {
+-	.owner		= THIS_MODULE,
+-	.open		= proc_read_pp32_seq_open,
+-	.read		= seq_read,
+-	.llseek		= seq_lseek,
+-	.release	= single_release,
+-	.write		= pp32_proc_write,
++static const struct proc_ops pp32_proc_fops = {
++	.proc_open	= proc_read_pp32_seq_open,
++	.proc_read	= seq_read,
++	.proc_lseek	= seq_lseek,
++	.proc_release	= single_release,
++	.proc_write	= pp32_proc_write,
+ };
+ 
+ static int proc_read_tc_cfg(struct seq_file *seq, void *v)
+@@ -865,13 +865,12 @@ static int proc_read_tc_cfg_seq_open(str
+ 	return single_open(file, proc_read_tc_cfg, PDE_DATA(inode));
+ }
+ 
+-static const struct file_operations tc_cfg_proc_fops = {
+-	.owner		= THIS_MODULE,
+-	.open		= proc_read_tc_cfg_seq_open,
+-	.read		= seq_read,
+-	.llseek		= seq_lseek,
+-	.release	= single_release,
+-	.write		= proc_write_cfg,
++static const struct proc_ops tc_cfg_proc_fops = {
++	.proc_open	= proc_read_tc_cfg_seq_open,
++	.proc_read	= seq_read,
++	.proc_lseek	= seq_lseek,
++	.proc_release	= single_release,
++	.proc_write	= proc_write_cfg,
+ };
+ 
+ static ssize_t proc_write_dbg(struct file *file, const char __user *buf,
+@@ -951,13 +950,12 @@ static int proc_read_dbg_seq_open(struct
+ 	return single_open(file, proc_read_dbg, PDE_DATA(inode));
+ }
+ 
+-static const struct file_operations tc_dbg_proc_fops = {
+-	.owner		= THIS_MODULE,
+-	.open		= proc_read_dbg_seq_open,
+-	.read		= seq_read,
+-	.write		= proc_write_dbg,
+-	.llseek		= seq_lseek,
+-	.release	= single_release,
++static const struct proc_ops tc_dbg_proc_fops = {
++	.proc_open	= proc_read_dbg_seq_open,
++	.proc_read	= seq_read,
++	.proc_write	= proc_write_dbg,
++	.proc_lseek	= seq_lseek,
++	.proc_release	= single_release,
+ };
+ 
+ static ssize_t proc_write_tc_switch(struct file *file, const char __user *buf,
+@@ -1018,11 +1016,11 @@ proc_tc_switch_help:
+ 	return count;
+ }
+ 
+-static const struct file_operations tc_switch_proc_fops = {
+-	.owner      = THIS_MODULE,
+-	.write      = proc_write_tc_switch,
+-	.llseek     = noop_llseek,
++static const struct proc_ops tc_switch_proc_fops = {
++	.proc_write = proc_write_tc_switch,
++	.proc_lseek = noop_llseek,
+ };
++
+ static ssize_t proc_write_show_time(struct file *file, const char __user *buf,
+ 			size_t count, loff_t *data)
+ {
+@@ -1077,10 +1075,9 @@ proc_show_time_help:
+ 	return count;
+ }
+ 
+-static const struct file_operations tc_show_time_proc_fops = {
+-	.owner      = THIS_MODULE,
+-	.write      = proc_write_show_time,
+-	.llseek     = noop_llseek,
++static const struct proc_ops tc_show_time_proc_fops = {
++	.proc_write = proc_write_show_time,
++	.proc_lseek = noop_llseek,
+ };
+ 
+ static int proc_read_ver(struct seq_file *seq, void *v)
+@@ -1128,12 +1125,11 @@ static int proc_read_ver_seq_open(struct
+ 	return single_open(file, proc_read_ver, PDE_DATA(inode));
+ }
+ 
+-static const struct file_operations tc_ver_proc_fops = {
+-	.owner		= THIS_MODULE,
+-	.open		= proc_read_ver_seq_open,
+-	.read		= seq_read,
+-	.llseek		= seq_lseek,
+-	.release	= single_release,
++static const struct proc_ops tc_ver_proc_fops = {
++	.proc_open	= proc_read_ver_seq_open,
++	.proc_read	= seq_read,
++	.proc_lseek	= seq_lseek,
++	.proc_release	= single_release,
+ };
+ 
+ static int proc_read_soc(struct seq_file *seq, void *v)
+@@ -1142,20 +1138,18 @@ static int proc_read_soc(struct seq_file
+ 
+ 	tcpriv = (struct tc_priv *)seq->private;
+ 
+-#if 0
+ 	seq_printf(seq, "TXIN Base: 0x%08x, TXIN num: %d\n",
+-			tcpriv->cfg.txin_dbase,
+-			tcpriv->cfg.txin_dnum);
++			tcpriv->cfg.txin.soc_phydbase,
++			tcpriv->cfg.txin.soc_dnum);
+ 	seq_printf(seq, "TXOUT Base: 0x%08x, TXOUT num: %d\n",
+-			tcpriv->cfg.txout_dbase,
+-			tcpriv->cfg.txout_dnum);
++			tcpriv->cfg.txout.soc_phydbase,
++			tcpriv->cfg.txout.soc_dnum);
+ 	seq_printf(seq, "RXIN Base: 0x%08x, RXIN num: %d\n",
+-			tcpriv->cfg.rxin_dbase,
+-			tcpriv->cfg.rxin_dnum);
++			tcpriv->cfg.rxin.soc_phydbase,
++			tcpriv->cfg.rxin.soc_dnum);
+ 	seq_printf(seq, "RXOUT Base: 0x%08x, RXOUT num: %d\n",
+-			tcpriv->cfg.rxout_dbase,
+-			tcpriv->cfg.rxout_dnum);
+-#endif
++			tcpriv->cfg.rxout.soc_phydbase,
++			tcpriv->cfg.rxout.soc_dnum);
+ 
+ 	return 0;
+ }
+@@ -1165,15 +1159,13 @@ static int proc_read_soc_seq_open(struct
+ 	return single_open(file, proc_read_soc, PDE_DATA(inode));
+ }
+ 
+-static const struct file_operations tc_soc_proc_fops = {
+-	.owner		= THIS_MODULE,
+-	.open		= proc_read_soc_seq_open,
+-	.read		= seq_read,
+-	.llseek		= seq_lseek,
+-	.release	= single_release,
++static const struct proc_ops tc_soc_proc_fops = {
++	.proc_open	= proc_read_soc_seq_open,
++	.proc_read	= seq_read,
++	.proc_lseek	= seq_lseek,
++	.proc_release	= single_release,
+ };
+ 
+-
+ static struct tc_proc_list tc_procs[] = {
+ 	{TC_PROC_DIR,	0,	NULL,			1},
+ 	{"cfg",		0644, &tc_cfg_proc_fops,	0},
+@@ -1241,13 +1233,12 @@ static int proc_read_ptm_wanmib_seq_open
+ 	return single_open(file, proc_read_ptm_wanmib, PDE_DATA(inode));
+ }
+ 
+-static const struct file_operations ptm_wanmib_proc_fops = {
+-	.owner      = THIS_MODULE,
+-	.open       = proc_read_ptm_wanmib_seq_open,
+-	.read       = seq_read,
+-	.write      = proc_write_ptm_wanmib,
+-	.llseek     = seq_lseek,
+-	.release    = single_release,
++static const struct proc_ops ptm_wanmib_proc_fops = {
++	.proc_open    = proc_read_ptm_wanmib_seq_open,
++	.proc_read    = seq_read,
++	.proc_write   = proc_write_ptm_wanmib,
++	.proc_lseek   = seq_lseek,
++	.proc_release = single_release,
+ };
+ 
+ static int proc_ptm_read_cfg(struct seq_file *seq, void *v)
+@@ -1300,7 +1291,7 @@ static ssize_t ptm_cfg_proc_write(struct
+ 		return -EINVAL;
+ 	}
+ 
+-	if (!access_ok(VERIFY_READ, buf, count))
++	if (!access_ok(buf, count))
+ 		return -EFAULT;
+ 
+ 	len = count < sizeof(str) ? count : sizeof(str) - 1;
+@@ -1343,13 +1334,12 @@ proc_ptm_cfg_help:
+ }
+ 
+ 
+-static const struct file_operations ptm_cfg_proc_fops = {
+-	.owner = THIS_MODULE,
+-	.open = proc_read_cfg_seq_open,
+-	.read = seq_read,
+-	.llseek = seq_lseek,
+-	.write = ptm_cfg_proc_write,
+-	.release = single_release,
++static const struct proc_ops ptm_cfg_proc_fops = {
++	.proc_open = proc_read_cfg_seq_open,
++	.proc_read = seq_read,
++	.proc_lseek = seq_lseek,
++	.proc_write = ptm_cfg_proc_write,
++	.proc_release = single_release,
+ };
+ 
+ static ssize_t proc_ptm_write_prio(struct file *file, const char __user *buf,
+@@ -1455,13 +1445,12 @@ static int proc_ptm_read_prio_seq_open(s
+ 	return single_open(file, proc_ptm_read_prio, PDE_DATA(inode));
+ }
+ 
+-static const struct file_operations ptm_prio_proc_fops = {
+-	.owner		= THIS_MODULE,
+-	.open		= proc_ptm_read_prio_seq_open,
+-	.read		= seq_read,
+-	.llseek		= seq_lseek,
+-	.write		= proc_ptm_write_prio,
+-	.release	= single_release,
++static const struct proc_ops ptm_prio_proc_fops = {
++	.proc_open	= proc_ptm_read_prio_seq_open,
++	.proc_read	= seq_read,
++	.proc_lseek	= seq_lseek,
++	.proc_write	= proc_ptm_write_prio,
++	.proc_release	= single_release,
+ };
+ 
+ static int proc_ptm_read_bond_seq_open(struct inode *inode, struct file *file)
+@@ -1469,12 +1458,11 @@ static int proc_ptm_read_bond_seq_open(s
+ 	return single_open(file, proc_ptm_read_bond, PDE_DATA(inode));
+ }
+ 
+-static const struct file_operations ptm_bond_proc_fops = {
+-	.owner		= THIS_MODULE,
+-	.open		= proc_ptm_read_bond_seq_open,
+-	.read		= seq_read,
+-	.llseek		= seq_lseek,
+-	.release	= single_release,
++static const struct proc_ops ptm_bond_proc_fops = {
++	.proc_open	= proc_ptm_read_bond_seq_open,
++	.proc_read	= seq_read,
++	.proc_lseek	= seq_lseek,
++	.proc_release	= single_release,
+ };
+ 
+ static int proc_ptm_read_bondmib_seq_open(struct inode *inode,
+@@ -1483,13 +1471,12 @@ static int proc_ptm_read_bondmib_seq_ope
+ 	return single_open(file, proc_ptm_read_bondmib, PDE_DATA(inode));
+ }
+ 
+-static const struct file_operations ptm_bondmib_proc_fops = {
+-	.owner		= THIS_MODULE,
+-	.open		= proc_ptm_read_bondmib_seq_open,
+-	.read		= seq_read,
+-	.llseek		= seq_lseek,
+-	.write		= proc_ptm_write_bondmib,
+-	.release	= single_release,
++static const struct proc_ops ptm_bondmib_proc_fops = {
++	.proc_open	= proc_ptm_read_bondmib_seq_open,
++	.proc_read	= seq_read,
++	.proc_lseek	= seq_lseek,
++	.proc_write	= proc_ptm_write_bondmib,
++	.proc_release	= single_release,
+ };
+ 
+ struct fwdbg_t {
+@@ -1910,14 +1897,14 @@ static int proc_read_fwdbg_seq_open(stru
+ {
+ 	return single_open(file, proc_read_fwdbg, NULL);
+ }
+-static const struct file_operations fwdbg_proc_fops = {
+-	.owner		= THIS_MODULE,
+-	.open		= proc_read_fwdbg_seq_open,
+-	.read		= seq_read,
+-	.write		= proc_write_fwdbg_seq,
+-	.llseek		= seq_lseek,
+-	.release	= single_release,
++static const struct proc_ops fwdbg_proc_fops = {
++	.proc_open	= proc_read_fwdbg_seq_open,
++	.proc_read	= seq_read,
++	.proc_write	= proc_write_fwdbg_seq,
++	.proc_lseek	= seq_lseek,
++	.proc_release	= single_release,
+ };
++
+ static struct tc_proc_list ptm_sl_procs[] = {
+ 	{TC_PROC_PTM_DIR, 0,	NULL,			1},
+ 	{"mem",		0644,	&mem_proc_fops,		0},
+@@ -2077,7 +2064,7 @@ static ssize_t atm_cfg_proc_write(struct
+ 
+ 	priv = (struct atm_priv *)PDE_DATA(file_inode(file));
+ 
+-	if (!access_ok(VERIFY_READ, buf, count))
++	if (!access_ok(buf, count))
+ 		return -EFAULT;
+ 
+ 	len = count < sizeof(str) ? count : sizeof(str) - 1;
+@@ -2119,13 +2106,12 @@ proc_atm_cfg_help:
+ 	return count;
+ }
+ 
+-static const struct file_operations atm_cfg_proc_fops = {
+-	.owner		= THIS_MODULE,
+-	.open		= proc_read_atm_cfg_seq_open,
+-	.read		= seq_read,
+-	.write		= atm_cfg_proc_write,
+-	.llseek		= seq_lseek,
+-	.release	= single_release,
++static const struct proc_ops atm_cfg_proc_fops = {
++	.proc_open	= proc_read_atm_cfg_seq_open,
++	.proc_read	= seq_read,
++	.proc_write	= atm_cfg_proc_write,
++	.proc_lseek	= seq_lseek,
++	.proc_release	= single_release,
+ };
+ 
+ static ssize_t proc_write_atm_wanmib(struct file *file, const char __user *buf,
+@@ -2173,13 +2159,12 @@ static int proc_read_atm_wanmib_seq_open
+ 
+ 
+ 
+-static const struct file_operations atm_wanmib_proc_fops = {
+-	.owner      = THIS_MODULE,
+-	.open       = proc_read_atm_wanmib_seq_open,
+-	.read       = seq_read,
+-	.write      = proc_write_atm_wanmib,
+-	.llseek     = seq_lseek,
+-	.release    = single_release,
++static const struct proc_ops atm_wanmib_proc_fops = {
++	.proc_open    = proc_read_atm_wanmib_seq_open,
++	.proc_read    = seq_read,
++	.proc_write   = proc_write_atm_wanmib,
++	.proc_lseek   = seq_lseek,
++	.proc_release = single_release,
+ };
+ 
+ static int proc_read_htu_seq_open(struct inode *inode, struct file *file)
+@@ -2187,12 +2172,11 @@ static int proc_read_htu_seq_open(struct
+ 	return single_open(file, proc_read_htu, PDE_DATA(inode));
+ }
+ 
+-static const struct file_operations htu_proc_fops = {
+-	.owner		= THIS_MODULE,
+-	.open		= proc_read_htu_seq_open,
+-	.read		= seq_read,
+-	.llseek		= seq_lseek,
+-	.release	= single_release,
++static const struct proc_ops htu_proc_fops = {
++	.proc_open	= proc_read_htu_seq_open,
++	.proc_read	= seq_read,
++	.proc_lseek	= seq_lseek,
++	.proc_release	= single_release,
+ };
+ 
+ static int proc_read_queue_seq_open(struct inode *inode, struct file *file)
+@@ -2200,12 +2184,11 @@ static int proc_read_queue_seq_open(stru
+ 	return single_open(file, proc_read_queue, PDE_DATA(inode));
+ }
+ 
+-static const struct file_operations queue_proc_fops = {
+-	.owner		= THIS_MODULE,
+-	.open		= proc_read_queue_seq_open,
+-	.read		= seq_read,
+-	.llseek		= seq_lseek,
+-	.release	= single_release,
++static const struct proc_ops queue_proc_fops = {
++	.proc_open	= proc_read_queue_seq_open,
++	.proc_read	= seq_read,
++	.proc_lseek	= seq_lseek,
++	.proc_release	= single_release,
+ };
+ 
+ static void set_q_prio(struct atm_priv *priv,
+@@ -2428,13 +2411,12 @@ static const struct seq_operations pvc_m
+ 	.show = pvc_mib_seq_show,
+ };
+ 
+-static const struct file_operations atm_prio_proc_fops = {
+-	.owner		= THIS_MODULE,
+-	.open		= proc_atm_read_prio_seq_open,
+-	.read		= seq_read,
+-	.llseek		= seq_lseek,
+-	.write		= proc_atm_write_prio,
+-	.release	= single_release,
++static const struct proc_ops atm_prio_proc_fops = {
++	.proc_open	= proc_atm_read_prio_seq_open,
++	.proc_read	= seq_read,
++	.proc_lseek	= seq_lseek,
++	.proc_write	= proc_atm_write_prio,
++	.proc_release	= single_release,
+ };
+ 
+ static int proc_read_pvc_mib_seq_open(struct inode *inode, struct file *file)
+@@ -2447,12 +2429,11 @@ static int proc_read_pvc_mib_seq_open(st
+ 	return ret;
+ }
+ 
+-static const struct file_operations atm_pvc_mib_proc_fops = {
+-	.owner	= THIS_MODULE,
+-	.open	= proc_read_pvc_mib_seq_open,
+-	.read	= seq_read,
+-	.llseek	= seq_lseek,
+-	.release = seq_release,
++static const struct proc_ops atm_pvc_mib_proc_fops = {
++	.proc_open	= proc_read_pvc_mib_seq_open,
++	.proc_read	= seq_read,
++	.proc_lseek	= seq_lseek,
++	.proc_release	= seq_release,
+ };
+ 
+ static ssize_t proc_write_cell(struct file *file,
+@@ -2592,13 +2573,12 @@ static int proc_read_cell_seq_open(struc
+ 	return single_open(file, proc_read_cell, NULL);
+ }
+ 
+-static const struct file_operations atm_cell_proc_fops = {
+-	.owner		= THIS_MODULE,
+-	.open		= proc_read_cell_seq_open,
+-	.read		= seq_read,
+-	.write		= proc_write_cell,
+-	.llseek		= seq_lseek,
+-	.release	= single_release,
++static const struct proc_ops atm_cell_proc_fops = {
++	.proc_open	= proc_read_cell_seq_open,
++	.proc_read	= seq_read,
++	.proc_write	= proc_write_cell,
++	.proc_lseek	= seq_lseek,
++	.proc_release	= single_release,
+ };
+ 
+ static struct tc_proc_list atm_procs[] = {
diff --git a/package/kernel/lantiq/vrx518_tc/patches/200-swplat.patch b/package/kernel/lantiq/vrx518_tc/patches/200-swplat.patch
new file mode 100644
index 00000000000000..793adefdd65b35
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_tc/patches/200-swplat.patch
@@ -0,0 +1,1356 @@
+The existing software receive and transmit path does not actually work.
+This replaces it by a basic working implementation.
+
+--- a/dcdp/atm_tc.c
++++ b/dcdp/atm_tc.c
+@@ -603,7 +603,11 @@ static void atm_aca_init(struct atm_priv
+ 	cfg = &priv->tc_priv->cfg;
+ 
+ 	txin = &param.aca_txin;
++#if defined(__LITTLE_ENDIAN)
++	txin->byteswap = 0;
++#else
+ 	txin->byteswap = 1;
++#endif
+ 	txin->hd_size_in_dw = cfg->txin.soc_desc_dwsz;
+ 	txin->pd_desc_base = SB_XBAR_ADDR(__ACA_TX_IN_PD_LIST_BASE);
+ 	txin->pd_desc_num = __ACA_TX_IN_PD_LIST_NUM;
+@@ -625,7 +629,11 @@ static void atm_aca_init(struct atm_priv
+ 		txin->soc_cmlt_cnt_addr);
+ 
+ 	txout = &param.aca_txout;
++#if defined(__LITTLE_ENDIAN)
++	txout->byteswap = 0;
++#else
+ 	txout->byteswap = 1;
++#endif
+ 	txout->hd_size_in_dw = cfg->txout.soc_desc_dwsz;
+ 	txout->pd_desc_base = SB_XBAR_ADDR(__ACA_TX_OUT_PD_LIST_BASE);
+ 	txout->pd_desc_num = __ACA_TX_OUT_PD_LIST_NUM;
+@@ -647,7 +655,11 @@ static void atm_aca_init(struct atm_priv
+ 		txout->soc_cmlt_cnt_addr);
+ 
+ 	rxout = &param.aca_rxout;
++#if defined(__LITTLE_ENDIAN)
++	rxout->byteswap = 0;
++#else
+ 	rxout->byteswap = 1;
++#endif
+ 	rxout->hd_size_in_dw = cfg->rxout.soc_desc_dwsz;
+ 	rxout->pd_desc_base = SB_XBAR_ADDR(__ACA_RX_OUT_PD_LIST_BASE);
+ 	rxout->pd_desc_num = __ACA_RX_OUT_PD_LIST_NUM;
+@@ -669,7 +681,11 @@ static void atm_aca_init(struct atm_priv
+ 		rxout->soc_cmlt_cnt_addr);
+ 
+ 	rxin = &param.aca_rxin;
++#if defined(__LITTLE_ENDIAN)
++	rxin->byteswap = 0;
++#else
+ 	rxin->byteswap = 1;
++#endif
+ 	rxin->hd_size_in_dw = cfg->rxin.soc_desc_dwsz;
+ 	rxin->pd_desc_base = SB_XBAR_ADDR(__RX_IN_PD_DES_LIST_BASE);
+ 	rxin->pd_desc_num = __ACA_RX_IN_PD_LIST_NUM;
+@@ -1261,7 +1277,7 @@ static int ppe_ioctl(struct atm_dev *dev
+ static int ppe_send(struct atm_vcc *vcc, struct sk_buff *skb)
+ {
+ 	int ret, qid, mpoa_pt, mpoa_type, vid;
+-	unsigned int prio, conn;
++	unsigned int prio, conn, len;
+ 	struct atm_priv *priv;
+ 
+ 	if (!vcc) {
+@@ -1327,12 +1343,14 @@ static int ppe_send(struct atm_vcc *vcc,
+ 	tc_dbg(priv->tc_priv, MSG_TX, "vid: 0x%x, qid: 0x%x\n",
+ 			vid, qid);
+ 
++	len = skb->len;
++
+ 	if (priv->tc_priv->tc_ops.send(NULL,
+ 			skb, qid, ATM_SL_PKT) == 0) {
+ 		priv->stats.aal5_tx_pkts++;
+-		priv->stats.aal5_tx_bytes += skb->len;
++		priv->stats.aal5_tx_bytes += len;
+ 		priv->conn[conn].stats.aal5_tx_pkts++;
+-		priv->conn[conn].stats.aal5_tx_bytes += skb->len;
++		priv->conn[conn].stats.aal5_tx_bytes += len;
+ 		priv->conn[conn].prio_tx_packets[prio]++;
+ 	} else {
+ 		tc_dbg(priv->tc_priv, MSG_TX, "ATM: TX fail\n");
+--- a/dcdp/ptm_tc.c
++++ b/dcdp/ptm_tc.c
+@@ -497,6 +497,7 @@ static int ptm_xmit(struct sk_buff *skb,
+ 	struct ptm_priv *ptm_tc = netdev_priv(dev);
+ 	int qid;
+ 	enum tc_pkt_type type;
++	unsigned int len;
+ 
+ 	if (!showtime_stat(ptm_tc->tc_priv))
+ 		goto PTM_XMIT_DROP;
+@@ -510,11 +511,13 @@ static int ptm_xmit(struct sk_buff *skb,
+ 	type = ptm_tc->tc_priv->tc_mode == TC_PTM_BND_MODE
+ 		? PTM_BOND_PKT : PTM_SL_PKT;
+ 
++	len = skb->len;
++
+ 	if (ptm_tc->tc_priv->tc_ops.send(dev, skb, qid, type) < 0)
+ 		ptm_tc->stats64.tx_dropped++;
+ 	else {
+ 		ptm_tc->stats64.tx_packets++;
+-		ptm_tc->stats64.tx_bytes += skb->len;
++		ptm_tc->stats64.tx_bytes += len;
+ 	}
+ 
+ 	return 0;
+@@ -631,7 +634,7 @@ static int ptm_dev_init(struct tc_priv *
+ 	const char macaddr[ETH_ALEN]
+ 		= {0xAC, 0x9A, 0x96, 0x11, 0x22, 0x33};
+ 
+-	dev = alloc_netdev_mq(sizeof(*ptm_tc), "dsl%d",  NET_NAME_ENUM, ptm_setup, 4);
++	dev = alloc_netdev(sizeof(*ptm_tc), "dsl%d",  NET_NAME_ENUM, ptm_setup);
+ 	if (!dev) {
+ 		tc_dbg(tc_priv, MSG_INIT, "Cannot alloc net device\n");
+ 		return -ENOMEM;
+@@ -2324,7 +2327,11 @@ static void ptm_aca_init(struct ptm_ep_p
+ 	cfg = &priv->tc_priv->cfg;
+ 
+ 	txin = &param.aca_txin;
++#if defined(__LITTLE_ENDIAN)
++	txin->byteswap = 0;
++#else
+ 	txin->byteswap = 1;
++#endif
+ 	txin->hd_size_in_dw = cfg->txin.soc_desc_dwsz;
+ 	txin->pd_desc_base = SB_XBAR_ADDR(__ACA_TX_IN_PD_LIST_BASE);
+ 	txin->pd_desc_num = __ACA_TX_IN_PD_LIST_NUM;
+@@ -2347,7 +2354,11 @@ static void ptm_aca_init(struct ptm_ep_p
+ 		txin->soc_cmlt_cnt_addr);
+ 
+ 	txout = &param.aca_txout;
++#if defined(__LITTLE_ENDIAN)
++	txout->byteswap = 0;
++#else
+ 	txout->byteswap = 1;
++#endif
+ 	txout->hd_size_in_dw = cfg->txout.soc_desc_dwsz;
+ 	if (priv->tc_priv->param.cdma_desc_loc == LOC_IN_FPI)
+ 		txout->pd_desc_base = sb_r32(__TX_OUT_SHADOW_PTR) - phybase;
+@@ -2373,7 +2384,11 @@ static void ptm_aca_init(struct ptm_ep_p
+ 		txout->soc_cmlt_cnt_addr);
+ 
+ 	rxout = &param.aca_rxout;
++#if defined(__LITTLE_ENDIAN)
++	rxout->byteswap = 0;
++#else
+ 	rxout->byteswap = 1;
++#endif
+ 	rxout->hd_size_in_dw = cfg->rxout.soc_desc_dwsz;
+ 	if (priv->tc_priv->param.cdma_desc_loc == LOC_IN_FPI)
+ 		rxout->pd_desc_base = sb_r32(__RX_OUT_SHADOW_PTR) - phybase;
+@@ -2399,7 +2414,11 @@ static void ptm_aca_init(struct ptm_ep_p
+ 		rxout->soc_cmlt_cnt_addr);
+ 
+ 	rxin = &param.aca_rxin;
++#if defined(__LITTLE_ENDIAN)
++	rxin->byteswap = 0;
++#else
+ 	rxin->byteswap = 1;
++#endif
+ 	rxin->hd_size_in_dw = cfg->rxin.soc_desc_dwsz;
+ 	rxin->pd_desc_base = SB_XBAR_ADDR(__RX_IN_PD_DES_LIST_BASE);
+ 	rxin->pd_desc_num = __ACA_RX_IN_PD_LIST_NUM;
+--- a/dcdp/platform/sw_plat.c
++++ b/dcdp/platform/sw_plat.c
+@@ -36,10 +36,13 @@
+ #include <linux/printk.h>
+ #include <linux/etherdevice.h>
+ #include <linux/workqueue.h>
+-#include "inc/dsl_tc.h"
++#include "../inc/dsl_tc.h"
+ 
+ #include "../inc/tc_main.h"
+ #include "../inc/reg_addr.h"
++#include "../inc/tc_common.h"
++
++#include "../inc/fw/vrx518_addr_def.h"
+ 
+ 
+ #define PMAC_SIZE		8
+@@ -70,7 +73,7 @@ enum {
+ #define TXIN_DNUM  	128
+ #define TXOUT_DNUM	128
+ #define RXOUT_DNUM	1024
+-#define RXIN_DNUM	1024
++#define RXIN_DNUM	0
+ 
+ #define TXIN_CHECK_NUM	32
+ 
+@@ -80,22 +83,32 @@ struct aca_ring {
+ 	void *umt_dst;
+ 	u32 umt_phydst;
+ 	u32 dnum;
++	u32 dsize;
+ 	int idx; /* SoC RX/TX index */
+-	int cnt;
+-	void *cnt_addr;
+-	u32 cnt_phyaddr;
+ 	int ep_dev_idx;
+ };
+ 
++struct tx_list_item {
++	size_t len;
++	void *buf;
++	dma_addr_t phyaddr;
++};
++
++struct tx_list {
++	struct tx_list_item *data;
++	u32 dnum;
++};
++
+ struct aca_ring_grp {
+ 	struct aca_ring rxin;
+ 	struct aca_ring txin;
+ 	struct aca_ring rxout;
+ 	struct aca_ring txout;
++	struct tx_list txlist;
+ };
+ 
+-#if 1
+-struct dma_desc {
++#if defined(__LITTLE_ENDIAN)
++struct dma_tx_desc {
+ 	/* DW 0 */
+ 	u32 qid;
+ 	/* DW 1 */
+@@ -112,8 +125,26 @@ struct dma_desc {
+ 	u32 c:1;
+ 	u32 own:1;
+ }__packed;
++
++struct dma_rx_desc {
++	/* DW 0 */
++	u32 qid;
++	/* DW 1 */
++	u32 res2;
++	/* DW 2 */
++	u32 data_len:16;
++	u32 res0:7;
++	u32 byte_off:3;
++	u32 res1:2;
++	u32 eop:1;
++	u32 sop:1;
++	u32 c:1;
++	u32 own:1;
++	/* DW 3 */
++	u32 data_ptr;
++}__packed;
+ #else
+-struct dma_desc {
++struct dma_tx_desc {
+ 	/* DW 0 */
+ 	u32 qid;
+ 	/* DW 1 */
+@@ -131,14 +162,25 @@ struct dma_desc {
+ 	u32 data_len:16;
+ }__packed;
+ 
++struct dma_rx_desc {
++	/* DW 0 */
++	u32 qid;
++	/* DW 1 */
++	u32 res;
++	/* DW 2 */
++	u32 own:1;
++	u32 c:1;
++	u32 sop:1;
++	u32 eop:1;
++	u32 res1:2;
++	u32 byte_off:3;
++	u32 res0:7;
++	u32 data_len:16;
++	/* DW 3 */
++	u32 data_ptr;
++}__packed;
+ #endif
+ 
+-struct plat_dma {
+-	u32 chan; /* CHAN IID */
+-	u32 dma_chan; /* CONTROLLER/PORT/CHAN ID */
+-	u32 ds_dnum; /* DS descriptor number */
+-};
+-
+ struct plat_umt {
+ 	u32 id;
+ 	u32 cbm_id;
+@@ -152,28 +194,28 @@ struct tc_req {
+ 	enum dsl_tc_mode tc_mode;
+ };
+ 
+-#if 0
+-struct tc_coc {
+-	enum ltq_cpufreq_state coc_stat;
+-	struct tasklet_struct coc_task;
++struct mem_map_entry {
++	dma_addr_t phyaddr;
++	void *mem;
++	size_t size;
++	struct hlist_node node;
+ };
+-#endif
+ 
+ struct plat_priv {
+ 	struct tc_priv *tc_priv;
+ 	struct plat_umt umt[EP_MAX_NUM];
+-	struct plat_dma dma[EP_MAX_NUM];
+ 	struct ltq_mei_atm_showtime_info dsl_ops;
+ 	struct tc_req req_work;
+ 	struct aca_ring_grp soc_rings;
+-	/* struct tc_coc coc;*/
++	struct net_device *netdev;
++	DECLARE_HASHTABLE(mem_map, 8);
+ };
+ 
+ static struct plat_priv *g_plat_priv;
+ struct tasklet_struct txout_task;
+ struct tasklet_struct rxout_task;
+ 
+-static void txout_action(struct tc_priv *priv, struct aca_ring *txout);
++static DEFINE_SPINLOCK(tx_spinlock);
+ 
+ void *ppa_callback_get(e_ltq_mei_cb_type type)
+ {
+@@ -259,122 +301,65 @@ static inline struct tc_priv *plat_to_tc
+ 	return g_plat_priv->tc_priv;
+ }
+ 
+-static int32_t plat_rx(struct net_device *rxdev, struct net_device *txdev,
+-	struct sk_buff *skb, int32_t len)
+-{
+-	int32_t err;
+-	struct tc_priv *tc_priv = plat_to_tcpriv();
+-
+-	if (unlikely(!rxdev)) {
+-		if (txdev != NULL)
+-			tc_dbg(tc_priv, MSG_RX,
+-				"Recv undelivered packet from DP lib\n");
+-		else
+-			tc_dbg(tc_priv, MSG_RX, "Recv unknown packet\n");
+-		err = -ENODEV;
+-		goto err1;
+-	}
+-
+-	tc_priv->tc_ops.recv(rxdev, skb);
+-	return 0;
+-
+-err1:
+-	dev_kfree_skb_any(skb);
+-
+-	return err;
+-}
+-
+-#if 0
+-static int32_t plat_get_subifid(struct net_device *dev, struct sk_buff *skb,
+-	void *subif_data, uint8_t dst_mac[MAX_ETH_ALEN],
+-	dp_subif_t *subif, uint32_t flags)
+-{
+-	int qid;
+-	struct tc_priv *priv = plat_to_tcpriv();
+-
+-	qid = priv->tc_ops.get_qid(dev, skb, subif_data, flags);
+-	if (qid < 0)
+-		return qid;
+-	else
+-		subif->subif = qid;
+-
+-	return 0;
+-}
+-#endif
+-
+-#if 0
+-static void plat_coc_tasklet(unsigned long arg)
+-{
+-	/* change state to D0 */
+-	if (g_plat_priv->coc.coc_stat == LTQ_CPUFREQ_PS_D0)
+-		return;
+-
+-	g_plat_priv->coc.coc_stat = LTQ_CPUFREQ_PS_D0;
+-}
+-
+-static void plat_coc_req(void)
+-{
+-	tasklet_schedule(&g_plat_priv->coc.coc_task);
+-}
++static void *plat_mem_alloc(size_t size, enum tc_dir dir, u32 *phyaddr);
++static void *plat_mem_virt(u32 phyaddr);
++static void plat_mem_free(u32 phyaddr, enum tc_dir dir);
+ 
++static void txlist_free(struct tx_list *list);
+ 
+-static int32_t plat_coc_stat(enum ltq_cpufreq_state new_state,
+-	enum ltq_cpufreq_state old_state, uint32_t flags)
++static int txlist_init(struct tx_list *list, u32 dnum)
+ {
+-	struct tc_priv *priv = plat_to_tcpriv();
+-	tc_dbg(priv, MSG_COC,
+-		"COC current state: %d, new state: %d, old state: %d\n",
+-		g_plat_priv->coc.coc_stat, new_state, old_state);
++	struct tx_list_item *item;
++	int i;
+ 
+-	if (g_plat_priv->coc.coc_stat != new_state) {
+-		g_plat_priv->coc.coc_stat = new_state;
++	list->dnum = dnum;
+ 
+-		if (new_state == LTQ_CPUFREQ_PS_D3) {
+-			/* Enable interrupt for DS packet */
+-			priv->tc_ops.irq_on(MBOX_PKT_RX);
+-		} else {
+-			/* Disable interrupt for DS packet */
+-			priv->tc_ops.irq_off(MBOX_PKT_RX);
++	list->data = kcalloc(dnum, sizeof(struct tx_list_item), GFP_KERNEL);
++	if (!list->data) {
++		pr_err("Failed to allocate TX list!\n");
++		goto err;
++	}
++
++	for (i = 0; i < list->dnum; i++) {
++		item = &list->data[i];
++
++		// use plat_mem_alloc as these buffers will be mixed with buffers allocated in ptm_tc.c / atm_tc.c
++		item->buf = plat_mem_alloc(DMA_PACKET_SZ, US_DIR, &item->phyaddr);
++		if (!item->buf) {
++			pr_err("Failed to allocate TX buffer!\n");
++			goto err;
+ 		}
+ 	}
+ 
+ 	return 0;
+-}
+-#endif
+-
+-static inline int ring_dist(int idx1, int idx2, int size)
+-{
+-	if (idx1 >= idx2)
+-		return (idx1 - idx2);
+-	else
+-		return (idx1 + size - idx2);
+-}
+ 
+-static inline int __ring_full(int idx, int cnt, u32 dnum)
+-{
+-	if (ring_dist(idx, cnt, dnum) < dnum - 1)
+-		return 0;
+-	else
+-		return 1;
++err:
++	txlist_free(list);
++	return -1;
+ }
+ 
+-static inline int ring_full(struct aca_ring *ring)
++static void txlist_free(struct tx_list *list)
+ {
+-	if (!__ring_full(ring->idx, ring->cnt, ring->dnum))
+-		return 0;
++	struct tx_list_item *item;
++	int i;
+ 
+-	/* if ring full, update cumulative counter and check again */
+-	ring->cnt = readl(ring->cnt_addr) % ring->dnum;
++	if (list->data) {
++		for (i = 0; i < list->dnum; i++) {
++			item = &list->data[i];
++
++			if (item->buf) {
++				// use plat_mem_free as these buffers are mixed with buffers allocated in ptm_tc.c / atm_tc.c
++				plat_mem_free(item->phyaddr, US_DIR);
++			}
++		}
++	}
+ 
+-	return __ring_full(ring->idx, ring->cnt, ring->dnum);
++	kfree(list->data);
+ }
+ 
+-#define ring_idx_inc(ring, idx)						\
+-	do { ring->idx = (ring->idx + 1) % ring->dnum; } while (0);
+-
+-static inline void ring_cnt_update(struct aca_ring *ring)
++static inline void ring_idx_inc(struct aca_ring *ring)
+ {
+-	ring->cnt = readl(ring->cnt_addr) % ring->dnum;
++	ring->idx = (ring->idx + 1) % ring->dnum;
+ }
+ 
+ static struct sk_buff *txin_skb_prepare(struct sk_buff *skb)
+@@ -399,252 +384,220 @@ static struct sk_buff *txin_skb_prepare(
+ 	return nskb;
+ }
+ 
+-static int ring_mmap(void *mem, int size,
+-	enum dma_data_direction dir, u32 *addr)
+-{
+-	struct device *pdev;
+-	dma_addr_t phy_addr;
+-	struct tc_priv *priv;
+-	u32 addr1;
+-
+-	priv = g_plat_priv->tc_priv;
+-	pdev = priv->ep_dev[0].dev;
+-
+-	phy_addr = dma_map_single(pdev, mem, size, dir);
+-	if (unlikely(dma_mapping_error(pdev, phy_addr))) {
+-		tc_err(priv, MSG_INIT,
+-			"DMA address mapping error: buf: 0x%x, size: %d, dir: %d\n",
+-			(u32)mem, size, dir);
+-		return -ENOMEM;
+-	}
+-	dma_unmap_single(pdev, phy_addr, size, dir);
+-
+-	pr_info("vaddr: 0x%x, phyaddr: 0x%lx\n", (u32)mem, phy_addr);
+-	addr1 = (u32)phy_addr;
+-
+-	if (addr)
+-		*addr = addr1;
+-
+-	return 0;
+-}
+-
+-static void txin_action(struct tc_priv *priv, struct aca_ring *txin,
++static int txin_action(struct tc_priv *priv, struct aca_ring *txin,
+ 		struct sk_buff *skb, int qid, enum tc_pkt_type type)
+ {
+-	struct dma_desc *desc, desc1;
+-	u32 phyaddr, *dst, *src;
+-	int i;
++	struct device *pdev = priv->ep_dev[0].dev;
++	struct aca_ring *txout = &g_plat_priv->soc_rings.txout;
++	struct tx_list *txlist = &g_plat_priv->soc_rings.txlist;
++	struct dma_tx_desc *desc;
++	struct tx_list_item *txlist_item;
++	unsigned long flags;
++
++	if (!g_plat_priv->netdev) {
++		spin_lock_irqsave(&tx_spinlock, flags);
++	}
+ 
+-	if (ring_full(txin)) {
+-		tc_dbg(priv, MSG_TX,
+-			"TXIN Ring Full!: idx: %d, cnt: %d\n",
+-			txin->idx, txin->cnt);
++	if ((txin->idx + 2) % txin->dnum == txout->idx) {
++		if (g_plat_priv->netdev) {
++			netif_stop_queue(g_plat_priv->netdev);
++		}
++	} else if ((txin->idx + 1) % txin->dnum == txout->idx) {
++		tc_err(priv, MSG_TX, "TXIN ring full: txin: %d, txout: %d\n",
++			txin->idx, txout->idx);
+ 		goto err1;
+ 	}
+ 
++	desc = (struct dma_tx_desc *)txin->dbase_mem;
++	desc += txin->idx;
++
++	txlist_item = &txlist->data[txin->idx];
++
+ 	skb = txin_skb_prepare(skb);
+ 	if (!skb)
+-		return;
++		goto err2;
+ 
+-	if (ring_mmap(skb->data, skb->len, DMA_TO_DEVICE, &phyaddr) < 0) {
+-		tc_err(priv, MSG_TX, "TXIN data mmap failed: 0x%x\n",
+-			(unsigned int)skb->data);
+-		goto err1;
+-	}
++	/*
++	 * Copy the data to a buffer in the driver. This is necessary because there doesn't seem to be a timely signal
++	 * from the device when it has consumed a buffer, which would allow to safely free it. The data_ptr is only
++	 * returned in TXOUT after another fixed number of packets (depending on the size of internal buffers) has been
++	 * transmitted, which may not happen in the near future. Making a copy allows to free the SKB here.
++	 */
++	memcpy(txlist_item->buf, skb->data, skb->len);
+ 
+-	/* init a new descriptor for the new skb */
+-	desc = (struct dma_desc *)txin->dbase_mem;
+-	desc += txin->idx;
++	dma_sync_single_range_for_device(pdev, txlist_item->phyaddr, 0, skb->len, DMA_TO_DEVICE);
+ 
+-	memset(desc, 0, sizeof(*desc));
+-	memset(&desc1, 0, sizeof(desc1));
+-	desc1.own = 1;
+-	desc1.c = 1;
+-	desc1.sop = 1;
+-	desc1.eop = 1;
+-	desc1.byte_off = phyaddr & 0x7;
+-	desc1.data_len = skb->len;
+-
+-	desc1.data_ptr = phyaddr & (~(0x7));
+-	desc1.qid = qid;
+-
+-	dst = (u32 *)desc;
+-	src = (u32 *)&desc1;
+-	for (i = 0; i < DW_SZ(desc1); i++)
+-		dst[i] = cpu_to_be32(src[i]);
+-
+-	pr_info("txin idx: %d\n", txin->idx);
+-	pr_info("descriptor dst val:(DW0-DW3): 0x%x, 0x%x, 0x%x, 0x%x\n",
+-		dst[0], dst[1], dst[2], dst[3]);
+-	pr_info("descriptor src val: (DW0-DW3): 0x%x, 0x%x, 0x%x, 0x%x\n",
+-		src[0], src[1], src[2], src[3]);
+-
+-	if (ring_mmap(desc, sizeof(*desc), DMA_TO_DEVICE, NULL) < 0) {
+-		tc_err(priv, MSG_TX, "TXIN descriptor mmap failed: 0x%x\n",
+-			(unsigned int)desc);
++	// this should never happen, the buffers are already aligned by kmalloc
++	if (WARN_ON((txlist_item->phyaddr & 0x7) != 0))
+ 		goto err1;
++
++	if (g_plat_priv->netdev) {
++		netdev_sent_queue(g_plat_priv->netdev, skb->len);
+ 	}
++	txlist_item->len = skb->len;
++
++	memset(desc, 0, sizeof(*desc));
+ 
+-	ring_idx_inc(txin, idx);
++	desc->data_ptr = txlist_item->phyaddr;
++	desc->byte_off = 0;
++	desc->data_len = skb->len;
++	desc->qid = qid;
++
++	desc->sop = 1;
++	desc->eop = 1;
++	desc->c = 0;
++	desc->own = 1;
++
++	dev_consume_skb_any(skb);
++
++	ring_idx_inc(txin);
+ 
+ 	/* update TXIN UMT by 1 */
+ 	writel(1, txin->umt_dst);
+-	pr_info("TXIN send txin packet 1 packet\n");
+ 
+-	/* Free skb */
+-	dev_kfree_skb_any(skb);
++	if (!g_plat_priv->netdev) {
++		spin_unlock_irqrestore(&tx_spinlock, flags);
++	}
+ 
+-	/* check txout for testing*/
+-	//txout_action(plat_to_tcpriv(), &g_plat_priv->soc_rings.txout);
+-	return;
++	return 0;
+ 
+ err1:
+-	//skb->delay_free = 0;
+ 	dev_kfree_skb_any(skb);
++
++err2:
++	if (!g_plat_priv->netdev) {
++		spin_unlock_irqrestore(&tx_spinlock, flags);
++	}
++
++	return -1;
+ }
+ 
+ static void txout_action(struct tc_priv *priv, struct aca_ring *txout)
+ {
+-	int i, cnt;
+-	struct dma_desc *desc;
+-	u32 ptr;
+-	void *mem;
+-
+-	ring_cnt_update(txout);
+-	cnt = ring_dist(txout->idx, txout->cnt, txout->dnum);
++	struct aca_ring *txin = &g_plat_priv->soc_rings.txin;
++	struct tx_list *txlist = &g_plat_priv->soc_rings.txlist;
++	struct tx_list_item *txlist_item;
++	int i, cnt, bytes;
++	u32 *desc;
++	unsigned long flags;
++
++	cnt = 0;
++	bytes = 0;
++
++	if (g_plat_priv->netdev) {
++		netif_tx_lock(g_plat_priv->netdev);
++	} else {
++		spin_lock_irqsave(&tx_spinlock, flags);
++	}
+ 
+-	for (i = 0; i < cnt; i++) {
++	for (i = 0; i < txout->dnum; i++) {
+ 		desc = txout->dbase_mem;
+ 		desc += txout->idx;
+-		/* read from memory */
+-		if (ring_mmap(desc, sizeof(*desc), DMA_FROM_DEVICE, NULL) < 0) {
+-			tc_err(priv, MSG_TX,
+-				"map TXOUT DMA descriptor failed\n");
+-			continue;
++
++		// *desc seems to be a pointer to a QoSQ buffer or the data_ptr of some previously sent packet
++		if (*desc == 0) {
++			break;
+ 		}
+-		ptr = desc->data_ptr + desc->byte_off;
+-		mem = (void * __force)__va(ptr);
+-		kfree(mem);
+-		ring_idx_inc(txout, idx);
+-	}
+ 
+-	if (cnt)
+-		writel(cnt, txout->umt_dst);
+-	pr_info("TXOUT received %d descriptors\n", cnt);
+-}
++		if (txout->idx == txin->idx) {
++			tc_err(priv, MSG_TX, "TXOUT unexpected non-zero descriptor: txin: %d, txout: %d\n",
++				txin->idx, txout->idx);
++			break;
++		}
+ 
+-static void rxin_action(struct tc_priv *priv,
+-		struct aca_ring *rxin, int size, int cnt)
+-{
+-	int i, dist;
+-	struct dma_desc *desc;
+-	void *data_ptr;
+-	u32 phyaddr;
+-
+-	if (ring_full(rxin)) {
+-		tc_dbg(priv, MSG_RX,
+-			"RXIN Ring Full!: idx: %d, cnt: %d\n",
+-			rxin->idx, rxin->cnt);
+-		return;
+-	}
++		txlist_item = &txlist->data[txout->idx];
+ 
+-	dist = ring_dist(rxin->idx, rxin->cnt, rxin->dnum);
+-	if (cnt > dist) {
+-		WARN_ONCE(1, "RXIN NO enough room for free buffers: free: %d, room: %d\n",
+-			cnt, dist);
+-		cnt = dist;
++		cnt++;
++		bytes += txlist_item->len;
++
++		/*
++		 * Reuse the returned buffer. The previous buffer should still be referenced by another descriptor.
++		 * When the driver is unloaded, all buffers in the txlist as well as those referenced by the
++		 * descriptors managed in ptm_tc.c or atm_tc.c will be freed.
++		 */
++		txlist_item->buf = plat_mem_virt(*desc);
++		txlist_item->phyaddr = *desc;
++
++		*desc = 0;
++
++		ring_idx_inc(txout);
+ 	}
+ 
+-	for (i = 0; i < cnt; i++) {
+-		data_ptr = kmalloc(size, GFP_ATOMIC);
+-		if (!data_ptr) {
+-			tc_err(priv, MSG_RX,
+-				"RXIN kmalloc data buffer failed: %d\n", size);
+-			goto err1;
+-		}
++	if (cnt) {
++		writel(cnt, txout->umt_dst+0x28); // TXOUT_HD_ACCUM_SUB instead of TXOUT_HD_ACCUM_ADD
+ 
+-		if (ring_mmap(data_ptr, size, DMA_FROM_DEVICE, &phyaddr) < 0) {
+-			tc_err(priv, MSG_RX,
+-				"RXIN kmalloc data buffer failed: %d\n", size);
+-			goto err2;
++		if (g_plat_priv->netdev) {
++			netdev_completed_queue(g_plat_priv->netdev, cnt, bytes);
+ 		}
++	}
+ 
+-		desc = (struct dma_desc *)rxin->dbase_mem;
+-		desc += rxin->idx;
+-		memset(desc, 0, sizeof(*desc));
+-
+-		desc->data_len = size;
+-		desc->byte_off = phyaddr & 0x7;
+-		desc->eop = 1;
+-		desc->sop = 1;
+-		desc->own = 1;
+-
+-		desc->data_ptr = phyaddr;
+-
+-		
+-		if (ring_mmap(desc, sizeof(*desc), DMA_TO_DEVICE, NULL) < 0) {
+-			tc_err(priv, MSG_RX, "RXIN descriptor mmap failed: 0x%x\n",
+-				(unsigned int)desc);
+-			goto err2;
+-		}
+-		
+-		ring_idx_inc(rxin, idx);
++	if (g_plat_priv->netdev) {
++		netif_tx_unlock(g_plat_priv->netdev);
++	} else {
++		spin_unlock_irqrestore(&tx_spinlock, flags);
+ 	}
+ 
+-	/* update RXIN UMT*/
+-	writel(i, rxin->umt_dst);
+-	pr_info("rxin refill %d descriptors\n", i);
+-	return;
++	if (cnt && g_plat_priv->netdev && netif_queue_stopped(g_plat_priv->netdev)) {
++		netif_wake_queue(g_plat_priv->netdev);
++	}
++}
+ 
+-err2:
+-	kfree(data_ptr);
+-err1:
+-	if (i)
+-		writel(i, rxin->umt_dst);
+-	return;
++static void rxin_action(struct tc_priv *priv,
++		struct aca_ring *rxin, int size, int cnt)
++{
++	/* update RXIN UMT*/
++	writel(cnt, rxin->umt_dst);
+ }
+ 
+ static int rxout_action(struct tc_priv *priv, struct aca_ring *rxout)
+ {
++	struct device *pdev = priv->ep_dev[0].dev;
+ 	int i, cnt;
+-	struct dma_desc *desc;
+-	u32 ptr;
+-	void *mem;
++	struct dma_rx_desc *desc;
++	dma_addr_t phyaddr;
++	void *ptr, *dst;
++	size_t len;
+ 	struct sk_buff *skb;
+ 
+-	ring_cnt_update(rxout);
+-	cnt = ring_dist(rxout->idx, rxout->cnt, rxout->dnum);
+-
+-	for (i = 0; i < cnt; i++) {
++	cnt = 0;
++	for (i = 0; i < rxout->dnum; i++) {
+ 		desc = rxout->dbase_mem;
+ 		desc += rxout->idx;
+ 
+-		/* read from memory */
+-		if (ring_mmap(desc, sizeof(*desc), DMA_FROM_DEVICE, NULL) < 0) {
+-			tc_err(priv, MSG_RX,
+-				"map RXOUT DMA descriptor failed\n");
+-			continue;
++		if (!desc->own) {
++			break;
+ 		}
+-		ptr = desc->data_ptr + desc->byte_off;
+-		mem = __va(ptr);
+-		skb = build_skb(mem, 0);
+-		if (!skb) {
+-			tc_err(priv, MSG_RX,
+-				"RXOUT build skb failed\n");
+-			kfree(mem);
+-			continue;
++
++		// this seems to be a pointer to a DS PKT buffer
++		phyaddr = desc->data_ptr + desc->byte_off;
++		ptr = plat_mem_virt(phyaddr);
++
++		len = desc->data_len;
++
++		dma_sync_single_range_for_cpu(pdev, phyaddr, 0, len, DMA_FROM_DEVICE);
++
++		skb = netdev_alloc_skb(g_plat_priv->netdev, len);
++		if (unlikely(!skb)) {
++			tc_err(priv, MSG_RX, "RXOUT SKB allocation failed\n");
++			break;
+ 		}
+-		priv->tc_ops.recv(NULL, skb);
+-		ring_idx_inc(rxout, idx);
++
++		dst = skb_put(skb, len);
++		memcpy(dst, ptr, len);
++
++		priv->tc_ops.recv(g_plat_priv->netdev, skb);
++
++		desc->own = 0;
++
++		cnt++;
++		ring_idx_inc(rxout);
+ 	}
+ 
+ 	if (!cnt)
+-		tc_err(priv, MSG_RX, "RXOUT dummy interrupt: dbase: 0x%x, idx: %d, cnt: %d\n",
+-			(unsigned int)rxout->dbase_mem, rxout->idx, rxout->cnt);
++		tc_err(priv, MSG_RX, "RXOUT spurious interrupt\n");
+ 	else
+-		writel(cnt, rxout->umt_dst);
++		writel(cnt, rxout->umt_dst+0x28); // RXOUT_HD_ACCUM_SUB instead of RXOUT_HD_ACCUM_ADD
+ 
+-	pr_info("txout received %d packets\n", cnt);
+ 	return cnt;
+ }
+ 
+@@ -669,7 +622,6 @@ static void plat_rxout_tasklet(unsigned
+ 	struct aca_ring *rxin = &priv->soc_rings.rxin;
+ 	struct dc_ep_dev *ep_dev = &tcpriv->ep_dev[rxout->ep_dev_idx];
+ 	int cnt;
+-	
+ 
+ 	cnt = rxout_action(tcpriv, rxout);
+ 	if (cnt)
+@@ -687,68 +639,144 @@ static int plat_send(struct net_device *
+ {
+ 	struct plat_priv *priv = g_plat_priv;
+ 	struct aca_ring *txin = &priv->soc_rings.txin;
++	int res;
+ 
+-	txin_action(priv->tc_priv, txin, skb, qid, type);
++	res = txin_action(priv->tc_priv, txin, skb, qid, type);
+ 
+-	return 0;
++	return res;
++}
++
++static void plat_mem_init(void)
++{
++	struct plat_priv *priv = g_plat_priv;
++
++	hash_init(priv->mem_map);
+ }
+ 
+ /* return virtual address */
+-static void *plat_mem_alloc(size_t size, enum tc_dir dir)
++static void *plat_mem_alloc(size_t size, enum tc_dir dir, u32 *phyaddr)
+ {
+-	return kmalloc(size, GFP_KERNEL);
++	struct plat_priv *priv = g_plat_priv;
++	struct tc_priv *tcpriv = priv->tc_priv;
++	struct device *pdev = tcpriv->ep_dev[0].dev;
++	enum dma_data_direction dma_dir;
++	struct mem_map_entry *entry;
++
++	entry = kzalloc(sizeof(struct mem_map_entry), GFP_KERNEL);
++	if (!entry)
++		goto err;
++
++	entry->size = size;
++
++	entry->mem = kmalloc(size, GFP_KERNEL);
++	if (!entry->mem)
++		goto err_alloc;
++
++	dma_dir = (dir == DS_DIR) ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
++
++	entry->phyaddr = dma_map_single(pdev, entry->mem, entry->size, dma_dir);
++	if (unlikely(dma_mapping_error(pdev, entry->phyaddr))) {
++		tc_err(priv, MSG_INIT,
++			"plat_mem_alloc: DMA mapping error: buf: 0x%x, size: %d, dir: %d\n",
++			(u32)entry->mem, size, dir);
++
++		goto err_map;
++	}
++
++	hash_add(g_plat_priv->mem_map, &entry->node, entry->phyaddr);
++
++	*phyaddr = entry->phyaddr;
++	return entry->mem;
++
++err_map:
++	kfree(entry->mem);
++
++err_alloc:
++	kfree(entry);
++
++err:
++	return NULL;
+ }
+ 
+-static void plat_mem_free(u32 phy_addr, enum tc_dir dir)
++static void *plat_mem_virt(u32 phyaddr)
+ {
+-	void *mem;
++	struct mem_map_entry *entry;
++
++	hash_for_each_possible(g_plat_priv->mem_map, entry, node, phyaddr)
++		if (entry->phyaddr == phyaddr)
++			return entry->mem;
++
++	WARN_ON(1);
++	return NULL;
++}
++
++static struct mem_map_entry *plat_mem_entry(u32 phyaddr)
++{
++	struct mem_map_entry *entry;
++
++	hash_for_each_possible(g_plat_priv->mem_map, entry, node, phyaddr)
++		if (entry->phyaddr == phyaddr)
++			return entry;
+ 
+-	mem = (void * __force)__va(phy_addr);
+-	kfree(mem);
++	return NULL;
+ }
+ 
+-static void aca_soc_ring_init(struct tc_priv *priv,
+-			struct aca_ring *ring, u32 dnum, u32 dsize)
++static void plat_mem_free(u32 phyaddr, enum tc_dir dir)
+ {
++	struct tc_priv *priv = g_plat_priv->tc_priv;
++	struct device *pdev = priv->ep_dev[0].dev;
++	enum dma_data_direction dma_dir;
++	struct mem_map_entry *entry;
++
++	entry = plat_mem_entry(phyaddr);
++	if (WARN_ON(!entry))
++		return;
++
++	hash_del(&entry->node);
++
++	dma_dir = (dir == DS_DIR) ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
++	dma_unmap_single(pdev, entry->phyaddr, entry->size, dma_dir);
++
++	kfree(entry->mem);
++
++	kfree(entry);
++}
++
++static int ring_init(struct tc_priv *priv, struct aca_ring *ring, u32 dnum, u32 dsize)
++{
++	struct device *pdev = priv->ep_dev[0].dev;
+ 	int size;
+-	struct device *pdev;
+ 
+ 	memset(ring, 0, sizeof(*ring));
+ 	ring->dnum = dnum;
++	ring->dsize = dsize;
++
++	if (ring->dnum == 0) {
++		return 0;
++	}
++
+ 	size = dsize * dnum;
+-	pdev = priv->ep_dev[0].dev;
+ 
+-	ring->dbase_mem = kmalloc(size, GFP_KERNEL);
++	ring->dbase_mem = dma_alloc_coherent(pdev, size, &(ring->dbase_phymem), GFP_KERNEL);
+ 	if (!ring->dbase_mem) {
+-		tc_err(priv, MSG_INIT, "Allocate SoC Ring fail: %d\n", dnum);
+-		return;
++		tc_err(priv, MSG_INIT, "Ring allocation failed: %d\n", dnum);
++		return -1;
+ 	}
+ 
+-	ring_mmap(ring->dbase_mem, size, DMA_FROM_DEVICE, &(ring->dbase_phymem));
+-	tc_dbg(priv, MSG_INIT, "ring: membase: 0x%x, phybase: 0x%x, dnum: %d\n",
+-		(u32)ring->dbase_mem, ring->dbase_phymem, ring->dnum);
+-
+-	size = sizeof(u32);
+-	ring->cnt_addr = kzalloc(size, GFP_KERNEL);
+-	if (!ring->cnt_addr) {
+-		tc_err(priv, MSG_INIT, "Allocate cumulative counter fail!\n");
+-		return;
+-	}
++	return 0;
++}
+ 
+-	ring_mmap(ring->cnt_addr, size, DMA_TO_DEVICE, &(ring->cnt_phyaddr));
+-	tc_dbg(priv, MSG_INIT, "ring: cumulative cnt addr: 0x%x, phy address: 0x%x\n",
+-		(u32)ring->cnt_addr, ring->cnt_phyaddr);
++#define ring_dnum(tcpriv, name1, name2) ((!tcpriv->param.name1##_dnum) ? name2##_DNUM : tcpriv->param.name1##_dnum)
+ 
+-	return;
+-}
++static void ring_free(struct tc_priv *priv, struct aca_ring *ring)
++{
++	struct device *pdev = priv->ep_dev[0].dev;
+ 
+-#define ring_init(tcpriv, ring, name1, name2, num, size)	\
+-{								\
+-	if (!tcpriv->param.name1##_dnum)			\
+-		num = name2##_DNUM;				\
+-	else							\
+-		num = tcpriv->param.name1##_dnum;		\
+-	aca_soc_ring_init(tcpriv, ring, num, size);		\
++	if (ring->dnum == 0) {
++		return;
++	}
++
++	dma_free_coherent(pdev, ring->dsize * ring->dnum, ring->dbase_mem, ring->dbase_phymem);
+ }
+ 
+ static irqreturn_t aca_rx_irq_handler(int irq, void *dev_id)
+@@ -777,39 +805,55 @@ static irqreturn_t aca_tx_irq_handler(in
+ 	return IRQ_HANDLED;
+ }
+ 
+-static void irq_init(struct tc_priv *priv, const char *dev_name)
++static void plat_irq_init(struct tc_priv *priv, const char *dev_name)
+ {
+ 	int ret;
+ 	int i;
+-	char name[IFNAMSIZ];
++	//char name[IFNAMSIZ];
+ 
+ 	for (i = 0; i < EP_MAX_NUM && i < priv->ep_num; i++) {
+-		sprintf(name, "%s%d", dev_name, i);
++		//snprintf(name, sizeof(name), "aca-rxo%d", i);
+ 
+ 		ret = devm_request_irq(priv->ep_dev[i].dev, priv->ep_dev[i].aca_rx_irq,
+-				aca_rx_irq_handler, 0, name, &priv->ep_dev[i]);
++				aca_rx_irq_handler, 0, "aca-rxo", &priv->ep_dev[i]);
+ 
+ 		if (ret) {
+ 			tc_err(priv, MSG_INIT,
+ 				"ACA RX IRQ request Fail!: irq: %d, ep_id: %d\n",
+ 				priv->ep_dev[i].aca_rx_irq, i);
+ 			//return;
+-		} 
++		}
++
++		//snprintf(name, sizeof(name), "aca-txo%d", i);
+ 
+ 		ret = devm_request_irq(priv->ep_dev[i].dev, priv->ep_dev[i].aca_tx_irq,
+-				aca_tx_irq_handler, 0, name, &priv->ep_dev[i]);
++				aca_tx_irq_handler, 0, "aca-txo", &priv->ep_dev[i]);
+ 
+ 		if (ret) {
+ 			tc_err(priv, MSG_INIT,
+ 				"ACA TX IRQ request Fail!: irq: %d, ep_id: %d\n",
+ 				priv->ep_dev[i].aca_tx_irq, i);
+ 			//return;
+-		} 
++		}
+ 	}
+ 
+ 	return;
+ }
+ 
++static void plat_irq_free(struct tc_priv *priv)
++{
++	int i;
++
++	for (i = 0; i < EP_MAX_NUM && i < priv->ep_num; i++) {
++
++		/* Unregister RX irq handler */
++		devm_free_irq(priv->ep_dev[i].dev, priv->ep_dev[i].aca_rx_irq, &priv->ep_dev[i]);
++
++		/* Unregister TX irq handler */
++		devm_free_irq(priv->ep_dev[i].dev, priv->ep_dev[i].aca_tx_irq, &priv->ep_dev[i]);
++	}
++}
++
+ /**
+  * Decide txin/rxout queue size
+  * Create a tx/rx queue
+@@ -819,29 +863,68 @@ static int plat_dp_init(struct plat_priv
+ 	struct tc_priv *tcpriv;
+ 	struct aca_ring_grp *soc_rings;
+ 	struct aca_ring *ring;
+-	int size;
+ 	u32 dnum;
++	int i;
++	int ret = 0;
+ 
+ 	tcpriv = priv->tc_priv;
+ 
+-	size = sizeof(struct dma_desc);
++	plat_mem_init();
++
+ 	soc_rings = &priv->soc_rings;
+ 
+ 	/* txin ring */
+ 	ring = &soc_rings->txin;
+-	ring_init(tcpriv, ring, txin, TXIN, dnum, size);
++	dnum = ring_dnum(tcpriv, txin, TXIN);
++	ret = txlist_init(&soc_rings->txlist, dnum);
++	if (ret < 0)
++		goto err5;
++	ret = ring_init(tcpriv, ring, dnum, sizeof(struct dma_tx_desc));
++	if (ret < 0)
++		goto err4;
+ 
+ 	/* txout ring */
+ 	ring = &soc_rings->txout;
+-	ring_init(tcpriv, ring, txout, TXOUT, dnum, size);
++	dnum = ring_dnum(tcpriv, txout, TXOUT);
++	ret = ring_init(tcpriv, ring, dnum, sizeof(u32));
++	if (ret < 0)
++		goto err3;
++
+ 	/* rxin ring */
+ 	ring = &soc_rings->rxin;
+-	ring_init(tcpriv, ring, rxin, RXIN, dnum, size);
++	dnum = ring_dnum(tcpriv, rxin, RXIN);
++	ret |= ring_init(tcpriv, ring, dnum, sizeof(struct dma_rx_desc));
++	if (ret < 0)
++		goto err2;
++
+ 	/* rxout ring */
+ 	ring = &soc_rings->rxout;
+-	ring_init(tcpriv, ring, rxout, RXOUT, dnum, size);
++	dnum = ring_dnum(tcpriv, rxout, RXOUT);
++	ret = ring_init(tcpriv, ring, dnum, sizeof(struct dma_rx_desc));
++	if (ret < 0)
++		goto err1;
++
++	for (i = 0; i < EP_MAX_NUM && i < tcpriv->ep_num; i++) {
++
++ 		/* Enable RX interrupt */
++ 		tcpriv->ep_dev[i].hw_ops->icu_en(&tcpriv->ep_dev[i], ACA_HOSTIF_RX);
++
++ 		/* Enable TX interrupt */
++ 		tcpriv->ep_dev[i].hw_ops->icu_en(&tcpriv->ep_dev[i], ACA_HOSTIF_TX);
++ 	}
+ 
+ 	return 0;
++
++err1:
++	ring_free(tcpriv, &soc_rings->rxin);
++err2:
++	ring_free(tcpriv, &soc_rings->txout);
++err3:
++	ring_free(tcpriv, &soc_rings->txin);
++err4:
++	txlist_free(&soc_rings->txlist);
++err5:
++	return ret;
+ }
+ 
+ /**
+@@ -850,6 +933,26 @@ static int plat_dp_init(struct plat_priv
+  */
+ static void plat_dp_exit(struct plat_priv *priv)
+ {
++	struct tc_priv *tcpriv = priv->tc_priv;
++	struct aca_ring_grp *soc_rings = &priv->soc_rings;
++	int i;
++
++	for (i = 0; i < EP_MAX_NUM && i < tcpriv->ep_num; i++) {
++
++		/* Disable RX interrupt */
++		tcpriv->ep_dev[i].hw_ops->icu_mask(&tcpriv->ep_dev[i], ACA_HOSTIF_RX);
++
++		/* Disable TX interrupt */
++		tcpriv->ep_dev[i].hw_ops->icu_mask(&tcpriv->ep_dev[i], ACA_HOSTIF_TX);
++	}
++
++	ring_free(tcpriv, &soc_rings->txin);
++	ring_free(tcpriv, &soc_rings->txout);
++	ring_free(tcpriv, &soc_rings->rxin);
++	ring_free(tcpriv, &soc_rings->rxout);
++
++	txlist_free(&soc_rings->txlist);
++
+ 	return;
+ }
+ 
+@@ -858,45 +961,45 @@ static int plat_soc_cfg_get(struct soc_c
+ 	struct plat_priv *priv = g_plat_priv;
+ 
+ 	/* TXIN */
+-	cfg->txin_dbase = priv->soc_rings.txin.dbase_phymem;
+-	cfg->txin_dnum = priv->soc_rings.txin.dnum;
+-	cfg->txin_desc_dwsz = DW_SZ(struct dma_desc);
+-	cfg->txin_cnt_phyaddr = priv->soc_rings.txin.cnt_phyaddr;
++	cfg->txin.soc_phydbase = priv->soc_rings.txin.dbase_phymem;
++	cfg->txin.soc_dnum = priv->soc_rings.txin.dnum;
++	cfg->txin.soc_desc_dwsz = DW_SZ(struct dma_tx_desc);
+ 	/* TXOUT */
+-	cfg->txout_dbase = priv->soc_rings.txout.dbase_phymem;
+-	cfg->txout_dnum = priv->soc_rings.txout.dnum;
+-	cfg->txout_desc_dwsz = DW_SZ(struct dma_desc);
+-	cfg->txout_cnt_phyaddr = priv->soc_rings.txout.cnt_phyaddr;
++	cfg->txout.soc_phydbase = priv->soc_rings.txout.dbase_phymem;
++	cfg->txout.soc_dnum = priv->soc_rings.txout.dnum;
++	cfg->txout.soc_desc_dwsz = DW_SZ(u32);
+ 	/* RXOUT */
+-	cfg->rxout_dbase = priv->soc_rings.rxout.dbase_phymem;
+-	cfg->rxout_dnum = priv->soc_rings.rxout.dnum;
+-	cfg->rxout_desc_dwsz = DW_SZ(struct dma_desc);
+-	cfg->rxout_cnt_phyaddr = priv->soc_rings.rxout.cnt_phyaddr;
++	cfg->rxout.soc_phydbase = priv->soc_rings.rxout.dbase_phymem;
++	cfg->rxout.soc_dnum = priv->soc_rings.rxout.dnum;
++	cfg->rxout.soc_desc_dwsz = DW_SZ(struct dma_rx_desc);
+ 	/* RXIN */
+-	cfg->rxin_dbase = priv->soc_rings.rxin.dbase_phymem;
+-	cfg->rxin_dnum = priv->soc_rings.rxin.dnum;
+-	cfg->rxin_desc_dwsz = DW_SZ(struct dma_desc);
+-	cfg->rxin_cnt_phyaddr = priv->soc_rings.rxin.cnt_phyaddr;
++	cfg->rxin.soc_phydbase = priv->soc_rings.rxin.dbase_phymem;
++	cfg->rxin.soc_dnum = priv->soc_rings.rxin.dnum;
++	cfg->rxin.soc_desc_dwsz = DW_SZ(struct dma_rx_desc);
+ 
+ 	tc_info(priv->tc_priv, MSG_INIT,
+ 		"id: %d, txin(0x%x: %d, 0x%x), txout(0x%x: %d, 0x%x), rxin(0x%x: %d, 0x%x), rxout(0x%x: %d, 0x%x)\n",
+-		id, cfg->txin_dbase, cfg->txin_dnum, cfg->txin_cnt_phyaddr,
+-		cfg->txout_dbase, cfg->txout_dnum, cfg->txout_cnt_phyaddr,
+-		cfg->rxin_dbase, cfg->rxout_dnum, cfg->rxin_cnt_phyaddr,
+-		cfg->rxout_dbase, cfg->rxout_dnum, cfg->rxout_cnt_phyaddr);
++		id, cfg->txin.soc_phydbase, cfg->txin.soc_dnum, cfg->txin.soc_cnt_phyaddr,
++		cfg->txout.soc_phydbase, cfg->txout.soc_dnum, cfg->txout.soc_cnt_phyaddr,
++		cfg->rxin.soc_phydbase, cfg->rxin.soc_dnum, cfg->rxin.soc_cnt_phyaddr,
++		cfg->rxout.soc_phydbase, cfg->rxout.soc_dnum, cfg->rxout.soc_cnt_phyaddr);
+ 
+ 	return 0;
+ }
+ 
+-static int plat_open(struct net_device *pdev, char *dev_name,
+-		int *subif, int flag)
++static int plat_open(struct net_device *pdev, const char *dev_name,
++		int id, int flag)
+ {
++	g_plat_priv->netdev = pdev;
++
+ 	return 0;
+ }
+ 
+-static void plat_close(struct net_device *pdev, char *dev_name,
+-		int subif, int flag)
++static void plat_close(struct net_device *pdev, const char *dev_name,
++		int flag)
+ {
++	g_plat_priv->netdev = NULL;
++
+ 	return;
+ }
+ 
+@@ -971,7 +1074,6 @@ static void plat_disable_us(int en)
+ static int plat_get_mib(struct net_device *pdev,
+ 			struct rtnl_link_stats64 *stat)
+ {
+-	pr_info("%s is not supported\n", __func__);
+ 	return -ENOTSUPP;
+ }
+ 
+@@ -1181,8 +1283,8 @@ int platform_init(struct tc_priv *tc_pri
+ 	INIT_WORK(&priv->req_work.work, plat_tc_req_workqueue);
+ 	tasklet_init(&txout_task, plat_txout_tasklet, 0);
+ 	tasklet_init(&rxout_task, plat_rxout_tasklet, 0);
+-	irq_init(tc_priv, drv_name);
+-	//tasklet_init(&priv->coc.coc_task, plat_coc_tasklet, 0);
++	plat_irq_init(tc_priv, drv_name);
++
+ 	plat_tc_ops_setup(tc_priv);
+ 	plat_dsl_ops_setup();
+ 
+@@ -1201,8 +1303,15 @@ void platform_dsl_exit(void)
+ 
+ void platform_exit(void)
+ {
+-	//tasklet_kill(&g_plat_priv->coc.coc_task);
++	struct tc_priv *tcpriv = plat_to_tcpriv();
++
++	tasklet_kill(&txout_task);
++	tasklet_kill(&rxout_task);
++
++	plat_irq_free(tcpriv);
++
+ 	plat_dp_exit(g_plat_priv);
++
+ 	g_plat_priv = NULL;
+ }
+ 
diff --git a/package/kernel/lantiq/vrx518_tc/patches/201-desc-length.patch b/package/kernel/lantiq/vrx518_tc/patches/201-desc-length.patch
new file mode 100644
index 00000000000000..8b30914df9647c
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_tc/patches/201-desc-length.patch
@@ -0,0 +1,342 @@
+Port FEATURE_CONF_DESC_LENGTH from the grx500 variant of the driver.
+This also reduces the default length of some descriptors, resulting in
+significantly lower latencies when the line is saturated.
+
+--- a/dcdp/inc/tc_common.h
++++ b/dcdp/inc/tc_common.h
+@@ -27,7 +27,11 @@
+ #define UMT_DEF_PERIOD		400	/* microseconds */
+ 
+ #define MAX_MTU			(DMA_PACKET_SZ - ETH_HLEN - HD_RSRV_SZ)
++#ifdef FEATURE_CONF_DESC_LENGTH
++#define QOSQ_NUM		8
++#else
+ #define QOSQ_NUM		2
++#endif
+ #define FW_STOP_TIMEOUT		20	/* millisecond */
+ #define QOS_DISPATCH_OWN	0
+ #define ACA_TXIN_POLL_INTVAL	10	/* millisecond */
+--- a/dcdp/inc/tc_main.h
++++ b/dcdp/inc/tc_main.h
+@@ -30,6 +30,7 @@
+ #define TCPRIV_ALIGN	32
+ #define DMA_PACKET_SZ	2048
+ 
++#define FEATURE_CONF_DESC_LENGTH 1
+ #define FEATURE_POWER_DOWN 1
+ 
+ enum {
+@@ -157,6 +158,25 @@ struct tc_param {
+ 	unsigned int txout_dnum;
+ 	unsigned int rxin_dnum;
+ 	unsigned int rxout_dnum;
++
++#ifdef FEATURE_CONF_DESC_LENGTH
++	/* __US_FAST_PATH_DES_LIST_NUM:64
++	 * __ACA_TX_IN_PD_LIST_NUM
++	 * __ACA_TX_OUT_PD_LIST_NUM
++	 * */
++	u32 conf_us_fp_desq_len;
++	/*
++	 * Number of queue per QoS queue: QOS_DES_NUM / QOSQ_NUM
++	 * */
++	u32 conf_us_qos_queue_len;
++	/* __US_OUTQ0_DES_LIST_NUM: 32
++	 * __US_OUTQ1_DES_LIST_NUM: 32
++	 * OUTQ_DESC_PER_Q
++	 * */
++	u32 conf_us_outq_len;
++	/**/
++	u32 conf_us_local_q0_desq_len;
++#endif
+ };
+ 
+ struct cdma {
+--- a/dcdp/ptm_tc.c
++++ b/dcdp/ptm_tc.c
+@@ -75,7 +75,11 @@ static const u32 tx_kvec[] = {
+ 	0x30B1B233, 0xB43536B7, 0xB8393ABB, 0x3CBDBE3F,
+ 	0xC04142C3, 0x44C5C647, 0x48C9CA4B, 0xCC4D4ECF
+ };
++#ifndef FEATURE_CONF_DESC_LENGTH
+ static const u32 def_outq_map[OUTQ_PNUM] = {0x1, 0xFE};
++#else
++static const u32 def_outq_map[OUTQ_PNUM] = {0x0, 0xFF};
++#endif
+ static const char ptm_drv_name[] = "PTM SL";
+ static const char ptm_bond_name[][IFNAMSIZ] = {"PTM US BOND", "PTM DS BOND"};
+ 
+@@ -1005,6 +1009,10 @@ static void us_fp_desq_cfg_ctxt_init(str
+ 	int i;
+ 	u32 desc_addr;
+ 	rx_descriptor_t desc;
++#ifdef FEATURE_CONF_DESC_LENGTH
++	struct tc_priv *tc_priv;
++	tc_priv = priv->tc_priv;
++#endif
+ 
+ 	memset(&desq_cfg, 0, sizeof(desq_cfg));
+ 	/* Initialize US Fast-Path Descriptor Queue Config/Context */
+@@ -1012,7 +1020,11 @@ static void us_fp_desq_cfg_ctxt_init(str
+ 	desq_cfg.fast_path	= 1;
+ 	desq_cfg.mbox_int_en	= 0;
+ 	desq_cfg.des_sync_needed = 0;
++#ifndef FEATURE_CONF_DESC_LENGTH
+ 	desq_cfg.des_num	= __US_FAST_PATH_DES_LIST_NUM;
++#else
++	desq_cfg.des_num	= tc_priv->param.conf_us_fp_desq_len;
++#endif
+ 	desq_cfg.des_base_addr	= __US_FAST_PATH_DES_LIST_BASE;
+ 
+ 	tc_mem_write(priv, fpi_addr(__US_FP_INQ_DES_CFG_CTXT),
+@@ -1036,12 +1048,20 @@ static void us_qos_desq_cfg_ctxt_init(st
+ 	int offset, i;
+ 	rx_descriptor_t desc;
+ 	u32 phy_addr;
++#ifdef FEATURE_CONF_DESC_LENGTH
++	struct tc_priv *tc_priv;
++	tc_priv = priv->tc_priv;
++#endif
+ 
+ 	/* Setup QoSQ_CFG_CTXT */
+ 	memset(&qosq_cfg_ctxt, 0, sizeof(qosq_cfg_ctxt));
+ 
+ 	qosq_cfg_ctxt.threshold = 8;
++#ifdef FEATURE_CONF_DESC_LENGTH
++	qosq_cfg_ctxt.des_num	= tc_priv->param.conf_us_qos_queue_len;
++#else
+ 	qosq_cfg_ctxt.des_num	= QOS_DES_NUM / QOSQ_NUM;
++#endif
+ 
+ 	offset = 0;
+ 	for (i = 0; i < QOSQ_NUM; i++) {
+@@ -1080,6 +1100,10 @@ static void us_outq_desq_cfg_ctxt_init(s
+ 	u32 phy_addr;
+ 	int i;
+ 	u32 offset;
++#ifdef FEATURE_CONF_DESC_LENGTH
++	struct tc_priv *tc_priv;
++	tc_priv = priv->tc_priv;
++#endif
+ 
+ 	/* Setup OUTQ_QoS_CFG_CTXT */
+ 	/* NOTE: By default, Shaping & WFQ both are DISABLED!! */
+@@ -1108,7 +1132,11 @@ static void us_outq_desq_cfg_ctxt_init(s
+ 	desq_cfg.des_in_own_val	= US_OUTQ_DES_OWN;
+ 	desq_cfg.mbox_int_en	= 0;
+ 	desq_cfg.des_sync_needed = 0;
+-	desq_cfg.des_num	= 32;
++#ifndef FEATURE_CONF_DESC_LENGTH
++	desq_cfg.des_num	= OUTQ_DESC_PER_Q;
++#else
++	desq_cfg.des_num	= tc_priv->param.conf_us_outq_len;
++#endif
+ 	/**
+ 	* Only BC0 is used in VRX518
+ 	*/
+@@ -1174,7 +1202,11 @@ static void us_qos_cfg_init(struct ptm_e
+ 	/* Set QoS NO DROP */
+ 	sb_w32(1, __QOSQ_NO_DROP);
+ 	/* Enable Preemption function/Disable QoS by default */
++#ifdef FEATURE_CONF_DESC_LENGTH
++	sb_w32(0, _CHK_PREEMP_MAP);
++#else
+ 	sb_w32(1, _CHK_PREEMP_MAP);
++#endif
+ 	/* By default, all qid mappint to non-preemption queue */
+ 	sb_w32(0x0, _QID2PREEMP_MAP);
+ 
+@@ -1376,6 +1408,11 @@ static void ptm_local_desq_cfg_ctxt_init
+ 	u32 dcnt, addr, pdbram_base;
+ 	unsigned int us_des_alloc[] = {
+ 		__US_TC_LOCAL_Q0_DES_LIST_NUM, __US_TC_LOCAL_Q1_DES_LIST_NUM};
++#ifdef FEATURE_CONF_DESC_LENGTH
++	struct tc_priv *tc_priv;
++	tc_priv = priv->tc_priv;
++	us_des_alloc[0] = tc_priv->param.conf_us_local_q0_desq_len;
++#endif
+ 
+ 	/* Setup the Local DESQ Configuration/Context for UpStream Queues */
+ 	memset(&desq_cfg, 0, sizeof(desq_cfg));
+@@ -2321,6 +2358,10 @@ static void ptm_aca_init(struct ptm_ep_p
+ 	u32 phybase = priv->ep->phy_membase;
+ 	u32 start;
+ 	u32 type;
++#ifdef FEATURE_CONF_DESC_LENGTH
++	struct tc_priv *tc_priv;
++	tc_priv = priv->tc_priv;
++#endif
+ 
+ 	priv->tc_priv->tc_ops.soc_cfg_get(&priv->tc_priv->cfg, ptm_id(priv));
+ 	memset(&param, 0, sizeof(param));
+@@ -2334,7 +2375,11 @@ static void ptm_aca_init(struct ptm_ep_p
+ #endif
+ 	txin->hd_size_in_dw = cfg->txin.soc_desc_dwsz;
+ 	txin->pd_desc_base = SB_XBAR_ADDR(__ACA_TX_IN_PD_LIST_BASE);
++#ifndef FEATURE_CONF_DESC_LENGTH
+ 	txin->pd_desc_num = __ACA_TX_IN_PD_LIST_NUM;
++#else
++	txin->pd_desc_num = tc_priv->param.conf_us_fp_desq_len;
++#endif
+ 	txin->pd_size_in_dw = DESC_DWSZ;
+ 	txin->soc_desc_base = cfg->txin.soc_phydbase;
+ 	txin->soc_desc_num = cfg->txin.soc_dnum;
+--- a/dcdp/tc_main.c
++++ b/dcdp/tc_main.c
+@@ -182,6 +182,12 @@ static inline void init_local_param(stru
+ 	priv->param.txout_dnum = txout_num;
+ 	priv->param.rxin_dnum = rxin_num;
+ 	priv->param.rxout_dnum = rxout_num;
++#ifdef FEATURE_CONF_DESC_LENGTH
++	priv->param.conf_us_fp_desq_len = 32;
++	priv->param.conf_us_qos_queue_len = 32;
++	priv->param.conf_us_outq_len = 32;
++	priv->param.conf_us_local_q0_desq_len = 16;
++#endif
+ 	priv->tc_mode = TC_NONE_MODE;
+ 	priv->tc_stat = NO_TC;
+ 
+--- a/dcdp/tc_proc.c
++++ b/dcdp/tc_proc.c
+@@ -1114,6 +1114,9 @@ static int proc_read_ver(struct seq_file
+ 		(date >> 16) & 0xff,
+ 		(date & 0xffff));
+ 
++#ifdef FEATURE_CONF_DESC_LENGTH
++	seq_puts(seq, " + Support QoS and Configurable descriptor length\n");
++#endif
+ #ifdef FEATURE_POWER_DOWN
+ 	seq_puts(seq, " + Support Power Down enhancement feature\n");
+ #endif
+@@ -1166,6 +1169,113 @@ static const struct proc_ops tc_soc_proc
+ 	.proc_release	= single_release,
+ };
+ 
++#ifdef FEATURE_CONF_DESC_LENGTH
++static ssize_t proc_write_desc_conf(struct file *file, const char __user *buf,
++			size_t count, loff_t *data)
++{
++	struct tc_priv *priv;
++	char str[32];
++	int len, rlen, temp;
++	int num, temp_num;
++	char *param_list[20];
++	len = count < sizeof(str) ? count : sizeof(str) - 1;
++	rlen = len - copy_from_user(str, buf, len);
++	str[rlen] = 0;
++
++	if (!capable(CAP_SYS_ADMIN))
++		return -EPERM;
++
++	priv = (struct tc_priv *)PDE_DATA(file_inode(file));
++	if (priv == NULL)
++		return count;
++
++	num = vrx_split_buffer(str, param_list, ARRAY_SIZE(param_list));
++	if (num < 1 || num > 4)
++		goto proc_dbg_desc_conf;
++
++	temp_num = num;
++	if (num-- != 0) {
++		temp = vrx_atoi(param_list[0]);
++		if (temp < 1 || temp > 128) {
++			pr_info("Fastpath valid range: 1 -> 128\n");
++			goto proc_dbg_desc_conf;
++		}
++	}
++	if (num-- != 0) {
++		temp = vrx_atoi(param_list[1]);
++		if (temp < 1 || temp > 63) {
++			pr_info("QoS valid range: 1 -> 63\n");
++			goto proc_dbg_desc_conf;
++		}
++	}
++	if (num-- != 0) {
++		temp = vrx_atoi(param_list[2]);
++		if (temp < 1 || temp > 128) {
++			pr_info("OutQ valid range: 1 -> 128\n");
++			goto proc_dbg_desc_conf;
++		}
++	}
++	if (num-- != 0) {
++		temp = vrx_atoi(param_list[3]);
++		if (temp < 4 || temp > 16) {
++			pr_info("Local Q0 valid range: 4 -> 16\n");
++			goto proc_dbg_desc_conf;
++		}
++	}
++	num = temp_num;
++	if (num-- != 0) {
++		priv->param.conf_us_fp_desq_len = vrx_atoi(param_list[0]);
++	}
++	if (num-- != 0) {
++		priv->param.conf_us_qos_queue_len = vrx_atoi(param_list[1]);
++	}
++	if (num-- != 0) {
++		priv->param.conf_us_outq_len = vrx_atoi(param_list[2]);
++	}
++	if (num-- != 0) {
++		priv->param.conf_us_local_q0_desq_len = vrx_atoi(param_list[3]);
++	}
++
++	return count;
++
++proc_dbg_desc_conf:
++	pr_info("echo [FP] [QoS] [OutQ] [LocalQ0]> desc_conf\n");
++	return count;
++}
++
++static int proc_read_desc_conf(struct seq_file *seq, void *v)
++{
++	struct tc_priv *priv;
++	priv = (struct tc_priv *)seq->private;
++	if (priv == NULL)
++		return -1;
++	seq_puts(seq, "Upstream descriptor length information:\n");
++	seq_printf(seq, " - Fastpath: %d\n",
++		priv->param.conf_us_fp_desq_len);
++	seq_printf(seq, " - QoS: %d\n",
++		priv->param.conf_us_qos_queue_len);
++	seq_printf(seq, " - OutQ: %d\n",
++		priv->param.conf_us_outq_len);
++	seq_printf(seq, " - Local Q0: %d\n",
++		priv->param.conf_us_local_q0_desq_len);
++	seq_puts(seq, "\n");
++	return 0;
++}
++
++static int proc_read_desc_conf_seq_open(struct inode *inode, struct file *file)
++{
++	return single_open(file, proc_read_desc_conf, PDE_DATA(inode));
++}
++#endif
++
++static const struct proc_ops tc_desc_conf_proc_fops = {
++	.proc_open	= proc_read_desc_conf_seq_open,
++	.proc_read	= seq_read,
++	.proc_write	= proc_write_desc_conf,
++	.proc_lseek	= seq_lseek,
++	.proc_release	= single_release,
++};
++
+ static struct tc_proc_list tc_procs[] = {
+ 	{TC_PROC_DIR,	0,	NULL,			1},
+ 	{"cfg",		0644, &tc_cfg_proc_fops,	0},
+@@ -1174,6 +1284,9 @@ static struct tc_proc_list tc_procs[] =
+ 	{"showtime",	0200, &tc_show_time_proc_fops,	0},
+ 	{"ver",		0644, &tc_ver_proc_fops,	0},
+ 	{"soc",		0644, &tc_soc_proc_fops,	0},
++#ifdef FEATURE_CONF_DESC_LENGTH
++	{"desc_conf",	0644, &tc_desc_conf_proc_fops,	0},
++#endif
+ };
+ 
+ int tc_proc_init(struct tc_priv *priv)
+@@ -1333,7 +1446,6 @@ proc_ptm_cfg_help:
+ 	return count;
+ }
+ 
+-
+ static const struct proc_ops ptm_cfg_proc_fops = {
+ 	.proc_open = proc_read_cfg_seq_open,
+ 	.proc_read = seq_read,
diff --git a/package/kernel/lantiq/vrx518_tc/patches/202-napi.patch b/package/kernel/lantiq/vrx518_tc/patches/202-napi.patch
new file mode 100644
index 00000000000000..55f0cc10667811
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_tc/patches/202-napi.patch
@@ -0,0 +1,423 @@
+--- a/dcdp/platform/sw_plat.c
++++ b/dcdp/platform/sw_plat.c
+@@ -208,6 +208,8 @@ struct plat_priv {
+ 	struct tc_req req_work;
+ 	struct aca_ring_grp soc_rings;
+ 	struct net_device *netdev;
++	struct napi_struct *napi_tx;
++	struct napi_struct *napi_rx;
+ 	DECLARE_HASHTABLE(mem_map, 8);
+ };
+ 
+@@ -472,7 +474,7 @@ err2:
+ 	return -1;
+ }
+ 
+-static void txout_action(struct tc_priv *priv, struct aca_ring *txout)
++static int txout_action(struct tc_priv *priv, struct aca_ring *txout, int budget)
+ {
+ 	struct aca_ring *txin = &g_plat_priv->soc_rings.txin;
+ 	struct tx_list *txlist = &g_plat_priv->soc_rings.txlist;
+@@ -490,7 +492,10 @@ static void txout_action(struct tc_priv
+ 		spin_lock_irqsave(&tx_spinlock, flags);
+ 	}
+ 
+-	for (i = 0; i < txout->dnum; i++) {
++	if (budget == 0 || budget > txout->dnum)
++		budget = txout->dnum;
++
++	for (i = 0; i < budget; i++) {
+ 		desc = txout->dbase_mem;
+ 		desc += txout->idx;
+ 
+@@ -540,6 +545,8 @@ static void txout_action(struct tc_priv
+ 	if (cnt && g_plat_priv->netdev && netif_queue_stopped(g_plat_priv->netdev)) {
+ 		netif_wake_queue(g_plat_priv->netdev);
+ 	}
++
++	return cnt;
+ }
+ 
+ static void rxin_action(struct tc_priv *priv,
+@@ -549,7 +556,7 @@ static void rxin_action(struct tc_priv *
+ 	writel(cnt, rxin->umt_dst);
+ }
+ 
+-static int rxout_action(struct tc_priv *priv, struct aca_ring *rxout)
++static int rxout_action(struct tc_priv *priv, struct aca_ring *rxout, int budget)
+ {
+ 	struct device *pdev = priv->ep_dev[0].dev;
+ 	int i, cnt;
+@@ -559,8 +566,11 @@ static int rxout_action(struct tc_priv *
+ 	size_t len;
+ 	struct sk_buff *skb;
+ 
++	if (budget == 0 || budget > rxout->dnum)
++		budget = rxout->dnum;
++
+ 	cnt = 0;
+-	for (i = 0; i < rxout->dnum; i++) {
++	for (i = 0; i < budget; i++) {
+ 		desc = rxout->dbase_mem;
+ 		desc += rxout->idx;
+ 
+@@ -593,14 +603,30 @@ static int rxout_action(struct tc_priv *
+ 		ring_idx_inc(rxout);
+ 	}
+ 
+-	if (!cnt)
+-		tc_err(priv, MSG_RX, "RXOUT spurious interrupt\n");
+-	else
++	if (cnt)
+ 		writel(cnt, rxout->umt_dst+0x28); // RXOUT_HD_ACCUM_SUB instead of RXOUT_HD_ACCUM_ADD
+ 
+ 	return cnt;
+ }
+ 
++static int plat_txout_napi(struct napi_struct *napi, int budget)
++{
++	struct plat_priv *priv = g_plat_priv;
++	struct tc_priv *tcpriv = plat_to_tcpriv();
++	struct aca_ring *txout = &priv->soc_rings.txout;
++	struct dc_ep_dev *ep_dev = &tcpriv->ep_dev[txout->ep_dev_idx];
++	int cnt;
++
++	cnt = txout_action(tcpriv, txout, budget);
++
++	if (cnt < budget) {
++		if (napi_complete_done(napi, cnt))
++			ep_dev->hw_ops->icu_en(ep_dev, ACA_HOSTIF_TX);
++	}
++
++	return cnt;
++}
++
+ static void plat_txout_tasklet(unsigned long arg)
+ {
+ 	struct plat_priv *priv = g_plat_priv;
+@@ -608,12 +634,33 @@ static void plat_txout_tasklet(unsigned
+ 	struct aca_ring *txout = &priv->soc_rings.txout;
+ 	struct dc_ep_dev *ep_dev = &tcpriv->ep_dev[txout->ep_dev_idx];
+ 
+-	txout_action(tcpriv, txout);
++	txout_action(tcpriv, txout, 0);
+ 
+ 	/* Enable interrupt */
+ 	ep_dev->hw_ops->icu_en(ep_dev, ACA_HOSTIF_TX);
+ }
+ 
++static int plat_rxout_napi(struct napi_struct *napi, int budget)
++{
++	struct plat_priv *priv = g_plat_priv;
++	struct tc_priv *tcpriv = plat_to_tcpriv();
++	struct aca_ring *rxout = &priv->soc_rings.rxout;
++	struct aca_ring *rxin = &priv->soc_rings.rxin;
++	struct dc_ep_dev *ep_dev = &tcpriv->ep_dev[rxout->ep_dev_idx];
++	int cnt;
++
++	cnt = rxout_action(tcpriv, rxout, budget);
++	if (cnt)
++		rxin_action(tcpriv, rxin, DMA_PACKET_SZ, cnt);
++
++	if (cnt < budget) {
++		if (napi_complete_done(napi, cnt))
++			ep_dev->hw_ops->icu_en(ep_dev, ACA_HOSTIF_RX);
++	}
++
++	return cnt;
++}
++
+ static void plat_rxout_tasklet(unsigned long arg)
+ {
+ 	struct plat_priv *priv = g_plat_priv;
+@@ -623,7 +670,7 @@ static void plat_rxout_tasklet(unsigned
+ 	struct dc_ep_dev *ep_dev = &tcpriv->ep_dev[rxout->ep_dev_idx];
+ 	int cnt;
+ 
+-	cnt = rxout_action(tcpriv, rxout);
++	cnt = rxout_action(tcpriv, rxout, 0);
+ 	if (cnt)
+ 		rxin_action(tcpriv, rxin, DMA_PACKET_SZ, cnt);
+ 
+@@ -783,11 +830,22 @@ static irqreturn_t aca_rx_irq_handler(in
+ {
+ 	struct dc_ep_dev *ep_dev = dev_id;
+ 
+-	/* Disable IRQ in IMCU */
+-	ep_dev->hw_ops->icu_mask(ep_dev, ACA_HOSTIF_RX);
++	if (g_plat_priv->napi_rx) {
++
++		if (napi_schedule_prep(g_plat_priv->napi_rx)) {
++			ep_dev->hw_ops->icu_mask(ep_dev, ACA_HOSTIF_RX);
++			__napi_schedule(g_plat_priv->napi_rx);
++		}
++
++	} else {
++
++		/* Disable IRQ in IMCU */
++		ep_dev->hw_ops->icu_mask(ep_dev, ACA_HOSTIF_RX);
+ 
+-	/* Start tasklet */
+-	tasklet_schedule(&rxout_task);
++		/* Start tasklet */
++		tasklet_schedule(&rxout_task);
++
++	}
+ 
+ 	return IRQ_HANDLED;
+ }
+@@ -796,15 +854,62 @@ static irqreturn_t aca_tx_irq_handler(in
+ {
+ 	struct dc_ep_dev *ep_dev = dev_id;
+ 
+-	/* Disable IRQ in IMCU */
+-	ep_dev->hw_ops->icu_mask(ep_dev, ACA_HOSTIF_TX);
++	if (g_plat_priv->napi_tx) {
+ 
+-	/* Start tasklet */
+-	tasklet_schedule(&txout_task);
++		if (napi_schedule_prep(g_plat_priv->napi_tx)) {
++			ep_dev->hw_ops->icu_mask(ep_dev, ACA_HOSTIF_TX);
++			__napi_schedule(g_plat_priv->napi_tx);
++		}
++
++	} else {
++
++		/* Disable IRQ in IMCU */
++		ep_dev->hw_ops->icu_mask(ep_dev, ACA_HOSTIF_TX);
++
++		/* Start tasklet */
++		tasklet_schedule(&txout_task);
++
++	}
+ 
+ 	return IRQ_HANDLED;
+ }
+ 
++static void plat_net_open(void)
++{
++	struct plat_priv *priv = g_plat_priv;
++	struct tc_priv *tcpriv = plat_to_tcpriv();
++	struct aca_ring *rxout = &priv->soc_rings.rxout;
++	struct aca_ring *txout = &priv->soc_rings.txout;
++	struct dc_ep_dev *ep_dev_rx = &tcpriv->ep_dev[rxout->ep_dev_idx];
++	struct dc_ep_dev *ep_dev_tx = &tcpriv->ep_dev[txout->ep_dev_idx];
++
++	if (priv->napi_rx)
++		napi_enable(priv->napi_rx);
++	ep_dev_rx->hw_ops->icu_en(ep_dev_rx, ACA_HOSTIF_RX);
++
++	if (priv->napi_tx)
++		napi_enable(priv->napi_tx);
++	ep_dev_tx->hw_ops->icu_en(ep_dev_tx, ACA_HOSTIF_TX);
++}
++
++static void plat_net_stop(void)
++{
++	struct plat_priv *priv = g_plat_priv;
++	struct tc_priv *tcpriv = plat_to_tcpriv();
++	struct aca_ring *rxout = &priv->soc_rings.rxout;
++	struct aca_ring *txout = &priv->soc_rings.txout;
++	struct dc_ep_dev *ep_dev_rx = &tcpriv->ep_dev[rxout->ep_dev_idx];
++	struct dc_ep_dev *ep_dev_tx = &tcpriv->ep_dev[txout->ep_dev_idx];
++
++	if (priv->napi_tx)
++		napi_disable(priv->napi_tx);
++	ep_dev_tx->hw_ops->icu_mask(ep_dev_tx, ACA_HOSTIF_TX);
++
++	if (priv->napi_rx)
++		napi_disable(priv->napi_rx);
++	ep_dev_rx->hw_ops->icu_mask(ep_dev_rx, ACA_HOSTIF_RX);
++}
++
+ static void plat_irq_init(struct tc_priv *priv, const char *dev_name)
+ {
+ 	int ret;
+@@ -988,17 +1093,49 @@ static int plat_soc_cfg_get(struct soc_c
+ }
+ 
+ static int plat_open(struct net_device *pdev, const char *dev_name,
++		struct napi_struct *napi_tx, struct napi_struct *napi_rx,
+ 		int id, int flag)
+ {
++	struct tc_priv *priv = g_plat_priv->tc_priv;
++	int i;
++
++	for (i = 0; i < EP_MAX_NUM && i < priv->ep_num; i++) {
++		disable_irq(priv->ep_dev[i].aca_rx_irq);
++		disable_irq(priv->ep_dev[i].aca_tx_irq);
++	}
++
+ 	g_plat_priv->netdev = pdev;
++	g_plat_priv->napi_tx = napi_tx;
++	g_plat_priv->napi_rx = napi_rx;
++
++	for (i = 0; i < EP_MAX_NUM && i < priv->ep_num; i++) {
++		enable_irq(priv->ep_dev[i].aca_rx_irq);
++		enable_irq(priv->ep_dev[i].aca_tx_irq);
++	}
+ 
+ 	return 0;
+ }
+ 
+ static void plat_close(struct net_device *pdev, const char *dev_name,
++		struct napi_struct *napi_tx, struct napi_struct *napi_rx,
+ 		int flag)
+ {
++	struct tc_priv *priv = g_plat_priv->tc_priv;
++	int i;
++
++	for (i = 0; i < EP_MAX_NUM && i < priv->ep_num; i++) {
++		disable_irq(priv->ep_dev[i].aca_rx_irq);
++		disable_irq(priv->ep_dev[i].aca_tx_irq);
++	}
++
+ 	g_plat_priv->netdev = NULL;
++	g_plat_priv->napi_tx = NULL;
++	g_plat_priv->napi_rx = NULL;
++
++	for (i = 0; i < EP_MAX_NUM && i < priv->ep_num; i++) {
++		enable_irq(priv->ep_dev[i].aca_rx_irq);
++		enable_irq(priv->ep_dev[i].aca_tx_irq);
++	}
+ 
+ 	return;
+ }
+@@ -1084,6 +1221,10 @@ static void plat_tc_ops_setup(struct tc_
+ 	priv->tc_ops.free = plat_mem_free;
+ 	priv->tc_ops.dev_reg = plat_open;
+ 	priv->tc_ops.dev_unreg = plat_close;
++	priv->tc_ops.net_open = plat_net_open;
++	priv->tc_ops.net_stop = plat_net_stop;
++	priv->tc_ops.napi_tx = plat_txout_napi;
++	priv->tc_ops.napi_rx = plat_rxout_napi;
+ 	priv->tc_ops.umt_init = plat_umt_init;
+ 	priv->tc_ops.umt_exit = plat_umt_exit;
+ 	priv->tc_ops.umt_start = plat_umt_start;
+--- a/dcdp/atm_tc.c
++++ b/dcdp/atm_tc.c
+@@ -3650,7 +3650,7 @@ static void atm_aca_ring_config_init(str
+ static int atm_ring_init(struct atm_priv *priv)
+ {
+ 	atm_aca_ring_config_init(priv);
+-	return priv->tc_priv->tc_ops.dev_reg(NULL, g_atm_dev_name, 0, 0);
++	return priv->tc_priv->tc_ops.dev_reg(NULL, g_atm_dev_name, NULL, NULL, 0, 0);
+ }
+ 
+ static int atm_init(struct tc_priv *tcpriv, u32 ep_id)
+@@ -4020,7 +4020,7 @@ void atm_tc_unload(void)
+ 	/* unregister device */
+ 	if (priv->tc_priv->tc_ops.dev_unreg != NULL)
+ 		priv->tc_priv->tc_ops.dev_unreg(NULL,
+-			g_atm_dev_name, 0);
++			g_atm_dev_name, NULL, NULL, 0);
+ 
+ 	/* atm_dev_deinit(priv); */
+ 	/* modem module power off */
+--- a/dcdp/inc/tc_main.h
++++ b/dcdp/inc/tc_main.h
+@@ -209,9 +209,15 @@ struct tc_hw_ops {
+ 	void (*subif_unreg)(struct net_device *pdev, const char *dev_name,
+ 			int subif_id, int flag);
+ 	int (*dev_reg)(struct net_device *pdev, const char *dev_name,
++			struct napi_struct *napi_tx, struct napi_struct *napi_rx,
+ 			int id, int flag);
+ 	void (*dev_unreg)(struct net_device *pdev, const char *dev_name,
++			struct napi_struct *napi_tx, struct napi_struct *napi_rx,
+ 			int flag);
++	void (*net_open)(void);
++	void (*net_stop)(void);
++	int (*napi_tx)(struct napi_struct *napi, int budget);
++	int (*napi_rx)(struct napi_struct *napi, int budget);
+ 
+ 	/*umt init/exit including the corresponding DMA init/exit */
+ 	int (*umt_init)(u32 umt_id, u32 umt_period, u32 umt_dst);
+--- a/dcdp/ptm_tc.c
++++ b/dcdp/ptm_tc.c
+@@ -141,7 +141,11 @@ static int ptm_open(struct net_device *d
+ 	struct ptm_priv *ptm_tc = netdev_priv(dev);
+ 
+ 	tc_info(ptm_tc->tc_priv, MSG_EVENT, "ptm open\n");
++
++	ptm_tc->tc_priv->tc_ops.net_open();
++
+ 	netif_tx_start_all_queues(dev);
++
+ #ifdef CONFIG_SOC_TYPE_XWAY
+ 	xet_phy_wan_port(7, NULL, 1, 1);
+ 	if (ppa_hook_ppa_phys_port_add_fn)
+@@ -158,7 +162,11 @@ static int ptm_stop(struct net_device *d
+ 	struct ptm_priv *ptm_tc = netdev_priv(dev);
+ 
+ 	tc_info(ptm_tc->tc_priv, MSG_EVENT, "ptm stop\n");
++
+ 	netif_tx_stop_all_queues(dev);
++
++	ptm_tc->tc_priv->tc_ops.net_stop();
++
+ #ifdef CONFIG_SOC_TYPE_XWAY
+     if (ppa_drv_datapath_mac_entry_setting)
+         ppa_drv_datapath_mac_entry_setting(dev->dev_addr, 0, 6, 10, 1, 2);
+@@ -555,7 +563,7 @@ static void ptm_rx(struct net_device *de
+ 	ptm_tc->stats64.rx_packets++;
+ 	ptm_tc->stats64.rx_bytes += skb->len;
+ 
+-	if (netif_rx(skb) == NET_RX_DROP)
++	if (netif_receive_skb(skb) == NET_RX_DROP)
+ 		ptm_tc->stats64.rx_dropped++;
+ 
+ 	return;
+@@ -651,6 +659,9 @@ static int ptm_dev_init(struct tc_priv *
+ 	memcpy(ptm_tc->outq_map, def_outq_map, sizeof(def_outq_map));
+ 	SET_NETDEV_DEV(ptm_tc->dev, tc_priv->ep_dev[id].dev);
+ 
++	netif_napi_add(ptm_tc->dev, &ptm_tc->napi_rx, tc_priv->tc_ops.napi_rx, NAPI_POLL_WEIGHT);
++	netif_tx_napi_add(ptm_tc->dev, &ptm_tc->napi_tx, tc_priv->tc_ops.napi_tx, NAPI_POLL_WEIGHT);
++
+ 	err = register_netdev(ptm_tc->dev);
+ 	if (err)
+ 		goto err1;
+@@ -2605,7 +2616,9 @@ static int ptm_ring_init(struct ptm_ep_p
+ {
+ 	ptm_aca_ring_config_init(priv, id, bonding);
+ 	return priv->tc_priv->tc_ops.dev_reg(priv->ptm_tc->dev,
+-		priv->ptm_tc->dev->name, id, bonding);
++		priv->ptm_tc->dev->name,
++		&priv->ptm_tc->napi_tx, &priv->ptm_tc->napi_rx,
++		id, bonding);
+ }
+ 
+ /**
+@@ -2960,7 +2973,9 @@ void ptm_tc_unload(enum dsl_tc_mode tc_m
+ 	/* unregister device */
+ 	if (ptm_tc->tc_priv->tc_ops.dev_unreg != NULL)
+ 		ptm_tc->tc_priv->tc_ops.dev_unreg(ptm_tc->dev,
+-			ptm_tc->dev->name, 0);
++			ptm_tc->dev->name,
++			&priv->ptm_tc->napi_tx, &priv->ptm_tc->napi_rx,
++			0);
+ 
+ 	/* remove PTM callback function */
+ 	ptm_cb_setup(ptm_tc, 0);
+@@ -2978,6 +2993,10 @@ void ptm_exit(void)
+ 
+ 	if (!priv)
+ 		return;
++
++	netif_napi_del(&priv->napi_tx);
++	netif_napi_del(&priv->napi_rx);
++
+ 	unregister_netdev(priv->dev);
+ 	free_netdev(priv->dev);
+ 
+--- a/dcdp/inc/ptm_tc.h
++++ b/dcdp/inc/ptm_tc.h
+@@ -119,6 +119,8 @@ struct ptm_priv {
+ 	u32 ep_id;
+ 	struct ppe_fw fw;
+ 	struct net_device *dev;
++	struct napi_struct napi_tx;
++	struct napi_struct napi_rx;
+ 	spinlock_t ptm_lock;
+ 	struct rtnl_link_stats64 stats64;
+ 	int subif_id;
diff --git a/package/kernel/lantiq/vrx518_tc/patches/203-dbg.patch b/package/kernel/lantiq/vrx518_tc/patches/203-dbg.patch
new file mode 100644
index 00000000000000..687e66f991ed9c
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_tc/patches/203-dbg.patch
@@ -0,0 +1,120 @@
+--- a/dcdp/platform/sw_plat.c
++++ b/dcdp/platform/sw_plat.c
+@@ -85,6 +85,7 @@ struct aca_ring {
+ 	u32 dnum;
+ 	u32 dsize;
+ 	int idx; /* SoC RX/TX index */
++	u64 cnt;
+ 	int ep_dev_idx;
+ };
+ 
+@@ -210,6 +211,8 @@ struct plat_priv {
+ 	struct net_device *netdev;
+ 	struct napi_struct *napi_tx;
+ 	struct napi_struct *napi_rx;
++	u64 napi_tx_stats[NAPI_POLL_WEIGHT+1];
++	u64 napi_rx_stats[NAPI_POLL_WEIGHT+1];
+ 	DECLARE_HASHTABLE(mem_map, 8);
+ };
+ 
+@@ -362,6 +365,7 @@ static void txlist_free(struct tx_list *
+ static inline void ring_idx_inc(struct aca_ring *ring)
+ {
+ 	ring->idx = (ring->idx + 1) % ring->dnum;
++	ring->cnt += 1;
+ }
+ 
+ static struct sk_buff *txin_skb_prepare(struct sk_buff *skb)
+@@ -619,6 +623,8 @@ static int plat_txout_napi(struct napi_s
+ 
+ 	cnt = txout_action(tcpriv, txout, budget);
+ 
++	priv->napi_tx_stats[cnt] += 1;
++
+ 	if (cnt < budget) {
+ 		if (napi_complete_done(napi, cnt))
+ 			ep_dev->hw_ops->icu_en(ep_dev, ACA_HOSTIF_TX);
+@@ -653,6 +659,8 @@ static int plat_rxout_napi(struct napi_s
+ 	if (cnt)
+ 		rxin_action(tcpriv, rxin, DMA_PACKET_SZ, cnt);
+ 
++	priv->napi_rx_stats[cnt] += 1;
++
+ 	if (cnt < budget) {
+ 		if (napi_complete_done(napi, cnt))
+ 			ep_dev->hw_ops->icu_en(ep_dev, ACA_HOSTIF_RX);
+@@ -1092,6 +1100,56 @@ static int plat_soc_cfg_get(struct soc_c
+ 	return 0;
+ }
+ 
++static struct proc_dir_entry *g_proc_entry;
++
++static int proc_show(struct seq_file *m, void *p)
++{
++	struct aca_ring *txin = &g_plat_priv->soc_rings.txin;
++	struct aca_ring *txout = &g_plat_priv->soc_rings.txout;
++	struct aca_ring *rxin = &g_plat_priv->soc_rings.rxin;
++	struct aca_ring *rxout = &g_plat_priv->soc_rings.rxout;
++	int i;
++
++	seq_printf(m, "napi_tx_stats: ");
++	for (i = 0; i < sizeof(g_plat_priv->napi_tx_stats) / sizeof(g_plat_priv->napi_tx_stats[0]); i++) {
++		if (i == 0) {
++			seq_printf(m, "%llu", g_plat_priv->napi_tx_stats[i]);
++		} else {
++			seq_printf(m, ", %llu", g_plat_priv->napi_tx_stats[i]);
++		}
++	}
++	seq_printf(m, "\n");
++
++	seq_printf(m, "napi_rx_stats: ");
++	for (i = 0; i < sizeof(g_plat_priv->napi_rx_stats) / sizeof(g_plat_priv->napi_rx_stats[0]); i++) {
++		if (i == 0) {
++			seq_printf(m, "%llu", g_plat_priv->napi_rx_stats[i]);
++		} else {
++			seq_printf(m, ", %llu", g_plat_priv->napi_rx_stats[i]);
++		}
++	}
++	seq_printf(m, "\n");
++
++	seq_printf(m, "txin: %d/%u, %llu\n", txin->idx, txin->dnum, txin->cnt);
++	seq_printf(m, "txout: %d/%u, %llu\n", txout->idx, txout->dnum, txout->cnt);
++	seq_printf(m, "rxin: %d/%u, %llu\n", rxin->idx, rxin->dnum, rxin->cnt);
++	seq_printf(m, "rxout: %d/%u, %llu\n", rxout->idx, rxout->dnum, rxout->cnt);
++
++	return 0;
++}
++
++static int proc_open(struct inode *inode, struct file *file)
++{
++	return single_open(file, proc_show, NULL);
++}
++
++static struct proc_ops proc_operations = {
++        .proc_open    = proc_open,
++        .proc_read    = seq_read,
++        .proc_lseek   = seq_lseek,
++        .proc_release = single_release
++};
++
+ static int plat_open(struct net_device *pdev, const char *dev_name,
+ 		struct napi_struct *napi_tx, struct napi_struct *napi_rx,
+ 		int id, int flag)
+@@ -1099,6 +1157,8 @@ static int plat_open(struct net_device *
+ 	struct tc_priv *priv = g_plat_priv->tc_priv;
+ 	int i;
+ 
++	g_proc_entry = proc_create("swplat", 0600, priv->proc_dir, &proc_operations);
++
+ 	for (i = 0; i < EP_MAX_NUM && i < priv->ep_num; i++) {
+ 		disable_irq(priv->ep_dev[i].aca_rx_irq);
+ 		disable_irq(priv->ep_dev[i].aca_tx_irq);
+@@ -1137,6 +1197,8 @@ static void plat_close(struct net_device
+ 		enable_irq(priv->ep_dev[i].aca_tx_irq);
+ 	}
+ 
++	proc_remove(g_proc_entry);
++
+ 	return;
+ }
+ 
diff --git a/package/kernel/lantiq/vrx518_tc/patches/204-dcdp-atm_tc-fix-compilation-warning.patch b/package/kernel/lantiq/vrx518_tc/patches/204-dcdp-atm_tc-fix-compilation-warning.patch
new file mode 100644
index 00000000000000..bf2d82e2b552a1
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_tc/patches/204-dcdp-atm_tc-fix-compilation-warning.patch
@@ -0,0 +1,31 @@
+--- a/dcdp/atm_tc.c
++++ b/dcdp/atm_tc.c
+@@ -746,7 +746,8 @@ static void atm_aca_init(struct atm_priv
+ 		ACA_TXOUT_EN | ACA_RXIN_EN | ACA_RXOUT_EN, 1);
+ }
+ 
+-static int print_datetime(char *buffer, const struct timespec64 *datetime)
++static int print_datetime(char *buffer, int buffer_size,
++			  const struct timespec64 *datetime)
+ {
+ 	struct tm nowtm;
+ 	char tmbuf[64];
+@@ -765,7 +766,8 @@ static int print_datetime(char *buffer,
+ 			nowtm.tm_hour,
+ 			nowtm.tm_min,
+ 			nowtm.tm_sec);
+-	snprintf(buffer, sizeof(buffer), "%s.%06d", tmbuf, (int)datetime->tv_nsec / 1000);
++	snprintf(buffer, sizeof(tmbuf)+buffer_size, "%s.%06d",
++		 tmbuf, (int)datetime->tv_nsec / 1000);
+ 
+ 	return 0;
+ }
+@@ -967,7 +969,7 @@ void show_atm_pvc(struct seq_file *seq,
+ 	char buf[64];
+ 
+ 	seq_printf(seq, "\tNet device: %s\n", pvc->dev->name);
+-	print_datetime(buf, &(pvc->access_time));
++	print_datetime(buf, sizeof(buf), &(pvc->access_time));
+ 	seq_printf(seq, "\tLast user cell: %s\n", buf);
+ 	seq_printf(seq, "\tPort: %d\n", pvc->port);
+ 	seq_printf(seq, "\tSoftware TX Queue: %u\n", pvc->sw_txq_tbl);
diff --git a/package/kernel/lantiq/vrx518_tc/patches/205-dcdp-ptm_tc-dynamically-alloc-mib.patch b/package/kernel/lantiq/vrx518_tc/patches/205-dcdp-ptm_tc-dynamically-alloc-mib.patch
new file mode 100644
index 00000000000000..ca4c041b210bbf
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_tc/patches/205-dcdp-ptm_tc-dynamically-alloc-mib.patch
@@ -0,0 +1,206 @@
+--- a/dcdp/ptm_tc.c
++++ b/dcdp/ptm_tc.c
+@@ -298,15 +298,19 @@ static int ptm_tc_get_stats(struct ptm_e
+ )
+ {
+ 	struct rtnl_link_stats64 *stat;
+-	struct wan_rx_mib_table rx_mib;
++	struct wan_rx_mib_table *rx_mib;
+ 	unsigned int cur_cnt, last_cnt;
+ 	struct intel_tc_ptm_sl_stats *ptm_sl_stats;
+ 	struct ptm_priv *ptm_tc;
++	int ret = 0;
+ 	if (!priv || !stats)
+ 		return -EFAULT;
+ 	ptm_tc = priv->ptm_tc;
+ 	if (!ptm_tc)
+ 		return -EFAULT;
++	rx_mib = kzalloc(sizeof(*rx_mib), GFP_KERNEL);
++	if (!rx_mib)
++		return -ENOMEM;
+ 	if (bonding)
+ 		stats->tc_info = TC_PTM_BND_MODE;
+ 	else
+@@ -340,11 +344,11 @@ static int ptm_tc_get_stats(struct ptm_e
+ 		? cur_cnt - last_cnt
+ 		: cur_cnt + ((unsigned int)(-1) - last_cnt);
+ 
+-	tc_mem_read(priv, &rx_mib,
++	tc_mem_read(priv, rx_mib,
+ 		fpi_addr(__RX_GIF_MIB_BASE),
+-		sizeof(rx_mib)
++		sizeof(*rx_mib)
+ 	);
+-	ptm_sl_stats->wrx_gif_drop_pdu = rx_mib.wrx_dropdes_pdu;
++	ptm_sl_stats->wrx_gif_drop_pdu = rx_mib->wrx_dropdes_pdu;
+ 
+ 	cur_cnt = tc_r32(GIF0_RX_CRC_ERR_CNT);
+ 	last_cnt = priv->ptm_mib.rx_crc_err_pdu[0];
+@@ -358,7 +362,7 @@ static int ptm_tc_get_stats(struct ptm_e
+ 		? cur_cnt - last_cnt
+ 		: cur_cnt + ((unsigned int)(-1) - last_cnt);
+ 
+-	ptm_sl_stats->wrx_gif_total_bytes = rx_mib.wrx_total_bytes;
++	ptm_sl_stats->wrx_gif_total_bytes = rx_mib->wrx_total_bytes;
+ 	cur_cnt = sb_r32(__US_TC_LOCAL_Q_CFG_CTXT_BASE +
+ 		offsetof(desq_cfg_ctxt_t, deq_pkt_cnt) / 4);
+ 	last_cnt = priv->ptm_mib.tx_total_pdu[0];
+@@ -376,90 +380,108 @@ static int ptm_tc_get_stats(struct ptm_e
+ 	/* For bonding information */
+ 	if (bonding) {
+ 		int i;
+-		struct intel_tc_ptm_bonding_stats ptm_ds;
+-		struct intel_tc_ptm_bonding_stats ptm_us;
++		struct intel_tc_ptm_bonding_stats *ptm_ds;
++		struct intel_tc_ptm_bonding_stats *ptm_us;
+ 		struct intel_tc_ptm_bonding_stats *ptm_bonding_stats;
++
++		ptm_ds = kzalloc(sizeof(*ptm_ds), GFP_KERNEL);
++		if (!ptm_ds) {
++			ret = -ENOMEM;
++			goto free_rx_mib;
++		}
++		
++		ptm_us = kzalloc(sizeof(*ptm_us), GFP_KERNEL);
++		if (!ptm_us) {
++			ret = -ENOMEM;
++			goto free_ptm_ds;
++		}
++
+ 		priv = tc_ep_priv(0);
+-		ptm_tc_bond_get_stats(priv, &ptm_ds);
++		ptm_tc_bond_get_stats(priv, ptm_ds);
+ 		priv = tc_ep_priv(1);
+-		ptm_tc_bond_get_stats(priv, &ptm_us);
++		ptm_tc_bond_get_stats(priv, ptm_us);
+ 		ptm_bonding_stats =
+ 			&(stats->stats.ptm_tc_stats.pmt_bonding_stats);
+ 		for (i = 0; i < 8; i++)
+ 			ptm_bonding_stats->us_gif_mib[i] =
+-				ptm_ds.us_gif_mib[i] + ptm_us.us_gif_mib[i];
++				ptm_ds->us_gif_mib[i] + ptm_us->us_gif_mib[i];
+ 		for (i = 0; i < 8; i++) {
+ 			ptm_bonding_stats->ds_gif_mib[i].rx_frag_byte_cnt =
+-				ptm_ds.ds_gif_mib[i].rx_frag_byte_cnt
+-				+ ptm_us.ds_gif_mib[i].rx_frag_byte_cnt;
++				ptm_ds->ds_gif_mib[i].rx_frag_byte_cnt
++				+ ptm_us->ds_gif_mib[i].rx_frag_byte_cnt;
+ 			ptm_bonding_stats->ds_gif_mib[i].rx_byte_cnt =
+-				ptm_ds.ds_gif_mib[i].rx_byte_cnt
+-				+ ptm_us.ds_gif_mib[i].rx_byte_cnt;
++				ptm_ds->ds_gif_mib[i].rx_byte_cnt
++				+ ptm_us->ds_gif_mib[i].rx_byte_cnt;
+ 			ptm_bonding_stats->ds_gif_mib[i].rx_of_frag_byte_cnt =
+-				ptm_ds.ds_gif_mib[i].rx_of_frag_byte_cnt
+-				+ ptm_us.ds_gif_mib[i].rx_of_frag_byte_cnt;
++				ptm_ds->ds_gif_mib[i].rx_of_frag_byte_cnt
++				+ ptm_us->ds_gif_mib[i].rx_of_frag_byte_cnt;
+ 			ptm_bonding_stats->ds_gif_mib[i].rx_of_byte_cnt =
+-				ptm_ds.ds_gif_mib[i].rx_of_byte_cnt
+-				+ ptm_us.ds_gif_mib[i].rx_of_byte_cnt;
++				ptm_ds->ds_gif_mib[i].rx_of_byte_cnt
++				+ ptm_us->ds_gif_mib[i].rx_of_byte_cnt;
+ 			ptm_bonding_stats->ds_gif_mib[i].rx_oor_frag_byte_cnt =
+-				ptm_ds.ds_gif_mib[i].rx_oor_frag_byte_cnt
+-				+ ptm_us.ds_gif_mib[i].rx_oor_frag_byte_cnt;
++				ptm_ds->ds_gif_mib[i].rx_oor_frag_byte_cnt
++				+ ptm_us->ds_gif_mib[i].rx_oor_frag_byte_cnt;
+ 			ptm_bonding_stats->ds_gif_mib[i].rx_miss_frag_byte_cnt =
+-				ptm_ds.ds_gif_mib[i].rx_miss_frag_byte_cnt
+-				+ ptm_us.ds_gif_mib[i].rx_miss_frag_byte_cnt;
++				ptm_ds->ds_gif_mib[i].rx_miss_frag_byte_cnt
++				+ ptm_us->ds_gif_mib[i].rx_miss_frag_byte_cnt;
+ 			ptm_bonding_stats->ds_gif_mib[i].rx_to_frag_byte_cnt =
+-				ptm_ds.ds_gif_mib[i].rx_to_frag_byte_cnt
+-				+ ptm_us.ds_gif_mib[i].rx_to_frag_byte_cnt;
++				ptm_ds->ds_gif_mib[i].rx_to_frag_byte_cnt
++				+ ptm_us->ds_gif_mib[i].rx_to_frag_byte_cnt;
+ 		}
+ 		for (i = 0; i < 4; i++) {
+ 			ptm_bonding_stats->ds_bg_mib[i].conform_pkt_cnt =
+-				ptm_ds.ds_bg_mib[i].conform_pkt_cnt
+-				+ ptm_us.ds_bg_mib[i].conform_pkt_cnt;
++				ptm_ds->ds_bg_mib[i].conform_pkt_cnt
++				+ ptm_us->ds_bg_mib[i].conform_pkt_cnt;
+ 			ptm_bonding_stats->ds_bg_mib[i].conform_frag_cnt =
+-				ptm_ds.ds_bg_mib[i].conform_frag_cnt
+-				+ ptm_us.ds_bg_mib[i].conform_frag_cnt;
++				ptm_ds->ds_bg_mib[i].conform_frag_cnt
++				+ ptm_us->ds_bg_mib[i].conform_frag_cnt;
+ 			ptm_bonding_stats->ds_bg_mib[i].conform_byte_cnt =
+-				ptm_ds.ds_bg_mib[i].conform_byte_cnt
+-				+ ptm_us.ds_bg_mib[i].conform_byte_cnt;
++				ptm_ds->ds_bg_mib[i].conform_byte_cnt
++				+ ptm_us->ds_bg_mib[i].conform_byte_cnt;
+ 			ptm_bonding_stats->ds_bg_mib[i].no_sop_pkt_cnt =
+-				ptm_ds.ds_bg_mib[i].no_sop_pkt_cnt
+-				+ ptm_us.ds_bg_mib[i].no_sop_pkt_cnt;
++				ptm_ds->ds_bg_mib[i].no_sop_pkt_cnt
++				+ ptm_us->ds_bg_mib[i].no_sop_pkt_cnt;
+ 			ptm_bonding_stats->ds_bg_mib[i].no_sop_frag_cnt =
+-				ptm_ds.ds_bg_mib[i].no_sop_frag_cnt
+-				+ ptm_us.ds_bg_mib[i].no_sop_frag_cnt;
++				ptm_ds->ds_bg_mib[i].no_sop_frag_cnt
++				+ ptm_us->ds_bg_mib[i].no_sop_frag_cnt;
+ 			ptm_bonding_stats->ds_bg_mib[i].no_sop_byte_cnt =
+-				ptm_ds.ds_bg_mib[i].no_sop_byte_cnt
+-				+ ptm_us.ds_bg_mib[i].no_sop_byte_cnt;
++				ptm_ds->ds_bg_mib[i].no_sop_byte_cnt
++				+ ptm_us->ds_bg_mib[i].no_sop_byte_cnt;
+ 			ptm_bonding_stats->ds_bg_mib[i].no_eop_pkt_cnt =
+-				ptm_ds.ds_bg_mib[i].no_eop_pkt_cnt
+-				+ ptm_us.ds_bg_mib[i].no_eop_pkt_cnt;
++				ptm_ds->ds_bg_mib[i].no_eop_pkt_cnt
++				+ ptm_us->ds_bg_mib[i].no_eop_pkt_cnt;
+ 			ptm_bonding_stats->ds_bg_mib[i].no_eop_frag_cnt =
+-				ptm_ds.ds_bg_mib[i].no_eop_frag_cnt
+-				+ ptm_us.ds_bg_mib[i].no_eop_frag_cnt;
++				ptm_ds->ds_bg_mib[i].no_eop_frag_cnt
++				+ ptm_us->ds_bg_mib[i].no_eop_frag_cnt;
+ 			ptm_bonding_stats->ds_bg_mib[i].no_eop_byte_cnt =
+-				ptm_ds.ds_bg_mib[i].no_eop_byte_cnt
+-				+ ptm_us.ds_bg_mib[i].no_eop_byte_cnt;
++				ptm_ds->ds_bg_mib[i].no_eop_byte_cnt
++				+ ptm_us->ds_bg_mib[i].no_eop_byte_cnt;
+ 			ptm_bonding_stats->ds_bg_mib[i].oversize_pkt_cnt =
+-				ptm_ds.ds_bg_mib[i].oversize_pkt_cnt
+-				+ ptm_us.ds_bg_mib[i].oversize_pkt_cnt;
++				ptm_ds->ds_bg_mib[i].oversize_pkt_cnt
++				+ ptm_us->ds_bg_mib[i].oversize_pkt_cnt;
+ 			ptm_bonding_stats->ds_bg_mib[i].oversize_frag_cnt =
+-				ptm_ds.ds_bg_mib[i].oversize_frag_cnt
+-				+ ptm_us.ds_bg_mib[i].oversize_frag_cnt;
++				ptm_ds->ds_bg_mib[i].oversize_frag_cnt
++				+ ptm_us->ds_bg_mib[i].oversize_frag_cnt;
+ 			ptm_bonding_stats->ds_bg_mib[i].oversize_byte_cnt =
+-				ptm_ds.ds_bg_mib[i].oversize_byte_cnt
+-				+ ptm_us.ds_bg_mib[i].oversize_byte_cnt;
++				ptm_ds->ds_bg_mib[i].oversize_byte_cnt
++				+ ptm_us->ds_bg_mib[i].oversize_byte_cnt;
+ 			ptm_bonding_stats->ds_bg_mib[i].noncosec_pkt_cnt =
+-				ptm_ds.ds_bg_mib[i].noncosec_pkt_cnt
+-				+ ptm_us.ds_bg_mib[i].noncosec_pkt_cnt;
++				ptm_ds->ds_bg_mib[i].noncosec_pkt_cnt
++				+ ptm_us->ds_bg_mib[i].noncosec_pkt_cnt;
+ 			ptm_bonding_stats->ds_bg_mib[i].noncosec_frag_cnt =
+-				ptm_ds.ds_bg_mib[i].noncosec_frag_cnt
+-				+ ptm_us.ds_bg_mib[i].noncosec_frag_cnt;
++				ptm_ds->ds_bg_mib[i].noncosec_frag_cnt
++				+ ptm_us->ds_bg_mib[i].noncosec_frag_cnt;
+ 			ptm_bonding_stats->ds_bg_mib[i].noncosec_byte_cnt =
+-				ptm_ds.ds_bg_mib[i].noncosec_byte_cnt
+-				+ ptm_us.ds_bg_mib[i].noncosec_byte_cnt;
++				ptm_ds->ds_bg_mib[i].noncosec_byte_cnt
++				+ ptm_us->ds_bg_mib[i].noncosec_byte_cnt;
+ 		}
++		kfree(ptm_us);
++free_ptm_ds:
++		kfree(ptm_ds);
+ 	}
+-	return 0;
++free_rx_mib:
++	kfree(rx_mib);
++	return ret;
+ }
+ static int ptm_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+ {
diff --git a/package/kernel/leds-ws2812b/Makefile b/package/kernel/leds-ws2812b/Makefile
new file mode 100644
index 00000000000000..453d2590f653d1
--- /dev/null
+++ b/package/kernel/leds-ws2812b/Makefile
@@ -0,0 +1,34 @@
+#
+# Copyright (C) 2008-2010 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_NAME:=leds-ws2812b
+PKG_RELEASE:=1
+PKG_LICENSE:=GPL-2.0
+
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/leds-ws2812b
+  SUBMENU:=LED modules
+  TITLE:=Worldsemi WS2812B (NeoPixel) LED support
+  FILES:= \
+	$(PKG_BUILD_DIR)/leds-ws2812b.ko
+  AUTOLOAD:=$(call AutoProbe,leds-ws2812b,1)
+  DEPENDS:=@TARGET_mediatek_filogic
+endef
+
+define KernelPackage/leds-ws2812b/description
+  LED support for driving WS2812B (NeoPixel) using SPI MOSI.
+endef
+
+define Build/Compile
+	$(KERNEL_MAKE) M="$(PKG_BUILD_DIR)" modules
+endef
+
+$(eval $(call KernelPackage,leds-ws2812b))
diff --git a/package/kernel/leds-ws2812b/src/Makefile b/package/kernel/leds-ws2812b/src/Makefile
new file mode 100644
index 00000000000000..718a9f708de398
--- /dev/null
+++ b/package/kernel/leds-ws2812b/src/Makefile
@@ -0,0 +1 @@
+obj-m := leds-ws2812b.o
diff --git a/package/kernel/leds-ws2812b/src/leds-ws2812b.c b/package/kernel/leds-ws2812b/src/leds-ws2812b.c
new file mode 100644
index 00000000000000..b0d13f52427fbe
--- /dev/null
+++ b/package/kernel/leds-ws2812b/src/leds-ws2812b.c
@@ -0,0 +1,233 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * WorldSemi WS2812B individually-addressable LED driver using SPI
+ *
+ * Copyright 2022 Chuanhong Guo <gch981213@gmail.com>
+ *
+ * This driver simulates WS2812B protocol using SPI MOSI pin. A one pulse
+ * is transferred as 3'b110 and a zero pulse is 3'b100. For this driver to
+ * work properly, the SPI frequency should be 2.105MHz~2.85MHz and it needs
+ * to transfer all the bytes continuously.
+ */
+
+#include <linux/led-class-multicolor.h>
+#include <linux/leds.h>
+#include <linux/module.h>
+#include <linux/of_device.h>
+#include <linux/property.h>
+#include <linux/spi/spi.h>
+#include <linux/mutex.h>
+
+#define WS2812B_BYTES_PER_COLOR 3
+#define WS2812B_NUM_COLORS 3
+/* A continuous 0 for 50us+ as the 'reset' signal */
+#define WS2812B_RESET_LEN 18
+
+struct ws2812b_led {
+	struct led_classdev_mc mc_cdev;
+	struct mc_subled subled[WS2812B_NUM_COLORS];
+	int cascade;
+};
+
+struct ws2812b_priv {
+	struct led_classdev ldev;
+	struct spi_device *spi;
+	struct mutex mutex;
+	int num_leds;
+	size_t data_len;
+	u8 *data_buf;
+	struct ws2812b_led leds[];
+};
+
+/**
+ * ws2812b_set_byte - convert a byte of data to 3-byte SPI data for pulses
+ * @priv: pointer to the private data structure
+ * @offset: offset of the target byte in the data stream
+ * @val: 1-byte data to be set
+ *
+ * WS2812B receives a stream of bytes from DI, takes the first 3 byte as LED
+ * brightness and pases the rest to the next LED through the DO pin.
+ * This function assembles a single byte of data to the LED:
+ * A bit is represented with a pulse of specific length. A long pulse is a 1
+ * and a short pulse is a 0.
+ * SPI transfers data continuously, MSB first. We can send 3'b100 to create a
+ * 0 pulse and 3'b110 for a 1 pulse. In this way, a byte of data takes up 3
+ * bytes in a SPI transfer:
+ *  1x0 1x0 1x0 1x0 1x0 1x0 1x0 1x0
+ * Let's rearrange it in 8 bits:
+ *  1x01x01x 01x01x01 x01x01x0
+ * The higher 3 bits, middle 2 bits and lower 3 bits are represented with the
+ * 1st, 2nd and 3rd byte in the SPI transfer respectively.
+ * There are only 8 combinations for 3 bits and 4 for 2 bits, so we can create
+ * a lookup table for the 3 bytes.
+ * e.g. For 0x6b -> 2'b01101011:
+ *  Bit 7-5: 3'b011 -> 10011011 -> 0x9b
+ *  Bit 4-3: 2'b01  -> 01001101 -> 0x4d
+ *  Bit 2-0: 3'b011 -> 00110110 -> 0x36
+ */
+static void ws2812b_set_byte(struct ws2812b_priv *priv, size_t offset, u8 val)
+{
+	/* The lookup table for Bit 7-5 4-3 2-0 */
+	const u8 h3b[] = { 0x92, 0x93, 0x9a, 0x9b, 0xd2, 0xd3, 0xda, 0xdb };
+	const u8 m2b[] = { 0x49, 0x4d, 0x69, 0x6d };
+	const u8 l3b[] = { 0x24, 0x26, 0x34, 0x36, 0xa4, 0xa6, 0xb4, 0xb6 };
+	u8 *p = priv->data_buf + WS2812B_RESET_LEN + (offset * WS2812B_BYTES_PER_COLOR);
+
+	p[0] = h3b[val >> 5]; /* Bit 7-5 */
+	p[1] = m2b[(val >> 3) & 0x3]; /* Bit 4-3 */
+	p[2] = l3b[val & 0x7]; /* Bit 2-0 */
+}
+
+static int ws2812b_set(struct led_classdev *cdev,
+		       enum led_brightness brightness)
+{
+	struct led_classdev_mc *mc_cdev = lcdev_to_mccdev(cdev);
+	struct ws2812b_led *led =
+		container_of(mc_cdev, struct ws2812b_led, mc_cdev);
+	struct ws2812b_priv *priv = dev_get_drvdata(cdev->dev->parent);
+	int ret;
+	int i;
+
+	led_mc_calc_color_components(mc_cdev, brightness);
+
+	mutex_lock(&priv->mutex);
+	for (i = 0; i < WS2812B_NUM_COLORS; i++)
+		ws2812b_set_byte(priv, led->cascade * WS2812B_NUM_COLORS + i,
+				 led->subled[i].brightness);
+	ret = spi_write(priv->spi, priv->data_buf, priv->data_len);
+	mutex_unlock(&priv->mutex);
+
+	return ret;
+}
+
+static int ws2812b_probe(struct spi_device *spi)
+{
+	struct device *dev = &spi->dev;
+	int cur_led = 0;
+	struct ws2812b_priv *priv;
+	struct fwnode_handle *led_node;
+	int num_leds, i, cnt, ret;
+
+	num_leds = device_get_child_node_count(dev);
+
+	priv = devm_kzalloc(dev, struct_size(priv, leds, num_leds), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+	priv->data_len =
+		num_leds * WS2812B_BYTES_PER_COLOR * WS2812B_NUM_COLORS +
+		WS2812B_RESET_LEN;
+	priv->data_buf = kzalloc(priv->data_len, GFP_KERNEL);
+	if (!priv->data_buf)
+		return -ENOMEM;
+
+	for (i = 0; i < num_leds * WS2812B_NUM_COLORS; i++)
+		ws2812b_set_byte(priv, i, 0);
+
+	mutex_init(&priv->mutex);
+	priv->num_leds = num_leds;
+	priv->spi = spi;
+
+	device_for_each_child_node(dev, led_node) {
+		struct led_init_data init_data = {
+			.fwnode = led_node,
+		};
+		/* WS2812B LEDs usually come with GRB color */
+		u32 color_idx[WS2812B_NUM_COLORS] = {
+			LED_COLOR_ID_GREEN,
+			LED_COLOR_ID_RED,
+			LED_COLOR_ID_BLUE,
+		};
+		u32 cascade;
+
+		ret = fwnode_property_read_u32(led_node, "reg", &cascade);
+		if (ret) {
+			dev_err(dev, "failed to obtain numerical LED index for %s",
+				fwnode_get_name(led_node));
+			goto ERR_UNREG_LEDS;
+		}
+		if (cascade >= num_leds) {
+			dev_err(dev, "LED index of %s is larger than the number of LEDs.",
+				fwnode_get_name(led_node));
+			ret = -EINVAL;
+			goto ERR_UNREG_LEDS;
+		}
+
+		cnt = fwnode_property_count_u32(led_node, "color-index");
+		if (cnt > 0 && cnt <= WS2812B_NUM_COLORS)
+			fwnode_property_read_u32_array(led_node, "color-index",
+						       color_idx, (size_t)cnt);
+
+		priv->leds[cur_led].mc_cdev.subled_info =
+			priv->leds[cur_led].subled;
+		priv->leds[cur_led].mc_cdev.num_colors = WS2812B_NUM_COLORS;
+		priv->leds[cur_led].mc_cdev.led_cdev.max_brightness = 255;
+		priv->leds[cur_led].mc_cdev.led_cdev.brightness_set_blocking = ws2812b_set;
+
+		for (i = 0; i < WS2812B_NUM_COLORS; i++) {
+			priv->leds[cur_led].subled[i].color_index = color_idx[i];
+			priv->leds[cur_led].subled[i].intensity = 255;
+		}
+
+		priv->leds[cur_led].cascade = cascade;
+
+		ret = led_classdev_multicolor_register_ext(
+			dev, &priv->leds[cur_led].mc_cdev, &init_data);
+		if (ret) {
+			dev_err(dev, "registration of %s failed.",
+				fwnode_get_name(led_node));
+			goto ERR_UNREG_LEDS;
+		}
+		cur_led++;
+	}
+
+	spi_set_drvdata(spi, priv);
+
+	return 0;
+ERR_UNREG_LEDS:
+	for (; cur_led >= 0; cur_led--)
+		led_classdev_multicolor_unregister(&priv->leds[cur_led].mc_cdev);
+	mutex_destroy(&priv->mutex);
+	kfree(priv->data_buf);
+	return ret;
+}
+
+static int ws2812b_remove(struct spi_device *spi)
+{
+	struct ws2812b_priv *priv = spi_get_drvdata(spi);
+	int cur_led;
+
+	for (cur_led = priv->num_leds - 1; cur_led >= 0; cur_led--)
+		led_classdev_multicolor_unregister(&priv->leds[cur_led].mc_cdev);
+	kfree(priv->data_buf);
+	mutex_destroy(&priv->mutex);
+
+	return 0;
+}
+
+static const struct spi_device_id ws2812b_spi_ids[] = {
+	{ "ws2812b" },
+	{},
+};
+MODULE_DEVICE_TABLE(spi, ws2812b_spi_ids);
+
+static const struct of_device_id ws2812b_dt_ids[] = {
+	{ .compatible = "worldsemi,ws2812b" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, ws2812b_dt_ids);
+
+static struct spi_driver ws2812b_driver = {
+	.probe		= ws2812b_probe,
+	.remove		= ws2812b_remove,
+	.id_table	= ws2812b_spi_ids,
+	.driver = {
+		.name		= KBUILD_MODNAME,
+		.of_match_table	= ws2812b_dt_ids,
+	},
+};
+
+module_spi_driver(ws2812b_driver);
+
+MODULE_AUTHOR("Chuanhong Guo <gch981213@gmail.com>");
+MODULE_DESCRIPTION("WS2812B LED driver using SPI");
+MODULE_LICENSE("GPL");
diff --git a/package/kernel/linux/Makefile b/package/kernel/linux/Makefile
index 9fa68d78f722f4..ff917602701ab6 100644
--- a/package/kernel/linux/Makefile
+++ b/package/kernel/linux/Makefile
@@ -12,7 +12,9 @@ PKG_NAME:=kernel
 PKG_FLAGS:=hold
 
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/packages
-SCAN_DEPS=modules/*.mk $(TOPDIR)/target/linux/*/modules.mk $(TOPDIR)/include/netfilter.mk
+SUBTARGETS = $(sort $(filter-out feeds,$(notdir $(wildcard $(TOPDIR)/target/linux/* $(TOPDIR)/target/linux/feeds/*))))
+SUBTARGET_MODULES = $(foreach t,$(SUBTARGETS),$(firstword $(wildcard $(TOPDIR)/target/linux/feeds/$(t)/modules.mk $(TOPDIR)/target/linux/$(t)/modules.mk)))
+SCAN_DEPS=modules/*.mk $(SUBTARGET_MODULES) $(TOPDIR)/include/netfilter.mk
 
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=
@@ -63,4 +65,4 @@ endef
 $(eval $(if $(DUMP),,$(call BuildPackage,kernel)))
 
 include $(sort $(wildcard ./modules/*.mk))
--include $(TOPDIR)/target/linux/*/modules.mk
+-include $(SUBTARGET_MODULES)
diff --git a/package/kernel/linux/files/hotplug-sched-teql.sh b/package/kernel/linux/files/hotplug-sched-teql.sh
index a0c0e503aa6e9b..2dc4ed4a84246e 100644
--- a/package/kernel/linux/files/hotplug-sched-teql.sh
+++ b/package/kernel/linux/files/hotplug-sched-teql.sh
@@ -12,7 +12,7 @@ config_get teql $INTERFACE teql
 
 if [ "$teql" != "" ]; then
     logger Adding device $DEVICE to TEQL master $teql
-    insmod sch_teql
+    modprobe sch_teql
     tc qdisc add dev $DEVICE root $teql
 
     # The kernel doesn't let us bring it up until it has at least one
diff --git a/package/kernel/linux/modules/block.mk b/package/kernel/linux/modules/block.mk
index 8affa722963ee9..bdf84e8ae29b23 100644
--- a/package/kernel/linux/modules/block.mk
+++ b/package/kernel/linux/modules/block.mk
@@ -90,21 +90,6 @@ endef
 $(eval $(call KernelPackage,ata-artop))
 
 
-define KernelPackage/ata-marvell-sata
-  TITLE:=Marvell Serial ATA support
-  KCONFIG:=CONFIG_SATA_MV
-  FILES:=$(LINUX_DIR)/drivers/ata/sata_mv.ko
-  AUTOLOAD:=$(call AutoLoad,41,sata_mv,1)
-  $(call AddDepends/ata)
-endef
-
-define KernelPackage/ata-marvell-sata/description
- SATA support for marvell chipsets
-endef
-
-$(eval $(call KernelPackage,ata-marvell-sata))
-
-
 define KernelPackage/ata-nvidia-sata
   TITLE:=Nvidia Serial ATA support
   KCONFIG:=CONFIG_SATA_NV
@@ -536,13 +521,13 @@ define KernelPackage/scsi-core
   TITLE:=SCSI device support
   KCONFIG:= \
 	CONFIG_SCSI \
-	CONFIG_SCSI_COMMON@ge5.15 \
+	CONFIG_SCSI_COMMON \
 	CONFIG_BLK_DEV_SD
   FILES:= \
 	$(LINUX_DIR)/drivers/scsi/scsi_mod.ko \
-	$(LINUX_DIR)/drivers/scsi/scsi_common.ko@ge5.15 \
+	$(LINUX_DIR)/drivers/scsi/scsi_common.ko \
 	$(LINUX_DIR)/drivers/scsi/sd_mod.ko
-  AUTOLOAD:=$(call AutoLoad,40,scsi_mod scsi_common@ge5.15 sd_mod,1)
+  AUTOLOAD:=$(call AutoLoad,40,scsi_mod scsi_common sd_mod,1)
 endef
 
 $(eval $(call KernelPackage,scsi-core))
diff --git a/package/kernel/linux/modules/can.mk b/package/kernel/linux/modules/can.mk
index 9cdebb9091a67d..4ff85d1c01379d 100644
--- a/package/kernel/linux/modules/can.mk
+++ b/package/kernel/linux/modules/can.mk
@@ -152,7 +152,7 @@ define KernelPackage/can-mcp251x
 	CONFIG_SPI=y \
 	CONFIG_CAN_MCP251X
   FILES:=$(LINUX_DIR)/drivers/net/can/spi/mcp251x.ko
-  AUTOLOAD:=$(call AutoProbe,can-mcp251x)
+  AUTOLOAD:=$(call AutoProbe,mcp251x)
   $(call AddDepends/can)
 endef
 
diff --git a/package/kernel/linux/modules/crypto.mk b/package/kernel/linux/modules/crypto.mk
index f8af5f0a3bb2fb..248b4d68f9e14a 100644
--- a/package/kernel/linux/modules/crypto.mk
+++ b/package/kernel/linux/modules/crypto.mk
@@ -52,6 +52,7 @@ $(eval $(call KernelPackage,crypto-aead))
 
 define KernelPackage/crypto-arc4
   TITLE:=ARC4 cipher CryptoAPI module
+  DEPENDS:=+kmod-crypto-user
   KCONFIG:= \
 	  CONFIG_CRYPTO_ARC4 \
 	  CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE=y
@@ -541,7 +542,7 @@ define KernelPackage/crypto-lib-curve25519/config
   imply PACKAGE_kmod-crypto-kpp
 endef
 
-define KernelPackage/crypto-lib-curve25519/x86/64
+define KernelPackage/crypto-lib-curve25519/x86_64
   KCONFIG+=CONFIG_CRYPTO_CURVE25519_X86
   FILES+=$(LINUX_DIR)/arch/x86/crypto/curve25519-x86_64.ko
 endef
@@ -556,6 +557,11 @@ ifeq ($(ARCH)-$(CONFIG_KERNEL_MODE_NEON),arm-y)
 	  $(KernelPackage/crypto-lib-curve25519/arm-neon)
 endif
 
+ifdef KernelPackage/crypto-lib-curve25519/$(ARCH)
+  KernelPackage/crypto-lib-curve25519/$(CRYPTO_TARGET)=\
+	  $(KernelPackage/crypto-lib-curve25519/$(ARCH))
+endif
+
 $(eval $(call KernelPackage,crypto-lib-curve25519))
 
 
@@ -646,11 +652,16 @@ define KernelPackage/crypto-md5/octeon
   AUTOLOAD+=$(call AutoLoad,09,octeon-md5)
 endef
 
-define KernelPackage/crypto-md5/mpc85xx
+define KernelPackage/crypto-md5/powerpc
   FILES+=$(LINUX_DIR)/arch/powerpc/crypto/md5-ppc.ko
   AUTOLOAD+=$(call AutoLoad,09,md5-ppc)
 endef
 
+ifdef KernelPackage/crypto-md5/$(ARCH)
+  KernelPackage/crypto-md5/$(CRYPTO_TARGET)=\
+	  $(KernelPackage/crypto-md5/$(ARCH))
+endif
+
 $(eval $(call KernelPackage,crypto-md5))
 
 
@@ -668,7 +679,7 @@ $(eval $(call KernelPackage,crypto-michael-mic))
 
 define KernelPackage/crypto-misc
   TITLE:=Other CryptoAPI modules
-  DEPENDS:=+kmod-crypto-xts
+  DEPENDS:=+kmod-crypto-xts +kmod-crypto-user
   KCONFIG:= \
 	CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE=y \
 	CONFIG_CRYPTO_CAMELLIA_X86_64 \
@@ -693,7 +704,6 @@ define KernelPackage/crypto-misc
 	CONFIG_CRYPTO_KHAZAD \
 	CONFIG_CRYPTO_SERPENT \
 	CONFIG_CRYPTO_TEA \
-	CONFIG_CRYPTO_TGR192@lt5.12 \
 	CONFIG_CRYPTO_TWOFISH \
 	CONFIG_CRYPTO_TWOFISH_COMMON \
 	CONFIG_CRYPTO_TWOFISH_586 \
@@ -706,7 +716,6 @@ define KernelPackage/crypto-misc
 	$(LINUX_DIR)/crypto/cast6_generic.ko \
 	$(LINUX_DIR)/crypto/khazad.ko \
 	$(LINUX_DIR)/crypto/tea.ko \
-	$(LINUX_DIR)/crypto/tgr192.ko@lt5.12 \
 	$(LINUX_DIR)/crypto/twofish_common.ko \
 	$(LINUX_DIR)/crypto/wp512.ko \
 	$(LINUX_DIR)/crypto/twofish_generic.ko \
@@ -714,7 +723,7 @@ define KernelPackage/crypto-misc
 	$(LINUX_DIR)/crypto/blowfish_generic.ko \
 	$(LINUX_DIR)/crypto/serpent_generic.ko
   AUTOLOAD:=$(call AutoLoad,10,anubis camellia_generic cast_common \
-	cast5_generic cast6_generic khazad tea tgr192@lt5.12 twofish_common \
+	cast5_generic cast6_generic khazad tea twofish_common \
 	wp512 blowfish_common serpent_generic)
   ifndef CONFIG_TARGET_x86
 	AUTOLOAD+= $(call AutoLoad,10,twofish_generic blowfish_generic)
@@ -727,15 +736,14 @@ ifndef CONFIG_TARGET_x86_64
     FILES+= \
 	$(LINUX_DIR)/arch/x86/crypto/twofish-i586.ko \
 	$(LINUX_DIR)/arch/x86/crypto/serpent-sse2-i586.ko \
-	$(LINUX_DIR)/arch/x86/crypto/glue_helper.ko \
 	$(LINUX_DIR)/crypto/cryptd.ko \
 	$(LINUX_DIR)/crypto/crypto_simd.ko
-    AUTOLOAD+= $(call AutoLoad,10,cryptd glue_helper \
+    AUTOLOAD+= $(call AutoLoad,10,cryptd \
 	serpent-sse2-i586 twofish-i586 blowfish_generic)
   endef
 endif
 
-define KernelPackage/crypto-misc/x86/64
+define KernelPackage/crypto-misc/x86_64
   FILES+= \
 	$(LINUX_DIR)/arch/x86/crypto/camellia-x86_64.ko \
 	$(LINUX_DIR)/arch/x86/crypto/blowfish-x86_64.ko \
@@ -755,6 +763,11 @@ define KernelPackage/crypto-misc/x86/64
 	twofish-avx-x86_64 blowfish-x86_64 serpent-avx-x86_64 serpent-avx2)
 endef
 
+ifdef KernelPackage/crypto-misc/$(ARCH)
+  KernelPackage/crypto-misc/$(CRYPTO_TARGET)=\
+	  $(KernelPackage/crypto-misc/$(ARCH))
+endif
+
 $(eval $(call KernelPackage,crypto-misc))
 
 
@@ -811,7 +824,7 @@ $(eval $(call KernelPackage,crypto-rmd160))
 
 define KernelPackage/crypto-rng
   TITLE:=CryptoAPI random number generation
-  DEPENDS:=+kmod-crypto-hash +kmod-crypto-hmac +kmod-crypto-sha256
+  DEPENDS:=+kmod-crypto-hash +kmod-crypto-hmac +kmod-crypto-sha512
   KCONFIG:= \
 	CONFIG_CRYPTO_DRBG \
 	CONFIG_CRYPTO_DRBG_HMAC=y \
@@ -884,10 +897,17 @@ define KernelPackage/crypto-sha1/mpc85xx
   AUTOLOAD+=$(call AutoLoad,09,sha1-ppc-spe)
 endef
 
-define KernelPackage/crypto-sha1/x86/64
+ifndef CONFIG_TARGET_uml
+define KernelPackage/crypto-sha1/x86_64
   FILES+=$(LINUX_DIR)/arch/x86/crypto/sha1-ssse3.ko
   AUTOLOAD+=$(call AutoLoad,09,sha1-ssse3)
 endef
+endif
+
+ifdef KernelPackage/crypto-sha1/$(ARCH)
+  KernelPackage/crypto-sha1/$(CRYPTO_TARGET)=\
+	  $(KernelPackage/crypto-sha1/$(ARCH))
+endif
 
 $(eval $(call KernelPackage,crypto-sha1))
 
@@ -917,10 +937,17 @@ define KernelPackage/crypto-sha256/mpc85xx
   AUTOLOAD+=$(call AutoLoad,09,sha256-ppc-spe)
 endef
 
-define KernelPackage/crypto-sha256/x86/64
+ifndef CONFIG_TARGET_uml
+define KernelPackage/crypto-sha256/x86_64
   FILES+=$(LINUX_DIR)/arch/x86/crypto/sha256-ssse3.ko
   AUTOLOAD+=$(call AutoLoad,09,sha256-ssse3)
 endef
+endif
+
+ifdef KernelPackage/crypto-sha256/$(ARCH)
+  KernelPackage/crypto-sha256/$(CRYPTO_TARGET)=\
+	  $(KernelPackage/crypto-sha256/$(ARCH))
+endif
 
 $(eval $(call KernelPackage,crypto-sha256))
 
@@ -954,10 +981,17 @@ endef
 
 KernelPackage/crypto-sha512/tegra=$(KernelPackage/crypto-sha512/arm)
 
-define KernelPackage/crypto-sha512/x86/64
+ifndef CONFIG_TARGET_uml
+define KernelPackage/crypto-sha512/x86_64
   FILES+=$(LINUX_DIR)/arch/x86/crypto/sha512-ssse3.ko
   AUTOLOAD+=$(call AutoLoad,09,sha512-ssse3)
 endef
+endif
+
+ifdef KernelPackage/crypto-sha512/$(ARCH)
+  KernelPackage/crypto-sha512/$(CRYPTO_TARGET)=\
+	  $(KernelPackage/crypto-sha512/$(ARCH))
+endif
 
 $(eval $(call KernelPackage,crypto-sha512))
 
diff --git a/package/kernel/linux/modules/fs.mk b/package/kernel/linux/modules/fs.mk
index 3ad458286f450e..5fb9a2b7d64f51 100644
--- a/package/kernel/linux/modules/fs.mk
+++ b/package/kernel/linux/modules/fs.mk
@@ -10,7 +10,7 @@ FS_MENU:=Filesystems
 define KernelPackage/fs-9p
   SUBMENU:=$(FS_MENU)
   TITLE:=Plan 9 Resource Sharing Support
-  DEPENDS:=+kmod-9pnet
+  DEPENDS:=+kmod-9pnet +LINUX_6_1:kmod-fs-netfs
   KCONFIG:=\
 	CONFIG_9P_FS \
 	CONFIG_9P_FS_POSIX_ACL=n \
@@ -83,35 +83,48 @@ endef
 $(eval $(call KernelPackage,fs-btrfs))
 
 
+define KernelPackage/fs-smbfs-common
+  SUBMENU:=$(FS_MENU)
+  TITLE:=SMBFS common dependencies support
+  HIDDEN:=1
+  KCONFIG:=CONFIG_SMBFS_COMMON
+  FILES:= \
+	$(LINUX_DIR)/fs/smbfs_common/cifs_arc4.ko \
+	$(LINUX_DIR)/fs/smbfs_common/cifs_md4.ko
+endef
+
+define KernelPackage/fs-smbfs-common/description
+ Kernel module dependency for CIFS or SMB_SERVER support
+endef
+
+$(eval $(call KernelPackage,fs-smbfs-common))
+
+
 define KernelPackage/fs-cifs
   SUBMENU:=$(FS_MENU)
   TITLE:=CIFS support
   KCONFIG:= \
-	CONFIG_SMBFS_COMMON@ge5.15 \
 	CONFIG_CIFS \
 	CONFIG_CIFS_DFS_UPCALL=n \
 	CONFIG_CIFS_UPCALL=n
   FILES:= \
-	$(LINUX_DIR)/fs/smbfs_common/cifs_arc4.ko@ge5.15 \
-	$(LINUX_DIR)/fs/smbfs_common/cifs_md4.ko@ge5.15 \
 	$(LINUX_DIR)/fs/cifs/cifs.ko
   AUTOLOAD:=$(call AutoLoad,30,cifs)
   $(call AddDepends/nls)
   DEPENDS+= \
-    +LINUX_5_10:kmod-crypto-md4\
+    +kmod-fs-smbfs-common \
     +kmod-crypto-md5 \
     +kmod-crypto-sha256 \
     +kmod-crypto-sha512 \
     +kmod-crypto-cmac \
     +kmod-crypto-hmac \
-    +LINUX_5_10:kmod-crypto-arc4 \
     +kmod-crypto-aead \
     +kmod-crypto-ccm \
     +kmod-crypto-ecb \
     +kmod-crypto-des \
-    +(LINUX_5_15):kmod-asn1-decoder \
-    +(LINUX_5_15):kmod-oid-registry \
-    +(LINUX_5_15):kmod-dnsresolver
+    +kmod-asn1-decoder \
+    +kmod-oid-registry \
+    +kmod-dnsresolver
 endef
 
 define KernelPackage/fs-cifs/description
@@ -244,17 +257,6 @@ endef
 $(eval $(call KernelPackage,fs-f2fs))
 
 
-define KernelPackage/fs-netfs
-  SUBMENU:=$(FS_MENU)
-  TITLE:=Network Filesystems support
-  DEPENDS:=@LINUX_5_15
-  KCONFIG:= CONFIG_NETFS_SUPPORT
-  FILES:=$(LINUX_DIR)/fs/netfs/netfs.ko
-  AUTOLOAD:=$(call AutoLoad,28,netfs)
-endef
-
-$(eval $(call KernelPackage,fs-netfs))
-
 define KernelPackage/fs-fscache
   SUBMENU:=$(FS_MENU)
   TITLE:=General filesystem local cache manager
@@ -267,7 +269,9 @@ define KernelPackage/fs-fscache
 	CONFIG_FSCACHE_OBJECT_LIST=n \
 	CONFIG_CACHEFILES \
 	CONFIG_CACHEFILES_DEBUG=n \
-	CONFIG_CACHEFILES_HISTOGRAM=n
+	CONFIG_CACHEFILES_HISTOGRAM=n \
+	CONFIG_CACHEFILES_ERROR_INJECTION=n@ge5.17 \
+	CONFIG_CACHEFILES_ONDEMAND=n@ge5.19
   FILES:= \
 	$(LINUX_DIR)/fs/fscache/fscache.ko \
 	$(LINUX_DIR)/fs/cachefiles/cachefiles.ko
@@ -343,6 +347,43 @@ endef
 
 $(eval $(call KernelPackage,fs-jfs))
 
+
+define KernelPackage/fs-ksmbd
+  SUBMENU:=$(FS_MENU)
+  TITLE:=SMB kernel server support
+  DEPENDS:= \
+	  +kmod-nls-base \
+	  +kmod-nls-utf8 \
+	  +kmod-crypto-md4 \
+          +kmod-crypto-md5 \
+	  +kmod-crypto-hmac \
+	  +kmod-crypto-ecb \
+	  +kmod-crypto-des \
+	  +kmod-crypto-sha256 \
+	  +kmod-crypto-cmac \
+	  +kmod-crypto-sha512 \
+	  +kmod-crypto-aead \
+	  +kmod-crypto-ccm \
+	  +kmod-crypto-gcm \
+	  +kmod-asn1-decoder \
+	  +kmod-oid-registry \
+	  +kmod-fs-smbfs-common
+  KCONFIG:= \
+	CONFIG_SMB_SERVER \
+	CONFIG_SMB_SERVER_SMBDIRECT=n \
+	CONFIG_SMB_SERVER_CHECK_CAP_NET_ADMIN=n \
+	CONFIG_SMB_SERVER_KERBEROS5=n
+  FILES:=$(LINUX_DIR)/fs/ksmbd/ksmbd.ko
+  AUTOLOAD:=$(call AutoLoad,41,ksmbd)
+endef
+
+define KernelPackage/fs-ksmbd/description
+ Kernel module for SMB kernel server support
+endef
+
+$(eval $(call KernelPackage,fs-ksmbd))
+
+
 define KernelPackage/fs-minix
   SUBMENU:=$(FS_MENU)
   TITLE:=Minix filesystem support
@@ -375,6 +416,17 @@ endef
 $(eval $(call KernelPackage,fs-msdos))
 
 
+define KernelPackage/fs-netfs
+  SUBMENU:=$(FS_MENU)
+  TITLE:=Network Filesystems support
+  KCONFIG:= CONFIG_NETFS_SUPPORT
+  FILES:=$(LINUX_DIR)/fs/netfs/netfs.ko
+  AUTOLOAD:=$(call AutoLoad,28,netfs)
+endef
+
+$(eval $(call KernelPackage,fs-netfs))
+
+
 define KernelPackage/fs-nfs
   SUBMENU:=$(FS_MENU)
   TITLE:=NFS filesystem client support
@@ -509,7 +561,7 @@ $(eval $(call KernelPackage,fs-nfsd))
 
 define KernelPackage/fs-ntfs
   SUBMENU:=$(FS_MENU)
-  TITLE:=NTFS filesystem support
+  TITLE:=NTFS filesystem read-only (old driver) support
   KCONFIG:=CONFIG_NTFS_FS
   FILES:=$(LINUX_DIR)/fs/ntfs/ntfs.ko
   AUTOLOAD:=$(call AutoLoad,30,ntfs)
@@ -517,31 +569,30 @@ define KernelPackage/fs-ntfs
 endef
 
 define KernelPackage/fs-ntfs/description
- Kernel module for NTFS filesystem support
+ Kernel module for limited NTFS filesystem support. Support for writing
+ is extremely limited and disabled as a result.
 endef
 
 $(eval $(call KernelPackage,fs-ntfs))
 
 
-define KernelPackage/pstore
+define KernelPackage/fs-ntfs3
   SUBMENU:=$(FS_MENU)
-  TITLE:=Pstore file system
-  DEFAULT:=m if ALL_KMODS
-  KCONFIG:= \
-	CONFIG_PSTORE \
-	CONFIG_PSTORE_COMPRESS=y \
-	CONFIG_PSTORE_COMPRESS_DEFAULT="deflate" \
-	CONFIG_PSTORE_DEFLATE_COMPRESS=y \
-	CONFIG_PSTORE_DEFLATE_COMPRESS_DEFAULT=y
-  FILES:= $(LINUX_DIR)/fs/pstore/pstore.ko
-  AUTOLOAD:=$(call AutoLoad,30,pstore,1)
+  TITLE:=NTFS filesystem read & write (new driver) support
+  KCONFIG:= CONFIG_NTFS3_FS CONFIG_NTFS3_FS_POSIX_ACL=y
+  FILES:=$(LINUX_DIR)/fs/ntfs3/ntfs3.ko
+  $(call AddDepends/nls)
+  AUTOLOAD:=$(call AutoLoad,80,ntfs3)
 endef
 
-define KernelPackage/pstore/description
- Kernel module for pstore filesystem support
+define KernelPackage/fs-ntfs3/description
+ Kernel module for fully functional NTFS filesystem support. It allows
+ reading as well as writing.
+
+ It supports NTFS versions up to 3.1.
 endef
 
-$(eval $(call KernelPackage,pstore))
+$(eval $(call KernelPackage,fs-ntfs3))
 
 
 define KernelPackage/fs-reiserfs
@@ -643,17 +694,22 @@ endef
 $(eval $(call KernelPackage,fuse))
 
 
-define KernelPackage/fs-ntfs3
+define KernelPackage/pstore
   SUBMENU:=$(FS_MENU)
-  TITLE:=Ntfs3 support
-  KCONFIG:= CONFIG_NTFS3_FS CONFIG_NTFS3_FS_POSIX_ACL=y
-  FILES:=$(LINUX_DIR)/fs/ntfs3/ntfs3.ko
-  $(call AddDepends/nls)
-  AUTOLOAD:=$(call AutoLoad,80,ntfs3)
+  TITLE:=Pstore file system
+  DEFAULT:=m if ALL_KMODS
+  KCONFIG:= \
+	CONFIG_PSTORE \
+	CONFIG_PSTORE_COMPRESS=y \
+	CONFIG_PSTORE_COMPRESS_DEFAULT="deflate" \
+	CONFIG_PSTORE_DEFLATE_COMPRESS=y \
+	CONFIG_PSTORE_DEFLATE_COMPRESS_DEFAULT=y
+  FILES:= $(LINUX_DIR)/fs/pstore/pstore.ko
+  AUTOLOAD:=$(call AutoLoad,30,pstore,1)
 endef
 
-define KernelPackage/fuse/description
- Kernel module for new NTFS3 filesystem support
+define KernelPackage/pstore/description
+ Kernel module for pstore filesystem support
 endef
 
-$(eval $(call KernelPackage,fs-ntfs3))
+$(eval $(call KernelPackage,pstore))
diff --git a/package/kernel/linux/modules/hwmon.mk b/package/kernel/linux/modules/hwmon.mk
index e0810c97bdcff2..23e32655b2c239 100644
--- a/package/kernel/linux/modules/hwmon.mk
+++ b/package/kernel/linux/modules/hwmon.mk
@@ -52,7 +52,7 @@ define KernelPackage/hwmon-adt7410
 	$(LINUX_DIR)/drivers/hwmon/adt7x10.ko \
 	$(LINUX_DIR)/drivers/hwmon/adt7410.ko
   AUTOLOAD:=$(call AutoLoad,60,adt7x10 adt7410)
-  $(call AddDepends/hwmon,+kmod-i2c-core)
+  $(call AddDepends/hwmon,+kmod-i2c-core +LINUX_6_1:kmod-regmap-core)
 endef
 
 define KernelPackage/hwmon-adt7410/description
@@ -108,6 +108,25 @@ endef
 $(eval $(call KernelPackage,hwmon-drivetemp))
 
 
+define KernelPackage/hwmon-gsc
+  TITLE:=Gateworks System Controller support
+  KCONFIG:=CONFIG_MFD_GATEWORKS_GSC \
+        CONFIG_SENSORS_GSC
+  FILES:= \
+	$(LINUX_DIR)/drivers/mfd/gateworks-gsc.ko \
+	$(LINUX_DIR)/drivers/hwmon/gsc-hwmon.ko
+  AUTOLOAD:=$(call AutoLoad,20,gsc-hwmon,1)
+  $(call AddDepends/hwmon,+kmod-i2c-core)
+endef
+
+define KernelPackage/hwmon-gsc/description
+ Kernel module for Gateworks System Controller with temperature sensor,
+ADCs, and FAN controller
+endef
+
+$(eval $(call KernelPackage,hwmon-gsc))
+
+
 define KernelPackage/hwmon-gpiofan
   TITLE:=Generic GPIO FAN support
   KCONFIG:=CONFIG_SENSORS_GPIO_FAN
@@ -335,6 +354,21 @@ endef
 $(eval $(call KernelPackage,hwmon-ltc4151))
 
 
+define KernelPackage/hwmon-max6642
+  TITLE:=MAX6642 monitoring support
+  KCONFIG:=CONFIG_SENSORS_MAX6642
+  FILES:=$(LINUX_DIR)/drivers/hwmon/max6642.ko
+  AUTOLOAD:=$(call AutoLoad,60,max6642 max6642)
+  $(call AddDepends/hwmon,+kmod-i2c-core)
+endef
+
+define KernelPackage/hwmon-max6642/description
+ Kernel module for Maxim MAX6642 temperature monitor
+endef
+
+$(eval $(call KernelPackage,hwmon-max6642))
+
+
 define KernelPackage/hwmon-mcp3021
   TITLE:=MCP3021/3221 monitoring support
   KCONFIG:=CONFIG_SENSORS_MCP3021
@@ -474,6 +508,21 @@ endef
 $(eval $(call KernelPackage,hwmon-sht21))
 
 
+define KernelPackage/hwmon-sht3x
+  TITLE:=Sensiron SHT3x and compat. monitoring support
+  KCONFIG:=CONFIG_SENSORS_SHT3x
+  FILES:=$(LINUX_DIR)/drivers/hwmon/sht3x.ko
+  AUTOLOAD:=$(call AutoProbe,sht3x)
+  $(call AddDepends/hwmon,+kmod-i2c-core +kmod-lib-crc8)
+endef
+
+define KernelPackage/hwmon-sht3x/description
+ Kernel module for Sensirion SHT3x temperature and humidity sensors chip
+endef
+
+$(eval $(call KernelPackage,hwmon-sht3x))
+
+
 define KernelPackage/hwmon-tmp102
   TITLE:=Texas Instruments TMP102 monitoring support
   KCONFIG:=CONFIG_SENSORS_TMP102
diff --git a/package/kernel/linux/modules/i2c.mk b/package/kernel/linux/modules/i2c.mk
index 15fd1ccddc423c..1c65a26edceaf3 100644
--- a/package/kernel/linux/modules/i2c.mk
+++ b/package/kernel/linux/modules/i2c.mk
@@ -84,6 +84,20 @@ endef
 $(eval $(call KernelPackage,i2c-algo-pcf))
 
 
+I2C_CCGS_UCSI_MODULES:= \
+  CONFIG_I2C_CCGX_UCSI:drivers/i2c/busses/i2c-ccgx-ucsi
+
+define KernelPackage/i2c-ccgs-ucsi
+  $(call i2c_defaults,$(I2C_CCGS_UCSI_MODULES),58)
+  TITLE:=Cypress CCGx Type-C controller
+  DEPENDS:=+kmod-i2c-core +kmod-regmap-core
+  HIDDEN:=y
+endef
+
+
+$(eval $(call KernelPackage,i2c-ccgs-ucsi))
+
+
 I2C_DWCORE_MODULES:= \
   CONFIG_I2C_DESIGNWARE_CORE:drivers/i2c/busses/i2c-designware-core
 
@@ -103,7 +117,7 @@ I2C_DWPCI_MODULES:= \
 define KernelPackage/i2c-designware-pci
   $(call i2c_defaults,$(I2C_DWPCI_MODULES),59)
   TITLE:=Synopsys DesignWare PCI
-  DEPENDS:=+kmod-i2c-designware-core
+  DEPENDS:=@PCI_SUPPORT +kmod-i2c-designware-core +kmod-i2c-ccgs-ucsi
 endef
 
 define KernelPackage/i2c-designware-pci/description
diff --git a/package/kernel/linux/modules/iio.mk b/package/kernel/linux/modules/iio.mk
index a4b2ee93e937ec..f901f87ddd512e 100644
--- a/package/kernel/linux/modules/iio.mk
+++ b/package/kernel/linux/modules/iio.mk
@@ -25,14 +25,17 @@ endef
 
 $(eval $(call KernelPackage,iio-core))
 
+define AddDepends/iio
+  SUBMENU:=$(IIO_MENU)
+  DEPENDS+=+kmod-iio-core $(1)
+endef
 
 define KernelPackage/iio-kfifo-buf
-  SUBMENU:=$(IIO_MENU)
   TITLE:=Industrial I/O buffering based on kfifo
-  DEPENDS:=+kmod-iio-core
   KCONFIG:=CONFIG_IIO_KFIFO_BUF
   FILES:=$(LINUX_DIR)/drivers/iio/buffer/kfifo_buf.ko
   AUTOLOAD:=$(call AutoLoad,55,kfifo_buf)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-kfifo-buf/description
@@ -44,12 +47,12 @@ $(eval $(call KernelPackage,iio-kfifo-buf))
 
 
 define KernelPackage/industrialio-triggered-buffer
-  SUBMENU:=$(IIO_MENU)
   TITLE:=Provides helper functions for setting up triggered buffers.
-  DEPENDS:=+kmod-iio-core +kmod-iio-kfifo-buf
+  DEPENDS:=+kmod-iio-kfifo-buf
   KCONFIG:=CONFIG_IIO_TRIGGERED_BUFFER
   FILES:=$(LINUX_DIR)/drivers/iio/buffer/industrialio-triggered-buffer.ko
   AUTOLOAD:=$(call AutoLoad,55,industrialio-triggered-buffer)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/industrialio-triggered-buffer/description
@@ -60,14 +63,14 @@ $(eval $(call KernelPackage,industrialio-triggered-buffer))
 
 
 define KernelPackage/iio-ad799x
-  SUBMENU:=$(IIO_MENU)
-  DEPENDS:=+kmod-i2c-core +kmod-iio-core +kmod-industrialio-triggered-buffer
+  DEPENDS:=+kmod-i2c-core +kmod-industrialio-triggered-buffer
   TITLE:=Analog Devices AD799x ADC driver
   KCONFIG:= \
 	CONFIG_AD799X_RING_BUFFER=y \
 	CONFIG_AD799X
   FILES:=$(LINUX_DIR)/drivers/iio/adc/ad799x.ko
   AUTOLOAD:=$(call AutoLoad,56,ad799x)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-ad799x/description
@@ -79,12 +82,12 @@ endef
 $(eval $(call KernelPackage,iio-ad799x))
 
 define KernelPackage/iio-ads1015
-  SUBMENU:=$(IIO_MENU)
-  DEPENDS:=+kmod-i2c-core +kmod-iio-core +kmod-regmap-i2c +kmod-industrialio-triggered-buffer
+  DEPENDS:=+kmod-i2c-core +kmod-regmap-i2c +kmod-industrialio-triggered-buffer
   TITLE:=Texas Instruments ADS1015 ADC driver
   KCONFIG:= CONFIG_TI_ADS1015
   FILES:=$(LINUX_DIR)/drivers/iio/adc/ti-ads1015.ko
   AUTOLOAD:=$(call AutoLoad,56,ti-ads1015)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-ads1015/description
@@ -94,14 +97,14 @@ endef
 $(eval $(call KernelPackage,iio-ads1015))
 
 define KernelPackage/iio-hmc5843
-  SUBMENU:=$(IIO_MENU)
-  DEPENDS:=+kmod-i2c-core +kmod-iio-core +kmod-regmap-i2c +kmod-industrialio-triggered-buffer
+  DEPENDS:=+kmod-i2c-core +kmod-regmap-i2c +kmod-industrialio-triggered-buffer
   TITLE:=Honeywell HMC58x3 Magnetometer
   KCONFIG:= CONFIG_SENSORS_HMC5843_I2C
   FILES:= \
       $(LINUX_DIR)/drivers/iio/magnetometer/hmc5843_i2c.ko \
       $(LINUX_DIR)/drivers/iio/magnetometer/hmc5843_core.ko
   AUTOLOAD:=$(call AutoLoad,56,hmc5843)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-hmc5843/description
@@ -111,12 +114,12 @@ endef
 $(eval $(call KernelPackage,iio-hmc5843))
 
 define KernelPackage/iio-bh1750
-  SUBMENU:=$(IIO_MENU)
-  DEPENDS:=+kmod-i2c-core +kmod-iio-core
+  DEPENDS:=+kmod-i2c-core
   TITLE:=ROHM BH1750 ambient light sensor
   KCONFIG:= CONFIG_BH1750
   FILES:=$(LINUX_DIR)/drivers/iio/light/bh1750.ko
   AUTOLOAD:=$(call AutoLoad,56,bh1750)
+  $(call AddDepends/iio)
 endef
 define KernelPackage/iio-bh1750/description
   ROHM BH1750 ambient light sensor (i2c bus)
@@ -124,12 +127,12 @@ endef
 $(eval $(call KernelPackage,iio-bh1750))
 
 define KernelPackage/iio-am2315
-  SUBMENU:=$(IIO_MENU)
-  DEPENDS:=+kmod-i2c-core +kmod-iio-core +kmod-industrialio-triggered-buffer
+  DEPENDS:=+kmod-i2c-core +kmod-industrialio-triggered-buffer
   TITLE:=Asong AM2315 humidity/temperature sensor
   KCONFIG:= CONFIG_AM2315
   FILES:=$(LINUX_DIR)/drivers/iio/humidity/am2315.ko
   AUTOLOAD:=$(call AutoLoad,56,am2315)
+  $(call AddDepends/iio)
 endef
 define KernelPackage/iio-am2315/description
   Aosong AM2315 humidity/temperature sensor (I2C bus)
@@ -137,13 +140,13 @@ endef
 $(eval $(call KernelPackage,iio-am2315))
 
 define KernelPackage/iio-mxs-lradc
-  SUBMENU:=$(IIO_MENU)
-  DEPENDS:=@TARGET_mxs +kmod-iio-core +kmod-industrialio-triggered-buffer
+  DEPENDS:=@TARGET_mxs +kmod-industrialio-triggered-buffer
   TITLE:=Freescale i.MX23/i.MX28 LRADC ADC driver
   KCONFIG:= \
 	CONFIG_MXS_LRADC_ADC
   FILES:=$(LINUX_DIR)/drivers/iio/adc/mxs-lradc-adc.ko
   AUTOLOAD:=$(call AutoLoad,56,mxs-lradc-adc)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-mxs-lradc/description
@@ -153,13 +156,13 @@ endef
 $(eval $(call KernelPackage,iio-mxs-lradc))
 
 define KernelPackage/iio-dht11
-  SUBMENU:=$(IIO_MENU)
-  DEPENDS:=+kmod-iio-core @GPIO_SUPPORT @USES_DEVICETREE
+  DEPENDS:=@GPIO_SUPPORT @USES_DEVICETREE
   TITLE:=DHT11 (and compatible) humidity and temperature sensors
   KCONFIG:= \
 	CONFIG_DHT11
   FILES:=$(LINUX_DIR)/drivers/iio/humidity/dht11.ko
   AUTOLOAD:=$(call AutoLoad,56,dht11)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-dht11/description
@@ -172,11 +175,11 @@ $(eval $(call KernelPackage,iio-dht11))
 
 
 define KernelPackage/iio-bme680
-  SUBMENU:=$(IIO_MENU)
   TITLE:=BME680 gas/humidity/pressure/temperature sensor
-  DEPENDS:=+kmod-iio-core +kmod-regmap-core
+  DEPENDS:=+kmod-regmap-core
   KCONFIG:=CONFIG_BME680
   FILES:=$(LINUX_DIR)/drivers/iio/chemical/bme680_core.ko
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-bme680/description
@@ -187,12 +190,12 @@ endef
 $(eval $(call KernelPackage,iio-bme680))
 
 define KernelPackage/iio-bme680-i2c
-  SUBMENU:=$(IIO_MENU)
   TITLE:=BME680 gas/humidity/pressure/temperature sensor (I2C)
   DEPENDS:=+kmod-iio-bme680 +kmod-regmap-i2c
   KCONFIG:=CONFIG_BME680_I2C
   FILES:=$(LINUX_DIR)/drivers/iio/chemical/bme680_i2c.ko
   AUTOLOAD:=$(call AutoProbe,bme680-i2c)
+  $(call AddDepends/iio)
 endef
 define KernelPackage/iio-bme680-i2c/description
  This driver adds support for Bosch Sensortec's BME680 connected via I2C.
@@ -201,12 +204,12 @@ endef
 $(eval $(call KernelPackage,iio-bme680-i2c))
 
 define KernelPackage/iio-bme680-spi
-  SUBMENU:=$(IIO_MENU)
   TITLE:=BME680 gas/humidity/pressure/temperature sensor (SPI)
   DEPENDS:=+kmod-iio-bme680 +kmod-regmap-spi
   KCONFIG:=CONFIG_BME680_SPI
   FILES:=$(LINUX_DIR)/drivers/iio/chemical/bme680_spi.ko
   AUTOLOAD:=$(call AutoProbe,bme680-spi)
+  $(call AddDepends/iio)
 endef
 define KernelPackage/iio-bme680-spi/description
  This driver adds support for Bosch Sensortec's BME680 connected via SPI.
@@ -216,11 +219,11 @@ $(eval $(call KernelPackage,iio-bme680-spi))
 
 
 define KernelPackage/iio-bmp280
-  SUBMENU:=$(IIO_MENU)
   TITLE:=BMP180/BMP280/BME280 pressure/temperatur sensor
-  DEPENDS:=+kmod-iio-core +kmod-regmap-core
+  DEPENDS:=+kmod-regmap-core
   KCONFIG:=CONFIG_BMP280
   FILES:=$(LINUX_DIR)/drivers/iio/pressure/bmp280.ko
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-bmp280/description
@@ -233,12 +236,12 @@ $(eval $(call KernelPackage,iio-bmp280))
 
 
 define KernelPackage/iio-bmp280-i2c
-  SUBMENU:=$(IIO_MENU)
   TITLE:=BMP180/BMP280/BME280 pressure/temperatur sensor (I2C)
   DEPENDS:=+kmod-iio-bmp280 +kmod-i2c-core +kmod-regmap-i2c
   KCONFIG:=CONFIG_BMP280_I2C
   FILES:=$(LINUX_DIR)/drivers/iio/pressure/bmp280-i2c.ko
   AUTOLOAD:=$(call AutoProbe,bmp280-i2c)
+  $(call AddDepends/iio)
 endef
 define KernelPackage/iio-bmp280-i2c/description
  This driver adds support for Bosch Sensortec's digital pressure and
@@ -249,12 +252,12 @@ $(eval $(call KernelPackage,iio-bmp280-i2c))
 
 
 define KernelPackage/iio-bmp280-spi
-  SUBMENU:=$(IIO_MENU)
   TITLE:=BMP180/BMP280/BME280 pressure/temperatur sensor (SPI)
   DEPENDS:=+kmod-iio-bmp280 +kmod-spi-bitbang
   KCONFIG:=CONFIG_BMP280_SPI
   FILES:=$(LINUX_DIR)/drivers/iio/pressure/bmp280-spi.ko
   AUTOLOAD:=$(call AutoProbe,bmp280-spi)
+  $(call AddDepends/iio)
 endef
 define KernelPackage/iio-bmp280-spi/description
  This driver adds support for Bosch Sensortec's digital pressure and
@@ -264,8 +267,7 @@ endef
 $(eval $(call KernelPackage,iio-bmp280-spi))
 
 define KernelPackage/iio-htu21
-  SUBMENU:=$(IIO_MENU)
-  DEPENDS:=+kmod-i2c-core +kmod-iio-core
+  DEPENDS:=+kmod-i2c-core
   TITLE:=HTU21 humidity & temperature sensor
   KCONFIG:= \
        CONFIG_HTU21 \
@@ -274,6 +276,7 @@ define KernelPackage/iio-htu21
        $(LINUX_DIR)/drivers/iio/humidity/htu21.ko \
        $(LINUX_DIR)/drivers/iio/common/ms_sensors/ms_sensors_i2c.ko
   AUTOLOAD:=$(call AutoLoad,56,htu21)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-htu21/description
@@ -287,13 +290,13 @@ $(eval $(call KernelPackage,iio-htu21))
 
 
 define KernelPackage/iio-ccs811
-  SUBMENU:=$(IIO_MENU)
-  DEPENDS:=+kmod-i2c-core +kmod-iio-core +kmod-industrialio-triggered-buffer
+  DEPENDS:=+kmod-i2c-core +kmod-industrialio-triggered-buffer
   TITLE:=AMS CCS811 VOC sensor
   KCONFIG:= \
 	CONFIG_CCS811
   FILES:= $(LINUX_DIR)/drivers/iio/chemical/ccs811.ko
   AUTOLOAD:=$(call AutoLoad,56,ccs811)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-ccs811/description
@@ -304,12 +307,12 @@ $(eval $(call KernelPackage,iio-ccs811))
 
 
 define KernelPackage/iio-si7020
-  SUBMENU:=$(IIO_MENU)
-  DEPENDS:=+kmod-i2c-core +kmod-iio-core
+  DEPENDS:=+kmod-i2c-core
   TITLE:=Silicon Labs Si7020 sensor
   KCONFIG:= CONFIG_SI7020
   FILES:=$(LINUX_DIR)/drivers/iio/humidity/si7020.ko
   AUTOLOAD:=$(call AutoLoad,56,si7020)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-si7020/description
@@ -322,15 +325,15 @@ $(eval $(call KernelPackage,iio-si7020))
 
 
 define KernelPackage/iio-st_accel
-  SUBMENU:=$(IIO_MENU)
   TITLE:=STMicroelectronics accelerometer 3-Axis Driver
-  DEPENDS:=+kmod-iio-core +kmod-regmap-core +kmod-industrialio-triggered-buffer
+  DEPENDS:=+kmod-regmap-core +kmod-industrialio-triggered-buffer
   KCONFIG:= \
 	CONFIG_IIO_ST_ACCEL_3AXIS \
 	CONFIG_IIO_ST_SENSORS_CORE
   FILES:= \
 	$(LINUX_DIR)/drivers/iio/accel/st_accel.ko \
 	$(LINUX_DIR)/drivers/iio/common/st_sensors/st_sensors.ko
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-st_accel/description
@@ -344,7 +347,6 @@ $(eval $(call KernelPackage,iio-st_accel))
 
 
 define KernelPackage/iio-st_accel-i2c
-  SUBMENU:=$(IIO_MENU)
   TITLE:=STMicroelectronics accelerometer 3-Axis Driver (I2C)
   DEPENDS:=+kmod-iio-st_accel +kmod-i2c-core +kmod-regmap-i2c
   KCONFIG:= CONFIG_IIO_ST_ACCEL_I2C_3AXIS
@@ -352,6 +354,7 @@ define KernelPackage/iio-st_accel-i2c
 	$(LINUX_DIR)/drivers/iio/accel/st_accel_i2c.ko \
 	$(LINUX_DIR)/drivers/iio/common/st_sensors/st_sensors_i2c.ko
   AUTOLOAD:=$(call AutoLoad,56,st_accel_i2c)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-st_accel-i2c/description
@@ -362,7 +365,6 @@ $(eval $(call KernelPackage,iio-st_accel-i2c))
 
 
 define KernelPackage/iio-st_accel-spi
-  SUBMENU:=$(IIO_MENU)
   TITLE:=STMicroelectronics accelerometer 3-Axis Driver (SPI)
   DEPENDS:=+kmod-iio-st_accel +kmod-regmap-spi
   KCONFIG:= CONFIG_IIO_ST_ACCEL_SPI_3AXIS
@@ -370,6 +372,7 @@ define KernelPackage/iio-st_accel-spi
 	$(LINUX_DIR)/drivers/iio/accel/st_accel_spi.ko \
 	$(LINUX_DIR)/drivers/iio/common/st_sensors/st_sensors_spi.ko
   AUTOLOAD:=$(call AutoLoad,56,st_accel_spi)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-st_accel-spi/description
@@ -380,12 +383,12 @@ $(eval $(call KernelPackage,iio-st_accel-spi))
 
 
 define KernelPackage/iio-lsm6dsx
-  SUBMENU:=$(IIO_MENU)
-  DEPENDS:=+kmod-iio-core +kmod-iio-kfifo-buf +kmod-regmap-core
+  DEPENDS:=+kmod-iio-kfifo-buf +kmod-regmap-core
   TITLE:=ST LSM6DSx driver for IMU MEMS sensors
   KCONFIG:=CONFIG_IIO_ST_LSM6DSX
   FILES:=$(LINUX_DIR)/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.ko
   AUTOLOAD:=$(call AutoProbe,st_lsm6dsx)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-lsm6dsx/description
@@ -396,12 +399,12 @@ $(eval $(call KernelPackage,iio-lsm6dsx))
 
 
 define KernelPackage/iio-lsm6dsx-i2c
-  SUBMENU:=$(IIO_MENU)
   DEPENDS:=+kmod-iio-lsm6dsx +kmod-i2c-core +kmod-regmap-i2c
   TITLE:=ST LSM6DSx driver for IMU MEMS sensors (I2C)
   KCONFIG:=CONFIG_IIO_ST_LSM6DSX
   FILES:=$(LINUX_DIR)/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_i2c.ko
   AUTOLOAD:=$(call AutoProbe,st_lsm6dsx-i2c)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-lsm6dsx-i2c/description
@@ -412,12 +415,12 @@ $(eval $(call KernelPackage,iio-lsm6dsx-i2c))
 
 
 define KernelPackage/iio-lsm6dsx-spi
-  SUBMENU:=$(IIO_MENU)
   DEPENDS:=+kmod-iio-lsm6dsx +kmod-regmap-spi
   TITLE:=ST LSM6DSx driver for IMU MEMS sensors (SPI)
   KCONFIG:=CONFIG_IIO_ST_LSM6DSX
   FILES:=$(LINUX_DIR)/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_spi.ko
   AUTOLOAD:=$(call AutoProbe,st_lsm6dsx-spi)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-lsm6dsx-spi/description
@@ -428,16 +431,16 @@ $(eval $(call KernelPackage,iio-lsm6dsx-spi))
 
 
 define KernelPackage/iio-sps30
-  SUBMENU:=$(IIO_MENU)
-  DEPENDS:=+kmod-i2c-core +kmod-iio-core +kmod-industrialio-triggered-buffer +kmod-lib-crc8
+  DEPENDS:=+kmod-i2c-core +kmod-industrialio-triggered-buffer +kmod-lib-crc8
   TITLE:=Sensirion SPS30 particulate matter sensor
   KCONFIG:= \
 	CONFIG_SPS30 \
 	CONFIG_SPS30_I2C
   FILES:= \
 	$(LINUX_DIR)/drivers/iio/chemical/sps30.ko \
-	$(LINUX_DIR)/drivers/iio/chemical/sps30_i2c.ko@ge5.14
+	$(LINUX_DIR)/drivers/iio/chemical/sps30_i2c.ko
   AUTOLOAD:=$(call AutoProbe,sps30 sps30_i2c)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-sps30/description
@@ -448,12 +451,12 @@ $(eval $(call KernelPackage,iio-sps30))
 
 
 define KernelPackage/iio-tsl4531
-  SUBMENU:=$(IIO_MENU)
-  DEPENDS:=+kmod-i2c-core +kmod-iio-core
+  DEPENDS:=+kmod-i2c-core
   TITLE:=TAOS TSL4531 ambient light sensor
   KCONFIG:= CONFIG_TSL4531
   FILES:=$(LINUX_DIR)/drivers/iio/light/tsl4531.ko
   AUTOLOAD:=$(call AutoLoad,56,tsl4531)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-tsl4531/description
@@ -466,12 +469,12 @@ $(eval $(call KernelPackage,iio-tsl4531))
 
 
 define KernelPackage/iio-fxas21002c
-  SUBMENU:=$(IIO_MENU)
   TITLE:=Freescale FXAS21002C 3-axis gyro driver
-  DEPENDS:=+kmod-iio-core +kmod-regmap-core +kmod-industrialio-triggered-buffer
+  DEPENDS:=+kmod-regmap-core +kmod-industrialio-triggered-buffer
   KCONFIG:= CONFIG_FXAS21002C
   FILES:=$(LINUX_DIR)/drivers/iio/gyro/fxas21002c_core.ko
   AUTOLOAD:=$(call AutoLoad,56,fxas21002c)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-fxas21002c/description
@@ -482,12 +485,12 @@ $(eval $(call KernelPackage,iio-fxas21002c))
 
 
 define KernelPackage/iio-fxas21002c-i2c
-  SUBMENU:=$(IIO_MENU)
   TITLE:=Freescale FXAS21002C 3-axis gyro driver (I2C)
   DEPENDS:=+kmod-iio-fxas21002c +kmod-i2c-core +kmod-regmap-i2c
   KCONFIG:= CONFIG_FXAS21002C_I2C
   FILES:=$(LINUX_DIR)/drivers/iio/gyro/fxas21002c_i2c.ko
   AUTOLOAD:=$(call AutoLoad,56,fxas21002c_i2c)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-fxas21002c-i2c/description
@@ -499,12 +502,12 @@ endef
 $(eval $(call KernelPackage,iio-fxas21002c-i2c))
 
 define KernelPackage/iio-fxas21002c-spi
-  SUBMENU:=$(IIO_MENU)
   DEPENDS:=+kmod-iio-fxas21002c +kmod-regmap-spi
   TITLE:=Freescale FXAS21002C 3-axis gyro driver (SPI)
   KCONFIG:= CONFIG_FXAS21002C_SPI
   FILES:=$(LINUX_DIR)/drivers/iio/gyro/fxas21002c_spi.ko
   AUTOLOAD:=$(call AutoLoad,56,fxas21002c_spi)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-fxas21002c-spi/description
@@ -516,12 +519,12 @@ $(eval $(call KernelPackage,iio-fxas21002c-spi))
 
 
 define KernelPackage/iio-fxos8700
-  SUBMENU:=$(IIO_MENU)
   TITLE:=Freescale FXOS8700 3-axis accelerometer driver
-  DEPENDS:=+kmod-iio-core +kmod-regmap-core
+  DEPENDS:=+kmod-regmap-core
   KCONFIG:= CONFIG_FXOS8700
   FILES:=$(LINUX_DIR)/drivers/iio/imu/fxos8700_core.ko
   AUTOLOAD:=$(call AutoLoad,56,fxos8700)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-fxos8700/description
@@ -532,12 +535,12 @@ $(eval $(call KernelPackage,iio-fxos8700))
 
 
 define KernelPackage/iio-fxos8700-i2c
-  SUBMENU:=$(IIO_MENU)
   TITLE:=Freescale FXOS8700 3-axis acceleromter driver (I2C)
   DEPENDS:=+kmod-iio-fxos8700 +kmod-i2c-core +kmod-regmap-i2c
   KCONFIG:= CONFIG_FXOS8700_I2C
   FILES:=$(LINUX_DIR)/drivers/iio/imu/fxos8700_i2c.ko
   AUTOLOAD:=$(call AutoLoad,56,fxos8700_i2c)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-fxos8700-i2c/description
@@ -549,12 +552,12 @@ endef
 $(eval $(call KernelPackage,iio-fxos8700-i2c))
 
 define KernelPackage/iio-fxos8700-spi
-  SUBMENU:=$(IIO_MENU)
   DEPENDS:=+kmod-iio-fxos8700 +kmod-regmap-spi
   TITLE:=Freescale FXOS8700 3-axis accelerometer driver (SPI)
   KCONFIG:= CONFIG_FXOS8700_SPI
   FILES:=$(LINUX_DIR)/drivers/iio/imu/fxos8700_spi.ko
   AUTOLOAD:=$(call AutoLoad,56,fxos8700_spi)
+  $(call AddDepends/iio)
 endef
 
 define KernelPackage/iio-fxos8700-spi/description
@@ -563,3 +566,17 @@ define KernelPackage/iio-fxos8700-spi/description
 endef
 
 $(eval $(call KernelPackage,iio-fxos8700-spi))
+
+define KernelPackage/iio-ti-am335x-adc
+  TITLE:= TI Sitara AM335x ADC driver
+  DEPENDS:=@TARGET_omap
+  KCONFIG:=CONFIG_TI_AM335X_ADC
+  FILES:=$(LINUX_DIR)/drivers/iio/adc/ti_am335x_adc.ko
+  AUTOLOAD:=$(call AutoProbe,ti_am335x_adc)
+  $(call AddDepends/iio,+kmod-iio-kfifo-buf)
+endef
+define KernelPackage/iio-ti-am335x-adc/description
+ Driver for the TI AM335x ADC.
+endef
+
+$(eval $(call KernelPackage,iio-ti-am335x-adc))
diff --git a/package/kernel/linux/modules/input.mk b/package/kernel/linux/modules/input.mk
index 6270cdeb3b09db..92587b1874cf05 100644
--- a/package/kernel/linux/modules/input.mk
+++ b/package/kernel/linux/modules/input.mk
@@ -92,7 +92,7 @@ $(eval $(call KernelPackage,input-gpio-keys))
 define KernelPackage/input-gpio-keys-polled
   SUBMENU:=$(INPUT_MODULES_MENU)
   TITLE:=Polled GPIO key support
-  DEPENDS:=@GPIO_SUPPORT +kmod-input-core +LINUX_5_10:kmod-input-polldev
+  DEPENDS:=@GPIO_SUPPORT +kmod-input-core
   KCONFIG:= \
 	CONFIG_KEYBOARD_GPIO_POLLED \
 	CONFIG_INPUT_KEYBOARD=y
@@ -142,21 +142,6 @@ endef
 $(eval $(call KernelPackage,input-joydev))
 
 
-define KernelPackage/input-polldev
-  SUBMENU:=$(INPUT_MODULES_MENU)
-  TITLE:=Polled Input device support
-  DEPENDS:=+kmod-input-core @LINUX_5_10
-  KCONFIG:=CONFIG_INPUT_POLLDEV
-  FILES:=$(LINUX_DIR)/drivers/input/input-polldev.ko
-endef
-
-define KernelPackage/input-polldev/description
- Kernel module for support of polled input devices
-endef
-
-$(eval $(call KernelPackage,input-polldev))
-
-
 define KernelPackage/input-matrixkmap
   SUBMENU:=$(INPUT_MODULES_MENU)
   TITLE:=Input matrix devices support
@@ -179,10 +164,8 @@ define KernelPackage/input-touchscreen-ads7846
   DEPENDS:=+kmod-hwmon-core +kmod-input-core +kmod-spi-bitbang
   KCONFIG:= \
 	CONFIG_INPUT_TOUCHSCREEN=y \
-	CONFIG_TOUCHSCREEN_PROPERTIES=y@lt5.13 \
 	CONFIG_TOUCHSCREEN_ADS7846
-  FILES:=$(LINUX_DIR)/drivers/input/touchscreen/ads7846.ko \
-	$(LINUX_DIR)/drivers/input/touchscreen/of_touchscreen.ko@lt5.13
+  FILES:=$(LINUX_DIR)/drivers/input/touchscreen/ads7846.ko
   AUTOLOAD:=$(call AutoProbe,ads7846)
 endef
 
@@ -199,10 +182,8 @@ define KernelPackage/input-touchscreen-edt-ft5x06
   DEPENDS:=+kmod-i2c-core +kmod-input-core
   KCONFIG:= \
 	CONFIG_INPUT_TOUCHSCREEN=y \
-	CONFIG_TOUCHSCREEN_PROPERTIES=y@lt5.13 \
 	CONFIG_TOUCHSCREEN_EDT_FT5X06
-  FILES:=$(LINUX_DIR)/drivers/input/touchscreen/edt-ft5x06.ko \
-	$(LINUX_DIR)/drivers/input/touchscreen/of_touchscreen.ko@lt5.13
+  FILES:=$(LINUX_DIR)/drivers/input/touchscreen/edt-ft5x06.ko
   AUTOLOAD:=$(call AutoProbe,edt-ft5x06)
 endef
 
diff --git a/package/kernel/linux/modules/leds.mk b/package/kernel/linux/modules/leds.mk
index 7b5609a84ca2e9..fcf9c987e8ece4 100644
--- a/package/kernel/linux/modules/leds.mk
+++ b/package/kernel/linux/modules/leds.mk
@@ -115,6 +115,22 @@ endef
 $(eval $(call KernelPackage,ledtrig-pattern))
 
 
+define KernelPackage/ledtrig-tty
+  SUBMENU:=$(LEDS_MENU)
+  TITLE:=LED Trigger for TTY devices
+  KCONFIG:=CONFIG_LEDS_TRIGGER_TTY
+  FILES:=$(LED_TRIGGER_DIR)/ledtrig-tty.ko
+  AUTOLOAD:=$(call AutoLoad,50,ledtrig-tty)
+endef
+
+define KernelPackage/ledtrig-tty/description
+  This allows LEDs to be controlled by activity on ttys which includes
+  serial devices like '/dev/ttyS0'.
+endef
+
+$(eval $(call KernelPackage,ledtrig-tty))
+
+
 define KernelPackage/leds-apu
   SUBMENU:=$(LEDS_MENU)
   TITLE:=PC Engines APU1 LED support
diff --git a/package/kernel/linux/modules/lib.mk b/package/kernel/linux/modules/lib.mk
index 81ceb1f76ce036..c7d32d73170f6d 100644
--- a/package/kernel/linux/modules/lib.mk
+++ b/package/kernel/linux/modules/lib.mk
@@ -134,6 +134,7 @@ define KernelPackage/lib-zstd
   FILES:= \
 	$(LINUX_DIR)/crypto/zstd.ko \
 	$(LINUX_DIR)/lib/xxhash.ko \
+	$(LINUX_DIR)/lib/zstd/zstd_common.ko@ge6.1 \
 	$(LINUX_DIR)/lib/zstd/zstd_compress.ko \
 	$(LINUX_DIR)/lib/zstd/zstd_decompress.ko
   AUTOLOAD:=$(call AutoProbe,xxhash zstd zstd_compress zstd_decompress)
@@ -152,13 +153,15 @@ define KernelPackage/lib-lz4
   DEPENDS:=+kmod-crypto-acompress
   KCONFIG:= \
 	CONFIG_CRYPTO_LZ4 \
+	CONFIG_CRYPTO_LZ4HC \
 	CONFIG_LZ4_COMPRESS \
 	CONFIG_LZ4_DECOMPRESS
   FILES:= \
 	$(LINUX_DIR)/crypto/lz4.ko \
 	$(LINUX_DIR)/lib/lz4/lz4_compress.ko \
+	$(LINUX_DIR)/lib/lz4/lz4hc_compress.ko \
 	$(LINUX_DIR)/lib/lz4/lz4_decompress.ko
-  AUTOLOAD:=$(call AutoProbe,lz4 lz4_compress lz4_decompress)
+  AUTOLOAD:=$(call AutoProbe,lz4 lz4_compress lz4hc_compress lz4_decompress)
 endef
 
 define KernelPackage/lib-lz4/description
@@ -168,6 +171,28 @@ endef
 $(eval $(call KernelPackage,lib-lz4))
 
 
+define KernelPackage/lib-842
+  SUBMENU:=$(LIB_MENU)
+  TITLE:=842 support
+  DEPENDS:=+kmod-crypto-acompress +kmod-crypto-crc32
+  KCONFIG:= \
+	CONFIG_CRYPTO_842 \
+	CONFIG_842_COMPRESS \
+	CONFIG_842_DECOMPRESS
+  FILES:= \
+	$(LINUX_DIR)/crypto/842.ko \
+	$(LINUX_DIR)/lib/842/842_compress.ko \
+	$(LINUX_DIR)/lib/842/842_decompress.ko
+  AUTOLOAD:=$(call AutoProbe,842 842_compress 842_decompress)
+endef
+
+define KernelPackage/lib-842/description
+ Kernel module for 842 compression/decompression support
+endef
+
+$(eval $(call KernelPackage,lib-842))
+
+
 define KernelPackage/lib-raid6
   SUBMENU:=$(LIB_MENU)
   TITLE:=RAID6 algorithm support
diff --git a/package/kernel/linux/modules/netdevices.mk b/package/kernel/linux/modules/netdevices.mk
index 394180902d6a98..33e7f1bc306048 100644
--- a/package/kernel/linux/modules/netdevices.mk
+++ b/package/kernel/linux/modules/netdevices.mk
@@ -111,6 +111,7 @@ $(eval $(call KernelPackage,libphy))
 define KernelPackage/phylink
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=Model for MAC to optional PHY connection
+  DEPENDS:=+kmod-libphy
   KCONFIG:=CONFIG_PHYLINK
   FILES:=$(LINUX_DIR)/drivers/net/phy/phylink.ko
   AUTOLOAD:=$(call AutoLoad,15,phylink,1)
@@ -141,7 +142,7 @@ $(eval $(call KernelPackage,mii))
 define KernelPackage/mdio-devres
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=Supports MDIO device registration
-  DEPENDS:=+kmod-libphy +(TARGET_armvirt||TARGET_bcm27xx_bcm2708||TARGET_malta||TARGET_tegra):kmod-of-mdio
+  DEPENDS:=+kmod-libphy +(TARGET_armsr||TARGET_bcm27xx_bcm2708||TARGET_malta||TARGET_tegra):kmod-of-mdio
   KCONFIG:=CONFIG_MDIO_DEVRES
   HIDDEN:=1
   FILES:=$(LINUX_DIR)/drivers/net/phy/mdio_devres.ko
@@ -158,7 +159,7 @@ $(eval $(call KernelPackage,mdio-devres))
 define KernelPackage/mdio-gpio
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:= Supports GPIO lib-based MDIO busses
-  DEPENDS:=+kmod-libphy @GPIO_SUPPORT +(TARGET_armvirt||TARGET_bcm27xx_bcm2708||TARGET_malta||TARGET_tegra):kmod-of-mdio
+  DEPENDS:=+kmod-libphy @GPIO_SUPPORT +(TARGET_armsr||TARGET_bcm27xx_bcm2708||TARGET_malta||TARGET_tegra):kmod-of-mdio
   KCONFIG:= \
 	CONFIG_MDIO_BITBANG \
 	CONFIG_MDIO_GPIO
@@ -273,6 +274,40 @@ endef
 $(eval $(call KernelPackage,phy-bcm84881))
 
 
+define KernelPackage/phy-marvell
+   SUBMENU:=$(NETWORK_DEVICES_MENU)
+   TITLE:=Marvell Gigabit Ethernet PHY driver
+   KCONFIG:=CONFIG_MARVELL_PHY
+   DEPENDS:=+kmod-libphy
+   FILES:=$(LINUX_DIR)/drivers/net/phy/marvell.ko
+   AUTOLOAD:=$(call AutoLoad,18,marvell)
+endef
+
+define KernelPackage/phy-marvell/description
+   Supports Marvell Gigabit Ethernet PHYs:
+   * 88E1101
+   * 88E1112
+   * 88E1111 (incl. Finisar variant)
+   * 88E1118
+   * 88E1121R
+   * 88E1145
+   * 88E1149R
+   * 88E1240
+   * 88E1318S
+   * 88E1116R
+   * 88E1510
+   * 88E1540
+   * 88E1545
+   * 88E3016
+   * 88E6341 family
+   * 88E6390 family
+   * 88E6393 family
+   * 88E1340S
+   * 88E1548P
+endef
+
+$(eval $(call KernelPackage,phy-marvell))
+
 
 define KernelPackage/phy-realtek
    SUBMENU:=$(NETWORK_DEVICES_MENU)
@@ -306,6 +341,22 @@ endef
 $(eval $(call KernelPackage,phy-smsc))
 
 
+define KernelPackage/phy-aquantia
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=Aquantia Ethernet PHYs
+  DEPENDS:=+kmod-libphy +kmod-hwmon-core
+  KCONFIG:=CONFIG_AQUANTIA_PHY
+  FILES:=$(LINUX_DIR)/drivers/net/phy/aquantia.ko
+  AUTOLOAD:=$(call AutoLoad,18,aquantia,1)
+endef
+
+define KernelPackage/phy-aquantia/description
+  Kernel modules for Aquantia Ethernet PHYs
+endef
+
+$(eval $(call KernelPackage,phy-aquantia))
+
+
 define KernelPackage/swconfig
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=switch configuration API
@@ -387,7 +438,7 @@ $(eval $(call KernelPackage,switch-rtl8306))
 define KernelPackage/switch-rtl8366-smi
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=Realtek RTL8366 SMI switch interface support
-  DEPENDS:=@GPIO_SUPPORT +kmod-swconfig +(TARGET_armvirt||TARGET_bcm27xx_bcm2708||TARGET_malta||TARGET_tegra):kmod-of-mdio
+  DEPENDS:=@GPIO_SUPPORT +kmod-swconfig +(TARGET_armsr||TARGET_bcm27xx_bcm2708||TARGET_malta||TARGET_tegra):kmod-of-mdio
   KCONFIG:=CONFIG_RTL8366_SMI
   FILES:=$(LINUX_DIR)/drivers/net/phy/rtl8366_smi.ko
   AUTOLOAD:=$(call AutoLoad,42,rtl8366_smi,1)
@@ -900,7 +951,7 @@ define KernelPackage/tg3
   TITLE:=Broadcom Tigon3 Gigabit Ethernet
   KCONFIG:=CONFIG_TIGON3 \
 	CONFIG_TIGON3_HWMON=n
-  DEPENDS:=+!TARGET_bcm47xx:kmod-libphy +kmod-ptp
+  DEPENDS:=@PCI_SUPPORT +!TARGET_bcm47xx:kmod-libphy +kmod-ptp
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   FILES:=$(LINUX_DIR)/drivers/net/ethernet/broadcom/tg3.ko
   AUTOLOAD:=$(call AutoLoad,19,tg3,1)
@@ -916,7 +967,7 @@ $(eval $(call KernelPackage,tg3))
 define KernelPackage/hfcpci
   TITLE:=HFC PCI cards (single port) support for mISDN
   KCONFIG:=CONFIG_MISDN_HFCPCI
-  DEPENDS:=+kmod-misdn
+  DEPENDS:=@PCI_SUPPORT +kmod-misdn
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   FILES:=$(LINUX_DIR)/drivers/isdn/hardware/mISDN/hfcpci.ko
   AUTOLOAD:=$(call AutoLoad,31,hfcpci)
@@ -933,7 +984,7 @@ $(eval $(call KernelPackage,hfcpci))
 define KernelPackage/hfcmulti
   TITLE:=HFC multiport cards (HFC-4S/8S/E1) support for mISDN
   KCONFIG:=CONFIG_MISDN_HFCMULTI
-  DEPENDS:=+kmod-misdn
+  DEPENDS:=@PCI_SUPPORT +kmod-misdn
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   FILES:=$(LINUX_DIR)/drivers/isdn/hardware/mISDN/hfcmulti.ko
   AUTOLOAD:=$(call AutoLoad,31,hfcmulti)
@@ -1120,7 +1171,7 @@ define KernelPackage/of-mdio
   KCONFIG:=CONFIG_OF_MDIO
   FILES:= \
 	$(LINUX_DIR)/drivers/net/mdio/of_mdio.ko \
-	$(LINUX_DIR)/drivers/net/mdio/fwnode_mdio.ko@ge5.15
+	$(LINUX_DIR)/drivers/net/mdio/fwnode_mdio.ko
   AUTOLOAD:=$(call AutoLoad,41,of_mdio)
 endef
 
@@ -1398,14 +1449,15 @@ $(eval $(call KernelPackage,sfc-falcon))
 define KernelPackage/wwan
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=WWAN Driver Core
-  DEPENDS:=@LINUX_5_15
-  KCONFIG:=CONFIG_WWAN
+  KCONFIG:= \
+  CONFIG_WWAN \
+  CONFIG_WWAN_DEBUGFS=y@ge5.17
   FILES:=$(LINUX_DIR)/drivers/net/wwan/wwan.ko
   AUTOLOAD:=$(call AutoProbe,wwan)
 endef
 
 define KernelPackage/wwan/description
- his driver provides a common framework for WWAN drivers.
+ This driver provides a common framework for WWAN drivers.
 endef
 
 $(eval $(call KernelPackage,wwan))
@@ -1414,7 +1466,7 @@ $(eval $(call KernelPackage,wwan))
 define KernelPackage/mhi-net
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=MHI Network Device
-  DEPENDS:=@LINUX_5_15 @PCI_SUPPORT +kmod-mhi-bus
+  DEPENDS:=@PCI_SUPPORT +kmod-mhi-bus
   KCONFIG:=CONFIG_MHI_NET
   FILES:=$(LINUX_DIR)/drivers/net/mhi_net.ko
   AUTOLOAD:=$(call AutoProbe,mhi_net)
@@ -1429,7 +1481,7 @@ $(eval $(call KernelPackage,mhi-net))
 define KernelPackage/mhi-wwan-ctrl
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=MHI WWAN Control
-  DEPENDS:=@LINUX_5_15 @PCI_SUPPORT +kmod-mhi-bus +kmod-wwan
+  DEPENDS:=@PCI_SUPPORT +kmod-mhi-bus +kmod-wwan
   KCONFIG:=CONFIG_MHI_WWAN_CTRL
   FILES:=$(LINUX_DIR)/drivers/net/wwan/mhi_wwan_ctrl.ko
   AUTOLOAD:=$(call AutoProbe,mhi_wwan_ctrl)
@@ -1445,7 +1497,7 @@ $(eval $(call KernelPackage,mhi-wwan-ctrl))
 define KernelPackage/mhi-wwan-mbim
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=MHI MBIM
-  DEPENDS:=@LINUX_5_15 @PCI_SUPPORT +kmod-mhi-bus +kmod-wwan
+  DEPENDS:=@PCI_SUPPORT +kmod-mhi-bus +kmod-wwan
   KCONFIG:=CONFIG_MHI_WWAN_MBIM
   FILES:=$(LINUX_DIR)/drivers/net/wwan/mhi_wwan_mbim.ko
   AUTOLOAD:=$(call AutoProbe,mhi_wwan_mbim)
@@ -1473,3 +1525,34 @@ endef
 
 $(eval $(call KernelPackage,atlantic))
 
+
+define KernelPackage/lan743x
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=Microchip LAN743x PCI Express Gigabit Ethernet NIC
+  DEPENDS:=@PCI_SUPPORT +kmod-ptp +kmod-mdio-devres
+  KCONFIG:=CONFIG_LAN743X
+  FILES:=$(LINUX_DIR)/drivers/net/ethernet/microchip/lan743x.ko
+  AUTOLOAD:=$(call AutoProbe,lan743x)
+endef
+
+define KernelPackage/lan743x/description
+  Kernel module for Microchip LAN743x PCI Express Gigabit Ethernet NIC
+endef
+
+$(eval $(call KernelPackage,lan743x))
+
+define KernelPackage/amazon-ena
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=Elastic Network Adapter (for Amazon AWS)
+  DEPENDS:=@TARGET_x86_64||TARGET_armsr_armv8
+  KCONFIG:=CONFIG_ENA_ETHERNET
+  FILES:=$(LINUX_DIR)/drivers/net/ethernet/amazon/ena/ena.ko
+  AUTOLOAD:=$(call AutoLoad,12,ena)
+endef
+
+define KernelPackage/amazon-ena/description
+  This driver supports Elastic Network Adapter (ENA)
+  used by Amazon AWS T3 (2018) and later instances.
+endef
+
+$(eval $(call KernelPackage,amazon-ena))
diff --git a/package/kernel/linux/modules/netfilter.mk b/package/kernel/linux/modules/netfilter.mk
index e6e2c9b6371e0d..86a5ffb5c52f25 100644
--- a/package/kernel/linux/modules/netfilter.mk
+++ b/package/kernel/linux/modules/netfilter.mk
@@ -1,6 +1,6 @@
 
 #
-# Copyright (C) 2006-2010 OpenWrt.org
+# Copyright (C) 2006-2023 OpenWrt.org
 #
 # This is free software, licensed under the GNU General Public License v2.
 # See /LICENSE for more information.
@@ -39,6 +39,17 @@ endef
 
 $(eval $(call KernelPackage,nf-reject6))
 
+define KernelPackage/nf-conncount
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter conncount support
+  KCONFIG:=$(KCONFIG_NF_CONNCOUNT)
+  HIDDEN:=1
+  DEPENDS:=+kmod-nf-conntrack
+  FILES:=$(foreach mod,$(NF_CONNCOUNT-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_CONNCOUNT-m)))
+endef
+
+$(eval $(call KernelPackage,nf-conncount))
 
 define KernelPackage/nf-ipt
   SUBMENU:=$(NF_MENU)
@@ -234,6 +245,7 @@ $(eval $(call KernelPackage,ipt-conntrack))
 
 define KernelPackage/ipt-conntrack-extra
   TITLE:=Extra connection tracking modules
+  DEPENDS:=+kmod-nf-conncount
   KCONFIG:=$(KCONFIG_IPT_CONNTRACK_EXTRA)
   FILES:=$(foreach mod,$(IPT_CONNTRACK_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CONNTRACK_EXTRA-m)))
@@ -1129,13 +1141,32 @@ define KernelPackage/nft-bridge
   FILES:=$(foreach mod,$(NFT_BRIDGE-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_BRIDGE-m)))
   KCONFIG:= \
-	CONFIG_NF_LOG_BRIDGE=n@lt5.13 \
 	$(KCONFIG_NFT_BRIDGE)
 endef
 
 $(eval $(call KernelPackage,nft-bridge))
 
 
+define KernelPackage/nft-dup-inet
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter nf_tables dup in ip/ip6/inet family support
+  DEPENDS:=+kmod-nft-core +kmod-nf-conntrack +IPV6:kmod-nf-conntrack6
+  KCONFIG:= \
+	CONFIG_NF_DUP_IPV4 \
+	CONFIG_NF_DUP_IPV6 \
+	CONFIG_NFT_DUP_IPV4 \
+	CONFIG_NFT_DUP_IPV6
+  FILES:= \
+	$(LINUX_DIR)/net/ipv4/netfilter/nf_dup_ipv4.ko \
+	$(LINUX_DIR)/net/ipv6/netfilter/nf_dup_ipv6.ko \
+	$(LINUX_DIR)/net/ipv4/netfilter/nft_dup_ipv4.ko \
+	$(LINUX_DIR)/net/ipv6/netfilter/nft_dup_ipv6.ko
+  AUTOLOAD:=$(call AutoProbe,nf_dup_ipv4 nf_dup_ipv6 nft_dup_ipv4 nft_dup_ipv6)
+endef
+
+$(eval $(call KernelPackage,nft-dup-inet))
+
+
 define KernelPackage/nft-nat
   SUBMENU:=$(NF_MENU)
   TITLE:=Netfilter nf_tables NAT support
@@ -1154,15 +1185,15 @@ define KernelPackage/nft-offload
   DEPENDS:=@IPV6 +kmod-nf-flow +kmod-nft-nat
   KCONFIG:= \
 	CONFIG_NF_FLOW_TABLE_INET \
-	CONFIG_NF_FLOW_TABLE_IPV4 \
-	CONFIG_NF_FLOW_TABLE_IPV6 \
+	CONFIG_NF_FLOW_TABLE_IPV4@lt5.17 \
+	CONFIG_NF_FLOW_TABLE_IPV6@lt5.17 \
 	CONFIG_NFT_FLOW_OFFLOAD
   FILES:= \
 	$(LINUX_DIR)/net/netfilter/nf_flow_table_inet.ko \
-	$(LINUX_DIR)/net/ipv4/netfilter/nf_flow_table_ipv4.ko \
-	$(LINUX_DIR)/net/ipv6/netfilter/nf_flow_table_ipv6.ko \
+	$(LINUX_DIR)/net/ipv4/netfilter/nf_flow_table_ipv4.ko@lt5.17 \
+	$(LINUX_DIR)/net/ipv6/netfilter/nf_flow_table_ipv6.ko@lt5.17 \
 	$(LINUX_DIR)/net/netfilter/nft_flow_offload.ko
-  AUTOLOAD:=$(call AutoProbe,nf_flow_table_inet nf_flow_table_ipv4 nf_flow_table_ipv6 nft_flow_offload)
+  AUTOLOAD:=$(call AutoProbe,nf_flow_table_inet nf_flow_table_ipv4@lt5.17 nf_flow_table_ipv6@lt5.17 nft_flow_offload)
 endef
 
 $(eval $(call KernelPackage,nft-offload))
@@ -1254,3 +1285,14 @@ define KernelPackage/nft-xfrm
 endef
 
 $(eval $(call KernelPackage,nft-xfrm))
+
+define KernelPackage/nft-connlimit
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter nf_tables connlimit support
+  DEPENDS:=+kmod-nft-core +kmod-nf-conncount
+  FILES:=$(foreach mod,$(NFT_CONNLIMIT-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_CONNLIMIT-m)))
+  KCONFIG:=$(KCONFIG_NFT_CONNLIMIT)
+endef
+
+$(eval $(call KernelPackage,nft-connlimit))
diff --git a/package/kernel/linux/modules/netsupport.mk b/package/kernel/linux/modules/netsupport.mk
index be0347527d18fb..cb85c46b78517a 100644
--- a/package/kernel/linux/modules/netsupport.mk
+++ b/package/kernel/linux/modules/netsupport.mk
@@ -46,6 +46,7 @@ define KernelPackage/bonding
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=Ethernet bonding driver
   KCONFIG:=CONFIG_BONDING
+  DEPENDS:=PACKAGE_kmod-tls:kmod-tls
   FILES:=$(LINUX_DIR)/drivers/net/bonding/bonding.ko
   AUTOLOAD:=$(call AutoLoad,40,bonding)
   MODPARAMS.bonding:=max_bonds=0
@@ -91,7 +92,9 @@ define KernelPackage/vxlan
 	+kmod-udptunnel4 \
 	+IPV6:kmod-udptunnel6
   KCONFIG:=CONFIG_VXLAN
-  FILES:=$(LINUX_DIR)/drivers/net/vxlan.ko
+  FILES:= \
+	$(LINUX_DIR)/drivers/net/vxlan.ko@lt5.18 \
+	$(LINUX_DIR)/drivers/net/vxlan/vxlan.ko@ge5.18
   AUTOLOAD:=$(call AutoLoad,13,vxlan)
 endef
 
@@ -215,10 +218,8 @@ $(eval $(call KernelPackage,ipsec))
 IPSEC4-m = \
 	ipv4/ah4 \
 	ipv4/esp4 \
-	ipv4/xfrm4_tunnel \
 	ipv4/ipcomp \
-
-IPSEC4-m += $(ifeq ($$(strip $$(call CompareKernelPatchVer,$$(KERNEL_PATCHVER),le,5.2))),ipv4/xfrm4_mode_beet ipv4/xfrm4_mode_transport ipv4/xfrm4_mode_tunnel)
+	ipv4/xfrm4_tunnel
 
 define KernelPackage/ipsec4
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
@@ -228,9 +229,6 @@ define KernelPackage/ipsec4
 	CONFIG_INET_AH \
 	CONFIG_INET_ESP \
 	CONFIG_INET_IPCOMP \
-	CONFIG_INET_XFRM_MODE_BEET \
-	CONFIG_INET_XFRM_MODE_TRANSPORT \
-	CONFIG_INET_XFRM_MODE_TUNNEL \
 	CONFIG_INET_XFRM_TUNNEL \
 	CONFIG_INET_ESP_OFFLOAD=n
   FILES:=$(foreach mod,$(IPSEC4-m),$(LINUX_DIR)/net/$(mod).ko)
@@ -243,9 +241,6 @@ define KernelPackage/ipsec4/description
  - ah4
  - esp4
  - ipcomp4
- - xfrm4_mode_beet
- - xfrm4_mode_transport
- - xfrm4_mode_tunnel
  - xfrm4_tunnel
 endef
 
@@ -255,10 +250,8 @@ $(eval $(call KernelPackage,ipsec4))
 IPSEC6-m = \
 	ipv6/ah6 \
 	ipv6/esp6 \
-	ipv6/xfrm6_tunnel \
 	ipv6/ipcomp6 \
-
-IPSEC6-m += $(ifeq ($$(strip $$(call CompareKernelPatchVer,$$(KERNEL_PATCHVER),le,5.2))),ipv6/xfrm6_mode_beet ipv6/xfrm6_mode_transport ipv6/xfrm6_mode_tunnel)
+	ipv6/xfrm6_tunnel
 
 define KernelPackage/ipsec6
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
@@ -268,9 +261,6 @@ define KernelPackage/ipsec6
 	CONFIG_INET6_AH \
 	CONFIG_INET6_ESP \
 	CONFIG_INET6_IPCOMP \
-	CONFIG_INET6_XFRM_MODE_BEET \
-	CONFIG_INET6_XFRM_MODE_TRANSPORT \
-	CONFIG_INET6_XFRM_MODE_TUNNEL \
 	CONFIG_INET6_XFRM_TUNNEL \
 	CONFIG_INET6_ESP_OFFLOAD=n
   FILES:=$(foreach mod,$(IPSEC6-m),$(LINUX_DIR)/net/$(mod).ko)
@@ -283,9 +273,6 @@ define KernelPackage/ipsec6/description
  - ah6
  - esp6
  - ipcomp6
- - xfrm6_mode_beet
- - xfrm6_mode_transport
- - xfrm6_mode_tunnel
  - xfrm6_tunnel
 endef
 
@@ -706,7 +693,7 @@ endef
 $(eval $(call KernelPackage,mppe))
 
 
-SCHED_MODULES_CORE = sch_ingress sch_hfsc sch_htb sch_tbf cls_basic cls_fw cls_route cls_flow cls_tcindex cls_u32 em_u32 act_gact act_mirred act_skbedit cls_matchall
+SCHED_MODULES_CORE = sch_ingress sch_hfsc sch_htb sch_tbf cls_basic cls_fw cls_route cls_flow cls_u32 em_u32 act_gact act_mirred act_skbedit cls_matchall
 SCHED_FILES_CORE = $(foreach mod,$(SCHED_MODULES_CORE),$(LINUX_DIR)/net/sched/$(mod).ko)
 
 define KernelPackage/sched-core
@@ -724,7 +711,6 @@ define KernelPackage/sched-core
 	CONFIG_NET_CLS_FLOW \
 	CONFIG_NET_CLS_FW \
 	CONFIG_NET_CLS_ROUTE4 \
-	CONFIG_NET_CLS_TCINDEX \
 	CONFIG_NET_CLS_U32 \
 	CONFIG_NET_ACT_GACT \
 	CONFIG_NET_ACT_MIRRED \
@@ -892,6 +878,22 @@ endef
 $(eval $(call KernelPackage,sched-flower))
 
 
+define KernelPackage/sched-fq-pie
+  SUBMENU:=$(NETWORK_SUPPORT_MENU)
+  TITLE:=Flow Queue Proportional Integral Enhanced (FQ-PIE)
+  DEPENDS:=+kmod-sched-core +kmod-sched-pie
+  KCONFIG:=CONFIG_NET_SCH_FQ_PIE
+  FILES:=$(LINUX_DIR)/net/sched/sch_fq_pie.ko
+  AUTOLOAD:=$(call AutoProbe, sch_fq_pie)
+endef
+
+define KernelPackage/sched-fq-pie/description
+  A queuing discipline that combines Flow Queuing with the PIE AQM.
+endef
+
+$(eval $(call KernelPackage,sched-fq-pie))
+
+
 define KernelPackage/sched-ipset
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=Traffic shaper ipset support
@@ -922,6 +924,22 @@ endef
 $(eval $(call KernelPackage,sched-mqprio))
 
 
+define KernelPackage/sched-pie
+  SUBMENU:=$(NETWORK_SUPPORT_MENU)
+  TITLE:=Proportional Integral controller-Enhanced AQM (PIE)
+  DEPENDS:=+kmod-sched-core
+  KCONFIG:=CONFIG_NET_SCH_PIE
+  FILES:=$(LINUX_DIR)/net/sched/sch_pie.ko
+  AUTOLOAD:=$(call AutoProbe, sch_pie)
+endef
+
+define KernelPackage/sched-pie/description
+  A control theoretic active queue management scheme.
+endef
+
+$(eval $(call KernelPackage,sched-pie))
+
+
 define KernelPackage/sched-prio
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=Multi Band Priority Queueing (PRIO)
@@ -964,7 +982,7 @@ endef
 $(eval $(call KernelPackage,bpf-test))
 
 
-SCHED_MODULES_EXTRA = sch_codel sch_dsmark sch_gred sch_multiq sch_sfq sch_teql sch_fq sch_pie act_pedit act_simple act_csum em_cmp em_nbyte em_meta em_text
+SCHED_MODULES_EXTRA = sch_codel sch_dsmark sch_gred sch_multiq sch_sfq sch_teql sch_fq act_pedit act_simple act_csum em_cmp em_nbyte em_meta em_text
 SCHED_FILES_EXTRA = $(foreach mod,$(SCHED_MODULES_EXTRA),$(LINUX_DIR)/net/sched/$(mod).ko)
 
 define KernelPackage/sched
@@ -979,7 +997,6 @@ define KernelPackage/sched
 	CONFIG_NET_SCH_SFQ \
 	CONFIG_NET_SCH_TEQL \
 	CONFIG_NET_SCH_FQ \
-	CONFIG_NET_SCH_PIE \
 	CONFIG_NET_ACT_PEDIT \
 	CONFIG_NET_ACT_SIMP \
 	CONFIG_NET_ACT_CSUM \
@@ -1028,6 +1045,24 @@ endef
 
 $(eval $(call KernelPackage,tcp-bbr))
 
+define KernelPackage/tls
+  SUBMENU:=$(NETWORK_SUPPORT_MENU)
+  TITLE:=In-kernel TLS Support with HW Offload
+  KCONFIG:=CONFIG_TLS \
+	CONFIG_TLS_DEVICE=y
+  FILES:=$(LINUX_DIR)/net/tls/tls.ko
+  AUTOLOAD:=$(call AutoProbe,tls)
+endef
+
+define KernelPackage/tls/description
+ Kernel module for in-kernel TLS protocol support and hw offload
+ (to supported interfaces).
+ This allows symmetric encryption handling of the TLS protocol to
+ be done in-kernel and it's HW offload when available.
+endef
+
+$(eval $(call KernelPackage,tls))
+
 
 define KernelPackage/tcp-hybla
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
@@ -1173,7 +1208,7 @@ define KernelPackage/sctp
   FILES:= $(LINUX_DIR)/net/sctp/sctp.ko
   AUTOLOAD:= $(call AutoLoad,32,sctp)
   DEPENDS:=+kmod-lib-crc32c +kmod-crypto-md5 +kmod-crypto-hmac \
-    +LINUX_5_15:kmod-udptunnel4 +LINUX_5_15:kmod-udptunnel6
+    +kmod-udptunnel4 +kmod-udptunnel6
 endef
 
 define KernelPackage/sctp/description
@@ -1240,7 +1275,8 @@ define KernelPackage/rxrpc
   FILES:= \
 	$(LINUX_DIR)/net/rxrpc/rxrpc.ko
   AUTOLOAD:=$(call AutoLoad,30,rxrpc.ko)
-  DEPENDS:= +kmod-crypto-manager +kmod-crypto-pcbc +kmod-crypto-fcrypt
+  DEPENDS:= +kmod-crypto-manager +kmod-crypto-pcbc +kmod-crypto-fcrypt \
+    +kmod-udptunnel4 +kmod-udptunnel6
 endef
 
 define KernelPackage/rxrpc/description
@@ -1281,7 +1317,8 @@ define KernelPackage/9pnet
 	CONFIG_NET_9P \
 	CONFIG_NET_9P_DEBUG=n \
 	CONFIG_NET_9P_XEN=n \
-	CONFIG_NET_9P_VIRTIO
+	CONFIG_NET_9P_VIRTIO \
+	CONFIG_NET_9P_FD=n@ge5.17
   FILES:= \
 	$(LINUX_DIR)/net/9p/9pnet.ko \
 	$(LINUX_DIR)/net/9p/9pnet_virtio.ko
@@ -1326,6 +1363,21 @@ endef
 
 $(eval $(call KernelPackage,mdio))
 
+define KernelPackage/mdio-bus-mux
+  SUBMENU:=$(NETWORK_SUPPORT_MENU)
+  TITLE:=MDIO bus multiplexers
+  KCONFIG:=CONFIG_MDIO_BUS_MUX
+  HIDDEN:=1
+  FILES:=$(LINUX_DIR)/drivers/net/mdio/mdio-mux.ko
+  AUTOLOAD:=$(call AutoLoad,32,mdio-mux)
+endef
+
+define KernelPackage/mdio-bus-mux/description
+ Kernel framework for MDIO bus multiplexers.
+endef
+
+$(eval $(call KernelPackage,mdio-bus-mux))
+
 define KernelPackage/macsec
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=IEEE 802.1AE MAC-level encryption (MAC)
@@ -1423,3 +1475,65 @@ define KernelPackage/netconsole/description
 endef
 
 $(eval $(call KernelPackage,netconsole))
+
+
+define KernelPackage/qrtr
+  SUBMENU:=$(NETWORK_SUPPORT_MENU)
+  TITLE:=Qualcomm IPC Router support
+  HIDDEN:=1
+  KCONFIG:=CONFIG_QRTR
+  FILES:= \
+  $(LINUX_DIR)/net/qrtr/qrtr.ko
+  AUTOLOAD:=$(call AutoProbe,qrtr)
+endef
+
+define KernelPackage/qrtr/description
+ Qualcomm IPC Router support
+endef
+
+$(eval $(call KernelPackage,qrtr))
+
+define KernelPackage/qrtr-tun
+  SUBMENU:=$(NETWORK_SUPPORT_MENU)
+  TITLE:=TUN device for Qualcomm IPC Router
+  DEPENDS:=+kmod-qrtr
+  KCONFIG:=CONFIG_QRTR_TUN
+  FILES:= $(LINUX_DIR)/net/qrtr/qrtr-tun.ko
+  AUTOLOAD:=$(call AutoProbe,qrtr-tun)
+endef
+
+define KernelPackage/qrtr-tun/description
+ TUN device for Qualcomm IPC Router
+endef
+
+$(eval $(call KernelPackage,qrtr-tun))
+
+define KernelPackage/qrtr-smd
+  SUBMENU:=$(NETWORK_SUPPORT_MENU)
+  TITLE:=SMD IPC Router channels
+  DEPENDS:=+kmod-qrtr @TARGET_qualcommax
+  KCONFIG:=CONFIG_QRTR_SMD
+  FILES:= $(LINUX_DIR)/net/qrtr/qrtr-smd.ko
+  AUTOLOAD:=$(call AutoProbe,qrtr-smd)
+endef
+
+define KernelPackage/qrtr-smd/description
+ SMD IPC Router channels
+endef
+
+$(eval $(call KernelPackage,qrtr-smd))
+
+define KernelPackage/qrtr-mhi
+  SUBMENU:=$(NETWORK_SUPPORT_MENU)
+  TITLE:=MHI IPC Router channels
+  DEPENDS:=+kmod-mhi-bus +kmod-qrtr
+  KCONFIG:=CONFIG_QRTR_MHI
+  FILES:= $(LINUX_DIR)/net/qrtr/qrtr-mhi.ko
+  AUTOLOAD:=$(call AutoProbe,qrtr-mhi)
+endef
+
+define KernelPackage/qrtr-mhi/description
+ MHI IPC Router channels
+endef
+
+$(eval $(call KernelPackage,qrtr-mhi))
diff --git a/package/kernel/linux/modules/other.mk b/package/kernel/linux/modules/other.mk
index 0ab8c7ad4a36d5..ac26c2a15037cf 100644
--- a/package/kernel/linux/modules/other.mk
+++ b/package/kernel/linux/modules/other.mk
@@ -41,7 +41,7 @@ define KernelPackage/bluetooth
 	CONFIG_BT_HCIBTUSB \
 	CONFIG_BT_HCIBTUSB_BCM=n \
 	CONFIG_BT_HCIBTUSB_MTK=y \
-	CONFIG_BT_HCIBTUSB_RTL=n \
+	CONFIG_BT_HCIBTUSB_RTL=y \
 	CONFIG_BT_HCIUART \
 	CONFIG_BT_HCIUART_BCM=n \
 	CONFIG_BT_HCIUART_INTEL=n \
@@ -56,7 +56,9 @@ define KernelPackage/bluetooth
 	$(LINUX_DIR)/net/bluetooth/hidp/hidp.ko \
 	$(LINUX_DIR)/drivers/bluetooth/hci_uart.ko \
 	$(LINUX_DIR)/drivers/bluetooth/btusb.ko \
-	$(LINUX_DIR)/drivers/bluetooth/btintel.ko
+	$(LINUX_DIR)/drivers/bluetooth/btintel.ko \
+	$(LINUX_DIR)/drivers/bluetooth/btrtl.ko \
+	$(LINUX_DIR)/drivers/bluetooth/btmtk.ko@ge5.17
   AUTOLOAD:=$(call AutoProbe,bluetooth rfcomm bnep hidp hci_uart btusb)
 endef
 
@@ -242,23 +244,72 @@ endef
 $(eval $(call KernelPackage,gpio-f7188x))
 
 
-define KernelPackage/gpio-mcp23s08
+define KernelPackage/lkdtm
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Linux Kernel Dump Test Tool Module
+  KCONFIG:=CONFIG_LKDTM
+  FILES:=$(LINUX_DIR)/drivers/misc/lkdtm/lkdtm.ko
+  AUTOLOAD:=$(call AutoProbe,lkdtm)
+endef
+
+define KernelPackage/lkdtm/description
+ This module enables testing of the different dumping mechanisms by inducing
+ system failures at predefined crash points.
+endef
+
+$(eval $(call KernelPackage,lkdtm))
+
+
+define KernelPackage/pinctrl-mcp23s08
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Microchip MCP23xxx I/O expander
-  DEPENDS:=@GPIO_SUPPORT +kmod-i2c-core +kmod-regmap-i2c
-  KCONFIG:= \
-	CONFIG_GPIO_MCP23S08 \
-	CONFIG_PINCTRL_MCP23S08
-  FILES:= \
-	$(LINUX_DIR)/drivers/pinctrl/pinctrl-mcp23s08.ko
+  HIDDEN:=1
+  DEPENDS:=@GPIO_SUPPORT +kmod-regmap-core
+  KCONFIG:=CONFIG_PINCTRL_MCP23S08
+  FILES:=$(LINUX_DIR)/drivers/pinctrl/pinctrl-mcp23s08.ko
   AUTOLOAD:=$(call AutoLoad,40,pinctrl-mcp23s08)
 endef
 
-define KernelPackage/gpio-mcp23s08/description
- Kernel module for Microchip MCP23xxx SPI/I2C I/O expander
+define KernelPackage/pinctrl-mcp23s08/description
+  Kernel module for Microchip MCP23xxx I/O expander
+endef
+
+$(eval $(call KernelPackage,pinctrl-mcp23s08))
+
+
+define KernelPackage/pinctrl-mcp23s08-i2c
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Microchip MCP23xxx I/O expander (I2C)
+  DEPENDS:=@GPIO_SUPPORT \
+	+kmod-pinctrl-mcp23s08 \
+	+kmod-i2c-core \
+	+kmod-regmap-i2c
+  KCONFIG:=CONFIG_PINCTRL_MCP23S08_I2C
+  FILES:=$(LINUX_DIR)/drivers/pinctrl/pinctrl-mcp23s08_i2c.ko
+  AUTOLOAD:=$(call AutoLoad,40,pinctrl-mcp23s08-i2c)
+endef
+
+define KernelPackage/pinctrl-mcp23s08-i2c/description
+  Kernel module for Microchip MCP23xxx I/O expander via I2C
 endef
 
-$(eval $(call KernelPackage,gpio-mcp23s08))
+$(eval $(call KernelPackage,pinctrl-mcp23s08-i2c))
+
+
+define KernelPackage/pinctrl-mcp23s08-spi
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Microchip MCP23xxx I/O expander (SPI)
+  DEPENDS:=@GPIO_SUPPORT +kmod-pinctrl-mcp23s08
+  KCONFIG:=CONFIG_PINCTRL_MCP23S08_SPI
+  FILES:=$(LINUX_DIR)/drivers/pinctrl/pinctrl-mcp23s08_spi.ko
+  AUTOLOAD:=$(call AutoLoad,40,pinctrl-mcp23s08-spi)
+endef
+
+define KernelPackage/pinctrl-mcp23s08-spi/description
+  Kernel module for Microchip MCP23xxx I/O expander via SPI
+endef
+
+$(eval $(call KernelPackage,pinctrl-mcp23s08-spi))
 
 
 define KernelPackage/gpio-nxp-74hc164
@@ -419,23 +470,6 @@ endef
 $(eval $(call KernelPackage,mmc))
 
 
-define KernelPackage/mvsdio
-  SUBMENU:=$(OTHER_MENU)
-  TITLE:=Marvell MMC/SD/SDIO host driver
-  DEPENDS:=+kmod-mmc @TARGET_kirkwood
-  KCONFIG:= CONFIG_MMC_MVSDIO
-  FILES:= \
-	$(LINUX_DIR)/drivers/mmc/host/mvsdio.ko
-  AUTOLOAD:=$(call AutoProbe,mvsdio,1)
-endef
-
-define KernelPackage/mvsdio/description
- Kernel support for the Marvell SDIO host driver.
-endef
-
-$(eval $(call KernelPackage,mvsdio))
-
-
 define KernelPackage/sdhci
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Secure Digital Host Controller Interface support
@@ -505,6 +539,7 @@ define KernelPackage/ssb
 	CONFIG_SSB_DRIVER_MIPS=n \
 	CONFIG_SSB_DRIVER_PCICORE=y \
 	CONFIG_SSB_DRIVER_PCICORE_POSSIBLE=y \
+	CONFIG_SSB_FALLBACK_SPROM=y \
 	CONFIG_SSB_PCIHOST=y \
 	CONFIG_SSB_PCIHOST_POSSIBLE=y \
 	CONFIG_SSB_POSSIBLE=y \
@@ -529,6 +564,7 @@ define KernelPackage/bcma
 	CONFIG_BCMA \
 	CONFIG_BCMA_POSSIBLE=y \
 	CONFIG_BCMA_BLOCKIO=y \
+	CONFIG_BCMA_FALLBACK_SPROM=y \
 	CONFIG_BCMA_HOST_PCI_POSSIBLE=y \
 	CONFIG_BCMA_HOST_PCI=y \
 	CONFIG_BCMA_HOST_SOC=n \
@@ -801,7 +837,8 @@ define KernelPackage/ramoops
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Ramoops (pstore-ram)
   DEFAULT:=m if ALL_KMODS
-  KCONFIG:=CONFIG_PSTORE_RAM
+  KCONFIG:=CONFIG_PSTORE_RAM \
+	CONFIG_PSTORE_CONSOLE=y
   DEPENDS:=+kmod-pstore +kmod-reed-solomon
   FILES:= $(LINUX_DIR)/fs/pstore/ramoops.ko
   AUTOLOAD:=$(call AutoLoad,30,ramoops,1)
@@ -865,7 +902,7 @@ define KernelPackage/serial-8250-exar
   KCONFIG:= CONFIG_SERIAL_8250_EXAR
   FILES:=$(LINUX_DIR)/drivers/tty/serial/8250/8250_exar.ko
   AUTOLOAD:=$(call AutoProbe,8250 8250_base 8250_exar)
-  DEPENDS:=+kmod-serial-8250
+  DEPENDS:=@PCI_SUPPORT +kmod-serial-8250
 endef
 
 define KernelPackage/serial-8250-exar/description
@@ -993,6 +1030,10 @@ define KernelPackage/zram/config
             bool "lz4"
             select PACKAGE_kmod-lib-lz4
 
+  config ZRAM_DEF_COMP_LZ4HC
+            bool "lz4-hc"
+            select PACKAGE_kmod-lib-lz4hc
+
   config ZRAM_DEF_COMP_ZSTD
             bool "zstd"
             select PACKAGE_kmod-lib-zstd
@@ -1211,8 +1252,8 @@ $(eval $(call KernelPackage,keys-trusted))
 define KernelPackage/tpm
   SUBMENU:=$(OTHER_MENU)
   TITLE:=TPM Hardware Support
-  DEPENDS:= +kmod-random-core +(LINUX_5_15):kmod-asn1-decoder \
-	  +(LINUX_5_15):kmod-asn1-encoder +(LINUX_5_15):kmod-oid-registry
+  DEPENDS:= +kmod-random-core +kmod-asn1-decoder \
+	  +kmod-asn1-encoder +kmod-oid-registry
   KCONFIG:= CONFIG_TCG_TPM
   FILES:= $(LINUX_DIR)/drivers/char/tpm/tpm.ko
   AUTOLOAD:=$(call AutoLoad,10,tpm,1)
@@ -1296,10 +1337,9 @@ $(eval $(call KernelPackage,i6300esb-wdt))
 define KernelPackage/mhi-bus
   SUBMENU:=$(OTHER_MENU)
   TITLE:=MHI bus
-  DEPENDS:=@LINUX_5_15
   KCONFIG:=CONFIG_MHI_BUS \
            CONFIG_MHI_BUS_DEBUG=y
-  FILES:=$(LINUX_DIR)/drivers/bus/mhi/core/mhi.ko
+  FILES:=$(LINUX_DIR)/drivers/bus/mhi/host/mhi.ko
   AUTOLOAD:=$(call AutoProbe,mhi)
 endef
 
@@ -1312,9 +1352,9 @@ $(eval $(call KernelPackage,mhi-bus))
 define KernelPackage/mhi-pci-generic
   SUBMENU:=$(OTHER_MENU)
   TITLE:=MHI PCI controller driver
-  DEPENDS:=@LINUX_5_15 +kmod-mhi-bus
+  DEPENDS:=@PCI_SUPPORT +kmod-mhi-bus
   KCONFIG:=CONFIG_MHI_BUS_PCI_GENERIC
-  FILES:=$(LINUX_DIR)/drivers/bus/mhi/mhi_pci_generic.ko
+  FILES:=$(LINUX_DIR)/drivers/bus/mhi/host/mhi_pci_generic.ko
   AUTOLOAD:=$(call AutoProbe,mhi_pci_generic)
 endef
 
diff --git a/package/kernel/linux/modules/spi.mk b/package/kernel/linux/modules/spi.mk
index 01dc7dc7e60705..78a1c8a03283b2 100644
--- a/package/kernel/linux/modules/spi.mk
+++ b/package/kernel/linux/modules/spi.mk
@@ -15,9 +15,9 @@ define KernelPackage/mmc-spi
           CONFIG_SPI=y \
           CONFIG_SPI_MASTER=y
   FILES:=\
-	$(if $(CONFIG_OF),$(LINUX_DIR)/drivers/mmc/host/of_mmc_spi.ko) \
+	$(LINUX_DIR)/drivers/mmc/host/of_mmc_spi.ko \
 	$(LINUX_DIR)/drivers/mmc/host/mmc_spi.ko
-  AUTOLOAD:=$(call AutoProbe,$(if $(CONFIG_OF),of_mmc_spi) mmc_spi)
+  AUTOLOAD:=$(call AutoProbe,of_mmc_spi mmc_spi)
 endef
 
 define KernelPackage/mmc-spi/description
diff --git a/package/kernel/linux/modules/usb.mk b/package/kernel/linux/modules/usb.mk
index f3838b3981d330..45efd7449f8db8 100644
--- a/package/kernel/linux/modules/usb.mk
+++ b/package/kernel/linux/modules/usb.mk
@@ -331,17 +331,6 @@ define KernelPackage/usb-bcma
 endef
 $(eval $(call KernelPackage,usb-bcma))
 
-define KernelPackage/usb-fotg210
-  TITLE:=Support for FOTG210 USB host controllers
-  DEPENDS:=@USB_SUPPORT @TARGET_gemini
-  KCONFIG:=CONFIG_USB_FOTG210_HCD
-  FILES:= \
-	$(if $(CONFIG_USB_FOTG210_HCD),$(LINUX_DIR)/drivers/usb/host/fotg210-hcd.ko)
-  AUTOLOAD:=$(call AutoLoad,50,fotg210-hcd,1)
-  $(call AddDepends/usb)
-endef
-$(eval $(call KernelPackage,usb-fotg210))
-
 define KernelPackage/usb-ssb
   TITLE:=Support for SSB USB controllers
   DEPENDS:=@USB_SUPPORT @TARGET_bcm47xx
@@ -494,7 +483,7 @@ $(eval $(call KernelPackage,usb-dwc3))
 
 define KernelPackage/usb-dwc3-qcom
   TITLE:=DWC3 Qualcomm USB driver
-  DEPENDS:=@(TARGET_ipq40xx||TARGET_ipq806x) +kmod-usb-dwc3
+  DEPENDS:=@(TARGET_ipq40xx||TARGET_ipq806x||TARGET_qualcommax) +kmod-usb-dwc3
   KCONFIG:= CONFIG_USB_DWC3_QCOM
   FILES:= $(LINUX_DIR)/drivers/usb/dwc3/dwc3-qcom.ko
   AUTOLOAD:=$(call AutoLoad,53,dwc3-qcom,1)
@@ -1155,7 +1144,9 @@ $(eval $(call KernelPackage,usb-net-aqc111))
 
 define KernelPackage/usb-net-asix
   TITLE:=Kernel module for USB-to-Ethernet Asix convertors
-  DEPENDS:=+kmod-libphy +LINUX_5_15:kmod-net-selftests +LINUX_5_15:kmod-mdio-devres +kmod-phy-ax88796b
+  DEPENDS:= \
+	+kmod-libphy +kmod-net-selftests +kmod-mdio-devres +kmod-phy-ax88796b \
+	+LINUX_6_1:kmod-phylink
   KCONFIG:=CONFIG_USB_NET_AX8817X
   FILES:=$(LINUX_DIR)/drivers/$(USBNET_DIR)/asix.ko
   AUTOLOAD:=$(call AutoProbe,asix)
@@ -1283,7 +1274,7 @@ $(eval $(call KernelPackage,usb-net-smsc75xx))
 
 define KernelPackage/usb-net-smsc95xx
   TITLE:=SMSC LAN95XX based USB 2.0 10/100 ethernet devices
-  DEPENDS:=+kmod-libphy +kmod-phy-smsc
+  DEPENDS:=+kmod-libphy +kmod-phy-smsc +LINUX_6_1:kmod-net-selftests
   KCONFIG:=CONFIG_USB_NET_SMSC95XX
   FILES:=$(LINUX_DIR)/drivers/$(USBNET_DIR)/smsc95xx.ko
   AUTOLOAD:=$(call AutoProbe,smsc95xx)
@@ -1394,7 +1385,7 @@ define KernelPackage/usb-net-rtl8152
   KCONFIG:=CONFIG_USB_RTL8152
   FILES:=$(LINUX_DIR)/drivers/$(USBNET_DIR)/r8152.ko
   AUTOLOAD:=$(call AutoProbe,r8152)
-  $(call AddDepends/usb-net, +LINUX_5_10:kmod-crypto-hash)
+  $(call AddDepends/usb-net)
 endef
 
 define KernelPackage/usb-net-rtl8152/description
@@ -1746,6 +1737,7 @@ define KernelPackage/usb3
 	+TARGET_bcm53xx:kmod-usb-bcma \
 	+TARGET_bcm53xx:kmod-phy-bcm-ns-usb3 \
 	+TARGET_ramips_mt7621:kmod-usb-xhci-mtk \
+	+TARGET_mediatek:kmod-usb-xhci-mtk \
 	+TARGET_apm821xx_nand:kmod-usb-xhci-pci-renesas \
 	+TARGET_mvebu_cortexa9:kmod-usb-xhci-pci-renesas
   KCONFIG:= \
@@ -1822,9 +1814,8 @@ define KernelPackage/usb-xhci-mtk
   KCONFIG:=CONFIG_USB_XHCI_MTK
   HIDDEN:=1
   FILES:= \
-	 $(LINUX_DIR)/drivers/usb/host/xhci-mtk.ko@lt5.13 \
-	 $(LINUX_DIR)/drivers/usb/host/xhci-mtk-hcd.ko@ge5.13
-  AUTOLOAD:=$(call AutoLoad,54,xhci-mtk@lt5.13 xhci-mtk-hcd@gt5.13,1)
+	 $(LINUX_DIR)/drivers/usb/host/xhci-mtk-hcd.ko
+  AUTOLOAD:=$(call AutoLoad,54,xhci-mtk-hcd,1)
   $(call AddDepends/usb)
 endef
 
diff --git a/package/kernel/linux/modules/video.mk b/package/kernel/linux/modules/video.mk
index 258414df45097c..f1e61f33a5761f 100644
--- a/package/kernel/linux/modules/video.mk
+++ b/package/kernel/linux/modules/video.mk
@@ -226,7 +226,7 @@ define KernelPackage/drm
   TITLE:=Direct Rendering Manager (DRM) support
   HIDDEN:=1
   DEPENDS:=+kmod-dma-buf +kmod-i2c-core +PACKAGE_kmod-backlight:kmod-backlight \
-	+(LINUX_5_15):kmod-fb
+	+kmod-fb
   KCONFIG:=CONFIG_DRM
   FILES:= \
 	$(LINUX_DIR)/drivers/gpu/drm/drm.ko \
@@ -256,6 +256,20 @@ endef
 
 $(eval $(call KernelPackage,drm-ttm))
 
+
+define KernelPackage/drm-ttm-helper
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=Helpers for ttm-based gem objects
+  HIDDEN:=1
+  DEPENDS:=@DISPLAY_SUPPORT +kmod-drm-ttm
+  KCONFIG:=CONFIG_DRM_TTM_HELPER
+  FILES:=$(LINUX_DIR)/drivers/gpu/drm/drm_ttm_helper.ko
+  AUTOLOAD:=$(call AutoProbe,drm_ttm_helper)
+endef
+
+$(eval $(call KernelPackage,drm-ttm-helper))
+
+
 define KernelPackage/drm-kms-helper
   SUBMENU:=$(VIDEO_MENU)
   TITLE:=CRTC helpers for KMS drivers
@@ -278,7 +292,7 @@ define KernelPackage/drm-amdgpu
   SUBMENU:=$(VIDEO_MENU)
   TITLE:=AMDGPU DRM support
   DEPENDS:=@TARGET_x86 @DISPLAY_SUPPORT +kmod-backlight +kmod-drm-ttm \
-	+kmod-drm-kms-helper +kmod-i2c-algo-bit +amdgpu-firmware
+	+kmod-drm-ttm-helper +kmod-drm-kms-helper +kmod-i2c-algo-bit +amdgpu-firmware
   KCONFIG:=CONFIG_DRM_AMDGPU \
 	CONFIG_DRM_AMDGPU_SI=y \
 	CONFIG_DRM_AMDGPU_CIK=y \
@@ -362,7 +376,7 @@ define KernelPackage/drm-imx-ldb
 	CONFIG_DRM_PANEL_SITRONIX_ST7789V=n
   FILES:=$(LINUX_DIR)/drivers/gpu/drm/imx/imx-ldb.ko \
 	$(LINUX_DIR)/drivers/gpu/drm/panel/panel-simple.ko \
-	$(LINUX_DIR)/drivers/gpu/drm/drm_dp_aux_bus.ko@gt5.10
+	$(LINUX_DIR)/drivers/gpu/drm/drm_dp_aux_bus.ko
   AUTOLOAD:=$(call AutoLoad,08,imx-ldb)
 endef
 
@@ -376,7 +390,7 @@ define KernelPackage/drm-radeon
   SUBMENU:=$(VIDEO_MENU)
   TITLE:=Radeon DRM support
   DEPENDS:=@TARGET_x86 @DISPLAY_SUPPORT +kmod-backlight +kmod-drm-kms-helper \
-	+kmod-drm-ttm +kmod-i2c-algo-bit +radeon-firmware
+	+kmod-drm-ttm +kmod-drm-ttm-helper +kmod-i2c-algo-bit +radeon-firmware
   KCONFIG:=CONFIG_DRM_RADEON
   FILES:=$(LINUX_DIR)/drivers/gpu/drm/radeon/radeon.ko
   AUTOLOAD:=$(call AutoProbe,radeon)
diff --git a/package/kernel/linux/modules/virt.mk b/package/kernel/linux/modules/virt.mk
index 5ed0d5dbbf2221..90226b480638c2 100644
--- a/package/kernel/linux/modules/virt.mk
+++ b/package/kernel/linux/modules/virt.mk
@@ -72,3 +72,48 @@ define KernelPackage/kvm-amd/description
 endef
 
 $(eval $(call KernelPackage,kvm-amd))
+
+
+define KernelPackage/vfio
+  SUBMENU:=Virtualization
+  TITLE:=VFIO Non-Privileged userspace driver framework
+  DEPENDS:=@TARGET_x86_64
+  KCONFIG:= \
+	CONFIG_VFIO \
+	CONFIG_VFIO_NOIOMMU=n \
+	CONFIG_VFIO_MDEV=n
+  MODPARAMS.vfio:=\
+	enable_unsafe_noiommu_mode=n
+  FILES:= \
+	$(LINUX_DIR)/drivers/vfio/vfio.ko \
+	$(LINUX_DIR)/drivers/vfio/vfio_virqfd.ko \
+	$(LINUX_DIR)/drivers/vfio/vfio_iommu_type1.ko
+  AUTOLOAD:=$(call AutoProbe,vfio vfio_iommu_type1 vfio_virqfd)
+endef
+
+define KernelPackage/vfio/description
+  VFIO provides a framework for secure userspace device drivers.
+endef
+
+$(eval $(call KernelPackage,vfio))
+
+
+define KernelPackage/vfio-pci
+  SUBMENU:=Virtualization
+  TITLE:=Generic VFIO support for any PCI device
+  DEPENDS:=@TARGET_x86_64 @PCI_SUPPORT +kmod-vfio +kmod-irqbypass
+  KCONFIG:= \
+	CONFIG_VFIO_PCI \
+	CONFIG_VFIO_PCI_IGD=n
+  FILES:= \
+	$(LINUX_DIR)/drivers/vfio/pci/vfio-pci-core.ko \
+	$(LINUX_DIR)/drivers/vfio/pci/vfio-pci.ko
+  AUTOLOAD:=$(call AutoProbe,vfio-pci)
+endef
+
+define KernelPackage/vfio-pci/description
+  Support for the generic PCI VFIO bus driver which can connect any PCI
+  device to the VFIO framework.
+endef
+
+$(eval $(call KernelPackage,vfio-pci))
diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
index d467d20c61147f..a7472ee7794f15 100644
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@@ -10,10 +10,11 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=mac80211
 
-PKG_VERSION:=5.15.58-1
-PKG_RELEASE:=2
-PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v5.15.58/
-PKG_HASH:=a3c2a2b7bbaf8943c65fd72f4e7d7ad5e205aeae28b26c835f9d8afa0f9810bf
+PKG_VERSION:=6.1.24
+PKG_RELEASE:=4
+# PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v5.15.58/
+PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources/
+PKG_HASH:=5d39aca7e34c33cb9b3e366117b2e86841b7bdd37933679d6b1e61be6b150648
 
 PKG_SOURCE:=backports-$(PKG_VERSION).tar.xz
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/backports-$(PKG_VERSION)
@@ -22,15 +23,10 @@ PKG_BUILD_PARALLEL:=1
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 
 PKG_DRIVERS = \
-	adm8211 \
-	hermes hermes-pci hermes-pcmcia hermes-plx\
-	lib80211 \
 	mac80211-hwsim \
 	mt7601u \
-	p54-common p54-pci p54-usb \
 	rsi91x rsi91x-usb rsi91x-sdio\
-	wlcore wl12xx wl18xx \
-	zd1211rw
+	wlcore wl12xx wl18xx
 
 PKG_CONFIG_DEPENDS:= \
 	CONFIG_PACKAGE_kmod-mac80211 \
@@ -56,7 +52,6 @@ config_package=$(if $(CONFIG_PACKAGE_kmod-$(1)),m)
 
 config-y:= \
 	WLAN \
-	CFG80211_WEXT \
 	CFG80211_CERTIFICATION_ONUS \
 	MAC80211_RC_MINSTREL \
 	MAC80211_RC_MINSTREL_HT \
@@ -165,94 +160,10 @@ define KernelPackage/mac80211/description
 Generic IEEE 802.11 Networking Stack (mac80211)
 endef
 
-define KernelPackage/adm8211
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=ADMTek 8211 support
-  DEPENDS+=@PCI_SUPPORT +kmod-mac80211 +kmod-eeprom-93cx6
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/admtek/adm8211.ko
-  AUTOLOAD:=$(call AutoProbe,adm8211)
-endef
-
-define KernelPackage/hermes
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Hermes 802.11b chipset support
-  DEPENDS:=@PCI_SUPPORT||PCMCIA_SUPPORT +kmod-cfg80211 +@DRIVER_WEXT_SUPPORT +kmod-crypto-michael-mic
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/orinoco/orinoco.ko
-  AUTOLOAD:=$(call AutoProbe,orinoco)
-endef
-
-define KernelPackage/hermes/description
- Kernel support for Hermes 802.11b chipsets
-endef
-
-define KernelPackage/hermes-pci
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Intersil Prism 2.5 PCI support
-  DEPENDS:=@PCI_SUPPORT +kmod-hermes
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/orinoco/orinoco_pci.ko
-  AUTOLOAD:=$(call AutoProbe,orinoco_pci)
-endef
-
-define KernelPackage/hermes-pci/description
- Kernel modules for Intersil Prism 2.5 PCI support
-endef
-
-define KernelPackage/hermes-plx
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=PLX9052 based PCI adaptor
-  DEPENDS:=@PCI_SUPPORT +kmod-hermes
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/orinoco/orinoco_plx.ko
-  AUTOLOAD:=$(call AutoProbe,orinoco_plx)
-endef
-
-define KernelPackage/hermes-plx/description
- Kernel modules for Hermes in PLX9052 based PCI adaptors
-endef
-
-define KernelPackage/hermes-pcmcia
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Hermes based PCMCIA adaptors
-  DEPENDS:=@PCMCIA_SUPPORT +kmod-hermes +kmod-pcmcia-core
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/orinoco/orinoco_cs.ko
-  AUTOLOAD:=$(call AutoProbe,orinoco_cs)
-endef
-
-define KernelPackage/hermes-pcmcia/description
- Kernel modules for Hermes based PCMCIA adaptors
-endef
-
-
-define KernelPackage/lib80211
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=802.11 Networking stack
-  DEPENDS:=+kmod-cfg80211 +kmod-crypto-hash +kmod-crypto-ccm
-  FILES:= \
-	$(PKG_BUILD_DIR)/net/wireless/lib80211.ko \
-	$(PKG_BUILD_DIR)/net/wireless/lib80211_crypt_wep.ko \
-	$(PKG_BUILD_DIR)/net/wireless/lib80211_crypt_ccmp.ko \
-	$(PKG_BUILD_DIR)/net/wireless/lib80211_crypt_tkip.ko
-  AUTOLOAD:=$(call AutoProbe, \
-	lib80211 \
-	lib80211_crypt_wep \
-	lib80211_crypt_ccmp \
-	lib80211_crypt_tkip \
-  )
-endef
-
-define KernelPackage/lib80211/description
- Kernel modules for 802.11 Networking stack
- Includes:
- - lib80211
- - lib80211_crypt_wep
- - lib80211_crypt_tkip
- - lib80211_crytp_ccmp
-endef
-
-
 define KernelPackage/mac80211-hwsim
   $(call KernelPackage/mac80211/Default)
   TITLE:=mac80211 HW simulation device
-  DEPENDS+= +kmod-mac80211 +@DRIVER_11AX_SUPPORT +@DRIVER_11AC_SUPPORT +@DRIVER_11N_SUPPORT
+  DEPENDS+= +kmod-mac80211 +@DRIVER_11AX_SUPPORT +@DRIVER_11AC_SUPPORT
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/mac80211_hwsim.ko
   AUTOLOAD:=$(call AutoProbe,mac80211_hwsim)
 endef
@@ -261,47 +172,15 @@ endef
 define KernelPackage/mt7601u
   $(call KernelPackage/mac80211/Default)
   TITLE:=MT7601U-based USB dongles Wireless Driver
-  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT @USB_SUPPORT +kmod-usb-core +mt7601u-firmware
+  DEPENDS+= +kmod-mac80211 @USB_SUPPORT +kmod-usb-core +mt7601u-firmware
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/mediatek/mt7601u/mt7601u.ko
   AUTOLOAD:=$(call AutoProbe,mt7601u)
 endef
 
-define KernelPackage/p54/Default
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Prism54 Drivers
-endef
-
-define KernelPackage/p54/description
-  Kernel module for Prism54 chipsets (mac80211)
-endef
-
-define KernelPackage/p54-common
-  $(call KernelPackage/p54/Default)
-  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT) +kmod-mac80211 +kmod-lib-crc-ccitt
-  TITLE+= (COMMON)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/p54/p54common.ko
-endef
-
-define KernelPackage/p54-pci
-  $(call KernelPackage/p54/Default)
-  TITLE+= (PCI)
-  DEPENDS+= @PCI_SUPPORT +kmod-p54-common +p54-pci-firmware
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/p54/p54pci.ko
-  AUTOLOAD:=$(call AutoProbe,p54pci)
-endef
-
-define KernelPackage/p54-usb
-  $(call KernelPackage/p54/Default)
-  TITLE+= (USB)
-  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-p54-common +p54-usb-firmware
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/p54/p54usb.ko
-  AUTOLOAD:=$(call AutoProbe,p54usb)
-endef
-
 define KernelPackage/rsi91x
   $(call KernelPackage/mac80211/Default)
   TITLE:=Redpine Signals Inc 91x WLAN driver support
-  DEPENDS+= +kmod-mac80211 +rs9113-firmware +@DRIVER_11N_SUPPORT
+  DEPENDS+= +kmod-mac80211 +rs9113-firmware
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rsi/rsi_91x.ko
 endef
 
@@ -325,7 +204,7 @@ endef
 define KernelPackage/wlcore
   $(call KernelPackage/mac80211/Default)
   TITLE:=TI common driver part
-  DEPENDS+= +kmod-mmc +kmod-mac80211 +@DRIVER_11N_SUPPORT
+  DEPENDS+= +kmod-mmc +kmod-mac80211
   FILES:= \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wlcore/wlcore.ko \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wlcore/wlcore_sdio.ko
@@ -363,23 +242,6 @@ define KernelPackage/wl18xx/description
 endef
 
 
-ZD1211FW_NAME:=zd1211-firmware
-ZD1211FW_VERSION:=1.4
-define Download/zd1211rw
-  FILE:=$(ZD1211FW_NAME)-$(ZD1211FW_VERSION).tar.bz2
-  URL:=@SF/zd1211/
-  HASH:=866308f6f59f7075f075d4959dff2ede47735c751251fecd1496df1ba4d338e1
-endef
-$(eval $(call Download,zd1211rw))
-
-define KernelPackage/zd1211rw
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Zydas ZD1211 support
-  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-mac80211
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/zydas/zd1211rw/zd1211rw.ko
-  AUTOLOAD:=$(call AutoProbe,zd1211rw)
-endef
-
 ifdef CONFIG_PACKAGE_MAC80211_DEBUGFS
   config-y += \
 	CFG80211_DEBUGFS \
@@ -391,28 +253,14 @@ ifdef CONFIG_PACKAGE_MAC80211_TRACING
 	IWLWIFI_DEVICE_TRACING
 endif
 
-config-$(call config_package,lib80211) += LIB80211 LIB80211_CRYPT_WEP LIB80211_CRYPT_CCMP LIB80211_CRYPT_TKIP
-
 config-$(call config_package,mac80211-hwsim) += MAC80211_HWSIM
 config-$(call config_package,mt7601u) += MT7601U
 config-y += WL_MEDIATEK
 
-config-$(call config_package,p54-common) += P54_COMMON
-config-$(call config_package,p54-pci) += P54_PCI
-config-$(call config_package,p54-usb) += P54_USB
-
-config-$(call config_package,hermes) += HERMES
-config-$(call config_package,hermes-pci) += PCI_HERMES
-config-$(call config_package,hermes-plx) += PLX_HERMES
-config-$(call config_package,hermes-pcmcia) += PCMCIA_HERMES
-config-y += HERMES_PRISM
-
-config-$(call config_package,adm8211) += ADM8211
 config-$(call config_package,wlcore) += WLCORE WLCORE_SDIO
 config-$(call config_package,wl12xx) += WL12XX
 config-$(call config_package,wl18xx) += WL18XX
 config-y += WL_TI WILINK_PLATFORM_DATA
-config-$(call config_package,zd1211rw) += ZD1211RW
 config-$(call config_package,rsi91x) += RSI_91X
 config-$(call config_package,rsi91x-usb) += RSI_USB
 config-$(call config_package,rsi91x-sdio) += RSI_SDIO
@@ -425,8 +273,8 @@ ifeq ($(BUILD_VARIANT),smallbuffers)
 	C_DEFINES+= -DCONFIG_ATH10K_SMALLBUFFERS
 endif
 
-MAKE_OPTS:= -C "$(PKG_BUILD_DIR)" \
-	$(KERNEL_MAKE_FLAGS) \
+MAKE_OPTS:= \
+	$(subst -C $(LINUX_DIR),-C "$(PKG_BUILD_DIR)",$(KERNEL_MAKEOPTS)) \
 	EXTRA_CFLAGS="-I$(PKG_BUILD_DIR)/include $(IREMAP_CFLAGS) $(C_DEFINES)" \
 	KLIB_BUILD="$(LINUX_DIR)" \
 	MODPROBE=true \
@@ -449,9 +297,6 @@ define Build/Prepare
 	mkdir -p $(PKG_BUILD_DIR)
 	$(PKG_UNPACK)
 	$(Build/Patch)
-	$(TAR) -C $(PKG_BUILD_DIR) -xzf $(DL_DIR)/$(IPW2100_NAME)-$(IPW2100_VERSION).tgz
-	$(TAR) -C $(PKG_BUILD_DIR) -xzf $(DL_DIR)/$(IPW2200_NAME)-$(IPW2200_VERSION).tgz
-	$(TAR) -C $(PKG_BUILD_DIR) -xjf $(DL_DIR)/$(ZD1211FW_NAME)-$(ZD1211FW_VERSION).tar.bz2
 	rm -rf \
 		$(PKG_BUILD_DIR)/include/linux/ssb \
 		$(PKG_BUILD_DIR)/include/linux/bcma \
@@ -462,14 +307,14 @@ define Build/Prepare
 		$(PKG_BUILD_DIR)/include/linux/crc8.h \
 		$(PKG_BUILD_DIR)/include/linux/eeprom_93cx6.h \
 		$(PKG_BUILD_DIR)/include/linux/wl12xx.h \
-		$(PKG_BUILD_DIR)/include/linux/spi/libertas_spi.h \
+		$(PKG_BUILD_DIR)/include/linux/mhi.h \
 		$(PKG_BUILD_DIR)/include/net/ieee80211.h \
 		$(PKG_BUILD_DIR)/backport-include/linux/bcm47xx_nvram.h
 
 	echo 'compat-wireless-$(PKG_VERSION)-$(PKG_RELEASE)-$(REVISION)' > $(PKG_BUILD_DIR)/compat_version
 endef
 
-ifneq ($(CONFIG_PACKAGE_kmod-cfg80211)$(CONFIG_PACKAGE_kmod-lib80211),)
+ifneq ($(CONFIG_PACKAGE_kmod-cfg80211),)
  define Build/Compile/kmod
 	rm -rf $(PKG_BUILD_DIR)/modules
 	+$(MAKE) $(PKG_JOBS) $(MAKE_OPTS) modules
@@ -497,6 +342,7 @@ define Build/Patch
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath10k,ath10k/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath11k,ath11k/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rt2x00,rt2x00/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mt7601u,mt7601u/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mwl,mwl/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/brcm,brcm/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rtl,rtl/)
@@ -512,6 +358,7 @@ define Quilt/Refresh/Package
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath10k,ath10k/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath11k,ath11k/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rt2x00,rt2x00/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mt7601u,mt7601u/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mwl,mwl/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/brcm,brcm/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rtl,rtl/)
@@ -545,11 +392,6 @@ define KernelPackage/cfg80211/install
 	$(INSTALL_DATA) ./files/mac80211.hotplug $(1)/etc/hotplug.d/ieee80211/10-wifi-detect
 endef
 
-define KernelPackage/zd1211rw/install
-	$(INSTALL_DIR) $(1)/lib/firmware/zd1211
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(ZD1211FW_NAME)/zd1211* $(1)/lib/firmware/zd1211
-endef
-
 $(eval $(foreach drv,$(PKG_DRIVERS),$(call KernelPackage,$(drv))))
 $(eval $(call KernelPackage,cfg80211))
 $(eval $(call KernelPackage,mac80211))
diff --git a/package/kernel/mac80211/ath.mk b/package/kernel/mac80211/ath.mk
index 9af8c4665d198f..c75630a8bb0b67 100644
--- a/package/kernel/mac80211/ath.mk
+++ b/package/kernel/mac80211/ath.mk
@@ -1,6 +1,6 @@
 PKG_DRIVERS += \
 	ath ath5k ath6kl ath6kl-sdio ath6kl-usb ath9k ath9k-common ath9k-htc ath10k ath10k-smallbuffers \
-	carl9170 owl-loader ar5523 wil6210
+	ath11k ath11k-ahb ath11k-pci carl9170 owl-loader ar5523 wil6210
 
 PKG_CONFIG_DEPENDS += \
 	CONFIG_PACKAGE_ATH_DEBUG \
@@ -12,6 +12,7 @@ PKG_CONFIG_DEPENDS += \
 	CONFIG_ATH9K_TX99 \
 	CONFIG_ATH10K_LEDS \
 	CONFIG_ATH10K_THERMAL \
+	CONFIG_ATH11K_THERMAL \
 	CONFIG_ATH_USER_REGD
 
 ifdef CONFIG_PACKAGE_MAC80211_DEBUGFS
@@ -19,6 +20,7 @@ ifdef CONFIG_PACKAGE_MAC80211_DEBUGFS
 	ATH9K_DEBUGFS \
 	ATH9K_HTC_DEBUGFS \
 	ATH10K_DEBUGFS \
+	ATH11K_DEBUGFS \
 	CARL9170_DEBUGFS \
 	ATH5K_DEBUG \
 	ATH6KL_DEBUG \
@@ -28,6 +30,7 @@ endif
 ifdef CONFIG_PACKAGE_MAC80211_TRACING
   config-y += \
 	ATH10K_TRACING \
+	ATH11K_TRACING \
 	ATH6KL_TRACING \
 	ATH_TRACEPOINTS \
 	ATH5K_TRACER \
@@ -35,9 +38,9 @@ ifdef CONFIG_PACKAGE_MAC80211_TRACING
 endif
 
 config-$(call config_package,ath) += ATH_CARDS ATH_COMMON
-config-$(CONFIG_PACKAGE_ATH_DEBUG) += ATH_DEBUG ATH10K_DEBUG ATH9K_STATION_STATISTICS
+config-$(CONFIG_PACKAGE_ATH_DEBUG) += ATH_DEBUG ATH10K_DEBUG ATH11K_DEBUG ATH9K_STATION_STATISTICS
 config-$(CONFIG_PACKAGE_ATH_DFS) += ATH9K_DFS_CERTIFIED ATH10K_DFS_CERTIFIED
-config-$(CONFIG_PACKAGE_ATH_SPECTRAL) += ATH9K_COMMON_SPECTRAL ATH10K_SPECTRAL
+config-$(CONFIG_PACKAGE_ATH_SPECTRAL) += ATH9K_COMMON_SPECTRAL ATH10K_SPECTRAL ATH11K_SPECTRAL
 config-$(CONFIG_PACKAGE_ATH_DYNACK) += ATH9K_DYNACK
 config-$(call config_package,ath9k) += ATH9K
 config-$(call config_package,ath9k-common) += ATH9K_COMMON
@@ -52,10 +55,14 @@ config-$(CONFIG_ATH9K_TX99) += ATH9K_TX99
 config-$(CONFIG_ATH9K_UBNTHSR) += ATH9K_UBNTHSR
 config-$(CONFIG_ATH10K_LEDS) += ATH10K_LEDS
 config-$(CONFIG_ATH10K_THERMAL) += ATH10K_THERMAL
+config-$(CONFIG_ATH11K_THERMAL) += ATH11K_THERMAL
 
 config-$(call config_package,ath9k-htc) += ATH9K_HTC
 config-$(call config_package,ath10k) += ATH10K ATH10K_PCI
 config-$(call config_package,ath10k-smallbuffers) += ATH10K ATH10K_PCI ATH10K_SMALLBUFFERS
+config-$(call config_package,ath11k) += ATH11K
+config-$(call config_package,ath11k-ahb) += ATH11K_AHB
+config-$(call config_package,ath11k-pci) += ATH11K_PCI
 
 config-$(call config_package,ath5k) += ATH5K
 ifdef CONFIG_TARGET_ath25
@@ -154,7 +161,7 @@ define KernelPackage/ath6kl
   TITLE:=Atheros FullMAC wireless devices (common code for ath6kl_sdio and ath6kl_usb)
   URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath6kl
   HIDDEN:=1
-  DEPENDS+= +kmod-ath +@DRIVER_11N_SUPPORT
+  DEPENDS+= +kmod-ath
   FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath6kl/ath6kl_core.ko
 endef
 
@@ -191,7 +198,7 @@ define KernelPackage/ath9k-common
   TITLE:=Atheros 802.11n wireless devices (common code for ath9k and ath9k_htc)
   URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
   HIDDEN:=1
-  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ath79 +kmod-ath +@DRIVER_11N_SUPPORT
+  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ath79 +kmod-ath +kmod-random-core
   FILES:= \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_common.ko \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_hw.ko
@@ -218,7 +225,7 @@ define KernelPackage/ath9k/config
 		bool "Add wireless noise as source of randomness to kernel entropy pool"
 		depends on PACKAGE_kmod-ath9k
 		select PACKAGE_kmod-random-core
-		default n
+		default y
 
 	config ATH9K_SUPPORT_PCOEM
 		bool "Support chips used in PC OEM cards"
@@ -255,7 +262,7 @@ define KernelPackage/ath10k
   $(call KernelPackage/mac80211/Default)
   TITLE:=Atheros 802.11ac wireless cards support
   URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath10k
-  DEPENDS+= @PCI_SUPPORT +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT \
+  DEPENDS+= @PCI_SUPPORT +kmod-ath +@DRIVER_11AC_SUPPORT \
 	+ATH10K_THERMAL:kmod-hwmon-core +ATH10K_THERMAL:kmod-thermal
   FILES:= \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_core.ko \
@@ -290,10 +297,62 @@ define KernelPackage/ath10k-smallbuffers
   VARIANT:=smallbuffers
 endef
 
+define KernelPackage/ath11k
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Qualcomm 802.11ax wireless chipset support (common code)
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath11k
+  DEPENDS+= +kmod-ath +@DRIVER_11AC_SUPPORT +@DRIVER_11AX_SUPPORT \
+  +kmod-crypto-michael-mic +ATH11K_THERMAL:kmod-hwmon-core +ATH11K_THERMAL:kmod-thermal
+  FILES:=$(PKG_BUILD_DIR)/drivers/soc/qcom/qmi_helpers.ko \
+  $(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath11k/ath11k.ko
+endef
+
+define KernelPackage/ath11k/description
+This module adds support for Qualcomm Technologies 802.11ax family of
+chipsets.
+endef
+
+define KernelPackage/ath11k/config
+
+       config ATH11K_THERMAL
+               bool "Enable thermal sensors and throttling support"
+               depends on PACKAGE_kmod-ath11k
+               default y if TARGET_qualcommax
+
+endef
+
+define KernelPackage/ath11k-ahb
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Qualcomm 802.11ax AHB wireless chipset support
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath11k
+  DEPENDS+= @TARGET_qualcommax +kmod-ath11k +kmod-qrtr-smd
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath11k/ath11k_ahb.ko
+  AUTOLOAD:=$(call AutoProbe,ath11k_ahb)
+endef
+
+define KernelPackage/ath11k-ahb/description
+This module adds support for Qualcomm Technologies 802.11ax family of
+chipsets with AHB bus.
+endef
+
+define KernelPackage/ath11k-pci
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Qualcomm 802.11ax PCI wireless chipset support
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath11k
+  DEPENDS+= @PCI_SUPPORT +kmod-qrtr-mhi +kmod-ath11k
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath11k/ath11k_pci.ko
+  AUTOLOAD:=$(call AutoProbe,ath11k_pci)
+endef
+
+define KernelPackage/ath11k-pci/description
+This module adds support for Qualcomm Technologies 802.11ax family of
+chipsets with PCI bus.
+endef
+
 define KernelPackage/carl9170
   $(call KernelPackage/mac80211/Default)
   TITLE:=Driver for Atheros AR9170 USB sticks
-  DEPENDS:=@USB_SUPPORT +kmod-mac80211 +kmod-ath +kmod-usb-core +kmod-input-core +@DRIVER_11N_SUPPORT +carl9170-firmware
+  DEPENDS:=@USB_SUPPORT +kmod-mac80211 +kmod-ath +kmod-usb-core +kmod-input-core +carl9170-firmware
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/carl9170/carl9170.ko
   AUTOLOAD:=$(call AutoProbe,carl9170)
 endef
@@ -318,7 +377,7 @@ endef
 define KernelPackage/ar5523
   $(call KernelPackage/mac80211/Default)
   TITLE:=Driver for Atheros AR5523 USB sticks
-  DEPENDS:=@USB_SUPPORT +kmod-mac80211 +kmod-ath +kmod-usb-core +kmod-input-core 
+  DEPENDS:=@USB_SUPPORT +kmod-mac80211 +kmod-ath +kmod-usb-core +kmod-input-core
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ar5523/ar5523.ko
   AUTOLOAD:=$(call AutoProbe,ar5523)
 endef
diff --git a/package/kernel/mac80211/broadcom.mk b/package/kernel/mac80211/broadcom.mk
index 5548f6e661ae11..cf80ad2d32603b 100644
--- a/package/kernel/mac80211/broadcom.mk
+++ b/package/kernel/mac80211/broadcom.mk
@@ -1,5 +1,5 @@
 PKG_DRIVERS += \
-	b43 b43legacy brcmsmac brcmfmac brcmutil
+	b43 brcmsmac brcmfmac brcmutil
 
 PKG_CONFIG_DEPENDS += \
 	CONFIG_PACKAGE_B43_DEBUG \
@@ -24,9 +24,6 @@ config-$(CONFIG_PACKAGE_B43_PHY_HT) += B43_PHY_HT
 config-$(CONFIG_PACKAGE_B43_PIO) += B43_PIO
 config-$(CONFIG_PACKAGE_B43_DEBUG) += B43_DEBUG
 
-config-$(call config_package,b43legacy) += B43LEGACY
-config-y += B43LEGACY_DMA_MODE
-
 config-$(call config_package,brcmutil) += BRCMUTIL
 config-$(call config_package,brcmsmac) += BRCMSMAC
 config-$(call config_package,brcmfmac) += BRCMFMAC
@@ -248,11 +245,11 @@ config PACKAGE_B43_USE_BCMA
 		  This allows choosing buses that b43 should support.
 
 	config PACKAGE_B43_BUSES_BCMA_AND_SSB
-		depends on !TARGET_bcm47xx_legacy && !TARGET_bcm47xx_mips74k && !TARGET_bcm53xx
+		depends on !TARGET_bcm47xx_legacy && !TARGET_bcm47xx_mips74k && !TARGET_bcm53xx && !TARGET_bmips
 		bool "BCMA and SSB"
 
 	config PACKAGE_B43_BUSES_BCMA
-		depends on !TARGET_bcm47xx_legacy
+		depends on !TARGET_bcm47xx_legacy && !TARGET_bmips_bcm6358 && !TARGET_bmips_bcm6368
 		bool "BCMA only"
 
 	config PACKAGE_B43_BUSES_SSB
@@ -341,23 +338,6 @@ define KernelPackage/b43/description
 Kernel module for Broadcom 43xx wireless support (mac80211 stack) new
 endef
 
-define KernelPackage/b43legacy
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Broadcom 43xx-legacy wireless support
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/b43
-  KCONFIG:= \
-  	CONFIG_HW_RANDOM=y
-  DEPENDS+= +kmod-mac80211 +!(TARGET_bcm47xx||TARGET_bcm63xx):kmod-ssb @!TARGET_bcm47xx_mips74k +b43legacy-firmware
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/b43legacy/b43legacy.ko
-  AUTOLOAD:=$(call AutoProbe,b43legacy)
-  MENU:=1
-endef
-
-define KernelPackage/b43legacy/description
-Kernel module for Broadcom 43xx-legacy wireless support (mac80211 stack) new
-endef
-
-
 define KernelPackage/brcmutil
   $(call KernelPackage/mac80211/Default)
   TITLE:=Broadcom IEEE802.11n common driver parts
@@ -401,7 +381,7 @@ define KernelPackage/brcmsmac
   $(call KernelPackage/mac80211/Default)
   TITLE:=Broadcom IEEE802.11n PCIe SoftMAC WLAN driver
   URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
-  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT +!TARGET_bcm47xx:kmod-bcma +kmod-lib-cordic +kmod-lib-crc8 +kmod-brcmutil +!BRCMSMAC_USE_FW_FROM_WL:brcmsmac-firmware
+  DEPENDS+=@!TARGET_bcm47xx_legacy +kmod-mac80211 +!TARGET_bcm47xx:kmod-bcma +kmod-lib-cordic +kmod-lib-crc8 +kmod-brcmutil +!BRCMSMAC_USE_FW_FROM_WL:brcmsmac-firmware
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmsmac/brcmsmac.ko
   AUTOLOAD:=$(call AutoProbe,brcmsmac)
   MENU:=1
@@ -433,7 +413,7 @@ define KernelPackage/brcmfmac
   $(call KernelPackage/mac80211/Default)
   TITLE:=Broadcom IEEE802.11n USB FullMAC WLAN driver
   URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
-  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT \
+  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +@DRIVER_11AC_SUPPORT \
   	+kmod-brcmutil +BRCMFMAC_SDIO:kmod-mmc @!TARGET_uml \
 	+BRCMFMAC_USB:kmod-usb-core +BRCMFMAC_USB:brcmfmac-firmware-usb
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmfmac/brcmfmac.ko
diff --git a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
index f5249408546771..5aaba9af26c608 100644
--- a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
+++ b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
@@ -51,6 +51,8 @@ drv_mac80211_init_device_config() {
 		rx_antenna_pattern \
 		tx_antenna_pattern \
 		he_spr_sr_control \
+		he_spr_psr_enabled \
+		he_bss_color_enabled \
 		he_twt_required
 	config_add_int \
 		beamformer_antennas \
@@ -138,8 +140,8 @@ mac80211_hostapd_setup_base() {
 	[ -n "$acs_exclude_dfs" ] && [ "$acs_exclude_dfs" -gt 0 ] &&
 		append base_cfg "acs_exclude_dfs=1" "$N"
 
-	json_get_vars noscan ht_coex min_tx_power:0
-	json_get_values ht_capab_list ht_capab tx_burst
+	json_get_vars noscan ht_coex min_tx_power:0 tx_burst
+	json_get_values ht_capab_list ht_capab
 	json_get_values channel_list channels
 
 	[ "$auto_channel" = 0 ] && [ -z "$channel_list" ] && \
@@ -414,12 +416,14 @@ mac80211_hostapd_setup_base() {
 	if [ "$enable_ax" != "0" ]; then
 		json_get_vars \
 			he_su_beamformer:1 \
-			he_su_beamformee:0 \
+			he_su_beamformee:1 \
 			he_mu_beamformer:1 \
 			he_twt_required:0 \
-			he_spr_sr_control:0 \
-			he_spr_non_srg_obss_pd_max_offset:1 \
-			he_bss_color
+			he_spr_sr_control:3 \
+			he_spr_psr_enabled:0 \
+			he_spr_non_srg_obss_pd_max_offset:0 \
+			he_bss_color:128 \
+			he_bss_color_enabled:1
 
 		he_phy_cap=$(iw phy "$phy" info | sed -n '/HE Iftypes: AP/,$p' | awk -F "[()]" '/HE PHY Capabilities/ { print $2 }' | head -1)
 		he_phy_cap=${he_phy_cap:2}
@@ -432,17 +436,25 @@ mac80211_hostapd_setup_base() {
 			append base_cfg "he_oper_centr_freq_seg0_idx=$vht_center_seg0" "$N"
 		}
 
-		set_default he_bss_color 128
-		append base_cfg "he_bss_color=$he_bss_color" "$N"
-
 		mac80211_add_he_capabilities \
 			he_su_beamformer:${he_phy_cap:6:2}:0x80:$he_su_beamformer \
 			he_su_beamformee:${he_phy_cap:8:2}:0x1:$he_su_beamformee \
 			he_mu_beamformer:${he_phy_cap:8:2}:0x2:$he_mu_beamformer \
-			he_spr_sr_control:${he_phy_cap:14:2}:0x1:$he_spr_sr_control \
+			he_spr_psr_enabled:${he_phy_cap:14:2}:0x1:$he_spr_psr_enabled \
 			he_twt_required:${he_mac_cap:0:2}:0x6:$he_twt_required
 
-		[ "$he_spr_sr_control" -gt 0 ] && append base_cfg "he_spr_non_srg_obss_pd_max_offset=$he_spr_non_srg_obss_pd_max_offset" "$N"
+		if [ "$he_bss_color_enabled" -gt 0 ]; then
+			append base_cfg "he_bss_color=$he_bss_color" "$N"
+			[ "$he_spr_non_srg_obss_pd_max_offset" -gt 0 ] && { \
+				append base_cfg "he_spr_non_srg_obss_pd_max_offset=$he_spr_non_srg_obss_pd_max_offset" "$N"
+				he_spr_sr_control=$((he_spr_sr_control | (1 << 2)))
+			}
+			[ "$he_spr_psr_enabled" -gt 0 ] || he_spr_sr_control=$((he_spr_sr_control | (1 << 0)))
+			append base_cfg "he_spr_sr_control=$he_spr_sr_control" "$N"
+		else
+			append base_cfg "he_bss_color_disabled=1" "$N"
+		fi
+
 
 		append base_cfg "he_default_pe_duration=4" "$N"
 		append base_cfg "he_rts_threshold=1023" "$N"
@@ -569,15 +581,77 @@ mac80211_generate_mac() {
 		$(( (0x$6 + $id) % 0x100 ))
 }
 
+get_board_phy_name() (
+	local path="$1"
+	local fallback_phy=""
+
+	__check_phy() {
+		local val="$1"
+		local key="$2"
+		local ref_path="$3"
+
+		json_select "$key"
+		json_get_values path
+		json_select ..
+
+		[ "${ref_path%+*}" = "$path" ] && fallback_phy=$key
+		[ "$ref_path" = "$path" ] || return 0
+
+		echo "$key"
+		exit
+	}
+
+	json_load_file /etc/board.json
+	json_for_each_item __check_phy wlan "$path"
+	[ -n "$fallback_phy" ] && echo "${fallback_phy}.${path##*+}"
+)
+
+rename_board_phy_by_path() {
+	local path="$1"
+
+	local new_phy="$(get_board_phy_name "$path")"
+	[ -z "$new_phy" -o "$new_phy" = "$phy" ] && return
+
+	iw "$phy" set name "$new_phy" && phy="$new_phy"
+}
+
+rename_board_phy_by_name() (
+	local phy="$1"
+	local suffix="${phy##*.}"
+	[ "$suffix" = "$phy" ] && suffix=
+
+	json_load_file /etc/board.json
+	json_select wlan
+	json_select "${phy%.*}" || return 0
+	json_get_values path
+
+	prev_phy="$(iwinfo nl80211 phyname "path=$path${suffix:++$suffix}")"
+	[ -n "$prev_phy" ] || return 0
+
+	[ "$prev_phy" = "$phy" ] && return 0
+
+	iw "$prev_phy" set name "$phy"
+)
+
 find_phy() {
-	[ -n "$phy" -a -d /sys/class/ieee80211/$phy ] && return 0
+	[ -n "$phy" ] && {
+		rename_board_phy_by_name "$phy"
+		[ -d /sys/class/ieee80211/$phy ] && return 0
+	}
 	[ -n "$path" ] && {
 		phy="$(iwinfo nl80211 phyname "path=$path")"
-		[ -n "$phy" ] && return 0
+		[ -n "$phy" ] && {
+			rename_board_phy_by_path "$path"
+			return 0
+		}
 	}
 	[ -n "$macaddr" ] && {
 		for phy in $(ls /sys/class/ieee80211 2>/dev/null); do
-			grep -i -q "$macaddr" "/sys/class/ieee80211/${phy}/macaddress" && return 0
+			grep -i -q "$macaddr" "/sys/class/ieee80211/${phy}/macaddress" && {
+				path="$(iwinfo nl80211 path "$phy")"
+				rename_board_phy_by_path "$path"
+				return 0
+			}
 		done
 	}
 	return 1
@@ -655,13 +729,28 @@ mac80211_iw_interface_add() {
 	return $rc
 }
 
+mac80211_set_ifname() {
+	local phy="$1"
+	local prefix="$2"
+	eval "ifname=\"$phy-$prefix\${idx_$prefix:-0}\"; idx_$prefix=\$((\${idx_$prefix:-0 } + 1))"
+}
+
 mac80211_prepare_vif() {
 	json_select config
 
 	json_get_vars ifname mode ssid wds powersave macaddr enable wpa_psk_file vlan_file
 
-	[ -n "$ifname" ] || ifname="wlan${phy#phy}${if_idx:+-$if_idx}"
-	if_idx=$((${if_idx:-0} + 1))
+	[ -n "$ifname" ] || {
+		local prefix;
+
+		case "$mode" in
+		ap|sta|mesh) prefix=$mode;;
+		adhoc) prefix=ibss;;
+		monitor) prefix=mon;;
+		esac
+
+		mac80211_set_ifname "$phy" "$prefix"
+	}
 
 	set_default wds 0
 	set_default powersave 0
@@ -812,8 +901,8 @@ mac80211_setup_supplicant_noctl() {
 
 mac80211_prepare_iw_htmode() {
 	case "$htmode" in
-		VHT20|HT20) iw_htmode=HT20;;
-		HT40*|VHT40|VHT160)
+		VHT20|HT20|HE20) iw_htmode=HT20;;
+		HT40*|VHT40|VHT160|HE40)
 			case "$band" in
 				2g)
 					case "$htmode" in
@@ -837,7 +926,7 @@ mac80211_prepare_iw_htmode() {
 			esac
 			[ "$auto_channel" -gt 0 ] && iw_htmode="HT40+"
 		;;
-		VHT80)
+		VHT80|HE80)
 			iw_htmode="80MHZ"
 		;;
 		NONE|NOHT)
@@ -944,7 +1033,7 @@ mac80211_setup_vif() {
 		mesh)
 			wireless_vif_parse_encryption
 			[ -z "$htmode" ] && htmode="NOHT";
-			if [ "$wpa" -gt 0 -o "$auto_channel" -gt 0 ] || chan_is_dfs "$phy" "$channel"; then
+			if wpa_supplicant -vmesh || [ "$wpa" -gt 0 -o "$auto_channel" -gt 0 ] || chan_is_dfs "$phy" "$channel"; then
 				mac80211_setup_supplicant $vif_enable || failed=1
 			else
 				mac80211_setup_mesh $vif_enable
diff --git a/package/kernel/mac80211/files/lib/wifi/mac80211.sh b/package/kernel/mac80211/files/lib/wifi/mac80211.sh
index 6aa46b0c747c02..e24a2a634ea606 100644
--- a/package/kernel/mac80211/files/lib/wifi/mac80211.sh
+++ b/package/kernel/mac80211/files/lib/wifi/mac80211.sh
@@ -2,58 +2,46 @@
 
 append DRIVERS "mac80211"
 
-lookup_phy() {
-	[ -n "$phy" ] && {
-		[ -d /sys/class/ieee80211/$phy ] && return
-	}
-
-	local devpath
-	config_get devpath "$device" path
-	[ -n "$devpath" ] && {
-		phy="$(iwinfo nl80211 phyname "path=$devpath")"
-		[ -n "$phy" ] && return
-	}
-
-	local macaddr="$(config_get "$device" macaddr | tr 'A-Z' 'a-z')"
-	[ -n "$macaddr" ] && {
-		for _phy in /sys/class/ieee80211/*; do
-			[ -e "$_phy" ] || continue
-
-			[ "$macaddr" = "$(cat ${_phy}/macaddress)" ] || continue
-			phy="${_phy##*/}"
-			return
-		done
-	}
-	phy=
-	return
-}
-
-find_mac80211_phy() {
+check_mac80211_device() {
 	local device="$1"
+	local path="$2"
+	local macaddr="$3"
 
+	[ -n "$found" ] && return 0
+
+	phy_path=
 	config_get phy "$device" phy
-	lookup_phy
-	[ -n "$phy" -a -d "/sys/class/ieee80211/$phy" ] || {
-		echo "PHY for wifi device $1 not found"
-		return 1
+	json_select wlan
+	[ -n "$phy" ] && case "$phy" in
+		phy*)
+			[ -d /sys/class/ieee80211/$phy ] && \
+				phy_path="$(iwinfo nl80211 path "$dev")"
+		;;
+		*)
+			if json_is_a "$phy" object; then
+				json_select "$phy"
+				json_get_var phy_path path
+				json_select ..
+			elif json_is_a "${phy%.*}" object; then
+				json_select "${phy%.*}"
+				json_get_var phy_path path
+				json_select ..
+				phy_path="$phy_path+${phy##*.}"
+			fi
+		;;
+	esac
+	json_select ..
+	[ -n "$phy_path" ] || config_get phy_path "$device" path
+	[ -n "$path" -a "$phy_path" = "$path" ] && {
+		found=1
+		return 0
 	}
-	config_set "$device" phy "$phy"
 
-	config_get macaddr "$device" macaddr
-	[ -z "$macaddr" ] && {
-		config_set "$device" macaddr "$(cat /sys/class/ieee80211/${phy}/macaddress)"
-	}
+	config_get dev_macaddr "$device" macaddr
 
-	return 0
-}
+	[ -n "$macaddr" -a "$dev_macaddr" = "$macaddr" ] && found=1
 
-check_mac80211_device() {
-	config_get phy "$1" phy
-	[ -z "$phy" ] && {
-		find_mac80211_phy "$1" >/dev/null || return 0
-		config_get phy "$1" phy
-	}
-	[ "$phy" = "$dev" ] && found=1
+	return 0
 }
 
 
@@ -135,24 +123,41 @@ get_band_defaults() {
 	done
 }
 
+check_devidx() {
+	case "$1" in
+	radio[0-9]*)
+		local idx="${1#radio}"
+		[ "$devidx" -ge "${1#radio}" ] && devidx=$((idx + 1))
+		;;
+	esac
+}
+
+check_board_phy() {
+	local name="$2"
+
+	json_select "$name"
+	json_get_var phy_path path
+	json_select ..
+
+	if [ "$path" = "$phy_path" ]; then
+		board_dev="$name"
+	elif [ "${path%+*}" = "$phy_path" ]; then
+		fallback_board_dev="$name.${path#*+}"
+	fi
+}
+
 detect_mac80211() {
 	devidx=0
 	config_load wireless
-	while :; do
-		config_get type "radio$devidx" type
-		[ -n "$type" ] || break
-		devidx=$(($devidx + 1))
-	done
+	config_foreach check_devidx wifi-device
+
+	json_load_file /etc/board.json
 
 	for _dev in /sys/class/ieee80211/*; do
 		[ -e "$_dev" ] || continue
 
 		dev="${_dev##*/}"
 
-		found=0
-		config_foreach check_mac80211_device wifi-device
-		[ "$found" -gt 0 ] && continue
-
 		mode_band=""
 		channel=""
 		htmode=""
@@ -161,30 +166,52 @@ detect_mac80211() {
 		get_band_defaults "$dev"
 
 		path="$(iwinfo nl80211 path "$dev")"
-		if [ -n "$path" ]; then
-			dev_id="set wireless.radio${devidx}.path='$path'"
-		else
-			dev_id="set wireless.radio${devidx}.macaddr=$(cat /sys/class/ieee80211/${dev}/macaddress)"
-		fi
+		macaddr="$(cat /sys/class/ieee80211/${dev}/macaddress)"
+
+		# work around phy rename related race condition
+		[ -n "$path" -o -n "$macaddr" ] || continue
+
+		board_dev=
+		fallback_board_dev=
+		json_for_each_item check_board_phy wlan
+		[ -n "$board_dev" ] || board_dev="$fallback_board_dev"
+		[ -n "$board_dev" ] && dev="$board_dev"
+
+		found=
+		config_foreach check_mac80211_device wifi-device "$path" "$macaddr"
+		[ -n "$found" ] && continue
+
+		name="radio${devidx}"
+		devidx=$(($devidx + 1))
+		case "$dev" in
+			phy*)
+				if [ -n "$path" ]; then
+					dev_id="set wireless.${name}.path='$path'"
+				else
+					dev_id="set wireless.${name}.macaddr='$macaddr'"
+				fi
+				;;
+			*)
+				dev_id="set wireless.${name}.phy='$dev'"
+				;;
+		esac
 
 		uci -q batch <<-EOF
-			set wireless.radio${devidx}=wifi-device
-			set wireless.radio${devidx}.type=mac80211
+			set wireless.${name}=wifi-device
+			set wireless.${name}.type=mac80211
 			${dev_id}
-			set wireless.radio${devidx}.channel=${channel}
-			set wireless.radio${devidx}.band=${mode_band}
-			set wireless.radio${devidx}.htmode=$htmode
-			set wireless.radio${devidx}.disabled=1
-
-			set wireless.default_radio${devidx}=wifi-iface
-			set wireless.default_radio${devidx}.device=radio${devidx}
-			set wireless.default_radio${devidx}.network=lan
-			set wireless.default_radio${devidx}.mode=ap
-			set wireless.default_radio${devidx}.ssid=OpenWrt
-			set wireless.default_radio${devidx}.encryption=none
+			set wireless.${name}.channel=${channel}
+			set wireless.${name}.band=${mode_band}
+			set wireless.${name}.htmode=$htmode
+			set wireless.${name}.disabled=1
+
+			set wireless.default_${name}=wifi-iface
+			set wireless.default_${name}.device=${name}
+			set wireless.default_${name}.network=lan
+			set wireless.default_${name}.mode=ap
+			set wireless.default_${name}.ssid=OpenWrt
+			set wireless.default_${name}.encryption=none
 EOF
 		uci -q commit wireless
-
-		devidx=$(($devidx + 1))
 	done
 }
diff --git a/package/kernel/mac80211/intel.mk b/package/kernel/mac80211/intel.mk
index a915f94bf962f9..8d374d73e744dd 100644
--- a/package/kernel/mac80211/intel.mk
+++ b/package/kernel/mac80211/intel.mk
@@ -1,21 +1,12 @@
-PKG_DRIVERS += \
-	iwl-legacy iwl3945 iwl4965 iwlwifi \
-	libipw ipw2100 ipw2200 \
+PKG_DRIVERS += iwlwifi
 
-config-$(call config_package,iwl-legacy) += IWLEGACY
-config-$(call config_package,iwl3945) += IWL3945
-config-$(call config_package,iwl4965) += IWL4965
 config-$(call config_package,iwlwifi) += IWLWIFI IWLDVM IWLMVM
 config-$(CONFIG_PACKAGE_IWLWIFI_DEBUG)+= IWLWIFI_DEBUG
 config-$(CONFIG_PACKAGE_IWLWIFI_DEBUGFS)+= IWLWIFI_DEBUGFS
 
-config-$(call config_package,libipw) += LIBIPW
-config-$(call config_package,ipw2100) += IPW2100
-config-$(call config_package,ipw2200) += IPW2200
-
 define KernelPackage/iwlwifi
   $(call KernelPackage/mac80211/Default)
-  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +@DRIVER_11AX_SUPPORT
+  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT +@DRIVER_11AC_SUPPORT +@DRIVER_11AX_SUPPORT
   TITLE:=Intel AGN Wireless support
   FILES:= \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/iwlwifi.ko \
@@ -84,117 +75,3 @@ define KernelPackage/iwlwifi/config
   endif
 endef
 
-define KernelPackage/iwl-legacy
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT
-  TITLE:=Intel legacy Wireless support
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwlegacy.ko
-  AUTOLOAD:=$(call AutoProbe,iwlegacy)
-endef
-
-define KernelPackage/iwl-legacy/description
- iwl-legacy kernel module for legacy Intel wireless support
-endef
-
-define KernelPackage/iwl3945
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy +iwl3945-firmware
-  TITLE:=Intel iwl3945 Wireless support
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwl3945.ko
-  AUTOLOAD:=$(call AutoProbe,iwl3945)
-endef
-
-define KernelPackage/iwl3945/description
- iwl3945 kernel module for Intel 3945 support
-endef
-
-define KernelPackage/iwl4965
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy +@DRIVER_11N_SUPPORT +iwl4965-firmware
-  TITLE:=Intel iwl4965 Wireless support
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwl4965.ko
-  AUTOLOAD:=$(call AutoProbe,iwl4965)
-endef
-
-define KernelPackage/iwl4965/description
- iwl4965 kernel module for Intel 4965 support
-endef
-
-
-define KernelPackage/libipw
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=libipw for ipw2100 and ipw2200
-  DEPENDS:=@PCI_SUPPORT +kmod-crypto-michael-mic +kmod-crypto-ecb +kmod-lib80211 +kmod-cfg80211 +@DRIVER_WEXT_SUPPORT @!BIG_ENDIAN
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/libipw.ko
-  AUTOLOAD:=$(call AutoProbe,libipw)
-endef
-
-define KernelPackage/libipw/description
- Hardware independent IEEE 802.11 networking stack for ipw2100 and ipw2200.
-endef
-
-IPW2100_NAME:=ipw2100-fw
-IPW2100_VERSION:=1.3
-
-define Download/ipw2100
-  URL:= \
-	https://src.fedoraproject.org/repo/pkgs/ipw2100-firmware/ipw2100-fw-1.3.tgz/46aa75bcda1a00efa841f9707bbbd113/ \
-	https://archlinux.mirror.pkern.at/other/packages/ipw2100-fw/ \
-	http://mirror.ox.ac.uk/sites/ftp.openbsd.org/pub/OpenBSD/distfiles/firmware/ \
-	http://firmware.openbsd.org/firmware-dist/
-  FILE:=$(IPW2100_NAME)-$(IPW2100_VERSION).tgz
-  HASH:=e1107c455e48d324a616b47a622593bc8413dcce72026f72731c0b03dae3a7a2
-endef
-$(eval $(call Download,ipw2100))
-
-define KernelPackage/ipw2100
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Intel IPW2100 driver
-  DEPENDS:=@PCI_SUPPORT +kmod-libipw
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/ipw2100.ko
-  AUTOLOAD:=$(call AutoProbe,ipw2100)
-endef
-
-define KernelPackage/ipw2100/description
- Kernel support for Intel IPW2100
- Includes:
- - ipw2100
-endef
-
-IPW2200_NAME:=ipw2200-fw
-IPW2200_VERSION:=3.1
-
-define Download/ipw2200
-  URL:= \
-	https://src.fedoraproject.org/repo/pkgs/ipw2200-firmware/ipw2200-fw-3.1.tgz/eaba788643c7cc7483dd67ace70f6e99/ \
-	https://archlinux.mirror.pkern.at/other/packages/ipw2200-fw/ \
-	http://mirror.ox.ac.uk/sites/ftp.openbsd.org/pub/OpenBSD/distfiles/firmware/ \
-	http://firmware.openbsd.org/firmware-dist/
-  FILE:=$(IPW2200_NAME)-$(IPW2200_VERSION).tgz
-  HASH:=c6818c11c18cc030d55ff83f64b2bad8feef485e7742f84f94a61d811a6258bd
-endef
-$(eval $(call Download,ipw2200))
-
-define KernelPackage/ipw2200
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Intel IPW2200 driver
-  DEPENDS:=@PCI_SUPPORT +kmod-libipw
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/ipw2200.ko
-  AUTOLOAD:=$(call AutoProbe,ipw2200)
-endef
-
-define KernelPackage/ipw2200/description
- Kernel support for Intel IPW2200
- Includes:
- - ipw2200
-endef
-
-define KernelPackage/ipw2100/install
-	$(INSTALL_DIR) $(1)/lib/firmware
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/ipw2100-$(IPW2100_VERSION)*.fw $(1)/lib/firmware
-endef
-
-define KernelPackage/ipw2200/install
-	$(INSTALL_DIR) $(1)/lib/firmware
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(IPW2200_NAME)-$(IPW2200_VERSION)/ipw2200*.fw $(1)/lib/firmware
-endef
diff --git a/package/kernel/mac80211/marvell.mk b/package/kernel/mac80211/marvell.mk
index a0e67091e5f302..dbd07a80da5ea6 100644
--- a/package/kernel/mac80211/marvell.mk
+++ b/package/kernel/mac80211/marvell.mk
@@ -1,54 +1,15 @@
 PKG_DRIVERS += \
-	libertas-sdio libertas-usb libertas-spi \
 	mwl8k mwifiex-pcie mwifiex-sdio
 
-config-$(call config_package,libertas-sdio) += LIBERTAS LIBERTAS_SDIO
-config-$(call config_package,libertas-usb) += LIBERTAS LIBERTAS_USB
-config-$(call config_package,libertas-spi) += LIBERTAS LIBERTAS_SPI
 config-$(call config_package,mwl8k) += MWL8K
 config-$(call config_package,mwifiex-pcie) += MWIFIEX MWIFIEX_PCIE
 config-$(call config_package,mwifiex-sdio) += MWIFIEX MWIFIEX_SDIO
 
-define KernelPackage/libertas-usb
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +kmod-usb-core +kmod-lib80211 +@DRIVER_WEXT_SUPPORT +libertas-usb-firmware
-  TITLE:=Marvell 88W8015 Wireless Driver
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/usb8xxx.ko
-  AUTOLOAD:=$(call AutoProbe,libertas usb8xxx)
-endef
-
-define KernelPackage/libertas-sdio
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS+= +kmod-cfg80211 +kmod-lib80211 +kmod-mmc +@DRIVER_WEXT_SUPPORT @!TARGET_uml +libertas-sdio-firmware
-  TITLE:=Marvell 88W8686 Wireless Driver
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas_sdio.ko
-  AUTOLOAD:=$(call AutoProbe,libertas libertas_sdio)
-endef
-
-define KernelPackage/libertas-spi
-  $(call KernelPackage/mac80211/Default)
-  SUBMENU:=Wireless Drivers
-  DEPENDS+= +kmod-cfg80211 +kmod-lib80211 +@DRIVER_WEXT_SUPPORT @!TARGET_uml +libertas-spi-firmware
-  KCONFIG := \
-	CONFIG_SPI=y \
-	CONFIG_SPI_MASTER=y
-  TITLE:=Marvell 88W8686 SPI Wireless Driver
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas_spi.ko
-  AUTOLOAD:=$(call AutoProbe,libertas libertas_spi)
-endef
-
-
 define KernelPackage/mwl8k
   $(call KernelPackage/mac80211/Default)
   TITLE:=Driver for Marvell TOPDOG 802.11 Wireless cards
   URL:=https://wireless.wiki.kernel.org/en/users/drivers/mwl8k
-  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT +mwl8k-firmware
+  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +mwl8k-firmware
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwl8k.ko
   AUTOLOAD:=$(call AutoProbe,mwl8k)
 endef
@@ -62,7 +23,7 @@ define KernelPackage/mwifiex-pcie
   $(call KernelPackage/mac80211/Default)
   TITLE:=Driver for Marvell 802.11n/802.11ac PCIe Wireless cards
   URL:=https://wireless.wiki.kernel.org/en/users/drivers/mwifiex
-  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +mwifiex-pcie-firmware
+  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11AC_SUPPORT +mwifiex-pcie-firmware
   FILES:= \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex.ko \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex_pcie.ko
@@ -77,7 +38,7 @@ define KernelPackage/mwifiex-sdio
   $(call KernelPackage/mac80211/Default)
   TITLE:=Driver for Marvell 802.11n/802.11ac SDIO Wireless cards
   URL:=https://wireless.wiki.kernel.org/en/users/drivers/mwifiex
-  DEPENDS+= +kmod-mmc +kmod-mac80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +mwifiex-sdio-firmware
+  DEPENDS+= +kmod-mmc +kmod-mac80211 +@DRIVER_11AC_SUPPORT +mwifiex-sdio-firmware
   FILES:= \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex.ko \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex_sdio.ko
diff --git a/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch b/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch
index 4ea33365d18ff8..fd5493de71d526 100644
--- a/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch
+++ b/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch
@@ -82,7 +82,7 @@
  	help
 --- a/local-symbols
 +++ b/local-symbols
-@@ -106,6 +106,7 @@ ADM8211=
+@@ -102,6 +102,7 @@ ADM8211=
  ATH_COMMON=
  WLAN_VENDOR_ATH=
  ATH_DEBUG=
diff --git a/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch b/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
index 02281adf4a299b..8d83921a3b847a 100644
--- a/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
+++ b/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
@@ -1,6 +1,6 @@
 --- a/net/wireless/reg.c
 +++ b/net/wireless/reg.c
-@@ -3309,6 +3309,8 @@ void regulatory_hint_country_ie(struct w
+@@ -3370,6 +3370,8 @@ void regulatory_hint_country_ie(struct w
  	enum environment_cap env = ENVIRON_ANY;
  	struct regulatory_request *request = NULL, *lr;
  
@@ -9,7 +9,7 @@
  	/* IE len must be evenly divisible by 2 */
  	if (country_ie_len & 0x01)
  		return;
-@@ -3560,6 +3562,7 @@ static bool is_wiphy_all_set_reg_flag(en
+@@ -3621,6 +3623,7 @@ static bool is_wiphy_all_set_reg_flag(en
  
  void regulatory_hint_disconnect(void)
  {
diff --git a/package/kernel/mac80211/patches/ath/405-ath_regd_us.patch b/package/kernel/mac80211/patches/ath/405-ath_regd_us.patch
index 088833199d0d2e..6723721a47bc0f 100644
--- a/package/kernel/mac80211/patches/ath/405-ath_regd_us.patch
+++ b/package/kernel/mac80211/patches/ath/405-ath_regd_us.patch
@@ -8,7 +8,7 @@
  	FRANCE_RES = 0x31,
  	FCC3_FCCA = 0x3A,
  	FCC3_WORLD = 0x3B,
-@@ -172,6 +173,7 @@ static struct reg_dmn_pair_mapping regDo
+@@ -173,6 +174,7 @@ static struct reg_dmn_pair_mapping regDo
  	{FCC2_WORLD, CTL_FCC, CTL_ETSI},
  	{FCC2_ETSIC, CTL_FCC, CTL_ETSI},
  	{FCC3_FCCA, CTL_FCC, CTL_FCC},
@@ -16,7 +16,7 @@
  	{FCC3_WORLD, CTL_FCC, CTL_ETSI},
  	{FCC3_ETSIC, CTL_FCC, CTL_ETSI},
  	{FCC4_FCCA, CTL_FCC, CTL_FCC},
-@@ -483,6 +485,7 @@ static struct country_code_to_enum_rd al
+@@ -486,6 +488,7 @@ static struct country_code_to_enum_rd al
  	{CTRY_UAE, NULL1_WORLD, "AE"},
  	{CTRY_UNITED_KINGDOM, ETSI1_WORLD, "GB"},
  	{CTRY_UNITED_STATES, FCC3_FCCA, "US"},
diff --git a/package/kernel/mac80211/patches/ath10k/080-ath10k_thermal_config.patch b/package/kernel/mac80211/patches/ath10k/080-ath10k_thermal_config.patch
index d9a3cd534c8b7d..41ad6006b5ceff 100644
--- a/package/kernel/mac80211/patches/ath10k/080-ath10k_thermal_config.patch
+++ b/package/kernel/mac80211/patches/ath10k/080-ath10k_thermal_config.patch
@@ -37,7 +37,7 @@
  void ath10k_thermal_event_temperature(struct ath10k *ar, int temperature);
 --- a/local-symbols
 +++ b/local-symbols
-@@ -165,6 +165,7 @@ ATH10K_SNOC=
+@@ -161,6 +161,7 @@ ATH10K_SNOC=
  ATH10K_DEBUG=
  ATH10K_DEBUGFS=
  ATH10K_SPECTRAL=
diff --git a/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch
index e47fb012fa3af4..7a38cf3e4ed62d 100644
--- a/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch
+++ b/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch
@@ -14,7 +14,7 @@ Signed-off-by: Sven Eckelmann <sven@open-mesh.com>
 
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -3443,6 +3443,16 @@ int ath10k_core_register(struct ath10k *
+@@ -3516,6 +3516,16 @@ int ath10k_core_register(struct ath10k *
  
  	queue_work(ar->workqueue, &ar->register_work);
  
diff --git a/package/kernel/mac80211/patches/ath10k/930-ath10k_add_tpt_led_trigger.patch b/package/kernel/mac80211/patches/ath10k/930-ath10k_add_tpt_led_trigger.patch
index 9dfde4385ebc61..e8beed17e8f19f 100644
--- a/package/kernel/mac80211/patches/ath10k/930-ath10k_add_tpt_led_trigger.patch
+++ b/package/kernel/mac80211/patches/ath10k/930-ath10k_add_tpt_led_trigger.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -9894,6 +9894,21 @@ static int ath10k_mac_init_rd(struct ath
+@@ -9909,6 +9909,21 @@ static int ath10k_mac_init_rd(struct ath
  	return 0;
  }
  
@@ -22,7 +22,7 @@
  int ath10k_mac_register(struct ath10k *ar)
  {
  	static const u32 cipher_suites[] = {
-@@ -10252,6 +10267,12 @@ int ath10k_mac_register(struct ath10k *a
+@@ -10267,6 +10282,12 @@ int ath10k_mac_register(struct ath10k *a
  
  	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
  
diff --git a/package/kernel/mac80211/patches/ath10k/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch b/package/kernel/mac80211/patches/ath10k/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
index 47b52416ab1d93..1c1630c05199d9 100644
--- a/package/kernel/mac80211/patches/ath10k/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
+++ b/package/kernel/mac80211/patches/ath10k/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
@@ -114,7 +114,7 @@ v13:
  ath10k_core-$(CONFIG_DEV_COREDUMP) += coredump.o
 --- a/local-symbols
 +++ b/local-symbols
-@@ -166,6 +166,7 @@ ATH10K_DEBUG=
+@@ -162,6 +162,7 @@ ATH10K_DEBUG=
  ATH10K_DEBUGFS=
  ATH10K_SPECTRAL=
  ATH10K_THERMAL=
@@ -140,7 +140,7 @@ v13:
  		.patch_load_addr = QCA988X_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_ALL,
-@@ -138,6 +140,7 @@ static const struct ath10k_hw_params ath
+@@ -146,6 +148,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA9887_1_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca9887 hw1.0",
@@ -148,7 +148,7 @@ v13:
  		.patch_load_addr = QCA9887_HW_1_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_ALL,
-@@ -355,6 +358,7 @@ static const struct ath10k_hw_params ath
+@@ -387,6 +390,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA99X0_2_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca99x0 hw2.0",
@@ -156,7 +156,7 @@ v13:
  		.patch_load_addr = QCA99X0_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.otp_exe_param = 0x00000700,
-@@ -397,6 +401,7 @@ static const struct ath10k_hw_params ath
+@@ -433,6 +437,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA9984_1_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca9984/qca9994 hw1.0",
@@ -164,7 +164,7 @@ v13:
  		.patch_load_addr = QCA9984_HW_1_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
-@@ -446,6 +451,7 @@ static const struct ath10k_hw_params ath
+@@ -486,6 +491,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA9888_2_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca9888 hw2.0",
@@ -172,7 +172,7 @@ v13:
  		.patch_load_addr = QCA9888_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
-@@ -3158,6 +3164,10 @@ int ath10k_core_start(struct ath10k *ar,
+@@ -3231,6 +3237,10 @@ int ath10k_core_start(struct ath10k *ar,
  		goto err_hif_stop;
  	}
  
@@ -183,7 +183,7 @@ v13:
  	return 0;
  
  err_hif_stop:
-@@ -3416,9 +3426,18 @@ static void ath10k_core_register_work(st
+@@ -3489,9 +3499,18 @@ static void ath10k_core_register_work(st
  		goto err_spectral_destroy;
  	}
  
@@ -202,7 +202,7 @@ v13:
  err_spectral_destroy:
  	ath10k_spectral_destroy(ar);
  err_debug_destroy:
-@@ -3464,6 +3483,8 @@ void ath10k_core_unregister(struct ath10
+@@ -3537,6 +3556,8 @@ void ath10k_core_unregister(struct ath10
  	if (!test_bit(ATH10K_FLAG_CORE_REGISTERED, &ar->dev_flags))
  		return;
  
@@ -221,7 +221,7 @@ v13:
  
  #include "htt.h"
  #include "htc.h"
-@@ -1256,6 +1257,13 @@ struct ath10k {
+@@ -1253,6 +1254,13 @@ struct ath10k {
  	} testmode;
  
  	struct {
@@ -237,7 +237,7 @@ v13:
  		u32 fw_crash_counter;
 --- a/drivers/net/wireless/ath/ath10k/hw.h
 +++ b/drivers/net/wireless/ath/ath10k/hw.h
-@@ -517,6 +517,7 @@ struct ath10k_hw_params {
+@@ -519,6 +519,7 @@ struct ath10k_hw_params {
  	const char *name;
  	u32 patch_load_addr;
  	int uart_pin;
diff --git a/package/kernel/mac80211/patches/ath10k/975-ath10k-use-tpt-trigger-by-default.patch b/package/kernel/mac80211/patches/ath10k/975-ath10k-use-tpt-trigger-by-default.patch
index 842853ddf415bb..4c1f9aa815cbad 100644
--- a/package/kernel/mac80211/patches/ath10k/975-ath10k-use-tpt-trigger-by-default.patch
+++ b/package/kernel/mac80211/patches/ath10k/975-ath10k-use-tpt-trigger-by-default.patch
@@ -16,7 +16,7 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
 
 --- a/drivers/net/wireless/ath/ath10k/core.h
 +++ b/drivers/net/wireless/ath/ath10k/core.h
-@@ -1312,6 +1312,10 @@ struct ath10k {
+@@ -1309,6 +1309,10 @@ struct ath10k {
  	s32 tx_power_2g_limit;
  	s32 tx_power_5g_limit;
  
@@ -42,7 +42,7 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
  	if (ret)
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -10269,7 +10269,7 @@ int ath10k_mac_register(struct ath10k *a
+@@ -10284,7 +10284,7 @@ int ath10k_mac_register(struct ath10k *a
  	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
  
  #ifdef CPTCFG_MAC80211_LEDS
diff --git a/package/kernel/mac80211/patches/ath10k/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch b/package/kernel/mac80211/patches/ath10k/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
index a45addf1196499..3626debf198918 100644
--- a/package/kernel/mac80211/patches/ath10k/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
+++ b/package/kernel/mac80211/patches/ath10k/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
@@ -28,7 +28,7 @@ Forwarded: no
 
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -1021,6 +1021,40 @@ static inline int ath10k_vdev_setup_sync
+@@ -1028,6 +1028,40 @@ static inline int ath10k_vdev_setup_sync
  	return ar->last_wmi_vdev_start_status;
  }
  
@@ -69,7 +69,7 @@ Forwarded: no
  static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
  {
  	struct cfg80211_chan_def *chandef = NULL;
-@@ -1053,7 +1087,8 @@ static int ath10k_monitor_vdev_start(str
+@@ -1060,7 +1094,8 @@ static int ath10k_monitor_vdev_start(str
  	arg.channel.min_power = 0;
  	arg.channel.max_power = channel->max_power * 2;
  	arg.channel.max_reg_power = channel->max_reg_power * 2;
@@ -79,7 +79,7 @@ Forwarded: no
  
  	reinit_completion(&ar->vdev_setup_done);
  	reinit_completion(&ar->vdev_delete_done);
-@@ -1499,7 +1534,8 @@ static int ath10k_vdev_start_restart(str
+@@ -1506,7 +1541,8 @@ static int ath10k_vdev_start_restart(str
  	arg.channel.min_power = 0;
  	arg.channel.max_power = chandef->chan->max_power * 2;
  	arg.channel.max_reg_power = chandef->chan->max_reg_power * 2;
@@ -89,7 +89,7 @@ Forwarded: no
  
  	if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
  		arg.ssid = arvif->u.ap.ssid;
-@@ -3427,7 +3463,8 @@ static int ath10k_update_channel_list(st
+@@ -3437,7 +3473,8 @@ static int ath10k_update_channel_list(st
  			ch->min_power = 0;
  			ch->max_power = channel->max_power * 2;
  			ch->max_reg_power = channel->max_reg_power * 2;
diff --git a/package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch b/package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch
index 80da07de8a4c8c..084e28a2d924d8 100644
--- a/package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch
+++ b/package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch
@@ -26,9 +26,9 @@ Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
  #include <linux/property.h>
  #include <linux/dmi.h>
  #include <linux/ctype.h>
-@@ -3334,6 +3335,8 @@ static int ath10k_core_probe_fw(struct a
+@@ -3407,6 +3408,8 @@ static int ath10k_core_probe_fw(struct a
  
- 	device_get_mac_address(ar->dev, ar->mac_addr, sizeof(ar->mac_addr));
+ 	device_get_mac_address(ar->dev, ar->mac_addr);
  
 +	of_get_mac_address(ar->dev->of_node, ar->mac_addr);
 +
diff --git a/package/kernel/mac80211/patches/ath11k/0001-wifi-ath11k-stop-tx-queues-immediately-upon-firmware.patch b/package/kernel/mac80211/patches/ath11k/0001-wifi-ath11k-stop-tx-queues-immediately-upon-firmware.patch
new file mode 100644
index 00000000000000..d0dc04febf764d
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0001-wifi-ath11k-stop-tx-queues-immediately-upon-firmware.patch
@@ -0,0 +1,78 @@
+From 81e60b2dfb2744ab6642c4aa62534b4f711fdc5d Mon Sep 17 00:00:00 2001
+From: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Date: Tue, 27 Sep 2022 09:18:54 +0300
+Subject: [PATCH] wifi: ath11k: stop tx queues immediately upon firmware exit
+
+Currently, recovery flag is set immediately upon firmware
+exit but tx queues are stopped once firmware arrives back
+and is ready which is during ath11k_core_restart. Once
+ieee80211 hw restart is completed, tx queues are resumed.
+If during the time delta between firmware exit and firmware
+ready, mac80211 send packets, currently ath11k will drop it
+since recovery flag will be set. But warning prints will
+come -
+  "ath11k c000000.wifi: failed to transmit frame -108"
+
+If more tx packets are there, this could lead to flooding
+of above print.
+
+However, actually tx queues should be stopped immediately
+when firmware leaves. This will prevent packets to get
+dropped when firmware is recovering.
+
+Add fix to stop tx queues immediately after firmware exit.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20220923170235.18873-1-quic_adisi@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c | 5 +----
+ drivers/net/wireless/ath/ath11k/core.h | 1 +
+ drivers/net/wireless/ath/ath11k/qmi.c  | 3 +++
+ 3 files changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -1641,7 +1641,7 @@ static void ath11k_update_11d(struct wor
+ 	}
+ }
+ 
+-static void ath11k_core_pre_reconfigure_recovery(struct ath11k_base *ab)
++void ath11k_core_pre_reconfigure_recovery(struct ath11k_base *ab)
+ {
+ 	struct ath11k *ar;
+ 	struct ath11k_pdev *pdev;
+@@ -1730,9 +1730,6 @@ static void ath11k_core_restart(struct w
+ 	struct ath11k_base *ab = container_of(work, struct ath11k_base, restart_work);
+ 	int ret;
+ 
+-	if (!ab->is_reset)
+-		ath11k_core_pre_reconfigure_recovery(ab);
+-
+ 	ret = ath11k_core_reconfigure_on_crash(ab);
+ 	if (ret) {
+ 		ath11k_err(ab, "failed to reconfigure driver on crash recovery\n");
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -1158,6 +1158,7 @@ int ath11k_core_check_smbios(struct ath1
+ void ath11k_core_halt(struct ath11k *ar);
+ int ath11k_core_resume(struct ath11k_base *ab);
+ int ath11k_core_suspend(struct ath11k_base *ab);
++void ath11k_core_pre_reconfigure_recovery(struct ath11k_base *ab);
+ 
+ const struct firmware *ath11k_core_firmware_request(struct ath11k_base *ab,
+ 						    const char *filename);
+--- a/drivers/net/wireless/ath/ath11k/qmi.c
++++ b/drivers/net/wireless/ath/ath11k/qmi.c
+@@ -3164,6 +3164,9 @@ static void ath11k_qmi_driver_event_work
+ 		case ATH11K_QMI_EVENT_SERVER_EXIT:
+ 			set_bit(ATH11K_FLAG_CRASH_FLUSH, &ab->dev_flags);
+ 			set_bit(ATH11K_FLAG_RECOVERY, &ab->dev_flags);
++
++			if (!ab->is_reset)
++				ath11k_core_pre_reconfigure_recovery(ab);
+ 			break;
+ 		case ATH11K_QMI_EVENT_REQUEST_MEM:
+ 			ret = ath11k_qmi_event_mem_request(qmi);
diff --git a/package/kernel/mac80211/patches/ath11k/0002-wifi-ath11k-Don-t-exit-on-wakeup-failure.patch b/package/kernel/mac80211/patches/ath11k/0002-wifi-ath11k-Don-t-exit-on-wakeup-failure.patch
new file mode 100644
index 00000000000000..47385e0458e1c2
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0002-wifi-ath11k-Don-t-exit-on-wakeup-failure.patch
@@ -0,0 +1,45 @@
+From 45d2e268369b0c768d5a644f319758bcfd370521 Mon Sep 17 00:00:00 2001
+From: Baochen Qiang <quic_bqiang@quicinc.com>
+Date: Wed, 28 Sep 2022 09:51:40 +0800
+Subject: [PATCH] wifi: ath11k: Don't exit on wakeup failure
+
+Currently, ath11k_pcic_read() returns an error if wakeup()
+fails, this makes firmware crash debug quite hard because we can
+get nothing.
+
+Change to go ahead on wakeup failure, in that case we still may
+get something valid to check. There should be no mislead due
+to incorrect content because we are aware of the failure with the
+log printed.
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
+
+Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20220928015140.5431-1-quic_bqiang@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/pcic.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/pcic.c
++++ b/drivers/net/wireless/ath/ath11k/pcic.c
+@@ -218,9 +218,16 @@ int ath11k_pcic_read(struct ath11k_base
+ 	if (wakeup_required && ab->pci.ops->wakeup) {
+ 		ret = ab->pci.ops->wakeup(ab);
+ 		if (ret) {
+-			ath11k_warn(ab, "failed to wakeup for read from 0x%x: %d\n",
+-				    start, ret);
+-			return ret;
++			ath11k_warn(ab,
++				    "wakeup failed, data may be invalid: %d",
++				    ret);
++			/* Even though wakeup() failed, continue processing rather
++			 * than returning because some parts of the data may still
++			 * be valid and useful in some cases, e.g. could give us
++			 * some clues on firmware crash.
++			 * Mislead due to invalid data could be avoided because we
++			 * are aware of the wakeup failure.
++			 */
+ 		}
+ 	}
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0005-wifi-ath11k-Fix-spelling-mistake-chnange-change.patch b/package/kernel/mac80211/patches/ath11k/0005-wifi-ath11k-Fix-spelling-mistake-chnange-change.patch
new file mode 100644
index 00000000000000..4b52252ef34874
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0005-wifi-ath11k-Fix-spelling-mistake-chnange-change.patch
@@ -0,0 +1,25 @@
+From a797f479bf3e02c6d179c2e6aeace7f9b22b0acd Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.i.king@gmail.com>
+Date: Wed, 28 Sep 2022 15:38:34 +0100
+Subject: [PATCH] wifi: ath11k: Fix spelling mistake "chnange" -> "change"
+
+There is a spelling mistake in an ath11k_dbg debug message. Fix it.
+
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20220928143834.35189-1-colin.i.king@gmail.com
+---
+ drivers/net/wireless/ath/ath11k/wmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -6829,7 +6829,7 @@ static void ath11k_wmi_event_peer_sta_ps
+ 	}
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_WMI,
+-		   "peer sta ps chnange ev addr %pM state %u sup_bitmap %x ps_valid %u ts %u\n",
++		   "peer sta ps change ev addr %pM state %u sup_bitmap %x ps_valid %u ts %u\n",
+ 		   ev->peer_macaddr.addr, ev->peer_ps_state,
+ 		   ev->ps_supported_bitmap, ev->peer_ps_valid,
+ 		   ev->peer_ps_timestamp);
diff --git a/package/kernel/mac80211/patches/ath11k/0007-wifi-ath11k-suppress-add-interface-error.patch b/package/kernel/mac80211/patches/ath11k/0007-wifi-ath11k-suppress-add-interface-error.patch
new file mode 100644
index 00000000000000..fbef0abb8db41f
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0007-wifi-ath11k-suppress-add-interface-error.patch
@@ -0,0 +1,52 @@
+From 638b26652b0438563a76ec90014c8cba34db982b Mon Sep 17 00:00:00 2001
+From: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
+Date: Thu, 6 Oct 2022 06:28:42 +0530
+Subject: [PATCH 7/9] wifi: ath11k: suppress add interface error
+
+In the VIF (other than monitor type) creation request, we should not
+throw the error code when the monitor VIF creation fails, since the
+actual VIF creation succeeds. If we throw the error code from driver
+then the actual VIF creation get fail. So suppress the monitor VIF
+creation error by throwing warning message instead of error code.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.6.0.1-00760-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221006005842.8599-1-quic_periyasa@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -6421,18 +6421,16 @@ static int ath11k_mac_op_add_interface(s
+ 
+ 	ath11k_dp_vdev_tx_attach(ar, arvif);
+ 
++	ath11k_debugfs_add_interface(arvif);
++
+ 	if (vif->type != NL80211_IFTYPE_MONITOR &&
+ 	    test_bit(ATH11K_FLAG_MONITOR_CONF_ENABLED, &ar->monitor_flags)) {
+ 		ret = ath11k_mac_monitor_vdev_create(ar);
+-		if (ret) {
++		if (ret)
+ 			ath11k_warn(ar->ab, "failed to create monitor vdev during add interface: %d",
+ 				    ret);
+-			goto err_peer_del;
+-		}
+ 	}
+ 
+-	ath11k_debugfs_add_interface(arvif);
+-
+ 	mutex_unlock(&ar->conf_mutex);
+ 
+ 	return 0;
+@@ -6457,7 +6455,6 @@ err_vdev_del:
+ 	spin_unlock_bh(&ar->data_lock);
+ 
+ err:
+-	ath11k_debugfs_remove_interface(arvif);
+ 	mutex_unlock(&ar->conf_mutex);
+ 
+ 	return ret;
diff --git a/package/kernel/mac80211/patches/ath11k/0008-wifi-ath11k-add-support-to-configure-channel-dwell-t.patch b/package/kernel/mac80211/patches/ath11k/0008-wifi-ath11k-add-support-to-configure-channel-dwell-t.patch
new file mode 100644
index 00000000000000..d0b19fe59f58f9
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0008-wifi-ath11k-add-support-to-configure-channel-dwell-t.patch
@@ -0,0 +1,102 @@
+From c362daa213cdeb0a9e7c2ed84849544c24505720 Mon Sep 17 00:00:00 2001
+From: Manikanta Pubbisetty <quic_mpubbise@quicinc.com>
+Date: Fri, 7 Oct 2022 10:41:30 +0530
+Subject: [PATCH 8/9] wifi: ath11k: add support to configure channel dwell time
+
+Add support to configure channel dwell time during scan.
+Dwell time help to stay on the channel for a specified duration
+during scan and aid userspace in finding WiFi networks. Very
+useful in passive scans where longer dwell times are needed
+to find the WiFi networks.
+
+Configure channel dwell time from duration of the scan request
+received from mac80211 when the duration is non-zero. When the
+scan request does not have duration value, use the default ones,
+the current implementation.
+
+Advertise corresponding feature flag NL80211_EXT_FEATURE_SET_SCAN_DWELL
+to enable the feature.
+
+Change is applicable for all ath11k hardware.
+
+Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-00887-QCAMSLSWPLZ-1
+
+Signed-off-by: Manikanta Pubbisetty <quic_mpubbise@quicinc.com>
+Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221007051130.6067-1-quic_mpubbise@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 33 +++++++++++++++++++++++----
+ 1 file changed, 29 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -241,7 +241,10 @@ const struct htt_rx_ring_tlv_filter ath1
+ #define ath11k_a_rates (ath11k_legacy_rates + 4)
+ #define ath11k_a_rates_size (ARRAY_SIZE(ath11k_legacy_rates) - 4)
+ 
+-#define ATH11K_MAC_SCAN_TIMEOUT_MSECS 200 /* in msecs */
++#define ATH11K_MAC_SCAN_CMD_EVT_OVERHEAD		200 /* in msecs */
++
++/* Overhead due to the processing of channel switch events from FW */
++#define ATH11K_SCAN_CHANNEL_SWITCH_WMI_EVT_OVERHEAD	10 /* in msecs */
+ 
+ static const u32 ath11k_smps_map[] = {
+ 	[WLAN_HT_CAP_SM_PS_STATIC] = WMI_PEER_SMPS_STATIC,
+@@ -3612,6 +3615,7 @@ static int ath11k_mac_op_hw_scan(struct
+ 	struct scan_req_params arg;
+ 	int ret = 0;
+ 	int i;
++	u32 scan_timeout;
+ 
+ 	mutex_lock(&ar->conf_mutex);
+ 
+@@ -3681,6 +3685,26 @@ static int ath11k_mac_op_hw_scan(struct
+ 		ether_addr_copy(arg.mac_mask.addr, req->mac_addr_mask);
+ 	}
+ 
++	/* if duration is set, default dwell times will be overwritten */
++	if (req->duration) {
++		arg.dwell_time_active = req->duration;
++		arg.dwell_time_active_2g = req->duration;
++		arg.dwell_time_active_6g = req->duration;
++		arg.dwell_time_passive = req->duration;
++		arg.dwell_time_passive_6g = req->duration;
++		arg.burst_duration = req->duration;
++
++		scan_timeout = min_t(u32, arg.max_rest_time *
++				(arg.num_chan - 1) + (req->duration +
++				ATH11K_SCAN_CHANNEL_SWITCH_WMI_EVT_OVERHEAD) *
++				arg.num_chan, arg.max_scan_time);
++	} else {
++		scan_timeout = arg.max_scan_time;
++	}
++
++	/* Add a margin to account for event/command processing */
++	scan_timeout += ATH11K_MAC_SCAN_CMD_EVT_OVERHEAD;
++
+ 	ret = ath11k_start_scan(ar, &arg);
+ 	if (ret) {
+ 		ath11k_warn(ar->ab, "failed to start hw scan: %d\n", ret);
+@@ -3689,10 +3713,8 @@ static int ath11k_mac_op_hw_scan(struct
+ 		spin_unlock_bh(&ar->data_lock);
+ 	}
+ 
+-	/* Add a 200ms margin to account for event/command processing */
+ 	ieee80211_queue_delayed_work(ar->hw, &ar->scan.timeout,
+-				     msecs_to_jiffies(arg.max_scan_time +
+-						      ATH11K_MAC_SCAN_TIMEOUT_MSECS));
++				     msecs_to_jiffies(scan_timeout));
+ 
+ exit:
+ 	kfree(arg.chan_list);
+@@ -9060,6 +9082,9 @@ static int __ath11k_mac_register(struct
+ 				      NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP);
+ 	}
+ 
++	wiphy_ext_feature_set(ar->hw->wiphy,
++			      NL80211_EXT_FEATURE_SET_SCAN_DWELL);
++
+ 	ath11k_reg_init(ar);
+ 
+ 	if (!test_bit(ATH11K_FLAG_RAW_MODE, &ab->dev_flags)) {
diff --git a/package/kernel/mac80211/patches/ath11k/0010-wifi-ath11k-Fix-firmware-crash-on-vdev-delete-race-c.patch b/package/kernel/mac80211/patches/ath11k/0010-wifi-ath11k-Fix-firmware-crash-on-vdev-delete-race-c.patch
new file mode 100644
index 00000000000000..7275af06ea28cc
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0010-wifi-ath11k-Fix-firmware-crash-on-vdev-delete-race-c.patch
@@ -0,0 +1,116 @@
+From 3811fa1f231f1a3e29759efef4992116604aab8b Mon Sep 17 00:00:00 2001
+From: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
+Date: Tue, 11 Oct 2022 15:23:46 +0530
+Subject: [PATCH] wifi: ath11k: Fix firmware crash on vdev delete race
+ condition
+
+Current code does not wait for vdev delete completion on vdev create
+failures and tries to send another vdev create followed by vdev set
+param to firmware with same vdev id. This causes firmware crash.
+Fix this crash by waiting for vdev delete completion on vdev
+create failures.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.6.0.1-00905-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221011095346.3901-1-quic_ssreeela@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 60 +++++++++++++++++----------
+ 1 file changed, 37 insertions(+), 23 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -6233,6 +6233,40 @@ void ath11k_mac_11d_scan_stop_all(struct
+ 	}
+ }
+ 
++static int ath11k_mac_vdev_delete(struct ath11k *ar, struct ath11k_vif *arvif)
++{
++	unsigned long time_left;
++	struct ieee80211_vif *vif = arvif->vif;
++	int ret = 0;
++
++	lockdep_assert_held(&ar->conf_mutex);
++
++	reinit_completion(&ar->vdev_delete_done);
++
++	ret = ath11k_wmi_vdev_delete(ar, arvif->vdev_id);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to delete WMI vdev %d: %d\n",
++			    arvif->vdev_id, ret);
++		return ret;
++	}
++
++	time_left = wait_for_completion_timeout(&ar->vdev_delete_done,
++						ATH11K_VDEV_DELETE_TIMEOUT_HZ);
++	if (time_left == 0) {
++		ath11k_warn(ar->ab, "Timeout in receiving vdev delete response\n");
++		return -ETIMEDOUT;
++	}
++
++	ar->ab->free_vdev_map |= 1LL << (arvif->vdev_id);
++	ar->allocated_vdev_map &= ~(1LL << arvif->vdev_id);
++	ar->num_created_vdevs--;
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "vdev %pM deleted, vdev_id %d\n",
++		   vif->addr, arvif->vdev_id);
++
++	return ret;
++}
++
+ static int ath11k_mac_op_add_interface(struct ieee80211_hw *hw,
+ 				       struct ieee80211_vif *vif)
+ {
+@@ -6468,10 +6502,7 @@ err_peer_del:
+ 	}
+ 
+ err_vdev_del:
+-	ath11k_wmi_vdev_delete(ar, arvif->vdev_id);
+-	ar->num_created_vdevs--;
+-	ar->allocated_vdev_map &= ~(1LL << arvif->vdev_id);
+-	ab->free_vdev_map |= 1LL << arvif->vdev_id;
++	ath11k_mac_vdev_delete(ar, arvif);
+ 	spin_lock_bh(&ar->data_lock);
+ 	list_del(&arvif->list);
+ 	spin_unlock_bh(&ar->data_lock);
+@@ -6499,7 +6530,6 @@ static void ath11k_mac_op_remove_interfa
+ 	struct ath11k *ar = hw->priv;
+ 	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
+ 	struct ath11k_base *ab = ar->ab;
+-	unsigned long time_left;
+ 	int ret;
+ 	int i;
+ 
+@@ -6520,29 +6550,13 @@ static void ath11k_mac_op_remove_interfa
+ 				    arvif->vdev_id, ret);
+ 	}
+ 
+-	reinit_completion(&ar->vdev_delete_done);
+-
+-	ret = ath11k_wmi_vdev_delete(ar, arvif->vdev_id);
++	ret = ath11k_mac_vdev_delete(ar, arvif);
+ 	if (ret) {
+-		ath11k_warn(ab, "failed to delete WMI vdev %d: %d\n",
++		ath11k_warn(ab, "failed to delete vdev %d: %d\n",
+ 			    arvif->vdev_id, ret);
+ 		goto err_vdev_del;
+ 	}
+ 
+-	time_left = wait_for_completion_timeout(&ar->vdev_delete_done,
+-						ATH11K_VDEV_DELETE_TIMEOUT_HZ);
+-	if (time_left == 0) {
+-		ath11k_warn(ab, "Timeout in receiving vdev delete response\n");
+-		goto err_vdev_del;
+-	}
+-
+-	ab->free_vdev_map |= 1LL << (arvif->vdev_id);
+-	ar->allocated_vdev_map &= ~(1LL << arvif->vdev_id);
+-	ar->num_created_vdevs--;
+-
+-	ath11k_dbg(ab, ATH11K_DBG_MAC, "vdev %pM deleted, vdev_id %d\n",
+-		   vif->addr, arvif->vdev_id);
+-
+ 	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
+ 		clear_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags);
+ 		ar->monitor_vdev_id = -1;
diff --git a/package/kernel/mac80211/patches/ath11k/0011-wifi-ath11k-fix-monitor-vdev-creation-with-firmware-.patch b/package/kernel/mac80211/patches/ath11k/0011-wifi-ath11k-fix-monitor-vdev-creation-with-firmware-.patch
new file mode 100644
index 00000000000000..2f066d0a565dce
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0011-wifi-ath11k-fix-monitor-vdev-creation-with-firmware-.patch
@@ -0,0 +1,40 @@
+From f3ca72b0327101a074a871539e61775d43908ca4 Mon Sep 17 00:00:00 2001
+From: Nagarajan Maran <quic_nmaran@quicinc.com>
+Date: Fri, 14 Oct 2022 21:20:54 +0530
+Subject: [PATCH] wifi: ath11k: fix monitor vdev creation with firmware
+ recovery
+
+During firmware recovery, the monitor interface is not
+getting created in the driver and firmware since
+the respective flags are not updated properly.
+
+So after firmware recovery is successful, when monitor
+interface is brought down manually, firmware assertion
+is observed, since we are trying to bring down the
+interface which is not yet created in the firmware.
+
+Fix this by updating the monitor flags properly per
+phy#, during firmware recovery.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221014155054.11471-1-quic_nmaran@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -1677,6 +1677,10 @@ void ath11k_core_pre_reconfigure_recover
+ 			     ath11k_mac_tx_mgmt_pending_free, ar);
+ 		idr_destroy(&ar->txmgmt_idr);
+ 		wake_up(&ar->txmgmt_empty_waitq);
++
++		ar->monitor_vdev_id = -1;
++		clear_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags);
++		clear_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags);
+ 	}
+ 
+ 	wake_up(&ab->wmi_ab.tx_credits_wq);
diff --git a/package/kernel/mac80211/patches/ath11k/0012-wifi-ath11k-Fix-qmi_msg_handler-data-structure-initi.patch b/package/kernel/mac80211/patches/ath11k/0012-wifi-ath11k-Fix-qmi_msg_handler-data-structure-initi.patch
new file mode 100644
index 00000000000000..fccfa4385a7476
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0012-wifi-ath11k-Fix-qmi_msg_handler-data-structure-initi.patch
@@ -0,0 +1,33 @@
+From ed3725e15a154ebebf44e0c34806c57525483f92 Mon Sep 17 00:00:00 2001
+From: Rahul Bhattacharjee <quic_rbhattac@quicinc.com>
+Date: Fri, 21 Oct 2022 14:31:26 +0530
+Subject: [PATCH] wifi: ath11k: Fix qmi_msg_handler data structure
+ initialization
+
+qmi_msg_handler is required to be null terminated by QMI module.
+There might be a case where a handler for a msg id is not present in the
+handlers array which can lead to infinite loop while searching the handler
+and therefore out of bound access in qmi_invoke_handler().
+Hence update the initialization in qmi_msg_handler data structure.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Rahul Bhattacharjee <quic_rbhattac@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221021090126.28626-1-quic_rbhattac@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/qmi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/qmi.c
++++ b/drivers/net/wireless/ath/ath11k/qmi.c
+@@ -1702,6 +1702,9 @@ static struct qmi_elem_info qmi_wlfw_fw_
+ 		.data_type = QMI_EOTI,
+ 		.array_type = NO_ARRAY,
+ 	},
++
++	/* end of list */
++	{},
+ };
+ 
+ static int ath11k_qmi_host_cap_send(struct ath11k_base *ab)
diff --git a/package/kernel/mac80211/patches/ath11k/0013-wifi-ath11k-synchronize-ath11k_mac_he_gi_to_nl80211_.patch b/package/kernel/mac80211/patches/ath11k/0013-wifi-ath11k-synchronize-ath11k_mac_he_gi_to_nl80211_.patch
new file mode 100644
index 00000000000000..1e89b4d4f21185
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0013-wifi-ath11k-synchronize-ath11k_mac_he_gi_to_nl80211_.patch
@@ -0,0 +1,42 @@
+From dd1c2322694522f674c874f5fa02ac5ae39135dd Mon Sep 17 00:00:00 2001
+From: "Jiri Slaby (SUSE)" <jirislaby@kernel.org>
+Date: Mon, 31 Oct 2022 12:43:41 +0100
+Subject: [PATCH] wifi: ath11k: synchronize
+ ath11k_mac_he_gi_to_nl80211_he_gi()'s return type
+
+ath11k_mac_he_gi_to_nl80211_he_gi() generates a valid warning with gcc-13:
+  drivers/net/wireless/ath/ath11k/mac.c:321:20: error: conflicting types for 'ath11k_mac_he_gi_to_nl80211_he_gi' due to enum/integer mismatch; have 'enum nl80211_he_gi(u8)'
+  drivers/net/wireless/ath/ath11k/mac.h:166:5: note: previous declaration of 'ath11k_mac_he_gi_to_nl80211_he_gi' with type 'u32(u8)'
+
+I.e. the type of the return value ath11k_mac_he_gi_to_nl80211_he_gi() in
+the declaration is u32, while the definition spells enum nl80211_he_gi.
+Synchronize them to the latter.
+
+Cc: Martin Liska <mliska@suse.cz>
+Cc: Kalle Valo <kvalo@kernel.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: ath11k@lists.infradead.org
+Cc: linux-wireless@vger.kernel.org
+Cc: netdev@vger.kernel.org
+Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
+Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221031114341.10377-1-jirislaby@kernel.org
+---
+ drivers/net/wireless/ath/ath11k/mac.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.h
++++ b/drivers/net/wireless/ath/ath11k/mac.h
+@@ -163,7 +163,7 @@ void ath11k_mac_drain_tx(struct ath11k *
+ void ath11k_mac_peer_cleanup_all(struct ath11k *ar);
+ int ath11k_mac_tx_mgmt_pending_free(int buf_id, void *skb, void *ctx);
+ u8 ath11k_mac_bw_to_mac80211_bw(u8 bw);
+-u32 ath11k_mac_he_gi_to_nl80211_he_gi(u8 sgi);
++enum nl80211_he_gi ath11k_mac_he_gi_to_nl80211_he_gi(u8 sgi);
+ enum nl80211_he_ru_alloc ath11k_mac_phy_he_ru_to_nl80211_he_ru_alloc(u16 ru_phy);
+ enum nl80211_he_ru_alloc ath11k_mac_he_ru_tones_to_nl80211_he_ru_alloc(u16 ru_tones);
+ enum ath11k_supported_bw ath11k_mac_mac80211_bw_to_ath11k_bw(enum rate_info_bw bw);
diff --git a/package/kernel/mac80211/patches/ath11k/0016-wifi-ath11k-Make-QMI-message-rules-const.patch b/package/kernel/mac80211/patches/ath11k/0016-wifi-ath11k-Make-QMI-message-rules-const.patch
new file mode 100644
index 00000000000000..1f48df73f75a98
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0016-wifi-ath11k-Make-QMI-message-rules-const.patch
@@ -0,0 +1,341 @@
+From 93c1592889fca46d09d833455628bab05516cdbf Mon Sep 17 00:00:00 2001
+From: Jeff Johnson <quic_jjohnson@quicinc.com>
+Date: Wed, 14 Sep 2022 17:23:03 -0700
+Subject: [PATCH] wifi: ath11k: Make QMI message rules const
+
+Commit ff6d365898d4 ("soc: qcom: qmi: use const for struct
+qmi_elem_info") allows QMI message encoding/decoding rules to be
+const, so do that for ath11k.
+
+Compile tested only.
+
+Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20220915002303.12206-1-quic_jjohnson@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/qmi.c | 72 +++++++++++++--------------
+ 1 file changed, 36 insertions(+), 36 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/qmi.c
++++ b/drivers/net/wireless/ath/ath11k/qmi.c
+@@ -29,7 +29,7 @@ module_param_named(cold_boot_cal, ath11k
+ MODULE_PARM_DESC(cold_boot_cal,
+ 		 "Decrease the channel switch time but increase the driver load time (Default: true)");
+ 
+-static struct qmi_elem_info qmi_wlanfw_host_cap_req_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_host_cap_req_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_OPT_FLAG,
+ 		.elem_len	= 1,
+@@ -280,7 +280,7 @@ static struct qmi_elem_info qmi_wlanfw_h
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_host_cap_resp_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_host_cap_resp_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_STRUCT,
+ 		.elem_len	= 1,
+@@ -297,7 +297,7 @@ static struct qmi_elem_info qmi_wlanfw_h
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_ind_register_req_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_ind_register_req_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_OPT_FLAG,
+ 		.elem_len	= 1,
+@@ -522,7 +522,7 @@ static struct qmi_elem_info qmi_wlanfw_i
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_ind_register_resp_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_ind_register_resp_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_STRUCT,
+ 		.elem_len	= 1,
+@@ -558,7 +558,7 @@ static struct qmi_elem_info qmi_wlanfw_i
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_mem_cfg_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_mem_cfg_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_8_BYTE,
+ 		.elem_len	= 1,
+@@ -590,7 +590,7 @@ static struct qmi_elem_info qmi_wlanfw_m
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_mem_seg_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_mem_seg_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_4_BYTE,
+ 		.elem_len	= 1,
+@@ -632,7 +632,7 @@ static struct qmi_elem_info qmi_wlanfw_m
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_request_mem_ind_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_request_mem_ind_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_DATA_LEN,
+ 		.elem_len	= 1,
+@@ -659,7 +659,7 @@ static struct qmi_elem_info qmi_wlanfw_r
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_mem_seg_resp_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_mem_seg_resp_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_8_BYTE,
+ 		.elem_len	= 1,
+@@ -699,7 +699,7 @@ static struct qmi_elem_info qmi_wlanfw_m
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_respond_mem_req_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_respond_mem_req_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_DATA_LEN,
+ 		.elem_len	= 1,
+@@ -726,7 +726,7 @@ static struct qmi_elem_info qmi_wlanfw_r
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_respond_mem_resp_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_respond_mem_resp_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_STRUCT,
+ 		.elem_len	= 1,
+@@ -744,7 +744,7 @@ static struct qmi_elem_info qmi_wlanfw_r
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_cap_req_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_cap_req_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_EOTI,
+ 		.array_type	= NO_ARRAY,
+@@ -752,7 +752,7 @@ static struct qmi_elem_info qmi_wlanfw_c
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_device_info_req_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_device_info_req_msg_v01_ei[] = {
+ 	{
+ 		.data_type      = QMI_EOTI,
+ 		.array_type     = NO_ARRAY,
+@@ -760,7 +760,7 @@ static struct qmi_elem_info qmi_wlanfw_d
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlfw_device_info_resp_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlfw_device_info_resp_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_STRUCT,
+ 		.elem_len	= 1,
+@@ -814,7 +814,7 @@ static struct qmi_elem_info qmi_wlfw_dev
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_rf_chip_info_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_rf_chip_info_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_4_BYTE,
+ 		.elem_len	= 1,
+@@ -840,7 +840,7 @@ static struct qmi_elem_info qmi_wlanfw_r
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_rf_board_info_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_rf_board_info_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_4_BYTE,
+ 		.elem_len	= 1,
+@@ -857,7 +857,7 @@ static struct qmi_elem_info qmi_wlanfw_r
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_soc_info_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_soc_info_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_4_BYTE,
+ 		.elem_len	= 1,
+@@ -873,7 +873,7 @@ static struct qmi_elem_info qmi_wlanfw_s
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_fw_version_info_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_fw_version_info_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_4_BYTE,
+ 		.elem_len	= 1,
+@@ -899,7 +899,7 @@ static struct qmi_elem_info qmi_wlanfw_f
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_cap_resp_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_cap_resp_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_STRUCT,
+ 		.elem_len	= 1,
+@@ -1100,7 +1100,7 @@ static struct qmi_elem_info qmi_wlanfw_c
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_bdf_download_req_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_bdf_download_req_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_1_BYTE,
+ 		.elem_len	= 1,
+@@ -1235,7 +1235,7 @@ static struct qmi_elem_info qmi_wlanfw_b
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_bdf_download_resp_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_bdf_download_resp_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_STRUCT,
+ 		.elem_len	= 1,
+@@ -1253,7 +1253,7 @@ static struct qmi_elem_info qmi_wlanfw_b
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_m3_info_req_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_m3_info_req_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_8_BYTE,
+ 		.elem_len	= 1,
+@@ -1277,7 +1277,7 @@ static struct qmi_elem_info qmi_wlanfw_m
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_m3_info_resp_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_m3_info_resp_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_STRUCT,
+ 		.elem_len	= 1,
+@@ -1294,7 +1294,7 @@ static struct qmi_elem_info qmi_wlanfw_m
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_ce_tgt_pipe_cfg_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_ce_tgt_pipe_cfg_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_4_BYTE,
+ 		.elem_len	= 1,
+@@ -1347,7 +1347,7 @@ static struct qmi_elem_info qmi_wlanfw_c
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_ce_svc_pipe_cfg_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_ce_svc_pipe_cfg_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_4_BYTE,
+ 		.elem_len	= 1,
+@@ -1382,7 +1382,7 @@ static struct qmi_elem_info qmi_wlanfw_c
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_shadow_reg_cfg_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_shadow_reg_cfg_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_2_BYTE,
+ 		.elem_len	= 1,
+@@ -1406,7 +1406,7 @@ static struct qmi_elem_info qmi_wlanfw_s
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_shadow_reg_v2_cfg_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_shadow_reg_v2_cfg_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_4_BYTE,
+ 		.elem_len	= 1,
+@@ -1423,7 +1423,7 @@ static struct qmi_elem_info qmi_wlanfw_s
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_wlan_mode_req_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_wlan_mode_req_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_4_BYTE,
+ 		.elem_len	= 1,
+@@ -1458,7 +1458,7 @@ static struct qmi_elem_info qmi_wlanfw_w
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_wlan_mode_resp_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_wlan_mode_resp_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_STRUCT,
+ 		.elem_len	= 1,
+@@ -1476,7 +1476,7 @@ static struct qmi_elem_info qmi_wlanfw_w
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_wlan_cfg_req_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_wlan_cfg_req_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_OPT_FLAG,
+ 		.elem_len	= 1,
+@@ -1615,7 +1615,7 @@ static struct qmi_elem_info qmi_wlanfw_w
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_wlan_cfg_resp_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_wlan_cfg_resp_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_STRUCT,
+ 		.elem_len	= 1,
+@@ -1632,28 +1632,28 @@ static struct qmi_elem_info qmi_wlanfw_w
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_mem_ready_ind_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_mem_ready_ind_msg_v01_ei[] = {
+ 	{
+ 		.data_type = QMI_EOTI,
+ 		.array_type = NO_ARRAY,
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_fw_ready_ind_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_fw_ready_ind_msg_v01_ei[] = {
+ 	{
+ 		.data_type = QMI_EOTI,
+ 		.array_type = NO_ARRAY,
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_cold_boot_cal_done_ind_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_cold_boot_cal_done_ind_msg_v01_ei[] = {
+ 	{
+ 		.data_type = QMI_EOTI,
+ 		.array_type = NO_ARRAY,
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_wlan_ini_req_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_wlan_ini_req_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_OPT_FLAG,
+ 		.elem_len	= 1,
+@@ -1679,7 +1679,7 @@ static struct qmi_elem_info qmi_wlanfw_w
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_wlan_ini_resp_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_wlan_ini_resp_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_STRUCT,
+ 		.elem_len	= 1,
+@@ -1697,7 +1697,7 @@ static struct qmi_elem_info qmi_wlanfw_w
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlfw_fw_init_done_ind_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlfw_fw_init_done_ind_msg_v01_ei[] = {
+ 	{
+ 		.data_type = QMI_EOTI,
+ 		.array_type = NO_ARRAY,
diff --git a/package/kernel/mac80211/patches/ath11k/0017-wifi-ath11k-Trigger-sta-disconnect-on-hardware-resta.patch b/package/kernel/mac80211/patches/ath11k/0017-wifi-ath11k-Trigger-sta-disconnect-on-hardware-resta.patch
new file mode 100644
index 00000000000000..f95e5027b259eb
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0017-wifi-ath11k-Trigger-sta-disconnect-on-hardware-resta.patch
@@ -0,0 +1,119 @@
+From a018750a2cceaf4427c4ee3d9ce3e83a171d5bd6 Mon Sep 17 00:00:00 2001
+From: Youghandhar Chintala <quic_youghand@quicinc.com>
+Date: Fri, 4 Nov 2022 14:24:03 +0530
+Subject: [PATCH] wifi: ath11k: Trigger sta disconnect on hardware restart
+
+Currently after the hardware restart triggered from the driver, the
+station interface connection remains intact, since a disconnect trigger
+is not sent to userspace. This can lead to a problem in targets where
+the wifi mac sequence is added by the firmware.
+
+After the target restart, its wifi mac sequence number gets reset to
+zero. Hence AP to which our device is connected will receive frames with
+a  wifi mac sequence number jump to the past, thereby resulting in the
+AP dropping all these frames, until the frame arrives with a wifi mac
+sequence number which AP was expecting.
+
+To avoid such frame drops, its better to trigger a station disconnect
+upon target hardware restart which can be done with API
+ieee80211_reconfig_disconnect exposed to mac80211.
+
+The other targets are not affected by this change, since the hardware
+params flag is not set.
+
+Reported-by: kernel test robot <lkp@intel.com>
+
+Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-00887-QCAMSLSWPLZ-1
+
+Signed-off-by: Youghandhar Chintala <quic_youghand@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221104085403.11025-1-quic_youghand@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c | 6 ++++++
+ drivers/net/wireless/ath/ath11k/hw.h   | 1 +
+ drivers/net/wireless/ath/ath11k/mac.c  | 7 +++++++
+ 3 files changed, 14 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -195,6 +195,7 @@ static const struct ath11k_hw_params ath
+ 		.tcl_ring_retry = true,
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
++		.support_fw_mac_sequence = false,
+ 	},
+ 	{
+ 		.name = "qca6390 hw2.0",
+@@ -277,6 +278,7 @@ static const struct ath11k_hw_params ath
+ 		.tcl_ring_retry = true,
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
++		.support_fw_mac_sequence = true,
+ 	},
+ 	{
+ 		.name = "qcn9074 hw1.0",
+@@ -356,6 +358,7 @@ static const struct ath11k_hw_params ath
+ 		.tcl_ring_retry = true,
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
++		.support_fw_mac_sequence = false,
+ 	},
+ 	{
+ 		.name = "wcn6855 hw2.0",
+@@ -438,6 +441,7 @@ static const struct ath11k_hw_params ath
+ 		.tcl_ring_retry = true,
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
++		.support_fw_mac_sequence = true,
+ 	},
+ 	{
+ 		.name = "wcn6855 hw2.1",
+@@ -519,6 +523,7 @@ static const struct ath11k_hw_params ath
+ 		.tcl_ring_retry = true,
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
++		.support_fw_mac_sequence = true,
+ 	},
+ 	{
+ 		.name = "wcn6750 hw1.0",
+@@ -597,6 +602,7 @@ static const struct ath11k_hw_params ath
+ 		.tcl_ring_retry = false,
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE_WCN6750,
+ 		.smp2p_wow_exit = true,
++		.support_fw_mac_sequence = true,
+ 	},
+ };
+ 
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -219,6 +219,7 @@ struct ath11k_hw_params {
+ 	bool tcl_ring_retry;
+ 	u32 tx_ring_size;
+ 	bool smp2p_wow_exit;
++	bool support_fw_mac_sequence;
+ };
+ 
+ struct ath11k_hw_ops {
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -8010,6 +8010,7 @@ ath11k_mac_op_reconfig_complete(struct i
+ 	struct ath11k *ar = hw->priv;
+ 	struct ath11k_base *ab = ar->ab;
+ 	int recovery_count;
++	struct ath11k_vif *arvif;
+ 
+ 	if (reconfig_type != IEEE80211_RECONFIG_TYPE_RESTART)
+ 		return;
+@@ -8045,6 +8046,12 @@ ath11k_mac_op_reconfig_complete(struct i
+ 				ath11k_dbg(ab, ATH11K_DBG_BOOT, "reset success\n");
+ 			}
+ 		}
++		if (ar->ab->hw_params.support_fw_mac_sequence) {
++			list_for_each_entry(arvif, &ar->arvifs, list) {
++				if (arvif->is_up && arvif->vdev_type == WMI_VDEV_TYPE_STA)
++					ieee80211_hw_restart_disconnect(arvif->vif);
++			}
++		}
+ 	}
+ 
+ 	mutex_unlock(&ar->conf_mutex);
diff --git a/package/kernel/mac80211/patches/ath11k/0018-wifi-ath11k-Fix-race-condition-with-struct-htt_ppdu_.patch b/package/kernel/mac80211/patches/ath11k/0018-wifi-ath11k-Fix-race-condition-with-struct-htt_ppdu_.patch
new file mode 100644
index 00000000000000..cef61ee34481d9
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0018-wifi-ath11k-Fix-race-condition-with-struct-htt_ppdu_.patch
@@ -0,0 +1,103 @@
+From e44de90453bb2b46a523df78c39eb896bab35dcd Mon Sep 17 00:00:00 2001
+From: Govindaraj Saminathan <quic_gsaminat@quicinc.com>
+Date: Tue, 29 Nov 2022 13:04:02 +0200
+Subject: [PATCH] wifi: ath11k: Fix race condition with struct
+ htt_ppdu_stats_info
+
+A crash happens when running the traffic with multiple clients:
+
+Crash Signature : Unable to handle kernel paging request at
+virtual address ffffffd700970918 During the crash, PC points to
+"ieee80211_tx_rate_update+0x30/0x68 [mac80211]"
+LR points to "ath11k_dp_htt_htc_t2h_msg_handler+0x5a8/0x8a0 [ath11k]".
+
+Struct ppdu_stats_info is allocated and accessed from event callback via copy
+engine tasklet, this has a problem when freeing it from ath11k_mac_op_stop().
+
+Use data_lock during entire ath11k_dp_htt_get_ppdu_desc() call to protect
+struct htt_ppdu_stats_info access and to avoid race condition when accessing it
+from ath11k_mac_op_stop().
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Govindaraj Saminathan <quic_gsaminat@quicinc.com>
+Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221124071104.22506-1-quic_kathirve@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -1535,13 +1535,12 @@ struct htt_ppdu_stats_info *ath11k_dp_ht
+ {
+ 	struct htt_ppdu_stats_info *ppdu_info;
+ 
+-	spin_lock_bh(&ar->data_lock);
++	lockdep_assert_held(&ar->data_lock);
++
+ 	if (!list_empty(&ar->ppdu_stats_info)) {
+ 		list_for_each_entry(ppdu_info, &ar->ppdu_stats_info, list) {
+-			if (ppdu_info->ppdu_id == ppdu_id) {
+-				spin_unlock_bh(&ar->data_lock);
++			if (ppdu_info->ppdu_id == ppdu_id)
+ 				return ppdu_info;
+-			}
+ 		}
+ 
+ 		if (ar->ppdu_stat_list_depth > HTT_PPDU_DESC_MAX_DEPTH) {
+@@ -1553,16 +1552,13 @@ struct htt_ppdu_stats_info *ath11k_dp_ht
+ 			kfree(ppdu_info);
+ 		}
+ 	}
+-	spin_unlock_bh(&ar->data_lock);
+ 
+ 	ppdu_info = kzalloc(sizeof(*ppdu_info), GFP_ATOMIC);
+ 	if (!ppdu_info)
+ 		return NULL;
+ 
+-	spin_lock_bh(&ar->data_lock);
+ 	list_add_tail(&ppdu_info->list, &ar->ppdu_stats_info);
+ 	ar->ppdu_stat_list_depth++;
+-	spin_unlock_bh(&ar->data_lock);
+ 
+ 	return ppdu_info;
+ }
+@@ -1586,16 +1582,17 @@ static int ath11k_htt_pull_ppdu_stats(st
+ 	ar = ath11k_mac_get_ar_by_pdev_id(ab, pdev_id);
+ 	if (!ar) {
+ 		ret = -EINVAL;
+-		goto exit;
++		goto out;
+ 	}
+ 
+ 	if (ath11k_debugfs_is_pktlog_lite_mode_enabled(ar))
+ 		trace_ath11k_htt_ppdu_stats(ar, skb->data, len);
+ 
++	spin_lock_bh(&ar->data_lock);
+ 	ppdu_info = ath11k_dp_htt_get_ppdu_desc(ar, ppdu_id);
+ 	if (!ppdu_info) {
+ 		ret = -EINVAL;
+-		goto exit;
++		goto out_unlock_data;
+ 	}
+ 
+ 	ppdu_info->ppdu_id = ppdu_id;
+@@ -1604,10 +1601,13 @@ static int ath11k_htt_pull_ppdu_stats(st
+ 				     (void *)ppdu_info);
+ 	if (ret) {
+ 		ath11k_warn(ab, "Failed to parse tlv %d\n", ret);
+-		goto exit;
++		goto out_unlock_data;
+ 	}
+ 
+-exit:
++out_unlock_data:
++	spin_unlock_bh(&ar->data_lock);
++
++out:
+ 	rcu_read_unlock();
+ 
+ 	return ret;
diff --git a/package/kernel/mac80211/patches/ath11k/0019-wifi-ath11k-update-hw-params-for-IPQ5018.patch b/package/kernel/mac80211/patches/ath11k/0019-wifi-ath11k-update-hw-params-for-IPQ5018.patch
new file mode 100644
index 00000000000000..25d39ddb0d3530
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0019-wifi-ath11k-update-hw-params-for-IPQ5018.patch
@@ -0,0 +1,125 @@
+From 8dfe875aa24aec68baf6702018633c84c2c1feca Mon Sep 17 00:00:00 2001
+From: Sriram R <quic_srirrama@quicinc.com>
+Date: Fri, 2 Dec 2022 23:37:13 +0200
+Subject: [PATCH] wifi: ath11k: update hw params for IPQ5018
+
+Add new compatible string for IPQ5018 and add
+required hw params for IPQ5018. The hw descriptors size and
+datapath ops are similar to QCN9074, hence reuse the same.
+
+Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
+Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221122132152.17771-3-quic_kathirve@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c | 71 ++++++++++++++++++++++++++
+ drivers/net/wireless/ath/ath11k/core.h |  8 +++
+ 2 files changed, 79 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -604,6 +604,77 @@ static const struct ath11k_hw_params ath
+ 		.smp2p_wow_exit = true,
+ 		.support_fw_mac_sequence = true,
+ 	},
++	{
++		.hw_rev = ATH11K_HW_IPQ5018_HW10,
++		.name = "ipq5018 hw1.0",
++		.fw = {
++			.dir = "IPQ5018/hw1.0",
++			.board_size = 256 * 1024,
++			.cal_offset = 128 * 1024,
++		},
++		.max_radios = MAX_RADIOS_5018,
++		.bdf_addr = 0x4BA00000,
++		/* hal_desc_sz and hw ops are similar to qcn9074 */
++		.hal_desc_sz = sizeof(struct hal_rx_desc_qcn9074),
++		.qmi_service_ins_id = ATH11K_QMI_WLFW_SERVICE_INS_ID_V01_IPQ8074,
++		.ring_mask = &ath11k_hw_ring_mask_ipq8074,
++		.credit_flow = false,
++		.max_tx_ring = 1,
++		.spectral = {
++			.fft_sz = 2,
++			.fft_pad_sz = 0,
++			.summary_pad_sz = 16,
++			.fft_hdr_len = 24,
++			.max_fft_bins = 1024,
++		},
++		.internal_sleep_clock = false,
++		.host_ce_config = ath11k_host_ce_config_qcn9074,
++		.ce_count = CE_CNT_5018,
++		.rxdma1_enable = true,
++		.num_rxmda_per_pdev = RXDMA_PER_PDEV_5018,
++		.rx_mac_buf_ring = false,
++		.vdev_start_delay = false,
++		.htt_peer_map_v2 = true,
++		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
++			BIT(NL80211_IFTYPE_AP) |
++			BIT(NL80211_IFTYPE_MESH_POINT),
++		.supports_monitor = false,
++		.supports_sta_ps = false,
++		.supports_shadow_regs = false,
++		.fw_mem_mode = 0,
++		.num_vdevs = 16 + 1,
++		.num_peers = 512,
++		.supports_regdb = false,
++		.idle_ps = false,
++		.supports_suspend = false,
++		.hal_params = &ath11k_hw_hal_params_ipq8074,
++		.single_pdev_only = false,
++		.cold_boot_calib = true,
++		.fix_l1ss = true,
++		.supports_dynamic_smps_6ghz = false,
++		.alloc_cacheable_memory = true,
++		.supports_rssi_stats = false,
++		.fw_wmi_diag_event = false,
++		.current_cc_support = false,
++		.dbr_debug_support = true,
++		.global_reset = false,
++		.bios_sar_capa = NULL,
++		.m3_fw_support = false,
++		.fixed_bdf_addr = true,
++		.fixed_mem_region = true,
++		.static_window_map = false,
++		.hybrid_bus_type = false,
++		.fixed_fw_mem = false,
++		.support_off_channel_tx = false,
++		.supports_multi_bssid = false,
++
++		.sram_dump = {},
++
++		.tcl_ring_retry = true,
++		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
++		.smp2p_wow_exit = false,
++		.support_fw_mac_sequence = false,
++	},
+ };
+ 
+ static inline struct ath11k_pdev *ath11k_core_get_single_pdev(struct ath11k_base *ab)
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -142,6 +142,7 @@ enum ath11k_hw_rev {
+ 	ATH11K_HW_WCN6855_HW20,
+ 	ATH11K_HW_WCN6855_HW21,
+ 	ATH11K_HW_WCN6750_HW10,
++	ATH11K_HW_IPQ5018_HW10,
+ };
+ 
+ enum ath11k_firmware_mode {
+@@ -230,6 +231,13 @@ struct ath11k_he {
+ 
+ #define MAX_RADIOS 3
+ 
++/* ipq5018 hw param macros */
++#define MAX_RADIOS_5018	1
++#define CE_CNT_5018	6
++#define TARGET_CE_CNT_5018	9
++#define SVC_CE_MAP_LEN_5018	17
++#define RXDMA_PER_PDEV_5018	1
++
+ enum {
+ 	WMI_HOST_TP_SCALE_MAX   = 0,
+ 	WMI_HOST_TP_SCALE_50    = 1,
diff --git a/package/kernel/mac80211/patches/ath11k/0020-wifi-ath11k-update-ce-configurations-for-IPQ5018.patch b/package/kernel/mac80211/patches/ath11k/0020-wifi-ath11k-update-ce-configurations-for-IPQ5018.patch
new file mode 100644
index 00000000000000..95643a95fec592
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0020-wifi-ath11k-update-ce-configurations-for-IPQ5018.patch
@@ -0,0 +1,246 @@
+From 26af7aabd2d8225c6b2056234626ba5099610871 Mon Sep 17 00:00:00 2001
+From: Sriram R <quic_srirrama@quicinc.com>
+Date: Fri, 2 Dec 2022 23:37:14 +0200
+Subject: [PATCH] wifi: ath11k: update ce configurations for IPQ5018
+
+IPQ5018 is a single pdev device. Update host
+and target CE configurations accordingly.
+
+Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
+Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221122132152.17771-4-quic_kathirve@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c |   4 +
+ drivers/net/wireless/ath/ath11k/core.h |   3 +
+ drivers/net/wireless/ath/ath11k/hw.c   | 191 +++++++++++++++++++++++++
+ 3 files changed, 198 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -630,6 +630,10 @@ static const struct ath11k_hw_params ath
+ 		.internal_sleep_clock = false,
+ 		.host_ce_config = ath11k_host_ce_config_qcn9074,
+ 		.ce_count = CE_CNT_5018,
++		.target_ce_config = ath11k_target_ce_config_wlan_ipq5018,
++		.target_ce_count = TARGET_CE_CNT_5018,
++		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_ipq5018,
++		.svc_to_ce_map_len = SVC_CE_MAP_LEN_5018,
+ 		.rxdma1_enable = true,
+ 		.num_rxmda_per_pdev = RXDMA_PER_PDEV_5018,
+ 		.rx_mac_buf_ring = false,
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -1145,6 +1145,9 @@ extern const struct service_to_pipe ath1
+ extern const struct ce_pipe_config ath11k_target_ce_config_wlan_qca6390[];
+ extern const struct service_to_pipe ath11k_target_service_to_ce_map_wlan_qca6390[];
+ 
++extern const struct ce_pipe_config ath11k_target_ce_config_wlan_ipq5018[];
++extern const struct service_to_pipe ath11k_target_service_to_ce_map_wlan_ipq5018[];
++
+ extern const struct ce_pipe_config ath11k_target_ce_config_wlan_qcn9074[];
+ extern const struct service_to_pipe ath11k_target_service_to_ce_map_wlan_qcn9074[];
+ int ath11k_core_qmi_firmware_ready(struct ath11k_base *ab);
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -1972,6 +1972,197 @@ const struct ath11k_hw_ring_mask ath11k_
+ 	},
+ };
+ 
++/* Target firmware's Copy Engine configuration for IPQ5018 */
++const struct ce_pipe_config ath11k_target_ce_config_wlan_ipq5018[] = {
++	/* CE0: host->target HTC control and raw streams */
++	{
++		.pipenum = __cpu_to_le32(0),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),
++		.nentries = __cpu_to_le32(32),
++		.nbytes_max = __cpu_to_le32(2048),
++		.flags = __cpu_to_le32(CE_ATTR_FLAGS),
++		.reserved = __cpu_to_le32(0),
++	},
++
++	/* CE1: target->host HTT + HTC control */
++	{
++		.pipenum = __cpu_to_le32(1),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),
++		.nentries = __cpu_to_le32(32),
++		.nbytes_max = __cpu_to_le32(2048),
++		.flags = __cpu_to_le32(CE_ATTR_FLAGS),
++		.reserved = __cpu_to_le32(0),
++	},
++
++	/* CE2: target->host WMI */
++	{
++		.pipenum = __cpu_to_le32(2),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),
++		.nentries = __cpu_to_le32(32),
++		.nbytes_max = __cpu_to_le32(2048),
++		.flags = __cpu_to_le32(CE_ATTR_FLAGS),
++		.reserved = __cpu_to_le32(0),
++	},
++
++	/* CE3: host->target WMI */
++	{
++		.pipenum = __cpu_to_le32(3),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),
++		.nentries = __cpu_to_le32(32),
++		.nbytes_max = __cpu_to_le32(2048),
++		.flags = __cpu_to_le32(CE_ATTR_FLAGS),
++		.reserved = __cpu_to_le32(0),
++	},
++
++	/* CE4: host->target HTT */
++	{
++		.pipenum = __cpu_to_le32(4),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),
++		.nentries = __cpu_to_le32(256),
++		.nbytes_max = __cpu_to_le32(256),
++		.flags = __cpu_to_le32(CE_ATTR_FLAGS | CE_ATTR_DIS_INTR),
++		.reserved = __cpu_to_le32(0),
++	},
++
++	/* CE5: target->host Pktlog */
++	{
++		.pipenum = __cpu_to_le32(5),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),
++		.nentries = __cpu_to_le32(32),
++		.nbytes_max = __cpu_to_le32(2048),
++		.flags = __cpu_to_le32(CE_ATTR_FLAGS),
++		.reserved = __cpu_to_le32(0),
++	},
++
++	/* CE6: Reserved for target autonomous hif_memcpy */
++	{
++		.pipenum = __cpu_to_le32(6),
++		.pipedir = __cpu_to_le32(PIPEDIR_INOUT),
++		.nentries = __cpu_to_le32(32),
++		.nbytes_max = __cpu_to_le32(16384),
++		.flags = __cpu_to_le32(CE_ATTR_FLAGS),
++		.reserved = __cpu_to_le32(0),
++	},
++
++	/* CE7 used only by Host */
++	{
++		.pipenum = __cpu_to_le32(7),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),
++		.nentries = __cpu_to_le32(32),
++		.nbytes_max = __cpu_to_le32(2048),
++		.flags = __cpu_to_le32(0x2000),
++		.reserved = __cpu_to_le32(0),
++	},
++
++	/* CE8 target->host used only by IPA */
++	{
++		.pipenum = __cpu_to_le32(8),
++		.pipedir = __cpu_to_le32(PIPEDIR_INOUT),
++		.nentries = __cpu_to_le32(32),
++		.nbytes_max = __cpu_to_le32(16384),
++		.flags = __cpu_to_le32(CE_ATTR_FLAGS),
++		.reserved = __cpu_to_le32(0),
++	},
++};
++
++/* Map from service/endpoint to Copy Engine for IPQ5018.
++ * This table is derived from the CE TABLE, above.
++ * It is passed to the Target at startup for use by firmware.
++ */
++const struct service_to_pipe ath11k_target_service_to_ce_map_wlan_ipq5018[] = {
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_VO),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
++		.pipenum = __cpu_to_le32(3),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_VO),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
++		.pipenum = __cpu_to_le32(2),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_BK),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
++		.pipenum = __cpu_to_le32(3),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_BK),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
++		.pipenum = __cpu_to_le32(2),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_BE),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
++		.pipenum = __cpu_to_le32(3),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_BE),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
++		.pipenum = __cpu_to_le32(2),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_VI),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
++		.pipenum = __cpu_to_le32(3),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_VI),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
++		.pipenum = __cpu_to_le32(2),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_CONTROL),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
++		.pipenum = __cpu_to_le32(3),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_CONTROL),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
++		.pipenum = __cpu_to_le32(2),
++	},
++
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_RSVD_CTRL),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
++		.pipenum = __cpu_to_le32(0),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_RSVD_CTRL),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
++		.pipenum = __cpu_to_le32(1),
++	},
++
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_TEST_RAW_STREAMS),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
++		.pipenum = __cpu_to_le32(0),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_TEST_RAW_STREAMS),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
++		.pipenum = __cpu_to_le32(1),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_HTT_DATA_MSG),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
++		.pipenum = __cpu_to_le32(4),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_HTT_DATA_MSG),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
++		.pipenum = __cpu_to_le32(1),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_PKT_LOG),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
++		.pipenum = __cpu_to_le32(5),
++	},
++
++       /* (Additions here) */
++
++	{ /* terminator entry */ }
++};
++
+ const struct ath11k_hw_regs ipq8074_regs = {
+ 	/* SW2TCL(x) R0 ring configuration address */
+ 	.hal_tcl1_ring_base_lsb = 0x00000510,
diff --git a/package/kernel/mac80211/patches/ath11k/0021-wifi-ath11k-remap-ce-register-space-for-IPQ5018.patch b/package/kernel/mac80211/patches/ath11k/0021-wifi-ath11k-remap-ce-register-space-for-IPQ5018.patch
new file mode 100644
index 00000000000000..d07a258ac2acb7
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0021-wifi-ath11k-remap-ce-register-space-for-IPQ5018.patch
@@ -0,0 +1,351 @@
+From b42b3678c91f3ca6e0888bf5a15c1e8678fd5f2d Mon Sep 17 00:00:00 2001
+From: Sriram R <quic_srirrama@quicinc.com>
+Date: Fri, 2 Dec 2022 23:37:14 +0200
+Subject: [PATCH] wifi: ath11k: remap ce register space for IPQ5018
+
+In IPQ5018 ce register space is moved out of wcss unlike
+ipq8074 or ipq6018 and the space is not contiguous,
+hence remap the CE registers to a new space to access them.
+
+Register read/write is modified to check if the register to be written
+falls in the CE register space and corresponding register is written.
+Also adjust the interrupt register address to ce irq enable/disable.
+
+Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
+Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221122132152.17771-5-quic_kathirve@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/ahb.c  | 44 ++++++++++++++++++++++----
+ drivers/net/wireless/ath/ath11k/ce.h   | 16 ++++++++++
+ drivers/net/wireless/ath/ath11k/core.c |  8 +++++
+ drivers/net/wireless/ath/ath11k/core.h |  1 +
+ drivers/net/wireless/ath/ath11k/hal.c  | 17 ++++++----
+ drivers/net/wireless/ath/ath11k/hal.h  |  5 +++
+ drivers/net/wireless/ath/ath11k/hw.c   | 17 ++++++++++
+ drivers/net/wireless/ath/ath11k/hw.h   |  9 ++++++
+ drivers/net/wireless/ath/ath11k/pci.c  |  2 ++
+ 9 files changed, 107 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -267,30 +267,42 @@ static void ath11k_ahb_clearbit32(struct
+ static void ath11k_ahb_ce_irq_enable(struct ath11k_base *ab, u16 ce_id)
+ {
+ 	const struct ce_attr *ce_attr;
++	const struct ce_ie_addr *ce_ie_addr = ab->hw_params.ce_ie_addr;
++	u32 ie1_reg_addr, ie2_reg_addr, ie3_reg_addr;
++
++	ie1_reg_addr = ce_ie_addr->ie1_reg_addr + ATH11K_CE_OFFSET(ab);
++	ie2_reg_addr = ce_ie_addr->ie2_reg_addr + ATH11K_CE_OFFSET(ab);
++	ie3_reg_addr = ce_ie_addr->ie3_reg_addr + ATH11K_CE_OFFSET(ab);
+ 
+ 	ce_attr = &ab->hw_params.host_ce_config[ce_id];
+ 	if (ce_attr->src_nentries)
+-		ath11k_ahb_setbit32(ab, ce_id, CE_HOST_IE_ADDRESS);
++		ath11k_ahb_setbit32(ab, ce_id, ie1_reg_addr);
+ 
+ 	if (ce_attr->dest_nentries) {
+-		ath11k_ahb_setbit32(ab, ce_id, CE_HOST_IE_2_ADDRESS);
++		ath11k_ahb_setbit32(ab, ce_id, ie2_reg_addr);
+ 		ath11k_ahb_setbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,
+-				    CE_HOST_IE_3_ADDRESS);
++				    ie3_reg_addr);
+ 	}
+ }
+ 
+ static void ath11k_ahb_ce_irq_disable(struct ath11k_base *ab, u16 ce_id)
+ {
+ 	const struct ce_attr *ce_attr;
++	const struct ce_ie_addr *ce_ie_addr = ab->hw_params.ce_ie_addr;
++	u32 ie1_reg_addr, ie2_reg_addr, ie3_reg_addr;
++
++	ie1_reg_addr = ce_ie_addr->ie1_reg_addr + ATH11K_CE_OFFSET(ab);
++	ie2_reg_addr = ce_ie_addr->ie2_reg_addr + ATH11K_CE_OFFSET(ab);
++	ie3_reg_addr = ce_ie_addr->ie3_reg_addr + ATH11K_CE_OFFSET(ab);
+ 
+ 	ce_attr = &ab->hw_params.host_ce_config[ce_id];
+ 	if (ce_attr->src_nentries)
+-		ath11k_ahb_clearbit32(ab, ce_id, CE_HOST_IE_ADDRESS);
++		ath11k_ahb_clearbit32(ab, ce_id, ie1_reg_addr);
+ 
+ 	if (ce_attr->dest_nentries) {
+-		ath11k_ahb_clearbit32(ab, ce_id, CE_HOST_IE_2_ADDRESS);
++		ath11k_ahb_clearbit32(ab, ce_id, ie2_reg_addr);
+ 		ath11k_ahb_clearbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,
+-				      CE_HOST_IE_3_ADDRESS);
++				      ie3_reg_addr);
+ 	}
+ }
+ 
+@@ -1142,10 +1154,26 @@ static int ath11k_ahb_probe(struct platf
+ 		goto err_core_free;
+ 	}
+ 
++	ab->mem_ce = ab->mem;
++
+ 	ret = ath11k_core_pre_init(ab);
+ 	if (ret)
+ 		goto err_core_free;
+ 
++	if (ab->hw_params.ce_remap) {
++		const struct ce_remap *ce_remap = ab->hw_params.ce_remap;
++		/* ce register space is moved out of wcss unlike ipq8074 or ipq6018
++		 * and the space is not contiguous, hence remapping the CE registers
++		 * to a new space for accessing them.
++		 */
++		ab->mem_ce = ioremap(ce_remap->base, ce_remap->size);
++		if (IS_ERR(ab->mem_ce)) {
++			dev_err(&pdev->dev, "ce ioremap error\n");
++			ret = -ENOMEM;
++			goto err_core_free;
++		}
++	}
++
+ 	ret = ath11k_ahb_setup_resources(ab);
+ 	if (ret)
+ 		goto err_core_free;
+@@ -1236,6 +1264,10 @@ static void ath11k_ahb_free_resources(st
+ 	ath11k_ahb_release_smp2p_handle(ab);
+ 	ath11k_ahb_fw_resource_deinit(ab);
+ 	ath11k_ce_free_pipes(ab);
++
++	if (ab->hw_params.ce_remap)
++		iounmap(ab->mem_ce);
++
+ 	ath11k_core_free(ab);
+ 	platform_set_drvdata(pdev, NULL);
+ }
+--- a/drivers/net/wireless/ath/ath11k/ce.h
++++ b/drivers/net/wireless/ath/ath11k/ce.h
+@@ -49,6 +49,11 @@ void ath11k_ce_byte_swap(void *mem, u32
+ #define CE_HOST_IE_2_ADDRESS	0x00A18040
+ #define CE_HOST_IE_3_ADDRESS	CE_HOST_IE_ADDRESS
+ 
++/* CE IE registers are different for IPQ5018 */
++#define CE_HOST_IPQ5018_IE_ADDRESS		0x0841804C
++#define CE_HOST_IPQ5018_IE_2_ADDRESS		0x08418050
++#define CE_HOST_IPQ5018_IE_3_ADDRESS		CE_HOST_IPQ5018_IE_ADDRESS
++
+ #define CE_HOST_IE_3_SHIFT	0xC
+ 
+ #define CE_RING_IDX_INCR(nentries_mask, idx) (((idx) + 1) & (nentries_mask))
+@@ -84,6 +89,17 @@ struct ce_pipe_config {
+ 	__le32 reserved;
+ };
+ 
++struct ce_ie_addr {
++	u32 ie1_reg_addr;
++	u32 ie2_reg_addr;
++	u32 ie3_reg_addr;
++};
++
++struct ce_remap {
++	u32 base;
++	u32 size;
++};
++
+ struct ce_attr {
+ 	/* CE_ATTR_* values */
+ 	unsigned int flags;
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -54,6 +54,7 @@ static const struct ath11k_hw_params ath
+ 		.target_ce_count = 11,
+ 		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_ipq8074,
+ 		.svc_to_ce_map_len = 21,
++		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
+ 		.single_pdev_only = false,
+ 		.rxdma1_enable = true,
+ 		.num_rxmda_per_pdev = 1,
+@@ -137,6 +138,7 @@ static const struct ath11k_hw_params ath
+ 		.target_ce_count = 11,
+ 		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_ipq6018,
+ 		.svc_to_ce_map_len = 19,
++		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
+ 		.single_pdev_only = false,
+ 		.rxdma1_enable = true,
+ 		.num_rxmda_per_pdev = 1,
+@@ -218,6 +220,7 @@ static const struct ath11k_hw_params ath
+ 		.target_ce_count = 9,
+ 		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_qca6390,
+ 		.svc_to_ce_map_len = 14,
++		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
+ 		.single_pdev_only = true,
+ 		.rxdma1_enable = false,
+ 		.num_rxmda_per_pdev = 2,
+@@ -301,6 +304,7 @@ static const struct ath11k_hw_params ath
+ 		.target_ce_count = 9,
+ 		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_qcn9074,
+ 		.svc_to_ce_map_len = 18,
++		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
+ 		.rxdma1_enable = true,
+ 		.num_rxmda_per_pdev = 1,
+ 		.rx_mac_buf_ring = false,
+@@ -381,6 +385,7 @@ static const struct ath11k_hw_params ath
+ 		.target_ce_count = 9,
+ 		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_qca6390,
+ 		.svc_to_ce_map_len = 14,
++		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
+ 		.single_pdev_only = true,
+ 		.rxdma1_enable = false,
+ 		.num_rxmda_per_pdev = 2,
+@@ -546,6 +551,7 @@ static const struct ath11k_hw_params ath
+ 		.target_ce_count = 9,
+ 		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_qca6390,
+ 		.svc_to_ce_map_len = 14,
++		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
+ 		.single_pdev_only = true,
+ 		.rxdma1_enable = false,
+ 		.num_rxmda_per_pdev = 1,
+@@ -634,6 +640,8 @@ static const struct ath11k_hw_params ath
+ 		.target_ce_count = TARGET_CE_CNT_5018,
+ 		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_ipq5018,
+ 		.svc_to_ce_map_len = SVC_CE_MAP_LEN_5018,
++		.ce_ie_addr = &ath11k_ce_ie_addr_ipq5018,
++		.ce_remap = &ath11k_ce_remap_ipq5018,
+ 		.rxdma1_enable = true,
+ 		.num_rxmda_per_pdev = RXDMA_PER_PDEV_5018,
+ 		.rx_mac_buf_ring = false,
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -851,6 +851,7 @@ struct ath11k_base {
+ 	struct ath11k_dp dp;
+ 
+ 	void __iomem *mem;
++	void __iomem *mem_ce;
+ 	unsigned long mem_len;
+ 
+ 	struct {
+--- a/drivers/net/wireless/ath/ath11k/hal.c
++++ b/drivers/net/wireless/ath/ath11k/hal.c
+@@ -1220,16 +1220,20 @@ static int ath11k_hal_srng_create_config
+ 	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_TCL_REG + HAL_TCL_STATUS_RING_HP;
+ 
+ 	s = &hal->srng_config[HAL_CE_SRC];
+-	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(ab) + HAL_CE_DST_RING_BASE_LSB;
+-	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(ab) + HAL_CE_DST_RING_HP;
++	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(ab) + HAL_CE_DST_RING_BASE_LSB +
++		ATH11K_CE_OFFSET(ab);
++	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(ab) + HAL_CE_DST_RING_HP +
++		ATH11K_CE_OFFSET(ab);
+ 	s->reg_size[0] = HAL_SEQ_WCSS_UMAC_CE1_SRC_REG(ab) -
+ 		HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(ab);
+ 	s->reg_size[1] = HAL_SEQ_WCSS_UMAC_CE1_SRC_REG(ab) -
+ 		HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(ab);
+ 
+ 	s = &hal->srng_config[HAL_CE_DST];
+-	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab) + HAL_CE_DST_RING_BASE_LSB;
+-	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab) + HAL_CE_DST_RING_HP;
++	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab) + HAL_CE_DST_RING_BASE_LSB +
++		ATH11K_CE_OFFSET(ab);
++	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab) + HAL_CE_DST_RING_HP +
++		ATH11K_CE_OFFSET(ab);
+ 	s->reg_size[0] = HAL_SEQ_WCSS_UMAC_CE1_DST_REG(ab) -
+ 		HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab);
+ 	s->reg_size[1] = HAL_SEQ_WCSS_UMAC_CE1_DST_REG(ab) -
+@@ -1237,8 +1241,9 @@ static int ath11k_hal_srng_create_config
+ 
+ 	s = &hal->srng_config[HAL_CE_DST_STATUS];
+ 	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab) +
+-		HAL_CE_DST_STATUS_RING_BASE_LSB;
+-	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab) + HAL_CE_DST_STATUS_RING_HP;
++		HAL_CE_DST_STATUS_RING_BASE_LSB + ATH11K_CE_OFFSET(ab);
++	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab) + HAL_CE_DST_STATUS_RING_HP +
++		ATH11K_CE_OFFSET(ab);
+ 	s->reg_size[0] = HAL_SEQ_WCSS_UMAC_CE1_DST_REG(ab) -
+ 		HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab);
+ 	s->reg_size[1] = HAL_SEQ_WCSS_UMAC_CE1_DST_REG(ab) -
+--- a/drivers/net/wireless/ath/ath11k/hal.h
++++ b/drivers/net/wireless/ath/ath11k/hal.h
+@@ -321,6 +321,10 @@ struct ath11k_base;
+ #define HAL_WBM2SW_RELEASE_RING_BASE_MSB_RING_SIZE	0x000fffff
+ #define HAL_RXDMA_RING_MAX_SIZE				0x0000ffff
+ 
++/* IPQ5018 ce registers */
++#define HAL_IPQ5018_CE_WFSS_REG_BASE		0x08400000
++#define HAL_IPQ5018_CE_SIZE			0x200000
++
+ /* Add any other errors here and return them in
+  * ath11k_hal_rx_desc_get_err().
+  */
+@@ -519,6 +523,7 @@ enum hal_srng_dir {
+ #define HAL_SRNG_FLAGS_MSI_INTR			0x00020000
+ #define HAL_SRNG_FLAGS_CACHED                   0x20000000
+ #define HAL_SRNG_FLAGS_LMAC_RING		0x80000000
++#define HAL_SRNG_FLAGS_REMAP_CE_RING        0x10000000
+ 
+ #define HAL_SRNG_TLV_HDR_TAG		GENMASK(9, 1)
+ #define HAL_SRNG_TLV_HDR_LEN		GENMASK(25, 10)
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -2163,6 +2163,23 @@ const struct service_to_pipe ath11k_targ
+ 	{ /* terminator entry */ }
+ };
+ 
++const struct ce_ie_addr ath11k_ce_ie_addr_ipq8074 = {
++	.ie1_reg_addr = CE_HOST_IE_ADDRESS,
++	.ie2_reg_addr = CE_HOST_IE_2_ADDRESS,
++	.ie3_reg_addr = CE_HOST_IE_3_ADDRESS,
++};
++
++const struct ce_ie_addr ath11k_ce_ie_addr_ipq5018 = {
++	.ie1_reg_addr = CE_HOST_IPQ5018_IE_ADDRESS - HAL_IPQ5018_CE_WFSS_REG_BASE,
++	.ie2_reg_addr = CE_HOST_IPQ5018_IE_2_ADDRESS - HAL_IPQ5018_CE_WFSS_REG_BASE,
++	.ie3_reg_addr = CE_HOST_IPQ5018_IE_3_ADDRESS - HAL_IPQ5018_CE_WFSS_REG_BASE,
++};
++
++const struct ce_remap ath11k_ce_remap_ipq5018 = {
++	.base = HAL_IPQ5018_CE_WFSS_REG_BASE,
++	.size = HAL_IPQ5018_CE_SIZE,
++};
++
+ const struct ath11k_hw_regs ipq8074_regs = {
+ 	/* SW2TCL(x) R0 ring configuration address */
+ 	.hal_tcl1_ring_base_lsb = 0x00000510,
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -80,6 +80,8 @@
+ #define ATH11K_M3_FILE			"m3.bin"
+ #define ATH11K_REGDB_FILE_NAME		"regdb.bin"
+ 
++#define ATH11K_CE_OFFSET(ab)	(ab->mem_ce - ab->mem)
++
+ enum ath11k_hw_rate_cck {
+ 	ATH11K_HW_RATE_CCK_LP_11M = 0,
+ 	ATH11K_HW_RATE_CCK_LP_5_5M,
+@@ -158,6 +160,8 @@ struct ath11k_hw_params {
+ 	u32 target_ce_count;
+ 	const struct service_to_pipe *svc_to_ce_map;
+ 	u32 svc_to_ce_map_len;
++	const struct ce_ie_addr *ce_ie_addr;
++	const struct ce_remap *ce_remap;
+ 
+ 	bool single_pdev_only;
+ 
+@@ -277,6 +281,11 @@ extern const struct ath11k_hw_ring_mask
+ extern const struct ath11k_hw_ring_mask ath11k_hw_ring_mask_qcn9074;
+ extern const struct ath11k_hw_ring_mask ath11k_hw_ring_mask_wcn6750;
+ 
++extern const struct ce_ie_addr ath11k_ce_ie_addr_ipq8074;
++extern const struct ce_ie_addr ath11k_ce_ie_addr_ipq5018;
++
++extern const struct ce_remap ath11k_ce_remap_ipq5018;
++
+ extern const struct ath11k_hw_hal_params ath11k_hw_hal_params_ipq8074;
+ extern const struct ath11k_hw_hal_params ath11k_hw_hal_params_qca6390;
+ extern const struct ath11k_hw_hal_params ath11k_hw_hal_params_wcn6750;
+--- a/drivers/net/wireless/ath/ath11k/pci.c
++++ b/drivers/net/wireless/ath/ath11k/pci.c
+@@ -543,6 +543,8 @@ static int ath11k_pci_claim(struct ath11
+ 		goto clear_master;
+ 	}
+ 
++	ab->mem_ce = ab->mem;
++
+ 	ath11k_dbg(ab, ATH11K_DBG_BOOT, "boot pci_mem 0x%pK\n", ab->mem);
+ 	return 0;
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0022-wifi-ath11k-update-hal-srng-regs-for-IPQ5018.patch b/package/kernel/mac80211/patches/ath11k/0022-wifi-ath11k-update-hal-srng-regs-for-IPQ5018.patch
new file mode 100644
index 00000000000000..35ea20a3c4fa74
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0022-wifi-ath11k-update-hal-srng-regs-for-IPQ5018.patch
@@ -0,0 +1,130 @@
+From 711b80acbdfb9667a9cf8374e13320a6e624ce73 Mon Sep 17 00:00:00 2001
+From: Sriram R <quic_srirrama@quicinc.com>
+Date: Fri, 2 Dec 2022 23:37:14 +0200
+Subject: [PATCH] wifi: ath11k: update hal srng regs for IPQ5018
+
+IPQ5018 hal srng register address & offsets are not
+similar to IPQ8074/IPQ6018/QCN9074, hence define a
+new set of srng register group data for IPQ5018.
+
+Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
+Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221122132152.17771-6-quic_kathirve@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c |  1 +
+ drivers/net/wireless/ath/ath11k/hw.c   | 79 ++++++++++++++++++++++++++
+ drivers/net/wireless/ath/ath11k/hw.h   |  1 +
+ 3 files changed, 81 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -634,6 +634,7 @@ static const struct ath11k_hw_params ath
+ 			.max_fft_bins = 1024,
+ 		},
+ 		.internal_sleep_clock = false,
++		.regs = &ipq5018_regs,
+ 		.host_ce_config = ath11k_host_ce_config_qcn9074,
+ 		.ce_count = CE_CNT_5018,
+ 		.target_ce_config = ath11k_target_ce_config_wlan_ipq5018,
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -2645,6 +2645,85 @@ static const struct ath11k_hw_tcl2wbm_rb
+ 	},
+ };
+ 
++const struct ath11k_hw_regs ipq5018_regs = {
++	/* SW2TCL(x) R0 ring configuration address */
++	.hal_tcl1_ring_base_lsb = 0x00000694,
++	.hal_tcl1_ring_base_msb = 0x00000698,
++	.hal_tcl1_ring_id =	0x0000069c,
++	.hal_tcl1_ring_misc = 0x000006a4,
++	.hal_tcl1_ring_tp_addr_lsb = 0x000006b0,
++	.hal_tcl1_ring_tp_addr_msb = 0x000006b4,
++	.hal_tcl1_ring_consumer_int_setup_ix0 = 0x000006c4,
++	.hal_tcl1_ring_consumer_int_setup_ix1 = 0x000006c8,
++	.hal_tcl1_ring_msi1_base_lsb = 0x000006dc,
++	.hal_tcl1_ring_msi1_base_msb = 0x000006e0,
++	.hal_tcl1_ring_msi1_data = 0x000006e4,
++	.hal_tcl2_ring_base_lsb = 0x000006ec,
++	.hal_tcl_ring_base_lsb = 0x0000079c,
++
++	/* TCL STATUS ring address */
++	.hal_tcl_status_ring_base_lsb = 0x000008a4,
++
++	/* REO2SW(x) R0 ring configuration address */
++	.hal_reo1_ring_base_lsb = 0x000001ec,
++	.hal_reo1_ring_base_msb = 0x000001f0,
++	.hal_reo1_ring_id = 0x000001f4,
++	.hal_reo1_ring_misc = 0x000001fc,
++	.hal_reo1_ring_hp_addr_lsb = 0x00000200,
++	.hal_reo1_ring_hp_addr_msb = 0x00000204,
++	.hal_reo1_ring_producer_int_setup = 0x00000210,
++	.hal_reo1_ring_msi1_base_lsb = 0x00000234,
++	.hal_reo1_ring_msi1_base_msb = 0x00000238,
++	.hal_reo1_ring_msi1_data = 0x0000023c,
++	.hal_reo2_ring_base_lsb = 0x00000244,
++	.hal_reo1_aging_thresh_ix_0 = 0x00000564,
++	.hal_reo1_aging_thresh_ix_1 = 0x00000568,
++	.hal_reo1_aging_thresh_ix_2 = 0x0000056c,
++	.hal_reo1_aging_thresh_ix_3 = 0x00000570,
++
++	/* REO2SW(x) R2 ring pointers (head/tail) address */
++	.hal_reo1_ring_hp = 0x00003028,
++	.hal_reo1_ring_tp = 0x0000302c,
++	.hal_reo2_ring_hp = 0x00003030,
++
++	/* REO2TCL R0 ring configuration address */
++	.hal_reo_tcl_ring_base_lsb = 0x000003fc,
++	.hal_reo_tcl_ring_hp = 0x00003058,
++
++	/* SW2REO ring address */
++	.hal_sw2reo_ring_base_lsb = 0x0000013c,
++	.hal_sw2reo_ring_hp = 0x00003018,
++
++	/* REO CMD ring address */
++	.hal_reo_cmd_ring_base_lsb = 0x000000e4,
++	.hal_reo_cmd_ring_hp = 0x00003010,
++
++	/* REO status address */
++	.hal_reo_status_ring_base_lsb = 0x00000504,
++	.hal_reo_status_hp = 0x00003070,
++
++	/* WCSS relative address */
++	.hal_seq_wcss_umac_ce0_src_reg = 0x08400000
++		- HAL_IPQ5018_CE_WFSS_REG_BASE,
++	.hal_seq_wcss_umac_ce0_dst_reg = 0x08401000
++		- HAL_IPQ5018_CE_WFSS_REG_BASE,
++	.hal_seq_wcss_umac_ce1_src_reg = 0x08402000
++		- HAL_IPQ5018_CE_WFSS_REG_BASE,
++	.hal_seq_wcss_umac_ce1_dst_reg = 0x08403000
++		- HAL_IPQ5018_CE_WFSS_REG_BASE,
++
++	/* WBM Idle address */
++	.hal_wbm_idle_link_ring_base_lsb = 0x00000874,
++	.hal_wbm_idle_link_ring_misc = 0x00000884,
++
++	/* SW2WBM release address */
++	.hal_wbm_release_ring_base_lsb = 0x000001ec,
++
++	/* WBM2SW release address */
++	.hal_wbm0_release_ring_base_lsb = 0x00000924,
++	.hal_wbm1_release_ring_base_lsb = 0x0000097c,
++};
++
+ const struct ath11k_hw_hal_params ath11k_hw_hal_params_ipq8074 = {
+ 	.rx_buf_rbm = HAL_RX_BUF_RBM_SW3_BM,
+ 	.tcl2wbm_rbm_map = ath11k_hw_tcl2wbm_rbm_map_ipq8074,
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -415,6 +415,7 @@ extern const struct ath11k_hw_regs qca63
+ extern const struct ath11k_hw_regs qcn9074_regs;
+ extern const struct ath11k_hw_regs wcn6855_regs;
+ extern const struct ath11k_hw_regs wcn6750_regs;
++extern const struct ath11k_hw_regs ipq5018_regs;
+ 
+ static inline const char *ath11k_bd_ie_type_str(enum ath11k_bd_ie_type type)
+ {
diff --git a/package/kernel/mac80211/patches/ath11k/0023-wifi-ath11k-initialize-hw_ops-for-IPQ5018.patch b/package/kernel/mac80211/patches/ath11k/0023-wifi-ath11k-initialize-hw_ops-for-IPQ5018.patch
new file mode 100644
index 00000000000000..5ef701a4452691
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0023-wifi-ath11k-initialize-hw_ops-for-IPQ5018.patch
@@ -0,0 +1,90 @@
+From ba60f2793d3a37a00da14bb56a26558a902d2831 Mon Sep 17 00:00:00 2001
+From: Sriram R <quic_srirrama@quicinc.com>
+Date: Fri, 2 Dec 2022 23:37:14 +0200
+Subject: [PATCH] wifi: ath11k: initialize hw_ops for IPQ5018
+
+The ipq5018_ops is initialized for IPQ5018. This is different from
+other platforms.
+
+Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
+Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221122132152.17771-7-quic_kathirve@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c |  1 +
+ drivers/net/wireless/ath/ath11k/hw.c   | 40 ++++++++++++++++++++++++++
+ drivers/net/wireless/ath/ath11k/hw.h   |  1 +
+ 3 files changed, 42 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -635,6 +635,7 @@ static const struct ath11k_hw_params ath
+ 		},
+ 		.internal_sleep_clock = false,
+ 		.regs = &ipq5018_regs,
++		.hw_ops = &ipq5018_ops,
+ 		.host_ce_config = ath11k_host_ce_config_qcn9074,
+ 		.ce_count = CE_CNT_5018,
+ 		.target_ce_config = ath11k_target_ce_config_wlan_ipq5018,
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -1084,6 +1084,46 @@ const struct ath11k_hw_ops wcn6750_ops =
+ 	.get_ring_selector = ath11k_hw_wcn6750_get_tcl_ring_selector,
+ };
+ 
++/* IPQ5018 hw ops is similar to QCN9074 except for the dest ring remap */
++const struct ath11k_hw_ops ipq5018_ops = {
++	.get_hw_mac_from_pdev_id = ath11k_hw_ipq6018_mac_from_pdev_id,
++	.wmi_init_config = ath11k_init_wmi_config_ipq8074,
++	.mac_id_to_pdev_id = ath11k_hw_mac_id_to_pdev_id_ipq8074,
++	.mac_id_to_srng_id = ath11k_hw_mac_id_to_srng_id_ipq8074,
++	.tx_mesh_enable = ath11k_hw_qcn9074_tx_mesh_enable,
++	.rx_desc_get_first_msdu = ath11k_hw_qcn9074_rx_desc_get_first_msdu,
++	.rx_desc_get_last_msdu = ath11k_hw_qcn9074_rx_desc_get_last_msdu,
++	.rx_desc_get_l3_pad_bytes = ath11k_hw_qcn9074_rx_desc_get_l3_pad_bytes,
++	.rx_desc_get_hdr_status = ath11k_hw_qcn9074_rx_desc_get_hdr_status,
++	.rx_desc_encrypt_valid = ath11k_hw_qcn9074_rx_desc_encrypt_valid,
++	.rx_desc_get_encrypt_type = ath11k_hw_qcn9074_rx_desc_get_encrypt_type,
++	.rx_desc_get_decap_type = ath11k_hw_qcn9074_rx_desc_get_decap_type,
++	.rx_desc_get_mesh_ctl = ath11k_hw_qcn9074_rx_desc_get_mesh_ctl,
++	.rx_desc_get_ldpc_support = ath11k_hw_qcn9074_rx_desc_get_ldpc_support,
++	.rx_desc_get_mpdu_seq_ctl_vld = ath11k_hw_qcn9074_rx_desc_get_mpdu_seq_ctl_vld,
++	.rx_desc_get_mpdu_fc_valid = ath11k_hw_qcn9074_rx_desc_get_mpdu_fc_valid,
++	.rx_desc_get_mpdu_start_seq_no = ath11k_hw_qcn9074_rx_desc_get_mpdu_start_seq_no,
++	.rx_desc_get_msdu_len = ath11k_hw_qcn9074_rx_desc_get_msdu_len,
++	.rx_desc_get_msdu_sgi = ath11k_hw_qcn9074_rx_desc_get_msdu_sgi,
++	.rx_desc_get_msdu_rate_mcs = ath11k_hw_qcn9074_rx_desc_get_msdu_rate_mcs,
++	.rx_desc_get_msdu_rx_bw = ath11k_hw_qcn9074_rx_desc_get_msdu_rx_bw,
++	.rx_desc_get_msdu_freq = ath11k_hw_qcn9074_rx_desc_get_msdu_freq,
++	.rx_desc_get_msdu_pkt_type = ath11k_hw_qcn9074_rx_desc_get_msdu_pkt_type,
++	.rx_desc_get_msdu_nss = ath11k_hw_qcn9074_rx_desc_get_msdu_nss,
++	.rx_desc_get_mpdu_tid = ath11k_hw_qcn9074_rx_desc_get_mpdu_tid,
++	.rx_desc_get_mpdu_peer_id = ath11k_hw_qcn9074_rx_desc_get_mpdu_peer_id,
++	.rx_desc_copy_attn_end_tlv = ath11k_hw_qcn9074_rx_desc_copy_attn_end,
++	.rx_desc_get_mpdu_start_tag = ath11k_hw_qcn9074_rx_desc_get_mpdu_start_tag,
++	.rx_desc_get_mpdu_ppdu_id = ath11k_hw_qcn9074_rx_desc_get_mpdu_ppdu_id,
++	.rx_desc_set_msdu_len = ath11k_hw_qcn9074_rx_desc_set_msdu_len,
++	.rx_desc_get_attention = ath11k_hw_qcn9074_rx_desc_get_attention,
++	.rx_desc_get_msdu_payload = ath11k_hw_qcn9074_rx_desc_get_msdu_payload,
++	.mpdu_info_get_peerid = ath11k_hw_ipq8074_mpdu_info_get_peerid,
++	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
++	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2,
++
++};
++
+ #define ATH11K_TX_RING_MASK_0 BIT(0)
+ #define ATH11K_TX_RING_MASK_1 BIT(1)
+ #define ATH11K_TX_RING_MASK_2 BIT(2)
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -275,6 +275,7 @@ extern const struct ath11k_hw_ops qca639
+ extern const struct ath11k_hw_ops qcn9074_ops;
+ extern const struct ath11k_hw_ops wcn6855_ops;
+ extern const struct ath11k_hw_ops wcn6750_ops;
++extern const struct ath11k_hw_ops ipq5018_ops;
+ 
+ extern const struct ath11k_hw_ring_mask ath11k_hw_ring_mask_ipq8074;
+ extern const struct ath11k_hw_ring_mask ath11k_hw_ring_mask_qca6390;
diff --git a/package/kernel/mac80211/patches/ath11k/0024-wifi-ath11k-add-new-hw-ops-for-IPQ5018-to-get-rx-des.patch b/package/kernel/mac80211/patches/ath11k/0024-wifi-ath11k-add-new-hw-ops-for-IPQ5018-to-get-rx-des.patch
new file mode 100644
index 00000000000000..64531f13f81cec
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0024-wifi-ath11k-add-new-hw-ops-for-IPQ5018-to-get-rx-des.patch
@@ -0,0 +1,84 @@
+From 69968f88f1770d61cae0febef805fd00d66cf6a1 Mon Sep 17 00:00:00 2001
+From: Sriram R <quic_srirrama@quicinc.com>
+Date: Fri, 2 Dec 2022 23:37:15 +0200
+Subject: [PATCH] wifi: ath11k: add new hw ops for IPQ5018 to get rx dest ring
+ hashmap
+
+The Destination ring control register is different
+for IPQ5018 when compared to IPQ8074/IPQ6018/QCN9074.
+Hence create a new hw ops to fetch the hash ring map
+for different device variants. ipq5018 hw ops
+is similar to qcn9074 except for this change, so reuse
+all the qcn9074 ops for ipq5018.
+
+Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
+Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221122132152.17771-8-quic_kathirve@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/hw.c | 44 ++++++++++++++++++++++++++++
+ 1 file changed, 44 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -791,6 +791,49 @@ static void ath11k_hw_wcn6855_reo_setup(
+ 			   ring_hash_map);
+ }
+ 
++static void ath11k_hw_ipq5018_reo_setup(struct ath11k_base *ab)
++{
++	u32 reo_base = HAL_SEQ_WCSS_UMAC_REO_REG;
++	u32 val;
++
++	/* Each hash entry uses three bits to map to a particular ring. */
++	u32 ring_hash_map = HAL_HASH_ROUTING_RING_SW1 << 0 |
++		HAL_HASH_ROUTING_RING_SW2 << 4 |
++		HAL_HASH_ROUTING_RING_SW3 << 8 |
++		HAL_HASH_ROUTING_RING_SW4 << 12 |
++		HAL_HASH_ROUTING_RING_SW1 << 16 |
++		HAL_HASH_ROUTING_RING_SW2 << 20 |
++		HAL_HASH_ROUTING_RING_SW3 << 24 |
++		HAL_HASH_ROUTING_RING_SW4 << 28;
++
++	val = ath11k_hif_read32(ab, reo_base + HAL_REO1_GEN_ENABLE);
++
++	val &= ~HAL_REO1_GEN_ENABLE_FRAG_DST_RING;
++	val |= FIELD_PREP(HAL_REO1_GEN_ENABLE_FRAG_DST_RING,
++			HAL_SRNG_RING_ID_REO2SW1) |
++		FIELD_PREP(HAL_REO1_GEN_ENABLE_AGING_LIST_ENABLE, 1) |
++		FIELD_PREP(HAL_REO1_GEN_ENABLE_AGING_FLUSH_ENABLE, 1);
++	ath11k_hif_write32(ab, reo_base + HAL_REO1_GEN_ENABLE, val);
++
++	ath11k_hif_write32(ab, reo_base + HAL_REO1_AGING_THRESH_IX_0(ab),
++			   HAL_DEFAULT_REO_TIMEOUT_USEC);
++	ath11k_hif_write32(ab, reo_base + HAL_REO1_AGING_THRESH_IX_1(ab),
++			   HAL_DEFAULT_REO_TIMEOUT_USEC);
++	ath11k_hif_write32(ab, reo_base + HAL_REO1_AGING_THRESH_IX_2(ab),
++			   HAL_DEFAULT_REO_TIMEOUT_USEC);
++	ath11k_hif_write32(ab, reo_base + HAL_REO1_AGING_THRESH_IX_3(ab),
++			   HAL_DEFAULT_REO_TIMEOUT_USEC);
++
++	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_0,
++			   ring_hash_map);
++	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_1,
++			   ring_hash_map);
++	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_2,
++			   ring_hash_map);
++	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_3,
++			   ring_hash_map);
++}
++
+ static u16 ath11k_hw_ipq8074_mpdu_info_get_peerid(u8 *tlv_data)
+ {
+ 	u16 peer_id = 0;
+@@ -1117,6 +1160,7 @@ const struct ath11k_hw_ops ipq5018_ops =
+ 	.rx_desc_get_mpdu_ppdu_id = ath11k_hw_qcn9074_rx_desc_get_mpdu_ppdu_id,
+ 	.rx_desc_set_msdu_len = ath11k_hw_qcn9074_rx_desc_set_msdu_len,
+ 	.rx_desc_get_attention = ath11k_hw_qcn9074_rx_desc_get_attention,
++	.reo_setup = ath11k_hw_ipq5018_reo_setup,
+ 	.rx_desc_get_msdu_payload = ath11k_hw_qcn9074_rx_desc_get_msdu_payload,
+ 	.mpdu_info_get_peerid = ath11k_hw_ipq8074_mpdu_info_get_peerid,
+ 	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
diff --git a/package/kernel/mac80211/patches/ath11k/0025-wifi-ath11k-add-ipq5018-device-support.patch b/package/kernel/mac80211/patches/ath11k/0025-wifi-ath11k-add-ipq5018-device-support.patch
new file mode 100644
index 00000000000000..5b930e8d4fd19a
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0025-wifi-ath11k-add-ipq5018-device-support.patch
@@ -0,0 +1,31 @@
+From 25edca7bb18a2a40cc7e54c6f522e9b3c917e2c5 Mon Sep 17 00:00:00 2001
+From: Sriram R <quic_srirrama@quicinc.com>
+Date: Fri, 2 Dec 2022 23:37:15 +0200
+Subject: [PATCH] wifi: ath11k: add ipq5018 device support
+
+ipq5018 is a ahb 2ghz device, enable the compatible support for
+ipq5018 in ahb.
+
+Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
+Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221122132152.17771-9-quic_kathirve@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/ahb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -32,6 +32,9 @@ static const struct of_device_id ath11k_
+ 	{ .compatible = "qcom,wcn6750-wifi",
+ 	  .data = (void *)ATH11K_HW_WCN6750_HW10,
+ 	},
++	{ .compatible = "qcom,ipq5018-wifi",
++	  .data = (void *)ATH11K_HW_IPQ5018_HW10,
++	},
+ 	{ }
+ };
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0026-wifi-ath11k-Fix-scan-request-param-frame-size-warnin.patch b/package/kernel/mac80211/patches/ath11k/0026-wifi-ath11k-Fix-scan-request-param-frame-size-warnin.patch
new file mode 100644
index 00000000000000..50c14e7b98fb8d
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0026-wifi-ath11k-Fix-scan-request-param-frame-size-warnin.patch
@@ -0,0 +1,161 @@
+From d45daa6d1a8da080f1b516c570a8428a7b9225e4 Mon Sep 17 00:00:00 2001
+From: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Date: Tue, 6 Dec 2022 00:51:25 +0530
+Subject: [PATCH] wifi: ath11k: Fix scan request param frame size warning
+
+Following warning was observed
+
+drivers/net/wireless/ath/ath11k/mac.c:2351:1: warning: the frame
+size of 1184 bytes is larger than 1024 bytes [-Wframe-larger-than=]
+
+A local variable is declared with a size larger than 1024 bytes
+this causing a compilation warning. Change the local variable to
+heap memory to fix the warning.
+
+Tested-on: IPQ8074 AHB WLAN.HK.2.7.0.1-01701-QCAHKSWPL_SILICONZ-1 v2
+
+Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221205192125.13533-1-quic_kathirve@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 83 +++++++++++++++------------
+ 1 file changed, 45 insertions(+), 38 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -3612,7 +3612,7 @@ static int ath11k_mac_op_hw_scan(struct
+ 	struct ath11k *ar = hw->priv;
+ 	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
+ 	struct cfg80211_scan_request *req = &hw_req->req;
+-	struct scan_req_params arg;
++	struct scan_req_params *arg = NULL;
+ 	int ret = 0;
+ 	int i;
+ 	u32 scan_timeout;
+@@ -3640,72 +3640,78 @@ static int ath11k_mac_op_hw_scan(struct
+ 	if (ret)
+ 		goto exit;
+ 
+-	memset(&arg, 0, sizeof(arg));
+-	ath11k_wmi_start_scan_init(ar, &arg);
+-	arg.vdev_id = arvif->vdev_id;
+-	arg.scan_id = ATH11K_SCAN_ID;
++	arg = kzalloc(sizeof(*arg), GFP_KERNEL);
++
++	if (!arg) {
++		ret = -ENOMEM;
++		goto exit;
++	}
++
++	ath11k_wmi_start_scan_init(ar, arg);
++	arg->vdev_id = arvif->vdev_id;
++	arg->scan_id = ATH11K_SCAN_ID;
+ 
+ 	if (req->ie_len) {
+-		arg.extraie.ptr = kmemdup(req->ie, req->ie_len, GFP_KERNEL);
+-		if (!arg.extraie.ptr) {
++		arg->extraie.ptr = kmemdup(req->ie, req->ie_len, GFP_KERNEL);
++		if (!arg->extraie.ptr) {
+ 			ret = -ENOMEM;
+ 			goto exit;
+ 		}
+-		arg.extraie.len = req->ie_len;
++		arg->extraie.len = req->ie_len;
+ 	}
+ 
+ 	if (req->n_ssids) {
+-		arg.num_ssids = req->n_ssids;
+-		for (i = 0; i < arg.num_ssids; i++) {
+-			arg.ssid[i].length  = req->ssids[i].ssid_len;
+-			memcpy(&arg.ssid[i].ssid, req->ssids[i].ssid,
++		arg->num_ssids = req->n_ssids;
++		for (i = 0; i < arg->num_ssids; i++) {
++			arg->ssid[i].length  = req->ssids[i].ssid_len;
++			memcpy(&arg->ssid[i].ssid, req->ssids[i].ssid,
+ 			       req->ssids[i].ssid_len);
+ 		}
+ 	} else {
+-		arg.scan_flags |= WMI_SCAN_FLAG_PASSIVE;
++		arg->scan_flags |= WMI_SCAN_FLAG_PASSIVE;
+ 	}
+ 
+ 	if (req->n_channels) {
+-		arg.num_chan = req->n_channels;
+-		arg.chan_list = kcalloc(arg.num_chan, sizeof(*arg.chan_list),
+-					GFP_KERNEL);
++		arg->num_chan = req->n_channels;
++		arg->chan_list = kcalloc(arg->num_chan, sizeof(*arg->chan_list),
++					 GFP_KERNEL);
+ 
+-		if (!arg.chan_list) {
++		if (!arg->chan_list) {
+ 			ret = -ENOMEM;
+ 			goto exit;
+ 		}
+ 
+-		for (i = 0; i < arg.num_chan; i++)
+-			arg.chan_list[i] = req->channels[i]->center_freq;
++		for (i = 0; i < arg->num_chan; i++)
++			arg->chan_list[i] = req->channels[i]->center_freq;
+ 	}
+ 
+ 	if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
+-		arg.scan_f_add_spoofed_mac_in_probe = 1;
+-		ether_addr_copy(arg.mac_addr.addr, req->mac_addr);
+-		ether_addr_copy(arg.mac_mask.addr, req->mac_addr_mask);
++		arg->scan_f_add_spoofed_mac_in_probe = 1;
++		ether_addr_copy(arg->mac_addr.addr, req->mac_addr);
++		ether_addr_copy(arg->mac_mask.addr, req->mac_addr_mask);
+ 	}
+ 
+ 	/* if duration is set, default dwell times will be overwritten */
+ 	if (req->duration) {
+-		arg.dwell_time_active = req->duration;
+-		arg.dwell_time_active_2g = req->duration;
+-		arg.dwell_time_active_6g = req->duration;
+-		arg.dwell_time_passive = req->duration;
+-		arg.dwell_time_passive_6g = req->duration;
+-		arg.burst_duration = req->duration;
++		arg->dwell_time_active = req->duration;
++		arg->dwell_time_active_2g = req->duration;
++		arg->dwell_time_active_6g = req->duration;
++		arg->dwell_time_passive = req->duration;
++		arg->dwell_time_passive_6g = req->duration;
++		arg->burst_duration = req->duration;
+ 
+-		scan_timeout = min_t(u32, arg.max_rest_time *
+-				(arg.num_chan - 1) + (req->duration +
++		scan_timeout = min_t(u32, arg->max_rest_time *
++				(arg->num_chan - 1) + (req->duration +
+ 				ATH11K_SCAN_CHANNEL_SWITCH_WMI_EVT_OVERHEAD) *
+-				arg.num_chan, arg.max_scan_time);
++				arg->num_chan, arg->max_scan_time);
+ 	} else {
+-		scan_timeout = arg.max_scan_time;
++		scan_timeout = arg->max_scan_time;
+ 	}
+ 
+ 	/* Add a margin to account for event/command processing */
+ 	scan_timeout += ATH11K_MAC_SCAN_CMD_EVT_OVERHEAD;
+ 
+-	ret = ath11k_start_scan(ar, &arg);
++	ret = ath11k_start_scan(ar, arg);
+ 	if (ret) {
+ 		ath11k_warn(ar->ab, "failed to start hw scan: %d\n", ret);
+ 		spin_lock_bh(&ar->data_lock);
+@@ -3717,10 +3723,11 @@ static int ath11k_mac_op_hw_scan(struct
+ 				     msecs_to_jiffies(scan_timeout));
+ 
+ exit:
+-	kfree(arg.chan_list);
+-
+-	if (req->ie_len)
+-		kfree(arg.extraie.ptr);
++	if (arg) {
++		kfree(arg->chan_list);
++		kfree(arg->extraie.ptr);
++		kfree(arg);
++	}
+ 
+ 	mutex_unlock(&ar->conf_mutex);
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0029-wifi-ath11k-Add-support-to-configure-FTM-responder-r.patch b/package/kernel/mac80211/patches/ath11k/0029-wifi-ath11k-Add-support-to-configure-FTM-responder-r.patch
new file mode 100644
index 00000000000000..f652d689b5196e
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0029-wifi-ath11k-Add-support-to-configure-FTM-responder-r.patch
@@ -0,0 +1,169 @@
+From a27c6a5853eb9d4f293b99be73a6891fe88263c7 Mon Sep 17 00:00:00 2001
+From: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
+Date: Tue, 10 Jan 2023 15:30:57 +0200
+Subject: [PATCH] wifi: ath11k: Add support to configure FTM responder role
+
+Fine Timing Measurement(FTM) support is used to measure round trip
+time between two nodes.
+
+Enable FTM responder feature using hw_params on supported device.
+Since FTM functionality is offloaded to firmware, adding the
+interface allows user space to enable or disable FTM responder.
+Also add support for advertising the same in extended capabilities.
+
+QCA6390, WCN6855 and WCN6750 do not support this feature.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
+Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221220044435.10506-1-quic_rajkbhag@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c |  8 ++++++++
+ drivers/net/wireless/ath/ath11k/core.h |  1 +
+ drivers/net/wireless/ath/ath11k/hw.h   |  1 +
+ drivers/net/wireless/ath/ath11k/mac.c  | 20 +++++++++++++++++++-
+ drivers/net/wireless/ath/ath11k/wmi.h  |  1 +
+ 5 files changed, 30 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -116,6 +116,7 @@ static const struct ath11k_hw_params ath
+ 		.tcl_ring_retry = true,
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
++		.ftm_responder = true,
+ 	},
+ 	{
+ 		.hw_rev = ATH11K_HW_IPQ6018_HW10,
+@@ -198,6 +199,7 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = false,
++		.ftm_responder = true,
+ 	},
+ 	{
+ 		.name = "qca6390 hw2.0",
+@@ -282,6 +284,7 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = true,
++		.ftm_responder = false,
+ 	},
+ 	{
+ 		.name = "qcn9074 hw1.0",
+@@ -363,6 +366,7 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = false,
++		.ftm_responder = true,
+ 	},
+ 	{
+ 		.name = "wcn6855 hw2.0",
+@@ -447,6 +451,7 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = true,
++		.ftm_responder = false,
+ 	},
+ 	{
+ 		.name = "wcn6855 hw2.1",
+@@ -529,6 +534,7 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = true,
++		.ftm_responder = false,
+ 	},
+ 	{
+ 		.name = "wcn6750 hw1.0",
+@@ -609,6 +615,7 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE_WCN6750,
+ 		.smp2p_wow_exit = true,
+ 		.support_fw_mac_sequence = true,
++		.ftm_responder = false,
+ 	},
+ 	{
+ 		.hw_rev = ATH11K_HW_IPQ5018_HW10,
+@@ -688,6 +695,7 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = false,
++		.ftm_responder = true,
+ 	},
+ };
+ 
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -346,6 +346,7 @@ struct ath11k_vif {
+ 
+ 	bool is_started;
+ 	bool is_up;
++	bool ftm_responder;
+ 	bool spectral_enabled;
+ 	bool ps;
+ 	u32 aid;
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -224,6 +224,7 @@ struct ath11k_hw_params {
+ 	u32 tx_ring_size;
+ 	bool smp2p_wow_exit;
+ 	bool support_fw_mac_sequence;
++	bool ftm_responder;
+ };
+ 
+ struct ath11k_hw_ops {
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -3110,7 +3110,7 @@ static void ath11k_mac_op_bss_info_chang
+ 	u16 bitrate;
+ 	int ret = 0;
+ 	u8 rateidx;
+-	u32 rate;
++	u32 rate, param;
+ 	u32 ipv4_cnt;
+ 
+ 	mutex_lock(&ar->conf_mutex);
+@@ -3412,6 +3412,20 @@ static void ath11k_mac_op_bss_info_chang
+ 		}
+ 	}
+ 
++	if (changed & BSS_CHANGED_FTM_RESPONDER &&
++	    arvif->ftm_responder != info->ftm_responder &&
++	    ar->ab->hw_params.ftm_responder &&
++	    (vif->type == NL80211_IFTYPE_AP ||
++	     vif->type == NL80211_IFTYPE_MESH_POINT)) {
++		arvif->ftm_responder = info->ftm_responder;
++		param = WMI_VDEV_PARAM_ENABLE_DISABLE_RTT_RESPONDER_ROLE;
++		ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id, param,
++						    arvif->ftm_responder);
++		if (ret)
++			ath11k_warn(ar->ab, "Failed to set ftm responder %i: %d\n",
++				    arvif->vdev_id, ret);
++	}
++
+ 	if (changed & BSS_CHANGED_FILS_DISCOVERY ||
+ 	    changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP)
+ 		ath11k_mac_fils_discovery(arvif, info);
+@@ -9113,6 +9127,10 @@ static int __ath11k_mac_register(struct
+ 	wiphy_ext_feature_set(ar->hw->wiphy,
+ 			      NL80211_EXT_FEATURE_SET_SCAN_DWELL);
+ 
++	if (ab->hw_params.ftm_responder)
++		wiphy_ext_feature_set(ar->hw->wiphy,
++				      NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
++
+ 	ath11k_reg_init(ar);
+ 
+ 	if (!test_bit(ATH11K_FLAG_RAW_MODE, &ab->dev_flags)) {
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -1073,6 +1073,7 @@ enum wmi_tlv_vdev_param {
+ 	WMI_VDEV_PARAM_ENABLE_BCAST_PROBE_RESPONSE,
+ 	WMI_VDEV_PARAM_FILS_MAX_CHANNEL_GUARD_TIME,
+ 	WMI_VDEV_PARAM_HE_LTF = 0x74,
++	WMI_VDEV_PARAM_ENABLE_DISABLE_RTT_RESPONDER_ROLE = 0x7d,
+ 	WMI_VDEV_PARAM_BA_MODE = 0x7e,
+ 	WMI_VDEV_PARAM_AUTORATE_MISC_CFG = 0x80,
+ 	WMI_VDEV_PARAM_SET_HE_SOUNDING_MODE = 0x87,
diff --git a/package/kernel/mac80211/patches/ath11k/0030-wifi-ath11k-add-channel-177-into-5-GHz-channel-list.patch b/package/kernel/mac80211/patches/ath11k/0030-wifi-ath11k-add-channel-177-into-5-GHz-channel-list.patch
new file mode 100644
index 00000000000000..d0ed9c54b8842b
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0030-wifi-ath11k-add-channel-177-into-5-GHz-channel-list.patch
@@ -0,0 +1,41 @@
+From e5e94d10c85653609a2893c8d0ef24a27471b68f Mon Sep 17 00:00:00 2001
+From: Wen Gong <quic_wgong@quicinc.com>
+Date: Tue, 10 Jan 2023 15:30:58 +0200
+Subject: [PATCH] wifi: ath11k: add channel 177 into 5 GHz channel list
+
+Add support for the 5 GHz channel 177 with center frequency 5885 MHz and
+operating class 125 per IEEE Std 802.11ax-2021, Table E-4.
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3
+
+Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221220101912.30816-1-quic_wgong@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.h | 4 ++--
+ drivers/net/wireless/ath/ath11k/mac.c  | 1 +
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -521,8 +521,8 @@ struct ath11k_sta {
+ #define ATH11K_MIN_5G_FREQ 4150
+ #define ATH11K_MIN_6G_FREQ 5925
+ #define ATH11K_MAX_6G_FREQ 7115
+-#define ATH11K_NUM_CHANS 101
+-#define ATH11K_MAX_5G_CHAN 173
++#define ATH11K_NUM_CHANS 102
++#define ATH11K_MAX_5G_CHAN 177
+ 
+ enum ath11k_state {
+ 	ATH11K_STATE_OFF,
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -96,6 +96,7 @@ static const struct ieee80211_channel at
+ 	CHAN5G(165, 5825, 0),
+ 	CHAN5G(169, 5845, 0),
+ 	CHAN5G(173, 5865, 0),
++	CHAN5G(177, 5885, 0),
+ };
+ 
+ static const struct ieee80211_channel ath11k_6ghz_channels[] = {
diff --git a/package/kernel/mac80211/patches/ath11k/0031-wifi-ath11k-fix-ce-memory-mapping-for-ahb-devices.patch b/package/kernel/mac80211/patches/ath11k/0031-wifi-ath11k-fix-ce-memory-mapping-for-ahb-devices.patch
new file mode 100644
index 00000000000000..2786799972f69d
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0031-wifi-ath11k-fix-ce-memory-mapping-for-ahb-devices.patch
@@ -0,0 +1,114 @@
+From 53a998c4d7284debd77734d01e1466e59a1d03b2 Mon Sep 17 00:00:00 2001
+From: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
+Date: Fri, 13 Jan 2023 12:02:09 +0530
+Subject: [PATCH] wifi: ath11k: fix ce memory mapping for ahb devices
+
+Currently ath11k_ahb module is not loaded successfully and the wifi
+interface is not created. Kernel trace is seen while loading the
+ath11k_ahb module. The issue is seen in all ath11k AHB devices except
+in IPQ5018.
+
+This happens because in ath11k_ahb_probe(), ab->mem_ce is initialized
+with the value of ab->mem. However, at this instant ab->mem is not
+yet set.
+
+Later, during write to a particular memory via ath11k_ahb_write32()
+this ab->mem_ce is used with particular offset. Since ab->mem_ce is
+not set properly this possibly leads to memory conflict to handle
+kernel paging request and the below trace is seen.
+
+[   93.035047] Unable to handle kernel paging request at virtual address ffff800100a00000
+[   93.035083] Mem abort info:
+[   93.041869]   ESR = 0x0000000096000045
+[   93.044561]   EC = 0x25: DABT (current EL), IL = 32 bits
+[   93.048377]   SET = 0, FnV = 0
+[   93.053840]   EA = 0, S1PTW = 0
+[   93.056704]   FSC = 0x05: level 1 translation fault
+[   93.059745] Data abort info:
+[   93.064603]   ISV = 0, ISS = 0x00000045
+[   93.067729]   CM = 0, WnR = 1
+[   93.071287] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000042219000
+[   93.074409] [ffff800100a00000] pgd=100000007ffff003, p4d=100000007ffff003, pud=0000000000000000
+[   93.081195] Internal error: Oops: 0000000096000045 [#1] PREEMPT SMP
+[   93.089598] Modules linked in: ath11k_ahb ath11k_pci ath11k qmi_helpers
+[   93.095851] CPU: 2 PID: 66 Comm: kworker/u8:3 Not tainted 6.1.0-rc8-wt-ath-658126-g58e4b9df840c-dirty #2
+[   93.102454] Hardware name: Qualcomm Technologies, Inc. IPQ8074/AP-HK14 (DT)
+[   93.112171] Workqueue: ath11k_qmi_driver_event ath11k_qmi_driver_event_work [ath11k]
+[   93.118856] pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[   93.126838] pc : ath11k_ahb_write32+0xc/0x18 [ath11k_ahb]
+[   93.133520] lr : ath11k_hal_srng_setup+0x860/0x8f0 [ath11k]
+[   93.139075] sp : ffff80000aaebb70
+[   93.144452] x29: ffff80000aaebb70 x28: 0000000000000020 x27: ffff80000aaebc50
+[   93.147934] x26: ffff000004923750 x25: ffff000004921200 x24: ffff000004928000
+[   93.155051] x23: 0000000000000020 x22: ffff000004930000 x21: ffff000004923200
+[   93.162170] x20: ffff000004920000 x19: 00000000eea00000 x18: ffff0000049200f0
+[   93.169288] x17: 0000000000000000 x16: 0000000000000000 x15: 000000000000025e
+[   93.176405] x14: ffff000003c414f0 x13: 0000000000000000 x12: 0000000000000008
+[   93.183524] x11: ffff000003c41488 x10: 0000000000000040 x9 : 0000000000000000
+[   93.190641] x8 : ffff80000a9dd100 x7 : 0000000000000000 x6 : 000000000000003f
+[   93.197759] x5 : ffff800100a00400 x4 : ffff8000031f4018 x3 : 0000000000000004
+[   93.204877] x2 : 0000000047b62000 x1 : ffff800100a00000 x0 : ffff800012000000
+[   93.211996] Call trace:
+[   93.219104]  ath11k_ahb_write32+0xc/0x18 [ath11k_ahb]
+[   93.221366]  ath11k_ce_init_ring+0x184/0x278 [ath11k]
+[   93.226576]  ath11k_ce_init_pipes+0x4c/0x1a0 [ath11k]
+[   93.231610]  ath11k_core_qmi_firmware_ready+0x3c/0x568 [ath11k]
+[   93.236646]  ath11k_qmi_driver_event_work+0x168/0x4f8 [ath11k]
+[   93.242376]  process_one_work+0x144/0x350
+[   93.248275]  worker_thread+0x120/0x430
+[   93.252352]  kthread+0xf4/0x110
+[   93.255997]  ret_from_fork+0x10/0x20
+[   93.259043] Code: d503201f f94e1c00 8b214001 d50332bf (b9000022)
+[   93.262863] ---[ end trace 0000000000000000 ]---
+
+However, for the device IPQ5018 ath11k_hw_params .ce_remap is
+defined. This parameter is used to recalculate ab->mem_ce and hence,
+this issue is not seen in IPQ5018.
+
+Hence, fix this by initializing ab->mem_ce after ab->mem is set.
+ab->mem is set inside the ath11k_ahb_setup_resources() therefore
+initialize ab->mem_ce after ath11k_ahb_setup_resources().
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Fixes: b42b3678c91f ("wifi: ath11k: remap ce register space for IPQ5018")
+
+Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230113063209.7256-1-quic_rajkbhag@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/ahb.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -1157,12 +1157,16 @@ static int ath11k_ahb_probe(struct platf
+ 		goto err_core_free;
+ 	}
+ 
+-	ab->mem_ce = ab->mem;
+-
+ 	ret = ath11k_core_pre_init(ab);
+ 	if (ret)
+ 		goto err_core_free;
+ 
++	ret = ath11k_ahb_setup_resources(ab);
++	if (ret)
++		goto err_core_free;
++
++	ab->mem_ce = ab->mem;
++
+ 	if (ab->hw_params.ce_remap) {
+ 		const struct ce_remap *ce_remap = ab->hw_params.ce_remap;
+ 		/* ce register space is moved out of wcss unlike ipq8074 or ipq6018
+@@ -1177,10 +1181,6 @@ static int ath11k_ahb_probe(struct platf
+ 		}
+ 	}
+ 
+-	ret = ath11k_ahb_setup_resources(ab);
+-	if (ret)
+-		goto err_core_free;
+-
+ 	ret = ath11k_ahb_fw_resources_init(ab);
+ 	if (ret)
+ 		goto err_core_free;
diff --git a/package/kernel/mac80211/patches/ath11k/0033-wifi-ath11k-Set-ext-passive-scan-flag-to-adjust-pass.patch b/package/kernel/mac80211/patches/ath11k/0033-wifi-ath11k-Set-ext-passive-scan-flag-to-adjust-pass.patch
new file mode 100644
index 00000000000000..79b79e1053e49f
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0033-wifi-ath11k-Set-ext-passive-scan-flag-to-adjust-pass.patch
@@ -0,0 +1,73 @@
+From cf8f3d4deb02a8fdc806c46d4112b69868544697 Mon Sep 17 00:00:00 2001
+From: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
+Date: Wed, 15 Feb 2023 20:31:36 +0200
+Subject: [PATCH] wifi: ath11k: Set ext passive scan flag to adjust passive
+ scan start time
+
+Set the WMI_SCAN_FLAG_EXT_PASSIVE_SCAN_START_TIME_ENHANCE flag
+while sending the scan command.  If this flag is enabled when the
+incoming scan request comes with a strict start time and its duration
+overlaps with next TBTT, then target adjust the start time accordingly
+for passive scan. Target supporting this feature will advertise
+WMI_TLV_SERVICE_PASSIVE_SCAN_START_TIME_ENHANCE.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01467-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221222131720.11368-1-quic_tamizhr@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/wmi.c | 8 ++++++++
+ drivers/net/wireless/ath/ath11k/wmi.h | 3 +++
+ 2 files changed, 11 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -2068,6 +2068,12 @@ void ath11k_wmi_start_scan_init(struct a
+ 				  WMI_SCAN_EVENT_FOREIGN_CHAN |
+ 				  WMI_SCAN_EVENT_DEQUEUED;
+ 	arg->scan_flags |= WMI_SCAN_CHAN_STAT_EVENT;
++
++	if (test_bit(WMI_TLV_SERVICE_PASSIVE_SCAN_START_TIME_ENHANCE,
++		     ar->ab->wmi_ab.svc_map))
++		arg->scan_ctrl_flags_ext |=
++			WMI_SCAN_FLAG_EXT_PASSIVE_SCAN_START_TIME_ENHANCE;
++
+ 	arg->num_bssid = 1;
+ 
+ 	/* fill bssid_list[0] with 0xff, otherwise bssid and RA will be
+@@ -2149,6 +2155,8 @@ ath11k_wmi_copy_scan_event_cntrl_flags(s
+ 	/* for adaptive scan mode using 3 bits (21 - 23 bits) */
+ 	WMI_SCAN_SET_DWELL_MODE(cmd->scan_ctrl_flags,
+ 				param->adaptive_dwell_time_mode);
++
++	cmd->scan_ctrl_flags_ext = param->scan_ctrl_flags_ext;
+ }
+ 
+ int ath11k_wmi_send_scan_start_cmd(struct ath11k *ar,
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -2093,6 +2093,7 @@ enum wmi_tlv_service {
+ 	WMI_TLV_SERVICE_EXT2_MSG = 220,
+ 	WMI_TLV_SERVICE_PEER_POWER_SAVE_DURATION_SUPPORT = 246,
+ 	WMI_TLV_SERVICE_SRG_SRP_SPATIAL_REUSE_SUPPORT = 249,
++	WMI_TLV_SERVICE_PASSIVE_SCAN_START_TIME_ENHANCE = 263,
+ 
+ 	/* The second 128 bits */
+ 	WMI_MAX_EXT_SERVICE = 256,
+@@ -3223,6 +3224,7 @@ struct  wmi_start_scan_cmd {
+ 
+ #define WMI_SCAN_DWELL_MODE_MASK 0x00E00000
+ #define WMI_SCAN_DWELL_MODE_SHIFT        21
++#define WMI_SCAN_FLAG_EXT_PASSIVE_SCAN_START_TIME_ENHANCE   0x00000800
+ 
+ enum {
+ 	WMI_SCAN_DWELL_MODE_DEFAULT      = 0,
+@@ -3270,6 +3272,7 @@ struct scan_req_params {
+ 		};
+ 		u32 scan_events;
+ 	};
++	u32 scan_ctrl_flags_ext;
+ 	u32 dwell_time_active;
+ 	u32 dwell_time_active_2g;
+ 	u32 dwell_time_passive;
diff --git a/package/kernel/mac80211/patches/ath11k/0034-wifi-ath11k-fix-return-value-check-in-ath11k_ahb_pro.patch b/package/kernel/mac80211/patches/ath11k/0034-wifi-ath11k-fix-return-value-check-in-ath11k_ahb_pro.patch
new file mode 100644
index 00000000000000..59132913bd0f9f
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0034-wifi-ath11k-fix-return-value-check-in-ath11k_ahb_pro.patch
@@ -0,0 +1,27 @@
+From 342fcde9d91460f01f65707e16368a1571271a3a Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Fri, 17 Feb 2023 11:00:31 +0800
+Subject: [PATCH] wifi: ath11k: fix return value check in ath11k_ahb_probe()
+
+ioremap() returns NULL pointer not PTR_ERR() when it fails,
+so replace the IS_ERR() check with NULL pointer check.
+
+Fixes: b42b3678c91f ("wifi: ath11k: remap ce register space for IPQ5018")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230217030031.4021289-1-yangyingliang@huawei.com
+---
+ drivers/net/wireless/ath/ath11k/ahb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -1174,7 +1174,7 @@ static int ath11k_ahb_probe(struct platf
+ 		 * to a new space for accessing them.
+ 		 */
+ 		ab->mem_ce = ioremap(ce_remap->base, ce_remap->size);
+-		if (IS_ERR(ab->mem_ce)) {
++		if (!ab->mem_ce) {
+ 			dev_err(&pdev->dev, "ce ioremap error\n");
+ 			ret = -ENOMEM;
+ 			goto err_core_free;
diff --git a/package/kernel/mac80211/patches/ath11k/0035-wifi-ath11k-Use-platform_get_irq-to-get-the-interrup.patch b/package/kernel/mac80211/patches/ath11k/0035-wifi-ath11k-Use-platform_get_irq-to-get-the-interrup.patch
new file mode 100644
index 00000000000000..93a9da8fc2e5da
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0035-wifi-ath11k-Use-platform_get_irq-to-get-the-interrup.patch
@@ -0,0 +1,50 @@
+From f117276638b7600b981b3fe28550823cfbe1ef23 Mon Sep 17 00:00:00 2001
+From: Douglas Anderson <dianders@chromium.org>
+Date: Wed, 1 Feb 2023 08:54:42 -0800
+Subject: [PATCH] wifi: ath11k: Use platform_get_irq() to get the interrupt
+
+As of commit a1a2b7125e10 ("of/platform: Drop static setup of IRQ
+resource from DT core"), we need to use platform_get_irq() instead of
+platform_get_resource() to get our IRQs because
+platform_get_resource() simply won't get them anymore.
+
+This was already fixed in several other Atheros WiFi drivers,
+apparently in response to Zeal Robot reports. An example of another
+fix is commit 9503a1fc123d ("ath9k: Use platform_get_irq() to get the
+interrupt"). ath11k seems to have been missed in this effort, though.
+
+Without this change, WiFi wasn't coming up on my Qualcomm sc7280-based
+hardware. Specifically, "platform_get_resource(pdev, IORESOURCE_IRQ,
+i)" was failing even for i=0.
+
+Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-00887-QCAMSLSWPLZ-1
+
+Fixes: a1a2b7125e10 ("of/platform: Drop static setup of IRQ resource from DT core")
+Fixes: 00402f49d26f ("ath11k: Add support for WCN6750 device")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Tested-by: Jun Yu <junyuu@chromium.org>
+Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230201084131.v2.1.I69cf3d56c97098287fe3a70084ee515098390b70@changeid
+---
+ drivers/net/wireless/ath/ath11k/ahb.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -874,11 +874,11 @@ static int ath11k_ahb_setup_msi_resource
+ 	ab->pci.msi.ep_base_data = int_prop + 32;
+ 
+ 	for (i = 0; i < ab->pci.msi.config->total_vectors; i++) {
+-		res = platform_get_resource(pdev, IORESOURCE_IRQ, i);
+-		if (!res)
+-			return -ENODEV;
++		ret = platform_get_irq(pdev, i);
++		if (ret < 0)
++			return ret;
+ 
+-		ab->pci.msi.irqs[i] = res->start;
++		ab->pci.msi.irqs[i] = ret;
+ 	}
+ 
+ 	set_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, &ab->dev_flags);
diff --git a/package/kernel/mac80211/patches/ath11k/0036-wifi-ath11k-fix-SAC-bug-on-peer-addition-with-sta-ba.patch b/package/kernel/mac80211/patches/ath11k/0036-wifi-ath11k-fix-SAC-bug-on-peer-addition-with-sta-ba.patch
new file mode 100644
index 00000000000000..b37f070ba64432
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0036-wifi-ath11k-fix-SAC-bug-on-peer-addition-with-sta-ba.patch
@@ -0,0 +1,53 @@
+From 60b7d62ba8cdbd073997bff0f1cdae8d844002c0 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 9 Feb 2023 23:26:22 +0100
+Subject: [PATCH] wifi: ath11k: fix SAC bug on peer addition with sta band
+ migration
+
+Fix sleep in atomic context warning detected by Smatch static checker
+analyzer.
+
+Following the locking pattern for peer_rhash_add lock tbl_mtx_lock mutex
+always even if sta is not transitioning to another band.
+This is peer_add function and a more secure locking should not cause
+performance regression.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1
+
+Fixes: d673cb6fe6c0 ("wifi: ath11k: fix peer addition/deletion error on sta band migration")
+Reported-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230209222622.1751-1-ansuelsmth@gmail.com
+---
+ drivers/net/wireless/ath/ath11k/peer.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/peer.c
++++ b/drivers/net/wireless/ath/ath11k/peer.c
+@@ -382,22 +382,23 @@ int ath11k_peer_create(struct ath11k *ar
+ 		return -ENOBUFS;
+ 	}
+ 
++	mutex_lock(&ar->ab->tbl_mtx_lock);
+ 	spin_lock_bh(&ar->ab->base_lock);
+ 	peer = ath11k_peer_find_by_addr(ar->ab, param->peer_addr);
+ 	if (peer) {
+ 		if (peer->vdev_id == param->vdev_id) {
+ 			spin_unlock_bh(&ar->ab->base_lock);
++			mutex_unlock(&ar->ab->tbl_mtx_lock);
+ 			return -EINVAL;
+ 		}
+ 
+ 		/* Assume sta is transitioning to another band.
+ 		 * Remove here the peer from rhash.
+ 		 */
+-		mutex_lock(&ar->ab->tbl_mtx_lock);
+ 		ath11k_peer_rhash_delete(ar->ab, peer);
+-		mutex_unlock(&ar->ab->tbl_mtx_lock);
+ 	}
+ 	spin_unlock_bh(&ar->ab->base_lock);
++	mutex_unlock(&ar->ab->tbl_mtx_lock);
+ 
+ 	ret = ath11k_wmi_send_peer_create_cmd(ar, param);
+ 	if (ret) {
diff --git a/package/kernel/mac80211/patches/ath11k/0037-wifi-ath11k-allow-system-suspend-to-survive-ath11k.patch b/package/kernel/mac80211/patches/ath11k/0037-wifi-ath11k-allow-system-suspend-to-survive-ath11k.patch
new file mode 100644
index 00000000000000..fa680954e6fae3
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0037-wifi-ath11k-allow-system-suspend-to-survive-ath11k.patch
@@ -0,0 +1,43 @@
+From 7c15430822e71e90203d87e6d0cfe83fa058b0dc Mon Sep 17 00:00:00 2001
+From: Len Brown <len.brown@intel.com>
+Date: Wed, 1 Feb 2023 12:32:01 -0600
+Subject: [PATCH] wifi: ath11k: allow system suspend to survive ath11k
+
+When ath11k runs into internal errors upon suspend,
+it returns an error code to pci_pm_suspend, which
+aborts the entire system suspend.
+
+The driver should not abort system suspend, but should
+keep its internal errors to itself, and allow the system
+to suspend.  Otherwise, a user can suspend a laptop
+by closing the lid and sealing it into a case, assuming
+that is will suspend, rather than heating up and draining
+the battery when in transit.
+
+In practice, the ath11k device seems to have plenty of transient
+errors, and subsequent suspend cycles after this failure
+often succeed.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=216968
+
+Fixes: d1b0c33850d29 ("ath11k: implement suspend for QCA6390 PCI devices")
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230201183201.14431-1-len.brown@intel.com
+---
+ drivers/net/wireless/ath/ath11k/pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/pci.c
++++ b/drivers/net/wireless/ath/ath11k/pci.c
+@@ -998,7 +998,7 @@ static __maybe_unused int ath11k_pci_pm_
+ 	if (ret)
+ 		ath11k_warn(ab, "failed to resume core: %d\n", ret);
+ 
+-	return ret;
++	return 0;
+ }
+ 
+ static SIMPLE_DEV_PM_OPS(ath11k_pci_pm_ops,
diff --git a/package/kernel/mac80211/patches/ath11k/0038-wifi-ath11k-modify-accessor-macros-to-match-index-si.patch b/package/kernel/mac80211/patches/ath11k/0038-wifi-ath11k-modify-accessor-macros-to-match-index-si.patch
new file mode 100644
index 00000000000000..42bf170a03de9d
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0038-wifi-ath11k-modify-accessor-macros-to-match-index-si.patch
@@ -0,0 +1,61 @@
+From a96f10422e74cde27c100b321b127ec32ae75747 Mon Sep 17 00:00:00 2001
+From: Muna Sinada <quic_msinada@quicinc.com>
+Date: Fri, 24 Feb 2023 12:28:03 +0200
+Subject: [PATCH] wifi: ath11k: modify accessor macros to match index size
+
+HE PHY is only 11 bytes, therefore it should be using byte indexes
+instead of dword. Change corresponding macros to reflect this.
+
+Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/1666128501-12364-2-git-send-email-quic_msinada@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/wmi.h | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -2859,30 +2859,32 @@ struct rx_reorder_queue_remove_params {
+ #define WMI_VDEV_PARAM_TXBF_SU_TX_BFER BIT(2)
+ #define WMI_VDEV_PARAM_TXBF_MU_TX_BFER BIT(3)
+ 
+-#define HECAP_PHYDWORD_0	0
+-#define HECAP_PHYDWORD_1	1
+-#define HECAP_PHYDWORD_2	2
++#define HE_PHYCAP_BYTE_0	0
++#define HE_PHYCAP_BYTE_1	1
++#define HE_PHYCAP_BYTE_2	2
++#define HE_PHYCAP_BYTE_3	3
++#define HE_PHYCAP_BYTE_4	4
+ 
+-#define HECAP_PHY_SU_BFER		BIT(31)
++#define HECAP_PHY_SU_BFER		BIT(7)
+ #define HECAP_PHY_SU_BFEE		BIT(0)
+ #define HECAP_PHY_MU_BFER		BIT(1)
+-#define HECAP_PHY_UL_MUMIMO		BIT(22)
+-#define HECAP_PHY_UL_MUOFDMA		BIT(23)
++#define HECAP_PHY_UL_MUMIMO		BIT(6)
++#define HECAP_PHY_UL_MUOFDMA		BIT(7)
+ 
+ #define HECAP_PHY_SUBFMR_GET(hecap_phy) \
+-	FIELD_GET(HECAP_PHY_SU_BFER, hecap_phy[HECAP_PHYDWORD_0])
++	FIELD_GET(HECAP_PHY_SU_BFER, hecap_phy[HE_PHYCAP_BYTE_3])
+ 
+ #define HECAP_PHY_SUBFME_GET(hecap_phy) \
+-	FIELD_GET(HECAP_PHY_SU_BFEE, hecap_phy[HECAP_PHYDWORD_1])
++	FIELD_GET(HECAP_PHY_SU_BFEE, hecap_phy[HE_PHYCAP_BYTE_4])
+ 
+ #define HECAP_PHY_MUBFMR_GET(hecap_phy) \
+-	FIELD_GET(HECAP_PHY_MU_BFER, hecap_phy[HECAP_PHYDWORD_1])
++	FIELD_GET(HECAP_PHY_MU_BFER, hecap_phy[HE_PHYCAP_BYTE_4])
+ 
+ #define HECAP_PHY_ULMUMIMO_GET(hecap_phy) \
+-	FIELD_GET(HECAP_PHY_UL_MUMIMO, hecap_phy[HECAP_PHYDWORD_0])
++	FIELD_GET(HECAP_PHY_UL_MUMIMO, hecap_phy[HE_PHYCAP_BYTE_2])
+ 
+ #define HECAP_PHY_ULOFDMA_GET(hecap_phy) \
+-	FIELD_GET(HECAP_PHY_UL_MUOFDMA, hecap_phy[HECAP_PHYDWORD_0])
++	FIELD_GET(HECAP_PHY_UL_MUOFDMA, hecap_phy[HE_PHYCAP_BYTE_2])
+ 
+ #define HE_MODE_SU_TX_BFEE	BIT(0)
+ #define HE_MODE_SU_TX_BFER	BIT(1)
diff --git a/package/kernel/mac80211/patches/ath11k/0039-wifi-ath11k-push-MU-MIMO-params-from-hostapd-to-hard.patch b/package/kernel/mac80211/patches/ath11k/0039-wifi-ath11k-push-MU-MIMO-params-from-hostapd-to-hard.patch
new file mode 100644
index 00000000000000..298ce1a612b6a1
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0039-wifi-ath11k-push-MU-MIMO-params-from-hostapd-to-hard.patch
@@ -0,0 +1,300 @@
+From 38dfe775d0abf511341f37c1cb77b919a3ad410b Mon Sep 17 00:00:00 2001
+From: Muna Sinada <quic_msinada@quicinc.com>
+Date: Fri, 24 Feb 2023 12:28:04 +0200
+Subject: [PATCH] wifi: ath11k: push MU-MIMO params from hostapd to hardware
+
+In the previous behaviour only HE IE in management frames are changed
+regarding MU-MIMO configurations and not in hardware. Adding push of
+MU-MIMO configurations to the hardware as well.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-00356-QCAHKSWPL_SILICONZ-1
+
+Co-developed-by: Anilkumar Kolli <quic_akolli@quicinc.com>
+Signed-off-by: Anilkumar Kolli <quic_akolli@quicinc.com>
+Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/1666128501-12364-3-git-send-email-quic_msinada@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 200 ++++++++++++++++----------
+ drivers/net/wireless/ath/ath11k/wmi.h |   3 +
+ 2 files changed, 130 insertions(+), 73 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -2699,6 +2699,117 @@ static int ath11k_setup_peer_smps(struct
+ 					 ath11k_smps_map[smps]);
+ }
+ 
++static bool ath11k_mac_set_he_txbf_conf(struct ath11k_vif *arvif)
++{
++	struct ath11k *ar = arvif->ar;
++	u32 param, value;
++	int ret;
++
++	if (!arvif->vif->bss_conf.he_support)
++		return true;
++
++	param = WMI_VDEV_PARAM_SET_HEMU_MODE;
++	value = 0;
++	if (arvif->vif->bss_conf.he_su_beamformer) {
++		value |= FIELD_PREP(HE_MODE_SU_TX_BFER, HE_SU_BFER_ENABLE);
++		if (arvif->vif->bss_conf.he_mu_beamformer &&
++		    arvif->vdev_type == WMI_VDEV_TYPE_AP)
++			value |= FIELD_PREP(HE_MODE_MU_TX_BFER, HE_MU_BFER_ENABLE);
++	}
++
++	if (arvif->vif->type != NL80211_IFTYPE_MESH_POINT) {
++		value |= FIELD_PREP(HE_MODE_DL_OFDMA, HE_DL_MUOFDMA_ENABLE) |
++			 FIELD_PREP(HE_MODE_UL_OFDMA, HE_UL_MUOFDMA_ENABLE);
++
++		if (arvif->vif->bss_conf.he_full_ul_mumimo)
++			value |= FIELD_PREP(HE_MODE_UL_MUMIMO, HE_UL_MUMIMO_ENABLE);
++
++		if (arvif->vif->bss_conf.he_su_beamformee)
++			value |= FIELD_PREP(HE_MODE_SU_TX_BFEE, HE_SU_BFEE_ENABLE);
++	}
++
++	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id, param, value);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to set vdev %d HE MU mode: %d\n",
++			    arvif->vdev_id, ret);
++		return false;
++	}
++
++	param = WMI_VDEV_PARAM_SET_HE_SOUNDING_MODE;
++	value =	FIELD_PREP(HE_VHT_SOUNDING_MODE, HE_VHT_SOUNDING_MODE_ENABLE) |
++		FIELD_PREP(HE_TRIG_NONTRIG_SOUNDING_MODE,
++			   HE_TRIG_NONTRIG_SOUNDING_MODE_ENABLE);
++	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
++					    param, value);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to set vdev %d sounding mode: %d\n",
++			    arvif->vdev_id, ret);
++		return false;
++	}
++	return true;
++}
++
++static bool ath11k_mac_vif_recalc_sta_he_txbf(struct ath11k *ar,
++					      struct ieee80211_vif *vif,
++					      struct ieee80211_sta_he_cap *he_cap)
++{
++	struct ath11k_vif *arvif = (void *)vif->drv_priv;
++	struct ieee80211_he_cap_elem he_cap_elem = {0};
++	struct ieee80211_sta_he_cap *cap_band = NULL;
++	struct cfg80211_chan_def def;
++	u32 param = WMI_VDEV_PARAM_SET_HEMU_MODE;
++	u32 hemode = 0;
++	int ret;
++
++	if (!vif->bss_conf.he_support)
++		return true;
++
++	if (vif->type != NL80211_IFTYPE_STATION)
++		return false;
++
++	if (WARN_ON(ath11k_mac_vif_chan(vif, &def)))
++		return false;
++
++	if (def.chan->band == NL80211_BAND_2GHZ)
++		cap_band = &ar->mac.iftype[NL80211_BAND_2GHZ][vif->type].he_cap;
++	else
++		cap_band = &ar->mac.iftype[NL80211_BAND_5GHZ][vif->type].he_cap;
++
++	memcpy(&he_cap_elem, &cap_band->he_cap_elem, sizeof(he_cap_elem));
++
++	if (HECAP_PHY_SUBFME_GET(he_cap_elem.phy_cap_info)) {
++		if (HECAP_PHY_SUBFMR_GET(he_cap->he_cap_elem.phy_cap_info))
++			hemode |= FIELD_PREP(HE_MODE_SU_TX_BFEE, HE_SU_BFEE_ENABLE);
++		if (HECAP_PHY_MUBFMR_GET(he_cap->he_cap_elem.phy_cap_info))
++			hemode |= FIELD_PREP(HE_MODE_MU_TX_BFEE, HE_MU_BFEE_ENABLE);
++	}
++
++	if (vif->type != NL80211_IFTYPE_MESH_POINT) {
++		hemode |= FIELD_PREP(HE_MODE_DL_OFDMA, HE_DL_MUOFDMA_ENABLE) |
++			  FIELD_PREP(HE_MODE_UL_OFDMA, HE_UL_MUOFDMA_ENABLE);
++
++		if (HECAP_PHY_ULMUMIMO_GET(he_cap_elem.phy_cap_info))
++			if (HECAP_PHY_ULMUMIMO_GET(he_cap->he_cap_elem.phy_cap_info))
++				hemode |= FIELD_PREP(HE_MODE_UL_MUMIMO,
++						     HE_UL_MUMIMO_ENABLE);
++
++		if (FIELD_GET(HE_MODE_MU_TX_BFEE, hemode))
++			hemode |= FIELD_PREP(HE_MODE_SU_TX_BFEE, HE_SU_BFEE_ENABLE);
++
++		if (FIELD_GET(HE_MODE_MU_TX_BFER, hemode))
++			hemode |= FIELD_PREP(HE_MODE_SU_TX_BFER, HE_SU_BFER_ENABLE);
++	}
++
++	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id, param, hemode);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to submit vdev param txbf 0x%x: %d\n",
++			    hemode, ret);
++		return false;
++	}
++
++	return true;
++}
++
+ static void ath11k_bss_assoc(struct ieee80211_hw *hw,
+ 			     struct ieee80211_vif *vif,
+ 			     struct ieee80211_bss_conf *bss_conf)
+@@ -2709,6 +2820,7 @@ static void ath11k_bss_assoc(struct ieee
+ 	struct ieee80211_sta *ap_sta;
+ 	struct ath11k_peer *peer;
+ 	bool is_auth = false;
++	struct ieee80211_sta_he_cap  he_cap;
+ 	int ret;
+ 
+ 	lockdep_assert_held(&ar->conf_mutex);
+@@ -2726,6 +2838,9 @@ static void ath11k_bss_assoc(struct ieee
+ 		return;
+ 	}
+ 
++	/* he_cap here is updated at assoc success for sta mode only */
++	he_cap  = ap_sta->deflink.he_cap;
++
+ 	ath11k_peer_assoc_prepare(ar, vif, ap_sta, &peer_arg, false);
+ 
+ 	rcu_read_unlock();
+@@ -2753,6 +2868,12 @@ static void ath11k_bss_assoc(struct ieee
+ 		return;
+ 	}
+ 
++	if (!ath11k_mac_vif_recalc_sta_he_txbf(ar, vif, &he_cap)) {
++		ath11k_warn(ar->ab, "failed to recalc he txbf for vdev %i on bss %pM\n",
++			    arvif->vdev_id, bss_conf->bssid);
++		return;
++	}
++
+ 	WARN_ON(arvif->is_up);
+ 
+ 	arvif->aid = vif->cfg.aid;
+@@ -3202,6 +3323,8 @@ static void ath11k_mac_op_bss_info_chang
+ 		ether_addr_copy(arvif->bssid, info->bssid);
+ 
+ 	if (changed & BSS_CHANGED_BEACON_ENABLED) {
++		if (info->enable_beacon)
++			ath11k_mac_set_he_txbf_conf(arvif);
+ 		ath11k_control_beaconing(arvif, info);
+ 
+ 		if (arvif->is_up && vif->bss_conf.he_support &&
+@@ -5392,6 +5515,10 @@ static int ath11k_mac_copy_he_cap(struct
+ 
+ 		he_cap_elem->mac_cap_info[1] &=
+ 			IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_MASK;
++		he_cap_elem->phy_cap_info[0] &=
++			~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
++		he_cap_elem->phy_cap_info[0] &=
++			~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G;
+ 
+ 		he_cap_elem->phy_cap_info[5] &=
+ 			~IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK;
+@@ -6026,69 +6153,6 @@ ath11k_mac_setup_vdev_create_params(stru
+ 	}
+ }
+ 
+-static u32
+-ath11k_mac_prepare_he_mode(struct ath11k_pdev *pdev, u32 viftype)
+-{
+-	struct ath11k_pdev_cap *pdev_cap = &pdev->cap;
+-	struct ath11k_band_cap *cap_band = NULL;
+-	u32 *hecap_phy_ptr = NULL;
+-	u32 hemode = 0;
+-
+-	if (pdev->cap.supported_bands & WMI_HOST_WLAN_2G_CAP)
+-		cap_band = &pdev_cap->band[NL80211_BAND_2GHZ];
+-	else
+-		cap_band = &pdev_cap->band[NL80211_BAND_5GHZ];
+-
+-	hecap_phy_ptr = &cap_band->he_cap_phy_info[0];
+-
+-	hemode = FIELD_PREP(HE_MODE_SU_TX_BFEE, HE_SU_BFEE_ENABLE) |
+-		 FIELD_PREP(HE_MODE_SU_TX_BFER, HECAP_PHY_SUBFMR_GET(hecap_phy_ptr)) |
+-		 FIELD_PREP(HE_MODE_UL_MUMIMO, HECAP_PHY_ULMUMIMO_GET(hecap_phy_ptr));
+-
+-	/* TODO WDS and other modes */
+-	if (viftype == NL80211_IFTYPE_AP) {
+-		hemode |= FIELD_PREP(HE_MODE_MU_TX_BFER,
+-			  HECAP_PHY_MUBFMR_GET(hecap_phy_ptr)) |
+-			  FIELD_PREP(HE_MODE_DL_OFDMA, HE_DL_MUOFDMA_ENABLE) |
+-			  FIELD_PREP(HE_MODE_UL_OFDMA, HE_UL_MUOFDMA_ENABLE);
+-	} else {
+-		hemode |= FIELD_PREP(HE_MODE_MU_TX_BFEE, HE_MU_BFEE_ENABLE);
+-	}
+-
+-	return hemode;
+-}
+-
+-static int ath11k_set_he_mu_sounding_mode(struct ath11k *ar,
+-					  struct ath11k_vif *arvif)
+-{
+-	u32 param_id, param_value;
+-	struct ath11k_base *ab = ar->ab;
+-	int ret = 0;
+-
+-	param_id = WMI_VDEV_PARAM_SET_HEMU_MODE;
+-	param_value = ath11k_mac_prepare_he_mode(ar->pdev, arvif->vif->type);
+-	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
+-					    param_id, param_value);
+-	if (ret) {
+-		ath11k_warn(ab, "failed to set vdev %d HE MU mode: %d param_value %x\n",
+-			    arvif->vdev_id, ret, param_value);
+-		return ret;
+-	}
+-	param_id = WMI_VDEV_PARAM_SET_HE_SOUNDING_MODE;
+-	param_value =
+-		FIELD_PREP(HE_VHT_SOUNDING_MODE, HE_VHT_SOUNDING_MODE_ENABLE) |
+-		FIELD_PREP(HE_TRIG_NONTRIG_SOUNDING_MODE,
+-			   HE_TRIG_NONTRIG_SOUNDING_MODE_ENABLE);
+-	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
+-					    param_id, param_value);
+-	if (ret) {
+-		ath11k_warn(ab, "failed to set vdev %d HE MU mode: %d\n",
+-			    arvif->vdev_id, ret);
+-		return ret;
+-	}
+-	return ret;
+-}
+-
+ static void ath11k_mac_op_update_vif_offload(struct ieee80211_hw *hw,
+ 					     struct ieee80211_vif *vif)
+ {
+@@ -6757,7 +6821,6 @@ ath11k_mac_vdev_start_restart(struct ath
+ 	struct ath11k_base *ab = ar->ab;
+ 	struct wmi_vdev_start_req_arg arg = {};
+ 	const struct cfg80211_chan_def *chandef = &ctx->def;
+-	int he_support = arvif->vif->bss_conf.he_support;
+ 	int ret = 0;
+ 
+ 	lockdep_assert_held(&ar->conf_mutex);
+@@ -6798,15 +6861,6 @@ ath11k_mac_vdev_start_restart(struct ath
+ 		spin_lock_bh(&ab->base_lock);
+ 		arg.regdomain = ar->ab->dfs_region;
+ 		spin_unlock_bh(&ab->base_lock);
+-
+-		if (he_support) {
+-			ret = ath11k_set_he_mu_sounding_mode(ar, arvif);
+-			if (ret) {
+-				ath11k_warn(ar->ab, "failed to set he mode vdev %i\n",
+-					    arg.vdev_id);
+-				return ret;
+-			}
+-		}
+ 	}
+ 
+ 	arg.channel.passive |= !!(chandef->chan->flags & IEEE80211_CHAN_NO_IR);
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -2897,8 +2897,11 @@ struct rx_reorder_queue_remove_params {
+ #define HE_DL_MUOFDMA_ENABLE	1
+ #define HE_UL_MUOFDMA_ENABLE	1
+ #define HE_DL_MUMIMO_ENABLE	1
++#define HE_UL_MUMIMO_ENABLE	1
+ #define HE_MU_BFEE_ENABLE	1
+ #define HE_SU_BFEE_ENABLE	1
++#define HE_MU_BFER_ENABLE	1
++#define HE_SU_BFER_ENABLE	1
+ 
+ #define HE_VHT_SOUNDING_MODE_ENABLE		1
+ #define HE_SU_MU_SOUNDING_MODE_ENABLE		1
diff --git a/package/kernel/mac80211/patches/ath11k/0040-wifi-ath11k-move-HE-MCS-mapper-to-a-separate-functio.patch b/package/kernel/mac80211/patches/ath11k/0040-wifi-ath11k-move-HE-MCS-mapper-to-a-separate-functio.patch
new file mode 100644
index 00000000000000..6bc9880e109fba
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0040-wifi-ath11k-move-HE-MCS-mapper-to-a-separate-functio.patch
@@ -0,0 +1,67 @@
+From 8077c1bbbc28e527fb29143c46f32c6a9d6cadf0 Mon Sep 17 00:00:00 2001
+From: Muna Sinada <quic_msinada@quicinc.com>
+Date: Fri, 24 Feb 2023 12:28:04 +0200
+Subject: [PATCH] wifi: ath11k: move HE MCS mapper to a separate function
+
+Move HE MCS mapper to a separate function and call new function
+in ath11k_mac_copy_he_cap().
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-00356-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/1666128501-12364-4-git-send-email-quic_msinada@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 34 +++++++++++++++++----------
+ 1 file changed, 22 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -5483,6 +5483,27 @@ static __le16 ath11k_mac_setup_he_6ghz_c
+ 	return cpu_to_le16(bcap->he_6ghz_capa);
+ }
+ 
++static void ath11k_mac_set_hemcsmap(struct ath11k *ar,
++				    struct ath11k_pdev_cap *cap,
++				    struct ieee80211_sta_he_cap *he_cap,
++				    int band)
++{
++	struct ath11k_band_cap *band_cap = &cap->band[band];
++
++	he_cap->he_mcs_nss_supp.rx_mcs_80 =
++		cpu_to_le16(band_cap->he_mcs & 0xffff);
++	he_cap->he_mcs_nss_supp.tx_mcs_80 =
++		cpu_to_le16(band_cap->he_mcs & 0xffff);
++	he_cap->he_mcs_nss_supp.rx_mcs_160 =
++		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
++	he_cap->he_mcs_nss_supp.tx_mcs_160 =
++		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
++	he_cap->he_mcs_nss_supp.rx_mcs_80p80 =
++		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
++	he_cap->he_mcs_nss_supp.tx_mcs_80p80 =
++		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
++}
++
+ static int ath11k_mac_copy_he_cap(struct ath11k *ar,
+ 				  struct ath11k_pdev_cap *cap,
+ 				  struct ieee80211_sband_iftype_data *data,
+@@ -5544,18 +5565,7 @@ static int ath11k_mac_copy_he_cap(struct
+ 			break;
+ 		}
+ 
+-		he_cap->he_mcs_nss_supp.rx_mcs_80 =
+-			cpu_to_le16(band_cap->he_mcs & 0xffff);
+-		he_cap->he_mcs_nss_supp.tx_mcs_80 =
+-			cpu_to_le16(band_cap->he_mcs & 0xffff);
+-		he_cap->he_mcs_nss_supp.rx_mcs_160 =
+-			cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
+-		he_cap->he_mcs_nss_supp.tx_mcs_160 =
+-			cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
+-		he_cap->he_mcs_nss_supp.rx_mcs_80p80 =
+-			cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
+-		he_cap->he_mcs_nss_supp.tx_mcs_80p80 =
+-			cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
++		ath11k_mac_set_hemcsmap(ar, cap, he_cap, band);
+ 
+ 		memset(he_cap->ppe_thres, 0, sizeof(he_cap->ppe_thres));
+ 		if (he_cap_elem->phy_cap_info[6] &
diff --git a/package/kernel/mac80211/patches/ath11k/0041-wifi-ath11k-generate-rx-and-tx-mcs-maps-for-supporte.patch b/package/kernel/mac80211/patches/ath11k/0041-wifi-ath11k-generate-rx-and-tx-mcs-maps-for-supporte.patch
new file mode 100644
index 00000000000000..5cb7801b294e38
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0041-wifi-ath11k-generate-rx-and-tx-mcs-maps-for-supporte.patch
@@ -0,0 +1,64 @@
+From ebf82988f844dd98e6b007cffcc5e95986056995 Mon Sep 17 00:00:00 2001
+From: Muna Sinada <quic_msinada@quicinc.com>
+Date: Fri, 24 Feb 2023 12:28:04 +0200
+Subject: [PATCH] wifi: ath11k: generate rx and tx mcs maps for supported HE
+ mcs
+
+Generate rx and tx mcs maps in ath11k_mac_set_hemcsmap() and set them
+in supported mcs/nss for HE capabilities.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-00356-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/1666128501-12364-5-git-send-email-quic_msinada@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 30 ++++++++++++++++++++-------
+ 1 file changed, 23 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -5488,20 +5488,36 @@ static void ath11k_mac_set_hemcsmap(stru
+ 				    struct ieee80211_sta_he_cap *he_cap,
+ 				    int band)
+ {
+-	struct ath11k_band_cap *band_cap = &cap->band[band];
++	u16 txmcs_map, rxmcs_map;
++	u32 i;
+ 
++	rxmcs_map = 0;
++	txmcs_map = 0;
++	for (i = 0; i < 8; i++) {
++		if (i < ar->num_tx_chains &&
++		    (ar->cfg_tx_chainmask >> cap->tx_chain_mask_shift) & BIT(i))
++			txmcs_map |= IEEE80211_HE_MCS_SUPPORT_0_11 << (i * 2);
++		else
++			txmcs_map |= IEEE80211_HE_MCS_NOT_SUPPORTED << (i * 2);
++
++		if (i < ar->num_rx_chains &&
++		    (ar->cfg_rx_chainmask >> cap->tx_chain_mask_shift) & BIT(i))
++			rxmcs_map |= IEEE80211_HE_MCS_SUPPORT_0_11 << (i * 2);
++		else
++			rxmcs_map |= IEEE80211_HE_MCS_NOT_SUPPORTED << (i * 2);
++	}
+ 	he_cap->he_mcs_nss_supp.rx_mcs_80 =
+-		cpu_to_le16(band_cap->he_mcs & 0xffff);
++		cpu_to_le16(rxmcs_map & 0xffff);
+ 	he_cap->he_mcs_nss_supp.tx_mcs_80 =
+-		cpu_to_le16(band_cap->he_mcs & 0xffff);
++		cpu_to_le16(txmcs_map & 0xffff);
+ 	he_cap->he_mcs_nss_supp.rx_mcs_160 =
+-		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
++		cpu_to_le16(rxmcs_map & 0xffff);
+ 	he_cap->he_mcs_nss_supp.tx_mcs_160 =
+-		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
++		cpu_to_le16(txmcs_map & 0xffff);
+ 	he_cap->he_mcs_nss_supp.rx_mcs_80p80 =
+-		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
++		cpu_to_le16(rxmcs_map & 0xffff);
+ 	he_cap->he_mcs_nss_supp.tx_mcs_80p80 =
+-		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
++		cpu_to_le16(txmcs_map & 0xffff);
+ }
+ 
+ static int ath11k_mac_copy_he_cap(struct ath11k *ar,
diff --git a/package/kernel/mac80211/patches/ath11k/0042-wifi-ath11k-Add-tx-ack-signal-support-for-management.patch b/package/kernel/mac80211/patches/ath11k/0042-wifi-ath11k-Add-tx-ack-signal-support-for-management.patch
new file mode 100644
index 00000000000000..8d41657311a6d7
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0042-wifi-ath11k-Add-tx-ack-signal-support-for-management.patch
@@ -0,0 +1,150 @@
+From 01c6c9fccbd51c1d9eab0f5794b0271b026178df Mon Sep 17 00:00:00 2001
+From: Abinaya Kalaiselvan <quic_akalaise@quicinc.com>
+Date: Mon, 19 Dec 2022 11:08:44 +0530
+Subject: [PATCH] wifi: ath11k: Add tx ack signal support for management
+ packets
+
+Add support to notify tx ack signal values for management
+packets to userspace through nl80211 interface.
+
+Advertise NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT flag
+to enable this feature and it will be used for data
+packets as well.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Abinaya Kalaiselvan <quic_akalaise@quicinc.com>
+Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221219053844.4084486-1-quic_mkenna@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/hw.c  |  1 +
+ drivers/net/wireless/ath/ath11k/mac.c |  5 +++++
+ drivers/net/wireless/ath/ath11k/wmi.c | 27 ++++++++++++++++-----------
+ drivers/net/wireless/ath/ath11k/wmi.h |  3 +++
+ 4 files changed, 25 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -201,6 +201,7 @@ static void ath11k_init_wmi_config_ipq80
+ 	config->twt_ap_pdev_count = ab->num_radios;
+ 	config->twt_ap_sta_count = 1000;
+ 	config->flag1 |= WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64;
++	config->flag1 |= WMI_RSRC_CFG_FLAG1_ACK_RSSI;
+ }
+ 
+ static int ath11k_hw_mac_id_to_pdev_id_ipq8074(struct ath11k_hw_params *hw,
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -9174,6 +9174,11 @@ static int __ath11k_mac_register(struct
+ 		goto err_free_if_combs;
+ 	}
+ 
++	if (test_bit(WMI_TLV_SERVICE_TX_DATA_MGMT_ACK_RSSI,
++		     ar->ab->wmi_ab.svc_map))
++		wiphy_ext_feature_set(ar->hw->wiphy,
++				      NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
++
+ 	ar->hw->queues = ATH11K_HW_MAX_QUEUES;
+ 	ar->hw->wiphy->tx_queue_len = ATH11K_QUEUE_LEN;
+ 	ar->hw->offchannel_tx_hw_queue = ATH11K_HW_MAX_QUEUES - 1;
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -5229,8 +5229,8 @@ static int ath11k_pull_mgmt_rx_params_tl
+ 	return 0;
+ }
+ 
+-static int wmi_process_mgmt_tx_comp(struct ath11k *ar, u32 desc_id,
+-				    u32 status)
++static int wmi_process_mgmt_tx_comp(struct ath11k *ar,
++				    struct wmi_mgmt_tx_compl_event *tx_compl_param)
+ {
+ 	struct sk_buff *msdu;
+ 	struct ieee80211_tx_info *info;
+@@ -5238,24 +5238,29 @@ static int wmi_process_mgmt_tx_comp(stru
+ 	int num_mgmt;
+ 
+ 	spin_lock_bh(&ar->txmgmt_idr_lock);
+-	msdu = idr_find(&ar->txmgmt_idr, desc_id);
++	msdu = idr_find(&ar->txmgmt_idr, tx_compl_param->desc_id);
+ 
+ 	if (!msdu) {
+ 		ath11k_warn(ar->ab, "received mgmt tx compl for invalid msdu_id: %d\n",
+-			    desc_id);
++			    tx_compl_param->desc_id);
+ 		spin_unlock_bh(&ar->txmgmt_idr_lock);
+ 		return -ENOENT;
+ 	}
+ 
+-	idr_remove(&ar->txmgmt_idr, desc_id);
++	idr_remove(&ar->txmgmt_idr, tx_compl_param->desc_id);
+ 	spin_unlock_bh(&ar->txmgmt_idr_lock);
+ 
+ 	skb_cb = ATH11K_SKB_CB(msdu);
+ 	dma_unmap_single(ar->ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
+ 
+ 	info = IEEE80211_SKB_CB(msdu);
+-	if ((!(info->flags & IEEE80211_TX_CTL_NO_ACK)) && !status)
++	if ((!(info->flags & IEEE80211_TX_CTL_NO_ACK)) &&
++	    !tx_compl_param->status) {
+ 		info->flags |= IEEE80211_TX_STAT_ACK;
++		if (test_bit(WMI_TLV_SERVICE_TX_DATA_MGMT_ACK_RSSI,
++			     ar->ab->wmi_ab.svc_map))
++			info->status.ack_signal = tx_compl_param->ack_rssi;
++	}
+ 
+ 	ieee80211_tx_status_irqsafe(ar->hw, msdu);
+ 
+@@ -5267,7 +5272,7 @@ static int wmi_process_mgmt_tx_comp(stru
+ 
+ 	ath11k_dbg(ar->ab, ATH11K_DBG_WMI,
+ 		   "wmi mgmt tx comp pending %d desc id %d\n",
+-		   num_mgmt, desc_id);
++		   num_mgmt, tx_compl_param->desc_id);
+ 
+ 	if (!num_mgmt)
+ 		wake_up(&ar->txmgmt_empty_waitq);
+@@ -5300,6 +5305,7 @@ static int ath11k_pull_mgmt_tx_compl_par
+ 	param->pdev_id = ev->pdev_id;
+ 	param->desc_id = ev->desc_id;
+ 	param->status = ev->status;
++	param->ack_rssi = ev->ack_rssi;
+ 
+ 	kfree(tb);
+ 	return 0;
+@@ -7070,13 +7076,12 @@ static void ath11k_mgmt_tx_compl_event(s
+ 		goto exit;
+ 	}
+ 
+-	wmi_process_mgmt_tx_comp(ar, tx_compl_param.desc_id,
+-				 tx_compl_param.status);
++	wmi_process_mgmt_tx_comp(ar, &tx_compl_param);
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_MGMT,
+-		   "mgmt tx compl ev pdev_id %d, desc_id %d, status %d",
++		   "mgmt tx compl ev pdev_id %d, desc_id %d, status %d ack_rssi %d",
+ 		   tx_compl_param.pdev_id, tx_compl_param.desc_id,
+-		   tx_compl_param.status);
++		   tx_compl_param.status, tx_compl_param.ack_rssi);
+ 
+ exit:
+ 	rcu_read_unlock();
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -2311,6 +2311,7 @@ struct wmi_init_cmd {
+ } __packed;
+ 
+ #define WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64 BIT(5)
++#define WMI_RSRC_CFG_FLAG1_ACK_RSSI BIT(18)
+ 
+ struct wmi_resource_config {
+ 	u32 tlv_header;
+@@ -4550,6 +4551,8 @@ struct wmi_mgmt_tx_compl_event {
+ 	u32 desc_id;
+ 	u32 status;
+ 	u32 pdev_id;
++	u32 ppdu_id;
++	u32 ack_rssi;
+ } __packed;
+ 
+ struct wmi_scan_event {
diff --git a/package/kernel/mac80211/patches/ath11k/0043-wifi-ath11k-use-proper-regulatory-reference-for-band.patch b/package/kernel/mac80211/patches/ath11k/0043-wifi-ath11k-use-proper-regulatory-reference-for-band.patch
new file mode 100644
index 00000000000000..5bc195528e4448
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0043-wifi-ath11k-use-proper-regulatory-reference-for-band.patch
@@ -0,0 +1,216 @@
+From 25e289e1f52e1f4fb1d07622c6a24f8d8a8e420d Mon Sep 17 00:00:00 2001
+From: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Date: Wed, 1 Mar 2023 16:20:58 +0200
+Subject: [PATCH] wifi: ath11k: use proper regulatory reference for bands
+
+Currently, during regulatory event, 2 GHz/5 GHz is referred
+to as 2G/5G including variable names. However, there is no
+such entity as 2G or 5G.
+
+Re-name such occurences to its proper name. No functional changes.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230110121024.14051-2-quic_adisi@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/reg.c | 20 ++++-----
+ drivers/net/wireless/ath/ath11k/wmi.c | 58 ++++++++++++++-------------
+ drivers/net/wireless/ath/ath11k/wmi.h | 28 ++++++-------
+ 3 files changed, 54 insertions(+), 52 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/reg.c
++++ b/drivers/net/wireless/ath/ath11k/reg.c
+@@ -619,7 +619,7 @@ ath11k_reg_build_regd(struct ath11k_base
+ 	u32 flags;
+ 	char alpha2[3];
+ 
+-	num_rules = reg_info->num_5g_reg_rules + reg_info->num_2g_reg_rules;
++	num_rules = reg_info->num_5ghz_reg_rules + reg_info->num_2ghz_reg_rules;
+ 
+ 	if (!num_rules)
+ 		goto ret;
+@@ -644,20 +644,20 @@ ath11k_reg_build_regd(struct ath11k_base
+ 		   alpha2, ath11k_reg_get_regdom_str(tmp_regd->dfs_region),
+ 		   reg_info->dfs_region, num_rules);
+ 	/* Update reg_rules[] below. Firmware is expected to
+-	 * send these rules in order(2G rules first and then 5G)
++	 * send these rules in order(2 GHz rules first and then 5 GHz)
+ 	 */
+ 	for (; i < num_rules; i++) {
+-		if (reg_info->num_2g_reg_rules &&
+-		    (i < reg_info->num_2g_reg_rules)) {
+-			reg_rule = reg_info->reg_rules_2g_ptr + i;
++		if (reg_info->num_2ghz_reg_rules &&
++		    (i < reg_info->num_2ghz_reg_rules)) {
++			reg_rule = reg_info->reg_rules_2ghz_ptr + i;
+ 			max_bw = min_t(u16, reg_rule->max_bw,
+-				       reg_info->max_bw_2g);
++				       reg_info->max_bw_2ghz);
+ 			flags = 0;
+-		} else if (reg_info->num_5g_reg_rules &&
+-			   (j < reg_info->num_5g_reg_rules)) {
+-			reg_rule = reg_info->reg_rules_5g_ptr + j++;
++		} else if (reg_info->num_5ghz_reg_rules &&
++			   (j < reg_info->num_5ghz_reg_rules)) {
++			reg_rule = reg_info->reg_rules_5ghz_ptr + j++;
+ 			max_bw = min_t(u16, reg_rule->max_bw,
+-				       reg_info->max_bw_5g);
++				       reg_info->max_bw_5ghz);
+ 
+ 			/* FW doesn't pass NL80211_RRF_AUTO_BW flag for
+ 			 * BW Auto correction, we can enable this by default
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -4959,7 +4959,7 @@ static int ath11k_pull_reg_chan_list_upd
+ 	const void **tb;
+ 	const struct wmi_reg_chan_list_cc_event *chan_list_event_hdr;
+ 	struct wmi_regulatory_rule_struct *wmi_reg_rule;
+-	u32 num_2g_reg_rules, num_5g_reg_rules;
++	u32 num_2ghz_reg_rules, num_5ghz_reg_rules;
+ 	int ret;
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_WMI, "processing regulatory channel list\n");
+@@ -4978,10 +4978,10 @@ static int ath11k_pull_reg_chan_list_upd
+ 		return -EPROTO;
+ 	}
+ 
+-	reg_info->num_2g_reg_rules = chan_list_event_hdr->num_2g_reg_rules;
+-	reg_info->num_5g_reg_rules = chan_list_event_hdr->num_5g_reg_rules;
++	reg_info->num_2ghz_reg_rules = chan_list_event_hdr->num_2ghz_reg_rules;
++	reg_info->num_5ghz_reg_rules = chan_list_event_hdr->num_5ghz_reg_rules;
+ 
+-	if (!(reg_info->num_2g_reg_rules + reg_info->num_5g_reg_rules)) {
++	if (!(reg_info->num_2ghz_reg_rules + reg_info->num_5ghz_reg_rules)) {
+ 		ath11k_warn(ab, "No regulatory rules available in the event info\n");
+ 		kfree(tb);
+ 		return -EINVAL;
+@@ -5008,46 +5008,48 @@ static int ath11k_pull_reg_chan_list_upd
+ 	else if (chan_list_event_hdr->status_code == WMI_REG_SET_CC_STATUS_FAIL)
+ 		reg_info->status_code = REG_SET_CC_STATUS_FAIL;
+ 
+-	reg_info->min_bw_2g = chan_list_event_hdr->min_bw_2g;
+-	reg_info->max_bw_2g = chan_list_event_hdr->max_bw_2g;
+-	reg_info->min_bw_5g = chan_list_event_hdr->min_bw_5g;
+-	reg_info->max_bw_5g = chan_list_event_hdr->max_bw_5g;
++	reg_info->min_bw_2ghz = chan_list_event_hdr->min_bw_2ghz;
++	reg_info->max_bw_2ghz = chan_list_event_hdr->max_bw_2ghz;
++	reg_info->min_bw_5ghz = chan_list_event_hdr->min_bw_5ghz;
++	reg_info->max_bw_5ghz = chan_list_event_hdr->max_bw_5ghz;
+ 
+-	num_2g_reg_rules = reg_info->num_2g_reg_rules;
+-	num_5g_reg_rules = reg_info->num_5g_reg_rules;
++	num_2ghz_reg_rules = reg_info->num_2ghz_reg_rules;
++	num_5ghz_reg_rules = reg_info->num_5ghz_reg_rules;
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_WMI,
+-		   "%s:cc %s dsf %d BW: min_2g %d max_2g %d min_5g %d max_5g %d",
++		   "%s:cc %s dsf %d BW: min_2ghz %d max_2ghz %d min_5ghz %d max_5ghz %d",
+ 		   __func__, reg_info->alpha2, reg_info->dfs_region,
+-		   reg_info->min_bw_2g, reg_info->max_bw_2g,
+-		   reg_info->min_bw_5g, reg_info->max_bw_5g);
++		   reg_info->min_bw_2ghz, reg_info->max_bw_2ghz,
++		   reg_info->min_bw_5ghz, reg_info->max_bw_5ghz);
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_WMI,
+-		   "%s: num_2g_reg_rules %d num_5g_reg_rules %d", __func__,
+-		   num_2g_reg_rules, num_5g_reg_rules);
++		   "%s: num_2ghz_reg_rules %d num_5ghz_reg_rules %d", __func__,
++		   num_2ghz_reg_rules, num_5ghz_reg_rules);
+ 
+ 	wmi_reg_rule =
+ 		(struct wmi_regulatory_rule_struct *)((u8 *)chan_list_event_hdr
+ 						+ sizeof(*chan_list_event_hdr)
+ 						+ sizeof(struct wmi_tlv));
+ 
+-	if (num_2g_reg_rules) {
+-		reg_info->reg_rules_2g_ptr = create_reg_rules_from_wmi(num_2g_reg_rules,
+-								       wmi_reg_rule);
+-		if (!reg_info->reg_rules_2g_ptr) {
++	if (num_2ghz_reg_rules) {
++		reg_info->reg_rules_2ghz_ptr =
++				create_reg_rules_from_wmi(num_2ghz_reg_rules,
++							  wmi_reg_rule);
++		if (!reg_info->reg_rules_2ghz_ptr) {
+ 			kfree(tb);
+-			ath11k_warn(ab, "Unable to Allocate memory for 2g rules\n");
++			ath11k_warn(ab, "Unable to Allocate memory for 2 GHz rules\n");
+ 			return -ENOMEM;
+ 		}
+ 	}
+ 
+-	if (num_5g_reg_rules) {
+-		wmi_reg_rule += num_2g_reg_rules;
+-		reg_info->reg_rules_5g_ptr = create_reg_rules_from_wmi(num_5g_reg_rules,
+-								       wmi_reg_rule);
+-		if (!reg_info->reg_rules_5g_ptr) {
++	if (num_5ghz_reg_rules) {
++		wmi_reg_rule += num_2ghz_reg_rules;
++		reg_info->reg_rules_5ghz_ptr =
++				create_reg_rules_from_wmi(num_5ghz_reg_rules,
++							  wmi_reg_rule);
++		if (!reg_info->reg_rules_5ghz_ptr) {
+ 			kfree(tb);
+-			ath11k_warn(ab, "Unable to Allocate memory for 5g rules\n");
++			ath11k_warn(ab, "Unable to Allocate memory for 5 GHz rules\n");
+ 			return -ENOMEM;
+ 		}
+ 	}
+@@ -6619,8 +6621,8 @@ fallback:
+ 	WARN_ON(1);
+ mem_free:
+ 	if (reg_info) {
+-		kfree(reg_info->reg_rules_2g_ptr);
+-		kfree(reg_info->reg_rules_5g_ptr);
++		kfree(reg_info->reg_rules_2ghz_ptr);
++		kfree(reg_info->reg_rules_5ghz_ptr);
+ 		kfree(reg_info);
+ 	}
+ 	return ret;
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -4129,14 +4129,14 @@ struct cur_regulatory_info {
+ 	u8 alpha2[REG_ALPHA2_LEN + 1];
+ 	u32 dfs_region;
+ 	u32 phybitmap;
+-	u32 min_bw_2g;
+-	u32 max_bw_2g;
+-	u32 min_bw_5g;
+-	u32 max_bw_5g;
+-	u32 num_2g_reg_rules;
+-	u32 num_5g_reg_rules;
+-	struct cur_reg_rule *reg_rules_2g_ptr;
+-	struct cur_reg_rule *reg_rules_5g_ptr;
++	u32 min_bw_2ghz;
++	u32 max_bw_2ghz;
++	u32 min_bw_5ghz;
++	u32 max_bw_5ghz;
++	u32 num_2ghz_reg_rules;
++	u32 num_5ghz_reg_rules;
++	struct cur_reg_rule *reg_rules_2ghz_ptr;
++	struct cur_reg_rule *reg_rules_5ghz_ptr;
+ };
+ 
+ struct wmi_reg_chan_list_cc_event {
+@@ -4148,12 +4148,12 @@ struct wmi_reg_chan_list_cc_event {
+ 	u32 domain_code;
+ 	u32 dfs_region;
+ 	u32 phybitmap;
+-	u32 min_bw_2g;
+-	u32 max_bw_2g;
+-	u32 min_bw_5g;
+-	u32 max_bw_5g;
+-	u32 num_2g_reg_rules;
+-	u32 num_5g_reg_rules;
++	u32 min_bw_2ghz;
++	u32 max_bw_2ghz;
++	u32 min_bw_5ghz;
++	u32 max_bw_5ghz;
++	u32 num_2ghz_reg_rules;
++	u32 num_5ghz_reg_rules;
+ } __packed;
+ 
+ struct wmi_regulatory_rule_struct {
diff --git a/package/kernel/mac80211/patches/ath11k/0044-wifi-ath11k-add-support-to-parse-new-WMI-event-for-6.patch b/package/kernel/mac80211/patches/ath11k/0044-wifi-ath11k-add-support-to-parse-new-WMI-event-for-6.patch
new file mode 100644
index 00000000000000..e165c09dc47885
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0044-wifi-ath11k-add-support-to-parse-new-WMI-event-for-6.patch
@@ -0,0 +1,844 @@
+From 91fa00fa69224aae5afb720c5e68b22e4c4f7333 Mon Sep 17 00:00:00 2001
+From: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Date: Wed, 1 Mar 2023 16:20:59 +0200
+Subject: [PATCH] wifi: ath11k: add support to parse new WMI event for 6 GHz
+
+In order to support different power levels of 6 GHz AP and client,
+new WMI event for regulatory - WMI_REG_CHAN_LIST_CC_EXT_EVENTID is
+added in firmware. This event provides new parameters required for
+6 GHz regulatory rules.
+
+Add support for parsing 2.4 GHz, 5 GHz and 6 GHz reg rules and other
+parameters from WMI_REG_CHAN_LIST_CC_EXT_EVENTID.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Lavanya Suresh <quic_lavaks@quicinc.com>
+Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
+Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230110121024.14051-3-quic_adisi@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/reg.c |  37 ++-
+ drivers/net/wireless/ath/ath11k/wmi.c | 418 +++++++++++++++++++++++++-
+ drivers/net/wireless/ath/ath11k/wmi.h | 163 +++++++++-
+ 3 files changed, 584 insertions(+), 34 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/reg.c
++++ b/drivers/net/wireless/ath/ath11k/reg.c
+@@ -613,7 +613,7 @@ ath11k_reg_build_regd(struct ath11k_base
+ {
+ 	struct ieee80211_regdomain *tmp_regd, *default_regd, *new_regd = NULL;
+ 	struct cur_reg_rule *reg_rule;
+-	u8 i = 0, j = 0;
++	u8 i = 0, j = 0, k = 0;
+ 	u8 num_rules;
+ 	u16 max_bw;
+ 	u32 flags;
+@@ -621,6 +621,12 @@ ath11k_reg_build_regd(struct ath11k_base
+ 
+ 	num_rules = reg_info->num_5ghz_reg_rules + reg_info->num_2ghz_reg_rules;
+ 
++	/* FIXME: Currently taking reg rules for 6 GHz only from Indoor AP mode list.
++	 * This can be updated after complete 6 GHz regulatory support is added.
++	 */
++	if (reg_info->is_ext_reg_event)
++		num_rules += reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP];
++
+ 	if (!num_rules)
+ 		goto ret;
+ 
+@@ -666,6 +672,14 @@ ath11k_reg_build_regd(struct ath11k_base
+ 			 * per other BW rule flags we pass from here
+ 			 */
+ 			flags = NL80211_RRF_AUTO_BW;
++		} else if (reg_info->is_ext_reg_event &&
++			   reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP] &&
++			   (k < reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP])) {
++			reg_rule = reg_info->reg_rules_6ghz_ap_ptr[WMI_REG_INDOOR_AP] +
++				   k++;
++			max_bw = min_t(u16, reg_rule->max_bw,
++				       reg_info->max_bw_6ghz_ap[WMI_REG_INDOOR_AP]);
++			flags = NL80211_RRF_AUTO_BW;
+ 		} else {
+ 			break;
+ 		}
+@@ -693,12 +707,21 @@ ath11k_reg_build_regd(struct ath11k_base
+ 			continue;
+ 		}
+ 
+-		ath11k_dbg(ab, ATH11K_DBG_REG,
+-			   "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
+-			   i + 1, reg_rule->start_freq, reg_rule->end_freq,
+-			   max_bw, reg_rule->ant_gain, reg_rule->reg_power,
+-			   tmp_regd->reg_rules[i].dfs_cac_ms,
+-			   flags);
++		if (reg_info->is_ext_reg_event) {
++			ath11k_dbg(ab, ATH11K_DBG_REG,
++				   "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d) (%d, %d)\n",
++				   i + 1, reg_rule->start_freq, reg_rule->end_freq,
++				   max_bw, reg_rule->ant_gain, reg_rule->reg_power,
++				   tmp_regd->reg_rules[i].dfs_cac_ms, flags,
++				   reg_rule->psd_flag, reg_rule->psd_eirp);
++		} else {
++			ath11k_dbg(ab, ATH11K_DBG_REG,
++				   "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
++				   i + 1, reg_rule->start_freq, reg_rule->end_freq,
++				   max_bw, reg_rule->ant_gain, reg_rule->reg_power,
++				   tmp_regd->reg_rules[i].dfs_cac_ms,
++				   flags);
++		}
+ 	}
+ 
+ 	tmp_regd->n_reg_rules = i;
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -105,6 +105,8 @@ static const struct wmi_tlv_policy wmi_t
+ 		= { .min_len = sizeof(struct wmi_vdev_stopped_event) },
+ 	[WMI_TAG_REG_CHAN_LIST_CC_EVENT]
+ 		= { .min_len = sizeof(struct wmi_reg_chan_list_cc_event) },
++	[WMI_TAG_REG_CHAN_LIST_CC_EXT_EVENT]
++		= { .min_len = sizeof(struct wmi_reg_chan_list_cc_ext_event) },
+ 	[WMI_TAG_MGMT_RX_HDR]
+ 		= { .min_len = sizeof(struct wmi_mgmt_rx_hdr) },
+ 	[WMI_TAG_MGMT_TX_COMPL_EVENT]
+@@ -3974,6 +3976,10 @@ ath11k_wmi_copy_resource_config(struct w
+ 	wmi_cfg->sched_params = tg_cfg->sched_params;
+ 	wmi_cfg->twt_ap_pdev_count = tg_cfg->twt_ap_pdev_count;
+ 	wmi_cfg->twt_ap_sta_count = tg_cfg->twt_ap_sta_count;
++	wmi_cfg->host_service_flags &=
++		~(1 << WMI_CFG_HOST_SERVICE_FLAG_REG_CC_EXT);
++	wmi_cfg->host_service_flags |= (tg_cfg->is_reg_cc_ext_event_supported <<
++					WMI_CFG_HOST_SERVICE_FLAG_REG_CC_EXT);
+ }
+ 
+ static int ath11k_init_cmd_send(struct ath11k_pdev_wmi *wmi,
+@@ -4192,6 +4198,10 @@ int ath11k_wmi_cmd_init(struct ath11k_ba
+ 
+ 	ab->hw_params.hw_ops->wmi_init_config(ab, &config);
+ 
++	if (test_bit(WMI_TLV_SERVICE_REG_CC_EXT_EVENT_SUPPORT,
++		     ab->wmi_ab.svc_map))
++		config.is_reg_cc_ext_event_supported = 1;
++
+ 	memcpy(&wmi_sc->wlan_resource_config, &config, sizeof(config));
+ 
+ 	init_param.res_cfg = &wmi_sc->wlan_resource_config;
+@@ -4995,18 +5005,11 @@ static int ath11k_pull_reg_chan_list_upd
+ 	reg_info->phy_id = chan_list_event_hdr->phy_id;
+ 	reg_info->ctry_code = chan_list_event_hdr->country_id;
+ 	reg_info->reg_dmn_pair = chan_list_event_hdr->domain_code;
+-	if (chan_list_event_hdr->status_code == WMI_REG_SET_CC_STATUS_PASS)
+-		reg_info->status_code = REG_SET_CC_STATUS_PASS;
+-	else if (chan_list_event_hdr->status_code == WMI_REG_CURRENT_ALPHA2_NOT_FOUND)
+-		reg_info->status_code = REG_CURRENT_ALPHA2_NOT_FOUND;
+-	else if (chan_list_event_hdr->status_code == WMI_REG_INIT_ALPHA2_NOT_FOUND)
+-		reg_info->status_code = REG_INIT_ALPHA2_NOT_FOUND;
+-	else if (chan_list_event_hdr->status_code == WMI_REG_SET_CC_CHANGE_NOT_ALLOWED)
+-		reg_info->status_code = REG_SET_CC_CHANGE_NOT_ALLOWED;
+-	else if (chan_list_event_hdr->status_code == WMI_REG_SET_CC_STATUS_NO_MEMORY)
+-		reg_info->status_code = REG_SET_CC_STATUS_NO_MEMORY;
+-	else if (chan_list_event_hdr->status_code == WMI_REG_SET_CC_STATUS_FAIL)
+-		reg_info->status_code = REG_SET_CC_STATUS_FAIL;
++
++	reg_info->status_code =
++		ath11k_wmi_cc_setting_code_to_reg(chan_list_event_hdr->status_code);
++
++	reg_info->is_ext_reg_event = false;
+ 
+ 	reg_info->min_bw_2ghz = chan_list_event_hdr->min_bw_2ghz;
+ 	reg_info->max_bw_2ghz = chan_list_event_hdr->max_bw_2ghz;
+@@ -5060,6 +5063,372 @@ static int ath11k_pull_reg_chan_list_upd
+ 	return 0;
+ }
+ 
++static struct cur_reg_rule
++*create_ext_reg_rules_from_wmi(u32 num_reg_rules,
++			       struct wmi_regulatory_ext_rule *wmi_reg_rule)
++{
++	struct cur_reg_rule *reg_rule_ptr;
++	u32 count;
++
++	reg_rule_ptr =  kcalloc(num_reg_rules, sizeof(*reg_rule_ptr), GFP_ATOMIC);
++
++	if (!reg_rule_ptr)
++		return NULL;
++
++	for (count = 0; count < num_reg_rules; count++) {
++		reg_rule_ptr[count].start_freq =
++			u32_get_bits(wmi_reg_rule[count].freq_info,
++				     REG_RULE_START_FREQ);
++		reg_rule_ptr[count].end_freq =
++			u32_get_bits(wmi_reg_rule[count].freq_info,
++				     REG_RULE_END_FREQ);
++		reg_rule_ptr[count].max_bw =
++			u32_get_bits(wmi_reg_rule[count].bw_pwr_info,
++				     REG_RULE_MAX_BW);
++		reg_rule_ptr[count].reg_power =
++			u32_get_bits(wmi_reg_rule[count].bw_pwr_info,
++				     REG_RULE_REG_PWR);
++		reg_rule_ptr[count].ant_gain =
++			u32_get_bits(wmi_reg_rule[count].bw_pwr_info,
++				     REG_RULE_ANT_GAIN);
++		reg_rule_ptr[count].flags =
++			u32_get_bits(wmi_reg_rule[count].flag_info,
++				     REG_RULE_FLAGS);
++		reg_rule_ptr[count].psd_flag =
++			u32_get_bits(wmi_reg_rule[count].psd_power_info,
++				     REG_RULE_PSD_INFO);
++		reg_rule_ptr[count].psd_eirp =
++			u32_get_bits(wmi_reg_rule[count].psd_power_info,
++				     REG_RULE_PSD_EIRP);
++	}
++
++	return reg_rule_ptr;
++}
++
++static u8
++ath11k_invalid_5ghz_reg_ext_rules_from_wmi(u32 num_reg_rules,
++					   const struct wmi_regulatory_ext_rule *rule)
++{
++	u8 num_invalid_5ghz_rules = 0;
++	u32 count, start_freq;
++
++	for (count = 0; count < num_reg_rules; count++) {
++		start_freq = u32_get_bits(rule[count].freq_info,
++					  REG_RULE_START_FREQ);
++
++		if (start_freq >= ATH11K_MIN_6G_FREQ)
++			num_invalid_5ghz_rules++;
++	}
++
++	return num_invalid_5ghz_rules;
++}
++
++static int ath11k_pull_reg_chan_list_ext_update_ev(struct ath11k_base *ab,
++						   struct sk_buff *skb,
++						   struct cur_regulatory_info *reg_info)
++{
++	const void **tb;
++	const struct wmi_reg_chan_list_cc_ext_event *ext_chan_list_event_hdr;
++	struct wmi_regulatory_ext_rule *ext_wmi_reg_rule;
++	u32 num_2ghz_reg_rules, num_5ghz_reg_rules;
++	u32 num_6ghz_reg_rules_ap[WMI_REG_CURRENT_MAX_AP_TYPE];
++	u32 num_6ghz_client[WMI_REG_CURRENT_MAX_AP_TYPE][WMI_REG_MAX_CLIENT_TYPE];
++	u32 total_reg_rules = 0;
++	int ret, i, j, num_invalid_5ghz_ext_rules = 0;
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI, "processing regulatory ext channel list\n");
++
++	tb = ath11k_wmi_tlv_parse_alloc(ab, skb->data, skb->len, GFP_ATOMIC);
++	if (IS_ERR(tb)) {
++		ret = PTR_ERR(tb);
++		ath11k_warn(ab, "failed to parse tlv: %d\n", ret);
++		return ret;
++	}
++
++	ext_chan_list_event_hdr = tb[WMI_TAG_REG_CHAN_LIST_CC_EXT_EVENT];
++	if (!ext_chan_list_event_hdr) {
++		ath11k_warn(ab, "failed to fetch reg chan list ext update ev\n");
++		kfree(tb);
++		return -EPROTO;
++	}
++
++	reg_info->num_2ghz_reg_rules =
++			ext_chan_list_event_hdr->num_2ghz_reg_rules;
++	reg_info->num_5ghz_reg_rules =
++			ext_chan_list_event_hdr->num_5ghz_reg_rules;
++	reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP] =
++			ext_chan_list_event_hdr->num_6ghz_reg_rules_ap_lpi;
++	reg_info->num_6ghz_rules_ap[WMI_REG_STANDARD_POWER_AP] =
++			ext_chan_list_event_hdr->num_6ghz_reg_rules_ap_sp;
++	reg_info->num_6ghz_rules_ap[WMI_REG_VERY_LOW_POWER_AP] =
++			ext_chan_list_event_hdr->num_6ghz_reg_rules_ap_vlp;
++
++	for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
++		reg_info->num_6ghz_rules_client[WMI_REG_INDOOR_AP][i] =
++			ext_chan_list_event_hdr->num_6ghz_reg_rules_client_lpi[i];
++		reg_info->num_6ghz_rules_client[WMI_REG_STANDARD_POWER_AP][i] =
++			ext_chan_list_event_hdr->num_6ghz_reg_rules_client_sp[i];
++		reg_info->num_6ghz_rules_client[WMI_REG_VERY_LOW_POWER_AP][i] =
++			ext_chan_list_event_hdr->num_6ghz_reg_rules_client_vlp[i];
++	}
++
++	num_2ghz_reg_rules = reg_info->num_2ghz_reg_rules;
++	num_5ghz_reg_rules = reg_info->num_5ghz_reg_rules;
++
++	total_reg_rules += num_2ghz_reg_rules;
++	total_reg_rules += num_5ghz_reg_rules;
++
++	if ((num_2ghz_reg_rules > MAX_REG_RULES) ||
++	    (num_5ghz_reg_rules > MAX_REG_RULES)) {
++		ath11k_warn(ab, "Num reg rules for 2.4 GHz/5 GHz exceeds max limit (num_2ghz_reg_rules: %d num_5ghz_reg_rules: %d max_rules: %d)\n",
++			    num_2ghz_reg_rules, num_5ghz_reg_rules, MAX_REG_RULES);
++		kfree(tb);
++		return -EINVAL;
++	}
++
++	for (i = 0; i < WMI_REG_CURRENT_MAX_AP_TYPE; i++) {
++		num_6ghz_reg_rules_ap[i] = reg_info->num_6ghz_rules_ap[i];
++
++		if (num_6ghz_reg_rules_ap[i] > MAX_6GHZ_REG_RULES) {
++			ath11k_warn(ab, "Num 6 GHz reg rules for AP mode(%d) exceeds max limit (num_6ghz_reg_rules_ap: %d, max_rules: %d)\n",
++				    i, num_6ghz_reg_rules_ap[i], MAX_6GHZ_REG_RULES);
++			kfree(tb);
++			return -EINVAL;
++		}
++
++		total_reg_rules += num_6ghz_reg_rules_ap[i];
++	}
++
++	for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
++		num_6ghz_client[WMI_REG_INDOOR_AP][i] =
++			reg_info->num_6ghz_rules_client[WMI_REG_INDOOR_AP][i];
++		total_reg_rules += num_6ghz_client[WMI_REG_INDOOR_AP][i];
++
++		num_6ghz_client[WMI_REG_STANDARD_POWER_AP][i] =
++			reg_info->num_6ghz_rules_client[WMI_REG_STANDARD_POWER_AP][i];
++		total_reg_rules += num_6ghz_client[WMI_REG_STANDARD_POWER_AP][i];
++
++		num_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i] =
++			reg_info->num_6ghz_rules_client[WMI_REG_VERY_LOW_POWER_AP][i];
++		total_reg_rules += num_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i];
++
++		if ((num_6ghz_client[WMI_REG_INDOOR_AP][i] > MAX_6GHZ_REG_RULES) ||
++		    (num_6ghz_client[WMI_REG_STANDARD_POWER_AP][i] >
++							     MAX_6GHZ_REG_RULES) ||
++		    (num_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i] >
++							     MAX_6GHZ_REG_RULES)) {
++			ath11k_warn(ab,
++				    "Num 6 GHz client reg rules exceeds max limit, for client(type: %d)\n",
++				    i);
++			kfree(tb);
++			return -EINVAL;
++		}
++	}
++
++	if (!total_reg_rules) {
++		ath11k_warn(ab, "No reg rules available\n");
++		kfree(tb);
++		return -EINVAL;
++	}
++
++	memcpy(reg_info->alpha2, &ext_chan_list_event_hdr->alpha2,
++	       REG_ALPHA2_LEN);
++
++	reg_info->dfs_region = ext_chan_list_event_hdr->dfs_region;
++	reg_info->phybitmap = ext_chan_list_event_hdr->phybitmap;
++	reg_info->num_phy = ext_chan_list_event_hdr->num_phy;
++	reg_info->phy_id = ext_chan_list_event_hdr->phy_id;
++	reg_info->ctry_code = ext_chan_list_event_hdr->country_id;
++	reg_info->reg_dmn_pair = ext_chan_list_event_hdr->domain_code;
++
++	reg_info->status_code =
++		ath11k_wmi_cc_setting_code_to_reg(ext_chan_list_event_hdr->status_code);
++
++	reg_info->is_ext_reg_event = true;
++
++	reg_info->min_bw_2ghz = ext_chan_list_event_hdr->min_bw_2ghz;
++	reg_info->max_bw_2ghz = ext_chan_list_event_hdr->max_bw_2ghz;
++	reg_info->min_bw_5ghz = ext_chan_list_event_hdr->min_bw_5ghz;
++	reg_info->max_bw_5ghz = ext_chan_list_event_hdr->max_bw_5ghz;
++
++	reg_info->min_bw_6ghz_ap[WMI_REG_INDOOR_AP] =
++			ext_chan_list_event_hdr->min_bw_6ghz_ap_lpi;
++	reg_info->max_bw_6ghz_ap[WMI_REG_INDOOR_AP] =
++			 ext_chan_list_event_hdr->max_bw_6ghz_ap_lpi;
++	reg_info->min_bw_6ghz_ap[WMI_REG_STANDARD_POWER_AP] =
++			ext_chan_list_event_hdr->min_bw_6ghz_ap_sp;
++	reg_info->max_bw_6ghz_ap[WMI_REG_STANDARD_POWER_AP] =
++			ext_chan_list_event_hdr->max_bw_6ghz_ap_sp;
++	reg_info->min_bw_6ghz_ap[WMI_REG_VERY_LOW_POWER_AP] =
++			ext_chan_list_event_hdr->min_bw_6ghz_ap_vlp;
++	reg_info->max_bw_6ghz_ap[WMI_REG_VERY_LOW_POWER_AP] =
++			ext_chan_list_event_hdr->max_bw_6ghz_ap_vlp;
++
++	for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
++		reg_info->min_bw_6ghz_client[WMI_REG_INDOOR_AP][i] =
++				ext_chan_list_event_hdr->min_bw_6ghz_client_lpi[i];
++		reg_info->max_bw_6ghz_client[WMI_REG_INDOOR_AP][i] =
++				ext_chan_list_event_hdr->max_bw_6ghz_client_lpi[i];
++		reg_info->min_bw_6ghz_client[WMI_REG_STANDARD_POWER_AP][i] =
++				ext_chan_list_event_hdr->min_bw_6ghz_client_sp[i];
++		reg_info->max_bw_6ghz_client[WMI_REG_STANDARD_POWER_AP][i] =
++				ext_chan_list_event_hdr->max_bw_6ghz_client_sp[i];
++		reg_info->min_bw_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i] =
++				ext_chan_list_event_hdr->min_bw_6ghz_client_vlp[i];
++		reg_info->max_bw_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i] =
++				ext_chan_list_event_hdr->max_bw_6ghz_client_vlp[i];
++	}
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "%s:cc_ext %s dsf %d BW: min_2ghz %d max_2ghz %d min_5ghz %d max_5ghz %d",
++		   __func__, reg_info->alpha2, reg_info->dfs_region,
++		   reg_info->min_bw_2ghz, reg_info->max_bw_2ghz,
++		   reg_info->min_bw_5ghz, reg_info->max_bw_5ghz);
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "num_2ghz_reg_rules %d num_5ghz_reg_rules %d",
++		   num_2ghz_reg_rules, num_5ghz_reg_rules);
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "num_6ghz_reg_rules_ap_lpi: %d num_6ghz_reg_rules_ap_sp: %d num_6ghz_reg_rules_ap_vlp: %d",
++		   num_6ghz_reg_rules_ap[WMI_REG_INDOOR_AP],
++		   num_6ghz_reg_rules_ap[WMI_REG_STANDARD_POWER_AP],
++		   num_6ghz_reg_rules_ap[WMI_REG_VERY_LOW_POWER_AP]);
++
++	j = WMI_REG_DEFAULT_CLIENT;
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "6 GHz Regular client: num_6ghz_reg_rules_lpi: %d num_6ghz_reg_rules_sp: %d num_6ghz_reg_rules_vlp: %d",
++		   num_6ghz_client[WMI_REG_INDOOR_AP][j],
++		   num_6ghz_client[WMI_REG_STANDARD_POWER_AP][j],
++		   num_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][j]);
++
++	j = WMI_REG_SUBORDINATE_CLIENT;
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "6 GHz Subordinate client: num_6ghz_reg_rules_lpi: %d num_6ghz_reg_rules_sp: %d num_6ghz_reg_rules_vlp: %d",
++		   num_6ghz_client[WMI_REG_INDOOR_AP][j],
++		   num_6ghz_client[WMI_REG_STANDARD_POWER_AP][j],
++		   num_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][j]);
++
++	ext_wmi_reg_rule =
++		(struct wmi_regulatory_ext_rule *)((u8 *)ext_chan_list_event_hdr
++						   + sizeof(*ext_chan_list_event_hdr)
++						   + sizeof(struct wmi_tlv));
++	if (num_2ghz_reg_rules) {
++		reg_info->reg_rules_2ghz_ptr =
++			create_ext_reg_rules_from_wmi(num_2ghz_reg_rules,
++						      ext_wmi_reg_rule);
++
++		if (!reg_info->reg_rules_2ghz_ptr) {
++			kfree(tb);
++			ath11k_warn(ab, "Unable to Allocate memory for 2 GHz rules\n");
++			return -ENOMEM;
++		}
++	}
++
++	ext_wmi_reg_rule += num_2ghz_reg_rules;
++
++	/* Firmware might include 6 GHz reg rule in 5 GHz rule list
++	 * for few countries along with separate 6 GHz rule.
++	 * Having same 6 GHz reg rule in 5 GHz and 6 GHz rules list
++	 * causes intersect check to be true, and same rules will be
++	 * shown multiple times in iw cmd.
++	 * Hence, avoid parsing 6 GHz rule from 5 GHz reg rule list
++	 */
++	num_invalid_5ghz_ext_rules =
++		ath11k_invalid_5ghz_reg_ext_rules_from_wmi(num_5ghz_reg_rules,
++							   ext_wmi_reg_rule);
++
++	if (num_invalid_5ghz_ext_rules) {
++		ath11k_dbg(ab, ATH11K_DBG_WMI,
++			   "CC: %s 5 GHz reg rules number %d from fw, %d number of invalid 5 GHz rules",
++			   reg_info->alpha2, reg_info->num_5ghz_reg_rules,
++			   num_invalid_5ghz_ext_rules);
++
++		num_5ghz_reg_rules = num_5ghz_reg_rules - num_invalid_5ghz_ext_rules;
++		reg_info->num_5ghz_reg_rules = num_5ghz_reg_rules;
++	}
++
++	if (num_5ghz_reg_rules) {
++		reg_info->reg_rules_5ghz_ptr =
++			create_ext_reg_rules_from_wmi(num_5ghz_reg_rules,
++						      ext_wmi_reg_rule);
++
++		if (!reg_info->reg_rules_5ghz_ptr) {
++			kfree(tb);
++			ath11k_warn(ab, "Unable to Allocate memory for 5 GHz rules\n");
++			return -ENOMEM;
++		}
++	}
++
++	/* We have adjusted the number of 5 GHz reg rules above. But still those
++	 * many rules needs to be adjusted in ext_wmi_reg_rule.
++	 *
++	 * NOTE: num_invalid_5ghz_ext_rules will be 0 for rest other cases.
++	 */
++	ext_wmi_reg_rule += (num_5ghz_reg_rules + num_invalid_5ghz_ext_rules);
++
++	for (i = 0; i < WMI_REG_CURRENT_MAX_AP_TYPE; i++) {
++		reg_info->reg_rules_6ghz_ap_ptr[i] =
++			create_ext_reg_rules_from_wmi(num_6ghz_reg_rules_ap[i],
++						      ext_wmi_reg_rule);
++
++		if (!reg_info->reg_rules_6ghz_ap_ptr[i]) {
++			kfree(tb);
++			ath11k_warn(ab, "Unable to Allocate memory for 6 GHz AP rules\n");
++			return -ENOMEM;
++		}
++
++		ext_wmi_reg_rule += num_6ghz_reg_rules_ap[i];
++	}
++
++	for (j = 0; j < WMI_REG_CURRENT_MAX_AP_TYPE; j++) {
++		for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
++			reg_info->reg_rules_6ghz_client_ptr[j][i] =
++				create_ext_reg_rules_from_wmi(num_6ghz_client[j][i],
++							      ext_wmi_reg_rule);
++
++			if (!reg_info->reg_rules_6ghz_client_ptr[j][i]) {
++				kfree(tb);
++				ath11k_warn(ab, "Unable to Allocate memory for 6 GHz client rules\n");
++				return -ENOMEM;
++			}
++
++			ext_wmi_reg_rule += num_6ghz_client[j][i];
++		}
++	}
++
++	reg_info->client_type = ext_chan_list_event_hdr->client_type;
++	reg_info->rnr_tpe_usable = ext_chan_list_event_hdr->rnr_tpe_usable;
++	reg_info->unspecified_ap_usable =
++			ext_chan_list_event_hdr->unspecified_ap_usable;
++	reg_info->domain_code_6ghz_ap[WMI_REG_INDOOR_AP] =
++			ext_chan_list_event_hdr->domain_code_6ghz_ap_lpi;
++	reg_info->domain_code_6ghz_ap[WMI_REG_STANDARD_POWER_AP] =
++			ext_chan_list_event_hdr->domain_code_6ghz_ap_sp;
++	reg_info->domain_code_6ghz_ap[WMI_REG_VERY_LOW_POWER_AP] =
++			ext_chan_list_event_hdr->domain_code_6ghz_ap_vlp;
++
++	for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
++		reg_info->domain_code_6ghz_client[WMI_REG_INDOOR_AP][i] =
++				ext_chan_list_event_hdr->domain_code_6ghz_client_lpi[i];
++		reg_info->domain_code_6ghz_client[WMI_REG_STANDARD_POWER_AP][i] =
++				ext_chan_list_event_hdr->domain_code_6ghz_client_sp[i];
++		reg_info->domain_code_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i] =
++				ext_chan_list_event_hdr->domain_code_6ghz_client_vlp[i];
++	}
++
++	reg_info->domain_code_6ghz_super_id =
++			ext_chan_list_event_hdr->domain_code_6ghz_super_id;
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI, "6 GHz client_type: %d domain_code_6ghz_super_id: %d",
++		   reg_info->client_type, reg_info->domain_code_6ghz_super_id);
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI, "processed regulatory ext channel list\n");
++
++	kfree(tb);
++	return 0;
++}
++
+ static int ath11k_pull_peer_del_resp_ev(struct ath11k_base *ab, struct sk_buff *skb,
+ 					struct wmi_peer_delete_resp_event *peer_del_resp)
+ {
+@@ -6507,12 +6876,14 @@ static bool ath11k_reg_is_world_alpha(ch
+ 	return false;
+ }
+ 
+-static int ath11k_reg_chan_list_event(struct ath11k_base *ab, struct sk_buff *skb)
++static int ath11k_reg_chan_list_event(struct ath11k_base *ab,
++				      struct sk_buff *skb,
++				      enum wmi_reg_chan_list_cmd_type id)
+ {
+ 	struct cur_regulatory_info *reg_info = NULL;
+ 	struct ieee80211_regdomain *regd = NULL;
+ 	bool intersect = false;
+-	int ret = 0, pdev_idx;
++	int ret = 0, pdev_idx, i, j;
+ 	struct ath11k *ar;
+ 
+ 	reg_info = kzalloc(sizeof(*reg_info), GFP_ATOMIC);
+@@ -6521,7 +6892,11 @@ static int ath11k_reg_chan_list_event(st
+ 		goto fallback;
+ 	}
+ 
+-	ret = ath11k_pull_reg_chan_list_update_ev(ab, skb, reg_info);
++	if (id == WMI_REG_CHAN_LIST_CC_ID)
++		ret = ath11k_pull_reg_chan_list_update_ev(ab, skb, reg_info);
++	else
++		ret = ath11k_pull_reg_chan_list_ext_update_ev(ab, skb, reg_info);
++
+ 	if (ret) {
+ 		ath11k_warn(ab, "failed to extract regulatory info from received event\n");
+ 		goto fallback;
+@@ -6623,6 +6998,14 @@ mem_free:
+ 	if (reg_info) {
+ 		kfree(reg_info->reg_rules_2ghz_ptr);
+ 		kfree(reg_info->reg_rules_5ghz_ptr);
++		if (reg_info->is_ext_reg_event) {
++			for (i = 0; i < WMI_REG_CURRENT_MAX_AP_TYPE; i++)
++				kfree(reg_info->reg_rules_6ghz_ap_ptr[i]);
++
++			for (j = 0; j < WMI_REG_CURRENT_MAX_AP_TYPE; j++)
++				for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++)
++					kfree(reg_info->reg_rules_6ghz_client_ptr[j][i]);
++		}
+ 		kfree(reg_info);
+ 	}
+ 	return ret;
+@@ -8054,7 +8437,10 @@ static void ath11k_wmi_tlv_op_rx(struct
+ 		ath11k_service_ready_ext2_event(ab, skb);
+ 		break;
+ 	case WMI_REG_CHAN_LIST_CC_EVENTID:
+-		ath11k_reg_chan_list_event(ab, skb);
++		ath11k_reg_chan_list_event(ab, skb, WMI_REG_CHAN_LIST_CC_ID);
++		break;
++	case WMI_REG_CHAN_LIST_CC_EXT_EVENTID:
++		ath11k_reg_chan_list_event(ab, skb, WMI_REG_CHAN_LIST_CC_EXT_ID);
+ 		break;
+ 	case WMI_READY_EVENTID:
+ 		ath11k_ready_event(ab, skb);
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -797,6 +797,7 @@ enum wmi_tlv_event_id {
+ 	WMI_RMC_NEW_LEADER_EVENTID = WMI_TLV_CMD(WMI_GRP_RMC),
+ 	WMI_REG_CHAN_LIST_CC_EVENTID = WMI_TLV_CMD(WMI_GRP_REGULATORY),
+ 	WMI_11D_NEW_COUNTRY_EVENTID,
++	WMI_REG_CHAN_LIST_CC_EXT_EVENTID,
+ 	WMI_NDI_CAP_RSP_EVENTID = WMI_TLV_CMD(WMI_GRP_PROTOTYPE),
+ 	WMI_NDP_INITIATOR_RSP_EVENTID,
+ 	WMI_NDP_RESPONDER_RSP_EVENTID,
+@@ -1865,6 +1866,8 @@ enum wmi_tlv_tag {
+ 	WMI_TAG_PDEV_SRG_OBSS_BSSID_ENABLE_BITMAP_CMD,
+ 	WMI_TAG_PDEV_NON_SRG_OBSS_COLOR_ENABLE_BITMAP_CMD,
+ 	WMI_TAG_PDEV_NON_SRG_OBSS_BSSID_ENABLE_BITMAP_CMD,
++	WMI_TAG_REGULATORY_RULE_EXT_STRUCT = 0x3A9,
++	WMI_TAG_REG_CHAN_LIST_CC_EXT_EVENT,
+ 	WMI_TAG_PDEV_SET_BIOS_SAR_TABLE_CMD = 0x3D8,
+ 	WMI_TAG_PDEV_SET_BIOS_GEO_TABLE_CMD,
+ 	WMI_TAG_MAX
+@@ -2097,6 +2100,7 @@ enum wmi_tlv_service {
+ 
+ 	/* The second 128 bits */
+ 	WMI_MAX_EXT_SERVICE = 256,
++	WMI_TLV_SERVICE_REG_CC_EXT_EVENT_SUPPORT = 281,
+ 	WMI_TLV_SERVICE_BIOS_SAR_SUPPORT = 326,
+ 
+ 	/* The third 128 bits */
+@@ -2313,6 +2317,8 @@ struct wmi_init_cmd {
+ #define WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64 BIT(5)
+ #define WMI_RSRC_CFG_FLAG1_ACK_RSSI BIT(18)
+ 
++#define WMI_CFG_HOST_SERVICE_FLAG_REG_CC_EXT 4
++
+ struct wmi_resource_config {
+ 	u32 tlv_header;
+ 	u32 num_vdevs;
+@@ -2372,6 +2378,15 @@ struct wmi_resource_config {
+ 	u32 sched_params;
+ 	u32 twt_ap_pdev_count;
+ 	u32 twt_ap_sta_count;
++	u32 max_nlo_ssids;
++	u32 num_pkt_filters;
++	u32 num_max_sta_vdevs;
++	u32 max_bssid_indicator;
++	u32 ul_resp_config;
++	u32 msdu_flow_override_config0;
++	u32 msdu_flow_override_config1;
++	u32 flags2;
++	u32 host_service_flags;
+ } __packed;
+ 
+ struct wmi_service_ready_event {
+@@ -2854,6 +2869,8 @@ struct rx_reorder_queue_remove_params {
+ #define REG_RULE_MAX_BW				0x0000ffff
+ #define REG_RULE_REG_PWR			0x00ff0000
+ #define REG_RULE_ANT_GAIN			0xff000000
++#define REG_RULE_PSD_INFO			BIT(0)
++#define REG_RULE_PSD_EIRP			0xff0000
+ 
+ #define WMI_VDEV_PARAM_TXBF_SU_TX_BFEE BIT(0)
+ #define WMI_VDEV_PARAM_TXBF_MU_TX_BFEE BIT(1)
+@@ -4049,6 +4066,7 @@ struct wmi_he_rate_set {
+ 
+ #define MAX_REG_RULES 10
+ #define REG_ALPHA2_LEN 2
++#define MAX_6GHZ_REG_RULES 5
+ 
+ enum wmi_start_event_param {
+ 	WMI_VDEV_START_RESP_EVENT = 0,
+@@ -4079,16 +4097,6 @@ enum wmi_vdev_start_resp_status_code {
+ 	WMI_VDEV_START_RESPONSE_INVALID_REGDOMAIN = 4,
+ };
+ 
+-;
+-enum cc_setting_code {
+-	REG_SET_CC_STATUS_PASS = 0,
+-	REG_CURRENT_ALPHA2_NOT_FOUND = 1,
+-	REG_INIT_ALPHA2_NOT_FOUND = 2,
+-	REG_SET_CC_CHANGE_NOT_ALLOWED = 3,
+-	REG_SET_CC_STATUS_NO_MEMORY = 4,
+-	REG_SET_CC_STATUS_FAIL = 5,
+-};
+-
+ /* Regaulatory Rule Flags Passed by FW */
+ #define REGULATORY_CHAN_DISABLED     BIT(0)
+ #define REGULATORY_CHAN_NO_IR        BIT(1)
+@@ -4102,13 +4110,72 @@ enum cc_setting_code {
+ #define REGULATORY_CHAN_NO_20MHZ     BIT(11)
+ #define REGULATORY_CHAN_NO_10MHZ     BIT(12)
+ 
+-enum {
++enum wmi_reg_chan_list_cmd_type {
++	WMI_REG_CHAN_LIST_CC_ID = 0,
++	WMI_REG_CHAN_LIST_CC_EXT_ID = 1,
++};
++
++enum wmi_reg_cc_setting_code {
+ 	WMI_REG_SET_CC_STATUS_PASS = 0,
+ 	WMI_REG_CURRENT_ALPHA2_NOT_FOUND = 1,
+ 	WMI_REG_INIT_ALPHA2_NOT_FOUND = 2,
+ 	WMI_REG_SET_CC_CHANGE_NOT_ALLOWED = 3,
+ 	WMI_REG_SET_CC_STATUS_NO_MEMORY = 4,
+ 	WMI_REG_SET_CC_STATUS_FAIL = 5,
++
++	/* add new setting code above, update in
++	 * @enum cc_setting_code as well.
++	 * Also handle it in ath11k_wmi_cc_setting_code_to_reg()
++	 */
++};
++
++enum cc_setting_code {
++	REG_SET_CC_STATUS_PASS = 0,
++	REG_CURRENT_ALPHA2_NOT_FOUND = 1,
++	REG_INIT_ALPHA2_NOT_FOUND = 2,
++	REG_SET_CC_CHANGE_NOT_ALLOWED = 3,
++	REG_SET_CC_STATUS_NO_MEMORY = 4,
++	REG_SET_CC_STATUS_FAIL = 5,
++
++	/* add new setting code above, update in
++	 * @enum wmi_reg_cc_setting_code as well.
++	 */
++};
++
++static inline enum cc_setting_code
++ath11k_wmi_cc_setting_code_to_reg(enum wmi_reg_cc_setting_code status_code)
++{
++	switch (status_code) {
++	case WMI_REG_SET_CC_STATUS_PASS:
++		return REG_SET_CC_STATUS_PASS;
++	case WMI_REG_CURRENT_ALPHA2_NOT_FOUND:
++		return REG_CURRENT_ALPHA2_NOT_FOUND;
++	case WMI_REG_INIT_ALPHA2_NOT_FOUND:
++		return REG_INIT_ALPHA2_NOT_FOUND;
++	case WMI_REG_SET_CC_CHANGE_NOT_ALLOWED:
++		return REG_SET_CC_CHANGE_NOT_ALLOWED;
++	case WMI_REG_SET_CC_STATUS_NO_MEMORY:
++		return REG_SET_CC_STATUS_NO_MEMORY;
++	case WMI_REG_SET_CC_STATUS_FAIL:
++		return REG_SET_CC_STATUS_FAIL;
++	}
++
++	return REG_SET_CC_STATUS_FAIL;
++}
++
++enum wmi_reg_6ghz_ap_type {
++	WMI_REG_INDOOR_AP = 0,
++	WMI_REG_STANDARD_POWER_AP = 1,
++	WMI_REG_VERY_LOW_POWER_AP = 2,
++
++	WMI_REG_CURRENT_MAX_AP_TYPE,
++	WMI_REG_MAX_AP_TYPE = 7,
++};
++
++enum wmi_reg_6ghz_client_type {
++	WMI_REG_DEFAULT_CLIENT = 0,
++	WMI_REG_SUBORDINATE_CLIENT = 1,
++	WMI_REG_MAX_CLIENT_TYPE = 2,
+ };
+ 
+ struct cur_reg_rule {
+@@ -4118,6 +4185,8 @@ struct cur_reg_rule {
+ 	u8 reg_power;
+ 	u8 ant_gain;
+ 	u16 flags;
++	bool psd_flag;
++	s8 psd_eirp;
+ };
+ 
+ struct cur_regulatory_info {
+@@ -4137,6 +4206,22 @@ struct cur_regulatory_info {
+ 	u32 num_5ghz_reg_rules;
+ 	struct cur_reg_rule *reg_rules_2ghz_ptr;
+ 	struct cur_reg_rule *reg_rules_5ghz_ptr;
++	bool is_ext_reg_event;
++	enum wmi_reg_6ghz_client_type client_type;
++	bool rnr_tpe_usable;
++	bool unspecified_ap_usable;
++	u8 domain_code_6ghz_ap[WMI_REG_CURRENT_MAX_AP_TYPE];
++	u8 domain_code_6ghz_client[WMI_REG_CURRENT_MAX_AP_TYPE][WMI_REG_MAX_CLIENT_TYPE];
++	u32 domain_code_6ghz_super_id;
++	u32 min_bw_6ghz_ap[WMI_REG_CURRENT_MAX_AP_TYPE];
++	u32 max_bw_6ghz_ap[WMI_REG_CURRENT_MAX_AP_TYPE];
++	u32 min_bw_6ghz_client[WMI_REG_CURRENT_MAX_AP_TYPE][WMI_REG_MAX_CLIENT_TYPE];
++	u32 max_bw_6ghz_client[WMI_REG_CURRENT_MAX_AP_TYPE][WMI_REG_MAX_CLIENT_TYPE];
++	u32 num_6ghz_rules_ap[WMI_REG_CURRENT_MAX_AP_TYPE];
++	u32 num_6ghz_rules_client[WMI_REG_CURRENT_MAX_AP_TYPE][WMI_REG_MAX_CLIENT_TYPE];
++	struct cur_reg_rule *reg_rules_6ghz_ap_ptr[WMI_REG_CURRENT_MAX_AP_TYPE];
++	struct cur_reg_rule *reg_rules_6ghz_client_ptr
++		[WMI_REG_CURRENT_MAX_AP_TYPE][WMI_REG_MAX_CLIENT_TYPE];
+ };
+ 
+ struct wmi_reg_chan_list_cc_event {
+@@ -4163,6 +4248,61 @@ struct wmi_regulatory_rule_struct {
+ 	u32  flag_info;
+ };
+ 
++#define WMI_REG_CLIENT_MAX 4
++
++struct wmi_reg_chan_list_cc_ext_event {
++	u32 status_code;
++	u32 phy_id;
++	u32 alpha2;
++	u32 num_phy;
++	u32 country_id;
++	u32 domain_code;
++	u32 dfs_region;
++	u32 phybitmap;
++	u32 min_bw_2ghz;
++	u32 max_bw_2ghz;
++	u32 min_bw_5ghz;
++	u32 max_bw_5ghz;
++	u32 num_2ghz_reg_rules;
++	u32 num_5ghz_reg_rules;
++	u32 client_type;
++	u32 rnr_tpe_usable;
++	u32 unspecified_ap_usable;
++	u32 domain_code_6ghz_ap_lpi;
++	u32 domain_code_6ghz_ap_sp;
++	u32 domain_code_6ghz_ap_vlp;
++	u32 domain_code_6ghz_client_lpi[WMI_REG_CLIENT_MAX];
++	u32 domain_code_6ghz_client_sp[WMI_REG_CLIENT_MAX];
++	u32 domain_code_6ghz_client_vlp[WMI_REG_CLIENT_MAX];
++	u32 domain_code_6ghz_super_id;
++	u32 min_bw_6ghz_ap_sp;
++	u32 max_bw_6ghz_ap_sp;
++	u32 min_bw_6ghz_ap_lpi;
++	u32 max_bw_6ghz_ap_lpi;
++	u32 min_bw_6ghz_ap_vlp;
++	u32 max_bw_6ghz_ap_vlp;
++	u32 min_bw_6ghz_client_sp[WMI_REG_CLIENT_MAX];
++	u32 max_bw_6ghz_client_sp[WMI_REG_CLIENT_MAX];
++	u32 min_bw_6ghz_client_lpi[WMI_REG_CLIENT_MAX];
++	u32 max_bw_6ghz_client_lpi[WMI_REG_CLIENT_MAX];
++	u32 min_bw_6ghz_client_vlp[WMI_REG_CLIENT_MAX];
++	u32 max_bw_6ghz_client_vlp[WMI_REG_CLIENT_MAX];
++	u32 num_6ghz_reg_rules_ap_sp;
++	u32 num_6ghz_reg_rules_ap_lpi;
++	u32 num_6ghz_reg_rules_ap_vlp;
++	u32 num_6ghz_reg_rules_client_sp[WMI_REG_CLIENT_MAX];
++	u32 num_6ghz_reg_rules_client_lpi[WMI_REG_CLIENT_MAX];
++	u32 num_6ghz_reg_rules_client_vlp[WMI_REG_CLIENT_MAX];
++} __packed;
++
++struct wmi_regulatory_ext_rule {
++	u32 tlv_header;
++	u32 freq_info;
++	u32 bw_pwr_info;
++	u32 flag_info;
++	u32 psd_power_info;
++} __packed;
++
+ struct wmi_vdev_delete_resp_event {
+ 	u32 vdev_id;
+ } __packed;
+@@ -5358,6 +5498,7 @@ struct target_resource_config {
+ 	u32 sched_params;
+ 	u32 twt_ap_pdev_count;
+ 	u32 twt_ap_sta_count;
++	u8 is_reg_cc_ext_event_supported;
+ };
+ 
+ enum wmi_debug_log_param {
diff --git a/package/kernel/mac80211/patches/ath11k/0045-wifi-ath11k-add-debug-prints-in-regulatory-WMI-event.patch b/package/kernel/mac80211/patches/ath11k/0045-wifi-ath11k-add-debug-prints-in-regulatory-WMI-event.patch
new file mode 100644
index 00000000000000..b88e51928f7abd
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0045-wifi-ath11k-add-debug-prints-in-regulatory-WMI-event.patch
@@ -0,0 +1,567 @@
+From e238e62ba8868a784e485eb94451c87cd1b85cee Mon Sep 17 00:00:00 2001
+From: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Date: Wed, 1 Mar 2023 16:20:59 +0200
+Subject: [PATCH] wifi: ath11k: add debug prints in regulatory WMI event
+ processing
+
+Add some more debug prints in processing regulatory WMI event in order to
+increase more debuggability.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230110121024.14051-4-quic_adisi@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/reg.c |   2 +-
+ drivers/net/wireless/ath/ath11k/wmi.c | 207 ++++++++++++++++++--------
+ drivers/net/wireless/ath/ath11k/wmi.h | 142 ++++++++++++++++++
+ 3 files changed, 291 insertions(+), 60 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/reg.c
++++ b/drivers/net/wireless/ath/ath11k/reg.c
+@@ -646,7 +646,7 @@ ath11k_reg_build_regd(struct ath11k_base
+ 	tmp_regd->dfs_region = ath11k_map_fw_dfs_region(reg_info->dfs_region);
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_REG,
+-		   "\r\nCountry %s, CFG Regdomain %s FW Regdomain %d, num_reg_rules %d\n",
++		   "Country %s, CFG Regdomain %s FW Regdomain %d, num_reg_rules %d\n",
+ 		   alpha2, ath11k_reg_get_regdom_str(tmp_regd->dfs_region),
+ 		   reg_info->dfs_region, num_rules);
+ 	/* Update reg_rules[] below. Firmware is expected to
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -4925,6 +4925,26 @@ static int ath11k_pull_vdev_start_resp_t
+ 	return 0;
+ }
+ 
++static void ath11k_print_reg_rule(struct ath11k_base *ab, const char *band,
++				  u32 num_reg_rules,
++				  struct cur_reg_rule *reg_rule_ptr)
++{
++	struct cur_reg_rule *reg_rule = reg_rule_ptr;
++	u32 count;
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI, "number of reg rules in %s band: %d\n",
++		   band, num_reg_rules);
++
++	for (count = 0; count < num_reg_rules; count++) {
++		ath11k_dbg(ab, ATH11K_DBG_WMI,
++			   "reg rule %d: (%d - %d @ %d) (%d, %d) (FLAGS %d)\n",
++			   count + 1, reg_rule->start_freq, reg_rule->end_freq,
++			   reg_rule->max_bw, reg_rule->ant_gain,
++			   reg_rule->reg_power, reg_rule->flags);
++		reg_rule++;
++	}
++}
++
+ static struct cur_reg_rule
+ *create_reg_rules_from_wmi(u32 num_reg_rules,
+ 			   struct wmi_regulatory_rule_struct *wmi_reg_rule)
+@@ -5006,6 +5026,10 @@ static int ath11k_pull_reg_chan_list_upd
+ 	reg_info->ctry_code = chan_list_event_hdr->country_id;
+ 	reg_info->reg_dmn_pair = chan_list_event_hdr->domain_code;
+ 
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "status_code %s",
++		   ath11k_cc_status_to_str(reg_info->status_code));
++
+ 	reg_info->status_code =
+ 		ath11k_wmi_cc_setting_code_to_reg(chan_list_event_hdr->status_code);
+ 
+@@ -5020,13 +5044,13 @@ static int ath11k_pull_reg_chan_list_upd
+ 	num_5ghz_reg_rules = reg_info->num_5ghz_reg_rules;
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_WMI,
+-		   "%s:cc %s dsf %d BW: min_2ghz %d max_2ghz %d min_5ghz %d max_5ghz %d",
+-		   __func__, reg_info->alpha2, reg_info->dfs_region,
++		   "cc %s dsf %d BW: min_2ghz %d max_2ghz %d min_5ghz %d max_5ghz %d",
++		   reg_info->alpha2, reg_info->dfs_region,
+ 		   reg_info->min_bw_2ghz, reg_info->max_bw_2ghz,
+ 		   reg_info->min_bw_5ghz, reg_info->max_bw_5ghz);
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_WMI,
+-		   "%s: num_2ghz_reg_rules %d num_5ghz_reg_rules %d", __func__,
++		   "num_2ghz_reg_rules %d num_5ghz_reg_rules %d",
+ 		   num_2ghz_reg_rules, num_5ghz_reg_rules);
+ 
+ 	wmi_reg_rule =
+@@ -5043,6 +5067,10 @@ static int ath11k_pull_reg_chan_list_upd
+ 			ath11k_warn(ab, "Unable to Allocate memory for 2 GHz rules\n");
+ 			return -ENOMEM;
+ 		}
++
++		ath11k_print_reg_rule(ab, "2 GHz",
++				      num_2ghz_reg_rules,
++				      reg_info->reg_rules_2ghz_ptr);
+ 	}
+ 
+ 	if (num_5ghz_reg_rules) {
+@@ -5055,6 +5083,10 @@ static int ath11k_pull_reg_chan_list_upd
+ 			ath11k_warn(ab, "Unable to Allocate memory for 5 GHz rules\n");
+ 			return -ENOMEM;
+ 		}
++
++		ath11k_print_reg_rule(ab, "5 GHz",
++				      num_5ghz_reg_rules,
++				      reg_info->reg_rules_5ghz_ptr);
+ 	}
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_WMI, "processed regulatory channel list\n");
+@@ -5128,7 +5160,7 @@ static int ath11k_pull_reg_chan_list_ext
+ 						   struct cur_regulatory_info *reg_info)
+ {
+ 	const void **tb;
+-	const struct wmi_reg_chan_list_cc_ext_event *ext_chan_list_event_hdr;
++	const struct wmi_reg_chan_list_cc_ext_event *ev;
+ 	struct wmi_regulatory_ext_rule *ext_wmi_reg_rule;
+ 	u32 num_2ghz_reg_rules, num_5ghz_reg_rules;
+ 	u32 num_6ghz_reg_rules_ap[WMI_REG_CURRENT_MAX_AP_TYPE];
+@@ -5145,31 +5177,29 @@ static int ath11k_pull_reg_chan_list_ext
+ 		return ret;
+ 	}
+ 
+-	ext_chan_list_event_hdr = tb[WMI_TAG_REG_CHAN_LIST_CC_EXT_EVENT];
+-	if (!ext_chan_list_event_hdr) {
++	ev = tb[WMI_TAG_REG_CHAN_LIST_CC_EXT_EVENT];
++	if (!ev) {
+ 		ath11k_warn(ab, "failed to fetch reg chan list ext update ev\n");
+ 		kfree(tb);
+ 		return -EPROTO;
+ 	}
+ 
+-	reg_info->num_2ghz_reg_rules =
+-			ext_chan_list_event_hdr->num_2ghz_reg_rules;
+-	reg_info->num_5ghz_reg_rules =
+-			ext_chan_list_event_hdr->num_5ghz_reg_rules;
++	reg_info->num_2ghz_reg_rules = ev->num_2ghz_reg_rules;
++	reg_info->num_5ghz_reg_rules = ev->num_5ghz_reg_rules;
+ 	reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP] =
+-			ext_chan_list_event_hdr->num_6ghz_reg_rules_ap_lpi;
++			ev->num_6ghz_reg_rules_ap_lpi;
+ 	reg_info->num_6ghz_rules_ap[WMI_REG_STANDARD_POWER_AP] =
+-			ext_chan_list_event_hdr->num_6ghz_reg_rules_ap_sp;
++			ev->num_6ghz_reg_rules_ap_sp;
+ 	reg_info->num_6ghz_rules_ap[WMI_REG_VERY_LOW_POWER_AP] =
+-			ext_chan_list_event_hdr->num_6ghz_reg_rules_ap_vlp;
++			ev->num_6ghz_reg_rules_ap_vlp;
+ 
+ 	for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
+ 		reg_info->num_6ghz_rules_client[WMI_REG_INDOOR_AP][i] =
+-			ext_chan_list_event_hdr->num_6ghz_reg_rules_client_lpi[i];
++			ev->num_6ghz_reg_rules_client_lpi[i];
+ 		reg_info->num_6ghz_rules_client[WMI_REG_STANDARD_POWER_AP][i] =
+-			ext_chan_list_event_hdr->num_6ghz_reg_rules_client_sp[i];
++			ev->num_6ghz_reg_rules_client_sp[i];
+ 		reg_info->num_6ghz_rules_client[WMI_REG_VERY_LOW_POWER_AP][i] =
+-			ext_chan_list_event_hdr->num_6ghz_reg_rules_client_vlp[i];
++			ev->num_6ghz_reg_rules_client_vlp[i];
+ 	}
+ 
+ 	num_2ghz_reg_rules = reg_info->num_2ghz_reg_rules;
+@@ -5231,57 +5261,79 @@ static int ath11k_pull_reg_chan_list_ext
+ 		return -EINVAL;
+ 	}
+ 
+-	memcpy(reg_info->alpha2, &ext_chan_list_event_hdr->alpha2,
+-	       REG_ALPHA2_LEN);
++	memcpy(reg_info->alpha2, &ev->alpha2, REG_ALPHA2_LEN);
++
++	reg_info->dfs_region = ev->dfs_region;
++	reg_info->phybitmap = ev->phybitmap;
++	reg_info->num_phy = ev->num_phy;
++	reg_info->phy_id = ev->phy_id;
++	reg_info->ctry_code = ev->country_id;
++	reg_info->reg_dmn_pair = ev->domain_code;
+ 
+-	reg_info->dfs_region = ext_chan_list_event_hdr->dfs_region;
+-	reg_info->phybitmap = ext_chan_list_event_hdr->phybitmap;
+-	reg_info->num_phy = ext_chan_list_event_hdr->num_phy;
+-	reg_info->phy_id = ext_chan_list_event_hdr->phy_id;
+-	reg_info->ctry_code = ext_chan_list_event_hdr->country_id;
+-	reg_info->reg_dmn_pair = ext_chan_list_event_hdr->domain_code;
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "status_code %s",
++		   ath11k_cc_status_to_str(reg_info->status_code));
+ 
+ 	reg_info->status_code =
+-		ath11k_wmi_cc_setting_code_to_reg(ext_chan_list_event_hdr->status_code);
++		ath11k_wmi_cc_setting_code_to_reg(ev->status_code);
+ 
+ 	reg_info->is_ext_reg_event = true;
+ 
+-	reg_info->min_bw_2ghz = ext_chan_list_event_hdr->min_bw_2ghz;
+-	reg_info->max_bw_2ghz = ext_chan_list_event_hdr->max_bw_2ghz;
+-	reg_info->min_bw_5ghz = ext_chan_list_event_hdr->min_bw_5ghz;
+-	reg_info->max_bw_5ghz = ext_chan_list_event_hdr->max_bw_5ghz;
++	reg_info->min_bw_2ghz = ev->min_bw_2ghz;
++	reg_info->max_bw_2ghz = ev->max_bw_2ghz;
++	reg_info->min_bw_5ghz = ev->min_bw_5ghz;
++	reg_info->max_bw_5ghz = ev->max_bw_5ghz;
+ 
+ 	reg_info->min_bw_6ghz_ap[WMI_REG_INDOOR_AP] =
+-			ext_chan_list_event_hdr->min_bw_6ghz_ap_lpi;
++			ev->min_bw_6ghz_ap_lpi;
+ 	reg_info->max_bw_6ghz_ap[WMI_REG_INDOOR_AP] =
+-			 ext_chan_list_event_hdr->max_bw_6ghz_ap_lpi;
++			ev->max_bw_6ghz_ap_lpi;
+ 	reg_info->min_bw_6ghz_ap[WMI_REG_STANDARD_POWER_AP] =
+-			ext_chan_list_event_hdr->min_bw_6ghz_ap_sp;
++			ev->min_bw_6ghz_ap_sp;
+ 	reg_info->max_bw_6ghz_ap[WMI_REG_STANDARD_POWER_AP] =
+-			ext_chan_list_event_hdr->max_bw_6ghz_ap_sp;
++			ev->max_bw_6ghz_ap_sp;
+ 	reg_info->min_bw_6ghz_ap[WMI_REG_VERY_LOW_POWER_AP] =
+-			ext_chan_list_event_hdr->min_bw_6ghz_ap_vlp;
++			ev->min_bw_6ghz_ap_vlp;
+ 	reg_info->max_bw_6ghz_ap[WMI_REG_VERY_LOW_POWER_AP] =
+-			ext_chan_list_event_hdr->max_bw_6ghz_ap_vlp;
++			ev->max_bw_6ghz_ap_vlp;
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "6 GHz AP BW: LPI (%d - %d), SP (%d - %d), VLP (%d - %d)\n",
++		   reg_info->min_bw_6ghz_ap[WMI_REG_INDOOR_AP],
++		   reg_info->max_bw_6ghz_ap[WMI_REG_INDOOR_AP],
++		   reg_info->min_bw_6ghz_ap[WMI_REG_STANDARD_POWER_AP],
++		   reg_info->max_bw_6ghz_ap[WMI_REG_STANDARD_POWER_AP],
++		   reg_info->min_bw_6ghz_ap[WMI_REG_VERY_LOW_POWER_AP],
++		   reg_info->max_bw_6ghz_ap[WMI_REG_VERY_LOW_POWER_AP]);
+ 
+ 	for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
+ 		reg_info->min_bw_6ghz_client[WMI_REG_INDOOR_AP][i] =
+-				ext_chan_list_event_hdr->min_bw_6ghz_client_lpi[i];
++				ev->min_bw_6ghz_client_lpi[i];
+ 		reg_info->max_bw_6ghz_client[WMI_REG_INDOOR_AP][i] =
+-				ext_chan_list_event_hdr->max_bw_6ghz_client_lpi[i];
++				ev->max_bw_6ghz_client_lpi[i];
+ 		reg_info->min_bw_6ghz_client[WMI_REG_STANDARD_POWER_AP][i] =
+-				ext_chan_list_event_hdr->min_bw_6ghz_client_sp[i];
++				ev->min_bw_6ghz_client_sp[i];
+ 		reg_info->max_bw_6ghz_client[WMI_REG_STANDARD_POWER_AP][i] =
+-				ext_chan_list_event_hdr->max_bw_6ghz_client_sp[i];
++				ev->max_bw_6ghz_client_sp[i];
+ 		reg_info->min_bw_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i] =
+-				ext_chan_list_event_hdr->min_bw_6ghz_client_vlp[i];
++				ev->min_bw_6ghz_client_vlp[i];
+ 		reg_info->max_bw_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i] =
+-				ext_chan_list_event_hdr->max_bw_6ghz_client_vlp[i];
++				ev->max_bw_6ghz_client_vlp[i];
++
++		ath11k_dbg(ab, ATH11K_DBG_WMI,
++			   "6 GHz %s BW: LPI (%d - %d), SP (%d - %d), VLP (%d - %d)\n",
++			   ath11k_6ghz_client_type_to_str(i),
++			   reg_info->min_bw_6ghz_client[WMI_REG_INDOOR_AP][i],
++			   reg_info->max_bw_6ghz_client[WMI_REG_INDOOR_AP][i],
++			   reg_info->min_bw_6ghz_client[WMI_REG_STANDARD_POWER_AP][i],
++			   reg_info->max_bw_6ghz_client[WMI_REG_STANDARD_POWER_AP][i],
++			   reg_info->min_bw_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i],
++			   reg_info->max_bw_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i]);
+ 	}
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_WMI,
+-		   "%s:cc_ext %s dsf %d BW: min_2ghz %d max_2ghz %d min_5ghz %d max_5ghz %d",
+-		   __func__, reg_info->alpha2, reg_info->dfs_region,
++		   "cc_ext %s dsf %d BW: min_2ghz %d max_2ghz %d min_5ghz %d max_5ghz %d",
++		   reg_info->alpha2, reg_info->dfs_region,
+ 		   reg_info->min_bw_2ghz, reg_info->max_bw_2ghz,
+ 		   reg_info->min_bw_5ghz, reg_info->max_bw_5ghz);
+ 
+@@ -5310,9 +5362,8 @@ static int ath11k_pull_reg_chan_list_ext
+ 		   num_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][j]);
+ 
+ 	ext_wmi_reg_rule =
+-		(struct wmi_regulatory_ext_rule *)((u8 *)ext_chan_list_event_hdr
+-						   + sizeof(*ext_chan_list_event_hdr)
+-						   + sizeof(struct wmi_tlv));
++		(struct wmi_regulatory_ext_rule *)((u8 *)ev + sizeof(*ev) +
++						   sizeof(struct wmi_tlv));
+ 	if (num_2ghz_reg_rules) {
+ 		reg_info->reg_rules_2ghz_ptr =
+ 			create_ext_reg_rules_from_wmi(num_2ghz_reg_rules,
+@@ -5323,6 +5374,10 @@ static int ath11k_pull_reg_chan_list_ext
+ 			ath11k_warn(ab, "Unable to Allocate memory for 2 GHz rules\n");
+ 			return -ENOMEM;
+ 		}
++
++		ath11k_print_reg_rule(ab, "2 GHz",
++				      num_2ghz_reg_rules,
++				      reg_info->reg_rules_2ghz_ptr);
+ 	}
+ 
+ 	ext_wmi_reg_rule += num_2ghz_reg_rules;
+@@ -5358,6 +5413,10 @@ static int ath11k_pull_reg_chan_list_ext
+ 			ath11k_warn(ab, "Unable to Allocate memory for 5 GHz rules\n");
+ 			return -ENOMEM;
+ 		}
++
++		ath11k_print_reg_rule(ab, "5 GHz",
++				      num_5ghz_reg_rules,
++				      reg_info->reg_rules_5ghz_ptr);
+ 	}
+ 
+ 	/* We have adjusted the number of 5 GHz reg rules above. But still those
+@@ -5378,10 +5437,17 @@ static int ath11k_pull_reg_chan_list_ext
+ 			return -ENOMEM;
+ 		}
+ 
++		ath11k_print_reg_rule(ab, ath11k_6ghz_ap_type_to_str(i),
++				      num_6ghz_reg_rules_ap[i],
++				      reg_info->reg_rules_6ghz_ap_ptr[i]);
++
+ 		ext_wmi_reg_rule += num_6ghz_reg_rules_ap[i];
+ 	}
+ 
+ 	for (j = 0; j < WMI_REG_CURRENT_MAX_AP_TYPE; j++) {
++		ath11k_dbg(ab, ATH11K_DBG_WMI,
++			   "6 GHz AP type %s", ath11k_6ghz_ap_type_to_str(j));
++
+ 		for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
+ 			reg_info->reg_rules_6ghz_client_ptr[j][i] =
+ 				create_ext_reg_rules_from_wmi(num_6ghz_client[j][i],
+@@ -5393,35 +5459,58 @@ static int ath11k_pull_reg_chan_list_ext
+ 				return -ENOMEM;
+ 			}
+ 
++			ath11k_print_reg_rule(ab,
++					      ath11k_6ghz_client_type_to_str(i),
++					      num_6ghz_client[j][i],
++					      reg_info->reg_rules_6ghz_client_ptr[j][i]);
++
+ 			ext_wmi_reg_rule += num_6ghz_client[j][i];
+ 		}
+ 	}
+ 
+-	reg_info->client_type = ext_chan_list_event_hdr->client_type;
+-	reg_info->rnr_tpe_usable = ext_chan_list_event_hdr->rnr_tpe_usable;
++	reg_info->client_type = ev->client_type;
++	reg_info->rnr_tpe_usable = ev->rnr_tpe_usable;
+ 	reg_info->unspecified_ap_usable =
+-			ext_chan_list_event_hdr->unspecified_ap_usable;
++			ev->unspecified_ap_usable;
+ 	reg_info->domain_code_6ghz_ap[WMI_REG_INDOOR_AP] =
+-			ext_chan_list_event_hdr->domain_code_6ghz_ap_lpi;
++			ev->domain_code_6ghz_ap_lpi;
+ 	reg_info->domain_code_6ghz_ap[WMI_REG_STANDARD_POWER_AP] =
+-			ext_chan_list_event_hdr->domain_code_6ghz_ap_sp;
++			ev->domain_code_6ghz_ap_sp;
+ 	reg_info->domain_code_6ghz_ap[WMI_REG_VERY_LOW_POWER_AP] =
+-			ext_chan_list_event_hdr->domain_code_6ghz_ap_vlp;
++			ev->domain_code_6ghz_ap_vlp;
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "6 GHz reg info client type %s rnr_tpe_usable %d unspecified_ap_usable %d AP sub domain: lpi %s, sp %s, vlp %s\n",
++		   ath11k_6ghz_client_type_to_str(reg_info->client_type),
++		   reg_info->rnr_tpe_usable,
++		   reg_info->unspecified_ap_usable,
++		   ath11k_sub_reg_6ghz_to_str(ev->domain_code_6ghz_ap_lpi),
++		   ath11k_sub_reg_6ghz_to_str(ev->domain_code_6ghz_ap_sp),
++		   ath11k_sub_reg_6ghz_to_str(ev->domain_code_6ghz_ap_vlp));
+ 
+ 	for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
+ 		reg_info->domain_code_6ghz_client[WMI_REG_INDOOR_AP][i] =
+-				ext_chan_list_event_hdr->domain_code_6ghz_client_lpi[i];
++				ev->domain_code_6ghz_client_lpi[i];
+ 		reg_info->domain_code_6ghz_client[WMI_REG_STANDARD_POWER_AP][i] =
+-				ext_chan_list_event_hdr->domain_code_6ghz_client_sp[i];
++				ev->domain_code_6ghz_client_sp[i];
+ 		reg_info->domain_code_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i] =
+-				ext_chan_list_event_hdr->domain_code_6ghz_client_vlp[i];
++				ev->domain_code_6ghz_client_vlp[i];
++
++		ath11k_dbg(ab, ATH11K_DBG_WMI,
++			   "6 GHz client type %s client sub domain: lpi %s, sp %s, vlp %s\n",
++			   ath11k_6ghz_client_type_to_str(i),
++			   ath11k_sub_reg_6ghz_to_str(ev->domain_code_6ghz_client_lpi[i]),
++			   ath11k_sub_reg_6ghz_to_str(ev->domain_code_6ghz_client_sp[i]),
++			   ath11k_sub_reg_6ghz_to_str(ev->domain_code_6ghz_client_vlp[i])
++			  );
+ 	}
+ 
+-	reg_info->domain_code_6ghz_super_id =
+-			ext_chan_list_event_hdr->domain_code_6ghz_super_id;
++	reg_info->domain_code_6ghz_super_id = ev->domain_code_6ghz_super_id;
+ 
+-	ath11k_dbg(ab, ATH11K_DBG_WMI, "6 GHz client_type: %d domain_code_6ghz_super_id: %d",
+-		   reg_info->client_type, reg_info->domain_code_6ghz_super_id);
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "6 GHz client_type %s 6 GHz super domain %s",
++		   ath11k_6ghz_client_type_to_str(reg_info->client_type),
++		   ath11k_super_reg_6ghz_to_str(reg_info->domain_code_6ghz_super_id));
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_WMI, "processed regulatory ext channel list\n");
+ 
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -4139,6 +4139,7 @@ enum cc_setting_code {
+ 
+ 	/* add new setting code above, update in
+ 	 * @enum wmi_reg_cc_setting_code as well.
++	 * Also handle it in ath11k_cc_status_to_str()
+ 	 */
+ };
+ 
+@@ -4163,21 +4164,162 @@ ath11k_wmi_cc_setting_code_to_reg(enum w
+ 	return REG_SET_CC_STATUS_FAIL;
+ }
+ 
++static inline const char *ath11k_cc_status_to_str(enum cc_setting_code code)
++{
++	switch (code) {
++	case REG_SET_CC_STATUS_PASS:
++		return "REG_SET_CC_STATUS_PASS";
++	case REG_CURRENT_ALPHA2_NOT_FOUND:
++		return "REG_CURRENT_ALPHA2_NOT_FOUND";
++	case REG_INIT_ALPHA2_NOT_FOUND:
++		return "REG_INIT_ALPHA2_NOT_FOUND";
++	case REG_SET_CC_CHANGE_NOT_ALLOWED:
++		return "REG_SET_CC_CHANGE_NOT_ALLOWED";
++	case REG_SET_CC_STATUS_NO_MEMORY:
++		return "REG_SET_CC_STATUS_NO_MEMORY";
++	case REG_SET_CC_STATUS_FAIL:
++		return "REG_SET_CC_STATUS_FAIL";
++	}
++
++	return "Unknown CC status";
++}
++
+ enum wmi_reg_6ghz_ap_type {
+ 	WMI_REG_INDOOR_AP = 0,
+ 	WMI_REG_STANDARD_POWER_AP = 1,
+ 	WMI_REG_VERY_LOW_POWER_AP = 2,
+ 
++	/* add AP type above, handle in ath11k_6ghz_ap_type_to_str()
++	 */
+ 	WMI_REG_CURRENT_MAX_AP_TYPE,
+ 	WMI_REG_MAX_AP_TYPE = 7,
+ };
+ 
++static inline const char *
++ath11k_6ghz_ap_type_to_str(enum wmi_reg_6ghz_ap_type type)
++{
++	switch (type) {
++	case WMI_REG_INDOOR_AP:
++		return "INDOOR AP";
++	case WMI_REG_STANDARD_POWER_AP:
++		return "STANDARD POWER AP";
++	case WMI_REG_VERY_LOW_POWER_AP:
++		return "VERY LOW POWER AP";
++	case WMI_REG_CURRENT_MAX_AP_TYPE:
++		return "CURRENT_MAX_AP_TYPE";
++	case WMI_REG_MAX_AP_TYPE:
++		return "MAX_AP_TYPE";
++	}
++
++	return "unknown 6 GHz AP type";
++}
++
+ enum wmi_reg_6ghz_client_type {
+ 	WMI_REG_DEFAULT_CLIENT = 0,
+ 	WMI_REG_SUBORDINATE_CLIENT = 1,
+ 	WMI_REG_MAX_CLIENT_TYPE = 2,
++
++	/* add client type above, handle it in
++	 * ath11k_6ghz_client_type_to_str()
++	 */
++};
++
++static inline const char *
++ath11k_6ghz_client_type_to_str(enum wmi_reg_6ghz_client_type type)
++{
++	switch (type) {
++	case WMI_REG_DEFAULT_CLIENT:
++		return "DEFAULT CLIENT";
++	case WMI_REG_SUBORDINATE_CLIENT:
++		return "SUBORDINATE CLIENT";
++	case WMI_REG_MAX_CLIENT_TYPE:
++		return "MAX_CLIENT_TYPE";
++	}
++
++	return "unknown 6 GHz client type";
++}
++
++enum reg_subdomains_6ghz {
++	EMPTY_6GHZ = 0x0,
++	FCC1_CLIENT_LPI_REGULAR_6GHZ = 0x01,
++	FCC1_CLIENT_SP_6GHZ = 0x02,
++	FCC1_AP_LPI_6GHZ = 0x03,
++	FCC1_CLIENT_LPI_SUBORDINATE = FCC1_AP_LPI_6GHZ,
++	FCC1_AP_SP_6GHZ = 0x04,
++	ETSI1_LPI_6GHZ = 0x10,
++	ETSI1_VLP_6GHZ = 0x11,
++	ETSI2_LPI_6GHZ = 0x12,
++	ETSI2_VLP_6GHZ = 0x13,
++	APL1_LPI_6GHZ = 0x20,
++	APL1_VLP_6GHZ = 0x21,
++
++	/* add sub-domain above, handle it in
++	 * ath11k_sub_reg_6ghz_to_str()
++	 */
++};
++
++static inline const char *
++ath11k_sub_reg_6ghz_to_str(enum reg_subdomains_6ghz sub_id)
++{
++	switch (sub_id) {
++	case EMPTY_6GHZ:
++		return "N/A";
++	case FCC1_CLIENT_LPI_REGULAR_6GHZ:
++		return "FCC1_CLIENT_LPI_REGULAR_6GHZ";
++	case FCC1_CLIENT_SP_6GHZ:
++		return "FCC1_CLIENT_SP_6GHZ";
++	case FCC1_AP_LPI_6GHZ:
++		return "FCC1_AP_LPI_6GHZ/FCC1_CLIENT_LPI_SUBORDINATE";
++	case FCC1_AP_SP_6GHZ:
++		return "FCC1_AP_SP_6GHZ";
++	case ETSI1_LPI_6GHZ:
++		return "ETSI1_LPI_6GHZ";
++	case ETSI1_VLP_6GHZ:
++		return "ETSI1_VLP_6GHZ";
++	case ETSI2_LPI_6GHZ:
++		return "ETSI2_LPI_6GHZ";
++	case ETSI2_VLP_6GHZ:
++		return "ETSI2_VLP_6GHZ";
++	case APL1_LPI_6GHZ:
++		return "APL1_LPI_6GHZ";
++	case APL1_VLP_6GHZ:
++		return "APL1_VLP_6GHZ";
++	}
++
++	return "unknown sub reg id";
++}
++
++enum reg_super_domain_6ghz {
++	FCC1_6GHZ = 0x01,
++	ETSI1_6GHZ = 0x02,
++	ETSI2_6GHZ = 0x03,
++	APL1_6GHZ = 0x04,
++	FCC1_6GHZ_CL = 0x05,
++
++	/* add super domain above, handle it in
++	 * ath11k_super_reg_6ghz_to_str()
++	 */
+ };
+ 
++static inline const char *
++ath11k_super_reg_6ghz_to_str(enum reg_super_domain_6ghz domain_id)
++{
++	switch (domain_id) {
++	case FCC1_6GHZ:
++		return "FCC1_6GHZ";
++	case ETSI1_6GHZ:
++		return "ETSI1_6GHZ";
++	case ETSI2_6GHZ:
++		return "ETSI2_6GHZ";
++	case APL1_6GHZ:
++		return "APL1_6GHZ";
++	case FCC1_6GHZ_CL:
++		return "FCC1_6GHZ_CL";
++	}
++
++	return "unknown domain id";
++}
++
+ struct cur_reg_rule {
+ 	u16 start_freq;
+ 	u16 end_freq;
diff --git a/package/kernel/mac80211/patches/ath11k/0046-wifi-ath11k-Replace-fake-flex-array-with-flexible-ar.patch b/package/kernel/mac80211/patches/ath11k/0046-wifi-ath11k-Replace-fake-flex-array-with-flexible-ar.patch
new file mode 100644
index 00000000000000..bd1617856442bd
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0046-wifi-ath11k-Replace-fake-flex-array-with-flexible-ar.patch
@@ -0,0 +1,246 @@
+From 3b1088a09ec9438523c251d8435e78988824bc0d Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
+Date: Tue, 7 Mar 2023 16:22:39 -0600
+Subject: [PATCH] wifi: ath11k: Replace fake flex-array with flexible-array
+ member
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Zero-length arrays as fake flexible arrays are deprecated and we are
+moving towards adopting C99 flexible-array members instead.
+
+Address 25 of the following warnings found with GCC-13 and
+-fstrict-flex-arrays=3 enabled:
+drivers/net/wireless/ath/ath11k/debugfs_htt_stats.c:30:51: warning: array subscript <unknown> is outside array bounds of ‘const u32[0]’ {aka ‘const unsigned int[]’} [-Warray-bounds=]
+
+This helps with the ongoing efforts to tighten the FORTIFY_SOURCE
+routines on memcpy() and help us make progress towards globally
+enabling -fstrict-flex-arrays=3 [1].
+
+Link: https://github.com/KSPP/linux/issues/21
+Link: https://github.com/KSPP/linux/issues/266
+Link: https://gcc.gnu.org/pipermail/gcc-patches/2022-October/602902.html [1]
+Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/ZAe5L5DtmsQxzqRH@work
+---
+ .../wireless/ath/ath11k/debugfs_htt_stats.h   | 73 +++++++++++--------
+ 1 file changed, 43 insertions(+), 30 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.h
++++ b/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.h
+@@ -143,7 +143,8 @@ enum htt_tx_pdev_underrun_enum {
+ /* Bytes stored in little endian order */
+ /* Length should be multiple of DWORD */
+ struct htt_stats_string_tlv {
+-	u32 data[0]; /* Can be variable length */
++	 /* Can be variable length */
++	DECLARE_FLEX_ARRAY(u32, data);
+ } __packed;
+ 
+ #define HTT_STATS_MAC_ID	GENMASK(7, 0)
+@@ -205,27 +206,32 @@ struct htt_tx_pdev_stats_cmn_tlv {
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_pdev_stats_urrn_tlv_v {
+-	u32 urrn_stats[0]; /* HTT_TX_PDEV_MAX_URRN_STATS */
++	/* HTT_TX_PDEV_MAX_URRN_STATS */
++	DECLARE_FLEX_ARRAY(u32, urrn_stats);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_pdev_stats_flush_tlv_v {
+-	u32 flush_errs[0]; /* HTT_TX_PDEV_MAX_FLUSH_REASON_STATS */
++	/* HTT_TX_PDEV_MAX_FLUSH_REASON_STATS */
++	DECLARE_FLEX_ARRAY(u32, flush_errs);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_pdev_stats_sifs_tlv_v {
+-	u32 sifs_status[0]; /* HTT_TX_PDEV_MAX_SIFS_BURST_STATS */
++	/* HTT_TX_PDEV_MAX_SIFS_BURST_STATS */
++	DECLARE_FLEX_ARRAY(u32, sifs_status);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_pdev_stats_phy_err_tlv_v {
+-	u32  phy_errs[0]; /* HTT_TX_PDEV_MAX_PHY_ERR_STATS */
++	/* HTT_TX_PDEV_MAX_PHY_ERR_STATS */
++	DECLARE_FLEX_ARRAY(u32, phy_errs);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_pdev_stats_sifs_hist_tlv_v {
+-	u32 sifs_hist_status[0]; /* HTT_TX_PDEV_SIFS_BURST_HIST_STATS */
++	/* HTT_TX_PDEV_SIFS_BURST_HIST_STATS */
++	DECLARE_FLEX_ARRAY(u32, sifs_hist_status);
+ };
+ 
+ struct htt_tx_pdev_stats_tx_ppdu_stats_tlv_v {
+@@ -590,20 +596,20 @@ struct htt_tx_hwq_difs_latency_stats_tlv
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_hwq_cmd_result_stats_tlv_v {
+-	/* Histogram of sched cmd result */
+-	u32 cmd_result[0]; /* HTT_TX_HWQ_MAX_CMD_RESULT_STATS */
++	/* Histogram of sched cmd result, HTT_TX_HWQ_MAX_CMD_RESULT_STATS */
++	DECLARE_FLEX_ARRAY(u32, cmd_result);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_hwq_cmd_stall_stats_tlv_v {
+-	/* Histogram of various pause conitions */
+-	u32 cmd_stall_status[0]; /* HTT_TX_HWQ_MAX_CMD_STALL_STATS */
++	/* Histogram of various pause conitions, HTT_TX_HWQ_MAX_CMD_STALL_STATS */
++	DECLARE_FLEX_ARRAY(u32, cmd_stall_status);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_hwq_fes_result_stats_tlv_v {
+-	/* Histogram of number of user fes result */
+-	u32 fes_result[0]; /* HTT_TX_HWQ_MAX_FES_RESULT_STATS */
++	/* Histogram of number of user fes result, HTT_TX_HWQ_MAX_FES_RESULT_STATS */
++	DECLARE_FLEX_ARRAY(u32, fes_result);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size
+@@ -635,8 +641,8 @@ struct htt_tx_hwq_tried_mpdu_cnt_hist_tl
+  * #define WAL_TXOP_USED_HISTOGRAM_INTERVAL 1000 ( 1 ms )
+  */
+ struct htt_tx_hwq_txop_used_cnt_hist_tlv_v {
+-	/* Histogram of txop used cnt */
+-	u32 txop_used_cnt_hist[0]; /* HTT_TX_HWQ_TXOP_USED_CNT_HIST */
++	/* Histogram of txop used cnt,  HTT_TX_HWQ_TXOP_USED_CNT_HIST */
++	DECLARE_FLEX_ARRAY(u32, txop_used_cnt_hist);
+ };
+ 
+ /* == TX SELFGEN STATS == */
+@@ -804,17 +810,20 @@ struct htt_tx_pdev_mpdu_stats_tlv {
+ /* == TX SCHED STATS == */
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_sched_txq_cmd_posted_tlv_v {
+-	u32 sched_cmd_posted[0]; /* HTT_TX_PDEV_SCHED_TX_MODE_MAX */
++	/* HTT_TX_PDEV_SCHED_TX_MODE_MAX */
++	DECLARE_FLEX_ARRAY(u32, sched_cmd_posted);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_sched_txq_cmd_reaped_tlv_v {
+-	u32 sched_cmd_reaped[0]; /* HTT_TX_PDEV_SCHED_TX_MODE_MAX */
++	/* HTT_TX_PDEV_SCHED_TX_MODE_MAX */
++	DECLARE_FLEX_ARRAY(u32, sched_cmd_reaped);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_sched_txq_sched_order_su_tlv_v {
+-	u32 sched_order_su[0]; /* HTT_TX_PDEV_NUM_SCHED_ORDER_LOG */
++	/* HTT_TX_PDEV_NUM_SCHED_ORDER_LOG */
++	DECLARE_FLEX_ARRAY(u32, sched_order_su);
+ };
+ 
+ enum htt_sched_txq_sched_ineligibility_tlv_enum {
+@@ -842,7 +851,7 @@ enum htt_sched_txq_sched_ineligibility_t
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_sched_txq_sched_ineligibility_tlv_v {
+ 	/* indexed by htt_sched_txq_sched_ineligibility_tlv_enum */
+-	u32 sched_ineligibility[0];
++	DECLARE_FLEX_ARRAY(u32, sched_ineligibility);
+ };
+ 
+ #define	HTT_TX_PDEV_STATS_SCHED_PER_TXQ_MAC_ID	GENMASK(7, 0)
+@@ -888,18 +897,20 @@ struct htt_stats_tx_sched_cmn_tlv {
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_tqm_gen_mpdu_stats_tlv_v {
+-	u32 gen_mpdu_end_reason[0]; /* HTT_TX_TQM_MAX_GEN_MPDU_END_REASON */
++	/* HTT_TX_TQM_MAX_GEN_MPDU_END_REASON */
++	DECLARE_FLEX_ARRAY(u32, gen_mpdu_end_reason);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_tqm_list_mpdu_stats_tlv_v {
+-	u32 list_mpdu_end_reason[0]; /* HTT_TX_TQM_MAX_LIST_MPDU_END_REASON */
++	 /* HTT_TX_TQM_MAX_LIST_MPDU_END_REASON */
++	DECLARE_FLEX_ARRAY(u32, list_mpdu_end_reason);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_tqm_list_mpdu_cnt_tlv_v {
+-	u32 list_mpdu_cnt_hist[0];
+-			/* HTT_TX_TQM_MAX_LIST_MPDU_CNT_HISTOGRAM_BINS */
++	/* HTT_TX_TQM_MAX_LIST_MPDU_CNT_HISTOGRAM_BINS */
++	DECLARE_FLEX_ARRAY(u32, list_mpdu_cnt_hist);
+ };
+ 
+ struct htt_tx_tqm_pdev_stats_tlv_v {
+@@ -1098,7 +1109,7 @@ struct htt_tx_de_compl_stats_tlv {
+  *                               ENTRIES_PER_BIN_COUNT)
+  */
+ struct htt_tx_de_fw2wbm_ring_full_hist_tlv {
+-	u32 fw2wbm_ring_full_hist[0];
++	DECLARE_FLEX_ARRAY(u32, fw2wbm_ring_full_hist);
+ };
+ 
+ struct htt_tx_de_cmn_stats_tlv {
+@@ -1151,7 +1162,7 @@ struct htt_ring_if_cmn_tlv {
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_sfm_client_user_tlv_v {
+ 	/* Number of DWORDS used per user and per client */
+-	u32 dwords_used_by_user_n[0];
++	DECLARE_FLEX_ARRAY(u32, dwords_used_by_user_n);
+ };
+ 
+ struct htt_sfm_client_tlv {
+@@ -1436,12 +1447,14 @@ struct htt_rx_soc_fw_stats_tlv {
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_rx_soc_fw_refill_ring_empty_tlv_v {
+-	u32 refill_ring_empty_cnt[0]; /* HTT_RX_STATS_REFILL_MAX_RING */
++	/* HTT_RX_STATS_REFILL_MAX_RING */
++	DECLARE_FLEX_ARRAY(u32, refill_ring_empty_cnt);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_rx_soc_fw_refill_ring_num_refill_tlv_v {
+-	u32 refill_ring_num_refill[0]; /* HTT_RX_STATS_REFILL_MAX_RING */
++	/* HTT_RX_STATS_REFILL_MAX_RING */
++	DECLARE_FLEX_ARRAY(u32, refill_ring_num_refill);
+ };
+ 
+ /* RXDMA error code from WBM released packets */
+@@ -1473,7 +1486,7 @@ enum htt_rx_rxdma_error_code_enum {
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_rx_soc_fw_refill_ring_num_rxdma_err_tlv_v {
+-	u32 rxdma_err[0]; /* HTT_RX_RXDMA_MAX_ERR_CODE */
++	DECLARE_FLEX_ARRAY(u32, rxdma_err); /* HTT_RX_RXDMA_MAX_ERR_CODE */
+ };
+ 
+ /* REO error code from WBM released packets */
+@@ -1505,7 +1518,7 @@ enum htt_rx_reo_error_code_enum {
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_rx_soc_fw_refill_ring_num_reo_err_tlv_v {
+-	u32 reo_err[0]; /* HTT_RX_REO_MAX_ERR_CODE */
++	DECLARE_FLEX_ARRAY(u32, reo_err); /* HTT_RX_REO_MAX_ERR_CODE */
+ };
+ 
+ /* == RX PDEV STATS == */
+@@ -1622,13 +1635,13 @@ struct htt_rx_pdev_fw_stats_phy_err_tlv
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_rx_pdev_fw_ring_mpdu_err_tlv_v {
+ 	/* Num error MPDU for each RxDMA error type  */
+-	u32 fw_ring_mpdu_err[0]; /* HTT_RX_STATS_RXDMA_MAX_ERR */
++	DECLARE_FLEX_ARRAY(u32, fw_ring_mpdu_err); /* HTT_RX_STATS_RXDMA_MAX_ERR */
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_rx_pdev_fw_mpdu_drop_tlv_v {
+ 	/* Num MPDU dropped  */
+-	u32 fw_mpdu_drop[0]; /* HTT_RX_STATS_FW_DROP_REASON_MAX */
++	DECLARE_FLEX_ARRAY(u32, fw_mpdu_drop); /* HTT_RX_STATS_FW_DROP_REASON_MAX */
+ };
+ 
+ #define HTT_PDEV_CCA_STATS_TX_FRAME_INFO_PRESENT               (0x1)
diff --git a/package/kernel/mac80211/patches/ath11k/0047-wifi-ath11k-fix-deinitialization-of-firmware-resourc.patch b/package/kernel/mac80211/patches/ath11k/0047-wifi-ath11k-fix-deinitialization-of-firmware-resourc.patch
new file mode 100644
index 00000000000000..eec11f50e3cea5
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0047-wifi-ath11k-fix-deinitialization-of-firmware-resourc.patch
@@ -0,0 +1,79 @@
+From 5a78ac33e3cb8822da64dd1af196e83664b332b0 Mon Sep 17 00:00:00 2001
+From: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Date: Thu, 9 Mar 2023 15:23:08 +0530
+Subject: [PATCH] wifi: ath11k: fix deinitialization of firmware resources
+
+Currently, in ath11k_ahb_fw_resources_init(), iommu domain
+mapping is done only for the chipsets having fixed firmware
+memory. Also, for such chipsets, mapping is done only if it
+does not have TrustZone support.
+
+During deinitialization, only if TrustZone support is not there,
+iommu is unmapped back. However, for non fixed firmware memory
+chipsets, TrustZone support is not there and this makes the
+condition check to true and it tries to unmap the memory which
+was not mapped during initialization.
+
+This leads to the following trace -
+
+[   83.198790] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
+[   83.259537] Modules linked in: ath11k_ahb ath11k qmi_helpers
+.. snip ..
+[   83.280286] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[   83.287228] pc : __iommu_unmap+0x30/0x140
+[   83.293907] lr : iommu_unmap+0x5c/0xa4
+[   83.298072] sp : ffff80000b3abad0
+.. snip ..
+[   83.369175] Call trace:
+[   83.376282]  __iommu_unmap+0x30/0x140
+[   83.378541]  iommu_unmap+0x5c/0xa4
+[   83.382360]  ath11k_ahb_fw_resource_deinit.part.12+0x2c/0xac [ath11k_ahb]
+[   83.385666]  ath11k_ahb_free_resources+0x140/0x17c [ath11k_ahb]
+[   83.392521]  ath11k_ahb_shutdown+0x34/0x40 [ath11k_ahb]
+[   83.398248]  platform_shutdown+0x20/0x2c
+[   83.403455]  device_shutdown+0x16c/0x1c4
+[   83.407621]  kernel_restart_prepare+0x34/0x3c
+[   83.411529]  kernel_restart+0x14/0x74
+[   83.415781]  __do_sys_reboot+0x1c4/0x22c
+[   83.419427]  __arm64_sys_reboot+0x1c/0x24
+[   83.423420]  invoke_syscall+0x44/0xfc
+[   83.427326]  el0_svc_common.constprop.3+0xac/0xe8
+[   83.430974]  do_el0_svc+0xa0/0xa8
+[   83.435659]  el0_svc+0x1c/0x44
+[   83.438957]  el0t_64_sync_handler+0x60/0x144
+[   83.441910]  el0t_64_sync+0x15c/0x160
+[   83.446343] Code: aa0103f4 f9400001 f90027a1 d2800001 (f94006a0)
+[   83.449903] ---[ end trace 0000000000000000 ]---
+
+This can be reproduced by probing an AHB chipset which is not
+having a fixed memory region. During reboot (or rmmod) trace
+can be seen.
+
+Fix this issue by adding a condition check on firmware fixed memory
+hw_param as done in the counter initialization function.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Fixes: f9eec4947add ("ath11k: Add support for targets without trustzone")
+Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230309095308.24937-1-quic_adisi@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/ahb.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -1078,6 +1078,12 @@ static int ath11k_ahb_fw_resource_deinit
+ 	struct iommu_domain *iommu;
+ 	size_t unmapped_size;
+ 
++	/* Chipsets not requiring MSA would have not initialized
++	 * MSA resources, return success in such cases.
++	 */
++	if (!ab->hw_params.fixed_fw_mem)
++		return 0;
++
+ 	if (ab_ahb->fw.use_tz)
+ 		return 0;
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0048-wifi-ath11k-fix-BUFFER_DONE-read-on-monitor-ring-rx-.patch b/package/kernel/mac80211/patches/ath11k/0048-wifi-ath11k-fix-BUFFER_DONE-read-on-monitor-ring-rx-.patch
new file mode 100644
index 00000000000000..3e22645331be9f
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0048-wifi-ath11k-fix-BUFFER_DONE-read-on-monitor-ring-rx-.patch
@@ -0,0 +1,130 @@
+From 68e93ac5a31d4975b25f819b2dfe914c72abc3bb Mon Sep 17 00:00:00 2001
+From: Harshitha Prem <quic_hprem@quicinc.com>
+Date: Wed, 15 Mar 2023 12:24:43 +0200
+Subject: [PATCH] wifi: ath11k: fix BUFFER_DONE read on monitor ring rx  buffer
+
+Perform dma_sync_single_for_cpu() on monitor ring rx buffer before
+reading BUFFER_DONE tag and do dma_unmap_single() only after device
+had set BUFFER_DONE tag to the buffer.
+
+Also when BUFFER_DONE tag is not set, allow the buffer to get read
+next time without freeing skb.
+
+This helps to fix AP+Monitor VAP with flood traffic scenario to see
+monitor ring rx buffer overrun missing BUFFER_DONE tag to be set.
+
+Also remove redundant rx dma buf free performed on DP
+rx_mon_status_refill_ring.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sathishkumar Muruganandam <quic_murugana@quicinc.com>
+Signed-off-by: Harshitha Prem <quic_hprem@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230309164434.32660-1-quic_hprem@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 57 ++++++++++---------------
+ 1 file changed, 23 insertions(+), 34 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -435,7 +435,6 @@ fail_free_skb:
+ static int ath11k_dp_rxdma_buf_ring_free(struct ath11k *ar,
+ 					 struct dp_rxdma_ring *rx_ring)
+ {
+-	struct ath11k_pdev_dp *dp = &ar->dp;
+ 	struct sk_buff *skb;
+ 	int buf_id;
+ 
+@@ -453,28 +452,6 @@ static int ath11k_dp_rxdma_buf_ring_free
+ 	idr_destroy(&rx_ring->bufs_idr);
+ 	spin_unlock_bh(&rx_ring->idr_lock);
+ 
+-	/* if rxdma1_enable is false, mon_status_refill_ring
+-	 * isn't setup, so don't clean.
+-	 */
+-	if (!ar->ab->hw_params.rxdma1_enable)
+-		return 0;
+-
+-	rx_ring = &dp->rx_mon_status_refill_ring[0];
+-
+-	spin_lock_bh(&rx_ring->idr_lock);
+-	idr_for_each_entry(&rx_ring->bufs_idr, skb, buf_id) {
+-		idr_remove(&rx_ring->bufs_idr, buf_id);
+-		/* XXX: Understand where internal driver does this dma_unmap
+-		 * of rxdma_buffer.
+-		 */
+-		dma_unmap_single(ar->ab->dev, ATH11K_SKB_RXCB(skb)->paddr,
+-				 skb->len + skb_tailroom(skb), DMA_BIDIRECTIONAL);
+-		dev_kfree_skb_any(skb);
+-	}
+-
+-	idr_destroy(&rx_ring->bufs_idr);
+-	spin_unlock_bh(&rx_ring->idr_lock);
+-
+ 	return 0;
+ }
+ 
+@@ -3029,39 +3006,51 @@ static int ath11k_dp_rx_reap_mon_status_
+ 
+ 			spin_lock_bh(&rx_ring->idr_lock);
+ 			skb = idr_find(&rx_ring->bufs_idr, buf_id);
++			spin_unlock_bh(&rx_ring->idr_lock);
++
+ 			if (!skb) {
+ 				ath11k_warn(ab, "rx monitor status with invalid buf_id %d\n",
+ 					    buf_id);
+-				spin_unlock_bh(&rx_ring->idr_lock);
+ 				pmon->buf_state = DP_MON_STATUS_REPLINISH;
+ 				goto move_next;
+ 			}
+ 
+-			idr_remove(&rx_ring->bufs_idr, buf_id);
+-			spin_unlock_bh(&rx_ring->idr_lock);
+-
+ 			rxcb = ATH11K_SKB_RXCB(skb);
+ 
+-			dma_unmap_single(ab->dev, rxcb->paddr,
+-					 skb->len + skb_tailroom(skb),
+-					 DMA_FROM_DEVICE);
++			dma_sync_single_for_cpu(ab->dev, rxcb->paddr,
++						skb->len + skb_tailroom(skb),
++						DMA_FROM_DEVICE);
+ 
+ 			tlv = (struct hal_tlv_hdr *)skb->data;
+ 			if (FIELD_GET(HAL_TLV_HDR_TAG, tlv->tl) !=
+ 					HAL_RX_STATUS_BUFFER_DONE) {
+-				ath11k_warn(ab, "mon status DONE not set %lx\n",
++				ath11k_warn(ab, "mon status DONE not set %lx, buf_id %d\n",
+ 					    FIELD_GET(HAL_TLV_HDR_TAG,
+-						      tlv->tl));
+-				dev_kfree_skb_any(skb);
++						      tlv->tl), buf_id);
++				/* If done status is missing, hold onto status
++				 * ring until status is done for this status
++				 * ring buffer.
++				 * Keep HP in mon_status_ring unchanged,
++				 * and break from here.
++				 * Check status for same buffer for next time
++				 */
+ 				pmon->buf_state = DP_MON_STATUS_NO_DMA;
+-				goto move_next;
++				break;
+ 			}
+ 
++			spin_lock_bh(&rx_ring->idr_lock);
++			idr_remove(&rx_ring->bufs_idr, buf_id);
++			spin_unlock_bh(&rx_ring->idr_lock);
+ 			if (ab->hw_params.full_monitor_mode) {
+ 				ath11k_dp_rx_mon_update_status_buf_state(pmon, tlv);
+ 				if (paddr == pmon->mon_status_paddr)
+ 					pmon->buf_state = DP_MON_STATUS_MATCH;
+ 			}
++
++			dma_unmap_single(ab->dev, rxcb->paddr,
++					 skb->len + skb_tailroom(skb),
++					 DMA_FROM_DEVICE);
++
+ 			__skb_queue_tail(skb_list, skb);
+ 		} else {
+ 			pmon->buf_state = DP_MON_STATUS_REPLINISH;
diff --git a/package/kernel/mac80211/patches/ath11k/0049-wifi-ath11k-Optimize-6-GHz-scan-time.patch b/package/kernel/mac80211/patches/ath11k/0049-wifi-ath11k-Optimize-6-GHz-scan-time.patch
new file mode 100644
index 00000000000000..f468990feb7831
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0049-wifi-ath11k-Optimize-6-GHz-scan-time.patch
@@ -0,0 +1,101 @@
+From 8b4d2f080afbd4280ecca0f4b3ceea943a7a86d0 Mon Sep 17 00:00:00 2001
+From: Manikanta Pubbisetty <quic_mpubbise@quicinc.com>
+Date: Thu, 23 Mar 2023 11:39:13 +0530
+Subject: [PATCH] wifi: ath11k: Optimize 6 GHz scan time
+
+Currently, time taken to scan all supported channels on WCN6750
+is ~8 seconds and connection time is almost 10 seconds. WCN6750
+supports three Wi-Fi bands (i.e., 2.4/5/6 GHz) and the numbers of
+channels for scan come around ~100 channels (default case).
+Since the chip doesn't have support for DBS (Dual Band Simultaneous),
+scans cannot be parallelized resulting in longer scan times.
+
+Among the 100 odd channels, ~60 channels are in 6 GHz band. Therefore,
+optimizing the scan for 6 GHz channels will bring down the overall
+scan time.
+
+WCN6750 firmware has support to scan a 6 GHz channel based on co-located
+AP information i.e., RNR IE which is found in the legacy 2.4/5 GHz scan
+results. When a scan request with all supported channel list is enqueued
+to the firmware, then based on WMI_SCAN_CHAN_FLAG_SCAN_ONLY_IF_RNR_FOUND
+scan channel flag, firmware will scan only those 6 GHz channels for which
+RNR IEs are found in the legacy scan results.
+
+In the proposed design, based on NL80211_SCAN_FLAG_COLOCATED_6GHZ scan
+flag, driver will set the WMI_SCAN_CHAN_FLAG_SCAN_ONLY_IF_RNR_FOUND flag
+for non-PSC channels. Since there is high probability to find 6 GHz APs
+on PSC channels, these channels are always scanned. Only non-PSC channels
+are selectively scanned based on cached RNR information from the legacy
+scan results.
+
+If NL80211_SCAN_FLAG_COLOCATED_6GHZ is not set in the scan flags,
+then scan will happen on all supported channels (default behavior).
+
+With these optimizations, scan time is improved by 1.5-1.8 seconds on
+WCN6750. Similar savings have been observed on WCN6855.
+
+Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-00887-QCAMSLSWPLZ-1
+Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.16
+
+Signed-off-by: Manikanta Pubbisetty <quic_mpubbise@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230323060913.10097-1-quic_mpubbise@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 25 +++++++++++++++++++++++--
+ drivers/net/wireless/ath/ath11k/wmi.h |  4 ++++
+ 2 files changed, 27 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -3819,8 +3819,29 @@ static int ath11k_mac_op_hw_scan(struct
+ 			goto exit;
+ 		}
+ 
+-		for (i = 0; i < arg->num_chan; i++)
+-			arg->chan_list[i] = req->channels[i]->center_freq;
++		for (i = 0; i < arg->num_chan; i++) {
++			if (test_bit(WMI_TLV_SERVICE_SCAN_CONFIG_PER_CHANNEL,
++				     ar->ab->wmi_ab.svc_map)) {
++				arg->chan_list[i] =
++					u32_encode_bits(req->channels[i]->center_freq,
++							WMI_SCAN_CONFIG_PER_CHANNEL_MASK);
++
++				/* If NL80211_SCAN_FLAG_COLOCATED_6GHZ is set in scan
++				 * flags, then scan all PSC channels in 6 GHz band and
++				 * those non-PSC channels where RNR IE is found during
++				 * the legacy 2.4/5 GHz scan.
++				 * If NL80211_SCAN_FLAG_COLOCATED_6GHZ is not set,
++				 * then all channels in 6 GHz will be scanned.
++				 */
++				if (req->channels[i]->band == NL80211_BAND_6GHZ &&
++				    req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ &&
++				    !cfg80211_channel_is_psc(req->channels[i]))
++					arg->chan_list[i] |=
++						WMI_SCAN_CH_FLAG_SCAN_ONLY_IF_RNR_FOUND;
++			} else {
++				arg->chan_list[i] = req->channels[i]->center_freq;
++			}
++		}
+ 	}
+ 
+ 	if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -2100,6 +2100,7 @@ enum wmi_tlv_service {
+ 
+ 	/* The second 128 bits */
+ 	WMI_MAX_EXT_SERVICE = 256,
++	WMI_TLV_SERVICE_SCAN_CONFIG_PER_CHANNEL = 265,
+ 	WMI_TLV_SERVICE_REG_CC_EXT_EVENT_SUPPORT = 281,
+ 	WMI_TLV_SERVICE_BIOS_SAR_SUPPORT = 326,
+ 
+@@ -3249,6 +3250,9 @@ struct  wmi_start_scan_cmd {
+ #define WMI_SCAN_DWELL_MODE_SHIFT        21
+ #define WMI_SCAN_FLAG_EXT_PASSIVE_SCAN_START_TIME_ENHANCE   0x00000800
+ 
++#define WMI_SCAN_CONFIG_PER_CHANNEL_MASK	GENMASK(19, 0)
++#define WMI_SCAN_CH_FLAG_SCAN_ONLY_IF_RNR_FOUND	BIT(20)
++
+ enum {
+ 	WMI_SCAN_DWELL_MODE_DEFAULT      = 0,
+ 	WMI_SCAN_DWELL_MODE_CONSERVATIVE = 1,
diff --git a/package/kernel/mac80211/patches/ath11k/0050-wifi-ath11k-Configure-the-FTM-responder-role-using-f.patch b/package/kernel/mac80211/patches/ath11k/0050-wifi-ath11k-Configure-the-FTM-responder-role-using-f.patch
new file mode 100644
index 00000000000000..bca08b177fd11c
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0050-wifi-ath11k-Configure-the-FTM-responder-role-using-f.patch
@@ -0,0 +1,117 @@
+From 813968c24126cc5c8320cd5db0e262069a535063 Mon Sep 17 00:00:00 2001
+From: Ganesh Babu Jothiram <quic_gjothira@quicinc.com>
+Date: Fri, 24 Mar 2023 16:57:00 +0200
+Subject: [PATCH] wifi: ath11k: Configure the FTM responder role using firmware
+ capability flag
+
+Fine Time Measurement(FTM) is offloaded feature to firmware.
+Hence, the configuration of FTM responder role is done using
+firmware capability flag instead of hw param.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Ganesh Babu Jothiram <quic_gjothira@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230317072034.8217-1-quic_gjothira@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c | 8 --------
+ drivers/net/wireless/ath/ath11k/hw.h   | 1 -
+ drivers/net/wireless/ath/ath11k/mac.c  | 4 ++--
+ 3 files changed, 2 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -116,7 +116,6 @@ static const struct ath11k_hw_params ath
+ 		.tcl_ring_retry = true,
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+-		.ftm_responder = true,
+ 	},
+ 	{
+ 		.hw_rev = ATH11K_HW_IPQ6018_HW10,
+@@ -199,7 +198,6 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = false,
+-		.ftm_responder = true,
+ 	},
+ 	{
+ 		.name = "qca6390 hw2.0",
+@@ -284,7 +282,6 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = true,
+-		.ftm_responder = false,
+ 	},
+ 	{
+ 		.name = "qcn9074 hw1.0",
+@@ -366,7 +363,6 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = false,
+-		.ftm_responder = true,
+ 	},
+ 	{
+ 		.name = "wcn6855 hw2.0",
+@@ -451,7 +447,6 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = true,
+-		.ftm_responder = false,
+ 	},
+ 	{
+ 		.name = "wcn6855 hw2.1",
+@@ -534,7 +529,6 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = true,
+-		.ftm_responder = false,
+ 	},
+ 	{
+ 		.name = "wcn6750 hw1.0",
+@@ -615,7 +609,6 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE_WCN6750,
+ 		.smp2p_wow_exit = true,
+ 		.support_fw_mac_sequence = true,
+-		.ftm_responder = false,
+ 	},
+ 	{
+ 		.hw_rev = ATH11K_HW_IPQ5018_HW10,
+@@ -695,7 +688,6 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = false,
+-		.ftm_responder = true,
+ 	},
+ };
+ 
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -224,7 +224,6 @@ struct ath11k_hw_params {
+ 	u32 tx_ring_size;
+ 	bool smp2p_wow_exit;
+ 	bool support_fw_mac_sequence;
+-	bool ftm_responder;
+ };
+ 
+ struct ath11k_hw_ops {
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -3538,7 +3538,7 @@ static void ath11k_mac_op_bss_info_chang
+ 
+ 	if (changed & BSS_CHANGED_FTM_RESPONDER &&
+ 	    arvif->ftm_responder != info->ftm_responder &&
+-	    ar->ab->hw_params.ftm_responder &&
++	    test_bit(WMI_TLV_SERVICE_RTT, ar->ab->wmi_ab.svc_map) &&
+ 	    (vif->type == NL80211_IFTYPE_AP ||
+ 	     vif->type == NL80211_IFTYPE_MESH_POINT)) {
+ 		arvif->ftm_responder = info->ftm_responder;
+@@ -9234,7 +9234,7 @@ static int __ath11k_mac_register(struct
+ 	wiphy_ext_feature_set(ar->hw->wiphy,
+ 			      NL80211_EXT_FEATURE_SET_SCAN_DWELL);
+ 
+-	if (ab->hw_params.ftm_responder)
++	if (test_bit(WMI_TLV_SERVICE_RTT, ar->ab->wmi_ab.svc_map))
+ 		wiphy_ext_feature_set(ar->hw->wiphy,
+ 				      NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0051-wifi-ath11k-fix-rssi-station-dump-not-updated-in-QCN.patch b/package/kernel/mac80211/patches/ath11k/0051-wifi-ath11k-fix-rssi-station-dump-not-updated-in-QCN.patch
new file mode 100644
index 00000000000000..835dece1fe715d
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0051-wifi-ath11k-fix-rssi-station-dump-not-updated-in-QCN.patch
@@ -0,0 +1,158 @@
+From 031ffa6c2cd305a57ccc6d610f2decd956b2e7f6 Mon Sep 17 00:00:00 2001
+From: P Praneesh <quic_ppranees@quicinc.com>
+Date: Fri, 24 Mar 2023 16:57:00 +0200
+Subject: [PATCH] wifi: ath11k: fix rssi station dump not updated in QCN9074
+
+In QCN9074, station dump signal values display default value which
+is -95 dbm, since there is firmware header change for HAL_RX_MPDU_START
+between QCN9074 and IPQ8074 which cause wrong peer_id fetch from msdu.
+Fix this by updating hal_rx_mpdu_info with corresponding QCN9074 tlv
+format.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01695-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230320110312.20639-1-quic_ppranees@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/hal_rx.c | 10 ++++++++-
+ drivers/net/wireless/ath/ath11k/hal_rx.h | 18 +++++++++++++++-
+ drivers/net/wireless/ath/ath11k/hw.c     | 27 ++++++++++++++++--------
+ drivers/net/wireless/ath/ath11k/hw.h     |  2 +-
+ 4 files changed, 45 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.c
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
+@@ -865,6 +865,12 @@ ath11k_hal_rx_populate_mu_user_info(void
+ 	ath11k_hal_rx_populate_byte_count(rx_tlv, ppdu_info, rx_user_status);
+ }
+ 
++static u16 ath11k_hal_rx_mpduinfo_get_peerid(struct ath11k_base *ab,
++					     struct hal_rx_mpdu_info *mpdu_info)
++{
++	return ab->hw_params.hw_ops->mpdu_info_get_peerid(mpdu_info);
++}
++
+ static enum hal_rx_mon_status
+ ath11k_hal_rx_parse_mon_status_tlv(struct ath11k_base *ab,
+ 				   struct hal_rx_mon_ppdu_info *ppdu_info,
+@@ -1459,9 +1465,11 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+ 		break;
+ 	}
+ 	case HAL_RX_MPDU_START: {
++		struct hal_rx_mpdu_info *mpdu_info =
++				(struct hal_rx_mpdu_info *)tlv_data;
+ 		u16 peer_id;
+ 
+-		peer_id = ab->hw_params.hw_ops->mpdu_info_get_peerid(tlv_data);
++		peer_id = ath11k_hal_rx_mpduinfo_get_peerid(ab, mpdu_info);
+ 		if (peer_id)
+ 			ppdu_info->peer_id = peer_id;
+ 		break;
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.h
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.h
+@@ -405,7 +405,7 @@ struct hal_rx_phyrx_rssi_legacy_info {
+ #define HAL_RX_MPDU_INFO_INFO0_PEERID_WCN6855	GENMASK(15, 0)
+ #define HAL_RX_MPDU_INFO_INFO1_MPDU_LEN		GENMASK(13, 0)
+ 
+-struct hal_rx_mpdu_info {
++struct hal_rx_mpdu_info_ipq8074 {
+ 	__le32 rsvd0;
+ 	__le32 info0;
+ 	__le32 rsvd1[11];
+@@ -413,12 +413,28 @@ struct hal_rx_mpdu_info {
+ 	__le32 rsvd2[9];
+ } __packed;
+ 
++struct hal_rx_mpdu_info_qcn9074 {
++	__le32 rsvd0[10];
++	__le32 info0;
++	__le32 rsvd1[2];
++	__le32 info1;
++	__le32 rsvd2[9];
++} __packed;
++
+ struct hal_rx_mpdu_info_wcn6855 {
+ 	__le32 rsvd0[8];
+ 	__le32 info0;
+ 	__le32 rsvd1[14];
+ } __packed;
+ 
++struct hal_rx_mpdu_info {
++	union {
++		struct hal_rx_mpdu_info_ipq8074 ipq8074;
++		struct hal_rx_mpdu_info_qcn9074 qcn9074;
++		struct hal_rx_mpdu_info_wcn6855 wcn6855;
++	} u;
++} __packed;
++
+ #define HAL_RX_PPDU_END_DURATION	GENMASK(23, 0)
+ struct hal_rx_ppdu_end_duration {
+ 	__le32 rsvd0[9];
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -835,26 +835,35 @@ static void ath11k_hw_ipq5018_reo_setup(
+ 			   ring_hash_map);
+ }
+ 
+-static u16 ath11k_hw_ipq8074_mpdu_info_get_peerid(u8 *tlv_data)
++static u16
++ath11k_hw_ipq8074_mpdu_info_get_peerid(struct hal_rx_mpdu_info *mpdu_info)
+ {
+ 	u16 peer_id = 0;
+-	struct hal_rx_mpdu_info *mpdu_info =
+-		(struct hal_rx_mpdu_info *)tlv_data;
+ 
+ 	peer_id = FIELD_GET(HAL_RX_MPDU_INFO_INFO0_PEERID,
+-			    __le32_to_cpu(mpdu_info->info0));
++			    __le32_to_cpu(mpdu_info->u.ipq8074.info0));
+ 
+ 	return peer_id;
+ }
+ 
+-static u16 ath11k_hw_wcn6855_mpdu_info_get_peerid(u8 *tlv_data)
++static u16
++ath11k_hw_qcn9074_mpdu_info_get_peerid(struct hal_rx_mpdu_info *mpdu_info)
++{
++	u16 peer_id = 0;
++
++	peer_id = FIELD_GET(HAL_RX_MPDU_INFO_INFO0_PEERID,
++			    __le32_to_cpu(mpdu_info->u.qcn9074.info0));
++
++	return peer_id;
++}
++
++static u16
++ath11k_hw_wcn6855_mpdu_info_get_peerid(struct hal_rx_mpdu_info *mpdu_info)
+ {
+ 	u16 peer_id = 0;
+-	struct hal_rx_mpdu_info_wcn6855 *mpdu_info =
+-		(struct hal_rx_mpdu_info_wcn6855 *)tlv_data;
+ 
+ 	peer_id = FIELD_GET(HAL_RX_MPDU_INFO_INFO0_PEERID_WCN6855,
+-			    __le32_to_cpu(mpdu_info->info0));
++			    __le32_to_cpu(mpdu_info->u.wcn6855.info0));
+ 	return peer_id;
+ }
+ 
+@@ -1042,7 +1051,7 @@ const struct ath11k_hw_ops qcn9074_ops =
+ 	.rx_desc_get_attention = ath11k_hw_qcn9074_rx_desc_get_attention,
+ 	.rx_desc_get_msdu_payload = ath11k_hw_qcn9074_rx_desc_get_msdu_payload,
+ 	.reo_setup = ath11k_hw_ipq8074_reo_setup,
+-	.mpdu_info_get_peerid = ath11k_hw_ipq8074_mpdu_info_get_peerid,
++	.mpdu_info_get_peerid = ath11k_hw_qcn9074_mpdu_info_get_peerid,
+ 	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
+ 	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2,
+ 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -263,7 +263,7 @@ struct ath11k_hw_ops {
+ 	struct rx_attention *(*rx_desc_get_attention)(struct hal_rx_desc *desc);
+ 	u8 *(*rx_desc_get_msdu_payload)(struct hal_rx_desc *desc);
+ 	void (*reo_setup)(struct ath11k_base *ab);
+-	u16 (*mpdu_info_get_peerid)(u8 *tlv_data);
++	u16 (*mpdu_info_get_peerid)(struct hal_rx_mpdu_info *mpdu_info);
+ 	bool (*rx_desc_mac_addr2_valid)(struct hal_rx_desc *desc);
+ 	u8* (*rx_desc_mpdu_start_addr2)(struct hal_rx_desc *desc);
+ 	u32 (*get_ring_selector)(struct sk_buff *skb);
diff --git a/package/kernel/mac80211/patches/ath11k/0052-wifi-ath11k-Fix-invalid-management-rx-frame-length-i.patch b/package/kernel/mac80211/patches/ath11k/0052-wifi-ath11k-Fix-invalid-management-rx-frame-length-i.patch
new file mode 100644
index 00000000000000..0c1637fb04c2b9
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0052-wifi-ath11k-Fix-invalid-management-rx-frame-length-i.patch
@@ -0,0 +1,115 @@
+From 447b0398a9cd41ca343dfd43e555af92d6214487 Mon Sep 17 00:00:00 2001
+From: Bhagavathi Perumal S <quic_bperumal@quicinc.com>
+Date: Fri, 24 Mar 2023 16:57:00 +0200
+Subject: [PATCH] wifi: ath11k: Fix invalid management rx frame length issue
+
+The WMI management rx event has multiple arrays of TLVs, however the common
+WMI TLV parser won't handle multiple TLV tags of same type.
+So the multiple array tags of WMI management rx TLV is parsed incorrectly
+and the length calculated becomes wrong when the target sends multiple
+array tags.
+
+Add separate TLV parser to handle multiple arrays for WMI management rx
+TLV. This fixes invalid length issue when the target sends multiple array
+tags.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Bhagavathi Perumal S <quic_bperumal@quicinc.com>
+Co-developed-by: Nagarajan Maran <quic_nmaran@quicinc.com>
+Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230320133840.30162-1-quic_nmaran@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/wmi.c | 45 +++++++++++++++++++++------
+ 1 file changed, 35 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -82,6 +82,12 @@ struct wmi_tlv_fw_stats_parse {
+ 	bool chain_rssi_done;
+ };
+ 
++struct wmi_tlv_mgmt_rx_parse {
++	const struct wmi_mgmt_rx_hdr *fixed;
++	const u8 *frame_buf;
++	bool frame_buf_done;
++};
++
+ static const struct wmi_tlv_policy wmi_tlv_policies[] = {
+ 	[WMI_TAG_ARRAY_BYTE]
+ 		= { .min_len = 0 },
+@@ -5633,28 +5639,49 @@ static int ath11k_pull_vdev_stopped_para
+ 	return 0;
+ }
+ 
++static int ath11k_wmi_tlv_mgmt_rx_parse(struct ath11k_base *ab,
++					u16 tag, u16 len,
++					const void *ptr, void *data)
++{
++	struct wmi_tlv_mgmt_rx_parse *parse = data;
++
++	switch (tag) {
++	case WMI_TAG_MGMT_RX_HDR:
++		parse->fixed = ptr;
++		break;
++	case WMI_TAG_ARRAY_BYTE:
++		if (!parse->frame_buf_done) {
++			parse->frame_buf = ptr;
++			parse->frame_buf_done = true;
++		}
++		break;
++	}
++	return 0;
++}
++
+ static int ath11k_pull_mgmt_rx_params_tlv(struct ath11k_base *ab,
+ 					  struct sk_buff *skb,
+ 					  struct mgmt_rx_event_params *hdr)
+ {
+-	const void **tb;
++	struct wmi_tlv_mgmt_rx_parse parse = { };
+ 	const struct wmi_mgmt_rx_hdr *ev;
+ 	const u8 *frame;
+ 	int ret;
+ 
+-	tb = ath11k_wmi_tlv_parse_alloc(ab, skb->data, skb->len, GFP_ATOMIC);
+-	if (IS_ERR(tb)) {
+-		ret = PTR_ERR(tb);
+-		ath11k_warn(ab, "failed to parse tlv: %d\n", ret);
++	ret = ath11k_wmi_tlv_iter(ab, skb->data, skb->len,
++				  ath11k_wmi_tlv_mgmt_rx_parse,
++				  &parse);
++	if (ret) {
++		ath11k_warn(ab, "failed to parse mgmt rx tlv %d\n",
++			    ret);
+ 		return ret;
+ 	}
+ 
+-	ev = tb[WMI_TAG_MGMT_RX_HDR];
+-	frame = tb[WMI_TAG_ARRAY_BYTE];
++	ev = parse.fixed;
++	frame = parse.frame_buf;
+ 
+ 	if (!ev || !frame) {
+ 		ath11k_warn(ab, "failed to fetch mgmt rx hdr");
+-		kfree(tb);
+ 		return -EPROTO;
+ 	}
+ 
+@@ -5673,7 +5700,6 @@ static int ath11k_pull_mgmt_rx_params_tl
+ 
+ 	if (skb->len < (frame - skb->data) + hdr->buf_len) {
+ 		ath11k_warn(ab, "invalid length in mgmt rx hdr ev");
+-		kfree(tb);
+ 		return -EPROTO;
+ 	}
+ 
+@@ -5685,7 +5711,6 @@ static int ath11k_pull_mgmt_rx_params_tl
+ 
+ 	ath11k_ce_byte_swap(skb->data, hdr->buf_len);
+ 
+-	kfree(tb);
+ 	return 0;
+ }
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0053-wifi-ath11k-fix-writing-to-unintended-memory-region.patch b/package/kernel/mac80211/patches/ath11k/0053-wifi-ath11k-fix-writing-to-unintended-memory-region.patch
new file mode 100644
index 00000000000000..7b8a7d454313a8
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0053-wifi-ath11k-fix-writing-to-unintended-memory-region.patch
@@ -0,0 +1,43 @@
+From 756a7f90878f0866fd2fe167ef37e90b47326b96 Mon Sep 17 00:00:00 2001
+From: P Praneesh <quic_ppranees@quicinc.com>
+Date: Fri, 24 Mar 2023 16:57:01 +0200
+Subject: [PATCH] wifi: ath11k: fix writing to unintended memory region
+
+While initializing spectral, the magic value is getting written to the
+invalid memory address leading to random boot-up crash. This occurs
+due to the incorrect index increment in ath11k_dbring_fill_magic_value
+function. Fix it by replacing the existing logic with memset32 to ensure
+there is no invalid memory access.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01838-QCAHKSWPL_SILICONZ-1
+
+Fixes: d3d358efc553 ("ath11k: add spectral/CFR buffer validation support")
+Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230321052900.16895-1-quic_ppranees@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/dbring.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dbring.c
++++ b/drivers/net/wireless/ath/ath11k/dbring.c
+@@ -26,13 +26,13 @@ int ath11k_dbring_validate_buffer(struct
+ static void ath11k_dbring_fill_magic_value(struct ath11k *ar,
+ 					   void *buffer, u32 size)
+ {
+-	u32 *temp;
+-	int idx;
++	/* memset32 function fills buffer payload with the ATH11K_DB_MAGIC_VALUE
++	 * and the variable size is expected to be the number of u32 values
++	 * to be stored, not the number of bytes.
++	 */
++	size = size / sizeof(u32);
+ 
+-	size = size >> 2;
+-
+-	for (idx = 0, temp = buffer; idx < size; idx++, temp++)
+-		*temp++ = ATH11K_DB_MAGIC_VALUE;
++	memset32(buffer, ATH11K_DB_MAGIC_VALUE, size);
+ }
+ 
+ static int ath11k_dbring_bufs_replenish(struct ath11k *ar,
diff --git a/package/kernel/mac80211/patches/ath11k/0054-wifi-ath11k-Send-11d-scan-start-before-WMI_START_SCA.patch b/package/kernel/mac80211/patches/ath11k/0054-wifi-ath11k-Send-11d-scan-start-before-WMI_START_SCA.patch
new file mode 100644
index 00000000000000..0f8e63759217e8
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0054-wifi-ath11k-Send-11d-scan-start-before-WMI_START_SCA.patch
@@ -0,0 +1,61 @@
+From e89a51aedf380bc60219dc9afa96c36507060fb3 Mon Sep 17 00:00:00 2001
+From: Manikanta Pubbisetty <quic_mpubbise@quicinc.com>
+Date: Wed, 15 Mar 2023 21:48:17 +0530
+Subject: [PATCH] wifi: ath11k: Send 11d scan start before WMI_START_SCAN_CMDID
+
+Firmwares advertising the support of triggering 11d algorithm on the
+scan results of a regular scan expects driver to send
+WMI_11D_SCAN_START_CMDID before sending WMI_START_SCAN_CMDID.
+Triggering 11d algorithm on the scan results of a normal scan helps
+in completely avoiding a separate 11d scan for determining regdomain.
+This indirectly helps in speeding up connections on station
+interfaces on the chipsets supporting 11D scan.
+
+To enable this feature, send WMI_11D_SCAN_START_CMDID just before
+sending WMI_START_SCAN_CMDID if the firmware advertises
+WMI_TLV_SERVICE_SUPPORT_11D_FOR_HOST_SCAN service flag.
+
+WCN6750 & WCN6855 supports this feature.
+
+Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1
+Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23
+
+Signed-off-by: Manikanta Pubbisetty <quic_mpubbise@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230315161817.29627-1-quic_mpubbise@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 12 ++++++++++++
+ drivers/net/wireless/ath/ath11k/wmi.h |  1 +
+ 2 files changed, 13 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -3755,6 +3755,18 @@ static int ath11k_mac_op_hw_scan(struct
+ 	int i;
+ 	u32 scan_timeout;
+ 
++	/* Firmwares advertising the support of triggering 11D algorithm
++	 * on the scan results of a regular scan expects driver to send
++	 * WMI_11D_SCAN_START_CMDID before sending WMI_START_SCAN_CMDID.
++	 * With this feature, separate 11D scan can be avoided since
++	 * regdomain can be determined with the scan results of the
++	 * regular scan.
++	 */
++	if (ar->state_11d == ATH11K_11D_PREPARING &&
++	    test_bit(WMI_TLV_SERVICE_SUPPORT_11D_FOR_HOST_SCAN,
++		     ar->ab->wmi_ab.svc_map))
++		ath11k_mac_11d_scan_start(ar, arvif->vdev_id);
++
+ 	mutex_lock(&ar->conf_mutex);
+ 
+ 	spin_lock_bh(&ar->data_lock);
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -2103,6 +2103,7 @@ enum wmi_tlv_service {
+ 	WMI_TLV_SERVICE_SCAN_CONFIG_PER_CHANNEL = 265,
+ 	WMI_TLV_SERVICE_REG_CC_EXT_EVENT_SUPPORT = 281,
+ 	WMI_TLV_SERVICE_BIOS_SAR_SUPPORT = 326,
++	WMI_TLV_SERVICE_SUPPORT_11D_FOR_HOST_SCAN = 357,
+ 
+ 	/* The third 128 bits */
+ 	WMI_MAX_EXT2_SERVICE = 384
diff --git a/package/kernel/mac80211/patches/ath11k/0055-wifi-ath11k-Remove-redundant-pci_clear_master.patch b/package/kernel/mac80211/patches/ath11k/0055-wifi-ath11k-Remove-redundant-pci_clear_master.patch
new file mode 100644
index 00000000000000..0439727e72faaa
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0055-wifi-ath11k-Remove-redundant-pci_clear_master.patch
@@ -0,0 +1,58 @@
+From f812e2a9f85d6bea78957ccb5197e4491316848b Mon Sep 17 00:00:00 2001
+From: Cai Huoqing <cai.huoqing@linux.dev>
+Date: Thu, 23 Mar 2023 19:26:09 +0800
+Subject: [PATCH] wifi: ath11k: Remove redundant pci_clear_master
+
+Remove pci_clear_master to simplify the code,
+the bus-mastering is also cleared in do_pci_disable_device,
+like this:
+./drivers/pci/pci.c:2197
+static void do_pci_disable_device(struct pci_dev *dev)
+{
+	u16 pci_command;
+
+	pci_read_config_word(dev, PCI_COMMAND, &pci_command);
+	if (pci_command & PCI_COMMAND_MASTER) {
+		pci_command &= ~PCI_COMMAND_MASTER;
+		pci_write_config_word(dev, PCI_COMMAND, pci_command);
+	}
+
+	pcibios_disable_device(dev);
+}.
+And dev->is_busmaster is set to 0 in pci_disable_device.
+
+Signed-off-by: Cai Huoqing <cai.huoqing@linux.dev>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230323112613.7550-1-cai.huoqing@linux.dev
+---
+ drivers/net/wireless/ath/ath11k/pci.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/pci.c
++++ b/drivers/net/wireless/ath/ath11k/pci.c
+@@ -540,7 +540,7 @@ static int ath11k_pci_claim(struct ath11
+ 	if (!ab->mem) {
+ 		ath11k_err(ab, "failed to map pci bar %d\n", ATH11K_PCI_BAR_NUM);
+ 		ret = -EIO;
+-		goto clear_master;
++		goto release_region;
+ 	}
+ 
+ 	ab->mem_ce = ab->mem;
+@@ -548,8 +548,6 @@ static int ath11k_pci_claim(struct ath11
+ 	ath11k_dbg(ab, ATH11K_DBG_BOOT, "boot pci_mem 0x%pK\n", ab->mem);
+ 	return 0;
+ 
+-clear_master:
+-	pci_clear_master(pdev);
+ release_region:
+ 	pci_release_region(pdev, ATH11K_PCI_BAR_NUM);
+ disable_device:
+@@ -565,7 +563,6 @@ static void ath11k_pci_free_region(struc
+ 
+ 	pci_iounmap(pci_dev, ab->mem);
+ 	ab->mem = NULL;
+-	pci_clear_master(pci_dev);
+ 	pci_release_region(pci_dev, ATH11K_PCI_BAR_NUM);
+ 	if (pci_is_enabled(pci_dev))
+ 		pci_disable_device(pci_dev);
diff --git a/package/kernel/mac80211/patches/ath11k/0056-wifi-ath11k-Disable-Spectral-scan-upon-removing-inte.patch b/package/kernel/mac80211/patches/ath11k/0056-wifi-ath11k-Disable-Spectral-scan-upon-removing-inte.patch
new file mode 100644
index 00000000000000..44532a4d7200cb
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0056-wifi-ath11k-Disable-Spectral-scan-upon-removing-inte.patch
@@ -0,0 +1,36 @@
+From 5c690db63b45c6c4c4932b13173af71df369dba5 Mon Sep 17 00:00:00 2001
+From: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
+Date: Tue, 28 Mar 2023 12:41:50 +0530
+Subject: [PATCH] wifi: ath11k: Disable Spectral scan upon removing interface
+
+Host might receive spectral events during interface
+down sequence and this might create below errors.
+
+failed to handle dma buf release event -22
+failed to handle dma buf release event -22
+
+Fix this by disabling spectral config during remove interface.
+
+Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230328071150.29645-1-quic_tamizhr@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -6685,6 +6685,11 @@ static void ath11k_mac_op_remove_interfa
+ 	ath11k_dbg(ab, ATH11K_DBG_MAC, "mac remove interface (vdev %d)\n",
+ 		   arvif->vdev_id);
+ 
++	ret = ath11k_spectral_vif_stop(arvif);
++	if (ret)
++		ath11k_warn(ab, "failed to stop spectral for vdev %i: %d\n",
++			    arvif->vdev_id, ret);
++
+ 	if (arvif->vdev_type == WMI_VDEV_TYPE_STA)
+ 		ath11k_mac_11d_scan_stop(ar);
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0057-wifi-ath11k-enable-SAR-support-on-WCN6750.patch b/package/kernel/mac80211/patches/ath11k/0057-wifi-ath11k-enable-SAR-support-on-WCN6750.patch
new file mode 100644
index 00000000000000..5e64e552c1d35a
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0057-wifi-ath11k-enable-SAR-support-on-WCN6750.patch
@@ -0,0 +1,29 @@
+From abf57d84973ce1abcb67504ac0df8aea1fe09a76 Mon Sep 17 00:00:00 2001
+From: Youghandhar Chintala <quic_youghand@quicinc.com>
+Date: Tue, 28 Mar 2023 17:04:55 +0530
+Subject: [PATCH] wifi: ath11k: enable SAR support on WCN6750
+
+Currently, SAR is enabled only on WCN6855, enable this for WCN6750 too. This
+functionality gets triggered, when the user space application calls
+NL80211_CMD_SET_SAR_SPECS.
+
+Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-00887-QCAMSLSWPLZ-1
+
+Signed-off-by: Youghandhar Chintala <quic_youghand@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230328113455.11252-1-quic_youghand@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -593,7 +593,7 @@ static const struct ath11k_hw_params ath
+ 		.current_cc_support = true,
+ 		.dbr_debug_support = false,
+ 		.global_reset = false,
+-		.bios_sar_capa = NULL,
++		.bios_sar_capa = &ath11k_hw_sar_capa_wcn6855,
+ 		.m3_fw_support = false,
+ 		.fixed_bdf_addr = false,
+ 		.fixed_mem_region = false,
diff --git a/package/kernel/mac80211/patches/ath11k/0058-wifi-ath11k-pci-Add-more-MODULE_FIRMWARE-entries.patch b/package/kernel/mac80211/patches/ath11k/0058-wifi-ath11k-pci-Add-more-MODULE_FIRMWARE-entries.patch
new file mode 100644
index 00000000000000..585864eff2e3a2
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0058-wifi-ath11k-pci-Add-more-MODULE_FIRMWARE-entries.patch
@@ -0,0 +1,36 @@
+From 06c58473969239e00d76b683edd511952060ca56 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 30 Mar 2023 16:37:18 +0200
+Subject: [PATCH] wifi: ath11k: pci: Add more MODULE_FIRMWARE() entries
+
+As there are a few more models supported by the driver, let's add the
+missing MODULE_FIRMWARE() entries for them.  The lack of them resulted
+in the missing device enablement on some systems, such as the
+installation image of openSUSE.
+
+While we are at it, use the wildcard instead of listing each firmware
+files individually for each.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230330143718.19511-1-tiwai@suse.de
+---
+ drivers/net/wireless/ath/ath11k/pci.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/pci.c
++++ b/drivers/net/wireless/ath/ath11k/pci.c
+@@ -1036,7 +1036,8 @@ module_exit(ath11k_pci_exit);
+ MODULE_DESCRIPTION("Driver support for Qualcomm Technologies 802.11ax WLAN PCIe devices");
+ MODULE_LICENSE("Dual BSD/GPL");
+ 
+-/* QCA639x 2.0 firmware files */
+-MODULE_FIRMWARE(ATH11K_FW_DIR "/QCA6390/hw2.0/" ATH11K_BOARD_API2_FILE);
+-MODULE_FIRMWARE(ATH11K_FW_DIR "/QCA6390/hw2.0/" ATH11K_AMSS_FILE);
+-MODULE_FIRMWARE(ATH11K_FW_DIR "/QCA6390/hw2.0/" ATH11K_M3_FILE);
++/* firmware files */
++MODULE_FIRMWARE(ATH11K_FW_DIR "/QCA6390/hw2.0/*");
++MODULE_FIRMWARE(ATH11K_FW_DIR "/QCN9074/hw1.0/*");
++MODULE_FIRMWARE(ATH11K_FW_DIR "/WCN6855/hw2.0/*");
++MODULE_FIRMWARE(ATH11K_FW_DIR "/WCN6855/hw2.1/*");
diff --git a/package/kernel/mac80211/patches/ath11k/0059-wifi-ath11k-print-a-warning-when-crypto_alloc_shash-.patch b/package/kernel/mac80211/patches/ath11k/0059-wifi-ath11k-print-a-warning-when-crypto_alloc_shash-.patch
new file mode 100644
index 00000000000000..fab52a0fa7b096
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0059-wifi-ath11k-print-a-warning-when-crypto_alloc_shash-.patch
@@ -0,0 +1,34 @@
+From a87a9110ac0dcbfd9458b6665c141fa1c16a669d Mon Sep 17 00:00:00 2001
+From: Kalle Valo <quic_kvalo@quicinc.com>
+Date: Wed, 5 Apr 2023 12:04:25 +0300
+Subject: [PATCH] wifi: ath11k: print a warning when crypto_alloc_shash() fails
+
+Christoph reported that ath11k failed to initialise when michael_mic.ko
+module was not installed. To make it easier to notice that case print a
+warning when crypto_alloc_shash() fails.
+
+Compile tested only.
+
+Reported-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/all/20221130133016.GC3055@lst.de/
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230405090425.1351-1-kvalo@kernel.org
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -3106,8 +3106,11 @@ int ath11k_peer_rx_frag_setup(struct ath
+ 	int i;
+ 
+ 	tfm = crypto_alloc_shash("michael_mic", 0, 0);
+-	if (IS_ERR(tfm))
++	if (IS_ERR(tfm)) {
++		ath11k_warn(ab, "failed to allocate michael_mic shash: %ld\n",
++			    PTR_ERR(tfm));
+ 		return PTR_ERR(tfm);
++	}
+ 
+ 	spin_lock_bh(&ab->base_lock);
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0060-wifi-ath11k-Ignore-frags-from-uninitialized-peer-in-.patch b/package/kernel/mac80211/patches/ath11k/0060-wifi-ath11k-Ignore-frags-from-uninitialized-peer-in-.patch
new file mode 100644
index 00000000000000..5bbf9e04a4db7f
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0060-wifi-ath11k-Ignore-frags-from-uninitialized-peer-in-.patch
@@ -0,0 +1,104 @@
+From a06bfb3c9f69f303692cdae87bc0899d2ae8b2a6 Mon Sep 17 00:00:00 2001
+From: Harshitha Prem <quic_hprem@quicinc.com>
+Date: Tue, 4 Apr 2023 00:11:54 +0530
+Subject: [PATCH] wifi: ath11k: Ignore frags from uninitialized peer in dp.
+
+When max virtual ap interfaces are configured in all the bands with
+ACS and hostapd restart is done every 60s, a crash is observed at
+random times.
+In this certain scenario, a fragmented packet is received for
+self peer, for which rx_tid and rx_frags are not initialized in
+datapath. While handling this fragment, crash is observed as the
+rx_frag list is uninitialised and when we walk in
+ath11k_dp_rx_h_sort_frags, skb null leads to exception.
+
+To address this, before processing received fragments we check
+dp_setup_done flag is set to ensure that peer has completed its
+dp peer setup for fragment queue, else ignore processing the
+fragments.
+
+Call trace:
+  ath11k_dp_process_rx_err+0x550/0x1084 [ath11k]
+  ath11k_dp_service_srng+0x70/0x370 [ath11k]
+  0xffffffc009693a04
+  __napi_poll+0x30/0xa4
+  net_rx_action+0x118/0x270
+  __do_softirq+0x10c/0x244
+  irq_exit+0x64/0xb4
+  __handle_domain_irq+0x88/0xac
+  gic_handle_irq+0x74/0xbc
+  el1_irq+0xf0/0x1c0
+  arch_cpu_idle+0x10/0x18
+  do_idle+0x104/0x248
+  cpu_startup_entry+0x20/0x64
+  rest_init+0xd0/0xdc
+  arch_call_rest_init+0xc/0x14
+  start_kernel+0x480/0x4b8
+  Code: f9400281 f94066a2 91405021 b94a0023 (f9406401)
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Harshitha Prem <quic_hprem@quicinc.com>
+Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230403184155.8670-2-quic_nmaran@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/dp.c    | 4 +++-
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 8 ++++++++
+ drivers/net/wireless/ath/ath11k/peer.h  | 1 +
+ 3 files changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp.c
++++ b/drivers/net/wireless/ath/ath11k/dp.c
+@@ -36,6 +36,7 @@ void ath11k_dp_peer_cleanup(struct ath11
+ 	}
+ 
+ 	ath11k_peer_rx_tid_cleanup(ar, peer);
++	peer->dp_setup_done = false;
+ 	crypto_free_shash(peer->tfm_mmic);
+ 	spin_unlock_bh(&ab->base_lock);
+ }
+@@ -72,7 +73,8 @@ int ath11k_dp_peer_setup(struct ath11k *
+ 	ret = ath11k_peer_rx_frag_setup(ar, addr, vdev_id);
+ 	if (ret) {
+ 		ath11k_warn(ab, "failed to setup rx defrag context\n");
+-		return ret;
++		tid--;
++		goto peer_clean;
+ 	}
+ 
+ 	/* TODO: Setup other peer specific resource used in data path */
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -3130,6 +3130,7 @@ int ath11k_peer_rx_frag_setup(struct ath
+ 	}
+ 
+ 	peer->tfm_mmic = tfm;
++	peer->dp_setup_done = true;
+ 	spin_unlock_bh(&ab->base_lock);
+ 
+ 	return 0;
+@@ -3575,6 +3576,13 @@ static int ath11k_dp_rx_frag_h_mpdu(stru
+ 		ret = -ENOENT;
+ 		goto out_unlock;
+ 	}
++	if (!peer->dp_setup_done) {
++		ath11k_warn(ab, "The peer %pM [%d] has uninitialized datapath\n",
++			    peer->addr, peer_id);
++		ret = -ENOENT;
++		goto out_unlock;
++	}
++
+ 	rx_tid = &peer->rx_tid[tid];
+ 
+ 	if ((!skb_queue_empty(&rx_tid->rx_frags) && seqno != rx_tid->cur_sn) ||
+--- a/drivers/net/wireless/ath/ath11k/peer.h
++++ b/drivers/net/wireless/ath/ath11k/peer.h
+@@ -35,6 +35,7 @@ struct ath11k_peer {
+ 	u16 sec_type;
+ 	u16 sec_type_grp;
+ 	bool is_authorized;
++	bool dp_setup_done;
+ };
+ 
+ void ath11k_peer_unmap_event(struct ath11k_base *ab, u16 peer_id);
diff --git a/package/kernel/mac80211/patches/ath11k/0061-wifi-ath11k-fix-undefined-behavior-with-__fls-in-dp.patch b/package/kernel/mac80211/patches/ath11k/0061-wifi-ath11k-fix-undefined-behavior-with-__fls-in-dp.patch
new file mode 100644
index 00000000000000..d68c19f16098fe
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0061-wifi-ath11k-fix-undefined-behavior-with-__fls-in-dp.patch
@@ -0,0 +1,29 @@
+From 41e02bf4ae32cf2ac47b08b4caaa9c1a032e4ce7 Mon Sep 17 00:00:00 2001
+From: Harshitha Prem <quic_hprem@quicinc.com>
+Date: Tue, 4 Apr 2023 00:11:55 +0530
+Subject: [PATCH] wifi: ath11k: fix undefined behavior with __fls in dp
+
+"__fls" would have an undefined behavior if the argument is passed
+as "0". Hence, added changes to handle the same.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Harshitha Prem <quic_hprem@quicinc.com>
+Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230403184155.8670-3-quic_nmaran@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -3598,7 +3598,7 @@ static int ath11k_dp_rx_frag_h_mpdu(stru
+ 		goto out_unlock;
+ 	}
+ 
+-	if (frag_no > __fls(rx_tid->rx_frag_bitmap))
++	if (!rx_tid->rx_frag_bitmap || (frag_no > __fls(rx_tid->rx_frag_bitmap)))
+ 		__skb_queue_tail(&rx_tid->rx_frags, msdu);
+ 	else
+ 		ath11k_dp_rx_h_sort_frags(ar, &rx_tid->rx_frags, msdu);
diff --git a/package/kernel/mac80211/patches/ath11k/0062-wifi-ath11k-fix-double-free-of-peer-rx_tid-during-re.patch b/package/kernel/mac80211/patches/ath11k/0062-wifi-ath11k-fix-double-free-of-peer-rx_tid-during-re.patch
new file mode 100644
index 00000000000000..dd37b1e4fa8c62
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0062-wifi-ath11k-fix-double-free-of-peer-rx_tid-during-re.patch
@@ -0,0 +1,144 @@
+From 93a91f40c25c3d0e61f8540a7accf105090f9995 Mon Sep 17 00:00:00 2001
+From: Harshitha Prem <quic_hprem@quicinc.com>
+Date: Mon, 17 Apr 2023 13:35:00 +0300
+Subject: [PATCH] wifi: ath11k: fix double free of peer rx_tid during reo cmd
+ failure
+
+Peer rx_tid is locally copied thrice during peer_rx_tid_cleanup to
+send REO_CMD_UPDATE_RX_QUEUE followed by REO_CMD_FLUSH_CACHE to flush
+all aged REO descriptors from HW cache.
+
+When sending REO_CMD_FLUSH_CACHE fails, we do dma unmap of already
+mapped rx_tid->vaddr and free it. This is not checked during
+reo_cmd_list_cleanup() and dp_reo_cmd_free() before trying to free and
+unmap again.
+
+Fix this by setting rx_tid->vaddr NULL in rx tid delete and also
+wherever freeing it to check in reo_cmd_list_cleanup() and
+reo_cmd_free() before trying to free again.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sathishkumar Muruganandam <quic_murugana@quicinc.com>
+Signed-off-by: Harshitha Prem <quic_hprem@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230403182420.23375-2-quic_hprem@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 43 ++++++++++++++++++-------
+ 1 file changed, 31 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -668,13 +668,18 @@ void ath11k_dp_reo_cmd_list_cleanup(stru
+ 	struct ath11k_dp *dp = &ab->dp;
+ 	struct dp_reo_cmd *cmd, *tmp;
+ 	struct dp_reo_cache_flush_elem *cmd_cache, *tmp_cache;
++	struct dp_rx_tid *rx_tid;
+ 
+ 	spin_lock_bh(&dp->reo_cmd_lock);
+ 	list_for_each_entry_safe(cmd, tmp, &dp->reo_cmd_list, list) {
+ 		list_del(&cmd->list);
+-		dma_unmap_single(ab->dev, cmd->data.paddr,
+-				 cmd->data.size, DMA_BIDIRECTIONAL);
+-		kfree(cmd->data.vaddr);
++		rx_tid = &cmd->data;
++		if (rx_tid->vaddr) {
++			dma_unmap_single(ab->dev, rx_tid->paddr,
++					 rx_tid->size, DMA_BIDIRECTIONAL);
++			kfree(rx_tid->vaddr);
++			rx_tid->vaddr = NULL;
++		}
+ 		kfree(cmd);
+ 	}
+ 
+@@ -682,9 +687,13 @@ void ath11k_dp_reo_cmd_list_cleanup(stru
+ 				 &dp->reo_cmd_cache_flush_list, list) {
+ 		list_del(&cmd_cache->list);
+ 		dp->reo_cmd_cache_flush_count--;
+-		dma_unmap_single(ab->dev, cmd_cache->data.paddr,
+-				 cmd_cache->data.size, DMA_BIDIRECTIONAL);
+-		kfree(cmd_cache->data.vaddr);
++		rx_tid = &cmd_cache->data;
++		if (rx_tid->vaddr) {
++			dma_unmap_single(ab->dev, rx_tid->paddr,
++					 rx_tid->size, DMA_BIDIRECTIONAL);
++			kfree(rx_tid->vaddr);
++			rx_tid->vaddr = NULL;
++		}
+ 		kfree(cmd_cache);
+ 	}
+ 	spin_unlock_bh(&dp->reo_cmd_lock);
+@@ -698,10 +707,12 @@ static void ath11k_dp_reo_cmd_free(struc
+ 	if (status != HAL_REO_CMD_SUCCESS)
+ 		ath11k_warn(dp->ab, "failed to flush rx tid hw desc, tid %d status %d\n",
+ 			    rx_tid->tid, status);
+-
+-	dma_unmap_single(dp->ab->dev, rx_tid->paddr, rx_tid->size,
+-			 DMA_BIDIRECTIONAL);
+-	kfree(rx_tid->vaddr);
++	if (rx_tid->vaddr) {
++		dma_unmap_single(dp->ab->dev, rx_tid->paddr, rx_tid->size,
++				 DMA_BIDIRECTIONAL);
++		kfree(rx_tid->vaddr);
++		rx_tid->vaddr = NULL;
++	}
+ }
+ 
+ static void ath11k_dp_reo_cache_flush(struct ath11k_base *ab,
+@@ -740,6 +751,7 @@ static void ath11k_dp_reo_cache_flush(st
+ 		dma_unmap_single(ab->dev, rx_tid->paddr, rx_tid->size,
+ 				 DMA_BIDIRECTIONAL);
+ 		kfree(rx_tid->vaddr);
++		rx_tid->vaddr = NULL;
+ 	}
+ }
+ 
+@@ -792,6 +804,7 @@ free_desc:
+ 	dma_unmap_single(ab->dev, rx_tid->paddr, rx_tid->size,
+ 			 DMA_BIDIRECTIONAL);
+ 	kfree(rx_tid->vaddr);
++	rx_tid->vaddr = NULL;
+ }
+ 
+ void ath11k_peer_rx_tid_delete(struct ath11k *ar,
+@@ -804,6 +817,8 @@ void ath11k_peer_rx_tid_delete(struct at
+ 	if (!rx_tid->active)
+ 		return;
+ 
++	rx_tid->active = false;
++
+ 	cmd.flag = HAL_REO_CMD_FLG_NEED_STATUS;
+ 	cmd.addr_lo = lower_32_bits(rx_tid->paddr);
+ 	cmd.addr_hi = upper_32_bits(rx_tid->paddr);
+@@ -818,9 +833,11 @@ void ath11k_peer_rx_tid_delete(struct at
+ 		dma_unmap_single(ar->ab->dev, rx_tid->paddr, rx_tid->size,
+ 				 DMA_BIDIRECTIONAL);
+ 		kfree(rx_tid->vaddr);
++		rx_tid->vaddr = NULL;
+ 	}
+ 
+-	rx_tid->active = false;
++	rx_tid->paddr = 0;
++	rx_tid->size = 0;
+ }
+ 
+ static int ath11k_dp_rx_link_desc_return(struct ath11k_base *ab,
+@@ -967,6 +984,7 @@ static void ath11k_dp_rx_tid_mem_free(st
+ 	dma_unmap_single(ab->dev, rx_tid->paddr, rx_tid->size,
+ 			 DMA_BIDIRECTIONAL);
+ 	kfree(rx_tid->vaddr);
++	rx_tid->vaddr = NULL;
+ 
+ 	rx_tid->active = false;
+ 
+@@ -1067,7 +1085,8 @@ int ath11k_peer_rx_tid_setup(struct ath1
+ 	return ret;
+ 
+ err_mem_free:
+-	kfree(vaddr);
++	kfree(rx_tid->vaddr);
++	rx_tid->vaddr = NULL;
+ 
+ 	return ret;
+ }
diff --git a/package/kernel/mac80211/patches/ath11k/0063-wifi-ath11k-Prevent-REO-cmd-failures.patch b/package/kernel/mac80211/patches/ath11k/0063-wifi-ath11k-Prevent-REO-cmd-failures.patch
new file mode 100644
index 00000000000000..4b9af180620132
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0063-wifi-ath11k-Prevent-REO-cmd-failures.patch
@@ -0,0 +1,43 @@
+From a8ae833657a45746debde85c38bb7f070d344026 Mon Sep 17 00:00:00 2001
+From: Harshitha Prem <quic_hprem@quicinc.com>
+Date: Mon, 17 Apr 2023 13:35:01 +0300
+Subject: [PATCH] wifi: ath11k: Prevent REO cmd failures
+
+Prevent REO cmd failures causing double free by increasing REO cmd
+ring size and moving REO status ring mask to IRQ group 3 from group
+0 to separate from tx completion ring on IRQ group 0 which may delay
+reo status processing.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sathishkumar Muruganandam <quic_murugana@quicinc.com>
+Signed-off-by: Harshitha Prem <quic_hprem@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230403182420.23375-3-quic_hprem@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/dp.h | 2 +-
+ drivers/net/wireless/ath/ath11k/hw.c | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp.h
++++ b/drivers/net/wireless/ath/ath11k/dp.h
+@@ -214,7 +214,7 @@ struct ath11k_pdev_dp {
+ #define DP_REO_REINJECT_RING_SIZE	32
+ #define DP_RX_RELEASE_RING_SIZE		1024
+ #define DP_REO_EXCEPTION_RING_SIZE	128
+-#define DP_REO_CMD_RING_SIZE		128
++#define DP_REO_CMD_RING_SIZE		256
+ #define DP_REO_STATUS_RING_SIZE		2048
+ #define DP_RXDMA_BUF_RING_SIZE		4096
+ #define DP_RXDMA_REFILL_RING_SIZE	2048
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -1233,6 +1233,7 @@ const struct ath11k_hw_ring_mask ath11k_
+ 		ATH11K_RX_WBM_REL_RING_MASK_0,
+ 	},
+ 	.reo_status = {
++		0, 0, 0,
+ 		ATH11K_REO_STATUS_RING_MASK_0,
+ 	},
+ 	.rxdma2host = {
diff --git a/package/kernel/mac80211/patches/ath11k/0064-wifi-ath11k-add-peer-mac-information-in-failure-case.patch b/package/kernel/mac80211/patches/ath11k/0064-wifi-ath11k-add-peer-mac-information-in-failure-case.patch
new file mode 100644
index 00000000000000..fbcbdfff712fc6
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0064-wifi-ath11k-add-peer-mac-information-in-failure-case.patch
@@ -0,0 +1,74 @@
+From 20487cc3ff36bbfa9505f0a078ba98f09abfc717 Mon Sep 17 00:00:00 2001
+From: Harshitha Prem <quic_hprem@quicinc.com>
+Date: Mon, 17 Apr 2023 13:35:01 +0300
+Subject: [PATCH] wifi: ath11k: add peer mac information in failure cases
+
+During reo command failure, the peer mac detail for which the reo
+command was not successful is unknown. Hence, to improve the
+debuggability, add the peer mac information in the failure cases
+which would be useful during multi client cases.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sathishkumar Muruganandam <quic_murugana@quicinc.com>
+Signed-off-by: Harshitha Prem <quic_hprem@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230403182420.23375-4-quic_hprem@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -1009,7 +1009,8 @@ int ath11k_peer_rx_tid_setup(struct ath1
+ 
+ 	peer = ath11k_peer_find(ab, vdev_id, peer_mac);
+ 	if (!peer) {
+-		ath11k_warn(ab, "failed to find the peer to set up rx tid\n");
++		ath11k_warn(ab, "failed to find the peer %pM to set up rx tid\n",
++			    peer_mac);
+ 		spin_unlock_bh(&ab->base_lock);
+ 		return -ENOENT;
+ 	}
+@@ -1022,7 +1023,8 @@ int ath11k_peer_rx_tid_setup(struct ath1
+ 						    ba_win_sz, ssn, true);
+ 		spin_unlock_bh(&ab->base_lock);
+ 		if (ret) {
+-			ath11k_warn(ab, "failed to update reo for rx tid %d\n", tid);
++			ath11k_warn(ab, "failed to update reo for peer %pM rx tid %d\n: %d",
++				    peer_mac, tid, ret);
+ 			return ret;
+ 		}
+ 
+@@ -1030,8 +1032,8 @@ int ath11k_peer_rx_tid_setup(struct ath1
+ 							     peer_mac, paddr,
+ 							     tid, 1, ba_win_sz);
+ 		if (ret)
+-			ath11k_warn(ab, "failed to send wmi command to update rx reorder queue, tid :%d (%d)\n",
+-				    tid, ret);
++			ath11k_warn(ab, "failed to send wmi rx reorder queue for peer %pM tid %d: %d\n",
++				    peer_mac, tid, ret);
+ 		return ret;
+ 	}
+ 
+@@ -1064,6 +1066,8 @@ int ath11k_peer_rx_tid_setup(struct ath1
+ 	ret = dma_mapping_error(ab->dev, paddr);
+ 	if (ret) {
+ 		spin_unlock_bh(&ab->base_lock);
++		ath11k_warn(ab, "failed to setup dma map for peer %pM rx tid %d: %d\n",
++			    peer_mac, tid, ret);
+ 		goto err_mem_free;
+ 	}
+ 
+@@ -1077,8 +1081,8 @@ int ath11k_peer_rx_tid_setup(struct ath1
+ 	ret = ath11k_wmi_peer_rx_reorder_queue_setup(ar, vdev_id, peer_mac,
+ 						     paddr, tid, 1, ba_win_sz);
+ 	if (ret) {
+-		ath11k_warn(ar->ab, "failed to setup rx reorder queue, tid :%d (%d)\n",
+-			    tid, ret);
++		ath11k_warn(ar->ab, "failed to setup rx reorder queue for peer %pM tid %d: %d\n",
++			    peer_mac, tid, ret);
+ 		ath11k_dp_rx_tid_mem_free(ab, peer_mac, vdev_id, tid);
+ 	}
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0065-wifi-ath11k-fix-tx-status-reporting-in-encap-offload.patch b/package/kernel/mac80211/patches/ath11k/0065-wifi-ath11k-fix-tx-status-reporting-in-encap-offload.patch
new file mode 100644
index 00000000000000..e2fe419158f391
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0065-wifi-ath11k-fix-tx-status-reporting-in-encap-offload.patch
@@ -0,0 +1,119 @@
+From 6257c702264c44d74c6b71f0c62a7665da2dc356 Mon Sep 17 00:00:00 2001
+From: Pradeep Kumar Chitrapu <quic_pradeepc@quicinc.com>
+Date: Mon, 17 Apr 2023 13:35:02 +0300
+Subject: [PATCH] wifi: ath11k: fix tx status reporting in encap offload mode
+
+ieee80211_tx_status() treats packets in 802.11 frame format and
+tries to extract sta address from packet header. When tx encap
+offload is enabled, this becomes invalid operation. Hence, switch
+to using ieee80211_tx_status_ext() after filling in station
+address for handling both 802.11 and 802.3 frames.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Pradeep Kumar Chitrapu <quic_pradeepc@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230403195738.25367-2-quic_pradeepc@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/dp.h    |  4 +++
+ drivers/net/wireless/ath/ath11k/dp_tx.c | 33 ++++++++++++++++++++++++-
+ drivers/net/wireless/ath/ath11k/dp_tx.h |  1 +
+ 3 files changed, 37 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp.h
++++ b/drivers/net/wireless/ath/ath11k/dp.h
+@@ -303,12 +303,16 @@ struct ath11k_dp {
+ 
+ #define HTT_TX_WBM_COMP_STATUS_OFFSET 8
+ 
++#define HTT_INVALID_PEER_ID	0xffff
++
+ /* HTT tx completion is overlaid in wbm_release_ring */
+ #define HTT_TX_WBM_COMP_INFO0_STATUS		GENMASK(12, 9)
+ #define HTT_TX_WBM_COMP_INFO0_REINJECT_REASON	GENMASK(16, 13)
+ #define HTT_TX_WBM_COMP_INFO0_REINJECT_REASON	GENMASK(16, 13)
+ 
+ #define HTT_TX_WBM_COMP_INFO1_ACK_RSSI		GENMASK(31, 24)
++#define HTT_TX_WBM_COMP_INFO2_SW_PEER_ID	GENMASK(15, 0)
++#define HTT_TX_WBM_COMP_INFO2_VALID		BIT(21)
+ 
+ struct htt_tx_wbm_completion {
+ 	u32 info0;
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -316,10 +316,12 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+ 				 struct dp_tx_ring *tx_ring,
+ 				 struct ath11k_dp_htt_wbm_tx_status *ts)
+ {
++	struct ieee80211_tx_status status = { 0 };
+ 	struct sk_buff *msdu;
+ 	struct ieee80211_tx_info *info;
+ 	struct ath11k_skb_cb *skb_cb;
+ 	struct ath11k *ar;
++	struct ath11k_peer *peer;
+ 
+ 	spin_lock(&tx_ring->tx_idr_lock);
+ 	msdu = idr_remove(&tx_ring->txbuf_idr, ts->msdu_id);
+@@ -341,6 +343,11 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+ 
+ 	dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
+ 
++	if (!skb_cb->vif) {
++		dev_kfree_skb_any(msdu);
++		return;
++	}
++
+ 	memset(&info->status, 0, sizeof(info->status));
+ 
+ 	if (ts->acked) {
+@@ -355,7 +362,23 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+ 		}
+ 	}
+ 
+-	ieee80211_tx_status(ar->hw, msdu);
++	spin_lock_bh(&ab->base_lock);
++	peer = ath11k_peer_find_by_id(ab, ts->peer_id);
++	if (!peer || !peer->sta) {
++		ath11k_dbg(ab, ATH11K_DBG_DATA,
++			   "dp_tx: failed to find the peer with peer_id %d\n",
++			    ts->peer_id);
++		spin_unlock_bh(&ab->base_lock);
++		dev_kfree_skb_any(msdu);
++		return;
++	}
++	spin_unlock_bh(&ab->base_lock);
++
++	status.sta = peer->sta;
++	status.info = info;
++	status.skb = msdu;
++
++	ieee80211_tx_status_ext(ar->hw, &status);
+ }
+ 
+ static void
+@@ -379,7 +402,15 @@ ath11k_dp_tx_process_htt_tx_complete(str
+ 		ts.msdu_id = msdu_id;
+ 		ts.ack_rssi = FIELD_GET(HTT_TX_WBM_COMP_INFO1_ACK_RSSI,
+ 					status_desc->info1);
++
++		if (FIELD_GET(HTT_TX_WBM_COMP_INFO2_VALID, status_desc->info2))
++			ts.peer_id = FIELD_GET(HTT_TX_WBM_COMP_INFO2_SW_PEER_ID,
++					       status_desc->info2);
++		else
++			ts.peer_id = HTT_INVALID_PEER_ID;
++
+ 		ath11k_dp_tx_htt_tx_complete_buf(ab, tx_ring, &ts);
++
+ 		break;
+ 	case HAL_WBM_REL_HTT_TX_COMP_STATUS_REINJ:
+ 	case HAL_WBM_REL_HTT_TX_COMP_STATUS_INSPECT:
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.h
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.h
+@@ -13,6 +13,7 @@ struct ath11k_dp_htt_wbm_tx_status {
+ 	u32 msdu_id;
+ 	bool acked;
+ 	int ack_rssi;
++	u16 peer_id;
+ };
+ 
+ void ath11k_dp_tx_update_txcompl(struct ath11k *ar, struct hal_tx_status *ts);
diff --git a/package/kernel/mac80211/patches/ath11k/0066-wifi-ath11k-Fix-incorrect-update-of-radiotap-fields.patch b/package/kernel/mac80211/patches/ath11k/0066-wifi-ath11k-Fix-incorrect-update-of-radiotap-fields.patch
new file mode 100644
index 00000000000000..4f94580100f399
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0066-wifi-ath11k-Fix-incorrect-update-of-radiotap-fields.patch
@@ -0,0 +1,49 @@
+From 2f0c9ac8362da09c80f1cd422ef7fd6fa9b252b9 Mon Sep 17 00:00:00 2001
+From: Pradeep Kumar Chitrapu <quic_pradeepc@quicinc.com>
+Date: Mon, 17 Apr 2023 13:35:02 +0300
+Subject: [PATCH] wifi: ath11k: Fix incorrect update of radiotap fields
+
+Fix incorrect update of ppdu stats causing incorrect radiotap
+fields.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Pradeep Kumar Chitrapu <quic_pradeepc@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230403195738.25367-3-quic_pradeepc@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/hal_rx.c | 4 ++--
+ drivers/net/wireless/ath/ath11k/hal_rx.h | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.c
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
+@@ -1029,7 +1029,7 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+ 		info1 = __le32_to_cpu(vht_sig->info1);
+ 
+ 		ppdu_info->ldpc = FIELD_GET(HAL_RX_VHT_SIG_A_INFO_INFO1_SU_MU_CODING,
+-					    info0);
++					    info1);
+ 		ppdu_info->mcs = FIELD_GET(HAL_RX_VHT_SIG_A_INFO_INFO1_MCS,
+ 					   info1);
+ 		gi_setting = FIELD_GET(HAL_RX_VHT_SIG_A_INFO_INFO1_GI_SETTING,
+@@ -1452,7 +1452,7 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+ 		 * PHYRX_OTHER_RECEIVE_INFO TLV.
+ 		 */
+ 		ppdu_info->rssi_comb =
+-			FIELD_GET(HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB,
++			FIELD_GET(HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RSSI_COMB,
+ 				  __le32_to_cpu(rssi->info0));
+ 
+ 		if (db2dbm) {
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.h
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.h
+@@ -385,7 +385,7 @@ struct hal_rx_he_sig_b2_ofdma_info {
+ 	__le32 info0;
+ } __packed;
+ 
+-#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB	GENMASK(15, 8)
++#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RSSI_COMB	GENMASK(15, 8)
+ 
+ #define HAL_RX_PHYRX_RSSI_PREAMBLE_PRI20	GENMASK(7, 0)
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0067-wifi-ath11k-Fix-SKB-corruption-in-REO-destination-ri.patch b/package/kernel/mac80211/patches/ath11k/0067-wifi-ath11k-Fix-SKB-corruption-in-REO-destination-ri.patch
new file mode 100644
index 00000000000000..8b300f3a790a35
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0067-wifi-ath11k-Fix-SKB-corruption-in-REO-destination-ri.patch
@@ -0,0 +1,70 @@
+From f9fff67d2d7ca6fa8066132003a3deef654c55b1 Mon Sep 17 00:00:00 2001
+From: Nagarajan Maran <quic_nmaran@quicinc.com>
+Date: Mon, 17 Apr 2023 13:35:02 +0300
+Subject: [PATCH] wifi: ath11k: Fix SKB corruption in REO destination ring
+
+While running traffics for a long time, randomly an RX descriptor
+filled with value "0" from REO destination ring is received.
+This descriptor which is invalid causes the wrong SKB (SKB stored in
+the IDR lookup with buffer id "0") to be fetched which in turn
+causes SKB memory corruption issue and the same leads to crash
+after some time.
+
+Changed the start id for idr allocation to "1" and the buffer id "0"
+is reserved for error validation. Introduced Sanity check to validate
+the descriptor, before processing the SKB.
+
+Crash Signature :
+
+Unable to handle kernel paging request at virtual address 3f004900
+PC points to "b15_dma_inv_range+0x30/0x50"
+LR points to "dma_cache_maint_page+0x8c/0x128".
+The Backtrace obtained is as follows:
+[<8031716c>] (b15_dma_inv_range) from [<80313a4c>] (dma_cache_maint_page+0x8c/0x128)
+[<80313a4c>] (dma_cache_maint_page) from [<80313b90>] (__dma_page_dev_to_cpu+0x28/0xcc)
+[<80313b90>] (__dma_page_dev_to_cpu) from [<7fb5dd68>] (ath11k_dp_process_rx+0x1e8/0x4a4 [ath11k])
+[<7fb5dd68>] (ath11k_dp_process_rx [ath11k]) from [<7fb53c20>] (ath11k_dp_service_srng+0xb0/0x2ac [ath11k])
+[<7fb53c20>] (ath11k_dp_service_srng [ath11k]) from [<7f67bba4>] (ath11k_pci_ext_grp_napi_poll+0x1c/0x78 [ath11k_pci])
+[<7f67bba4>] (ath11k_pci_ext_grp_napi_poll [ath11k_pci]) from [<807d5cf4>] (__napi_poll+0x28/0xb8)
+[<807d5cf4>] (__napi_poll) from [<807d5f28>] (net_rx_action+0xf0/0x280)
+[<807d5f28>] (net_rx_action) from [<80302148>] (__do_softirq+0xd0/0x280)
+[<80302148>] (__do_softirq) from [<80320408>] (irq_exit+0x74/0xd4)
+[<80320408>] (irq_exit) from [<803638a4>] (__handle_domain_irq+0x90/0xb4)
+[<803638a4>] (__handle_domain_irq) from [<805bedec>] (gic_handle_irq+0x58/0x90)
+[<805bedec>] (gic_handle_irq) from [<80301a78>] (__irq_svc+0x58/0x8c)
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230403191533.28114-1-quic_nmaran@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -389,10 +389,10 @@ int ath11k_dp_rxbufs_replenish(struct at
+ 			goto fail_free_skb;
+ 
+ 		spin_lock_bh(&rx_ring->idr_lock);
+-		buf_id = idr_alloc(&rx_ring->bufs_idr, skb, 0,
+-				   rx_ring->bufs_max * 3, GFP_ATOMIC);
++		buf_id = idr_alloc(&rx_ring->bufs_idr, skb, 1,
++				   (rx_ring->bufs_max * 3) + 1, GFP_ATOMIC);
+ 		spin_unlock_bh(&rx_ring->idr_lock);
+-		if (buf_id < 0)
++		if (buf_id <= 0)
+ 			goto fail_dma_unmap;
+ 
+ 		desc = ath11k_hal_srng_src_get_next_entry(ab, srng);
+@@ -2665,6 +2665,9 @@ try_again:
+ 				   cookie);
+ 		mac_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_PDEV_ID, cookie);
+ 
++		if (unlikely(buf_id == 0))
++			continue;
++
+ 		ar = ab->pdevs[mac_id].ar;
+ 		rx_ring = &ar->dp.rx_refill_buf_ring;
+ 		spin_lock_bh(&rx_ring->idr_lock);
diff --git a/package/kernel/mac80211/patches/ath11k/0068-wifi-ath11k-Remove-disabling-of-80-80-and-160-MHz.patch b/package/kernel/mac80211/patches/ath11k/0068-wifi-ath11k-Remove-disabling-of-80-80-and-160-MHz.patch
new file mode 100644
index 00000000000000..ce5ffd273be333
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0068-wifi-ath11k-Remove-disabling-of-80-80-and-160-MHz.patch
@@ -0,0 +1,49 @@
+From b100722a777f6455d913666a376f81342b2cb995 Mon Sep 17 00:00:00 2001
+From: Muna Sinada <quic_msinada@quicinc.com>
+Date: Mon, 17 Apr 2023 13:22:27 -0700
+Subject: [PATCH] wifi: ath11k: Remove disabling of 80+80 and 160 MHz
+
+This is a regression fix for 80+80 and 160 MHz support bits being
+cleared, therefore not adverised. Remove disable of 80+80 and 160 MHz
+capability flags and assign valid center frequency 2 similar to
+VHT80_80.
+
+Fixes: 38dfe775d0ab ("wifi: ath11k: push MU-MIMO params from hostapd to hardware")
+Reported-by: Robert Marko <robert.marko@sartura.hr>
+Tested-by: Robert Marko <robert.marko@sartura.hr> # IPQ8074 WLAN.HK.2.9.0.1-01385-QCAHKSWPL_SILICONZ-1
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=217299
+Co-developed-by: P Praneesh <quic_ppranees@quicinc.com>
+Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
+Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/1681762947-13882-1-git-send-email-quic_msinada@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 4 ----
+ drivers/net/wireless/ath/ath11k/wmi.c | 3 ++-
+ 2 files changed, 2 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -5585,10 +5585,6 @@ static int ath11k_mac_copy_he_cap(struct
+ 
+ 		he_cap_elem->mac_cap_info[1] &=
+ 			IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_MASK;
+-		he_cap_elem->phy_cap_info[0] &=
+-			~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
+-		he_cap_elem->phy_cap_info[0] &=
+-			~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G;
+ 
+ 		he_cap_elem->phy_cap_info[5] &=
+ 			~IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK;
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -871,7 +871,8 @@ static void ath11k_wmi_put_wmi_channel(s
+ 
+ 		chan->band_center_freq2 = arg->channel.band_center_freq1;
+ 
+-	} else if (arg->channel.mode == MODE_11AC_VHT80_80) {
++	} else if ((arg->channel.mode == MODE_11AC_VHT80_80) ||
++		   (arg->channel.mode == MODE_11AX_HE80_80)) {
+ 		chan->band_center_freq2 = arg->channel.band_center_freq2;
+ 	} else {
+ 		chan->band_center_freq2 = 0;
diff --git a/package/kernel/mac80211/patches/ath11k/0069-wifi-ath11k-fix-registration-of-6Ghz-only-phy-withou.patch b/package/kernel/mac80211/patches/ath11k/0069-wifi-ath11k-fix-registration-of-6Ghz-only-phy-withou.patch
new file mode 100644
index 00000000000000..32468dbc4cab62
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0069-wifi-ath11k-fix-registration-of-6Ghz-only-phy-withou.patch
@@ -0,0 +1,61 @@
+From e2ceb1de2f83aafd8003f0b72dfd4b7441e97d14 Mon Sep 17 00:00:00 2001
+From: Maxime Bizon <mbizon@freebox.fr>
+Date: Fri, 21 Apr 2023 16:54:45 +0200
+Subject: [PATCH] wifi: ath11k: fix registration of 6Ghz-only phy without the
+ full channel range
+
+Because of what seems to be a typo, a 6Ghz-only phy for which the BDF
+does not allow the 7115Mhz channel will fail to register:
+
+  WARNING: CPU: 2 PID: 106 at net/wireless/core.c:907 wiphy_register+0x914/0x954
+  Modules linked in: ath11k_pci sbsa_gwdt
+  CPU: 2 PID: 106 Comm: kworker/u8:5 Not tainted 6.3.0-rc7-next-20230418-00549-g1e096a17625a-dirty #9
+  Hardware name: Freebox V7R Board (DT)
+  Workqueue: ath11k_qmi_driver_event ath11k_qmi_driver_event_work
+  pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+  pc : wiphy_register+0x914/0x954
+  lr : ieee80211_register_hw+0x67c/0xc10
+  sp : ffffff800b123aa0
+  x29: ffffff800b123aa0 x28: 0000000000000000 x27: 0000000000000000
+  x26: 0000000000000000 x25: 0000000000000006 x24: ffffffc008d51418
+  x23: ffffffc008cb0838 x22: ffffff80176c2460 x21: 0000000000000168
+  x20: ffffff80176c0000 x19: ffffff80176c03e0 x18: 0000000000000014
+  x17: 00000000cbef338c x16: 00000000d2a26f21 x15: 00000000ad6bb85f
+  x14: 0000000000000020 x13: 0000000000000020 x12: 00000000ffffffbd
+  x11: 0000000000000208 x10: 00000000fffffdf7 x9 : ffffffc009394718
+  x8 : ffffff80176c0528 x7 : 000000007fffffff x6 : 0000000000000006
+  x5 : 0000000000000005 x4 : ffffff800b304284 x3 : ffffff800b304284
+  x2 : ffffff800b304d98 x1 : 0000000000000000 x0 : 0000000000000000
+  Call trace:
+   wiphy_register+0x914/0x954
+   ieee80211_register_hw+0x67c/0xc10
+   ath11k_mac_register+0x7c4/0xe10
+   ath11k_core_qmi_firmware_ready+0x1f4/0x570
+   ath11k_qmi_driver_event_work+0x198/0x590
+   process_one_work+0x1b8/0x328
+   worker_thread+0x6c/0x414
+   kthread+0x100/0x104
+   ret_from_fork+0x10/0x20
+  ---[ end trace 0000000000000000 ]---
+  ath11k_pci 0002:01:00.0: ieee80211 registration failed: -22
+  ath11k_pci 0002:01:00.0: failed register the radio with mac80211: -22
+  ath11k_pci 0002:01:00.0: failed to create pdev core: -22
+
+Signed-off-by: Maxime Bizon <mbizon@freebox.fr>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230421145445.2612280-1-mbizon@freebox.fr
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -8892,7 +8892,7 @@ static int ath11k_mac_setup_channels_rat
+ 	}
+ 
+ 	if (supported_bands & WMI_HOST_WLAN_5G_CAP) {
+-		if (reg_cap->high_5ghz_chan >= ATH11K_MAX_6G_FREQ) {
++		if (reg_cap->high_5ghz_chan >= ATH11K_MIN_6G_FREQ) {
+ 			channels = kmemdup(ath11k_6ghz_channels,
+ 					   sizeof(ath11k_6ghz_channels), GFP_KERNEL);
+ 			if (!channels) {
diff --git a/package/kernel/mac80211/patches/ath11k/0070-wifi-ath-work-around-false-positive-stringop-overrea.patch b/package/kernel/mac80211/patches/ath11k/0070-wifi-ath-work-around-false-positive-stringop-overrea.patch
new file mode 100644
index 00000000000000..aa4df16a90fe6b
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0070-wifi-ath-work-around-false-positive-stringop-overrea.patch
@@ -0,0 +1,84 @@
+From 695df2f417d25202bdac9cde3c82d2acb6492b4d Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 5 May 2023 16:11:25 +0300
+Subject: [PATCH] wifi: ath: work around false-positive stringop-overread
+ warning
+
+In a rare arm64 randconfig build, I got multiple warnings for ath11k
+and ath12k:
+
+In function 'ath11k_peer_assoc_h_ht',
+    inlined from 'ath11k_peer_assoc_prepare' at drivers/net/wireless/ath/ath11k/mac.c:2665:2:
+drivers/net/wireless/ath/ath11k/mac.c:1709:13: error: 'ath11k_peer_assoc_h_ht_masked' reading 10 bytes from a region of size 0 [-Werror=stringop-overread]
+ 1709 |         if (ath11k_peer_assoc_h_ht_masked(ht_mcs_mask))
+      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This happens whenever gcc-13 fails to inline one of the functions
+that take a fixed-length array argument but gets passed a pointer.
+
+Change these functions to all take a regular pointer argument
+instead.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230417205447.1800912-1-arnd@kernel.org
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -433,7 +433,7 @@ u8 ath11k_mac_bitrate_to_idx(const struc
+ }
+ 
+ static u32
+-ath11k_mac_max_ht_nss(const u8 ht_mcs_mask[IEEE80211_HT_MCS_MASK_LEN])
++ath11k_mac_max_ht_nss(const u8 *ht_mcs_mask)
+ {
+ 	int nss;
+ 
+@@ -445,7 +445,7 @@ ath11k_mac_max_ht_nss(const u8 ht_mcs_ma
+ }
+ 
+ static u32
+-ath11k_mac_max_vht_nss(const u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
++ath11k_mac_max_vht_nss(const u16 *vht_mcs_mask)
+ {
+ 	int nss;
+ 
+@@ -457,7 +457,7 @@ ath11k_mac_max_vht_nss(const u16 vht_mcs
+ }
+ 
+ static u32
+-ath11k_mac_max_he_nss(const u16 he_mcs_mask[NL80211_HE_NSS_MAX])
++ath11k_mac_max_he_nss(const u16 *he_mcs_mask)
+ {
+ 	int nss;
+ 
+@@ -1658,7 +1658,7 @@ static void ath11k_peer_assoc_h_rates(st
+ }
+ 
+ static bool
+-ath11k_peer_assoc_h_ht_masked(const u8 ht_mcs_mask[IEEE80211_HT_MCS_MASK_LEN])
++ath11k_peer_assoc_h_ht_masked(const u8 *ht_mcs_mask)
+ {
+ 	int nss;
+ 
+@@ -1670,7 +1670,7 @@ ath11k_peer_assoc_h_ht_masked(const u8 h
+ }
+ 
+ static bool
+-ath11k_peer_assoc_h_vht_masked(const u16 vht_mcs_mask[])
++ath11k_peer_assoc_h_vht_masked(const u16 *vht_mcs_mask)
+ {
+ 	int nss;
+ 
+@@ -2065,7 +2065,7 @@ static u16 ath11k_peer_assoc_h_he_limit(
+ }
+ 
+ static bool
+-ath11k_peer_assoc_h_he_masked(const u16 he_mcs_mask[NL80211_HE_NSS_MAX])
++ath11k_peer_assoc_h_he_masked(const u16 *he_mcs_mask)
+ {
+ 	int nss;
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0071-wifi-ath11k-driver-settings-for-MBSSID-and-EMA.patch b/package/kernel/mac80211/patches/ath11k/0071-wifi-ath11k-driver-settings-for-MBSSID-and-EMA.patch
new file mode 100644
index 00000000000000..bede4819ca4072
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0071-wifi-ath11k-driver-settings-for-MBSSID-and-EMA.patch
@@ -0,0 +1,133 @@
+From a08dbb04d7365a04d52882143cf196005bfc88c3 Mon Sep 17 00:00:00 2001
+From: Aloka Dixit <quic_alokad@quicinc.com>
+Date: Fri, 5 May 2023 16:11:27 +0300
+Subject: [PATCH 71/77] wifi: ath11k: driver settings for MBSSID and EMA
+
+Advertise the driver support for multiple BSSID (MBSSID) and
+enhanced multi-BSSID advertisements (EMA) by setting extended
+capabilities.
+
+Configure mbssid_max_interfaces and ema_max_profile_periodicity
+fields in structure wiphy which are used to advertise maximum number
+of interfaces and profile periodicity supported by the driver.
+
+Add new WMI fields to configure maximum vdev count supported for
+MBSSID and profile periodicity in case of EMA.
+Setting WMI_RSRC_CFG_FLAG2_CALC_NEXT_DTIM_COUNT_SET flag
+indicates that the firmware should track and update the DTIM counts
+for each non-transmitted profile.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+Co-developed-by: John Crispin <john@phrozen.org>
+Signed-off-by: John Crispin <john@phrozen.org>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230405221648.17950-2-quic_alokad@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/hw.c  | 3 +++
+ drivers/net/wireless/ath/ath11k/hw.h  | 1 +
+ drivers/net/wireless/ath/ath11k/mac.c | 7 +++++++
+ drivers/net/wireless/ath/ath11k/wmi.c | 3 +++
+ drivers/net/wireless/ath/ath11k/wmi.h | 6 ++++++
+ 5 files changed, 20 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -202,6 +202,9 @@ static void ath11k_init_wmi_config_ipq80
+ 	config->twt_ap_sta_count = 1000;
+ 	config->flag1 |= WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64;
+ 	config->flag1 |= WMI_RSRC_CFG_FLAG1_ACK_RSSI;
++	config->ema_max_vap_cnt = ab->num_radios;
++	config->ema_max_profile_period = TARGET_EMA_MAX_PROFILE_PERIOD;
++	config->beacon_tx_offload_max_vdev += config->ema_max_vap_cnt;
+ }
+ 
+ static int ath11k_hw_mac_id_to_pdev_id_ipq8074(struct ath11k_hw_params *hw,
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -64,6 +64,7 @@
+ #define TARGET_NUM_WDS_ENTRIES		32
+ #define TARGET_DMA_BURST_SIZE		1
+ #define TARGET_RX_BATCHMODE		1
++#define TARGET_EMA_MAX_PROFILE_PERIOD	8
+ 
+ #define ATH11K_HW_MAX_QUEUES		4
+ #define ATH11K_QUEUE_LEN		4096
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -9001,19 +9001,23 @@ static int ath11k_mac_setup_iface_combin
+ 
+ static const u8 ath11k_if_types_ext_capa[] = {
+ 	[0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
++	[2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
+ 	[7] = WLAN_EXT_CAPA8_OPMODE_NOTIF,
+ };
+ 
+ static const u8 ath11k_if_types_ext_capa_sta[] = {
+ 	[0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
++	[2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
+ 	[7] = WLAN_EXT_CAPA8_OPMODE_NOTIF,
+ 	[9] = WLAN_EXT_CAPA10_TWT_REQUESTER_SUPPORT,
+ };
+ 
+ static const u8 ath11k_if_types_ext_capa_ap[] = {
+ 	[0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
++	[2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
+ 	[7] = WLAN_EXT_CAPA8_OPMODE_NOTIF,
+ 	[9] = WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT,
++	[10] = WLAN_EXT_CAPA11_EMA_SUPPORT,
+ };
+ 
+ static const struct wiphy_iftype_ext_capab ath11k_iftypes_ext_capa[] = {
+@@ -9251,6 +9255,9 @@ static int __ath11k_mac_register(struct
+ 		wiphy_ext_feature_set(ar->hw->wiphy,
+ 				      NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
+ 
++	ar->hw->wiphy->mbssid_max_interfaces = TARGET_NUM_VDEVS(ab);
++	ar->hw->wiphy->ema_max_profile_periodicity = TARGET_EMA_MAX_PROFILE_PERIOD;
++
+ 	ath11k_reg_init(ar);
+ 
+ 	if (!test_bit(ATH11K_FLAG_RAW_MODE, &ab->dev_flags)) {
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -3987,6 +3987,9 @@ ath11k_wmi_copy_resource_config(struct w
+ 		~(1 << WMI_CFG_HOST_SERVICE_FLAG_REG_CC_EXT);
+ 	wmi_cfg->host_service_flags |= (tg_cfg->is_reg_cc_ext_event_supported <<
+ 					WMI_CFG_HOST_SERVICE_FLAG_REG_CC_EXT);
++	wmi_cfg->flags2 = WMI_RSRC_CFG_FLAG2_CALC_NEXT_DTIM_COUNT_SET;
++	wmi_cfg->ema_max_vap_cnt = tg_cfg->ema_max_vap_cnt;
++	wmi_cfg->ema_max_profile_period = tg_cfg->ema_max_profile_period;
+ }
+ 
+ static int ath11k_init_cmd_send(struct ath11k_pdev_wmi *wmi,
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -2317,6 +2317,7 @@ struct wmi_init_cmd {
+ } __packed;
+ 
+ #define WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64 BIT(5)
++#define WMI_RSRC_CFG_FLAG2_CALC_NEXT_DTIM_COUNT_SET BIT(9)
+ #define WMI_RSRC_CFG_FLAG1_ACK_RSSI BIT(18)
+ 
+ #define WMI_CFG_HOST_SERVICE_FLAG_REG_CC_EXT 4
+@@ -2389,6 +2390,9 @@ struct wmi_resource_config {
+ 	u32 msdu_flow_override_config1;
+ 	u32 flags2;
+ 	u32 host_service_flags;
++	u32 max_rnr_neighbours;
++	u32 ema_max_vap_cnt;
++	u32 ema_max_profile_period;
+ } __packed;
+ 
+ struct wmi_service_ready_event {
+@@ -5646,6 +5650,8 @@ struct target_resource_config {
+ 	u32 twt_ap_pdev_count;
+ 	u32 twt_ap_sta_count;
+ 	u8 is_reg_cc_ext_event_supported;
++	u32 ema_max_vap_cnt;
++	u32 ema_max_profile_period;
+ };
+ 
+ enum wmi_debug_log_param {
diff --git a/package/kernel/mac80211/patches/ath11k/0072-wifi-ath11k-MBSSID-configuration-during-vdev-create-.patch b/package/kernel/mac80211/patches/ath11k/0072-wifi-ath11k-MBSSID-configuration-during-vdev-create-.patch
new file mode 100644
index 00000000000000..4ba0717319cad8
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0072-wifi-ath11k-MBSSID-configuration-during-vdev-create-.patch
@@ -0,0 +1,215 @@
+From 5a81610acf66c4ad6e1a1fbd09f3f555fca863b1 Mon Sep 17 00:00:00 2001
+From: Aloka Dixit <quic_alokad@quicinc.com>
+Date: Fri, 5 May 2023 16:11:27 +0300
+Subject: [PATCH 72/77] wifi: ath11k: MBSSID configuration during vdev
+ create/start
+
+Configure multiple BSSID flags and index of the transmitting interface
+in vdev create/start commands depending on the service bit
+WMI_TLV_SERVICE_MBSS_PARAM_IN_VDEV_START_SUPPORT.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+Co-developed-by: John Crispin <john@phrozen.org>
+Signed-off-by: John Crispin <john@phrozen.org>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230405221648.17950-3-quic_alokad@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 70 +++++++++++++++++++++++++--
+ drivers/net/wireless/ath/ath11k/wmi.c |  5 ++
+ drivers/net/wireless/ath/ath11k/wmi.h | 19 ++++++++
+ 3 files changed, 90 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -6181,17 +6181,62 @@ static void ath11k_mac_op_stop(struct ie
+ 	atomic_set(&ar->num_pending_mgmt_tx, 0);
+ }
+ 
+-static void
+-ath11k_mac_setup_vdev_create_params(struct ath11k_vif *arvif,
+-				    struct vdev_create_params *params)
++static int ath11k_mac_setup_vdev_params_mbssid(struct ath11k_vif *arvif,
++					       u32 *flags, u32 *tx_vdev_id)
++{
++	struct ath11k *ar = arvif->ar;
++	struct ath11k_vif *tx_arvif;
++	struct ieee80211_vif *tx_vif;
++
++	*tx_vdev_id = 0;
++	tx_vif = arvif->vif->mbssid_tx_vif;
++	if (!tx_vif) {
++		*flags = WMI_HOST_VDEV_FLAGS_NON_MBSSID_AP;
++		return 0;
++	}
++
++	tx_arvif = (void *)tx_vif->drv_priv;
++
++	if (arvif->vif->bss_conf.nontransmitted) {
++		if (ar->hw->wiphy != ieee80211_vif_to_wdev(tx_vif)->wiphy)
++			return -EINVAL;
++
++		*flags = WMI_HOST_VDEV_FLAGS_NON_TRANSMIT_AP;
++		*tx_vdev_id = ath11k_vif_to_arvif(tx_vif)->vdev_id;
++	} else if (tx_arvif == arvif) {
++		*flags = WMI_HOST_VDEV_FLAGS_TRANSMIT_AP;
++	} else {
++		return -EINVAL;
++	}
++
++	if (arvif->vif->bss_conf.ema_ap)
++		*flags |= WMI_HOST_VDEV_FLAGS_EMA_MODE;
++
++	return 0;
++}
++
++static int ath11k_mac_setup_vdev_create_params(struct ath11k_vif *arvif,
++					       struct vdev_create_params *params)
+ {
+ 	struct ath11k *ar = arvif->ar;
+ 	struct ath11k_pdev *pdev = ar->pdev;
++	int ret;
+ 
+ 	params->if_id = arvif->vdev_id;
+ 	params->type = arvif->vdev_type;
+ 	params->subtype = arvif->vdev_subtype;
+ 	params->pdev_id = pdev->pdev_id;
++	params->mbssid_flags = 0;
++	params->mbssid_tx_vdev_id = 0;
++
++	if (!test_bit(WMI_TLV_SERVICE_MBSS_PARAM_IN_VDEV_START_SUPPORT,
++		      ar->ab->wmi_ab.svc_map)) {
++		ret = ath11k_mac_setup_vdev_params_mbssid(arvif,
++							  &params->mbssid_flags,
++							  &params->mbssid_tx_vdev_id);
++		if (ret)
++			return ret;
++	}
+ 
+ 	if (pdev->cap.supported_bands & WMI_HOST_WLAN_2G_CAP) {
+ 		params->chains[NL80211_BAND_2GHZ].tx = ar->num_tx_chains;
+@@ -6206,6 +6251,7 @@ ath11k_mac_setup_vdev_create_params(stru
+ 		params->chains[NL80211_BAND_6GHZ].tx = ar->num_tx_chains;
+ 		params->chains[NL80211_BAND_6GHZ].rx = ar->num_rx_chains;
+ 	}
++	return 0;
+ }
+ 
+ static void ath11k_mac_op_update_vif_offload(struct ieee80211_hw *hw,
+@@ -6500,7 +6546,12 @@ static int ath11k_mac_op_add_interface(s
+ 	for (i = 0; i < ARRAY_SIZE(vif->hw_queue); i++)
+ 		vif->hw_queue[i] = i % (ATH11K_HW_MAX_QUEUES - 1);
+ 
+-	ath11k_mac_setup_vdev_create_params(arvif, &vdev_param);
++	ret = ath11k_mac_setup_vdev_create_params(arvif, &vdev_param);
++	if (ret) {
++		ath11k_warn(ab, "failed to create vdev parameters %d: %d\n",
++			    arvif->vdev_id, ret);
++		goto err;
++	}
+ 
+ 	ret = ath11k_wmi_vdev_create(ar, vif->addr, &vdev_param);
+ 	if (ret) {
+@@ -6905,6 +6956,17 @@ ath11k_mac_vdev_start_restart(struct ath
+ 	arg.pref_tx_streams = ar->num_tx_chains;
+ 	arg.pref_rx_streams = ar->num_rx_chains;
+ 
++	arg.mbssid_flags = 0;
++	arg.mbssid_tx_vdev_id = 0;
++	if (test_bit(WMI_TLV_SERVICE_MBSS_PARAM_IN_VDEV_START_SUPPORT,
++		     ar->ab->wmi_ab.svc_map)) {
++		ret = ath11k_mac_setup_vdev_params_mbssid(arvif,
++							  &arg.mbssid_flags,
++							  &arg.mbssid_tx_vdev_id);
++		if (ret)
++			return ret;
++	}
++
+ 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
+ 		arg.ssid = arvif->u.ap.ssid;
+ 		arg.ssid_len = arvif->u.ap.ssid_len;
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -724,6 +724,9 @@ int ath11k_wmi_vdev_create(struct ath11k
+ 	cmd->vdev_subtype = param->subtype;
+ 	cmd->num_cfg_txrx_streams = WMI_NUM_SUPPORTED_BAND_MAX;
+ 	cmd->pdev_id = param->pdev_id;
++	cmd->mbssid_flags = param->mbssid_flags;
++	cmd->mbssid_tx_vdev_id = param->mbssid_tx_vdev_id;
++
+ 	ether_addr_copy(cmd->vdev_macaddr.addr, macaddr);
+ 
+ 	ptr = skb->data + sizeof(*cmd);
+@@ -941,6 +944,8 @@ int ath11k_wmi_vdev_start(struct ath11k
+ 	cmd->cac_duration_ms = arg->cac_duration_ms;
+ 	cmd->regdomain = arg->regdomain;
+ 	cmd->he_ops = arg->he_ops;
++	cmd->mbssid_flags = arg->mbssid_flags;
++	cmd->mbssid_tx_vdev_id = arg->mbssid_tx_vdev_id;
+ 
+ 	if (!restart) {
+ 		if (arg->ssid) {
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -137,6 +137,14 @@ enum {
+ 	WMI_AUTORATE_3200NS_GI = BIT(11),
+ };
+ 
++enum {
++	WMI_HOST_VDEV_FLAGS_NON_MBSSID_AP       = 0x00000001,
++	WMI_HOST_VDEV_FLAGS_TRANSMIT_AP         = 0x00000002,
++	WMI_HOST_VDEV_FLAGS_NON_TRANSMIT_AP     = 0x00000004,
++	WMI_HOST_VDEV_FLAGS_EMA_MODE            = 0x00000008,
++	WMI_HOST_VDEV_FLAGS_SCAN_MODE_VAP       = 0x00000010,
++};
++
+ /*
+  * wmi command groups.
+  */
+@@ -2096,6 +2104,7 @@ enum wmi_tlv_service {
+ 	WMI_TLV_SERVICE_EXT2_MSG = 220,
+ 	WMI_TLV_SERVICE_PEER_POWER_SAVE_DURATION_SUPPORT = 246,
+ 	WMI_TLV_SERVICE_SRG_SRP_SPATIAL_REUSE_SUPPORT = 249,
++	WMI_TLV_SERVICE_MBSS_PARAM_IN_VDEV_START_SUPPORT = 253,
+ 	WMI_TLV_SERVICE_PASSIVE_SCAN_START_TIME_ENHANCE = 263,
+ 
+ 	/* The second 128 bits */
+@@ -2583,6 +2592,8 @@ struct vdev_create_params {
+ 		u8 rx;
+ 	} chains[NUM_NL80211_BANDS];
+ 	u32 pdev_id;
++	u32 mbssid_flags;
++	u32 mbssid_tx_vdev_id;
+ };
+ 
+ struct wmi_vdev_create_cmd {
+@@ -2593,6 +2604,8 @@ struct wmi_vdev_create_cmd {
+ 	struct wmi_mac_addr vdev_macaddr;
+ 	u32 num_cfg_txrx_streams;
+ 	u32 pdev_id;
++	u32 mbssid_flags;
++	u32 mbssid_tx_vdev_id;
+ } __packed;
+ 
+ struct wmi_vdev_txrx_streams {
+@@ -2656,6 +2669,9 @@ struct wmi_vdev_start_request_cmd {
+ 	u32 he_ops;
+ 	u32 cac_duration_ms;
+ 	u32 regdomain;
++	u32 min_data_rate;
++	u32 mbssid_flags;
++	u32 mbssid_tx_vdev_id;
+ } __packed;
+ 
+ #define MGMT_TX_DL_FRM_LEN		     64
+@@ -2825,6 +2841,9 @@ struct wmi_vdev_start_req_arg {
+ 	u32 pref_rx_streams;
+ 	u32 pref_tx_streams;
+ 	u32 num_noa_descriptors;
++	u32 min_data_rate;
++	u32 mbssid_flags;
++	u32 mbssid_tx_vdev_id;
+ };
+ 
+ struct peer_create_params {
diff --git a/package/kernel/mac80211/patches/ath11k/0073-wifi-ath11k-rename-MBSSID-fields-in-wmi_vdev_up_cmd.patch b/package/kernel/mac80211/patches/ath11k/0073-wifi-ath11k-rename-MBSSID-fields-in-wmi_vdev_up_cmd.patch
new file mode 100644
index 00000000000000..023a1dbb9fc03e
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0073-wifi-ath11k-rename-MBSSID-fields-in-wmi_vdev_up_cmd.patch
@@ -0,0 +1,52 @@
+From cf604e72bc6e6db68c7fcaa8779b03ec14b8d2fa Mon Sep 17 00:00:00 2001
+From: Aloka Dixit <quic_alokad@quicinc.com>
+Date: Fri, 5 May 2023 16:11:27 +0300
+Subject: [PATCH 73/77] wifi: ath11k: rename MBSSID fields in wmi_vdev_up_cmd
+
+Rename trans_bssid to tx_vdev_bssid to make it similar to vdev_bssid.
+
+Rename profile_num to nontx_profile_cnt, and profile_idx to
+nontx_profile_idx which makes it clear that these store configurations
+related to MBSSID non-transmitting profiles.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230405221648.17950-4-quic_alokad@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/wmi.c | 6 +++---
+ drivers/net/wireless/ath/ath11k/wmi.h | 6 +++---
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -1029,10 +1029,10 @@ int ath11k_wmi_vdev_up(struct ath11k *ar
+ 		bss_conf = &arvif->vif->bss_conf;
+ 
+ 		if (bss_conf->nontransmitted) {
+-			ether_addr_copy(cmd->trans_bssid.addr,
++			ether_addr_copy(cmd->tx_vdev_bssid.addr,
+ 					bss_conf->transmitter_bssid);
+-			cmd->profile_idx = bss_conf->bssid_index;
+-			cmd->profile_num = bss_conf->bssid_indicator;
++			cmd->nontx_profile_idx = bss_conf->bssid_index;
++			cmd->nontx_profile_cnt = bss_conf->bssid_indicator;
+ 		}
+ 	}
+ 
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -2625,9 +2625,9 @@ struct wmi_vdev_up_cmd {
+ 	u32 vdev_id;
+ 	u32 vdev_assoc_id;
+ 	struct wmi_mac_addr vdev_bssid;
+-	struct wmi_mac_addr trans_bssid;
+-	u32 profile_idx;
+-	u32 profile_num;
++	struct wmi_mac_addr tx_vdev_bssid;
++	u32 nontx_profile_idx;
++	u32 nontx_profile_cnt;
+ } __packed;
+ 
+ struct wmi_vdev_stop_cmd {
diff --git a/package/kernel/mac80211/patches/ath11k/0074-wifi-ath11k-MBSSID-parameter-configuration-in-AP-mod.patch b/package/kernel/mac80211/patches/ath11k/0074-wifi-ath11k-MBSSID-parameter-configuration-in-AP-mod.patch
new file mode 100644
index 00000000000000..d93e27dd42bb95
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0074-wifi-ath11k-MBSSID-parameter-configuration-in-AP-mod.patch
@@ -0,0 +1,138 @@
+From c82dc33f252fd8883be66f2d0230af0fd734c683 Mon Sep 17 00:00:00 2001
+From: Aloka Dixit <quic_alokad@quicinc.com>
+Date: Fri, 5 May 2023 16:11:27 +0300
+Subject: [PATCH 74/77] wifi: ath11k: MBSSID parameter configuration in AP mode
+
+Include MBSSID parameters in WMI vdev up operation.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+Co-developed-by: John Crispin <john@phrozen.org>
+Signed-off-by: John Crispin <john@phrozen.org>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230405221648.17950-5-quic_alokad@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 29 +++++++++++++++++++++------
+ drivers/net/wireless/ath/ath11k/wmi.c |  8 +++++++-
+ drivers/net/wireless/ath/ath11k/wmi.h |  3 ++-
+ 3 files changed, 32 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -964,7 +964,7 @@ static int ath11k_mac_monitor_vdev_start
+ 		return ret;
+ 	}
+ 
+-	ret = ath11k_wmi_vdev_up(ar, vdev_id, 0, ar->mac_addr);
++	ret = ath11k_wmi_vdev_up(ar, vdev_id, 0, ar->mac_addr, NULL, 0, 0);
+ 	if (ret) {
+ 		ath11k_warn(ar->ab, "failed to put up monitor vdev %i: %d\n",
+ 			    vdev_id, ret);
+@@ -1423,6 +1423,7 @@ static void ath11k_control_beaconing(str
+ 				     struct ieee80211_bss_conf *info)
+ {
+ 	struct ath11k *ar = arvif->ar;
++	struct ath11k_vif *tx_arvif = NULL;
+ 	int ret = 0;
+ 
+ 	lockdep_assert_held(&arvif->ar->conf_mutex);
+@@ -1451,8 +1452,14 @@ static void ath11k_control_beaconing(str
+ 
+ 	ether_addr_copy(arvif->bssid, info->bssid);
+ 
++	if (arvif->vif->mbssid_tx_vif)
++		tx_arvif = (struct ath11k_vif *)arvif->vif->mbssid_tx_vif->drv_priv;
++
+ 	ret = ath11k_wmi_vdev_up(arvif->ar, arvif->vdev_id, arvif->aid,
+-				 arvif->bssid);
++				 arvif->bssid,
++				 tx_arvif ? tx_arvif->bssid : NULL,
++				 info->bssid_index,
++				 1 << info->bssid_indicator);
+ 	if (ret) {
+ 		ath11k_warn(ar->ab, "failed to bring up vdev %d: %i\n",
+ 			    arvif->vdev_id, ret);
+@@ -2879,7 +2886,8 @@ static void ath11k_bss_assoc(struct ieee
+ 	arvif->aid = vif->cfg.aid;
+ 	ether_addr_copy(arvif->bssid, bss_conf->bssid);
+ 
+-	ret = ath11k_wmi_vdev_up(ar, arvif->vdev_id, arvif->aid, arvif->bssid);
++	ret = ath11k_wmi_vdev_up(ar, arvif->vdev_id, arvif->aid, arvif->bssid,
++				 NULL, 0, 0);
+ 	if (ret) {
+ 		ath11k_warn(ar->ab, "failed to set vdev %d up: %d\n",
+ 			    arvif->vdev_id, ret);
+@@ -7133,7 +7141,8 @@ ath11k_mac_update_vif_chan(struct ath11k
+ 			   int n_vifs)
+ {
+ 	struct ath11k_base *ab = ar->ab;
+-	struct ath11k_vif *arvif;
++	struct ath11k_vif *arvif, *tx_arvif = NULL;
++	struct ieee80211_vif *mbssid_tx_vif;
+ 	int ret;
+ 	int i;
+ 	bool monitor_vif = false;
+@@ -7187,8 +7196,15 @@ ath11k_mac_update_vif_chan(struct ath11k
+ 			ath11k_warn(ab, "failed to update bcn tmpl during csa: %d\n",
+ 				    ret);
+ 
++		mbssid_tx_vif = arvif->vif->mbssid_tx_vif;
++		if (mbssid_tx_vif)
++			tx_arvif = (struct ath11k_vif *)mbssid_tx_vif->drv_priv;
++
+ 		ret = ath11k_wmi_vdev_up(arvif->ar, arvif->vdev_id, arvif->aid,
+-					 arvif->bssid);
++					 arvif->bssid,
++					 tx_arvif ? tx_arvif->bssid : NULL,
++					 arvif->vif->bss_conf.bssid_index,
++					 1 << arvif->vif->bss_conf.bssid_indicator);
+ 		if (ret) {
+ 			ath11k_warn(ab, "failed to bring vdev up %d: %d\n",
+ 				    arvif->vdev_id, ret);
+@@ -7306,7 +7322,8 @@ static int ath11k_start_vdev_delay(struc
+ 	}
+ 
+ 	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
+-		ret = ath11k_wmi_vdev_up(ar, arvif->vdev_id, 0, ar->mac_addr);
++		ret = ath11k_wmi_vdev_up(ar, arvif->vdev_id, 0, ar->mac_addr,
++					 NULL, 0, 0);
+ 		if (ret) {
+ 			ath11k_warn(ab, "failed put monitor up: %d\n", ret);
+ 			return ret;
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -1001,7 +1001,8 @@ int ath11k_wmi_vdev_start(struct ath11k
+ 	return ret;
+ }
+ 
+-int ath11k_wmi_vdev_up(struct ath11k *ar, u32 vdev_id, u32 aid, const u8 *bssid)
++int ath11k_wmi_vdev_up(struct ath11k *ar, u32 vdev_id, u32 aid, const u8 *bssid,
++		       u8 *tx_bssid, u32 nontx_profile_idx, u32 nontx_profile_cnt)
+ {
+ 	struct ath11k_pdev_wmi *wmi = ar->wmi;
+ 	struct wmi_vdev_up_cmd *cmd;
+@@ -1025,6 +1026,11 @@ int ath11k_wmi_vdev_up(struct ath11k *ar
+ 
+ 	ether_addr_copy(cmd->vdev_bssid.addr, bssid);
+ 
++	cmd->nontx_profile_idx = nontx_profile_idx;
++	cmd->nontx_profile_cnt = nontx_profile_cnt;
++	if (tx_bssid)
++		ether_addr_copy(cmd->tx_vdev_bssid.addr, tx_bssid);
++
+ 	if (arvif && arvif->vif->type == NL80211_IFTYPE_STATION) {
+ 		bss_conf = &arvif->vif->bss_conf;
+ 
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -6301,7 +6301,8 @@ int ath11k_wmi_bcn_tmpl(struct ath11k *a
+ 			struct sk_buff *bcn);
+ int ath11k_wmi_vdev_down(struct ath11k *ar, u8 vdev_id);
+ int ath11k_wmi_vdev_up(struct ath11k *ar, u32 vdev_id, u32 aid,
+-		       const u8 *bssid);
++		       const u8 *bssid, u8 *tx_bssid, u32 nontx_profile_idx,
++		       u32 nontx_profile_cnt);
+ int ath11k_wmi_vdev_stop(struct ath11k *ar, u8 vdev_id);
+ int ath11k_wmi_vdev_start(struct ath11k *ar, struct wmi_vdev_start_req_arg *arg,
+ 			  bool restart);
diff --git a/package/kernel/mac80211/patches/ath11k/0075-wifi-ath11k-refactor-vif-parameter-configurations.patch b/package/kernel/mac80211/patches/ath11k/0075-wifi-ath11k-refactor-vif-parameter-configurations.patch
new file mode 100644
index 00000000000000..8509e55978d75d
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0075-wifi-ath11k-refactor-vif-parameter-configurations.patch
@@ -0,0 +1,86 @@
+From cb9bea773c85e372931cd7a177db4165adf29d95 Mon Sep 17 00:00:00 2001
+From: Aloka Dixit <quic_alokad@quicinc.com>
+Date: Fri, 5 May 2023 16:11:28 +0300
+Subject: [PATCH 75/77] wifi: ath11k: refactor vif parameter configurations
+
+Security parameters for each non-transmitting profile can be
+different when MBSSID is enabled and this information is included
+in the MBSSID element in the Beacon frame. Current implementation
+to set rsnie_present and wpaie_present does not parse this element
+hence it applies only to the transmitting interface.
+
+Move the code to a separate function to make additions for
+non-transmitting interfaces cleaner.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230405221648.17950-6-quic_alokad@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 41 ++++++++++++++++-----------
+ 1 file changed, 24 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -1351,28 +1351,14 @@ err_mon_del:
+ 	return ret;
+ }
+ 
+-static int ath11k_mac_setup_bcn_tmpl(struct ath11k_vif *arvif)
++static void ath11k_mac_set_vif_params(struct ath11k_vif *arvif,
++				      struct sk_buff *bcn)
+ {
+-	struct ath11k *ar = arvif->ar;
+-	struct ath11k_base *ab = ar->ab;
+-	struct ieee80211_hw *hw = ar->hw;
+-	struct ieee80211_vif *vif = arvif->vif;
+-	struct ieee80211_mutable_offsets offs = {};
+-	struct sk_buff *bcn;
+ 	struct ieee80211_mgmt *mgmt;
+ 	u8 *ies;
+-	int ret;
+-
+-	if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
+-		return 0;
+-
+-	bcn = ieee80211_beacon_get_template(hw, vif, &offs, 0);
+-	if (!bcn) {
+-		ath11k_warn(ab, "failed to get beacon template from mac80211\n");
+-		return -EPERM;
+-	}
+ 
+ 	ies = bcn->data + ieee80211_get_hdrlen_from_skb(bcn);
++	mgmt = (struct ieee80211_mgmt *)bcn->data;
+ 	ies += sizeof(mgmt->u.beacon);
+ 
+ 	if (cfg80211_find_ie(WLAN_EID_RSN, ies, (skb_tail_pointer(bcn) - ies)))
+@@ -1386,7 +1372,28 @@ static int ath11k_mac_setup_bcn_tmpl(str
+ 		arvif->wpaie_present = true;
+ 	else
+ 		arvif->wpaie_present = false;
++}
++
++static int ath11k_mac_setup_bcn_tmpl(struct ath11k_vif *arvif)
++{
++	struct ath11k *ar = arvif->ar;
++	struct ath11k_base *ab = ar->ab;
++	struct ieee80211_hw *hw = ar->hw;
++	struct ieee80211_vif *vif = arvif->vif;
++	struct ieee80211_mutable_offsets offs = {};
++	struct sk_buff *bcn;
++	int ret;
++
++	if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
++		return 0;
++
++	bcn = ieee80211_beacon_get_template(hw, vif, &offs, 0);
++	if (!bcn) {
++		ath11k_warn(ab, "failed to get beacon template from mac80211\n");
++		return -EPERM;
++	}
+ 
++	ath11k_mac_set_vif_params(arvif, bcn);
+ 	ret = ath11k_wmi_bcn_tmpl(ar, arvif->vdev_id, &offs, bcn);
+ 
+ 	kfree_skb(bcn);
diff --git a/package/kernel/mac80211/patches/ath11k/0076-wifi-ath11k-MBSSID-beacon-support.patch b/package/kernel/mac80211/patches/ath11k/0076-wifi-ath11k-MBSSID-beacon-support.patch
new file mode 100644
index 00000000000000..d23ea8deeadc57
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0076-wifi-ath11k-MBSSID-beacon-support.patch
@@ -0,0 +1,190 @@
+From 335a92765d308dfe22826f5562cd4b4389b45e71 Mon Sep 17 00:00:00 2001
+From: Aloka Dixit <quic_alokad@quicinc.com>
+Date: Fri, 5 May 2023 16:11:28 +0300
+Subject: [PATCH 76/77] wifi: ath11k: MBSSID beacon support
+
+- Split ath11k_mac_setup_bcn_tmpl() to move the beacon retrieval and
+  WMI command to a new function, ath11k_mac_setup_bcn_tmpl_legacy().
+  In the original function add checks to use the transmitting interface
+  when MBSSID is enabled.
+- Set rsnie_present and wpaie_present fields for the non-transmitting
+  interfaces when MBSSID is enabled.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+Co-developed-by: John Crispin <john@phrozen.org>
+Signed-off-by: John Crispin <john@phrozen.org>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230405221648.17950-7-quic_alokad@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 116 ++++++++++++++++++++++++--
+ drivers/net/wireless/ath/ath11k/wmi.c |   1 +
+ 2 files changed, 112 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -1351,6 +1351,84 @@ err_mon_del:
+ 	return ret;
+ }
+ 
++static void ath11k_mac_setup_nontx_vif_rsnie(struct ath11k_vif *arvif,
++					     bool tx_arvif_rsnie_present,
++					     const u8 *profile, u8 profile_len)
++{
++	if (cfg80211_find_ie(WLAN_EID_RSN, profile, profile_len)) {
++		arvif->rsnie_present = true;
++	} else if (tx_arvif_rsnie_present) {
++		int i;
++		u8 nie_len;
++		const u8 *nie = cfg80211_find_ext_ie(WLAN_EID_EXT_NON_INHERITANCE,
++						     profile, profile_len);
++		if (!nie)
++			return;
++
++		nie_len = nie[1];
++		nie += 2;
++		for (i = 0; i < nie_len; i++) {
++			if (nie[i] == WLAN_EID_RSN) {
++				arvif->rsnie_present = false;
++				break;
++			}
++		}
++	}
++}
++
++static bool ath11k_mac_set_nontx_vif_params(struct ath11k_vif *tx_arvif,
++					    struct ath11k_vif *arvif,
++					    struct sk_buff *bcn)
++{
++	struct ieee80211_mgmt *mgmt;
++	const u8 *ies, *profile, *next_profile;
++	int ies_len;
++
++	ies = bcn->data + ieee80211_get_hdrlen_from_skb(bcn);
++	mgmt = (struct ieee80211_mgmt *)bcn->data;
++	ies += sizeof(mgmt->u.beacon);
++	ies_len = skb_tail_pointer(bcn) - ies;
++
++	ies = cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ies, ies_len);
++	arvif->rsnie_present = tx_arvif->rsnie_present;
++
++	while (ies) {
++		u8 mbssid_len;
++
++		ies_len -= (2 + ies[1]);
++		mbssid_len = ies[1] - 1;
++		profile = &ies[3];
++
++		while (mbssid_len) {
++			u8 profile_len;
++
++			profile_len = profile[1];
++			next_profile = profile + (2 + profile_len);
++			mbssid_len -= (2 + profile_len);
++
++			profile += 2;
++			profile_len -= (2 + profile[1]);
++			profile += (2 + profile[1]); /* nontx capabilities */
++			profile_len -= (2 + profile[1]);
++			profile += (2 + profile[1]); /* SSID */
++			if (profile[2] == arvif->vif->bss_conf.bssid_index) {
++				profile_len -= 5;
++				profile = profile + 5;
++				ath11k_mac_setup_nontx_vif_rsnie(arvif,
++								 tx_arvif->rsnie_present,
++								 profile,
++								 profile_len);
++				return true;
++			}
++			profile = next_profile;
++		}
++		ies = cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, profile,
++				       ies_len);
++	}
++
++	return false;
++}
++
+ static void ath11k_mac_set_vif_params(struct ath11k_vif *arvif,
+ 				      struct sk_buff *bcn)
+ {
+@@ -1374,18 +1452,26 @@ static void ath11k_mac_set_vif_params(st
+ 		arvif->wpaie_present = false;
+ }
+ 
+-static int ath11k_mac_setup_bcn_tmpl(struct ath11k_vif *arvif)
++static int ath11k_mac_setup_bcn_tmpl_mbssid(struct ath11k_vif *arvif)
+ {
+ 	struct ath11k *ar = arvif->ar;
+ 	struct ath11k_base *ab = ar->ab;
++	struct ath11k_vif *tx_arvif = arvif;
+ 	struct ieee80211_hw *hw = ar->hw;
+ 	struct ieee80211_vif *vif = arvif->vif;
+ 	struct ieee80211_mutable_offsets offs = {};
+ 	struct sk_buff *bcn;
+ 	int ret;
+ 
+-	if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
+-		return 0;
++	if (arvif->vif->mbssid_tx_vif) {
++		tx_arvif = (void *)arvif->vif->mbssid_tx_vif->drv_priv;
++		if (tx_arvif != arvif) {
++			ar = tx_arvif->ar;
++			ab = ar->ab;
++			hw = ar->hw;
++			vif = tx_arvif->vif;
++		}
++	}
+ 
+ 	bcn = ieee80211_beacon_get_template(hw, vif, &offs, 0);
+ 	if (!bcn) {
+@@ -1393,9 +1479,12 @@ static int ath11k_mac_setup_bcn_tmpl(str
+ 		return -EPERM;
+ 	}
+ 
+-	ath11k_mac_set_vif_params(arvif, bcn);
+-	ret = ath11k_wmi_bcn_tmpl(ar, arvif->vdev_id, &offs, bcn);
++	if (tx_arvif == arvif)
++		ath11k_mac_set_vif_params(tx_arvif, bcn);
++	else if (!ath11k_mac_set_nontx_vif_params(tx_arvif, arvif, bcn))
++		return -EINVAL;
+ 
++	ret = ath11k_wmi_bcn_tmpl(ar, arvif->vdev_id, &offs, bcn);
+ 	kfree_skb(bcn);
+ 
+ 	if (ret)
+@@ -1405,6 +1494,23 @@ static int ath11k_mac_setup_bcn_tmpl(str
+ 	return ret;
+ }
+ 
++static int ath11k_mac_setup_bcn_tmpl(struct ath11k_vif *arvif)
++{
++	struct ieee80211_vif *vif = arvif->vif;
++
++	if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
++		return 0;
++
++	/* Target does not expect beacon templates for the already up
++	 * non-transmitting interfaces, and results in a crash if sent.
++	 */
++	if (vif->mbssid_tx_vif &&
++	    arvif != (void *)vif->mbssid_tx_vif->drv_priv && arvif->is_up)
++		return 0;
++
++	return ath11k_mac_setup_bcn_tmpl_mbssid(arvif);
++}
++
+ void ath11k_mac_bcn_tx_event(struct ath11k_vif *arvif)
+ {
+ 	struct ieee80211_vif *vif = arvif->vif;
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -1737,6 +1737,7 @@ int ath11k_wmi_bcn_tmpl(struct ath11k *a
+ 	}
+ 
+ 	cmd->buf_len = bcn->len;
++	cmd->mbssid_ie_offset = offs->mbssid_off;
+ 
+ 	ptr = skb->data + sizeof(*cmd);
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0077-wifi-ath11k-EMA-beacon-support.patch b/package/kernel/mac80211/patches/ath11k/0077-wifi-ath11k-EMA-beacon-support.patch
new file mode 100644
index 00000000000000..51353fa3e480f1
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0077-wifi-ath11k-EMA-beacon-support.patch
@@ -0,0 +1,156 @@
+From 87bd401138161008fdb82fbca6e213af117bfeb9 Mon Sep 17 00:00:00 2001
+From: Aloka Dixit <quic_alokad@quicinc.com>
+Date: Fri, 5 May 2023 16:11:28 +0300
+Subject: [PATCH 77/77] wifi: ath11k: EMA beacon support
+
+Add new function ath11k_mac_setup_bcn_tmpl_ema() which invokes the new
+API provided by MAC80211 to retrieve EMA beacons.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+Co-developed-by: John Crispin <john@phrozen.org>
+Signed-off-by: John Crispin <john@phrozen.org>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230405221648.17950-8-quic_alokad@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 59 ++++++++++++++++++++++++++-
+ drivers/net/wireless/ath/ath11k/wmi.c |  3 +-
+ drivers/net/wireless/ath/ath11k/wmi.h | 11 ++++-
+ 3 files changed, 70 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -1452,6 +1452,60 @@ static void ath11k_mac_set_vif_params(st
+ 		arvif->wpaie_present = false;
+ }
+ 
++static int ath11k_mac_setup_bcn_tmpl_ema(struct ath11k_vif *arvif)
++{
++	struct ath11k_vif *tx_arvif;
++	struct ieee80211_ema_beacons *beacons;
++	int ret = 0;
++	bool nontx_vif_params_set = false;
++	u32 params = 0;
++	u8 i = 0;
++
++	tx_arvif = (void *)arvif->vif->mbssid_tx_vif->drv_priv;
++
++	beacons = ieee80211_beacon_get_template_ema_list(tx_arvif->ar->hw,
++							 tx_arvif->vif, 0);
++	if (!beacons || !beacons->cnt) {
++		ath11k_warn(arvif->ar->ab,
++			    "failed to get ema beacon templates from mac80211\n");
++		return -EPERM;
++	}
++
++	if (tx_arvif == arvif)
++		ath11k_mac_set_vif_params(tx_arvif, beacons->bcn[0].skb);
++	else
++		arvif->wpaie_present = tx_arvif->wpaie_present;
++
++	for (i = 0; i < beacons->cnt; i++) {
++		if (tx_arvif != arvif && !nontx_vif_params_set)
++			nontx_vif_params_set =
++				ath11k_mac_set_nontx_vif_params(tx_arvif, arvif,
++								beacons->bcn[i].skb);
++
++		params = beacons->cnt;
++		params |= (i << WMI_EMA_TMPL_IDX_SHIFT);
++		params |= ((!i ? 1 : 0) << WMI_EMA_FIRST_TMPL_SHIFT);
++		params |= ((i + 1 == beacons->cnt ? 1 : 0) << WMI_EMA_LAST_TMPL_SHIFT);
++
++		ret = ath11k_wmi_bcn_tmpl(tx_arvif->ar, tx_arvif->vdev_id,
++					  &beacons->bcn[i].offs,
++					  beacons->bcn[i].skb, params);
++		if (ret) {
++			ath11k_warn(tx_arvif->ar->ab,
++				    "failed to set ema beacon template id %i error %d\n",
++				    i, ret);
++			break;
++		}
++	}
++
++	ieee80211_beacon_free_ema_list(beacons);
++
++	if (tx_arvif != arvif && !nontx_vif_params_set)
++		return -EINVAL; /* Profile not found in the beacons */
++
++	return ret;
++}
++
+ static int ath11k_mac_setup_bcn_tmpl_mbssid(struct ath11k_vif *arvif)
+ {
+ 	struct ath11k *ar = arvif->ar;
+@@ -1484,7 +1538,7 @@ static int ath11k_mac_setup_bcn_tmpl_mbs
+ 	else if (!ath11k_mac_set_nontx_vif_params(tx_arvif, arvif, bcn))
+ 		return -EINVAL;
+ 
+-	ret = ath11k_wmi_bcn_tmpl(ar, arvif->vdev_id, &offs, bcn);
++	ret = ath11k_wmi_bcn_tmpl(ar, arvif->vdev_id, &offs, bcn, 0);
+ 	kfree_skb(bcn);
+ 
+ 	if (ret)
+@@ -1508,6 +1562,9 @@ static int ath11k_mac_setup_bcn_tmpl(str
+ 	    arvif != (void *)vif->mbssid_tx_vif->drv_priv && arvif->is_up)
+ 		return 0;
+ 
++	if (vif->bss_conf.ema_ap && vif->mbssid_tx_vif)
++		return ath11k_mac_setup_bcn_tmpl_ema(arvif);
++
+ 	return ath11k_mac_setup_bcn_tmpl_mbssid(arvif);
+ }
+ 
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -1699,7 +1699,7 @@ int ath11k_wmi_send_bcn_offload_control_
+ 
+ int ath11k_wmi_bcn_tmpl(struct ath11k *ar, u32 vdev_id,
+ 			struct ieee80211_mutable_offsets *offs,
+-			struct sk_buff *bcn)
++			struct sk_buff *bcn, u32 ema_params)
+ {
+ 	struct ath11k_pdev_wmi *wmi = ar->wmi;
+ 	struct wmi_bcn_tmpl_cmd *cmd;
+@@ -1738,6 +1738,7 @@ int ath11k_wmi_bcn_tmpl(struct ath11k *a
+ 
+ 	cmd->buf_len = bcn->len;
+ 	cmd->mbssid_ie_offset = offs->mbssid_off;
++	cmd->ema_params = ema_params;
+ 
+ 	ptr = skb->data + sizeof(*cmd);
+ 
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -3566,6 +3566,10 @@ struct wmi_get_pdev_temperature_cmd {
+ 
+ #define WMI_BEACON_TX_BUFFER_SIZE	512
+ 
++#define WMI_EMA_TMPL_IDX_SHIFT            8
++#define WMI_EMA_FIRST_TMPL_SHIFT          16
++#define WMI_EMA_LAST_TMPL_SHIFT           24
++
+ struct wmi_bcn_tmpl_cmd {
+ 	u32 tlv_header;
+ 	u32 vdev_id;
+@@ -3576,6 +3580,11 @@ struct wmi_bcn_tmpl_cmd {
+ 	u32 csa_event_bitmap;
+ 	u32 mbssid_ie_offset;
+ 	u32 esp_ie_offset;
++	u32 csc_switch_count_offset;
++	u32 csc_event_bitmap;
++	u32 mu_edca_ie_offset;
++	u32 feature_enable_bitmap;
++	u32 ema_params;
+ } __packed;
+ 
+ struct wmi_key_seq_counter {
+@@ -6298,7 +6307,7 @@ int ath11k_wmi_mgmt_send(struct ath11k *
+ 			 struct sk_buff *frame);
+ int ath11k_wmi_bcn_tmpl(struct ath11k *ar, u32 vdev_id,
+ 			struct ieee80211_mutable_offsets *offs,
+-			struct sk_buff *bcn);
++			struct sk_buff *bcn, u32 ema_param);
+ int ath11k_wmi_vdev_down(struct ath11k *ar, u8 vdev_id);
+ int ath11k_wmi_vdev_up(struct ath11k *ar, u32 vdev_id, u32 aid,
+ 		       const u8 *bssid, u8 *tx_bssid, u32 nontx_profile_idx,
diff --git a/package/kernel/mac80211/patches/ath11k/0078-wifi-ath11k-Relocate-the-func-ath11k_mac_bitrate_mas.patch b/package/kernel/mac80211/patches/ath11k/0078-wifi-ath11k-Relocate-the-func-ath11k_mac_bitrate_mas.patch
new file mode 100644
index 00000000000000..610bf725149221
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0078-wifi-ath11k-Relocate-the-func-ath11k_mac_bitrate_mas.patch
@@ -0,0 +1,75 @@
+From 570eec3d40505c30babbe3b8f85a38496c975ab2 Mon Sep 17 00:00:00 2001
+From: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
+Date: Tue, 9 May 2023 20:07:23 +0300
+Subject: [PATCH] wifi: ath11k: Relocate the func
+ ath11k_mac_bitrate_mask_num_ht_rates() and change hweight16 to hweight8
+
+Relocate the function ath11k_mac_bitrate_mask_num_ht_rates() definition
+to call this function from other functions which helps to avoid the
+compilation error (function not defined).
+
+ht_mcs[] is 1 byte array and it is enough to use hweight8() instead
+of hweight16(). Hence, fixed the same.
+
+Tested on: Compile tested only.
+
+Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230504092033.3542456-2-quic_mkenna@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 30 +++++++++++++--------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #include <net/mac80211.h>
+@@ -4338,6 +4338,20 @@ exit:
+ }
+ 
+ static int
++ath11k_mac_bitrate_mask_num_ht_rates(struct ath11k *ar,
++				     enum nl80211_band band,
++				     const struct cfg80211_bitrate_mask *mask)
++{
++	int num_rates = 0;
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(mask->control[band].ht_mcs); i++)
++		num_rates += hweight8(mask->control[band].ht_mcs[i]);
++
++	return num_rates;
++}
++
++static int
+ ath11k_mac_bitrate_mask_num_vht_rates(struct ath11k *ar,
+ 				      enum nl80211_band band,
+ 				      const struct cfg80211_bitrate_mask *mask)
+@@ -7791,20 +7805,6 @@ static void ath11k_mac_op_flush(struct i
+ 	ath11k_mac_flush_tx_complete(ar);
+ }
+ 
+-static int
+-ath11k_mac_bitrate_mask_num_ht_rates(struct ath11k *ar,
+-				     enum nl80211_band band,
+-				     const struct cfg80211_bitrate_mask *mask)
+-{
+-	int num_rates = 0;
+-	int i;
+-
+-	for (i = 0; i < ARRAY_SIZE(mask->control[band].ht_mcs); i++)
+-		num_rates += hweight16(mask->control[band].ht_mcs[i]);
+-
+-	return num_rates;
+-}
+-
+ static bool
+ ath11k_mac_has_single_legacy_rate(struct ath11k *ar,
+ 				  enum nl80211_band band,
diff --git a/package/kernel/mac80211/patches/ath11k/0079-wifi-ath11k-Send-HT-fixed-rate-in-WMI-peer-fixed-par.patch b/package/kernel/mac80211/patches/ath11k/0079-wifi-ath11k-Send-HT-fixed-rate-in-WMI-peer-fixed-par.patch
new file mode 100644
index 00000000000000..6282f4462e6b45
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0079-wifi-ath11k-Send-HT-fixed-rate-in-WMI-peer-fixed-par.patch
@@ -0,0 +1,141 @@
+From df8e3729ffc0aa645839693f74ee7b6d999cdf64 Mon Sep 17 00:00:00 2001
+From: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
+Date: Tue, 9 May 2023 20:07:24 +0300
+Subject: [PATCH] wifi: ath11k: Send HT fixed rate in WMI peer fixed param
+
+Due to the firmware behavior with HT fixed rate setting,
+HT fixed rate MCS with NSS > 1 are treated as NSS = 1
+HT rates in the firmware and enables the HT fixed rate of
+NSS = 1.
+
+This leads to HT fixed rate is always configured for NSS = 1
+even though the user sets NSS = 2 or > 1 HT fixed MCS in the
+set bitrate command.
+
+Currently HT fixed MCS is sent via WMI peer assoc command.
+Fix this issue, by sending the HT fixed rate MCS in WMI peer
+fixed param instead of sending in peer assoc command.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230504092033.3542456-3-quic_mkenna@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 63 ++++++++++++++++++++++++++-
+ 1 file changed, 61 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -4480,6 +4480,54 @@ ath11k_mac_set_peer_he_fixed_rate(struct
+ 	return ret;
+ }
+ 
++static int
++ath11k_mac_set_peer_ht_fixed_rate(struct ath11k_vif *arvif,
++				  struct ieee80211_sta *sta,
++				  const struct cfg80211_bitrate_mask *mask,
++				  enum nl80211_band band)
++{
++	struct ath11k *ar = arvif->ar;
++	u8 ht_rate, nss = 0;
++	u32 rate_code;
++	int ret, i;
++
++	lockdep_assert_held(&ar->conf_mutex);
++
++	for (i = 0; i < ARRAY_SIZE(mask->control[band].ht_mcs); i++) {
++		if (hweight8(mask->control[band].ht_mcs[i]) == 1) {
++			nss = i + 1;
++			ht_rate = ffs(mask->control[band].ht_mcs[i]) - 1;
++		}
++	}
++
++	if (!nss) {
++		ath11k_warn(ar->ab, "No single HT Fixed rate found to set for %pM",
++			    sta->addr);
++		return -EINVAL;
++	}
++
++	/* Avoid updating invalid nss as fixed rate*/
++	if (nss > sta->deflink.rx_nss)
++		return -EINVAL;
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
++		   "Setting Fixed HT Rate for peer %pM. Device will not switch to any other selected rates",
++		   sta->addr);
++
++	rate_code = ATH11K_HW_RATE_CODE(ht_rate, nss - 1,
++					WMI_RATE_PREAMBLE_HT);
++	ret = ath11k_wmi_set_peer_param(ar, sta->addr,
++					arvif->vdev_id,
++					WMI_PEER_PARAM_FIXED_RATE,
++					rate_code);
++	if (ret)
++		ath11k_warn(ar->ab,
++			    "failed to update STA %pM HT Fixed Rate %d: %d\n",
++			    sta->addr, rate_code, ret);
++
++	return ret;
++}
++
+ static int ath11k_station_assoc(struct ath11k *ar,
+ 				struct ieee80211_vif *vif,
+ 				struct ieee80211_sta *sta,
+@@ -4491,7 +4539,7 @@ static int ath11k_station_assoc(struct a
+ 	struct cfg80211_chan_def def;
+ 	enum nl80211_band band;
+ 	struct cfg80211_bitrate_mask *mask;
+-	u8 num_vht_rates, num_he_rates;
++	u8 num_ht_rates, num_vht_rates, num_he_rates;
+ 
+ 	lockdep_assert_held(&ar->conf_mutex);
+ 
+@@ -4519,6 +4567,7 @@ static int ath11k_station_assoc(struct a
+ 
+ 	num_vht_rates = ath11k_mac_bitrate_mask_num_vht_rates(ar, band, mask);
+ 	num_he_rates = ath11k_mac_bitrate_mask_num_he_rates(ar, band, mask);
++	num_ht_rates = ath11k_mac_bitrate_mask_num_ht_rates(ar, band, mask);
+ 
+ 	/* If single VHT/HE rate is configured (by set_bitrate_mask()),
+ 	 * peer_assoc will disable VHT/HE. This is now enabled by a peer specific
+@@ -4535,6 +4584,11 @@ static int ath11k_station_assoc(struct a
+ 							band);
+ 		if (ret)
+ 			return ret;
++	} else if (sta->deflink.ht_cap.ht_supported && num_ht_rates == 1) {
++		ret = ath11k_mac_set_peer_ht_fixed_rate(arvif, sta, mask,
++							band);
++		if (ret)
++			return ret;
+ 	}
+ 
+ 	/* Re-assoc is run only to update supported rates for given station. It
+@@ -4608,7 +4662,7 @@ static void ath11k_sta_rc_update_wk(stru
+ 	const u16 *vht_mcs_mask;
+ 	const u16 *he_mcs_mask;
+ 	u32 changed, bw, nss, smps, bw_prev;
+-	int err, num_vht_rates, num_he_rates;
++	int err, num_ht_rates, num_vht_rates, num_he_rates;
+ 	const struct cfg80211_bitrate_mask *mask;
+ 	struct peer_assoc_params peer_arg;
+ 	enum wmi_phy_mode peer_phymode;
+@@ -4724,6 +4778,8 @@ static void ath11k_sta_rc_update_wk(stru
+ 
+ 	if (changed & IEEE80211_RC_SUPP_RATES_CHANGED) {
+ 		mask = &arvif->bitrate_mask;
++		num_ht_rates = ath11k_mac_bitrate_mask_num_ht_rates(ar, band,
++								    mask);
+ 		num_vht_rates = ath11k_mac_bitrate_mask_num_vht_rates(ar, band,
+ 								      mask);
+ 		num_he_rates = ath11k_mac_bitrate_mask_num_he_rates(ar, band,
+@@ -4746,6 +4802,9 @@ static void ath11k_sta_rc_update_wk(stru
+ 		} else if (sta->deflink.he_cap.has_he && num_he_rates == 1) {
+ 			ath11k_mac_set_peer_he_fixed_rate(arvif, sta, mask,
+ 							  band);
++		} else if (sta->deflink.ht_cap.ht_supported && num_ht_rates == 1) {
++			ath11k_mac_set_peer_ht_fixed_rate(arvif, sta, mask,
++							  band);
+ 		} else {
+ 			/* If the peer is non-VHT/HE or no fixed VHT/HE rate
+ 			 * is provided in the new bitrate mask we set the
diff --git a/package/kernel/mac80211/patches/ath11k/0080-wifi-ath11k-add-support-default-regdb-while-searchin.patch b/package/kernel/mac80211/patches/ath11k/0080-wifi-ath11k-add-support-default-regdb-while-searchin.patch
new file mode 100644
index 00000000000000..5ff40aac7a12d0
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0080-wifi-ath11k-add-support-default-regdb-while-searchin.patch
@@ -0,0 +1,127 @@
+From 88ca89202f8e8afb5225eb5244d79cd67c15d744 Mon Sep 17 00:00:00 2001
+From: Wen Gong <quic_wgong@quicinc.com>
+Date: Fri, 26 May 2023 12:41:06 +0300
+Subject: [PATCH] wifi: ath11k: add support default regdb while searching
+ board-2.bin for WCN6855
+
+Sometimes board-2.bin does not have the regdb data which matched the
+parameters such as vendor, device, subsystem-vendor, subsystem-device
+and etc. Add default regdb data with 'bus=%s' into board-2.bin for
+WCN6855, then ath11k use 'bus=pci' to search regdb data in board-2.bin
+for WCN6855.
+
+kernel: [  122.515808] ath11k_pci 0000:03:00.0: boot using board name 'bus=pci,vendor=17cb,device=1103,subsystem-vendor=17cb,subsystem-device=3374,qmi-chip-id=2,qmi-board-id=262'
+kernel: [  122.517240] ath11k_pci 0000:03:00.0: boot firmware request ath11k/WCN6855/hw2.0/board-2.bin size 6179564
+kernel: [  122.517280] ath11k_pci 0000:03:00.0: failed to fetch regdb data for bus=pci,vendor=17cb,device=1103,subsystem-vendor=17cb,subsystem-device=3374,qmi-chip-id=2,qmi-board-id=262 from ath11k/WCN6855/hw2.0/board-2.bin
+kernel: [  122.517464] ath11k_pci 0000:03:00.0: boot using board name 'bus=pci'
+kernel: [  122.518901] ath11k_pci 0000:03:00.0: boot firmware request ath11k/WCN6855/hw2.0/board-2.bin size 6179564
+kernel: [  122.518915] ath11k_pci 0000:03:00.0: board name
+kernel: [  122.518917] ath11k_pci 0000:03:00.0: 00000000: 62 75 73 3d 70 63 69                             bus=pci
+kernel: [  122.518918] ath11k_pci 0000:03:00.0: boot found match regdb data for name 'bus=pci'
+kernel: [  122.518920] ath11k_pci 0000:03:00.0: boot found regdb data for 'bus=pci'
+kernel: [  122.518921] ath11k_pci 0000:03:00.0: fetched regdb
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3
+
+Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230517133959.8224-1-quic_wgong@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c | 53 +++++++++++++++++++-------
+ 1 file changed, 40 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -961,7 +961,8 @@ int ath11k_core_check_dt(struct ath11k_b
+ }
+ 
+ static int __ath11k_core_create_board_name(struct ath11k_base *ab, char *name,
+-					   size_t name_len, bool with_variant)
++					   size_t name_len, bool with_variant,
++					   bool bus_type_mode)
+ {
+ 	/* strlen(',variant=') + strlen(ab->qmi.target.bdf_ext) */
+ 	char variant[9 + ATH11K_QMI_BDF_EXT_STR_LENGTH] = { 0 };
+@@ -972,15 +973,20 @@ static int __ath11k_core_create_board_na
+ 
+ 	switch (ab->id.bdf_search) {
+ 	case ATH11K_BDF_SEARCH_BUS_AND_BOARD:
+-		scnprintf(name, name_len,
+-			  "bus=%s,vendor=%04x,device=%04x,subsystem-vendor=%04x,subsystem-device=%04x,qmi-chip-id=%d,qmi-board-id=%d%s",
+-			  ath11k_bus_str(ab->hif.bus),
+-			  ab->id.vendor, ab->id.device,
+-			  ab->id.subsystem_vendor,
+-			  ab->id.subsystem_device,
+-			  ab->qmi.target.chip_id,
+-			  ab->qmi.target.board_id,
+-			  variant);
++		if (bus_type_mode)
++			scnprintf(name, name_len,
++				  "bus=%s",
++				  ath11k_bus_str(ab->hif.bus));
++		else
++			scnprintf(name, name_len,
++				  "bus=%s,vendor=%04x,device=%04x,subsystem-vendor=%04x,subsystem-device=%04x,qmi-chip-id=%d,qmi-board-id=%d%s",
++				  ath11k_bus_str(ab->hif.bus),
++				  ab->id.vendor, ab->id.device,
++				  ab->id.subsystem_vendor,
++				  ab->id.subsystem_device,
++				  ab->qmi.target.chip_id,
++				  ab->qmi.target.board_id,
++				  variant);
+ 		break;
+ 	default:
+ 		scnprintf(name, name_len,
+@@ -999,13 +1005,19 @@ static int __ath11k_core_create_board_na
+ static int ath11k_core_create_board_name(struct ath11k_base *ab, char *name,
+ 					 size_t name_len)
+ {
+-	return __ath11k_core_create_board_name(ab, name, name_len, true);
++	return __ath11k_core_create_board_name(ab, name, name_len, true, false);
+ }
+ 
+ static int ath11k_core_create_fallback_board_name(struct ath11k_base *ab, char *name,
+ 						  size_t name_len)
+ {
+-	return __ath11k_core_create_board_name(ab, name, name_len, false);
++	return __ath11k_core_create_board_name(ab, name, name_len, false, false);
++}
++
++static int ath11k_core_create_bus_type_board_name(struct ath11k_base *ab, char *name,
++						  size_t name_len)
++{
++	return __ath11k_core_create_board_name(ab, name, name_len, false, true);
+ }
+ 
+ const struct firmware *ath11k_core_firmware_request(struct ath11k_base *ab,
+@@ -1309,7 +1321,7 @@ success:
+ 
+ int ath11k_core_fetch_regdb(struct ath11k_base *ab, struct ath11k_board_data *bd)
+ {
+-	char boardname[BOARD_NAME_SIZE];
++	char boardname[BOARD_NAME_SIZE], default_boardname[BOARD_NAME_SIZE];
+ 	int ret;
+ 
+ 	ret = ath11k_core_create_board_name(ab, boardname, BOARD_NAME_SIZE);
+@@ -1323,6 +1335,21 @@ int ath11k_core_fetch_regdb(struct ath11
+ 						 ATH11K_BD_IE_REGDB,
+ 						 ATH11K_BD_IE_REGDB_NAME,
+ 						 ATH11K_BD_IE_REGDB_DATA);
++	if (!ret)
++		goto exit;
++
++	ret = ath11k_core_create_bus_type_board_name(ab, default_boardname,
++						     BOARD_NAME_SIZE);
++	if (ret) {
++		ath11k_dbg(ab, ATH11K_DBG_BOOT,
++			   "failed to create default board name for regdb: %d", ret);
++		goto exit;
++	}
++
++	ret = ath11k_core_fetch_board_data_api_n(ab, bd, default_boardname,
++						 ATH11K_BD_IE_REGDB,
++						 ATH11K_BD_IE_REGDB_NAME,
++						 ATH11K_BD_IE_REGDB_DATA);
+ 	if (!ret)
+ 		goto exit;
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0081-wifi-ath11k-remove-unused-function-ath11k_tm_event_w.patch b/package/kernel/mac80211/patches/ath11k/0081-wifi-ath11k-remove-unused-function-ath11k_tm_event_w.patch
new file mode 100644
index 00000000000000..b5dc83f007e3ab
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0081-wifi-ath11k-remove-unused-function-ath11k_tm_event_w.patch
@@ -0,0 +1,128 @@
+From 86f85575a3f6a20cef1c8bb98e78585fe3a53ccc Mon Sep 17 00:00:00 2001
+From: Govindaraj Saminathan <quic_gsaminat@quicinc.com>
+Date: Fri, 26 May 2023 12:41:06 +0300
+Subject: [PATCH 82/84] wifi: ath11k: remove unused function
+ ath11k_tm_event_wmi()
+
+The function ath11k_tm_event_wmi() is only defined and it is not used
+anywhere. Hence remove the unused.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Govindaraj Saminathan <quic_gsaminat@quicinc.com>
+Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230517135934.16408-2-quic_rajkbhag@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/testmode.c | 64 +---------------------
+ drivers/net/wireless/ath/ath11k/testmode.h |  8 +--
+ 2 files changed, 2 insertions(+), 70 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/testmode.c
++++ b/drivers/net/wireless/ath/ath11k/testmode.c
+@@ -1,6 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
++ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #include "testmode.h"
+@@ -20,69 +21,6 @@ static const struct nla_policy ath11k_tm
+ 	[ATH11K_TM_ATTR_VERSION_MINOR]	= { .type = NLA_U32 },
+ };
+ 
+-/* Returns true if callee consumes the skb and the skb should be discarded.
+- * Returns false if skb is not used. Does not sleep.
+- */
+-bool ath11k_tm_event_wmi(struct ath11k *ar, u32 cmd_id, struct sk_buff *skb)
+-{
+-	struct sk_buff *nl_skb;
+-	bool consumed;
+-	int ret;
+-
+-	ath11k_dbg(ar->ab, ATH11K_DBG_TESTMODE,
+-		   "testmode event wmi cmd_id %d skb %pK skb->len %d\n",
+-		   cmd_id, skb, skb->len);
+-
+-	ath11k_dbg_dump(ar->ab, ATH11K_DBG_TESTMODE, NULL, "", skb->data, skb->len);
+-
+-	spin_lock_bh(&ar->data_lock);
+-
+-	consumed = true;
+-
+-	nl_skb = cfg80211_testmode_alloc_event_skb(ar->hw->wiphy,
+-						   2 * sizeof(u32) + skb->len,
+-						   GFP_ATOMIC);
+-	if (!nl_skb) {
+-		ath11k_warn(ar->ab,
+-			    "failed to allocate skb for testmode wmi event\n");
+-		goto out;
+-	}
+-
+-	ret = nla_put_u32(nl_skb, ATH11K_TM_ATTR_CMD, ATH11K_TM_CMD_WMI);
+-	if (ret) {
+-		ath11k_warn(ar->ab,
+-			    "failed to put testmode wmi event cmd attribute: %d\n",
+-			    ret);
+-		kfree_skb(nl_skb);
+-		goto out;
+-	}
+-
+-	ret = nla_put_u32(nl_skb, ATH11K_TM_ATTR_WMI_CMDID, cmd_id);
+-	if (ret) {
+-		ath11k_warn(ar->ab,
+-			    "failed to put testmode wmi even cmd_id: %d\n",
+-			    ret);
+-		kfree_skb(nl_skb);
+-		goto out;
+-	}
+-
+-	ret = nla_put(nl_skb, ATH11K_TM_ATTR_DATA, skb->len, skb->data);
+-	if (ret) {
+-		ath11k_warn(ar->ab,
+-			    "failed to copy skb to testmode wmi event: %d\n",
+-			    ret);
+-		kfree_skb(nl_skb);
+-		goto out;
+-	}
+-
+-	cfg80211_testmode_event(nl_skb, GFP_ATOMIC);
+-
+-out:
+-	spin_unlock_bh(&ar->data_lock);
+-
+-	return consumed;
+-}
+-
+ static int ath11k_tm_cmd_get_version(struct ath11k *ar, struct nlattr *tb[])
+ {
+ 	struct sk_buff *skb;
+--- a/drivers/net/wireless/ath/ath11k/testmode.h
++++ b/drivers/net/wireless/ath/ath11k/testmode.h
+@@ -1,24 +1,18 @@
+ /* SPDX-License-Identifier: BSD-3-Clause-Clear */
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
++ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #include "core.h"
+ 
+ #ifdef CPTCFG_NL80211_TESTMODE
+ 
+-bool ath11k_tm_event_wmi(struct ath11k *ar, u32 cmd_id, struct sk_buff *skb);
+ int ath11k_tm_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		  void *data, int len);
+ 
+ #else
+ 
+-static inline bool ath11k_tm_event_wmi(struct ath11k *ar, u32 cmd_id,
+-				       struct sk_buff *skb)
+-{
+-	return false;
+-}
+-
+ static inline int ath11k_tm_cmd(struct ieee80211_hw *hw,
+ 				struct ieee80211_vif *vif,
+ 				void *data, int len)
diff --git a/package/kernel/mac80211/patches/ath11k/0082-wifi-ath11k-factory-test-mode-support.patch b/package/kernel/mac80211/patches/ath11k/0082-wifi-ath11k-factory-test-mode-support.patch
new file mode 100644
index 00000000000000..f1b262724f94eb
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0082-wifi-ath11k-factory-test-mode-support.patch
@@ -0,0 +1,850 @@
+From b43310e44edc823a7f02af1e1e2b4e8a9abc7d91 Mon Sep 17 00:00:00 2001
+From: Govindaraj Saminathan <quic_gsaminat@quicinc.com>
+Date: Fri, 26 May 2023 12:41:07 +0300
+Subject: [PATCH 83/84] wifi: ath11k: factory test mode support
+
+Add support to process factory test mode commands (FTM) for calibration.
+By default firmware start with NORMAL mode and to process the FTM commands
+firmware needs to be restarted in FTM mode using module parameter ftm_mode.
+The pre-request is all the radios should be down before starting the test.
+
+When start command ATH11K_TM_CMD_TESTMODE_START is received, ar->state
+is set to Test Mode. If the FTM command or event length is greater
+than 256 bytes, it will be broken down into multiple segments and
+encoded with TLV header if it is segmented commands, else it is sent
+to firmware as it is.
+
+On receiving UTF event from firmware, if it is segmented event, the driver
+will wait until it receives all the segments and notify the complete
+data to user application. In case the segmented sequence are missed or
+lost from the firmware, driver will skip the already received partial data.
+
+In case of unsegmented UTF event from firmware, driver notifies the
+data to the user application as it comes. Applications handles
+the data further.
+
+Command to boot in ftm mode:
+
+insmod ath11k ftm_mode=1
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Govindaraj Saminathan <quic_gsaminat@quicinc.com>
+Co-developed-by: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
+Signed-off-by: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
+Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230517135934.16408-4-quic_rajkbhag@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/ahb.c        |   3 +-
+ drivers/net/wireless/ath/ath11k/core.c       |  21 +-
+ drivers/net/wireless/ath/ath11k/core.h       |  16 +-
+ drivers/net/wireless/ath/ath11k/debug.h      |   1 +
+ drivers/net/wireless/ath/ath11k/mac.c        |  11 +-
+ drivers/net/wireless/ath/ath11k/pci.c        |   3 +-
+ drivers/net/wireless/ath/ath11k/testmode.c   | 350 ++++++++++++++++++-
+ drivers/net/wireless/ath/ath11k/testmode.h   |   6 +
+ drivers/net/wireless/ath/ath11k/testmode_i.h |  18 +-
+ drivers/net/wireless/ath/ath11k/wmi.c        |  11 +-
+ drivers/net/wireless/ath/ath11k/wmi.h        |  22 ++
+ drivers/net/wireless/ath/ath11k/wow.c        |   3 +-
+ 12 files changed, 444 insertions(+), 21 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #include <linux/module.h>
+@@ -1155,6 +1155,7 @@ static int ath11k_ahb_probe(struct platf
+ 	ab->hif.ops = hif_ops;
+ 	ab->pdev = pdev;
+ 	ab->hw_rev = hw_rev;
++	ab->fw_mode = ATH11K_FIRMWARE_MODE_NORMAL;
+ 	platform_set_drvdata(pdev, ab);
+ 
+ 	ret = ath11k_pcic_register_pci_ops(ab, pci_ops);
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #include <linux/module.h>
+@@ -32,6 +32,10 @@ module_param_named(frame_mode, ath11k_fr
+ MODULE_PARM_DESC(frame_mode,
+ 		 "Datapath frame mode (0: raw, 1: native wifi (default), 2: ethernet)");
+ 
++bool ath11k_ftm_mode;
++module_param_named(ftm_mode, ath11k_ftm_mode, bool, 0444);
++MODULE_PARM_DESC(ftm_mode, "Boots up in factory test mode");
++
+ static const struct ath11k_hw_params ath11k_hw_params[] = {
+ 	{
+ 		.hw_rev = ATH11K_HW_IPQ8074,
+@@ -1381,6 +1385,11 @@ static int ath11k_core_soc_create(struct
+ {
+ 	int ret;
+ 
++	if (ath11k_ftm_mode) {
++		ab->fw_mode = ATH11K_FIRMWARE_MODE_FTM;
++		ath11k_info(ab, "Booting in factory test mode\n");
++	}
++
+ 	ret = ath11k_qmi_init_service(ab);
+ 	if (ret) {
+ 		ath11k_err(ab, "failed to initialize qmi :%d\n", ret);
+@@ -1607,7 +1616,7 @@ int ath11k_core_qmi_firmware_ready(struc
+ {
+ 	int ret;
+ 
+-	ret = ath11k_core_start_firmware(ab, ATH11K_FIRMWARE_MODE_NORMAL);
++	ret = ath11k_core_start_firmware(ab, ab->fw_mode);
+ 	if (ret) {
+ 		ath11k_err(ab, "failed to start firmware: %d\n", ret);
+ 		return ret;
+@@ -1772,7 +1781,8 @@ void ath11k_core_pre_reconfigure_recover
+ 	for (i = 0; i < ab->num_radios; i++) {
+ 		pdev = &ab->pdevs[i];
+ 		ar = pdev->ar;
+-		if (!ar || ar->state == ATH11K_STATE_OFF)
++		if (!ar || ar->state == ATH11K_STATE_OFF ||
++		    ar->state == ATH11K_STATE_FTM)
+ 			continue;
+ 
+ 		ieee80211_stop_queues(ar->hw);
+@@ -1841,7 +1851,12 @@ static void ath11k_core_post_reconfigure
+ 			ath11k_warn(ab,
+ 				    "device is wedged, will not restart radio %d\n", i);
+ 			break;
++		case ATH11K_STATE_FTM:
++			ath11k_dbg(ab, ATH11K_DBG_TESTMODE,
++				   "fw mode reset done radio %d\n", i);
++			break;
+ 		}
++
+ 		mutex_unlock(&ar->conf_mutex);
+ 	}
+ 	complete(&ab->driver_recovery);
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -1,7 +1,7 @@
+ /* SPDX-License-Identifier: BSD-3-Clause-Clear */
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #ifndef ATH11K_CORE_H
+@@ -52,6 +52,7 @@
+ #define ATH11K_SMBIOS_BDF_EXT_MAGIC "BDF_"
+ 
+ extern unsigned int ath11k_frame_mode;
++extern bool ath11k_ftm_mode;
+ 
+ #define ATH11K_SCAN_TIMEOUT_HZ (20 * HZ)
+ 
+@@ -277,6 +278,7 @@ enum ath11k_dev_flags {
+ 	ATH11K_FLAG_FIXED_MEM_RGN,
+ 	ATH11K_FLAG_DEVICE_INIT_DONE,
+ 	ATH11K_FLAG_MULTI_MSI_VECTORS,
++	ATH11K_FLAG_FTM_SEGMENTED,
+ };
+ 
+ enum ath11k_monitor_flags {
+@@ -530,6 +532,7 @@ enum ath11k_state {
+ 	ATH11K_STATE_RESTARTING,
+ 	ATH11K_STATE_RESTARTED,
+ 	ATH11K_STATE_WEDGED,
++	ATH11K_STATE_FTM,
+ 	/* Add other states as required */
+ };
+ 
+@@ -709,6 +712,8 @@ struct ath11k {
+ 	u32 last_ppdu_id;
+ 	u32 cached_ppdu_id;
+ 	int monitor_vdev_id;
++	struct completion fw_mode_reset;
++	u8 ftm_msgref;
+ #ifdef CPTCFG_ATH11K_DEBUGFS
+ 	struct ath11k_debug debug;
+ #endif
+@@ -838,6 +843,7 @@ struct ath11k_msi_config {
+ /* Master structure to hold the hw data which may be used in core module */
+ struct ath11k_base {
+ 	enum ath11k_hw_rev hw_rev;
++	enum ath11k_firmware_mode fw_mode;
+ 	struct platform_device *pdev;
+ 	struct device *dev;
+ 	struct ath11k_qmi qmi;
+@@ -978,6 +984,14 @@ struct ath11k_base {
+ 		const struct ath11k_pci_ops *ops;
+ 	} pci;
+ 
++#ifdef CPTCFG_NL80211_TESTMODE
++	struct {
++		u32 data_pos;
++		u32 expected_seq;
++		u8 *eventdata;
++	} testmode;
++#endif
++
+ 	/* must be last */
+ 	u8 drv_priv[] __aligned(sizeof(void *));
+ };
+--- a/drivers/net/wireless/ath/ath11k/debug.h
++++ b/drivers/net/wireless/ath/ath11k/debug.h
+@@ -1,6 +1,7 @@
+ /* SPDX-License-Identifier: BSD-3-Clause-Clear */
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
++ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #ifndef _ATH11K_DEBUG_H_
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -643,7 +643,10 @@ struct ath11k *ath11k_mac_get_ar_by_pdev
+ 		return NULL;
+ 
+ 	for (i = 0; i < ab->num_radios; i++) {
+-		pdev = rcu_dereference(ab->pdevs_active[i]);
++		if (ab->fw_mode == ATH11K_FIRMWARE_MODE_FTM)
++			pdev = &ab->pdevs[i];
++		else
++			pdev = rcu_dereference(ab->pdevs_active[i]);
+ 
+ 		if (pdev && pdev->pdev_id == pdev_id)
+ 			return (pdev->ar ? pdev->ar : NULL);
+@@ -6271,6 +6274,11 @@ static int ath11k_mac_op_start(struct ie
+ 	struct ath11k_pdev *pdev = ar->pdev;
+ 	int ret;
+ 
++	if (ath11k_ftm_mode) {
++		ath11k_warn(ab, "mac operations not supported in factory test mode\n");
++		return -EOPNOTSUPP;
++	}
++
+ 	ath11k_mac_drain_tx(ar);
+ 	mutex_lock(&ar->conf_mutex);
+ 
+@@ -6285,6 +6293,7 @@ static int ath11k_mac_op_start(struct ie
+ 	case ATH11K_STATE_RESTARTED:
+ 	case ATH11K_STATE_WEDGED:
+ 	case ATH11K_STATE_ON:
++	case ATH11K_STATE_FTM:
+ 		WARN_ON(1);
+ 		ret = -EINVAL;
+ 		goto err;
+--- a/drivers/net/wireless/ath/ath11k/pci.c
++++ b/drivers/net/wireless/ath/ath11k/pci.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+  * Copyright (c) 2019-2020 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2021-2022, Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #include <linux/module.h>
+@@ -745,6 +745,7 @@ static int ath11k_pci_probe(struct pci_d
+ 	ab_pci->ab = ab;
+ 	ab_pci->pdev = pdev;
+ 	ab->hif.ops = &ath11k_pci_hif_ops;
++	ab->fw_mode = ATH11K_FIRMWARE_MODE_NORMAL;
+ 	pci_set_drvdata(pdev, ab);
+ 	spin_lock_init(&ab_pci->window_lock);
+ 
+--- a/drivers/net/wireless/ath/ath11k/testmode.c
++++ b/drivers/net/wireless/ath/ath11k/testmode.c
+@@ -12,6 +12,9 @@
+ #include "core.h"
+ #include "testmode_i.h"
+ 
++#define ATH11K_FTM_SEGHDR_CURRENT_SEQ		GENMASK(3, 0)
++#define ATH11K_FTM_SEGHDR_TOTAL_SEGMENTS	GENMASK(7, 4)
++
+ static const struct nla_policy ath11k_tm_policy[ATH11K_TM_ATTR_MAX + 1] = {
+ 	[ATH11K_TM_ATTR_CMD]		= { .type = NLA_U32 },
+ 	[ATH11K_TM_ATTR_DATA]		= { .type = NLA_BINARY,
+@@ -21,13 +24,217 @@ static const struct nla_policy ath11k_tm
+ 	[ATH11K_TM_ATTR_VERSION_MINOR]	= { .type = NLA_U32 },
+ };
+ 
++static struct ath11k *ath11k_tm_get_ar(struct ath11k_base *ab)
++{
++	struct ath11k_pdev *pdev;
++	struct ath11k *ar = NULL;
++	int i;
++
++	for (i = 0; i < ab->num_radios; i++) {
++		pdev = &ab->pdevs[i];
++		ar = pdev->ar;
++
++		if (ar && ar->state == ATH11K_STATE_FTM)
++			break;
++	}
++
++	return ar;
++}
++
++/* This function handles unsegmented events. Data in various events are aggregated
++ * in application layer, this event is unsegmented from host perspective.
++ */
++static void ath11k_tm_wmi_event_unsegmented(struct ath11k_base *ab, u32 cmd_id,
++					    struct sk_buff *skb)
++{
++	struct sk_buff *nl_skb;
++	struct ath11k *ar;
++
++	ath11k_dbg(ab, ATH11K_DBG_TESTMODE,
++		   "event wmi cmd_id %d skb length %d\n",
++		   cmd_id, skb->len);
++	ath11k_dbg_dump(ab, ATH11K_DBG_TESTMODE, NULL, "", skb->data, skb->len);
++
++	ar = ath11k_tm_get_ar(ab);
++	if (!ar) {
++		ath11k_warn(ab, "testmode event not handled due to invalid pdev\n");
++		return;
++	}
++
++	spin_lock_bh(&ar->data_lock);
++
++	nl_skb = cfg80211_testmode_alloc_event_skb(ar->hw->wiphy,
++						   2 * nla_total_size(sizeof(u32)) +
++						   nla_total_size(skb->len),
++						   GFP_ATOMIC);
++	if (!nl_skb) {
++		ath11k_warn(ab,
++			    "failed to allocate skb for unsegmented testmode wmi event\n");
++		goto out;
++	}
++
++	if (nla_put_u32(nl_skb, ATH11K_TM_ATTR_CMD, ATH11K_TM_CMD_WMI) ||
++	    nla_put_u32(nl_skb, ATH11K_TM_ATTR_WMI_CMDID, cmd_id) ||
++	    nla_put(nl_skb, ATH11K_TM_ATTR_DATA, skb->len, skb->data)) {
++		ath11k_warn(ab, "failed to populate testmode unsegmented event\n");
++		kfree_skb(nl_skb);
++		goto out;
++	}
++
++	cfg80211_testmode_event(nl_skb, GFP_ATOMIC);
++	spin_unlock_bh(&ar->data_lock);
++	return;
++
++out:
++	spin_unlock_bh(&ar->data_lock);
++	ath11k_warn(ab, "Failed to send testmode event to higher layers\n");
++}
++
++/* This function handles segmented events. Data of various events received
++ * from firmware is aggregated and sent to application layer
++ */
++static int ath11k_tm_process_event(struct ath11k_base *ab, u32 cmd_id,
++				   const struct wmi_ftm_event_msg *ftm_msg,
++				   u16 length)
++{
++	struct sk_buff *nl_skb;
++	int ret = 0;
++	struct ath11k *ar;
++	u8 const *buf_pos;
++	u16 datalen;
++	u8 total_segments, current_seq;
++	u32 data_pos;
++	u32 pdev_id;
++
++	ath11k_dbg(ab, ATH11K_DBG_TESTMODE,
++		   "event wmi cmd_id %d ftm event msg %pK datalen %d\n",
++		   cmd_id, ftm_msg, length);
++	ath11k_dbg_dump(ab, ATH11K_DBG_TESTMODE, NULL, "", ftm_msg, length);
++	pdev_id = DP_HW2SW_MACID(ftm_msg->seg_hdr.pdev_id);
++
++	if (pdev_id >= ab->num_radios) {
++		ath11k_warn(ab, "testmode event not handled due to invalid pdev id: %d\n",
++			    pdev_id);
++		return -EINVAL;
++	}
++
++	ar = ab->pdevs[pdev_id].ar;
++	if (!ar) {
++		ath11k_warn(ab, "testmode event not handled due to absence of pdev\n");
++		return -ENODEV;
++	}
++
++	current_seq = FIELD_GET(ATH11K_FTM_SEGHDR_CURRENT_SEQ,
++				ftm_msg->seg_hdr.segmentinfo);
++	total_segments = FIELD_GET(ATH11K_FTM_SEGHDR_TOTAL_SEGMENTS,
++				   ftm_msg->seg_hdr.segmentinfo);
++	datalen = length - (sizeof(struct wmi_ftm_seg_hdr));
++	buf_pos = ftm_msg->data;
++
++	spin_lock_bh(&ar->data_lock);
++
++	if (current_seq == 0) {
++		ab->testmode.expected_seq = 0;
++		ab->testmode.data_pos = 0;
++	}
++
++	data_pos = ab->testmode.data_pos;
++
++	if ((data_pos + datalen) > ATH11K_FTM_EVENT_MAX_BUF_LENGTH) {
++		ath11k_warn(ab, "Invalid ftm event length at %d: %d\n",
++			    data_pos, datalen);
++		ret = -EINVAL;
++		goto out;
++	}
++
++	memcpy(&ab->testmode.eventdata[data_pos], buf_pos, datalen);
++	data_pos += datalen;
++
++	if (++ab->testmode.expected_seq != total_segments) {
++		ab->testmode.data_pos = data_pos;
++		ath11k_dbg(ab, ATH11K_DBG_TESTMODE,
++			   "partial data received current_seq %d total_seg %d\n",
++			    current_seq, total_segments);
++		goto out;
++	}
++
++	ath11k_dbg(ab, ATH11K_DBG_TESTMODE,
++		   "total data length pos %d len %d\n",
++		    data_pos, ftm_msg->seg_hdr.len);
++	nl_skb = cfg80211_testmode_alloc_event_skb(ar->hw->wiphy,
++						   2 * nla_total_size(sizeof(u32)) +
++						   nla_total_size(data_pos),
++						   GFP_ATOMIC);
++	if (!nl_skb) {
++		ath11k_warn(ab,
++			    "failed to allocate skb for segmented testmode wmi event\n");
++		ret = -ENOMEM;
++		goto out;
++	}
++
++	if (nla_put_u32(nl_skb, ATH11K_TM_ATTR_CMD,
++			ATH11K_TM_CMD_WMI_FTM) ||
++	    nla_put_u32(nl_skb, ATH11K_TM_ATTR_WMI_CMDID, cmd_id) ||
++	    nla_put(nl_skb, ATH11K_TM_ATTR_DATA, data_pos,
++		    &ab->testmode.eventdata[0])) {
++		ath11k_warn(ab, "failed to populate segmented testmode event");
++		kfree_skb(nl_skb);
++		ret = -ENOBUFS;
++		goto out;
++	}
++
++	cfg80211_testmode_event(nl_skb, GFP_ATOMIC);
++
++out:
++	spin_unlock_bh(&ar->data_lock);
++	return ret;
++}
++
++static void ath11k_tm_wmi_event_segmented(struct ath11k_base *ab, u32 cmd_id,
++					  struct sk_buff *skb)
++{
++	const void **tb;
++	const struct wmi_ftm_event_msg *ev;
++	u16 length;
++	int ret;
++
++	tb = ath11k_wmi_tlv_parse_alloc(ab, skb->data, skb->len, GFP_ATOMIC);
++	if (IS_ERR(tb)) {
++		ret = PTR_ERR(tb);
++		ath11k_warn(ab, "failed to parse ftm event tlv: %d\n", ret);
++		return;
++	}
++
++	ev = tb[WMI_TAG_ARRAY_BYTE];
++	if (!ev) {
++		ath11k_warn(ab, "failed to fetch ftm msg\n");
++		kfree(tb);
++		return;
++	}
++
++	length = skb->len - TLV_HDR_SIZE;
++	ret = ath11k_tm_process_event(ab, cmd_id, ev, length);
++	if (ret)
++		ath11k_warn(ab, "Failed to process ftm event\n");
++
++	kfree(tb);
++}
++
++void ath11k_tm_wmi_event(struct ath11k_base *ab, u32 cmd_id, struct sk_buff *skb)
++{
++	if (test_bit(ATH11K_FLAG_FTM_SEGMENTED, &ab->dev_flags))
++		ath11k_tm_wmi_event_segmented(ab, cmd_id, skb);
++	else
++		ath11k_tm_wmi_event_unsegmented(ab, cmd_id, skb);
++}
++
+ static int ath11k_tm_cmd_get_version(struct ath11k *ar, struct nlattr *tb[])
+ {
+ 	struct sk_buff *skb;
+ 	int ret;
+ 
+ 	ath11k_dbg(ar->ab, ATH11K_DBG_TESTMODE,
+-		   "testmode cmd get version_major %d version_minor %d\n",
++		   "cmd get version_major %d version_minor %d\n",
+ 		   ATH11K_TESTMODE_VERSION_MAJOR,
+ 		   ATH11K_TESTMODE_VERSION_MINOR);
+ 
+@@ -53,6 +260,43 @@ static int ath11k_tm_cmd_get_version(str
+ 	return cfg80211_testmode_reply(skb);
+ }
+ 
++static int ath11k_tm_cmd_testmode_start(struct ath11k *ar, struct nlattr *tb[])
++{
++	int ret;
++
++	mutex_lock(&ar->conf_mutex);
++
++	if (ar->state == ATH11K_STATE_FTM) {
++		ret = -EALREADY;
++		goto err;
++	}
++
++	/* start utf only when the driver is not in use  */
++	if (ar->state != ATH11K_STATE_OFF) {
++		ret = -EBUSY;
++		goto err;
++	}
++
++	ar->ab->testmode.eventdata = kzalloc(ATH11K_FTM_EVENT_MAX_BUF_LENGTH,
++					     GFP_KERNEL);
++	if (!ar->ab->testmode.eventdata) {
++		ret = -ENOMEM;
++		goto err;
++	}
++
++	ar->state = ATH11K_STATE_FTM;
++	ar->ftm_msgref = 0;
++
++	mutex_unlock(&ar->conf_mutex);
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_TESTMODE, "cmd start\n");
++	return 0;
++
++err:
++	mutex_unlock(&ar->conf_mutex);
++	return ret;
++}
++
+ static int ath11k_tm_cmd_wmi(struct ath11k *ar, struct nlattr *tb[])
+ {
+ 	struct ath11k_pdev_wmi *wmi = ar->wmi;
+@@ -63,11 +307,6 @@ static int ath11k_tm_cmd_wmi(struct ath1
+ 
+ 	mutex_lock(&ar->conf_mutex);
+ 
+-	if (ar->state != ATH11K_STATE_ON) {
+-		ret = -ENETDOWN;
+-		goto out;
+-	}
+-
+ 	if (!tb[ATH11K_TM_ATTR_DATA]) {
+ 		ret = -EINVAL;
+ 		goto out;
+@@ -80,11 +319,17 @@ static int ath11k_tm_cmd_wmi(struct ath1
+ 
+ 	buf = nla_data(tb[ATH11K_TM_ATTR_DATA]);
+ 	buf_len = nla_len(tb[ATH11K_TM_ATTR_DATA]);
++	if (!buf_len) {
++		ath11k_warn(ar->ab, "No data present in testmode wmi command\n");
++		ret = -EINVAL;
++		goto out;
++	}
++
+ 	cmd_id = nla_get_u32(tb[ATH11K_TM_ATTR_WMI_CMDID]);
+ 
+ 	ath11k_dbg(ar->ab, ATH11K_DBG_TESTMODE,
+-		   "testmode cmd wmi cmd_id %d buf %pK buf_len %d\n",
+-		   cmd_id, buf, buf_len);
++		   "cmd wmi cmd_id %d buf length %d\n",
++		   cmd_id, buf_len);
+ 
+ 	ath11k_dbg_dump(ar->ab, ATH11K_DBG_TESTMODE, NULL, "", buf, buf_len);
+ 
+@@ -111,6 +356,91 @@ out:
+ 	return ret;
+ }
+ 
++static int ath11k_tm_cmd_wmi_ftm(struct ath11k *ar, struct nlattr *tb[])
++{
++	struct ath11k_pdev_wmi *wmi = ar->wmi;
++	struct ath11k_base *ab = ar->ab;
++	struct sk_buff *skb;
++	u32 cmd_id, buf_len, hdr_info;
++	int ret;
++	void *buf;
++	u8 segnumber = 0, seginfo;
++	u16 chunk_len, total_bytes, num_segments;
++	u8 *bufpos;
++	struct wmi_ftm_cmd *ftm_cmd;
++
++	set_bit(ATH11K_FLAG_FTM_SEGMENTED, &ab->dev_flags);
++
++	mutex_lock(&ar->conf_mutex);
++
++	if (ar->state != ATH11K_STATE_FTM) {
++		ret = -ENETDOWN;
++		goto out;
++	}
++
++	if (!tb[ATH11K_TM_ATTR_DATA]) {
++		ret = -EINVAL;
++		goto out;
++	}
++
++	buf = nla_data(tb[ATH11K_TM_ATTR_DATA]);
++	buf_len = nla_len(tb[ATH11K_TM_ATTR_DATA]);
++	cmd_id = WMI_PDEV_UTF_CMDID;
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_TESTMODE,
++		   "cmd wmi ftm cmd_id %d buffer length %d\n",
++		   cmd_id, buf_len);
++	ath11k_dbg_dump(ar->ab, ATH11K_DBG_TESTMODE, NULL, "", buf, buf_len);
++
++	bufpos = buf;
++	total_bytes = buf_len;
++	num_segments = total_bytes / MAX_WMI_UTF_LEN;
++
++	if (buf_len - (num_segments * MAX_WMI_UTF_LEN))
++		num_segments++;
++
++	while (buf_len) {
++		chunk_len = min_t(u16, buf_len, MAX_WMI_UTF_LEN);
++
++		skb = ath11k_wmi_alloc_skb(wmi->wmi_ab, (chunk_len +
++					   sizeof(struct wmi_ftm_cmd)));
++		if (!skb) {
++			ret = -ENOMEM;
++			goto out;
++		}
++
++		ftm_cmd = (struct wmi_ftm_cmd *)skb->data;
++		hdr_info = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_BYTE) |
++			   FIELD_PREP(WMI_TLV_LEN, (chunk_len +
++				      sizeof(struct wmi_ftm_seg_hdr)));
++		ftm_cmd->tlv_header = hdr_info;
++		ftm_cmd->seg_hdr.len = total_bytes;
++		ftm_cmd->seg_hdr.msgref = ar->ftm_msgref;
++		seginfo = FIELD_PREP(ATH11K_FTM_SEGHDR_TOTAL_SEGMENTS, num_segments) |
++			  FIELD_PREP(ATH11K_FTM_SEGHDR_CURRENT_SEQ, segnumber);
++		ftm_cmd->seg_hdr.segmentinfo = seginfo;
++		segnumber++;
++
++		memcpy(&ftm_cmd->data, bufpos, chunk_len);
++
++		ret = ath11k_wmi_cmd_send(wmi, skb, cmd_id);
++		if (ret) {
++			ath11k_warn(ar->ab, "failed to send wmi ftm command: %d\n", ret);
++			goto out;
++		}
++
++		buf_len -= chunk_len;
++		bufpos += chunk_len;
++	}
++
++	ar->ftm_msgref++;
++	ret = 0;
++
++out:
++	mutex_unlock(&ar->conf_mutex);
++	return ret;
++}
++
+ int ath11k_tm_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		  void *data, int len)
+ {
+@@ -131,6 +461,10 @@ int ath11k_tm_cmd(struct ieee80211_hw *h
+ 		return ath11k_tm_cmd_get_version(ar, tb);
+ 	case ATH11K_TM_CMD_WMI:
+ 		return ath11k_tm_cmd_wmi(ar, tb);
++	case ATH11K_TM_CMD_TESTMODE_START:
++		return ath11k_tm_cmd_testmode_start(ar, tb);
++	case ATH11K_TM_CMD_WMI_FTM:
++		return ath11k_tm_cmd_wmi_ftm(ar, tb);
+ 	default:
+ 		return -EOPNOTSUPP;
+ 	}
+--- a/drivers/net/wireless/ath/ath11k/testmode.h
++++ b/drivers/net/wireless/ath/ath11k/testmode.h
+@@ -8,11 +8,17 @@
+ 
+ #ifdef CPTCFG_NL80211_TESTMODE
+ 
++void ath11k_tm_wmi_event(struct ath11k_base *ab, u32 cmd_id, struct sk_buff *skb);
+ int ath11k_tm_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		  void *data, int len);
+ 
+ #else
+ 
++static inline void ath11k_tm_wmi_event(struct ath11k_base *ab, u32 cmd_id,
++				       struct sk_buff *skb)
++{
++}
++
+ static inline int ath11k_tm_cmd(struct ieee80211_hw *hw,
+ 				struct ieee80211_vif *vif,
+ 				void *data, int len)
+--- a/drivers/net/wireless/ath/ath11k/testmode_i.h
++++ b/drivers/net/wireless/ath/ath11k/testmode_i.h
+@@ -1,6 +1,7 @@
+ /* SPDX-License-Identifier: BSD-3-Clause-Clear */
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
++ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ /* "API" level of the ath11k testmode interface. Bump it after every
+@@ -11,9 +12,10 @@
+ /* Bump this after every _compatible_ interface change, for example
+  * addition of a new command or an attribute.
+  */
+-#define ATH11K_TESTMODE_VERSION_MINOR 0
++#define ATH11K_TESTMODE_VERSION_MINOR 1
+ 
+ #define ATH11K_TM_DATA_MAX_LEN		5000
++#define ATH11K_FTM_EVENT_MAX_BUF_LENGTH 2048
+ 
+ enum ath11k_tm_attr {
+ 	__ATH11K_TM_ATTR_INVALID		= 0,
+@@ -47,4 +49,18 @@ enum ath11k_tm_cmd {
+ 	 * ATH11K_TM_ATTR_DATA.
+ 	 */
+ 	ATH11K_TM_CMD_WMI = 1,
++
++	/* Boots the UTF firmware, the netdev interface must be down at the
++	 * time.
++	 */
++	ATH11K_TM_CMD_TESTMODE_START = 2,
++
++	/* The command used to transmit a FTM WMI command to the firmware
++	 * and the event to receive WMI events from the firmware. The data
++	 * received only contain the payload, need to add the tlv header
++	 * and send the cmd to firmware with command id WMI_PDEV_UTF_CMDID.
++	 * The data payload size could be large and the driver needs to
++	 * send segmented data to firmware.
++	 */
++	ATH11K_TM_CMD_WMI_FTM = 3,
+ };
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2021, Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2021, 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ #include <linux/skbuff.h>
+ #include <linux/ctype.h>
+@@ -19,6 +19,7 @@
+ #include "mac.h"
+ #include "hw.h"
+ #include "peer.h"
++#include "testmode.h"
+ 
+ struct wmi_tlv_policy {
+ 	size_t min_len;
+@@ -237,9 +238,8 @@ static int ath11k_wmi_tlv_parse(struct a
+ 				   (void *)tb);
+ }
+ 
+-static const void **
+-ath11k_wmi_tlv_parse_alloc(struct ath11k_base *ab, const void *ptr,
+-			   size_t len, gfp_t gfp)
++const void **ath11k_wmi_tlv_parse_alloc(struct ath11k_base *ab, const void *ptr,
++					size_t len, gfp_t gfp)
+ {
+ 	const void **tb;
+ 	int ret;
+@@ -8628,6 +8628,9 @@ static void ath11k_wmi_tlv_op_rx(struct
+ 	case WMI_PDEV_CSA_SWITCH_COUNT_STATUS_EVENTID:
+ 		ath11k_wmi_pdev_csa_switch_count_status_event(ab, skb);
+ 		break;
++	case WMI_PDEV_UTF_EVENTID:
++		ath11k_tm_wmi_event(ab, id, skb);
++		break;
+ 	case WMI_PDEV_TEMPERATURE_EVENTID:
+ 		ath11k_wmi_pdev_temperature_event(ab, skb);
+ 		break;
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -1,6 +1,7 @@
+ /* SPDX-License-Identifier: BSD-3-Clause-Clear */
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
++ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #ifndef ATH11K_WMI_H
+@@ -68,6 +69,7 @@ struct wmi_tlv {
+ 
+ #define WMI_APPEND_TO_EXISTING_CHAN_LIST_FLAG 1
+ 
++#define MAX_WMI_UTF_LEN 252
+ #define WMI_BA_MODE_BUFFER_SIZE_256  3
+ /*
+  * HW mode config type replicated from FW header
+@@ -3564,6 +3566,24 @@ struct wmi_get_pdev_temperature_cmd {
+ 	u32 pdev_id;
+ } __packed;
+ 
++struct wmi_ftm_seg_hdr {
++	u32 len;
++	u32 msgref;
++	u32 segmentinfo;
++	u32 pdev_id;
++} __packed;
++
++struct wmi_ftm_cmd {
++	u32 tlv_header;
++	struct wmi_ftm_seg_hdr seg_hdr;
++	u8 data[];
++} __packed;
++
++struct wmi_ftm_event_msg {
++	struct wmi_ftm_seg_hdr seg_hdr;
++	u8 data[];
++} __packed;
++
+ #define WMI_BEACON_TX_BUFFER_SIZE	512
+ 
+ #define WMI_EMA_TMPL_IDX_SHIFT            8
+@@ -6300,6 +6320,8 @@ enum wmi_sta_keepalive_method {
+ #define WMI_STA_KEEPALIVE_INTERVAL_DEFAULT	30
+ #define WMI_STA_KEEPALIVE_INTERVAL_DISABLE	0
+ 
++const void **ath11k_wmi_tlv_parse_alloc(struct ath11k_base *ab, const void *ptr,
++					size_t len, gfp_t gfp);
+ int ath11k_wmi_cmd_send(struct ath11k_pdev_wmi *wmi, struct sk_buff *skb,
+ 			u32 cmd_id);
+ struct sk_buff *ath11k_wmi_alloc_skb(struct ath11k_wmi_base *wmi_sc, u32 len);
+--- a/drivers/net/wireless/ath/ath11k/wow.c
++++ b/drivers/net/wireless/ath/ath11k/wow.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+  * Copyright (c) 2020 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2022, Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #include <linux/delay.h>
+@@ -838,6 +838,7 @@ exit:
+ 		case ATH11K_STATE_RESTARTING:
+ 		case ATH11K_STATE_RESTARTED:
+ 		case ATH11K_STATE_WEDGED:
++		case ATH11K_STATE_FTM:
+ 			ath11k_warn(ar->ab, "encountered unexpected device state %d on resume, cannot recover\n",
+ 				    ar->state);
+ 			ret = -EIO;
diff --git a/package/kernel/mac80211/patches/ath11k/0083-wifi-ath11k-Allow-ath11k-to-boot-without-caldata-in-.patch b/package/kernel/mac80211/patches/ath11k/0083-wifi-ath11k-Allow-ath11k-to-boot-without-caldata-in-.patch
new file mode 100644
index 00000000000000..5a1fa882948e5a
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0083-wifi-ath11k-Allow-ath11k-to-boot-without-caldata-in-.patch
@@ -0,0 +1,47 @@
+From 8aeba427296bff6a6051686f1d139c89a0b00e4c Mon Sep 17 00:00:00 2001
+From: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
+Date: Fri, 26 May 2023 12:41:07 +0300
+Subject: [PATCH 84/84] wifi: ath11k: Allow ath11k to boot without caldata in
+ ftm mode
+
+Currently, if ath11k is unable to load the calibration data file it will
+always exit. However the calibration data may not be present in factory
+test mode, so update the logic to allow the driver to execute in FTM mode
+even if downloading the calibration data fails.
+
+Tested-on : IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
+Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230517135934.16408-5-quic_rajkbhag@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/qmi.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/qmi.c
++++ b/drivers/net/wireless/ath/ath11k/qmi.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #include <linux/elf.h>
+@@ -2460,6 +2460,14 @@ static int ath11k_qmi_load_bdf_qmi(struc
+ 
+ 		fw_entry = ath11k_core_firmware_request(ab, ATH11K_DEFAULT_CAL_FILE);
+ 		if (IS_ERR(fw_entry)) {
++			/* Caldata may not be present during first time calibration in
++			 * factory hence allow to boot without loading caldata in ftm mode
++			 */
++			if (ath11k_ftm_mode) {
++				ath11k_info(ab,
++					    "Booting without cal data file in factory test mode\n");
++				return 0;
++			}
+ 			ret = PTR_ERR(fw_entry);
+ 			ath11k_warn(ab,
+ 				    "qmi failed to load CAL data file:%s\n",
diff --git a/package/kernel/mac80211/patches/ath11k/0084-wifi-ath11k-Add-HTT-stats-for-PHY-reset-case.patch b/package/kernel/mac80211/patches/ath11k/0084-wifi-ath11k-Add-HTT-stats-for-PHY-reset-case.patch
new file mode 100644
index 00000000000000..946f5f7b5786bb
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0084-wifi-ath11k-Add-HTT-stats-for-PHY-reset-case.patch
@@ -0,0 +1,261 @@
+From 2d4f9093e2d8531ad0a2bb98fe5b36dc8addf2a2 Mon Sep 17 00:00:00 2001
+From: Nidhi Jain <quic_nidhjain@quicinc.com>
+Date: Fri, 26 May 2023 12:41:07 +0300
+Subject: [PATCH] wifi: ath11k: Add HTT stats for PHY reset case
+
+New HTT stats are added with stats type 37 to
+provide PHY reset stats and PHY reset counter stats.
+
+PHY reset stats are used to display the current
+PHY-related operation information such as band, CCA
+threshold, current operating channel etc.,
+
+PHY reset counter stats are used to display the
+PHY reset counter values like calibration counts,
+temperature based recalibration counts etc.,
+
+Usage:
+echo 37 > /sys/kernel/debug/ieee80211/phyX/ath11k/htt_stats_type
+cat /sys/kernel/debug/ieee80211/phyx/ath11k/htt_stats
+
+Output:
+
+HTT_PHY_RESET_STATS_TLV:
+pdev_id = 0
+chan_mhz = 5180
+chan_band_center_freq1 = 5210
+chan_band_center_freq2 = 0
+chan_phy_mode = 18
+chan_flags = 0x8
+chan_num = 36
+reset_cause = 0x50000
+prev_reset_cause = 0x50000
+phy_warm_reset_src = 0x0
+rx_gain_tbl_mode = 0
+xbar_val = 0xfac688
+force_calibration = 0
+phyrf_mode = 0
+phy_homechan = 0
+phy_tx_ch_mask = 0x3
+phy_rx_ch_mask = 0x3
+phybb_ini_mask = 0x5
+phyrf_ini_mask = 0x0
+phy_dfs_en_mask = 0x0
+phy_sscan_en_mask = 0x0
+phy_synth_sel_mask = 0x0
+phy_adfs_freq = 0
+cck_fir_settings = 0x0
+phy_dyn_pri_chan = 6
+cca_thresh = 0x26232020
+dyn_cca_status = 0
+rxdesense_thresh_hw = 0xcfe0afe
+rxdesense_thresh_sw = 0xcfe0afe
+
+HTT_PHY_RESET_COUNTERS_TLV:
+pdev_id = 0
+cf_active_low_fail_cnt = 0
+cf_active_low_pass_cnt = 0
+phy_off_through_vreg_cnt = 0
+force_calibration_cnt = 0
+rf_mode_switch_phy_off_cnt = 0
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Nidhi Jain <quic_nidhjain@quicinc.com>
+Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230517141242.2754293-1-quic_mkenna@quicinc.com
+---
+ .../wireless/ath/ath11k/debugfs_htt_stats.c   | 114 ++++++++++++++++++
+ .../wireless/ath/ath11k/debugfs_htt_stats.h   |  43 +++++++
+ 2 files changed, 157 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.c
+@@ -4011,6 +4011,114 @@ void htt_print_phy_stats_tlv(const void
+ 	stats_req->buf_len = len;
+ }
+ 
++static inline void
++htt_print_phy_reset_counters_tlv(const void *tag_buf,
++				 u16 tag_len,
++				 struct debug_htt_stats_req *stats_req)
++{
++	const struct htt_phy_reset_counters_tlv *htt_stats_buf = tag_buf;
++	u8 *buf = stats_req->buf;
++	u32 len = stats_req->buf_len;
++	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
++
++	if (tag_len < sizeof(*htt_stats_buf))
++		return;
++
++	len += scnprintf(buf + len, buf_len - len, "HTT_PHY_RESET_COUNTERS_TLV:\n");
++
++	len += scnprintf(buf + len, buf_len - len, "pdev_id = %u\n",
++			 htt_stats_buf->pdev_id);
++	len += scnprintf(buf + len, buf_len - len, "cf_active_low_fail_cnt = %u\n",
++			 htt_stats_buf->cf_active_low_fail_cnt);
++	len += scnprintf(buf + len, buf_len - len, "cf_active_low_pass_cnt = %u\n",
++			 htt_stats_buf->cf_active_low_pass_cnt);
++	len += scnprintf(buf + len, buf_len - len, "phy_off_through_vreg_cnt = %u\n",
++			 htt_stats_buf->phy_off_through_vreg_cnt);
++	len += scnprintf(buf + len, buf_len - len, "force_calibration_cnt = %u\n",
++			 htt_stats_buf->force_calibration_cnt);
++	len += scnprintf(buf + len, buf_len - len, "rf_mode_switch_phy_off_cnt = %u\n",
++			 htt_stats_buf->rf_mode_switch_phy_off_cnt);
++
++	stats_req->buf_len = len;
++}
++
++static inline void
++htt_print_phy_reset_stats_tlv(const void *tag_buf,
++			      u16 tag_len,
++			      struct debug_htt_stats_req *stats_req)
++{
++	const struct htt_phy_reset_stats_tlv *htt_stats_buf = tag_buf;
++	u8 *buf = stats_req->buf;
++	u32 len = stats_req->buf_len;
++	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
++
++	if (tag_len < sizeof(*htt_stats_buf))
++		return;
++
++	len += scnprintf(buf + len, buf_len - len, "HTT_PHY_RESET_STATS_TLV:\n");
++
++	len += scnprintf(buf + len, buf_len - len, "pdev_id = %u\n",
++			 htt_stats_buf->pdev_id);
++	len += scnprintf(buf + len, buf_len - len, "chan_mhz = %u\n",
++			 htt_stats_buf->chan_mhz);
++	len += scnprintf(buf + len, buf_len - len, "chan_band_center_freq1 = %u\n",
++			 htt_stats_buf->chan_band_center_freq1);
++	len += scnprintf(buf + len, buf_len - len, "chan_band_center_freq2 = %u\n",
++			 htt_stats_buf->chan_band_center_freq2);
++	len += scnprintf(buf + len, buf_len - len, "chan_phy_mode = %u\n",
++			 htt_stats_buf->chan_phy_mode);
++	len += scnprintf(buf + len, buf_len - len, "chan_flags = 0x%0x\n",
++			 htt_stats_buf->chan_flags);
++	len += scnprintf(buf + len, buf_len - len, "chan_num = %u\n",
++			 htt_stats_buf->chan_num);
++	len += scnprintf(buf + len, buf_len - len, "reset_cause = 0x%0x\n",
++			 htt_stats_buf->reset_cause);
++	len += scnprintf(buf + len, buf_len - len, "prev_reset_cause = 0x%0x\n",
++			 htt_stats_buf->prev_reset_cause);
++	len += scnprintf(buf + len, buf_len - len, "phy_warm_reset_src = 0x%0x\n",
++			 htt_stats_buf->phy_warm_reset_src);
++	len += scnprintf(buf + len, buf_len - len, "rx_gain_tbl_mode = %d\n",
++			 htt_stats_buf->rx_gain_tbl_mode);
++	len += scnprintf(buf + len, buf_len - len, "xbar_val = 0x%0x\n",
++			 htt_stats_buf->xbar_val);
++	len += scnprintf(buf + len, buf_len - len, "force_calibration = %u\n",
++			 htt_stats_buf->force_calibration);
++	len += scnprintf(buf + len, buf_len - len, "phyrf_mode = %u\n",
++			 htt_stats_buf->phyrf_mode);
++	len += scnprintf(buf + len, buf_len - len, "phy_homechan = %u\n",
++			 htt_stats_buf->phy_homechan);
++	len += scnprintf(buf + len, buf_len - len, "phy_tx_ch_mask = 0x%0x\n",
++			 htt_stats_buf->phy_tx_ch_mask);
++	len += scnprintf(buf + len, buf_len - len, "phy_rx_ch_mask = 0x%0x\n",
++			 htt_stats_buf->phy_rx_ch_mask);
++	len += scnprintf(buf + len, buf_len - len, "phybb_ini_mask = 0x%0x\n",
++			 htt_stats_buf->phybb_ini_mask);
++	len += scnprintf(buf + len, buf_len - len, "phyrf_ini_mask = 0x%0x\n",
++			 htt_stats_buf->phyrf_ini_mask);
++	len += scnprintf(buf + len, buf_len - len, "phy_dfs_en_mask = 0x%0x\n",
++			 htt_stats_buf->phy_dfs_en_mask);
++	len += scnprintf(buf + len, buf_len - len, "phy_sscan_en_mask = 0x%0x\n",
++			 htt_stats_buf->phy_sscan_en_mask);
++	len += scnprintf(buf + len, buf_len - len, "phy_synth_sel_mask = 0x%0x\n",
++			 htt_stats_buf->phy_synth_sel_mask);
++	len += scnprintf(buf + len, buf_len - len, "phy_adfs_freq = %u\n",
++			 htt_stats_buf->phy_adfs_freq);
++	len += scnprintf(buf + len, buf_len - len, "cck_fir_settings = 0x%0x\n",
++			 htt_stats_buf->cck_fir_settings);
++	len += scnprintf(buf + len, buf_len - len, "phy_dyn_pri_chan = %u\n",
++			 htt_stats_buf->phy_dyn_pri_chan);
++	len += scnprintf(buf + len, buf_len - len, "cca_thresh = 0x%0x\n",
++			 htt_stats_buf->cca_thresh);
++	len += scnprintf(buf + len, buf_len - len, "dyn_cca_status = %u\n",
++			 htt_stats_buf->dyn_cca_status);
++	len += scnprintf(buf + len, buf_len - len, "rxdesense_thresh_hw = 0x%x\n",
++			 htt_stats_buf->rxdesense_thresh_hw);
++	len += scnprintf(buf + len, buf_len - len, "rxdesense_thresh_sw = 0x%x\n",
++			 htt_stats_buf->rxdesense_thresh_sw);
++
++	stats_req->buf_len = len;
++}
++
+ static inline
+ void htt_print_peer_ctrl_path_txrx_stats_tlv(const void *tag_buf,
+ 					     struct debug_htt_stats_req *stats_req)
+@@ -4425,6 +4533,12 @@ static int ath11k_dbg_htt_ext_stats_pars
+ 	case HTT_STATS_PHY_STATS_TAG:
+ 		htt_print_phy_stats_tlv(tag_buf, stats_req);
+ 		break;
++	case HTT_STATS_PHY_RESET_COUNTERS_TAG:
++		htt_print_phy_reset_counters_tlv(tag_buf, len, stats_req);
++		break;
++	case HTT_STATS_PHY_RESET_STATS_TAG:
++		htt_print_phy_reset_stats_tlv(tag_buf, len, stats_req);
++		break;
+ 	case HTT_STATS_PEER_CTRL_PATH_TXRX_STATS_TAG:
+ 		htt_print_peer_ctrl_path_txrx_stats_tlv(tag_buf, stats_req);
+ 		break;
+--- a/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.h
++++ b/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.h
+@@ -111,6 +111,8 @@ enum htt_tlv_tag_t {
+ 	HTT_STATS_TXBF_OFDMA_STEER_STATS_TAG		    = 116,
+ 	HTT_STATS_PHY_COUNTERS_TAG			    = 121,
+ 	HTT_STATS_PHY_STATS_TAG				    = 122,
++	HTT_STATS_PHY_RESET_COUNTERS_TAG		    = 123,
++	HTT_STATS_PHY_RESET_STATS_TAG			    = 124,
+ 
+ 	HTT_STATS_MAX_TAG,
+ };
+@@ -1964,6 +1966,47 @@ struct htt_phy_stats_tlv {
+ 	u32 fw_run_time;
+ };
+ 
++struct htt_phy_reset_counters_tlv {
++	u32 pdev_id;
++	u32 cf_active_low_fail_cnt;
++	u32 cf_active_low_pass_cnt;
++	u32 phy_off_through_vreg_cnt;
++	u32 force_calibration_cnt;
++	u32 rf_mode_switch_phy_off_cnt;
++};
++
++struct htt_phy_reset_stats_tlv {
++	u32 pdev_id;
++	u32 chan_mhz;
++	u32 chan_band_center_freq1;
++	u32 chan_band_center_freq2;
++	u32 chan_phy_mode;
++	u32 chan_flags;
++	u32 chan_num;
++	u32 reset_cause;
++	u32 prev_reset_cause;
++	u32 phy_warm_reset_src;
++	u32 rx_gain_tbl_mode;
++	u32 xbar_val;
++	u32 force_calibration;
++	u32 phyrf_mode;
++	u32 phy_homechan;
++	u32 phy_tx_ch_mask;
++	u32 phy_rx_ch_mask;
++	u32 phybb_ini_mask;
++	u32 phyrf_ini_mask;
++	u32 phy_dfs_en_mask;
++	u32 phy_sscan_en_mask;
++	u32 phy_synth_sel_mask;
++	u32 phy_adfs_freq;
++	u32 cck_fir_settings;
++	u32 phy_dyn_pri_chan;
++	u32 cca_thresh;
++	u32 dyn_cca_status;
++	u32 rxdesense_thresh_hw;
++	u32 rxdesense_thresh_sw;
++};
++
+ struct htt_peer_ctrl_path_txrx_stats_tlv {
+ 	/* peer mac address */
+ 	u8 peer_mac_addr[ETH_ALEN];
diff --git a/package/kernel/mac80211/patches/ath11k/100-wifi-ath11k-use-unique-QRTR-instance-ID.patch b/package/kernel/mac80211/patches/ath11k/100-wifi-ath11k-use-unique-QRTR-instance-ID.patch
new file mode 100644
index 00000000000000..39d5a61d5a1ed8
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/100-wifi-ath11k-use-unique-QRTR-instance-ID.patch
@@ -0,0 +1,162 @@
+From 534a5f99d589cfa6b244b4433c192b6a278a67ff Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Sat, 5 Nov 2022 20:15:40 +0100
+Subject: [PATCH] wifi: ath11k: use unique QRTR instance ID
+
+Currently, trying to use AHB + PCI/MHI cards or multiple PCI/MHI cards
+will cause a clash in the QRTR instance node ID and prevent the driver
+from talking via QMI to the card and thus initializing it with:
+[    9.836329] ath11k c000000.wifi: host capability request failed: 1 90
+[    9.842047] ath11k c000000.wifi: failed to send qmi host cap: -22
+
+So, in order to allow for this combination of cards, especially AHB + PCI
+cards like IPQ8074 + QCN9074 (Used by me and tested on) set the desired
+QRTR instance ID offset by calculating a unique one based on PCI domain
+and bus ID-s and writing it to bits 7-0 of BHI_ERRDBG2 MHI register by
+using the SBL state callback that is added as part of the series.
+We also have to make sure that new QRTR offset is added on top of the
+default QRTR instance ID-s that are currently used in the driver.
+
+This finally allows using AHB + PCI or multiple PCI cards on the same
+system.
+
+Since this is not supported on QCA6390 and like, its limited to QCN9074
+which is known to support changing QRTR instance ID.
+
+Before:
+root@OpenWrt:/# qrtr-lookup
+  Service Version Instance Node  Port
+     1054       1        0    7     1 <unknown>
+       69       1        2    7     3 ATH10k WLAN firmware service
+
+After:
+root@OpenWrt:/# qrtr-lookup
+  Service Version Instance Node  Port
+     1054       1        0    7     1 <unknown>
+       69       1        2    7     3 ATH10k WLAN firmware service
+       15       1        0    8     1 Test service
+       69       1        8    8     2 ATH10k WLAN firmware service
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/net/wireless/ath/ath11k/mhi.c | 49 ++++++++++++++++++---------
+ drivers/net/wireless/ath/ath11k/mhi.h |  3 ++
+ drivers/net/wireless/ath/ath11k/pci.c |  9 ++++-
+ 3 files changed, 44 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mhi.c
++++ b/drivers/net/wireless/ath/ath11k/mhi.c
+@@ -294,6 +294,34 @@ static void ath11k_mhi_op_runtime_put(st
+ {
+ }
+ 
++static int ath11k_mhi_op_read_reg(struct mhi_controller *mhi_cntrl,
++				  void __iomem *addr,
++				  u32 *out)
++{
++	*out = readl(addr);
++
++	return 0;
++}
++
++static void ath11k_mhi_op_write_reg(struct mhi_controller *mhi_cntrl,
++				    void __iomem *addr,
++				    u32 val)
++{
++	writel(val, addr);
++}
++
++static void ath11k_mhi_qrtr_instance_set(struct mhi_controller *mhi_cntrl)
++{
++	struct ath11k_base *ab = dev_get_drvdata(mhi_cntrl->cntrl_dev);
++
++	if (ab->hw_rev == ATH11K_HW_QCN9074_HW10) {
++		ath11k_mhi_op_write_reg(mhi_cntrl,
++					mhi_cntrl->bhi + BHI_ERRDBG2,
++					FIELD_PREP(QRTR_INSTANCE_MASK,
++					ab->qmi.service_ins_id - ab->hw_params.qmi_service_ins_id));
++	}
++}
++
+ static char *ath11k_mhi_op_callback_to_str(enum mhi_callback reason)
+ {
+ 	switch (reason) {
+@@ -315,6 +343,8 @@ static char *ath11k_mhi_op_callback_to_s
+ 		return "MHI_CB_FATAL_ERROR";
+ 	case MHI_CB_BW_REQ:
+ 		return "MHI_CB_BW_REQ";
++	case MHI_CB_EE_SBL_MODE:
++		return "MHI_CB_EE_SBL_MODE";
+ 	default:
+ 		return "UNKNOWN";
+ 	}
+@@ -336,27 +366,14 @@ static void ath11k_mhi_op_status_cb(stru
+ 		if (!(test_bit(ATH11K_FLAG_UNREGISTERING, &ab->dev_flags)))
+ 			queue_work(ab->workqueue_aux, &ab->reset_work);
+ 		break;
++	case MHI_CB_EE_SBL_MODE:
++		ath11k_mhi_qrtr_instance_set(mhi_cntrl);
++		break;
+ 	default:
+ 		break;
+ 	}
+ }
+ 
+-static int ath11k_mhi_op_read_reg(struct mhi_controller *mhi_cntrl,
+-				  void __iomem *addr,
+-				  u32 *out)
+-{
+-	*out = readl(addr);
+-
+-	return 0;
+-}
+-
+-static void ath11k_mhi_op_write_reg(struct mhi_controller *mhi_cntrl,
+-				    void __iomem *addr,
+-				    u32 val)
+-{
+-	writel(val, addr);
+-}
+-
+ static int ath11k_mhi_read_addr_from_dt(struct mhi_controller *mhi_ctrl)
+ {
+ 	struct device_node *np;
+--- a/drivers/net/wireless/ath/ath11k/mhi.h
++++ b/drivers/net/wireless/ath/ath11k/mhi.h
+@@ -16,6 +16,9 @@
+ #define MHICTRL					0x38
+ #define MHICTRL_RESET_MASK			0x2
+ 
++#define BHI_ERRDBG2				0x38
++#define QRTR_INSTANCE_MASK			GENMASK(7, 0)
++
+ int ath11k_mhi_start(struct ath11k_pci *ar_pci);
+ void ath11k_mhi_stop(struct ath11k_pci *ar_pci);
+ int ath11k_mhi_register(struct ath11k_pci *ar_pci);
+--- a/drivers/net/wireless/ath/ath11k/pci.c
++++ b/drivers/net/wireless/ath/ath11k/pci.c
+@@ -370,13 +370,20 @@ static void ath11k_pci_sw_reset(struct a
+ static void ath11k_pci_init_qmi_ce_config(struct ath11k_base *ab)
+ {
+ 	struct ath11k_qmi_ce_cfg *cfg = &ab->qmi.ce_cfg;
++	struct ath11k_pci *ab_pci = ath11k_pci_priv(ab);
++	struct pci_bus *bus = ab_pci->pdev->bus;
+ 
+ 	cfg->tgt_ce = ab->hw_params.target_ce_config;
+ 	cfg->tgt_ce_len = ab->hw_params.target_ce_count;
+ 
+ 	cfg->svc_to_ce_map = ab->hw_params.svc_to_ce_map;
+ 	cfg->svc_to_ce_map_len = ab->hw_params.svc_to_ce_map_len;
+-	ab->qmi.service_ins_id = ab->hw_params.qmi_service_ins_id;
++
++	if (ab->hw_rev == ATH11K_HW_QCN9074_HW10) {
++		ab->qmi.service_ins_id = ab->hw_params.qmi_service_ins_id +
++		(((pci_domain_nr(bus) & 0xF) << 4) | (bus->number & 0xF));
++	} else
++		ab->qmi.service_ins_id = ab->hw_params.qmi_service_ins_id;
+ 
+ 	ath11k_ce_get_shadow_config(ab, &cfg->shadow_reg_v2,
+ 				    &cfg->shadow_reg_v2_len);
diff --git a/package/kernel/mac80211/patches/ath11k/900-ath11k-control-thermal-support-via-symbol.patch b/package/kernel/mac80211/patches/ath11k/900-ath11k-control-thermal-support-via-symbol.patch
new file mode 100644
index 00000000000000..60720a721e30ee
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/900-ath11k-control-thermal-support-via-symbol.patch
@@ -0,0 +1,66 @@
+From 703d6551f71e7290619d6effe2a25a64e10538b7 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Thu, 15 Dec 2022 12:20:52 +0100
+Subject: [PATCH] ath11k: control thermal support via symbol
+
+Currently, thermal support will get built if CONFIG_THERMAL is reachable,
+however this is not suitable for OpenWrt as with ALL_KMODS being set to y
+ATH11K_THERMAL wont get selected and so hwmon and thermal kmods wont get
+pulled in resulting in a build-failure.
+
+So, to avoid that, lets do what is already done for ath10k and add a
+config symbol into backports for enabling thermal support.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/net/wireless/ath/ath11k/Kconfig   | 7 +++++++
+ drivers/net/wireless/ath/ath11k/Makefile  | 2 +-
+ drivers/net/wireless/ath/ath11k/thermal.h | 2 +-
+ local-symbols                             | 1 +
+ 4 files changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/Kconfig
++++ b/drivers/net/wireless/ath/ath11k/Kconfig
+@@ -61,3 +61,10 @@ config ATH11K_SPECTRAL
+ 	  Enable ath11k spectral scan support
+ 
+ 	  Say Y to enable access to the FFT/spectral data via debugfs.
++
++config ATH11K_THERMAL
++	bool "ath11k thermal sensors and throttling support"
++	depends on ATH11K
++	depends on THERMAL
++	help
++	  Enable ath11k thermal sensors and throttling support.
+--- a/drivers/net/wireless/ath/ath11k/Makefile
++++ b/drivers/net/wireless/ath/ath11k/Makefile
+@@ -22,7 +22,7 @@ ath11k-y += core.o \
+ ath11k-$(CPTCFG_ATH11K_DEBUGFS) += debugfs.o debugfs_htt_stats.o debugfs_sta.o
+ ath11k-$(CPTCFG_NL80211_TESTMODE) += testmode.o
+ ath11k-$(CPTCFG_ATH11K_TRACING) += trace.o
+-ath11k-$(CONFIG_THERMAL) += thermal.o
++ath11k-$(CPTCFG_ATH11K_THERMAL) += thermal.o
+ ath11k-$(CPTCFG_ATH11K_SPECTRAL) += spectral.o
+ ath11k-$(CONFIG_PM) += wow.o
+ 
+--- a/drivers/net/wireless/ath/ath11k/thermal.h
++++ b/drivers/net/wireless/ath/ath11k/thermal.h
+@@ -25,7 +25,7 @@ struct ath11k_thermal {
+ 	int temperature;
+ };
+ 
+-#if IS_REACHABLE(CONFIG_THERMAL)
++#if IS_REACHABLE(CPTCFG_ATH11K_THERMAL)
+ int ath11k_thermal_register(struct ath11k_base *sc);
+ void ath11k_thermal_unregister(struct ath11k_base *sc);
+ int ath11k_thermal_set_throttling(struct ath11k *ar, u32 throttle_state);
+--- a/local-symbols
++++ b/local-symbols
+@@ -174,6 +174,7 @@ ATH11K_DEBUG=
+ ATH11K_DEBUGFS=
+ ATH11K_TRACING=
+ ATH11K_SPECTRAL=
++ATH11K_THERMAL=
+ WLAN_VENDOR_ATMEL=
+ ATMEL=
+ PCI_ATMEL=
diff --git a/package/kernel/mac80211/patches/ath11k/901-wifi-ath11k-pci-fix-compilation-in-5.16-and-older.patch b/package/kernel/mac80211/patches/ath11k/901-wifi-ath11k-pci-fix-compilation-in-5.16-and-older.patch
new file mode 100644
index 00000000000000..72156563899370
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/901-wifi-ath11k-pci-fix-compilation-in-5.16-and-older.patch
@@ -0,0 +1,29 @@
+From 04178918e7f6b5f34dde81ec79ee8a1ccace3be3 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Mon, 17 Oct 2022 11:45:03 +0200
+Subject: [PATCH] wifi: ath11k: pci: fix compilation in 5.16 and older
+
+Commit ("genirq/msi, treewide: Use a named struct for PCI/MSI attributes")
+changed the msi_desc structure a bit, however that is only available in
+kernels 5.17 and newer, so check for kernel version to allow compilation
+in 5.16 and older.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/net/wireless/ath/ath11k/pci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/pci.c
++++ b/drivers/net/wireless/ath/ath11k/pci.c
+@@ -458,7 +458,11 @@ static int ath11k_pci_alloc_msi(struct a
+ 	pci_read_config_dword(pci_dev, pci_dev->msi_cap + PCI_MSI_ADDRESS_LO,
+ 			      &ab->pci.msi.addr_lo);
+ 
++#if (LINUX_VERSION_CODE > KERNEL_VERSION(5, 17, 0))
+ 	if (msi_desc->pci.msi_attrib.is_64) {
++#else
++	if (msi_desc->msi_attrib.is_64) {
++#endif
+ 		pci_read_config_dword(pci_dev, pci_dev->msi_cap + PCI_MSI_ADDRESS_HI,
+ 				      &ab->pci.msi.addr_hi);
+ 	} else {
diff --git a/package/kernel/mac80211/patches/ath11k/902-ath11k-Disable-coldboot-calibration-for-IPQ8074.patch b/package/kernel/mac80211/patches/ath11k/902-ath11k-Disable-coldboot-calibration-for-IPQ8074.patch
new file mode 100644
index 00000000000000..5454fa75e4c62d
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/902-ath11k-Disable-coldboot-calibration-for-IPQ8074.patch
@@ -0,0 +1,24 @@
+From dd3b9c59cfa1e9e0b73a575f4646be905691eaef Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Sat, 16 Oct 2021 19:34:10 +0200
+Subject: [PATCH 241/241] ath11k: Disable coldboot calibration for IPQ8074
+
+There is a bug with the remoteproc reset after coldboot calibration,
+so until that is resolved disabled it to allow using the radio.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/net/wireless/ath/ath11k/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -86,7 +86,7 @@ static const struct ath11k_hw_params ath
+ 		.supports_shadow_regs = false,
+ 		.idle_ps = false,
+ 		.supports_sta_ps = false,
+-		.cold_boot_calib = true,
++		.cold_boot_calib = false,
+ 		.cbcal_restart_fw = true,
+ 		.fw_mem_mode = 0,
+ 		.num_vdevs = 16 + 1,
diff --git a/package/kernel/mac80211/patches/ath11k/903-ath11k-support-setting-FW-memory-mode-via-DT.patch b/package/kernel/mac80211/patches/ath11k/903-ath11k-support-setting-FW-memory-mode-via-DT.patch
new file mode 100644
index 00000000000000..22c2493ca9d1e0
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/903-ath11k-support-setting-FW-memory-mode-via-DT.patch
@@ -0,0 +1,74 @@
+From fb1c40c225cbc413d82c872dd8c8af3469b2b921 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 16 Dec 2022 17:17:52 +0100
+Subject: [PATCH] ath11k: support setting FW memory mode via DT
+
+ath11k is really memory intensive for devices with less that 1GB of RAM,
+so lets allow saving a significant amount of memory by setting the FW to
+Mode-1 via DTS for devices that need it.
+
+However the drawback is reduced number of VDEV-s and peers which is a
+reasonable tradeoff.
+
+Mode-2 allows for further reduction, but it has further restrictions.
+
+While we are here, lets add a print to be able to easily determine what
+FW memory mode is being used.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/net/wireless/ath/ath11k/core.c | 28 ++++++++++++++++++++++++--
+ 1 file changed, 26 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -36,7 +36,7 @@ bool ath11k_ftm_mode;
+ module_param_named(ftm_mode, ath11k_ftm_mode, bool, 0444);
+ MODULE_PARM_DESC(ftm_mode, "Boots up in factory test mode");
+ 
+-static const struct ath11k_hw_params ath11k_hw_params[] = {
++static struct ath11k_hw_params ath11k_hw_params[] = {
+ 	{
+ 		.hw_rev = ATH11K_HW_IPQ8074,
+ 		.name = "ipq8074 hw2.0",
+@@ -1953,7 +1953,8 @@ static void ath11k_core_reset(struct wor
+ static int ath11k_init_hw_params(struct ath11k_base *ab)
+ {
+ 	const struct ath11k_hw_params *hw_params = NULL;
+-	int i;
++	u32 fw_mem_mode;
++	int i, ret;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(ath11k_hw_params); i++) {
+ 		hw_params = &ath11k_hw_params[i];
+@@ -1969,7 +1970,30 @@ static int ath11k_init_hw_params(struct
+ 
+ 	ab->hw_params = *hw_params;
+ 
++	ret = of_property_read_u32(ab->dev->of_node,
++				   "qcom,ath11k-fw-memory-mode",
++				   &fw_mem_mode);
++	if (!ret) {
++		if (fw_mem_mode == 0) {
++			ab->hw_params.fw_mem_mode = 0;
++			ab->hw_params.num_vdevs = 16 + 1;
++			ab->hw_params.num_peers = 512;
++		}
++		else if (fw_mem_mode == 1) {
++			ab->hw_params.fw_mem_mode = 1;
++			ab->hw_params.num_vdevs = 8;
++			ab->hw_params.num_peers = 128;
++		} else if (fw_mem_mode == 2) {
++			ab->hw_params.fw_mem_mode = 2;
++			ab->hw_params.num_vdevs = 8;
++			ab->hw_params.num_peers = 128;
++			ab->hw_params.cold_boot_calib = false;
++		} else
++			ath11k_info(ab, "Unsupported FW memory mode: %u\n", fw_mem_mode);
++	}
++
+ 	ath11k_info(ab, "%s\n", ab->hw_params.name);
++	ath11k_info(ab, "FW memory mode: %d\n", ab->hw_params.fw_mem_mode);
+ 
+ 	return 0;
+ }
diff --git a/package/kernel/mac80211/patches/ath11k/905-ath11k-remove-intersection-support-for-regulatory-ru.patch b/package/kernel/mac80211/patches/ath11k/905-ath11k-remove-intersection-support-for-regulatory-ru.patch
new file mode 100644
index 00000000000000..b0ceb00ba034e0
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/905-ath11k-remove-intersection-support-for-regulatory-ru.patch
@@ -0,0 +1,317 @@
+From abdd0985a36189ef2cc0e393b027276e86137ace Mon Sep 17 00:00:00 2001
+From: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Date: Tue, 11 Apr 2023 20:08:49 +0200
+Subject: [PATCH] ath11k: remove intersection support for regulatory rules
+
+Currently, regulatory rules from new country settings is intersected with
+rules from default country settings(during initialisation) in order to prevent
+users to bypass their default country settings such as power limits, channel
+flags, etc.
+
+However, the country setting in the BDF will take higher higher precendence
+and FW will protect it. Therefore, there is no need to handle intersection
+on the driver side now.
+
+Remove regulatory rules intersection logic support.
+
+Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/reg.c | 168 +++-----------------------
+ drivers/net/wireless/ath/ath11k/reg.h |   2 +-
+ drivers/net/wireless/ath/ath11k/wmi.c |  24 +---
+ 3 files changed, 16 insertions(+), 178 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/reg.c
++++ b/drivers/net/wireless/ath/ath11k/reg.c
+@@ -352,129 +352,6 @@ static u32 ath11k_map_fw_reg_flags(u16 r
+ 	return flags;
+ }
+ 
+-static bool
+-ath11k_reg_can_intersect(struct ieee80211_reg_rule *rule1,
+-			 struct ieee80211_reg_rule *rule2)
+-{
+-	u32 start_freq1, end_freq1;
+-	u32 start_freq2, end_freq2;
+-
+-	start_freq1 = rule1->freq_range.start_freq_khz;
+-	start_freq2 = rule2->freq_range.start_freq_khz;
+-
+-	end_freq1 = rule1->freq_range.end_freq_khz;
+-	end_freq2 = rule2->freq_range.end_freq_khz;
+-
+-	if ((start_freq1 >= start_freq2 &&
+-	     start_freq1 < end_freq2) ||
+-	    (start_freq2 > start_freq1 &&
+-	     start_freq2 < end_freq1))
+-		return true;
+-
+-	/* TODO: Should we restrict intersection feasibility
+-	 *  based on min bandwidth of the intersected region also,
+-	 *  say the intersected rule should have a  min bandwidth
+-	 * of 20MHz?
+-	 */
+-
+-	return false;
+-}
+-
+-static void ath11k_reg_intersect_rules(struct ieee80211_reg_rule *rule1,
+-				       struct ieee80211_reg_rule *rule2,
+-				       struct ieee80211_reg_rule *new_rule)
+-{
+-	u32 start_freq1, end_freq1;
+-	u32 start_freq2, end_freq2;
+-	u32 freq_diff, max_bw;
+-
+-	start_freq1 = rule1->freq_range.start_freq_khz;
+-	start_freq2 = rule2->freq_range.start_freq_khz;
+-
+-	end_freq1 = rule1->freq_range.end_freq_khz;
+-	end_freq2 = rule2->freq_range.end_freq_khz;
+-
+-	new_rule->freq_range.start_freq_khz = max_t(u32, start_freq1,
+-						    start_freq2);
+-	new_rule->freq_range.end_freq_khz = min_t(u32, end_freq1, end_freq2);
+-
+-	freq_diff = new_rule->freq_range.end_freq_khz -
+-			new_rule->freq_range.start_freq_khz;
+-	max_bw = min_t(u32, rule1->freq_range.max_bandwidth_khz,
+-		       rule2->freq_range.max_bandwidth_khz);
+-	new_rule->freq_range.max_bandwidth_khz = min_t(u32, max_bw, freq_diff);
+-
+-	new_rule->power_rule.max_antenna_gain =
+-		min_t(u32, rule1->power_rule.max_antenna_gain,
+-		      rule2->power_rule.max_antenna_gain);
+-
+-	new_rule->power_rule.max_eirp = min_t(u32, rule1->power_rule.max_eirp,
+-					      rule2->power_rule.max_eirp);
+-
+-	/* Use the flags of both the rules */
+-	new_rule->flags = rule1->flags | rule2->flags;
+-
+-	/* To be safe, lts use the max cac timeout of both rules */
+-	new_rule->dfs_cac_ms = max_t(u32, rule1->dfs_cac_ms,
+-				     rule2->dfs_cac_ms);
+-}
+-
+-static struct ieee80211_regdomain *
+-ath11k_regd_intersect(struct ieee80211_regdomain *default_regd,
+-		      struct ieee80211_regdomain *curr_regd)
+-{
+-	u8 num_old_regd_rules, num_curr_regd_rules, num_new_regd_rules;
+-	struct ieee80211_reg_rule *old_rule, *curr_rule, *new_rule;
+-	struct ieee80211_regdomain *new_regd = NULL;
+-	u8 i, j, k;
+-
+-	num_old_regd_rules = default_regd->n_reg_rules;
+-	num_curr_regd_rules = curr_regd->n_reg_rules;
+-	num_new_regd_rules = 0;
+-
+-	/* Find the number of intersecting rules to allocate new regd memory */
+-	for (i = 0; i < num_old_regd_rules; i++) {
+-		old_rule = default_regd->reg_rules + i;
+-		for (j = 0; j < num_curr_regd_rules; j++) {
+-			curr_rule = curr_regd->reg_rules + j;
+-
+-			if (ath11k_reg_can_intersect(old_rule, curr_rule))
+-				num_new_regd_rules++;
+-		}
+-	}
+-
+-	if (!num_new_regd_rules)
+-		return NULL;
+-
+-	new_regd = kzalloc(sizeof(*new_regd) + (num_new_regd_rules *
+-			sizeof(struct ieee80211_reg_rule)),
+-			GFP_ATOMIC);
+-
+-	if (!new_regd)
+-		return NULL;
+-
+-	/* We set the new country and dfs region directly and only trim
+-	 * the freq, power, antenna gain by intersecting with the
+-	 * default regdomain. Also MAX of the dfs cac timeout is selected.
+-	 */
+-	new_regd->n_reg_rules = num_new_regd_rules;
+-	memcpy(new_regd->alpha2, curr_regd->alpha2, sizeof(new_regd->alpha2));
+-	new_regd->dfs_region = curr_regd->dfs_region;
+-	new_rule = new_regd->reg_rules;
+-
+-	for (i = 0, k = 0; i < num_old_regd_rules; i++) {
+-		old_rule = default_regd->reg_rules + i;
+-		for (j = 0; j < num_curr_regd_rules; j++) {
+-			curr_rule = curr_regd->reg_rules + j;
+-
+-			if (ath11k_reg_can_intersect(old_rule, curr_rule))
+-				ath11k_reg_intersect_rules(old_rule, curr_rule,
+-							   (new_rule + k++));
+-		}
+-	}
+-	return new_regd;
+-}
+-
+ static const char *
+ ath11k_reg_get_regdom_str(enum nl80211_dfs_regions dfs_region)
+ {
+@@ -609,9 +486,9 @@ ath11k_reg_update_weather_radar_band(str
+ 
+ struct ieee80211_regdomain *
+ ath11k_reg_build_regd(struct ath11k_base *ab,
+-		      struct cur_regulatory_info *reg_info, bool intersect)
++		      struct cur_regulatory_info *reg_info)
+ {
+-	struct ieee80211_regdomain *tmp_regd, *default_regd, *new_regd = NULL;
++	struct ieee80211_regdomain *new_regd = NULL;
+ 	struct cur_reg_rule *reg_rule;
+ 	u8 i = 0, j = 0, k = 0;
+ 	u8 num_rules;
+@@ -628,26 +505,26 @@ ath11k_reg_build_regd(struct ath11k_base
+ 		num_rules += reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP];
+ 
+ 	if (!num_rules)
+-		goto ret;
++		return new_regd;
+ 
+ 	/* Add max additional rules to accommodate weather radar band */
+ 	if (reg_info->dfs_region == ATH11K_DFS_REG_ETSI)
+ 		num_rules += 2;
+ 
+-	tmp_regd =  kzalloc(sizeof(*tmp_regd) +
++	new_regd =  kzalloc(sizeof(*new_regd) +
+ 			(num_rules * sizeof(struct ieee80211_reg_rule)),
+ 			GFP_ATOMIC);
+-	if (!tmp_regd)
+-		goto ret;
++	if (!new_regd)
++		return new_regd;
+ 
+-	memcpy(tmp_regd->alpha2, reg_info->alpha2, REG_ALPHA2_LEN + 1);
++	memcpy(new_regd->alpha2, reg_info->alpha2, REG_ALPHA2_LEN + 1);
+ 	memcpy(alpha2, reg_info->alpha2, REG_ALPHA2_LEN + 1);
+ 	alpha2[2] = '\0';
+-	tmp_regd->dfs_region = ath11k_map_fw_dfs_region(reg_info->dfs_region);
++	new_regd->dfs_region = ath11k_map_fw_dfs_region(reg_info->dfs_region);
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_REG,
+ 		   "Country %s, CFG Regdomain %s FW Regdomain %d, num_reg_rules %d\n",
+-		   alpha2, ath11k_reg_get_regdom_str(tmp_regd->dfs_region),
++		   alpha2, ath11k_reg_get_regdom_str(new_regd->dfs_region),
+ 		   reg_info->dfs_region, num_rules);
+ 	/* Update reg_rules[] below. Firmware is expected to
+ 	 * send these rules in order(2 GHz rules first and then 5 GHz)
+@@ -686,7 +563,7 @@ ath11k_reg_build_regd(struct ath11k_base
+ 
+ 		flags |= ath11k_map_fw_reg_flags(reg_rule->flags);
+ 
+-		ath11k_reg_update_rule(tmp_regd->reg_rules + i,
++		ath11k_reg_update_rule(new_regd->reg_rules + i,
+ 				       reg_rule->start_freq,
+ 				       reg_rule->end_freq, max_bw,
+ 				       reg_rule->ant_gain, reg_rule->reg_power,
+@@ -701,7 +578,7 @@ ath11k_reg_build_regd(struct ath11k_base
+ 		    reg_info->dfs_region == ATH11K_DFS_REG_ETSI &&
+ 		    (reg_rule->end_freq > ETSI_WEATHER_RADAR_BAND_LOW &&
+ 		    reg_rule->start_freq < ETSI_WEATHER_RADAR_BAND_HIGH)){
+-			ath11k_reg_update_weather_radar_band(ab, tmp_regd,
++			ath11k_reg_update_weather_radar_band(ab, new_regd,
+ 							     reg_rule, &i,
+ 							     flags, max_bw);
+ 			continue;
+@@ -712,37 +589,20 @@ ath11k_reg_build_regd(struct ath11k_base
+ 				   "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d) (%d, %d)\n",
+ 				   i + 1, reg_rule->start_freq, reg_rule->end_freq,
+ 				   max_bw, reg_rule->ant_gain, reg_rule->reg_power,
+-				   tmp_regd->reg_rules[i].dfs_cac_ms, flags,
++				   new_regd->reg_rules[i].dfs_cac_ms, flags,
+ 				   reg_rule->psd_flag, reg_rule->psd_eirp);
+ 		} else {
+ 			ath11k_dbg(ab, ATH11K_DBG_REG,
+ 				   "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
+ 				   i + 1, reg_rule->start_freq, reg_rule->end_freq,
+ 				   max_bw, reg_rule->ant_gain, reg_rule->reg_power,
+-				   tmp_regd->reg_rules[i].dfs_cac_ms,
++				   new_regd->reg_rules[i].dfs_cac_ms,
+ 				   flags);
+ 		}
+ 	}
+ 
+-	tmp_regd->n_reg_rules = i;
+-
+-	if (intersect) {
+-		default_regd = ab->default_regd[reg_info->phy_id];
+-
+-		/* Get a new regd by intersecting the received regd with
+-		 * our default regd.
+-		 */
+-		new_regd = ath11k_regd_intersect(default_regd, tmp_regd);
+-		kfree(tmp_regd);
+-		if (!new_regd) {
+-			ath11k_warn(ab, "Unable to create intersected regdomain\n");
+-			goto ret;
+-		}
+-	} else {
+-		new_regd = tmp_regd;
+-	}
++	new_regd->n_reg_rules = i;
+ 
+-ret:
+ 	return new_regd;
+ }
+ 
+--- a/drivers/net/wireless/ath/ath11k/reg.h
++++ b/drivers/net/wireless/ath/ath11k/reg.h
+@@ -30,7 +30,7 @@ void ath11k_reg_free(struct ath11k_base
+ void ath11k_regd_update_work(struct work_struct *work);
+ struct ieee80211_regdomain *
+ ath11k_reg_build_regd(struct ath11k_base *ab,
+-		      struct cur_regulatory_info *reg_info, bool intersect);
++		      struct cur_regulatory_info *reg_info);
+ int ath11k_regd_update(struct ath11k *ar);
+ int ath11k_reg_update_chan_list(struct ath11k *ar, bool wait);
+ #endif
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -6996,24 +6996,12 @@ static void ath11k_wmi_htc_tx_complete(s
+ 		wake_up(&wmi->tx_ce_desc_wq);
+ }
+ 
+-static bool ath11k_reg_is_world_alpha(char *alpha)
+-{
+-	if (alpha[0] == '0' && alpha[1] == '0')
+-		return true;
+-
+-	if (alpha[0] == 'n' && alpha[1] == 'a')
+-		return true;
+-
+-	return false;
+-}
+-
+ static int ath11k_reg_chan_list_event(struct ath11k_base *ab,
+ 				      struct sk_buff *skb,
+ 				      enum wmi_reg_chan_list_cmd_type id)
+ {
+ 	struct cur_regulatory_info *reg_info = NULL;
+ 	struct ieee80211_regdomain *regd = NULL;
+-	bool intersect = false;
+ 	int ret = 0, pdev_idx, i, j;
+ 	struct ath11k *ar;
+ 
+@@ -7075,17 +7063,7 @@ static int ath11k_reg_chan_list_event(st
+ 		    (char *)reg_info->alpha2, 2))
+ 		goto mem_free;
+ 
+-	/* Intersect new rules with default regd if a new country setting was
+-	 * requested, i.e a default regd was already set during initialization
+-	 * and the regd coming from this event has a valid country info.
+-	 */
+-	if (ab->default_regd[pdev_idx] &&
+-	    !ath11k_reg_is_world_alpha((char *)
+-		ab->default_regd[pdev_idx]->alpha2) &&
+-	    !ath11k_reg_is_world_alpha((char *)reg_info->alpha2))
+-		intersect = true;
+-
+-	regd = ath11k_reg_build_regd(ab, reg_info, intersect);
++	regd = ath11k_reg_build_regd(ab, reg_info);
+ 	if (!regd) {
+ 		ath11k_warn(ab, "failed to build regd from reg_info\n");
+ 		goto fallback;
diff --git a/package/kernel/mac80211/patches/ath5k/201-ath5k-WAR-for-AR71xx-PCI-bug.patch b/package/kernel/mac80211/patches/ath5k/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
index 21516ffde905c9..4fc97dfaec969c 100644
--- a/package/kernel/mac80211/patches/ath5k/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
+++ b/package/kernel/mac80211/patches/ath5k/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
@@ -17,7 +17,7 @@
  	{ AR5K_RXNOFRM,		8 },
 --- a/drivers/net/wireless/ath/ath5k/dma.c
 +++ b/drivers/net/wireless/ath/ath5k/dma.c
-@@ -869,10 +869,18 @@ ath5k_hw_dma_init(struct ath5k_hw *ah)
+@@ -854,10 +854,18 @@ ath5k_hw_dma_init(struct ath5k_hw *ah)
  	 * guess we can tweak it and see how it goes ;-)
  	 */
  	if (ah->ah_version != AR5K_AR5210) {
diff --git a/package/kernel/mac80211/patches/ath5k/411-ath5k_allow_adhoc_and_ap.patch b/package/kernel/mac80211/patches/ath5k/411-ath5k_allow_adhoc_and_ap.patch
index 35ed6ea55519e3..1df4aab57ee47c 100644
--- a/package/kernel/mac80211/patches/ath5k/411-ath5k_allow_adhoc_and_ap.patch
+++ b/package/kernel/mac80211/patches/ath5k/411-ath5k_allow_adhoc_and_ap.patch
@@ -18,7 +18,7 @@
  		goto end;
 --- a/drivers/net/wireless/ath/ath5k/base.c
 +++ b/drivers/net/wireless/ath/ath5k/base.c
-@@ -1963,7 +1963,7 @@ ath5k_beacon_send(struct ath5k_hw *ah)
+@@ -2009,7 +2009,7 @@ ath5k_beacon_send(struct ath5k_hw *ah)
  	}
  
  	if ((ah->opmode == NL80211_IFTYPE_AP && ah->num_ap_vifs +
@@ -27,7 +27,7 @@
  			ah->opmode == NL80211_IFTYPE_MESH_POINT) {
  		u64 tsf = ath5k_hw_get_tsf64(ah);
  		u32 tsftu = TSF_TO_TU(tsf);
-@@ -2049,7 +2049,7 @@ ath5k_beacon_update_timers(struct ath5k_
+@@ -2095,7 +2095,7 @@ ath5k_beacon_update_timers(struct ath5k_
  
  	intval = ah->bintval & AR5K_BEACON_PERIOD;
  	if (ah->opmode == NL80211_IFTYPE_AP && ah->num_ap_vifs
@@ -36,7 +36,7 @@
  		intval /= ATH_BCBUF;	/* staggered multi-bss beacons */
  		if (intval < 15)
  			ATH5K_WARN(ah, "intval %u is too low, min 15\n",
-@@ -2515,6 +2515,7 @@ static const struct ieee80211_iface_limi
+@@ -2561,6 +2561,7 @@ static const struct ieee80211_iface_limi
  				 BIT(NL80211_IFTYPE_MESH_POINT) |
  #endif
  				 BIT(NL80211_IFTYPE_AP) },
diff --git a/package/kernel/mac80211/patches/ath9k/401-ath9k_blink_default.patch b/package/kernel/mac80211/patches/ath9k/401-ath9k_blink_default.patch
index 7405e594fe64ce..3eb57bb1cf5caf 100644
--- a/package/kernel/mac80211/patches/ath9k/401-ath9k_blink_default.patch
+++ b/package/kernel/mac80211/patches/ath9k/401-ath9k_blink_default.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -47,7 +47,7 @@ int ath9k_modparam_nohwcrypt;
+@@ -48,7 +48,7 @@ int ath9k_modparam_nohwcrypt;
  module_param_named(nohwcrypt, ath9k_modparam_nohwcrypt, int, 0444);
  MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption");
  
diff --git a/package/kernel/mac80211/patches/ath9k/410-ath9k_allow_adhoc_and_ap.patch b/package/kernel/mac80211/patches/ath9k/410-ath9k_allow_adhoc_and_ap.patch
index b355e8372f6ce0..b2f2763e8e16d9 100644
--- a/package/kernel/mac80211/patches/ath9k/410-ath9k_allow_adhoc_and_ap.patch
+++ b/package/kernel/mac80211/patches/ath9k/410-ath9k_allow_adhoc_and_ap.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -826,6 +826,7 @@ static const struct ieee80211_iface_limi
+@@ -882,6 +882,7 @@ static const struct ieee80211_iface_limi
  				 BIT(NL80211_IFTYPE_AP) },
  	{ .max = 1,	.types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
  				 BIT(NL80211_IFTYPE_P2P_GO) },
diff --git a/package/kernel/mac80211/patches/ath9k/450-ath9k-enabled-MFP-capability-unconditionally.patch b/package/kernel/mac80211/patches/ath9k/450-ath9k-enabled-MFP-capability-unconditionally.patch
index 284c88ff493e4f..f424ca530be860 100644
--- a/package/kernel/mac80211/patches/ath9k/450-ath9k-enabled-MFP-capability-unconditionally.patch
+++ b/package/kernel/mac80211/patches/ath9k/450-ath9k-enabled-MFP-capability-unconditionally.patch
@@ -14,7 +14,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -907,6 +907,7 @@ static void ath9k_set_hw_capab(struct at
+@@ -963,6 +963,7 @@ static void ath9k_set_hw_capab(struct at
  	ieee80211_hw_set(hw, HOST_BROADCAST_PS_BUFFERING);
  	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
  	ieee80211_hw_set(hw, SUPPORTS_CLONED_SKBS);
@@ -22,7 +22,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  
  	if (ath9k_ps_enable)
  		ieee80211_hw_set(hw, SUPPORTS_PS);
-@@ -919,9 +920,6 @@ static void ath9k_set_hw_capab(struct at
+@@ -975,9 +976,6 @@ static void ath9k_set_hw_capab(struct at
  				IEEE80211_RADIOTAP_MCS_HAVE_STBC;
  	}
  
diff --git a/package/kernel/mac80211/patches/ath9k/500-ath9k_eeprom_debugfs.patch b/package/kernel/mac80211/patches/ath9k/500-ath9k_eeprom_debugfs.patch
index 48ccc8130807eb..2f5e75be8a3051 100644
--- a/package/kernel/mac80211/patches/ath9k/500-ath9k_eeprom_debugfs.patch
+++ b/package/kernel/mac80211/patches/ath9k/500-ath9k_eeprom_debugfs.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1364,6 +1364,53 @@ void ath9k_deinit_debug(struct ath_softc
+@@ -1413,6 +1413,54 @@ void ath9k_deinit_debug(struct ath_softc
  	ath9k_cmn_spectral_deinit_debug(&sc->spec_priv);
  }
  
@@ -39,7 +39,8 @@
 +		} else {
 +			bytes = 2;
 +		}
-+		copy_to_user(user_buf, from, bytes);
++		if (copy_to_user(user_buf, from, bytes))
++			return -EFAULT;
 +		user_buf += bytes;
 +	}
 +	return *ppos - pos;
@@ -54,7 +55,7 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -1383,6 +1430,8 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1432,6 +1480,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  	ath9k_tx99_init_debug(sc);
  	ath9k_cmn_spectral_init_debug(&sc->spec_priv, sc->debug.debugfs_phy);
  
diff --git a/package/kernel/mac80211/patches/ath9k/501-ath9k_ahb_init.patch b/package/kernel/mac80211/patches/ath9k/501-ath9k_ahb_init.patch
index 6ab7972b556552..740ddc39dc3d03 100644
--- a/package/kernel/mac80211/patches/ath9k/501-ath9k_ahb_init.patch
+++ b/package/kernel/mac80211/patches/ath9k/501-ath9k_ahb_init.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -1122,25 +1122,25 @@ static int __init ath9k_init(void)
+@@ -1178,25 +1178,25 @@ static int __init ath9k_init(void)
  {
  	int error;
  
diff --git a/package/kernel/mac80211/patches/ath9k/512-ath9k_channelbw_debugfs.patch b/package/kernel/mac80211/patches/ath9k/512-ath9k_channelbw_debugfs.patch
index 126d1d5c624836..a871e458a4e7e9 100644
--- a/package/kernel/mac80211/patches/ath9k/512-ath9k_channelbw_debugfs.patch
+++ b/package/kernel/mac80211/patches/ath9k/512-ath9k_channelbw_debugfs.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1411,6 +1411,52 @@ static const struct file_operations fops
+@@ -1461,6 +1461,52 @@ static const struct file_operations fops
  	.owner = THIS_MODULE
  };
  
@@ -53,7 +53,7 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -1432,6 +1478,8 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1482,6 +1528,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  
  	debugfs_create_file("eeprom", S_IRUSR, sc->debug.debugfs_phy, sc,
  			    &fops_eeprom);
diff --git a/package/kernel/mac80211/patches/ath9k/530-ath9k_extra_leds.patch b/package/kernel/mac80211/patches/ath9k/530-ath9k_extra_leds.patch
index c161237827601b..74506657e0f26c 100644
--- a/package/kernel/mac80211/patches/ath9k/530-ath9k_extra_leds.patch
+++ b/package/kernel/mac80211/patches/ath9k/530-ath9k_extra_leds.patch
@@ -181,7 +181,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -1032,7 +1032,7 @@ int ath9k_init_device(u16 devid, struct
+@@ -1088,7 +1088,7 @@ int ath9k_init_device(u16 devid, struct
  
  #ifdef CPTCFG_MAC80211_LEDS
  	/* must be initialized before ieee80211_register_hw */
@@ -192,7 +192,7 @@
  #endif
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1456,6 +1456,61 @@ static const struct file_operations fops
+@@ -1506,6 +1506,61 @@ static const struct file_operations fops
  	.llseek = default_llseek,
  };
  
@@ -254,7 +254,7 @@
  
  int ath9k_init_debug(struct ath_hw *ah)
  {
-@@ -1480,6 +1535,10 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1530,6 +1585,10 @@ int ath9k_init_debug(struct ath_hw *ah)
  			    &fops_eeprom);
  	debugfs_create_file("chanbw", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
  			    sc, &fops_chanbw);
diff --git a/package/kernel/mac80211/patches/ath9k/542-ath9k_debugfs_diag.patch b/package/kernel/mac80211/patches/ath9k/542-ath9k_debugfs_diag.patch
index 5b64f560fdc531..e09bbc08eafb4b 100644
--- a/package/kernel/mac80211/patches/ath9k/542-ath9k_debugfs_diag.patch
+++ b/package/kernel/mac80211/patches/ath9k/542-ath9k_debugfs_diag.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1512,6 +1512,50 @@ static const struct file_operations fops
+@@ -1562,6 +1562,50 @@ static const struct file_operations fops
  #endif
  
  
@@ -51,7 +51,7 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -1539,6 +1583,8 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1589,6 +1633,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  	debugfs_create_file("gpio_led", S_IWUSR,
  			   sc->debug.debugfs_phy, sc, &fops_gpio_led);
  #endif
@@ -84,7 +84,7 @@
  	bool reset_power_on;
  	bool htc_reset_init;
  
-@@ -1077,6 +1085,7 @@ void ath9k_hw_check_nav(struct ath_hw *a
+@@ -1079,6 +1087,7 @@ void ath9k_hw_check_nav(struct ath_hw *a
  bool ath9k_hw_check_alive(struct ath_hw *ah);
  
  bool ath9k_hw_setpower(struct ath_hw *ah, enum ath9k_power_mode mode);
diff --git a/package/kernel/mac80211/patches/ath9k/543-ath9k_entropy_from_adc.patch b/package/kernel/mac80211/patches/ath9k/543-ath9k_entropy_from_adc.patch
index ef4e6598707739..6acc864d1e10e6 100644
--- a/package/kernel/mac80211/patches/ath9k/543-ath9k_entropy_from_adc.patch
+++ b/package/kernel/mac80211/patches/ath9k/543-ath9k_entropy_from_adc.patch
@@ -18,7 +18,7 @@
  	void (*spectral_scan_trigger)(struct ath_hw *ah);
 --- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
-@@ -1927,6 +1927,26 @@ void ar9003_hw_init_rate_txpower(struct
+@@ -1918,6 +1918,26 @@ void ar9003_hw_init_rate_txpower(struct
  	}
  }
  
@@ -45,7 +45,7 @@
  void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
  {
  	struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
-@@ -1963,6 +1983,7 @@ void ar9003_hw_attach_phy_ops(struct ath
+@@ -1954,6 +1974,7 @@ void ar9003_hw_attach_phy_ops(struct ath
  	priv_ops->set_radar_params = ar9003_hw_set_radar_params;
  	priv_ops->fast_chan_change = ar9003_hw_fast_chan_change;
  
@@ -55,7 +55,7 @@
  	ops->spectral_scan_config = ar9003_hw_spectral_scan_config;
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -814,7 +814,8 @@ static void ath9k_init_txpower_limits(st
+@@ -870,7 +870,8 @@ static void ath9k_init_txpower_limits(st
  	if (ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ)
  		ath9k_init_band_txpower(sc, NL80211_BAND_5GHZ);
  
@@ -65,7 +65,7 @@
  }
  
  static const struct ieee80211_iface_limit if_limits[] = {
-@@ -992,6 +993,18 @@ static void ath9k_set_hw_capab(struct at
+@@ -1048,6 +1049,18 @@ static void ath9k_set_hw_capab(struct at
  	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CAN_REPLACE_PTK0);
  }
  
@@ -84,7 +84,7 @@
  int ath9k_init_device(u16 devid, struct ath_softc *sc,
  		    const struct ath_bus_ops *bus_ops)
  {
-@@ -1039,6 +1052,8 @@ int ath9k_init_device(u16 devid, struct
+@@ -1095,6 +1108,8 @@ int ath9k_init_device(u16 devid, struct
  
  	wiphy_read_of_freq_limits(hw->wiphy);
  
diff --git a/package/kernel/mac80211/patches/ath9k/545-ath9k_ani_ws_detect.patch b/package/kernel/mac80211/patches/ath9k/545-ath9k_ani_ws_detect.patch
index 854bb3659a5f50..d3bf07ff92203b 100644
--- a/package/kernel/mac80211/patches/ath9k/545-ath9k_ani_ws_detect.patch
+++ b/package/kernel/mac80211/patches/ath9k/545-ath9k_ani_ws_detect.patch
@@ -79,7 +79,7 @@
  static const u8 ofdm2pwr[] = {
  	ALL_TARGET_LEGACY_6_24,
  	ALL_TARGET_LEGACY_6_24,
-@@ -1077,11 +1063,6 @@ static bool ar9003_hw_ani_control(struct
+@@ -1068,11 +1054,6 @@ static bool ar9003_hw_ani_control(struct
  	struct ath_common *common = ath9k_hw_common(ah);
  	struct ath9k_channel *chan = ah->curchan;
  	struct ar5416AniState *aniState = &ah->ani;
@@ -91,7 +91,7 @@
  	s32 value, value2;
  
  	switch (cmd & ah->ani_function) {
-@@ -1095,61 +1076,6 @@ static bool ar9003_hw_ani_control(struct
+@@ -1086,61 +1067,6 @@ static bool ar9003_hw_ani_control(struct
  		 */
  		u32 on = param ? 1 : 0;
  
diff --git a/package/kernel/mac80211/patches/ath9k/551-ath9k_ubnt_uap_plus_hsr.patch b/package/kernel/mac80211/patches/ath9k/551-ath9k_ubnt_uap_plus_hsr.patch
index 6b5c0dc514939d..efc4b9187c0f7f 100644
--- a/package/kernel/mac80211/patches/ath9k/551-ath9k_ubnt_uap_plus_hsr.patch
+++ b/package/kernel/mac80211/patches/ath9k/551-ath9k_ubnt_uap_plus_hsr.patch
@@ -371,7 +371,7 @@
  
 --- a/local-symbols
 +++ b/local-symbols
-@@ -133,6 +133,7 @@ ATH9K_WOW=
+@@ -129,6 +129,7 @@ ATH9K_WOW=
  ATH9K_RFKILL=
  ATH9K_CHANNEL_CONTEXT=
  ATH9K_PCOEM=
diff --git a/package/kernel/mac80211/patches/ath9k/552-ath9k-ahb_of.patch b/package/kernel/mac80211/patches/ath9k/552-ath9k-ahb_of.patch
index 7ce8bc5b82e39d..57eef54e8977a0 100644
--- a/package/kernel/mac80211/patches/ath9k/552-ath9k-ahb_of.patch
+++ b/package/kernel/mac80211/patches/ath9k/552-ath9k-ahb_of.patch
@@ -271,7 +271,7 @@
  
  	if (!dev_get_platdata(&pdev->dev)) {
  		dev_err(&pdev->dev, "no platform data specified\n");
-@@ -122,13 +371,16 @@ static int ath_ahb_probe(struct platform
+@@ -118,13 +367,16 @@ static int ath_ahb_probe(struct platform
  	sc->mem = mem;
  	sc->irq = irq;
  
@@ -289,7 +289,7 @@
  	if (ret) {
  		dev_err(&pdev->dev, "failed to initialize device\n");
  		goto err_irq;
-@@ -159,6 +411,9 @@ static int ath_ahb_remove(struct platfor
+@@ -155,6 +407,9 @@ static int ath_ahb_remove(struct platfor
  		free_irq(sc->irq, sc);
  		ieee80211_free_hw(sc->hw);
  	}
@@ -299,7 +299,7 @@
  
  	return 0;
  }
-@@ -168,6 +423,9 @@ static struct platform_driver ath_ahb_dr
+@@ -164,6 +419,9 @@ static struct platform_driver ath_ahb_dr
  	.remove     = ath_ahb_remove,
  	.driver		= {
  		.name	= "ath9k",
diff --git a/package/kernel/mac80211/patches/ath9k/553-ath9k_of_gpio_mask.patch b/package/kernel/mac80211/patches/ath9k/553-ath9k_of_gpio_mask.patch
index 80e0dc4c5ed807..6d1820ecb72d1a 100644
--- a/package/kernel/mac80211/patches/ath9k/553-ath9k_of_gpio_mask.patch
+++ b/package/kernel/mac80211/patches/ath9k/553-ath9k_of_gpio_mask.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -644,6 +644,12 @@ static int ath9k_of_init(struct ath_soft
+@@ -696,6 +696,12 @@ static int ath9k_of_init(struct ath_soft
  	return 0;
  }
  
@@ -13,7 +13,7 @@
  static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
  			    const struct ath_bus_ops *bus_ops)
  {
-@@ -747,6 +753,9 @@ static int ath9k_init_softc(u16 devid, s
+@@ -803,6 +809,9 @@ static int ath9k_init_softc(u16 devid, s
  	if (ret)
  		goto err_hw;
  
diff --git a/package/kernel/mac80211/patches/brcm/812-b43-add-antenna-control.patch b/package/kernel/mac80211/patches/brcm/812-b43-add-antenna-control.patch
index 5dc04ecc88e228..22b67c49d8e895 100644
--- a/package/kernel/mac80211/patches/brcm/812-b43-add-antenna-control.patch
+++ b/package/kernel/mac80211/patches/brcm/812-b43-add-antenna-control.patch
@@ -20,7 +20,7 @@
  
  	if (phy->type == B43_PHYTYPE_B) {
  		value16 = b43_read16(dev, 0x005E);
-@@ -3985,7 +3985,6 @@ static int b43_op_config(struct ieee8021
+@@ -3986,7 +3986,6 @@ static int b43_op_config(struct ieee8021
  	struct b43_wldev *dev = wl->current_dev;
  	struct b43_phy *phy = &dev->phy;
  	struct ieee80211_conf *conf = &hw->conf;
@@ -28,7 +28,7 @@
  	int err = 0;
  
  	mutex_lock(&wl->mutex);
-@@ -4028,11 +4027,9 @@ static int b43_op_config(struct ieee8021
+@@ -4029,11 +4028,9 @@ static int b43_op_config(struct ieee8021
  	}
  
  	/* Antennas for RX and management frame TX. */
@@ -42,7 +42,7 @@
  
  	if (wl->radio_enabled != phy->radio_on) {
  		if (wl->radio_enabled) {
-@@ -5175,6 +5172,47 @@ static int b43_op_get_survey(struct ieee
+@@ -5176,6 +5173,47 @@ static int b43_op_get_survey(struct ieee
  	return 0;
  }
  
@@ -89,8 +89,8 @@
 +
  static const struct ieee80211_ops b43_hw_ops = {
  	.tx			= b43_op_tx,
- 	.conf_tx		= b43_op_conf_tx,
-@@ -5196,6 +5234,8 @@ static const struct ieee80211_ops b43_hw
+ 	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+@@ -5198,6 +5236,8 @@ static const struct ieee80211_ops b43_hw
  	.sw_scan_complete	= b43_op_sw_scan_complete_notifier,
  	.get_survey		= b43_op_get_survey,
  	.rfkill_poll		= b43_rfkill_poll,
@@ -99,7 +99,7 @@
  };
  
  /* Hard-reset the chip. Do not call this directly.
-@@ -5497,6 +5537,8 @@ static int b43_one_core_attach(struct b4
+@@ -5499,6 +5539,8 @@ static int b43_one_core_attach(struct b4
  	if (!wldev)
  		goto out;
  
@@ -108,7 +108,7 @@
  	wldev->use_pio = b43_modparam_pio;
  	wldev->dev = dev;
  	wldev->wl = wl;
-@@ -5588,6 +5630,9 @@ static struct b43_wl *b43_wireless_init(
+@@ -5590,6 +5632,9 @@ static struct b43_wl *b43_wireless_init(
  
  	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
  
diff --git a/package/kernel/mac80211/patches/brcm/815-b43-always-take-overlapping-devs.patch b/package/kernel/mac80211/patches/brcm/815-b43-always-take-overlapping-devs.patch
index a8eae19413b21b..3700eaa1a069a6 100644
--- a/package/kernel/mac80211/patches/brcm/815-b43-always-take-overlapping-devs.patch
+++ b/package/kernel/mac80211/patches/brcm/815-b43-always-take-overlapping-devs.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/broadcom/b43/main.c
 +++ b/drivers/net/wireless/broadcom/b43/main.c
-@@ -114,7 +114,7 @@ static int b43_modparam_pio = 0;
+@@ -114,7 +114,7 @@ static int b43_modparam_pio;
  module_param_named(pio, b43_modparam_pio, int, 0644);
  MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
  
diff --git a/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch b/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
index 7b4cb250f93828..b82b442a1e1f4c 100644
--- a/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
+++ b/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
@@ -10,7 +10,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -715,8 +715,36 @@ static struct wireless_dev *brcmf_cfg802
+@@ -713,8 +713,36 @@ static struct wireless_dev *brcmf_cfg802
  	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
  	struct brcmf_pub *drvr = cfg->pub;
  	struct wireless_dev *wdev;
diff --git a/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch b/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch
index 88465f256be5f1..080ab8f7efd8e4 100644
--- a/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch
+++ b/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch
@@ -14,7 +14,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2974,6 +2974,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip
+@@ -2976,6 +2976,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip
  	 * preference in cfg struct to apply this to
  	 * FW later while initializing the dongle
  	 */
diff --git a/package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch b/package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
index 1ddc78f7ca9a21..25191b6439ee54 100644
--- a/package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
+++ b/package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
@@ -12,7 +12,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
-@@ -59,6 +59,36 @@ static int brcmf_of_get_country_codes(st
+@@ -65,6 +65,36 @@ static int brcmf_of_get_country_codes(st
  	return 0;
  }
  
@@ -49,7 +49,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  void brcmf_of_probe(struct device *dev, enum brcmf_bus_type bus_type,
  		    struct brcmf_mp_device *settings)
  {
-@@ -91,6 +121,8 @@ void brcmf_of_probe(struct device *dev,
+@@ -106,6 +136,8 @@ void brcmf_of_probe(struct device *dev,
  		of_node_put(root);
  	}
  
diff --git a/package/kernel/mac80211/patches/brcm/865-brcmfmac-Read-alternative-firmware-names-from-DT.patch b/package/kernel/mac80211/patches/brcm/865-brcmfmac-Read-alternative-firmware-names-from-DT.patch
index 8adb8c42a106a9..8df285f8b13781 100644
--- a/package/kernel/mac80211/patches/brcm/865-brcmfmac-Read-alternative-firmware-names-from-DT.patch
+++ b/package/kernel/mac80211/patches/brcm/865-brcmfmac-Read-alternative-firmware-names-from-DT.patch
@@ -24,7 +24,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  #include "of.h"
  
  static int brcmf_of_get_country_codes(struct device *dev,
-@@ -153,3 +154,38 @@ void brcmf_of_probe(struct device *dev,
+@@ -168,3 +169,38 @@ void brcmf_of_probe(struct device *dev,
  	sdio->oob_irq_nr = irq;
  	sdio->oob_irq_flags = irqf;
  }
@@ -65,22 +65,26 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 +}
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.h
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.h
-@@ -5,9 +5,16 @@
+@@ -5,9 +5,20 @@
  #ifdef CONFIG_OF
  void brcmf_of_probe(struct device *dev, enum brcmf_bus_type bus_type,
  		    struct brcmf_mp_device *settings);
++#ifdef CPTCFG_BRCMFMAC_SDIO
 +struct brcmf_firmware_mapping *
 +brcmf_of_fwnames(struct device *dev, u32 *map_count);
++#endif
  #else
  static void brcmf_of_probe(struct device *dev, enum brcmf_bus_type bus_type,
  			   struct brcmf_mp_device *settings)
  {
  }
++#ifdef CPTCFG_BRCMFMAC_SDIO
 +static struct brcmf_firmware_mapping *
 +brcmf_of_fwnames(struct device *dev, u32 *map_count)
 +{
 +	return NULL;
 +}
++#endif
  #endif /* CONFIG_OF */
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -92,7 +96,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  
  #define DCMD_RESP_TIMEOUT	msecs_to_jiffies(2500)
  #define CTL_DONE_TIMEOUT	msecs_to_jiffies(2500)
-@@ -633,7 +634,7 @@ MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH "b
+@@ -634,7 +635,7 @@ MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH "b
  /* per-board firmware binaries */
  MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH "brcmfmac*-sdio.*.bin");
  
@@ -101,7 +105,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	BRCMF_FW_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
  	BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0x0000001F, 43241B0),
  	BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0x00000020, 43241B4),
-@@ -659,6 +660,9 @@ static const struct brcmf_firmware_mappi
+@@ -662,6 +663,9 @@ static const struct brcmf_firmware_mappi
  	BRCMF_FW_ENTRY(CY_CC_43752_CHIP_ID, 0xFFFFFFFF, 43752)
  };
  
@@ -111,18 +115,9 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  #define TXCTL_CREDITS	2
  
  static void pkt_align(struct sk_buff *p, int len, int align)
-@@ -4140,7 +4144,7 @@ int brcmf_sdio_get_fwname(struct device
- 
- 	fwreq = brcmf_fw_alloc_request(bus_if->chip, bus_if->chiprev,
- 				       brcmf_sdio_fwnames,
--				       ARRAY_SIZE(brcmf_sdio_fwnames),
-+				       brcmf_sdio_fwnames_count,
- 				       fwnames, ARRAY_SIZE(fwnames));
- 	if (!fwreq)
- 		return -ENOMEM;
-@@ -4196,6 +4200,9 @@ static const struct brcmf_bus_ops brcmf_
- #define BRCMF_SDIO_FW_CODE	0
+@@ -4193,6 +4197,9 @@ static const struct brcmf_bus_ops brcmf_
  #define BRCMF_SDIO_FW_NVRAM	1
+ #define BRCMF_SDIO_FW_CLM	2
  
 +static struct brcmf_fw_request *
 +brcmf_sdio_prepare_fw_request(struct brcmf_sdio *bus);
@@ -130,7 +125,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  static void brcmf_sdio_firmware_callback(struct device *dev, int err,
  					 struct brcmf_fw_request *fwreq)
  {
-@@ -4211,6 +4218,22 @@ static void brcmf_sdio_firmware_callback
+@@ -4208,6 +4215,22 @@ static void brcmf_sdio_firmware_callback
  
  	brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
  
@@ -153,7 +148,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	if (err)
  		goto fail;
  
-@@ -4419,7 +4442,7 @@ brcmf_sdio_prepare_fw_request(struct brc
+@@ -4418,7 +4441,7 @@ brcmf_sdio_prepare_fw_request(struct brc
  
  	fwreq = brcmf_fw_alloc_request(bus->ci->chip, bus->ci->chiprev,
  				       brcmf_sdio_fwnames,
@@ -162,7 +157,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  				       fwnames, ARRAY_SIZE(fwnames));
  	if (!fwreq)
  		return NULL;
-@@ -4437,6 +4460,9 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+@@ -4438,6 +4461,9 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
  	struct brcmf_sdio *bus;
  	struct workqueue_struct *wq;
  	struct brcmf_fw_request *fwreq;
@@ -172,7 +167,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  
  	brcmf_dbg(TRACE, "Enter\n");
  
-@@ -4519,6 +4545,21 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+@@ -4520,6 +4546,21 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
  
  	brcmf_dbg(INFO, "completed!!\n");
  
diff --git a/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch b/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch
index 089ff2117bd94f..4ad2ac081a6761 100644
--- a/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch
+++ b/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch
@@ -1,6 +1,6 @@
 --- a/local-symbols
 +++ b/local-symbols
-@@ -451,43 +451,6 @@ USB_VL600=
+@@ -470,43 +470,6 @@ USB_VL600=
  USB_NET_CH9200=
  USB_NET_AQC111=
  USB_RTL8153_ECM=
@@ -99,7 +99,7 @@
  	return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
  #else
  	return bus->chipco.dev;
-@@ -4870,7 +4870,7 @@ static int b43_wireless_core_init(struct
+@@ -4871,7 +4871,7 @@ static int b43_wireless_core_init(struct
  	}
  	if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
  		hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
@@ -158,27 +158,6 @@
  	pcidev = bus->pcicore.dev;
  #endif
  	gpiodev = bus->chipco.dev ? : pcidev;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
-@@ -24,7 +24,7 @@ struct brcms_led {
- 	struct gpio_desc *gpiod;
- };
- 
--#ifdef CPTCFG_BCMA_DRIVER_GPIO
-+#ifdef CONFIG_BCMA_DRIVER_GPIO
- void brcms_led_unregister(struct brcms_info *wl);
- int brcms_led_register(struct brcms_info *wl);
- #else
---- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
-@@ -42,6 +42,6 @@ brcmsmac-y := \
- 	brcms_trace_events.o \
- 	debug.o
- 
--brcmsmac-$(CPTCFG_BCMA_DRIVER_GPIO) += led.o
-+brcmsmac-$(CONFIG_BCMA_DRIVER_GPIO) += led.o
- 
- obj-$(CPTCFG_BRCMSMAC)	+= brcmsmac.o
 --- a/drivers/net/wireless/broadcom/brcm80211/Kconfig
 +++ b/drivers/net/wireless/broadcom/brcm80211/Kconfig
 @@ -8,7 +8,7 @@ config BRCMSMAC
@@ -187,12 +166,12 @@
  	depends on BCMA_POSSIBLE
 -	select BCMA
 +	depends on BCMA
- 	select NEW_LEDS if BCMA_DRIVER_GPIO
- 	select LEDS_CLASS if BCMA_DRIVER_GPIO
  	select BRCMUTIL
+ 	depends on FW_LOADER
+ 	depends on CORDIC
 --- a/Kconfig.local
 +++ b/Kconfig.local
-@@ -1357,117 +1357,6 @@ config BACKPORTED_USB_NET_AQC111
+@@ -1414,117 +1414,6 @@ config BACKPORTED_USB_NET_AQC111
  config BACKPORTED_USB_RTL8153_ECM
  	tristate
  	default USB_RTL8153_ECM
diff --git a/package/kernel/mac80211/patches/build/070-remove-broken-wext-select.patch b/package/kernel/mac80211/patches/build/070-remove-broken-wext-select.patch
new file mode 100644
index 00000000000000..121b7faad93795
--- /dev/null
+++ b/package/kernel/mac80211/patches/build/070-remove-broken-wext-select.patch
@@ -0,0 +1,10 @@
+--- a/drivers/staging/rtl8723bs/Kconfig
++++ b/drivers/staging/rtl8723bs/Kconfig
+@@ -5,7 +5,6 @@ config RTL8723BS
+ 	depends on m
+ 	depends on WLAN && MMC && CFG80211
+ 	depends on m
+-	select CFG80211_WEXT
+ 	depends on CRYPTO
+ 	select BPAUTO_CRYPTO_LIB_ARC4
+ 	help
diff --git a/package/kernel/mac80211/patches/build/080-resv_start_op.patch b/package/kernel/mac80211/patches/build/080-resv_start_op.patch
new file mode 100644
index 00000000000000..40b8e94a201c6e
--- /dev/null
+++ b/package/kernel/mac80211/patches/build/080-resv_start_op.patch
@@ -0,0 +1,24 @@
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -5363,7 +5363,9 @@ static struct genl_family hwsim_genl_fam
+ 	.module = THIS_MODULE,
+ 	.small_ops = hwsim_ops,
+ 	.n_small_ops = ARRAY_SIZE(hwsim_ops),
++#if LINUX_VERSION_IS_GEQ(6,1,0)
+ 	.resv_start_op = HWSIM_CMD_DEL_MAC_ADDR + 1,
++#endif
+ 	.mcgrps = hwsim_mcgrps,
+ 	.n_mcgrps = ARRAY_SIZE(hwsim_mcgrps),
+ };
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -17233,7 +17233,9 @@ static struct genl_family nl80211_fam __
+ 	.n_ops = ARRAY_SIZE(nl80211_ops),
+ 	.small_ops = nl80211_small_ops,
+ 	.n_small_ops = ARRAY_SIZE(nl80211_small_ops),
++#if LINUX_VERSION_IS_GEQ(6,1,0)
+ 	.resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
++#endif
+ 	.mcgrps = nl80211_mcgrps,
+ 	.n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
+ 	.parallel_ops = true,
diff --git a/package/kernel/mac80211/patches/build/090-bcma-otp.patch b/package/kernel/mac80211/patches/build/090-bcma-otp.patch
new file mode 100644
index 00000000000000..39747761246ffe
--- /dev/null
+++ b/package/kernel/mac80211/patches/build/090-bcma-otp.patch
@@ -0,0 +1,13 @@
+--- /dev/null
++++ b/backport-include/linux/bcma/bcma_driver_chipcommon.h
+@@ -0,0 +1,10 @@
++#ifndef __BACKPORT_BCMA_DRIVER_CHIPCOMMON_H
++#define __BACKPORT_BCMA_DRIVER_CHIPCOMMON_H
++
++#include_next <linux/bcma/bcma_driver_chipcommon.h>
++
++#ifndef BCMA_CC_SROM_CONTROL_OTP_PRESENT
++#define BCMA_CC_SROM_CONTROL_OTP_PRESENT 0x00000020
++#endif
++
++#endif
diff --git a/package/kernel/mac80211/patches/build/100-backports-drop-QRTR-and-MHI.patch b/package/kernel/mac80211/patches/build/100-backports-drop-QRTR-and-MHI.patch
new file mode 100644
index 00000000000000..b017a0ce14600a
--- /dev/null
+++ b/package/kernel/mac80211/patches/build/100-backports-drop-QRTR-and-MHI.patch
@@ -0,0 +1,76 @@
+From 54e0f9aaf340377fb76acdffee9ec7372c4b70ae Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Mon, 17 Oct 2022 11:35:36 +0200
+Subject: [PATCH] backports: drop QRTR and MHI
+
+Backports currently include QRTR and MHI due to ath11k-pci requiring them,
+however this at the same time prevents us from adding ath11k-ahb as it
+also requires QRTR however its AHB variant from the kernel will conflict
+with the core provided by backports.
+
+Since MHI also conflicts with existing OpenWrt kmods providing MHI drop
+both from backports and use the ones provided by OpenWrt kernel.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ Kconfig.sources                         | 2 --
+ Makefile.kernel                         | 2 --
+ drivers/net/wireless/ath/ath11k/Kconfig | 6 +++---
+ local-symbols                           | 8 --------
+ 4 files changed, 3 insertions(+), 15 deletions(-)
+
+--- a/Kconfig.sources
++++ b/Kconfig.sources
+@@ -4,8 +4,6 @@ source "$BACKPORT_DIR/compat/Kconfig"
+ # these are copied from the kernel
+ source "$BACKPORT_DIR/net/wireless/Kconfig"
+ source "$BACKPORT_DIR/net/mac80211/Kconfig"
+-source "$BACKPORT_DIR/net/qrtr/Kconfig"
+-source "$BACKPORT_DIR/drivers/bus/mhi/Kconfig"
+ source "$BACKPORT_DIR/drivers/soc/qcom/Kconfig"
+ source "$BACKPORT_DIR/drivers/net/wireless/Kconfig"
+ source "$BACKPORT_DIR/drivers/net/usb/Kconfig"
+--- a/Makefile.kernel
++++ b/Makefile.kernel
+@@ -39,9 +39,7 @@ obj-y += compat/
+ 
+ obj-$(CPTCFG_CFG80211) += net/wireless/
+ obj-$(CPTCFG_MAC80211) += net/mac80211/
+-obj-$(CPTCFG_QRTR) += net/qrtr/
+ obj-$(CPTCFG_QCOM_QMI_HELPERS) += drivers/soc/qcom/
+-obj-$(CPTCFG_MHI_BUS) += drivers/bus/mhi/
+ obj-$(CPTCFG_WLAN) += drivers/net/wireless/
+ obj-$(CPTCFG_USB_NET_RNDIS_WLAN) += drivers/net/usb/
+ 
+--- a/drivers/net/wireless/ath/ath11k/Kconfig
++++ b/drivers/net/wireless/ath/ath11k/Kconfig
+@@ -25,9 +25,9 @@ config ATH11K_PCI
+ 	tristate "Atheros ath11k PCI support"
+ 	depends on m
+ 	depends on ATH11K && PCI
+-	select MHI_BUS
+-	select QRTR
+-	select QRTR_MHI
++	depends on MHI_BUS
++	depends on QRTR
++	depends on QRTR_MHI
+ 	help
+ 	  This module adds support for PCIE bus
+ 
+--- a/local-symbols
++++ b/local-symbols
+@@ -65,14 +65,6 @@ MAC80211_MESH_PS_DEBUG=
+ MAC80211_TDLS_DEBUG=
+ MAC80211_DEBUG_COUNTERS=
+ MAC80211_STA_HASH_MAX_SIZE=
+-QRTR=
+-QRTR_SMD=
+-QRTR_TUN=
+-QRTR_MHI=
+-MHI_BUS=
+-MHI_BUS_DEBUG=
+-MHI_BUS_PCI_GENERIC=
+-MHI_BUS_EP=
+ QCOM_AOSS_QMP=
+ QCOM_COMMAND_DB=
+ QCOM_CPR=
diff --git a/package/kernel/mac80211/patches/build/110-backport_napi_build_skb.patch b/package/kernel/mac80211/patches/build/110-backport_napi_build_skb.patch
new file mode 100644
index 00000000000000..1e152feceac6c3
--- /dev/null
+++ b/package/kernel/mac80211/patches/build/110-backport_napi_build_skb.patch
@@ -0,0 +1,11 @@
+--- a/backport-include/linux/skbuff.h
++++ b/backport-include/linux/skbuff.h
+@@ -144,4 +144,8 @@ static inline u64 skb_get_kcov_handle(st
+ #define napi_build_skb build_skb
+ #endif
+ 
++#if LINUX_VERSION_IS_LESS(5,11,0)
++#define napi_build_skb build_skb
++#endif
++
+ #endif /* __BACKPORT_SKBUFF_H */
diff --git a/package/kernel/mac80211/patches/mt7601u/001-wifi-mt7601u-update-firmware-path.patch b/package/kernel/mac80211/patches/mt7601u/001-wifi-mt7601u-update-firmware-path.patch
new file mode 100644
index 00000000000000..5d982906c5601a
--- /dev/null
+++ b/package/kernel/mac80211/patches/mt7601u/001-wifi-mt7601u-update-firmware-path.patch
@@ -0,0 +1,55 @@
+From patchwork Mon May 15 22:56:53 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 13242309
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@vger.kernel.org>
+Date: Tue, 16 May 2023 00:56:53 +0200
+From: Daniel Golle <daniel@makrotopia.org>
+To: Jakub Kicinski <kuba@kernel.org>, Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Matthias Brugger <matthias.bgg@gmail.com>,
+        AngeloGioacchino Del Regno
+        <angelogioacchino.delregno@collabora.com>,
+        linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
+        linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
+        linux-mediatek@lists.infradead.org
+Subject: [PATCH] wifi: mt7601u: update firmware path
+Message-ID: 
+ <fefcbf36f13873ae0d97438a0156b87e7e1ae64e.1684191377.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+mt7601u.bin was moved to mediatek/ folder in linux-wireless via commit
+8451c2b1 ("mt76xx: Move the old Mediatek WiFi firmware to mediatek")
+and linux-firmware release 20230515.
+
+Update the firmware path requested by the mt7601u driver to follow up
+with the move of the file.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/wireless/mediatek/mt7601u/usb.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+
+base-commit: 0d9b41daa5907756a31772d8af8ac5ff25cf17c1
+
+--- a/drivers/net/wireless/mediatek/mt7601u/usb.h
++++ b/drivers/net/wireless/mediatek/mt7601u/usb.h
+@@ -8,7 +8,7 @@
+ 
+ #include "mt7601u.h"
+ 
+-#define MT7601U_FIRMWARE	"mt7601u.bin"
++#define MT7601U_FIRMWARE	"mediatek/mt7601u.bin"
+ 
+ #define MT_VEND_REQ_MAX_RETRY	10
+ #define MT_VEND_REQ_TOUT_MS	300
diff --git a/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch b/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
index 140949f9a88e31..11536651b5e34f 100644
--- a/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
+++ b/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/mwl8k.c
 +++ b/drivers/net/wireless/marvell/mwl8k.c
-@@ -5699,6 +5699,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
+@@ -5703,6 +5703,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
  MODULE_FIRMWARE(MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API));
  
  static const struct pci_device_id mwl8k_pci_id_table[] = {
diff --git a/package/kernel/mac80211/patches/mwl/801-libertas-configure-sysfs-links.patch b/package/kernel/mac80211/patches/mwl/801-libertas-configure-sysfs-links.patch
index dfa0e502fc5b8a..1dbcb1bfef3f7b 100644
--- a/package/kernel/mac80211/patches/mwl/801-libertas-configure-sysfs-links.patch
+++ b/package/kernel/mac80211/patches/mwl/801-libertas-configure-sysfs-links.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/libertas/cfg.c
 +++ b/drivers/net/wireless/marvell/libertas/cfg.c
-@@ -2053,6 +2053,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
+@@ -2052,6 +2052,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
  		goto err_wiphy_new;
  	}
  
diff --git a/package/kernel/mac80211/patches/mwl/802-libertas-set-wireless-macaddr.patch b/package/kernel/mac80211/patches/mwl/802-libertas-set-wireless-macaddr.patch
index c2d0a5890d27f8..b47aee54908a88 100644
--- a/package/kernel/mac80211/patches/mwl/802-libertas-set-wireless-macaddr.patch
+++ b/package/kernel/mac80211/patches/mwl/802-libertas-set-wireless-macaddr.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/libertas/cfg.c
 +++ b/drivers/net/wireless/marvell/libertas/cfg.c
-@@ -2129,6 +2129,8 @@ int lbs_cfg_register(struct lbs_private
+@@ -2128,6 +2128,8 @@ int lbs_cfg_register(struct lbs_private
  	wdev->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
  	wdev->wiphy->reg_notifier = lbs_reg_notifier;
  
diff --git a/package/kernel/mac80211/patches/mwl/900-mwifiex-increase-the-global-limit-up-to-4-SSID.patch b/package/kernel/mac80211/patches/mwl/900-mwifiex-increase-the-global-limit-up-to-4-SSID.patch
index 4115eeccbb365a..caa139a2c6eae9 100644
--- a/package/kernel/mac80211/patches/mwl/900-mwifiex-increase-the-global-limit-up-to-4-SSID.patch
+++ b/package/kernel/mac80211/patches/mwl/900-mwifiex-increase-the-global-limit-up-to-4-SSID.patch
@@ -21,7 +21,7 @@ the card-specific structure.
 
 --- a/drivers/net/wireless/marvell/mwifiex/decl.h
 +++ b/drivers/net/wireless/marvell/mwifiex/decl.h
-@@ -30,7 +30,7 @@
+@@ -18,7 +18,7 @@
  #include <net/cfg80211.h>
  
  #define MWIFIEX_BSS_COEX_COUNT	     2
@@ -30,7 +30,7 @@ the card-specific structure.
  
  #define MWIFIEX_DMA_ALIGN_SZ	    64
  #define MWIFIEX_RX_HEADROOM	    64
-@@ -112,7 +112,7 @@
+@@ -100,7 +100,7 @@
  #define MWIFIEX_RATE_INDEX_OFDM0   4
  
  #define MWIFIEX_MAX_STA_NUM		3
diff --git a/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
index 96b1ce77e94eb0..c8d24283aad9ea 100644
--- a/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
+++ b/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/mwl8k.c
 +++ b/drivers/net/wireless/marvell/mwl8k.c
-@@ -6285,6 +6285,8 @@ static int mwl8k_probe(struct pci_dev *p
+@@ -6289,6 +6289,8 @@ static int mwl8k_probe(struct pci_dev *p
  
  	priv->running_bsses = 0;
  
@@ -9,7 +9,7 @@
  	return rc;
  
  err_stop_firmware:
-@@ -6318,8 +6320,6 @@ static void mwl8k_remove(struct pci_dev
+@@ -6322,8 +6324,6 @@ static void mwl8k_remove(struct pci_dev
  		return;
  	priv = hw->priv;
  
diff --git a/package/kernel/mac80211/patches/mwl/950-mwifiex-Print-stringified-name-of-command-in-error-l.patch b/package/kernel/mac80211/patches/mwl/950-mwifiex-Print-stringified-name-of-command-in-error-l.patch
index 8fa3924e60d161..98ed9e60e98337 100644
--- a/package/kernel/mac80211/patches/mwl/950-mwifiex-Print-stringified-name-of-command-in-error-l.patch
+++ b/package/kernel/mac80211/patches/mwl/950-mwifiex-Print-stringified-name-of-command-in-error-l.patch
@@ -19,7 +19,7 @@ Signed-off-by: Pali Rohár <pali@kernel.org>
 
 --- a/drivers/net/wireless/marvell/mwifiex/cmdevt.c
 +++ b/drivers/net/wireless/marvell/mwifiex/cmdevt.c
-@@ -28,6 +28,85 @@
+@@ -16,6 +16,85 @@
  
  static void mwifiex_cancel_pending_ioctl(struct mwifiex_adapter *adapter);
  
@@ -105,7 +105,7 @@ Signed-off-by: Pali Rohár <pali@kernel.org>
  /*
   * This function initializes a command node.
   *
-@@ -205,8 +284,8 @@ static int mwifiex_dnld_cmd_to_fw(struct
+@@ -193,8 +272,8 @@ static int mwifiex_dnld_cmd_to_fw(struct
  	    cmd_code != HostCmd_CMD_FUNC_SHUTDOWN &&
  	    cmd_code != HostCmd_CMD_FUNC_INIT) {
  		mwifiex_dbg(adapter, ERROR,
@@ -116,7 +116,7 @@ Signed-off-by: Pali Rohár <pali@kernel.org>
  		mwifiex_recycle_cmd_node(adapter, cmd_node);
  		queue_work(adapter->workqueue, &adapter->main_work);
  		return -1;
-@@ -660,8 +739,8 @@ int mwifiex_send_cmd(struct mwifiex_priv
+@@ -653,8 +732,8 @@ int mwifiex_send_cmd(struct mwifiex_priv
  	/* Return error, since the command preparation failed */
  	if (ret) {
  		mwifiex_dbg(adapter, ERROR,
@@ -127,7 +127,7 @@ Signed-off-by: Pali Rohár <pali@kernel.org>
  		mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
  		return -1;
  	}
-@@ -900,8 +979,9 @@ int mwifiex_process_cmdresp(struct mwifi
+@@ -902,8 +981,9 @@ int mwifiex_process_cmdresp(struct mwifi
  	if (adapter->hw_status == MWIFIEX_HW_STATUS_INITIALIZING) {
  		if (ret) {
  			mwifiex_dbg(adapter, ERROR,
@@ -139,7 +139,7 @@ Signed-off-by: Pali Rohár <pali@kernel.org>
  			mwifiex_init_fw_complete(adapter);
  			return -1;
  		} else if (adapter->last_init_cmd == cmdresp_no)
-@@ -1264,8 +1344,8 @@ mwifiex_process_sleep_confirm_resp(struc
+@@ -1273,8 +1353,8 @@ mwifiex_process_sleep_confirm_resp(struc
  
  	if (command != HostCmd_CMD_802_11_PS_MODE_ENH) {
  		mwifiex_dbg(adapter, ERROR,
@@ -152,7 +152,7 @@ Signed-off-by: Pali Rohár <pali@kernel.org>
  
 --- a/drivers/net/wireless/marvell/mwifiex/main.h
 +++ b/drivers/net/wireless/marvell/mwifiex/main.h
-@@ -1106,6 +1106,8 @@ void mwifiex_cancel_all_pending_cmd(stru
+@@ -1099,6 +1099,8 @@ void mwifiex_cancel_all_pending_cmd(stru
  void mwifiex_cancel_pending_scan_cmd(struct mwifiex_adapter *adapter);
  void mwifiex_cancel_scan(struct mwifiex_adapter *adapter);
  
@@ -163,7 +163,7 @@ Signed-off-by: Pali Rohár <pali@kernel.org>
  
 --- a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
 +++ b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
-@@ -48,8 +48,9 @@ mwifiex_process_cmdresp_error(struct mwi
+@@ -36,8 +36,9 @@ mwifiex_process_cmdresp_error(struct mwi
  	struct host_cmd_ds_802_11_ps_mode_enh *pm;
  
  	mwifiex_dbg(adapter, ERROR,
@@ -177,7 +177,7 @@ Signed-off-by: Pali Rohár <pali@kernel.org>
  		adapter->cmd_wait_q.status = -1;
 --- a/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
 +++ b/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
-@@ -806,7 +806,8 @@ int mwifiex_uap_prepare_cmd(struct mwifi
+@@ -794,7 +794,8 @@ int mwifiex_uap_prepare_cmd(struct mwifi
  		break;
  	default:
  		mwifiex_dbg(priv->adapter, ERROR,
diff --git a/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch b/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch
index bd33b2efbd9cc3..ab0fa3670d6b3d 100644
--- a/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch
+++ b/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch
@@ -1,6 +1,6 @@
 --- a/local-symbols
 +++ b/local-symbols
-@@ -345,6 +345,7 @@ RT2X00_LIB_FIRMWARE=
+@@ -347,6 +347,7 @@ RT2X00_LIB_FIRMWARE=
  RT2X00_LIB_CRYPTO=
  RT2X00_LIB_LEDS=
  RT2X00_LIB_DEBUGFS=
@@ -48,7 +48,7 @@
  obj-$(CPTCFG_RT2X00_LIB_MMIO)		+= rt2x00mmio.o
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-@@ -37,6 +37,8 @@ struct rt2800_drv_data {
+@@ -47,6 +47,8 @@ struct rt2800_drv_data {
  	struct ieee80211_sta *wcid_to_sta[STA_IDS_SIZE];
  };
  
@@ -57,7 +57,7 @@
  struct rt2800_ops {
  	u32 (*register_read)(struct rt2x00_dev *rt2x00dev,
  			      const unsigned int offset);
-@@ -135,6 +137,15 @@ static inline int rt2800_read_eeprom(str
+@@ -145,6 +147,15 @@ static inline int rt2800_read_eeprom(str
  {
  	const struct rt2800_ops *rt2800ops = rt2x00dev->ops->drv;
  
@@ -95,7 +95,7 @@
  /* Firmware functions */
  static char *rt2800soc_get_firmware_name(struct rt2x00_dev *rt2x00dev)
  {
-@@ -167,7 +154,6 @@ static const struct rt2800_ops rt2800soc
+@@ -168,7 +155,6 @@ static const struct rt2800_ops rt2800soc
  	.register_multiread	= rt2x00mmio_register_multiread,
  	.register_multiwrite	= rt2x00mmio_register_multiwrite,
  	.regbusy_read		= rt2x00mmio_regbusy_read,
@@ -127,7 +127,7 @@
  	DECLARE_KFIFO_PTR(txstatus_fifo, u32);
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1401,6 +1401,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
+@@ -1419,6 +1419,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
  	INIT_DELAYED_WORK(&rt2x00dev->autowakeup_work, rt2x00lib_autowakeup);
  	INIT_WORK(&rt2x00dev->sleep_work, rt2x00lib_sleep);
  
@@ -138,7 +138,7 @@
  	/*
  	 * Let the driver probe the device to detect the capabilities.
  	 */
-@@ -1541,6 +1545,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
+@@ -1559,6 +1563,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
  	 * Free the driver data.
  	 */
  	kfree(rt2x00dev->drv_data);
@@ -193,7 +193,7 @@
 +	if (pdata && pdata->eeprom_file_name)
 +		return pdata->eeprom_file_name;
 +
-+	return NULL
++	return NULL;
 +}
 +
 +static int rt2x00lib_request_eeprom_file(struct rt2x00_dev *rt2x00dev)
diff --git a/package/kernel/mac80211/patches/rt2x00/603-rt2x00-of_load_eeprom_filename.patch b/package/kernel/mac80211/patches/rt2x00/603-rt2x00-of_load_eeprom_filename.patch
index 9dffef1812d121..431e090237286d 100644
--- a/package/kernel/mac80211/patches/rt2x00/603-rt2x00-of_load_eeprom_filename.patch
+++ b/package/kernel/mac80211/patches/rt2x00/603-rt2x00-of_load_eeprom_filename.patch
@@ -8,7 +8,7 @@
  
  #include "rt2x00.h"
  #include "rt2x00lib.h"
-@@ -34,11 +35,21 @@ static const char *
+@@ -34,10 +35,20 @@ static const char *
  rt2x00lib_get_eeprom_file_name(struct rt2x00_dev *rt2x00dev)
  {
  	struct rt2x00_platform_data *pdata = rt2x00dev->dev->platform_data;
@@ -20,14 +20,12 @@
  	if (pdata && pdata->eeprom_file_name)
  		return pdata->eeprom_file_name;
  
--	return NULL
 +#ifdef CONFIG_OF
 +	np = rt2x00dev->dev->of_node;
 +	if (np && of_property_read_string(np, "ralink,eeprom", &eep) == 0)
 +	    return eep;
 +#endif
 +
-+	return NULL;
+ 	return NULL;
  }
  
- static int rt2x00lib_request_eeprom_file(struct rt2x00_dev *rt2x00dev)
diff --git a/package/kernel/mac80211/patches/rt2x00/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch b/package/kernel/mac80211/patches/rt2x00/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
index 38f8b7717686b1..8964f8bf1057b6 100644
--- a/package/kernel/mac80211/patches/rt2x00/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
+++ b/package/kernel/mac80211/patches/rt2x00/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
@@ -13,7 +13,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
-@@ -224,10 +224,17 @@ static int rt2800soc_probe(struct platfo
+@@ -225,10 +225,17 @@ static int rt2800soc_probe(struct platfo
  	return rt2x00soc_probe(pdev, &rt2800soc_ops);
  }
  
diff --git a/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch b/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch
index d78b76d7f5b0ee..acc8a8edb8ca94 100644
--- a/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch
+++ b/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch
@@ -8,7 +8,7 @@
  
  #include "rt2x00.h"
  #include "rt2800lib.h"
-@@ -9549,6 +9550,17 @@ static int rt2800_init_eeprom(struct rt2
+@@ -11131,6 +11132,17 @@ static int rt2800_init_eeprom(struct rt2
  	rt2800_init_led(rt2x00dev, &rt2x00dev->led_assoc, LED_TYPE_ASSOC);
  	rt2800_init_led(rt2x00dev, &rt2x00dev->led_qual, LED_TYPE_QUALITY);
  
diff --git a/package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch b/package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch
index 0da9356e0c1eac..5ef5fc8def623d 100644
--- a/package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch
+++ b/package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1340,7 +1340,7 @@ static inline void rt2x00lib_set_if_comb
+@@ -1358,7 +1358,7 @@ static inline void rt2x00lib_set_if_comb
  	 */
  	if_limit = &rt2x00dev->if_limits_ap;
  	if_limit->max = rt2x00dev->ops->max_ap_intf;
diff --git a/package/kernel/mac80211/patches/rt2x00/994-rt2x00-import-support-for-external-LNA-on-MT7620.patch b/package/kernel/mac80211/patches/rt2x00/994-rt2x00-import-support-for-external-LNA-on-MT7620.patch
new file mode 100644
index 00000000000000..deaa03be6c036d
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/994-rt2x00-import-support-for-external-LNA-on-MT7620.patch
@@ -0,0 +1,161 @@
+From 0fce1109f894ec7fcd72cb098843a1eff786716a Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Fri, 16 Sep 2022 20:49:42 +0100
+Subject: [PATCH 16/16] rt2x00: import support for external LNA on MT7620
+To: linux-wireless@vger.kernel.org,
+    Stanislaw Gruszka <stf_xl@wp.pl>,
+    Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+    David S. Miller <davem@davemloft.net>,
+    Eric Dumazet <edumazet@google.com>,
+    Jakub Kicinski <kuba@kernel.org>,
+    Paolo Abeni <pabeni@redhat.com>,
+    Johannes Berg <johannes.berg@intel.com>
+
+In order to carry out calibration on boards with ePA or eLNA the PA pin
+needs to be switch to GPIO mode on MT7620. Implement that by selecting
+pinctrl state "pa_gpio" which should be defined for MT7620 boards with
+eLNA or ePA beside the "default" state.
+
+Reported-by: Serge Vasilugin <vasilugin@yandex.ru>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 58 +++++++++++++++++++
+ drivers/net/wireless/ralink/rt2x00/rt2x00.h   |  5 ++
+ .../net/wireless/ralink/rt2x00/rt2x00soc.c    | 15 +++++
+ 3 files changed, 78 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -304,6 +304,24 @@ static void rt2800_rf_write(struct rt2x0
+ 	mutex_unlock(&rt2x00dev->csr_mutex);
+ }
+ 
++void rt6352_enable_pa_pin(struct rt2x00_dev *rt2x00dev, int enable)
++{
++	if (!rt2x00dev->pinctrl)
++		return;
++
++	if (enable) {
++		if (!rt2x00dev->pins_default)
++			return;
++
++		pinctrl_select_state(rt2x00dev->pinctrl, rt2x00dev->pins_default);
++	} else {
++		if (!rt2x00dev->pins_pa_gpio)
++			return;
++
++		pinctrl_select_state(rt2x00dev->pinctrl, rt2x00dev->pins_pa_gpio);
++	}
++}
++
+ static const unsigned int rt2800_eeprom_map[EEPROM_WORD_COUNT] = {
+ 	[EEPROM_CHIP_ID]		= 0x0000,
+ 	[EEPROM_VERSION]		= 0x0001,
+@@ -4469,6 +4487,29 @@ static void rt2800_config_channel(struct
+ 			rt2800_register_write(rt2x00dev, TX1_RF_GAIN_ATTEN,
+ 					      0x6C6C6B6C);
+ 		}
++
++		if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
++			reg = rt2800_register_read(rt2x00dev, RF_CONTROL3);
++			reg |= 0x00000101;
++			rt2800_register_write(rt2x00dev, RF_CONTROL3, reg);
++
++			reg = rt2800_register_read(rt2x00dev, RF_BYPASS3);
++			reg |= 0x00000101;
++			rt2800_register_write(rt2x00dev, RF_BYPASS3, reg);
++
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x66);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 17, 0x20);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 18, 0x42);
++			rt2800_bbp_write(rt2x00dev, 75, 0x68);
++			rt2800_bbp_write(rt2x00dev, 76, 0x4C);
++			rt2800_bbp_write(rt2x00dev, 79, 0x1C);
++			rt2800_bbp_write(rt2x00dev, 80, 0x0C);
++			rt2800_bbp_write(rt2x00dev, 82, 0xB6);
++			/* bank 0 RF reg 42 and glrt BBP reg 141 will be set in
++			 * config channel function in dependence of channel and
++			 * HT20/HT40 so don't touch it
++			 */
++		}
+ 	}
+ 
+ 	bbp = rt2800_bbp_read(rt2x00dev, 4);
+@@ -10583,6 +10624,7 @@ static void rt2800_init_rfcsr_6352(struc
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
+ 
++	rt6352_enable_pa_pin(rt2x00dev, 0);
+ 	rt2800_r_calibration(rt2x00dev);
+ 	rt2800_rf_self_txdc_cal(rt2x00dev);
+ 	rt2800_rxdcoc_calibration(rt2x00dev);
+@@ -10590,6 +10632,22 @@ static void rt2800_init_rfcsr_6352(struc
+ 	rt2800_bw_filter_calibration(rt2x00dev, false);
+ 	rt2800_loft_iq_calibration(rt2x00dev);
+ 	rt2800_rxiq_calibration(rt2x00dev);
++	rt6352_enable_pa_pin(rt2x00dev, 1);
++
++	if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x66);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 17, 0x20);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 18, 0x42);
++		rt2800_bbp_write(rt2x00dev, 75, 0x68);
++		rt2800_bbp_write(rt2x00dev, 76, 0x4C);
++		rt2800_bbp_write(rt2x00dev, 79, 0x1C);
++		rt2800_bbp_write(rt2x00dev, 80, 0x0C);
++		rt2800_bbp_write(rt2x00dev, 82, 0xB6);
++		/* bank 0 RF reg 42 and glrt BBP reg 141 will be set in config
++		 * channel function in dependence of channel and HT20/HT40,
++		 * so don't touch them here.
++		 */
++	}
+ }
+ 
+ static void rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -28,6 +28,7 @@
+ #include <linux/average.h>
+ #include <linux/usb.h>
+ #include <linux/clk.h>
++#include <linux/pinctrl/consumer.h>
+ #include <linux/rt2x00_platform.h>
+ 
+ #include <net/mac80211.h>
+@@ -1029,6 +1030,11 @@ struct rt2x00_dev {
+ 
+ 	/* Clock for System On Chip devices. */
+ 	struct clk *clk;
++
++	/* pinctrl and states for System On Chip devices with PA/LNA. */
++	struct pinctrl *pinctrl;
++	struct pinctrl_state *pins_default;
++	struct pinctrl_state *pins_pa_gpio;
+ };
+ 
+ struct rt2x00_bar_list_entry {
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00soc.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00soc.c
+@@ -97,6 +97,21 @@ int rt2x00soc_probe(struct platform_devi
+ 	if (retval)
+ 		goto exit_free_reg;
+ 
++	rt2x00dev->pinctrl = devm_pinctrl_get(&pdev->dev);
++	if (IS_ERR(rt2x00dev->pinctrl)) {
++		rt2x00dev->pinctrl = NULL;
++		rt2x00dev->pins_default = NULL;
++		rt2x00dev->pins_pa_gpio = NULL;
++	} else {
++		rt2x00dev->pins_default = pinctrl_lookup_state(rt2x00dev->pinctrl, "default");
++		if (IS_ERR(rt2x00dev->pins_default))
++			rt2x00dev->pins_default = NULL;
++
++		rt2x00dev->pins_pa_gpio = pinctrl_lookup_state(rt2x00dev->pinctrl, "pa_gpio");
++		if (IS_ERR(rt2x00dev->pins_pa_gpio))
++			rt2x00dev->pins_pa_gpio = NULL;
++	}
++
+ 	return 0;
+ 
+ exit_free_reg:
diff --git a/package/kernel/mac80211/patches/rt2x00/995-rt2x00-mt7620-introduce-accessors-for-CHIP_VER-register.patch b/package/kernel/mac80211/patches/rt2x00/995-rt2x00-mt7620-introduce-accessors-for-CHIP_VER-register.patch
new file mode 100644
index 00000000000000..97a56de2b3d844
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/995-rt2x00-mt7620-introduce-accessors-for-CHIP_VER-register.patch
@@ -0,0 +1,139 @@
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
+@@ -78,6 +78,9 @@ struct rt2800_ops {
+ 	int (*drv_init_registers)(struct rt2x00_dev *rt2x00dev);
+ 	__le32 *(*drv_get_txwi)(struct queue_entry *entry);
+ 	unsigned int (*drv_get_dma_done)(struct data_queue *queue);
++	int (*hw_get_chippkg)(void);
++	int (*hw_get_chipver)(void);
++	int (*hw_get_chipeco)(void);
+ };
+ 
+ static inline u32 rt2800_register_read(struct rt2x00_dev *rt2x00dev,
+@@ -195,6 +198,27 @@ static inline unsigned int rt2800_drv_ge
+ 	return rt2800ops->drv_get_dma_done(queue);
+ }
+ 
++static inline int rt2800_hw_get_chippkg(struct rt2x00_dev *rt2x00dev)
++{
++	const struct rt2800_ops *rt2800ops = rt2x00dev->ops->drv;
++
++	return rt2800ops->hw_get_chippkg();
++}
++
++static inline int rt2800_hw_get_chipver(struct rt2x00_dev *rt2x00dev)
++{
++	const struct rt2800_ops *rt2800ops = rt2x00dev->ops->drv;
++
++	return rt2800ops->hw_get_chipver();
++}
++
++static inline int rt2800_hw_get_chipeco(struct rt2x00_dev *rt2x00dev)
++{
++	const struct rt2800_ops *rt2800ops = rt2x00dev->ops->drv;
++
++	return rt2800ops->hw_get_chipeco();
++}
++
+ void rt2800_mcu_request(struct rt2x00_dev *rt2x00dev,
+ 			const u8 command, const u8 token,
+ 			const u8 arg0, const u8 arg1);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
+@@ -286,6 +286,10 @@ static int rt2800pci_read_eeprom(struct
+ 	return retval;
+ }
+ 
++static int rt2800pci_get_chippkg(void) { return 0; }
++static int rt2800pci_get_chipver(void) { return 0; }
++static int rt2800pci_get_chipeco(void) { return 0; }
++
+ static const struct ieee80211_ops rt2800pci_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
+ 	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+@@ -329,6 +333,9 @@ static const struct rt2800_ops rt2800pci
+ 	.drv_init_registers	= rt2800mmio_init_registers,
+ 	.drv_get_txwi		= rt2800mmio_get_txwi,
+ 	.drv_get_dma_done	= rt2800mmio_get_dma_done,
++	.hw_get_chippkg		= rt2800pci_get_chippkg,
++	.hw_get_chipver		= rt2800pci_get_chipver,
++	.hw_get_chipeco		= rt2800pci_get_chipeco,
+ };
+ 
+ static const struct rt2x00lib_ops rt2800pci_rt2x00_ops = {
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
+@@ -27,6 +27,12 @@
+ #include "rt2800lib.h"
+ #include "rt2800mmio.h"
+ 
++/* Needed to probe CHIP_VER register on MT7620 */
++#ifdef CONFIG_SOC_MT7620
++#include <asm/mach-ralink/ralink_regs.h>
++#include <asm/mach-ralink/mt7620.h>
++#endif
++
+ /* Allow hardware encryption to be disabled. */
+ static bool modparam_nohwcrypt;
+ module_param_named(nohwcrypt, modparam_nohwcrypt, bool, 0444);
+@@ -118,6 +124,27 @@ static int rt2800soc_write_firmware(stru
+ 	return 0;
+ }
+ 
++#ifdef CONFIG_SOC_MT7620
++static int rt2800soc_get_chippkg(void)
++{
++	return mt7620_get_pkg();
++}
++
++static int rt2800soc_get_chipver(void)
++{
++	return mt7620_get_chipver();
++}
++
++static int rt2800soc_get_chipeco(void)
++{
++	return mt7620_get_eco();
++}
++#else
++static int rt2800soc_get_chippkg(void) { return 0; }
++static int rt2800soc_get_chipver(void) { return 0; }
++static int rt2800soc_get_chipeco(void) { return 0; }
++#endif
++
+ static const struct ieee80211_ops rt2800soc_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
+ 	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+@@ -160,6 +187,9 @@ static const struct rt2800_ops rt2800soc
+ 	.drv_init_registers	= rt2800mmio_init_registers,
+ 	.drv_get_txwi		= rt2800mmio_get_txwi,
+ 	.drv_get_dma_done	= rt2800mmio_get_dma_done,
++	.hw_get_chippkg		= rt2800soc_get_chippkg,
++	.hw_get_chipver		= rt2800soc_get_chipver,
++	.hw_get_chipeco		= rt2800soc_get_chipeco,
+ };
+ 
+ static const struct rt2x00lib_ops rt2800soc_rt2x00_ops = {
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
+@@ -628,6 +628,10 @@ static int rt2800usb_probe_hw(struct rt2
+ 	return 0;
+ }
+ 
++static int rt2800usb_get_chippkg(void) { return 0; }
++static int rt2800usb_get_chipver(void) { return 0; }
++static int rt2800usb_get_chipeco(void) { return 0; }
++
+ static const struct ieee80211_ops rt2800usb_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
+ 	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+@@ -672,6 +676,9 @@ static const struct rt2800_ops rt2800usb
+ 	.drv_init_registers	= rt2800usb_init_registers,
+ 	.drv_get_txwi		= rt2800usb_get_txwi,
+ 	.drv_get_dma_done	= rt2800usb_get_dma_done,
++	.hw_get_chippkg		= rt2800usb_get_chippkg,
++	.hw_get_chipver		= rt2800usb_get_chipver,
++	.hw_get_chipeco		= rt2800usb_get_chipeco,
+ };
+ 
+ static const struct rt2x00lib_ops rt2800usb_rt2x00_ops = {
diff --git a/package/kernel/mac80211/patches/rt2x00/996-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch b/package/kernel/mac80211/patches/rt2x00/996-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch
new file mode 100644
index 00000000000000..dab6e05ffd2c5c
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/996-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch
@@ -0,0 +1,408 @@
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
+@@ -1044,6 +1044,11 @@
+ #define MIMO_PS_CFG_RX_STBY_POL		FIELD32(0x00000010)
+ #define MIMO_PS_CFG_RX_RX_STBY0		FIELD32(0x00000020)
+ 
++#define BB_PA_MODE_CFG0			0x1214
++#define BB_PA_MODE_CFG1			0x1218
++#define RF_PA_MODE_CFG0			0x121C
++#define RF_PA_MODE_CFG1			0x1220
++
+ /*
+  * EDCA_AC0_CFG:
+  */
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -3778,14 +3778,16 @@ static void rt2800_config_channel_rf7620
+ 	rt2x00_set_field8(&rfcsr, RFCSR19_K, rf->rf4);
+ 	rt2800_rfcsr_write(rt2x00dev, 19, rfcsr);
+ 
+-	/* Default: XO=20MHz , SDM mode */
+-	rfcsr = rt2800_rfcsr_read(rt2x00dev, 16);
+-	rt2x00_set_field8(&rfcsr, RFCSR16_SDM_MODE_MT7620, 0x80);
+-	rt2800_rfcsr_write(rt2x00dev, 16, rfcsr);
+-
+-	rfcsr = rt2800_rfcsr_read(rt2x00dev, 21);
+-	rt2x00_set_field8(&rfcsr, RFCSR21_BIT8, 1);
+-	rt2800_rfcsr_write(rt2x00dev, 21, rfcsr);
++	if (rt2800_hw_get_chipver(rt2x00dev) > 1) {
++		/* Default: XO=20MHz , SDM mode */
++		rfcsr = rt2800_rfcsr_read(rt2x00dev, 16);
++		rt2x00_set_field8(&rfcsr, RFCSR16_SDM_MODE_MT7620, 0x80);
++		rt2800_rfcsr_write(rt2x00dev, 16, rfcsr);
++
++		rfcsr = rt2800_rfcsr_read(rt2x00dev, 21);
++		rt2x00_set_field8(&rfcsr, RFCSR21_BIT8, 1);
++		rt2800_rfcsr_write(rt2x00dev, 21, rfcsr);
++	}
+ 
+ 	rfcsr = rt2800_rfcsr_read(rt2x00dev, 1);
+ 	rt2x00_set_field8(&rfcsr, RFCSR1_TX2_EN_MT7620,
+@@ -3819,18 +3821,23 @@ static void rt2800_config_channel_rf7620
+ 		rt2800_rfcsr_write_dccal(rt2x00dev, 59, 0x20);
+ 	}
+ 
+-	if (conf_is_ht40(conf)) {
+-		rt2800_rfcsr_write_dccal(rt2x00dev, 58, 0x08);
+-		rt2800_rfcsr_write_dccal(rt2x00dev, 59, 0x08);
+-	} else {
+-		rt2800_rfcsr_write_dccal(rt2x00dev, 58, 0x28);
+-		rt2800_rfcsr_write_dccal(rt2x00dev, 59, 0x28);
++	if (rt2800_hw_get_chipver(rt2x00dev) > 1) {
++		if (conf_is_ht40(conf)) {
++			rt2800_rfcsr_write_dccal(rt2x00dev, 58, 0x08);
++			rt2800_rfcsr_write_dccal(rt2x00dev, 59, 0x08);
++		} else {
++			rt2800_rfcsr_write_dccal(rt2x00dev, 58, 0x28);
++			rt2800_rfcsr_write_dccal(rt2x00dev, 59, 0x28);
++		}
+ 	}
+ 
+-	rfcsr = rt2800_rfcsr_read(rt2x00dev, 28);
+-	rt2x00_set_field8(&rfcsr, RFCSR28_CH11_HT40,
+-			  conf_is_ht40(conf) && (rf->channel == 11));
+-	rt2800_rfcsr_write(rt2x00dev, 28, rfcsr);
++	if (rt2800_hw_get_chipver(rt2x00dev) > 1 &&
++	    rt2800_hw_get_chipeco(rt2x00dev) == 2) {
++		rfcsr = rt2800_rfcsr_read(rt2x00dev, 28);
++		rt2x00_set_field8(&rfcsr, RFCSR28_CH11_HT40,
++				  conf_is_ht40(conf) && (rf->channel == 11));
++		rt2800_rfcsr_write(rt2x00dev, 28, rfcsr);
++	}
+ 
+ 	if (!test_bit(DEVICE_STATE_SCANNING, &rt2x00dev->flags)) {
+ 		if (conf_is_ht40(conf)) {
+@@ -3929,25 +3936,29 @@ static void rt2800_config_alc(struct rt2
+ 	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY)))
+ 		rt2x00_warn(rt2x00dev, "RF busy while configuring ALC\n");
+ 
+-	if (chan->center_freq > 2457) {
+-		bbp = rt2800_bbp_read(rt2x00dev, 30);
+-		bbp = 0x40;
+-		rt2800_bbp_write(rt2x00dev, 30, bbp);
+-		rt2800_rfcsr_write(rt2x00dev, 39, 0);
+-		if (rt2x00_has_cap_external_lna_bg(rt2x00dev))
+-			rt2800_rfcsr_write(rt2x00dev, 42, 0xfb);
+-		else
+-			rt2800_rfcsr_write(rt2x00dev, 42, 0x7b);
+-	} else {
+-		bbp = rt2800_bbp_read(rt2x00dev, 30);
+-		bbp = 0x1f;
+-		rt2800_bbp_write(rt2x00dev, 30, bbp);
+-		rt2800_rfcsr_write(rt2x00dev, 39, 0x80);
+-		if (rt2x00_has_cap_external_lna_bg(rt2x00dev))
+-			rt2800_rfcsr_write(rt2x00dev, 42, 0xdb);
+-		else
+-			rt2800_rfcsr_write(rt2x00dev, 42, 0x5b);
++	if (rt2800_hw_get_chipver(rt2x00dev) > 1 &&
++	    rt2800_hw_get_chipeco(rt2x00dev) >= 2) {
++		if (chan->center_freq > 2457) {
++			bbp = rt2800_bbp_read(rt2x00dev, 30);
++			bbp = 0x40;
++			rt2800_bbp_write(rt2x00dev, 30, bbp);
++			rt2800_rfcsr_write(rt2x00dev, 39, 0);
++			if (rt2x00_has_cap_external_lna_bg(rt2x00dev))
++				rt2800_rfcsr_write(rt2x00dev, 42, 0xfb);
++			else
++				rt2800_rfcsr_write(rt2x00dev, 42, 0x7b);
++		} else {
++			bbp = rt2800_bbp_read(rt2x00dev, 30);
++			bbp = 0x1f;
++			rt2800_bbp_write(rt2x00dev, 30, bbp);
++			rt2800_rfcsr_write(rt2x00dev, 39, 0x80);
++			if (rt2x00_has_cap_external_lna_bg(rt2x00dev))
++				rt2800_rfcsr_write(rt2x00dev, 42, 0xdb);
++			else
++				rt2800_rfcsr_write(rt2x00dev, 42, 0x5b);
++		}
+ 	}
++
+ 	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, mac_sys_ctrl);
+ 
+ 	rt2800_vco_calibration(rt2x00dev);
+@@ -6011,18 +6022,33 @@ static int rt2800_init_registers(struct
+ 	} else if (rt2x00_rt(rt2x00dev, RT5350)) {
+ 		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
+ 	} else if (rt2x00_rt(rt2x00dev, RT6352)) {
+-		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000401);
+-		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0001);
+-		rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
+-		rt2800_register_write(rt2x00dev, TX_ALC_VGA3, 0x00000000);
+-		rt2800_register_write(rt2x00dev, TX0_BB_GAIN_ATTEN, 0x0);
+-		rt2800_register_write(rt2x00dev, TX1_BB_GAIN_ATTEN, 0x0);
+-		rt2800_register_write(rt2x00dev, TX0_RF_GAIN_ATTEN, 0x6C6C666C);
+-		rt2800_register_write(rt2x00dev, TX1_RF_GAIN_ATTEN, 0x6C6C666C);
+-		rt2800_register_write(rt2x00dev, TX0_RF_GAIN_CORRECT,
+-				      0x3630363A);
+-		rt2800_register_write(rt2x00dev, TX1_RF_GAIN_CORRECT,
+-				      0x3630363A);
++		if (rt2800_hw_get_chipver(rt2x00dev) <= 1) {
++			rt2800_register_write(rt2x00dev, TX_ALC_VGA3,
++					      0x00000000);
++			rt2800_register_write(rt2x00dev, BB_PA_MODE_CFG0,
++					      0x000055FF);
++			rt2800_register_write(rt2x00dev, BB_PA_MODE_CFG1,
++					      0x00550055);
++			rt2800_register_write(rt2x00dev, RF_PA_MODE_CFG0,
++					      0x000055FF);
++			rt2800_register_write(rt2x00dev, RF_PA_MODE_CFG1,
++					      0x00550055);
++		} else {
++			rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000401);
++			rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0001);
++			rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
++			rt2800_register_write(rt2x00dev, TX_ALC_VGA3, 0x00000000);
++			rt2800_register_write(rt2x00dev, TX0_BB_GAIN_ATTEN, 0x0);
++			rt2800_register_write(rt2x00dev, TX1_BB_GAIN_ATTEN, 0x0);
++			rt2800_register_write(rt2x00dev, TX0_RF_GAIN_ATTEN,
++					      0x6C6C666C);
++			rt2800_register_write(rt2x00dev, TX1_RF_GAIN_ATTEN,
++					      0x6C6C666C);
++			rt2800_register_write(rt2x00dev, TX0_RF_GAIN_CORRECT,
++					      0x3630363A);
++			rt2800_register_write(rt2x00dev, TX1_RF_GAIN_CORRECT,
++					      0x3630363A);
++		}
+ 		reg = rt2800_register_read(rt2x00dev, TX_ALC_CFG_1);
+ 		rt2x00_set_field32(&reg, TX_ALC_CFG_1_ROS_BUSY_EN, 0);
+ 		rt2800_register_write(rt2x00dev, TX_ALC_CFG_1, reg);
+@@ -7127,14 +7153,16 @@ static void rt2800_init_bbp_6352(struct
+ 	rt2800_bbp_write(rt2x00dev, 188, 0x00);
+ 	rt2800_bbp_write(rt2x00dev, 189, 0x00);
+ 
+-	rt2800_bbp_write(rt2x00dev, 91, 0x06);
+-	rt2800_bbp_write(rt2x00dev, 92, 0x04);
+-	rt2800_bbp_write(rt2x00dev, 93, 0x54);
+-	rt2800_bbp_write(rt2x00dev, 99, 0x50);
+-	rt2800_bbp_write(rt2x00dev, 148, 0x84);
+-	rt2800_bbp_write(rt2x00dev, 167, 0x80);
+-	rt2800_bbp_write(rt2x00dev, 178, 0xFF);
+-	rt2800_bbp_write(rt2x00dev, 106, 0x13);
++	if (rt2800_hw_get_chipver(rt2x00dev) > 1) {
++		rt2800_bbp_write(rt2x00dev, 91, 0x06);
++		rt2800_bbp_write(rt2x00dev, 92, 0x04);
++		rt2800_bbp_write(rt2x00dev, 93, 0x54);
++		rt2800_bbp_write(rt2x00dev, 99, 0x50);
++		rt2800_bbp_write(rt2x00dev, 148, 0x84);
++		rt2800_bbp_write(rt2x00dev, 167, 0x80);
++		rt2800_bbp_write(rt2x00dev, 178, 0xFF);
++		rt2800_bbp_write(rt2x00dev, 106, 0x13);
++	}
+ 
+ 	/* BBP for G band GLRT function (BBP_128 ~ BBP_221) */
+ 	rt2800_bbp_glrt_write(rt2x00dev, 0, 0x00);
+@@ -10408,31 +10436,36 @@ static void rt2800_init_rfcsr_6352(struc
+ 	rt2800_rfcsr_write(rt2x00dev, 42, 0x5B);
+ 	rt2800_rfcsr_write(rt2x00dev, 43, 0x00);
+ 
+-	rt2800_rfcsr_write(rt2x00dev, 11, 0x21);
+-	if (rt2800_clk_is_20mhz(rt2x00dev))
+-		rt2800_rfcsr_write(rt2x00dev, 13, 0x03);
+-	else
+-		rt2800_rfcsr_write(rt2x00dev, 13, 0x00);
+-	rt2800_rfcsr_write(rt2x00dev, 14, 0x7C);
+-	rt2800_rfcsr_write(rt2x00dev, 16, 0x80);
+-	rt2800_rfcsr_write(rt2x00dev, 17, 0x99);
+-	rt2800_rfcsr_write(rt2x00dev, 18, 0x99);
+-	rt2800_rfcsr_write(rt2x00dev, 19, 0x09);
+-	rt2800_rfcsr_write(rt2x00dev, 20, 0x50);
+-	rt2800_rfcsr_write(rt2x00dev, 21, 0xB0);
+-	rt2800_rfcsr_write(rt2x00dev, 22, 0x00);
+-	rt2800_rfcsr_write(rt2x00dev, 23, 0x06);
+-	rt2800_rfcsr_write(rt2x00dev, 24, 0x00);
+-	rt2800_rfcsr_write(rt2x00dev, 25, 0x00);
+-	rt2800_rfcsr_write(rt2x00dev, 26, 0x5D);
+-	rt2800_rfcsr_write(rt2x00dev, 27, 0x00);
+-	rt2800_rfcsr_write(rt2x00dev, 28, 0x61);
+-	rt2800_rfcsr_write(rt2x00dev, 29, 0xB5);
+-	rt2800_rfcsr_write(rt2x00dev, 43, 0x02);
+-
+-	rt2800_rfcsr_write(rt2x00dev, 28, 0x62);
+-	rt2800_rfcsr_write(rt2x00dev, 29, 0xAD);
+-	rt2800_rfcsr_write(rt2x00dev, 39, 0x80);
++	if (rt2800_hw_get_chipver(rt2x00dev) > 1) {
++		rt2800_rfcsr_write(rt2x00dev, 11, 0x21);
++		if (rt2800_clk_is_20mhz(rt2x00dev))
++			rt2800_rfcsr_write(rt2x00dev, 13, 0x03);
++		else
++			rt2800_rfcsr_write(rt2x00dev, 13, 0x00);
++		rt2800_rfcsr_write(rt2x00dev, 14, 0x7C);
++		rt2800_rfcsr_write(rt2x00dev, 16, 0x80);
++		rt2800_rfcsr_write(rt2x00dev, 17, 0x99);
++		rt2800_rfcsr_write(rt2x00dev, 18, 0x99);
++		rt2800_rfcsr_write(rt2x00dev, 19, 0x09);
++		rt2800_rfcsr_write(rt2x00dev, 20, 0x50);
++		rt2800_rfcsr_write(rt2x00dev, 21, 0xB0);
++		rt2800_rfcsr_write(rt2x00dev, 22, 0x00);
++		rt2800_rfcsr_write(rt2x00dev, 23, 0x06);
++		rt2800_rfcsr_write(rt2x00dev, 24, 0x00);
++		rt2800_rfcsr_write(rt2x00dev, 25, 0x00);
++		rt2800_rfcsr_write(rt2x00dev, 26, 0x5D);
++		rt2800_rfcsr_write(rt2x00dev, 27, 0x00);
++		rt2800_rfcsr_write(rt2x00dev, 28, 0x61);
++		rt2800_rfcsr_write(rt2x00dev, 29, 0xB5);
++		rt2800_rfcsr_write(rt2x00dev, 43, 0x02);
++	}
++
++	if (rt2800_hw_get_chipver(rt2x00dev) > 1 &&
++	    rt2800_hw_get_chipeco(rt2x00dev) >= 2) {
++		rt2800_rfcsr_write(rt2x00dev, 28, 0x62);
++		rt2800_rfcsr_write(rt2x00dev, 29, 0xAD);
++		rt2800_rfcsr_write(rt2x00dev, 39, 0x80);
++	}
+ 
+ 	/* Initialize RF channel register to default value */
+ 	rt2800_rfcsr_write_chanreg(rt2x00dev, 0, 0x03);
+@@ -10498,63 +10531,71 @@ static void rt2800_init_rfcsr_6352(struc
+ 
+ 	rt2800_rfcsr_write_bank(rt2x00dev, 6, 45, 0xC5);
+ 
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 9, 0x47);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 10, 0x71);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 11, 0x33);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x0E);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 17, 0x23);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 19, 0xA4);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 20, 0x02);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 21, 0x12);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 28, 0x1C);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 29, 0xEB);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 32, 0x7D);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 34, 0xD6);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 36, 0x08);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 38, 0xB4);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 43, 0xD3);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 44, 0xB3);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 45, 0xD5);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 46, 0x27);
+-	rt2800_rfcsr_write_bank(rt2x00dev, 4, 47, 0x67);
+-	rt2800_rfcsr_write_bank(rt2x00dev, 6, 47, 0x69);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 48, 0xFF);
+-	rt2800_rfcsr_write_bank(rt2x00dev, 4, 54, 0x27);
+-	rt2800_rfcsr_write_bank(rt2x00dev, 6, 54, 0x20);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0x66);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 56, 0xFF);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 57, 0x1C);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 58, 0x20);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 59, 0x6B);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 60, 0xF7);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 61, 0x09);
+-
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 10, 0x51);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x06);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 19, 0xA7);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 28, 0x2C);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0x64);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 8, 0x51);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 9, 0x36);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 11, 0x53);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x16);
+-
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 47, 0x6C);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 48, 0xFC);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 49, 0x1F);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 54, 0x27);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0x66);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 59, 0x6B);
+-
+-	/* Initialize RF channel register for DRQFN */
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 43, 0xD3);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 44, 0xE3);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 45, 0xE5);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 47, 0x28);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0x68);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 56, 0xF7);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 58, 0x02);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 60, 0xC7);
++	if (rt2800_hw_get_chipver(rt2x00dev) > 1) {
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 9, 0x47);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 10, 0x71);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 11, 0x33);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x0E);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 17, 0x23);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 19, 0xA4);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 20, 0x02);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 21, 0x12);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 28, 0x1C);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 29, 0xEB);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 32, 0x7D);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 34, 0xD6);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 36, 0x08);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 38, 0xB4);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 43, 0xD3);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 44, 0xB3);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 45, 0xD5);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 46, 0x27);
++		rt2800_rfcsr_write_bank(rt2x00dev, 4, 47, 0x67);
++		rt2800_rfcsr_write_bank(rt2x00dev, 6, 47, 0x69);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 48, 0xFF);
++		rt2800_rfcsr_write_bank(rt2x00dev, 4, 54, 0x27);
++		rt2800_rfcsr_write_bank(rt2x00dev, 6, 54, 0x20);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0x66);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 56, 0xFF);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 57, 0x1C);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 58, 0x20);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 59, 0x6B);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 60, 0xF7);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 61, 0x09);
++	}
++
++	if (rt2800_hw_get_chipver(rt2x00dev) > 1 &&
++	    rt2800_hw_get_chipeco(rt2x00dev) >= 2) {
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 10, 0x51);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x06);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 19, 0xA7);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 28, 0x2C);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0x64);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 8, 0x51);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 9, 0x36);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 11, 0x53);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x16);
++
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 47, 0x6C);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 48, 0xFC);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 49, 0x1F);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 54, 0x27);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0x66);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 59, 0x6B);
++	}
++
++	if (rt2800_hw_get_chippkg(rt2x00dev) == 0 &&
++	    rt2800_hw_get_chipver(rt2x00dev) == 1) {
++		/* Initialize RF channel register for DRQFN */
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 43, 0xD3);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 44, 0xE3);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 45, 0xE5);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 47, 0x28);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0x68);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 56, 0xF7);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 58, 0x02);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 60, 0xC7);
++	}
+ 
+ 	/* Initialize RF DC calibration register to default value */
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 0, 0x47);
+@@ -10617,12 +10658,17 @@ static void rt2800_init_rfcsr_6352(struc
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 62, 0x00);
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 63, 0x00);
+ 
+-	rt2800_rfcsr_write_dccal(rt2x00dev, 3, 0x08);
+-	rt2800_rfcsr_write_dccal(rt2x00dev, 4, 0x04);
+-	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x20);
++	if (rt2800_hw_get_chipver(rt2x00dev) > 1) {
++		rt2800_rfcsr_write_dccal(rt2x00dev, 3, 0x08);
++		rt2800_rfcsr_write_dccal(rt2x00dev, 4, 0x04);
++		rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x20);
++	}
+ 
+-	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
+-	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
++	if (rt2800_hw_get_chipver(rt2x00dev) > 1 &&
++	    rt2800_hw_get_chipeco(rt2x00dev) >= 2) {
++		rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
++		rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
++	}
+ 
+ 	rt6352_enable_pa_pin(rt2x00dev, 0);
+ 	rt2800_r_calibration(rt2x00dev);
diff --git a/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch b/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
index 5307fd355ceaff..4d4a2a8f5e8d2f 100644
--- a/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
+++ b/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
@@ -1,12 +1,19 @@
-Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnects
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 27 Oct 2014 00:00:00 +0100
+Subject: [PATCH] mac80211: preseve AP mode keys across STA reconnect
+
+Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnect
+---
+ net/mac80211/cfg.c | 1 -
+ 1 file changed, 1 deletion(-)
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1319,7 +1319,6 @@ static int ieee80211_stop_ap(struct wiph
- 	sdata->vif.bss_conf.ftmr_params = NULL;
+@@ -1519,7 +1519,6 @@ static int ieee80211_stop_ap(struct wiph
+ 	link_conf->bssid_indicator = 0;
  
  	__sta_info_flush(sdata, true);
 -	ieee80211_free_keys(sdata, true);
  
- 	sdata->vif.bss_conf.enable_beacon = false;
+ 	link_conf->enable_beacon = false;
  	sdata->beacon_rate_set = false;
diff --git a/package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch b/package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
index ffd8807cccd192..f315ae5ca2baa2 100644
--- a/package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
+++ b/package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
@@ -1,3 +1,12 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 11 Dec 2014 00:00:00 +0100
+Subject: [PATCH] cfg80211: add support for changing the device mac address via
+ sysfs
+
+---
+ net/wireless/sysfs.c | 27 ++++++++++++++++++++++-----
+ 1 file changed, 22 insertions(+), 5 deletions(-)
+
 --- a/net/wireless/sysfs.c
 +++ b/net/wireless/sysfs.c
 @@ -24,18 +24,35 @@ static inline struct cfg80211_registered
diff --git a/package/kernel/mac80211/patches/subsys/210-ap_scan.patch b/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
index 0c06829ce486b3..10b842d9af39a6 100644
--- a/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
+++ b/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
@@ -1,11 +1,19 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 3 Oct 2012 00:00:00 +0200
+Subject: [PATCH] mac80211: allow scans in access point mode (for site survey)
+
+---
+ net/mac80211/cfg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2497,7 +2497,7 @@ static int ieee80211_scan(struct wiphy *
- 		 * the  frames sent while scanning on other channel will be
- 		 * lost)
+@@ -2727,6 +2727,8 @@ static int ieee80211_scan(struct wiphy *
  		 */
--		if (sdata->u.ap.beacon &&
-+		if (0 && sdata->u.ap.beacon &&
- 		    (!(wiphy->features & NL80211_FEATURE_AP_SCAN) ||
- 		     !(req->flags & NL80211_SCAN_FLAG_AP)))
- 			return -EOPNOTSUPP;
+ 		fallthrough;
+ 	case NL80211_IFTYPE_AP:
++		/* skip check */
++		break;
+ 		/*
+ 		 * If the scan has been forced (and the driver supports
+ 		 * forcing), don't care about being beaconing already.
diff --git a/package/kernel/mac80211/patches/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch b/package/kernel/mac80211/patches/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
index d09d70725e5516..63b21774719bf3 100644
--- a/package/kernel/mac80211/patches/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
+++ b/package/kernel/mac80211/patches/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
@@ -28,7 +28,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -357,6 +357,7 @@ struct sta_info *sta_info_alloc(struct i
+@@ -554,6 +554,7 @@ __sta_info_alloc(struct ieee80211_sub_if
  	INIT_WORK(&sta->drv_deliver_wk, sta_deliver_ps_frames);
  	INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
  	mutex_init(&sta->ampdu_mlme.mtx);
diff --git a/package/kernel/mac80211/patches/subsys/302-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch b/package/kernel/mac80211/patches/subsys/302-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch
new file mode 100644
index 00000000000000..0d475b73297d83
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/302-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch
@@ -0,0 +1,21 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 28 Apr 2021 21:03:13 +0200
+Subject: [PATCH] mac80211: minstrel_ht: fix MINSTREL_FRAC macro
+
+Add missing braces to avoid issues with e.g. using additions in the
+div expression
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.h
++++ b/net/mac80211/rc80211_minstrel_ht.h
+@@ -14,7 +14,7 @@
+ 
+ /* scaled fraction values */
+ #define MINSTREL_SCALE  12
+-#define MINSTREL_FRAC(val, div) (((val) << MINSTREL_SCALE) / div)
++#define MINSTREL_FRAC(val, div) (((val) << MINSTREL_SCALE) / (div))
+ #define MINSTREL_TRUNC(val) ((val) >> MINSTREL_SCALE)
+ 
+ #define EWMA_LEVEL	96	/* ewma weighting factor [/EWMA_DIV] */
diff --git a/package/kernel/mac80211/patches/subsys/303-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch b/package/kernel/mac80211/patches/subsys/303-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
new file mode 100644
index 00000000000000..f26477e8112f2e
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/303-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
@@ -0,0 +1,30 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 6 Feb 2021 16:08:01 +0100
+Subject: [PATCH] mac80211: minstrel_ht: reduce fluctuations in rate
+ probability stats
+
+In some scenarios when there is a lot of fluctuation in packet error rates,
+rate switching can be amplified when the statistics get skewed by time slots
+with very few tries.
+Make the input data to the moving average more smooth by adding the
+success/attempts count from the last stats window as well. This has the
+advantage of smoothing the data without introducing any extra lag to sampling
+rates.
+This significantly improves rate stability on a strong test link subjected to
+periodic noise bursts generated with a SDR
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -769,7 +769,8 @@ minstrel_ht_calc_rate_stats(struct minst
+ 	unsigned int cur_prob;
+ 
+ 	if (unlikely(mrs->attempts > 0)) {
+-		cur_prob = MINSTREL_FRAC(mrs->success, mrs->attempts);
++		cur_prob = MINSTREL_FRAC(mrs->success + mrs->last_success,
++					 mrs->attempts + mrs->last_attempts);
+ 		minstrel_filter_avg_add(&mrs->prob_avg,
+ 					&mrs->prob_avg_1, cur_prob);
+ 		mrs->att_hist += mrs->attempts;
diff --git a/package/kernel/mac80211/patches/subsys/304-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch b/package/kernel/mac80211/patches/subsys/304-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
new file mode 100644
index 00000000000000..9b3cc3a664ac4d
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/304-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
@@ -0,0 +1,151 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 6 Feb 2021 16:33:14 +0100
+Subject: [PATCH] mac80211: minstrel_ht: rework rate downgrade code and
+ max_prob rate selection
+
+The current fallback code for fast rate switching on potentially failing rates
+is triggering too often if there is some strong noise on the channel. This can
+lead to wild fluctuations in the rate selection.
+Additionally, switching down to max_prob_rate can create a significant gap down
+in throughput, especially when using only 2 spatial streams, because max_prob_rate
+is limited to using fewer streams than the max_tp rates.
+In order to improve throughput without reducing reliability too much, use the
+rate downgrade code for the max_prob_rate only, and allow the non-downgraded
+max_prob_rate to use as many spatial streams as the max_tp rates
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -580,6 +580,14 @@ minstrel_ht_set_best_prob_rate(struct mi
+ 	int cur_tp_avg, cur_group, cur_idx;
+ 	int max_gpr_group, max_gpr_idx;
+ 	int max_gpr_tp_avg, max_gpr_prob;
++	int min_dur;
++
++	min_dur = max(minstrel_get_duration(mi->max_tp_rate[0]),
++		      minstrel_get_duration(mi->max_tp_rate[1]));
++
++	/* make the rate at least 18% slower than max tp rates */
++	if (minstrel_get_duration(index) <= min_dur * 19 / 16)
++		return;
+ 
+ 	cur_group = MI_RATE_GROUP(index);
+ 	cur_idx = MI_RATE_IDX(index);
+@@ -601,11 +609,6 @@ minstrel_ht_set_best_prob_rate(struct mi
+ 	    !minstrel_ht_is_legacy_group(max_tp_group))
+ 		return;
+ 
+-	/* skip rates faster than max tp rate with lower prob */
+-	if (minstrel_get_duration(mi->max_tp_rate[0]) > minstrel_get_duration(index) &&
+-	    mrs->prob_avg < max_tp_prob)
+-		return;
+-
+ 	max_gpr_group = MI_RATE_GROUP(mg->max_group_prob_rate);
+ 	max_gpr_idx = MI_RATE_IDX(mg->max_group_prob_rate);
+ 	max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_avg;
+@@ -663,40 +666,6 @@ minstrel_ht_assign_best_tp_rates(struct
+ 
+ }
+ 
+-/*
+- * Try to increase robustness of max_prob rate by decrease number of
+- * streams if possible.
+- */
+-static inline void
+-minstrel_ht_prob_rate_reduce_streams(struct minstrel_ht_sta *mi)
+-{
+-	struct minstrel_mcs_group_data *mg;
+-	int tmp_max_streams, group, tmp_idx, tmp_prob;
+-	int tmp_tp = 0;
+-
+-	if (!mi->sta->deflink.ht_cap.ht_supported)
+-		return;
+-
+-	group = MI_RATE_GROUP(mi->max_tp_rate[0]);
+-	tmp_max_streams = minstrel_mcs_groups[group].streams;
+-	for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
+-		mg = &mi->groups[group];
+-		if (!mi->supported[group] || group == MINSTREL_CCK_GROUP)
+-			continue;
+-
+-		tmp_idx = MI_RATE_IDX(mg->max_group_prob_rate);
+-		tmp_prob = mi->groups[group].rates[tmp_idx].prob_avg;
+-
+-		if (tmp_tp < minstrel_ht_get_tp_avg(mi, group, tmp_idx, tmp_prob) &&
+-		   (minstrel_mcs_groups[group].streams < tmp_max_streams)) {
+-				mi->max_prob_rate = mg->max_group_prob_rate;
+-				tmp_tp = minstrel_ht_get_tp_avg(mi, group,
+-								tmp_idx,
+-								tmp_prob);
+-		}
+-	}
+-}
+-
+ static u16
+ __minstrel_ht_get_sample_rate(struct minstrel_ht_sta *mi,
+ 			      enum minstrel_sample_type type)
+@@ -1176,8 +1145,6 @@ minstrel_ht_update_stats(struct minstrel
+ 
+ 	mi->max_prob_rate = tmp_max_prob_rate;
+ 
+-	/* Try to increase robustness of max_prob_rate*/
+-	minstrel_ht_prob_rate_reduce_streams(mi);
+ 	minstrel_ht_refill_sample_rates(mi);
+ 
+ #ifdef CPTCFG_MAC80211_DEBUGFS
+@@ -1256,7 +1223,7 @@ minstrel_ht_ri_txstat_valid(struct minst
+ }
+ 
+ static void
+-minstrel_downgrade_rate(struct minstrel_ht_sta *mi, u16 *idx, bool primary)
++minstrel_downgrade_prob_rate(struct minstrel_ht_sta *mi, u16 *idx)
+ {
+ 	int group, orig_group;
+ 
+@@ -1271,11 +1238,7 @@ minstrel_downgrade_rate(struct minstrel_
+ 		    minstrel_mcs_groups[orig_group].streams)
+ 			continue;
+ 
+-		if (primary)
+-			*idx = mi->groups[group].max_group_tp_rate[0];
+-		else
+-			*idx = mi->groups[group].max_group_tp_rate[1];
+-		break;
++		*idx = mi->groups[group].max_group_prob_rate;
+ 	}
+ }
+ 
+@@ -1286,7 +1249,7 @@ minstrel_ht_tx_status(void *priv, struct
+ 	struct ieee80211_tx_info *info = st->info;
+ 	struct minstrel_ht_sta *mi = priv_sta;
+ 	struct ieee80211_tx_rate *ar = info->status.rates;
+-	struct minstrel_rate_stats *rate, *rate2;
++	struct minstrel_rate_stats *rate;
+ 	struct minstrel_priv *mp = priv;
+ 	u32 update_interval = mp->update_interval;
+ 	bool last, update = false;
+@@ -1354,18 +1317,13 @@ minstrel_ht_tx_status(void *priv, struct
+ 		/*
+ 		 * check for sudden death of spatial multiplexing,
+ 		 * downgrade to a lower number of streams if necessary.
++		 * only do this for the max_prob_rate to prevent spurious
++		 * rate fluctuations when the link changes suddenly
+ 		 */
+-		rate = minstrel_get_ratestats(mi, mi->max_tp_rate[0]);
++		rate = minstrel_get_ratestats(mi, mi->max_prob_rate);
+ 		if (rate->attempts > 30 &&
+ 		    rate->success < rate->attempts / 4) {
+-			minstrel_downgrade_rate(mi, &mi->max_tp_rate[0], true);
+-			update = true;
+-		}
+-
+-		rate2 = minstrel_get_ratestats(mi, mi->max_tp_rate[1]);
+-		if (rate2->attempts > 30 &&
+-		    rate2->success < rate2->attempts / 4) {
+-			minstrel_downgrade_rate(mi, &mi->max_tp_rate[1], false);
++			minstrel_downgrade_prob_rate(mi, &mi->max_prob_rate);
+ 			update = true;
+ 		}
+ 	}
diff --git a/package/kernel/mac80211/patches/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch b/package/kernel/mac80211/patches/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch
new file mode 100644
index 00000000000000..0ac972955f0210
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch
@@ -0,0 +1,53 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 26 Jun 2022 11:43:25 +0200
+Subject: [PATCH] mac80211: increase quantum for airtime scheduler
+
+Given the typical AQL budget and queue length, a quantum of 256 with the
+default station weight often requires iterating over all queues frequently,
+until one of them becomes eligible.
+Improve performance by using 8 times station weight as scheduler quantum
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -90,6 +90,8 @@ extern const u8 ieee80211_ac_to_qos_mask
+  */
+ #define AIRTIME_ACTIVE_DURATION (HZ / 10)
+ 
++#define AIRTIME_QUANTUM_SHIFT	3
++
+ struct ieee80211_bss {
+ 	u32 device_ts_beacon, device_ts_presp;
+ 
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3984,7 +3984,7 @@ struct ieee80211_txq *ieee80211_next_txq
+ 
+ 		if (deficit < 0)
+ 			sta->airtime[txqi->txq.ac].deficit +=
+-				sta->airtime_weight;
++				sta->airtime_weight << AIRTIME_QUANTUM_SHIFT;
+ 
+ 		if (deficit < 0 || !aql_check) {
+ 			list_move_tail(&txqi->schedule_order,
+@@ -4127,7 +4127,8 @@ bool ieee80211_txq_may_transmit(struct i
+ 		}
+ 		sta = container_of(iter->txq.sta, struct sta_info, sta);
+ 		if (ieee80211_sta_deficit(sta, ac) < 0)
+-			sta->airtime[ac].deficit += sta->airtime_weight;
++			sta->airtime[ac].deficit += sta->airtime_weight <<
++						    AIRTIME_QUANTUM_SHIFT;
+ 		list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
+ 	}
+ 
+@@ -4135,7 +4136,7 @@ bool ieee80211_txq_may_transmit(struct i
+ 	if (sta->airtime[ac].deficit >= 0)
+ 		goto out;
+ 
+-	sta->airtime[ac].deficit += sta->airtime_weight;
++	sta->airtime[ac].deficit += sta->airtime_weight << AIRTIME_QUANTUM_SHIFT;
+ 	list_move_tail(&txqi->schedule_order, &local->active_txqs[ac]);
+ 	spin_unlock_bh(&local->active_txq_lock[ac]);
+ 
diff --git a/package/kernel/mac80211/patches/subsys/306-01-v6.2-wifi-mac80211-add-internal-handler-for-wake_tx_queue.patch b/package/kernel/mac80211/patches/subsys/306-01-v6.2-wifi-mac80211-add-internal-handler-for-wake_tx_queue.patch
new file mode 100644
index 00000000000000..d14ba05e695c8f
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/306-01-v6.2-wifi-mac80211-add-internal-handler-for-wake_tx_queue.patch
@@ -0,0 +1,183 @@
+From: Alexander Wetzel <alexander@wetzel-home.de>
+Date: Sun, 9 Oct 2022 18:30:38 +0200
+Subject: [PATCH] wifi: mac80211: add internal handler for wake_tx_queue
+
+Start to align the TX handling to only use internal TX queues (iTXQs):
+
+Provide a handler for drivers not having a custom wake_tx_queue
+callback and update the documentation.
+
+Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -89,15 +89,13 @@
+ /**
+  * DOC: mac80211 software tx queueing
+  *
+- * mac80211 provides an optional intermediate queueing implementation designed
+- * to allow the driver to keep hardware queues short and provide some fairness
+- * between different stations/interfaces.
+- * In this model, the driver pulls data frames from the mac80211 queue instead
+- * of letting mac80211 push them via drv_tx().
+- * Other frames (e.g. control or management) are still pushed using drv_tx().
++ * mac80211 uses an intermediate queueing implementation, designed to allow the
++ * driver to keep hardware queues short and to provide some fairness between
++ * different stations/interfaces.
+  *
+- * Drivers indicate that they use this model by implementing the .wake_tx_queue
+- * driver operation.
++ * Drivers must provide the .wake_tx_queue driver operation by either
++ * linking it to ieee80211_handle_wake_tx_queue() or implementing a custom
++ * handler.
+  *
+  * Intermediate queues (struct ieee80211_txq) are kept per-sta per-tid, with
+  * another per-sta for non-data/non-mgmt and bufferable management frames, and
+@@ -106,9 +104,12 @@
+  * The driver is expected to initialize its private per-queue data for stations
+  * and interfaces in the .add_interface and .sta_add ops.
+  *
+- * The driver can't access the queue directly. To dequeue a frame from a
+- * txq, it calls ieee80211_tx_dequeue(). Whenever mac80211 adds a new frame to a
+- * queue, it calls the .wake_tx_queue driver op.
++ * The driver can't access the internal TX queues (iTXQs) directly.
++ * Whenever mac80211 adds a new frame to a queue, it calls the .wake_tx_queue
++ * driver op.
++ * Drivers implementing a custom .wake_tx_queue op can get them by calling
++ * ieee80211_tx_dequeue(). Drivers using ieee80211_handle_wake_tx_queue() will
++ * simply get the individual frames pushed via the .tx driver operation.
+  *
+  * Drivers can optionally delegate responsibility for scheduling queues to
+  * mac80211, to take advantage of airtime fairness accounting. In this case, to
+@@ -2248,8 +2249,8 @@ struct ieee80211_link_sta {
+  *	For non MLO STA it will point to the deflink data. For MLO STA
+  *	ieee80211_sta_recalc_aggregates() must be called to update it.
+  * @support_p2p_ps: indicates whether the STA supports P2P PS mechanism or not.
+- * @txq: per-TID data TX queues (if driver uses the TXQ abstraction); note that
+- *	the last entry (%IEEE80211_NUM_TIDS) is used for non-data frames
++ * @txq: per-TID data TX queues; note that the last entry (%IEEE80211_NUM_TIDS)
++ *	is used for non-data frames
+  * @deflink: This holds the default link STA information, for non MLO STA all link
+  *	specific STA information is accessed through @deflink or through
+  *	link[0] which points to address of @deflink. For MLO Link STA
+@@ -5687,7 +5688,7 @@ void ieee80211_key_replay(struct ieee802
+  * @hw: pointer as obtained from ieee80211_alloc_hw().
+  * @queue: queue number (counted from zero).
+  *
+- * Drivers should use this function instead of netif_wake_queue.
++ * Drivers must use this function instead of netif_wake_queue.
+  */
+ void ieee80211_wake_queue(struct ieee80211_hw *hw, int queue);
+ 
+@@ -5696,7 +5697,7 @@ void ieee80211_wake_queue(struct ieee802
+  * @hw: pointer as obtained from ieee80211_alloc_hw().
+  * @queue: queue number (counted from zero).
+  *
+- * Drivers should use this function instead of netif_stop_queue.
++ * Drivers must use this function instead of netif_stop_queue.
+  */
+ void ieee80211_stop_queue(struct ieee80211_hw *hw, int queue);
+ 
+@@ -5705,7 +5706,7 @@ void ieee80211_stop_queue(struct ieee802
+  * @hw: pointer as obtained from ieee80211_alloc_hw().
+  * @queue: queue number (counted from zero).
+  *
+- * Drivers should use this function instead of netif_stop_queue.
++ * Drivers must use this function instead of netif_queue_stopped.
+  *
+  * Return: %true if the queue is stopped. %false otherwise.
+  */
+@@ -5716,7 +5717,7 @@ int ieee80211_queue_stopped(struct ieee8
+  * ieee80211_stop_queues - stop all queues
+  * @hw: pointer as obtained from ieee80211_alloc_hw().
+  *
+- * Drivers should use this function instead of netif_stop_queue.
++ * Drivers must use this function instead of netif_tx_stop_all_queues.
+  */
+ void ieee80211_stop_queues(struct ieee80211_hw *hw);
+ 
+@@ -5724,7 +5725,7 @@ void ieee80211_stop_queues(struct ieee80
+  * ieee80211_wake_queues - wake all queues
+  * @hw: pointer as obtained from ieee80211_alloc_hw().
+  *
+- * Drivers should use this function instead of netif_wake_queue.
++ * Drivers must use this function instead of netif_tx_wake_all_queues.
+  */
+ void ieee80211_wake_queues(struct ieee80211_hw *hw);
+ 
+@@ -6946,6 +6947,18 @@ static inline struct sk_buff *ieee80211_
+ }
+ 
+ /**
++ * ieee80211_handle_wake_tx_queue - mac80211 handler for wake_tx_queue callback
++ *
++ * @hw: pointer as obtained from wake_tx_queue() callback().
++ * @txq: pointer as obtained from wake_tx_queue() callback().
++ *
++ * Drivers can use this function for the mandatory mac80211 wake_tx_queue
++ * callback in struct ieee80211_ops. They should not call this function.
++ */
++void ieee80211_handle_wake_tx_queue(struct ieee80211_hw *hw,
++				    struct ieee80211_txq *txq);
++
++/**
+  * ieee80211_next_txq - get next tx queue to pull packets from
+  *
+  * @hw: pointer as obtained from ieee80211_alloc_hw()
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -288,6 +288,52 @@ __le16 ieee80211_ctstoself_duration(stru
+ }
+ EXPORT_SYMBOL(ieee80211_ctstoself_duration);
+ 
++static void wake_tx_push_queue(struct ieee80211_local *local,
++			       struct ieee80211_sub_if_data *sdata,
++			       struct ieee80211_txq *queue)
++{
++	int q = sdata->vif.hw_queue[queue->ac];
++	struct ieee80211_tx_control control = {
++		.sta = queue->sta,
++	};
++	struct sk_buff *skb;
++	unsigned long flags;
++	bool q_stopped;
++
++	while (1) {
++		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
++		q_stopped = local->queue_stop_reasons[q];
++		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
++
++		if (q_stopped)
++			break;
++
++		skb = ieee80211_tx_dequeue(&local->hw, queue);
++		if (!skb)
++			break;
++
++		drv_tx(local, &control, skb);
++	}
++}
++
++/* wake_tx_queue handler for driver not implementing a custom one*/
++void ieee80211_handle_wake_tx_queue(struct ieee80211_hw *hw,
++				    struct ieee80211_txq *txq)
++{
++	struct ieee80211_local *local = hw_to_local(hw);
++	struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->vif);
++	struct ieee80211_txq *queue;
++
++	/* Use ieee80211_next_txq() for airtime fairness accounting */
++	ieee80211_txq_schedule_start(hw, txq->ac);
++	while ((queue = ieee80211_next_txq(hw, txq->ac))) {
++		wake_tx_push_queue(local, sdata, queue);
++		ieee80211_return_txq(hw, queue, false);
++	}
++	ieee80211_txq_schedule_end(hw, txq->ac);
++}
++EXPORT_SYMBOL(ieee80211_handle_wake_tx_queue);
++
+ static void __ieee80211_wake_txqs(struct ieee80211_sub_if_data *sdata, int ac)
+ {
+ 	struct ieee80211_local *local = sdata->local;
diff --git a/package/kernel/mac80211/patches/subsys/306-02-v6.2-wifi-mac80211-add-wake_tx_queue-callback-to-drivers.patch b/package/kernel/mac80211/patches/subsys/306-02-v6.2-wifi-mac80211-add-wake_tx_queue-callback-to-drivers.patch
new file mode 100644
index 00000000000000..fee038d90c5c72
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/306-02-v6.2-wifi-mac80211-add-wake_tx_queue-callback-to-drivers.patch
@@ -0,0 +1,396 @@
+From: Alexander Wetzel <alexander@wetzel-home.de>
+Date: Sun, 9 Oct 2022 18:30:39 +0200
+Subject: [PATCH] wifi: mac80211: add wake_tx_queue callback to drivers
+
+mac80211 is fully switching over to the internal TX queue (iTXQ)
+implementation. Update all drivers not yet providing the now mandatory
+wake_tx_queue() callback.
+
+As an side effect the netdev interfaces of all updated drivers will
+switch to the noqueue qdisc.
+
+Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
+[add staging drivers]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/drivers/net/wireless/admtek/adm8211.c
++++ b/drivers/net/wireless/admtek/adm8211.c
+@@ -1760,6 +1760,7 @@ static int adm8211_alloc_rings(struct ie
+ 
+ static const struct ieee80211_ops adm8211_ops = {
+ 	.tx			= adm8211_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= adm8211_start,
+ 	.stop			= adm8211_stop,
+ 	.add_interface		= adm8211_add_interface,
+--- a/drivers/net/wireless/ath/ar5523/ar5523.c
++++ b/drivers/net/wireless/ath/ar5523/ar5523.c
+@@ -1361,6 +1361,7 @@ static const struct ieee80211_ops ar5523
+ 	.start			= ar5523_start,
+ 	.stop			= ar5523_stop,
+ 	.tx			= ar5523_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.set_rts_threshold	= ar5523_set_rts_threshold,
+ 	.add_interface		= ar5523_add_interface,
+ 	.remove_interface	= ar5523_remove_interface,
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -8587,6 +8587,7 @@ err_fallback:
+ 
+ static const struct ieee80211_ops ath11k_ops = {
+ 	.tx				= ath11k_mac_op_tx,
++	.wake_tx_queue			= ieee80211_handle_wake_tx_queue,
+ 	.start                          = ath11k_mac_op_start,
+ 	.stop                           = ath11k_mac_op_stop,
+ 	.reconfig_complete              = ath11k_mac_op_reconfig_complete,
+--- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c
++++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
+@@ -781,6 +781,7 @@ static int ath5k_set_ringparam(struct ie
+ 
+ const struct ieee80211_ops ath5k_hw_ops = {
+ 	.tx			= ath5k_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= ath5k_start,
+ 	.stop			= ath5k_stop,
+ 	.add_interface		= ath5k_add_interface,
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+@@ -1870,6 +1870,7 @@ static void ath9k_htc_channel_switch_bea
+ 
+ struct ieee80211_ops ath9k_htc_ops = {
+ 	.tx                 = ath9k_htc_tx,
++	.wake_tx_queue      = ieee80211_handle_wake_tx_queue,
+ 	.start              = ath9k_htc_start,
+ 	.stop               = ath9k_htc_stop,
+ 	.add_interface      = ath9k_htc_add_interface,
+--- a/drivers/net/wireless/ath/carl9170/main.c
++++ b/drivers/net/wireless/ath/carl9170/main.c
+@@ -1715,6 +1715,7 @@ static const struct ieee80211_ops carl91
+ 	.start			= carl9170_op_start,
+ 	.stop			= carl9170_op_stop,
+ 	.tx			= carl9170_op_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.flush			= carl9170_op_flush,
+ 	.add_interface		= carl9170_op_add_interface,
+ 	.remove_interface	= carl9170_op_remove_interface,
+--- a/drivers/net/wireless/ath/wcn36xx/main.c
++++ b/drivers/net/wireless/ath/wcn36xx/main.c
+@@ -1362,6 +1362,7 @@ static const struct ieee80211_ops wcn36x
+ 	.prepare_multicast	= wcn36xx_prepare_multicast,
+ 	.configure_filter       = wcn36xx_configure_filter,
+ 	.tx			= wcn36xx_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.set_key		= wcn36xx_set_key,
+ 	.hw_scan		= wcn36xx_hw_scan,
+ 	.cancel_hw_scan		= wcn36xx_cancel_hw_scan,
+--- a/drivers/net/wireless/atmel/at76c50x-usb.c
++++ b/drivers/net/wireless/atmel/at76c50x-usb.c
+@@ -2187,6 +2187,7 @@ static int at76_set_key(struct ieee80211
+ 
+ static const struct ieee80211_ops at76_ops = {
+ 	.tx = at76_mac80211_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.add_interface = at76_add_interface,
+ 	.remove_interface = at76_remove_interface,
+ 	.config = at76_config,
+--- a/drivers/net/wireless/broadcom/b43/main.c
++++ b/drivers/net/wireless/broadcom/b43/main.c
+@@ -5171,6 +5171,7 @@ static int b43_op_get_survey(struct ieee
+ 
+ static const struct ieee80211_ops b43_hw_ops = {
+ 	.tx			= b43_op_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.conf_tx		= b43_op_conf_tx,
+ 	.add_interface		= b43_op_add_interface,
+ 	.remove_interface	= b43_op_remove_interface,
+--- a/drivers/net/wireless/broadcom/b43legacy/main.c
++++ b/drivers/net/wireless/broadcom/b43legacy/main.c
+@@ -3532,6 +3532,7 @@ static int b43legacy_op_get_survey(struc
+ 
+ static const struct ieee80211_ops b43legacy_hw_ops = {
+ 	.tx			= b43legacy_op_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.conf_tx		= b43legacy_op_conf_tx,
+ 	.add_interface		= b43legacy_op_add_interface,
+ 	.remove_interface	= b43legacy_op_remove_interface,
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
+@@ -962,6 +962,7 @@ static int brcms_ops_beacon_set_tim(stru
+ 
+ static const struct ieee80211_ops brcms_ops = {
+ 	.tx = brcms_ops_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.start = brcms_ops_start,
+ 	.stop = brcms_ops_stop,
+ 	.add_interface = brcms_ops_add_interface,
+--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+@@ -3439,6 +3439,7 @@ static const struct attribute_group il39
+ 
+ static struct ieee80211_ops il3945_mac_ops __ro_after_init = {
+ 	.tx = il3945_mac_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.start = il3945_mac_start,
+ 	.stop = il3945_mac_stop,
+ 	.add_interface = il_mac_add_interface,
+--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+@@ -6308,6 +6308,7 @@ il4965_tx_queue_set_status(struct il_pri
+ 
+ static const struct ieee80211_ops il4965_mac_ops = {
+ 	.tx = il4965_mac_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.start = il4965_mac_start,
+ 	.stop = il4965_mac_stop,
+ 	.add_interface = il_mac_add_interface,
+--- a/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c
+@@ -1571,6 +1571,7 @@ static void iwlagn_mac_sta_notify(struct
+ 
+ const struct ieee80211_ops iwlagn_hw_ops = {
+ 	.tx = iwlagn_mac_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.start = iwlagn_mac_start,
+ 	.stop = iwlagn_mac_stop,
+ #ifdef CONFIG_PM_SLEEP
+--- a/drivers/net/wireless/intersil/p54/main.c
++++ b/drivers/net/wireless/intersil/p54/main.c
+@@ -705,6 +705,7 @@ static void p54_set_coverage_class(struc
+ 
+ static const struct ieee80211_ops p54_ops = {
+ 	.tx			= p54_tx_80211,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= p54_start,
+ 	.stop			= p54_stop,
+ 	.add_interface		= p54_add_interface,
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3109,6 +3109,7 @@ static int mac80211_hwsim_change_sta_lin
+ 
+ #define HWSIM_COMMON_OPS					\
+ 	.tx = mac80211_hwsim_tx,				\
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,	\
+ 	.start = mac80211_hwsim_start,				\
+ 	.stop = mac80211_hwsim_stop,				\
+ 	.add_interface = mac80211_hwsim_add_interface,		\
+--- a/drivers/net/wireless/marvell/libertas_tf/main.c
++++ b/drivers/net/wireless/marvell/libertas_tf/main.c
+@@ -474,6 +474,7 @@ static int lbtf_op_get_survey(struct iee
+ 
+ static const struct ieee80211_ops lbtf_ops = {
+ 	.tx			= lbtf_op_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= lbtf_op_start,
+ 	.stop			= lbtf_op_stop,
+ 	.add_interface		= lbtf_op_add_interface,
+--- a/drivers/net/wireless/marvell/mwl8k.c
++++ b/drivers/net/wireless/marvell/mwl8k.c
+@@ -5611,6 +5611,7 @@ static void mwl8k_sw_scan_complete(struc
+ 
+ static const struct ieee80211_ops mwl8k_ops = {
+ 	.tx			= mwl8k_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= mwl8k_start,
+ 	.stop			= mwl8k_stop,
+ 	.add_interface		= mwl8k_add_interface,
+--- a/drivers/net/wireless/mediatek/mt7601u/main.c
++++ b/drivers/net/wireless/mediatek/mt7601u/main.c
+@@ -406,6 +406,7 @@ out:
+ 
+ const struct ieee80211_ops mt7601u_ops = {
+ 	.tx = mt7601u_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.start = mt7601u_start,
+ 	.stop = mt7601u_stop,
+ 	.add_interface = mt7601u_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2400pci.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2400pci.c
+@@ -1706,6 +1706,7 @@ static int rt2400pci_tx_last_beacon(stru
+ 
+ static const struct ieee80211_ops rt2400pci_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2500pci.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2500pci.c
+@@ -2004,6 +2004,7 @@ static int rt2500pci_tx_last_beacon(stru
+ 
+ static const struct ieee80211_ops rt2500pci_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2500usb.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2500usb.c
+@@ -1795,6 +1795,7 @@ static int rt2500usb_probe_hw(struct rt2
+ 
+ static const struct ieee80211_ops rt2500usb_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
+@@ -288,6 +288,7 @@ static int rt2800pci_read_eeprom(struct
+ 
+ static const struct ieee80211_ops rt2800pci_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
+@@ -133,6 +133,7 @@ static int rt2800soc_write_firmware(stru
+ 
+ static const struct ieee80211_ops rt2800soc_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
+@@ -630,6 +630,7 @@ static int rt2800usb_probe_hw(struct rt2
+ 
+ static const struct ieee80211_ops rt2800usb_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt61pci.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt61pci.c
+@@ -2873,6 +2873,7 @@ static u64 rt61pci_get_tsf(struct ieee80
+ 
+ static const struct ieee80211_ops rt61pci_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt73usb.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt73usb.c
+@@ -2292,6 +2292,7 @@ static u64 rt73usb_get_tsf(struct ieee80
+ 
+ static const struct ieee80211_ops rt73usb_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
++++ b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
+@@ -1608,6 +1608,7 @@ static void rtl8180_configure_filter(str
+ 
+ static const struct ieee80211_ops rtl8180_ops = {
+ 	.tx			= rtl8180_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rtl8180_start,
+ 	.stop			= rtl8180_stop,
+ 	.add_interface		= rtl8180_add_interface,
+--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
+@@ -1378,6 +1378,7 @@ static int rtl8187_conf_tx(struct ieee80
+ 
+ static const struct ieee80211_ops rtl8187_ops = {
+ 	.tx			= rtl8187_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rtl8187_start,
+ 	.stop			= rtl8187_stop,
+ 	.add_interface		= rtl8187_add_interface,
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -6548,6 +6548,7 @@ static void rtl8xxxu_stop(struct ieee802
+ 
+ static const struct ieee80211_ops rtl8xxxu_ops = {
+ 	.tx = rtl8xxxu_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.add_interface = rtl8xxxu_add_interface,
+ 	.remove_interface = rtl8xxxu_remove_interface,
+ 	.config = rtl8xxxu_config,
+--- a/drivers/net/wireless/realtek/rtlwifi/core.c
++++ b/drivers/net/wireless/realtek/rtlwifi/core.c
+@@ -1912,6 +1912,7 @@ const struct ieee80211_ops rtl_ops = {
+ 	.start = rtl_op_start,
+ 	.stop = rtl_op_stop,
+ 	.tx = rtl_op_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.add_interface = rtl_op_add_interface,
+ 	.remove_interface = rtl_op_remove_interface,
+ 	.change_interface = rtl_op_change_interface,
+--- a/drivers/net/wireless/realtek/rtw88/mac80211.c
++++ b/drivers/net/wireless/realtek/rtw88/mac80211.c
+@@ -896,6 +896,7 @@ static void rtw_ops_sta_rc_update(struct
+ 
+ const struct ieee80211_ops rtw_ops = {
+ 	.tx			= rtw_ops_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.wake_tx_queue		= rtw_ops_wake_tx_queue,
+ 	.start			= rtw_ops_start,
+ 	.stop			= rtw_ops_stop,
+--- a/drivers/net/wireless/realtek/rtw89/mac80211.c
++++ b/drivers/net/wireless/realtek/rtw89/mac80211.c
+@@ -918,6 +918,7 @@ static int rtw89_ops_set_tid_config(stru
+ 
+ const struct ieee80211_ops rtw89_ops = {
+ 	.tx			= rtw89_ops_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.wake_tx_queue		= rtw89_ops_wake_tx_queue,
+ 	.start			= rtw89_ops_start,
+ 	.stop			= rtw89_ops_stop,
+--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
++++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+@@ -1958,6 +1958,7 @@ static int rsi_mac80211_resume(struct ie
+ 
+ static const struct ieee80211_ops mac80211_ops = {
+ 	.tx = rsi_mac80211_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.start = rsi_mac80211_start,
+ 	.stop = rsi_mac80211_stop,
+ 	.add_interface = rsi_mac80211_add_interface,
+--- a/drivers/net/wireless/st/cw1200/main.c
++++ b/drivers/net/wireless/st/cw1200/main.c
+@@ -209,6 +209,7 @@ static const struct ieee80211_ops cw1200
+ 	.remove_interface	= cw1200_remove_interface,
+ 	.change_interface	= cw1200_change_interface,
+ 	.tx			= cw1200_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.hw_scan		= cw1200_hw_scan,
+ 	.set_tim		= cw1200_set_tim,
+ 	.sta_notify		= cw1200_sta_notify,
+--- a/drivers/net/wireless/ti/wl1251/main.c
++++ b/drivers/net/wireless/ti/wl1251/main.c
+@@ -1359,6 +1359,7 @@ static const struct ieee80211_ops wl1251
+ 	.prepare_multicast = wl1251_op_prepare_multicast,
+ 	.configure_filter = wl1251_op_configure_filter,
+ 	.tx = wl1251_op_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.set_key = wl1251_op_set_key,
+ 	.hw_scan = wl1251_op_hw_scan,
+ 	.bss_info_changed = wl1251_op_bss_info_changed,
+--- a/drivers/net/wireless/ti/wlcore/main.c
++++ b/drivers/net/wireless/ti/wlcore/main.c
+@@ -5942,6 +5942,7 @@ static const struct ieee80211_ops wl1271
+ 	.prepare_multicast = wl1271_op_prepare_multicast,
+ 	.configure_filter = wl1271_op_configure_filter,
+ 	.tx = wl1271_op_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.set_key = wlcore_op_set_key,
+ 	.hw_scan = wl1271_op_hw_scan,
+ 	.cancel_hw_scan = wl1271_op_cancel_hw_scan,
+--- a/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
++++ b/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
+@@ -1344,6 +1344,7 @@ static u64 zd_op_get_tsf(struct ieee8021
+ 
+ static const struct ieee80211_ops zd_ops = {
+ 	.tx			= zd_op_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= zd_op_start,
+ 	.stop			= zd_op_stop,
+ 	.add_interface		= zd_op_add_interface,
diff --git a/package/kernel/mac80211/patches/subsys/306-03-v6.2-wifi-mac80211-Drop-support-for-TX-push-path.patch b/package/kernel/mac80211/patches/subsys/306-03-v6.2-wifi-mac80211-Drop-support-for-TX-push-path.patch
new file mode 100644
index 00000000000000..f9f9977cee5ef0
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/306-03-v6.2-wifi-mac80211-Drop-support-for-TX-push-path.patch
@@ -0,0 +1,683 @@
+From: Alexander Wetzel <alexander@wetzel-home.de>
+Date: Sun, 9 Oct 2022 18:30:40 +0200
+Subject: [PATCH] wifi: mac80211: Drop support for TX push path
+
+All drivers are now using mac80211 internal queues (iTXQs).
+Drop mac80211 internal support for the old push path.
+
+Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -4346,9 +4346,6 @@ static int ieee80211_get_txq_stats(struc
+ 	struct ieee80211_sub_if_data *sdata;
+ 	int ret = 0;
+ 
+-	if (!local->ops->wake_tx_queue)
+-		return 1;
+-
+ 	spin_lock_bh(&local->fq.lock);
+ 	rcu_read_lock();
+ 
+--- a/net/mac80211/debugfs.c
++++ b/net/mac80211/debugfs.c
+@@ -663,9 +663,7 @@ void debugfs_hw_add(struct ieee80211_loc
+ 	DEBUGFS_ADD_MODE(force_tx_status, 0600);
+ 	DEBUGFS_ADD_MODE(aql_enable, 0600);
+ 	DEBUGFS_ADD(aql_pending);
+-
+-	if (local->ops->wake_tx_queue)
+-		DEBUGFS_ADD_MODE(aqm, 0600);
++	DEBUGFS_ADD_MODE(aqm, 0600);
+ 
+ 	DEBUGFS_ADD_MODE(airtime_flags, 0600);
+ 
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -677,8 +677,7 @@ static void add_common_files(struct ieee
+ 	DEBUGFS_ADD(rc_rateidx_vht_mcs_mask_5ghz);
+ 	DEBUGFS_ADD(hw_queues);
+ 
+-	if (sdata->local->ops->wake_tx_queue &&
+-	    sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
++	if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
+ 	    sdata->vif.type != NL80211_IFTYPE_NAN)
+ 		DEBUGFS_ADD(aqm);
+ }
+--- a/net/mac80211/debugfs_sta.c
++++ b/net/mac80211/debugfs_sta.c
+@@ -1057,10 +1057,8 @@ void ieee80211_sta_debugfs_add(struct st
+ 	DEBUGFS_ADD_COUNTER(rx_fragments, deflink.rx_stats.fragments);
+ 	DEBUGFS_ADD_COUNTER(tx_filtered, deflink.status_stats.filtered);
+ 
+-	if (local->ops->wake_tx_queue) {
+-		DEBUGFS_ADD(aqm);
+-		DEBUGFS_ADD(airtime);
+-	}
++	DEBUGFS_ADD(aqm);
++	DEBUGFS_ADD(airtime);
+ 
+ 	if (wiphy_ext_feature_isset(local->hw.wiphy,
+ 				    NL80211_EXT_FEATURE_AQL))
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -2294,7 +2294,6 @@ void ieee80211_wake_queue_by_reason(stru
+ void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
+ 				    enum queue_stop_reason reason,
+ 				    bool refcounted);
+-void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue);
+ void ieee80211_add_pending_skb(struct ieee80211_local *local,
+ 			       struct sk_buff *skb);
+ void ieee80211_add_pending_skbs(struct ieee80211_local *local,
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -460,12 +460,6 @@ static void ieee80211_do_stop(struct iee
+ 	if (cancel_scan)
+ 		ieee80211_scan_cancel(local);
+ 
+-	/*
+-	 * Stop TX on this interface first.
+-	 */
+-	if (!local->ops->wake_tx_queue && sdata->dev)
+-		netif_tx_stop_all_queues(sdata->dev);
+-
+ 	ieee80211_roc_purge(local, sdata);
+ 
+ 	switch (sdata->vif.type) {
+@@ -813,13 +807,6 @@ static void ieee80211_uninit(struct net_
+ 	ieee80211_teardown_sdata(IEEE80211_DEV_TO_SUB_IF(dev));
+ }
+ 
+-static u16 ieee80211_netdev_select_queue(struct net_device *dev,
+-					 struct sk_buff *skb,
+-					 struct net_device *sb_dev)
+-{
+-	return ieee80211_select_queue(IEEE80211_DEV_TO_SUB_IF(dev), skb);
+-}
+-
+ static void
+ ieee80211_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
+ {
+@@ -833,7 +820,6 @@ static const struct net_device_ops ieee8
+ 	.ndo_start_xmit		= ieee80211_subif_start_xmit,
+ 	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
+ 	.ndo_set_mac_address 	= ieee80211_change_mac,
+-	.ndo_select_queue	= ieee80211_netdev_select_queue,
+ 	.ndo_get_stats64	= ieee80211_get_stats64,
+ };
+ 
+@@ -941,7 +927,6 @@ static const struct net_device_ops ieee8
+ 	.ndo_start_xmit		= ieee80211_subif_start_xmit_8023,
+ 	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
+ 	.ndo_set_mac_address	= ieee80211_change_mac,
+-	.ndo_select_queue	= ieee80211_netdev_select_queue,
+ 	.ndo_get_stats64	= ieee80211_get_stats64,
+ 	.ndo_fill_forward_path	= ieee80211_netdev_fill_forward_path,
+ };
+@@ -1443,35 +1428,6 @@ int ieee80211_do_open(struct wireless_de
+ 
+ 	ieee80211_recalc_ps(local);
+ 
+-	if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
+-	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+-	    local->ops->wake_tx_queue) {
+-		/* XXX: for AP_VLAN, actually track AP queues */
+-		if (dev)
+-			netif_tx_start_all_queues(dev);
+-	} else if (dev) {
+-		unsigned long flags;
+-		int n_acs = IEEE80211_NUM_ACS;
+-		int ac;
+-
+-		if (local->hw.queues < IEEE80211_NUM_ACS)
+-			n_acs = 1;
+-
+-		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+-		if (sdata->vif.cab_queue == IEEE80211_INVAL_HW_QUEUE ||
+-		    (local->queue_stop_reasons[sdata->vif.cab_queue] == 0 &&
+-		     skb_queue_empty(&local->pending[sdata->vif.cab_queue]))) {
+-			for (ac = 0; ac < n_acs; ac++) {
+-				int ac_queue = sdata->vif.hw_queue[ac];
+-
+-				if (local->queue_stop_reasons[ac_queue] == 0 &&
+-				    skb_queue_empty(&local->pending[ac_queue]))
+-					netif_start_subqueue(dev, ac);
+-			}
+-		}
+-		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+-	}
+-
+ 	set_bit(SDATA_STATE_RUNNING, &sdata->state);
+ 
+ 	return 0;
+@@ -1501,17 +1457,12 @@ static void ieee80211_if_setup(struct ne
+ {
+ 	ether_setup(dev);
+ 	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
++	dev->priv_flags |= IFF_NO_QUEUE;
+ 	dev->netdev_ops = &ieee80211_dataif_ops;
+ 	dev->needs_free_netdev = true;
+ 	dev->priv_destructor = ieee80211_if_free;
+ }
+ 
+-static void ieee80211_if_setup_no_queue(struct net_device *dev)
+-{
+-	ieee80211_if_setup(dev);
+-	dev->priv_flags |= IFF_NO_QUEUE;
+-}
+-
+ static void ieee80211_iface_process_skb(struct ieee80211_local *local,
+ 					struct ieee80211_sub_if_data *sdata,
+ 					struct sk_buff *skb)
+@@ -2096,9 +2047,7 @@ int ieee80211_if_add(struct ieee80211_lo
+ 	struct net_device *ndev = NULL;
+ 	struct ieee80211_sub_if_data *sdata = NULL;
+ 	struct txq_info *txqi;
+-	void (*if_setup)(struct net_device *dev);
+ 	int ret, i;
+-	int txqs = 1;
+ 
+ 	ASSERT_RTNL();
+ 
+@@ -2121,30 +2070,18 @@ int ieee80211_if_add(struct ieee80211_lo
+ 				 sizeof(void *));
+ 		int txq_size = 0;
+ 
+-		if (local->ops->wake_tx_queue &&
+-		    type != NL80211_IFTYPE_AP_VLAN &&
++		if (type != NL80211_IFTYPE_AP_VLAN &&
+ 		    (type != NL80211_IFTYPE_MONITOR ||
+ 		     (params->flags & MONITOR_FLAG_ACTIVE)))
+ 			txq_size += sizeof(struct txq_info) +
+ 				    local->hw.txq_data_size;
+ 
+-		if (local->ops->wake_tx_queue) {
+-			if_setup = ieee80211_if_setup_no_queue;
+-		} else {
+-			if_setup = ieee80211_if_setup;
+-			if (local->hw.queues >= IEEE80211_NUM_ACS)
+-				txqs = IEEE80211_NUM_ACS;
+-		}
+-
+ 		ndev = alloc_netdev_mqs(size + txq_size,
+ 					name, name_assign_type,
+-					if_setup, txqs, 1);
++					ieee80211_if_setup, 1, 1);
+ 		if (!ndev)
+ 			return -ENOMEM;
+ 
+-		if (!local->ops->wake_tx_queue && local->hw.wiphy->tx_queue_len)
+-			ndev->tx_queue_len = local->hw.wiphy->tx_queue_len;
+-
+ 		dev_net_set(ndev, wiphy_net(local->hw.wiphy));
+ 
+ 		ndev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -630,7 +630,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ 
+ 	if (WARN_ON(!ops->tx || !ops->start || !ops->stop || !ops->config ||
+ 		    !ops->add_interface || !ops->remove_interface ||
+-		    !ops->configure_filter))
++		    !ops->configure_filter || !ops->wake_tx_queue))
+ 		return NULL;
+ 
+ 	if (WARN_ON(ops->sta_state && (ops->sta_add || ops->sta_remove)))
+@@ -719,9 +719,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ 	if (!ops->set_key)
+ 		wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
+ 
+-	if (ops->wake_tx_queue)
+-		wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_TXQS);
+-
++	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_TXQS);
+ 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_RRM);
+ 
+ 	wiphy->bss_priv_size = sizeof(struct ieee80211_bss);
+@@ -834,10 +832,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ 		atomic_set(&local->agg_queue_stop[i], 0);
+ 	}
+ 	tasklet_setup(&local->tx_pending_tasklet, ieee80211_tx_pending);
+-
+-	if (ops->wake_tx_queue)
+-		tasklet_setup(&local->wake_txqs_tasklet, ieee80211_wake_txqs);
+-
++	tasklet_setup(&local->wake_txqs_tasklet, ieee80211_wake_txqs);
+ 	tasklet_setup(&local->tasklet, ieee80211_tasklet_handler);
+ 
+ 	skb_queue_head_init(&local->skb_queue);
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1571,9 +1571,6 @@ static void sta_ps_start(struct sta_info
+ 
+ 	ieee80211_clear_fast_xmit(sta);
+ 
+-	if (!sta->sta.txq[0])
+-		return;
+-
+ 	for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
+ 		struct ieee80211_txq *txq = sta->sta.txq[tid];
+ 		struct txq_info *txqi = to_txq_info(txq);
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -140,17 +140,15 @@ static void __cleanup_single_sta(struct
+ 		atomic_dec(&ps->num_sta_ps);
+ 	}
+ 
+-	if (sta->sta.txq[0]) {
+-		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
+-			struct txq_info *txqi;
++	for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
++		struct txq_info *txqi;
+ 
+-			if (!sta->sta.txq[i])
+-				continue;
++		if (!sta->sta.txq[i])
++			continue;
+ 
+-			txqi = to_txq_info(sta->sta.txq[i]);
++		txqi = to_txq_info(sta->sta.txq[i]);
+ 
+-			ieee80211_txq_purge(local, txqi);
+-		}
++		ieee80211_txq_purge(local, txqi);
+ 	}
+ 
+ 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+@@ -425,8 +423,7 @@ void sta_info_free(struct ieee80211_loca
+ 
+ 	sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
+ 
+-	if (sta->sta.txq[0])
+-		kfree(to_txq_info(sta->sta.txq[0]));
++	kfree(to_txq_info(sta->sta.txq[0]));
+ 	kfree(rcu_dereference_raw(sta->sta.rates));
+ #ifdef CPTCFG_MAC80211_MESH
+ 	kfree(sta->mesh);
+@@ -527,6 +524,8 @@ __sta_info_alloc(struct ieee80211_sub_if
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct ieee80211_hw *hw = &local->hw;
+ 	struct sta_info *sta;
++	void *txq_data;
++	int size;
+ 	int i;
+ 
+ 	sta = kzalloc(sizeof(*sta) + hw->sta_data_size, gfp);
+@@ -597,21 +596,18 @@ __sta_info_alloc(struct ieee80211_sub_if
+ 
+ 	sta->last_connected = ktime_get_seconds();
+ 
+-	if (local->ops->wake_tx_queue) {
+-		void *txq_data;
+-		int size = sizeof(struct txq_info) +
+-			   ALIGN(hw->txq_data_size, sizeof(void *));
++	size = sizeof(struct txq_info) +
++	       ALIGN(hw->txq_data_size, sizeof(void *));
+ 
+-		txq_data = kcalloc(ARRAY_SIZE(sta->sta.txq), size, gfp);
+-		if (!txq_data)
+-			goto free;
++	txq_data = kcalloc(ARRAY_SIZE(sta->sta.txq), size, gfp);
++	if (!txq_data)
++		goto free;
+ 
+-		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
+-			struct txq_info *txq = txq_data + i * size;
++	for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
++		struct txq_info *txq = txq_data + i * size;
+ 
+-			/* might not do anything for the bufferable MMPDU TXQ */
+-			ieee80211_txq_init(sdata, sta, txq, i);
+-		}
++		/* might not do anything for the (bufferable) MMPDU TXQ */
++		ieee80211_txq_init(sdata, sta, txq, i);
+ 	}
+ 
+ 	if (sta_prepare_rate_control(local, sta, gfp))
+@@ -685,8 +681,7 @@ __sta_info_alloc(struct ieee80211_sub_if
+ 	return sta;
+ 
+ free_txq:
+-	if (sta->sta.txq[0])
+-		kfree(to_txq_info(sta->sta.txq[0]));
++	kfree(to_txq_info(sta->sta.txq[0]));
+ free:
+ 	sta_info_free_link(&sta->deflink);
+ #ifdef CPTCFG_MAC80211_MESH
+@@ -1960,9 +1955,6 @@ ieee80211_sta_ps_deliver_response(struct
+ 		 * TIM recalculation.
+ 		 */
+ 
+-		if (!sta->sta.txq[0])
+-			return;
+-
+ 		for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
+ 			if (!sta->sta.txq[tid] ||
+ 			    !(driver_release_tids & BIT(tid)) ||
+@@ -2447,7 +2439,7 @@ static void sta_set_tidstats(struct sta_
+ 		tidstats->tx_msdu_failed = sta->deflink.status_stats.msdu_failed[tid];
+ 	}
+ 
+-	if (local->ops->wake_tx_queue && tid < IEEE80211_NUM_TIDS) {
++	if (tid < IEEE80211_NUM_TIDS) {
+ 		spin_lock_bh(&local->fq.lock);
+ 		rcu_read_lock();
+ 
+@@ -2775,9 +2767,6 @@ unsigned long ieee80211_sta_last_active(
+ 
+ static void sta_update_codel_params(struct sta_info *sta, u32 thr)
+ {
+-	if (!sta->sdata->local->ops->wake_tx_queue)
+-		return;
+-
+ 	if (thr && thr < STA_SLOW_THRESHOLD * sta->local->num_sta) {
+ 		sta->cparams.target = MS2TIME(50);
+ 		sta->cparams.interval = MS2TIME(300);
+--- a/net/mac80211/tdls.c
++++ b/net/mac80211/tdls.c
+@@ -1016,7 +1016,6 @@ ieee80211_tdls_prep_mgmt_packet(struct w
+ 		skb->priority = 256 + 5;
+ 		break;
+ 	}
+-	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, skb));
+ 
+ 	/*
+ 	 * Set the WLAN_TDLS_TEARDOWN flag to indicate a teardown in progress.
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1600,9 +1600,6 @@ int ieee80211_txq_setup_flows(struct iee
+ 	bool supp_vht = false;
+ 	enum nl80211_band band;
+ 
+-	if (!local->ops->wake_tx_queue)
+-		return 0;
+-
+ 	ret = fq_init(fq, 4096);
+ 	if (ret)
+ 		return ret;
+@@ -1650,9 +1647,6 @@ void ieee80211_txq_teardown_flows(struct
+ {
+ 	struct fq *fq = &local->fq;
+ 
+-	if (!local->ops->wake_tx_queue)
+-		return;
+-
+ 	kfree(local->cvars);
+ 	local->cvars = NULL;
+ 
+@@ -1669,8 +1663,7 @@ static bool ieee80211_queue_skb(struct i
+ 	struct ieee80211_vif *vif;
+ 	struct txq_info *txqi;
+ 
+-	if (!local->ops->wake_tx_queue ||
+-	    sdata->vif.type == NL80211_IFTYPE_MONITOR)
++	if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
+ 		return false;
+ 
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+@@ -4193,12 +4186,7 @@ void __ieee80211_subif_start_xmit(struct
+ 	if (IS_ERR(sta))
+ 		sta = NULL;
+ 
+-	if (local->ops->wake_tx_queue) {
+-		u16 queue = __ieee80211_select_queue(sdata, sta, skb);
+-		skb_set_queue_mapping(skb, queue);
+-		skb_get_hash(skb);
+-	}
+-
++	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
+ 	ieee80211_aggr_check(sdata, sta, skb);
+ 
+ 	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
+@@ -4509,11 +4497,7 @@ static void ieee80211_8023_xmit(struct i
+ 	struct tid_ampdu_tx *tid_tx;
+ 	u8 tid;
+ 
+-	if (local->ops->wake_tx_queue) {
+-		u16 queue = __ieee80211_select_queue(sdata, sta, skb);
+-		skb_set_queue_mapping(skb, queue);
+-		skb_get_hash(skb);
+-	}
++	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
+ 
+ 	if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning)) &&
+ 	    test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))
+@@ -4767,9 +4751,6 @@ void ieee80211_tx_pending(struct tasklet
+ 			if (!txok)
+ 				break;
+ 		}
+-
+-		if (skb_queue_empty(&local->pending[i]))
+-			ieee80211_propagate_queue_wake(local, i);
+ 	}
+ 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+ 
+@@ -5962,10 +5943,9 @@ int ieee80211_tx_control_port(struct wip
+ 	}
+ 
+ 	if (!IS_ERR(sta)) {
+-		u16 queue = __ieee80211_select_queue(sdata, sta, skb);
++		u16 queue = ieee80211_select_queue(sdata, sta, skb);
+ 
+ 		skb_set_queue_mapping(skb, queue);
+-		skb_get_hash(skb);
+ 
+ 		/*
+ 		 * for MLO STA, the SA should be the AP MLD address, but
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -444,39 +444,6 @@ void ieee80211_wake_txqs(struct tasklet_
+ 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+ }
+ 
+-void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue)
+-{
+-	struct ieee80211_sub_if_data *sdata;
+-	int n_acs = IEEE80211_NUM_ACS;
+-
+-	if (local->ops->wake_tx_queue)
+-		return;
+-
+-	if (local->hw.queues < IEEE80211_NUM_ACS)
+-		n_acs = 1;
+-
+-	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+-		int ac;
+-
+-		if (!sdata->dev)
+-			continue;
+-
+-		if (sdata->vif.cab_queue != IEEE80211_INVAL_HW_QUEUE &&
+-		    local->queue_stop_reasons[sdata->vif.cab_queue] != 0)
+-			continue;
+-
+-		for (ac = 0; ac < n_acs; ac++) {
+-			int ac_queue = sdata->vif.hw_queue[ac];
+-
+-			if (ac_queue == queue ||
+-			    (sdata->vif.cab_queue == queue &&
+-			     local->queue_stop_reasons[ac_queue] == 0 &&
+-			     skb_queue_empty(&local->pending[ac_queue])))
+-				netif_wake_subqueue(sdata->dev, ac);
+-		}
+-	}
+-}
+-
+ static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
+ 				   enum queue_stop_reason reason,
+ 				   bool refcounted,
+@@ -507,11 +474,7 @@ static void __ieee80211_wake_queue(struc
+ 		/* someone still has this queue stopped */
+ 		return;
+ 
+-	if (skb_queue_empty(&local->pending[queue])) {
+-		rcu_read_lock();
+-		ieee80211_propagate_queue_wake(local, queue);
+-		rcu_read_unlock();
+-	} else
++	if (!skb_queue_empty(&local->pending[queue]))
+ 		tasklet_schedule(&local->tx_pending_tasklet);
+ 
+ 	/*
+@@ -521,12 +484,10 @@ static void __ieee80211_wake_queue(struc
+ 	 * release someone's lock, but it is fine because all the callers of
+ 	 * __ieee80211_wake_queue call it right before releasing the lock.
+ 	 */
+-	if (local->ops->wake_tx_queue) {
+-		if (reason == IEEE80211_QUEUE_STOP_REASON_DRIVER)
+-			tasklet_schedule(&local->wake_txqs_tasklet);
+-		else
+-			_ieee80211_wake_txqs(local, flags);
+-	}
++	if (reason == IEEE80211_QUEUE_STOP_REASON_DRIVER)
++		tasklet_schedule(&local->wake_txqs_tasklet);
++	else
++		_ieee80211_wake_txqs(local, flags);
+ }
+ 
+ void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
+@@ -554,8 +515,6 @@ static void __ieee80211_stop_queue(struc
+ 				   bool refcounted)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+-	struct ieee80211_sub_if_data *sdata;
+-	int n_acs = IEEE80211_NUM_ACS;
+ 
+ 	trace_stop_queue(local, queue, reason);
+ 
+@@ -567,27 +526,7 @@ static void __ieee80211_stop_queue(struc
+ 	else
+ 		local->q_stop_reasons[queue][reason]++;
+ 
+-	if (__test_and_set_bit(reason, &local->queue_stop_reasons[queue]))
+-		return;
+-
+-	if (local->hw.queues < IEEE80211_NUM_ACS)
+-		n_acs = 1;
+-
+-	rcu_read_lock();
+-	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+-		int ac;
+-
+-		if (!sdata->dev)
+-			continue;
+-
+-		for (ac = 0; ac < n_acs; ac++) {
+-			if (!local->ops->wake_tx_queue &&
+-			    (sdata->vif.hw_queue[ac] == queue ||
+-			     sdata->vif.cab_queue == queue))
+-				netif_stop_subqueue(sdata->dev, ac);
+-		}
+-	}
+-	rcu_read_unlock();
++	set_bit(reason, &local->queue_stop_reasons[queue]);
+ }
+ 
+ void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
+--- a/net/mac80211/wme.c
++++ b/net/mac80211/wme.c
+@@ -122,6 +122,9 @@ u16 ieee80211_select_queue_80211(struct
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	u8 *p;
+ 
++	/* Ensure hash is set prior to potential SW encryption */
++	skb_get_hash(skb);
++
+ 	if ((info->control.flags & IEEE80211_TX_CTRL_DONT_REORDER) ||
+ 	    local->hw.queues < IEEE80211_NUM_ACS)
+ 		return 0;
+@@ -141,13 +144,16 @@ u16 ieee80211_select_queue_80211(struct
+ 	return ieee80211_downgrade_queue(sdata, NULL, skb);
+ }
+ 
+-u16 __ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
+-			     struct sta_info *sta, struct sk_buff *skb)
++u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
++			   struct sta_info *sta, struct sk_buff *skb)
+ {
+ 	const struct ethhdr *eth = (void *)skb->data;
+ 	struct mac80211_qos_map *qos_map;
+ 	bool qos;
+ 
++	/* Ensure hash is set prior to potential SW encryption */
++	skb_get_hash(skb);
++
+ 	/* all mesh/ocb stations are required to support WME */
+ 	if ((sdata->vif.type == NL80211_IFTYPE_MESH_POINT &&
+ 	    !is_multicast_ether_addr(eth->h_dest)) ||
+@@ -178,59 +184,6 @@ u16 __ieee80211_select_queue(struct ieee
+ 	return ieee80211_downgrade_queue(sdata, sta, skb);
+ }
+ 
+-
+-/* Indicate which queue to use. */
+-u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
+-			   struct sk_buff *skb)
+-{
+-	struct ieee80211_local *local = sdata->local;
+-	struct sta_info *sta = NULL;
+-	const u8 *ra = NULL;
+-	u16 ret;
+-
+-	/* when using iTXQ, we can do this later */
+-	if (local->ops->wake_tx_queue)
+-		return 0;
+-
+-	if (local->hw.queues < IEEE80211_NUM_ACS || skb->len < 6) {
+-		skb->priority = 0; /* required for correct WPA/11i MIC */
+-		return 0;
+-	}
+-
+-	rcu_read_lock();
+-	switch (sdata->vif.type) {
+-	case NL80211_IFTYPE_AP_VLAN:
+-		sta = rcu_dereference(sdata->u.vlan.sta);
+-		if (sta)
+-			break;
+-		fallthrough;
+-	case NL80211_IFTYPE_AP:
+-		ra = skb->data;
+-		break;
+-	case NL80211_IFTYPE_STATION:
+-		/* might be a TDLS station */
+-		sta = sta_info_get(sdata, skb->data);
+-		if (sta)
+-			break;
+-
+-		ra = sdata->deflink.u.mgd.bssid;
+-		break;
+-	case NL80211_IFTYPE_ADHOC:
+-		ra = skb->data;
+-		break;
+-	default:
+-		break;
+-	}
+-
+-	if (!sta && ra && !is_multicast_ether_addr(ra))
+-		sta = sta_info_get(sdata, ra);
+-
+-	ret = __ieee80211_select_queue(sdata, sta, skb);
+-
+-	rcu_read_unlock();
+-	return ret;
+-}
+-
+ /**
+  * ieee80211_set_qos_hdr - Fill in the QoS header if there is one.
+  *
+--- a/net/mac80211/wme.h
++++ b/net/mac80211/wme.h
+@@ -13,10 +13,8 @@
+ u16 ieee80211_select_queue_80211(struct ieee80211_sub_if_data *sdata,
+ 				 struct sk_buff *skb,
+ 				 struct ieee80211_hdr *hdr);
+-u16 __ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
+-			     struct sta_info *sta, struct sk_buff *skb);
+ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
+-			   struct sk_buff *skb);
++			   struct sta_info *sta, struct sk_buff *skb);
+ void ieee80211_set_qos_hdr(struct ieee80211_sub_if_data *sdata,
+ 			   struct sk_buff *skb);
+ 
diff --git a/package/kernel/mac80211/patches/subsys/306-04-v6.2-wifi-realtek-remove-duplicated-wake_tx_queue.patch b/package/kernel/mac80211/patches/subsys/306-04-v6.2-wifi-realtek-remove-duplicated-wake_tx_queue.patch
new file mode 100644
index 00000000000000..f0dfc75a788727
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/306-04-v6.2-wifi-realtek-remove-duplicated-wake_tx_queue.patch
@@ -0,0 +1,32 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 10 Oct 2022 19:17:46 +0200
+Subject: [PATCH] wifi: realtek: remove duplicated wake_tx_queue
+
+By accident, the previous patch duplicated the initialization
+of the wake_tx_queue callback. Fix that by removing the new
+initializations.
+
+Fixes: a790cc3a4fad ("wifi: mac80211: add wake_tx_queue callback to drivers")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/drivers/net/wireless/realtek/rtw88/mac80211.c
++++ b/drivers/net/wireless/realtek/rtw88/mac80211.c
+@@ -896,7 +896,6 @@ static void rtw_ops_sta_rc_update(struct
+ 
+ const struct ieee80211_ops rtw_ops = {
+ 	.tx			= rtw_ops_tx,
+-	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.wake_tx_queue		= rtw_ops_wake_tx_queue,
+ 	.start			= rtw_ops_start,
+ 	.stop			= rtw_ops_stop,
+--- a/drivers/net/wireless/realtek/rtw89/mac80211.c
++++ b/drivers/net/wireless/realtek/rtw89/mac80211.c
+@@ -918,7 +918,6 @@ static int rtw89_ops_set_tid_config(stru
+ 
+ const struct ieee80211_ops rtw89_ops = {
+ 	.tx			= rtw89_ops_tx,
+-	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.wake_tx_queue		= rtw89_ops_wake_tx_queue,
+ 	.start			= rtw89_ops_start,
+ 	.stop			= rtw89_ops_stop,
diff --git a/package/kernel/mac80211/patches/subsys/310-v6.2-mac80211-add-support-for-restricting-netdev-features.patch b/package/kernel/mac80211/patches/subsys/310-v6.2-mac80211-add-support-for-restricting-netdev-features.patch
new file mode 100644
index 00000000000000..812b12189c4754
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/310-v6.2-mac80211-add-support-for-restricting-netdev-features.patch
@@ -0,0 +1,506 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 9 Oct 2022 20:15:46 +0200
+Subject: [PATCH] mac80211: add support for restricting netdev features per vif
+
+This can be used to selectively disable feature flags for checksum offload,
+scatter/gather or GSO by changing vif->netdev_features.
+Removing features from vif->netdev_features does not affect the netdev
+features themselves, but instead fixes up skbs in the tx path so that the
+offloads are not needed in the driver.
+
+Aside from making it easier to deal with vif type based hardware limitations,
+this also makes it possible to optimize performance on hardware without native
+GSO support by declaring GSO support in hw->netdev_features and removing it
+from vif->netdev_features. This allows mac80211 to handle GSO segmentation
+after the sta lookup, but before itxq enqueue, thus reducing the number of
+unnecessary sta lookups, as well as some other per-packet processing.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/net/fq_impl.h
++++ b/include/net/fq_impl.h
+@@ -200,6 +200,7 @@ static void fq_tin_enqueue(struct fq *fq
+ 			   fq_skb_free_t free_func)
+ {
+ 	struct fq_flow *flow;
++	struct sk_buff *next;
+ 	bool oom;
+ 
+ 	lockdep_assert_held(&fq->lock);
+@@ -214,11 +215,15 @@ static void fq_tin_enqueue(struct fq *fq
+ 	}
+ 
+ 	flow->tin = tin;
+-	flow->backlog += skb->len;
+-	tin->backlog_bytes += skb->len;
+-	tin->backlog_packets++;
+-	fq->memory_usage += skb->truesize;
+-	fq->backlog++;
++	skb_list_walk_safe(skb, skb, next) {
++		skb_mark_not_on_list(skb);
++		flow->backlog += skb->len;
++		tin->backlog_bytes += skb->len;
++		tin->backlog_packets++;
++		fq->memory_usage += skb->truesize;
++		fq->backlog++;
++		__skb_queue_tail(&flow->queue, skb);
++	}
+ 
+ 	if (list_empty(&flow->flowchain)) {
+ 		flow->deficit = fq->quantum;
+@@ -226,7 +231,6 @@ static void fq_tin_enqueue(struct fq *fq
+ 			      &tin->new_flows);
+ 	}
+ 
+-	__skb_queue_tail(&flow->queue, skb);
+ 	oom = (fq->memory_usage > fq->memory_limit);
+ 	while (fq->backlog > fq->limit || oom) {
+ 		flow = fq_find_fattest_flow(fq);
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1807,6 +1807,10 @@ struct ieee80211_vif_cfg {
+  * @addr: address of this interface
+  * @p2p: indicates whether this AP or STA interface is a p2p
+  *	interface, i.e. a GO or p2p-sta respectively
++ * @netdev_features: tx netdev features supported by the hardware for this
++ *	vif. mac80211 initializes this to hw->netdev_features, and the driver
++ *	can mask out specific tx features. mac80211 will handle software fixup
++ *	for masked offloads (GSO, CSUM)
+  * @driver_flags: flags/capabilities the driver has for this interface,
+  *	these need to be set (or cleared) when the interface is added
+  *	or, if supported by the driver, the interface type is changed
+@@ -1846,6 +1850,7 @@ struct ieee80211_vif {
+ 
+ 	struct ieee80211_txq *txq;
+ 
++	netdev_features_t netdev_features;
+ 	u32 driver_flags;
+ 	u32 offload_flags;
+ 
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -2181,6 +2181,7 @@ int ieee80211_if_add(struct ieee80211_lo
+ 		ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
+ 		ndev->hw_features |= ndev->features &
+ 					MAC80211_SUPPORTED_FEATURES_TX;
++		sdata->vif.netdev_features = local->hw.netdev_features;
+ 
+ 		netdev_set_default_ethtool_ops(ndev, &ieee80211_ethtool_ops);
+ 
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1356,7 +1356,11 @@ static struct txq_info *ieee80211_get_tx
+ 
+ static void ieee80211_set_skb_enqueue_time(struct sk_buff *skb)
+ {
+-	IEEE80211_SKB_CB(skb)->control.enqueue_time = codel_get_time();
++	struct sk_buff *next;
++	codel_time_t now = codel_get_time();
++
++	skb_list_walk_safe(skb, skb, next)
++		IEEE80211_SKB_CB(skb)->control.enqueue_time = now;
+ }
+ 
+ static u32 codel_skb_len_func(const struct sk_buff *skb)
+@@ -3579,55 +3583,79 @@ ieee80211_xmit_fast_finish(struct ieee80
+ 	return TX_CONTINUE;
+ }
+ 
+-static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
+-				struct sta_info *sta,
+-				struct ieee80211_fast_tx *fast_tx,
+-				struct sk_buff *skb)
++static netdev_features_t
++ieee80211_sdata_netdev_features(struct ieee80211_sub_if_data *sdata)
+ {
+-	struct ieee80211_local *local = sdata->local;
+-	u16 ethertype = (skb->data[12] << 8) | skb->data[13];
+-	int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
+-	int hw_headroom = sdata->local->hw.extra_tx_headroom;
+-	struct ethhdr eth;
+-	struct ieee80211_tx_info *info;
+-	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
+-	struct ieee80211_tx_data tx;
+-	ieee80211_tx_result r;
+-	struct tid_ampdu_tx *tid_tx = NULL;
+-	u8 tid = IEEE80211_NUM_TIDS;
++	if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
++		return sdata->vif.netdev_features;
+ 
+-	/* control port protocol needs a lot of special handling */
+-	if (cpu_to_be16(ethertype) == sdata->control_port_protocol)
+-		return false;
++	if (!sdata->bss)
++		return 0;
+ 
+-	/* only RFC 1042 SNAP */
+-	if (ethertype < ETH_P_802_3_MIN)
+-		return false;
++	sdata = container_of(sdata->bss, struct ieee80211_sub_if_data, u.ap);
++	return sdata->vif.netdev_features;
++}
+ 
+-	/* don't handle TX status request here either */
+-	if (skb->sk && skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)
+-		return false;
++static struct sk_buff *
++ieee80211_tx_skb_fixup(struct sk_buff *skb, netdev_features_t features)
++{
++	if (skb_is_gso(skb)) {
++		struct sk_buff *segs;
+ 
+-	if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
+-		tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
+-		tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
+-		if (tid_tx) {
+-			if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
+-				return false;
+-			if (tid_tx->timeout)
+-				tid_tx->last_tx = jiffies;
+-		}
++		segs = skb_gso_segment(skb, features);
++		if (!segs)
++			return skb;
++		if (IS_ERR(segs))
++			goto free;
++
++		consume_skb(skb);
++		return segs;
+ 	}
+ 
+-	/* after this point (skb is modified) we cannot return false */
++	if (skb_needs_linearize(skb, features) && __skb_linearize(skb))
++		goto free;
++
++	if (skb->ip_summed == CHECKSUM_PARTIAL) {
++		int ofs = skb_checksum_start_offset(skb);
++
++		if (skb->encapsulation)
++			skb_set_inner_transport_header(skb, ofs);
++		else
++			skb_set_transport_header(skb, ofs);
++
++		if (skb_csum_hwoffload_help(skb, features))
++			goto free;
++	}
++
++	skb_mark_not_on_list(skb);
++	return skb;
++
++free:
++	kfree_skb(skb);
++	return NULL;
++}
++
++static void __ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
++				  struct sta_info *sta,
++				  struct ieee80211_fast_tx *fast_tx,
++				  struct sk_buff *skb, u8 tid, bool ampdu)
++{
++	struct ieee80211_local *local = sdata->local;
++	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
++	struct ieee80211_tx_info *info;
++	struct ieee80211_tx_data tx;
++	ieee80211_tx_result r;
++	int hw_headroom = sdata->local->hw.extra_tx_headroom;
++	int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
++	struct ethhdr eth;
+ 
+ 	skb = skb_share_check(skb, GFP_ATOMIC);
+ 	if (unlikely(!skb))
+-		return true;
++		return;
+ 
+ 	if ((hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) &&
+ 	    ieee80211_amsdu_aggregate(sdata, sta, fast_tx, skb))
+-		return true;
++		return;
+ 
+ 	/* will not be crypto-handled beyond what we do here, so use false
+ 	 * as the may-encrypt argument for the resize to not account for
+@@ -3636,10 +3664,8 @@ static bool ieee80211_xmit_fast(struct i
+ 	if (unlikely(ieee80211_skb_resize(sdata, skb,
+ 					  max_t(int, extra_head + hw_headroom -
+ 						     skb_headroom(skb), 0),
+-					  ENCRYPT_NO))) {
+-		kfree_skb(skb);
+-		return true;
+-	}
++					  ENCRYPT_NO)))
++		goto free;
+ 
+ 	memcpy(&eth, skb->data, ETH_HLEN - 2);
+ 	hdr = skb_push(skb, extra_head);
+@@ -3653,7 +3679,7 @@ static bool ieee80211_xmit_fast(struct i
+ 	info->control.vif = &sdata->vif;
+ 	info->flags = IEEE80211_TX_CTL_FIRST_FRAGMENT |
+ 		      IEEE80211_TX_CTL_DONTFRAG |
+-		      (tid_tx ? IEEE80211_TX_CTL_AMPDU : 0);
++		      (ampdu ? IEEE80211_TX_CTL_AMPDU : 0);
+ 	info->control.flags = IEEE80211_TX_CTRL_FAST_XMIT |
+ 			      u32_encode_bits(IEEE80211_LINK_UNSPECIFIED,
+ 					      IEEE80211_TX_CTRL_MLO_LINK);
+@@ -3677,16 +3703,14 @@ static bool ieee80211_xmit_fast(struct i
+ 	tx.key = fast_tx->key;
+ 
+ 	if (ieee80211_queue_skb(local, sdata, sta, skb))
+-		return true;
++		return;
+ 
+ 	tx.skb = skb;
+ 	r = ieee80211_xmit_fast_finish(sdata, sta, fast_tx->pn_offs,
+ 				       fast_tx->key, &tx);
+ 	tx.skb = NULL;
+-	if (r == TX_DROP) {
+-		kfree_skb(skb);
+-		return true;
+-	}
++	if (r == TX_DROP)
++		goto free;
+ 
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+ 		sdata = container_of(sdata->bss,
+@@ -3694,6 +3718,56 @@ static bool ieee80211_xmit_fast(struct i
+ 
+ 	__skb_queue_tail(&tx.skbs, skb);
+ 	ieee80211_tx_frags(local, &sdata->vif, sta, &tx.skbs, false);
++	return;
++
++free:
++	kfree_skb(skb);
++}
++
++static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
++				struct sta_info *sta,
++				struct ieee80211_fast_tx *fast_tx,
++				struct sk_buff *skb)
++{
++	u16 ethertype = (skb->data[12] << 8) | skb->data[13];
++	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
++	struct tid_ampdu_tx *tid_tx = NULL;
++	struct sk_buff *next;
++	u8 tid = IEEE80211_NUM_TIDS;
++
++	/* control port protocol needs a lot of special handling */
++	if (cpu_to_be16(ethertype) == sdata->control_port_protocol)
++		return false;
++
++	/* only RFC 1042 SNAP */
++	if (ethertype < ETH_P_802_3_MIN)
++		return false;
++
++	/* don't handle TX status request here either */
++	if (skb->sk && skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)
++		return false;
++
++	if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
++		tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
++		tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
++		if (tid_tx) {
++			if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
++				return false;
++			if (tid_tx->timeout)
++				tid_tx->last_tx = jiffies;
++		}
++	}
++
++	/* after this point (skb is modified) we cannot return false */
++	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
++	if (!skb)
++		return true;
++
++	skb_list_walk_safe(skb, skb, next) {
++		skb_mark_not_on_list(skb);
++		__ieee80211_xmit_fast(sdata, sta, fast_tx, skb, tid, tid_tx);
++	}
++
+ 	return true;
+ }
+ 
+@@ -4201,31 +4275,14 @@ void __ieee80211_subif_start_xmit(struct
+ 			goto out;
+ 	}
+ 
+-	if (skb_is_gso(skb)) {
+-		struct sk_buff *segs;
+-
+-		segs = skb_gso_segment(skb, 0);
+-		if (IS_ERR(segs)) {
+-			goto out_free;
+-		} else if (segs) {
+-			consume_skb(skb);
+-			skb = segs;
+-		}
+-	} else {
+-		/* we cannot process non-linear frames on this path */
+-		if (skb_linearize(skb))
+-			goto out_free;
+-
+-		/* the frame could be fragmented, software-encrypted, and other
+-		 * things so we cannot really handle checksum offload with it -
+-		 * fix it up in software before we handle anything else.
+-		 */
+-		if (skb->ip_summed == CHECKSUM_PARTIAL) {
+-			skb_set_transport_header(skb,
+-						 skb_checksum_start_offset(skb));
+-			if (skb_checksum_help(skb))
+-				goto out_free;
+-		}
++	/* the frame could be fragmented, software-encrypted, and other
++	 * things so we cannot really handle checksum or GSO offload.
++	 * fix it up in software before we handle anything else.
++	 */
++	skb = ieee80211_tx_skb_fixup(skb, 0);
++	if (!skb) {
++		len = 0;
++		goto out;
+ 	}
+ 
+ 	skb_list_walk_safe(skb, skb, next) {
+@@ -4443,9 +4500,11 @@ normal:
+ 	return NETDEV_TX_OK;
+ }
+ 
+-static bool ieee80211_tx_8023(struct ieee80211_sub_if_data *sdata,
+-			      struct sk_buff *skb, struct sta_info *sta,
+-			      bool txpending)
++
++
++static bool __ieee80211_tx_8023(struct ieee80211_sub_if_data *sdata,
++				struct sk_buff *skb, struct sta_info *sta,
++				bool txpending)
+ {
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct ieee80211_tx_control control = {};
+@@ -4454,14 +4513,6 @@ static bool ieee80211_tx_8023(struct iee
+ 	unsigned long flags;
+ 	int q = info->hw_queue;
+ 
+-	if (sta)
+-		sk_pacing_shift_update(skb->sk, local->hw.tx_sk_pacing_shift);
+-
+-	ieee80211_tpt_led_trig_tx(local, skb->len);
+-
+-	if (ieee80211_queue_skb(local, sdata, sta, skb))
+-		return true;
+-
+ 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+ 
+ 	if (local->queue_stop_reasons[q] ||
+@@ -4488,6 +4539,26 @@ static bool ieee80211_tx_8023(struct iee
+ 	return true;
+ }
+ 
++static bool ieee80211_tx_8023(struct ieee80211_sub_if_data *sdata,
++			      struct sk_buff *skb, struct sta_info *sta,
++			      bool txpending)
++{
++	struct ieee80211_local *local = sdata->local;
++	struct sk_buff *next;
++	bool ret = true;
++
++	if (ieee80211_queue_skb(local, sdata, sta, skb))
++		return true;
++
++	skb_list_walk_safe(skb, skb, next) {
++		skb_mark_not_on_list(skb);
++		if (!__ieee80211_tx_8023(sdata, skb, sta, txpending))
++			ret = false;
++	}
++
++	return ret;
++}
++
+ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
+ 				struct net_device *dev, struct sta_info *sta,
+ 				struct ieee80211_key *key, struct sk_buff *skb)
+@@ -4495,9 +4566,13 @@ static void ieee80211_8023_xmit(struct i
+ 	struct ieee80211_tx_info *info;
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct tid_ampdu_tx *tid_tx;
++	struct sk_buff *seg, *next;
++	unsigned int skbs = 0, len = 0;
++	u16 queue;
+ 	u8 tid;
+ 
+-	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
++	queue = ieee80211_select_queue(sdata, sta, skb);
++	skb_set_queue_mapping(skb, queue);
+ 
+ 	if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning)) &&
+ 	    test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))
+@@ -4507,9 +4582,6 @@ static void ieee80211_8023_xmit(struct i
+ 	if (unlikely(!skb))
+ 		return;
+ 
+-	info = IEEE80211_SKB_CB(skb);
+-	memset(info, 0, sizeof(*info));
+-
+ 	ieee80211_aggr_check(sdata, sta, skb);
+ 
+ 	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
+@@ -4523,22 +4595,20 @@ static void ieee80211_8023_xmit(struct i
+ 			return;
+ 		}
+ 
+-		info->flags |= IEEE80211_TX_CTL_AMPDU;
+ 		if (tid_tx->timeout)
+ 			tid_tx->last_tx = jiffies;
+ 	}
+ 
+-	if (unlikely(skb->sk &&
+-		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS))
+-		info->ack_frame_id = ieee80211_store_ack_skb(local, skb,
+-							     &info->flags, NULL);
++	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
++	if (!skb)
++		return;
+ 
+-	info->hw_queue = sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
++	info = IEEE80211_SKB_CB(skb);
++	memset(info, 0, sizeof(*info));
++	if (tid_tx)
++		info->flags |= IEEE80211_TX_CTL_AMPDU;
+ 
+-	dev_sw_netstats_tx_add(dev, 1, skb->len);
+-
+-	sta->deflink.tx_stats.bytes[skb_get_queue_mapping(skb)] += skb->len;
+-	sta->deflink.tx_stats.packets[skb_get_queue_mapping(skb)]++;
++	info->hw_queue = sdata->vif.hw_queue[queue];
+ 
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+ 		sdata = container_of(sdata->bss,
+@@ -4550,6 +4620,24 @@ static void ieee80211_8023_xmit(struct i
+ 	if (key)
+ 		info->control.hw_key = &key->conf;
+ 
++	skb_list_walk_safe(skb, seg, next) {
++		skbs++;
++		len += seg->len;
++		if (seg != skb)
++			memcpy(IEEE80211_SKB_CB(seg), info, sizeof(*info));
++	}
++
++	if (unlikely(skb->sk &&
++		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS))
++		info->ack_frame_id = ieee80211_store_ack_skb(local, skb,
++							     &info->flags, NULL);
++
++	dev_sw_netstats_tx_add(dev, skbs, len);
++	sta->deflink.tx_stats.packets[queue] += skbs;
++	sta->deflink.tx_stats.bytes[queue] += len;
++
++	ieee80211_tpt_led_trig_tx(local, len);
++
+ 	ieee80211_tx_8023(sdata, skb, sta, false);
+ 
+ 	return;
+@@ -4591,6 +4679,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+ 		    key->conf.cipher == WLAN_CIPHER_SUITE_TKIP))
+ 		goto skip_offload;
+ 
++	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
+ 	ieee80211_8023_xmit(sdata, dev, sta, key, skb);
+ 	goto out;
+ 
diff --git a/package/kernel/mac80211/patches/subsys/311-v6.2-wifi-mac80211-fix-and-simplify-unencrypted-drop-chec.patch b/package/kernel/mac80211/patches/subsys/311-v6.2-wifi-mac80211-fix-and-simplify-unencrypted-drop-chec.patch
new file mode 100644
index 00000000000000..804b02eb3063e5
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/311-v6.2-wifi-mac80211-fix-and-simplify-unencrypted-drop-chec.patch
@@ -0,0 +1,87 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 1 Dec 2022 14:57:30 +0100
+Subject: [PATCH] wifi: mac80211: fix and simplify unencrypted drop check for
+ mesh
+
+ieee80211_drop_unencrypted is called from ieee80211_rx_h_mesh_fwding and
+ieee80211_frame_allowed.
+
+Since ieee80211_rx_h_mesh_fwding can forward packets for other mesh nodes
+and is called earlier, it needs to check the decryptions status and if the
+packet is using the control protocol on its own, instead of deferring to
+the later call from ieee80211_frame_allowed.
+
+Because of that, ieee80211_drop_unencrypted has a mesh specific check
+that skips over the mesh header in order to check the payload protocol.
+This code is invalid when called from ieee80211_frame_allowed, since that
+happens after the 802.11->802.3 conversion.
+
+Fix this by moving the mesh specific check directly into
+ieee80211_rx_h_mesh_fwding.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Link: https://lore.kernel.org/r/20221201135730.19723-1-nbd@nbd.name
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2403,7 +2403,6 @@ static int ieee80211_802_1x_port_control
+ 
+ static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
+ {
+-	struct ieee80211_hdr *hdr = (void *)rx->skb->data;
+ 	struct sk_buff *skb = rx->skb;
+ 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+ 
+@@ -2414,31 +2413,6 @@ static int ieee80211_drop_unencrypted(st
+ 	if (status->flag & RX_FLAG_DECRYPTED)
+ 		return 0;
+ 
+-	/* check mesh EAPOL frames first */
+-	if (unlikely(rx->sta && ieee80211_vif_is_mesh(&rx->sdata->vif) &&
+-		     ieee80211_is_data(fc))) {
+-		struct ieee80211s_hdr *mesh_hdr;
+-		u16 hdr_len = ieee80211_hdrlen(fc);
+-		u16 ethertype_offset;
+-		__be16 ethertype;
+-
+-		if (!ether_addr_equal(hdr->addr1, rx->sdata->vif.addr))
+-			goto drop_check;
+-
+-		/* make sure fixed part of mesh header is there, also checks skb len */
+-		if (!pskb_may_pull(rx->skb, hdr_len + 6))
+-			goto drop_check;
+-
+-		mesh_hdr = (struct ieee80211s_hdr *)(skb->data + hdr_len);
+-		ethertype_offset = hdr_len + ieee80211_get_mesh_hdrlen(mesh_hdr) +
+-				   sizeof(rfc1042_header);
+-
+-		if (skb_copy_bits(rx->skb, ethertype_offset, &ethertype, 2) == 0 &&
+-		    ethertype == rx->sdata->control_port_protocol)
+-			return 0;
+-	}
+-
+-drop_check:
+ 	/* Drop unencrypted frames if key is set. */
+ 	if (unlikely(!ieee80211_has_protected(fc) &&
+ 		     !ieee80211_is_any_nullfunc(fc) &&
+@@ -2892,8 +2866,16 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+ 	hdr = (struct ieee80211_hdr *) skb->data;
+ 	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+ 
+-	if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
+-		return RX_DROP_MONITOR;
++	if (ieee80211_drop_unencrypted(rx, hdr->frame_control)) {
++		int offset = hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr) +
++			     sizeof(rfc1042_header);
++		__be16 ethertype;
++
++		if (!ether_addr_equal(hdr->addr1, rx->sdata->vif.addr) ||
++		    skb_copy_bits(rx->skb, offset, &ethertype, 2) != 0 ||
++		    ethertype != rx->sdata->control_port_protocol)
++			return RX_DROP_MONITOR;
++	}
+ 
+ 	/* frame is in RMC, don't forward */
+ 	if (ieee80211_is_data(hdr->frame_control) &&
diff --git a/package/kernel/mac80211/patches/subsys/312-v6.3-wifi-cfg80211-move-A-MSDU-check-in-ieee80211_data_to.patch b/package/kernel/mac80211/patches/subsys/312-v6.3-wifi-cfg80211-move-A-MSDU-check-in-ieee80211_data_to.patch
new file mode 100644
index 00000000000000..f668905ccaae19
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/312-v6.3-wifi-cfg80211-move-A-MSDU-check-in-ieee80211_data_to.patch
@@ -0,0 +1,25 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 2 Dec 2022 13:53:11 +0100
+Subject: [PATCH] wifi: cfg80211: move A-MSDU check in
+ ieee80211_data_to_8023_exthdr
+
+When parsing the outer A-MSDU header, don't check for inner bridge tunnel
+or RFC1042 headers. This is handled by ieee80211_amsdu_to_8023s already.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -631,8 +631,9 @@ int ieee80211_data_to_8023_exthdr(struct
+ 		break;
+ 	}
+ 
+-	if (likely(skb_copy_bits(skb, hdrlen, &payload, sizeof(payload)) == 0 &&
+-	           ((!is_amsdu && ether_addr_equal(payload.hdr, rfc1042_header) &&
++	if (likely(!is_amsdu &&
++		   skb_copy_bits(skb, hdrlen, &payload, sizeof(payload)) == 0 &&
++	           ((ether_addr_equal(payload.hdr, rfc1042_header) &&
+ 		     payload.proto != htons(ETH_P_AARP) &&
+ 		     payload.proto != htons(ETH_P_IPX)) ||
+ 		    ether_addr_equal(payload.hdr, bridge_tunnel_header)))) {
diff --git a/package/kernel/mac80211/patches/subsys/313-v6.3-wifi-cfg80211-factor-out-bridge-tunnel-RFC1042-heade.patch b/package/kernel/mac80211/patches/subsys/313-v6.3-wifi-cfg80211-factor-out-bridge-tunnel-RFC1042-heade.patch
new file mode 100644
index 00000000000000..86410578694c14
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/313-v6.3-wifi-cfg80211-factor-out-bridge-tunnel-RFC1042-heade.patch
@@ -0,0 +1,76 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 2 Dec 2022 13:54:15 +0100
+Subject: [PATCH] wifi: cfg80211: factor out bridge tunnel / RFC1042 header
+ check
+
+The same check is done in multiple places, unify it.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -542,6 +542,21 @@ unsigned int ieee80211_get_mesh_hdrlen(s
+ }
+ EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
+ 
++static bool ieee80211_get_8023_tunnel_proto(const void *hdr, __be16 *proto)
++{
++	const __be16 *hdr_proto = hdr + ETH_ALEN;
++
++	if (!(ether_addr_equal(hdr, rfc1042_header) &&
++	      *hdr_proto != htons(ETH_P_AARP) &&
++	      *hdr_proto != htons(ETH_P_IPX)) &&
++	    !ether_addr_equal(hdr, bridge_tunnel_header))
++		return false;
++
++	*proto = *hdr_proto;
++
++	return true;
++}
++
+ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
+ 				  const u8 *addr, enum nl80211_iftype iftype,
+ 				  u8 data_offset, bool is_amsdu)
+@@ -633,14 +648,9 @@ int ieee80211_data_to_8023_exthdr(struct
+ 
+ 	if (likely(!is_amsdu &&
+ 		   skb_copy_bits(skb, hdrlen, &payload, sizeof(payload)) == 0 &&
+-	           ((ether_addr_equal(payload.hdr, rfc1042_header) &&
+-		     payload.proto != htons(ETH_P_AARP) &&
+-		     payload.proto != htons(ETH_P_IPX)) ||
+-		    ether_addr_equal(payload.hdr, bridge_tunnel_header)))) {
+-		/* remove RFC1042 or Bridge-Tunnel encapsulation and
+-		 * replace EtherType */
++		   ieee80211_get_8023_tunnel_proto(&payload, &tmp.h_proto))) {
++		/* remove RFC1042 or Bridge-Tunnel encapsulation */
+ 		hdrlen += ETH_ALEN + 2;
+-		tmp.h_proto = payload.proto;
+ 		skb_postpull_rcsum(skb, &payload, ETH_ALEN + 2);
+ 	} else {
+ 		tmp.h_proto = htons(skb->len - hdrlen);
+@@ -756,8 +766,6 @@ void ieee80211_amsdu_to_8023s(struct sk_
+ {
+ 	unsigned int hlen = ALIGN(extra_headroom, 4);
+ 	struct sk_buff *frame = NULL;
+-	u16 ethertype;
+-	u8 *payload;
+ 	int offset = 0, remaining;
+ 	struct ethhdr eth;
+ 	bool reuse_frag = skb->head_frag && !skb_has_frag_list(skb);
+@@ -811,14 +819,8 @@ void ieee80211_amsdu_to_8023s(struct sk_
+ 		frame->dev = skb->dev;
+ 		frame->priority = skb->priority;
+ 
+-		payload = frame->data;
+-		ethertype = (payload[6] << 8) | payload[7];
+-		if (likely((ether_addr_equal(payload, rfc1042_header) &&
+-			    ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
+-			   ether_addr_equal(payload, bridge_tunnel_header))) {
+-			eth.h_proto = htons(ethertype);
++		if (likely(ieee80211_get_8023_tunnel_proto(frame->data, &eth.h_proto)))
+ 			skb_pull(frame, ETH_ALEN + 2);
+-		}
+ 
+ 		memcpy(skb_push(frame, sizeof(eth)), &eth, sizeof(eth));
+ 		__skb_queue_tail(list, frame);
diff --git a/package/kernel/mac80211/patches/subsys/314-v6.3-wifi-mac80211-remove-mesh-forwarding-congestion-chec.patch b/package/kernel/mac80211/patches/subsys/314-v6.3-wifi-mac80211-remove-mesh-forwarding-congestion-chec.patch
new file mode 100644
index 00000000000000..515176f0dec45f
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/314-v6.3-wifi-mac80211-remove-mesh-forwarding-congestion-chec.patch
@@ -0,0 +1,54 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 2 Dec 2022 17:01:46 +0100
+Subject: [PATCH] wifi: mac80211: remove mesh forwarding congestion check
+
+Now that all drivers use iTXQ, it does not make sense to check to drop
+tx forwarding packets when the driver has stopped the queues.
+fq_codel will take care of dropping packets when the queues fill up
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -603,8 +603,6 @@ IEEE80211_IF_FILE(fwded_mcast, u.mesh.ms
+ IEEE80211_IF_FILE(fwded_unicast, u.mesh.mshstats.fwded_unicast, DEC);
+ IEEE80211_IF_FILE(fwded_frames, u.mesh.mshstats.fwded_frames, DEC);
+ IEEE80211_IF_FILE(dropped_frames_ttl, u.mesh.mshstats.dropped_frames_ttl, DEC);
+-IEEE80211_IF_FILE(dropped_frames_congestion,
+-		  u.mesh.mshstats.dropped_frames_congestion, DEC);
+ IEEE80211_IF_FILE(dropped_frames_no_route,
+ 		  u.mesh.mshstats.dropped_frames_no_route, DEC);
+ 
+@@ -740,7 +738,6 @@ static void add_mesh_stats(struct ieee80
+ 	MESHSTATS_ADD(fwded_frames);
+ 	MESHSTATS_ADD(dropped_frames_ttl);
+ 	MESHSTATS_ADD(dropped_frames_no_route);
+-	MESHSTATS_ADD(dropped_frames_congestion);
+ #undef MESHSTATS_ADD
+ }
+ 
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -329,7 +329,6 @@ struct mesh_stats {
+ 	__u32 fwded_frames;		/* Mesh total forwarded frames */
+ 	__u32 dropped_frames_ttl;	/* Not transmitted since mesh_ttl == 0*/
+ 	__u32 dropped_frames_no_route;	/* Not transmitted, no route found */
+-	__u32 dropped_frames_congestion;/* Not forwarded due to congestion */
+ };
+ 
+ #define PREQ_Q_F_START		0x1
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2926,11 +2926,6 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+ 		return RX_CONTINUE;
+ 
+ 	ac = ieee802_1d_to_ac[skb->priority];
+-	q = sdata->vif.hw_queue[ac];
+-	if (ieee80211_queue_stopped(&local->hw, q)) {
+-		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
+-		return RX_DROP_MONITOR;
+-	}
+ 	skb_set_queue_mapping(skb, ac);
+ 
+ 	if (!--mesh_hdr->ttl) {
diff --git a/package/kernel/mac80211/patches/subsys/315-v6.3-wifi-mac80211-fix-receiving-A-MSDU-frames-on-mesh-in.patch b/package/kernel/mac80211/patches/subsys/315-v6.3-wifi-mac80211-fix-receiving-A-MSDU-frames-on-mesh-in.patch
new file mode 100644
index 00000000000000..59b799b6b1704e
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/315-v6.3-wifi-mac80211-fix-receiving-A-MSDU-frames-on-mesh-in.patch
@@ -0,0 +1,762 @@
+From 986e43b19ae9176093da35e0a844e65c8bf9ede7 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 13 Feb 2023 11:08:54 +0100
+Subject: [PATCH] wifi: mac80211: fix receiving A-MSDU frames on mesh
+ interfaces
+
+The current mac80211 mesh A-MSDU receive path fails to parse A-MSDU packets
+on mesh interfaces, because it assumes that the Mesh Control field is always
+directly after the 802.11 header.
+802.11-2020 9.3.2.2.2 Figure 9-70 shows that the Mesh Control field is
+actually part of the A-MSDU subframe header.
+This makes more sense, since it allows packets for multiple different
+destinations to be included in the same A-MSDU, as long as RA and TID are
+still the same.
+Another issue is the fact that the A-MSDU subframe length field was apparently
+accidentally defined as little-endian in the standard.
+
+In order to fix this, the mesh forwarding path needs happen at a different
+point in the receive path.
+
+ieee80211_data_to_8023_exthdr is changed to ignore the mesh control field
+and leave it in after the ethernet header. This also affects the source/dest
+MAC address fields, which now in the case of mesh point to the mesh SA/DA.
+
+ieee80211_amsdu_to_8023s is changed to deal with the endian difference and
+to add the Mesh Control length to the subframe length, since it's not covered
+by the MSDU length field.
+
+With these changes, the mac80211 will get the same packet structure for
+converted regular data packets and unpacked A-MSDU subframes.
+
+The mesh forwarding checks are now only performed after the A-MSDU decap.
+For locally received packets, the Mesh Control header is stripped away.
+For forwarded packets, a new 802.11 header gets added.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Link: https://lore.kernel.org/r/20230213100855.34315-4-nbd@nbd.name
+[fix fortify build error]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ .../wireless/marvell/mwifiex/11n_rxreorder.c  |   2 +-
+ include/net/cfg80211.h                        |  27 +-
+ net/mac80211/rx.c                             | 350 ++++++++++--------
+ net/wireless/util.c                           | 120 +++---
+ 4 files changed, 297 insertions(+), 202 deletions(-)
+
+--- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
++++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
+@@ -33,7 +33,7 @@ static int mwifiex_11n_dispatch_amsdu_pk
+ 		skb_trim(skb, le16_to_cpu(local_rx_pd->rx_pkt_length));
+ 
+ 		ieee80211_amsdu_to_8023s(skb, &list, priv->curr_addr,
+-					 priv->wdev.iftype, 0, NULL, NULL);
++					 priv->wdev.iftype, 0, NULL, NULL, false);
+ 
+ 		while (!skb_queue_empty(&list)) {
+ 			struct rx_packet_hdr *rx_hdr;
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -6208,11 +6208,36 @@ static inline int ieee80211_data_to_8023
+  * @extra_headroom: The hardware extra headroom for SKBs in the @list.
+  * @check_da: DA to check in the inner ethernet header, or NULL
+  * @check_sa: SA to check in the inner ethernet header, or NULL
++ * @mesh_control: A-MSDU subframe header includes the mesh control field
+  */
+ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
+ 			      const u8 *addr, enum nl80211_iftype iftype,
+ 			      const unsigned int extra_headroom,
+-			      const u8 *check_da, const u8 *check_sa);
++			      const u8 *check_da, const u8 *check_sa,
++			      bool mesh_control);
++
++/**
++ * ieee80211_get_8023_tunnel_proto - get RFC1042 or bridge tunnel encap protocol
++ *
++ * Check for RFC1042 or bridge tunnel header and fetch the encapsulated
++ * protocol.
++ *
++ * @hdr: pointer to the MSDU payload
++ * @proto: destination pointer to store the protocol
++ * Return: true if encapsulation was found
++ */
++bool ieee80211_get_8023_tunnel_proto(const void *hdr, __be16 *proto);
++
++/**
++ * ieee80211_strip_8023_mesh_hdr - strip mesh header from converted 802.3 frames
++ *
++ * Strip the mesh header, which was left in by ieee80211_data_to_8023 as part
++ * of the MSDU data. Also move any source/destination addresses from the mesh
++ * header to the ethernet header (if present).
++ *
++ * @skb: The 802.3 frame with embedded mesh header
++ */
++int ieee80211_strip_8023_mesh_hdr(struct sk_buff *skb);
+ 
+ /**
+  * cfg80211_classify8021d - determine the 802.1p/1d tag for a data frame
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2720,6 +2720,174 @@ ieee80211_deliver_skb(struct ieee80211_r
+ 	}
+ }
+ 
++static ieee80211_rx_result
++ieee80211_rx_mesh_data(struct ieee80211_sub_if_data *sdata, struct sta_info *sta,
++		       struct sk_buff *skb)
++{
++#ifdef CPTCFG_MAC80211_MESH
++	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
++	struct ieee80211_local *local = sdata->local;
++	uint16_t fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA;
++	struct ieee80211_hdr hdr = {
++		.frame_control = cpu_to_le16(fc)
++	};
++	struct ieee80211_hdr *fwd_hdr;
++	struct ieee80211s_hdr *mesh_hdr;
++	struct ieee80211_tx_info *info;
++	struct sk_buff *fwd_skb;
++	struct ethhdr *eth;
++	bool multicast;
++	int tailroom = 0;
++	int hdrlen, mesh_hdrlen;
++	u8 *qos;
++
++	if (!ieee80211_vif_is_mesh(&sdata->vif))
++		return RX_CONTINUE;
++
++	if (!pskb_may_pull(skb, sizeof(*eth) + 6))
++		return RX_DROP_MONITOR;
++
++	mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(*eth));
++	mesh_hdrlen = ieee80211_get_mesh_hdrlen(mesh_hdr);
++
++	if (!pskb_may_pull(skb, sizeof(*eth) + mesh_hdrlen))
++		return RX_DROP_MONITOR;
++
++	eth = (struct ethhdr *)skb->data;
++	multicast = is_multicast_ether_addr(eth->h_dest);
++
++	mesh_hdr = (struct ieee80211s_hdr *)(eth + 1);
++	if (!mesh_hdr->ttl)
++		return RX_DROP_MONITOR;
++
++	/* frame is in RMC, don't forward */
++	if (is_multicast_ether_addr(eth->h_dest) &&
++	    mesh_rmc_check(sdata, eth->h_source, mesh_hdr))
++		return RX_DROP_MONITOR;
++
++	/* Frame has reached destination.  Don't forward */
++	if (ether_addr_equal(sdata->vif.addr, eth->h_dest))
++		goto rx_accept;
++
++	if (!ifmsh->mshcfg.dot11MeshForwarding) {
++		if (is_multicast_ether_addr(eth->h_dest))
++			goto rx_accept;
++
++		return RX_DROP_MONITOR;
++	}
++
++	/* forward packet */
++	if (sdata->crypto_tx_tailroom_needed_cnt)
++		tailroom = IEEE80211_ENCRYPT_TAILROOM;
++
++	if (!--mesh_hdr->ttl) {
++		if (multicast)
++			goto rx_accept;
++
++		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
++		return RX_DROP_MONITOR;
++	}
++
++	if (mesh_hdr->flags & MESH_FLAGS_AE) {
++		struct mesh_path *mppath;
++		char *proxied_addr;
++
++		if (multicast)
++			proxied_addr = mesh_hdr->eaddr1;
++		else if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6)
++			/* has_a4 already checked in ieee80211_rx_mesh_check */
++			proxied_addr = mesh_hdr->eaddr2;
++		else
++			return RX_DROP_MONITOR;
++
++		rcu_read_lock();
++		mppath = mpp_path_lookup(sdata, proxied_addr);
++		if (!mppath) {
++			mpp_path_add(sdata, proxied_addr, eth->h_source);
++		} else {
++			spin_lock_bh(&mppath->state_lock);
++			if (!ether_addr_equal(mppath->mpp, eth->h_source))
++				memcpy(mppath->mpp, eth->h_source, ETH_ALEN);
++			mppath->exp_time = jiffies;
++			spin_unlock_bh(&mppath->state_lock);
++		}
++		rcu_read_unlock();
++	}
++
++	skb_set_queue_mapping(skb, ieee802_1d_to_ac[skb->priority]);
++
++	ieee80211_fill_mesh_addresses(&hdr, &hdr.frame_control,
++				      eth->h_dest, eth->h_source);
++	hdrlen = ieee80211_hdrlen(hdr.frame_control);
++	if (multicast) {
++		int extra_head = sizeof(struct ieee80211_hdr) - sizeof(*eth);
++
++		fwd_skb = skb_copy_expand(skb, local->tx_headroom + extra_head +
++					       IEEE80211_ENCRYPT_HEADROOM,
++					  tailroom, GFP_ATOMIC);
++		if (!fwd_skb)
++			goto rx_accept;
++	} else {
++		fwd_skb = skb;
++		skb = NULL;
++
++		if (skb_cow_head(fwd_skb, hdrlen - sizeof(struct ethhdr)))
++			return RX_DROP_UNUSABLE;
++	}
++
++	fwd_hdr = skb_push(fwd_skb, hdrlen - sizeof(struct ethhdr));
++	memcpy(fwd_hdr, &hdr, hdrlen - 2);
++	qos = ieee80211_get_qos_ctl(fwd_hdr);
++	qos[0] = qos[1] = 0;
++
++	skb_reset_mac_header(fwd_skb);
++	hdrlen += mesh_hdrlen;
++	if (ieee80211_get_8023_tunnel_proto(fwd_skb->data + hdrlen,
++					    &fwd_skb->protocol))
++		hdrlen += ETH_ALEN;
++	else
++		fwd_skb->protocol = htons(fwd_skb->len - hdrlen);
++	skb_set_network_header(fwd_skb, hdrlen);
++
++	info = IEEE80211_SKB_CB(fwd_skb);
++	memset(info, 0, sizeof(*info));
++	info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
++	info->control.vif = &sdata->vif;
++	info->control.jiffies = jiffies;
++	if (multicast) {
++		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
++		memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
++		/* update power mode indication when forwarding */
++		ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
++	} else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
++		/* mesh power mode flags updated in mesh_nexthop_lookup */
++		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
++	} else {
++		/* unable to resolve next hop */
++		if (sta)
++			mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
++					   hdr.addr3, 0,
++					   WLAN_REASON_MESH_PATH_NOFORWARD,
++					   sta->sta.addr);
++		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
++		kfree_skb(fwd_skb);
++		goto rx_accept;
++	}
++
++	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
++	fwd_skb->dev = sdata->dev;
++	ieee80211_add_pending_skb(local, fwd_skb);
++
++rx_accept:
++	if (!skb)
++		return RX_QUEUED;
++
++	ieee80211_strip_8023_mesh_hdr(skb);
++#endif
++
++	return RX_CONTINUE;
++}
++
+ static ieee80211_rx_result debug_noinline
+ __ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset)
+ {
+@@ -2728,8 +2896,10 @@ __ieee80211_rx_h_amsdu(struct ieee80211_
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ 	__le16 fc = hdr->frame_control;
+ 	struct sk_buff_head frame_list;
++	static ieee80211_rx_result res;
+ 	struct ethhdr ethhdr;
+ 	const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
++	bool mesh = false;
+ 
+ 	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
+ 		check_da = NULL;
+@@ -2746,6 +2916,8 @@ __ieee80211_rx_h_amsdu(struct ieee80211_
+ 			break;
+ 		case NL80211_IFTYPE_MESH_POINT:
+ 			check_sa = NULL;
++			check_da = NULL;
++			mesh = true;
+ 			break;
+ 		default:
+ 			break;
+@@ -2763,17 +2935,29 @@ __ieee80211_rx_h_amsdu(struct ieee80211_
+ 	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
+ 				 rx->sdata->vif.type,
+ 				 rx->local->hw.extra_tx_headroom,
+-				 check_da, check_sa);
++				 check_da, check_sa, mesh);
+ 
+ 	while (!skb_queue_empty(&frame_list)) {
+ 		rx->skb = __skb_dequeue(&frame_list);
+ 
+-		if (!ieee80211_frame_allowed(rx, fc)) {
+-			dev_kfree_skb(rx->skb);
++		res = ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb);
++		switch (res) {
++		case RX_QUEUED:
+ 			continue;
++		case RX_CONTINUE:
++			break;
++		default:
++			goto free;
+ 		}
+ 
++		if (!ieee80211_frame_allowed(rx, fc))
++			goto free;
++
+ 		ieee80211_deliver_skb(rx);
++		continue;
++
++free:
++		dev_kfree_skb(rx->skb);
+ 	}
+ 
+ 	return RX_QUEUED;
+@@ -2806,6 +2990,8 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx
+ 			if (!rx->sdata->u.mgd.use_4addr)
+ 				return RX_DROP_UNUSABLE;
+ 			break;
++		case NL80211_IFTYPE_MESH_POINT:
++			break;
+ 		default:
+ 			return RX_DROP_UNUSABLE;
+ 		}
+@@ -2834,155 +3020,6 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx
+ 	return __ieee80211_rx_h_amsdu(rx, 0);
+ }
+ 
+-#ifdef CPTCFG_MAC80211_MESH
+-static ieee80211_rx_result
+-ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+-{
+-	struct ieee80211_hdr *fwd_hdr, *hdr;
+-	struct ieee80211_tx_info *info;
+-	struct ieee80211s_hdr *mesh_hdr;
+-	struct sk_buff *skb = rx->skb, *fwd_skb;
+-	struct ieee80211_local *local = rx->local;
+-	struct ieee80211_sub_if_data *sdata = rx->sdata;
+-	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+-	u16 ac, q, hdrlen;
+-	int tailroom = 0;
+-
+-	hdr = (struct ieee80211_hdr *) skb->data;
+-	hdrlen = ieee80211_hdrlen(hdr->frame_control);
+-
+-	/* make sure fixed part of mesh header is there, also checks skb len */
+-	if (!pskb_may_pull(rx->skb, hdrlen + 6))
+-		return RX_DROP_MONITOR;
+-
+-	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+-
+-	/* make sure full mesh header is there, also checks skb len */
+-	if (!pskb_may_pull(rx->skb,
+-			   hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
+-		return RX_DROP_MONITOR;
+-
+-	/* reload pointers */
+-	hdr = (struct ieee80211_hdr *) skb->data;
+-	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+-
+-	if (ieee80211_drop_unencrypted(rx, hdr->frame_control)) {
+-		int offset = hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr) +
+-			     sizeof(rfc1042_header);
+-		__be16 ethertype;
+-
+-		if (!ether_addr_equal(hdr->addr1, rx->sdata->vif.addr) ||
+-		    skb_copy_bits(rx->skb, offset, &ethertype, 2) != 0 ||
+-		    ethertype != rx->sdata->control_port_protocol)
+-			return RX_DROP_MONITOR;
+-	}
+-
+-	/* frame is in RMC, don't forward */
+-	if (ieee80211_is_data(hdr->frame_control) &&
+-	    is_multicast_ether_addr(hdr->addr1) &&
+-	    mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr))
+-		return RX_DROP_MONITOR;
+-
+-	if (!ieee80211_is_data(hdr->frame_control))
+-		return RX_CONTINUE;
+-
+-	if (!mesh_hdr->ttl)
+-		return RX_DROP_MONITOR;
+-
+-	if (mesh_hdr->flags & MESH_FLAGS_AE) {
+-		struct mesh_path *mppath;
+-		char *proxied_addr;
+-		char *mpp_addr;
+-
+-		if (is_multicast_ether_addr(hdr->addr1)) {
+-			mpp_addr = hdr->addr3;
+-			proxied_addr = mesh_hdr->eaddr1;
+-		} else if ((mesh_hdr->flags & MESH_FLAGS_AE) ==
+-			    MESH_FLAGS_AE_A5_A6) {
+-			/* has_a4 already checked in ieee80211_rx_mesh_check */
+-			mpp_addr = hdr->addr4;
+-			proxied_addr = mesh_hdr->eaddr2;
+-		} else {
+-			return RX_DROP_MONITOR;
+-		}
+-
+-		rcu_read_lock();
+-		mppath = mpp_path_lookup(sdata, proxied_addr);
+-		if (!mppath) {
+-			mpp_path_add(sdata, proxied_addr, mpp_addr);
+-		} else {
+-			spin_lock_bh(&mppath->state_lock);
+-			if (!ether_addr_equal(mppath->mpp, mpp_addr))
+-				memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
+-			mppath->exp_time = jiffies;
+-			spin_unlock_bh(&mppath->state_lock);
+-		}
+-		rcu_read_unlock();
+-	}
+-
+-	/* Frame has reached destination.  Don't forward */
+-	if (!is_multicast_ether_addr(hdr->addr1) &&
+-	    ether_addr_equal(sdata->vif.addr, hdr->addr3))
+-		return RX_CONTINUE;
+-
+-	ac = ieee802_1d_to_ac[skb->priority];
+-	skb_set_queue_mapping(skb, ac);
+-
+-	if (!--mesh_hdr->ttl) {
+-		if (!is_multicast_ether_addr(hdr->addr1))
+-			IEEE80211_IFSTA_MESH_CTR_INC(ifmsh,
+-						     dropped_frames_ttl);
+-		goto out;
+-	}
+-
+-	if (!ifmsh->mshcfg.dot11MeshForwarding)
+-		goto out;
+-
+-	if (sdata->crypto_tx_tailroom_needed_cnt)
+-		tailroom = IEEE80211_ENCRYPT_TAILROOM;
+-
+-	fwd_skb = skb_copy_expand(skb, local->tx_headroom +
+-				       IEEE80211_ENCRYPT_HEADROOM,
+-				  tailroom, GFP_ATOMIC);
+-	if (!fwd_skb)
+-		goto out;
+-
+-	fwd_skb->dev = sdata->dev;
+-	fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
+-	fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
+-	info = IEEE80211_SKB_CB(fwd_skb);
+-	memset(info, 0, sizeof(*info));
+-	info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
+-	info->control.vif = &rx->sdata->vif;
+-	info->control.jiffies = jiffies;
+-	if (is_multicast_ether_addr(fwd_hdr->addr1)) {
+-		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
+-		memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
+-		/* update power mode indication when forwarding */
+-		ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
+-	} else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
+-		/* mesh power mode flags updated in mesh_nexthop_lookup */
+-		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
+-	} else {
+-		/* unable to resolve next hop */
+-		mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
+-				   fwd_hdr->addr3, 0,
+-				   WLAN_REASON_MESH_PATH_NOFORWARD,
+-				   fwd_hdr->addr2);
+-		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
+-		kfree_skb(fwd_skb);
+-		return RX_DROP_MONITOR;
+-	}
+-
+-	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
+-	ieee80211_add_pending_skb(local, fwd_skb);
+- out:
+-	if (is_multicast_ether_addr(hdr->addr1))
+-		return RX_CONTINUE;
+-	return RX_DROP_MONITOR;
+-}
+-#endif
+-
+ static ieee80211_rx_result debug_noinline
+ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
+ {
+@@ -2991,6 +3028,7 @@ ieee80211_rx_h_data(struct ieee80211_rx_
+ 	struct net_device *dev = sdata->dev;
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
+ 	__le16 fc = hdr->frame_control;
++	static ieee80211_rx_result res;
+ 	bool port_control;
+ 	int err;
+ 
+@@ -3017,6 +3055,10 @@ ieee80211_rx_h_data(struct ieee80211_rx_
+ 	if (unlikely(err))
+ 		return RX_DROP_UNUSABLE;
+ 
++	res = ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb);
++	if (res != RX_CONTINUE)
++		return res;
++
+ 	if (!ieee80211_frame_allowed(rx, fc))
+ 		return RX_DROP_MONITOR;
+ 
+@@ -3987,10 +4029,6 @@ static void ieee80211_rx_handlers(struct
+ 		CALL_RXH(ieee80211_rx_h_defragment);
+ 		CALL_RXH(ieee80211_rx_h_michael_mic_verify);
+ 		/* must be after MMIC verify so header is counted in MPDU mic */
+-#ifdef CPTCFG_MAC80211_MESH
+-		if (ieee80211_vif_is_mesh(&rx->sdata->vif))
+-			CALL_RXH(ieee80211_rx_h_mesh_fwding);
+-#endif
+ 		CALL_RXH(ieee80211_rx_h_amsdu);
+ 		CALL_RXH(ieee80211_rx_h_data);
+ 
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -542,7 +542,7 @@ unsigned int ieee80211_get_mesh_hdrlen(s
+ }
+ EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
+ 
+-static bool ieee80211_get_8023_tunnel_proto(const void *hdr, __be16 *proto)
++bool ieee80211_get_8023_tunnel_proto(const void *hdr, __be16 *proto)
+ {
+ 	const __be16 *hdr_proto = hdr + ETH_ALEN;
+ 
+@@ -556,6 +556,49 @@ static bool ieee80211_get_8023_tunnel_pr
+ 
+ 	return true;
+ }
++EXPORT_SYMBOL(ieee80211_get_8023_tunnel_proto);
++
++int ieee80211_strip_8023_mesh_hdr(struct sk_buff *skb)
++{
++	const void *mesh_addr;
++	struct {
++		struct ethhdr eth;
++		u8 flags;
++	} payload;
++	int hdrlen;
++	int ret;
++
++	ret = skb_copy_bits(skb, 0, &payload, sizeof(payload));
++	if (ret)
++		return ret;
++
++	hdrlen = sizeof(payload.eth) + __ieee80211_get_mesh_hdrlen(payload.flags);
++
++	if (likely(pskb_may_pull(skb, hdrlen + 8) &&
++		   ieee80211_get_8023_tunnel_proto(skb->data + hdrlen,
++						   &payload.eth.h_proto)))
++		hdrlen += ETH_ALEN + 2;
++	else if (!pskb_may_pull(skb, hdrlen))
++		return -EINVAL;
++
++	mesh_addr = skb->data + sizeof(payload.eth) + ETH_ALEN;
++	switch (payload.flags & MESH_FLAGS_AE) {
++	case MESH_FLAGS_AE_A4:
++		memcpy(&payload.eth.h_source, mesh_addr, ETH_ALEN);
++		break;
++	case MESH_FLAGS_AE_A5_A6:
++		memcpy(&payload.eth, mesh_addr, 2 * ETH_ALEN);
++		break;
++	default:
++		break;
++	}
++
++	pskb_pull(skb, hdrlen - sizeof(payload.eth));
++	memcpy(skb->data, &payload.eth, sizeof(payload.eth));
++
++	return 0;
++}
++EXPORT_SYMBOL(ieee80211_strip_8023_mesh_hdr);
+ 
+ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
+ 				  const u8 *addr, enum nl80211_iftype iftype,
+@@ -568,7 +611,6 @@ int ieee80211_data_to_8023_exthdr(struct
+ 	} payload;
+ 	struct ethhdr tmp;
+ 	u16 hdrlen;
+-	u8 mesh_flags = 0;
+ 
+ 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
+ 		return -1;
+@@ -589,12 +631,6 @@ int ieee80211_data_to_8023_exthdr(struct
+ 	memcpy(tmp.h_dest, ieee80211_get_DA(hdr), ETH_ALEN);
+ 	memcpy(tmp.h_source, ieee80211_get_SA(hdr), ETH_ALEN);
+ 
+-	if (iftype == NL80211_IFTYPE_MESH_POINT &&
+-	    skb_copy_bits(skb, hdrlen, &mesh_flags, 1) < 0)
+-		return -1;
+-
+-	mesh_flags &= MESH_FLAGS_AE;
+-
+ 	switch (hdr->frame_control &
+ 		cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
+ 	case cpu_to_le16(IEEE80211_FCTL_TODS):
+@@ -608,17 +644,6 @@ int ieee80211_data_to_8023_exthdr(struct
+ 			     iftype != NL80211_IFTYPE_AP_VLAN &&
+ 			     iftype != NL80211_IFTYPE_STATION))
+ 			return -1;
+-		if (iftype == NL80211_IFTYPE_MESH_POINT) {
+-			if (mesh_flags == MESH_FLAGS_AE_A4)
+-				return -1;
+-			if (mesh_flags == MESH_FLAGS_AE_A5_A6 &&
+-			    skb_copy_bits(skb, hdrlen +
+-					  offsetof(struct ieee80211s_hdr, eaddr1),
+-					  tmp.h_dest, 2 * ETH_ALEN) < 0)
+-				return -1;
+-
+-			hdrlen += __ieee80211_get_mesh_hdrlen(mesh_flags);
+-		}
+ 		break;
+ 	case cpu_to_le16(IEEE80211_FCTL_FROMDS):
+ 		if ((iftype != NL80211_IFTYPE_STATION &&
+@@ -627,16 +652,6 @@ int ieee80211_data_to_8023_exthdr(struct
+ 		    (is_multicast_ether_addr(tmp.h_dest) &&
+ 		     ether_addr_equal(tmp.h_source, addr)))
+ 			return -1;
+-		if (iftype == NL80211_IFTYPE_MESH_POINT) {
+-			if (mesh_flags == MESH_FLAGS_AE_A5_A6)
+-				return -1;
+-			if (mesh_flags == MESH_FLAGS_AE_A4 &&
+-			    skb_copy_bits(skb, hdrlen +
+-					  offsetof(struct ieee80211s_hdr, eaddr1),
+-					  tmp.h_source, ETH_ALEN) < 0)
+-				return -1;
+-			hdrlen += __ieee80211_get_mesh_hdrlen(mesh_flags);
+-		}
+ 		break;
+ 	case cpu_to_le16(0):
+ 		if (iftype != NL80211_IFTYPE_ADHOC &&
+@@ -646,7 +661,7 @@ int ieee80211_data_to_8023_exthdr(struct
+ 		break;
+ 	}
+ 
+-	if (likely(!is_amsdu &&
++	if (likely(!is_amsdu && iftype != NL80211_IFTYPE_MESH_POINT &&
+ 		   skb_copy_bits(skb, hdrlen, &payload, sizeof(payload)) == 0 &&
+ 		   ieee80211_get_8023_tunnel_proto(&payload, &tmp.h_proto))) {
+ 		/* remove RFC1042 or Bridge-Tunnel encapsulation */
+@@ -722,7 +737,8 @@ __ieee80211_amsdu_copy_frag(struct sk_bu
+ 
+ static struct sk_buff *
+ __ieee80211_amsdu_copy(struct sk_buff *skb, unsigned int hlen,
+-		       int offset, int len, bool reuse_frag)
++		       int offset, int len, bool reuse_frag,
++		       int min_len)
+ {
+ 	struct sk_buff *frame;
+ 	int cur_len = len;
+@@ -736,7 +752,7 @@ __ieee80211_amsdu_copy(struct sk_buff *s
+ 	 * in the stack later.
+ 	 */
+ 	if (reuse_frag)
+-		cur_len = min_t(int, len, 32);
++		cur_len = min_t(int, len, min_len);
+ 
+ 	/*
+ 	 * Allocate and reserve two bytes more for payload
+@@ -746,6 +762,7 @@ __ieee80211_amsdu_copy(struct sk_buff *s
+ 	if (!frame)
+ 		return NULL;
+ 
++	frame->priority = skb->priority;
+ 	skb_reserve(frame, hlen + sizeof(struct ethhdr) + 2);
+ 	skb_copy_bits(skb, offset, skb_put(frame, cur_len), cur_len);
+ 
+@@ -762,23 +779,37 @@ __ieee80211_amsdu_copy(struct sk_buff *s
+ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
+ 			      const u8 *addr, enum nl80211_iftype iftype,
+ 			      const unsigned int extra_headroom,
+-			      const u8 *check_da, const u8 *check_sa)
++			      const u8 *check_da, const u8 *check_sa,
++			      bool mesh_control)
+ {
+ 	unsigned int hlen = ALIGN(extra_headroom, 4);
+ 	struct sk_buff *frame = NULL;
+ 	int offset = 0, remaining;
+-	struct ethhdr eth;
++	struct {
++		struct ethhdr eth;
++		uint8_t flags;
++	} hdr;
+ 	bool reuse_frag = skb->head_frag && !skb_has_frag_list(skb);
+ 	bool reuse_skb = false;
+ 	bool last = false;
++	int copy_len = sizeof(hdr.eth);
++
++	if (iftype == NL80211_IFTYPE_MESH_POINT)
++		copy_len = sizeof(hdr);
+ 
+ 	while (!last) {
+ 		unsigned int subframe_len;
+-		int len;
++		int len, mesh_len = 0;
+ 		u8 padding;
+ 
+-		skb_copy_bits(skb, offset, &eth, sizeof(eth));
+-		len = ntohs(eth.h_proto);
++		skb_copy_bits(skb, offset, &hdr, copy_len);
++		if (iftype == NL80211_IFTYPE_MESH_POINT)
++			mesh_len = __ieee80211_get_mesh_hdrlen(hdr.flags);
++		if (mesh_control)
++			len = le16_to_cpu(*(__le16 *)&hdr.eth.h_proto) + mesh_len;
++		else
++			len = ntohs(hdr.eth.h_proto);
++
+ 		subframe_len = sizeof(struct ethhdr) + len;
+ 		padding = (4 - subframe_len) & 0x3;
+ 
+@@ -787,16 +818,16 @@ void ieee80211_amsdu_to_8023s(struct sk_
+ 		if (subframe_len > remaining)
+ 			goto purge;
+ 		/* mitigate A-MSDU aggregation injection attacks */
+-		if (ether_addr_equal(eth.h_dest, rfc1042_header))
++		if (ether_addr_equal(hdr.eth.h_dest, rfc1042_header))
+ 			goto purge;
+ 
+ 		offset += sizeof(struct ethhdr);
+ 		last = remaining <= subframe_len + padding;
+ 
+ 		/* FIXME: should we really accept multicast DA? */
+-		if ((check_da && !is_multicast_ether_addr(eth.h_dest) &&
+-		     !ether_addr_equal(check_da, eth.h_dest)) ||
+-		    (check_sa && !ether_addr_equal(check_sa, eth.h_source))) {
++		if ((check_da && !is_multicast_ether_addr(hdr.eth.h_dest) &&
++		     !ether_addr_equal(check_da, hdr.eth.h_dest)) ||
++		    (check_sa && !ether_addr_equal(check_sa, hdr.eth.h_source))) {
+ 			offset += len + padding;
+ 			continue;
+ 		}
+@@ -808,7 +839,7 @@ void ieee80211_amsdu_to_8023s(struct sk_
+ 			reuse_skb = true;
+ 		} else {
+ 			frame = __ieee80211_amsdu_copy(skb, hlen, offset, len,
+-						       reuse_frag);
++						       reuse_frag, 32 + mesh_len);
+ 			if (!frame)
+ 				goto purge;
+ 
+@@ -819,10 +850,11 @@ void ieee80211_amsdu_to_8023s(struct sk_
+ 		frame->dev = skb->dev;
+ 		frame->priority = skb->priority;
+ 
+-		if (likely(ieee80211_get_8023_tunnel_proto(frame->data, &eth.h_proto)))
++		if (likely(iftype != NL80211_IFTYPE_MESH_POINT &&
++			   ieee80211_get_8023_tunnel_proto(frame->data, &hdr.eth.h_proto)))
+ 			skb_pull(frame, ETH_ALEN + 2);
+ 
+-		memcpy(skb_push(frame, sizeof(eth)), &eth, sizeof(eth));
++		memcpy(skb_push(frame, sizeof(hdr.eth)), &hdr.eth, sizeof(hdr.eth));
+ 		__skb_queue_tail(list, frame);
+ 	}
+ 
diff --git a/package/kernel/mac80211/patches/subsys/316-v6.3-wifi-mac80211-add-a-workaround-for-receiving-non-sta.patch b/package/kernel/mac80211/patches/subsys/316-v6.3-wifi-mac80211-add-a-workaround-for-receiving-non-sta.patch
new file mode 100644
index 00000000000000..6dc98ae16af127
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/316-v6.3-wifi-mac80211-add-a-workaround-for-receiving-non-sta.patch
@@ -0,0 +1,145 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 9 Dec 2022 21:15:04 +0100
+Subject: [PATCH] wifi: mac80211: add a workaround for receiving
+ non-standard mesh A-MSDU
+
+At least ath10k and ath11k supported hardware (maybe more) does not implement
+mesh A-MSDU aggregation in a standard compliant way.
+802.11-2020 9.3.2.2.2 declares that the Mesh Control field is part of the
+A-MSDU header. As such, its length must not be included in the subframe
+length field.
+Hardware affected by this bug treats the mesh control field as part of the
+MSDU data and sets the length accordingly.
+In order to avoid packet loss, keep track of which stations are affected
+by this and take it into account when converting A-MSDU to 802.3 + mesh control
+packets.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -6194,6 +6194,19 @@ static inline int ieee80211_data_to_8023
+ }
+ 
+ /**
++ * ieee80211_is_valid_amsdu - check if subframe lengths of an A-MSDU are valid
++ *
++ * This is used to detect non-standard A-MSDU frames, e.g. the ones generated
++ * by ath10k and ath11k, where the subframe length includes the length of the
++ * mesh control field.
++ *
++ * @skb: The input A-MSDU frame without any headers.
++ * @mesh_hdr: use standard compliant mesh A-MSDU subframe header
++ * Returns: true if subframe header lengths are valid for the @mesh_hdr mode
++ */
++bool ieee80211_is_valid_amsdu(struct sk_buff *skb, bool mesh_hdr);
++
++/**
+  * ieee80211_amsdu_to_8023s - decode an IEEE 802.11n A-MSDU frame
+  *
+  * Decode an IEEE 802.11 A-MSDU and convert it to a list of 802.3 frames.
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2899,7 +2899,6 @@ __ieee80211_rx_h_amsdu(struct ieee80211_
+ 	static ieee80211_rx_result res;
+ 	struct ethhdr ethhdr;
+ 	const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
+-	bool mesh = false;
+ 
+ 	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
+ 		check_da = NULL;
+@@ -2917,7 +2916,6 @@ __ieee80211_rx_h_amsdu(struct ieee80211_
+ 		case NL80211_IFTYPE_MESH_POINT:
+ 			check_sa = NULL;
+ 			check_da = NULL;
+-			mesh = true;
+ 			break;
+ 		default:
+ 			break;
+@@ -2932,10 +2930,21 @@ __ieee80211_rx_h_amsdu(struct ieee80211_
+ 					  data_offset, true))
+ 		return RX_DROP_UNUSABLE;
+ 
++	if (rx->sta && rx->sta->amsdu_mesh_control < 0) {
++		bool valid_std = ieee80211_is_valid_amsdu(skb, true);
++		bool valid_nonstd = ieee80211_is_valid_amsdu(skb, false);
++
++		if (valid_std && !valid_nonstd)
++			rx->sta->amsdu_mesh_control = 1;
++		else if (valid_nonstd && !valid_std)
++			rx->sta->amsdu_mesh_control = 0;
++	}
++
+ 	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
+ 				 rx->sdata->vif.type,
+ 				 rx->local->hw.extra_tx_headroom,
+-				 check_da, check_sa, mesh);
++				 check_da, check_sa,
++				 rx->sta->amsdu_mesh_control);
+ 
+ 	while (!skb_queue_empty(&frame_list)) {
+ 		rx->skb = __skb_dequeue(&frame_list);
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -591,6 +591,9 @@ __sta_info_alloc(struct ieee80211_sub_if
+ 
+ 	sta->sta_state = IEEE80211_STA_NONE;
+ 
++	if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
++		sta->amsdu_mesh_control = -1;
++
+ 	/* Mark TID as unreserved */
+ 	sta->reserved_tid = IEEE80211_TID_UNRESERVED;
+ 
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -702,6 +702,7 @@ struct sta_info {
+ 	struct codel_params cparams;
+ 
+ 	u8 reserved_tid;
++	s8 amsdu_mesh_control;
+ 
+ 	struct cfg80211_chan_def tdls_chandef;
+ 
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -776,6 +776,38 @@ __ieee80211_amsdu_copy(struct sk_buff *s
+ 	return frame;
+ }
+ 
++bool ieee80211_is_valid_amsdu(struct sk_buff *skb, bool mesh_hdr)
++{
++	int offset = 0, remaining, subframe_len, padding;
++
++	for (offset = 0; offset < skb->len; offset += subframe_len + padding) {
++		struct {
++		    __be16 len;
++		    u8 mesh_flags;
++		} hdr;
++		u16 len;
++
++		if (skb_copy_bits(skb, offset + 2 * ETH_ALEN, &hdr, sizeof(hdr)) < 0)
++			return false;
++
++		if (mesh_hdr)
++			len = le16_to_cpu(*(__le16 *)&hdr.len) +
++			      __ieee80211_get_mesh_hdrlen(hdr.mesh_flags);
++		else
++			len = ntohs(hdr.len);
++
++		subframe_len = sizeof(struct ethhdr) + len;
++		padding = (4 - subframe_len) & 0x3;
++		remaining = skb->len - offset;
++
++		if (subframe_len > remaining)
++			return false;
++	}
++
++	return true;
++}
++EXPORT_SYMBOL(ieee80211_is_valid_amsdu);
++
+ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
+ 			      const u8 *addr, enum nl80211_iftype iftype,
+ 			      const unsigned int extra_headroom,
diff --git a/package/kernel/mac80211/patches/subsys/318-wifi-mac80211-fix-race-in-mesh-sequence-number-assig.patch b/package/kernel/mac80211/patches/subsys/318-wifi-mac80211-fix-race-in-mesh-sequence-number-assig.patch
new file mode 100644
index 00000000000000..7d01ffdfff0a20
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/318-wifi-mac80211-fix-race-in-mesh-sequence-number-assig.patch
@@ -0,0 +1,37 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 15 Feb 2023 15:21:37 +0100
+Subject: [PATCH] wifi: mac80211: fix race in mesh sequence number
+ assignment
+
+Since the sequence number is shared across different tx queues, it needs
+to be atomic in order to avoid accidental duplicate assignment
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -696,7 +696,7 @@ struct ieee80211_if_mesh {
+ 	struct mesh_stats mshstats;
+ 	struct mesh_config mshcfg;
+ 	atomic_t estab_plinks;
+-	u32 mesh_seqnum;
++	atomic_t mesh_seqnum;
+ 	bool accepting_plinks;
+ 	int num_gates;
+ 	struct beacon_data __rcu *beacon;
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -752,10 +752,8 @@ unsigned int ieee80211_new_mesh_header(s
+ 
+ 	meshhdr->ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
+ 
+-	/* FIXME: racy -- TX on multiple queues can be concurrent */
+-	put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &meshhdr->seqnum);
+-	sdata->u.mesh.mesh_seqnum++;
+-
++	put_unaligned_le32(atomic_inc_return(&sdata->u.mesh.mesh_seqnum),
++			   &meshhdr->seqnum);
+ 	if (addr4or5 && !addr6) {
+ 		meshhdr->flags |= MESH_FLAGS_AE_A4;
+ 		memcpy(meshhdr->eaddr1, addr4or5, ETH_ALEN);
diff --git a/package/kernel/mac80211/patches/subsys/319-wifi-mac80211-mesh-fast-xmit-support.patch b/package/kernel/mac80211/patches/subsys/319-wifi-mac80211-mesh-fast-xmit-support.patch
new file mode 100644
index 00000000000000..968d2885f2a987
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/319-wifi-mac80211-mesh-fast-xmit-support.patch
@@ -0,0 +1,850 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 26 Feb 2023 13:53:08 +0100
+Subject: [PATCH] wifi: mac80211: mesh fast xmit support
+
+Previously, fast xmit only worked on interface types where initially a
+sta lookup is performed, and a cached header can be attached to the sta,
+requiring only some fields to be updated at runtime.
+
+This technique is not directly applicable for a mesh device type due
+to the dynamic nature of the topology and protocol. There are more
+addresses that need to be filled, and there is an extra header with a
+dynamic length based on the addressing mode.
+
+Change the code to cache entries contain a copy of the mesh subframe header +
+bridge tunnel header, as well as an embedded struct ieee80211_fast_tx, which
+contains the information for building the 802.11 header.
+
+Add a mesh specific early fast xmit call, which looks up a cached entry and
+adds only the mesh subframe header, before passing it over to the generic
+fast xmit code.
+
+To ensure the changes in network are reflected in these cached headers,
+flush affected cached entries on path changes, as well as other conditions
+that currently trigger a fast xmit check in other modes (key changes etc.)
+
+This code is loosely based on a previous implementation by:
+Sriram R <quic_srirrama@quicinc.com>
+
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -37,6 +37,7 @@
+ extern const struct cfg80211_ops mac80211_config_ops;
+ 
+ struct ieee80211_local;
++struct ieee80211_mesh_fast_tx;
+ 
+ /* Maximum number of broadcast/multicast frames to buffer when some of the
+  * associated stations are using power saving. */
+@@ -656,6 +657,19 @@ struct mesh_table {
+ 	atomic_t entries;		/* Up to MAX_MESH_NEIGHBOURS */
+ };
+ 
++/**
++ * struct mesh_tx_cache - mesh fast xmit header cache
++ *
++ * @rht: hash table containing struct ieee80211_mesh_fast_tx, using skb DA as key
++ * @walk_head: linked list containing all ieee80211_mesh_fast_tx objects
++ * @walk_lock: lock protecting walk_head and rht
++ */
++struct mesh_tx_cache {
++	struct rhashtable rht;
++	struct hlist_head walk_head;
++	spinlock_t walk_lock;
++};
++
+ struct ieee80211_if_mesh {
+ 	struct timer_list housekeeping_timer;
+ 	struct timer_list mesh_path_timer;
+@@ -734,6 +748,7 @@ struct ieee80211_if_mesh {
+ 	struct mesh_table mpp_paths; /* Store paths for MPP&MAP */
+ 	int mesh_paths_generation;
+ 	int mpp_paths_generation;
++	struct mesh_tx_cache tx_cache;
+ };
+ 
+ #ifdef CPTCFG_MAC80211_MESH
+@@ -2002,6 +2017,11 @@ int ieee80211_tx_control_port(struct wip
+ 			      int link_id, u64 *cookie);
+ int ieee80211_probe_mesh_link(struct wiphy *wiphy, struct net_device *dev,
+ 			      const u8 *buf, size_t len);
++void __ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
++			   struct sta_info *sta,
++			   struct ieee80211_fast_tx *fast_tx,
++			   struct sk_buff *skb, bool ampdu,
++			   const u8 *da, const u8 *sa);
+ 
+ /* HT */
+ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -10,6 +10,7 @@
+ #include <asm/unaligned.h>
+ #include "ieee80211_i.h"
+ #include "mesh.h"
++#include "wme.h"
+ #include "driver-ops.h"
+ 
+ static int mesh_allocated;
+@@ -698,6 +699,95 @@ ieee80211_mesh_update_bss_params(struct
+ 			__le32_to_cpu(he_oper->he_oper_params);
+ }
+ 
++bool ieee80211_mesh_xmit_fast(struct ieee80211_sub_if_data *sdata,
++			      struct sk_buff *skb, u32 ctrl_flags)
++{
++	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
++	struct ieee80211_mesh_fast_tx *entry;
++	struct ieee80211s_hdr *meshhdr;
++	u8 sa[ETH_ALEN] __aligned(2);
++	struct tid_ampdu_tx *tid_tx;
++	struct sta_info *sta;
++	bool copy_sa = false;
++	u16 ethertype;
++	u8 tid;
++
++	if (ctrl_flags & IEEE80211_TX_CTRL_SKIP_MPATH_LOOKUP)
++		return false;
++
++	if (ifmsh->mshcfg.dot11MeshNolearn)
++		return false;
++
++	/* Add support for these cases later */
++	if (ifmsh->ps_peers_light_sleep || ifmsh->ps_peers_deep_sleep)
++		return false;
++
++	if (is_multicast_ether_addr(skb->data))
++		return false;
++
++	ethertype = (skb->data[12] << 8) | skb->data[13];
++	if (ethertype < ETH_P_802_3_MIN)
++		return false;
++
++	if (skb->sk && skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)
++		return false;
++
++	if (skb->ip_summed == CHECKSUM_PARTIAL) {
++		skb_set_transport_header(skb, skb_checksum_start_offset(skb));
++		if (skb_checksum_help(skb))
++			return false;
++	}
++
++	entry = mesh_fast_tx_get(sdata, skb->data);
++	if (!entry)
++		return false;
++
++	if (skb_headroom(skb) < entry->hdrlen + entry->fast_tx.hdr_len)
++		return false;
++
++	sta = rcu_dereference(entry->mpath->next_hop);
++	if (!sta)
++		return false;
++
++	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
++	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
++	if (tid_tx) {
++		if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
++			return false;
++		if (tid_tx->timeout)
++			tid_tx->last_tx = jiffies;
++	}
++
++	skb = skb_share_check(skb, GFP_ATOMIC);
++	if (!skb)
++		return true;
++
++	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
++
++	meshhdr = (struct ieee80211s_hdr *)entry->hdr;
++	if ((meshhdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6) {
++		/* preserve SA from eth header for 6-addr frames */
++		ether_addr_copy(sa, skb->data + ETH_ALEN);
++		copy_sa = true;
++	}
++
++	memcpy(skb_push(skb, entry->hdrlen - 2 * ETH_ALEN), entry->hdr,
++	       entry->hdrlen);
++
++	meshhdr = (struct ieee80211s_hdr *)skb->data;
++	put_unaligned_le32(atomic_inc_return(&sdata->u.mesh.mesh_seqnum),
++			   &meshhdr->seqnum);
++	meshhdr->ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
++	if (copy_sa)
++	    ether_addr_copy(meshhdr->eaddr2, sa);
++
++	skb_push(skb, 2 * ETH_ALEN);
++	__ieee80211_xmit_fast(sdata, sta, &entry->fast_tx, skb, tid_tx,
++			      entry->mpath->dst, sdata->vif.addr);
++
++	return true;
++}
++
+ /**
+  * ieee80211_fill_mesh_addresses - fill addresses of a locally originated mesh frame
+  * @hdr:	802.11 frame header
+@@ -780,6 +870,8 @@ static void ieee80211_mesh_housekeeping(
+ 	changed = mesh_accept_plinks_update(sdata);
+ 	ieee80211_mbss_info_change_notify(sdata, changed);
+ 
++	mesh_fast_tx_gc(sdata);
++
+ 	mod_timer(&ifmsh->housekeeping_timer,
+ 		  round_jiffies(jiffies +
+ 				IEEE80211_MESH_HOUSEKEEPING_INTERVAL));
+--- a/net/mac80211/mesh.h
++++ b/net/mac80211/mesh.h
+@@ -122,11 +122,41 @@ struct mesh_path {
+ 	u8 rann_snd_addr[ETH_ALEN];
+ 	u32 rann_metric;
+ 	unsigned long last_preq_to_root;
++	unsigned long fast_tx_check;
+ 	bool is_root;
+ 	bool is_gate;
+ 	u32 path_change_count;
+ };
+ 
++#define MESH_FAST_TX_CACHE_MAX_SIZE		512
++#define MESH_FAST_TX_CACHE_THRESHOLD_SIZE	384
++#define MESH_FAST_TX_CACHE_TIMEOUT		8000 /* msecs */
++
++/**
++ * struct ieee80211_mesh_fast_tx - cached mesh fast tx entry
++ * @rhash: rhashtable pointer
++ * @addr_key: The Ethernet DA which is the key for this entry
++ * @fast_tx: base fast_tx data
++ * @hdr: cached mesh and rfc1042 headers
++ * @hdrlen: length of mesh + rfc1042
++ * @walk_list: list containing all the fast tx entries
++ * @mpath: mesh path corresponding to the Mesh DA
++ * @mppath: MPP entry corresponding to this DA
++ * @timestamp: Last used time of this entry
++ */
++struct ieee80211_mesh_fast_tx {
++	struct rhash_head rhash;
++	u8 addr_key[ETH_ALEN] __aligned(2);
++
++	struct ieee80211_fast_tx fast_tx;
++	u8 hdr[sizeof(struct ieee80211s_hdr) + sizeof(rfc1042_header)];
++	u16 hdrlen;
++
++	struct mesh_path *mpath, *mppath;
++	struct hlist_node walk_list;
++	unsigned long timestamp;
++};
++
+ /* Recent multicast cache */
+ /* RMC_BUCKETS must be a power of 2, maximum 256 */
+ #define RMC_BUCKETS		256
+@@ -298,6 +328,20 @@ void mesh_path_discard_frame(struct ieee
+ void mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata);
+ 
+ bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt);
++struct ieee80211_mesh_fast_tx *
++mesh_fast_tx_get(struct ieee80211_sub_if_data *sdata, const u8 *addr);
++bool ieee80211_mesh_xmit_fast(struct ieee80211_sub_if_data *sdata,
++			      struct sk_buff *skb, u32 ctrl_flags);
++void mesh_fast_tx_cache(struct ieee80211_sub_if_data *sdata,
++			struct sk_buff *skb, struct mesh_path *mpath);
++void mesh_fast_tx_gc(struct ieee80211_sub_if_data *sdata);
++void mesh_fast_tx_flush_addr(struct ieee80211_sub_if_data *sdata,
++			     const u8 *addr);
++void mesh_fast_tx_flush_mpath(struct mesh_path *mpath);
++void mesh_fast_tx_flush_sta(struct ieee80211_sub_if_data *sdata,
++			    struct sta_info *sta);
++void mesh_path_refresh(struct ieee80211_sub_if_data *sdata,
++		       struct mesh_path *mpath, const u8 *addr);
+ 
+ #ifdef CPTCFG_MAC80211_MESH
+ static inline
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -394,6 +394,7 @@ static u32 hwmp_route_info_get(struct ie
+ 	u32 orig_sn, orig_metric;
+ 	unsigned long orig_lifetime, exp_time;
+ 	u32 last_hop_metric, new_metric;
++	bool flush_mpath = false;
+ 	bool process = true;
+ 	u8 hopcount;
+ 
+@@ -491,8 +492,10 @@ static u32 hwmp_route_info_get(struct ie
+ 		}
+ 
+ 		if (fresh_info) {
+-			if (rcu_access_pointer(mpath->next_hop) != sta)
++			if (rcu_access_pointer(mpath->next_hop) != sta) {
+ 				mpath->path_change_count++;
++				flush_mpath = true;
++			}
+ 			mesh_path_assign_nexthop(mpath, sta);
+ 			mpath->flags |= MESH_PATH_SN_VALID;
+ 			mpath->metric = new_metric;
+@@ -502,6 +505,8 @@ static u32 hwmp_route_info_get(struct ie
+ 			mpath->hop_count = hopcount;
+ 			mesh_path_activate(mpath);
+ 			spin_unlock_bh(&mpath->state_lock);
++			if (flush_mpath)
++				mesh_fast_tx_flush_mpath(mpath);
+ 			ewma_mesh_fail_avg_init(&sta->mesh->fail_avg);
+ 			/* init it at a low value - 0 start is tricky */
+ 			ewma_mesh_fail_avg_add(&sta->mesh->fail_avg, 1);
+@@ -539,8 +544,10 @@ static u32 hwmp_route_info_get(struct ie
+ 		}
+ 
+ 		if (fresh_info) {
+-			if (rcu_access_pointer(mpath->next_hop) != sta)
++			if (rcu_access_pointer(mpath->next_hop) != sta) {
+ 				mpath->path_change_count++;
++				flush_mpath = true;
++			}
+ 			mesh_path_assign_nexthop(mpath, sta);
+ 			mpath->metric = last_hop_metric;
+ 			mpath->exp_time = time_after(mpath->exp_time, exp_time)
+@@ -548,6 +555,8 @@ static u32 hwmp_route_info_get(struct ie
+ 			mpath->hop_count = 1;
+ 			mesh_path_activate(mpath);
+ 			spin_unlock_bh(&mpath->state_lock);
++			if (flush_mpath)
++				mesh_fast_tx_flush_mpath(mpath);
+ 			ewma_mesh_fail_avg_init(&sta->mesh->fail_avg);
+ 			/* init it at a low value - 0 start is tricky */
+ 			ewma_mesh_fail_avg_add(&sta->mesh->fail_avg, 1);
+@@ -1215,6 +1224,20 @@ static int mesh_nexthop_lookup_nolearn(s
+ 	return 0;
+ }
+ 
++void mesh_path_refresh(struct ieee80211_sub_if_data *sdata,
++		       struct mesh_path *mpath, const u8 *addr)
++{
++	if (mpath->flags & (MESH_PATH_REQ_QUEUED | MESH_PATH_FIXED |
++			    MESH_PATH_RESOLVING))
++		return;
++
++	if (time_after(jiffies,
++		       mpath->exp_time -
++		       msecs_to_jiffies(sdata->u.mesh.mshcfg.path_refresh_time)) &&
++	    (!addr || ether_addr_equal(sdata->vif.addr, addr)))
++		mesh_queue_preq(mpath, PREQ_Q_F_START | PREQ_Q_F_REFRESH);
++}
++
+ /**
+  * mesh_nexthop_lookup - put the appropriate next hop on a mesh frame. Calling
+  * this function is considered "using" the associated mpath, so preempt a path
+@@ -1242,19 +1265,15 @@ int mesh_nexthop_lookup(struct ieee80211
+ 	if (!mpath || !(mpath->flags & MESH_PATH_ACTIVE))
+ 		return -ENOENT;
+ 
+-	if (time_after(jiffies,
+-		       mpath->exp_time -
+-		       msecs_to_jiffies(sdata->u.mesh.mshcfg.path_refresh_time)) &&
+-	    ether_addr_equal(sdata->vif.addr, hdr->addr4) &&
+-	    !(mpath->flags & MESH_PATH_RESOLVING) &&
+-	    !(mpath->flags & MESH_PATH_FIXED))
+-		mesh_queue_preq(mpath, PREQ_Q_F_START | PREQ_Q_F_REFRESH);
++	mesh_path_refresh(sdata, mpath, hdr->addr4);
+ 
+ 	next_hop = rcu_dereference(mpath->next_hop);
+ 	if (next_hop) {
+ 		memcpy(hdr->addr1, next_hop->sta.addr, ETH_ALEN);
+ 		memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
+ 		ieee80211_mps_set_frame_flags(sdata, next_hop, hdr);
++		if (ieee80211_hw_check(&sdata->local->hw, SUPPORT_FAST_XMIT))
++			mesh_fast_tx_cache(sdata, skb, mpath);
+ 		return 0;
+ 	}
+ 
+--- a/net/mac80211/mesh_pathtbl.c
++++ b/net/mac80211/mesh_pathtbl.c
+@@ -14,6 +14,7 @@
+ #include "wme.h"
+ #include "ieee80211_i.h"
+ #include "mesh.h"
++#include <linux/rhashtable.h>
+ 
+ static void mesh_path_free_rcu(struct mesh_table *tbl, struct mesh_path *mpath);
+ 
+@@ -32,6 +33,41 @@ static const struct rhashtable_params me
+ 	.hashfn = mesh_table_hash,
+ };
+ 
++static const struct rhashtable_params fast_tx_rht_params = {
++	.nelem_hint = 10,
++	.automatic_shrinking = true,
++	.key_len = ETH_ALEN,
++	.key_offset = offsetof(struct ieee80211_mesh_fast_tx, addr_key),
++	.head_offset = offsetof(struct ieee80211_mesh_fast_tx, rhash),
++	.hashfn = mesh_table_hash,
++};
++
++static void __mesh_fast_tx_entry_free(void *ptr, void *tblptr)
++{
++	struct ieee80211_mesh_fast_tx *entry = ptr;
++
++	kfree_rcu(entry, fast_tx.rcu_head);
++}
++
++static void mesh_fast_tx_deinit(struct ieee80211_sub_if_data *sdata)
++{
++	struct mesh_tx_cache *cache;
++
++	cache = &sdata->u.mesh.tx_cache;
++	rhashtable_free_and_destroy(&cache->rht,
++				    __mesh_fast_tx_entry_free, NULL);
++}
++
++static void mesh_fast_tx_init(struct ieee80211_sub_if_data *sdata)
++{
++	struct mesh_tx_cache *cache;
++
++	cache = &sdata->u.mesh.tx_cache;
++	rhashtable_init(&cache->rht, &fast_tx_rht_params);
++	INIT_HLIST_HEAD(&cache->walk_head);
++	spin_lock_init(&cache->walk_lock);
++}
++
+ static inline bool mpath_expired(struct mesh_path *mpath)
+ {
+ 	return (mpath->flags & MESH_PATH_ACTIVE) &&
+@@ -381,6 +417,243 @@ struct mesh_path *mesh_path_new(struct i
+ 	return new_mpath;
+ }
+ 
++static void mesh_fast_tx_entry_free(struct mesh_tx_cache *cache,
++				    struct ieee80211_mesh_fast_tx *entry)
++{
++	hlist_del_rcu(&entry->walk_list);
++	rhashtable_remove_fast(&cache->rht, &entry->rhash, fast_tx_rht_params);
++	kfree_rcu(entry, fast_tx.rcu_head);
++}
++
++struct ieee80211_mesh_fast_tx *
++mesh_fast_tx_get(struct ieee80211_sub_if_data *sdata, const u8 *addr)
++{
++	struct ieee80211_mesh_fast_tx *entry;
++	struct mesh_tx_cache *cache;
++
++	cache = &sdata->u.mesh.tx_cache;
++	entry = rhashtable_lookup(&cache->rht, addr, fast_tx_rht_params);
++	if (!entry)
++		return NULL;
++
++	if (!(entry->mpath->flags & MESH_PATH_ACTIVE) ||
++	    mpath_expired(entry->mpath)) {
++		spin_lock_bh(&cache->walk_lock);
++		entry = rhashtable_lookup(&cache->rht, addr, fast_tx_rht_params);
++		if (entry)
++		    mesh_fast_tx_entry_free(cache, entry);
++		spin_unlock_bh(&cache->walk_lock);
++		return NULL;
++	}
++
++	mesh_path_refresh(sdata, entry->mpath, NULL);
++	if (entry->mppath)
++		entry->mppath->exp_time = jiffies;
++	entry->timestamp = jiffies;
++
++	return entry;
++}
++
++void mesh_fast_tx_cache(struct ieee80211_sub_if_data *sdata,
++			struct sk_buff *skb, struct mesh_path *mpath)
++{
++	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
++	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++	struct ieee80211_mesh_fast_tx *entry, *prev;
++	struct ieee80211_mesh_fast_tx build = {};
++	struct ieee80211s_hdr *meshhdr;
++	struct mesh_tx_cache *cache;
++	struct ieee80211_key *key;
++	struct mesh_path *mppath;
++	struct sta_info *sta;
++	u8 *qc;
++
++	if (sdata->noack_map ||
++	    !ieee80211_is_data_qos(hdr->frame_control))
++		return;
++
++	build.fast_tx.hdr_len = ieee80211_hdrlen(hdr->frame_control);
++	meshhdr = (struct ieee80211s_hdr *)(skb->data + build.fast_tx.hdr_len);
++	build.hdrlen = ieee80211_get_mesh_hdrlen(meshhdr);
++
++	cache = &sdata->u.mesh.tx_cache;
++	if (atomic_read(&cache->rht.nelems) >= MESH_FAST_TX_CACHE_MAX_SIZE)
++		return;
++
++	sta = rcu_dereference(mpath->next_hop);
++	if (!sta)
++		return;
++
++	if ((meshhdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6) {
++		/* This is required to keep the mppath alive */
++		mppath = mpp_path_lookup(sdata, meshhdr->eaddr1);
++		if (!mppath)
++			return;
++		build.mppath = mppath;
++	} else if (ieee80211_has_a4(hdr->frame_control)) {
++		mppath = mpath;
++	} else {
++		return;
++	}
++
++	/* rate limit, in case fast xmit can't be enabled */
++	if (mppath->fast_tx_check == jiffies)
++		return;
++
++	mppath->fast_tx_check = jiffies;
++
++	/*
++	 * Same use of the sta lock as in ieee80211_check_fast_xmit, in order
++	 * to protect against concurrent sta key updates.
++	 */
++	spin_lock_bh(&sta->lock);
++	key = rcu_access_pointer(sta->ptk[sta->ptk_idx]);
++	if (!key)
++		key = rcu_access_pointer(sdata->default_unicast_key);
++	build.fast_tx.key = key;
++
++	if (key) {
++		bool gen_iv, iv_spc;
++
++		gen_iv = key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV;
++		iv_spc = key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE;
++
++		if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) ||
++		    (key->flags & KEY_FLAG_TAINTED))
++			goto unlock_sta;
++
++		switch (key->conf.cipher) {
++		case WLAN_CIPHER_SUITE_CCMP:
++		case WLAN_CIPHER_SUITE_CCMP_256:
++			if (gen_iv)
++				build.fast_tx.pn_offs = build.fast_tx.hdr_len;
++			if (gen_iv || iv_spc)
++				build.fast_tx.hdr_len += IEEE80211_CCMP_HDR_LEN;
++			break;
++		case WLAN_CIPHER_SUITE_GCMP:
++		case WLAN_CIPHER_SUITE_GCMP_256:
++			if (gen_iv)
++				build.fast_tx.pn_offs = build.fast_tx.hdr_len;
++			if (gen_iv || iv_spc)
++				build.fast_tx.hdr_len += IEEE80211_GCMP_HDR_LEN;
++			break;
++		default:
++			goto unlock_sta;
++		}
++	}
++
++	memcpy(build.addr_key, mppath->dst, ETH_ALEN);
++	build.timestamp = jiffies;
++	build.fast_tx.band = info->band;
++	build.fast_tx.da_offs = offsetof(struct ieee80211_hdr, addr3);
++	build.fast_tx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
++	build.mpath = mpath;
++	memcpy(build.hdr, meshhdr, build.hdrlen);
++	memcpy(build.hdr + build.hdrlen, rfc1042_header, sizeof(rfc1042_header));
++	build.hdrlen += sizeof(rfc1042_header);
++	memcpy(build.fast_tx.hdr, hdr, build.fast_tx.hdr_len);
++
++	hdr = (struct ieee80211_hdr *)build.fast_tx.hdr;
++	if (build.fast_tx.key)
++		hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
++
++	qc = ieee80211_get_qos_ctl(hdr);
++	qc[1] |= IEEE80211_QOS_CTL_MESH_CONTROL_PRESENT >> 8;
++
++	entry = kmemdup(&build, sizeof(build), GFP_ATOMIC);
++	if (!entry)
++		goto unlock_sta;
++
++	spin_lock(&cache->walk_lock);
++	prev = rhashtable_lookup_get_insert_fast(&cache->rht,
++						 &entry->rhash,
++						 fast_tx_rht_params);
++	if (unlikely(IS_ERR(prev))) {
++		kfree(entry);
++		goto unlock_cache;
++	}
++
++	/*
++	 * replace any previous entry in the hash table, in case we're
++	 * replacing it with a different type (e.g. mpath -> mpp)
++	 */
++	if (unlikely(prev)) {
++		rhashtable_replace_fast(&cache->rht, &prev->rhash,
++					&entry->rhash, fast_tx_rht_params);
++		hlist_del_rcu(&prev->walk_list);
++		kfree_rcu(prev, fast_tx.rcu_head);
++	}
++
++	hlist_add_head(&entry->walk_list, &cache->walk_head);
++
++unlock_cache:
++	spin_unlock(&cache->walk_lock);
++unlock_sta:
++	spin_unlock_bh(&sta->lock);
++}
++
++void mesh_fast_tx_gc(struct ieee80211_sub_if_data *sdata)
++{
++	unsigned long timeout = msecs_to_jiffies(MESH_FAST_TX_CACHE_TIMEOUT);
++	struct mesh_tx_cache *cache;
++	struct ieee80211_mesh_fast_tx *entry;
++	struct hlist_node *n;
++
++	cache = &sdata->u.mesh.tx_cache;
++	if (atomic_read(&cache->rht.nelems) < MESH_FAST_TX_CACHE_THRESHOLD_SIZE)
++		return;
++
++	spin_lock_bh(&cache->walk_lock);
++	hlist_for_each_entry_safe(entry, n, &cache->walk_head, walk_list)
++		if (!time_is_after_jiffies(entry->timestamp + timeout))
++			mesh_fast_tx_entry_free(cache, entry);
++	spin_unlock_bh(&cache->walk_lock);
++}
++
++void mesh_fast_tx_flush_mpath(struct mesh_path *mpath)
++{
++	struct ieee80211_sub_if_data *sdata = mpath->sdata;
++	struct mesh_tx_cache *cache = &sdata->u.mesh.tx_cache;
++	struct ieee80211_mesh_fast_tx *entry;
++	struct hlist_node *n;
++
++	cache = &sdata->u.mesh.tx_cache;
++	spin_lock_bh(&cache->walk_lock);
++	hlist_for_each_entry_safe(entry, n, &cache->walk_head, walk_list)
++		if (entry->mpath == mpath)
++			mesh_fast_tx_entry_free(cache, entry);
++	spin_unlock_bh(&cache->walk_lock);
++}
++
++void mesh_fast_tx_flush_sta(struct ieee80211_sub_if_data *sdata,
++			    struct sta_info *sta)
++{
++	struct mesh_tx_cache *cache = &sdata->u.mesh.tx_cache;
++	struct ieee80211_mesh_fast_tx *entry;
++	struct hlist_node *n;
++
++	cache = &sdata->u.mesh.tx_cache;
++	spin_lock_bh(&cache->walk_lock);
++	hlist_for_each_entry_safe(entry, n, &cache->walk_head, walk_list)
++		if (rcu_access_pointer(entry->mpath->next_hop) == sta)
++			mesh_fast_tx_entry_free(cache, entry);
++	spin_unlock_bh(&cache->walk_lock);
++}
++
++void mesh_fast_tx_flush_addr(struct ieee80211_sub_if_data *sdata,
++			     const u8 *addr)
++{
++	struct mesh_tx_cache *cache = &sdata->u.mesh.tx_cache;
++	struct ieee80211_mesh_fast_tx *entry;
++
++	cache = &sdata->u.mesh.tx_cache;
++	spin_lock_bh(&cache->walk_lock);
++	entry = rhashtable_lookup(&cache->rht, addr, fast_tx_rht_params);
++	if (entry)
++		mesh_fast_tx_entry_free(cache, entry);
++	spin_unlock_bh(&cache->walk_lock);
++}
++
+ /**
+  * mesh_path_add - allocate and add a new path to the mesh path table
+  * @dst: destination address of the path (ETH_ALEN length)
+@@ -464,6 +737,8 @@ int mpp_path_add(struct ieee80211_sub_if
+ 
+ 	if (ret)
+ 		kfree(new_mpath);
++	else
++		mesh_fast_tx_flush_addr(sdata, dst);
+ 
+ 	sdata->u.mesh.mpp_paths_generation++;
+ 	return ret;
+@@ -523,6 +798,10 @@ static void __mesh_path_del(struct mesh_
+ {
+ 	hlist_del_rcu(&mpath->walk_list);
+ 	rhashtable_remove_fast(&tbl->rhead, &mpath->rhash, mesh_rht_params);
++	if (tbl == &mpath->sdata->u.mesh.mpp_paths)
++		mesh_fast_tx_flush_addr(mpath->sdata, mpath->dst);
++	else
++		mesh_fast_tx_flush_mpath(mpath);
+ 	mesh_path_free_rcu(tbl, mpath);
+ }
+ 
+@@ -747,6 +1026,7 @@ void mesh_path_fix_nexthop(struct mesh_p
+ 	mpath->exp_time = 0;
+ 	mpath->flags = MESH_PATH_FIXED | MESH_PATH_SN_VALID;
+ 	mesh_path_activate(mpath);
++	mesh_fast_tx_flush_mpath(mpath);
+ 	spin_unlock_bh(&mpath->state_lock);
+ 	ewma_mesh_fail_avg_init(&next_hop->mesh->fail_avg);
+ 	/* init it at a low value - 0 start is tricky */
+@@ -758,6 +1038,7 @@ void mesh_pathtbl_init(struct ieee80211_
+ {
+ 	mesh_table_init(&sdata->u.mesh.mesh_paths);
+ 	mesh_table_init(&sdata->u.mesh.mpp_paths);
++	mesh_fast_tx_init(sdata);
+ }
+ 
+ static
+@@ -785,6 +1066,7 @@ void mesh_path_expire(struct ieee80211_s
+ 
+ void mesh_pathtbl_unregister(struct ieee80211_sub_if_data *sdata)
+ {
++	mesh_fast_tx_deinit(sdata);
+ 	mesh_table_free(&sdata->u.mesh.mesh_paths);
+ 	mesh_table_free(&sdata->u.mesh.mpp_paths);
+ }
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2791,6 +2791,7 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 	if (mesh_hdr->flags & MESH_FLAGS_AE) {
+ 		struct mesh_path *mppath;
+ 		char *proxied_addr;
++		bool update = false;
+ 
+ 		if (multicast)
+ 			proxied_addr = mesh_hdr->eaddr1;
+@@ -2806,11 +2807,18 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 			mpp_path_add(sdata, proxied_addr, eth->h_source);
+ 		} else {
+ 			spin_lock_bh(&mppath->state_lock);
+-			if (!ether_addr_equal(mppath->mpp, eth->h_source))
++			if (!ether_addr_equal(mppath->mpp, eth->h_source)) {
+ 				memcpy(mppath->mpp, eth->h_source, ETH_ALEN);
++				update = true;
++			}
+ 			mppath->exp_time = jiffies;
+ 			spin_unlock_bh(&mppath->state_lock);
+ 		}
++
++		/* flush fast xmit cache if the address path changed */
++		if (update)
++			mesh_fast_tx_flush_addr(sdata, proxied_addr);
++
+ 		rcu_read_unlock();
+ 	}
+ 
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3022,6 +3022,9 @@ void ieee80211_check_fast_xmit(struct st
+ 	if (!ieee80211_hw_check(&local->hw, SUPPORT_FAST_XMIT))
+ 		return;
+ 
++	if (ieee80211_vif_is_mesh(&sdata->vif))
++		mesh_fast_tx_flush_sta(sdata, sta);
++
+ 	/* Locking here protects both the pointer itself, and against concurrent
+ 	 * invocations winning data access races to, e.g., the key pointer that
+ 	 * is used.
+@@ -3403,6 +3406,9 @@ static bool ieee80211_amsdu_aggregate(st
+ 	if (sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
+ 		return false;
+ 
++	if (ieee80211_vif_is_mesh(&sdata->vif))
++		return false;
++
+ 	if (skb_is_gso(skb))
+ 		return false;
+ 
+@@ -3635,10 +3641,11 @@ free:
+ 	return NULL;
+ }
+ 
+-static void __ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
+-				  struct sta_info *sta,
+-				  struct ieee80211_fast_tx *fast_tx,
+-				  struct sk_buff *skb, u8 tid, bool ampdu)
++void __ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
++			   struct sta_info *sta,
++			   struct ieee80211_fast_tx *fast_tx,
++			   struct sk_buff *skb, bool ampdu,
++			   const u8 *da, const u8 *sa)
+ {
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
+@@ -3647,7 +3654,6 @@ static void __ieee80211_xmit_fast(struct
+ 	ieee80211_tx_result r;
+ 	int hw_headroom = sdata->local->hw.extra_tx_headroom;
+ 	int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
+-	struct ethhdr eth;
+ 
+ 	skb = skb_share_check(skb, GFP_ATOMIC);
+ 	if (unlikely(!skb))
+@@ -3667,11 +3673,10 @@ static void __ieee80211_xmit_fast(struct
+ 					  ENCRYPT_NO)))
+ 		goto free;
+ 
+-	memcpy(&eth, skb->data, ETH_HLEN - 2);
+ 	hdr = skb_push(skb, extra_head);
+ 	memcpy(skb->data, fast_tx->hdr, fast_tx->hdr_len);
+-	memcpy(skb->data + fast_tx->da_offs, eth.h_dest, ETH_ALEN);
+-	memcpy(skb->data + fast_tx->sa_offs, eth.h_source, ETH_ALEN);
++	memcpy(skb->data + fast_tx->da_offs, da, ETH_ALEN);
++	memcpy(skb->data + fast_tx->sa_offs, sa, ETH_ALEN);
+ 
+ 	info = IEEE80211_SKB_CB(skb);
+ 	memset(info, 0, sizeof(*info));
+@@ -3690,7 +3695,8 @@ static void __ieee80211_xmit_fast(struct
+ #endif
+ 
+ 	if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
+-		tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
++		u8 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
++
+ 		*ieee80211_get_qos_ctl(hdr) = tid;
+ 	}
+ 
+@@ -3733,6 +3739,7 @@ static bool ieee80211_xmit_fast(struct i
+ 	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
+ 	struct tid_ampdu_tx *tid_tx = NULL;
+ 	struct sk_buff *next;
++	struct ethhdr eth;
+ 	u8 tid = IEEE80211_NUM_TIDS;
+ 
+ 	/* control port protocol needs a lot of special handling */
+@@ -3758,6 +3765,8 @@ static bool ieee80211_xmit_fast(struct i
+ 		}
+ 	}
+ 
++	memcpy(&eth, skb->data, ETH_HLEN - 2);
++
+ 	/* after this point (skb is modified) we cannot return false */
+ 	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
+ 	if (!skb)
+@@ -3765,7 +3774,8 @@ static bool ieee80211_xmit_fast(struct i
+ 
+ 	skb_list_walk_safe(skb, skb, next) {
+ 		skb_mark_not_on_list(skb);
+-		__ieee80211_xmit_fast(sdata, sta, fast_tx, skb, tid, tid_tx);
++		__ieee80211_xmit_fast(sdata, sta, fast_tx, skb, tid_tx,
++				      eth.h_dest, eth.h_source);
+ 	}
+ 
+ 	return true;
+@@ -4252,8 +4262,15 @@ void __ieee80211_subif_start_xmit(struct
+ 		return;
+ 	}
+ 
++	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
++
+ 	rcu_read_lock();
+ 
++	if (ieee80211_vif_is_mesh(&sdata->vif) &&
++	    ieee80211_hw_check(&local->hw, SUPPORT_FAST_XMIT) &&
++	    ieee80211_mesh_xmit_fast(sdata, skb, ctrl_flags))
++		goto out;
++
+ 	if (ieee80211_lookup_ra_sta(sdata, skb, &sta))
+ 		goto out_free;
+ 
+@@ -4263,8 +4280,6 @@ void __ieee80211_subif_start_xmit(struct
+ 	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
+ 	ieee80211_aggr_check(sdata, sta, skb);
+ 
+-	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
+-
+ 	if (sta) {
+ 		struct ieee80211_fast_tx *fast_tx;
+ 
diff --git a/package/kernel/mac80211/patches/subsys/320-wifi-mac80211-use-mesh-header-cache-to-speed-up-mesh.patch b/package/kernel/mac80211/patches/subsys/320-wifi-mac80211-use-mesh-header-cache-to-speed-up-mesh.patch
new file mode 100644
index 00000000000000..28b1ff110684ee
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/320-wifi-mac80211-use-mesh-header-cache-to-speed-up-mesh.patch
@@ -0,0 +1,132 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 16 Feb 2023 11:07:30 +0100
+Subject: [PATCH] wifi: mac80211: use mesh header cache to speed up mesh
+ forwarding
+
+Significantly reduces mesh forwarding path CPU usage and enables the
+direct use of iTXQ.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2720,6 +2720,65 @@ ieee80211_deliver_skb(struct ieee80211_r
+ 	}
+ }
+ 
++#ifdef CPTCFG_MAC80211_MESH
++static bool
++ieee80211_rx_mesh_fast_forward(struct ieee80211_sub_if_data *sdata,
++			       struct sk_buff *skb, int hdrlen)
++{
++	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
++	struct ieee80211_mesh_fast_tx *entry = NULL;
++	struct ieee80211s_hdr *mesh_hdr;
++	struct tid_ampdu_tx *tid_tx;
++	struct sta_info *sta;
++	struct ethhdr eth;
++	u8 tid;
++
++	mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(eth));
++	if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6)
++		entry = mesh_fast_tx_get(sdata, mesh_hdr->eaddr1);
++	else if (!(mesh_hdr->flags & MESH_FLAGS_AE))
++		entry = mesh_fast_tx_get(sdata, skb->data);
++	if (!entry)
++		return false;
++
++	sta = rcu_dereference(entry->mpath->next_hop);
++	if (!sta)
++		return false;
++
++	if (skb_linearize(skb))
++		return false;
++
++	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
++	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
++	if (tid_tx) {
++		if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
++			return false;
++
++		if (tid_tx->timeout)
++			tid_tx->last_tx = jiffies;
++	}
++
++	ieee80211_aggr_check(sdata, sta, skb);
++
++	if (ieee80211_get_8023_tunnel_proto(skb->data + hdrlen,
++					    &skb->protocol))
++		hdrlen += ETH_ALEN;
++	else
++		skb->protocol = htons(skb->len - hdrlen);
++	skb_set_network_header(skb, hdrlen + 2);
++
++	skb->dev = sdata->dev;
++	memcpy(&eth, skb->data, ETH_HLEN - 2);
++	skb_pull(skb, 2);
++	__ieee80211_xmit_fast(sdata, sta, &entry->fast_tx, skb, tid_tx,
++			      eth.h_dest, eth.h_source);
++	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
++	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
++
++	return true;
++}
++#endif
++
+ static ieee80211_rx_result
+ ieee80211_rx_mesh_data(struct ieee80211_sub_if_data *sdata, struct sta_info *sta,
+ 		       struct sk_buff *skb)
+@@ -2824,6 +2883,10 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 
+ 	skb_set_queue_mapping(skb, ieee802_1d_to_ac[skb->priority]);
+ 
++	if (!multicast &&
++	    ieee80211_rx_mesh_fast_forward(sdata, skb, mesh_hdrlen))
++		return RX_QUEUED;
++
+ 	ieee80211_fill_mesh_addresses(&hdr, &hdr.frame_control,
+ 				      eth->h_dest, eth->h_source);
+ 	hdrlen = ieee80211_hdrlen(hdr.frame_control);
+@@ -2862,6 +2925,7 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 	info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
+ 	info->control.vif = &sdata->vif;
+ 	info->control.jiffies = jiffies;
++	fwd_skb->dev = sdata->dev;
+ 	if (multicast) {
+ 		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
+ 		memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
+@@ -2883,7 +2947,6 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 	}
+ 
+ 	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
+-	fwd_skb->dev = sdata->dev;
+ 	ieee80211_add_pending_skb(local, fwd_skb);
+ 
+ rx_accept:
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -2022,6 +2022,8 @@ void __ieee80211_xmit_fast(struct ieee80
+ 			   struct ieee80211_fast_tx *fast_tx,
+ 			   struct sk_buff *skb, bool ampdu,
+ 			   const u8 *da, const u8 *sa);
++void ieee80211_aggr_check(struct ieee80211_sub_if_data *sdata,
++			  struct sta_info *sta, struct sk_buff *skb);
+ 
+ /* HT */
+ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1191,10 +1191,8 @@ static bool ieee80211_tx_prep_agg(struct
+ 	return queued;
+ }
+ 
+-static void
+-ieee80211_aggr_check(struct ieee80211_sub_if_data *sdata,
+-		     struct sta_info *sta,
+-		     struct sk_buff *skb)
++void ieee80211_aggr_check(struct ieee80211_sub_if_data *sdata,
++			  struct sta_info *sta, struct sk_buff *skb)
+ {
+ 	struct rate_control_ref *ref = sdata->local->rate_ctrl;
+ 	u16 tid;
diff --git a/package/kernel/mac80211/patches/subsys/321-mac80211-fix-mesh-forwarding.patch b/package/kernel/mac80211/patches/subsys/321-mac80211-fix-mesh-forwarding.patch
new file mode 100644
index 00000000000000..e2b268ae4c0e4f
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/321-mac80211-fix-mesh-forwarding.patch
@@ -0,0 +1,32 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 20 Feb 2023 12:50:50 +0100
+Subject: [PATCH] mac80211: fix mesh forwarding
+
+Linearize packets (needed for forwarding A-MSDU subframes).
+Fix network header offset to fix flow dissector (and fair queueing).
+
+Fixes: 986e43b19ae9 ("wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2904,6 +2904,9 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 
+ 		if (skb_cow_head(fwd_skb, hdrlen - sizeof(struct ethhdr)))
+ 			return RX_DROP_UNUSABLE;
++
++		if (skb_linearize(fwd_skb))
++			return RX_DROP_UNUSABLE;
+ 	}
+ 
+ 	fwd_hdr = skb_push(fwd_skb, hdrlen - sizeof(struct ethhdr));
+@@ -2918,7 +2921,7 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 		hdrlen += ETH_ALEN;
+ 	else
+ 		fwd_skb->protocol = htons(fwd_skb->len - hdrlen);
+-	skb_set_network_header(fwd_skb, hdrlen);
++	skb_set_network_header(fwd_skb, hdrlen + 2);
+ 
+ 	info = IEEE80211_SKB_CB(fwd_skb);
+ 	memset(info, 0, sizeof(*info));
diff --git a/package/kernel/mac80211/patches/subsys/322-wifi-mac80211-fix-mesh-path-discovery-based-on-unica.patch b/package/kernel/mac80211/patches/subsys/322-wifi-mac80211-fix-mesh-path-discovery-based-on-unica.patch
new file mode 100644
index 00000000000000..292a89ef9213fa
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/322-wifi-mac80211-fix-mesh-path-discovery-based-on-unica.patch
@@ -0,0 +1,52 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 26 Feb 2023 20:30:20 +0100
+Subject: [PATCH] wifi: mac80211: fix mesh path discovery based on unicast
+ packets
+
+If a packet has reached its intended destination, it was bumped to the code
+that accepts it, without first checking if a mesh_path needs to be created
+based on the discovered source.
+Fix this by moving the destination address check further down
+
+Fixes: 986e43b19ae9 ("wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2824,17 +2824,6 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 	    mesh_rmc_check(sdata, eth->h_source, mesh_hdr))
+ 		return RX_DROP_MONITOR;
+ 
+-	/* Frame has reached destination.  Don't forward */
+-	if (ether_addr_equal(sdata->vif.addr, eth->h_dest))
+-		goto rx_accept;
+-
+-	if (!ifmsh->mshcfg.dot11MeshForwarding) {
+-		if (is_multicast_ether_addr(eth->h_dest))
+-			goto rx_accept;
+-
+-		return RX_DROP_MONITOR;
+-	}
+-
+ 	/* forward packet */
+ 	if (sdata->crypto_tx_tailroom_needed_cnt)
+ 		tailroom = IEEE80211_ENCRYPT_TAILROOM;
+@@ -2881,6 +2870,17 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 		rcu_read_unlock();
+ 	}
+ 
++	/* Frame has reached destination.  Don't forward */
++	if (ether_addr_equal(sdata->vif.addr, eth->h_dest))
++		goto rx_accept;
++
++	if (!ifmsh->mshcfg.dot11MeshForwarding) {
++		if (is_multicast_ether_addr(eth->h_dest))
++			goto rx_accept;
++
++		return RX_DROP_MONITOR;
++	}
++
+ 	skb_set_queue_mapping(skb, ieee802_1d_to_ac[skb->priority]);
+ 
+ 	if (!multicast &&
diff --git a/package/kernel/mac80211/patches/subsys/323-v6.3-wifi-mac80211-Add-VHT-MU-MIMO-related-flags-in-ieee8.patch b/package/kernel/mac80211/patches/subsys/323-v6.3-wifi-mac80211-Add-VHT-MU-MIMO-related-flags-in-ieee8.patch
new file mode 100644
index 00000000000000..e23dc4d226a0af
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/323-v6.3-wifi-mac80211-Add-VHT-MU-MIMO-related-flags-in-ieee8.patch
@@ -0,0 +1,68 @@
+From: Muna Sinada <quic_msinada@quicinc.com>
+Date: Wed, 5 Oct 2022 14:54:45 -0700
+Subject: [PATCH] wifi: mac80211: Add VHT MU-MIMO related flags in
+ ieee80211_bss_conf
+
+Adding flags for SU Beamformer, SU Beamformee, MU Beamformer and
+MU Beamformee for VHT. This is utilized to pass MU-MIMO
+configurations from user space to driver in AP mode.
+
+Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
+Link: https://lore.kernel.org/r/1665006886-23874-1-git-send-email-quic_msinada@quicinc.com
+[fixed indentation, removed redundant !!]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -653,6 +653,14 @@ struct ieee80211_fils_discovery {
+  *	write-protected by sdata_lock and local->mtx so holding either is fine
+  *	for read access.
+  * @color_change_color: the bss color that will be used after the change.
++ * @vht_su_beamformer: in AP mode, does this BSS support operation as an VHT SU
++ *	beamformer
++ * @vht_su_beamformee: in AP mode, does this BSS support operation as an VHT SU
++ *	beamformee
++ * @vht_mu_beamformer: in AP mode, does this BSS support operation as an VHT MU
++ *	beamformer
++ * @vht_mu_beamformee: in AP mode, does this BSS support operation as an VHT MU
++ *	beamformee
+  */
+ struct ieee80211_bss_conf {
+ 	const u8 *bssid;
+@@ -726,6 +734,11 @@ struct ieee80211_bss_conf {
+ 
+ 	bool color_change_active;
+ 	u8 color_change_color;
++
++	bool vht_su_beamformer;
++	bool vht_su_beamformee;
++	bool vht_mu_beamformer;
++	bool vht_mu_beamformee;
+ };
+ 
+ /**
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1252,6 +1252,21 @@ static int ieee80211_start_ap(struct wip
+ 	prev_beacon_int = link_conf->beacon_int;
+ 	link_conf->beacon_int = params->beacon_interval;
+ 
++	if (params->vht_cap) {
++		link_conf->vht_su_beamformer =
++			params->vht_cap->vht_cap_info &
++				cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
++		link_conf->vht_su_beamformee =
++			params->vht_cap->vht_cap_info &
++				cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
++		link_conf->vht_mu_beamformer =
++			params->vht_cap->vht_cap_info &
++				cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE);
++		link_conf->vht_mu_beamformee =
++			params->vht_cap->vht_cap_info &
++				cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
++	}
++
+ 	if (params->he_cap && params->he_oper) {
+ 		link_conf->he_support = true;
+ 		link_conf->htc_trig_based_pkt_ext =
diff --git a/package/kernel/mac80211/patches/subsys/324-v6.3-wifi-mac80211-Add-HE-MU-MIMO-related-flags-in-ieee80.patch b/package/kernel/mac80211/patches/subsys/324-v6.3-wifi-mac80211-Add-HE-MU-MIMO-related-flags-in-ieee80.patch
new file mode 100644
index 00000000000000..f843dba1235cf0
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/324-v6.3-wifi-mac80211-Add-HE-MU-MIMO-related-flags-in-ieee80.patch
@@ -0,0 +1,68 @@
+From: Muna Sinada <quic_msinada@quicinc.com>
+Date: Wed, 5 Oct 2022 14:54:46 -0700
+Subject: [PATCH] wifi: mac80211: Add HE MU-MIMO related flags in
+ ieee80211_bss_conf
+
+Adding flags for SU Beamformer, SU Beamformee, MU Beamformer and Full
+Bandwidth UL MU-MIMO for HE. This is utilized to pass MU-MIMO
+configurations from user space to driver in AP mode.
+
+Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
+Link: https://lore.kernel.org/r/1665006886-23874-2-git-send-email-quic_msinada@quicinc.com
+[fixed indentation, removed redundant !!]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -661,6 +661,15 @@ struct ieee80211_fils_discovery {
+  *	beamformer
+  * @vht_mu_beamformee: in AP mode, does this BSS support operation as an VHT MU
+  *	beamformee
++ * @he_su_beamformer: in AP-mode, does this BSS support operation as an HE SU
++ *	beamformer
++ * @he_su_beamformee: in AP-mode, does this BSS support operation as an HE SU
++ *	beamformee
++ * @he_mu_beamformer: in AP-mode, does this BSS support operation as an HE MU
++ *	beamformer
++ * @he_full_ul_mumimo: does this BSS support the reception (AP) or transmission
++ *	(non-AP STA) of an HE TB PPDU on an RU that spans the entire PPDU
++ *	bandwidth
+  */
+ struct ieee80211_bss_conf {
+ 	const u8 *bssid;
+@@ -739,6 +748,10 @@ struct ieee80211_bss_conf {
+ 	bool vht_su_beamformee;
+ 	bool vht_mu_beamformer;
+ 	bool vht_mu_beamformee;
++	bool he_su_beamformer;
++	bool he_su_beamformee;
++	bool he_mu_beamformer;
++	bool he_full_ul_mumimo;
+ };
+ 
+ /**
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1281,6 +1281,21 @@ static int ieee80211_start_ap(struct wip
+ 			changed |= BSS_CHANGED_HE_BSS_COLOR;
+ 	}
+ 
++	if (params->he_cap) {
++		link_conf->he_su_beamformer =
++			params->he_cap->phy_cap_info[3] &
++				IEEE80211_HE_PHY_CAP3_SU_BEAMFORMER;
++		link_conf->he_su_beamformee =
++			params->he_cap->phy_cap_info[4] &
++				IEEE80211_HE_PHY_CAP4_SU_BEAMFORMEE;
++		link_conf->he_mu_beamformer =
++			params->he_cap->phy_cap_info[4] &
++				IEEE80211_HE_PHY_CAP4_MU_BEAMFORMER;
++		link_conf->he_full_ul_mumimo =
++			params->he_cap->phy_cap_info[2] &
++				IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO;
++	}
++
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP &&
+ 	    params->mbssid_config.tx_wdev) {
+ 		err = ieee80211_set_ap_mbssid_options(sdata,
diff --git a/package/kernel/mac80211/patches/subsys/325-wifi-mac80211-introduce-ieee80211_refresh_tx_agg_ses.patch b/package/kernel/mac80211/patches/subsys/325-wifi-mac80211-introduce-ieee80211_refresh_tx_agg_ses.patch
new file mode 100644
index 00000000000000..1be5fcfbfa18e8
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/325-wifi-mac80211-introduce-ieee80211_refresh_tx_agg_ses.patch
@@ -0,0 +1,60 @@
+From: Ryder Lee <ryder.lee@mediatek.com>
+Date: Sat, 18 Feb 2023 01:50:05 +0800
+Subject: [PATCH] wifi: mac80211: introduce
+ ieee80211_refresh_tx_agg_session_timer()
+
+This allows low level drivers to refresh the tx agg session timer, based on
+querying stats from the firmware usually. Especially for some mt76 devices
+support .net_fill_forward_path would bypass mac80211, which leads to tx BA
+session timeout for certain clients.
+
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -5964,6 +5964,18 @@ void ieee80211_queue_delayed_work(struct
+ 				  unsigned long delay);
+ 
+ /**
++ * ieee80211_refresh_tx_agg_session_timer - Refresh a tx agg session timer.
++ * @sta: the station for which to start a BA session
++ * @tid: the TID to BA on.
++ *
++ * This function allows low level driver to refresh tx agg session timer
++ * to maintain BA session, the session level will still be managed by the
++ * mac80211.
++ */
++void ieee80211_refresh_tx_agg_session_timer(struct ieee80211_sta *sta,
++					    u16 tid);
++
++/**
+  * ieee80211_start_tx_ba_session - Start a tx Block Ack session.
+  * @sta: the station for which to start a BA session
+  * @tid: the TID to BA on.
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -554,6 +554,23 @@ void ieee80211_tx_ba_session_handle_star
+ 	ieee80211_send_addba_with_timeout(sta, tid_tx);
+ }
+ 
++void ieee80211_refresh_tx_agg_session_timer(struct ieee80211_sta *pubsta,
++					    u16 tid)
++{
++	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
++	struct tid_ampdu_tx *tid_tx;
++
++	if (WARN_ON_ONCE(tid >= IEEE80211_NUM_TIDS))
++		return;
++
++	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
++	if (!tid_tx)
++		return;
++
++	tid_tx->last_tx = jiffies;
++}
++EXPORT_SYMBOL(ieee80211_refresh_tx_agg_session_timer);
++
+ /*
+  * After accepting the AddBA Response we activated a timer,
+  * resetting it after each frame that we send.
diff --git a/package/kernel/mac80211/patches/subsys/326-wifi-mac80211-add-mesh-fast-rx-support.patch b/package/kernel/mac80211/patches/subsys/326-wifi-mac80211-add-mesh-fast-rx-support.patch
new file mode 100644
index 00000000000000..11f39c2d109dec
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/326-wifi-mac80211-add-mesh-fast-rx-support.patch
@@ -0,0 +1,77 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 2 Mar 2023 13:52:29 +0100
+Subject: [PATCH] wifi: mac80211: add mesh fast-rx support
+
+This helps bring down rx CPU usage by avoiding calls to the rx handlers in
+the slow path. Supports forwarding and local rx, including A-MSDU.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -4564,6 +4564,12 @@ void ieee80211_check_fast_rx(struct sta_
+ 		}
+ 
+ 		break;
++	case NL80211_IFTYPE_MESH_POINT:
++		fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_FROMDS |
++						      IEEE80211_FCTL_TODS);
++		fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
++		fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
++		break;
+ 	default:
+ 		goto clear;
+ 	}
+@@ -4772,6 +4778,7 @@ static bool ieee80211_invoke_fast_rx(str
+ 	struct sk_buff *skb = rx->skb;
+ 	struct ieee80211_hdr *hdr = (void *)skb->data;
+ 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
++	static ieee80211_rx_result res;
+ 	int orig_len = skb->len;
+ 	int hdrlen = ieee80211_hdrlen(hdr->frame_control);
+ 	int snap_offs = hdrlen;
+@@ -4833,7 +4840,8 @@ static bool ieee80211_invoke_fast_rx(str
+ 		snap_offs += IEEE80211_CCMP_HDR_LEN;
+ 	}
+ 
+-	if (!(status->rx_flags & IEEE80211_RX_AMSDU)) {
++	if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&
++	    !(status->rx_flags & IEEE80211_RX_AMSDU)) {
+ 		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
+ 			return false;
+ 
+@@ -4872,13 +4880,29 @@ static bool ieee80211_invoke_fast_rx(str
+ 	/* do the header conversion - first grab the addresses */
+ 	ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
+ 	ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
+-	skb_postpull_rcsum(skb, skb->data + snap_offs,
+-			   sizeof(rfc1042_header) + 2);
+-	/* remove the SNAP but leave the ethertype */
+-	skb_pull(skb, snap_offs + sizeof(rfc1042_header));
++	if (ieee80211_vif_is_mesh(&rx->sdata->vif)) {
++	    skb_pull(skb, snap_offs - 2);
++	    put_unaligned_be16(skb->len - 2, skb->data);
++	} else {
++	    skb_postpull_rcsum(skb, skb->data + snap_offs,
++			       sizeof(rfc1042_header) + 2);
++
++	    /* remove the SNAP but leave the ethertype */
++	    skb_pull(skb, snap_offs + sizeof(rfc1042_header));
++	}
+ 	/* push the addresses in front */
+ 	memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs));
+ 
++	res = ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb);
++	switch (res) {
++	case RX_QUEUED:
++		return true;
++	case RX_CONTINUE:
++		break;
++	default:
++		goto drop;
++	}
++
+ 	ieee80211_rx_8023(rx, fast_rx, orig_len);
+ 
+ 	return true;
diff --git a/package/kernel/mac80211/patches/subsys/327-wifi-mac80211-add-support-for-letting-drivers-regist.patch b/package/kernel/mac80211/patches/subsys/327-wifi-mac80211-add-support-for-letting-drivers-regist.patch
new file mode 100644
index 00000000000000..ac290b5360a182
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/327-wifi-mac80211-add-support-for-letting-drivers-regist.patch
@@ -0,0 +1,149 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 20 Mar 2023 14:28:08 +0100
+Subject: [PATCH] wifi: mac80211: add support for letting drivers register tc
+ offload support
+
+On newer MediaTek SoCs (e.g. MT7986), WLAN->WLAN or WLAN->Ethernet flows can
+be offloaded by the SoC. In order to support that, the .ndo_setup_tc op is
+needed.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -4192,6 +4192,10 @@ struct ieee80211_prep_tx_info {
+  *	Note that a sta can also be inserted or removed with valid links,
+  *	i.e. passed to @sta_add/@sta_state with sta->valid_links not zero.
+  *	In fact, cannot change from having valid_links and not having them.
++ * @net_setup_tc: Called from .ndo_setup_tc in order to prepare hardware
++ *	flow offloading for flows originating from the vif.
++ *	Note that the driver must not assume that the vif driver_data is valid
++ *	at this point, since the callback can be called during netdev teardown.
+  */
+ struct ieee80211_ops {
+ 	void (*tx)(struct ieee80211_hw *hw,
+@@ -4547,6 +4551,11 @@ struct ieee80211_ops {
+ 				struct ieee80211_vif *vif,
+ 				struct ieee80211_sta *sta,
+ 				u16 old_links, u16 new_links);
++	int (*net_setup_tc)(struct ieee80211_hw *hw,
++			    struct ieee80211_vif *vif,
++			    struct net_device *dev,
++			    enum tc_setup_type type,
++			    void *type_data);
+ };
+ 
+ /**
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -1470,6 +1470,23 @@ static inline int drv_net_fill_forward_p
+ 	return ret;
+ }
+ 
++static inline int drv_net_setup_tc(struct ieee80211_local *local,
++				   struct ieee80211_sub_if_data *sdata,
++				   struct net_device *dev,
++				   enum tc_setup_type type, void *type_data)
++{
++	int ret = -EOPNOTSUPP;
++
++	sdata = get_bss_sdata(sdata);
++	trace_drv_net_setup_tc(local, sdata, type);
++	if (local->ops->net_setup_tc)
++		ret = local->ops->net_setup_tc(&local->hw, &sdata->vif, dev,
++					       type, type_data);
++	trace_drv_return_int(local, ret);
++
++	return ret;
++}
++
+ int drv_change_vif_links(struct ieee80211_local *local,
+ 			 struct ieee80211_sub_if_data *sdata,
+ 			 u16 old_links, u16 new_links,
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1939,7 +1939,8 @@ void ieee80211_color_collision_detection
+ /* interface handling */
+ #define MAC80211_SUPPORTED_FEATURES_TX	(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | \
+ 					 NETIF_F_HW_CSUM | NETIF_F_SG | \
+-					 NETIF_F_HIGHDMA | NETIF_F_GSO_SOFTWARE)
++					 NETIF_F_HIGHDMA | NETIF_F_GSO_SOFTWARE | \
++					 NETIF_F_HW_TC)
+ #define MAC80211_SUPPORTED_FEATURES_RX	(NETIF_F_RXCSUM)
+ #define MAC80211_SUPPORTED_FEATURES	(MAC80211_SUPPORTED_FEATURES_TX | \
+ 					 MAC80211_SUPPORTED_FEATURES_RX)
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -813,6 +813,21 @@ ieee80211_get_stats64(struct net_device
+ 	dev_fetch_sw_netstats(stats, dev->tstats);
+ }
+ 
++static int ieee80211_netdev_setup_tc(struct net_device *dev,
++				     enum tc_setup_type type, void *type_data)
++{
++	struct ieee80211_sub_if_data *sdata;
++	struct ieee80211_local *local;
++
++	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
++	local = sdata->local;
++
++	if (!local->ops->net_setup_tc)
++		return -EOPNOTSUPP;
++
++	return drv_net_setup_tc(local, sdata, dev, type, type_data);
++}
++
+ static const struct net_device_ops ieee80211_dataif_ops = {
+ 	.ndo_open		= ieee80211_open,
+ 	.ndo_stop		= ieee80211_stop,
+@@ -821,6 +836,7 @@ static const struct net_device_ops ieee8
+ 	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
+ 	.ndo_set_mac_address 	= ieee80211_change_mac,
+ 	.ndo_get_stats64	= ieee80211_get_stats64,
++	.ndo_setup_tc		= ieee80211_netdev_setup_tc,
+ };
+ 
+ static u16 ieee80211_monitor_select_queue(struct net_device *dev,
+@@ -929,6 +945,7 @@ static const struct net_device_ops ieee8
+ 	.ndo_set_mac_address	= ieee80211_change_mac,
+ 	.ndo_get_stats64	= ieee80211_get_stats64,
+ 	.ndo_fill_forward_path	= ieee80211_netdev_fill_forward_path,
++	.ndo_setup_tc		= ieee80211_netdev_setup_tc,
+ };
+ 
+ static bool ieee80211_iftype_supports_hdr_offload(enum nl80211_iftype iftype)
+--- a/net/mac80211/trace.h
++++ b/net/mac80211/trace.h
+@@ -2478,6 +2478,31 @@ DEFINE_EVENT(sta_event, drv_net_fill_for
+ 	TP_ARGS(local, sdata, sta)
+ );
+ 
++TRACE_EVENT(drv_net_setup_tc,
++	TP_PROTO(struct ieee80211_local *local,
++		 struct ieee80211_sub_if_data *sdata,
++		 u8 type),
++
++	TP_ARGS(local, sdata, type),
++
++	TP_STRUCT__entry(
++		LOCAL_ENTRY
++		VIF_ENTRY
++		__field(u8, type)
++	),
++
++	TP_fast_assign(
++		LOCAL_ASSIGN;
++		VIF_ASSIGN;
++		__entry->type = type;
++	),
++
++	TP_printk(
++		LOCAL_PR_FMT VIF_PR_FMT " type:%d\n",
++		LOCAL_PR_ARG, VIF_PR_ARG, __entry->type
++	)
++);
++
+ TRACE_EVENT(drv_change_vif_links,
+ 	TP_PROTO(struct ieee80211_local *local,
+ 		 struct ieee80211_sub_if_data *sdata,
diff --git a/package/kernel/mac80211/patches/subsys/329-wifi-mac80211-fix-receiving-mesh-packets-in-forwardi.patch b/package/kernel/mac80211/patches/subsys/329-wifi-mac80211-fix-receiving-mesh-packets-in-forwardi.patch
new file mode 100644
index 00000000000000..6882694da8e569
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/329-wifi-mac80211-fix-receiving-mesh-packets-in-forwardi.patch
@@ -0,0 +1,50 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 26 Mar 2023 17:11:34 +0200
+Subject: [PATCH] wifi: mac80211: fix receiving mesh packets in forwarding=0
+ networks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When forwarding is set to 0, frames are typically sent with ttl=1.
+Move the ttl decrement check below the check for local receive in order to
+fix packet drops.
+
+Reported-by: Thomas Hühn <thomas.huehn@hs-nordhausen.de>
+Reported-by: Nick Hainke <vincent@systemli.org>
+Fixes: 986e43b19ae9 ("wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2828,14 +2828,6 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 	if (sdata->crypto_tx_tailroom_needed_cnt)
+ 		tailroom = IEEE80211_ENCRYPT_TAILROOM;
+ 
+-	if (!--mesh_hdr->ttl) {
+-		if (multicast)
+-			goto rx_accept;
+-
+-		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
+-		return RX_DROP_MONITOR;
+-	}
+-
+ 	if (mesh_hdr->flags & MESH_FLAGS_AE) {
+ 		struct mesh_path *mppath;
+ 		char *proxied_addr;
+@@ -2874,6 +2866,14 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 	if (ether_addr_equal(sdata->vif.addr, eth->h_dest))
+ 		goto rx_accept;
+ 
++	if (!--mesh_hdr->ttl) {
++		if (multicast)
++			goto rx_accept;
++
++		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
++		return RX_DROP_MONITOR;
++	}
++
+ 	if (!ifmsh->mshcfg.dot11MeshForwarding) {
+ 		if (is_multicast_ether_addr(eth->h_dest))
+ 			goto rx_accept;
diff --git a/package/kernel/mac80211/patches/subsys/330-wifi-ieee80211-correctly-mark-FTM-frames-non-buffera.patch b/package/kernel/mac80211/patches/subsys/330-wifi-ieee80211-correctly-mark-FTM-frames-non-buffera.patch
new file mode 100644
index 00000000000000..079dd2a86865a0
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/330-wifi-ieee80211-correctly-mark-FTM-frames-non-buffera.patch
@@ -0,0 +1,134 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 29 Mar 2023 16:46:26 +0200
+Subject: [PATCH] wifi: ieee80211: correctly mark FTM frames non-bufferable
+
+The checks of whether or not a frame is bufferable were not
+taking into account that some action frames aren't, such as
+FTM. Check this, which requires some changes to the function
+ieee80211_is_bufferable_mmpdu() since we need the whole skb
+for the checks now.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Greenman, Gregory <gregory.greenman@intel.com>
+Reviewed-by: Peer, Ilan <ilan.peer@intel.com>
+---
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -601,8 +601,9 @@ static void iwl_mvm_skb_prepare_status(s
+ 
+ static int iwl_mvm_get_ctrl_vif_queue(struct iwl_mvm *mvm,
+ 				      struct ieee80211_tx_info *info,
+-				      struct ieee80211_hdr *hdr)
++				      struct sk_buff *skb)
+ {
++	struct ieee80211_hdr *hdr = (void *)skb->data;
+ 	struct iwl_mvm_vif *mvmvif =
+ 		iwl_mvm_vif_from_mac80211(info->control.vif);
+ 	__le16 fc = hdr->frame_control;
+@@ -621,7 +622,7 @@ static int iwl_mvm_get_ctrl_vif_queue(st
+ 		 * reason 7 ("Class 3 frame received from nonassociated STA").
+ 		 */
+ 		if (ieee80211_is_mgmt(fc) &&
+-		    (!ieee80211_is_bufferable_mmpdu(fc) ||
++		    (!ieee80211_is_bufferable_mmpdu(skb) ||
+ 		     ieee80211_is_deauth(fc) || ieee80211_is_disassoc(fc)))
+ 			return mvm->probe_queue;
+ 
+@@ -740,7 +741,7 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mv
+ 			else
+ 				sta_id = mvmvif->mcast_sta.sta_id;
+ 
+-			queue = iwl_mvm_get_ctrl_vif_queue(mvm, &info, hdr);
++			queue = iwl_mvm_get_ctrl_vif_queue(mvm, &info, skb);
+ 		} else if (info.control.vif->type == NL80211_IFTYPE_MONITOR) {
+ 			queue = mvm->snif_queue;
+ 			sta_id = mvm->snif_sta.sta_id;
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -772,20 +772,6 @@ static inline bool ieee80211_is_any_null
+ }
+ 
+ /**
+- * ieee80211_is_bufferable_mmpdu - check if frame is bufferable MMPDU
+- * @fc: frame control field in little-endian byteorder
+- */
+-static inline bool ieee80211_is_bufferable_mmpdu(__le16 fc)
+-{
+-	/* IEEE 802.11-2012, definition of "bufferable management frame";
+-	 * note that this ignores the IBSS special case. */
+-	return ieee80211_is_mgmt(fc) &&
+-	       (ieee80211_is_action(fc) ||
+-		ieee80211_is_disassoc(fc) ||
+-		ieee80211_is_deauth(fc));
+-}
+-
+-/**
+  * ieee80211_is_first_frag - check if IEEE80211_SCTL_FRAG is not set
+  * @seq_ctrl: frame sequence control bytes in little-endian byteorder
+  */
+@@ -4121,6 +4107,44 @@ static inline u8 *ieee80211_get_DA(struc
+ }
+ 
+ /**
++ * ieee80211_is_bufferable_mmpdu - check if frame is bufferable MMPDU
++ * @skb: the skb to check, starting with the 802.11 header
++ */
++static inline bool ieee80211_is_bufferable_mmpdu(struct sk_buff *skb)
++{
++	struct ieee80211_mgmt *mgmt = (void *)skb->data;
++	__le16 fc = mgmt->frame_control;
++
++	/*
++	 * IEEE 802.11 REVme D2.0 definition of bufferable MMPDU;
++	 * note that this ignores the IBSS special case.
++	 */
++	if (!ieee80211_is_mgmt(fc))
++		return false;
++
++	if (ieee80211_is_disassoc(fc) || ieee80211_is_deauth(fc))
++		return true;
++
++	if (!ieee80211_is_action(fc))
++		return false;
++
++	if (skb->len < offsetofend(typeof(*mgmt), u.action.u.ftm.action_code))
++		return true;
++
++	/* action frame - additionally check for non-bufferable FTM */
++
++	if (mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
++	    mgmt->u.action.category != WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION)
++		return true;
++
++	if (mgmt->u.action.u.ftm.action_code == WLAN_PUB_ACTION_FTM_REQUEST ||
++	    mgmt->u.action.u.ftm.action_code == WLAN_PUBLIC_ACTION_FTM_RESPONSE)
++		return false;
++
++	return true;
++}
++
++/**
+  * _ieee80211_is_robust_mgmt_frame - check if frame is a robust management frame
+  * @hdr: the frame (buffer must include at least the first octet of payload)
+  */
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -488,7 +488,7 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
+ 		int ac = skb_get_queue_mapping(tx->skb);
+ 
+ 		if (ieee80211_is_mgmt(hdr->frame_control) &&
+-		    !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) {
++		    !ieee80211_is_bufferable_mmpdu(tx->skb)) {
+ 			info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
+ 			return TX_CONTINUE;
+ 		}
+@@ -1326,7 +1326,7 @@ static struct txq_info *ieee80211_get_tx
+ 	if (!(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) &&
+ 	    unlikely(!ieee80211_is_data_present(hdr->frame_control))) {
+ 		if ((!ieee80211_is_mgmt(hdr->frame_control) ||
+-		     ieee80211_is_bufferable_mmpdu(hdr->frame_control) ||
++		     ieee80211_is_bufferable_mmpdu(skb) ||
+ 		     vif->type == NL80211_IFTYPE_STATION) &&
+ 		    sta && sta->uploaded) {
+ 			/*
diff --git a/package/kernel/mac80211/patches/subsys/331-wifi-mac80211-flush-queues-on-STA-removal.patch b/package/kernel/mac80211/patches/subsys/331-wifi-mac80211-flush-queues-on-STA-removal.patch
new file mode 100644
index 00000000000000..00232ec1b9e9f6
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/331-wifi-mac80211-flush-queues-on-STA-removal.patch
@@ -0,0 +1,36 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 13 Mar 2023 11:42:12 +0100
+Subject: [PATCH] wifi: mac80211: flush queues on STA removal
+
+When we remove a station, we first make it unreachable,
+then we (must) remove its keys, and then remove the
+station itself. Depending on the hardware design, if
+we have hardware crypto at all, frames still sitting
+on hardware queues may then be transmitted without a
+valid key, possibly unencrypted or with a fixed key.
+
+Fix this by flushing the queues when removing stations
+so this cannot happen.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Greenman, Gregory <gregory.greenman@intel.com>
+---
+
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1271,6 +1271,14 @@ static void __sta_info_destroy_part2(str
+ 		WARN_ON_ONCE(ret);
+ 	}
+ 
++	/* Flush queues before removing keys, as that might remove them
++	 * from hardware, and then depending on the offload method, any
++	 * frames sitting on hardware queues might be sent out without
++	 * any encryption at all.
++	 */
++	if (local->ops->set_key)
++		ieee80211_flush_queues(local, sta->sdata, false);
++
+ 	/* now keys can no longer be reached */
+ 	ieee80211_free_sta_keys(local, sta);
+ 
diff --git a/package/kernel/mac80211/patches/subsys/332-wifi-iwlwifi-mvm-support-flush-on-AP-interfaces.patch b/package/kernel/mac80211/patches/subsys/332-wifi-iwlwifi-mvm-support-flush-on-AP-interfaces.patch
new file mode 100644
index 00000000000000..3c31dfeddc8eba
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/332-wifi-iwlwifi-mvm-support-flush-on-AP-interfaces.patch
@@ -0,0 +1,34 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 13 Mar 2023 12:02:58 +0100
+Subject: [PATCH] wifi: iwlwifi: mvm: support flush on AP interfaces
+
+Support TX flush on AP interfaces so that we will do a
+proper flush for frames on the queue before keys are
+removed.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Greenman, Gregory <gregory.greenman@intel.com>
+---
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -4854,9 +4854,6 @@ static void iwl_mvm_mac_flush(struct iee
+ 		return;
+ 	}
+ 
+-	if (vif->type != NL80211_IFTYPE_STATION)
+-		return;
+-
+ 	/* Make sure we're done with the deferred traffic before flushing */
+ 	flush_work(&mvm->add_stream_wk);
+ 
+@@ -4874,9 +4871,6 @@ static void iwl_mvm_mac_flush(struct iee
+ 		if (mvmsta->vif != vif)
+ 			continue;
+ 
+-		/* make sure only TDLS peers or the AP are flushed */
+-		WARN_ON(i != mvmvif->ap_sta_id && !sta->tdls);
+-
+ 		if (drop) {
+ 			if (iwl_mvm_flush_sta(mvm, mvmsta, false))
+ 				IWL_ERR(mvm, "flush request fail\n");
diff --git a/package/kernel/mac80211/patches/subsys/333-wifi-mac80211-add-flush_sta-method.patch b/package/kernel/mac80211/patches/subsys/333-wifi-mac80211-add-flush_sta-method.patch
new file mode 100644
index 00000000000000..3bba0b7e66f61e
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/333-wifi-mac80211-add-flush_sta-method.patch
@@ -0,0 +1,91 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 13 Mar 2023 11:53:51 +0100
+Subject: [PATCH] wifi: mac80211: add flush_sta method
+
+Some drivers like iwlwifi might have per-STA queues, so we
+may want to flush/drop just those queues rather than all
+when removing a station. Add a separate method for that.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Greenman, Gregory <gregory.greenman@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -3918,6 +3918,10 @@ struct ieee80211_prep_tx_info {
+  *	Note that vif can be NULL.
+  *	The callback can sleep.
+  *
++ * @flush_sta: Flush or drop all pending frames from the hardware queue(s) for
++ *	the given station, as it's about to be removed.
++ *	The callback can sleep.
++ *
+  * @channel_switch: Drivers that need (or want) to offload the channel
+  *	switch operation for CSAs received from the AP may implement this
+  *	callback. They must then call ieee80211_chswitch_done() to indicate
+@@ -4372,6 +4376,8 @@ struct ieee80211_ops {
+ #endif
+ 	void (*flush)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		      u32 queues, bool drop);
++	void (*flush_sta)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
++			  struct ieee80211_sta *sta);
+ 	void (*channel_switch)(struct ieee80211_hw *hw,
+ 			       struct ieee80211_vif *vif,
+ 			       struct ieee80211_channel_switch *ch_switch);
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -617,6 +617,21 @@ static inline void drv_flush(struct ieee
+ 	trace_drv_return_void(local);
+ }
+ 
++static inline void drv_flush_sta(struct ieee80211_local *local,
++				 struct ieee80211_sub_if_data *sdata,
++				 struct sta_info *sta)
++{
++	might_sleep();
++
++	if (sdata && !check_sdata_in_driver(sdata))
++		return;
++
++	trace_drv_flush_sta(local, sdata, &sta->sta);
++	if (local->ops->flush_sta)
++		local->ops->flush_sta(&local->hw, &sdata->vif, &sta->sta);
++	trace_drv_return_void(local);
++}
++
+ static inline void drv_channel_switch(struct ieee80211_local *local,
+ 				      struct ieee80211_sub_if_data *sdata,
+ 				      struct ieee80211_channel_switch *ch_switch)
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1276,8 +1276,12 @@ static void __sta_info_destroy_part2(str
+ 	 * frames sitting on hardware queues might be sent out without
+ 	 * any encryption at all.
+ 	 */
+-	if (local->ops->set_key)
+-		ieee80211_flush_queues(local, sta->sdata, false);
++	if (local->ops->set_key) {
++		if (local->ops->flush_sta)
++			drv_flush_sta(local, sta->sdata, sta);
++		else
++			ieee80211_flush_queues(local, sta->sdata, false);
++	}
+ 
+ 	/* now keys can no longer be reached */
+ 	ieee80211_free_sta_keys(local, sta);
+--- a/net/mac80211/trace.h
++++ b/net/mac80211/trace.h
+@@ -1177,6 +1177,13 @@ TRACE_EVENT(drv_flush,
+ 	)
+ );
+ 
++DEFINE_EVENT(sta_event, drv_flush_sta,
++	TP_PROTO(struct ieee80211_local *local,
++		 struct ieee80211_sub_if_data *sdata,
++		 struct ieee80211_sta *sta),
++	TP_ARGS(local, sdata, sta)
++);
++
+ TRACE_EVENT(drv_channel_switch,
+ 	TP_PROTO(struct ieee80211_local *local,
+ 		 struct ieee80211_sub_if_data *sdata,
diff --git a/package/kernel/mac80211/patches/subsys/334-wifi-iwlwifi-mvm-support-new-flush_sta-method.patch b/package/kernel/mac80211/patches/subsys/334-wifi-iwlwifi-mvm-support-new-flush_sta-method.patch
new file mode 100644
index 00000000000000..18f39d505feb7d
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/334-wifi-iwlwifi-mvm-support-new-flush_sta-method.patch
@@ -0,0 +1,53 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 13 Mar 2023 12:05:35 +0100
+Subject: [PATCH] wifi: iwlwifi: mvm: support new flush_sta method
+
+For iwlwifi this is simple to implement, and on newer hardware
+it's an improvement since we have per-station queues.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Greenman, Gregory <gregory.greenman@intel.com>
+---
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -4890,6 +4890,31 @@ static void iwl_mvm_mac_flush(struct iee
+ 		iwl_trans_wait_tx_queues_empty(mvm->trans, msk);
+ }
+ 
++static void iwl_mvm_mac_flush_sta(struct ieee80211_hw *hw,
++				  struct ieee80211_vif *vif,
++				  struct ieee80211_sta *sta)
++{
++	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
++	int i;
++
++	mutex_lock(&mvm->mutex);
++	for (i = 0; i < mvm->fw->ucode_capa.num_stations; i++) {
++		struct iwl_mvm_sta *mvmsta;
++		struct ieee80211_sta *tmp;
++
++		tmp = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
++						lockdep_is_held(&mvm->mutex));
++		if (tmp != sta)
++			continue;
++
++		mvmsta = iwl_mvm_sta_from_mac80211(sta);
++
++		if (iwl_mvm_flush_sta(mvm, mvmsta, false))
++			IWL_ERR(mvm, "flush request fail\n");
++	}
++	mutex_unlock(&mvm->mutex);
++}
++
+ static int iwl_mvm_mac_get_survey(struct ieee80211_hw *hw, int idx,
+ 				  struct survey_info *survey)
+ {
+@@ -5417,6 +5442,7 @@ const struct ieee80211_ops iwl_mvm_hw_op
+ 	.mgd_complete_tx = iwl_mvm_mac_mgd_complete_tx,
+ 	.mgd_protect_tdls_discover = iwl_mvm_mac_mgd_protect_tdls_discover,
+ 	.flush = iwl_mvm_mac_flush,
++	.flush_sta = iwl_mvm_mac_flush_sta,
+ 	.sched_scan_start = iwl_mvm_mac_sched_scan_start,
+ 	.sched_scan_stop = iwl_mvm_mac_sched_scan_stop,
+ 	.set_key = iwl_mvm_mac_set_key,
diff --git a/package/kernel/mac80211/patches/subsys/335-wifi-mac80211-add-LDPC-related-flags-in-ieee80211_bs.patch b/package/kernel/mac80211/patches/subsys/335-wifi-mac80211-add-LDPC-related-flags-in-ieee80211_bs.patch
new file mode 100644
index 00000000000000..1b379b76ae9f9d
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/335-wifi-mac80211-add-LDPC-related-flags-in-ieee80211_bs.patch
@@ -0,0 +1,62 @@
+From: Ryder Lee <ryder.lee@mediatek.com>
+Date: Sat, 18 Feb 2023 01:49:25 +0800
+Subject: [PATCH] wifi: mac80211: add LDPC related flags in ieee80211_bss_conf
+
+This is utilized to pass LDPC configurations from user space
+(i.e. hostapd) to driver.
+
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Link: https://lore.kernel.org/r/1de696aaa34efd77a926eb657b8c0fda05aaa177.1676628065.git.ryder.lee@mediatek.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -653,6 +653,9 @@ struct ieee80211_fils_discovery {
+  *	write-protected by sdata_lock and local->mtx so holding either is fine
+  *	for read access.
+  * @color_change_color: the bss color that will be used after the change.
++ * @ht_ldpc: in AP mode, indicates interface has HT LDPC capability.
++ * @vht_ldpc: in AP mode, indicates interface has VHT LDPC capability.
++ * @he_ldpc: in AP mode, indicates interface has HE LDPC capability.
+  * @vht_su_beamformer: in AP mode, does this BSS support operation as an VHT SU
+  *	beamformer
+  * @vht_su_beamformee: in AP mode, does this BSS support operation as an VHT SU
+@@ -744,6 +747,9 @@ struct ieee80211_bss_conf {
+ 	bool color_change_active;
+ 	u8 color_change_color;
+ 
++	bool ht_ldpc;
++	bool vht_ldpc;
++	bool he_ldpc;
+ 	bool vht_su_beamformer;
+ 	bool vht_su_beamformee;
+ 	bool vht_mu_beamformer;
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1252,7 +1252,15 @@ static int ieee80211_start_ap(struct wip
+ 	prev_beacon_int = link_conf->beacon_int;
+ 	link_conf->beacon_int = params->beacon_interval;
+ 
++	if (params->ht_cap)
++		link_conf->ht_ldpc =
++			params->ht_cap->cap_info &
++				cpu_to_le16(IEEE80211_HT_CAP_LDPC_CODING);
++
+ 	if (params->vht_cap) {
++		link_conf->vht_ldpc =
++			params->vht_cap->vht_cap_info &
++				cpu_to_le32(IEEE80211_VHT_CAP_RXLDPC);
+ 		link_conf->vht_su_beamformer =
+ 			params->vht_cap->vht_cap_info &
+ 				cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
+@@ -1282,6 +1290,9 @@ static int ieee80211_start_ap(struct wip
+ 	}
+ 
+ 	if (params->he_cap) {
++		link_conf->he_ldpc =
++			params->he_cap->phy_cap_info[1] &
++				IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD;
+ 		link_conf->he_su_beamformer =
+ 			params->he_cap->phy_cap_info[3] &
+ 				IEEE80211_HE_PHY_CAP3_SU_BEAMFORMER;
diff --git a/package/kernel/mac80211/patches/subsys/336-v6.4-wifi-mac80211-generate-EMA-beacons-in-AP-mode.patch b/package/kernel/mac80211/patches/subsys/336-v6.4-wifi-mac80211-generate-EMA-beacons-in-AP-mode.patch
new file mode 100644
index 00000000000000..088f468e37216e
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/336-v6.4-wifi-mac80211-generate-EMA-beacons-in-AP-mode.patch
@@ -0,0 +1,372 @@
+From bd54f3c29077f23dad92ef82a78061b40be30c65 Mon Sep 17 00:00:00 2001
+From: Aloka Dixit <quic_alokad@quicinc.com>
+Date: Mon, 5 Dec 2022 16:50:37 -0800
+Subject: [PATCH] wifi: mac80211: generate EMA beacons in AP mode
+
+Add APIs to generate an array of beacons for an EMA AP (enhanced
+multiple BSSID advertisements), each including a single MBSSID element.
+EMA profile periodicity equals the count of elements.
+
+- ieee80211_beacon_get_template_ema_list() - Generate and return all
+EMA beacon templates. Drivers must call ieee80211_beacon_free_ema_list()
+to free the memory. No change in the prototype for the existing API,
+ieee80211_beacon_get_template(), which should be used for non-EMA AP.
+
+- ieee80211_beacon_get_template_ema_index() - Generate a beacon which
+includes the multiple BSSID element at the given index. Drivers can use
+this function in a loop until NULL is returned which indicates end of
+available MBSSID elements.
+
+- ieee80211_beacon_free_ema_list() - free the memory allocated for the
+list of EMA beacon templates.
+
+Modify existing functions ieee80211_beacon_get_ap(),
+ieee80211_get_mbssid_beacon_len() and ieee80211_beacon_add_mbssid()
+to accept a new parameter for EMA index.
+
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+Co-developed-by: John Crispin <john@phrozen.org>
+Signed-off-by: John Crispin <john@phrozen.org>
+Link: https://lore.kernel.org/r/20221206005040.3177-2-quic_alokad@quicinc.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ include/net/mac80211.h     |  68 +++++++++++++++++++
+ net/mac80211/cfg.c         |  11 +--
+ net/mac80211/ieee80211_i.h |  10 ++-
+ net/mac80211/tx.c          | 134 ++++++++++++++++++++++++++++++++++---
+ 4 files changed, 205 insertions(+), 18 deletions(-)
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -5252,6 +5252,74 @@ ieee80211_beacon_get_template(struct iee
+ 			      unsigned int link_id);
+ 
+ /**
++ * ieee80211_beacon_get_template_ema_index - EMA beacon template generation
++ * @hw: pointer obtained from ieee80211_alloc_hw().
++ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
++ * @offs: &struct ieee80211_mutable_offsets pointer to struct that will
++ *	receive the offsets that may be updated by the driver.
++ * @link_id: the link id to which the beacon belongs (or 0 for a non-MLD AP).
++ * @ema_index: index of the beacon in the EMA set.
++ *
++ * This function follows the same rules as ieee80211_beacon_get_template()
++ * but returns a beacon template which includes multiple BSSID element at the
++ * requested index.
++ *
++ * Return: The beacon template. %NULL indicates the end of EMA templates.
++ */
++struct sk_buff *
++ieee80211_beacon_get_template_ema_index(struct ieee80211_hw *hw,
++					struct ieee80211_vif *vif,
++					struct ieee80211_mutable_offsets *offs,
++					unsigned int link_id, u8 ema_index);
++
++/**
++ * struct ieee80211_ema_beacons - List of EMA beacons
++ * @cnt: count of EMA beacons.
++ *
++ * @bcn: array of EMA beacons.
++ * @bcn.skb: the skb containing this specific beacon
++ * @bcn.offs: &struct ieee80211_mutable_offsets pointer to struct that will
++ *	receive the offsets that may be updated by the driver.
++ */
++struct ieee80211_ema_beacons {
++	u8 cnt;
++	struct {
++		struct sk_buff *skb;
++		struct ieee80211_mutable_offsets offs;
++	} bcn[];
++};
++
++/**
++ * ieee80211_beacon_get_template_ema_list - EMA beacon template generation
++ * @hw: pointer obtained from ieee80211_alloc_hw().
++ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
++ * @link_id: the link id to which the beacon belongs (or 0 for a non-MLD AP)
++ *
++ * This function follows the same rules as ieee80211_beacon_get_template()
++ * but allocates and returns a pointer to list of all beacon templates required
++ * to cover all profiles in the multiple BSSID set. Each template includes only
++ * one multiple BSSID element.
++ *
++ * Driver must call ieee80211_beacon_free_ema_list() to free the memory.
++ *
++ * Return: EMA beacon templates of type struct ieee80211_ema_beacons *.
++ *	%NULL on error.
++ */
++struct ieee80211_ema_beacons *
++ieee80211_beacon_get_template_ema_list(struct ieee80211_hw *hw,
++				       struct ieee80211_vif *vif,
++				       unsigned int link_id);
++
++/**
++ * ieee80211_beacon_free_ema_list - free an EMA beacon template list
++ * @ema_beacons: list of EMA beacons of type &struct ieee80211_ema_beacons pointers.
++ *
++ * This function will free a list previously acquired by calling
++ * ieee80211_beacon_get_template_ema_list()
++ */
++void ieee80211_beacon_free_ema_list(struct ieee80211_ema_beacons *ema_beacons);
++
++/**
+  * ieee80211_beacon_get_tim - beacon generation function
+  * @hw: pointer obtained from ieee80211_alloc_hw().
+  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1122,11 +1122,11 @@ static int ieee80211_assign_beacon(struc
+ 	if (params->mbssid_ies) {
+ 		mbssid = params->mbssid_ies;
+ 		size += struct_size(new->mbssid_ies, elem, mbssid->cnt);
+-		size += ieee80211_get_mbssid_beacon_len(mbssid);
++		size += ieee80211_get_mbssid_beacon_len(mbssid, mbssid->cnt);
+ 	} else if (old && old->mbssid_ies) {
+ 		mbssid = old->mbssid_ies;
+ 		size += struct_size(new->mbssid_ies, elem, mbssid->cnt);
+-		size += ieee80211_get_mbssid_beacon_len(mbssid);
++		size += ieee80211_get_mbssid_beacon_len(mbssid, mbssid->cnt);
+ 	}
+ 
+ 	new = kzalloc(size, GFP_KERNEL);
+@@ -3384,8 +3384,11 @@ cfg80211_beacon_dup(struct cfg80211_beac
+ 
+ 	len = beacon->head_len + beacon->tail_len + beacon->beacon_ies_len +
+ 	      beacon->proberesp_ies_len + beacon->assocresp_ies_len +
+-	      beacon->probe_resp_len + beacon->lci_len + beacon->civicloc_len +
+-	      ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies);
++	      beacon->probe_resp_len + beacon->lci_len + beacon->civicloc_len;
++
++	if (beacon->mbssid_ies)
++		len += ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies,
++						       beacon->mbssid_ies->cnt);
+ 
+ 	new_beacon = kzalloc(sizeof(*new_beacon) + len, GFP_KERNEL);
+ 	if (!new_beacon)
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1182,13 +1182,17 @@ ieee80211_vif_get_shift(struct ieee80211
+ }
+ 
+ static inline int
+-ieee80211_get_mbssid_beacon_len(struct cfg80211_mbssid_elems *elems)
++ieee80211_get_mbssid_beacon_len(struct cfg80211_mbssid_elems *elems, u8 i)
+ {
+-	int i, len = 0;
++	int len = 0;
+ 
+-	if (!elems)
++	if (!elems || !elems->cnt || i > elems->cnt)
+ 		return 0;
+ 
++	if (i < elems->cnt)
++		return elems->elem[i].len;
++
++	/* i == elems->cnt, calculate total length of all MBSSID elements */
+ 	for (i = 0; i < elems->cnt; i++)
+ 		len += elems->elem[i].len;
+ 
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -5205,13 +5205,20 @@ ieee80211_beacon_get_finish(struct ieee8
+ }
+ 
+ static void
+-ieee80211_beacon_add_mbssid(struct sk_buff *skb, struct beacon_data *beacon)
++ieee80211_beacon_add_mbssid(struct sk_buff *skb, struct beacon_data *beacon,
++			    u8 i)
+ {
+-	int i;
++	if (!beacon->mbssid_ies || !beacon->mbssid_ies->cnt ||
++	    i > beacon->mbssid_ies->cnt)
++		return;
+ 
+-	if (!beacon->mbssid_ies)
++	if (i < beacon->mbssid_ies->cnt) {
++		skb_put_data(skb, beacon->mbssid_ies->elem[i].data,
++			     beacon->mbssid_ies->elem[i].len);
+ 		return;
++	}
+ 
++	/* i == beacon->mbssid_ies->cnt, include all MBSSID elements */
+ 	for (i = 0; i < beacon->mbssid_ies->cnt; i++)
+ 		skb_put_data(skb, beacon->mbssid_ies->elem[i].data,
+ 			     beacon->mbssid_ies->elem[i].len);
+@@ -5224,7 +5231,8 @@ ieee80211_beacon_get_ap(struct ieee80211
+ 			struct ieee80211_mutable_offsets *offs,
+ 			bool is_template,
+ 			struct beacon_data *beacon,
+-			struct ieee80211_chanctx_conf *chanctx_conf)
++			struct ieee80211_chanctx_conf *chanctx_conf,
++			u8 ema_index)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+@@ -5243,7 +5251,9 @@ ieee80211_beacon_get_ap(struct ieee80211
+ 	/* headroom, head length,
+ 	 * tail length, maximum TIM length and multiple BSSID length
+ 	 */
+-	mbssid_len = ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies);
++	mbssid_len = ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies,
++						     ema_index);
++
+ 	skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
+ 			    beacon->tail_len + 256 +
+ 			    local->hw.extra_beacon_tailroom + mbssid_len);
+@@ -5261,7 +5271,7 @@ ieee80211_beacon_get_ap(struct ieee80211
+ 		offs->cntdwn_counter_offs[0] = beacon->cntdwn_counter_offsets[0];
+ 
+ 		if (mbssid_len) {
+-			ieee80211_beacon_add_mbssid(skb, beacon);
++			ieee80211_beacon_add_mbssid(skb, beacon, ema_index);
+ 			offs->mbssid_off = skb->len - mbssid_len;
+ 		}
+ 
+@@ -5280,12 +5290,51 @@ ieee80211_beacon_get_ap(struct ieee80211
+ 	return skb;
+ }
+ 
++static struct ieee80211_ema_beacons *
++ieee80211_beacon_get_ap_ema_list(struct ieee80211_hw *hw,
++				 struct ieee80211_vif *vif,
++				 struct ieee80211_link_data *link,
++				 struct ieee80211_mutable_offsets *offs,
++				 bool is_template, struct beacon_data *beacon,
++				 struct ieee80211_chanctx_conf *chanctx_conf)
++{
++	struct ieee80211_ema_beacons *ema = NULL;
++
++	if (!beacon->mbssid_ies || !beacon->mbssid_ies->cnt)
++		return NULL;
++
++	ema = kzalloc(struct_size(ema, bcn, beacon->mbssid_ies->cnt),
++		      GFP_ATOMIC);
++	if (!ema)
++		return NULL;
++
++	for (ema->cnt = 0; ema->cnt < beacon->mbssid_ies->cnt; ema->cnt++) {
++		ema->bcn[ema->cnt].skb =
++			ieee80211_beacon_get_ap(hw, vif, link,
++						&ema->bcn[ema->cnt].offs,
++						is_template, beacon,
++						chanctx_conf, ema->cnt);
++		if (!ema->bcn[ema->cnt].skb)
++			break;
++	}
++
++	if (ema->cnt == beacon->mbssid_ies->cnt)
++		return ema;
++
++	ieee80211_beacon_free_ema_list(ema);
++	return NULL;
++}
++
++#define IEEE80211_INCLUDE_ALL_MBSSID_ELEMS -1
++
+ static struct sk_buff *
+ __ieee80211_beacon_get(struct ieee80211_hw *hw,
+ 		       struct ieee80211_vif *vif,
+ 		       struct ieee80211_mutable_offsets *offs,
+ 		       bool is_template,
+-		       unsigned int link_id)
++		       unsigned int link_id,
++		       int ema_index,
++		       struct ieee80211_ema_beacons **ema_beacons)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 	struct beacon_data *beacon = NULL;
+@@ -5314,8 +5363,29 @@ __ieee80211_beacon_get(struct ieee80211_
+ 		if (!beacon)
+ 			goto out;
+ 
+-		skb = ieee80211_beacon_get_ap(hw, vif, link, offs, is_template,
+-					      beacon, chanctx_conf);
++		if (ema_beacons) {
++			*ema_beacons =
++				ieee80211_beacon_get_ap_ema_list(hw, vif, link,
++								 offs,
++								 is_template,
++								 beacon,
++								 chanctx_conf);
++		} else {
++			if (beacon->mbssid_ies && beacon->mbssid_ies->cnt) {
++				if (ema_index >= beacon->mbssid_ies->cnt)
++					goto out; /* End of MBSSID elements */
++
++				if (ema_index <= IEEE80211_INCLUDE_ALL_MBSSID_ELEMS)
++					ema_index = beacon->mbssid_ies->cnt;
++			} else {
++				ema_index = 0;
++			}
++
++			skb = ieee80211_beacon_get_ap(hw, vif, link, offs,
++						      is_template, beacon,
++						      chanctx_conf,
++						      ema_index);
++		}
+ 	} else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+ 		struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+ 		struct ieee80211_hdr *hdr;
+@@ -5403,10 +5473,50 @@ ieee80211_beacon_get_template(struct iee
+ 			      struct ieee80211_mutable_offsets *offs,
+ 			      unsigned int link_id)
+ {
+-	return __ieee80211_beacon_get(hw, vif, offs, true, link_id);
++	return __ieee80211_beacon_get(hw, vif, offs, true, link_id,
++				      IEEE80211_INCLUDE_ALL_MBSSID_ELEMS, NULL);
+ }
+ EXPORT_SYMBOL(ieee80211_beacon_get_template);
+ 
++struct sk_buff *
++ieee80211_beacon_get_template_ema_index(struct ieee80211_hw *hw,
++					struct ieee80211_vif *vif,
++					struct ieee80211_mutable_offsets *offs,
++					unsigned int link_id, u8 ema_index)
++{
++	return __ieee80211_beacon_get(hw, vif, offs, true, link_id, ema_index,
++				      NULL);
++}
++EXPORT_SYMBOL(ieee80211_beacon_get_template_ema_index);
++
++void ieee80211_beacon_free_ema_list(struct ieee80211_ema_beacons *ema_beacons)
++{
++	u8 i;
++
++	if (!ema_beacons)
++		return;
++
++	for (i = 0; i < ema_beacons->cnt; i++)
++		kfree_skb(ema_beacons->bcn[i].skb);
++
++	kfree(ema_beacons);
++}
++EXPORT_SYMBOL(ieee80211_beacon_free_ema_list);
++
++struct ieee80211_ema_beacons *
++ieee80211_beacon_get_template_ema_list(struct ieee80211_hw *hw,
++				       struct ieee80211_vif *vif,
++				       unsigned int link_id)
++{
++	struct ieee80211_ema_beacons *ema_beacons = NULL;
++
++	WARN_ON(__ieee80211_beacon_get(hw, vif, NULL, false, link_id, 0,
++				       &ema_beacons));
++
++	return ema_beacons;
++}
++EXPORT_SYMBOL(ieee80211_beacon_get_template_ema_list);
++
+ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
+ 					 struct ieee80211_vif *vif,
+ 					 u16 *tim_offset, u16 *tim_length,
+@@ -5414,7 +5524,9 @@ struct sk_buff *ieee80211_beacon_get_tim
+ {
+ 	struct ieee80211_mutable_offsets offs = {};
+ 	struct sk_buff *bcn = __ieee80211_beacon_get(hw, vif, &offs, false,
+-						     link_id);
++						     link_id,
++						     IEEE80211_INCLUDE_ALL_MBSSID_ELEMS,
++						     NULL);
+ 	struct sk_buff *copy;
+ 	int shift;
+ 
diff --git a/package/kernel/mac80211/patches/subsys/400-allow-ibss-mixed.patch b/package/kernel/mac80211/patches/subsys/400-allow-ibss-mixed.patch
index f2ed528d231cda..c38fa13f03daa0 100644
--- a/package/kernel/mac80211/patches/subsys/400-allow-ibss-mixed.patch
+++ b/package/kernel/mac80211/patches/subsys/400-allow-ibss-mixed.patch
@@ -1,11 +1,22 @@
-ath10k-ct starting with version 5.2 allows the combination of 
-NL80211_IFTYPE_ADHOC and beacon_int_min_gcd in ath10k_10x_ct_if_comb 
-which triggers this warning. Ben told me that this is not a big problem 
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Mon, 24 Feb 2020 00:00:00 +0100
+Subject: [PATCH] mac80211: Allow IBSS mode and different beacon intervals
+
+ath10k-ct supports the combination to select IBSS (ADHOC) mode and
+different beacon intervals together. mac80211 does not like this
+combination, but Ben says this is ok, so remove this check.
+
+ath10k-ct starting with version 5.2 allows the combination of
+NL80211_IFTYPE_ADHOC and beacon_int_min_gcd in ath10k_10x_ct_if_comb
+which triggers this warning. Ben told me that this is not a big problem
 and we should ignore this.
+---
+ net/wireless/core.c | 15 ---------------
+ 1 file changed, 15 deletions(-)
 
 --- a/net/wireless/core.c
 +++ b/net/wireless/core.c
-@@ -625,21 +625,6 @@ static int wiphy_verify_combinations(str
+@@ -614,21 +614,6 @@ static int wiphy_verify_combinations(str
  				    c->limits[j].max > 1))
  				return -EINVAL;
  
diff --git a/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch b/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch
index 50c24a77466915..4a3984fb424510 100644
--- a/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch
+++ b/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch
@@ -1,6 +1,6 @@
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -3869,6 +3869,7 @@ struct mgmt_frame_regs {
+@@ -4081,6 +4081,7 @@ struct mgmt_frame_regs {
   *	(as advertised by the nl80211 feature flag.)
   * @get_tx_power: store the current TX power into the dbm variable;
   *	return 0 if successful
@@ -8,7 +8,7 @@
   *
   * @rfkill_poll: polls the hw rfkill line, use cfg80211 reporting
   *	functions to adjust rfkill hw state
-@@ -4202,6 +4203,7 @@ struct cfg80211_ops {
+@@ -4431,6 +4432,7 @@ struct cfg80211_ops {
  				enum nl80211_tx_power_setting type, int mbm);
  	int	(*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
  				int *dbm);
@@ -18,7 +18,7 @@
  
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1566,6 +1566,7 @@ enum ieee80211_smps_mode {
+@@ -1677,6 +1677,7 @@ enum ieee80211_smps_mode {
   *
   * @power_level: requested transmit power (in dBm), backward compatibility
   *	value only that is set to the minimum of all interfaces
@@ -26,7 +26,7 @@
   *
   * @chandef: the channel definition to tune to
   * @radar_enabled: whether radar detection is enabled
-@@ -1586,6 +1587,7 @@ enum ieee80211_smps_mode {
+@@ -1697,6 +1698,7 @@ enum ieee80211_smps_mode {
  struct ieee80211_conf {
  	u32 flags;
  	int power_level, dynamic_ps_timeout;
@@ -36,19 +36,19 @@
  	u8 ps_dtim_period;
 --- a/include/uapi/linux/nl80211.h
 +++ b/include/uapi/linux/nl80211.h
-@@ -2615,6 +2615,9 @@ enum nl80211_commands {
-  *	switching on a different channel during CAC detection on the selected
-  *	radar channel.
-  *
+@@ -2749,6 +2749,9 @@ enum nl80211_commands {
+  *	When used with %NL80211_CMD_FRAME_TX_STATUS, indicates the ack RX
+  *	timestamp. When used with %NL80211_CMD_FRAME RX notification, indicates
+  *	the incoming frame RX timestamp.
 + * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
 + *	transmit power to stay within regulatory limits. u32, dBi.
 + *
   * @NUM_NL80211_ATTR: total number of nl80211_attrs available
   * @NL80211_ATTR_MAX: highest attribute number currently defined
   * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3123,6 +3126,8 @@ enum nl80211_attrs {
- 
- 	NL80211_ATTR_RADAR_BACKGROUND,
+@@ -3277,6 +3280,8 @@ enum nl80211_attrs {
+ 	NL80211_ATTR_TX_HW_TIMESTAMP,
+ 	NL80211_ATTR_RX_HW_TIMESTAMP,
  
 +	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
 +
@@ -57,7 +57,7 @@
  	__NL80211_ATTR_AFTER_LAST,
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2812,6 +2812,19 @@ static int ieee80211_get_tx_power(struct
+@@ -3046,6 +3046,19 @@ static int ieee80211_get_tx_power(struct
  	return 0;
  }
  
@@ -77,7 +77,7 @@
  static void ieee80211_rfkill_poll(struct wiphy *wiphy)
  {
  	struct ieee80211_local *local = wiphy_priv(wiphy);
-@@ -4516,6 +4529,7 @@ const struct cfg80211_ops mac80211_confi
+@@ -4956,6 +4969,7 @@ const struct cfg80211_ops mac80211_confi
  	.set_wiphy_params = ieee80211_set_wiphy_params,
  	.set_tx_power = ieee80211_set_tx_power,
  	.get_tx_power = ieee80211_get_tx_power,
@@ -87,7 +87,7 @@
  	CFG80211_TESTMODE_DUMP(ieee80211_testmode_dump)
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1448,6 +1448,7 @@ struct ieee80211_local {
+@@ -1542,6 +1542,7 @@ struct ieee80211_local {
  	int dynamic_ps_forced_timeout;
  
  	int user_power_level; /* in dBm, for all interfaces */
@@ -119,7 +119,7 @@
  	if (local->hw.conf.power_level != power) {
  		changed |= IEEE80211_CONF_CHANGE_POWER;
  		local->hw.conf.power_level = power;
-@@ -679,6 +685,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+@@ -762,6 +768,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
  					 IEEE80211_RADIOTAP_MCS_HAVE_BW;
  	local->hw.radiotap_vht_details = IEEE80211_RADIOTAP_VHT_KNOWN_GI |
  					 IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
@@ -129,15 +129,15 @@
  	local->hw.max_mtu = IEEE80211_MAX_DATA_LEN;
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -802,6 +802,7 @@ static const struct nla_policy nl80211_p
- 			NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
- 	[NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
- 	[NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
+@@ -799,6 +799,7 @@ static const struct nla_policy nl80211_p
+ 	[NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN),
+ 	[NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
+ 	[NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT },
 +	[NL80211_ATTR_WIPHY_ANTENNA_GAIN] = { .type = NLA_U32 },
  };
  
  /* policy for the key attributes */
-@@ -3391,6 +3392,22 @@ static int nl80211_set_wiphy(struct sk_b
+@@ -3511,6 +3512,22 @@ static int nl80211_set_wiphy(struct sk_b
  		if (result)
  			goto out;
  	}
diff --git a/package/kernel/mac80211/ralink.mk b/package/kernel/mac80211/ralink.mk
index 7bbdc1c22c6e48..83d208ee1a0a0e 100644
--- a/package/kernel/mac80211/ralink.mk
+++ b/package/kernel/mac80211/ralink.mk
@@ -1,8 +1,6 @@
 PKG_DRIVERS += \
 	rt2x00-lib rt2x00-pci rt2x00-usb rt2x00-mmio \
-	rt2400-pci rt2500-pci rt2500-usb \
-	rt2800-lib rt2800-mmio rt2800-pci rt2800-soc rt2800-usb \
-	rt61-pci rt73-usb
+	rt2800-lib rt2800-mmio rt2800-pci rt2800-soc rt2800-usb
 
 PKG_CONFIG_DEPENDS += \
 	CONFIG_PACKAGE_RT2X00_LIB_DEBUGFS \
@@ -90,36 +88,12 @@ endef
 
 define KernelPackage/rt2800-lib
 $(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT||TARGET_ramips) +kmod-rt2x00-lib +kmod-lib-crc-ccitt +@DRIVER_11N_SUPPORT
+  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT||TARGET_ramips) +kmod-rt2x00-lib +kmod-lib-crc-ccitt
   HIDDEN:=1
   TITLE+= (rt2800 LIB)
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800lib.ko
 endef
 
-define KernelPackage/rt2400-pci
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-eeprom-93cx6
-  TITLE+= (RT2400 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2400pci.ko
-  AUTOLOAD:=$(call AutoProbe,rt2400pci)
-endef
-
-define KernelPackage/rt2500-pci
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-eeprom-93cx6
-  TITLE+= (RT2500 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2500pci.ko
-  AUTOLOAD:=$(call AutoProbe,rt2500pci)
-endef
-
-define KernelPackage/rt2500-usb
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb
-  TITLE+= (RT2500 USB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2500usb.ko
-  AUTOLOAD:=$(call AutoProbe,rt2500usb)
-endef
-
 define KernelPackage/rt2800-mmio
 $(call KernelPackage/rt2x00/Default)
   TITLE += (RT28xx/RT3xxx MMIO)
@@ -155,18 +129,3 @@ $(call KernelPackage/rt2x00/Default)
 endef
 
 
-define KernelPackage/rt61-pci
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-eeprom-93cx6 +kmod-lib-crc-itu-t +rt61-pci-firmware
-  TITLE+= (RT2x61 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt61pci.ko
-  AUTOLOAD:=$(call AutoProbe,rt61pci)
-endef
-
-define KernelPackage/rt73-usb
-  $(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb +kmod-lib-crc-itu-t +rt73-usb-firmware
-  TITLE+= (RT73 USB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt73usb.ko
-  AUTOLOAD:=$(call AutoProbe,rt73usb)
-endef
diff --git a/package/kernel/mac80211/realtek.mk b/package/kernel/mac80211/realtek.mk
index 44c6c25b089df1..9c143583265e11 100644
--- a/package/kernel/mac80211/realtek.mk
+++ b/package/kernel/mac80211/realtek.mk
@@ -1,12 +1,8 @@
 PKG_DRIVERS += \
-	rtl8180 rtl8187 \
 	rtlwifi rtlwifi-pci rtlwifi-btcoexist rtlwifi-usb rtl8192c-common \
 	rtl8192ce rtl8192se rtl8192de rtl8192cu rtl8723bs rtl8821ae \
 	rtl8xxxu rtw88
 
-config-$(call config_package,rtl8180) += RTL8180
-config-$(call config_package,rtl8187) += RTL8187
-
 config-$(call config_package,rtlwifi) += RTL_CARDS RTLWIFI
 config-$(call config_package,rtlwifi-pci) += RTLWIFI_PCI
 config-$(call config_package,rtlwifi-btcoexist) += RTLBTCOEXIST
@@ -30,29 +26,6 @@ config-y += RTW88_8822BE RTW88_8822CE RTW88_8723DE
 config-$(CONFIG_PACKAGE_RTW88_DEBUG) += RTW88_DEBUG
 config-$(CONFIG_PACKAGE_RTW88_DEBUGFS) += RTW88_DEBUGFS
 
-define KernelPackage/rtl818x/Default
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek Drivers for RTL818x devices
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/rtl8187
-  DEPENDS+= +kmod-eeprom-93cx6 +kmod-mac80211
-endef
-
-define KernelPackage/rtl8180
-  $(call KernelPackage/rtl818x/Default)
-  DEPENDS+= @PCI_SUPPORT
-  TITLE+= (RTL8180 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl818x/rtl8180/rtl818x_pci.ko
-  AUTOLOAD:=$(call AutoProbe,rtl818x_pci)
-endef
-
-define KernelPackage/rtl8187
-$(call KernelPackage/rtl818x/Default)
-  DEPENDS+= @USB_SUPPORT +kmod-usb-core
-  TITLE+= (RTL8187 USB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8187.ko
-  AUTOLOAD:=$(call AutoProbe,rtl8187)
-endef
-
 define KernelPackage/rtlwifi/config
 	config PACKAGE_RTLWIFI_DEBUG
 		bool "Realtek wireless debugging"
@@ -65,7 +38,7 @@ endef
 define KernelPackage/rtlwifi
   $(call KernelPackage/mac80211/Default)
   TITLE:=Realtek common driver part
-  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT) +kmod-mac80211 +@DRIVER_11N_SUPPORT
+  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT) +kmod-mac80211
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtlwifi.ko
   HIDDEN:=1
 endef
@@ -196,7 +169,7 @@ endef
 define KernelPackage/rtw88
   $(call KernelPackage/mac80211/Default)
   TITLE:=Realtek RTL8822BE/RTL8822CE/RTL8723DE
-  DEPENDS+= @(PCI_SUPPORT) +kmod-mac80211 +@DRIVER_11AC_SUPPORT +@DRIVER_11N_SUPPORT
+  DEPENDS+= @(PCI_SUPPORT) +kmod-mac80211 +@DRIVER_11AC_SUPPORT
   FILES:=\
 	$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_8822be.ko \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_8822b.ko \
diff --git a/package/kernel/mt76/Makefile b/package/kernel/mt76/Makefile
index 998320ac5c804b..04db7fe32c2422 100644
--- a/package/kernel/mt76/Makefile
+++ b/package/kernel/mt76/Makefile
@@ -1,16 +1,16 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mt76
-PKG_RELEASE=4
+PKG_RELEASE=1
 
 PKG_LICENSE:=GPLv2
 PKG_LICENSE_FILES:=
 
 PKG_SOURCE_URL:=https://github.com/openwrt/mt76
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2022-09-06
-PKG_SOURCE_VERSION:=d70546462b7b51ebc2bcdd5c534fdf3465be62a4
-PKG_MIRROR_HASH:=3d6b68d70a78c0072ed10ab2548344b6b3a70ad99e4edc258fafa16886f4abf9
+PKG_SOURCE_DATE:=2023-05-13
+PKG_SOURCE_VERSION:=969b7b5ebd129068ca56e4b0d831593a2f92382f
+PKG_MIRROR_HASH:=d28869591d1cb9a967b72f5cd8215c7b2c3388b7b31147b7b18c797018ab8ffb
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_USE_NINJA:=0
@@ -40,7 +40,8 @@ define KernelPackage/mt76-default
   SUBMENU:=Wireless Drivers
   DEPENDS:= \
 	+kmod-mac80211 \
-	+@DRIVER_11AC_SUPPORT +@DRIVER_11N_SUPPORT
+	+@DRIVER_11AC_SUPPORT \
+	+@KERNEL_PAGE_POOL
 endef
 
 define KernelPackage/mt76
@@ -171,7 +172,7 @@ endef
 define KernelPackage/mt7615-firmware
   $(KernelPackage/mt76-default)
   TITLE:=MediaTek MT7615e firmware
-  DEFAULT:=PACKAGE_kmod-mt7615e
+  DEPENDS+=+kmod-mt7615e
 endef
 
 define KernelPackage/mt7615e
@@ -182,6 +183,12 @@ define KernelPackage/mt7615e
   AUTOLOAD:=$(call AutoProbe,mt7615e)
 endef
 
+define KernelPackage/mt7622-firmware
+  $(KernelPackage/mt76-default)
+  TITLE:=MediaTek MT7622 firmware
+  DEPENDS+=+kmod-mt7615e
+endef
+
 define KernelPackage/mt7663-firmware-ap
   $(KernelPackage/mt76-default)
   TITLE:=MediaTek MT7663e firmware (optimized for AP)
@@ -218,25 +225,48 @@ define KernelPackage/mt7663u
   AUTOLOAD:=$(call AutoProbe,mt7663u)
 endef
 
+define KernelPackage/mt7915-firmware
+  $(KernelPackage/mt76-default)
+  TITLE:=MediaTek MT7915 firmware
+  DEPENDS+=+kmod-mt7915e
+endef
+
 define KernelPackage/mt7915e
   $(KernelPackage/mt76-default)
   TITLE:=MediaTek MT7915e wireless driver
-  DEPENDS+=@PCI_SUPPORT +kmod-mt7615-common +kmod-hwmon-core +kmod-thermal +@DRIVER_11AX_SUPPORT +@KERNEL_RELAY
+  DEPENDS+=@PCI_SUPPORT +kmod-mt76-connac +kmod-hwmon-core +kmod-thermal +@DRIVER_11AX_SUPPORT +@KERNEL_RELAY
   FILES:= $(PKG_BUILD_DIR)/mt7915/mt7915e.ko
   AUTOLOAD:=$(call AutoProbe,mt7915e)
 endef
 
+define KernelPackage/mt7916-firmware
+  $(KernelPackage/mt76-default)
+  DEPENDS+=+kmod-mt7915e
+  TITLE:=MediaTek MT7916 firmware
+endef
+
+define KernelPackage/mt7981-firmware
+  $(KernelPackage/mt76-default)
+  DEPENDS:=@TARGET_mediatek_filogic
+  TITLE:=MediaTek MT7981 firmware
+endef
+
 define KernelPackage/mt7986-firmware
   $(KernelPackage/mt76-default)
   DEPENDS:=@TARGET_mediatek_filogic
   TITLE:=MediaTek MT7986 firmware
 endef
 
+define KernelPackage/mt7921-firmware
+  $(KernelPackage/mt76-default)
+  TITLE:=MediaTek MT7921 firmware
+endef
+
 define KernelPackage/mt7921-common
   $(KernelPackage/mt76-default)
   TITLE:=MediaTek MT7615 wireless driver common code
   HIDDEN:=1
-  DEPENDS+=+kmod-mt76-connac +@DRIVER_11AX_SUPPORT
+  DEPENDS+=+kmod-mt76-connac +kmod-mt7921-firmware +@DRIVER_11AX_SUPPORT
   FILES:= $(PKG_BUILD_DIR)/mt7921/mt7921-common.ko
 endef
 
@@ -350,8 +380,8 @@ endif
 ifdef CONFIG_PACKAGE_kmod-mt7915e
   PKG_MAKE_FLAGS += CONFIG_MT7915E=m
   ifdef CONFIG_TARGET_mediatek_filogic
-    PKG_MAKE_FLAGS += CONFIG_MT7986_WMAC=y
-    NOSTDINC_FLAGS += -DCONFIG_MT7986_WMAC
+    PKG_MAKE_FLAGS += CONFIG_MT798X_WMAC=y
+    NOSTDINC_FLAGS += -DCONFIG_MT798X_WMAC
   endif
 endif
 ifdef CONFIG_PACKAGE_kmod-mt7921-common
@@ -368,8 +398,7 @@ ifdef CONFIG_PACKAGE_kmod-mt7921e
 endif
 
 define Build/Compile
-	+$(MAKE) $(PKG_JOBS) -C "$(LINUX_DIR)" \
-		$(KERNEL_MAKE_FLAGS) \
+	+$(KERNEL_MAKE) $(PKG_JOBS) \
 		$(PKG_MAKE_FLAGS) \
 		M="$(PKG_BUILD_DIR)" \
 		NOSTDINC_FLAGS="$(NOSTDINC_FLAGS)" \
@@ -429,9 +458,14 @@ define KernelPackage/mt7615-firmware/install
 		$(PKG_BUILD_DIR)/firmware/mt7615_cr4.bin \
 		$(PKG_BUILD_DIR)/firmware/mt7615_n9.bin \
 		$(PKG_BUILD_DIR)/firmware/mt7615_rom_patch.bin \
-		$(if $(CONFIG_TARGET_mediatek_mt7622), \
-			$(PKG_BUILD_DIR)/firmware/mt7622_n9.bin \
-			$(PKG_BUILD_DIR)/firmware/mt7622_rom_patch.bin) \
+		$(1)/lib/firmware/mediatek
+endef
+
+define KernelPackage/mt7622-firmware/install
+	$(INSTALL_DIR) $(1)/lib/firmware/mediatek
+	cp \
+		$(PKG_BUILD_DIR)/firmware/mt7622_n9.bin \
+		$(PKG_BUILD_DIR)/firmware/mt7622_rom_patch.bin \
 		$(1)/lib/firmware/mediatek
 endef
 
@@ -451,7 +485,7 @@ define KernelPackage/mt7663-firmware-sta/install
 		$(1)/lib/firmware/mediatek
 endef
 
-define KernelPackage/mt7915e/install
+define KernelPackage/mt7915-firmware/install
 	$(INSTALL_DIR) $(1)/lib/firmware/mediatek
 	cp \
 		$(PKG_BUILD_DIR)/firmware/mt7915_wa.bin \
@@ -460,6 +494,24 @@ define KernelPackage/mt7915e/install
 		$(1)/lib/firmware/mediatek
 endef
 
+define KernelPackage/mt7916-firmware/install
+	$(INSTALL_DIR) $(1)/lib/firmware/mediatek
+	cp \
+		$(PKG_BUILD_DIR)/firmware/mt7916_wa.bin \
+		$(PKG_BUILD_DIR)/firmware/mt7916_wm.bin \
+		$(PKG_BUILD_DIR)/firmware/mt7916_rom_patch.bin \
+		$(1)/lib/firmware/mediatek
+endef
+
+define KernelPackage/mt7981-firmware/install
+	$(INSTALL_DIR) $(1)/lib/firmware/mediatek
+	cp \
+		$(PKG_BUILD_DIR)/firmware/mt7981_wa.bin \
+		$(PKG_BUILD_DIR)/firmware/mt7981_wm.bin \
+		$(PKG_BUILD_DIR)/firmware/mt7981_rom_patch.bin \
+		$(1)/lib/firmware/mediatek
+endef
+
 define KernelPackage/mt7986-firmware/install
 	$(INSTALL_DIR) $(1)/lib/firmware/mediatek
 	cp \
@@ -473,7 +525,7 @@ define KernelPackage/mt7986-firmware/install
 		$(1)/lib/firmware/mediatek
 endef
 
-define KernelPackage/mt7921e/install
+define KernelPackage/mt7921-firmware/install
 	$(INSTALL_DIR) $(1)/lib/firmware/mediatek
 	cp \
 		$(PKG_BUILD_DIR)/firmware/WIFI_MT7961_patch_mcu_1_2_hdr.bin \
@@ -501,14 +553,19 @@ $(eval $(call KernelPackage,mt76-connac))
 $(eval $(call KernelPackage,mt76-sdio))
 $(eval $(call KernelPackage,mt7615-common))
 $(eval $(call KernelPackage,mt7615-firmware))
+$(eval $(call KernelPackage,mt7622-firmware))
 $(eval $(call KernelPackage,mt7615e))
 $(eval $(call KernelPackage,mt7663-firmware-ap))
 $(eval $(call KernelPackage,mt7663-firmware-sta))
 $(eval $(call KernelPackage,mt7663-usb-sdio))
 $(eval $(call KernelPackage,mt7663u))
 $(eval $(call KernelPackage,mt7663s))
+$(eval $(call KernelPackage,mt7915-firmware))
 $(eval $(call KernelPackage,mt7915e))
+$(eval $(call KernelPackage,mt7916-firmware))
+$(eval $(call KernelPackage,mt7981-firmware))
 $(eval $(call KernelPackage,mt7986-firmware))
+$(eval $(call KernelPackage,mt7921-firmware))
 $(eval $(call KernelPackage,mt7921-common))
 $(eval $(call KernelPackage,mt7921u))
 $(eval $(call KernelPackage,mt7921s))
diff --git a/package/kernel/mwlwifi/Makefile b/package/kernel/mwlwifi/Makefile
index bd2c7cfc4ae33f..130ed01fdc21ee 100644
--- a/package/kernel/mwlwifi/Makefile
+++ b/package/kernel/mwlwifi/Makefile
@@ -8,16 +8,16 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mwlwifi
-PKG_RELEASE=3
+PKG_RELEASE=1
 
 PKG_LICENSE:=ISC
 PKG_LICENSE_FILES:=
 
 PKG_SOURCE_URL:=https://github.com/kaloz/mwlwifi
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2020-02-06
-PKG_SOURCE_VERSION:=a2fd00bb74c35820dfe233d762690c0433a87ef5
-PKG_MIRROR_HASH:=0eda0e774a87e58e611d6436350e1cf2be3de50fddde334909a07a15b0c9862b
+PKG_SOURCE_DATE:=2023-04-29
+PKG_SOURCE_VERSION:=6a436714d2ea0d0adf39fc4d7d45e6a17fcc9371
+PKG_MIRROR_HASH:=dcc320a8f859b732ff65c7ded0b5199a625bfba05a775a6bed15ed3c10cb2748
 
 PKG_MAINTAINER:=Imre Kaloz <kaloz@openwrt.org>
 PKG_BUILD_PARALLEL:=1
@@ -29,7 +29,7 @@ include $(INCLUDE_DIR)/package.mk
 define KernelPackage/mwlwifi
   SUBMENU:=Wireless Drivers
   TITLE:=Marvell 88W8864/88W8897/88W8964/88W8997 wireless driver
-  DEPENDS:=+kmod-mac80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT @PCI_SUPPORT @TARGET_mvebu
+  DEPENDS:=+kmod-mac80211 +@DRIVER_11AC_SUPPORT @PCI_SUPPORT @TARGET_mvebu
   FILES:=$(PKG_BUILD_DIR)/mwlwifi.ko
   AUTOLOAD:=$(call AutoLoad,50,mwlwifi)
 endef
@@ -41,11 +41,11 @@ NOSTDINC_FLAGS := \
 	-I$(STAGING_DIR)/usr/include/mac80211-backport \
 	-I$(STAGING_DIR)/usr/include/mac80211/uapi \
 	-I$(STAGING_DIR)/usr/include/mac80211 \
-	-include backport/backport.h
+	-include backport/backport.h \
+	-Wno-unused-result
 
 define Build/Compile
-	+$(MAKE) $(PKG_JOBS) -C "$(LINUX_DIR)" \
-		$(KERNEL_MAKE_FLAGS) \
+	+$(KERNEL_MAKE) $(PKG_JOBS) \
 		M="$(PKG_BUILD_DIR)" \
 		NOSTDINC_FLAGS="$(NOSTDINC_FLAGS)" \
 		modules
diff --git a/package/kernel/mwlwifi/patches/001-Fix-compilation-warning-with-64-bit-system.patch b/package/kernel/mwlwifi/patches/001-Fix-compilation-warning-with-64-bit-system.patch
new file mode 100644
index 00000000000000..8e71918cf3f828
--- /dev/null
+++ b/package/kernel/mwlwifi/patches/001-Fix-compilation-warning-with-64-bit-system.patch
@@ -0,0 +1,176 @@
+From ed4422e98ababf956674da3438ac42b3aa32c66e Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 10 May 2023 00:41:06 +0200
+Subject: [PATCH] Fix compilation warning with 64 bit system
+
+Use %zu and %zd where possible for ssize_t and size_t.
+Use PTR_ERR to correctly convert to negative error.
+Use universal pointer to support both 32 and 64bit systems.
+
+Fix compilation warning:
+/home/ansuel/openwrt-ansuel/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/mwlwifi-2023-04-29-6a436714/hif/fwcmd.c: In function 'mwl_fwcmd_get_fw_core_dump':
+/home/ansuel/openwrt-ansuel/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/mwlwifi-2023-04-29-6a436714/hif/fwcmd.c:3608:31: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast]
+ 3608 |                (const void *)((u32)pcmd +
+      |                               ^
+In file included from ./include/linux/device.h:15,
+                 from /home/ansuel/openwrt-ansuel/openwrt/staging_dir/target-aarch64_cortex-a53_musl/usr/include/mac80211-backport/linux/device.h:3,
+                 from ./include/linux/dma-mapping.h:7,
+                 from /home/ansuel/openwrt-ansuel/openwrt/staging_dir/target-aarch64_cortex-a53_musl/usr/include/mac80211-backport/linux/dma-mapping.h:3,
+                 from ./include/linux/skbuff.h:31,
+                 from /home/ansuel/openwrt-ansuel/openwrt/staging_dir/target-aarch64_cortex-a53_musl/usr/include/mac80211-backport/linux/skbuff.h:3,
+                 from ./include/linux/if_ether.h:19,
+                 from /home/ansuel/openwrt-ansuel/openwrt/staging_dir/target-aarch64_cortex-a53_musl/usr/include/mac80211-backport/linux/if_ether.h:3,
+                 from ./include/linux/etherdevice.h:20,
+                 from /home/ansuel/openwrt-ansuel/openwrt/staging_dir/target-aarch64_cortex-a53_musl/usr/include/mac80211-backport/linux/etherdevice.h:3,
+                 from /home/ansuel/openwrt-ansuel/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/mwlwifi-2023-04-29-6a436714/hif/pcie/tx_ndp.c:20:
+/home/ansuel/openwrt-ansuel/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/mwlwifi-2023-04-29-6a436714/hif/pcie/tx_ndp.c: In function 'pcie_tx_init_ndp':
+/home/ansuel/openwrt-ansuel/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/mwlwifi-2023-04-29-6a436714/hif/pcie/tx_ndp.c:338:38: error: format '%d' expects argument of type 'int', but argument 3 has type 'long unsigned int' [-Werror=format=]
+  338 |                 wiphy_err(hw->wiphy, "driver data is not enough: %d (%d)\n",
+      |                                      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+./include/linux/dev_printk.h:110:30: note: in definition of macro 'dev_printk_index_wrap'
+  110 |                 _p_func(dev, fmt, ##__VA_ARGS__);                       \
+      |                              ^~~
+./include/linux/dev_printk.h:144:56: note: in expansion of macro 'dev_fmt'
+  144 |         dev_printk_index_wrap(_dev_err, KERN_ERR, dev, dev_fmt(fmt), ##__VA_ARGS__)
+      |                                                        ^~~~~~~
+/home/ansuel/openwrt-ansuel/openwrt/staging_dir/target-aarch64_cortex-a53_musl/usr/include/mac80211/net/cfg80211.h:8828:9: note: in expansion of macro 'dev_err'
+ 8828 |         dev_err(&(wiphy)->dev, format, ##args)
+      |         ^~~~~~~
+/home/ansuel/openwrt-ansuel/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/mwlwifi-2023-04-29-6a436714/hif/pcie/tx_ndp.c:338:17: note: in expansion of macro 'wiphy_err'
+  338 |                 wiphy_err(hw->wiphy, "driver data is not enough: %d (%d)\n",
+      |                 ^~~~~~~~~
+/home/ansuel/openwrt-ansuel/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/mwlwifi-2023-04-29-6a436714/hif/pcie/tx_ndp.c:338:67: note: format string is defined here
+  338 |                 wiphy_err(hw->wiphy, "driver data is not enough: %d (%d)\n",
+      |                                                                  ~^
+      |                                                                   |
+      |                                                                   int
+      |                                                                  %ld
+/home/ansuel/openwrt-ansuel/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/mwlwifi-2023-04-29-6a436714/hif/pcie/tx_ndp.c:338:38: error: format '%d' expects argument of type 'int', but argument 4 has type 'long unsigned int' [-Werror=format=]
+  338 |                 wiphy_err(hw->wiphy, "driver data is not enough: %d (%d)\n",
+      |                                      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+./include/linux/dev_printk.h:110:30: note: in definition of macro 'dev_printk_index_wrap'
+  110 |                 _p_func(dev, fmt, ##__VA_ARGS__);                       \
+      |                              ^~~
+./include/linux/dev_printk.h:144:56: note: in expansion of macro 'dev_fmt'
+  144 |         dev_printk_index_wrap(_dev_err, KERN_ERR, dev, dev_fmt(fmt), ##__VA_ARGS__)
+      |                                                        ^~~~~~~
+/home/ansuel/openwrt-ansuel/openwrt/staging_dir/target-aarch64_cortex-a53_musl/usr/include/mac80211/net/cfg80211.h:8828:9: note: in expansion of macro 'dev_err'
+ 8828 |         dev_err(&(wiphy)->dev, format, ##args)
+      |         ^~~~~~~
+/home/ansuel/openwrt-ansuel/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/mwlwifi-2023-04-29-6a436714/hif/pcie/tx_ndp.c:338:17: note: in expansion of macro 'wiphy_err'
+  338 |                 wiphy_err(hw->wiphy, "driver data is not enough: %d (%d)\n",
+      |                 ^~~~~~~~~
+/home/ansuel/openwrt-ansuel/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/mwlwifi-2023-04-29-6a436714/hif/pcie/tx_ndp.c:338:71: note: format string is defined here
+  338 |                 wiphy_err(hw->wiphy, "driver data is not enough: %d (%d)\n",
+      |                                                                      ~^
+      |                                                                       |
+      |                                                                       int
+      |                                                                      %ld
+  CC [M]  /home/ansuel/openwrt-ansuel/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/mwlwifi-2023-04-29-6a436714/debugfs.o
+In file included from ./include/linux/device.h:15,
+                 from /home/ansuel/openwrt-ansuel/openwrt/staging_dir/target-aarch64_cortex-a53_musl/usr/include/mac80211-backport/linux/device.h:3,
+                 from ./include/linux/dma-mapping.h:7,
+                 from /home/ansuel/openwrt-ansuel/openwrt/staging_dir/target-aarch64_cortex-a53_musl/usr/include/mac80211-backport/linux/dma-mapping.h:3,
+                 from ./include/linux/skbuff.h:31,
+                 from /home/ansuel/openwrt-ansuel/openwrt/staging_dir/target-aarch64_cortex-a53_musl/usr/include/mac80211-backport/linux/skbuff.h:3,
+                 from ./include/linux/if_ether.h:19,
+                 from /home/ansuel/openwrt-ansuel/openwrt/staging_dir/target-aarch64_cortex-a53_musl/usr/include/mac80211-backport/linux/if_ether.h:3,
+                 from ./include/linux/etherdevice.h:20,
+                 from /home/ansuel/openwrt-ansuel/openwrt/staging_dir/target-aarch64_cortex-a53_musl/usr/include/mac80211-backport/linux/etherdevice.h:3,
+                 from /home/ansuel/openwrt-ansuel/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/mwlwifi-2023-04-29-6a436714/hif/pcie/pcie.c:19:
+/home/ansuel/openwrt-ansuel/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/mwlwifi-2023-04-29-6a436714/hif/pcie/pcie.c: In function 'pcie_bf_mimo_ctrl_decode':
+/home/ansuel/openwrt-ansuel/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/mwlwifi-2023-04-29-6a436714/hif/pcie/pcie.c:1325:37: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast]
+ 1325 |                           filename, (unsigned int)fp_data);
+      |                                     ^
+./include/linux/dev_printk.h:110:37: note: in definition of macro 'dev_printk_index_wrap'
+  110 |                 _p_func(dev, fmt, ##__VA_ARGS__);                       \
+      |                                     ^~~~~~~~~~~
+/home/ansuel/openwrt-ansuel/openwrt/staging_dir/target-aarch64_cortex-a53_musl/usr/include/mac80211/net/cfg80211.h:8828:9: note: in expansion of macro 'dev_err'
+ 8828 |         dev_err(&(wiphy)->dev, format, ##args)
+      |         ^~~~~~~
+/home/ansuel/openwrt-ansuel/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/mwlwifi-2023-04-29-6a436714/hif/pcie/pcie.c:1324:17: note: in expansion of macro 'wiphy_err'
+ 1324 |                 wiphy_err(priv->hw->wiphy, "Error opening %s! %x\n",
+      |                 ^~~~~~~~~
+cc1: all warnings being treated as errors
+make[4]: *** [scripts/Makefile.build:289: /home/ansuel/openwrt-ansuel/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/mwlwifi-2023-04-29-6a436714/hif/pcie/tx_ndp.o] Error 1
+make[4]: *** Waiting for unfinished jobs....
+cc1: all warnings being treated as errors
+make[4]: *** [scripts/Makefile.build:289: /home/ansuel/openwrt-ansuel/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/mwlwifi-2023-04-29-6a436714/hif/pcie/pcie.o] Error 1
+/home/ansuel/openwrt-ansuel/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/mwlwifi-2023-04-29-6a436714/debugfs.c: In function 'mwl_debugfs_regrdwr_read':
+/home/ansuel/openwrt-ansuel/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/mwlwifi-2023-04-29-6a436714/debugfs.c:1335:43: error: format '%d' expects argument of type 'int', but argument 4 has type 'ssize_t' {aka 'long int'} [-Werror=format=]
+ 1335 |                                  "error: %d(%u 0x%08x 0x%08x)\n",
+      |                                          ~^
+      |                                           |
+      |                                           int
+      |                                          %ld
+ 1336 |                                  ret, priv->reg_type, priv->reg_offset,
+      |                                  ~~~
+      |                                  |
+      |                                  ssize_t {aka long int}
+cc1: all warnings being treated as errors
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ debugfs.c         | 2 +-
+ hif/fwcmd.c       | 2 +-
+ hif/pcie/pcie.c   | 4 ++--
+ hif/pcie/tx_ndp.c | 2 +-
+ 4 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/debugfs.c b/debugfs.c
+index 39b09fd..42efd28 100644
+--- a/debugfs.c
++++ b/debugfs.c
+@@ -1332,7 +1332,7 @@ done:
+ 				 priv->reg_value);
+ 	else
+ 		len += scnprintf(p + len, size - len,
+-				 "error: %d(%u 0x%08x 0x%08x)\n",
++				 "error: %zd(%u 0x%08x 0x%08x)\n",
+ 				 ret, priv->reg_type, priv->reg_offset,
+ 				 priv->reg_value);
+ 
+diff --git a/hif/fwcmd.c b/hif/fwcmd.c
+index 376b58f..582c8d2 100644
+--- a/hif/fwcmd.c
++++ b/hif/fwcmd.c
+@@ -3604,7 +3604,7 @@ int mwl_fwcmd_get_fw_core_dump(struct ieee80211_hw *hw,
+ 	core_dump->size_kb = pcmd->cmd_data.coredump.size_kb;
+ 	core_dump->flags = pcmd->cmd_data.coredump.flags;
+ 	memcpy(buff,
+-	       (const void *)((u32)pcmd +
++	       (const void *)((uintptr_t)pcmd +
+ 	       sizeof(struct hostcmd_cmd_get_fw_core_dump) -
+ 	       sizeof(struct hostcmd_cmd_get_fw_core_dump_)),
+ 	       MAX_CORE_DUMP_BUFFER);
+diff --git a/hif/pcie/pcie.c b/hif/pcie/pcie.c
+index 24453b6..5b6c633 100644
+--- a/hif/pcie/pcie.c
++++ b/hif/pcie/pcie.c
+@@ -1320,8 +1320,8 @@ static void pcie_bf_mimo_ctrl_decode(struct mwl_priv *priv,
+ 			       &fp_data->f_pos);
+ 		filp_close(fp_data, current->files);
+ 	} else {
+-		wiphy_err(priv->hw->wiphy, "Error opening %s! %x\n",
+-			  filename, (unsigned int)fp_data);
++		wiphy_err(priv->hw->wiphy, "Error opening %s! %ld\n",
++			  filename, PTR_ERR(fp_data));
+ 	}
+ 
+ #if LINUX_VERSION_CODE < KERNEL_VERSION(5,10,0)
+diff --git a/hif/pcie/tx_ndp.c b/hif/pcie/tx_ndp.c
+index 6758cde..3140a2e 100644
+--- a/hif/pcie/tx_ndp.c
++++ b/hif/pcie/tx_ndp.c
+@@ -335,7 +335,7 @@ int pcie_tx_init_ndp(struct ieee80211_hw *hw)
+ 
+ 	if (sizeof(struct pcie_tx_ctrl_ndp) >
+ 	    sizeof(tx_info->status.status_driver_data)) {
+-		wiphy_err(hw->wiphy, "driver data is not enough: %d (%d)\n",
++		wiphy_err(hw->wiphy, "driver data is not enough: %zu (%zu)\n",
+ 			  sizeof(struct pcie_tx_ctrl_ndp),
+ 			  sizeof(tx_info->status.status_driver_data));
+ 		return -ENOMEM;
+-- 
+2.39.2
+
diff --git a/package/kernel/mwlwifi/patches/004-mwlwifi-fix-PCIe-DT-node-null-pointer-dereference.patch b/package/kernel/mwlwifi/patches/004-mwlwifi-fix-PCIe-DT-node-null-pointer-dereference.patch
index 9b9e49b66ab385..3d9ec4dcfb3ac2 100644
--- a/package/kernel/mwlwifi/patches/004-mwlwifi-fix-PCIe-DT-node-null-pointer-dereference.patch
+++ b/package/kernel/mwlwifi/patches/004-mwlwifi-fix-PCIe-DT-node-null-pointer-dereference.patch
@@ -19,7 +19,7 @@ Signed-off-by: Robert Marko <robert.marko@sartura.hr>
 
 --- a/hif/pcie/pcie.c
 +++ b/hif/pcie/pcie.c
-@@ -570,7 +570,8 @@ static struct device_node *pcie_get_devi
+@@ -573,7 +573,8 @@ static struct device_node *pcie_get_devi
  	struct device_node *dev_node;
  
  	dev_node = pci_bus_to_OF_node(pcie_priv->pdev->bus);
diff --git a/package/kernel/mwlwifi/patches/005-mac80211_update.patch b/package/kernel/mwlwifi/patches/005-mac80211_update.patch
new file mode 100644
index 00000000000000..c11cf8c9469d43
--- /dev/null
+++ b/package/kernel/mwlwifi/patches/005-mac80211_update.patch
@@ -0,0 +1,393 @@
+--- a/core.c
++++ b/core.c
+@@ -706,7 +706,7 @@ static void mwl_chnl_switch_event(struct
+ 		vif = container_of((void *)mwl_vif, struct ieee80211_vif,
+ 				   drv_priv);
+ 
+-		if (vif->csa_active)
++		if (vif->bss_conf.csa_active)
+ 			ieee80211_csa_finish(vif);
+ 	}
+ 	spin_unlock_bh(&priv->vif_lock);
+--- a/debugfs.c
++++ b/debugfs.c
+@@ -455,9 +455,9 @@ static ssize_t mwl_debugfs_vif_read(stru
+ 		switch (vif->type) {
+ 		case NL80211_IFTYPE_AP:
+ 			len += scnprintf(p + len, size - len, "type: ap\n");
+-			memcpy(ssid, vif->bss_conf.ssid,
+-			       vif->bss_conf.ssid_len);
+-			ssid[vif->bss_conf.ssid_len] = 0;
++			memcpy(ssid, vif->cfg.ssid,
++			       vif->cfg.ssid_len);
++			ssid[vif->cfg.ssid_len] = 0;
+ 			len += scnprintf(p + len, size - len,
+ 					 "ssid: %s\n", ssid);
+ 			len += scnprintf(p + len, size - len,
+@@ -479,8 +479,8 @@ static ssize_t mwl_debugfs_vif_read(stru
+ 					 "type: unknown\n");
+ 			break;
+ 		}
+-		if (vif->chanctx_conf) {
+-			chan_def = &vif->chanctx_conf->def;
++		if (vif->bss_conf.chanctx_conf) {
++			chan_def = &vif->bss_conf.chanctx_conf->def;
+ 			len += scnprintf(p + len, size - len,
+ 					 "channel: %d: width: %d\n",
+ 					 chan_def->chan->hw_value,
+@@ -564,28 +564,28 @@ static ssize_t mwl_debugfs_sta_read(stru
+ 					 "amsdu cap: 0x%02x\n",
+ 					 sta_info->amsdu_ctrl.cap);
+ 		}
+-		if (sta->ht_cap.ht_supported) {
++		if (sta->deflink.ht_cap.ht_supported) {
+ 			len += scnprintf(p + len, size - len,
+ 					 "ht_cap: 0x%04x, ampdu: %02x, %02x\n",
+-					 sta->ht_cap.cap,
+-					 sta->ht_cap.ampdu_factor,
+-					 sta->ht_cap.ampdu_density);
++					 sta->deflink.ht_cap.cap,
++					 sta->deflink.ht_cap.ampdu_factor,
++					 sta->deflink.ht_cap.ampdu_density);
+ 			len += scnprintf(p + len, size - len,
+ 					 "rx_mask: 0x%02x, %02x, %02x, %02x\n",
+-					 sta->ht_cap.mcs.rx_mask[0],
+-					 sta->ht_cap.mcs.rx_mask[1],
+-					 sta->ht_cap.mcs.rx_mask[2],
+-					 sta->ht_cap.mcs.rx_mask[3]);
++					 sta->deflink.ht_cap.mcs.rx_mask[0],
++					 sta->deflink.ht_cap.mcs.rx_mask[1],
++					 sta->deflink.ht_cap.mcs.rx_mask[2],
++					 sta->deflink.ht_cap.mcs.rx_mask[3]);
+ 		}
+-		if (sta->vht_cap.vht_supported) {
++		if (sta->deflink.vht_cap.vht_supported) {
+ 			len += scnprintf(p + len, size - len,
+ 					 "vht_cap: 0x%08x, mcs: %02x, %02x\n",
+-					 sta->vht_cap.cap,
+-					 sta->vht_cap.vht_mcs.rx_mcs_map,
+-					 sta->vht_cap.vht_mcs.tx_mcs_map);
++					 sta->deflink.vht_cap.cap,
++					 sta->deflink.vht_cap.vht_mcs.rx_mcs_map,
++					 sta->deflink.vht_cap.vht_mcs.tx_mcs_map);
+ 		}
+ 		len += scnprintf(p + len, size - len, "rx_bw: %d, rx_nss: %d\n",
+-				 sta->bandwidth, sta->rx_nss);
++				 sta->deflink.bandwidth, sta->deflink.rx_nss);
+ 		len += scnprintf(p + len, size - len,
+ 				 "tdls: %d, tdls_init: %d\n",
+ 				 sta->tdls, sta->tdls_initiator);
+--- a/hif/fwcmd.c
++++ b/hif/fwcmd.c
+@@ -634,8 +634,9 @@ einval:
+ 
+ static int mwl_fwcmd_set_ap_beacon(struct mwl_priv *priv,
+ 				   struct mwl_vif *mwl_vif,
+-				   struct ieee80211_bss_conf *bss_conf)
++				   struct ieee80211_vif *vif)
+ {
++	struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
+ 	struct hostcmd_cmd_ap_beacon *pcmd;
+ 	struct ds_params *phy_ds_param_set;
+ 
+@@ -664,7 +665,7 @@ static int mwl_fwcmd_set_ap_beacon(struc
+ 	pcmd->cmd_hdr.macid = mwl_vif->macid;
+ 
+ 	ether_addr_copy(pcmd->start_cmd.sta_mac_addr, mwl_vif->bssid);
+-	memcpy(pcmd->start_cmd.ssid, bss_conf->ssid, bss_conf->ssid_len);
++	memcpy(pcmd->start_cmd.ssid, vif->cfg.ssid, vif->cfg.ssid_len);
+ 	if (priv->chip_type == MWL8997)
+ 		ether_addr_copy(pcmd->start_cmd.bssid, mwl_vif->bssid);
+ 	pcmd->start_cmd.bss_type = 1;
+@@ -2091,7 +2092,7 @@ int mwl_fwcmd_set_beacon(struct ieee8021
+ 	if (mwl_fwcmd_set_wsc_ie(hw, b_inf->ie_wsc_len, b_inf->ie_wsc_ptr))
+ 		goto err;
+ 
+-	if (mwl_fwcmd_set_ap_beacon(priv, mwl_vif, &vif->bss_conf))
++	if (mwl_fwcmd_set_ap_beacon(priv, mwl_vif, vif))
+ 		goto err;
+ 
+ 	if (b_inf->cap_info & WLAN_CAPABILITY_SPECTRUM_MGMT)
+@@ -2153,38 +2154,38 @@ int mwl_fwcmd_set_new_stn_add(struct iee
+ 	ether_addr_copy(pcmd->mac_addr, sta->addr);
+ 
+ 	if (hw->conf.chandef.chan->band == NL80211_BAND_2GHZ)
+-		rates = sta->supp_rates[NL80211_BAND_2GHZ];
++		rates = sta->deflink.supp_rates[NL80211_BAND_2GHZ];
+ 	else
+-		rates = sta->supp_rates[NL80211_BAND_5GHZ] << 5;
++		rates = sta->deflink.supp_rates[NL80211_BAND_5GHZ] << 5;
+ 	pcmd->peer_info.legacy_rate_bitmap = cpu_to_le32(rates);
+ 
+-	if (sta->ht_cap.ht_supported) {
++	if (sta->deflink.ht_cap.ht_supported) {
+ 		int i;
+ 
+ 		for (i = 0; i < 4; i++) {
+-			if (i < sta->rx_nss) {
++			if (i < sta->deflink.rx_nss) {
+ 				pcmd->peer_info.ht_rates[i] =
+-					sta->ht_cap.mcs.rx_mask[i];
++					sta->deflink.ht_cap.mcs.rx_mask[i];
+ 			} else {
+ 				pcmd->peer_info.ht_rates[i] = 0;
+ 			}
+ 		}
+-		pcmd->peer_info.ht_cap_info = cpu_to_le16(sta->ht_cap.cap);
++		pcmd->peer_info.ht_cap_info = cpu_to_le16(sta->deflink.ht_cap.cap);
+ 		pcmd->peer_info.mac_ht_param_info =
+-			(sta->ht_cap.ampdu_factor & 3) |
+-			((sta->ht_cap.ampdu_density & 7) << 2);
++			(sta->deflink.ht_cap.ampdu_factor & 3) |
++			((sta->deflink.ht_cap.ampdu_density & 7) << 2);
+ 	}
+ 
+-	if (sta->vht_cap.vht_supported) {
++	if (sta->deflink.vht_cap.vht_supported) {
+ 		u32 rx_mcs_map_mask = 0;
+ 
+-		rx_mcs_map_mask = ((0x0000FFFF) >> (sta->rx_nss * 2))
+-			<< (sta->rx_nss * 2);
++		rx_mcs_map_mask = ((0x0000FFFF) >> (sta->deflink.rx_nss * 2))
++			<< (sta->deflink.rx_nss * 2);
+ 		pcmd->peer_info.vht_max_rx_mcs =
+ 			cpu_to_le32((*((u32 *)
+-			&sta->vht_cap.vht_mcs.rx_mcs_map)) | rx_mcs_map_mask);
+-		pcmd->peer_info.vht_cap = cpu_to_le32(sta->vht_cap.cap);
+-		pcmd->peer_info.vht_rx_channel_width = sta->bandwidth;
++			&sta->deflink.vht_cap.vht_mcs.rx_mcs_map)) | rx_mcs_map_mask);
++		pcmd->peer_info.vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
++		pcmd->peer_info.vht_rx_channel_width = sta->deflink.bandwidth;
+ 	}
+ 
+ 	pcmd->is_qos_sta = sta->wme;
+@@ -2240,38 +2241,38 @@ int mwl_fwcmd_set_new_stn_add_sc4(struct
+ 	ether_addr_copy(pcmd->mac_addr, sta->addr);
+ 
+ 	if (hw->conf.chandef.chan->band == NL80211_BAND_2GHZ)
+-		rates = sta->supp_rates[NL80211_BAND_2GHZ];
++		rates = sta->deflink.supp_rates[NL80211_BAND_2GHZ];
+ 	else
+-		rates = sta->supp_rates[NL80211_BAND_5GHZ] << 5;
++		rates = sta->deflink.supp_rates[NL80211_BAND_5GHZ] << 5;
+ 	pcmd->peer_info.legacy_rate_bitmap = cpu_to_le32(rates);
+ 
+-	if (sta->ht_cap.ht_supported) {
++	if (sta->deflink.ht_cap.ht_supported) {
+ 		int i;
+ 
+ 		for (i = 0; i < 4; i++) {
+-			if (i < sta->rx_nss) {
++			if (i < sta->deflink.rx_nss) {
+ 				pcmd->peer_info.ht_rates[i] =
+-					sta->ht_cap.mcs.rx_mask[i];
++					sta->deflink.ht_cap.mcs.rx_mask[i];
+ 			} else {
+ 				pcmd->peer_info.ht_rates[i] = 0;
+ 			}
+ 		}
+-		pcmd->peer_info.ht_cap_info = cpu_to_le16(sta->ht_cap.cap);
++		pcmd->peer_info.ht_cap_info = cpu_to_le16(sta->deflink.ht_cap.cap);
+ 		pcmd->peer_info.mac_ht_param_info =
+-			(sta->ht_cap.ampdu_factor & 3) |
+-			((sta->ht_cap.ampdu_density & 7) << 2);
++			(sta->deflink.ht_cap.ampdu_factor & 3) |
++			((sta->deflink.ht_cap.ampdu_density & 7) << 2);
+ 	}
+ 
+-	if (sta->vht_cap.vht_supported) {
++	if (sta->deflink.vht_cap.vht_supported) {
+ 		u32 rx_mcs_map_mask = 0;
+ 
+-		rx_mcs_map_mask = ((0x0000FFFF) >> (sta->rx_nss * 2))
+-			<< (sta->rx_nss * 2);
++		rx_mcs_map_mask = ((0x0000FFFF) >> (sta->deflink.rx_nss * 2))
++			<< (sta->deflink.rx_nss * 2);
+ 		pcmd->peer_info.vht_max_rx_mcs =
+ 			cpu_to_le32((*((u32 *)
+-			&sta->vht_cap.vht_mcs.rx_mcs_map)) | rx_mcs_map_mask);
+-		pcmd->peer_info.vht_cap = cpu_to_le32(sta->vht_cap.cap);
+-		pcmd->peer_info.vht_rx_channel_width = sta->bandwidth;
++			&sta->deflink.vht_cap.vht_mcs.rx_mcs_map)) | rx_mcs_map_mask);
++		pcmd->peer_info.vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
++		pcmd->peer_info.vht_rx_channel_width = sta->deflink.bandwidth;
+ 	}
+ 
+ 	pcmd->is_qos_sta = sta->wme;
+@@ -2788,9 +2789,9 @@ int mwl_fwcmd_create_ba(struct ieee80211
+ 	pcmd->ba_info.create_params.flags = cpu_to_le32(ba_flags);
+ 	pcmd->ba_info.create_params.queue_id = stream->idx;
+ 	pcmd->ba_info.create_params.param_info =
+-		(stream->sta->ht_cap.ampdu_factor &
++		(stream->sta->deflink.ht_cap.ampdu_factor &
+ 		 IEEE80211_HT_AMPDU_PARM_FACTOR) |
+-		((stream->sta->ht_cap.ampdu_density << 2) &
++		((stream->sta->deflink.ht_cap.ampdu_density << 2) &
+ 		 IEEE80211_HT_AMPDU_PARM_DENSITY);
+ 	if (direction == BA_FLAG_DIRECTION_UP) {
+ 		pcmd->ba_info.create_params.reset_seq_no = 0;
+@@ -2800,9 +2801,9 @@ int mwl_fwcmd_create_ba(struct ieee80211
+ 		pcmd->ba_info.create_params.current_seq = cpu_to_le16(0);
+ 	}
+ 	if (priv->chip_type == MWL8964 &&
+-	    stream->sta->vht_cap.vht_supported) {
++	    stream->sta->deflink.vht_cap.vht_supported) {
+ 		pcmd->ba_info.create_params.vht_rx_factor =
+-			cpu_to_le32((stream->sta->vht_cap.cap  &
++			cpu_to_le32((stream->sta->deflink.vht_cap.cap  &
+ 			IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK) >>
+ 			IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT);
+ 	}
+--- a/mac80211.c
++++ b/mac80211.c
+@@ -371,15 +371,15 @@ static void mwl_mac80211_bss_info_change
+ 		}
+ 	}
+ 
+-	if ((changed & BSS_CHANGED_ASSOC) && vif->bss_conf.assoc)
++	if ((changed & BSS_CHANGED_ASSOC) && vif->cfg.assoc)
+ 		mwl_fwcmd_set_aid(hw, vif, (u8 *)vif->bss_conf.bssid,
+-				  vif->bss_conf.aid);
++				  vif->cfg.aid);
+ }
+ 
+ static void mwl_mac80211_bss_info_changed_ap(struct ieee80211_hw *hw,
+ 					     struct ieee80211_vif *vif,
+ 					     struct ieee80211_bss_conf *info,
+-					     u32 changed)
++					     u64 changed)
+ {
+ 	struct mwl_priv *priv = hw->priv;
+ 	struct mwl_vif *mwl_vif;
+@@ -429,8 +429,8 @@ static void mwl_mac80211_bss_info_change
+ 	if (changed & (BSS_CHANGED_BEACON_INT | BSS_CHANGED_BEACON)) {
+ 		struct sk_buff *skb;
+ 
+-		if ((info->ssid[0] != '\0') &&
+-		    (info->ssid_len != 0) &&
++		if ((vif->cfg.ssid[0] != '\0') &&
++		    (vif->cfg.ssid_len != 0) &&
+ 		    (!info->hidden_ssid)) {
+ 			if (mwl_vif->broadcast_ssid != true) {
+ 				mwl_fwcmd_broadcast_ssid_enable(hw, vif, true);
+@@ -444,7 +444,7 @@ static void mwl_mac80211_bss_info_change
+ 		}
+ 
+ 		if (!mwl_vif->set_beacon) {
+-			skb = ieee80211_beacon_get(hw, vif);
++			skb = ieee80211_beacon_get(hw, vif, 0);
+ 
+ 			if (skb) {
+ 				mwl_fwcmd_set_beacon(hw, vif, skb->data, skb->len);
+@@ -461,7 +461,7 @@ static void mwl_mac80211_bss_info_change
+ static void mwl_mac80211_bss_info_changed(struct ieee80211_hw *hw,
+ 					  struct ieee80211_vif *vif,
+ 					  struct ieee80211_bss_conf *info,
+-					  u32 changed)
++					  u64 changed)
+ {
+ 	switch (vif->type) {
+ 	case NL80211_IFTYPE_AP:
+@@ -584,10 +584,10 @@ static int mwl_mac80211_sta_add(struct i
+ 	if (vif->type == NL80211_IFTYPE_MESH_POINT)
+ 		sta_info->is_mesh_node = true;
+ 
+-	if (sta->ht_cap.ht_supported) {
++	if (sta->deflink.ht_cap.ht_supported) {
+ 		sta_info->is_ampdu_allowed = true;
+ 		sta_info->is_amsdu_allowed = false;
+-		if (sta->ht_cap.cap & IEEE80211_HT_CAP_MAX_AMSDU)
++		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_MAX_AMSDU)
+ 			sta_info->amsdu_ctrl.cap = MWL_AMSDU_SIZE_8K;
+ 		else
+ 			sta_info->amsdu_ctrl.cap = MWL_AMSDU_SIZE_4K;
+@@ -669,7 +669,7 @@ static int mwl_mac80211_sta_remove(struc
+ 
+ static int mwl_mac80211_conf_tx(struct ieee80211_hw *hw,
+ 				struct ieee80211_vif *vif,
+-				u16 queue,
++				unsigned int link_id, u16 queue,
+ 				const struct ieee80211_tx_queue_params *params)
+ {
+ 	struct mwl_priv *priv = hw->priv;
+@@ -928,4 +928,5 @@ const struct ieee80211_ops mwl_mac80211_
+ 	.pre_channel_switch = mwl_mac80211_chnl_switch,
+ 	.sw_scan_start      = mwl_mac80211_sw_scan_start,
+ 	.sw_scan_complete   = mwl_mac80211_sw_scan_complete,
++	.wake_tx_queue	    = ieee80211_handle_wake_tx_queue,
+ };
+--- a/utils.c
++++ b/utils.c
+@@ -173,9 +173,9 @@ u32 utils_get_init_tx_rate(struct mwl_pr
+ 	u32 tx_rate;
+ 	u16 format, nss, bw, rate_mcs;
+ 
+-	if (sta->vht_cap.vht_supported)
++	if (sta->deflink.vht_cap.vht_supported)
+ 		format = TX_RATE_FORMAT_11AC;
+-	else if (sta->ht_cap.ht_supported)
++	else if (sta->deflink.ht_cap.ht_supported)
+ 		format = TX_RATE_FORMAT_11N;
+ 	else
+ 		format = TX_RATE_FORMAT_LEGACY;
+@@ -192,11 +192,11 @@ u32 utils_get_init_tx_rate(struct mwl_pr
+ 		nss = 3;
+ 		break;
+ 	default:
+-		nss = sta->rx_nss;
++		nss = sta->deflink.rx_nss;
+ 		break;
+ 	}
+-	if (nss > sta->rx_nss)
+-		nss = sta->rx_nss;
++	if (nss > sta->deflink.rx_nss)
++		nss = sta->deflink.rx_nss;
+ 
+ 	switch (conf->chandef.width) {
+ 	case NL80211_CHAN_WIDTH_20_NOHT:
+@@ -213,11 +213,11 @@ u32 utils_get_init_tx_rate(struct mwl_pr
+ 		bw = TX_RATE_BANDWIDTH_160;
+ 		break;
+ 	default:
+-		bw = sta->bandwidth;
++		bw = sta->deflink.bandwidth;
+ 		break;
+ 	}
+-	if (bw > sta->bandwidth)
+-		bw = sta->bandwidth;
++	if (bw > sta->deflink.bandwidth)
++		bw = sta->deflink.bandwidth;
+ 
+ 	switch (format) {
+ 	case TX_RATE_FORMAT_LEGACY:
+--- a/hif/pcie/tx.c
++++ b/hif/pcie/tx.c
+@@ -153,7 +153,7 @@ static int pcie_txbd_ring_create(struct
+ 	wiphy_info(priv->hw->wiphy,
+ 		   "TX ring: - base: %p, pbase: 0x%x, len: %d\n",
+ 		   pcie_priv->txbd_ring_vbase,
+-		   pcie_priv->txbd_ring_pbase,
++		   (u32)pcie_priv->txbd_ring_pbase,
+ 		   pcie_priv->txbd_ring_size);
+ 
+ 	for (num = 0; num < PCIE_MAX_TXRX_BD; num++) {
+@@ -1091,7 +1091,7 @@ void pcie_tx_xmit(struct ieee80211_hw *h
+ 	index = SYSADPT_TX_WMM_QUEUES - index - 1;
+ 	txpriority = index;
+ 
+-	if (sta && sta->ht_cap.ht_supported && !eapol_frame &&
++	if (sta && sta->deflink.ht_cap.ht_supported && !eapol_frame &&
+ 	    ieee80211_is_data_qos(wh->frame_control)) {
+ 		tid = qos & 0xf;
+ 		pcie_tx_count_packet(sta, tid);
+--- a/hif/pcie/tx_ndp.c
++++ b/hif/pcie/tx_ndp.c
+@@ -602,7 +602,7 @@ void pcie_tx_xmit_ndp(struct ieee80211_h
+ 		pcie_tx_encapsulate_frame(priv, skb, k_conf, NULL);
+ 	} else {
+ 		tid = qos & 0x7;
+-		if (sta && sta->ht_cap.ht_supported && !eapol_frame &&
++		if (sta && sta->deflink.ht_cap.ht_supported && !eapol_frame &&
+ 		    qos != 0xFFFF) {
+ 			pcie_tx_count_packet(sta, tid);
+ 			spin_lock_bh(&priv->stream_lock);
diff --git a/package/kernel/nat46/Makefile b/package/kernel/nat46/Makefile
index 2b131a9a703f47..5e5efbe101a713 100644
--- a/package/kernel/nat46/Makefile
+++ b/package/kernel/nat46/Makefile
@@ -3,11 +3,11 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=nat46
 
-PKG_MIRROR_HASH:=c26b8c60aa991a087011b8b6492e43a6749f0a5d9dc79ffcfd352da5fa20b78d
+PKG_MIRROR_HASH:=aeff95aa278ec1e197b59700284c0210f32b92c1fb757e5c3088bd00b3b403d4
 PKG_SOURCE_URL:=https://github.com/ayourtch/nat46.git
-PKG_SOURCE_DATE:=2022-03-30
+PKG_SOURCE_DATE:=2022-09-19
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=95ca1c3b99376da2d0306919f2df4a8d3c9bb78b
+PKG_SOURCE_VERSION:=4c5beee236841724219598fabb1edc93d4f08ce5
 
 PKG_MAINTAINER:=Hans Dedecker <dedeckeh@gmail.com>
 PKG_LICENSE:=GPL-2.0
@@ -15,7 +15,7 @@ PKG_LICENSE:=GPL-2.0
 include $(INCLUDE_DIR)/package.mk
 
 define KernelPackage/nat46
-  DEPENDS:=@IPV6
+  DEPENDS:=@IPV6 +kmod-nf-conntrack6
   TITLE:=Stateless NAT46 translation kernel module
   SECTION:=kernel
   SUBMENU:=Network Support
diff --git a/package/kernel/qca-nss-dp/Makefile b/package/kernel/qca-nss-dp/Makefile
new file mode 100644
index 00000000000000..8e9e9c4f09c5cd
--- /dev/null
+++ b/package/kernel/qca-nss-dp/Makefile
@@ -0,0 +1,57 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=qca-nss-dp
+PKG_RELEASE:=1
+
+PKG_SOURCE_URL:=https://git.codelinaro.org/clo/qsdk/oss/lklm/nss-dp.git
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_DATE:=2022-04-30
+PKG_SOURCE_VERSION:=72e9ec4187414461cbcf6ccff100e8b5ebe5f40b
+PKG_MIRROR_HASH:=805f16e59c75511132922f97740ebf6bf953845b0bbfd2089c4615456893bb37
+
+PKG_BUILD_PARALLEL:=1
+PKG_FLAGS:=nonshared
+
+include $(INCLUDE_DIR)/kernel.mk
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/qca-nss-dp
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  DEPENDS:=@TARGET_qualcommax +kmod-qca-ssdk
+  TITLE:=Qualcom NSS dataplane ethernet driver
+  FILES:=$(PKG_BUILD_DIR)/qca-nss-dp.ko
+  AUTOLOAD:=$(call AutoLoad,31,qca-nss-dp,1)
+endef
+
+define KernelPackage/qca-nss-dp/Description
+  NSS dataplane ethernet driver for Qualcom SoCs.
+endef
+
+define Build/InstallDev
+	mkdir -p $(1)/usr/include/qca-nss-dp
+	$(CP) $(PKG_BUILD_DIR)/exports/* $(1)/usr/include/qca-nss-dp/
+endef
+
+EXTRA_CFLAGS+= \
+	-I$(STAGING_DIR)/usr/include/qca-ssdk
+
+NSS_DP_HAL_DIR:=$(PKG_BUILD_DIR)/hal
+define Build/Configure
+	$(LN) $(NSS_DP_HAL_DIR)/soc_ops/$(CONFIG_TARGET_SUBTARGET)/nss_$(CONFIG_TARGET_SUBTARGET).h \
+		$(PKG_BUILD_DIR)/exports/nss_dp_arch.h
+endef
+
+define Build/Compile
+	+$(MAKE) -C "$(LINUX_DIR)" \
+		CROSS_COMPILE="$(TARGET_CROSS)" \
+		ARCH="$(LINUX_KARCH)" \
+		M="$(PKG_BUILD_DIR)" \
+		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" SoC="$(CONFIG_TARGET_SUBTARGET)" \
+		$(KERNEL_MAKE_FLAGS) \
+		$(PKG_JOBS) \
+		modules
+endef
+
+$(eval $(call KernelPackage,qca-nss-dp))
diff --git a/package/kernel/qca-nss-dp/patches/0001-edma_tx_rx-support-newer-kernels-time-stamping-API.patch b/package/kernel/qca-nss-dp/patches/0001-edma_tx_rx-support-newer-kernels-time-stamping-API.patch
new file mode 100644
index 00000000000000..1fed4ba8ab96fa
--- /dev/null
+++ b/package/kernel/qca-nss-dp/patches/0001-edma_tx_rx-support-newer-kernels-time-stamping-API.patch
@@ -0,0 +1,44 @@
+From 40979666b4371012405715ffa61ab5760fcdc6b3 Mon Sep 17 00:00:00 2001
+Message-Id: <40979666b4371012405715ffa61ab5760fcdc6b3.1620066716.git.baruch@tkos.co.il>
+From: Baruch Siach <baruch@tkos.co.il>
+Date: Mon, 3 May 2021 20:07:36 +0300
+Subject: [PATCH 1/3] edma_tx_rx: support newer kernels time stamping API
+
+---
+ hal/dp_ops/edma_dp/edma_v1/edma_tx_rx.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/hal/dp_ops/edma_dp/edma_v1/edma_tx_rx.c
++++ b/hal/dp_ops/edma_dp/edma_v1/edma_tx_rx.c
+@@ -227,10 +227,16 @@ void nss_phy_tstamp_rx_buf(__attribute__
+ 	 * set to the correct PTP class value by calling ptp_classify_raw
+ 	 * in drv->rxtstamp function.
+ 	 */
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 6, 0))
+ 	if (ndev && ndev->phydev && ndev->phydev->drv &&
+ 			ndev->phydev->drv->rxtstamp)
+ 		if(ndev->phydev->drv->rxtstamp(ndev->phydev, skb, 0))
+ 			return;
++#else
++	if (ndev && phy_has_rxtstamp(ndev->phydev))
++		if (phy_rxtstamp(ndev->phydev, skb, 0))
++			return;
++#endif
+ 
+ 	netif_receive_skb(skb);
+ }
+@@ -248,9 +254,14 @@ void nss_phy_tstamp_tx_buf(struct net_de
+ 	 * set to the correct PTP class value by calling ptp_classify_raw
+ 	 * in the drv->txtstamp function.
+ 	 */
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 6, 0))
+ 	if (ndev && ndev->phydev && ndev->phydev->drv &&
+ 			ndev->phydev->drv->txtstamp)
+ 		ndev->phydev->drv->txtstamp(ndev->phydev, skb, 0);
++#else
++	if (ndev && phy_has_txtstamp(ndev->phydev))
++		phy_rxtstamp(ndev->phydev, skb, 0);
++#endif
+ }
+ EXPORT_SYMBOL(nss_phy_tstamp_tx_buf);
+ 
diff --git a/package/kernel/qca-nss-dp/patches/0002-nss_dp_main-make-phy-mode-code-compatible-with-newer.patch b/package/kernel/qca-nss-dp/patches/0002-nss_dp_main-make-phy-mode-code-compatible-with-newer.patch
new file mode 100644
index 00000000000000..04adad86f6b4e4
--- /dev/null
+++ b/package/kernel/qca-nss-dp/patches/0002-nss_dp_main-make-phy-mode-code-compatible-with-newer.patch
@@ -0,0 +1,48 @@
+From cef7873a2d77df13ee702d902ed4e06b2248904b Mon Sep 17 00:00:00 2001
+Message-Id: <cef7873a2d77df13ee702d902ed4e06b2248904b.1620066716.git.baruch@tkos.co.il>
+In-Reply-To: <40979666b4371012405715ffa61ab5760fcdc6b3.1620066716.git.baruch@tkos.co.il>
+References: <40979666b4371012405715ffa61ab5760fcdc6b3.1620066716.git.baruch@tkos.co.il>
+From: Baruch Siach <baruch@tkos.co.il>
+Date: Mon, 3 May 2021 20:17:22 +0300
+Subject: [PATCH 2/3] nss_dp_main: make phy mode code compatible with newer
+ kernels
+
+---
+ include/nss_dp_dev.h | 4 ++--
+ nss_dp_main.c        | 4 ++++
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/include/nss_dp_dev.h
++++ b/include/nss_dp_dev.h
+@@ -22,7 +22,7 @@
+ #include <linux/etherdevice.h>
+ #include <linux/netdevice.h>
+ #include <linux/platform_device.h>
+-#include <linux/switch.h>
++#include <linux/phy.h>
+ #include <linux/version.h>
+ 
+ #include "nss_dp_api_if.h"
+@@ -99,7 +99,7 @@ struct nss_dp_dev {
+ 	/* Phy related stuff */
+ 	struct phy_device *phydev;	/* Phy device */
+ 	struct mii_bus *miibus;		/* MII bus */
+-	uint32_t phy_mii_type;		/* RGMII/SGMII/QSGMII */
++	phy_interface_t phy_mii_type;	/* RGMII/SGMII/QSGMII */
+ 	uint32_t phy_mdio_addr;		/* Mdio address */
+ 	bool link_poll;			/* Link polling enable? */
+ 	uint32_t forced_speed;		/* Forced speed? */
+--- a/nss_dp_main.c
++++ b/nss_dp_main.c
+@@ -584,7 +584,11 @@ static int32_t nss_dp_of_get_pdata(struc
+ 	hal_pdata->netdev = netdev;
+ 	hal_pdata->macid = dp_priv->macid;
+ 
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 5, 0))
+ 	dp_priv->phy_mii_type = of_get_phy_mode(np);
++#else
++	of_get_phy_mode(np, &dp_priv->phy_mii_type);
++#endif
+ 	dp_priv->link_poll = of_property_read_bool(np, "qcom,link-poll");
+ 	if (of_property_read_u32(np, "qcom,phy-mdio-addr",
+ 		&dp_priv->phy_mdio_addr) && dp_priv->link_poll) {
diff --git a/package/kernel/qca-nss-dp/patches/0003-Drop-_nocache-variants-of-ioremap.patch b/package/kernel/qca-nss-dp/patches/0003-Drop-_nocache-variants-of-ioremap.patch
new file mode 100644
index 00000000000000..18bd85c8c36597
--- /dev/null
+++ b/package/kernel/qca-nss-dp/patches/0003-Drop-_nocache-variants-of-ioremap.patch
@@ -0,0 +1,48 @@
+From c8c52512ff48bee578901c381a42f027e79eadf9 Mon Sep 17 00:00:00 2001
+Message-Id: <c8c52512ff48bee578901c381a42f027e79eadf9.1620066716.git.baruch@tkos.co.il>
+In-Reply-To: <40979666b4371012405715ffa61ab5760fcdc6b3.1620066716.git.baruch@tkos.co.il>
+References: <40979666b4371012405715ffa61ab5760fcdc6b3.1620066716.git.baruch@tkos.co.il>
+From: Baruch Siach <baruch@tkos.co.il>
+Date: Mon, 3 May 2021 20:20:29 +0300
+Subject: [PATCH 3/3] Drop _nocache variants of ioremap()
+
+Recent kernels removed them.
+---
+ hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c          | 2 +-
+ hal/gmac_ops/qcom/qcom_if.c     | 2 +-
+ hal/gmac_ops/syn/xgmac/syn_if.c | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c
++++ b/hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c
+@@ -279,7 +279,7 @@ int edma_init(void)
+ 	/*
+ 	 * Remap register resource
+ 	 */
+-	edma_hw.reg_base = ioremap_nocache((edma_hw.reg_resource)->start,
++	edma_hw.reg_base = ioremap((edma_hw.reg_resource)->start,
+ 				resource_size(edma_hw.reg_resource));
+ 	if (!edma_hw.reg_base) {
+ 		pr_warn("Unable to remap EDMA register memory.\n");
+--- a/hal/gmac_ops/qcom/qcom_if.c
++++ b/hal/gmac_ops/qcom/qcom_if.c
+@@ -418,7 +418,7 @@ static void *qcom_init(struct nss_gmac_h
+ 	qhd->nghd.mac_id = gmacpdata->macid;
+ 
+ 	/* Populate the mac base addresses */
+-	qhd->nghd.mac_base = devm_ioremap_nocache(&dp_priv->pdev->dev,
++	qhd->nghd.mac_base = devm_ioremap(&dp_priv->pdev->dev,
+ 						res->start, resource_size(res));
+ 	if (!qhd->nghd.mac_base) {
+ 		netdev_dbg(ndev, "ioremap fail.\n");
+--- a/hal/gmac_ops/syn/xgmac/syn_if.c
++++ b/hal/gmac_ops/syn/xgmac/syn_if.c
+@@ -432,7 +432,7 @@ static void *syn_init(struct nss_gmac_ha
+ 
+ 	/* Populate the mac base addresses */
+ 	shd->nghd.mac_base =
+-		devm_ioremap_nocache(&dp_priv->pdev->dev, res->start,
++		devm_ioremap(&dp_priv->pdev->dev, res->start,
+ 				     resource_size(res));
+ 	if (!shd->nghd.mac_base) {
+ 		netdev_dbg(ndev, "ioremap fail.\n");
diff --git a/package/kernel/qca-nss-dp/patches/0004-EDMA-Fix-NAPI-packet-counting.patch b/package/kernel/qca-nss-dp/patches/0004-EDMA-Fix-NAPI-packet-counting.patch
new file mode 100644
index 00000000000000..f7653729a00a28
--- /dev/null
+++ b/package/kernel/qca-nss-dp/patches/0004-EDMA-Fix-NAPI-packet-counting.patch
@@ -0,0 +1,31 @@
+From d74920e2a7c413ef40eed72f9cf287cf6fbd5fb8 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Thu, 20 May 2021 14:56:46 +0200
+Subject: [PATCH 1/2] EDMA: Fix NAPI packet counting
+
+There is a bug in the NAPI packet counting that will
+cause NAPI over budget warnings.
+
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ hal/dp_ops/edma_dp/edma_v1/edma_tx_rx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/hal/dp_ops/edma_dp/edma_v1/edma_tx_rx.c
++++ b/hal/dp_ops/edma_dp/edma_v1/edma_tx_rx.c
+@@ -459,12 +459,12 @@ int edma_napi(struct napi_struct *napi,
+ 
+ 	for (i = 0; i < ehw->txcmpl_rings; i++) {
+ 		txcmpl_ring = &ehw->txcmpl_ring[i];
+-		work_done += edma_clean_tx(ehw, txcmpl_ring);
++		edma_clean_tx(ehw, txcmpl_ring);
+ 	}
+ 
+ 	for (i = 0; i < ehw->rxfill_rings; i++) {
+ 		rxfill_ring = &ehw->rxfill_ring[i];
+-		work_done += edma_alloc_rx_buffer(ehw, rxfill_ring);
++		edma_alloc_rx_buffer(ehw, rxfill_ring);
+ 	}
+ 
+ 	/*
diff --git a/package/kernel/qca-nss-dp/patches/0005-EDMA-Use-NAPI_POLL_WEIGHT-as-NAPI-weight.patch b/package/kernel/qca-nss-dp/patches/0005-EDMA-Use-NAPI_POLL_WEIGHT-as-NAPI-weight.patch
new file mode 100644
index 00000000000000..9c22fa7904496d
--- /dev/null
+++ b/package/kernel/qca-nss-dp/patches/0005-EDMA-Use-NAPI_POLL_WEIGHT-as-NAPI-weight.patch
@@ -0,0 +1,41 @@
+From 44a30d94abcbb10aacc21db29be212518a6b1bf7 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Thu, 20 May 2021 14:57:46 +0200
+Subject: [PATCH] EDMA: Use NAPI_POLL_WEIGHT as NAPI weight
+
+Currently a weight of 100 is used by the EDMA, according
+to upstream max of 64 should be used and that is used for
+almost any driver.
+
+They also introduced NAPI_POLL_WEIGHT define which equals
+to 64.
+
+So use NAPI_POLL_WEIGHT as the weight.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c | 2 +-
+ hal/dp_ops/edma_dp/edma_v1/edma_data_plane.h | 1 -
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+--- a/hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c
++++ b/hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c
+@@ -837,7 +837,7 @@ static int edma_register_netdevice(struc
+ 	 */
+ 	if (!edma_hw.napi_added) {
+ 		netif_napi_add(netdev, &edma_hw.napi, edma_napi,
+-				EDMA_NAPI_WORK);
++				NAPI_POLL_WEIGHT);
+ 		/*
+ 		 * Register the interrupt handlers and enable interrupts
+ 		 */
+--- a/hal/dp_ops/edma_dp/edma_v1/edma_data_plane.h
++++ b/hal/dp_ops/edma_dp/edma_v1/edma_data_plane.h
+@@ -26,7 +26,6 @@
+ #define EDMA_RX_PREHDR_SIZE		(sizeof(struct edma_rx_preheader))
+ #define EDMA_TX_PREHDR_SIZE		(sizeof(struct edma_tx_preheader))
+ #define EDMA_RING_SIZE			128
+-#define EDMA_NAPI_WORK			100
+ #define EDMA_START_GMACS		NSS_DP_HAL_START_IFNUM
+ #define EDMA_MAX_GMACS			NSS_DP_HAL_MAX_PORTS
+ #define EDMA_TX_PKT_MIN_SIZE		33	/* IPQ807x EDMA needs a minimum packet size of 33 bytes */
diff --git a/package/kernel/qca-nss-dp/patches/0006-NSS-DP-fix-of_get_mac_address.patch b/package/kernel/qca-nss-dp/patches/0006-NSS-DP-fix-of_get_mac_address.patch
new file mode 100644
index 00000000000000..1d7b49129fb0af
--- /dev/null
+++ b/package/kernel/qca-nss-dp/patches/0006-NSS-DP-fix-of_get_mac_address.patch
@@ -0,0 +1,46 @@
+From cadeb62a42296563141d6954eec58e34ef86778d Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 13 Aug 2021 20:12:08 +0200
+Subject: [PATCH] NSS-DP: fix of_get_mac_address()
+
+Recently OpenWrt backported the updated of_get_mac_address()
+function which returns and error code instead.
+
+So, patch the SSDK to use it and fix the compilation error.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ nss_dp_main.c | 13 ++++---------
+ 1 file changed, 4 insertions(+), 9 deletions(-)
+
+--- a/nss_dp_main.c
++++ b/nss_dp_main.c
+@@ -555,9 +555,10 @@ static int32_t nss_dp_of_get_pdata(struc
+ 				   struct net_device *netdev,
+ 				   struct nss_gmac_hal_platform_data *hal_pdata)
+ {
+-	uint8_t *maddr;
++	u8 maddr[ETH_ALEN];
+ 	struct nss_dp_dev *dp_priv;
+ 	struct resource memres_devtree = {0};
++	int ret;
+ 
+ 	dp_priv = netdev_priv(netdev);
+ 
+@@ -600,14 +601,8 @@ static int32_t nss_dp_of_get_pdata(struc
+ 	of_property_read_u32(np, "qcom,forced-speed", &dp_priv->forced_speed);
+ 	of_property_read_u32(np, "qcom,forced-duplex", &dp_priv->forced_duplex);
+ 
+-	maddr = (uint8_t *)of_get_mac_address(np);
+-#if (LINUX_VERSION_CODE > KERNEL_VERSION(5, 4, 0))
+-	if (IS_ERR((void *)maddr)) {
+-		maddr = NULL;
+-	}
+-#endif
+-
+-	if (maddr && is_valid_ether_addr(maddr)) {
++	ret = of_get_mac_address(np, maddr);
++	if (!ret && is_valid_ether_addr(maddr)) {
+ 		ether_addr_copy(netdev->dev_addr, maddr);
+ 	} else {
+ 		random_ether_addr(netdev->dev_addr);
diff --git a/package/kernel/qca-nss-dp/patches/0007-NSS-DP-implement-ethernet-IOCTL-s.patch b/package/kernel/qca-nss-dp/patches/0007-NSS-DP-implement-ethernet-IOCTL-s.patch
new file mode 100644
index 00000000000000..824f18634be0e0
--- /dev/null
+++ b/package/kernel/qca-nss-dp/patches/0007-NSS-DP-implement-ethernet-IOCTL-s.patch
@@ -0,0 +1,29 @@
+From 5da62ba19f554bf437752a44360fb5ae9f1a7f5e Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Tue, 8 Mar 2022 10:48:32 +0100
+Subject: [PATCH] NSS-DP: implement ethernet IOCTL-s
+
+Since kernel 5.15 ethernet/PHY related IOCTL-s have been split from the
+generic IOCTL netdev op.
+So, implement the new op instead of the generic one which is considered
+for private IOCTL-s only now for 5.15+.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ nss_dp_main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/nss_dp_main.c
++++ b/nss_dp_main.c
+@@ -532,7 +532,11 @@ static const struct net_device_ops nss_d
+ 	.ndo_set_mac_address = nss_dp_set_mac_address,
+ 	.ndo_validate_addr = eth_validate_addr,
+ 	.ndo_change_mtu = nss_dp_change_mtu,
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 0))
+ 	.ndo_do_ioctl = nss_dp_do_ioctl,
++#else
++	.ndo_eth_ioctl = nss_dp_do_ioctl,
++#endif
+ 
+ #if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 5, 0))
+ 	.ndo_bridge_setlink = switchdev_port_bridge_setlink,
diff --git a/package/kernel/qca-nss-dp/patches/0008-switchdev-remove-the-transaction-structure.patch b/package/kernel/qca-nss-dp/patches/0008-switchdev-remove-the-transaction-structure.patch
new file mode 100644
index 00000000000000..220be961ab4a3d
--- /dev/null
+++ b/package/kernel/qca-nss-dp/patches/0008-switchdev-remove-the-transaction-structure.patch
@@ -0,0 +1,48 @@
+From c9afdcdd2642485a6476906be9da2e811090fc7a Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 18 Mar 2022 18:06:03 +0100
+Subject: [PATCH] switchdev: remove the transaction structure
+
+Since 5.12 there is no transaction structure anymore, so drop it for
+5.12 and newer.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ nss_dp_switchdev.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/nss_dp_switchdev.c
++++ b/nss_dp_switchdev.c
+@@ -279,13 +279,19 @@ void nss_dp_switchdev_setup(struct net_d
+  *	Sets attributes
+  */
+ static int nss_dp_port_attr_set(struct net_device *dev,
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0))
+ 				const struct switchdev_attr *attr,
+ 				struct switchdev_trans *trans)
++#else
++				const struct switchdev_attr *attr)
++#endif
+ {
+ 	struct nss_dp_dev *dp_priv = (struct nss_dp_dev *)netdev_priv(dev);
+ 
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0))
+ 	if (switchdev_trans_ph_prepare(trans))
+ 		return 0;
++#endif
+ 
+ 	switch (attr->id) {
+ 	case SWITCHDEV_ATTR_ID_PORT_BRIDGE_FLAGS:
+@@ -309,8 +315,12 @@ static int nss_dp_switchdev_port_attr_se
+ {
+ 	int err;
+ 
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0))
+ 	err = nss_dp_port_attr_set(netdev, port_attr_info->attr,
+ 				   port_attr_info->trans);
++#else
++	err = nss_dp_port_attr_set(netdev, port_attr_info->attr);
++#endif
+ 
+ 	port_attr_info->handled = true;
+ 	return notifier_from_errno(err);
diff --git a/package/kernel/qca-nss-dp/patches/0009-switchdev-use-new-switchdev-flags.patch b/package/kernel/qca-nss-dp/patches/0009-switchdev-use-new-switchdev-flags.patch
new file mode 100644
index 00000000000000..ecc84c1741c433
--- /dev/null
+++ b/package/kernel/qca-nss-dp/patches/0009-switchdev-use-new-switchdev-flags.patch
@@ -0,0 +1,51 @@
+From f95868d54301c0f54e968ec9d978c9caa02ee425 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 18 Mar 2022 18:24:18 +0100
+Subject: [PATCH] switchdev: use new switchdev flags
+
+Since kernel 5.12 switched utilizes a new way of setting the flags by
+using a dedicated structure with flags and mask.
+
+So fix using kernels 5.12 and later.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ include/nss_dp_dev.h | 7 +++++++
+ nss_dp_switchdev.c   | 2 +-
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+--- a/include/nss_dp_dev.h
++++ b/include/nss_dp_dev.h
+@@ -24,6 +24,9 @@
+ #include <linux/platform_device.h>
+ #include <linux/phy.h>
+ #include <linux/version.h>
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0))
++#include <net/switchdev.h>
++#endif
+ 
+ #include "nss_dp_api_if.h"
+ #include "nss_dp_hal_if.h"
+@@ -126,7 +129,11 @@ struct nss_dp_dev {
+ 	/* switchdev related attributes */
+ #ifdef CONFIG_NET_SWITCHDEV
+ 	u8 stp_state;			/* STP state of this physical port */
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0))
+ 	unsigned long brport_flags;	/* bridge port flags */
++#else
++	struct switchdev_brport_flags brport_flags;	/* bridge port flags */
++#endif
+ #endif
+ 	uint32_t rx_page_mode;		/* page mode for Rx processing */
+ 	uint32_t rx_jumbo_mru;		/* Jumbo mru value for Rx processing */
+--- a/nss_dp_switchdev.c
++++ b/nss_dp_switchdev.c
+@@ -296,7 +296,7 @@ static int nss_dp_port_attr_set(struct n
+ 	switch (attr->id) {
+ 	case SWITCHDEV_ATTR_ID_PORT_BRIDGE_FLAGS:
+ 		dp_priv->brport_flags = attr->u.brport_flags;
+-		netdev_dbg(dev, "set brport_flags %lu\n", attr->u.brport_flags);
++		netdev_dbg(dev, "set brport_flags %lu\n", attr->u.brport_flags.val);
+ 		return 0;
+ 	case SWITCHDEV_ATTR_ID_PORT_STP_STATE:
+ 		return nss_dp_stp_state_set(dp_priv, attr->u.stp_state);
diff --git a/package/kernel/qca-nss-dp/patches/0010-switchdev-fix-FDB-roaming.patch b/package/kernel/qca-nss-dp/patches/0010-switchdev-fix-FDB-roaming.patch
new file mode 100644
index 00000000000000..19395ac42c49a7
--- /dev/null
+++ b/package/kernel/qca-nss-dp/patches/0010-switchdev-fix-FDB-roaming.patch
@@ -0,0 +1,110 @@
+From d16102cad769f430144ca8094d928762b445e9b0 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 18 Mar 2022 22:02:01 +0100
+Subject: [PATCH] switchdev: fix FDB roaming
+
+Try and solve the roaming issue by trying to replicate what NSS bridge
+module is doing, but by utilizing switchdev FDB notifiers instead of
+adding new notifiers to the bridge code.
+
+We register a new non-blocking switchdev notifier and simply wait for
+notification, and then process the SWITCHDEV_FDB_DEL_TO_DEVICE
+notifications.
+
+Those tell us that a certain FDB entry should be removed, then a VSI ID
+is fetched for the physical PPE port and using that VSI ID and the
+notification provided MAC adress existing FDB entry gets removed.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ nss_dp_switchdev.c | 61 ++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 61 insertions(+)
+
+--- a/nss_dp_switchdev.c
++++ b/nss_dp_switchdev.c
+@@ -24,6 +24,8 @@
+ #include "nss_dp_dev.h"
+ #include "fal/fal_stp.h"
+ #include "fal/fal_ctrlpkt.h"
++#include "fal/fal_fdb.h"
++#include "ref/ref_vsi.h"
+ 
+ #define NSS_DP_SWITCH_ID		0
+ #define NSS_DP_SW_ETHTYPE_PID		0 /* PPE ethtype profile ID for slow protocols */
+@@ -348,10 +350,64 @@ static int nss_dp_switchdev_event(struct
+ 	return NOTIFY_DONE;
+ }
+ 
++static int nss_dp_switchdev_fdb_del_event(struct net_device *netdev,
++					  struct switchdev_notifier_fdb_info *fdb_info)
++{
++	struct nss_dp_dev *dp_priv = (struct nss_dp_dev *)netdev_priv(netdev);
++	fal_fdb_entry_t entry;
++	a_uint32_t vsi_id;
++	sw_error_t rv;
++
++	netdev_dbg(netdev, "FDB DEL %pM port %d\n", fdb_info->addr, dp_priv->macid);
++
++	rv = ppe_port_vsi_get(NSS_DP_SWITCH_ID, dp_priv->macid, &vsi_id);
++	if (rv) {
++		netdev_err(netdev, "cannot get VSI ID for port %d\n", dp_priv->macid);
++		return notifier_from_errno(rv);
++	}
++
++	memset(&entry, 0, sizeof(entry));
++	memcpy(&entry.addr, fdb_info->addr, ETH_ALEN);
++	entry.fid = vsi_id;
++
++	rv = fal_fdb_entry_del_bymac(NSS_DP_SWITCH_ID, &entry);
++	if (rv) {
++		netdev_err(netdev, "FDB entry delete failed with MAC %pM and fid %d\n",
++			   &entry.addr, entry.fid);
++		return notifier_from_errno(rv);
++	}
++
++	return notifier_from_errno(rv);
++}
++
++static int nss_dp_fdb_switchdev_event(struct notifier_block *nb,
++				      unsigned long event, void *ptr)
++{
++	struct net_device *dev = switchdev_notifier_info_to_dev(ptr);
++
++	/*
++	 * Handle switchdev event only for physical devices
++	 */
++	if (!nss_dp_is_phy_dev(dev)) {
++		return NOTIFY_DONE;
++	}
++
++	switch (event) {
++	case SWITCHDEV_FDB_DEL_TO_DEVICE:
++		return nss_dp_switchdev_fdb_del_event(dev, ptr);
++	}
++
++	return NOTIFY_DONE;
++}
++
+ static struct notifier_block nss_dp_switchdev_notifier = {
+ 	.notifier_call = nss_dp_switchdev_event,
+ };
+ 
++static struct notifier_block nss_dp_switchdev_fdb_notifier = {
++	.notifier_call = nss_dp_fdb_switchdev_event,
++};
++
+ static bool switch_init_done;
+ 
+ /*
+@@ -366,6 +422,11 @@ void nss_dp_switchdev_setup(struct net_d
+ 		return;
+ 	}
+ 
++	err = register_switchdev_notifier(&nss_dp_switchdev_fdb_notifier);
++	if (err) {
++		netdev_dbg(dev, "%px:Failed to register switchdev FDB notifier\n", dev);
++	}
++
+ 	err = register_switchdev_blocking_notifier(&nss_dp_switchdev_notifier);
+ 	if (err) {
+ 		netdev_dbg(dev, "%px:Failed to register switchdev notifier\n", dev);
diff --git a/package/kernel/qca-nss-dp/patches/0011-treewide-fix-confusing-printing-of-registered-netdev.patch b/package/kernel/qca-nss-dp/patches/0011-treewide-fix-confusing-printing-of-registered-netdev.patch
new file mode 100644
index 00000000000000..726ca304df704f
--- /dev/null
+++ b/package/kernel/qca-nss-dp/patches/0011-treewide-fix-confusing-printing-of-registered-netdev.patch
@@ -0,0 +1,41 @@
+From 7e4ae2d6285095794d73d2f2ce61404f61d4e633 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Tue, 17 May 2022 15:55:36 +0200
+Subject: [PATCH 11/11] treewide: fix confusing printing of registered netdev
+
+Net core implementation changed and now printing the netdev name cause
+confusing printing if done before register_netdev. Move the old printing
+to dbg and add an additional info log right after register_netdev to
+give the user some info on correct nss-dp probe.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+---
+ hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c | 4 ++--
+ nss_dp_main.c                                | 3 +++
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+--- a/hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c
++++ b/hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c
+@@ -822,8 +822,8 @@ static int edma_register_netdevice(struc
+ 		return -EINVAL;
+ 	}
+ 
+-	netdev_info(netdev, "nss_dp_edma: Registering netdev %s(qcom-id:%d) with EDMA\n",
+-		netdev->name, macid);
++	netdev_dbg(netdev, "nss_dp_edma: Registering netdev %s(qcom-id:%d) with EDMA\n",
++		   netdev->name, macid);
+ 
+ 	/*
+ 	 * We expect 'macid' to correspond to ports numbers on
+--- a/nss_dp_main.c
++++ b/nss_dp_main.c
+@@ -875,6 +875,9 @@ static int32_t nss_dp_probe(struct platf
+ 		goto phy_setup_fail;
+ 	}
+ 
++	netdev_info(netdev, "Registered netdev %s(qcom-id:%d)\n",
++		    netdev->name, port_id);
++
+ 	dp_global_ctx.nss_dp[dp_priv->macid - 1] = dp_priv;
+ 	dp_global_ctx.slowproto_acl_bm = 0;
+ 
diff --git a/package/kernel/qca-nss-dp/patches/0012-gmac-syn-xgmac-silence-debug-log-on-probe.patch b/package/kernel/qca-nss-dp/patches/0012-gmac-syn-xgmac-silence-debug-log-on-probe.patch
new file mode 100644
index 00000000000000..3c1c8ab83b5834
--- /dev/null
+++ b/package/kernel/qca-nss-dp/patches/0012-gmac-syn-xgmac-silence-debug-log-on-probe.patch
@@ -0,0 +1,23 @@
+From fee52ef165e9fab2fca15492677082fd8e9e891f Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Thu, 19 May 2022 23:40:24 +0200
+Subject: [PATCH 12/12] gmac: syn: xgmac: silence debug log on probe
+
+Silence debug log set as info in xgmac port probe.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+---
+ hal/gmac_ops/syn/xgmac/syn_if.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/hal/gmac_ops/syn/xgmac/syn_if.c
++++ b/hal/gmac_ops/syn/xgmac/syn_if.c
+@@ -445,7 +445,7 @@ static void *syn_init(struct nss_gmac_ha
+ 
+ 	spin_lock_init(&shd->nghd.slock);
+ 
+-	netdev_info(ndev, "ioremap OK.Size 0x%x Ndev base 0x%lx macbase 0x%px\n",
++	netdev_dbg(ndev, "ioremap OK.Size 0x%x Ndev base 0x%lx macbase 0x%px\n",
+ 			gmacpdata->reg_len,
+ 			ndev->base_addr,
+ 			shd->nghd.mac_base);
diff --git a/package/kernel/qca-nss-dp/patches/0013-nss_dp_main-Use-a-phy-handle-property-to-connect-to-.patch b/package/kernel/qca-nss-dp/patches/0013-nss_dp_main-Use-a-phy-handle-property-to-connect-to-.patch
new file mode 100644
index 00000000000000..276c87adfc52af
--- /dev/null
+++ b/package/kernel/qca-nss-dp/patches/0013-nss_dp_main-Use-a-phy-handle-property-to-connect-to-.patch
@@ -0,0 +1,183 @@
+From 8293a26ca56ee2e9a88e4efb5dcc7f647803cd8c Mon Sep 17 00:00:00 2001
+From: Alexandru Gagniuc <mr.nuke.me@gmail.com>
+Date: Sun, 5 Jun 2022 21:45:09 -0500
+Subject: [PATCH] nss_dp_main: Use a 'phy-handle' property to connect to the
+ PHY
+
+The original method of connecting a PHY to the ethernet controller
+requires the "qcom,link-poll", and "qcom,phy-mdio-addr" devicetree
+properties. This is redundant. The PHY node already contains the MDIO
+address, and attaching a PHY implies "link-poll".
+
+Allow using a "phy-handle" property. Remove the following properties,
+as they are no longer used:
+    * "qcom,link-poll"
+    * "qcom,phy-mdio-addr"
+    * "mdio-bus"
+    * "qcom,forced-speed"
+    * "qcom,forced-duplex"
+
+Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
+---
+ include/nss_dp_dev.h |  5 +--
+ nss_dp_main.c        | 91 +++++---------------------------------------
+ 2 files changed, 10 insertions(+), 86 deletions(-)
+
+--- a/include/nss_dp_dev.h
++++ b/include/nss_dp_dev.h
+@@ -100,13 +100,10 @@ struct nss_dp_dev {
+ 	unsigned long drv_flags;	/* Driver specific feature flags */
+ 
+ 	/* Phy related stuff */
++	struct device_node *phy_node;
+ 	struct phy_device *phydev;	/* Phy device */
+ 	struct mii_bus *miibus;		/* MII bus */
+ 	phy_interface_t phy_mii_type;	/* RGMII/SGMII/QSGMII */
+-	uint32_t phy_mdio_addr;		/* Mdio address */
+-	bool link_poll;			/* Link polling enable? */
+-	uint32_t forced_speed;		/* Forced speed? */
+-	uint32_t forced_duplex;		/* Forced duplex? */
+ 	uint32_t link_state;		/* Current link state */
+ 	uint32_t pause;			/* Current flow control settings */
+ 
+--- a/nss_dp_main.c
++++ b/nss_dp_main.c
+@@ -399,7 +399,7 @@ static int nss_dp_open(struct net_device
+ 
+ 	netif_start_queue(netdev);
+ 
+-	if (!dp_priv->link_poll) {
++	if (!dp_priv->phydev) {
+ 		/* Notify data plane link is up */
+ 		if (dp_priv->data_plane_ops->link_state(dp_priv->dpc, 1)) {
+ 			netdev_dbg(netdev, "Data plane set link failed\n");
+@@ -576,6 +576,8 @@ static int32_t nss_dp_of_get_pdata(struc
+ 		return -EFAULT;
+ 	}
+ 
++	dp_priv->phy_node = of_parse_phandle(np, "phy-handle", 0);
++
+ 	if (of_property_read_u32(np, "qcom,mactype", &hal_pdata->mactype)) {
+ 		pr_err("%s: error reading mactype\n", np->name);
+ 		return -EFAULT;
+@@ -594,16 +596,6 @@ static int32_t nss_dp_of_get_pdata(struc
+ #else
+ 	of_get_phy_mode(np, &dp_priv->phy_mii_type);
+ #endif
+-	dp_priv->link_poll = of_property_read_bool(np, "qcom,link-poll");
+-	if (of_property_read_u32(np, "qcom,phy-mdio-addr",
+-		&dp_priv->phy_mdio_addr) && dp_priv->link_poll) {
+-		pr_err("%s: mdio addr required if link polling is enabled\n",
+-				np->name);
+-		return -EFAULT;
+-	}
+-
+-	of_property_read_u32(np, "qcom,forced-speed", &dp_priv->forced_speed);
+-	of_property_read_u32(np, "qcom,forced-duplex", &dp_priv->forced_duplex);
+ 
+ 	ret = of_get_mac_address(np, maddr);
+ 	if (!ret && is_valid_ether_addr(maddr)) {
+@@ -636,50 +628,6 @@ static int32_t nss_dp_of_get_pdata(struc
+ 	return 0;
+ }
+ 
+-/*
+- * nss_dp_mdio_attach()
+- */
+-static struct mii_bus *nss_dp_mdio_attach(struct platform_device *pdev)
+-{
+-	struct device_node *mdio_node;
+-	struct platform_device *mdio_plat;
+-	struct ipq40xx_mdio_data *mdio_data;
+-
+-	/*
+-	 * Find mii_bus using "mdio-bus" handle.
+-	 */
+-	mdio_node = of_parse_phandle(pdev->dev.of_node, "mdio-bus", 0);
+-	if (mdio_node) {
+-		return of_mdio_find_bus(mdio_node);
+-	}
+-
+-	mdio_node = of_find_compatible_node(NULL, NULL, "qcom,qca-mdio");
+-	if (!mdio_node) {
+-		mdio_node = of_find_compatible_node(NULL, NULL,
+-							"qcom,ipq40xx-mdio");
+-		if (!mdio_node) {
+-			dev_err(&pdev->dev, "cannot find mdio node by phandle\n");
+-			return NULL;
+-		}
+-	}
+-
+-	mdio_plat = of_find_device_by_node(mdio_node);
+-	if (!mdio_plat) {
+-		dev_err(&pdev->dev, "cannot find platform device from mdio node\n");
+-		of_node_put(mdio_node);
+-		return NULL;
+-	}
+-
+-	mdio_data = dev_get_drvdata(&mdio_plat->dev);
+-	if (!mdio_data) {
+-		dev_err(&pdev->dev, "cannot get mii bus reference from device data\n");
+-		of_node_put(mdio_node);
+-		return NULL;
+-	}
+-
+-	return mdio_data->mii_bus;
+-}
+-
+ #ifdef CONFIG_NET_SWITCHDEV
+ /*
+  * nss_dp_is_phy_dev()
+@@ -738,7 +686,6 @@ static int32_t nss_dp_probe(struct platf
+ 	struct device_node *np = pdev->dev.of_node;
+ 	struct nss_gmac_hal_platform_data gmac_hal_pdata;
+ 	int32_t ret = 0;
+-	uint8_t phy_id[MII_BUS_ID_SIZE + 3];
+ #if defined(NSS_DP_PPE_SUPPORT)
+ 	uint32_t vsi_id;
+ 	fal_port_t port_id;
+@@ -813,37 +760,17 @@ static int32_t nss_dp_probe(struct platf
+ 
+ 	dp_priv->drv_flags |= NSS_DP_PRIV_FLAG(INIT_DONE);
+ 
+-	if (dp_priv->link_poll) {
+-		dp_priv->miibus = nss_dp_mdio_attach(pdev);
+-		if (!dp_priv->miibus) {
+-			netdev_dbg(netdev, "failed to find miibus\n");
+-			goto phy_setup_fail;
+-		}
+-		snprintf(phy_id, MII_BUS_ID_SIZE + 3, PHY_ID_FMT,
+-				dp_priv->miibus->id, dp_priv->phy_mdio_addr);
+-
++	if (dp_priv->phy_node) {
+ 		SET_NETDEV_DEV(netdev, &pdev->dev);
+-
+-		dp_priv->phydev = phy_connect(netdev, phy_id,
+-				&nss_dp_adjust_link,
+-				dp_priv->phy_mii_type);
+-		if (IS_ERR(dp_priv->phydev)) {
+-			netdev_dbg(netdev, "failed to connect to phy device\n");
++		dp_priv->phydev = of_phy_connect(netdev, dp_priv->phy_node,
++						 &nss_dp_adjust_link, 0,
++						 dp_priv->phy_mii_type);
++		if (!(dp_priv->phydev)) {
++			dev_err(&pdev->dev, "Could not attach to PHY\n");
+ 			goto phy_setup_fail;
+ 		}
+ 
+-#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 5, 0))
+-		dp_priv->phydev->advertising |=
+-			(ADVERTISED_Pause | ADVERTISED_Asym_Pause);
+-		dp_priv->phydev->supported |=
+-			(SUPPORTED_Pause | SUPPORTED_Asym_Pause);
+-#else
+-		linkmode_set_bit(ETHTOOL_LINK_MODE_Pause_BIT, dp_priv->phydev->advertising);
+-		linkmode_set_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT, dp_priv->phydev->advertising);
+-
+-		linkmode_set_bit(ETHTOOL_LINK_MODE_Pause_BIT, dp_priv->phydev->supported);
+-		linkmode_set_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT, dp_priv->phydev->supported);
+-#endif
++		phy_attached_info(dp_priv->phydev);
+ 	}
+ 
+ #if defined(NSS_DP_PPE_SUPPORT)
diff --git a/package/kernel/qca-nss-dp/patches/0014-nss-dp-edma-v1-use-NAPI-GRO-by-default.patch b/package/kernel/qca-nss-dp/patches/0014-nss-dp-edma-v1-use-NAPI-GRO-by-default.patch
new file mode 100644
index 00000000000000..f3a0948dfa8e51
--- /dev/null
+++ b/package/kernel/qca-nss-dp/patches/0014-nss-dp-edma-v1-use-NAPI-GRO-by-default.patch
@@ -0,0 +1,56 @@
+From ae4fe8fb79b68f4cf4a887434ab6a8a9a1c65bfc Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Thu, 23 Jun 2022 14:18:50 +0200
+Subject: [PATCH] nss-dp: edma-v1: use NAPI GRO by default
+
+Utilize napi_gro_receive instead of plain netif_receive_skb on EDMA v1.
+
+Usually it provides quite a lot of RX speed improvements, however in some
+cases it may lead to decreased performance as there is no checksum
+offloading implemented.
+
+In cases where reduced performance is experienced its possible to disable
+GRO by using ethtool.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c | 10 ++++++----
+ hal/dp_ops/edma_dp/edma_v1/edma_tx_rx.c      |  8 ++++++--
+ 2 files changed, 12 insertions(+), 6 deletions(-)
+
+--- a/hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c
++++ b/hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c
+@@ -589,10 +589,12 @@ drop:
+  */
+ static void edma_if_set_features(struct nss_dp_data_plane_ctx *dpc)
+ {
+-	/*
+-	 * TODO - add flags to support HIGHMEM/cksum offload VLAN
+-	 * the features are enabled.
+-	 */
++	struct net_device *netdev = dpc->dev;
++
++	netdev->features |= NETIF_F_GRO;
++	netdev->hw_features |= NETIF_F_GRO;
++	netdev->vlan_features |= NETIF_F_GRO;
++	netdev->wanted_features |= NETIF_F_GRO;
+ }
+ 
+ /* TODO - check if this is needed */
+--- a/hal/dp_ops/edma_dp/edma_v1/edma_tx_rx.c
++++ b/hal/dp_ops/edma_dp/edma_v1/edma_tx_rx.c
+@@ -410,8 +410,12 @@ static uint32_t edma_clean_rx(struct edm
+ 		if (unlikely(EDMA_RXPH_SERVICE_CODE_GET(rxph) ==
+ 					NSS_PTP_EVENT_SERVICE_CODE))
+ 			nss_phy_tstamp_rx_buf(ndev, skb);
+-		else
+-			netif_receive_skb(skb);
++		else {
++			if (likely(ndev->features & NETIF_F_GRO))
++				napi_gro_receive(&ehw->napi, skb);
++			else
++				netif_receive_skb(skb);
++		}
+ 
+ next_rx_desc:
+ 		/*
diff --git a/package/kernel/qca-nss-dp/patches/0015-nss-dp-allow-setting-netdev-name-from-DTS.patch b/package/kernel/qca-nss-dp/patches/0015-nss-dp-allow-setting-netdev-name-from-DTS.patch
new file mode 100644
index 00000000000000..906e5ee76241aa
--- /dev/null
+++ b/package/kernel/qca-nss-dp/patches/0015-nss-dp-allow-setting-netdev-name-from-DTS.patch
@@ -0,0 +1,50 @@
+From 358b93e40d0c6b6d381fe0e9d2a63c45a10321b3 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Sun, 4 Dec 2022 18:41:36 +0100
+Subject: [PATCH] nss-dp: allow setting netdev name from DTS
+
+Allow reading the desired netdev name from DTS like DSA allows and then
+set it as the netdev name during registration.
+
+If label is not defined, simply fallback to kernel ethN enumeration.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ nss_dp_main.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+--- a/nss_dp_main.c
++++ b/nss_dp_main.c
+@@ -685,18 +685,29 @@ static int32_t nss_dp_probe(struct platf
+ 	struct nss_dp_dev *dp_priv;
+ 	struct device_node *np = pdev->dev.of_node;
+ 	struct nss_gmac_hal_platform_data gmac_hal_pdata;
++	const char *name = of_get_property(np, "label", NULL);
+ 	int32_t ret = 0;
++	int assign_type;
+ #if defined(NSS_DP_PPE_SUPPORT)
+ 	uint32_t vsi_id;
+ 	fal_port_t port_id;
+ #endif
+ 
++	if (name) {
++		assign_type = NET_NAME_PREDICTABLE;
++	} else {
++		name = "eth%d";
++		assign_type = NET_NAME_ENUM;
++	}
++
+ 	/* TODO: See if we need to do some SoC level common init */
+ 
+-	netdev = alloc_etherdev_mqs(sizeof(struct nss_dp_dev),
+-			NSS_DP_NETDEV_TX_QUEUE_NUM, NSS_DP_NETDEV_RX_QUEUE_NUM);
++	netdev = alloc_netdev_mqs(sizeof(struct nss_dp_dev),
++				  name, assign_type,
++				  ether_setup,
++				  NSS_DP_NETDEV_TX_QUEUE_NUM, NSS_DP_NETDEV_RX_QUEUE_NUM);
+ 	if (!netdev) {
+-		pr_info("alloc_etherdev() failed\n");
++		dev_err(&pdev->dev, "alloc_netdev_mqs() failed\n");
+ 		return -ENOMEM;
+ 	}
+ 
diff --git a/package/kernel/qca-nss-dp/patches/0016-nss-dp-netdev-mac_addr-is-const.patch b/package/kernel/qca-nss-dp/patches/0016-nss-dp-netdev-mac_addr-is-const.patch
new file mode 100644
index 00000000000000..6957f14609247d
--- /dev/null
+++ b/package/kernel/qca-nss-dp/patches/0016-nss-dp-netdev-mac_addr-is-const.patch
@@ -0,0 +1,57 @@
+From ff9284e3a59982c78a0132e6f2c5e3f04ba11472 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Thu, 29 Sep 2022 20:37:46 +0200
+Subject: [PATCH 15/16] nss-dp: netdev mac_addr is const
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ exports/nss_dp_api_if.h                      | 2 +-
+ hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c | 2 +-
+ hal/dp_ops/edma_dp/edma_v2/edma_dp.c         | 2 +-
+ hal/dp_ops/syn_gmac_dp/syn_dp.c              | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/exports/nss_dp_api_if.h
++++ b/exports/nss_dp_api_if.h
+@@ -83,7 +83,7 @@ struct nss_dp_data_plane_ops {
+ 	int (*close)(struct nss_dp_data_plane_ctx *dpc);
+ 	int (*link_state)(struct nss_dp_data_plane_ctx *dpc,
+ 			  uint32_t link_state);
+-	int (*mac_addr)(struct nss_dp_data_plane_ctx *dpc, uint8_t *addr);
++	int (*mac_addr)(struct nss_dp_data_plane_ctx *dpc, const uint8_t *addr);
+ 	int (*change_mtu)(struct nss_dp_data_plane_ctx *dpc, uint32_t mtu);
+ 	netdev_tx_t (*xmit)(struct nss_dp_data_plane_ctx *dpc, struct sk_buff *os_buf);
+ 	void (*set_features)(struct nss_dp_data_plane_ctx *dpc);
+--- a/hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c
++++ b/hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c
+@@ -494,7 +494,7 @@ static int edma_if_link_state(struct nss
+ /*
+  * edma_if_mac_addr()
+  */
+-static int edma_if_mac_addr(struct nss_dp_data_plane_ctx *dpc, uint8_t *addr)
++static int edma_if_mac_addr(struct nss_dp_data_plane_ctx *dpc, const uint8_t *addr)
+ {
+ 	return NSS_DP_SUCCESS;
+ }
+--- a/hal/dp_ops/edma_dp/edma_v2/edma_dp.c
++++ b/hal/dp_ops/edma_dp/edma_v2/edma_dp.c
+@@ -99,7 +99,7 @@ static int edma_dp_link_state(struct nss
+  * edma_dp_mac_addr()
+  *	EDMA data plane MAC address change API
+  */
+-static int edma_dp_mac_addr(struct nss_dp_data_plane_ctx *dpc, uint8_t *addr)
++static int edma_dp_mac_addr(struct nss_dp_data_plane_ctx *dpc, const uint8_t *addr)
+ {
+ 	return NSS_DP_SUCCESS;
+ }
+--- a/hal/dp_ops/syn_gmac_dp/syn_dp.c
++++ b/hal/dp_ops/syn_gmac_dp/syn_dp.c
+@@ -289,7 +289,7 @@ static int syn_dp_if_link_state(struct n
+ /*
+  * syn_dp_if_mac_addr()
+  */
+-static int syn_dp_if_mac_addr(struct nss_dp_data_plane_ctx *dpc, uint8_t *addr)
++static int syn_dp_if_mac_addr(struct nss_dp_data_plane_ctx *dpc, const uint8_t *addr)
+ {
+ 	return NSS_DP_SUCCESS;
+ }
diff --git a/package/kernel/qca-nss-dp/patches/0017-nss-dp-use-proper-netdev-MAC-helpers.patch b/package/kernel/qca-nss-dp/patches/0017-nss-dp-use-proper-netdev-MAC-helpers.patch
new file mode 100644
index 00000000000000..beb6db4996d547
--- /dev/null
+++ b/package/kernel/qca-nss-dp/patches/0017-nss-dp-use-proper-netdev-MAC-helpers.patch
@@ -0,0 +1,27 @@
+From 704706969301076961c15423dedce9e2e6f1026e Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Thu, 29 Sep 2022 20:39:07 +0200
+Subject: [PATCH 16/16] nss-dp: use proper netdev MAC helpers
+
+mac_addr is const, so utilize proper helpers for setting random and
+desired MAC addres as old ones were dropped in newer kernels.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ nss_dp_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/nss_dp_main.c
++++ b/nss_dp_main.c
+@@ -599,9 +599,9 @@ static int32_t nss_dp_of_get_pdata(struc
+ 
+ 	ret = of_get_mac_address(np, maddr);
+ 	if (!ret && is_valid_ether_addr(maddr)) {
+-		ether_addr_copy(netdev->dev_addr, maddr);
++		eth_hw_addr_set(netdev, maddr);
+ 	} else {
+-		random_ether_addr(netdev->dev_addr);
++		eth_hw_addr_random(netdev);
+ 		pr_info("GMAC%d(%px) Invalid MAC@ - using %pM\n", dp_priv->macid,
+ 						dp_priv, netdev->dev_addr);
+ 	}
diff --git a/package/kernel/qca-nss-dp/patches/0018-nss-dp-adapt-to-netif_napi_add-changes.patch b/package/kernel/qca-nss-dp/patches/0018-nss-dp-adapt-to-netif_napi_add-changes.patch
new file mode 100644
index 00000000000000..084f30da1369aa
--- /dev/null
+++ b/package/kernel/qca-nss-dp/patches/0018-nss-dp-adapt-to-netif_napi_add-changes.patch
@@ -0,0 +1,84 @@
+From ba748ab91a62db57f9bdf69dd306e6557315db85 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Mon, 3 Oct 2022 23:05:14 +0200
+Subject: [PATCH] nss-dp: adapt to netif_napi_add() changes
+
+netif_napi_add() removed the weight argument and just uses the default
+NAPI_POLL_WEIGHT in background, so for those requiring custom weight use
+netif_napi_add_weight() instead.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c | 6 +++++-
+ hal/dp_ops/edma_dp/edma_v2/edma_cfg_rx.c     | 8 +++++++-
+ hal/dp_ops/edma_dp/edma_v2/edma_cfg_tx.c     | 7 ++++++-
+ hal/dp_ops/syn_gmac_dp/syn_dp.c              | 5 +++++
+ 4 files changed, 23 insertions(+), 3 deletions(-)
+
+--- a/hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c
++++ b/hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c
+@@ -838,8 +838,12 @@ static int edma_register_netdevice(struc
+ 	 * NAPI add
+ 	 */
+ 	if (!edma_hw.napi_added) {
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 0)
+ 		netif_napi_add(netdev, &edma_hw.napi, edma_napi,
+-				NAPI_POLL_WEIGHT);
++			       NAPI_POLL_WEIGHT);
++#else
++		netif_napi_add(netdev, &edma_hw.napi, edma_napi);
++#endif
+ 		/*
+ 		 * Register the interrupt handlers and enable interrupts
+ 		 */
+--- a/hal/dp_ops/edma_dp/edma_v2/edma_cfg_rx.c
++++ b/hal/dp_ops/edma_dp/edma_v2/edma_cfg_rx.c
+@@ -1097,8 +1097,14 @@ void edma_cfg_rx_napi_add(struct edma_gb
+ 
+ 	for (i = 0; i < egc->num_rxdesc_rings; i++) {
+ 		struct edma_rxdesc_ring *rxdesc_ring = &egc->rxdesc_rings[i];
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 0)
+ 		netif_napi_add(netdev, &rxdesc_ring->napi,
+-				edma_rx_napi_poll, nss_dp_rx_napi_budget);
++			       edma_rx_napi_poll, nss_dp_rx_napi_budget);
++
++#else
++		netif_napi_add_weight(netdev, &rxdesc_ring->napi,
++				      edma_rx_napi_poll, nss_dp_rx_napi_budget);
++#endif
+ 		rxdesc_ring->napi_added = true;
+ 	}
+ 	edma_info("%s: Rx NAPI budget: %d\n", netdev->name, nss_dp_rx_napi_budget);
+--- a/hal/dp_ops/edma_dp/edma_v2/edma_cfg_tx.c
++++ b/hal/dp_ops/edma_dp/edma_v2/edma_cfg_tx.c
+@@ -672,8 +672,13 @@ void edma_cfg_tx_napi_add(struct edma_gb
+ 	for (i = 0; i < egc->num_txcmpl_rings; i++) {
+ 		struct edma_txcmpl_ring *txcmpl_ring = &egc->txcmpl_rings[i];
+ 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 0)
+ 		netif_napi_add(netdev, &txcmpl_ring->napi,
+-				edma_tx_napi_poll, nss_dp_tx_napi_budget);
++			       edma_tx_napi_poll, nss_dp_tx_napi_budget);
++#else
++		netif_napi_add_weight(netdev, &txcmpl_ring->napi,
++				      edma_tx_napi_poll, nss_dp_tx_napi_budget);
++#endif
+ 		txcmpl_ring->napi_added = true;
+ 	}
+ 	edma_info("Tx NAPI budget: %d\n", nss_dp_tx_napi_budget);
+--- a/hal/dp_ops/syn_gmac_dp/syn_dp.c
++++ b/hal/dp_ops/syn_gmac_dp/syn_dp.c
+@@ -189,8 +189,13 @@ static int syn_dp_if_init(struct nss_dp_
+ 	}
+ 
+ 	if (!dev_info->napi_added) {
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 0)
+ 		netif_napi_add(netdev, &rx_info->napi_rx, syn_dp_napi_poll_rx, SYN_DP_NAPI_BUDGET_RX);
+ 		netif_napi_add(netdev, &tx_info->napi_tx, syn_dp_napi_poll_tx, SYN_DP_NAPI_BUDGET_TX);
++#else
++		netif_napi_add_weight(netdev, &rx_info->napi_rx, syn_dp_napi_poll_rx, SYN_DP_NAPI_BUDGET_RX);
++		netif_napi_add_weight(netdev, &tx_info->napi_tx, syn_dp_napi_poll_tx, SYN_DP_NAPI_BUDGET_TX);
++#endif
+ 
+ 		/*
+ 		 * Requesting irq. Set IRQ_DISABLE_UNLAZY flag, this flag
diff --git a/package/kernel/qca-ssdk/Makefile b/package/kernel/qca-ssdk/Makefile
new file mode 100644
index 00000000000000..a40aefb2eeed4d
--- /dev/null
+++ b/package/kernel/qca-ssdk/Makefile
@@ -0,0 +1,85 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=qca-ssdk
+PKG_RELEASE:=2
+
+PKG_SOURCE_URL:=https://git.codelinaro.org/clo/qsdk/oss/lklm/qca-ssdk.git
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_DATE:=2022-09-12
+PKG_SOURCE_VERSION:=628b22bc3d5ee81414b75ab3de6a255c82754dec
+PKG_MIRROR_HASH:=859344f79504b9953639dc5aa27042249f68e3a9a269e66d7f7a25e1ab38c110
+
+PKG_FLAGS:=nonshared
+PKG_BUILD_FLAGS:=no-lto
+
+include $(INCLUDE_DIR)/kernel.mk
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/qca-ssdk
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Qualcom SSDK switch driver
+  DEPENDS:=@(TARGET_qualcommax)
+  FILES:=$(PKG_BUILD_DIR)/build/bin/qca-ssdk.ko
+  AUTOLOAD:=$(call AutoLoad,30,qca-ssdk)
+endef
+
+define KernelPackage/qca-ssdk/Description
+  Driver for Qualcomm Atheros switches.
+endef
+
+GCC_VERSION=$(shell echo "$(CONFIG_GCC_VERSION)" | sed 's/[^0-9.]*\([0-9.]*\).*/\1/')
+
+ifdef CONFIG_TOOLCHAIN_BIN_PATH
+TOOLCHAIN_BIN_PATH=$(CONFIG_TOOLCHAIN_BIN_PATH)
+else
+TOOLCHAIN_BIN_PATH=$(TOOLCHAIN_DIR)/bin
+endif
+
+LNX_CONFIG_OPTS = LNX_MAKEOPTS='$(KERNEL_MAKEOPTS)' MODULE_TYPE=KSLIB modules
+
+MAKE_FLAGS+= \
+	TARGET_NAME=$(CONFIG_TARGET_NAME) \
+	TOOL_PATH=$(TOOLCHAIN_BIN_PATH) \
+	SYS_PATH=$(LINUX_DIR) \
+	TOOLPREFIX=$(TARGET_CROSS) \
+	KVER=$(LINUX_VERSION) \
+	ARCH=$(LINUX_KARCH) \
+	TARGET_SUFFIX=$(CONFIG_TARGET_SUFFIX) \
+	GCC_VERSION=$(GCC_VERSION) \
+	EXTRA_CFLAGS=-fno-stack-protector -I$(STAGING_DIR)/usr/include \
+	$(LNX_CONFIG_OPTS)
+
+ifeq ($(CONFIG_TARGET_SUBTARGET), "ipq807x")
+    MAKE_FLAGS+= CHIP_TYPE=HPPE PTP_FEATURE=disable SWCONFIG_FEATURE=disable
+endif
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include/qca-ssdk
+	$(INSTALL_DIR) $(1)/usr/include/qca-ssdk/api
+	$(INSTALL_DIR) $(1)/usr/include/qca-ssdk/ref
+	$(INSTALL_DIR) $(1)/usr/include/qca-ssdk/fal
+	$(INSTALL_DIR) $(1)/usr/include/qca-ssdk/sal
+	$(INSTALL_DIR) $(1)/usr/include/qca-ssdk/init
+	$(CP) -rf $(PKG_BUILD_DIR)/include/api/sw_ioctl.h $(1)/usr/include/qca-ssdk/api
+	if [ -f $(PKG_BUILD_DIR)/include/ref/ref_vsi.h ]; then \
+	$(CP) -rf $(PKG_BUILD_DIR)/include/ref/ref_vsi.h $(1)/usr/include/qca-ssdk/ref/; \
+	fi
+	if [ -f $(PKG_BUILD_DIR)/include/ref/ref_fdb.h ]; then \
+	$(CP) -rf $(PKG_BUILD_DIR)/include/ref/ref_fdb.h $(1)/usr/include/qca-ssdk/ref/; \
+	fi
+	if [ -f $(PKG_BUILD_DIR)/include/ref/ref_port_ctrl.h ]; then \
+	$(CP) -rf $(PKG_BUILD_DIR)/include/ref/ref_port_ctrl.h $(1)/usr/include/qca-ssdk/ref/; \
+	fi
+	if [ -f $(PKG_BUILD_DIR)/include/init/ssdk_init.h ]; then \
+	$(CP) -rf $(PKG_BUILD_DIR)/include/init/ssdk_init.h $(1)/usr/include/qca-ssdk/init/; \
+	fi
+	$(CP) -rf $(PKG_BUILD_DIR)/include/fal $(1)/usr/include/qca-ssdk
+	$(CP) -rf $(PKG_BUILD_DIR)/include/common/*.h $(1)/usr/include/qca-ssdk
+	$(CP) -rf $(PKG_BUILD_DIR)/include/sal/os/linux/*.h $(1)/usr/include/qca-ssdk
+	$(CP) -rf $(PKG_BUILD_DIR)/include/sal/os/*.h $(1)/usr/include/qca-ssdk
+
+endef
+
+$(eval $(call KernelPackage,qca-ssdk))
diff --git a/package/kernel/qca-ssdk/patches/0001-SSDK-replace-ioremap_nocache-with-ioremap.patch b/package/kernel/qca-ssdk/patches/0001-SSDK-replace-ioremap_nocache-with-ioremap.patch
new file mode 100644
index 00000000000000..2b659e1322ee66
--- /dev/null
+++ b/package/kernel/qca-ssdk/patches/0001-SSDK-replace-ioremap_nocache-with-ioremap.patch
@@ -0,0 +1,102 @@
+From 1e46d596701fedb751a669666a74677344fb8724 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Wed, 12 May 2021 13:45:45 +0200
+Subject: [PATCH 01/14] SSDK: replace ioremap_nocache with ioremap
+
+ioremap_nocache was dropped upstream, simply use the
+generic variety.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ src/init/ssdk_clk.c  | 10 +++++-----
+ src/init/ssdk_init.c |  2 +-
+ src/init/ssdk_plat.c |  6 +++---
+ 3 files changed, 9 insertions(+), 9 deletions(-)
+
+--- a/src/init/ssdk_clk.c
++++ b/src/init/ssdk_clk.c
+@@ -721,7 +721,7 @@ ssdk_mp_tcsr_get(a_uint32_t tcsr_offset,
+ {
+ 	void __iomem *tcsr_base = NULL;
+ 
+-	tcsr_base = ioremap_nocache(TCSR_ETH_ADDR, TCSR_ETH_SIZE);
++	tcsr_base = ioremap(TCSR_ETH_ADDR, TCSR_ETH_SIZE);
+ 	if (!tcsr_base)
+ 	{
+ 		SSDK_ERROR("Failed to map tcsr eth address!\n");
+@@ -738,7 +738,7 @@ ssdk_mp_tcsr_set(a_uint32_t tcsr_offset,
+ {
+ 	void __iomem *tcsr_base = NULL;
+ 
+-	tcsr_base = ioremap_nocache(TCSR_ETH_ADDR, TCSR_ETH_SIZE);
++	tcsr_base = ioremap(TCSR_ETH_ADDR, TCSR_ETH_SIZE);
+ 	if (!tcsr_base)
+ 	{
+ 		SSDK_ERROR("Failed to map tcsr eth address!\n");
+@@ -786,7 +786,7 @@ ssdk_mp_cmnblk_stable_check(void)
+ 	a_uint32_t reg_val;
+ 	int i, loops = 20;
+ 
+-	pll_lock = ioremap_nocache(CMN_PLL_LOCKED_ADDR, CMN_PLL_LOCKED_SIZE);
++	pll_lock = ioremap(CMN_PLL_LOCKED_ADDR, CMN_PLL_LOCKED_SIZE);
+ 	if (!pll_lock) {
+ 		SSDK_ERROR("Failed to map CMN PLL LOCK register!\n");
+ 		return A_FALSE;
+@@ -843,7 +843,7 @@ static void ssdk_cmnblk_pll_src_set(enum
+ 	void __iomem *cmn_pll_src_base = NULL;
+ 	a_uint32_t reg_val;
+ 
+-	cmn_pll_src_base = ioremap_nocache(CMN_BLK_PLL_SRC_ADDR, CMN_BLK_SIZE);
++	cmn_pll_src_base = ioremap(CMN_BLK_PLL_SRC_ADDR, CMN_BLK_SIZE);
+ 	if (!cmn_pll_src_base) {
+ 		SSDK_ERROR("Failed to map cmn pll source address!\n");
+ 		return;
+@@ -869,7 +869,7 @@ static void ssdk_cmnblk_init(enum cmnblk
+ 		return;
+ 	}
+ 
+-	gcc_pll_base = ioremap_nocache(CMN_BLK_ADDR, CMN_BLK_SIZE);
++	gcc_pll_base = ioremap(CMN_BLK_ADDR, CMN_BLK_SIZE);
+ 	if (!gcc_pll_base) {
+ 		SSDK_ERROR("Failed to map gcc pll address!\n");
+ 		return;
+--- a/src/init/ssdk_init.c
++++ b/src/init/ssdk_init.c
+@@ -3134,7 +3134,7 @@ static int ssdk_dess_mac_mode_init(a_uin
+ 							(a_uint8_t *)&reg_value, 4);
+ 			mdelay(10);
+ 			/*softreset psgmii, fixme*/
+-			gcc_addr = ioremap_nocache(0x1812000, 0x200);
++			gcc_addr = ioremap(0x1812000, 0x200);
+ 			if (!gcc_addr) {
+ 				SSDK_ERROR("gcc map fail!\n");
+ 				return 0;
+--- a/src/init/ssdk_plat.c
++++ b/src/init/ssdk_plat.c
+@@ -1708,7 +1708,7 @@ ssdk_plat_init(ssdk_init_cfg *cfg, a_uin
+ 	reg_mode = ssdk_uniphy_reg_access_mode_get(dev_id);
+ 	if(reg_mode == HSL_REG_LOCAL_BUS) {
+ 		ssdk_uniphy_reg_map_info_get(dev_id, &map);
+-		qca_phy_priv_global[dev_id]->uniphy_hw_addr = ioremap_nocache(map.base_addr,
++		qca_phy_priv_global[dev_id]->uniphy_hw_addr = ioremap(map.base_addr,
+ 									map.size);
+ 		if (!qca_phy_priv_global[dev_id]->uniphy_hw_addr) {
+ 			SSDK_ERROR("%s ioremap fail.", __func__);
+@@ -1723,7 +1723,7 @@ ssdk_plat_init(ssdk_init_cfg *cfg, a_uin
+ 	reg_mode = ssdk_switch_reg_access_mode_get(dev_id);
+ 	if (reg_mode == HSL_REG_LOCAL_BUS) {
+ 		ssdk_switch_reg_map_info_get(dev_id, &map);
+-		qca_phy_priv_global[dev_id]->hw_addr = ioremap_nocache(map.base_addr,
++		qca_phy_priv_global[dev_id]->hw_addr = ioremap(map.base_addr,
+ 								map.size);
+ 		if (!qca_phy_priv_global[dev_id]->hw_addr) {
+ 			SSDK_ERROR("%s ioremap fail.", __func__);
+@@ -1764,7 +1764,7 @@ ssdk_plat_init(ssdk_init_cfg *cfg, a_uin
+ 			return -1;
+ 		}
+ 
+-		qca_phy_priv_global[dev_id]->psgmii_hw_addr = ioremap_nocache(map.base_addr,
++		qca_phy_priv_global[dev_id]->psgmii_hw_addr = ioremap(map.base_addr,
+ 								map.size);
+ 		if (!qca_phy_priv_global[dev_id]->psgmii_hw_addr) {
+ 			SSDK_ERROR("%s ioremap fail.", __func__);
diff --git a/package/kernel/qca-ssdk/patches/0002-SSDK-platform-use-of_mdio_find_bus-to-get-MDIO-bus.patch b/package/kernel/qca-ssdk/patches/0002-SSDK-platform-use-of_mdio_find_bus-to-get-MDIO-bus.patch
new file mode 100644
index 00000000000000..21b3491c6f7ddc
--- /dev/null
+++ b/package/kernel/qca-ssdk/patches/0002-SSDK-platform-use-of_mdio_find_bus-to-get-MDIO-bus.patch
@@ -0,0 +1,40 @@
+From 60d2b72cacd43796def9b4bd69a9e0e84be9d2e1 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Wed, 12 May 2021 17:15:46 +0200
+Subject: [PATCH 02/14] SSDK: platform: use of_mdio_find_bus() to get MDIO bus
+
+Kernel has a generic of_mdio_find_bus() which can get the appropriate
+MDIO bus based on the DT node.
+So, drop the getting MDIO from platform data, which no longer works
+in 5.4 and later and use of_mdio_find_bus().
+
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ src/init/ssdk_plat.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/src/init/ssdk_plat.c
++++ b/src/init/ssdk_plat.c
+@@ -753,7 +753,6 @@ static int miibus_get(a_uint32_t dev_id)
+ 	struct device_node *mdio_node = NULL;
+ 	struct device_node *switch_node = NULL;
+ 	struct platform_device *mdio_plat = NULL;
+-	struct qca_mdio_data *mdio_data = NULL;
+ 	struct qca_phy_priv *priv;
+ 	hsl_reg_mode reg_mode = HSL_REG_LOCAL_BUS;
+ 	priv = qca_phy_priv_global[dev_id];
+@@ -788,12 +787,7 @@ static int miibus_get(a_uint32_t dev_id)
+ 
+ 	if(reg_mode == HSL_REG_LOCAL_BUS)
+ 	{
+-		mdio_data = dev_get_drvdata(&mdio_plat->dev);
+-		if (!mdio_data) {
+-			SSDK_ERROR("cannot get mdio_data reference from device data\n");
+-			return 1;
+-		}
+-		priv->miibus = mdio_data->mii_bus;
++		priv->miibus = of_mdio_find_bus(mdio_node);
+ 	}
+ 	else
+ 		priv->miibus = dev_get_drvdata(&mdio_plat->dev);
diff --git a/package/kernel/qca-ssdk/patches/0003-SSDK-dts-fix-of_get_mac_address.patch b/package/kernel/qca-ssdk/patches/0003-SSDK-dts-fix-of_get_mac_address.patch
new file mode 100644
index 00000000000000..c004f4acd88a10
--- /dev/null
+++ b/package/kernel/qca-ssdk/patches/0003-SSDK-dts-fix-of_get_mac_address.patch
@@ -0,0 +1,42 @@
+From c1b6fa42a160763b574dd52aa4845718e4cd0ea6 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 13 Aug 2021 20:03:21 +0200
+Subject: [PATCH 03/14] SSDK: dts: fix of_get_mac_address()
+
+Recently OpenWrt backported the updated of_get_mac_address()
+function which returns and error code instead.
+
+So, patch the SSDK to use it and fix the compilation error.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ src/init/ssdk_dts.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/src/init/ssdk_dts.c
++++ b/src/init/ssdk_dts.c
+@@ -921,8 +921,9 @@ static void ssdk_dt_parse_intf_mac(void)
+ {
+ 	struct device_node *dp_node = NULL;
+ 	a_uint32_t dp = 0;
+-	a_uint8_t *maddr = NULL;
++	u8 maddr[ETH_ALEN];
+ 	char dp_name[8] = {0};
++	int ret;
+ 
+ 	for (dp = 1; dp <= SSDK_MAX_NR_ETH; dp++) {
+ 		snprintf(dp_name, sizeof(dp_name), "dp%d", dp);
+@@ -930,11 +931,11 @@ static void ssdk_dt_parse_intf_mac(void)
+ 		if (!dp_node) {
+ 			continue;
+ 		}
+-		maddr = (a_uint8_t *)of_get_mac_address(dp_node);
++		ret = of_get_mac_address(dp_node, maddr);
+ #if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0))
+ 		if (maddr && is_valid_ether_addr(maddr)) {
+ #else
+-		if (!IS_ERR(maddr) && is_valid_ether_addr(maddr)) {
++		if (!ret && is_valid_ether_addr(maddr)) {
+ #endif
+ 			ssdk_dt_global.num_intf_mac++;
+ 			ether_addr_copy(ssdk_dt_global.intf_mac[dp-1].uc, maddr);
diff --git a/package/kernel/qca-ssdk/patches/0004-qca8081-convert-to-5.11-IRQ-model.patch b/package/kernel/qca-ssdk/patches/0004-qca8081-convert-to-5.11-IRQ-model.patch
new file mode 100644
index 00000000000000..1e496ad9810142
--- /dev/null
+++ b/package/kernel/qca-ssdk/patches/0004-qca8081-convert-to-5.11-IRQ-model.patch
@@ -0,0 +1,83 @@
+From aaac91b5e8756dce1c0242d58074a0b5d4607b57 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 24 Dec 2021 20:02:32 +0100
+Subject: [PATCH 04/14] qca8081: convert to 5.11 IRQ model
+
+Kernel 5.11 introduced new IRQ handling model for PHY-s,
+so provide those if 5.11 or later is used.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ src/hsl/phy/qca808x.c | 46 +++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 46 insertions(+)
+
+--- a/src/hsl/phy/qca808x.c
++++ b/src/hsl/phy/qca808x.c
+@@ -247,6 +247,7 @@ static int qca808x_config_intr(struct ph
+ 	return err;
+ }
+ 
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 11, 0))
+ static int qca808x_ack_interrupt(struct phy_device *phydev)
+ {
+ 	int err;
+@@ -266,6 +267,47 @@ static int qca808x_ack_interrupt(struct
+ 
+ 	return (err < 0) ? err : 0;
+ }
++#endif
++
++#if (LINUX_VERSION_CODE > KERNEL_VERSION(5, 11, 0))
++static irqreturn_t qca808x_handle_interrupt(struct phy_device *phydev)
++{
++	a_uint16_t irq_status, int_enabled;
++	a_uint32_t dev_id = 0, phy_id = 0;
++	qca808x_priv *priv = phydev->priv;
++	const struct qca808x_phy_info *pdata = priv->phy_info;
++
++	if (!pdata) {
++		return SW_FAIL;
++	}
++
++	dev_id = pdata->dev_id;
++	phy_id = pdata->phy_addr;
++
++	irq_status = qca808x_phy_reg_read(dev_id, phy_id,
++					  QCA808X_PHY_INTR_STATUS);
++	if (irq_status < 0) {
++		phy_error(phydev);
++		return IRQ_NONE;
++	}
++
++	/* Read the current enabled interrupts */
++	int_enabled = qca808x_phy_reg_read(dev_id, phy_id,
++					   QCA808X_PHY_INTR_MASK);
++	if (int_enabled < 0) {
++		phy_error(phydev);
++		return IRQ_NONE;
++	}
++
++	/* See if this was one of our enabled interrupts */
++	if (!(irq_status & int_enabled))
++		return IRQ_NONE;
++
++	phy_trigger_machine(phydev);
++
++	return IRQ_HANDLED;
++}
++#endif
+ 
+ /* switch linux negtiation capability to fal avariable */
+ #if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0))
+@@ -638,7 +680,11 @@ struct phy_driver qca808x_phy_driver = {
+ 	.config_intr	= qca808x_config_intr,
+ 	.config_aneg	= qca808x_config_aneg,
+ 	.aneg_done	= qca808x_aneg_done,
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 11, 0))
+ 	.ack_interrupt	= qca808x_ack_interrupt,
++#else
++	.handle_interrupt = qca808x_handle_interrupt,
++#endif
+ 	.read_status	= qca808x_read_status,
+ 	.suspend	= qca808x_suspend,
+ 	.resume		= qca808x_resume,
diff --git a/package/kernel/qca-ssdk/patches/0005-qca807x-add-a-LED-quirk-for-Xiaomi-AX9000.patch b/package/kernel/qca-ssdk/patches/0005-qca807x-add-a-LED-quirk-for-Xiaomi-AX9000.patch
new file mode 100644
index 00000000000000..6ff92ab95a984d
--- /dev/null
+++ b/package/kernel/qca-ssdk/patches/0005-qca807x-add-a-LED-quirk-for-Xiaomi-AX9000.patch
@@ -0,0 +1,67 @@
+From 37255b97a9170f6dd1604931f0d7a8f847be5b5d Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Tue, 11 Jan 2022 00:28:42 +0100
+Subject: [PATCH 05/14] qca807x: add a LED quirk for Xiaomi AX9000
+
+Xiaomi AX9000 has a single LED for each of 4 gigabit ethernet ports that
+are connected to QCA8075, and that LED is connected to the 100M LED pin.
+
+So, by default it will only work when in 10 or 100Mbit mode, this is quite
+annoying and makes no sense(If they have connected it to the 1000Mbit LED
+pin then it would have worked for 10/100 by default as well).
+
+So, to solve this add a check for system compatible as we cant parse if
+from DTS in any other way and set the 100M LED to blink on 1000Base-T
+as well.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ include/hsl/phy/malibu_phy.h |  2 ++
+ src/hsl/phy/malibu_phy.c     | 11 +++++++++++
+ 2 files changed, 13 insertions(+)
+
+--- a/include/hsl/phy/malibu_phy.h
++++ b/include/hsl/phy/malibu_phy.h
+@@ -94,6 +94,7 @@ extern "C"
+ #define MALIBU_DAC_CTRL_MASK  0x380
+ #define MALIBU_DAC_CTRL_VALUE  0x280
+ #define MALIBU_LED_1000_CTRL1_100_10_MASK  0x30
++#define MALIBU_LED_100_CTRL1_1000_MASK  0x40
+ 
+ #define MALIBU_PHY_EEE_ADV_100M 0x0002
+ #define MALIBU_PHY_EEE_ADV_1000M 0x0004
+@@ -118,6 +119,7 @@ extern "C"
+ #define MALIBU_PHY_MMD7_EGRESS_COUNTER_HIGH       0x802d
+ #define MALIBU_PHY_MMD7_EGRESS_COUNTER_LOW       0x802e
+ #define MALIBU_PHY_MMD7_EGRESS_ERROR_COUNTER       0x802f
++#define MALIBU_PHY_MMD7_LED_100_CTRL1       0x8074
+ #define MALIBU_PHY_MMD7_LED_1000_CTRL1       0x8076
+ 
+ 
+--- a/src/hsl/phy/malibu_phy.c
++++ b/src/hsl/phy/malibu_phy.c
+@@ -15,6 +15,8 @@
+  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+  */
+ 
++#include <linux/of.h>
++
+ #include "sw.h"
+ #include "fal_port_ctrl.h"
+ #include "hsl_api.h"
+@@ -2708,6 +2710,15 @@ malibu_phy_hw_init(a_uint32_t dev_id, a_
+ 			led_status |= MALIBU_LED_1000_CTRL1_100_10_MASK;
+ 			malibu_phy_mmd_write(dev_id, phy_addr, MALIBU_PHY_MMD7_NUM,
+ 				MALIBU_PHY_MMD7_LED_1000_CTRL1, led_status);
++			if (of_machine_is_compatible("xiaomi,ax9000")) {
++				/* add 1000M link LED behavior for Xiaomi AX9000 */
++				led_status = malibu_phy_mmd_read(dev_id, phy_addr, MALIBU_PHY_MMD7_NUM,
++					MALIBU_PHY_MMD7_LED_100_CTRL1);
++				led_status &= ~MALIBU_LED_100_CTRL1_1000_MASK;
++				led_status |= MALIBU_LED_100_CTRL1_1000_MASK;
++				malibu_phy_mmd_write(dev_id, phy_addr, MALIBU_PHY_MMD7_NUM,
++					MALIBU_PHY_MMD7_LED_100_CTRL1, led_status);
++			}
+ 			/*disable Extended next page*/
+ 			phy_data = malibu_phy_reg_read(dev_id, phy_addr, MALIBU_AUTONEG_ADVERT);
+ 			phy_data &= ~MALIBU_EXTENDED_NEXT_PAGE_EN;
diff --git a/package/kernel/qca-ssdk/patches/0006-qca807x-add-a-LED-quirk-for-Xiaomi-AX3600.patch b/package/kernel/qca-ssdk/patches/0006-qca807x-add-a-LED-quirk-for-Xiaomi-AX3600.patch
new file mode 100644
index 00000000000000..6e044c7466d2d1
--- /dev/null
+++ b/package/kernel/qca-ssdk/patches/0006-qca807x-add-a-LED-quirk-for-Xiaomi-AX3600.patch
@@ -0,0 +1,29 @@
+From 1eaed6c8d72cb07e221a94d05615ae45b60ffd82 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Wed, 26 Jan 2022 14:47:33 +0100
+Subject: [PATCH 06/14] qca807x: add a LED quirk for Xiaomi AX3600
+
+AX3600 requires the same LED quirk so that PHY LED-s will blink even
+once Linux resets the PHY.
+
+So, just check for its compatible.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ src/hsl/phy/malibu_phy.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/src/hsl/phy/malibu_phy.c
++++ b/src/hsl/phy/malibu_phy.c
+@@ -2710,8 +2710,9 @@ malibu_phy_hw_init(a_uint32_t dev_id, a_
+ 			led_status |= MALIBU_LED_1000_CTRL1_100_10_MASK;
+ 			malibu_phy_mmd_write(dev_id, phy_addr, MALIBU_PHY_MMD7_NUM,
+ 				MALIBU_PHY_MMD7_LED_1000_CTRL1, led_status);
+-			if (of_machine_is_compatible("xiaomi,ax9000")) {
+-				/* add 1000M link LED behavior for Xiaomi AX9000 */
++			/* add 1000M link LED behavior for Xiaomi boards */
++			if (of_machine_is_compatible("xiaomi,ax9000") ||
++			    of_machine_is_compatible("xiaomi,ax3600")) {
+ 				led_status = malibu_phy_mmd_read(dev_id, phy_addr, MALIBU_PHY_MMD7_NUM,
+ 					MALIBU_PHY_MMD7_LED_100_CTRL1);
+ 				led_status &= ~MALIBU_LED_100_CTRL1_1000_MASK;
diff --git a/package/kernel/qca-ssdk/patches/0007-include-fix-compilation-error-for-parse_uci_option.patch b/package/kernel/qca-ssdk/patches/0007-include-fix-compilation-error-for-parse_uci_option.patch
new file mode 100644
index 00000000000000..6b084a844d217a
--- /dev/null
+++ b/package/kernel/qca-ssdk/patches/0007-include-fix-compilation-error-for-parse_uci_option.patch
@@ -0,0 +1,22 @@
+From adc75660a50c5b7a16032921a30a0eaedc8b826f Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sat, 7 May 2022 19:03:55 +0200
+Subject: [PATCH 07/14] include: fix compilation error for parse_uci_option
+
+Fix missing include for parse_uci_option
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+---
+ include/ref/ref_uci.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/ref/ref_uci.h
++++ b/include/ref/ref_uci.h
+@@ -22,6 +22,7 @@
+ extern "C" {
+ #endif                          /* __cplusplus */
+ 
++#include <linux/switch.h>
+ 
+ #if defined(IN_SWCONFIG)
+ int
diff --git a/package/kernel/qca-ssdk/patches/0008-QSDK-config-Avoid-Werror-heroics.patch b/package/kernel/qca-ssdk/patches/0008-QSDK-config-Avoid-Werror-heroics.patch
new file mode 100644
index 00000000000000..30b4e4be4f9ad9
--- /dev/null
+++ b/package/kernel/qca-ssdk/patches/0008-QSDK-config-Avoid-Werror-heroics.patch
@@ -0,0 +1,30 @@
+From d70d013ac1090565ebb71875f5bdc70840807428 Mon Sep 17 00:00:00 2001
+From: Alexandru Gagniuc <mr.nuke.me@gmail.com>
+Date: Fri, 23 Sep 2022 08:21:13 -0500
+Subject: [PATCH 08/14] QSDK: config: Avoid -Werror heroics
+
+Trying to compile the QSDK with warnings as errors is a very brave
+endeavor. It's also stupid as it doesn't work on ipq60xx:
+
+   isisc_acl_prv.h:99: error: "FIELD_GET" redefined [-Werror]
+   99 | #define FIELD_GET(reg, field, val) \
+      |
+
+Instead of dealing with the braindead code, just disable Werror.
+
+Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
+---
+ config | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/config
++++ b/config
+@@ -133,7 +133,7 @@ endif
+ 
+ ifeq ($(ARCH), arm64)
+ 	ifeq ($(KVER),$(filter 4.1% 4.4% 4.9% 5.4%,$(KVER)))
+-		CPU_CFLAG=  -DMODULE -Os -pipe -march=armv8-a -mcpu=cortex-a53+crypto -fno-caller-saves -fno-strict-aliasing -Werror -fno-common -Wno-format-security -Wno-pointer-sign -Wno-unused-but-set-variable -Wno-error=unused-result -mcmodel=large
++		CPU_CFLAG=  -DMODULE -Os -pipe -march=armv8-a -mcpu=cortex-a53+crypto -fno-caller-saves -fno-strict-aliasing -fno-common -Wno-format-security -Wno-pointer-sign -Wno-unused-but-set-variable -Wno-error=unused-result -mcmodel=large
+ 	endif
+ endif
+ 
diff --git a/package/kernel/qca-ssdk/patches/0009-Revert-qca-ssdk-remove-bridge-fdb-entry-for-the-auth.patch b/package/kernel/qca-ssdk/patches/0009-Revert-qca-ssdk-remove-bridge-fdb-entry-for-the-auth.patch
new file mode 100644
index 00000000000000..92c46a815ed85d
--- /dev/null
+++ b/package/kernel/qca-ssdk/patches/0009-Revert-qca-ssdk-remove-bridge-fdb-entry-for-the-auth.patch
@@ -0,0 +1,48 @@
+From 0582c76ce9c35ce8d49cba598e0e17073dd875b5 Mon Sep 17 00:00:00 2001
+From: Alexandru Gagniuc <mr.nuke.me@gmail.com>
+Date: Fri, 23 Sep 2022 08:30:03 -0500
+Subject: [PATCH 09/14] Revert "qca-ssdk: remove bridge fdb entry for the
+ authentication failed mac"
+
+This change causes an undefined reference to "br_fdb_delete_by_netdev".
+This reverts commit 144f02b982c8c707aaf84b57d8c277d03d877236.
+
+Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
+---
+ src/ref/ref_acl.c | 11 -----------
+ 1 file changed, 11 deletions(-)
+
+--- a/src/ref/ref_acl.c
++++ b/src/ref/ref_acl.c
+@@ -23,7 +23,6 @@
+ #include "ssdk_init.h"
+ #include "ssdk_plat.h"
+ #include <linux/etherdevice.h>
+-#include <linux/if_bridge.h>
+ 
+ /* entry 0-1 is for global deny all and accept eapol rule
+    entry 2-9 is for phy port1 specific mac accept rule
+@@ -128,7 +127,6 @@ _ref_acl_mac_entry_create_rule(a_uint32_
+ {
+ 	sw_error_t rv = SW_OK;
+ 	fal_acl_rule_t rule = {0};
+-	struct net_device *eth_dev = NULL;
+ 	a_uint32_t port_id = ssdk_ifname_to_port(dev_id, entry->ifname);
+ 	SSDK_DEBUG("port_id %d entry_idx %d\n", port_id, entry_idx);
+ 
+@@ -224,15 +222,6 @@ _ref_acl_mac_entry_create_rule(a_uint32_
+ 		ref_acl_mac_entry[dev_id][entry_idx].port_map = BIT(port_id);
+ 		ref_acl_mac_entry[dev_id][entry_idx].acl_policy = 1;
+ 	}
+-	else if (!is_deny_all_mac(entry->src_mac.uc) && !entry->acl_policy)
+-	{
+-		eth_dev = dev_get_by_name(&init_net, entry->ifname);
+-		if (eth_dev)
+-		{
+-			br_fdb_delete_by_netdev(eth_dev, entry->src_mac.uc, 0);
+-			dev_put(eth_dev);
+-		}
+-	}
+ 	return rv;
+ }
+ 
diff --git a/package/kernel/qca-ssdk/patches/0010-Support-Linux-Style-Makefile-for-SSDK.patch b/package/kernel/qca-ssdk/patches/0010-Support-Linux-Style-Makefile-for-SSDK.patch
new file mode 100644
index 00000000000000..180701bb143603
--- /dev/null
+++ b/package/kernel/qca-ssdk/patches/0010-Support-Linux-Style-Makefile-for-SSDK.patch
@@ -0,0 +1,281 @@
+From 2276a0b93751f015ef719dedf9a0d4b55ae684d5 Mon Sep 17 00:00:00 2001
+From: crao <quic_crao@quicinc.com>
+Date: Tue, 15 Nov 2022 18:50:01 +0800
+Subject: [PATCH 10/14] Support Linux-Style Makefile for SSDK
+
+Change-Id: I8c4399433b6422ef6192f70bf08b0d3023cc94b6
+Signed-off-by: crao <quic_crao@quicinc.com>
+---
+ Makefile          | 15 +++++++++++++
+ Makefile.modules  | 16 ++++++++++++++
+ make/defs.mk      |  1 +
+ make/linux_opt.mk | 54 ++++++++++++++++++++++++++++-------------------
+ make/target.mk    | 12 +++++++++++
+ src/api/Makefile  |  2 +-
+ 6 files changed, 77 insertions(+), 23 deletions(-)
+ create mode 100644 Makefile.modules
+
+--- a/Makefile
++++ b/Makefile
+@@ -12,6 +12,9 @@ include ./make/$(OS)_opt.mk
+ SUB_DIR=$(patsubst %/, %, $(dir $(wildcard src/*/Makefile)))
+ SUB_LIB=$(subst src/, , $(SUB_DIR))
+ 
++####################################################################
++# 			SSDK-Style Makefile
++####################################################################
+ all: $(BIN_DIR) kslib
+ 	mkdir -p ./temp/;cd ./temp;cp ../build/bin/ssdk_ks_km.a ./;ar -x ssdk_ks_km.a; cp ../ko_Makefile ./Makefile;
+ 	make -C $(SYS_PATH) M=$(PRJ_PATH)/temp/ CROSS_COMPILE=$(TOOLPREFIX) modules
+@@ -20,6 +23,18 @@ all: $(BIN_DIR) kslib
+ 	rm -Rf ./temp/*.o ./temp/*.ko ./temp/*.a
+ 	@echo "---Build [SSDK-$(VERSION)] at $(BUILD_DATE) finished."
+ 
++####################################################################
++# 			LNX Modules-Style Makefile
++####################################################################
++modules: $(BIN_DIR) kslib_c
++	cp Makefile.modules ./Makefile;
++	make -C $(SYS_PATH) M=$(PRJ_PATH)/ $(LNX_MAKEOPTS) modules
++	cp *.ko build/bin;
++	@echo "---Build [SSDK-$(VERSION)] at $(BUILD_DATE) finished."
++
++kslib_c:
++	$(foreach i, $(SUB_LIB), $(MAKE) MODULE_TYPE=KSLIB -C src/$i src_list_loop || exit 1;)
++
+ kslib:kslib_o
+ 	$(AR) -r $(BIN_DIR)/$(KS_MOD)_$(RUNMODE).a $(wildcard $(BLD_DIR)/KSLIB/*.o)
+ 
+--- /dev/null
++++ b/Makefile.modules
+@@ -0,0 +1,16 @@
++####################################################################
++# 			Add All Local Flags
++####################################################################
++ccflags-y += $(LNX_LOCAL_CFLAGS) -Wno-error
++
++####################################################################
++# 			Build Object List
++####################################################################
++SRC_LIST := $(shell cat $(PRJ_PATH)/src_list.dep)
++OBJ_LIST := $(patsubst %.c,%.o,$(SRC_LIST))
++
++####################################################################
++# 			Linux Kernel Module
++####################################################################
++obj-m :=  qca-ssdk.o
++qca-ssdk-objs := $(OBJ_LIST)
+--- a/make/defs.mk
++++ b/make/defs.mk
+@@ -7,6 +7,7 @@ ifeq (,$(findstring $(LIB), $(COMPONENTS
+ endif
+ 
+ SRC_FILE=$(addprefix $(PRJ_PATH)/$(LOC_DIR)/, $(SRC_LIST))
++LOC_SRC_FILE=$(addprefix $(LOC_DIR)/, $(SRC_LIST))
+ 
+ OBJ_LIST=$(SRC_LIST:.c=.o)
+ OBJ_FILE=$(addprefix $(DST_DIR)/, $(OBJ_LIST))
+--- a/make/linux_opt.mk
++++ b/make/linux_opt.mk
+@@ -295,7 +295,7 @@ ifeq (TRUE, $(DEBUG_ON))
+   MODULE_CFLAG += -g
+ endif
+ 
+-MODULE_CFLAG += $(OPT_FLAG) -Wall -DVERSION=\"$(VERSION)\" -DBUILD_DATE=\"$(BUILD_DATE)\" -DOS=\"$(OS)\" -D"KBUILD_STR(s)=\#s" -D"KBUILD_MODNAME=KBUILD_STR(qca-ssdk)"
++MODULE_CFLAG += $(OPT_FLAG) -Wall -DVERSION=\"$(VERSION)\" -DBUILD_DATE=\"$(BUILD_DATE)\" -DOS=\"$(OS)\" -D"KBUILD_STR(s)=\#s"
+ 
+ MODULE_INC += -I$(PRJ_PATH)/include \
+                    -I$(PRJ_PATH)/include/common \
+@@ -450,7 +450,7 @@ ifeq (KSLIB, $(MODULE_TYPE))
+ 		MODULE_CFLAG += -DKVER34
+ 		MODULE_CFLAG += -DKVER32
+ 	    MODULE_CFLAG += -DLNX26_22
+-	    MODULE_INC += -I$(SYS_PATH) \
++	    SYS_INC += -I$(SYS_PATH) \
+                   -I$(TOOL_PATH)/../lib/gcc/$(TARGET_NAME)/$(GCC_VERSION)/include/ \
+ 	          -I$(SYS_PATH)/include \
+               -I$(SYS_PATH)/source/include \
+@@ -473,7 +473,7 @@ ifeq (KSLIB, $(MODULE_TYPE))
+                 MODULE_CFLAG += -DKVER32
+             MODULE_CFLAG += -DLNX26_22
+ 	    ifeq ($(ARCH), arm64)
+-            MODULE_INC += -I$(SYS_PATH) \
++            SYS_INC += -I$(SYS_PATH) \
+                   -I$(TOOL_PATH)/../lib/gcc/$(TARGET_NAME)/$(GCC_VERSION)/include/ \
+                   -I$(SYS_PATH)/include \
+               -I$(SYS_PATH)/source \
+@@ -492,13 +492,13 @@ ifeq (KSLIB, $(MODULE_TYPE))
+               -I$(SYS_PATH)/source/include/uapi
+ 
+ 	      ifneq ($(wildcard $(SYS_PATH)/include/linux/kconfig.h),)
+-	          MODULE_INC += -include $(SYS_PATH)/include/linux/kconfig.h
++	          SYS_INC += -include $(SYS_PATH)/include/linux/kconfig.h
+ 	      else
+-	          MODULE_INC += -include $(KERNEL_SRC)/include/linux/kconfig.h
++	          SYS_INC += -include $(KERNEL_SRC)/include/linux/kconfig.h
+ 	      endif
+ 
+ 	    else ifeq ($(ARCH), arm)
+-	    MODULE_INC += -I$(SYS_PATH) \
++	    SYS_INC += -I$(SYS_PATH) \
+               -I$(TOOL_PATH)/../lib/gcc/$(TARGET_NAME)/$(GCC_VERSION)/include/ \
+ 	      -I$(TOOL_PATH)/../lib/gcc/$(TARGET_NAME)/7.5.0/include/ \
+               -I$(TOOL_PATH)/../../lib/armv7a-vfp-neon-rdk-linux-gnueabi/gcc/arm-rdk-linux-gnueabi/4.8.4/include/ \
+@@ -522,13 +522,13 @@ ifeq (KSLIB, $(MODULE_TYPE))
+               -I$(TOOL_PATH)/../../lib/arm-rdk-linux-gnueabi/gcc/arm-rdk-linux-gnueabi/9.3.0/include/
+ 
+ 	      ifneq ($(wildcard $(SYS_PATH)/include/linux/kconfig.h),)
+-	          MODULE_INC += -include $(SYS_PATH)/include/linux/kconfig.h
++	          SYS_INC += -include $(SYS_PATH)/include/linux/kconfig.h
+ 	      else
+-	          MODULE_INC += -include $(KERNEL_SRC)/include/linux/kconfig.h
++	          SYS_INC += -include $(KERNEL_SRC)/include/linux/kconfig.h
+ 	      endif
+ 
+             else
+-            MODULE_INC += -I$(SYS_PATH) \
++            SYS_INC += -I$(SYS_PATH) \
+               -I$(TOOL_PATH)/../lib/gcc/$(TARGET_NAME)/$(GCC_VERSION)/include/ \
+               -I$(SYS_PATH)/include \
+               -I$(SYS_PATH)/source \
+@@ -564,7 +564,7 @@ ifeq (KSLIB, $(MODULE_TYPE))
+             MODULE_CFLAG += -DLNX26_22
+ 	    ifeq ($(ARCH), arm64)
+ 	    KCONF_FILE = $(SYS_PATH)/source/include/linux/kconfig.h
+-            MODULE_INC += -I$(SYS_PATH) \
++            SYS_INC += -I$(SYS_PATH) \
+                   -I$(TOOL_PATH)/../lib/gcc/$(TARGET_NAME)/$(GCC_VERSION)/include/ \
+                   -I$(SYS_PATH)/include \
+               -I$(SYS_PATH)/source/include \
+@@ -581,7 +581,7 @@ ifeq (KSLIB, $(MODULE_TYPE))
+               -I$(SYS_PATH)/source/arch/arm64/include/asm/mach \
+ 	      -include $(KCONF_FILE)
+ 	    else ifeq ($(ARCH), arm)
+-	    MODULE_INC += -I$(SYS_PATH) \
++	    SYS_INC += -I$(SYS_PATH) \
+               -I$(TOOL_PATH)/../lib/gcc/$(TARGET_NAME)/$(GCC_VERSION)/include/ \
+               -I$(TOOL_PATH)/../../lib/armv7a-vfp-neon-rdk-linux-gnueabi/gcc/arm-rdk-linux-gnueabi/4.8.4/include/ \
+               -I$(SYS_PATH)/include \
+@@ -604,7 +604,7 @@ ifeq (KSLIB, $(MODULE_TYPE))
+ 		MODULE_CFLAG += -DKVER34
+ 		MODULE_CFLAG += -DKVER32
+ 	    MODULE_CFLAG += -DLNX26_22
+-	    MODULE_INC += -I$(SYS_PATH) \
++	    SYS_INC += -I$(SYS_PATH) \
+                   -I$(TOOL_PATH)/../lib/gcc/$(TARGET_NAME)/$(GCC_VERSION)/include/ \
+ 		  -I$(TOOL_PATH)/../../lib/arm-poky-linux-gnueabi/gcc/arm-poky-linux-gnueabi/5.3.0/include/ \
+ 		  -I$(TOOL_PATH)/../../lib/armv7a-vfp-neon-rdk-linux-gnueabi/gcc/arm-rdk-linux-gnueabi/4.8.4/include/ \
+@@ -627,10 +627,10 @@ ifeq (KSLIB, $(MODULE_TYPE))
+               -I$(EXT_PATH) \
+               -I$(SYS_PATH)/source/arch/arm/include/asm/mach
+ 	ifneq ($(wildcard $(SYS_PATH)/include/linux/kconfig.h),)
+-		MODULE_INC += \
++		SYS_INC += \
+ 			-include $(SYS_PATH)/include/linux/kconfig.h
+ 	else
+-		MODULE_INC += \
++		SYS_INC += \
+ 			-include $(SYS_PATH)/source/include/linux/kconfig.h
+ 	endif
+ 
+@@ -641,7 +641,7 @@ ifeq (KSLIB, $(MODULE_TYPE))
+ 		MODULE_CFLAG += -DKVER32
+ 	    MODULE_CFLAG += -DLNX26_22
+ 	    MODULE_CFLAG += -Werror
+-	    MODULE_INC += -I$(SYS_PATH) \
++	    SYS_INC += -I$(SYS_PATH) \
+ 	          -I$(SYS_PATH)/include \
+               -I$(SYS_PATH)/source/include \
+               -I$(SYS_PATH)/source/arch/arm/mach-msm/include \
+@@ -657,7 +657,7 @@ ifeq (KSLIB, $(MODULE_TYPE))
+ 	MODULE_CFLAG += -DKVER32
+ 	MODULE_CFLAG += -DLNX26_22
+ 	ifeq (mips, $(CPU))
+-	  MODULE_INC += -I$(SYS_PATH) \
++	  SYS_INC += -I$(SYS_PATH) \
+             -I$(SYS_PATH)/include \
+             -I$(SYS_PATH)/arch/mips/include \
+ 	    -I$(SYS_PATH)/arch/mips/include/asm/mach-ar7240 \
+@@ -678,7 +678,7 @@ ifeq (KSLIB, $(MODULE_TYPE))
+                      -O2 -fno-pic -pipe -mabi=32 -march=mips32r2 -DMODULE -mlong-calls -DEXPORT_SYMTAB
+           endif
+     else
+-	    MODULE_INC += -I$(SYS_PATH) \
++	    SYS_INC += -I$(SYS_PATH) \
+               -I$(SYS_PATH)/include \
+               -I$(SYS_PATH)/arch/arm/include \
+               -I$(SYS_PATH)/arch/arm/include/asm \
+@@ -695,7 +695,7 @@ ifeq (KSLIB, $(MODULE_TYPE))
+         MODULE_CFLAG += -DKVER26
+         MODULE_CFLAG += -DLNX26_22
+         ifeq (mips, $(CPU))
+-          MODULE_INC += -I$(SYS_PATH) \
++          SYS_INC += -I$(SYS_PATH) \
+             -I$(SYS_PATH)/include \
+             -I$(SYS_PATH)/arch/mips/include \
+             -I$(SYS_PATH)/arch/mips/include/asm/mach-ar7240 \
+@@ -708,7 +708,7 @@ ifeq (KSLIB, $(MODULE_TYPE))
+                      -O2 -fno-pic -pipe -mabi=32 -march=mips32r2 -DMODULE -mlong-calls -DEXPORT_SYMTAB
+           endif
+         else
+-	    MODULE_INC += -I$(SYS_PATH) \
++	    SYS_INC += -I$(SYS_PATH) \
+               -I$(SYS_PATH)/include \
+               -I$(SYS_PATH)/arch/arm/include \
+               -I$(SYS_PATH)/arch/arm/include/asm \
+@@ -721,8 +721,7 @@ ifeq (KSLIB, $(MODULE_TYPE))
+ 
+   endif
+ 
+-  MODULE_CFLAG += -D__KERNEL__ -DKERNEL_MODULE $(CPU_CFLAG)
+-
++  MODULE_CFLAG += -D__KERNEL__ -DKERNEL_MODULE 
+ 
+ endif
+ 
+@@ -748,4 +747,15 @@ ifneq (TRUE, $(KERNEL_MODE))
+   endif
+ endif
+ 
+-LOCAL_CFLAGS += $(MODULE_INC) $(MODULE_CFLAG) $(EXTRA_CFLAGS)
++LOCAL_CFLAGS += $(MODULE_INC) $(SYS_INC) $(MODULE_CFLAG) $(EXTRA_CFLAGS)
++
++####################################################################
++# 			cflags for SSDK-Style Makefile
++####################################################################
++LOCAL_CFLAGS += $(CPU_CFLAG) -D"KBUILD_MODNAME=KBUILD_STR(qca-ssdk)"
++
++####################################################################
++# 			cflags for LNX Modules-Style Makefile
++####################################################################
++LNX_LOCAL_CFLAGS += $(MODULE_INC) $(MODULE_CFLAG) ${EXTRA_INC}
++export LNX_LOCAL_CFLAGS
+--- a/make/target.mk
++++ b/make/target.mk
+@@ -3,6 +3,18 @@ include $(PRJ_PATH)/make/$(OS)_opt.mk
+ 
+ include $(PRJ_PATH)/make/tools.mk
+ 
++####################################################################
++# 			LNX Modules-Style Makefile
++####################################################################
++src_list_loop: src_list
++	$(foreach i, $(SUB_DIR), $(MAKE) -C $(i) src_list_loop || exit 1;)
++
++src_list:
++	echo -n "$(LOC_SRC_FILE) " >>  $(PRJ_PATH)/src_list.dep
++
++####################################################################
++# 			SSDK-Style Makefile
++####################################################################
+ obj: $(OBJ_LIST)
+ 	$(OBJ_LOOP)
+ 
+--- a/src/api/Makefile
++++ b/src/api/Makefile
+@@ -1,4 +1,4 @@
+-LOC_DIR=src/sal
++LOC_DIR=src/api
+ LIB=API
+ 
+ include $(PRJ_PATH)/make/config.mk
diff --git a/package/kernel/qca-ssdk/patches/0011-fix-compilation-issue-in-Linux-Style-Makefile.patch b/package/kernel/qca-ssdk/patches/0011-fix-compilation-issue-in-Linux-Style-Makefile.patch
new file mode 100644
index 00000000000000..f7d07a7baf9251
--- /dev/null
+++ b/package/kernel/qca-ssdk/patches/0011-fix-compilation-issue-in-Linux-Style-Makefile.patch
@@ -0,0 +1,26 @@
+From 46a5dd73195081b5d78582f2a13f83e49f36e917 Mon Sep 17 00:00:00 2001
+From: crao <quic_crao@quicinc.com>
+Date: Tue, 7 Mar 2023 17:15:07 +0800
+Subject: [PATCH 11/14] fix compilation issue in Linux-Style Makefile
+
+Change-Id: If38251fc0a2bf4abc666d30f4812c0d9507310dc
+Signed-off-by: crao <quic_crao@quicinc.com>
+---
+ Makefile | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/Makefile
++++ b/Makefile
+@@ -27,9 +27,9 @@ all: $(BIN_DIR) kslib
+ # 			LNX Modules-Style Makefile
+ ####################################################################
+ modules: $(BIN_DIR) kslib_c
+-	cp Makefile.modules ./Makefile;
+-	make -C $(SYS_PATH) M=$(PRJ_PATH)/ $(LNX_MAKEOPTS) modules
+-	cp *.ko build/bin;
++	mkdir -p ./temp/;cp * ./temp -a;cd ./temp;cp ../Makefile.modules ./Makefile;
++	make -C $(SYS_PATH) M=$(PRJ_PATH)/temp $(LNX_MAKEOPTS) modules
++	cp temp/*.ko build/bin;
+ 	@echo "---Build [SSDK-$(VERSION)] at $(BUILD_DATE) finished."
+ 
+ kslib_c:
diff --git a/package/kernel/qca-ssdk/patches/0012-fix-compilation-issue-in-Miami-yocto.patch b/package/kernel/qca-ssdk/patches/0012-fix-compilation-issue-in-Miami-yocto.patch
new file mode 100644
index 00000000000000..7670d7f354af06
--- /dev/null
+++ b/package/kernel/qca-ssdk/patches/0012-fix-compilation-issue-in-Miami-yocto.patch
@@ -0,0 +1,23 @@
+From 0060aa1b0d2530672e64708d8062b3f33d007ed3 Mon Sep 17 00:00:00 2001
+From: crao <quic_crao@quicinc.com>
+Date: Wed, 15 Mar 2023 11:19:39 +0800
+Subject: [PATCH 12/14] fix compilation issue in Miami yocto
+
+Change-Id: I8526b9e43667d72ae9afa4ef8a13167088d194ba
+Signed-off-by: crao <quic_crao@quicinc.com>
+---
+ Makefile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/Makefile
++++ b/Makefile
+@@ -29,7 +29,9 @@ all: $(BIN_DIR) kslib
+ modules: $(BIN_DIR) kslib_c
+ 	mkdir -p ./temp/;cp * ./temp -a;cd ./temp;cp ../Makefile.modules ./Makefile;
+ 	make -C $(SYS_PATH) M=$(PRJ_PATH)/temp $(LNX_MAKEOPTS) modules
++	cp $(PRJ_PATH)/temp/Module.symvers $(PRJ_PATH)/Module.symvers;
+ 	cp temp/*.ko build/bin;
++	rm -Rf ./temp/*.o ./temp/*.ko ./temp/*.a
+ 	@echo "---Build [SSDK-$(VERSION)] at $(BUILD_DATE) finished."
+ 
+ kslib_c:
diff --git a/package/kernel/qca-ssdk/patches/0013-SSDK-config-add-kernel-6.1.patch b/package/kernel/qca-ssdk/patches/0013-SSDK-config-add-kernel-6.1.patch
new file mode 100644
index 00000000000000..44b5e625eede3f
--- /dev/null
+++ b/package/kernel/qca-ssdk/patches/0013-SSDK-config-add-kernel-6.1.patch
@@ -0,0 +1,55 @@
+From 05aba6d6dfd49fe10b33cf221b7e81250a67033c Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Thu, 29 Sep 2022 09:59:20 +0200
+Subject: [PATCH 13/14] SSDK: config: add kernel 6.1
+
+Allow kernel 6.1 to be recognized and compiled under it.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ config            | 6 +++++-
+ make/linux_opt.mk | 4 ++--
+ 2 files changed, 7 insertions(+), 3 deletions(-)
+
+--- a/config
++++ b/config
+@@ -24,6 +24,10 @@ ifeq ($(KVER),$(filter 5.4%,$(KVER)))
+ 	OS_VER=5_4
+ endif
+ 
++ifeq ($(KVER),$(filter 6.1%,$(KVER)))
++	OS_VER=6_1
++endif
++
+ ifeq ($(KVER), 3.4.0)
+ 	OS_VER=3_4
+ endif
+@@ -132,7 +136,7 @@ ifeq ($(ARCH), arm)
+ endif
+ 
+ ifeq ($(ARCH), arm64)
+-	ifeq ($(KVER),$(filter 4.1% 4.4% 4.9% 5.4%,$(KVER)))
++	ifeq ($(KVER),$(filter 4.1% 4.4% 4.9% 5.4% 6.1%,$(KVER)))
+ 		CPU_CFLAG=  -DMODULE -Os -pipe -march=armv8-a -mcpu=cortex-a53+crypto -fno-caller-saves -fno-strict-aliasing -fno-common -Wno-format-security -Wno-pointer-sign -Wno-unused-but-set-variable -Wno-error=unused-result -mcmodel=large
+ 	endif
+ endif
+--- a/make/linux_opt.mk
++++ b/make/linux_opt.mk
+@@ -437,7 +437,7 @@ ifeq (KSLIB, $(MODULE_TYPE))
+       KASAN_SHADOW_SCALE_SHIFT := 3
+   endif
+ 
+-  ifeq (5_4, $(OS_VER))
++  ifeq (5_4 6_1, $(OS_VER))
+       ifeq ($(ARCH), arm64)
+           KASAN_OPTION += -DKASAN_SHADOW_SCALE_SHIFT=$(KASAN_SHADOW_SCALE_SHIFT)
+        endif
+@@ -468,7 +468,7 @@ ifeq (KSLIB, $(MODULE_TYPE))
+ 
+   endif
+ 
+-  ifeq ($(OS_VER),$(filter 4_4 5_4, $(OS_VER)))
++  ifeq ($(OS_VER),$(filter 4_4 5_4 6_1, $(OS_VER)))
+                 MODULE_CFLAG += -DKVER34
+                 MODULE_CFLAG += -DKVER32
+             MODULE_CFLAG += -DLNX26_22
diff --git a/package/kernel/qca-ssdk/patches/0014-SSDK-qca808x-use-get_random_u32.patch b/package/kernel/qca-ssdk/patches/0014-SSDK-qca808x-use-get_random_u32.patch
new file mode 100644
index 00000000000000..f5aa0e907c78e2
--- /dev/null
+++ b/package/kernel/qca-ssdk/patches/0014-SSDK-qca808x-use-get_random_u32.patch
@@ -0,0 +1,27 @@
+From 6a49dd6bb2e40ce49351adb6100599f176d80494 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 21 Oct 2022 13:40:15 +0200
+Subject: [PATCH 14/14] SSDK: qca808x: use get_random_u32
+
+prandom has been removed from the kernel in 6.1-rc1, so use get_random_u32
+instead as its the drop-in replacement.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ src/hsl/phy/qca808x_phy.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/src/hsl/phy/qca808x_phy.c
++++ b/src/hsl/phy/qca808x_phy.c
+@@ -299,7 +299,11 @@ qca808x_phy_ms_random_seed_set(a_uint32_
+ 	phy_data = qca808x_phy_debug_read(dev_id, phy_id,
+ 		QCA808X_DEBUG_LOCAL_SEED);
+ 	phy_data &= ~(QCA808X_MASTER_SLAVE_SEED_CFG);
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 0)
+ 	phy_data |= (prandom_u32()%QCA808X_MASTER_SLAVE_SEED_RANGE) << 2;
++#else
++	phy_data |= (get_random_u32()%QCA808X_MASTER_SLAVE_SEED_RANGE) << 2;
++#endif
+ 	SSDK_DEBUG("QCA808X_DEBUG_LOCAL_SEED:%x\n", phy_data);
+ 	rv = qca808x_phy_debug_write(dev_id, phy_id,
+ 		QCA808X_DEBUG_LOCAL_SEED, phy_data);
diff --git a/package/kernel/rtc-rv5c386a/Makefile b/package/kernel/rtc-rv5c386a/Makefile
index 0cca78548a2016..7c18942ffec375 100644
--- a/package/kernel/rtc-rv5c386a/Makefile
+++ b/package/kernel/rtc-rv5c386a/Makefile
@@ -22,8 +22,7 @@ define KernelPackage/rtc-rv5c386a
 endef
 
 define Build/Compile
-	$(MAKE) -C "$(LINUX_DIR)" \
-		$(KERNEL_MAKE_FLAGS) \
+	$(KERNEL_MAKE) \
 		M="$(PKG_BUILD_DIR)" \
 		EXTRA_CFLAGS="$(BUILDFLAGS)" \
 		modules
diff --git a/package/kernel/rtl8812au-ct/Makefile b/package/kernel/rtl8812au-ct/Makefile
index aa2d7a2ea9a3a3..be1acabf28778f 100644
--- a/package/kernel/rtl8812au-ct/Makefile
+++ b/package/kernel/rtl8812au-ct/Makefile
@@ -24,7 +24,7 @@ include $(INCLUDE_DIR)/package.mk
 define KernelPackage/rtl8812au-ct
   SUBMENU:=Wireless Drivers
   TITLE:=Driver for Realtek 8812 AU devices comfast 912-ac, etc
-  DEPENDS:=+kmod-cfg80211 +kmod-usb-core +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT
+  DEPENDS:=+kmod-cfg80211 +kmod-usb-core +@DRIVER_11AC_SUPPORT
   FILES:=\
 	$(PKG_BUILD_DIR)/rtl8812au.ko
   AUTOLOAD:=$(call AutoProbe,rtl8812au)
@@ -39,13 +39,14 @@ NOSTDINC_FLAGS := \
 	-I$(STAGING_DIR)/usr/include/mac80211-backport/uapi \
 	-I$(STAGING_DIR)/usr/include/mac80211 \
 	-I$(STAGING_DIR)/usr/include/mac80211/uapi \
-	-include backport/backport.h
+	-include backport/backport.h \
+	-Wno-error=address \
+	-Wno-error=stringop-overread
 
 NOSTDINC_FLAGS+=-DCONFIG_IOCTL_CFG80211 -DRTW_USE_CFG80211_STA_EVENT -DBUILD_OPENWRT
 
 define Build/Compile
-	+$(MAKE) $(PKG_JOBS) -C "$(LINUX_DIR)" \
-		$(KERNEL_MAKE_FLAGS) \
+	+$(KERNEL_MAKE) $(PKG_JOBS) \
 		M="$(PKG_BUILD_DIR)" \
 		NOSTDINC_FLAGS="$(NOSTDINC_FLAGS)" \
 		modules
diff --git a/package/kernel/rtl8812au-ct/patches/004-remove-extern-inline.patch b/package/kernel/rtl8812au-ct/patches/004-remove-extern-inline.patch
new file mode 100644
index 00000000000000..871fe106364b3d
--- /dev/null
+++ b/package/kernel/rtl8812au-ct/patches/004-remove-extern-inline.patch
@@ -0,0 +1,24 @@
+--- a/include/ieee80211.h
++++ b/include/ieee80211.h
+@@ -1313,18 +1313,18 @@ enum ieee80211_state {
+ (((Addr[2]) & 0xff) == 0xff) && (((Addr[3]) & 0xff) == 0xff) && (((Addr[4]) & 0xff) == 0xff) && \
+ (((Addr[5]) & 0xff) == 0xff))
+ #else
+-extern __inline int is_multicast_mac_addr(const u8 *addr)
++__inline static int is_multicast_mac_addr(const u8 *addr)
+ {
+ 	return ((addr[0] != 0xff) && (0x01 & addr[0]));
+ }
+ 
+-extern __inline int is_broadcast_mac_addr(const u8 *addr)
++__inline static int is_broadcast_mac_addr(const u8 *addr)
+ {
+ 	return ((addr[0] == 0xff) && (addr[1] == 0xff) && (addr[2] == 0xff) &&   \
+ 	        (addr[3] == 0xff) && (addr[4] == 0xff) && (addr[5] == 0xff));
+ }
+ 
+-extern __inline int is_zero_mac_addr(const u8 *addr)
++__inline static int is_zero_mac_addr(const u8 *addr)
+ {
+ 	return ((addr[0] == 0x00) && (addr[1] == 0x00) && (addr[2] == 0x00) &&   \
+ 	        (addr[3] == 0x00) && (addr[4] == 0x00) && (addr[5] == 0x00));
diff --git a/package/kernel/rtl8812au-ct/patches/100-api_update.patch b/package/kernel/rtl8812au-ct/patches/100-api_update.patch
new file mode 100644
index 00000000000000..2c081256ed7b9b
--- /dev/null
+++ b/package/kernel/rtl8812au-ct/patches/100-api_update.patch
@@ -0,0 +1,56 @@
+--- a/os_dep/linux/ioctl_cfg80211.c
++++ b/os_dep/linux/ioctl_cfg80211.c
+@@ -798,8 +798,8 @@ check_bss:
+ 
+ 		DBG_871X(FUNC_ADPT_FMT" call cfg80211_roamed\n", FUNC_ADPT_ARG(padapter));
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0)
+-		roam_info.channel = notify_channel;
+-		roam_info.bssid = cur_network->network.MacAddress;
++		roam_info.links[0].channel = notify_channel;
++		roam_info.links[0].bssid = cur_network->network.MacAddress;
+ 		roam_info.req_ie = pmlmepriv->assoc_req + sizeof(struct rtw_ieee80211_hdr_3addr) + 2;
+ 		roam_info.req_ie_len = pmlmepriv->assoc_req_len - sizeof(struct rtw_ieee80211_hdr_3addr) - 2;
+ 		roam_info.resp_ie = pmlmepriv->assoc_rsp + sizeof(struct rtw_ieee80211_hdr_3addr) + 6;
+@@ -1389,6 +1389,7 @@ exit:
+ 
+ static int cfg80211_rtw_add_key(struct wiphy *wiphy, struct net_device *ndev,
+ #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
++                                int link_id,
+                                 u8 key_index, bool pairwise, const u8 *mac_addr,
+ #else	// (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+                                 u8 key_index, const u8 *mac_addr,
+@@ -1529,6 +1530,7 @@ addkey_end:
+ 
+ static int cfg80211_rtw_get_key(struct wiphy *wiphy, struct net_device *ndev,
+ #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
++                                int link_id,
+                                 u8 key_index, bool pairwise, const u8 *mac_addr,
+ #else	// (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+                                 u8 key_index, const u8 *mac_addr,
+@@ -1562,6 +1564,7 @@ static int cfg80211_rtw_get_key(struct w
+ 
+ static int cfg80211_rtw_del_key(struct wiphy *wiphy, struct net_device *ndev,
+ #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
++                                int link_id,
+                                 u8 key_index, bool pairwise, const u8 *mac_addr)
+ #else	// (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+                                 u8 key_index, const u8 *mac_addr)
+@@ -1581,7 +1584,7 @@ static int cfg80211_rtw_del_key(struct w
+ }
+ 
+ static int cfg80211_rtw_set_default_key(struct wiphy *wiphy,
+-                                        struct net_device *ndev, u8 key_index
++                                        struct net_device *ndev, int link_id, u8 key_index
+ #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38)) || defined(COMPAT_KERNEL_RELEASE)
+                                         , bool unicast, bool multicast
+ #endif
+@@ -4019,7 +4022,8 @@ static int cfg80211_rtw_change_beacon(st
+ 	return ret;
+ }
+ 
+-static int cfg80211_rtw_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
++static int cfg80211_rtw_stop_ap(struct wiphy *wiphy, struct net_device *ndev,
++				unsigned int link_id)
+ {
+ 	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+ 	return 0;
diff --git a/package/kernel/ubnt-ledbar/Makefile b/package/kernel/ubnt-ledbar/Makefile
new file mode 100644
index 00000000000000..69236ffbb330d4
--- /dev/null
+++ b/package/kernel/ubnt-ledbar/Makefile
@@ -0,0 +1,34 @@
+#
+# Copyright (C) 2008-2010 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_NAME:=ubnt-ledbar
+PKG_RELEASE:=1
+PKG_LICENSE:=GPL-2.0
+
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/leds-ubnt-ledbar
+  SUBMENU:=LED modules
+  TITLE:=Ubiquiti UniFi 6 LR LED support
+  FILES:= \
+	$(PKG_BUILD_DIR)/leds-ubnt-ledbar.ko
+  AUTOLOAD:=$(call AutoProbe,leds-ubnt-ledbar,1)
+  DEPENDS:=@TARGET_mediatek_mt7622||TARGET_ramips_mt7621 +kmod-i2c-core
+endef
+
+define KernelPackage/leds-ubnt-ledbar/description
+  LED support for some Ubiquiti UniFi access points.
+endef
+
+define Build/Compile
+	$(KERNEL_MAKE) M="$(PKG_BUILD_DIR)" modules
+endef
+
+$(eval $(call KernelPackage,leds-ubnt-ledbar))
diff --git a/package/kernel/ubnt-ledbar/src/Makefile b/package/kernel/ubnt-ledbar/src/Makefile
new file mode 100644
index 00000000000000..a81d9377c0a38a
--- /dev/null
+++ b/package/kernel/ubnt-ledbar/src/Makefile
@@ -0,0 +1 @@
+obj-m := leds-ubnt-ledbar.o
diff --git a/package/kernel/ubnt-ledbar/src/leds-ubnt-ledbar.c b/package/kernel/ubnt-ledbar/src/leds-ubnt-ledbar.c
new file mode 100644
index 00000000000000..ee9d34601c6fec
--- /dev/null
+++ b/package/kernel/ubnt-ledbar/src/leds-ubnt-ledbar.c
@@ -0,0 +1,262 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <linux/delay.h>
+#include <linux/i2c.h>
+#include <linux/init.h>
+#include <linux/leds.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include <linux/gpio/consumer.h>
+#include <linux/version.h>
+
+/**
+ * Driver for the Ubiquiti RGB LED controller (LEDBAR).
+ * This Controller is based on a Holtek HT32F52241 and connected
+ * via I2C.
+ *
+ *  - The Controller needs an enable signal set to high when
+ *    performing a transaction. On the U6-LR, this is located
+ *    at Pin 18 (R6902)
+ *
+ *  - The Pin is also printed when calling the "usetled" function
+ *    contained in the ubntapp bootloader application.
+ */
+
+#define UBNT_LEDBAR_MAX_BRIGHTNESS	0xff
+
+#define UBNT_LEDBAR_TRANSACTION_LENGTH	8
+#define UBNT_LEDBAR_TRANSACTION_SUCCESS	(char) 0xaa
+
+#define UBNT_LEDBAR_TRANSACTION_BLUE_IDX	2
+#define UBNT_LEDBAR_TRANSACTION_GREEN_IDX	3
+#define UBNT_LEDBAR_TRANSACTION_RED_IDX		4
+#define UBNT_LEDBAR_TRANSACTION_LED_COUNT_IDX	6
+
+struct ubnt_ledbar {
+	struct mutex lock;
+	u32 led_count;
+	struct i2c_client *client;
+	struct led_classdev led_red;
+	struct led_classdev led_green;
+	struct led_classdev led_blue;
+	struct gpio_desc *enable_gpio;
+	struct gpio_desc *reset_gpio;
+};
+
+static void ubnt_ledbar_perform_transaction(struct ubnt_ledbar *ledbar,
+					   const char *transaction, int len,
+					   char *result, int result_len)
+{
+	int i;
+
+	for (i = 0; i < len; i++)
+		i2c_smbus_write_byte(ledbar->client, transaction[i]);
+
+	for (i = 0; i < result_len; i++)
+		result[i] = i2c_smbus_read_byte(ledbar->client);
+}
+
+static int ubnt_ledbar_apply_state(struct ubnt_ledbar *ledbar)
+{
+	char setup_msg[UBNT_LEDBAR_TRANSACTION_LENGTH] = {0x40, 0x10, 0x00, 0x00,
+							  0x00, 0x00, 0x00, 0x11};
+	char led_msg[UBNT_LEDBAR_TRANSACTION_LENGTH] = {0x40, 0x00, 0x00, 0x00,
+							0x00, 0x00, 0x00, 0x00};
+	char i2c_response;
+	int ret = 0;
+
+	mutex_lock(&ledbar->lock);
+
+	led_msg[UBNT_LEDBAR_TRANSACTION_BLUE_IDX] = ledbar->led_blue.brightness;
+	led_msg[UBNT_LEDBAR_TRANSACTION_GREEN_IDX] = ledbar->led_green.brightness;
+	led_msg[UBNT_LEDBAR_TRANSACTION_RED_IDX] = ledbar->led_red.brightness;
+	led_msg[UBNT_LEDBAR_TRANSACTION_LED_COUNT_IDX] = ledbar->led_count;
+
+	gpiod_set_value(ledbar->enable_gpio, 1);
+
+	msleep(10);
+
+	ubnt_ledbar_perform_transaction(ledbar, setup_msg, sizeof(setup_msg), &i2c_response, sizeof(i2c_response));
+	if (i2c_response != UBNT_LEDBAR_TRANSACTION_SUCCESS) {
+		dev_err(&ledbar->client->dev, "Error initializing LED transaction: %02hhx\n", i2c_response);
+		ret = -EINVAL;
+		goto out_gpio;
+	}
+
+	ubnt_ledbar_perform_transaction(ledbar, led_msg, sizeof(led_msg), &i2c_response, sizeof(i2c_response));
+	if (i2c_response != UBNT_LEDBAR_TRANSACTION_SUCCESS) {
+		dev_err(&ledbar->client->dev, "Failed LED transaction: %02hhx\n", i2c_response);
+		ret = -EINVAL;
+		goto out_gpio;
+	}
+
+	msleep(10);
+out_gpio:
+	gpiod_set_value(ledbar->enable_gpio, 0);
+
+	mutex_unlock(&ledbar->lock);
+
+	return ret;
+}
+
+static void ubnt_ledbar_reset(struct ubnt_ledbar *ledbar)
+{
+	static const char init_msg[16] = {0x02, 0x81, 0xfd, 0x7e,
+					  0x00, 0x00, 0x00, 0x00,
+					  0x00, 0x00, 0x00, 0x00,
+					  0x00, 0x00, 0x00, 0x00};
+	char init_response[4];
+
+	if (!ledbar->reset_gpio)
+		return;
+
+	mutex_lock(&ledbar->lock);
+
+	gpiod_set_value(ledbar->reset_gpio, 1);
+	msleep(10);
+	gpiod_set_value(ledbar->reset_gpio, 0);
+
+	msleep(10);
+
+	gpiod_set_value(ledbar->enable_gpio, 1);
+	msleep(10);
+	ubnt_ledbar_perform_transaction(ledbar, init_msg, sizeof(init_msg), init_response, sizeof(init_response));
+	msleep(10);
+	gpiod_set_value(ledbar->enable_gpio, 0);
+
+	mutex_unlock(&ledbar->lock);
+}
+
+#define UBNT_LEDBAR_CONTROL_RGBS(name)				\
+static int ubnt_ledbar_set_##name##_brightness(struct led_classdev *led_cdev,\
+					enum led_brightness value)	\
+{									\
+	struct ubnt_ledbar *ledbar = \
+			container_of(led_cdev, struct ubnt_ledbar, led_##name); \
+	int ret; \
+	led_cdev->brightness = value; \
+	ret = ubnt_ledbar_apply_state(ledbar); \
+	return ret; \
+}
+
+UBNT_LEDBAR_CONTROL_RGBS(red);
+UBNT_LEDBAR_CONTROL_RGBS(green);
+UBNT_LEDBAR_CONTROL_RGBS(blue);
+
+
+static int ubnt_ledbar_init_led(struct device_node *np, struct ubnt_ledbar *ledbar,
+				struct led_classdev *led_cdev)
+{
+	struct led_init_data init_data = {};
+	int ret;
+
+	if (!np)
+		return 0;
+
+	init_data.fwnode = of_fwnode_handle(np);
+
+	led_cdev->max_brightness = UBNT_LEDBAR_MAX_BRIGHTNESS;
+
+	ret = devm_led_classdev_register_ext(&ledbar->client->dev, led_cdev,
+					     &init_data);
+	if (ret)
+		dev_err(&ledbar->client->dev, "led register err: %d\n", ret);
+
+	return ret;
+}
+
+
+static int ubnt_ledbar_probe(struct i2c_client *client,
+			     const struct i2c_device_id *id)
+{
+	struct device_node *np = client->dev.of_node;
+	struct ubnt_ledbar *ledbar;
+	int ret;
+
+	ledbar = devm_kzalloc(&client->dev, sizeof(*ledbar), GFP_KERNEL);
+	if (!ledbar)
+		return -ENOMEM;
+
+	ledbar->enable_gpio = devm_gpiod_get(&client->dev, "enable", GPIOD_OUT_LOW);
+
+	if (IS_ERR(ledbar->enable_gpio)) {
+		ret = PTR_ERR(ledbar->enable_gpio);
+		dev_err(&client->dev, "Failed to get enable gpio: %d\n", ret);
+		return ret;
+	}
+
+	ledbar->reset_gpio = devm_gpiod_get_optional(&client->dev, "reset", GPIOD_OUT_LOW);
+
+	if (IS_ERR(ledbar->reset_gpio)) {
+		ret = PTR_ERR(ledbar->reset_gpio);
+		dev_err(&client->dev, "Failed to get reset gpio: %d\n", ret);
+		return ret;
+	}
+
+	ledbar->led_count = 1;
+	of_property_read_u32(np, "led-count", &ledbar->led_count);
+
+	ledbar->client = client;
+
+	mutex_init(&ledbar->lock);
+
+	i2c_set_clientdata(client, ledbar);
+
+	// Reset and initialize the MCU
+	ubnt_ledbar_reset(ledbar);
+
+	ledbar->led_red.brightness_set_blocking = ubnt_ledbar_set_red_brightness;
+	ubnt_ledbar_init_led(of_get_child_by_name(np, "red"), ledbar, &ledbar->led_red);
+
+	ledbar->led_green.brightness_set_blocking = ubnt_ledbar_set_green_brightness;
+	ubnt_ledbar_init_led(of_get_child_by_name(np, "green"), ledbar, &ledbar->led_green);
+
+	ledbar->led_blue.brightness_set_blocking = ubnt_ledbar_set_blue_brightness;
+	ubnt_ledbar_init_led(of_get_child_by_name(np, "blue"), ledbar, &ledbar->led_blue);
+
+	return ubnt_ledbar_apply_state(ledbar);
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 0)
+static int ubnt_ledbar_remove(struct i2c_client *client)
+#else
+static void ubnt_ledbar_remove(struct i2c_client *client)
+#endif
+{
+	struct ubnt_ledbar *ledbar = i2c_get_clientdata(client);
+
+	mutex_destroy(&ledbar->lock);
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 0)
+	return 0;
+#endif
+}
+
+static const struct i2c_device_id ubnt_ledbar_id[] = {
+	{ "ubnt-ledbar", 0 },
+	{ }
+};
+MODULE_DEVICE_TABLE(i2c, ubnt_ledbar_id);
+
+static const struct of_device_id of_ubnt_ledbar_match[] = {
+	{ .compatible = "ubnt,ledbar", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, of_ubnt_ledbar_match);
+
+static struct i2c_driver ubnt_ledbar_driver = {
+	.driver = {
+		.name	= "ubnt-ledbar",
+		.of_match_table = of_ubnt_ledbar_match,
+	},
+	.probe		= ubnt_ledbar_probe,
+	.remove		= ubnt_ledbar_remove,
+	.id_table	= ubnt_ledbar_id,
+};
+module_i2c_driver(ubnt_ledbar_driver);
+
+MODULE_DESCRIPTION("Ubiquiti LEDBAR driver");
+MODULE_AUTHOR("David Bauer <mail@david-bauer.net>");
+MODULE_LICENSE("GPL v2");
diff --git a/package/libs/argp-standalone/Makefile b/package/libs/argp-standalone/Makefile
index 1a48dcb2cd7269..23e51697964c7e 100644
--- a/package/libs/argp-standalone/Makefile
+++ b/package/libs/argp-standalone/Makefile
@@ -19,6 +19,8 @@ PKG_MAINTAINER:=Ted Hess <thess@kitschensync.net>
 PKG_LICENSE:=LGPL-2.1
 PKG_LICENSE:=Makefile.am
 
+PKG_BUILD_FLAGS:=no-lto
+
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/host-build.mk
 
diff --git a/package/libs/elfutils/Makefile b/package/libs/elfutils/Makefile
index 4ca37d3b06d223..f7364c36be2079 100644
--- a/package/libs/elfutils/Makefile
+++ b/package/libs/elfutils/Makefile
@@ -7,12 +7,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=elfutils
-PKG_VERSION:=0.187
+PKG_VERSION:=0.189
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://sourceware.org/$(PKG_NAME)/ftp/$(PKG_VERSION)
-PKG_HASH:=e70b0dfbe610f90c4d1fe0d71af142a4e25c3c4ef9ebab8d2d72b65159d454c8
+PKG_HASH:=39bd8f1a338e2b7cd4abc3ff11a0eddc6e690f69578a57478d8179b4148708c8
 
 PKG_MAINTAINER:=Luiz Angelo Daros de Luca <luizluca@gmail.com>
 PKG_LICENSE:=GPL-3.0-or-later
@@ -21,7 +21,6 @@ PKG_CPE_ID:=cpe:/a:elfutils_project:elfutils
 
 PKG_FIXUP:=autoreconf
 PKG_INSTALL:=1
-PKG_USE_MIPS16:=1
 PKG_BUILD_DEPENDS:=!USE_GLIBC:argp-standalone
 
 include $(INCLUDE_DIR)/package.mk
@@ -65,6 +64,7 @@ HOST_CONFIGURE_ARGS += \
 	--disable-nls \
 	--disable-debuginfod \
 	--disable-libdebuginfod \
+	--without-bzlib \
 	--without-lzma \
 	--without-zstd
 
@@ -72,6 +72,7 @@ CONFIGURE_ARGS += \
 	--program-prefix=eu- \
 	--disable-debuginfod \
 	--disable-libdebuginfod \
+	--without-bzlib \
 	--without-lzma \
 	--without-zstd
 
@@ -81,7 +82,15 @@ HOST_CONFIGURE_VARS += \
 CONFIGURE_VARS += \
 	ac_cv_search__obstack_free=yes
 
-TARGET_CFLAGS += -D_GNU_SOURCE -Wno-unused-result -Wno-format-nonliteral
+TARGET_CFLAGS += \
+	-D_GNU_SOURCE \
+	-Wno-unused-result \
+	-Wno-format-nonliteral
+
+ifneq ($(CONFIG_GCC_USE_VERSION_11),y)
+TARGET_CFLAGS += \
+	-Wno-error=use-after-free
+endif
 
 define Build/InstallDev
 	$(INSTALL_DIR) $(1)/usr/include
diff --git a/package/libs/elfutils/patches/003-libintl-compatibility.patch b/package/libs/elfutils/patches/003-libintl-compatibility.patch
index 3254dcffb2613a..1271796af54fd4 100644
--- a/package/libs/elfutils/patches/003-libintl-compatibility.patch
+++ b/package/libs/elfutils/patches/003-libintl-compatibility.patch
@@ -8,10 +8,10 @@
 +Libs: -L${libdir} -lelf @intl_LDFLAGS@
  Cflags: -I${includedir}
  
- Requires.private: zlib
+ Requires.private: zlib @LIBZSTD@
 --- a/configure.ac
 +++ b/configure.ac
-@@ -610,6 +610,9 @@ dnl AM_GNU_GETTEXT_REQUIRE_VERSION suppo
+@@ -717,6 +717,9 @@ dnl AM_GNU_GETTEXT_REQUIRE_VERSION suppo
  AM_GNU_GETTEXT_VERSION([0.19.6])
  AM_GNU_GETTEXT_REQUIRE_VERSION([0.19.6])
  
diff --git a/package/libs/elfutils/patches/100-musl-compat.patch b/package/libs/elfutils/patches/100-musl-compat.patch
index 52b9f2c43b7ecc..3fa095bd74dc2e 100644
--- a/package/libs/elfutils/patches/100-musl-compat.patch
+++ b/package/libs/elfutils/patches/100-musl-compat.patch
@@ -9,7 +9,7 @@
  }
 --- a/libdwfl/dwfl_error.c
 +++ b/libdwfl/dwfl_error.c
-@@ -140,6 +140,7 @@ __libdwfl_seterrno (Dwfl_Error error)
+@@ -139,6 +139,7 @@ __libdwfl_seterrno (Dwfl_Error error)
  static const char *
  errnomsg(int error)
  {
@@ -17,7 +17,7 @@
    /* Won't be changed by strerror_r, but not const so compiler doesn't throw warning */
    static char unknown[] = "unknown error";
  
-@@ -150,6 +151,9 @@ errnomsg(int error)
+@@ -149,6 +150,9 @@ errnomsg(int error)
    static __thread char msg[128];
    return strerror_r (error, msg, sizeof (msg)) ? unknown : msg;
  #endif
diff --git a/package/libs/elfutils/patches/101-no-fts.patch b/package/libs/elfutils/patches/101-no-fts.patch
index c4f0b88233f235..29a6c4b36cb4aa 100644
--- a/package/libs/elfutils/patches/101-no-fts.patch
+++ b/package/libs/elfutils/patches/101-no-fts.patch
@@ -1,6 +1,6 @@
 --- a/libdwfl/argp-std.c
 +++ b/libdwfl/argp-std.c
-@@ -53,9 +53,6 @@ static const struct argp_option options[
+@@ -51,9 +51,6 @@ static const struct argp_option options[
    { "linux-process-map", 'M', "FILE", 0,
      N_("Find addresses in files mapped as read from FILE"
         " in Linux /proc/PID/maps format"), 0 },
@@ -10,7 +10,7 @@
    { "debuginfo-path", OPT_DEBUGINFO, "PATH", 0,
      N_("Search path for separate debuginfo files"), 0 },
    { NULL, 0, NULL, 0, NULL, 0 }
-@@ -82,15 +79,6 @@ static const Dwfl_Callbacks proc_callbac
+@@ -80,15 +77,6 @@ static const Dwfl_Callbacks proc_callbac
      .find_elf = INTUSE(dwfl_linux_proc_find_elf),
    };
  
@@ -26,7 +26,7 @@
  /* Structure held at state->HOOK.  */
  struct parse_opt
  {
-@@ -223,43 +211,6 @@ parse_opt (int key, char *arg, struct ar
+@@ -221,43 +209,6 @@ parse_opt (int key, char *arg, struct ar
        }
        break;
  
diff --git a/package/libs/gettext-full/Makefile b/package/libs/gettext-full/Makefile
index f5f5e00542c25d..1ed0e82df05899 100644
--- a/package/libs/gettext-full/Makefile
+++ b/package/libs/gettext-full/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=gettext-full
-PKG_VERSION:=0.21
+PKG_VERSION:=0.21.1
 PKG_RELEASE:=2
 
 PKG_SOURCE:=gettext-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@GNU/gettext
-PKG_HASH:=d20fcbb537e02dcf1383197ba05bd0734ef7bf5db06bdb241eb69b7d16b73192
+PKG_HASH:=50dbc8f39797950aa2c98e939947c527e5ac9ebd2c1b99dd7b06ba33a6767ae6
 PKG_BUILD_DIR:=$(BUILD_DIR)/gettext-$(PKG_VERSION)
 HOST_BUILD_DIR:=$(BUILD_DIR_HOST)/gettext-$(PKG_VERSION)
 
@@ -21,12 +21,42 @@ PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 PKG_LICENSE:=GPL-3.0-or-later
 PKG_CPE_ID:=cpe:/a:gnu:gettext
 
-PKG_FIXUP:=autoreconf
 PKG_INSTALL:=1
-PKG_BUILD_DEPENDS:=gettext-full/host
+PKG_BUILD_DEPENDS:=gettext-full/host libunistring libxml2
 PKG_BUILD_PARALLEL:=0
+
+HOST_BUILD_DEPENDS:=gperf/host libunistring/host libxml2/host
 HOST_BUILD_PARALLEL:=0
 
+PKG_SUBDIRS:= \
+	$$$$(foreach dir, \
+		intl \
+		intl-csharp \
+		intl-java \
+		its \
+		gnulib-lib \
+		gnulib-local \
+		lib \
+		$$$$(SUBDIR_libasprintf) \
+		libgettextpo \
+		libgrep \
+		libtextstyle \
+		m4 \
+		misc \
+		po \
+		projects \
+		src \
+		styles \
+		gettext-runtime \
+		gettext-tools \
+	,$$$$(wildcard $$$$(dir)) )
+
+PKG_MAKEFILES_FAKE:= \
+	gnulib-local/m4/Makefile \
+	libtextstyle/gnulib-local/Makefile \
+	libtextstyle/m4/Makefile \
+	m4/Makefile
+
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/host-build.mk
 
@@ -38,6 +68,8 @@ define Package/libintl-full
   ABI_VERSION:=8
 endef
 
+export GNULIB_SRCDIR:=$(HOST_GNULIB_SRCDIR)
+
 TARGET_CFLAGS += $(FPIC)
 ifneq ($(HOST_OS),Linux)
   TARGET_CFLAGS += -I$(STAGING_DIR_HOSTPKG)/include
@@ -55,6 +87,8 @@ CONFIGURE_ARGS += \
 	--with-included-gettext \
 	--without-libintl-prefix \
 	--without-libexpat-prefix \
+	--with-libunistring-prefix=$(STAGING_DIR)/usr \
+	--with-libxml2-prefix=$(STAGING_DIR) \
 	--without-emacs
 
 HOST_CONFIGURE_ARGS += \
@@ -65,7 +99,8 @@ HOST_CONFIGURE_ARGS += \
 	--disable-java \
 	--disable-openmp \
 	--without-emacs \
-	--without-libxml2-prefix
+	--with-libunistring-prefix=$(STAGING_DIR_HOSTPKG) \
+	--with-libxml2-prefix=$(STAGING_DIR_HOSTPKG)
 
 HOST_CONFIGURE_VARS += \
 	EMACS="no" \
@@ -75,6 +110,52 @@ HOST_CONFIGURE_VARS += \
 
 HOST_CFLAGS += $(HOST_FPIC)
 
+define Host/Bootstrap
+	( \
+		cd $(HOST_BUILD_DIR); \
+		$(AM_TOOL_PATHS) \
+		./autogen.sh \
+	)
+endef
+
+define Host/Prepare
+	$(call Host/Prepare/Default)
+	$(if $(QUILT),,$(call Host/Bootstrap))
+endef
+
+define Host/Configure
+	$(if $(QUILT),$(call Host/Bootstrap))
+	$(call Host/Configure/Default)
+endef
+
+define Host/Compile
+	$(foreach makefile,$(PKG_MAKEFILES_FAKE),printf '%s\n%s\n' 'all:' 'install:' > $(HOST_BUILD_DIR)/$(makefile); )
+	$(call Host/Compile/Default,SUBDIRS='$(PKG_SUBDIRS)')
+endef
+
+define Build/Bootstrap
+	( \
+		cd $(PKG_BUILD_DIR); \
+		$(AM_TOOL_PATHS) \
+		./autogen.sh \
+	)
+endef
+
+define Build/Prepare
+	$(call Build/Prepare/Default)
+	$(if $(QUILT),,$(call Build/Bootstrap))
+endef
+
+define Build/Configure
+	$(if $(QUILT),$(call Build/Bootstrap))
+	$(call Build/Configure/Default)
+endef
+
+define Build/Compile
+	$(foreach makefile,$(PKG_MAKEFILES_FAKE),printf '%s\n%s\n' 'all:' 'install:' > $(PKG_BUILD_DIR)/$(makefile); )
+	$(call Build/Compile/Default,SUBDIRS='$(PKG_SUBDIRS)')
+endef
+
 define Build/InstallDev
 	$(INSTALL_DIR) $(1)/usr/lib/libintl-full/include
 	$(CP) $(PKG_INSTALL_DIR)/usr/include/libintl.h $(1)/usr/lib/libintl-full/include/
@@ -89,10 +170,14 @@ define Build/InstallDev
 endef
 
 define Host/Install
-	$(call Host/Install/Default)
+	$(call Host/Compile/Default,install SUBDIRS='$(PKG_SUBDIRS)')
 	$(LN) msgfmt $(STAGING_DIR_HOSTPKG)/bin/gmsgfmt
 endef
 
+define Build/Install
+	$(call Build/Install/Default,install SUBDIRS='$(PKG_SUBDIRS)')
+endef
+
 define Package/libintl-full/install
 	$(INSTALL_DIR) $(1)/usr/lib
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libintl.so.* $(1)/usr/lib/
diff --git a/package/libs/gettext-full/patches/001-autotools.patch b/package/libs/gettext-full/patches/001-autotools.patch
index 034fc938a3b4f2..7e1f005dc55262 100644
--- a/package/libs/gettext-full/patches/001-autotools.patch
+++ b/package/libs/gettext-full/patches/001-autotools.patch
@@ -12,7 +12,7 @@
  	  $(INSTALL_DATA) $$dir/$$file $(DESTDIR)$(htmldir)/$$file; \
 --- a/gettext-tools/man/Makefile.am
 +++ b/gettext-tools/man/Makefile.am
-@@ -157,8 +157,7 @@ recode-sr-latin.1.html: recode-sr-latin.
+@@ -158,8 +158,7 @@ recode-sr-latin.1.html: recode-sr-latin.
  gettextize.1.html: gettextize.1
  autopoint.1.html: autopoint.1
  
diff --git a/package/libs/gettext-full/patches/100-libxml-no-force-included.patch b/package/libs/gettext-full/patches/100-libxml-no-force-included.patch
new file mode 100644
index 00000000000000..af5c0a47ee8e79
--- /dev/null
+++ b/package/libs/gettext-full/patches/100-libxml-no-force-included.patch
@@ -0,0 +1,31 @@
+--- a/libtextstyle/gnulib-local/modules/libxml.diff
++++ /dev/null
+@@ -1,28 +0,0 @@
+-*** libxml.orig	2018-10-28 14:37:07.007164889 +0100
+---- libxml	2019-02-14 22:19:29.994771110 +0100
+-***************
+-*** 118,124 ****
+-  fabs
+-  
+-  configure.ac:
+-! gl_LIBXML
+-  
+-  Makefile.am:
+-  if INCLUDED_LIBXML
+---- 118,133 ----
+-  fabs
+-  
+-  configure.ac:
+-! # In libtextstyle, we don't want to use an external libxml, because its
+-! # dependencies and their dynamic relocations have an impact on the startup
+-! # time of a program that is linked with it. As you can see by using
+-! # 'readelf -r ... | wc -l' and 'readelf -d ... | grep NEEDED':
+-! # - libxml2.so has more than 3300 relocations and depends on libicuuc.
+-! #   - libicuuc.so has more than 4900 relocations and depends on libstdc++.
+-! #     - libstdc++.so has more than 4600 relocations.
+-! # These are more than 12800 relocations, to perform at program startup.
+-! # So, force the use of the included libxml part.
+-! gl_LIBXML([yes])
+-  
+-  Makefile.am:
+-  if INCLUDED_LIBXML
diff --git a/package/libs/gettext-full/patches/200-libunistring-missing-link.patch b/package/libs/gettext-full/patches/200-libunistring-missing-link.patch
new file mode 100644
index 00000000000000..2e1dbf84e87a90
--- /dev/null
+++ b/package/libs/gettext-full/patches/200-libunistring-missing-link.patch
@@ -0,0 +1,21 @@
+--- a/autogen.sh
++++ b/autogen.sh
+@@ -78,6 +78,7 @@ if ! $skip_gnulib; then
+     getopt-gnu
+     gettext-h
+     havelib
++    libunistring-optional
+     memmove
+     noreturn
+     progname
+--- a/gettext-runtime/src/Makefile.am
++++ b/gettext-runtime/src/Makefile.am
+@@ -40,7 +40,7 @@ envsubst_SOURCES = envsubst.c
+ 
+ # Link dependencies.
+ # Need @LTLIBICONV@ because striconv.c uses iconv().
+-LDADD = ../gnulib-lib/libgrt.a @LTLIBINTL@ @LTLIBICONV@ $(WOE32_LDADD)
++LDADD = ../gnulib-lib/libgrt.a $(LTLIBUNISTRING) @LTLIBINTL@ @LTLIBICONV@ $(WOE32_LDADD)
+ 
+ # Specify installation directory, for --enable-relocatable.
+ gettext_CFLAGS = -DINSTALLDIR=\"$(bindir)\"
diff --git a/package/libs/gmp/Makefile b/package/libs/gmp/Makefile
index eb7d808139f927..c9f886e7648d88 100644
--- a/package/libs/gmp/Makefile
+++ b/package/libs/gmp/Makefile
@@ -20,7 +20,7 @@ PKG_INSTALL:=1
 PKG_FIXUP:=autoreconf
 PKG_LICENSE:=GPL-2.0-or-later
 
-PKG_USE_MIPS16:=0
+PKG_BUILD_FLAGS:=no-mips16
 
 include $(INCLUDE_DIR)/host-build.mk
 include $(INCLUDE_DIR)/package.mk
diff --git a/package/libs/jansson/Makefile b/package/libs/jansson/Makefile
index d8567ed79a4f11..e2b5206acb35bd 100644
--- a/package/libs/jansson/Makefile
+++ b/package/libs/jansson/Makefile
@@ -19,6 +19,8 @@ PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE
 PKG_CPE_ID:=cpe:/a:jansson_project:jansson
 
+PKG_BUILD_FLAGS:=lto
+
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/cmake.mk
 
@@ -41,9 +43,6 @@ define Package/jansson/description
   Jansson is a C library for encoding, decoding and manipulating JSON data
 endef
 
-TARGET_CFLAGS += -flto
-TARGET_LDFLAGS += -flto
-
 define Package/jansson/install
 	$(INSTALL_DIR) $(1)/usr/lib
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libjansson*so.* $(1)/usr/lib/
diff --git a/package/libs/libaudit/Makefile b/package/libs/libaudit/Makefile
index d0cca1350a5f7e..0d79c253657cf8 100644
--- a/package/libs/libaudit/Makefile
+++ b/package/libs/libaudit/Makefile
@@ -11,7 +11,7 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_NAME:=audit
 PKG_SOURCE:=$(PKG_SOURCE_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=http://people.redhat.com/sgrubb/audit
+PKG_SOURCE_URL:=https://people.redhat.com/sgrubb/audit
 PKG_HASH:=0e5d4103646e00f8d1981e1cd2faea7a2ae28e854c31a803e907a383c5e2ecb7
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_SOURCE_NAME)-$(PKG_VERSION)
 HOST_BUILD_DIR:=$(BUILD_DIR_HOST)/$(PKG_SOURCE_NAME)-$(PKG_VERSION)
@@ -22,7 +22,7 @@ PKG_CPE_ID:=cpe:/a:linux_audit_project:linux_audit
 
 PKG_FIXUP:=autoreconf
 
-PKG_USE_MIPS16:=0
+PKG_BUILD_FLAGS:=no-mips16
 PKG_INSTALL:=1
 
 include $(INCLUDE_DIR)/package.mk
diff --git a/package/libs/libbpf/Makefile b/package/libs/libbpf/Makefile
new file mode 100644
index 00000000000000..ee7666f734d891
--- /dev/null
+++ b/package/libs/libbpf/Makefile
@@ -0,0 +1,75 @@
+#
+# Copyright (C) 2020-2023 Tony Ambardar <itugrok@yahoo.com>
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=libbpf
+PKG_VERSION:=1.2.0
+PKG_RELEASE:=1
+
+PKG_SOURCE_URL:=https://github.com/libbpf/libbpf
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_VERSION:=fbd60dbff51c870f5e80a17c4f2fd639eb80af90
+PKG_MIRROR_HASH:=80a80dfba71576e017b596fb28068e2a92de629e426f063e4b37314c8d576336
+PKG_ABI_VERSION:=$(firstword $(subst .,$(space),$(PKG_VERSION)))
+
+PKG_MAINTAINER:=Tony Ambardar <itugrok@yahoo.com>
+
+PKG_BUILD_FLAGS:=no-mips16
+PKG_BUILD_PARALLEL:=1
+PKG_INSTALL:=1
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/nls.mk
+
+define Package/libbpf
+  SECTION:=libs
+  CATEGORY:=Libraries
+  TITLE:=libbpf - eBPF helper library
+  LICENSE:=LGPL-2.1 OR BSD-2-Clause
+  ABI_VERSION:=$(PKG_ABI_VERSION)
+  URL:=http://www.kernel.org
+  DEPENDS:=+libelf
+endef
+
+define Package/libbpf/description
+  libbpf is a library for loading eBPF programs and reading and manipulating eBPF objects from user-space.
+endef
+
+MAKE_VARS = \
+	EXTRA_CFLAGS="$(TARGET_CFLAGS) $(TARGET_CPPFLAGS)" \
+	LDFLAGS="$(TARGET_LDFLAGS)"
+
+MAKE_FLAGS += \
+	$(if $(findstring c,$(OPENWRT_VERBOSE)),V=1,V='') \
+	LIBSUBDIR=lib
+
+MAKE_PATH = src
+
+define Build/InstallDev/libbpf
+	$(INSTALL_DIR) $(1)/usr/include/bpf
+	$(CP) $(PKG_INSTALL_DIR)/usr/include/bpf/*.h $(1)/usr/include/bpf/
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libbpf.{a,so*} \
+		$(1)/usr/lib/
+	$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libbpf.pc \
+		$(1)/usr/lib/pkgconfig/
+	$(SED) 's,/usr/include,$$$${prefix}/include,g' \
+		$(1)/usr/lib/pkgconfig/libbpf.pc
+	$(SED) 's,/usr/lib,$$$${exec_prefix}/lib,g' \
+		$(1)/usr/lib/pkgconfig/libbpf.pc
+endef
+
+Build/InstallDev=$(Build/InstallDev/libbpf)
+
+define Package/libbpf/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libbpf.so.* $(1)/usr/lib/
+endef
+
+$(eval $(call BuildPackage,libbpf))
diff --git a/package/libs/libbpf/patches/001-cflags.patch b/package/libs/libbpf/patches/001-cflags.patch
new file mode 100644
index 00000000000000..d6ffc3f907f8ec
--- /dev/null
+++ b/package/libs/libbpf/patches/001-cflags.patch
@@ -0,0 +1,10 @@
+--- a/src/Makefile
++++ b/src/Makefile
+@@ -34,6 +34,7 @@ ALL_CFLAGS := $(INCLUDES)
+ 
+ SHARED_CFLAGS += -fPIC -fvisibility=hidden -DSHARED
+ 
++CFLAGS = $(EXTRA_CFLAGS)
+ CFLAGS ?= -g -O2 -Werror -Wall -std=gnu89
+ ALL_CFLAGS += $(CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 $(EXTRA_CFLAGS)
+ ALL_LDFLAGS += $(LDFLAGS) $(EXTRA_LDFLAGS)
diff --git a/package/libs/libbsd/Makefile b/package/libs/libbsd/Makefile
index 47af01f5550370..1872e3ce30f3b5 100644
--- a/package/libs/libbsd/Makefile
+++ b/package/libs/libbsd/Makefile
@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libbsd
-PKG_VERSION:=0.11.6
-PKG_RELEASE:=1
+PKG_VERSION:=0.11.7
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://libbsd.freedesktop.org/releases
-PKG_HASH:=19b38f3172eaf693e6e1c68714636190c7e48851e45224d720b3b5bc0499b5df
+PKG_HASH:=9baa186059ebbf25c06308e9f991fda31f7183c0f24931826d83aa6abd8a0261
 
 PKG_LICENSE:=BSD-4-Clause
 PKG_LICENSE_FILES:=COPYING
@@ -14,6 +14,7 @@ PKG_LICENSE_FILES:=COPYING
 PKG_INSTALL:=1
 PKG_BUILD_PARALLEL:=1
 PKG_BUILD_DEPENDS := libmd
+PKG_FIXUP:=autoreconf
 
 include $(INCLUDE_DIR)/package.mk
 
@@ -28,6 +29,8 @@ define Package/libbsd/description
  This library provides useful functions commonly found on BSD systems, and lacking on others like GNU systems, thus making it easier to port projects with strong BSD origins, without needing to embed the same code over and over again on each project.
 endef
 
+TARGET_CFLAGS += -D_LARGEFILE64_SOURCE
+
 define Build/InstallDev
 	$(INSTALL_DIR) $(1)/usr/lib
 	$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
diff --git a/package/libs/libbsd/patches/001-fix-libpath.patch b/package/libs/libbsd/patches/001-fix-libpath.patch
new file mode 100644
index 00000000000000..ca2407024960d7
--- /dev/null
+++ b/package/libs/libbsd/patches/001-fix-libpath.patch
@@ -0,0 +1,13 @@
+do not use host path to fix cross compiling
+
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -160,7 +160,7 @@
+ 	(echo '/* GNU ld script'; \
+ 	 echo ' * The MD5 functions are provided by the libmd library. */'; \
+ 	 cat format.ld; \
+-	 echo "GROUP($(runtimelibdir)/$$soname AS_NEEDED($(MD5_LIBS)))"; \
++	 echo "GROUP($$soname AS_NEEDED($(MD5_LIBS)))"; \
+ 	)>$(DESTDIR)$(libdir)/libbsd.so
+ else
+ 	if [ "$(libdir)" != "$(runtimelibdir)" ]; then \
diff --git a/package/libs/libcap/Makefile b/package/libs/libcap/Makefile
index b3ca20fd8a5403..989209302a489b 100644
--- a/package/libs/libcap/Makefile
+++ b/package/libs/libcap/Makefile
@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libcap
-PKG_VERSION:=2.65
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_VERSION:=2.69
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/linux/libs/security/linux-privs/libcap2
-PKG_HASH:=73e350020cc31fe15360879d19384ffa3395a825f065fcf6bda3a5cdf965bebd
+PKG_HASH:=f311f8f3dad84699d0566d1d6f7ec943a9298b28f714cae3c931dfd57492d7eb
 
 PKG_MAINTAINER:=Paul Wassi <p.wassi@gmx.at>
 PKG_LICENSE:=GPL-2.0-only
diff --git a/package/libs/libcap/patches/900-use-more-compatible-shebang.patch b/package/libs/libcap/patches/900-use-more-compatible-shebang.patch
new file mode 100644
index 00000000000000..454c703fbe728a
--- /dev/null
+++ b/package/libs/libcap/patches/900-use-more-compatible-shebang.patch
@@ -0,0 +1,8 @@
+--- a/progs/mkcapshdoc.sh
++++ b/progs/mkcapshdoc.sh
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ # This script generates some C code for inclusion in the capsh binary.
+ # The Makefile generally only generates the .c code and compares it
+ # with the checked in code in the progs directory.
diff --git a/package/libs/libevent2/Makefile b/package/libs/libevent2/Makefile
index 85c159c2a69753..92602607aea253 100644
--- a/package/libs/libevent2/Makefile
+++ b/package/libs/libevent2/Makefile
@@ -26,6 +26,8 @@ PKG_CONFIG_DEPENDS:= \
 	CONFIG_PACKAGE_libevent2-pthreads \
 	CONFIG_PACKAGE_libevent2-mbedtls
 
+PKG_BUILD_FLAGS:=gc-sections lto
+
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/cmake.mk
 
@@ -112,8 +114,8 @@ define Package/libevent2-pthreads/description
 	threading & locking.
 endef
 
-TARGET_CFLAGS += $(FPIC) -ffunction-sections -fdata-sections -flto
-TARGET_LDFLAGS += -Wl,--gc-sections,--as-needed -flto
+TARGET_CFLAGS += $(FPIC)
+TARGET_LDFLAGS += -Wl,--as-needed
 
 CMAKE_OPTIONS += \
 	-DEVENT__DISABLE_BENCHMARK:BOOL=ON \
diff --git a/package/libs/libjson-c/Makefile b/package/libs/libjson-c/Makefile
index 2c312f200eecf7..d925ac750d6f0d 100644
--- a/package/libs/libjson-c/Makefile
+++ b/package/libs/libjson-c/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=json-c
 PKG_VERSION:=0.16
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-nodoc.tar.gz
 PKG_SOURCE_URL:=https://s3.amazonaws.com/json-c_releases/releases/
diff --git a/package/libs/libjson-c/patches/010-fix-build-with-clang-15.patch b/package/libs/libjson-c/patches/010-fix-build-with-clang-15.patch
new file mode 100644
index 00000000000000..d6af772e06b487
--- /dev/null
+++ b/package/libs/libjson-c/patches/010-fix-build-with-clang-15.patch
@@ -0,0 +1,184 @@
+From 6eca65617aacd19f4928acd5766b8dd20eda0b34 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sat, 13 Aug 2022 20:37:03 -0700
+Subject: [PATCH] Fix build with clang-15+
+
+Fixes
+json_util.c:63:35: error: a function declaration without a prototype is deprecated in all versions of C [-We
+rror,-Wstrict-prototypes]
+const char *json_util_get_last_err()
+                                  ^
+                                   void
+
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ json_util.c            | 2 +-
+ tests/test1.c          | 6 +++---
+ tests/test4.c          | 2 +-
+ tests/test_cast.c      | 2 +-
+ tests/test_charcase.c  | 2 +-
+ tests/test_parse.c     | 8 ++++----
+ tests/test_printbuf.c  | 4 ++--
+ tests/test_util_file.c | 6 +++---
+ 8 files changed, 16 insertions(+), 16 deletions(-)
+
+--- a/json_util.c
++++ b/json_util.c
+@@ -60,7 +60,7 @@ static int _json_object_to_fd(int fd, st
+ 
+ static char _last_err[256] = "";
+ 
+-const char *json_util_get_last_err()
++const char *json_util_get_last_err(void)
+ {
+ 	if (_last_err[0] == '\0')
+ 		return NULL;
+--- a/tests/test1.c
++++ b/tests/test1.c
+@@ -58,7 +58,7 @@ static const char *to_json_string(json_o
+ #endif
+ 
+ json_object *make_array(void);
+-json_object *make_array()
++json_object *make_array(void)
+ {
+ 	json_object *my_array;
+ 
+@@ -74,7 +74,7 @@ json_object *make_array()
+ }
+ 
+ void test_array_del_idx(void);
+-void test_array_del_idx()
++void test_array_del_idx(void)
+ {
+ 	int rc;
+ 	size_t ii;
+@@ -140,7 +140,7 @@ void test_array_del_idx()
+ }
+ 
+ void test_array_list_expand_internal(void);
+-void test_array_list_expand_internal()
++void test_array_list_expand_internal(void)
+ {
+ 	int rc;
+ 	size_t ii;
+--- a/tests/test4.c
++++ b/tests/test4.c
+@@ -28,7 +28,7 @@ void print_hex(const char *s)
+ }
+ 
+ static void test_lot_of_adds(void);
+-static void test_lot_of_adds()
++static void test_lot_of_adds(void)
+ {
+ 	int ii;
+ 	char key[50];
+--- a/tests/test_cast.c
++++ b/tests/test_cast.c
+@@ -94,7 +94,7 @@ static void getit(struct json_object *ne
+ 	printf("new_obj.%s json_object_get_double()=%f\n", field, json_object_get_double(o));
+ }
+ 
+-static void checktype_header()
++static void checktype_header(void)
+ {
+ 	printf("json_object_is_type: %s,%s,%s,%s,%s,%s,%s\n", json_type_to_name(json_type_null),
+ 	       json_type_to_name(json_type_boolean), json_type_to_name(json_type_double),
+--- a/tests/test_charcase.c
++++ b/tests/test_charcase.c
+@@ -19,7 +19,7 @@ int main(int argc, char **argv)
+ }
+ 
+ /* make sure only lowercase forms are parsed in strict mode */
+-static void test_case_parse()
++static void test_case_parse(void)
+ {
+ 	struct json_tokener *tok;
+ 	json_object *new_obj;
+--- a/tests/test_parse.c
++++ b/tests/test_parse.c
+@@ -92,7 +92,7 @@ static void single_basic_parse(const cha
+ 	if (getenv("TEST_PARSE_CHUNKSIZE") != NULL)
+ 		single_incremental_parse(test_string, clear_serializer);
+ }
+-static void test_basic_parse()
++static void test_basic_parse(void)
+ {
+ 	single_basic_parse("\"\003\"", 0);
+ 	single_basic_parse("/* hello */\"foo\"", 0);
+@@ -195,7 +195,7 @@ static void test_basic_parse()
+ 	single_basic_parse("[18446744073709551616]", 1);
+ }
+ 
+-static void test_utf8_parse()
++static void test_utf8_parse(void)
+ {
+ 	// json_tokener_parse doesn't support checking for byte order marks.
+ 	// It's the responsibility of the caller to detect and skip a BOM.
+@@ -222,7 +222,7 @@ static int clear_serializer(json_object
+ 	return JSON_C_VISIT_RETURN_CONTINUE;
+ }
+ 
+-static void test_verbose_parse()
++static void test_verbose_parse(void)
+ {
+ 	json_object *new_obj;
+ 	enum json_tokener_error error = json_tokener_success;
+@@ -562,7 +562,7 @@ struct incremental_step
+     {NULL, -1, -1, json_tokener_success, 0},
+ };
+ 
+-static void test_incremental_parse()
++static void test_incremental_parse(void)
+ {
+ 	json_object *new_obj;
+ 	enum json_tokener_error jerr;
+--- a/tests/test_printbuf.c
++++ b/tests/test_printbuf.c
+@@ -16,7 +16,7 @@ static void test_printbuf_memset_length(
+ #define __func__ __FUNCTION__
+ #endif
+ 
+-static void test_basic_printbuf_memset()
++static void test_basic_printbuf_memset(void)
+ {
+ 	struct printbuf *pb;
+ 
+@@ -29,7 +29,7 @@ static void test_basic_printbuf_memset()
+ 	printf("%s: end test\n", __func__);
+ }
+ 
+-static void test_printbuf_memset_length()
++static void test_printbuf_memset_length(void)
+ {
+ 	struct printbuf *pb;
+ 
+--- a/tests/test_util_file.c
++++ b/tests/test_util_file.c
+@@ -35,7 +35,7 @@ static void test_read_fd_equal(const cha
+ #define PATH_MAX 256
+ #endif
+ 
+-static void test_write_to_file()
++static void test_write_to_file(void)
+ {
+ 	json_object *jso;
+ 
+@@ -231,7 +231,7 @@ static void test_read_valid_nested_with_
+ 	close(d);
+ }
+ 
+-static void test_read_nonexistant()
++static void test_read_nonexistant(void)
+ {
+ 	const char *filename = "./not_present.json";
+ 
+@@ -249,7 +249,7 @@ static void test_read_nonexistant()
+ 	}
+ }
+ 
+-static void test_read_closed()
++static void test_read_closed(void)
+ {
+ 	// Test reading from a closed fd
+ 	int d = open("/dev/null", O_RDONLY, 0);
diff --git a/package/libs/libnftnl/Makefile b/package/libs/libnftnl/Makefile
index 3bb4c57cfcde89..05437d020b96bb 100644
--- a/package/libs/libnftnl/Makefile
+++ b/package/libs/libnftnl/Makefile
@@ -8,12 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libnftnl
-PKG_VERSION:=1.2.3
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_CPE_ID:=cpe:/a:netfilter:libnftnl
+PKG_VERSION:=1.2.5
+PKG_RELEASE:=2
 
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://netfilter.org/projects/$(PKG_NAME)/files
-PKG_HASH:=e916ea9b79f9518560b9a187251a7c042442a9ecbce7f36be7908888605d0255
+PKG_HASH:=966de0a8120c8a53db859889749368bfb2cba0c4f0b4c1a30d264eccc45f1226
 
 PKG_MAINTAINER:=Steven Barth <steven@midlink.org>
 PKG_LICENSE:=GPL-2.0-or-later
@@ -21,6 +22,7 @@ PKG_LICENSE_FILES:=COPYING
 
 PKG_INSTALL:=1
 PKG_BUILD_PARALLEL:=1
+PKG_BUILD_FLAGS:=lto
 
 include $(INCLUDE_DIR)/package.mk
 
@@ -40,8 +42,7 @@ define Package/libnftnl/description
  programming interface (API) to the in-kernel nf_tables subsystem.
 endef
 
-TARGET_CFLAGS += $(FPIC) -flto
-TARGET_LDFLAGS += -flto
+TARGET_CFLAGS += $(FPIC)
 
 CONFIGURE_ARGS += \
 	--enable-static \
diff --git a/package/libs/libnl-tiny/Makefile b/package/libs/libnl-tiny/Makefile
index 48df6a4c8c69b3..7239c286fdd510 100644
--- a/package/libs/libnl-tiny/Makefile
+++ b/package/libs/libnl-tiny/Makefile
@@ -12,9 +12,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/libnl-tiny.git
-PKG_SOURCE_DATE:=2022-05-17
-PKG_SOURCE_VERSION:=b5b2ba09c4f1c8b3c21580aea7223edc2f5e92be
-PKG_MIRROR_HASH:=b957d56aa8c2e7b55184111be69eb8dea734f1feba19e670a91f302459a48a78
+PKG_SOURCE_DATE:=2023-04-02
+PKG_SOURCE_VERSION:=11b7c5f0745af2637b48131287f28689bb80ed3e
+PKG_MIRROR_HASH:=9bcae026ad1fde81865ea113d24bbc70c2bd1945655d51cd00181c41b70570d2
 CMAKE_INSTALL:=1
 
 PKG_LICENSE:=LGPL-2.1
diff --git a/package/libs/libnl/Makefile b/package/libs/libnl/Makefile
index 71b043a9e56507..56549dcc0a24a2 100644
--- a/package/libs/libnl/Makefile
+++ b/package/libs/libnl/Makefile
@@ -20,6 +20,8 @@ PKG_CPE_ID:=cpe:/a:libnl_project:libnl
 PKG_INSTALL:=1
 PKG_FIXUP:=autoreconf
 
+PKG_BUILD_FLAGS:=gc-sections
+
 include $(INCLUDE_DIR)/package.mk
 
 define Package/libnl/default
@@ -80,7 +82,7 @@ define Package/libnl/description
  message construction and parsing, object caching system, etc.
 endef
 
-TARGET_CFLAGS += -ffunction-sections -fdata-sections $(FPIC)
+TARGET_CFLAGS += $(FPIC)
 
 CONFIGURE_ARGS += \
 	--disable-debug
diff --git a/package/libs/libpcap/Makefile b/package/libs/libpcap/Makefile
index d5d94369948565..107c00aa03165d 100644
--- a/package/libs/libpcap/Makefile
+++ b/package/libs/libpcap/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libpcap
-PKG_VERSION:=1.10.1
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_VERSION:=1.10.4
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=http://www.tcpdump.org/release/
-PKG_HASH:=ed285f4accaf05344f90975757b3dbfe772ba41d1c401c2648b7fa45b711bdd4
+PKG_SOURCE_URL:=https://www.tcpdump.org/release/
+PKG_HASH:=ed19a0383fad72e3ad435fd239d7cd80d64916b87269550159d20e47160ebe5f
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=BSD-3-Clause
diff --git a/package/libs/libpcap/patches/100-no-openssl.patch b/package/libs/libpcap/patches/100-no-openssl.patch
index 56896ad8ba1fa1..434f1ce006ada9 100644
--- a/package/libs/libpcap/patches/100-no-openssl.patch
+++ b/package/libs/libpcap/patches/100-no-openssl.patch
@@ -1,6 +1,6 @@
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -1042,7 +1042,6 @@ endif()
+@@ -1325,7 +1325,6 @@ endif()
  #
  # OpenSSL/libressl.
  #
diff --git a/package/libs/libpcap/patches/102-skip-manpages.patch b/package/libs/libpcap/patches/102-skip-manpages.patch
index 79a365643e24b7..43d393ac5f67b6 100644
--- a/package/libs/libpcap/patches/102-skip-manpages.patch
+++ b/package/libs/libpcap/patches/102-skip-manpages.patch
@@ -9,7 +9,7 @@ Subject: [PATCH] skip manpages
 
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -2732,57 +2732,6 @@ if(NOT MSVC)
+@@ -3325,57 +3325,6 @@ if(NOT MSVC)
      if(MINGW)
          find_program(LINK_EXECUTABLE ln)
      endif(MINGW)
diff --git a/package/libs/libpcap/patches/300-Add-support-for-B.A.T.M.A.N.-Advanced.patch b/package/libs/libpcap/patches/300-Add-support-for-B.A.T.M.A.N.-Advanced.patch
new file mode 100644
index 00000000000000..b3ff25286d75b6
--- /dev/null
+++ b/package/libs/libpcap/patches/300-Add-support-for-B.A.T.M.A.N.-Advanced.patch
@@ -0,0 +1,642 @@
+From 3d8d268320d2381021a409ff8d03533698dd6242 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
+Date: Mon, 23 Nov 2020 00:38:22 +0100
+Subject: [PATCH] Add support for B.A.T.M.A.N. Advanced
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This adds support for the layer 2 mesh routing protocol
+B.A.T.M.A.N. Advanced. "batadv" can be used to filter on batman-adv
+packets. It also allows later filters to look at frames inside the
+tunnel when both "version" and "type" are specified.
+
+Documentation for the batman-adv protocol can be found at the following
+locations:
+
+https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/networking/batman-adv.rst
+https://www.open-mesh.org/
+
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+---
+ Makefile.in            |   2 +
+ batadv_legacy_packet.h |  77 +++++++++++++++++++
+ batadv_packet.h        |  78 ++++++++++++++++++++
+ ethertype.h            |   3 +
+ gencode.c              | 164 +++++++++++++++++++++++++++++++++++++++++
+ gencode.h              |   3 +
+ grammar.y.in           |  32 +++++++-
+ nametoaddr.c           |  59 +++++++++++++++
+ pcap-filter.manmisc.in |  35 ++++++++-
+ pcap/namedb.h          |   2 +
+ scanner.l              |   1 +
+ 11 files changed, 453 insertions(+), 3 deletions(-)
+ create mode 100644 batadv_legacy_packet.h
+ create mode 100644 batadv_packet.h
+
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -133,6 +133,8 @@ PUBHDR = \
+ HDR = $(PUBHDR) \
+ 	arcnet.h \
+ 	atmuni31.h \
++	batadv_legacy_packet.h \
++	batadv_packet.h \
+ 	diag-control.h \
+ 	ethertype.h \
+ 	extract.h \
+--- /dev/null
++++ b/batadv_legacy_packet.h
+@@ -0,0 +1,77 @@
++/* SPDX-License-Identifier: BSD-3 */
++/* Copyright (C) 2020  Linus Lüssing */
++
++#ifndef _BATADV_LEGACY_PACKET_H_
++#define _BATADV_LEGACY_PACKET_H_
++
++enum batadv_legacy_packettype {
++	BATADV_LEGACY_IV_OGM		= 0x01,
++	BATADV_LEGACY_ICMP		= 0x02,
++	BATADV_LEGACY_UNICAST		= 0x03,
++	BATADV_LEGACY_BCAST		= 0x04,
++	BATADV_LEGACY_VIS		= 0x05,
++	BATADV_LEGACY_UNICAST_FRAG	= 0x06,
++	BATADV_LEGACY_TT_QUERY		= 0x07,
++	BATADV_LEGACY_ROAM_ADV		= 0x08,
++	BATADV_LEGACY_UNICAST_4ADDR	= 0x09,
++	BATADV_LEGACY_CODED		= 0x0a,
++};
++
++#define ETH_ALEN	6
++
++struct batadv_legacy_unicast_packet {
++	uint8_t packet_type;
++	uint8_t version;
++	uint8_t ttl;
++	uint8_t ttvn;
++	uint8_t dest[ETH_ALEN];
++};
++
++struct batadv_legacy_unicast_4addr_packet {
++	uint8_t packet_type;
++	uint8_t version;
++	uint8_t ttl;
++	uint8_t src[ETH_ALEN];
++	uint8_t subtype;
++	uint8_t reserved;
++};
++
++struct batadv_legacy_unicast_frag_packet {
++	uint8_t packet_type;
++	uint8_t version;
++	uint8_t ttl;
++	uint8_t ttvn;
++	uint8_t dest[ETH_ALEN];
++	uint8_t flags;
++	uint8_t align;
++	uint8_t orig[ETH_ALEN];
++	uint8_t seqno[2];		/* 2-byte integral value */
++};
++
++struct batadv_legacy_bcast_packet {
++	uint8_t packet_type;
++	uint8_t version;
++	uint8_t ttl;
++	uint8_t reserved;
++	uint8_t seqno[4];		/* 4-byte integral value */
++	uint8_t orig[ETH_ALEN];
++};
++
++struct batadv_legacy_coded_packet {
++	uint8_t packet_type;
++	uint8_t version;
++	uint8_t ttl;
++	uint8_t first_ttvn;
++	uint8_t first_source[ETH_ALEN];
++	uint8_t first_orig_dest[ETH_ALEN];
++	uint8_t first_crc[4];		/* 4-byte integral value */
++	uint8_t second_ttl;
++	uint8_t second_ttvn;
++	uint8_t second_dest[ETH_ALEN];
++	uint8_t second_source[ETH_ALEN];
++	uint8_t second_orig_dest[ETH_ALEN];
++	uint8_t second_crc[4];		/* 4-byte integral value */
++	uint8_t coded_len[2];		/* 2-byte integral value */
++};
++
++#endif /* _BATADV_LEGACY_PACKET_H_ */
+--- /dev/null
++++ b/batadv_packet.h
+@@ -0,0 +1,78 @@
++/* SPDX-License-Identifier: BSD-3 */
++/* Copyright (C) 2020  Linus Lüssing */
++
++#ifndef _BATADV_PACKET_H_
++#define _BATADV_PACKET_H_
++
++/* For the definitive and most recent packet format definition,
++ * see the batadv_packet.h in the Linux kernel.
++ */
++
++enum batadv_packettype {
++	BATADV_IV_OGM           = 0x00,
++	BATADV_BCAST            = 0x01,
++	BATADV_CODED            = 0x02,
++	BATADV_ELP		= 0x03,
++	BATADV_OGM2		= 0x04,
++	BATADV_UNICAST          = 0x40,
++	BATADV_UNICAST_FRAG     = 0x41,
++	BATADV_UNICAST_4ADDR    = 0x42,
++	BATADV_ICMP             = 0x43,
++	BATADV_UNICAST_TVLV     = 0x44,
++};
++
++#define ETH_ALEN	6
++
++struct batadv_unicast_packet {
++	uint8_t packet_type;
++	uint8_t version;
++	uint8_t ttl;
++	uint8_t ttvn;
++	uint8_t dest[ETH_ALEN];
++};
++
++struct batadv_unicast_4addr_packet {
++	struct batadv_unicast_packet u;
++	uint8_t src[ETH_ALEN];
++	uint8_t subtype;
++	uint8_t reserved;
++};
++
++struct batadv_frag_packet {
++	uint8_t packet_type;
++	uint8_t version;
++	uint8_t ttl;
++	uint8_t num_pri;	/* number and priority */
++	uint8_t dest[ETH_ALEN];
++	uint8_t orig[ETH_ALEN];
++	uint8_t seqno[2];	/* 2-byte integral value */
++	uint8_t total_size[2];	/* 2-byte integral value */
++};
++
++struct batadv_bcast_packet {
++	uint8_t packet_type;
++	uint8_t version;
++	uint8_t ttl;
++	uint8_t reserved;
++	uint8_t seqno[4];	/* 4-byte integral value */
++	uint8_t orig[ETH_ALEN];
++};
++
++struct batadv_coded_packet {
++	uint8_t packet_type;
++	uint8_t version;
++	uint8_t ttl;
++	uint8_t first_ttvn;
++	uint8_t first_source[ETH_ALEN];
++	uint8_t first_orig_dest[ETH_ALEN];
++	uint8_t first_crc[4];	/* 4-byte integral value */
++	uint8_t second_ttl;
++	uint8_t second_ttvn;
++	uint8_t second_dest[ETH_ALEN];
++	uint8_t second_source[ETH_ALEN];
++	uint8_t second_orig_dest[ETH_ALEN];
++	uint8_t second_crc[4];	/* 4-byte integral value */
++	uint8_t coded_len[2];	/* 2-byte integral value */
++};
++
++#endif /* _BATADV_PACKET_H_ */
+--- a/ethertype.h
++++ b/ethertype.h
+@@ -49,6 +49,9 @@
+ #ifndef ETHERTYPE_TRAIL
+ #define ETHERTYPE_TRAIL		0x1000
+ #endif
++#ifndef ETHERTYPE_BATMAN
++#define ETHERTYPE_BATMAN	0x4305 /* B.A.T.M.A.N. Advanced */
++#endif
+ #ifndef	ETHERTYPE_MOPDL
+ #define ETHERTYPE_MOPDL		0x6001
+ #endif
+--- a/gencode.c
++++ b/gencode.c
+@@ -60,6 +60,8 @@
+ #include "sunatmpos.h"
+ #include "pflog.h"
+ #include "ppp.h"
++#include "batadv_packet.h"
++#include "batadv_legacy_packet.h"
+ #include "pcap/sll.h"
+ #include "pcap/ipnet.h"
+ #include "arcnet.h"
+@@ -9436,6 +9438,168 @@ gen_geneve(compiler_state_t *cstate, bpf
+ 	return b1;
+ }
+ 
++static struct block *
++gen_batadv_check_version(compiler_state_t *cstate, struct block *b0, bpf_u_int32 version)
++{
++	struct block *b1;
++
++	if (version > UINT8_MAX)
++		bpf_error(cstate,
++			  "batman-adv compatibility version number %u unsupported",
++			  version);
++
++	b1 = gen_cmp(cstate, OR_LINKPL, 1, BPF_B, version);
++	gen_and(b0, b1);
++
++	return b1;
++}
++
++static struct block *
++gen_batadv_check_type(compiler_state_t *cstate, struct block *b0,
++		      bpf_u_int32 version, bpf_u_int32 type)
++{
++	struct block *b1;
++
++	switch (version) {
++	case 14:
++	case 15:
++		if (type > UINT8_MAX)
++			bpf_error(cstate,
++				  "batman-adv packet type %u unsupported for compatibility version %u",
++				  type, version);
++
++		b1 = gen_cmp(cstate, OR_LINKPL, 0, BPF_B, type);
++		gen_and(b0, b1);
++		b0 = b1;
++
++		break;
++	default:
++		bpf_error(cstate,
++			  "batman-adv compatibility version number %u unsupported",
++			  version);
++	}
++
++	return b0;
++}
++
++
++static void gen_batadv_push_offset(compiler_state_t *cstate, u_int offset)
++{
++	PUSH_LINKHDR(cstate, DLT_EN10MB, cstate->off_linkpl.is_variable,
++		     cstate->off_linkpl.constant_part + cstate->off_nl + offset,
++		     cstate->off_linkpl.reg);
++
++	cstate->off_linktype.constant_part += cstate->off_linkhdr.constant_part;
++	cstate->off_linkpl.constant_part += cstate->off_linkhdr.constant_part;
++
++	cstate->off_nl = 0;
++	cstate->off_nl_nosnap = 0;	/* no 802.2 LLC */
++}
++
++static void
++gen_batadv_offsets_v14(compiler_state_t *cstate, bpf_u_int32 type)
++{
++	size_t offset;
++
++	switch (type) {
++	case BATADV_LEGACY_UNICAST:		/* 0x03 */
++		offset = sizeof(struct batadv_legacy_unicast_packet);
++		break;
++	case BATADV_LEGACY_BCAST:		/* 0x04 */
++		offset = sizeof(struct batadv_legacy_bcast_packet);
++		break;
++	case BATADV_LEGACY_UNICAST_FRAG:	/* 0x06 */
++		offset = sizeof(struct batadv_legacy_unicast_frag_packet);
++		break;
++	case BATADV_LEGACY_UNICAST_4ADDR:	/* 0x09 */
++		offset = sizeof(struct batadv_legacy_unicast_4addr_packet);
++		break;
++	case BATADV_LEGACY_CODED:		/* 0x0a */
++		offset = sizeof(struct batadv_legacy_coded_packet);
++		break;
++	default:
++		offset = 0;
++	}
++
++	if (offset)
++		gen_batadv_push_offset(cstate, (u_int)offset);
++}
++
++static void
++gen_batadv_offsets_v15(compiler_state_t *cstate, bpf_u_int32 type)
++{
++	size_t offset;
++
++	switch (type) {
++	case BATADV_BCAST:		/* 0x01 */
++		offset = sizeof(struct batadv_bcast_packet);
++		break;
++	case BATADV_CODED:		/* 0x02 */
++		offset = sizeof(struct batadv_coded_packet);
++		break;
++	case BATADV_UNICAST:		/* 0x40 */
++		offset = sizeof(struct batadv_unicast_packet);
++		break;
++	case BATADV_UNICAST_FRAG:	/* 0x41 */
++		offset = sizeof(struct batadv_frag_packet);
++		break;
++	case BATADV_UNICAST_4ADDR:	/* 0x42 */
++		offset = sizeof(struct batadv_unicast_4addr_packet);
++		break;
++	case BATADV_UNICAST_TVLV:
++		/* unsupported for now, needs variable offset to
++		 * take tvlv_len into account
++		 */
++		/* fall through */
++	default:
++		offset = 0;
++	}
++
++	if (offset)
++		gen_batadv_push_offset(cstate, (u_int)offset);
++}
++
++static void
++gen_batadv_offsets(compiler_state_t *cstate, bpf_u_int32 version, bpf_u_int32 type)
++{
++	switch (version) {
++	case 14:
++		gen_batadv_offsets_v14(cstate, type);
++		break;
++	case 15:
++		gen_batadv_offsets_v15(cstate, type);
++		break;
++	default:
++		break;
++	}
++}
++
++struct block *
++gen_batadv(compiler_state_t *cstate, bpf_u_int32 version, int has_version,
++	   bpf_u_int32 type, int has_type)
++{
++	struct block *b0;
++
++	/*
++	 * Catch errors reported by us and routines below us, and return NULL
++	 * on an error.
++	 */
++	if (setjmp(cstate->top_ctx))
++		return (NULL);
++
++	b0 = gen_linktype(cstate, ETHERTYPE_BATMAN);
++
++	if (has_version)
++		b0 = gen_batadv_check_version(cstate, b0, version);
++
++	if (has_type) {
++		b0 = gen_batadv_check_type(cstate, b0, version, type);
++		gen_batadv_offsets(cstate, version, type);
++	}
++
++	return b0;
++}
++
+ /* Check that the encapsulated frame has a link layer header
+  * for Ethernet filters. */
+ static struct block *
+--- a/gencode.h
++++ b/gencode.h
+@@ -358,6 +358,9 @@ struct block *gen_pppoes(compiler_state_
+ 
+ struct block *gen_geneve(compiler_state_t *, bpf_u_int32, int);
+ 
++struct block *gen_batadv(compiler_state_t *, bpf_u_int32, int,
++			 bpf_u_int32, int);
++
+ struct block *gen_atmfield_code(compiler_state_t *, int, bpf_u_int32,
+     int, int);
+ struct block *gen_atmtype_abbrev(compiler_state_t *, int);
+--- a/grammar.y.in
++++ b/grammar.y.in
+@@ -375,6 +375,7 @@ DIAG_OFF_BISON_BYACC
+ %type	<i>	mtp2type
+ %type	<blk>	mtp3field
+ %type	<blk>	mtp3fieldvalue mtp3value mtp3listvalue
++%type	<rblk>	pbatadv
+ 
+ 
+ %token  DST SRC HOST GATEWAY
+@@ -393,7 +394,7 @@ DIAG_OFF_BISON_BYACC
+ %token  LEN
+ %token  IPV6 ICMPV6 AH ESP
+ %token	VLAN MPLS
+-%token	PPPOED PPPOES GENEVE
++%token	PPPOED PPPOES GENEVE BATADV
+ %token  ISO ESIS CLNP ISIS L1 L2 IIH LSP SNP CSNP PSNP
+ %token  STP
+ %token  IPX
+@@ -620,11 +621,40 @@ other:	  pqual TK_BROADCAST	{ CHECK_PTR_
+ 	| PPPOES		{ CHECK_PTR_VAL(($$ = gen_pppoes(cstate, 0, 0))); }
+ 	| GENEVE pnum		{ CHECK_PTR_VAL(($$ = gen_geneve(cstate, $2, 1))); }
+ 	| GENEVE		{ CHECK_PTR_VAL(($$ = gen_geneve(cstate, 0, 0))); }
++	| BATADV pbatadv	{ $$ = $2; }
+ 	| pfvar			{ $$ = $1; }
+ 	| pqual p80211		{ $$ = $2; }
+ 	| pllc			{ $$ = $1; }
+ 	;
+ 
++pbatadv:		{ CHECK_PTR_VAL(($$ = gen_batadv(cstate, 0, 0, 0, 0))); }
++	| pnum		{ CHECK_PTR_VAL(($$ = gen_batadv(cstate, $1, 1, 0, 0))); }
++	| pnum pnum	{ CHECK_PTR_VAL(($$ = gen_batadv(cstate, $1, 1, $2, 1))); }
++	| pnum ID
++		{
++			int type;
++
++			switch ($1) {
++			case 14:
++				type = pcap_nametobatadvtype_v14($2);
++				break;
++			case 15:
++				type = pcap_nametobatadvtype_v15($2);
++				break;
++			default:
++				bpf_set_error(cstate, "batman-adv compatibility version number %u unsupported", $1);
++				YYABORT;
++			}
++
++			if (type == PROTO_UNDEF) {
++				bpf_set_error(cstate, "invalid batman-adv packet type value \"%s\"", $2);
++				YYABORT;
++			}
++
++			CHECK_PTR_VAL(($$ = gen_batadv(cstate, $1, 1, type, 1)));
++		}
++	;
++
+ pfvar:	  PF_IFNAME ID		{ CHECK_PTR_VAL($2); CHECK_PTR_VAL(($$ = gen_pf_ifname(cstate, $2))); }
+ 	| PF_RSET ID		{ CHECK_PTR_VAL($2); CHECK_PTR_VAL(($$ = gen_pf_ruleset(cstate, $2))); }
+ 	| PF_RNR NUM		{ CHECK_PTR_VAL(($$ = gen_pf_rnr(cstate, $2))); }
+--- a/nametoaddr.c
++++ b/nametoaddr.c
+@@ -136,8 +136,12 @@
+ 
+ #include "diag-control.h"
+ 
++#include "batadv_packet.h"
++#include "batadv_legacy_packet.h"
++
+ #include "gencode.h"
+ #include <pcap/namedb.h>
++
+ #include "nametoaddr.h"
+ 
+ #ifdef HAVE_OS_PROTO_H
+@@ -604,6 +608,7 @@ PCAP_API_DEF struct eproto eproto_db[] =
+ 	{ "moprc", ETHERTYPE_MOPRC },
+ 	{ "rarp", ETHERTYPE_REVARP },
+ 	{ "sca", ETHERTYPE_SCA },
++	{ "batadv", ETHERTYPE_BATMAN },
+ 	{ (char *)0, 0 }
+ };
+ 
+@@ -638,6 +643,60 @@ pcap_nametollc(const char *s)
+ 
+ 	while (p->s != 0) {
+ 		if (strcmp(p->s, s) == 0)
++			return p->p;
++		p += 1;
++	}
++	return PROTO_UNDEF;
++}
++
++/* Static data base of batman-adv v14 packet type values. */
++static struct eproto batadv_type_db_v14[] = {
++	{ "iv_ogm",		BATADV_LEGACY_IV_OGM },
++	{ "icmp",		BATADV_LEGACY_ICMP },
++	{ "unicast",		BATADV_LEGACY_UNICAST },
++	{ "bcast",		BATADV_LEGACY_BCAST },
++	{ "vis",		BATADV_LEGACY_VIS },
++	{ "unicast_frag",	BATADV_LEGACY_UNICAST_FRAG },
++	{ "tt_query",		BATADV_LEGACY_TT_QUERY },
++	{ "roam_adv",		BATADV_LEGACY_ROAM_ADV },
++	{ "unicast_4addr",	BATADV_LEGACY_UNICAST_4ADDR },
++	{ "coded",		BATADV_LEGACY_CODED },
++	{ (char *)0, 0 }
++};
++
++int pcap_nametobatadvtype_v14(const char *s)
++{
++	struct eproto *p = batadv_type_db_v14;
++
++	while (p->s != 0) {
++		if (strcmp(p->s, s) == 0)
++			return p->p;
++		p += 1;
++	}
++	return PROTO_UNDEF;
++}
++
++/* Static data base of batman-adv v15 packet type values. */
++static struct eproto batadv_type_db_v15[] = {
++	{ "iv_ogm",		BATADV_IV_OGM },
++	{ "bcast",		BATADV_BCAST },
++	{ "coded",		BATADV_CODED },
++	{ "elp",		BATADV_ELP },
++	{ "ogm2",		BATADV_OGM2 },
++	{ "unicast",		BATADV_UNICAST },
++	{ "unicast_frag",	BATADV_UNICAST_FRAG },
++	{ "unicast_4addr",	BATADV_UNICAST_4ADDR },
++	{ "icmp",		BATADV_ICMP },
++	{ "unicast_tvlv",	BATADV_UNICAST_TVLV },
++	{ (char *)0, 0 }
++};
++
++int pcap_nametobatadvtype_v15(const char *s)
++{
++	struct eproto *p = batadv_type_db_v15;
++
++	while (p->s != 0) {
++		if (strcmp(p->s, s) == 0)
+ 			return p->p;
+ 		p += 1;
+ 	}
+--- a/pcap-filter.manmisc.in
++++ b/pcap-filter.manmisc.in
+@@ -98,6 +98,7 @@ protocols are:
+ .BR arp ,
+ .BR rarp ,
+ .BR decnet ,
++.BR batadv ,
+ .BR sctp ,
+ .B tcp
+ and
+@@ -400,7 +401,7 @@ True if the packet is an IPv6 multicast
+ .IP  "\fBether proto \fIprotocol\fR"
+ True if the packet is of ether type \fIprotocol\fR.
+ \fIProtocol\fP can be a number or one of the names
+-\fBaarp\fP, \fBarp\fP, \fBatalk\fP, \fBdecnet\fP, \fBip\fP, \fBip6\fP,
++\fBaarp\fP, \fBarp\fP, \fBatalk\fP, \fBbatadv\fP, \fBdecnet\fP, \fBip\fP, \fBip6\fP,
+ \fBipx\fP, \fBiso\fP, \fBlat\fP, \fBloopback\fP, \fBmopdl\fP, \fBmoprc\fP, \fBnetbeui\fP,
+ \fBrarp\fP, \fBsca\fP or \fBstp\fP.
+ Note these identifiers (except \fBloopback\fP) are also keywords
+@@ -454,7 +455,7 @@ the filter checks for the IPX etype in a
+ DSAP in the LLC header, the 802.3-with-no-LLC-header encapsulation of
+ IPX, and the IPX etype in a SNAP frame.
+ .RE
+-.IP "\fBip\fR, \fBip6\fR, \fBarp\fR, \fBrarp\fR, \fBatalk\fR, \fBaarp\fR, \fBdecnet\fR, \fBiso\fR, \fBstp\fR, \fBipx\fR, \fBnetbeui\fP"
++.IP "\fBip\fR, \fBip6\fR, \fBarp\fR, \fBrarp\fR, \fBatalk\fR, \fBaarp\fR, \fBdecnet\fR, \fBiso\fR, \fBstp\fR, \fBipx\fR, \fBnetbeui\fP, \fBbatadv\fP"
+ Abbreviations for:
+ .in +.5i
+ .nf
+@@ -792,6 +793,36 @@ For example:
+ filters IPv4 protocol encapsulated in Geneve with VNI 0xb. This will
+ match both IPv4 directly encapsulated in Geneve as well as IPv4 contained
+ inside an Ethernet frame.
++.IP "\fBbatadv \fI[version] \fI[type]\fR"
++True if the packet is a B.A.T.M.A.N. Advanced packet (Ethernet type 0x4305).
++If the optional \fIversion\fR is specified, only true if the packet has the
++specified batman-adv compatibility \fIversion\fR. If the optional \fIversion\fR
++and \fItype\fR are specified, only true if the packet has both the specified
++batman-adv compatibility \fIversion\fR and batman-adv packet \fItype\fR.
++.IP
++\fIversion\fR may be a number from 0 to 255, though only compatibility version
++14 and 15 were actually deployed in the wild. Version 15 is the current version,
++14 is considered deprecated.
++.IP
++\fItype\fR is currently only defined for compatibility \fIversion\fR 14 and 15.
++\fItype\fR may be a number from 0 to 255 for compatibility \fIversion\fR 14 and 15.
++.IP
++The following packet \fItype\fR aliases are available for compat \fIversion\fR 14:
++\fBiv_ogm\fP, \fBicmp\fP, \fBunicast\fP, \fBbcast\fP, \fBvis\fP, \fBunicast-frag\fP,
++\fBtt_query\fP, \fBroam_adv\fP, \fBunicast_4addr\fP, \fPcoded\fP.
++.IP
++The following packet \fItype\fR aliases are available for compat \fIversion\fR 15:
++\fBiv_ogm\fP, \fBbcast\fP, \fBcoded\fP, \fBelp\fP, \fBogm2\fP, \fBunicast\fP,
++\fBunicast_frag\fP, \fBunicast_4addr\fP, \fBicmp\fP, \fPunicast_tvlv\fP.
++.IP
++Note that when the \fBbatadv\fR keyword is encountered in an expression and
++a batman-adv packet \fItype\fR is provided which specifies an encapsulating
++packet type then it changes the decoding offsets for the remainder of the
++expression on the assumption that the packet is a batman-adv packet. For compat
++\fIversion\fR 14 these are packet \fItype\fRs \fBunicast\fP, \fBbcast\fP,
++\fBunicast_frag\fP, \fBunicast_4addr\fP and \fBcoded\fP. For compat \fIversion\fR
++15 these are currently packet \fItype\fRs \fBbcast\fP, \fBcoded\fP, \fBunicast\fP,
++\fBunicast_frag\fP and \fBunicast_4addr\fP.
+ .IP "\fBiso proto \fIprotocol\fR"
+ True if the packet is an OSI packet of protocol type \fIprotocol\fP.
+ \fIProtocol\fP can be a number or one of the names
+--- a/pcap/namedb.h
++++ b/pcap/namedb.h
+@@ -70,6 +70,8 @@ PCAP_API int	pcap_nametoportrange(const
+ PCAP_API int	pcap_nametoproto(const char *);
+ PCAP_API int	pcap_nametoeproto(const char *);
+ PCAP_API int	pcap_nametollc(const char *);
++PCAP_API int	pcap_nametobatadvtype_v14(const char *);
++PCAP_API int	pcap_nametobatadvtype_v15(const char *);
+ /*
+  * If a protocol is unknown, PROTO_UNDEF is returned.
+  * Also, pcap_nametoport() returns the protocol along with the port number.
+--- a/scanner.l
++++ b/scanner.l
+@@ -347,6 +347,7 @@ mpls		return MPLS;
+ pppoed		return PPPOED;
+ pppoes		return PPPOES;
+ geneve		return GENEVE;
++batadv		return BATADV;
+ 
+ lane		return LANE;
+ llc		return LLC;
diff --git a/package/libs/libselinux/Makefile b/package/libs/libselinux/Makefile
index 7246d855668dd8..816e09f30ce877 100644
--- a/package/libs/libselinux/Makefile
+++ b/package/libs/libselinux/Makefile
@@ -6,20 +6,19 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libselinux
-PKG_VERSION:=3.3
-PKG_RELEASE:=2
+PKG_VERSION:=3.5
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/$(PKG_VERSION)
-PKG_HASH:=acfdee27633d2496508c28727c3d41d3748076f66d42fccde2e6b9f3463a7057
-HOST_BUILD_DEPENDS:=libsepol/host pcre/host
+PKG_HASH:=9a3a3705ac13a2ccca2de6d652b6356fead10f36fb33115c185c5ccdf29eec19
 
 PKG_LICENSE:=libselinux-1.0
 PKG_LICENSE_FILES:=LICENSE
 PKG_MAINTAINER:=Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 PKG_CPE_ID:=cpe:/a:selinuxproject:libselinux
 
-HOST_BUILD_DEPENDS:=libsepol/host musl-fts/host pcre/host
+HOST_BUILD_DEPENDS:=libsepol/host musl-fts/host pcre2/host
 
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/host-build.mk
@@ -72,7 +71,7 @@ define Package/libselinux
   $(call Package/libselinux/Default)
   SECTION:=libs
   CATEGORY:=Libraries
-  DEPENDS:=+libsepol +libpcre +USE_MUSL:musl-fts
+  DEPENDS:=+libsepol +libpcre2 +USE_MUSL:musl-fts
 endef
 
 define Package/libselinux/description
@@ -104,7 +103,7 @@ endef
 $(foreach a,$(LIBSELINUX_UTILS),$(eval $(call GenUtilPkg,libselinux-$(a),$(a))))
 
 # Needed to link libselinux utilities, which link against
-# libselinux.so, which indirectly depends on libpcre.so, installed in
+# libselinux.so, which indirectly depends on libpcre2.so, installed in
 # $(STAGING_DIR_HOSTPKG).
 HOST_LDFLAGS += -Wl,-rpath="$(STAGING_DIR_HOSTPKG)/lib"
 
@@ -115,6 +114,7 @@ HOST_MAKE_FLAGS += \
 
 ifeq ($(CONFIG_USE_MUSL),y)
 MAKE_FLAGS += FTS_LDLIBS=-lfts
+TARGET_CFLAGS += -D_LARGEFILE64_SOURCE
 endif
 
 MAKE_FLAGS += \
diff --git a/package/libs/libsemanage/Makefile b/package/libs/libsemanage/Makefile
index 8337b90bdac697..37e433b34ccff9 100644
--- a/package/libs/libsemanage/Makefile
+++ b/package/libs/libsemanage/Makefile
@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libsemanage
-PKG_VERSION:=3.3
+PKG_VERSION:=3.5
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/$(PKG_VERSION)
-PKG_HASH:=84d0ec5afa34bbbb471f602d8c1bf317d12443d07852a34b60741d428d597ce8
+PKG_HASH:=f53534e50247538280ed0d76c6ce81d8fb3939bd64cadb89da10dba42e40dd9c
 PKG_MAINTAINER:=Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 PKG_LICENSE:=LGPL-2.1
 PKG_LICENSE_FILES:=COPYING
diff --git a/package/libs/libsepol/Makefile b/package/libs/libsepol/Makefile
index 816b1397273e39..613d19388d5312 100644
--- a/package/libs/libsepol/Makefile
+++ b/package/libs/libsepol/Makefile
@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libsepol
-PKG_VERSION:=3.3
+PKG_VERSION:=3.5
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/$(PKG_VERSION)
-PKG_HASH:=2d97df3eb8466169b389c3660acbb90c54200ac96e452eca9f41a9639f4f238b
+PKG_HASH:=78fdaf69924db780bac78546e43d9c44074bad798c2c415d0b9bb96d065ee8a2
 
 PKG_MAINTAINER:=Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 PKG_CPE_ID:=cpe:/a:selinuxproject:libsepol
diff --git a/package/libs/libtraceevent/Makefile b/package/libs/libtraceevent/Makefile
index 9fb9304e76245d..5d8740faab47e7 100644
--- a/package/libs/libtraceevent/Makefile
+++ b/package/libs/libtraceevent/Makefile
@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libtraceevent
-PKG_VERSION:=1.6.2
+PKG_VERSION:=1.7.2
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://git.kernel.org/pub/scm/libs/libtrace/libtraceevent.git/snapshot/
-PKG_HASH:=1aaeb12f5842a843a06b733e3f4230b0937ba9c2ecd39345edf6f66cc8cbe795
+PKG_HASH:=a8b4bf8f05c06d1d6405f6d0038467a87e7ab218f0d8b0608d08bca5d1fc112a
 
 PKG_MAINTAINER:=Nick Hainke <vincent@systemli.org>
 
diff --git a/package/libs/libtracefs/Makefile b/package/libs/libtracefs/Makefile
index 412c5fd122137d..b97922f4606217 100644
--- a/package/libs/libtracefs/Makefile
+++ b/package/libs/libtracefs/Makefile
@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libtracefs
-PKG_VERSION:=1.4.2
+PKG_VERSION:=1.6.4
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://git.kernel.org/pub/scm/libs/libtrace/libtracefs.git/snapshot/
-PKG_HASH:=8ad03e6d2a6227f6eb11692d9f04614d3da60ac6c5e4fe436e59b2bed90f031b
+PKG_HASH:=52ce793dbb35a3e59bddce31de09a5d92cedd4d0702e64d0916f1ccdb00526c9
 
 PKG_MAINTAINER:=Nick Hainke <vincent@systemli.org>
 
diff --git a/package/libs/libubox/Makefile b/package/libs/libubox/Makefile
index 9ad4c305959cf4..c62278adc50ab2 100644
--- a/package/libs/libubox/Makefile
+++ b/package/libs/libubox/Makefile
@@ -5,9 +5,9 @@ PKG_RELEASE=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/libubox.git
-PKG_MIRROR_HASH:=cf48d00ed0ea74d53f2043eb9f9dc52834c0b214f258201cf22dfff7dd6c6e40
-PKG_SOURCE_DATE:=2022-05-15
-PKG_SOURCE_VERSION:=d2223ef9da7172a84d1508733dc58840e1381e3c
+PKG_MIRROR_HASH:=f22de22a784a0135cc2869fe81ff30e52136dca36863ee713503b4be5be01869
+PKG_SOURCE_DATE:=2023-05-23
+PKG_SOURCE_VERSION:=75a3b870cace1171faf57bd55e5a9a2f1564f757
 PKG_ABI_VERSION:=$(call abi_version_str,$(PKG_SOURCE_DATE))
 CMAKE_INSTALL:=1
 
diff --git a/package/libs/libunistring/Makefile b/package/libs/libunistring/Makefile
new file mode 100644
index 00000000000000..9b41cc3ce38392
--- /dev/null
+++ b/package/libs/libunistring/Makefile
@@ -0,0 +1,64 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=libunistring
+PKG_VERSION:=1.1
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
+PKG_SOURCE_URL:=@GNU/$(PKG_NAME)
+PKG_HASH:=827c1eb9cb6e7c738b171745dac0888aa58c5924df2e59239318383de0729b98
+
+PKG_BUILD_PARALLEL:=1
+PKG_INSTALL:=1
+
+PKG_LICENSE:=GPL-3.0
+PKG_LICENSE_FILES:=COPYING
+PKG_CPE_ID:=cpe:/a:gnu:$(PKG_NAME)
+
+include $(INCLUDE_DIR)/host-build.mk
+include $(INCLUDE_DIR)/package.mk
+
+define Package/libunistring
+  SECTION:=libs
+  CATEGORY:=Libraries
+  TITLE:=libunistring
+  URL:=https://www.gnu.org/software/libunistring
+endef
+
+define Package/libunistring/description
+  This library provides functions for manipulating Unicode strings
+  and for manipulating C strings according to the Unicode standard.
+endef
+
+HOST_CFLAGS += $(HOST_FPIC)
+
+TARGET_CFLAGS += $(FPIC)
+
+HOST_CONFIGURE_ARGS += \
+	--enable-static \
+	--disable-shared \
+	--without-libiconv-prefix \
+	--with-pic
+
+CONFIGURE_ARGS += \
+	--enable-static \
+	--enable-shared \
+	--without-libiconv-prefix \
+	--with-pic
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include
+	$(CP) $(PKG_INSTALL_DIR)/usr/include/*.h $(1)/usr/include/
+	$(INSTALL_DIR) $(1)/usr/include/unistring
+	$(CP) $(PKG_INSTALL_DIR)/usr/include/unistring/*.h $(1)/usr/include/unistring/
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libunistring.{a,so*} $(1)/usr/lib/
+endef
+
+define Package/libunistring/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libunistring.so.* $(1)/usr/lib/
+endef
+
+$(eval $(call HostBuild))
+$(eval $(call BuildPackage,libunistring))
diff --git a/package/libs/libusb/Makefile b/package/libs/libusb/Makefile
index 5d89568937c780..0c6de7cb618901 100644
--- a/package/libs/libusb/Makefile
+++ b/package/libs/libusb/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libusb
 PKG_VERSION:=1.0.26
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=3
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=\
@@ -41,10 +41,26 @@ define Package/libusb-1.0/description
   many different operating systems.
 endef
 
+define Package/fxload
+  SECTION:=utils
+  CATEGORY:=Utilities
+  TITLE:=fxload firmware loader
+  URL:=http://linux-hotplug.sourceforge.net
+  DEPENDS:=+libusb-1.0
+endef
+
+define Package/fxload/description
+This program is conveniently able to download firmware into FX, FX2,
+and FX2LP EZ-USB devices, as well as the original AnchorChips EZ-USB.
+It is intended to be invoked by hotplug scripts when the unprogrammed
+device appears on the bus.
+endef
+
 TARGET_CFLAGS += $(FPIC)
 CONFIGURE_ARGS += \
-	--disable-udev \
-	--disable-log
+	--enable-examples-build \
+	--disable-log \
+	--disable-udev
 
 define Build/InstallDev
 	$(INSTALL_DIR) $(1)/usr/include/libusb-1.0
@@ -60,4 +76,10 @@ define Package/libusb-1.0/install
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libusb-1.0.so* $(1)/usr/lib/
 endef
 
+define Package/fxload/install
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/examples/.libs/fxload $(1)/usr/sbin
+endef
+
 $(eval $(call BuildPackage,libusb-1.0))
+$(eval $(call BuildPackage,fxload))
diff --git a/package/libs/libxml2/Makefile b/package/libs/libxml2/Makefile
new file mode 100644
index 00000000000000..ed1965c0195418
--- /dev/null
+++ b/package/libs/libxml2/Makefile
@@ -0,0 +1,206 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=libxml2
+PKG_VERSION:=2.11.4
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
+PKG_SOURCE_URL:=@GNOME/libxml2/$(basename $(PKG_VERSION))
+PKG_HASH:=737e1d7f8ab3f139729ca13a2494fd17bf30ddb4b7a427cf336252cab57f57f7
+
+PKG_LICENSE:=MIT
+PKG_LICENSE_FILES:=COPYING
+PKG_CPE_ID:=cpe:/a:xmlsoft:libxml2
+
+include $(INCLUDE_DIR)/host-build.mk
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/cmake.mk
+include $(INCLUDE_DIR)/nls.mk
+
+define Package/libxml2
+  SECTION:=libs
+  CATEGORY:=Libraries
+  TITLE:=Gnome XML library
+  URL:=http://xmlsoft.org/
+  DEPENDS:=+libpthread +zlib $(ICONV_DEPENDS)
+endef
+
+define Package/libxml2/description
+ A library for manipulating XML and HTML resources.
+endef
+
+define Package/libxml2-dev
+  SECTION:=devel
+  CATEGORY:=Development
+  SUBMENU:=Libraries
+  TITLE:=Development files for libxml2
+  URL:=http://xmlsoft.org/
+  DEPENDS:=+libxml2
+endef
+
+define Package/libxml2-dev/description
+  A library for manipulating XML and HTML resources.
+
+  This package contains the headers and xml2-config binary.
+endef
+
+define Package/libxml2-utils
+  SECTION:=utils
+  CATEGORY:=Utilities
+  TITLE:=XML command line utilities (xmllint...)
+  URL:=http://xmlsoft.org/
+  DEPENDS:=+libxml2
+endef
+
+define Package/libxml2-utils/description
+  This package contains the binaries xmllint and xmlcatalog
+  from libxml2, a library for manipulating XML and HTML resources.
+endef
+
+CMAKE_HOST_OPTIONS += \
+	-DBUILD_SHARED_LIBS=OFF \
+	-DLIBXML2_WITH_C14N=ON \
+	-DLIBXML2_WITH_CATALOG=OFF \
+	-DLIBXML2_WITH_DEBUG=ON \
+	-DLIBXML2_WITH_FTP=OFF \
+	-DLIBXML2_WITH_HTML=ON \
+	-DLIBXML2_WITH_HTTP=OFF \
+	-DLIBXML2_WITH_ICONV=ON \
+	-DLIBXML2_WITH_ICU=OFF \
+	-DLIBXML2_WITH_ISO8859X=OFF \
+	-DLIBXML2_WITH_LEGACY=OFF \
+	-DLIBXML2_WITH_LZMA=OFF \
+	-DLIBXML2_WITH_MEM_DEBUG=OFF \
+	-DLIBXML2_WITH_MODULES=OFF \
+	-DLIBXML2_WITH_OUTPUT=ON \
+	-DLIBXML2_WITH_PATTERN=ON \
+	-DLIBXML2_WITH_PROGRAMS=OFF \
+	-DLIBXML2_WITH_PUSH=ON \
+	-DLIBXML2_WITH_PYTHON=OFF \
+	-DLIBXML2_WITH_READER=ON \
+	-DLIBXML2_WITH_REGEXPS=ON \
+	-DLIBXML2_WITH_RUN_DEBUG=OFF \
+	-DLIBXML2_WITH_SAX1=ON \
+	-DLIBXML2_WITH_SCHEMAS=ON \
+	-DLIBXML2_WITH_SCHEMATRON=OFF \
+	-DLIBXML2_WITH_TESTS=OFF \
+	-DLIBXML2_WITH_THREADS=ON \
+	-DLIBXML2_WITH_THREAD_ALLOC=OFF \
+	-DLIBXML2_WITH_TREE=ON \
+	-DLIBXML2_WITH_VALID=ON \
+	-DLIBXML2_WITH_WRITER=ON \
+	-DLIBXML2_WITH_XINCLUDE=ON \
+	-DLIBXML2_WITH_XPATH=ON \
+	-DLIBXML2_WITH_XPTR=ON \
+	-DLIBXML2_WITH_XPTR_LOCS=ON \
+	-DLIBXML2_WITH_ZLIB=ON
+
+CMAKE_OPTIONS += \
+	-DBUILD_SHARED_LIBS=ON \
+	-DLIBXML2_WITH_C14N=ON \
+	-DLIBXML2_WITH_CATALOG=OFF \
+	-DLIBXML2_WITH_DEBUG=ON \
+	-DLIBXML2_WITH_FTP=OFF \
+	-DLIBXML2_WITH_HTML=ON \
+	-DLIBXML2_WITH_HTTP=OFF \
+	-DLIBXML2_WITH_ICONV=ON \
+	-DLIBXML2_WITH_ICU=OFF \
+	-DLIBXML2_WITH_ISO8859X=OFF \
+	-DLIBXML2_WITH_LEGACY=OFF \
+	-DLIBXML2_WITH_LZMA=OFF \
+	-DLIBXML2_WITH_MEM_DEBUG=OFF \
+	-DLIBXML2_WITH_MODULES=OFF \
+	-DLIBXML2_WITH_OUTPUT=ON \
+	-DLIBXML2_WITH_PATTERN=ON \
+	-DLIBXML2_WITH_PROGRAMS=ON \
+	-DLIBXML2_WITH_PUSH=ON \
+	-DLIBXML2_WITH_PYTHON=OFF \
+	-DLIBXML2_WITH_READER=ON \
+	-DLIBXML2_WITH_REGEXPS=ON \
+	-DLIBXML2_WITH_RUN_DEBUG=OFF \
+	-DLIBXML2_WITH_SAX1=ON \
+	-DLIBXML2_WITH_SCHEMAS=ON \
+	-DLIBXML2_WITH_SCHEMATRON=OFF \
+	-DLIBXML2_WITH_TESTS=OFF \
+	-DLIBXML2_WITH_THREADS=ON \
+	-DLIBXML2_WITH_THREAD_ALLOC=OFF \
+	-DLIBXML2_WITH_TREE=ON \
+	-DLIBXML2_WITH_VALID=ON \
+	-DLIBXML2_WITH_WRITER=ON \
+	-DLIBXML2_WITH_XINCLUDE=ON \
+	-DLIBXML2_WITH_XPATH=ON \
+	-DLIBXML2_WITH_XPTR=ON \
+	-DLIBXML2_WITH_XPTR_LOCS=ON \
+	-DLIBXML2_WITH_ZLIB=ON \
+	-DHAVE_LIBHISTORY=OFF \
+	-DHAVE_LIBREADLINE=OFF
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(2)/bin
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/xml2-config \
+		$(2)/bin/$(GNU_TARGET_NAME)-xml2-config
+	$(SED) 's,^\(prefix\|exec_prefix\)=.*,\1=$(STAGING_DIR)/usr,g' \
+		$(2)/bin/$(GNU_TARGET_NAME)-xml2-config
+	$(LN) $(GNU_TARGET_NAME)-xml2-config $(2)/bin/xml2-config
+
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(CP) $(PKG_INSTALL_DIR)/usr/bin/xmlcatalog $(1)/usr/bin/
+	$(CP) $(PKG_INSTALL_DIR)/usr/bin/xmllint $(1)/usr/bin/
+
+	$(INSTALL_DIR) $(1)/usr/include
+	$(CP) $(PKG_INSTALL_DIR)/usr/include/libxml2 $(1)/usr/include/
+
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libxml2.so* $(1)/usr/lib/
+
+	$(INSTALL_DIR) $(1)/usr/lib/cmake/libxml2
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/cmake/libxml2-$(PKG_VERSION)/*.cmake \
+		$(1)/usr/lib/cmake/libxml2
+
+	$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
+	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libxml-2.0.pc $(1)/usr/lib/pkgconfig/
+
+	$(INSTALL_DIR) $(2)/share/aclocal/
+	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/share/aclocal/* $(2)/share/aclocal
+endef
+
+define Host/Install
+	$(call Host/Install/Default)
+	mv $(1)/bin/xml2-config $(1)/bin/$(GNU_HOST_NAME)-xml2-config
+	$(LN) $(GNU_HOST_NAME)-xml2-config $(1)/bin/xml2-config
+endef
+
+define Package/libxml2/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libxml2.so.* $(1)/usr/lib/
+endef
+
+define Package/libxml2-dev/install
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(CP) $(PKG_INSTALL_DIR)/usr/bin/xml2-config $(1)/usr/bin/
+	$(SED) "s,$(STAGING_DIR),,g" $(1)/usr/bin/xml2-config
+
+	$(INSTALL_DIR) $(1)/usr/include/
+	$(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
+
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libxml2.so $(1)/usr/lib/
+
+	$(INSTALL_DIR) $(1)/usr/lib/{cmake,pkgconfig}
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/{cmake,pkgconfig} $(1)/usr/lib/
+	$(SED) "s,$(STAGING_DIR),,g" $(1)/usr/lib/pkgconfig/*.pc
+
+	$(INSTALL_DIR) $(1)/usr/share/aclocal
+	$(CP) $(PKG_INSTALL_DIR)/usr/share/aclocal/* $(1)/usr/share/aclocal
+endef
+
+define Package/libxml2-utils/install
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(CP) $(PKG_INSTALL_DIR)/usr/bin/xmllint $(1)/usr/bin/
+	$(CP) $(PKG_INSTALL_DIR)/usr/bin/xmlcatalog $(1)/usr/bin/
+endef
+
+$(eval $(call HostBuild))
+$(eval $(call BuildPackage,libxml2))
+$(eval $(call BuildPackage,libxml2-dev))
+$(eval $(call BuildPackage,libxml2-utils))
diff --git a/package/libs/libxml2/patches/010-iconv.patch b/package/libs/libxml2/patches/010-iconv.patch
new file mode 100644
index 00000000000000..92b09685c56461
--- /dev/null
+++ b/package/libs/libxml2/patches/010-iconv.patch
@@ -0,0 +1,12 @@
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -469,6 +469,9 @@ if(LIBXML2_WITH_PROGRAMS)
+ 		add_executable(LibXml2::${PROGRAM} ALIAS ${PROGRAM})
+ 		target_compile_definitions(${PROGRAM} PRIVATE SYSCONFDIR="${CMAKE_INSTALL_FULL_SYSCONFDIR}")
+ 		target_link_libraries(${PROGRAM} LibXml2)
++		if(LIBXML2_WITH_ICONV AND NOT Iconv_IS_BUILT_IN)
++			target_link_libraries(${PROGRAM} iconv)
++		endif()
+ 		if(HAVE_LIBHISTORY)
+ 			target_link_libraries(${PROGRAM} history)
+ 		endif()
diff --git a/package/libs/mbedtls/Config.in b/package/libs/mbedtls/Config.in
new file mode 100644
index 00000000000000..ffabd799d32b64
--- /dev/null
+++ b/package/libs/mbedtls/Config.in
@@ -0,0 +1,193 @@
+if PACKAGE_libmbedtls
+
+comment "Option details in source code: include/mbedtls/mbedtls_config.h"
+
+comment "Ciphers - unselect old or less-used ciphers to reduce binary size"
+
+config MBEDTLS_AES_C
+	bool "MBEDTLS_AES_C"
+	default y
+
+config MBEDTLS_CAMELLIA_C
+	bool "MBEDTLS_CAMELLIA_C"
+	default n
+
+config MBEDTLS_CCM_C
+	bool "MBEDTLS_CCM_C"
+	default n
+
+config MBEDTLS_CMAC_C
+	bool "MBEDTLS_CMAC_C (old but used by hostapd)"
+	default y
+
+config MBEDTLS_DES_C
+	bool "MBEDTLS_DES_C (old but used by hostapd)"
+	default y
+
+config MBEDTLS_GCM_C
+	bool "MBEDTLS_GCM_C"
+	default y
+
+config MBEDTLS_NIST_KW_C
+	bool "MBEDTLS_NIST_KW_C (old but used by hostapd)"
+	default y
+
+config MBEDTLS_RIPEMD160_C
+	bool "MBEDTLS_RIPEMD160_C"
+	default n
+
+config MBEDTLS_XTEA_C
+	bool "MBEDTLS_XTEA_C"
+	default n
+
+config MBEDTLS_RSA_NO_CRT
+	bool "MBEDTLS_RSA_NO_CRT"
+	default y
+
+config MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
+	bool "MBEDTLS_KEY_EXCHANGE_PSK_ENABLED"
+	default y
+
+config MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
+	bool "MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED"
+	default n
+
+config MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
+	bool "MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED"
+	default y
+
+config MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
+	bool "MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED"
+	default n
+
+config MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
+	bool "MBEDTLS_KEY_EXCHANGE_RSA_ENABLED"
+	default n
+
+config MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
+	bool "MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED"
+	default n
+
+config MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
+	bool "MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED"
+	default y
+
+config MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
+	bool "MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED"
+	default y
+
+config MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
+	bool "MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED"
+	default n
+
+config MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
+	bool "MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED"
+	default n
+
+comment "Curves - unselect old or less-used curves to reduce binary size"
+
+config MBEDTLS_ECP_DP_SECP192R1_ENABLED
+	bool "MBEDTLS_ECP_DP_SECP192R1_ENABLED"
+	default n
+
+config MBEDTLS_ECP_DP_SECP224R1_ENABLED
+	bool "MBEDTLS_ECP_DP_SECP224R1_ENABLED"
+	default n
+
+config MBEDTLS_ECP_DP_SECP256R1_ENABLED
+	bool "MBEDTLS_ECP_DP_SECP256R1_ENABLED"
+	default y
+
+config MBEDTLS_ECP_DP_SECP384R1_ENABLED
+	bool "MBEDTLS_ECP_DP_SECP384R1_ENABLED"
+	default y
+
+config MBEDTLS_ECP_DP_SECP521R1_ENABLED
+	bool "MBEDTLS_ECP_DP_SECP521R1_ENABLED"
+	default n
+
+config MBEDTLS_ECP_DP_SECP192K1_ENABLED
+	bool "MBEDTLS_ECP_DP_SECP192K1_ENABLED"
+	default n
+
+config MBEDTLS_ECP_DP_SECP224K1_ENABLED
+	bool "MBEDTLS_ECP_DP_SECP224K1_ENABLED"
+	default n
+
+config MBEDTLS_ECP_DP_SECP256K1_ENABLED
+	bool "MBEDTLS_ECP_DP_SECP256K1_ENABLED"
+	default y
+
+config MBEDTLS_ECP_DP_BP256R1_ENABLED
+	bool "MBEDTLS_ECP_DP_BP256R1_ENABLED"
+	default n
+
+config MBEDTLS_ECP_DP_BP384R1_ENABLED
+	bool "MBEDTLS_ECP_DP_BP384R1_ENABLED"
+	default n
+
+config MBEDTLS_ECP_DP_BP512R1_ENABLED
+	bool "MBEDTLS_ECP_DP_BP512R1_ENABLED"
+	default n
+
+config MBEDTLS_ECP_DP_CURVE25519_ENABLED
+	bool "MBEDTLS_ECP_DP_CURVE25519_ENABLED"
+	default y
+
+config MBEDTLS_ECP_DP_CURVE448_ENABLED
+	bool "MBEDTLS_ECP_DP_CURVE448_ENABLED"
+	default n
+
+comment "Build Options - unselect features to reduce binary size"
+
+config MBEDTLS_CERTS_C
+	bool "MBEDTLS_CERTS_C"
+	default n
+
+config MBEDTLS_CIPHER_MODE_OFB
+	bool "MBEDTLS_CIPHER_MODE_OFB"
+	default n
+
+config MBEDTLS_CIPHER_MODE_XTS
+	bool "MBEDTLS_CIPHER_MODE_XTS"
+	default n
+
+config MBEDTLS_DEBUG_C
+	bool "MBEDTLS_DEBUG_C"
+	default n
+
+config MBEDTLS_HKDF_C
+	bool "MBEDTLS_HKDF_C"
+	default n
+
+config MBEDTLS_PLATFORM_C
+	bool "MBEDTLS_PLATFORM_C"
+	default n
+
+config MBEDTLS_SELF_TEST
+	bool "MBEDTLS_SELF_TEST"
+	default n
+
+config MBEDTLS_SSL_TRUNCATED_HMAC
+	bool "MBEDTLS_SSL_TRUNCATED_HMAC"
+	default n
+
+config MBEDTLS_VERSION_C
+	bool "MBEDTLS_VERSION_C"
+	default n
+
+config MBEDTLS_VERSION_FEATURES
+	bool "MBEDTLS_VERSION_FEATURES"
+	default n
+
+comment "Build Options"
+
+config MBEDTLS_ENTROPY_FORCE_SHA256
+	bool "MBEDTLS_ENTROPY_FORCE_SHA256"
+	default y
+
+config MBEDTLS_SSL_RENEGOTIATION
+	bool "MBEDTLS_SSL_RENEGOTIATION"
+	default n
+
+endif
diff --git a/package/libs/mbedtls/Makefile b/package/libs/mbedtls/Makefile
index 701d338a2ceca0..a6a7ac39e91be3 100644
--- a/package/libs/mbedtls/Makefile
+++ b/package/libs/mbedtls/Makefile
@@ -8,21 +8,72 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mbedtls
-PKG_VERSION:=2.28.1
-PKG_RELEASE:=$(AUTORELEASE)
-PKG_USE_MIPS16:=0
+PKG_VERSION:=2.28.3
+PKG_RELEASE:=1
+PKG_BUILD_FLAGS:=no-mips16 gc-sections no-lto
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/ARMmbed/mbedtls/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=6797a7b6483ef589deeab8d33d401ed235d7be25eeecda1be8ddfed406d40ff4
+PKG_HASH:=bdf7c5bbdc338da3edad89b2885d4f8668f9a6fffeba6ec17a60333e36dade6f
 
 PKG_LICENSE:=GPL-2.0-or-later
 PKG_LICENSE_FILES:=gpl-2.0.txt
 PKG_CPE_ID:=cpe:/a:arm:mbed_tls
 
-PKG_CONFIG_DEPENDS := \
-	CONFIG_LIBMBEDTLS_DEBUG_C \
-	CONFIG_LIBMBEDTLS_HKDF_C
+MBEDTLS_BUILD_OPTS_CURVES= \
+  CONFIG_MBEDTLS_ECP_DP_SECP192R1_ENABLED \
+  CONFIG_MBEDTLS_ECP_DP_SECP224R1_ENABLED \
+  CONFIG_MBEDTLS_ECP_DP_SECP256R1_ENABLED \
+  CONFIG_MBEDTLS_ECP_DP_SECP384R1_ENABLED \
+  CONFIG_MBEDTLS_ECP_DP_SECP521R1_ENABLED \
+  CONFIG_MBEDTLS_ECP_DP_SECP192K1_ENABLED \
+  CONFIG_MBEDTLS_ECP_DP_SECP224K1_ENABLED \
+  CONFIG_MBEDTLS_ECP_DP_SECP256K1_ENABLED \
+  CONFIG_MBEDTLS_ECP_DP_BP256R1_ENABLED \
+  CONFIG_MBEDTLS_ECP_DP_BP384R1_ENABLED \
+  CONFIG_MBEDTLS_ECP_DP_BP512R1_ENABLED \
+  CONFIG_MBEDTLS_ECP_DP_CURVE25519_ENABLED \
+  CONFIG_MBEDTLS_ECP_DP_CURVE448_ENABLED
+
+MBEDTLS_BUILD_OPTS_CIPHERS= \
+  CONFIG_MBEDTLS_AES_C \
+  CONFIG_MBEDTLS_CAMELLIA_C \
+  CONFIG_MBEDTLS_CCM_C \
+  CONFIG_MBEDTLS_CMAC_C \
+  CONFIG_MBEDTLS_DES_C \
+  CONFIG_MBEDTLS_GCM_C \
+  CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED \
+  CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED \
+  CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED \
+  CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED \
+  CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED \
+  CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED \
+  CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \
+  CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED \
+  CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED \
+  CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED \
+  CONFIG_MBEDTLS_NIST_KW_C \
+  CONFIG_MBEDTLS_RIPEMD160_C \
+  CONFIG_MBEDTLS_RSA_NO_CRT \
+  CONFIG_MBEDTLS_XTEA_C
+
+MBEDTLS_BUILD_OPTS= \
+  $(MBEDTLS_BUILD_OPTS_CURVES) \
+  $(MBEDTLS_BUILD_OPTS_CIPHERS) \
+  CONFIG_MBEDTLS_CERTS_C \
+  CONFIG_MBEDTLS_CIPHER_MODE_OFB \
+  CONFIG_MBEDTLS_CIPHER_MODE_XTS \
+  CONFIG_MBEDTLS_DEBUG_C \
+  CONFIG_MBEDTLS_ENTROPY_FORCE_SHA256 \
+  CONFIG_MBEDTLS_HKDF_C \
+  CONFIG_MBEDTLS_PLATFORM_C \
+  CONFIG_MBEDTLS_SELF_TEST \
+  CONFIG_MBEDTLS_SSL_RENEGOTIATION \
+  CONFIG_MBEDTLS_SSL_TRUNCATED_HMAC \
+  CONFIG_MBEDTLS_VERSION_C \
+  CONFIG_MBEDTLS_VERSION_FEATURES
+
+PKG_CONFIG_DEPENDS := $(MBEDTLS_BUILD_OPTS)
 
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/cmake.mk
@@ -44,28 +95,11 @@ $(call Package/mbedtls/Default)
   SUBMENU:=SSL
   TITLE+= (library)
   ABI_VERSION:=12
+  MENU:=1
 endef
 
 define Package/libmbedtls/config
-config LIBMBEDTLS_DEBUG_C
-	depends on PACKAGE_libmbedtls
-	bool "Enable debug functions"
-	default n
-	help
-	 This option enables mbedtls library's debug functions.
-
-	 It increases the uncompressed libmbedtls binary size
-	 by around 60 KiB (for an ARMv5 platform).
-
-	 Usually, you don't need this, so don't select this if you're unsure.
-
-config LIBMBEDTLS_HKDF_C
-	depends on PACKAGE_libmbedtls
-	bool "Enable the HKDF algorithm (RFC 5869)"
-	default n
-	help
-	 This option adds support for the Hashed Message Authentication Code
-	 (HMAC)-based key derivation function (HKDF).
+	source "$(SOURCE)/Config.in"
 endef
 
 define Package/mbedtls-util
@@ -87,7 +121,6 @@ This package contains mbedtls helper programs for private key and
 CSR generation (gen_key, cert_req)
 endef
 
-TARGET_CFLAGS += -ffunction-sections -fdata-sections
 TARGET_CFLAGS := $(filter-out -O%,$(TARGET_CFLAGS))
 
 CMAKE_OPTIONS += \
@@ -96,25 +129,14 @@ CMAKE_OPTIONS += \
 	-DENABLE_TESTING:Bool=OFF \
 	-DENABLE_PROGRAMS:Bool=ON
 
-define Build/Configure
-	$(Build/Configure/Default)
-
-	awk 'BEGIN { rc = 1 } \
-	     /#define MBEDTLS_DEBUG_C/ { $$$$0 = "$(if $(CONFIG_LIBMBEDTLS_DEBUG_C),,// )#define MBEDTLS_DEBUG_C"; rc = 0 } \
-	     { print } \
-	     END { exit(rc) }' $(PKG_BUILD_DIR)/include/mbedtls/config.h \
-	     >$(PKG_BUILD_DIR)/include/mbedtls/config.h.new && \
-	mv $(PKG_BUILD_DIR)/include/mbedtls/config.h.new $(PKG_BUILD_DIR)/include/mbedtls/config.h
-
-	awk 'BEGIN { rc = 1 } \
-	     /#define MBEDTLS_HKDF_C/ { $$$$0 = "$(if $(CONFIG_LIBMBEDTLS_HKDF_C),,// )#define MBEDTLS_HKDF_C"; rc = 0 } \
-	     { print } \
-	     END { exit(rc) }' $(PKG_BUILD_DIR)/include/mbedtls/config.h \
-	     >$(PKG_BUILD_DIR)/include/mbedtls/config.h.new && \
-	mv $(PKG_BUILD_DIR)/include/mbedtls/config.h.new $(PKG_BUILD_DIR)/include/mbedtls/config.h
-
-	sed -i '/fuzz/d' $(PKG_BUILD_DIR)/programs/CMakeLists.txt
-	sed -i '/test/d' $(PKG_BUILD_DIR)/programs/CMakeLists.txt
+define Build/Prepare
+       $(call Build/Prepare/Default)
+
+       $(if $(strip $(foreach opt,$(MBEDTLS_BUILD_OPTS),$($(opt)))),
+	 $(foreach opt,$(MBEDTLS_BUILD_OPTS),
+	 $(PKG_BUILD_DIR)/scripts/config.py \
+	 -f $(PKG_BUILD_DIR)/include/mbedtls/config.h \
+	 $(if $($(opt)),set,unset) $(patsubst CONFIG_%,%,$(opt))),)
 endef
 
 define Build/InstallDev
diff --git a/package/libs/mbedtls/patches/100-x509-crt-verify-SAN-iPAddress.patch b/package/libs/mbedtls/patches/100-x509-crt-verify-SAN-iPAddress.patch
new file mode 100644
index 00000000000000..c9802eac191f4c
--- /dev/null
+++ b/package/libs/mbedtls/patches/100-x509-crt-verify-SAN-iPAddress.patch
@@ -0,0 +1,197 @@
+From eb9d4fdf1846e688d51d86a9a50f0312aca2af25 Mon Sep 17 00:00:00 2001
+From: Glenn Strauss <gstrauss@gluelogic.com>
+Date: Sun, 23 Oct 2022 19:48:18 -0400
+Subject: [PATCH] x509 crt verify SAN iPAddress
+
+Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
+---
+ include/mbedtls/x509_crt.h |   2 +-
+ library/x509_crt.c         | 126 ++++++++++++++++++++++++++++++-------
+ 2 files changed, 103 insertions(+), 25 deletions(-)
+
+--- a/include/mbedtls/x509_crt.h
++++ b/include/mbedtls/x509_crt.h
+@@ -608,7 +608,7 @@ int mbedtls_x509_crt_verify_info(char *b
+  * \param cn       The expected Common Name. This will be checked to be
+  *                 present in the certificate's subjectAltNames extension or,
+  *                 if this extension is absent, as a CN component in its
+- *                 Subject name. Currently only DNS names are supported. This
++ *                 Subject name. DNS names and IP addresses are supported. This
+  *                 may be \c NULL if the CN need not be verified.
+  * \param flags    The address at which to store the result of the verification.
+  *                 If the verification couldn't be completed, the flag value is
+--- a/library/x509_crt.c
++++ b/library/x509_crt.c
+@@ -57,6 +57,10 @@
+ 
+ #if defined(MBEDTLS_HAVE_TIME)
+ #if defined(_WIN32) && !defined(EFIX64) && !defined(EFI32)
++#define WIN32_LEAN_AND_MEAN
++#ifndef _WIN32_WINNT
++#define _WIN32_WINNT 0x0600
++#endif
+ #include <windows.h>
+ #else
+ #include <time.h>
+@@ -2995,6 +2999,61 @@ find_parent:
+     }
+ }
+ 
++#ifdef _WIN32
++#ifdef _MSC_VER
++#pragma comment(lib, "ws2_32.lib")
++#include <winsock2.h>
++#include <ws2tcpip.h>
++#elif (defined(__MINGW32__) || defined(__MINGW64__)) && _WIN32_WINNT >= 0x0600
++#include <winsock2.h>
++#include <ws2tcpip.h>
++#endif
++#elif defined(__sun)
++/* Solaris requires -lsocket -lnsl for inet_pton() */
++#elif defined(__has_include)
++#if __has_include(<sys/socket.h>)
++#include <sys/socket.h>
++#endif
++#if __has_include(<arpa/inet.h>)
++#include <arpa/inet.h>
++#endif
++#endif
++
++/* Use whether or not AF_INET6 is defined to indicate whether or not to use
++ * the platform inet_pton() or a local implementation (below).  The local
++ * implementation may be used even in cases where the platform provides
++ * inet_pton(), e.g. when there are different includes required and/or the
++ * platform implementation requires dependencies on additional libraries.
++ * Specifically, Windows requires custom includes and additional link
++ * dependencies, and Solaris requires additional link dependencies.
++ * Also, as a coarse heuristic, use the local implementation if the compiler
++ * does not support __has_include(), or if the definition of AF_INET6 is not
++ * provided by headers included (or not) via __has_include() above. */
++#ifndef AF_INET6
++
++#define x509_cn_inet_pton(cn, dst) (0)
++
++#else
++
++static int x509_inet_pton_ipv6(const char *src, void *dst)
++{
++    return inet_pton(AF_INET6, src, dst) == 1 ? 0 : -1;
++}
++
++static int x509_inet_pton_ipv4(const char *src, void *dst)
++{
++    return inet_pton(AF_INET, src, dst) == 1 ? 0 : -1;
++}
++
++#endif /* AF_INET6 */
++
++static size_t x509_cn_inet_pton(const char *cn, void *dst)
++{
++    return strchr(cn, ':') == NULL
++            ? x509_inet_pton_ipv4(cn, dst) == 0 ? 4 : 0
++            : x509_inet_pton_ipv6(cn, dst) == 0 ? 16 : 0;
++}
++
+ /*
+  * Check for CN match
+  */
+@@ -3015,24 +3074,51 @@ static int x509_crt_check_cn(const mbedt
+     return -1;
+ }
+ 
++static int x509_crt_check_san_ip(const mbedtls_x509_sequence *san,
++                                 const char *cn, size_t cn_len)
++{
++    uint32_t ip[4];
++    cn_len = x509_cn_inet_pton(cn, ip);
++    if (cn_len == 0) {
++        return -1;
++    }
++
++    for (const mbedtls_x509_sequence *cur = san; cur != NULL; cur = cur->next) {
++        const unsigned char san_type = (unsigned char) cur->buf.tag &
++                                       MBEDTLS_ASN1_TAG_VALUE_MASK;
++        if (san_type == MBEDTLS_X509_SAN_IP_ADDRESS &&
++            cur->buf.len == cn_len && memcmp(cur->buf.p, ip, cn_len) == 0) {
++            return 0;
++        }
++    }
++
++    return -1;
++}
++
+ /*
+  * Check for SAN match, see RFC 5280 Section 4.2.1.6
+  */
+-static int x509_crt_check_san(const mbedtls_x509_buf *name,
++static int x509_crt_check_san(const mbedtls_x509_sequence *san,
+                               const char *cn, size_t cn_len)
+ {
+-    const unsigned char san_type = (unsigned char) name->tag &
+-                                   MBEDTLS_ASN1_TAG_VALUE_MASK;
+-
+-    /* dNSName */
+-    if (san_type == MBEDTLS_X509_SAN_DNS_NAME) {
+-        return x509_crt_check_cn(name, cn, cn_len);
++    int san_ip = 0;
++    for (const mbedtls_x509_sequence *cur = san; cur != NULL; cur = cur->next) {
++        switch ((unsigned char) cur->buf.tag & MBEDTLS_ASN1_TAG_VALUE_MASK) {
++            case MBEDTLS_X509_SAN_DNS_NAME:                /* dNSName */
++                if (x509_crt_check_cn(&cur->buf, cn, cn_len) == 0) {
++                    return 0;
++                }
++                break;
++            case MBEDTLS_X509_SAN_IP_ADDRESS:              /* iPAddress */
++                san_ip = 1;
++                break;
++            /* (We may handle other types here later.) */
++            default: /* Unrecognized type */
++                break;
++        }
+     }
+ 
+-    /* (We may handle other types here later.) */
+-
+-    /* Unrecognized type */
+-    return -1;
++    return san_ip ? x509_crt_check_san_ip(san, cn, cn_len) : -1;
+ }
+ 
+ /*
+@@ -3043,31 +3129,23 @@ static void x509_crt_verify_name(const m
+                                  uint32_t *flags)
+ {
+     const mbedtls_x509_name *name;
+-    const mbedtls_x509_sequence *cur;
+     size_t cn_len = strlen(cn);
+ 
+     if (crt->ext_types & MBEDTLS_X509_EXT_SUBJECT_ALT_NAME) {
+-        for (cur = &crt->subject_alt_names; cur != NULL; cur = cur->next) {
+-            if (x509_crt_check_san(&cur->buf, cn, cn_len) == 0) {
+-                break;
+-            }
+-        }
+-
+-        if (cur == NULL) {
+-            *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
++        if (x509_crt_check_san(&crt->subject_alt_names, cn, cn_len) == 0) {
++            return;
+         }
+     } else {
+         for (name = &crt->subject; name != NULL; name = name->next) {
+             if (MBEDTLS_OID_CMP(MBEDTLS_OID_AT_CN, &name->oid) == 0 &&
+                 x509_crt_check_cn(&name->val, cn, cn_len) == 0) {
+-                break;
++                return;
+             }
+         }
+ 
+-        if (name == NULL) {
+-            *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
+-        }
+     }
++
++    *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
+ }
+ 
+ /*
diff --git a/package/libs/mbedtls/patches/101-remove-test.patch b/package/libs/mbedtls/patches/101-remove-test.patch
new file mode 100644
index 00000000000000..e43f8757d71702
--- /dev/null
+++ b/package/libs/mbedtls/patches/101-remove-test.patch
@@ -0,0 +1,15 @@
+--- a/programs/CMakeLists.txt
++++ b/programs/CMakeLists.txt
+@@ -1,12 +1,8 @@
+ add_subdirectory(aes)
+-if (NOT WIN32)
+-    add_subdirectory(fuzz)
+-endif()
+ add_subdirectory(hash)
+ add_subdirectory(pkey)
+ add_subdirectory(psa)
+ add_subdirectory(random)
+ add_subdirectory(ssl)
+-add_subdirectory(test)
+ add_subdirectory(util)
+ add_subdirectory(x509)
diff --git a/package/libs/ncurses/Makefile b/package/libs/ncurses/Makefile
index b21dd2b0aba8ee..4d8e685f35dd7b 100644
--- a/package/libs/ncurses/Makefile
+++ b/package/libs/ncurses/Makefile
@@ -8,12 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ncurses
-PKG_VERSION:=6.3
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_CPE_ID:=cpe:/a:gnu:ncurses
+PKG_VERSION:=6.4
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=@GNU/$(PKG_NAME)
-PKG_HASH:=97fc51ac2b085d4cde31ef4d2c3122c21abc217e9090a43a30fc5ec21684e059
+PKG_HASH:=6931283d9ac87c5073f30b6290c4c75f21632bb4fc3603ac8100812bed248159
 
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=README
@@ -122,6 +123,7 @@ ifneq ($(HOST_OS),FreeBSD)
 	)
 	for file in \
 		a/ansi \
+		a/alacritty \
 		d/dumb \
 		l/linux \
 		r/rxvt \
diff --git a/package/libs/ncurses/patches/100-ncurses-5.6-20080112-urxvt.patch b/package/libs/ncurses/patches/100-ncurses-5.6-20080112-urxvt.patch
index 2fdbb7b0be348f..70d64bd8e10063 100644
--- a/package/libs/ncurses/patches/100-ncurses-5.6-20080112-urxvt.patch
+++ b/package/libs/ncurses/patches/100-ncurses-5.6-20080112-urxvt.patch
@@ -1,6 +1,6 @@
 --- a/misc/terminfo.src
 +++ b/misc/terminfo.src
-@@ -6616,6 +6616,172 @@ rxvt-cygwin-native|rxvt terminal emulato
+@@ -6886,6 +6886,172 @@ rxvt-cygwin-native|rxvt terminal emulato
  rxvt-16color|rxvt with 16 colors like aixterm,
  	ncv#32, use=ibm+16color, use=rxvt,
  
diff --git a/package/libs/ncurses/patches/101-ncurses-5.6-20080628-kbs.patch b/package/libs/ncurses/patches/101-ncurses-5.6-20080628-kbs.patch
index 2d299197b029f3..9f00350a468771 100644
--- a/package/libs/ncurses/patches/101-ncurses-5.6-20080628-kbs.patch
+++ b/package/libs/ncurses/patches/101-ncurses-5.6-20080628-kbs.patch
@@ -1,14 +1,14 @@
 --- a/misc/terminfo.src
 +++ b/misc/terminfo.src
-@@ -4815,6 +4815,7 @@ xterm+nofkeys|building block for xterm f
- # This version reflects the current xterm features.
- xterm-new|modern xterm terminal emulator,
+@@ -4984,6 +4984,7 @@ xterm-xfree86|xterm terminal emulator (X
+ 
+ xterm+nofkeys|building block for xterm fkey-variants,
  	npc,
 +	kbs=\177,
  	kcbt=\E[Z, kent=\EOM, nel=\EE, use=ecma+index,
- 	use=ansi+rep, use=ecma+strikeout, use=xterm+pcfkeys,
- 	use=xterm+nofkeys,
-@@ -6416,6 +6417,7 @@ mlterm-256color|mlterm 3.0 with xterm 25
+ 	use=ansi+rep, use=ecma+strikeout, use=vt420+lrmm,
+ 	use=xterm+sm+1006, use=xterm+tmux, use=ecma+italics,
+@@ -6689,6 +6690,7 @@ mlterm-256color|mlterm 3.0 with xterm 25
  rxvt-basic|rxvt terminal base (X Window System),
  	OTbs, am, bce, eo, mir, msgr, xenl, xon, XT,
  	cols#80, it#8, lines#24,
@@ -16,24 +16,24 @@
  	acsc=``aaffggjjkkllmmnnooppqqrrssttuuvvwwxxyyzz{{||}}~~,
  	bel=^G, blink=\E[5m, bold=\E[1m, clear=\E[H\E[2J, cr=\r,
  	csr=\E[%i%p1%d;%p2%dr, cub=\E[%p1%dD, cub1=^H,
-@@ -6425,7 +6427,7 @@ rxvt-basic|rxvt terminal base (X Window
+@@ -6698,7 +6700,7 @@ rxvt-basic|rxvt terminal base (X Window
  	enacs=\E(B\E)0, flash=\E[?5h$<100/>\E[?5l, home=\E[H,
  	ht=^I, hts=\EH, ich=\E[%p1%d@, il=\E[%p1%dL, il1=\E[L,
  	ind=\n, is1=\E[?47l\E=\E[?1l,
 -	is2=\E[r\E[m\E[2J\E[H\E[?7h\E[?1;3;4;6l\E[4l, kbs=^H,
 +	is2=\E[r\E[m\E[2J\E[H\E[?7h\E[?1;3;4;6l\E[4l,
  	kcbt=\E[Z, kmous=\E[M, rc=\E8, rev=\E[7m, ri=\EM, rmacs=^O,
- 	rmcup=\E[2J\E[?47l\E8, rmir=\E[4l, rmkx=\E>, rmso=\E[27m,
- 	rmul=\E[24m,
-@@ -8060,6 +8062,7 @@ dumb-emacs-ansi|Emacs dumb terminal with
- screen|VT 100/ANSI X3.64 virtual terminal,
+ 	rmir=\E[4l, rmkx=\E>, rmso=\E[27m, rmul=\E[24m,
+ 	rs1=\E>\E[1;3;4;5;6l\E[?7h\E[m\E[r\E[2J\E[H,
+@@ -8347,6 +8349,7 @@ dumb-emacs-ansi|Emacs dumb terminal with
+ screen-base|VT 100/ANSI X3.64 virtual terminal (base),
  	OTbs, OTpt, am, km, mir, msgr, xenl, G0,
  	colors#8, cols#80, it#8, lines#24, ncv@, pairs#64, U8#1,
 +	kbs=\177,
  	acsc=++\,\,--..00``aaffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxy
  	     yzz{{||}}~~,
  	bel=^G, blink=\E[5m, bold=\E[1m, cbt=\E[Z, civis=\E[?25l,
-@@ -8071,7 +8074,7 @@ screen|VT 100/ANSI X3.64 virtual termina
+@@ -8358,7 +8361,7 @@ screen-base|VT 100/ANSI X3.64 virtual te
  	dl=\E[%p1%dM, dl1=\E[M, ed=\E[J, el=\E[K, el1=\E[1K,
  	enacs=\E(B\E)0, flash=\Eg, home=\E[H, hpa=\E[%i%p1%dG,
  	ht=^I, hts=\EH, ich=\E[%p1%d@, il=\E[%p1%dL, il1=\E[L,
@@ -42,7 +42,7 @@
  	kcub1=\EOD, kcud1=\EOB, kcuf1=\EOC, kcuu1=\EOA, kf1=\EOP,
  	kf10=\E[21~, kf11=\E[23~, kf12=\E[24~, kf2=\EOQ, kf3=\EOR,
  	kf4=\EOS, kf5=\E[15~, kf6=\E[17~, kf7=\E[18~, kf8=\E[19~,
-@@ -8199,6 +8202,7 @@ screen.xterm-r6|screen customized for X1
+@@ -8500,6 +8503,7 @@ screen.xterm-r6|screen customized for X1
  # on Solaris because Sun's curses implementation gets confused.
  screen.teraterm|disable ncv in teraterm,
  	ncv#127,
diff --git a/package/libs/ncurses/patches/102-ncurses-5.9-gcc-5.patch b/package/libs/ncurses/patches/102-ncurses-5.9-gcc-5.patch
index a6398acf8e7102..5f1461b7b040b9 100644
--- a/package/libs/ncurses/patches/102-ncurses-5.9-gcc-5.patch
+++ b/package/libs/ncurses/patches/102-ncurses-5.9-gcc-5.patch
@@ -15,7 +15,7 @@ Subject: [PATCH] ncurses 5.9 - patch 20141206
 
 --- a/ncurses/base/MKlib_gen.sh
 +++ b/ncurses/base/MKlib_gen.sh
-@@ -511,11 +511,22 @@ sed -n -f $ED1 \
+@@ -512,11 +512,22 @@ sed -n -f $ED1 \
  	-e 's/gen_$//' \
  	-e 's/  / /g' >>$TMP
  
diff --git a/package/libs/ncurses/patches/103-ncurses-ar-determinism.patch b/package/libs/ncurses/patches/103-ncurses-ar-determinism.patch
index 5ef8ab7ab0d332..a4599130cc8328 100644
--- a/package/libs/ncurses/patches/103-ncurses-ar-determinism.patch
+++ b/package/libs/ncurses/patches/103-ncurses-ar-determinism.patch
@@ -1,6 +1,6 @@
 --- a/aclocal.m4
 +++ b/aclocal.m4
-@@ -505,7 +505,7 @@ AC_CACHE_CHECK(for options to update arc
+@@ -523,7 +523,7 @@ AC_CACHE_CHECK(for options to update arc
  		;;
  	(*)
  		cf_cv_ar_flags=unknown
@@ -11,7 +11,7 @@
  			# check if $ARFLAGS already contains this choice
 --- a/configure
 +++ b/configure
-@@ -5072,7 +5072,7 @@ else
+@@ -5110,7 +5110,7 @@ else
  		;;
  	(*)
  		cf_cv_ar_flags=unknown
diff --git a/package/libs/ncurses/patches/900-terminfo.patch b/package/libs/ncurses/patches/900-terminfo.patch
index 96d78cde349a83..86e3bc16b2b2fd 100644
--- a/package/libs/ncurses/patches/900-terminfo.patch
+++ b/package/libs/ncurses/patches/900-terminfo.patch
@@ -1,6 +1,6 @@
 --- a/misc/terminfo.src
 +++ b/misc/terminfo.src
-@@ -6240,12 +6240,11 @@ konsole-xf3x|KDE console window with key
+@@ -6514,12 +6514,11 @@ konsole-xf3x|KDE console window with key
  # The value for kbs (see konsole-vt100) reflects local customization rather
  # than the settings used for XFree86 xterm.
  konsole-xf4x|KDE console window with keyboard for XFree86 4.x xterm,
diff --git a/package/libs/nettle/Makefile b/package/libs/nettle/Makefile
index 8825da4be7ffee..36410920b99314 100644
--- a/package/libs/nettle/Makefile
+++ b/package/libs/nettle/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=nettle
-PKG_VERSION:=3.8.1
-PKG_RELEASE:=$(AUTORELEASE)
-PKG_USE_MIPS16:=0
+PKG_VERSION:=3.9
+PKG_RELEASE:=1
+PKG_BUILD_FLAGS:=no-mips16
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=@GNU/nettle
-PKG_HASH:=364f3e2b77cd7dcde83fd7c45219c834e54b0c75e428b6f894a23d12dd41cbfe
+PKG_HASH:=0ee7adf5a7201610bb7fe0acbb7c9b3be83be44904dd35ebbcd965cd896bfeaa
 
 PKG_LICENSE:=GPL-2.0-or-later
 PKG_LICENSE_FILES:=COPYING
diff --git a/package/libs/nettle/patches/100-portability.patch b/package/libs/nettle/patches/100-portability.patch
index b4677ec02064ba..a44baa296d5d81 100644
--- a/package/libs/nettle/patches/100-portability.patch
+++ b/package/libs/nettle/patches/100-portability.patch
@@ -1,6 +1,6 @@
 --- a/configure
 +++ b/configure
-@@ -4704,6 +4704,7 @@ $as_echo_n "checking build system compil
+@@ -4719,6 +4719,7 @@ $as_echo_n "checking build system compil
  # remove anything that might look like compiler output to our "||" expression
  rm -f conftest* a.out b.out a.exe a_out.exe
  cat >conftest.c <<EOF
@@ -8,7 +8,7 @@
  int
  main ()
  {
-@@ -4736,6 +4737,7 @@ $as_echo_n "checking build system compil
+@@ -4751,6 +4752,7 @@ $as_echo_n "checking build system compil
  # remove anything that might look like compiler output to our "||" expression
  rm -f conftest* a.out b.out a.exe a_out.exe
  cat >conftest.c <<EOF
@@ -16,7 +16,7 @@
  int
  main ()
  {
-@@ -4772,6 +4774,7 @@ $as_echo_n "checking build system compil
+@@ -4787,6 +4789,7 @@ $as_echo_n "checking build system compil
  # remove anything that might look like compiler output to our "||" expression
  rm -f conftest* a.out b.out a.exe a_out.exe
  cat >conftest.c <<EOF
@@ -24,7 +24,7 @@
  int
  main ()
  {
-@@ -4822,6 +4825,7 @@ else
+@@ -4837,6 +4840,7 @@ else
    gmp_cv_prog_exeext_for_build="$EXEEXT"
  else
    cat >conftest.c <<EOF
diff --git a/package/libs/openssl/Config.in b/package/libs/openssl/Config.in
index bc2f0584b634da..871080a4cbec39 100644
--- a/package/libs/openssl/Config.in
+++ b/package/libs/openssl/Config.in
@@ -8,33 +8,33 @@ config OPENSSL_OPTIMIZE_SPEED
 	prompt "Enable optimization for speed instead of size"
 	select OPENSSL_WITH_ASM
 	help
-		Enabling this option increases code size (around 20%) and
-		performance.  The increase in performance and size depends on the
-		target CPU. EC and AES seem to benefit the most, with EC speed
-		increased by 20%-50% (mipsel & x86).
-		AES-GCM is supposed to be 3x faster on x86. YMMV.
+		Enabling this option increases code size and performance.
+		The increase in performance and size depends on the
+		target CPU. EC and AES seem to benefit the most.
+
+config OPENSSL_SMALL_FOOTPRINT
+	bool
+	depends on !OPENSSL_OPTIMIZE_SPEED
+	default y if SMALL_FLASH || LOW_MEMORY_FOOTPRINT
+	prompt "Build with OPENSSL_SMALL_FOOTPRINT (read help)"
+	help
+		This turns on -DOPENSSL_SMALL_FOOTPRINT.  This will save only
+		1-3% of of the ipk size.  The performance drop depends on
+		architecture and algorithm.  MIPS drops 13% of performance for
+		a 3% decrease in ipk size.  On Aarch64, for a 1% reduction in
+		size, ghash and GCM performance decreases 90%, while
+		Chacha20-Poly1305 is 15% slower.  X86_64 drops 1% of its size
+		for 3% of performance.  Other arches have not been tested.
 
 config OPENSSL_WITH_ASM
 	bool
-	default y if !SMALL_FLASH || !arm
+	default y
 	prompt "Compile with optimized assembly code"
 	depends on !arc
 	help
 		Disabling this option will reduce code size and performance.
 		The increase in performance and size depends on the target
-		CPU and on the algorithms being optimized.  As of 1.1.0i*:
-
-		Platform  Pkg Inc. Algorithms where assembly is used - ~% Speed Increase
-		aarch64   174K     BN, aes, sha1, sha256, sha512, nist256, poly1305
-		arm       152K     BN, aes, sha1, sha256, sha512, nist256, poly1305
-		i386      183K     BN+147%, aes+300%, rc4+55%, sha1+160%, sha256+114%, sha512+270%, nist256+282%, poly1305+292%
-		mipsel      1.5K   BN+97%, aes+4%, sha1+94%, sha256+60%
-		mips64	    3.7K   BN, aes, sha1, sha256, sha512, poly1305
-		powerpc    20K     BN, aes, sha1, sha256, sha512, poly1305
-		x86_64    228K     BN+220%, aes+173%, rc4+38%, sha1+40%, sha256+64%, sha512+31%, nist256+354%, poly1305+228%
-
-		* Only most common algorithms shown. Your mileage may vary.
-		  BN (bignum) performance was measured using RSA sign/verify.
+		CPU and on the algorithms being optimized.
 
 config OPENSSL_WITH_SSE2
 	bool
@@ -42,21 +42,17 @@ config OPENSSL_WITH_SSE2
 	prompt "Enable use of x86 SSE2 instructions"
 	depends on OPENSSL_WITH_ASM && i386
 	help
-		Use of SSE2 instructions greatly increase performance (up to
-		3x faster) with a minimum (~0.2%, or 23KB) increase in package
-		size, but it will bring no benefit if your hardware does not
-		support them, such as Geode GX and LX.  In this case you may
-		save 23KB by saying yes here.  AMD Geode NX, and Intel
-		Pentium 4 and above support SSE2.
+		Use of SSE2 instructions greatly increase performance with a
+		minimum increase in package size, but it will bring no benefit
+		if your hardware does not support them, such as Geode GX and LX.
+		AMD Geode NX, and Intel Pentium 4 and above support SSE2.
 
 config OPENSSL_WITH_DEPRECATED
 	bool
 	default y
-	prompt "Include deprecated APIs (See help for a list of packages that need this)"
+	prompt "Include deprecated APIs"
 	help
-		Since openssl 1.1.x is still new to openwrt, some packages
-		requiring this option do not list it as a requirement yet:
-		 * freeswitch-stable, freeswitch, python, python3, squid.
+		This drops all deprecated API, including engine support.
 
 config OPENSSL_NO_DEPRECATED
 	bool
@@ -64,7 +60,7 @@ config OPENSSL_NO_DEPRECATED
 
 config OPENSSL_WITH_ERROR_MESSAGES
 	bool
-	default y if !SMALL_FLASH && !LOW_MEMORY_FOOTPRINT
+	default y if !OPENSSL_SMALL_FOOTPRINT || (!SMALL_FLASH && !LOW_MEMORY_FOOTPRINT)
 	prompt "Include error messages"
 	help
 		This option aids debugging, but increases package size and
@@ -84,7 +80,6 @@ config OPENSSL_WITH_TLS13
 		   protocol;
 		 * to increase performance by reducing the number of round-trips
 		   when performing a full handshake.
-		It increases package size by ~4KB.
 
 config OPENSSL_WITH_DTLS
 	bool
@@ -172,16 +167,24 @@ config OPENSSL_WITH_CAMELLIA
 
 config OPENSSL_WITH_IDEA
 	bool
-	prompt "Enable IDEA cipher support"
+	default y if !SMALL_FLASH
+	prompt "Enable IDEA cipher support (needs legacy provider)"
 	help
 		IDEA is a block cipher with 128-bit keys.
+		To use the cipher, one must install the libopenssl-legacy
+		package, using a main libopenssl package compiled with this
+		option enabled as well.
 
 config OPENSSL_WITH_SEED
 	bool
-	prompt "Enable SEED cipher support"
+	default y if !SMALL_FLASH
+	prompt "Enable SEED cipher support (needs legacy provider)"
 	help
 		SEED is a block cipher with 128-bit keys broadly used in
 		South Korea, but seldom found elsewhere.
+		To use the cipher, one must install the libopenssl-legacy
+		package, using a main libopenssl package compiled with this
+		option enabled as well.
 
 config OPENSSL_WITH_SM234
 	bool
@@ -202,11 +205,21 @@ config OPENSSL_WITH_BLAKE2
 
 config OPENSSL_WITH_MDC2
 	bool
-	prompt "Enable MDC2 digest support"
+	default y if !SMALL_FLASH
+	prompt "Enable MDC2 digest support (needs legacy provider)"
+	help
+		To use the digest, one must install the libopenssl-legacy
+		package, using a main libopenssl package compiled with this
+		option enabled as well.
 
 config OPENSSL_WITH_WHIRLPOOL
 	bool
-	prompt "Enable Whirlpool digest support"
+	default y if !SMALL_FLASH
+	prompt "Enable Whirlpool digest support (needs legacy provider)"
+	help
+		To use the digest, one must install the libopenssl-legacy
+		package, using a main libopenssl package compiled with this
+		option enabled as well.
 
 config OPENSSL_WITH_COMPRESSION
 	bool
@@ -233,6 +246,7 @@ comment "Engine/Hardware Support"
 
 config OPENSSL_ENGINE
 	bool "Enable engine support"
+	select OPENSSL_WITH_DEPRECATED
 	default y
 	help
 		This enables alternative cryptography implementations,
diff --git a/package/libs/openssl/Makefile b/package/libs/openssl/Makefile
index bf2d6ae64d24e7..0d09114f06e307 100644
--- a/package/libs/openssl/Makefile
+++ b/package/libs/openssl/Makefile
@@ -8,14 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=openssl
-PKG_BASE:=1.1.1
-PKG_BUGFIX:=q
-PKG_VERSION:=$(PKG_BASE)$(PKG_BUGFIX)
-PKG_RELEASE:=$(AUTORELEASE)
-PKG_USE_MIPS16:=0
+PKG_VERSION:=3.0.9
+PKG_RELEASE:=2
+PKG_BUILD_FLAGS:=no-mips16 gc-sections
 
 PKG_BUILD_PARALLEL:=1
 
+PKG_BASE:=$(subst $(space),.,$(wordlist 1,2,$(subst .,$(space),$(PKG_VERSION))))
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:= \
 	http://www.openssl.org/source/ \
@@ -25,9 +24,9 @@ PKG_SOURCE_URL:= \
 	ftp://ftp.pca.dfn.de/pub/tools/net/openssl/source/ \
 	ftp://ftp.pca.dfn.de/pub/tools/net/openssl/source/old/$(PKG_BASE)/
 
-PKG_HASH:=d7939ce614029cdff0b6c20f0e2e5703158a489a72b2507b8bd51bf8c8fd10ca
+PKG_HASH:=eb1ab04781474360f77c318ab89d8c5a03abc38e63d65a603cabbf1b00a1dc90
 
-PKG_LICENSE:=OpenSSL
+PKG_LICENSE:=Apache-2.0
 PKG_LICENSE_FILES:=LICENSE
 PKG_MAINTAINER:=Eneas U de Queiroz <cotequeiroz@gmail.com>
 PKG_CPE_ID:=cpe:/a:openssl:openssl
@@ -40,6 +39,7 @@ PKG_CONFIG_DEPENDS:= \
 	CONFIG_OPENSSL_NO_DEPRECATED \
 	CONFIG_OPENSSL_OPTIMIZE_SPEED \
 	CONFIG_OPENSSL_PREFER_CHACHA_OVER_GCM \
+	CONFIG_OPENSSL_SMALL_FOOTPRINT \
 	CONFIG_OPENSSL_WITH_ARIA \
 	CONFIG_OPENSSL_WITH_ASM \
 	CONFIG_OPENSSL_WITH_ASYNC \
@@ -64,7 +64,7 @@ PKG_CONFIG_DEPENDS:= \
 	CONFIG_OPENSSL_WITH_WHIRLPOOL
 
 include $(INCLUDE_DIR)/package.mk
-include $(INCLUDE_DIR)/openssl-engine.mk
+include $(INCLUDE_DIR)/openssl-module.mk
 
 ifneq ($(CONFIG_CCACHE),)
 HOSTCC=$(HOSTCC_NOCACHE)
@@ -95,9 +95,10 @@ $(call Package/openssl/Default)
   DEPENDS:=+OPENSSL_WITH_COMPRESSION:zlib \
 	   +OPENSSL_ENGINE_BUILTIN_AFALG:kmod-crypto-user \
 	   +OPENSSL_ENGINE_BUILTIN_DEVCRYPTO:kmod-cryptodev \
-	   +OPENSSL_ENGINE_BUILTIN_PADLOCK:kmod-crypto-hw-padlock
+	   +OPENSSL_ENGINE_BUILTIN_PADLOCK:kmod-crypto-hw-padlock \
+	   +(arm||armeb||mips||mipsel||powerpc||arc):libatomic
   TITLE+= (libraries)
-  ABI_VERSION:=1.1
+  ABI_VERSION:=$(firstword $(subst .,$(space),$(PKG_VERSION)))
   MENU:=1
 endef
 
@@ -128,8 +129,8 @@ endef
 
 define Package/libopenssl-conf/conffiles
 /etc/ssl/openssl.cnf
-$(if CONFIG_OPENSSL_ENGINE_BUILTIN_DEVCRYPTO,/etc/ssl/engines.cnf.d/devcrypto.cnf)
-$(if CONFIG_OPENSSL_ENGINE_BUILTIN_PADLOCK,/etc/ssl/engines.cnf.d/padlock.cnf)
+$(if $(CONFIG_OPENSSL_ENGINE_BUILTIN_DEVCRYPTO),/etc/ssl/modules.cnf.d/devcrypto.cnf)
+$(if $(CONFIG_OPENSSL_ENGINE_BUILTIN_PADLOCK),/etc/ssl/modules.cnf.d/padlock.cnf)
 endef
 
 define Package/libopenssl-conf/description
@@ -137,6 +138,37 @@ $(call Package/openssl/Default/description)
 This package installs the OpenSSL configuration file /etc/ssl/openssl.cnf.
 endef
 
+ifneq ($(CONFIG_OPENSSL_ENGINE_BUILTIN_PADLOCK)$(CONFIG_OPENSSL_ENGINE_BUILTIN_DEVCRYPTO),)
+define Package/libopenssl-conf/postinst
+#!/bin/sh
+
+add_engine_config() {
+	if [ -z "$${IPKG_INSTROOT}" ] && uci -q get "openssl.$$1" >/dev/null; then
+		[ "$$(uci -q get "openssl.$$1.builtin")" = 1 ] && return
+		uci set "openssl.$$1.builtin=1" && uci commit openssl
+		return
+	fi
+}
+
+$(if $(CONFIG_OPENSSL_ENGINE_BUILTIN_DEVCRYPTO),add_engine_config devcrypto)
+$(if $(CONFIG_OPENSSL_ENGINE_BUILTIN_PADLOCK),add_engine_config padlock)
+endef
+endif
+
+$(eval $(call Package/openssl/add-provider,legacy))
+define Package/libopenssl-legacy
+  $(call Package/openssl/Default)
+  $(call Package/openssl/module/Default)
+  TITLE:=OpenSSL legacy provider
+endef
+
+define Package/libopenssl-legacy/description
+The OpenSSL legacy provider supplies OpenSSL implementations of algorithms that
+have been deemed legacy. Such algorithms have commonly fallen out of use, have
+been deemed insecure by the cryptography community, or something similar.  See
+https://www.openssl.org/docs/man3.0/man7/OSSL_PROVIDER-legacy.html
+endef
+
 $(eval $(call Package/openssl/add-engine,afalg))
 define Package/libopenssl-afalg
   $(call Package/openssl/Default)
@@ -149,7 +181,7 @@ endef
 define Package/libopenssl-afalg/description
 This package adds an engine that enables hardware acceleration
 through the AF_ALG kernel interface.
-See https://www.openssl.org/docs/man1.1.1/man5/config.html#Engine-Configuration-Module
+See https://www.openssl.org/docs/man3.0/man5/config.html#Engine-Configuration
 and https://openwrt.org/docs/techref/hardware/cryptographic.hardware.accelerators
 The engine_id is "afalg"
 endef
@@ -165,7 +197,7 @@ endef
 define Package/libopenssl-devcrypto/description
 This package adds an engine that enables hardware acceleration
 through the /dev/crypto kernel interface.
-See https://www.openssl.org/docs/man1.1.1/man5/config.html#Engine-Configuration-Module
+See https://www.openssl.org/docs/man3.0/man5/config.html#Engine-Configuration
 and https://openwrt.org/docs/techref/hardware/cryptographic.hardware.accelerators
 The engine_id is "devcrypto"
 endef
@@ -181,12 +213,12 @@ endef
 
 define Package/libopenssl-padlock/description
 This package adds an engine that enables VIA Padlock hardware acceleration.
-See https://www.openssl.org/docs/man1.1.1/man5/config.html#Engine-Configuration-Module
+See https://www.openssl.org/docs/man3.0/man5/config.html#Engine-Configuration
 and https://openwrt.org/docs/techref/hardware/cryptographic.hardware.accelerators
 The engine_id is "padlock"
 endef
 
-OPENSSL_OPTIONS:= shared
+OPENSSL_OPTIONS:= shared no-tests
 
 ifndef CONFIG_OPENSSL_WITH_BLAKE2
   OPENSSL_OPTIONS += no-blake2
@@ -258,7 +290,9 @@ endif
 
 ifeq ($(CONFIG_OPENSSL_OPTIMIZE_SPEED),y)
   TARGET_CFLAGS := $(filter-out -O%,$(TARGET_CFLAGS)) -O3
-else
+endif
+
+ifeq ($(CONFIG_OPENSSL_SMALL_FOOTPRINT),y)
   OPENSSL_OPTIONS += -DOPENSSL_SMALL_FOOTPRINT
 endif
 
@@ -272,7 +306,7 @@ ifdef CONFIG_OPENSSL_ENGINE
       OPENSSL_OPTIONS += enable-devcryptoeng
     endif
     ifndef CONFIG_OPENSSL_ENGINE_BUILTIN_PADLOCK
-      OPENSSL_OPTIONS += no-hw-padlock
+      OPENSSL_OPTIONS += no-padlockeng
     endif
   else
     ifdef CONFIG_PACKAGE_libopenssl-devcrypto
@@ -282,7 +316,7 @@ ifdef CONFIG_OPENSSL_ENGINE
       OPENSSL_OPTIONS += no-afalgeng
     endif
     ifndef CONFIG_PACKAGE_libopenssl-padlock
-      OPENSSL_OPTIONS += no-hw-padlock
+      OPENSSL_OPTIONS += no-padlockeng
     endif
   endif
 else
@@ -332,6 +366,7 @@ define Build/Configure
 			--libdir=lib \
 			--openssldir=/etc/ssl \
 			--cross-compile-prefix="$(TARGET_CROSS)" \
+			$(TARGET_CFLAGS) \
 			$(TARGET_CPPFLAGS) \
 			$(TARGET_LDFLAGS) \
 			$(OPENSSL_OPTIONS) && \
@@ -339,8 +374,7 @@ define Build/Configure
 	)
 endef
 
-TARGET_CFLAGS += $(FPIC) -ffunction-sections -fdata-sections
-TARGET_LDFLAGS += -Wl,--gc-sections
+TARGET_CFLAGS += $(FPIC)
 
 define Build/Compile
 	+$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \
@@ -377,17 +411,17 @@ define Package/libopenssl/install
 endef
 
 define Package/libopenssl-conf/install
-	$(INSTALL_DIR) $(1)/etc/ssl/engines.cnf.d $(1)/etc/config $(1)/etc/init.d
+	$(INSTALL_DIR) $(1)/etc/ssl/modules.cnf.d $(1)/etc/config $(1)/etc/init.d
 	$(CP) $(PKG_INSTALL_DIR)/etc/ssl/openssl.cnf $(1)/etc/ssl/
 	$(INSTALL_BIN) ./files/openssl.init $(1)/etc/init.d/openssl
 	$(SED) 's!%ENGINES_DIR%!/usr/lib/$(ENGINES_DIR)!' $(1)/etc/init.d/openssl
 	touch $(1)/etc/config/openssl
 	$(if $(CONFIG_OPENSSL_ENGINE_BUILTIN_DEVCRYPTO),
-		$(CP) ./files/devcrypto.cnf $(1)/etc/ssl/engines.cnf.d/
-		echo -e "config engine 'devcrypto'\n\toption enabled '1'" >> $(1)/etc/config/openssl)
+		$(CP) ./files/devcrypto.cnf $(1)/etc/ssl/modules.cnf.d/
+		echo -e "config engine 'devcrypto'\n\toption enabled '1'\n\toption builtin '1'" >> $(1)/etc/config/openssl)
 	$(if $(CONFIG_OPENSSL_ENGINE_BUILTIN_PADLOCK),
-		$(CP) ./files/padlock.cnf $(1)/etc/ssl/engines.cnf.d/
-		echo -e "\nconfig engine 'padlock'\n\toption enabled '1'" >> $(1)/etc/config/openssl)
+		$(CP) ./files/padlock.cnf $(1)/etc/ssl/modules.cnf.d/
+		echo -e "\nconfig engine 'padlock'\n\toption enabled '1'\n\toption builtin '1'" >> $(1)/etc/config/openssl)
 endef
 
 define Package/openssl-util/install
@@ -399,5 +433,6 @@ $(eval $(call BuildPackage,libopenssl))
 $(eval $(call BuildPackage,libopenssl-conf))
 $(eval $(call BuildPackage,libopenssl-afalg))
 $(eval $(call BuildPackage,libopenssl-devcrypto))
+$(eval $(call BuildPackage,libopenssl-legacy))
 $(eval $(call BuildPackage,libopenssl-padlock))
 $(eval $(call BuildPackage,openssl-util))
diff --git a/package/libs/openssl/files/afalg.cnf b/package/libs/openssl/files/afalg.cnf
index 4f573d757c87dd..fd206361bf353d 100644
--- a/package/libs/openssl/files/afalg.cnf
+++ b/package/libs/openssl/files/afalg.cnf
@@ -1,3 +1,3 @@
-[afalg]
+[afalg_sect]
 default_algorithms = ALL
 
diff --git a/package/libs/openssl/files/devcrypto.cnf b/package/libs/openssl/files/devcrypto.cnf
index 549275600d10f9..91d0eee17fa8d3 100644
--- a/package/libs/openssl/files/devcrypto.cnf
+++ b/package/libs/openssl/files/devcrypto.cnf
@@ -1,4 +1,4 @@
-[devcrypto]
+[devcrypto_sect]
 # Leave this alone and configure algorithms with CIPERS/DIGESTS below
 default_algorithms = ALL
 
@@ -17,8 +17,9 @@ default_algorithms = ALL
 # It is recommended to disable the ECB ciphers; in most cases, it will
 # only be used for PRNG, in small blocks, where performance is poor,
 # and there may be problems with apps forking with open crypto
-# contexts, leading to failures.  The CBC ciphers work well:
-#CIPHERS=DES-CBC, DES-EDE3-CBC, AES-128-CBC, AES-192-CBC, AES-256-CBC
+# contexts, leading to failures.  The CBC ciphers work well.
+CIPHERS=DES-CBC, DES-EDE3-CBC, AES-128-CBC, AES-192-CBC, AES-256-CBC, \
+	AES-128-CTR, AES-192-CTR, AES-256-CTR
 
 # DIGESTS: either ALL, NONE, or a comma-separated list of digests to
 # enable [default=NONE]
@@ -26,6 +27,8 @@ default_algorithms = ALL
 # is poor, and there are many cases in which they will not work,
 # especially when calling fork with open crypto contexts.  Openssh,
 # for example, does this, and you may not be able to login.
-#DIGESTS = NONE
-
+# Sysupgrade will fail as well.  If you're adventurous enough to change
+# this, you should change it back to NONE, and reboot before running
+# sysupgrade!
+DIGESTS = NONE
 
diff --git a/package/libs/openssl/files/legacy.cnf b/package/libs/openssl/files/legacy.cnf
new file mode 100644
index 00000000000000..4c20617444b28d
--- /dev/null
+++ b/package/libs/openssl/files/legacy.cnf
@@ -0,0 +1,3 @@
+[legacy_sect]
+activate = 1
+
diff --git a/package/libs/openssl/files/openssl.init b/package/libs/openssl/files/openssl.init
index 21e253e7a5616c..1c1e8745ffeb40 100755
--- a/package/libs/openssl/files/openssl.init
+++ b/package/libs/openssl/files/openssl.init
@@ -1,31 +1,72 @@
 #!/bin/sh /etc/rc.common
 
 START=13
-ENGINES_CNF_D="/etc/ssl/engines.cnf.d"
-ENGINES_CNF="/var/etc/ssl/engines.cnf"
-ENGINES_DIR="%ENGINES_DIR%"
+ENGINES_CNF=/var/etc/ssl/engines.cnf
+ENGINES_DIR=%ENGINES_DIR%
+MODULES_DIR=/usr/lib/ossl-modules
+PROVIDERS_CNF=/var/etc/ssl/providers.cnf
 
-config_engine() {
-	local enabled force
+#1: cnf file
+write_cnf_header() {
+	mkdir -p "$(dirname "$1")" && \
+	echo "# This file is automatically generated from /etc/config/openssl." >"$1" || {
+		echo "Error writing to $1."
+		return 1
+	}
+}
+
+
+#1: module name
+#2: output cnf file
+#3: module.so
+enable_module() {
+	local builtin enabled force
+
+	config_get_bool builtin "$1" builtin 0
 	config_get_bool enabled "$1" enabled 1
 	config_get_bool force "$1" force 0
-	[ "$enabled" = 0 ] && return
-	if [ "$force" = 0 ] && \
-	   [ ! -f "${ENGINES_CNF_D}/$1.cnf" ] && \
-	   [ ! -f "${ENGINES_DIR}/$1.so" ]; then
-	    echo Skipping engine "$1": not installed
-	    return
+
+	if [ "$enabled" = 0 ]; then
+		[ "$builtin" = 0 ] && return 1
+		echo "Engine $1 is built into the libcrypto library and can't be disabled through UCI."
+		echo "If the engine was not built-in, remove 'config builtin' from /etc/config/openssl."
+	elif [ "$force" = 1 ]; then
+		printf "[Forced] "
+	elif ! grep -q "\\[ *$1_sect *]" /etc/ssl/modules.cnf.d/*; then
+		echo "$1: Could not find section [$1] in config files."
+		return 1
+	elif [ "$builtin" = 1 ]; then
+		printf "[Builtin] "
+	elif [ ! -f "$3" ];then
+		echo "Skipping $1: $3 not found."
+		return 1
 	fi
-	echo Enabling engine "$1"
-	echo "$1=$1" >> "${ENGINES_CNF}"
+	echo "Enabling $1"
+	echo "$1=$1_sect" >>"$2"
+}
+
+config_engine() {
+	enable_module "$1" "$ENGINES_CNF" \
+		      "${ENGINES_DIR}/${1}.so"
+}
+
+config_provider() {
+	enable_module "$1" "$PROVIDERS_CNF" \
+		      "${MODULES_DIR}/${1}.so"
 }
 
 start() {
-	mkdir -p "$(dirname "${ENGINES_CNF}")" || exit 1
-	echo Generating engines.cnf
-	echo "# This file is automatically generated from /etc/config/openssl." \
-	      > "${ENGINES_CNF}" || \
-	      { echo Error writing ${ENGINES_CNF} >&2; exit 1; }
+	local ret=0
+
         config_load openssl
-	config_foreach config_engine engine
+
+	echo Generating engines.cnf
+	write_cnf_header "${ENGINES_CNF}" && \
+	config_foreach config_engine engine || ret=$?
+
+	echo Generating providers.cnf
+	write_cnf_header "${PROVIDERS_CNF}" && \
+	config_foreach config_provider provider || ret=$?
+
+	return $ret
 }
diff --git a/package/libs/openssl/files/padlock.cnf b/package/libs/openssl/files/padlock.cnf
index ef91079e5d1416..f4085d907b4e20 100644
--- a/package/libs/openssl/files/padlock.cnf
+++ b/package/libs/openssl/files/padlock.cnf
@@ -1,3 +1,3 @@
-[padlock]
+[padlock_sect]
 default_algorithms = ALL
 
diff --git a/package/libs/openssl/patches/100-Configure-afalg-support.patch b/package/libs/openssl/patches/100-Configure-afalg-support.patch
index 3125e37a948b91..e9cd7bf9c1afa6 100644
--- a/package/libs/openssl/patches/100-Configure-afalg-support.patch
+++ b/package/libs/openssl/patches/100-Configure-afalg-support.patch
@@ -8,10 +8,9 @@ version to disable building the AFALG engine on openwrt targets.
 
 Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
 
-diff --git a/Configure b/Configure
 --- a/Configure
 +++ b/Configure
-@@ -1548,7 +1548,9 @@ unless ($disabled{"crypto-mdebug-backtrace"})
+@@ -1677,7 +1677,9 @@ $config{CFLAGS} = [ map { $_ eq '--ossl-
  
  unless ($disabled{afalgeng}) {
      $config{afalgeng}="";
diff --git a/package/libs/openssl/patches/110-openwrt_targets.patch b/package/libs/openssl/patches/110-openwrt_targets.patch
index 9d5db6cfd130b8..a97c603fa7c224 100644
--- a/package/libs/openssl/patches/110-openwrt_targets.patch
+++ b/package/libs/openssl/patches/110-openwrt_targets.patch
@@ -7,11 +7,9 @@ Targets are named: linux-$(CONFIG_ARCH)-openwrt
 
 Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
 
-diff --git a/Configurations/25-openwrt.conf b/Configurations/25-openwrt.conf
-new file mode 100644
 --- /dev/null
 +++ b/Configurations/25-openwrt.conf
-@@ -0,0 +1,52 @@
+@@ -0,0 +1,56 @@
 +## Openwrt "CONFIG_ARCH" matching targets.
 +
 +# The targets need to end in '-openwrt' for the AFALG patch to work
@@ -25,7 +23,7 @@ new file mode 100644
 +        inherit_from    => [ "linux-aarch64", "openwrt" ],
 +    },
 +    "linux-arc-openwrt" => {
-+        inherit_from    => [ "linux-generic32", "openwrt" ],
++        inherit_from    => [ "linux-latomic", "openwrt" ],
 +    },
 +    "linux-arm-openwrt" => {
 +        inherit_from    => [ "linux-armv4", "openwrt" ],
@@ -55,6 +53,10 @@ new file mode 100644
 +        inherit_from    => [ "linux-ppc64", "openwrt" ],
 +        perlasm_scheme  => "linux64v2",
 +    },
++    "linux-riscv64-openwrt" => {
++        inherit_from    => [ "linux-generic64", "openwrt" ],
++        perlasm_scheme   => "linux64",
++    },
 +    "linux-x86_64-openwrt" => {
 +        inherit_from    => [ "linux-x86_64", "openwrt" ],
 +    },
diff --git a/package/libs/openssl/patches/120-strip-cflags-from-binary.patch b/package/libs/openssl/patches/120-strip-cflags-from-binary.patch
index 20fe21f2acf03c..c4f2540395b415 100644
--- a/package/libs/openssl/patches/120-strip-cflags-from-binary.patch
+++ b/package/libs/openssl/patches/120-strip-cflags-from-binary.patch
@@ -8,15 +8,14 @@ OpenSSL_version(OPENSSL_CFLAGS), or running openssl version -a
 
 Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
 
-diff --git a/crypto/build.info b/crypto/build.info
 --- a/crypto/build.info
 +++ b/crypto/build.info
-@@ -10,7 +10,7 @@ EXTRA=  ../ms/uplink-x86.pl ../ms/uplink.c ../ms/applink.c \
-         ppccpuid.pl pariscid.pl alphacpuid.pl arm64cpuid.pl armv4cpuid.pl
+@@ -111,7 +111,7 @@ DEFINE[../libcrypto]=$UPLINKDEF
  
+ DEPEND[info.o]=buildinf.h
  DEPEND[cversion.o]=buildinf.h
 -GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC) $(LIB_CFLAGS) $(CPPFLAGS_Q)" "$(PLATFORM)"
 +GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(filter-out -I% -iremap% -fmacro-prefix-map% -ffile-prefix-map%,$(CC) $(LIB_CFLAGS) $(CPPFLAGS_Q))" "$(PLATFORM)"
- DEPEND[buildinf.h]=../configdata.pm
  
- GENERATE[uplink-x86.s]=../ms/uplink-x86.pl $(PERLASM_SCHEME)
+ GENERATE[uplink-x86.S]=../ms/uplink-x86.pl
+ GENERATE[uplink-x86_64.s]=../ms/uplink-x86_64.pl
diff --git a/package/libs/openssl/patches/130-dont-build-fuzz-docs.patch b/package/libs/openssl/patches/130-dont-build-fuzz-docs.patch
new file mode 100644
index 00000000000000..60c466392394e1
--- /dev/null
+++ b/package/libs/openssl/patches/130-dont-build-fuzz-docs.patch
@@ -0,0 +1,20 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Eneas U de Queiroz <cote2004-github@yahoo.com>
+Date: Thu, 27 Sep 2018 08:34:38 -0300
+Subject: Do not build tests and fuzz directories
+
+This shortens build time.
+
+Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
+
+--- a/build.info
++++ b/build.info
+@@ -1,7 +1,7 @@
+ # Note that some of these directories are filtered in Configure.  Look for
+ # %skipdir there for further explanations.
+ 
+-SUBDIRS=crypto ssl apps util tools fuzz providers doc
++SUBDIRS=crypto ssl apps util tools providers
+ IF[{- !$disabled{tests} -}]
+   SUBDIRS=test
+ ENDIF
diff --git a/package/libs/openssl/patches/140-allow-prefer-chacha20.patch b/package/libs/openssl/patches/140-allow-prefer-chacha20.patch
index b2418006a9cc28..43fd92e3886cff 100644
--- a/package/libs/openssl/patches/140-allow-prefer-chacha20.patch
+++ b/package/libs/openssl/patches/140-allow-prefer-chacha20.patch
@@ -14,32 +14,9 @@ when the client has it on top of its ciphersuite preference.
 
 Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
 
-diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h
---- a/include/openssl/ssl.h
-+++ b/include/openssl/ssl.h
-@@ -173,9 +173,15 @@ extern "C" {
- # define SSL_DEFAULT_CIPHER_LIST "ALL:!COMPLEMENTOFDEFAULT:!eNULL"
- /* This is the default set of TLSv1.3 ciphersuites */
- # if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
--#  define TLS_DEFAULT_CIPHERSUITES "TLS_AES_256_GCM_SHA384:" \
--                                   "TLS_CHACHA20_POLY1305_SHA256:" \
--                                   "TLS_AES_128_GCM_SHA256"
-+#  ifdef OPENSSL_PREFER_CHACHA_OVER_GCM
-+#   define TLS_DEFAULT_CIPHERSUITES "TLS_CHACHA20_POLY1305_SHA256:" \
-+                                    "TLS_AES_256_GCM_SHA384:" \
-+                                    "TLS_AES_128_GCM_SHA256"
-+#  else
-+#   define TLS_DEFAULT_CIPHERSUITES "TLS_AES_256_GCM_SHA384:" \
-+                                    "TLS_CHACHA20_POLY1305_SHA256:" \
-+                                    "TLS_AES_128_GCM_SHA256"
-+#  endif
- # else
- #  define TLS_DEFAULT_CIPHERSUITES "TLS_AES_256_GCM_SHA384:" \
-                                    "TLS_AES_128_GCM_SHA256"
-diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
 --- a/ssl/ssl_ciph.c
 +++ b/ssl/ssl_ciph.c
-@@ -1467,11 +1467,29 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
+@@ -1505,11 +1505,29 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
      ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head,
                            &tail);
  
@@ -69,7 +46,7 @@ diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
  
      /*
       * ...and generally, our preferred cipher is AES.
-@@ -1527,7 +1545,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
+@@ -1564,7 +1582,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
       * Within each group, ciphers remain sorted by strength and previous
       * preference, i.e.,
       * 1) ECDHE > DHE
@@ -78,3 +55,38 @@ diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
       * 3) AES > rest
       * 4) TLS 1.2 > legacy
       *
+@@ -2235,7 +2253,13 @@ const char *OSSL_default_cipher_list(voi
+  */
+ const char *OSSL_default_ciphersuites(void)
+ {
++#ifdef OPENSSL_PREFER_CHACHA_OVER_GCM
++    return "TLS_CHACHA20_POLY1305_SHA256:"
++           "TLS_AES_256_GCM_SHA384:"
++           "TLS_AES_128_GCM_SHA256";
++#else
+     return "TLS_AES_256_GCM_SHA384:"
+            "TLS_CHACHA20_POLY1305_SHA256:"
+            "TLS_AES_128_GCM_SHA256";
++#endif
+ }
+--- a/include/openssl/ssl.h.in
++++ b/include/openssl/ssl.h.in
+@@ -195,9 +195,15 @@ extern "C" {
+  * DEPRECATED IN 3.0.0, in favor of OSSL_default_ciphersuites()
+  * Update both macro and function simultaneously
+  */
+-#  define TLS_DEFAULT_CIPHERSUITES "TLS_AES_256_GCM_SHA384:" \
+-                                   "TLS_CHACHA20_POLY1305_SHA256:" \
+-                                   "TLS_AES_128_GCM_SHA256"
++#  ifdef OPENSSL_PREFER_CHACHA_OVER_GCM
++#   define TLS_DEFAULT_CIPHERSUITES "TLS_CHACHA20_POLY1305_SHA256:" \
++                                    "TLS_AES_256_GCM_SHA384:" \
++                                    "TLS_AES_128_GCM_SHA256"
++#  else
++#   define TLS_DEFAULT_CIPHERSUITES "TLS_AES_256_GCM_SHA384:" \
++                                    "TLS_CHACHA20_POLY1305_SHA256:" \
++                                    "TLS_AES_128_GCM_SHA256"
++#  endif
+ # endif
+ /*
+  * As of OpenSSL 1.0.0, ssl_create_cipher_list() in ssl/ssl_ciph.c always
diff --git a/package/libs/openssl/patches/150-openssl.cnf-add-engines-conf.patch b/package/libs/openssl/patches/150-openssl.cnf-add-engines-conf.patch
index 88511163478c2e..9fe9cdf590cdbf 100644
--- a/package/libs/openssl/patches/150-openssl.cnf-add-engines-conf.patch
+++ b/package/libs/openssl/patches/150-openssl.cnf-add-engines-conf.patch
@@ -8,23 +8,34 @@ This adds configuration options for engines, loading all cnf files under
 
 Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
 
-diff --git a/apps/openssl.cnf b/apps/openssl.cnf
 --- a/apps/openssl.cnf
 +++ b/apps/openssl.cnf
-@@ -22,6 +22,16 @@ oid_section		= new_oids
- # (Alternatively, use a configuration file that has only
- # X.509v3 extensions in its main [= default] section.)
+@@ -52,10 +52,13 @@ tsa_policy3 = 1.2.3.4.5.7
  
-+openssl_conf=openssl_conf
+ [openssl_init]
+ providers = provider_sect
++engines = engines_sect
+ 
+ # List of providers to load
+ [provider_sect]
+ default = default_sect
++.include /var/etc/ssl/providers.cnf
 +
-+[openssl_conf]
-+engines=engines
+ # The fips section name should match the section name inside the
+ # included fipsmodule.cnf.
+ # fips = fips_sect
+@@ -69,7 +72,13 @@ default = default_sect
+ # OpenSSL may not work correctly which could lead to significant system
+ # problems including inability to remotely access the system.
+ [default_sect]
+-# activate = 1
++activate = 1
 +
-+[engines]
++[engines_sect]
 +.include /var/etc/ssl/engines.cnf
 +
-+.include /etc/ssl/engines.cnf.d
++.include /etc/ssl/modules.cnf.d
 +
- [ new_oids ]
  
- # We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
+ 
+ ####################################################################
diff --git a/package/libs/openssl/patches/500-e_devcrypto-default-to-not-use-digests-in-engine.patch b/package/libs/openssl/patches/500-e_devcrypto-default-to-not-use-digests-in-engine.patch
index fd4701307e5123..f1832638586696 100644
--- a/package/libs/openssl/patches/500-e_devcrypto-default-to-not-use-digests-in-engine.patch
+++ b/package/libs/openssl/patches/500-e_devcrypto-default-to-not-use-digests-in-engine.patch
@@ -19,10 +19,9 @@ turn them on if it is safe and fast enough.
 
 Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
 
-diff --git a/engines/e_devcrypto.c b/engines/e_devcrypto.c
 --- a/engines/e_devcrypto.c
 +++ b/engines/e_devcrypto.c
-@@ -852,7 +852,7 @@ static void prepare_digest_methods(void)
+@@ -905,7 +905,7 @@ static void prepare_digest_methods(void)
      for (i = 0, known_digest_nids_amount = 0; i < OSSL_NELEM(digest_data);
           i++) {
  
@@ -31,7 +30,7 @@ diff --git a/engines/e_devcrypto.c b/engines/e_devcrypto.c
  
          /*
           * Check that the digest is usable
-@@ -1072,7 +1072,7 @@ static const ENGINE_CMD_DEFN devcrypto_cmds[] = {
+@@ -1119,7 +1119,7 @@ static const ENGINE_CMD_DEFN devcrypto_c
  #ifdef IMPLEMENT_DIGEST
     {DEVCRYPTO_CMD_DIGESTS,
      "DIGESTS",
diff --git a/package/libs/openssl/patches/510-e_devcrypto-ignore-error-when-closing-session.patch b/package/libs/openssl/patches/510-e_devcrypto-ignore-error-when-closing-session.patch
index bf1c98b1040d9d..40b1dc78d3195f 100644
--- a/package/libs/openssl/patches/510-e_devcrypto-ignore-error-when-closing-session.patch
+++ b/package/libs/openssl/patches/510-e_devcrypto-ignore-error-when-closing-session.patch
@@ -8,11 +8,10 @@ session.  It may have been closed by another process after a fork.
 
 Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
 
-diff --git a/engines/e_devcrypto.c b/engines/e_devcrypto.c
 --- a/engines/e_devcrypto.c
 +++ b/engines/e_devcrypto.c
-@@ -195,9 +195,8 @@ static int cipher_init(EVP_CIPHER_CTX *ctx, const unsigned char *key,
-         get_cipher_data(EVP_CIPHER_CTX_nid(ctx));
+@@ -211,9 +211,8 @@ static int cipher_init(EVP_CIPHER_CTX *c
+     int ret;
  
      /* cleanup a previous session */
 -    if (cipher_ctx->sess.ses != 0 &&
diff --git a/package/libs/pcre2/Config.in b/package/libs/pcre2/Config.in
new file mode 100644
index 00000000000000..8777a4e84cbe16
--- /dev/null
+++ b/package/libs/pcre2/Config.in
@@ -0,0 +1,30 @@
+config PCRE2_JIT_ENABLED
+	bool
+	depends on PACKAGE_libpcre2 && (aarch64 || aarch64_be || arm || i386 || i686 || x86_64 || mips || mipsel || mips64 || mips64el || powerpc || powerpc64 || powerpcle || sparc)
+	default y if (arm || i686 || x86_64)
+	prompt "Enable JIT compiler support"
+	help
+		Enable JIT (Just-In-Time) compiler support.
+
+		Just-in-time compiling is a heavyweight optimization that can greatly
+		speed up pattern matching. However, it comes at the cost of extra
+		processing before the match is performed, so it is of most benefit when
+		the same pattern is going to be matched many times. This does not
+		necessarily mean many calls of a matching function; if the pattern is
+		not anchored, matching attempts may take place many times at various
+		positions in the subject, even for a single call. Therefore, if the
+		subject string is very long, it may still pay to use JIT even for
+		one-off matches. JIT support is available for all of the 8-bit, 16-bit
+		and 32-bit PCRE2 libraries and adds about 100KB to the resulting
+		libpcre2.so. JIT support applies only to the traditional Perl-compatible
+		matching function. It does not apply when the DFA matching function is
+		being used.
+
+		Enabling this option can give an about 10x performance increase on JIT
+		operations. It can be desireable for e.g. high performance Apache
+		mod_rewrite or HA-Proxy reqrep operations.
+
+		However, JIT should _only_ be enabled on architectures that are supported.
+		Enabling JIT on unsupported platforms will result in a compilation
+		failure. A list of supported architectures can be found here:
+		https://pcre.org/current/doc/html/pcre2jit.html#SEC2
diff --git a/package/libs/pcre2/Makefile b/package/libs/pcre2/Makefile
new file mode 100644
index 00000000000000..fa4282cee8ca80
--- /dev/null
+++ b/package/libs/pcre2/Makefile
@@ -0,0 +1,109 @@
+#
+# Copyright (C) 2017 Shane Peelar
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=pcre2
+PKG_VERSION:=10.42
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
+PKG_SOURCE_URL:=https://github.com/PCRE2Project/pcre2/releases/download/$(PKG_NAME)-$(PKG_VERSION)
+PKG_HASH:=8d36cd8cb6ea2a4c2bb358ff6411b0c788633a2a45dabbf1aeb4b701d1b5e840
+
+PKG_MAINTAINER:=Shane Peelar <lookatyouhacker@gmail.com>
+PKG_LICENSE:=BSD-3-Clause
+PKG_LICENSE_FILES:=LICENCE
+PKG_CPE_ID:=cpe:/a:pcre:pcre
+
+PKG_CONFIG_DEPENDS:=\
+	CONFIG_PACKAGE_libpcre2-16 \
+	CONFIG_PACKAGE_libpcre2-32 \
+	CONFIG_PCRE2_JIT_ENABLED
+
+PKG_BUILD_DEPENDS:=zlib
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/host-build.mk
+include $(INCLUDE_DIR)/cmake.mk
+
+define Package/libpcre2/default
+  SECTION:=libs
+  CATEGORY:=Libraries
+  URL:=https://www.pcre.org/
+endef
+
+define Package/libpcre2/config
+  source "$(SOURCE)/Config.in"
+endef
+
+define Package/libpcre2
+  $(call Package/libpcre2/default)
+  TITLE:=A Perl Compatible Regular Expression library
+endef
+
+define Package/libpcre2-16
+  $(call Package/libpcre2/default)
+  TITLE:=A Perl Compatible Regular Expression library (16bit support)
+endef
+
+define Package/libpcre2-32
+  $(call Package/libpcre2/default)
+  TITLE:=A Perl Compatible Regular Expression library (32bit support)
+endef
+
+CMAKE_HOST_OPTIONS += \
+	-DBUILD_SHARED_LIBS=OFF \
+	-DPCRE2_BUILD_PCRE2_8=ON \
+	-DPCRE2_BUILD_PCRE2_16=ON \
+	-DPCRE2_BUILD_PCRE2_32=ON \
+	-DPCRE2_DEBUG=OFF \
+	-DPCRE2_DISABLE_PERCENT_ZT=ON \
+	-DPCRE2_SUPPORT_JIT=OFF \
+	-DPCRE2_SHOW_REPORT=OFF \
+	-DPCRE2_BUILD_PCRE2GREP=OFF \
+	-DPCRE2_BUILD_TESTS=OFF \
+	-DPCRE2_STATIC_PIC=ON
+
+CMAKE_OPTIONS += \
+	-DBUILD_SHARED_LIBS=ON \
+	-DPCRE2_BUILD_PCRE2_8=ON \
+	-DPCRE2_BUILD_PCRE2_16=O$(if $(CONFIG_PACKAGE_libpcre2-16),N,FF) \
+	-DPCRE2_BUILD_PCRE2_32=O$(if $(CONFIG_PACKAGE_libpcre2-32),N,FF) \
+	-DPCRE2_DEBUG=OFF \
+	-DPCRE2_DISABLE_PERCENT_ZT=ON \
+	-DPCRE2_SUPPORT_JIT=O$(if $(CONFIG_PCRE2_JIT_ENABLED),N,FF) \
+	-DPCRE2_SHOW_REPORT=OFF \
+	-DPCRE2_BUILD_PCRE2GREP=OFF \
+	-DPCRE2_BUILD_TESTS=OFF
+
+define Build/InstallDev
+	$(call Build/InstallDev/cmake,$(1))
+	$(SED) 	's,^\(prefix\|exec_prefix\)=.*,\1=$(STAGING_DIR)/usr,g' $(1)/usr/bin/pcre2-config
+	$(INSTALL_DIR) $(2)/bin
+	$(LN) ../../usr/bin/pcre2-config $(2)/bin/pcre2-config
+endef
+
+define Package/libpcre2/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre2-{8,posix}.so* $(1)/usr/lib/
+endef
+
+define Package/libpcre2-16/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre2-16.so* $(1)/usr/lib/
+endef
+
+define Package/libpcre2-32/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre2-32.so* $(1)/usr/lib/
+endef
+
+$(eval $(call BuildPackage,libpcre2))
+$(eval $(call BuildPackage,libpcre2-16))
+$(eval $(call BuildPackage,libpcre2-32))
+$(eval $(call HostBuild))
diff --git a/package/libs/popt/Makefile b/package/libs/popt/Makefile
index 5b8b870111a9fd..ad767b8eede5b4 100644
--- a/package/libs/popt/Makefile
+++ b/package/libs/popt/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=popt
-PKG_VERSION:=1.18
+PKG_VERSION:=1.19
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=http://ftp.rpm.org/popt/releases/popt-1.x/
-PKG_HASH:=5159bc03a20b28ce363aa96765f37df99ea4d8850b1ece17d1e6ad5c24fdc5d1
+PKG_HASH:=c25a4838fc8e4c1c8aacb8bd620edb3084a3d63bf8987fdad3ca2758c63240f9
 PKG_LICENSE:=MIT
 
 PKG_FIXUP:=autoreconf
diff --git a/package/libs/popt/patches/100-configure.ac-remove-require-gettext-version.patch b/package/libs/popt/patches/100-configure.ac-remove-require-gettext-version.patch
new file mode 100644
index 00000000000000..24ad076433ef9c
--- /dev/null
+++ b/package/libs/popt/patches/100-configure.ac-remove-require-gettext-version.patch
@@ -0,0 +1,26 @@
+From 19d21b2d9e5aea5f73b1709b3c7803f920471146 Mon Sep 17 00:00:00 2001
+From: Nick Hainke <vincent@systemli.org>
+Date: Sun, 25 Sep 2022 11:52:29 +0200
+Subject: [PATCH] configure.ac: remove require gettext version
+
+This breaks compilation with OpenWrt:
+./configure: line 13059: syntax error near unexpected token `0.19.8'
+./configure: line 13059: `AM_GNU_GETTEXT_REQUIRE_VERSION(0.19.8)'
+
+Fixes: bf8dd64e8aa0 ("Update gettext autoconf usage")
+
+Signed-off-by: Nick Hainke <vincent@systemli.org>
+---
+ configure.ac | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/configure.ac
++++ b/configure.ac
+@@ -53,7 +53,6 @@ AC_SEARCH_LIBS([setreuid], [ucb])
+ AC_CHECK_FUNCS([getuid geteuid iconv mtrace secure_getenv __secure_getenv setreuid setuid stpcpy strerror vasprintf srandom glob_pattern_p mbsrtowcs])
+ 
+ AM_GNU_GETTEXT_VERSION([0.19.8])
+-AM_GNU_GETTEXT_REQUIRE_VERSION([0.19.8])
+ AM_GNU_GETTEXT([external])
+ AM_ICONV_LINK
+ 
diff --git a/package/libs/readline/Makefile b/package/libs/readline/Makefile
index a6ceec1fce8391..015a1ae2da952f 100644
--- a/package/libs/readline/Makefile
+++ b/package/libs/readline/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=readline
-PKG_VERSION:=8.1.2
+PKG_VERSION:=8.2
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=@GNU/readline
-PKG_HASH:=7589a2381a8419e68654a47623ce7dfcb756815c8fee726b98f90bf668af7bc6
+PKG_HASH:=3feb7171f16a84ee82ca18a36d7b9be109a52c04f492a053331d7d1095007c35
 
 PKG_LICENSE:=GPL-3.0-or-later
 PKG_LICENSE_FILES:=COPYING
diff --git a/package/libs/sysfsutils/Makefile b/package/libs/sysfsutils/Makefile
index 8ce9a40f9145ff..ff676308dab5af 100644
--- a/package/libs/sysfsutils/Makefile
+++ b/package/libs/sysfsutils/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sysfsutils
 PKG_VERSION:=2.1.0
-PKG_RELEASE:=3
+PKG_RELEASE:=4
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=@SF/linux-diag
diff --git a/package/libs/sysfsutils/files/sysfsutils b/package/libs/sysfsutils/files/sysfsutils
index 0305ca82a9d574..3c5b35e78d3dd0 100644
--- a/package/libs/sysfsutils/files/sysfsutils
+++ b/package/libs/sysfsutils/files/sysfsutils
@@ -4,6 +4,8 @@
 # Based on Debian's script /etc/init.d/sysfsutils by
 # Martin Pitt <mpitt@debian.org>
 
+START=11
+
 load_conffile() {
 	FILE="$1"
 	sed  's/#.*$//; /^[[:space:]]*$/d;
@@ -39,7 +41,6 @@ load_conffile() {
 	}
 }
 
-START=11
 start() {
 	for file in /etc/sysfs.conf /etc/sysfs.d/*.conf; do
 		[ -r "$file" ] || continue
diff --git a/package/libs/uclient/Makefile b/package/libs/uclient/Makefile
index 398a27bb98bc49..d7d1f1bb1f5f40 100644
--- a/package/libs/uclient/Makefile
+++ b/package/libs/uclient/Makefile
@@ -5,9 +5,9 @@ PKG_RELEASE=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/uclient.git
-PKG_MIRROR_HASH:=7c443cac02a734dd312c65618f4de17248d188317f30a9fac192c1503b3d5c05
-PKG_SOURCE_DATE:=2021-05-14
-PKG_SOURCE_VERSION:=6a6011df3429ffa5958d12b1327eeda4fd9daa47
+PKG_MIRROR_HASH:=16c6c97f45d9737fb40628ea22ae347541a1e37d8d1576e04ffbaa5fc92f3b6d
+PKG_SOURCE_DATE:=2023-04-13
+PKG_SOURCE_VERSION:=007d945467499f43656b141171d31f5643b83a6c
 CMAKE_INSTALL:=1
 
 PKG_BUILD_DEPENDS:=ustream-ssl
diff --git a/package/libs/ustream-ssl/Makefile b/package/libs/ustream-ssl/Makefile
index a5e34a73b444a0..ae5c8026c208e5 100644
--- a/package/libs/ustream-ssl/Makefile
+++ b/package/libs/ustream-ssl/Makefile
@@ -5,9 +5,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/ustream-ssl.git
-PKG_SOURCE_DATE:=2022-01-16
-PKG_SOURCE_VERSION:=868fd8812f477c110f9c6c5252c0bd172167b94c
-PKG_MIRROR_HASH:=dd28d5e846b391917cf83d66176653bdfa4e8a0d5b11144b65a012fe7693ddeb
+PKG_SOURCE_DATE:=2023-02-25
+PKG_SOURCE_VERSION:=498f6e268d4d2b0ad33b430f4ba1abe397d31496
+PKG_MIRROR_HASH:=a201d065dd613e30886c9f13a0851cec79538192cfe591b6f8ecd88724d55fb1
 CMAKE_INSTALL:=1
 
 PKG_LICENSE:=ISC
diff --git a/package/libs/wolfssl/Config.in b/package/libs/wolfssl/Config.in
index 4b9db4d1079b40..7c154ccb315020 100644
--- a/package/libs/wolfssl/Config.in
+++ b/package/libs/wolfssl/Config.in
@@ -1,4 +1,4 @@
-if PACKAGE_libwolfssl
+menu "wolfSSL Library Configuration"
 
 config WOLFSSL_HAS_AES_CCM
 	bool "Include AES-CCM support"
@@ -66,38 +66,31 @@ config WOLFSSL_ALT_NAMES
 config WOLFSSL_HAS_DEVCRYPTO
 	bool
 
-config WOLFSSL_ASM_CAPABLE
-	bool
-	default x86_64 || (aarch64 && !TARGET_bcm27xx)
-
-choice
-	prompt "Hardware Acceleration"
-	default WOLFSSL_HAS_NO_HW
-
-	config WOLFSSL_HAS_NO_HW
-		bool "None"
-
-	config WOLFSSL_HAS_CPU_CRYPTO
-		bool "Use CPU crypto instructions"
-		depends on WOLFSSL_ASM_CAPABLE
-		help
-		This will use Intel AESNI insturctions or armv8 Crypto Extensions.
-		Either of them should easily outperform hardware crypto in WolfSSL.
-
-	config WOLFSSL_HAS_AFALG
-		bool "AF_ALG"
-
-	config WOLFSSL_HAS_DEVCRYPTO_CBC
-		bool "/dev/crytpo - AES-CBC-only"
-		select WOLFSSL_HAS_DEVCRYPTO
-
-	config WOLFSSL_HAS_DEVCRYPTO_AES
-		bool "/dev/crypto - AES-only (all supported modes)"
-		select WOLFSSL_HAS_DEVCRYPTO
-
-	config WOLFSSL_HAS_DEVCRYPTO_FULL
-		bool "/dev/crypto - full"
-		select WOLFSSL_HAS_DEVCRYPTO
-endchoice
-
+if PACKAGE_libwolfssl
+	if PACKAGE_libwolfsslcpu-crypto
+		comment "Hardware Acceleration does not apply to libwolfsslcpu-crypto"
+	endif
+	choice
+		prompt "Hardware Acceleration"
+		default WOLFSSL_HAS_NO_HW
+
+		config WOLFSSL_HAS_NO_HW
+			bool "None"
+
+		config WOLFSSL_HAS_AFALG
+			bool "AF_ALG"
+
+		config WOLFSSL_HAS_DEVCRYPTO_CBC
+			bool "/dev/crypto - AES-CBC-only"
+			select WOLFSSL_HAS_DEVCRYPTO
+
+		config WOLFSSL_HAS_DEVCRYPTO_AES
+			bool "/dev/crypto - AES-only (all supported modes)"
+			select WOLFSSL_HAS_DEVCRYPTO
+
+		config WOLFSSL_HAS_DEVCRYPTO_FULL
+			bool "/dev/crypto - full"
+			select WOLFSSL_HAS_DEVCRYPTO
+	endchoice
 endif
+endmenu
diff --git a/package/libs/wolfssl/Makefile b/package/libs/wolfssl/Makefile
index ee07081cfd8d17..d9426d75fc303d 100644
--- a/package/libs/wolfssl/Makefile
+++ b/package/libs/wolfssl/Makefile
@@ -8,16 +8,16 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wolfssl
-PKG_VERSION:=5.5.0-stable
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_VERSION:=5.5.4-stable
+PKG_RELEASE:=4
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/wolfSSL/wolfssl/archive/v$(PKG_VERSION)
-PKG_HASH:=c34b74b5f689fac7becb05583b044e84d3b10d39f38709f0095dd5d423ded67f
+PKG_HASH:=b7ee150e49def77c765bc02aac92ddeb0bebefd4cb12aa263d8f95e405221fb8
 
 PKG_FIXUP:=libtool libtool-abiver
 PKG_INSTALL:=1
-PKG_USE_MIPS16:=0
+PKG_BUILD_FLAGS:=no-mips16 lto
 PKG_BUILD_PARALLEL:=1
 PKG_LICENSE:=GPL-2.0-or-later
 PKG_LICENSE_FILES:=LICENSING COPYING
@@ -25,7 +25,6 @@ PKG_MAINTAINER:=Eneas U de Queiroz <cotequeiroz@gmail.com>
 PKG_CPE_ID:=cpe:/a:wolfssl:wolfssl
 
 PKG_CONFIG_DEPENDS:=\
-	CONFIG_PACKAGE_libwolfssl-benchmark \
 	CONFIG_WOLFSSL_HAS_AES_CCM \
 	CONFIG_WOLFSSL_HAS_ARC4 \
 	CONFIG_WOLFSSL_HAS_CERTGEN \
@@ -44,8 +43,8 @@ PKG_CONFIG_DEPENDS:=\
 PKG_ABI_VERSION:=$(patsubst %-stable,%,$(PKG_VERSION)).$(call version_abbrev,$(call confvar,$(PKG_CONFIG_DEPENDS)))
 
 PKG_CONFIG_DEPENDS+=\
+	CONFIG_PACKAGE_libwolfssl-benchmark \
 	CONFIG_WOLFSSL_HAS_AFALG \
-	CONFIG_WOLFSSL_HAS_CPU_CRYPTO \
 	CONFIG_WOLFSSL_HAS_DEVCRYPTO_AES \
 	CONFIG_WOLFSSL_HAS_DEVCRYPTO_CBC \
 	CONFIG_WOLFSSL_HAS_DEVCRYPTO_FULL
@@ -66,6 +65,9 @@ $(call Package/libwolfssl/Default)
   PROVIDES:=libcyassl
   DEPENDS:=+WOLFSSL_HAS_DEVCRYPTO:kmod-cryptodev +WOLFSSL_HAS_AFALG:kmod-crypto-user
   ABI_VERSION:=$(PKG_ABI_VERSION)
+  VARIANT:=regular
+  DEFAULT_VARIANT:=1
+  CONFLICTS:=libwolfsslcpu-crypto
 endef
 
 define Package/libwolfssl/description
@@ -77,12 +79,38 @@ define Package/libwolfssl/config
 	source "$(SOURCE)/Config.in"
 endef
 
+define Package/libwolfsslcpu-crypto
+$(call Package/libwolfssl/Default)
+  TITLE:=wolfSSL library with AES CPU instructions
+  PROVIDES:=libwolfssl libcyassl
+  DEPENDS:=@((aarch64||x86_64)&&(m||!TARGET_bcm27xx))
+  ABI_VERSION:=$(PKG_ABI_VERSION)
+  VARIANT:=cpu-crypto
+endef
+
 define Package/libwolfssl-benchmark
 $(call Package/libwolfssl/Default)
   TITLE:=wolfSSL Benchmark Utility
   DEPENDS:=libwolfssl
 endef
 
+define Package/libwolfsslcpu-crypto/description
+$(call Package/libwolfssl/description)
+This variant uses AES CPU instructions (Intel AESNI or ARMv8 Crypto Extension)
+endef
+
+define Package/libwolfsslcpu-crypto/config
+    if TARGET_armsr && PACKAGE_libwolfsslcpu-crypto = y
+	comment "You are about to build libwolfsslcpu-crypto into an armsr_64 image."
+	comment "Ensure all of your installation targets support the Crypto Extension. "
+	comment "Look for the 'aes' feature in /proc/cpuinfo. This library does not do "
+	comment "run-time detection and will crash if the CPU does not support it.     "
+    endif
+    if TARGET_bcm27xx && PACKAGE_libwolfsslcpu-crypto
+	comment "Beware that libwolfsslcpu-crypto will not run in a bcm27xx target.   "
+    endif
+endef
+
 define Package/libwolfssl-benchmark/description
 This is the wolfssl benchmark utility.
 endef
@@ -90,12 +118,9 @@ endef
 TARGET_CFLAGS += \
 	$(FPIC) \
 	-fomit-frame-pointer \
-	-flto \
 	-DFP_MAX_BITS=8192 \
 	$(if $(CONFIG_WOLFSSL_ALT_NAMES),-DWOLFSSL_ALT_NAMES)
 
-TARGET_LDFLAGS += -flto
-
 # --enable-stunnel needed for OpenSSL API compatibility bits
 CONFIGURE_ARGS += \
 	--enable-reproducible-build \
@@ -121,11 +146,48 @@ CONFIGURE_ARGS += \
 	--$(if $(CONFIG_WOLFSSL_HAS_DTLS),enable,disable)-dtls \
 	--$(if $(CONFIG_WOLFSSL_HAS_ECC25519),enable,disable)-curve25519 \
 	--$(if $(CONFIG_WOLFSSL_HAS_ECC448),enable,disable)-curve448 \
+	--$(if $(CONFIG_WOLFSSL_HAS_OPENVPN),enable,disable)-openvpn
+
+define Package/libwolfsslcpu-crypto/preinst-aarch64
+#!/bin/sh
+exec >&2
+printf "[libwolfsslcpu-crypto] Checking for Arm v8-A Cryptographic Extension support: "
+if [ -n "$${IPKG_INSTROOT}" ]; then
+    printf "...[offline]... "
+    eval "$$(grep '^DISTRIB_TARGET=' "$${IPKG_INSTROOT}/etc/openwrt_release")"
+    echo "$${DISTRIB_TARGET}" | grep '^bcm27xx/.*' > /dev/null && {
+	echo "not supported"
+	echo "Error: Target $${DISTRIB_TARGET} does not support Arm Cryptographic Extension."
+	echo "Install the regular libwolfssl package instead of libwolfsslcpu-crypto."
+	exit 1
+    }
+else
+    grep -q '^Features.*\baes\b' /proc/cpuinfo || {
+	echo "not supported"
+	echo "Error: Arm v8-A Cryptographic Extension not supported."
+	echo "Install the regular libwolfssl package instead of libwolfsslcpu-crypto."
+	echo "Contents of /proc/cpuinfo:"
+	cat /proc/cpuinfo
+	exit 1
+    }
+fi
+echo OK
+exit 0
+endef
+
+ifeq ($(BUILD_VARIANT),regular)
+CONFIGURE_ARGS += \
 	--$(if $(CONFIG_WOLFSSL_HAS_AFALG),enable,disable)-afalg \
-	--$(if $(CONFIG_WOLFSSL_HAS_OPENVPN),enable,disable)-openvpn \
 	--enable-devcrypto=$(if $(CONFIG_WOLFSSL_HAS_DEVCRYPTO_CBC),cbc\
 			  ,$(if $(CONFIG_WOLFSSL_HAS_DEVCRYPTO_AES),aes\
 			  ,$(if $(CONFIG_WOLFSSL_HAS_DEVCRYPTO_FULL),yes,no)))
+else ifdef CONFIG_aarch64
+    CONFIGURE_ARGS += --enable-armasm
+    TARGET_CFLAGS:=$(TARGET_CFLAGS:-mcpu%=-mcpu%+crypto)
+    Package/libwolfsslcpu-crypto/preinst=$(Package/libwolfsslcpu-crypto/preinst-aarch64)
+else ifdef CONFIG_TARGET_x86_64
+	CONFIGURE_ARGS += --enable-intelasm
+endif
 
 ifeq ($(CONFIG_WOLFSSL_HAS_OCSP),y)
 CONFIGURE_ARGS += \
@@ -137,15 +199,6 @@ CONFIGURE_ARGS += \
 	--enable-wpas --enable-fortress --enable-fastmath
 endif
 
-ifdef CONFIG_WOLFSSL_HAS_CPU_CRYPTO
-    ifdef CONFIG_aarch64
-	CONFIGURE_ARGS += --enable-armasm
-	TARGET_CFLAGS:=$(TARGET_CFLAGS:-mcpu%=-mcpu%+crypto)
-    else ifdef CONFIG_TARGET_x86_64
-	CONFIGURE_ARGS += --enable-intelasm
-    endif
-endif
-
 define Build/InstallDev
 	$(INSTALL_DIR) $(1)/usr/include $(1)/usr/lib/pkgconfig
 	$(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
@@ -163,10 +216,13 @@ define Package/libwolfssl/install
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libwolfssl.so.* $(1)/usr/lib/
 endef
 
+Package/libwolfsslcpu-crypto/install=$(Package/libwolfssl/install)
+
 define Package/libwolfssl-benchmark/install
 	$(INSTALL_DIR) $(1)/usr/bin
 	$(CP) $(PKG_BUILD_DIR)/wolfcrypt/benchmark/.libs/benchmark $(1)/usr/bin/wolfssl-benchmark
 endef
 
 $(eval $(call BuildPackage,libwolfssl))
+$(eval $(call BuildPackage,libwolfsslcpu-crypto))
 $(eval $(call BuildPackage,libwolfssl-benchmark))
diff --git a/package/libs/wolfssl/patches/100-disable-hardening-check.patch b/package/libs/wolfssl/patches/100-disable-hardening-check.patch
index 01bb5974ba3385..af774181ec0bb4 100644
--- a/package/libs/wolfssl/patches/100-disable-hardening-check.patch
+++ b/package/libs/wolfssl/patches/100-disable-hardening-check.patch
@@ -1,6 +1,6 @@
 --- a/wolfssl/wolfcrypt/settings.h
 +++ b/wolfssl/wolfcrypt/settings.h
-@@ -2445,7 +2445,7 @@ extern void uITRON4_free(void *p) ;
+@@ -2496,7 +2496,7 @@ extern void uITRON4_free(void *p) ;
  #endif
  
  /* warning for not using harden build options (default with ./configure) */
diff --git a/package/libs/zlib/Makefile b/package/libs/zlib/Makefile
index 8512394ff4fd49..7031bc974f8ab5 100644
--- a/package/libs/zlib/Makefile
+++ b/package/libs/zlib/Makefile
@@ -8,13 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zlib
-PKG_VERSION:=1.2.12
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_VERSION:=1.2.13
+PKG_RELEASE:=1
 
-PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=https://github.com/madler/zlib
-PKG_MIRROR_HASH:=a162fc219763635f0c1591ec515d4b08684e4b0bfb4b1c8e65e4eab18d597c27
-PKG_SOURCE_VERSION:=21767c654d31d2dccdde4330529775c6c5fd5389
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
+PKG_SOURCE_URL:=https://github.com/madler/zlib/releases/download/v$(PKG_VERSION)
+PKG_HASH:=d14c38e313afc35a9a8760dadf26042f51ea0f5d154b0630a31da0540107fb98
 
 PKG_LICENSE:=Zlib
 PKG_LICENSE_FILES:=README
diff --git a/package/libs/zlib/patches/002-arm-specific-optimisations-for-inflate.patch b/package/libs/zlib/patches/002-arm-specific-optimisations-for-inflate.patch
index d181b034e51133..04e66621e14e1e 100644
--- a/package/libs/zlib/patches/002-arm-specific-optimisations-for-inflate.patch
+++ b/package/libs/zlib/patches/002-arm-specific-optimisations-for-inflate.patch
@@ -11,9 +11,6 @@ Change-Id: Id4cda552b39bfb39ab35ec499dbe122b43b6d1a1
  create mode 100644 contrib/arm/inffast.c
  create mode 100644 contrib/arm/inflate.c
 
-diff --git a/contrib/arm/inffast.c b/contrib/arm/inffast.c
-new file mode 100644
-index 00000000..0dbd1dbc
 --- /dev/null
 +++ b/contrib/arm/inffast.c
 @@ -0,0 +1,323 @@
@@ -340,9 +337,6 @@ index 00000000..0dbd1dbc
 + */
 +
 +#endif /* !ASMINF */
-diff --git a/contrib/arm/inflate.c b/contrib/arm/inflate.c
-new file mode 100644
-index 00000000..ac333e8c
 --- /dev/null
 +++ b/contrib/arm/inflate.c
 @@ -0,0 +1,1561 @@
diff --git a/package/libs/zlib/patches/003-arm-specific-optimisations-for-inflate.patch b/package/libs/zlib/patches/003-arm-specific-optimisations-for-inflate.patch
index 9370264c4034d4..1f83b500ba160e 100644
--- a/package/libs/zlib/patches/003-arm-specific-optimisations-for-inflate.patch
+++ b/package/libs/zlib/patches/003-arm-specific-optimisations-for-inflate.patch
@@ -16,9 +16,6 @@ Change-Id: I59854eb25d2b1e43561c8a2afaf9175bf10cf674
  3 files changed, 335 insertions(+), 62 deletions(-)
  create mode 100644 contrib/arm/chunkcopy.h
 
-diff --git a/contrib/arm/chunkcopy.h b/contrib/arm/chunkcopy.h
-new file mode 100644
-index 00000000..2d6fd6f9
 --- /dev/null
 +++ b/contrib/arm/chunkcopy.h
 @@ -0,0 +1,279 @@
@@ -301,8 +298,6 @@ index 00000000..2d6fd6f9
 +#undef Z_RESTRICT
 +
 +#endif /* CHUNKCOPY_H */
-diff --git a/contrib/arm/inffast.c b/contrib/arm/inffast.c
-index 0dbd1dbc..f7f50071 100644
 --- a/contrib/arm/inffast.c
 +++ b/contrib/arm/inffast.c
 @@ -7,6 +7,7 @@
@@ -313,7 +308,7 @@ index 0dbd1dbc..f7f50071 100644
  
  #ifdef ASMINF
  #  pragma message("Assembler code may have bugs -- use at your own risk")
-@@ -57,6 +58,7 @@ unsigned start;         /* inflate()'s starting value for strm->avail_out */
+@@ -57,6 +58,7 @@ unsigned start;         /* inflate()'s s
      unsigned char FAR *out;     /* local strm->next_out */
      unsigned char FAR *beg;     /* inflate()'s initial strm->next_out */
      unsigned char FAR *end;     /* while out < end, enough space available */
@@ -321,7 +316,7 @@ index 0dbd1dbc..f7f50071 100644
  #ifdef INFLATE_STRICT
      unsigned dmax;              /* maximum distance from zlib header */
  #endif
-@@ -84,12 +86,13 @@ unsigned start;         /* inflate()'s starting value for strm->avail_out */
+@@ -84,12 +86,13 @@ unsigned start;         /* inflate()'s s
      out = strm->next_out;
      beg = out - (start - strm->avail_out);
      end = out + (strm->avail_out - 257);
@@ -336,7 +331,7 @@ index 0dbd1dbc..f7f50071 100644
      window = state->window;
      hold = state->hold;
      bits = state->bits;
-@@ -197,70 +200,51 @@ unsigned start;         /* inflate()'s starting value for strm->avail_out */
+@@ -197,70 +200,51 @@ unsigned start;         /* inflate()'s s
  #endif
                      }
                      from = window;
@@ -371,14 +366,8 @@ index 0dbd1dbc..f7f50071 100644
 -                                } while (--op);
 -                                from = out - dist;      /* rest from output */
 -                            }
-+                            out = chunkcopy_safe(out, from, op, limit);
-+                            from = window;      /* more from start of window */
-+                            op = wnext;
-+                            /* This (rare) case can create a situation where
-+                               the first chunkcopy below must be checked.
-+                             */
-                         }
-                     }
+-                        }
+-                    }
 -                    else {                      /* contiguous in window */
 -                        from += wnext - op;
 -                        if (op < len) {         /* some from window */
@@ -399,6 +388,14 @@ index 0dbd1dbc..f7f50071 100644
 -                        *out++ = *from++;
 -                        if (len > 1)
 -                            *out++ = *from++;
++                            out = chunkcopy_safe(out, from, op, limit);
++                            from = window;      /* more from start of window */
++                            op = wnext;
++                            /* This (rare) case can create a situation where
++                               the first chunkcopy below must be checked.
++                             */
++                        }
++                    }
 +                    if (op < len) {             /* still need some from output */
 +                        out = chunkcopy_safe(out, from, op, limit);
 +                        len -= op;
@@ -443,8 +440,6 @@ index 0dbd1dbc..f7f50071 100644
                  }
              }
              else if ((op & 64) == 0) {          /* 2nd level distance code */
-diff --git a/contrib/arm/inflate.c b/contrib/arm/inflate.c
-index ac333e8c..e40322c3 100644
 --- a/contrib/arm/inflate.c
 +++ b/contrib/arm/inflate.c
 @@ -84,6 +84,7 @@
diff --git a/package/libs/zlib/patches/004-attach-sourcefiles-in-patch-002-to-buildsystem.patch b/package/libs/zlib/patches/004-attach-sourcefiles-in-patch-002-to-buildsystem.patch
index 68f317b24bcf21..81816aed680d63 100644
--- a/package/libs/zlib/patches/004-attach-sourcefiles-in-patch-002-to-buildsystem.patch
+++ b/package/libs/zlib/patches/004-attach-sourcefiles-in-patch-002-to-buildsystem.patch
@@ -1,8 +1,6 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 8e75f66..24d7329 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -95,34 +95,67 @@ set(ZLIB_PUBLIC_HDRS
+@@ -91,34 +91,67 @@ set(ZLIB_PUBLIC_HDRS
      ${CMAKE_CURRENT_BINARY_DIR}/zconf.h
      zlib.h
  )
diff --git a/package/network/config/firewall/Makefile b/package/network/config/firewall/Makefile
index e4a3ad97f776fc..0e00f386897a7c 100644
--- a/package/network/config/firewall/Makefile
+++ b/package/network/config/firewall/Makefile
@@ -21,6 +21,8 @@ PKG_LICENSE:=ISC
 
 PKG_CONFIG_DEPENDS := CONFIG_IPV6
 
+PKG_BUILD_FLAGS:=gc-sections lto
+
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/cmake.mk
 
@@ -42,8 +44,6 @@ define Package/firewall/conffiles
 /etc/firewall.user
 endef
 
-TARGET_CFLAGS += -ffunction-sections -fdata-sections -flto
-TARGET_LDFLAGS += -Wl,--gc-sections -flto
 CMAKE_OPTIONS += $(if $(CONFIG_IPV6),,-DDISABLE_IPV6=1)
 
 define Package/firewall/install
diff --git a/package/network/config/firewall/files/firewall.config b/package/network/config/firewall/files/firewall.config
index 61cfe665e45185..b90ac7af0a382c 100644
--- a/package/network/config/firewall/files/firewall.config
+++ b/package/network/config/firewall/files/firewall.config
@@ -1,6 +1,6 @@
 config defaults
 	option syn_flood	1
-	option input		ACCEPT
+	option input		REJECT
 	option output		ACCEPT
 	option forward		REJECT
 # Uncomment this line to disable ipv6 rules
diff --git a/package/network/config/firewall4/Makefile b/package/network/config/firewall4/Makefile
index 87510d59af649b..809f3d3f0409f4 100644
--- a/package/network/config/firewall4/Makefile
+++ b/package/network/config/firewall4/Makefile
@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=firewall4
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/firewall4.git
-PKG_SOURCE_DATE:=2022-09-01
-PKG_SOURCE_VERSION:=f5fcdcf2c51f6f0a4b116c352000c4fe0523be77
-PKG_MIRROR_HASH:=57ef6f161abdd323019c026c959ab875fdfd3c972b8dc7767623634b1c259138
+PKG_SOURCE_DATE:=2023-03-23
+PKG_SOURCE_VERSION:=04a06bd70b9808b14444cae81a2faba4708ee231
+PKG_MIRROR_HASH:=37c34facb733c50d0fdbfa238765a23e667e4daaae9728aaccbaba87a2a07bb9
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 PKG_LICENSE:=ISC
 
diff --git a/package/network/config/ltq-adsl-app/Makefile b/package/network/config/ltq-adsl-app/Makefile
index 2e4792266c19d9..472e3c0ed9c639 100644
--- a/package/network/config/ltq-adsl-app/Makefile
+++ b/package/network/config/ltq-adsl-app/Makefile
@@ -10,7 +10,7 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=dsl_cpe_control_danube
 PKG_VERSION:=3.24.4.4
-PKG_RELEASE:=10
+PKG_RELEASE:=11
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_BUILD_DIR:=$(BUILD_DIR)/dsl_cpe_control-$(PKG_VERSION)
 PKG_SOURCE_URL:=@OPENWRT
@@ -36,6 +36,7 @@ define Package/ltq-adsl-app
   TITLE:=Lantiq DSL userland tool
   URL:=http://www.lantiq.com/
   DEPENDS:=@(TARGET_lantiq_xway||TARGET_lantiq_xway_legacy||TARGET_lantiq_ase) +libpthread +ltq-dsl-base +libubox +libubus
+  PROVIDES:=ltq-dsl-app
   MENU:=1
 endef
 
@@ -77,7 +78,7 @@ TARGET_CFLAGS += -I$(LINUX_DIR)/include
 
 define Build/Prepare
 	$(call Build/Prepare/Default)
-	$(CP) ../ltq-vdsl-app/src/src/dsl_cpe_ubus.c $(PKG_BUILD_DIR)/src/
+	$(CP) ../ltq-vdsl-vr9-app/src/src/dsl_cpe_ubus.c $(PKG_BUILD_DIR)/src/
 endef
 
 define Package/ltq-adsl-app/install
diff --git a/package/network/config/ltq-adsl-app/patches/100-add-more-script-notifications.patch b/package/network/config/ltq-adsl-app/patches/100-add-more-script-notifications.patch
index 9d611c1caff581..875b7ecbf57362 100644
--- a/package/network/config/ltq-adsl-app/patches/100-add-more-script-notifications.patch
+++ b/package/network/config/ltq-adsl-app/patches/100-add-more-script-notifications.patch
@@ -3,7 +3,7 @@ From: Mathias Kresin <dev@kresin.me>
 Date: Mon, 16 Oct 2017 21:08:26 +0200
 Subject: ltq-adsl-app: add more script notifications
 
-Backport HANDSHAKE and TRAINING notification from ltq-vdsl-app. It
+Backport HANDSHAKE and TRAINING notification from ltq-vdsl-vr9-app. It
 unifies the dsl led blinking pattern accross all subtargets and allows
 to get the current line status from the dsl led.
 
diff --git a/package/network/config/ltq-vdsl-vr11-app/Makefile b/package/network/config/ltq-vdsl-vr11-app/Makefile
new file mode 100644
index 00000000000000..bcbf41e65a153d
--- /dev/null
+++ b/package/network/config/ltq-vdsl-vr11-app/Makefile
@@ -0,0 +1,92 @@
+# Copyright (C) 2010 OpenWrt.org
+# Copyright (C) 2015-2016 Lantiq Beteiligungs GmbH & Co KG.
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_NAME:=ltq-vdsl-vr11-app
+PKG_VERSION:=4.23.1
+PKG_RELEASE:=2
+PKG_BASE_NAME:=dsl_cpe_control
+
+UGW_VERSION=8.5.2.10
+UGW_BASENAME=$(PKG_BASE_NAME)-ugw_$(UGW_VERSION)
+
+PKG_SOURCE:=$(UGW_BASENAME).tar.bz2
+PKG_SOURCE_URL:=https://gitlab.com/prpl-foundation/intel/$(PKG_BASE_NAME)/-/archive/ugw_$(UGW_VERSION)/
+PKG_HASH:=d21ec74ca30f7f3893a8aa26d2b74ec319652f6b112832efab6f1274c7e5d1fc
+PKG_BUILD_DIR:=$(BUILD_DIR)/$(UGW_BASENAME)
+PKG_LICENSE:=BSD-2-Clause
+PKG_LICENSE_FILES:=LICENSE
+
+PKG_BUILD_DEPENDS:=ltq-vdsl-vr11
+
+PKG_FLAGS:=nonshared
+PKG_FIXUP:=autoreconf
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/ltq-vdsl-vr11-app
+  SECTION:=net
+  CATEGORY:=Network
+  TITLE:=Lantiq VDSL userland tool
+  URL:=http://www.lantiq.com/
+  DEPENDS:=@TARGET_ipq40xx +libpthread +librt +libubox +libubus +ltq-dsl-base +kmod-ltq-vdsl-vr11
+  PROVIDES:=ltq-dsl-app
+endef
+
+define Package/ltq-vdsl-vr11-app/description
+  Userland tool needed to control Lantiq VDSL CPE
+endef
+
+# ltq-vdsl-vr11-app uses a header provided by the MEI driver which has some
+# conditionals.
+#
+# Define them here with the default values they would get in the MEI driver,
+# have the same view on both sides.
+#
+# If you change them, you need to change them for the ltq-vdsl-vr11-app as well
+VDSL_APP_CFLAGS = \
+	-DMAX_CLI_PIPES=1 \
+	-DMEI_SUPPORT_DEBUG_STREAMS=1 \
+	-DMEI_SUPPORT_OPTIMIZED_FW_DL=1
+
+CONFIGURE_ARGS += \
+	--enable-debug-logger-support=no
+
+CONFIGURE_ARGS += \
+	--enable-vrx \
+	--enable-vrx-device=vr11 \
+	--enable-driver-include="-I$(STAGING_DIR)/usr/include/drv_vdsl_cpe_api" \
+	--enable-device-driver-include="-I$(STAGING_DIR)/usr/include/vdsl/" \
+	--enable-ifxos \
+	--enable-ifxos-include="-I$(STAGING_DIR)/usr/include/ifxos" \
+	--enable-ifxos-library="-I$(STAGING_DIR)/usr/lib" \
+	--enable-add-appl-cflags="$(VDSL_APP_CFLAGS)"  \
+	--enable-debug \
+	--disable-dti
+
+CONFIGURE_ARGS += \
+	--enable-model=full \
+	--enable-dsl-ceoc=no
+#CONFIGURE_ARGS += --enable-model=lite
+#CONFIGURE_ARGS += --enable-model=footprint
+#CONFIGURE_ARGS += --enable-model=typical
+#CONFIGURE_ARGS += --enable-model=debug
+
+define Build/Prepare
+	$(call Build/Prepare/Default)
+	$(CP) ../ltq-vdsl-vr9-app/src/src/dsl_cpe_ubus.c $(PKG_BUILD_DIR)/src/
+endef
+
+define Package/ltq-vdsl-vr11-app/install
+	$(INSTALL_DIR) $(1)/etc/init.d $(1)/sbin $(1)/etc/hotplug.d/dsl
+	$(INSTALL_BIN) ./files/dsl_control $(1)/etc/init.d/
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/dsl_cpe_control $(1)/sbin/vdsl_cpe_control
+	$(INSTALL_BIN) ./files/dsl_cpe_pipe.sh $(1)/sbin/
+endef
+
+$(eval $(call BuildPackage,ltq-vdsl-vr11-app))
diff --git a/package/network/config/ltq-vdsl-vr11-app/files/dsl_control b/package/network/config/ltq-vdsl-vr11-app/files/dsl_control
new file mode 100644
index 00000000000000..d960a7726181d0
--- /dev/null
+++ b/package/network/config/ltq-vdsl-vr11-app/files/dsl_control
@@ -0,0 +1,264 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2012 OpenWrt.org
+
+START=97
+USE_PROCD=1
+
+dslstat() {
+	ubus call dsl metrics
+}
+
+extra_command "dslstat" "Get DSL status information"
+
+#
+# ITU-T G.997.1 (06/2012) - Section 7.3.1.1.1 (xTU transmission system enabling (XTSE))
+# ITU-T G.997.1 Amendment 2 (04/2013) - Section 2.1 - (Vectoring mode enable (VECTORMODE_ENABLE))
+#
+# G.992.1 Annex A
+# G.992.2 Annex A
+# G.992.3 Annex A / L-US1 / L_US-2 / M
+# G.992.5 Annex A / M
+# G.993.2 Annex A/B/C
+# G.993.5 Annex A/B/C
+xtse_xdsl_a="05_01_04_00_4C_01_04_07"
+
+# G.992.1 Annex B
+# G.992.3 Annex B
+# G.992.5 Annex B
+# G.993.2 Annex A/B/C
+# G.993.5 Annex A/B/C
+xtse_xdsl_b="10_00_10_00_00_04_00_07"
+
+# G.992.1 Annex B
+# G.992.3 Annex B
+# G.992.3 Annex J
+# G.992.5 Annex B
+# G.992.5 Annex J
+# G.993.2 Annex A/B/C
+# G.993.5 Annex A/B/C
+xtse_xdsl_j="10_00_10_40_00_04_01_07"
+
+# G.992.1 Annex B
+xtse_xdsl_bdmt="10_00_00_00_00_00_00_00"
+
+# G.992.3 Annex B
+xtse_xdsl_b2="00_00_10_00_00_00_00_00"
+
+# G.992.5 Annex B
+xtse_xdsl_b2p="00_00_00_00_00_04_00_00"
+
+# ANSI T1.413
+xtse_xdsl_at1="01_00_00_00_00_00_00_00"
+
+# G.992.2 Annex A
+xtse_xdsl_alite="00_01_00_00_00_00_00_00"
+
+# G.992.1 Annex A
+xtse_xdsl_admt="04_00_00_00_00_00_00_00"
+
+# G.992.3 Annex A
+xtse_xdsl_a2="00_00_04_00_00_00_00_00"
+
+# G.992.5 Annex A
+xtse_xdsl_a2p="00_00_00_00_00_01_00_00"
+
+# G.992.3 Annex L
+xtse_xdsl_l="00_00_00_00_0C_00_00_00"
+
+# G.992.3 Annex M
+# G.992.5 Annex M
+xtse_xdsl_m="00_00_00_00_40_00_04_00"
+
+# G.992.3 Annex M
+xtse_xdsl_m2="00_00_00_00_40_00_00_00"
+
+# G.992.5 Annex M
+xtse_xdsl_m2p="00_00_00_00_00_00_04_00"
+
+#
+# ITU-T G.994.1 (06/2012) - Table 2 (Mandatory carrier sets)
+#
+
+# A43
+tone_adsl_a="0x142" # A43C + J43 + A43
+tone_vdsl_a="0x142" # A43C + J43 + A43
+
+# A43 + V43
+tone_adsl_av="0x142" # A43C + J43 + A43
+tone_vdsl_av="0x146" # A43C + J43 + A43 + V43
+
+# B43
+tone_adsl_b="0x81" # B43 + B43c
+tone_vdsl_b="0x1" # B43
+
+# B43 + V43
+tone_adsl_bv="0x81" # B43 + B43c
+tone_vdsl_bv="0x5" # B43 + V43
+
+# create DSL autoboot script. Used for SNR margin tweak and to set MAC address for vectoring error reports
+autoboot_script() {
+    echo "[WaitForConfiguration]={
+locs nLine=0 0 $1
+dsmmcs nLine=0 $2
+}
+
+[WaitForLinkActivate]={
+}
+
+[WaitForRestart]={
+}
+
+[Common]={
+}" > /tmp/dsl.scr
+}
+
+lowlevel_cfg() {
+	echo "# VRX Low Level Configuration File
+#
+# Parameters must be separated by tabs or spaces.
+# Empty lines and comments will be ignored.
+#
+
+# nFilter
+#
+# NA     = -1
+# OFF    = 0
+# ISDN   = 1
+# POTS   = 2
+# POTS_2 = 3
+# POTS_3 = 4
+#
+#  (dec)
+    -1
+
+# nHsToneGroupMode nHsToneGroup_A       nHsToneGroup_V    nHsToneGroup_AV
+#
+# NA     = -1      NA         = -1      see               see
+# AUTO   = 0       VDSL2_B43  = 0x0001  nHsToneGroup_A    nHsToneGroup_A
+# MANUAL = 1       VDSL2_A43  = 0x0002
+#                  VDSL2_V43  = 0x0004
+#                  VDSL1_V43P = 0x0008
+#                  VDSL1_V43I = 0x0010
+#                  ADSL1_C43  = 0x0020
+#                  ADSL2_J43  = 0x0040
+#                  ADSL2_B43C = 0x0080
+#                  ADSL2_A43C = 0x0100
+#
+#  (dec)           (hex)                (hex)             (hex)
+     1             $1			$2		 0x0
+
+#   nBaseAddr     nIrqNum
+#
+#     (hex)        (dec)
+    0x1e116000      63
+
+# nUtopiaPhyAdr   nUtopiaBusWidth      nPosPhyParity
+#                 default(16b) = 0     NA   = -1
+#                 8-bit        = 1     ODD  = 0
+#                 16-bit       = 2
+#
+#
+#    (hex)            (dec)                (dec)
+      0xFF              0                    0
+
+# bNtrEnable
+#
+#  (dec)
+    0" > /tmp/lowlevel.cfg
+}
+
+get_macaddr() {
+	local name
+	config_get name $1 name
+	[ "$name" = "dsl0" ] && config_get $2 $1 macaddr
+}
+
+service_triggers() {
+	procd_add_reload_trigger network
+}
+
+start_service() {
+	local annex
+	local firmware
+	local tone
+	local tone_adsl
+	local tone_vdsl
+	local xtse
+	local xfer_mode
+	local line_mode
+	local tc_layer
+	local mode
+	local lowlevel
+	local snr
+	local macaddr
+
+	config_load network
+	config_get tone dsl tone
+	config_get annex dsl annex
+	config_get firmware dsl firmware
+	config_get xfer_mode dsl xfer_mode
+	config_get line_mode dsl line_mode
+	config_get snr dsl ds_snr_offset
+	config_foreach get_macaddr device macaddr
+
+	eval "xtse=\"\${xtse_xdsl_$annex}\""
+
+	case "${xfer_mode}" in
+	atm)
+		tc_layer="-T1:0x1:0x1_1:0x1:0x1"
+		;;
+	ptm)
+		tc_layer="-T2:0x1:0x1_2:0x1:0x1"
+		;;
+	esac
+
+	case "${line_mode}" in
+	adsl)
+		mode="-M1"
+
+		# mask out VDSL bits when ADSL is requested
+		xtse="${xtse%_*}_00"
+		;;
+	vdsl)
+		mode="-M2"
+
+		# mask out ADSL bits when VDSL is requested
+		xtse="00_00_00_00_00_00_00_${xtse##*_}"
+		;;
+	esac
+
+	[ -z "${firmware}" ] && firmware=/lib/firmware/vdsl.bin
+	[ -f "${firmware}" ] || {
+		echo failed to find $firmware
+		return 1
+	}
+
+	eval "tone_adsl=\"\${tone_adsl_$tone}\""
+	eval "tone_vdsl=\"\${tone_vdsl_$tone}\""
+	[ -n "${tone_adsl}" ] && [ -n "${tone_vdsl}" ] && {
+		lowlevel_cfg "${tone_adsl}" "${tone_vdsl}"
+		lowlevel="-l /tmp/lowlevel.cfg"
+	}
+
+	[ -z "${snr}" ] && snr=0
+	[ -z "${macaddr}" ] && macaddr="00:00:00:00:00:00"
+	autoboot_script "$snr" "$macaddr"
+	autoboot="-a /tmp/dsl.scr -A /tmp/dsl.scr"
+
+	procd_open_instance
+	procd_set_param command /sbin/vdsl_cpe_control \
+			-i$xtse \
+			-n /sbin/dsl_notify.sh \
+			-f ${firmware} \
+			$lowlevel \
+			${mode} \
+			${tc_layer} \
+			$autoboot
+	procd_close_instance
+}
+
+stop_service() {
+	DSL_NOTIFICATION_TYPE="DSL_INTERFACE_STATUS" \
+	DSL_INTERFACE_STATUS="DOWN" \
+		/sbin/dsl_notify.sh
+}
diff --git a/package/network/config/ltq-vdsl-vr11-app/files/dsl_cpe_pipe.sh b/package/network/config/ltq-vdsl-vr11-app/files/dsl_cpe_pipe.sh
new file mode 100644
index 00000000000000..9002b7b3164abd
--- /dev/null
+++ b/package/network/config/ltq-vdsl-vr11-app/files/dsl_cpe_pipe.sh
@@ -0,0 +1,18 @@
+#!/bin/sh
+
+pipe_no=0
+
+# use specified pipe no
+case "$1" in
+0|1|2)
+pipe_no=$1; shift; ;;
+esac
+
+
+#echo "Call dsl_pipe with $*"
+lock /var/lock/dsl_pipe
+echo $* > /tmp/pipe/dsl_cpe${pipe_no}_cmd
+result=$(cat /tmp/pipe/dsl_cpe${pipe_no}_ack)
+lock -u /var/lock/dsl_pipe
+
+echo "$result"
diff --git a/package/network/config/ltq-vdsl-vr11-app/patches/100-compat.patch b/package/network/config/ltq-vdsl-vr11-app/patches/100-compat.patch
new file mode 100644
index 00000000000000..6bc359c3cc9af9
--- /dev/null
+++ b/package/network/config/ltq-vdsl-vr11-app/patches/100-compat.patch
@@ -0,0 +1,11 @@
+--- a/src/dsl_cpe_init_cfg.c
++++ b/src/dsl_cpe_init_cfg.c
+@@ -38,7 +38,7 @@ DSL_InitData_t gInitCfgData =
+       DSL_DEV_HS_TONE_GROUP_CLEANED, \
+       DSL_DEV_HS_TONE_GROUP_CLEANED, \
+       DSL_DEV_HS_TONE_GROUP_CLEANED, \
+-      0x1E116000, 0x37, -1),
++      0x1E116000, 0x3f, -1),
+    DSL_CPE_SIC_SET(DSL_TC_ATM, DSL_EMF_TC_CLEANED, DSL_EMF_TC_CLEANED, DSL_SYSTEMIF_MII, \
+                    DSL_TC_EFM, DSL_EMF_TC_CLEANED, DSL_EMF_TC_CLEANED, DSL_SYSTEMIF_MII),
+    DSL_CPE_MAC_CFG_SET(DSL_EFM_SPEED_100, DSL_EFM_DUPLEX_FULL, DSL_EFM_FLOWCTRL_ON, DSL_EFM_AUTONEG_OFF, \
diff --git a/package/network/config/ltq-vdsl-vr11-app/patches/101-warnings.patch b/package/network/config/ltq-vdsl-vr11-app/patches/101-warnings.patch
new file mode 100644
index 00000000000000..0c02bb17b75557
--- /dev/null
+++ b/package/network/config/ltq-vdsl-vr11-app/patches/101-warnings.patch
@@ -0,0 +1,87 @@
+--- a/src/dsl_cpe_control.h
++++ b/src/dsl_cpe_control.h
+@@ -13,6 +13,8 @@
+ #ifndef _DSL_CPE_CONTROL_H
+ #define _DSL_CPE_CONTROL_H
+ 
++#include <string.h>
++
+ /** \defgroup DSL_CPE_CONTROL Lantiq DSL CPE API Control Application
+     Lists the entire modules to the DSL CPE_API Control Application.
+   @{ */
+--- a/src/dsl_cpe_safec_wrapper.h
++++ b/src/dsl_cpe_safec_wrapper.h
+@@ -23,7 +23,7 @@
+ #define cpe_control_vsnprintf_s vsnprintf_s
+ 
+ /* snprintf_s symbol is not exported in SafeC lib */
+-static int cpe_control_snprintf_s(char *dest,
++static inline int cpe_control_snprintf_s(char *dest,
+                                   size_t dmax,
+                                   const char *fmt,
+                                   ...)
+@@ -40,7 +40,7 @@ static int cpe_control_snprintf_s(char *
+ 
+ #else
+ 
+-#warning "Safe C library is not available!"
++//#warning "Safe C library is not available!"
+ 
+ #include <stddef.h>     /* size_t */
+ #include <stdarg.h>     /* va_list */
+@@ -55,7 +55,7 @@ static __inline__ size_t safec_wrapper_m
+ #define cpe_control_memset_s(dest, destsz, src, srcsz) memset(dest, src, safec_wrapper_min(destsz,srcsz))
+ #define cpe_control_strncpy_s(dest, destsz, src, srcsz) strncpy(dest, src, safec_wrapper_min(destsz,srcsz))
+ 
+-static size_t cpe_control_strnlen_s(const char *str,
++static inline size_t cpe_control_strnlen_s(const char *str,
+                                     size_t smax)
+ {
+    /* preconditions */
+@@ -74,7 +74,7 @@ static size_t cpe_control_strnlen_s(cons
+    return size;
+ }
+ 
+-static char *cpe_control_strtok_s(char *dest,
++static inline char *cpe_control_strtok_s(char *dest,
+                                   size_t *dmax,
+                                   const char *delim,
+                                   char **ptr)
+@@ -123,7 +123,7 @@ static char *cpe_control_strtok_s(char *
+    return pTmp;
+ }
+ 
+-static int cpe_control_pipe_strcat_s(char *dest,
++static inline int cpe_control_pipe_strcat_s(char *dest,
+                                      size_t destsz,
+                                      char *src)
+ {
+@@ -157,7 +157,7 @@ static int cpe_control_pipe_strcat_s(cha
+    return 0;
+ }
+ 
+-static int cpe_control_snprintf_s(char *dest,
++static inline int cpe_control_snprintf_s(char *dest,
+                                   size_t dmax,
+                                   const char *fmt,
+                                   ...)
+@@ -181,7 +181,7 @@ static int cpe_control_snprintf_s(char *
+    return retVal;
+ }
+ 
+-static int cpe_control_vsnprintf_s(char *dest,
++static inline int cpe_control_vsnprintf_s(char *dest,
+                                    size_t dmax,
+                                    const char *fmt,
+                                    va_list vlist)
+--- a/tools/pipe/dsl_cpe_safec_wrapper.h
++++ b/tools/pipe/dsl_cpe_safec_wrapper.h
+@@ -27,7 +27,7 @@
+ 
+ #else
+ 
+-#warning "Safe C library is not available!"
++//#warning "Safe C library is not available!"
+ 
+ #include <stddef.h>	/* size_t */
+ static __inline__ size_t safec_wrapper_min(size_t a, size_t b)
diff --git a/package/network/config/ltq-vdsl-vr11-app/patches/200-autoboot.patch b/package/network/config/ltq-vdsl-vr11-app/patches/200-autoboot.patch
new file mode 100644
index 00000000000000..c3e9b966204880
--- /dev/null
+++ b/package/network/config/ltq-vdsl-vr11-app/patches/200-autoboot.patch
@@ -0,0 +1,85 @@
+This enables automatic connection after the control daemon is started,
+and also changes the way the connection is stopped on termination.
+
+Using the autoboot restart command is necessary because the stop command
+would stop the autoboot thread, and the driver offers no working way to
+start it again later, short of unloading and reloading the module.
+
+--- a/src/dsl_cpe_init_cfg.c
++++ b/src/dsl_cpe_init_cfg.c
+@@ -27,7 +27,7 @@ DSL_InitData_t gInitCfgData =
+    DSL_CPE_FW2_SET(DSL_NULL, 0x0),
+    DSL_CPE_XTU_SET(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7),
+    DSL_CPE_LINE_INV_NE_SET(DSL_NULL),
+-   DSL_CPE_AUTOBOOT_CTRL_SET(DSL_AUTOBOOT_CTRL_STOP),
++   DSL_CPE_AUTOBOOT_CTRL_SET(DSL_AUTOBOOT_CTRL_START),
+    DSL_CPE_AUTOBOOT_CFG_SET(DSL_FALSE, DSL_FALSE, DSL_FALSE),
+    DSL_CPE_TEST_MODE_CTRL_SET(DSL_TESTMODE_DISABLE),
+    DSL_CPE_LINE_ACTIVATE_CTRL_SET(DSL_G997_INHIBIT_LDSF, DSL_G997_INHIBIT_ACSF, DSL_G997_NORMAL_STARTUP),
+--- a/src/dsl_cpe_control.c
++++ b/src/dsl_cpe_control.c
+@@ -7338,6 +7338,7 @@ DSL_CPE_STATIC  DSL_void_t DSL_CPE_Termi
+ {
+    DSL_Error_t nRet = DSL_SUCCESS;
+    DSL_int_t nDevice = 0;
++   DSL_AutobootConfig_t sAutobootCfg;
+    DSL_AutobootControl_t sAutobootCtl;
+    DSL_CPE_Control_Context_t *pCtrlCtx = DSL_NULL;
+ 
+@@ -7349,8 +7350,32 @@ DSL_CPE_STATIC  DSL_void_t DSL_CPE_Termi
+ 
+    for (nDevice = 0; nDevice < DSL_CPE_DSL_ENTITIES; ++nDevice)
+    {
++      g_bWaitBeforeConfigWrite[nDevice]    = DSL_TRUE;
++      g_bWaitBeforeLinkActivation[nDevice] = DSL_TRUE;
++      g_bWaitBeforeRestart[nDevice]        = DSL_TRUE;
++
++      g_bAutoContinueWaitBeforeConfigWrite[nDevice]    = DSL_FALSE;
++      g_bAutoContinueWaitBeforeLinkActivation[nDevice] = DSL_FALSE;
++      g_bAutoContinueWaitBeforeRestart[nDevice]        = DSL_FALSE;
++
++      memset(&sAutobootCfg, 0x0, sizeof(DSL_AutobootConfig_t));
++      sAutobootCfg.data.nStateMachineOptions.bWaitBeforeConfigWrite    = DSL_TRUE;
++      sAutobootCfg.data.nStateMachineOptions.bWaitBeforeLinkActivation = DSL_TRUE;
++      sAutobootCfg.data.nStateMachineOptions.bWaitBeforeRestart        = DSL_TRUE;
++
++      nRet = (DSL_Error_t)DSL_CPE_Ioctl(
++         DSL_CPE_GetGlobalContext()->fd[nDevice],
++         DSL_FIO_AUTOBOOT_CONFIG_SET, (DSL_int_t)&sAutobootCfg);
++
++      if (nRet < DSL_SUCCESS)
++      {
++         DSL_CCA_DEBUG(DSL_CCA_DBG_ERR, (DSL_CPE_PREFIX
++            "Autoboot configuration for device (%d) failed!, nRet = %d!"
++            DSL_CPE_CRLF, nDevice, sAutobootCtl.accessCtl.nReturn));
++      }
++
+       memset(&sAutobootCtl, 0, sizeof(DSL_AutobootControl_t));
+-      sAutobootCtl.data.nCommand = DSL_AUTOBOOT_CTRL_STOP;
++      sAutobootCtl.data.nCommand = DSL_AUTOBOOT_CTRL_RESTART;
+ 
+       nRet = (DSL_Error_t)DSL_CPE_Ioctl(
+          DSL_CPE_GetGlobalContext()->fd[nDevice],
+@@ -7359,13 +7384,13 @@ DSL_CPE_STATIC  DSL_void_t DSL_CPE_Termi
+       if (nRet < DSL_SUCCESS)
+       {
+          DSL_CCA_DEBUG(DSL_CCA_DBG_ERR, (DSL_CPE_PREFIX
+-            "Autoboot stop for device (%d) failed!, nRet = %d!"
++            "Autoboot restart for device (%d) failed!, nRet = %d!"
+             DSL_CPE_CRLF, nDevice, sAutobootCtl.accessCtl.nReturn));
+       }
+    }
+ 
+    DSL_CCA_DEBUG(DSL_CCA_DBG_MSG, (DSL_CPE_PREFIX
+-      "Autoboot stop executed" DSL_CPE_CRLF));
++      "Autoboot restart executed" DSL_CPE_CRLF));
+ 
+    DSL_CPE_DaemonExit();
+ 
+@@ -8798,4 +8823,4 @@ DSL_CPE_STATIC DSL_Error_t DSL_CPE_Firmw
+       pDecimal));
+ 
+    return nErrCode;
+-}
+\ No newline at end of file
++}
diff --git a/package/network/config/ltq-vdsl-vr11-app/patches/300-ubus.patch b/package/network/config/ltq-vdsl-vr11-app/patches/300-ubus.patch
new file mode 100644
index 00000000000000..fc0dd70bc1b7ff
--- /dev/null
+++ b/package/network/config/ltq-vdsl-vr11-app/patches/300-ubus.patch
@@ -0,0 +1,50 @@
+--- a/src/dsl_cpe_control.c
++++ b/src/dsl_cpe_control.c
+@@ -221,6 +221,9 @@ extern DSL_Error_t DSL_CPE_Pipe_StaticRe
+ #endif /* INCLUDE_DSL_RESOURCE_STATISTICS*/
+ #endif
+ 
++extern void ubus_init();
++extern void ubus_deinit();
++
+ DSL_char_t *g_sFirmwareName1 = DSL_NULL;
+ DSL_FirmwareFeatures_t g_nFwFeatures1 = {DSL_FW_XDSLMODE_CLEANED, DSL_FW_XDSLFEATURE_CLEANED,
+    DSL_FW_XDSLFEATURE_CLEANED};
+@@ -7831,6 +7834,8 @@ DSL_int_t dsl_cpe_daemon (
+ #endif /* defined(INCLUDE_DSL_JSON_PARSING) && (INCLUDE_DSL_JSON_PARSING == 1) */
+ #endif /* RTEMS*/
+ 
++   ubus_init();
++
+    /* Open DSL_CPE_MAX_DSL_ENTITIES devices*/
+    for (nDevice = 0; nDevice < DSL_CPE_DSL_ENTITIES; nDevice++)
+    {
+@@ -8367,6 +8372,7 @@ DSL_int_t dsl_cpe_daemon (
+ #endif /* INCLUDE_DSL_CPE_CLI_SUPPORT */
+ 
+ DSL_CPE_CONTROL_EXIT:
++   ubus_deinit();
+ 
+    if (INCLUDE_DSL_BONDING)
+    {
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -17,7 +17,7 @@ else
+ dsl_cpe_control_common_ldflags =
+ endif
+ 
+-dsl_cpe_control_LDADD = -lpthread -lrt
++dsl_cpe_control_LDADD = -lpthread -lrt -lubox -lubus
+ 
+ if INCLUDE_DSL_CPE_DTI_SUPPORT
+ dsl_cpe_control_LDADD += -ldti_agent
+@@ -118,7 +118,8 @@ dsl_cpe_control_SOURCES = \
+ 	dsl_cpe_control.c \
+ 	dsl_cpe_init_cfg.c \
+ 	dsl_cpe_linux.c \
+-	dsl_cpe_debug.c
++	dsl_cpe_debug.c \
++	dsl_cpe_ubus.c
+ 
+ dsl_cpe_control_SOURCES += \
+ 	$(dsl_cpe_control_dti_sources)
diff --git a/package/network/config/ltq-vdsl-vr9-app/Makefile b/package/network/config/ltq-vdsl-vr9-app/Makefile
new file mode 100644
index 00000000000000..c51489e2c5fa33
--- /dev/null
+++ b/package/network/config/ltq-vdsl-vr9-app/Makefile
@@ -0,0 +1,83 @@
+# Copyright (C) 2010 OpenWrt.org
+# Copyright (C) 2015-2016 Lantiq Beteiligungs GmbH & Co KG.
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_NAME:=ltq-vdsl-vr9-app
+PKG_VERSION:=4.17.18.6
+PKG_RELEASE:=5
+PKG_BASE_NAME:=dsl_cpe_control
+PKG_SOURCE:=$(PKG_BASE_NAME)_vrx-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=@OPENWRT
+PKG_HASH:=da8bb929526a61aea0e153ef524331fcd472a1ebbc6d88ca017735a4f82ece02
+PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(PKG_BASE_NAME)-$(PKG_VERSION)
+PKG_LICENSE:=BSD-2-Clause
+
+PKG_BUILD_DEPENDS:=ltq-vdsl-vr9
+
+PKG_FLAGS:=nonshared
+PKG_FIXUP:=autoreconf
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/ltq-vdsl-vr9-app
+  SECTION:=net
+  CATEGORY:=Network
+  TITLE:=Lantiq VDSL userland tool
+  URL:=http://www.lantiq.com/
+  DEPENDS:=@TARGET_lantiq_xrx200 +libpthread +librt +ltq-dsl-base +libubox +libubus
+  PROVIDES:=ltq-dsl-app
+endef
+
+define Package/ltq-vdsl-vr9-app/description
+  Userland tool needed to control Lantiq VDSL CPE
+endef
+
+# ltq-vdsl-vr9-app uses a header provided by the MEI driver which has some
+# conditionals.
+#
+# Define them here with the default values they would get in the MEI driver,
+# have the same view on both sides.
+#
+# If you change them, you need to change them for the ltq-vdsl-vr9-app as well
+VDSL_APP_CFLAGS = \
+	-DMAX_CLI_PIPES=1 \
+	-DMEI_SUPPORT_DEBUG_STREAMS=1 \
+	-DMEI_SUPPORT_OPTIMIZED_FW_DL=1
+
+CONFIGURE_ARGS += \
+	--enable-vrx \
+	--enable-vrx-device=vr9 \
+	--enable-driver-include="-I$(STAGING_DIR)/usr/include/drv_vdsl_cpe_api" \
+	--enable-device-driver-include="-I$(STAGING_DIR)/usr/include/vdsl/" \
+	--enable-ifxos \
+	--enable-ifxos-include="-I$(STAGING_DIR)/usr/include/ifxos" \
+	--enable-ifxos-library="-I$(STAGING_DIR)/usr/lib" \
+	--enable-add-appl-cflags="$(VDSL_APP_CFLAGS)"  \
+	--enable-debug \
+	--disable-dti \
+	--with-channels-per-line="1"
+
+CONFIGURE_ARGS += \
+	--enable-model=full \
+	--enable-dsl-ceoc=no
+#CONFIGURE_ARGS += --enable-model=lite
+#CONFIGURE_ARGS += --enable-model=footprint
+#CONFIGURE_ARGS += --enable-model=typical
+#CONFIGURE_ARGS += --enable-model=debug
+
+define Package/ltq-vdsl-vr9-app/install
+	$(INSTALL_DIR) $(1)/etc/init.d $(1)/sbin $(1)/etc/hotplug.d/dsl
+	$(INSTALL_BIN) ./files/dsl_control $(1)/etc/init.d/
+	$(INSTALL_BIN) ./files/10_atm.sh $(1)/etc/hotplug.d/dsl
+	$(INSTALL_BIN) ./files/10_ptm.sh $(1)/etc/hotplug.d/dsl
+
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/dsl_cpe_control $(1)/sbin/vdsl_cpe_control
+	$(INSTALL_BIN) ./files/dsl_cpe_pipe.sh $(1)/sbin/
+endef
+
+$(eval $(call BuildPackage,ltq-vdsl-vr9-app))
diff --git a/package/network/config/ltq-vdsl-vr9-app/files/10_atm.sh b/package/network/config/ltq-vdsl-vr9-app/files/10_atm.sh
new file mode 100644
index 00000000000000..e104a14b2e0a8c
--- /dev/null
+++ b/package/network/config/ltq-vdsl-vr9-app/files/10_atm.sh
@@ -0,0 +1,14 @@
+#!/bin/sh
+
+[ "$DSL_NOTIFICATION_TYPE" = "DSL_STATUS" ] && \
+[ "$DSL_TC_LAYER_STATUS" = "ATM" ] && \
+! grep -q "ltq_atm_vr9" /proc/modules || exit 0
+
+logger -p daemon.notice -t "dsl-notify" "Switching to TC-Layer ATM"
+
+if grep -q "ltq_ptm_vr9" /proc/modules ; then
+	logger -p daemon.notice -t "dsl-notify" "Loading ATM driver while EFM/PTM driver is loaded is not possible. Reboot is needed."
+	exit
+fi
+
+modprobe ltq_atm_vr9
diff --git a/package/network/config/ltq-vdsl-vr9-app/files/10_ptm.sh b/package/network/config/ltq-vdsl-vr9-app/files/10_ptm.sh
new file mode 100644
index 00000000000000..1c62617bba613f
--- /dev/null
+++ b/package/network/config/ltq-vdsl-vr9-app/files/10_ptm.sh
@@ -0,0 +1,14 @@
+#!/bin/sh
+
+[ "$DSL_NOTIFICATION_TYPE" = "DSL_STATUS" ] && \
+[ "$DSL_TC_LAYER_STATUS" = "EFM" ] && \
+! grep -q "ltq_ptm_vr9" /proc/modules || exit 0
+
+logger -p daemon.notice -t "dsl-notify" "Switching to TC-Layer EFM/PTM"
+
+if grep -q "ltq_atm_vr9" /proc/modules ; then
+	logger -p daemon.notice -t "dsl-notify" "Loading EFM/PTM driver while ATM driver is loaded is not possible. Reboot is needed."
+	exit
+fi
+
+modprobe ltq_ptm_vr9
diff --git a/package/network/config/ltq-vdsl-vr9-app/files/dsl_control b/package/network/config/ltq-vdsl-vr9-app/files/dsl_control
new file mode 100644
index 00000000000000..34642dbda5aa85
--- /dev/null
+++ b/package/network/config/ltq-vdsl-vr9-app/files/dsl_control
@@ -0,0 +1,322 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2012 OpenWrt.org
+
+START=97
+USE_PROCD=1
+
+dslstat() {
+	ubus call dsl metrics
+}
+
+extra_command "dslstat" "Get DSL status information"
+
+#
+# ITU-T G.997.1 (06/2012) - Section 7.3.1.1.1 (xTU transmission system enabling (XTSE))
+# ITU-T G.997.1 Amendment 2 (04/2013) - Section 2.1 - (Vectoring mode enable (VECTORMODE_ENABLE))
+#
+# G.992.1 Annex A
+# G.992.2 Annex A
+# G.992.3 Annex A / L-US1 / L_US-2 / M
+# G.992.5 Annex A / M
+# G.993.2 Annex A/B/C
+# G.993.5 Annex A/B/C
+xtse_xdsl_a="05_01_04_00_4C_01_04_07"
+
+# G.992.1 Annex B
+# G.992.3 Annex B
+# G.992.5 Annex B
+# G.993.2 Annex A/B/C
+# G.993.5 Annex A/B/C
+xtse_xdsl_b="10_00_10_00_00_04_00_07"
+
+# G.992.1 Annex B
+# G.992.3 Annex B
+# G.992.3 Annex J
+# G.992.5 Annex B
+# G.992.5 Annex J
+# G.993.2 Annex A/B/C
+# G.993.5 Annex A/B/C
+xtse_xdsl_j="10_00_10_40_00_04_01_07"
+
+# G.992.1 Annex B
+xtse_xdsl_bdmt="10_00_00_00_00_00_00_00"
+
+# G.992.3 Annex B
+xtse_xdsl_b2="00_00_10_00_00_00_00_00"
+
+# G.992.5 Annex B
+xtse_xdsl_b2p="00_00_00_00_00_04_00_00"
+
+# ANSI T1.413
+xtse_xdsl_at1="01_00_00_00_00_00_00_00"
+
+# G.992.2 Annex A
+xtse_xdsl_alite="00_01_00_00_00_00_00_00"
+
+# G.992.1 Annex A
+xtse_xdsl_admt="04_00_00_00_00_00_00_00"
+
+# G.992.3 Annex A
+xtse_xdsl_a2="00_00_04_00_00_00_00_00"
+
+# G.992.5 Annex A
+xtse_xdsl_a2p="00_00_00_00_00_01_00_00"
+
+# G.992.3 Annex L
+xtse_xdsl_l="00_00_00_00_0C_00_00_00"
+
+# G.992.3 Annex M
+# G.992.5 Annex M
+xtse_xdsl_m="00_00_00_00_40_00_04_00"
+
+# G.992.3 Annex M
+xtse_xdsl_m2="00_00_00_00_40_00_00_00"
+
+# G.992.5 Annex M
+xtse_xdsl_m2p="00_00_00_00_00_00_04_00"
+
+#
+# ITU-T G.994.1 (06/2012) - Table 2 (Mandatory carrier sets)
+#
+
+# A43
+tone_adsl_a="0x142" # A43C + J43 + A43
+tone_vdsl_a="0x142" # A43C + J43 + A43
+
+# A43 + V43
+tone_adsl_av="0x142" # A43C + J43 + A43
+tone_vdsl_av="0x146" # A43C + J43 + A43 + V43
+
+# B43
+tone_adsl_b="0x81" # B43 + B43c
+tone_vdsl_b="0x1" # B43
+
+# B43 + V43
+tone_adsl_bv="0x81" # B43 + B43c
+tone_vdsl_bv="0x5" # B43 + V43
+
+# create DSL autoboot script. Used for SNR margin tweak and to set MAC address for vectoring error reports
+autoboot_script() {
+    echo "[WaitForConfiguration]={
+locs 0 $1
+dsmmcs $2
+}
+
+[WaitForLinkActivate]={
+}
+
+[WaitForRestart]={
+}
+
+[Common]={
+}" > /tmp/dsl.scr
+}
+
+lowlevel_cfg() {
+	echo "# VRX Low Level Configuration File
+#
+# Parameters must be separated by tabs or spaces.
+# Empty lines and comments will be ignored.
+#
+
+# nFilter
+#
+# NA     = -1
+# OFF    = 0
+# ISDN   = 1
+# POTS   = 2
+# POTS_2 = 3
+# POTS_3 = 4
+#
+#  (dec)
+    -1
+
+# nHsToneGroupMode nHsToneGroup_A       nHsToneGroup_V    nHsToneGroup_AV
+#
+# NA     = -1      NA         = -1      see               see
+# AUTO   = 0       VDSL2_B43  = 0x0001  nHsToneGroup_A    nHsToneGroup_A
+# MANUAL = 1       VDSL2_A43  = 0x0002
+#                  VDSL2_V43  = 0x0004
+#                  VDSL1_V43P = 0x0008
+#                  VDSL1_V43I = 0x0010
+#                  ADSL1_C43  = 0x0020
+#                  ADSL2_J43  = 0x0040
+#                  ADSL2_B43C = 0x0080
+#                  ADSL2_A43C = 0x0100
+#
+#  (dec)           (hex)                (hex)             (hex)
+     1             $1			$2		 0x0
+
+#   nBaseAddr     nIrqNum
+#
+#     (hex)        (dec)
+    0x1e116000      63
+
+# nUtopiaPhyAdr   nUtopiaBusWidth      nPosPhyParity
+#                 default(16b) = 0     NA   = -1
+#                 8-bit        = 1     ODD  = 0
+#                 16-bit       = 2
+#
+#
+#    (hex)            (dec)                (dec)
+      0xFF              0                    0
+
+# bNtrEnable
+#
+#  (dec)
+    0" > /tmp/lowlevel.cfg
+}
+
+get_macaddr() {
+	local name
+	config_get name $1 name
+	[ "$name" = "dsl0" ] && config_get $2 $1 macaddr
+}
+
+service_triggers() {
+	procd_add_reload_trigger network
+}
+
+start_service() {
+	local annex
+	local firmware
+	local tone
+	local tone_adsl
+	local tone_vdsl
+	local xtse
+	local xfer_mode
+	local line_mode
+	local tc_layer
+	local mode
+	local lowlevel
+	local snr
+	local macaddr
+
+	config_load network
+	config_get tone dsl tone
+	config_get annex dsl annex
+	config_get firmware dsl firmware
+	config_get xfer_mode dsl xfer_mode
+	config_get line_mode dsl line_mode
+	config_get snr dsl ds_snr_offset
+	config_foreach get_macaddr device macaddr
+
+	eval "xtse=\"\${xtse_xdsl_$annex}\""
+
+	case "${xfer_mode}" in
+	atm)
+		tc_layer="-T1:0x1:0x1_1:0x1:0x1"
+		;;
+	ptm)
+		tc_layer="-T2:0x1:0x1_2:0x1:0x1"
+		;;
+	esac
+
+	case "${line_mode}" in
+	adsl)
+		mode="-M1"
+
+		# mask out VDSL bits when ADSL is requested
+		xtse="${xtse%_*}_00"
+		;;
+	vdsl)
+		mode="-M2"
+
+		# mask out ADSL bits when VDSL is requested
+		xtse="00_00_00_00_00_00_00_${xtse##*_}"
+		;;
+	esac
+
+	local annexgpio="/sys/class/gpio/annex"
+	if [ -d "${annexgpio}a" ] && [ -d "${annexgpio}b" ]; then
+		case "${annex}" in
+			a*|l*|m*)
+				echo 1 > "${annexgpio}a/value"
+				echo 0 > "${annexgpio}b/value"
+				;;
+			b*|j*)
+				echo 0 > "${annexgpio}a/value"
+				echo 1 > "${annexgpio}b/value"
+				;;
+		esac
+	fi
+
+	if [ -z "${firmware}" ]; then
+		# search for the firmware provided by dsl-vrx200-firmware-xdsl-*
+		if grep -qE "system type.*: (VR9|xRX200)" /proc/cpuinfo; then
+			case "${annex}" in
+			a*|l*|m*)
+				if [ -f "/lib/firmware/lantiq-vrx200-a.bin" ]; then
+					firmware="/lib/firmware/lantiq-vrx200-a.bin"
+				elif [ -f "/tmp/lantiq-vrx200-a.bin" ]; then
+					firmware="/tmp/lantiq-vrx200-a.bin"
+				elif [ -f "/lib/firmware/lantiq-vrx200-b.bin" ] && [ -f "/lib/firmware/lantiq-vrx200-b-to-a.bspatch" ]; then
+					bspatch /lib/firmware/lantiq-vrx200-b.bin \
+						/tmp/lantiq-vrx200-a.bin \
+						/lib/firmware/lantiq-vrx200-b-to-a.bspatch
+					firmware="/tmp/lantiq-vrx200-a.bin"
+				else
+					echo "firmware for annex a not found"
+					return 1
+				fi
+				;;
+			b*|j*)
+				if [ -f "/lib/firmware/vr9_dsl_fw_annex_b.bin" ]; then
+					firmware="/lib/firmware/vr9_dsl_fw_annex_b.bin"
+				elif [ -f "/lib/firmware/lantiq-vrx200-b.bin" ]; then
+					firmware="/lib/firmware/lantiq-vrx200-b.bin"
+				elif [ -f "/tmp/lantiq-vrx200-b.bin" ]; then
+					firmware="/tmp/lantiq-vrx200-b.bin"
+				elif [ -f "/lib/firmware/lantiq-vrx200-a.bin" ] && [ -f "/lib/firmware/lantiq-vrx200-a-to-b.bspatch" ]; then
+					bspatch /lib/firmware/lantiq-vrx200-a.bin \
+						/tmp/lantiq-vrx200-b.bin \
+						/lib/firmware/lantiq-vrx200-a-to-b.bspatch
+					firmware="/tmp/lantiq-vrx200-b.bin"
+				else
+					echo "firmware for annex b not found"
+					return 1
+				fi
+				;;
+			*)
+				echo "annex type not supported use a or b"
+				return 1
+				;;
+			esac
+		fi
+	fi
+
+	[ -z "${firmware}" ] && firmware=/lib/firmware/vdsl.bin
+	[ -f "${firmware}" ] || {
+		echo failed to find $firmware
+		return 1
+	}
+
+	eval "tone_adsl=\"\${tone_adsl_$tone}\""
+	eval "tone_vdsl=\"\${tone_vdsl_$tone}\""
+	[ -n "${tone_adsl}" ] && [ -n "${tone_vdsl}" ] && {
+		lowlevel_cfg "${tone_adsl}" "${tone_vdsl}"
+		lowlevel="-l /tmp/lowlevel.cfg"
+	}
+
+	[ -z "${snr}" ] && snr=0
+	[ -z "${macaddr}" ] && macaddr="00:00:00:00:00:00"
+	autoboot_script "$snr" "$macaddr"
+	autoboot="-a /tmp/dsl.scr -A /tmp/dsl.scr"
+
+	procd_open_instance
+	procd_set_param command /sbin/vdsl_cpe_control \
+			-i$xtse \
+			-n /sbin/dsl_notify.sh \
+			-f ${firmware} \
+			$lowlevel \
+			${mode} \
+			${tc_layer} \
+			$autoboot
+	procd_close_instance
+}
+
+stop_service() {
+	DSL_NOTIFICATION_TYPE="DSL_INTERFACE_STATUS" \
+	DSL_INTERFACE_STATUS="DOWN" \
+		/sbin/dsl_notify.sh
+}
diff --git a/package/network/config/ltq-vdsl-vr9-app/files/dsl_cpe_pipe.sh b/package/network/config/ltq-vdsl-vr9-app/files/dsl_cpe_pipe.sh
new file mode 100644
index 00000000000000..9002b7b3164abd
--- /dev/null
+++ b/package/network/config/ltq-vdsl-vr9-app/files/dsl_cpe_pipe.sh
@@ -0,0 +1,18 @@
+#!/bin/sh
+
+pipe_no=0
+
+# use specified pipe no
+case "$1" in
+0|1|2)
+pipe_no=$1; shift; ;;
+esac
+
+
+#echo "Call dsl_pipe with $*"
+lock /var/lock/dsl_pipe
+echo $* > /tmp/pipe/dsl_cpe${pipe_no}_cmd
+result=$(cat /tmp/pipe/dsl_cpe${pipe_no}_ack)
+lock -u /var/lock/dsl_pipe
+
+echo "$result"
diff --git a/package/network/config/ltq-vdsl-vr9-app/patches/100-compat.patch b/package/network/config/ltq-vdsl-vr9-app/patches/100-compat.patch
new file mode 100644
index 00000000000000..6bc359c3cc9af9
--- /dev/null
+++ b/package/network/config/ltq-vdsl-vr9-app/patches/100-compat.patch
@@ -0,0 +1,11 @@
+--- a/src/dsl_cpe_init_cfg.c
++++ b/src/dsl_cpe_init_cfg.c
+@@ -38,7 +38,7 @@ DSL_InitData_t gInitCfgData =
+       DSL_DEV_HS_TONE_GROUP_CLEANED, \
+       DSL_DEV_HS_TONE_GROUP_CLEANED, \
+       DSL_DEV_HS_TONE_GROUP_CLEANED, \
+-      0x1E116000, 0x37, -1),
++      0x1E116000, 0x3f, -1),
+    DSL_CPE_SIC_SET(DSL_TC_ATM, DSL_EMF_TC_CLEANED, DSL_EMF_TC_CLEANED, DSL_SYSTEMIF_MII, \
+                    DSL_TC_EFM, DSL_EMF_TC_CLEANED, DSL_EMF_TC_CLEANED, DSL_SYSTEMIF_MII),
+    DSL_CPE_MAC_CFG_SET(DSL_EFM_SPEED_100, DSL_EFM_DUPLEX_FULL, DSL_EFM_FLOWCTRL_ON, DSL_EFM_AUTONEG_OFF, \
diff --git a/package/network/config/ltq-vdsl-vr9-app/patches/101-musl.patch b/package/network/config/ltq-vdsl-vr9-app/patches/101-musl.patch
new file mode 100644
index 00000000000000..d66045db614193
--- /dev/null
+++ b/package/network/config/ltq-vdsl-vr9-app/patches/101-musl.patch
@@ -0,0 +1,10 @@
+--- a/src/dsl_cpe_control.c
++++ b/src/dsl_cpe_control.c
+@@ -11,6 +11,7 @@
+ /*
+ Includes
+ */
++#include <limits.h>
+ #include "dsl_cpe_control.h"
+ #include "dsl_cpe_cli.h"
+ #include "dsl_cpe_cli_console.h"
diff --git a/package/network/config/ltq-vdsl-vr9-app/patches/200-autoboot.patch b/package/network/config/ltq-vdsl-vr9-app/patches/200-autoboot.patch
new file mode 100644
index 00000000000000..cc6feb94aa9f9a
--- /dev/null
+++ b/package/network/config/ltq-vdsl-vr9-app/patches/200-autoboot.patch
@@ -0,0 +1,86 @@
+This enables automatic connection after the control daemon is started,
+and also stops the connection on termination.
+
+Using the autoboot restart command is necessary because the stop command
+doesn't actually stop the connection, and would also leave the driver in
+a state where an explicit start command is necessary to connect again.
+
+--- a/src/dsl_cpe_init_cfg.c
++++ b/src/dsl_cpe_init_cfg.c
+@@ -27,7 +27,7 @@ DSL_InitData_t gInitCfgData =
+    DSL_CPE_FW2_SET(DSL_NULL, 0x0),
+    DSL_CPE_XTU_SET(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7),
+    DSL_CPE_LINE_INV_NE_SET(DSL_NULL),
+-   DSL_CPE_AUTOBOOT_CTRL_SET(DSL_AUTOBOOT_CTRL_STOP),
++   DSL_CPE_AUTOBOOT_CTRL_SET(DSL_AUTOBOOT_CTRL_START),
+    DSL_CPE_AUTOBOOT_CFG_SET(DSL_FALSE, DSL_FALSE, DSL_FALSE),
+    DSL_CPE_TEST_MODE_CTRL_SET(DSL_TESTMODE_DISABLE),
+    DSL_CPE_LINE_ACTIVATE_CTRL_SET(DSL_G997_INHIBIT_LDSF, DSL_G997_INHIBIT_ACSF, DSL_G997_NORMAL_STARTUP),
+--- a/src/dsl_cpe_control.c
++++ b/src/dsl_cpe_control.c
+@@ -6515,10 +6515,13 @@ DSL_CPE_STATIC  void DSL_CPE_Termination
+ DSL_CPE_STATIC  DSL_void_t DSL_CPE_Termination (void)
+ {
+ #ifdef INCLUDE_DSL_CPE_CLI_SUPPORT
+-   DSL_int_t nDevice = 0;
+    DSL_char_t buf[32] = "quit";
+ #endif
+ 
++   DSL_Error_t nRet = DSL_SUCCESS;
++   DSL_int_t nDevice = 0;
++   DSL_AutobootConfig_t sAutobootCfg;
++   DSL_AutobootControl_t sAutobootCtl;
+    DSL_CPE_Control_Context_t *pCtrlCtx;
+ 
+    pCtrlCtx = DSL_CPE_GetGlobalContext();
+@@ -6527,6 +6530,50 @@ DSL_CPE_STATIC  DSL_void_t DSL_CPE_Termi
+       pCtrlCtx->bRun = DSL_FALSE;
+    }
+ 
++   for (nDevice = 0; nDevice < DSL_CPE_MAX_DSL_ENTITIES; ++nDevice)
++   {
++      g_bWaitBeforeConfigWrite[nDevice]    = DSL_TRUE;
++      g_bWaitBeforeLinkActivation[nDevice] = DSL_TRUE;
++      g_bWaitBeforeRestart[nDevice]        = DSL_TRUE;
++
++      g_bAutoContinueWaitBeforeConfigWrite[nDevice]    = DSL_FALSE;
++      g_bAutoContinueWaitBeforeLinkActivation[nDevice] = DSL_FALSE;
++      g_bAutoContinueWaitBeforeRestart[nDevice]        = DSL_FALSE;
++
++      memset(&sAutobootCfg, 0x0, sizeof(DSL_AutobootConfig_t));
++      sAutobootCfg.data.nStateMachineOptions.bWaitBeforeConfigWrite    = DSL_TRUE;
++      sAutobootCfg.data.nStateMachineOptions.bWaitBeforeLinkActivation = DSL_TRUE;
++      sAutobootCfg.data.nStateMachineOptions.bWaitBeforeRestart        = DSL_TRUE;
++
++      nRet = (DSL_Error_t)DSL_CPE_Ioctl(
++         DSL_CPE_GetGlobalContext()->fd[nDevice],
++         DSL_FIO_AUTOBOOT_CONFIG_SET, (DSL_int_t)&sAutobootCfg);
++
++      if (nRet < DSL_SUCCESS)
++      {
++         DSL_CCA_DEBUG(DSL_CCA_DBG_ERR, (DSL_CPE_PREFIX
++            "Autoboot configuration for device (%d) failed!, nRet = %d!"
++            DSL_CPE_CRLF, nDevice, sAutobootCtl.accessCtl.nReturn));
++      }
++
++      memset(&sAutobootCtl, 0, sizeof(DSL_AutobootControl_t));
++      sAutobootCtl.data.nCommand = DSL_AUTOBOOT_CTRL_RESTART;
++
++      nRet = (DSL_Error_t)DSL_CPE_Ioctl(
++         DSL_CPE_GetGlobalContext()->fd[nDevice],
++         DSL_FIO_AUTOBOOT_CONTROL_SET, (DSL_int_t)&sAutobootCtl);
++
++      if (nRet < DSL_SUCCESS)
++      {
++         DSL_CCA_DEBUG(DSL_CCA_DBG_ERR, (DSL_CPE_PREFIX
++            "Autoboot restart for device (%d) failed!, nRet = %d!"
++            DSL_CPE_CRLF, nDevice, sAutobootCtl.accessCtl.nReturn));
++      }
++   }
++
++   DSL_CCA_DEBUG(DSL_CCA_DBG_MSG, (DSL_CPE_PREFIX
++      "Autoboot restart executed" DSL_CPE_CRLF));
++
+ #ifdef INCLUDE_DSL_CPE_CLI_SUPPORT
+    for (nDevice = 0; nDevice < DSL_CPE_MAX_DSL_ENTITIES; nDevice++)
+    {
diff --git a/package/network/config/ltq-vdsl-vr9-app/patches/201-sigterm.patch b/package/network/config/ltq-vdsl-vr9-app/patches/201-sigterm.patch
new file mode 100644
index 00000000000000..4e978359835e2e
--- /dev/null
+++ b/package/network/config/ltq-vdsl-vr9-app/patches/201-sigterm.patch
@@ -0,0 +1,19 @@
+--- a/src/dsl_cpe_control.c
++++ b/src/dsl_cpe_control.c
+@@ -6504,7 +6504,7 @@ DSL_CPE_STATIC  void DSL_CPE_Termination
+    /* ignore the signal, we'll handle by ourself */
+    signal (sig, SIG_IGN);
+ 
+-   if (sig == SIGINT)
++   if (sig == SIGINT || sig == SIGTERM)
+    {
+       DSL_CCA_DEBUG(DSL_CCA_DBG_MSG, (DSL_CPE_PREFIX "terminated" DSL_CPE_CRLF));
+       DSL_CPE_Termination ();
+@@ -6803,6 +6803,7 @@ DSL_int_t dsl_cpe_daemon (
+ 
+ #ifndef RTEMS
+    signal (SIGINT, DSL_CPE_TerminationHandler);
++   signal (SIGTERM, DSL_CPE_TerminationHandler);
+ #endif /* RTEMS*/
+ 
+    /* Open DSL_CPE_MAX_DSL_ENTITIES devices*/
diff --git a/package/network/config/ltq-vdsl-vr9-app/patches/300-ubus.patch b/package/network/config/ltq-vdsl-vr9-app/patches/300-ubus.patch
new file mode 100644
index 00000000000000..d257ca2fc4ab63
--- /dev/null
+++ b/package/network/config/ltq-vdsl-vr9-app/patches/300-ubus.patch
@@ -0,0 +1,50 @@
+--- a/src/dsl_cpe_control.c
++++ b/src/dsl_cpe_control.c
+@@ -177,6 +177,9 @@ extern DSL_Error_t DSL_CPE_Pipe_StaticRe
+ #endif /* INCLUDE_DSL_RESOURCE_STATISTICS*/
+ #endif
+ 
++extern void ubus_init();
++extern void ubus_deinit();
++
+ DSL_char_t *g_sFirmwareName1 = DSL_NULL;
+ DSL_FirmwareFeatures_t g_nFwFeatures1 = {DSL_FW_XDSLMODE_CLEANED, DSL_FW_XDSLFEATURE_CLEANED,
+    DSL_FW_XDSLFEATURE_CLEANED};
+@@ -6806,6 +6809,8 @@ DSL_int_t dsl_cpe_daemon (
+    signal (SIGTERM, DSL_CPE_TerminationHandler);
+ #endif /* RTEMS*/
+ 
++   ubus_init();
++
+    /* Open DSL_CPE_MAX_DSL_ENTITIES devices*/
+    for (nDevice = 0; nDevice < DSL_CPE_MAX_DSL_ENTITIES; nDevice++)
+    {
+@@ -7260,6 +7265,7 @@ DSL_int_t dsl_cpe_daemon (
+ #endif /* INCLUDE_DSL_CPE_CLI_SUPPORT */
+ 
+ DSL_CPE_CONTROL_EXIT:
++   ubus_deinit();
+ 
+ #ifdef INCLUDE_DSL_BONDING
+    DSL_CPE_BND_Stop((DSL_CPE_BND_Context_t*)pCtrlCtx->pBnd);
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -11,7 +11,7 @@ else
+ dsl_cpe_control_common_ldflags =
+ endif
+ 
+-dsl_cpe_control_LDADD = -lpthread -lrt
++dsl_cpe_control_LDADD = -lpthread -lrt -lubox -lubus
+ 
+ if INCLUDE_DSL_CPE_DTI_SUPPORT
+     dsl_cpe_control_LDADD += -ldti_agent
+@@ -66,7 +66,8 @@ dsl_cpe_control_SOURCES = \
+ 	dsl_cpe_control.c \
+ 	dsl_cpe_init_cfg.c \
+ 	dsl_cpe_linux.c \
+-	dsl_cpe_debug.c
++	dsl_cpe_debug.c \
++	dsl_cpe_ubus.c
+ 
+ dsl_cpe_control_SOURCES += \
+ 	$(dsl_cpe_control_dti_sources)
diff --git a/package/network/config/ltq-vdsl-vr9-app/src/src/dsl_cpe_ubus.c b/package/network/config/ltq-vdsl-vr9-app/src/src/dsl_cpe_ubus.c
new file mode 100644
index 00000000000000..77a1c67b6aebc2
--- /dev/null
+++ b/package/network/config/ltq-vdsl-vr9-app/src/src/dsl_cpe_ubus.c
@@ -0,0 +1,1170 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * Copyright (C) 2020 Andre Heider <a.heider@gmail.com>
+ */
+
+#include <sys/ioctl.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <fcntl.h>
+#include <libubus.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "dsl_cpe_control.h"
+#include <drv_dsl_cpe_api_ioctl.h>
+#ifdef INCLUDE_DSL_CPE_API_VRX
+#include <drv_mei_cpe_interface.h>
+#endif
+
+#define U16(v1, v2) ( \
+	((uint16_t)(v1) << 8) | \
+	((uint16_t)(v2)))
+
+#define U32(v1, v2, v3, v4) ( \
+	((uint32_t)(v1) << 24) | \
+	((uint32_t)(v2) << 16) | \
+	((uint32_t)(v3) << 8) | \
+	((uint32_t)(v4)))
+
+#define STR_CASE(id, text) \
+	case id: \
+		str = text; \
+		break;
+
+#define STR_CASE_MAP(id, text, number) \
+	case id: \
+		str = text; \
+		map = number; \
+		break;
+
+#define IOCTL(type, request) \
+	type out; \
+	memset(&out, 0, sizeof(type)); \
+	if (ioctl(fd, request, &out)) \
+		return;
+
+#define IOCTL_DIR(type, request, dir) \
+	type out; \
+	memset(&out, 0, sizeof(type)); \
+	out.nDirection = dir; \
+	if (ioctl(fd, request, &out)) \
+		return;
+
+#define IOCTL_DIR_DELT(type, request, dir, delt) \
+	type out; \
+	memset(&out, 0, sizeof(type)); \
+	out.nDirection = dir; \
+	out.nDeltDataType = delt; \
+	if (ioctl(fd, request, &out)) \
+		return;
+
+typedef enum {
+	ANNEX_UNKNOWN = 0,
+	ANNEX_A,
+	ANNEX_B,
+	ANNEX_C,
+	ANNEX_I,
+	ANNEX_J,
+	ANNEX_L,
+	ANNEX_M,
+} annex_t;
+
+typedef enum {
+	STD_UNKNOWN = 0,
+	STD_T1_413,
+	STD_TS_101_388,
+	STD_G_992_1,
+	STD_G_992_2,
+	STD_G_992_3,
+	STD_G_992_4,
+	STD_G_992_5,
+	STD_G_993_1,
+	STD_G_993_2,
+} standard_t;
+
+typedef enum {
+	VECTOR_UNKNOWN = 0,
+	VECTOR_OFF,
+	VECTOR_ON_DS,
+	VECTOR_ON_DS_US,
+} vector_t;
+
+typedef enum {
+	PROFILE_UNKNOWN = 0,
+	PROFILE_8A,
+	PROFILE_8B,
+	PROFILE_8C,
+	PROFILE_8D,
+	PROFILE_12A,
+	PROFILE_12B,
+	PROFILE_17A,
+	PROFILE_30A,
+	PROFILE_35B,
+} profile_t;
+
+/* These values are exported via ubus and backwards compability
+ * needs to be kept!
+ */
+enum {
+	LSTATE_MAP_UNKNOWN = -1,
+	LSTATE_MAP_NOT_INITIALIZED,
+	LSTATE_MAP_EXCEPTION,
+	LSTATE_MAP_IDLE,
+	LSTATE_MAP_SILENT,
+	LSTATE_MAP_HANDSHAKE,
+	LSTATE_MAP_FULL_INIT,
+	LSTATE_MAP_SHOWTIME_NO_SYNC,
+	LSTATE_MAP_SHOWTIME_TC_SYNC,
+	LSTATE_MAP_RESYNC,
+};
+
+/* These values are exported via ubus and backwards compability
+ * needs to be kept!
+ */
+enum {
+	PSTATE_MAP_UNKNOWN = -2,
+	PSTATE_MAP_NA,
+	PSTATE_MAP_L0,
+	PSTATE_MAP_L1,
+	PSTATE_MAP_L2,
+	PSTATE_MAP_L3,
+};
+
+/* These values are exported via ubus and backwards compability
+ * needs to be kept!
+ */
+enum {
+	RAMODE_MAP_UNKNOWN = -1,
+	RAMODE_MAP_MANUAL,
+	RAMODE_MAP_AT_INIT,
+	RAMODE_MAP_DYNAMIC,
+	RAMODE_MAP_DYNAMIC_SOS,
+};
+
+static DSL_CPE_ThreadCtrl_t thread;
+static struct ubus_context *ctx;
+static struct blob_buf b;
+
+static inline void m_null() {
+	blobmsg_add_field(&b, BLOBMSG_TYPE_UNSPEC, "", NULL, 0);
+}
+
+static inline void m_double(const char *id, double value) {
+	blobmsg_add_double(&b, id, value);
+}
+
+static inline void m_bool(const char *id, bool value) {
+	blobmsg_add_u8(&b, id, value);
+}
+
+static inline void m_u32(const char *id, uint32_t value) {
+	blobmsg_add_u64(&b, id, value);
+}
+
+static inline void m_str(const char *id, const char *value) {
+	blobmsg_add_string(&b, id, value);
+}
+
+static inline void m_db(const char *id, int value, int invalid) {
+	if (value != invalid)
+		m_double(id, (double)value / 10);
+}
+
+static inline void m_array(const char *id, const uint8_t *value, size_t len) {
+	void *c = blobmsg_open_array(&b, id);
+
+	for (size_t i = 0; i < len; ++i)
+		blobmsg_add_u16(&b, "", value[i]);
+
+	blobmsg_close_array(&b, c);
+}
+
+static inline void m_array_u16(const char *id, const uint16_t *value, size_t len) {
+	void *c = blobmsg_open_array(&b, id);
+
+	for (size_t i = 0; i < len; ++i)
+		blobmsg_add_u16(&b, "", value[i]);
+
+	blobmsg_close_array(&b, c);
+}
+
+static void m_vendor(const char *id, const uint8_t *value) {
+	// ITU-T T.35: U.S.
+	if (U16(value[0], value[1]) != 0xb500)
+		return;
+
+	const char *str = NULL;
+	switch (U32(value[2], value[3], value[4], value[5])) {
+	STR_CASE(0x414C4342, "Alcatel")
+	STR_CASE(0x414E4456, "Analog Devices")
+	STR_CASE(0x4244434D, "Broadcom")
+	STR_CASE(0x43454E54, "Centillium")
+	STR_CASE(0x4753504E, "Globespan")
+	STR_CASE(0x494B4E53, "Ikanos")
+	STR_CASE(0x4946544E, "Infineon")
+	STR_CASE(0x54535443, "Texas Instruments")
+	STR_CASE(0x544D4D42, "Thomson MultiMedia Broadband")
+	STR_CASE(0x5443544E, "Trend Chip Technologies")
+	STR_CASE(0x53544D49, "ST Micro")
+	};
+
+	if (!str)
+		return;
+
+	if ((value[6] == 0) && (value[7] == 0)) {
+		m_str(id, str);
+		return;
+	}
+
+	char buf[64];
+	sprintf(buf, "%s %d.%d", str, value[6], value[7]);
+	m_str(id, buf);
+
+	return;
+}
+
+annex_t get_annex(const uint8_t *xtse) {
+	if ((xtse[0] & XTSE_1_01_A_T1_413) ||
+	    (xtse[0] & XTSE_1_03_A_1_NO) ||
+	    (xtse[0] & XTSE_1_04_A_1_O) ||
+	    (xtse[1] & XTSE_2_01_A_2_NO) ||
+	    (xtse[2] & XTSE_3_03_A_3_NO) ||
+	    (xtse[2] & XTSE_3_04_A_3_O) ||
+	    (xtse[3] & XTSE_4_01_A_4_NO) ||
+	    (xtse[3] & XTSE_4_02_A_4_O) ||
+	    (xtse[5] & XTSE_6_01_A_5_NO) ||
+	    (xtse[5] & XTSE_6_02_A_5_O) ||
+	    (xtse[7] & XTSE_8_01_A))
+		return ANNEX_A;
+
+	if ((xtse[0] & XTSE_1_05_B_1_NO) ||
+	    (xtse[0] & XTSE_1_06_B_1_O) ||
+	    (xtse[1] & XTSE_2_02_B_2_O) ||
+	    (xtse[2] & XTSE_3_05_B_3_NO) ||
+	    (xtse[2] & XTSE_3_06_B_3_O) ||
+	    (xtse[5] & XTSE_6_03_B_5_NO) ||
+	    (xtse[5] & XTSE_6_04_B_5_O) ||
+	    (xtse[7] & XTSE_8_02_B))
+		return ANNEX_B;
+
+	if ((xtse[0] & XTSE_1_02_C_TS_101388) ||
+	    (xtse[0] & XTSE_1_07_C_1_NO) ||
+	    (xtse[0] & XTSE_1_08_C_1_O) ||
+	    (xtse[1] & XTSE_2_03_C_2_NO) ||
+	    (xtse[1] & XTSE_2_04_C_2_O) ||
+	    (xtse[7] & XTSE_8_03_C))
+		return ANNEX_C;
+
+	if ((xtse[3] & XTSE_4_05_I_3_NO) ||
+	    (xtse[3] & XTSE_4_06_I_3_O) ||
+	    (xtse[4] & XTSE_5_01_I_4_NO) ||
+	    (xtse[4] & XTSE_5_02_I_4_O) ||
+	    (xtse[5] & XTSE_6_07_I_5_NO) ||
+	    (xtse[5] & XTSE_6_08_I_5_O))
+		return ANNEX_I;
+
+	if ((xtse[3] & XTSE_4_07_J_3_NO) ||
+	    (xtse[3] & XTSE_4_08_J_3_O) ||
+	    (xtse[6] & XTSE_7_01_J_5_NO) ||
+	    (xtse[6] & XTSE_7_02_J_5_O))
+		return ANNEX_J;
+
+	if ((xtse[4] & XTSE_5_03_L_3_NO) ||
+	    (xtse[4] & XTSE_5_04_L_3_NO) ||
+	    (xtse[4] & XTSE_5_05_L_3_O) ||
+	    (xtse[4] & XTSE_5_06_L_3_O))
+		return ANNEX_L;
+
+	if ((xtse[4] & XTSE_5_07_M_3_NO) ||
+	    (xtse[4] & XTSE_5_08_M_3_O) ||
+	    (xtse[6] & XTSE_7_03_M_5_NO) ||
+	    (xtse[6] & XTSE_7_04_M_5_O))
+		return ANNEX_M;
+
+	return ANNEX_UNKNOWN;
+}
+
+static standard_t get_standard(const uint8_t *xtse) {
+	if (xtse[0] & XTSE_1_01_A_T1_413)
+		return STD_T1_413;
+
+	if (xtse[0] & XTSE_1_02_C_TS_101388)
+		return STD_TS_101_388;
+
+	if ((xtse[0] & XTSE_1_03_A_1_NO) ||
+	    (xtse[0] & XTSE_1_04_A_1_O) ||
+	    (xtse[0] & XTSE_1_05_B_1_NO) ||
+	    (xtse[0] & XTSE_1_06_B_1_O) ||
+	    (xtse[0] & XTSE_1_07_C_1_NO) ||
+	    (xtse[0] & XTSE_1_08_C_1_O))
+		return STD_G_992_1;
+
+	if ((xtse[1] & XTSE_2_01_A_2_NO) ||
+	    (xtse[1] & XTSE_2_02_B_2_O) ||
+	    (xtse[1] & XTSE_2_03_C_2_NO) ||
+	    (xtse[1] & XTSE_2_04_C_2_O))
+		return STD_G_992_2;
+
+	if ((xtse[2] & XTSE_3_03_A_3_NO) ||
+	    (xtse[2] & XTSE_3_04_A_3_O) ||
+	    (xtse[2] & XTSE_3_05_B_3_NO) ||
+	    (xtse[2] & XTSE_3_06_B_3_O) ||
+	    (xtse[3] & XTSE_4_05_I_3_NO) ||
+	    (xtse[3] & XTSE_4_06_I_3_O) ||
+	    (xtse[3] & XTSE_4_07_J_3_NO) ||
+	    (xtse[3] & XTSE_4_08_J_3_O) ||
+	    (xtse[4] & XTSE_5_03_L_3_NO) ||
+	    (xtse[4] & XTSE_5_04_L_3_NO) ||
+	    (xtse[4] & XTSE_5_05_L_3_O) ||
+	    (xtse[4] & XTSE_5_06_L_3_O) ||
+	    (xtse[4] & XTSE_5_07_M_3_NO) ||
+	    (xtse[4] & XTSE_5_08_M_3_O))
+		return STD_G_992_3;
+
+	if ((xtse[3] & XTSE_4_01_A_4_NO) ||
+	    (xtse[3] & XTSE_4_02_A_4_O) ||
+	    (xtse[4] & XTSE_5_01_I_4_NO) ||
+	    (xtse[4] & XTSE_5_02_I_4_O))
+		return STD_G_992_4;
+
+	if ((xtse[5] & XTSE_6_01_A_5_NO) ||
+	    (xtse[5] & XTSE_6_02_A_5_O) ||
+	    (xtse[5] & XTSE_6_03_B_5_NO) ||
+	    (xtse[5] & XTSE_6_04_B_5_O) ||
+	    (xtse[5] & XTSE_6_07_I_5_NO) ||
+	    (xtse[5] & XTSE_6_08_I_5_O) ||
+	    (xtse[6] & XTSE_7_01_J_5_NO) ||
+	    (xtse[6] & XTSE_7_02_J_5_O) ||
+	    (xtse[6] & XTSE_7_03_M_5_NO) ||
+	    (xtse[6] & XTSE_7_04_M_5_O))
+		return STD_G_992_5;
+
+	if (xtse[7] & XTSE_8_08)
+		return STD_G_993_1;
+
+	if ((xtse[7] & XTSE_8_01_A) ||
+	    (xtse[7] & XTSE_8_02_B) ||
+	    (xtse[7] & XTSE_8_03_C))
+		return STD_G_993_2;
+
+	return STD_UNKNOWN;
+}
+
+static void version_information(int fd) {
+	IOCTL(DSL_VersionInformation_t, DSL_FIO_VERSION_INFORMATION_GET)
+
+	m_str("api_version", out.data.DSL_DriverVersionApi);
+	m_str("firmware_version", out.data.DSL_ChipSetFWVersion);
+	m_str("chipset", out.data.DSL_ChipSetType);
+	m_str("driver_version", out.data.DSL_DriverVersionMeiBsp);
+}
+
+static void line_state(int fd) {
+	IOCTL(DSL_LineState_t, DSL_FIO_LINE_STATE_GET)
+
+	int map = LSTATE_MAP_UNKNOWN;
+	const char *str;
+	switch (out.data.nLineState) {
+	STR_CASE_MAP(DSL_LINESTATE_NOT_INITIALIZED, "Not initialized", LSTATE_MAP_NOT_INITIALIZED)
+	STR_CASE_MAP(DSL_LINESTATE_EXCEPTION, "Exception", LSTATE_MAP_EXCEPTION)
+	STR_CASE(DSL_LINESTATE_NOT_UPDATED, "Not updated")
+	STR_CASE(DSL_LINESTATE_IDLE_REQUEST, "Idle request")
+	STR_CASE_MAP(DSL_LINESTATE_IDLE, "Idle", LSTATE_MAP_IDLE)
+	STR_CASE(DSL_LINESTATE_SILENT_REQUEST, "Silent request")
+	STR_CASE_MAP(DSL_LINESTATE_SILENT, "Silent", LSTATE_MAP_SILENT)
+	STR_CASE_MAP(DSL_LINESTATE_HANDSHAKE, "Handshake", LSTATE_MAP_HANDSHAKE)
+	STR_CASE(DSL_LINESTATE_BONDING_CLR, "Bonding CLR")
+	STR_CASE_MAP(DSL_LINESTATE_FULL_INIT, "Full init", LSTATE_MAP_FULL_INIT)
+	STR_CASE(DSL_LINESTATE_SHORT_INIT_ENTRY, "Short init entry")
+	STR_CASE(DSL_LINESTATE_DISCOVERY, "Discovery")
+	STR_CASE(DSL_LINESTATE_TRAINING, "Training")
+	STR_CASE(DSL_LINESTATE_ANALYSIS, "Analysis")
+	STR_CASE(DSL_LINESTATE_EXCHANGE, "Exchange")
+	STR_CASE_MAP(DSL_LINESTATE_SHOWTIME_NO_SYNC, "Showtime without TC-Layer sync", LSTATE_MAP_SHOWTIME_NO_SYNC)
+	STR_CASE_MAP(DSL_LINESTATE_SHOWTIME_TC_SYNC, "Showtime with TC-Layer sync", LSTATE_MAP_SHOWTIME_TC_SYNC)
+	STR_CASE(DSL_LINESTATE_FASTRETRAIN, "Fastretrain")
+	STR_CASE(DSL_LINESTATE_LOWPOWER_L2, "Lowpower L2")
+	STR_CASE(DSL_LINESTATE_LOOPDIAGNOSTIC_ACTIVE, "Loopdiagnostic active")
+	STR_CASE(DSL_LINESTATE_LOOPDIAGNOSTIC_DATA_EXCHANGE, "Loopdiagnostic data exchange")
+	STR_CASE(DSL_LINESTATE_LOOPDIAGNOSTIC_DATA_REQUEST, "Loopdiagnostic data request")
+	STR_CASE(DSL_LINESTATE_LOOPDIAGNOSTIC_COMPLETE, "Loopdiagnostic complete")
+	STR_CASE_MAP(DSL_LINESTATE_RESYNC, "Resync", LSTATE_MAP_RESYNC)
+	STR_CASE(DSL_LINESTATE_TEST, "Test")
+	STR_CASE(DSL_LINESTATE_TEST_LOOP, "Test loop")
+	STR_CASE(DSL_LINESTATE_TEST_REVERB, "Test reverb")
+	STR_CASE(DSL_LINESTATE_TEST_MEDLEY, "Test medley")
+	STR_CASE(DSL_LINESTATE_TEST_SHOWTIME_LOCK, "Showtime lock")
+	STR_CASE(DSL_LINESTATE_TEST_QUIET, "Quiet")
+	STR_CASE(DSL_LINESTATE_LOWPOWER_L3, "Lowpower L3")
+#ifndef INCLUDE_DSL_CPE_API_DANUBE
+	STR_CASE(DSL_LINESTATE_DISABLED, "Disabled")
+	STR_CASE(DSL_LINESTATE_T1413, "T1413")
+	STR_CASE(DSL_LINESTATE_ORDERLY_SHUTDOWN_REQUEST, "Orderly shutdown request")
+	STR_CASE(DSL_LINESTATE_ORDERLY_SHUTDOWN, "Orderly shutdown")
+	STR_CASE(DSL_LINESTATE_TEST_FILTERDETECTION_ACTIVE, "Test filterdetection active")
+	STR_CASE(DSL_LINESTATE_TEST_FILTERDETECTION_COMPLETE, "Test filterdetection complete")
+#endif
+	default:
+		str = NULL;
+		break;
+	};
+
+	if (str)
+		m_str("state", str);
+
+	if (map != LSTATE_MAP_UNKNOWN )
+		m_u32("state_num", map);
+
+	m_bool("up", out.data.nLineState == DSL_LINESTATE_SHOWTIME_TC_SYNC);
+}
+
+static void pm_channel_counters_showtime(int fd) {
+	IOCTL_DIR(DSL_PM_ChannelCounters_t, DSL_FIO_PM_CHANNEL_COUNTERS_SHOWTIME_GET, DSL_NEAR_END);
+
+	m_u32("uptime", out.interval.nElapsedTime);
+}
+
+static void g997_line_inventory(int fd) {
+	IOCTL_DIR(DSL_G997_LineInventory_t, DSL_FIO_G997_LINE_INVENTORY_GET, DSL_DOWNSTREAM)
+
+	m_array("vendor_id", out.data.G994VendorID, DSL_G997_LI_MAXLEN_VENDOR_ID);
+	m_vendor("vendor", out.data.G994VendorID);
+	m_array("system_vendor_id", out.data.SystemVendorID, DSL_G997_LI_MAXLEN_VENDOR_ID);
+	m_vendor("system_vendor", out.data.SystemVendorID);
+	m_array("version", out.data.VersionNumber, DSL_G997_LI_MAXLEN_VERSION);
+	m_array("serial", out.data.SerialNumber, DSL_G997_LI_MAXLEN_SERIAL);
+}
+
+static void pilot_tones_status(int fd) {
+#ifndef INCLUDE_DSL_CPE_API_DANUBE
+	IOCTL(DSL_PilotTonesStatus_t, DSL_FIO_PILOT_TONES_STATUS_GET);
+
+	m_array_u16("pilot_tones", out.data.nPilotTone, out.data.nNumData);
+#endif
+}
+
+static void band_border_status(int fd, DSL_AccessDir_t direction) {
+	IOCTL(DSL_BandBorderStatus_t, DSL_FIO_BAND_BORDER_STATUS_GET);
+
+	void *c, *c2;
+
+	c = blobmsg_open_array(&b, "limits");
+
+	for (size_t i = 0; i < out.data.nNumData; i++) {
+		c2 = blobmsg_open_table(&b, "");
+		blobmsg_add_u16(&b, "first", out.data.nBandLimits[i].nFirstToneIndex);
+		blobmsg_add_u16(&b, "last", out.data.nBandLimits[i].nLastToneIndex);
+		blobmsg_close_table(&b, c2);
+	}
+
+	blobmsg_close_array(&b, c);
+}
+
+static void g977_get_bit_allocation(int fd, DSL_AccessDir_t direction) {
+	IOCTL_DIR(DSL_G997_BitAllocationNsc_t, DSL_FIO_G997_BIT_ALLOCATION_NSC_GET, direction);
+
+	// create default value to obtain consistent JSON structure
+	m_u32("groupsize", 1);
+	m_u32("groups", out.data.bitAllocationNsc.nNumData);
+	m_array("data", out.data.bitAllocationNsc.nNSCData, out.data.bitAllocationNsc.nNumData);
+}
+
+static void g977_get_snr(int fd, DSL_AccessDir_t direction) {
+	IOCTL_DIR_DELT(DSL_G997_DeltSnr_t, DSL_FIO_G997_DELT_SNR_GET, direction, DSL_DELT_DATA_SHOWTIME);
+
+	m_u32("groupsize", out.data.nGroupSize);
+	m_u32("groups", out.data.deltSnr.nNumData);
+
+	void *c = blobmsg_open_array(&b, "data");
+
+	// SNR -32 ... 95 dB
+	for (uint16_t i  = 0  ; i < out.data.deltSnr.nNumData ; i++)
+		if (out.data.deltSnr.nNSCData[i] != 255 && out.data.deltSnr.nNSCData[i] != 0)
+			m_double("", -32 + (double)out.data.deltSnr.nNSCData[i] / 2);
+		else
+			m_null();
+
+	blobmsg_close_array(&b, c);
+}
+
+static void g977_get_qln(int fd, DSL_AccessDir_t direction) {
+	IOCTL_DIR_DELT(DSL_G997_DeltQln_t, DSL_FIO_G997_DELT_QLN_GET, direction, DSL_DELT_DATA_SHOWTIME);
+
+	m_u32("groupsize", out.data.nGroupSize);
+	m_u32("groups", out.data.deltQln.nNumData);
+
+	void *c = blobmsg_open_array(&b, "data");
+
+	// QLN -150 ... -23 dBm/Hz
+	for (uint16_t i  = 0  ; i < out.data.deltQln.nNumData ; i++)
+		if (out.data.deltQln.nNSCData[i] != 255 && out.data.deltQln.nNSCData[i] != 0)
+			m_double("", -23 - (double)out.data.deltQln.nNSCData[i] / 2);
+		else
+			m_null();
+
+	blobmsg_close_array(&b, c);
+}
+
+static void g977_get_hlog(int fd, DSL_AccessDir_t direction) {
+	IOCTL_DIR_DELT(DSL_G997_DeltHlog_t, DSL_FIO_G997_DELT_HLOG_GET, direction, DSL_DELT_DATA_SHOWTIME);
+
+	m_u32("groupsize", out.data.nGroupSize);
+	m_u32("groups", out.data.deltHlog.nNumData);
+
+	void *c = blobmsg_open_array(&b, "data");
+
+	// HLOG +6 ... -96 dB
+	for (uint16_t i  = 0  ; i < out.data.deltHlog.nNumData ; i++)
+		if (out.data.deltHlog.nNSCData[i] != 1023 && out.data.deltHlog.nNSCData[i] != 0)
+			m_double("", 6 - (double)out.data.deltHlog.nNSCData[i] / 10);
+		else
+			m_null();
+
+	blobmsg_close_array(&b, c);
+}
+
+static void g997_power_management_status(int fd) {
+	IOCTL(DSL_G997_PowerManagementStatus_t, DSL_FIO_G997_POWER_MANAGEMENT_STATUS_GET)
+
+	int map = PSTATE_MAP_UNKNOWN;
+	const char *str;
+	switch (out.data.nPowerManagementStatus) {
+	STR_CASE_MAP(DSL_G997_PMS_NA, "Power management state is not available", PSTATE_MAP_NA)
+	STR_CASE_MAP(DSL_G997_PMS_L0, "L0 - Synchronized", PSTATE_MAP_L0)
+	STR_CASE_MAP(DSL_G997_PMS_L1, "L1 - Power Down Data transmission (G.992.2)", PSTATE_MAP_L1)
+	STR_CASE_MAP(DSL_G997_PMS_L2, "L2 - Power Down Data transmission (G.992.3 and G.992.4)", PSTATE_MAP_L2)
+	STR_CASE_MAP(DSL_G997_PMS_L3, "L3 - No power", PSTATE_MAP_L3)
+	default:
+		str = NULL;
+		break;
+	};
+
+	if (str)
+		m_str("power_state", str);
+
+	if (map != PSTATE_MAP_UNKNOWN)
+		m_u32("power_state_num", map);
+}
+
+static void g997_xtu_system_enabling(int fd, standard_t *standard) {
+	IOCTL(DSL_G997_XTUSystemEnabling_t, DSL_FIO_G997_XTU_SYSTEM_ENABLING_STATUS_GET)
+
+	m_array("xtse", out.data.XTSE, DSL_G997_NUM_XTSE_OCTETS);
+
+	const char *str;
+	switch (get_annex(out.data.XTSE)) {
+	STR_CASE(ANNEX_A, "A")
+	STR_CASE(ANNEX_B, "B")
+	STR_CASE(ANNEX_C, "C")
+	STR_CASE(ANNEX_I, "I")
+	STR_CASE(ANNEX_J, "J")
+	STR_CASE(ANNEX_L, "L")
+	STR_CASE(ANNEX_M, "M")
+	default:
+		str = NULL;
+		break;
+	};
+	if (str)
+		m_str("annex", str);
+
+	*standard = get_standard(out.data.XTSE);
+
+	switch (*standard) {
+	STR_CASE(STD_T1_413, "T1.413")
+	STR_CASE(STD_TS_101_388, "TS 101 388")
+	STR_CASE(STD_G_992_1, "G.992.1")
+	STR_CASE(STD_G_992_2, "G.992.2")
+	STR_CASE(STD_G_992_3, "G.992.3")
+	STR_CASE(STD_G_992_4, "G.992.4")
+	STR_CASE(STD_G_992_5, "G.992.5")
+	STR_CASE(STD_G_993_1, "G.993.1")
+	STR_CASE(STD_G_993_2, "G.993.2")
+	default:
+		str = NULL;
+		break;
+	}
+	if (str)
+		m_str("standard", str);
+}
+
+static void get_vector_status(int fd, vector_t *status) {
+	*status = VECTOR_UNKNOWN;
+
+#ifdef INCLUDE_DSL_CPE_API_VRX
+	if (fd < 0)
+		return;
+
+	IOCTL(IOCTL_MEI_dsmStatus_t, FIO_MEI_DSM_STATUS_GET);
+
+	switch (out.eVectorStatus) {
+	case e_MEI_VECTOR_STAT_OFF:
+		*status = VECTOR_OFF;
+		break;
+	case e_MEI_VECTOR_STAT_ON_DS:
+		*status = VECTOR_ON_DS;
+		break;
+	case e_MEI_VECTOR_STAT_ON_DS_US:
+		*status = VECTOR_ON_DS_US;
+		break;
+	default:
+		break;
+	};
+#endif
+}
+
+static void vector_erb(int fd) {
+#ifdef INCLUDE_DSL_CPE_API_VRX
+	if (fd < 0)
+		return;
+
+	IOCTL(IOCTL_MEI_dsmStatistics_t, FIO_MEI_DSM_STATISTICS_GET);
+
+	m_u32("sent", out.n_processed);
+	m_u32("discarded", out.n_fw_dropped_size + out.n_mei_dropped_size + out.n_mei_dropped_no_pp_cb + out.n_pp_dropped);
+#endif
+}
+
+static void band_plan_status(int fd, profile_t *profile) {
+#if (INCLUDE_DSL_CPE_API_VDSL_SUPPORT == 1)
+	IOCTL(DSL_BandPlanStatus_t, DSL_FIO_BAND_PLAN_STATUS_GET)
+
+	switch (out.data.nProfile) {
+	case DSL_PROFILE_8A:
+		*profile = PROFILE_8A;
+		break;
+	case DSL_PROFILE_8B:
+		*profile = PROFILE_8B;
+		break;
+	case DSL_PROFILE_8C:
+		*profile = PROFILE_8C;
+		break;
+	case DSL_PROFILE_8D:
+		*profile = PROFILE_8D;
+		break;
+	case DSL_PROFILE_12A:
+		*profile = PROFILE_12A;
+		break;
+	case DSL_PROFILE_12B:
+		*profile = PROFILE_12B;
+		break;
+	case DSL_PROFILE_17A:
+		*profile = PROFILE_17A;
+		break;
+	case DSL_PROFILE_30A:
+		*profile = PROFILE_30A;
+		break;
+	case DSL_PROFILE_35B:
+		*profile = PROFILE_35B;
+		break;
+	default:
+		*profile = PROFILE_UNKNOWN;
+		break;
+	};
+
+	const char *str;
+	switch (*profile) {
+	STR_CASE(PROFILE_8A, "8a")
+	STR_CASE(PROFILE_8B, "8b")
+	STR_CASE(PROFILE_8C, "8c")
+	STR_CASE(PROFILE_8D, "8d")
+	STR_CASE(PROFILE_12A, "12a")
+	STR_CASE(PROFILE_12B, "12b")
+	STR_CASE(PROFILE_17A, "17a")
+	STR_CASE(PROFILE_30A, "30a")
+	STR_CASE(PROFILE_35B, "35b")
+	default:
+		str = NULL;
+		break;
+	};
+	if (str)
+		m_str("profile", str);
+#endif
+}
+
+static void line_feature_config(int fd, DSL_AccessDir_t direction, bool *retx) {
+	IOCTL_DIR(DSL_LineFeature_t, DSL_FIO_LINE_FEATURE_STATUS_GET, direction)
+
+	m_bool("trellis", out.data.bTrellisEnable);
+	m_bool("bitswap", out.data.bBitswapEnable);
+	m_bool("retx", out.data.bReTxEnable);
+	m_bool("virtual_noise", out.data.bVirtualNoiseSupport);
+
+	*retx = out.data.bReTxEnable;
+}
+
+static void g997_rate_adaptation_status(int fd, DSL_AccessDir_t direction) {
+#ifndef INCLUDE_DSL_CPE_API_DANUBE
+	IOCTL_DIR(DSL_G997_RateAdaptationStatus_t, DSL_FIO_G997_RATE_ADAPTATION_STATUS_GET, direction);
+
+	int map = RAMODE_MAP_UNKNOWN;
+	const char *str;
+	switch (out.data.RA_MODE) {
+	STR_CASE_MAP(DSL_G997_RA_MODE_MANUAL, "Manual", RAMODE_MAP_MANUAL)
+	STR_CASE_MAP(DSL_G997_RA_MODE_AT_INIT, "At initialization", RAMODE_MAP_AT_INIT)
+	STR_CASE_MAP(DSL_G997_RA_MODE_DYNAMIC, "Dynamic", RAMODE_MAP_DYNAMIC)
+	STR_CASE_MAP(DSL_G997_RA_MODE_DYNAMIC_SOS, "Dynamic with SOS", RAMODE_MAP_DYNAMIC_SOS)
+	default:
+		str = NULL;
+		break;
+	};
+
+	if (str)
+		m_str("ra_mode", str);
+
+	if (map != PSTATE_MAP_UNKNOWN)
+		m_u32("ra_mode_num", map);
+#endif
+}
+
+static void g997_channel_status(int fd, DSL_AccessDir_t direction) {
+	IOCTL_DIR(DSL_G997_ChannelStatus_t, DSL_FIO_G997_CHANNEL_STATUS_GET, direction);
+
+	m_u32("interleave_delay", out.data.ActualInterleaveDelay * 10);
+	m_double("inp", (double)out.data.ActualImpulseNoiseProtection / 10);
+#ifndef INCLUDE_DSL_CPE_API_DANUBE
+	// prefer ACTNDR, see comments in drv_dsl_cpe_api_g997.h
+	m_u32("data_rate", out.data.ActualNetDataRate);
+#else
+	m_u32("data_rate", out.data.ActualDataRate);
+#endif
+}
+
+static void g997_line_status(int fd, DSL_AccessDir_t direction) {
+	IOCTL_DIR_DELT(DSL_G997_LineStatus_t, DSL_FIO_G997_LINE_STATUS_GET, direction, DSL_DELT_DATA_SHOWTIME);
+
+	// invalid value indicators taken from drv_dsl_cpe_api_g997.h
+	m_db("latn", out.data.LATN, 1271);
+	m_db("satn", out.data.SATN, 1271);
+	m_db("snr", out.data.SNR, -641);
+	m_db("actps", out.data.ACTPS, -901);
+	m_db("actatp", out.data.ACTATP, -512);
+	m_u32("attndr", out.data.ATTNDR);
+}
+
+static void pm_retx_counters_showtime(int fd, DSL_XTUDir_t direction) {
+#ifdef INCLUDE_DSL_CPE_PM_RETX_COUNTERS
+	IOCTL_DIR(DSL_PM_ReTxCounters_t, DSL_FIO_PM_RETX_COUNTERS_SHOWTIME_GET, direction);
+
+	m_u32("mineftr", out.data.nEftrMin);
+#endif
+}
+
+#ifndef INCLUDE_DSL_CPE_API_DANUBE
+static void olr_statistics(int fd, DSL_AccessDir_t direction) {
+	IOCTL_DIR(DSL_OlrStatistics_t, DSL_FIO_OLR_STATISTICS_GET, direction)
+
+	void *c = blobmsg_open_table(&b, "bitswap");
+	m_u32("requested", out.data.nBitswapRequested + out.data.nBitswapRequested);
+	m_u32("executed", out.data.nBitswapExecuted);
+	m_u32("rejected", out.data.nBitswapRejected);
+	m_u32("timeout", out.data.nBitswapTimeout);
+	blobmsg_close_table(&b, c);
+
+	c = blobmsg_open_table(&b, "sra");
+	m_u32("requested", out.data.nSraRequested);
+	m_u32("executed", out.data.nSraExecuted);
+	m_u32("rejected", out.data.nSraRejected);
+	m_u32("timeout", out.data.nSraTimeout);
+	blobmsg_close_table(&b, c);
+
+	c = blobmsg_open_table(&b, "sos");
+	m_u32("requested", out.data.nSosRequested);
+	m_u32("executed", out.data.nSosExecuted);
+	m_u32("rejected", out.data.nSosRejected);
+	m_u32("timeout", out.data.nSosTimeout);
+	blobmsg_close_table(&b, c);
+}
+#endif
+
+static void pm_line_sec_counters_total(int fd, DSL_XTUDir_t direction) {
+	IOCTL_DIR(DSL_PM_LineSecCountersTotal_t, DSL_FIO_PM_LINE_SEC_COUNTERS_TOTAL_GET, direction)
+
+	m_u32("es", out.data.nES);
+	m_u32("ses", out.data.nSES);
+	m_u32("loss", out.data.nLOSS);
+	m_u32("uas", out.data.nUAS);
+	m_u32("lofs", out.data.nLOFS);
+#ifndef INCLUDE_DSL_CPE_API_DANUBE
+	m_u32("fecs", out.data.nFECS);
+#endif
+}
+
+static void pm_retx_counters_total(int fd, DSL_XTUDir_t direction) {
+#ifdef INCLUDE_DSL_CPE_PM_RETX_COUNTERS
+	IOCTL_DIR(DSL_PM_ReTxCountersTotal_t, DSL_FIO_PM_RETX_COUNTERS_TOTAL_GET, direction);
+
+	m_u32("leftrs", out.data.nLeftr);
+#endif
+}
+
+static void pm_channel_counters_total(int fd, DSL_XTUDir_t direction) {
+	IOCTL_DIR(DSL_PM_ChannelCountersTotal_t, DSL_FIO_PM_CHANNEL_COUNTERS_TOTAL_GET, direction);
+
+	m_u32("cv_c", out.data.nCodeViolations);
+	m_u32("fec_c", out.data.nFEC);
+}
+
+static void pm_data_path_counters_total(int fd, DSL_XTUDir_t direction) {
+	IOCTL_DIR(DSL_PM_DataPathCountersTotal_t, DSL_FIO_PM_DATA_PATH_COUNTERS_TOTAL_GET, direction);
+
+	m_u32("hec", out.data.nHEC);
+	m_u32("ibe", out.data.nIBE);
+	m_u32("crc_p", out.data.nCRC_P);
+	m_u32("crcp_p", out.data.nCRCP_P);
+	m_u32("cv_p", out.data.nCV_P);
+	m_u32("cvp_p", out.data.nCVP_P);
+}
+
+static void retx_statistics(int fd, DSL_XTUDir_t direction) {
+#ifdef INCLUDE_DSL_CPE_PM_RETX_COUNTERS
+#ifdef INCLUDE_DSL_CPE_PM_RETX_THRESHOLDS
+	IOCTL_DIR(DSL_ReTxStatistics_t, DSL_FIO_RETX_STATISTICS_GET, direction);
+
+	m_u32("rx_corrupted", out.data.nRxCorruptedTotal);
+	m_u32("rx_uncorrected_protected", out.data.nRxUncorrectedProtected);
+	m_u32("rx_retransmitted", out.data.nRxRetransmitted);
+	m_u32("rx_corrected", out.data.nRxCorrected);
+	m_u32("tx_retransmitted", out.data.nTxRetransmitted);
+#endif
+#endif
+}
+
+static void describe_mode(standard_t standard, profile_t profile, vector_t vector) {
+	char buf[128];
+
+	switch (standard) {
+	case STD_T1_413:
+		strcpy(buf, "T1.413");
+		break;
+	case STD_TS_101_388:
+		strcpy(buf, "TS 101 388");
+		break;
+	case STD_G_992_1:
+		strcpy(buf, "G.992.1 (ADSL)");
+		break;
+	case STD_G_992_2:
+		strcpy(buf, "G.992.2 (ADSL lite)");
+		break;
+	case STD_G_992_3:
+		strcpy(buf, "G.992.3 (ADSL2)");
+		break;
+	case STD_G_992_4:
+		strcpy(buf, "G.992.4 (ADSL2 lite)");
+		break;
+	case STD_G_992_5:
+		strcpy(buf, "G.992.5 (ADSL2+)");
+		break;
+	case STD_G_993_1:
+		strcpy(buf, "G.993.1 (VDSL)");
+		break;
+	case STD_G_993_2:
+		strcpy(buf, "G.993.2 (VDSL2");
+
+		switch (profile) {
+		case PROFILE_8A:
+			strcat(buf, ", Profile 8a");
+			break;
+		case PROFILE_8B:
+			strcat(buf, ", Profile 8b");
+			break;
+		case PROFILE_8C:
+			strcat(buf, ", Profile 8c");
+			break;
+		case PROFILE_8D:
+			strcat(buf, ", Profile 8d");
+			break;
+		case PROFILE_12A:
+			strcat(buf, ", Profile 12a");
+			break;
+		case PROFILE_12B:
+			strcat(buf, ", Profile 12b");
+			break;
+		case PROFILE_17A:
+			strcat(buf, ", Profile 17a");
+			break;
+		case PROFILE_30A:
+			strcat(buf, ", Profile 30a");
+			break;
+		case PROFILE_35B:
+			strcat(buf, ", Profile 35b");
+			break;
+		default:
+			break;
+		};
+
+		switch (vector) {
+		case VECTOR_ON_DS:
+			strcat(buf, ", with downstream vectoring");
+			break;
+		case VECTOR_ON_DS_US:
+			strcat(buf, ", with down- and upstream vectoring");
+			break;
+		default:
+			break;
+		};
+
+		strcat(buf, ")");
+		break;
+	default:
+		return;
+	};
+
+	m_str("mode", buf);
+}
+
+static int line_statistics(struct ubus_context *ctx, struct ubus_object *obj,
+                   struct ubus_request_data *req, const char *method,
+                   struct blob_attr *msg)
+{
+	int fd;
+	void *c, *c2;
+
+#ifndef INCLUDE_DSL_CPE_API_DANUBE
+	fd = open(DSL_CPE_DEVICE_NAME "/0", O_RDWR, 0644);
+#else
+	fd = open(DSL_CPE_DEVICE_NAME, O_RDWR, 0644);
+#endif
+	if (fd < 0)
+		return UBUS_STATUS_UNKNOWN_ERROR;
+
+	blob_buf_init(&b, 0);
+
+	pilot_tones_status(fd);
+
+	c = blobmsg_open_table(&b, "bands");
+	c2 = blobmsg_open_table(&b, "downstream");
+	band_border_status(fd, DSL_DOWNSTREAM);
+	blobmsg_close_table(&b, c2);
+	c2 = blobmsg_open_table(&b, "upstream");
+	band_border_status(fd, DSL_UPSTREAM);
+	blobmsg_close_table(&b, c2);
+	blobmsg_close_table(&b, c);
+
+	c = blobmsg_open_table(&b, "bits");
+	c2 = blobmsg_open_table(&b, "downstream");
+	g977_get_bit_allocation(fd, DSL_DOWNSTREAM);
+	blobmsg_close_table(&b, c2);
+	c2 = blobmsg_open_table(&b, "upstream");
+	g977_get_bit_allocation(fd, DSL_UPSTREAM);
+	blobmsg_close_table(&b, c2);
+	blobmsg_close_table(&b, c);
+
+	c = blobmsg_open_table(&b, "snr");
+	c2 = blobmsg_open_table(&b, "downstream");
+	g977_get_snr(fd, DSL_DOWNSTREAM);
+	blobmsg_close_table(&b, c2);
+	c2 = blobmsg_open_table(&b, "upstream");
+	g977_get_snr(fd, DSL_UPSTREAM);
+	blobmsg_close_table(&b, c2);
+	blobmsg_close_table(&b, c);
+
+	c = blobmsg_open_table(&b, "qln");
+	c2 = blobmsg_open_table(&b, "downstream");
+	g977_get_qln(fd, DSL_DOWNSTREAM);
+	blobmsg_close_table(&b, c2);
+	c2 = blobmsg_open_table(&b, "upstream");
+	g977_get_qln(fd, DSL_UPSTREAM);
+	blobmsg_close_table(&b, c2);
+	blobmsg_close_table(&b, c);
+
+	c = blobmsg_open_table(&b, "hlog");
+	c2 = blobmsg_open_table(&b, "downstream");
+	g977_get_hlog(fd, DSL_DOWNSTREAM);
+	blobmsg_close_table(&b, c2);
+	c2 = blobmsg_open_table(&b, "upstream");
+	g977_get_hlog(fd, DSL_UPSTREAM);
+	blobmsg_close_table(&b, c2);
+	blobmsg_close_table(&b, c);
+
+	ubus_send_reply(ctx, req, b.head);
+
+	close(fd);
+
+	return 0;
+}
+
+static int metrics(struct ubus_context *ctx, struct ubus_object *obj,
+		   struct ubus_request_data *req, const char *method,
+		   struct blob_attr *msg)
+{
+	int fd, fd_mei;
+	void *c, *c2;
+	standard_t standard = STD_UNKNOWN;
+	profile_t profile = PROFILE_UNKNOWN;
+	vector_t vector = VECTOR_UNKNOWN;
+	bool retx_up = false, retx_down = false;
+
+#ifndef INCLUDE_DSL_CPE_API_DANUBE
+	fd = open(DSL_CPE_DEVICE_NAME "/0", O_RDWR, 0644);
+#else
+	fd = open(DSL_CPE_DEVICE_NAME, O_RDWR, 0644);
+#endif
+	if (fd < 0)
+		return UBUS_STATUS_UNKNOWN_ERROR;
+
+#ifdef INCLUDE_DSL_CPE_API_VRX
+	fd_mei = open(DSL_CPE_DSL_LOW_DEV "/0", O_RDWR, 0644);
+#else
+	fd_mei = -1;
+#endif
+
+	blob_buf_init(&b, 0);
+
+	version_information(fd);
+	line_state(fd);
+	pm_channel_counters_showtime(fd);
+
+	c = blobmsg_open_table(&b, "atu_c");
+	g997_line_inventory(fd);
+	blobmsg_close_table(&b, c);
+
+	g997_power_management_status(fd);
+	g997_xtu_system_enabling(fd, &standard);
+
+	if (standard == STD_G_993_2) {
+		band_plan_status(fd, &profile);
+		get_vector_status(fd_mei, &vector);
+	}
+
+	describe_mode(standard, profile, vector);
+
+	c = blobmsg_open_table(&b, "upstream");
+	switch (vector) {
+	case VECTOR_OFF:
+		m_bool("vector", false);
+		break;
+	case VECTOR_ON_DS_US:
+		m_bool("vector", true);
+		break;
+	default:
+		break;
+	};
+	line_feature_config(fd, DSL_UPSTREAM, &retx_up);
+	g997_rate_adaptation_status(fd, DSL_UPSTREAM);
+	g997_channel_status(fd, DSL_UPSTREAM);
+	g997_line_status(fd, DSL_UPSTREAM);
+	if (retx_up)
+		pm_retx_counters_showtime(fd, DSL_FAR_END);
+	blobmsg_close_table(&b, c);
+
+	c = blobmsg_open_table(&b, "downstream");
+	switch (vector) {
+	case VECTOR_OFF:
+		m_bool("vector", false);
+		break;
+	case VECTOR_ON_DS:
+	case VECTOR_ON_DS_US:
+		m_bool("vector", true);
+		break;
+	default:
+		break;
+	};
+	line_feature_config(fd, DSL_DOWNSTREAM, &retx_down);
+	g997_rate_adaptation_status(fd, DSL_DOWNSTREAM);
+	g997_channel_status(fd, DSL_DOWNSTREAM);
+	g997_line_status(fd, DSL_DOWNSTREAM);
+	if (retx_down)
+		pm_retx_counters_showtime(fd, DSL_NEAR_END);
+	blobmsg_close_table(&b, c);
+
+#ifndef INCLUDE_DSL_CPE_API_DANUBE
+	c = blobmsg_open_table(&b, "olr");
+	c2 = blobmsg_open_table(&b, "downstream");
+	olr_statistics(fd, DSL_DOWNSTREAM);
+	blobmsg_close_table(&b, c2);
+	c2 = blobmsg_open_table(&b, "upstream");
+	olr_statistics(fd, DSL_UPSTREAM);
+	blobmsg_close_table(&b, c2);
+	blobmsg_close_table(&b, c);
+#endif
+
+	c = blobmsg_open_table(&b, "errors");
+	c2 = blobmsg_open_table(&b, "near");
+	pm_line_sec_counters_total(fd, DSL_NEAR_END);
+	if (retx_down)
+		pm_retx_counters_total(fd, DSL_NEAR_END);
+	pm_channel_counters_total(fd, DSL_NEAR_END);
+	pm_data_path_counters_total(fd, DSL_NEAR_END);
+	retx_statistics(fd, DSL_NEAR_END);
+	blobmsg_close_table(&b, c2);
+
+	c2 = blobmsg_open_table(&b, "far");
+	pm_line_sec_counters_total(fd, DSL_FAR_END);
+	if (retx_up)
+		pm_retx_counters_total(fd, DSL_FAR_END);
+	pm_channel_counters_total(fd, DSL_FAR_END);
+	pm_data_path_counters_total(fd, DSL_FAR_END);
+	retx_statistics(fd, DSL_FAR_END);
+	blobmsg_close_table(&b, c2);
+	blobmsg_close_table(&b, c);
+
+	switch (vector) {
+	case VECTOR_ON_DS:
+	case VECTOR_ON_DS_US:
+		c = blobmsg_open_table(&b, "erb");
+		vector_erb(fd_mei);
+		blobmsg_close_table(&b, c);
+		break;
+	default:
+		break;
+	};
+
+	ubus_send_reply(ctx, req, b.head);
+
+	if (fd_mei >= 0)
+		close(fd_mei);
+	close(fd);
+
+	return 0;
+}
+
+static const struct ubus_method dsl_methods[] = {
+	UBUS_METHOD_NOARG("metrics", metrics),
+	UBUS_METHOD_NOARG("statistics", line_statistics)
+};
+
+static struct ubus_object_type dsl_object_type =
+	UBUS_OBJECT_TYPE("dsl", dsl_methods);
+
+static struct ubus_object dsl_object = {
+	.name = "dsl",
+	.type = &dsl_object_type,
+	.methods = dsl_methods,
+	.n_methods = ARRAY_SIZE(dsl_methods),
+};
+
+static DSL_int_t ubus_main(DSL_CPE_Thread_Params_t *params) {
+	uloop_run();
+	return 0;
+}
+
+void ubus_init() {
+	uloop_init();
+
+	ctx = ubus_connect(NULL);
+	if (!ctx)
+		return;
+
+	if (ubus_add_object(ctx, &dsl_object)) {
+		ubus_free(ctx);
+		ctx = NULL;
+		return;
+	}
+
+	ubus_add_uloop(ctx);
+
+	DSL_CPE_ThreadInit(&thread, "ubus", ubus_main, DSL_CPE_PIPE_STACK_SIZE, DSL_CPE_PIPE_PRIORITY, 0, 0);
+}
+
+void ubus_deinit() {
+	if (!ctx)
+		return;
+
+	ubus_free(ctx);
+	uloop_done();
+
+	DSL_CPE_ThreadShutdown(&thread, 1000);
+}
diff --git a/package/network/config/netifd/Makefile b/package/network/config/netifd/Makefile
index 488b9db2b0b8d6..31fd0838a49309 100644
--- a/package/network/config/netifd/Makefile
+++ b/package/network/config/netifd/Makefile
@@ -5,14 +5,16 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/netifd.git
-PKG_SOURCE_DATE:=2022-08-25
-PKG_SOURCE_VERSION:=76d2d41b7355e02f95fbfa79affbd232fb090595
-PKG_MIRROR_HASH:=cd754decce7d9f9c69e0ad8c6801f306fa37dd6c8a7039aea610c1c71d06b8f9
+PKG_SOURCE_DATE:=2023-06-04
+PKG_SOURCE_VERSION:=ec9dba72124597b7224bbfe75960386dc320f4bd
+PKG_MIRROR_HASH:=baee39a3882a2b03fc83a3a6a8963c340fa8d884c7a8c9e80e7d2dddc50e24bd
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=
 
+PKG_BUILD_FLAGS:=lto
+
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/cmake.mk
 
@@ -30,10 +32,7 @@ endef
 
 TARGET_CFLAGS += \
 	-I$(STAGING_DIR)/usr/include/libnl-tiny \
-	-I$(STAGING_DIR)/usr/include \
-	-flto
-
-TARGET_LDFLAGS += -flto -fuse-linker-plugin
+	-I$(STAGING_DIR)/usr/include
 
 CMAKE_OPTIONS += \
 	-DLIBNL_LIBS=-lnl-tiny \
diff --git a/package/network/config/netifd/files/etc/init.d/packet_steering b/package/network/config/netifd/files/etc/init.d/packet_steering
new file mode 100644
index 00000000000000..9d8f791e23b305
--- /dev/null
+++ b/package/network/config/netifd/files/etc/init.d/packet_steering
@@ -0,0 +1,18 @@
+#!/bin/sh /etc/rc.common
+
+START=25
+USE_PROCD=1
+
+start_service() {
+	reload_service
+}
+
+service_triggers() {
+	procd_add_reload_trigger "network"
+	procd_add_reload_trigger "firewall"
+	procd_add_raw_trigger "interface.*" 1000 /etc/init.d/packet_steering reload
+}
+
+reload_service() {
+	/usr/libexec/network/packet-steering.sh
+}
diff --git a/package/network/config/netifd/files/lib/netifd/proto/dhcp.sh b/package/network/config/netifd/files/lib/netifd/proto/dhcp.sh
index ea6d872eb4926c..636b4654ff0535 100755
--- a/package/network/config/netifd/files/lib/netifd/proto/dhcp.sh
+++ b/package/network/config/netifd/files/lib/netifd/proto/dhcp.sh
@@ -67,7 +67,7 @@ proto_dhcp_setup() {
 		-p /var/run/udhcpc-$iface.pid \
 		-s /lib/netifd/dhcp.script \
 		-f -t 0 -i "$iface" \
-		${ipaddr:+-r $ipaddr} \
+		${ipaddr:+-r ${ipaddr/\/*/}} \
 		${hostname:+-x "hostname:$hostname"} \
 		${vendorid:+-V "$vendorid"} \
 		$clientid $defaultreqopts $broadcast $norelease $dhcpopts
diff --git a/package/network/config/netifd/files/usr/libexec/network/packet-steering.sh b/package/network/config/netifd/files/usr/libexec/network/packet-steering.sh
new file mode 100644
index 00000000000000..799c0808053f8d
--- /dev/null
+++ b/package/network/config/netifd/files/usr/libexec/network/packet-steering.sh
@@ -0,0 +1,70 @@
+#!/bin/sh
+NPROCS="$(grep -c "^processor.*:" /proc/cpuinfo)"
+[ "$NPROCS" -gt 1 ] || exit
+
+PROC_MASK="$(( (1 << $NPROCS) - 1 ))"
+
+find_irq_cpu() {
+	local dev="$1"
+	local match="$(grep -m 1 "$dev\$" /proc/interrupts)"
+	local cpu=0
+
+	[ -n "$match" ] && {
+		set -- $match
+		shift
+		for cur in $(seq 1 $NPROCS); do
+			[ "$1" -gt 0 ] && {
+				cpu=$(($cur - 1))
+				break
+			}
+			shift
+		done
+	}
+
+	echo "$cpu"
+}
+
+set_hex_val() {
+	local file="$1"
+	local val="$2"
+	val="$(printf %x "$val")"
+	[ -n "$DEBUG" ] && echo "$file = $val"
+	echo "$val" > "$file"
+}
+
+packet_steering="$(uci get "network.@globals[0].packet_steering")"
+[ "$packet_steering" != 1 ] && exit 0
+
+exec 512>/var/lock/smp_tune.lock
+flock 512 || exit 1
+
+[ -e "/usr/libexec/platform/packet-steering.sh" ] && {
+	/usr/libexec/platform/packet-steering.sh
+	exit 0
+}
+
+for dev in /sys/class/net/*; do
+	[ -d "$dev" ] || continue
+
+	# ignore virtual interfaces
+	[ -n "$(ls "${dev}/" | grep '^lower_')" ] && continue
+	[ -d "${dev}/device" ] || continue
+
+	device="$(readlink "${dev}/device")"
+	device="$(basename "$device")"
+	irq_cpu="$(find_irq_cpu "$device")"
+	irq_cpu_mask="$((1 << $irq_cpu))"
+
+	for q in ${dev}/queues/tx-*; do
+		set_hex_val "$q/xps_cpus" "$PROC_MASK"
+	done
+
+	# ignore dsa slave ports for RPS
+	subsys="$(readlink "${dev}/device/subsystem")"
+	subsys="$(basename "$subsys")"
+	[ "$subsys" = "mdio_bus" ] && continue
+
+	for q in ${dev}/queues/rx-*; do
+		set_hex_val "$q/rps_cpus" "$PROC_MASK"
+	done
+done
diff --git a/package/network/config/qos-scripts/Makefile b/package/network/config/qos-scripts/Makefile
index d6e7df1467013e..774ce4d94a4ff2 100644
--- a/package/network/config/qos-scripts/Makefile
+++ b/package/network/config/qos-scripts/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=qos-scripts
 PKG_VERSION:=1.3.1
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=33
 PKG_LICENSE:=GPL-2.0
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
diff --git a/package/network/config/qos-scripts/files/usr/bin/qos-start b/package/network/config/qos-scripts/files/usr/bin/qos-start
index 68dae706389b89..13d777209581d2 100755
--- a/package/network/config/qos-scripts/files/usr/bin/qos-start
+++ b/package/network/config/qos-scripts/files/usr/bin/qos-start
@@ -1,4 +1,4 @@
 #!/bin/sh
 
-qos-stop 
+qos-stop
 /usr/lib/qos/generate.sh all | sh
diff --git a/package/network/config/qos-scripts/files/usr/bin/qos-stat b/package/network/config/qos-scripts/files/usr/bin/qos-stat
index 03b737c89dc9f0..454e18aa72e6f4 100755
--- a/package/network/config/qos-scripts/files/usr/bin/qos-stat
+++ b/package/network/config/qos-scripts/files/usr/bin/qos-stat
@@ -32,7 +32,7 @@ print_comments() {
 	echo '# Direction: '"$2"
 	echo '# Stats:     '"$3"
 	echo ''
-}	
+}
 
 get_device() {
 	( config_load network; scan_interfaces; config_get "$1" ifname )
diff --git a/package/network/config/qos-scripts/files/usr/lib/qos/generate.sh b/package/network/config/qos-scripts/files/usr/lib/qos/generate.sh
index 62e7283633e08e..13aa173d182549 100755
--- a/package/network/config/qos-scripts/files/usr/lib/qos/generate.sh
+++ b/package/network/config/qos-scripts/files/usr/lib/qos/generate.sh
@@ -2,11 +2,10 @@
 [ -e /lib/functions.sh ] && . /lib/functions.sh || . ./functions.sh
 [ -x /sbin/modprobe ] && {
 	insmod="modprobe"
-	rmmod="$insmod -r"
 } || {
 	insmod="insmod"
-	rmmod="rmmod"
 }
+rmmod="rmmod"
 
 add_insmod() {
 	eval "export isset=\${insmod_$1}"
@@ -65,7 +64,7 @@ parse_matching_rule() {
 	append "$var" "${proto:+-p $proto}"
 	for option in $options; do
 		config_get value "$section" "$option"
-		
+
 		case "$pkt:$option" in
 			*:srchost)
 				append "$var" "-s $value"
@@ -283,14 +282,14 @@ start_interface() {
 	config_get device "$iface" device
 	config_get_bool enabled "$iface" enabled 1
 	[ -z "$device" -o 1 -ne "$enabled" ] && {
-		return 1 
+		return 1
 	}
 	config_get upload "$iface" upload
 	config_get_bool halfduplex "$iface" halfduplex
 	config_get download "$iface" download
 	config_get classgroup "$iface" classgroup
 	config_get_bool overhead "$iface" overhead 0
-	
+
 	download="${download:-${halfduplex:+$upload}}"
 	enum_classes "$classgroup"
 	for dir in ${halfduplex:-up} ${download:+down}; do
@@ -374,7 +373,7 @@ add_rules() {
 	local var="$1"
 	local rules="$2"
 	local prefix="$3"
-	
+
 	for rule in $rules; do
 		unset iptrule
 		config_get target "$rule" target
@@ -438,7 +437,7 @@ EOF
 
 for command in $iptables; do
 	cat <<EOF
-	$command -w -t mangle -N qos_${cg} 
+	$command -w -t mangle -N qos_${cg}
 	$command -w -t mangle -N qos_${cg}_ct
 EOF
 done
diff --git a/package/network/config/qos-scripts/files/usr/lib/qos/tcrules.awk b/package/network/config/qos-scripts/files/usr/lib/qos/tcrules.awk
index 21df391054f2d5..be95f99b01d120 100644
--- a/package/network/config/qos-scripts/files/usr/lib/qos/tcrules.awk
+++ b/package/network/config/qos-scripts/files/usr/lib/qos/tcrules.awk
@@ -103,4 +103,3 @@ END {
 		}
 	}
 }
-
diff --git a/package/network/config/qosify/Makefile b/package/network/config/qosify/Makefile
index be0bc6657c620a..f4ad0422354fc6 100644
--- a/package/network/config/qosify/Makefile
+++ b/package/network/config/qosify/Makefile
@@ -11,10 +11,10 @@ include $(INCLUDE_DIR)/kernel.mk
 PKG_NAME:=qosify
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/qosify.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2022-04-08
-PKG_SOURCE_VERSION:=ef82defaae26619e5b2ebddfdd86e9de61c399f1
-PKG_MIRROR_HASH:=8e4ca65d23a85aad774af51dc62cfaa4615111ffd2c7922258ac8f026a62b013
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_SOURCE_DATE:=2023-03-07
+PKG_SOURCE_VERSION:=9a47ea4b683dd845ec94534fcd82d3117c9ab313
+PKG_MIRROR_HASH:=c4c313aed4a405492201612bdfef5e219c9a994a35f35acc84fc8327d9aa73d2
+PKG_RELEASE:=1
 
 PKG_LICENSE:=GPL-2.0
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
diff --git a/package/network/config/swconfig/Makefile b/package/network/config/swconfig/Makefile
index 4d3e572d824a6a..6549075e5c5901 100644
--- a/package/network/config/swconfig/Makefile
+++ b/package/network/config/swconfig/Makefile
@@ -13,6 +13,8 @@ PKG_RELEASE:=12
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=GPL-2.0
 
+PKG_BUILD_FLAGS:=lto
+
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/kernel.mk
 
@@ -23,9 +25,6 @@ define Package/swconfig
   TITLE:=Switch configuration utility
 endef
 
-TARGET_CFLAGS += -flto
-TARGET_LDFLAGS += -flto=jobserver
-
 TARGET_CPPFLAGS := \
 	-D_GNU_SOURCE \
 	-I$(STAGING_DIR)/usr/include/libnl-tiny \
diff --git a/package/network/config/swconfig/src/cli.c b/package/network/config/swconfig/src/cli.c
index eab6c64742e96d..2601f346db1301 100644
--- a/package/network/config/swconfig/src/cli.c
+++ b/package/network/config/swconfig/src/cli.c
@@ -101,6 +101,24 @@ speed_str(int speed)
 	return "unknown";
 }
 
+static void
+free_attr_val(const struct switch_attr *attr, const struct switch_val *val)
+{
+	switch (attr->type) {
+	case SWITCH_TYPE_STRING:
+		free(val->value.s);
+		break;
+	case SWITCH_TYPE_PORTS:
+		free(val->value.ports);
+		break;
+	case SWITCH_TYPE_LINK:
+		free(val->value.link);
+		break;
+	default:
+		break;
+	}
+}
+
 static void
 print_attr_val(const struct switch_attr *attr, const struct switch_val *val)
 {
@@ -150,8 +168,10 @@ show_attrs(struct switch_dev *dev, struct switch_attr *attr, struct switch_val *
 			printf("\t%s: ", attr->name);
 			if (swlib_get_attr(dev, attr, val) < 0)
 				printf("???");
-			else
+			else {
 				print_attr_val(attr, val);
+				free_attr_val(attr, val);
+			}
 			putchar('\n');
 		}
 		attr = attr->next;
@@ -354,6 +374,7 @@ int main(int argc, char **argv)
 			goto out;
 		}
 		print_attr_val(a, &val);
+		free_attr_val(a, &val);
 		putchar('\n');
 		break;
 	case CMD_LOAD:
diff --git a/package/network/ipv6/odhcp6c/Makefile b/package/network/ipv6/odhcp6c/Makefile
index 82bc7191397cbc..ac507e1f17a767 100644
--- a/package/network/ipv6/odhcp6c/Makefile
+++ b/package/network/ipv6/odhcp6c/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=odhcp6c
-PKG_RELEASE:=18
+PKG_RELEASE:=20
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/odhcp6c.git
-PKG_SOURCE_DATE:=2022-08-05
-PKG_SOURCE_VERSION:=7d21e8d8ecd6d776f64b6928f62893c0f5c9747a
-PKG_MIRROR_HASH:=6d918517de4ec47d83edddb6167bb52f08b2b696f336d5055a45290bb37ac4db
+PKG_SOURCE_DATE:=2023-05-12
+PKG_SOURCE_VERSION:=bcd283632ac13391aac3ebdd074d1fd832d76fa3
+PKG_MIRROR_HASH:=0f3508a5a148ca831ae30b49b21919535f9dfbbd003a942baa6cb5388d207878
 PKG_MAINTAINER:=Hans Dedecker <dedeckeh@gmail.com>
 PKG_LICENSE:=GPL-2.0
 
diff --git a/package/network/ipv6/odhcp6c/files/dhcpv6.sh b/package/network/ipv6/odhcp6c/files/dhcpv6.sh
index cf6847f29e212b..18c24febd614b0 100755
--- a/package/network/ipv6/odhcp6c/files/dhcpv6.sh
+++ b/package/network/ipv6/odhcp6c/files/dhcpv6.sh
@@ -34,11 +34,13 @@ proto_dhcpv6_init_config() {
 	proto_config_add_string "vendorclass"
 	proto_config_add_array "sendopts:list(string)"
 	proto_config_add_boolean delegate
+	proto_config_add_int skpriority
 	proto_config_add_int "soltimeout"
 	proto_config_add_boolean fakeroutes
 	proto_config_add_boolean sourcefilter
 	proto_config_add_boolean keep_ra_dnslifetime
 	proto_config_add_int "ra_holdoff"
+	proto_config_add_boolean verbose
 }
 
 proto_dhcpv6_add_prefix() {
@@ -53,8 +55,8 @@ proto_dhcpv6_setup() {
 	local config="$1"
 	local iface="$2"
 
-	local reqaddress reqprefix clientid reqopts defaultreqopts noslaaconly forceprefix extendprefix norelease noserverunicast noclientfqdn noacceptreconfig ip6prefix ip6prefixes iface_dslite iface_map iface_464xlat ifaceid userclass vendorclass sendopts delegate zone_dslite zone_map zone_464xlat zone encaplimit_dslite encaplimit_map soltimeout fakeroutes sourcefilter keep_ra_dnslifetime ra_holdoff
-	json_get_vars reqaddress reqprefix clientid reqopts defaultreqopts noslaaconly forceprefix extendprefix norelease noserverunicast noclientfqdn noacceptreconfig iface_dslite iface_map iface_464xlat ifaceid userclass vendorclass delegate zone_dslite zone_map zone_464xlat zone encaplimit_dslite encaplimit_map soltimeout fakeroutes sourcefilter keep_ra_dnslifetime ra_holdoff
+	local reqaddress reqprefix clientid reqopts defaultreqopts noslaaconly forceprefix extendprefix norelease noserverunicast noclientfqdn noacceptreconfig ip6prefix ip6prefixes iface_dslite iface_map iface_464xlat ifaceid userclass vendorclass sendopts delegate zone_dslite zone_map zone_464xlat zone encaplimit_dslite encaplimit_map skpriority soltimeout fakeroutes sourcefilter keep_ra_dnslifetime ra_holdoff verbose
+	json_get_vars reqaddress reqprefix clientid reqopts defaultreqopts noslaaconly forceprefix extendprefix norelease noserverunicast noclientfqdn noacceptreconfig iface_dslite iface_map iface_464xlat ifaceid userclass vendorclass delegate zone_dslite zone_map zone_464xlat zone encaplimit_dslite encaplimit_map skpriority soltimeout fakeroutes sourcefilter keep_ra_dnslifetime ra_holdoff verbose
 	json_for_each_item proto_dhcpv6_add_prefix ip6prefix ip6prefixes
 
 	# Configure
@@ -88,8 +90,12 @@ proto_dhcpv6_setup() {
 
 	[ "$keep_ra_dnslifetime" = "1" ] && append opts "-L"
 
+	[ -n "$skpriority" ] && append opts "-K$skpriority"
+
 	[ -n "$ra_holdoff" ] && append opts "-m$ra_holdoff"
 
+	[ "$verbose" = "1" ] && append opts "-v"
+
 	local opt
 	for opt in $reqopts; do
 		append opts "-r$opt"
@@ -105,6 +111,7 @@ proto_dhcpv6_setup() {
 	[ -n "$iface_464xlat" ] && proto_export "IFACE_464XLAT=$iface_464xlat"
 	[ "$delegate" = "0" ] && proto_export "IFACE_DSLITE_DELEGATE=0"
 	[ "$delegate" = "0" ] && proto_export "IFACE_MAP_DELEGATE=0"
+	[ "$delegate" = "0" ] && proto_export "IFACE_464XLAT_DELEGATE=0"
 	[ -n "$zone_dslite" ] && proto_export "ZONE_DSLITE=$zone_dslite"
 	[ -n "$zone_map" ] && proto_export "ZONE_MAP=$zone_map"
 	[ -n "$zone_464xlat" ] && proto_export "ZONE_464XLAT=$zone_464xlat"
diff --git a/package/network/ipv6/thc-ipv6/Makefile b/package/network/ipv6/thc-ipv6/Makefile
index 91bacf625e3a49..b26b0507fb784b 100644
--- a/package/network/ipv6/thc-ipv6/Makefile
+++ b/package/network/ipv6/thc-ipv6/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=thc-ipv6
-PKG_VERSION:=2.7
+PKG_VERSION:=3.8
 PKG_RELEASE:=1
 PKG_LICENSE:=GPL-3.0
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=@GITHUB/vanhauser-thc/THC-Archive/master/Tools
-PKG_HASH:=440a3ae98b57100c397ec4f8634468dbbb0c3b48788c6b74af2a597a90544a96
+PKG_HASH:=b60be61a8b0a944a66e3b719704b4c03c1bc2c22f32d5d21e99e434c82a9d769
 
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 
@@ -31,7 +31,7 @@ THC_APPLETS := \
 	fuzz_dhcps6 implementation6 implementation6d inverse_lookup6          \
 	kill_router6 ndpexhaust6 node_query6 parasite6 passive_discovery6     \
 	randicmp6 redir6 rsmurf6 sendpees6 sendpeesmp6 smurf6 thcping6        \
-	toobig6 trace6
+	toobig6 trace6 toobigsniff6 flood_unreach6 connect6
 
 THC_DEPENDS_dnsdict6 := +libpthread
 THC_DEPENDS_thcping6 := +librt
diff --git a/package/network/ipv6/thc-ipv6/patches/100-no-ssl.patch b/package/network/ipv6/thc-ipv6/patches/100-no-ssl.patch
index 1ef1f66be88bd7..118c2a705bc958 100644
--- a/package/network/ipv6/thc-ipv6/patches/100-no-ssl.patch
+++ b/package/network/ipv6/thc-ipv6/patches/100-no-ssl.patch
@@ -1,9 +1,10 @@
 --- a/Makefile
 +++ b/Makefile
-@@ -1,5 +1,5 @@
+@@ -1,6 +1,6 @@
  # Comment out if openssl-dev is not present
+ # of if you want to compile statc
 -HAVE_SSL=yes
 +#HAVE_SSL=yes
  
- CC=gcc
- #CFLAGS=-g
+ # comment in if you want to compile static tools
+ #STATIC=-static
diff --git a/package/network/ipv6/thc-ipv6/patches/101-remove-march-native.patch b/package/network/ipv6/thc-ipv6/patches/101-remove-march-native.patch
new file mode 100644
index 00000000000000..da6c7caa7cba05
--- /dev/null
+++ b/package/network/ipv6/thc-ipv6/patches/101-remove-march-native.patch
@@ -0,0 +1,11 @@
+--- a/Makefile
++++ b/Makefile
+@@ -7,7 +7,7 @@ HAVE_SSL=yes
+ 
+ #CC=gcc
+ #CFLAGS=-g
+-CFLAGS+=-g -O3 -march=native -flto -falign-functions -falign-jumps -falign-loops -falign-labels -freorder-blocks
++CFLAGS+=-g -O3 -flto -falign-functions -falign-jumps -falign-loops -falign-labels -freorder-blocks
+ CFLAGS+=$(if $(HAVE_SSL),-D_HAVE_SSL,)
+ LDFLAGS+=-lpcap $(if $(HAVE_SSL),-lssl -lcrypto,)
+ PROGRAMS=parasite6 dos-new-ip6 detect-new-ip6 fake_router6 fake_advertise6 fake_solicitate6 fake_mld6 fake_mld26 fake_mldrouter6 flood_mldrouter6 fake_mipv6 redir6 smurf6 alive6 toobig6 rsmurf6 implementation6 implementation6d sendpees6 sendpeesmp6 randicmp6 fuzz_ip6 flood_mld6 flood_mld26 flood_router6 flood_advertise6 flood_solicitate6 trace6 exploit6 denial6 fake_dhcps6 flood_dhcpc6 fake_dns6d fragmentation6 kill_router6 fake_dnsupdate6 ndpexhaust6 detect_sniffer6 dump_router6 fake_router26 flood_router26 passive_discovery6 dnsrevenum6 inverse_lookup6 node_query6 address6 covert_send6 covert_send6d inject_alive6 firewall6 ndpexhaust26 fake_pim6 thcsyn6 redirsniff6 flood_redir6 four2six dump_dhcp6 flood_rs6 fuzz_dhcps6 fuzz_dhcpc6 toobigsniff6 flood_unreach6 connect6
diff --git a/package/network/services/bridger/Makefile b/package/network/services/bridger/Makefile
index dc32b1a6af0ee4..e228de517dcd20 100644
--- a/package/network/services/bridger/Makefile
+++ b/package/network/services/bridger/Makefile
@@ -10,9 +10,9 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=bridger
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=https://github.com/nbd168/bridger
-PKG_SOURCE_DATE:=2022-04-06
-PKG_SOURCE_VERSION:=e8f6814a85b4ea951657e7018c5d77597400f44a
-PKG_MIRROR_HASH:=f917e099a9ab2a55745a7254239efabe695a722d5c448342198cdc847a4a24ac
+PKG_SOURCE_DATE:=2023-05-12
+PKG_SOURCE_VERSION:=d0f79a16c749ad310d79e1c31f593860619f99eb
+PKG_MIRROR_HASH:=bee35594767cbcd13764f5c95e4837a4fc73171a91fcdae73aaefe00f4e8f8fa
 
 PKG_LICENSE:=GPL-2.0
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
diff --git a/package/network/services/dnsmasq/Makefile b/package/network/services/dnsmasq/Makefile
index c5a8930ea74a39..4272398a927440 100644
--- a/package/network/services/dnsmasq/Makefile
+++ b/package/network/services/dnsmasq/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dnsmasq
-PKG_UPSTREAM_VERSION:=2.86
+PKG_UPSTREAM_VERSION:=2.89
 PKG_VERSION:=$(subst test,~~test,$(subst rc,~rc,$(PKG_UPSTREAM_VERSION)))
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=4
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_UPSTREAM_VERSION).tar.xz
-PKG_SOURCE_URL:=http://thekelleys.org.uk/dnsmasq
-PKG_HASH:=28d52cfc9e2004ac4f85274f52b32e1647b4dbc9761b82e7de1e41c49907eb08
+PKG_SOURCE_URL:=https://thekelleys.org.uk/dnsmasq/
+PKG_HASH:=02bd230346cf0b9d5909f5e151df168b2707103785eb616b56685855adebb609
 
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=COPYING
@@ -24,12 +24,14 @@ PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_UPSTR
 
 PKG_INSTALL:=1
 PKG_BUILD_PARALLEL:=1
+PKG_BUILD_FLAGS:=lto
 PKG_ASLR_PIE_REGULAR:=1
 PKG_CONFIG_DEPENDS:= CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_dhcp \
 	CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_dhcpv6 \
 	CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_dnssec \
 	CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_auth \
 	CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_ipset \
+	CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_nftset \
 	CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_conntrack \
 	CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_noid \
 	CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_broken_rtc \
@@ -61,10 +63,11 @@ endef
 
 define Package/dnsmasq-full
 $(call Package/dnsmasq/Default)
-  TITLE += (with DNSSEC, DHCPv6, Auth DNS, IPset, Conntrack, NO_ID enabled by default)
+  TITLE += (with DNSSEC, DHCPv6, Auth DNS, IPset, Nftset, Conntrack, NO_ID enabled by default)
   DEPENDS+=+PACKAGE_dnsmasq_full_dnssec:libnettle \
 	+PACKAGE_dnsmasq_full_ipset:kmod-ipt-ipset \
-	+PACKAGE_dnsmasq_full_conntrack:libnetfilter-conntrack
+	+PACKAGE_dnsmasq_full_conntrack:libnetfilter-conntrack \
+	+PACKAGE_dnsmasq_full_nftset:nftables-json
   VARIANT:=full
   PROVIDES:=dnsmasq
 endef
@@ -83,7 +86,7 @@ define Package/dnsmasq-full/description
 $(call Package/dnsmasq/description)
 
 This is a fully configurable variant with DHCPv4, DHCPv6, DNSSEC, Authoritative DNS
-and IPset, Conntrack support & NO_ID enabled by default.
+and nftset, Conntrack support & NO_ID enabled by default.
 endef
 
 define Package/dnsmasq/conffiles
@@ -109,6 +112,9 @@ define Package/dnsmasq-full/config
 		default y
 	config PACKAGE_dnsmasq_full_ipset
 		bool "Build with IPset support."
+		default n
+	config PACKAGE_dnsmasq_full_nftset
+		bool "Build with Nftset support."
 		default y
 	config PACKAGE_dnsmasq_full_conntrack
 		bool "Build with Conntrack support."
@@ -128,9 +134,6 @@ endef
 Package/dnsmasq-dhcpv6/conffiles = $(Package/dnsmasq/conffiles)
 Package/dnsmasq-full/conffiles = $(Package/dnsmasq/conffiles)
 
-TARGET_CFLAGS += -flto
-TARGET_LDFLAGS += -flto=jobserver
-
 COPTS = -DHAVE_UBUS -DHAVE_POLL_H \
 	$(if $(CONFIG_IPV6),,-DNO_IPV6)
 
@@ -144,6 +147,7 @@ ifeq ($(BUILD_VARIANT),full)
 		$(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_dnssec),-DHAVE_DNSSEC) \
 		$(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_auth),,-DNO_AUTH) \
 		$(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_ipset),,-DNO_IPSET) \
+		$(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_nftset),-DHAVE_NFTSET,) \
 		$(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_conntrack),-DHAVE_CONNTRACK,) \
 		$(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_noid),-DNO_ID,) \
 		$(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_broken_rtc),-DHAVE_BROKEN_RTC) \
@@ -182,6 +186,7 @@ define Package/dnsmasq/install
 	$(INSTALL_DATA) ./files/dnsmasq_acl.json $(1)/usr/share/acl.d/
 	$(INSTALL_DIR) $(1)/etc/uci-defaults
 	$(INSTALL_BIN) ./files/50-dnsmasq-migrate-resolv-conf-auto.sh $(1)/etc/uci-defaults
+	$(INSTALL_BIN) ./files/50-dnsmasq-migrate-ipset.sh $(1)/etc/uci-defaults
 endef
 
 Package/dnsmasq-dhcpv6/install = $(Package/dnsmasq/install)
diff --git a/package/network/services/dnsmasq/files/50-dnsmasq-migrate-ipset.sh b/package/network/services/dnsmasq/files/50-dnsmasq-migrate-ipset.sh
new file mode 100644
index 00000000000000..aba73e7dd48a79
--- /dev/null
+++ b/package/network/services/dnsmasq/files/50-dnsmasq-migrate-ipset.sh
@@ -0,0 +1,32 @@
+#!/bin/sh
+
+ipsets=$(uci -q get dhcp.@dnsmasq[0].ipset)
+[ -z "$ipsets" ] && exit 0
+
+for ipset in $ipsets; do
+	names=${ipset##*/}
+	domains=${ipset%/*}
+
+	[ -z "$names" ] || [ -z "$domains" ] && continue
+
+	uci add dhcp ipset
+
+	OLDIFS="$IFS"
+
+	IFS=","
+	for name in $names; do
+		uci add_list dhcp.@ipset[-1].name="$name"
+	done
+
+	IFS="/"
+	for domain in ${domains:1}; do
+		uci add_list dhcp.@ipset[-1].domain="$domain"
+	done
+
+	IFS="$OLDIFS"
+
+	uci del_list dhcp.@dnsmasq[0].ipset="$ipset"
+done
+
+uci commit dhcp
+exit 0
diff --git a/package/network/services/dnsmasq/files/dhcp.conf b/package/network/services/dnsmasq/files/dhcp.conf
index 8c42ef782e3b8f..d5b9dfa018c146 100644
--- a/package/network/services/dnsmasq/files/dhcp.conf
+++ b/package/network/services/dnsmasq/files/dhcp.conf
@@ -10,6 +10,7 @@ config dnsmasq
 	option domain	'lan'
 	option expandhosts	1
 	option nonegcache	0
+	option cachesize	1000
 	option authoritative	1
 	option readethers	1
 	option leasefile	'/tmp/dhcp.leases'
@@ -21,6 +22,9 @@ config dnsmasq
 	#list bogusnxdomain     '64.94.110.11'
 	option localservice	1  # disable to allow DNS requests from non-local subnets
 	option ednspacket_max	1232
+	option filter_aaaa	0
+	option filter_a		0
+	#list addnmount		/some/path # read-only mount path to expose it to dnsmasq
 
 config dhcp lan
 	option interface	lan
diff --git a/package/network/services/dnsmasq/files/dnsmasq.init b/package/network/services/dnsmasq/files/dnsmasq.init
index c4ca3eb2db39d0..2a3327b0c6f263 100755
--- a/package/network/services/dnsmasq/files/dnsmasq.init
+++ b/package/network/services/dnsmasq/files/dnsmasq.init
@@ -33,6 +33,7 @@ dnsmasq_ignore_opt() {
 		[ "${dnsmasq_features#* DNSSEC }" = "$dnsmasq_features" ] || dnsmasq_has_dnssec=1
 		[ "${dnsmasq_features#* TFTP }" = "$dnsmasq_features" ] || dnsmasq_has_tftp=1
 		[ "${dnsmasq_features#* ipset }" = "$dnsmasq_features" ] || dnsmasq_has_ipset=1
+		[ "${dnsmasq_features#* nftset }" = "$dnsmasq_features" ] || dnsmasq_has_nftset=1
 	fi
 
 	case "$opt" in
@@ -55,6 +56,8 @@ dnsmasq_ignore_opt() {
 			[ -z "$dnsmasq_has_tftp" ] ;;
 		ipset)
 			[ -z "$dnsmasq_has_ipset" ] ;;
+		nftset)
+			[ -z "$dnsmasq_has_nftset" ] ;;
 		*)
 			return 1
 	esac
@@ -169,10 +172,6 @@ append_address() {
 	xappend "--address=$1"
 }
 
-append_ipset() {
-	xappend "--ipset=$1"
-}
-
 append_connmark_allowlist() {
 	xappend "--connmark-allowlist=$1"
 }
@@ -205,8 +204,12 @@ ismounted() {
 	return 1
 }
 
-append_addnhosts() {
+append_extramount() {
 	ismounted "$1" || append EXTRA_MOUNT "$1"
+}
+
+append_addnhosts() {
+	append_extramount "$1"
 	xappend "--addn-hosts=$1"
 }
 
@@ -554,6 +557,8 @@ dhcp_add() {
 	config_get leasetime "$cfg" leasetime 12h
 	config_get options "$cfg" options
 	config_get_bool dynamicdhcp "$cfg" dynamicdhcp 1
+	config_get_bool dynamicdhcpv4 "$cfg" dynamicdhcpv4 $dynamicdhcp
+	config_get_bool dynamicdhcpv6 "$cfg" dynamicdhcpv6 $dynamicdhcp
 
 	config_get dhcpv4 "$cfg" dhcpv4
 	config_get dhcpv6 "$cfg" dhcpv6
@@ -581,21 +586,20 @@ dhcp_add() {
 		limit=$((limit-1))
 	fi
 
-	eval "$(ipcalc.sh "${subnet%%/*}" $netmask $start $limit)"
+	# make sure the DHCP range is not empty
+	if [ "$dhcpv4" != "disabled" ] && eval "$(ipcalc.sh "${subnet%%/*}" "$netmask" "$start" "$limit")" ; then
+		[ "$dynamicdhcpv4" = "0" ] && END="static"
 
-	if [ "$dynamicdhcp" = "0" ] ; then
-		END="static"
+		xappend "--dhcp-range=$tags$nettag$START,$END,$NETMASK,$leasetime${options:+ $options}"
+	fi
+
+	if [ "$dynamicdhcpv6" = "0" ] ; then
 		dhcp6range="::,static"
 	else
 		dhcp6range="::1000,::ffff"
 	fi
 
 
-	if [ "$dhcpv4" != "disabled" ] ; then
-		xappend "--dhcp-range=$tags$nettag$START,$END,$NETMASK,$leasetime${options:+ $options}"
-	fi
-
-
 	if [ $DNSMASQ_DHCP_VER -eq 6 ] && [ "$ra" = "server" ] ; then
 		# Note: dnsmasq cannot just be a DHCPv6 server (all-in-1)
 		# and let some other machine(s) send RA pointing to it.
@@ -796,25 +800,54 @@ dhcp_relay_add() {
 
 dnsmasq_ipset_add() {
 	local cfg="$1"
-	local ipsets domains
+	local ipsets nftsets domains
 
 	add_ipset() {
 		ipsets="${ipsets:+$ipsets,}$1"
 	}
 
+	add_nftset() {
+		local IFS=,
+		for set in $1; do
+			local fam="$family"
+			[ -n "$fam" ] || fam=$(echo "$set" | sed -nre \
+				's#^.*[^0-9]([46])$|^.*[-_]([46])[-_].*$|^([46])[^0-9].*$#\1\2\3#p')
+			[ -n "$fam" ] || \
+				fam=$(nft -t list set "$table_family" "$table" "$set" 2>&1 | sed -nre \
+				's#^\t\ttype .*\bipv([46])_addr\b.*$#\1#p')
+
+			[ -n "$fam" ] || \
+				logger -t dnsmasq "Cannot infer address family from non-existent nftables set '$set'"
+
+			nftsets="${nftsets:+$nftsets,}${fam:+$fam#}$table_family#$table#$set"
+		done
+	}
+
 	add_domain() {
 		# leading '/' is expected
 		domains="$domains/$1"
 	}
 
+	config_get table "$cfg" table 'fw4'
+	config_get table_family "$cfg" table_family 'inet'
+	if [ "$table_family" = "ip" ] ; then
+		family="4"
+	elif [ "$table_family" = "ip6" ] ; then
+		family="6"
+	else
+		config_get family "$cfg" family
+	fi
+
 	config_list_foreach "$cfg" "name" add_ipset
+	config_list_foreach "$cfg" "name" add_nftset
 	config_list_foreach "$cfg" "domain" add_domain
 
-	if [ -z "$ipsets" ] || [ -z "$domains" ]; then
+	if [ -z "$ipsets" ] || [ -z "$nftsets" ] || [ -z "$domains" ]; then
 		return 0
 	fi
 
 	xappend "--ipset=$domains/$ipsets"
+	xappend "--nftset=$domains/$nftsets"
 }
 
 dnsmasq_start()
@@ -932,6 +965,9 @@ dnsmasq_start()
 	append_bool "$cfg" rapidcommit "--dhcp-rapid-commit"
 	append_bool "$cfg" scriptarp "--script-arp"
 
+	append_bool "$cfg" filter_aaaa "--filter-AAAA"
+	append_bool "$cfg" filter_a "--filter-A"
+
 	append_parm "$cfg" logfacility "--log-facility"
 	config_get logfacility "$cfg" "logfacility"
 	append_parm "$cfg" cachesize "--cache-size"
@@ -948,7 +984,6 @@ dnsmasq_start()
 	config_list_foreach "$cfg" "server" append_server
 	config_list_foreach "$cfg" "rev_server" append_rev_server
 	config_list_foreach "$cfg" "address" append_address
-	config_list_foreach "$cfg" "ipset" append_ipset
 
 	local connmark_allowlist_enable
 	config_get connmark_allowlist_enable "$cfg" connmark_allowlist_enable 0
@@ -1141,7 +1176,6 @@ dnsmasq_start()
 	config_foreach filter_dnsmasq ipset dnsmasq_ipset_add "$cfg"
 	echo >> $CONFIGFILE_TMP
 
-	echo >> $CONFIGFILE_TMP
 	mv -f $CONFIGFILE_TMP $CONFIGFILE
 	mv -f $HOSTFILE_TMP $HOSTFILE
 
@@ -1157,6 +1191,8 @@ dnsmasq_start()
 		done
 	}
 
+	config_list_foreach "$cfg" addnmount append_extramount
+
 	procd_open_instance $cfg
 	procd_set_param command $PROG -C $CONFIGFILE -k -x /var/run/dnsmasq/dnsmasq."${cfg}".pid
 	procd_set_param file $CONFIGFILE
@@ -1178,6 +1214,7 @@ dnsmasq_start()
 		[ ! -e "$logfacility" ] && touch "$logfacility"
 		procd_add_jail_mount_rw "$logfacility"
 	esac
+	[ -e "$hostsfile" ] && procd_add_jail_mount $hostsfile
 
 	procd_close_instance
 }
diff --git a/package/network/services/dnsmasq/patches/100-remove-old-runtime-kernel-support.patch b/package/network/services/dnsmasq/patches/100-remove-old-runtime-kernel-support.patch
index 4f8fe4ecbebacd..59b8d02c0e1823 100644
--- a/package/network/services/dnsmasq/patches/100-remove-old-runtime-kernel-support.patch
+++ b/package/network/services/dnsmasq/patches/100-remove-old-runtime-kernel-support.patch
@@ -13,7 +13,7 @@ Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
 
 --- a/src/dnsmasq.c
 +++ b/src/dnsmasq.c
-@@ -95,10 +95,6 @@ int main (int argc, char **argv)
+@@ -103,10 +103,6 @@ int main (int argc, char **argv)
    
    read_opts(argc, argv, compile_opts);
   
@@ -26,7 +26,7 @@ Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
  
 --- a/src/dnsmasq.h
 +++ b/src/dnsmasq.h
-@@ -1201,7 +1201,7 @@ extern struct daemon {
+@@ -1248,7 +1248,7 @@ extern struct daemon {
    int inotifyfd;
  #endif
  #if defined(HAVE_LINUX_NETWORK)
@@ -35,7 +35,7 @@ Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
  #elif defined(HAVE_BSD_NETWORK)
    int dhcp_raw_fd, dhcp_icmp_fd, routefd;
  #endif
-@@ -1388,9 +1388,6 @@ int read_write(int fd, unsigned char *pa
+@@ -1453,9 +1453,6 @@ int read_write(int fd, unsigned char *pa
  void close_fds(long max_fd, int spare1, int spare2, int spare3);
  int wildcard_match(const char* wildcard, const char* match);
  int wildcard_matchn(const char* wildcard, const char* match, int num);
@@ -140,7 +140,7 @@ Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
       my_syslog(LOG_ERR, _("failed to update ipset %s: %s"), setname, strerror(errno));
 --- a/src/util.c
 +++ b/src/util.c
-@@ -796,22 +796,3 @@ int wildcard_matchn(const char* wildcard
+@@ -855,22 +855,3 @@ int wildcard_matchn(const char* wildcard
  
    return (!num) || (*wildcard == *match);
  }
diff --git a/package/network/services/dnsmasq/patches/200-ubus_dns.patch b/package/network/services/dnsmasq/patches/200-ubus_dns.patch
index b8c4e449525b16..8a70bb8bdf19bb 100644
--- a/package/network/services/dnsmasq/patches/200-ubus_dns.patch
+++ b/package/network/services/dnsmasq/patches/200-ubus_dns.patch
@@ -1,6 +1,6 @@
 --- a/src/dnsmasq.h
 +++ b/src/dnsmasq.h
-@@ -1564,14 +1564,26 @@ void emit_dbus_signal(int action, struct
+@@ -1631,14 +1631,26 @@ void emit_dbus_signal(int action, struct
  
  /* ubus.c */
  #ifdef HAVE_UBUS
@@ -151,7 +151,7 @@
        if (!ADD_RDLEN(header, p, qlen, rdlen))
  	 return 0; /* bad packet */
      }
-@@ -563,7 +632,7 @@ int extract_addresses(struct dns_header
+@@ -570,7 +639,7 @@ int extract_addresses(struct dns_header
    cache_start_insert();
  
    /* find_soa is needed for dns_doctor side effects, so don't call it lazily if there are any. */
@@ -269,7 +269,7 @@
    struct ubus_context *ubus = (struct ubus_context *)daemon->ubus;
 --- a/src/dnsmasq.c
 +++ b/src/dnsmasq.c
-@@ -1972,6 +1972,10 @@ static void check_dns_listeners(time_t n
+@@ -2003,6 +2003,10 @@ static void check_dns_listeners(time_t n
  		  daemon->pipe_to_parent = pipefd[1];
  		}
  
diff --git a/package/network/services/dropbear/Makefile b/package/network/services/dropbear/Makefile
index eaf14c55332581..e98e995ba7b9a3 100644
--- a/package/network/services/dropbear/Makefile
+++ b/package/network/services/dropbear/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dropbear
 PKG_VERSION:=2022.82
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=5
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:= \
@@ -23,7 +23,7 @@ PKG_CPE_ID:=cpe:/a:matt_johnston:dropbear_ssh_server
 
 PKG_BUILD_PARALLEL:=1
 PKG_ASLR_PIE_REGULAR:=1
-PKG_USE_MIPS16:=0
+PKG_BUILD_FLAGS:=no-mips16 gc-sections lto
 PKG_FIXUP:=autoreconf
 PKG_FLAGS:=nonshared
 
@@ -142,8 +142,7 @@ DB_OPT_CONFIG = \
 	DROPBEAR_SVR_AGENTFWD|CONFIG_DROPBEAR_AGENTFORWARD|1|0 \
 
 
-TARGET_CFLAGS += -DARGTYPE=3 -ffunction-sections -fdata-sections -flto
-TARGET_LDFLAGS += -Wl,--gc-sections -flto=jobserver
+TARGET_CFLAGS += -DARGTYPE=3
 
 db_opt_add     =echo '\#define $(1) $(2)' >> $(PKG_BUILD_DIR)/localoptions.h
 db_opt_replace =$(ESED) 's,^(\#define $(1)) .*$$$$,\1 $(2),g' $(PKG_BUILD_DIR)/sysoptions.h
diff --git a/package/network/services/dropbear/files/dropbear.init b/package/network/services/dropbear/files/dropbear.init
index ea4cad2a8d5489..b82e967cbcedc4 100755
--- a/package/network/services/dropbear/files/dropbear.init
+++ b/package/network/services/dropbear/files/dropbear.init
@@ -119,6 +119,7 @@ validate_section_dropbear()
 		'enable:bool:1' \
 		'Interface:string' \
 		'GatewayPorts:bool:0' \
+		'ForceCommand:string' \
 		'RootPasswordAuth:bool:1' \
 		'RootLogin:bool:1' \
 		'rsakeyfile:file' \
@@ -158,6 +159,7 @@ dropbear_instance()
 	procd_set_param command "$PROG" -F -P "$pid_file"
 	[ "${PasswordAuth}" -eq 0 ] && procd_append_param command -s
 	[ "${GatewayPorts}" -eq 1 ] && procd_append_param command -a
+	[ -n "${ForceCommand}" ] && procd_append_param command -c "${ForceCommand}"
 	[ "${RootPasswordAuth}" -eq 0 ] && procd_append_param command -g
 	[ "${RootLogin}" -eq 0 ] && procd_append_param command -w
 	if [ -n "${rsakeyfile}" ]; then
diff --git a/package/network/services/hostapd/Config.in b/package/network/services/hostapd/Config.in
index 4cfcaafade90cf..87ad7e093e7da0 100644
--- a/package/network/services/hostapd/Config.in
+++ b/package/network/services/hostapd/Config.in
@@ -4,20 +4,25 @@ config WPA_RFKILL_SUPPORT
 	depends on PACKAGE_wpa-supplicant || \
 		   PACKAGE_wpa-supplicant-openssl || \
 		   PACKAGE_wpa-supplicant-wolfssl || \
+		   PACKAGE_wpa-supplicant-mbedtls || \
 		   PACKAGE_wpa-supplicant-mesh-openssl || \
 		   PACKAGE_wpa-supplicant-mesh-wolfssl || \
+		   PACKAGE_wpa-supplicant-mesh-mbedtls || \
 		   PACKAGE_wpa-supplicant-basic || \
 		   PACKAGE_wpa-supplicant-mini || \
 		   PACKAGE_wpa-supplicant-p2p || \
 		   PACKAGE_wpad || \
 		   PACKAGE_wpad-openssl || \
 		   PACKAGE_wpad-wolfssl || \
+		   PACKAGE_wpad-mbedtls || \
 		   PACKAGE_wpad-basic || \
 		   PACKAGE_wpad-basic-openssl || \
 		   PACKAGE_wpad-basic-wolfssl || \
+		   PACKAGE_wpad-basic-mbedtls || \
 		   PACKAGE_wpad-mini || \
 		   PACKAGE_wpad-mesh-openssl || \
-		   PACKAGE_wpad-mesh-wolfssl
+		   PACKAGE_wpad-mesh-wolfssl || \
+		   PACKAGE_wpad-mesh-mbedtls
 	default n
 
 config WPA_MSG_MIN_PRIORITY
@@ -25,20 +30,25 @@ config WPA_MSG_MIN_PRIORITY
 	depends on PACKAGE_wpa-supplicant || \
 		   PACKAGE_wpa-supplicant-openssl || \
 		   PACKAGE_wpa-supplicant-wolfssl || \
+		   PACKAGE_wpa-supplicant-mbedtls || \
 		   PACKAGE_wpa-supplicant-mesh-openssl || \
 		   PACKAGE_wpa-supplicant-mesh-wolfssl || \
+		   PACKAGE_wpa-supplicant-mesh-mbedtls || \
 		   PACKAGE_wpa-supplicant-basic || \
 		   PACKAGE_wpa-supplicant-mini || \
 		   PACKAGE_wpa-supplicant-p2p || \
 		   PACKAGE_wpad || \
 		   PACKAGE_wpad-openssl || \
 		   PACKAGE_wpad-wolfssl || \
+		   PACKAGE_wpad-mbedtls || \
 		   PACKAGE_wpad-basic || \
 		   PACKAGE_wpad-basic-openssl || \
 		   PACKAGE_wpad-basic-wolfssl || \
+		   PACKAGE_wpad-basic-mbedtls || \
 		   PACKAGE_wpad-mini || \
 		   PACKAGE_wpad-mesh-openssl || \
-		   PACKAGE_wpad-mesh-wolfssl
+		   PACKAGE_wpad-mesh-wolfssl || \
+		   PACKAGE_wpad-mesh-mbedtls
 	default 3
 	help
 	  Useful values are:
@@ -63,14 +73,6 @@ config WPA_WOLFSSL
 	select WOLFSSL_HAS_SESSION_TICKET
 	select WOLFSSL_HAS_WPAS
 
-config DRIVER_WEXT_SUPPORT
-	bool
-	default n
-
-config DRIVER_11N_SUPPORT
-	bool
-	default n
-
 config DRIVER_11AC_SUPPORT
 	bool
 	default n
@@ -94,9 +96,11 @@ config WPA_MBO_SUPPORT
 	default PACKAGE_wpa-supplicant || \
 		PACKAGE_wpa-supplicant-openssl || \
 		PACKAGE_wpa-supplicant-wolfssl || \
+		PACKAGE_wpa-supplicant-mbedtls || \
 		PACKAGE_wpad || \
 		PACKAGE_wpad-openssl || \
-		PACKAGE_wpad-wolfssl
+		PACKAGE_wpad-wolfssl || \
+		PACKAGE_wpad-mbedtls
 	help
 	  Multi Band Operation aka (Agile Multiband) enables features
 	  that facilitate efficient use of multiple frequency bands.
diff --git a/package/network/services/hostapd/Makefile b/package/network/services/hostapd/Makefile
index c4aa6d04f3f03d..dc296704898124 100644
--- a/package/network/services/hostapd/Makefile
+++ b/package/network/services/hostapd/Makefile
@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=hostapd
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=1.2
 
 PKG_SOURCE_URL:=http://w1.fi/hostap.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2022-06-02
-PKG_SOURCE_VERSION:=4383528e01955d995d3b3db201e4c0f9840e8236
-PKG_MIRROR_HASH:=1b533287661d4877d56aca8a5b2a53d84d2a90eebe246d8d9b3adf943da7f0a1
+PKG_SOURCE_DATE:=2023-03-29
+PKG_SOURCE_VERSION:=bb945b98fefc64887dffb40773a19d77585cee42
+PKG_MIRROR_HASH:=1da8a39c7c81ce257994874402a86d00080a6145b5eb5c5fc44b2fae1853fe8d
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=BSD-3-Clause
@@ -27,12 +27,12 @@ PKG_CONFIG_DEPENDS:= \
 	CONFIG_PACKAGE_hostapd-basic \
 	CONFIG_PACKAGE_hostapd-mini \
 	CONFIG_WPA_RFKILL_SUPPORT \
-	CONFIG_DRIVER_WEXT_SUPPORT \
-	CONFIG_DRIVER_11N_SUPPORT \
 	CONFIG_DRIVER_11AC_SUPPORT \
 	CONFIG_DRIVER_11AX_SUPPORT \
 	CONFIG_WPA_ENABLE_WEP
 
+PKG_BUILD_FLAGS:=gc-sections lto
+
 EAPOL_TEST_PROVIDERS:=eapol-test eapol-test-openssl eapol-test-wolfssl
 
 SUPPLICANT_PROVIDERS:=
@@ -53,14 +53,16 @@ LOCAL_AND_LIB_VARIANT=$(patsubst hostapd-%,%,\
 LOCAL_VARIANT=$(patsubst %-internal,%,\
 	      $(patsubst %-openssl,%,\
 	      $(patsubst %-wolfssl,%,\
+	      $(patsubst %-mbedtls,%,\
 	      $(LOCAL_AND_LIB_VARIANT)\
-	      )))
+	      ))))
 
 SSL_VARIANT=$(strip \
 		$(if $(findstring openssl,$(LOCAL_AND_LIB_VARIANT)),openssl,\
 		$(if $(findstring wolfssl,$(LOCAL_AND_LIB_VARIANT)),wolfssl,\
+		$(if $(findstring mbedtls,$(LOCAL_AND_LIB_VARIANT)),mbedtls,\
 		internal\
-		)))
+		))))
 
 CONFIG_VARIANT:=$(LOCAL_VARIANT)
 ifeq ($(LOCAL_VARIANT),mesh)
@@ -71,11 +73,6 @@ include $(INCLUDE_DIR)/package.mk
 
 STAMP_CONFIGURED:=$(STAMP_CONFIGURED)_$(CONFIG_WPA_MSG_MIN_PRIORITY)
 
-
-ifneq ($(CONFIG_DRIVER_11N_SUPPORT),)
-  HOSTAPD_IEEE80211N:=y
-endif
-
 ifneq ($(CONFIG_DRIVER_11AC_SUPPORT),)
   HOSTAPD_IEEE80211AC:=y
 endif
@@ -87,10 +84,8 @@ endif
 DRIVER_MAKEOPTS= \
 	CONFIG_ACS=$(CONFIG_PACKAGE_kmod-cfg80211) \
 	CONFIG_DRIVER_NL80211=$(CONFIG_PACKAGE_kmod-cfg80211) \
-	CONFIG_IEEE80211N=$(HOSTAPD_IEEE80211N) \
 	CONFIG_IEEE80211AC=$(HOSTAPD_IEEE80211AC) \
 	CONFIG_IEEE80211AX=$(HOSTAPD_IEEE80211AX) \
-	CONFIG_DRIVER_WEXT=$(CONFIG_DRIVER_WEXT_SUPPORT) \
 	CONFIG_MBO=$(CONFIG_WPA_MBO_SUPPORT)
 
 ifeq ($(SSL_VARIANT),openssl)
@@ -123,17 +118,27 @@ ifeq ($(SSL_VARIANT),wolfssl)
   endif
 endif
 
+ifeq ($(SSL_VARIANT),mbedtls)
+  DRIVER_MAKEOPTS += CONFIG_TLS=mbedtls CONFIG_SAE=y
+  TARGET_LDFLAGS += -lmbedcrypto -lmbedx509 -lmbedtls
+
+  ifeq ($(LOCAL_VARIANT),basic)
+    DRIVER_MAKEOPTS += CONFIG_OWE=y
+  endif
+  ifeq ($(LOCAL_VARIANT),mesh)
+    DRIVER_MAKEOPTS += CONFIG_AP=y CONFIG_MESH=y CONFIG_WPS_NFC=1
+  endif
+  ifeq ($(LOCAL_VARIANT),full)
+    DRIVER_MAKEOPTS += CONFIG_OWE=y CONFIG_SUITEB192=y CONFIG_AP=y CONFIG_MESH=y CONFIG_WPS_NFC=1
+  endif
+endif
+
 ifneq ($(LOCAL_TYPE),hostapd)
   ifdef CONFIG_WPA_RFKILL_SUPPORT
     DRIVER_MAKEOPTS += NEED_RFKILL=y
   endif
 endif
 
-ifdef CONFIG_USE_GLIBC
-  TARGET_LDFLAGS += -lrt
-  TARGET_LDFLAGS_C += -lrt
-endif
-
 DRV_DEPENDS:=+PACKAGE_kmod-cfg80211:libnl-tiny
 
 
@@ -180,6 +185,15 @@ endef
 
 Package/hostapd-wolfssl/description = $(Package/hostapd/description)
 
+define Package/hostapd-mbedtls
+$(call Package/hostapd/Default,$(1))
+  TITLE+= (mbedTLS full)
+  VARIANT:=full-mbedtls
+  DEPENDS+=+PACKAGE_hostapd-mbedtls:libmbedtls
+endef
+
+Package/hostapd-mbedtls/description = $(Package/hostapd/description)
+
 define Package/hostapd-basic
 $(call Package/hostapd/Default,$(1))
   TITLE+= (WPA-PSK, 11r, 11w)
@@ -212,6 +226,17 @@ define Package/hostapd-basic-wolfssl/description
  This package contains a basic IEEE 802.1x/WPA Authenticator with WPA-PSK, 802.11r and 802.11w support.
 endef
 
+define Package/hostapd-basic-mbedtls
+$(call Package/hostapd/Default,$(1))
+  TITLE+= (WPA-PSK, 11r and 11w)
+  VARIANT:=basic-mbedtls
+  DEPENDS+=+PACKAGE_hostapd-basic-mbedtls:libmbedtls
+endef
+
+define Package/hostapd-basic-mbedtls/description
+ This package contains a basic IEEE 802.1x/WPA Authenticator with WPA-PSK, 802.11r and 802.11w support.
+endef
+
 define Package/hostapd-mini
 $(call Package/hostapd/Default,$(1))
   TITLE+= (WPA-PSK only)
@@ -267,6 +292,15 @@ endef
 
 Package/wpad-wolfssl/description = $(Package/wpad/description)
 
+define Package/wpad-mbedtls
+$(call Package/wpad/Default,$(1))
+  TITLE+= (mbedTLS full)
+  VARIANT:=wpad-full-mbedtls
+  DEPENDS+=+PACKAGE_wpad-mbedtls:libmbedtls
+endef
+
+Package/wpad-mbedtls/description = $(Package/wpad/description)
+
 define Package/wpad-basic
 $(call Package/wpad/Default,$(1))
   TITLE+= (WPA-PSK, 11r, 11w)
@@ -299,6 +333,17 @@ define Package/wpad-basic-wolfssl/description
  This package contains a basic IEEE 802.1x/WPA Authenticator and Supplicant with WPA-PSK, SAE (WPA3-Personal), 802.11r and 802.11w support.
 endef
 
+define Package/wpad-basic-mbedtls
+$(call Package/wpad/Default,$(1))
+  TITLE+= (mbedTLS, 11r, 11w)
+  VARIANT:=wpad-basic-mbedtls
+  DEPENDS+=+PACKAGE_wpad-basic-mbedtls:libmbedtls
+endef
+
+define Package/wpad-basic-mbedtls/description
+ This package contains a basic IEEE 802.1x/WPA Authenticator and Supplicant with WPA-PSK, SAE (WPA3-Personal), 802.11r and 802.11w support.
+endef
+
 define Package/wpad-mini
 $(call Package/wpad/Default,$(1))
   TITLE+= (WPA-PSK only)
@@ -337,6 +382,15 @@ endef
 
 Package/wpad-mesh-wolfssl/description = $(Package/wpad-mesh/description)
 
+define Package/wpad-mesh-mbedtls
+$(call Package/wpad-mesh,$(1))
+  TITLE+= (mbedTLS, 11s, SAE)
+  DEPENDS+=+PACKAGE_wpad-mesh-mbedtls:libmbedtls
+  VARIANT:=wpad-mesh-mbedtls
+endef
+
+Package/wpad-mesh-mbedtls/description = $(Package/wpad-mesh/description)
+
 
 define Package/wpa-supplicant/Default
   SECTION:=net
@@ -372,6 +426,13 @@ $(call Package/wpa-supplicant/Default,$(1))
   DEPENDS+=+PACKAGE_wpa-supplicant-wolfssl:libwolfssl
 endef
 
+define Package/wpa-supplicant-mbedtls
+$(call Package/wpa-supplicant/Default,$(1))
+  TITLE+= (mbedTLS full)
+  VARIANT:=supplicant-full-mbedtls
+  DEPENDS+=+PACKAGE_wpa-supplicant-mbedtls:libmbedtls
+endef
+
 define Package/wpa-supplicant/config
 	source "$(SOURCE)/Config.in"
 endef
@@ -403,6 +464,13 @@ $(call Package/wpa-supplicant-mesh/Default,$(1))
   DEPENDS+=+PACKAGE_wpa-supplicant-mesh-wolfssl:libwolfssl
 endef
 
+define Package/wpa-supplicant-mesh-mbedtls
+$(call Package/wpa-supplicant-mesh/Default,$(1))
+  TITLE+= (mbedTLS, 11s, SAE)
+  VARIANT:=supplicant-mesh-mbedtls
+  DEPENDS+=+PACKAGE_wpa-supplicant-mesh-mbedtls:libmbedtls
+endef
+
 define Package/wpa-supplicant-basic
 $(call Package/wpa-supplicant/Default,$(1))
   TITLE+= (11r, 11w)
@@ -479,6 +547,15 @@ define Package/eapol-test-wolfssl
   PROVIDES:=eapol-test
 endef
 
+define Package/eapol-test-mbedtls
+  $(call Package/eapol-test/Default,$(1))
+  TITLE+= (mbedTLS full)
+  VARIANT:=supplicant-full-mbedtls
+  CONFLICTS:=$(filter-out eapol-test-openssl ,$(filter-out eapol-test-mbedtls ,$(EAPOL_TEST_PROVIDERS)))
+  DEPENDS+=+PACKAGE_eapol-test-mbedtls:libmbedtls
+  PROVIDES:=eapol-test
+endef
+
 
 ifneq ($(wildcard $(PKG_BUILD_DIR)/.config_*),$(subst .configured_,.config_,$(STAMP_CONFIGURED)))
   define Build/Configure/rebuild
@@ -508,8 +585,7 @@ TARGET_CPPFLAGS := \
 	-D_GNU_SOURCE \
 	$(if $(CONFIG_WPA_MSG_MIN_PRIORITY),-DCONFIG_MSG_MIN_PRIORITY=$(CONFIG_WPA_MSG_MIN_PRIORITY))
 
-TARGET_CFLAGS += -ffunction-sections -fdata-sections -flto
-TARGET_LDFLAGS += -Wl,--gc-sections -flto=jobserver -fuse-linker-plugin -lubox -lubus
+TARGET_LDFLAGS += -lubox -lubus
 
 ifdef CONFIG_PACKAGE_kmod-cfg80211
   TARGET_LDFLAGS += -lm -lnl-tiny
@@ -587,6 +663,12 @@ define Build/Compile/supplicant-full-wolfssl
 	)
 endef
 
+define Build/Compile/supplicant-full-mbedtls
+	+$(call Build/RunMake,wpa_supplicant, \
+		eapol_test \
+	)
+endef
+
 define Build/Compile
 	$(Build/Compile/$(LOCAL_TYPE))
 	$(Build/Compile/$(BUILD_VARIANT))
@@ -617,9 +699,11 @@ endef
 Package/hostapd-basic/install = $(Package/hostapd/install)
 Package/hostapd-basic-openssl/install = $(Package/hostapd/install)
 Package/hostapd-basic-wolfssl/install = $(Package/hostapd/install)
+Package/hostapd-basic-mbedtls/install = $(Package/hostapd/install)
 Package/hostapd-mini/install = $(Package/hostapd/install)
 Package/hostapd-openssl/install = $(Package/hostapd/install)
 Package/hostapd-wolfssl/install = $(Package/hostapd/install)
+Package/hostapd-mbedtls/install = $(Package/hostapd/install)
 
 ifneq ($(LOCAL_TYPE),supplicant)
   define Package/hostapd-utils/install
@@ -638,11 +722,14 @@ endef
 Package/wpad-basic/install = $(Package/wpad/install)
 Package/wpad-basic-openssl/install = $(Package/wpad/install)
 Package/wpad-basic-wolfssl/install = $(Package/wpad/install)
+Package/wpad-basic-mbedtls/install = $(Package/wpad/install)
 Package/wpad-mini/install = $(Package/wpad/install)
 Package/wpad-openssl/install = $(Package/wpad/install)
 Package/wpad-wolfssl/install = $(Package/wpad/install)
+Package/wpad-mbedtls/install = $(Package/wpad/install)
 Package/wpad-mesh-openssl/install = $(Package/wpad/install)
 Package/wpad-mesh-wolfssl/install = $(Package/wpad/install)
+Package/wpad-mesh-mbedtls/install = $(Package/wpad/install)
 
 define Package/wpa-supplicant/install
 	$(call Install/supplicant,$(1))
@@ -653,8 +740,10 @@ Package/wpa-supplicant-mini/install = $(Package/wpa-supplicant/install)
 Package/wpa-supplicant-p2p/install = $(Package/wpa-supplicant/install)
 Package/wpa-supplicant-openssl/install = $(Package/wpa-supplicant/install)
 Package/wpa-supplicant-wolfssl/install = $(Package/wpa-supplicant/install)
+Package/wpa-supplicant-mbedtls/install = $(Package/wpa-supplicant/install)
 Package/wpa-supplicant-mesh-openssl/install = $(Package/wpa-supplicant/install)
 Package/wpa-supplicant-mesh-wolfssl/install = $(Package/wpa-supplicant/install)
+Package/wpa-supplicant-mesh-mbedtls/install = $(Package/wpa-supplicant/install)
 
 ifneq ($(LOCAL_TYPE),hostapd)
   define Package/wpa-cli/install
@@ -684,6 +773,13 @@ ifeq ($(BUILD_VARIANT),supplicant-full-wolfssl)
   endef
 endif
 
+ifeq ($(BUILD_VARIANT),supplicant-full-mbedtls)
+  define Package/eapol-test-mbedtls/install
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(CP) $(PKG_BUILD_DIR)/wpa_supplicant/eapol_test $(1)/usr/sbin/
+  endef
+endif
+
 # Build hostapd-common before its dependents, to avoid
 # spurious rebuilds when building multiple variants.
 $(eval $(call BuildPackage,hostapd-common))
@@ -691,28 +787,36 @@ $(eval $(call BuildPackage,hostapd))
 $(eval $(call BuildPackage,hostapd-basic))
 $(eval $(call BuildPackage,hostapd-basic-openssl))
 $(eval $(call BuildPackage,hostapd-basic-wolfssl))
+$(eval $(call BuildPackage,hostapd-basic-mbedtls))
 $(eval $(call BuildPackage,hostapd-mini))
 $(eval $(call BuildPackage,hostapd-openssl))
 $(eval $(call BuildPackage,hostapd-wolfssl))
+$(eval $(call BuildPackage,hostapd-mbedtls))
 $(eval $(call BuildPackage,wpad))
 $(eval $(call BuildPackage,wpad-mesh-openssl))
 $(eval $(call BuildPackage,wpad-mesh-wolfssl))
+$(eval $(call BuildPackage,wpad-mesh-mbedtls))
 $(eval $(call BuildPackage,wpad-basic))
 $(eval $(call BuildPackage,wpad-basic-openssl))
 $(eval $(call BuildPackage,wpad-basic-wolfssl))
+$(eval $(call BuildPackage,wpad-basic-mbedtls))
 $(eval $(call BuildPackage,wpad-mini))
 $(eval $(call BuildPackage,wpad-openssl))
 $(eval $(call BuildPackage,wpad-wolfssl))
+$(eval $(call BuildPackage,wpad-mbedtls))
 $(eval $(call BuildPackage,wpa-supplicant))
 $(eval $(call BuildPackage,wpa-supplicant-mesh-openssl))
 $(eval $(call BuildPackage,wpa-supplicant-mesh-wolfssl))
+$(eval $(call BuildPackage,wpa-supplicant-mesh-mbedtls))
 $(eval $(call BuildPackage,wpa-supplicant-basic))
 $(eval $(call BuildPackage,wpa-supplicant-mini))
 $(eval $(call BuildPackage,wpa-supplicant-p2p))
 $(eval $(call BuildPackage,wpa-supplicant-openssl))
 $(eval $(call BuildPackage,wpa-supplicant-wolfssl))
+$(eval $(call BuildPackage,wpa-supplicant-mbedtls))
 $(eval $(call BuildPackage,wpa-cli))
 $(eval $(call BuildPackage,hostapd-utils))
 $(eval $(call BuildPackage,eapol-test))
 $(eval $(call BuildPackage,eapol-test-openssl))
 $(eval $(call BuildPackage,eapol-test-wolfssl))
+$(eval $(call BuildPackage,eapol-test-mbedtls))
diff --git a/package/network/services/hostapd/files/hostapd-full.config b/package/network/services/hostapd/files/hostapd-full.config
index b92f9a25b865f0..9076ebc44f95df 100644
--- a/package/network/services/hostapd/files/hostapd-full.config
+++ b/package/network/services/hostapd/files/hostapd-full.config
@@ -142,7 +142,7 @@ CONFIG_PKCS12=y
 
 # RADIUS authentication server. This provides access to the integrated EAP
 # server from external hosts using RADIUS.
-#CONFIG_RADIUS_SERVER=y
+CONFIG_RADIUS_SERVER=y
 
 # Build IPv6 support for RADIUS operations
 CONFIG_IPV6=y
diff --git a/package/network/services/hostapd/files/hostapd.sh b/package/network/services/hostapd/files/hostapd.sh
index 7eeb74e9846cac..bf3625c92d8b4e 100644
--- a/package/network/services/hostapd/files/hostapd.sh
+++ b/package/network/services/hostapd/files/hostapd.sh
@@ -24,12 +24,12 @@ hostapd_append_wep_key() {
 		[1234])
 			for idx in 1 2 3 4; do
 				local zidx
-				zidx=$(($idx - 1))
+				zidx="$(($idx - 1))"
 				json_get_var ckey "key${idx}"
 				[ -n "$ckey" ] && \
 					append $var "wep_key${zidx}=$(prepare_key_wep "$ckey")" "$N$T"
 			done
-			wep_keyidx=$((key - 1))
+			wep_keyidx="$((key - 1))"
 		;;
 		*)
 			append $var "wep_key0=$(prepare_key_wep "$key")" "$N$T"
@@ -121,6 +121,7 @@ hostapd_common_add_device_config() {
 	config_add_array hostapd_options
 
 	config_add_int airtime_mode
+	config_add_int mbssid
 
 	hostapd_add_log_config
 }
@@ -131,9 +132,10 @@ hostapd_prepare_device_config() {
 
 	local base_cfg=
 
-	json_get_vars country country3 country_ie beacon_int:100 dtim_period:2 doth require_mode legacy_rates \
+	json_get_vars country country3 country_ie beacon_int:100 doth require_mode legacy_rates \
 		acs_chan_bias local_pwr_constraint spectrum_mgmt_required airtime_mode cell_density \
-		rts_threshold beacon_rate rssi_reject_assoc_rssi rssi_ignore_probe_request maxassoc
+		rts_threshold beacon_rate rssi_reject_assoc_rssi rssi_ignore_probe_request maxassoc \
+		mbssid:0
 
 	hostapd_set_log_options base_cfg
 
@@ -232,9 +234,9 @@ hostapd_prepare_device_config() {
 	[ -n "$brlist" ] && append base_cfg "basic_rates=$brlist" "$N"
 	append base_cfg "beacon_int=$beacon_int" "$N"
 	[ -n "$rts_threshold" ] && append base_cfg "rts_threshold=$rts_threshold" "$N"
-	append base_cfg "dtim_period=$dtim_period" "$N"
 	[ "$airtime_mode" -gt 0 ] && append base_cfg "airtime_mode=$airtime_mode" "$N"
 	[ -n "$maxassoc" ] && append base_cfg "iface_max_num_sta=$maxassoc" "$N"
+	[ "$mbssid" -gt 0 ] && [ "$mbssid" -le 2 ] && append base_cfg "mbssid=$mbssid" "$N"
 
 	json_get_values opts hostapd_options
 	for val in $opts; do
@@ -266,11 +268,11 @@ hostapd_common_add_bss_config() {
 	config_add_int ieee80211w
 	config_add_int eapol_version
 
-	config_add_string 'auth_server:host' 'server:host'
+	config_add_array auth_server acct_server
+	config_add_string 'server:host'
 	config_add_string auth_secret key
 	config_add_int 'auth_port:port' 'port:port'
 
-	config_add_string acct_server
 	config_add_string acct_secret
 	config_add_int acct_port
 	config_add_int acct_interval
@@ -525,6 +527,20 @@ append_airtime_sta_weight() {
 	[ -n "$1" ] && append bss_conf "airtime_sta_weight=$1" "$N"
 }
 
+append_auth_server() {
+	[ -n "$1" ] || return
+	append bss_conf "auth_server_addr=$1" "$N"
+	append bss_conf "auth_server_port=$auth_port" "$N"
+	[ -n "$auth_secret" ] && append bss_conf "auth_server_shared_secret=$auth_secret" "$N"
+}
+
+append_acct_server() {
+	[ -n "$1" ] || return
+	append bss_conf "acct_server_addr=$1" "$N"
+	append bss_conf "acct_server_port=$acct_port" "$N"
+	[ -n "$acct_secret" ] && append bss_conf "acct_server_shared_secret=$acct_secret" "$N"
+}
+
 hostapd_set_bss_options() {
 	local var="$1"
 	local phy="$2"
@@ -543,7 +559,7 @@ hostapd_set_bss_options() {
 		wps_independent wps_device_type wps_device_name wps_manufacturer wps_pin \
 		macfilter ssid utf8_ssid wmm uapsd hidden short_preamble rsn_preauth \
 		iapp_interface eapol_version dynamic_vlan ieee80211w nasid \
-		acct_server acct_secret acct_port acct_interval \
+		acct_secret acct_port acct_interval \
 		bss_load_update_period chan_util_avg_period sae_require_mfp sae_pwe \
 		multi_ap multi_ap_backhaul_ssid multi_ap_backhaul_key skip_inactivity_poll \
 		ppsk airtime_bss_weight airtime_bss_limit airtime_sta_weight \
@@ -612,16 +628,13 @@ hostapd_set_bss_options() {
 		[ -n "$wpa_strict_rekey" ] && append bss_conf "wpa_strict_rekey=$wpa_strict_rekey" "$N"
 	}
 
-	[ -n "$nasid" ] && append bss_conf "nas_identifier=$nasid" "$N"
-	[ -n "$acct_server" ] && {
-		append bss_conf "acct_server_addr=$acct_server" "$N"
-		append bss_conf "acct_server_port=$acct_port" "$N"
-		[ -n "$acct_secret" ] && \
-			append bss_conf "acct_server_shared_secret=$acct_secret" "$N"
-		[ -n "$acct_interval" ] && \
-			append bss_conf "radius_acct_interim_interval=$acct_interval" "$N"
-		json_for_each_item append_radius_acct_req_attr radius_acct_req_attr
-	}
+	set_default nasid "${macaddr//\:}"
+	append bss_conf "nas_identifier=$nasid" "$N"
+
+	[ -n "$acct_interval" ] && \
+		append bss_conf "radius_acct_interim_interval=$acct_interval" "$N"
+	json_for_each_item append_acct_server acct_server
+	json_for_each_item append_radius_acct_req_attr radius_acct_req_attr
 
 	[ -n "$ocv" ] && append bss_conf "ocv=$ocv" "$N"
 
@@ -658,11 +671,9 @@ hostapd_set_bss_options() {
 		psk|sae|psk-sae)
 			json_get_vars key wpa_psk_file
 			if [ "$auth_type" = "psk" ] && [ "$ppsk" -ne 0 ] ; then
-				json_get_vars auth_server auth_secret auth_port
+				json_get_vars auth_secret auth_port
 				set_default auth_port 1812
-				append bss_conf "auth_server_addr=$auth_server" "$N"
-				append bss_conf "auth_server_port=$auth_port" "$N"
-				append bss_conf "auth_server_shared_secret=$auth_secret" "$N"
+				json_for_each_item append_auth_server auth_server
 				append bss_conf "macaddr_acl=2" "$N"
 				append bss_conf "wpa_psk_radius=2" "$N"
 			elif [ ${#key} -eq 64 ]; then
@@ -688,7 +699,7 @@ hostapd_set_bss_options() {
 			json_get_vars \
 				auth_server auth_secret auth_port \
 				dae_client dae_secret dae_port \
-				ownip radius_client_addr \
+				dynamic_ownip ownip radius_client_addr \
 				eap_reauth_period request_cui \
 				erp_domain mobility_domain \
 				fils_realm fils_dhcp
@@ -696,6 +707,8 @@ hostapd_set_bss_options() {
 			# radius can provide VLAN ID for clients
 			vlan_possible=1
 
+			set_default dynamic_ownip 1
+
 			# legacy compatibility
 			[ -n "$auth_server" ] || json_get_var auth_server server
 			[ -n "$auth_port" ] || json_get_var auth_port port
@@ -729,12 +742,7 @@ hostapd_set_bss_options() {
 			set_default dae_port 3799
 			set_default request_cui 0
 
-			[ "$eap_server" -eq 0 ] && {
-				append bss_conf "auth_server_addr=$auth_server" "$N"
-				append bss_conf "auth_server_port=$auth_port" "$N"
-				append bss_conf "auth_server_shared_secret=$auth_secret" "$N"
-			}
-
+			[ "$eap_server" -eq 0 ] && json_for_each_item append_auth_server auth_server
 			[ "$request_cui" -gt 0 ] && append bss_conf "radius_request_cui=$request_cui" "$N"
 			[ -n "$eap_reauth_period" ] && append bss_conf "eap_reauth_period=$eap_reauth_period" "$N"
 
@@ -744,7 +752,12 @@ hostapd_set_bss_options() {
 			}
 			json_for_each_item append_radius_auth_req_attr radius_auth_req_attr
 
-			[ -n "$ownip" ] && append bss_conf "own_ip_addr=$ownip" "$N"
+			if [ -n "$ownip" ]; then
+				append bss_conf "own_ip_addr=$ownip" "$N"
+			elif [ "$dynamic_ownip" -gt 0 ]; then
+				append bss_conf "dynamic_own_ip_addr=$dynamic_ownip" "$N"
+			fi
+
 			[ -n "$radius_client_addr" ] && append bss_conf "radius_client_addr=$radius_client_addr" "$N"
 			append bss_conf "eapol_key_index_workaround=1" "$N"
 			append bss_conf "ieee8021x=1" "$N"
@@ -769,9 +782,7 @@ hostapd_set_bss_options() {
 			[ -n "$auth_server" ] &&  {
 				set_default auth_port 1812
 
-				append bss_conf "auth_server_addr=$auth_server" "$N"
-				append bss_conf "auth_server_port=$auth_port" "$N"
-				[ -n "$auth_secret" ] && append bss_conf "auth_server_shared_secret=$auth_secret" "$N"
+				json_for_each_item append_auth_server auth_server
 				[ -n "$ownip" ] && append bss_conf "own_ip_addr=$ownip" "$N"
 				[ -n "$radius_client_addr" ] && append bss_conf "radius_client_addr=$radius_client_addr" "$N"
 				append bss_conf "macaddr_acl=2" "$N"
@@ -779,7 +790,7 @@ hostapd_set_bss_options() {
 		;;
 	esac
 
-	local auth_algs=$((($auth_mode_shared << 1) | $auth_mode_open))
+	local auth_algs="$((($auth_mode_shared << 1) | $auth_mode_open))"
 	append bss_conf "auth_algs=${auth_algs:-1}" "$N"
 	append bss_conf "wpa=$wpa" "$N"
 	[ -n "$wpa_pairwise" ] && append bss_conf "wpa_pairwise=$wpa_pairwise" "$N"
@@ -906,7 +917,6 @@ hostapd_set_bss_options() {
 			append bss_conf "ft_psk_generate_local=$ft_psk_generate_local" "$N"
 			append bss_conf "ft_over_ds=$ft_over_ds" "$N"
 			append bss_conf "reassociation_deadline=$reassociation_deadline" "$N"
-			[ -n "$nasid" ] || append bss_conf "nas_identifier=${macaddr//\:}" "$N"
 
 			if [ "$ft_psk_generate_local" -eq "0" ]; then
 				json_get_vars r0_key_lifetime r1_key_holder pmk_r1_push
@@ -1149,7 +1159,7 @@ hostapd_set_bss_options() {
 		append bss_conf "$val" "$N"
 	done
 
-	bss_md5sum=$(echo $bss_conf | md5sum | cut -d" " -f1)
+	bss_md5sum="$(echo $bss_conf | md5sum | cut -d" " -f1)"
 	append bss_conf "config_id=$bss_md5sum" "$N"
 
 	append "$var" "$bss_conf" "$N"
@@ -1171,7 +1181,7 @@ hostapd_set_log_options() {
 	set_default log_iapp   1
 	set_default log_mlme   1
 
-	local log_mask=$(( \
+	local log_mask="$(( \
 		($log_80211  << 0) | \
 		($log_8021x  << 1) | \
 		($log_radius << 2) | \
@@ -1179,7 +1189,7 @@ hostapd_set_log_options() {
 		($log_driver << 4) | \
 		($log_iapp   << 5) | \
 		($log_mlme   << 6)   \
-	))
+	))"
 
 	append "$var" "logger_syslog=$log_mask" "$N"
 	append "$var" "logger_syslog_level=$log_level" "$N"
@@ -1323,7 +1333,7 @@ wpa_supplicant_add_network() {
 	}
 
 	[ "$_w_mode" = "mesh" ] && {
-		json_get_vars mesh_id mesh_fwding mesh_rssi_threshold
+		json_get_vars mesh_id mesh_fwding mesh_rssi_threshold encryption
 		[ -n "$mesh_id" ] && ssid="${mesh_id}"
 
 		append network_data "mode=5" "$N$T"
@@ -1331,7 +1341,7 @@ wpa_supplicant_add_network() {
 		[ -n "$mesh_rssi_threshold" ] && append network_data "mesh_rssi_threshold=${mesh_rssi_threshold}" "$N$T"
 		[ -n "$freq" ] && wpa_supplicant_set_fixed_freq "$freq" "$htmode"
 		[ "$noscan" = "1" ] && append network_data "noscan=1" "$N$T"
-		append wpa_key_mgmt "SAE"
+		[ "$encryption" = "none" -o -z "$encryption" ] || append wpa_key_mgmt "SAE"
 		scan_ssid=""
 	}
 
@@ -1365,11 +1375,11 @@ wpa_supplicant_add_network() {
 
 			key_mgmt="$wpa_key_mgmt"
 
-			if [ ${#key} -eq 64 ]; then
-				passphrase="psk=${key}"
+			if [ "$_w_mode" = "mesh" ] || [ "$auth_type" = "sae" ]; then
+				passphrase="sae_password=\"${key}\""
 			else
-				if [ "$_w_mode" = "mesh" ]; then
-					passphrase="sae_password=\"${key}\""
+				if [ ${#key} -eq 64 ]; then
+					passphrase="psk=${key}"
 				else
 					passphrase="psk=\"${key}\""
 				fi
diff --git a/package/network/services/hostapd/files/wpa_supplicant-basic.config b/package/network/services/hostapd/files/wpa_supplicant-basic.config
index 6abd8e2331aa13..944b4d92876002 100644
--- a/package/network/services/hostapd/files/wpa_supplicant-basic.config
+++ b/package/network/services/hostapd/files/wpa_supplicant-basic.config
@@ -26,7 +26,7 @@
 # replacement for WEXT and its use allows wpa_supplicant to properly control
 # the driver to improve existing functionality like roaming and to support new
 # functionality.
-CONFIG_DRIVER_WEXT=y
+#CONFIG_DRIVER_WEXT=y
 
 # Driver interface for Linux drivers using the nl80211 kernel interface
 CONFIG_DRIVER_NL80211=y
diff --git a/package/network/services/hostapd/files/wpa_supplicant-full.config b/package/network/services/hostapd/files/wpa_supplicant-full.config
index d24fbbb01f1723..b39dabca0696b5 100644
--- a/package/network/services/hostapd/files/wpa_supplicant-full.config
+++ b/package/network/services/hostapd/files/wpa_supplicant-full.config
@@ -26,7 +26,7 @@
 # replacement for WEXT and its use allows wpa_supplicant to properly control
 # the driver to improve existing functionality like roaming and to support new
 # functionality.
-CONFIG_DRIVER_WEXT=y
+#CONFIG_DRIVER_WEXT=y
 
 # Driver interface for Linux drivers using the nl80211 kernel interface
 CONFIG_DRIVER_NL80211=y
diff --git a/package/network/services/hostapd/files/wpa_supplicant-mini.config b/package/network/services/hostapd/files/wpa_supplicant-mini.config
index 9eb1111e523e59..2a3f8fb69de337 100644
--- a/package/network/services/hostapd/files/wpa_supplicant-mini.config
+++ b/package/network/services/hostapd/files/wpa_supplicant-mini.config
@@ -26,7 +26,7 @@
 # replacement for WEXT and its use allows wpa_supplicant to properly control
 # the driver to improve existing functionality like roaming and to support new
 # functionality.
-CONFIG_DRIVER_WEXT=y
+#CONFIG_DRIVER_WEXT=y
 
 # Driver interface for Linux drivers using the nl80211 kernel interface
 CONFIG_DRIVER_NL80211=y
diff --git a/package/network/services/hostapd/files/wpa_supplicant-p2p.config b/package/network/services/hostapd/files/wpa_supplicant-p2p.config
index 0dcc88e6486dff..7f5140622cc15a 100644
--- a/package/network/services/hostapd/files/wpa_supplicant-p2p.config
+++ b/package/network/services/hostapd/files/wpa_supplicant-p2p.config
@@ -26,7 +26,7 @@
 # replacement for WEXT and its use allows wpa_supplicant to properly control
 # the driver to improve existing functionality like roaming and to support new
 # functionality.
-CONFIG_DRIVER_WEXT=y
+#CONFIG_DRIVER_WEXT=y
 
 # Driver interface for Linux drivers using the nl80211 kernel interface
 CONFIG_DRIVER_NL80211=y
diff --git a/package/network/services/hostapd/files/wpad.init b/package/network/services/hostapd/files/wpad.init
index 79c5bf1075c8b5..65d46df982a50c 100644
--- a/package/network/services/hostapd/files/wpad.init
+++ b/package/network/services/hostapd/files/wpad.init
@@ -13,6 +13,7 @@ start_service() {
 		procd_open_instance hostapd
 		procd_set_param command /usr/sbin/hostapd -s -g /var/run/hostapd/global
 		procd_set_param respawn 3600 1 0
+		procd_set_param limits core="unlimited"
 		[ -x /sbin/ujail -a -e /etc/capabilities/wpad.json ] && {
 			procd_add_jail hostapd
 			procd_set_param capabilities /etc/capabilities/wpad.json
@@ -29,6 +30,7 @@ start_service() {
 		procd_open_instance supplicant
 		procd_set_param command /usr/sbin/wpa_supplicant -n -s -g /var/run/wpa_supplicant/global
 		procd_set_param respawn 3600 1 0
+		procd_set_param limits core="unlimited"
 		[ -x /sbin/ujail -a -e /etc/capabilities/wpad.json ] && {
 			procd_add_jail wpa_supplicant
 			procd_set_param capabilities /etc/capabilities/wpad.json
diff --git a/package/network/services/hostapd/patches/001-wolfssl-init-RNG-with-ECC-key.patch b/package/network/services/hostapd/patches/001-wolfssl-init-RNG-with-ECC-key.patch
index 994aa306264caa..269dcaac75ce3e 100644
--- a/package/network/services/hostapd/patches/001-wolfssl-init-RNG-with-ECC-key.patch
+++ b/package/network/services/hostapd/patches/001-wolfssl-init-RNG-with-ECC-key.patch
@@ -16,7 +16,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 
 --- a/src/crypto/crypto_wolfssl.c
 +++ b/src/crypto/crypto_wolfssl.c
-@@ -1307,6 +1307,7 @@ int ecc_projective_add_point(ecc_point *
+@@ -1340,6 +1340,7 @@ int ecc_projective_add_point(ecc_point *
  
  struct crypto_ec {
  	ecc_key key;
@@ -24,7 +24,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  	mp_int a;
  	mp_int prime;
  	mp_int order;
-@@ -1361,6 +1362,8 @@ struct crypto_ec * crypto_ec_init(int gr
+@@ -1394,6 +1395,8 @@ struct crypto_ec * crypto_ec_init(int gr
  		return NULL;
  
  	if (wc_ecc_init(&e->key) != 0 ||
@@ -33,7 +33,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  	    wc_ecc_set_curve(&e->key, 0, curve_id) != 0 ||
  	    mp_init(&e->a) != MP_OKAY ||
  	    mp_init(&e->prime) != MP_OKAY ||
-@@ -1392,6 +1395,7 @@ void crypto_ec_deinit(struct crypto_ec*
+@@ -1425,6 +1428,7 @@ void crypto_ec_deinit(struct crypto_ec*
  	mp_clear(&e->order);
  	mp_clear(&e->prime);
  	mp_clear(&e->a);
diff --git a/package/network/services/hostapd/patches/010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch b/package/network/services/hostapd/patches/010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch
index 16d24d1000b4d5..761fe368cd2a9c 100644
--- a/package/network/services/hostapd/patches/010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch
+++ b/package/network/services/hostapd/patches/010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch
@@ -14,7 +14,7 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
 
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -2409,7 +2409,7 @@ static int drv_supports_vht(struct wpa_s
+@@ -2621,7 +2621,7 @@ static int drv_supports_vht(struct wpa_s
  }
  
  
@@ -23,7 +23,7 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
  {
  	int i;
  
-@@ -2418,7 +2418,10 @@ static bool ibss_mesh_is_80mhz_avail(int
+@@ -2630,7 +2630,10 @@ static bool ibss_mesh_is_80mhz_avail(int
  
  		chan = hw_get_channel_chan(mode, i, NULL);
  		if (!chan ||
@@ -35,16 +35,16 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
  			return false;
  	}
  
-@@ -2447,6 +2450,8 @@ void ibss_mesh_setup_freq(struct wpa_sup
- 	int chwidth, seg0, seg1;
- 	u32 vht_caps = 0;
- 	bool is_24ghz, is_6ghz;
-+	bool dfs_enabled = wpa_s->conf->country[0] &&
-+			   (wpa_s->drv_flags & WPA_DRIVER_FLAGS_RADAR);
- 
- 	freq->freq = ssid->frequency;
- 
-@@ -2543,8 +2548,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2757,7 +2760,7 @@ static void ibss_mesh_select_40mhz(struc
+ 				   const struct wpa_ssid *ssid,
+ 				   struct hostapd_hw_modes *mode,
+ 				   struct hostapd_freq_params *freq,
+-				   int obss_scan) {
++				   int obss_scan, bool dfs_enabled) {
+ 	int chan_idx;
+ 	struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
+ 	int i, res;
+@@ -2781,8 +2784,11 @@ static void ibss_mesh_select_40mhz(struc
  		return;
  
  	/* Check primary channel flags */
@@ -55,9 +55,9 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
 +		if (!dfs_enabled)
 +			return;
  
- 	freq->channel = pri_chan->chan;
- 
-@@ -2577,8 +2585,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ #ifdef CONFIG_HT_OVERRIDES
+ 	if (ssid->disable_ht40)
+@@ -2808,8 +2814,11 @@ static void ibss_mesh_select_40mhz(struc
  		return;
  
  	/* Check secondary channel flags */
@@ -70,25 +70,34 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
  
  	if (ht40 == -1) {
  		if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
-@@ -2667,7 +2678,7 @@ skip_to_6ghz:
- 		return;
- 
- 	/* Back to HT configuration if channel not usable */
+@@ -2863,7 +2872,7 @@ static bool ibss_mesh_select_80_160mhz(s
+ 				       const struct wpa_ssid *ssid,
+ 				       struct hostapd_hw_modes *mode,
+ 				       struct hostapd_freq_params *freq,
+-				       int ieee80211_mode, bool is_6ghz) {
++				       int ieee80211_mode, bool is_6ghz, bool dfs_enabled) {
+ 	static const int bw80[] = {
+ 		5180, 5260, 5500, 5580, 5660, 5745, 5825,
+ 		5955, 6035, 6115, 6195, 6275, 6355, 6435,
+@@ -2908,7 +2917,7 @@ static bool ibss_mesh_select_80_160mhz(s
+ 		goto skip_80mhz;
+ 
+ 	/* Use 40 MHz if channel not usable */
 -	if (!ibss_mesh_is_80mhz_avail(channel, mode))
 +	if (!ibss_mesh_is_80mhz_avail(channel, mode, dfs_enabled))
- 		return;
- 
- 	chwidth = CHANWIDTH_80MHZ;
-@@ -2681,7 +2692,7 @@ skip_to_6ghz:
- 		 * above; check the remaining four 20 MHz channels for the total
- 		 * of 160 MHz bandwidth.
- 		 */
--		if (!ibss_mesh_is_80mhz_avail(channel + 16, mode))
-+		if (!ibss_mesh_is_80mhz_avail(channel + 16, mode, dfs_enabled))
- 			return;
- 
+ 		goto skip_80mhz;
+ 
+ 	chwidth = CONF_OPER_CHWIDTH_80MHZ;
+@@ -2922,7 +2931,7 @@ static bool ibss_mesh_select_80_160mhz(s
+ 	if ((mode->he_capab[ieee80211_mode].phy_cap[
+ 		     HE_PHYCAP_CHANNEL_WIDTH_SET_IDX] &
+ 	     HE_PHYCAP_CHANNEL_WIDTH_SET_160MHZ_IN_5G) && is_6ghz &&
+-	    ibss_mesh_is_80mhz_avail(channel + 16, mode)) {
++	    ibss_mesh_is_80mhz_avail(channel + 16, mode, dfs_enabled)) {
  		for (j = 0; j < ARRAY_SIZE(bw160); j++) {
-@@ -2711,10 +2722,12 @@ skip_to_6ghz:
+ 			if (freq->freq == bw160[j]) {
+ 				chwidth = CONF_OPER_CHWIDTH_160MHZ;
+@@ -2950,10 +2959,12 @@ static bool ibss_mesh_select_80_160mhz(s
  				if (!chan)
  					continue;
  
@@ -103,4 +112,24 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
 +						continue;
  
  				/* Found a suitable second segment for 80+80 */
- 				chwidth = CHANWIDTH_80P80MHZ;
+ 				chwidth = CONF_OPER_CHWIDTH_80P80MHZ;
+@@ -3008,6 +3019,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ 	int i, obss_scan = 1;
+ 	u8 channel;
+ 	bool is_6ghz;
++	bool dfs_enabled = wpa_s->conf->country[0] && (wpa_s->drv_flags & WPA_DRIVER_FLAGS_RADAR);
+ 
+ 	freq->freq = ssid->frequency;
+ 
+@@ -3053,9 +3065,9 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ 	freq->channel = channel;
+ 	/* Setup higher BW only for 5 GHz */
+ 	if (mode->mode == HOSTAPD_MODE_IEEE80211A) {
+-		ibss_mesh_select_40mhz(wpa_s, ssid, mode, freq, obss_scan);
++		ibss_mesh_select_40mhz(wpa_s, ssid, mode, freq, obss_scan, dfs_enabled);
+ 		if (!ibss_mesh_select_80_160mhz(wpa_s, ssid, mode, freq,
+-						ieee80211_mode, is_6ghz))
++						ieee80211_mode, is_6ghz, dfs_enabled))
+ 			freq->he_enabled = freq->vht_enabled = false;
+ 	}
+ 
diff --git a/package/network/services/hostapd/patches/011-mesh-use-deterministic-channel-on-channel-switch.patch b/package/network/services/hostapd/patches/011-mesh-use-deterministic-channel-on-channel-switch.patch
index 1faeacf76604a3..20a8bee072758f 100644
--- a/package/network/services/hostapd/patches/011-mesh-use-deterministic-channel-on-channel-switch.patch
+++ b/package/network/services/hostapd/patches/011-mesh-use-deterministic-channel-on-channel-switch.patch
@@ -28,8 +28,8 @@ Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
 +#include "crypto/crypto.h"
  
  
- static int dfs_get_used_n_chans(struct hostapd_iface *iface, int *seg1)
-@@ -483,9 +484,14 @@ dfs_get_valid_channel(struct hostapd_ifa
+ enum dfs_channel_type {
+@@ -521,9 +522,14 @@ dfs_get_valid_channel(struct hostapd_ifa
  	int num_available_chandefs;
  	int chan_idx, chan_idx2;
  	int sec_chan_idx_80p80 = -1;
@@ -44,7 +44,7 @@ Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
  	wpa_printf(MSG_DEBUG, "DFS: Selecting random channel");
  	*secondary_channel = 0;
  	*oper_centr_freq_seg0_idx = 0;
-@@ -505,8 +511,20 @@ dfs_get_valid_channel(struct hostapd_ifa
+@@ -543,8 +549,20 @@ dfs_get_valid_channel(struct hostapd_ifa
  	if (num_available_chandefs == 0)
  		return NULL;
  
@@ -64,11 +64,11 @@ Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
  		return NULL;
 +
  	chan_idx = _rand % num_available_chandefs;
- 	dfs_find_channel(iface, &chan, chan_idx, skip_radar);
+ 	dfs_find_channel(iface, &chan, chan_idx, type);
  	if (!chan) {
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -9895,6 +9895,10 @@ static int nl80211_switch_channel(void *
+@@ -10739,6 +10739,10 @@ static int nl80211_switch_channel(void *
  	if (ret)
  		goto error;
  
diff --git a/package/network/services/hostapd/patches/021-fix-sta-add-after-previous-connection.patch b/package/network/services/hostapd/patches/021-fix-sta-add-after-previous-connection.patch
index ac02ec5ab7252b..827e122baf4ea3 100644
--- a/package/network/services/hostapd/patches/021-fix-sta-add-after-previous-connection.patch
+++ b/package/network/services/hostapd/patches/021-fix-sta-add-after-previous-connection.patch
@@ -1,6 +1,6 @@
 --- a/src/ap/ieee802_11.c
 +++ b/src/ap/ieee802_11.c
-@@ -4944,6 +4944,13 @@ static int add_associated_sta(struct hos
+@@ -4168,6 +4168,13 @@ static int add_associated_sta(struct hos
  	 * drivers to accept the STA parameter configuration. Since this is
  	 * after a new FT-over-DS exchange, a new TK has been derived, so key
  	 * reinstallation is not a concern for this case.
@@ -14,7 +14,7 @@
  	 */
  	wpa_printf(MSG_DEBUG, "Add associated STA " MACSTR
  		   " (added_unassoc=%d auth_alg=%u ft_over_ds=%u reassoc=%d authorized=%d ft_tk=%d fils_tk=%d)",
-@@ -4957,7 +4964,8 @@ static int add_associated_sta(struct hos
+@@ -4181,7 +4188,8 @@ static int add_associated_sta(struct hos
  	    (!(sta->flags & WLAN_STA_AUTHORIZED) ||
  	     (reassoc && sta->ft_over_ds && sta->auth_alg == WLAN_AUTH_FT) ||
  	     (!wpa_auth_sta_ft_tk_already_set(sta->wpa_sm) &&
diff --git a/package/network/services/hostapd/patches/022-hostapd-fix-use-of-uninitialized-stack-variables.patch b/package/network/services/hostapd/patches/022-hostapd-fix-use-of-uninitialized-stack-variables.patch
index c7da33f029058a..f4f56f5107cf6c 100644
--- a/package/network/services/hostapd/patches/022-hostapd-fix-use-of-uninitialized-stack-variables.patch
+++ b/package/network/services/hostapd/patches/022-hostapd-fix-use-of-uninitialized-stack-variables.patch
@@ -14,7 +14,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -3431,7 +3431,7 @@ static int hostapd_change_config_freq(st
+@@ -3562,7 +3562,7 @@ static int hostapd_change_config_freq(st
  				      struct hostapd_freq_params *old_params)
  {
  	int channel;
diff --git a/package/network/services/hostapd/patches/030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch b/package/network/services/hostapd/patches/030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch
index ade0b1131105e7..c02d4b497e2aee 100644
--- a/package/network/services/hostapd/patches/030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch
+++ b/package/network/services/hostapd/patches/030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch
@@ -20,7 +20,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #include <linux/rtnetlink.h>
  #include <netpacket/packet.h>
  #include <linux/errqueue.h>
-@@ -5300,26 +5297,29 @@ fail:
+@@ -5590,26 +5587,29 @@ fail:
  
  static void rtnl_neigh_delete_fdb_entry(struct i802_bss *bss, const u8 *addr)
  {
@@ -64,7 +64,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (err < 0) {
  		wpa_printf(MSG_DEBUG, "nl80211: bridge FDB entry delete for "
  			   MACSTR " ifindex=%d failed: %s", MAC2STR(addr),
-@@ -5329,9 +5329,8 @@ static void rtnl_neigh_delete_fdb_entry(
+@@ -5619,9 +5619,8 @@ static void rtnl_neigh_delete_fdb_entry(
  			   MACSTR, MAC2STR(addr));
  	}
  
@@ -76,7 +76,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
  
  
-@@ -7714,7 +7713,6 @@ static void *i802_init(struct hostapd_da
+@@ -8275,7 +8274,6 @@ static void *i802_init(struct hostapd_da
  	    (params->num_bridge == 0 || !params->bridge[0]))
  		add_ifidx(drv, br_ifindex, drv->ifindex);
  
@@ -84,7 +84,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (bss->added_if_into_bridge || bss->already_in_bridge) {
  		int err;
  
-@@ -7731,7 +7729,6 @@ static void *i802_init(struct hostapd_da
+@@ -8292,7 +8290,6 @@ static void *i802_init(struct hostapd_da
  			goto failed;
  		}
  	}
@@ -92,7 +92,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	if (drv->capa.flags2 & WPA_DRIVER_FLAGS2_CONTROL_PORT_RX) {
  		wpa_printf(MSG_DEBUG,
-@@ -10678,13 +10675,14 @@ static int wpa_driver_br_add_ip_neigh(vo
+@@ -11605,13 +11602,14 @@ static int wpa_driver_br_add_ip_neigh(vo
  				      const u8 *ipaddr, int prefixlen,
  				      const u8 *addr)
  {
@@ -112,7 +112,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	int res;
  
  	if (!ipaddr || prefixlen == 0 || !addr)
-@@ -10703,85 +10701,66 @@ static int wpa_driver_br_add_ip_neigh(vo
+@@ -11630,85 +11628,66 @@ static int wpa_driver_br_add_ip_neigh(vo
  	}
  
  	if (version == 4) {
@@ -220,7 +220,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		addrsize = 16;
  	} else {
  		return -EINVAL;
-@@ -10799,41 +10778,30 @@ static int wpa_driver_br_delete_ip_neigh
+@@ -11726,41 +11705,30 @@ static int wpa_driver_br_delete_ip_neigh
  		return -1;
  	}
  
diff --git a/package/network/services/hostapd/patches/040-mesh-allow-processing-authentication-frames-in-block.patch b/package/network/services/hostapd/patches/040-mesh-allow-processing-authentication-frames-in-block.patch
index 6d9fd81acf8580..179d47ecc4ed02 100644
--- a/package/network/services/hostapd/patches/040-mesh-allow-processing-authentication-frames-in-block.patch
+++ b/package/network/services/hostapd/patches/040-mesh-allow-processing-authentication-frames-in-block.patch
@@ -16,7 +16,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/src/ap/ieee802_11.c
 +++ b/src/ap/ieee802_11.c
-@@ -3761,15 +3761,6 @@ static void handle_auth(struct hostapd_d
+@@ -2948,15 +2948,6 @@ static void handle_auth(struct hostapd_d
  				       seq_ctrl);
  			return;
  		}
diff --git a/package/network/services/hostapd/patches/050-build_fix.patch b/package/network/services/hostapd/patches/050-build_fix.patch
index 2652a8331610e8..8680b07c66a26f 100644
--- a/package/network/services/hostapd/patches/050-build_fix.patch
+++ b/package/network/services/hostapd/patches/050-build_fix.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/Makefile
 +++ b/hostapd/Makefile
-@@ -323,6 +323,7 @@ ifdef CONFIG_FILS
+@@ -324,6 +324,7 @@ ifdef CONFIG_FILS
  CFLAGS += -DCONFIG_FILS
  OBJS += ../src/ap/fils_hlp.o
  NEED_SHA384=y
@@ -10,7 +10,7 @@
  CFLAGS += -DCONFIG_FILS_SK_PFS
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -312,6 +312,7 @@ endif
+@@ -331,6 +331,7 @@ endif
  ifdef CONFIG_FILS
  CFLAGS += -DCONFIG_FILS
  NEED_SHA384=y
diff --git a/package/network/services/hostapd/patches/110-mbedtls-TLS-crypto-option-initial-port.patch b/package/network/services/hostapd/patches/110-mbedtls-TLS-crypto-option-initial-port.patch
new file mode 100644
index 00000000000000..22107944dce7d5
--- /dev/null
+++ b/package/network/services/hostapd/patches/110-mbedtls-TLS-crypto-option-initial-port.patch
@@ -0,0 +1,8051 @@
+From e16f200dc1d2f69efc78c7c55af0d7b410a981f9 Mon Sep 17 00:00:00 2001
+From: Glenn Strauss <gstrauss@gluelogic.com>
+Date: Tue, 5 Jul 2022 02:49:50 -0400
+Subject: [PATCH 1/7] mbedtls: TLS/crypto option (initial port)
+
+Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
+---
+ hostapd/Makefile                              |   91 +
+ hostapd/defconfig                             |   15 +-
+ src/crypto/crypto_mbedtls.c                   | 4043 +++++++++++++++++
+ src/crypto/tls_mbedtls.c                      | 3313 ++++++++++++++
+ .../build/build-wpa_supplicant-mbedtls.config |   24 +
+ tests/hwsim/example-hostapd.config            |    4 +
+ tests/hwsim/example-wpa_supplicant.config     |    4 +
+ wpa_supplicant/Makefile                       |   74 +
+ wpa_supplicant/defconfig                      |    6 +-
+ 9 files changed, 7571 insertions(+), 3 deletions(-)
+ create mode 100644 src/crypto/crypto_mbedtls.c
+ create mode 100644 src/crypto/tls_mbedtls.c
+ create mode 100644 tests/build/build-wpa_supplicant-mbedtls.config
+
+--- a/hostapd/Makefile
++++ b/hostapd/Makefile
+@@ -745,6 +745,40 @@ endif
+ CFLAGS += -DTLS_DEFAULT_CIPHERS=\"$(CONFIG_TLS_DEFAULT_CIPHERS)\"
+ endif
+ 
++ifeq ($(CONFIG_TLS), mbedtls)
++ifndef CONFIG_CRYPTO
++CONFIG_CRYPTO=mbedtls
++endif
++ifdef TLS_FUNCS
++OBJS += ../src/crypto/tls_mbedtls.o
++LIBS += -lmbedtls
++ifndef CONFIG_DPP
++LIBS += -lmbedx509
++endif
++endif
++OBJS += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
++HOBJS += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
++SOBJS += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
++ifdef NEED_FIPS186_2_PRF
++OBJS += ../src/crypto/fips_prf_internal.o
++SHA1OBJS += ../src/crypto/sha1-internal.o
++endif
++ifeq ($(CONFIG_CRYPTO), mbedtls)
++ifdef CONFIG_DPP
++LIBS += -lmbedx509
++LIBS_h += -lmbedx509
++LIBS_n += -lmbedx509
++LIBS_s += -lmbedx509
++endif
++LIBS += -lmbedcrypto
++LIBS_h += -lmbedcrypto
++LIBS_n += -lmbedcrypto
++LIBS_s += -lmbedcrypto
++# XXX: create a config option?
++CFLAGS += -DCRYPTO_RSA_OAEP_SHA256
++endif
++endif
++
+ ifeq ($(CONFIG_TLS), gnutls)
+ ifndef CONFIG_CRYPTO
+ # default to libgcrypt
+@@ -924,9 +958,11 @@ endif
+ 
+ ifneq ($(CONFIG_TLS), openssl)
+ ifneq ($(CONFIG_TLS), wolfssl)
++ifneq ($(CONFIG_TLS), mbedtls)
+ AESOBJS += ../src/crypto/aes-wrap.o
+ endif
+ endif
++endif
+ ifdef NEED_AES_EAX
+ AESOBJS += ../src/crypto/aes-eax.o
+ NEED_AES_CTR=y
+@@ -936,38 +972,48 @@ AESOBJS += ../src/crypto/aes-siv.o
+ NEED_AES_CTR=y
+ endif
+ ifdef NEED_AES_CTR
++ifneq ($(CONFIG_TLS), mbedtls)
+ AESOBJS += ../src/crypto/aes-ctr.o
+ endif
++endif
+ ifdef NEED_AES_ENCBLOCK
++ifneq ($(CONFIG_TLS), mbedtls)
+ AESOBJS += ../src/crypto/aes-encblock.o
+ endif
++endif
+ ifneq ($(CONFIG_TLS), openssl)
+ ifneq ($(CONFIG_TLS), linux)
+ ifneq ($(CONFIG_TLS), wolfssl)
++ifneq ($(CONFIG_TLS), mbedtls)
+ AESOBJS += ../src/crypto/aes-omac1.o
+ endif
+ endif
+ endif
++endif
+ ifdef NEED_AES_UNWRAP
+ ifneq ($(CONFIG_TLS), openssl)
+ ifneq ($(CONFIG_TLS), linux)
+ ifneq ($(CONFIG_TLS), wolfssl)
++ifneq ($(CONFIG_TLS), mbedtls)
+ NEED_AES_DEC=y
+ AESOBJS += ../src/crypto/aes-unwrap.o
+ endif
+ endif
+ endif
+ endif
++endif
+ ifdef NEED_AES_CBC
+ NEED_AES_DEC=y
+ ifneq ($(CONFIG_TLS), openssl)
+ ifneq ($(CONFIG_TLS), linux)
+ ifneq ($(CONFIG_TLS), wolfssl)
++ifneq ($(CONFIG_TLS), mbedtls)
+ AESOBJS += ../src/crypto/aes-cbc.o
+ endif
+ endif
+ endif
+ endif
++endif
+ ifdef NEED_AES_DEC
+ ifdef CONFIG_INTERNAL_AES
+ AESOBJS += ../src/crypto/aes-internal-dec.o
+@@ -982,12 +1028,16 @@ ifneq ($(CONFIG_TLS), openssl)
+ ifneq ($(CONFIG_TLS), linux)
+ ifneq ($(CONFIG_TLS), gnutls)
+ ifneq ($(CONFIG_TLS), wolfssl)
++ifneq ($(CONFIG_TLS), mbedtls)
+ SHA1OBJS += ../src/crypto/sha1.o
+ endif
+ endif
+ endif
+ endif
++endif
++ifneq ($(CONFIG_TLS), mbedtls)
+ SHA1OBJS += ../src/crypto/sha1-prf.o
++endif
+ ifdef CONFIG_INTERNAL_SHA1
+ SHA1OBJS += ../src/crypto/sha1-internal.o
+ ifdef NEED_FIPS186_2_PRF
+@@ -996,16 +1046,22 @@ endif
+ endif
+ ifneq ($(CONFIG_TLS), openssl)
+ ifneq ($(CONFIG_TLS), wolfssl)
++ifneq ($(CONFIG_TLS), mbedtls)
+ SHA1OBJS += ../src/crypto/sha1-pbkdf2.o
+ endif
+ endif
++endif
+ ifdef NEED_T_PRF
++ifneq ($(CONFIG_TLS), mbedtls)
+ SHA1OBJS += ../src/crypto/sha1-tprf.o
+ endif
++endif
+ ifdef NEED_TLS_PRF
++ifneq ($(CONFIG_TLS), mbedtls)
+ SHA1OBJS += ../src/crypto/sha1-tlsprf.o
+ endif
+ endif
++endif
+ 
+ ifdef NEED_SHA1
+ OBJS += $(SHA1OBJS)
+@@ -1015,11 +1071,13 @@ ifneq ($(CONFIG_TLS), openssl)
+ ifneq ($(CONFIG_TLS), linux)
+ ifneq ($(CONFIG_TLS), gnutls)
+ ifneq ($(CONFIG_TLS), wolfssl)
++ifneq ($(CONFIG_TLS), mbedtls)
+ OBJS += ../src/crypto/md5.o
+ endif
+ endif
+ endif
+ endif
++endif
+ 
+ ifdef NEED_MD5
+ ifdef CONFIG_INTERNAL_MD5
+@@ -1058,56 +1116,81 @@ ifneq ($(CONFIG_TLS), openssl)
+ ifneq ($(CONFIG_TLS), linux)
+ ifneq ($(CONFIG_TLS), gnutls)
+ ifneq ($(CONFIG_TLS), wolfssl)
++ifneq ($(CONFIG_TLS), mbedtls)
+ OBJS += ../src/crypto/sha256.o
+ endif
+ endif
+ endif
+ endif
++endif
++ifneq ($(CONFIG_TLS), mbedtls)
+ OBJS += ../src/crypto/sha256-prf.o
++endif
+ ifdef CONFIG_INTERNAL_SHA256
+ OBJS += ../src/crypto/sha256-internal.o
+ endif
+ ifdef NEED_TLS_PRF_SHA256
++ifneq ($(CONFIG_TLS), mbedtls)
+ OBJS += ../src/crypto/sha256-tlsprf.o
+ endif
++endif
+ ifdef NEED_TLS_PRF_SHA384
++ifneq ($(CONFIG_TLS), mbedtls)
+ OBJS += ../src/crypto/sha384-tlsprf.o
+ endif
++endif
+ ifdef NEED_HMAC_SHA256_KDF
++CFLAGS += -DCONFIG_HMAC_SHA256_KDF
++ifneq ($(CONFIG_TLS), mbedtls)
+ OBJS += ../src/crypto/sha256-kdf.o
+ endif
++endif
+ ifdef NEED_HMAC_SHA384_KDF
++CFLAGS += -DCONFIG_HMAC_SHA384_KDF
++ifneq ($(CONFIG_TLS), mbedtls)
+ OBJS += ../src/crypto/sha384-kdf.o
+ endif
++endif
+ ifdef NEED_HMAC_SHA512_KDF
++CFLAGS += -DCONFIG_HMAC_SHA512_KDF
++ifneq ($(CONFIG_TLS), mbedtls)
+ OBJS += ../src/crypto/sha512-kdf.o
+ endif
++endif
+ ifdef NEED_SHA384
+ CFLAGS += -DCONFIG_SHA384
+ ifneq ($(CONFIG_TLS), openssl)
+ ifneq ($(CONFIG_TLS), linux)
+ ifneq ($(CONFIG_TLS), gnutls)
+ ifneq ($(CONFIG_TLS), wolfssl)
++ifneq ($(CONFIG_TLS), mbedtls)
+ OBJS += ../src/crypto/sha384.o
+ endif
+ endif
+ endif
+ endif
++endif
++ifneq ($(CONFIG_TLS), mbedtls)
+ OBJS += ../src/crypto/sha384-prf.o
+ endif
++endif
+ ifdef NEED_SHA512
+ CFLAGS += -DCONFIG_SHA512
+ ifneq ($(CONFIG_TLS), openssl)
+ ifneq ($(CONFIG_TLS), linux)
+ ifneq ($(CONFIG_TLS), gnutls)
+ ifneq ($(CONFIG_TLS), wolfssl)
++ifneq ($(CONFIG_TLS), mbedtls)
+ OBJS += ../src/crypto/sha512.o
+ endif
+ endif
+ endif
+ endif
++endif
++ifneq ($(CONFIG_TLS), mbedtls)
+ OBJS += ../src/crypto/sha512-prf.o
+ endif
++endif
+ 
+ ifdef CONFIG_INTERNAL_SHA384
+ CFLAGS += -DCONFIG_INTERNAL_SHA384
+@@ -1152,11 +1235,13 @@ HOBJS += $(SHA1OBJS)
+ ifneq ($(CONFIG_TLS), openssl)
+ ifneq ($(CONFIG_TLS), linux)
+ ifneq ($(CONFIG_TLS), wolfssl)
++ifneq ($(CONFIG_TLS), mbedtls)
+ HOBJS += ../src/crypto/md5.o
+ endif
+ endif
+ endif
+ endif
++endif
+ 
+ ifdef CONFIG_RADIUS_SERVER
+ CFLAGS += -DRADIUS_SERVER
+@@ -1329,7 +1414,9 @@ NOBJS += ../src/utils/trace.o
+ endif
+ 
+ HOBJS += hlr_auc_gw.o ../src/utils/common.o ../src/utils/wpa_debug.o ../src/utils/os_$(CONFIG_OS).o ../src/utils/wpabuf.o ../src/crypto/milenage.o
++ifneq ($(CONFIG_TLS), mbedtls)
+ HOBJS += ../src/crypto/aes-encblock.o
++endif
+ ifdef CONFIG_INTERNAL_AES
+ HOBJS += ../src/crypto/aes-internal.o
+ HOBJS += ../src/crypto/aes-internal-enc.o
+@@ -1352,13 +1439,17 @@ SOBJS += ../src/common/sae.o
+ SOBJS += ../src/common/sae_pk.o
+ SOBJS += ../src/common/dragonfly.o
+ SOBJS += $(AESOBJS)
++ifneq ($(CONFIG_TLS), mbedtls)
+ SOBJS += ../src/crypto/sha256-prf.o
+ SOBJS += ../src/crypto/sha384-prf.o
+ SOBJS += ../src/crypto/sha512-prf.o
++endif
+ SOBJS += ../src/crypto/dh_groups.o
++ifneq ($(CONFIG_TLS), mbedtls)
+ SOBJS += ../src/crypto/sha256-kdf.o
+ SOBJS += ../src/crypto/sha384-kdf.o
+ SOBJS += ../src/crypto/sha512-kdf.o
++endif
+ 
+ _OBJS_VAR := NOBJS
+ include ../src/objs.mk
+--- a/hostapd/defconfig
++++ b/hostapd/defconfig
+@@ -6,9 +6,21 @@
+ # just setting VARIABLE=n is not disabling that variable.
+ #
+ # This file is included in Makefile, so variables like CFLAGS and LIBS can also
+-# be modified from here. In most cass, these lines should use += in order not
++# be modified from here. In most cases, these lines should use += in order not
+ # to override previous values of the variables.
+ 
++
++# Uncomment following two lines and fix the paths if you have installed TLS
++# libraries in a non-default location
++#CFLAGS += -I/usr/local/openssl/include
++#LIBS += -L/usr/local/openssl/lib
++
++# Some Red Hat versions seem to include kerberos header files from OpenSSL, but
++# the kerberos files are not in the default include path. Following line can be
++# used to fix build issues on such systems (krb5.h not found).
++#CFLAGS += -I/usr/include/kerberos
++
++
+ # Driver interface for Host AP driver
+ CONFIG_DRIVER_HOSTAP=y
+ 
+@@ -278,6 +290,7 @@ CONFIG_IPV6=y
+ # openssl = OpenSSL (default)
+ # gnutls = GnuTLS
+ # internal = Internal TLSv1 implementation (experimental)
++# mbedtls = mbed TLS
+ # linux = Linux kernel AF_ALG and internal TLSv1 implementation (experimental)
+ # none = Empty template
+ #CONFIG_TLS=openssl
+--- /dev/null
++++ b/src/crypto/crypto_mbedtls.c
+@@ -0,0 +1,4043 @@
++/*
++ * crypto wrapper functions for mbed TLS
++ *
++ * SPDX-FileCopyrightText: 2022 Glenn Strauss <gstrauss@gluelogic.com>
++ * SPDX-License-Identifier: BSD-3-Clause
++ */
++
++#include "utils/includes.h"
++#include "utils/common.h"
++
++#include <mbedtls/version.h>
++#include <mbedtls/entropy.h>
++#include <mbedtls/ctr_drbg.h>
++#include <mbedtls/platform_util.h> /* mbedtls_platform_zeroize() */
++#include <mbedtls/asn1.h>
++#include <mbedtls/asn1write.h>
++#include <mbedtls/aes.h>
++#include <mbedtls/md.h>
++#include <mbedtls/md5.h>
++#include <mbedtls/sha1.h>
++#include <mbedtls/sha256.h>
++#include <mbedtls/sha512.h>
++
++#ifndef MBEDTLS_PRIVATE
++#define MBEDTLS_PRIVATE(x) x
++#endif
++
++/* hostapd/wpa_supplicant provides forced_memzero(),
++ * but prefer mbedtls_platform_zeroize() */
++#define forced_memzero(ptr,sz) mbedtls_platform_zeroize(ptr,sz)
++
++#ifndef __has_attribute
++#define __has_attribute(x) 0
++#endif
++
++#ifndef __GNUC_PREREQ
++#define __GNUC_PREREQ(maj,min) 0
++#endif
++
++#ifndef __attribute_cold__
++#if __has_attribute(cold) \
++ || __GNUC_PREREQ(4,3)
++#define __attribute_cold__  __attribute__((__cold__))
++#else
++#define __attribute_cold__
++#endif
++#endif
++
++#ifndef __attribute_noinline__
++#if __has_attribute(noinline) \
++ || __GNUC_PREREQ(3,1)
++#define __attribute_noinline__  __attribute__((__noinline__))
++#else
++#define __attribute_noinline__
++#endif
++#endif
++
++#include "crypto.h"
++#include "aes_wrap.h"
++#include "aes.h"
++#include "md5.h"
++#include "sha1.h"
++#include "sha256.h"
++#include "sha384.h"
++#include "sha512.h"
++
++
++/*
++ * selective code inclusion based on preprocessor defines
++ *
++ * future: additional code could be wrapped with preprocessor checks if
++ * wpa_supplicant/Makefile and hostap/Makefile were more consistent with
++ * setting preprocessor defines for named groups of functionality
++ */
++
++#if defined(CONFIG_FIPS)
++#undef MBEDTLS_MD4_C     /* omit md4_vector() */
++#undef MBEDTLS_MD5_C     /* omit md5_vector() hmac_md5_vector() hmac_md5() */
++#undef MBEDTLS_DES_C     /* omit des_encrypt() */
++#undef MBEDTLS_NIST_KW_C /* omit aes_wrap() aes_unwrap() */
++#define CRYPTO_MBEDTLS_CONFIG_FIPS
++#endif
++
++#if !defined(CONFIG_FIPS)
++#if defined(EAP_PWD) \
++ || defined(EAP_LEAP) || defined(EAP_LEAP_DYNAMIC) \
++ || defined(EAP_TTLS) || defined(EAP_TTLS_DYNAMIC) \
++ || defined(EAP_MSCHAPv2) || defined(EAP_MSCHAPv2_DYNAMIC) \
++ || defined(EAP_SERVER_MSCHAPV2)
++#ifndef MBEDTLS_MD4_C    /* (MD4 not in mbedtls 3.x) */
++#include "md4-internal.c"/* pull in hostap local implementation */
++#endif /* md4_vector() */
++#else
++#undef MBEDTLS_MD4_C     /* omit md4_vector() */
++#endif
++#endif
++
++#if !defined(CONFIG_NO_RC4) && !defined(CONFIG_NO_WPA)
++#ifndef MBEDTLS_ARC4_C   /* (RC4 not in mbedtls 3.x) */
++#include "rc4.c"         /* pull in hostap local implementation */
++#endif /* rc4_skip() */
++#else
++#undef MBEDTLS_ARC4_C    /* omit rc4_skip() */
++#endif
++
++#if defined(CONFIG_MACSEC)     \
++ || defined(CONFIG_NO_RADIUS)  \
++ || defined(CONFIG_IEEE80211R) \
++ || defined(EAP_SERVER_FAST)   \
++ || defined(EAP_SERVER_TEAP)   \
++ || !defined(CONFIG_NO_WPA)
++       /* aes_wrap() aes_unwrap() */
++#else
++#undef MBEDTLS_NIST_KW_C /* omit aes_wrap() aes_unwrap() */
++#endif
++
++#if !defined(CONFIG_SHA256)
++#undef MBEDTLS_SHA256_C
++#endif
++
++#if !defined(CONFIG_SHA384) && !defined(CONFIG_SHA512)
++#undef MBEDTLS_SHA512_C
++#endif
++
++#if defined(CONFIG_HMAC_SHA256_KDF)
++#define CRYPTO_MBEDTLS_HMAC_KDF_SHA256
++#endif
++#if defined(CONFIG_HMAC_SHA384_KDF)
++#define CRYPTO_MBEDTLS_HMAC_KDF_SHA384
++#endif
++#if defined(CONFIG_HMAC_SHA512_KDF)
++#define CRYPTO_MBEDTLS_HMAC_KDF_SHA512
++#endif
++
++#if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST) \
++ || defined(EAP_TEAP) || defined(EAP_TEAP_DYNAMIC) || defined(EAP_SERVER_FAST)
++#define CRYPTO_MBEDTLS_SHA1_T_PRF
++#endif
++
++#if defined(CONFIG_DES)
++#define CRYPTO_MBEDTLS_DES_ENCRYPT
++#endif /* des_encrypt() */
++
++#if !defined(CONFIG_NO_PBKDF2)
++#define CRYPTO_MBEDTLS_PBKDF2_SHA1
++#endif /* pbkdf2_sha1() */
++
++#if defined(EAP_IKEV2) \
++ || defined(EAP_IKEV2_DYNAMIC) \
++ || defined(EAP_SERVER_IKEV2) /* CONFIG_EAP_IKEV2=y */
++#define CRYPTO_MBEDTLS_CRYPTO_CIPHER
++#endif /* crypto_cipher_*() */
++
++#if defined(EAP_PWD) || defined(EAP_SERVER_PWD) /* CONFIG_EAP_PWD=y */
++#define CRYPTO_MBEDTLS_CRYPTO_HASH
++#endif /* crypto_hash_*() */
++
++#if defined(EAP_PWD) || defined(EAP_SERVER_PWD) /* CONFIG_EAP_PWD=y */ \
++ || defined(CONFIG_SAE) /* CONFIG_SAE=y */
++#define CRYPTO_MBEDTLS_CRYPTO_BIGNUM
++#endif /* crypto_bignum_*() */
++
++#if defined(EAP_PWD)          /* CONFIG_EAP_PWD=y */    \
++ || defined(EAP_EKE)          /* CONFIG_EAP_EKE=y */    \
++ || defined(EAP_EKE_DYNAMIC)  /* CONFIG_EAP_EKE=y */    \
++ || defined(EAP_SERVER_EKE)   /* CONFIG_EAP_EKE=y */    \
++ || defined(EAP_IKEV2)        /* CONFIG_EAP_IKEV2y */   \
++ || defined(EAP_IKEV2_DYNAMIC)/* CONFIG_EAP_IKEV2=y */  \
++ || defined(EAP_SERVER_IKEV2) /* CONFIG_EAP_IKEV2=y */  \
++ || defined(CONFIG_SAE)       /* CONFIG_SAE=y */        \
++ || defined(CONFIG_WPS)       /* CONFIG_WPS=y */
++#define CRYPTO_MBEDTLS_CRYPTO_DH
++#if defined(CONFIG_WPS_NFC)
++#define CRYPTO_MBEDTLS_DH5_INIT_FIXED
++#endif /* dh5_init_fixed() */
++#endif /* crypto_dh_*() */
++
++#if !defined(CONFIG_NO_WPA) /* CONFIG_NO_WPA= */
++#define CRYPTO_MBEDTLS_CRYPTO_ECDH
++#endif /* crypto_ecdh_*() */
++
++#if defined(CONFIG_ECC)
++#define CRYPTO_MBEDTLS_CRYPTO_BIGNUM
++#define CRYPTO_MBEDTLS_CRYPTO_EC
++#endif /* crypto_ec_*() crypto_ec_key_*() */
++
++#if defined(CONFIG_DPP) /* CONFIG_DPP=y */
++#define CRYPTO_MBEDTLS_CRYPTO_EC_DPP /* extra for DPP */
++#define CRYPTO_MBEDTLS_CRYPTO_CSR
++#endif /* crypto_csr_*() */
++
++#if defined(CONFIG_DPP3) /* CONFIG_DPP3=y */
++#define CRYPTO_MBEDTLS_CRYPTO_HPKE
++#endif
++
++#if defined(CONFIG_DPP2) /* CONFIG_DPP2=y */
++#define CRYPTO_MBEDTLS_CRYPTO_PKCS7
++#endif /* crypto_pkcs7_*() */
++
++#if defined(EAP_SIM) || defined(EAP_SIM_DYNAMIC) || defined(EAP_SERVER_SIM) \
++ || defined(EAP_AKA) || defined(EAP_AKA_DYNAMIC) || defined(EAP_SERVER_AKA) \
++ || defined(CONFIG_AP) || defined(HOSTAPD)
++/* CONFIG_EAP_SIM=y CONFIG_EAP_AKA=y CONFIG_AP=y HOSTAPD */
++#if defined(CRYPTO_RSA_OAEP_SHA256)
++#define CRYPTO_MBEDTLS_CRYPTO_RSA
++#endif
++#endif /* crypto_rsa_*() */
++
++
++static int ctr_drbg_init_state;
++static mbedtls_ctr_drbg_context ctr_drbg;
++static mbedtls_entropy_context entropy;
++
++#ifdef CRYPTO_MBEDTLS_CRYPTO_BIGNUM
++#include <mbedtls/bignum.h>
++static mbedtls_mpi mpi_sw_A;
++#endif
++
++__attribute_cold__
++__attribute_noinline__
++static mbedtls_ctr_drbg_context * ctr_drbg_init(void)
++{
++	mbedtls_ctr_drbg_init(&ctr_drbg);
++	mbedtls_entropy_init(&entropy);
++	if (mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy,
++	                          NULL, 0)) {
++		wpa_printf(MSG_ERROR, "Init of random number generator failed");
++		/* XXX: abort? */
++	}
++	else
++		ctr_drbg_init_state = 1;
++
++	return &ctr_drbg;
++}
++
++__attribute_cold__
++void crypto_unload(void)
++{
++	if (ctr_drbg_init_state) {
++		mbedtls_ctr_drbg_free(&ctr_drbg);
++		mbedtls_entropy_free(&entropy);
++	  #ifdef CRYPTO_MBEDTLS_CRYPTO_BIGNUM
++		mbedtls_mpi_free(&mpi_sw_A);
++	  #endif
++		ctr_drbg_init_state = 0;
++	}
++}
++
++/* init ctr_drbg on first use
++ * crypto_global_init() and crypto_global_deinit() are not available here
++ * (available only when CONFIG_TLS=internal, which is not CONFIG_TLS=mbedtls) */
++mbedtls_ctr_drbg_context * crypto_mbedtls_ctr_drbg(void); /*(not in header)*/
++inline
++mbedtls_ctr_drbg_context * crypto_mbedtls_ctr_drbg(void)
++{
++	return ctr_drbg_init_state ? &ctr_drbg : ctr_drbg_init();
++}
++
++#ifdef CRYPTO_MBEDTLS_CONFIG_FIPS
++int crypto_get_random(void *buf, size_t len)
++{
++	return mbedtls_ctr_drbg_random(crypto_mbedtls_ctr_drbg(),buf,len) ? -1 : 0;
++}
++#endif
++
++
++#if 1
++
++/* tradeoff: slightly smaller code size here at cost of slight increase
++ * in instructions and function calls at runtime versus the expanded
++ * per-message-digest code that follows in #else (~0.5 kib .text larger) */
++
++__attribute_noinline__
++static int md_vector(size_t num_elem, const u8 *addr[], const size_t *len,
++                     u8 *mac, mbedtls_md_type_t md_type)
++{
++	mbedtls_md_context_t ctx;
++	mbedtls_md_init(&ctx);
++	if (mbedtls_md_setup(&ctx, mbedtls_md_info_from_type(md_type), 0) != 0){
++		mbedtls_md_free(&ctx);
++		return -1;
++	}
++	mbedtls_md_starts(&ctx);
++	for (size_t i = 0; i < num_elem; ++i)
++		mbedtls_md_update(&ctx, addr[i], len[i]);
++	mbedtls_md_finish(&ctx, mac);
++	mbedtls_md_free(&ctx);
++	return 0;
++}
++
++#ifdef MBEDTLS_SHA512_C
++int sha512_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
++{
++	return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_SHA512);
++}
++
++int sha384_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
++{
++	return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_SHA384);
++}
++#endif
++
++#ifdef MBEDTLS_SHA256_C
++int sha256_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
++{
++	return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_SHA256);
++}
++#endif
++
++#ifdef MBEDTLS_SHA1_C
++int sha1_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
++{
++	return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_SHA1);
++}
++#endif
++
++#ifdef MBEDTLS_MD5_C
++int md5_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
++{
++	return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_MD5);
++}
++#endif
++
++#ifdef MBEDTLS_MD4_C
++#include <mbedtls/md4.h>
++int md4_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
++{
++	return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_MD4);
++}
++#endif
++
++#else  /* expanded per-message-digest functions */
++
++#ifdef MBEDTLS_SHA512_C
++#include <mbedtls/sha512.h>
++__attribute_noinline__
++static int sha384_512_vector(size_t num_elem, const u8 *addr[],
++                             const size_t *len, u8 *mac, int is384)
++{
++	struct mbedtls_sha512_context ctx;
++	mbedtls_sha512_init(&ctx);
++  #if MBEDTLS_VERSION_MAJOR >= 3
++	mbedtls_sha512_starts(&ctx, is384);
++	for (size_t i = 0; i < num_elem; ++i)
++		mbedtls_sha512_update(&ctx, addr[i], len[i]);
++	mbedtls_sha512_finish(&ctx, mac);
++  #else
++	mbedtls_sha512_starts_ret(&ctx, is384);
++	for (size_t i = 0; i < num_elem; ++i)
++		mbedtls_sha512_update_ret(&ctx, addr[i], len[i]);
++	mbedtls_sha512_finish_ret(&ctx, mac);
++  #endif
++	mbedtls_sha512_free(&ctx);
++	return 0;
++}
++
++int sha512_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
++{
++	return sha384_512_vector(num_elem, addr, len, mac, 0);
++}
++
++int sha384_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
++{
++	return sha384_512_vector(num_elem, addr, len, mac, 1);
++}
++#endif
++
++#ifdef MBEDTLS_SHA256_C
++#include <mbedtls/sha256.h>
++int sha256_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
++{
++	struct mbedtls_sha256_context ctx;
++	mbedtls_sha256_init(&ctx);
++  #if MBEDTLS_VERSION_MAJOR >= 3
++	mbedtls_sha256_starts(&ctx, 0);
++	for (size_t i = 0; i < num_elem; ++i)
++		mbedtls_sha256_update(&ctx, addr[i], len[i]);
++	mbedtls_sha256_finish(&ctx, mac);
++  #else
++	mbedtls_sha256_starts_ret(&ctx, 0);
++	for (size_t i = 0; i < num_elem; ++i)
++		mbedtls_sha256_update_ret(&ctx, addr[i], len[i]);
++	mbedtls_sha256_finish_ret(&ctx, mac);
++  #endif
++	mbedtls_sha256_free(&ctx);
++	return 0;
++}
++#endif
++
++#ifdef MBEDTLS_SHA1_C
++#include <mbedtls/sha1.h>
++int sha1_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
++{
++	struct mbedtls_sha1_context ctx;
++	mbedtls_sha1_init(&ctx);
++  #if MBEDTLS_VERSION_MAJOR >= 3
++	mbedtls_sha1_starts(&ctx);
++	for (size_t i = 0; i < num_elem; ++i)
++		mbedtls_sha1_update(&ctx, addr[i], len[i]);
++	mbedtls_sha1_finish(&ctx, mac);
++  #else
++	mbedtls_sha1_starts_ret(&ctx);
++	for (size_t i = 0; i < num_elem; ++i)
++		mbedtls_sha1_update_ret(&ctx, addr[i], len[i]);
++	mbedtls_sha1_finish_ret(&ctx, mac);
++  #endif
++	mbedtls_sha1_free(&ctx);
++	return 0;
++}
++#endif
++
++#ifdef MBEDTLS_MD5_C
++#include <mbedtls/md5.h>
++int md5_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
++{
++	struct mbedtls_md5_context ctx;
++	mbedtls_md5_init(&ctx);
++  #if MBEDTLS_VERSION_MAJOR >= 3
++	mbedtls_md5_starts(&ctx);
++	for (size_t i = 0; i < num_elem; ++i)
++		mbedtls_md5_update(&ctx, addr[i], len[i]);
++	mbedtls_md5_finish(&ctx, mac);
++  #else
++	mbedtls_md5_starts_ret(&ctx);
++	for (size_t i = 0; i < num_elem; ++i)
++		mbedtls_md5_update_ret(&ctx, addr[i], len[i]);
++	mbedtls_md5_finish_ret(&ctx, mac);
++  #endif
++	mbedtls_md5_free(&ctx);
++	return 0;
++}
++#endif
++
++#ifdef MBEDTLS_MD4_C
++#include <mbedtls/md4.h>
++int md4_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
++{
++	struct mbedtls_md4_context ctx;
++	mbedtls_md4_init(&ctx);
++	mbedtls_md4_starts_ret(&ctx);
++	for (size_t i = 0; i < num_elem; ++i)
++		mbedtls_md4_update_ret(&ctx, addr[i], len[i]);
++	mbedtls_md4_finish_ret(&ctx, mac);
++	mbedtls_md4_free(&ctx);
++	return 0;
++}
++#endif
++
++#endif /* expanded per-message-digest functions */
++
++
++__attribute_noinline__
++static int hmac_vector(const u8 *key, size_t key_len, size_t num_elem,
++                       const u8 *addr[], const size_t *len, u8 *mac,
++                       mbedtls_md_type_t md_type)
++{
++	mbedtls_md_context_t ctx;
++	mbedtls_md_init(&ctx);
++	if (mbedtls_md_setup(&ctx, mbedtls_md_info_from_type(md_type), 1) != 0){
++		mbedtls_md_free(&ctx);
++		return -1;
++	}
++	mbedtls_md_hmac_starts(&ctx, key, key_len);
++	for (size_t i = 0; i < num_elem; ++i)
++		mbedtls_md_hmac_update(&ctx, addr[i], len[i]);
++	mbedtls_md_hmac_finish(&ctx, mac);
++	mbedtls_md_free(&ctx);
++	return 0;
++}
++
++#ifdef MBEDTLS_SHA512_C
++int hmac_sha512_vector(const u8 *key, size_t key_len, size_t num_elem,
++                       const u8 *addr[], const size_t *len, u8 *mac)
++{
++	return hmac_vector(key, key_len, num_elem, addr, len, mac,
++			   MBEDTLS_MD_SHA512);
++}
++
++int hmac_sha512(const u8 *key, size_t key_len, const u8 *data, size_t data_len,
++                u8 *mac)
++{
++	return hmac_vector(key, key_len, 1, &data, &data_len, mac,
++			   MBEDTLS_MD_SHA512);
++}
++
++int hmac_sha384_vector(const u8 *key, size_t key_len, size_t num_elem,
++                       const u8 *addr[], const size_t *len, u8 *mac)
++{
++	return hmac_vector(key, key_len, num_elem, addr, len, mac,
++			   MBEDTLS_MD_SHA384);
++}
++
++int hmac_sha384(const u8 *key, size_t key_len, const u8 *data, size_t data_len,
++                u8 *mac)
++{
++	return hmac_vector(key, key_len, 1, &data, &data_len, mac,
++			   MBEDTLS_MD_SHA384);
++}
++#endif
++
++#ifdef MBEDTLS_SHA256_C
++int hmac_sha256_vector(const u8 *key, size_t key_len, size_t num_elem,
++                       const u8 *addr[], const size_t *len, u8 *mac)
++{
++	return hmac_vector(key, key_len, num_elem, addr, len, mac,
++			   MBEDTLS_MD_SHA256);
++}
++
++int hmac_sha256(const u8 *key, size_t key_len, const u8 *data, size_t data_len,
++                u8 *mac)
++{
++	return hmac_vector(key, key_len, 1, &data, &data_len, mac,
++			   MBEDTLS_MD_SHA256);
++}
++#endif
++
++#ifdef MBEDTLS_SHA1_C
++int hmac_sha1_vector(const u8 *key, size_t key_len, size_t num_elem,
++                     const u8 *addr[], const size_t *len, u8 *mac)
++{
++	return hmac_vector(key, key_len, num_elem, addr, len, mac,
++			   MBEDTLS_MD_SHA1);
++}
++
++int hmac_sha1(const u8 *key, size_t key_len, const u8 *data, size_t data_len,
++              u8 *mac)
++{
++	return hmac_vector(key, key_len, 1, &data, &data_len, mac,
++			   MBEDTLS_MD_SHA1);
++}
++#endif
++
++#ifdef MBEDTLS_MD5_C
++int hmac_md5_vector(const u8 *key, size_t key_len, size_t num_elem,
++                    const u8 *addr[], const size_t *len, u8 *mac)
++{
++	return hmac_vector(key, key_len, num_elem, addr, len, mac,
++			   MBEDTLS_MD_MD5);
++}
++
++int hmac_md5(const u8 *key, size_t key_len, const u8 *data, size_t data_len,
++             u8 *mac)
++{
++	return hmac_vector(key, key_len, 1, &data, &data_len, mac,
++			   MBEDTLS_MD_MD5);
++}
++#endif
++
++
++#if defined(MBEDTLS_SHA256_C) || defined(MBEDTLS_SHA512_C)
++
++#if defined(CRYPTO_MBEDTLS_HMAC_KDF_SHA256) \
++ || defined(CRYPTO_MBEDTLS_HMAC_KDF_SHA384) \
++ || defined(CRYPTO_MBEDTLS_HMAC_KDF_SHA512)
++
++#include <mbedtls/hkdf.h>
++
++/* sha256-kdf.c sha384-kdf.c sha512-kdf.c */
++
++/* HMAC-SHA256 KDF (RFC 5295) and HKDF-Expand(SHA256) (RFC 5869) */
++/* HMAC-SHA384 KDF (RFC 5295) and HKDF-Expand(SHA384) (RFC 5869) */
++/* HMAC-SHA512 KDF (RFC 5295) and HKDF-Expand(SHA512) (RFC 5869) */
++__attribute_noinline__
++static int hmac_kdf_expand(const u8 *prk, size_t prk_len,
++                           const char *label, const u8 *info, size_t info_len,
++                           u8 *okm, size_t okm_len, mbedtls_md_type_t md_type)
++{
++	const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type(md_type);
++  #ifdef MBEDTLS_HKDF_C
++	if (label == NULL)  /* RFC 5869 HKDF-Expand when (label == NULL) */
++		return mbedtls_hkdf_expand(md_info, prk, prk_len, info,
++		                           info_len, okm, okm_len) ? -1 : 0;
++  #endif
++
++	const size_t mac_len = mbedtls_md_get_size(md_info);
++	/* okm_len must not exceed 255 times hash len (RFC 5869 Section 2.3) */
++	if (okm_len > ((mac_len << 8) - mac_len))
++		return -1;
++
++	mbedtls_md_context_t ctx;
++	mbedtls_md_init(&ctx);
++	if (mbedtls_md_setup(&ctx, md_info, 1) != 0) {
++		mbedtls_md_free(&ctx);
++		return -1;
++	}
++	mbedtls_md_hmac_starts(&ctx, prk, prk_len);
++
++	u8 iter = 1;
++	const u8 *addr[4] = { okm, (const u8 *)label, info, &iter };
++	size_t len[4] = { 0, label ? os_strlen(label)+1 : 0, info_len, 1 };
++
++	for (; okm_len >= mac_len; okm_len -= mac_len, ++iter) {
++		for (size_t i = 0; i < ARRAY_SIZE(addr); ++i)
++			mbedtls_md_hmac_update(&ctx, addr[i], len[i]);
++		mbedtls_md_hmac_finish(&ctx, okm);
++		mbedtls_md_hmac_reset(&ctx);
++		addr[0] = okm;
++		okm += mac_len;
++		len[0] = mac_len; /*(include digest in subsequent rounds)*/
++	}
++
++	if (okm_len) {
++		u8 hash[MBEDTLS_MD_MAX_SIZE];
++		for (size_t i = 0; i < ARRAY_SIZE(addr); ++i)
++			mbedtls_md_hmac_update(&ctx, addr[i], len[i]);
++		mbedtls_md_hmac_finish(&ctx, hash);
++		os_memcpy(okm, hash, okm_len);
++		forced_memzero(hash, mac_len);
++	}
++
++	mbedtls_md_free(&ctx);
++	return 0;
++}
++
++#ifdef MBEDTLS_SHA512_C
++#ifdef CRYPTO_MBEDTLS_HMAC_KDF_SHA512
++int hmac_sha512_kdf(const u8 *secret, size_t secret_len,
++		    const char *label, const u8 *seed, size_t seed_len,
++		    u8 *out, size_t outlen)
++{
++	return hmac_kdf_expand(secret, secret_len, label, seed, seed_len,
++	                       out, outlen, MBEDTLS_MD_SHA512);
++}
++#endif
++
++#ifdef CRYPTO_MBEDTLS_HMAC_KDF_SHA384
++int hmac_sha384_kdf(const u8 *secret, size_t secret_len,
++		    const char *label, const u8 *seed, size_t seed_len,
++		    u8 *out, size_t outlen)
++{
++	return hmac_kdf_expand(secret, secret_len, label, seed, seed_len,
++	                       out, outlen, MBEDTLS_MD_SHA384);
++}
++#endif
++#endif
++
++#ifdef MBEDTLS_SHA256_C
++#ifdef CRYPTO_MBEDTLS_HMAC_KDF_SHA256
++int hmac_sha256_kdf(const u8 *secret, size_t secret_len,
++		    const char *label, const u8 *seed, size_t seed_len,
++		    u8 *out, size_t outlen)
++{
++	return hmac_kdf_expand(secret, secret_len, label, seed, seed_len,
++	                       out, outlen, MBEDTLS_MD_SHA256);
++}
++#endif
++#endif
++
++#endif /* CRYPTO_MBEDTLS_HMAC_KDF_* */
++
++
++/* sha256-prf.c sha384-prf.c sha512-prf.c */
++
++/* hmac_prf_bits - IEEE Std 802.11ac-2013, 11.6.1.7.2 Key derivation function */
++__attribute_noinline__
++static int hmac_prf_bits(const u8 *key, size_t key_len, const char *label,
++                         const u8 *data, size_t data_len, u8 *buf,
++                         size_t buf_len_bits, mbedtls_md_type_t md_type)
++{
++	mbedtls_md_context_t ctx;
++	mbedtls_md_init(&ctx);
++	const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type(md_type);
++	if (mbedtls_md_setup(&ctx, md_info, 1) != 0) {
++		mbedtls_md_free(&ctx);
++		return -1;
++	}
++	mbedtls_md_hmac_starts(&ctx, key, key_len);
++
++	u16 ctr, n_le = host_to_le16(buf_len_bits);
++	const u8 * const addr[] = { (u8 *)&ctr,(u8 *)label,data,(u8 *)&n_le };
++	const size_t len[] =      { 2, os_strlen(label), data_len, 2 };
++	const size_t mac_len = mbedtls_md_get_size(md_info);
++	size_t buf_len = (buf_len_bits + 7) / 8;
++	for (ctr = 1; buf_len >= mac_len; buf_len -= mac_len, ++ctr) {
++	  #if __BYTE_ORDER == __BIG_ENDIAN
++		ctr = host_to_le16(ctr);
++	  #endif
++		for (size_t i = 0; i < ARRAY_SIZE(addr); ++i)
++			mbedtls_md_hmac_update(&ctx, addr[i], len[i]);
++		mbedtls_md_hmac_finish(&ctx, buf);
++		mbedtls_md_hmac_reset(&ctx);
++		buf += mac_len;
++	  #if __BYTE_ORDER == __BIG_ENDIAN
++		ctr = le_to_host16(ctr);
++	  #endif
++	}
++
++	if (buf_len) {
++		u8 hash[MBEDTLS_MD_MAX_SIZE];
++	  #if __BYTE_ORDER == __BIG_ENDIAN
++		ctr = host_to_le16(ctr);
++	  #endif
++		for (size_t i = 0; i < ARRAY_SIZE(addr); ++i)
++			mbedtls_md_hmac_update(&ctx, addr[i], len[i]);
++		mbedtls_md_hmac_finish(&ctx, hash);
++		os_memcpy(buf, hash, buf_len);
++		buf += buf_len;
++		forced_memzero(hash, mac_len);
++	}
++
++	/* Mask out unused bits in last octet if it does not use all the bits */
++	if ((buf_len_bits &= 0x7))
++		buf[-1] &= (u8)(0xff << (8 - buf_len_bits));
++
++	mbedtls_md_free(&ctx);
++	return 0;
++}
++
++#ifdef MBEDTLS_SHA512_C
++int sha512_prf(const u8 *key, size_t key_len, const char *label,
++               const u8 *data, size_t data_len, u8 *buf, size_t buf_len)
++{
++	return hmac_prf_bits(key, key_len, label, data, data_len, buf,
++	                     buf_len * 8, MBEDTLS_MD_SHA512);
++}
++
++int sha384_prf(const u8 *key, size_t key_len, const char *label,
++               const u8 *data, size_t data_len, u8 *buf, size_t buf_len)
++{
++	return hmac_prf_bits(key, key_len, label, data, data_len, buf,
++	                     buf_len * 8, MBEDTLS_MD_SHA384);
++}
++#endif
++
++#ifdef MBEDTLS_SHA256_C
++int sha256_prf(const u8 *key, size_t key_len, const char *label,
++               const u8 *data, size_t data_len, u8 *buf, size_t buf_len)
++{
++	return hmac_prf_bits(key, key_len, label, data, data_len, buf,
++	                     buf_len * 8, MBEDTLS_MD_SHA256);
++}
++
++int sha256_prf_bits(const u8 *key, size_t key_len, const char *label,
++                    const u8 *data, size_t data_len, u8 *buf,
++                    size_t buf_len_bits)
++{
++	return hmac_prf_bits(key, key_len, label, data, data_len, buf,
++	                     buf_len_bits, MBEDTLS_MD_SHA256);
++}
++#endif
++
++#endif /* MBEDTLS_SHA256_C || MBEDTLS_SHA512_C */
++
++
++#ifdef MBEDTLS_SHA1_C
++
++/* sha1-prf.c */
++
++/* sha1_prf - SHA1-based Pseudo-Random Function (PRF) (IEEE 802.11i, 8.5.1.1) */
++
++int sha1_prf(const u8 *key, size_t key_len, const char *label,
++	     const u8 *data, size_t data_len, u8 *buf, size_t buf_len)
++{
++	/*(note: algorithm differs from hmac_prf_bits() */
++	/*(note: smaller code size instead of expanding hmac_sha1_vector()
++	 * as is done in hmac_prf_bits(); not expecting large num of loops) */
++	u8 counter = 0;
++	const u8 *addr[] = { (u8 *)label, data, &counter };
++	const size_t len[] = { os_strlen(label)+1, data_len, 1 };
++
++	for (; buf_len >= SHA1_MAC_LEN; buf_len -= SHA1_MAC_LEN, ++counter) {
++		if (hmac_sha1_vector(key, key_len, 3, addr, len, buf))
++			return -1;
++		buf += SHA1_MAC_LEN;
++	}
++
++	if (buf_len) {
++		u8 hash[SHA1_MAC_LEN];
++		if (hmac_sha1_vector(key, key_len, 3, addr, len, hash))
++			return -1;
++		os_memcpy(buf, hash, buf_len);
++		forced_memzero(hash, sizeof(hash));
++	}
++
++	return 0;
++}
++
++#ifdef CRYPTO_MBEDTLS_SHA1_T_PRF
++
++/* sha1-tprf.c */
++
++/* sha1_t_prf - EAP-FAST Pseudo-Random Function (T-PRF) (RFC 4851,Section 5.5)*/
++
++int sha1_t_prf(const u8 *key, size_t key_len, const char *label,
++	       const u8 *seed, size_t seed_len, u8 *buf, size_t buf_len)
++{
++	/*(note: algorithm differs from hmac_prf_bits() and hmac_kdf() above)*/
++	/*(note: smaller code size instead of expanding hmac_sha1_vector()
++	 * as is done in hmac_prf_bits(); not expecting large num of loops) */
++	u8 ctr;
++	u16 olen = host_to_be16(buf_len);
++	const u8 *addr[] = { buf, (u8 *)label, seed, (u8 *)&olen, &ctr };
++	size_t len[] = { 0, os_strlen(label)+1, seed_len, 2, 1 };
++
++	for (ctr = 1; buf_len >= SHA1_MAC_LEN; buf_len -= SHA1_MAC_LEN, ++ctr) {
++		if (hmac_sha1_vector(key, key_len, 5, addr, len, buf))
++			return -1;
++		addr[0] = buf;
++		buf += SHA1_MAC_LEN;
++		len[0] = SHA1_MAC_LEN; /*(include digest in subsequent rounds)*/
++	}
++
++	if (buf_len) {
++		u8 hash[SHA1_MAC_LEN];
++		if (hmac_sha1_vector(key, key_len, 5, addr, len, hash))
++			return -1;
++		os_memcpy(buf, hash, buf_len);
++		forced_memzero(hash, sizeof(hash));
++	}
++
++	return 0;
++}
++
++#endif /* CRYPTO_MBEDTLS_SHA1_T_PRF */
++
++#endif /* MBEDTLS_SHA1_C */
++
++
++#ifdef CRYPTO_MBEDTLS_DES_ENCRYPT
++#ifdef MBEDTLS_DES_C
++#include <mbedtls/des.h>
++int des_encrypt(const u8 *clear, const u8 *key, u8 *cypher)
++{
++	u8 pkey[8], next, tmp;
++	int i;
++
++	/* Add parity bits to the key */
++	next = 0;
++	for (i = 0; i < 7; i++) {
++		tmp = key[i];
++		pkey[i] = (tmp >> i) | next | 1;
++		next = tmp << (7 - i);
++	}
++	pkey[i] = next | 1;
++
++	mbedtls_des_context des;
++	mbedtls_des_init(&des);
++	int ret = mbedtls_des_setkey_enc(&des, pkey)
++	       || mbedtls_des_crypt_ecb(&des, clear, cypher) ? -1 : 0;
++	mbedtls_des_free(&des);
++	return ret;
++}
++#else
++#include "des-internal.c"/* pull in hostap local implementation */
++#endif
++#endif
++
++
++#ifdef CRYPTO_MBEDTLS_PBKDF2_SHA1
++/* sha1-pbkdf2.c */
++#include <mbedtls/pkcs5.h>
++int pbkdf2_sha1(const char *passphrase, const u8 *ssid, size_t ssid_len,
++                int iterations, u8 *buf, size_t buflen)
++{
++  #if MBEDTLS_VERSION_NUMBER >= 0x03020200 /* mbedtls 3.2.2 */
++	return mbedtls_pkcs5_pbkdf2_hmac_ext(MBEDTLS_MD_SHA1,
++			(const u8 *)passphrase, os_strlen(passphrase),
++			ssid, ssid_len, iterations, 32, buf) ? -1 : 0;
++  #else
++	const mbedtls_md_info_t *md_info;
++	md_info = mbedtls_md_info_from_type(MBEDTLS_MD_SHA1);
++	if (md_info == NULL)
++		return -1;
++	mbedtls_md_context_t ctx;
++	mbedtls_md_init(&ctx);
++	int ret = mbedtls_md_setup(&ctx, md_info, 1)
++	       || mbedtls_pkcs5_pbkdf2_hmac(&ctx,
++			(const u8 *)passphrase, os_strlen(passphrase),
++			ssid, ssid_len, iterations, 32, buf) ? -1 : 0;
++	mbedtls_md_free(&ctx);
++	return ret;
++  #endif
++}
++#endif
++
++
++/*#include "aes.h"*/ /* prototypes also included in "crypto.h" */
++
++static void *aes_crypt_init_mode(const u8 *key, size_t len, int mode)
++{
++	mbedtls_aes_context *aes = os_malloc(sizeof(*aes));
++	if (!aes)
++		return NULL;
++
++	mbedtls_aes_init(aes);
++	if ((mode == MBEDTLS_AES_ENCRYPT
++	    ? mbedtls_aes_setkey_enc(aes, key, len * 8)
++	    : mbedtls_aes_setkey_dec(aes, key, len * 8)) == 0)
++		return aes;
++
++	mbedtls_aes_free(aes);
++	os_free(aes);
++	return NULL;
++}
++
++void *aes_encrypt_init(const u8 *key, size_t len)
++{
++	return aes_crypt_init_mode(key, len, MBEDTLS_AES_ENCRYPT);
++}
++
++int aes_encrypt(void *ctx, const u8 *plain, u8 *crypt)
++{
++	return mbedtls_aes_crypt_ecb(ctx, MBEDTLS_AES_ENCRYPT, plain, crypt);
++}
++
++void aes_encrypt_deinit(void *ctx)
++{
++	mbedtls_aes_free(ctx);
++	os_free(ctx);
++}
++
++void *aes_decrypt_init(const u8 *key, size_t len)
++{
++	return aes_crypt_init_mode(key, len, MBEDTLS_AES_DECRYPT);
++}
++
++int aes_decrypt(void *ctx, const u8 *crypt, u8 *plain)
++{
++	return mbedtls_aes_crypt_ecb(ctx, MBEDTLS_AES_DECRYPT, crypt, plain);
++}
++
++void aes_decrypt_deinit(void *ctx)
++{
++	mbedtls_aes_free(ctx);
++	os_free(ctx);
++}
++
++
++#include "aes_wrap.h"
++
++
++#ifdef MBEDTLS_NIST_KW_C
++
++#include <mbedtls/nist_kw.h>
++
++/* aes-wrap.c */
++int aes_wrap(const u8 *kek, size_t kek_len, int n, const u8 *plain, u8 *cipher)
++{
++	mbedtls_nist_kw_context ctx;
++	mbedtls_nist_kw_init(&ctx);
++	size_t olen;
++	int ret = mbedtls_nist_kw_setkey(&ctx, MBEDTLS_CIPHER_ID_AES,
++	                                 kek, kek_len*8, 1)
++	       || mbedtls_nist_kw_wrap(&ctx, MBEDTLS_KW_MODE_KW, plain, n*8,
++	                               cipher, &olen, (n+1)*8) ? -1 : 0;
++	mbedtls_nist_kw_free(&ctx);
++	return ret;
++}
++
++/* aes-unwrap.c */
++int aes_unwrap(const u8 *kek, size_t kek_len, int n, const u8 *cipher, u8 *plain)
++{
++	mbedtls_nist_kw_context ctx;
++	mbedtls_nist_kw_init(&ctx);
++	size_t olen;
++	int ret = mbedtls_nist_kw_setkey(&ctx, MBEDTLS_CIPHER_ID_AES,
++	                                 kek, kek_len*8, 0)
++	       || mbedtls_nist_kw_unwrap(&ctx, MBEDTLS_KW_MODE_KW, cipher,
++	                                 (n+1)*8, plain, &olen, n*8) ? -1 : 0;
++	mbedtls_nist_kw_free(&ctx);
++	return ret;
++}
++
++#else
++
++#ifndef CRYPTO_MBEDTLS_CONFIG_FIPS
++#include "aes-wrap.c"    /* pull in hostap local implementation */
++#include "aes-unwrap.c"  /* pull in hostap local implementation */
++#endif
++
++#endif /* MBEDTLS_NIST_KW_C */
++
++
++#ifdef MBEDTLS_CMAC_C
++
++/* aes-omac1.c */
++
++#include <mbedtls/cmac.h>
++
++int omac1_aes_vector(
++    const u8 *key, size_t key_len, size_t num_elem, const u8 *addr[],
++    const size_t *len, u8 *mac)
++{
++	mbedtls_cipher_type_t cipher_type;
++	switch (key_len) {
++	case 16: cipher_type = MBEDTLS_CIPHER_AES_128_ECB; break;
++	case 24: cipher_type = MBEDTLS_CIPHER_AES_192_ECB; break;
++	case 32: cipher_type = MBEDTLS_CIPHER_AES_256_ECB; break;
++	default: return -1;
++	}
++	const mbedtls_cipher_info_t *cipher_info;
++	cipher_info = mbedtls_cipher_info_from_type(cipher_type);
++	if (cipher_info == NULL)
++		return -1;
++
++	mbedtls_cipher_context_t ctx;
++	mbedtls_cipher_init(&ctx);
++	int ret = -1;
++	if (mbedtls_cipher_setup(&ctx, cipher_info) == 0
++	    && mbedtls_cipher_cmac_starts(&ctx, key, key_len*8) == 0) {
++		ret = 0;
++		for (size_t i = 0; i < num_elem && ret == 0; ++i)
++			ret = mbedtls_cipher_cmac_update(&ctx, addr[i], len[i]);
++	}
++	if (ret == 0)
++		ret = mbedtls_cipher_cmac_finish(&ctx, mac);
++	mbedtls_cipher_free(&ctx);
++	return ret ? -1 : 0;
++}
++
++int omac1_aes_128_vector(const u8 *key, size_t num_elem,
++			 const u8 *addr[], const size_t *len,
++			 u8 *mac)
++{
++	return omac1_aes_vector(key, 16, num_elem, addr, len, mac);
++}
++
++int omac1_aes_128(const u8 *key, const u8 *data, size_t data_len, u8 *mac)
++{
++	return omac1_aes_vector(key, 16, 1, &data, &data_len, mac);
++}
++
++int omac1_aes_256(const u8 *key, const u8 *data, size_t data_len, u8 *mac)
++{
++	return omac1_aes_vector(key, 32, 1, &data, &data_len, mac);
++}
++
++#else
++
++#include "aes-omac1.c"  /* pull in hostap local implementation */
++
++#ifndef MBEDTLS_AES_BLOCK_SIZE
++#define MBEDTLS_AES_BLOCK_SIZE 16
++#endif
++
++#endif /* MBEDTLS_CMAC_C */
++
++
++/* These interfaces can be inefficient when used in loops, as the overhead of
++ * initialization each call is large for each block input (e.g. 16 bytes) */
++
++
++/* aes-encblock.c */
++int aes_128_encrypt_block(const u8 *key, const u8 *in, u8 *out)
++{
++	mbedtls_aes_context aes;
++	mbedtls_aes_init(&aes);
++	int ret = mbedtls_aes_setkey_enc(&aes, key, 128)
++	       || mbedtls_aes_crypt_ecb(&aes, MBEDTLS_AES_ENCRYPT, in, out)
++	  ? -1
++	  : 0;
++	mbedtls_aes_free(&aes);
++	return ret;
++}
++
++
++/* aes-ctr.c */
++int aes_ctr_encrypt(const u8 *key, size_t key_len, const u8 *nonce,
++		    u8 *data, size_t data_len)
++{
++	unsigned char counter[MBEDTLS_AES_BLOCK_SIZE];
++	unsigned char stream_block[MBEDTLS_AES_BLOCK_SIZE];
++	os_memcpy(counter, nonce, MBEDTLS_AES_BLOCK_SIZE);/*(must be writable)*/
++
++	mbedtls_aes_context ctx;
++	mbedtls_aes_init(&ctx);
++	size_t nc_off = 0;
++	int ret = mbedtls_aes_setkey_enc(&ctx, key, key_len*8)
++	       || mbedtls_aes_crypt_ctr(&ctx, data_len, &nc_off,
++	                                counter, stream_block,
++	                                data, data) ? -1 : 0;
++	forced_memzero(stream_block, sizeof(stream_block));
++	mbedtls_aes_free(&ctx);
++	return ret;
++}
++
++int aes_128_ctr_encrypt(const u8 *key, const u8 *nonce,
++			u8 *data, size_t data_len)
++{
++	return aes_ctr_encrypt(key, 16, nonce, data, data_len);
++}
++
++
++/* aes-cbc.c */
++static int aes_128_cbc_oper(const u8 *key, const u8 *iv,
++                            u8 *data, size_t data_len, int mode)
++{
++	unsigned char ivec[MBEDTLS_AES_BLOCK_SIZE];
++	os_memcpy(ivec, iv, MBEDTLS_AES_BLOCK_SIZE); /*(must be writable)*/
++
++	mbedtls_aes_context ctx;
++	mbedtls_aes_init(&ctx);
++	int ret = (mode == MBEDTLS_AES_ENCRYPT
++	           ? mbedtls_aes_setkey_enc(&ctx, key, 128)
++	           : mbedtls_aes_setkey_dec(&ctx, key, 128))
++	       || mbedtls_aes_crypt_cbc(&ctx, mode, data_len, ivec, data, data);
++	mbedtls_aes_free(&ctx);
++	return ret ? -1 : 0;
++}
++
++int aes_128_cbc_encrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len)
++{
++	return aes_128_cbc_oper(key, iv, data, data_len, MBEDTLS_AES_ENCRYPT);
++}
++
++int aes_128_cbc_decrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len)
++{
++	return aes_128_cbc_oper(key, iv, data, data_len, MBEDTLS_AES_DECRYPT);
++}
++
++
++/*
++ * Much of the following is documented in crypto.h as for CONFIG_TLS=internal
++ * but such comments are not accurate:
++ *
++ * "This function is only used with internal TLSv1 implementation
++ *  (CONFIG_TLS=internal). If that is not used, the crypto wrapper does not need
++ *  to implement this."
++ */
++
++
++#ifdef CRYPTO_MBEDTLS_CRYPTO_CIPHER
++
++#include <mbedtls/cipher.h>
++
++struct crypto_cipher
++{
++	mbedtls_cipher_context_t ctx_enc;
++	mbedtls_cipher_context_t ctx_dec;
++};
++
++struct crypto_cipher * crypto_cipher_init(enum crypto_cipher_alg alg,
++					  const u8 *iv, const u8 *key,
++					  size_t key_len)
++{
++	/* IKEv2 src/eap_common/ikev2_common.c:ikev2_{encr,decr}_encrypt()
++	 * uses one of CRYPTO_CIPHER_ALG_AES or CRYPTO_CIPHER_ALG_3DES */
++
++	mbedtls_cipher_type_t cipher_type;
++	size_t iv_len;
++	switch (alg) {
++  #ifdef MBEDTLS_ARC4_C
++  #if 0
++	case CRYPTO_CIPHER_ALG_RC4:
++		cipher_type = MBEDTLS_CIPHER_ARC4_128;
++		iv_len = 0;
++		break;
++  #endif
++  #endif
++  #ifdef MBEDTLS_AES_C
++	case CRYPTO_CIPHER_ALG_AES:
++		if (key_len == 16) cipher_type = MBEDTLS_CIPHER_AES_128_CTR;
++		if (key_len == 24) cipher_type = MBEDTLS_CIPHER_AES_192_CTR;
++		if (key_len == 32) cipher_type = MBEDTLS_CIPHER_AES_256_CTR;
++		iv_len = 16;
++		break;
++  #endif
++  #ifdef MBEDTLS_DES_C
++	case CRYPTO_CIPHER_ALG_3DES:
++		cipher_type = MBEDTLS_CIPHER_DES_EDE3_CBC;
++		iv_len = 8;
++		break;
++  #if 0
++	case CRYPTO_CIPHER_ALG_DES:
++		cipher_type = MBEDTLS_CIPHER_DES_CBC;
++		iv_len = 8;
++		break;
++  #endif
++  #endif
++	default:
++		return NULL;
++	}
++
++	const mbedtls_cipher_info_t *cipher_info;
++	cipher_info = mbedtls_cipher_info_from_type(cipher_type);
++	if (cipher_info == NULL)
++		return NULL;
++
++	key_len *= 8; /* key_bitlen */
++  #if 0 /*(were key_bitlen not already available)*/
++  #if MBEDTLS_VERSION_NUMBER >= 0x03010000 /* mbedtls 3.1.0 */
++	key_len = mbedtls_cipher_info_get_key_bitlen(cipher_info);
++  #else
++	key_len = cipher_info->MBEDTLS_PRIVATE(key_bitlen);
++  #endif
++  #endif
++
++  #if 0 /*(were iv_len not known above, would need MBEDTLS_PRIVATE(iv_size))*/
++	iv_len = cipher_info->MBEDTLS_PRIVATE(iv_size);
++  #endif
++
++	struct crypto_cipher *ctx = os_malloc(sizeof(*ctx));
++	if (!ctx)
++		return NULL;
++
++	mbedtls_cipher_init(&ctx->ctx_enc);
++	mbedtls_cipher_init(&ctx->ctx_dec);
++	if (   mbedtls_cipher_setup(&ctx->ctx_enc,cipher_info) == 0
++	    && mbedtls_cipher_setup(&ctx->ctx_dec,cipher_info) == 0
++	    && mbedtls_cipher_setkey(&ctx->ctx_enc,key,key_len,MBEDTLS_ENCRYPT) == 0
++	    && mbedtls_cipher_setkey(&ctx->ctx_dec,key,key_len,MBEDTLS_DECRYPT) == 0
++	    && mbedtls_cipher_set_iv(&ctx->ctx_enc,iv,iv_len) == 0
++	    && mbedtls_cipher_set_iv(&ctx->ctx_dec,iv,iv_len) == 0
++	    && mbedtls_cipher_reset(&ctx->ctx_enc) == 0
++	    && mbedtls_cipher_reset(&ctx->ctx_dec) == 0) {
++		return ctx;
++	}
++
++	mbedtls_cipher_free(&ctx->ctx_enc);
++	mbedtls_cipher_free(&ctx->ctx_dec);
++	os_free(ctx);
++	return NULL;
++}
++
++int crypto_cipher_encrypt(struct crypto_cipher *ctx,
++			  const u8 *plain, u8 *crypt, size_t len)
++{
++	size_t olen = 0; /*(poor interface above; unknown size of u8 *crypt)*/
++	return (mbedtls_cipher_update(&ctx->ctx_enc, plain, len, crypt, &olen)
++	        || mbedtls_cipher_finish(&ctx->ctx_enc, crypt + olen, &olen)) ? -1 : 0;
++}
++
++int crypto_cipher_decrypt(struct crypto_cipher *ctx,
++			  const u8 *crypt, u8 *plain, size_t len)
++{
++	size_t olen = 0; /*(poor interface above; unknown size of u8 *plain)*/
++	return (mbedtls_cipher_update(&ctx->ctx_dec, crypt, len, plain, &olen)
++	        || mbedtls_cipher_finish(&ctx->ctx_dec, plain + olen, &olen)) ? -1 : 0;
++}
++
++void crypto_cipher_deinit(struct crypto_cipher *ctx)
++{
++	mbedtls_cipher_free(&ctx->ctx_enc);
++	mbedtls_cipher_free(&ctx->ctx_dec);
++	os_free(ctx);
++}
++
++#endif /* CRYPTO_MBEDTLS_CRYPTO_CIPHER */
++
++
++#ifdef CRYPTO_MBEDTLS_CRYPTO_HASH
++
++struct crypto_hash * crypto_hash_init(enum crypto_hash_alg alg, const u8 *key,
++				      size_t key_len)
++{
++	mbedtls_md_type_t md_type;
++	int is_hmac = 0;
++
++	switch (alg) {
++  #ifdef MBEDTLS_MD5_C
++	case CRYPTO_HASH_ALG_MD5:
++		md_type = MBEDTLS_MD_MD5;
++		break;
++  #endif
++  #ifdef MBEDTLS_SHA1_C
++	case CRYPTO_HASH_ALG_SHA1:
++		md_type = MBEDTLS_MD_SHA1;
++		break;
++  #endif
++  #ifdef MBEDTLS_MD5_C
++	case CRYPTO_HASH_ALG_HMAC_MD5:
++		md_type = MBEDTLS_MD_MD5;
++		is_hmac = 1;
++		break;
++  #endif
++  #ifdef MBEDTLS_SHA1_C
++	case CRYPTO_HASH_ALG_HMAC_SHA1:
++		md_type = MBEDTLS_MD_SHA1;
++		is_hmac = 1;
++		break;
++  #endif
++  #ifdef MBEDTLS_SHA256_C
++	case CRYPTO_HASH_ALG_SHA256:
++		md_type = MBEDTLS_MD_SHA256;
++		break;
++	case CRYPTO_HASH_ALG_HMAC_SHA256:
++		md_type = MBEDTLS_MD_SHA256;
++		is_hmac = 1;
++		break;
++  #endif
++  #ifdef MBEDTLS_SHA512_C
++	case CRYPTO_HASH_ALG_SHA384:
++		md_type = MBEDTLS_MD_SHA384;
++		break;
++	case CRYPTO_HASH_ALG_SHA512:
++		md_type = MBEDTLS_MD_SHA512;
++		break;
++  #endif
++	default:
++		return NULL;
++	}
++
++	const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type(md_type);
++	if (!md_info)
++		return NULL;
++
++	mbedtls_md_context_t *mctx = os_malloc(sizeof(*mctx));
++	if (mctx == NULL)
++		return NULL;
++
++	mbedtls_md_init(mctx);
++	if (mbedtls_md_setup(mctx, md_info, is_hmac) != 0) {
++		os_free(mctx);
++		return NULL;
++	}
++
++	if (is_hmac)
++		mbedtls_md_hmac_starts(mctx, key, key_len);
++	else
++		mbedtls_md_starts(mctx);
++	return (struct crypto_hash *)((uintptr_t)mctx | is_hmac);
++}
++
++void crypto_hash_update(struct crypto_hash *ctx, const u8 *data, size_t len)
++{
++	mbedtls_md_context_t *mctx = (mbedtls_md_context_t*)((uintptr_t)ctx & ~1uL);
++  #if 0
++	/*(mbedtls_md_hmac_update() and mbedtls_md_update()
++	 * make same modifications under the hood in mbedtls)*/
++	if ((uintptr_t)ctx & 1uL)
++		mbedtls_md_hmac_update(mctx, data, len);
++	else
++  #endif
++		mbedtls_md_update(mctx, data, len);
++}
++
++int crypto_hash_finish(struct crypto_hash *ctx, u8 *mac, size_t *len)
++{
++	mbedtls_md_context_t *mctx = (mbedtls_md_context_t*)((uintptr_t)ctx & ~1uL);
++	if (mac != NULL && len != NULL) { /*(NULL if caller just freeing context)*/
++	  #if MBEDTLS_VERSION_NUMBER >= 0x03020000 /* mbedtls 3.2.0 */
++		const mbedtls_md_info_t *md_info = mbedtls_md_info_from_ctx(mctx);
++	  #else
++		const mbedtls_md_info_t *md_info = mctx->MBEDTLS_PRIVATE(md_info);
++	  #endif
++		size_t maclen = mbedtls_md_get_size(md_info);
++		if (*len < maclen) {
++			*len = maclen;
++			/*(note: ctx not freed; can call again with larger *len)*/
++			return -1;
++		}
++		*len = maclen;
++		if ((uintptr_t)ctx & 1uL)
++			mbedtls_md_hmac_finish(mctx, mac);
++		else
++			mbedtls_md_finish(mctx, mac);
++	}
++	mbedtls_md_free(mctx);
++	os_free(mctx);
++	return 0;
++}
++
++#endif /* CRYPTO_MBEDTLS_CRYPTO_HASH */
++
++
++#ifdef CRYPTO_MBEDTLS_CRYPTO_BIGNUM
++
++#include <mbedtls/bignum.h>
++
++/* crypto.h bignum interfaces */
++
++struct crypto_bignum *crypto_bignum_init(void)
++{
++	mbedtls_mpi *bn = os_malloc(sizeof(*bn));
++	if (bn)
++		mbedtls_mpi_init(bn);
++	return (struct crypto_bignum *)bn;
++}
++
++struct crypto_bignum *crypto_bignum_init_set(const u8 *buf, size_t len)
++{
++	mbedtls_mpi *bn = os_malloc(sizeof(*bn));
++	if (bn) {
++		mbedtls_mpi_init(bn);
++		if (mbedtls_mpi_read_binary(bn, buf, len) == 0)
++			return (struct crypto_bignum *)bn;
++	}
++
++	os_free(bn);
++	return NULL;
++}
++
++struct crypto_bignum *crypto_bignum_init_uint(unsigned int val)
++{
++  #if 0 /*(hostap use of this interface passes int, not uint)*/
++	val = host_to_be32(val);
++	return crypto_bignum_init_set((const u8 *)&val, sizeof(val));
++  #else
++	mbedtls_mpi *bn = os_malloc(sizeof(*bn));
++	if (bn) {
++		mbedtls_mpi_init(bn);
++		if (mbedtls_mpi_lset(bn, (int)val) == 0)
++			return (struct crypto_bignum *)bn;
++	}
++
++	os_free(bn);
++	return NULL;
++  #endif
++}
++
++void crypto_bignum_deinit(struct crypto_bignum *n, int clear)
++{
++	mbedtls_mpi_free((mbedtls_mpi *)n);
++	os_free(n);
++}
++
++int crypto_bignum_to_bin(const struct crypto_bignum *a,
++			 u8 *buf, size_t buflen, size_t padlen)
++{
++	size_t n = mbedtls_mpi_size((mbedtls_mpi *)a);
++	if (n < padlen)
++		n = padlen;
++	return n > buflen || mbedtls_mpi_write_binary((mbedtls_mpi *)a, buf, n)
++	  ? -1
++	  : (int)(n);
++}
++
++int crypto_bignum_rand(struct crypto_bignum *r, const struct crypto_bignum *m)
++{
++	/*assert(r != m);*//* r must not be same as m for mbedtls_mpi_random()*/
++  #if MBEDTLS_VERSION_NUMBER >= 0x021B0000 /* mbedtls 2.27.0 */
++	return mbedtls_mpi_random((mbedtls_mpi *)r, 0, (mbedtls_mpi *)m,
++				  mbedtls_ctr_drbg_random,
++				  crypto_mbedtls_ctr_drbg()) ? -1 : 0;
++  #else
++	/* (needed by EAP_PWD, SAE, DPP) */
++	wpa_printf(MSG_ERROR,
++	           "mbedtls 2.27.0 or later required for mbedtls_mpi_random()");
++	return -1;
++  #endif
++}
++
++int crypto_bignum_add(const struct crypto_bignum *a,
++		      const struct crypto_bignum *b,
++		      struct crypto_bignum *c)
++{
++	return mbedtls_mpi_add_mpi((mbedtls_mpi *)c,
++				   (const mbedtls_mpi *)a,
++				   (const mbedtls_mpi *)b) ? -1 : 0;
++}
++
++int crypto_bignum_mod(const struct crypto_bignum *a,
++		      const struct crypto_bignum *b,
++		      struct crypto_bignum *c)
++{
++	return mbedtls_mpi_mod_mpi((mbedtls_mpi *)c,
++				   (const mbedtls_mpi *)a,
++				   (const mbedtls_mpi *)b) ? -1 : 0;
++}
++
++int crypto_bignum_exptmod(const struct crypto_bignum *a,
++			  const struct crypto_bignum *b,
++			  const struct crypto_bignum *c,
++			  struct crypto_bignum *d)
++{
++	/* (check if input params match d; d is the result) */
++	/* (a == d) is ok in current mbedtls implementation */
++	if (b == d || c == d) { /*(not ok; store result in intermediate)*/
++		mbedtls_mpi R;
++		mbedtls_mpi_init(&R);
++		int rc = mbedtls_mpi_exp_mod(&R,
++		                             (const mbedtls_mpi *)a,
++		                             (const mbedtls_mpi *)b,
++		                             (const mbedtls_mpi *)c,
++		                             NULL)
++		      || mbedtls_mpi_copy((mbedtls_mpi *)d, &R) ? -1 : 0;
++		mbedtls_mpi_free(&R);
++		return rc;
++	}
++	else {
++		return mbedtls_mpi_exp_mod((mbedtls_mpi *)d,
++		                           (const mbedtls_mpi *)a,
++		                           (const mbedtls_mpi *)b,
++		                           (const mbedtls_mpi *)c,
++		                           NULL) ? -1 : 0;
++	}
++}
++
++int crypto_bignum_inverse(const struct crypto_bignum *a,
++			  const struct crypto_bignum *b,
++			  struct crypto_bignum *c)
++{
++	return mbedtls_mpi_inv_mod((mbedtls_mpi *)c,
++				   (const mbedtls_mpi *)a,
++				   (const mbedtls_mpi *)b) ? -1 : 0;
++}
++
++int crypto_bignum_sub(const struct crypto_bignum *a,
++		      const struct crypto_bignum *b,
++		      struct crypto_bignum *c)
++{
++	return mbedtls_mpi_sub_mpi((mbedtls_mpi *)c,
++				   (const mbedtls_mpi *)a,
++				   (const mbedtls_mpi *)b) ? -1 : 0;
++}
++
++int crypto_bignum_div(const struct crypto_bignum *a,
++		      const struct crypto_bignum *b,
++		      struct crypto_bignum *c)
++{
++	/*(most current use of this crypto.h interface has a == c (result),
++	 * so store result in an intermediate to avoid overwritten input)*/
++	mbedtls_mpi R;
++	mbedtls_mpi_init(&R);
++	int rc = mbedtls_mpi_div_mpi(&R, NULL,
++				     (const mbedtls_mpi *)a,
++				     (const mbedtls_mpi *)b)
++	      || mbedtls_mpi_copy((mbedtls_mpi *)c, &R) ? -1 : 0;
++	mbedtls_mpi_free(&R);
++	return rc;
++}
++
++int crypto_bignum_addmod(const struct crypto_bignum *a,
++			 const struct crypto_bignum *b,
++			 const struct crypto_bignum *c,
++			 struct crypto_bignum *d)
++{
++	return mbedtls_mpi_add_mpi((mbedtls_mpi *)d,
++				   (const mbedtls_mpi *)a,
++				   (const mbedtls_mpi *)b)
++	    || mbedtls_mpi_mod_mpi((mbedtls_mpi *)d,
++				   (mbedtls_mpi *)d,
++				   (const mbedtls_mpi *)c) ? -1 : 0;
++}
++
++int crypto_bignum_mulmod(const struct crypto_bignum *a,
++			 const struct crypto_bignum *b,
++			 const struct crypto_bignum *c,
++			 struct crypto_bignum *d)
++{
++	return mbedtls_mpi_mul_mpi((mbedtls_mpi *)d,
++				   (const mbedtls_mpi *)a,
++				   (const mbedtls_mpi *)b)
++	    || mbedtls_mpi_mod_mpi((mbedtls_mpi *)d,
++				   (mbedtls_mpi *)d,
++				   (const mbedtls_mpi *)c) ? -1 : 0;
++}
++
++int crypto_bignum_sqrmod(const struct crypto_bignum *a,
++			 const struct crypto_bignum *b,
++			 struct crypto_bignum *c)
++{
++  #if 1
++	return crypto_bignum_mulmod(a, a, b, c);
++  #else
++	mbedtls_mpi bn;
++	mbedtls_mpi_init(&bn);
++	if (mbedtls_mpi_lset(&bn, 2)) /* alt?: mbedtls_mpi_set_bit(&bn, 1) */
++		return -1;
++	int ret = mbedtls_mpi_exp_mod((mbedtls_mpi *)c,
++				      (const mbedtls_mpi *)a, &bn,
++				      (const mbedtls_mpi *)b, NULL) ? -1 : 0;
++	mbedtls_mpi_free(&bn);
++	return ret;
++  #endif
++}
++
++int crypto_bignum_rshift(const struct crypto_bignum *a, int n,
++			 struct crypto_bignum *r)
++{
++	return mbedtls_mpi_copy((mbedtls_mpi *)r, (const mbedtls_mpi *)a)
++	    || mbedtls_mpi_shift_r((mbedtls_mpi *)r, n) ? -1 : 0;
++}
++
++int crypto_bignum_cmp(const struct crypto_bignum *a,
++		      const struct crypto_bignum *b)
++{
++	return mbedtls_mpi_cmp_mpi((const mbedtls_mpi *)a, (const mbedtls_mpi *)b);
++}
++
++int crypto_bignum_is_zero(const struct crypto_bignum *a)
++{
++	/* XXX: src/common/sae.c:sswu() contains comment:
++	 * "TODO: Make sure crypto_bignum_is_zero() is constant time"
++	 * Note: mbedtls_mpi_cmp_int() *is not* constant time */
++	return (mbedtls_mpi_cmp_int((const mbedtls_mpi *)a, 0) == 0);
++}
++
++int crypto_bignum_is_one(const struct crypto_bignum *a)
++{
++	return (mbedtls_mpi_cmp_int((const mbedtls_mpi *)a, 1) == 0);
++}
++
++int crypto_bignum_is_odd(const struct crypto_bignum *a)
++{
++	return mbedtls_mpi_get_bit((const mbedtls_mpi *)a, 0);
++}
++
++#include "utils/const_time.h"
++int crypto_bignum_legendre(const struct crypto_bignum *a,
++			   const struct crypto_bignum *p)
++{
++	/* Security Note:
++	 * mbedtls_mpi_exp_mod() is not documented to run in constant time,
++	 * though mbedtls/library/bignum.c uses constant_time_internal.h funcs.
++	 * Compare to crypto_openssl.c:crypto_bignum_legendre()
++	 * which uses openssl BN_mod_exp_mont_consttime()
++	 * mbedtls/library/ecp.c has further countermeasures to timing attacks,
++	 * (but ecp.c funcs are not used here) */
++
++	mbedtls_mpi exp, tmp;
++	mbedtls_mpi_init(&exp);
++	mbedtls_mpi_init(&tmp);
++
++	/* exp = (p-1) / 2 */
++	int res;
++	if (mbedtls_mpi_sub_int(&exp, (const mbedtls_mpi *)p, 1) == 0
++	    && mbedtls_mpi_shift_r(&exp, 1) == 0
++	    && mbedtls_mpi_exp_mod(&tmp, (const mbedtls_mpi *)a, &exp,
++	                           (const mbedtls_mpi *)p, NULL) == 0) {
++		/*(modified from crypto_openssl.c:crypto_bignum_legendre())*/
++		/* Return 1 if tmp == 1, 0 if tmp == 0, or -1 otherwise. Need
++		 * to use constant time selection to avoid branches here. */
++		unsigned int mask;
++		res = -1;
++		mask = const_time_eq((mbedtls_mpi_cmp_int(&tmp, 1) == 0), 1);
++		res = const_time_select_int(mask, 1, res);
++		mask = const_time_eq((mbedtls_mpi_cmp_int(&tmp, 0) == 0), 1);
++		res = const_time_select_int(mask, 0, res);
++	} else {
++		res = -2;
++	}
++
++	mbedtls_mpi_free(&tmp);
++	mbedtls_mpi_free(&exp);
++	return res;
++}
++
++#endif /* CRYPTO_MBEDTLS_CRYPTO_BIGNUM */
++
++
++#ifdef CRYPTO_MBEDTLS_CRYPTO_DH
++
++/* crypto_internal-modexp.c */
++
++#include <mbedtls/bignum.h>
++#include <mbedtls/dhm.h>
++
++#if 0 /* crypto_dh_init() and crypto_dh_derive_secret() prefer to use mbedtls */
++int crypto_mod_exp(const u8 *base, size_t base_len,
++		   const u8 *power, size_t power_len,
++		   const u8 *modulus, size_t modulus_len,
++		   u8 *result, size_t *result_len)
++{
++	mbedtls_mpi bn_base, bn_exp, bn_modulus, bn_result;
++	mbedtls_mpi_init(&bn_base);
++	mbedtls_mpi_init(&bn_exp);
++	mbedtls_mpi_init(&bn_modulus);
++	mbedtls_mpi_init(&bn_result);
++
++	size_t len;
++	int ret =  mbedtls_mpi_read_binary(&bn_base, base, base_len)
++	        || mbedtls_mpi_read_binary(&bn_exp, power, power_len)
++	        || mbedtls_mpi_read_binary(&bn_modulus, modulus, modulus_len)
++	        || mbedtls_mpi_exp_mod(&bn_result,&bn_base,&bn_exp,&bn_modulus,NULL)
++	        || (len = mbedtls_mpi_size(&bn_result)) > *result_len
++	        || mbedtls_mpi_write_binary(&bn_result, result, (*result_len = len))
++	  ? -1
++	  : 0;
++
++	mbedtls_mpi_free(&bn_base);
++	mbedtls_mpi_free(&bn_exp);
++	mbedtls_mpi_free(&bn_modulus);
++	mbedtls_mpi_free(&bn_result);
++	return ret;
++}
++#endif
++
++static int crypto_mbedtls_dh_set_bin_pg(mbedtls_dhm_context *ctx, u8 generator,
++                                        const u8 *prime, size_t prime_len)
++{
++	/*(could set these directly in MBEDTLS_PRIVATE members)*/
++	mbedtls_mpi P, G;
++	mbedtls_mpi_init(&P);
++	mbedtls_mpi_init(&G);
++	int ret = mbedtls_mpi_lset(&G, generator)
++	       || mbedtls_mpi_read_binary(&P, prime, prime_len)
++	       || mbedtls_dhm_set_group(ctx, &P, &G);
++	mbedtls_mpi_free(&P);
++	mbedtls_mpi_free(&G);
++	return ret;
++}
++
++__attribute_noinline__
++static int crypto_mbedtls_dh_init_public(mbedtls_dhm_context *ctx, u8 generator,
++                                         const u8 *prime, size_t prime_len,
++                                         u8 *privkey, u8 *pubkey)
++{
++	if (crypto_mbedtls_dh_set_bin_pg(ctx, generator, prime, prime_len)
++	    || mbedtls_dhm_make_public(ctx, (int)prime_len, pubkey, prime_len,
++	                               mbedtls_ctr_drbg_random,
++	                               crypto_mbedtls_ctr_drbg()))
++		return -1;
++
++  /*(enable later when upstream mbedtls interface changes require)*/
++  #if 0 && MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
++	mbedtls_mpi X;
++	mbedtls_mpi_init(&X);
++	int ret = mbedtls_dhm_get_value(ctx, MBEDTLS_DHM_PARAM_X, &X)
++	       || mbedtls_mpi_write_binary(&X, privkey, prime_len) ? -1 : 0;
++	mbedtls_mpi_free(&X);
++	return ret;
++  #else
++	return mbedtls_mpi_write_binary(&ctx->MBEDTLS_PRIVATE(X),
++	                                privkey, prime_len) ? -1 : 0;
++  #endif
++}
++
++int crypto_dh_init(u8 generator, const u8 *prime, size_t prime_len, u8 *privkey,
++		   u8 *pubkey)
++{
++  #if 0 /*(crypto_dh_init() duplicated (and identical) in crypto_*.c modules)*/
++	size_t pubkey_len, pad;
++
++	if (os_get_random(privkey, prime_len) < 0)
++		return -1;
++	if (os_memcmp(privkey, prime, prime_len) > 0) {
++		/* Make sure private value is smaller than prime */
++		privkey[0] = 0;
++	}
++
++	pubkey_len = prime_len;
++	if (crypto_mod_exp(&generator, 1, privkey, prime_len, prime, prime_len,
++			   pubkey, &pubkey_len) < 0)
++		return -1;
++	if (pubkey_len < prime_len) {
++		pad = prime_len - pubkey_len;
++		os_memmove(pubkey + pad, pubkey, pubkey_len);
++		os_memset(pubkey, 0, pad);
++	}
++
++	return 0;
++  #else
++	/* Prefer to use mbedtls to derive our public/private key, as doing so
++	 * leverages mbedtls to properly format output and to perform blinding*/
++	mbedtls_dhm_context ctx;
++	mbedtls_dhm_init(&ctx);
++	int ret = crypto_mbedtls_dh_init_public(&ctx, generator, prime,
++	                                        prime_len, privkey, pubkey);
++	mbedtls_dhm_free(&ctx);
++	return ret;
++  #endif
++}
++
++/*(crypto_dh_derive_secret() could be implemented using crypto.h APIs
++ * instead of being reimplemented in each crypto_*.c)*/
++int crypto_dh_derive_secret(u8 generator, const u8 *prime, size_t prime_len,
++			    const u8 *order, size_t order_len,
++			    const u8 *privkey, size_t privkey_len,
++			    const u8 *pubkey, size_t pubkey_len,
++			    u8 *secret, size_t *len)
++{
++  #if 0
++	if (pubkey_len > prime_len ||
++	    (pubkey_len == prime_len &&
++	     os_memcmp(pubkey, prime, prime_len) >= 0))
++		return -1;
++
++	int res = 0;
++	mbedtls_mpi pub;
++	mbedtls_mpi_init(&pub);
++	if (mbedtls_mpi_read_binary(&pub, pubkey, pubkey_len)
++	    || mbedtls_mpi_cmp_int(&pub, 1) <= 0) {
++		res = -1;
++	} else if (order) {
++		mbedtls_mpi p, q, tmp;
++		mbedtls_mpi_init(&p);
++		mbedtls_mpi_init(&q);
++		mbedtls_mpi_init(&tmp);
++
++		/* verify: pubkey^q == 1 mod p */
++		res = (mbedtls_mpi_read_binary(&p, prime, prime_len)
++		    || mbedtls_mpi_read_binary(&q, order, order_len)
++		    || mbedtls_mpi_exp_mod(&tmp, &pub, &q, &p, NULL)
++		    || mbedtls_mpi_cmp_int(&tmp, 1) != 0);
++
++		mbedtls_mpi_free(&p);
++		mbedtls_mpi_free(&q);
++		mbedtls_mpi_free(&tmp);
++	}
++	mbedtls_mpi_free(&pub);
++
++	return (res == 0)
++	  ? crypto_mod_exp(pubkey, pubkey_len, privkey, privkey_len,
++			   prime, prime_len, secret, len)
++	  : -1;
++  #else
++	/* Prefer to use mbedtls to derive DH shared secret, as doing so
++	 * leverages mbedtls to validate params and to perform blinding.
++	 *
++	 * Attempt to reconstitute DH context to derive shared secret
++	 * (due to limitations of the interface, which ought to pass context).
++	 * Force provided G (our private key) into context without validation.
++	 * Regenerating GX (our public key) not needed to derive shared secret.
++	 */
++	/*(older compilers might not support VLAs)*/
++	/*unsigned char buf[2+prime_len+2+1+2+pubkey_len];*/
++	unsigned char buf[2+MBEDTLS_MPI_MAX_SIZE+2+1+2+MBEDTLS_MPI_MAX_SIZE];
++	unsigned char *p = buf + 2 + prime_len;
++	if (2+prime_len+2+1+2+pubkey_len > sizeof(buf))
++		return -1;
++	WPA_PUT_BE16(buf, prime_len);  /*(2-byte big-endian size of prime)*/
++	p[0] = 0;                      /*(2-byte big-endian size of generator)*/
++	p[1] = 1;
++	p[2] = generator;
++	WPA_PUT_BE16(p+3, pubkey_len); /*(2-byte big-endian size of pubkey)*/
++	os_memcpy(p+5, pubkey, pubkey_len);
++	os_memcpy(buf+2, prime, prime_len);
++
++	mbedtls_dhm_context ctx;
++	mbedtls_dhm_init(&ctx);
++	p = buf;
++	int ret = mbedtls_dhm_read_params(&ctx, &p, p+2+prime_len+5+pubkey_len)
++	       || mbedtls_mpi_read_binary(&ctx.MBEDTLS_PRIVATE(X),
++	                                  privkey, privkey_len)
++	       || mbedtls_dhm_calc_secret(&ctx, secret, *len, len,
++	                                  mbedtls_ctr_drbg_random,
++	                                  crypto_mbedtls_ctr_drbg()) ? -1 : 0;
++	mbedtls_dhm_free(&ctx);
++	return ret;
++  #endif
++}
++
++/* dh_group5.c */
++
++#include "dh_group5.h"
++
++/* RFC3526_PRIME_1536[] and RFC3526_GENERATOR_1536[] from crypto_wolfssl.c */
++
++static const unsigned char RFC3526_PRIME_1536[] = {
++	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xC9, 0x0F, 0xDA, 0xA2,
++	0x21, 0x68, 0xC2, 0x34, 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
++	0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, 0x02, 0x0B, 0xBE, 0xA6,
++	0x3B, 0x13, 0x9B, 0x22, 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
++	0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B, 0x30, 0x2B, 0x0A, 0x6D,
++	0xF2, 0x5F, 0x14, 0x37, 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45,
++	0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6, 0xF4, 0x4C, 0x42, 0xE9,
++	0xA6, 0x37, 0xED, 0x6B, 0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,
++	0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5, 0xAE, 0x9F, 0x24, 0x11,
++	0x7C, 0x4B, 0x1F, 0xE6, 0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D,
++	0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05, 0x98, 0xDA, 0x48, 0x36,
++	0x1C, 0x55, 0xD3, 0x9A, 0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F,
++	0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96, 0x1C, 0x62, 0xF3, 0x56,
++	0x20, 0x85, 0x52, 0xBB, 0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D,
++	0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04, 0xF1, 0x74, 0x6C, 0x08,
++	0xCA, 0x23, 0x73, 0x27, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
++};
++
++static const unsigned char RFC3526_GENERATOR_1536[] = {
++	0x02
++};
++
++void * dh5_init(struct wpabuf **priv, struct wpabuf **publ)
++{
++	const unsigned char * const prime = RFC3526_PRIME_1536;
++	const size_t prime_len = sizeof(RFC3526_PRIME_1536);
++	const u8 generator = *RFC3526_GENERATOR_1536;
++	struct wpabuf *wpubl = NULL, *wpriv = NULL;
++
++	mbedtls_dhm_context *ctx = os_malloc(sizeof(*ctx));
++	if (ctx == NULL)
++		return NULL;
++	mbedtls_dhm_init(ctx);
++
++	if (   (wpubl = wpabuf_alloc(prime_len))
++	    && (wpriv = wpabuf_alloc(prime_len))
++	    && crypto_mbedtls_dh_init_public(ctx, generator, prime, prime_len,
++	                                     wpabuf_put(wpriv, prime_len),
++	                                     wpabuf_put(wpubl, prime_len))==0) {
++		wpabuf_free(*publ);
++		wpabuf_clear_free(*priv);
++		*publ = wpubl;
++		*priv = wpriv;
++		return ctx;
++	}
++
++	wpabuf_clear_free(wpriv);
++	wpabuf_free(wpubl);
++	mbedtls_dhm_free(ctx);
++	os_free(ctx);
++	return NULL;
++}
++
++#ifdef CRYPTO_MBEDTLS_DH5_INIT_FIXED
++void * dh5_init_fixed(const struct wpabuf *priv, const struct wpabuf *publ)
++{
++	const unsigned char * const prime = RFC3526_PRIME_1536;
++	const size_t prime_len = sizeof(RFC3526_PRIME_1536);
++	const u8 generator = *RFC3526_GENERATOR_1536;
++
++	mbedtls_dhm_context *ctx = os_malloc(sizeof(*ctx));
++	if (ctx == NULL)
++		return NULL;
++	mbedtls_dhm_init(ctx);
++
++	if (crypto_mbedtls_dh_set_bin_pg(ctx, generator, prime, prime_len)==0
++	   #if 0 /*(ignore; not required to derive shared secret)*/
++	    && mbedtls_mpi_read_binary(&ctx->MBEDTLS_PRIVATE(GX),
++				       wpabuf_head(publ),wpabuf_len(publ))==0
++	   #endif
++	    && mbedtls_mpi_read_binary(&ctx->MBEDTLS_PRIVATE(X),
++				       wpabuf_head(priv),wpabuf_len(priv))==0) {
++		return ctx;
++	}
++
++	mbedtls_dhm_free(ctx);
++	os_free(ctx);
++	return NULL;
++}
++#endif
++
++struct wpabuf * dh5_derive_shared(void *ctx, const struct wpabuf *peer_public,
++				  const struct wpabuf *own_private)
++{
++	/*((mbedtls_dhm_context *)ctx must already contain own_private)*/
++	/* mbedtls 2.x: prime_len = ctx->len; */
++	/* mbedtls 3.x: prime_len = mbedtls_dhm_get_len(ctx); */
++	size_t olen = sizeof(RFC3526_PRIME_1536); /*(sizeof(); prime known)*/
++	struct wpabuf *buf = wpabuf_alloc(olen);
++	if (buf == NULL)
++		return NULL;
++	if (mbedtls_dhm_read_public((mbedtls_dhm_context *)ctx,
++	                            wpabuf_head(peer_public),
++	                            wpabuf_len(peer_public)) == 0
++	    && mbedtls_dhm_calc_secret(ctx, wpabuf_mhead(buf), olen, &olen,
++	                               mbedtls_ctr_drbg_random,
++	                               crypto_mbedtls_ctr_drbg()) == 0) {
++		wpabuf_put(buf, olen);
++		return buf;
++	}
++
++	wpabuf_free(buf);
++	return NULL;
++}
++
++void dh5_free(void *ctx)
++{
++	mbedtls_dhm_free(ctx);
++	os_free(ctx);
++}
++
++#endif /* CRYPTO_MBEDTLS_CRYPTO_DH */
++
++
++#if defined(CRYPTO_MBEDTLS_CRYPTO_ECDH) || defined(CRYPTO_MBEDTLS_CRYPTO_EC)
++
++#include <mbedtls/ecp.h>
++
++#define CRYPTO_EC_pbits(e) (((mbedtls_ecp_group *)(e))->pbits)
++#define CRYPTO_EC_plen(e) ((((mbedtls_ecp_group *)(e))->pbits+7)>>3)
++#define CRYPTO_EC_P(e)    (&((mbedtls_ecp_group *)(e))->P)
++#define CRYPTO_EC_N(e)    (&((mbedtls_ecp_group *)(e))->N)
++#define CRYPTO_EC_A(e)    (&((mbedtls_ecp_group *)(e))->A)
++#define CRYPTO_EC_B(e)    (&((mbedtls_ecp_group *)(e))->B)
++#define CRYPTO_EC_G(e)    (&((mbedtls_ecp_group *)(e))->G)
++
++static mbedtls_ecp_group_id crypto_mbedtls_ecp_group_id_from_ike_id(int group)
++{
++	/* https://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml */
++	switch (group) {
++  #ifdef MBEDTLS_ECP_DP_SECP256R1_ENABLED
++	case 19: return MBEDTLS_ECP_DP_SECP256R1;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_SECP384R1_ENABLED
++	case 20: return MBEDTLS_ECP_DP_SECP384R1;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_SECP521R1_ENABLED
++	case 21: return MBEDTLS_ECP_DP_SECP521R1;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_SECP192R1_ENABLED
++	case 25: return MBEDTLS_ECP_DP_SECP192R1;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_SECP224R1_ENABLED
++	case 26: return MBEDTLS_ECP_DP_SECP224R1;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_BP256R1_ENABLED
++	case 28: return MBEDTLS_ECP_DP_BP256R1;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_BP384R1_ENABLED
++	case 29: return MBEDTLS_ECP_DP_BP384R1;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_BP512R1_ENABLED
++	case 30: return MBEDTLS_ECP_DP_BP512R1;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_CURVE25519_ENABLED
++	case 31: return MBEDTLS_ECP_DP_CURVE25519;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_CURVE448_ENABLED
++	case 32: return MBEDTLS_ECP_DP_CURVE448;
++  #endif
++	default: return MBEDTLS_ECP_DP_NONE;
++	}
++}
++
++#ifdef CRYPTO_MBEDTLS_CRYPTO_EC
++static int crypto_mbedtls_ike_id_from_ecp_group_id(mbedtls_ecp_group_id grp_id)
++{
++	/* https://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml */
++	/*(for crypto_ec_key_group())*/
++	switch (grp_id) {
++  #ifdef MBEDTLS_ECP_DP_SECP256R1_ENABLED
++	case MBEDTLS_ECP_DP_SECP256R1:  return 19;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_SECP384R1_ENABLED
++	case MBEDTLS_ECP_DP_SECP384R1:  return 20;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_SECP521R1_ENABLED
++	case MBEDTLS_ECP_DP_SECP521R1:  return 21;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_SECP192R1_ENABLED
++	case MBEDTLS_ECP_DP_SECP192R1:  return 25;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_SECP224R1_ENABLED
++	case MBEDTLS_ECP_DP_SECP224R1:  return 26;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_BP256R1_ENABLED
++	case MBEDTLS_ECP_DP_BP256R1:    return 28;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_BP384R1_ENABLED
++	case MBEDTLS_ECP_DP_BP384R1:    return 29;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_BP512R1_ENABLED
++	case MBEDTLS_ECP_DP_BP512R1:    return 30;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_CURVE25519_ENABLED
++	case MBEDTLS_ECP_DP_CURVE25519: return 31;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_CURVE448_ENABLED
++	case MBEDTLS_ECP_DP_CURVE448:   return 32;
++  #endif
++	default: return -1;
++	}
++}
++#endif
++
++#endif /* CRYPTO_MBEDTLS_CRYPTO_ECDH || CRYPTO_MBEDTLS_CRYPTO_EC */
++
++
++#if defined(CRYPTO_MBEDTLS_CRYPTO_ECDH) || defined(CRYPTO_MBEDTLS_CRYPTO_EC_DPP)
++
++#include <mbedtls/ecp.h>
++#include <mbedtls/pk.h>
++
++static int crypto_mbedtls_keypair_gen(int group, mbedtls_pk_context *pk)
++{
++	mbedtls_ecp_group_id grp_id =
++	  crypto_mbedtls_ecp_group_id_from_ike_id(group);
++	if (grp_id == MBEDTLS_ECP_DP_NONE)
++		return -1;
++	const mbedtls_pk_info_t *pk_info =
++	  mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY);
++	if (pk_info == NULL)
++		return -1;
++	return mbedtls_pk_setup(pk, pk_info)
++	    || mbedtls_ecp_gen_key(grp_id, mbedtls_pk_ec(*pk),
++	                           mbedtls_ctr_drbg_random,
++	                           crypto_mbedtls_ctr_drbg()) ? -1 : 0;
++}
++
++#endif
++
++
++#ifdef CRYPTO_MBEDTLS_CRYPTO_ECDH
++
++#include <mbedtls/ecdh.h>
++#include <mbedtls/ecdsa.h>
++#include <mbedtls/ecp.h>
++#include <mbedtls/pk.h>
++
++/* wrap mbedtls_ecdh_context for more future-proof direct access to components
++ * (mbedtls_ecdh_context internal implementation may change between releases)
++ *
++ * If mbedtls_pk_context -- specifically underlying mbedtls_ecp_keypair --
++ * lifetime were guaranteed to be longer than that of mbedtls_ecdh_context,
++ * then mbedtls_pk_context or mbedtls_ecp_keypair could be stored in crypto_ecdh
++ * (or crypto_ec_key could be stored in crypto_ecdh, and crypto_ec_key could
++ *  wrap mbedtls_ecp_keypair and components, to avoid MBEDTLS_PRIVATE access) */
++struct crypto_ecdh {
++	mbedtls_ecdh_context ctx;
++	mbedtls_ecp_group grp;
++	mbedtls_ecp_point Q;
++};
++
++struct crypto_ecdh * crypto_ecdh_init(int group)
++{
++	mbedtls_pk_context pk;
++	mbedtls_pk_init(&pk);
++	struct crypto_ecdh *ecdh = crypto_mbedtls_keypair_gen(group, &pk) == 0
++	  ? crypto_ecdh_init2(group, (struct crypto_ec_key *)&pk)
++	  : NULL;
++	mbedtls_pk_free(&pk);
++	return ecdh;
++}
++
++struct crypto_ecdh * crypto_ecdh_init2(int group,
++				       struct crypto_ec_key *own_key)
++{
++	mbedtls_ecp_group_id grp_id =
++	  crypto_mbedtls_ecp_group_id_from_ike_id(group);
++	if (grp_id == MBEDTLS_ECP_DP_NONE)
++		return NULL;
++	mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)own_key);
++	struct crypto_ecdh *ecdh = os_malloc(sizeof(*ecdh));
++	if (ecdh == NULL)
++		return NULL;
++	mbedtls_ecdh_init(&ecdh->ctx);
++	mbedtls_ecp_group_init(&ecdh->grp);
++	mbedtls_ecp_point_init(&ecdh->Q);
++	if (mbedtls_ecdh_setup(&ecdh->ctx, grp_id) == 0
++	    && mbedtls_ecdh_get_params(&ecdh->ctx,ecp_kp,MBEDTLS_ECDH_OURS) == 0) {
++		/* copy grp and Q for later use
++		 * (retrieving this info later is more convoluted
++		 *  even if mbedtls_ecdh_make_public() is considered)*/
++	  #if MBEDTLS_VERSION_NUMBER >= 0x03020000 /* mbedtls 3.2.0 */
++		mbedtls_mpi d;
++		mbedtls_mpi_init(&d);
++		if (mbedtls_ecp_export(ecp_kp, &ecdh->grp, &d, &ecdh->Q) == 0) {
++			mbedtls_mpi_free(&d);
++			return ecdh;
++		}
++		mbedtls_mpi_free(&d);
++	  #else
++		if (mbedtls_ecp_group_load(&ecdh->grp, grp_id) == 0
++		    && mbedtls_ecp_copy(&ecdh->Q, &ecp_kp->MBEDTLS_PRIVATE(Q)) == 0)
++			return ecdh;
++	  #endif
++	}
++
++	mbedtls_ecp_point_free(&ecdh->Q);
++	mbedtls_ecp_group_free(&ecdh->grp);
++	mbedtls_ecdh_free(&ecdh->ctx);
++	os_free(ecdh);
++	return NULL;
++}
++
++struct wpabuf * crypto_ecdh_get_pubkey(struct crypto_ecdh *ecdh, int inc_y)
++{
++	mbedtls_ecp_group *grp = &ecdh->grp;
++	size_t len = CRYPTO_EC_plen(grp);
++  #ifdef MBEDTLS_ECP_MONTGOMERY_ENABLED
++	/* len */
++  #endif
++  #ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED
++	if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS)
++		len = inc_y ? len*2+1 : len+1;
++  #endif
++	struct wpabuf *buf = wpabuf_alloc(len);
++	if (buf == NULL)
++		return NULL;
++	inc_y = inc_y ? MBEDTLS_ECP_PF_UNCOMPRESSED : MBEDTLS_ECP_PF_COMPRESSED;
++	if (mbedtls_ecp_point_write_binary(grp, &ecdh->Q, inc_y, &len,
++	                                   wpabuf_mhead_u8(buf), len) == 0) {
++		wpabuf_put(buf, len);
++		return buf;
++	}
++
++	wpabuf_free(buf);
++	return NULL;
++}
++
++#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
++static int crypto_mbedtls_short_weierstrass_derive_y(mbedtls_ecp_group *grp,
++                                                     mbedtls_mpi *bn,
++                                                     int parity_bit)
++{
++	/* y^2 = x^3 + ax + b
++	 * sqrt(w) = w^((p+1)/4) mod p   (for prime p where p = 3 mod 4) */
++	mbedtls_mpi *cy2 = (mbedtls_mpi *)
++	  crypto_ec_point_compute_y_sqr((struct crypto_ec *)grp,
++	                                (const struct crypto_bignum *)bn); /*x*/
++	if (cy2 == NULL)
++		return -1;
++
++	/*mbedtls_mpi_free(bn);*/
++	/*(reuse bn to store result (y))*/
++
++	mbedtls_mpi exp;
++	mbedtls_mpi_init(&exp);
++	int ret = mbedtls_mpi_get_bit(&grp->P, 0) != 1 /*(p = 3 mod 4)*/
++	       || mbedtls_mpi_get_bit(&grp->P, 1) != 1 /*(p = 3 mod 4)*/
++	       || mbedtls_mpi_add_int(&exp, &grp->P, 1)
++	       || mbedtls_mpi_shift_r(&exp, 2)
++	       || mbedtls_mpi_exp_mod(bn, cy2, &exp, &grp->P, NULL)
++	       || (mbedtls_mpi_get_bit(bn, 0) != parity_bit
++	           && mbedtls_mpi_sub_mpi(bn, &grp->P, bn));
++	mbedtls_mpi_free(&exp);
++	mbedtls_mpi_free(cy2);
++	os_free(cy2);
++	return ret;
++}
++#endif
++
++struct wpabuf * crypto_ecdh_set_peerkey(struct crypto_ecdh *ecdh, int inc_y,
++					const u8 *key, size_t len)
++{
++	if (len == 0) /*(invalid peer key)*/
++		return NULL;
++
++	mbedtls_ecp_group *grp = &ecdh->grp;
++
++  #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
++	if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) {
++		/* add header for mbedtls_ecdh_read_public() */
++		u8 buf[256];
++		if (sizeof(buf)-1 < len)
++			return NULL;
++		buf[0] = (u8)(len);
++		os_memcpy(buf+1, key, len);
++
++		if (inc_y) {
++			if (!(len & 1)) { /*(dpp code/tests does not include tag?!?)*/
++				if (sizeof(buf)-2 < len)
++					return NULL;
++				buf[0] = (u8)(1+len);
++				buf[1] = 0x04;
++				os_memcpy(buf+2, key, len);
++			}
++			len >>= 1; /*(repurpose len to prime_len)*/
++		}
++		else if (key[0] == 0x02 || key[0] == 0x03) { /* (inc_y == 0) */
++			--len; /*(repurpose len to prime_len)*/
++
++			/* mbedtls_ecp_point_read_binary() does not currently support
++			 * MBEDTLS_ECP_PF_COMPRESSED format (buf[1] = 0x02 or 0x03)
++			 * (returns MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE) */
++
++			/* derive y, amend buf[] with y for UNCOMPRESSED format */
++			if (sizeof(buf)-2 < len*2 || len == 0)
++				return NULL;
++			buf[0] = (u8)(1+len*2);
++			buf[1] = 0x04;
++			mbedtls_mpi bn;
++			mbedtls_mpi_init(&bn);
++			int ret = mbedtls_mpi_read_binary(&bn, key+1, len)
++			       || crypto_mbedtls_short_weierstrass_derive_y(grp, &bn,
++			                                                    key[0] & 1)
++			       || mbedtls_mpi_write_binary(&bn, buf+2+len, len);
++			mbedtls_mpi_free(&bn);
++			if (ret != 0)
++				return NULL;
++		}
++
++		if (key[0] == 0) /*(repurpose len to prime_len)*/
++			len = CRYPTO_EC_plen(grp);
++
++		if (mbedtls_ecdh_read_public(&ecdh->ctx, buf, buf[0]+1))
++			return NULL;
++	}
++  #endif
++  #if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
++	if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) {
++		if (mbedtls_ecdh_read_public(&ecdh->ctx, key, len))
++			return NULL;
++	}
++  #endif
++
++	struct wpabuf *buf = wpabuf_alloc(len);
++	if (buf == NULL)
++		return NULL;
++
++	if (mbedtls_ecdh_calc_secret(&ecdh->ctx, &len,
++	                             wpabuf_mhead(buf), len,
++	                             mbedtls_ctr_drbg_random,
++	                             crypto_mbedtls_ctr_drbg()) == 0) {
++		wpabuf_put(buf, len);
++		return buf;
++	}
++
++	wpabuf_clear_free(buf);
++	return NULL;
++}
++
++void crypto_ecdh_deinit(struct crypto_ecdh *ecdh)
++{
++	if (ecdh == NULL)
++		return;
++	mbedtls_ecp_point_free(&ecdh->Q);
++	mbedtls_ecp_group_free(&ecdh->grp);
++	mbedtls_ecdh_free(&ecdh->ctx);
++	os_free(ecdh);
++}
++
++size_t crypto_ecdh_prime_len(struct crypto_ecdh *ecdh)
++{
++	return CRYPTO_EC_plen(&ecdh->grp);
++}
++
++#endif /* CRYPTO_MBEDTLS_CRYPTO_ECDH */
++
++
++#ifdef CRYPTO_MBEDTLS_CRYPTO_EC
++
++#include <mbedtls/ecp.h>
++
++struct crypto_ec *crypto_ec_init(int group)
++{
++	mbedtls_ecp_group_id grp_id =
++	  crypto_mbedtls_ecp_group_id_from_ike_id(group);
++	if (grp_id == MBEDTLS_ECP_DP_NONE)
++		return NULL;
++	mbedtls_ecp_group *e = os_malloc(sizeof(*e));
++	if (e == NULL)
++		return NULL;
++	mbedtls_ecp_group_init(e);
++	if (mbedtls_ecp_group_load(e, grp_id) == 0)
++		return (struct crypto_ec *)e;
++
++	mbedtls_ecp_group_free(e);
++	os_free(e);
++	return NULL;
++}
++
++void crypto_ec_deinit(struct crypto_ec *e)
++{
++	mbedtls_ecp_group_free((mbedtls_ecp_group *)e);
++	os_free(e);
++}
++
++size_t crypto_ec_prime_len(struct crypto_ec *e)
++{
++	return CRYPTO_EC_plen(e);
++}
++
++size_t crypto_ec_prime_len_bits(struct crypto_ec *e)
++{
++	return CRYPTO_EC_pbits(e);
++}
++
++size_t crypto_ec_order_len(struct crypto_ec *e)
++{
++	return (mbedtls_mpi_bitlen(CRYPTO_EC_N(e)) + 7) / 8;
++}
++
++const struct crypto_bignum *crypto_ec_get_prime(struct crypto_ec *e)
++{
++	return (const struct crypto_bignum *)CRYPTO_EC_P(e);
++}
++
++const struct crypto_bignum *crypto_ec_get_order(struct crypto_ec *e)
++{
++	return (const struct crypto_bignum *)CRYPTO_EC_N(e);
++}
++
++const struct crypto_bignum *crypto_ec_get_a(struct crypto_ec *e)
++{
++	static const uint8_t secp256r1_a[] =
++	  {0xff,0xff,0xff,0xff,0x00,0x00,0x00,0x01,
++	   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
++	   0x00,0x00,0x00,0x00,0xff,0xff,0xff,0xff,
++	   0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc};
++	static const uint8_t secp384r1_a[] =
++	  {0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
++	   0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
++	   0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
++	   0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,
++	   0xff,0xff,0xff,0xff,0x00,0x00,0x00,0x00,
++	   0x00,0x00,0x00,0x00,0xff,0xff,0xff,0xfc};
++	static const uint8_t secp521r1_a[] =
++	  {0x01,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
++	   0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
++	   0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
++	   0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
++	   0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
++	   0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
++	   0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
++	   0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
++	   0xff,0xfc};
++	static const uint8_t secp192r1_a[] =
++	  {0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
++	   0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,
++	   0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc};
++	static const uint8_t secp224r1_a[] =
++	  {0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
++	   0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,
++	   0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
++	   0xff,0xff,0xff,0xfe};
++
++	const uint8_t *bin = NULL;
++	size_t len = 0;
++
++	/* (mbedtls groups matching supported sswu_curve_param() IKE groups) */
++	switch (((mbedtls_ecp_group *)e)->id) {
++  #ifdef MBEDTLS_ECP_DP_SECP256R1_ENABLED
++	case MBEDTLS_ECP_DP_SECP256R1:
++		bin = secp256r1_a;
++		len = sizeof(secp256r1_a);
++		break;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_SECP384R1_ENABLED
++	case MBEDTLS_ECP_DP_SECP384R1:
++		bin = secp384r1_a;
++		len = sizeof(secp384r1_a);
++		break;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_SECP521R1_ENABLED
++	case MBEDTLS_ECP_DP_SECP521R1:
++		bin = secp521r1_a;
++		len = sizeof(secp521r1_a);
++		break;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_SECP192R1_ENABLED
++	case MBEDTLS_ECP_DP_SECP192R1:
++		bin = secp192r1_a;
++		len = sizeof(secp192r1_a);
++		break;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_SECP224R1_ENABLED
++	case MBEDTLS_ECP_DP_SECP224R1:
++		bin = secp224r1_a;
++		len = sizeof(secp224r1_a);
++		break;
++  #endif
++  #ifdef MBEDTLS_ECP_DP_BP256R1_ENABLED
++	case MBEDTLS_ECP_DP_BP256R1:
++		return (const struct crypto_bignum *)CRYPTO_EC_A(e);
++  #endif
++  #ifdef MBEDTLS_ECP_DP_BP384R1_ENABLED
++	case MBEDTLS_ECP_DP_BP384R1:
++		return (const struct crypto_bignum *)CRYPTO_EC_A(e);
++  #endif
++  #ifdef MBEDTLS_ECP_DP_BP512R1_ENABLED
++	case MBEDTLS_ECP_DP_BP512R1:
++		return (const struct crypto_bignum *)CRYPTO_EC_A(e);
++  #endif
++  #ifdef MBEDTLS_ECP_DP_CURVE25519_ENABLED
++	case MBEDTLS_ECP_DP_CURVE25519:
++		return (const struct crypto_bignum *)CRYPTO_EC_A(e);
++  #endif
++  #ifdef MBEDTLS_ECP_DP_CURVE448_ENABLED
++	case MBEDTLS_ECP_DP_CURVE448:
++		return (const struct crypto_bignum *)CRYPTO_EC_A(e);
++  #endif
++	default:
++		return NULL;
++	}
++
++	/*(note: not thread-safe; returns file-scoped static storage)*/
++	if (mbedtls_mpi_read_binary(&mpi_sw_A, bin, len) == 0)
++		return (const struct crypto_bignum *)&mpi_sw_A;
++	return NULL;
++}
++
++const struct crypto_bignum *crypto_ec_get_b(struct crypto_ec *e)
++{
++	return (const struct crypto_bignum *)CRYPTO_EC_B(e);
++}
++
++const struct crypto_ec_point * crypto_ec_get_generator(struct crypto_ec *e)
++{
++	return (const struct crypto_ec_point *)CRYPTO_EC_G(e);
++}
++
++struct crypto_ec_point *crypto_ec_point_init(struct crypto_ec *e)
++{
++	mbedtls_ecp_point *p = os_malloc(sizeof(*p));
++	if (p != NULL)
++		mbedtls_ecp_point_init(p);
++	return (struct crypto_ec_point *)p;
++}
++
++void crypto_ec_point_deinit(struct crypto_ec_point *p, int clear)
++{
++	mbedtls_ecp_point_free((mbedtls_ecp_point *)p);
++	os_free(p);
++}
++
++int crypto_ec_point_x(struct crypto_ec *e, const struct crypto_ec_point *p,
++		      struct crypto_bignum *x)
++{
++	mbedtls_mpi *px = &((mbedtls_ecp_point *)p)->MBEDTLS_PRIVATE(X);
++	return mbedtls_mpi_copy((mbedtls_mpi *)x, px)
++	  ? -1
++	  : 0;
++}
++
++int crypto_ec_point_to_bin(struct crypto_ec *e,
++			   const struct crypto_ec_point *point, u8 *x, u8 *y)
++{
++	/* crypto.h documents crypto_ec_point_to_bin() output is big-endian */
++	size_t len = CRYPTO_EC_plen(e);
++	if (x) {
++		mbedtls_mpi *px = &((mbedtls_ecp_point *)point)->MBEDTLS_PRIVATE(X);
++		if (mbedtls_mpi_write_binary(px, x, len))
++			return -1;
++	}
++	if (y) {
++	  #if 0 /*(should not be necessary; py mpi should be in initial state)*/
++	  #ifdef MBEDTLS_ECP_MONTGOMERY_ENABLED
++		if (mbedtls_ecp_get_type((mbedtls_ecp_group *)e)
++		    == MBEDTLS_ECP_TYPE_MONTGOMERY) {
++			os_memset(y, 0, len);
++			return 0;
++		}
++	  #endif
++	  #endif
++		mbedtls_mpi *py = &((mbedtls_ecp_point *)point)->MBEDTLS_PRIVATE(Y);
++		if (mbedtls_mpi_write_binary(py, y, len))
++			return -1;
++	}
++	return 0;
++}
++
++struct crypto_ec_point * crypto_ec_point_from_bin(struct crypto_ec *e,
++						  const u8 *val)
++{
++	size_t len = CRYPTO_EC_plen(e);
++	mbedtls_ecp_point *p = os_malloc(sizeof(*p));
++	u8 buf[1+MBEDTLS_MPI_MAX_SIZE*2];
++	if (p == NULL)
++		return NULL;
++	mbedtls_ecp_point_init(p);
++
++  #ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED
++	if (mbedtls_ecp_get_type((mbedtls_ecp_group *)e)
++	    == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) {
++	  #if 0 /* prefer alternative to MBEDTLS_PRIVATE() access */
++		mbedtls_mpi *px = &((mbedtls_ecp_point *)p)->MBEDTLS_PRIVATE(X);
++		mbedtls_mpi *py = &((mbedtls_ecp_point *)p)->MBEDTLS_PRIVATE(Y);
++		mbedtls_mpi *pz = &((mbedtls_ecp_point *)p)->MBEDTLS_PRIVATE(Z);
++
++		if (mbedtls_mpi_read_binary(px, val, len) == 0
++		    && mbedtls_mpi_read_binary(py, val + len, len) == 0
++		    && mbedtls_mpi_lset(pz, 1) == 0)
++			return (struct crypto_ec_point *)p;
++	  #else
++		buf[0] = 0x04;
++		os_memcpy(buf+1, val, len*2);
++		if (mbedtls_ecp_point_read_binary((mbedtls_ecp_group *)e, p,
++		                                  buf, 1+len*2) == 0)
++			return (struct crypto_ec_point *)p;
++	  #endif
++	}
++  #endif
++  #ifdef MBEDTLS_ECP_MONTGOMERY_ENABLED
++	if (mbedtls_ecp_get_type((mbedtls_ecp_group *)e)
++	    == MBEDTLS_ECP_TYPE_MONTGOMERY) {
++		/* crypto.h interface documents crypto_ec_point_from_bin()
++		 * val is length: prime_len * 2 and is big-endian
++		 * (Short Weierstrass is assumed by hostap)
++		 * Reverse to little-endian format for Montgomery */
++		for (unsigned int i = 0; i < len; ++i)
++			buf[i] = val[len-1-i];
++		if (mbedtls_ecp_point_read_binary((mbedtls_ecp_group *)e, p,
++		                                  buf, len) == 0)
++			return (struct crypto_ec_point *)p;
++	}
++  #endif
++
++	mbedtls_ecp_point_free(p);
++	os_free(p);
++	return NULL;
++}
++
++int crypto_ec_point_add(struct crypto_ec *e, const struct crypto_ec_point *a,
++			const struct crypto_ec_point *b,
++			struct crypto_ec_point *c)
++{
++	/* mbedtls does not provide an mbedtls_ecp_point add function */
++	mbedtls_mpi one;
++	mbedtls_mpi_init(&one);
++	int ret = mbedtls_mpi_lset(&one, 1)
++	       || mbedtls_ecp_muladd(
++			(mbedtls_ecp_group *)e, (mbedtls_ecp_point *)c,
++			&one, (const mbedtls_ecp_point *)a,
++			&one, (const mbedtls_ecp_point *)b) ? -1 : 0;
++	mbedtls_mpi_free(&one);
++	return ret;
++}
++
++int crypto_ec_point_mul(struct crypto_ec *e, const struct crypto_ec_point *p,
++			const struct crypto_bignum *b,
++			struct crypto_ec_point *res)
++{
++	return mbedtls_ecp_mul(
++		(mbedtls_ecp_group *)e, (mbedtls_ecp_point *)res,
++		(const mbedtls_mpi *)b, (const mbedtls_ecp_point *)p,
++		mbedtls_ctr_drbg_random, crypto_mbedtls_ctr_drbg()) ? -1 : 0;
++}
++
++int crypto_ec_point_invert(struct crypto_ec *e, struct crypto_ec_point *p)
++{
++	if (mbedtls_ecp_get_type((mbedtls_ecp_group *)e)
++	    == MBEDTLS_ECP_TYPE_MONTGOMERY) {
++		/* e.g. MBEDTLS_ECP_DP_CURVE25519 and MBEDTLS_ECP_DP_CURVE448 */
++		wpa_printf(MSG_ERROR,
++		           "%s not implemented for Montgomery curves",__func__);
++		return -1;
++	}
++
++	/* mbedtls does not provide an mbedtls_ecp_point invert function */
++	/* below works for Short Weierstrass; incorrect for Montgomery curves */
++	mbedtls_mpi *py = &((mbedtls_ecp_point *)p)->MBEDTLS_PRIVATE(Y);
++	return mbedtls_ecp_is_zero((mbedtls_ecp_point *)p) /*point at infinity*/
++	    || mbedtls_mpi_cmp_int(py, 0) == 0      /*point is its own inverse*/
++	    || mbedtls_mpi_sub_abs(py, CRYPTO_EC_P(e), py) == 0 ? 0 : -1;
++}
++
++#ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED
++static int
++crypto_ec_point_y_sqr_weierstrass(mbedtls_ecp_group *e, const mbedtls_mpi *x,
++                                  mbedtls_mpi *y2)
++{
++	/* MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS  y^2 = x^3 + a x + b    */
++
++	/* Short Weierstrass elliptic curve group w/o A set treated as A = -3 */
++	/* Attempt to match mbedtls/library/ecp.c:ecp_check_pubkey_sw() behavior
++	 * and elsewhere in mbedtls/library/ecp.c where if A is not set, it is
++	 * treated as if A = -3. */
++
++  #if 0
++	/* y^2 = x^3 + ax + b */
++	mbedtls_mpi *A = &e->A;
++	mbedtls_mpi t, A_neg3;
++	if (&e->A.p == NULL) {
++		mbedtls_mpi_init(&A_neg3);
++		if (mbedtls_mpi_lset(&A_neg3, -3) != 0) {
++			mbedtls_mpi_free(&A_neg3);
++			return -1;
++		}
++		A = &A_neg3;
++	}
++	mbedtls_mpi_init(&t);
++	int ret = /* x^3 */
++	          mbedtls_mpi_lset(&t, 3)
++	       || mbedtls_mpi_exp_mod(y2,  x, &t, &e->P, NULL)
++		  /* ax */
++	       || mbedtls_mpi_mul_mpi(y2, y2, A)
++	       || mbedtls_mpi_mod_mpi(&t, &t, &e->P)
++		  /* ax + b */
++	       || mbedtls_mpi_add_mpi(&t, &t, &e->B)
++	       || mbedtls_mpi_mod_mpi(&t, &t, &e->P)
++		  /* x^3 + ax + b */
++	       || mbedtls_mpi_add_mpi(&t, &t, y2) /* ax + b + x^3 */
++	       || mbedtls_mpi_mod_mpi(y2, &t, &e->P);
++	mbedtls_mpi_free(&t);
++	if (A == &A_neg3)
++		mbedtls_mpi_free(&A_neg3);
++	return ret; /* 0: success, non-zero: failure */
++  #else
++	/* y^2 = x^3 + ax + b = (x^2 + a)x + b */
++	return    /* x^2 */
++	          mbedtls_mpi_mul_mpi(y2,  x, x)
++	       || mbedtls_mpi_mod_mpi(y2, y2, &e->P)
++		  /* x^2 + a */
++	       || (e->A.MBEDTLS_PRIVATE(p)
++	           ? mbedtls_mpi_add_mpi(y2, y2, &e->A)
++	           : mbedtls_mpi_sub_int(y2, y2, 3))
++	       || mbedtls_mpi_mod_mpi(y2, y2, &e->P)
++		  /* (x^2 + a)x */
++	       || mbedtls_mpi_mul_mpi(y2, y2, x)
++	       || mbedtls_mpi_mod_mpi(y2, y2, &e->P)
++		  /* (x^2 + a)x + b */
++	       || mbedtls_mpi_add_mpi(y2, y2, &e->B)
++	       || mbedtls_mpi_mod_mpi(y2, y2, &e->P);
++  #endif
++}
++#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
++
++#if 0 /* not used by hostap */
++#ifdef MBEDTLS_ECP_MONTGOMERY_ENABLED
++static int
++crypto_ec_point_y_sqr_montgomery(mbedtls_ecp_group *e, const mbedtls_mpi *x,
++                                 mbedtls_mpi *y2)
++{
++	/* XXX: !!! must be reviewed and audited for correctness !!! */
++
++	/* MBEDTLS_ECP_TYPE_MONTGOMERY         y^2 = x^3 + a x^2 + x  */
++
++	/* y^2 = x^3 + a x^2 + x = (x + a)x^2 + x */
++	mbedtls_mpi x2;
++	mbedtls_mpi_init(&x2);
++	int ret = /* x^2 */
++	          mbedtls_mpi_mul_mpi(&x2, x, x)
++	       || mbedtls_mpi_mod_mpi(&x2, &x2, &e->P)
++		  /* x + a */
++	       || mbedtls_mpi_add_mpi(y2,  x, &e->A)
++	       || mbedtls_mpi_mod_mpi(y2, y2, &e->P)
++		  /* (x + a)x^2 */
++	       || mbedtls_mpi_mul_mpi(y2, y2, &x2)
++	       || mbedtls_mpi_mod_mpi(y2, y2, &e->P)
++		  /* (x + a)x^2 + x */
++	       || mbedtls_mpi_add_mpi(y2, y2, x)
++	       || mbedtls_mpi_mod_mpi(y2, y2, &e->P);
++	mbedtls_mpi_free(&x2);
++	return ret; /* 0: success, non-zero: failure */
++}
++#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
++#endif
++
++struct crypto_bignum *
++crypto_ec_point_compute_y_sqr(struct crypto_ec *e,
++			      const struct crypto_bignum *x)
++{
++	mbedtls_mpi *y2 = os_malloc(sizeof(*y2));
++	if (y2 == NULL)
++		return NULL;
++	mbedtls_mpi_init(y2);
++
++  #ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED
++	if (mbedtls_ecp_get_type((mbedtls_ecp_group *)e)
++	      == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS
++	    && crypto_ec_point_y_sqr_weierstrass((mbedtls_ecp_group *)e,
++	                                         (const mbedtls_mpi *)x,
++	                                         y2) == 0)
++		return (struct crypto_bignum *)y2;
++  #endif
++  #if 0 /* not used by hostap */
++  #ifdef MBEDTLS_ECP_MONTGOMERY_ENABLED
++	if (mbedtls_ecp_get_type((mbedtls_ecp_group *)e)
++	      == MBEDTLS_ECP_TYPE_MONTGOMERY
++	    && crypto_ec_point_y_sqr_montgomery((mbedtls_ecp_group *)e,
++	                                        (const mbedtls_mpi *)x,
++	                                        y2) == 0)
++		return (struct crypto_bignum *)y2;
++  #endif
++  #endif
++
++	mbedtls_mpi_free(y2);
++	os_free(y2);
++	return NULL;
++}
++
++int crypto_ec_point_is_at_infinity(struct crypto_ec *e,
++				   const struct crypto_ec_point *p)
++{
++	return mbedtls_ecp_is_zero((mbedtls_ecp_point *)p);
++}
++
++int crypto_ec_point_is_on_curve(struct crypto_ec *e,
++				const struct crypto_ec_point *p)
++{
++  #if 1
++	return mbedtls_ecp_check_pubkey((const mbedtls_ecp_group *)e,
++	                                (const mbedtls_ecp_point *)p) == 0;
++  #else
++	/* compute y^2 mod P and compare to y^2 mod P */
++	/*(ref: src/eap_common/eap_pwd_common.c:compute_password_element())*/
++	const mbedtls_mpi *px = &((const mbedtls_ecp_point *)p)->MBEDTLS_PRIVATE(X);
++	mbedtls_mpi *cy2 = (mbedtls_mpi *)
++	  crypto_ec_point_compute_y_sqr(e, (const struct crypto_bignum *)px);
++	if (cy2 == NULL)
++		return 0;
++
++	mbedtls_mpi y2;
++	mbedtls_mpi_init(&y2);
++	const mbedtls_mpi *py = &((const mbedtls_ecp_point *)p)->MBEDTLS_PRIVATE(Y);
++	int is_on_curve = mbedtls_mpi_mul_mpi(&y2, py, py) /* y^2 mod P */
++	               || mbedtls_mpi_mod_mpi(&y2, &y2, CRYPTO_EC_P(e))
++	               || mbedtls_mpi_cmp_mpi(&y2, cy2) != 0 ? 0 : 1;
++
++	mbedtls_mpi_free(&y2);
++	mbedtls_mpi_free(cy2);
++	os_free(cy2);
++	return is_on_curve;
++  #endif
++}
++
++int crypto_ec_point_cmp(const struct crypto_ec *e,
++			const struct crypto_ec_point *a,
++			const struct crypto_ec_point *b)
++{
++	return mbedtls_ecp_point_cmp((const mbedtls_ecp_point *)a,
++	                             (const mbedtls_ecp_point *)b);
++}
++
++#if !defined(CONFIG_NO_STDOUT_DEBUG)
++void crypto_ec_point_debug_print(const struct crypto_ec *e,
++				 const struct crypto_ec_point *p,
++				 const char *title)
++{
++	u8 x[MBEDTLS_MPI_MAX_SIZE];
++	u8 y[MBEDTLS_MPI_MAX_SIZE];
++	size_t len = CRYPTO_EC_plen(e);
++	/* crypto_ec_point_to_bin ought to take (const struct crypto_ec *e) */
++	struct crypto_ec *ee;
++	*(const struct crypto_ec **)&ee = e; /*(cast away const)*/
++	if (crypto_ec_point_to_bin(ee, p, x, y) == 0) {
++		if (title)
++			wpa_printf(MSG_DEBUG, "%s", title);
++		wpa_hexdump(MSG_DEBUG, "x:", x, len);
++		wpa_hexdump(MSG_DEBUG, "y:", y, len);
++	}
++}
++#endif
++
++
++struct crypto_ec_key * crypto_ec_key_parse_priv(const u8 *der, size_t der_len)
++{
++	mbedtls_pk_context *ctx = os_malloc(sizeof(*ctx));
++	if (ctx == NULL)
++		return NULL;
++	mbedtls_pk_init(ctx);
++  #if MBEDTLS_VERSION_NUMBER < 0x03000000 /* mbedtls 3.0.0 */
++	if (mbedtls_pk_parse_key(ctx, der, der_len, NULL, 0) == 0)
++  #else
++	if (mbedtls_pk_parse_key(ctx, der, der_len, NULL, 0,
++	                         mbedtls_ctr_drbg_random,
++	                         crypto_mbedtls_ctr_drbg()) == 0)
++  #endif
++		return (struct crypto_ec_key *)ctx;
++
++	mbedtls_pk_free(ctx);
++	os_free(ctx);
++	return NULL;
++}
++
++#ifdef CRYPTO_MBEDTLS_CRYPTO_HPKE
++#ifdef CONFIG_MODULE_TESTS
++/*(for crypto_module_tests.c)*/
++struct crypto_ec_key * crypto_ec_key_set_priv(int group,
++					      const u8 *raw, size_t raw_len)
++{
++	mbedtls_ecp_group_id grp_id =
++	  crypto_mbedtls_ecp_group_id_from_ike_id(group);
++	if (grp_id == MBEDTLS_ECP_DP_NONE)
++		return NULL;
++	const mbedtls_pk_info_t *pk_info =
++	  mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY);
++	if (pk_info == NULL)
++		return NULL;
++	mbedtls_pk_context *ctx = os_malloc(sizeof(*ctx));
++	if (ctx == NULL)
++		return NULL;
++	mbedtls_pk_init(ctx);
++	if (mbedtls_pk_setup(ctx, pk_info) == 0
++	    && mbedtls_ecp_read_key(grp_id,mbedtls_pk_ec(*ctx),raw,raw_len) == 0) {
++		return (struct crypto_ec_key *)ctx;
++	}
++
++	mbedtls_pk_free(ctx);
++	os_free(ctx);
++	return NULL;
++}
++#endif
++#endif
++
++#include <mbedtls/error.h>
++#include <mbedtls/oid.h>
++static int crypto_mbedtls_pk_parse_subpubkey_compressed(mbedtls_pk_context *ctx, const u8 *der, size_t der_len)
++{
++    /* The following is modified from:
++     *   mbedtls/library/pkparse.c:mbedtls_pk_parse_subpubkey()
++     *   mbedtls/library/pkparse.c:pk_get_pk_alg()
++     *   mbedtls/library/pkparse.c:pk_use_ecparams()
++     */
++    mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE;
++    const mbedtls_pk_info_t *pk_info;
++    int ret;
++    size_t len;
++    const unsigned char *end = der+der_len;
++    unsigned char *p;
++    *(const unsigned char **)&p = der;
++
++    if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
++                    MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
++    {
++        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
++    }
++
++    end = p + len;
++
++    /*
++    if( ( ret = pk_get_pk_alg( &p, end, &pk_alg, &alg_params ) ) != 0 )
++        return( ret );
++    */
++    mbedtls_asn1_buf alg_oid, params;
++    memset( &params, 0, sizeof(mbedtls_asn1_buf) );
++    if( ( ret = mbedtls_asn1_get_alg( &p, end, &alg_oid, &params ) ) != 0 )
++        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_ALG, ret ) );
++    if( mbedtls_oid_get_pk_alg( &alg_oid, &pk_alg ) != 0 )
++        return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
++
++    if( ( ret = mbedtls_asn1_get_bitstring_null( &p, end, &len ) ) != 0 )
++        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY, ret ) );
++
++    if( p + len != end )
++        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY,
++                MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
++
++    if( ( pk_info = mbedtls_pk_info_from_type( pk_alg ) ) == NULL )
++        return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
++
++    if( ( ret = mbedtls_pk_setup( ctx, pk_info ) ) != 0 )
++        return( ret );
++
++    /* assume mbedtls_pk_parse_subpubkey(&der, der+der_len, ctx)
++     * has already run with ctx initialized up to pk_get_ecpubkey(),
++     * and pk_get_ecpubkey() has returned MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE
++     *
++     * mbedtls mbedtls_ecp_point_read_binary()
++     * does not handle point in COMPRESSED format
++     *
++     * (validate assumption that algorithm is EC) */
++    mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*ctx);
++    if (ecp_kp == NULL)
++        return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
++    mbedtls_ecp_group *ecp_kp_grp = &ecp_kp->MBEDTLS_PRIVATE(grp);
++    mbedtls_ecp_point *ecp_kp_Q = &ecp_kp->MBEDTLS_PRIVATE(Q);
++    mbedtls_ecp_group_id grp_id;
++
++
++    /* mbedtls/library/pkparse.c:pk_use_ecparams() */
++
++    if( params.tag == MBEDTLS_ASN1_OID )
++    {
++        if( mbedtls_oid_get_ec_grp( &params, &grp_id ) != 0 )
++            return( MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE );
++    }
++    else
++    {
++#if defined(MBEDTLS_PK_PARSE_EC_EXTENDED)
++        /*(large code block not copied from mbedtls; unsupported)*/
++      #if 0
++        if( ( ret = pk_group_id_from_specified( &params, &grp_id ) ) != 0 )
++            return( ret );
++      #endif
++#endif
++        return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
++    }
++
++    /*
++     * grp may already be initialized; if so, make sure IDs match
++     */
++    if( ecp_kp_grp->id != MBEDTLS_ECP_DP_NONE && ecp_kp_grp->id != grp_id )
++        return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
++
++    if( ( ret = mbedtls_ecp_group_load( ecp_kp_grp, grp_id ) ) != 0 )
++        return( ret );
++
++
++    /* (validate assumption that EC point is in COMPRESSED format) */
++    len = CRYPTO_EC_plen(ecp_kp_grp);
++    if( mbedtls_ecp_get_type(ecp_kp_grp) != MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS
++        || (end - p) != 1+len
++        || (*p != 0x02 && *p != 0x03) )
++        return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
++
++    /* Instead of calling mbedtls/library/pkparse.c:pk_get_ecpubkey() to call
++     * mbedtls_ecp_point_read_binary(), manually parse point into ecp_kp_Q */
++    mbedtls_mpi *X = &ecp_kp_Q->MBEDTLS_PRIVATE(X);
++    mbedtls_mpi *Y = &ecp_kp_Q->MBEDTLS_PRIVATE(Y);
++    mbedtls_mpi *Z = &ecp_kp_Q->MBEDTLS_PRIVATE(Z);
++    ret = mbedtls_mpi_lset(Z, 1);
++    if (ret != 0)
++        return( ret );
++    ret = mbedtls_mpi_read_binary(X, p+1, len);
++    if (ret != 0)
++        return( ret );
++    /* derive Y
++     * (similar derivation of Y in crypto_mbedtls.c:crypto_ecdh_set_peerkey())*/
++    ret = mbedtls_mpi_copy(Y, X) /*(Y is used as input and output obj below)*/
++       || crypto_mbedtls_short_weierstrass_derive_y(ecp_kp_grp, Y, (*p & 1));
++    if (ret != 0)
++        return( ret );
++
++    return mbedtls_ecp_check_pubkey( ecp_kp_grp, ecp_kp_Q );
++}
++
++struct crypto_ec_key * crypto_ec_key_parse_pub(const u8 *der, size_t der_len)
++{
++	mbedtls_pk_context *ctx = os_malloc(sizeof(*ctx));
++	if (ctx == NULL)
++		return NULL;
++	mbedtls_pk_init(ctx);
++	/*int rc = mbedtls_pk_parse_subpubkey(&der, der+der_len, ctx);*/
++	int rc = mbedtls_pk_parse_public_key(ctx, der, der_len);
++	if (rc == 0)
++		return (struct crypto_ec_key *)ctx;
++	else if (rc == MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE) {
++		/* mbedtls mbedtls_ecp_point_read_binary()
++		 * does not handle point in COMPRESSED format; parse internally */
++		rc = crypto_mbedtls_pk_parse_subpubkey_compressed(ctx,der,der_len);
++		if (rc == 0)
++			return (struct crypto_ec_key *)ctx;
++	}
++
++	mbedtls_pk_free(ctx);
++	os_free(ctx);
++	return NULL;
++}
++
++#ifdef CRYPTO_MBEDTLS_CRYPTO_EC_DPP
++
++static struct crypto_ec_key *
++crypto_ec_key_set_pub_point_for_group(mbedtls_ecp_group_id grp_id,
++                                      const mbedtls_ecp_point *pub,
++                                      const u8 *buf, size_t len)
++{
++	const mbedtls_pk_info_t *pk_info =
++	  mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY);
++	if (pk_info == NULL)
++		return NULL;
++	mbedtls_pk_context *ctx = os_malloc(sizeof(*ctx));
++	if (ctx == NULL)
++		return NULL;
++	mbedtls_pk_init(ctx);
++	if (mbedtls_pk_setup(ctx, pk_info) == 0) {
++		/* (Is private key generation necessary for callers?)
++		 * alt: gen key then overwrite Q
++		 *   mbedtls_ecp_gen_key(grp_id, ecp_kp,
++	         *                       mbedtls_ctr_drbg_random,
++	         *                       crypto_mbedtls_ctr_drbg()) == 0
++	         */
++		mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*ctx);
++		mbedtls_ecp_group *ecp_kp_grp = &ecp_kp->MBEDTLS_PRIVATE(grp);
++		mbedtls_ecp_point *ecp_kp_Q = &ecp_kp->MBEDTLS_PRIVATE(Q);
++		mbedtls_mpi *ecp_kp_d = &ecp_kp->MBEDTLS_PRIVATE(d);
++		if (mbedtls_ecp_group_load(ecp_kp_grp, grp_id) == 0
++		    && (pub
++		         ? mbedtls_ecp_copy(ecp_kp_Q, pub) == 0
++		         : mbedtls_ecp_point_read_binary(ecp_kp_grp, ecp_kp_Q,
++		                                         buf, len) == 0)
++		    && mbedtls_ecp_gen_privkey(ecp_kp_grp, ecp_kp_d,
++		                               mbedtls_ctr_drbg_random,
++		                               crypto_mbedtls_ctr_drbg()) == 0){
++			return (struct crypto_ec_key *)ctx;
++		}
++	}
++
++	mbedtls_pk_free(ctx);
++	os_free(ctx);
++	return NULL;
++}
++
++struct crypto_ec_key * crypto_ec_key_set_pub(int group, const u8 *x,
++					     const u8 *y, size_t len)
++{
++	mbedtls_ecp_group_id grp_id =
++	  crypto_mbedtls_ecp_group_id_from_ike_id(group);
++	if (grp_id == MBEDTLS_ECP_DP_NONE)
++		return NULL;
++	if (len > MBEDTLS_MPI_MAX_SIZE)
++		return NULL;
++	u8 buf[1+MBEDTLS_MPI_MAX_SIZE*2];
++	buf[0] = 0x04; /* assume x,y for Short Weierstrass */
++	os_memcpy(buf+1, x, len);
++	os_memcpy(buf+1+len, y, len);
++
++	return crypto_ec_key_set_pub_point_for_group(grp_id,NULL,buf,1+len*2);
++}
++
++struct crypto_ec_key *
++crypto_ec_key_set_pub_point(struct crypto_ec *e,
++			    const struct crypto_ec_point *pub)
++{
++	mbedtls_ecp_group_id grp_id = ((mbedtls_ecp_group *)e)->id;
++	mbedtls_ecp_point *p = (mbedtls_ecp_point *)pub;
++	return crypto_ec_key_set_pub_point_for_group(grp_id, p, NULL, 0);
++}
++
++
++struct crypto_ec_key * crypto_ec_key_gen(int group)
++{
++	mbedtls_pk_context *ctx = os_malloc(sizeof(*ctx));
++	if (ctx == NULL)
++		return NULL;
++	mbedtls_pk_init(ctx);
++	if (crypto_mbedtls_keypair_gen(group, ctx) == 0)
++		return (struct crypto_ec_key *)ctx;
++	mbedtls_pk_free(ctx);
++	os_free(ctx);
++	return NULL;
++}
++
++#endif /* CRYPTO_MBEDTLS_CRYPTO_EC_DPP */
++
++void crypto_ec_key_deinit(struct crypto_ec_key *key)
++{
++	mbedtls_pk_free((mbedtls_pk_context *)key);
++	os_free(key);
++}
++
++struct wpabuf * crypto_ec_key_get_subject_public_key(struct crypto_ec_key *key)
++{
++	/* (similar to crypto_ec_key_get_pubkey_point(),
++	 *  but compressed point format and ASN.1 DER wrapping)*/
++#ifndef MBEDTLS_PK_ECP_PUB_DER_MAX_BYTES /*(mbedtls/library/pkwrite.h)*/
++#define MBEDTLS_PK_ECP_PUB_DER_MAX_BYTES    ( 30 + 2 * MBEDTLS_ECP_MAX_BYTES )
++#endif
++	unsigned char buf[MBEDTLS_PK_ECP_PUB_DER_MAX_BYTES];
++	int len = mbedtls_pk_write_pubkey_der((mbedtls_pk_context *)key,
++	                                      buf, sizeof(buf));
++	if (len < 0)
++		return NULL;
++	/*  Note: data is written at the end of the buffer! Use the
++	 *        return value to determine where you should start
++	 *        using the buffer */
++	unsigned char *p = buf+sizeof(buf)-len;
++
++  #ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED
++	mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)key);
++	if (ecp_kp == NULL)
++		return NULL;
++	mbedtls_ecp_group *grp = &ecp_kp->MBEDTLS_PRIVATE(grp);
++	/*  Note: sae_pk.c expects pubkey point in compressed format,
++	 *        but mbedtls_pk_write_pubkey_der() writes uncompressed format.
++	 *        Manually translate format and update lengths in DER format */
++	if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) {
++		unsigned char *end = buf+sizeof(buf);
++		size_t n;
++		/* SubjectPublicKeyInfo SEQUENCE */
++		mbedtls_asn1_get_tag(&p, end, &n,
++		    MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
++		/* algorithm AlgorithmIdentifier */
++		unsigned char *a = p;
++		size_t alen;
++		mbedtls_asn1_get_tag(&p, end, &alen,
++		    MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
++		p += alen;
++		alen = (size_t)(p - a);
++		/* subjectPublicKey BIT STRING */
++		mbedtls_asn1_get_tag(&p, end, &n, MBEDTLS_ASN1_BIT_STRING);
++		/* rewrite into compressed point format and rebuild ASN.1 */
++		p[1] = (buf[sizeof(buf)-1] & 1) ? 0x03 : 0x02;
++		n = 1 + 1 + (n-2)/2;
++		len = mbedtls_asn1_write_len(&p, buf, n) + (int)n;
++		len += mbedtls_asn1_write_tag(&p, buf, MBEDTLS_ASN1_BIT_STRING);
++		os_memmove(p-alen, a, alen);
++		len += alen;
++		p -= alen;
++		len += mbedtls_asn1_write_len(&p, buf, (size_t)len);
++		len += mbedtls_asn1_write_tag(&p, buf,
++		    MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
++	}
++  #endif
++	return wpabuf_alloc_copy(p, (size_t)len);
++}
++
++#ifdef CRYPTO_MBEDTLS_CRYPTO_EC_DPP
++
++struct wpabuf * crypto_ec_key_get_ecprivate_key(struct crypto_ec_key *key,
++						bool include_pub)
++{
++#ifndef MBEDTLS_PK_ECP_PRV_DER_MAX_BYTES /*(mbedtls/library/pkwrite.h)*/
++#define MBEDTLS_PK_ECP_PRV_DER_MAX_BYTES    ( 29 + 3 * MBEDTLS_ECP_MAX_BYTES )
++#endif
++	unsigned char priv[MBEDTLS_PK_ECP_PRV_DER_MAX_BYTES];
++	int privlen = mbedtls_pk_write_key_der((mbedtls_pk_context *)key,
++	                                       priv, sizeof(priv));
++	if (privlen < 0)
++		return NULL;
++
++	struct wpabuf *wbuf;
++
++	/*  Note: data is written at the end of the buffer! Use the
++	 *        return value to determine where you should start
++	 *        using the buffer */
++	/* mbedtls_pk_write_key_der() includes publicKey in DER */
++	if (include_pub)
++		wbuf = wpabuf_alloc_copy(priv+sizeof(priv)-privlen, privlen);
++	else {
++		/* calculate publicKey offset and skip from end of buffer */
++		unsigned char *p = priv+sizeof(priv)-privlen;
++		unsigned char *end = priv+sizeof(priv);
++		size_t len;
++		/* ECPrivateKey SEQUENCE */
++		mbedtls_asn1_get_tag(&p, end, &len,
++		    MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
++		/* version INTEGER */
++		unsigned char *v = p;
++		mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_INTEGER);
++		p += len;
++		/* privateKey OCTET STRING */
++		mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING);
++		p += len;
++		/* parameters ECParameters */
++		mbedtls_asn1_get_tag(&p, end, &len,
++		    MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED);
++		p += len;
++
++		/* write new SEQUENCE header (we know that it fits in priv[]) */
++		len = (size_t)(p - v);
++		p = v;
++		len += mbedtls_asn1_write_len(&p, priv, len);
++		len += mbedtls_asn1_write_tag(&p, priv,
++		    MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
++		wbuf = wpabuf_alloc_copy(p, len);
++	}
++
++	forced_memzero(priv, sizeof(priv));
++	return wbuf;
++}
++
++struct wpabuf * crypto_ec_key_get_pubkey_point(struct crypto_ec_key *key,
++					       int prefix)
++{
++	/*(similarities to crypto_ecdh_get_pubkey(), but different struct)*/
++	mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)key);
++	if (ecp_kp == NULL)
++		return NULL;
++	mbedtls_ecp_group *grp = &ecp_kp->MBEDTLS_PRIVATE(grp);
++	size_t len = CRYPTO_EC_plen(grp);
++  #ifdef MBEDTLS_ECP_MONTGOMERY_ENABLED
++	/* len */
++  #endif
++  #ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED
++	if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS)
++		len = len*2+1;
++  #endif
++	struct wpabuf *buf = wpabuf_alloc(len);
++	if (buf == NULL)
++		return NULL;
++	mbedtls_ecp_point *ecp_kp_Q = &ecp_kp->MBEDTLS_PRIVATE(Q);
++	if (mbedtls_ecp_point_write_binary(grp, ecp_kp_Q,
++	                                   MBEDTLS_ECP_PF_UNCOMPRESSED, &len,
++	                                   wpabuf_mhead_u8(buf), len) == 0) {
++		if (!prefix) /* Remove 0x04 prefix if requested */
++			os_memmove(wpabuf_mhead(buf),wpabuf_mhead(buf)+1,--len);
++		wpabuf_put(buf, len);
++		return buf;
++	}
++
++	wpabuf_free(buf);
++	return NULL;
++}
++
++struct crypto_ec_point *
++crypto_ec_key_get_public_key(struct crypto_ec_key *key)
++{
++	mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)key);
++	if (ecp_kp == NULL)
++		return NULL;
++	mbedtls_ecp_point *p = os_malloc(sizeof(*p));
++	if (p != NULL) {
++		/*(mbedtls_ecp_export() uses &ecp_kp->MBEDTLS_PRIVATE(grp))*/
++		mbedtls_ecp_point_init(p);
++		mbedtls_ecp_point *ecp_kp_Q = &ecp_kp->MBEDTLS_PRIVATE(Q);
++		if (mbedtls_ecp_copy(p, ecp_kp_Q)) {
++			mbedtls_ecp_point_free(p);
++			os_free(p);
++			p = NULL;
++		}
++	}
++	return (struct crypto_ec_point *)p;
++}
++
++struct crypto_bignum *
++crypto_ec_key_get_private_key(struct crypto_ec_key *key)
++{
++	mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)key);
++	if (ecp_kp == NULL)
++		return NULL;
++	mbedtls_mpi *bn = os_malloc(sizeof(*bn));
++	if (bn) {
++		/*(mbedtls_ecp_export() uses &ecp_kp->MBEDTLS_PRIVATE(grp))*/
++		mbedtls_mpi_init(bn);
++		mbedtls_mpi *ecp_kp_d = &ecp_kp->MBEDTLS_PRIVATE(d);
++		if (mbedtls_mpi_copy(bn, ecp_kp_d)) {
++			mbedtls_mpi_free(bn);
++			os_free(bn);
++			bn = NULL;
++		}
++	}
++	return (struct crypto_bignum *)bn;
++}
++
++#endif /* CRYPTO_MBEDTLS_CRYPTO_EC_DPP */
++
++static mbedtls_md_type_t crypto_ec_key_sign_md(size_t len)
++{
++	/* get mbedtls_md_type_t from length of hash data to be signed */
++	switch (len) {
++	case 64: return MBEDTLS_MD_SHA512;
++	case 48: return MBEDTLS_MD_SHA384;
++	case 32: return MBEDTLS_MD_SHA256;
++	case 20: return MBEDTLS_MD_SHA1;
++	case 16: return MBEDTLS_MD_MD5;
++	default: return MBEDTLS_MD_NONE;
++	}
++}
++
++struct wpabuf * crypto_ec_key_sign(struct crypto_ec_key *key, const u8 *data,
++				   size_t len)
++{
++  #ifndef MBEDTLS_PK_SIGNATURE_MAX_SIZE /*(defined since mbedtls 2.20.0)*/
++  #if MBEDTLS_ECDSA_MAX_LEN > MBEDTLS_MPI_MAX_SIZE
++  #define MBEDTLS_PK_SIGNATURE_MAX_SIZE MBEDTLS_ECDSA_MAX_LEN
++  #else
++  #define MBEDTLS_PK_SIGNATURE_MAX_SIZE MBEDTLS_MPI_MAX_SIZE
++  #endif
++  #endif
++	size_t sig_len = MBEDTLS_PK_SIGNATURE_MAX_SIZE;
++	struct wpabuf *buf = wpabuf_alloc(sig_len);
++	if (buf == NULL)
++		return NULL;
++	if (mbedtls_pk_sign((mbedtls_pk_context *)key,
++	                    crypto_ec_key_sign_md(len), data, len,
++	                    wpabuf_mhead_u8(buf),
++  #if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
++	                    sig_len,
++  #endif
++	                    &sig_len,
++	                    mbedtls_ctr_drbg_random,
++	                    crypto_mbedtls_ctr_drbg()) == 0) {
++		wpabuf_put(buf, sig_len);
++		return buf;
++	}
++
++	wpabuf_free(buf);
++	return NULL;
++}
++
++#ifdef CRYPTO_MBEDTLS_CRYPTO_EC_DPP
++struct wpabuf * crypto_ec_key_sign_r_s(struct crypto_ec_key *key,
++				       const u8 *data, size_t len)
++{
++	mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)key);
++	if (ecp_kp == NULL)
++		return NULL;
++
++	size_t sig_len = MBEDTLS_ECDSA_MAX_LEN;
++	u8 buf[MBEDTLS_ECDSA_MAX_LEN];
++	if (mbedtls_ecdsa_write_signature(ecp_kp, crypto_ec_key_sign_md(len),
++	                                  data, len, buf,
++  #if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
++	                                  sig_len,
++  #endif
++	                                  &sig_len,
++	                                  mbedtls_ctr_drbg_random,
++	                                  crypto_mbedtls_ctr_drbg())) {
++		return NULL;
++	}
++
++	/*(mbedtls_ecdsa_write_signature() writes signature in ASN.1)*/
++	/* parse ASN.1 to get r and s and lengths */
++	u8 *p = buf, *r, *s;
++	u8 *end = p + sig_len;
++	size_t rlen, slen;
++	mbedtls_asn1_get_tag(&p, end, &rlen,
++	  MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
++	mbedtls_asn1_get_tag(&p, end, &rlen, MBEDTLS_ASN1_INTEGER);
++	r = p;
++	p += rlen;
++	mbedtls_asn1_get_tag(&p, end, &slen, MBEDTLS_ASN1_INTEGER);
++	s = p;
++
++	/* write raw r and s into out
++	 * (including removal of leading 0 if added for ASN.1 integer)
++	 * note: DPP caller expects raw r, s each padded to prime len */
++	mbedtls_ecp_group *ecp_kp_grp = &ecp_kp->MBEDTLS_PRIVATE(grp);
++	size_t plen = CRYPTO_EC_plen(ecp_kp_grp);
++	if (rlen > plen) {
++		r += (rlen - plen);
++		rlen = plen;
++	}
++	if (slen > plen) {
++		s += (slen - plen);
++		slen = plen;
++	}
++	struct wpabuf *out = wpabuf_alloc(plen*2);
++	if (out) {
++		wpabuf_put(out, plen*2);
++		p = wpabuf_mhead_u8(out);
++		os_memset(p, 0, plen*2);
++		os_memcpy(p+plen*1-rlen, r, rlen);
++		os_memcpy(p+plen*2-slen, s, slen);
++	}
++	return out;
++}
++#endif /* CRYPTO_MBEDTLS_CRYPTO_EC_DPP */
++
++int crypto_ec_key_verify_signature(struct crypto_ec_key *key, const u8 *data,
++				   size_t len, const u8 *sig, size_t sig_len)
++{
++	switch (mbedtls_pk_verify((mbedtls_pk_context *)key,
++	                          crypto_ec_key_sign_md(len), data, len,
++	                          sig, sig_len)) {
++	case 0:
++	/*case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:*//* XXX: allow? */
++		return 1;
++	case MBEDTLS_ERR_ECP_VERIFY_FAILED:
++		return 0;
++	default:
++		return -1;
++	}
++}
++
++#ifdef CRYPTO_MBEDTLS_CRYPTO_EC_DPP
++int crypto_ec_key_verify_signature_r_s(struct crypto_ec_key *key,
++				       const u8 *data, size_t len,
++				       const u8 *r, size_t r_len,
++				       const u8 *s, size_t s_len)
++{
++	/* reimplement mbedtls_ecdsa_read_signature() without encoding r and s
++	 * into ASN.1 just for mbedtls_ecdsa_read_signature() to decode ASN.1 */
++	mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)key);
++	if (ecp_kp == NULL)
++		return -1;
++	mbedtls_ecp_group *ecp_kp_grp = &ecp_kp->MBEDTLS_PRIVATE(grp);
++	mbedtls_ecp_point *ecp_kp_Q = &ecp_kp->MBEDTLS_PRIVATE(Q);
++
++	mbedtls_mpi mpi_r;
++	mbedtls_mpi mpi_s;
++	mbedtls_mpi_init(&mpi_r);
++	mbedtls_mpi_init(&mpi_s);
++	int ret = mbedtls_mpi_read_binary(&mpi_r, r, r_len)
++	       || mbedtls_mpi_read_binary(&mpi_s, s, s_len) ? -1 : 0;
++	if (ret == 0) {
++		ret = mbedtls_ecdsa_verify(ecp_kp_grp, data, len,
++		                           ecp_kp_Q, &mpi_r, &mpi_s);
++		ret = ret ? ret == MBEDTLS_ERR_ECP_BAD_INPUT_DATA ? 0 : -1 : 1;
++	}
++	mbedtls_mpi_free(&mpi_r);
++	mbedtls_mpi_free(&mpi_s);
++	return ret;
++}
++#endif /* CRYPTO_MBEDTLS_CRYPTO_EC_DPP */
++
++int crypto_ec_key_group(struct crypto_ec_key *key)
++{
++	mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)key);
++	if (ecp_kp == NULL)
++		return -1;
++	mbedtls_ecp_group *ecp_group = &ecp_kp->MBEDTLS_PRIVATE(grp);
++	return crypto_mbedtls_ike_id_from_ecp_group_id(ecp_group->id);
++}
++
++#ifdef CRYPTO_MBEDTLS_CRYPTO_EC_DPP
++
++int crypto_ec_key_cmp(struct crypto_ec_key *key1, struct crypto_ec_key *key2)
++{
++#if 0 /*(DPP is passing two public keys; unable to use pk_check_pair())*/
++  #if MBEDTLS_VERSION_NUMBER < 0x03000000 /* mbedtls 3.0.0 */
++	return mbedtls_pk_check_pair((const mbedtls_pk_context *)key1,
++	                             (const mbedtls_pk_context *)key2) ? -1 : 0;
++  #else
++	return mbedtls_pk_check_pair((const mbedtls_pk_context *)key1,
++	                             (const mbedtls_pk_context *)key2,
++	                             mbedtls_ctr_drbg_random,
++	                             crypto_mbedtls_ctr_drbg()) ? -1 : 0;
++  #endif
++#else
++	mbedtls_ecp_keypair *ecp_kp1=mbedtls_pk_ec(*(mbedtls_pk_context *)key1);
++	mbedtls_ecp_keypair *ecp_kp2=mbedtls_pk_ec(*(mbedtls_pk_context *)key2);
++	if (ecp_kp1 == NULL || ecp_kp2 == NULL)
++		return -1;
++	mbedtls_ecp_group *ecp_kp1_grp = &ecp_kp1->MBEDTLS_PRIVATE(grp);
++	mbedtls_ecp_group *ecp_kp2_grp = &ecp_kp2->MBEDTLS_PRIVATE(grp);
++	mbedtls_ecp_point *ecp_kp1_Q = &ecp_kp1->MBEDTLS_PRIVATE(Q);
++	mbedtls_ecp_point *ecp_kp2_Q = &ecp_kp2->MBEDTLS_PRIVATE(Q);
++	return ecp_kp1_grp->id != ecp_kp2_grp->id
++	    || mbedtls_ecp_point_cmp(ecp_kp1_Q, ecp_kp2_Q) ? -1 : 0;
++#endif
++}
++
++void crypto_ec_key_debug_print(const struct crypto_ec_key *key,
++			       const char *title)
++{
++	/* TBD: what info is desirable here and in what human readable format?*/
++	/*(crypto_openssl.c prints a human-readably public key and attributes)*/
++  #if 0
++	struct mbedtls_pk_debug_item debug_item;
++	if (mbedtls_pk_debug((const mbedtls_pk_context *)key, &debug_item))
++		return;
++	/* ... */
++  #endif
++	wpa_printf(MSG_DEBUG, "%s: %s not implemented", title, __func__);
++}
++
++#endif /* CRYPTO_MBEDTLS_CRYPTO_EC_DPP */
++
++#endif /* CRYPTO_MBEDTLS_CRYPTO_EC */
++
++
++#ifdef CRYPTO_MBEDTLS_CRYPTO_CSR
++
++#include <mbedtls/x509_csr.h>
++#include <mbedtls/oid.h>
++
++struct crypto_csr * crypto_csr_init(void)
++{
++	mbedtls_x509write_csr *csr = os_malloc(sizeof(*csr));
++	if (csr != NULL)
++		mbedtls_x509write_csr_init(csr);
++	return (struct crypto_csr *)csr;
++}
++
++struct crypto_csr * crypto_csr_verify(const struct wpabuf *req)
++{
++	/* future: look for alternatives to MBEDTLS_PRIVATE() access */
++
++	/* sole caller src/common/dpp_crypto.c:dpp_validate_csr()
++	 * uses (mbedtls_x509_csr *) to obtain CSR_ATTR_CHALLENGE_PASSWORD
++	 * so allocate different object (mbedtls_x509_csr *) and special-case
++	 * object when used in crypto_csr_get_attribute() and when free()d in
++	 * crypto_csr_deinit(). */
++
++	mbedtls_x509_csr *csr = os_malloc(sizeof(*csr));
++	if (csr == NULL)
++		return NULL;
++	mbedtls_x509_csr_init(csr);
++	const mbedtls_md_info_t *md_info;
++	unsigned char digest[MBEDTLS_MD_MAX_SIZE];
++	if (mbedtls_x509_csr_parse_der(csr,wpabuf_head(req),wpabuf_len(req))==0
++	    && (md_info=mbedtls_md_info_from_type(csr->MBEDTLS_PRIVATE(sig_md)))
++	       != NULL
++	    && mbedtls_md(md_info, csr->cri.p, csr->cri.len, digest) == 0) {
++		switch (mbedtls_pk_verify(&csr->pk,csr->MBEDTLS_PRIVATE(sig_md),
++		                          digest, mbedtls_md_get_size(md_info),
++		                          csr->MBEDTLS_PRIVATE(sig).p,
++		                          csr->MBEDTLS_PRIVATE(sig).len)) {
++		case 0:
++		/*case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:*//* XXX: allow? */
++			return (struct crypto_csr *)((uintptr_t)csr | 1uL);
++		default:
++			break;
++		}
++	}
++
++	mbedtls_x509_csr_free(csr);
++	os_free(csr);
++	return NULL;
++}
++
++void crypto_csr_deinit(struct crypto_csr *csr)
++{
++	if ((uintptr_t)csr & 1uL) {
++		csr = (struct crypto_csr *)((uintptr_t)csr & ~1uL);
++		mbedtls_x509_csr_free((mbedtls_x509_csr *)csr);
++	}
++	else
++		mbedtls_x509write_csr_free((mbedtls_x509write_csr *)csr);
++	os_free(csr);
++}
++
++int crypto_csr_set_ec_public_key(struct crypto_csr *csr,
++				 struct crypto_ec_key *key)
++{
++	mbedtls_x509write_csr_set_key((mbedtls_x509write_csr *)csr,
++	                              (mbedtls_pk_context *)key);
++	return 0;
++}
++
++int crypto_csr_set_name(struct crypto_csr *csr, enum crypto_csr_name type,
++			const char *name)
++{
++	/* specialized for src/common/dpp_crypto.c */
++
++	/* sole caller src/common/dpp_crypto.c:dpp_build_csr()
++	 * calls this function only once, using type == CSR_NAME_CN
++	 * (If called more than once, this code would need to append
++	 *  components to the subject name, which we could do by
++	 *  appending to (mbedtls_x509write_csr *) private member
++	 *  mbedtls_asn1_named_data *MBEDTLS_PRIVATE(subject)) */
++
++	const char *label;
++	switch (type) {
++	case CSR_NAME_CN: label = "CN="; break;
++	case CSR_NAME_SN: label = "SN="; break;
++	case CSR_NAME_C:  label = "C=";  break;
++	case CSR_NAME_O:  label = "O=";  break;
++	case CSR_NAME_OU: label = "OU="; break;
++	default: return -1;
++	}
++
++	size_t len = strlen(name);
++	struct wpabuf *buf = wpabuf_alloc(3+len+1);
++	if (buf == NULL)
++		return -1;
++	wpabuf_put_data(buf, label, strlen(label));
++	wpabuf_put_data(buf, name, len+1); /*(include trailing '\0')*/
++	/* Note: 'name' provided is set as given and should be backslash-escaped
++	 * by caller when necessary, e.g. literal ',' which are not separating
++	 * components should be backslash-escaped */
++
++	int ret =
++	  mbedtls_x509write_csr_set_subject_name((mbedtls_x509write_csr *)csr,
++	                                         wpabuf_head(buf)) ? -1 : 0;
++	wpabuf_free(buf);
++	return ret;
++}
++
++/* OBJ_pkcs9_challengePassword  1 2 840 113549 1 9 7 */
++static const char OBJ_pkcs9_challengePassword[] = MBEDTLS_OID_PKCS9 "\x07";
++
++int crypto_csr_set_attribute(struct crypto_csr *csr, enum crypto_csr_attr attr,
++			     int attr_type, const u8 *value, size_t len)
++{
++	/* specialized for src/common/dpp_crypto.c */
++	/* sole caller src/common/dpp_crypto.c:dpp_build_csr() passes
++	 *   attr      == CSR_ATTR_CHALLENGE_PASSWORD
++	 *   attr_type == ASN1_TAG_UTF8STRING */
++
++	const char *oid;
++	size_t oid_len;
++	switch (attr) {
++	case CSR_ATTR_CHALLENGE_PASSWORD:
++		oid = OBJ_pkcs9_challengePassword;
++		oid_len = sizeof(OBJ_pkcs9_challengePassword)-1;
++		break;
++	default:
++		return -1;
++	}
++
++  #if 0 /*(incorrect; sets an extension, not an attribute)*/
++	return mbedtls_x509write_csr_set_extension((mbedtls_x509write_csr *)csr,
++	                                           oid, oid_len,
++	  #if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
++	                                           0, /*(critical flag)*/
++	  #endif
++	                                           value, len) ? -1 : 0;
++  #else
++	(void)oid;
++	(void)oid_len;
++  #endif
++
++	/* mbedtls does not currently provide way to set an attribute in a CSR:
++	 *   https://github.com/Mbed-TLS/mbedtls/issues/4886 */
++	wpa_printf(MSG_ERROR,
++	  "mbedtls does not currently support setting challengePassword "
++	  "attribute in CSR");
++	return -1;
++}
++
++const u8 * mbedtls_x509_csr_attr_oid_value(mbedtls_x509_csr *csr,
++                                           const char *oid, size_t oid_len,
++                                           size_t *vlen, int *vtype)
++{
++	/* Note: mbedtls_x509_csr_parse_der() has parsed and validated CSR,
++	 *	   so validation checks are not repeated here
++	 *
++	 * It would be nicer if (mbedtls_x509_csr *) had an mbedtls_x509_buf of
++	 * Attributes (or at least a pointer) since mbedtls_x509_csr_parse_der()
++	 * already parsed the rest of CertificationRequestInfo, some of which is
++	 * repeated here to step to Attributes.  Since csr->subject_raw.p points
++	 * into csr->cri.p, which points into csr->raw.p, step over version and
++	 * subject of CertificationRequestInfo (SEQUENCE) */
++	unsigned char *p = csr->subject_raw.p + csr->subject_raw.len;
++	unsigned char *end = csr->cri.p + csr->cri.len, *ext;
++	size_t len;
++
++	/* step over SubjectPublicKeyInfo */
++	mbedtls_asn1_get_tag(&p, end, &len,
++	    MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
++	p += len;
++
++	/* Attributes
++	 *   { ATTRIBUTE:IOSet } ::= SET OF { SEQUENCE { OID, value } }
++	 */
++	if (mbedtls_asn1_get_tag(&p, end, &len,
++	      MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_CONTEXT_SPECIFIC) != 0) {
++		return NULL;
++	}
++	while (p < end) {
++		if (mbedtls_asn1_get_tag(&p, end, &len,
++		      MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE) != 0) {
++			return NULL;
++		}
++		ext = p;
++		p += len;
++
++		if (mbedtls_asn1_get_tag(&ext,end,&len,MBEDTLS_ASN1_OID) != 0)
++			return NULL;
++		if (oid_len != len || 0 != memcmp(ext, oid, oid_len))
++			continue;
++
++		/* found oid; return value */
++		*vtype = *ext++; /* tag */
++		return (mbedtls_asn1_get_len(&ext,end,vlen) == 0) ? ext : NULL;
++	}
++
++	return NULL;
++}
++
++const u8 * crypto_csr_get_attribute(struct crypto_csr *csr,
++				    enum crypto_csr_attr attr,
++				    size_t *len, int *type)
++{
++	/* specialized for src/common/dpp_crypto.c */
++	/* sole caller src/common/dpp_crypto.c:dpp_build_csr() passes
++	 *   attr == CSR_ATTR_CHALLENGE_PASSWORD */
++
++	const char *oid;
++	size_t oid_len;
++	switch (attr) {
++	case CSR_ATTR_CHALLENGE_PASSWORD:
++		oid = OBJ_pkcs9_challengePassword;
++		oid_len = sizeof(OBJ_pkcs9_challengePassword)-1;
++		break;
++	default:
++		return NULL;
++	}
++
++	/* see crypto_csr_verify(); expecting (mbedtls_x509_csr *) tagged |=1 */
++	if (!((uintptr_t)csr & 1uL))
++		return NULL;
++	csr = (struct crypto_csr *)((uintptr_t)csr & ~1uL);
++
++	return mbedtls_x509_csr_attr_oid_value((mbedtls_x509_csr *)csr,
++	                                       oid, oid_len, len, type);
++}
++
++struct wpabuf * crypto_csr_sign(struct crypto_csr *csr,
++				struct crypto_ec_key *key,
++				enum crypto_hash_alg algo)
++{
++	mbedtls_md_type_t sig_md;
++	switch (algo) {
++  #ifdef MBEDTLS_SHA256_C
++	case CRYPTO_HASH_ALG_SHA256: sig_md = MBEDTLS_MD_SHA256; break;
++  #endif
++  #ifdef MBEDTLS_SHA512_C
++	case CRYPTO_HASH_ALG_SHA384: sig_md = MBEDTLS_MD_SHA384; break;
++	case CRYPTO_HASH_ALG_SHA512: sig_md = MBEDTLS_MD_SHA512; break;
++  #endif
++	default:
++		return NULL;
++	}
++	mbedtls_x509write_csr_set_md_alg((mbedtls_x509write_csr *)csr, sig_md);
++
++  #if 0
++	unsigned char key_usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE
++	                        | MBEDTLS_X509_KU_KEY_CERT_SIGN;
++	if (mbedtls_x509write_csr_set_key_usage((mbedtls_x509write_csr *)csr,
++	                                        key_usage))
++		return NULL;
++  #endif
++
++  #if 0
++	unsigned char ns_cert_type = MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT
++	                           | MBEDTLS_X509_NS_CERT_TYPE_EMAIL;
++	if (mbedtls_x509write_csr_set_ns_cert_type((mbedtls_x509write_csr *)csr,
++	                                           ns_cert_type))
++		return NULL;
++  #endif
++
++  #if 0
++	/* mbedtls does not currently provide way to set an attribute in a CSR:
++	 *   https://github.com/Mbed-TLS/mbedtls/issues/4886
++	 * XXX: hwsim dpp_enterprise test fails due to this limitation.
++	 *
++	 * Current usage of this function is solely by dpp_build_csr(),
++	 * so as a kludge, might consider custom (struct crypto_csr *)
++	 * containing (mbedtls_x509write_csr *) and a list of attributes
++	 * (i.e. challengePassword).  Might have to totally reimplement
++	 * mbedtls_x509write_csr_der(); underlying x509write_csr_der_internal()
++	 * handles signing the CSR.  (This is more work that appending an
++	 * Attributes section to end of CSR and adjusting ASN.1 length of CSR.)
++	 */
++  #endif
++
++	unsigned char buf[4096]; /* XXX: large enough?  too large? */
++	int len = mbedtls_x509write_csr_der((mbedtls_x509write_csr *)csr,
++	                                    buf, sizeof(buf),
++	                                    mbedtls_ctr_drbg_random,
++	                                    crypto_mbedtls_ctr_drbg());
++	if (len < 0)
++		return NULL;
++	/*  Note: data is written at the end of the buffer! Use the
++	 *        return value to determine where you should start
++	 *        using the buffer */
++	return wpabuf_alloc_copy(buf+sizeof(buf)-len, (size_t)len);
++}
++
++#endif /* CRYPTO_MBEDTLS_CRYPTO_CSR */
++
++
++#ifdef CRYPTO_MBEDTLS_CRYPTO_PKCS7
++
++#if 0
++#include <mbedtls/pkcs7.h> /* PKCS7 is not currently supported in mbedtls */
++#include <mbedtls/pem.h>
++#endif
++
++struct wpabuf * crypto_pkcs7_get_certificates(const struct wpabuf *pkcs7)
++{
++	/* PKCS7 is not currently supported in mbedtls */
++	return NULL;
++
++#if 0
++	/* https://github.com/naynajain/mbedtls-1 branch: development-pkcs7
++	 * (??? potential future contribution to mbedtls ???) */
++
++	/* Note: PKCS7 signature *is not* verified by this function.
++	 * The function interface does not provide for passing a certificate */
++
++	mbedtls_pkcs7 mpkcs7;
++	mbedtls_pkcs7_init(&mpkcs7);
++	int pkcs7_type = mbedtls_pkcs7_parse_der(wpabuf_head(pkcs7),
++	                                         wpabuf_len(pkcs7),
++	                                         &mpkcs7);
++	wpabuf *buf = NULL;
++	do {
++		if (pkcs7_type < 0)
++			break;
++
++		/* src/common/dpp.c:dpp_parse_cred_dot1x() interested in certs
++		 * for wpa_supplicant/dpp_supplicant.c:wpas_dpp_add_network()
++		 * (? are adding certificate headers and footers desired ?) */
++
++		/* development-pkcs7 branch does not currently provide
++		 * additional interfaces to retrieve the parsed data */
++
++		mbedtls_x509_crt *certs =
++		  &mpkcs7.MBEDTLS_PRIVATE(signed_data).MBEDTLS_PRIVATE(certs);
++		int ncerts =
++		  mpkcs7.MBEDTLS_PRIVATE(signed_data).MBEDTLS_PRIVATE(no_of_certs);
++
++		/* allocate buffer for PEM (base64-encoded DER)
++		 * plus header, footer, newlines, and some extra */
++		buf = wpabuf_alloc((wpabuf_len(pkcs7)+2)/3*4 + ncerts*64);
++		if (buf == NULL)
++			break;
++
++		#define PEM_BEGIN_CRT "-----BEGIN CERTIFICATE-----\n"
++		#define PEM_END_CRT   "-----END CERTIFICATE-----\n"
++		size_t olen;
++		for (int i = 0; i < ncerts; ++i) {
++			int ret = mbedtls_pem_write_buffer(
++			            PEM_BEGIN_CRT, PEM_END_CRT,
++			            certs[i].raw.p, certs[i].raw.len,
++			            wpabuf_mhead(buf, 0), wpabuf_tailroom(buf),
++			            &olen));
++			if (ret == 0)
++				wpabuf_put(buf, olen);
++			} else {
++				if (ret == MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL)
++					ret = wpabuf_resize(
++					        &buf,olen-wpabuf_tailroom(buf));
++				if (ret == 0) {
++					--i;/*(adjust loop iterator for retry)*/
++					continue;
++				}
++				wpabuf_free(buf);
++				buf = NULL;
++				break;
++			}
++		}
++	} while (0);
++
++	mbedtls_pkcs7_free(&mpkcs7);
++	return buf;
++#endif
++}
++
++#endif /* CRYPTO_MBEDTLS_CRYPTO_PKCS7 */
++
++
++#ifdef MBEDTLS_ARC4_C
++#include <mbedtls/arc4.h>
++int rc4_skip(const u8 *key, size_t keylen, size_t skip,
++	     u8 *data, size_t data_len)
++{
++	mbedtls_arc4_context ctx;
++	mbedtls_arc4_init(&ctx);
++	mbedtls_arc4_setup(&ctx, key, keylen);
++
++	if (skip) {
++		/*(prefer [16] on ancient hardware with smaller cache lines)*/
++		unsigned char skip_buf[64]; /*('skip' is generally small)*/
++		/*os_memset(skip_buf, 0, sizeof(skip_buf));*/ /*(necessary?)*/
++		size_t len;
++		do {
++			len = skip > sizeof(skip_buf) ? sizeof(skip_buf) : skip;
++			mbedtls_arc4_crypt(&ctx, len, skip_buf, skip_buf);
++		} while ((skip -= len));
++	}
++
++	int ret = mbedtls_arc4_crypt(&ctx, data_len, data, data);
++	mbedtls_arc4_free(&ctx);
++	return ret;
++}
++#endif
++
++
++/* duplicated in tls_mbedtls.c:tls_mbedtls_readfile()*/
++__attribute_noinline__
++static int crypto_mbedtls_readfile(const char *path, u8 **buf, size_t *n)
++{
++  #if 0 /* #ifdef MBEDTLS_FS_IO */
++	/*(includes +1 for '\0' needed by mbedtls PEM parsing funcs)*/
++	if (mbedtls_pk_load_file(path, (unsigned char **)buf, n) != 0) {
++		wpa_printf(MSG_ERROR, "error: mbedtls_pk_load_file %s", path);
++		return -1;
++	}
++  #else
++	/*(use os_readfile() so that we can use os_free()
++	 *(if we use mbedtls_pk_load_file() above, macros prevent calling free()
++	 * directly #if defined(OS_REJECT_C_LIB_FUNCTIONS) and calling os_free()
++	 * on buf aborts in tests if buf not allocated via os_malloc())*/
++	*buf = (u8 *)os_readfile(path, n);
++	if (!*buf) {
++		wpa_printf(MSG_ERROR, "error: os_readfile %s", path);
++		return -1;
++	}
++	u8 *buf0 = os_realloc(*buf, *n+1);
++	if (!buf0) {
++		bin_clear_free(*buf, *n);
++		*buf = NULL;
++		return -1;
++	}
++	buf0[(*n)++] = '\0';
++	*buf = buf0;
++  #endif
++	return 0;
++}
++
++
++#ifdef CRYPTO_MBEDTLS_CRYPTO_RSA
++#ifdef MBEDTLS_RSA_C
++
++#include <mbedtls/pk.h>
++#include <mbedtls/rsa.h>
++
++struct crypto_rsa_key * crypto_rsa_key_read(const char *file, bool private_key)
++{
++	/* mbedtls_pk_parse_keyfile() and mbedtls_pk_parse_public_keyfile()
++	 * require #ifdef MBEDTLS_FS_IO in mbedtls library.  Prefer to use
++	 * crypto_mbedtls_readfile(), which wraps os_readfile() */
++	u8 *data;
++	size_t len;
++	if (crypto_mbedtls_readfile(file, &data, &len) != 0)
++		return NULL;
++
++	mbedtls_pk_context *ctx = os_malloc(sizeof(*ctx));
++	if (ctx == NULL) {
++		bin_clear_free(data, len);
++		return NULL;
++	}
++	mbedtls_pk_init(ctx);
++
++	int rc;
++	rc = (private_key
++	      ? mbedtls_pk_parse_key(ctx, data, len, NULL, 0
++	  #if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
++	                            ,mbedtls_ctr_drbg_random,
++	                             crypto_mbedtls_ctr_drbg()
++	  #endif
++	                            )
++	      : mbedtls_pk_parse_public_key(ctx, data, len)) == 0
++	    && mbedtls_pk_can_do(ctx, MBEDTLS_PK_RSA);
++
++	bin_clear_free(data, len);
++
++	if (rc) {
++		/* use MBEDTLS_RSA_PKCS_V21 padding for RSAES-OAEP */
++		/* use MBEDTLS_MD_SHA256 for these hostap interfaces */
++	  #if MBEDTLS_VERSION_NUMBER < 0x03000000 /* mbedtls 3.0.0 */
++		/*(no return value in mbedtls 2.x)*/
++		mbedtls_rsa_set_padding(mbedtls_pk_rsa(*ctx),
++		                        MBEDTLS_RSA_PKCS_V21,
++		                        MBEDTLS_MD_SHA256);
++	  #else
++		if (mbedtls_rsa_set_padding(mbedtls_pk_rsa(*ctx),
++		                            MBEDTLS_RSA_PKCS_V21,
++		                            MBEDTLS_MD_SHA256) == 0)
++	  #endif
++			return (struct crypto_rsa_key *)ctx;
++	}
++
++	mbedtls_pk_free(ctx);
++	os_free(ctx);
++	return NULL;
++}
++
++struct wpabuf * crypto_rsa_oaep_sha256_encrypt(struct crypto_rsa_key *key,
++					       const struct wpabuf *in)
++{
++	mbedtls_rsa_context *pk_rsa = mbedtls_pk_rsa(*(mbedtls_pk_context*)key);
++	size_t olen = mbedtls_rsa_get_len(pk_rsa);
++	struct wpabuf *buf = wpabuf_alloc(olen);
++	if (buf == NULL)
++		return NULL;
++
++	/* mbedtls_pk_encrypt() takes a few more hops to get to same func */
++	if (mbedtls_rsa_rsaes_oaep_encrypt(pk_rsa,
++	                                   mbedtls_ctr_drbg_random,
++	                                   crypto_mbedtls_ctr_drbg(),
++	  #if MBEDTLS_VERSION_NUMBER < 0x03000000 /* mbedtls 3.0.0 */
++	                                   MBEDTLS_RSA_PRIVATE,
++	  #endif
++	                                   NULL, 0,
++	                                   wpabuf_len(in), wpabuf_head(in),
++	                                   wpabuf_put(buf, olen)) == 0) {
++		return buf;
++	}
++
++	wpabuf_clear_free(buf);
++	return NULL;
++}
++
++struct wpabuf * crypto_rsa_oaep_sha256_decrypt(struct crypto_rsa_key *key,
++					       const struct wpabuf *in)
++{
++	mbedtls_rsa_context *pk_rsa = mbedtls_pk_rsa(*(mbedtls_pk_context*)key);
++	size_t olen = mbedtls_rsa_get_len(pk_rsa);
++	struct wpabuf *buf = wpabuf_alloc(olen);
++	if (buf == NULL)
++		return NULL;
++
++	/* mbedtls_pk_decrypt() takes a few more hops to get to same func */
++	if (mbedtls_rsa_rsaes_oaep_decrypt(pk_rsa,
++	                                   mbedtls_ctr_drbg_random,
++	                                   crypto_mbedtls_ctr_drbg(),
++	  #if MBEDTLS_VERSION_NUMBER < 0x03000000 /* mbedtls 3.0.0 */
++	                                   MBEDTLS_RSA_PUBLIC,
++	  #endif
++	                                   NULL, 0, &olen, wpabuf_head(in),
++	                                   wpabuf_mhead(buf), olen) == 0) {
++		wpabuf_put(buf, olen);
++		return buf;
++	}
++
++	wpabuf_clear_free(buf);
++	return NULL;
++}
++
++void crypto_rsa_key_free(struct crypto_rsa_key *key)
++{
++	mbedtls_pk_free((mbedtls_pk_context *)key);
++	os_free(key);
++}
++
++#endif /* MBEDTLS_RSA_C */
++#endif /* CRYPTO_MBEDTLS_CRYPTO_RSA */
++
++#ifdef CRYPTO_MBEDTLS_CRYPTO_HPKE
++
++struct wpabuf * hpke_base_seal(enum hpke_kem_id kem_id,
++			       enum hpke_kdf_id kdf_id,
++			       enum hpke_aead_id aead_id,
++			       struct crypto_ec_key *peer_pub,
++			       const u8 *info, size_t info_len,
++			       const u8 *aad, size_t aad_len,
++			       const u8 *pt, size_t pt_len)
++{
++	/* not yet implemented */
++	return NULL;
++}
++
++struct wpabuf * hpke_base_open(enum hpke_kem_id kem_id,
++			       enum hpke_kdf_id kdf_id,
++			       enum hpke_aead_id aead_id,
++			       struct crypto_ec_key *own_priv,
++			       const u8 *info, size_t info_len,
++			       const u8 *aad, size_t aad_len,
++			       const u8 *enc_ct, size_t enc_ct_len)
++{
++	/* not yet implemented */
++	return NULL;
++}
++
++#endif
+--- /dev/null
++++ b/src/crypto/tls_mbedtls.c
+@@ -0,0 +1,3313 @@
++/*
++ * SSL/TLS interface functions for mbed TLS
++ *
++ * SPDX-FileCopyrightText: 2022 Glenn Strauss <gstrauss@gluelogic.com>
++ * SPDX-License-Identifier: BSD-3-Clause
++ *
++ * This software may be distributed under the terms of the BSD license.
++ * See README for more details.
++ *
++ * template:  src/crypto/tls_none.c
++ * reference: src/crypto/tls_*.c
++ *
++ * Known Limitations:
++ * - no TLSv1.3 (not available in mbedtls 2.x; experimental in mbedtls 3.x)
++ * - no OCSP (not yet available in mbedtls)
++ * - mbedtls does not support all certificate encodings used by hwsim tests
++ *   PCKS#5 v1.5
++ *   PCKS#12
++ *   DH DSA
++ * - EAP-FAST, EAP-TEAP session ticket support not implemented in tls_mbedtls.c
++ * - mbedtls does not currently provide way to set an attribute in a CSR
++ *     https://github.com/Mbed-TLS/mbedtls/issues/4886
++ *   so tests/hwsim dpp_enterprise tests fail
++ * - DPP2 not supported
++ *   PKCS#7 parsing is not supported in mbedtls
++ *   See crypto_mbedtls.c:crypto_pkcs7_get_certificates() comments
++ * - DPP3 not supported
++ *   hpke_base_seal() and hpke_base_seal() not implemented in crypto_mbedtls.c
++ *
++ * Status:
++ * - code written to be compatible with mbedtls 2.x and mbedtls 3.x
++ *   (currently requires mbedtls >= 2.27.0 for mbedtls_mpi_random())
++ *   (currently requires mbedtls >= 2.18.0 for mbedtls_ssl_tls_prf())
++ * - builds with tests/build/build-wpa_supplicant-mbedtls.config
++ * - passes all tests/ crypto module tests (incomplete coverage)
++ *   ($ cd tests; make clean; make -j 4 run-tests CONFIG_TLS=mbedtls)
++ * - passes almost all tests/hwsim tests
++ *   (hwsim tests skipped for missing features)
++ *
++ * RFE:
++ * - EAP-FAST, EAP-TEAP session ticket support not implemented in tls_mbedtls.c
++ * - client/server session resumption, and/or save client session ticket
++ */
++
++#include "includes.h"
++#include "common.h"
++
++#include <mbedtls/version.h>
++#include <mbedtls/ctr_drbg.h>
++#include <mbedtls/error.h>
++#include <mbedtls/oid.h>
++#include <mbedtls/pem.h>
++#include <mbedtls/platform.h> /* mbedtls_calloc() mbedtls_free() */
++#include <mbedtls/platform_util.h> /* mbedtls_platform_zeroize() */
++#include <mbedtls/ssl.h>
++#include <mbedtls/ssl_ticket.h>
++#include <mbedtls/x509.h>
++#include <mbedtls/x509_crt.h>
++
++#if MBEDTLS_VERSION_NUMBER >= 0x02040000 /* mbedtls 2.4.0 */
++#include <mbedtls/net_sockets.h>
++#else
++#include <mbedtls/net.h>
++#endif
++
++#ifndef MBEDTLS_PRIVATE
++#define MBEDTLS_PRIVATE(x) x
++#endif
++
++#if MBEDTLS_VERSION_NUMBER < 0x03020000 /* mbedtls 3.2.0 */
++#define mbedtls_ssl_get_ciphersuite_id_from_ssl(ssl) \
++        ((ssl)->MBEDTLS_PRIVATE(session) \
++        ?(ssl)->MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(ciphersuite) \
++        : 0)
++#define mbedtls_ssl_ciphersuite_get_name(info) \
++        (info)->MBEDTLS_PRIVATE(name)
++#endif
++
++#include "crypto.h"     /* sha256_vector() */
++#include "tls.h"
++
++#ifndef SHA256_DIGEST_LENGTH
++#define SHA256_DIGEST_LENGTH 32
++#endif
++
++#ifndef MBEDTLS_EXPKEY_FIXED_SECRET_LEN
++#define MBEDTLS_EXPKEY_FIXED_SECRET_LEN 48
++#endif
++
++#ifndef MBEDTLS_EXPKEY_RAND_LEN
++#define MBEDTLS_EXPKEY_RAND_LEN 32
++#endif
++
++#if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
++static mbedtls_ssl_export_keys_t tls_connection_export_keys_cb;
++#elif MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */
++static mbedtls_ssl_export_keys_ext_t tls_connection_export_keys_cb;
++#else /*(not implemented; return error)*/
++#define mbedtls_ssl_tls_prf(a,b,c,d,e,f,g,h) (-1)
++typedef mbedtls_tls_prf_types int;
++#endif
++
++
++/* hostapd/wpa_supplicant provides forced_memzero(),
++ * but prefer mbedtls_platform_zeroize() */
++#define forced_memzero(ptr,sz) mbedtls_platform_zeroize(ptr,sz)
++
++
++#if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST) \
++ || defined(EAP_TEAP) || defined(EAP_SERVER_TEAP)
++#ifdef MBEDTLS_SSL_SESSION_TICKETS
++#ifdef MBEDTLS_SSL_TICKET_C
++#define TLS_MBEDTLS_SESSION_TICKETS
++#if defined(EAP_TEAP) || defined(EAP_SERVER_TEAP)
++#define TLS_MBEDTLS_EAP_TEAP
++#endif
++#if !defined(CONFIG_FIPS) /* EAP-FAST keys cannot be exported in FIPS mode */
++#if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
++#define TLS_MBEDTLS_EAP_FAST
++#endif
++#endif
++#endif
++#endif
++#endif
++
++
++struct tls_conf {
++	mbedtls_ssl_config conf;
++
++	unsigned int verify_peer:1;
++	unsigned int verify_depth0_only:1;
++	unsigned int check_crl:2;           /*(needs :2 bits for 0, 1, 2)*/
++	unsigned int check_crl_strict:1;    /*(needs :1 bit  for 0, 1)*/
++	unsigned int ca_cert_probe:1;
++	unsigned int has_ca_cert:1;
++	unsigned int has_client_cert:1;
++	unsigned int has_private_key:1;
++	unsigned int suiteb128:1;
++	unsigned int suiteb192:1;
++	mbedtls_x509_crl *crl;
++	mbedtls_x509_crt ca_cert;
++	mbedtls_x509_crt client_cert;
++	mbedtls_pk_context private_key;
++
++	uint32_t refcnt;
++
++	unsigned int flags;
++	char *subject_match;
++	char *altsubject_match;
++	char *suffix_match;
++	char *domain_match;
++	char *check_cert_subject;
++	u8 ca_cert_hash[SHA256_DIGEST_LENGTH];
++
++	int *ciphersuites;  /* list of ciphersuite ids for mbedtls_ssl_config */
++#if MBEDTLS_VERSION_NUMBER < 0x03010000 /* mbedtls 3.1.0 */
++	mbedtls_ecp_group_id *curves;
++#else
++	uint16_t *curves;   /* list of curve ids for mbedtls_ssl_config */
++#endif
++};
++
++
++struct tls_global {
++	struct tls_conf *tls_conf;
++	char *ocsp_stapling_response;
++	mbedtls_ctr_drbg_context *ctr_drbg; /*(see crypto_mbedtls.c)*/
++  #ifdef MBEDTLS_SSL_SESSION_TICKETS
++	mbedtls_ssl_ticket_context ticket_ctx;
++  #endif
++	char *ca_cert_file;
++	struct os_reltime crl_reload_previous;
++	unsigned int crl_reload_interval;
++	uint32_t refcnt;
++	struct tls_config init_conf;
++};
++
++static struct tls_global tls_ctx_global;
++
++
++struct tls_connection {
++	struct tls_conf *tls_conf;
++	struct wpabuf *push_buf;
++	struct wpabuf *pull_buf;
++	size_t pull_buf_offset;
++
++	unsigned int established:1;
++	unsigned int resumed:1;
++	unsigned int verify_peer:1;
++	unsigned int is_server:1;
++
++	mbedtls_ssl_context ssl;
++
++	mbedtls_tls_prf_types tls_prf_type;
++	size_t expkey_keyblock_size;
++	size_t expkey_secret_len;
++  #if MBEDTLS_VERSION_NUMBER < 0x03000000 /* mbedtls 3.0.0 */
++	unsigned char expkey_secret[MBEDTLS_EXPKEY_FIXED_SECRET_LEN];
++  #else
++	unsigned char expkey_secret[MBEDTLS_MD_MAX_SIZE];
++  #endif
++	unsigned char expkey_randbytes[MBEDTLS_EXPKEY_RAND_LEN*2];
++
++	int read_alerts, write_alerts, failed;
++
++  #ifdef TLS_MBEDTLS_SESSION_TICKETS
++	tls_session_ticket_cb session_ticket_cb;
++	void *session_ticket_cb_ctx;
++	unsigned char *clienthello_session_ticket;
++	size_t clienthello_session_ticket_len;
++  #endif
++	char *peer_subject; /* peer subject info for authenticated peer */
++	struct wpabuf *success_data;
++};
++
++
++#ifndef __has_attribute
++#define __has_attribute(x) 0
++#endif
++
++#ifndef __GNUC_PREREQ
++#define __GNUC_PREREQ(maj,min) 0
++#endif
++
++#ifndef __attribute_cold__
++#if __has_attribute(cold) \
++ || __GNUC_PREREQ(4,3)
++#define __attribute_cold__  __attribute__((__cold__))
++#else
++#define __attribute_cold__
++#endif
++#endif
++
++#ifndef __attribute_noinline__
++#if __has_attribute(noinline) \
++ || __GNUC_PREREQ(3,1)
++#define __attribute_noinline__  __attribute__((__noinline__))
++#else
++#define __attribute_noinline__
++#endif
++#endif
++
++
++__attribute_cold__
++__attribute_noinline__
++static void emsg(int level, const char * const msg)
++{
++	wpa_printf(level, "MTLS: %s", msg);
++}
++
++
++__attribute_cold__
++__attribute_noinline__
++static void emsgrc(int level, const char * const msg, int rc)
++{
++  #ifdef MBEDTLS_ERROR_C
++	/* error logging convenience function that decodes mbedtls result codes */
++	char buf[256];
++	mbedtls_strerror(rc, buf, sizeof(buf));
++	wpa_printf(level, "MTLS: %s: %s (-0x%04x)", msg, buf, -rc);
++  #else
++	wpa_printf(level, "MTLS: %s: (-0x%04x)", msg, -rc);
++  #endif
++}
++
++
++#define elog(rc, msg) emsgrc(MSG_ERROR, (msg), (rc))
++#define ilog(rc, msg) emsgrc(MSG_INFO,  (msg), (rc))
++
++
++struct tls_conf * tls_conf_init(void *tls_ctx)
++{
++	struct tls_conf *tls_conf = os_zalloc(sizeof(*tls_conf));
++	if (tls_conf == NULL)
++		return NULL;
++	tls_conf->refcnt = 1;
++
++	mbedtls_ssl_config_init(&tls_conf->conf);
++	mbedtls_ssl_conf_rng(&tls_conf->conf,
++			     mbedtls_ctr_drbg_random, tls_ctx_global.ctr_drbg);
++	mbedtls_x509_crt_init(&tls_conf->ca_cert);
++	mbedtls_x509_crt_init(&tls_conf->client_cert);
++	mbedtls_pk_init(&tls_conf->private_key);
++
++	return tls_conf;
++}
++
++
++void tls_conf_deinit(struct tls_conf *tls_conf)
++{
++	if (tls_conf == NULL || --tls_conf->refcnt != 0)
++		return;
++
++	mbedtls_x509_crt_free(&tls_conf->ca_cert);
++	mbedtls_x509_crt_free(&tls_conf->client_cert);
++	if (tls_conf->crl) {
++		mbedtls_x509_crl_free(tls_conf->crl);
++		os_free(tls_conf->crl);
++	}
++	mbedtls_pk_free(&tls_conf->private_key);
++	mbedtls_ssl_config_free(&tls_conf->conf);
++	os_free(tls_conf->curves);
++	os_free(tls_conf->ciphersuites);
++	os_free(tls_conf->subject_match);
++	os_free(tls_conf->altsubject_match);
++	os_free(tls_conf->suffix_match);
++	os_free(tls_conf->domain_match);
++	os_free(tls_conf->check_cert_subject);
++	os_free(tls_conf);
++}
++
++
++mbedtls_ctr_drbg_context * crypto_mbedtls_ctr_drbg(void); /*(not in header)*/
++
++__attribute_cold__
++void * tls_init(const struct tls_config *conf)
++{
++	/* RFE: review struct tls_config *conf (different from tls_conf) */
++
++	if (++tls_ctx_global.refcnt > 1)
++		return &tls_ctx_global;
++
++	tls_ctx_global.ctr_drbg = crypto_mbedtls_ctr_drbg();
++  #ifdef MBEDTLS_SSL_SESSION_TICKETS
++	mbedtls_ssl_ticket_init(&tls_ctx_global.ticket_ctx);
++	mbedtls_ssl_ticket_setup(&tls_ctx_global.ticket_ctx,
++	                         mbedtls_ctr_drbg_random,
++	                         tls_ctx_global.ctr_drbg,
++	                         MBEDTLS_CIPHER_AES_256_GCM,
++	                         43200); /* ticket timeout: 12 hours */
++  #endif
++	/* copy struct for future use */
++	tls_ctx_global.init_conf = *conf;
++	if (conf->openssl_ciphers)
++		tls_ctx_global.init_conf.openssl_ciphers =
++		  os_strdup(conf->openssl_ciphers);
++
++	tls_ctx_global.crl_reload_interval = conf->crl_reload_interval;
++	os_get_reltime(&tls_ctx_global.crl_reload_previous);
++
++	return &tls_ctx_global;
++}
++
++
++__attribute_cold__
++void tls_deinit(void *tls_ctx)
++{
++	if (tls_ctx == NULL || --tls_ctx_global.refcnt != 0)
++		return;
++
++	tls_conf_deinit(tls_ctx_global.tls_conf);
++	os_free(tls_ctx_global.ca_cert_file);
++	os_free(tls_ctx_global.ocsp_stapling_response);
++	char *openssl_ciphers; /*(allocated in tls_init())*/
++	*(const char **)&openssl_ciphers =
++	  tls_ctx_global.init_conf.openssl_ciphers;
++	os_free(openssl_ciphers);
++  #ifdef MBEDTLS_SSL_SESSION_TICKETS
++	mbedtls_ssl_ticket_free(&tls_ctx_global.ticket_ctx);
++  #endif
++	os_memset(&tls_ctx_global, 0, sizeof(tls_ctx_global));
++}
++
++
++int tls_get_errors(void *tls_ctx)
++{
++	return 0;
++}
++
++
++static void tls_connection_deinit_expkey(struct tls_connection *conn)
++{
++	conn->tls_prf_type = 0; /* MBEDTLS_SSL_TLS_PRF_NONE; */
++	conn->expkey_keyblock_size = 0;
++	conn->expkey_secret_len = 0;
++	forced_memzero(conn->expkey_secret, sizeof(conn->expkey_secret));
++	forced_memzero(conn->expkey_randbytes, sizeof(conn->expkey_randbytes));
++}
++
++
++#ifdef TLS_MBEDTLS_SESSION_TICKETS
++void tls_connection_deinit_clienthello_session_ticket(struct tls_connection *conn)
++{
++	if (conn->clienthello_session_ticket) {
++		mbedtls_platform_zeroize(conn->clienthello_session_ticket,
++		                         conn->clienthello_session_ticket_len);
++		mbedtls_free(conn->clienthello_session_ticket);
++		conn->clienthello_session_ticket = NULL;
++		conn->clienthello_session_ticket_len = 0;
++	}
++}
++#endif
++
++
++void tls_connection_deinit(void *tls_ctx, struct tls_connection *conn)
++{
++	if (conn == NULL)
++		return;
++
++  #if 0 /*(good intention, but never sent since we destroy self below)*/
++	if (conn->established)
++		mbedtls_ssl_close_notify(&conn->ssl);
++  #endif
++
++	if (conn->tls_prf_type)
++		tls_connection_deinit_expkey(conn);
++
++  #ifdef TLS_MBEDTLS_SESSION_TICKETS
++	if (conn->clienthello_session_ticket)
++		tls_connection_deinit_clienthello_session_ticket(conn);
++  #endif
++
++	os_free(conn->peer_subject);
++	wpabuf_free(conn->success_data);
++	wpabuf_free(conn->push_buf);
++	wpabuf_free(conn->pull_buf);
++	mbedtls_ssl_free(&conn->ssl);
++	tls_conf_deinit(conn->tls_conf);
++	os_free(conn);
++}
++
++
++static void tls_mbedtls_refresh_crl(void);
++static int tls_mbedtls_ssl_setup(struct tls_connection *conn);
++
++struct tls_connection * tls_connection_init(void *tls_ctx)
++{
++	struct tls_connection *conn = os_zalloc(sizeof(*conn));
++	if (conn == NULL)
++		return NULL;
++
++	mbedtls_ssl_init(&conn->ssl);
++
++	conn->tls_conf = tls_ctx_global.tls_conf; /*(inherit global conf, if set)*/
++	if (conn->tls_conf) {
++		++conn->tls_conf->refcnt;
++		/* check for CRL refresh if inheriting from global config */
++		tls_mbedtls_refresh_crl();
++
++		conn->verify_peer = conn->tls_conf->verify_peer;
++		if (tls_mbedtls_ssl_setup(conn) != 0) {
++			tls_connection_deinit(&tls_ctx_global, conn);
++			return NULL;
++		}
++	}
++
++	return conn;
++}
++
++
++int tls_connection_established(void *tls_ctx, struct tls_connection *conn)
++{
++	return conn ? conn->established : 0;
++}
++
++
++__attribute_noinline__
++char * tls_mbedtls_peer_serial_num(const mbedtls_x509_crt *crt, char *serial_num, size_t len)
++{
++	/* mbedtls_x509_serial_gets() inefficiently formats to hex separated by
++	 * colons, so generate the hex serial number here.  The func
++	 * wpa_snprintf_hex_uppercase() is similarly inefficient. */
++	size_t i = 0; /* skip leading 0's per Distinguished Encoding Rules (DER) */
++	while (i < crt->serial.len && crt->serial.p[i] == 0) ++i;
++	if (i == crt->serial.len) --i;
++
++	const unsigned char *s = crt->serial.p + i;
++	const size_t e = (crt->serial.len - i) * 2;
++	if (e >= len)
++		return NULL;
++  #if 0
++	wpa_snprintf_hex_uppercase(serial_num, len, s, crt->serial.len-i);
++  #else
++	for (i = 0; i < e; i+=2, ++s) {
++		serial_num[i+0] = "0123456789ABCDEF"[(*s >>  4)];
++		serial_num[i+1] = "0123456789ABCDEF"[(*s & 0xF)];
++	}
++	serial_num[e] = '\0';
++  #endif
++	return serial_num;
++}
++
++
++char * tls_connection_peer_serial_num(void *tls_ctx,
++				      struct tls_connection *conn)
++{
++	const mbedtls_x509_crt *crt = mbedtls_ssl_get_peer_cert(&conn->ssl);
++	if (crt == NULL)
++		return NULL;
++	size_t len = crt->serial.len * 2 + 1;
++	char *serial_num = os_malloc(len);
++	if (!serial_num)
++		return NULL;
++	return tls_mbedtls_peer_serial_num(crt, serial_num, len);
++}
++
++
++static void tls_pull_buf_reset(struct tls_connection *conn);
++
++int tls_connection_shutdown(void *tls_ctx, struct tls_connection *conn)
++{
++	/* Note: this function called from eap_peer_tls_reauth_init()
++	 * for session resumption, not for connection shutdown */
++
++	if (conn == NULL)
++		return -1;
++
++	tls_pull_buf_reset(conn);
++	wpabuf_free(conn->push_buf);
++	conn->push_buf = NULL;
++	conn->established = 0;
++	conn->resumed = 0;
++	if (conn->tls_prf_type)
++		tls_connection_deinit_expkey(conn);
++
++	/* RFE: prepare for session resumption? (see doc in crypto/tls.h) */
++
++	return mbedtls_ssl_session_reset(&conn->ssl);
++}
++
++
++static int tls_wpabuf_resize_put_data(struct wpabuf **buf,
++                                      const unsigned char *data, size_t dlen)
++{
++	if (wpabuf_resize(buf, dlen) < 0)
++		return 0;
++	wpabuf_put_data(*buf, data, dlen);
++	return 1;
++}
++
++
++static int tls_pull_buf_append(struct tls_connection *conn,
++                               const struct wpabuf *in_data)
++{
++	/*(interface does not lend itself to move semantics)*/
++	return tls_wpabuf_resize_put_data(&conn->pull_buf,
++	                                  wpabuf_head(in_data),
++	                                  wpabuf_len(in_data));
++}
++
++
++static void tls_pull_buf_reset(struct tls_connection *conn)
++{
++	/*(future: might consider reusing conn->pull_buf)*/
++	wpabuf_free(conn->pull_buf);
++	conn->pull_buf = NULL;
++	conn->pull_buf_offset = 0;
++}
++
++
++__attribute_cold__
++static void tls_pull_buf_discard(struct tls_connection *conn, const char *func)
++{
++	size_t discard = wpabuf_len(conn->pull_buf) - conn->pull_buf_offset;
++	if (discard)
++		wpa_printf(MSG_DEBUG,
++			   "%s - %zu bytes remaining in pull_buf; discarding",
++			   func, discard);
++	tls_pull_buf_reset(conn);
++}
++
++
++static int tls_pull_func(void *ptr, unsigned char *buf, size_t len)
++{
++	struct tls_connection *conn = (struct tls_connection *) ptr;
++	if (conn->pull_buf == NULL)
++		return MBEDTLS_ERR_SSL_WANT_READ;
++	const size_t dlen = wpabuf_len(conn->pull_buf) - conn->pull_buf_offset;
++	if (dlen == 0)
++		return MBEDTLS_ERR_SSL_WANT_READ;
++
++	if (len > dlen)
++		len = dlen;
++	os_memcpy(buf, wpabuf_head(conn->pull_buf)+conn->pull_buf_offset, len);
++
++	if (len == dlen) {
++		tls_pull_buf_reset(conn);
++		/*wpa_printf(MSG_DEBUG, "%s - emptied pull_buf", __func__);*/
++	}
++	else {
++		conn->pull_buf_offset += len;
++		/*wpa_printf(MSG_DEBUG, "%s - %zu bytes remaining in pull_buf",
++			   __func__, dlen - len);*/
++	}
++	return (int)len;
++}
++
++
++static int tls_push_func(void *ptr, const unsigned char *buf, size_t len)
++{
++	struct tls_connection *conn = (struct tls_connection *) ptr;
++	return tls_wpabuf_resize_put_data(&conn->push_buf, buf, len)
++	  ? (int)len
++	  : MBEDTLS_ERR_SSL_ALLOC_FAILED;
++}
++
++
++static int
++tls_mbedtls_verify_cb (void *arg, mbedtls_x509_crt *crt, int depth, uint32_t *flags);
++
++
++static int tls_mbedtls_ssl_setup(struct tls_connection *conn)
++{
++  #if 0
++	/* mbedtls_ssl_setup() must be called only once */
++	/* If this func might be called multiple times (e.g. via set_params),
++	 * then we should set a flag in conn that ssl was initialized */
++	if (conn->ssl_is_init) {
++		mbedtls_ssl_free(&conn->ssl);
++		mbedtls_ssl_init(&conn->ssl);
++	}
++  #endif
++
++	int ret = mbedtls_ssl_setup(&conn->ssl, &conn->tls_conf->conf);
++	if (ret != 0) {
++		elog(ret, "mbedtls_ssl_setup");
++		return -1;
++	}
++
++	mbedtls_ssl_set_bio(&conn->ssl, conn, tls_push_func, tls_pull_func, NULL);
++  #if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
++	mbedtls_ssl_set_export_keys_cb(
++	    &conn->ssl, tls_connection_export_keys_cb, conn);
++  #elif MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */
++	mbedtls_ssl_conf_export_keys_ext_cb(
++	    &conn->tls_conf->conf, tls_connection_export_keys_cb, conn);
++  #endif
++	if (conn->verify_peer)
++		mbedtls_ssl_set_verify(&conn->ssl, tls_mbedtls_verify_cb, conn);
++
++	return 0;
++}
++
++
++static int tls_mbedtls_data_is_pem(const u8 *data)
++{
++    return (NULL != os_strstr((char *)data, "-----"));
++}
++
++
++static void tls_mbedtls_set_allowed_tls_vers(struct tls_conf *tls_conf,
++                                             mbedtls_ssl_config *conf)
++{
++  #if !defined(MBEDTLS_SSL_PROTO_TLS1_3)
++	tls_conf->flags |= TLS_CONN_DISABLE_TLSv1_3;
++  #endif
++
++	/* unconditionally require TLSv1.2+ for TLS_CONN_SUITEB */
++	if (tls_conf->flags & TLS_CONN_SUITEB) {
++		tls_conf->flags |= TLS_CONN_DISABLE_TLSv1_0;
++		tls_conf->flags |= TLS_CONN_DISABLE_TLSv1_1;
++	}
++
++	const unsigned int flags = tls_conf->flags;
++
++	/* attempt to map flags to min and max TLS protocol version */
++
++	int min = (flags & TLS_CONN_DISABLE_TLSv1_0)
++		? (flags & TLS_CONN_DISABLE_TLSv1_1)
++		? (flags & TLS_CONN_DISABLE_TLSv1_2)
++		? (flags & TLS_CONN_DISABLE_TLSv1_3)
++		? 4
++		: 3
++		: 2
++		: 1
++		: 0;
++
++	int max = (flags & TLS_CONN_DISABLE_TLSv1_3)
++		? (flags & TLS_CONN_DISABLE_TLSv1_2)
++		? (flags & TLS_CONN_DISABLE_TLSv1_1)
++		? (flags & TLS_CONN_DISABLE_TLSv1_0)
++		? -1
++		: 0
++		: 1
++		: 2
++		: 3;
++
++	if ((flags & TLS_CONN_ENABLE_TLSv1_2) && min > 2) min = 2;
++	if ((flags & TLS_CONN_ENABLE_TLSv1_1) && min > 1) min = 1;
++	if ((flags & TLS_CONN_ENABLE_TLSv1_0) && min > 0) min = 0;
++	if (max < min) {
++		emsg(MSG_ERROR, "invalid tls_disable_tlsv* params; ignoring");
++		return;
++	}
++  #if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
++	/* mbed TLS 3.0.0 removes support for protocols < TLSv1.2 */
++	if (min < 2 || max < 2) {
++		emsg(MSG_ERROR, "invalid tls_disable_tlsv* params; ignoring");
++		if (min < 2) min = 2;
++		if (max < 2) max = 2;
++	}
++  #endif
++
++  #if MBEDTLS_VERSION_NUMBER >= 0x03020000 /* mbedtls 3.2.0 */
++	/* MBEDTLS_SSL_VERSION_TLS1_2 = 0x0303 *//*!< (D)TLS 1.2 */
++	/* MBEDTLS_SSL_VERSION_TLS1_3 = 0x0304 *//*!< (D)TLS 1.3 */
++	min = (min == 2) ? MBEDTLS_SSL_VERSION_TLS1_2 : MBEDTLS_SSL_VERSION_TLS1_3;
++	max = (max == 2) ? MBEDTLS_SSL_VERSION_TLS1_2 : MBEDTLS_SSL_VERSION_TLS1_3;
++	mbedtls_ssl_conf_min_tls_version(conf, min);
++	mbedtls_ssl_conf_max_tls_version(conf, max);
++  #else
++   #ifndef MBEDTLS_SSL_MINOR_VERSION_4
++	if (min == 3) min = 2;
++	if (max == 3) max = 2;
++   #endif
++	/* MBEDTLS_SSL_MINOR_VERSION_0  0 *//*!< SSL v3.0 */
++	/* MBEDTLS_SSL_MINOR_VERSION_1  1 *//*!< TLS v1.0 */
++	/* MBEDTLS_SSL_MINOR_VERSION_2  2 *//*!< TLS v1.1 */
++	/* MBEDTLS_SSL_MINOR_VERSION_3  3 *//*!< TLS v1.2 */
++	/* MBEDTLS_SSL_MINOR_VERSION_4  4 *//*!< TLS v1.3 */
++	mbedtls_ssl_conf_min_version(conf, MBEDTLS_SSL_MAJOR_VERSION_3, min+1);
++	mbedtls_ssl_conf_max_version(conf, MBEDTLS_SSL_MAJOR_VERSION_3, max+1);
++  #endif
++}
++
++
++__attribute_noinline__
++static int tls_mbedtls_readfile(const char *path, u8 **buf, size_t *n);
++
++
++static int
++tls_mbedtls_set_dhparams(struct tls_conf *tls_conf, const char *dh_file)
++{
++    size_t len;
++    u8 *data;
++    if (tls_mbedtls_readfile(dh_file, &data, &len))
++        return 0;
++
++    /* parse only if DH parameters if in PEM format */
++    if (tls_mbedtls_data_is_pem(data)
++        && NULL == os_strstr((char *)data, "-----BEGIN DH PARAMETERS-----")) {
++        if (os_strstr((char *)data, "-----BEGIN DSA PARAMETERS-----"))
++            wpa_printf(MSG_WARNING, "DSA parameters not handled (%s)", dh_file);
++        else
++            wpa_printf(MSG_WARNING, "unexpected DH param content (%s)",dh_file);
++        forced_memzero(data, len);
++        os_free(data);
++        return 0;
++    }
++
++    /* mbedtls_dhm_parse_dhm() expects "-----BEGIN DH PARAMETERS-----" if PEM */
++    mbedtls_dhm_context dhm;
++    mbedtls_dhm_init(&dhm);
++    int rc = mbedtls_dhm_parse_dhm(&dhm, data, len);
++    if (0 == rc)
++        rc = mbedtls_ssl_conf_dh_param_ctx(&tls_conf->conf, &dhm);
++    if (0 != rc)
++        elog(rc, dh_file);
++    mbedtls_dhm_free(&dhm);
++
++    forced_memzero(data, len);
++    os_free(data);
++    return (0 == rc);
++}
++
++
++/* reference: lighttpd src/mod_mbedtls.c:mod_mbedtls_ssl_append_curve()
++ * (same author: gstrauss@gluelogic.com; same license: BSD-3-Clause) */
++#if MBEDTLS_VERSION_NUMBER < 0x03010000 /* mbedtls 3.1.0 */
++static int
++tls_mbedtls_append_curve (mbedtls_ecp_group_id *ids, int nids, int idsz, const mbedtls_ecp_group_id id)
++{
++    if (1 >= idsz - (nids + 1)) {
++        emsg(MSG_ERROR, "error: too many curves during list expand");
++        return -1;
++    }
++    ids[++nids] = id;
++    return nids;
++}
++
++
++static int
++tls_mbedtls_set_curves(struct tls_conf *tls_conf, const char *curvelist)
++{
++    mbedtls_ecp_group_id ids[512];
++    int nids = -1;
++    const int idsz = (int)(sizeof(ids)/sizeof(*ids)-1);
++    const mbedtls_ecp_curve_info * const curve_info = mbedtls_ecp_curve_list();
++
++    for (const char *e = curvelist-1; e; ) {
++        const char * const n = e+1;
++        e = os_strchr(n, ':');
++        size_t len = e ? (size_t)(e - n) : os_strlen(n);
++        mbedtls_ecp_group_id grp_id = MBEDTLS_ECP_DP_NONE;
++        switch (len) {
++          case 5:
++            if (0 == os_memcmp("P-521", n, 5))
++                grp_id = MBEDTLS_ECP_DP_SECP521R1;
++            else if (0 == os_memcmp("P-384", n, 5))
++                grp_id = MBEDTLS_ECP_DP_SECP384R1;
++            else if (0 == os_memcmp("P-256", n, 5))
++                grp_id = MBEDTLS_ECP_DP_SECP256R1;
++            break;
++          case 6:
++            if (0 == os_memcmp("BP-521", n, 6))
++                grp_id = MBEDTLS_ECP_DP_BP512R1;
++            else if (0 == os_memcmp("BP-384", n, 6))
++                grp_id = MBEDTLS_ECP_DP_BP384R1;
++            else if (0 == os_memcmp("BP-256", n, 6))
++                grp_id = MBEDTLS_ECP_DP_BP256R1;
++            break;
++          default:
++            break;
++        }
++        if (grp_id != MBEDTLS_ECP_DP_NONE) {
++            nids = tls_mbedtls_append_curve(ids, nids, idsz, grp_id);
++            if (-1 == nids) return 0;
++            continue;
++        }
++        /* similar to mbedtls_ecp_curve_info_from_name() */
++        const mbedtls_ecp_curve_info *info;
++        for (info = curve_info; info->grp_id != MBEDTLS_ECP_DP_NONE; ++info) {
++            if (0 == os_strncmp(info->name, n, len) && info->name[len] == '\0')
++                break;
++        }
++        if (info->grp_id == MBEDTLS_ECP_DP_NONE) {
++            wpa_printf(MSG_ERROR, "MTLS: unrecognized curve: %.*s",(int)len,n);
++            return 0;
++        }
++
++        nids = tls_mbedtls_append_curve(ids, nids, idsz, info->grp_id);
++        if (-1 == nids) return 0;
++    }
++
++    /* mod_openssl configures "prime256v1" if curve list not specified,
++     * but mbedtls provides a list of supported curves if not explicitly set */
++    if (-1 == nids) return 1; /* empty list; no-op */
++
++    ids[++nids] = MBEDTLS_ECP_DP_NONE; /* terminate list */
++    ++nids;
++
++    /* curves list must be persistent for lifetime of mbedtls_ssl_config */
++    tls_conf->curves = os_malloc(nids * sizeof(mbedtls_ecp_group_id));
++    if (tls_conf->curves == NULL)
++        return 0;
++    os_memcpy(tls_conf->curves, ids, nids * sizeof(mbedtls_ecp_group_id));
++
++    mbedtls_ssl_conf_curves(&tls_conf->conf, tls_conf->curves);
++    return 1;
++}
++#else
++static int
++tls_mbedtls_append_curve (uint16_t *ids, int nids, int idsz, const uint16_t id)
++{
++    if (1 >= idsz - (nids + 1)) {
++        emsg(MSG_ERROR, "error: too many curves during list expand");
++        return -1;
++    }
++    ids[++nids] = id;
++    return nids;
++}
++
++
++static int
++tls_mbedtls_set_curves(struct tls_conf *tls_conf, const char *curvelist)
++{
++    /* TLS Supported Groups (renamed from "EC Named Curve Registry")
++     * https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
++     */
++    uint16_t ids[512];
++    int nids = -1;
++    const int idsz = (int)(sizeof(ids)/sizeof(*ids)-1);
++    const mbedtls_ecp_curve_info * const curve_info = mbedtls_ecp_curve_list();
++
++    for (const char *e = curvelist-1; e; ) {
++        const char * const n = e+1;
++        e = os_strchr(n, ':');
++        size_t len = e ? (size_t)(e - n) : os_strlen(n);
++        uint16_t tls_id = 0;
++        switch (len) {
++          case 5:
++            if (0 == os_memcmp("P-521", n, 5))
++                tls_id = 25; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_SECP521R1 */
++            else if (0 == os_memcmp("P-384", n, 5))
++                tls_id = 24; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_SECP384R1 */
++            else if (0 == os_memcmp("P-256", n, 5))
++                tls_id = 23; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_SECP256R1 */
++            break;
++          case 6:
++            if (0 == os_memcmp("BP-521", n, 6))
++                tls_id = 28; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_BP512R1 */
++            else if (0 == os_memcmp("BP-384", n, 6))
++                tls_id = 27; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_BP384R1 */
++            else if (0 == os_memcmp("BP-256", n, 6))
++                tls_id = 26; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_BP256R1 */
++            break;
++          default:
++            break;
++        }
++        if (tls_id != 0) {
++            nids = tls_mbedtls_append_curve(ids, nids, idsz, tls_id);
++            if (-1 == nids) return 0;
++            continue;
++        }
++        /* similar to mbedtls_ecp_curve_info_from_name() */
++        const mbedtls_ecp_curve_info *info;
++        for (info = curve_info; info->tls_id != 0; ++info) {
++            if (0 == os_strncmp(info->name, n, len) && info->name[len] == '\0')
++                break;
++        }
++        if (info->tls_id == 0) {
++            wpa_printf(MSG_ERROR, "MTLS: unrecognized curve: %.*s",(int)len,n);
++            return 0;
++        }
++
++        nids = tls_mbedtls_append_curve(ids, nids, idsz, info->tls_id);
++        if (-1 == nids) return 0;
++    }
++
++    /* mod_openssl configures "prime256v1" if curve list not specified,
++     * but mbedtls provides a list of supported curves if not explicitly set */
++    if (-1 == nids) return 1; /* empty list; no-op */
++
++    ids[++nids] = 0; /* terminate list */
++    ++nids;
++
++    /* curves list must be persistent for lifetime of mbedtls_ssl_config */
++    tls_conf->curves = os_malloc(nids * sizeof(uint16_t));
++    if (tls_conf->curves == NULL)
++        return 0;
++    os_memcpy(tls_conf->curves, ids, nids * sizeof(uint16_t));
++
++    mbedtls_ssl_conf_groups(&tls_conf->conf, tls_conf->curves);
++    return 1;
++}
++#endif /* MBEDTLS_VERSION_NUMBER >= 0x03010000 */ /* mbedtls 3.1.0 */
++
++
++/* data copied from lighttpd src/mod_mbedtls.c (BSD-3-Clause) */
++static const int suite_AES_256_ephemeral[] = {
++    /* All AES-256 ephemeral suites */
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
++    MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
++    MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM,
++    MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
++    MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
++    MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
++    MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
++    MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8,
++    MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM_8
++};
++
++/* data copied from lighttpd src/mod_mbedtls.c (BSD-3-Clause) */
++static const int suite_AES_128_ephemeral[] = {
++    /* All AES-128 ephemeral suites */
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
++    MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
++    MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM,
++    MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
++    MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
++    MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
++    MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
++    MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8,
++    MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM_8
++};
++
++/* data copied from lighttpd src/mod_mbedtls.c (BSD-3-Clause) */
++/* HIGH cipher list (mapped from openssl list to mbedtls) */
++static const int suite_HIGH[] = {
++    MBEDTLS_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
++    MBEDTLS_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
++    MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
++    MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM,
++    MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
++    MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
++    MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
++    MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
++    MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8,
++    MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM_8,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384,
++    MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384,
++    MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256,
++    MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384,
++    MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384,
++    MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
++    MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
++    MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM,
++    MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
++    MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
++    MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
++    MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
++    MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8,
++    MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM_8,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256,
++    MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
++    MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
++    MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
++    MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256,
++    MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256,
++    MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256,
++    MBEDTLS_TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256,
++    MBEDTLS_TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256,
++    MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384,
++    MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CCM,
++    MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384,
++    MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384,
++    MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA,
++    MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA,
++    MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384,
++    MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384,
++    MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CCM_8,
++    MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384,
++    MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256,
++    MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CCM,
++    MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256,
++    MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256,
++    MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA,
++    MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA,
++    MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256,
++    MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256,
++    MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CCM_8,
++    MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256,
++    MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384,
++    MBEDTLS_TLS_RSA_WITH_AES_256_CCM,
++    MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256,
++    MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA,
++    MBEDTLS_TLS_RSA_WITH_AES_256_CCM_8,
++    MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256,
++    MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,
++    MBEDTLS_TLS_RSA_WITH_ARIA_256_GCM_SHA384,
++    MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256,
++    MBEDTLS_TLS_RSA_WITH_AES_128_CCM,
++    MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256,
++    MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA,
++    MBEDTLS_TLS_RSA_WITH_AES_128_CCM_8,
++    MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256,
++    MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA,
++    MBEDTLS_TLS_RSA_WITH_ARIA_128_GCM_SHA256,
++    MBEDTLS_TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256,
++    MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384,
++    MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384,
++    MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA,
++    MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384,
++    MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384,
++    MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256,
++    MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256,
++    MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA,
++    MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256,
++    MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256,
++    MBEDTLS_TLS_PSK_WITH_CHACHA20_POLY1305_SHA256,
++    MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384,
++    MBEDTLS_TLS_PSK_WITH_AES_256_CCM,
++    MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384,
++    MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA,
++    MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384,
++    MBEDTLS_TLS_PSK_WITH_AES_256_CCM_8,
++    MBEDTLS_TLS_PSK_WITH_ARIA_256_GCM_SHA384,
++    MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256,
++    MBEDTLS_TLS_PSK_WITH_AES_128_CCM,
++    MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256,
++    MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA,
++    MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256,
++    MBEDTLS_TLS_PSK_WITH_AES_128_CCM_8,
++    MBEDTLS_TLS_PSK_WITH_ARIA_128_GCM_SHA256
++};
++
++
++__attribute_noinline__
++static int
++tls_mbedtls_append_ciphersuite (int *ids, int nids, int idsz, const int *x, int xsz)
++{
++    if (xsz >= idsz - (nids + 1)) {
++        emsg(MSG_ERROR, "error: too many ciphers during list expand");
++        return -1;
++    }
++
++    for (int i = 0; i < xsz; ++i)
++        ids[++nids] = x[i];
++
++    return nids;
++}
++
++
++static int
++tls_mbedtls_translate_ciphername(int id, char *buf, size_t buflen)
++{
++    const mbedtls_ssl_ciphersuite_t *info =
++      mbedtls_ssl_ciphersuite_from_id(id);
++    if (info == NULL)
++        return 0;
++    const char *name = mbedtls_ssl_ciphersuite_get_name(info);
++    const size_t len = os_strlen(name);
++    if (len == 7 && 0 == os_memcmp(name, "unknown", 7))
++        return 0;
++    if (len >= buflen)
++        return 0;
++    os_strlcpy(buf, name, buflen);
++
++    /* attempt to translate mbedtls string to openssl string
++     * (some heuristics; incomplete) */
++    size_t i = 0, j = 0;
++    if (buf[0] == 'T') {
++        if (os_strncmp(buf, "TLS1-3-", 7) == 0) {
++            buf[3] = '-';
++            j = 4; /* remove "1-3" from "TLS1-3-" prefix */
++            i = 7;
++        }
++        else if (os_strncmp(buf, "TLS-", 4) == 0)
++            i = 4; /* remove "TLS-" prefix */
++    }
++    for (; buf[i]; ++i) {
++        if (buf[i] == '-') {
++            if (i >= 3) {
++                if (0 == os_memcmp(buf+i-3, "AES", 3))
++                    continue; /* "AES-" -> "AES" */
++            }
++            if (i >= 4) {
++                if (0 == os_memcmp(buf+i-4, "WITH", 4)) {
++                    j -= 4;   /* remove "WITH-" */
++                    continue;
++                }
++            }
++        }
++        buf[j++] = buf[i];
++    }
++    buf[j] = '\0';
++
++    return j;
++}
++
++
++__attribute_noinline__
++static int
++tls_mbedtls_set_ciphersuites(struct tls_conf *tls_conf, int *ids, int nids)
++{
++    /* ciphersuites list must be persistent for lifetime of mbedtls_ssl_config*/
++    os_free(tls_conf->ciphersuites);
++    tls_conf->ciphersuites = os_malloc(nids * sizeof(int));
++    if (tls_conf->ciphersuites == NULL)
++        return 0;
++    os_memcpy(tls_conf->ciphersuites, ids, nids * sizeof(int));
++    mbedtls_ssl_conf_ciphersuites(&tls_conf->conf, tls_conf->ciphersuites);
++    return 1;
++}
++
++
++static int
++tls_mbedtls_set_ciphers(struct tls_conf *tls_conf, const char *ciphers)
++{
++    char buf[64];
++    int ids[512];
++    int nids = -1;
++    const int idsz = (int)(sizeof(ids)/sizeof(*ids)-1);
++    const char *next;
++    size_t blen, clen;
++    do {
++        next = os_strchr(ciphers, ':');
++        clen = next ? (size_t)(next - ciphers) : os_strlen(ciphers);
++        if (!clen)
++            continue;
++
++        /* special-case a select set of openssl group names for hwsim tests */
++	/* (review; remove excess code if tests are not run for non-OpenSSL?) */
++        if (clen == 9 && os_memcmp(ciphers, "SUITEB192", 9) == 0) {
++            static int ssl_preset_suiteb192_ciphersuites[] = {
++                MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
++                0
++            };
++            return tls_mbedtls_set_ciphersuites(tls_conf,
++                                                ssl_preset_suiteb192_ciphersuites,
++                                                2);
++        }
++        if (clen == 9 && os_memcmp(ciphers, "SUITEB128", 9) == 0) {
++            static int ssl_preset_suiteb128_ciphersuites[] = {
++                MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
++                0
++            };
++            return tls_mbedtls_set_ciphersuites(tls_conf,
++                                                ssl_preset_suiteb128_ciphersuites,
++                                                2);
++        }
++        if (clen == 7 && os_memcmp(ciphers, "DEFAULT", 7) == 0)
++            continue;
++        if (clen == 6 && os_memcmp(ciphers, "AES128", 6) == 0) {
++            nids = tls_mbedtls_append_ciphersuite(ids, nids, idsz,
++                     suite_AES_128_ephemeral,
++                     (int)ARRAY_SIZE(suite_AES_128_ephemeral));
++            if (nids == -1)
++                return 0;
++            continue;
++        }
++        if (clen == 6 && os_memcmp(ciphers, "AES256", 6) == 0) {
++            nids = tls_mbedtls_append_ciphersuite(ids, nids, idsz,
++                     suite_AES_256_ephemeral,
++                     (int)ARRAY_SIZE(suite_AES_256_ephemeral));
++            if (nids == -1)
++                return 0;
++            continue;
++        }
++        if (clen == 4 && os_memcmp(ciphers, "HIGH", 4) == 0) {
++            nids = tls_mbedtls_append_ciphersuite(ids, nids, idsz, suite_HIGH,
++                                                  (int)ARRAY_SIZE(suite_HIGH));
++            if (nids == -1)
++                return 0;
++            continue;
++        }
++        /* ignore anonymous cipher group names (?not supported by mbedtls?) */
++        if (clen == 4 && os_memcmp(ciphers, "!ADH", 4) == 0)
++            continue;
++        if (clen == 6 && os_memcmp(ciphers, "-aECDH", 6) == 0)
++            continue;
++        if (clen == 7 && os_memcmp(ciphers, "-aECDSA", 7) == 0)
++            continue;
++
++        /* attempt to match mbedtls cipher names
++         * nb: does not support openssl group names or list manipulation syntax
++         *   (alt: could copy almost 1200 lines (!!!) of lighttpd mod_mbedtls.c
++         *    mod_mbedtls_ssl_conf_ciphersuites() to translate strings)
++         * note: not efficient to rewrite list for each ciphers entry,
++         *       but this code is expected to run only at startup
++         */
++        const int *list = mbedtls_ssl_list_ciphersuites();
++        for (; *list; ++list) {
++            blen = tls_mbedtls_translate_ciphername(*list,buf,sizeof(buf));
++            if (!blen)
++                continue;
++
++            /* matching heuristics additional to translate_ciphername above */
++            if (blen == clen+4) {
++                char *cbc = os_strstr(buf, "CBC-");
++                if (cbc) {
++                    os_memmove(cbc, cbc+4, blen-(cbc+4-buf)+1); /*(w/ '\0')*/
++                    blen -= 4;
++                }
++            }
++            if (blen >= clen && os_memcmp(ciphers, buf, clen) == 0
++                && (blen == clen
++                    || (blen == clen+7 && os_memcmp(buf+clen, "-SHA256", 7)))) {
++                if (1 >= idsz - (nids + 1)) {
++                    emsg(MSG_ERROR,
++                         "error: too many ciphers during list expand");
++                    return 0;
++                }
++                ids[++nids] = *list;
++                break;
++            }
++        }
++        if (*list == 0) {
++            wpa_printf(MSG_ERROR,
++                       "MTLS: unrecognized cipher: %.*s", (int)clen, ciphers);
++            return 0;
++        }
++    } while ((ciphers = next ? next+1 : NULL));
++
++    if (-1 == nids) return 1; /* empty list; no-op */
++
++    ids[++nids] = 0; /* terminate list */
++    ++nids;
++
++    return tls_mbedtls_set_ciphersuites(tls_conf, ids, nids);
++}
++
++
++__attribute_noinline__
++static int tls_mbedtls_set_item(char **config_item, const char *item)
++{
++	os_free(*config_item);
++	*config_item = NULL;
++	return item ? (*config_item = os_strdup(item)) != NULL : 1;
++}
++
++
++static int tls_connection_set_subject_match(struct tls_conf *tls_conf,
++                                            const struct tls_connection_params *params)
++{
++	int rc = 1;
++	rc &= tls_mbedtls_set_item(&tls_conf->subject_match,
++	                              params->subject_match);
++	rc &= tls_mbedtls_set_item(&tls_conf->altsubject_match,
++	                              params->altsubject_match);
++	rc &= tls_mbedtls_set_item(&tls_conf->suffix_match,
++	                              params->suffix_match);
++	rc &= tls_mbedtls_set_item(&tls_conf->domain_match,
++	                              params->domain_match);
++	rc &= tls_mbedtls_set_item(&tls_conf->check_cert_subject,
++	                              params->check_cert_subject);
++	return rc;
++}
++
++
++/* duplicated in crypto_mbedtls.c:crypto_mbedtls_readfile()*/
++__attribute_noinline__
++static int tls_mbedtls_readfile(const char *path, u8 **buf, size_t *n)
++{
++  #if 0 /* #ifdef MBEDTLS_FS_IO */
++	/*(includes +1 for '\0' needed by mbedtls PEM parsing funcs)*/
++	if (mbedtls_pk_load_file(path, (unsigned char **)buf, n) != 0) {
++		wpa_printf(MSG_ERROR, "error: mbedtls_pk_load_file %s", path);
++		return -1;
++	}
++  #else
++	/*(use os_readfile() so that we can use os_free()
++	 *(if we use mbedtls_pk_load_file() above, macros prevent calling free()
++	 * directly #if defined(OS_REJECT_C_LIB_FUNCTIONS) and calling os_free()
++	 * on buf aborts in tests if buf not allocated via os_malloc())*/
++	*buf = (u8 *)os_readfile(path, n);
++	if (!*buf) {
++		wpa_printf(MSG_ERROR, "error: os_readfile %s", path);
++		return -1;
++	}
++	u8 *buf0 = os_realloc(*buf, *n+1);
++	if (!buf0) {
++		bin_clear_free(*buf, *n);
++		*buf = NULL;
++		return -1;
++	}
++	buf0[(*n)++] = '\0';
++	*buf = buf0;
++  #endif
++	return 0;
++}
++
++
++static int tls_mbedtls_set_crl(struct tls_conf *tls_conf, const u8 *data, size_t len)
++{
++	/* do not use mbedtls_x509_crl_parse() on PEM unless it contains CRL */
++	if (len && data[len-1] == '\0'
++	    && NULL == os_strstr((const char *)data,"-----BEGIN X509 CRL-----")
++	    && tls_mbedtls_data_is_pem(data))
++		return 0;
++
++	mbedtls_x509_crl crl;
++	mbedtls_x509_crl_init(&crl);
++	int rc = mbedtls_x509_crl_parse(&crl, data, len);
++	if (rc < 0) {
++		mbedtls_x509_crl_free(&crl);
++		return rc == MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT ? 0 : rc;
++	}
++
++	mbedtls_x509_crl *crl_new = os_malloc(sizeof(crl));
++	if (crl_new == NULL) {
++		mbedtls_x509_crl_free(&crl);
++		return MBEDTLS_ERR_X509_ALLOC_FAILED;
++	}
++	os_memcpy(crl_new, &crl, sizeof(crl));
++
++	mbedtls_x509_crl *crl_old = tls_conf->crl;
++	tls_conf->crl = crl_new;
++	if (crl_old) {
++		mbedtls_x509_crl_free(crl_old);
++		os_free(crl_old);
++	}
++	return 0;
++}
++
++
++static int tls_mbedtls_set_ca(struct tls_conf *tls_conf, u8 *data, size_t len)
++{
++	/* load crt struct onto stack and then copy into tls_conf in
++	 * order to preserve existing tls_conf value if error occurs
++	 *
++	 * hostapd is not threaded, or else should allocate memory and swap in
++	 * pointer reduce race condition.  (If threaded, would also need to
++	 * keep reference count of use to avoid freeing while still in use.) */
++
++	mbedtls_x509_crt crt;
++	mbedtls_x509_crt_init(&crt);
++	int rc = mbedtls_x509_crt_parse(&crt, data, len);
++	if (rc < 0) {
++		mbedtls_x509_crt_free(&crt);
++		return rc;
++	}
++
++	mbedtls_x509_crt_free(&tls_conf->ca_cert);
++	os_memcpy(&tls_conf->ca_cert, &crt, sizeof(crt));
++	return 0;
++}
++
++
++static int tls_mbedtls_set_ca_and_crl(struct tls_conf *tls_conf, const char *ca_cert_file)
++{
++	size_t len;
++	u8 *data;
++	if (tls_mbedtls_readfile(ca_cert_file, &data, &len))
++		return -1;
++
++	int rc;
++	if (0 == (rc = tls_mbedtls_set_ca(tls_conf, data, len))
++	    && (!tls_mbedtls_data_is_pem(data) /*skip parse for CRL if not PEM*/
++	        || 0 == (rc = tls_mbedtls_set_crl(tls_conf, data, len)))) {
++		mbedtls_ssl_conf_ca_chain(&tls_conf->conf,
++		                          &tls_conf->ca_cert,
++		                          tls_conf->crl);
++	}
++	else {
++		elog(rc, __func__);
++		emsg(MSG_ERROR, ca_cert_file);
++	}
++
++	forced_memzero(data, len);
++	os_free(data);
++	return rc;
++}
++
++
++static void tls_mbedtls_refresh_crl(void)
++{
++	/* check for CRL refresh
++	 * continue even if error occurs; continue with previous cert, CRL */
++	unsigned int crl_reload_interval = tls_ctx_global.crl_reload_interval;
++	const char *ca_cert_file = tls_ctx_global.ca_cert_file;
++	if (!crl_reload_interval || !ca_cert_file)
++		return;
++
++	struct os_reltime *previous = &tls_ctx_global.crl_reload_previous;
++	struct os_reltime now;
++	if (os_get_reltime(&now) != 0
++	    || !os_reltime_expired(&now, previous, crl_reload_interval))
++		return;
++
++	/* Note: modifying global state is not thread-safe
++	 *       if in use by existing connections
++	 *
++	 * src/utils/os.h does not provide a portable stat()
++	 * or else it would be a good idea to check mtime and size,
++	 * and avoid reloading if file has not changed */
++
++	if (tls_mbedtls_set_ca_and_crl(tls_ctx_global.tls_conf, ca_cert_file) == 0)
++		*previous = now;
++}
++
++
++static int tls_mbedtls_set_ca_cert(struct tls_conf *tls_conf,
++				   const struct tls_connection_params *params)
++{
++	if (params->ca_cert) {
++		if (os_strncmp(params->ca_cert, "probe://", 8) == 0) {
++			tls_conf->ca_cert_probe = 1;
++			tls_conf->has_ca_cert = 1;
++			return 0;
++		}
++
++		if (os_strncmp(params->ca_cert, "hash://", 7) == 0) {
++			const char *pos = params->ca_cert + 7;
++			if (os_strncmp(pos, "server/sha256/", 14) != 0) {
++				emsg(MSG_ERROR, "unsupported ca_cert hash value");
++				return -1;
++			}
++			pos += 14;
++			if (os_strlen(pos) != SHA256_DIGEST_LENGTH*2) {
++				emsg(MSG_ERROR, "unexpected ca_cert hash length");
++				return -1;
++			}
++			if (hexstr2bin(pos, tls_conf->ca_cert_hash,
++			               SHA256_DIGEST_LENGTH) < 0) {
++				emsg(MSG_ERROR, "invalid ca_cert hash value");
++				return -1;
++			}
++			emsg(MSG_DEBUG, "checking only server certificate match");
++			tls_conf->verify_depth0_only = 1;
++			tls_conf->has_ca_cert = 1;
++			return 0;
++		}
++
++		if (tls_mbedtls_set_ca_and_crl(tls_conf, params->ca_cert) != 0)
++			return -1;
++	}
++	if (params->ca_cert_blob) {
++		size_t len = params->ca_cert_blob_len;
++		int is_pem = tls_mbedtls_data_is_pem(params->ca_cert_blob);
++		if (len && params->ca_cert_blob[len-1] != '\0' && is_pem)
++			++len; /*(include '\0' in len for PEM)*/
++		int ret = mbedtls_x509_crt_parse(&tls_conf->ca_cert,
++		                                 params->ca_cert_blob, len);
++		if (ret != 0) {
++			elog(ret, "mbedtls_x509_crt_parse");
++			return -1;
++		}
++		if (is_pem) { /*(ca_cert_blob in DER format contains ca cert only)*/
++			ret = tls_mbedtls_set_crl(tls_conf, params->ca_cert_blob, len);
++			if (ret != 0) {
++				elog(ret, "mbedtls_x509_crl_parse");
++				return -1;
++			}
++		}
++	}
++
++	if (mbedtls_x509_time_is_future(&tls_conf->ca_cert.valid_from)
++	    || mbedtls_x509_time_is_past(&tls_conf->ca_cert.valid_to)) {
++		emsg(MSG_WARNING, "ca_cert expired or not yet valid");
++		if (params->ca_cert)
++			emsg(MSG_WARNING, params->ca_cert);
++	}
++
++	tls_conf->has_ca_cert = 1;
++	return 0;
++}
++
++
++static int tls_mbedtls_set_certs(struct tls_conf *tls_conf,
++				 const struct tls_connection_params *params)
++{
++	int ret;
++
++	if (params->ca_cert || params->ca_cert_blob) {
++		if (tls_mbedtls_set_ca_cert(tls_conf, params) != 0)
++			return -1;
++	}
++	else if (params->ca_path) {
++		emsg(MSG_INFO, "ca_path support not implemented");
++		return -1;
++	}
++
++	if (!tls_conf->has_ca_cert)
++		mbedtls_ssl_conf_authmode(&tls_conf->conf, MBEDTLS_SSL_VERIFY_NONE);
++	else {
++		/* Initial setting: REQUIRED for client, OPTIONAL for server
++		 *   (see also tls_connection_set_verify()) */
++		tls_conf->verify_peer = (tls_ctx_global.tls_conf == NULL);
++		int authmode = tls_conf->verify_peer
++		  ? MBEDTLS_SSL_VERIFY_REQUIRED
++		  : MBEDTLS_SSL_VERIFY_OPTIONAL;
++		mbedtls_ssl_conf_authmode(&tls_conf->conf, authmode);
++		mbedtls_ssl_conf_ca_chain(&tls_conf->conf,
++		                          &tls_conf->ca_cert,
++		                          tls_conf->crl);
++
++		if (!tls_connection_set_subject_match(tls_conf, params))
++			return -1;
++	}
++
++	if (params->client_cert2) /*(yes, server_cert2 in msg below)*/
++		emsg(MSG_INFO, "server_cert2 support not implemented");
++
++	if (params->client_cert) {
++		size_t len;
++		u8 *data;
++		if (tls_mbedtls_readfile(params->client_cert, &data, &len))
++			return -1;
++		ret = mbedtls_x509_crt_parse(&tls_conf->client_cert, data, len);
++		forced_memzero(data, len);
++		os_free(data);
++	}
++	if (params->client_cert_blob) {
++		size_t len = params->client_cert_blob_len;
++		if (len && params->client_cert_blob[len-1] != '\0'
++		    && tls_mbedtls_data_is_pem(params->client_cert_blob))
++			++len; /*(include '\0' in len for PEM)*/
++		ret = mbedtls_x509_crt_parse(&tls_conf->client_cert,
++		                             params->client_cert_blob, len);
++	}
++	if (params->client_cert || params->client_cert_blob) {
++		if (ret < 0) {
++			elog(ret, "mbedtls_x509_crt_parse");
++			if (params->client_cert)
++				emsg(MSG_ERROR, params->client_cert);
++			return -1;
++		}
++		if (mbedtls_x509_time_is_future(&tls_conf->client_cert.valid_from)
++		    || mbedtls_x509_time_is_past(&tls_conf->client_cert.valid_to)) {
++			emsg(MSG_WARNING, "cert expired or not yet valid");
++			if (params->client_cert)
++				emsg(MSG_WARNING, params->client_cert);
++		}
++		tls_conf->has_client_cert = 1;
++	}
++
++	if (params->private_key || params->private_key_blob) {
++		size_t len = params->private_key_blob_len;
++		u8 *data;
++		*(const u8 **)&data = params->private_key_blob;
++		if (len && data[len-1] != '\0' && tls_mbedtls_data_is_pem(data))
++			++len; /*(include '\0' in len for PEM)*/
++		if (params->private_key
++		    && tls_mbedtls_readfile(params->private_key, &data, &len)) {
++			return -1;
++		}
++		const char *pwd = params->private_key_passwd;
++	  #if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
++		ret = mbedtls_pk_parse_key(&tls_conf->private_key,
++			data, len,
++			(const unsigned char *)pwd,
++			pwd ? os_strlen(pwd) : 0,
++			mbedtls_ctr_drbg_random,
++			tls_ctx_global.ctr_drbg);
++	  #else
++		ret = mbedtls_pk_parse_key(&tls_conf->private_key,
++			data, len,
++			(const unsigned char *)pwd,
++			pwd ? os_strlen(pwd) : 0);
++	  #endif
++		if (params->private_key) {
++			forced_memzero(data, len);
++			os_free(data);
++		}
++		if (ret < 0) {
++			elog(ret, "mbedtls_pk_parse_key");
++			return -1;
++		}
++		tls_conf->has_private_key = 1;
++	}
++
++	if (tls_conf->has_client_cert && tls_conf->has_private_key) {
++		ret = mbedtls_ssl_conf_own_cert(
++		    &tls_conf->conf, &tls_conf->client_cert, &tls_conf->private_key);
++		if (ret < 0) {
++			elog(ret, "mbedtls_ssl_conf_own_cert");
++			return -1;
++		}
++	}
++
++	return 0;
++}
++
++
++/* mbedtls_x509_crt_profile_suiteb plus rsa_min_bitlen 2048 */
++/* (reference: see also mbedtls_x509_crt_profile_next) */
++/* ??? should permit SHA-512, too, and additional curves ??? */
++static const mbedtls_x509_crt_profile tls_mbedtls_crt_profile_suiteb128 =
++{
++    /* Only SHA-256 and 384 */
++    MBEDTLS_X509_ID_FLAG( MBEDTLS_MD_SHA256 ) |
++    MBEDTLS_X509_ID_FLAG( MBEDTLS_MD_SHA384 ),
++    /* Only ECDSA */
++    MBEDTLS_X509_ID_FLAG( MBEDTLS_PK_ECDSA ) |
++    MBEDTLS_X509_ID_FLAG( MBEDTLS_PK_ECKEY ),
++#if defined(MBEDTLS_ECP_C)
++    /* Only NIST P-256 and P-384 */
++    MBEDTLS_X509_ID_FLAG( MBEDTLS_ECP_DP_SECP256R1 ) |
++    MBEDTLS_X509_ID_FLAG( MBEDTLS_ECP_DP_SECP384R1 ),
++#else
++    0,
++#endif
++    2048,
++};
++
++
++/* stricter than mbedtls_x509_crt_profile_suiteb */
++/* (reference: see also mbedtls_x509_crt_profile_next) */
++/* ??? should permit SHA-512, too, and additional curves ??? */
++static const mbedtls_x509_crt_profile tls_mbedtls_crt_profile_suiteb192 =
++{
++    /* Only SHA-384 */
++    MBEDTLS_X509_ID_FLAG( MBEDTLS_MD_SHA384 ),
++    /* Only ECDSA */
++    MBEDTLS_X509_ID_FLAG( MBEDTLS_PK_ECDSA ) |
++    MBEDTLS_X509_ID_FLAG( MBEDTLS_PK_ECKEY ),
++#if defined(MBEDTLS_ECP_C)
++    /* Only NIST P-384 */
++    MBEDTLS_X509_ID_FLAG( MBEDTLS_ECP_DP_SECP384R1 ),
++#else
++    0,
++#endif
++    3072,
++};
++
++
++/* stricter than mbedtls_x509_crt_profile_suiteb except allow any PK alg */
++/* (reference: see also mbedtls_x509_crt_profile_next) */
++/* ??? should permit SHA-512, too, and additional curves ??? */
++static const mbedtls_x509_crt_profile tls_mbedtls_crt_profile_suiteb192_anypk =
++{
++    /* Only SHA-384 */
++    MBEDTLS_X509_ID_FLAG( MBEDTLS_MD_SHA384 ),
++    0xFFFFFFF, /* Any PK alg    */
++#if defined(MBEDTLS_ECP_C)
++    /* Only NIST P-384 */
++    MBEDTLS_X509_ID_FLAG( MBEDTLS_ECP_DP_SECP384R1 ),
++#else
++    0,
++#endif
++    3072,
++};
++
++
++static int tls_mbedtls_set_params(struct tls_conf *tls_conf,
++				  const struct tls_connection_params *params)
++{
++	tls_conf->flags = params->flags;
++
++	if (tls_conf->flags & TLS_CONN_REQUIRE_OCSP_ALL) {
++		emsg(MSG_INFO, "ocsp=3 not supported");
++		return -1;
++	}
++
++	if (tls_conf->flags & TLS_CONN_REQUIRE_OCSP) {
++		emsg(MSG_INFO, "ocsp not supported");
++		return -1;
++	}
++
++	int suiteb128 = 0;
++	int suiteb192 = 0;
++	if (params->openssl_ciphers) {
++		if (os_strcmp(params->openssl_ciphers, "SUITEB192") == 0) {
++			suiteb192 = 1;
++			tls_conf->flags |= TLS_CONN_SUITEB;
++		}
++		if (os_strcmp(params->openssl_ciphers, "SUITEB128") == 0) {
++			suiteb128 = 1;
++			tls_conf->flags |= TLS_CONN_SUITEB;
++		}
++	}
++
++	int ret = mbedtls_ssl_config_defaults(
++	    &tls_conf->conf, tls_ctx_global.tls_conf ? MBEDTLS_SSL_IS_SERVER
++	                                             : MBEDTLS_SSL_IS_CLIENT,
++	    MBEDTLS_SSL_TRANSPORT_STREAM,
++	    (tls_conf->flags & TLS_CONN_SUITEB) ? MBEDTLS_SSL_PRESET_SUITEB
++	                                        : MBEDTLS_SSL_PRESET_DEFAULT);
++	if (ret != 0) {
++		elog(ret, "mbedtls_ssl_config_defaults");
++		return -1;
++	}
++
++	if (suiteb128) {
++		mbedtls_ssl_conf_cert_profile(&tls_conf->conf,
++		                              &tls_mbedtls_crt_profile_suiteb128);
++		mbedtls_ssl_conf_dhm_min_bitlen(&tls_conf->conf, 2048);
++	}
++	else if (suiteb192) {
++		mbedtls_ssl_conf_cert_profile(&tls_conf->conf,
++		                              &tls_mbedtls_crt_profile_suiteb192);
++		mbedtls_ssl_conf_dhm_min_bitlen(&tls_conf->conf, 3072);
++	}
++	else if (tls_conf->flags & TLS_CONN_SUITEB) {
++		/* treat as suiteb192 while allowing any PK algorithm */
++		mbedtls_ssl_conf_cert_profile(&tls_conf->conf,
++		                              &tls_mbedtls_crt_profile_suiteb192_anypk);
++		mbedtls_ssl_conf_dhm_min_bitlen(&tls_conf->conf, 3072);
++	}
++
++	tls_mbedtls_set_allowed_tls_vers(tls_conf, &tls_conf->conf);
++	ret = tls_mbedtls_set_certs(tls_conf, params);
++	if (ret != 0)
++		return -1;
++
++	if (params->dh_file
++	    && !tls_mbedtls_set_dhparams(tls_conf, params->dh_file)) {
++		return -1;
++	}
++
++	if (params->openssl_ecdh_curves
++	    && !tls_mbedtls_set_curves(tls_conf, params->openssl_ecdh_curves)) {
++		return -1;
++	}
++
++	if (params->openssl_ciphers) {
++		if (!tls_mbedtls_set_ciphers(tls_conf, params->openssl_ciphers))
++			return -1;
++	}
++	else if (tls_conf->flags & TLS_CONN_SUITEB) {
++		/* special-case a select set of ciphers for hwsim tests */
++		if (!tls_mbedtls_set_ciphers(tls_conf,
++		        (tls_conf->flags & TLS_CONN_SUITEB_NO_ECDH)
++		          ? "DHE-RSA-AES256-GCM-SHA384"
++		          : "ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384"))
++			return -1;
++	}
++
++	return 0;
++}
++
++
++int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn,
++			      const struct tls_connection_params *params)
++{
++	if (conn == NULL || params == NULL)
++		return -1;
++
++	tls_conf_deinit(conn->tls_conf);
++	struct tls_conf *tls_conf = conn->tls_conf = tls_conf_init(tls_ctx);
++	if (tls_conf == NULL)
++		return -1;
++
++	if (tls_ctx_global.tls_conf) {
++		tls_conf->check_crl = tls_ctx_global.tls_conf->check_crl;
++		tls_conf->check_crl_strict = tls_ctx_global.tls_conf->check_crl_strict;
++		/*(tls_openssl.c inherits check_cert_subject from global conf)*/
++		if (tls_ctx_global.tls_conf->check_cert_subject) {
++			tls_conf->check_cert_subject =
++			  os_strdup(tls_ctx_global.tls_conf->check_cert_subject);
++			if (tls_conf->check_cert_subject == NULL)
++				return -1;
++		}
++	}
++
++	if (tls_mbedtls_set_params(tls_conf, params) != 0)
++		return -1;
++	conn->verify_peer = tls_conf->verify_peer;
++
++	return tls_mbedtls_ssl_setup(conn);
++}
++
++
++#ifdef TLS_MBEDTLS_SESSION_TICKETS
++
++static int tls_mbedtls_clienthello_session_ticket_prep (struct tls_connection *conn,
++                                                        const u8 *data, size_t len)
++{
++	if (conn->tls_conf->flags & TLS_CONN_DISABLE_SESSION_TICKET)
++		return -1;
++	if (conn->clienthello_session_ticket)
++		tls_connection_deinit_clienthello_session_ticket(conn);
++	if (len) {
++		conn->clienthello_session_ticket = mbedtls_calloc(1, len);
++		if (conn->clienthello_session_ticket == NULL)
++			return -1;
++		conn->clienthello_session_ticket_len = len;
++		os_memcpy(conn->clienthello_session_ticket, data, len);
++	}
++	return 0;
++}
++
++
++static void tls_mbedtls_clienthello_session_ticket_set (struct tls_connection *conn)
++{
++	mbedtls_ssl_session *sess = conn->ssl.MBEDTLS_PRIVATE(session_negotiate);
++	if (sess->MBEDTLS_PRIVATE(ticket)) {
++		mbedtls_platform_zeroize(sess->MBEDTLS_PRIVATE(ticket),
++		                         sess->MBEDTLS_PRIVATE(ticket_len));
++		mbedtls_free(sess->MBEDTLS_PRIVATE(ticket));
++	}
++	sess->MBEDTLS_PRIVATE(ticket) = conn->clienthello_session_ticket;
++	sess->MBEDTLS_PRIVATE(ticket_len) = conn->clienthello_session_ticket_len;
++	sess->MBEDTLS_PRIVATE(ticket_lifetime) = 86400;/* XXX: can hint be 0? */
++
++	conn->clienthello_session_ticket = NULL;
++	conn->clienthello_session_ticket_len = 0;
++}
++
++
++static int tls_mbedtls_ssl_ticket_write(void *p_ticket,
++                                        const mbedtls_ssl_session *session,
++                                        unsigned char *start,
++                                        const unsigned char *end,
++                                        size_t *tlen,
++                                        uint32_t *lifetime)
++{
++	struct tls_connection *conn = p_ticket;
++	if (conn && conn->session_ticket_cb) {
++		/* see tls_mbedtls_clienthello_session_ticket_prep() */
++		/* see tls_mbedtls_clienthello_session_ticket_set() */
++		return 0;
++	}
++
++	return mbedtls_ssl_ticket_write(&tls_ctx_global.ticket_ctx,
++	                                session, start, end, tlen, lifetime);
++}
++
++
++static int tls_mbedtls_ssl_ticket_parse(void *p_ticket,
++                                        mbedtls_ssl_session *session,
++                                        unsigned char *buf,
++                                        size_t len)
++{
++	/* XXX: TODO: not implemented in client;
++	 * mbedtls_ssl_conf_session_tickets_cb() callbacks only for TLS server*/
++
++	if (len == 0)
++		return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
++
++	struct tls_connection *conn = p_ticket;
++	if (conn && conn->session_ticket_cb) {
++		/* XXX: have random and secret been initialized yet?
++		 *      or must keys first be exported?
++		 *      EAP-FAST uses all args, EAP-TEAP only uses secret */
++		struct tls_random data;
++		if (tls_connection_get_random(NULL, conn, &data) != 0)
++			return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
++		int ret =
++		  conn->session_ticket_cb(conn->session_ticket_cb_ctx,
++		                          buf, len,
++		                          data.client_random,
++		                          data.server_random,
++		                          conn->expkey_secret);
++		if (ret == 1) {
++			conn->resumed = 1;
++			return 0;
++		}
++		emsg(MSG_ERROR, "EAP session ticket ext not implemented");
++		return MBEDTLS_ERR_SSL_INVALID_MAC;
++		/*(non-zero return used for mbedtls debug logging)*/
++	}
++
++	/* XXX: TODO always use tls_mbedtls_ssl_ticket_parse() for callback? */
++	int rc = mbedtls_ssl_ticket_parse(&tls_ctx_global.ticket_ctx,
++	                                  session, buf, len);
++	if (conn)
++		conn->resumed = (rc == 0);
++	return rc;
++}
++
++#endif /* TLS_MBEDTLS_SESSION_TICKETS */
++
++
++__attribute_cold__
++int tls_global_set_params(void *tls_ctx,
++			  const struct tls_connection_params *params)
++{
++	/* XXX: why might global_set_params be called more than once? */
++	if (tls_ctx_global.tls_conf)
++		tls_conf_deinit(tls_ctx_global.tls_conf);
++	tls_ctx_global.tls_conf = tls_conf_init(tls_ctx);
++	if (tls_ctx_global.tls_conf == NULL)
++		return -1;
++
++  #ifdef MBEDTLS_SSL_SESSION_TICKETS
++  #ifdef MBEDTLS_SSL_TICKET_C
++	if (!(params->flags & TLS_CONN_DISABLE_SESSION_TICKET))
++	  #ifdef TLS_MBEDTLS_SESSION_TICKETS
++		mbedtls_ssl_conf_session_tickets_cb(&tls_ctx_global.tls_conf->conf,
++		                                    tls_mbedtls_ssl_ticket_write,
++		                                    tls_mbedtls_ssl_ticket_parse,
++		                                    NULL);
++	  #else
++		mbedtls_ssl_conf_session_tickets_cb(&tls_ctx_global.tls_conf->conf,
++		                                    mbedtls_ssl_ticket_write,
++		                                    mbedtls_ssl_ticket_parse,
++		                                    &tls_ctx_global.ticket_ctx);
++	  #endif
++  #endif
++  #endif
++
++	os_free(tls_ctx_global.ocsp_stapling_response);
++	tls_ctx_global.ocsp_stapling_response = NULL;
++	if (params->ocsp_stapling_response)
++		tls_ctx_global.ocsp_stapling_response =
++			os_strdup(params->ocsp_stapling_response);
++
++	os_free(tls_ctx_global.ca_cert_file);
++	tls_ctx_global.ca_cert_file = NULL;
++	if (params->ca_cert)
++		tls_ctx_global.ca_cert_file = os_strdup(params->ca_cert);
++	return tls_mbedtls_set_params(tls_ctx_global.tls_conf, params);
++}
++
++
++int tls_global_set_verify(void *tls_ctx, int check_crl, int strict)
++{
++	tls_ctx_global.tls_conf->check_crl = check_crl;
++	tls_ctx_global.tls_conf->check_crl_strict = strict; /*(time checks)*/
++	return 0;
++}
++
++
++int tls_connection_set_verify(void *tls_ctx, struct tls_connection *conn,
++			      int verify_peer, unsigned int flags,
++			      const u8 *session_ctx, size_t session_ctx_len)
++{
++	/*(EAP server-side calls this from eap_server_tls_ssl_init())*/
++	if (conn == NULL)
++		return -1;
++
++	conn->tls_conf->flags |= flags;/* TODO: reprocess flags, if necessary */
++
++	int authmode;
++	switch (verify_peer) {
++	case 2:  authmode = MBEDTLS_SSL_VERIFY_OPTIONAL; break;/*(eap_teap_init())*/
++	case 1:  authmode = MBEDTLS_SSL_VERIFY_REQUIRED; break;
++	default: authmode = MBEDTLS_SSL_VERIFY_NONE;     break;
++	}
++	mbedtls_ssl_set_hs_authmode(&conn->ssl, authmode);
++
++	if ((conn->verify_peer = (authmode != MBEDTLS_SSL_VERIFY_NONE)))
++		mbedtls_ssl_set_verify(&conn->ssl, tls_mbedtls_verify_cb, conn);
++	else
++		mbedtls_ssl_set_verify(&conn->ssl, NULL, NULL);
++
++	return 0;
++}
++
++
++#if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
++static void tls_connection_export_keys_cb(
++    void *p_expkey, mbedtls_ssl_key_export_type secret_type,
++    const unsigned char *secret, size_t secret_len,
++    const unsigned char client_random[MBEDTLS_EXPKEY_RAND_LEN],
++    const unsigned char server_random[MBEDTLS_EXPKEY_RAND_LEN],
++    mbedtls_tls_prf_types tls_prf_type)
++{
++	struct tls_connection *conn = p_expkey;
++	conn->tls_prf_type = tls_prf_type;
++	if (!tls_prf_type)
++		return;
++	if (secret_len > sizeof(conn->expkey_secret)) {
++		emsg(MSG_ERROR, "tls_connection_export_keys_cb secret too long");
++		conn->tls_prf_type = MBEDTLS_SSL_TLS_PRF_NONE; /* 0 */
++		return;
++	}
++	conn->expkey_secret_len = secret_len;
++	os_memcpy(conn->expkey_secret, secret, secret_len);
++	os_memcpy(conn->expkey_randbytes,
++	          client_random, MBEDTLS_EXPKEY_RAND_LEN);
++	os_memcpy(conn->expkey_randbytes + MBEDTLS_EXPKEY_RAND_LEN,
++	          server_random, MBEDTLS_EXPKEY_RAND_LEN);
++}
++#elif MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */
++static int tls_connection_export_keys_cb(
++    void *p_expkey,
++    const unsigned char *ms,
++    const unsigned char *kb,
++    size_t maclen,
++    size_t keylen,
++    size_t ivlen,
++    const unsigned char client_random[MBEDTLS_EXPKEY_RAND_LEN],
++    const unsigned char server_random[MBEDTLS_EXPKEY_RAND_LEN],
++    mbedtls_tls_prf_types tls_prf_type )
++{
++	struct tls_connection *conn = p_expkey;
++	conn->tls_prf_type = tls_prf_type;
++	if (!tls_prf_type)
++		return -1; /*(return value ignored by mbedtls)*/
++	conn->expkey_keyblock_size = maclen + keylen + ivlen;
++	conn->expkey_secret_len = MBEDTLS_EXPKEY_FIXED_SECRET_LEN;
++	os_memcpy(conn->expkey_secret, ms, MBEDTLS_EXPKEY_FIXED_SECRET_LEN);
++	os_memcpy(conn->expkey_randbytes,
++	          client_random, MBEDTLS_EXPKEY_RAND_LEN);
++	os_memcpy(conn->expkey_randbytes + MBEDTLS_EXPKEY_RAND_LEN,
++	          server_random, MBEDTLS_EXPKEY_RAND_LEN);
++	return 0;
++}
++#endif
++
++
++int tls_connection_get_random(void *tls_ctx, struct tls_connection *conn,
++			      struct tls_random *data)
++{
++	if (!conn || !conn->tls_prf_type)
++		return -1;
++	data->client_random = conn->expkey_randbytes;
++	data->client_random_len = MBEDTLS_EXPKEY_RAND_LEN;
++	data->server_random = conn->expkey_randbytes + MBEDTLS_EXPKEY_RAND_LEN;
++	data->server_random_len = MBEDTLS_EXPKEY_RAND_LEN;
++	return 0;
++}
++
++
++int tls_connection_export_key(void *tls_ctx, struct tls_connection *conn,
++			      const char *label, const u8 *context,
++			      size_t context_len, u8 *out, size_t out_len)
++{
++	/* (EAP-PEAP EAP-TLS EAP-TTLS) */
++  #if MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */
++	return (conn && conn->established && conn->tls_prf_type)
++	  ? mbedtls_ssl_tls_prf(conn->tls_prf_type,
++				conn->expkey_secret, conn->expkey_secret_len, label,
++				conn->expkey_randbytes,
++				sizeof(conn->expkey_randbytes), out, out_len)
++	  : -1;
++  #else
++	/* not implemented here for mbedtls < 2.18.0 */
++	return -1;
++  #endif
++}
++
++
++#ifdef TLS_MBEDTLS_EAP_FAST
++
++#if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
++/* keyblock size info is not exposed in mbed TLS 3.0.0 */
++/* extracted from mbedtls library/ssl_tls.c:ssl_tls12_populate_transform() */
++#include <mbedtls/ssl_ciphersuites.h>
++#include <mbedtls/cipher.h>
++static size_t tls_mbedtls_ssl_keyblock_size (mbedtls_ssl_context *ssl)
++{
++  #if !defined(MBEDTLS_USE_PSA_CRYPTO) /* XXX: (not extracted for PSA crypto) */
++  #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
++    if (tls_version == MBEDTLS_SSL_VERSION_TLS1_3)
++        return 0; /* (calculation not extracted) */
++  #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
++
++    int ciphersuite = mbedtls_ssl_get_ciphersuite_id_from_ssl(ssl);
++    const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
++      mbedtls_ssl_ciphersuite_from_id(ciphersuite);
++    if (ciphersuite_info == NULL)
++        return 0;
++
++    const mbedtls_cipher_info_t *cipher_info =
++      mbedtls_cipher_info_from_type(ciphersuite_info->MBEDTLS_PRIVATE(cipher));
++    if (cipher_info == NULL)
++        return 0;
++
++  #if MBEDTLS_VERSION_NUMBER >= 0x03010000 /* mbedtls 3.1.0 */
++    size_t keylen = mbedtls_cipher_info_get_key_bitlen(cipher_info) / 8;
++    mbedtls_cipher_mode_t mode = mbedtls_cipher_info_get_mode(cipher_info);
++  #else
++    size_t keylen = cipher_info->MBEDTLS_PRIVATE(key_bitlen) / 8;
++    mbedtls_cipher_mode_t mode = cipher_info->MBEDTLS_PRIVATE(mode);
++  #endif
++  #if defined(MBEDTLS_GCM_C) || \
++      defined(MBEDTLS_CCM_C) || \
++      defined(MBEDTLS_CHACHAPOLY_C)
++    if (mode == MBEDTLS_MODE_GCM || mode == MBEDTLS_MODE_CCM)
++        return keylen + 4;
++    else if (mode == MBEDTLS_MODE_CHACHAPOLY)
++        return keylen + 12;
++    else
++  #endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
++  #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
++    {
++        const mbedtls_md_info_t *md_info =
++          mbedtls_md_info_from_type(ciphersuite_info->MBEDTLS_PRIVATE(mac));
++        if (md_info == NULL)
++            return 0;
++        size_t mac_key_len = mbedtls_md_get_size(md_info);
++        size_t ivlen = mbedtls_cipher_info_get_iv_size(cipher_info);
++        return keylen + mac_key_len + ivlen;
++    }
++  #endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
++  #endif /* !MBEDTLS_USE_PSA_CRYPTO *//* (not extracted for PSA crypto) */
++    return 0;
++}
++#endif /* MBEDTLS_VERSION_NUMBER >= 0x03000000 *//* mbedtls 3.0.0 */
++
++
++int tls_connection_get_eap_fast_key(void *tls_ctx, struct tls_connection *conn,
++				    u8 *out, size_t out_len)
++{
++	/* XXX: has export keys callback been run? */
++	if (!conn || !conn->tls_prf_type)
++		return -1;
++
++  #if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
++	conn->expkey_keyblock_size = tls_mbedtls_ssl_keyblock_size(&conn->ssl);
++	if (conn->expkey_keyblock_size == 0)
++		return -1;
++  #endif
++	size_t skip = conn->expkey_keyblock_size * 2;
++	unsigned char *tmp_out = os_malloc(skip + out_len);
++	if (!tmp_out)
++		return -1;
++
++	/* server_random and then client_random */
++	unsigned char seed[MBEDTLS_EXPKEY_RAND_LEN*2];
++	os_memcpy(seed, conn->expkey_randbytes + MBEDTLS_EXPKEY_RAND_LEN,
++	          MBEDTLS_EXPKEY_RAND_LEN);
++	os_memcpy(seed + MBEDTLS_EXPKEY_RAND_LEN, conn->expkey_randbytes,
++	          MBEDTLS_EXPKEY_RAND_LEN);
++
++  #if MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */
++	int ret = mbedtls_ssl_tls_prf(conn->tls_prf_type,
++				      conn->expkey_secret, conn->expkey_secret_len,
++				      "key expansion", seed, sizeof(seed),
++				      tmp_out, skip + out_len);
++	if (ret == 0)
++		os_memcpy(out, tmp_out + skip, out_len);
++  #else
++	int ret = -1; /*(not reached if not impl; return -1 at top of func)*/
++  #endif
++
++	bin_clear_free(tmp_out, skip + out_len);
++	forced_memzero(seed, sizeof(seed));
++	return ret;
++}
++
++#endif /* TLS_MBEDTLS_EAP_FAST */
++
++
++__attribute_cold__
++static void tls_mbedtls_suiteb_handshake_alert (struct tls_connection *conn)
++{
++	/* tests/hwsim/test_suite_b.py test_suite_b_192_rsa_insufficient_dh */
++	if (!(conn->tls_conf->flags & TLS_CONN_SUITEB))
++		return;
++	if (tls_ctx_global.tls_conf) /*(is server; want issue event on client)*/
++		return;
++  #if 0
++	/*(info not available on client;
++         * mbed TLS library enforces dhm min bitlen in ServerKeyExchange)*/
++	if (MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 ==
++	  #if MBEDTLS_VERSION_NUMBER < 0x03020000 /* mbedtls 3.2.0 */
++	          mbedtls_ssl_get_ciphersuite_id_from_ssl(&conn->ssl)
++	  #else
++	          mbedtls_ssl_get_ciphersuite_id(
++	            mbedtls_ssl_get_ciphersuite(&conn->ssl))
++	  #endif
++	    && mbedtls_mpi_size(&conn->tls_conf->conf.MBEDTLS_PRIVATE(dhm_P))
++	         < 384 /*(3072/8)*/)
++  #endif
++	{
++		struct tls_config *init_conf = &tls_ctx_global.init_conf;
++		if (init_conf->event_cb) {
++			union tls_event_data ev;
++			os_memset(&ev, 0, sizeof(ev));
++			ev.alert.is_local = 1;
++			ev.alert.type = "fatal";
++			/*"internal error" string for tests/hwsim/test_suiteb.py */
++			ev.alert.description = "internal error: handshake failure";
++			/*ev.alert.description = "insufficient security";*/
++			init_conf->event_cb(init_conf->cb_ctx, TLS_ALERT, &ev);
++		}
++	}
++}
++
++
++struct wpabuf * tls_connection_handshake(void *tls_ctx,
++					 struct tls_connection *conn,
++					 const struct wpabuf *in_data,
++					 struct wpabuf **appl_data)
++{
++	if (appl_data)
++		*appl_data = NULL;
++
++	if (in_data && wpabuf_len(in_data)) {
++		/*(unsure why tls_gnutls.c discards buffer contents; skip here)*/
++		if (conn->pull_buf && 0) /* disable; appears unwise */
++			tls_pull_buf_discard(conn, __func__);
++		if (!tls_pull_buf_append(conn, in_data))
++			return NULL;
++	}
++
++	if (conn->tls_conf == NULL) {
++		struct tls_connection_params params;
++		os_memset(&params, 0, sizeof(params));
++		params.openssl_ciphers =
++		  tls_ctx_global.init_conf.openssl_ciphers;
++		params.flags = tls_ctx_global.tls_conf->flags;
++		if (tls_connection_set_params(tls_ctx, conn, &params) != 0)
++			return NULL;
++	}
++
++	if (conn->verify_peer) /*(call here might be redundant; nbd)*/
++		mbedtls_ssl_set_verify(&conn->ssl, tls_mbedtls_verify_cb, conn);
++
++  #ifdef TLS_MBEDTLS_SESSION_TICKETS
++	if (conn->clienthello_session_ticket)
++		/*(starting handshake for EAP-FAST and EAP-TEAP)*/
++		tls_mbedtls_clienthello_session_ticket_set(conn);
++
++	/* (not thread-safe due to need to set userdata 'conn' for callback) */
++	/* (unable to use mbedtls_ssl_set_user_data_p() with mbedtls 3.2.0+
++	 *  since ticket write and parse callbacks take (mbedtls_ssl_session *)
++	 *  param instead of (mbedtls_ssl_context *) param) */
++	if (conn->tls_conf->flags & TLS_CONN_DISABLE_SESSION_TICKET)
++		mbedtls_ssl_conf_session_tickets_cb(&conn->tls_conf->conf,
++		                                    NULL, NULL, NULL);
++	else
++		mbedtls_ssl_conf_session_tickets_cb(&conn->tls_conf->conf,
++		                                    tls_mbedtls_ssl_ticket_write,
++		                                    tls_mbedtls_ssl_ticket_parse,
++		                                    conn);
++  #endif
++
++  #if MBEDTLS_VERSION_NUMBER >= 0x03020000 /* mbedtls 3.2.0 */
++	int ret = mbedtls_ssl_handshake(&conn->ssl);
++  #else
++	int ret = 0;
++	while (conn->ssl.MBEDTLS_PRIVATE(state) != MBEDTLS_SSL_HANDSHAKE_OVER) {
++		ret = mbedtls_ssl_handshake_step(&conn->ssl);
++		if (ret != 0)
++			break;
++	}
++  #endif
++
++  #ifdef TLS_MBEDTLS_SESSION_TICKETS
++	mbedtls_ssl_conf_session_tickets_cb(&conn->tls_conf->conf,
++	                                    tls_mbedtls_ssl_ticket_write,
++	                                    tls_mbedtls_ssl_ticket_parse,
++	                                    NULL);
++  #endif
++
++	switch (ret) {
++	case 0:
++		conn->established = 1;
++		if (conn->push_buf == NULL)
++			/* Need to return something to get final TLS ACK. */
++			conn->push_buf = wpabuf_alloc(0);
++
++		if (appl_data /*&& conn->pull_buf && wpabuf_len(conn->pull_buf)*/)
++			*appl_data = NULL; /* RFE: check for application data */
++		break;
++	case MBEDTLS_ERR_SSL_WANT_WRITE:
++	case MBEDTLS_ERR_SSL_WANT_READ:
++	case MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS:
++	case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS:
++		if (tls_ctx_global.tls_conf /*(is server)*/
++		    && conn->established && conn->push_buf == NULL)
++			/* Need to return something to trigger completion of EAP-TLS. */
++			conn->push_buf = wpabuf_alloc(0);
++		break;
++	default:
++		++conn->failed;
++		switch (ret) {
++		case MBEDTLS_ERR_SSL_CLIENT_RECONNECT:
++		case MBEDTLS_ERR_NET_CONN_RESET:
++		case MBEDTLS_ERR_NET_SEND_FAILED:
++			++conn->write_alerts;
++			break;
++	      #if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
++		case MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE:
++	      #else
++		case MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE:
++	      #endif
++			tls_mbedtls_suiteb_handshake_alert(conn);
++			/* fall through */
++		case MBEDTLS_ERR_NET_RECV_FAILED:
++		case MBEDTLS_ERR_SSL_CONN_EOF:
++		case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY:
++		case MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE:
++			++conn->read_alerts;
++			break;
++		default:
++			break;
++		}
++
++		ilog(ret, "mbedtls_ssl_handshake");
++		break;
++	}
++
++	struct wpabuf *out_data = conn->push_buf;
++	conn->push_buf = NULL;
++	return out_data;
++}
++
++
++struct wpabuf * tls_connection_server_handshake(void *tls_ctx,
++						struct tls_connection *conn,
++						const struct wpabuf *in_data,
++						struct wpabuf **appl_data)
++{
++	conn->is_server = 1;
++	return tls_connection_handshake(tls_ctx, conn, in_data, appl_data);
++}
++
++
++struct wpabuf * tls_connection_encrypt(void *tls_ctx,
++				       struct tls_connection *conn,
++				       const struct wpabuf *in_data)
++{
++	int res = mbedtls_ssl_write(&conn->ssl,
++	                            wpabuf_head_u8(in_data), wpabuf_len(in_data));
++	if (res < 0) {
++		elog(res, "mbedtls_ssl_write");
++		return NULL;
++	}
++
++	struct wpabuf *buf = conn->push_buf;
++	conn->push_buf = NULL;
++	return buf;
++}
++
++
++struct wpabuf * tls_connection_decrypt(void *tls_ctx,
++				       struct tls_connection *conn,
++				       const struct wpabuf *in_data)
++{
++	int res;
++	struct wpabuf *out;
++
++	/*assert(in_data != NULL);*/
++	if (!tls_pull_buf_append(conn, in_data))
++		return NULL;
++
++  #if defined(MBEDTLS_ZLIB_SUPPORT) /* removed in mbedtls 3.x */
++	/* Add extra buffer space to handle the possibility of decrypted
++	 * data being longer than input data due to TLS compression. */
++	out = wpabuf_alloc((wpabuf_len(in_data) + 500) * 3);
++  #else /* TLS compression is disabled in mbedtls 3.x */
++	out = wpabuf_alloc(wpabuf_len(in_data));
++  #endif
++	if (out == NULL)
++		return NULL;
++
++	res = mbedtls_ssl_read(&conn->ssl, wpabuf_mhead(out), wpabuf_size(out));
++	if (res < 0) {
++	  #if 1 /*(seems like a different error if wpabuf_len(in_data) == 0)*/
++		if (res == MBEDTLS_ERR_SSL_WANT_READ)
++			return out;
++	  #endif
++		elog(res, "mbedtls_ssl_read");
++		wpabuf_free(out);
++		return NULL;
++	}
++	wpabuf_put(out, res);
++
++	return out;
++}
++
++
++int tls_connection_resumed(void *tls_ctx, struct tls_connection *conn)
++{
++	/* XXX: might need to detect if session resumed from TLS session ticket
++	 * even if not special session ticket handling for EAP-FAST, EAP-TEAP */
++	/* (?ssl->handshake->resume during session ticket validation?) */
++	return conn && conn->resumed;
++}
++
++
++#ifdef TLS_MBEDTLS_EAP_FAST
++int tls_connection_set_cipher_list(void *tls_ctx, struct tls_connection *conn,
++				   u8 *ciphers)
++{
++	/* ciphers is list of TLS_CIPHER_* from hostap/src/crypto/tls.h */
++	int ids[7];
++	const int idsz = (int)sizeof(ids);
++	int nids = -1, id;
++	for ( ; *ciphers != TLS_CIPHER_NONE; ++ciphers) {
++		switch (*ciphers) {
++		case TLS_CIPHER_RC4_SHA:
++		  #ifdef MBEDTLS_TLS_RSA_WITH_RC4_128_SHA
++			id = MBEDTLS_TLS_RSA_WITH_RC4_128_SHA;
++			break;
++		  #else
++			continue; /*(not supported in mbedtls 3.x; ignore)*/
++		  #endif
++		case TLS_CIPHER_AES128_SHA:
++			id = MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA;
++			break;
++		case TLS_CIPHER_RSA_DHE_AES128_SHA:
++			id = MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA;
++			break;
++		case TLS_CIPHER_ANON_DH_AES128_SHA:
++			continue; /*(not supported in mbedtls; ignore)*/
++		case TLS_CIPHER_RSA_DHE_AES256_SHA:
++			id = MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA;
++			break;
++		case TLS_CIPHER_AES256_SHA:
++			id = MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA;
++			break;
++		default:
++			return -1; /* should not happen */
++		}
++		if (++nids == idsz)
++			return -1; /* should not happen */
++		ids[nids] = id;
++	}
++	if (nids < 0)
++		return 0; /* nothing to do */
++	if (++nids == idsz)
++		return -1; /* should not happen */
++	ids[nids] = 0; /* terminate list */
++	++nids;
++
++	return tls_mbedtls_set_ciphersuites(conn->tls_conf, ids, nids) ? 0 : -1;
++}
++#endif
++
++
++int tls_get_version(void *ssl_ctx, struct tls_connection *conn,
++		    char *buf, size_t buflen)
++{
++	if (conn == NULL)
++		return -1;
++	os_strlcpy(buf, mbedtls_ssl_get_version(&conn->ssl), buflen);
++	return buf[0] != 'u' ? 0 : -1; /*(-1 if "unknown")*/
++}
++
++
++#ifdef TLS_MBEDTLS_EAP_TEAP
++u16 tls_connection_get_cipher_suite(struct tls_connection *conn)
++{
++	if (conn == NULL)
++		return 0;
++	return (u16)mbedtls_ssl_get_ciphersuite_id_from_ssl(&conn->ssl);
++}
++#endif
++
++
++int tls_get_cipher(void *tls_ctx, struct tls_connection *conn,
++		   char *buf, size_t buflen)
++{
++	if (conn == NULL)
++		return -1;
++	const int id = mbedtls_ssl_get_ciphersuite_id_from_ssl(&conn->ssl);
++	return tls_mbedtls_translate_ciphername(id, buf, buflen) ? 0 : -1;
++}
++
++
++#ifdef TLS_MBEDTLS_SESSION_TICKETS
++
++int tls_connection_enable_workaround(void *tls_ctx,
++				     struct tls_connection *conn)
++{
++	/* (see comment in src/eap_peer/eap_fast.c:eap_fast_init()) */
++	/* XXX: is there a relevant setting for this in mbed TLS? */
++	/* (do we even care that much about older CBC ciphers?) */
++	return 0;
++}
++
++
++int tls_connection_client_hello_ext(void *tls_ctx, struct tls_connection *conn,
++				    int ext_type, const u8 *data,
++				    size_t data_len)
++{
++	/* (EAP-FAST and EAP-TEAP) */
++	if (ext_type == MBEDTLS_TLS_EXT_SESSION_TICKET) /*(ext_type == 35)*/
++		return tls_mbedtls_clienthello_session_ticket_prep(conn, data,
++		                                                   data_len);
++
++	return -1;
++}
++
++#endif /* TLS_MBEDTLS_SESSION_TICKETS */
++
++
++int tls_connection_get_failed(void *tls_ctx, struct tls_connection *conn)
++{
++	return conn ? conn->failed : -1;
++}
++
++
++int tls_connection_get_read_alerts(void *tls_ctx, struct tls_connection *conn)
++{
++	return conn ? conn->read_alerts : -1;
++}
++
++
++int tls_connection_get_write_alerts(void *tls_ctx,
++				    struct tls_connection *conn)
++{
++	return conn ? conn->write_alerts : -1;
++}
++
++
++#ifdef TLS_MBEDTLS_SESSION_TICKETS
++int tls_connection_set_session_ticket_cb(
++	void *tls_ctx, struct tls_connection *conn,
++	tls_session_ticket_cb cb, void *ctx)
++{
++	if (!(conn->tls_conf->flags & TLS_CONN_DISABLE_SESSION_TICKET)) {
++		/* (EAP-FAST and EAP-TEAP) */
++		conn->session_ticket_cb = cb;
++		conn->session_ticket_cb_ctx = ctx;
++		return 0;
++	}
++	return -1;
++}
++#endif
++
++
++int tls_get_library_version(char *buf, size_t buf_len)
++{
++  #ifndef MBEDTLS_VERSION_C
++	const char * const ver = "n/a";
++  #else
++	char ver[9];
++	mbedtls_version_get_string(ver);
++  #endif
++	return os_snprintf(buf, buf_len,
++	                   "mbed TLS build=" MBEDTLS_VERSION_STRING " run=%s", ver);
++}
++
++
++void tls_connection_set_success_data(struct tls_connection *conn,
++				     struct wpabuf *data)
++{
++	wpabuf_free(conn->success_data);
++	conn->success_data = data;
++}
++
++
++void tls_connection_set_success_data_resumed(struct tls_connection *conn)
++{
++}
++
++
++const struct wpabuf *
++tls_connection_get_success_data(struct tls_connection *conn)
++{
++	return conn->success_data;
++}
++
++
++void tls_connection_remove_session(struct tls_connection *conn)
++{
++}
++
++
++#ifdef TLS_MBEDTLS_EAP_TEAP
++int tls_get_tls_unique(struct tls_connection *conn, u8 *buf, size_t max_len)
++{
++  #if defined(MBEDTLS_SSL_RENEGOTIATION) /* XXX: renegotiation or resumption? */
++	/* data from TLS handshake Finished message */
++	size_t verify_len = conn->ssl.MBEDTLS_PRIVATE(verify_data_len);
++	char *verify_data = (conn->is_server ^ conn->resumed)
++	  ? conn->ssl.MBEDTLS_PRIVATE(peer_verify_data)
++	  : conn->ssl.MBEDTLS_PRIVATE(own_verify_data);
++	if (verify_len && verify_len <= max_len) {
++		os_memcpy(buf, verify_data, verify_len);
++		return (int)verify_len;
++	}
++  #endif
++	return -1;
++}
++#endif
++
++
++__attribute_noinline__
++static void tls_mbedtls_set_peer_subject(struct tls_connection *conn, const mbedtls_x509_crt *crt)
++{
++	if (conn->peer_subject)
++		return;
++	char buf[MBEDTLS_X509_MAX_DN_NAME_SIZE*2];
++	int buflen = mbedtls_x509_dn_gets(buf, sizeof(buf), &crt->subject);
++	if (buflen >= 0 && (conn->peer_subject = os_malloc((size_t)buflen+1)))
++		os_memcpy(conn->peer_subject, buf, (size_t)buflen+1);
++}
++
++
++#ifdef TLS_MBEDTLS_EAP_TEAP
++const char * tls_connection_get_peer_subject(struct tls_connection *conn)
++{
++	if (!conn)
++		return NULL;
++	if (!conn->peer_subject) { /*(if not set during cert verify)*/
++		const mbedtls_x509_crt *peer_cert =
++		  mbedtls_ssl_get_peer_cert(&conn->ssl);
++		if (peer_cert)
++			tls_mbedtls_set_peer_subject(conn, peer_cert);
++	}
++	return conn->peer_subject;
++}
++#endif
++
++
++#ifdef TLS_MBEDTLS_EAP_TEAP
++bool tls_connection_get_own_cert_used(struct tls_connection *conn)
++{
++	/* XXX: availability of cert does not necessary mean that client
++	 * received certificate request from server and then sent cert.
++	 * ? step handshake in tls_connection_handshake() looking for
++	 *   MBEDTLS_SSL_CERTIFICATE_REQUEST ? */
++	const struct tls_conf * const tls_conf = conn->tls_conf;
++	return (tls_conf->has_client_cert && tls_conf->has_private_key);
++}
++#endif
++
++
++#if defined(CONFIG_FIPS)
++#define TLS_MBEDTLS_CONFIG_FIPS
++#endif
++
++#if defined(CONFIG_SHA256)
++#define TLS_MBEDTLS_TLS_PRF_SHA256
++#endif
++
++#if defined(CONFIG_SHA384)
++#define TLS_MBEDTLS_TLS_PRF_SHA384
++#endif
++
++
++#ifndef TLS_MBEDTLS_CONFIG_FIPS
++#if defined(CONFIG_MODULE_TESTS)
++/* unused with CONFIG_TLS=mbedtls except in crypto_module_tests.c */
++#if MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */ \
++ && MBEDTLS_VERSION_NUMBER <  0x03000000 /* mbedtls 3.0.0 */
++/* sha1-tlsprf.c */
++#include "sha1.h"
++int tls_prf_sha1_md5(const u8 *secret, size_t secret_len, const char *label,
++		     const u8 *seed, size_t seed_len, u8 *out, size_t outlen)
++{
++	return mbedtls_ssl_tls_prf(MBEDTLS_SSL_TLS_PRF_TLS1,
++				   secret, secret_len, label,
++				   seed, seed_len, out, outlen) ? -1 : 0;
++}
++#else
++#include "sha1-tlsprf.c" /* pull in hostap local implementation */
++#endif
++#endif
++#endif
++
++#ifdef TLS_MBEDTLS_TLS_PRF_SHA256
++/* sha256-tlsprf.c */
++#if MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */
++#include "sha256.h"
++int tls_prf_sha256(const u8 *secret, size_t secret_len, const char *label,
++		   const u8 *seed, size_t seed_len, u8 *out, size_t outlen)
++{
++	return mbedtls_ssl_tls_prf(MBEDTLS_SSL_TLS_PRF_SHA256,
++				   secret, secret_len, label,
++				   seed, seed_len, out, outlen) ? -1 : 0;
++}
++#else
++#include "sha256-tlsprf.c" /* pull in hostap local implementation */
++#endif
++#endif
++
++#ifdef TLS_MBEDTLS_TLS_PRF_SHA384
++/* sha384-tlsprf.c */
++#if MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */
++#include "sha384.h"
++int tls_prf_sha384(const u8 *secret, size_t secret_len, const char *label,
++		   const u8 *seed, size_t seed_len, u8 *out, size_t outlen)
++{
++	return mbedtls_ssl_tls_prf(MBEDTLS_SSL_TLS_PRF_SHA384,
++				   secret, secret_len, label,
++				   seed, seed_len, out, outlen) ? -1 : 0;
++}
++#else
++#include "sha384-tlsprf.c" /* pull in hostap local implementation */
++#endif
++#endif
++
++
++#if MBEDTLS_VERSION_NUMBER < 0x03020000 /* mbedtls 3.2.0 */
++#define mbedtls_x509_crt_has_ext_type(crt, ext_type) \
++        ((crt)->MBEDTLS_PRIVATE(ext_types) & (ext_type))
++#endif
++
++struct mlist { const char *p; size_t n; };
++
++
++static int
++tls_mbedtls_match_altsubject(mbedtls_x509_crt *crt, const char *match)
++{
++	/* RFE: this could be pre-parsed into structured data at config time */
++	struct mlist list[256]; /*(much larger than expected)*/
++	int nlist = 0;
++	if (   os_strncmp(match, "EMAIL:", 6) != 0
++	    && os_strncmp(match, "DNS:",   4) != 0
++	    && os_strncmp(match, "URI:",   4) != 0   ) {
++		wpa_printf(MSG_INFO, "MTLS: Invalid altSubjectName match '%s'", match);
++		return 0;
++	}
++	for (const char *s = match, *tok; *s; s = tok ? tok+1 : "") {
++		do { } while ((tok = os_strchr(s, ';'))
++		              && os_strncmp(tok+1, "EMAIL:", 6) != 0
++		              && os_strncmp(tok+1, "DNS:",   4) != 0
++		              && os_strncmp(tok+1, "URI:",   4) != 0);
++		list[nlist].p = s;
++		list[nlist].n = tok ? (size_t)(tok - s) : os_strlen(s);
++		if (list[nlist].n && ++nlist == sizeof(list)/sizeof(*list)) {
++			wpa_printf(MSG_INFO, "MTLS: excessive altSubjectName match '%s'",
++			           match);
++			break; /* truncate huge list and continue */
++		}
++	}
++
++	if (!mbedtls_x509_crt_has_ext_type(crt, MBEDTLS_X509_EXT_SUBJECT_ALT_NAME))
++		return 0;
++
++	const mbedtls_x509_sequence *cur = &crt->subject_alt_names;
++	for (; cur != NULL; cur = cur->next) {
++		const unsigned char san_type = (unsigned char)cur->buf.tag
++		                             & MBEDTLS_ASN1_TAG_VALUE_MASK;
++		char t;
++		size_t step = 4;
++		switch (san_type) {             /* "EMAIL:" or "DNS:" or "URI:" */
++		case MBEDTLS_X509_SAN_RFC822_NAME:       step = 6; t = 'E'; break;
++		case MBEDTLS_X509_SAN_DNS_NAME:                    t = 'D'; break;
++		case MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER: t = 'U'; break;
++		default: continue;
++		}
++
++		for (int i = 0; i < nlist; ++i) {
++			/* step over "EMAIL:" or "DNS:" or "URI:" in list[i].p */
++			/* Note: v is not '\0'-terminated, but is a known length vlen,
++			 * so okay to pass to os_strncasecmp() even though not z-string */
++			if (cur->buf.len == list[i].n - step && t == *list[i].p
++			    && 0 == os_strncasecmp((char *)cur->buf.p,
++			                           list[i].p+step, cur->buf.len)) {
++				return 1; /* match */
++			}
++		}
++	}
++	return 0; /* no match */
++}
++
++
++static int
++tls_mbedtls_match_suffix(const char *v, size_t vlen,
++                         const struct mlist *list, int nlist, int full)
++{
++	/* Note: v is not '\0'-terminated, but is a known length vlen,
++	 * so okay to pass to os_strncasecmp() even though not z-string */
++	for (int i = 0; i < nlist; ++i) {
++		size_t n = list[i].n;
++		if ((n == vlen || (n < vlen && v[vlen-n-1] == '.' && !full))
++		    && 0 == os_strncasecmp(v+vlen-n, list[i].p, n))
++			return 1; /* match */
++	}
++	return 0; /* no match */
++}
++
++
++static int
++tls_mbedtls_match_suffixes(mbedtls_x509_crt *crt, const char *match, int full)
++{
++	/* RFE: this could be pre-parsed into structured data at config time */
++	struct mlist list[256]; /*(much larger than expected)*/
++	int nlist = 0;
++	for (const char *s = match, *tok; *s; s = tok ? tok+1 : "") {
++		tok = os_strchr(s, ';');
++		list[nlist].p = s;
++		list[nlist].n = tok ? (size_t)(tok - s) : os_strlen(s);
++		if (list[nlist].n && ++nlist == sizeof(list)/sizeof(*list)) {
++			wpa_printf(MSG_INFO, "MTLS: excessive suffix match '%s'", match);
++			break; /* truncate huge list and continue */
++		}
++	}
++
++	/* check subjectAltNames */
++	if (mbedtls_x509_crt_has_ext_type(crt, MBEDTLS_X509_EXT_SUBJECT_ALT_NAME)) {
++		const mbedtls_x509_sequence *cur = &crt->subject_alt_names;
++		for (; cur != NULL; cur = cur->next) {
++			const unsigned char san_type = (unsigned char)cur->buf.tag
++			                             & MBEDTLS_ASN1_TAG_VALUE_MASK;
++			if (san_type == MBEDTLS_X509_SAN_DNS_NAME
++			    && tls_mbedtls_match_suffix((char *)cur->buf.p,
++			                                cur->buf.len,
++			                                list, nlist, full)) {
++				return 1; /* match */
++			}
++		}
++	}
++
++	/* check subject CN */
++	const mbedtls_x509_name *name = &crt->subject;
++	for (; name != NULL; name = name->next) {
++		if (name->oid.p && MBEDTLS_OID_CMP(MBEDTLS_OID_AT_CN, &name->oid) == 0)
++			break;
++	}
++	if (name && tls_mbedtls_match_suffix((char *)name->val.p, name->val.len,
++	                                     list, nlist, full)) {
++		return 1; /* match */
++	}
++
++	return 0; /* no match */
++}
++
++
++static int
++tls_mbedtls_match_dn_field(mbedtls_x509_crt *crt, const char *match)
++{
++	/* RFE: this could be pre-parsed into structured data at config time */
++	struct mlistoid { const char *p; size_t n;
++	                  const char *oid; size_t olen;
++	                  int prefix; };
++	struct mlistoid list[32]; /*(much larger than expected)*/
++	int nlist = 0;
++	for (const char *s = match, *tok, *e; *s; s = tok ? tok+1 : "") {
++		tok = os_strchr(s, '/');
++		list[nlist].oid = NULL;
++		list[nlist].olen = 0;
++		list[nlist].n = tok ? (size_t)(tok - s) : os_strlen(s);
++		e = memchr(s, '=', list[nlist].n);
++		if (e == NULL) {
++			if (list[nlist].n == 0)
++				continue; /* skip consecutive, repeated '/' */
++			if (list[nlist].n == 1 && *s == '*') {
++				/* special-case "*" to match any OID and value */
++				s = e = "=*";
++				list[nlist].n = 2;
++				list[nlist].oid = "";
++			}
++			else {
++				wpa_printf(MSG_INFO,
++				           "MTLS: invalid check_cert_subject '%s' missing '='",
++				           match);
++				return 0;
++			}
++		}
++		switch (e - s) {
++		case 1:
++			if (*s == 'C') {
++				list[nlist].oid  = MBEDTLS_OID_AT_COUNTRY;
++				list[nlist].olen = sizeof(MBEDTLS_OID_AT_COUNTRY)-1;
++			}
++			else if (*s == 'L') {
++				list[nlist].oid  = MBEDTLS_OID_AT_LOCALITY;
++				list[nlist].olen = sizeof(MBEDTLS_OID_AT_LOCALITY)-1;
++			}
++			else if (*s == 'O') {
++				list[nlist].oid  = MBEDTLS_OID_AT_ORGANIZATION;
++				list[nlist].olen = sizeof(MBEDTLS_OID_AT_ORGANIZATION)-1;
++			}
++			break;
++		case 2:
++			if (s[0] == 'C' && s[1] == 'N') {
++				list[nlist].oid  = MBEDTLS_OID_AT_CN;
++				list[nlist].olen = sizeof(MBEDTLS_OID_AT_CN)-1;
++			}
++			else if (s[0] == 'S' && s[1] == 'T') {
++				list[nlist].oid  = MBEDTLS_OID_AT_STATE;
++				list[nlist].olen = sizeof(MBEDTLS_OID_AT_STATE)-1;
++			}
++			else if (s[0] == 'O' && s[1] == 'U') {
++				list[nlist].oid  = MBEDTLS_OID_AT_ORG_UNIT;
++				list[nlist].olen = sizeof(MBEDTLS_OID_AT_ORG_UNIT)-1;
++			}
++			break;
++		case 12:
++			if (os_memcmp(s, "emailAddress", 12) == 0) {
++				list[nlist].oid  = MBEDTLS_OID_PKCS9_EMAIL;
++				list[nlist].olen = sizeof(MBEDTLS_OID_PKCS9_EMAIL)-1;
++			}
++			break;
++		default:
++			break;
++		}
++		if (list[nlist].oid == NULL) {
++			wpa_printf(MSG_INFO,
++			           "MTLS: Unknown field in check_cert_subject '%s'",
++			           match);
++			return 0;
++		}
++		list[nlist].n -= (size_t)(++e - s);
++		list[nlist].p = e;
++		if (list[nlist].n && e[list[nlist].n-1] == '*') {
++			--list[nlist].n;
++			list[nlist].prefix = 1;
++		}
++		/*(could easily add support for suffix matches if value begins with '*',
++		 * but suffix match is not currently supported by other TLS modules)*/
++
++		if (list[nlist].n && ++nlist == sizeof(list)/sizeof(*list)) {
++			wpa_printf(MSG_INFO,
++			           "MTLS: excessive check_cert_subject match '%s'",
++			           match);
++			break; /* truncate huge list and continue */
++		}
++	}
++
++	/* each component in match string must match cert Subject in order listed
++	 * The behavior below preserves ordering but is slightly different than
++	 * the grossly inefficient contortions implemented in tls_openssl.c */
++	const mbedtls_x509_name *name = &crt->subject;
++	for (int i = 0; i < nlist; ++i) {
++		int found = 0;
++		for (; name != NULL && !found; name = name->next) {
++			if (!name->oid.p)
++				continue;
++			/* special-case "*" to match any OID and value */
++			if (list[i].olen == 0) {
++				found = 1;
++				continue;
++			}
++			/* perform equalent of !MBEDTLS_OID_CMP() with oid ptr and len */
++			if (list[i].olen != name->oid.len
++			    || os_memcmp(list[i].oid, name->oid.p, name->oid.len) != 0)
++				continue;
++			/* Note: v is not '\0'-terminated, but is a known length vlen,
++			 * so okay to pass to os_strncasecmp() even though not z-string */
++			if ((list[i].prefix
++			      ? list[i].n <= name->val.len  /* prefix match */
++			      : list[i].n == name->val.len) /* full match */
++			    && 0 == os_strncasecmp((char *)name->val.p,
++			                           list[i].p, list[i].n)) {
++				found = 1;
++				continue;
++			}
++		}
++		if (!found)
++			return 0; /* no match */
++	}
++	return 1; /* match */
++}
++
++
++__attribute_cold__
++static void
++tls_mbedtls_verify_fail_event (mbedtls_x509_crt *crt, int depth,
++                               const char *errmsg, enum tls_fail_reason reason)
++{
++	struct tls_config *init_conf = &tls_ctx_global.init_conf;
++	if (init_conf->event_cb == NULL)
++		return;
++
++	struct wpabuf *certbuf = wpabuf_alloc_copy(crt->raw.p, crt->raw.len);
++	char subject[MBEDTLS_X509_MAX_DN_NAME_SIZE*2];
++	if (mbedtls_x509_dn_gets(subject, sizeof(subject), &crt->subject) < 0)
++		subject[0] = '\0';
++	union tls_event_data ev;
++	os_memset(&ev, 0, sizeof(ev));
++	ev.cert_fail.reason = reason;
++	ev.cert_fail.depth = depth;
++	ev.cert_fail.subject = subject;
++	ev.cert_fail.reason_txt = errmsg;
++	ev.cert_fail.cert = certbuf;
++
++	init_conf->event_cb(init_conf->cb_ctx, TLS_CERT_CHAIN_FAILURE, &ev);
++
++	wpabuf_free(certbuf);
++}
++
++
++__attribute_noinline__
++static void
++tls_mbedtls_verify_cert_event (struct tls_connection *conn,
++                               mbedtls_x509_crt *crt, int depth)
++{
++	struct tls_config *init_conf = &tls_ctx_global.init_conf;
++	if (init_conf->event_cb == NULL)
++		return;
++
++	struct wpabuf *certbuf = NULL;
++	union tls_event_data ev;
++	os_memset(&ev, 0, sizeof(ev));
++
++  #ifdef MBEDTLS_SHA256_C
++	u8 hash[SHA256_DIGEST_LENGTH];
++	const u8 *addr[] = { (u8 *)crt->raw.p };
++	if (sha256_vector(1, addr, &crt->raw.len, hash) == 0) {
++		ev.peer_cert.hash = hash;
++		ev.peer_cert.hash_len = sizeof(hash);
++	}
++  #endif
++	ev.peer_cert.depth = depth;
++	char subject[MBEDTLS_X509_MAX_DN_NAME_SIZE*2];
++	if (depth == 0)
++		ev.peer_cert.subject = conn->peer_subject;
++	if (ev.peer_cert.subject == NULL) {
++		ev.peer_cert.subject = subject;
++		if (mbedtls_x509_dn_gets(subject, sizeof(subject), &crt->subject) < 0)
++			subject[0] = '\0';
++	}
++
++	char serial_num[128+1];
++	ev.peer_cert.serial_num =
++	  tls_mbedtls_peer_serial_num(crt, serial_num, sizeof(serial_num));
++
++	const mbedtls_x509_sequence *cur;
++
++	cur = NULL;
++	if (mbedtls_x509_crt_has_ext_type(crt, MBEDTLS_X509_EXT_SUBJECT_ALT_NAME))
++		cur = &crt->subject_alt_names;
++	for (; cur != NULL; cur = cur->next) {
++		const unsigned char san_type = (unsigned char)cur->buf.tag
++		                             & MBEDTLS_ASN1_TAG_VALUE_MASK;
++		size_t prelen = 4;
++		const char *pre;
++		switch (san_type) {
++		case MBEDTLS_X509_SAN_RFC822_NAME:     prelen = 6; pre = "EMAIL:";break;
++		case MBEDTLS_X509_SAN_DNS_NAME:                    pre = "DNS:";  break;
++		case MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER: pre = "URI:";  break;
++		default: continue;
++		}
++
++		char *pos = os_malloc(prelen + cur->buf.len + 1);
++		if (pos == NULL)
++			break;
++		ev.peer_cert.altsubject[ev.peer_cert.num_altsubject] = pos;
++		os_memcpy(pos, pre, prelen);
++		/* data should be properly backslash-escaped if needed,
++		 * so code below does not re-escape, but does replace CTLs */
++		/*os_memcpy(pos+prelen, cur->buf.p, cur->buf.len);*/
++		/*pos[prelen+cur->buf.len] = '\0';*/
++		pos += prelen;
++		for (size_t i = 0; i < cur->buf.len; ++i) {
++			unsigned char c = cur->buf.p[i];
++			*pos++ = (c >= 32 && c != 127) ? c : '?';
++		}
++		*pos = '\0';
++
++		if (++ev.peer_cert.num_altsubject == TLS_MAX_ALT_SUBJECT)
++			break;
++	}
++
++	cur = NULL;
++	if (mbedtls_x509_crt_has_ext_type(crt, MBEDTLS_X509_EXT_CERTIFICATE_POLICIES))
++		cur = &crt->certificate_policies;
++	for (; cur != NULL; cur = cur->next) {
++		if (cur->buf.len != 11) /* len of OID_TOD_STRICT or OID_TOD_TOFU */
++			continue;
++		/* TOD-STRICT "1.3.6.1.4.1.40808.1.3.1" */
++		/* TOD-TOFU   "1.3.6.1.4.1.40808.1.3.2" */
++		#define OID_TOD_STRICT "\x2b\x06\x01\x04\x01\x82\xbe\x68\x01\x03\x01"
++		#define OID_TOD_TOFU   "\x2b\x06\x01\x04\x01\x82\xbe\x68\x01\x03\x02"
++		if (os_memcmp(cur->buf.p,
++		              OID_TOD_STRICT, sizeof(OID_TOD_STRICT)-1) == 0) {
++			ev.peer_cert.tod = 1; /* TOD-STRICT */
++			break;
++		}
++		if (os_memcmp(cur->buf.p,
++		              OID_TOD_TOFU, sizeof(OID_TOD_TOFU)-1) == 0) {
++			ev.peer_cert.tod = 2; /* TOD-TOFU */
++			break;
++		}
++	}
++
++	struct tls_conf *tls_conf = conn->tls_conf;
++	if (tls_conf->ca_cert_probe || (tls_conf->flags & TLS_CONN_EXT_CERT_CHECK)
++	    || init_conf->cert_in_cb) {
++		certbuf = wpabuf_alloc_copy(crt->raw.p, crt->raw.len);
++		ev.peer_cert.cert = certbuf;
++	}
++
++	init_conf->event_cb(init_conf->cb_ctx, TLS_PEER_CERTIFICATE, &ev);
++
++	wpabuf_free(certbuf);
++	char **altsubject;
++	*(const char ***)&altsubject = ev.peer_cert.altsubject;
++	for (size_t i = 0; i < ev.peer_cert.num_altsubject; ++i)
++		os_free(altsubject[i]);
++}
++
++
++static int
++tls_mbedtls_verify_cb (void *arg, mbedtls_x509_crt *crt, int depth, uint32_t *flags)
++{
++	/* XXX: N.B. verify code not carefully tested besides hwsim tests
++	 *
++	 * RFE: mbedtls_x509_crt_verify_info() and enhance log trace messages
++	 * RFE: review and add support for additional TLS_CONN_* flags
++	 * not handling OCSP (not available in mbedtls)
++	 * ... */
++
++	struct tls_connection *conn = (struct tls_connection *)arg;
++	struct tls_conf *tls_conf = conn->tls_conf;
++	uint32_t flags_in = *flags;
++
++	if (depth > 8) { /*(depth 8 picked as arbitrary limit)*/
++		emsg(MSG_WARNING, "client cert chain too long");
++		*flags |= MBEDTLS_X509_BADCERT_OTHER; /* cert chain too long */
++		tls_mbedtls_verify_fail_event(crt, depth,
++			                      "client cert chain too long",
++		                              TLS_FAIL_BAD_CERTIFICATE);
++	}
++	else if (tls_conf->verify_depth0_only) {
++		if (depth > 0)
++			*flags = 0;
++		else {
++		  #ifdef MBEDTLS_SHA256_C
++			u8 hash[SHA256_DIGEST_LENGTH];
++			const u8 *addr[] = { (u8 *)crt->raw.p };
++			if (sha256_vector(1, addr, &crt->raw.len, hash) < 0
++			    || os_memcmp(tls_conf->ca_cert_hash, hash, sizeof(hash)) != 0) {
++				*flags |= MBEDTLS_X509_BADCERT_NOT_TRUSTED;
++				tls_mbedtls_verify_fail_event(crt, depth,
++			                                      "cert hash mismatch",
++				                              TLS_FAIL_UNTRUSTED);
++			}
++			else /* hash matches; ignore other issues *except* if revoked)*/
++				*flags &= MBEDTLS_X509_BADCERT_REVOKED;
++		  #endif
++		}
++	}
++	else if (depth == 0) {
++		if (!conn->peer_subject)
++			tls_mbedtls_set_peer_subject(conn, crt);
++		/*(use same labels to tls_mbedtls_verify_fail_event() as used in
++		 * other TLS modules so that hwsim tests find exact string match)*/
++		if (!conn->peer_subject) { /* error copying subject string */
++			*flags |= MBEDTLS_X509_BADCERT_OTHER;
++			tls_mbedtls_verify_fail_event(crt, depth,
++			                              "internal error",
++			                              TLS_FAIL_UNSPECIFIED);
++		}
++		/*(use os_strstr() for subject match as is done in tls_mbedtls.c
++		 * to follow the same behavior, even though a suffix match would
++		 * make more sense.  Also, note that strstr match does not
++		 * normalize whitespace (between components) for comparison)*/
++		else if (tls_conf->subject_match
++		         && os_strstr(conn->peer_subject,
++		                      tls_conf->subject_match) == NULL) {
++			wpa_printf(MSG_WARNING,
++			           "MTLS: Subject '%s' did not match with '%s'",
++			           conn->peer_subject, tls_conf->subject_match);
++			*flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
++			tls_mbedtls_verify_fail_event(crt, depth,
++			                              "Subject mismatch",
++			                              TLS_FAIL_SUBJECT_MISMATCH);
++		}
++		if (tls_conf->altsubject_match
++		    && !tls_mbedtls_match_altsubject(crt, tls_conf->altsubject_match)) {
++			wpa_printf(MSG_WARNING,
++				   "MTLS: altSubjectName match '%s' not found",
++			           tls_conf->altsubject_match);
++			*flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
++			tls_mbedtls_verify_fail_event(crt, depth,
++			                              "AltSubject mismatch",
++			                              TLS_FAIL_ALTSUBJECT_MISMATCH);
++		}
++		if (tls_conf->suffix_match
++		    && !tls_mbedtls_match_suffixes(crt, tls_conf->suffix_match, 0)) {
++			wpa_printf(MSG_WARNING,
++			           "MTLS: Domain suffix match '%s' not found",
++				   tls_conf->suffix_match);
++			*flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
++			tls_mbedtls_verify_fail_event(crt, depth,
++			                              "Domain suffix mismatch",
++			                              TLS_FAIL_DOMAIN_SUFFIX_MISMATCH);
++		}
++		if (tls_conf->domain_match
++		    && !tls_mbedtls_match_suffixes(crt, tls_conf->domain_match, 1)) {
++			wpa_printf(MSG_WARNING,
++			           "MTLS: Domain match '%s' not found",
++				   tls_conf->domain_match);
++			*flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
++			tls_mbedtls_verify_fail_event(crt, depth,
++			                              "Domain mismatch",
++			                              TLS_FAIL_DOMAIN_MISMATCH);
++		}
++		if (tls_conf->check_cert_subject
++		    && !tls_mbedtls_match_dn_field(crt, tls_conf->check_cert_subject)) {
++			*flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
++			tls_mbedtls_verify_fail_event(crt, depth,
++			                              "Distinguished Name",
++			                              TLS_FAIL_DN_MISMATCH);
++		}
++		if (tls_conf->flags & TLS_CONN_SUITEB) {
++			/* check RSA modulus size (public key bitlen) */
++			const mbedtls_pk_type_t pk_alg = mbedtls_pk_get_type(&crt->pk);
++			if ((pk_alg == MBEDTLS_PK_RSA || pk_alg == MBEDTLS_PK_RSASSA_PSS)
++			    && mbedtls_pk_get_bitlen(&crt->pk) < 3072) {
++				/* hwsim suite_b RSA tests expect 3072
++				 *   suite_b_192_rsa_ecdhe_radius_rsa2048_client
++				 *   suite_b_192_rsa_dhe_radius_rsa2048_client */
++				*flags |= MBEDTLS_X509_BADCERT_BAD_KEY;
++				tls_mbedtls_verify_fail_event(crt, depth,
++				                              "Insufficient RSA modulus size",
++				                              TLS_FAIL_INSUFFICIENT_KEY_LEN);
++			}
++		}
++		if (tls_conf->check_crl && tls_conf->crl == NULL) {
++			/* see tests/hwsim test_ap_eap.py ap_wpa2_eap_tls_check_crl */
++			emsg(MSG_WARNING, "check_crl set but no CRL loaded; reject all?");
++			*flags |= MBEDTLS_X509_BADCERT_OTHER;
++			tls_mbedtls_verify_fail_event(crt, depth,
++				                      "check_crl set but no CRL loaded; "
++			                              "reject all?",
++			                              TLS_FAIL_BAD_CERTIFICATE);
++		}
++	}
++	else {
++		if (tls_conf->check_crl != 2) /* 2 == verify CRLs for all certs */
++			*flags &= ~MBEDTLS_X509_BADCERT_REVOKED;
++	}
++
++	if (!tls_conf->check_crl_strict) {
++		*flags &= ~MBEDTLS_X509_BADCRL_EXPIRED;
++		*flags &= ~MBEDTLS_X509_BADCRL_FUTURE;
++	}
++
++	if (tls_conf->flags & TLS_CONN_DISABLE_TIME_CHECKS) {
++		*flags &= ~MBEDTLS_X509_BADCERT_EXPIRED;
++		*flags &= ~MBEDTLS_X509_BADCERT_FUTURE;
++	}
++
++	tls_mbedtls_verify_cert_event(conn, crt, depth);
++
++	if (*flags) {
++		if (*flags & (MBEDTLS_X509_BADCERT_NOT_TRUSTED
++		             |MBEDTLS_X509_BADCERT_CN_MISMATCH
++		             |MBEDTLS_X509_BADCERT_REVOKED)) {
++			emsg(MSG_WARNING, "client cert not trusted");
++		}
++		/* report event if flags set but no additional flags set above */
++		/* (could translate flags to more detailed TLS_FAIL_* if needed) */
++		if (!(*flags & ~flags_in)) {
++			enum tls_fail_reason reason = TLS_FAIL_UNSPECIFIED;
++			const char *errmsg = "cert verify fail unspecified";
++			if (*flags & MBEDTLS_X509_BADCERT_NOT_TRUSTED) {
++				reason = TLS_FAIL_UNTRUSTED;
++				errmsg = "certificate not trusted";
++			}
++			if (*flags & MBEDTLS_X509_BADCERT_REVOKED) {
++				reason = TLS_FAIL_REVOKED;
++				errmsg = "certificate has been revoked";
++			}
++			if (*flags & MBEDTLS_X509_BADCERT_FUTURE) {
++				reason = TLS_FAIL_NOT_YET_VALID;
++				errmsg = "certificate not yet valid";
++			}
++			if (*flags & MBEDTLS_X509_BADCERT_EXPIRED) {
++				reason = TLS_FAIL_EXPIRED;
++				errmsg = "certificate has expired";
++			}
++			if (*flags & MBEDTLS_X509_BADCERT_BAD_MD) {
++				reason = TLS_FAIL_BAD_CERTIFICATE;
++				errmsg = "certificate uses insecure algorithm";
++			}
++			tls_mbedtls_verify_fail_event(crt, depth, errmsg, reason);
++		}
++	  #if 0
++		/* ??? send (again) cert events for all certs in chain ???
++		 * (should already have been called for greater depths) */
++		/* tls_openssl.c:tls_verify_cb() sends cert events for all certs
++		 * in chain if certificate validation fails, but sends all events
++		 * with depth set to 0 (might be a bug) */
++		if (depth > 0) {
++			int pdepth = depth + 1;
++			for (mbedtls_x509_crt *pcrt; (pcrt = crt->next); ++pdepth) {
++				tls_mbedtls_verify_cert_event(conn, pcrt, pdepth);
++			}
++		}
++	  #endif
++		/*(do not preserve subject if verification failed but was optional)*/
++		if (depth == 0 && conn->peer_subject) {
++			os_free(conn->peer_subject);
++			conn->peer_subject = NULL;
++		}
++	}
++	else if (depth == 0) {
++		struct tls_config *init_conf = &tls_ctx_global.init_conf;
++		if (tls_conf->ca_cert_probe) {
++			/* reject server certificate on probe-only run */
++			*flags |= MBEDTLS_X509_BADCERT_OTHER;
++			tls_mbedtls_verify_fail_event(crt, depth,
++			                              "server chain probe",
++			                              TLS_FAIL_SERVER_CHAIN_PROBE);
++		}
++		else if (init_conf->event_cb) {
++			/* ??? send event as soon as depth == 0 is verified ???
++			 * What about rest of chain?
++			 * Follows tls_mbedtls.c behavior: */
++			init_conf->event_cb(init_conf->cb_ctx,
++			                    TLS_CERT_CHAIN_SUCCESS, NULL);
++		}
++	}
++
++	return 0;
++}
+--- /dev/null
++++ b/tests/build/build-wpa_supplicant-mbedtls.config
+@@ -0,0 +1,24 @@
++CONFIG_TLS=mbedtls
++
++CONFIG_WPS=y
++CONFIG_EAP_TLS=y
++CONFIG_EAP_MSCHAPV2=y
++
++CONFIG_EAP_PSK=y
++CONFIG_EAP_GPSK=y
++CONFIG_EAP_AKA=y
++CONFIG_EAP_SIM=y
++CONFIG_EAP_SAKE=y
++CONFIG_EAP_PAX=y
++CONFIG_EAP_FAST=y
++CONFIG_EAP_IKEV2=y
++
++CONFIG_SAE=y
++CONFIG_FILS=y
++CONFIG_FILS_SK_PFS=y
++CONFIG_OWE=y
++CONFIG_DPP=y
++CONFIG_SUITEB=y
++CONFIG_SUITEB192=y
++
++CFLAGS += -Werror
+--- a/tests/hwsim/example-hostapd.config
++++ b/tests/hwsim/example-hostapd.config
+@@ -4,6 +4,7 @@ CONFIG_DRIVER_NONE=y
+ CONFIG_DRIVER_NL80211=y
+ CONFIG_RSN_PREAUTH=y
+ 
++#CONFIG_TLS=mbedtls
+ #CONFIG_TLS=internal
+ #CONFIG_INTERNAL_LIBTOMMATH=y
+ #CONFIG_INTERNAL_LIBTOMMATH_FAST=y
+@@ -39,6 +40,9 @@ endif
+ ifeq ($(CONFIG_TLS), wolfssl)
+ CONFIG_EAP_PWD=y
+ endif
++ifeq ($(CONFIG_TLS), mbedtls)
++CONFIG_EAP_PWD=y
++endif
+ CONFIG_EAP_EKE=y
+ CONFIG_PKCS12=y
+ CONFIG_RADIUS_SERVER=y
+--- a/tests/hwsim/example-wpa_supplicant.config
++++ b/tests/hwsim/example-wpa_supplicant.config
+@@ -2,6 +2,7 @@
+ 
+ CONFIG_TLS=openssl
+ #CONFIG_TLS=wolfssl
++#CONFIG_TLS=mbedtls
+ #CONFIG_TLS=internal
+ #CONFIG_INTERNAL_LIBTOMMATH=y
+ #CONFIG_INTERNAL_LIBTOMMATH_FAST=y
+@@ -41,6 +42,9 @@ endif
+ ifeq ($(CONFIG_TLS), wolfssl)
+ CONFIG_EAP_PWD=y
+ endif
++ifeq ($(CONFIG_TLS), mbedtls)
++CONFIG_EAP_PWD=y
++endif
+ 
+ CONFIG_USIM_SIMULATOR=y
+ CONFIG_SIM_SIMULATOR=y
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -1163,6 +1163,29 @@ endif
+ CFLAGS += -DTLS_DEFAULT_CIPHERS=\"$(CONFIG_TLS_DEFAULT_CIPHERS)\"
+ endif
+ 
++ifeq ($(CONFIG_TLS), mbedtls)
++ifndef CONFIG_CRYPTO
++CONFIG_CRYPTO=mbedtls
++endif
++ifdef TLS_FUNCS
++OBJS += ../src/crypto/tls_mbedtls.o
++LIBS += -lmbedtls -lmbedx509
++endif
++OBJS += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
++OBJS_p += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
++OBJS_priv += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
++ifdef NEED_FIPS186_2_PRF
++OBJS += ../src/crypto/fips_prf_internal.o
++SHA1OBJS += ../src/crypto/sha1-internal.o
++endif
++ifeq ($(CONFIG_CRYPTO), mbedtls)
++LIBS += -lmbedcrypto
++LIBS_p += -lmbedcrypto
++# XXX: create a config option?
++CFLAGS += -DCRYPTO_RSA_OAEP_SHA256
++endif
++endif
++
+ ifeq ($(CONFIG_TLS), gnutls)
+ ifndef CONFIG_CRYPTO
+ # default to libgcrypt
+@@ -1355,9 +1378,11 @@ endif
+ 
+ ifneq ($(CONFIG_TLS), openssl)
+ ifneq ($(CONFIG_TLS), wolfssl)
++ifneq ($(CONFIG_TLS), mbedtls)
+ NEED_INTERNAL_AES_WRAP=y
+ endif
+ endif
++endif
+ ifdef CONFIG_OPENSSL_INTERNAL_AES_WRAP
+ # Seems to be needed at least with BoringSSL
+ NEED_INTERNAL_AES_WRAP=y
+@@ -1371,9 +1396,11 @@ endif
+ 
+ ifdef NEED_INTERNAL_AES_WRAP
+ ifneq ($(CONFIG_TLS), linux)
++ifneq ($(CONFIG_TLS), mbedtls)
+ AESOBJS += ../src/crypto/aes-unwrap.o
+ endif
+ endif
++endif
+ ifdef NEED_AES_EAX
+ AESOBJS += ../src/crypto/aes-eax.o
+ NEED_AES_CTR=y
+@@ -1383,35 +1410,45 @@ AESOBJS += ../src/crypto/aes-siv.o
+ NEED_AES_CTR=y
+ endif
+ ifdef NEED_AES_CTR
++ifneq ($(CONFIG_TLS), mbedtls)
+ AESOBJS += ../src/crypto/aes-ctr.o
+ endif
++endif
+ ifdef NEED_AES_ENCBLOCK
++ifneq ($(CONFIG_TLS), mbedtls)
+ AESOBJS += ../src/crypto/aes-encblock.o
+ endif
++endif
+ NEED_AES_ENC=y
+ ifneq ($(CONFIG_TLS), openssl)
+ ifneq ($(CONFIG_TLS), linux)
+ ifneq ($(CONFIG_TLS), wolfssl)
++ifneq ($(CONFIG_TLS), mbedtls)
+ AESOBJS += ../src/crypto/aes-omac1.o
+ endif
+ endif
+ endif
++endif
+ ifdef NEED_AES_WRAP
+ NEED_AES_ENC=y
+ ifdef NEED_INTERNAL_AES_WRAP
++ifneq ($(CONFIG_TLS), mbedtls)
+ AESOBJS += ../src/crypto/aes-wrap.o
+ endif
+ endif
++endif
+ ifdef NEED_AES_CBC
+ NEED_AES_ENC=y
+ ifneq ($(CONFIG_TLS), openssl)
+ ifneq ($(CONFIG_TLS), linux)
+ ifneq ($(CONFIG_TLS), wolfssl)
++ifneq ($(CONFIG_TLS), mbedtls)
+ AESOBJS += ../src/crypto/aes-cbc.o
+ endif
+ endif
+ endif
+ endif
++endif
+ ifdef NEED_AES_ENC
+ ifdef CONFIG_INTERNAL_AES
+ AESOBJS += ../src/crypto/aes-internal-enc.o
+@@ -1426,12 +1463,16 @@ ifneq ($(CONFIG_TLS), openssl)
+ ifneq ($(CONFIG_TLS), linux)
+ ifneq ($(CONFIG_TLS), gnutls)
+ ifneq ($(CONFIG_TLS), wolfssl)
++ifneq ($(CONFIG_TLS), mbedtls)
+ SHA1OBJS += ../src/crypto/sha1.o
+ endif
+ endif
+ endif
+ endif
++endif
++ifneq ($(CONFIG_TLS), mbedtls)
+ SHA1OBJS += ../src/crypto/sha1-prf.o
++endif
+ ifdef CONFIG_INTERNAL_SHA1
+ SHA1OBJS += ../src/crypto/sha1-internal.o
+ ifdef NEED_FIPS186_2_PRF
+@@ -1443,29 +1484,37 @@ CFLAGS += -DCONFIG_NO_PBKDF2
+ else
+ ifneq ($(CONFIG_TLS), openssl)
+ ifneq ($(CONFIG_TLS), wolfssl)
++ifneq ($(CONFIG_TLS), mbedtls)
+ SHA1OBJS += ../src/crypto/sha1-pbkdf2.o
+ endif
+ endif
+ endif
++endif
+ ifdef NEED_T_PRF
++ifneq ($(CONFIG_TLS), mbedtls)
+ SHA1OBJS += ../src/crypto/sha1-tprf.o
+ endif
++endif
+ ifdef NEED_TLS_PRF
++ifneq ($(CONFIG_TLS), mbedtls)
+ SHA1OBJS += ../src/crypto/sha1-tlsprf.o
+ endif
+ endif
++endif
+ 
+ ifndef CONFIG_FIPS
+ ifneq ($(CONFIG_TLS), openssl)
+ ifneq ($(CONFIG_TLS), linux)
+ ifneq ($(CONFIG_TLS), gnutls)
+ ifneq ($(CONFIG_TLS), wolfssl)
++ifneq ($(CONFIG_TLS), mbedtls)
+ MD5OBJS += ../src/crypto/md5.o
+ endif
+ endif
+ endif
+ endif
+ endif
++endif
+ ifdef NEED_MD5
+ ifdef CONFIG_INTERNAL_MD5
+ MD5OBJS += ../src/crypto/md5-internal.o
+@@ -1520,12 +1569,17 @@ ifneq ($(CONFIG_TLS), openssl)
+ ifneq ($(CONFIG_TLS), linux)
+ ifneq ($(CONFIG_TLS), gnutls)
+ ifneq ($(CONFIG_TLS), wolfssl)
++ifneq ($(CONFIG_TLS), mbedtls)
+ SHA256OBJS += ../src/crypto/sha256.o
+ endif
+ endif
+ endif
+ endif
++endif
++
++ifneq ($(CONFIG_TLS), mbedtls)
+ SHA256OBJS += ../src/crypto/sha256-prf.o
++endif
+ ifdef CONFIG_INTERNAL_SHA256
+ SHA256OBJS += ../src/crypto/sha256-internal.o
+ endif
+@@ -1538,50 +1592,68 @@ CFLAGS += -DCONFIG_INTERNAL_SHA512
+ SHA256OBJS += ../src/crypto/sha512-internal.o
+ endif
+ ifdef NEED_TLS_PRF_SHA256
++ifneq ($(CONFIG_TLS), mbedtls)
+ SHA256OBJS += ../src/crypto/sha256-tlsprf.o
+ endif
++endif
+ ifdef NEED_TLS_PRF_SHA384
++ifneq ($(CONFIG_TLS), mbedtls)
+ SHA256OBJS += ../src/crypto/sha384-tlsprf.o
+ endif
++endif
+ ifdef NEED_HMAC_SHA256_KDF
+ CFLAGS += -DCONFIG_HMAC_SHA256_KDF
++ifneq ($(CONFIG_TLS), mbedtls)
+ OBJS += ../src/crypto/sha256-kdf.o
+ endif
++endif
+ ifdef NEED_HMAC_SHA384_KDF
+ CFLAGS += -DCONFIG_HMAC_SHA384_KDF
++ifneq ($(CONFIG_TLS), mbedtls)
+ OBJS += ../src/crypto/sha384-kdf.o
+ endif
++endif
+ ifdef NEED_HMAC_SHA512_KDF
+ CFLAGS += -DCONFIG_HMAC_SHA512_KDF
++ifneq ($(CONFIG_TLS), mbedtls)
+ OBJS += ../src/crypto/sha512-kdf.o
+ endif
++endif
+ OBJS += $(SHA256OBJS)
+ ifdef NEED_SHA384
+ ifneq ($(CONFIG_TLS), openssl)
+ ifneq ($(CONFIG_TLS), linux)
+ ifneq ($(CONFIG_TLS), gnutls)
+ ifneq ($(CONFIG_TLS), wolfssl)
++ifneq ($(CONFIG_TLS), mbedtls)
+ OBJS += ../src/crypto/sha384.o
+ endif
+ endif
+ endif
+ endif
++endif
+ CFLAGS += -DCONFIG_SHA384
++ifneq ($(CONFIG_TLS), mbedtls)
+ OBJS += ../src/crypto/sha384-prf.o
+ endif
++endif
+ ifdef NEED_SHA512
+ ifneq ($(CONFIG_TLS), openssl)
+ ifneq ($(CONFIG_TLS), linux)
+ ifneq ($(CONFIG_TLS), gnutls)
+ ifneq ($(CONFIG_TLS), wolfssl)
++ifneq ($(CONFIG_TLS), mbedtls)
+ OBJS += ../src/crypto/sha512.o
+ endif
+ endif
+ endif
+ endif
++endif
+ CFLAGS += -DCONFIG_SHA512
++ifneq ($(CONFIG_TLS), mbedtls)
+ OBJS += ../src/crypto/sha512-prf.o
+ endif
++endif
+ 
+ ifdef NEED_ASN1
+ OBJS += ../src/tls/asn1.o
+@@ -1756,10 +1828,12 @@ ifdef CONFIG_FIPS
+ CFLAGS += -DCONFIG_FIPS
+ ifneq ($(CONFIG_TLS), openssl)
+ ifneq ($(CONFIG_TLS), wolfssl)
++ifneq ($(CONFIG_TLS), mbedtls)
+ $(error CONFIG_FIPS=y requires CONFIG_TLS=openssl)
+ endif
+ endif
+ endif
++endif
+ 
+ OBJS += $(SHA1OBJS) $(DESOBJS)
+ 
+--- a/wpa_supplicant/defconfig
++++ b/wpa_supplicant/defconfig
+@@ -10,8 +10,8 @@
+ # to override previous values of the variables.
+ 
+ 
+-# Uncomment following two lines and fix the paths if you have installed OpenSSL
+-# or GnuTLS in non-default location
++# Uncomment following two lines and fix the paths if you have installed TLS
++# libraries in a non-default location
+ #CFLAGS += -I/usr/local/openssl/include
+ #LIBS += -L/usr/local/openssl/lib
+ 
+@@ -20,6 +20,7 @@
+ # used to fix build issues on such systems (krb5.h not found).
+ #CFLAGS += -I/usr/include/kerberos
+ 
++
+ # Driver interface for generic Linux wireless extensions
+ # Note: WEXT is deprecated in the current Linux kernel version and no new
+ # functionality is added to it. nl80211-based interface is the new
+@@ -326,6 +327,7 @@ CONFIG_BACKEND=file
+ # openssl = OpenSSL (default)
+ # gnutls = GnuTLS
+ # internal = Internal TLSv1 implementation (experimental)
++# mbedtls = mbed TLS
+ # linux = Linux kernel AF_ALG and internal TLSv1 implementation (experimental)
+ # none = Empty template
+ #CONFIG_TLS=openssl
diff --git a/package/network/services/hostapd/patches/120-mbedtls-fips186_2_prf.patch b/package/network/services/hostapd/patches/120-mbedtls-fips186_2_prf.patch
new file mode 100644
index 00000000000000..a48725264fd36a
--- /dev/null
+++ b/package/network/services/hostapd/patches/120-mbedtls-fips186_2_prf.patch
@@ -0,0 +1,114 @@
+From c8dba4bd750269bcc80fed3d546e2077cb4cdf0e Mon Sep 17 00:00:00 2001
+From: Glenn Strauss <gstrauss@gluelogic.com>
+Date: Tue, 19 Jul 2022 20:02:21 -0400
+Subject: [PATCH 2/7] mbedtls: fips186_2_prf()
+
+Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
+---
+ hostapd/Makefile            |  4 ---
+ src/crypto/crypto_mbedtls.c | 60 +++++++++++++++++++++++++++++++++++++
+ wpa_supplicant/Makefile     |  4 ---
+ 3 files changed, 60 insertions(+), 8 deletions(-)
+
+--- a/hostapd/Makefile
++++ b/hostapd/Makefile
+@@ -759,10 +759,6 @@ endif
+ OBJS += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
+ HOBJS += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
+ SOBJS += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
+-ifdef NEED_FIPS186_2_PRF
+-OBJS += ../src/crypto/fips_prf_internal.o
+-SHA1OBJS += ../src/crypto/sha1-internal.o
+-endif
+ ifeq ($(CONFIG_CRYPTO), mbedtls)
+ ifdef CONFIG_DPP
+ LIBS += -lmbedx509
+--- a/src/crypto/crypto_mbedtls.c
++++ b/src/crypto/crypto_mbedtls.c
+@@ -132,6 +132,12 @@
+ #define CRYPTO_MBEDTLS_HMAC_KDF_SHA512
+ #endif
+ 
++#if defined(EAP_SIM) || defined(EAP_SIM_DYNAMIC) || defined(EAP_SERVER_SIM) \
++ || defined(EAP_AKA) || defined(EAP_AKA_DYNAMIC) || defined(EAP_SERVER_AKA)
++/* EAP_SIM=y EAP_AKA=y */
++#define CRYPTO_MBEDTLS_FIPS186_2_PRF
++#endif
++
+ #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST) \
+  || defined(EAP_TEAP) || defined(EAP_TEAP_DYNAMIC) || defined(EAP_SERVER_FAST)
+ #define CRYPTO_MBEDTLS_SHA1_T_PRF
+@@ -813,6 +819,60 @@ int sha1_t_prf(const u8 *key, size_t key
+ 
+ #endif /* CRYPTO_MBEDTLS_SHA1_T_PRF */
+ 
++#ifdef CRYPTO_MBEDTLS_FIPS186_2_PRF
++
++/* fips_prf_internal.c sha1-internal.c */
++
++/* used only by src/eap_common/eap_sim_common.c:eap_sim_prf()
++ * for eap_sim_derive_keys() and eap_sim_derive_keys_reauth()
++ * where xlen is 160 */
++
++int fips186_2_prf(const u8 *seed, size_t seed_len, u8 *x, size_t xlen)
++{
++	/* FIPS 186-2 + change notice 1 */
++
++	mbedtls_sha1_context ctx;
++	u8 * const xkey = ctx.MBEDTLS_PRIVATE(buffer);
++	u32 * const xstate = ctx.MBEDTLS_PRIVATE(state);
++	const u32 xstate_init[] =
++	  { 0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476, 0xC3D2E1F0 };
++
++	mbedtls_sha1_init(&ctx);
++	os_memcpy(xkey, seed, seed_len < 64 ? seed_len : 64);
++
++	/* note: does not fill extra bytes if (xlen % 20) (SHA1_MAC_LEN) */
++	for (; xlen >= 20; xlen -= 20) {
++		/* XSEED_j = 0 */
++		/* XVAL = (XKEY + XSEED_j) mod 2^b */
++
++		/* w_i = G(t, XVAL) */
++		os_memcpy(xstate, xstate_init, sizeof(xstate_init));
++		mbedtls_internal_sha1_process(&ctx, xkey);
++
++	  #if __BYTE_ORDER == __LITTLE_ENDIAN
++		xstate[0] = host_to_be32(xstate[0]);
++		xstate[1] = host_to_be32(xstate[1]);
++		xstate[2] = host_to_be32(xstate[2]);
++		xstate[3] = host_to_be32(xstate[3]);
++		xstate[4] = host_to_be32(xstate[4]);
++	  #endif
++		os_memcpy(x, xstate, 20);
++		if (xlen == 20) /*(done; skip prep for next loop)*/
++			break;
++
++		/* XKEY = (1 + XKEY + w_i) mod 2^b */
++		for (u32 carry = 1, k = 20; k-- > 0; carry >>= 8)
++			xkey[k] = (carry += xkey[k] + x[k]) & 0xff;
++		x += 20;
++		/* x_j = w_0|w_1 (each pair of iterations through loop)*/
++	}
++
++	mbedtls_sha1_free(&ctx);
++	return 0;
++}
++
++#endif /* CRYPTO_MBEDTLS_FIPS186_2_PRF */
++
+ #endif /* MBEDTLS_SHA1_C */
+ 
+ 
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -1174,10 +1174,6 @@ endif
+ OBJS += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
+ OBJS_p += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
+ OBJS_priv += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
+-ifdef NEED_FIPS186_2_PRF
+-OBJS += ../src/crypto/fips_prf_internal.o
+-SHA1OBJS += ../src/crypto/sha1-internal.o
+-endif
+ ifeq ($(CONFIG_CRYPTO), mbedtls)
+ LIBS += -lmbedcrypto
+ LIBS_p += -lmbedcrypto
diff --git a/package/network/services/hostapd/patches/130-mbedtls-annotate-with-TEST_FAIL-for-hwsim-tests.patch b/package/network/services/hostapd/patches/130-mbedtls-annotate-with-TEST_FAIL-for-hwsim-tests.patch
new file mode 100644
index 00000000000000..ae7620b90c14b3
--- /dev/null
+++ b/package/network/services/hostapd/patches/130-mbedtls-annotate-with-TEST_FAIL-for-hwsim-tests.patch
@@ -0,0 +1,421 @@
+From 31bd19e0e0254b910cccfd3ddc6a6a9222bbcfc0 Mon Sep 17 00:00:00 2001
+From: Glenn Strauss <gstrauss@gluelogic.com>
+Date: Sun, 9 Oct 2022 05:12:17 -0400
+Subject: [PATCH 3/7] mbedtls: annotate with TEST_FAIL() for hwsim tests
+
+Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
+---
+ src/crypto/crypto_mbedtls.c | 124 ++++++++++++++++++++++++++++++++++++
+ 1 file changed, 124 insertions(+)
+
+--- a/src/crypto/crypto_mbedtls.c
++++ b/src/crypto/crypto_mbedtls.c
+@@ -280,6 +280,9 @@ __attribute_noinline__
+ static int md_vector(size_t num_elem, const u8 *addr[], const size_t *len,
+                      u8 *mac, mbedtls_md_type_t md_type)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	mbedtls_md_context_t ctx;
+ 	mbedtls_md_init(&ctx);
+ 	if (mbedtls_md_setup(&ctx, mbedtls_md_info_from_type(md_type), 0) != 0){
+@@ -343,6 +346,9 @@ __attribute_noinline__
+ static int sha384_512_vector(size_t num_elem, const u8 *addr[],
+                              const size_t *len, u8 *mac, int is384)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	struct mbedtls_sha512_context ctx;
+ 	mbedtls_sha512_init(&ctx);
+   #if MBEDTLS_VERSION_MAJOR >= 3
+@@ -375,6 +381,9 @@ int sha384_vector(size_t num_elem, const
+ #include <mbedtls/sha256.h>
+ int sha256_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	struct mbedtls_sha256_context ctx;
+ 	mbedtls_sha256_init(&ctx);
+   #if MBEDTLS_VERSION_MAJOR >= 3
+@@ -397,6 +406,9 @@ int sha256_vector(size_t num_elem, const
+ #include <mbedtls/sha1.h>
+ int sha1_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	struct mbedtls_sha1_context ctx;
+ 	mbedtls_sha1_init(&ctx);
+   #if MBEDTLS_VERSION_MAJOR >= 3
+@@ -419,6 +431,9 @@ int sha1_vector(size_t num_elem, const u
+ #include <mbedtls/md5.h>
+ int md5_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	struct mbedtls_md5_context ctx;
+ 	mbedtls_md5_init(&ctx);
+   #if MBEDTLS_VERSION_MAJOR >= 3
+@@ -441,6 +456,9 @@ int md5_vector(size_t num_elem, const u8
+ #include <mbedtls/md4.h>
+ int md4_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	struct mbedtls_md4_context ctx;
+ 	mbedtls_md4_init(&ctx);
+ 	mbedtls_md4_starts_ret(&ctx);
+@@ -460,6 +478,9 @@ static int hmac_vector(const u8 *key, si
+                        const u8 *addr[], const size_t *len, u8 *mac,
+                        mbedtls_md_type_t md_type)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	mbedtls_md_context_t ctx;
+ 	mbedtls_md_init(&ctx);
+ 	if (mbedtls_md_setup(&ctx, mbedtls_md_info_from_type(md_type), 1) != 0){
+@@ -571,6 +592,9 @@ static int hmac_kdf_expand(const u8 *prk
+                            const char *label, const u8 *info, size_t info_len,
+                            u8 *okm, size_t okm_len, mbedtls_md_type_t md_type)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type(md_type);
+   #ifdef MBEDTLS_HKDF_C
+ 	if (label == NULL)  /* RFC 5869 HKDF-Expand when (label == NULL) */
+@@ -663,6 +687,9 @@ static int hmac_prf_bits(const u8 *key,
+                          const u8 *data, size_t data_len, u8 *buf,
+                          size_t buf_len_bits, mbedtls_md_type_t md_type)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	mbedtls_md_context_t ctx;
+ 	mbedtls_md_init(&ctx);
+ 	const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type(md_type);
+@@ -938,6 +965,9 @@ int pbkdf2_sha1(const char *passphrase,
+ 
+ static void *aes_crypt_init_mode(const u8 *key, size_t len, int mode)
+ {
++	if (TEST_FAIL())
++		return NULL;
++
+ 	mbedtls_aes_context *aes = os_malloc(sizeof(*aes));
+ 	if (!aes)
+ 		return NULL;
+@@ -996,6 +1026,9 @@ void aes_decrypt_deinit(void *ctx)
+ /* aes-wrap.c */
+ int aes_wrap(const u8 *kek, size_t kek_len, int n, const u8 *plain, u8 *cipher)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	mbedtls_nist_kw_context ctx;
+ 	mbedtls_nist_kw_init(&ctx);
+ 	size_t olen;
+@@ -1010,6 +1043,9 @@ int aes_wrap(const u8 *kek, size_t kek_l
+ /* aes-unwrap.c */
+ int aes_unwrap(const u8 *kek, size_t kek_len, int n, const u8 *cipher, u8 *plain)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	mbedtls_nist_kw_context ctx;
+ 	mbedtls_nist_kw_init(&ctx);
+ 	size_t olen;
+@@ -1041,6 +1077,9 @@ int omac1_aes_vector(
+     const u8 *key, size_t key_len, size_t num_elem, const u8 *addr[],
+     const size_t *len, u8 *mac)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	mbedtls_cipher_type_t cipher_type;
+ 	switch (key_len) {
+ 	case 16: cipher_type = MBEDTLS_CIPHER_AES_128_ECB; break;
+@@ -1103,6 +1142,9 @@ int omac1_aes_256(const u8 *key, const u
+ /* aes-encblock.c */
+ int aes_128_encrypt_block(const u8 *key, const u8 *in, u8 *out)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	mbedtls_aes_context aes;
+ 	mbedtls_aes_init(&aes);
+ 	int ret = mbedtls_aes_setkey_enc(&aes, key, 128)
+@@ -1118,6 +1160,9 @@ int aes_128_encrypt_block(const u8 *key,
+ int aes_ctr_encrypt(const u8 *key, size_t key_len, const u8 *nonce,
+ 		    u8 *data, size_t data_len)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	unsigned char counter[MBEDTLS_AES_BLOCK_SIZE];
+ 	unsigned char stream_block[MBEDTLS_AES_BLOCK_SIZE];
+ 	os_memcpy(counter, nonce, MBEDTLS_AES_BLOCK_SIZE);/*(must be writable)*/
+@@ -1160,11 +1205,17 @@ static int aes_128_cbc_oper(const u8 *ke
+ 
+ int aes_128_cbc_encrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	return aes_128_cbc_oper(key, iv, data, data_len, MBEDTLS_AES_ENCRYPT);
+ }
+ 
+ int aes_128_cbc_decrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	return aes_128_cbc_oper(key, iv, data, data_len, MBEDTLS_AES_DECRYPT);
+ }
+ 
+@@ -1407,6 +1458,10 @@ int crypto_hash_finish(struct crypto_has
+ 	}
+ 	mbedtls_md_free(mctx);
+ 	os_free(mctx);
++
++	if (TEST_FAIL())
++		return -1;
++
+ 	return 0;
+ }
+ 
+@@ -1421,6 +1476,9 @@ int crypto_hash_finish(struct crypto_has
+ 
+ struct crypto_bignum *crypto_bignum_init(void)
+ {
++	if (TEST_FAIL())
++		return NULL;
++
+ 	mbedtls_mpi *bn = os_malloc(sizeof(*bn));
+ 	if (bn)
+ 		mbedtls_mpi_init(bn);
+@@ -1429,6 +1487,9 @@ struct crypto_bignum *crypto_bignum_init
+ 
+ struct crypto_bignum *crypto_bignum_init_set(const u8 *buf, size_t len)
+ {
++	if (TEST_FAIL())
++		return NULL;
++
+ 	mbedtls_mpi *bn = os_malloc(sizeof(*bn));
+ 	if (bn) {
+ 		mbedtls_mpi_init(bn);
+@@ -1442,6 +1503,9 @@ struct crypto_bignum *crypto_bignum_init
+ 
+ struct crypto_bignum *crypto_bignum_init_uint(unsigned int val)
+ {
++	if (TEST_FAIL())
++		return NULL;
++
+   #if 0 /*(hostap use of this interface passes int, not uint)*/
+ 	val = host_to_be32(val);
+ 	return crypto_bignum_init_set((const u8 *)&val, sizeof(val));
+@@ -1467,6 +1531,9 @@ void crypto_bignum_deinit(struct crypto_
+ int crypto_bignum_to_bin(const struct crypto_bignum *a,
+ 			 u8 *buf, size_t buflen, size_t padlen)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	size_t n = mbedtls_mpi_size((mbedtls_mpi *)a);
+ 	if (n < padlen)
+ 		n = padlen;
+@@ -1477,6 +1544,9 @@ int crypto_bignum_to_bin(const struct cr
+ 
+ int crypto_bignum_rand(struct crypto_bignum *r, const struct crypto_bignum *m)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	/*assert(r != m);*//* r must not be same as m for mbedtls_mpi_random()*/
+   #if MBEDTLS_VERSION_NUMBER >= 0x021B0000 /* mbedtls 2.27.0 */
+ 	return mbedtls_mpi_random((mbedtls_mpi *)r, 0, (mbedtls_mpi *)m,
+@@ -1513,6 +1583,9 @@ int crypto_bignum_exptmod(const struct c
+ 			  const struct crypto_bignum *c,
+ 			  struct crypto_bignum *d)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	/* (check if input params match d; d is the result) */
+ 	/* (a == d) is ok in current mbedtls implementation */
+ 	if (b == d || c == d) { /*(not ok; store result in intermediate)*/
+@@ -1540,6 +1613,9 @@ int crypto_bignum_inverse(const struct c
+ 			  const struct crypto_bignum *b,
+ 			  struct crypto_bignum *c)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	return mbedtls_mpi_inv_mod((mbedtls_mpi *)c,
+ 				   (const mbedtls_mpi *)a,
+ 				   (const mbedtls_mpi *)b) ? -1 : 0;
+@@ -1549,6 +1625,9 @@ int crypto_bignum_sub(const struct crypt
+ 		      const struct crypto_bignum *b,
+ 		      struct crypto_bignum *c)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	return mbedtls_mpi_sub_mpi((mbedtls_mpi *)c,
+ 				   (const mbedtls_mpi *)a,
+ 				   (const mbedtls_mpi *)b) ? -1 : 0;
+@@ -1558,6 +1637,9 @@ int crypto_bignum_div(const struct crypt
+ 		      const struct crypto_bignum *b,
+ 		      struct crypto_bignum *c)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	/*(most current use of this crypto.h interface has a == c (result),
+ 	 * so store result in an intermediate to avoid overwritten input)*/
+ 	mbedtls_mpi R;
+@@ -1575,6 +1657,9 @@ int crypto_bignum_addmod(const struct cr
+ 			 const struct crypto_bignum *c,
+ 			 struct crypto_bignum *d)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	return mbedtls_mpi_add_mpi((mbedtls_mpi *)d,
+ 				   (const mbedtls_mpi *)a,
+ 				   (const mbedtls_mpi *)b)
+@@ -1588,6 +1673,9 @@ int crypto_bignum_mulmod(const struct cr
+ 			 const struct crypto_bignum *c,
+ 			 struct crypto_bignum *d)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	return mbedtls_mpi_mul_mpi((mbedtls_mpi *)d,
+ 				   (const mbedtls_mpi *)a,
+ 				   (const mbedtls_mpi *)b)
+@@ -1600,6 +1688,9 @@ int crypto_bignum_sqrmod(const struct cr
+ 			 const struct crypto_bignum *b,
+ 			 struct crypto_bignum *c)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+   #if 1
+ 	return crypto_bignum_mulmod(a, a, b, c);
+   #else
+@@ -1650,6 +1741,9 @@ int crypto_bignum_is_odd(const struct cr
+ int crypto_bignum_legendre(const struct crypto_bignum *a,
+ 			   const struct crypto_bignum *p)
+ {
++	if (TEST_FAIL())
++		return -2;
++
+ 	/* Security Note:
+ 	 * mbedtls_mpi_exp_mod() is not documented to run in constant time,
+ 	 * though mbedtls/library/bignum.c uses constant_time_internal.h funcs.
+@@ -1702,6 +1796,9 @@ int crypto_mod_exp(const u8 *base, size_
+ 		   const u8 *modulus, size_t modulus_len,
+ 		   u8 *result, size_t *result_len)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	mbedtls_mpi bn_base, bn_exp, bn_modulus, bn_result;
+ 	mbedtls_mpi_init(&bn_base);
+ 	mbedtls_mpi_init(&bn_exp);
+@@ -1769,6 +1866,9 @@ static int crypto_mbedtls_dh_init_public
+ int crypto_dh_init(u8 generator, const u8 *prime, size_t prime_len, u8 *privkey,
+ 		   u8 *pubkey)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+   #if 0 /*(crypto_dh_init() duplicated (and identical) in crypto_*.c modules)*/
+ 	size_t pubkey_len, pad;
+ 
+@@ -1810,6 +1910,9 @@ int crypto_dh_derive_secret(u8 generator
+ 			    const u8 *pubkey, size_t pubkey_len,
+ 			    u8 *secret, size_t *len)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+   #if 0
+ 	if (pubkey_len > prime_len ||
+ 	    (pubkey_len == prime_len &&
+@@ -2512,6 +2615,9 @@ const struct crypto_ec_point * crypto_ec
+ 
+ struct crypto_ec_point *crypto_ec_point_init(struct crypto_ec *e)
+ {
++	if (TEST_FAIL())
++		return NULL;
++
+ 	mbedtls_ecp_point *p = os_malloc(sizeof(*p));
+ 	if (p != NULL)
+ 		mbedtls_ecp_point_init(p);
+@@ -2536,6 +2642,9 @@ int crypto_ec_point_x(struct crypto_ec *
+ int crypto_ec_point_to_bin(struct crypto_ec *e,
+ 			   const struct crypto_ec_point *point, u8 *x, u8 *y)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	/* crypto.h documents crypto_ec_point_to_bin() output is big-endian */
+ 	size_t len = CRYPTO_EC_plen(e);
+ 	if (x) {
+@@ -2563,6 +2672,9 @@ int crypto_ec_point_to_bin(struct crypto
+ struct crypto_ec_point * crypto_ec_point_from_bin(struct crypto_ec *e,
+ 						  const u8 *val)
+ {
++	if (TEST_FAIL())
++		return NULL;
++
+ 	size_t len = CRYPTO_EC_plen(e);
+ 	mbedtls_ecp_point *p = os_malloc(sizeof(*p));
+ 	u8 buf[1+MBEDTLS_MPI_MAX_SIZE*2];
+@@ -2615,6 +2727,9 @@ int crypto_ec_point_add(struct crypto_ec
+ 			const struct crypto_ec_point *b,
+ 			struct crypto_ec_point *c)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	/* mbedtls does not provide an mbedtls_ecp_point add function */
+ 	mbedtls_mpi one;
+ 	mbedtls_mpi_init(&one);
+@@ -2631,6 +2746,9 @@ int crypto_ec_point_mul(struct crypto_ec
+ 			const struct crypto_bignum *b,
+ 			struct crypto_ec_point *res)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	return mbedtls_ecp_mul(
+ 		(mbedtls_ecp_group *)e, (mbedtls_ecp_point *)res,
+ 		(const mbedtls_mpi *)b, (const mbedtls_ecp_point *)p,
+@@ -2639,6 +2757,9 @@ int crypto_ec_point_mul(struct crypto_ec
+ 
+ int crypto_ec_point_invert(struct crypto_ec *e, struct crypto_ec_point *p)
+ {
++	if (TEST_FAIL())
++		return -1;
++
+ 	if (mbedtls_ecp_get_type((mbedtls_ecp_group *)e)
+ 	    == MBEDTLS_ECP_TYPE_MONTGOMERY) {
+ 		/* e.g. MBEDTLS_ECP_DP_CURVE25519 and MBEDTLS_ECP_DP_CURVE448 */
+@@ -2751,6 +2872,9 @@ struct crypto_bignum *
+ crypto_ec_point_compute_y_sqr(struct crypto_ec *e,
+ 			      const struct crypto_bignum *x)
+ {
++	if (TEST_FAIL())
++		return NULL;
++
+ 	mbedtls_mpi *y2 = os_malloc(sizeof(*y2));
+ 	if (y2 == NULL)
+ 		return NULL;
diff --git a/package/network/services/hostapd/patches/140-tests-Makefile-make-run-tests-with-CONFIG_TLS.patch b/package/network/services/hostapd/patches/140-tests-Makefile-make-run-tests-with-CONFIG_TLS.patch
new file mode 100644
index 00000000000000..148c268f9ca1e6
--- /dev/null
+++ b/package/network/services/hostapd/patches/140-tests-Makefile-make-run-tests-with-CONFIG_TLS.patch
@@ -0,0 +1,1358 @@
+From f24933dc175e0faf44a3cce3330c256a59649ca6 Mon Sep 17 00:00:00 2001
+From: Glenn Strauss <gstrauss@gluelogic.com>
+Date: Tue, 19 Jul 2022 23:01:17 -0400
+Subject: [PATCH 4/7] tests/Makefile make run-tests with CONFIG_TLS=...
+
+add test-crypto_module.c to run crypto_module_tests()
+
+adjust some tests/hwsim/*.py for mbed TLS (work in progress)
+
+option to build and run-tests with CONFIG_TLS=internal # (default)
+$ cd tests; make clean
+$ make run-tests
+
+option to build and run-tests with CONFIG_TLS=gnutls
+$ cd tests; make clean CONFIG_TLS=gnutls
+$ make run-tests CONFIG_TLS=gnutls
+
+option to build and run-tests with CONFIG_TLS=mbedtls
+$ cd tests; make clean CONFIG_TLS=mbedtls
+$ make run-tests CONFIG_TLS=mbedtls
+
+option to build and run-tests with CONFIG_TLS=openssl
+$ cd tests; make clean CONFIG_TLS=openssl
+$ make run-tests CONFIG_TLS=openssl
+
+option to build and run-tests with CONFIG_TLS=wolfssl
+$ cd tests; make clean CONFIG_TLS=wolfssl
+$ make run-tests CONFIG_TLS=wolfssl
+
+RFE: Makefile logic for crypto objects should be centralized
+     instead of being duplicated in hostapd/Makefile,
+     wpa_supplicant/Makefile, src/crypto/Makefile,
+     tests/Makefile, ...
+
+Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
+---
+ hostapd/Makefile                          |   6 +
+ src/crypto/Makefile                       | 129 ++++++++++++++++++++-
+ src/crypto/crypto_module_tests.c          | 134 ++++++++++++++++++++++
+ src/tls/Makefile                          |  11 ++
+ tests/Makefile                            |  75 +++++++++---
+ tests/hwsim/example-hostapd.config        |  11 +-
+ tests/hwsim/example-wpa_supplicant.config |  12 +-
+ tests/hwsim/test_ap_eap.py                | 114 +++++++++++++-----
+ tests/hwsim/test_ap_ft.py                 |   4 +-
+ tests/hwsim/test_authsrv.py               |   9 +-
+ tests/hwsim/test_dpp.py                   |  19 ++-
+ tests/hwsim/test_erp.py                   |  16 +--
+ tests/hwsim/test_fils.py                  |   5 +-
+ tests/hwsim/test_pmksa_cache.py           |   4 +-
+ tests/hwsim/test_sae.py                   |   7 ++
+ tests/hwsim/test_suite_b.py               |   3 +
+ tests/hwsim/test_wpas_ctrl.py             |   2 +-
+ tests/hwsim/utils.py                      |   8 +-
+ tests/test-crypto_module.c                |  16 +++
+ tests/test-https.c                        |  12 +-
+ tests/test-https_server.c                 |  12 +-
+ wpa_supplicant/Makefile                   |   6 +
+ 22 files changed, 524 insertions(+), 91 deletions(-)
+ create mode 100644 tests/test-crypto_module.c
+
+--- a/hostapd/Makefile
++++ b/hostapd/Makefile
+@@ -696,6 +696,7 @@ CFLAGS += -DCONFIG_TLSV12
+ endif
+ 
+ ifeq ($(CONFIG_TLS), wolfssl)
++CFLAGS += -DCONFIG_TLS_WOLFSSL
+ CONFIG_CRYPTO=wolfssl
+ ifdef TLS_FUNCS
+ OBJS += ../src/crypto/tls_wolfssl.o
+@@ -716,6 +717,7 @@ endif
+ endif
+ 
+ ifeq ($(CONFIG_TLS), openssl)
++CFLAGS += -DCONFIG_TLS_OPENSSL
+ CFLAGS += -DCRYPTO_RSA_OAEP_SHA256
+ CONFIG_CRYPTO=openssl
+ ifdef TLS_FUNCS
+@@ -746,6 +748,7 @@ CFLAGS += -DTLS_DEFAULT_CIPHERS=\"$(CONF
+ endif
+ 
+ ifeq ($(CONFIG_TLS), mbedtls)
++CFLAGS += -DCONFIG_TLS_MBEDTLS
+ ifndef CONFIG_CRYPTO
+ CONFIG_CRYPTO=mbedtls
+ endif
+@@ -776,6 +779,7 @@ endif
+ endif
+ 
+ ifeq ($(CONFIG_TLS), gnutls)
++CFLAGS += -DCONFIG_TLS_GNUTLS
+ ifndef CONFIG_CRYPTO
+ # default to libgcrypt
+ CONFIG_CRYPTO=gnutls
+@@ -806,6 +810,7 @@ endif
+ endif
+ 
+ ifeq ($(CONFIG_TLS), internal)
++CFLAGS += -DCONFIG_TLS_INTERNAL
+ ifndef CONFIG_CRYPTO
+ CONFIG_CRYPTO=internal
+ endif
+@@ -884,6 +889,7 @@ endif
+ endif
+ 
+ ifeq ($(CONFIG_TLS), linux)
++CFLAGS += -DCONFIG_TLS_INTERNAL
+ OBJS += ../src/crypto/crypto_linux.o
+ ifdef TLS_FUNCS
+ OBJS += ../src/crypto/crypto_internal-rsa.o
+--- a/src/crypto/Makefile
++++ b/src/crypto/Makefile
+@@ -1,10 +1,121 @@
+-CFLAGS += -DCONFIG_CRYPTO_INTERNAL
+-CFLAGS += -DCONFIG_TLS_INTERNAL_CLIENT
+-CFLAGS += -DCONFIG_TLS_INTERNAL_SERVER
+ #CFLAGS += -DALL_DH_GROUPS
+ CFLAGS += -DCONFIG_SHA256
+ CFLAGS += -DCONFIG_SHA384
++CFLAGS += -DCONFIG_HMAC_SHA256_KDF
+ CFLAGS += -DCONFIG_HMAC_SHA384_KDF
++
++# crypto_module_tests.c
++CFLAGS += -DCONFIG_MODULE_TESTS
++CFLAGS += -DCONFIG_DPP
++#CFLAGS += -DCONFIG_DPP2
++#CFLAGS += -DCONFIG_DPP3
++CFLAGS += -DCONFIG_ECC
++CFLAGS += -DCONFIG_MESH
++CFLAGS += -DEAP_PSK
++CFLAGS += -DEAP_FAST
++
++ifeq ($(CONFIG_TLS),mbedtls)
++
++# (enable features for 'cd tests; make run-tests CONFIG_TLS=mbedtls')
++CFLAGS += -DCRYPTO_RSA_OAEP_SHA256
++CFLAGS += -DCONFIG_DES
++CFLAGS += -DEAP_IKEV2
++CFLAGS += -DEAP_MSCHAPv2
++CFLAGS += -DEAP_SIM
++
++LIB_OBJS = tls_mbedtls.o crypto_mbedtls.o
++LIB_OBJS+= \
++	aes-eax.o \
++	aes-siv.o \
++	dh_groups.o \
++	milenage.o \
++	ms_funcs.o
++
++else
++ifeq ($(CONFIG_TLS),openssl)
++
++# (enable features for 'cd tests; make run-tests CONFIG_TLS=openssl')
++ifndef CONFIG_TLS_DEFAULT_CIPHERS
++CONFIG_TLS_DEFAULT_CIPHERS = "DEFAULT:!EXP:!LOW"
++endif
++CFLAGS += -DTLS_DEFAULT_CIPHERS=\"$(CONFIG_TLS_DEFAULT_CIPHERS)\"
++CFLAGS += -DCRYPTO_RSA_OAEP_SHA256
++CFLAGS += -DEAP_TLS_OPENSSL
++
++LIB_OBJS = tls_openssl.o fips_prf_openssl.o crypto_openssl.o
++LIB_OBJS+= \
++	aes-ctr.o \
++	aes-eax.o \
++	aes-encblock.o \
++	aes-siv.o \
++	dh_groups.o \
++	milenage.o \
++	ms_funcs.o \
++	sha1-prf.o \
++	sha1-tlsprf.o \
++	sha1-tprf.o \
++	sha256-kdf.o \
++	sha256-prf.o \
++	sha256-tlsprf.o
++
++else
++ifeq ($(CONFIG_TLS),wolfssl)
++
++# (wolfssl libraries must be built with ./configure --enable-wpas)
++# (enable features for 'cd tests; make run-tests CONFIG_TLS=wolfssl')
++CFLAGS += -DWOLFSSL_DER_LOAD
++CFLAGS += -DCONFIG_DES
++
++LIB_OBJS = tls_wolfssl.o fips_prf_wolfssl.o crypto_wolfssl.o
++LIB_OBJS+= \
++	aes-ctr.o \
++	aes-eax.o \
++	aes-encblock.o \
++	aes-siv.o \
++	dh_groups.o \
++	milenage.o \
++	ms_funcs.o \
++	sha1-prf.o \
++	sha1-tlsprf.o \
++	sha1-tprf.o \
++	sha256-kdf.o \
++	sha256-prf.o \
++	sha256-tlsprf.o
++
++else
++ifeq ($(CONFIG_TLS),gnutls)
++
++# (enable features for 'cd tests; make run-tests CONFIG_TLS=gnutls')
++LIB_OBJS = tls_gnutls.o crypto_gnutls.o
++LIB_OBJS+= \
++	aes-cbc.o \
++	aes-ctr.o \
++	aes-eax.o \
++	aes-encblock.o \
++	aes-omac1.o \
++	aes-siv.o \
++	aes-unwrap.o \
++	aes-wrap.o \
++	dh_group5.o \
++	dh_groups.o \
++	milenage.o \
++	ms_funcs.o \
++	rc4.o \
++	sha1-pbkdf2.o \
++	sha1-prf.o \
++	fips_prf_internal.o \
++	sha1-internal.o \
++	sha1-tlsprf.o \
++	sha1-tprf.o \
++	sha256-kdf.o \
++	sha256-prf.o \
++	sha256-tlsprf.o
++
++else
++
++CFLAGS += -DCONFIG_CRYPTO_INTERNAL
++CFLAGS += -DCONFIG_TLS_INTERNAL_CLIENT
++CFLAGS += -DCONFIG_TLS_INTERNAL_SERVER
+ CFLAGS += -DCONFIG_INTERNAL_SHA384
+ 
+ LIB_OBJS= \
+@@ -13,7 +124,6 @@ LIB_OBJS= \
+ 	aes-ctr.o \
+ 	aes-eax.o \
+ 	aes-encblock.o \
+-	aes-gcm.o \
+ 	aes-internal.o \
+ 	aes-internal-dec.o \
+ 	aes-internal-enc.o \
+@@ -37,6 +147,7 @@ LIB_OBJS= \
+ 	sha1-tlsprf.o \
+ 	sha1-tprf.o \
+ 	sha256.o \
++	sha256-kdf.o \
+ 	sha256-prf.o \
+ 	sha256-tlsprf.o \
+ 	sha256-internal.o \
+@@ -53,6 +164,16 @@ LIB_OBJS += crypto_internal-modexp.o
+ LIB_OBJS += crypto_internal-rsa.o
+ LIB_OBJS += tls_internal.o
+ LIB_OBJS += fips_prf_internal.o
++
++endif
++endif
++endif
++endif
++
++
++# (used by wlantest/{bip,gcmp,rx_mgmt}.c and tests/test-aes.c)
++LIB_OBJS += aes-gcm.o
++
+ ifndef TEST_FUZZ
+ LIB_OBJS += random.o
+ endif
+--- a/src/crypto/crypto_module_tests.c
++++ b/src/crypto/crypto_module_tests.c
+@@ -2469,6 +2469,139 @@ static int test_hpke(void)
+ }
+ 
+ 
++static int test_ecc(void)
++{
++#ifdef CONFIG_ECC
++#ifndef CONFIG_TLS_INTERNAL
++#ifndef CONFIG_TLS_GNUTLS
++#if defined(CONFIG_TLS_MBEDTLS) \
++ || defined(CONFIG_TLS_OPENSSL) \
++ || defined(CONFIG_TLS_WOLFSSL)
++	wpa_printf(MSG_INFO, "Testing ECC");
++	/* Note: some tests below are valid on supported Short Weierstrass
++	 * curves, but not on Montgomery curves (e.g. IKE groups 31 and 32)
++	 * (e.g. deriving and comparing y^2 test below not valid on Montgomery)
++	 */
++#ifdef CONFIG_TLS_MBEDTLS
++	const int grps[] = {19, 20, 21, 25, 26, 28};
++#endif
++#ifdef CONFIG_TLS_OPENSSL
++	const int grps[] = {19, 20, 21, 26};
++#endif
++#ifdef CONFIG_TLS_WOLFSSL
++	const int grps[] = {19, 20, 21, 26};
++#endif
++	uint32_t i;
++	struct crypto_ec *e = NULL;
++	struct crypto_ec_point *p = NULL, *q = NULL;
++	struct crypto_bignum *x = NULL, *y = NULL;
++#ifdef CONFIG_DPP
++	u8 bin[4096];
++#endif
++	for (i = 0; i < ARRAY_SIZE(grps); ++i) {
++		e = crypto_ec_init(grps[i]);
++		if (e == NULL
++		    || crypto_ec_prime_len(e) == 0
++		    || crypto_ec_prime_len_bits(e) == 0
++		    || crypto_ec_order_len(e) == 0
++		    || crypto_ec_get_prime(e) == NULL
++		    || crypto_ec_get_order(e) == NULL
++		    || crypto_ec_get_a(e) == NULL
++		    || crypto_ec_get_b(e) == NULL
++		    || crypto_ec_get_generator(e) == NULL) {
++			break;
++		}
++#ifdef CONFIG_DPP
++		struct crypto_ec_key *key = crypto_ec_key_gen(grps[i]);
++		if (key == NULL)
++			break;
++		p = crypto_ec_key_get_public_key(key);
++		q = crypto_ec_key_get_public_key(key);
++		crypto_ec_key_deinit(key);
++		if (p == NULL || q == NULL)
++			break;
++		if (!crypto_ec_point_is_on_curve(e, p))
++			break;
++
++		/* inverted point should not match original;
++		 * double-invert should match */
++		if (crypto_ec_point_invert(e, q) != 0
++		    || crypto_ec_point_cmp(e, p, q) == 0
++		    || crypto_ec_point_invert(e, q) != 0
++		    || crypto_ec_point_cmp(e, p, q) != 0) {
++			break;
++		}
++
++		/* crypto_ec_point_to_bin() and crypto_ec_point_from_bin()
++		 * imbalanced interfaces? */
++		size_t prime_len = crypto_ec_prime_len(e);
++		if (prime_len * 2 > sizeof(bin))
++			break;
++		if (crypto_ec_point_to_bin(e, p, bin, bin+prime_len) != 0)
++			break;
++		struct crypto_ec_point *tmp = crypto_ec_point_from_bin(e, bin);
++		if (tmp == NULL)
++			break;
++		if (crypto_ec_point_cmp(e, p, tmp) != 0) {
++			crypto_ec_point_deinit(tmp, 0);
++			break;
++		}
++		crypto_ec_point_deinit(tmp, 0);
++
++		x = crypto_bignum_init();
++		y = crypto_bignum_init_set(bin+prime_len, prime_len);
++		if (x == NULL || y == NULL || crypto_ec_point_x(e, p, x) != 0)
++			break;
++		struct crypto_bignum *y2 = crypto_ec_point_compute_y_sqr(e, x);
++		if (y2 == NULL)
++			break;
++		if (crypto_bignum_sqrmod(y, crypto_ec_get_prime(e), y) != 0
++		    || crypto_bignum_cmp(y, y2) != 0) {
++			crypto_bignum_deinit(y2, 0);
++			break;
++		}
++		crypto_bignum_deinit(y2, 0);
++		crypto_bignum_deinit(x, 0);
++		crypto_bignum_deinit(y, 0);
++		x = NULL;
++		y = NULL;
++
++		x = crypto_bignum_init();
++		if (x == NULL)
++			break;
++		if (crypto_bignum_rand(x, crypto_ec_get_prime(e)) != 0)
++			break;
++		crypto_bignum_deinit(x, 0);
++		x = NULL;
++
++		crypto_ec_point_deinit(p, 0);
++		p = NULL;
++		crypto_ec_point_deinit(q, 0);
++		q = NULL;
++#endif /* CONFIG_DPP */
++		crypto_ec_deinit(e);
++		e = NULL;
++	}
++	if (i != ARRAY_SIZE(grps)) {
++		crypto_bignum_deinit(x, 0);
++		crypto_bignum_deinit(y, 0);
++		crypto_ec_point_deinit(p, 0);
++		crypto_ec_point_deinit(q, 0);
++		crypto_ec_deinit(e);
++		wpa_printf(MSG_INFO,
++		           "ECC test case failed tls_id:%d", grps[i]);
++		return -1;
++	}
++
++	wpa_printf(MSG_INFO, "ECC test cases passed");
++#endif
++#endif /* !CONFIG_TLS_GNUTLS */
++#endif /* !CONFIG_TLS_INTERNAL */
++#endif /* CONFIG_ECC */
++	return 0;
++}
++
++
+ static int test_ms_funcs(void)
+ {
+ #ifndef CONFIG_FIPS
+@@ -2590,6 +2723,7 @@ int crypto_module_tests(void)
+ 	    test_fips186_2_prf() ||
+ 	    test_extract_expand_hkdf() ||
+ 	    test_hpke() ||
++	    test_ecc() ||
+ 	    test_ms_funcs())
+ 		ret = -1;
+ 
+--- a/src/tls/Makefile
++++ b/src/tls/Makefile
+@@ -1,3 +1,10 @@
++LIB_OBJS= asn1.o
++
++ifneq ($(CONFIG_TLS),gnutls)
++ifneq ($(CONFIG_TLS),mbedtls)
++ifneq ($(CONFIG_TLS),openssl)
++ifneq ($(CONFIG_TLS),wolfssl)
++
+ CFLAGS += -DCONFIG_INTERNAL_LIBTOMMATH
+ CFLAGS += -DCONFIG_CRYPTO_INTERNAL
+ CFLAGS += -DCONFIG_TLSV11
+@@ -21,5 +28,9 @@ LIB_OBJS= \
+ 	tlsv1_server_read.o \
+ 	tlsv1_server_write.o \
+ 	x509v3.o
++endif
++endif
++endif
++endif
+ 
+ include ../lib.rules
+--- a/tests/Makefile
++++ b/tests/Makefile
+@@ -1,8 +1,10 @@
+-ALL=test-base64 test-md4 test-milenage \
+-	test-rsa-sig-ver \
+-	test-sha1 \
+-	test-https test-https_server \
+-	test-sha256 test-aes test-x509v3 test-list test-rc4
++RUN_TESTS= \
++	test-list \
++	test-md4 test-rc4 test-sha1 test-sha256 \
++	test-milenage test-aes \
++	test-crypto_module
++
++ALL=$(RUN_TESTS) test-base64 test-https test-https_server
+ 
+ include ../src/build.rules
+ 
+@@ -24,13 +26,27 @@ CFLAGS += -DCONFIG_IEEE80211R_AP
+ CFLAGS += -DCONFIG_IEEE80211R
+ CFLAGS += -DCONFIG_TDLS
+ 
++# test-crypto_module
++CFLAGS += -DCONFIG_MODULE_TESTS
++CFLAGS += -DCONFIG_DPP
++#CFLAGS += -DCONFIG_DPP2
++#CFLAGS += -DCONFIG_DPP3
++CFLAGS += -DCONFIG_ECC
++CFLAGS += -DCONFIG_HMAC_SHA256_KDF
++CFLAGS += -DCONFIG_HMAC_SHA384_KDF
++CFLAGS += -DCONFIG_MESH
++CFLAGS += -DCONFIG_SHA256
++CFLAGS += -DCONFIG_SHA384
++CFLAGS += -DEAP_PSK
++CFLAGS += -DEAP_FAST
++
+ CFLAGS += -I../src
+ CFLAGS += -I../src/utils
+ 
+ SLIBS = ../src/utils/libutils.a
+ 
+-DLIBS = ../src/crypto/libcrypto.a \
+-	../src/tls/libtls.a
++DLIBS = ../src/tls/libtls.a \
++	../src/crypto/libcrypto.a
+ 
+ _OBJS_VAR := LLIBS
+ include ../src/objs.mk
+@@ -42,12 +58,43 @@ include ../src/objs.mk
+ LIBS = $(SLIBS) $(DLIBS)
+ LLIBS = -Wl,--start-group $(DLIBS) -Wl,--end-group $(SLIBS)
+ 
++ifeq ($(CONFIG_TLS),mbedtls)
++CFLAGS += -DCONFIG_TLS_MBEDTLS
++LLIBS += -lmbedtls -lmbedx509 -lmbedcrypto
++else
++ifeq ($(CONFIG_TLS),openssl)
++CFLAGS += -DCONFIG_TLS_OPENSSL
++LLIBS += -lssl -lcrypto
++else
++ifeq ($(CONFIG_TLS),gnutls)
++CFLAGS += -DCONFIG_TLS_GNUTLS
++LLIBS += -lgnutls -lgpg-error -lgcrypt
++else
++ifeq ($(CONFIG_TLS),wolfssl)
++CFLAGS += -DCONFIG_TLS_WOLFSSL
++LLIBS += -lwolfssl -lm
++else
++CFLAGS += -DCONFIG_TLS_INTERNAL
++CFLAGS += -DCONFIG_TLS_INTERNAL_SERVER
++ALL += test-rsa-sig-ver
++ALL += test-x509v3
++clean-config_tls_internal:
++	rm -f test_x509v3_nist.out.*
++	rm -f test_x509v3_nist2.out.*
++endif
++endif
++endif
++endif
++
+ # glibc < 2.17 needs -lrt for clock_gettime()
+ LLIBS += -lrt
+ 
+ test-aes: $(call BUILDOBJ,test-aes.o) $(LIBS)
+ 	$(LDO) $(LDFLAGS) -o $@ $^ $(LLIBS)
+ 
++test-crypto_module: $(call BUILDOBJ,test-crypto_module.o) $(LIBS)
++	$(LDO) $(LDFLAGS) -o $@ $< $(LLIBS)
++
+ test-base64: $(call BUILDOBJ,test-base64.o) $(LIBS)
+ 	$(LDO) $(LDFLAGS) -o $@ $^ $(LLIBS)
+ 
+@@ -83,17 +130,11 @@ test-x509v3: $(call BUILDOBJ,test-x509v3
+ 
+ 
+ run-tests: $(ALL)
+-	./test-aes
+-	./test-list
+-	./test-md4
+-	./test-milenage
+-	./test-rsa-sig-ver
+-	./test-sha1
+-	./test-sha256
++	@set -ex; for i in $(RUN_TESTS); do ./$$i; done
+ 	@echo
+ 	@echo All tests completed successfully.
+ 
+-clean: common-clean
++clean: common-clean clean-config_tls_internal
+ 	rm -f *~
+-	rm -f test_x509v3_nist.out.*
+-	rm -f test_x509v3_nist2.out.*
++
++.PHONY: run-tests clean-config_tls_internal
+--- a/tests/hwsim/example-hostapd.config
++++ b/tests/hwsim/example-hostapd.config
+@@ -34,15 +34,7 @@ CONFIG_EAP_TNC=y
+ CFLAGS += -DTNC_CONFIG_FILE=\"tnc/tnc_config\"
+ LIBS += -rdynamic
+ CONFIG_EAP_UNAUTH_TLS=y
+-ifeq ($(CONFIG_TLS), openssl)
+-CONFIG_EAP_PWD=y
+-endif
+-ifeq ($(CONFIG_TLS), wolfssl)
+-CONFIG_EAP_PWD=y
+-endif
+-ifeq ($(CONFIG_TLS), mbedtls)
+-CONFIG_EAP_PWD=y
+-endif
++CONFIG_EAP_PWD=$(if $(filter openssl wolfssl mbedtls,$(CONFIG_TLS)),y,)
+ CONFIG_EAP_EKE=y
+ CONFIG_PKCS12=y
+ CONFIG_RADIUS_SERVER=y
+@@ -89,6 +81,7 @@ CFLAGS += -DCONFIG_RADIUS_TEST
+ CONFIG_MODULE_TESTS=y
+ 
+ CONFIG_SUITEB=y
++CONFIG_SUITEB192=$(if $(filter openssl mbedtls,$(CONFIG_TLS)),y,)
+ 
+ # AddressSanitizer (ASan) can be enabled by uncommenting the following lines.
+ # This can be used as a more efficient memory error detector than valgrind
+--- a/tests/hwsim/example-wpa_supplicant.config
++++ b/tests/hwsim/example-wpa_supplicant.config
+@@ -35,16 +35,7 @@ LIBS += -rdynamic
+ CONFIG_EAP_FAST=y
+ CONFIG_EAP_TEAP=y
+ CONFIG_EAP_IKEV2=y
+-
+-ifeq ($(CONFIG_TLS), openssl)
+-CONFIG_EAP_PWD=y
+-endif
+-ifeq ($(CONFIG_TLS), wolfssl)
+-CONFIG_EAP_PWD=y
+-endif
+-ifeq ($(CONFIG_TLS), mbedtls)
+-CONFIG_EAP_PWD=y
+-endif
++CONFIG_EAP_PWD=$(if $(filter openssl wolfssl mbedtls,$(CONFIG_TLS)),y,)
+ 
+ CONFIG_USIM_SIMULATOR=y
+ CONFIG_SIM_SIMULATOR=y
+@@ -137,6 +128,7 @@ CONFIG_TESTING_OPTIONS=y
+ CONFIG_MODULE_TESTS=y
+ 
+ CONFIG_SUITEB=y
++CONFIG_SUITEB192=$(if $(filter openssl mbedtls,$(CONFIG_TLS)),y,)
+ 
+ # AddressSanitizer (ASan) can be enabled by uncommenting the following lines.
+ # This can be used as a more efficient memory error detector than valgrind
+--- a/tests/hwsim/test_ap_eap.py
++++ b/tests/hwsim/test_ap_eap.py
+@@ -42,20 +42,42 @@ def check_eap_capa(dev, method):
+     res = dev.get_capability("eap")
+     if method not in res:
+         raise HwsimSkip("EAP method %s not supported in the build" % method)
++    if method == "FAST" or method == "TEAP":
++        tls = dev.request("GET tls_library")
++        if tls.startswith("mbed TLS"):
++            raise HwsimSkip("EAP-%s not supported with this TLS library: " % method + tls)
+ 
+ def check_subject_match_support(dev):
+     tls = dev.request("GET tls_library")
+-    if not tls.startswith("OpenSSL") and not tls.startswith("wolfSSL"):
++    if tls.startswith("OpenSSL"):
++        return
++    elif tls.startswith("wolfSSL"):
++        return
++    elif tls.startswith("mbed TLS"):
++        return
++    else:
+         raise HwsimSkip("subject_match not supported with this TLS library: " + tls)
+ 
+ def check_check_cert_subject_support(dev):
+     tls = dev.request("GET tls_library")
+-    if not tls.startswith("OpenSSL") and not tls.startswith("wolfSSL"):
++    if tls.startswith("OpenSSL"):
++        return
++    elif tls.startswith("wolfSSL"):
++        return
++    elif tls.startswith("mbed TLS"):
++        return
++    else:
+         raise HwsimSkip("check_cert_subject not supported with this TLS library: " + tls)
+ 
+ def check_altsubject_match_support(dev):
+     tls = dev.request("GET tls_library")
+-    if not tls.startswith("OpenSSL") and not tls.startswith("wolfSSL"):
++    if tls.startswith("OpenSSL"):
++        return
++    elif tls.startswith("wolfSSL"):
++        return
++    elif tls.startswith("mbed TLS"):
++        return
++    else:
+         raise HwsimSkip("altsubject_match not supported with this TLS library: " + tls)
+ 
+ def check_domain_match(dev):
+@@ -70,7 +92,13 @@ def check_domain_suffix_match(dev):
+ 
+ def check_domain_match_full(dev):
+     tls = dev.request("GET tls_library")
+-    if not tls.startswith("OpenSSL") and not tls.startswith("wolfSSL"):
++    if tls.startswith("OpenSSL"):
++        return
++    elif tls.startswith("wolfSSL"):
++        return
++    elif tls.startswith("mbed TLS"):
++        return
++    else:
+         raise HwsimSkip("domain_suffix_match requires full match with this TLS library: " + tls)
+ 
+ def check_cert_probe_support(dev):
+@@ -79,8 +107,15 @@ def check_cert_probe_support(dev):
+         raise HwsimSkip("Certificate probing not supported with this TLS library: " + tls)
+ 
+ def check_ext_cert_check_support(dev):
++    if not openssl_imported:
++        raise HwsimSkip("OpenSSL python method not available")
++
+     tls = dev.request("GET tls_library")
+-    if not tls.startswith("OpenSSL"):
++    if tls.startswith("OpenSSL"):
++        return
++    elif tls.startswith("mbed TLS"):
++        return
++    else:
+         raise HwsimSkip("ext_cert_check not supported with this TLS library: " + tls)
+ 
+ def check_ocsp_support(dev):
+@@ -91,14 +126,18 @@ def check_ocsp_support(dev):
+     #    raise HwsimSkip("OCSP not supported with this TLS library: " + tls)
+     #if tls.startswith("wolfSSL"):
+     #    raise HwsimSkip("OCSP not supported with this TLS library: " + tls)
++    if tls.startswith("mbed TLS"):
++        raise HwsimSkip("OCSP not supported with this TLS library: " + tls)
+ 
+ def check_pkcs5_v15_support(dev):
+     tls = dev.request("GET tls_library")
+-    if "BoringSSL" in tls or "GnuTLS" in tls:
++    if "BoringSSL" in tls or "GnuTLS" in tls or "mbed TLS" in tls:
+         raise HwsimSkip("PKCS#5 v1.5 not supported with this TLS library: " + tls)
+ 
+ def check_tls13_support(dev):
+     tls = dev.request("GET tls_library")
++    if tls.startswith("mbed TLS"):
++        raise HwsimSkip("TLS v1.3 not supported")
+     if "run=OpenSSL 1.1.1" not in tls and "run=OpenSSL 3.0" not in tls and "wolfSSL" not in tls:
+         raise HwsimSkip("TLS v1.3 not supported")
+ 
+@@ -118,11 +157,15 @@ def check_pkcs12_support(dev):
+     #    raise HwsimSkip("PKCS#12 not supported with this TLS library: " + tls)
+     if tls.startswith("wolfSSL"):
+         raise HwsimSkip("PKCS#12 not supported with this TLS library: " + tls)
++    if tls.startswith("mbed TLS"):
++        raise HwsimSkip("PKCS#12 not supported with this TLS library: " + tls)
+ 
+ def check_dh_dsa_support(dev):
+     tls = dev.request("GET tls_library")
+     if tls.startswith("internal"):
+         raise HwsimSkip("DH DSA not supported with this TLS library: " + tls)
++    if tls.startswith("mbed TLS"):
++        raise HwsimSkip("DH DSA not supported with this TLS library: " + tls)
+ 
+ def check_ec_support(dev):
+     tls = dev.request("GET tls_library")
+@@ -1595,7 +1638,7 @@ def test_ap_wpa2_eap_ttls_pap_subject_ma
+     eap_connect(dev[0], hapd, "TTLS", "pap user",
+                 anonymous_identity="ttls", password="password",
+                 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
+-                subject_match="/C=FI/O=w1.fi/CN=server.w1.fi",
++                check_cert_subject="/C=FI/O=w1.fi/CN=server.w1.fi",
+                 altsubject_match="EMAIL:noone@example.com;DNS:server.w1.fi;URI:http://example.com/")
+     eap_reauth(dev[0], "TTLS")
+ 
+@@ -2830,6 +2873,7 @@ def test_ap_wpa2_eap_tls_neg_domain_matc
+ 
+ def test_ap_wpa2_eap_tls_neg_subject_match(dev, apdev):
+     """WPA2-Enterprise negative test - subject mismatch"""
++    check_subject_match_support(dev[0])
+     params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
+     hostapd.add_ap(apdev[0], params)
+     dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
+@@ -2890,6 +2934,7 @@ def test_ap_wpa2_eap_tls_neg_subject_mat
+ 
+ def test_ap_wpa2_eap_tls_neg_altsubject_match(dev, apdev):
+     """WPA2-Enterprise negative test - altsubject mismatch"""
++    check_altsubject_match_support(dev[0])
+     params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
+     hostapd.add_ap(apdev[0], params)
+ 
+@@ -3430,7 +3475,7 @@ def test_ap_wpa2_eap_ikev2_oom(dev, apde
+             dev[0].request("REMOVE_NETWORK all")
+ 
+     tls = dev[0].request("GET tls_library")
+-    if not tls.startswith("wolfSSL"):
++    if not tls.startswith("wolfSSL") and not tls.startswith("mbed TLS"):
+         tests = [(1, "os_get_random;dh_init")]
+     else:
+         tests = [(1, "crypto_dh_init;dh_init")]
+@@ -4744,7 +4789,7 @@ def test_ap_wpa2_eap_tls_intermediate_ca
+     params["private_key"] = "auth_serv/iCA-server/server.key"
+     hostapd.add_ap(apdev[0], params)
+     tls = dev[0].request("GET tls_library")
+-    if "GnuTLS" in tls or "wolfSSL" in tls:
++    if "GnuTLS" in tls or "wolfSSL" in tls or "mbed TLS" in tls:
+         ca_cert = "auth_serv/iCA-user/ca-and-root.pem"
+         client_cert = "auth_serv/iCA-user/user_and_ica.pem"
+     else:
+@@ -4810,6 +4855,7 @@ def test_ap_wpa2_eap_tls_intermediate_ca
+     run_ap_wpa2_eap_tls_intermediate_ca_ocsp(dev, apdev, params, "-sha1")
+ 
+ def run_ap_wpa2_eap_tls_intermediate_ca_ocsp(dev, apdev, params, md):
++    check_ocsp_support(dev[0])
+     params = int_eap_server_params()
+     params["ca_cert"] = "auth_serv/iCA-server/ca-and-root.pem"
+     params["server_cert"] = "auth_serv/iCA-server/server.pem"
+@@ -4819,7 +4865,7 @@ def run_ap_wpa2_eap_tls_intermediate_ca_
+     try:
+         hostapd.add_ap(apdev[0], params)
+         tls = dev[0].request("GET tls_library")
+-        if "GnuTLS" in tls or "wolfSSL" in tls:
++        if "GnuTLS" in tls or "wolfSSL" in tls or "mbed TLS" in tls:
+             ca_cert = "auth_serv/iCA-user/ca-and-root.pem"
+             client_cert = "auth_serv/iCA-user/user_and_ica.pem"
+         else:
+@@ -4855,7 +4901,7 @@ def run_ap_wpa2_eap_tls_intermediate_ca_
+     try:
+         hostapd.add_ap(apdev[0], params)
+         tls = dev[0].request("GET tls_library")
+-        if "GnuTLS" in tls or "wolfSSL" in tls:
++        if "GnuTLS" in tls or "wolfSSL" in tls or "mbed TLS" in tls:
+             ca_cert = "auth_serv/iCA-user/ca-and-root.pem"
+             client_cert = "auth_serv/iCA-user/user_and_ica.pem"
+         else:
+@@ -4905,7 +4951,7 @@ def test_ap_wpa2_eap_tls_intermediate_ca
+     try:
+         hostapd.add_ap(apdev[0], params)
+         tls = dev[0].request("GET tls_library")
+-        if "GnuTLS" in tls or "wolfSSL" in tls:
++        if "GnuTLS" in tls or "wolfSSL" in tls or "mbed TLS" in tls:
+             ca_cert = "auth_serv/iCA-user/ca-and-root.pem"
+             client_cert = "auth_serv/iCA-user/user_and_ica.pem"
+         else:
+@@ -4972,7 +5018,7 @@ def test_ap_wpa2_eap_tls_intermediate_ca
+ 
+         hostapd.add_ap(apdev[0], params)
+         tls = dev[0].request("GET tls_library")
+-        if "GnuTLS" in tls or "wolfSSL" in tls:
++        if "GnuTLS" in tls or "wolfSSL" in tls or "mbed TLS" in tls:
+             ca_cert = "auth_serv/iCA-user/ca-and-root.pem"
+             client_cert = "auth_serv/iCA-user/user_and_ica.pem"
+         else:
+@@ -5230,6 +5276,7 @@ def test_ap_wpa2_eap_ttls_server_cert_ek
+ 
+ def test_ap_wpa2_eap_ttls_server_pkcs12(dev, apdev):
+     """WPA2-Enterprise using EAP-TTLS and server PKCS#12 file"""
++    check_pkcs12_support(dev[0])
+     skip_with_fips(dev[0])
+     params = int_eap_server_params()
+     del params["server_cert"]
+@@ -5242,6 +5289,7 @@ def test_ap_wpa2_eap_ttls_server_pkcs12(
+ 
+ def test_ap_wpa2_eap_ttls_server_pkcs12_extra(dev, apdev):
+     """EAP-TTLS and server PKCS#12 file with extra certs"""
++    check_pkcs12_support(dev[0])
+     skip_with_fips(dev[0])
+     params = int_eap_server_params()
+     del params["server_cert"]
+@@ -5264,6 +5312,7 @@ def test_ap_wpa2_eap_ttls_dh_params_serv
+ 
+ def test_ap_wpa2_eap_ttls_dh_params_dsa_server(dev, apdev):
+     """WPA2-Enterprise using EAP-TTLS and alternative server dhparams (DSA)"""
++    check_dh_dsa_support(dev[0])
+     params = int_eap_server_params()
+     params["dh_file"] = "auth_serv/dsaparam.pem"
+     hapd = hostapd.add_ap(apdev[0], params)
+@@ -5575,8 +5624,8 @@ def test_ap_wpa2_eap_non_ascii_identity2
+ def test_openssl_cipher_suite_config_wpas(dev, apdev):
+     """OpenSSL cipher suite configuration on wpa_supplicant"""
+     tls = dev[0].request("GET tls_library")
+-    if not tls.startswith("OpenSSL"):
+-        raise HwsimSkip("TLS library is not OpenSSL: " + tls)
++    if not tls.startswith("OpenSSL") and not tls.startswith("mbed TLS"):
++        raise HwsimSkip("TLS library is not OpenSSL or mbed TLS: " + tls)
+     params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
+     hapd = hostapd.add_ap(apdev[0], params)
+     eap_connect(dev[0], hapd, "TTLS", "pap user",
+@@ -5602,14 +5651,14 @@ def test_openssl_cipher_suite_config_wpa
+ def test_openssl_cipher_suite_config_hapd(dev, apdev):
+     """OpenSSL cipher suite configuration on hostapd"""
+     tls = dev[0].request("GET tls_library")
+-    if not tls.startswith("OpenSSL"):
+-        raise HwsimSkip("wpa_supplicant TLS library is not OpenSSL: " + tls)
++    if not tls.startswith("OpenSSL") and not tls.startswith("mbed TLS"):
++        raise HwsimSkip("wpa_supplicant TLS library is not OpenSSL or mbed TLS: " + tls)
+     params = int_eap_server_params()
+     params['openssl_ciphers'] = "AES256"
+     hapd = hostapd.add_ap(apdev[0], params)
+     tls = hapd.request("GET tls_library")
+-    if not tls.startswith("OpenSSL"):
+-        raise HwsimSkip("hostapd TLS library is not OpenSSL: " + tls)
++    if not tls.startswith("OpenSSL") and not tls.startswith("mbed TLS"):
++        raise HwsimSkip("hostapd TLS library is not OpenSSL or mbed TLS: " + tls)
+     eap_connect(dev[0], hapd, "TTLS", "pap user",
+                 anonymous_identity="ttls", password="password",
+                 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
+@@ -6051,13 +6100,17 @@ def test_ap_wpa2_eap_tls_versions(dev, a
+             check_tls_ver(dev[0], hapd,
+                           "tls_disable_tlsv1_0=1 tls_disable_tlsv1_1=1",
+                           "TLSv1.2")
+-    elif tls.startswith("internal"):
++    elif tls.startswith("internal") or tls.startswith("mbed TLS"):
+         check_tls_ver(dev[0], hapd,
+                       "tls_disable_tlsv1_0=1 tls_disable_tlsv1_1=1", "TLSv1.2")
+-    check_tls_ver(dev[1], hapd,
+-                  "tls_disable_tlsv1_0=1 tls_disable_tlsv1_1=0 tls_disable_tlsv1_2=1", "TLSv1.1")
+-    check_tls_ver(dev[2], hapd,
+-                  "tls_disable_tlsv1_0=0 tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1", "TLSv1")
++    if tls.startswith("mbed TLS"):
++        check_tls_ver(dev[2], hapd,
++                      "tls_disable_tlsv1_0=0 tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1", "TLSv1.0")
++    else:
++        check_tls_ver(dev[1], hapd,
++                      "tls_disable_tlsv1_0=1 tls_disable_tlsv1_1=0 tls_disable_tlsv1_2=1", "TLSv1.1")
++        check_tls_ver(dev[2], hapd,
++                      "tls_disable_tlsv1_0=0 tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1", "TLSv1")
+     if "run=OpenSSL 1.1.1" in tls or "run=OpenSSL 3.0" in tls:
+         check_tls_ver(dev[0], hapd,
+                       "tls_disable_tlsv1_0=1 tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1 tls_disable_tlsv1_3=0", "TLSv1.3")
+@@ -6079,6 +6132,11 @@ def test_ap_wpa2_eap_tls_versions_server
+     tests = [("TLSv1", "[ENABLE-TLSv1.0][DISABLE-TLSv1.1][DISABLE-TLSv1.2][DISABLE-TLSv1.3]"),
+              ("TLSv1.1", "[ENABLE-TLSv1.0][ENABLE-TLSv1.1][DISABLE-TLSv1.2][DISABLE-TLSv1.3]"),
+              ("TLSv1.2", "[ENABLE-TLSv1.0][ENABLE-TLSv1.1][ENABLE-TLSv1.2][DISABLE-TLSv1.3]")]
++    tls = dev[0].request("GET tls_library")
++    if tls.startswith("mbed TLS"):
++        tests = [#("TLSv1.0", "[ENABLE-TLSv1.0][DISABLE-TLSv1.1][DISABLE-TLSv1.2][DISABLE-TLSv1.3]"),
++                 #("TLSv1.1", "[ENABLE-TLSv1.0][ENABLE-TLSv1.1][DISABLE-TLSv1.2][DISABLE-TLSv1.3]"),
++                 ("TLSv1.2", "[ENABLE-TLSv1.0][ENABLE-TLSv1.1][ENABLE-TLSv1.2][DISABLE-TLSv1.3]")]
+     for exp, flags in tests:
+         hapd.disable()
+         hapd.set("tls_flags", flags)
+@@ -7115,6 +7173,7 @@ def test_ap_wpa2_eap_assoc_rsn(dev, apde
+ def test_eap_tls_ext_cert_check(dev, apdev):
+     """EAP-TLS and external server certification validation"""
+     # With internal server certificate chain validation
++    check_ext_cert_check_support(dev[0])
+     id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
+                         identity="tls user",
+                         ca_cert="auth_serv/ca.pem",
+@@ -7127,6 +7186,7 @@ def test_eap_tls_ext_cert_check(dev, apd
+ def test_eap_ttls_ext_cert_check(dev, apdev):
+     """EAP-TTLS and external server certification validation"""
+     # Without internal server certificate chain validation
++    check_ext_cert_check_support(dev[0])
+     id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
+                         identity="pap user", anonymous_identity="ttls",
+                         password="password", phase2="auth=PAP",
+@@ -7137,6 +7197,7 @@ def test_eap_ttls_ext_cert_check(dev, ap
+ def test_eap_peap_ext_cert_check(dev, apdev):
+     """EAP-PEAP and external server certification validation"""
+     # With internal server certificate chain validation
++    check_ext_cert_check_support(dev[0])
+     id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PEAP",
+                         identity="user", anonymous_identity="peap",
+                         ca_cert="auth_serv/ca.pem",
+@@ -7147,6 +7208,7 @@ def test_eap_peap_ext_cert_check(dev, ap
+ 
+ def test_eap_fast_ext_cert_check(dev, apdev):
+     """EAP-FAST and external server certification validation"""
++    check_ext_cert_check_support(dev[0])
+     check_eap_capa(dev[0], "FAST")
+     # With internal server certificate chain validation
+     dev[0].request("SET blob fast_pac_auth_ext ")
+@@ -7161,10 +7223,6 @@ def test_eap_fast_ext_cert_check(dev, ap
+     run_ext_cert_check(dev, apdev, id)
+ 
+ def run_ext_cert_check(dev, apdev, net_id):
+-    check_ext_cert_check_support(dev[0])
+-    if not openssl_imported:
+-        raise HwsimSkip("OpenSSL python method not available")
+-
+     params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
+     hapd = hostapd.add_ap(apdev[0], params)
+ 
+--- a/tests/hwsim/test_ap_ft.py
++++ b/tests/hwsim/test_ap_ft.py
+@@ -2471,11 +2471,11 @@ def test_ap_ft_ap_oom5(dev, apdev):
+         # This will fail to roam
+         dev[0].roam(bssid1, check_bssid=False)
+ 
+-    with fail_test(hapd1, 1, "sha256_prf_bits;wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
++    with fail_test(hapd1, 1, "sha256_prf;wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
+         # This will fail to roam
+         dev[0].roam(bssid1, check_bssid=False)
+ 
+-    with fail_test(hapd1, 3, "wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
++    with fail_test(hapd1, 2, "wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
+         # This will fail to roam
+         dev[0].roam(bssid1, check_bssid=False)
+ 
+--- a/tests/hwsim/test_authsrv.py
++++ b/tests/hwsim/test_authsrv.py
+@@ -156,9 +156,12 @@ def test_authsrv_oom(dev, apdev):
+         if "FAIL" not in authsrv.request("ENABLE"):
+             raise Exception("ENABLE succeeded during OOM")
+ 
+-    with alloc_fail(authsrv, 1, "tls_init;authsrv_init"):
+-        if "FAIL" not in authsrv.request("ENABLE"):
+-            raise Exception("ENABLE succeeded during OOM")
++    # tls_mbedtls.c:tls_init() does not alloc memory (no alloc fail trigger)
++    tls = dev[0].request("GET tls_library")
++    if not tls.startswith("mbed TLS"):
++        with alloc_fail(authsrv, 1, "tls_init;authsrv_init"):
++            if "FAIL" not in authsrv.request("ENABLE"):
++                raise Exception("ENABLE succeeded during OOM")
+ 
+     for count in range(1, 3):
+         with alloc_fail(authsrv, count, "eap_sim_db_init;authsrv_init"):
+--- a/tests/hwsim/test_dpp.py
++++ b/tests/hwsim/test_dpp.py
+@@ -39,7 +39,8 @@ def check_dpp_capab(dev, brainpool=False
+         raise HwsimSkip("DPP not supported")
+     if brainpool:
+         tls = dev.request("GET tls_library")
+-        if (not tls.startswith("OpenSSL") or "run=BoringSSL" in tls) and not tls.startswith("wolfSSL"):
++        if (not tls.startswith("OpenSSL") or "run=BoringSSL" in tls) and not tls.startswith("wolfSSL") \
++                                                                     and not tls.startswith("mbed TLS"):
+             raise HwsimSkip("Crypto library does not support Brainpool curves: " + tls)
+     capa = dev.request("GET_CAPABILITY dpp")
+     ver = 1
+@@ -3892,6 +3893,9 @@ def test_dpp_proto_auth_req_no_i_proto_k
+ 
+ def test_dpp_proto_auth_req_invalid_i_proto_key(dev, apdev):
+     """DPP protocol testing - invalid I-proto key in Auth Req"""
++    tls = dev[0].request("GET tls_library")
++    if tls.startswith("mbed TLS"):
++        raise HwsimSkip("mbed TLS crypto_ecdh_set_peerkey() properly detects invalid key; no response")
+     run_dpp_proto_auth_req_missing(dev, 66, "Invalid Initiator Protocol Key")
+ 
+ def test_dpp_proto_auth_req_no_i_nonce(dev, apdev):
+@@ -3987,7 +3991,12 @@ def test_dpp_proto_auth_resp_no_r_proto_
+ 
+ def test_dpp_proto_auth_resp_invalid_r_proto_key(dev, apdev):
+     """DPP protocol testing - invalid R-Proto Key in Auth Resp"""
+-    run_dpp_proto_auth_resp_missing(dev, 67, "Invalid Responder Protocol Key")
++    tls = dev[0].request("GET tls_library")
++    if tls.startswith("mbed TLS"):
++        # mbed TLS crypto_ecdh_set_peerkey() properly detects invalid key
++        run_dpp_proto_auth_resp_missing(dev, 67, "Failed to derive ECDH shared secret")
++    else:
++        run_dpp_proto_auth_resp_missing(dev, 67, "Invalid Responder Protocol Key")
+ 
+ def test_dpp_proto_auth_resp_no_r_nonce(dev, apdev):
+     """DPP protocol testing - no R-nonce in Auth Resp"""
+@@ -4349,11 +4358,17 @@ def test_dpp_proto_pkex_exchange_resp_in
+ 
+ def test_dpp_proto_pkex_cr_req_invalid_bootstrap_key(dev, apdev):
+     """DPP protocol testing - invalid Bootstrap Key in PKEX Commit-Reveal Request"""
++    tls = dev[0].request("GET tls_library")
++    if tls.startswith("mbed TLS"):
++        raise HwsimSkip("mbed TLS crypto_ecdh_set_peerkey() properly detects invalid key; no response")
+     run_dpp_proto_pkex_req_missing(dev, 47,
+                                    "Peer bootstrapping key is invalid")
+ 
+ def test_dpp_proto_pkex_cr_resp_invalid_bootstrap_key(dev, apdev):
+     """DPP protocol testing - invalid Bootstrap Key in PKEX Commit-Reveal Response"""
++    tls = dev[0].request("GET tls_library")
++    if tls.startswith("mbed TLS"):
++        raise HwsimSkip("mbed TLS crypto_ecdh_set_peerkey() properly detects invalid key; no response")
+     run_dpp_proto_pkex_resp_missing(dev, 48,
+                                     "Peer bootstrapping key is invalid")
+ 
+--- a/tests/hwsim/test_erp.py
++++ b/tests/hwsim/test_erp.py
+@@ -12,7 +12,7 @@ import time
+ 
+ import hostapd
+ from utils import *
+-from test_ap_eap import int_eap_server_params, check_tls13_support
++from test_ap_eap import int_eap_server_params, check_tls13_support, check_eap_capa
+ from test_ap_psk import find_wpas_process, read_process_memory, verify_not_present, get_key_locations
+ 
+ def test_erp_initiate_reauth_start(dev, apdev):
+@@ -276,6 +276,7 @@ def test_erp_radius_eap_methods(dev, apd
+     params['erp_domain'] = 'example.com'
+     params['disable_pmksa_caching'] = '1'
+     hapd = hostapd.add_ap(apdev[0], params)
++    tls = dev[0].request("GET tls_library")
+ 
+     erp_test(dev[0], hapd, eap="AKA", identity="0232010000000000@example.com",
+              password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123")
+@@ -289,7 +290,7 @@ def test_erp_radius_eap_methods(dev, apd
+              password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123")
+     erp_test(dev[0], hapd, eap="EKE", identity="erp-eke@example.com",
+              password="hello")
+-    if "FAST" in eap_methods:
++    if "FAST" in eap_methods and check_eap_capa(dev[0], "FAST"):
+         erp_test(dev[0], hapd, eap="FAST", identity="erp-fast@example.com",
+                  password="password", ca_cert="auth_serv/ca.pem",
+                  phase2="auth=GTC",
+@@ -301,13 +302,14 @@ def test_erp_radius_eap_methods(dev, apd
+              password="password")
+     erp_test(dev[0], hapd, eap="PAX", identity="erp-pax@example.com",
+              password_hex="0123456789abcdef0123456789abcdef")
+-    if "MSCHAPV2" in eap_methods:
++    if "MSCHAPV2" in eap_methods and check_eap_capa(dev[0], "MSCHAPV2"):
+         erp_test(dev[0], hapd, eap="PEAP", identity="erp-peap@example.com",
+                  password="password", ca_cert="auth_serv/ca.pem",
+                  phase2="auth=MSCHAPV2")
+-        erp_test(dev[0], hapd, eap="TEAP", identity="erp-teap@example.com",
+-                 password="password", ca_cert="auth_serv/ca.pem",
+-                 phase2="auth=MSCHAPV2", pac_file="blob://teap_pac")
++        if check_eap_capa(dev[0], "TEAP"):
++            erp_test(dev[0], hapd, eap="TEAP", identity="erp-teap@example.com",
++                     password="password", ca_cert="auth_serv/ca.pem",
++                     phase2="auth=MSCHAPV2", pac_file="blob://teap_pac")
+     erp_test(dev[0], hapd, eap="PSK", identity="erp-psk@example.com",
+              password_hex="0123456789abcdef0123456789abcdef")
+     if "PWD" in eap_methods:
+@@ -640,7 +642,7 @@ def test_erp_local_errors(dev, apdev):
+         dev[0].request("REMOVE_NETWORK all")
+         dev[0].wait_disconnected()
+ 
+-    for count in range(1, 6):
++    for count in range(1, 4):
+         dev[0].request("ERP_FLUSH")
+         with fail_test(dev[0], count, "hmac_sha256_kdf;eap_peer_erp_init"):
+             dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
+--- a/tests/hwsim/test_fils.py
++++ b/tests/hwsim/test_fils.py
+@@ -1422,7 +1422,10 @@ def run_fils_sk_pfs(dev, apdev, group, p
+     check_erp_capa(dev[0])
+ 
+     tls = dev[0].request("GET tls_library")
+-    if not tls.startswith("wolfSSL"):
++    if tls.startswith("mbed TLS"):
++        if int(group) == 27:
++            raise HwsimSkip("Brainpool EC group 27 not supported by mbed TLS")
++    elif not tls.startswith("wolfSSL"):
+         if int(group) in [25]:
+             if not (tls.startswith("OpenSSL") and ("build=OpenSSL 1.0.2" in tls or "build=OpenSSL 1.1" in tls or "build=OpenSSL 3.0" in tls) and ("run=OpenSSL 1.0.2" in tls or "run=OpenSSL 1.1" in tls or "run=OpenSSL 3.0" in tls)):
+                 raise HwsimSkip("EC group not supported")
+--- a/tests/hwsim/test_pmksa_cache.py
++++ b/tests/hwsim/test_pmksa_cache.py
+@@ -955,7 +955,7 @@ def test_pmksa_cache_preauth_wpas_oom(de
+     eap_connect(dev[0], hapd, "PAX", "pax.user@example.com",
+                 password_hex="0123456789abcdef0123456789abcdef",
+                 bssid=apdev[0]['bssid'])
+-    for i in range(1, 11):
++    for i in range(1, 10):
+         with alloc_fail(dev[0], i, "rsn_preauth_init"):
+             res = dev[0].request("PREAUTH f2:11:22:33:44:55").strip()
+             logger.info("Iteration %d - PREAUTH command results: %s" % (i, res))
+@@ -963,7 +963,7 @@ def test_pmksa_cache_preauth_wpas_oom(de
+                 state = dev[0].request('GET_ALLOC_FAIL')
+                 if state.startswith('0:'):
+                     break
+-                time.sleep(0.05)
++                time.sleep(0.10)
+ 
+ def test_pmksa_cache_ctrl(dev, apdev):
+     """PMKSA cache control interface operations"""
+--- a/tests/hwsim/test_sae.py
++++ b/tests/hwsim/test_sae.py
+@@ -177,6 +177,11 @@ def test_sae_groups(dev, apdev):
+     if tls.startswith("OpenSSL") and "run=OpenSSL 1." in tls:
+         logger.info("Add Brainpool EC groups since OpenSSL is new enough")
+         sae_groups += [27, 28, 29, 30]
++    if tls.startswith("mbed TLS"):
++        # secp224k1 and secp224r1 (26) have prime p = 1 mod 4, and mbedtls
++        # does not have code to derive y from compressed format for those curves
++        sae_groups = [19, 25, 20, 21, 1, 2, 5, 14, 15, 16, 22, 23, 24]
++        sae_groups += [27, 28, 29, 30]
+     heavy_groups = [14, 15, 16]
+     suitable_groups = [15, 16, 17, 18, 19, 20, 21]
+     groups = [str(g) for g in sae_groups]
+@@ -2188,6 +2193,8 @@ def run_sae_pwe_group(dev, apdev, group)
+             logger.info("Add Brainpool EC groups since OpenSSL is new enough")
+         elif tls.startswith("wolfSSL"):
+             logger.info("Make sure Brainpool EC groups were enabled when compiling wolfSSL")
++        elif tls.startswith("mbed TLS"):
++            logger.info("Make sure Brainpool EC groups were enabled when compiling mbed TLS")
+         else:
+             raise HwsimSkip("Brainpool curve not supported")
+     start_sae_pwe_ap(apdev[0], group, 2)
+--- a/tests/hwsim/test_suite_b.py
++++ b/tests/hwsim/test_suite_b.py
+@@ -27,6 +27,8 @@ def check_suite_b_tls_lib(dev, dhe=False
+         return
+     if tls.startswith("wolfSSL"):
+         return
++    if tls.startswith("mbed TLS"):
++        return
+     if not tls.startswith("OpenSSL"):
+         raise HwsimSkip("TLS library not supported for Suite B: " + tls)
+     supported = False
+@@ -520,6 +522,7 @@ def test_suite_b_192_rsa_insufficient_dh
+ 
+     dev[0].connect("test-suite-b", key_mgmt="WPA-EAP-SUITE-B-192",
+                    ieee80211w="2",
++                   openssl_ciphers="DHE-RSA-AES256-GCM-SHA384",
+                    phase1="tls_suiteb=1",
+                    eap="TLS", identity="tls user",
+                    ca_cert="auth_serv/rsa3072-ca.pem",
+--- a/tests/hwsim/test_wpas_ctrl.py
++++ b/tests/hwsim/test_wpas_ctrl.py
+@@ -1842,7 +1842,7 @@ def _test_wpas_ctrl_oom(dev):
+     tls = dev[0].request("GET tls_library")
+     if not tls.startswith("internal"):
+         tests.append(('NFC_GET_HANDOVER_SEL NDEF P2P-CR-TAG', 'FAIL',
+-                      4, 'wpas_ctrl_nfc_get_handover_sel_p2p'))
++                      3, 'wpas_ctrl_nfc_get_handover_sel_p2p'))
+     for cmd, exp, count, func in tests:
+         with alloc_fail(dev[0], count, func):
+             res = dev[0].request(cmd)
+--- a/tests/hwsim/utils.py
++++ b/tests/hwsim/utils.py
+@@ -141,7 +141,13 @@ def check_imsi_privacy_support(dev):
+ 
+ def check_tls_tod(dev):
+     tls = dev.request("GET tls_library")
+-    if not tls.startswith("OpenSSL") and not tls.startswith("internal"):
++    if tls.startswith("OpenSSL"):
++        return
++    elif tls.startswith("internal"):
++        return
++    elif tls.startswith("mbed TLS"):
++        return
++    else:
+         raise HwsimSkip("TLS TOD-TOFU/STRICT not supported with this TLS library: " + tls)
+ 
+ def vht_supported():
+--- /dev/null
++++ b/tests/test-crypto_module.c
+@@ -0,0 +1,16 @@
++/*
++ * crypto module tests - test program
++ * Copyright (c) 2022, Glenn Strauss <gstrauss@gluelogic.com>
++ *
++ * This software may be distributed under the terms of the BSD license.
++ * See README for more details.
++ */
++
++#include "utils/includes.h"
++#include "utils/module_tests.h"
++#include "crypto/crypto_module_tests.c"
++
++int main(int argc, char *argv[])
++{
++	return crypto_module_tests();
++}
+--- a/tests/test-https.c
++++ b/tests/test-https.c
+@@ -75,7 +75,7 @@ static int https_client(int s, const cha
+ 	struct tls_connection *conn;
+ 	struct wpabuf *in, *out, *appl;
+ 	int res = -1;
+-	int need_more_data;
++	int need_more_data = 0;
+ 
+ 	os_memset(&conf, 0, sizeof(conf));
+ 	conf.event_cb = https_tls_event_cb;
+@@ -93,8 +93,12 @@ static int https_client(int s, const cha
+ 
+ 	for (;;) {
+ 		appl = NULL;
++#ifdef CONFIG_TLS_INTERNAL_SERVER
+ 		out = tls_connection_handshake2(tls, conn, in, &appl,
+ 						&need_more_data);
++#else
++		out = tls_connection_handshake(tls, conn, in, &appl);
++#endif
+ 		wpabuf_free(in);
+ 		in = NULL;
+ 		if (out == NULL) {
+@@ -152,11 +156,15 @@ static int https_client(int s, const cha
+ 
+ 	wpa_printf(MSG_INFO, "Reading HTTP response");
+ 	for (;;) {
+-		int need_more_data;
++		int need_more_data = 0;
+ 		in = https_recv(s);
+ 		if (in == NULL)
+ 			goto done;
++#ifdef CONFIG_TLS_INTERNAL_SERVER
+ 		out = tls_connection_decrypt2(tls, conn, in, &need_more_data);
++#else
++		out = tls_connection_decrypt(tls, conn, in);
++#endif
+ 		if (need_more_data)
+ 			wpa_printf(MSG_DEBUG, "HTTP: Need more data");
+ 		wpabuf_free(in);
+--- a/tests/test-https_server.c
++++ b/tests/test-https_server.c
+@@ -67,10 +67,12 @@ static struct wpabuf * https_recv(int s,
+ }
+ 
+ 
++#ifdef CONFIG_TLS_INTERNAL_SERVER
+ static void https_tls_log_cb(void *ctx, const char *msg)
+ {
+ 	wpa_printf(MSG_DEBUG, "TLS: %s", msg);
+ }
++#endif
+ 
+ 
+ static int https_server(int s)
+@@ -79,7 +81,7 @@ static int https_server(int s)
+ 	void *tls;
+ 	struct tls_connection_params params;
+ 	struct tls_connection *conn;
+-	struct wpabuf *in, *out, *appl;
++	struct wpabuf *in = NULL, *out = NULL, *appl = NULL;
+ 	int res = -1;
+ 
+ 	os_memset(&conf, 0, sizeof(conf));
+@@ -106,7 +108,9 @@ static int https_server(int s)
+ 		return -1;
+ 	}
+ 
++#ifdef CONFIG_TLS_INTERNAL_SERVER
+ 	tls_connection_set_log_cb(conn, https_tls_log_cb, NULL);
++#endif
+ 
+ 	for (;;) {
+ 		in = https_recv(s, 5000);
+@@ -147,12 +151,16 @@ static int https_server(int s)
+ 
+ 	wpa_printf(MSG_INFO, "Reading HTTP request");
+ 	for (;;) {
+-		int need_more_data;
++		int need_more_data = 0;
+ 
+ 		in = https_recv(s, 5000);
+ 		if (!in)
+ 			goto done;
++#ifdef CONFIG_TLS_INTERNAL_SERVER
+ 		out = tls_connection_decrypt2(tls, conn, in, &need_more_data);
++#else
++		out = tls_connection_decrypt(tls, conn, in);
++#endif
+ 		wpabuf_free(in);
+ 		in = NULL;
+ 		if (need_more_data) {
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -1122,6 +1122,7 @@ CFLAGS += -DCONFIG_TLSV12
+ endif
+ 
+ ifeq ($(CONFIG_TLS), wolfssl)
++CFLAGS += -DCONFIG_TLS_WOLFSSL
+ ifdef TLS_FUNCS
+ CFLAGS += -DWOLFSSL_DER_LOAD
+ OBJS += ../src/crypto/tls_wolfssl.o
+@@ -1137,6 +1138,7 @@ LIBS_p += -lwolfssl -lm
+ endif
+ 
+ ifeq ($(CONFIG_TLS), openssl)
++CFLAGS += -DCONFIG_TLS_OPENSSL
+ CFLAGS += -DCRYPTO_RSA_OAEP_SHA256
+ ifdef TLS_FUNCS
+ CFLAGS += -DEAP_TLS_OPENSSL
+@@ -1164,6 +1166,7 @@ CFLAGS += -DTLS_DEFAULT_CIPHERS=\"$(CONF
+ endif
+ 
+ ifeq ($(CONFIG_TLS), mbedtls)
++CFLAGS += -DCONFIG_TLS_MBEDTLS
+ ifndef CONFIG_CRYPTO
+ CONFIG_CRYPTO=mbedtls
+ endif
+@@ -1183,6 +1186,7 @@ endif
+ endif
+ 
+ ifeq ($(CONFIG_TLS), gnutls)
++CFLAGS += -DCONFIG_TLS_GNUTLS
+ ifndef CONFIG_CRYPTO
+ # default to libgcrypt
+ CONFIG_CRYPTO=gnutls
+@@ -1213,6 +1217,7 @@ endif
+ endif
+ 
+ ifeq ($(CONFIG_TLS), internal)
++CFLAGS += -DCONFIG_TLS_INTERNAL
+ ifndef CONFIG_CRYPTO
+ CONFIG_CRYPTO=internal
+ endif
+@@ -1293,6 +1298,7 @@ endif
+ endif
+ 
+ ifeq ($(CONFIG_TLS), linux)
++CFLAGS += -DCONFIG_TLS_INTERNAL
+ OBJS += ../src/crypto/crypto_linux.o
+ OBJS_p += ../src/crypto/crypto_linux.o
+ ifdef TLS_FUNCS
diff --git a/package/network/services/hostapd/patches/150-add-NULL-checks-encountered-during-tests-hwsim.patch b/package/network/services/hostapd/patches/150-add-NULL-checks-encountered-during-tests-hwsim.patch
new file mode 100644
index 00000000000000..c8c3ff33f42022
--- /dev/null
+++ b/package/network/services/hostapd/patches/150-add-NULL-checks-encountered-during-tests-hwsim.patch
@@ -0,0 +1,45 @@
+From 33afce36c54b0cad38643629ded10ff5d727f077 Mon Sep 17 00:00:00 2001
+From: Glenn Strauss <gstrauss@gluelogic.com>
+Date: Fri, 12 Aug 2022 05:34:47 -0400
+Subject: [PATCH 5/7] add NULL checks (encountered during tests/hwsim)
+
+sae_derive_commit_element_ecc NULL pwe_ecc check
+dpp_gen_keypair() NULL curve check
+
+Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
+---
+ src/common/dpp_crypto.c | 6 ++++++
+ src/common/sae.c        | 7 +++++++
+ 2 files changed, 13 insertions(+)
+
+--- a/src/common/dpp_crypto.c
++++ b/src/common/dpp_crypto.c
+@@ -269,6 +269,12 @@ int dpp_get_pubkey_hash(struct crypto_ec
+ 
+ struct crypto_ec_key * dpp_gen_keypair(const struct dpp_curve_params *curve)
+ {
++	if (curve == NULL) {
++		wpa_printf(MSG_DEBUG,
++		           "DPP: %s curve must be initialized", __func__);
++		return NULL;
++	}
++
+ 	struct crypto_ec_key *key;
+ 
+ 	wpa_printf(MSG_DEBUG, "DPP: Generating a keypair");
+--- a/src/common/sae.c
++++ b/src/common/sae.c
+@@ -1278,6 +1278,13 @@ void sae_deinit_pt(struct sae_pt *pt)
+ static int sae_derive_commit_element_ecc(struct sae_data *sae,
+ 					 struct crypto_bignum *mask)
+ {
++	if (sae->tmp->pwe_ecc == NULL) {
++		wpa_printf(MSG_DEBUG,
++		           "SAE: %s sae->tmp->pwe_ecc must be initialized",
++		           __func__);
++		return -1;
++	}
++
+ 	/* COMMIT-ELEMENT = inverse(scalar-op(mask, PWE)) */
+ 	if (!sae->tmp->own_commit_element_ecc) {
+ 		sae->tmp->own_commit_element_ecc =
diff --git a/package/network/services/hostapd/patches/160-dpp_pkex-EC-point-mul-w-value-prime.patch b/package/network/services/hostapd/patches/160-dpp_pkex-EC-point-mul-w-value-prime.patch
new file mode 100644
index 00000000000000..db4fcfe2357ce7
--- /dev/null
+++ b/package/network/services/hostapd/patches/160-dpp_pkex-EC-point-mul-w-value-prime.patch
@@ -0,0 +1,26 @@
+From 54211caa2e0e5163aefef390daf88a971367a702 Mon Sep 17 00:00:00 2001
+From: Glenn Strauss <gstrauss@gluelogic.com>
+Date: Tue, 4 Oct 2022 17:09:24 -0400
+Subject: [PATCH 6/7] dpp_pkex: EC point mul w/ value < prime
+
+crypto_ec_point_mul() with mbedtls requires point
+be multiplied by a multiplicand with value < prime
+
+Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
+---
+ src/common/dpp_crypto.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/src/common/dpp_crypto.c
++++ b/src/common/dpp_crypto.c
+@@ -1588,7 +1588,9 @@ dpp_pkex_derive_Qr(const struct dpp_curv
+ 	Pr = crypto_ec_key_get_public_key(Pr_key);
+ 	Qr = crypto_ec_point_init(ec);
+ 	hash_bn = crypto_bignum_init_set(hash, curve->hash_len);
+-	if (!Pr || !Qr || !hash_bn || crypto_ec_point_mul(ec, Pr, hash_bn, Qr))
++	if (!Pr || !Qr || !hash_bn ||
++	    crypto_bignum_mod(hash_bn, crypto_ec_get_prime(ec), hash_bn) ||
++	    crypto_ec_point_mul(ec, Pr, hash_bn, Qr))
+ 		goto fail;
+ 
+ 	if (crypto_ec_point_is_at_infinity(ec, Qr)) {
diff --git a/package/network/services/hostapd/patches/170-wpa_supplicant-fix-compiling-without-IEEE8021X_EAPOL.patch b/package/network/services/hostapd/patches/170-wpa_supplicant-fix-compiling-without-IEEE8021X_EAPOL.patch
new file mode 100644
index 00000000000000..7724f1ae8d6496
--- /dev/null
+++ b/package/network/services/hostapd/patches/170-wpa_supplicant-fix-compiling-without-IEEE8021X_EAPOL.patch
@@ -0,0 +1,41 @@
+From c85ce84d942e1eabde33e120b18e5b1f1637b76e Mon Sep 17 00:00:00 2001
+From: Nick Hainke <vincent@systemli.org>
+Date: Tue, 14 Mar 2023 21:40:53 +0100
+Subject: [PATCH] wpa_supplicant: fix compiling without IEEE8021X_EAPOL
+
+If IEEE8021X_EAPOL is not defined wpa_supplicant will not compile with
+following error:
+
+  events.c: In function 'wpa_supplicant_connect':
+  events.c:1827:14: warning: implicit declaration of function 'eap_is_wps_pbc_enrollee' [-Wimplicit-function-declaration]
+   1827 |         if ((eap_is_wps_pbc_enrollee(&ssid->eap) &&
+        |              ^~~~~~~~~~~~~~~~~~~~~~~
+  events.c:1827:43: error: 'struct wpa_ssid' has no member named 'eap'
+   1827 |         if ((eap_is_wps_pbc_enrollee(&ssid->eap) &&
+        |                                           ^~
+
+Adding ifdef statements around the calling function fixes the issue.
+
+Signed-off-by: Nick Hainke <vincent@systemli.org>
+---
+ wpa_supplicant/events.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/wpa_supplicant/events.c
++++ b/wpa_supplicant/events.c
+@@ -1824,6 +1824,7 @@ int wpa_supplicant_connect(struct wpa_su
+ 			   struct wpa_bss *selected,
+ 			   struct wpa_ssid *ssid)
+ {
++#ifdef IEEE8021X_EAPOL
+ 	if ((eap_is_wps_pbc_enrollee(&ssid->eap) &&
+ 	     wpas_wps_partner_link_overlap_detect(wpa_s)) ||
+ 	    wpas_wps_scan_pbc_overlap(wpa_s, selected, ssid)) {
+@@ -1846,6 +1847,7 @@ int wpa_supplicant_connect(struct wpa_su
+ #endif /* CONFIG_WPS */
+ 		return -1;
+ 	}
++#endif /* IEEE8021X_EAPOL */
+ 
+ 	wpa_msg(wpa_s, MSG_DEBUG,
+ 		"Considering connect request: reassociate: %d  selected: "
diff --git a/package/network/services/hostapd/patches/200-multicall.patch b/package/network/services/hostapd/patches/200-multicall.patch
index ad82e020f61158..f12aeb0ca9e37a 100644
--- a/package/network/services/hostapd/patches/200-multicall.patch
+++ b/package/network/services/hostapd/patches/200-multicall.patch
@@ -18,7 +18,7 @@
  OBJS += ../src/ap/vlan_init.o
  OBJS += ../src/ap/vlan_ifconfig.o
  OBJS += ../src/ap/vlan.o
-@@ -350,10 +352,14 @@ CFLAGS += -DCONFIG_MBO
+@@ -357,10 +359,14 @@ CFLAGS += -DCONFIG_MBO
  OBJS += ../src/ap/mbo_ap.o
  endif
  
@@ -36,7 +36,7 @@
  LIBS += $(DRV_AP_LIBS)
  
  ifdef CONFIG_L2_PACKET
-@@ -1281,6 +1287,12 @@ install: $(addprefix $(DESTDIR)$(BINDIR)
+@@ -1380,6 +1386,12 @@ install: $(addprefix $(DESTDIR)$(BINDIR)
  _OBJS_VAR := OBJS
  include ../src/objs.mk
  
@@ -49,7 +49,7 @@
  hostapd: $(OBJS)
  	$(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS)
  	@$(E) "  LD " $@
-@@ -1355,6 +1367,12 @@ include ../src/objs.mk
+@@ -1460,6 +1472,12 @@ include ../src/objs.mk
  _OBJS_VAR := SOBJS
  include ../src/objs.mk
  
@@ -64,15 +64,15 @@
  	@$(E) "  LD " $@
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -17,6 +17,7 @@ endif
+@@ -10,6 +10,7 @@ ALL += dbus/fi.w1.wpa_supplicant1.servic
  EXTRA_TARGETS=dynamic_eap_methods
  
  CONFIG_FILE=.config
 +-include $(if $(MULTICALL),../hostapd/.config)
  include ../src/build.rules
  
- ifdef LIBS
-@@ -363,7 +364,9 @@ endif
+ ifdef CONFIG_BUILD_PASN_SO
+@@ -382,7 +383,9 @@ endif
  ifdef CONFIG_IBSS_RSN
  NEED_RSN_AUTHENTICATOR=y
  CFLAGS += -DCONFIG_IBSS_RSN
@@ -82,7 +82,7 @@
  OBJS += ibss_rsn.o
  endif
  
-@@ -900,6 +903,10 @@ ifdef CONFIG_DYNAMIC_EAP_METHODS
+@@ -924,6 +927,10 @@ ifdef CONFIG_DYNAMIC_EAP_METHODS
  CFLAGS += -DCONFIG_DYNAMIC_EAP_METHODS
  LIBS += -ldl -rdynamic
  endif
@@ -93,7 +93,7 @@
  endif
  
  ifdef CONFIG_AP
-@@ -907,9 +914,11 @@ NEED_EAP_COMMON=y
+@@ -931,9 +938,11 @@ NEED_EAP_COMMON=y
  NEED_RSN_AUTHENTICATOR=y
  CFLAGS += -DCONFIG_AP
  OBJS += ap.o
@@ -105,7 +105,7 @@
  OBJS += ../src/ap/hostapd.o
  OBJS += ../src/ap/wpa_auth_glue.o
  OBJS += ../src/ap/utils.o
-@@ -989,6 +998,12 @@ endif
+@@ -1022,6 +1031,12 @@ endif
  ifdef CONFIG_HS20
  OBJS += ../src/ap/hs20.o
  endif
@@ -118,7 +118,7 @@
  endif
  
  ifdef CONFIG_MBO
-@@ -997,7 +1012,9 @@ CFLAGS += -DCONFIG_MBO
+@@ -1030,7 +1045,9 @@ CFLAGS += -DCONFIG_MBO
  endif
  
  ifdef NEED_RSN_AUTHENTICATOR
@@ -128,7 +128,7 @@
  NEED_AES_WRAP=y
  OBJS += ../src/ap/wpa_auth.o
  OBJS += ../src/ap/wpa_auth_ie.o
-@@ -1891,6 +1908,12 @@ wpa_priv: $(BCHECK) $(OBJS_priv)
+@@ -2010,6 +2027,12 @@ wpa_priv: $(BCHECK) $(OBJS_priv)
  
  _OBJS_VAR := OBJS
  include ../src/objs.mk
@@ -141,7 +141,7 @@
  wpa_supplicant: $(BCHECK) $(OBJS) $(EXTRA_progs)
  	$(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS)
  	@$(E) "  LD " $@
-@@ -2023,6 +2046,12 @@ eap_gpsk.so: $(SRC_EAP_GPSK)
+@@ -2142,6 +2165,12 @@ eap_gpsk.so: $(SRC_EAP_GPSK)
  	$(Q)sed -e 's|\@BINDIR\@|$(BINDIR)|g' $< >$@
  	@$(E) "  sed" $<
  
@@ -156,7 +156,7 @@
  wpa_cli.exe: wpa_cli
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -6033,8 +6033,8 @@ union wpa_event_data {
+@@ -6544,8 +6544,8 @@ union wpa_event_data {
   * Driver wrapper code should call this function whenever an event is received
   * from the driver.
   */
@@ -167,7 +167,7 @@
  
  /**
   * wpa_supplicant_event_global - Report a driver event for wpa_supplicant
-@@ -6046,7 +6046,7 @@ void wpa_supplicant_event(void *ctx, enu
+@@ -6557,7 +6557,7 @@ void wpa_supplicant_event(void *ctx, enu
   * Same as wpa_supplicant_event(), but we search for the interface in
   * wpa_global.
   */
@@ -178,7 +178,7 @@
  /*
 --- a/src/ap/drv_callbacks.c
 +++ b/src/ap/drv_callbacks.c
-@@ -1842,8 +1842,8 @@ err:
+@@ -1887,8 +1887,8 @@ err:
  #endif /* CONFIG_OWE */
  
  
@@ -189,7 +189,7 @@
  {
  	struct hostapd_data *hapd = ctx;
  #ifndef CONFIG_NO_STDOUT_DEBUG
-@@ -2088,7 +2088,7 @@ void wpa_supplicant_event(void *ctx, enu
+@@ -2161,7 +2161,7 @@ void wpa_supplicant_event(void *ctx, enu
  }
  
  
@@ -200,7 +200,7 @@
  	struct hapd_interfaces *interfaces = ctx;
 --- a/wpa_supplicant/wpa_priv.c
 +++ b/wpa_supplicant/wpa_priv.c
-@@ -1038,8 +1038,8 @@ static void wpa_priv_send_ft_response(st
+@@ -1039,8 +1039,8 @@ static void wpa_priv_send_ft_response(st
  }
  
  
@@ -211,7 +211,7 @@
  {
  	struct wpa_priv_interface *iface = ctx;
  
-@@ -1102,7 +1102,7 @@ void wpa_supplicant_event(void *ctx, enu
+@@ -1103,7 +1103,7 @@ void wpa_supplicant_event(void *ctx, enu
  }
  
  
@@ -220,7 +220,7 @@
  				 union wpa_event_data *data)
  {
  	struct wpa_priv_global *global = ctx;
-@@ -1215,6 +1215,8 @@ int main(int argc, char *argv[])
+@@ -1217,6 +1217,8 @@ int main(int argc, char *argv[])
  	if (os_program_init())
  		return -1;
  
@@ -231,7 +231,7 @@
  	os_memset(&global, 0, sizeof(global));
 --- a/wpa_supplicant/events.c
 +++ b/wpa_supplicant/events.c
-@@ -4891,8 +4891,8 @@ static void wpas_event_unprot_beacon(str
+@@ -5237,8 +5237,8 @@ static void wpas_event_unprot_beacon(str
  }
  
  
@@ -242,7 +242,7 @@
  {
  	struct wpa_supplicant *wpa_s = ctx;
  	int resched;
-@@ -5745,7 +5745,7 @@ void wpa_supplicant_event(void *ctx, enu
+@@ -6149,7 +6149,7 @@ void wpa_supplicant_event(void *ctx, enu
  }
  
  
@@ -253,7 +253,7 @@
  	struct wpa_supplicant *wpa_s;
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -7043,7 +7043,6 @@ struct wpa_interface * wpa_supplicant_ma
+@@ -7408,7 +7408,6 @@ struct wpa_interface * wpa_supplicant_ma
  	return NULL;
  }
  
@@ -261,7 +261,7 @@
  /**
   * wpa_supplicant_match_existing - Match existing interfaces
   * @global: Pointer to global data from wpa_supplicant_init()
-@@ -7078,6 +7077,11 @@ static int wpa_supplicant_match_existing
+@@ -7443,6 +7442,11 @@ static int wpa_supplicant_match_existing
  
  #endif /* CONFIG_MATCH_IFACE */
  
@@ -273,7 +273,7 @@
  
  /**
   * wpa_supplicant_add_iface - Add a new network interface
-@@ -7334,6 +7338,8 @@ struct wpa_global * wpa_supplicant_init(
+@@ -7699,6 +7703,8 @@ struct wpa_global * wpa_supplicant_init(
  #ifndef CONFIG_NO_WPA_MSG
  	wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
  #endif /* CONFIG_NO_WPA_MSG */
@@ -284,7 +284,7 @@
  		wpa_debug_open_file(params->wpa_debug_file_path);
 --- a/hostapd/main.c
 +++ b/hostapd/main.c
-@@ -590,6 +590,11 @@ fail:
+@@ -595,6 +595,11 @@ fail:
  	return -1;
  }
  
@@ -296,14 +296,14 @@
  
  #ifdef CONFIG_WPS
  static int gen_uuid(const char *txt_addr)
-@@ -683,6 +688,8 @@ int main(int argc, char *argv[])
+@@ -688,6 +693,8 @@ int main(int argc, char *argv[])
  		return -1;
  #endif /* CONFIG_DPP */
  
 +	wpa_supplicant_event = hostapd_wpa_event;
 +	wpa_supplicant_event_global = hostapd_wpa_event_global;
  	for (;;) {
- 		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:vg:G:");
+ 		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:vg:G:q");
  		if (c < 0)
 --- a/src/drivers/drivers.c
 +++ b/src/drivers/drivers.c
@@ -320,7 +320,7 @@
  {
 --- a/wpa_supplicant/eapol_test.c
 +++ b/wpa_supplicant/eapol_test.c
-@@ -30,7 +30,12 @@
+@@ -31,7 +31,12 @@
  #include "ctrl_iface.h"
  #include "pcsc_funcs.h"
  #include "wpas_glue.h"
@@ -333,7 +333,7 @@
  
  const struct wpa_driver_ops *const wpa_drivers[] = { NULL };
  
-@@ -1291,6 +1296,10 @@ static void usage(void)
+@@ -1303,6 +1308,10 @@ static void usage(void)
  	       "option several times.\n");
  }
  
@@ -344,7 +344,7 @@
  
  int main(int argc, char *argv[])
  {
-@@ -1311,6 +1320,8 @@ int main(int argc, char *argv[])
+@@ -1323,6 +1332,8 @@ int main(int argc, char *argv[])
  	if (os_program_init())
  		return -1;
  
diff --git a/package/network/services/hostapd/patches/300-noscan.patch b/package/network/services/hostapd/patches/300-noscan.patch
index 01a33d0d035b18..91e1aaad8333a5 100644
--- a/package/network/services/hostapd/patches/300-noscan.patch
+++ b/package/network/services/hostapd/patches/300-noscan.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -3474,6 +3474,10 @@ static int hostapd_config_fill(struct ho
+@@ -3446,6 +3446,10 @@ static int hostapd_config_fill(struct ho
  		if (bss->ocv && !bss->ieee80211w)
  			bss->ieee80211w = 1;
  #endif /* CONFIG_OCV */
@@ -13,7 +13,7 @@
  	} else if (os_strcmp(buf, "ht_capab") == 0) {
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
-@@ -1014,6 +1014,8 @@ struct hostapd_config {
+@@ -1061,6 +1061,8 @@ struct hostapd_config {
  
  	int ht_op_mode_fixed;
  	u16 ht_capab;
diff --git a/package/network/services/hostapd/patches/301-mesh-noscan.patch b/package/network/services/hostapd/patches/301-mesh-noscan.patch
index e682efb543ee30..8a1bdaa1854a72 100644
--- a/package/network/services/hostapd/patches/301-mesh-noscan.patch
+++ b/package/network/services/hostapd/patches/301-mesh-noscan.patch
@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/config.c
 +++ b/wpa_supplicant/config.c
-@@ -2532,6 +2532,7 @@ static const struct parse_data ssid_fiel
+@@ -2599,6 +2599,7 @@ static const struct parse_data ssid_fiel
  #else /* CONFIG_MESH */
  	{ INT_RANGE(mode, 0, 4) },
  #endif /* CONFIG_MESH */
@@ -10,7 +10,7 @@
  	{ STR(id_str) },
 --- a/wpa_supplicant/config_file.c
 +++ b/wpa_supplicant/config_file.c
-@@ -769,6 +769,7 @@ static void wpa_config_write_network(FIL
+@@ -775,6 +775,7 @@ static void wpa_config_write_network(FIL
  #endif /* IEEE8021X_EAPOL */
  	INT(mode);
  	INT(no_auto_peer);
@@ -20,7 +20,7 @@
  	INT(enable_edmg);
 --- a/wpa_supplicant/mesh.c
 +++ b/wpa_supplicant/mesh.c
-@@ -505,6 +505,8 @@ static int wpa_supplicant_mesh_init(stru
+@@ -506,6 +506,8 @@ static int wpa_supplicant_mesh_init(stru
  			   frequency);
  		goto out_free;
  	}
@@ -31,36 +31,36 @@
  		/*
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -2436,7 +2436,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2693,7 +2693,7 @@ static bool ibss_mesh_can_use_vht(struct
+ 				  const struct wpa_ssid *ssid,
+ 				  struct hostapd_hw_modes *mode)
+ {
+-	if (mode->mode != HOSTAPD_MODE_IEEE80211A)
++	if (mode->mode != HOSTAPD_MODE_IEEE80211A && !(ssid->noscan))
+ 		return false;
+ 
+ 	if (!drv_supports_vht(wpa_s, ssid))
+@@ -2766,7 +2766,7 @@ static void ibss_mesh_select_40mhz(struc
+ 	int i, res;
+ 	unsigned int j;
+ 	static const int ht40plus[] = {
+-		36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157, 165, 173,
++		1, 2, 3, 4, 5, 6, 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157, 165, 173,
+ 		184, 192
+ 	};
+ 	int ht40 = -1;
+@@ -3016,7 +3016,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
  	int ieee80211_mode = wpas_mode_to_ieee80211_mode(ssid->mode);
  	enum hostapd_hw_mode hw_mode;
  	struct hostapd_hw_modes *mode = NULL;
--	int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
-+	int ht40plus[] = { 1, 2, 3, 4, 5, 6, 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
- 			   184, 192 };
- 	int bw80[] = { 5180, 5260, 5500, 5580, 5660, 5745, 5955,
- 		       6035, 6115, 6195, 6275, 6355, 6435, 6515,
-@@ -2444,7 +2444,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
- 	int bw160[] = { 5955, 6115, 6275, 6435, 6595, 6755, 6915 };
- 	struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
+-	int i, obss_scan = 1;
++	int i, obss_scan = !(ssid->noscan);
  	u8 channel;
--	int i, chan_idx, ht40 = -1, res, obss_scan = 1;
-+	int i, chan_idx, ht40 = -1, res, obss_scan = !(ssid->noscan);
- 	unsigned int j, k;
- 	struct hostapd_freq_params vht_freq;
- 	int chwidth, seg0, seg1;
-@@ -2535,7 +2535,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
- #endif /* CONFIG_HE_OVERRIDES */
- 
- 	/* Setup higher BW only for 5 GHz */
--	if (mode->mode != HOSTAPD_MODE_IEEE80211A)
-+	if (mode->mode != HOSTAPD_MODE_IEEE80211A && !(ssid->noscan))
- 		return;
- 
- 	for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
+ 	bool is_6ghz;
+ 	bool dfs_enabled = wpa_s->conf->country[0] && (wpa_s->drv_flags & WPA_DRIVER_FLAGS_RADAR);
 --- a/wpa_supplicant/config_ssid.h
 +++ b/wpa_supplicant/config_ssid.h
-@@ -974,6 +974,8 @@ struct wpa_ssid {
+@@ -1035,6 +1035,8 @@ struct wpa_ssid {
  	 */
  	int no_auto_peer;
  
diff --git a/package/network/services/hostapd/patches/310-rescan_immediately.patch b/package/network/services/hostapd/patches/310-rescan_immediately.patch
index b0c1cb83544b9b..033f763094d5c2 100644
--- a/package/network/services/hostapd/patches/310-rescan_immediately.patch
+++ b/package/network/services/hostapd/patches/310-rescan_immediately.patch
@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -5377,7 +5377,7 @@ wpa_supplicant_alloc(struct wpa_supplica
+@@ -5713,7 +5713,7 @@ wpa_supplicant_alloc(struct wpa_supplica
  	if (wpa_s == NULL)
  		return NULL;
  	wpa_s->scan_req = INITIAL_SCAN_REQ;
diff --git a/package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch b/package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch
index 37033c3035db8e..93a03a6db670b4 100644
--- a/package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch
+++ b/package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch
@@ -1,8 +1,8 @@
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -4986,7 +4986,7 @@ static int nl80211_set_channel(struct i8
- 		   freq->freq, freq->ht_enabled, freq->vht_enabled, freq->he_enabled,
- 		   freq->bandwidth, freq->center_freq1, freq->center_freq2);
+@@ -5224,7 +5224,7 @@ static int nl80211_set_channel(struct i8
+ 		   freq->he_enabled, freq->eht_enabled, freq->bandwidth,
+ 		   freq->center_freq1, freq->center_freq2);
  
 -	msg = nl80211_drv_msg(drv, 0, set_chan ? NL80211_CMD_SET_CHANNEL :
 +	msg = nl80211_bss_msg(bss, 0, set_chan ? NL80211_CMD_SET_CHANNEL :
diff --git a/package/network/services/hostapd/patches/340-reload_freq_change.patch b/package/network/services/hostapd/patches/340-reload_freq_change.patch
index 89259f2f44ca0d..9a468079d1a54a 100644
--- a/package/network/services/hostapd/patches/340-reload_freq_change.patch
+++ b/package/network/services/hostapd/patches/340-reload_freq_change.patch
@@ -1,6 +1,6 @@
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -115,6 +115,29 @@ static void hostapd_reload_bss(struct ho
+@@ -142,6 +142,29 @@ static void hostapd_reload_bss(struct ho
  #endif /* CONFIG_NO_RADIUS */
  
  	ssid = &hapd->conf->ssid;
@@ -30,7 +30,7 @@
  	if (!ssid->wpa_psk_set && ssid->wpa_psk && !ssid->wpa_psk->next &&
  	    ssid->wpa_passphrase_set && ssid->wpa_passphrase) {
  		/*
-@@ -216,6 +238,7 @@ int hostapd_reload_config(struct hostapd
+@@ -250,6 +273,7 @@ int hostapd_reload_config(struct hostapd
  	struct hostapd_data *hapd = iface->bss[0];
  	struct hostapd_config *newconf, *oldconf;
  	size_t j;
@@ -38,7 +38,7 @@
  
  	if (iface->config_fname == NULL) {
  		/* Only in-memory config in use - assume it has been updated */
-@@ -266,24 +289,20 @@ int hostapd_reload_config(struct hostapd
+@@ -300,6 +324,17 @@ int hostapd_reload_config(struct hostapd
  	}
  	iface->conf = newconf;
  
@@ -55,6 +55,10 @@
 +
  	for (j = 0; j < iface->num_bss; j++) {
  		hapd = iface->bss[j];
+ 		if (!hapd->conf->config_id || !newconf->bss[j]->config_id ||
+@@ -307,21 +342,6 @@ int hostapd_reload_config(struct hostapd
+ 			      newconf->bss[j]->config_id) != 0)
+ 			hostapd_clear_old_bss(hapd);
  		hapd->iconf = newconf;
 -		hapd->iconf->channel = oldconf->channel;
 -		hapd->iconf->acs = oldconf->acs;
diff --git a/package/network/services/hostapd/patches/341-mesh-ctrl-iface-channel-switch.patch b/package/network/services/hostapd/patches/341-mesh-ctrl-iface-channel-switch.patch
index b13dcb06737db6..8784452876b22e 100644
--- a/package/network/services/hostapd/patches/341-mesh-ctrl-iface-channel-switch.patch
+++ b/package/network/services/hostapd/patches/341-mesh-ctrl-iface-channel-switch.patch
@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/ap.c
 +++ b/wpa_supplicant/ap.c
-@@ -1611,15 +1611,35 @@ int ap_switch_channel(struct wpa_supplic
+@@ -1825,15 +1825,35 @@ int ap_switch_channel(struct wpa_supplic
  
  
  #ifdef CONFIG_CTRL_IFACE
diff --git a/package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch b/package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch
index 8a2beb312ffb71..a943395b5640ab 100644
--- a/package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch
+++ b/package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch
@@ -1,34 +1,35 @@
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -2932,11 +2932,11 @@ static int wpa_driver_nl80211_del_beacon
- 	struct wpa_driver_nl80211_data *drv = bss->drv;
+@@ -3006,12 +3006,12 @@ static int wpa_driver_nl80211_del_beacon
+ 		return 0;
  
  	wpa_printf(MSG_DEBUG, "nl80211: Remove beacon (ifindex=%d)",
 -		   drv->ifindex);
 +		   bss->ifindex);
- 	bss->beacon_set = 0;
- 	bss->freq = 0;
+ 	link->beacon_set = 0;
+ 	link->freq = 0;
+ 
  	nl80211_put_wiphy_data_ap(bss);
 -	msg = nl80211_drv_msg(drv, 0, NL80211_CMD_DEL_BEACON);
-+	msg = nl80211_bss_msg(drv, 0, NL80211_CMD_DEL_BEACON);
- 	return send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
- }
++	msg = nl80211_bss_msg(bss, 0, NL80211_CMD_DEL_BEACON);
+ 	if (!msg)
+ 		return -ENOBUFS;
  
-@@ -5650,7 +5650,7 @@ static void nl80211_teardown_ap(struct i
+@@ -5907,7 +5907,7 @@ static void nl80211_teardown_ap(struct i
  		nl80211_mgmt_unsubscribe(bss, "AP teardown");
  
  	nl80211_put_wiphy_data_ap(bss);
--	bss->beacon_set = 0;
-+	wpa_driver_nl80211_del_beacon(bss);
+-	bss->flink->beacon_set = 0;
++	wpa_driver_nl80211_del_beacon_all(bss);
  }
  
  
-@@ -8104,8 +8104,6 @@ static int wpa_driver_nl80211_if_remove(
+@@ -8642,8 +8642,6 @@ static int wpa_driver_nl80211_if_remove(
  	} else {
  		wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context");
  		nl80211_teardown_ap(bss);
 -		if (!bss->added_if && !drv->first_bss->next)
--			wpa_driver_nl80211_del_beacon(bss);
+-			wpa_driver_nl80211_del_beacon_all(bss);
  		nl80211_destroy_bss(bss);
  		if (!bss->added_if)
  			i802_set_iface_flags(bss, 0);
diff --git a/package/network/services/hostapd/patches/360-ctrl_iface_reload.patch b/package/network/services/hostapd/patches/360-ctrl_iface_reload.patch
index 7f3aa91889494a..e9f46ce9d36f32 100644
--- a/package/network/services/hostapd/patches/360-ctrl_iface_reload.patch
+++ b/package/network/services/hostapd/patches/360-ctrl_iface_reload.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -67,6 +67,7 @@
+@@ -68,6 +68,7 @@
  #include "fst/fst_ctrl_iface.h"
  #include "config_file.h"
  #include "ctrl_iface.h"
@@ -8,7 +8,7 @@
  
  
  #define HOSTAPD_CLI_DUP_VALUE_MAX_LEN 256
-@@ -82,6 +83,7 @@ static void hostapd_ctrl_iface_send(stru
+@@ -83,6 +84,7 @@ static void hostapd_ctrl_iface_send(stru
  				    enum wpa_msg_type type,
  				    const char *buf, size_t len);
  
@@ -16,7 +16,7 @@
  
  static int hostapd_ctrl_iface_attach(struct hostapd_data *hapd,
  				     struct sockaddr_storage *from,
-@@ -133,6 +135,61 @@ static int hostapd_ctrl_iface_new_sta(st
+@@ -134,6 +136,61 @@ static int hostapd_ctrl_iface_new_sta(st
  	return 0;
  }
  
@@ -78,7 +78,7 @@
  
  #ifdef NEED_AP_MLME
  static int hostapd_ctrl_iface_sa_query(struct hostapd_data *hapd,
-@@ -3771,6 +3828,8 @@ static int hostapd_ctrl_iface_receive_pr
+@@ -3529,6 +3586,8 @@ static int hostapd_ctrl_iface_receive_pr
  	} else if (os_strncmp(buf, "VENDOR ", 7) == 0) {
  		reply_len = hostapd_ctrl_iface_vendor(hapd, buf + 7, reply,
  						      reply_size);
@@ -89,7 +89,7 @@
  #ifdef RADIUS_SERVER
 --- a/src/ap/ctrl_iface_ap.c
 +++ b/src/ap/ctrl_iface_ap.c
-@@ -927,7 +927,13 @@ int hostapd_parse_csa_settings(const cha
+@@ -1008,7 +1008,13 @@ int hostapd_parse_csa_settings(const cha
  
  int hostapd_ctrl_iface_stop_ap(struct hostapd_data *hapd)
  {
diff --git a/package/network/services/hostapd/patches/370-ap_sta_support.patch b/package/network/services/hostapd/patches/370-ap_sta_support.patch
index c81c841a43aa99..24064839f13e31 100644
--- a/package/network/services/hostapd/patches/370-ap_sta_support.patch
+++ b/package/network/services/hostapd/patches/370-ap_sta_support.patch
@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -108,6 +108,8 @@ OBJS_c += ../src/utils/common.o
+@@ -126,6 +126,8 @@ OBJS_c += ../src/utils/common.o
  OBJS_c += ../src/common/cli.o
  OBJS += wmm_ac.o
  
@@ -19,7 +19,7 @@
  #include "drivers/driver.h"
  #include "eap_peer/eap.h"
  #include "wpa_supplicant_i.h"
-@@ -282,6 +283,10 @@ void calculate_update_time(const struct
+@@ -283,6 +284,10 @@ void calculate_update_time(const struct
  static void wpa_bss_copy_res(struct wpa_bss *dst, struct wpa_scan_res *src,
  			     struct os_reltime *fetch_time)
  {
@@ -30,7 +30,7 @@
  	dst->flags = src->flags;
  	os_memcpy(dst->bssid, src->bssid, ETH_ALEN);
  	dst->freq = src->freq;
-@@ -294,6 +299,15 @@ static void wpa_bss_copy_res(struct wpa_
+@@ -296,6 +301,15 @@ static void wpa_bss_copy_res(struct wpa_
  	dst->est_throughput = src->est_throughput;
  	dst->snr = src->snr;
  
@@ -61,7 +61,7 @@
  	/** Beacon interval in TUs (host byte order) */
 --- a/wpa_supplicant/main.c
 +++ b/wpa_supplicant/main.c
-@@ -34,7 +34,7 @@ static void usage(void)
+@@ -35,7 +35,7 @@ static void usage(void)
  	       "vW] [-P<pid file>] "
  	       "[-g<global ctrl>] \\\n"
  	       "        [-G<group>] \\\n"
@@ -70,7 +70,7 @@
  	       "[-p<driver_param>] \\\n"
  	       "        [-b<br_ifname>] [-e<entropy file>]"
  #ifdef CONFIG_DEBUG_FILE
-@@ -74,6 +74,7 @@ static void usage(void)
+@@ -75,6 +75,7 @@ static void usage(void)
  	       "  -g = global ctrl_interface\n"
  	       "  -G = global ctrl_interface group\n"
  	       "  -h = show this help text\n"
@@ -78,7 +78,7 @@
  	       "  -i = interface name\n"
  	       "  -I = additional configuration file\n"
  	       "  -K = include keys (passwords, etc.) in debug output\n"
-@@ -201,7 +202,7 @@ int main(int argc, char *argv[])
+@@ -202,7 +203,7 @@ int main(int argc, char *argv[])
  
  	for (;;) {
  		c = getopt(argc, argv,
@@ -87,7 +87,7 @@
  		if (c < 0)
  			break;
  		switch (c) {
-@@ -248,6 +249,9 @@ int main(int argc, char *argv[])
+@@ -249,6 +250,9 @@ int main(int argc, char *argv[])
  			usage();
  			exitcode = 0;
  			goto out;
@@ -99,7 +99,7 @@
  			break;
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -130,6 +130,54 @@ static void wpas_update_fils_connect_par
+@@ -131,6 +131,54 @@ static void wpas_update_fils_connect_par
  static void wpas_update_owe_connect_params(struct wpa_supplicant *wpa_s);
  #endif /* CONFIG_OWE */
  
@@ -154,7 +154,7 @@
  
  #ifdef CONFIG_WEP
  /* Configure default/group WEP keys for static WEP */
-@@ -1015,6 +1063,8 @@ void wpa_supplicant_set_state(struct wpa
+@@ -1026,6 +1074,8 @@ void wpa_supplicant_set_state(struct wpa
  
  		sme_sched_obss_scan(wpa_s, 1);
  
@@ -163,7 +163,7 @@
  #if defined(CONFIG_FILS) && defined(IEEE8021X_EAPOL)
  		if (!fils_hlp_sent && ssid && ssid->eap.erp)
  			update_fils_connect_params = true;
-@@ -1025,6 +1075,8 @@ void wpa_supplicant_set_state(struct wpa
+@@ -1036,6 +1086,8 @@ void wpa_supplicant_set_state(struct wpa
  #endif /* CONFIG_OWE */
  	} else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
  		   state == WPA_ASSOCIATED) {
@@ -172,7 +172,7 @@
  		wpa_s->new_connection = 1;
  		wpa_drv_set_operstate(wpa_s, 0);
  #ifndef IEEE8021X_EAPOL
-@@ -2308,6 +2360,8 @@ void wpa_supplicant_associate(struct wpa
+@@ -2520,6 +2572,8 @@ void wpa_supplicant_associate(struct wpa
  			return;
  		}
  		wpa_s->current_bss = bss;
@@ -181,7 +181,7 @@
  #else /* CONFIG_MESH */
  		wpa_msg(wpa_s, MSG_ERROR,
  			"mesh mode support not included in the build");
-@@ -6650,6 +6704,16 @@ static int wpa_supplicant_init_iface(str
+@@ -7010,6 +7064,16 @@ static int wpa_supplicant_init_iface(str
  			   sizeof(wpa_s->bridge_ifname));
  	}
  
@@ -198,7 +198,7 @@
  	/* RSNA Supplicant Key Management - INITIALIZE */
  	eapol_sm_notify_portEnabled(wpa_s->eapol, false);
  	eapol_sm_notify_portValid(wpa_s->eapol, false);
-@@ -6987,6 +7051,11 @@ static void wpa_supplicant_deinit_iface(
+@@ -7352,6 +7416,11 @@ static void wpa_supplicant_deinit_iface(
  	if (terminate)
  		wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
  
@@ -212,7 +212,7 @@
  
 --- a/wpa_supplicant/wpa_supplicant_i.h
 +++ b/wpa_supplicant/wpa_supplicant_i.h
-@@ -104,6 +104,11 @@ struct wpa_interface {
+@@ -106,6 +106,11 @@ struct wpa_interface {
  	const char *ifname;
  
  	/**
@@ -224,7 +224,7 @@
  	 * bridge_ifname - Optional bridge interface name
  	 *
  	 * If the driver interface (ifname) is included in a Linux bridge
-@@ -718,6 +723,8 @@ struct wpa_supplicant {
+@@ -665,6 +670,8 @@ struct wpa_supplicant {
  #endif /* CONFIG_CTRL_IFACE_BINDER */
  	char bridge_ifname[16];
  
@@ -235,7 +235,7 @@
  
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -2889,6 +2889,12 @@ static int hostapd_ctrl_iface_chan_switc
+@@ -2716,6 +2716,12 @@ static int hostapd_ctrl_iface_chan_switc
  		return 0;
  	}
  
@@ -247,10 +247,10 @@
 +
  	for (i = 0; i < iface->num_bss; i++) {
  
- 		/* Save CHAN_SWITCH VHT and HE config */
+ 		/* Save CHAN_SWITCH VHT, HE, and EHT config */
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
-@@ -1791,11 +1791,6 @@ static int __ieee802_11_set_beacon(struc
+@@ -2052,11 +2052,6 @@ static int __ieee802_11_set_beacon(struc
  		return -1;
  	}
  
@@ -264,7 +264,7 @@
  	if (ieee802_11_build_ap_params(hapd, &params) < 0)
 --- a/wpa_supplicant/events.c
 +++ b/wpa_supplicant/events.c
-@@ -4891,6 +4891,60 @@ static void wpas_event_unprot_beacon(str
+@@ -5237,6 +5237,60 @@ static void wpas_event_unprot_beacon(str
  }
  
  
@@ -325,7 +325,7 @@
  void supplicant_event(void *ctx, enum wpa_event_type event,
  		      union wpa_event_data *data)
  {
-@@ -5206,8 +5260,10 @@ void supplicant_event(void *ctx, enum wp
+@@ -5586,8 +5640,10 @@ void supplicant_event(void *ctx, enum wp
  			channel_width_to_string(data->ch_switch.ch_width),
  			data->ch_switch.cf1,
  			data->ch_switch.cf2);
@@ -339,7 +339,7 @@
  		wpa_s->current_ssid->frequency = data->ch_switch.freq;
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -5837,6 +5837,7 @@ union wpa_event_data {
+@@ -6324,6 +6324,7 @@ union wpa_event_data {
  
  	/**
  	 * struct ch_switch
@@ -347,8 +347,8 @@
  	 * @freq: Frequency of new channel in MHz
  	 * @ht_enabled: Whether this is an HT channel
  	 * @ch_offset: Secondary channel offset
-@@ -5845,6 +5846,7 @@ union wpa_event_data {
- 	 * @cf2: Center frequency 2
+@@ -6334,6 +6335,7 @@ union wpa_event_data {
+ 	 * @punct_bitmap: Puncturing bitmap
  	 */
  	struct ch_switch {
 +		int count;
@@ -357,16 +357,15 @@
  		int ch_offset;
 --- a/src/drivers/driver_nl80211_event.c
 +++ b/src/drivers/driver_nl80211_event.c
-@@ -684,7 +684,7 @@ static void mlme_event_ch_switch(struct
- 				 struct nlattr *ifindex, struct nlattr *freq,
- 				 struct nlattr *type, struct nlattr *bw,
- 				 struct nlattr *cf1, struct nlattr *cf2,
--				 int finished)
-+				 struct nlattr *count, int finished)
+@@ -997,6 +997,7 @@ static void mlme_event_ch_switch(struct
+ 				 struct nlattr *bw, struct nlattr *cf1,
+ 				 struct nlattr *cf2,
+ 				 struct nlattr *punct_bitmap,
++				 struct nlattr *count,
+ 				 int finished)
  {
  	struct i802_bss *bss;
- 	union wpa_event_data data;
-@@ -745,6 +745,8 @@ static void mlme_event_ch_switch(struct
+@@ -1060,6 +1061,8 @@ static void mlme_event_ch_switch(struct
  		data.ch_switch.cf1 = nla_get_u32(cf1);
  	if (cf2)
  		data.ch_switch.cf2 = nla_get_u32(cf2);
@@ -374,19 +373,19 @@
 +		data.ch_switch.count = nla_get_u32(count);
  
  	if (finished)
- 		bss->freq = data.ch_switch.freq;
-@@ -3003,6 +3005,7 @@ static void do_process_drv_event(struct
- 				     tb[NL80211_ATTR_CHANNEL_WIDTH],
+ 		bss->flink->freq = data.ch_switch.freq;
+@@ -3604,6 +3607,7 @@ static void do_process_drv_event(struct
  				     tb[NL80211_ATTR_CENTER_FREQ1],
  				     tb[NL80211_ATTR_CENTER_FREQ2],
+ 				     tb[NL80211_ATTR_PUNCT_BITMAP],
 +				     tb[NL80211_ATTR_CH_SWITCH_COUNT],
  				     0);
  		break;
  	case NL80211_CMD_CH_SWITCH_NOTIFY:
-@@ -3013,6 +3016,7 @@ static void do_process_drv_event(struct
- 				     tb[NL80211_ATTR_CHANNEL_WIDTH],
+@@ -3616,6 +3620,7 @@ static void do_process_drv_event(struct
  				     tb[NL80211_ATTR_CENTER_FREQ1],
  				     tb[NL80211_ATTR_CENTER_FREQ2],
+ 				     tb[NL80211_ATTR_PUNCT_BITMAP],
 +				     NULL,
  				     1);
  		break;
diff --git a/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch b/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch
index 92b52a6d370c38..b886ab74927402 100644
--- a/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch
+++ b/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch
@@ -12,7 +12,7 @@
  else
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -3587,6 +3587,7 @@ static int hostapd_ctrl_iface_receive_pr
+@@ -3342,6 +3342,7 @@ static int hostapd_ctrl_iface_receive_pr
  						      reply_size);
  	} else if (os_strcmp(buf, "STATUS-DRIVER") == 0) {
  		reply_len = hostapd_drv_status(hapd, reply, reply_size);
@@ -20,7 +20,7 @@
  	} else if (os_strcmp(buf, "MIB") == 0) {
  		reply_len = ieee802_11_get_mib(hapd, reply, reply_size);
  		if (reply_len >= 0) {
-@@ -3628,6 +3629,7 @@ static int hostapd_ctrl_iface_receive_pr
+@@ -3383,6 +3384,7 @@ static int hostapd_ctrl_iface_receive_pr
  	} else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
  		reply_len = hostapd_ctrl_iface_sta_next(hapd, buf + 9, reply,
  							reply_size);
@@ -30,7 +30,7 @@
  			reply_len = -1;
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -958,6 +958,9 @@ ifdef CONFIG_FILS
+@@ -985,6 +985,9 @@ ifdef CONFIG_FILS
  OBJS += ../src/ap/fils_hlp.o
  endif
  ifdef CONFIG_CTRL_IFACE
@@ -42,7 +42,7 @@
  
 --- a/wpa_supplicant/ctrl_iface.c
 +++ b/wpa_supplicant/ctrl_iface.c
-@@ -2314,7 +2314,7 @@ static int wpa_supplicant_ctrl_iface_sta
+@@ -2326,7 +2326,7 @@ static int wpa_supplicant_ctrl_iface_sta
  			pos += ret;
  		}
  
@@ -51,7 +51,7 @@
  		if (wpa_s->ap_iface) {
  			pos += ap_ctrl_iface_wpa_get_status(wpa_s, pos,
  							    end - pos,
-@@ -11494,6 +11494,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -11964,6 +11964,7 @@ char * wpa_supplicant_ctrl_iface_process
  			reply_len = -1;
  	} else if (os_strncmp(buf, "NOTE ", 5) == 0) {
  		wpa_printf(MSG_INFO, "NOTE: %s", buf + 5);
@@ -59,7 +59,7 @@
  	} else if (os_strcmp(buf, "MIB") == 0) {
  		reply_len = wpa_sm_get_mib(wpa_s->wpa, reply, reply_size);
  		if (reply_len >= 0) {
-@@ -11506,6 +11507,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -11976,6 +11977,7 @@ char * wpa_supplicant_ctrl_iface_process
  				reply_size - reply_len);
  #endif /* CONFIG_MACSEC */
  		}
@@ -67,7 +67,7 @@
  	} else if (os_strncmp(buf, "STATUS", 6) == 0) {
  		reply_len = wpa_supplicant_ctrl_iface_status(
  			wpa_s, buf + 6, reply, reply_size);
-@@ -11994,6 +11996,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -12464,6 +12466,7 @@ char * wpa_supplicant_ctrl_iface_process
  		reply_len = wpa_supplicant_ctrl_iface_bss(
  			wpa_s, buf + 4, reply, reply_size);
  #ifdef CONFIG_AP
@@ -75,7 +75,7 @@
  	} else if (os_strcmp(buf, "STA-FIRST") == 0) {
  		reply_len = ap_ctrl_iface_sta_first(wpa_s, reply, reply_size);
  	} else if (os_strncmp(buf, "STA ", 4) == 0) {
-@@ -12002,12 +12005,15 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -12472,12 +12475,15 @@ char * wpa_supplicant_ctrl_iface_process
  	} else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
  		reply_len = ap_ctrl_iface_sta_next(wpa_s, buf + 9, reply,
  						   reply_size);
@@ -93,15 +93,61 @@
  			reply_len = -1;
 --- a/src/ap/ctrl_iface_ap.c
 +++ b/src/ap/ctrl_iface_ap.c
-@@ -25,6 +25,7 @@
- #include "mbo_ap.h"
+@@ -26,6 +26,26 @@
  #include "taxonomy.h"
- 
+ #include "wnm_ap.h"
+ 
++static const char * hw_mode_str(enum hostapd_hw_mode mode)
++{
++	switch (mode) {
++	case HOSTAPD_MODE_IEEE80211B:
++		return "b";
++	case HOSTAPD_MODE_IEEE80211G:
++		return "g";
++	case HOSTAPD_MODE_IEEE80211A:
++		return "a";
++	case HOSTAPD_MODE_IEEE80211AD:
++		return "ad";
++	case HOSTAPD_MODE_IEEE80211ANY:
++		return "any";
++	case NUM_HOSTAPD_MODES:
++		return "invalid";
++	}
++	return "unknown";
++}
++
 +#ifdef CONFIG_CTRL_IFACE_MIB
  
  static size_t hostapd_write_ht_mcs_bitmask(char *buf, size_t buflen,
  					   size_t curr_len, const u8 *mcs_set)
-@@ -459,6 +460,7 @@ int hostapd_ctrl_iface_sta_next(struct h
+@@ -212,26 +232,6 @@ static const char * timeout_next_str(int
+ }
+ 
+ 
+-static const char * hw_mode_str(enum hostapd_hw_mode mode)
+-{
+-	switch (mode) {
+-	case HOSTAPD_MODE_IEEE80211B:
+-		return "b";
+-	case HOSTAPD_MODE_IEEE80211G:
+-		return "g";
+-	case HOSTAPD_MODE_IEEE80211A:
+-		return "a";
+-	case HOSTAPD_MODE_IEEE80211AD:
+-		return "ad";
+-	case HOSTAPD_MODE_IEEE80211ANY:
+-		return "any";
+-	case NUM_HOSTAPD_MODES:
+-		return "invalid";
+-	}
+-	return "unknown";
+-}
+-
+-
+ static int hostapd_ctrl_iface_sta_mib(struct hostapd_data *hapd,
+ 				      struct sta_info *sta,
+ 				      char *buf, size_t buflen)
+@@ -493,6 +493,7 @@ int hostapd_ctrl_iface_sta_next(struct h
  	return hostapd_ctrl_iface_sta_mib(hapd, sta->next, buf, buflen);
  }
  
@@ -109,7 +155,7 @@
  
  #ifdef CONFIG_P2P_MANAGER
  static int p2p_manager_disconnect(struct hostapd_data *hapd, u16 stype,
-@@ -815,12 +817,12 @@ int hostapd_ctrl_iface_status(struct hos
+@@ -884,12 +885,12 @@ int hostapd_ctrl_iface_status(struct hos
  			return len;
  		len += ret;
  	}
@@ -126,7 +172,7 @@
  		if (os_snprintf_error(buflen - len, ret))
 --- a/src/ap/ieee802_1x.c
 +++ b/src/ap/ieee802_1x.c
-@@ -2712,6 +2712,7 @@ static const char * bool_txt(bool val)
+@@ -2753,6 +2753,7 @@ static const char * bool_txt(bool val)
  	return val ? "TRUE" : "FALSE";
  }
  
@@ -134,7 +180,7 @@
  
  int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
  {
-@@ -2898,6 +2899,7 @@ int ieee802_1x_get_mib_sta(struct hostap
+@@ -2939,6 +2940,7 @@ int ieee802_1x_get_mib_sta(struct hostap
  	return len;
  }
  
@@ -144,7 +190,7 @@
  static void ieee802_1x_wnm_notif_send(void *eloop_ctx, void *timeout_ctx)
 --- a/src/ap/wpa_auth.c
 +++ b/src/ap/wpa_auth.c
-@@ -4519,6 +4519,7 @@ static const char * wpa_bool_txt(int val
+@@ -4786,6 +4786,7 @@ static const char * wpa_bool_txt(int val
  	return val ? "TRUE" : "FALSE";
  }
  
@@ -152,7 +198,7 @@
  
  #define RSN_SUITE "%02x-%02x-%02x-%d"
  #define RSN_SUITE_ARG(s) \
-@@ -4669,7 +4670,7 @@ int wpa_get_mib_sta(struct wpa_state_mac
+@@ -4938,7 +4939,7 @@ int wpa_get_mib_sta(struct wpa_state_mac
  
  	return len;
  }
@@ -163,7 +209,7 @@
  {
 --- a/src/rsn_supp/wpa.c
 +++ b/src/rsn_supp/wpa.c
-@@ -2777,6 +2777,8 @@ static u32 wpa_key_mgmt_suite(struct wpa
+@@ -3834,6 +3834,8 @@ static u32 wpa_key_mgmt_suite(struct wpa
  }
  
  
@@ -172,7 +218,7 @@
  #define RSN_SUITE "%02x-%02x-%02x-%d"
  #define RSN_SUITE_ARG(s) \
  ((s) >> 24) & 0xff, ((s) >> 16) & 0xff, ((s) >> 8) & 0xff, (s) & 0xff
-@@ -2858,6 +2860,7 @@ int wpa_sm_get_mib(struct wpa_sm *sm, ch
+@@ -3915,6 +3917,7 @@ int wpa_sm_get_mib(struct wpa_sm *sm, ch
  
  	return (int) len;
  }
@@ -182,7 +228,7 @@
  
 --- a/wpa_supplicant/ap.c
 +++ b/wpa_supplicant/ap.c
-@@ -1462,7 +1462,7 @@ int wpas_ap_wps_nfc_report_handover(stru
+@@ -1499,7 +1499,7 @@ int wpas_ap_wps_nfc_report_handover(stru
  #endif /* CONFIG_WPS */
  
  
diff --git a/package/network/services/hostapd/patches/381-hostapd_cli_UNKNOWN-COMMAND.patch b/package/network/services/hostapd/patches/381-hostapd_cli_UNKNOWN-COMMAND.patch
index d2414faf01fd8a..e9083f6ecc6d58 100644
--- a/package/network/services/hostapd/patches/381-hostapd_cli_UNKNOWN-COMMAND.patch
+++ b/package/network/services/hostapd/patches/381-hostapd_cli_UNKNOWN-COMMAND.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
-@@ -744,7 +744,7 @@ static int wpa_ctrl_command_sta(struct w
+@@ -757,7 +757,7 @@ static int wpa_ctrl_command_sta(struct w
  	}
  
  	buf[len] = '\0';
diff --git a/package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch b/package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch
index 65a8b07e65a54c..40c39ff29c7e12 100644
--- a/package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch
+++ b/package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch
@@ -1,6 +1,6 @@
 --- a/src/common/wpa_common.c
 +++ b/src/common/wpa_common.c
-@@ -2444,6 +2444,31 @@ u32 wpa_akm_to_suite(int akm)
+@@ -2719,6 +2719,31 @@ u32 wpa_akm_to_suite(int akm)
  }
  
  
@@ -32,7 +32,7 @@
  int wpa_compare_rsn_ie(int ft_initial_assoc,
  		       const u8 *ie1, size_t ie1len,
  		       const u8 *ie2, size_t ie2len)
-@@ -2451,8 +2476,19 @@ int wpa_compare_rsn_ie(int ft_initial_as
+@@ -2726,8 +2751,19 @@ int wpa_compare_rsn_ie(int ft_initial_as
  	if (ie1 == NULL || ie2 == NULL)
  		return -1;
  
diff --git a/package/network/services/hostapd/patches/400-wps_single_auth_enc_type.patch b/package/network/services/hostapd/patches/400-wps_single_auth_enc_type.patch
index f708bf39ba5ae2..edcd98525743ed 100644
--- a/package/network/services/hostapd/patches/400-wps_single_auth_enc_type.patch
+++ b/package/network/services/hostapd/patches/400-wps_single_auth_enc_type.patch
@@ -11,7 +11,7 @@
  			bss->wpa_pairwise |= WPA_CIPHER_TKIP;
  #endif /* CONFIG_NO_TKIP */
  		bss->rsn_pairwise = bss->wpa_pairwise;
-@@ -1180,8 +1179,7 @@ int hostapd_init_wps(struct hostapd_data
+@@ -1181,8 +1180,7 @@ int hostapd_init_wps(struct hostapd_data
  					  WPA_CIPHER_GCMP_256)) {
  			wps->encr_types |= WPS_ENCR_AES;
  			wps->encr_types_rsn |= WPS_ENCR_AES;
diff --git a/package/network/services/hostapd/patches/410-limit_debug_messages.patch b/package/network/services/hostapd/patches/410-limit_debug_messages.patch
index d2713fc29b249e..48a5589200f198 100644
--- a/package/network/services/hostapd/patches/410-limit_debug_messages.patch
+++ b/package/network/services/hostapd/patches/410-limit_debug_messages.patch
@@ -60,7 +60,7 @@
  #ifdef CONFIG_DEBUG_FILE
  static char *last_path = NULL;
  #endif /* CONFIG_DEBUG_FILE */
-@@ -636,7 +610,7 @@ void wpa_msg_register_ifname_cb(wpa_msg_
+@@ -644,7 +618,7 @@ void wpa_msg_register_ifname_cb(wpa_msg_
  }
  
  
@@ -69,7 +69,7 @@
  {
  	va_list ap;
  	char *buf;
-@@ -674,7 +648,7 @@ void wpa_msg(void *ctx, int level, const
+@@ -682,7 +656,7 @@ void wpa_msg(void *ctx, int level, const
  }
  
  
@@ -80,9 +80,9 @@
  	char *buf;
 --- a/src/utils/wpa_debug.h
 +++ b/src/utils/wpa_debug.h
-@@ -50,6 +50,17 @@ int wpa_debug_reopen_file(void);
- void wpa_debug_close_file(void);
+@@ -51,6 +51,17 @@ void wpa_debug_close_file(void);
  void wpa_debug_setup_stdout(void);
+ void wpa_debug_stop_log(void);
  
 +/* internal */
 +void _wpa_hexdump(int level, const char *title, const u8 *buf,
@@ -98,7 +98,7 @@
  /**
   * wpa_debug_printf_timestamp - Print timestamp for debug output
   *
-@@ -70,9 +81,15 @@ void wpa_debug_print_timestamp(void);
+@@ -71,9 +82,15 @@ void wpa_debug_print_timestamp(void);
   *
   * Note: New line '\n' is added to the end of the text when printing to stdout.
   */
@@ -115,7 +115,7 @@
  /**
   * wpa_hexdump - conditional hex dump
   * @level: priority level (MSG_*) of the message
-@@ -84,7 +101,13 @@ PRINTF_FORMAT(2, 3);
+@@ -85,7 +102,13 @@ PRINTF_FORMAT(2, 3);
   * output may be directed to stdout, stderr, and/or syslog based on
   * configuration. The contents of buf is printed out has hex dump.
   */
@@ -130,7 +130,7 @@
  
  static inline void wpa_hexdump_buf(int level, const char *title,
  				   const struct wpabuf *buf)
-@@ -106,7 +129,13 @@ static inline void wpa_hexdump_buf(int l
+@@ -107,7 +130,13 @@ static inline void wpa_hexdump_buf(int l
   * like wpa_hexdump(), but by default, does not include secret keys (passwords,
   * etc.) in debug output.
   */
@@ -145,7 +145,7 @@
  
  static inline void wpa_hexdump_buf_key(int level, const char *title,
  				       const struct wpabuf *buf)
-@@ -128,8 +157,14 @@ static inline void wpa_hexdump_buf_key(i
+@@ -129,8 +158,14 @@ static inline void wpa_hexdump_buf_key(i
   * the hex numbers and ASCII characters (for printable range) are shown. 16
   * bytes per line will be shown.
   */
@@ -162,7 +162,7 @@
  
  /**
   * wpa_hexdump_ascii_key - conditional hex dump, hide keys
-@@ -145,8 +180,14 @@ void wpa_hexdump_ascii(int level, const
+@@ -146,8 +181,14 @@ void wpa_hexdump_ascii(int level, const
   * bytes per line will be shown. This works like wpa_hexdump_ascii(), but by
   * default, does not include secret keys (passwords, etc.) in debug output.
   */
@@ -179,7 +179,7 @@
  
  /*
   * wpa_dbg() behaves like wpa_msg(), but it can be removed from build to reduce
-@@ -183,7 +224,12 @@ void wpa_hexdump_ascii_key(int level, co
+@@ -184,7 +225,12 @@ void wpa_hexdump_ascii_key(int level, co
   *
   * Note: New line '\n' is added to the end of the text when printing to stdout.
   */
@@ -193,7 +193,7 @@
  
  /**
   * wpa_msg_ctrl - Conditional printf for ctrl_iface monitors
-@@ -197,8 +243,13 @@ void wpa_msg(void *ctx, int level, const
+@@ -198,8 +244,13 @@ void wpa_msg(void *ctx, int level, const
   * attached ctrl_iface monitors. In other words, it can be used for frequent
   * events that do not need to be sent to syslog.
   */
diff --git a/package/network/services/hostapd/patches/420-indicate-features.patch b/package/network/services/hostapd/patches/420-indicate-features.patch
index 12edb6baccbcc1..356d5f8c6814e6 100644
--- a/package/network/services/hostapd/patches/420-indicate-features.patch
+++ b/package/network/services/hostapd/patches/420-indicate-features.patch
@@ -9,7 +9,7 @@
  
  struct hapd_global {
  	void **drv_priv;
-@@ -692,7 +692,7 @@ int main(int argc, char *argv[])
+@@ -696,7 +696,7 @@ int main(int argc, char *argv[])
  	wpa_supplicant_event = hostapd_wpa_event;
  	wpa_supplicant_event_global = hostapd_wpa_event_global;
  	for (;;) {
@@ -18,7 +18,7 @@
  		if (c < 0)
  			break;
  		switch (c) {
-@@ -729,6 +729,8 @@ int main(int argc, char *argv[])
+@@ -733,6 +733,8 @@ int main(int argc, char *argv[])
  			break;
  #endif /* CONFIG_DEBUG_LINUX_TRACING */
  		case 'v':
diff --git a/package/network/services/hostapd/patches/430-hostapd_cli_ifdef.patch b/package/network/services/hostapd/patches/430-hostapd_cli_ifdef.patch
index dc1fa3d29d9905..a21f0bf7cee05f 100644
--- a/package/network/services/hostapd/patches/430-hostapd_cli_ifdef.patch
+++ b/package/network/services/hostapd/patches/430-hostapd_cli_ifdef.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
-@@ -388,7 +388,6 @@ static int hostapd_cli_cmd_disassociate(
+@@ -401,7 +401,6 @@ static int hostapd_cli_cmd_disassociate(
  }
  
  
@@ -8,7 +8,7 @@
  static int hostapd_cli_cmd_signature(struct wpa_ctrl *ctrl, int argc,
  				     char *argv[])
  {
-@@ -401,7 +400,6 @@ static int hostapd_cli_cmd_signature(str
+@@ -414,7 +413,6 @@ static int hostapd_cli_cmd_signature(str
  	os_snprintf(buf, sizeof(buf), "SIGNATURE %s", argv[0]);
  	return wpa_ctrl_command(ctrl, buf);
  }
@@ -16,7 +16,7 @@
  
  
  static int hostapd_cli_cmd_sa_query(struct wpa_ctrl *ctrl, int argc,
-@@ -418,7 +416,6 @@ static int hostapd_cli_cmd_sa_query(stru
+@@ -431,7 +429,6 @@ static int hostapd_cli_cmd_sa_query(stru
  }
  
  
@@ -24,7 +24,7 @@
  static int hostapd_cli_cmd_wps_pin(struct wpa_ctrl *ctrl, int argc,
  				   char *argv[])
  {
-@@ -644,7 +641,6 @@ static int hostapd_cli_cmd_wps_config(st
+@@ -657,7 +654,6 @@ static int hostapd_cli_cmd_wps_config(st
  			 ssid_hex, argv[1]);
  	return wpa_ctrl_command(ctrl, buf);
  }
@@ -32,7 +32,7 @@
  
  
  static int hostapd_cli_cmd_disassoc_imminent(struct wpa_ctrl *ctrl, int argc,
-@@ -1579,13 +1575,10 @@ static const struct hostapd_cli_cmd host
+@@ -1610,13 +1606,10 @@ static const struct hostapd_cli_cmd host
  	{ "disassociate", hostapd_cli_cmd_disassociate,
  	  hostapd_complete_stations,
  	  "<addr> = disassociate a station" },
@@ -46,7 +46,7 @@
  	{ "wps_pin", hostapd_cli_cmd_wps_pin, NULL,
  	  "<uuid> <pin> [timeout] [addr] = add WPS Enrollee PIN" },
  	{ "wps_check_pin", hostapd_cli_cmd_wps_check_pin, NULL,
-@@ -1610,7 +1603,6 @@ static const struct hostapd_cli_cmd host
+@@ -1641,7 +1634,6 @@ static const struct hostapd_cli_cmd host
  	  "<SSID> <auth> <encr> <key> = configure AP" },
  	{ "wps_get_status", hostapd_cli_cmd_wps_get_status, NULL,
  	  "= show current WPS status" },
diff --git a/package/network/services/hostapd/patches/450-scan_wait.patch b/package/network/services/hostapd/patches/450-scan_wait.patch
index ac874ad66a4b77..e265d1ac7ca9f0 100644
--- a/package/network/services/hostapd/patches/450-scan_wait.patch
+++ b/package/network/services/hostapd/patches/450-scan_wait.patch
@@ -33,7 +33,7 @@
  	/* Initialize the driver interface */
  	if (!(b[0] | b[1] | b[2] | b[3] | b[4] | b[5]))
  		b = NULL;
-@@ -404,8 +416,6 @@ static void hostapd_global_deinit(const
+@@ -407,8 +419,6 @@ static void hostapd_global_deinit(const
  #endif /* CONFIG_NATIVE_WINDOWS */
  
  	eap_server_unregister_methods();
@@ -42,7 +42,7 @@
  }
  
  
-@@ -431,18 +441,6 @@ static int hostapd_global_run(struct hap
+@@ -434,18 +444,6 @@ static int hostapd_global_run(struct hap
  	}
  #endif /* EAP_SERVER_TNC */
  
@@ -61,7 +61,7 @@
  	eloop_run();
  
  	return 0;
-@@ -645,8 +643,7 @@ int main(int argc, char *argv[])
+@@ -649,8 +647,7 @@ int main(int argc, char *argv[])
  	struct hapd_interfaces interfaces;
  	int ret = 1;
  	size_t i, j;
diff --git a/package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch b/package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch
index 28f07c7dc21c76..80987774597e6f 100644
--- a/package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch
+++ b/package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch
@@ -22,7 +22,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  #include "common/defs.h"
  #include "common/ieee802_11_defs.h"
  #include "common/wpa_common.h"
-@@ -857,6 +858,9 @@ struct wpa_driver_associate_params {
+@@ -936,6 +937,9 @@ struct wpa_driver_associate_params {
  	 * responsible for selecting with which BSS to associate. */
  	const u8 *bssid;
  
@@ -42,7 +42,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  #include "config.h"
  
  
-@@ -2321,6 +2322,97 @@ static char * wpa_config_write_peerkey(c
+@@ -2389,6 +2390,97 @@ static char * wpa_config_write_mac_value
  #endif /* NO_CONFIG_WRITE */
  
  
@@ -140,7 +140,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  /* Helper macros for network block parser */
  
  #ifdef OFFSET
-@@ -2606,6 +2698,8 @@ static const struct parse_data ssid_fiel
+@@ -2673,6 +2765,8 @@ static const struct parse_data ssid_fiel
  	{ INT(ap_max_inactivity) },
  	{ INT(dtim_period) },
  	{ INT(beacon_int) },
@@ -162,7 +162,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  
  
  #define DEFAULT_EAP_WORKAROUND ((unsigned int) -1)
-@@ -846,6 +848,9 @@ struct wpa_ssid {
+@@ -879,6 +881,9 @@ struct wpa_ssid {
  	 */
  	void *parent_cred;
  
@@ -174,7 +174,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  	 * macsec_policy - Determines the policy for MACsec secure session
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -3865,6 +3865,12 @@ static void wpas_start_assoc_cb(struct w
+@@ -4177,6 +4177,12 @@ static void wpas_start_assoc_cb(struct w
  			params.beacon_int = ssid->beacon_int;
  		else
  			params.beacon_int = wpa_s->conf->beacon_int;
diff --git a/package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch b/package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch
index bd1d4d7565a964..e738ea131641a6 100644
--- a/package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch
+++ b/package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch
@@ -19,7 +19,7 @@ Tested-by: Simon Wunderlich <simon.wunderlich@openmesh.com>
 
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -1624,6 +1624,7 @@ struct wpa_driver_mesh_join_params {
+@@ -1768,6 +1768,7 @@ struct wpa_driver_mesh_join_params {
  #define WPA_DRIVER_MESH_FLAG_AMPE	0x00000008
  	unsigned int flags;
  	bool handle_dfs;
@@ -29,7 +29,7 @@ Tested-by: Simon Wunderlich <simon.wunderlich@openmesh.com>
  struct wpa_driver_set_key_params {
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -10496,6 +10496,18 @@ static int nl80211_put_mesh_id(struct nl
+@@ -11388,6 +11388,18 @@ static int nl80211_put_mesh_id(struct nl
  }
  
  
@@ -48,7 +48,7 @@ Tested-by: Simon Wunderlich <simon.wunderlich@openmesh.com>
  static int nl80211_put_mesh_config(struct nl_msg *msg,
  				   struct wpa_driver_mesh_bss_params *params)
  {
-@@ -10557,6 +10569,7 @@ static int nl80211_join_mesh(struct i802
+@@ -11449,6 +11461,7 @@ static int nl80211_join_mesh(struct i802
  	    nl80211_put_basic_rates(msg, params->basic_rates) ||
  	    nl80211_put_mesh_id(msg, params->meshid, params->meshid_len) ||
  	    nl80211_put_beacon_int(msg, params->beacon_int) ||
@@ -58,7 +58,7 @@ Tested-by: Simon Wunderlich <simon.wunderlich@openmesh.com>
  
 --- a/wpa_supplicant/mesh.c
 +++ b/wpa_supplicant/mesh.c
-@@ -631,6 +631,7 @@ int wpa_supplicant_join_mesh(struct wpa_
+@@ -632,6 +632,7 @@ int wpa_supplicant_join_mesh(struct wpa_
  
  	params->meshid = ssid->ssid;
  	params->meshid_len = ssid->ssid_len;
diff --git a/package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch b/package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch
index 4807727e0e59ee..73ccc65ad985ec 100644
--- a/package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch
+++ b/package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch
@@ -1,19 +1,13 @@
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -2512,11 +2512,13 @@ void ibss_mesh_setup_freq(struct wpa_sup
- 	for (j = 0; j < wpa_s->last_scan_res_used; j++) {
- 		struct wpa_bss *bss = wpa_s->last_scan_res[j];
+@@ -3077,6 +3077,10 @@ void ibss_mesh_setup_freq(struct wpa_sup
  
--		if (ssid->mode != WPAS_MODE_IBSS)
-+		/* Don't adjust control freq in case of fixed_freq */
-+		if (ssid->fixed_freq) {
-+			obss_scan = 0;
- 			break;
-+		}
+ 	freq->freq = ssid->frequency;
  
--		/* Don't adjust control freq in case of fixed_freq */
--		if (ssid->fixed_freq)
-+		if (ssid->mode != WPAS_MODE_IBSS)
- 			break;
++	if (ssid->fixed_freq) {
++		obss_scan = 0;
++	}
++
+ 	if (ssid->mode == WPAS_MODE_IBSS && !ssid->fixed_freq) {
+ 		struct wpa_bss *bss = ibss_find_existing_bss(wpa_s, ssid);
  
- 		if (!bss_is_ibss(bss))
diff --git a/package/network/services/hostapd/patches/465-hostapd-config-support-random-BSS-color.patch b/package/network/services/hostapd/patches/465-hostapd-config-support-random-BSS-color.patch
index c0b01196c4e546..ada77853feea33 100644
--- a/package/network/services/hostapd/patches/465-hostapd-config-support-random-BSS-color.patch
+++ b/package/network/services/hostapd/patches/465-hostapd-config-support-random-BSS-color.patch
@@ -13,7 +13,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -3485,6 +3485,8 @@ static int hostapd_config_fill(struct ho
+@@ -3498,6 +3498,8 @@ static int hostapd_config_fill(struct ho
  	} else if (os_strcmp(buf, "he_bss_color") == 0) {
  		conf->he_op.he_bss_color = atoi(pos) & 0x3f;
  		conf->he_op.he_bss_color_disabled = 0;
diff --git a/package/network/services/hostapd/patches/470-survey_data_fallback.patch b/package/network/services/hostapd/patches/470-survey_data_fallback.patch
index 359b5f3ef8f45c..79ab48c5c27486 100644
--- a/package/network/services/hostapd/patches/470-survey_data_fallback.patch
+++ b/package/network/services/hostapd/patches/470-survey_data_fallback.patch
@@ -1,24 +1,29 @@
 --- a/src/ap/acs.c
 +++ b/src/ap/acs.c
-@@ -420,20 +420,19 @@ static int acs_usable_bw160_chan(const s
+@@ -455,17 +455,17 @@ static int acs_get_bw_center_chan(int fr
  static int acs_survey_is_sufficient(struct freq_survey *survey)
  {
  	if (!(survey->filled & SURVEY_HAS_NF)) {
 +		survey->nf = -95;
- 		wpa_printf(MSG_INFO, "ACS: Survey is missing noise floor");
+ 		wpa_printf(MSG_INFO,
+ 			   "ACS: Survey for freq %d is missing noise floor",
+ 			   survey->freq);
 -		return 0;
  	}
  
  	if (!(survey->filled & SURVEY_HAS_CHAN_TIME)) {
 +		survey->channel_time = 0;
- 		wpa_printf(MSG_INFO, "ACS: Survey is missing channel time");
+ 		wpa_printf(MSG_INFO,
+ 			   "ACS: Survey for freq %d is missing channel time",
+ 			   survey->freq);
 -		return 0;
  	}
  
  	if (!(survey->filled & SURVEY_HAS_CHAN_TIME_BUSY) &&
- 	    !(survey->filled & SURVEY_HAS_CHAN_TIME_RX)) {
+@@ -473,7 +473,6 @@ static int acs_survey_is_sufficient(stru
  		wpa_printf(MSG_INFO,
- 			   "ACS: Survey is missing RX and busy time (at least one is required)");
+ 			   "ACS: Survey for freq %d is missing RX and busy time (at least one is required)",
+ 			   survey->freq);
 -		return 0;
  	}
  
diff --git a/package/network/services/hostapd/patches/500-lto-jobserver-support.patch b/package/network/services/hostapd/patches/500-lto-jobserver-support.patch
index c51db01fec3c2f..046da42ab8b912 100644
--- a/package/network/services/hostapd/patches/500-lto-jobserver-support.patch
+++ b/package/network/services/hostapd/patches/500-lto-jobserver-support.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/Makefile
 +++ b/hostapd/Makefile
-@@ -1297,7 +1297,7 @@ hostapd_multi.a: $(BCHECK) $(OBJS)
+@@ -1396,7 +1396,7 @@ hostapd_multi.a: $(BCHECK) $(OBJS)
  	@$(AR) cr $@ hostapd_multi.o $(OBJS)
  
  hostapd: $(OBJS)
@@ -9,7 +9,7 @@
  	@$(E) "  LD " $@
  
  ifdef CONFIG_WPA_TRACE
-@@ -1308,7 +1308,7 @@ _OBJS_VAR := OBJS_c
+@@ -1407,7 +1407,7 @@ _OBJS_VAR := OBJS_c
  include ../src/objs.mk
  
  hostapd_cli: $(OBJS_c)
@@ -20,7 +20,7 @@
  NOBJS = nt_password_hash.o ../src/crypto/ms_funcs.o $(SHA1OBJS)
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -1920,31 +1920,31 @@ wpa_supplicant_multi.a: .config $(BCHECK
+@@ -2039,31 +2039,31 @@ wpa_supplicant_multi.a: .config $(BCHECK
  	@$(AR) cr $@ wpa_supplicant_multi.o $(OBJS)
  
  wpa_supplicant: $(BCHECK) $(OBJS) $(EXTRA_progs)
diff --git a/package/network/services/hostapd/patches/590-rrm-wnm-statistics.patch b/package/network/services/hostapd/patches/590-rrm-wnm-statistics.patch
index ee3ab7938a279e..a6f43171ccddc3 100644
--- a/package/network/services/hostapd/patches/590-rrm-wnm-statistics.patch
+++ b/package/network/services/hostapd/patches/590-rrm-wnm-statistics.patch
@@ -1,6 +1,6 @@
 --- a/src/ap/hostapd.h
 +++ b/src/ap/hostapd.h
-@@ -150,6 +150,21 @@ struct hostapd_sae_commit_queue {
+@@ -162,6 +162,21 @@ struct hostapd_sae_commit_queue {
  };
  
  /**
@@ -22,7 +22,7 @@
   * struct hostapd_data - hostapd per-BSS data structure
   */
  struct hostapd_data {
-@@ -163,6 +178,9 @@ struct hostapd_data {
+@@ -175,6 +190,9 @@ struct hostapd_data {
  
  	u8 own_addr[ETH_ALEN];
  
@@ -42,9 +42,9 @@
  	wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request to "
  		   MACSTR " dialog_token=%u req_mode=0x%x disassoc_timer=%u "
  		   "validity_interval=%u",
-@@ -646,10 +647,12 @@ int ieee802_11_rx_wnm_action_ap(struct h
- 
- 	switch (action) {
+@@ -790,10 +791,12 @@ int ieee802_11_rx_wnm_action_ap(struct h
+ 					       plen);
+ 		return 0;
  	case WNM_BSS_TRANS_MGMT_QUERY:
 +		hapd->openwrt_stats.wnm.bss_transition_query_rx++;
  		ieee802_11_rx_bss_trans_mgmt_query(hapd, mgmt->sa, payload,
@@ -55,7 +55,7 @@
  		ieee802_11_rx_bss_trans_mgmt_resp(hapd, mgmt->sa, payload,
  						  plen);
  		return 0;
-@@ -696,6 +699,7 @@ int wnm_send_disassoc_imminent(struct ho
+@@ -840,6 +843,7 @@ int wnm_send_disassoc_imminent(struct ho
  
  	pos = mgmt->u.action.u.bss_tm_req.variable;
  
@@ -63,7 +63,7 @@
  	wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request frame to indicate imminent disassociation (disassoc_timer=%d) to "
  		   MACSTR, disassoc_timer, MAC2STR(sta->addr));
  	if (hostapd_drv_send_mlme(hapd, buf, pos - buf, 0, NULL, 0, 0) < 0) {
-@@ -777,6 +781,7 @@ int wnm_send_ess_disassoc_imminent(struc
+@@ -921,6 +925,7 @@ int wnm_send_ess_disassoc_imminent(struc
  		return -1;
  	}
  
@@ -71,7 +71,7 @@
  	if (disassoc_timer) {
  		/* send disassociation frame after time-out */
  		set_disassoc_timer(hapd, sta, disassoc_timer);
-@@ -857,6 +862,7 @@ int wnm_send_bss_tm_req(struct hostapd_d
+@@ -1001,6 +1006,7 @@ int wnm_send_bss_tm_req(struct hostapd_d
  	}
  	os_free(buf);
  
diff --git a/package/network/services/hostapd/patches/600-ubus_support.patch b/package/network/services/hostapd/patches/600-ubus_support.patch
index 4abb6887f68d59..aa68079fb26683 100644
--- a/package/network/services/hostapd/patches/600-ubus_support.patch
+++ b/package/network/services/hostapd/patches/600-ubus_support.patch
@@ -14,7 +14,7 @@
  CFLAGS += -O0 -fprofile-arcs -ftest-coverage
 --- a/src/ap/hostapd.h
 +++ b/src/ap/hostapd.h
-@@ -17,6 +17,7 @@
+@@ -18,6 +18,7 @@
  #include "utils/list.h"
  #include "ap_config.h"
  #include "drivers/driver.h"
@@ -22,7 +22,7 @@
  
  #define OCE_STA_CFON_ENABLED(hapd) \
  	((hapd->conf->oce & OCE_STA_CFON) && \
-@@ -80,7 +81,7 @@ struct hapd_interfaces {
+@@ -92,7 +93,7 @@ struct hapd_interfaces {
  #ifdef CONFIG_CTRL_IFACE_UDP
         unsigned char ctrl_iface_cookie[CTRL_IFACE_COOKIE_LEN];
  #endif /* CONFIG_CTRL_IFACE_UDP */
@@ -31,7 +31,7 @@
  };
  
  enum hostapd_chan_status {
-@@ -171,6 +172,7 @@ struct hostapd_data {
+@@ -183,6 +184,7 @@ struct hostapd_data {
  	struct hostapd_iface *iface;
  	struct hostapd_config *iconf;
  	struct hostapd_bss_config *conf;
@@ -39,7 +39,7 @@
  	int interface_added; /* virtual interface added for this BSS */
  	unsigned int started:1;
  	unsigned int disabled:1;
-@@ -630,6 +632,7 @@ hostapd_alloc_bss_data(struct hostapd_if
+@@ -682,6 +684,7 @@ hostapd_alloc_bss_data(struct hostapd_if
  		       struct hostapd_bss_config *bss);
  int hostapd_setup_interface(struct hostapd_iface *iface);
  int hostapd_setup_interface_complete(struct hostapd_iface *iface, int err);
@@ -49,7 +49,7 @@
  struct hostapd_iface * hostapd_alloc_iface(void);
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -396,6 +396,7 @@ void hostapd_free_hapd_data(struct hosta
+@@ -435,6 +435,7 @@ void hostapd_free_hapd_data(struct hosta
  	hapd->beacon_set_done = 0;
  
  	wpa_printf(MSG_DEBUG, "%s(%s)", __func__, hapd->conf->iface);
@@ -57,7 +57,7 @@
  	accounting_deinit(hapd);
  	hostapd_deinit_wpa(hapd);
  	vlan_deinit(hapd);
-@@ -1422,6 +1423,8 @@ static int hostapd_setup_bss(struct host
+@@ -1185,6 +1186,8 @@ static int hostapd_start_beacon(struct h
  	if (hapd->driver && hapd->driver->set_operstate)
  		hapd->driver->set_operstate(hapd->drv_priv, 1);
  
@@ -66,7 +66,7 @@
  	return 0;
  }
  
-@@ -2028,6 +2031,7 @@ static int hostapd_setup_interface_compl
+@@ -2126,6 +2129,7 @@ static int hostapd_setup_interface_compl
  	if (err)
  		goto fail;
  
@@ -74,7 +74,7 @@
  	wpa_printf(MSG_DEBUG, "Completing interface initialization");
  	if (iface->freq) {
  #ifdef NEED_AP_MLME
-@@ -2225,6 +2229,7 @@ dfs_offload:
+@@ -2342,6 +2346,7 @@ dfs_offload:
  
  fail:
  	wpa_printf(MSG_ERROR, "Interface initialization failed");
@@ -82,7 +82,7 @@
  	hostapd_set_state(iface, HAPD_IFACE_DISABLED);
  	wpa_msg(hapd->msg_ctx, MSG_INFO, AP_EVENT_DISABLED);
  #ifdef CONFIG_FST
-@@ -2700,6 +2705,7 @@ void hostapd_interface_deinit_free(struc
+@@ -2817,6 +2822,7 @@ void hostapd_interface_deinit_free(struc
  		   (unsigned int) iface->conf->num_bss);
  	driver = iface->bss[0]->driver;
  	drv_priv = iface->bss[0]->drv_priv;
@@ -92,7 +92,7 @@
  		   __func__, driver, drv_priv);
 --- a/src/ap/ieee802_11.c
 +++ b/src/ap/ieee802_11.c
-@@ -3553,13 +3553,18 @@ static void handle_auth(struct hostapd_d
+@@ -2740,13 +2740,18 @@ static void handle_auth(struct hostapd_d
  	u16 auth_alg, auth_transaction, status_code;
  	u16 resp = WLAN_STATUS_SUCCESS;
  	struct sta_info *sta = NULL;
@@ -112,7 +112,7 @@
  
  	if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
  		wpa_printf(MSG_INFO, "handle_auth - too short payload (len=%lu)",
-@@ -3727,6 +3732,13 @@ static void handle_auth(struct hostapd_d
+@@ -2914,6 +2919,13 @@ static void handle_auth(struct hostapd_d
  		resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
  		goto fail;
  	}
@@ -126,7 +126,7 @@
  	if (res == HOSTAPD_ACL_PENDING)
  		return;
  
-@@ -5447,7 +5459,7 @@ static void handle_assoc(struct hostapd_
+@@ -4695,7 +4707,7 @@ static void handle_assoc(struct hostapd_
  	int resp = WLAN_STATUS_SUCCESS;
  	u16 reply_res = WLAN_STATUS_UNSPECIFIED_FAILURE;
  	const u8 *pos;
@@ -135,7 +135,7 @@
  	struct sta_info *sta;
  	u8 *tmp = NULL;
  #ifdef CONFIG_FILS
-@@ -5660,6 +5672,11 @@ static void handle_assoc(struct hostapd_
+@@ -4908,6 +4920,11 @@ static void handle_assoc(struct hostapd_
  		left = res;
  	}
  #endif /* CONFIG_FILS */
@@ -147,7 +147,7 @@
  
  	/* followed by SSID and Supported rates; and HT capabilities if 802.11n
  	 * is used */
-@@ -5758,6 +5775,13 @@ static void handle_assoc(struct hostapd_
+@@ -5006,6 +5023,13 @@ static void handle_assoc(struct hostapd_
  	}
  #endif /* CONFIG_FILS */
  
@@ -161,7 +161,7 @@
   fail:
  
  	/*
-@@ -5851,6 +5875,7 @@ static void handle_disassoc(struct hosta
+@@ -5099,6 +5123,7 @@ static void handle_disassoc(struct hosta
  	wpa_printf(MSG_DEBUG, "disassocation: STA=" MACSTR " reason_code=%d",
  		   MAC2STR(mgmt->sa),
  		   le_to_host16(mgmt->u.disassoc.reason_code));
@@ -169,7 +169,7 @@
  
  	sta = ap_get_sta(hapd, mgmt->sa);
  	if (sta == NULL) {
-@@ -5920,6 +5945,8 @@ static void handle_deauth(struct hostapd
+@@ -5168,6 +5193,8 @@ static void handle_deauth(struct hostapd
  	/* Clear the PTKSA cache entries for PASN */
  	ptksa_cache_flush(hapd->ptksa, mgmt->sa, WPA_CIPHER_NONE);
  
@@ -180,7 +180,7 @@
  		wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " trying "
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
-@@ -852,6 +852,12 @@ void handle_probe_req(struct hostapd_dat
+@@ -1006,6 +1006,12 @@ void handle_probe_req(struct hostapd_dat
  	u16 csa_offs[2];
  	size_t csa_offs_len;
  	struct radius_sta rad_info;
@@ -193,7 +193,7 @@
  
  	if (hapd->iconf->rssi_ignore_probe_request && ssi_signal &&
  	    ssi_signal < hapd->iconf->rssi_ignore_probe_request)
-@@ -1038,6 +1044,12 @@ void handle_probe_req(struct hostapd_dat
+@@ -1192,6 +1198,12 @@ void handle_probe_req(struct hostapd_dat
  	}
  #endif /* CONFIG_P2P */
  
@@ -234,7 +234,7 @@
  		wpabuf_free(sta->p2p_ie);
 --- a/src/ap/sta_info.c
 +++ b/src/ap/sta_info.c
-@@ -458,6 +458,7 @@ void ap_handle_timer(void *eloop_ctx, vo
+@@ -460,6 +460,7 @@ void ap_handle_timer(void *eloop_ctx, vo
  		hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
  			       HOSTAPD_LEVEL_INFO, "deauthenticated due to "
  			       "local deauth request");
@@ -242,7 +242,7 @@
  		ap_free_sta(hapd, sta);
  		return;
  	}
-@@ -613,6 +614,7 @@ skip_poll:
+@@ -615,6 +616,7 @@ skip_poll:
  		mlme_deauthenticate_indication(
  			hapd, sta,
  			WLAN_REASON_PREV_AUTH_NOT_VALID);
@@ -250,8 +250,67 @@
  		ap_free_sta(hapd, sta);
  		break;
  	}
-@@ -1329,6 +1331,7 @@ void ap_sta_set_authorized(struct hostap
- 					  buf, ip_addr, keyid_buf);
+@@ -1305,15 +1307,28 @@ void ap_sta_set_authorized(struct hostap
+ 					sta->addr, authorized, dev_addr);
+ 
+ 	if (authorized) {
++		static const char * const auth_algs[] = {
++			[WLAN_AUTH_OPEN] = "open",
++			[WLAN_AUTH_SHARED_KEY] = "shared",
++			[WLAN_AUTH_FT] = "ft",
++			[WLAN_AUTH_SAE] = "sae",
++			[WLAN_AUTH_FILS_SK] = "fils-sk",
++			[WLAN_AUTH_FILS_SK_PFS] = "fils-sk-pfs",
++			[WLAN_AUTH_FILS_PK] = "fils-pk",
++			[WLAN_AUTH_PASN] = "pasn",
++		};
++		const char *auth_alg = NULL;
+ 		const u8 *dpp_pkhash;
+ 		const char *keyid;
+ 		char dpp_pkhash_buf[100];
+ 		char keyid_buf[100];
+ 		char ip_addr[100];
++		char alg_buf[100];
+ 
+ 		dpp_pkhash_buf[0] = '\0';
+ 		keyid_buf[0] = '\0';
+ 		ip_addr[0] = '\0';
++		alg_buf[0] = '\0';
+ #ifdef CONFIG_P2P
+ 		if (wpa_auth_get_ip_addr(sta->wpa_sm, ip_addr_buf) == 0) {
+ 			os_snprintf(ip_addr, sizeof(ip_addr),
+@@ -1323,6 +1338,13 @@ void ap_sta_set_authorized(struct hostap
+ 		}
+ #endif /* CONFIG_P2P */
+ 
++		if (sta->auth_alg < ARRAY_SIZE(auth_algs))
++			auth_alg = auth_algs[sta->auth_alg];
++
++		if (auth_alg)
++			os_snprintf(alg_buf, sizeof(alg_buf),
++				" auth_alg=%s", auth_alg);
++
+ 		keyid = ap_sta_wpa_get_keyid(hapd, sta);
+ 		if (keyid) {
+ 			os_snprintf(keyid_buf, sizeof(keyid_buf),
+@@ -1341,17 +1363,19 @@ void ap_sta_set_authorized(struct hostap
+ 					 dpp_pkhash, SHA256_MAC_LEN);
+ 		}
+ 
+-		wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_CONNECTED "%s%s%s%s",
+-			buf, ip_addr, keyid_buf, dpp_pkhash_buf);
++		hostapd_ubus_notify_authorized(hapd, sta, auth_alg);
++		wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_CONNECTED "%s%s%s%s%s",
++			buf, ip_addr, keyid_buf, dpp_pkhash_buf, alg_buf);
+ 
+ 		if (hapd->msg_ctx_parent &&
+ 		    hapd->msg_ctx_parent != hapd->msg_ctx)
+ 			wpa_msg_no_global(hapd->msg_ctx_parent, MSG_INFO,
+-					  AP_STA_CONNECTED "%s%s%s%s",
++					  AP_STA_CONNECTED "%s%s%s%s%s",
+ 					  buf, ip_addr, keyid_buf,
+-					  dpp_pkhash_buf);
++					  dpp_pkhash_buf, alg_buf);
  	} else {
  		wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_DISCONNECTED "%s", buf);
 +		hostapd_ubus_notify(hapd, "disassoc", sta->addr);
@@ -260,7 +319,7 @@
  		    hapd->msg_ctx_parent != hapd->msg_ctx)
 --- a/src/ap/wpa_auth_glue.c
 +++ b/src/ap/wpa_auth_glue.c
-@@ -265,6 +265,7 @@ static void hostapd_wpa_auth_psk_failure
+@@ -269,6 +269,7 @@ static void hostapd_wpa_auth_psk_failure
  	struct hostapd_data *hapd = ctx;
  	wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_POSSIBLE_PSK_MISMATCH MACSTR,
  		MAC2STR(addr));
@@ -270,7 +329,7 @@
  
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -176,6 +176,12 @@ ifdef CONFIG_EAPOL_TEST
+@@ -194,6 +194,12 @@ ifdef CONFIG_EAPOL_TEST
  CFLAGS += -Werror -DEAPOL_TEST
  endif
  
@@ -283,7 +342,7 @@
  ifdef CONFIG_CODE_COVERAGE
  CFLAGS += -O0 -fprofile-arcs -ftest-coverage
  LIBS += -lgcov
-@@ -962,6 +968,9 @@ ifdef CONFIG_CTRL_IFACE_MIB
+@@ -989,6 +995,9 @@ ifdef CONFIG_CTRL_IFACE_MIB
  CFLAGS += -DCONFIG_CTRL_IFACE_MIB
  endif
  OBJS += ../src/ap/ctrl_iface_ap.o
@@ -295,7 +354,7 @@
  CFLAGS += -DEAP_SERVER -DEAP_SERVER_IDENTITY
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -7241,6 +7241,8 @@ struct wpa_supplicant * wpa_supplicant_a
+@@ -7608,6 +7608,8 @@ struct wpa_supplicant * wpa_supplicant_a
  	}
  #endif /* CONFIG_P2P */
  
@@ -304,7 +363,7 @@
  	return wpa_s;
  }
  
-@@ -7267,6 +7269,8 @@ int wpa_supplicant_remove_iface(struct w
+@@ -7634,6 +7636,8 @@ int wpa_supplicant_remove_iface(struct w
  	struct wpa_supplicant *parent = wpa_s->parent;
  #endif /* CONFIG_MESH */
  
@@ -313,7 +372,7 @@
  	/* Remove interface from the global list of interfaces */
  	prev = global->ifaces;
  	if (prev == wpa_s) {
-@@ -7570,8 +7574,12 @@ int wpa_supplicant_run(struct wpa_global
+@@ -7980,8 +7984,12 @@ int wpa_supplicant_run(struct wpa_global
  	eloop_register_signal_terminate(wpa_supplicant_terminate, global);
  	eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
  
@@ -328,15 +387,15 @@
  
 --- a/wpa_supplicant/wpa_supplicant_i.h
 +++ b/wpa_supplicant/wpa_supplicant_i.h
-@@ -19,6 +19,7 @@
- #include "wps/wps_defs.h"
+@@ -21,6 +21,7 @@
  #include "config_ssid.h"
  #include "wmm_ac.h"
+ #include "pasn/pasn_common.h"
 +#include "ubus.h"
  
  extern const char *const wpa_supplicant_version;
  extern const char *const wpa_supplicant_license;
-@@ -322,6 +323,8 @@ struct wpa_global {
+@@ -324,6 +325,8 @@ struct wpa_global {
  #endif /* CONFIG_WIFI_DISPLAY */
  
  	struct psk_list_entry *add_psk; /* From group formation */
@@ -345,7 +404,7 @@
  };
  
  
-@@ -708,6 +711,7 @@ struct wpa_supplicant {
+@@ -655,6 +658,7 @@ struct wpa_supplicant {
  	unsigned char own_addr[ETH_ALEN];
  	unsigned char perm_addr[ETH_ALEN];
  	char ifname[100];
@@ -363,7 +422,7 @@
  
  
  #ifndef WPS_PIN_SCAN_IGNORE_SEL_REG
-@@ -393,6 +394,8 @@ static int wpa_supplicant_wps_cred(void
+@@ -402,6 +403,8 @@ static int wpa_supplicant_wps_cred(void
  	wpa_hexdump_key(MSG_DEBUG, "WPS: Received Credential attribute",
  			cred->cred_attr, cred->cred_attr_len);
  
@@ -374,7 +433,7 @@
  
 --- a/hostapd/main.c
 +++ b/hostapd/main.c
-@@ -895,6 +895,7 @@ int main(int argc, char *argv[])
+@@ -901,6 +901,7 @@ int main(int argc, char *argv[])
  	}
  
  	hostapd_global_ctrl_iface_init(&interfaces);
@@ -382,7 +441,7 @@
  
  	if (hostapd_global_run(&interfaces, daemonize, pid_file)) {
  		wpa_printf(MSG_ERROR, "Failed to start eloop");
-@@ -904,6 +905,7 @@ int main(int argc, char *argv[])
+@@ -910,6 +911,7 @@ int main(int argc, char *argv[])
  	ret = 0;
  
   out:
@@ -392,7 +451,7 @@
  	for (i = 0; i < interfaces.count; i++) {
 --- a/wpa_supplicant/main.c
 +++ b/wpa_supplicant/main.c
-@@ -203,7 +203,7 @@ int main(int argc, char *argv[])
+@@ -204,7 +204,7 @@ int main(int argc, char *argv[])
  
  	for (;;) {
  		c = getopt(argc, argv,
@@ -401,7 +460,7 @@
  		if (c < 0)
  			break;
  		switch (c) {
-@@ -271,6 +271,9 @@ int main(int argc, char *argv[])
+@@ -272,6 +272,9 @@ int main(int argc, char *argv[])
  			params.conf_p2p_dev = optarg;
  			break;
  #endif /* CONFIG_P2P */
@@ -473,7 +532,7 @@
  
 --- a/src/ap/dfs.c
 +++ b/src/ap/dfs.c
-@@ -1196,6 +1196,8 @@ int hostapd_dfs_radar_detected(struct ho
+@@ -1211,6 +1211,8 @@ int hostapd_dfs_pre_cac_expired(struct h
  		"freq=%d ht_enabled=%d chan_offset=%d chan_width=%d cf1=%d cf2=%d",
  		freq, ht_enabled, chan_offset, chan_width, cf1, cf2);
  
@@ -515,7 +574,7 @@
  	}
 --- a/src/ap/sta_info.h
 +++ b/src/ap/sta_info.h
-@@ -324,6 +324,7 @@ struct sta_info {
+@@ -293,6 +293,7 @@ struct sta_info {
  #endif /* CONFIG_TESTING_OPTIONS */
  #ifdef CONFIG_AIRTIME_POLICY
  	unsigned int airtime_weight;
@@ -525,9 +584,9 @@
  
 --- a/src/ap/wnm_ap.c
 +++ b/src/ap/wnm_ap.c
-@@ -442,7 +442,8 @@ static void ieee802_11_rx_bss_trans_mgmt
- 	wpa_hexdump(MSG_DEBUG, "WNM: BSS Transition Candidate List Entries",
- 		    pos, end - pos);
+@@ -455,7 +455,8 @@ static void ieee802_11_rx_bss_trans_mgmt
+ 		MAC2STR(addr), reason, hex ? " neighbor=" : "", hex);
+ 	os_free(hex);
  
 -	ieee802_11_send_bss_trans_mgmt_request(hapd, addr, dialog_token);
 +	if (!hostapd_ubus_notify_bss_transition_query(hapd, addr, dialog_token, reason, pos, end - pos))
@@ -535,7 +594,7 @@
  }
  
  
-@@ -464,7 +465,7 @@ static void ieee802_11_rx_bss_trans_mgmt
+@@ -477,7 +478,7 @@ static void ieee802_11_rx_bss_trans_mgmt
  					      size_t len)
  {
  	u8 dialog_token, status_code, bss_termination_delay;
@@ -544,7 +603,7 @@
  	int enabled = hapd->conf->bss_transition;
  	struct sta_info *sta;
  
-@@ -511,6 +512,7 @@ static void ieee802_11_rx_bss_trans_mgmt
+@@ -524,6 +525,7 @@ static void ieee802_11_rx_bss_trans_mgmt
  			wpa_printf(MSG_DEBUG, "WNM: not enough room for Target BSSID field");
  			return;
  		}
@@ -552,7 +611,7 @@
  		sta->agreed_to_steer = 1;
  		eloop_cancel_timeout(ap_sta_reset_steer_flag_timer, hapd, sta);
  		eloop_register_timeout(2, 0, ap_sta_reset_steer_flag_timer,
-@@ -530,6 +532,10 @@ static void ieee802_11_rx_bss_trans_mgmt
+@@ -543,6 +545,10 @@ static void ieee802_11_rx_bss_trans_mgmt
  			MAC2STR(addr), status_code, bss_termination_delay);
  	}
  
diff --git a/package/network/services/hostapd/patches/700-wifi-reload.patch b/package/network/services/hostapd/patches/700-wifi-reload.patch
index e6d7c2f6738b3f..5ac7f711a5cdee 100644
--- a/package/network/services/hostapd/patches/700-wifi-reload.patch
+++ b/package/network/services/hostapd/patches/700-wifi-reload.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -2458,6 +2458,8 @@ static int hostapd_config_fill(struct ho
+@@ -2418,6 +2418,8 @@ static int hostapd_config_fill(struct ho
  		bss->isolate = atoi(pos);
  	} else if (os_strcmp(buf, "ap_max_inactivity") == 0) {
  		bss->ap_max_inactivity = atoi(pos);
@@ -8,8 +8,8 @@
 +		bss->config_id = os_strdup(pos);
  	} else if (os_strcmp(buf, "skip_inactivity_poll") == 0) {
  		bss->skip_inactivity_poll = atoi(pos);
- 	} else if (os_strcmp(buf, "country_code") == 0) {
-@@ -3158,6 +3160,8 @@ static int hostapd_config_fill(struct ho
+ 	} else if (os_strcmp(buf, "config_id") == 0) {
+@@ -3128,6 +3130,8 @@ static int hostapd_config_fill(struct ho
  		}
  	} else if (os_strcmp(buf, "acs_exclude_dfs") == 0) {
  		conf->acs_exclude_dfs = atoi(pos);
@@ -20,15 +20,7 @@
  	} else if (os_strcmp(buf, "channel") == 0) {
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
-@@ -792,6 +792,7 @@ void hostapd_config_free_bss(struct host
- 	os_free(conf->radius_req_attr_sqlite);
- 	os_free(conf->rsn_preauth_interfaces);
- 	os_free(conf->ctrl_interface);
-+	os_free(conf->config_id);
- 	os_free(conf->ca_cert);
- 	os_free(conf->server_cert);
- 	os_free(conf->server_cert2);
-@@ -988,6 +989,7 @@ void hostapd_config_free(struct hostapd_
+@@ -997,6 +997,7 @@ void hostapd_config_free(struct hostapd_
  
  	for (i = 0; i < conf->num_bss; i++)
  		hostapd_config_free_bss(conf->bss[i]);
@@ -38,16 +30,7 @@
  	os_free(conf->basic_rates);
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
-@@ -279,6 +279,8 @@ struct hostapd_bss_config {
- 	char vlan_bridge[IFNAMSIZ + 1];
- 	char wds_bridge[IFNAMSIZ + 1];
- 
-+	char *config_id;
-+
- 	enum hostapd_logger_level logger_syslog_level, logger_stdout_level;
- 
- 	unsigned int logger_syslog; /* module bitfield */
-@@ -942,6 +944,7 @@ struct spatial_reuse {
+@@ -987,6 +987,7 @@ struct eht_phy_capabilities_info {
  struct hostapd_config {
  	struct hostapd_bss_config **bss, *last_bss;
  	size_t num_bss;
@@ -57,7 +40,7 @@
  	int rts_threshold;
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -219,6 +219,10 @@ static int hostapd_iface_conf_changed(st
+@@ -254,6 +254,10 @@ static int hostapd_iface_conf_changed(st
  {
  	size_t i;
  
@@ -68,7 +51,7 @@
  	if (newconf->num_bss != oldconf->num_bss)
  		return 1;
  
-@@ -232,7 +236,7 @@ static int hostapd_iface_conf_changed(st
+@@ -267,7 +271,7 @@ static int hostapd_iface_conf_changed(st
  }
  
  
@@ -77,26 +60,17 @@
  {
  	struct hapd_interfaces *interfaces = iface->interfaces;
  	struct hostapd_data *hapd = iface->bss[0];
-@@ -255,13 +259,16 @@ int hostapd_reload_config(struct hostapd
- 	if (newconf == NULL)
- 		return -1;
- 
--	hostapd_clear_old(iface);
--
- 	oldconf = hapd->iconf;
- 	if (hostapd_iface_conf_changed(newconf, oldconf)) {
+@@ -295,6 +299,9 @@ int hostapd_reload_config(struct hostapd
  		char *fname;
  		int res;
  
 +		if (reconf)
 +			return -1;
 +
-+		hostapd_clear_old(iface);
-+
+ 		hostapd_clear_old(iface);
+ 
  		wpa_printf(MSG_DEBUG,
- 			   "Configuration changes include interface/BSS modification - force full disable+enable sequence");
- 		fname = os_strdup(iface->config_fname);
-@@ -286,6 +293,24 @@ int hostapd_reload_config(struct hostapd
+@@ -321,6 +328,24 @@ int hostapd_reload_config(struct hostapd
  			wpa_printf(MSG_ERROR,
  				   "Failed to enable interface on config reload");
  		return res;
@@ -121,7 +95,7 @@
  	}
  	iface->conf = newconf;
  
-@@ -302,6 +327,12 @@ int hostapd_reload_config(struct hostapd
+@@ -337,6 +362,12 @@ int hostapd_reload_config(struct hostapd
  
  	for (j = 0; j < iface->num_bss; j++) {
  		hapd = iface->bss[j];
@@ -131,10 +105,10 @@
 +		}
 +		if (newconf->bss[j]->config_id)
 +			hapd->config_id = strdup(newconf->bss[j]->config_id);
- 		hapd->iconf = newconf;
- 		hapd->conf = newconf->bss[j];
- 		hostapd_reload_bss(hapd);
-@@ -2397,6 +2428,10 @@ hostapd_alloc_bss_data(struct hostapd_if
+ 		if (!hapd->conf->config_id || !newconf->bss[j]->config_id ||
+ 		    os_strcmp(hapd->conf->config_id,
+ 			      newconf->bss[j]->config_id) != 0)
+@@ -2514,6 +2545,10 @@ hostapd_alloc_bss_data(struct hostapd_if
  	hapd->iconf = conf;
  	hapd->conf = bss;
  	hapd->iface = hapd_iface;
@@ -147,7 +121,7 @@
  	hapd->ctrl_sock = -1;
 --- a/src/ap/hostapd.h
 +++ b/src/ap/hostapd.h
-@@ -46,7 +46,7 @@ struct mesh_conf;
+@@ -47,7 +47,7 @@ struct mesh_conf;
  struct hostapd_iface;
  
  struct hapd_interfaces {
@@ -156,7 +130,7 @@
  	struct hostapd_config * (*config_read_cb)(const char *config_fname);
  	int (*ctrl_iface_init)(struct hostapd_data *hapd);
  	void (*ctrl_iface_deinit)(struct hostapd_data *hapd);
-@@ -173,6 +173,7 @@ struct hostapd_data {
+@@ -185,6 +185,7 @@ struct hostapd_data {
  	struct hostapd_config *iconf;
  	struct hostapd_bss_config *conf;
  	struct hostapd_ubus_bss ubus;
@@ -164,7 +138,7 @@
  	int interface_added; /* virtual interface added for this BSS */
  	unsigned int started:1;
  	unsigned int disabled:1;
-@@ -624,7 +625,7 @@ struct hostapd_iface {
+@@ -676,7 +677,7 @@ struct hostapd_iface {
  int hostapd_for_each_interface(struct hapd_interfaces *interfaces,
  			       int (*cb)(struct hostapd_iface *iface,
  					 void *ctx), void *ctx);
@@ -175,19 +149,19 @@
  hostapd_alloc_bss_data(struct hostapd_iface *hapd_iface,
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -4833,6 +4833,9 @@ static int wpa_driver_nl80211_set_ap(voi
+@@ -5054,6 +5054,9 @@ static int wpa_driver_nl80211_set_ap(voi
  	if (ret) {
  		wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
  			   ret, strerror(-ret));
-+		if (!bss->beacon_set)
++		if (!bss->flink->beacon_set)
 +			ret = 0;
-+		bss->beacon_set = 0;
++		bss->flink->beacon_set = 0;
  	} else {
- 		bss->beacon_set = 1;
+ 		bss->flink->beacon_set = 1;
  		nl80211_set_bss(bss, params->cts_protect, params->preamble,
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -186,7 +186,7 @@ static int hostapd_ctrl_iface_update(str
+@@ -187,7 +187,7 @@ static int hostapd_ctrl_iface_update(str
  	iface->interfaces->config_read_cb = hostapd_ctrl_iface_config_read;
  	reload_opts = txt;
  
@@ -198,7 +172,7 @@
  }
 --- a/hostapd/main.c
 +++ b/hostapd/main.c
-@@ -317,7 +317,7 @@ static void handle_term(int sig, void *s
+@@ -320,7 +320,7 @@ static void handle_term(int sig, void *s
  
  static int handle_reload_iface(struct hostapd_iface *iface, void *ctx)
  {
diff --git a/package/network/services/hostapd/patches/710-vlan_no_bridge.patch b/package/network/services/hostapd/patches/710-vlan_no_bridge.patch
index 856dc8ba88901b..f625f4bda4b46b 100644
--- a/package/network/services/hostapd/patches/710-vlan_no_bridge.patch
+++ b/package/network/services/hostapd/patches/710-vlan_no_bridge.patch
@@ -1,6 +1,6 @@
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
-@@ -115,6 +115,7 @@ struct hostapd_ssid {
+@@ -121,6 +121,7 @@ struct hostapd_ssid {
  #define DYNAMIC_VLAN_OPTIONAL 1
  #define DYNAMIC_VLAN_REQUIRED 2
  	int dynamic_vlan;
@@ -30,7 +30,7 @@
  
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -3381,6 +3381,8 @@ static int hostapd_config_fill(struct ho
+@@ -3353,6 +3353,8 @@ static int hostapd_config_fill(struct ho
  #ifndef CONFIG_NO_VLAN
  	} else if (os_strcmp(buf, "dynamic_vlan") == 0) {
  		bss->ssid.dynamic_vlan = atoi(pos);
diff --git a/package/network/services/hostapd/patches/711-wds_bridge_force.patch b/package/network/services/hostapd/patches/711-wds_bridge_force.patch
index a22580c357803e..e04ae625384546 100644
--- a/package/network/services/hostapd/patches/711-wds_bridge_force.patch
+++ b/package/network/services/hostapd/patches/711-wds_bridge_force.patch
@@ -1,17 +1,17 @@
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -2358,6 +2358,8 @@ static int hostapd_config_fill(struct ho
+@@ -2316,6 +2316,8 @@ static int hostapd_config_fill(struct ho
  			   sizeof(conf->bss[0]->iface));
  	} else if (os_strcmp(buf, "bridge") == 0) {
  		os_strlcpy(bss->bridge, pos, sizeof(bss->bridge));
 +		if (!bss->wds_bridge[0])
 +			os_strlcpy(bss->wds_bridge, pos, sizeof(bss->wds_bridge));
+ 	} else if (os_strcmp(buf, "bridge_hairpin") == 0) {
+ 		bss->bridge_hairpin = atoi(pos);
  	} else if (os_strcmp(buf, "vlan_bridge") == 0) {
- 		os_strlcpy(bss->vlan_bridge, pos, sizeof(bss->vlan_bridge));
- 	} else if (os_strcmp(buf, "wds_bridge") == 0) {
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
-@@ -340,8 +340,6 @@ int hostapd_set_wds_sta(struct hostapd_d
+@@ -348,8 +348,6 @@ int hostapd_set_wds_sta(struct hostapd_d
  		return -1;
  	if (hapd->conf->wds_bridge[0])
  		bridge = hapd->conf->wds_bridge;
diff --git a/package/network/services/hostapd/patches/720-iface_max_num_sta.patch b/package/network/services/hostapd/patches/720-iface_max_num_sta.patch
index 106f9d74072621..a06f141c83fcc8 100644
--- a/package/network/services/hostapd/patches/720-iface_max_num_sta.patch
+++ b/package/network/services/hostapd/patches/720-iface_max_num_sta.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -2880,6 +2880,14 @@ static int hostapd_config_fill(struct ho
+@@ -2848,6 +2848,14 @@ static int hostapd_config_fill(struct ho
  				   line, bss->max_num_sta, MAX_STA_COUNT);
  			return 1;
  		}
@@ -17,17 +17,17 @@
  	} else if (os_strcmp(buf, "extended_key_id") == 0) {
 --- a/src/ap/hostapd.h
 +++ b/src/ap/hostapd.h
-@@ -668,6 +668,7 @@ void hostapd_cleanup_cs_params(struct ho
+@@ -721,6 +721,7 @@ void hostapd_cleanup_cs_params(struct ho
  void hostapd_periodic_iface(struct hostapd_iface *iface);
  int hostapd_owe_trans_get_info(struct hostapd_data *hapd);
  void hostapd_ocv_check_csa_sa_query(void *eloop_ctx, void *timeout_ctx);
 +int hostapd_check_max_sta(struct hostapd_data *hapd);
  
- /* utils.c */
- int hostapd_register_probereq_cb(struct hostapd_data *hapd,
+ void hostapd_switch_color(struct hostapd_data *hapd, u64 bitmap);
+ void hostapd_cleanup_cca_params(struct hostapd_data *hapd);
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -236,6 +236,30 @@ static int hostapd_iface_conf_changed(st
+@@ -271,6 +271,30 @@ static int hostapd_iface_conf_changed(st
  }
  
  
@@ -60,7 +60,7 @@
  	struct hapd_interfaces *interfaces = iface->interfaces;
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
-@@ -1068,7 +1068,7 @@ void handle_probe_req(struct hostapd_dat
+@@ -1222,7 +1222,7 @@ void handle_probe_req(struct hostapd_dat
  	if (hapd->conf->no_probe_resp_if_max_sta &&
  	    is_multicast_ether_addr(mgmt->da) &&
  	    is_multicast_ether_addr(mgmt->bssid) &&
@@ -71,7 +71,7 @@
  			   " since no room for additional STA",
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
-@@ -981,6 +981,8 @@ struct hostapd_config {
+@@ -1026,6 +1026,8 @@ struct hostapd_config {
  	unsigned int track_sta_max_num;
  	unsigned int track_sta_max_age;
  
diff --git a/package/network/services/hostapd/patches/730-ft_iface.patch b/package/network/services/hostapd/patches/730-ft_iface.patch
index b5809222d7eb7c..1826c97623622b 100644
--- a/package/network/services/hostapd/patches/730-ft_iface.patch
+++ b/package/network/services/hostapd/patches/730-ft_iface.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -3038,6 +3038,8 @@ static int hostapd_config_fill(struct ho
+@@ -3007,6 +3007,8 @@ static int hostapd_config_fill(struct ho
  		wpa_printf(MSG_INFO,
  			   "Line %d: Obsolete peerkey parameter ignored", line);
  #ifdef CONFIG_IEEE80211R_AP
@@ -11,17 +11,17 @@
  		    hexstr2bin(pos, bss->mobility_domain,
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
-@@ -277,6 +277,7 @@ struct airtime_sta_weight {
+@@ -283,6 +283,7 @@ struct airtime_sta_weight {
  struct hostapd_bss_config {
  	char iface[IFNAMSIZ + 1];
  	char bridge[IFNAMSIZ + 1];
 +	char ft_iface[IFNAMSIZ + 1];
  	char vlan_bridge[IFNAMSIZ + 1];
  	char wds_bridge[IFNAMSIZ + 1];
- 
+ 	int bridge_hairpin; /* hairpin_mode on bridge members */
 --- a/src/ap/wpa_auth_glue.c
 +++ b/src/ap/wpa_auth_glue.c
-@@ -1566,8 +1566,12 @@ int hostapd_setup_wpa(struct hostapd_dat
+@@ -1616,8 +1616,12 @@ int hostapd_setup_wpa(struct hostapd_dat
  	    wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt)) {
  		const char *ft_iface;
  
diff --git a/package/network/services/hostapd/patches/740-snoop_iface.patch b/package/network/services/hostapd/patches/740-snoop_iface.patch
index 2ed73750ca2dcc..a116644736530a 100644
--- a/package/network/services/hostapd/patches/740-snoop_iface.patch
+++ b/package/network/services/hostapd/patches/740-snoop_iface.patch
@@ -1,18 +1,18 @@
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
-@@ -278,6 +278,7 @@ struct hostapd_bss_config {
+@@ -284,6 +284,7 @@ struct hostapd_bss_config {
  	char iface[IFNAMSIZ + 1];
  	char bridge[IFNAMSIZ + 1];
  	char ft_iface[IFNAMSIZ + 1];
 +	char snoop_iface[IFNAMSIZ + 1];
  	char vlan_bridge[IFNAMSIZ + 1];
  	char wds_bridge[IFNAMSIZ + 1];
- 
+ 	int bridge_hairpin; /* hairpin_mode on bridge members */
 --- a/src/ap/x_snoop.c
 +++ b/src/ap/x_snoop.c
-@@ -31,14 +31,16 @@ int x_snoop_init(struct hostapd_data *ha
- 		return -1;
- 	}
+@@ -33,14 +33,16 @@ int x_snoop_init(struct hostapd_data *ha
+ 
+ 	hapd->x_snoop_initialized = true;
  
 -	if (hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_HAIRPIN_MODE,
 +	if (!conf->snoop_iface[0] &&
@@ -29,7 +29,7 @@
  		wpa_printf(MSG_DEBUG,
  			   "x_snoop: Failed to enable proxyarp on the bridge port");
  		return -1;
-@@ -52,7 +54,8 @@ int x_snoop_init(struct hostapd_data *ha
+@@ -54,7 +56,8 @@ int x_snoop_init(struct hostapd_data *ha
  	}
  
  #ifdef CONFIG_IPV6
@@ -39,7 +39,7 @@
  		wpa_printf(MSG_DEBUG,
  			   "x_snoop: Failed to enable multicast snooping on the bridge");
  		return -1;
-@@ -71,8 +74,12 @@ x_snoop_get_l2_packet(struct hostapd_dat
+@@ -73,8 +76,12 @@ x_snoop_get_l2_packet(struct hostapd_dat
  {
  	struct hostapd_bss_config *conf = hapd->conf;
  	struct l2_packet_data *l2;
@@ -55,10 +55,10 @@
  			   "x_snoop: Failed to initialize L2 packet processing %s",
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -2360,6 +2360,8 @@ static int hostapd_config_fill(struct ho
- 		os_strlcpy(bss->bridge, pos, sizeof(bss->bridge));
- 		if (!bss->wds_bridge[0])
+@@ -2320,6 +2320,8 @@ static int hostapd_config_fill(struct ho
  			os_strlcpy(bss->wds_bridge, pos, sizeof(bss->wds_bridge));
+ 	} else if (os_strcmp(buf, "bridge_hairpin") == 0) {
+ 		bss->bridge_hairpin = atoi(pos);
 +	} else if (os_strcmp(buf, "snoop_iface") == 0) {
 +		os_strlcpy(bss->snoop_iface, pos, sizeof(bss->snoop_iface));
  	} else if (os_strcmp(buf, "vlan_bridge") == 0) {
diff --git a/package/network/services/hostapd/patches/750-qos_map_set_without_interworking.patch b/package/network/services/hostapd/patches/750-qos_map_set_without_interworking.patch
index ff1d076b37911e..c3a77bc6537b2a 100644
--- a/package/network/services/hostapd/patches/750-qos_map_set_without_interworking.patch
+++ b/package/network/services/hostapd/patches/750-qos_map_set_without_interworking.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -1598,6 +1598,8 @@ static int parse_anqp_elem(struct hostap
+@@ -1602,6 +1602,8 @@ static int parse_anqp_elem(struct hostap
  	return 0;
  }
  
@@ -9,7 +9,7 @@
  
  static int parse_qos_map_set(struct hostapd_bss_config *bss,
  			     char *buf, int line)
-@@ -1639,8 +1641,6 @@ static int parse_qos_map_set(struct host
+@@ -1643,8 +1645,6 @@ static int parse_qos_map_set(struct host
  	return 0;
  }
  
@@ -18,7 +18,7 @@
  
  #ifdef CONFIG_HS20
  static int hs20_parse_conn_capab(struct hostapd_bss_config *bss, char *buf,
-@@ -4042,10 +4042,10 @@ static int hostapd_config_fill(struct ho
+@@ -4064,10 +4064,10 @@ static int hostapd_config_fill(struct ho
  		bss->gas_frag_limit = val;
  	} else if (os_strcmp(buf, "gas_comeback_delay") == 0) {
  		bss->gas_comeback_delay = atoi(pos);
@@ -32,7 +32,7 @@
  		os_free(bss->dump_msk_file);
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -1423,6 +1423,7 @@ static int hostapd_setup_bss(struct host
+@@ -1499,6 +1499,7 @@ static int hostapd_setup_bss(struct host
  		wpa_printf(MSG_ERROR, "GAS server initialization failed");
  		return -1;
  	}
@@ -40,7 +40,7 @@
  
  	if (conf->qos_map_set_len &&
  	    hostapd_drv_set_qos_map(hapd, conf->qos_map_set,
-@@ -1430,7 +1431,6 @@ static int hostapd_setup_bss(struct host
+@@ -1506,7 +1507,6 @@ static int hostapd_setup_bss(struct host
  		wpa_printf(MSG_ERROR, "Failed to initialize QoS Map");
  		return -1;
  	}
@@ -50,7 +50,7 @@
  		wpa_printf(MSG_ERROR, "BSS Load initialization failed");
 --- a/wpa_supplicant/events.c
 +++ b/wpa_supplicant/events.c
-@@ -2586,8 +2586,6 @@ void wnm_bss_keep_alive_deinit(struct wp
+@@ -2672,8 +2672,6 @@ void wnm_bss_keep_alive_deinit(struct wp
  }
  
  
@@ -59,16 +59,16 @@
  static int wpas_qos_map_set(struct wpa_supplicant *wpa_s, const u8 *qos_map,
  			    size_t len)
  {
-@@ -2620,8 +2618,6 @@ static void interworking_process_assoc_r
+@@ -2706,8 +2704,6 @@ static void interworking_process_assoc_r
  	}
  }
  
 -#endif /* CONFIG_INTERWORKING */
 -
  
- static void multi_ap_process_assoc_resp(struct wpa_supplicant *wpa_s,
- 					const u8 *ies, size_t ies_len)
-@@ -2954,10 +2950,8 @@ static int wpa_supplicant_event_associnf
+ static void wpa_supplicant_set_4addr_mode(struct wpa_supplicant *wpa_s)
+ {
+@@ -3087,10 +3083,8 @@ static int wpa_supplicant_event_associnf
  		wnm_process_assoc_resp(wpa_s, data->assoc_info.resp_ies,
  				       data->assoc_info.resp_ies_len);
  #endif /* CONFIG_WNM */
@@ -81,7 +81,7 @@
  			   data->assoc_info.resp_ies_len, WLAN_EID_VHT_CAP))
 --- a/src/ap/ieee802_11_shared.c
 +++ b/src/ap/ieee802_11_shared.c
-@@ -1098,13 +1098,11 @@ u8 * hostapd_eid_rsnxe(struct hostapd_da
+@@ -1116,13 +1116,11 @@ u8 * hostapd_eid_rsnxe(struct hostapd_da
  u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
  		    const u8 *ext_capab_ie, size_t ext_capab_ie_len)
  {
diff --git a/package/network/services/hostapd/patches/751-qos_map_ignore_when_unsupported.patch b/package/network/services/hostapd/patches/751-qos_map_ignore_when_unsupported.patch
index 8af5a0a0469b6a..1fc4e8a77cf2f6 100644
--- a/package/network/services/hostapd/patches/751-qos_map_ignore_when_unsupported.patch
+++ b/package/network/services/hostapd/patches/751-qos_map_ignore_when_unsupported.patch
@@ -1,6 +1,6 @@
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
-@@ -850,7 +850,8 @@ int hostapd_start_dfs_cac(struct hostapd
+@@ -874,7 +874,8 @@ int hostapd_start_dfs_cac(struct hostapd
  int hostapd_drv_set_qos_map(struct hostapd_data *hapd,
  			    const u8 *qos_map_set, u8 qos_map_set_len)
  {
diff --git a/package/network/services/hostapd/patches/760-dynamic_own_ip.patch b/package/network/services/hostapd/patches/760-dynamic_own_ip.patch
new file mode 100644
index 00000000000000..2f5015892b7b46
--- /dev/null
+++ b/package/network/services/hostapd/patches/760-dynamic_own_ip.patch
@@ -0,0 +1,109 @@
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -310,6 +310,7 @@ struct hostapd_bss_config {
+ 	unsigned int eap_sim_db_timeout;
+ 	int eap_server_erp; /* Whether ERP is enabled on internal EAP server */
+ 	struct hostapd_ip_addr own_ip_addr;
++	int dynamic_own_ip_addr;
+ 	char *nas_identifier;
+ 	struct hostapd_radius_servers *radius;
+ 	int acct_interim_interval;
+--- a/src/radius/radius_client.c
++++ b/src/radius/radius_client.c
+@@ -163,6 +163,8 @@ struct radius_client_data {
+ 	 */
+ 	void *ctx;
+ 
++	struct hostapd_ip_addr local_ip;
++
+ 	/**
+ 	 * conf - RADIUS client configuration (list of RADIUS servers to use)
+ 	 */
+@@ -720,6 +722,30 @@ static void radius_client_list_add(struc
+ 
+ 
+ /**
++ * radius_client_send - Get local address for the RADIUS auth socket
++ * @radius: RADIUS client context from radius_client_init()
++ * @addr: pointer to store the address
++ *
++ * This function returns the local address for the connection to the RADIUS
++ * auth server. It also opens the socket if it's not available yet.
++ */
++int radius_client_get_local_addr(struct radius_client_data *radius,
++				 struct hostapd_ip_addr *addr)
++{
++	struct hostapd_radius_servers *conf = radius->conf;
++
++	if (conf->auth_server && radius->auth_sock < 0)
++		radius_client_init_auth(radius);
++
++	if (radius->auth_sock < 0)
++		return -1;
++
++	memcpy(addr, &radius->local_ip, sizeof(*addr));
++
++	return 0;
++}
++
++/**
+  * radius_client_send - Send a RADIUS request
+  * @radius: RADIUS client context from radius_client_init()
+  * @msg: RADIUS message to be sent
+@@ -1238,6 +1264,10 @@ radius_change_server(struct radius_clien
+ 			wpa_printf(MSG_DEBUG, "RADIUS local address: %s:%u",
+ 				   inet_ntoa(claddr.sin_addr),
+ 				   ntohs(claddr.sin_port));
++			if (auth) {
++				radius->local_ip.af = AF_INET;
++				radius->local_ip.u.v4 = claddr.sin_addr;
++			}
+ 		}
+ 		break;
+ #ifdef CONFIG_IPV6
+@@ -1249,6 +1279,10 @@ radius_change_server(struct radius_clien
+ 				   inet_ntop(AF_INET6, &claddr6.sin6_addr,
+ 					     abuf, sizeof(abuf)),
+ 				   ntohs(claddr6.sin6_port));
++			if (auth) {
++				radius->local_ip.af = AF_INET6;
++				radius->local_ip.u.v6 = claddr6.sin6_addr;
++			}
+ 		}
+ 		break;
+ 	}
+--- a/src/radius/radius_client.h
++++ b/src/radius/radius_client.h
+@@ -249,6 +249,8 @@ int radius_client_register(struct radius
+ void radius_client_set_interim_error_cb(struct radius_client_data *radius,
+ 					void (*cb)(const u8 *addr, void *ctx),
+ 					void *ctx);
++int radius_client_get_local_addr(struct radius_client_data *radius,
++				 struct hostapd_ip_addr * addr);
+ int radius_client_send(struct radius_client_data *radius,
+ 		       struct radius_msg *msg,
+ 		       RadiusType msg_type, const u8 *addr);
+--- a/src/ap/ieee802_1x.c
++++ b/src/ap/ieee802_1x.c
+@@ -535,6 +535,10 @@ int add_common_radius_attr(struct hostap
+ 	struct hostapd_radius_attr *attr;
+ 	int len;
+ 
++	if (hapd->conf->dynamic_own_ip_addr)
++		radius_client_get_local_addr(hapd->radius,
++					     &hapd->conf->own_ip_addr);
++
+ 	if (!hostapd_config_get_radius_attr(req_attr,
+ 					    RADIUS_ATTR_NAS_IP_ADDRESS) &&
+ 	    hapd->conf->own_ip_addr.af == AF_INET &&
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -2688,6 +2688,8 @@ static int hostapd_config_fill(struct ho
+ 	} else if (os_strcmp(buf, "iapp_interface") == 0) {
+ 		wpa_printf(MSG_INFO, "DEPRECATED: iapp_interface not used");
+ #endif /* CONFIG_IAPP */
++	} else if (os_strcmp(buf, "dynamic_own_ip_addr") == 0) {
++		bss->dynamic_own_ip_addr = atoi(pos);
+ 	} else if (os_strcmp(buf, "own_ip_addr") == 0) {
+ 		if (hostapd_parse_ip_addr(pos, &bss->own_ip_addr)) {
+ 			wpa_printf(MSG_ERROR,
diff --git a/package/network/services/hostapd/patches/761-shared_das_port.patch b/package/network/services/hostapd/patches/761-shared_das_port.patch
new file mode 100644
index 00000000000000..59c2a967953d5e
--- /dev/null
+++ b/package/network/services/hostapd/patches/761-shared_das_port.patch
@@ -0,0 +1,298 @@
+--- a/src/radius/radius_das.h
++++ b/src/radius/radius_das.h
+@@ -44,6 +44,7 @@ struct radius_das_attrs {
+ struct radius_das_conf {
+ 	int port;
+ 	const u8 *shared_secret;
++	const u8 *nas_identifier;
+ 	size_t shared_secret_len;
+ 	const struct hostapd_ip_addr *client_addr;
+ 	unsigned int time_window;
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -1442,6 +1442,7 @@ static int hostapd_setup_bss(struct host
+ 		struct radius_das_conf das_conf;
+ 		os_memset(&das_conf, 0, sizeof(das_conf));
+ 		das_conf.port = conf->radius_das_port;
++		das_conf.nas_identifier = conf->nas_identifier;
+ 		das_conf.shared_secret = conf->radius_das_shared_secret;
+ 		das_conf.shared_secret_len =
+ 			conf->radius_das_shared_secret_len;
+--- a/src/radius/radius_das.c
++++ b/src/radius/radius_das.c
+@@ -12,13 +12,26 @@
+ #include "utils/common.h"
+ #include "utils/eloop.h"
+ #include "utils/ip_addr.h"
++#include "utils/list.h"
+ #include "radius.h"
+ #include "radius_das.h"
+ 
+ 
+-struct radius_das_data {
++static struct dl_list das_ports = DL_LIST_HEAD_INIT(das_ports);
++
++struct radius_das_port {
++	struct dl_list list;
++	struct dl_list das_data;
++
++	int port;
+ 	int sock;
++};
++
++struct radius_das_data {
++	struct dl_list list;
++	struct radius_das_port *port;
+ 	u8 *shared_secret;
++	u8 *nas_identifier;
+ 	size_t shared_secret_len;
+ 	struct hostapd_ip_addr client_addr;
+ 	unsigned int time_window;
+@@ -378,56 +391,17 @@ fail:
+ }
+ 
+ 
+-static void radius_das_receive(int sock, void *eloop_ctx, void *sock_ctx)
++static void
++radius_das_receive_msg(struct radius_das_data *das, struct radius_msg *msg,
++		       struct sockaddr *from, socklen_t fromlen,
++		       char *abuf, int from_port)
+ {
+-	struct radius_das_data *das = eloop_ctx;
+-	u8 buf[1500];
+-	union {
+-		struct sockaddr_storage ss;
+-		struct sockaddr_in sin;
+-#ifdef CONFIG_IPV6
+-		struct sockaddr_in6 sin6;
+-#endif /* CONFIG_IPV6 */
+-	} from;
+-	char abuf[50];
+-	int from_port = 0;
+-	socklen_t fromlen;
+-	int len;
+-	struct radius_msg *msg, *reply = NULL;
++	struct radius_msg *reply = NULL;
+ 	struct radius_hdr *hdr;
+ 	struct wpabuf *rbuf;
++	struct os_time now;
+ 	u32 val;
+ 	int res;
+-	struct os_time now;
+-
+-	fromlen = sizeof(from);
+-	len = recvfrom(sock, buf, sizeof(buf), 0,
+-		       (struct sockaddr *) &from.ss, &fromlen);
+-	if (len < 0) {
+-		wpa_printf(MSG_ERROR, "DAS: recvfrom: %s", strerror(errno));
+-		return;
+-	}
+-
+-	os_strlcpy(abuf, inet_ntoa(from.sin.sin_addr), sizeof(abuf));
+-	from_port = ntohs(from.sin.sin_port);
+-
+-	wpa_printf(MSG_DEBUG, "DAS: Received %d bytes from %s:%d",
+-		   len, abuf, from_port);
+-	if (das->client_addr.u.v4.s_addr &&
+-	    das->client_addr.u.v4.s_addr != from.sin.sin_addr.s_addr) {
+-		wpa_printf(MSG_DEBUG, "DAS: Drop message from unknown client");
+-		return;
+-	}
+-
+-	msg = radius_msg_parse(buf, len);
+-	if (msg == NULL) {
+-		wpa_printf(MSG_DEBUG, "DAS: Parsing incoming RADIUS packet "
+-			   "from %s:%d failed", abuf, from_port);
+-		return;
+-	}
+-
+-	if (wpa_debug_level <= MSG_MSGDUMP)
+-		radius_msg_dump(msg);
+ 
+ 	if (radius_msg_verify_das_req(msg, das->shared_secret,
+ 				       das->shared_secret_len,
+@@ -494,9 +468,8 @@ static void radius_das_receive(int sock,
+ 			radius_msg_dump(reply);
+ 
+ 		rbuf = radius_msg_get_buf(reply);
+-		res = sendto(das->sock, wpabuf_head(rbuf),
+-			     wpabuf_len(rbuf), 0,
+-			     (struct sockaddr *) &from.ss, fromlen);
++		res = sendto(das->port->sock, wpabuf_head(rbuf),
++			     wpabuf_len(rbuf), 0, from, fromlen);
+ 		if (res < 0) {
+ 			wpa_printf(MSG_ERROR, "DAS: sendto(to %s:%d): %s",
+ 				   abuf, from_port, strerror(errno));
+@@ -508,6 +481,72 @@ fail:
+ 	radius_msg_free(reply);
+ }
+ 
++static void radius_das_receive(int sock, void *eloop_ctx, void *sock_ctx)
++{
++	struct radius_das_port *p = eloop_ctx;
++	struct radius_das_data *das;
++	u8 buf[1500];
++	union {
++		struct sockaddr_storage ss;
++		struct sockaddr_in sin;
++#ifdef CONFIG_IPV6
++		struct sockaddr_in6 sin6;
++#endif /* CONFIG_IPV6 */
++	} from;
++	struct radius_msg *msg;
++	size_t nasid_len = 0;
++	u8 *nasid_buf = NULL;
++	char abuf[50];
++	int from_port = 0;
++	socklen_t fromlen;
++	int found = 0;
++	int len;
++
++	fromlen = sizeof(from);
++	len = recvfrom(sock, buf, sizeof(buf), 0,
++		       (struct sockaddr *) &from.ss, &fromlen);
++	if (len < 0) {
++		wpa_printf(MSG_ERROR, "DAS: recvfrom: %s", strerror(errno));
++		return;
++	}
++
++	os_strlcpy(abuf, inet_ntoa(from.sin.sin_addr), sizeof(abuf));
++	from_port = ntohs(from.sin.sin_port);
++
++	msg = radius_msg_parse(buf, len);
++	if (msg == NULL) {
++		wpa_printf(MSG_DEBUG, "DAS: Parsing incoming RADIUS packet "
++			   "from %s:%d failed", abuf, from_port);
++		return;
++	}
++
++	wpa_printf(MSG_DEBUG, "DAS: Received %d bytes from %s:%d",
++		   len, abuf, from_port);
++
++	if (wpa_debug_level <= MSG_MSGDUMP)
++		radius_msg_dump(msg);
++
++	radius_msg_get_attr_ptr(msg, RADIUS_ATTR_NAS_IDENTIFIER,
++				&nasid_buf, &nasid_len, NULL);
++	dl_list_for_each(das, &p->das_data, struct radius_das_data, list) {
++		if (das->client_addr.u.v4.s_addr &&
++		    das->client_addr.u.v4.s_addr != from.sin.sin_addr.s_addr)
++			continue;
++
++		if (das->nas_identifier && nasid_buf &&
++		    (nasid_len != os_strlen(das->nas_identifier) ||
++		     os_memcmp(das->nas_identifier, nasid_buf, nasid_len) != 0))
++			continue;
++
++		found = 1;
++		radius_das_receive_msg(das, msg, (struct sockaddr *)&from.ss,
++				       fromlen, abuf, from_port);
++	}
++
++	if (!found)
++		wpa_printf(MSG_DEBUG, "DAS: Drop message from unknown client");
++}
++
+ 
+ static int radius_das_open_socket(int port)
+ {
+@@ -533,6 +572,49 @@ static int radius_das_open_socket(int po
+ }
+ 
+ 
++static struct radius_das_port *
++radius_das_open_port(int port)
++{
++	struct radius_das_port *p;
++
++	dl_list_for_each(p, &das_ports, struct radius_das_port, list) {
++		if (p->port == port)
++			return p;
++	}
++
++	p = os_zalloc(sizeof(*p));
++	if (p == NULL)
++		return NULL;
++
++	dl_list_init(&p->das_data);
++	p->port = port;
++	p->sock = radius_das_open_socket(port);
++	if (p->sock < 0)
++		goto free_port;
++
++	if (eloop_register_read_sock(p->sock, radius_das_receive, p, NULL))
++		goto close_port;
++
++	dl_list_add(&das_ports, &p->list);
++
++	return p;
++
++close_port:
++	close(p->sock);
++free_port:
++	os_free(p);
++
++	return NULL;
++}
++
++static void radius_das_close_port(struct radius_das_port *p)
++{
++	dl_list_del(&p->list);
++	eloop_unregister_read_sock(p->sock);
++	close(p->sock);
++	free(p);
++}
++
+ struct radius_das_data *
+ radius_das_init(struct radius_das_conf *conf)
+ {
+@@ -553,6 +635,8 @@ radius_das_init(struct radius_das_conf *
+ 	das->ctx = conf->ctx;
+ 	das->disconnect = conf->disconnect;
+ 	das->coa = conf->coa;
++	if (conf->nas_identifier)
++		das->nas_identifier = os_strdup(conf->nas_identifier);
+ 
+ 	os_memcpy(&das->client_addr, conf->client_addr,
+ 		  sizeof(das->client_addr));
+@@ -565,19 +649,15 @@ radius_das_init(struct radius_das_conf *
+ 	}
+ 	das->shared_secret_len = conf->shared_secret_len;
+ 
+-	das->sock = radius_das_open_socket(conf->port);
+-	if (das->sock < 0) {
++	das->port = radius_das_open_port(conf->port);
++	if (!das->port) {
+ 		wpa_printf(MSG_ERROR, "Failed to open UDP socket for RADIUS "
+ 			   "DAS");
+ 		radius_das_deinit(das);
+ 		return NULL;
+ 	}
+ 
+-	if (eloop_register_read_sock(das->sock, radius_das_receive, das, NULL))
+-	{
+-		radius_das_deinit(das);
+-		return NULL;
+-	}
++	dl_list_add(&das->port->das_data, &das->list);
+ 
+ 	return das;
+ }
+@@ -588,11 +668,14 @@ void radius_das_deinit(struct radius_das
+ 	if (das == NULL)
+ 		return;
+ 
+-	if (das->sock >= 0) {
+-		eloop_unregister_read_sock(das->sock);
+-		close(das->sock);
++	if (das->port) {
++		dl_list_del(&das->list);
++
++		if (dl_list_empty(&das->port->das_data))
++			radius_das_close_port(das->port);
+ 	}
+ 
++	os_free(das->nas_identifier);
+ 	os_free(das->shared_secret);
+ 	os_free(das);
+ }
diff --git a/package/network/services/hostapd/patches/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch b/package/network/services/hostapd/patches/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch
index 3665c6c33f7ac8..51690def09c708 100644
--- a/package/network/services/hostapd/patches/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch
+++ b/package/network/services/hostapd/patches/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch
@@ -11,11 +11,9 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  wpa_supplicant/ctrl_iface.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)
 
-diff --git a/wpa_supplicant/ctrl_iface.c b/wpa_supplicant/ctrl_iface.c
-index ac337e0f5..6e23114e6 100644
 --- a/wpa_supplicant/ctrl_iface.c
 +++ b/wpa_supplicant/ctrl_iface.c
-@@ -12185,7 +12185,7 @@ char * wpa_supplicant_ctrl_iface_process(struct wpa_supplicant *wpa_s,
+@@ -12640,7 +12640,7 @@ char * wpa_supplicant_ctrl_iface_process
  		if (wpas_ctrl_iface_coloc_intf_report(wpa_s, buf + 18))
  			reply_len = -1;
  #endif /* CONFIG_WNM */
@@ -24,7 +22,7 @@ index ac337e0f5..6e23114e6 100644
  	} else if (os_strncmp(buf, "DISASSOC_IMMINENT ", 18) == 0) {
  		if (ap_ctrl_iface_disassoc_imminent(wpa_s, buf + 18))
  			reply_len = -1;
-@@ -12195,7 +12195,7 @@ char * wpa_supplicant_ctrl_iface_process(struct wpa_supplicant *wpa_s,
+@@ -12650,7 +12650,7 @@ char * wpa_supplicant_ctrl_iface_process
  	} else if (os_strncmp(buf, "BSS_TM_REQ ", 11) == 0) {
  		if (ap_ctrl_iface_bss_tm_req(wpa_s, buf + 11))
  			reply_len = -1;
@@ -33,6 +31,3 @@ index ac337e0f5..6e23114e6 100644
  	} else if (os_strcmp(buf, "FLUSH") == 0) {
  		wpa_supplicant_ctrl_iface_flush(wpa_s);
  	} else if (os_strncmp(buf, "RADIO_WORK ", 11) == 0) {
--- 
-2.35.1
-
diff --git a/package/network/services/hostapd/src/src/ap/ubus.c b/package/network/services/hostapd/src/src/ap/ubus.c
index 622eab8838acc3..ddd86447eb1371 100644
--- a/package/network/services/hostapd/src/src/ap/ubus.c
+++ b/package/network/services/hostapd/src/src/ap/ubus.c
@@ -390,32 +390,6 @@ hostapd_bss_get_features(struct ubus_context *ctx, struct ubus_object *obj,
 	return 0;
 }
 
-/* Imported from iw/util.c
- *  https://git.kernel.org/pub/scm/linux/kernel/git/jberg/iw.git/tree/util.c?id=4b25ae3537af48dbf9d0abf94132e5ba01b32c18#n200
- */
-int ieee80211_frequency_to_channel(int freq)
-{
-	/* see 802.11-2007 17.3.8.3.2 and Annex J */
-	if (freq == 2484)
-		return 14;
-	/* see 802.11ax D6.1 27.3.23.2 and Annex E */
-	else if (freq == 5935)
-		return 2;
-	else if (freq < 2484)
-		return (freq - 2407) / 5;
-	else if (freq >= 4910 && freq <= 4980)
-		return (freq - 4000) / 5;
-	else if (freq < 5950)
-		return (freq - 5000) / 5;
-	else if (freq <= 45000) /* DMG band lower limit */
-		/* see 802.11ax D6.1 27.3.23.2 */
-		return (freq - 5950) / 5;
-	else if (freq >= 58320 && freq <= 70200)
-		return (freq - 56160) / 2160;
-	else
-		return 0;
-}
-
 static int
 hostapd_bss_get_status(struct ubus_context *ctx, struct ubus_object *obj,
 		       struct ubus_request_data *req, const char *method,
@@ -1110,6 +1084,8 @@ hostapd_bss_mgmt_enable(struct ubus_context *ctx, struct ubus_object *obj,
 	}
 
 	__hostapd_bss_mgmt_enable(hapd, flags);
+
+	return 0;
 }
 
 
@@ -1983,6 +1959,20 @@ void hostapd_ubus_notify(struct hostapd_data *hapd, const char *type, const u8 *
 	ubus_notify(ctx, &hapd->ubus.obj, type, b.head, -1);
 }
 
+void hostapd_ubus_notify_authorized(struct hostapd_data *hapd, struct sta_info *sta,
+				    const char *auth_alg)
+{
+	if (!hapd->ubus.obj.has_subscribers)
+		return;
+
+	blob_buf_init(&b, 0);
+	blobmsg_add_macaddr(&b, "address", sta->addr);
+	if (auth_alg)
+		blobmsg_add_string(&b, "auth-alg", auth_alg);
+
+	ubus_notify(ctx, &hapd->ubus.obj, "sta-authorized", b.head, -1);
+}
+
 void hostapd_ubus_notify_beacon_report(
 	struct hostapd_data *hapd, const u8 *addr, u8 token, u8 rep_mode,
 	struct rrm_measurement_beacon_report *rep, size_t len)
@@ -2005,6 +1995,7 @@ void hostapd_ubus_notify_beacon_report(
 	blobmsg_add_macaddr(&b, "bssid", rep->bssid);
 	blobmsg_add_u16(&b, "antenna-id", rep->antenna_id);
 	blobmsg_add_u16(&b, "parent-tsf", rep->parent_tsf);
+	blobmsg_add_u16(&b, "rep-mode", rep_mode);
 
 	ubus_notify(ctx, &hapd->ubus.obj, "beacon-report", b.head, -1);
 }
diff --git a/package/network/services/hostapd/src/src/ap/ubus.h b/package/network/services/hostapd/src/src/ap/ubus.h
index 5a33b624d08738..b0f7c44ab5f49a 100644
--- a/package/network/services/hostapd/src/src/ap/ubus.h
+++ b/package/network/services/hostapd/src/src/ap/ubus.h
@@ -65,6 +65,8 @@ void hostapd_ubus_free(struct hapd_interfaces *interfaces);
 int hostapd_ubus_notify_bss_transition_query(
 	struct hostapd_data *hapd, const u8 *addr, u8 dialog_token, u8 reason,
 	const u8 *candidate_list, u16 candidate_list_len);
+void hostapd_ubus_notify_authorized(struct hostapd_data *hapd, struct sta_info *sta,
+				    const char *auth_alg);
 
 #else
 
@@ -140,6 +142,13 @@ static inline int hostapd_ubus_notify_bss_transition_query(
 {
 	return 0;
 }
+
+static inline void
+hostapd_ubus_notify_authorized(struct hostapd_data *hapd, struct sta_info *sta,
+			       const char *auth_alg)
+{
+}
+
 #endif
 
 #endif
diff --git a/package/network/services/hostapd/src/src/utils/build_features.h b/package/network/services/hostapd/src/src/utils/build_features.h
index 642a35836e4e54..553769ecebc84c 100644
--- a/package/network/services/hostapd/src/src/utils/build_features.h
+++ b/package/network/services/hostapd/src/src/utils/build_features.h
@@ -7,10 +7,6 @@ static inline int has_feature(const char *feat)
 	if (!strcmp(feat, "eap"))
 		return 1;
 #endif
-#ifdef CONFIG_IEEE80211N
-	if (!strcmp(feat, "11n"))
-		return 1;
-#endif
 #ifdef CONFIG_IEEE80211AC
 	if (!strcmp(feat, "11ac"))
 		return 1;
@@ -58,6 +54,10 @@ static inline int has_feature(const char *feat)
 #ifdef CONFIG_OCV
 	if (!strcmp(feat, "ocv"))
 		return 1;
+#endif
+#ifdef CONFIG_MESH
+	if (!strcmp(feat, "mesh"))
+		return 1;
 #endif
 	return 0;
 }
diff --git a/package/network/services/ipset-dns/Makefile b/package/network/services/ipset-dns/Makefile
index 3f21d04c47c52c..f55281ef427e31 100644
--- a/package/network/services/ipset-dns/Makefile
+++ b/package/network/services/ipset-dns/Makefile
@@ -11,7 +11,7 @@ PKG_NAME:=ipset-dns
 PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=http://git.zx2c4.com/ipset-dns
+PKG_SOURCE_URL:=https://git.zx2c4.com/ipset-dns
 PKG_SOURCE_DATE:=2017-10-08
 PKG_SOURCE_VERSION:=ade2cf88e933f4f90451e0a6171f0aa4a523f989
 PKG_MIRROR_HASH:=34ad1f5c7d2eab90b795f2a512102891428216e3d439d918a8992846550e9697
diff --git a/package/network/services/lldpd/Makefile b/package/network/services/lldpd/Makefile
index b99fc61e5ae6b7..289adc55c9407b 100644
--- a/package/network/services/lldpd/Makefile
+++ b/package/network/services/lldpd/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=lldpd
-PKG_VERSION:=1.0.15
+PKG_VERSION:=1.0.17
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://codeload.github.com/lldpd/lldpd/tar.gz/$(PKG_VERSION)?
-PKG_HASH:=bdb1f9e29f61c3be99e421e88a431536c53e62f1ab7189a6d5b8e1d2d55d8899
+PKG_SOURCE_URL:=https://github.com/lldpd/lldpd/releases/download/$(PKG_VERSION)/
+PKG_HASH:=89ae691a4917ac9e0ec3b8b2c1e634cc402d43b804f98850c73bd1c7df380882
 
 PKG_MAINTAINER:=Stijn Tintel <stijn@linux-ipv6.be>
 PKG_LICENSE:=ISC
@@ -21,6 +21,7 @@ PKG_CPE_ID:=cpe:/a:lldpd_project:lldpd
 
 PKG_FIXUP:=autoreconf
 PKG_BUILD_PARALLEL:=1
+PKG_BUILD_FLAGS:=lto
 PKG_INSTALL:=1
 
 include $(INCLUDE_DIR)/package.mk
@@ -111,7 +112,6 @@ CONFIGURE_ARGS += \
 	$(if $(CONFIG_LLDPD_WITH_SNMP),--with-snmp,) \
 	$(if $(CONFIG_USE_GLIBC),,--without-libbsd)
 
-TARGET_CFLAGS += -flto
-TARGET_LDFLAGS += -flto -Wl,--gc-sections,--as-needed
+TARGET_LDFLAGS += -Wl,--gc-sections,--as-needed
 
 $(eval $(call BuildPackage,lldpd))
diff --git a/package/network/services/odhcpd/Makefile b/package/network/services/odhcpd/Makefile
index 21c87eaad43e6b..c471c7c75d2fad 100644
--- a/package/network/services/odhcpd/Makefile
+++ b/package/network/services/odhcpd/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=odhcpd
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/odhcpd.git
-PKG_SOURCE_DATE:=2022-03-22
-PKG_SOURCE_VERSION:=860ca900e41c5d0f98cc85e67b39977f6f2cb355
-PKG_MIRROR_HASH:=555712a1e25d197e52808a0d5e42bf0d48a8b61fe7c8aad1a02a7c09f0b8b8a3
+PKG_MIRROR_HASH:=c2851b577d1ee632c902eca1864444fa22cad98956bfa852019e6d621c0f8d2a
+PKG_SOURCE_DATE:=2023-04-05
+PKG_SOURCE_VERSION:=40ab806bf4c8698ac925d094ce11ce1d57ae2e46
 
 PKG_MAINTAINER:=Hans Dedecker <dedeckeh@gmail.com>
 PKG_LICENSE:=GPL-2.0
diff --git a/package/network/services/ppp/Makefile b/package/network/services/ppp/Makefile
index 10e9bdfdfe1e77..40ec5c5cf12da7 100644
--- a/package/network/services/ppp/Makefile
+++ b/package/network/services/ppp/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=ppp
-PKG_RELEASE:=3
+PKG_RELEASE:=5
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/paulusmack/ppp
@@ -26,6 +26,7 @@ PKG_VERSION:=$(PKG_RELEASE_VERSION).git-$(PKG_SOURCE_DATE)
 PKG_BUILD_DEPENDS:=libpcap
 
 PKG_ASLR_PIE_REGULAR:=1
+PKG_BUILD_FLAGS:=gc-sections lto
 PKG_BUILD_PARALLEL:=1
 PKG_INSTALL:=1
 
@@ -192,9 +193,6 @@ $(call Build/Configure/Default,, \
 		$(PKG_BUILD_DIR)/pppd/plugins/pppoatm/linux/
 endef
 
-TARGET_CFLAGS += -ffunction-sections -fdata-sections -flto
-TARGET_LDFLAGS += -Wl,--gc-sections -flto -fuse-linker-plugin
-
 MAKE_FLAGS += COPTS="$(TARGET_CFLAGS)" \
 		PRECOMPILED_FILTER=1 \
 		STAGING_DIR="$(STAGING_DIR)"
diff --git a/package/network/services/ppp/files/ppp.sh b/package/network/services/ppp/files/ppp.sh
index 7bbc497c43bd44..6d3a8e29ffae21 100755
--- a/package/network/services/ppp/files/ppp.sh
+++ b/package/network/services/ppp/files/ppp.sh
@@ -220,9 +220,7 @@ proto_pppoe_setup() {
 	local config="$1"
 	local iface="$2"
 
-	for module in slhc ppp_generic pppox pppoe; do
-		/sbin/insmod $module 2>&- >&-
-	done
+	/sbin/modprobe -qa slhc ppp_generic pppox pppoe
 
 	json_get_var mtu mtu
 	mtu="${mtu:-1492}"
@@ -262,9 +260,7 @@ proto_pppoa_setup() {
 	local config="$1"
 	local iface="$2"
 
-	for module in slhc ppp_generic pppox pppoatm; do
-		/sbin/insmod $module 2>&- >&-
-	done
+	/sbin/modprobe -qa slhc ppp_generic pppox pppoatm
 
 	json_get_vars atmdev vci vpi encaps
 
@@ -311,13 +307,8 @@ proto_pptp_setup() {
 		exit 1
 	}
 
-	local load
-	for module in slhc ppp_generic ppp_async ppp_mppe ip_gre gre pptp; do
-		grep -q "^$module " /proc/modules && continue
-		/sbin/insmod $module 2>&- >&-
-		load=1
-	done
-	[ "$load" = "1" ] && sleep 1
+	/sbin/modprobe -qa slhc ppp_generic ppp_async ppp_mppe ip_gre gre pptp
+	sleep 1
 
 	ppp_generic_setup "$config" \
 		plugin pptp.so \
@@ -335,4 +326,3 @@ proto_pptp_teardown() {
 	[ -f /usr/lib/pppd/*/pppoatm.so ] && add_protocol pppoa
 	[ -f /usr/lib/pppd/*/pptp.so ] && add_protocol pptp
 }
-
diff --git a/package/network/services/ppp/patches/140-pppd-Fix-compilation-with-older-glibc-or-kernel-head.patch b/package/network/services/ppp/patches/140-pppd-Fix-compilation-with-older-glibc-or-kernel-head.patch
new file mode 100644
index 00000000000000..154ac7270bf311
--- /dev/null
+++ b/package/network/services/ppp/patches/140-pppd-Fix-compilation-with-older-glibc-or-kernel-head.patch
@@ -0,0 +1,54 @@
+From 98ec18f098e5ef68e3a8cc6954fcaf5a7fb8b7be Mon Sep 17 00:00:00 2001
+From: pali <7141871+pali@users.noreply.github.com>
+Date: Mon, 15 Feb 2021 07:54:01 +0100
+Subject: [PATCH] pppd: Fix compilation with older glibc or kernel headers
+ (#248)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+glibc versions prior to 2.24 do not define SOL_NETLINK and linux kernel
+versions prior to 4.3 do not define NETLINK_CAP_ACK. So add fallback
+definitions for these macros into pppd/sys-linux.c file.
+
+Also extend description why we call SOL_NETLINK/NETLINK_CAP_ACK option.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+---
+ pppd/sys-linux.c | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+--- a/pppd/sys-linux.c
++++ b/pppd/sys-linux.c
+@@ -125,6 +125,14 @@
+ #include <linux/netlink.h>
+ #include <linux/rtnetlink.h>
+ #include <linux/if_addr.h>
++/* glibc versions prior to 2.24 do not define SOL_NETLINK */
++#ifndef SOL_NETLINK
++#define SOL_NETLINK 270
++#endif
++/* linux kernel versions prior to 4.3 do not define/support NETLINK_CAP_ACK */
++#ifndef NETLINK_CAP_ACK
++#define NETLINK_CAP_ACK 10
++#endif
+ #endif
+ 
+ #include "pppd.h"
+@@ -2843,7 +2851,15 @@ static int append_peer_ipv6_address(unsi
+     if (fd < 0)
+         return 0;
+ 
+-    /* do not ask for error message content */
++    /*
++     * Tell kernel to not send to us payload of acknowledgment error message.
++     * NETLINK_CAP_ACK option is supported since Linux kernel version 4.3 and
++     * older kernel versions always send full payload in acknowledgment netlink
++     * message. We ignore payload of this message as we need only error code,
++     * to check if our set remote peer address request succeeded or failed.
++     * So ignore return value from the following setsockopt() call as setting
++     * option NETLINK_CAP_ACK means for us just a kernel hint / optimization.
++     */
+     one = 1;
+     setsockopt(fd, SOL_NETLINK, NETLINK_CAP_ACK, &one, sizeof(one));
+ 
diff --git a/package/network/services/ppp/patches/141-Expand-byte-count-statistics-to-64-bits-298.patch b/package/network/services/ppp/patches/141-Expand-byte-count-statistics-to-64-bits-298.patch
new file mode 100644
index 00000000000000..e4de5c0aa21534
--- /dev/null
+++ b/package/network/services/ppp/patches/141-Expand-byte-count-statistics-to-64-bits-298.patch
@@ -0,0 +1,518 @@
+From 81ad945630120cc1c27c8bb00503be42b76ff202 Mon Sep 17 00:00:00 2001
+From: Jaco Kroon <jaco@uls.co.za>
+Date: Thu, 13 Jan 2022 08:38:04 +0200
+Subject: [PATCH] Expand byte count statistics to 64 bits (#298)
+
+* Add Gigawords to radius packets where applicable.
+
+IMPORTANT NOTE:  The ioctl() only supports 32-bit counters.  In order t
+obtain 64-bit counters, these are now pulled in from sysfs (it's assumed
+to be mounted on /sys which I'm assuming is standard).
+
+It is unknown whether sysfs will be available everywhere, as such, keep
+the ioctl() method in place, but attempt to detect wrap-overs.
+
+If the sysfs mechanism fails, fail back to the ioctl().
+
+Given maximum data rates, the intervals between calling this needs to be
+such that no more than 4GB (2^32) bytes are sent or received in any
+given interval.  Mostly important for radius plugin where data
+accounting may be in effect.
+
+Towards this, a timer interval on 25 seconds is set to force a ioctl()
+poll irrespective of the rate of stats update calls.  This may be
+important for especially radius that needs to provide interim-update
+intervals, if the interim updates is too long and the counters could
+wrap-over twice in a single interval.  At 25 seconds we should detect
+all wraps up to an effective data rate of 1.37Gbps, which for my
+purposes is adequate.
+
+Possible downsides, 4 files are opened, read and closed every time
+statistics is requested.  This results in 12 system calls every single
+time statistics is required, compared to 1 for the ioctl.  Efficiency is
+unknown, but as a rule of thumb fewer system calls are better, this is
+however not a critical path in my opinion, so should not be a problem.
+If required I can run a few benchmarks using gettimeofday() to measure
+actual impact.
+
+Signed-off-by: Jaco Kroon <jaco@uls.co.za>
+
+* Use netlink if possible to obtain 64-bit stats.
+
+This uses two system calls per round.
+
+This should be preferred where available.  It seems the RTM_GETSTATS was
+only added from 2016 some point (4.7.0 as per pali), which is in my
+opinion old, but given experience with certain embedded systems does
+need to be supported.
+
+Signed-off-by: Jaco Kroon <jaco@uls.co.za>
+
+Co-authored-by: Jaco Kroon <jaco@iewc.co.za>
+---
+ pppd/main.c                        |   5 +-
+ pppd/plugins/radius/etc/dictionary |   2 +
+ pppd/plugins/radius/radius.c       |  28 ++-
+ pppd/plugins/radius/radiusclient.h |   2 +
+ pppd/pppd.h                        |   9 +-
+ pppd/sys-linux.c                   | 281 ++++++++++++++++++++++++++++-
+ 6 files changed, 313 insertions(+), 14 deletions(-)
+
+--- a/pppd/main.c
++++ b/pppd/main.c
+@@ -87,6 +87,7 @@
+ #include <sys/socket.h>
+ #include <netinet/in.h>
+ #include <arpa/inet.h>
++#include <inttypes.h>
+ 
+ #include "pppd.h"
+ #include "magic.h"
+@@ -1230,9 +1231,9 @@ update_link_stats(int u)
+ 
+     slprintf(numbuf, sizeof(numbuf), "%u", link_connect_time);
+     script_setenv("CONNECT_TIME", numbuf, 0);
+-    slprintf(numbuf, sizeof(numbuf), "%u", link_stats.bytes_out);
++    snprintf(numbuf, sizeof(numbuf), "%" PRIu64, link_stats.bytes_out);
+     script_setenv("BYTES_SENT", numbuf, 0);
+-    slprintf(numbuf, sizeof(numbuf), "%u", link_stats.bytes_in);
++    snprintf(numbuf, sizeof(numbuf), "%" PRIu64, link_stats.bytes_in);
+     script_setenv("BYTES_RCVD", numbuf, 0);
+ }
+ 
+--- a/pppd/plugins/radius/etc/dictionary
++++ b/pppd/plugins/radius/etc/dictionary
+@@ -82,6 +82,8 @@ ATTRIBUTE	Acct-Session-Time	46	integer
+ ATTRIBUTE	Acct-Input-Packets	47	integer
+ ATTRIBUTE	Acct-Output-Packets	48	integer
+ ATTRIBUTE	Acct-Terminate-Cause	49	integer
++ATTRIBUTE	Acct-Input-Gigawords	52	integer
++ATTRIBUTE	Acct-Output-Gigawords	53	integer
+ ATTRIBUTE       Chap-Challenge          60      string
+ ATTRIBUTE	NAS-Port-Type		61	integer
+ ATTRIBUTE	Port-Limit		62	integer
+--- a/pppd/plugins/radius/radius.c
++++ b/pppd/plugins/radius/radius.c
+@@ -1020,12 +1020,22 @@ radius_acct_stop(void)
+ 	av_type = link_connect_time;
+ 	rc_avpair_add(&send, PW_ACCT_SESSION_TIME, &av_type, 0, VENDOR_NONE);
+ 
+-	av_type = link_stats.bytes_out;
++	av_type = link_stats.bytes_out & 0xFFFFFFFF;
+ 	rc_avpair_add(&send, PW_ACCT_OUTPUT_OCTETS, &av_type, 0, VENDOR_NONE);
+ 
+-	av_type = link_stats.bytes_in;
++	if (link_stats.bytes_out > 0xFFFFFFFF) {
++	    av_type = link_stats.bytes_out >> 32;
++	    rc_avpair_add(&send, PW_ACCT_OUTPUT_GIGAWORDS, &av_type, 0, VENDOR_NONE);
++	}
++
++	av_type = link_stats.bytes_in & 0xFFFFFFFF;
+ 	rc_avpair_add(&send, PW_ACCT_INPUT_OCTETS, &av_type, 0, VENDOR_NONE);
+ 
++	if (link_stats.bytes_in > 0xFFFFFFFF) {
++	    av_type = link_stats.bytes_in >> 32;
++	    rc_avpair_add(&send, PW_ACCT_INPUT_GIGAWORDS, &av_type, 0, VENDOR_NONE);
++	}
++
+ 	av_type = link_stats.pkts_out;
+ 	rc_avpair_add(&send, PW_ACCT_OUTPUT_PACKETS, &av_type, 0, VENDOR_NONE);
+ 
+@@ -1172,12 +1182,22 @@ radius_acct_interim(void *ignored)
+ 	av_type = link_connect_time;
+ 	rc_avpair_add(&send, PW_ACCT_SESSION_TIME, &av_type, 0, VENDOR_NONE);
+ 
+-	av_type = link_stats.bytes_out;
++	av_type = link_stats.bytes_out & 0xFFFFFFFF;
+ 	rc_avpair_add(&send, PW_ACCT_OUTPUT_OCTETS, &av_type, 0, VENDOR_NONE);
+ 
+-	av_type = link_stats.bytes_in;
++	if (link_stats.bytes_out > 0xFFFFFFFF) {
++	    av_type = link_stats.bytes_out >> 32;
++	    rc_avpair_add(&send, PW_ACCT_OUTPUT_GIGAWORDS, &av_type, 0, VENDOR_NONE);
++	}
++
++	av_type = link_stats.bytes_in & 0xFFFFFFFF;
+ 	rc_avpair_add(&send, PW_ACCT_INPUT_OCTETS, &av_type, 0, VENDOR_NONE);
+ 
++	if (link_stats.bytes_in > 0xFFFFFFFF) {
++	    av_type = link_stats.bytes_in >> 32;
++	    rc_avpair_add(&send, PW_ACCT_INPUT_GIGAWORDS, &av_type, 0, VENDOR_NONE);
++	}
++
+ 	av_type = link_stats.pkts_out;
+ 	rc_avpair_add(&send, PW_ACCT_OUTPUT_PACKETS, &av_type, 0, VENDOR_NONE);
+ 
+--- a/pppd/plugins/radius/radiusclient.h
++++ b/pppd/plugins/radius/radiusclient.h
+@@ -184,6 +184,8 @@ typedef struct pw_auth_hdr
+ #define PW_ACCT_LINK_COUNT		51	/* integer */
+ 
+ /* From RFC 2869 */
++#define PW_ACCT_INPUT_GIGAWORDS         52	/* integer */
++#define PW_ACCT_OUTPUT_GIGAWORDS        53	/* integer */
+ #define PW_ACCT_INTERIM_INTERVAL        85	/* integer */
+ 
+ /*	Merit Experimental Extensions */
+--- a/pppd/pppd.h
++++ b/pppd/pppd.h
+@@ -53,6 +53,7 @@
+ #include <stdlib.h>		/* for encrypt */
+ #include <unistd.h>		/* for setkey */
+ #include <stdarg.h>
++#include <stdint.h>
+ #include <limits.h>		/* for NGROUPS_MAX */
+ #include <sys/param.h>		/* for MAXPATHLEN and BSD4_4, if defined */
+ #include <sys/types.h>		/* for u_int32_t, if defined */
+@@ -173,8 +174,8 @@ struct permitted_ip {
+  * pppd needs.
+  */
+ struct pppd_stats {
+-    unsigned int	bytes_in;
+-    unsigned int	bytes_out;
++    uint64_t		bytes_in;
++    uint64_t		bytes_out;
+     unsigned int	pkts_in;
+     unsigned int	pkts_out;
+ };
+@@ -347,7 +348,7 @@ extern char *max_tls_version;
+ extern unsigned int maxoctets;	     /* Maximum octetes per session (in bytes) */
+ extern int       maxoctets_dir;      /* Direction :
+ 				      0 - in+out (default)
+-				      1 - in 
++				      1 - in
+ 				      2 - out
+ 				      3 - max(in,out) */
+ extern int       maxoctets_timeout;  /* Timeout for check of octets limit */
+@@ -356,7 +357,7 @@ extern int       maxoctets_timeout;  /*
+ #define PPP_OCTETS_DIRECTION_OUT        2
+ #define PPP_OCTETS_DIRECTION_MAXOVERAL  3
+ /* same as previos, but little different on RADIUS side */
+-#define PPP_OCTETS_DIRECTION_MAXSESSION 4	
++#define PPP_OCTETS_DIRECTION_MAXSESSION 4
+ #endif
+ 
+ #ifdef PPP_FILTER
+--- a/pppd/sys-linux.c
++++ b/pppd/sys-linux.c
+@@ -79,6 +79,7 @@
+ #include <sys/sysmacros.h>
+ 
+ #include <errno.h>
++#include <stddef.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <syslog.h>
+@@ -92,6 +93,7 @@
+ #include <ctype.h>
+ #include <termios.h>
+ #include <unistd.h>
++#include <limits.h>
+ 
+ /* This is in netdevice.h. However, this compile will fail miserably if
+    you attempt to include netdevice.h because it has so many references
+@@ -121,9 +123,19 @@
+ #include <linux/ppp_defs.h>
+ #include <linux/if_ppp.h>
+ 
+-#ifdef INET6
+ #include <linux/netlink.h>
+ #include <linux/rtnetlink.h>
++#include <linux/if_link.h>
++/* Attempt at retaining compile-support with older than 4.7 kernels, or kernels
++ * where RTM_NEWSTATS isn't defined for whatever reason.
++ */
++#ifndef RTM_NEWSTATS
++#define RTM_NEWSTATS 92
++#define RTM_GETSTATS 94
++#define IFLA_STATS_LINK_64 1
++#endif
++
++#ifdef INET6
+ #include <linux/if_addr.h>
+ /* glibc versions prior to 2.24 do not define SOL_NETLINK */
+ #ifndef SOL_NETLINK
+@@ -1407,11 +1419,17 @@ get_idle_time(int u, struct ppp_idle *ip
+ 
+ /********************************************************************
+  *
+- * get_ppp_stats - return statistics for the link.
++ * get_ppp_stats_iocl - return statistics for the link, using the ioctl() method,
++ * this only supports 32-bit counters, so need to count the wraps.
+  */
+-int
+-get_ppp_stats(int u, struct pppd_stats *stats)
++static int
++get_ppp_stats_ioctl(int u, struct pppd_stats *stats)
+ {
++    static u_int32_t previbytes = 0;
++    static u_int32_t prevobytes = 0;
++    static u_int32_t iwraps = 0;
++    static u_int32_t owraps = 0;
++
+     struct ifpppstatsreq req;
+ 
+     memset (&req, 0, sizeof (req));
+@@ -1426,7 +1444,262 @@ get_ppp_stats(int u, struct pppd_stats *
+     stats->bytes_out = req.stats.p.ppp_obytes;
+     stats->pkts_in = req.stats.p.ppp_ipackets;
+     stats->pkts_out = req.stats.p.ppp_opackets;
++
++    if (stats->bytes_in < previbytes)
++	++iwraps;
++    if (stats->bytes_out < prevobytes)
++	++owraps;
++
++    previbytes = stats->bytes_in;
++    prevobytes = stats->bytes_out;
++
++    stats->bytes_in += (uint64_t)iwraps << 32;
++    stats->bytes_out += (uint64_t)owraps << 32;
++
++    return 1;
++}
++
++/********************************************************************
++ * get_ppp_stats_rtnetlink - return statistics for the link, using rtnetlink
++ * This provides native 64-bit counters.
++ */
++static int
++get_ppp_stats_rtnetlink(int u, struct pppd_stats *stats)
++{
++    static int rtnl_fd = -1;
++
++    struct sockaddr_nl nladdr;
++    struct {
++        struct nlmsghdr nlh;
++        struct if_stats_msg ifsm;
++    } nlreq;
++    struct nlresp {
++        struct nlmsghdr nlh;
++	union {
++	    struct {
++		struct nlmsgerr nlerr;
++		char __end_err[0];
++	    };
++	    struct {
++		struct rtmsg rth;
++		struct  {
++		    /* We only case about these first fields from rtnl_link_stats64 */
++		    uint64_t rx_packets;
++		    uint64_t tx_packets;
++		    uint64_t rx_bytes;
++		    uint64_t tx_bytes;
++		} stats;
++		char __end_stats[0];
++	    };
++	};
++    } nlresp;
++    ssize_t nlresplen;
++    struct iovec iov;
++    struct msghdr msg;
++
++    memset(&nladdr, 0, sizeof(nladdr));
++    nladdr.nl_family = AF_NETLINK;
++
++    if (rtnl_fd < 0) {
++	rtnl_fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
++	if (rtnl_fd < 0) {
++	    error("get_ppp_stats_rtnetlink: error creating NETLINK socket: %m (line %d)", __LINE__);
++	    return 0;
++	}
++
++	if (bind(rtnl_fd, (struct sockaddr *)&nladdr, sizeof(nladdr)) < 0) {
++	    error("get_ppp_stats_rtnetlink: bind(AF_NETLINK): %m (line %d)", __LINE__);
++	    goto err;
++	}
++    }
++
++    memset(&nlreq, 0, sizeof(nlreq));
++    nlreq.nlh.nlmsg_len = sizeof(nlreq);
++    nlreq.nlh.nlmsg_type = RTM_GETSTATS;
++    nlreq.nlh.nlmsg_flags = NLM_F_REQUEST;
++
++    nlreq.ifsm.ifindex = if_nametoindex(ifname);
++    nlreq.ifsm.filter_mask = IFLA_STATS_LINK_64;
++
++    memset(&iov, 0, sizeof(iov));
++    iov.iov_base = &nlreq;
++    iov.iov_len = sizeof(nlreq);
++
++    memset(&msg, 0, sizeof(msg));
++    msg.msg_name = &nladdr;
++    msg.msg_namelen = sizeof(nladdr);
++    msg.msg_iov = &iov;
++    msg.msg_iovlen = 1;
++
++    if (sendmsg(rtnl_fd, &msg, 0) < 0) {
++        error("get_ppp_stats_rtnetlink: sendmsg(RTM_GETSTATS): %m (line %d)", __LINE__);
++	goto err;
++    }
++
++    /* We just need to repoint to IOV ... everything else stays the same */
++    iov.iov_base = &nlresp;
++    iov.iov_len = sizeof(nlresp);
++
++    nlresplen = recvmsg(rtnl_fd, &msg, 0);
++
++    if (nlresplen < 0) {
++        error("get_ppp_stats_rtnetlink: recvmsg(RTM_GETSTATS): %m (line %d)", __LINE__);
++	goto err;
++    }
++
++    if (nlresplen < sizeof(nlresp.nlh)) {
++	error("get_ppp_stats_rtnetlink: Netlink response message was incomplete (line %d)", __LINE__);
++	goto err;
++    }
++
++    if (nlresp.nlh.nlmsg_type == NLMSG_ERROR) {
++	if (nlresplen < offsetof(struct nlresp, __end_err)) {
++	    if (kernel_version >= KVERSION(4,7,0))
++		error("get_ppp_stats_rtnetlink: Netlink responded with error: %s (line %d)", strerror(-nlresp.nlerr.error), __LINE__);
++	} else {
++	    error("get_ppp_stats_rtnetlink: Netlink responded with an error message, but the nlmsgerr structure is incomplete (line %d).",
++		    __LINE__);
++	}
++	goto err;
++    }
++
++    if (nlresp.nlh.nlmsg_type != RTM_NEWSTATS) {
++	error("get_ppp_stats_rtnetlink: Expected RTM_NEWSTATS response, found something else (mlmsg_type %d, line %d)",
++		nlresp.nlh.nlmsg_type, __LINE__);
++	goto err;
++    }
++
++    if (nlresplen < offsetof(struct nlresp, __end_stats)) {
++	error("get_ppp_stats_rtnetlink: Obtained an insufficiently sized rtnl_link_stats64 struct from the kernel (line %d).", __LINE__);
++	goto err;
++    }
++
++    stats->bytes_in  = nlresp.stats.rx_bytes;
++    stats->bytes_out = nlresp.stats.tx_bytes;
++    stats->pkts_in   = nlresp.stats.rx_packets;
++    stats->pkts_out  = nlresp.stats.tx_packets;
++
+     return 1;
++err:
++    close(rtnl_fd);
++    rtnl_fd = -1;
++    return 0;
++}
++
++/********************************************************************
++ * get_ppp_stats_sysfs - return statistics for the link, using the files in sysfs,
++ * this provides native 64-bit counters.
++ */
++static int
++get_ppp_stats_sysfs(int u, struct pppd_stats *stats)
++{
++    char fname[PATH_MAX+1];
++    char buf[21], *err; /* 2^64 < 10^20 */
++    int blen, fd, rlen;
++    unsigned long long val;
++
++    struct {
++	const char* fname;
++	void* ptr;
++	unsigned size;
++    } slist[] = {
++#define statfield(fn, field)	{ .fname = #fn, .ptr = &stats->field, .size = sizeof(stats->field) }
++	statfield(rx_bytes, bytes_in),
++	statfield(tx_bytes, bytes_out),
++	statfield(rx_packets, pkts_in),
++	statfield(tx_packets, pkts_out),
++#undef statfield
++    };
++
++    blen = snprintf(fname, sizeof(fname), "/sys/class/net/%s/statistics/", ifname);
++    if (blen >= sizeof(fname))
++	return 0; /* ifname max 15, so this should be impossible */
++
++    for (int i = 0; i < sizeof(slist) / sizeof(*slist); ++i) {
++	if (snprintf(fname + blen, sizeof(fname) - blen, "%s", slist[i].fname) >= sizeof(fname) - blen) {
++	    fname[blen] = 0;
++	    error("sysfs stats: filename %s/%s overflowed PATH_MAX", fname, slist[i].fname);
++	    return 0;
++	}
++
++	fd = open(fname, O_RDONLY);
++	if (fd < 0) {
++	    error("%s: %m", fname);
++	    return 0;
++	}
++
++	rlen = read(fd, buf, sizeof(buf) - 1);
++	close(fd);
++	if (rlen < 0) {
++	    error("%s: %m", fname);
++	    return 0;
++	}
++	/* trim trailing \n if present */
++	while (rlen > 0 && buf[rlen-1] == '\n')
++	    rlen--;
++	buf[rlen] = 0;
++
++	errno = 0;
++	val = strtoull(buf, &err, 10);
++	if (*buf < '0' || *buf > '9' || errno != 0 || *err) {
++	    error("string to number conversion error converting %s (from %s) for remaining string %s%s%s",
++		    buf, fname, err, errno ? ": " : "", errno ? strerror(errno) : "");
++	    return 0;
++	}
++	switch (slist[i].size) {
++#define stattype(type)	case sizeof(type): *(type*)slist[i].ptr = (type)val; break
++	    stattype(uint64_t);
++	    stattype(uint32_t);
++	    stattype(uint16_t);
++	    stattype(uint8_t);
++#undef stattype
++	default:
++	    error("Don't know how to store stats for %s of size %u", slist[i].fname, slist[i].size);
++	    return 0;
++	}
++    }
++
++    return 1;
++}
++
++/********************************************************************
++ * Periodic timer function to be used to keep stats up to date in case of ioctl
++ * polling.
++ *
++ * Given the 25s interval this should be fine up to data rates of 1.37Gbps.
++ * If you do change the timer, remember to also bring the get_ppp_stats (which
++ * sets up the initial trigger) as well.
++ */
++static void
++ppp_stats_poller(void* u)
++{
++    struct pppd_stats dummy;
++    get_ppp_stats_ioctl((long)u, &dummy);
++    TIMEOUT(ppp_stats_poller, u, 25);
++}
++
++/********************************************************************
++ * get_ppp_stats - return statistics for the link.
++ */
++int get_ppp_stats(int u, struct pppd_stats *stats)
++{
++    static int (*func)(int, struct pppd_stats*) = NULL;
++
++    if (!func) {
++	if (get_ppp_stats_rtnetlink(u, stats)) {
++	    func = get_ppp_stats_rtnetlink;
++	    return 1;
++	}
++	if (get_ppp_stats_sysfs(u, stats)) {
++	    func = get_ppp_stats_sysfs;
++	    return 1;
++	}
++	warn("statistics falling back to ioctl which only supports 32-bit counters");
++	func = get_ppp_stats_ioctl;
++	TIMEOUT(ppp_stats_poller, (void*)(long)u, 25);
++    }
++
++    return func(u, stats);
+ }
+ 
+ /********************************************************************
diff --git a/package/network/services/ppp/patches/142-pppd-Add-support-for-registering-ppp-interface-via-L.patch b/package/network/services/ppp/patches/142-pppd-Add-support-for-registering-ppp-interface-via-L.patch
new file mode 100644
index 00000000000000..9987d3dce9d15e
--- /dev/null
+++ b/package/network/services/ppp/patches/142-pppd-Add-support-for-registering-ppp-interface-via-L.patch
@@ -0,0 +1,299 @@
+From 4a54e34cf5629f9fed61f0b7d69ee3ba4d874bc6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
+Date: Sat, 9 Jul 2022 13:40:24 +0200
+Subject: [PATCH] pppd: Add support for registering ppp interface via Linux
+ rtnetlink API
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+pppd currently creates ppp network interface via PPPIOCNEWUNIT ioctl API.
+This API creates a new ppp network interface named "ppp<unit_id>". If user
+supply option "ifname" with custom network name then pppd calls SIOCSIFNAME
+ioctl to rename "ppp<unit_id>" to custom name immediately after successful
+PPPIOCNEWUNIT ioctl call. If custom name is already registered then
+SIOCSIFNAME ioctl fails and pppd close current channel (which destroy also
+network interface).
+
+This has side effect that in the first few miliseconds interface has
+different name as what user supplied.
+
+Tools like systemd, udev or NetworkManager are trying to query
+interface attributes based on interface name immediately when new
+network interface is created.
+
+But if interface is renamed immediately after creation then these tools
+fails. For example when running pppd with option "ifname ppp-wan" following
+error is reported by systemd / udev into dmesg log:
+
+    [   35.718732] PPP generic driver version 2.4.2
+    [   35.793914] NET: Registered protocol family 24
+    [   35.889924] systemd-udevd[1852]: link_config: autonegotiation is unset or enabled, the speed and duplex are not writable.
+    [   35.901450] ppp-wan: renamed from ppp0
+    [   35.930332] systemd-udevd[1852]: link_config: could not get ethtool features for ppp0
+    [   35.939473] systemd-udevd[1852]: Could not set offload features of ppp0: No such device
+
+There is an easy way to fix this issue: Use new rtnetlink API.
+
+Via rtnetlink API it is possible to create ppp network interface with
+custom ifname atomically. Just it is not possible to specify custom ppp
+unit id.
+
+So use new rtnetlink API when user requested custom ifname without custom
+ppp unit id. This will avoid system issues with interface renaming as ppp
+interface is directly registered with specified final name.
+
+This has also advantage that if requested interface name already exists
+then pppd fail during registering of networking interface and not during
+renaming network interface which happens after successful registration.
+
+If user supply custom ppp unit id then it is required to use old ioctl API
+as currently it is the only API which allows specifying ppp unit id.
+
+When user does not specify custom ifname stay also with old ioctl API.
+There is currently a bug in kernel which cause that when empty interface is
+specified in rtnetlink message for creating ppp interface then kernel
+creates ppp interface but with pseudo-random name, not derived from ppp
+unit id. And therefore it is not possible to retrieve what is the name of
+newly created network interface. So when user does not specify interface
+name via "ifname" option (which means that want from kernel to choose some
+"free" interface name) it is needed to use old ioctl API which do it
+correctly for now.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+---
+ pppd/sys-linux.c | 194 ++++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 192 insertions(+), 2 deletions(-)
+
+--- a/pppd/sys-linux.c
++++ b/pppd/sys-linux.c
+@@ -126,6 +126,11 @@
+ #include <linux/netlink.h>
+ #include <linux/rtnetlink.h>
+ #include <linux/if_link.h>
++
++#ifdef INET6
++#include <linux/if_addr.h>
++#endif
++
+ /* Attempt at retaining compile-support with older than 4.7 kernels, or kernels
+  * where RTM_NEWSTATS isn't defined for whatever reason.
+  */
+@@ -135,16 +140,20 @@
+ #define IFLA_STATS_LINK_64 1
+ #endif
+ 
+-#ifdef INET6
+-#include <linux/if_addr.h>
+ /* glibc versions prior to 2.24 do not define SOL_NETLINK */
+ #ifndef SOL_NETLINK
+ #define SOL_NETLINK 270
+ #endif
++
+ /* linux kernel versions prior to 4.3 do not define/support NETLINK_CAP_ACK */
+ #ifndef NETLINK_CAP_ACK
+ #define NETLINK_CAP_ACK 10
+ #endif
++
++/* linux kernel versions prior to 4.7 do not define/support IFLA_PPP_DEV_FD */
++#ifndef IFLA_PPP_MAX
++/* IFLA_PPP_DEV_FD is declared as enum when IFLA_PPP_MAX is defined */
++#define IFLA_PPP_DEV_FD 1
+ #endif
+ 
+ #include "pppd.h"
+@@ -657,6 +666,160 @@ void generic_disestablish_ppp(int dev_fd
+ }
+ 
+ /*
++ * make_ppp_unit_rtnetlink - register a new ppp network interface for ppp_dev_fd
++ * with specified req_ifname via rtnetlink. Interface name req_ifname must not
++ * be empty. Custom ppp unit id req_unit is ignored and kernel choose some free.
++ */
++static int make_ppp_unit_rtnetlink(void)
++{
++    struct {
++        struct nlmsghdr nlh;
++        struct ifinfomsg ifm;
++        struct {
++            struct rtattr rta;
++            char ifname[IFNAMSIZ];
++        } ifn;
++        struct {
++            struct rtattr rta;
++            struct {
++                struct rtattr rta;
++                char ifkind[sizeof("ppp")];
++            } ifik;
++            struct {
++                struct rtattr rta;
++                struct {
++                    struct rtattr rta;
++                    union {
++                        int ppp_dev_fd;
++                    } ppp;
++                } ifdata[1];
++            } ifid;
++        } ifli;
++    } nlreq;
++    struct {
++        struct nlmsghdr nlh;
++        struct nlmsgerr nlerr;
++    } nlresp;
++    struct sockaddr_nl nladdr;
++    struct iovec iov;
++    struct msghdr msg;
++    ssize_t nlresplen;
++    int one;
++    int fd;
++
++    fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
++    if (fd < 0) {
++        error("make_ppp_unit_rtnetlink: socket(NETLINK_ROUTE): %m (line %d)", __LINE__);
++        return 0;
++    }
++
++    /* Tell kernel to not send to us payload of acknowledgment error message. */
++    one = 1;
++    setsockopt(fd, SOL_NETLINK, NETLINK_CAP_ACK, &one, sizeof(one));
++
++    memset(&nladdr, 0, sizeof(nladdr));
++    nladdr.nl_family = AF_NETLINK;
++
++    if (bind(fd, (struct sockaddr *)&nladdr, sizeof(nladdr)) < 0) {
++        error("make_ppp_unit_rtnetlink: bind(AF_NETLINK): %m (line %d)", __LINE__);
++        close(fd);
++        return 0;
++    }
++
++    memset(&nlreq, 0, sizeof(nlreq));
++    nlreq.nlh.nlmsg_len = sizeof(nlreq);
++    nlreq.nlh.nlmsg_type = RTM_NEWLINK;
++    nlreq.nlh.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | NLM_F_EXCL | NLM_F_CREATE;
++    nlreq.ifm.ifi_family = AF_UNSPEC;
++    nlreq.ifm.ifi_type = ARPHRD_NETROM;
++    nlreq.ifn.rta.rta_len = sizeof(nlreq.ifn);
++    nlreq.ifn.rta.rta_type = IFLA_IFNAME;
++    strlcpy(nlreq.ifn.ifname, req_ifname, sizeof(nlreq.ifn.ifname));
++    nlreq.ifli.rta.rta_len = sizeof(nlreq.ifli);
++    nlreq.ifli.rta.rta_type = IFLA_LINKINFO;
++    nlreq.ifli.ifik.rta.rta_len = sizeof(nlreq.ifli.ifik);
++    nlreq.ifli.ifik.rta.rta_type = IFLA_INFO_KIND;
++    strcpy(nlreq.ifli.ifik.ifkind, "ppp");
++    nlreq.ifli.ifid.rta.rta_len = sizeof(nlreq.ifli.ifid);
++    nlreq.ifli.ifid.rta.rta_type = IFLA_INFO_DATA;
++    nlreq.ifli.ifid.ifdata[0].rta.rta_len = sizeof(nlreq.ifli.ifid.ifdata[0]);
++    nlreq.ifli.ifid.ifdata[0].rta.rta_type = IFLA_PPP_DEV_FD;
++    nlreq.ifli.ifid.ifdata[0].ppp.ppp_dev_fd = ppp_dev_fd;
++
++    memset(&nladdr, 0, sizeof(nladdr));
++    nladdr.nl_family = AF_NETLINK;
++
++    memset(&iov, 0, sizeof(iov));
++    iov.iov_base = &nlreq;
++    iov.iov_len = sizeof(nlreq);
++
++    memset(&msg, 0, sizeof(msg));
++    msg.msg_name = &nladdr;
++    msg.msg_namelen = sizeof(nladdr);
++    msg.msg_iov = &iov;
++    msg.msg_iovlen = 1;
++
++    if (sendmsg(fd, &msg, 0) < 0) {
++        error("make_ppp_unit_rtnetlink: sendmsg(RTM_NEWLINK/NLM_F_CREATE): %m (line %d)", __LINE__);
++        close(fd);
++        return 0;
++    }
++
++    memset(&iov, 0, sizeof(iov));
++    iov.iov_base = &nlresp;
++    iov.iov_len = sizeof(nlresp);
++
++    memset(&msg, 0, sizeof(msg));
++    msg.msg_name = &nladdr;
++    msg.msg_namelen = sizeof(nladdr);
++    msg.msg_iov = &iov;
++    msg.msg_iovlen = 1;
++
++    nlresplen = recvmsg(fd, &msg, 0);
++
++    if (nlresplen < 0) {
++        error("make_ppp_unit_rtnetlink: recvmsg(NLM_F_ACK): %m (line %d)", __LINE__);
++        close(fd);
++        return 0;
++    }
++
++    close(fd);
++
++    if (nladdr.nl_family != AF_NETLINK) {
++        error("make_ppp_unit_rtnetlink: recvmsg(NLM_F_ACK): Not a netlink packet (line %d)", __LINE__);
++        return 0;
++    }
++
++    if ((size_t)nlresplen < sizeof(nlresp) || nlresp.nlh.nlmsg_len < sizeof(nlresp)) {
++        error("make_ppp_unit_rtnetlink: recvmsg(NLM_F_ACK): Acknowledgment netlink packet too short (line %d)", __LINE__);
++        return 0;
++    }
++
++    /* acknowledgment packet for NLM_F_ACK is NLMSG_ERROR */
++    if (nlresp.nlh.nlmsg_type != NLMSG_ERROR) {
++        error("make_ppp_unit_rtnetlink: recvmsg(NLM_F_ACK): Not an acknowledgment netlink packet (line %d)", __LINE__);
++        return 0;
++    }
++
++    /* error == 0 indicates success, negative value is errno code */
++    if (nlresp.nlerr.error != 0) {
++        /*
++         * Linux kernel versions prior to 4.7 do not support creating ppp
++         * interfaces via rtnetlink API and therefore error response is
++         * expected. On older kernel versions do not show this error message.
++         * When error is different than EEXIST then pppd tries to fallback to
++         * the old ioctl method.
++         */
++        errno = (nlresp.nlerr.error < 0) ? -nlresp.nlerr.error : EINVAL;
++        if (kernel_version >= KVERSION(4,7,0))
++            error("Couldn't create ppp interface %s: %m", req_ifname);
++        return 0;
++    }
++
++    return 1;
++}
++
++/*
+  * make_ppp_unit - make a new ppp unit for ppp_dev_fd.
+  * Assumes new_style_driver.
+  */
+@@ -676,6 +839,33 @@ static int make_ppp_unit(void)
+ 	    || fcntl(ppp_dev_fd, F_SETFL, flags | O_NONBLOCK) == -1)
+ 		warn("Couldn't set /dev/ppp to nonblock: %m");
+ 
++	/*
++	 * Via rtnetlink it is possible to create ppp network interface with
++	 * custom ifname atomically. But it is not possible to specify custom
++	 * ppp unit id.
++	 *
++	 * Tools like systemd, udev or NetworkManager are trying to query
++	 * interface attributes based on interface name immediately when new
++	 * network interface is created. And therefore immediate interface
++	 * renaming is causing issues.
++	 *
++	 * So use rtnetlink API only when user requested custom ifname. It will
++	 * avoid system issues with interface renaming.
++	 */
++	if (req_unit == -1 && req_ifname[0] != '\0' && kernel_version >= KVERSION(2,1,16)) {
++	    if (make_ppp_unit_rtnetlink()) {
++		if (ioctl(ppp_dev_fd, PPPIOCGUNIT, &ifunit))
++		    fatal("Couldn't retrieve PPP unit id: %m");
++		return 0;
++	    }
++	    /*
++	     * If interface with requested name already exist return error
++	     * otherwise fallback to old ioctl method.
++	     */
++	    if (errno == EEXIST)
++		return -1;
++	}
++
+ 	ifunit = req_unit;
+ 	x = ioctl(ppp_dev_fd, PPPIOCNEWUNIT, &ifunit);
+ 	if (x < 0 && req_unit >= 0 && errno == EEXIST) {
diff --git a/package/network/services/ppp/patches/143-pppd-Workaround-for-generating-ppp-unit-id-on-Linux-.patch b/package/network/services/ppp/patches/143-pppd-Workaround-for-generating-ppp-unit-id-on-Linux-.patch
new file mode 100644
index 00000000000000..abe559e0748acc
--- /dev/null
+++ b/package/network/services/ppp/patches/143-pppd-Workaround-for-generating-ppp-unit-id-on-Linux-.patch
@@ -0,0 +1,59 @@
+From 44609bfc974bdafc0316d069aabf5e2903efa805 Mon Sep 17 00:00:00 2001
+From: pali <7141871+pali@users.noreply.github.com>
+Date: Tue, 9 Aug 2022 11:20:15 +0200
+Subject: [PATCH] pppd: Workaround for generating ppp unit id on Linux (#355)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Linux kernel has nasty bug / feature. If PPPIOCNEWUNIT is called with
+negative ppp unit id (which is default option when command line argument
+"unit" is not specified; and tells kernel to choose some free ppp unit id)
+and the lowest unused/free ppp unit id is present in some existing network
+interface name prefixed by "ppp" string then this PPPIOCNEWUNIT ioctl
+fails. In this case kernel is basically unable to create a new ppp
+interface via PPPIOCNEWUNIT ioctl when user does not specify some unused
+and non-conflicted unit id.
+
+Linux kernel should be fixed to choose usable ppp unit id when was
+requested via PPPIOCNEWUNIT parameter -1.
+
+Until this happens, add a workaround for pppd to help choosing some random
+ppp unit id when kernel returns this error.
+
+Simple test case (run on system when there is no ppp interface):
+
+    sudo ./pppd ifname ppp1 nodefaultroute noauth nolock local nodetach pty "./pppd nodefaultroute noauth nolock local nodetach notty"
+
+Second pppd process without this patch prints into syslog following error:
+
+    pppd 2.4.10-dev started by pali, uid 0
+    Couldn't create new ppp unit: File exists
+    Exit.
+
+With this patch it falls back to random ppp unit id and succeeds:
+
+    pppd 2.4.10-dev started by pali, uid 0
+    Using interface ppp1361
+    Connect: ppp1361 <--> /dev/pts/14
+    ...
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+---
+ pppd/sys-linux.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/pppd/sys-linux.c
++++ b/pppd/sys-linux.c
+@@ -873,6 +873,11 @@ static int make_ppp_unit(void)
+ 		ifunit = -1;
+ 		x = ioctl(ppp_dev_fd, PPPIOCNEWUNIT, &ifunit);
+ 	}
++	if (x < 0 && errno == EEXIST) {
++		srand(time(NULL) * getpid());
++		ifunit = rand() % 10000;
++		x = ioctl(ppp_dev_fd, PPPIOCNEWUNIT, &ifunit);
++	}
+ 	if (x < 0)
+ 		error("Couldn't create new ppp unit: %m");
+ 
diff --git a/package/network/services/ppp/patches/144-pppd-Retry-registering-interface-when-on-rtnetlink-E.patch b/package/network/services/ppp/patches/144-pppd-Retry-registering-interface-when-on-rtnetlink-E.patch
new file mode 100644
index 00000000000000..26c1e34683acb4
--- /dev/null
+++ b/package/network/services/ppp/patches/144-pppd-Retry-registering-interface-when-on-rtnetlink-E.patch
@@ -0,0 +1,218 @@
+From 089687fbcc6524809ae9f4b2f8145fe3c2a91147 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
+Date: Sat, 7 Aug 2021 19:48:01 +0200
+Subject: [PATCH] pppd: Retry registering interface when on rtnetlink -EBUSY
+ error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Due to workaround in kernel module ppp_generic.ko in function
+ppp_nl_newlink(), kernel may return -EBUSY error to prevent possible
+mutex deadlock. In this case userspace needs to retry its request.
+
+Proper way would be to fix kernel module to order requests and mutex
+locking, so prevent deadlock in kernel and so never return this error to
+userspace. Until it happens we need retry code in userspace.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+[ backport to ppp 2.4.9 ]
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ pppd/sys-linux.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/pppd/sys-linux.c
++++ b/pppd/sys-linux.c
+@@ -707,99 +707,101 @@ static int make_ppp_unit_rtnetlink(void)
+     int one;
+     int fd;
+ 
+-    fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
+-    if (fd < 0) {
+-        error("make_ppp_unit_rtnetlink: socket(NETLINK_ROUTE): %m (line %d)", __LINE__);
+-        return 0;
+-    }
+-
+-    /* Tell kernel to not send to us payload of acknowledgment error message. */
+-    one = 1;
+-    setsockopt(fd, SOL_NETLINK, NETLINK_CAP_ACK, &one, sizeof(one));
++    do {
++        fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
++        if (fd < 0) {
++            error("make_ppp_unit_rtnetlink: socket(NETLINK_ROUTE): %m (line %d)", __LINE__);
++            return 0;
++        }
++
++        /* Tell kernel to not send to us payload of acknowledgment error message. */
++        one = 1;
++        setsockopt(fd, SOL_NETLINK, NETLINK_CAP_ACK, &one, sizeof(one));
++
++        memset(&nladdr, 0, sizeof(nladdr));
++        nladdr.nl_family = AF_NETLINK;
++
++        if (bind(fd, (struct sockaddr *)&nladdr, sizeof(nladdr)) < 0) {
++            error("make_ppp_unit_rtnetlink: bind(AF_NETLINK): %m (line %d)", __LINE__);
++            close(fd);
++            return 0;
++        }
++
++        memset(&nlreq, 0, sizeof(nlreq));
++        nlreq.nlh.nlmsg_len = sizeof(nlreq);
++        nlreq.nlh.nlmsg_type = RTM_NEWLINK;
++        nlreq.nlh.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | NLM_F_EXCL | NLM_F_CREATE;
++        nlreq.ifm.ifi_family = AF_UNSPEC;
++        nlreq.ifm.ifi_type = ARPHRD_NETROM;
++        nlreq.ifn.rta.rta_len = sizeof(nlreq.ifn);
++        nlreq.ifn.rta.rta_type = IFLA_IFNAME;
++        strlcpy(nlreq.ifn.ifname, req_ifname, sizeof(nlreq.ifn.ifname));
++        nlreq.ifli.rta.rta_len = sizeof(nlreq.ifli);
++        nlreq.ifli.rta.rta_type = IFLA_LINKINFO;
++        nlreq.ifli.ifik.rta.rta_len = sizeof(nlreq.ifli.ifik);
++        nlreq.ifli.ifik.rta.rta_type = IFLA_INFO_KIND;
++        strcpy(nlreq.ifli.ifik.ifkind, "ppp");
++        nlreq.ifli.ifid.rta.rta_len = sizeof(nlreq.ifli.ifid);
++        nlreq.ifli.ifid.rta.rta_type = IFLA_INFO_DATA;
++        nlreq.ifli.ifid.ifdata[0].rta.rta_len = sizeof(nlreq.ifli.ifid.ifdata[0]);
++        nlreq.ifli.ifid.ifdata[0].rta.rta_type = IFLA_PPP_DEV_FD;
++        nlreq.ifli.ifid.ifdata[0].ppp.ppp_dev_fd = ppp_dev_fd;
++
++        memset(&nladdr, 0, sizeof(nladdr));
++        nladdr.nl_family = AF_NETLINK;
++
++        memset(&iov, 0, sizeof(iov));
++        iov.iov_base = &nlreq;
++        iov.iov_len = sizeof(nlreq);
++
++        memset(&msg, 0, sizeof(msg));
++        msg.msg_name = &nladdr;
++        msg.msg_namelen = sizeof(nladdr);
++        msg.msg_iov = &iov;
++        msg.msg_iovlen = 1;
++
++        if (sendmsg(fd, &msg, 0) < 0) {
++            error("make_ppp_unit_rtnetlink: sendmsg(RTM_NEWLINK/NLM_F_CREATE): %m (line %d)", __LINE__);
++            close(fd);
++            return 0;
++        }
++
++        memset(&iov, 0, sizeof(iov));
++        iov.iov_base = &nlresp;
++        iov.iov_len = sizeof(nlresp);
++
++        memset(&msg, 0, sizeof(msg));
++        msg.msg_name = &nladdr;
++        msg.msg_namelen = sizeof(nladdr);
++        msg.msg_iov = &iov;
++        msg.msg_iovlen = 1;
++
++        nlresplen = recvmsg(fd, &msg, 0);
++
++        if (nlresplen < 0) {
++            error("make_ppp_unit_rtnetlink: recvmsg(NLM_F_ACK): %m (line %d)", __LINE__);
++            close(fd);
++            return 0;
++        }
+ 
+-    memset(&nladdr, 0, sizeof(nladdr));
+-    nladdr.nl_family = AF_NETLINK;
+-
+-    if (bind(fd, (struct sockaddr *)&nladdr, sizeof(nladdr)) < 0) {
+-        error("make_ppp_unit_rtnetlink: bind(AF_NETLINK): %m (line %d)", __LINE__);
+         close(fd);
+-        return 0;
+-    }
+-
+-    memset(&nlreq, 0, sizeof(nlreq));
+-    nlreq.nlh.nlmsg_len = sizeof(nlreq);
+-    nlreq.nlh.nlmsg_type = RTM_NEWLINK;
+-    nlreq.nlh.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | NLM_F_EXCL | NLM_F_CREATE;
+-    nlreq.ifm.ifi_family = AF_UNSPEC;
+-    nlreq.ifm.ifi_type = ARPHRD_NETROM;
+-    nlreq.ifn.rta.rta_len = sizeof(nlreq.ifn);
+-    nlreq.ifn.rta.rta_type = IFLA_IFNAME;
+-    strlcpy(nlreq.ifn.ifname, req_ifname, sizeof(nlreq.ifn.ifname));
+-    nlreq.ifli.rta.rta_len = sizeof(nlreq.ifli);
+-    nlreq.ifli.rta.rta_type = IFLA_LINKINFO;
+-    nlreq.ifli.ifik.rta.rta_len = sizeof(nlreq.ifli.ifik);
+-    nlreq.ifli.ifik.rta.rta_type = IFLA_INFO_KIND;
+-    strcpy(nlreq.ifli.ifik.ifkind, "ppp");
+-    nlreq.ifli.ifid.rta.rta_len = sizeof(nlreq.ifli.ifid);
+-    nlreq.ifli.ifid.rta.rta_type = IFLA_INFO_DATA;
+-    nlreq.ifli.ifid.ifdata[0].rta.rta_len = sizeof(nlreq.ifli.ifid.ifdata[0]);
+-    nlreq.ifli.ifid.ifdata[0].rta.rta_type = IFLA_PPP_DEV_FD;
+-    nlreq.ifli.ifid.ifdata[0].ppp.ppp_dev_fd = ppp_dev_fd;
+-
+-    memset(&nladdr, 0, sizeof(nladdr));
+-    nladdr.nl_family = AF_NETLINK;
+-
+-    memset(&iov, 0, sizeof(iov));
+-    iov.iov_base = &nlreq;
+-    iov.iov_len = sizeof(nlreq);
+-
+-    memset(&msg, 0, sizeof(msg));
+-    msg.msg_name = &nladdr;
+-    msg.msg_namelen = sizeof(nladdr);
+-    msg.msg_iov = &iov;
+-    msg.msg_iovlen = 1;
+-
+-    if (sendmsg(fd, &msg, 0) < 0) {
+-        error("make_ppp_unit_rtnetlink: sendmsg(RTM_NEWLINK/NLM_F_CREATE): %m (line %d)", __LINE__);
+-        close(fd);
+-        return 0;
+-    }
+-
+-    memset(&iov, 0, sizeof(iov));
+-    iov.iov_base = &nlresp;
+-    iov.iov_len = sizeof(nlresp);
+-
+-    memset(&msg, 0, sizeof(msg));
+-    msg.msg_name = &nladdr;
+-    msg.msg_namelen = sizeof(nladdr);
+-    msg.msg_iov = &iov;
+-    msg.msg_iovlen = 1;
+-
+-    nlresplen = recvmsg(fd, &msg, 0);
+-
+-    if (nlresplen < 0) {
+-        error("make_ppp_unit_rtnetlink: recvmsg(NLM_F_ACK): %m (line %d)", __LINE__);
+-        close(fd);
+-        return 0;
+-    }
+-
+-    close(fd);
+ 
+-    if (nladdr.nl_family != AF_NETLINK) {
+-        error("make_ppp_unit_rtnetlink: recvmsg(NLM_F_ACK): Not a netlink packet (line %d)", __LINE__);
+-        return 0;
+-    }
+-
+-    if ((size_t)nlresplen < sizeof(nlresp) || nlresp.nlh.nlmsg_len < sizeof(nlresp)) {
+-        error("make_ppp_unit_rtnetlink: recvmsg(NLM_F_ACK): Acknowledgment netlink packet too short (line %d)", __LINE__);
+-        return 0;
+-    }
+-
+-    /* acknowledgment packet for NLM_F_ACK is NLMSG_ERROR */
+-    if (nlresp.nlh.nlmsg_type != NLMSG_ERROR) {
+-        error("make_ppp_unit_rtnetlink: recvmsg(NLM_F_ACK): Not an acknowledgment netlink packet (line %d)", __LINE__);
+-        return 0;
+-    }
++        if (nladdr.nl_family != AF_NETLINK) {
++            error("make_ppp_unit_rtnetlink: recvmsg(NLM_F_ACK): Not a netlink packet (line %d)", __LINE__);
++            return 0;
++        }
++
++        if ((size_t)nlresplen < sizeof(nlresp) || nlresp.nlh.nlmsg_len < sizeof(nlresp)) {
++            error("make_ppp_unit_rtnetlink: recvmsg(NLM_F_ACK): Acknowledgment netlink packet too short (line %d)", __LINE__);
++            return 0;
++        }
++
++        /* acknowledgment packet for NLM_F_ACK is NLMSG_ERROR */
++        if (nlresp.nlh.nlmsg_type != NLMSG_ERROR) {
++            error("make_ppp_unit_rtnetlink: recvmsg(NLM_F_ACK): Not an acknowledgment netlink packet (line %d)", __LINE__);
++            return 0;
++        }
++    } while (nlresp.nlerr.error == -EBUSY);
+ 
+     /* error == 0 indicates success, negative value is errno code */
+     if (nlresp.nlerr.error != 0) {
diff --git a/package/network/services/ppp/patches/208-fix_status_code.patch b/package/network/services/ppp/patches/208-fix_status_code.patch
index 54e6c45e149737..1d991e79490052 100644
--- a/package/network/services/ppp/patches/208-fix_status_code.patch
+++ b/package/network/services/ppp/patches/208-fix_status_code.patch
@@ -12,7 +12,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
 
 --- a/pppd/main.c
 +++ b/pppd/main.c
-@@ -1034,7 +1034,8 @@ get_input(void)
+@@ -1035,7 +1035,8 @@ get_input(void)
  	}
  	notice("Modem hangup");
  	hungup = 1;
diff --git a/package/network/services/ppp/patches/321-multilink_support_custom_iface_names.patch b/package/network/services/ppp/patches/321-multilink_support_custom_iface_names.patch
index 0c4d7ea9d6cd8f..0ae84ae1ed9adc 100644
--- a/package/network/services/ppp/patches/321-multilink_support_custom_iface_names.patch
+++ b/package/network/services/ppp/patches/321-multilink_support_custom_iface_names.patch
@@ -119,7 +119,7 @@ Signed-off-by: George Kashperko <george@znau.edu.ua>
  			&& memcmp(vd.dptr, key.dptr, vd.dsize) == 0;
 --- a/pppd/sys-linux.c
 +++ b/pppd/sys-linux.c
-@@ -706,6 +706,16 @@ void cfg_bundle(int mrru, int mtru, int
+@@ -923,6 +923,16 @@ void cfg_bundle(int mrru, int mtru, int
  	add_fd(ppp_dev_fd);
  }
  
@@ -136,7 +136,7 @@ Signed-off-by: George Kashperko <george@znau.edu.ua>
  /*
   * make_new_bundle - create a new PPP unit (i.e. a bundle)
   * and connect our channel to it.  This should only get called
-@@ -724,6 +734,8 @@ void make_new_bundle(int mrru, int mtru,
+@@ -941,6 +951,8 @@ void make_new_bundle(int mrru, int mtru,
  
  	/* set the mrru and flags */
  	cfg_bundle(mrru, mtru, rssn, tssn);
diff --git a/package/network/services/ppp/patches/330-retain_foreign_default_routes.patch b/package/network/services/ppp/patches/330-retain_foreign_default_routes.patch
index 6ccc4507b2ba2d..3d2a815dbd9bf3 100644
--- a/package/network/services/ppp/patches/330-retain_foreign_default_routes.patch
+++ b/package/network/services/ppp/patches/330-retain_foreign_default_routes.patch
@@ -12,7 +12,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
 
 --- a/pppd/sys-linux.c
 +++ b/pppd/sys-linux.c
-@@ -1770,6 +1770,7 @@ int cifdefaultroute (int unit, u_int32_t
+@@ -2248,6 +2248,7 @@ int cifdefaultroute (int unit, u_int32_t
  	SIN_ADDR(rt.rt_genmask) = 0L;
      }
  
diff --git a/package/network/services/ppp/patches/340-populate_default_gateway.patch b/package/network/services/ppp/patches/340-populate_default_gateway.patch
index 0f965c705d2a04..64d03fb5c474b0 100644
--- a/package/network/services/ppp/patches/340-populate_default_gateway.patch
+++ b/package/network/services/ppp/patches/340-populate_default_gateway.patch
@@ -13,7 +13,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
 
 --- a/pppd/sys-linux.c
 +++ b/pppd/sys-linux.c
-@@ -1720,6 +1720,9 @@ int sifdefaultroute (int unit, u_int32_t
+@@ -2198,6 +2198,9 @@ int sifdefaultroute (int unit, u_int32_t
      memset (&rt, 0, sizeof (rt));
      SET_SA_FAMILY (rt.rt_dst, AF_INET);
  
@@ -23,7 +23,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
      rt.rt_dev = ifname;
      rt.rt_metric = dfl_route_metric + 1; /* +1 for binary compatibility */
  
-@@ -1728,7 +1731,7 @@ int sifdefaultroute (int unit, u_int32_t
+@@ -2206,7 +2209,7 @@ int sifdefaultroute (int unit, u_int32_t
  	SIN_ADDR(rt.rt_genmask) = 0L;
      }
  
diff --git a/package/network/services/ppp/patches/400-simplify_kernel_checks.patch b/package/network/services/ppp/patches/400-simplify_kernel_checks.patch
index 3c720483627cd6..9d0ea9a0b84d16 100644
--- a/package/network/services/ppp/patches/400-simplify_kernel_checks.patch
+++ b/package/network/services/ppp/patches/400-simplify_kernel_checks.patch
@@ -10,7 +10,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
 
 --- a/pppd/sys-linux.c
 +++ b/pppd/sys-linux.c
-@@ -206,7 +206,7 @@ static int driver_is_old       = 0;
+@@ -235,7 +235,7 @@ static int driver_is_old       = 0;
  static int restore_term        = 0;	/* 1 => we've munged the terminal */
  static struct termios inittermios;	/* Initial TTY termios */
  
@@ -19,7 +19,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
  
  static char loop_name[20];
  static unsigned char inbuf[512]; /* buffer for chars read from loopback */
-@@ -225,8 +225,8 @@ static int	looped;			/* 1 if using loop
+@@ -254,8 +254,8 @@ static int	looped;			/* 1 if using loop
  static int	link_mtu;		/* mtu for the link (not bundle) */
  
  static struct utsname utsname;	/* for the kernel version */
@@ -29,7 +29,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
  
  #define MAX_IFS		100
  
-@@ -1455,11 +1455,12 @@ int ccp_fatal_error (int unit)
+@@ -1933,11 +1933,12 @@ int ccp_fatal_error (int unit)
   *
   * path_to_procfs - find the path to the proc file system mount point
   */
@@ -44,7 +44,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
      struct mntent *mntent;
      FILE *fp;
  
-@@ -1481,6 +1482,7 @@ static char *path_to_procfs(const char *
+@@ -1959,6 +1960,7 @@ static char *path_to_procfs(const char *
  	    fclose (fp);
  	}
      }
@@ -52,7 +52,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
  
      strlcpy(proc_path + proc_path_len, tail,
  	    sizeof(proc_path) - proc_path_len);
-@@ -2365,15 +2367,19 @@ int ppp_available(void)
+@@ -2843,15 +2845,19 @@ int ppp_available(void)
      int    my_version, my_modification, my_patch;
      int osmaj, osmin, ospatch;
  
@@ -72,7 +72,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
  
  	/* XXX should get from driver */
  	driver_version = 2;
-@@ -2433,6 +2439,7 @@ int ppp_available(void)
+@@ -2911,6 +2917,7 @@ int ppp_available(void)
  
      if (ok && ((ifr.ifr_hwaddr.sa_family & ~0xFF) != ARPHRD_PPP))
  	ok = 0;
@@ -80,7 +80,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
  
  /*
   *  This is the PPP device. Validate the version of the driver at this
-@@ -3106,6 +3113,7 @@ get_pty(int *master_fdp, int *slave_fdp,
+@@ -3592,6 +3599,7 @@ get_pty(int *master_fdp, int *slave_fdp,
      }
  #endif /* TIOCGPTN */
  
@@ -88,7 +88,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
      if (sfd < 0) {
  	/* the old way - scan through the pty name space */
  	for (i = 0; i < 64; ++i) {
-@@ -3124,6 +3132,7 @@ get_pty(int *master_fdp, int *slave_fdp,
+@@ -3610,6 +3618,7 @@ get_pty(int *master_fdp, int *slave_fdp,
  	    }
  	}
      }
diff --git a/package/network/services/ppp/patches/401-no_record_file.patch b/package/network/services/ppp/patches/401-no_record_file.patch
index 78442606851b6a..0304f36fe2bbda 100644
--- a/package/network/services/ppp/patches/401-no_record_file.patch
+++ b/package/network/services/ppp/patches/401-no_record_file.patch
@@ -7,7 +7,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
 
 --- a/pppd/pppd.h
 +++ b/pppd/pppd.h
-@@ -317,7 +317,6 @@ extern int	holdoff;	/* Dead time before
+@@ -318,7 +318,6 @@ extern int	holdoff;	/* Dead time before
  extern bool	holdoff_specified; /* true if user gave a holdoff value */
  extern bool	notty;		/* Stdin/out is not a tty */
  extern char	*pty_socket;	/* Socket to connect to pty */
diff --git a/package/network/services/ppp/patches/403-no_wtmp.patch b/package/network/services/ppp/patches/403-no_wtmp.patch
index 772620ed7227c1..90c2a8208a5543 100644
--- a/package/network/services/ppp/patches/403-no_wtmp.patch
+++ b/package/network/services/ppp/patches/403-no_wtmp.patch
@@ -7,7 +7,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
 
 --- a/pppd/sys-linux.c
 +++ b/pppd/sys-linux.c
-@@ -2503,6 +2503,7 @@ int ppp_available(void)
+@@ -2981,6 +2981,7 @@ int ppp_available(void)
  
  void logwtmp (const char *line, const char *name, const char *host)
  {
@@ -15,7 +15,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
      struct utmp ut, *utp;
      pid_t  mypid = getpid();
  #if __GLIBC__ < 2
-@@ -2568,6 +2569,7 @@ void logwtmp (const char *line, const ch
+@@ -3046,6 +3047,7 @@ void logwtmp (const char *line, const ch
  	close (wtmp);
      }
  #endif
diff --git a/package/network/services/ppp/patches/404-remove_obsolete_protocol_names.patch b/package/network/services/ppp/patches/404-remove_obsolete_protocol_names.patch
index b9b6f0e593b50e..8bed425a5b3c33 100644
--- a/package/network/services/ppp/patches/404-remove_obsolete_protocol_names.patch
+++ b/package/network/services/ppp/patches/404-remove_obsolete_protocol_names.patch
@@ -7,7 +7,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
 
 --- a/pppd/main.c
 +++ b/pppd/main.c
-@@ -866,14 +866,17 @@ struct protocol_list {
+@@ -867,14 +867,17 @@ struct protocol_list {
      const char	*name;
  } protocol_list[] = {
      { 0x21,	"IP" },
@@ -25,7 +25,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
      { 0x33,	"Stream Protocol ST-II" },
      { 0x35,	"Banyan Vines" },
      { 0x39,	"AppleTalk EDDP" },
-@@ -887,8 +890,11 @@ struct protocol_list {
+@@ -888,8 +891,11 @@ struct protocol_list {
      { 0x49,	"Serial Data Transport Protocol (PPP-SDTP)" },
      { 0x4b,	"SNA over 802.2" },
      { 0x4d,	"SNA" },
@@ -37,7 +37,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
      { 0x53,	"Encryption" },
      { 0x55,	"Individual Link Encryption" },
      { 0x57,	"IPv6" },
-@@ -899,12 +905,15 @@ struct protocol_list {
+@@ -900,12 +906,15 @@ struct protocol_list {
      { 0x65,	"RTP IPHC Compressed non-TCP" },
      { 0x67,	"RTP IPHC Compressed UDP 8" },
      { 0x69,	"RTP IPHC Compressed RTP 8" },
@@ -53,7 +53,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
      { 0x0203,	"IBM Source Routing BPDU" },
      { 0x0205,	"DEC LANBridge100 Spanning Tree" },
      { 0x0207,	"Cisco Discovery Protocol" },
-@@ -916,15 +925,19 @@ struct protocol_list {
+@@ -917,15 +926,19 @@ struct protocol_list {
      { 0x0231,	"Luxcom" },
      { 0x0233,	"Sigma Network Systems" },
      { 0x0235,	"Apple Client Server Protocol" },
@@ -73,7 +73,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
      { 0x4001,	"Cray Communications Control Protocol" },
      { 0x4003,	"CDPD Mobile Network Registration Protocol" },
      { 0x4005,	"Expand accelerator protocol" },
-@@ -935,8 +948,10 @@ struct protocol_list {
+@@ -936,8 +949,10 @@ struct protocol_list {
      { 0x4023,	"RefTek Protocol" },
      { 0x4025,	"Fibre Channel" },
      { 0x4027,	"EMIT Protocols" },
@@ -84,7 +84,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
      { 0x8023,	"OSI Network Layer Control Protocol" },
      { 0x8025,	"Xerox NS IDP Control Protocol" },
      { 0x8027,	"DECnet Phase IV Control Protocol" },
-@@ -945,7 +960,9 @@ struct protocol_list {
+@@ -946,7 +961,9 @@ struct protocol_list {
      { 0x8031,	"Bridging NCP" },
      { 0x8033,	"Stream Protocol Control Protocol" },
      { 0x8035,	"Banyan Vines Control Protocol" },
@@ -94,7 +94,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
      { 0x803f,	"NETBIOS Framing Control Protocol" },
      { 0x8041,	"Cisco Systems Control Protocol" },
      { 0x8043,	"Ascom Timeplex" },
-@@ -954,18 +971,24 @@ struct protocol_list {
+@@ -955,18 +972,24 @@ struct protocol_list {
      { 0x8049,	"Serial Data Control Protocol (PPP-SDCP)" },
      { 0x804b,	"SNA over 802.2 Control Protocol" },
      { 0x804d,	"SNA Control Protocol" },
@@ -119,7 +119,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
      { 0x8207,	"Cisco Discovery Protocol Control" },
      { 0x8209,	"Netcs Twin Routing" },
      { 0x820b,	"STP - Control Protocol" },
-@@ -974,24 +997,29 @@ struct protocol_list {
+@@ -975,24 +998,29 @@ struct protocol_list {
      { 0x8281,	"MPLSCP" },
      { 0x8285,	"IEEE p1284.4 standard - Protocol Control" },
      { 0x8287,	"ETSI TETRA TNP1 Control Protocol" },
diff --git a/package/network/services/relayd/Makefile b/package/network/services/relayd/Makefile
index 64a08a96652c49..aba69399556b07 100644
--- a/package/network/services/relayd/Makefile
+++ b/package/network/services/relayd/Makefile
@@ -12,9 +12,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/relayd.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2020-04-25
-PKG_SOURCE_VERSION:=f4d759be54ceb37714e9a6ca320d5b50c95e9ce9
-PKG_MIRROR_HASH:=b1ff6e99072867be0975ba0be52ba9da3a876c8b8da893d68301e8238243a51e
+PKG_SOURCE_DATE:=2023-01-28
+PKG_SOURCE_VERSION:=f646ba40489371e69f624f2dee2fc4e19ceec00e
+PKG_MIRROR_HASH:=672d3115728d40ee6897a9f633d269d127496699a7bd45eba11844aa771f2501
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=GPL-2.0
diff --git a/package/network/services/uhttpd/Makefile b/package/network/services/uhttpd/Makefile
index 36331857fbdb65..3923e55b072e16 100644
--- a/package/network/services/uhttpd/Makefile
+++ b/package/network/services/uhttpd/Makefile
@@ -12,15 +12,14 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/uhttpd.git
-PKG_SOURCE_DATE:=2022-08-12
-PKG_SOURCE_VERSION:=e3395cd90bed9b7b9fc319e79528fedcc0d947fe
-PKG_MIRROR_HASH:=14e9df9f85c406b8abbb14427e5f678383782500c549d842c0481cd954fc4ea3
+PKG_SOURCE_DATE:=2023-01-28
+PKG_SOURCE_VERSION:=47561aa13574068403d48f13ea310f8511057b2b
+PKG_MIRROR_HASH:=84500cf0c8224fe80b5717c9b6bad8ac13f44f286e3a88e8b12adfcf02e22c7c
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=ISC
 
 PKG_ASLR_PIE_REGULAR:=1
 PKG_BUILD_DEPENDS = ustream-ssl
-PKG_CONFIG_DEPENDS:= CONFIG_uhttpd_lua CONFIG_uhttpd_ucode
 
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/cmake.mk
@@ -44,18 +43,6 @@ define Package/uhttpd/description
  HTTP daemon.
 endef
 
-define Package/uhttpd/config
-  config uhttpd_lua
-    depends on PACKAGE_uhttpd-mod-lua
-    bool "Enable Integrated Lua interpreter"
-	default y
-
-  config uhttpd_ucode
-    depends on PACKAGE_uhttpd-mod-ucode
-    bool "Enable Integrated ucode interpreter"
-	default y
-endef
-
 define Package/uhttpd/conffiles
 /etc/config/uhttpd
 /etc/uhttpd.crt
@@ -101,17 +88,11 @@ ifneq ($(CONFIG_USE_GLIBC),)
   TARGET_CFLAGS += -D_DEFAULT_SOURCE
 endif
 
-TARGET_LDFLAGS += -lcrypt
-
-CMAKE_OPTIONS += -DTLS_SUPPORT=on
-
 define Package/uhttpd/install
-	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_DIR) $(1)/etc/init.d $(1)/etc/config $(1)/usr/sbin
 	$(INSTALL_BIN) ./files/uhttpd.init $(1)/etc/init.d/uhttpd
-	$(INSTALL_DIR) $(1)/etc/config
 	$(INSTALL_CONF) ./files/uhttpd.config $(1)/etc/config/uhttpd
 	$(VERSION_SED_SCRIPT) $(1)/etc/config/uhttpd
-	$(INSTALL_DIR) $(1)/usr/sbin
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/uhttpd $(1)/usr/sbin/uhttpd
 endef
 
diff --git a/package/network/services/uhttpd/files/uhttpd.init b/package/network/services/uhttpd/files/uhttpd.init
index 8dbc23f59c1e01..bfde231bf62f70 100755
--- a/package/network/services/uhttpd/files/uhttpd.init
+++ b/package/network/services/uhttpd/files/uhttpd.init
@@ -222,6 +222,7 @@ start_instance()
 service_triggers()
 {
 	procd_add_reload_trigger "uhttpd"
+	procd_add_raw_trigger acme.renew 5000 /etc/init.d/uhttpd reload
 }
 
 start_service() {
diff --git a/package/network/services/umdns/Makefile b/package/network/services/umdns/Makefile
index a25233ad5abb27..b7564fa7c3e6d7 100644
--- a/package/network/services/umdns/Makefile
+++ b/package/network/services/umdns/Makefile
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2014-2021 OpenWrt.org
+# Copyright (C) 2014-2023 OpenWrt.org
 #
 # This is free software, licensed under the GNU General Public License v2.
 # See /LICENSE for more information.
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=umdns
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=5
 
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/mdnsd.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2021-05-13
-PKG_SOURCE_VERSION:=b777a0b53f7d89ab2a60e3eed7d98036806da9a4
-PKG_MIRROR_HASH:=54992acf7edd32610de7bcb0ea7c58b20f69bf1ac20be69e76abcff41f25e775
+PKG_SOURCE_DATE:=2023-01-16
+PKG_SOURCE_VERSION:=65b3308d13de7d7975444d34389651612e2a4d38
+PKG_MIRROR_HASH:=945fdf51a299b68982aab74e8fba5614f2553a7b4c49a3a53b3093ea8aac0279
 
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 PKG_LICENSE:=LGPL-2.1
diff --git a/package/network/services/unetd/Makefile b/package/network/services/unetd/Makefile
index c645ee57d8ddfa..7d8ed9a144caa9 100644
--- a/package/network/services/unetd/Makefile
+++ b/package/network/services/unetd/Makefile
@@ -10,9 +10,9 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=unetd
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/unetd.git
-PKG_SOURCE_DATE:=2022-09-01
-PKG_SOURCE_VERSION:=d7fb9e5b065bf9eecb5bcbcf741b5f89695c5dcc
-PKG_MIRROR_HASH:=a693c2b4b4bda5e1e44b493019e8e6e6d39c4048f417b581c801a9931e6b9b39
+PKG_SOURCE_DATE:=2023-05-31
+PKG_SOURCE_VERSION:=7d3986b7a5a20b9af0dacd053b2657210385e7bb
+PKG_MIRROR_HASH:=07f0a4cbae3e80c6309bb8aa27fcef19fbc56093a9c7e426e0d527227af09429
 
 PKG_LICENSE:=GPL-2.0
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
@@ -44,10 +44,17 @@ define Package/unetd/config
 
 endef
 
+define Package/unet-dht
+  SECTION:=net
+  CATEGORY:=Network
+  DEPENDS:=unetd
+  TITLE:=unetd DHT discovery support
+endef
+
 define Package/unet-cli
   SECTION:=net
   CATEGORY:=Network
-  DEPENDS:=unetd +ucode +ucode-mod-fs
+  DEPENDS:=+unetd +ucode +ucode-mod-fs
   TITLE:=unetd administration command line utility
 endef
 
@@ -88,10 +95,19 @@ define Package/unetd/install
 	$(INSTALL_BIN) ./files/unetd.sh $(1)/lib/netifd/proto
 endef
 
+define Package/unet-dht/install
+	$(INSTALL_DIR) \
+		$(1)/etc/init.d \
+		$(1)/usr/sbin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/unet-dht $(1)/usr/sbin
+	$(INSTALL_BIN) ./files/unet-dht.init $(1)/etc/init.d/unet-dht
+endef
+
 define Package/unet-cli/install
 	$(INSTALL_DIR) $(1)/usr/sbin
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/scripts/unet-cli $(1)/usr/sbin
 endef
 
 $(eval $(call BuildPackage,unetd))
+$(eval $(call BuildPackage,unet-dht))
 $(eval $(call BuildPackage,unet-cli))
diff --git a/package/network/services/unetd/files/unet-dht.init b/package/network/services/unetd/files/unet-dht.init
new file mode 100644
index 00000000000000..272626a933e562
--- /dev/null
+++ b/package/network/services/unetd/files/unet-dht.init
@@ -0,0 +1,24 @@
+#!/bin/sh /etc/rc.common
+# Copyright (c) 2022 OpenWrt.org
+
+START=19
+
+USE_PROCD=1
+PROG=/usr/sbin/unet-dht
+
+unet_dht_id() {
+	cat \
+		/sys/class/net/eth?/address \
+		/sys/class/ieee80211/phy*/macaddress \
+		/etc/board.json | md5sum | awk '{ print $1 }'
+}
+
+start_service() {
+	mkdir -p /var/run/unetd /etc/unetd
+
+	procd_open_instance
+	procd_set_param command "$PROG" -u /var/run/unetd/socket -n /var/run/unetd/nodes.dat $(unet_dht_id)
+	procd_set_param respawn
+	procd_set_param limits core="unlimited"
+	procd_close_instance
+}
diff --git a/package/network/services/unetd/files/unetd.init b/package/network/services/unetd/files/unetd.init
index 0ec48b2b926a30..c1124821ee8fa1 100644
--- a/package/network/services/unetd/files/unetd.init
+++ b/package/network/services/unetd/files/unetd.init
@@ -10,7 +10,7 @@ start_service() {
 	mkdir -p /var/run/unetd /etc/unetd
 
 	procd_open_instance
-	procd_set_param command "$PROG" -h /var/run/unetd/hosts
+	procd_set_param command "$PROG" -h /var/run/unetd/hosts -u /var/run/unetd/socket
 	procd_set_param respawn
 	procd_set_param limits core="unlimited"
 	procd_close_instance
diff --git a/package/network/services/unetd/files/unetd.sh b/package/network/services/unetd/files/unetd.sh
index 70a28f64826c8d..2f0f0c478c78a9 100644
--- a/package/network/services/unetd/files/unetd.sh
+++ b/package/network/services/unetd/files/unetd.sh
@@ -16,6 +16,7 @@ proto_unet_init_config() {
 	proto_config_add_string file
 	proto_config_add_int keepalive
 	proto_config_add_string domain
+	proto_config_add_boolean dht
 	proto_config_add_array "tunnels:list(string)"
 	proto_config_add_array "connect:list(string)"
 	proto_config_add_array "peer_data:list(string)"
@@ -28,7 +29,7 @@ proto_unet_setup() {
 	local config="$1"
 
 	local device type key file keepalive domain tunnels
-	json_get_vars device type auth_key key file keepalive domain
+	json_get_vars device type auth_key key file keepalive domain dht
 	json_get_values tunnels tunnels
 	json_get_values connect connect
 	json_get_values peer_data peer_data
@@ -45,6 +46,7 @@ proto_unet_setup() {
 	json_add_string key "$key"
 	json_add_string file "$file"
 	[ -n "$keepalive" ] && json_add_int keepalive "$keepalive"
+	[ -n "$dht" ] && json_add_boolean dht "$dht"
 	json_add_string domain "$domain"
 
 	json_add_object tunnels
diff --git a/package/network/services/ustp/Makefile b/package/network/services/ustp/Makefile
index 88bc993bb652af..2cdd033754922c 100644
--- a/package/network/services/ustp/Makefile
+++ b/package/network/services/ustp/Makefile
@@ -19,6 +19,8 @@ PKG_MIRROR_HASH:=0e96edc983cf437b95874e5715d743f30bb826d8757dc3771ff872ab9cf18f3
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=GPL-2.0
 
+PKG_BUILD_FLAGS:=lto
+
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/cmake.mk
 
@@ -29,8 +31,7 @@ define Package/ustp
   DEPENDS:=+libubox +libubus
 endef
 
-TARGET_CFLAGS += -I$(STAGING_DIR)/usr/include -flto
-TARGET_LDFLAGS += -flto -fuse-linker-plugin
+TARGET_CFLAGS += -I$(STAGING_DIR)/usr/include
 
 define Package/ustp/install
 	$(INSTALL_DIR) $(1)/sbin $(1)/etc/init.d
diff --git a/package/network/utils/arptables/Makefile b/package/network/utils/arptables/Makefile
index 5083d1cd9b02f2..7f32ed139549ee 100644
--- a/package/network/utils/arptables/Makefile
+++ b/package/network/utils/arptables/Makefile
@@ -10,7 +10,7 @@ PKG_VERSION:=0.0.5
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=http://ftp.netfilter.org/pub/arptables
+PKG_SOURCE_URL:=https://ftp.netfilter.org/pub/arptables
 PKG_HASH:=4f9a0656ce5c90868f551cd4deeb2d04f33899667e1fb2818b64e432fe8f629c
 
 PKG_LICENSE:=GPL-2.0
diff --git a/package/network/utils/bpftool/Makefile b/package/network/utils/bpftool/Makefile
new file mode 100644
index 00000000000000..cbbba2dba5964d
--- /dev/null
+++ b/package/network/utils/bpftool/Makefile
@@ -0,0 +1,99 @@
+#
+# Copyright (C) 2020-2023 Tony Ambardar <itugrok@yahoo.com>
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=bpftools
+PKG_VERSION:=7.2.0
+PKG_RELEASE:=1
+
+PKG_SOURCE_URL:=https://github.com/libbpf/bpftool
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_VERSION:=19ff0564980a7429e730f6987a0b0bf418b3c676
+PKG_MIRROR_HASH:=f9b9871f64986dd2e5dab7060bb919398256ba93964da49c62efaf0e6bc9bbc4
+
+PKG_MAINTAINER:=Tony Ambardar <itugrok@yahoo.com>
+
+PKG_BUILD_FLAGS:=no-mips16
+PKG_BUILD_PARALLEL:=1
+PKG_INSTALL:=1
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/nls.mk
+
+define Package/bpftool/Default
+  SECTION:=net
+  CATEGORY:=Network
+  TITLE:=bpftool - eBPF subsystem utility
+  LICENSE:=GPL-2.0-only OR BSD-2-Clause
+  URL:=http://www.kernel.org
+  DEPENDS:=+libelf
+endef
+
+define Package/bpftool-minimal
+  $(call Package/bpftool/Default)
+  TITLE+= (Minimal)
+  VARIANT:=minimal
+  DEFAULT_VARIANT:=1
+  PROVIDES:=bpftool
+  ALTERNATIVES:=200:/usr/sbin/bpftool:/usr/libexec/bpftool-minimal
+endef
+
+define Package/bpftool-full
+  $(call Package/bpftool/Default)
+  TITLE+= (Full)
+  VARIANT:=full
+  PROVIDES:=bpftool
+  ALTERNATIVES:=300:/usr/sbin/bpftool:/usr/libexec/bpftool-full
+  DEPENDS+= +libbfd +libopcodes
+endef
+
+define Package/bpftool-minimal/description
+  A tool for inspection and simple manipulation of eBPF programs and maps.
+endef
+
+define Package/bpftool-full/description
+  A tool for inspection and simple manipulation of eBPF programs and maps.
+  This full version uses libbfd and libopcodes to support disassembly of
+  eBPF programs and jited code.
+endef
+
+TARGET_CFLAGS += -ffunction-sections -fdata-sections -flto
+TARGET_LDFLAGS += -Wl,--gc-sections -flto
+
+ifeq ($(BUILD_VARIANT),full)
+  full:=1
+else
+  full:=0
+endif
+
+MAKE_VARS = \
+	EXTRA_CFLAGS="$(TARGET_CFLAGS) $(TARGET_CPPFLAGS)" \
+	LDFLAGS="$(TARGET_LDFLAGS)"
+
+MAKE_FLAGS += \
+	OUTPUT="$(PKG_BUILD_DIR)/" \
+	prefix="/usr" \
+	$(if $(findstring c,$(OPENWRT_VERBOSE)),V=1,V='') \
+	check_feat=0 \
+	feature-clang-bpf-co-re=0 \
+	feature-libbfd=$(full) \
+	feature-llvm=0 \
+	feature-libcap=0 \
+	feature-disassembler-four-args=1 \
+	feature-disassembler-init-styled=1
+
+MAKE_PATH = src
+
+define Package/bpftool-$(BUILD_VARIANT)/install
+	$(INSTALL_DIR) $(1)/usr/libexec
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/bpftool \
+		$(1)/usr/libexec/bpftool-$(BUILD_VARIANT)
+endef
+
+$(eval $(call BuildPackage,bpftool-full))
+$(eval $(call BuildPackage,bpftool-minimal))
diff --git a/package/network/utils/bpftool/patches/001-cflags.patch b/package/network/utils/bpftool/patches/001-cflags.patch
new file mode 100644
index 00000000000000..b06842a0be7f66
--- /dev/null
+++ b/package/network/utils/bpftool/patches/001-cflags.patch
@@ -0,0 +1,10 @@
+--- a/libbpf/src/Makefile
++++ b/libbpf/src/Makefile
+@@ -34,6 +34,7 @@ ALL_CFLAGS := $(INCLUDES)
+ 
+ SHARED_CFLAGS += -fPIC -fvisibility=hidden -DSHARED
+ 
++CFLAGS = $(EXTRA_CFLAGS)
+ CFLAGS ?= -g -O2 -Werror -Wall -std=gnu89
+ ALL_CFLAGS += $(CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 $(EXTRA_CFLAGS)
+ ALL_LDFLAGS += $(LDFLAGS) $(EXTRA_LDFLAGS)
diff --git a/package/network/utils/bpftool/patches/002-includes.patch b/package/network/utils/bpftool/patches/002-includes.patch
new file mode 100644
index 00000000000000..ac1b5fcc2286c3
--- /dev/null
+++ b/package/network/utils/bpftool/patches/002-includes.patch
@@ -0,0 +1,26 @@
+--- a/libbpf/include/linux/list.h
++++ b/libbpf/include/linux/list.h
+@@ -3,6 +3,8 @@
+ #ifndef __LINUX_LIST_H
+ #define __LINUX_LIST_H
+ 
++#include <linux/types.h>
++
+ #define LIST_HEAD_INIT(name) { &(name), &(name) }
+ #define LIST_HEAD(name) \
+         struct list_head name = LIST_HEAD_INIT(name)
+--- a/src/Makefile
++++ b/src/Makefile
+@@ -73,10 +73,10 @@ CFLAGS += -W -Wall -Wextra -Wno-unused-p
+ CFLAGS += $(filter-out -Wswitch-enum -Wnested-externs,$(EXTRA_WARNINGS))
+ CFLAGS += -DPACKAGE='"bpftool"' -D__EXPORTED_HEADERS__ \
+ 	-I$(or $(OUTPUT),.) \
+-	-I$(LIBBPF_INCLUDE) \
+ 	-I$(srctree)/src/kernel/bpf/ \
+ 	-I$(srctree)/include \
+-	-I$(srctree)/include/uapi
++	-I$(srctree)/include/uapi \
++	-I$(LIBBPF_INCLUDE)
+ ifneq ($(BPFTOOL_VERSION),)
+ CFLAGS += -DBPFTOOL_VERSION='"$(BPFTOOL_VERSION)"'
+ endif
diff --git a/package/network/utils/comgt/Makefile b/package/network/utils/comgt/Makefile
index 24dae2521e392b..429c9386027094 100644
--- a/package/network/utils/comgt/Makefile
+++ b/package/network/utils/comgt/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=comgt
 PKG_VERSION:=0.32
-PKG_RELEASE:=34
+PKG_RELEASE:=35
 
 PKG_SOURCE:=$(PKG_NAME).$(PKG_VERSION).tgz
 PKG_SOURCE_URL:=@SF/comgt
@@ -79,6 +79,7 @@ define Package/comgt/install
 	$(INSTALL_DATA) ./files/getcarrier.gcom $(1)/etc/gcom/getcarrier.gcom
 	$(INSTALL_DATA) ./files/getcnum.gcom $(1)/etc/gcom/getcnum.gcom
 	$(INSTALL_DATA) ./files/getimsi.gcom $(1)/etc/gcom/getimsi.gcom
+	$(INSTALL_DATA) ./files/runcommand.gcom $(1)/etc/gcom/runcommand.gcom
 	$(INSTALL_DIR) $(1)/etc/hotplug.d/tty
 	$(INSTALL_CONF) ./files/3g.usb $(1)/etc/hotplug.d/tty/30-3g
 	$(INSTALL_DIR) $(1)/lib/netifd/proto
@@ -96,7 +97,6 @@ endef
 define Package/comgt-ncm/install
 	$(INSTALL_DIR) $(1)/etc/gcom
 	$(INSTALL_DATA) ./files/ncm.json $(1)/etc/gcom/ncm.json
-	$(INSTALL_DATA) ./files/runcommand.gcom $(1)/etc/gcom/runcommand.gcom
 	$(INSTALL_DIR) $(1)/lib/netifd/proto
 	$(INSTALL_BIN) ./files/ncm.sh $(1)/lib/netifd/proto/ncm.sh
 endef
diff --git a/package/network/utils/comgt/files/3g.sh b/package/network/utils/comgt/files/3g.sh
index 9220cbf5a0af17..42ba894e59592c 100644
--- a/package/network/utils/comgt/files/3g.sh
+++ b/package/network/utils/comgt/files/3g.sh
@@ -72,6 +72,8 @@ proto_3g_setup() {
 					*) CODE="2,2";;
 				esac
 				export MODE="AT^SYSCFG=${CODE},3FFFFFFF,2,4"
+			elif echo "$cardinfo" | grep -q "MikroTik"; then
+				COMMAND="AT+CFUN=1" gcom -d "$device" -s /etc/gcom/runcommand.gcom || return 1
 			fi
 
 			if [ -n "$pincode" ]; then
diff --git a/package/network/utils/comgt/files/ncm.json b/package/network/utils/comgt/files/ncm.json
index b6ad71752910d1..5f68b134967bcc 100644
--- a/package/network/utils/comgt/files/ncm.json
+++ b/package/network/utils/comgt/files/ncm.json
@@ -75,6 +75,22 @@
 		"finalize": "AT+CGDATA=\\\"M-MBIM\\\",${profile},1",
 		"disconnect": "AT+CGACT=0,${profile}"
 	},
+	"quectel": {
+		"initialize": [
+			"AT+CFUN=1"
+		],
+		"configure": [
+			"at+qicsgp=${profile},${context_type},\\\"${apn}\\\",\\\"${username}\\\",\\\"${password}\\\",0"
+		],
+		"modes": {
+			"lte": "AT+QCFG=\\\"nwscanmode\\\",3",
+			"umts": "AT+QCFG=\\\"nwscanmode\\\",2",
+			"gsm": "AT+QCFG=\\\"nwscanmode\\\",1",
+			"auto": "AT+QCFG=\\\"nwscanmode\\\",0"
+		},
+		"connect": "AT+qnetdevctl=1,${profile},1",
+		"disconnect": "AT+qnetdevctl=0,${profile},0"
+	},
 	"\"zte": {
 		"initialize": [
 			"AT+CFUN=1"
@@ -96,5 +112,29 @@
 		],
 		"connect": "AT+ZGACT=1,${profile}",
 		"disconnect": "AT+ZGACT=0,${profile}"
+	},
+	"\"mikrotik\"": {
+		"configure": [
+			"AT+CFUN=4",
+			"AT+ZGDCONT=${profile},\\\"${pdptype}\\\",\\\"${apn}\\\",0",
+			"AT+ZDHCPLEASE=10",
+			"AT+CFUN=1"
+		],
+		"waitforconnect": "\\\"+ZCONSTAT: 1,${context_type}\\\",\\\"+ZGIPDNS: ${context_type}\\\"",
+		"connect": "AT+ZGACT=1,${context_type}",
+		"finalize": "AT+ZDHCPLEASE=0",
+		"disconnect": "AT+ZGACT=0,1"
+	},
+	"spreadtrum": {
+		"initialize": [
+			"AT+CFUN=1",
+			"AT+CCED=2,8",
+			"AT+SPTTYROUTER=1"
+		],
+		"configure": [
+			"AT+CGDCONT=${profile},\\\"${pdptype}\\\"${apn:+,\\\"$apn\\\"}"
+		],
+		"connect": "AT+SPTZCMD=\\\"Y29ubm1hbmN0bCBuZGlzZGlhbCBBVF5ORElTRFVOPSJ1c2IwIiwxLDE=\\\"",
+		"disconnect": "AT+SPTZCMD=\\\"Y29ubm1hbmN0bCBuZGlzZGlhbCBBVF5ORElTRFVOPSJ1c2IwIiwwLDE=\\\""
 	}
 }
diff --git a/package/network/utils/comgt/files/ncm.sh b/package/network/utils/comgt/files/ncm.sh
index a2c913ea1d6f21..dec058712d0735 100644
--- a/package/network/utils/comgt/files/ncm.sh
+++ b/package/network/utils/comgt/files/ncm.sh
@@ -31,6 +31,8 @@ proto_ncm_setup() {
 	local device ifname  apn auth username password pincode delay mode pdptype profile $PROTO_DEFAULT_OPTIONS
 	json_get_vars device ifname apn auth username password pincode delay mode pdptype profile $PROTO_DEFAULT_OPTIONS
 
+	local context_type
+
 	[ "$metric" = "" ] && metric="0"
 
 	[ -n "$profile" ] || profile=1
@@ -38,6 +40,10 @@ proto_ncm_setup() {
 	pdptype=$(echo "$pdptype" | awk '{print toupper($0)}')
 	[ "$pdptype" = "IP" -o "$pdptype" = "IPV6" -o "$pdptype" = "IPV4V6" ] || pdptype="IP"
 
+	[ "$pdptype" = "IPV4V6" ] && context_type=3
+	[ -z "$context_type" -a "$pdptype" = "IPV6" ] && context_type=2
+	[ -n "$context_type" ] || context_type=1
+
 	[ -n "$ctl_device" ] && device=$ctl_device
 
 	[ -n "$device" ] || {
@@ -80,10 +86,25 @@ proto_ncm_setup() {
 		return 1
 	}
 
-	[ -n "$delay" ] && sleep "$delay"
-
-	manufacturer=$(gcom -d "$device" -s /etc/gcom/getcardinfo.gcom | awk 'NF && $0 !~ /AT\+CGMI/ { sub(/\+CGMI: /,""); print tolower($1); exit; }')
-	[ $? -ne 0 -o -z "$manufacturer" ] && {
+	start=$(date +%s)
+	while true; do
+		manufacturer=$(gcom -d "$device" -s /etc/gcom/getcardinfo.gcom | awk 'NF && $0 !~ /AT\+CGMI/ { sub(/\+CGMI: /,""); print tolower($1); exit; }')
+		[ "$manufacturer" = "error" ] && {
+			manufacturer=""
+		}
+		[ -n "$manufacturer" ] && {
+			break
+		}
+		[ -z "$delay" ] && {
+			break
+		}
+		sleep 1
+		elapsed=$(($(date +%s) - start))
+		[ "$elapsed" -gt "$delay" ] && {
+			break
+		}
+	done
+	[ -z "$manufacturer" ] && {
 		echo "Failed to get modem information"
 		proto_notify_error "$interface" GETINFO_FAILED
 		return 1
diff --git a/package/network/utils/ethtool/Makefile b/package/network/utils/ethtool/Makefile
index 2c75dd19a4155b..10fecd4a9c55b7 100644
--- a/package/network/utils/ethtool/Makefile
+++ b/package/network/utils/ethtool/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ethtool
-PKG_VERSION:=5.19
+PKG_VERSION:=6.3
 PKG_RELEASE:=1
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/software/network/ethtool
-PKG_HASH:=3b752a3329827907ac3812f2831dfecf51c8c41c55d2d69cfb9c53ca06449fc6
+PKG_HASH:=d9425f0a3df138734001fccc4175fe178c025f938460ac25c4ebc39960168822
 
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=COPYING
diff --git a/package/network/utils/iproute2/Makefile b/package/network/utils/iproute2/Makefile
index 52554005133b4a..101ca673244d89 100644
--- a/package/network/utils/iproute2/Makefile
+++ b/package/network/utils/iproute2/Makefile
@@ -8,17 +8,19 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=iproute2
-PKG_VERSION:=5.19.0
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_VERSION:=6.3.0
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/linux/utils/net/iproute2
-PKG_HASH:=26b7a34d6a7fd2f7a42e2b39c5a90cb61bac522d1096067ffeb195e5693d7791
+PKG_HASH:=dfb2a98db96e7a653cffc6693335a1a466e29a34b6ac528be48f35e1d2766732
 PKG_BUILD_PARALLEL:=1
 PKG_BUILD_DEPENDS:=iptables
 PKG_LICENSE:=GPL-2.0
 PKG_CPE_ID:=cpe:/a:iproute2_project:iproute2
 
+PKG_BUILD_FLAGS:=gc-sections lto
+
 include $(INCLUDE_DIR)/kernel.mk
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/nls.mk
@@ -171,8 +173,7 @@ define Build/Configure
 		> $(PKG_BUILD_DIR)/include/SNAPSHOT.h
 endef
 
-TARGET_CFLAGS += -ffunction-sections -fdata-sections -flto
-TARGET_LDFLAGS += -Wl,--gc-sections -Wl,--as-needed
+TARGET_LDFLAGS += -Wl,--as-needed
 TARGET_CPPFLAGS += -I$(STAGING_DIR)/usr/include/libnl-tiny
 
 MAKE_FLAGS += \
diff --git a/package/network/utils/iproute2/patches/110-darwin_fixes.patch b/package/network/utils/iproute2/patches/110-darwin_fixes.patch
index 1f3eb101ea4c6d..06ae59f8b4db3a 100644
--- a/package/network/utils/iproute2/patches/110-darwin_fixes.patch
+++ b/package/network/utils/iproute2/patches/110-darwin_fixes.patch
@@ -1,6 +1,6 @@
 --- a/netem/maketable.c
 +++ b/netem/maketable.c
-@@ -10,7 +10,9 @@
+@@ -11,7 +11,9 @@
  #include <stdio.h>
  #include <stdlib.h>
  #include <math.h>
@@ -12,7 +12,7 @@
  #include <sys/stat.h>
 --- a/netem/normal.c
 +++ b/netem/normal.c
-@@ -8,8 +8,12 @@
+@@ -9,8 +9,12 @@
  #include <string.h>
  #include <limits.h>
  
@@ -27,7 +27,7 @@
  #define TABLEFACTOR NETEM_DIST_SCALE
 --- a/netem/pareto.c
 +++ b/netem/pareto.c
-@@ -7,8 +7,12 @@
+@@ -8,8 +8,12 @@
  #include <math.h>
  #include <limits.h>
  
@@ -42,7 +42,7 @@
  #define TABLESIZE	16384
 --- a/netem/paretonormal.c
 +++ b/netem/paretonormal.c
-@@ -14,10 +14,13 @@
+@@ -15,10 +15,13 @@
  #include <string.h>
  #include <math.h>
  #include <limits.h>
diff --git a/package/network/utils/iproute2/patches/115-add-config-xtlibdir.patch b/package/network/utils/iproute2/patches/115-add-config-xtlibdir.patch
index 8702d5fd2d10f0..03df7809f7f0aa 100644
--- a/package/network/utils/iproute2/patches/115-add-config-xtlibdir.patch
+++ b/package/network/utils/iproute2/patches/115-add-config-xtlibdir.patch
@@ -1,6 +1,6 @@
 --- a/tc/Makefile
 +++ b/tc/Makefile
-@@ -128,6 +128,9 @@ CFLAGS += -DCONFIG_GACT -DCONFIG_GACT_PR
+@@ -127,6 +127,9 @@ CFLAGS += -DCONFIG_GACT -DCONFIG_GACT_PR
  ifneq ($(IPT_LIB_DIR),)
  	CFLAGS += -DIPT_LIB_DIR=\"$(IPT_LIB_DIR)\"
  endif
diff --git a/package/network/utils/iproute2/patches/140-allow_pfifo_fast.patch b/package/network/utils/iproute2/patches/140-allow_pfifo_fast.patch
index 13de48f412872c..8f5a7d352e5960 100644
--- a/package/network/utils/iproute2/patches/140-allow_pfifo_fast.patch
+++ b/package/network/utils/iproute2/patches/140-allow_pfifo_fast.patch
@@ -1,6 +1,6 @@
 --- a/tc/q_fifo.c
 +++ b/tc/q_fifo.c
-@@ -95,5 +95,6 @@ struct qdisc_util pfifo_head_drop_qdisc_
+@@ -90,5 +90,6 @@ struct qdisc_util pfifo_head_drop_qdisc_
  
  struct qdisc_util pfifo_fast_qdisc_util = {
  	.id = "pfifo_fast",
diff --git a/package/network/utils/iproute2/patches/170-ip_tiny.patch b/package/network/utils/iproute2/patches/170-ip_tiny.patch
index ba2cb0637a7822..71081c36bccb98 100644
--- a/package/network/utils/iproute2/patches/170-ip_tiny.patch
+++ b/package/network/utils/iproute2/patches/170-ip_tiny.patch
@@ -25,7 +25,7 @@
  		sed -n '/'$$s'[^ ]* =/{s:.* \([^ ]*'$$s'[^ ]*\) .*:extern char \1[] __attribute__((weak)); if (!strcmp(sym, "\1")) return \1;:;p}' $$files ; \
 --- a/ip/ip.c
 +++ b/ip/ip.c
-@@ -64,11 +64,17 @@ static void usage(void)
+@@ -61,11 +61,17 @@ static void usage(void)
  	fprintf(stderr,
  		"Usage: ip [ OPTIONS ] OBJECT { COMMAND | help }\n"
  		"       ip [ -force ] -batch filename\n"
@@ -43,7 +43,7 @@
  		"       OPTIONS := { -V[ersion] | -s[tatistics] | -d[etails] | -r[esolve] |\n"
  		"                    -h[uman-readable] | -iec | -j[son] | -p[retty] |\n"
  		"                    -f[amily] { inet | inet6 | mpls | bridge | link } |\n"
-@@ -91,37 +97,49 @@ static const struct cmd {
+@@ -88,37 +94,49 @@ static const struct cmd {
  	int (*func)(int argc, char **argv);
  } cmds[] = {
  	{ "address",	do_ipaddr },
@@ -105,4 +105,4 @@
 +
  UTILOBJ = utils.o utils_math.o rt_names.o ll_map.o ll_types.o ll_proto.o ll_addr.o \
  	inet_proto.o namespace.o json_writer.o json_print.o json_print_math.o \
- 	names.o color.o bpf_legacy.o bpf_glue.o exec.o fs.o cg_map.o
+ 	names.o color.o bpf_legacy.o bpf_glue.o exec.o fs.o cg_map.o ppp_proto.o
diff --git a/package/network/utils/iproute2/patches/175-reduce-dynamic-syms.patch b/package/network/utils/iproute2/patches/175-reduce-dynamic-syms.patch
index c3892e5a0e4b29..d0914848d59550 100644
--- a/package/network/utils/iproute2/patches/175-reduce-dynamic-syms.patch
+++ b/package/network/utils/iproute2/patches/175-reduce-dynamic-syms.patch
@@ -1,6 +1,6 @@
 --- a/tc/Makefile
 +++ b/tc/Makefile
-@@ -114,7 +114,7 @@ LDLIBS += -L. -lm
+@@ -113,7 +113,7 @@ LDLIBS += -L. -lm
  
  ifeq ($(SHARED_LIBS),y)
  LDLIBS += -ldl
@@ -9,7 +9,7 @@
  endif
  
  TCLIB := tc_core.o
-@@ -144,7 +144,7 @@ MODDESTDIR := $(DESTDIR)$(LIBDIR)/tc
+@@ -143,7 +143,7 @@ MODDESTDIR := $(DESTDIR)$(LIBDIR)/tc
  all: tc $(TCSO)
  
  tc: $(TCOBJ) $(LIBNETLINK) libtc.a
@@ -18,7 +18,7 @@
  
  libtc.a: $(TCLIB)
  	$(QUIET_AR)$(AR) rcs $@ $^
-@@ -166,6 +166,7 @@ install: all
+@@ -165,6 +165,7 @@ install: all
  clean:
  	rm -f $(TCOBJ) $(TCLIB) libtc.a tc *.so emp_ematch.tab.h; \
  	rm -f emp_ematch.tab.*
@@ -26,7 +26,7 @@
  
  q_atm.so: q_atm.c
  	$(QUIET_CC)$(CC) $(CFLAGS) $(CPPFLAGS) $(LDFLAGS) -shared -fpic -o q_atm.so q_atm.c -latm
-@@ -205,4 +206,16 @@ static-syms.h: $(wildcard *.c)
+@@ -204,4 +205,16 @@ static-syms.h: $(wildcard *.c)
  		sed -n '/'$$s'[^ ]* =/{s:.* \([^ ]*'$$s'[^ ]*\) .*:extern char \1[] __attribute__((weak)); if (!strcmp(sym, "\1")) return \1;:;p}' $$files ; \
  	done > $@
  
diff --git a/package/network/utils/iproute2/patches/180-drop_FAILED_POLICY.patch b/package/network/utils/iproute2/patches/180-drop_FAILED_POLICY.patch
index 094ff393a68df8..9ce7dd9a13e364 100644
--- a/package/network/utils/iproute2/patches/180-drop_FAILED_POLICY.patch
+++ b/package/network/utils/iproute2/patches/180-drop_FAILED_POLICY.patch
@@ -11,7 +11,7 @@ Subject: [PATCH] add support for dropping with FAILED_POLICY
 
 --- a/ip/rtm_map.c
 +++ b/ip/rtm_map.c
-@@ -54,6 +54,8 @@ char *rtnl_rtntype_n2a(int id, char *buf
+@@ -49,6 +49,8 @@ char *rtnl_rtntype_n2a(int id, char *buf
  		return "nat";
  	case RTN_XRESOLVE:
  		return "xresolve";
@@ -20,7 +20,7 @@ Subject: [PATCH] add support for dropping with FAILED_POLICY
  	default:
  		snprintf(buf, len, "%d", id);
  		return buf;
-@@ -89,6 +91,8 @@ int rtnl_rtntype_a2n(int *id, char *arg)
+@@ -84,6 +86,8 @@ int rtnl_rtntype_a2n(int *id, char *arg)
  		res = RTN_UNICAST;
  	else if (strcmp(arg, "throw") == 0)
  		res = RTN_THROW;
diff --git a/package/network/utils/iproute2/patches/195-build_variant_ip_tc.patch b/package/network/utils/iproute2/patches/195-build_variant_ip_tc.patch
index dc9c0b2969d68d..141763460da501 100644
--- a/package/network/utils/iproute2/patches/195-build_variant_ip_tc.patch
+++ b/package/network/utils/iproute2/patches/195-build_variant_ip_tc.patch
@@ -11,7 +11,7 @@
  
 --- a/tc/Makefile
 +++ b/tc/Makefile
-@@ -141,7 +141,7 @@ MODDESTDIR := $(DESTDIR)$(LIBDIR)/tc
+@@ -140,7 +140,7 @@ MODDESTDIR := $(DESTDIR)$(LIBDIR)/tc
  	$(QUIET_CC)$(CC) $(CFLAGS) $(CPPFLAGS) $(LDFLAGS) -shared -fpic $< -o $@
  
  
diff --git a/package/network/utils/ipset/Makefile b/package/network/utils/ipset/Makefile
index 65133d105cecfc..6d48103d0ecf37 100644
--- a/package/network/utils/ipset/Makefile
+++ b/package/network/utils/ipset/Makefile
@@ -9,12 +9,12 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=ipset
-PKG_VERSION:=7.15
-PKG_RELEASE:=2
+PKG_VERSION:=7.17
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
-PKG_SOURCE_URL:=http://ipset.netfilter.org
-PKG_HASH:=0a5545aaadb640142c1f888d366a78ddf8724799967fa20686a70053bd621751
+PKG_SOURCE_URL:=https://ipset.netfilter.org
+PKG_HASH:=be49c9ff489dd6610cad6541e743c3384eac96e9f24707da7b3929d8f2ac64d8
 
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 PKG_LICENSE:=GPL-2.0
diff --git a/package/network/utils/iptables/Makefile b/package/network/utils/iptables/Makefile
index dc57bb55d044ba..0d6d76fc080fca 100644
--- a/package/network/utils/iptables/Makefile
+++ b/package/network/utils/iptables/Makefile
@@ -20,6 +20,7 @@ PKG_FIXUP:=autoreconf
 PKG_FLAGS:=nonshared
 
 PKG_INSTALL:=1
+PKG_BUILD_FLAGS:=gc-sections
 PKG_BUILD_PARALLEL:=1
 PKG_LICENSE:=GPL-2.0
 PKG_CPE_ID:=cpe:/a:netfilter_core_team:iptables
@@ -150,7 +151,7 @@ Extra iptables nftables nft binaries.
 endef
 
 define Package/iptables-mod-conntrack-extra
-$(call Package/iptables/Module, +kmod-ipt-conntrack-extra +kmod-ipt-raw)
+$(call Package/iptables/Module, +kmod-ipt-conntrack-extra)
   TITLE:=Extra connection tracking extensions
 endef
 
@@ -591,12 +592,8 @@ TARGET_CPPFLAGS := \
 TARGET_CFLAGS += \
 	-I$(PKG_BUILD_DIR)/include \
 	-I$(LINUX_DIR)/user_headers/include \
-	-ffunction-sections -fdata-sections \
 	-DNO_LEGACY
 
-TARGET_LDFLAGS += \
-	-Wl,--gc-sections
-
 CONFIGURE_ARGS += \
 	--enable-shared \
 	--enable-static \
diff --git a/package/network/utils/iw/Makefile b/package/network/utils/iw/Makefile
index eb3a9ba091d2a2..746c2c3c129cd3 100644
--- a/package/network/utils/iw/Makefile
+++ b/package/network/utils/iw/Makefile
@@ -18,6 +18,8 @@ PKG_HASH:=f167bbe947dd53bb9ebc0c1dcef5db6ad73ac1d6084f2c6f9376c5c360cc4d4e
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=GPL-2.0
 
+PKG_BUILD_FLAGS:=gc-sections lto
+
 include $(INCLUDE_DIR)/package.mk
 
 define Package/iw
@@ -46,8 +48,7 @@ TARGET_CPPFLAGS:= \
 	-I$(STAGING_DIR)/usr/include/libnl-tiny \
 	$(TARGET_CPPFLAGS) \
 	-DCONFIG_LIBNL20 \
-	-D_GNU_SOURCE \
-	-flto
+	-D_GNU_SOURCE
 
 ifeq ($(BUILD_VARIANT),full)
   TARGET_CPPFLAGS += -DIW_FULL
@@ -55,8 +56,8 @@ ifeq ($(BUILD_VARIANT),full)
 endif
 
 MAKE_FLAGS += \
-	CFLAGS="$(TARGET_CPPFLAGS) $(TARGET_CFLAGS) -ffunction-sections -fdata-sections" \
-	LDFLAGS="$(TARGET_LDFLAGS) -Wl,--gc-sections -flto" \
+	CFLAGS="$(TARGET_CPPFLAGS) $(TARGET_CFLAGS)" \
+	LDFLAGS="$(TARGET_LDFLAGS)" \
 	NL1FOUND="" NL2FOUND=Y \
 	NLLIBNAME="libnl-tiny" \
 	LIBS="-lm -lnl-tiny" \
diff --git a/package/network/utils/iw/patches/001-nl80211_h_sync.patch b/package/network/utils/iw/patches/001-nl80211_h_sync.patch
index 49d08d9b01a093..afe27d6f238f15 100644
--- a/package/network/utils/iw/patches/001-nl80211_h_sync.patch
+++ b/package/network/utils/iw/patches/001-nl80211_h_sync.patch
@@ -1,554 +1,259 @@
 --- a/nl80211.h
 +++ b/nl80211.h
-@@ -11,7 +11,7 @@
-  * Copyright 2008 Jouni Malinen <jouni.malinen@atheros.com>
-  * Copyright 2008 Colin McCabe <colin@cozybit.com>
-  * Copyright 2015-2017	Intel Deutschland GmbH
-- * Copyright (C) 2018-2022 Intel Corporation
-+ * Copyright (C) 2018-2021 Intel Corporation
-  *
-  * Permission to use, copy, modify, and/or distribute this software for any
-  * purpose with or without fee is hereby granted, provided that the above
-@@ -301,29 +301,6 @@
+@@ -324,6 +324,17 @@
   */
  
  /**
-- * DOC: FILS shared key crypto offload
-- *
-- * This feature is applicable to drivers running in AP mode.
-- *
-- * FILS shared key crypto offload can be advertised by drivers by setting
-- * @NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD flag. The drivers that support
-- * FILS shared key crypto offload should be able to encrypt and decrypt
-- * association frames for FILS shared key authentication as per IEEE 802.11ai.
-- * With this capability, for FILS key derivation, drivers depend on userspace.
-- *
-- * After FILS key derivation, userspace shares the FILS AAD details with the
-- * driver and the driver stores the same to use in decryption of association
-- * request and in encryption of association response. The below parameters
-- * should be given to the driver in %NL80211_CMD_SET_FILS_AAD.
-- *	%NL80211_ATTR_MAC - STA MAC address, used for storing FILS AAD per STA
-- *	%NL80211_ATTR_FILS_KEK - Used for encryption or decryption
-- *	%NL80211_ATTR_FILS_NONCES - Used for encryption or decryption
-- *			(STA Nonce 16 bytes followed by AP Nonce 16 bytes)
-- *
-- * Once the association is done, the driver cleans the FILS AAD data.
-- */
--
--/**
++ * DOC: Multi-Link Operation
++ *
++ * In Multi-Link Operation, a connection between to MLDs utilizes multiple
++ * links. To use this in nl80211, various commands and responses now need
++ * to or will include the new %NL80211_ATTR_MLO_LINKS attribute.
++ * Additionally, various commands that need to operate on a specific link
++ * now need to be given the %NL80211_ATTR_MLO_LINK_ID attribute, e.g. to
++ * use %NL80211_CMD_START_AP or similar functions.
++ */
++
++/**
   * enum nl80211_commands - supported nl80211 commands
   *
   * @NL80211_CMD_UNSPEC: unspecified command to catch errors
-@@ -1226,17 +1203,6 @@
-  * @NL80211_CMD_COLOR_CHANGE_COMPLETED: Notify userland that the color change
-  *	has completed
+@@ -366,14 +377,22 @@
+  *	the non-transmitting interfaces are deleted as well.
+  *
+  * @NL80211_CMD_GET_KEY: Get sequence counter information for a key specified
+- *	by %NL80211_ATTR_KEY_IDX and/or %NL80211_ATTR_MAC.
++ *	by %NL80211_ATTR_KEY_IDX and/or %NL80211_ATTR_MAC. %NL80211_ATTR_MAC
++ *	represents peer's MLD address for MLO pairwise key. For MLO group key,
++ *	the link is identified by %NL80211_ATTR_MLO_LINK_ID.
+  * @NL80211_CMD_SET_KEY: Set key attributes %NL80211_ATTR_KEY_DEFAULT,
+  *	%NL80211_ATTR_KEY_DEFAULT_MGMT, or %NL80211_ATTR_KEY_THRESHOLD.
++ *	For MLO connection, the link to set default key is identified by
++ *	%NL80211_ATTR_MLO_LINK_ID.
+  * @NL80211_CMD_NEW_KEY: add a key with given %NL80211_ATTR_KEY_DATA,
+  *	%NL80211_ATTR_KEY_IDX, %NL80211_ATTR_MAC, %NL80211_ATTR_KEY_CIPHER,
+- *	and %NL80211_ATTR_KEY_SEQ attributes.
++ *	and %NL80211_ATTR_KEY_SEQ attributes. %NL80211_ATTR_MAC represents
++ *	peer's MLD address for MLO pairwise key. The link to add MLO
++ *	group key is identified by %NL80211_ATTR_MLO_LINK_ID.
+  * @NL80211_CMD_DEL_KEY: delete a key identified by %NL80211_ATTR_KEY_IDX
+- *	or %NL80211_ATTR_MAC.
++ *	or %NL80211_ATTR_MAC. %NL80211_ATTR_MAC represents peer's MLD address
++ *	for MLO pairwise key. The link to delete group key is identified by
++ *	%NL80211_ATTR_MLO_LINK_ID.
   *
-- * @NL80211_CMD_SET_FILS_AAD: Set FILS AAD data to the driver using -
-- *	&NL80211_ATTR_MAC - for STA MAC address
-- *	&NL80211_ATTR_FILS_KEK - for KEK
-- *	&NL80211_ATTR_FILS_NONCES - for FILS Nonces
-- *		(STA Nonce 16 bytes followed by AP Nonce 16 bytes)
-- *
-- * @NL80211_CMD_ASSOC_COMEBACK: notification about an association
-- *      temporal rejection with comeback. The event includes %NL80211_ATTR_MAC
-- *      to describe the BSSID address of the AP and %NL80211_ATTR_TIMEOUT to
-- *      specify the timeout value.
-- *
+  * @NL80211_CMD_GET_BEACON: (not used)
+  * @NL80211_CMD_SET_BEACON: change the beacon on an access point interface
+@@ -753,6 +772,13 @@
+  *	%NL80211_ATTR_CSA_C_OFFSETS_TX is an array of offsets to CSA
+  *	counters which will be updated to the current value. This attribute
+  *	is used during CSA period.
++ *	For TX on an MLD, the frequency can be omitted and the link ID be
++ *	specified, or if transmitting to a known peer MLD (with MLD addresses
++ *	in the frame) both can be omitted and the link will be selected by
++ *	lower layers.
++ *	For RX notification, %NL80211_ATTR_RX_HW_TIMESTAMP may be included to
++ *	indicate the frame RX timestamp and %NL80211_ATTR_TX_HW_TIMESTAMP may
++ *	be included to indicate the ack TX timestamp.
+  * @NL80211_CMD_FRAME_WAIT_CANCEL: When an off-channel TX was requested, this
+  *	command may be used with the corresponding cookie to cancel the wait
+  *	time if it is known that it is no longer necessary.  This command is
+@@ -763,7 +789,9 @@
+  *	transmitted with %NL80211_CMD_FRAME. %NL80211_ATTR_COOKIE identifies
+  *	the TX command and %NL80211_ATTR_FRAME includes the contents of the
+  *	frame. %NL80211_ATTR_ACK flag is included if the recipient acknowledged
+- *	the frame.
++ *	the frame. %NL80211_ATTR_TX_HW_TIMESTAMP may be included to indicate the
++ *	tx timestamp and %NL80211_ATTR_RX_HW_TIMESTAMP may be included to
++ *	indicate the ack RX timestamp.
+  * @NL80211_CMD_ACTION_TX_STATUS: Alias for @NL80211_CMD_FRAME_TX_STATUS for
+  *	backward compatibility.
+  *
+@@ -1108,6 +1136,12 @@
+  *	has been received. %NL80211_ATTR_FRAME is used to specify the
+  *	frame contents.  The frame is the raw EAPoL data, without ethernet or
+  *	802.11 headers.
++ *	For an MLD transmitter, the %NL80211_ATTR_MLO_LINK_ID may be given and
++ *	its effect will depend on the destination: If the destination is known
++ *	to be an MLD, this will be used as a hint to select the link to transmit
++ *	the frame on. If the destination is not an MLD, this will select both
++ *	the link to transmit on and the source address will be set to the link
++ *	address of that link.
+  *	When used as an event indication %NL80211_ATTR_CONTROL_PORT_ETHERTYPE,
+  *	%NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT and %NL80211_ATTR_MAC are added
+  *	indicating the protocol type of the received frame; whether the frame
+@@ -1237,6 +1271,16 @@
+  *      to describe the BSSID address of the AP and %NL80211_ATTR_TIMEOUT to
+  *      specify the timeout value.
+  *
++ * @NL80211_CMD_ADD_LINK: Add a new link to an interface. The
++ *	%NL80211_ATTR_MLO_LINK_ID attribute is used for the new link.
++ * @NL80211_CMD_REMOVE_LINK: Remove a link from an interface. This may come
++ *	without %NL80211_ATTR_MLO_LINK_ID as an easy way to remove all links
++ *	in preparation for e.g. roaming to a regular (non-MLO) AP.
++ *
++ * @NL80211_CMD_ADD_LINK_STA: Add a link to an MLD station
++ * @NL80211_CMD_MODIFY_LINK_STA: Modify a link of an MLD station
++ * @NL80211_CMD_REMOVE_LINK_STA: Remove a link of an MLD station
++ *
   * @NL80211_CMD_MAX: highest used command number
   * @__NL80211_CMD_AFTER_LAST: internal use
   */
-@@ -1477,10 +1443,6 @@ enum nl80211_commands {
- 	NL80211_CMD_COLOR_CHANGE_ABORTED,
- 	NL80211_CMD_COLOR_CHANGE_COMPLETED,
+@@ -1481,6 +1525,13 @@ enum nl80211_commands {
+ 
+ 	NL80211_CMD_ASSOC_COMEBACK,
  
--	NL80211_CMD_SET_FILS_AAD,
--
--	NL80211_CMD_ASSOC_COMEBACK,
--
++	NL80211_CMD_ADD_LINK,
++	NL80211_CMD_REMOVE_LINK,
++
++	NL80211_CMD_ADD_LINK_STA,
++	NL80211_CMD_MODIFY_LINK_STA,
++	NL80211_CMD_REMOVE_LINK_STA,
++
  	/* add new commands above here */
  
  	/* used to define NL80211_CMD_MAX below */
-@@ -2477,9 +2439,7 @@ enum nl80211_commands {
-  *	space supports external authentication. This attribute shall be used
-  *	with %NL80211_CMD_CONNECT and %NL80211_CMD_START_AP request. The driver
-  *	may offload authentication processing to user space if this capability
-- *	is indicated in the respective requests from the user space. (This flag
-- *	attribute deprecated for %NL80211_CMD_START_AP, use
-- *	%NL80211_ATTR_AP_SETTINGS_FLAGS)
-+ *	is indicated in the respective requests from the user space.
+@@ -2340,8 +2391,10 @@ enum nl80211_commands {
   *
-  * @NL80211_ATTR_NSS: Station's New/updated  RX_NSS value notified using this
-  *	u8 attribute. This is used with %NL80211_CMD_STA_OPMODE_CHANGED.
-@@ -2655,13 +2615,8 @@ enum nl80211_commands {
-  *	switching on a different channel during CAC detection on the selected
-  *	radar channel.
+  * @NL80211_ATTR_IFTYPE_EXT_CAPA: Nested attribute of the following attributes:
+  *	%NL80211_ATTR_IFTYPE, %NL80211_ATTR_EXT_CAPA,
+- *	%NL80211_ATTR_EXT_CAPA_MASK, to specify the extended capabilities per
+- *	interface type.
++ *	%NL80211_ATTR_EXT_CAPA_MASK, to specify the extended capabilities and
++ *	other interface-type specific capabilities per interface type. For MLO,
++ *	%NL80211_ATTR_EML_CAPABILITY and %NL80211_ATTR_MLD_CAPA_AND_OPS are
++ *	present.
   *
-- * @NL80211_ATTR_AP_SETTINGS_FLAGS: u32 attribute contains ap settings flags,
-- *	enumerated in &enum nl80211_ap_settings_flags. This attribute shall be
-- *	used with %NL80211_CMD_START_AP request.
-- *
-- * @NL80211_ATTR_EHT_CAPABILITY: EHT Capability information element (from
-- *	association request when used with NL80211_CMD_NEW_STATION). Can be set
-- *	only if %NL80211_STA_FLAG_WME is set.
+  * @NL80211_ATTR_MU_MIMO_GROUP_DATA: array of 24 bytes that defines a MU-MIMO
+  *	groupID for monitor mode.
+@@ -2663,6 +2716,44 @@ enum nl80211_commands {
+  *	association request when used with NL80211_CMD_NEW_STATION). Can be set
+  *	only if %NL80211_STA_FLAG_WME is set.
+  *
++ * @NL80211_ATTR_MLO_LINK_ID: A (u8) link ID for use with MLO, to be used with
++ *	various commands that need a link ID to operate.
++ * @NL80211_ATTR_MLO_LINKS: A nested array of links, each containing some
++ *	per-link information and a link ID.
++ * @NL80211_ATTR_MLD_ADDR: An MLD address, used with various commands such as
++ *	authenticate/associate.
++ *
++ * @NL80211_ATTR_MLO_SUPPORT: Flag attribute to indicate user space supports MLO
++ *	connection. Used with %NL80211_CMD_CONNECT. If this attribute is not
++ *	included in NL80211_CMD_CONNECT drivers must not perform MLO connection.
++ *
++ * @NL80211_ATTR_MAX_NUM_AKM_SUITES: U16 attribute. Indicates maximum number of
++ *	AKM suites allowed for %NL80211_CMD_CONNECT, %NL80211_CMD_ASSOCIATE and
++ *	%NL80211_CMD_START_AP in %NL80211_CMD_GET_WIPHY response. If this
++ *	attribute is not present userspace shall consider maximum number of AKM
++ *	suites allowed as %NL80211_MAX_NR_AKM_SUITES which is the legacy maximum
++ *	number prior to the introduction of this attribute.
++ *
++ * @NL80211_ATTR_EML_CAPABILITY: EML Capability information (u16)
++ * @NL80211_ATTR_MLD_CAPA_AND_OPS: MLD Capabilities and Operations (u16)
++ *
++ * @NL80211_ATTR_TX_HW_TIMESTAMP: Hardware timestamp for TX operation in
++ *	nanoseconds (u64). This is the device clock timestamp so it will
++ *	probably reset when the device is stopped or the firmware is reset.
++ *	When used with %NL80211_CMD_FRAME_TX_STATUS, indicates the frame TX
++ *	timestamp. When used with %NL80211_CMD_FRAME RX notification, indicates
++ *	the ack TX timestamp.
++ * @NL80211_ATTR_RX_HW_TIMESTAMP: Hardware timestamp for RX operation in
++ *	nanoseconds (u64). This is the device clock timestamp so it will
++ *	probably reset when the device is stopped or the firmware is reset.
++ *	When used with %NL80211_CMD_FRAME_TX_STATUS, indicates the ack RX
++ *	timestamp. When used with %NL80211_CMD_FRAME RX notification, indicates
++ *	the incoming frame RX timestamp.
++ * @NL80211_ATTR_TD_BITMAP: Transition Disable bitmap, for subsequent
++ *	(re)associations.
 + * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
 + *	transmit power to stay within regulatory limits. u32, dBi.
-  *
++ *
   * @NUM_NL80211_ATTR: total number of nl80211_attrs available
   * @NL80211_ATTR_MAX: highest attribute number currently defined
-@@ -3171,11 +3126,7 @@ enum nl80211_attrs {
+  * @__NL80211_ATTR_AFTER_LAST: internal use
+@@ -3177,6 +3268,23 @@ enum nl80211_attrs {
  
- 	NL80211_ATTR_RADAR_BACKGROUND,
+ 	NL80211_ATTR_DISABLE_EHT,
  
--	NL80211_ATTR_AP_SETTINGS_FLAGS,
--
--	NL80211_ATTR_EHT_CAPABILITY,
--
--	NL80211_ATTR_DISABLE_EHT,
++	NL80211_ATTR_MLO_LINKS,
++	NL80211_ATTR_MLO_LINK_ID,
++	NL80211_ATTR_MLD_ADDR,
++
++	NL80211_ATTR_MLO_SUPPORT,
++
++	NL80211_ATTR_MAX_NUM_AKM_SUITES,
++
++	NL80211_ATTR_EML_CAPABILITY,
++	NL80211_ATTR_MLD_CAPA_AND_OPS,
++
++	NL80211_ATTR_TX_HW_TIMESTAMP,
++	NL80211_ATTR_RX_HW_TIMESTAMP,
++	NL80211_ATTR_TD_BITMAP,
++
 +	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
- 
++
  	/* add attributes here, update the policy in nl80211.c */
  
-@@ -3232,8 +3183,6 @@ enum nl80211_attrs {
+ 	__NL80211_ATTR_AFTER_LAST,
+@@ -3231,6 +3339,11 @@ enum nl80211_attrs {
+ #define NL80211_HE_MIN_CAPABILITY_LEN           16
  #define NL80211_HE_MAX_CAPABILITY_LEN           54
  #define NL80211_MAX_NR_CIPHER_SUITES		5
++
++/*
++ * NL80211_MAX_NR_AKM_SUITES is obsolete when %NL80211_ATTR_MAX_NUM_AKM_SUITES
++ * present in %NL80211_CMD_GET_WIPHY response.
++ */
  #define NL80211_MAX_NR_AKM_SUITES		2
--#define NL80211_EHT_MIN_CAPABILITY_LEN          13
--#define NL80211_EHT_MAX_CAPABILITY_LEN          51
- 
- #define NL80211_MIN_REMAIN_ON_CHANNEL_TIME	10
- 
-@@ -3261,7 +3210,7 @@ enum nl80211_attrs {
-  *	and therefore can't be created in the normal ways, use the
-  *	%NL80211_CMD_START_P2P_DEVICE and %NL80211_CMD_STOP_P2P_DEVICE
-  *	commands to create and destroy one
-- * @NL80211_IFTYPE_OCB: Outside Context of a BSS
-+ * @NL80211_IF_TYPE_OCB: Outside Context of a BSS
-  *	This mode corresponds to the MIB variable dot11OCBActivated=true
-  * @NL80211_IFTYPE_NAN: NAN device interface type (not a netdev)
-  * @NL80211_IFTYPE_MAX: highest interface type number currently defined
-@@ -3403,56 +3352,6 @@ enum nl80211_he_ru_alloc {
- };
- 
- /**
-- * enum nl80211_eht_gi - EHT guard interval
-- * @NL80211_RATE_INFO_EHT_GI_0_8: 0.8 usec
-- * @NL80211_RATE_INFO_EHT_GI_1_6: 1.6 usec
-- * @NL80211_RATE_INFO_EHT_GI_3_2: 3.2 usec
-- */
--enum nl80211_eht_gi {
--	NL80211_RATE_INFO_EHT_GI_0_8,
--	NL80211_RATE_INFO_EHT_GI_1_6,
--	NL80211_RATE_INFO_EHT_GI_3_2,
--};
--
--/**
-- * enum nl80211_eht_ru_alloc - EHT RU allocation values
-- * @NL80211_RATE_INFO_EHT_RU_ALLOC_26: 26-tone RU allocation
-- * @NL80211_RATE_INFO_EHT_RU_ALLOC_52: 52-tone RU allocation
-- * @NL80211_RATE_INFO_EHT_RU_ALLOC_52P26: 52+26-tone RU allocation
-- * @NL80211_RATE_INFO_EHT_RU_ALLOC_106: 106-tone RU allocation
-- * @NL80211_RATE_INFO_EHT_RU_ALLOC_106P26: 106+26 tone RU allocation
-- * @NL80211_RATE_INFO_EHT_RU_ALLOC_242: 242-tone RU allocation
-- * @NL80211_RATE_INFO_EHT_RU_ALLOC_484: 484-tone RU allocation
-- * @NL80211_RATE_INFO_EHT_RU_ALLOC_484P242: 484+242 tone RU allocation
-- * @NL80211_RATE_INFO_EHT_RU_ALLOC_996: 996-tone RU allocation
-- * @NL80211_RATE_INFO_EHT_RU_ALLOC_996P484: 996+484 tone RU allocation
-- * @NL80211_RATE_INFO_EHT_RU_ALLOC_996P484P242: 996+484+242 tone RU allocation
-- * @NL80211_RATE_INFO_EHT_RU_ALLOC_2x996: 2x996-tone RU allocation
-- * @NL80211_RATE_INFO_EHT_RU_ALLOC_2x996P484: 2x996+484 tone RU allocation
-- * @NL80211_RATE_INFO_EHT_RU_ALLOC_3x996: 3x996-tone RU allocation
-- * @NL80211_RATE_INFO_EHT_RU_ALLOC_3x996P484: 3x996+484 tone RU allocation
-- * @NL80211_RATE_INFO_EHT_RU_ALLOC_4x996: 4x996-tone RU allocation
-- */
--enum nl80211_eht_ru_alloc {
--	NL80211_RATE_INFO_EHT_RU_ALLOC_26,
--	NL80211_RATE_INFO_EHT_RU_ALLOC_52,
--	NL80211_RATE_INFO_EHT_RU_ALLOC_52P26,
--	NL80211_RATE_INFO_EHT_RU_ALLOC_106,
--	NL80211_RATE_INFO_EHT_RU_ALLOC_106P26,
--	NL80211_RATE_INFO_EHT_RU_ALLOC_242,
--	NL80211_RATE_INFO_EHT_RU_ALLOC_484,
--	NL80211_RATE_INFO_EHT_RU_ALLOC_484P242,
--	NL80211_RATE_INFO_EHT_RU_ALLOC_996,
--	NL80211_RATE_INFO_EHT_RU_ALLOC_996P484,
--	NL80211_RATE_INFO_EHT_RU_ALLOC_996P484P242,
--	NL80211_RATE_INFO_EHT_RU_ALLOC_2x996,
--	NL80211_RATE_INFO_EHT_RU_ALLOC_2x996P484,
--	NL80211_RATE_INFO_EHT_RU_ALLOC_3x996,
--	NL80211_RATE_INFO_EHT_RU_ALLOC_3x996P484,
--	NL80211_RATE_INFO_EHT_RU_ALLOC_4x996,
--};
--
--/**
-  * enum nl80211_rate_info - bitrate information
-  *
-  * These attribute types are used with %NL80211_STA_INFO_TXRATE
-@@ -3491,13 +3390,6 @@ enum nl80211_eht_ru_alloc {
-  * @NL80211_RATE_INFO_HE_DCM: HE DCM value (u8, 0/1)
-  * @NL80211_RATE_INFO_RU_ALLOC: HE RU allocation, if not present then
-  *	non-OFDMA was used (u8, see &enum nl80211_he_ru_alloc)
-- * @NL80211_RATE_INFO_320_MHZ_WIDTH: 320 MHz bitrate
-- * @NL80211_RATE_INFO_EHT_MCS: EHT MCS index (u8, 0-15)
-- * @NL80211_RATE_INFO_EHT_NSS: EHT NSS value (u8, 1-8)
-- * @NL80211_RATE_INFO_EHT_GI: EHT guard interval identifier
-- *	(u8, see &enum nl80211_eht_gi)
-- * @NL80211_RATE_INFO_EHT_RU_ALLOC: EHT RU allocation, if not present then
-- *	non-OFDMA was used (u8, see &enum nl80211_eht_ru_alloc)
-  * @__NL80211_RATE_INFO_AFTER_LAST: internal use
+ #define NL80211_EHT_MIN_CAPABILITY_LEN          13
+ #define NL80211_EHT_MAX_CAPABILITY_LEN          51
+@@ -4853,6 +4966,8 @@ enum nl80211_bss_scan_width {
+  *	Contains a nested array of signal strength attributes (u8, dBm),
+  *	using the nesting index as the antenna number.
+  * @NL80211_BSS_FREQUENCY_OFFSET: frequency offset in KHz
++ * @NL80211_BSS_MLO_LINK_ID: MLO link ID of the BSS (u8).
++ * @NL80211_BSS_MLD_ADDR: MLD address of this BSS if connected to it.
+  * @__NL80211_BSS_AFTER_LAST: internal
+  * @NL80211_BSS_MAX: highest BSS attribute
   */
- enum nl80211_rate_info {
-@@ -3519,11 +3411,6 @@ enum nl80211_rate_info {
- 	NL80211_RATE_INFO_HE_GI,
- 	NL80211_RATE_INFO_HE_DCM,
- 	NL80211_RATE_INFO_HE_RU_ALLOC,
--	NL80211_RATE_INFO_320_MHZ_WIDTH,
--	NL80211_RATE_INFO_EHT_MCS,
--	NL80211_RATE_INFO_EHT_NSS,
--	NL80211_RATE_INFO_EHT_GI,
--	NL80211_RATE_INFO_EHT_RU_ALLOC,
+@@ -4878,6 +4993,8 @@ enum nl80211_bss {
+ 	NL80211_BSS_PARENT_BSSID,
+ 	NL80211_BSS_CHAIN_SIGNAL,
+ 	NL80211_BSS_FREQUENCY_OFFSET,
++	NL80211_BSS_MLO_LINK_ID,
++	NL80211_BSS_MLD_ADDR,
  
  	/* keep last */
- 	__NL80211_RATE_INFO_AFTER_LAST,
-@@ -3834,20 +3721,13 @@ enum nl80211_mpath_info {
-  *     capabilities IE
-  * @NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE: HE PPE thresholds information as
-  *     defined in HE capabilities IE
-+ * @NL80211_BAND_IFTYPE_ATTR_MAX: highest band HE capability attribute currently
-+ *     defined
-  * @NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA: HE 6GHz band capabilities (__le16),
-  *	given for all 6 GHz band channels
-  * @NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS: vendor element capabilities that are
-  *	advertised on this band/for this iftype (binary)
-- * @NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC: EHT MAC capabilities as in EHT
-- *	capabilities element
-- * @NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY: EHT PHY capabilities as in EHT
-- *	capabilities element
-- * @NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET: EHT supported NSS/MCS as in EHT
-- *	capabilities element
-- * @NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE: EHT PPE thresholds information as
-- *	defined in EHT capabilities element
-  * @__NL80211_BAND_IFTYPE_ATTR_AFTER_LAST: internal use
-- * @NL80211_BAND_IFTYPE_ATTR_MAX: highest band attribute currently defined
-  */
- enum nl80211_band_iftype_attr {
- 	__NL80211_BAND_IFTYPE_ATTR_INVALID,
-@@ -3859,10 +3739,6 @@ enum nl80211_band_iftype_attr {
- 	NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
- 	NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
- 	NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS,
--	NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC,
--	NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY,
--	NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET,
--	NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE,
- 
- 	/* keep last */
- 	__NL80211_BAND_IFTYPE_ATTR_AFTER_LAST,
-@@ -4007,10 +3883,6 @@ enum nl80211_wmm_rule {
-  *	on this channel in current regulatory domain.
-  * @NL80211_FREQUENCY_ATTR_16MHZ: 16 MHz operation is allowed
-  *	on this channel in current regulatory domain.
-- * @NL80211_FREQUENCY_ATTR_NO_320MHZ: any 320 MHz channel using this channel
-- *	as the primary or any of the secondary channels isn't possible
-- * @NL80211_FREQUENCY_ATTR_NO_EHT: EHT operation is not allowed on this channel
-- *	in current regulatory domain.
-  * @NL80211_FREQUENCY_ATTR_MAX: highest frequency attribute number
-  *	currently defined
-  * @__NL80211_FREQUENCY_ATTR_AFTER_LAST: internal use
-@@ -4047,8 +3919,6 @@ enum nl80211_frequency_attr {
- 	NL80211_FREQUENCY_ATTR_4MHZ,
- 	NL80211_FREQUENCY_ATTR_8MHZ,
- 	NL80211_FREQUENCY_ATTR_16MHZ,
--	NL80211_FREQUENCY_ATTR_NO_320MHZ,
--	NL80211_FREQUENCY_ATTR_NO_EHT,
- 
- 	/* keep last */
- 	__NL80211_FREQUENCY_ATTR_AFTER_LAST,
-@@ -4247,7 +4117,6 @@ enum nl80211_sched_scan_match_attr {
-  * @NL80211_RRF_NO_80MHZ: 80MHz operation not allowed
-  * @NL80211_RRF_NO_160MHZ: 160MHz operation not allowed
-  * @NL80211_RRF_NO_HE: HE operation not allowed
-- * @NL80211_RRF_NO_320MHZ: 320MHz operation not allowed
-  */
- enum nl80211_reg_rule_flags {
- 	NL80211_RRF_NO_OFDM		= 1<<0,
-@@ -4266,7 +4135,6 @@ enum nl80211_reg_rule_flags {
- 	NL80211_RRF_NO_80MHZ		= 1<<15,
- 	NL80211_RRF_NO_160MHZ		= 1<<16,
- 	NL80211_RRF_NO_HE		= 1<<17,
--	NL80211_RRF_NO_320MHZ		= 1<<18,
- };
- 
- #define NL80211_RRF_PASSIVE_SCAN	NL80211_RRF_NO_IR
-@@ -4764,8 +4632,6 @@ enum nl80211_key_mode {
-  * @NL80211_CHAN_WIDTH_4: 4 MHz OFDM channel
-  * @NL80211_CHAN_WIDTH_8: 8 MHz OFDM channel
-  * @NL80211_CHAN_WIDTH_16: 16 MHz OFDM channel
-- * @NL80211_CHAN_WIDTH_320: 320 MHz channel, the %NL80211_ATTR_CENTER_FREQ1
-- *	attribute must be provided as well
-  */
- enum nl80211_chan_width {
- 	NL80211_CHAN_WIDTH_20_NOHT,
-@@ -4781,7 +4647,6 @@ enum nl80211_chan_width {
- 	NL80211_CHAN_WIDTH_4,
- 	NL80211_CHAN_WIDTH_8,
- 	NL80211_CHAN_WIDTH_16,
--	NL80211_CHAN_WIDTH_320,
- };
- 
- /**
-@@ -5096,7 +4961,6 @@ enum nl80211_txrate_gi {
-  * @NL80211_BAND_60GHZ: around 60 GHz band (58.32 - 69.12 GHz)
-  * @NL80211_BAND_6GHZ: around 6 GHz band (5.9 - 7.2 GHz)
-  * @NL80211_BAND_S1GHZ: around 900MHz, supported by S1G PHYs
-- * @NL80211_BAND_LC: light communication band (placeholder)
-  * @NUM_NL80211_BANDS: number of bands, avoid using this in userspace
-  *	since newer kernel versions may support more bands
-  */
-@@ -5106,7 +4970,6 @@ enum nl80211_band {
- 	NL80211_BAND_60GHZ,
- 	NL80211_BAND_6GHZ,
- 	NL80211_BAND_S1GHZ,
--	NL80211_BAND_LC,
- 
- 	NUM_NL80211_BANDS,
- };
-@@ -5673,7 +5536,7 @@ enum nl80211_iface_limit_attrs {
-  *	=> allows 8 of AP/GO that can have BI gcd >= min gcd
-  *
-  *	numbers = [ #{STA} <= 2 ], channels = 2, max = 2
-- *	=> allows two STAs on the same or on different channels
-+ *	=> allows two STAs on different channels
-  *
-  *	numbers = [ #{STA} <= 1, #{P2P-client,P2P-GO} <= 3 ], max = 4
-  *	=> allows a STA plus three P2P interfaces
-@@ -5718,7 +5581,7 @@ enum nl80211_if_combination_attrs {
-  * @NL80211_PLINK_ESTAB: mesh peer link is established
-  * @NL80211_PLINK_HOLDING: mesh peer link is being closed or cancelled
-  * @NL80211_PLINK_BLOCKED: all frames transmitted from this mesh
-- *	plink are discarded, except for authentication frames
-+ *	plink are discarded
-  * @NUM_NL80211_PLINK_STATES: number of peer link states
-  * @MAX_NL80211_PLINK_STATES: highest numerical value of plink states
-  */
-@@ -5855,15 +5718,13 @@ enum nl80211_tdls_operation {
- 	NL80211_TDLS_DISABLE_LINK,
- };
- 
--/**
-+/*
-  * enum nl80211_ap_sme_features - device-integrated AP features
-- * @NL80211_AP_SME_SA_QUERY_OFFLOAD: SA Query procedures offloaded to driver
-- *	when user space indicates support for SA Query procedures offload during
-- *	"start ap" with %NL80211_AP_SETTINGS_SA_QUERY_OFFLOAD_SUPPORT.
-- */
-+ * Reserved for future use, no bits are defined in
-+ * NL80211_ATTR_DEVICE_AP_SME yet.
- enum nl80211_ap_sme_features {
--	NL80211_AP_SME_SA_QUERY_OFFLOAD		= 1 << 0,
- };
-+ */
- 
- /**
-  * enum nl80211_feature_flags - device/driver features
-@@ -6166,11 +6027,6 @@ enum nl80211_feature_flags {
-  * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
-  *	detection and change announcemnts.
-  *
-- * @NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD: Driver running in AP mode supports
-- *	FILS encryption and decryption for (Re)Association Request and Response
-- *	frames. Userspace has to share FILS AAD details to the driver by using
-- *	@NL80211_CMD_SET_FILS_AAD.
-- *
+ 	__NL80211_BSS_AFTER_LAST,
+@@ -5874,7 +5991,7 @@ enum nl80211_ap_sme_features {
+  * @NL80211_FEATURE_INACTIVITY_TIMER: This driver takes care of freeing up
+  *	the connected inactive stations in AP mode.
+  * @NL80211_FEATURE_CELL_BASE_REG_HINTS: This driver has been tested
+- *	to work properly to suppport receiving regulatory hints from
++ *	to work properly to support receiving regulatory hints from
+  *	cellular base stations.
+  * @NL80211_FEATURE_P2P_DEVICE_NEEDS_CHANNEL: (no longer available, only
+  *	here to reserve the value for API/ABI compatibility)
+@@ -6174,6 +6291,14 @@ enum nl80211_feature_flags {
   * @NL80211_EXT_FEATURE_RADAR_BACKGROUND: Device supports background radar/CAC
   *	detection.
   *
-@@ -6239,7 +6095,6 @@ enum nl80211_ext_feature_index {
- 	NL80211_EXT_FEATURE_SECURE_RTT,
- 	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
++ * @NL80211_EXT_FEATURE_POWERED_ADDR_CHANGE: Device can perform a MAC address
++ *	change without having to bring the underlying network device down
++ *	first. For example, in station mode this can be used to vary the
++ *	origin MAC address prior to a connection to a new AP for privacy
++ *	or other reasons. Note that certain driver specific restrictions
++ *	might apply, e.g. no scans in progress, no offchannel operations
++ *	in progress, and no active connections.
++ *
+  * @NUM_NL80211_EXT_FEATURES: number of extended features.
+  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
+  */
+@@ -6241,6 +6366,7 @@ enum nl80211_ext_feature_index {
  	NL80211_EXT_FEATURE_BSS_COLOR,
--	NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD,
+ 	NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD,
  	NL80211_EXT_FEATURE_RADAR_BACKGROUND,
++	NL80211_EXT_FEATURE_POWERED_ADDR_CHANGE,
  
  	/* add new features before the definition below */
-@@ -7548,7 +7403,7 @@ enum nl80211_sar_specs_attrs {
-  * @NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY: Used by the kernel
-  *	to advertise the maximum profile periodicity supported by the driver
-  *	if EMA is enabled. Driver should indicate EMA support to the userspace
-- *	by setting wiphy->ema_max_profile_periodicity to
-+ *	by setting wiphy->mbssid_max_ema_profile_periodicity to
-  *	a non-zero value.
-  *
-  * @NL80211_MBSSID_CONFIG_ATTR_INDEX: Mandatory parameter to pass the index of
-@@ -7567,7 +7422,7 @@ enum nl80211_sar_specs_attrs {
-  *
-  * @NL80211_MBSSID_CONFIG_ATTR_EMA: Flag used to enable EMA AP feature.
-  *	Setting this flag is permitted only if the driver advertises EMA support
-- *	by setting wiphy->ema_max_profile_periodicity to non-zero.
-+ *	by setting wiphy->mbssid_max_ema_profile_periodicity to non-zero.
-  *
-  * @__NL80211_MBSSID_CONFIG_ATTR_LAST: Internal
-  * @NL80211_MBSSID_CONFIG_ATTR_MAX: highest attribute
-@@ -7586,20 +7441,4 @@ enum nl80211_mbssid_config_attributes {
- 	NL80211_MBSSID_CONFIG_ATTR_MAX = __NL80211_MBSSID_CONFIG_ATTR_LAST - 1,
- };
- 
--/**
-- * enum nl80211_ap_settings_flags - AP settings flags
-- *
-- * @NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT: AP supports external
-- *	authentication.
-- * @NL80211_AP_SETTINGS_SA_QUERY_OFFLOAD_SUPPORT: Userspace supports SA Query
-- *	procedures offload to driver. If driver advertises
-- *	%NL80211_AP_SME_SA_QUERY_OFFLOAD in AP SME features, userspace shall
-- *	ignore SA Query procedures and validations when this flag is set by
-- *	userspace.
-- */
--enum nl80211_ap_settings_flags {
--	NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT	= 1 << 0,
--	NL80211_AP_SETTINGS_SA_QUERY_OFFLOAD_SUPPORT	= 1 << 1,
--};
--
- #endif /* __LINUX_NL80211_H */
---- a/event.c
-+++ b/event.c
-@@ -1292,9 +1292,6 @@ static int print_event(struct nl_msg *ms
- 	case NL80211_CMD_CH_SWITCH_NOTIFY:
- 		parse_ch_switch_notify(tb, gnlh->cmd);
- 		break;
--	case NL80211_CMD_ASSOC_COMEBACK: /* 147 */
--		parse_assoc_comeback(tb, gnlh->cmd);
--		break;
- 	default:
- 		printf("unknown event %d (%s)\n",
- 		       gnlh->cmd, command_name(gnlh->cmd));
---- a/info.c
-+++ b/info.c
-@@ -164,7 +164,6 @@ static void ext_feat_print(enum nl80211_
- 	ext_feat_case(PROT_RANGE_NEGO_AND_MEASURE,
- 		      "support for MFP in range measurement negotiation/procedure");
- 	ext_feat_case(BSS_COLOR, "BSS coloring support");
--	ext_feat_case(FILS_CRYPTO_OFFLOAD, "FILS crypto offload");
- 	ext_feat_case(RADAR_BACKGROUND, "Radar background support");
- 	}
- }
---- a/interface.c
-+++ b/interface.c
-@@ -362,8 +362,6 @@ char *channel_width_name(enum nl80211_ch
- 		return "5 MHz";
- 	case NL80211_CHAN_WIDTH_10:
- 		return "10 MHz";
--	case NL80211_CHAN_WIDTH_320:
--		return "320 MHz";
- 	default:
- 		return "unknown";
- 	}
---- a/util.c
-+++ b/util.c
-@@ -508,7 +508,6 @@ static int parse_freqs(struct chandef *c
- 	case NL80211_CHAN_WIDTH_40:
- 	case NL80211_CHAN_WIDTH_80:
- 	case NL80211_CHAN_WIDTH_160:
--	case NL80211_CHAN_WIDTH_320:
- 		need_cf1 = true;
- 		break;
- 	case NL80211_CHAN_WIDTH_1:
-@@ -626,10 +625,6 @@ int parse_freqchan(struct chandef *chand
- 		  .width = NL80211_CHAN_WIDTH_160,
- 		  .freq1_diff = 0,
- 		  .chantype = -1 },
--		{ .name = "320MHz",
--		  .width = NL80211_CHAN_WIDTH_320,
--		  .freq1_diff = 0,
--		  .chantype = -1 },
- 	};
- 	const struct chanmode *chanmode_selected = NULL;
- 	unsigned int freq;
-@@ -1599,48 +1594,6 @@ void print_eht_info(struct nlattr *nl_if
- 	print_iftype_line(tb[NL80211_BAND_IFTYPE_ATTR_IFTYPES]);
- 	printf("\n");
- 
--	if (tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC]) {
--		len = nla_len(tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC]);
--		if (len > sizeof(mac_cap))
--			len = sizeof(mac_cap);
--		memcpy(mac_cap,
--		       nla_data(tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC]),
--		       len);
--	}
--
--	if (tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY]) {
--		len = nla_len(tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY]);
--
--		if (len > sizeof(phy_cap))
--			len = sizeof(phy_cap);
--
--		memcpy(phy_cap,
--		       nla_data(tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY]),
--		       len);
--	}
--
--	if (tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET]) {
--		len = nla_len(tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET]);
--		if (len > sizeof(mcs_set))
--			len = sizeof(mcs_set);
--		memcpy(mcs_set,
--		       nla_data(tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET]),
--		       len);
--
--		// Assume that all parts of the MCS set are present
--		mcs_len = sizeof(mcs_set);
--	}
--
--	if (tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE]) {
--		len = nla_len(tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE]);
--		if (len > sizeof(ppet))
--			len = sizeof(ppet);
--		memcpy(ppet,
--		       nla_data(tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE]),
--		       len);
--		ppet_len = len;
--	}
--
- 	if (tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY]) {
- 		len = nla_len(tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY]);
- 
---- a/reg.c
-+++ b/reg.c
-@@ -210,7 +210,6 @@ static int print_reg_handler(struct nl_m
- 		PARSE_FLAG(NL80211_RRF_NO_80MHZ, "NO-80MHZ");
- 		PARSE_FLAG(NL80211_RRF_NO_160MHZ, "NO-160MHZ");
- 		PARSE_FLAG(NL80211_RRF_NO_HE, "NO-HE");
--		PARSE_FLAG(NL80211_RRF_NO_320MHZ, "NO-320MHZ");
- 
- 		/* Kernels that support NO_IR always turn on both flags */
- 		if ((flags & NL80211_RRF_NO_IR) && (flags & __NL80211_RRF_NO_IBSS)) {
---- a/station.c
-+++ b/station.c
-@@ -239,8 +239,6 @@ void parse_bitrate(struct nlattr *bitrat
- 		pos += snprintf(pos, buflen - (pos - buf), " 80P80MHz");
- 	if (rinfo[NL80211_RATE_INFO_160_MHZ_WIDTH])
- 		pos += snprintf(pos, buflen - (pos - buf), " 160MHz");
--	if (rinfo[NL80211_RATE_INFO_320_MHZ_WIDTH])
--		pos += snprintf(pos, buflen - (pos - buf), " 320MHz");
- 	if (rinfo[NL80211_RATE_INFO_SHORT_GI])
- 		pos += snprintf(pos, buflen - (pos - buf), " short GI");
- 	if (rinfo[NL80211_RATE_INFO_VHT_NSS])
-@@ -261,18 +259,6 @@ void parse_bitrate(struct nlattr *bitrat
- 	if (rinfo[NL80211_RATE_INFO_HE_RU_ALLOC])
- 		pos += snprintf(pos, buflen - (pos - buf),
- 				" HE-RU-ALLOC %d", nla_get_u8(rinfo[NL80211_RATE_INFO_HE_RU_ALLOC]));
--	if (rinfo[NL80211_RATE_INFO_EHT_MCS])
--		pos += snprintf(pos, buflen - (pos - buf),
--				" EHT-MCS %d", nla_get_u8(rinfo[NL80211_RATE_INFO_EHT_MCS]));
--	if (rinfo[NL80211_RATE_INFO_EHT_NSS])
--		pos += snprintf(pos, buflen - (pos - buf),
--				" EHT-NSS %d", nla_get_u8(rinfo[NL80211_RATE_INFO_EHT_NSS]));
--	if (rinfo[NL80211_RATE_INFO_EHT_GI])
--		pos += snprintf(pos, buflen - (pos - buf),
--				" EHT-GI %d", nla_get_u8(rinfo[NL80211_RATE_INFO_EHT_GI]));
--	if (rinfo[NL80211_RATE_INFO_EHT_RU_ALLOC])
--		pos += snprintf(pos, buflen - (pos - buf),
--				" EHT-RU-ALLOC %d", nla_get_u8(rinfo[NL80211_RATE_INFO_EHT_RU_ALLOC]));
- }
- 
- static char *get_chain_signal(struct nlattr *attr_list)
+ 	NUM_NL80211_EXT_FEATURES,
diff --git a/package/network/utils/iw/patches/200-reduce_size.patch b/package/network/utils/iw/patches/200-reduce_size.patch
index 88df56b385cd08..862199452425bd 100644
--- a/package/network/utils/iw/patches/200-reduce_size.patch
+++ b/package/network/utils/iw/patches/200-reduce_size.patch
@@ -24,9 +24,9 @@
  	case NL80211_CMD_JOIN_IBSS:
  		mac_addr_n2a(macbuf, nla_data(tb[NL80211_ATTR_MAC]));
  		printf("IBSS %s joined\n", macbuf);
-@@ -1292,9 +1295,9 @@ static int print_event(struct nl_msg *ms
- 	case NL80211_CMD_CH_SWITCH_NOTIFY:
- 		parse_ch_switch_notify(tb, gnlh->cmd);
+@@ -1295,9 +1298,9 @@ static int print_event(struct nl_msg *ms
+ 	case NL80211_CMD_ASSOC_COMEBACK: /* 147 */
+ 		parse_assoc_comeback(tb, gnlh->cmd);
  		break;
 +#endif
  	default:
@@ -38,7 +38,7 @@
  
 --- a/info.c
 +++ b/info.c
-@@ -308,6 +308,7 @@ next:
+@@ -309,6 +309,7 @@ next:
  				}
  			}
  
@@ -46,7 +46,7 @@
  			if (tb_band[NL80211_BAND_ATTR_RATES]) {
  			printf("\t\tBitrates (non-HT):\n");
  			nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES], rem_rate) {
-@@ -324,6 +325,7 @@ next:
+@@ -325,6 +326,7 @@ next:
  				printf("\n");
  			}
  			}
@@ -54,7 +54,7 @@
  		}
  	}
  
-@@ -389,6 +391,7 @@ next:
+@@ -390,6 +392,7 @@ next:
  		printf("\tCoverage class: %d (up to %dm)\n", coverage, 450 * coverage);
  	}
  
@@ -62,7 +62,7 @@
  	if (tb_msg[NL80211_ATTR_CIPHER_SUITES]) {
  		int num = nla_len(tb_msg[NL80211_ATTR_CIPHER_SUITES]) / sizeof(__u32);
  		int i;
-@@ -400,6 +403,7 @@ next:
+@@ -401,6 +404,7 @@ next:
  					cipher_name(ciphers[i]));
  		}
  	}
@@ -70,7 +70,7 @@
  
  	if (tb_msg[NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX] &&
  	    tb_msg[NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX])
-@@ -417,9 +421,11 @@ next:
+@@ -418,9 +422,11 @@ next:
  		print_iftype_list("\tSupported interface modes", "\t\t",
  				  tb_msg[NL80211_ATTR_SUPPORTED_IFTYPES]);
  
@@ -82,7 +82,7 @@
  
  	if (tb_msg[NL80211_ATTR_INTERFACE_COMBINATIONS]) {
  		struct nlattr *nl_combi;
-@@ -509,6 +515,7 @@ broken_combination:
+@@ -510,6 +516,7 @@ broken_combination:
  			printf("\tinterface combinations are not supported\n");
  	}
  
@@ -90,7 +90,7 @@
  	if (tb_msg[NL80211_ATTR_SUPPORTED_COMMANDS]) {
  		printf("\tSupported commands:\n");
  		nla_for_each_nested(nl_cmd, tb_msg[NL80211_ATTR_SUPPORTED_COMMANDS], rem_cmd)
-@@ -606,6 +613,7 @@ broken_combination:
+@@ -607,6 +614,7 @@ broken_combination:
  				printf("\t\t * wake up on TCP connection\n");
  		}
  	}
@@ -98,7 +98,7 @@
  
  	if (tb_msg[NL80211_ATTR_ROAM_SUPPORT])
  		printf("\tDevice supports roaming.\n");
-@@ -644,6 +652,7 @@ broken_combination:
+@@ -645,6 +653,7 @@ broken_combination:
  		}
  	}
  
@@ -106,7 +106,7 @@
  	if (tb_msg[NL80211_ATTR_FEATURE_FLAGS]) {
  		unsigned int features = nla_get_u32(tb_msg[NL80211_ATTR_FEATURE_FLAGS]);
  
-@@ -708,6 +717,7 @@ broken_combination:
+@@ -709,6 +718,7 @@ broken_combination:
  		if (features & NL80211_FEATURE_ND_RANDOM_MAC_ADDR)
  			printf("\tDevice supports randomizing MAC-addr in net-detect scans.\n");
  	}
@@ -114,7 +114,7 @@
  
  	if (tb_msg[NL80211_ATTR_TDLS_SUPPORT])
  		printf("\tDevice supports T-DLS.\n");
-@@ -773,6 +783,7 @@ TOPLEVEL(list, NULL, NL80211_CMD_GET_WIP
+@@ -774,6 +784,7 @@ TOPLEVEL(list, NULL, NL80211_CMD_GET_WIP
  	 "List all wireless devices and their capabilities.");
  TOPLEVEL(phy, NULL, NL80211_CMD_GET_WIPHY, NLM_F_DUMP, CIB_NONE, handle_info, NULL);
  
@@ -122,7 +122,7 @@
  static int handle_commands(struct nl80211_state *state, struct nl_msg *msg,
  			   int argc, char **argv, enum id_input id)
  {
-@@ -784,6 +795,7 @@ static int handle_commands(struct nl8021
+@@ -785,6 +796,7 @@ static int handle_commands(struct nl8021
  }
  TOPLEVEL(commands, NULL, NL80211_CMD_GET_WIPHY, 0, CIB_NONE, handle_commands,
  	 "list all known commands and their decimal & hex value");
@@ -292,7 +292,7 @@
  ifeq ($(NO_PKG_CONFIG),)
 --- a/station.c
 +++ b/station.c
-@@ -777,10 +777,12 @@ static int handle_station_set_plink(stru
+@@ -791,10 +791,12 @@ static int handle_station_set_plink(stru
   nla_put_failure:
  	return -ENOBUFS;
  }
@@ -305,7 +305,7 @@
  
  static int handle_station_set_vlan(struct nl80211_state *state,
  				   struct nl_msg *msg,
-@@ -875,11 +877,13 @@ static int handle_station_set_mesh_power
+@@ -889,11 +891,13 @@ static int handle_station_set_mesh_power
  nla_put_failure:
  	return -ENOBUFS;
  }
@@ -321,7 +321,7 @@
  					     struct nl_msg *msg,
 --- a/interface.c
 +++ b/interface.c
-@@ -627,9 +627,11 @@ static int handle_interface_wds_peer(str
+@@ -629,9 +629,11 @@ static int handle_interface_wds_peer(str
   nla_put_failure:
  	return -ENOBUFS;
  }
@@ -333,7 +333,7 @@
  
  static int set_mcast_rate(struct nl80211_state *state,
  			  struct nl_msg *msg,
-@@ -719,6 +721,7 @@ static int handle_chan(struct nl80211_st
+@@ -721,6 +723,7 @@ static int handle_chan(struct nl80211_st
  	return handle_chanfreq(state, msg, true, argc, argv, id);
  }
  
@@ -341,7 +341,7 @@
  SECTION(switch);
  COMMAND(switch, freq,
  	"<freq> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz] [beacons <count>] [block-tx]\n"
-@@ -990,3 +993,4 @@ COMMAND(set, tidconf, "[peer <MAC addres
+@@ -992,3 +995,4 @@ COMMAND(set, tidconf, "[peer <MAC addres
  	"  $ iw dev wlan0 set tidconf peer xx:xx:xx:xx:xx:xx tids 0x2 bitrates auto\n"
  	"  $ iw dev wlan0 set tidconf peer xx:xx:xx:xx:xx:xx tids 0x2 bitrates limit vht-mcs-5 4:9\n"
  	);
diff --git a/package/network/utils/iwinfo/Makefile b/package/network/utils/iwinfo/Makefile
index 4735181712ffaa..fcb89ff42b3248 100644
--- a/package/network/utils/iwinfo/Makefile
+++ b/package/network/utils/iwinfo/Makefile
@@ -11,13 +11,13 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/iwinfo.git
-PKG_SOURCE_DATE:=2022-08-19
-PKG_SOURCE_VERSION:=0dad3e6660594592071ae49a77a907e2b11a98fe
-PKG_MIRROR_HASH:=2162ee3158328ffe39018e50f34d74b47a6c7a26460e30d7984ca16cbc859d80
+PKG_SOURCE_DATE:=2023-05-17
+PKG_SOURCE_VERSION:=c9f5c3f7b50d146f18be1458ab5591defc0af6da
+PKG_MIRROR_HASH:=0d9263cbbe79d62966398af66b3b3ce7b58991da6b266f8f4ec2ec4be3d4ad97
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 PKG_LICENSE:=GPL-2.0
 
-IWINFO_ABI_VERSION:=20210430
+IWINFO_ABI_VERSION:=20230121
 
 include $(INCLUDE_DIR)/package.mk
 
diff --git a/package/network/utils/layerscape/restool/Makefile b/package/network/utils/layerscape/restool/Makefile
index a23ae1463b7fa9..5919f42ff2afa2 100644
--- a/package/network/utils/layerscape/restool/Makefile
+++ b/package/network/utils/layerscape/restool/Makefile
@@ -9,10 +9,10 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=restool
 PKG_VERSION:=21.08
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=4
 
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=https://source.codeaurora.org/external/qoriq/qoriq-components/restool
+PKG_SOURCE_URL:=https://github.com/nxp-qoriq/restool
 PKG_SOURCE_VERSION:=LSDK-21.08
 PKG_MIRROR_HASH:=0396644927b8f3da20183227562f695c8063d3d4c6bb606e8f31dda450e962e4
 
diff --git a/package/network/utils/ltq-dsl-base/Makefile b/package/network/utils/ltq-dsl-base/Makefile
index 2ff069ca4dc773..b51851f076ee42 100644
--- a/package/network/utils/ltq-dsl-base/Makefile
+++ b/package/network/utils/ltq-dsl-base/Makefile
@@ -17,7 +17,7 @@ define Package/ltq-dsl-base
   CATEGORY:=Network
   TITLE:=DSL related files for Intel/Lantiq DSL Chipsets
   URL:=http://openwrt.org/
-  DEPENDS:=@TARGET_lantiq +jshn
+  DEPENDS:=@(TARGET_lantiq||TARGET_ipq40xx) +jshn
 endef
 
 define Package/ltq-dsl-base/description
diff --git a/package/network/utils/nftables/Makefile b/package/network/utils/nftables/Makefile
index fd53e3faa13cfc..55a6a4bcf69c34 100644
--- a/package/network/utils/nftables/Makefile
+++ b/package/network/utils/nftables/Makefile
@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=nftables
-PKG_VERSION:=1.0.5
+PKG_VERSION:=1.0.7
 PKG_RELEASE:=1
 
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://netfilter.org/projects/$(PKG_NAME)/files
-PKG_HASH:=8d1b4b18393af43698d10baa25d2b9b6397969beecac7816c35dd0714e4de50a
+PKG_HASH:=c12ac941fff9adaedf17367d5ce213789b98a0d314277bc22b3d71e10891f412
 
 PKG_MAINTAINER:=
 PKG_LICENSE:=GPL-2.0
@@ -20,6 +20,8 @@ PKG_LICENSE_FILES:=COPYING
 PKG_FIXUP:=autoreconf
 PKG_INSTALL:=1
 
+PKG_BUILD_FLAGS:=lto
+
 include $(INCLUDE_DIR)/package.mk
 
 DISABLE_NLS:=
@@ -60,9 +62,6 @@ ifeq ($(BUILD_VARIANT),json)
   CONFIGURE_ARGS += --with-json
 endif
 
-TARGET_CFLAGS += -flto
-TARGET_LDFLAGS += -flto
-
 define Build/InstallDev
 	$(INSTALL_DIR) $(1)/usr/lib $(1)/usr/include
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib/*.so* $(1)/usr/lib/
diff --git a/package/network/utils/rssileds/Makefile b/package/network/utils/rssileds/Makefile
index 2282d8c5b1ac73..5adc25e8d801a7 100644
--- a/package/network/utils/rssileds/Makefile
+++ b/package/network/utils/rssileds/Makefile
@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=rssileds
-PKG_RELEASE:=3
+PKG_RELEASE:=4
 PKG_LICNESE:=GPL-2.0+
 
 include $(INCLUDE_DIR)/package.mk
diff --git a/package/network/utils/tcpdump/Makefile b/package/network/utils/tcpdump/Makefile
index d6da50f25e4e07..d2e933a1a1a4e1 100644
--- a/package/network/utils/tcpdump/Makefile
+++ b/package/network/utils/tcpdump/Makefile
@@ -8,18 +8,19 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=tcpdump
-PKG_VERSION:=4.99.1
+PKG_VERSION:=4.99.4
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=http://www.tcpdump.org/release/
-PKG_HASH:=79b36985fb2703146618d87c4acde3e068b91c553fb93f021a337f175fd10ebe
+PKG_SOURCE_URL:=https://www.tcpdump.org/release/
+PKG_HASH:=0232231bb2f29d6bf2426e70a08a7e0c63a0d59a9b44863b7f5e2357a6e49fea
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=BSD-3-Clause
 PKG_CPE_ID:=cpe:/a:tcpdump:tcpdump
 
 PKG_INSTALL:=1
+PKG_BUILD_FLAGS:=gc-sections
 PKG_BUILD_PARALLEL:=1
 
 include $(INCLUDE_DIR)/package.mk
@@ -48,9 +49,6 @@ CONFIGURE_ARGS += \
 	--without-crypto \
 	$(call autoconf_bool,CONFIG_IPV6,ipv6)
 
-TARGET_CFLAGS += -ffunction-sections -fdata-sections
-TARGET_LDFLAGS += -Wl,--gc-sections
-
 ifeq ($(BUILD_VARIANT),mini)
   TARGET_CFLAGS += -DTCPDUMP_MINI
   CONFIGURE_ARGS += --disable-smb
diff --git a/package/network/utils/tcpdump/patches/001-remove_pcap_debug.patch b/package/network/utils/tcpdump/patches/001-remove_pcap_debug.patch
index e79de526a1340e..1988587029b65a 100644
--- a/package/network/utils/tcpdump/patches/001-remove_pcap_debug.patch
+++ b/package/network/utils/tcpdump/patches/001-remove_pcap_debug.patch
@@ -1,6 +1,6 @@
 --- a/configure
 +++ b/configure
-@@ -6230,97 +6230,6 @@ fi
+@@ -6568,97 +6568,6 @@ fi
  
  
  
diff --git a/package/network/utils/tcpdump/patches/100-tcpdump_mini.patch b/package/network/utils/tcpdump/patches/100-tcpdump_mini.patch
index ad7c3feb4ecebe..8a014cabf0b4ec 100644
--- a/package/network/utils/tcpdump/patches/100-tcpdump_mini.patch
+++ b/package/network/utils/tcpdump/patches/100-tcpdump_mini.patch
@@ -1,6 +1,6 @@
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -73,6 +73,85 @@ DEPENDENCY_CFLAG = @DEPENDENCY_CFLAG@
+@@ -73,6 +73,86 @@ DEPENDENCY_CFLAG = @DEPENDENCY_CFLAG@
  
  CSRC =	fptype.c tcpdump.c
  
@@ -77,6 +77,7 @@
 +	print-tftp.c \
 +	print-udp.c \
 +	print-unsupported.c \
++	print-whois.c \
 +	signature.c \
 +	strtoaddr.c \
 +	util-print.c
@@ -86,7 +87,7 @@
  LIBNETDISSECT_SRC=\
  	addrtoname.c \
  	addrtostr.c \
-@@ -252,6 +331,8 @@ LIBNETDISSECT_SRC=\
+@@ -254,6 +334,8 @@ LIBNETDISSECT_SRC=\
  	strtoaddr.c \
  	util-print.c
  
@@ -97,7 +98,7 @@
  
 --- a/addrtoname.c
 +++ b/addrtoname.c
-@@ -683,8 +683,10 @@ linkaddr_string(netdissect_options *ndo,
+@@ -680,8 +680,10 @@ linkaddr_string(netdissect_options *ndo,
  	if (type == LINKADDR_ETHER && len == MAC_ADDR_LEN)
  		return (etheraddr_string(ndo, ep));
  
@@ -108,7 +109,7 @@
  
  	tp = lookup_bytestring(ndo, ep, len);
  	if (tp->bs_name)
-@@ -1263,6 +1265,7 @@ init_addrtoname(netdissect_options *ndo,
+@@ -1260,6 +1262,7 @@ init_addrtoname(netdissect_options *ndo,
  	init_ipxsaparray(ndo);
  }
  
@@ -116,7 +117,7 @@
  const char *
  dnaddr_string(netdissect_options *ndo, u_short dnaddr)
  {
-@@ -1279,6 +1282,7 @@ dnaddr_string(netdissect_options *ndo, u
+@@ -1276,6 +1279,7 @@ dnaddr_string(netdissect_options *ndo, u
  
  	return(tp->name);
  }
@@ -126,7 +127,7 @@
  struct hnamemem *
 --- a/print-ether.c
 +++ b/print-ether.c
-@@ -539,6 +539,7 @@ ethertype_print(netdissect_options *ndo,
+@@ -545,6 +545,7 @@ ethertype_print(netdissect_options *ndo,
  		arp_print(ndo, p, length, caplen);
  		return (1);
  
@@ -134,7 +135,7 @@
  	case ETHERTYPE_DN:
  		decnet_print(ndo, p, length, caplen);
  		return (1);
-@@ -569,6 +570,7 @@ ethertype_print(netdissect_options *ndo,
+@@ -575,6 +576,7 @@ ethertype_print(netdissect_options *ndo,
  		ND_TCHECK_LEN(p, 1);
  		isoclns_print(ndo, p + 1, length - 1);
  		return(1);
@@ -142,19 +143,19 @@
  
  	case ETHERTYPE_PPPOED:
  	case ETHERTYPE_PPPOES:
-@@ -581,9 +583,11 @@ ethertype_print(netdissect_options *ndo,
+@@ -587,9 +589,11 @@ ethertype_print(netdissect_options *ndo,
  		eapol_print(ndo, p);
  		return (1);
  
 +#ifndef TCPDUMP_MINI
- 	case ETHERTYPE_RRCP:
- 		rrcp_print(ndo, p, length, src, dst);
+ 	case ETHERTYPE_REALTEK:
+ 		rtl_print(ndo, p, length, src, dst);
  		return (1);
 +#endif
  
  	case ETHERTYPE_PPP:
  		if (length) {
-@@ -592,6 +596,7 @@ ethertype_print(netdissect_options *ndo,
+@@ -598,6 +602,7 @@ ethertype_print(netdissect_options *ndo,
  		}
  		return (1);
  
@@ -162,7 +163,7 @@
  	case ETHERTYPE_MPCP:
  		mpcp_print(ndo, p, length);
  		return (1);
-@@ -604,19 +609,23 @@ ethertype_print(netdissect_options *ndo,
+@@ -610,19 +615,23 @@ ethertype_print(netdissect_options *ndo,
  	case ETHERTYPE_CFM_OLD:
  		cfm_print(ndo, p, length);
  		return (1);
@@ -186,7 +187,7 @@
  	case ETHERTYPE_MPLS:
  	case ETHERTYPE_MPLS_MULTI:
  		mpls_print(ndo, p, length);
-@@ -646,6 +655,7 @@ ethertype_print(netdissect_options *ndo,
+@@ -652,6 +661,7 @@ ethertype_print(netdissect_options *ndo,
  	case ETHERTYPE_PTP:
  		ptp_print(ndo, p, length);
  		return (1);
@@ -214,7 +215,7 @@
  		break;
 --- a/print-icmp6.c
 +++ b/print-icmp6.c
-@@ -1384,7 +1384,7 @@ get_upperlayer(netdissect_options *ndo,
+@@ -1371,7 +1371,7 @@ get_upperlayer(netdissect_options *ndo,
  			nh = GET_U_1(fragh->ip6f_nxt);
  			hlen = sizeof(struct ip6_frag);
  			break;
@@ -223,7 +224,7 @@
  		case IPPROTO_AH:
  			ah = (const struct ah *)bp;
  			if (!ND_TTEST_1(ah->ah_len))
-@@ -1392,7 +1392,7 @@ get_upperlayer(netdissect_options *ndo,
+@@ -1379,7 +1379,7 @@ get_upperlayer(netdissect_options *ndo,
  			nh = GET_U_1(ah->ah_nxt);
  			hlen = (GET_U_1(ah->ah_len) + 2) << 2;
  			break;
@@ -336,7 +337,7 @@
  		default:
  			/*
  			 * AH and ESP are, in the RFCs that describe them,
-@@ -357,6 +358,7 @@ ip6_print(netdissect_options *ndo, const
+@@ -375,6 +376,7 @@ ip6_print(netdissect_options *ndo, const
  			nh = GET_U_1(cp);
  			break;
  
@@ -344,7 +345,7 @@
  		case IPPROTO_FRAGMENT:
  			advance = frag6_print(ndo, cp, (const u_char *)ip6);
  			if (advance < 0 || ndo->ndo_snapend <= cp + advance) {
-@@ -387,7 +389,7 @@ ip6_print(netdissect_options *ndo, const
+@@ -405,7 +407,7 @@ ip6_print(netdissect_options *ndo, const
  			nh = GET_U_1(cp);
  			nd_pop_packet_info(ndo);
  			return;
@@ -462,7 +463,7 @@
  static void
  ppp_hdlc(netdissect_options *ndo,
           const u_char *p, u_int length)
-@@ -1440,17 +1441,19 @@ trunc:
+@@ -1451,17 +1452,19 @@ trunc:
  	ndo->ndo_snapend = se;
  	nd_print_trunc(ndo);
  }
@@ -483,7 +484,7 @@
  
  	switch (proto) {
  	case PPP_LCP: /* fall through */
-@@ -1483,6 +1486,7 @@ handle_ppp(netdissect_options *ndo,
+@@ -1494,6 +1497,7 @@ handle_ppp(netdissect_options *ndo,
  	case PPP_IPV6:
  		ip6_print(ndo, p, length);
  		break;
@@ -491,7 +492,7 @@
  	case ETHERTYPE_IPX:	/*XXX*/
  	case PPP_IPX:
  		ipx_print(ndo, p, length);
-@@ -1494,6 +1498,7 @@ handle_ppp(netdissect_options *ndo,
+@@ -1505,6 +1509,7 @@ handle_ppp(netdissect_options *ndo,
  	case PPP_MPLS_MCAST:
  		mpls_print(ndo, p, length);
  		break;
@@ -499,7 +500,7 @@
  	case PPP_COMP:
  		ND_PRINT("compressed PPP data");
  		break;
-@@ -1634,6 +1639,7 @@ ppp_if_print(netdissect_options *ndo,
+@@ -1652,6 +1657,7 @@ ppp_if_print(netdissect_options *ndo,
  	ppp_print(ndo, p, length);
  }
  
@@ -507,14 +508,14 @@
  /*
   * PPP I/F printer to use if we know that RFC 1662-style PPP in HDLC-like
   * framing, or Cisco PPP with HDLC framing as per section 4.3.1 of RFC 1547,
-@@ -1877,3 +1883,4 @@ printx:
+@@ -1895,3 +1901,4 @@ printx:
  #endif /* __bsdi__ */
  	ndo->ndo_ll_hdr_len += hdrlength;
  }
 +#endif
 --- a/print-sll.c
 +++ b/print-sll.c
-@@ -460,12 +460,14 @@ recurse:
+@@ -465,12 +465,14 @@ recurse:
  		 */
  		switch (ether_type) {
  
@@ -531,7 +532,7 @@
  			/*
 --- a/print-tcp.c
 +++ b/print-tcp.c
-@@ -612,6 +612,7 @@ tcp_print(netdissect_options *ndo,
+@@ -614,6 +614,7 @@ tcp_print(netdissect_options *ndo,
                                  ND_PRINT(" %u", utoval);
                                  break;
  
@@ -539,7 +540,7 @@
                          case TCPOPT_MPTCP:
                              {
                                  const u_char *snapend_save;
-@@ -635,7 +636,7 @@ tcp_print(netdissect_options *ndo,
+@@ -637,7 +638,7 @@ tcp_print(netdissect_options *ndo,
                                          goto bad;
                                  break;
                              }
@@ -548,7 +549,7 @@
                          case TCPOPT_FASTOPEN:
                                  datalen = len - 2;
                                  LENCHECK(datalen);
-@@ -720,6 +721,7 @@ tcp_print(netdissect_options *ndo,
+@@ -722,6 +723,7 @@ tcp_print(netdissect_options *ndo,
                  return;
          }
  
@@ -556,7 +557,7 @@
          if (ndo->ndo_packettype) {
                  switch (ndo->ndo_packettype) {
                  case PT_ZMTP1:
-@@ -735,6 +737,7 @@ tcp_print(netdissect_options *ndo,
+@@ -737,6 +739,7 @@ tcp_print(netdissect_options *ndo,
                  }
                  return;
          }
@@ -564,12 +565,12 @@
  
          if (IS_SRC_OR_DST_PORT(TELNET_PORT)) {
                  telnet_print(ndo, bp, length);
-@@ -745,24 +748,31 @@ tcp_print(netdissect_options *ndo,
+@@ -746,24 +749,31 @@ tcp_print(netdissect_options *ndo,
+         } else if (IS_SRC_OR_DST_PORT(WHOIS_PORT)) {
                  ND_PRINT(": ");
-                 ndo->ndo_protocol = "whois";	/* needed by txtproto_print() */
-                 txtproto_print(ndo, bp, length, NULL, 0); /* RFC 3912 */
+                 whois_print(ndo, bp, length);
 -        } else if (IS_SRC_OR_DST_PORT(BGP_PORT))
-+        } 
++        }
 +#ifndef TCPDUMP_MINI
 +        else if (IS_SRC_OR_DST_PORT(BGP_PORT))
                  bgp_print(ndo, bp, length);
@@ -597,7 +598,7 @@
          else if (IS_SRC_OR_DST_PORT(FTP_PORT)) {
                  ND_PRINT(": ");
                  ftp_print(ndo, bp, length);
-@@ -775,12 +785,14 @@ tcp_print(netdissect_options *ndo,
+@@ -776,12 +786,14 @@ tcp_print(netdissect_options *ndo,
          } else if (IS_SRC_OR_DST_PORT(NAMESERVER_PORT)) {
                  /* over_tcp: TRUE, is_mdns: FALSE */
                  domain_print(ndo, bp, length, TRUE, FALSE);
@@ -831,7 +832,7 @@
  	{ null_if_print,	DLT_LOOP },
  #endif
 +#ifndef TCPDUMP_MINI
- #if defined(DLT_PFLOG) && defined(HAVE_NET_IF_PFLOG_H)
+ #ifdef DLT_PFLOG
  	{ pflog_if_print,	DLT_PFLOG },
  #endif
 @@ -200,6 +211,7 @@ static const struct printer printers[] =
diff --git a/package/network/utils/umbim/Makefile b/package/network/utils/umbim/Makefile
index 3563949c67c4ca..56e1a6f3785786 100644
--- a/package/network/utils/umbim/Makefile
+++ b/package/network/utils/umbim/Makefile
@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=umbim
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=24
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/umbim.git
@@ -14,6 +14,7 @@ PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=
 
 PKG_FLAGS:=nonshared
+PKG_BUILD_FLAGS:=gc-sections
 
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/cmake.mk
@@ -32,9 +33,7 @@ define Package/umbim/description
 endef
 
 TARGET_CFLAGS += \
-	-I$(STAGING_DIR)/usr/include -ffunction-sections -fdata-sections
-
-TARGET_LDFLAGS += -Wl,--gc-sections
+	-I$(STAGING_DIR)/usr/include
 
 define Package/umbim/install
 	$(INSTALL_DIR) $(1)/sbin
diff --git a/package/network/utils/umbim/files/lib/netifd/proto/mbim.sh b/package/network/utils/umbim/files/lib/netifd/proto/mbim.sh
index 3fa411c6c6d676..50913e7fa0461e 100755
--- a/package/network/utils/umbim/files/lib/netifd/proto/mbim.sh
+++ b/package/network/utils/umbim/files/lib/netifd/proto/mbim.sh
@@ -14,19 +14,42 @@ proto_mbim_init_config() {
 	proto_config_add_string apn
 	proto_config_add_string pincode
 	proto_config_add_string delay
+	proto_config_add_boolean allow_roaming
+	proto_config_add_boolean allow_partner
 	proto_config_add_string auth
 	proto_config_add_string username
 	proto_config_add_string password
+	[ -e /proc/sys/net/ipv6 ] && proto_config_add_string ipv6
+	proto_config_add_string dhcp
+	proto_config_add_string dhcpv6
+	proto_config_add_string pdptype
+	proto_config_add_int mtu
 	proto_config_add_defaults
 }
 
+_proto_mbim_get_field() {
+        local field="$1"
+        shift
+        local mbimconfig="$@"
+        echo "$mbimconfig" | while read -r line; do
+                variable=${line%%:*}
+                [ "$variable" = "$field" ] || continue;
+                value=${line##* }
+                echo -n "$value "
+        done
+}
+
 _proto_mbim_setup() {
 	local interface="$1"
 	local tid=2
 	local ret
 
-	local device apn pincode delay $PROTO_DEFAULT_OPTIONS
-	json_get_vars device apn pincode delay auth username password $PROTO_DEFAULT_OPTIONS
+	local device apn pincode delay auth username password allow_roaming allow_partner
+	local dhcp dhcpv6 pdptype ip4table ip6table mtu $PROTO_DEFAULT_OPTIONS
+	json_get_vars device apn pincode delay auth username password allow_roaming allow_partner
+	json_get_vars dhcp dhcpv6 pdptype ip4table ip6table mtu $PROTO_DEFAULT_OPTIONS
+
+	[ ! -e /proc/sys/net/ipv6 ] && ipv6=0 || json_get_var ipv6 ipv6
 
 	[ -n "$ctl_device" ] && device=$ctl_device
 
@@ -108,14 +131,31 @@ _proto_mbim_setup() {
 	tid=$((tid + 1))
 
 	echo "mbim[$$]" "Register with network"
-	umbim $DBG -n -t $tid -d $device registration || {
-		echo "mbim[$$]" "Subscriber registration failed"
+	connected=0
+	umbim $DBG -n -t $tid -d $device registration
+	reg_status=$?
+	case $reg_status in
+		0)	echo "mbim[$$]" "Registered in home mode"
+			tid=$((tid + 1))
+			connected=1;;
+		4)	if [ "$allow_roaming" = "1" ]; then
+				echo "mbim[$$]" "Registered in roaming mode"
+				tid=$((tid + 1))
+				connected=1
+			fi;;
+		5) 	if [ "$allow_partner" = "1" ]; then
+				echo "mbim[$$]" "Registered in partner mode"
+				tid=$((tid + 1))
+				connected=1
+			fi;;
+	esac
+	if [ $connected -ne 1 ]; then
+		echo "mbim[$$]" "Subscriber registration failed (code $reg_status)"
 		tid=$((tid + 1))
 		umbim $DBG -t $tid -d "$device" disconnect
 		proto_notify_error "$interface" NO_REGISTRATION
 		return 1
-	}
-	tid=$((tid + 1))
+	fi
 
 	echo "mbim[$$]" "Attach to network"
 	umbim $DBG -n -t $tid -d $device attach || {
@@ -127,35 +167,133 @@ _proto_mbim_setup() {
 	}
 	tid=$((tid + 1))
 
+	pdptype=$(echo "$pdptype" | awk '{print tolower($0)}')
+	[ "$ipv6" = 0 ] && pdptype="ipv4"
+
+	local req_pdptype="" # Pass "default" PDP type to umbim if unconfigured
+	[ "$pdptype" = "ipv4" -o "$pdptype" = "ipv6" -o "$pdptype" = "ipv4v6" ] && req_pdptype="$pdptype:"
+
+	local connect_state
 	echo "mbim[$$]" "Connect to network"
-	while ! umbim $DBG -n -t $tid -d $device connect "$apn" "$auth" "$username" "$password"; do
+	connect_state=$(umbim $DBG -n -t $tid -d $device connect "$req_pdptype$apn" "$auth" "$username" "$password") || {
+		echo "mbim[$$]" "Failed to connect bearer"
 		tid=$((tid + 1))
-		sleep 1;
-	done
+		umbim $DBG -t $tid -d "$device" disconnect
+		proto_notify_error "$interface" CONNECT_FAILED
+		return 1
+	}
 	tid=$((tid + 1))
 
-	uci_set_state network $interface tid "$tid"
+	echo "$connect_state"
+	local iptype="$(echo "$connect_state" | grep iptype: | awk '{print $4}')"
+
+	echo "mbim[$$]" "Connected"
+
+	local zone="$(fw3 -q network "$interface" 2>/dev/null)"
+
+	echo "mbim[$$]" "Setting up $ifname"
+	local mbimconfig="$(umbim $DBG -n -t $tid -d $device config)"
+	echo "$mbimconfig"
+	tid=$((tid + 1))
 
-	echo "mbim[$$]" "Connected, starting DHCP"
 	proto_init_update "$ifname" 1
 	proto_send_update "$interface"
 
-	json_init
-	json_add_string name "${interface}_4"
-	json_add_string ifname "@$interface"
-	json_add_string proto "dhcp"
-	proto_add_dynamic_defaults
-	json_close_object
-	ubus call network add_dynamic "$(json_dump)"
-
-	json_init
-	json_add_string name "${interface}_6"
-	json_add_string ifname "@$interface"
-	json_add_string proto "dhcpv6"
-	json_add_string extendprefix 1
-	proto_add_dynamic_defaults
-	json_close_object
-	ubus call network add_dynamic "$(json_dump)"
+	[ -z "$dhcp" ] && dhcp="auto"
+	[ -z "$dhcpv6" ] && dhcpv6="auto"
+
+	[ "$iptype" != "ipv6" ] && {
+		json_init
+		json_add_string name "${interface}_4"
+		json_add_string ifname "@$interface"
+		ipv4address=$(_proto_mbim_get_field ipv4address "$mbimconfig")
+		if [ -n "$ipv4address" -a "$dhcp" != 1 ]; then
+			json_add_string proto "static"
+
+			json_add_array ipaddr
+			for address in $ipv4address; do
+				json_add_string "" "$address"
+			done
+			json_close_array
+
+			json_add_string gateway $(_proto_mbim_get_field ipv4gateway "$mbimconfig")
+		elif [ "$dhcp" != 0 ]; then
+			echo "mbim[$$]" "Starting DHCP on $ifname"
+			json_add_string proto "dhcp"
+		fi
+
+		[ "$peerdns" = 0 -a "$dhcp" != 1 ] || {
+			json_add_array dns
+			for server in $(_proto_mbim_get_field ipv4dnsserver "$mbimconfig"); do
+				json_add_string "" "$server"
+			done
+			json_close_array
+		}
+
+		proto_add_dynamic_defaults
+		[ -n "$zone" ] && json_add_string zone "$zone"
+		[ -n "$ip4table" ] && json_add_string ip4table "$ip4table"
+		json_close_object
+		ubus call network add_dynamic "$(json_dump)"
+	}
+
+	[ "$iptype" != "ipv4" ] && {
+		json_init
+		json_add_string name "${interface}_6"
+		json_add_string ifname "@$interface"
+		ipv6address=$(_proto_mbim_get_field ipv6address "$mbimconfig")
+		if [ -n "$ipv6address" -a "$dhcpv6" != 1 ]; then
+			json_add_string proto "static"
+
+			json_add_array ip6addr
+			for address in $ipv6address; do
+				json_add_string "" "$address"
+			done
+			json_close_array
+
+			json_add_array ip6prefix
+			for address in $ipv6address; do
+				json_add_string "" "$address"
+			done
+			json_close_array
+
+			json_add_string ip6gw $(_proto_mbim_get_field ipv6gateway "$mbimconfig")
+
+		elif [ "$dhcpv6" != 0 ]; then
+			echo "mbim[$$]" "Starting DHCPv6 on $ifname"
+			json_add_string proto "dhcpv6"
+			json_add_string extendprefix 1
+		fi
+
+		[ "$peerdns" = 0 -a "$dhcpv6" != 1 ] || {
+			json_add_array dns
+			for server in $(_proto_mbim_get_field ipv6dnsserver "$mbimconfig"); do
+				json_add_string "" "$server"
+			done
+			json_close_array
+		}
+
+		proto_add_dynamic_defaults
+		[ -n "$zone" ] && json_add_string zone "$zone"
+		[ -n "$ip6table" ] && json_add_string ip6table "$ip6table"
+		json_close_object
+		ubus call network add_dynamic "$(json_dump)"
+	}
+
+	[ -z "$mtu" ] && {
+		local ipv4mtu=$(_proto_mbim_get_field ipv4mtu "$mbimconfig")
+		ipv4mtu="${ipv4mtu:-0}"
+		local ipv6mtu=$(_proto_mbim_get_field ipv6mtu "$mbimconfig")
+		ipv6mtu="${ipv6mtu:-0}"
+
+		mtu=$((ipv6mtu > ipv4mtu ? ipv6mtu : ipv4mtu))
+	}
+	[ -n "$mtu" -a "$mtu" != 0 ] && {
+		echo Setting MTU of $ifname to $mtu
+		/sbin/ip link set dev $ifname mtu $mtu
+	}
+
+	uci_set_state network $interface tid "$tid"
 }
 
 proto_mbim_setup() {
diff --git a/package/network/utils/uqmi/Makefile b/package/network/utils/uqmi/Makefile
index c4ca98012a0fbc..667171932161c3 100644
--- a/package/network/utils/uqmi/Makefile
+++ b/package/network/utils/uqmi/Makefile
@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=uqmi
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=5
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/uqmi.git
@@ -14,6 +14,7 @@ PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=
 
 PKG_FLAGS:=nonshared
+PKG_BUILD_FLAGS:=gc-sections
 
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/cmake.mk
@@ -32,9 +33,9 @@ define Package/uqmi/description
 endef
 
 TARGET_CFLAGS += \
-	-I$(STAGING_DIR)/usr/include -ffunction-sections -fdata-sections
-
-TARGET_LDFLAGS += -Wl,--gc-sections
+	-I$(STAGING_DIR)/usr/include \
+	-Wno-error=dangling-pointer \
+	-Wno-error=maybe-uninitialized
 
 CMAKE_OPTIONS += \
 	-DDEBUG=1
diff --git a/package/network/utils/uqmi/files/lib/netifd/proto/qmi.sh b/package/network/utils/uqmi/files/lib/netifd/proto/qmi.sh
index c2c5fc1eca0baf..6c5104bccd8347 100755
--- a/package/network/utils/uqmi/files/lib/netifd/proto/qmi.sh
+++ b/package/network/utils/uqmi/files/lib/netifd/proto/qmi.sh
@@ -11,6 +11,7 @@ proto_qmi_init_config() {
 	no_device=1
 	proto_config_add_string "device:device"
 	proto_config_add_string apn
+	proto_config_add_string v6apn
 	proto_config_add_string auth
 	proto_config_add_string username
 	proto_config_add_string password
@@ -19,6 +20,7 @@ proto_qmi_init_config() {
 	proto_config_add_string modes
 	proto_config_add_string pdptype
 	proto_config_add_int profile
+	proto_config_add_int v6profile
 	proto_config_add_boolean dhcp
 	proto_config_add_boolean dhcpv6
 	proto_config_add_boolean autoconnect
@@ -31,14 +33,14 @@ proto_qmi_init_config() {
 proto_qmi_setup() {
 	local interface="$1"
 	local dataformat connstat plmn_mode mcc mnc
-	local device apn auth username password pincode delay modes pdptype
-	local profile dhcp dhcpv6 autoconnect plmn timeout mtu $PROTO_DEFAULT_OPTIONS
+	local device apn v6apn auth username password pincode delay modes pdptype
+	local profile v6profile dhcp dhcpv6 autoconnect plmn timeout mtu $PROTO_DEFAULT_OPTIONS
 	local ip4table ip6table
 	local cid_4 pdh_4 cid_6 pdh_6
 	local ip_6 ip_prefix_length gateway_6 dns1_6 dns2_6
 
-	json_get_vars device apn auth username password pincode delay modes
-	json_get_vars pdptype profile dhcp dhcpv6 autoconnect plmn ip4table
+	json_get_vars device apn v6apn auth username password pincode delay modes
+	json_get_vars pdptype profile v6profile dhcp dhcpv6 autoconnect plmn ip4table
 	json_get_vars ip6table timeout mtu $PROTO_DEFAULT_OPTIONS
 
 	[ "$timeout" = "" ] && timeout="10"
@@ -192,6 +194,7 @@ proto_qmi_setup() {
 
 	# Cleanup current state if any
 	uqmi -s -d "$device" --stop-network 0xffffffff --autoconnect > /dev/null 2>&1
+	uqmi -s -d "$device" --set-ip-family ipv6 --stop-network 0xffffffff --autoconnect > /dev/null 2>&1
 
 	# Go online
 	uqmi -s -d "$device" --set-device-operating-mode online > /dev/null 2>&1
@@ -308,10 +311,13 @@ proto_qmi_setup() {
 
 		uqmi -s -d "$device" --set-client-id wds,"$cid_6" --set-ip-family ipv6 > /dev/null 2>&1
 
+		: "${v6apn:=${apn}}"
+		: "${v6profile:=${profile}}"
+
 		pdh_6=$(uqmi -s -d "$device" --set-client-id wds,"$cid_6" \
 			--start-network \
-			${apn:+--apn $apn} \
-			${profile:+--profile $profile} \
+			${v6apn:+--apn $v6apn} \
+			${v6profile:+--profile $v6profile} \
 			${auth:+--auth-type $auth} \
 			${username:+--username $username} \
 			${password:+--password $password} \
@@ -326,7 +332,7 @@ proto_qmi_setup() {
 		fi
 
 		# Check data connection state
-		connstat=$(uqmi -s -d "$device" --set-client-id wds,"$cid_6" --get-data-status)
+		connstat=$(uqmi -s -d "$device" --set-client-id wds,"$cid_6" --set-ip-family ipv6 --get-data-status)
 		[ "$connstat" == '"connected"' ] || {
 			echo "No data link!"
 			uqmi -s -d "$device" --set-client-id wds,"$cid_6" --release-client-id wds > /dev/null 2>&1
@@ -382,6 +388,7 @@ proto_qmi_setup() {
 			json_init
 			json_add_string name "${interface}_6"
 			json_add_string ifname "@$interface"
+			[ "$pdptype" = "ipv4v6" ] && json_add_string iface_464xlat "0"
 			json_add_string proto "dhcpv6"
 			[ -n "$ip6table" ] && json_add_string ip6table "$ip6table"
 			proto_add_dynamic_defaults
diff --git a/package/network/utils/wireguard-tools/Makefile b/package/network/utils/wireguard-tools/Makefile
index 8218171fcde601..5b1fab057d937a 100644
--- a/package/network/utils/wireguard-tools/Makefile
+++ b/package/network/utils/wireguard-tools/Makefile
@@ -7,12 +7,11 @@
 # See /LICENSE for more information.
 
 include $(TOPDIR)/rules.mk
-include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=wireguard-tools
 
 PKG_VERSION:=1.0.20210914
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=2
 
 PKG_SOURCE:=wireguard-tools-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://git.zx2c4.com/wireguard-tools/snapshot/
@@ -24,7 +23,6 @@ PKG_LICENSE_FILES:=COPYING
 PKG_BUILD_PARALLEL:=1
 
 include $(INCLUDE_DIR)/package.mk
-include $(INCLUDE_DIR)/package-defaults.mk
 
 MAKE_PATH:=src
 MAKE_VARS += PLATFORM=linux
diff --git a/package/network/utils/wireless-tools/Makefile b/package/network/utils/wireless-tools/Makefile
index 52e246a59c8002..6ac66a056a016f 100644
--- a/package/network/utils/wireless-tools/Makefile
+++ b/package/network/utils/wireless-tools/Makefile
@@ -8,6 +8,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wireless-tools
+PKG_CPE_ID:=cpe:/a:wireless_tools_project:wireless_tools
 PKG_VERSION:=29
 PKG_MINOR:=
 PKG_RELEASE:=6
diff --git a/package/network/utils/wwan/Makefile b/package/network/utils/wwan/Makefile
index 1c5a5e6669fc5d..19404383cb71f1 100644
--- a/package/network/utils/wwan/Makefile
+++ b/package/network/utils/wwan/Makefile
@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wwan
 PKG_VERSION:=2019-04-29
-PKG_RELEASE=5
+PKG_RELEASE=6
 
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=
diff --git a/package/network/utils/wwan/files/data/0e8d-00a5 b/package/network/utils/wwan/files/data/0e8d-00a5
new file mode 100644
index 00000000000000..23a7ce361613b6
--- /dev/null
+++ b/package/network/utils/wwan/files/data/0e8d-00a5
@@ -0,0 +1,5 @@
+{
+        "desc": "Medion S4222",
+        "control": 2,
+        "data": 0
+}
diff --git a/package/network/utils/xdp-tools/Makefile b/package/network/utils/xdp-tools/Makefile
index 42a8a0695b0ee2..3cc7980cf60b67 100644
--- a/package/network/utils/xdp-tools/Makefile
+++ b/package/network/utils/xdp-tools/Makefile
@@ -1,9 +1,9 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=xdp-tools
-PKG_RELEASE:=$(AUTORELEASE)
-PKG_VERSION:=1.2.6
-PKG_HASH:=e1bead15014adf404c1ae93b5bb24e6625840b4aadef6c1acfb47e0b99039f52
+PKG_RELEASE:=1
+PKG_VERSION:=1.2.9
+PKG_HASH:=159ed8d3c8195d812ec3cde83bd736245a72743af372998320d39c2ba69ab142
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/xdp-project/xdp-tools/tar.gz/v$(PKG_VERSION)?
diff --git a/package/network/utils/xdp-tools/patches/010-configure-respect-LDFLAGS.patch b/package/network/utils/xdp-tools/patches/010-configure-respect-LDFLAGS.patch
index b3454548f83edb..e2fbfa57dca444 100644
--- a/package/network/utils/xdp-tools/patches/010-configure-respect-LDFLAGS.patch
+++ b/package/network/utils/xdp-tools/patches/010-configure-respect-LDFLAGS.patch
@@ -1,6 +1,6 @@
 --- a/configure
 +++ b/configure
-@@ -138,7 +138,7 @@ int main(int argc, char **argv) {
+@@ -174,7 +174,7 @@ int main(int argc, char **argv) {
      return 0;
  }
  EOF
@@ -9,7 +9,7 @@
      if [ "$?" -eq "0" ]; then
          echo "HAVE_PCAP:=y" >>$CONFIG
          [ -n "$LIBPCAP_CFLAGS" ] && echo 'CFLAGS += ' $LIBPCAP_CFLAGS >> $CONFIG
-@@ -186,7 +186,7 @@ int main(int argc, char **argv) {
+@@ -222,7 +222,7 @@ int main(int argc, char **argv) {
      return 0;
  }
  EOF
@@ -18,7 +18,7 @@
      if [ "$?" -eq "0" ]; then
          echo "HAVE_FEATURES+=${config_var}" >>"$CONFIG"
          echo "yes"
-@@ -253,7 +253,7 @@ int main(int argc, char **argv) {
+@@ -289,7 +289,7 @@ int main(int argc, char **argv) {
  }
  EOF
  
diff --git a/package/system/ca-certificates/Makefile b/package/system/ca-certificates/Makefile
index 9fac32e7e3e80c..ec588cc65b6c6b 100644
--- a/package/system/ca-certificates/Makefile
+++ b/package/system/ca-certificates/Makefile
@@ -7,17 +7,20 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ca-certificates
-PKG_VERSION:=20211016
+PKG_VERSION:=20230311
 PKG_RELEASE:=1
 PKG_MAINTAINER:=
 
 PKG_SOURCE:=$(PKG_NAME)_$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@DEBIAN/pool/main/c/ca-certificates
-PKG_HASH:=2ae9b6dc5f40c25d6d7fe55e07b54f12a8967d1955d3b7b2f42ee46266eeef88
+PKG_HASH:=83de934afa186e279d1ed08ea0d73f5cf43a6fbfb5f00874b6db3711c64576f3
 PKG_INSTALL:=1
 
 include $(INCLUDE_DIR)/package.mk
 
+TAR_OPTIONS+= --strip-components 1
+TAR_CMD=$(HOST_TAR) -C $(1) $(TAR_OPTIONS)
+
 define Package/ca-certificates
   SECTION:=base
   CATEGORY:=Base system
@@ -34,13 +37,6 @@ define Package/ca-bundle
   PROVIDES:=ca-certs
 endef
 
-define Build/Prepare
-	$(DECOMPRESS_CMD) $(HOST_TAR) -C $(PKG_BUILD_DIR) $(TAR_OPTIONS)
-	$(Build/Patch)
-endef
-
-MAKE_PATH := work
-
 define Build/Install
 	mkdir -p \
 		$(PKG_INSTALL_DIR)/usr/sbin \
diff --git a/package/system/ca-certificates/patches/0001-ca-certificates-fix-python3-cryptography-woes-in-cer.patch b/package/system/ca-certificates/patches/0001-ca-certificates-fix-python3-cryptography-woes-in-cer.patch
index add01f42c0fb29..09092617f18ffd 100644
--- a/package/system/ca-certificates/patches/0001-ca-certificates-fix-python3-cryptography-woes-in-cer.patch
+++ b/package/system/ca-certificates/patches/0001-ca-certificates-fix-python3-cryptography-woes-in-cer.patch
@@ -18,8 +18,8 @@ Reported-by: Chen Minqiang <ptpt52@gmail.com>
 Reported-by: Shane Synan <digitalcircuit36939@gmail.com>
 Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
 ---
---- a/work/mozilla/certdata2pem.py
-+++ b/work/mozilla/certdata2pem.py
+--- a/mozilla/certdata2pem.py
++++ b/mozilla/certdata2pem.py
 @@ -21,16 +21,12 @@
  # USA.
  
@@ -42,8 +42,8 @@ Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
          if not obj['CKA_LABEL'] in trust or not trust[obj['CKA_LABEL']]:
              continue
 -
--        cert = x509.load_der_x509_certificate(obj['CKA_VALUE'])
--        if cert.not_valid_after < datetime.datetime.now():
+-        cert = x509.load_der_x509_certificate(bytes(obj['CKA_VALUE']))
+-        if cert.not_valid_after < datetime.datetime.utcnow():
 -            print('!'*74)
 -            print('Trusted but expired certificate found: %s' % obj['CKA_LABEL'])
 -            print('!'*74)
diff --git a/package/system/fstools/Makefile b/package/system/fstools/Makefile
index 304aff8de1bb54..379f5d8c9da3cc 100644
--- a/package/system/fstools/Makefile
+++ b/package/system/fstools/Makefile
@@ -8,19 +8,19 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=fstools
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/fstools.git
-PKG_MIRROR_HASH:=aecd54ca2421fee691d2fb4a77e0348d225c6949d5254dd9da0827da9728cb2d
-PKG_SOURCE_DATE:=2022-08-13
-PKG_SOURCE_VERSION:=81785c1b9a9c1b797e7406a3542c01d972c61315
+PKG_MIRROR_HASH:=4ec370a1cdc9fa69131f1403b064d2e05d54ee865411917410d7540454265319
+PKG_SOURCE_DATE:=2023-02-28
+PKG_SOURCE_VERSION:=bfe882d5ff4eeebb8f57c8a0f9b9e767a57870d8
 CMAKE_INSTALL:=1
 
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=
 
-PKG_USE_MIPS16:=0
+PKG_BUILD_FLAGS:=no-mips16
 PKG_FLAGS:=nonshared
 
 PKG_BUILD_DEPENDS := util-linux
@@ -31,7 +31,6 @@ PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/cmake.mk
 
-TARGET_LDFLAGS += $(if $(CONFIG_USE_GLIBC),-lrt)
 CMAKE_OPTIONS += $(if $(CONFIG_FSTOOLS_UBIFS_EXTROOT),-DCMAKE_UBIFS_EXTROOT=y)
 CMAKE_OPTIONS += $(if $(CONFIG_FSTOOLS_OVL_MOUNT_FULL_ACCESS_TIME),-DCMAKE_OVL_MOUNT_FULL_ACCESS_TIME=y)
 CMAKE_OPTIONS += $(if $(CONFIG_FSTOOLS_OVL_MOUNT_COMPRESS_ZLIB),-DCMAKE_OVL_MOUNT_COMPRESS_ZLIB=y)
@@ -39,7 +38,7 @@ CMAKE_OPTIONS += $(if $(CONFIG_FSTOOLS_OVL_MOUNT_COMPRESS_ZLIB),-DCMAKE_OVL_MOUN
 define Package/fstools
   SECTION:=base
   CATEGORY:=Base system
-  DEPENDS:=+ubox +USE_GLIBC:librt +NAND_SUPPORT:ubi-utils
+  DEPENDS:=+ubox +NAND_SUPPORT:ubi-utils
   TITLE:=OpenWrt filesystem tools
   MENU:=1
 endef
diff --git a/package/system/gpio-cdev/nu801/Makefile b/package/system/gpio-cdev/nu801/Makefile
index f91fbbc8ae34ad..67b2a771ec83fe 100644
--- a/package/system/gpio-cdev/nu801/Makefile
+++ b/package/system/gpio-cdev/nu801/Makefile
@@ -20,7 +20,7 @@ define Package/nu801
   SECTION:=utils
   CATEGORY:=Utilities
   SUBMENU:=Userspace GPIO Drivers
-  DEPENDS:=@(TARGET_x86||TARGET_bcm53xx)
+  DEPENDS:=@(TARGET_ath79_nand||TARGET_bcm53xx||TARGET_x86)
   KCONFIG:=CONFIG_GPIO_CDEV=y
   TITLE:=NU801 LED Driver
 endef
diff --git a/package/system/iucode-tool/patches/001-iucode_tool-add-missing-limits.h-for-USE_CPUID_DEVIC.patch b/package/system/iucode-tool/patches/001-iucode_tool-add-missing-limits.h-for-USE_CPUID_DEVIC.patch
new file mode 100644
index 00000000000000..ef9e5ab2f8ca3b
--- /dev/null
+++ b/package/system/iucode-tool/patches/001-iucode_tool-add-missing-limits.h-for-USE_CPUID_DEVIC.patch
@@ -0,0 +1,29 @@
+From e1137cdafc97c0a8b2a0717a771823f3c4320087 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 29 Nov 2022 19:37:03 +0100
+Subject: [PATCH] iucode_tool: add missing limits.h for USE_CPUID_DEVICE
+
+If USE_CPUID_DEVICE is enabled, compilation fails for missing define.
+Add the missing include to fix compilation error with USE_CPUID_DEVICE
+define.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ iucode_tool.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/iucode_tool.c b/iucode_tool.c
+index 4bba5db..0246035 100644
+--- a/iucode_tool.c
++++ b/iucode_tool.c
+@@ -19,6 +19,7 @@
+ #include <stdint.h>
+ #include <sys/types.h>
+ #include <sys/stat.h>
++#include <limits.h>
+ #include <fcntl.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+-- 
+2.37.2
+
diff --git a/package/system/mtd/Makefile b/package/system/mtd/Makefile
index 1a70a64b7d2004..d45f06fc4354de 100644
--- a/package/system/mtd/Makefile
+++ b/package/system/mtd/Makefile
@@ -18,6 +18,7 @@ PKG_LICENSE:=GPL-2.0+
 PKG_LICENSE_FILES:=
 
 PKG_FLAGS:=nonshared
+PKG_BUILD_FLAGS:=lto
 
 include $(INCLUDE_DIR)/package.mk
 
@@ -36,8 +37,7 @@ endef
 target=$(firstword $(subst -, ,$(BOARD)))
 
 MAKE_FLAGS += TARGET="$(target)"
-TARGET_CFLAGS += -Dtarget_$(target)=1 -Wall -flto
-TARGET_LDFLAGS += -flto=jobserver
+TARGET_CFLAGS += -Dtarget_$(target)=1 -Wall
 
 ifdef CONFIG_MTD_REDBOOT_PARTS
   MAKE_FLAGS += FIS_SUPPORT=1
diff --git a/package/system/opkg/Makefile b/package/system/opkg/Makefile
index 83c9dab1b020e8..3510e7435d1460 100644
--- a/package/system/opkg/Makefile
+++ b/package/system/opkg/Makefile
@@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=opkg
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=2
 PKG_FLAGS:=essential
 
 PKG_SOURCE_PROTO:=git
@@ -28,6 +28,8 @@ PKG_CONFIG_DEPENDS += \
 
 HOST_BUILD_DEPENDS:=libubox/host
 
+PKG_BUILD_FLAGS:=gc-sections
+
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/host-build.mk
 include $(INCLUDE_DIR)/cmake.mk
@@ -57,7 +59,6 @@ define Package/opkg/conffiles
 /etc/opkg/customfeeds.conf
 endef
 
-TARGET_CFLAGS += -ffunction-sections -fdata-sections
 EXTRA_CFLAGS += $(TARGET_CPPFLAGS)
 
 CMAKE_OPTIONS += \
diff --git a/package/system/procd/Makefile b/package/system/procd/Makefile
index 13d74ad7f66a5e..2d51b51ad72dad 100644
--- a/package/system/procd/Makefile
+++ b/package/system/procd/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=procd
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/procd.git
-PKG_MIRROR_HASH:=b03b6cd3321451813bb802647b8d574e25d39434167f36f271fef170ebd2f2c8
-PKG_SOURCE_DATE:=2022-07-17
-PKG_SOURCE_VERSION:=ef5d3e36e8b23ee2e1989c22717b21649dc9a388
+PKG_MIRROR_HASH:=75a92c01ef85f41dc7e0b77ac35f464fbe45942af02ca6847516c4ebf574c4a4
+PKG_SOURCE_DATE:=2023-01-16
+PKG_SOURCE_VERSION:=190f13a75e67e0bdb662188da79b8be31e0aae01
 CMAKE_INSTALL:=1
 
 PKG_LICENSE:=GPL-2.0
@@ -22,6 +22,7 @@ PKG_LICENSE_FILES:=
 
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 
+PKG_BUILD_FLAGS:=lto
 PKG_ASLR_PIE_REGULAR:=1
 PKG_CONFIG_DEPENDS:= \
 	CONFIG_TARGET_INIT_PATH CONFIG_KERNEL_SECCOMP CONFIG_PROCD_SHOW_BOOT \
@@ -35,15 +36,11 @@ ifeq ($(DUMP),)
 endif
 
 CMAKE_OPTIONS += -DEARLY_PATH="$(TARGET_INIT_PATH)"
-TARGET_LDFLAGS += $(if $(CONFIG_USE_GLIBC),-lrt)
-
-TARGET_CFLAGS += -flto
-TARGET_LDFLAGS += -flto
 
 define Package/procd/Default
   SECTION:=base
   CATEGORY:=Base system
-  DEPENDS:=+ubusd +ubus +libjson-script +ubox +USE_GLIBC:librt +libubox \
+  DEPENDS:=+ubusd +ubus +libjson-script +ubox +libubox \
 	  +libubus +libblobmsg-json +libjson-c +jshn
   TITLE:=OpenWrt system process manager
   USERID:=:dialout=20 :audio=29
diff --git a/package/system/procd/files/service b/package/system/procd/files/service
index 1ceacfe5add6c5..0ca70580417437 100644
--- a/package/system/procd/files/service
+++ b/package/system/procd/files/service
@@ -2,17 +2,17 @@
 
 main() {
 	local service="$1"
-	local cmd="$2"
+	shift
 
 	local boot status
 
 	if [ -f "/etc/init.d/${service}" ]; then
-		/etc/init.d/"${service}" "${cmd}"
+		/etc/init.d/"${service}" "$@"
 		exit "$?"
 	fi
 
 	if [ -n "$service" ]; then
-		echo "Service \"$1\" not found:"
+		echo "Service \"$service\" not found:"
 		exit 1
 	fi
 
diff --git a/package/system/rpcd/Makefile b/package/system/rpcd/Makefile
index 6571ca9c551482..6221da8c8effc7 100644
--- a/package/system/rpcd/Makefile
+++ b/package/system/rpcd/Makefile
@@ -12,9 +12,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/rpcd.git
-PKG_MIRROR_HASH:=52ca9beab4b18afec9717a5f05c5232ef6160c3ece82a020851ac3aeaa52a29a
-PKG_SOURCE_DATE:=2022-08-24
-PKG_SOURCE_VERSION:=82904bd4f92e5928d047db6396cc14ca2b07d89f
+PKG_MIRROR_HASH:=d636b6e08a69578d615b2a294d6ca2c7ef73791de2a8314f1afb741655d8a143
+PKG_SOURCE_DATE:=2023-03-14
+PKG_SOURCE_VERSION:=d97883005ffb5be251872c3e4abe04f71732f9bd
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 
 PKG_LICENSE:=ISC
@@ -68,8 +68,9 @@ endef
 
 
 # 1: plugin name
-# 2: extra dependencies
+# 2: additional dependencies
 # 3: plugin title/description
+# 4: extra dependencies
 define BuildPlugin
 
   PKG_CONFIG_DEPENDS += CONFIG_PACKAGE_rpcd-mod-$(1)
@@ -78,6 +79,7 @@ define BuildPlugin
     $(Package/rpcd/default)
     TITLE+= ($(1) plugin)
     DEPENDS+=rpcd $(2)
+    EXTRA_DEPENDS:=$(4)
   endef
 
   define Package/rpcd-mod-$(1)/description
@@ -101,5 +103,5 @@ endef
 $(eval $(call BuildPackage,rpcd))
 $(eval $(call BuildPlugin,file,,Provides ubus calls for file and directory operations.))
 $(eval $(call BuildPlugin,rpcsys,,Provides ubus calls for sysupgrade and password changing.))
-$(eval $(call BuildPlugin,iwinfo,+libiwinfo,Provides ubus calls for accessing iwinfo data.))
+$(eval $(call BuildPlugin,iwinfo,+libiwinfo,Provides ubus calls for accessing iwinfo data.,libiwinfo (>= 2023-01-21)))
 $(eval $(call BuildPlugin,ucode,+libucode,Allows implementing plugins using ucode scripts.))
diff --git a/package/system/selinux-policy/Makefile b/package/system/selinux-policy/Makefile
index bcf6b4a3c24676..8e36b267bb4fb3 100644
--- a/package/system/selinux-policy/Makefile
+++ b/package/system/selinux-policy/Makefile
@@ -8,8 +8,8 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=selinux-policy
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://git.defensec.nl/selinux-policy.git
-PKG_VERSION:=1.2.3
-PKG_MIRROR_HASH:=ff1ddca168a6631aeac34352657f424bc4acf5d50b8aa7ff8dfa8c9663ba8538
+PKG_VERSION:=1.2.5
+PKG_MIRROR_HASH:=81ac6e31d2f1febddbe594f3578a9c40444fc0e349075ab6abd3d3ee014a988e
 PKG_SOURCE_VERSION:=v$(PKG_VERSION)
 PKG_BUILD_DEPENDS:=secilc/host policycoreutils/host
 
diff --git a/package/system/ubox/Makefile b/package/system/ubox/Makefile
index ca177b2c494904..e91763b074db35 100644
--- a/package/system/ubox/Makefile
+++ b/package/system/ubox/Makefile
@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ubox
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=2
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/ubox.git
@@ -18,12 +18,10 @@ PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/cmake.mk
 
-TARGET_LDFLAGS += $(if $(CONFIG_USE_GLIBC),-lrt)
-
 define Package/ubox
   SECTION:=base
   CATEGORY:=Base system
-  DEPENDS:=+libubox +ubusd +ubus +libubus +libuci +USE_GLIBC:librt
+  DEPENDS:=+libubox +ubusd +ubus +libubus +libuci
   TITLE:=OpenWrt system helper toolbox
   ALTERNATIVES:=\
     100:/sbin/rmmod:/sbin/kmodloader \
@@ -46,7 +44,7 @@ endef
 define Package/logd
   SECTION:=base
   CATEGORY:=Base system
-  DEPENDS:=+libubox +libubus +libblobmsg-json +USE_GLIBC:librt
+  DEPENDS:=+libubox +libubus +libblobmsg-json
   TITLE:=OpenWrt system log implementation
   USERID:=logd=514:logd=514
 endef
diff --git a/package/system/ubus/Makefile b/package/system/ubus/Makefile
index c70defcafa5a9b..5a951ac2495907 100644
--- a/package/system/ubus/Makefile
+++ b/package/system/ubus/Makefile
@@ -5,9 +5,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/ubus.git
-PKG_SOURCE_DATE:=2022-06-01
-PKG_SOURCE_VERSION:=2bebf93cd3343fe49f22a05ef935e460d2d44f67
-PKG_MIRROR_HASH:=4efd873928089c086bbac02f3ca5bae55904500b6e6f1c4c377181a00b67147f
+PKG_SOURCE_DATE:=2022-06-15
+PKG_SOURCE_VERSION:=9913aa61de739e3efe067a2d186021c20bcd65e2
+PKG_MIRROR_HASH:=f6702e68d7c60388c11f40ca5ca8e932d0bf423325db5bee2c79404782bbcb52
 PKG_ABI_VERSION:=$(call abi_version_str,$(PKG_SOURCE_DATE))
 CMAKE_INSTALL:=1
 
@@ -15,6 +15,7 @@ PKG_LICENSE:=LGPL-2.1
 PKG_LICENSE_FILES:=
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 
+PKG_BUILD_FLAGS:=lto
 PKG_ASLR_PIE_REGULAR:=1
 
 include $(INCLUDE_DIR)/package.mk
@@ -50,8 +51,7 @@ define Package/libubus-lua
   TITLE:=Lua binding for the OpenWrt RPC client
 endef
 
-TARGET_CFLAGS += -I$(STAGING_DIR)/usr/include -flto
-TARGET_LDFLAGS += -flto
+TARGET_CFLAGS += -I$(STAGING_DIR)/usr/include
 
 CMAKE_OPTIONS += \
 	-DLUAPATH=/usr/lib/lua \
diff --git a/package/system/uci/Makefile b/package/system/uci/Makefile
index 48e5bcc4da5269..30152607613899 100644
--- a/package/system/uci/Makefile
+++ b/package/system/uci/Makefile
@@ -9,13 +9,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=uci
-PKG_RELEASE:=6
+PKG_RELEASE:=1
 
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/uci.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE=2021-10-22
-PKG_SOURCE_VERSION:=f84f49f00fb70364f58b4cce72f1796a7190d370
-PKG_MIRROR_HASH:=9f4747a029976b43fcea9919643ce71e587e515edc21b280163f7262360d847f
+PKG_SOURCE_DATE=2023-03-05
+PKG_SOURCE_VERSION:=04d0c46cfe30f557da0c603516636830cab4a08a
+PKG_MIRROR_HASH:=5402091db0645d19a60c3ec51850062138af8fb9eda6764091819637d84f1036
 
 PKG_LICENSE:=LGPL-2.1
 PKG_LICENSE_FILES:=
diff --git a/package/system/usign/Makefile b/package/system/usign/Makefile
index 5267ce15f36630..3c28318028c1e0 100644
--- a/package/system/usign/Makefile
+++ b/package/system/usign/Makefile
@@ -10,7 +10,7 @@ PKG_SOURCE_VERSION:=f1f65026a94137c91b5466b149ef3ea3f20091e9
 PKG_MIRROR_HASH:=3f6569a5e63fdfd032976ac0f79d736d3935101ac1b97fb370514b013c5e6bb6
 CMAKE_INSTALL:=1
 PKG_CHECK_FORMAT_SECURITY:=1
-PKG_USE_MIPS16:=0
+PKG_BUILD_FLAGS:=no-mips16 lto
 
 PKG_LICENSE:=ISC
 PKG_LICENSE_FILES:=
@@ -30,9 +30,6 @@ define Package/usign
   TITLE:=OpenWrt signature verification utility
 endef
 
-TARGET_CFLAGS += -flto
-TARGET_LDFLAGS += -flto=jobserver
-
 CMAKE_OPTIONS += \
 	-DUSE_LIBUBOX=on
 
diff --git a/package/system/zram-swap/Makefile b/package/system/zram-swap/Makefile
index d0d1baddd12f1c..6e7e353f6fd768 100644
--- a/package/system/zram-swap/Makefile
+++ b/package/system/zram-swap/Makefile
@@ -5,7 +5,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zram-swap
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=32
 
 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)
 
diff --git a/package/utils/bcm27xx-userland/Makefile b/package/utils/bcm27xx-userland/Makefile
index 857db7969f7cde..9d7f6dd822f898 100644
--- a/package/utils/bcm27xx-userland/Makefile
+++ b/package/utils/bcm27xx-userland/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=bcm27xx-userland
 PKG_VERSION:=c4fd1b8986c6d6d4ae5cd51e65a8bbeb495dfa4e
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/raspberrypi/userland/tar.gz/$(PKG_VERSION)?
diff --git a/package/utils/bsdiff/Makefile b/package/utils/bsdiff/Makefile
index db1f32087205da..09e6f126f627ac 100644
--- a/package/utils/bsdiff/Makefile
+++ b/package/utils/bsdiff/Makefile
@@ -12,7 +12,7 @@ PKG_VERSION:=4.3
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=http://www.daemonology.net/bsdiff/
+PKG_SOURCE_URL:=https://www.daemonology.net/bsdiff/
 PKG_HASH:=18821588b2dc5bf159aa37d3bcb7b885d85ffd1e19f23a0c57a58723fea85f48
 PKG_MAINTAINER:=Hauke Mehrtens <hauke@hauke-m.de>
 HOST_BUILD_DEPENDS:=bzip2/host
@@ -27,7 +27,7 @@ define Package/bsdiff
   CATEGORY:=Utilities
   DEPENDS:=+libbz2
   TITLE:=Binary diff tool
-  URL:=http://www.daemonology.net/bsdiff/
+  URL:=https://www.daemonology.net/bsdiff/
 endef
 
 define Package/bspatch
@@ -35,7 +35,7 @@ define Package/bspatch
   CATEGORY:=Utilities
   DEPENDS:=+libbz2
   TITLE:=Binary patch tool
-  URL:=http://www.daemonology.net/bsdiff/
+  URL:=https://www.daemonology.net/bsdiff/
 endef
 
 
diff --git a/package/utils/busybox/Config-defaults.in b/package/utils/busybox/Config-defaults.in
index abe6d5431a70d4..b3c3f9a0b23740 100644
--- a/package/utils/busybox/Config-defaults.in
+++ b/package/utils/busybox/Config-defaults.in
@@ -208,6 +208,15 @@ config BUSYBOX_DEFAULT_PASSWORD_MINLEN
 config BUSYBOX_DEFAULT_MD5_SMALL
 	int
 	default 1
+config BUSYBOX_DEFAULT_SHA1_SMALL
+	int
+	default 3
+config BUSYBOX_DEFAULT_SHA1_HWACCEL
+	bool
+	default y
+config BUSYBOX_DEFAULT_SHA256_HWACCEL
+	bool
+	default y
 config BUSYBOX_DEFAULT_SHA3_SMALL
 	int
 	default 1
@@ -298,6 +307,15 @@ config BUSYBOX_DEFAULT_UNICODE_NEUTRAL_TABLE
 config BUSYBOX_DEFAULT_UNICODE_PRESERVE_BROKEN
 	bool
 	default n
+config BUSYBOX_DEFAULT_LOOP_CONFIGURE
+	bool
+	default n
+config BUSYBOX_DEFAULT_NO_LOOP_CONFIGURE
+	bool
+	default n
+config BUSYBOX_DEFAULT_TRY_LOOP_CONFIGURE
+	bool
+	default y
 config BUSYBOX_DEFAULT_FEATURE_SEAMLESS_XZ
 	bool
 	default n
@@ -860,6 +878,9 @@ config BUSYBOX_DEFAULT_TRUNCATE
 	bool
 	default y if TARGET_bcm53xx
 	default n
+config BUSYBOX_DEFAULT_TSORT
+	bool
+	default n
 config BUSYBOX_DEFAULT_TTY
 	bool
 	default n
@@ -961,7 +982,7 @@ config BUSYBOX_DEFAULT_RESET
 	default y
 config BUSYBOX_DEFAULT_RESIZE
 	bool
-	default n
+	default y
 config BUSYBOX_DEFAULT_FEATURE_RESIZE_PRINT
 	bool
 	default n
@@ -1801,13 +1822,13 @@ config BUSYBOX_DEFAULT_SWITCH_ROOT
 	default y
 config BUSYBOX_DEFAULT_TASKSET
 	bool
-	default n
+	default y
 config BUSYBOX_DEFAULT_FEATURE_TASKSET_FANCY
 	bool
-	default n
+	default y
 config BUSYBOX_DEFAULT_FEATURE_TASKSET_CPULIST
 	bool
-	default n
+	default y
 config BUSYBOX_DEFAULT_UEVENT
 	bool
 	default n
@@ -2162,6 +2183,9 @@ config BUSYBOX_DEFAULT_RUNLEVEL
 config BUSYBOX_DEFAULT_RX
 	bool
 	default n
+config BUSYBOX_DEFAULT_SEEDRNG
+	bool
+	default n
 config BUSYBOX_DEFAULT_SETFATTR
 	bool
 	default n
@@ -2174,6 +2198,9 @@ config BUSYBOX_DEFAULT_STRINGS
 config BUSYBOX_DEFAULT_TIME
 	bool
 	default y
+config BUSYBOX_DEFAULT_TREE
+	bool
+	default n
 config BUSYBOX_DEFAULT_TS
 	bool
 	default n
@@ -2682,6 +2709,9 @@ config BUSYBOX_DEFAULT_FEATURE_UDHCPC_SANITIZEOPT
 config BUSYBOX_DEFAULT_UDHCPC_DEFAULT_SCRIPT
 	string
 	default "/usr/share/udhcpc/default.script"
+config BUSYBOX_DEFAULT_UDHCPC6_DEFAULT_SCRIPT
+	string
+	default ""
 config BUSYBOX_DEFAULT_UDHCPC6
 	bool
 	default n
@@ -2993,7 +3023,7 @@ config BUSYBOX_DEFAULT_ASH_ALIAS
 	default y
 config BUSYBOX_DEFAULT_ASH_RANDOM_SUPPORT
 	bool
-	default n
+	default y
 config BUSYBOX_DEFAULT_ASH_EXPAND_PRMT
 	bool
 	default y
@@ -3012,6 +3042,9 @@ config BUSYBOX_DEFAULT_ASH_PRINTF
 config BUSYBOX_DEFAULT_ASH_TEST
 	bool
 	default y
+config BUSYBOX_DEFAULT_ASH_SLEEP
+	bool
+	default n
 config BUSYBOX_DEFAULT_ASH_HELP
 	bool
 	default n
diff --git a/package/utils/busybox/Makefile b/package/utils/busybox/Makefile
index 2861e7d2e942e3..4bddd5201d8f86 100644
--- a/package/utils/busybox/Makefile
+++ b/package/utils/busybox/Makefile
@@ -5,17 +5,18 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=busybox
-PKG_VERSION:=1.35.0
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_VERSION:=1.36.1
+PKG_RELEASE:=1
 PKG_FLAGS:=essential
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://www.busybox.net/downloads \
 		http://sources.buildroot.net
-PKG_HASH:=faeeb244c35a348a334f4a59e44626ee870fb07b6884d68c10ae8bc19f83a694
+PKG_HASH:=b8cc24c9574d809e7279c3be349795c5d5ceb6fdf19ca709f80cde50e47de314
 
 PKG_BUILD_DEPENDS:=BUSYBOX_CONFIG_PAM:libpam
 PKG_BUILD_PARALLEL:=1
+PKG_BUILD_FLAGS:=lto
 PKG_CHECK_FORMAT_SECURITY:=0
 
 PKG_LICENSE:=GPL-2.0
@@ -103,9 +104,6 @@ ifeq ($(BUILD_VARIANT),selinux)
   LDLIBS += selinux sepol
 endif
 
-TARGET_CFLAGS += -flto
-TARGET_LDFLAGS += -flto=jobserver -fuse-linker-plugin
-
 MAKE_VARS :=
 MAKE_FLAGS += \
 	EXTRA_CFLAGS="$(TARGET_CFLAGS) $(TARGET_CPPFLAGS)" \
diff --git a/package/utils/busybox/config/coreutils/Config.in b/package/utils/busybox/config/coreutils/Config.in
index 835ce7950a2b51..983740be6ed12b 100644
--- a/package/utils/busybox/config/coreutils/Config.in
+++ b/package/utils/busybox/config/coreutils/Config.in
@@ -653,7 +653,7 @@ config BUSYBOX_CONFIG_SORT
 	sort is used to sort lines of text in specified files.
 
 config BUSYBOX_CONFIG_FEATURE_SORT_BIG
-	bool "Full SuSv3 compliant sort (support -ktcbdfiogM)"
+	bool "Full SuSv3 compliant sort (support -ktcbdfioghM)"
 	default BUSYBOX_DEFAULT_FEATURE_SORT_BIG
 	depends on BUSYBOX_CONFIG_SORT
 	help
@@ -851,6 +851,11 @@ config BUSYBOX_CONFIG_TRUNCATE
 	help
 	truncate truncates files to a given size. If a file does
 	not exist, it is created unless told otherwise.
+config BUSYBOX_CONFIG_TSORT
+	bool "tsort (0.7 kb)"
+	default BUSYBOX_DEFAULT_TSORT
+	help
+	tsort performs a topological sort.
 config BUSYBOX_CONFIG_TTY
 	bool "tty (3.6 kb)"
 	default BUSYBOX_DEFAULT_TTY
diff --git a/package/utils/busybox/config/libbb/Config.in b/package/utils/busybox/config/libbb/Config.in
index e050c4a9150a38..b3a83b9b085279 100644
--- a/package/utils/busybox/config/libbb/Config.in
+++ b/package/utils/busybox/config/libbb/Config.in
@@ -98,21 +98,47 @@ config BUSYBOX_CONFIG_MD5_SMALL
 	default BUSYBOX_DEFAULT_MD5_SMALL  # all "fast or small" options default to small
 	range 0 3
 	help
-	Trade binary size versus speed for the md5sum algorithm.
+	Trade binary size versus speed for the md5 algorithm.
 	Approximate values running uClibc and hashing
 	linux-2.4.4.tar.bz2 were:
-	value               user times (sec)  text size (386)
-	0 (fastest)         1.1                6144
-	1                   1.4                5392
-	2                   3.0                5088
-	3 (smallest)        5.1                4912
+	value           user times (sec)  text size (386)
+	0 (fastest)     1.1               6144
+	1               1.4               5392
+	2               3.0               5088
+	3 (smallest)    5.1               4912
+
+config BUSYBOX_CONFIG_SHA1_SMALL
+	int "SHA1: Trade bytes for speed (0:fast, 3:slow)"
+	default BUSYBOX_DEFAULT_SHA1_SMALL  # all "fast or small" options default to small
+	range 0 3
+	help
+	Trade binary size versus speed for the sha1 algorithm.
+	With FEATURE_COPYBUF_KB=64:
+	                throughput MB/s   size of sha1_process_block64
+	value           486  x86-64       486   x86-64
+	0               440  485          3481  3502
+	1               265  265           641   696
+	2,3             220  210           342   364
+
+config BUSYBOX_CONFIG_SHA1_HWACCEL
+	bool "SHA1: Use hardware accelerated instructions if possible"
+	default BUSYBOX_DEFAULT_SHA1_HWACCEL
+	help
+	On x86, this adds ~590 bytes of code. Throughput
+	is about twice as fast as fully-unrolled generic code.
+
+config BUSYBOX_CONFIG_SHA256_HWACCEL
+	bool "SHA256: Use hardware accelerated instructions if possible"
+	default BUSYBOX_DEFAULT_SHA256_HWACCEL
+	help
+	On x86, this adds ~1k bytes of code.
 
 config BUSYBOX_CONFIG_SHA3_SMALL
 	int "SHA3: Trade bytes for speed (0:fast, 1:slow)"
 	default BUSYBOX_DEFAULT_SHA3_SMALL  # all "fast or small" options default to small
 	range 0 1
 	help
-	Trade binary size versus speed for the sha3sum algorithm.
+	Trade binary size versus speed for the sha3 algorithm.
 	SHA3_SMALL=0 compared to SHA3_SMALL=1 (approximate):
 	64-bit x86: +270 bytes of code, 45% faster
 	32-bit x86: +450 bytes of code, 75% faster
@@ -399,3 +425,25 @@ config BUSYBOX_CONFIG_UNICODE_PRESERVE_BROKEN
 	For example, this means that entering 'l', 's', ' ', 0xff, [Enter]
 	at shell prompt will list file named 0xff (single char name
 	with char value 255), not file named '?'.
+
+choice
+	prompt "Use LOOP_CONFIGURE for losetup and loop mounts"
+	default BUSYBOX_CONFIG_TRY_LOOP_CONFIGURE
+	help
+	LOOP_CONFIGURE is added to Linux 5.8
+	https://lwn.net/Articles/820408/
+	This allows userspace to completely setup a loop device with a single
+	ioctl, removing the in-between state where the device can be partially
+	configured - eg the loop device has a backing file associated with it,
+	but is reading from the wrong offset.
+
+config BUSYBOX_CONFIG_LOOP_CONFIGURE
+	bool "use LOOP_CONFIGURE, needs kernel >= 5.8"
+
+config BUSYBOX_CONFIG_NO_LOOP_CONFIGURE
+	bool "use LOOP_SET_FD + LOOP_SET_STATUS"
+
+config BUSYBOX_CONFIG_TRY_LOOP_CONFIGURE
+	bool "try LOOP_CONFIGURE, fall back to LOOP_SET_FD + LOOP_SET_STATUS"
+
+endchoice
diff --git a/package/utils/busybox/config/miscutils/Config.in b/package/utils/busybox/config/miscutils/Config.in
index ecb83d9647aed8..e15e318fe07585 100644
--- a/package/utils/busybox/config/miscutils/Config.in
+++ b/package/utils/busybox/config/miscutils/Config.in
@@ -704,6 +704,13 @@ config BUSYBOX_CONFIG_RX
 	default BUSYBOX_DEFAULT_RX
 	help
 	Receive files using the Xmodem protocol.
+config BUSYBOX_CONFIG_SEEDRNG
+	bool "seedrng (1.3 kb)"
+	default BUSYBOX_DEFAULT_SEEDRNG
+	help
+	Seed the kernel RNG from seed files, meant to be called
+	once during startup, once during shutdown, and optionally
+	at some periodic interval in between.
 config BUSYBOX_CONFIG_SETFATTR
 	bool "setfattr (3.7 kb)"
 	default BUSYBOX_DEFAULT_SETFATTR
@@ -727,6 +734,11 @@ config BUSYBOX_CONFIG_TIME
 	The time command runs the specified program with the given arguments.
 	When the command finishes, time writes a message to standard output
 	giving timing statistics about this program run.
+config BUSYBOX_CONFIG_TREE
+	bool "tree (0.6 kb)"
+	default BUSYBOX_DEFAULT_TREE
+	help
+	List files and directories in a tree structure.
 config BUSYBOX_CONFIG_TS
 	bool "ts (450 bytes)"
 	default BUSYBOX_DEFAULT_TS
diff --git a/package/utils/busybox/config/networking/udhcp/Config.in b/package/utils/busybox/config/networking/udhcp/Config.in
index ecfa283e23ae34..6757f1efc9c9a6 100644
--- a/package/utils/busybox/config/networking/udhcp/Config.in
+++ b/package/utils/busybox/config/networking/udhcp/Config.in
@@ -93,12 +93,17 @@ config BUSYBOX_CONFIG_FEATURE_UDHCPC_SANITIZEOPT
 config BUSYBOX_CONFIG_UDHCPC_DEFAULT_SCRIPT
 	string "Absolute path to config script"
 	default BUSYBOX_DEFAULT_UDHCPC_DEFAULT_SCRIPT
-	depends on BUSYBOX_CONFIG_UDHCPC || BUSYBOX_CONFIG_UDHCPC6
+	depends on BUSYBOX_CONFIG_UDHCPC
 	help
 	This script is called after udhcpc receives an answer. See
 	examples/udhcp for a working example. Normally it is safe
 	to leave this untouched.
 
+config BUSYBOX_CONFIG_UDHCPC6_DEFAULT_SCRIPT
+	string "Absolute path to config script for IPv6"
+	default BUSYBOX_DEFAULT_UDHCPC6_DEFAULT_SCRIPT
+	depends on BUSYBOX_CONFIG_UDHCPC6
+
 # udhcpc6 config is inserted here:
 config BUSYBOX_CONFIG_UDHCPC6
 	bool "udhcpc6 (21 kb)"
diff --git a/package/utils/busybox/config/shell/Config.in b/package/utils/busybox/config/shell/Config.in
index 2b07812109c443..a68e9114ef7761 100644
--- a/package/utils/busybox/config/shell/Config.in
+++ b/package/utils/busybox/config/shell/Config.in
@@ -201,6 +201,11 @@ config BUSYBOX_CONFIG_ASH_TEST
 	default BUSYBOX_DEFAULT_ASH_TEST
 	depends on BUSYBOX_CONFIG_SHELL_ASH
 
+config BUSYBOX_CONFIG_ASH_SLEEP
+	bool "sleep builtin"
+	default BUSYBOX_DEFAULT_ASH_SLEEP
+	depends on BUSYBOX_CONFIG_SHELL_ASH
+
 config BUSYBOX_CONFIG_ASH_HELP
 	bool "help builtin"
 	default BUSYBOX_DEFAULT_ASH_HELP
diff --git a/package/utils/busybox/patches/530-nslookup-ensure-unique-transaction-IDs-for-the-DNS-queries.patch b/package/utils/busybox/patches/530-nslookup-ensure-unique-transaction-IDs-for-the-DNS-queries.patch
new file mode 100644
index 00000000000000..caa5ee78f35ad3
--- /dev/null
+++ b/package/utils/busybox/patches/530-nslookup-ensure-unique-transaction-IDs-for-the-DNS-queries.patch
@@ -0,0 +1,42 @@
+From: Uwe Kleine-König <uwe@kleine-koenig.org>
+Date: Sat, 8 Oct 2022 19:22:52 +0200
+Subject: [PATCH] nslookup: ensure unique transaction IDs for the DNS queries
+
+The transaction IDs generated by res_mkquery() for both glibc and musl only
+depends on the state of the monotonic clock.
+For some machines (here: a TP-Link RE200 powered by a MediaTek MT7620A)
+the monotonic clock has a coarse resolution (here: 20 µs) and it can happen
+that the requests for A and AAAA share the same transaction ID.
+
+In that case the mapping from received responses to the sent queries
+doesn't work and name resolution fails as follows:
+
+        # /bin/busybox nslookup heise.de
+        Server:         127.0.0.1
+        Address:        127.0.0.1:53
+
+        Non-authoritative answer:
+        Name:   heise.de
+        Address: 193.99.144.80
+
+        *** Can't find heise.de: No answer
+
+because the AAAA reply is dropped as a duplicate reply to the A query.
+
+To prevent this make sure the transaction IDs are unique.
+
+Forwarded: http://lists.busybox.net/pipermail/busybox/2022-October/089911.html
+---
+--- a/networking/nslookup.c
++++ b/networking/nslookup.c
+@@ -978,6 +978,10 @@ int nslookup_main(int argc UNUSED_PARAM,
+ 		}
+ 	}
+ 
++	/* Ensure the Transaction IDs are unique */
++	for (rc = 1; rc < G.query_count; rc++)
++		G.query[rc].query[1] = G.query[rc - 1].query[1] + 1;
++
+ 	for (rc = 0; rc < G.serv_count;) {
+ 		int c;
+ 
diff --git a/package/utils/checkpolicy/Makefile b/package/utils/checkpolicy/Makefile
index e9c10e293fc1fe..4ebf97bb3f9ee8 100644
--- a/package/utils/checkpolicy/Makefile
+++ b/package/utils/checkpolicy/Makefile
@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=checkpolicy
-PKG_VERSION:=3.3
+PKG_VERSION:=3.5
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/$(PKG_VERSION)
-PKG_HASH:=25c84edfa3a10ab8cb073b97bc55cb66377532d54a2723da9accdabd05431485
+PKG_HASH:=7aa48ab2222a0b9881111d6d7f70c3014d3d9338827d9e02df105a68c0df5dbc
 PKG_INSTALL:=1
 PKG_BUILD_DEPENDS:=libselinux
 HOST_BUILD_DEPENDS:=libselinux/host
diff --git a/package/utils/dtc/Makefile b/package/utils/dtc/Makefile
index 94534b9c5e9a69..2e20c29cc641ca 100644
--- a/package/utils/dtc/Makefile
+++ b/package/utils/dtc/Makefile
@@ -5,11 +5,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dtc
-PKG_VERSION:=1.6.1
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_VERSION:=1.7.0
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
-PKG_HASH:=65cec529893659a49a89740bb362f507a3b94fc8cd791e76a8d6a2b6f3203473
+PKG_HASH:=29edce3d302a15563d8663198bbc398c5a0554765c83830d0d4c0409d21a16c4
 PKG_SOURCE_URL:=@KERNEL/software/utils/dtc
 
 PKG_MAINTAINER:=Yousong Zhou <yszhou4tech@gmail.com>
diff --git a/package/utils/e2fsprogs/Makefile b/package/utils/e2fsprogs/Makefile
index b131cdccac5d95..42c297152941e3 100644
--- a/package/utils/e2fsprogs/Makefile
+++ b/package/utils/e2fsprogs/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=e2fsprogs
-PKG_VERSION:=1.46.5
-PKG_RELEASE:=1
+PKG_VERSION:=1.47.0
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/linux/kernel/people/tytso/e2fsprogs/v$(PKG_VERSION)/
-PKG_HASH:=2f16c9176704cf645dc69d5b15ff704ae722d665df38b2ed3cfc249757d8d81e
+PKG_HASH:=144af53f2bbd921cef6f8bea88bb9faddca865da3fbc657cc9b4d2001097d5db
 
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=NOTICE
@@ -23,6 +23,7 @@ PKG_BUILD_DEPENDS:=util-linux e2fsprogs/host
 PKG_INSTALL:=1
 
 PKG_BUILD_PARALLEL:=1
+PKG_BUILD_FLAGS:=gc-sections lto
 
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/host-build.mk
@@ -142,10 +143,7 @@ $(call Package/e2fsprogs)
   DEPENDS:= +e2fsprogs
 endef
 
-TARGET_CFLAGS += $(FPIC) -ffunction-sections -fdata-sections -flto
-
-TARGET_LDFLAGS += $(if $(CONFIG_USE_GLIBC),-lrt)
-TARGET_LDFLAGS += -flto
+TARGET_CFLAGS += $(FPIC)
 
 CONFIGURE_ARGS += \
 	--disable-testio-debug \
@@ -158,6 +156,10 @@ CONFIGURE_ARGS += \
 	--disable-rpath		\
 	--disable-fuse2fs
 
+ifneq ($(CONFIG_USE_MUSL),)
+  CONFIGURE_VARS += ac_cv_func_lseek64=yes
+endif
+
 define Build/Prepare
 	$(call Build/Prepare/Default)
 	$(CP) $(SCRIPT_DIR)/config.{guess,sub} $(PKG_BUILD_DIR)/config/
@@ -172,7 +174,6 @@ define Build/Compile
 		V=$(if $(findstring c,$(OPENWRT_VERBOSE)),1,) \
 		subst
 	+$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \
-		LDFLAGS=-Wl,--gc-sections \
 		BUILDCC="$(HOSTCC)" \
 		DESTDIR="$(PKG_INSTALL_DIR)" \
 		ELF_OTHER_LIBS="$(TARGET_LDFLAGS) -luuid" \
diff --git a/package/utils/f2fs-tools/Makefile b/package/utils/f2fs-tools/Makefile
index 99d402af6ca552..27a6fd2248ea0d 100644
--- a/package/utils/f2fs-tools/Makefile
+++ b/package/utils/f2fs-tools/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=f2fs-tools
-PKG_VERSION:=1.15.0
+PKG_VERSION:=1.16.0
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs-tools.git/snapshot/
-PKG_HASH:=147d471040b44900283ce2c935f1d35d13d7f40008e7cb8fab2b69f54da01a4f
+PKG_HASH:=208c7a07e95383fbd7b466b5681590789dcb41f41bf197369c41a95383b57c5e
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=GPL-2.0-only
@@ -111,6 +111,10 @@ endif
 CONFIGURE_VARS += \
 	ac_cv_file__git=no
 
+ifneq ($(CONFIG_USE_MUSL),)
+  CONFIGURE_VARS += ac_cv_func_lseek64=yes
+endif
+
 define Package/libf2fs/install
 	$(INSTALL_DIR) $(1)/usr/lib
 	$(CP) \
@@ -139,7 +143,6 @@ Package/f2fsck-selinux/install = $(Package/f2fsck/install)
 
 define Package/f2fs-tools/install
 	$(INSTALL_DIR) $(1)/usr/sbin
-	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/f2fstat $(1)/usr/sbin
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/fibmap.f2fs $(1)/usr/sbin
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/parse.f2fs $(1)/usr/sbin
 endef
diff --git a/package/utils/firmware-utils/Makefile b/package/utils/firmware-utils/Makefile
new file mode 100644
index 00000000000000..1316fa5c6b1803
--- /dev/null
+++ b/package/utils/firmware-utils/Makefile
@@ -0,0 +1,41 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=firmware-utils
+PKG_RELEASE:=2
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL=$(PROJECT_GIT)/project/firmware-utils.git
+PKG_SOURCE_DATE:=2023-05-18
+PKG_SOURCE_VERSION:=02cdbc6a4d61605c008efef09162f772f553fcde
+PKG_MIRROR_HASH:=f5188fc38bb03ddbcc34763ff049597e2d8af98c0854910dc87f10e5927096e2
+
+PKG_BUILD_DEPENDS:=openssl zlib
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/cmake.mk
+
+define Package/default
+  SECTION:=utils
+  CATEGORY:=Base system
+  TITLE:=Firmware utility $(1)
+  DEPENDS:=$(2)
+endef
+
+Package/oseama = $(call Package/default,oseama,@TARGET_bcm53xx)
+
+define Package/oseama/install
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/oseama $(1)/usr/bin/
+endef
+
+Package/otrx = $(call Package/default,otrx,@(TARGET_bcm47xx||TARGET_bcm53xx))
+
+define Package/otrx/install
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/otrx $(1)/usr/bin/
+endef
+
+$(eval $(call BuildPackage,oseama))
+$(eval $(call BuildPackage,otrx))
diff --git a/package/utils/fritz-tools/Makefile b/package/utils/fritz-tools/Makefile
index a4d69bdf719a81..6e20b56ff8a7ca 100644
--- a/package/utils/fritz-tools/Makefile
+++ b/package/utils/fritz-tools/Makefile
@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=fritz-tools
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 CMAKE_INSTALL:=1
 
 include $(INCLUDE_DIR)/package.mk
diff --git a/package/utils/fritz-tools/src/fritz_cal_extract.c b/package/utils/fritz-tools/src/fritz_cal_extract.c
index 8156dfd1a79cab..2978d86e0cc48e 100644
--- a/package/utils/fritz-tools/src/fritz_cal_extract.c
+++ b/package/utils/fritz-tools/src/fritz_cal_extract.c
@@ -210,7 +210,7 @@ int main(int argc, char **argv)
 	if (argc > 1 && optind <= argc) {
 		in = fopen(argv[optind], "r");
 		if (!in) {
-			perror("Failed to create output file");
+			perror("Failed to open input file");
 			goto out_bad;
 		}
 	}
@@ -253,7 +253,9 @@ int main(int argc, char **argv)
 	ret = EXIT_FAILURE;
 
 out:
-	fclose(in);
-	fclose(out);
+	if (in)
+		fclose(in);
+	if (out)
+		fclose(out);
 	return ret;
 }
diff --git a/package/utils/fritz-tools/src/fritz_tffs_nand_read.c b/package/utils/fritz-tools/src/fritz_tffs_nand_read.c
index 22b27336f89df0..05179bb423bbee 100644
--- a/package/utils/fritz-tools/src/fritz_tffs_nand_read.c
+++ b/package/utils/fritz-tools/src/fritz_tffs_nand_read.c
@@ -73,21 +73,18 @@ static uint8_t readbuf[TFFS_SECTOR_SIZE];
 static uint8_t oobbuf[TFFS_SECTOR_OOB_SIZE];
 static uint32_t blocksize;
 static int mtdfd;
-struct tffs_sectors *sectors;
-
-struct tffs_sectors {
-	uint32_t num_sectors;
-	uint8_t sectors[0];
-};
+static uint32_t num_sectors;
+static uint8_t *sectors;
+static uint32_t *sector_ids;
 
 static inline void sector_mark_bad(int num)
 {
-	sectors->sectors[num / 8] &= ~(0x80 >> (num % 8));
+	sectors[num / 8] &= ~(0x80 >> (num % 8));
 };
 
 static inline uint8_t sector_get_good(int num)
 {
-	return sectors->sectors[num / 8] & 0x80 >> (num % 8);
+	return sectors[num / 8] & 0x80 >> (num % 8);
 };
 
 struct tffs_entry_segment {
@@ -139,6 +136,8 @@ static int read_sector(off_t pos)
 		return -1;
 	}
 
+	sector_ids[pos / TFFS_SECTOR_SIZE] = read_uint32(readbuf, 0x00);
+
 	return 0;
 }
 
@@ -176,25 +175,39 @@ static int find_entry(uint32_t id, struct tffs_entry *entry)
 
 	off_t pos = 0;
 	uint8_t block_end = 0;
-	for (uint32_t sector = 0; sector < sectors->num_sectors; sector++, pos += TFFS_SECTOR_SIZE) {
+	for (uint32_t sector = 0; sector < num_sectors; sector++, pos += TFFS_SECTOR_SIZE) {
 		if (block_end) {
 			if (pos % blocksize == 0) {
 				block_end = 0;
 			}
 		} else if (sector_get_good(sector)) {
+			if (sector_ids[sector]) {
+				if (sector_ids[sector] == TFFS_ID_END) {
+					/* no more entries in this block */
+					block_end = 1;
+					continue;
+				}
+
+				if (sector_ids[sector] != id)
+					continue;
+			}
+
 			if (read_sectoroob(pos) || read_sector(pos)) {
 				fprintf(stderr, "ERROR: sector isn't readable, but has been previously!\n");
 				exit(EXIT_FAILURE);
 			}
-			uint32_t oob_id = read_uint32(oobbuf, 0x02);
-			uint32_t oob_len = read_uint32(oobbuf, 0x06);
-			uint32_t oob_rev = read_uint32(oobbuf, 0x0a);
 			uint32_t read_id = read_uint32(readbuf, 0x00);
 			uint32_t read_len = read_uint32(readbuf, 0x04);
 			uint32_t read_rev = read_uint32(readbuf, 0x0c);
-			if (read_oob_sector_health && (oob_id != read_id || oob_len != read_len || oob_rev != read_rev)) {
-				fprintf(stderr, "Warning: sector has inconsistent metadata\n");
-				continue;
+			if (read_oob_sector_health) {
+				uint32_t oob_id = read_uint32(oobbuf, 0x02);
+				uint32_t oob_len = read_uint32(oobbuf, 0x06);
+				uint32_t oob_rev = read_uint32(oobbuf, 0x0a);
+
+				if (oob_id != read_id || oob_len != read_len || oob_rev != read_rev) {
+					fprintf(stderr, "Warning: sector has inconsistent metadata\n");
+					continue;
+				}
 			}
 			if (read_id == TFFS_ID_END) {
 				/* no more entries in this block */
@@ -414,13 +427,14 @@ static int scan_mtd(void)
 
 	blocksize = info.erasesize;
 
-	sectors = malloc(sizeof(*sectors) + (info.size / TFFS_SECTOR_SIZE + 7) / 8);
-	if (sectors == NULL) {
+	num_sectors = info.size / TFFS_SECTOR_SIZE;
+	sectors = malloc((num_sectors + 7) / 8);
+	sector_ids = calloc(num_sectors, sizeof(uint32_t));
+	if (!sectors || !sector_ids) {
 		fprintf(stderr, "ERROR: memory allocation failed!\n");
 		exit(EXIT_FAILURE);
 	}
-	sectors->num_sectors = info.size / TFFS_SECTOR_SIZE;
-	memset(sectors->sectors, 0xff, (info.size / TFFS_SECTOR_SIZE + 7) / 8);
+	memset(sectors, 0xff, (num_sectors + 7) / 8);
 
 	uint32_t sector = 0, valid_blocks = 0;
 	uint8_t block_ok = 0;
@@ -564,6 +578,7 @@ int main(int argc, char *argv[])
 out_free_entry:
 	free(name_table.val);
 out_free_sectors:
+	free(sector_ids);
 	free(sectors);
 out_close:
 	close(mtdfd);
diff --git a/package/utils/lua/Makefile b/package/utils/lua/Makefile
index 279759e972d85b..e4d2fd1c500069 100644
--- a/package/utils/lua/Makefile
+++ b/package/utils/lua/Makefile
@@ -12,8 +12,8 @@ PKG_VERSION:=5.1.5
 PKG_RELEASE:=10
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=http://www.lua.org/ftp/ \
-	http://www.tecgraf.puc-rio.br/lua/ftp/
+PKG_SOURCE_URL:=https://www.lua.org/ftp/ \
+	https://www.tecgraf.puc-rio.br/lua/ftp/
 PKG_HASH:=2640fc56a795f29d28ef15e13c34a47e223960b0240e8cb0a82d9b0738695333
 PKG_BUILD_PARALLEL:=1
 
@@ -30,7 +30,7 @@ define Package/lua/Default
   SECTION:=lang
   CATEGORY:=Languages
   TITLE:=Lua programming language
-  URL:=http://www.lua.org/
+  URL:=https://www.lua.org/
   MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 endef
 
@@ -99,7 +99,7 @@ define Build/Compile
 		RANLIB="$(TARGET_CROSS)ranlib" \
 		INSTALL_ROOT=/usr \
 		CFLAGS="$(TARGET_CPPFLAGS) $(TARGET_CFLAGS)" \
-		MYLDFLAGS="$(TARGET_LDFLAGS) $(if $(CONFIG_USE_GLIBC),-lm -ldl)" \
+		MYLDFLAGS="$(TARGET_LDFLAGS)" \
 		PKG_VERSION=$(PKG_VERSION) \
 		linux
 	rm -rf $(PKG_INSTALL_DIR)
diff --git a/package/utils/lua5.3/Makefile b/package/utils/lua5.3/Makefile
index 19f3b4dfdad3de..9a707fbbab2a07 100644
--- a/package/utils/lua5.3/Makefile
+++ b/package/utils/lua5.3/Makefile
@@ -12,8 +12,8 @@ PKG_VERSION:=5.3.5
 PKG_RELEASE:=5
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=http://www.lua.org/ftp/ \
-	http://www.tecgraf.puc-rio.br/lua/ftp/
+PKG_SOURCE_URL:=https://www.lua.org/ftp/ \
+	https://www.tecgraf.puc-rio.br/lua/ftp/
 PKG_HASH:=0c2eed3f960446e1a3e4b9a1ca2f3ff893b6ce41942cf54d5dd59ab4b3b058ac
 PKG_BUILD_PARALLEL:=1
 
@@ -30,7 +30,7 @@ define Package/lua5.3/Default
   SECTION:=lang
   CATEGORY:=Languages
   TITLE:=Lua programming language
-  URL:=http://www.lua.org/
+  URL:=https://www.lua.org/
   MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 endef
 
diff --git a/package/utils/mdadm/Makefile b/package/utils/mdadm/Makefile
index 553728194ec44e..8070003394f80d 100644
--- a/package/utils/mdadm/Makefile
+++ b/package/utils/mdadm/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mdadm
 PKG_VERSION:=4.2
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/linux/utils/raid/mdadm
@@ -19,6 +19,7 @@ PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_CPE_ID:=cpe:/a:mdadm_project:mdadm
 
 PKG_BUILD_PARALLEL:=1
+PKG_BUILD_FLAGS:=gc-sections
 
 include $(INCLUDE_DIR)/package.mk
 
@@ -43,18 +44,16 @@ define Package/mdadm/conffiles
 endef
 
 TARGET_CFLAGS += \
-	-ffunction-sections -fdata-sections \
 	-DHAVE_STDINT_H -DNO_COROSYNC -DNO_DLM -DUSE_PTHREADS \
 	-DCONFFILE='\"/var/etc/mdadm.conf\"' \
 	-DMAP_DIR='\"/var/run/mdadm\"' \
 	-DMDMON_DIR='\"/var/run/mdadm\"' \
 	-DFAILED_SLOTS_DIR='\"/var/run/mdadm/failed-slots\"' \
-	-DNO_LIBUDEV
+	-DNO_LIBUDEV \
+	-D_LARGEFILE64_SOURCE
 
 TARGET_CXFLAGS = -DNO_LIBUDEV
 
-TARGET_LDFLAGS += -Wl,--gc-sections
-
 MAKE_FLAGS += \
 		CHECK_RUN_DIR=0 \
 		CXFLAGS="$(TARGET_CXFLAGS)"
diff --git a/package/utils/mtd-utils/Makefile b/package/utils/mtd-utils/Makefile
index 2f54b3ad0d036e..bd53e071d5f6af 100644
--- a/package/utils/mtd-utils/Makefile
+++ b/package/utils/mtd-utils/Makefile
@@ -8,17 +8,18 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mtd-utils
-PKG_VERSION:=2.1.4
+PKG_VERSION:=2.1.5
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://infraroot.at/pub/mtd/
-PKG_HASH:=2c6711d15d282c47cb3867b6857340597e26d332c238465134c602e5eef71b99
+PKG_HASH:=386e27fd121699b6b729bc2e8e04dda987b31cca6b16e12fb6cc6dcf26449f46
 
 PKG_INSTALL:=1
 PKG_FIXUP:=autoreconf
 
 PKG_FLAGS:=nonshared
+PKG_BUILD_FLAGS:=gc-sections
 
 PKG_BUILD_DEPENDS:=util-linux
 
@@ -64,9 +65,6 @@ CONFIGURE_ARGS += \
 	--without-zstd \
 	--without-lzo
 
-TARGET_CFLAGS += -ffunction-sections -fdata-sections
-TARGET_LDFLAGS += -Wl,--gc-sections
-
 define Package/ubi-utils/install
 	$(INSTALL_DIR) $(1)/usr/sbin
 	$(INSTALL_BIN) \
diff --git a/package/utils/mtd-utils/patches/130-lzma_jffs2.patch b/package/utils/mtd-utils/patches/130-lzma_jffs2.patch
index 55930ddc861ccd..db683063d58950 100644
--- a/package/utils/mtd-utils/patches/130-lzma_jffs2.patch
+++ b/package/utils/mtd-utils/patches/130-lzma_jffs2.patch
@@ -5020,7 +5020,7 @@
 +}
 --- a/jffsX-utils/mkfs.jffs2.c
 +++ b/jffsX-utils/mkfs.jffs2.c
-@@ -1667,11 +1667,11 @@ int main(int argc, char **argv)
+@@ -1668,11 +1668,11 @@ int main(int argc, char **argv)
  						  }
  						  erase_block_size *= units;
  
diff --git a/package/utils/policycoreutils/Makefile b/package/utils/policycoreutils/Makefile
index f724deda977533..f5027c5ece03ad 100644
--- a/package/utils/policycoreutils/Makefile
+++ b/package/utils/policycoreutils/Makefile
@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=policycoreutils
-PKG_VERSION:=3.3
+PKG_VERSION:=3.5
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/$(PKG_VERSION)
-PKG_HASH:=4199040ced8a81f2ddd0522b4faf2aba62fc821473f4051dc8474fb1c4a01078
+PKG_HASH:=78453e1529fbbf800e88860094d555e781ce1fba11a7ef77b5aabb43e1173276
 PKG_INSTALL:=1
 HOST_BUILD_DEPENDS:=libsemanage/host gettext-full/host
 PKG_BUILD_DEPENDS:=BUSYBOX_CONFIG_PAM:libpam gettext-full/host
diff --git a/package/utils/px5g-mbedtls/Makefile b/package/utils/px5g-mbedtls/Makefile
index 42ffd39ce327eb..6de5e55d0666c0 100644
--- a/package/utils/px5g-mbedtls/Makefile
+++ b/package/utils/px5g-mbedtls/Makefile
@@ -11,7 +11,7 @@ PKG_NAME:=px5g-mbedtls
 PKG_RELEASE:=9
 PKG_LICENSE:=LGPL-2.1
 
-PKG_USE_MIPS16:=0
+PKG_BUILD_FLAGS:=no-mips16
 
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 
diff --git a/package/utils/px5g-mbedtls/px5g-mbedtls.c b/package/utils/px5g-mbedtls/px5g-mbedtls.c
index 0b72154509a8c8..4e0a73ab0a7034 100644
--- a/package/utils/px5g-mbedtls/px5g-mbedtls.c
+++ b/package/utils/px5g-mbedtls/px5g-mbedtls.c
@@ -20,6 +20,7 @@
  */
 
 #include <sys/types.h>
+#include <sys/random.h>
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -31,6 +32,7 @@
 #include <stdbool.h>
 
 #include <mbedtls/bignum.h>
+#include <mbedtls/entropy.h>
 #include <mbedtls/x509_crt.h>
 #include <mbedtls/ecp.h>
 #include <mbedtls/rsa.h>
@@ -40,12 +42,16 @@
 #define PX5G_COPY "Copyright (c) 2009 Steven Barth <steven@midlink.org>"
 #define PX5G_LICENSE "Licensed under the GNU Lesser General Public License v2.1"
 
-static int urandom_fd;
 static char buf[16384];
 
 static int _urandom(void *ctx, unsigned char *out, size_t len)
 {
-	read(urandom_fd, out, len);
+	ssize_t ret;
+
+	ret = getrandom(out, len, 0);
+	if (ret < 0 || (size_t)ret != len)
+		return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
+
 	return 0;
 }
 
@@ -306,8 +312,6 @@ int selfsigned(char **arg)
 
 int main(int argc, char *argv[])
 {
-	urandom_fd = open("/dev/urandom", O_RDONLY);
-
 	if (!argv[1]) {
 		//Usage
 	} else if (!strcmp(argv[1], "eckey")) {
diff --git a/package/utils/px5g-wolfssl/Makefile b/package/utils/px5g-wolfssl/Makefile
index 95517c5c00b26b..843f03fcc11391 100644
--- a/package/utils/px5g-wolfssl/Makefile
+++ b/package/utils/px5g-wolfssl/Makefile
@@ -5,10 +5,10 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=px5g-wolfssl
-PKG_RELEASE:=$(COMMITCOUNT)
+PKG_RELEASE:=8.2
 PKG_LICENSE:=GPL-2.0-or-later
 
-PKG_USE_MIPS16:=0
+PKG_BUILD_FLAGS:=no-mips16
 
 PKG_MAINTAINER:=Paul Spooren <mail@aparcar.org>
 
diff --git a/package/utils/secilc/Makefile b/package/utils/secilc/Makefile
index 6f059bfc81ee1d..5469039e22852e 100644
--- a/package/utils/secilc/Makefile
+++ b/package/utils/secilc/Makefile
@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=secilc
-PKG_VERSION:=3.3
+PKG_VERSION:=3.5
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/$(PKG_VERSION)
-PKG_HASH:=2c5e1a5d417baf1d2aa3eac294e12c3aac7184a5ef6a779dcbe469ed756e8651
+PKG_HASH:=3eebc5a1f97847fa530cf90654b9f3b8f21a13c9ea3d07495325651580cd3373
 HOST_BUILD_DEPENDS:=libsepol/host
 
 PKG_MAINTAINER:=Dominick Grift <dominick.grift@defensec.nl>
diff --git a/package/utils/ucode-mod-bpf/Makefile b/package/utils/ucode-mod-bpf/Makefile
new file mode 100644
index 00000000000000..a748b9dbbd0df6
--- /dev/null
+++ b/package/utils/ucode-mod-bpf/Makefile
@@ -0,0 +1,40 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=ucode-mod-bpf
+PKG_RELEASE:=1
+PKG_LICENSE:=ISC
+PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/nls.mk
+
+define Package/ucode-mod-bpf
+  SECTION:=utils
+  CATEGORY:=Utilities
+  TITLE:=ucode eBPF module
+  DEPENDS:=+libucode +libbpf
+endef
+
+define Package/ucode-mod-bpf/description
+The bpf plugin provides functionality for loading and interacting with
+eBPF modules.
+
+It allows loading full modules and pinned maps/programs and supports
+interacting with maps and attaching programs as tc classifiers.
+endef
+
+define Package/ucode-mod-bpf/install
+	$(INSTALL_DIR) $(1)/usr/lib/ucode
+	$(CP) $(PKG_BUILD_DIR)/bpf.so $(1)/usr/lib/ucode/
+endef
+
+define Build/Configure
+endef
+
+define Build/Compile
+	$(TARGET_CC) $(TARGET_CFLAGS) $(TARGET_LDFLAGS) $(FPIC) \
+		-Wall -ffunction-sections -Wl,--gc-sections -shared -Wl,--no-as-needed -lbpf \
+		-o $(PKG_BUILD_DIR)/bpf.so $(PKG_BUILD_DIR)/bpf.c
+endef
+
+$(eval $(call BuildPackage,ucode-mod-bpf))
diff --git a/package/utils/ucode-mod-bpf/src/bpf.c b/package/utils/ucode-mod-bpf/src/bpf.c
new file mode 100644
index 00000000000000..415215e54e1a5c
--- /dev/null
+++ b/package/utils/ucode-mod-bpf/src/bpf.c
@@ -0,0 +1,814 @@
+#include <sys/resource.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <net/if.h>
+
+#include <stdint.h>
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+
+#include <bpf/bpf.h>
+#include <bpf/libbpf.h>
+
+#include "ucode/module.h"
+
+#define err_return_int(err, ...) do { set_error(err, __VA_ARGS__); return -1; } while(0)
+#define err_return(err, ...) do { set_error(err, __VA_ARGS__); return NULL; } while(0)
+#define TRUE ucv_boolean_new(true)
+
+static uc_resource_type_t *module_type, *map_type, *map_iter_type, *program_type;
+static uc_value_t *registry;
+static uc_vm_t *debug_vm;
+
+static struct {
+	int code;
+	char *msg;
+} last_error;
+
+struct uc_bpf_fd {
+	int fd;
+	bool close;
+};
+
+struct uc_bpf_map {
+	struct uc_bpf_fd fd; /* must be first */
+	unsigned int key_size, val_size;
+};
+
+struct uc_bpf_map_iter {
+	int fd;
+	unsigned int key_size;
+	bool has_next;
+	uint8_t key[];
+};
+
+__attribute__((format(printf, 2, 3))) static void
+set_error(int errcode, const char *fmt, ...)
+{
+	va_list ap;
+
+	free(last_error.msg);
+
+	last_error.code = errcode;
+	last_error.msg = NULL;
+
+	if (fmt) {
+		va_start(ap, fmt);
+		xvasprintf(&last_error.msg, fmt, ap);
+		va_end(ap);
+	}
+}
+
+static void init_env(void)
+{
+	static bool init_done = false;
+	struct rlimit limit = {
+		.rlim_cur = RLIM_INFINITY,
+		.rlim_max = RLIM_INFINITY,
+	};
+
+	if (init_done)
+		return;
+
+	setrlimit(RLIMIT_MEMLOCK, &limit);
+	init_done = true;
+}
+
+static uc_value_t *
+uc_bpf_error(uc_vm_t *vm, size_t nargs)
+{
+	uc_value_t *numeric = uc_fn_arg(0);
+	const char *msg = last_error.msg;
+	int code = last_error.code;
+	uc_stringbuf_t *buf;
+	const char *s;
+
+	if (last_error.code == 0)
+		return NULL;
+
+	set_error(0, NULL);
+
+	if (ucv_is_truish(numeric))
+		return ucv_int64_new(code);
+
+	buf = ucv_stringbuf_new();
+	if (code < 0 && msg) {
+		ucv_stringbuf_addstr(buf, msg, strlen(msg));
+	} else {
+		s = strerror(code);
+		ucv_stringbuf_addstr(buf, s, strlen(s));
+		if (msg)
+			ucv_stringbuf_printf(buf, ": %s", msg);
+	}
+
+	return ucv_stringbuf_finish(buf);
+}
+
+static int
+uc_bpf_module_set_opts(struct bpf_object *obj, uc_value_t *opts)
+{
+	uc_value_t *val;
+
+	if (!opts)
+		return 0;
+
+	if (ucv_type(opts) != UC_OBJECT)
+		err_return_int(EINVAL, "options argument");
+
+	if ((val = ucv_object_get(opts, "rodata", NULL)) != NULL) {
+		struct bpf_map *map = NULL;
+
+		if (ucv_type(val) != UC_STRING)
+			err_return_int(EINVAL, "rodata type");
+
+		while ((map = bpf_object__next_map(obj, map)) != NULL) {
+			if (!strstr(bpf_map__name(map), ".rodata"))
+				continue;
+
+			break;
+		}
+
+		if (!map)
+			err_return_int(errno, "rodata map");
+
+		if (bpf_map__set_initial_value(map, ucv_string_get(val),
+					       ucv_string_length(val)))
+			err_return_int(errno, "rodata");
+	}
+
+	if ((val = ucv_object_get(opts, "program-type", NULL)) != NULL) {
+		if (ucv_type(val) != UC_OBJECT)
+			err_return_int(EINVAL, "prog_types argument");
+
+		ucv_object_foreach(val, name, type) {
+			struct bpf_program *prog;
+
+			if (ucv_type(type) != UC_INTEGER)
+				err_return_int(EINVAL, "program %s type", name);
+
+			prog = bpf_object__find_program_by_name(obj, name);
+			if (!prog)
+				err_return_int(-1, "program %s not found", name);
+
+			bpf_program__set_type(prog, ucv_int64_get(type));
+		}
+	}
+
+	return 0;
+}
+
+static uc_value_t *
+uc_bpf_open_module(uc_vm_t *vm, size_t nargs)
+{
+	DECLARE_LIBBPF_OPTS(bpf_object_open_opts, bpf_opts);
+	uc_value_t *path = uc_fn_arg(0);
+	uc_value_t *opts = uc_fn_arg(1);
+	struct bpf_object *obj;
+
+	if (ucv_type(path) != UC_STRING)
+		err_return(EINVAL, "module path");
+
+	init_env();
+	obj = bpf_object__open_file(ucv_string_get(path), &bpf_opts);
+	if (libbpf_get_error(obj))
+		err_return(errno, NULL);
+
+	if (uc_bpf_module_set_opts(obj, opts)) {
+		bpf_object__close(obj);
+		return NULL;
+	}
+
+	if (bpf_object__load(obj)) {
+		bpf_object__close(obj);
+		err_return(errno, NULL);
+	}
+
+	return uc_resource_new(module_type, obj);
+}
+
+static uc_value_t *
+uc_bpf_map_create(int fd, unsigned int key_size, unsigned int val_size, bool close)
+{
+	struct uc_bpf_map *uc_map;
+
+	uc_map = xalloc(sizeof(*uc_map));
+	uc_map->fd.fd = fd;
+	uc_map->key_size = key_size;
+	uc_map->val_size = val_size;
+	uc_map->fd.close = close;
+
+	return uc_resource_new(map_type, uc_map);
+}
+
+static uc_value_t *
+uc_bpf_open_map(uc_vm_t *vm, size_t nargs)
+{
+	struct bpf_map_info info;
+	uc_value_t *path = uc_fn_arg(0);
+	__u32 len = sizeof(info);
+	int err;
+	int fd;
+
+	if (ucv_type(path) != UC_STRING)
+		err_return(EINVAL, "module path");
+
+	fd = bpf_obj_get(ucv_string_get(path));
+	if (fd < 0)
+		err_return(errno, NULL);
+
+	err = bpf_obj_get_info_by_fd(fd, &info, &len);
+	if (err) {
+		close(fd);
+		err_return(errno, NULL);
+	}
+
+	return uc_bpf_map_create(fd, info.key_size, info.value_size, true);
+}
+
+static uc_value_t *
+uc_bpf_open_program(uc_vm_t *vm, size_t nargs)
+{
+	uc_value_t *path = uc_fn_arg(0);
+	struct uc_bpf_fd *f;
+	int fd;
+
+	if (ucv_type(path) != UC_STRING)
+		err_return(EINVAL, "module path");
+
+	fd = bpf_obj_get(ucv_string_get(path));
+	if (fd < 0)
+		err_return(errno, NULL);
+
+	f = xalloc(sizeof(*f));
+	f->fd = fd;
+	f->close = true;
+
+	return uc_resource_new(program_type, f);
+}
+
+static uc_value_t *
+uc_bpf_module_get_maps(uc_vm_t *vm, size_t nargs)
+{
+	struct bpf_object *obj = uc_fn_thisval("bpf.module");
+	struct bpf_map *map = NULL;
+	uc_value_t *rv;
+	int i = 0;
+
+	if (!obj)
+		err_return(EINVAL, NULL);
+
+	rv = ucv_array_new(vm);
+	bpf_object__for_each_map(map, obj)
+		ucv_array_set(rv, i++, ucv_string_new(bpf_map__name(map)));
+
+	return rv;
+}
+
+static uc_value_t *
+uc_bpf_module_get_map(uc_vm_t *vm, size_t nargs)
+{
+	struct bpf_object *obj = uc_fn_thisval("bpf.module");
+	struct bpf_map *map;
+	uc_value_t *name = uc_fn_arg(0);
+	int fd;
+
+	if (!obj || ucv_type(name) != UC_STRING)
+		err_return(EINVAL, NULL);
+
+	map = bpf_object__find_map_by_name(obj, ucv_string_get(name));
+	if (!map)
+		err_return(errno, NULL);
+
+	fd = bpf_map__fd(map);
+	if (fd < 0)
+		err_return(EINVAL, NULL);
+
+	return uc_bpf_map_create(fd, bpf_map__key_size(map), bpf_map__value_size(map), false);
+}
+
+static uc_value_t *
+uc_bpf_module_get_programs(uc_vm_t *vm, size_t nargs)
+{
+	struct bpf_object *obj = uc_fn_thisval("bpf.module");
+	struct bpf_program *prog = NULL;
+	uc_value_t *rv;
+	int i = 0;
+
+	if (!obj)
+		err_return(EINVAL, NULL);
+
+	rv = ucv_array_new(vm);
+	bpf_object__for_each_program(prog, obj)
+		ucv_array_set(rv, i++, ucv_string_new(bpf_program__name(prog)));
+
+	return rv;
+}
+
+static uc_value_t *
+uc_bpf_module_get_program(uc_vm_t *vm, size_t nargs)
+{
+	struct bpf_object *obj = uc_fn_thisval("bpf.module");
+	struct bpf_program *prog;
+	uc_value_t *name = uc_fn_arg(0);
+	struct uc_bpf_fd *f;
+	int fd;
+
+	if (!obj || !name || ucv_type(name) != UC_STRING)
+		err_return(EINVAL, NULL);
+
+	prog = bpf_object__find_program_by_name(obj, ucv_string_get(name));
+	if (!prog)
+		err_return(errno, NULL);
+
+	fd = bpf_program__fd(prog);
+	if (fd < 0)
+		err_return(EINVAL, NULL);
+
+	f = xalloc(sizeof(*f));
+	f->fd = fd;
+
+	return uc_resource_new(program_type, f);
+}
+
+static void *
+uc_bpf_map_arg(uc_value_t *val, const char *kind, unsigned int size)
+{
+	static union {
+		uint32_t u32;
+		uint64_t u64;
+	} val_int;
+
+	switch (ucv_type(val)) {
+	case UC_INTEGER:
+		if (size == 4)
+			val_int.u32 = ucv_int64_get(val);
+		else if (size == 8)
+			val_int.u64 = ucv_int64_get(val);
+		else
+			break;
+
+		return &val_int;
+	case UC_STRING:
+		if (size != ucv_string_length(val))
+			break;
+
+		return ucv_string_get(val);
+	default:
+		err_return(EINVAL, "%s type", kind);
+	}
+
+	err_return(EINVAL, "%s size mismatch (expected: %d)", kind, size);
+}
+
+static uc_value_t *
+uc_bpf_map_get(uc_vm_t *vm, size_t nargs)
+{
+	struct uc_bpf_map *map = uc_fn_thisval("bpf.map");
+	uc_value_t *a_key = uc_fn_arg(0);
+	void *key, *val;
+
+	if (!map)
+		err_return(EINVAL, NULL);
+
+	key = uc_bpf_map_arg(a_key, "key", map->key_size);
+	if (!key)
+		return NULL;
+
+	val = alloca(map->val_size);
+	if (bpf_map_lookup_elem(map->fd.fd, key, val))
+		return NULL;
+
+	return ucv_string_new_length(val, map->val_size);
+}
+
+static uc_value_t *
+uc_bpf_map_set(uc_vm_t *vm, size_t nargs)
+{
+	struct uc_bpf_map *map = uc_fn_thisval("bpf.map");
+	uc_value_t *a_key = uc_fn_arg(0);
+	uc_value_t *a_val = uc_fn_arg(1);
+	uc_value_t *a_flags = uc_fn_arg(2);
+	uint64_t flags;
+	void *key, *val;
+
+	if (!map)
+		err_return(EINVAL, NULL);
+
+	key = uc_bpf_map_arg(a_key, "key", map->key_size);
+	if (!key)
+		return NULL;
+
+	val = uc_bpf_map_arg(a_val, "value", map->val_size);
+	if (!val)
+		return NULL;
+
+	if (!a_flags)
+		flags = BPF_ANY;
+	else if (ucv_type(a_flags) != UC_INTEGER)
+		err_return(EINVAL, "flags");
+	else
+		flags = ucv_int64_get(a_flags);
+
+	if (bpf_map_update_elem(map->fd.fd, key, val, flags))
+		return NULL;
+
+	return ucv_string_new_length(val, map->val_size);
+}
+
+static uc_value_t *
+uc_bpf_map_delete(uc_vm_t *vm, size_t nargs)
+{
+	struct uc_bpf_map *map = uc_fn_thisval("bpf.map");
+	uc_value_t *a_key = uc_fn_arg(0);
+	uc_value_t *a_return = uc_fn_arg(1);
+	void *key, *val = NULL;
+	int ret;
+
+	if (!map)
+		err_return(EINVAL, NULL);
+
+	key = uc_bpf_map_arg(a_key, "key", map->key_size);
+	if (!key)
+		return NULL;
+
+	if (!ucv_is_truish(a_return)) {
+		ret = bpf_map_delete_elem(map->fd.fd, key);
+
+		return ucv_boolean_new(ret == 0);
+	}
+
+	val = alloca(map->val_size);
+	if (bpf_map_lookup_and_delete_elem(map->fd.fd, key, val))
+		return NULL;
+
+	return ucv_string_new_length(val, map->val_size);
+}
+
+static uc_value_t *
+uc_bpf_map_delete_all(uc_vm_t *vm, size_t nargs)
+{
+	struct uc_bpf_map *map = uc_fn_thisval("bpf.map");
+	uc_value_t *filter = uc_fn_arg(0);
+	bool has_next;
+	void *key, *next;
+
+	if (!map)
+		err_return(EINVAL, NULL);
+
+	key = alloca(map->key_size);
+	next = alloca(map->key_size);
+	has_next = !bpf_map_get_next_key(map->fd.fd, NULL, next);
+	while (has_next) {
+		bool skip = false;
+
+		memcpy(key, next, map->key_size);
+		has_next = !bpf_map_get_next_key(map->fd.fd, next, next);
+
+		if (ucv_is_callable(filter)) {
+			uc_value_t *rv;
+
+			uc_value_push(ucv_get(filter));
+			uc_value_push(ucv_string_new_length((const char *)key, map->key_size));
+			if (uc_call(1) != EXCEPTION_NONE)
+				break;
+
+			rv = uc_vm_stack_pop(vm);
+			if (!rv)
+				break;
+
+			skip = !ucv_is_truish(rv);
+			ucv_put(rv);
+		}
+
+		if (!skip)
+			bpf_map_delete_elem(map->fd.fd, key);
+	}
+
+	return TRUE;
+}
+
+static uc_value_t *
+uc_bpf_map_iterator(uc_vm_t *vm, size_t nargs)
+{
+	struct uc_bpf_map *map = uc_fn_thisval("bpf.map");
+	struct uc_bpf_map_iter *iter;
+
+	if (!map)
+		err_return(EINVAL, NULL);
+
+	iter = xalloc(sizeof(*iter) + map->key_size);
+	iter->fd = map->fd.fd;
+	iter->key_size = map->key_size;
+	iter->has_next = !bpf_map_get_next_key(iter->fd, NULL, &iter->key);
+
+	return uc_resource_new(map_iter_type, iter);
+}
+
+static uc_value_t *
+uc_bpf_map_iter_next(uc_vm_t *vm, size_t nargs)
+{
+	struct uc_bpf_map_iter *iter = uc_fn_thisval("bpf.map_iter");
+	uc_value_t *rv;
+
+	if (!iter->has_next)
+		return NULL;
+
+	rv = ucv_string_new_length((const char *)iter->key, iter->key_size);
+	iter->has_next = !bpf_map_get_next_key(iter->fd, &iter->key, &iter->key);
+
+	return rv;
+}
+
+static uc_value_t *
+uc_bpf_map_iter_next_int(uc_vm_t *vm, size_t nargs)
+{
+	struct uc_bpf_map_iter *iter = uc_fn_thisval("bpf.map_iter");
+	uint64_t intval;
+	uc_value_t *rv;
+
+	if (!iter->has_next)
+		return NULL;
+
+	if (iter->key_size == 4)
+		intval = *(uint32_t *)iter->key;
+	else if (iter->key_size == 8)
+		intval = *(uint64_t *)iter->key;
+	else
+		return NULL;
+
+	rv = ucv_int64_new(intval);
+	iter->has_next = !bpf_map_get_next_key(iter->fd, &iter->key, &iter->key);
+
+	return rv;
+}
+
+static uc_value_t *
+uc_bpf_map_foreach(uc_vm_t *vm, size_t nargs)
+{
+	struct uc_bpf_map *map = uc_fn_thisval("bpf.map");
+	uc_value_t *func = uc_fn_arg(0);
+	bool has_next;
+	void *key, *next;
+	bool ret = false;
+
+	key = alloca(map->key_size);
+	next = alloca(map->key_size);
+	has_next = !bpf_map_get_next_key(map->fd.fd, NULL, next);
+
+	while (has_next) {
+		uc_value_t *rv;
+		bool stop;
+
+		memcpy(key, next, map->key_size);
+		has_next = !bpf_map_get_next_key(map->fd.fd, next, next);
+
+		uc_value_push(ucv_get(func));
+		uc_value_push(ucv_string_new_length((const char *)key, map->key_size));
+
+		if (uc_call(1) != EXCEPTION_NONE)
+			break;
+
+		rv = uc_vm_stack_pop(vm);
+		stop = (ucv_type(rv) == UC_BOOLEAN && !ucv_boolean_get(rv));
+		ucv_put(rv);
+
+		if (stop)
+			break;
+
+		ret = true;
+	}
+
+	return ucv_boolean_new(ret);
+}
+
+static uc_value_t *
+uc_bpf_obj_pin(uc_vm_t *vm, size_t nargs, const char *type)
+{
+	struct uc_bpf_fd *f = uc_fn_thisval(type);
+	uc_value_t *path = uc_fn_arg(0);
+
+	if (ucv_type(path) != UC_STRING)
+		err_return(EINVAL, NULL);
+
+	if (bpf_obj_pin(f->fd, ucv_string_get(path)))
+		err_return(errno, NULL);
+
+	return TRUE;
+}
+
+static uc_value_t *
+uc_bpf_program_pin(uc_vm_t *vm, size_t nargs)
+{
+	return uc_bpf_obj_pin(vm, nargs, "bpf.program");
+}
+
+static uc_value_t *
+uc_bpf_map_pin(uc_vm_t *vm, size_t nargs)
+{
+	return uc_bpf_obj_pin(vm, nargs, "bpf.map");
+}
+
+static uc_value_t *
+uc_bpf_set_tc_hook(uc_value_t *ifname, uc_value_t *type, uc_value_t *prio,
+		   int fd)
+{
+	DECLARE_LIBBPF_OPTS(bpf_tc_hook, hook);
+	DECLARE_LIBBPF_OPTS(bpf_tc_opts, attach_tc,
+			    .handle = 1);
+	const char *type_str;
+	uint64_t prio_val;
+
+	if (ucv_type(ifname) != UC_STRING || ucv_type(type) != UC_STRING ||
+	    ucv_type(prio) != UC_INTEGER)
+		err_return(EINVAL, NULL);
+
+	prio_val = ucv_int64_get(prio);
+	if (prio_val > 0xffff)
+		err_return(EINVAL, NULL);
+
+	type_str = ucv_string_get(type);
+	if (!strcmp(type_str, "ingress"))
+		hook.attach_point = BPF_TC_INGRESS;
+	else if (!strcmp(type_str, "egress"))
+		hook.attach_point = BPF_TC_EGRESS;
+	else
+		err_return(EINVAL, NULL);
+
+	hook.ifindex = if_nametoindex(ucv_string_get(ifname));
+	if (!hook.ifindex)
+		goto error;
+
+	bpf_tc_hook_create(&hook);
+	attach_tc.priority = prio_val;
+	if (bpf_tc_detach(&hook, &attach_tc) < 0 && fd < 0)
+		goto error;
+
+	if (fd < 0)
+		goto out;
+
+	attach_tc.prog_fd = fd;
+	if (bpf_tc_attach(&hook, &attach_tc) < 0)
+		goto error;
+
+out:
+	return TRUE;
+
+error:
+	if (fd >= 0)
+		err_return(ENOENT, NULL);
+	return NULL;
+}
+
+static uc_value_t *
+uc_bpf_program_tc_attach(uc_vm_t *vm, size_t nargs)
+{
+	struct uc_bpf_fd *f = uc_fn_thisval("bpf.program");
+	uc_value_t *ifname = uc_fn_arg(0);
+	uc_value_t *type = uc_fn_arg(1);
+	uc_value_t *prio = uc_fn_arg(2);
+
+	if (!f)
+		err_return(EINVAL, NULL);
+
+	return uc_bpf_set_tc_hook(ifname, type, prio, f->fd);
+}
+
+static uc_value_t *
+uc_bpf_tc_detach(uc_vm_t *vm, size_t nargs)
+{
+	uc_value_t *ifname = uc_fn_arg(0);
+	uc_value_t *type = uc_fn_arg(1);
+	uc_value_t *prio = uc_fn_arg(2);
+
+	return uc_bpf_set_tc_hook(ifname, type, prio, -1);
+}
+
+static int
+uc_bpf_debug_print(enum libbpf_print_level level, const char *format,
+		   va_list args)
+{
+	char buf[256], *str = NULL;
+	uc_value_t *val;
+	va_list ap;
+	int size;
+
+	va_copy(ap, args);
+	size = vsnprintf(buf, sizeof(buf), format, ap);
+	va_end(ap);
+
+	if (size > 0 && (unsigned long)size < ARRAY_SIZE(buf) - 1) {
+		val = ucv_string_new(buf);
+		goto out;
+	}
+
+	if (vasprintf(&str, format, args) < 0)
+		return 0;
+
+	val = ucv_string_new(str);
+	free(str);
+
+out:
+	uc_vm_stack_push(debug_vm, ucv_get(ucv_array_get(registry, 0)));
+	uc_vm_stack_push(debug_vm, ucv_int64_new(level));
+	uc_vm_stack_push(debug_vm, val);
+	if (uc_vm_call(debug_vm, false, 2) == EXCEPTION_NONE)
+		ucv_put(uc_vm_stack_pop(debug_vm));
+
+	return 0;
+}
+
+static uc_value_t *
+uc_bpf_set_debug_handler(uc_vm_t *vm, size_t nargs)
+{
+	uc_value_t *handler = uc_fn_arg(0);
+
+	if (handler && !ucv_is_callable(handler))
+		err_return(EINVAL, NULL);
+
+	debug_vm = vm;
+	libbpf_set_print(handler ? uc_bpf_debug_print : NULL);
+
+	ucv_array_set(registry, 0, ucv_get(handler));
+
+	return NULL;
+}
+
+static void
+register_constants(uc_vm_t *vm, uc_value_t *scope)
+{
+#define ADD_CONST(x) ucv_object_add(scope, #x, ucv_int64_new(x))
+	ADD_CONST(BPF_PROG_TYPE_SCHED_CLS);
+	ADD_CONST(BPF_PROG_TYPE_SCHED_ACT);
+
+	ADD_CONST(BPF_ANY);
+	ADD_CONST(BPF_NOEXIST);
+	ADD_CONST(BPF_EXIST);
+	ADD_CONST(BPF_F_LOCK);
+}
+
+static const uc_function_list_t module_fns[] = {
+	{ "get_map",			uc_bpf_module_get_map },
+	{ "get_maps",			uc_bpf_module_get_maps },
+	{ "get_programs",		uc_bpf_module_get_programs },
+	{ "get_program",		uc_bpf_module_get_program },
+};
+
+static void module_free(void *ptr)
+{
+	struct bpf_object *obj = ptr;
+
+	bpf_object__close(obj);
+}
+
+static const uc_function_list_t map_fns[] = {
+	{ "pin",			uc_bpf_map_pin },
+	{ "get",			uc_bpf_map_get },
+	{ "set",			uc_bpf_map_set },
+	{ "delete",			uc_bpf_map_delete },
+	{ "delete_all",			uc_bpf_map_delete_all },
+	{ "foreach",			uc_bpf_map_foreach },
+	{ "iterator",			uc_bpf_map_iterator },
+};
+
+static void uc_bpf_fd_free(void *ptr)
+{
+	struct uc_bpf_fd *f = ptr;
+
+	if (f->close)
+		close(f->fd);
+	free(f);
+}
+
+static const uc_function_list_t map_iter_fns[] = {
+	{ "next",			uc_bpf_map_iter_next },
+	{ "next_int",			uc_bpf_map_iter_next_int },
+};
+
+static const uc_function_list_t prog_fns[] = {
+	{ "pin",			uc_bpf_program_pin },
+	{ "tc_attach",			uc_bpf_program_tc_attach },
+};
+
+static const uc_function_list_t global_fns[] = {
+	{ "error",			uc_bpf_error },
+	{ "set_debug_handler",		uc_bpf_set_debug_handler },
+	{ "open_module",		uc_bpf_open_module },
+	{ "open_map",			uc_bpf_open_map },
+	{ "open_program",		uc_bpf_open_program },
+	{ "tc_detach",			uc_bpf_tc_detach },
+};
+
+void uc_module_init(uc_vm_t *vm, uc_value_t *scope)
+{
+	uc_function_list_register(scope, global_fns);
+	register_constants(vm, scope);
+
+	registry = ucv_array_new(vm);
+	uc_vm_registry_set(vm, "bpf.registry", registry);
+
+	module_type = uc_type_declare(vm, "bpf.module", module_fns, module_free);
+	map_type = uc_type_declare(vm, "bpf.map", map_fns, uc_bpf_fd_free);
+	map_iter_type = uc_type_declare(vm, "bpf.map_iter", map_iter_fns, free);
+	program_type = uc_type_declare(vm, "bpf.program", prog_fns, uc_bpf_fd_free);
+}
diff --git a/package/utils/ucode/Makefile b/package/utils/ucode/Makefile
index 025f9973870269..e768acbae91fd5 100644
--- a/package/utils/ucode/Makefile
+++ b/package/utils/ucode/Makefile
@@ -12,9 +12,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=https://github.com/jow-/ucode.git
-PKG_SOURCE_DATE:=2022-08-29
-PKG_SOURCE_VERSION:=344fa9e69da43ecdc4d8f7768d85d42639352405
-PKG_MIRROR_HASH:=94e1ae6779536b2bd8957db8c2922ec32dcef75258401707505b1d34b6f16d0b
+PKG_SOURCE_DATE:=2023-04-03
+PKG_SOURCE_VERSION:=5163867269fc04fa01ec5e9f8df3384c933339f2
+PKG_MIRROR_HASH:=e82922ff59d6f899d9434bf79f2e6e4add0b7b0466355755fc83d4b5a0aeebfb
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 PKG_LICENSE:=ISC
 
@@ -39,9 +39,10 @@ CMAKE_HOST_OPTIONS += \
 
 
 define Package/ucode/default
-  SECTION:=utils
-  CATEGORY:=Utilities
-  TITLE:=ucode - Tiny scripting and templating language
+  SUBMENU:=ucode
+  SECTION:=lang
+  CATEGORY:=Languages
+  TITLE:=Tiny scripting and templating language
 endef
 
 define Package/ucode
@@ -57,7 +58,10 @@ endef
 
 define Package/libucode
   $(Package/ucode/default)
-  TITLE+= - runtime library
+  SUBMENU:=
+  SECTION:=libs
+  CATEGORY:=Libraries
+  TITLE+= (library)
   ABI_VERSION:=$(PKG_ABI_VERSION)
   DEPENDS:=+libjson-c
 endef
@@ -92,7 +96,7 @@ endef
 define Package/ucode-mod-nl80211
   $(Package/ucode/default)
   TITLE+= (nl80211 module)
-  DEPENDS:=ucode +libnl-tiny
+  DEPENDS:=ucode +libnl-tiny +libubox
 endef
 
 define Package/ucode-mod-nl80211/description
@@ -114,7 +118,7 @@ endef
 define Package/ucode-mod-rtnl
   $(Package/ucode/default)
   TITLE+= (rtnl module)
-  DEPENDS:=ucode +libnl-tiny
+  DEPENDS:=ucode +libnl-tiny +libubox
 endef
 
 define Package/ucode-mod-rtnl/description
@@ -129,7 +133,7 @@ define Package/ucode-mod-struct
 endef
 
 define Package/ucode-mod-struct/description
- The struct plugin implemnts Python 3 compatible struct.pack/unpack functionality.
+ The struct plugin implements Python 3 compatible struct.pack/unpack functionality.
 endef
 
 
diff --git a/package/utils/uencrypt/Makefile b/package/utils/uencrypt/Makefile
index 9307f97b6e45b2..70ca655b6e858f 100644
--- a/package/utils/uencrypt/Makefile
+++ b/package/utils/uencrypt/Makefile
@@ -4,55 +4,82 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=uencrypt
-PKG_RELEASE:=1
+PKG_RELEASE:=5
 
-PKG_FLAGS:=nonshared
 PKG_LICENSE:=GPL-2.0-or-later
 PKG_MAINTAINER:=Eneas U de Queiroz <cotequeiroz@gmail.com>
-PKG_CONFIG_DEPENDS:=\
-	CONFIG_UENCRYPT_OPENSSL \
-	CONFIG_UENCRYPT_WOLFSSL
 
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/cmake.mk
 
 CMAKE_INSTALL:=1
-CMAKE_OPTIONS+=$(if $(CONFIG_UENCRYPT_WOLFSSL),-DUSE_WOLFSSL=1)
+ifeq ($(BUILD_VARIANT),mbedtls)
+  CMAKE_OPTIONS+=-DUSE_MBEDTLS=1
+else ifeq ($(BUILD_VARIANT),wolfssl)
+  CMAKE_OPTIONS+=-DUSE_WOLFSSL=1
+endif
 
-define Package/uencrypt
+TARGET_CFLAGS+=-Wall
+
+define Package/uencrypt/default
   SECTION:=utils
   CATEGORY:=Base system
-  TITLE:=Decryption utility for Arcadyan WG4xx223 and TP-Link Deco S4
-  DEPENDS:=+UENCRYPT_WOLFSSL:libwolfssl +UENCRYPT_OPENSSL:libopenssl
+  TITLE:=Small Decryption utility
 endef
 
-define Package/uencrypt/description
+define Package/uencrypt/default/description
   This is a small encrypton/decryption program. It defaults
   to AES-128-CBC, but supports any encryption provided by
-  the available openssl/wolfssl library. Even though it can
-  be used for regular encryption and decryption operations,
+  the crypto library. Even though it can be used for
+  non-critical* regular encryption and decryption operations,
   it is included here to unencrypt the configuration from mtd
-  on Arcadyan WG430223/WG443223 and TP-Link Deco S4 routers
+  on some devices.
+
+  * Key and IV are exposed on cmdline
+
+  This variant uses $(1) as crypto provider
+endef
+
+define Package/uencrypt-mbedtls
+  $(Package/uencrypt/default)
+  VARIANT:=mbedtls
+  TITLE+= using mbedTLS
+  DEPENDS:=+libmbedtls
+  CONFLICTS:=uencrypt-openssl uencrypt-wolfssl
 endef
 
-define Package/uencrypt/config
-  if PACKAGE_uencrypt
-    choice
-	prompt "Crypto provider"
-	default UENCRYPT_WOLFSSL
+Package/uencrypt-mbedtls/description= \
+  $(call Package/uencrypt/default/description,mbedTLS)
+
+define Package/uencrypt-openssl
+  $(Package/uencrypt/default)
+  VARIANT:=openssl
+  TITLE+= using OpenSSL
+  DEPENDS:=+libopenssl
+  CONFLICTS:=uencrypt-wolfssl
+endef
 
-	config UENCRYPT_OPENSSL
-	bool "OpenSSL"
+Package/uencrypt-openssl/description= \
+  $(call Package/uencrypt/default/description,OpenSSL)
 
-	config UENCRYPT_WOLFSSL
-	bool "wolfSSL"
-    endchoice
-  endif
+define Package/uencrypt-wolfssl
+  $(Package/uencrypt/default)
+  VARIANT:=wolfssl
+  TITLE+= using wolfSSL
+  DEPENDS:=+libwolfssl
 endef
 
-define Package/uencrypt/install
+Package/uencrypt-wolfssl/description= \
+  $(call Package/uencrypt/default/description,wolfSSL)
+
+define Package/uencrypt/default/install
 	$(INSTALL_DIR) $(1)/usr/bin
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/uencrypt $(1)/usr/bin
 endef
+Package/uencrypt-openssl/install = $(Package/uencrypt/default/install)
+Package/uencrypt-wolfssl/install = $(Package/uencrypt/default/install)
+Package/uencrypt-mbedtls/install = $(Package/uencrypt/default/install)
 
-$(eval $(call BuildPackage,uencrypt))
+$(eval $(call BuildPackage,uencrypt-mbedtls))
+$(eval $(call BuildPackage,uencrypt-openssl))
+$(eval $(call BuildPackage,uencrypt-wolfssl))
diff --git a/package/utils/uencrypt/src/CMakeLists.txt b/package/utils/uencrypt/src/CMakeLists.txt
index cd25d2f12f62a3..5e09954f0a2903 100644
--- a/package/utils/uencrypt/src/CMakeLists.txt
+++ b/package/utils/uencrypt/src/CMakeLists.txt
@@ -5,16 +5,28 @@ cmake_minimum_required(VERSION 2.8.12 FATAL_ERROR)
 project(uencrypt LANGUAGES C)
 
 option(USE_WOLFSSL "Use WolfSSL as crypto provider" OFF)
-if (USE_WOLFSSL)
-	add_definitions(-DUSE_WOLFSSL)
-	find_library(WOLFSSL_LIBRARY wolfssl REQUIRED)
-	set(CRYPTO_LIBRARIES ${WOLFSSL_LIBRARY})
+option(USE_MBEDTLS "Use mbedTLS as crypto provider" OFF)
+if (USE_MBEDTLS)
+	if (USE_WOLFSSL)
+		message(WARNING "USE_MBEDTLS and USE_WOLFSSL are both set. Building with USE_MBEDTLS.")
+	endif()
+	add_definitions(-DUSE_MBEDTLS)
+	find_library(MBEDCRYPTO_LIBRARY mbedcrypto REQUIRED)
+	set(CRYPTO_LIBRARIES ${MBEDCRYPTO_LIBRARY})
+	set(CRYPTO_SOURCES ${PROJECT_NAME}-mbedtls.c)
 else()
-	find_package(OpenSSL REQUIRED)
-	set(CRYPTO_LIBRARIES ${OPENSSL_CRYPTO_LIBRARY})
+	set(CRYPTO_SOURCES ${PROJECT_NAME}-openssl.c)
+	if (USE_WOLFSSL)
+		add_definitions(-DUSE_WOLFSSL)
+		find_library(WOLFSSL_LIBRARY wolfssl REQUIRED)
+		set(CRYPTO_LIBRARIES ${WOLFSSL_LIBRARY})
+	else()
+		find_package(OpenSSL REQUIRED)
+		set(CRYPTO_LIBRARIES ${OPENSSL_CRYPTO_LIBRARY})
+	endif()
 endif()
+add_executable(${PROJECT_NAME} ${PROJECT_NAME}.c ${PROJECT_NAME}.h ${CRYPTO_SOURCES})
 
-add_executable(${PROJECT_NAME} ${PROJECT_NAME}.c)
 target_link_libraries(${PROJECT_NAME} ${CRYPTO_LIBRARIES})
 
 install(TARGETS ${PROJECT_NAME} RUNTIME DESTINATION bin)
diff --git a/package/utils/uencrypt/src/uencrypt-mbedtls.c b/package/utils/uencrypt/src/uencrypt-mbedtls.c
new file mode 100644
index 00000000000000..34851261b79d0d
--- /dev/null
+++ b/package/utils/uencrypt/src/uencrypt-mbedtls.c
@@ -0,0 +1,186 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright (C) 2023 Eneas Ulir de Queiroz
+ */
+
+#include <ctype.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include "uencrypt.h"
+
+unsigned char *hexstr2buf(const char *str, long *len)
+{
+    unsigned char *buf;
+    long inlen = strlen(str);
+
+    *len = 0;
+    if (inlen % 2)
+	return NULL;
+
+    *len = inlen >> 1;
+    buf = malloc(*len);
+    for  (long x = 0; x < *len; x++)
+	sscanf(str + x * 2, "%2hhx", buf + x);
+    return buf;
+}
+
+const cipher_t *get_default_cipher(void)
+{
+    return mbedtls_cipher_info_from_type (MBEDTLS_CIPHER_AES_128_CBC);
+}
+
+static char* upperstr(char *str) {
+    for (char *s = str; *s; s++)
+	*s = toupper((unsigned char) *s);
+    return str;
+}
+
+const cipher_t *get_cipher_or_print_error(char *name)
+{
+    const mbedtls_cipher_info_t *cipher;
+
+    cipher = mbedtls_cipher_info_from_string(upperstr(name));
+    if (cipher)
+	return cipher;
+
+    fprintf(stderr, "Error: invalid cipher: %s.\n", name);
+    fprintf(stderr, "Supported ciphers: \n");
+    for (const int *list = mbedtls_cipher_list(); *list; list++) {
+	cipher = mbedtls_cipher_info_from_type(*list);
+	if (!cipher)
+	    continue;
+	fprintf(stderr, "\t%s\n", cipher->name);
+    }
+    return NULL;
+}
+
+int get_cipher_ivsize(const cipher_t *cipher)
+{
+    const mbedtls_cipher_info_t *c = cipher;
+
+    return c->iv_size;
+}
+
+int get_cipher_keysize(const cipher_t *cipher)
+{
+    const mbedtls_cipher_info_t *c = cipher;
+
+    return c->key_bitlen >> 3;
+}
+
+ctx_t *create_ctx(const cipher_t *cipher, const unsigned char *key,
+		  const unsigned char *iv, int enc, int padding)
+{
+    mbedtls_cipher_context_t *ctx;
+    const mbedtls_cipher_info_t *cipher_info=cipher;
+    int ret;
+
+    ctx = malloc(sizeof (mbedtls_cipher_context_t));
+    if (!ctx) {
+	fprintf (stderr, "Error: create_ctx: out of memory.\n");
+	return NULL;
+    }
+
+    mbedtls_cipher_init(ctx);
+    ret = mbedtls_cipher_setup(ctx, cipher_info);
+    if (ret) {
+	fprintf(stderr, "Error: mbedtls_cipher_setup: %d\n", ret);
+	goto abort;
+    }
+    ret = mbedtls_cipher_setkey(ctx, key,
+				(int) mbedtls_cipher_get_key_bitlen(ctx),
+				enc ? MBEDTLS_ENCRYPT : MBEDTLS_DECRYPT);
+    if (ret) {
+	fprintf(stderr, "Error: mbedtls_cipher_setkey: %d\n", ret);
+	goto abort;
+    }
+    if (iv) {
+        ret = mbedtls_cipher_set_iv(ctx, iv, mbedtls_cipher_get_iv_size(ctx));
+	if (ret) {
+	    fprintf(stderr, "Error: mbedtls_cipher_set_iv: %d\n", ret);
+	    goto abort;
+	}
+    }
+
+    if (cipher_info->mode == MBEDTLS_MODE_CBC) {
+	ret = mbedtls_cipher_set_padding_mode(ctx, padding ?
+						   MBEDTLS_PADDING_PKCS7 :
+						   MBEDTLS_PADDING_NONE);
+	if (ret) {
+	    fprintf(stderr, "Error: mbedtls_cipher_set_padding_mode: %d\n",
+		    ret);
+	    goto abort;
+	}
+    } else {
+	if (cipher_info->block_size > 1 && padding) {
+	    fprintf(stderr,
+		    "Error: mbedTLS only allows padding with CBC ciphers.\n");
+	    goto abort;
+	}
+    }
+
+    ret = mbedtls_cipher_reset(ctx);
+    if (ret) {
+	fprintf(stderr, "Error: mbedtls_cipher_reset: %d\n", ret);
+	goto abort;
+    }
+    return ctx;
+
+abort:
+    free_ctx(ctx);
+    return NULL;
+}
+
+int do_crypt(FILE *infile, FILE *outfile, ctx_t *ctx)
+{
+    unsigned char inbuf[CRYPT_BUF_SIZE];
+    unsigned char outbuf[CRYPT_BUF_SIZE + MBEDTLS_MAX_BLOCK_LENGTH];
+    size_t inlen, outlen, step;
+    int ret;
+
+    if (mbedtls_cipher_get_cipher_mode(ctx) == MBEDTLS_MODE_ECB) {
+	step = mbedtls_cipher_get_block_size(ctx);
+	if (step > CRYPT_BUF_SIZE) {
+	    step = CRYPT_BUF_SIZE;
+	}
+    } else {
+	step = CRYPT_BUF_SIZE;
+    }
+
+    for (;;) {
+	inlen = fread(inbuf, 1, step, infile);
+	if (inlen <= 0)
+	    break;
+	ret = mbedtls_cipher_update(ctx, inbuf, inlen, outbuf, &outlen);
+	if (ret) {
+	    fprintf(stderr, "Error: mbedtls_cipher_update: %d\n", ret);
+	    return ret;
+	}
+	ret = fwrite(outbuf, 1, outlen, outfile);
+	if (ret != outlen) {
+	    fprintf(stderr, "Error: cipher_update short write.\n");
+	    return ret - outlen;
+	}
+    }
+    ret = mbedtls_cipher_finish(ctx, outbuf, &outlen);
+    if (ret) {
+	fprintf(stderr, "Error: mbedtls_cipher_finish: %d\n", ret);
+	return ret;
+    }
+    ret = fwrite(outbuf, 1, outlen, outfile);
+    if (ret != outlen) {
+	fprintf(stderr, "Error: cipher_finish short write.\n");
+	return ret - outlen;
+    }
+
+    return 0;
+}
+
+void free_ctx(ctx_t *ctx)
+{
+    if (ctx) {
+	mbedtls_cipher_free(ctx);
+	free(ctx);
+    }
+}
diff --git a/package/utils/uencrypt/src/uencrypt-openssl.c b/package/utils/uencrypt/src/uencrypt-openssl.c
new file mode 100644
index 00000000000000..d9182be2baee18
--- /dev/null
+++ b/package/utils/uencrypt/src/uencrypt-openssl.c
@@ -0,0 +1,116 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright (C) 2022-2023 Eneas Ulir de Queiroz
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include "uencrypt.h"
+
+const cipher_t *get_default_cipher(void)
+{
+    return EVP_aes_128_cbc();
+}
+
+#ifndef USE_WOLFSSL
+static void print_ciphers(const OBJ_NAME *name,void *arg) {
+    fprintf(arg, "\t%s\n", name->name);
+}
+#endif
+
+const cipher_t *get_cipher_or_print_error(char *name)
+{
+    const EVP_CIPHER *cipher;
+
+    if ((cipher = EVP_get_cipherbyname(name)))
+	return cipher;
+
+    fprintf(stderr, "Error: invalid cipher: %s.\n", name);
+#ifndef USE_WOLFSSL
+    fprintf(stderr, "Supported ciphers: \n");
+    OBJ_NAME_do_all_sorted(OBJ_NAME_TYPE_CIPHER_METH, print_ciphers, stderr);
+#endif
+    return NULL;
+}
+
+int get_cipher_ivsize(const cipher_t *cipher)
+{
+    return EVP_CIPHER_iv_length(cipher);
+}
+
+int get_cipher_keysize(const cipher_t *cipher)
+{
+    return EVP_CIPHER_key_length(cipher);
+}
+
+ctx_t *create_ctx(const cipher_t *cipher, const unsigned char *key,
+		  const unsigned char *iv, int enc, int padding)
+{
+    EVP_CIPHER_CTX *ctx;
+    int ret;
+
+    ctx = EVP_CIPHER_CTX_new();
+    if (!ctx) {
+	fprintf (stderr, "Error: create_ctx: out of memory.\n");
+	return NULL;
+    }
+    ret = EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, enc);
+    if (!ret) {
+	fprintf(stderr, "Error:EVP_CipherInit_ex: %d\n", ret);
+	goto abort;
+    }
+    ret = EVP_CIPHER_CTX_set_padding(ctx, padding);
+    if (!ret) {
+	fprintf(stderr, "Error:EVP_CIPHER_CTX_set_padding: %d\n", ret);
+	goto abort;
+    }
+
+    return ctx;
+
+abort:
+    free_ctx(ctx);
+    return NULL;
+}
+
+
+int do_crypt(FILE *infile, FILE *outfile, ctx_t *ctx)
+{
+    unsigned char inbuf[CRYPT_BUF_SIZE];
+    unsigned char outbuf[CRYPT_BUF_SIZE + EVP_MAX_BLOCK_LENGTH];
+    int inlen, outlen;
+    int ret;
+
+    for (;;) {
+	inlen = fread(inbuf, 1, CRYPT_BUF_SIZE, infile);
+	if (inlen <= 0)
+	    break;
+	ret = EVP_CipherUpdate(ctx, outbuf, &outlen, inbuf, inlen);
+	if (!ret) {
+	    fprintf(stderr, "Error: EVP_CipherUpdate: %d\n", ret);
+	    return ret;
+	}
+	ret = fwrite(outbuf, 1, outlen, outfile);
+	if (ret != outlen) {
+	    fprintf(stderr, "Error: CipherUpdate short write.\n");
+	    return ret - outlen;
+	}
+    }
+    ret = EVP_CipherFinal_ex(ctx, outbuf, &outlen);
+    if (!ret) {
+	fprintf(stderr, "Error: EVP_CipherFinal: %d\n", ret);
+	return ret;
+    }
+    ret = fwrite(outbuf, 1, outlen, outfile);
+    if (ret != outlen) {
+	fprintf(stderr, "Error: CipherFinal short write.\n");
+	return ret - outlen;
+    }
+
+    return 0;
+}
+
+void free_ctx(ctx_t *ctx)
+{
+    EVP_CIPHER_CTX_free(ctx);
+}
diff --git a/package/utils/uencrypt/src/uencrypt.c b/package/utils/uencrypt/src/uencrypt.c
index ab9a202cec09cf..36e17e220bb688 100644
--- a/package/utils/uencrypt/src/uencrypt.c
+++ b/package/utils/uencrypt/src/uencrypt.c
@@ -1,5 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later
- * Copyright (C) 2022 Eneas Ulir de Queiroz
+ * Copyright (C) 2023 Eneas Ulir de Queiroz
  */
 
 #include <errno.h>
@@ -8,43 +8,7 @@
 #include <string.h>
 #include <unistd.h>
 
-#ifdef USE_WOLFSSL
-# include <wolfssl/options.h>
-# include <wolfssl/openssl/evp.h>
-#else
-# include <openssl/evp.h>
-#endif
-
-int do_crypt(FILE *infile, FILE *outfile, const EVP_CIPHER *cipher, const char *key, const char *iv,
-	     int enc, int padding)
-{
-    EVP_CIPHER_CTX *ctx;
-    unsigned char inbuf[1024], outbuf[1024 + EVP_MAX_BLOCK_LENGTH];
-    int inlen, outlen;
-
-    ctx = EVP_CIPHER_CTX_new();
-    EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, enc);
-    EVP_CIPHER_CTX_set_padding(ctx, padding);
-
-    for (;;) {
-	inlen = fread(inbuf, 1, 1024, infile);
-	if (inlen <= 0)
-	    break;
-	if (!EVP_CipherUpdate(ctx, outbuf, &outlen, inbuf, inlen)) {
-	    EVP_CIPHER_CTX_free(ctx);
-	    return -1;
-	}
-	fwrite(outbuf, 1, outlen, outfile);
-    }
-    if (!EVP_CipherFinal_ex(ctx, outbuf, &outlen)) {
-	EVP_CIPHER_CTX_free(ctx);
-	return -1;
-    }
-    fwrite(outbuf, 1, outlen, outfile);
-
-    EVP_CIPHER_CTX_free(ctx);
-    return 0;
-}
+#include "uencrypt.h"
 
 static void check_enc_dec(const int enc)
 {
@@ -54,50 +18,37 @@ static void check_enc_dec(const int enc)
     exit(EXIT_FAILURE);
 }
 
-#ifndef USE_WOLFSSL
-static void print_ciphers(const OBJ_NAME *name,void *arg) {
-    fprintf(arg, "\t%s\n", name->name);
-}
-#endif
-
-static void check_cipher(const EVP_CIPHER *cipher)
-{
-    if (cipher == NULL) {
-        fprintf(stderr, "Error: invalid cipher: %s.\n", optarg);
-#ifndef USE_WOLFSSL
-        fprintf(stderr, "Supported ciphers: \n", optarg);
-        OBJ_NAME_do_all_sorted(OBJ_NAME_TYPE_CIPHER_METH, print_ciphers, stderr);
-#endif
-        exit(EXIT_FAILURE);
-    }
-}
-
 static void show_usage(const char* name)
 {
     fprintf(stderr, "Usage: %s: [-d | -e] [-n] -k key [-i iv] [-c cipher]\n"
 		    "-d = decrypt; -e = encrypt; -n = no padding\n", name);
 }
 
+static void uencrypt_clear_free(void *ptr, size_t len)
+{
+    if (ptr) {
+	memset(ptr, 0, len);
+	free(ptr);
+    }
+}
+
 int main(int argc, char *argv[])
 {
     int enc = -1;
     unsigned char *iv = NULL;
     unsigned char *key = NULL;
-    long len;
+    long keylen = 0, ivlen = 0;
     int opt;
     int padding = 1;
-    int need_iv = 1;
-    const EVP_CIPHER *cipher = EVP_aes_128_cbc();
-    int ret;
+    const cipher_t *cipher = get_default_cipher();
+    ctx_t* ctx;
+    int ret = EXIT_FAILURE;
 
     while ((opt = getopt(argc, argv, "c:dei:k:n")) != -1) {
 	switch (opt) {
 	case 'c':
-	    cipher = EVP_get_cipherbyname(optarg);
-	    check_cipher(cipher);
-	    int arglen = strlen(optarg);
-	    if (arglen > 3 && strncmp(optarg+arglen-3, "ecb", 3) == 0) //if ends with "ecb"
-	        need_iv = 0;
+	    if (!(cipher = get_cipher_or_print_error(optarg)))
+		exit(EXIT_FAILURE);
 	    break;
 	case 'd':
 	    check_enc_dec(enc);
@@ -108,20 +59,22 @@ int main(int argc, char *argv[])
 	    enc = 1;
 	    break;
 	case 'i':
-	    iv = OPENSSL_hexstr2buf((const char *)optarg, &len);
+	    iv = hexstr2buf(optarg, &ivlen);
 	    if (iv == NULL) {
 		fprintf(stderr, "Error setting IV to %s. The IV should be encoded in hex.\n",
 			optarg);
 		exit(EINVAL);
 	    }
+	    memset(optarg, '*', strlen(optarg));
 	    break;
 	case 'k':
-	    key = OPENSSL_hexstr2buf((const char *)optarg, &len);
+	    key = hexstr2buf(optarg, &keylen);
 	    if (key == NULL) {
 		fprintf(stderr, "Error setting key to %s. The key should be encoded in hex.\n",
 			optarg);
 		exit(EINVAL);
 	    }
+	    memset(optarg, '*', strlen(optarg));
 	    break;
 	case 'n':
 	    padding = 0;
@@ -131,20 +84,22 @@ int main(int argc, char *argv[])
 	    exit(EINVAL);
 	}
     }
-    if (need_iv && iv == NULL) {
-        fprintf(stderr, "Error: iv not set.\n");
-        show_usage(argv[0]);
-        exit(EXIT_FAILURE);
+    if (ivlen != get_cipher_ivsize(cipher)) {
+	fprintf(stderr, "Error: IV must be %d bytes; given IV is %zd bytes.\n",
+		get_cipher_ivsize(cipher), ivlen);
+	exit(EXIT_FAILURE);
     }
-    if (key == NULL) {
-	fprintf(stderr, "Error: key not set.\n");
-	show_usage(argv[0]);
+    if (keylen != get_cipher_keysize(cipher)) {
+	fprintf(stderr, "Error: key must be %d bytes; given key is %zd bytes.\n",
+		get_cipher_keysize(cipher), keylen);
 	exit(EXIT_FAILURE);
     }
-    ret = do_crypt(stdin, stdout, cipher, key, iv, !!enc, padding);
-    if (ret)
-	fprintf(stderr, "Error during crypt operation.\n");
-    OPENSSL_free(iv);
-    OPENSSL_free(key);
+    ctx = create_ctx(cipher, key, iv, !!enc, padding);
+    if (ctx) {
+	ret = do_crypt(stdin, stdout, ctx);
+	free_ctx(ctx);
+    }
+    uencrypt_clear_free(iv, ivlen);
+    uencrypt_clear_free(key, keylen);
     return ret;
 }
diff --git a/package/utils/uencrypt/src/uencrypt.h b/package/utils/uencrypt/src/uencrypt.h
new file mode 100644
index 00000000000000..a4fe1f33762639
--- /dev/null
+++ b/package/utils/uencrypt/src/uencrypt.h
@@ -0,0 +1,49 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright (C) 2022-2023 Eneas Ulir de Queiroz
+ */
+
+#include <stdio.h>
+
+#define CRYPT_BUF_SIZE 1024
+
+#ifdef USE_MBEDTLS
+# include <mbedtls/cipher.h>
+
+# if defined(MBEDTLS_MAX_BLOCK_LENGTH) \
+     && MBEDTLS_MAX_BLOCK_LENGTH > CRYPT_BUF_SIZE
+#  undef CRYPT_BUF_SIZE
+#  define CRYPT_BUF_SIZE MAX_BLOCK_LENGTH
+# endif
+
+unsigned char *hexstr2buf(const char* str, long *len);
+
+#else /* USE_MBEDTLS */
+# ifdef USE_WOLFSSL
+#  include <wolfssl/options.h>
+#  include <wolfssl/openssl/evp.h>
+# else
+#  include <openssl/evp.h>
+# endif
+
+# if defined(EVP_MAX_BLOCK_LENGTH) \
+     && EVP_MAX_BLOCK_LENGTH > CRYPT_BUF_SIZE
+#  undef CRYPT_BUF_SIZE
+#  define CRYPT_BUF_SIZE EVP_MAX_BLOCK_LENGTH
+# endif
+
+# define hexstr2buf OPENSSL_hexstr2buf
+
+#endif /* USE_MBEDTLS */
+
+typedef void cipher_t;
+typedef void ctx_t;
+
+const cipher_t *get_default_cipher(void);
+const cipher_t *get_cipher_or_print_error(char *name);
+int get_cipher_ivsize(const cipher_t *cipher);
+int get_cipher_keysize(const cipher_t *cipher);
+
+ctx_t *create_ctx(const cipher_t *cipher, const unsigned char *key,
+		  const unsigned char *iv, int enc, int padding);
+int do_crypt(FILE *infile, FILE *outfile, ctx_t *ctx);
+void free_ctx(ctx_t *ctx);
diff --git a/package/utils/ugps/Makefile b/package/utils/ugps/Makefile
index c70a7b7ea64658..5afba4e0b02ee1 100644
--- a/package/utils/ugps/Makefile
+++ b/package/utils/ugps/Makefile
@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ugps
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=2
 
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/ugps.git
 PKG_SOURCE_PROTO:=git
diff --git a/package/utils/util-linux/Makefile b/package/utils/util-linux/Makefile
index 706c3194b19db3..704d4f11ec4eaa 100644
--- a/package/utils/util-linux/Makefile
+++ b/package/utils/util-linux/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=util-linux
-PKG_VERSION:=2.38
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_VERSION:=2.39
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
-PKG_SOURCE_URL:=@KERNEL/linux/utils/$(PKG_NAME)/v2.38
-PKG_HASH:=6d111cbe4d55b336db2f1fbeffbc65b89908704c01136371d32aa9bec373eb64
+PKG_SOURCE_URL:=@KERNEL/linux/utils/$(PKG_NAME)/v2.39
+PKG_HASH:=32b30a336cda903182ed61feb3e9b908b762a5e66fe14e43efb88d37162075cb
 PKG_CPE_ID:=cpe:/a:kernel:util-linux
 
 PKG_LICENSE:=GPL-2.0-only
@@ -415,6 +415,17 @@ define Package/rename/description
  expression in their name by replacement
 endef
 
+define Package/rev
+$(call Package/util-linux/Default)
+  TITLE:=Reverse lines characterwise
+endef
+
+define Package/rev/description
+ rev utility copies the specified files to the standard output, reversing the
+ order of characters in every line. If no files are specified, the standard
+ input is read.
+endef
+
 define Package/partx-utils
 $(call Package/util-linux/Default)
   TITLE:=inform kernel about the presence and numbering of on-disk partitions
@@ -474,6 +485,7 @@ endef
 define Package/taskset
 $(call Package/util-linux/Default)
   TITLE:=set or retrieve a process's CPU affinity
+  ALTERNATIVES:=200:/usr/bin/taskset:/usr/bin/util-linux-taskset
 endef
 
 define Package/taskset/description
@@ -804,6 +816,11 @@ define Package/rename/install
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/rename $(1)/usr/bin/
 endef
 
+define Package/rev/install
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/rev $(1)/usr/bin/
+endef
+
 define Package/partx-utils/install
 	$(INSTALL_DIR) $(1)/usr/sbin
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/partx $(1)/usr/sbin/
@@ -835,7 +852,7 @@ endef
 
 define Package/taskset/install
 	$(INSTALL_DIR) $(1)/usr/bin
-	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/taskset $(1)/usr/bin/
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/taskset $(1)/usr/bin/util-linux-taskset
 endef
 
 define Package/unshare/install
@@ -904,6 +921,7 @@ $(eval $(call BuildPackage,namei))
 $(eval $(call BuildPackage,nsenter))
 $(eval $(call BuildPackage,prlimit))
 $(eval $(call BuildPackage,rename))
+$(eval $(call BuildPackage,rev))
 $(eval $(call BuildPackage,partx-utils))
 $(eval $(call BuildPackage,script-utils))
 $(eval $(call BuildPackage,setterm))
diff --git a/package/utils/util-linux/patches/0001-test_enosys-add-support-for-mips.patch b/package/utils/util-linux/patches/0001-test_enosys-add-support-for-mips.patch
new file mode 100644
index 00000000000000..f8c8f851ec6103
--- /dev/null
+++ b/package/utils/util-linux/patches/0001-test_enosys-add-support-for-mips.patch
@@ -0,0 +1,36 @@
+From 2558932c65524d953e4c86d7fda2282a582aa5ec Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <thomas@t-8ch.de>
+Date: Wed, 17 May 2023 16:50:47 +0200
+Subject: [PATCH] test_enosys: add support for mips, powerpc and arc
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de>
+---
+ tests/helpers/test_enosys.c | 14 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/tests/helpers/test_enosys.c
++++ b/tests/helpers/test_enosys.c
+@@ -53,6 +53,20 @@
+ #    else
+ # 	 define SECCOMP_ARCH_NATIVE AUDIT_ARCH_PPC64LE
+ #    endif
++#elif __powerpc__
++# 	 define SECCOMP_ARCH_NATIVE AUDIT_ARCH_PPC
++#elif __mips__
++#    if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
++# 	 define SECCOMP_ARCH_NATIVE AUDIT_ARCH_MIPS
++#    else
++# 	 define SECCOMP_ARCH_NATIVE AUDIT_ARCH_MIPSEL
++#    endif
++#elif __arc__
++#    if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
++# 	 define SECCOMP_ARCH_NATIVE AUDIT_ARCH_ARCV2BE
++#    else
++# 	 define SECCOMP_ARCH_NATIVE AUDIT_ARCH_ARCV2
++#    endif
+ #else
+ #    error Unknown target architecture
+ #endif
diff --git a/package/utils/util-linux/patches/200-meson-no-po.patch b/package/utils/util-linux/patches/200-meson-no-po.patch
index d626036bb208d5..4d94f6b89ab860 100644
--- a/package/utils/util-linux/patches/200-meson-no-po.patch
+++ b/package/utils/util-linux/patches/200-meson-no-po.patch
@@ -1,6 +1,6 @@
 --- a/meson.build
 +++ b/meson.build
-@@ -774,7 +774,6 @@ subdir('disk-utils')
+@@ -874,7 +874,6 @@ subdir('disk-utils')
  subdir('misc-utils')
  subdir('text-utils')
  subdir('term-utils')
diff --git a/package/utils/yafut/Makefile b/package/utils/yafut/Makefile
new file mode 100644
index 00000000000000..fe27db97d22193
--- /dev/null
+++ b/package/utils/yafut/Makefile
@@ -0,0 +1,35 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=yafut
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL=https://github.com/kempniu/yafut.git
+PKG_SOURCE_DATE:=2023-03-31
+PKG_SOURCE_VERSION:=16435e89d449f953712983315e1a89cdb678620d
+
+PKG_LICENSE:=GPL-2.0
+PKG_LICENSE_FILES:=LICENSE
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/cmake.mk
+
+CMAKE_INSTALL:=1
+
+define Package/yafut
+  SECTION:=utils
+  CATEGORY:=Utilities
+  TITLE:=Yet Another File UTility
+  DEPENDS:=@NAND_SUPPORT
+endef
+
+define Package/yafut/description
+  A program for copying files from/to Yaffs file systems from userspace.
+endef
+
+define Package/yafut/install
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/yafut $(1)/usr/bin
+endef
+
+$(eval $(call BuildPackage,yafut))
diff --git a/package/utils/zyxel-bootconfig/files/95_apply_bootconfig b/package/utils/zyxel-bootconfig/files/95_apply_bootconfig
index c47857b082728c..500b81234a60f6 100644
--- a/package/utils/zyxel-bootconfig/files/95_apply_bootconfig
+++ b/package/utils/zyxel-bootconfig/files/95_apply_bootconfig
@@ -1,12 +1,10 @@
 apply_bootconfig() {
 	. /lib/functions.sh
 
-	local part
-
 	case $(board_name) in
 	zyxel,nwa50ax|\
 	zyxel,nwa55axe)
-        mtd_idx=$(find_mtd_index "bootconfig")
+	        mtd_idx=$(find_mtd_index "bootconfig")
 		zyxel-bootconfig "/dev/mtd$mtd_idx" set-image-status 0 valid
 		zyxel-bootconfig "/dev/mtd$mtd_idx" set-active-image 0
 		;;
diff --git a/rules.mk b/rules.mk
index c893f61b0f702b..58c53705a28161 100644
--- a/rules.mk
+++ b/rules.mk
@@ -109,7 +109,7 @@ $(foreach t,$(DEFAULT_SUBDIR_TARGETS) $(1),
 )
 endef
 
-DL_DIR:=$(if $(call qstrip,$(CONFIG_DOWNLOAD_FOLDER)),$(call qstrip,$(CONFIG_DOWNLOAD_FOLDER)),$(TOPDIR)/dl)
+DL_DIR=$(if $(call qstrip,$(CONFIG_DOWNLOAD_FOLDER)),$(call qstrip,$(CONFIG_DOWNLOAD_FOLDER)),$(TOPDIR)/dl)$(if $(DL_SUBDIR),/$(DL_SUBDIR))
 OUTPUT_DIR:=$(if $(call qstrip,$(CONFIG_BINARY_FOLDER)),$(call qstrip,$(CONFIG_BINARY_FOLDER)),$(TOPDIR)/bin)
 BIN_DIR:=$(OUTPUT_DIR)/targets/$(BOARD)/$(SUBTARGET)
 INCLUDE_DIR:=$(TOPDIR)/include
@@ -156,8 +156,8 @@ BUILD_LOG_DIR:=$(if $(call qstrip,$(CONFIG_BUILD_LOG_DIR)),$(call qstrip,$(CONFI
 PKG_INFO_DIR := $(STAGING_DIR)/pkginfo
 
 BUILD_DIR_HOST:=$(if $(IS_PACKAGE_BUILD),$(BUILD_DIR_BASE)/hostpkg,$(BUILD_DIR_BASE)/host)
-STAGING_DIR_HOST:=$(TOPDIR)/staging_dir/host
-STAGING_DIR_HOSTPKG:=$(TOPDIR)/staging_dir/hostpkg
+STAGING_DIR_HOST:=$(abspath $(STAGING_DIR)/../host)
+STAGING_DIR_HOSTPKG:=$(abspath $(STAGING_DIR)/../hostpkg)
 
 TARGET_PATH:=$(subst $(space),:,$(filter-out .,$(filter-out ./,$(subst :,$(space),$(PATH)))))
 TARGET_INIT_PATH:=$(call qstrip,$(CONFIG_TARGET_INIT_PATH))
@@ -184,7 +184,7 @@ ifndef DUMP
     -include $(TOOLCHAIN_DIR)/info.mk
     export GCC_HONOUR_COPTS:=0
     TARGET_CROSS:=$(if $(TARGET_CROSS),$(TARGET_CROSS),$(OPTIMIZE_FOR_CPU)-openwrt-linux$(if $(TARGET_SUFFIX),-$(TARGET_SUFFIX))-)
-    TARGET_CFLAGS+= -fhonour-copts -Wno-error=unused-but-set-variable -Wno-error=unused-result
+    TARGET_CFLAGS+= -fhonour-copts
     TARGET_CPPFLAGS+= -I$(TOOLCHAIN_DIR)/usr/include
     ifeq ($(CONFIG_USE_MUSL),y)
       TARGET_CPPFLAGS+= -I$(TOOLCHAIN_DIR)/include/fortify
@@ -227,6 +227,7 @@ else
   endif
 endif
 
+export ORIG_PATH:=$(if $(ORIG_PATH),$(ORIG_PATH),$(PATH))
 export PATH:=$(TARGET_PATH)
 export STAGING_DIR STAGING_DIR_HOST STAGING_DIR_HOSTPKG
 export SH_FUNC:=. $(INCLUDE_DIR)/shell.sh;
@@ -252,14 +253,12 @@ TARGET_NM:=$(TARGET_CROSS)gcc-nm
 TARGET_CC:=$(TARGET_CROSS)gcc
 TARGET_CXX:=$(TARGET_CROSS)g++
 KPATCH:=$(SCRIPT_DIR)/patch-kernel.sh
+FILECMD:=$(STAGING_DIR_HOST)/bin/file
 SED:=$(STAGING_DIR_HOST)/bin/sed -i -e
 ESED:=$(STAGING_DIR_HOST)/bin/sed -E -i -e
 MKHASH:=$(STAGING_DIR_HOST)/bin/mkhash
 # MKHASH is used in /scripts, so we export it here.
 export MKHASH
-# DOWNLOAD_CHECK_CERTIFICATE is used in /scripts, so we export it here.
-DOWNLOAD_CHECK_CERTIFICATE:=$(CONFIG_DOWNLOAD_CHECK_CERTIFICATE)
-export DOWNLOAD_CHECK_CERTIFICATE
 CP:=cp -fpR
 LN:=ln -sf
 XARGS:=xargs -r
@@ -270,6 +269,14 @@ FIND:=find
 PATCH:=patch
 PYTHON:=python3
 
+ifeq ($(HOST_OS),Darwin)
+  TRUE:=/usr/bin/env gtrue
+  FALSE:=/usr/bin/env gfalse
+else
+  TRUE:=/usr/bin/env true
+  FALSE:=/usr/bin/env false
+endif
+
 INSTALL_BIN:=install -m0755
 INSTALL_SUID:=install -m4755
 INSTALL_DIR:=install -d -m0755
@@ -286,8 +293,8 @@ export HOSTCC_NOCACHE
 export HOSTCXX_NOCACHE
 
 ifneq ($(CONFIG_CCACHE),)
-  TARGET_CC:= ccache_cc
-  TARGET_CXX:= ccache_cxx
+  TARGET_CC:= ccache $(TARGET_CC)
+  TARGET_CXX:= ccache $(TARGET_CXX)
   HOSTCC:= ccache $(HOSTCC)
   HOSTCXX:= ccache $(HOSTCXX)
   export CCACHE_BASEDIR:=$(TOPDIR)
@@ -352,6 +359,7 @@ ifeq ($(CONFIG_BUILD_LOG),y)
 endif
 
 export BISON_PKGDATADIR:=$(STAGING_DIR_HOST)/share/bison
+export HOST_GNULIB_SRCDIR:=$(STAGING_DIR_HOST)/share/gnulib
 export M4:=$(STAGING_DIR_HOST)/bin/m4
 
 define shvar
@@ -412,7 +420,7 @@ $(shell \
   if git log -1 >/dev/null 2>/dev/null; then \
     if [ -n "$(1)" ]; then \
       last_bump="$$(git log --pretty=format:'%h %s' . | \
-        grep --max-count=1 -e ': [uU]pdate to ' -e ': [bB]ump to ' | \
+        grep -m 1 -e ': [uU]pdate to ' -e ': [bB]ump to ' | \
         cut -f 1 -d ' ')"; \
     fi; \
     if [ -n "$$last_bump" ]; then \
diff --git a/scripts/dl_cleanup.py b/scripts/dl_cleanup.py
index ad1b88c8b90866..cdbcb83f2028d9 100755
--- a/scripts/dl_cleanup.py
+++ b/scripts/dl_cleanup.py
@@ -13,6 +13,7 @@
 import os
 import re
 import getopt
+import shutil
 
 # Commandline options
 opt_dryrun = False
@@ -119,8 +120,10 @@ def parseVer_GIT(match, filepath):
     (re.compile(r"(.+)[-_](\d\d\d\d)-?(\d\d)-?(\d\d)"), parseVer_ymd),  # xxx-YYYY-MM-DD
     (re.compile(r"(.+)[-_]([0-9a-fA-F]{40,40})"), parseVer_GIT),  # xxx-GIT_SHASUM
     (re.compile(r"(.+)[-_](\d+)\.(\d+)\.(\d+)(\w?)"), parseVer_123),  # xxx-1.2.3a
+    (re.compile(r"(.+)[-_]v(\d+)\.(\d+)\.(\d+)(\w?)"), parseVer_123),  # xxx-v1.2.3a
     (re.compile(r"(.+)[-_](\d+)_(\d+)_(\d+)"), parseVer_123),  # xxx-1_2_3
     (re.compile(r"(.+)[-_](\d+)\.(\d+)(\w?)"), parseVer_12),  # xxx-1.2a
+    (re.compile(r"(.+)[-_]v(\d+)\.(\d+)(\w?)"), parseVer_12),  # xxx-v1.2a
     (re.compile(r"(.+)[-_]r?(\d+)"), parseVer_r),  # xxx-r1111
 )
 
@@ -138,20 +141,26 @@ class EntryParseError(Exception):
 
 
 class Entry:
-    def __init__(self, directory, filename):
+    def __init__(self, directory, builddir, filename):
         self.directory = directory
         self.filename = filename
+        self.builddir = builddir
         self.progname = ""
         self.fileext = ""
+        self.filenoext = ""
 
-        for ext in extensions:
-            if filename.endswith(ext):
-                filename = filename[0 : 0 - len(ext)]
-                self.fileext = ext
-                break
+        if os.path.isdir(self.getPath()):
+            self.filenoext = filename
         else:
-            print(self.filename, "has an unknown file-extension")
-            raise EntryParseError("ext")
+            for ext in extensions:
+                if filename.endswith(ext):
+                    filename = filename[0 : 0 - len(ext)]
+                    self.filenoext = filename
+                    self.fileext = ext
+                    break
+            else:
+                print(self.filename, "has an unknown file-extension")
+                raise EntryParseError("ext")
         for (regex, parseVersion) in versionRegex:
             match = regex.match(filename)
             if match:
@@ -166,11 +175,29 @@ def __init__(self, directory, filename):
     def getPath(self):
         return (self.directory + "/" + self.filename).replace("//", "/")
 
+    def getBuildPaths(self):
+        paths = []
+        for subdir in os.scandir(self.builddir):
+            package_build_dir = os.path.join(subdir.path, self.filenoext)
+            if os.path.exists(package_build_dir):
+                paths.append(package_build_dir)
+        return paths
+
     def deleteFile(self):
         path = self.getPath()
         print("Deleting", path)
         if not opt_dryrun:
-            os.unlink(path)
+            if os.path.isdir(path):
+                shutil.rmtree(path)
+            else:
+                os.unlink(path)
+
+    def deleteBuildDir(self):
+        paths = self.getBuildPaths()
+        for path in paths:
+            print("Deleting BuildDir", path)
+            if not opt_dryrun:
+                    shutil.rmtree(path)
 
     def __ge__(self, y):
         return self.version >= y.version
@@ -183,6 +210,12 @@ def usage():
     print(" -d|--dry-run            Do a dry-run. Don't delete any files")
     print(" -B|--show-blacklist     Show the blacklist and exit")
     print(" -w|--whitelist ITEM     Remove ITEM from blacklist")
+    print(
+        " -D|--download-dir       Provide path to dl dir to clean also the build directory"
+    )
+    print(
+        " -b|--build-dir          Provide path to build dir to clean also the build directory"
+    )
 
 
 def main(argv):
@@ -191,25 +224,22 @@ def main(argv):
     try:
         (opts, args) = getopt.getopt(
             argv[1:],
-            "hdBw:",
+            "hdBw:D:b:",
             [
                 "help",
                 "dry-run",
                 "show-blacklist",
                 "whitelist=",
+                "download-dir=",
+                "build-dir=",
             ],
         )
-        if len(args) != 1:
-            usage()
-            return 1
     except getopt.GetoptError as e:
         usage()
         return 1
-    directory = args[0]
 
-    if not os.path.exists(directory):
-        print("Can't find dl path", directory)
-        return 1
+    directory = "dl/"
+    builddir = "build_dir/"
 
     for (o, v) in opts:
         if o in ("-h", "--help"):
@@ -233,6 +263,21 @@ def main(argv):
                     sep = "\t"
                 print("%s%s(%s)" % (name, sep, regex.pattern))
             return 0
+        if o in ("-D", "--download-dir"):
+            directory = v
+        if o in ("-b", "--build-dir"):
+            builddir = v
+
+    if args:
+        directory = args[0]
+
+    if not os.path.exists(directory):
+        print("Can't find download directory", directory)
+        return 1
+
+    if not os.path.exists(builddir):
+        print("Can't find build directory", builddir)
+        return 1
 
     # Create a directory listing and parse the file names.
     entries = []
@@ -246,7 +291,7 @@ def main(argv):
                 break
         else:
             try:
-                entries.append(Entry(directory, filename))
+                entries.append(Entry(directory, builddir, filename))
             except EntryParseError as e:
                 pass
 
@@ -265,12 +310,17 @@ def main(argv):
         lastVersion = None
         versions = progmap[prog]
         for version in versions:
+            if lastVersion:
+                if os.path.isdir(lastVersion.getPath()) and not os.path.isdir(version.getPath()):
+                    continue
             if lastVersion is None or version >= lastVersion:
                 lastVersion = version
         if lastVersion:
             for version in versions:
                 if version is not lastVersion:
                     version.deleteFile()
+                    if builddir:
+                        version.deleteBuildDir()
             if opt_dryrun:
                 print("Keeping", lastVersion.getPath())
 
diff --git a/scripts/dl_github_archive.py b/scripts/dl_github_archive.py
index b992227dc98ae2..328d588e781262 100755
--- a/scripts/dl_github_archive.py
+++ b/scripts/dl_github_archive.py
@@ -133,7 +133,7 @@ def untar(path, into=None):
     def tar(path, subdir, into=None, ts=None):
         """Pack ``path`` into tarball ``into``."""
         # --sort=name requires a recent build of GNU tar
-        args = ['tar', '--numeric-owner', '--owner=0', '--group=0', '--sort=name']
+        args = ['tar', '--numeric-owner', '--owner=0', '--group=0', '--sort=name', '--mode=a-s']
         args += ['-C', path, '-cf', into, subdir]
         envs = os.environ.copy()
         if ts is not None:
diff --git a/scripts/download.pl b/scripts/download.pl
index 33e1e12c1ea8eb..676c6e9e6b10b6 100755
--- a/scripts/download.pl
+++ b/scripts/download.pl
@@ -25,6 +25,8 @@
 my $ok;
 
 my $check_certificate = $ENV{DOWNLOAD_CHECK_CERTIFICATE} eq "y";
+my $custom_tool = $ENV{DOWNLOAD_TOOL_CUSTOM};
+my $download_tool;
 
 $url_filename or $url_filename = $filename;
 
@@ -70,27 +72,70 @@ ()
 	return undef;
 }
 
-sub download_cmd($) {
-	my $url = shift;
-	my $have_curl = 0;
+sub tool_present {
+	my $tool_name = shift;
+	my $compare_line = shift;
+	my $present = 0;
 
-	if (open CURL, "curl --version 2>/dev/null |") {
-		if (defined(my $line = readline CURL)) {
-			$have_curl = 1 if $line =~ /^curl /;
+	if (open TOOL, "$tool_name --version 2>/dev/null |") {
+		if (defined(my $line = readline TOOL)) {
+			$present = 1 if $line =~ /^$compare_line /;
 		}
-		close CURL;
+		close TOOL;
+	}
+
+	return $present
+}
+
+sub select_tool {
+	$custom_tool =~ tr/"//d;
+	if ($custom_tool) {
+		return $custom_tool;
+	}
+
+	# Try to use curl if available
+	if (tool_present("curl", "curl")) {
+		return "curl";
 	}
 
-	return $have_curl
-		? (qw(curl -f --connect-timeout 20 --retry 5 --location),
+	# No tool found, fallback to wget
+	return "wget";
+}
+
+sub download_cmd {
+	my $url = shift;
+	my $filename = shift;
+
+	if ($download_tool eq "curl") {
+		return (qw(curl -f --connect-timeout 20 --retry 5 --location),
 			$check_certificate ? () : '--insecure',
 			shellwords($ENV{CURL_OPTIONS} || ''),
-			$url)
-		: (qw(wget --tries=5 --timeout=20 --output-document=-),
+			$url);
+	} elsif ($download_tool eq "wget") {
+		return (qw(wget --tries=5 --timeout=20 --output-document=-),
 			$check_certificate ? () : '--no-check-certificate',
 			shellwords($ENV{WGET_OPTIONS} || ''),
-			$url)
-	;
+			$url);
+	} elsif ($download_tool eq "aria2c") {
+		my $additional_mirrors = join(" ", map "$_/$filename", @_);
+		my @chArray = ('a'..'z', 'A'..'Z', 0..9);
+		my $rfn = join '', "${filename}_", map{ $chArray[int rand @chArray] } 0..9;
+
+		@mirrors=();
+
+		return join(" ", "[ -d $ENV{'TMPDIR'}/aria2c ] || mkdir $ENV{'TMPDIR'}/aria2c;",
+			"touch $ENV{'TMPDIR'}/aria2c/${rfn}_spp;",
+			qw(aria2c --stderr -c -x2 -s10 -j10 -k1M), $url, $additional_mirrors,
+			$check_certificate ? () : '--check-certificate=false',
+			"--server-stat-of=$ENV{'TMPDIR'}/aria2c/${rfn}_spp",
+			"--server-stat-if=$ENV{'TMPDIR'}/aria2c/${rfn}_spp",
+			"--daemon=false --no-conf", shellwords($ENV{ARIA2C_OPTIONS} || ''),
+			"-d $ENV{'TMPDIR'}/aria2c -o $rfn;",
+			"cat $ENV{'TMPDIR'}/aria2c/$rfn;",
+			"rm $ENV{'TMPDIR'}/aria2c/$rfn $ENV{'TMPDIR'}/aria2c/${rfn}_spp");
+	} else {
+		return join(" ", $download_tool, $url);
+	}
 }
 
 my $hash_cmd = hash_cmd();
@@ -100,6 +145,7 @@ sub download
 {
 	my $mirror = shift;
 	my $download_filename = shift;
+	my @additional_mirrors = @_;
 
 	$mirror =~ s!/$!!;
 
@@ -146,9 +192,9 @@ sub download
 			}
 		};
 	} else {
-		my @cmd = download_cmd("$mirror/$download_filename");
+		my @cmd = download_cmd("$mirror/$download_filename", $download_filename, @additional_mirrors);
 		print STDERR "+ ".join(" ",@cmd)."\n";
-		open(FETCH_FD, '-|', @cmd) or die "Cannot launch curl or wget.\n";
+		open(FETCH_FD, '-|', @cmd) or die "Cannot launch aria2c, curl or wget.\n";
 		$hash_cmd and do {
 			open MD5SUM, "| $hash_cmd > '$target/$filename.hash'" or die "Cannot launch $hash_cmd.\n";
 		};
@@ -206,7 +252,10 @@ sub cleanup
 		push @mirrors, "https://ftp.debian.org/debian/$1";
 		push @mirrors, "https://mirror.leaseweb.com/debian/$1";
 		push @mirrors, "https://mirror.netcologne.de/debian/$1";
+		push @mirrors, "https://mirrors.tuna.tsinghua.edu.cn/debian/$1";
+		push @mirrors, "https://mirrors.ustc.edu.cn/debian/$1"
 	} elsif ($mirror =~ /^\@APACHE\/(.+)$/) {
+		push @mirrors, "https://dlcdn.apache.org/$1";
 		push @mirrors, "https://mirror.netcologne.de/apache.org/$1";
 		push @mirrors, "https://mirror.aarnet.edu.au/pub/apache/$1";
 		push @mirrors, "https://mirror.csclub.uwaterloo.ca/apache/$1";
@@ -216,6 +265,8 @@ sub cleanup
 		push @mirrors, "http://ftp.jaist.ac.jp/pub/apache/$1";
 		push @mirrors, "ftp://apache.cs.utah.edu/apache.org/$1";
 		push @mirrors, "ftp://apache.mirrors.ovh.net/ftp.apache.org/dist/$1";
+		push @mirrors, "https://mirrors.tuna.tsinghua.edu.cn/apache/$1";
+		push @mirrors, "https://mirrors.ustc.edu.cn/apache/$1";
 	} elsif ($mirror =~ /^\@GITHUB\/(.+)$/) {
 		# give github a few more tries (different mirrors)
 		for (1 .. 5) {
@@ -231,6 +282,8 @@ sub cleanup
 		push @mirrors, "ftp://mirrors.rit.edu/gnu/$1";
 		push @mirrors, "ftp://download.xs4all.nl/pub/gnu/$1";
 		push @mirrors, "https://ftp.gnu.org/gnu/$1";
+		push @mirrors, "https://mirrors.tuna.tsinghua.edu.cn/gnu/$1";
+		push @mirrors, "https://mirrors.ustc.edu.cn/gnu/$1";
 	} elsif ($mirror =~ /^\@SAVANNAH\/(.+)$/) {
 		push @mirrors, "https://mirror.netcologne.de/savannah/$1";
 		push @mirrors, "https://mirror.csclub.uwaterloo.ca/nongnu/$1";
@@ -254,6 +307,8 @@ sub cleanup
 			push @mirrors, "http://www.ring.gr.jp/archives/linux/kernel.org/$dir";
 			push @mirrors, "ftp://ftp.riken.jp/Linux/kernel.org/$dir";
 			push @mirrors, "ftp://www.mirrorservice.org/sites/ftp.kernel.org/pub/$dir";
+			push @mirrors, "https://mirrors.tuna.tsinghua.edu.cn/kernel/$dir";
+			push @mirrors, "https://mirrors.ustc.edu.cn/kernel.org/$dir";
 		}
 	} elsif ($mirror =~ /^\@GNOME\/(.+)$/) {
 		push @mirrors, "https://download.gnome.org/sources/$1";
@@ -265,6 +320,7 @@ sub cleanup
 		push @mirrors, "http://ftp.belnet.be/ftp.gnome.org/sources/$1";
 		push @mirrors, "ftp://ftp.cse.buffalo.edu/pub/Gnome/sources/$1";
 		push @mirrors, "ftp://ftp.nara.wide.ad.jp/pub/X11/GNOME/sources/$1";
+		push @mirrors, "https://mirrors.ustc.edu.cn/gnome/sources/$1";
 	} else {
 		push @mirrors, $mirror;
 	}
@@ -292,13 +348,15 @@ sub cleanup
 	};
 }
 
+$download_tool = select_tool();
+
 while (!-f "$target/$filename") {
 	my $mirror = shift @mirrors;
 	$mirror or die "No more mirrors to try - giving up.\n";
 
-	download($mirror, $url_filename);
+	download($mirror, $url_filename, @mirrors);
 	if (!-f "$target/$filename" && $url_filename ne $filename) {
-		download($mirror, $filename);
+		download($mirror, $filename, @mirrors);
 	}
 }
 
diff --git a/scripts/ext-tools.sh b/scripts/ext-tools.sh
new file mode 100644
index 00000000000000..b58296be10163c
--- /dev/null
+++ b/scripts/ext-tools.sh
@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+
+TOOLS_TAR=""
+HOST_BUILD_DIR=$(pwd)/"build_dir/host"
+HOST_STAGING_DIR_STAMP=$(pwd)/"staging_dir/host/stamp"
+
+refresh_timestamps() {
+	find -H "$1" -not -type l -print0 | xargs -0 touch
+}
+
+extract_prebuilt_tar() {
+	tar -xf "$1"
+}
+
+refresh_prebuilt_tools() {
+	if [ ! -d "$HOST_BUILD_DIR" ]; then
+		echo "Can't find Host Build Dir "$HOST_BUILD_DIR"" >&2
+		exit 1
+	fi
+
+	refresh_timestamps "$HOST_BUILD_DIR"
+	sleep 1
+
+	if [ ! -d "$HOST_STAGING_DIR_STAMP" ]; then
+		echo "Can't find Host Staging Dir Stamp "$HOST_STAGING_DIR_STAMP"" >&2
+		exit 1
+	fi
+
+	refresh_timestamps "$HOST_STAGING_DIR_STAMP"
+
+	return 0
+}
+
+install_prebuilt_tools() {
+	extract_prebuilt_tar "$TOOLS_TAR"
+
+	refresh_prebuilt_tools
+
+	return 0
+}
+
+while [ -n "$1" ]; do
+	arg="$1"; shift
+	case "$arg" in
+		--host-build-dir)
+			[ -d "$1" ] || {
+				echo "Directory '$1' does not exist." >&2
+				exit 1
+			}
+			HOST_BUILD_DIR="$(cd "$1"; pwd)"; shift
+		;;
+
+		--host-staging-dir-stamp)
+			[ -d "$1" ] || {
+				echo "Directory '$1' does not exist." >&2
+				exit 1
+			}
+			HOST_STAGING_DIR_STAMP="$(cd "$1"; pwd)"; shift
+		;;
+
+		--tools)
+			[ -f "$1" ] || {
+				echo "Tools tar file '$1' does not exist." >&2
+				exit 1
+			}
+			TOOLS_TAR="$1"; shift
+			install_prebuilt_tools
+
+			exit $?
+		;;
+
+		--refresh)
+			refresh_prebuilt_tools
+
+			exit $?
+		;;
+
+		-h|--help)
+			me="$(basename "$0")"
+			echo -e "\nUsage:\n"                                            >&2
+			echo -e "  $me --host-build-dir {directory}"                    >&2
+			echo -e "    Set to refresh timestamp of this build directory"  >&2
+			echo -e "    with --tools."                                     >&2
+			echo -e "    THIS OPTION MUST BE SET BEFORE --tools."           >&2
+			echo -e "    If not provided the default directory is:"         >&2
+			echo -e "    $(pwd)/build_dir/host\n"                           >&2
+			echo -e "  $me --host-staging-dir-stamp {directory}"            >&2
+			echo -e "    Set to refresh staging timestamp present in this"  >&2
+			echo -e "    directory with --tools."                           >&2
+			echo -e "    THIS OPTION MUST BE SET BEFORE --tools."           >&2
+			echo -e "    If not provided the default directory is:"         >&2
+			echo -e "    $(pwd)/staging_dir/host/stamp\n"                   >&2
+			echo -e "  $me --tools {tar}"                                   >&2
+			echo -e "    Install the prebuilt tools present in the passed"  >&2
+			echo -e "    tar and prepare them."                             >&2
+			echo -e "    To correctly use them it's needed to update the"   >&2
+			echo -e "    timestamp of each tools to skip recompilation.\n"  >&2
+			echo -e "  $me --refresh"                                       >&2
+			echo -e "    Refresh timestamps of already extracted prebuilt"  >&2
+			echo -e "    tools to correctly use them and skip"              >&2
+			echo -e "    recompilation.\n"                                  >&2
+			echo -e "  $me --help"                                          >&2
+			echo -e "    Display this help text and exit.\n\n"              >&2
+			exit 1
+		;;
+
+		*)
+			echo "Unknown argument '$arg'" >&2
+			exec $0 --help
+		;;
+	esac
+done
+
+exec $0 --help
diff --git a/scripts/gen_image_generic.sh b/scripts/gen_image_generic.sh
index ef136244029579..11e40f38868f8e 100755
--- a/scripts/gen_image_generic.sh
+++ b/scripts/gen_image_generic.sh
@@ -9,8 +9,10 @@ fi
 OUTPUT="$1"
 KERNELSIZE="$2"
 KERNELDIR="$3"
+KERNELPARTTYPE=${KERNELPARTTYPE:-83}
 ROOTFSSIZE="$4"
 ROOTFSIMAGE="$5"
+ROOTFSPARTTYPE=${ROOTFSPARTTYPE:-83}
 ALIGN="$6"
 
 rm -f "$OUTPUT"
@@ -19,7 +21,7 @@ head=16
 sect=63
 
 # create partition table
-set $(ptgen -o "$OUTPUT" -h $head -s $sect ${GUID:+-g} -p "${KERNELSIZE}m" -p "${ROOTFSSIZE}m" ${ALIGN:+-l $ALIGN} ${SIGNATURE:+-S 0x$SIGNATURE} ${GUID:+-G $GUID})
+set $(ptgen -o "$OUTPUT" -h $head -s $sect ${GUID:+-g} -t "${KERNELPARTTYPE}" -p "${KERNELSIZE}m${PARTOFFSET:+@$PARTOFFSET}" -t "${ROOTFSPARTTYPE}" -p "${ROOTFSSIZE}m" ${ALIGN:+-l $ALIGN} ${SIGNATURE:+-S 0x$SIGNATURE} ${GUID:+-G $GUID})
 
 KERNELOFFSET="$(($1 / 512))"
 KERNELSIZE="$2"
diff --git a/scripts/json_add_image_info.py b/scripts/json_add_image_info.py
index 9aa2a19e45d585..0c441b93344bd8 100755
--- a/scripts/json_add_image_info.py
+++ b/scripts/json_add_image_info.py
@@ -21,7 +21,7 @@
 
 def get_titles():
     titles = []
-    for prefix in ["", "ALT0_", "ALT1_", "ALT2_"]:
+    for prefix in ["", "ALT0_", "ALT1_", "ALT2_", "ALT3_", "ALT4_"]:
         title = {}
         for var in ["vendor", "model", "variant"]:
             if getenv("DEVICE_{}{}".format(prefix, var.upper())):
diff --git a/scripts/linksys-image.sh b/scripts/linksys-image.sh
index c3baf44844a0ac..d251b5da8ee84e 100755
--- a/scripts/linksys-image.sh
+++ b/scripts/linksys-image.sh
@@ -14,10 +14,9 @@
 #  <VERSION>        The version number of upgrade. Not checked so use arbitrary value (8 bytes)
 #  <TYPE>           Model of target device, padded (0x20) to (15 bytes)
 #  <CRC>      	    CRC checksum of the image to flash (8 byte)
-#  <padding>	    Padding (0x20) (7 bytes)
+#  <padding>	    Padding ('0' + 0x20 *7) (8 bytes)
 #  <signature>	    Signature of signer. Not checked so use arbitrary value (16 bytes)
 #  <padding>        Padding (0x00) (192 bytes)
-#  0x0A		    (1 byte)
 
 ## version history
 # * version 1: initial commit
@@ -58,10 +57,8 @@ IMG_OUT="${IMG_IN}.new"
 dd if="${IMG_IN}" of="${IMG_TMP_OUT}"
 CRC=$(printf "%08X" $(dd if="${IMG_IN}" bs=$(stat -c%s "${IMG_IN}") count=1|cksum| cut -d ' ' -f1))
 
-printf ".LINKSYS.01000409%-15s%-8s%-7s%-16s" "${TYPE}" "${CRC}" "" "K0000000F0246434" >> "${IMG_TMP_OUT}"
+printf ".LINKSYS.01000409%-15s%-8s%-8s%-16s" "${TYPE}" "${CRC}" "0" "K0000000F0246434" >> "${IMG_TMP_OUT}"
 
 dd if=/dev/zero bs=1 count=192 conv=notrunc >> "${IMG_TMP_OUT}"
 
-printf '\12' >> "${IMG_TMP_OUT}"
-
 cp "${IMG_TMP_OUT}" "${IMG_OUT}"
diff --git a/scripts/mkits.sh b/scripts/mkits.sh
index 7bf5681addf097..b1c6f988674711 100755
--- a/scripts/mkits.sh
+++ b/scripts/mkits.sh
@@ -35,6 +35,7 @@ usage() {
 	printf "\n\t-l ==> legacy mode character (@ etc otherwise -)"
 	printf "\n\t-o ==> create output file 'its_file'"
 	printf "\n\t-O ==> create config with dt overlay 'name:dtb'"
+	printf "\n\t-s ==> set FDT load address to 'addr' (hex)"
 	printf "\n\t\t(can be specified more than once)\n"
 	exit 1
 }
@@ -48,7 +49,7 @@ LOADABLES=
 DTOVERLAY=
 DTADDR=
 
-while getopts ":A:a:c:C:D:d:e:f:i:k:l:n:o:O:v:r:H:" OPTION
+while getopts ":A:a:c:C:D:d:e:f:i:k:l:n:o:O:v:r:s:H:" OPTION
 do
 	case $OPTION in
 		A ) ARCH=$OPTARG;;
@@ -66,6 +67,7 @@ do
 		o ) OUTPUT=$OPTARG;;
 		O ) DTOVERLAY="$DTOVERLAY ${OPTARG}";;
 		r ) ROOTFS=$OPTARG;;
+		s ) FDTADDR=$OPTARG;;
 		H ) HASH=$OPTARG;;
 		v ) VERSION=$OPTARG;;
 		* ) echo "Invalid option passed to '$0' (options:$*)"
@@ -87,10 +89,14 @@ if [ -n "${COMPATIBLE}" ]; then
 fi
 
 [ "$DTOVERLAY" ] && {
-	dtbsize=$(wc -c "$DTB" | cut -d' ' -f1)
+	dtbsize=$(wc -c "$DTB" | awk '{print $1}')
 	DTADDR=$(printf "0x%08x" $(($LOAD_ADDR - $dtbsize)) )
 }
 
+[ "$FDTADDR" ] && {
+	DTADDR="$FDTADDR"
+}
+
 # Conditionally create fdt information
 if [ -n "${DTB}" ]; then
 	FDT_NODE="
@@ -162,7 +168,7 @@ OVCONFIGS=""
 	overlay_blob=${overlay##*:}
 	ovname=${overlay%%:*}
 	ovnode="fdt-$ovname"
-	ovsize=$(wc -c "$overlay_blob" | cut -d' ' -f1)
+	ovsize=$(wc -c "$overlay_blob" | awk '{print $1}')
 	echo "$ovname ($overlay_blob) : $ovsize" >&2
 	DTADDR=$(printf "0x%08x" $(($DTADDR - $ovsize)))
 	FDTOVERLAY_NODE="$FDTOVERLAY_NODE
@@ -185,13 +191,10 @@ OVCONFIGS=""
 "
 	OVCONFIGS="$OVCONFIGS
 
-		config-$ovname {
-			description = \"OpenWrt ${DEVICE} with $ovname\";
-			kernel = \"kernel${REFERENCE_CHAR}1\";
-			fdt = \"fdt${REFERENCE_CHAR}$FDTNUM\", \"$ovnode\";
-			${LOADABLES:+loadables = ${LOADABLES};}
+		$ovname {
+			description = \"OpenWrt ${DEVICE} overlay $ovname\";
+			fdt = \"$ovnode\";
 			${COMPATIBLE_PROP}
-			${INITRD_PROP}
 		};
 	"
 done
diff --git a/scripts/qemustart b/scripts/qemustart
index f0ddefb839941a..f6a46551294fc3 100755
--- a/scripts/qemustart
+++ b/scripts/qemustart
@@ -109,10 +109,10 @@ Examples
   $SELF malta be -m 64
   $SELF malta le64
   $SELF malta be-glibc
-  $SELF armvirt 32 \\
+  $SELF armsr armv7 \\
                 --machine virt,highmem=off \\
-                --kernel bin/targets/armvirt/32/openwrt-armvirt-32-zImage \\
-                --rootfs bin/targets/armvirt/32/openwrt-armvirt-32-root.ext4
+                --kernel bin/targets/armsr/armv7/openwrt-armsr-armv7-generic-kernel.bin \\
+                --rootfs bin/targets/armsr/armv7/openwrt-armsr-armv7-generic-ext4-rootfs.img
 EOF
 }
 
@@ -158,10 +158,11 @@ parse_args() {
 		return 1
 	}
 	[ -n "$o_subtarget" ] || o_subtarget="generic"
-	o_bindir="bin/targets/$o_target/$o_subtarget"
+	eval "$(grep ^CONFIG_BINARY_FOLDER= .config 2>/dev/null)"
+	o_bindir="${CONFIG_BINARY_FOLDER:-bin}/targets/$o_target/$o_subtarget"
 }
 
-start_qemu_armvirt() {
+start_qemu_armsr() {
 	local kernel="$o_kernel"
 	local rootfs="$o_rootfs"
 	local mach="${o_mach:-virt}"
@@ -169,15 +170,15 @@ start_qemu_armvirt() {
 	local qemu_exe
 
 	case "${o_subtarget%-*}" in
-		32)
+		armv7)
 			qemu_exe="qemu-system-arm"
 			cpu="cortex-a15"
-			[ -n "$kernel" ] || kernel="$o_bindir/openwrt-$o_target-${o_subtarget%-*}-zImage-initramfs"
+			[ -n "$kernel" ] || kernel="$o_bindir/openwrt-$o_target-${o_subtarget%-*}-generic-initramfs-kernel.bin"
 			;;
-		64)
+		armv8)
 			qemu_exe="qemu-system-aarch64"
 			cpu="cortex-a57"
-			[ -n "$kernel" ] || kernel="$o_bindir/openwrt-$o_target-${o_subtarget%-*}-Image-initramfs"
+			[ -n "$kernel" ] || kernel="$o_bindir/openwrt-$o_target-${o_subtarget%-*}-generic-initramfs-kernel.bin"
 			;;
 		*)
 			__errmsg "target $o_target: unknown subtarget $o_subtarget"
@@ -327,7 +328,7 @@ start_qemu_x86() {
 
 start_qemu() {
 	case "$o_target" in
-		armvirt)	start_qemu_armvirt	;;
+		armsr)		start_qemu_armsr	;;
 		malta)		start_qemu_malta	;;
 		x86)		start_qemu_x86		;;
 		*)
diff --git a/scripts/sercomm-kernel-header.py b/scripts/sercomm-kernel-header.py
index bfb29c6fe07b96..40bcbb138534ca 100755
--- a/scripts/sercomm-kernel-header.py
+++ b/scripts/sercomm-kernel-header.py
@@ -48,12 +48,12 @@ def get_kernel_header(args):
 	struct.pack_into('<L', header, 0x2c, rootfs_size)
 	struct.pack_into('<L', header, 0x30, crc)
 
-	rootfs_end_offset = args.rootfs_offset + rootfs_size
-	struct.pack_into('<L', header, 0x4, rootfs_end_offset)
-
 	kernel_size = os.path.getsize(args.kernel_file)
 	struct.pack_into('<L', header, 0x14, kernel_size)
 
+	kernel_end_offset = args.kernel_offset + kernel_size
+	struct.pack_into('<L', header, 0x4, kernel_end_offset)
+
 	buf = open(args.kernel_file,'rb').read()
 	crc = binascii.crc32(buf) & 0xffffffff
 	struct.pack_into('<L', header, 0x18, crc)
diff --git a/scripts/sercomm-payload.py b/scripts/sercomm-payload.py
index 5193069b6c8fb1..2390d5d93a9b32 100755
--- a/scripts/sercomm-payload.py
+++ b/scripts/sercomm-payload.py
@@ -12,11 +12,21 @@ def create_output(args):
 	in_bytes = in_f.read(in_size)
 	in_f.close()
 
+	if (args.pid_file):
+		pid_st = os.stat(args.pid_file)
+		pid_size = pid_st.st_size
+
+		pid_f = open(args.pid_file, 'r+b')
+		pid_bytes = pid_f.read(pid_size)
+		pid_f.close()
+	else:
+		pid_bytes = bytes.fromhex(args.pid)
+
 	sha256 = hashlib.sha256()
 	sha256.update(in_bytes)
 
 	out_f = open(args.output_file, 'w+b')
-	out_f.write(bytes.fromhex(args.pid))
+	out_f.write(pid_bytes)
 	out_f.write(sha256.digest())
 	out_f.write(in_bytes)
 	out_f.close()
@@ -38,6 +48,12 @@ def main():
 		type=str,
 		help='Output file')
 
+	parser.add_argument('--pid-file',
+		dest='pid_file',
+		action='store',
+		type=str,
+		help='Sercomm PID file')
+
 	parser.add_argument('--pid',
 		dest='pid',
 		action='store',
@@ -48,7 +64,7 @@ def main():
 
 	if ((not args.input_file) or
 	    (not args.output_file) or
-	    (not args.pid)):
+	    (not args.pid_file and not args.pid)):
 		parser.print_help()
 
 	create_output(args)
diff --git a/scripts/sercomm-pid.py b/scripts/sercomm-pid.py
index b89977a5b94d1f..4d88a678396f1e 100755
--- a/scripts/sercomm-pid.py
+++ b/scripts/sercomm-pid.py
@@ -27,11 +27,15 @@ def create_pid_file(args):
 def get_pid(args):
 	buf = bytearray([PADDING] * PID_SIZE)
 
-	enc = args.hw_version.rjust(8, '0').encode('ascii')
-	struct.pack_into('>8s', buf, 0x0, enc)
+	if not args.hw_id:
+		enc = args.hw_version.rjust(14, '0').encode('ascii')
+		struct.pack_into('>14s', buf, 0x0, enc)
+	else:
+		enc = args.hw_version.rjust(8, '0').encode('ascii')
+		struct.pack_into('>8s', buf, 0x0, enc)
 
-	enc = binascii.hexlify(args.hw_id.encode())
-	struct.pack_into('>6s', buf, 0x8, enc)
+		enc = binascii.hexlify(args.hw_id.encode())
+		struct.pack_into('>6s', buf, 0x8, enc)
 
 	enc = args.sw_version.rjust(4, '0').encode('ascii')
 	struct.pack_into('>4s', buf, 0x64, enc)
@@ -41,6 +45,9 @@ def get_pid(args):
 		if (args.extra_padd_byte):
 			struct.pack_into ('<i', tail, 0x0,
 					  args.extra_padd_byte)
+		elif not args.hw_id:
+			tail[0] = 0x0D
+			tail[1] = 0x0A
 		buf += tail
 
 	return buf
@@ -91,7 +98,6 @@ def main():
 	args = parser.parse_args()
 
 	if ((not args.hw_version) or
-	    (not args.hw_id) or
 	    (not args.sw_version) or 
 	    (not args.pid_file)):
 		parser.print_help()
diff --git a/scripts/size_compare.sh b/scripts/size_compare.sh
index a5cc3337c74795..8417d25ff26b82 100755
--- a/scripts/size_compare.sh
+++ b/scripts/size_compare.sh
@@ -21,17 +21,20 @@
 ###   -p --package-size 	Check IPK package size and not installed size
 ###   -h --help 		This message
 
-CONFIG_TARGET=$(sed -n 's/^CONFIG_TARGET_BOARD="\(.*\)"$/\1/p' .config)
-CONFIG_SUBTARGET=$(sed -n 's/^CONFIG_TARGET_SUBTARGET="\(.*\)"$/\1/p' .config)
-CONFIG_ARCH=$(sed -n 's/^CONFIG_TARGET_ARCH_PACKAGES="\(.*\)"$/\1/p' .config)
+eval "$(grep \
+	-e ^CONFIG_TARGET_BOARD= \
+	-e ^CONFIG_TARGET_SUBTARGET= \
+	-e ^CONFIG_TARGET_ARCH_PACKAGES= \
+	-e ^CONFIG_BINARY_FOLDER= \
+	.config 2>/dev/null \
+)"
 CONFIG_PACKAGES=$(sed -n 's/^CONFIG_PACKAGE_\(.*\)=y$/\1/p' .config | tr '\n' ' ')
-CONFIG_BIN_DIR=$(sed -n 's/^CONFIG_BINARY_DIR="\(.*\)"$/\1/p' .config)
 
-TARGET=${TARGET:-$CONFIG_TARGET}
-SUBTARGET=${SUBTARGET:-$CONFIG_SUBTARGET}
-ARCH=${ARCH:-$CONFIG_ARCH}
+TARGET=${TARGET:-$CONFIG_TARGET_BOARD}
+SUBTARGET=${SUBTARGET:-$CONFIG_TARGET_SUBTARGET}
+ARCH=${ARCH:-$CONFIG_TARGET_ARCH_PACKAGES}
 PACKAGES=${PACKAGES:-$CONFIG_PACKAGES}
-BIN_DIR=${CONFIG_BIN_DIR:-./bin}
+BIN_DIR=${CONFIG_BINARY_FOLDER:-./bin}
 BASE_URL="${BASE_URL:-https://downloads.openwrt.org/snapshots}"
 CHECK_INSTALLED="${CHECK_INSTALLED:-y}"
 
@@ -72,6 +75,7 @@ package_size () {
 }
 
 compare_sizes () {
+	TOTAL_DIFF="0"
 	for PACKAGE in $PACKAGES; do
 		if [ "$PACKAGE" = "libc" ]; then
 			continue
@@ -89,7 +93,8 @@ compare_sizes () {
 			SIZE_LOCAL=$(tar tzvf "$PACKAGE_FILE" ./data.tar.gz | awk '{ print $3 }')
 		fi
 		SIZE_UPSTREAM=$(package_size "$TMP_INDEX" "$PACKAGE")
-		SIZE_DIFF="$((SIZE_LOCAL-SIZE_UPSTREAM))"
+		SIZE_DIFF="$((SIZE_LOCAL - SIZE_UPSTREAM))"
+		TOTAL_DIFF="$((TOTAL_DIFF + SIZE_DIFF))"
 		if [ "$SIZE_DIFF" -gt 0 ]; then
 			SIZE_DIFF="+$SIZE_DIFF"
 		fi
@@ -99,6 +104,7 @@ compare_sizes () {
 			echo "$PACKAGE is missing upstream"
 		fi
 	done
+	echo "~~~~~~~	total change	${TOTAL_DIFF}"
 }
 
 if [ "$1" = "-h" ]; then
diff --git a/target/Config.in b/target/Config.in
index a6b3351a61886a..ac0f1f9826bf9d 100644
--- a/target/Config.in
+++ b/target/Config.in
@@ -184,6 +184,10 @@ config powerpc64
 	select ARCH_64BIT
 	bool
 
+config riscv64
+	select ARCH_64BIT
+	bool
+
 config sh3
 	bool
 
@@ -223,6 +227,7 @@ config ARCH
 	default "mips64el"  if mips64el
 	default "powerpc"   if powerpc
 	default "powerpc64" if powerpc64
+	default "riscv64"   if riscv64
 	default "sh3"       if sh3
 	default "sh3eb"     if sh3eb
 	default "sh4"       if sh4
diff --git a/target/imagebuilder/files/Makefile b/target/imagebuilder/files/Makefile
index 3329fe70aa192a..5020373792450b 100644
--- a/target/imagebuilder/files/Makefile
+++ b/target/imagebuilder/files/Makefile
@@ -13,6 +13,7 @@ export TOPDIR LC_ALL LANG
 export OPENWRT_VERBOSE=s
 all: help
 
+export ORIG_PATH:=$(if $(ORIG_PATH),$(ORIG_PATH),$(PATH))
 export PATH:=$(TOPDIR)/staging_dir/host/bin:$(PATH)
 
 ifneq ($(OPENWRT_BUILD),1)
@@ -35,8 +36,11 @@ Available Commands:
 	info:	Show a list of available target profiles
 	clean:	Remove images and temporary build files
 	image:	Build an image (see below for more information).
+	manifest: Show all package that will be installed into the image
+	package_whatdepends: Show which packages have a dependency on this
+	package_depends: Show installation dependency of the package
 
-Building images:
+image:
 	By default 'make image' will create an image with the default
 	target profile and package set. You can use the following parameters
 	to change that:
@@ -48,8 +52,9 @@ Building images:
 	make image EXTRA_IMAGE_NAME="<string>" # Add this to the output image filename (sanitized)
 	make image DISABLED_SERVICES="<svc1> [<svc2> [<svc3> ..]]" # Which services in /etc/init.d/ should be disabled
 	make image ADD_LOCAL_KEY=1 # store locally generated signing key in built images
+	make image ROOTFS_PARTSIZE="<size>" # override the default rootfs partition size in MegaBytes
 
-Print manifest:
+manifest:
 	List "all" packages which get installed into the image.
 	You can use the following parameters:
 
@@ -57,6 +62,19 @@ Print manifest:
 	make manifest PACKAGES="<pkg1> [<pkg2> [<pkg3> ...]]" # include extra packages
 	make manifest STRIP_ABI=1 # remove ABI version from printed package names
 
+
+package_whatdepends:
+	List "all" packages that have a dependency on this package
+	You can use the following parameters:
+
+	make package_whatdepends PACKAGE="<pkg>"
+
+package_depends:
+	List "all" packages dependency of the package
+	You can use the following parameters:
+
+	make package_depends PACKAGE="<pkg>"
+
 endef
 $(eval $(call shexport,Helptext))
 
@@ -245,7 +263,8 @@ image:
 		$(if $(FILES),USER_FILES="$(FILES)") \
 		$(if $(PACKAGES),USER_PACKAGES="$(PACKAGES)") \
 		$(if $(BIN_DIR),BIN_DIR="$(BIN_DIR)") \
-		$(if $(DISABLED_SERVICES),DISABLED_SERVICES="$(DISABLED_SERVICES)"))
+		$(if $(DISABLED_SERVICES),DISABLED_SERVICES="$(DISABLED_SERVICES)") \
+		$(if $(ROOTFS_PARTSIZE),CONFIG_TARGET_ROOTFS_PARTSIZE="$(ROOTFS_PARTSIZE)"))
 
 manifest: FORCE
 	$(MAKE) -s _check_profile
@@ -255,7 +274,7 @@ manifest: FORCE
 		$(if $(PROFILE),USER_PROFILE="$(PROFILE_FILTER)") \
 		$(if $(PACKAGES),USER_PACKAGES="$(PACKAGES)"))
 
-whatdepends: FORCE
+package_whatdepends: FORCE
 ifeq ($(PACKAGE),)
 	@echo 'Variable `PACKAGE` is not set but required by `whatdepends`'
 	@exit 1
@@ -263,4 +282,13 @@ endif
 	@$(MAKE) -s package_reload
 	@$(OPKG) whatdepends -A $(PACKAGE)
 
-.SILENT: help info image manifest whatdepends
+package_depends: FORCE
+ifeq ($(PACKAGE),)
+	@echo 'Variable `PACKAGE` is not set but required by `package_depends`'
+	@exit 1
+endif
+	@$(MAKE) -s package_reload
+	@$(OPKG) depends -A $(PACKAGE)
+
+
+.SILENT: help info image manifest package_whatdepends package_depends
diff --git a/target/linux/Makefile b/target/linux/Makefile
index a939d42bc05463..8eea40ee18a6dd 100644
--- a/target/linux/Makefile
+++ b/target/linux/Makefile
@@ -8,4 +8,4 @@ include $(INCLUDE_DIR)/target.mk
 export TARGET_BUILD=1
 
 prereq clean download prepare compile install oldconfig menuconfig nconfig xconfig update refresh: FORCE
-	@+$(NO_TRACE_MAKE) -C $(BOARD) $@
+	@+$(NO_TRACE_MAKE) -C $(firstword $(wildcard feeds/$(BOARD) $(BOARD))) $@
diff --git a/target/linux/airoha/config-5.15 b/target/linux/airoha/config-5.15
index 0fbf8a49959d35..ae6c1d5089faa4 100644
--- a/target/linux/airoha/config-5.15
+++ b/target/linux/airoha/config-5.15
@@ -18,6 +18,7 @@ CONFIG_ARM_AMBA=y
 CONFIG_ARM_ARCH_TIMER=y
 CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
 CONFIG_ARM_CPU_SUSPEND=y
+CONFIG_ARM_CRYPTO=y
 CONFIG_ARM_GIC=y
 CONFIG_ARM_GIC_V3=y
 CONFIG_ARM_GIC_V3_ITS=y
@@ -44,8 +45,6 @@ CONFIG_BLK_PM=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
 CONFIG_CACHE_L2X0=y
-# CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE is not set
-CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CMDLINE="rootfstype=squashfs,jffs2"
 CONFIG_CMDLINE_FROM_BOOTLOADER=y
@@ -118,13 +117,11 @@ CONFIG_GENERIC_STRNCPY_FROM_USER=y
 CONFIG_GENERIC_STRNLEN_USER=y
 CONFIG_GENERIC_TIME_VSYSCALL=y
 CONFIG_GENERIC_VDSO_32=y
-CONFIG_GPIOLIB=y
 CONFIG_GPIOLIB_IRQCHIP=y
 CONFIG_GPIO_CDEV=y
 CONFIG_GPIO_EN7523=y
 CONFIG_GPIO_GENERIC=y
 CONFIG_HANDLE_DOMAIN_IRQ=y
-CONFIG_HARDENED_USERCOPY=y
 CONFIG_HARDEN_BRANCH_PREDICTOR=y
 CONFIG_HARDIRQS_SW_RESEND=y
 CONFIG_HAS_DMA=y
@@ -139,7 +136,6 @@ CONFIG_INITRAMFS_SOURCE=""
 # CONFIG_IOMMU_IO_PGTABLE_ARMV7S is not set
 # CONFIG_IOMMU_IO_PGTABLE_LPAE is not set
 CONFIG_IOMMU_SUPPORT=y
-CONFIG_IO_URING=y
 CONFIG_IRQCHIP=y
 CONFIG_IRQ_DOMAIN=y
 CONFIG_IRQ_DOMAIN_HIERARCHY=y
@@ -173,6 +169,8 @@ CONFIG_MTD_UBI_BLOCK=y
 CONFIG_MTD_UBI_WL_THRESHOLD=4096
 CONFIG_MUTEX_SPIN_ON_OWNER=y
 CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_SELFTESTS=y
 CONFIG_NLS=y
 CONFIG_NO_HZ_COMMON=y
 CONFIG_NO_HZ_IDLE=y
@@ -187,6 +185,8 @@ CONFIG_OF_GPIO=y
 CONFIG_OF_IRQ=y
 CONFIG_OF_KOBJ=y
 CONFIG_OF_MDIO=y
+CONFIG_OLD_SIGACTION=y
+CONFIG_OLD_SIGSUSPEND3=y
 CONFIG_OUTER_CACHE=y
 CONFIG_OUTER_CACHE_SYNC=y
 CONFIG_PADATA=y
@@ -238,7 +238,6 @@ CONFIG_SPI_MEM=y
 CONFIG_SRCU=y
 CONFIG_STACKTRACE=y
 # CONFIG_SWAP is not set
-CONFIG_SWCONFIG=y
 CONFIG_SWPHY=y
 CONFIG_SWP_EMULATE=y
 CONFIG_SYS_SUPPORTS_APM_EMULATION=y
diff --git a/target/linux/airoha/generic/target.mk b/target/linux/airoha/generic/target.mk
new file mode 100644
index 00000000000000..f5cb1fb19b943f
--- /dev/null
+++ b/target/linux/airoha/generic/target.mk
@@ -0,0 +1 @@
+BOARDNAME:=Generic
diff --git a/target/linux/airoha/patches-5.15/0001-add-airoha-platform.patch b/target/linux/airoha/patches-5.15/0001-add-airoha-platform.patch
index b1f88a6ac7b0f3..bb1104206e2a6d 100644
--- a/target/linux/airoha/patches-5.15/0001-add-airoha-platform.patch
+++ b/target/linux/airoha/patches-5.15/0001-add-airoha-platform.patch
@@ -1,11 +1,9 @@
-diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
-index 66f5d6c3..05cd3385 100644
 --- a/arch/arm/Kconfig
 +++ b/arch/arm/Kconfig
 @@ -571,6 +571,18 @@ config ARCH_VIRT
-	select HAVE_ARM_ARCH_TIMER
-	select ARCH_SUPPORTS_BIG_ENDIAN
-
+ 	select HAVE_ARM_ARCH_TIMER
+ 	select ARCH_SUPPORTS_BIG_ENDIAN
+ 
 +config ARCH_AIROHA
 +	bool "Airoha SoC Support"
 +	depends on ARCH_MULTI_V7
@@ -21,11 +19,9 @@ index 66f5d6c3..05cd3385 100644
  #
  # This is sorted alphabetically by mach-* pathname.  However, plat-*
  # Kconfigs may be included either alphabetically (according to the
-diff --git a/arch/arm/Makefile b/arch/arm/Makefile
-index fa45837b..c34f7463 100644
 --- a/arch/arm/Makefile
 +++ b/arch/arm/Makefile
-@@ -156,6 +156,7 @@ textofs-$(CONFIG_ARCH_AXXIA) := 0x00308000
+@@ -156,6 +156,7 @@ textofs-$(CONFIG_ARCH_AXXIA) := 0x003080
  # Machine directory name.  This list is sorted alphanumerically
  # by CONFIG_* macro name.
  machine-$(CONFIG_ARCH_ACTIONS)		+= actions
diff --git a/target/linux/airoha/patches-5.15/0002-add-airoha-en7523-clk-driver.patch b/target/linux/airoha/patches-5.15/0002-add-airoha-en7523-clk-driver.patch
index 676e0f40bbc89b..bae5cacc5e73f0 100644
--- a/target/linux/airoha/patches-5.15/0002-add-airoha-en7523-clk-driver.patch
+++ b/target/linux/airoha/patches-5.15/0002-add-airoha-en7523-clk-driver.patch
@@ -1,11 +1,9 @@
-diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig
-index c5b3dc97..c973ac1a 100644
 --- a/drivers/clk/Kconfig
 +++ b/drivers/clk/Kconfig
 @@ -192,6 +192,15 @@ config COMMON_CLK_CS2000_CP
-	help
-	  If you say yes here you get support for the CS2000 clock multiplier.
-
+ 	help
+ 	  If you say yes here you get support for the CS2000 clock multiplier.
+ 
 +config COMMON_CLK_EN7523
 +	bool "Clock driver for Airoha EN7523 SoC system clocks"
 +	depends on OF
@@ -16,13 +14,11 @@ index c5b3dc97..c973ac1a 100644
 +	  ARM silicon.
 +
  config COMMON_CLK_FSL_FLEXSPI
-	tristate "Clock driver for FlexSPI on Layerscape SoCs"
-	depends on ARCH_LAYERSCAPE || COMPILE_TEST
-diff --git a/drivers/clk/Makefile b/drivers/clk/Makefile
-index e4231212..be11d88c 100644
+ 	tristate "Clock driver for FlexSPI on Layerscape SoCs"
+ 	depends on ARCH_LAYERSCAPE || COMPILE_TEST
 --- a/drivers/clk/Makefile
 +++ b/drivers/clk/Makefile
-@@ -27,6 +27,7 @@ obj-$(CONFIG_COMMON_CLK_CDCE925)	+= clk-cdce925.o
+@@ -27,6 +27,7 @@ obj-$(CONFIG_COMMON_CLK_CDCE925)	+= clk-
  obj-$(CONFIG_ARCH_CLPS711X)		+= clk-clps711x.o
  obj-$(CONFIG_COMMON_CLK_CS2000_CP)	+= clk-cs2000-cp.o
  obj-$(CONFIG_ARCH_SPARX5)		+= clk-sparx5.o
diff --git a/target/linux/airoha/patches-5.15/0003-add-airoha-en7523-gpio-driver.patch b/target/linux/airoha/patches-5.15/0003-add-airoha-en7523-gpio-driver.patch
index 1d95e6b2c82713..319336257b9ed9 100644
--- a/target/linux/airoha/patches-5.15/0003-add-airoha-en7523-gpio-driver.patch
+++ b/target/linux/airoha/patches-5.15/0003-add-airoha-en7523-gpio-driver.patch
@@ -1,11 +1,9 @@
-diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
-index cbfb6f13..b3106df6 100644
 --- a/drivers/gpio/Kconfig
 +++ b/drivers/gpio/Kconfig
 @@ -247,6 +247,16 @@ config GPIO_EM
-	help
-	  Say yes here to support GPIO on Renesas Emma Mobile SoCs.
-
+ 	help
+ 	  Say yes here to support GPIO on Renesas Emma Mobile SoCs.
+ 
 +config GPIO_EN7523
 +	tristate "Airoha GPIO support"
 +	depends on ARCH_AIROHA
@@ -17,10 +15,8 @@ index cbfb6f13..b3106df6 100644
 +	  Airoha EN7523 SoC. It supports two banks of 32 GPIOs.
 +
  config GPIO_EP93XX
-	def_bool y
-	depends on ARCH_EP93XX
-diff --git a/drivers/gpio/Makefile b/drivers/gpio/Makefile
-index 61202717..4c73ce82 100644
+ 	def_bool y
+ 	depends on ARCH_EP93XX
 --- a/drivers/gpio/Makefile
 +++ b/drivers/gpio/Makefile
 @@ -57,6 +57,7 @@ obj-$(CONFIG_GPIO_DLN2)			+= gpio-dln2.o
diff --git a/target/linux/airoha/patches-5.15/0004-ARM-9124-1-uncompress-Parse-linux-usable-memory-rang.patch b/target/linux/airoha/patches-5.15/0004-ARM-9124-1-uncompress-Parse-linux-usable-memory-rang.patch
index f13ab2b0ed2c33..0f0cbaa10ffe68 100644
--- a/target/linux/airoha/patches-5.15/0004-ARM-9124-1-uncompress-Parse-linux-usable-memory-rang.patch
+++ b/target/linux/airoha/patches-5.15/0004-ARM-9124-1-uncompress-Parse-linux-usable-memory-rang.patch
@@ -21,11 +21,9 @@ Signed-off-by: Daniel Danzberger <daniel@dd-wrt.com>
  .../arm/boot/compressed/fdt_check_mem_start.c | 48 ++++++++++++++++---
  1 file changed, 42 insertions(+), 6 deletions(-)
 
-diff --git a/arch/arm/boot/compressed/fdt_check_mem_start.c b/arch/arm/boot/compressed/fdt_check_mem_start.c
-index 62450d824c3c..9291a2661bdf 100644
 --- a/arch/arm/boot/compressed/fdt_check_mem_start.c
 +++ b/arch/arm/boot/compressed/fdt_check_mem_start.c
-@@ -55,16 +55,17 @@ static uint64_t get_val(const fdt32_t *cells, uint32_t ncells)
+@@ -55,16 +55,17 @@ static uint64_t get_val(const fdt32_t *c
   * DTB, and, if out-of-range, replace it by the real start address.
   * To preserve backwards compatibility (systems reserving a block of memory
   * at the start of physical memory, kdump, ...), the traditional method is
@@ -39,18 +37,18 @@ index 62450d824c3c..9291a2661bdf 100644
  {
 -	uint32_t addr_cells, size_cells, base;
 +	uint32_t addr_cells, size_cells, usable_base, base;
-	uint32_t fdt_mem_start = 0xffffffff;
+ 	uint32_t fdt_mem_start = 0xffffffff;
 -	const fdt32_t *reg, *endp;
 -	uint64_t size, end;
 +	const fdt32_t *usable, *reg, *endp;
 +	uint64_t size, usable_end, end;
-	const char *type;
-	int offset, len;
-
-@@ -80,6 +81,27 @@ uint32_t fdt_check_mem_start(uint32_t mem_start, const void *fdt)
-	if (addr_cells > 2 || size_cells > 2)
-		return mem_start;
-
+ 	const char *type;
+ 	int offset, len;
+ 
+@@ -80,6 +81,27 @@ uint32_t fdt_check_mem_start(uint32_t me
+ 	if (addr_cells > 2 || size_cells > 2)
+ 		return mem_start;
+ 
 +	/*
 +	 * Usable memory in case of a crash dump kernel
 +	 * This property describes a limitation: memory within this range is
@@ -72,13 +70,13 @@ index 62450d824c3c..9291a2661bdf 100644
 +		usable_end = usable_base + size;
 +	}
 +
-	/* Walk all memory nodes and regions */
-	for (offset = fdt_next_node(fdt, -1, NULL); offset >= 0;
-	     offset = fdt_next_node(fdt, offset, NULL)) {
-@@ -107,7 +129,20 @@ uint32_t fdt_check_mem_start(uint32_t mem_start, const void *fdt)
-
-			base = fdt32_ld(reg + addr_cells - 1);
-			end = base + size;
+ 	/* Walk all memory nodes and regions */
+ 	for (offset = fdt_next_node(fdt, -1, NULL); offset >= 0;
+ 	     offset = fdt_next_node(fdt, offset, NULL)) {
+@@ -107,7 +129,20 @@ uint32_t fdt_check_mem_start(uint32_t me
+ 
+ 			base = fdt32_ld(reg + addr_cells - 1);
+ 			end = base + size;
 -			if (mem_start >= base && mem_start < end) {
 +			if (usable) {
 +				/*
@@ -94,18 +92,16 @@ index 62450d824c3c..9291a2661bdf 100644
 +				if (end <= base)
 +					continue;
 +			} else if (mem_start >= base && mem_start < end) {
-				/* Calculated address is valid, use it */
-				return mem_start;
-			}
-@@ -123,7 +158,8 @@ uint32_t fdt_check_mem_start(uint32_t mem_start, const void *fdt)
-	}
-
-	/*
+ 				/* Calculated address is valid, use it */
+ 				return mem_start;
+ 			}
+@@ -123,7 +158,8 @@ uint32_t fdt_check_mem_start(uint32_t me
+ 	}
+ 
+ 	/*
 -	 * The calculated address is not usable.
 +	 * The calculated address is not usable, or was overridden by the
 +	 * "linux,usable-memory-range" property.
-	 * Use the lowest usable physical memory address from the DTB instead,
-	 * and make sure this is a multiple of 2 MiB for phys/virt patching.
-	 */
---
-2.35.1
+ 	 * Use the lowest usable physical memory address from the DTB instead,
+ 	 * and make sure this is a multiple of 2 MiB for phys/virt patching.
+ 	 */
diff --git a/target/linux/airoha/patches-5.15/0005-spi-Add-support-for-the-Airoha-EN7523-SoC-SPI-contro.patch b/target/linux/airoha/patches-5.15/0005-spi-Add-support-for-the-Airoha-EN7523-SoC-SPI-contro.patch
index e368acc0cf7fde..6c21666ed11c51 100644
--- a/target/linux/airoha/patches-5.15/0005-spi-Add-support-for-the-Airoha-EN7523-SoC-SPI-contro.patch
+++ b/target/linux/airoha/patches-5.15/0005-spi-Add-support-for-the-Airoha-EN7523-SoC-SPI-contro.patch
@@ -1,11 +1,9 @@
-diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
-index 83e352b0..5f7defe4 100644
 --- a/drivers/spi/Kconfig
 +++ b/drivers/spi/Kconfig
-@@ -308,6 +308,12 @@ config SPI_DLN2
-	 This driver can also be built as a module.  If so, the module
-	 will be called spi-dln2.
-
+@@ -307,6 +307,12 @@ config SPI_DLN2
+ 	 This driver can also be built as a module.  If so, the module
+ 	 will be called spi-dln2.
+ 
 +config SPI_AIROHA_EN7523
 +	bool "Airoha EN7523 SPI controller support"
 +	depends on ARCH_AIROHA
@@ -13,13 +11,11 @@ index 83e352b0..5f7defe4 100644
 +	  This enables SPI controller support for the Airoha EN7523 SoC.
 +
  config SPI_EP93XX
-	tristate "Cirrus Logic EP93xx SPI controller"
-	depends on ARCH_EP93XX || COMPILE_TEST
-diff --git a/drivers/spi/Makefile b/drivers/spi/Makefile
-index 699db95c..6c9460f7 100644
+ 	tristate "Cirrus Logic EP93xx SPI controller"
+ 	depends on ARCH_EP93XX || COMPILE_TEST
 --- a/drivers/spi/Makefile
 +++ b/drivers/spi/Makefile
-@@ -45,6 +45,7 @@ obj-$(CONFIG_SPI_DW_BT1)		+= spi-dw-bt1.o
+@@ -45,6 +45,7 @@ obj-$(CONFIG_SPI_DW_BT1)		+= spi-dw-bt1.
  obj-$(CONFIG_SPI_DW_MMIO)		+= spi-dw-mmio.o
  obj-$(CONFIG_SPI_DW_PCI)		+= spi-dw-pci.o
  obj-$(CONFIG_SPI_EP93XX)		+= spi-ep93xx.o
@@ -27,12 +23,9 @@ index 699db95c..6c9460f7 100644
  obj-$(CONFIG_SPI_FALCON)		+= spi-falcon.o
  obj-$(CONFIG_SPI_FSI)			+= spi-fsi.o
  obj-$(CONFIG_SPI_FSL_CPM)		+= spi-fsl-cpm.o
-diff --git a/drivers/spi/spi-en7523.c b/drivers/spi/spi-en7523.c
-new file mode 100644
-index 00000000..322bf2eb
 --- /dev/null
 +++ b/drivers/spi/spi-en7523.c
-@@ -0,0 +1,311 @@
+@@ -0,0 +1,313 @@
 +// SPDX-License-Identifier: GPL-2.0
 +
 +#include <linux/module.h>
@@ -173,6 +166,7 @@ index 00000000..322bf2eb
 +	}
 +}
 +
++#if 0
 +static void set_spi_clock_speed(int freq_mhz)
 +{
 +	u32 tmp, val;
@@ -185,6 +179,7 @@ index 00000000..322bf2eb
 +	tmp |= (val << 8) | 1;
 +	writel(tmp, ENSPI_CLOCK_DIVIDER);
 +}
++#endif
 +
 +static void init_hw(void)
 +{
diff --git a/target/linux/airoha/patches-5.15/0006-PCI-mediatek-Allow-building-for-ARCH_AIROHA.patch b/target/linux/airoha/patches-5.15/0006-PCI-mediatek-Allow-building-for-ARCH_AIROHA.patch
index 9f51f281bcf8f8..465980907430fc 100644
--- a/target/linux/airoha/patches-5.15/0006-PCI-mediatek-Allow-building-for-ARCH_AIROHA.patch
+++ b/target/linux/airoha/patches-5.15/0006-PCI-mediatek-Allow-building-for-ARCH_AIROHA.patch
@@ -18,18 +18,14 @@ Signed-off-by: Daniel Danzberger <daniel@dd-wrt.com>
  drivers/pci/controller/Kconfig | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
-diff --git a/drivers/pci/controller/Kconfig b/drivers/pci/controller/Kconfig
-index b8d96d38064d..2f6806dc2a20 100644
 --- a/drivers/pci/controller/Kconfig
 +++ b/drivers/pci/controller/Kconfig
-@@ -237,7 +237,7 @@ config PCIE_ROCKCHIP_EP
-
+@@ -233,7 +233,7 @@ config PCIE_ROCKCHIP_EP
+ 
  config PCIE_MEDIATEK
-	tristate "MediaTek PCIe controller"
+ 	tristate "MediaTek PCIe controller"
 -	depends on ARCH_MEDIATEK || COMPILE_TEST
 +	depends on ARCH_AIROHA || ARCH_MEDIATEK || COMPILE_TEST
-	depends on OF
-	depends on PCI_MSI_IRQ_DOMAIN
-	help
---
-2.35.1
+ 	depends on OF
+ 	depends on PCI_MSI_IRQ_DOMAIN
+ 	help
diff --git a/target/linux/apm821xx/Makefile b/target/linux/apm821xx/Makefile
index 875ff225a90c18..e5e2841fd34afc 100644
--- a/target/linux/apm821xx/Makefile
+++ b/target/linux/apm821xx/Makefile
@@ -9,8 +9,8 @@ CPU_TYPE:=464fp
 FEATURES:=fpu dt gpio ramdisk squashfs usb
 SUBTARGETS:=nand sata
 
-KERNEL_PATCHVER:=5.10
-KERNEL_TESTING_PATCHVER:=5.15
+KERNEL_PATCHVER:=5.15
+KERNEL_TESTING_PATCHVER:=6.1
 
 define Target/Description
 	Build images for AppliedMicro APM821xx based boards.
@@ -21,6 +21,7 @@ include $(INCLUDE_DIR)/target.mk
 KERNELNAME:=uImage
 
 DEFAULT_PACKAGES += \
-	kmod-leds-gpio kmod-i2c-core kmod-gpio-button-hotplug uboot-envtools
+	kmod-leds-gpio kmod-i2c-core kmod-gpio-button-hotplug uboot-envtools \
+	kmod-hw-crypto-4xx
 
 $(eval $(call BuildTarget))
diff --git a/target/linux/apm821xx/config-5.15 b/target/linux/apm821xx/config-5.15
index 7cb81d7fddc985..adcccbe567c26b 100644
--- a/target/linux/apm821xx/config-5.15
+++ b/target/linux/apm821xx/config-5.15
@@ -38,17 +38,12 @@ CONFIG_CPU_BIG_ENDIAN=y
 CONFIG_CRC16=y
 # CONFIG_CRC32_SARWATE is not set
 CONFIG_CRC32_SLICEBY8=y
-CONFIG_CRYPTO_BLAKE2S=y
 CONFIG_CRYPTO_DEFLATE=y
-CONFIG_CRYPTO_DEV_PPC4XX=y
-CONFIG_CRYPTO_HW=y
 CONFIG_CRYPTO_JITTERENTROPY=y
 CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
 CONFIG_CRYPTO_LIB_POLY1305_RSIZE=1
 CONFIG_CRYPTO_LZO=y
 # CONFIG_CRYPTO_MD5_PPC is not set
-CONFIG_CRYPTO_RNG=y
-CONFIG_CRYPTO_RNG2=y
 # CONFIG_CRYPTO_SHA1_PPC is not set
 CONFIG_DATA_SHIFT=12
 CONFIG_DMADEVICES=y
@@ -76,7 +71,6 @@ CONFIG_GENERIC_BUG=y
 CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CMOS_UPDATE=y
-CONFIG_GENERIC_CPU=y
 CONFIG_GENERIC_CPU_AUTOPROBE=y
 CONFIG_GENERIC_EARLY_IOREMAP=y
 CONFIG_GENERIC_GETTIMEOFDAY=y
@@ -98,8 +92,6 @@ CONFIG_GPIO_GENERIC_PLATFORM=y
 CONFIG_HAS_DMA=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT_MAP=y
-CONFIG_HW_RANDOM=y
-CONFIG_HW_RANDOM_PPC4XX=y
 CONFIG_I2C=y
 CONFIG_I2C_BOARDINFO=y
 CONFIG_I2C_CHARDEV=y
@@ -180,6 +172,7 @@ CONFIG_PHYSICAL_START=0x00000000
 CONFIG_PHYS_64BIT=y
 CONFIG_PHYS_ADDR_T_64BIT=y
 # CONFIG_PMU_SYSFS is not set
+# CONFIG_POWERPC_CPU is not set
 CONFIG_PPC=y
 CONFIG_PPC32=y
 CONFIG_PPC44x_SIMPLE=y
@@ -233,6 +226,7 @@ CONFIG_THREAD_INFO_IN_TASK=y
 CONFIG_THREAD_SHIFT=13
 CONFIG_TICK_CPU_ACCOUNTING=y
 CONFIG_TINY_SRCU=y
+CONFIG_TOOLCHAIN_DEFAULT_CPU=y
 CONFIG_USB_SUPPORT=y
 CONFIG_VDSO32=y
 # CONFIG_VIRTIO_MENU is not set
diff --git a/target/linux/apm821xx/config-6.1 b/target/linux/apm821xx/config-6.1
new file mode 100644
index 00000000000000..9e51e94a2f5c1e
--- /dev/null
+++ b/target/linux/apm821xx/config-6.1
@@ -0,0 +1,250 @@
+# CONFIG_40x is not set
+# CONFIG_440_CPU is not set
+CONFIG_44x=y
+CONFIG_464_CPU=y
+CONFIG_4xx=y
+CONFIG_4xx_SOC=y
+# CONFIG_ADVANCED_OPTIONS is not set
+CONFIG_APM821xx=y
+# CONFIG_APOLLO3G is not set
+# CONFIG_ARCHES is not set
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_ARCH_FORCE_MAX_ORDER=11
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+CONFIG_ARCH_MIGHT_HAVE_PC_SERIO=y
+CONFIG_ARCH_MMAP_RND_BITS=11
+CONFIG_ARCH_MMAP_RND_BITS_MAX=17
+CONFIG_ARCH_MMAP_RND_BITS_MIN=11
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=17
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=11
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT=y
+CONFIG_ARCH_SPLIT_ARG64=y
+CONFIG_ARCH_STACKWALK=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARCH_WEAK_RELEASE_ACQUIRE=y
+CONFIG_AUDIT_ARCH=y
+# CONFIG_BAMBOO is not set
+# CONFIG_BLK_DEV_INITRD is not set
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLUESTONE=y
+CONFIG_BOOKE=y
+CONFIG_BOOKE_OR_40x=y
+CONFIG_BOOKE_WDT=y
+# CONFIG_CANYONLANDS is not set
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CMDLINE="rootfstype=squashfs noinitrd"
+CONFIG_CMDLINE_FROM_BOOTLOADER=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CRC16=y
+# CONFIG_CRC32_SARWATE is not set
+CONFIG_CRC32_SLICEBY8=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_JITTERENTROPY=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=1
+CONFIG_CRYPTO_LIB_SHA1=y
+CONFIG_CRYPTO_LIB_UTILS=y
+CONFIG_CRYPTO_LZO=y
+# CONFIG_CRYPTO_MD5_PPC is not set
+# CONFIG_CRYPTO_SHA1_PPC is not set
+CONFIG_DATA_SHIFT=12
+CONFIG_DMADEVICES=y
+CONFIG_DMA_DIRECT_REMAP=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_OF=y
+CONFIG_DTC=y
+CONFIG_DW_DMAC=y
+CONFIG_DW_DMAC_CORE=y
+CONFIG_EARLY_PRINTK=y
+# CONFIG_EBONY is not set
+CONFIG_EDAC_ATOMIC_SCRUB=y
+CONFIG_EDAC_SUPPORT=y
+# CONFIG_EIGER is not set
+CONFIG_EXCLUSIVE_SYSTEM_RAM=y
+CONFIG_EXTRA_TARGETS="uImage"
+CONFIG_FIXED_PHY=y
+CONFIG_FORCE_PCI=y
+# CONFIG_FSL_LBC is not set
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_FW_LOADER_SYSFS=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_ISA_DMA=y
+CONFIG_GENERIC_MSI_IRQ=y
+CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+# CONFIG_GEN_RTC is not set
+# CONFIG_GLACIER is not set
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_I2C=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_IBM_IIC=y
+CONFIG_IBM_EMAC=y
+CONFIG_IBM_EMAC_EMAC4=y
+CONFIG_IBM_EMAC_POLL_WEIGHT=32
+CONFIG_IBM_EMAC_RGMII=y
+CONFIG_IBM_EMAC_RXB=128
+CONFIG_IBM_EMAC_RX_COPY_THRESHOLD=256
+CONFIG_IBM_EMAC_TAH=y
+CONFIG_IBM_EMAC_TXB=128
+# CONFIG_ICON is not set
+CONFIG_ILLEGAL_POINTER_VALUE=0
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+CONFIG_ISA_DMA_API=y
+# CONFIG_JFFS2_FS is not set
+# CONFIG_KATMAI is not set
+CONFIG_KERNEL_START=0xc0000000
+CONFIG_LEDS_TRIGGER_MTD=y
+CONFIG_LEDS_TRIGGER_PATTERN=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOWMEM_SIZE=0x30000000
+# CONFIG_MATH_EMULATION is not set
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MIGRATION=y
+CONFIG_MMU_GATHER_PAGE_SIZE=y
+CONFIG_MODULES_USE_ELF_RELA=y
+CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS=y
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+# CONFIG_MTD_CFI_GEOMETRY is not set
+# CONFIG_MTD_SPLIT_SQUASHFS_ROOT is not set
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_PER_CPU_KM=y
+CONFIG_NEED_SG_DMA_LENGTH=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NOT_COHERENT_CACHE=y
+CONFIG_NO_HZ=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NR_CPUS=1
+CONFIG_NR_IRQS=512
+CONFIG_NVMEM=y
+CONFIG_NVMEM_SYSFS=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_OLD_SIGACTION=y
+CONFIG_OLD_SIGSUSPEND=y
+CONFIG_PACKING=y
+CONFIG_PAGE_OFFSET=0xc0000000
+CONFIG_PCI=y
+CONFIG_PCIEAER=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCI_DISABLE_COMMON_QUIRKS=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_MSI=y
+CONFIG_PCI_MSI_ARCH_FALLBACKS=y
+CONFIG_PCI_MSI_IRQ_DOMAIN=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYSICAL_START=0x00000000
+CONFIG_PHYS_64BIT=y
+CONFIG_PHYS_ADDR_T_64BIT=y
+# CONFIG_PMU_SYSFS is not set
+CONFIG_PPC=y
+CONFIG_PPC32=y
+CONFIG_PPC44x_SIMPLE=y
+CONFIG_PPC4xx_GPIO=y
+CONFIG_PPC4xx_PCI_EXPRESS=y
+# CONFIG_PPC64 is not set
+# CONFIG_PPC_47x is not set
+# CONFIG_PPC_85xx is not set
+# CONFIG_PPC_8xx is not set
+CONFIG_PPC_ADV_DEBUG_DACS=2
+CONFIG_PPC_ADV_DEBUG_DAC_RANGE=y
+CONFIG_PPC_ADV_DEBUG_DVCS=2
+CONFIG_PPC_ADV_DEBUG_IACS=4
+CONFIG_PPC_ADV_DEBUG_REGS=y
+# CONFIG_PPC_BOOK3S_32 is not set
+CONFIG_PPC_DCR=y
+CONFIG_PPC_DCR_NATIVE=y
+# CONFIG_PPC_EARLY_DEBUG is not set
+CONFIG_PPC_FPU=y
+CONFIG_PPC_FPU_REGS=y
+CONFIG_PPC_INDIRECT_PCI=y
+CONFIG_PPC_KUAP=y
+# CONFIG_PPC_KUAP_DEBUG is not set
+CONFIG_PPC_KUEP=y
+CONFIG_PPC_MMU_NOHASH=y
+CONFIG_PPC_PAGE_SHIFT=12
+# CONFIG_PPC_PCI_BUS_NUM_DOMAIN_DEPENDENT is not set
+CONFIG_PPC_UDBG_16550=y
+CONFIG_PPC_WERROR=y
+CONFIG_PTE_64BIT=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+# CONFIG_RAINIER is not set
+CONFIG_RAS=y
+CONFIG_RATIONAL=y
+CONFIG_REGULATOR=y
+CONFIG_RSEQ=y
+# CONFIG_SAM440EP is not set
+# CONFIG_SCOM_DEBUGFS is not set
+# CONFIG_SEQUOIA is not set
+# CONFIG_SERIAL_8250_FSL is not set
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SRCU=y
+# CONFIG_STATIC_CALL_SELFTEST is not set
+CONFIG_SWPHY=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+# CONFIG_TAISHAN is not set
+CONFIG_TARGET_CPU="464"
+CONFIG_TARGET_CPU_BOOL=y
+CONFIG_TASK_SIZE=0xc0000000
+CONFIG_THREAD_INFO_IN_TASK=y
+CONFIG_THREAD_SHIFT=13
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TINY_SRCU=y
+# CONFIG_TOOLCHAIN_DEFAULT_CPU is not set
+CONFIG_USB_SUPPORT=y
+CONFIG_VDSO32=y
+# CONFIG_VIRTIO_MENU is not set
+# CONFIG_VIRT_CPU_ACCOUNTING_NATIVE is not set
+# CONFIG_WARP is not set
+CONFIG_WATCHDOG_CORE=y
+CONFIG_XZ_DEC_BCJ=y
+CONFIG_XZ_DEC_POWERPC=y
+# CONFIG_YOSEMITE is not set
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
diff --git a/target/linux/apm821xx/dts/meraki-mx60.dts b/target/linux/apm821xx/dts/meraki-mx60.dts
index 33f9a3d9f78719..0e343ed7825e2b 100644
--- a/target/linux/apm821xx/dts/meraki-mx60.dts
+++ b/target/linux/apm821xx/dts/meraki-mx60.dts
@@ -47,8 +47,6 @@
 	status = "okay";
 
 	nand {
-		nand-is-boot-medium;
-
 		partitions {
 			compatible = "fixed-partitions";
 			#address-cells = <1>;
diff --git a/target/linux/apm821xx/image/Makefile b/target/linux/apm821xx/image/Makefile
index f4701e9f26320c..03799bcc1061d4 100644
--- a/target/linux/apm821xx/image/Makefile
+++ b/target/linux/apm821xx/image/Makefile
@@ -3,14 +3,12 @@
 include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/image.mk
 
-DEVICE_VARS += DTB_SIZE
-
 define Build/boot-img
 	$(RM) -rf $@.bootdir
 	mkdir -p $@.bootdir/boot
 
 	$(CP) $@.scr $@.bootdir/boot/boot.scr
-	$(CP) $(IMAGE_KERNEL).dtb $@.bootdir/boot/$(DEVICE_DTB)
+	$(CP) $(KDIR)/image-$(firstword $(DEVICE_DTS)).dtb $@.bootdir/boot/$(DEVICE_DTB)
 	$(CP) $(IMAGE_KERNEL) $@.bootdir/boot/uImage
 
 	genext2fs --block-size $(BLOCKSIZE:%k=%Ki) \
@@ -28,12 +26,8 @@ define Build/boot-script
 		$@.scr
 endef
 
-define Build/dtb
-	$(call Image/BuildDTB,../dts/$(DEVICE_DTS).dts,$@.dtb,,--space $(DTB_SIZE))
-endef
-
 define Build/export-dtb
-	cp $(IMAGE_KERNEL).dtb $@
+	cp $(KDIR)/image-$(firstword $(DEVICE_DTS)).dtb $@
 endef
 
 define Build/MuImage-initramfs
@@ -58,15 +52,15 @@ define Build/MuImage-initramfs
 	# part of the legacy multi image. Since we need to put the
 	# device tree stuff into part 3.
 
-	-$(STAGING_DIR_HOST)/bin/mkimage -A $(LINUX_KARCH) -O linux -T multi \
-		-C $(1) -a $(KERNEL_LOADADDR) -e $(KERNEL_ENTRY) \
-		-n '$(BOARD_NAME) initramfs' -d $@:$@.fakerd:$@.dtb $@.new
+	-$(STAGING_DIR_HOST)/bin/mkimage -A $(LINUX_KARCH) -O linux -T multi -C $(1) \
+		-a $(KERNEL_LOADADDR) -e $(KERNEL_ENTRY) -n '$(BOARD_NAME) initramfs' \
+		-d $@:$@.fakerd:$(KDIR)/image-$(firstword $(DEVICE_DTS)).dtb $@.new
 	mv $@.new $@
 	rm -rf $@.fakerd
 endef
 
 define Build/prepend-dtb
-	cat "$@.dtb.uimage" "$@" > "$@.new"
+	cat "$(KDIR)/image-$(firstword $(DEVICE_DTS)).dtb" "$@" > "$@.new"
 	mv "$@.new" "$@"
 endef
 
diff --git a/target/linux/apm821xx/image/nand.mk b/target/linux/apm821xx/image/nand.mk
index db3c9c07228539..9ecc2320fd83f9 100644
--- a/target/linux/apm821xx/image/nand.mk
+++ b/target/linux/apm821xx/image/nand.mk
@@ -6,16 +6,7 @@ define Build/create-uImage-dtb
 		-d "$@.dtb" "$@.dtb.uimage"
 endef
 
-define Build/MerakiAdd-dtb
-	$(call Image/BuildDTB,../dts/$(DEVICE_DTS).dts,$@.dtb)
-	( \
-		dd if=$@.dtb bs=$(DTB_SIZE) conv=sync; \
-		cat $@ ; \
-	) > $@.new
-	@mv $@.new $@
-endef
-
-define Build/MerakiNAND
+define Build/meraki-header
 	-$(STAGING_DIR_HOST)/bin/mkmerakifw \
 		-B $(BOARD_NAME) -s \
 		-i $@ \
@@ -30,10 +21,10 @@ define Device/meraki_mr24
   DEVICE_PACKAGES := kmod-spi-gpio -swconfig
   BOARD_NAME := mr24
   IMAGES := sysupgrade.bin
-  DTB_SIZE := 64512
+  DEVICE_DTC_FLAGS := --space 64512
   IMAGE_SIZE := 8191k
-  KERNEL := kernel-bin | lzma | uImage lzma | MerakiAdd-dtb | MerakiNAND
-  KERNEL_INITRAMFS := kernel-bin | lzma | dtb | MuImage-initramfs lzma
+  KERNEL := kernel-bin | lzma | uImage lzma | prepend-dtb | meraki-header
+  KERNEL_INITRAMFS := kernel-bin | lzma | MuImage-initramfs lzma
   IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   UBINIZE_OPTS := -E 5
   SUPPORTED_DEVICES += mr24
@@ -49,9 +40,9 @@ define Device/meraki_mx60
 		     kmod-usb-storage block-mount
   BLOCKSIZE := 128k
   IMAGES := sysupgrade.bin
-  DTB_SIZE := 20480
+  DEVICE_DTC_FLAGS := --space 20480
   IMAGE_SIZE := 1021m
-  KERNEL := kernel-bin | gzip | dtb | MuImage-initramfs gzip
+  KERNEL := kernel-bin | libdeflate-gzip | MuImage-initramfs gzip
   IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   UBINIZE_OPTS := -E 5
   DEVICE_COMPAT_VERSION := 2.0
@@ -66,11 +57,11 @@ define Device/netgear_wndap6x0
   SUBPAGESIZE := 256
   PAGESIZE := 512
   BLOCKSIZE := 16k
-  DTB_SIZE := 32768
+  DEVICE_DTC_FLAGS := --space 32768
   IMAGE_SIZE := 27392k
   IMAGES := sysupgrade.bin factory.img
   KERNEL_SIZE := 6080k
-  KERNEL := dtb | kernel-bin | gzip | MuImage-initramfs gzip
+  KERNEL := kernel-bin | libdeflate-gzip | MuImage-initramfs gzip
   IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   IMAGE/factory.img := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-ubi
   UBINIZE_OPTS := -E 5
@@ -100,12 +91,12 @@ define Device/netgear_wndr4700
 	kmod-dm kmod-fs-ext4 kmod-fs-vfat kmod-usb-ledtrig-usbport \
 	kmod-md-mod kmod-nls-cp437 kmod-nls-iso8859-1 kmod-nls-iso8859-15 \
 	kmod-nls-utf8 kmod-usb3 kmod-usb-dwc2 kmod-usb-storage \
-	partx-utils
+	partx-utils kmod-ata-dwc
   BOARD_NAME := wndr4700
   PAGESIZE := 2048
   SUBPAGESIZE := 512
   BLOCKSIZE := 128k
-  DTB_SIZE := 131008
+  DEVICE_DTC_FLAGS := --space 131008
   IMAGE_SIZE := 24960k
   IMAGES := factory.img sysupgrade.bin
   ARTIFACTS := device-tree.dtb
@@ -113,8 +104,8 @@ define Device/netgear_wndr4700
   # append a fake/empty rootfs to fool netgear's uboot
   # CHECK_DNI_FIRMWARE_ROOTFS_INTEGRITY in do_chk_dniimg()
   KERNEL := kernel-bin | lzma -d16 | uImage lzma | pad-offset $$(BLOCKSIZE) 64 | \
-	    append-uImage-fakehdr filesystem | dtb | create-uImage-dtb | prepend-dtb
-  KERNEL_INITRAMFS := kernel-bin | gzip | dtb | MuImage-initramfs gzip
+	    append-uImage-fakehdr filesystem | create-uImage-dtb | prepend-dtb
+  KERNEL_INITRAMFS := kernel-bin | libdeflate-gzip | MuImage-initramfs gzip
   IMAGE/factory.img := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-ubi | \
 		       netgear-dni | check-size
   IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
diff --git a/target/linux/apm821xx/image/sata.mk b/target/linux/apm821xx/image/sata.mk
index 40bd2807c994a8..dfb553c089650c 100644
--- a/target/linux/apm821xx/image/sata.mk
+++ b/target/linux/apm821xx/image/sata.mk
@@ -8,18 +8,19 @@ define Device/wd_mybooklive
   DEVICE_MODEL := My Book Live
   DEVICE_ALT0_VENDOR := Western Digital
   DEVICE_ALT0_MODEL := My Book Live Duo
-  DEVICE_PACKAGES := kmod-usb-dwc2 kmod-usb-ledtrig-usbport kmod-usb-storage kmod-fs-vfat wpad-basic-wolfssl
+  DEVICE_PACKAGES := kmod-usb-dwc2 kmod-ata-dwc kmod-usb-ledtrig-usbport \
+	kmod-usb-storage kmod-fs-vfat wpad-basic-mbedtls
   SUPPORTED_DEVICES += mbl wd,mybooklive-duo
   BLOCKSIZE := 1k
-  DTB_SIZE := 16384
-  KERNEL := kernel-bin | dtb | gzip | uImage gzip
-  KERNEL_INITRAMFS := kernel-bin | gzip | dtb | MuImage-initramfs gzip
+  DEVICE_DTC_FLAGS := --pad 4096
+  KERNEL := kernel-bin | libdeflate-gzip | uImage gzip
+  KERNEL_INITRAMFS := kernel-bin | libdeflate-gzip | MuImage-initramfs gzip
   IMAGES := factory.img.gz sysupgrade.img.gz
   ARTIFACTS := apollo3g.dtb
   DEVICE_DTB := apollo3g.dtb
   FILESYSTEMS := ext4 squashfs
-  IMAGE/factory.img.gz := boot-script | boot-img | hdd-img | gzip
-  IMAGE/sysupgrade.img.gz := boot-script | boot-img | hdd-img | gzip | append-metadata
+  IMAGE/factory.img.gz := boot-script | boot-img | hdd-img | libdeflate-gzip
+  IMAGE/sysupgrade.img.gz := boot-script | boot-img | hdd-img | libdeflate-gzip | append-metadata
   ARTIFACT/apollo3g.dtb := export-dtb
 endef
 
diff --git a/target/linux/apm821xx/modules.mk b/target/linux/apm821xx/modules.mk
new file mode 100644
index 00000000000000..f8880d67124802
--- /dev/null
+++ b/target/linux/apm821xx/modules.mk
@@ -0,0 +1,34 @@
+define KernelPackage/ata-dwc
+  TITLE:=DesignWare Cores SATA support
+  KCONFIG:=CONFIG_SATA_DWC
+  FILES:=$(LINUX_DIR)/drivers/ata/sata_dwc_460ex.ko
+  AUTOLOAD:=$(call AutoLoad,40,sata_dwc_460ex,1)
+  $(call AddDepends/ata)
+endef
+
+define KernelPackage/ata-dwc/description
+ Platform support for the on-chip SATA controller.
+endef
+
+$(eval $(call KernelPackage,ata-dwc))
+
+define KernelPackage/hw-crypto-4xx
+  TITLE:=Driver AMCC PPC4xx crypto accelerator
+  KCONFIG:= \
+	CONFIG_CRYPTO_HW=y \
+	CONFIG_HW_RANDOM=y \
+	CONFIG_CRYPTO_DEV_PPC4XX \
+	CONFIG_HW_RANDOM_PPC4XX=y
+  DEPENDS:=@TARGET_apm821xx +kmod-random-core +kmod-crypto-manager \
+	   +kmod-crypto-ccm +kmod-crypto-gcm \
+	   +kmod-crypto-sha1 +kmod-crypto-sha256 +kmod-crypto-sha512
+  FILES:=$(LINUX_DIR)/drivers/crypto/amcc/crypto4xx.ko
+  AUTOLOAD:=$(call AutoLoad,09,sata_dwc_460ex,1)
+  $(call AddDepends/crypto)
+endef
+
+define KernelPackage/hw-crypto-4xx/description
+  Platform support for the on-chip crypto acceleration.
+endef
+
+$(eval $(call KernelPackage,hw-crypto-4xx))
diff --git a/target/linux/apm821xx/nand/config-default b/target/linux/apm821xx/nand/config-default
index a8ab4fd8920b48..7070b34b93d0ee 100644
--- a/target/linux/apm821xx/nand/config-default
+++ b/target/linux/apm821xx/nand/config-default
@@ -2,14 +2,8 @@ CONFIG_AT803X_PHY=y
 CONFIG_AR8216_PHY=y
 # CONFIG_SATA_DWC_OLD_DMA is not set
 CONFIG_IKAREM=y
-CONFIG_ATA=y
-CONFIG_ATA_SFF=y
-CONFIG_ATA_BMDMA=y
 # CONFIG_PCI_DISABLE_COMMON_QUIRKS is not set
-CONFIG_SATA_PMP=y
 CONFIG_GENERIC_PHY=y
-CONFIG_SATA_DWC=y
-# CONFIG_SATA_DWC_DEBUG is not set
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_GPIO_GENERIC=y
diff --git a/target/linux/apm821xx/nand/target.mk b/target/linux/apm821xx/nand/target.mk
index 208ea10b91eb88..0cba949fa0695b 100644
--- a/target/linux/apm821xx/nand/target.mk
+++ b/target/linux/apm821xx/nand/target.mk
@@ -1,7 +1,7 @@
 BOARDNAME:=Devices with NAND flash (Routers)
 FEATURES += nand pcie
 
-DEFAULT_PACKAGES += kmod-ath9k swconfig wpad-basic-wolfssl
+DEFAULT_PACKAGES += kmod-ath9k swconfig wpad-basic-mbedtls
 
 define Target/Description
 	Build firmware images for APM821XX boards with NAND flash.
diff --git a/target/linux/apm821xx/patches-5.15/900-powerpc-bootwrapper-force-gzip-as-mkimage-s-compress.patch b/target/linux/apm821xx/patches-5.15/900-powerpc-bootwrapper-force-gzip-as-mkimage-s-compress.patch
index 3a9f48d0abd729..1ba8a45cb62ad9 100644
--- a/target/linux/apm821xx/patches-5.15/900-powerpc-bootwrapper-force-gzip-as-mkimage-s-compress.patch
+++ b/target/linux/apm821xx/patches-5.15/900-powerpc-bootwrapper-force-gzip-as-mkimage-s-compress.patch
@@ -18,7 +18,7 @@ Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
 
 --- a/arch/powerpc/boot/Makefile
 +++ b/arch/powerpc/boot/Makefile
-@@ -257,7 +257,7 @@ compressor-$(CONFIG_KERNEL_LZO) := lzo
+@@ -258,7 +258,7 @@ compressor-$(CONFIG_KERNEL_LZO) := lzo
  
  # args (to if_changed): 1 = (this rule), 2 = platform, 3 = dts 4=dtb 5=initrd
  quiet_cmd_wrap	= WRAP    $@
diff --git a/target/linux/apm821xx/patches-6.1/201-add-amcc-apollo3g-support.patch b/target/linux/apm821xx/patches-6.1/201-add-amcc-apollo3g-support.patch
new file mode 100644
index 00000000000000..d26e74dfb71a1e
--- /dev/null
+++ b/target/linux/apm821xx/patches-6.1/201-add-amcc-apollo3g-support.patch
@@ -0,0 +1,30 @@
+--- a/arch/powerpc/platforms/44x/Kconfig
++++ b/arch/powerpc/platforms/44x/Kconfig
+@@ -118,6 +118,17 @@ config CANYONLANDS
+ 	help
+ 	  This option enables support for the AMCC PPC460EX evaluation board.
+ 
++config APOLLO3G
++	bool "Apollo3G"
++	depends on 44x
++	default n
++	select PPC44x_SIMPLE
++	select APM821xx
++	select IBM_EMAC_RGMII
++	select 460EX
++	help
++	  This option enables support for the AMCC Apollo 3G board.
++
+ config GLACIER
+ 	bool "Glacier"
+ 	depends on 44x
+--- a/arch/powerpc/platforms/44x/ppc44x_simple.c
++++ b/arch/powerpc/platforms/44x/ppc44x_simple.c
+@@ -46,6 +46,7 @@ machine_device_initcall(ppc44x_simple, p
+  * board.c file for it rather than adding it to this list.
+  */
+ static char *board[] __initdata = {
++	"amcc,apollo3g",
+ 	"amcc,arches",
+ 	"amcc,bamboo",
+ 	"apm,bluestone",
diff --git a/target/linux/apm821xx/patches-6.1/300-fix-atheros-nics-on-apm82181.patch b/target/linux/apm821xx/patches-6.1/300-fix-atheros-nics-on-apm82181.patch
new file mode 100644
index 00000000000000..706f86d0cfe4f1
--- /dev/null
+++ b/target/linux/apm821xx/patches-6.1/300-fix-atheros-nics-on-apm82181.patch
@@ -0,0 +1,51 @@
+--- a/arch/powerpc/platforms/4xx/pci.c
++++ b/arch/powerpc/platforms/4xx/pci.c
+@@ -1061,15 +1061,24 @@ static int __init apm821xx_pciex_init_po
+ 	u32 val;
+ 
+ 	/*
+-	 * Do a software reset on PCIe ports.
+-	 * This code is to fix the issue that pci drivers doesn't re-assign
+-	 * bus number for PCIE devices after Uboot
+-	 * scanned and configured all the buses (eg. PCIE NIC IntelPro/1000
+-	 * PT quad port, SAS LSI 1064E)
++	 * Only reset the PHY when no link is currently established.
++	 * This is for the Atheros PCIe board which has problems to establish
++	 * the link (again) after this PHY reset. All other currently tested
++	 * PCIe boards don't show this problem.
+ 	 */
+-
+-	mtdcri(SDR0, PESDR0_460EX_PHY_CTL_RST, 0x0);
+-	mdelay(10);
++	val = mfdcri(SDR0, port->sdr_base + PESDRn_LOOP);
++	if (!(val & 0x00001000)) {
++		/*
++		 * Do a software reset on PCIe ports.
++		 * This code is to fix the issue that pci drivers doesn't re-assign
++		 * bus number for PCIE devices after Uboot
++		 * scanned and configured all the buses (eg. PCIE NIC IntelPro/1000
++		 * PT quad port, SAS LSI 1064E)
++		 */
++
++		mtdcri(SDR0, PESDR0_460EX_PHY_CTL_RST, 0x0);
++		mdelay(10);
++	}
+ 
+ 	if (port->endpoint)
+ 		val = PTYPE_LEGACY_ENDPOINT << 20;
+@@ -1086,9 +1095,12 @@ static int __init apm821xx_pciex_init_po
+ 	mtdcri(SDR0, PESDR0_460EX_L0DRV, 0x00000130);
+ 	mtdcri(SDR0, PESDR0_460EX_L0CLK, 0x00000006);
+ 
+-	mtdcri(SDR0, PESDR0_460EX_PHY_CTL_RST, 0x10000000);
+-	mdelay(50);
+-	mtdcri(SDR0, PESDR0_460EX_PHY_CTL_RST, 0x30000000);
++	val = mfdcri(SDR0, port->sdr_base + PESDRn_LOOP);
++	if (!(val & 0x00001000)) {
++		mtdcri(SDR0, PESDR0_460EX_PHY_CTL_RST, 0x10000000);
++		mdelay(50);
++		mtdcri(SDR0, PESDR0_460EX_PHY_CTL_RST, 0x30000000);
++	}
+ 
+ 	mtdcri(SDR0, port->sdr_base + PESDRn_RCSSET,
+ 		mfdcri(SDR0, port->sdr_base + PESDRn_RCSSET) |
diff --git a/target/linux/apm821xx/patches-6.1/301-fix-memory-map-wndr4700.patch b/target/linux/apm821xx/patches-6.1/301-fix-memory-map-wndr4700.patch
new file mode 100644
index 00000000000000..0c9fb370f1cbf5
--- /dev/null
+++ b/target/linux/apm821xx/patches-6.1/301-fix-memory-map-wndr4700.patch
@@ -0,0 +1,14 @@
+--- a/arch/powerpc/platforms/4xx/pci.c
++++ b/arch/powerpc/platforms/4xx/pci.c
+@@ -1903,9 +1903,9 @@ static void __init ppc4xx_configure_pcie
+ 		 * if it works
+ 		 */
+ 		out_le32(mbase + PECFG_PIM0LAL, 0x00000000);
+-		out_le32(mbase + PECFG_PIM0LAH, 0x00000000);
++		out_le32(mbase + PECFG_PIM0LAH, 0x00000008);
+ 		out_le32(mbase + PECFG_PIM1LAL, 0x00000000);
+-		out_le32(mbase + PECFG_PIM1LAH, 0x00000000);
++		out_le32(mbase + PECFG_PIM1LAH, 0x0000000c);
+ 		out_le32(mbase + PECFG_PIM01SAH, 0xffff0000);
+ 		out_le32(mbase + PECFG_PIM01SAL, 0x00000000);
+ 
diff --git a/target/linux/apm821xx/patches-6.1/900-powerpc-bootwrapper-force-gzip-as-mkimage-s-compress.patch b/target/linux/apm821xx/patches-6.1/900-powerpc-bootwrapper-force-gzip-as-mkimage-s-compress.patch
new file mode 100644
index 00000000000000..2e2bda7c60fd36
--- /dev/null
+++ b/target/linux/apm821xx/patches-6.1/900-powerpc-bootwrapper-force-gzip-as-mkimage-s-compress.patch
@@ -0,0 +1,29 @@
+From c9395ad54e2cabb87d408becc37566f3d8248933 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@gmail.com>
+Date: Sun, 1 Dec 2019 02:08:23 +0100
+Subject: [PATCH] powerpc: bootwrapper: force gzip as mkimage's compression
+ method
+
+Due to CONFIG_KERNEL_XZ symbol, the bootwrapper code tries to
+instruct the mkimage to use the xz compression, which isn't
+supported. This patch forces the gzip compression, which is
+supported and doesn't matter because the generated uImage for
+the apm821xx target gets ignored as the OpenWrt toolchain will
+do separate U-Boot kernel images for each device individually.
+
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+---
+ arch/powerpc/boot/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/boot/Makefile
++++ b/arch/powerpc/boot/Makefile
+@@ -272,7 +272,7 @@ compressor-$(CONFIG_KERNEL_LZO) := lzo
+ 
+ # args (to if_changed): 1 = (this rule), 2 = platform, 3 = dts 4=dtb 5=initrd
+ quiet_cmd_wrap	= WRAP    $@
+-      cmd_wrap	=$(CONFIG_SHELL) $(wrapper) -Z $(compressor-y) -c -o $@ -p $2 \
++      cmd_wrap	=$(CONFIG_SHELL) $(wrapper) -Z gzip -c -o $@ -p $2 \
+ 		$(CROSSWRAP) $(if $3, -s $3)$(if $4, -d $4)$(if $5, -i $5) \
+ 		vmlinux
+ 
diff --git a/target/linux/apm821xx/sata/config-default b/target/linux/apm821xx/sata/config-default
index 70a1ac760d4aee..daff2d04bef2bf 100644
--- a/target/linux/apm821xx/sata/config-default
+++ b/target/linux/apm821xx/sata/config-default
@@ -40,12 +40,14 @@ CONFIG_PM=y
 CONFIG_PM_AUTOSLEEP=y
 CONFIG_PM_CLK=y
 CONFIG_PM_SLEEP=y
+# CONFIG_PM_USERSPACE_AUTOSLEEP is not set
 CONFIG_PM_WAKELOCKS=y
 CONFIG_PM_WAKELOCKS_GC=y
 CONFIG_PM_WAKELOCKS_LIMIT=100
 CONFIG_PPC_EARLY_DEBUG=y
 CONFIG_PPC_EARLY_DEBUG_44x=y
 # CONFIG_PPC_EARLY_DEBUG_MEMCONS is not set
+# CONFIG_PPC_EARLY_DEBUG_16550 is not set
 CONFIG_PPC_EARLY_DEBUG_44x_PHYSHIGH=0x4
 CONFIG_PPC_EARLY_DEBUG_44x_PHYSLOW=0xef600300
 CONFIG_PPC4xx_CPM=y
diff --git a/target/linux/apm821xx/sata/profiles/00-default.mk b/target/linux/apm821xx/sata/profiles/00-default.mk
index a203821533b10e..082068fe365393 100644
--- a/target/linux/apm821xx/sata/profiles/00-default.mk
+++ b/target/linux/apm821xx/sata/profiles/00-default.mk
@@ -5,7 +5,7 @@
 define Profile/Default
   NAME:=Default Profile
   PRIORITY:=1
-  PACKAGES := kmod-usb-dwc2 kmod-usb-ledtrig-usbport kmod-usb-storage kmod-fs-vfat wpad-basic-wolfssl
+  PACKAGES := kmod-usb-dwc2 kmod-usb-ledtrig-usbport kmod-usb-storage kmod-fs-vfat wpad-basic-mbedtls
 endef
 
 define Profile/Default/Description
diff --git a/target/linux/archs38/Makefile b/target/linux/archs38/Makefile
index e08f7791709cc1..42b4edad8a9cea 100644
--- a/target/linux/archs38/Makefile
+++ b/target/linux/archs38/Makefile
@@ -8,9 +8,10 @@ ARCH:=arc
 CPU_TYPE:=archs
 BOARD:=archs38
 BOARDNAME:=Synopsys DesignWare ARC HS38
+FEATURES:=source-only
 SUBTARGETS:=generic
 
-KERNEL_PATCHVER:=5.10
+KERNEL_PATCHVER:=5.15
 
 DEVICE_TYPE:=basic
 
diff --git a/target/linux/archs38/config-5.15 b/target/linux/archs38/config-5.15
new file mode 100644
index 00000000000000..d4b1c5ab6021de
--- /dev/null
+++ b/target/linux/archs38/config-5.15
@@ -0,0 +1,256 @@
+# CONFIG_16KSTACKS is not set
+CONFIG_ARC=y
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARC_BUILTIN_DTB_NAME=""
+CONFIG_ARC_CACHE=y
+CONFIG_ARC_CACHE_LINE_SHIFT=6
+CONFIG_ARC_CACHE_PAGES=y
+CONFIG_ARC_CPU_HS=y
+CONFIG_ARC_CURR_IN_REG=y
+CONFIG_ARC_DBG=y
+# CONFIG_ARC_DSP_AGU_USERSPACE is not set
+# CONFIG_ARC_DSP_KERNEL is not set
+CONFIG_ARC_DSP_NONE=y
+# CONFIG_ARC_DSP_USERSPACE is not set
+CONFIG_ARC_DW2_UNWIND=y
+CONFIG_ARC_FPU_SAVE_RESTORE=y
+CONFIG_ARC_HAS_ACCL_REGS=y
+CONFIG_ARC_HAS_DCACHE=y
+# CONFIG_ARC_HAS_DCCM is not set
+CONFIG_ARC_HAS_DIV_REM=y
+CONFIG_ARC_HAS_ICACHE=y
+# CONFIG_ARC_HAS_ICCM is not set
+CONFIG_ARC_HAS_LL64=y
+CONFIG_ARC_HAS_LLSC=y
+# CONFIG_ARC_HAS_PAE40 is not set
+CONFIG_ARC_HAS_SWAPE=y
+CONFIG_ARC_IRQ_NO_AUTOSAVE=y
+CONFIG_ARC_KVADDR_SIZE=256
+# CONFIG_ARC_LPB_DISABLE is not set
+CONFIG_ARC_MCIP=y
+# CONFIG_ARC_METAWARE_HLINK is not set
+CONFIG_ARC_MMU_V4=y
+# CONFIG_ARC_PAGE_SIZE_16K is not set
+# CONFIG_ARC_PAGE_SIZE_4K is not set
+CONFIG_ARC_PAGE_SIZE_8K=y
+CONFIG_ARC_PLAT_AXS10X=y
+# CONFIG_ARC_PLAT_TB10X is not set
+# CONFIG_ARC_SMP_HALT_ON_RESET is not set
+CONFIG_ARC_SOC_HSDK=y
+CONFIG_ARC_TIMERS=y
+CONFIG_ARC_TIMERS_64BIT=y
+CONFIG_ARC_TUNE_MCPU=""
+CONFIG_ARC_USE_UNALIGNED_MEM_ACCESS=y
+CONFIG_AXS103=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_SD=y
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE=0
+# CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE is not set
+CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3=y
+CONFIG_CLK_HSDK=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CPU_RMAP=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_DRBG=y
+CONFIG_CRYPTO_DRBG_HMAC=y
+CONFIG_CRYPTO_DRBG_MENU=y
+CONFIG_CRYPTO_ECHAINIV=y
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_JITTERENTROPY=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=1
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_RNG_DEFAULT=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_DMADEVICES=y
+CONFIG_DMA_DIRECT_REMAP=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_REMAP=y
+CONFIG_DMA_VIRTUAL_CHANNELS=y
+CONFIG_DTC=y
+CONFIG_DWMAC_ANARION=y
+CONFIG_DWMAC_GENERIC=y
+CONFIG_DW_APB_ICTL=y
+CONFIG_DW_AXI_DMAC=y
+CONFIG_EXT4_FS=y
+CONFIG_FAT_FS=y
+CONFIG_FB=y
+CONFIG_FB_CMDLINE=y
+CONFIG_FIXED_PHY=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FS_POSIX_ACL=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CSUM=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PENDING_IRQ=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_DWAPB=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_SNPS_CREG=y
+CONFIG_GRACE_PERIOD=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_I2C=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_IIO=y
+CONFIG_IIO_BUFFER=y
+CONFIG_IIO_KFIFO_BUF=y
+CONFIG_IIO_ST_PRESS=y
+CONFIG_IIO_ST_PRESS_I2C=y
+CONFIG_IIO_ST_PRESS_SPI=y
+CONFIG_IIO_ST_SENSORS_CORE=y
+CONFIG_IIO_ST_SENSORS_I2C=y
+CONFIG_IIO_ST_SENSORS_SPI=y
+CONFIG_IIO_TRIGGER=y
+CONFIG_IIO_TRIGGERED_BUFFER=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_WORK=y
+# CONFIG_ISA_ARCOMPACT is not set
+CONFIG_ISA_ARCV2=y
+CONFIG_JBD2=y
+CONFIG_KALLSYMS=y
+CONFIG_KERNEL_GZIP=y
+CONFIG_LIBFDT=y
+CONFIG_LINUX_LINK_BASE=0x90000000
+CONFIG_LINUX_RAM_BASE=0x80000000
+CONFIG_LOCKD=y
+CONFIG_LOCKUP_DETECTOR=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MICREL_PHY=y
+CONFIG_MIGRATION=y
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_DW=y
+# CONFIG_MMC_DW_BLUEFIELD is not set
+# CONFIG_MMC_DW_EXYNOS is not set
+# CONFIG_MMC_DW_HI3798CV200 is not set
+# CONFIG_MMC_DW_K3 is not set
+CONFIG_MMC_DW_PLTFM=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MODULES_USE_ELF_RELA=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_NAMESPACES=y
+CONFIG_NATIONAL_PHY=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_NS=y
+CONFIG_NET_PTP_CLASSIFY=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NFS_ACL_SUPPORT=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
+CONFIG_NLS=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_NO_IOPORT_MAP=y
+CONFIG_NR_CPUS=4
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_PADATA=y
+CONFIG_PAGE_POOL=y
+CONFIG_PCS_XPCS=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PPS=y
+CONFIG_PREEMPT=y
+CONFIG_PREEMPTION=y
+CONFIG_PREEMPT_COUNT=y
+# CONFIG_PREEMPT_NONE is not set
+CONFIG_PREEMPT_RCU=y
+# CONFIG_PREVENT_FIRMWARE_BUILD is not set
+CONFIG_PTP_1588_CLOCK=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGMAP_SPI=y
+CONFIG_RESET_AXS10X=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RESET_HSDK=y
+CONFIG_RESET_SIMPLE=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+CONFIG_SERIAL_8250_DEPRECATED_OPTIONS=y
+CONFIG_SERIAL_8250_DW=y
+CONFIG_SERIAL_8250_DWLIB=y
+CONFIG_SERIAL_8250_NR_UARTS=4
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
+CONFIG_SERIAL_ARC=y
+CONFIG_SERIAL_ARC_CONSOLE=y
+CONFIG_SERIAL_ARC_NR_PORTS=1
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SG_POOL=y
+CONFIG_SMP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
+CONFIG_SPI=y
+CONFIG_SPI_DESIGNWARE=y
+# CONFIG_SPI_DW_DMA is not set
+CONFIG_SPI_DW_MMIO=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRCU=y
+CONFIG_STACKTRACE=y
+# CONFIG_STANDALONE is not set
+CONFIG_STMMAC_ETH=y
+CONFIG_STMMAC_PLATFORM=y
+CONFIG_SUNRPC=y
+CONFIG_SWPHY=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TI_ADC108S102=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UNINLINE_SPIN_UNLOCK=y
+CONFIG_USB_SUPPORT=y
+# CONFIG_USER_NS is not set
+CONFIG_VFAT_FS=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_XPS=y
diff --git a/target/linux/archs38/generic/profiles/00-default.mk b/target/linux/archs38/generic/profiles/00-default.mk
index 38da896fa6cb8e..ae3292e5b921b8 100644
--- a/target/linux/archs38/generic/profiles/00-default.mk
+++ b/target/linux/archs38/generic/profiles/00-default.mk
@@ -4,7 +4,7 @@
 
 define Profile/Default
 	NAME:=Default Profile (all drivers)
-	PACKAGES:= kmod-usb2 kmod-ath9k-htc wpad-basic-wolfssl
+	PACKAGES:= kmod-usb2 kmod-ath9k-htc wpad-basic-mbedtls
 endef
 
 define Profile/Default/Description
diff --git a/target/linux/armsr/Makefile b/target/linux/armsr/Makefile
new file mode 100644
index 00000000000000..b34500ed8a592a
--- /dev/null
+++ b/target/linux/armsr/Makefile
@@ -0,0 +1,21 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2017 Yousong Zhou <yszhou4tech@gmail.com>
+
+include $(TOPDIR)/rules.mk
+
+BOARD:=armsr
+BOARDNAME:=Arm SystemReady (EFI) compliant
+FEATURES:=fpu pci pcie rtc usb boot-part rootfs-part
+FEATURES+=cpiogz ext4 ramdisk squashfs targz vmdk
+
+KERNEL_PATCHVER:=6.1
+
+include $(INCLUDE_DIR)/target.mk
+
+DEFAULT_PACKAGES += mkf2fs e2fsprogs
+# blkid used for resolving PARTUUID
+# in sysupgrade
+DEFAULT_PACKAGES += blkid
+
+$(eval $(call BuildTarget))
diff --git a/target/linux/armsr/README b/target/linux/armsr/README
new file mode 100644
index 00000000000000..b4b9012826a2ca
--- /dev/null
+++ b/target/linux/armsr/README
@@ -0,0 +1,75 @@
+This target generates images that can be used on ARM machines with EFI
+support (e.g EDKII/TianoCore or U-Boot with bootefi).
+
+There are two subtargets:
+- armv7 for 32-bit machines
+- armv8 for 64-bit machines
+
+The kernel and filesystem images can also be used directly by QEMU:
+
+Run with qemu-system-arm
+
+	# boot with initramfs embedded in
+	qemu-system-arm -nographic -M virt -m 64 -kernel openwrt-armsr-armv7-generic-initramfs-kernel.bin
+
+	# boot with accel=kvm
+	qemu-system-arm -nographic -M virt,accel=kvm -cpu host -m 64 -kernel
+	openwrt-armsr-armv7-generic-initramfs-kernel.bin
+
+	# boot with a separate rootfs
+	qemu-system-arm -nographic -M virt -m 64 -kernel openwrt-armsr-armv7-generic-kernel.bin \
+	  -drive file=openwrt-armsr-armv7-generic-ext4-rootfs.img,format=raw,if=virtio -append 'root=/dev/vda rootwait'
+
+	# boot with local dir as rootfs
+	qemu-system-arm -nographic -M virt -m 64 -kernel openwrt-armsr-armv7-generic-kernel.bin \
+	  -fsdev local,id=rootdev,path=root-armsr/,security_model=none \
+	  -device virtio-9p-pci,fsdev=rootdev,mount_tag=/dev/root \
+	  -append 'rootflags=trans=virtio,version=9p2000.L,cache=loose rootfstype=9p'
+
+Run with kvmtool
+
+	# start a named machine
+	lkvm run -k openwrt-armsr-armv7-zImage -i openwrt-armsr-armv7-rootfs.cpio --name armsr0
+
+	# start with virtio-9p rootfs
+	lkvm run -k openwrt-armsr-armv7-zImage -d root-armsr/
+
+	# stop "armsr0"
+	lkvm stop --name armsr0
+
+	# stop all
+	lkvm stop --all
+
+The multi-platform ARMv8 target can be used with QEMU:
+
+	qemu-system-aarch64 -machine virt -cpu cortex-a57 -nographic \
+		-kernel openwrt-armsr-armv8-generic-initramfs-kernel.bin \
+
+With a EDKII or U-Boot binary for the QEMU ARM virtual machines, you can use these
+images in EFI mode:
+
+32-bit:
+gunzip -c bin/targets/armsr/armv7/openwrt-armsr-armv7-generic-ext4-combined.img.gz > openwrt-arm-32.img
+qemu-system-arm -nographic \
+    -cpu cortex-a15 -machine virt \
+    -bios bin/targets/armsr/armv7/u-boot-qemu_armv7/u-boot.bin \
+    -smp 1 -m 1024 \
+    -device virtio-rng-pci \
+    -drive file=openwrt-arm-32.img,format=raw,index=0,media=disk \
+    -netdev user,id=testlan -net nic,netdev=testlan \
+    -netdev user,id=testwan -net nic,netdev=testwan
+
+64-bit:
+gunzip -c bin/targets/armsr/armv8/openwrt-armsr-armv8-generic-ext4-combined.img.gz > openwrt-arm-64.img
+qemu-system-aarch64 -nographic \
+    -cpu cortex-a53 -machine virt \
+    -bios bin/targets/armsr/armv8/u-boot-qemu_armv8/u-boot.bin \
+    -smp 1 -m 1024 \
+    -device virtio-rng-pci \
+    -drive file=openwrt-arm-64.img,format=raw,index=0,media=disk \
+    -netdev user,id=testlan -net nic,netdev=testlan \
+    -netdev user,id=testwan -net nic,netdev=testwan
+
+One can obtain other EFI/BIOS binaries from:
+- Distribution packages (such as qemu-efi-arm and qemu-efi-aarch64 in Debian)
+- Community builds, like retrage/edk2-nightly: https://retrage.github.io/edk2-nightly/
diff --git a/target/linux/armsr/armv7/config-6.1 b/target/linux/armsr/armv7/config-6.1
new file mode 100644
index 00000000000000..664ef2e05b201c
--- /dev/null
+++ b/target/linux/armsr/armv7/config-6.1
@@ -0,0 +1,78 @@
+CONFIG_ALIGNMENT_TRAP=y
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+CONFIG_ARCH_MULTIPLATFORM=y
+CONFIG_ARCH_MULTI_V6_V7=y
+CONFIG_ARCH_MULTI_V7=y
+CONFIG_ARCH_MMAP_RND_BITS=8
+CONFIG_ARCH_NR_GPIO=0
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX=y
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_VIRT=y
+CONFIG_ARM=y
+CONFIG_ARM_CPU_SUSPEND=y
+CONFIG_ARM_HAS_SG_CHAIN=y
+CONFIG_ARM_HEAVY_MB=y
+# CONFIG_ARM_HIGHBANK_CPUIDLE is not set
+CONFIG_ARM_L1_CACHE_SHIFT=6
+CONFIG_ARM_L1_CACHE_SHIFT_6=y
+CONFIG_ARM_LPAE=y
+CONFIG_ARM_PATCH_IDIV=y
+CONFIG_ARM_PATCH_PHYS_VIRT=y
+CONFIG_ARM_PSCI=y
+CONFIG_ARM_THUMB=y
+CONFIG_ARM_UNWIND=y
+CONFIG_ARM_VIRT_EXT=y
+CONFIG_AUTO_ZRELADDR=y
+CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK=y
+CONFIG_CACHE_L2X0=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CPU_32v6K=y
+CONFIG_CPU_32v7=y
+CONFIG_CPU_ABRT_EV7=y
+CONFIG_CPU_CACHE_V7=y
+CONFIG_CPU_CACHE_VIPT=y
+CONFIG_CPU_COPY_V6=y
+CONFIG_CPU_CP15=y
+CONFIG_CPU_CP15_MMU=y
+CONFIG_CPU_HAS_ASID=y
+CONFIG_CPU_PABRT_V7=y
+CONFIG_CPU_SPECTRE=y
+CONFIG_CPU_THUMB_CAPABLE=y
+CONFIG_CPU_TLB_V7=y
+CONFIG_CPU_V7=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_DEBUG_LL_INCLUDE="mach/debug-macro.S"
+CONFIG_DMA_OPS=y
+CONFIG_EDAC_ATOMIC_SCRUB=y
+CONFIG_GENERIC_IRQ_MULTI_HANDLER=y
+CONFIG_GENERIC_VDSO_32=y
+CONFIG_HARDEN_BRANCH_PREDICTOR=y
+CONFIG_HAVE_SMP=y
+CONFIG_HZ_FIXED=0
+CONFIG_HZ_PERIODIC=y
+CONFIG_MIGHT_HAVE_CACHE_L2X0=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_NEON=y
+CONFIG_NR_CPUS=4
+CONFIG_OLD_SIGACTION=y
+CONFIG_OLD_SIGSUSPEND3=y
+CONFIG_OUTER_CACHE=y
+CONFIG_OUTER_CACHE_SYNC=y
+CONFIG_PAGE_OFFSET=0xC0000000
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_RTC_MC146818_LIB=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SMP_ON_UP=y
+CONFIG_SWP_EMULATE=y
+CONFIG_SYS_SUPPORTS_APM_EMULATION=y
+CONFIG_UNCOMPRESS_INCLUDE="debug/uncompress.h"
+CONFIG_UNWINDER_ARM=y
+CONFIG_USE_OF=y
+CONFIG_VFP=y
+CONFIG_VFPv3=y
+CONFIG_XZ_DEC_ARM=y
+CONFIG_XZ_DEC_BCJ=y
+CONFIG_ZBOOT_ROM_BSS=0
+CONFIG_ZBOOT_ROM_TEXT=0
diff --git a/target/linux/armsr/armv7/target.mk b/target/linux/armsr/armv7/target.mk
new file mode 100644
index 00000000000000..fbad3abb260f61
--- /dev/null
+++ b/target/linux/armsr/armv7/target.mk
@@ -0,0 +1,10 @@
+ARCH:=arm
+SUBTARGET:=armv7
+BOARDNAME:=32-bit (armv7) machines
+CPU_TYPE:=cortex-a15
+CPU_SUBTYPE:=neon-vfpv4
+KERNELNAME:=zImage
+
+define Target/Description
+  Build images for $(BOARDNAME)
+endef
diff --git a/target/linux/armsr/armv8/config-6.1 b/target/linux/armsr/armv8/config-6.1
new file mode 100644
index 00000000000000..f1b4838d153ec4
--- /dev/null
+++ b/target/linux/armsr/armv8/config-6.1
@@ -0,0 +1,444 @@
+CONFIG_64BIT=y
+CONFIG_ACPI_PCC=y
+CONFIG_ARCH_HISI=y
+CONFIG_ARCH_INTEL_SOCFPGA=y
+CONFIG_ARCH_LAYERSCAPE=y
+CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
+CONFIG_ARCH_MMAP_RND_BITS=18
+CONFIG_ARCH_MMAP_RND_BITS_MAX=24
+CONFIG_ARCH_MMAP_RND_BITS_MIN=18
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=11
+CONFIG_ARCH_MVEBU=y
+CONFIG_ARCH_NXP=y
+CONFIG_ARCH_PROC_KCORE_TEXT=y
+CONFIG_ARCH_ROCKCHIP=y
+CONFIG_ARCH_STACKWALK=y
+CONFIG_ARCH_SUNXI=y
+CONFIG_ARCH_SYNQUACER=y
+CONFIG_ARCH_THUNDER=y
+CONFIG_ARCH_THUNDER2=y
+CONFIG_ARCH_VEXPRESS=y
+CONFIG_ARCH_WANTS_NO_INSTR=y
+CONFIG_ARCH_ZYNQMP=y
+CONFIG_ARM64=y
+CONFIG_ARM64_4K_PAGES=y
+CONFIG_ARM64_CNP=y
+CONFIG_ARM64_CRYPTO=y
+CONFIG_ARM64_EPAN=y
+CONFIG_ARM64_ERRATUM_1165522=y
+CONFIG_ARM64_ERRATUM_1286807=y
+CONFIG_ARM64_ERRATUM_819472=y
+CONFIG_ARM64_ERRATUM_824069=y
+CONFIG_ARM64_ERRATUM_826319=y
+CONFIG_ARM64_ERRATUM_827319=y
+CONFIG_ARM64_ERRATUM_832075=y
+CONFIG_ARM64_ERRATUM_843419=y
+CONFIG_ARM64_HW_AFDBM=y
+CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
+CONFIG_ARM64_PAGE_SHIFT=12
+CONFIG_ARM64_PAN=y
+CONFIG_ARM64_PA_BITS=48
+CONFIG_ARM64_PA_BITS_48=y
+CONFIG_ARM64_PTR_AUTH=y
+CONFIG_ARM64_PTR_AUTH_KERNEL=y
+CONFIG_ARM64_SME=y
+CONFIG_ARM64_SVE=y
+CONFIG_ARM64_TAGGED_ADDR_ABI=y
+CONFIG_ARM64_VA_BITS=48
+CONFIG_ARM64_VA_BITS_48=y
+CONFIG_ARM64_WORKAROUND_CLEAN_CACHE=y
+CONFIG_ARM64_WORKAROUND_REPEAT_TLBI=y
+CONFIG_ARM64_WORKAROUND_SPECULATIVE_AT=y
+# CONFIG_ARMADA_37XX_RWTM_MBOX is not set
+CONFIG_ARMADA_37XX_WATCHDOG=y
+CONFIG_ARMADA_THERMAL=y
+CONFIG_ARM_ARCH_TIMER_OOL_WORKAROUND=y
+# CONFIG_ARM_DMC620_PMU is not set
+# CONFIG_ARM_MHU_V2 is not set
+CONFIG_ARM_SBSA_WATCHDOG=y
+CONFIG_ARM_SMC_WATCHDOG=y
+CONFIG_ARM_SMMU=y
+# CONFIG_ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT is not set
+# CONFIG_ARM_SMMU_LEGACY_DT_BINDINGS is not set
+CONFIG_ARM_SMMU_V3=y
+# CONFIG_ARM_SMMU_V3_PMU is not set
+# CONFIG_ARM_SMMU_V3_SVA is not set
+CONFIG_ATOMIC64_SELFTEST=y
+CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
+# CONFIG_AXI_DMAC is not set
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+CONFIG_BLK_PM=y
+CONFIG_CAVIUM_TX2_ERRATUM_219=y
+CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
+CONFIG_CLK_INTEL_SOCFPGA=y
+CONFIG_CLK_INTEL_SOCFPGA64=y
+CONFIG_CLK_LS1028A_PLLDIG=y
+CONFIG_CLK_PX30=y
+CONFIG_CLK_QORIQ=y
+CONFIG_CLK_RK3308=y
+CONFIG_CLK_RK3328=y
+CONFIG_CLK_RK3368=y
+CONFIG_CLK_RK3399=y
+CONFIG_CLK_RK3568=y
+CONFIG_CLK_SP810=y
+CONFIG_CLK_SUNXI=y
+CONFIG_CLK_SUNXI_CLOCKS=y
+# CONFIG_CLK_SUNXI_PRCM_SUN6I is not set
+# CONFIG_CLK_SUNXI_PRCM_SUN8I is not set
+# CONFIG_CLK_SUNXI_PRCM_SUN9I is not set
+CONFIG_CLK_VEXPRESS_OSC=y
+# CONFIG_COMMON_CLK_FSL_FLEXSPI is not set
+# CONFIG_COMMON_CLK_FSL_SAI is not set
+CONFIG_COMMON_CLK_HI3516CV300=y
+CONFIG_COMMON_CLK_HI3519=y
+CONFIG_COMMON_CLK_HI3559A=y
+CONFIG_COMMON_CLK_HI3660=y
+CONFIG_COMMON_CLK_HI3670=y
+CONFIG_COMMON_CLK_HI3798CV200=y
+CONFIG_COMMON_CLK_HI6220=y
+CONFIG_COMMON_CLK_HI655X=y
+CONFIG_COMMON_CLK_ROCKCHIP=y
+CONFIG_COMMON_CLK_SCPI=y
+CONFIG_COMMON_CLK_ZYNQMP=y
+CONFIG_COMMON_RESET_HI3660=y
+CONFIG_COMMON_RESET_HI6220=y
+# CONFIG_COMPAT_32BIT_TIME is not set
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_PM=y
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_BS=y
+CONFIG_CRYPTO_AES_ARM64_CE=y
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
+CONFIG_CRYPTO_AES_ARM64_NEON_BLK=y
+CONFIG_CRYPTO_ARCH_HAVE_LIB_CHACHA=y
+CONFIG_CRYPTO_BLAKE2S=y
+CONFIG_CRYPTO_CHACHA20=y
+CONFIG_CRYPTO_CHACHA20_NEON=y
+CONFIG_CRYPTO_CRYPTD=y
+# CONFIG_CRYPTO_DEV_ALLWINNER is not set
+# CONFIG_CRYPTO_DEV_FSL_DPAA2_CAAM is not set
+# CONFIG_CRYPTO_DEV_HISI_HPRE is not set
+# CONFIG_CRYPTO_DEV_HISI_SEC2 is not set
+# CONFIG_CRYPTO_DEV_HISI_TRNG is not set
+# CONFIG_CRYPTO_DEV_OCTEONTX2_CPT is not set
+# CONFIG_CRYPTO_DEV_ROCKCHIP is not set
+# CONFIG_CRYPTO_DEV_ZYNQMP_AES is not set
+# CONFIG_CRYPTO_DEV_ZYNQMP_SHA3 is not set
+CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_CHACHA_GENERIC=y
+CONFIG_CRYPTO_POLYVAL_ARM64_CE=y
+CONFIG_CRYPTO_SHA1=y
+CONFIG_CRYPTO_SHA1_ARM64_CE=y
+CONFIG_CRYPTO_SHA256_ARM64=y
+CONFIG_CRYPTO_SHA2_ARM64_CE=y
+CONFIG_CRYPTO_SHA512_ARM64=y
+CONFIG_CRYPTO_SIMD=y
+# CONFIG_CRYPTO_SM4_ARM64_CE_BLK is not set
+# CONFIG_CRYPTO_SM4_ARM64_NEON_BLK is not set
+CONFIG_DMA_DIRECT_REMAP=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DMA_SUN6I=y
+CONFIG_DRM=y
+CONFIG_DRM_BOCHS=y
+CONFIG_DRM_BRIDGE=y
+CONFIG_DRM_GEM_SHMEM_HELPER=y
+CONFIG_DRM_KMS_HELPER=y
+CONFIG_DRM_PANEL=y
+CONFIG_DRM_PANEL_BRIDGE=y
+CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y
+CONFIG_DRM_QXL=y
+# CONFIG_DRM_ROCKCHIP is not set
+CONFIG_DRM_TTM=y
+CONFIG_DRM_TTM_HELPER=y
+CONFIG_DRM_VIRTIO_GPU=y
+CONFIG_DRM_VRAM_HELPER=y
+# CONFIG_DWMAC_SUN8I is not set
+# CONFIG_DWMAC_SUNXI is not set
+CONFIG_DW_WATCHDOG=y
+CONFIG_FB=y
+CONFIG_FB_ARMCLCD=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+CONFIG_FB_CMDLINE=y
+CONFIG_FB_MODE_HELPERS=y
+# CONFIG_FB_XILINX is not set
+CONFIG_FRAME_POINTER=y
+CONFIG_FRAME_WARN=2048
+# CONFIG_FSL_DPAA is not set
+# CONFIG_FSL_DPAA2_QDMA is not set
+CONFIG_FSL_ERRATUM_A008585=y
+# CONFIG_FSL_IMX8_DDR_PMU is not set
+# CONFIG_FSL_PQ_MDIO is not set
+CONFIG_FUJITSU_ERRATUM_010001=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
+CONFIG_GENERIC_CSUM=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+# CONFIG_GIANFAR is not set
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_GPIO_MPC8XXX=y
+CONFIG_GPIO_ROCKCHIP=y
+CONFIG_GPIO_THUNDERX=y
+CONFIG_GPIO_XLP=y
+CONFIG_GPIO_ZYNQ=y
+CONFIG_GPIO_ZYNQMP_MODEPIN=y
+CONFIG_HDMI=y
+CONFIG_HI3660_MBOX=y
+CONFIG_HI6220_MBOX=y
+CONFIG_HISILICON_LPC=y
+CONFIG_HISI_PMU=y
+CONFIG_HISI_THERMAL=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_ARM_SMCCC_TRNG=y
+# CONFIG_HW_RANDOM_HISI is not set
+CONFIG_HW_RANDOM_VIRTIO=y
+CONFIG_I2C=y
+CONFIG_I2C_ALGOBIT=y
+CONFIG_I2C_ALTERA=y
+CONFIG_I2C_BOARDINFO=y
+# CONFIG_I2C_HIX5HD2 is not set
+CONFIG_I2C_IMX=y
+# CONFIG_I2C_SLAVE_TESTUNIT is not set
+CONFIG_I2C_SYNQUACER=y
+CONFIG_I2C_THUNDERX=y
+# CONFIG_I2C_XLP9XX is not set
+CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
+# CONFIG_IMX2_WDT is not set
+# CONFIG_INPUT_HISI_POWERKEY is not set
+# CONFIG_INPUT_IBM_PANEL is not set
+# CONFIG_INTEL_STRATIX10_RSU is not set
+# CONFIG_INTEL_STRATIX10_SERVICE is not set
+# CONFIG_IOMMU_DEBUGFS is not set
+# CONFIG_IOMMU_DEFAULT_DMA_LAZY is not set
+CONFIG_IOMMU_DEFAULT_DMA_STRICT=y
+CONFIG_IOMMU_DEFAULT_PASSTHROUGH=y
+# CONFIG_IOMMU_IO_PGTABLE_ARMV7S is not set
+# CONFIG_IOMMU_IO_PGTABLE_DART is not set
+# CONFIG_IOMMU_IO_PGTABLE_LPAE_SELFTEST is not set
+CONFIG_IOMMU_SUPPORT=y
+# CONFIG_K3_DMA is not set
+CONFIG_KCMP=y
+# CONFIG_KEYBOARD_SUN4I_LRADC is not set
+CONFIG_LCD_CLASS_DEVICE=m
+# CONFIG_LCD_PLATFORM is not set
+# CONFIG_MAILBOX_TEST is not set
+CONFIG_MARVELL_10G_PHY=y
+# CONFIG_MARVELL_CN10K_DDR_PMU is not set
+# CONFIG_MARVELL_CN10K_TAD_PMU is not set
+CONFIG_MDIO_SUN4I=y
+# CONFIG_MFD_ALTERA_A10SR is not set
+CONFIG_MFD_ALTERA_SYSMGR=y
+# CONFIG_MFD_AXP20X_RSB is not set
+CONFIG_MFD_CORE=y
+CONFIG_MFD_HI655X_PMIC=y
+# CONFIG_MFD_KHADAS_MCU is not set
+CONFIG_MFD_SUN4I_GPADC=y
+# CONFIG_MFD_SUN6I_PRCM is not set
+CONFIG_MFD_SYSCON=y
+CONFIG_MFD_VEXPRESS_SYSREG=y
+CONFIG_MMC=y
+CONFIG_MMC_ARMMMCI=y
+CONFIG_MMC_CAVIUM_THUNDERX=y
+CONFIG_MMC_DW=y
+# CONFIG_MMC_DW_BLUEFIELD is not set
+# CONFIG_MMC_DW_EXYNOS is not set
+# CONFIG_MMC_DW_HI3798CV200 is not set
+# CONFIG_MMC_DW_K3 is not set
+# CONFIG_MMC_DW_PCI is not set
+CONFIG_MMC_DW_PLTFM=y
+CONFIG_MMC_DW_ROCKCHIP=y
+CONFIG_MMC_RICOH_MMC=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_ACPI=y
+CONFIG_MMC_SDHCI_OF_ESDHC=y
+CONFIG_MMC_SDHCI_PCI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SUNXI=y
+CONFIG_MODULES_USE_ELF_RELA=y
+# CONFIG_MVNETA is not set
+# CONFIG_MVPP2 is not set
+# CONFIG_MV_XOR is not set
+CONFIG_NEED_SG_DMA_LENGTH=y
+# CONFIG_NET_VENDOR_ALLWINNER is not set
+CONFIG_NO_HZ=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NR_CPUS=64
+CONFIG_NVIDIA_CARMEL_CNP_ERRATUM=y
+# CONFIG_NVMEM_LAYERSCAPE_SFP is not set
+CONFIG_NVMEM_ROCKCHIP_EFUSE=y
+# CONFIG_NVMEM_ROCKCHIP_OTP is not set
+# CONFIG_NVMEM_SUNXI_SID is not set
+# CONFIG_NVMEM_ZYNQMP is not set
+CONFIG_PCC=y
+CONFIG_PCIE_HISI_STB=y
+CONFIG_PCIE_LAYERSCAPE=y
+CONFIG_PCIE_MOBIVEIL_PLAT=y
+CONFIG_PCIE_ROCKCHIP=y
+# CONFIG_PCIE_ROCKCHIP_DW_HOST is not set
+CONFIG_PCIE_ROCKCHIP_HOST=y
+CONFIG_PCIE_XILINX_CPM=y
+CONFIG_PCIE_XILINX_NWL=y
+CONFIG_PCI_AARDVARK=y
+CONFIG_PCI_LAYERSCAPE=y
+# CONFIG_PHY_FSL_LYNX_28G is not set
+CONFIG_PHY_HI3660_USB=y
+CONFIG_PHY_HI3670_PCIE=y
+CONFIG_PHY_HI3670_USB=y
+CONFIG_PHY_HI6220_USB=y
+CONFIG_PHY_HISI_INNO_USB2=y
+# CONFIG_PHY_HISTB_COMBPHY is not set
+CONFIG_PHY_MVEBU_A3700_COMPHY=y
+CONFIG_PHY_MVEBU_A3700_UTMI=y
+CONFIG_PHY_MVEBU_A38X_COMPHY=y
+CONFIG_PHY_MVEBU_CP110_COMPHY=y
+# CONFIG_PHY_ROCKCHIP_DP is not set
+# CONFIG_PHY_ROCKCHIP_DPHY_RX0 is not set
+CONFIG_PHY_ROCKCHIP_EMMC=y
+# CONFIG_PHY_ROCKCHIP_INNO_CSIDPHY is not set
+# CONFIG_PHY_ROCKCHIP_INNO_DSIDPHY is not set
+# CONFIG_PHY_ROCKCHIP_INNO_HDMI is not set
+CONFIG_PHY_ROCKCHIP_INNO_USB2=y
+# CONFIG_PHY_ROCKCHIP_NANENG_COMBO_PHY is not set
+CONFIG_PHY_ROCKCHIP_PCIE=y
+CONFIG_PHY_ROCKCHIP_SNPS_PCIE3=y
+CONFIG_PHY_ROCKCHIP_TYPEC=y
+# CONFIG_PHY_ROCKCHIP_USB is not set
+CONFIG_PHY_SUN4I_USB=y
+CONFIG_PHY_SUN50I_USB3=y
+# CONFIG_PHY_SUN6I_MIPI_DPHY is not set
+CONFIG_PHY_SUN9I_USB=y
+# CONFIG_PHY_XILINX_ZYNQMP is not set
+CONFIG_PINCTRL_ROCKCHIP=y
+# CONFIG_PINCTRL_SUN20I_D1 is not set
+CONFIG_PINCTRL_SUN4I_A10=y
+CONFIG_PINCTRL_SUN50I_A100=y
+CONFIG_PINCTRL_SUN50I_A100_R=y
+CONFIG_PINCTRL_SUN50I_A64=y
+CONFIG_PINCTRL_SUN50I_A64_R=y
+CONFIG_PINCTRL_SUN50I_H5=y
+CONFIG_PINCTRL_SUN50I_H6=y
+CONFIG_PINCTRL_SUN50I_H616=y
+CONFIG_PINCTRL_SUN50I_H616_R=y
+CONFIG_PINCTRL_SUN50I_H6_R=y
+CONFIG_PINCTRL_SUN5I=y
+# CONFIG_PINCTRL_SUN6I_A31 is not set
+# CONFIG_PINCTRL_SUN6I_A31_R is not set
+# CONFIG_PINCTRL_SUN8I_A23 is not set
+# CONFIG_PINCTRL_SUN8I_A23_R is not set
+# CONFIG_PINCTRL_SUN8I_A33 is not set
+# CONFIG_PINCTRL_SUN8I_A83T is not set
+# CONFIG_PINCTRL_SUN8I_A83T_R is not set
+# CONFIG_PINCTRL_SUN8I_H3 is not set
+# CONFIG_PINCTRL_SUN8I_H3_R is not set
+# CONFIG_PINCTRL_SUN8I_V3S is not set
+# CONFIG_PINCTRL_SUN9I_A80 is not set
+# CONFIG_PINCTRL_SUN9I_A80_R is not set
+CONFIG_PINCTRL_ZYNQMP=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_HISI=y
+CONFIG_POWER_RESET_VEXPRESS=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_QORIQ_THERMAL=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGULATOR_AXP20X=y
+CONFIG_REGULATOR_HI655X=y
+CONFIG_ROCKCHIP_IODOMAIN=y
+CONFIG_ROCKCHIP_IOMMU=y
+# CONFIG_ROCKCHIP_MBOX is not set
+CONFIG_ROCKCHIP_PM_DOMAINS=y
+# CONFIG_ROCKCHIP_SARADC is not set
+# CONFIG_ROCKCHIP_THERMAL is not set
+CONFIG_RODATA_FULL_DEFAULT_ENABLED=y
+# CONFIG_RTC_DRV_FSL_FTM_ALARM is not set
+CONFIG_RTC_DRV_MV=y
+CONFIG_RTC_I2C_AND_SPI=y
+# CONFIG_SERIAL_8250_EXAR is not set
+CONFIG_SERIAL_8250_FSL=y
+CONFIG_SERIAL_8250_PCI=y
+CONFIG_SERIAL_FSL_LPUART=y
+CONFIG_SERIAL_FSL_LPUART_CONSOLE=y
+CONFIG_SERIAL_MVEBU_CONSOLE=y
+CONFIG_SERIAL_MVEBU_UART=y
+CONFIG_SERIAL_SAMSUNG=y
+CONFIG_SERIAL_SAMSUNG_CONSOLE=y
+# CONFIG_SMC91X is not set
+# CONFIG_SND_SUN4I_I2S is not set
+# CONFIG_SND_SUN50I_CODEC_ANALOG is not set
+# CONFIG_SND_SUN50I_DMIC is not set
+# CONFIG_SND_SUN8I_CODEC is not set
+# CONFIG_SND_SUN8I_CODEC_ANALOG is not set
+# CONFIG_SNI_NETSEC is not set
+CONFIG_SPARSEMEM=y
+CONFIG_SPARSEMEM_EXTREME=y
+CONFIG_SPARSEMEM_VMEMMAP=y
+CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
+CONFIG_SPI_ARMADA_3700=y
+# CONFIG_SPI_FSL_QUADSPI is not set
+# CONFIG_SPI_HISI_KUNPENG is not set
+# CONFIG_SPI_HISI_SFC is not set
+# CONFIG_SPI_HISI_SFC_V3XX is not set
+# CONFIG_SPI_ROCKCHIP_SFC is not set
+# CONFIG_SPI_SUN4I is not set
+# CONFIG_SPI_SUN6I is not set
+# CONFIG_SPI_SYNQUACER is not set
+CONFIG_SPI_THUNDERX=y
+# CONFIG_SPI_XLP is not set
+CONFIG_STUB_CLK_HI3660=y
+CONFIG_STUB_CLK_HI6220=y
+CONFIG_SUN50I_A100_CCU=y
+CONFIG_SUN50I_A100_R_CCU=y
+CONFIG_SUN50I_A64_CCU=y
+CONFIG_SUN50I_H616_CCU=y
+CONFIG_SUN50I_H6_CCU=y
+CONFIG_SUN50I_H6_R_CCU=y
+CONFIG_SUN50I_IOMMU=y
+CONFIG_SUN6I_MSGBOX=y
+CONFIG_SUN6I_RTC_CCU=y
+# CONFIG_SUN8I_A83T_CCU is not set
+CONFIG_SUN8I_DE2_CCU=y
+# CONFIG_SUN8I_H3_CCU is not set
+CONFIG_SUN8I_R_CCU=y
+CONFIG_SUN8I_THERMAL=y
+CONFIG_SUNXI_CCU=y
+CONFIG_SUNXI_RSB=y
+CONFIG_SUNXI_WATCHDOG=y
+CONFIG_SYNC_FILE=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+# CONFIG_TCG_TIS_SYNQUACER is not set
+CONFIG_THREAD_INFO_IN_TASK=y
+# CONFIG_TURRIS_MOX_RWTM is not set
+# CONFIG_UACCE is not set
+CONFIG_UNMAP_KERNEL_AT_EL0=y
+CONFIG_USB_DWC3=y
+CONFIG_USB_DWC3_XILINX=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_HISTB=y
+CONFIG_USB_XHCI_MVEBU=y
+CONFIG_USB_XHCI_PLATFORM=y
+CONFIG_VEXPRESS_CONFIG=y
+CONFIG_VIDEOMODE_HELPERS=y
+CONFIG_VIRTIO_DMA_SHARED_BUFFER=y
+# CONFIG_VIRTIO_IOMMU is not set
+CONFIG_VMAP_STACK=y
+CONFIG_WDAT_WDT=y
+# CONFIG_XILINX_AMS is not set
+# CONFIG_XILINX_INTC is not set
+CONFIG_XLNX_EVENT_MANAGER=y
+CONFIG_ZONE_DMA32=y
+CONFIG_ZYNQMP_FIRMWARE=y
+# CONFIG_ZYNQMP_FIRMWARE_DEBUG is not set
+CONFIG_ZYNQMP_PM_DOMAINS=y
+CONFIG_ZYNQMP_POWER=y
diff --git a/target/linux/armsr/armv8/target.mk b/target/linux/armsr/armv8/target.mk
new file mode 100644
index 00000000000000..654e5976cae996
--- /dev/null
+++ b/target/linux/armsr/armv8/target.mk
@@ -0,0 +1,7 @@
+ARCH:=aarch64
+SUBTARGET:=armv8
+BOARDNAME:=64-bit (armv8) machines
+
+define Target/Description
+  Build multi-platform images for the ARMv8 instruction set architecture
+endef
diff --git a/target/linux/armsr/base-files/etc/board.d/01_led b/target/linux/armsr/base-files/etc/board.d/01_led
new file mode 100644
index 00000000000000..0250a9672f5e5c
--- /dev/null
+++ b/target/linux/armsr/base-files/etc/board.d/01_led
@@ -0,0 +1,19 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+board=$(board_name)
+
+case "$board" in
+traverse,ten64)
+	ucidef_set_led_netdev "sfp1" "SFP 1" "ten64:green:sfp1:down" "eth8" "link tx rx"
+	ucidef_set_led_netdev "sfp2" "SFP 2" "ten64:green:sfp2:up" "eth9" "link tx rx"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/armsr/base-files/etc/board.d/02_network b/target/linux/armsr/base-files/etc/board.d/02_network
new file mode 100644
index 00000000000000..f58de1c27d3986
--- /dev/null
+++ b/target/linux/armsr/base-files/etc/board.d/02_network
@@ -0,0 +1,18 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+. /lib/functions/system.sh
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+	traverse,ten64)
+		ucidef_set_interface_lan "eth0 eth1 eth2 eth3"
+		ucidef_set_interface_wan "eth6"
+		;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/armsr/base-files/etc/board.d/03_gpio_switches b/target/linux/armsr/base-files/etc/board.d/03_gpio_switches
new file mode 100644
index 00000000000000..cf07bc0f54fbc0
--- /dev/null
+++ b/target/linux/armsr/base-files/etc/board.d/03_gpio_switches
@@ -0,0 +1,23 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+board=$(board_name)
+
+case "$board" in
+traverse,ten64)
+	ucidef_add_gpio_switch "lte_reset" "Cell Modem Reset" "376"
+	ucidef_add_gpio_switch "lte_power" "Cell Modem Power" "377"
+	ucidef_add_gpio_switch "lte_disable" "Cell Modem Airplane mode" "378"
+	ucidef_add_gpio_switch "gnss_disable" "Cell Modem Disable GNSS receiver" "379"
+	ucidef_add_gpio_switch "lower_sfp_txidsable" "Lower SFP+ TX Disable" "369"
+	ucidef_add_gpio_switch "upper_sfp_txdisable" "Upper SFP+ TX Disable" "373"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/armsr/base-files/etc/inittab b/target/linux/armsr/base-files/etc/inittab
new file mode 100644
index 00000000000000..51832eb77564f8
--- /dev/null
+++ b/target/linux/armsr/base-files/etc/inittab
@@ -0,0 +1,9 @@
+::sysinit:/etc/init.d/rcS S boot
+::shutdown:/etc/init.d/rcS K shutdown
+ttyAMA0::askfirst:/usr/libexec/login.sh
+ttyS0::askfirst:/usr/libexec/login.sh
+tty0::askfirst:/usr/libexec/login.sh
+hvc0::askfirst:/usr/libexec/login.sh
+ttymxc0::askfirst:/usr/libexec/login.sh
+ttymxc1::askfirst:/usr/libexec/login.sh
+ttymxc2::askfirst:/usr/libexec/login.sh
diff --git a/target/linux/armsr/base-files/lib/preinit/01_sysinfo_acpi b/target/linux/armsr/base-files/lib/preinit/01_sysinfo_acpi
new file mode 100644
index 00000000000000..1069d74cf3e3cb
--- /dev/null
+++ b/target/linux/armsr/base-files/lib/preinit/01_sysinfo_acpi
@@ -0,0 +1,52 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+sanitize_name_arm64() {
+	sed -e '
+		y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/;
+		s/[^a-z0-9_-]\+/-/g;
+		s/^-//;
+		s/-$//;
+	' "$@"
+}
+
+do_sysinfo_arm64() {
+	local vendor product file
+
+	for file in sys_vendor board_vendor; do
+		vendor="$(cat /sys/devices/virtual/dmi/id/$file 2>/dev/null)"
+		case "$vendor" in
+		empty | \
+		System\ manufacturer | \
+		To\ [bB]e\ [fF]illed\ [bB]y\ O\.E\.M\.)
+			continue
+			;;
+		esac
+		[ -n "$vendor" ] && break
+	done
+
+	for file in product_name board_name; do
+		product="$(cat /sys/devices/virtual/dmi/id/$file 2>/dev/null)"
+		case "$vendor:$product" in
+		?*:empty | \
+		?*:System\ Product\ Name | \
+		?*:To\ [bB]e\ [fF]illed\ [bB]y\ O\.E\.M\.)
+			continue
+			;;
+		?*:?*)
+			break
+			;;
+		esac
+	done
+
+	[ -d "/sys/firmware/devicetree/base" ] && return
+
+	[ -n "$vendor" -a -n "$product" ] || return
+
+	mkdir -p /tmp/sysinfo
+
+	echo "$vendor $product" > /tmp/sysinfo/model
+
+	sanitize_name_arm64 /tmp/sysinfo/model > /tmp/sysinfo/board_name
+}
+
+boot_hook_add preinit_main do_sysinfo_arm64
diff --git a/target/linux/armsr/base-files/lib/upgrade/platform.sh b/target/linux/armsr/base-files/lib/upgrade/platform.sh
new file mode 100644
index 00000000000000..8263b9c7e3aa4d
--- /dev/null
+++ b/target/linux/armsr/base-files/lib/upgrade/platform.sh
@@ -0,0 +1,164 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+RAMFS_COPY_BIN="/usr/sbin/blkid"
+
+platform_check_image() {
+	local board=$(board_name)
+	local diskdev partdev diff
+	[ "$#" -gt 1 ] && return 1
+
+	v "Board is ${board}"
+
+	export_bootdevice && export_partdevice diskdev 0 || {
+		v "platform_check_image: Unable to determine upgrade device"
+		return 1
+	}
+
+	get_partitions "/dev/$diskdev" bootdisk
+
+	v "Extract boot sector from the image"
+	get_image_dd "$1" of=/tmp/image.bs count=63 bs=512b
+
+	get_partitions /tmp/image.bs image
+
+	#compare tables
+	diff="$(grep -F -x -v -f /tmp/partmap.bootdisk /tmp/partmap.image)"
+
+	rm -f /tmp/image.bs /tmp/partmap.bootdisk /tmp/partmap.image
+
+	if [ -n "$diff" ]; then
+		v "Partition layout has changed. Full image will be written."
+		ask_bool 0 "Abort" && exit 1
+		return 0
+	fi
+}
+
+platform_copy_config() {
+	local partdev parttype=ext4
+
+	if export_partdevice partdev 2; then
+		mount -t $parttype -o rw,noatime "/dev/$partdev" /mnt
+		cp -af "$UPGRADE_BACKUP" "/mnt/$BACKUP_FILE"
+		umount /mnt
+	else
+		v "ERROR: Unable to find partition to copy config data to"
+	fi
+
+	sleep 5
+}
+
+# To avoid writing over any firmware
+# files (e.g ubootefi.var or firmware/X/ aka EBBR)
+# Copy efi/openwrt and efi/boot from the new image
+# to the existing ESP
+platform_do_upgrade_efi_system_partition() {
+	local image_file=$1
+	local target_partdev=$2
+	local image_efisp_start=$3
+	local image_efisp_size=$4
+
+	v "Updating ESP on ${target_partdev}"
+	NEW_ESP_DIR="/mnt/new_esp_loop"
+	CUR_ESP_DIR="/mnt/cur_esp"
+	mkdir "${NEW_ESP_DIR}"
+	mkdir "${CUR_ESP_DIR}"
+
+	get_image_dd "$image_file" of="/tmp/new_efi_sys_part.img" \
+		skip="$image_efisp_start" count="$image_efisp_size"
+
+	mount -t vfat -o loop -o ro /tmp/new_efi_sys_part.img "${NEW_ESP_DIR}"
+	if [ ! -d "${NEW_ESP_DIR}/efi/boot" ]; then
+		v "ERROR: Image does not contain EFI boot files (/efi/boot)"
+		return 1
+	fi
+
+	mount -t vfat "/dev/$partdev" "${CUR_ESP_DIR}"
+
+	for d in $(find "${NEW_ESP_DIR}/efi/" -mindepth 1 -maxdepth 1 -type d); do
+		v "Copying ${d}"
+		newdir_bname=$(basename "${d}")
+		rm -rf "${CUR_ESP_DIR}/efi/${newdir_bname}"
+		cp -r "${d}" "${CUR_ESP_DIR}/efi"
+	done
+
+	umount "${NEW_ESP_DIR}"
+	umount "${CUR_ESP_DIR}"
+}
+
+platform_do_upgrade() {
+	local board=$(board_name)
+	local diskdev partdev diff
+
+	export_bootdevice && export_partdevice diskdev 0 || {
+		v "platform_do_upgrade: Unable to determine upgrade device"
+		return 1
+	}
+
+	sync
+
+	if [ "$UPGRADE_OPT_SAVE_PARTITIONS" = "1" ]; then
+		get_partitions "/dev/$diskdev" bootdisk
+
+		v "Extract boot sector from the image"
+		get_image_dd "$1" of=/tmp/image.bs count=63 bs=512b
+
+		get_partitions /tmp/image.bs image
+
+		#compare tables
+		diff="$(grep -F -x -v -f /tmp/partmap.bootdisk /tmp/partmap.image)"
+	else
+		diff=1
+	fi
+
+	# Only change the partition table if sysupgrade -p is set,
+	# otherwise doing so could interfere with embedded "single storage"
+	# (e.g SoC boot from SD card) setups, as well as other user
+	# created storage (like uvol)
+	if [ -n "$diff" ] && [ "${UPGRADE_OPT_SAVE_PARTITIONS}" = "0" ]; then
+		# Need to remove partitions before dd, otherwise the partitions
+		# that are added after will have minor numbers offset
+		partx -d - "/dev/$diskdev"
+
+		get_image_dd "$1" of="/dev/$diskdev" bs=4096 conv=fsync
+
+		# Separate removal and addtion is necessary; otherwise, partition 1
+		# will be missing if it overlaps with the old partition 2
+		partx -a - "/dev/$diskdev"
+
+		return 0
+	fi
+
+	#iterate over each partition from the image and write it to the boot disk
+	while read part start size; do
+		if export_partdevice partdev $part; then
+			v "Writing image to /dev/$partdev..."
+			if [ "$part" = "1" ]; then
+				platform_do_upgrade_efi_system_partition \
+					$1 $partdev $start $size || return 1
+			else
+				v "Normal partition, doing DD"
+				get_image_dd "$1" of="/dev/$partdev" ibs=512 obs=1M skip="$start" \
+					count="$size" conv=fsync
+			fi
+		else
+			v "Unable to find partition $part device, skipped."
+		fi
+	done < /tmp/partmap.image
+
+	local parttype=ext4
+
+	if (blkid > /dev/null) && export_partdevice partdev 1; then
+		part_magic_fat "/dev/$partdev" && parttype=vfat
+		mount -t $parttype -o rw,noatime "/dev/$partdev" /mnt
+		if export_partdevice partdev 2; then
+			THIS_PART_BLKID=$(blkid -o value -s PARTUUID "/dev/${partdev}")
+			v "Setting rootfs PARTUUID=${THIS_PART_BLKID}"
+			sed -i "s/\(PARTUUID=\)[a-f0-9-]\+/\1${THIS_PART_BLKID}/ig" \
+				/mnt/efi/openwrt/grub.cfg
+		fi
+		umount /mnt
+	fi
+	# Provide time for the storage medium to flush before system reset
+	# (despite the sync/umount it appears NVMe etc. do it in the background)
+	sleep 5
+}
diff --git a/target/linux/armsr/config-6.1 b/target/linux/armsr/config-6.1
new file mode 100644
index 00000000000000..a48af89b875b47
--- /dev/null
+++ b/target/linux/armsr/config-6.1
@@ -0,0 +1,336 @@
+CONFIG_64BIT=y
+CONFIG_9P_FS=y
+# CONFIG_9P_FS_POSIX_ACL is not set
+# CONFIG_9P_FS_SECURITY is not set
+# CONFIG_A64FX_DIAG is not set
+CONFIG_ACPI=y
+CONFIG_ACPI_AC=y
+CONFIG_ACPI_APEI=y
+CONFIG_ACPI_APEI_EINJ=y
+# CONFIG_ACPI_APEI_ERST_DEBUG is not set
+CONFIG_ACPI_APEI_GHES=y
+CONFIG_ACPI_APEI_MEMORY_FAILURE=y
+CONFIG_ACPI_APEI_PCIEAER=y
+CONFIG_ACPI_BATTERY=y
+# CONFIG_ACPI_BGRT is not set
+CONFIG_ACPI_CCA_REQUIRED=y
+CONFIG_ACPI_CONTAINER=y
+CONFIG_ACPI_CPPC_CPUFREQ=y
+# CONFIG_ACPI_DEBUG is not set
+# CONFIG_ACPI_DEBUGGER is not set
+# CONFIG_ACPI_DOCK is not set
+# CONFIG_ACPI_EC_DEBUGFS is not set
+CONFIG_ACPI_FAN=y
+CONFIG_ACPI_GENERIC_GSI=y
+CONFIG_ACPI_GTDT=y
+CONFIG_ACPI_HOTPLUG_CPU=y
+CONFIG_ACPI_I2C_OPREGION=y
+CONFIG_ACPI_IORT=y
+CONFIG_ACPI_MCFG=y
+# CONFIG_ACPI_PCI_SLOT is not set
+# CONFIG_ACPI_PFRUT is not set
+CONFIG_ACPI_PPTT=y
+CONFIG_ACPI_PRMT=y
+CONFIG_ACPI_PROCESSOR=y
+CONFIG_ACPI_PROCESSOR_IDLE=y
+CONFIG_ACPI_REDUCED_HARDWARE_ONLY=y
+CONFIG_ACPI_SPCR_TABLE=y
+CONFIG_ACPI_THERMAL=y
+# CONFIG_ACPI_TINY_POWER_BUTTON is not set
+# CONFIG_ALIBABA_UNCORE_DRW_PMU is not set
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_ARCH_FORCE_MAX_ORDER=11
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
+CONFIG_ARCH_MMAP_RND_BITS=18
+CONFIG_ARCH_MMAP_RND_BITS_MAX=24
+CONFIG_ARCH_MMAP_RND_BITS_MIN=18
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=11
+CONFIG_ARCH_PROC_KCORE_TEXT=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_STACKWALK=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARCH_WANTS_NO_INSTR=y
+CONFIG_ARM64=y
+CONFIG_ARM64_4K_PAGES=y
+# CONFIG_ARM64_ACPI_PARKING_PROTOCOL is not set
+CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
+CONFIG_ARM64_PAGE_SHIFT=12
+CONFIG_ARM64_PA_BITS=48
+CONFIG_ARM64_PA_BITS_48=y
+CONFIG_ARM64_TAGGED_ADDR_ABI=y
+CONFIG_ARM64_VA_BITS=39
+CONFIG_ARM64_VA_BITS_39=y
+CONFIG_ARM_AMBA=y
+CONFIG_ARM_ARCH_TIMER=y
+CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+CONFIG_ARM_GIC=y
+CONFIG_ARM_GIC_V2M=y
+CONFIG_ARM_GIC_V3=y
+CONFIG_ARM_GIC_V3_ITS=y
+CONFIG_ARM_GIC_V3_ITS_PCI=y
+CONFIG_ARM_PSCI_FW=y
+# CONFIG_ARM_SMMU_V3_PMU is not set
+CONFIG_ATA=y
+CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
+CONFIG_BALLOON_COMPACTION=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_NVME=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_MQ_VIRTIO=y
+CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+# CONFIG_COMPAT_32BIT_TIME is not set
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_RMAP=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_CRC32=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DMADEVICES=y
+CONFIG_DMA_ACPI=y
+CONFIG_DMA_DIRECT_REMAP=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_REMAP=y
+CONFIG_DMI=y
+CONFIG_DMIID=y
+CONFIG_DMI_SYSFS=y
+CONFIG_DTC=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EFI=y
+CONFIG_EFIVAR_FS=y
+CONFIG_EFI_ARMSTUB_DTB_LOADER=y
+# CONFIG_EFI_BOOTLOADER_CONTROL is not set
+# CONFIG_EFI_CAPSULE_LOADER is not set
+# CONFIG_EFI_COCO_SECRET is not set
+# CONFIG_EFI_CUSTOM_SSDT_OVERLAYS is not set
+# CONFIG_EFI_DISABLE_PCI_DMA is not set
+# CONFIG_EFI_DISABLE_RUNTIME is not set
+CONFIG_EFI_EARLYCON=y
+CONFIG_EFI_ESRT=y
+CONFIG_EFI_GENERIC_STUB=y
+# CONFIG_EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER is not set
+CONFIG_EFI_PARAMS_FROM_FDT=y
+CONFIG_EFI_RUNTIME_WRAPPERS=y
+CONFIG_EFI_STUB=y
+# CONFIG_EFI_TEST is not set
+# CONFIG_EFI_ZBOOT is not set
+CONFIG_EXT4_FS=y
+CONFIG_F2FS_FS=y
+CONFIG_FAILOVER=y
+CONFIG_FB_EFI=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FONT_8x16=y
+CONFIG_FONT_AUTOSELECT=y
+CONFIG_FONT_SUPPORT=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y
+# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
+CONFIG_FRAME_POINTER=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ARCH_TOPOLOGY=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_CSUM=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_MSI_IRQ=y
+CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_ACPI=y
+CONFIG_GPIO_CDEV=y
+# CONFIG_GPIO_HISI is not set
+CONFIG_GPIO_PL061=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HID=y
+CONFIG_HID_GENERIC=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HOTPLUG_PCI_ACPI=y
+CONFIG_HVC_DRIVER=y
+CONFIG_HZ_PERIODIC=y
+# CONFIG_I2C_AMD_MP2 is not set
+CONFIG_I2C_HID_ACPI=y
+# CONFIG_I2C_HISI is not set
+# CONFIG_I2C_SLAVE_TESTUNIT is not set
+CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
+# CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_INPUT_KEYBOARD=y
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+# CONFIG_ISCSI_IBFT is not set
+CONFIG_JBD2=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MEMORY_BALLOON=y
+CONFIG_MIGRATION=y
+# CONFIG_MLXBF_GIGE is not set
+CONFIG_MMC_SDHCI_ACPI=y
+CONFIG_MODULES_USE_ELF_RELA=y
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_MVMDIO=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_SG_DMA_LENGTH=y
+CONFIG_NET_9P=y
+# CONFIG_NET_9P_DEBUG is not set
+# CONFIG_NET_9P_FD is not set
+CONFIG_NET_9P_VIRTIO=y
+CONFIG_NET_FAILOVER=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NLS=y
+CONFIG_NR_CPUS=256
+CONFIG_NVMEM=y
+CONFIG_NVME_CORE=y
+# CONFIG_NVME_MULTIPATH is not set
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_PADATA=y
+CONFIG_PAGE_REPORTING=y
+CONFIG_PARTITION_PERCPU=y
+CONFIG_PCI=y
+# CONFIG_PCIE_HISI_ERR is not set
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PCI_ECAM=y
+CONFIG_PCI_HOST_COMMON=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCI_LABEL=y
+CONFIG_PCI_MSI=y
+CONFIG_PCI_MSI_IRQ_DOMAIN=y
+CONFIG_PGTABLE_LEVELS=3
+CONFIG_PHYS_ADDR_T_64BIT=y
+# CONFIG_PMIC_OPREGION is not set
+CONFIG_PNP=y
+CONFIG_PNPACPI=y
+CONFIG_PNP_DEBUG_MESSAGES=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RATIONAL=y
+# CONFIG_RESET_ATTACK_MITIGATION is not set
+CONFIG_RFS_ACCEL=y
+CONFIG_RODATA_FULL_DEFAULT_ENABLED=y
+CONFIG_RPS=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_EFI=y
+CONFIG_RTC_DRV_PL031=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+CONFIG_SATA_AHCI=y
+CONFIG_SATA_AHCI_PLATFORM=y
+CONFIG_SATA_HOST=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+CONFIG_SCSI_VIRTIO=y
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_DEPRECATED_OPTIONS=y
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_FSL=y
+CONFIG_SERIAL_8250_NR_UARTS=4
+CONFIG_SERIAL_8250_PNP=y
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_EARLYCON=y
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SG_POOL=y
+CONFIG_SMP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SPARSEMEM=y
+CONFIG_SPARSEMEM_EXTREME=y
+CONFIG_SPARSEMEM_VMEMMAP=y
+CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SRCU=y
+# CONFIG_SURFACE_PLATFORMS is not set
+CONFIG_SWIOTLB=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYSFB=y
+# CONFIG_SYSFB_SIMPLEFB is not set
+CONFIG_THERMAL=y
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_GOV_STEP_WISE=y
+CONFIG_THERMAL_OF=y
+CONFIG_THREAD_INFO_IN_TASK=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_ACPI=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+# CONFIG_UACCE is not set
+CONFIG_UCS2_STRING=y
+CONFIG_UNMAP_KERNEL_AT_EL0=y
+CONFIG_USB=y
+CONFIG_USB_HID=y
+CONFIG_USB_HIDDEV=y
+CONFIG_USB_PCI=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_PCI=y
+CONFIG_VIRTIO=y
+CONFIG_VIRTIO_BALLOON=y
+CONFIG_VIRTIO_BLK=y
+CONFIG_VIRTIO_CONSOLE=y
+CONFIG_VIRTIO_MMIO=y
+CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y
+CONFIG_VIRTIO_NET=y
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_PCI_LEGACY=y
+CONFIG_VIRTIO_PCI_LIB=y
+CONFIG_VMAP_STACK=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+# CONFIG_VT_HW_CONSOLE_BINDING is not set
+CONFIG_XPS=y
+CONFIG_ZONE_DMA32=y
diff --git a/target/linux/armsr/image/Makefile b/target/linux/armsr/image/Makefile
new file mode 100644
index 00000000000000..a6f045d24f5c90
--- /dev/null
+++ b/target/linux/armsr/image/Makefile
@@ -0,0 +1,118 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2016-2017 Yousong Zhou <yszhou4tech@gmail.com>
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/image.mk
+
+GRUB2_VARIANT =
+GRUB_TERMINALS =
+GRUB_SERIAL_CONFIG =
+GRUB_TERMINAL_CONFIG =
+GRUB_CONSOLE_CMDLINE = earlycon
+
+ifneq ($(CONFIG_GRUB_CONSOLE),)
+  GRUB_TERMINALS += console
+endif
+
+GRUB_SERIAL:=$(call qstrip,$(CONFIG_GRUB_SERIAL))
+
+ifneq ($(GRUB_SERIAL),)
+  GRUB_SERIAL_CONFIG := serial --unit=0 --speed=$(CONFIG_GRUB_BAUDRATE) --word=8 --parity=no --stop=1 --rtscts=$(if $(CONFIG_GRUB_FLOWCONTROL),on,off)
+  GRUB_TERMINALS += serial
+endif
+
+ifneq ($(GRUB_TERMINALS),)
+  GRUB_TERMINAL_CONFIG := terminal_input $(GRUB_TERMINALS); terminal_output $(GRUB_TERMINALS)
+endif
+
+ROOTPART:=$(call qstrip,$(CONFIG_TARGET_ROOTFS_PARTNAME))
+ROOTPART:=$(if $(ROOTPART),$(ROOTPART),PARTUUID=$(IMG_PART_SIGNATURE)-02)
+GPT_ROOTPART:=$(call qstrip,$(CONFIG_TARGET_ROOTFS_PARTNAME))
+GPT_ROOTPART:=$(if $(GPT_ROOTPART),$(GPT_ROOTPART),PARTUUID=$(shell echo $(IMG_PART_DISKGUID) | sed 's/00$$/02/'))
+
+GRUB_TIMEOUT:=$(call qstrip,$(CONFIG_GRUB_TIMEOUT))
+GRUB_TITLE:=$(call qstrip,$(CONFIG_GRUB_TITLE))
+
+BOOTOPTS:=$(call qstrip,$(CONFIG_GRUB_BOOTOPTS))
+
+define Build/combined
+  $(INSTALL_DIR) $@.boot/
+	$(CP) $(KDIR)/$(KERNEL_NAME) $@.boot/efi/openwrt/
+	-$(CP) $(STAGING_DIR_ROOT)/boot/. $@.boot/boot/
+	$(if $(filter $(1),efi),
+		$(INSTALL_DIR) $@.boot/efi/boot
+		$(CP) $(STAGING_DIR_IMAGE)/grub2/boot$(if $(CONFIG_aarch64),aa64,arm).efi $@.boot/efi/openwrt/
+		$(CP) $(STAGING_DIR_IMAGE)/grub2/boot$(if $(CONFIG_aarch64),aa64,arm).efi $@.boot/efi/boot/
+	)
+	KERNELPARTTYPE=ef FAT_TYPE="32" PADDING="1" SIGNATURE="$(IMG_PART_SIGNATURE)" \
+		$(if $(filter $(1),efi),GUID="$(IMG_PART_DISKGUID)") $(SCRIPT_DIR)/gen_image_generic.sh \
+		$@ \
+		$(CONFIG_TARGET_KERNEL_PARTSIZE) $@.boot \
+		$(CONFIG_TARGET_ROOTFS_PARTSIZE) $(IMAGE_ROOTFS) \
+		256
+endef
+
+define Build/grub-config
+	rm -fR $@.boot
+	$(INSTALL_DIR) $@.boot/efi/openwrt/
+	sed \
+		-e 's#@SERIAL_CONFIG@#$(strip $(GRUB_SERIAL_CONFIG))#g' \
+		-e 's#@TERMINAL_CONFIG@#$(strip $(GRUB_TERMINAL_CONFIG))#g' \
+		-e 's#@ROOTPART@#root=$(ROOTPART) rootwait#g' \
+		-e 's#@GPT_ROOTPART@#root=$(GPT_ROOTPART) rootwait#g' \
+		-e 's#@CMDLINE@#$(BOOTOPTS) $(GRUB_CONSOLE_CMDLINE)#g' \
+		-e 's#@TIMEOUT@#$(GRUB_TIMEOUT)#g' \
+		-e 's#@TITLE@#$(GRUB_TITLE)#g' \
+		-e 's#@KERNEL_NAME@#$(KERNEL_NAME)#g' \
+		./grub-$(1).cfg > $@.boot/efi/openwrt/grub.cfg
+endef
+
+define Build/grub-install
+	rm -fR $@.grub2
+	$(INSTALL_DIR) $@.grub2
+endef
+
+DEVICE_VARS += GRUB2_VARIANT UBOOT
+define Device/efi-default
+  IMAGE/rootfs.img := append-rootfs | pad-to $(ROOTFS_PARTSIZE)
+  IMAGE/rootfs.img.gz := append-rootfs | pad-to $(ROOTFS_PARTSIZE) | gzip
+  IMAGE/combined.img := grub-config efi | combined efi | grub-install efi | append-metadata
+  IMAGE/combined.img.gz := grub-config efi | combined efi | grub-install efi | gzip | append-metadata
+  IMAGE/combined.vmdk := grub-config efi | combined efi | grub-install efi | qemu-image vmdk
+ ifeq ($(CONFIG_TARGET_IMAGES_GZIP),y)
+    IMAGES-y := rootfs.img.gz
+    IMAGES-y += combined.img.gz
+  else
+    IMAGES-y := rootfs.img
+    IMAGES-y += combined.img
+  endif
+  ifeq ($(CONFIG_VMDK_IMAGES),y)
+    IMAGES-y += combined.vmdk
+  endif
+  KERNEL := kernel-bin
+  KERNEL_INSTALL := 1
+  IMAGES := $$(IMAGES-y)
+  ARTIFACTS := $$(ARTIFACTS-y)
+  SUPPORTED_DEVICES :=
+ ifeq ($(CONFIG_arm),y)
+  KERNEL_NAME = zImage
+ endif
+endef
+
+define Device/generic
+  $(call Device/efi-default)
+  DEVICE_TITLE := Generic EFI Boot
+  GRUB2_VARIANT := generic
+  FILESYSTEMS := ext4 squashfs
+  UBOOT := $(if $(CONFIG_aarch64),qemu_armv8,qemu_armv7)
+  DEVICE_PACKAGES += kmod-amazon-ena kmod-e1000e kmod-vmxnet3 kmod-rtc-rx8025 \
+	kmod-i2c-mux-pca954x kmod-gpio-pca953x partx-utils kmod-wdt-sp805 \
+	kmod-mvneta kmod-mvpp2 kmod-fsl-dpaa1-net kmod-fsl-dpaa2-net \
+	kmod-fsl-enetc-net kmod-dwmac-imx kmod-fsl-fec kmod-thunderx-net \
+	kmod-dwmac-rockchip kmod-dwmac-sun8i kmod-phy-aquantia kmod-phy-broadcom \
+	kmod-phy-marvell kmod-phy-marvell-10g kmod-sfp kmod-atlantic
+endef
+TARGET_DEVICES += generic
+
+$(eval $(call BuildImage))
diff --git a/target/linux/armsr/image/grub-efi.cfg b/target/linux/armsr/image/grub-efi.cfg
new file mode 100644
index 00000000000000..fd329e41e0ff2d
--- /dev/null
+++ b/target/linux/armsr/image/grub-efi.cfg
@@ -0,0 +1,14 @@
+@SERIAL_CONFIG@
+@TERMINAL_CONFIG@
+
+set default="0"
+set timeout="@TIMEOUT@"
+
+menuentry "@TITLE@" {
+	search --set=root --label kernel
+	linux /efi/openwrt/@KERNEL_NAME@ @GPT_ROOTPART@ @CMDLINE@ noinitrd
+}
+menuentry "@TITLE@ (failsafe)" {
+	search --set=root --label kernel
+	linux /efi/openwrt/@KERNEL_NAME@ failsafe=true @GPT_ROOTPART@ @CMDLINE@ noinitrd
+}
diff --git a/target/linux/armsr/modules.mk b/target/linux/armsr/modules.mk
new file mode 100644
index 00000000000000..7a349337d8aef6
--- /dev/null
+++ b/target/linux/armsr/modules.mk
@@ -0,0 +1,292 @@
+define KernelPackage/acpi-mdio
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=ACPI MDIO support
+  DEPENDS:=@(TARGET_armsr_armv8) +kmod-libphy +kmod-mdio-devres
+  KCONFIG:=CONFIG_ACPI_MDIO
+  FILES:=$(LINUX_DIR)/drivers/net/mdio/acpi_mdio.ko
+  AUTOLOAD:=$(call AutoLoad,11,acpi_mdio)
+endef
+
+define KernelPackage/acpi-mdio/description
+ Kernel driver for ACPI MDIO support
+endef
+
+$(eval $(call KernelPackage,acpi-mdio))
+
+define KernelPackage/fsl-pcs-lynx
+  SUBMENU=$(NETWORK_DEVICES_MENU)
+  DEPENDS:=@(TARGET_armsr_armv8) +kmod-libphy +kmod-of-mdio +kmod-phylink
+  TITLE:=NXP (Freescale) Lynx PCS
+  HIDDEN:=1
+  KCONFIG:=CONFIG_PCS_LYNX
+  FILES=$(LINUX_DIR)/drivers/net/pcs/pcs-lynx.ko
+  AUTOLOAD=$(call AutoLoad,30,pcs-lynx)
+endef
+
+$(eval $(call KernelPackage,fsl-pcs-lynx))
+
+define KernelPackage/pcs-xpcs
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=Synopsis DesignWare PCS driver
+  DEPENDS:=@(TARGET_armsr_armv8) +kmod-phylink
+  KCONFIG:=CONFIG_PCS_XPCS
+  FILES:=$(LINUX_DIR)/drivers/net/pcs/pcs_xpcs.ko
+  AUTOLOAD:=$(call AutoLoad,20,pcs_xpcs)
+endef
+
+$(eval $(call KernelPackage,pcs-xpcs))
+
+define KernelPackage/fsl-fec
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  DEPENDS:=@(TARGET_armsr_armv8) +kmod-libphy +kmod-of-mdio \
+    +kmod-ptp +kmod-net-selftests
+  TITLE:=NXP (Freescale) FEC Ethernet controller (i.MX)
+  KCONFIG:=CONFIG_FEC
+  FILES:=$(LINUX_DIR)/drivers/net/ethernet/freescale/fec.ko
+  AUTOLOAD:=$(call AutoLoad,35,fec)
+endef
+
+$(eval $(call KernelPackage,fsl-fec))
+
+define KernelPackage/fsl-xgmac-mdio
+  SUBMENU=$(NETWORK_DEVICES_MENU)
+  DEPENDS:=@(TARGET_armsr_armv8) +kmod-libphy +kmod-of-mdio +kmod-acpi-mdio
+  TITLE:=NXP (Freescale) MDIO bus
+  KCONFIG:=CONFIG_FSL_XGMAC_MDIO
+  FILES=$(LINUX_DIR)/drivers/net/ethernet/freescale/xgmac_mdio.ko
+  AUTOLOAD=$(call AutoLoad,30,xgmac_mdio)
+endef
+
+$(eval $(call KernelPackage,fsl-xgmac-mdio))
+
+define KernelPackage/fsl-mc-dpio
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=NXP DPAA2 DPIO (Data Path IO) driver
+  HIDDEN:=1
+  KCONFIG:=CONFIG_FSL_MC_BUS=y \
+    CONFIG_FSL_MC_DPIO
+  FILES:=$(LINUX_DIR)/drivers/soc/fsl/dpio/fsl-mc-dpio.ko
+  AUTOLOAD=$(call AutoLoad,30,fsl-mc-dpio)
+endef
+
+$(eval $(call KernelPackage,fsl-mc-dpio))
+
+define KernelPackage/fsl-enetc-net
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=:NXP ENETC (LS1028A) Ethernet
+  DEPENDS:=@(TARGET_armsr_armv8) +kmod-phylink +kmod-fsl-pcs-lynx
+  KCONFIG:= \
+    CONFIG_FSL_ENETC \
+    CONFIG_FSL_ENETC_VF \
+    CONFIG_FSL_ENETC_QOS
+  FILES:= \
+    $(LINUX_DIR)/drivers/net/ethernet/freescale/enetc/fsl-enetc.ko \
+    $(LINUX_DIR)/drivers/net/ethernet/freescale/enetc/fsl-enetc-vf.ko \
+    $(LINUX_DIR)/drivers/net/ethernet/freescale/enetc/fsl-enetc-mdio.ko \
+    $(LINUX_DIR)/drivers/net/ethernet/freescale/enetc/fsl-enetc-ierb.ko
+  AUTOLOAD=$(call AutoLoad,35,fsl-enetc)
+endef
+
+$(eval $(call KernelPackage,fsl-enetc-net))
+
+define KernelPackage/fsl-dpaa1-net
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=NXP DPAA1 (LS1043/LS1046) Ethernet
+  DEPENDS:=@(TARGET_armsr_armv8) +kmod-fsl-xgmac-mdio +kmod-libphy +kmod-crypto-crc32
+  KCONFIG:= \
+    CONFIG_FSL_DPAA=y \
+    CONFIG_FSL_DPAA_ETH \
+    CONFIG_FSL_FMAN \
+    CONFIG_FSL_DPAA_CHECKING=n \
+    CONFIG_FSL_BMAN_TEST=n \
+    CONFIG_FSL_QMAN_TEST=n
+  MODULES:= \
+    $(LINUX_DIR)/drivers/net/ethernet/freescale/dpaa/fsl_dpa.ko \
+    $(LINUX_DIR)/drivers/net/ethernet/freescale/fman/fsl_dpaa_fman.ko \
+    $(LINUX_DIR)/drivers/net/ethernet/freescale/fman/fsl_dpaa_mac.ko
+  AUTOLOAD=$(call AutoLoad,35,fsl-dpa)
+endef
+
+$(eval $(call KernelPackage,fsl-dpaa1-net))
+
+define KernelPackage/fsl-dpaa2-net
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=NXP DPAA2 Ethernet
+  DEPENDS:=@(TARGET_armsr_armv8) +kmod-fsl-xgmac-mdio +kmod-phylink \
+    +kmod-fsl-pcs-lynx +kmod-fsl-mc-dpio
+  KCONFIG:= \
+    CONFIG_FSL_MC_UAPI_SUPPORT=y \
+    CONFIG_FSL_DPAA2_ETH
+  FILES:= \
+  $(LINUX_DIR)/drivers/net/ethernet/freescale/dpaa2/fsl-dpaa2-eth.ko
+  AUTOLOAD=$(call AutoLoad,35,fsl-dpaa2-eth)
+endef
+
+$(eval $(call KernelPackage,fsl-dpaa2-net))
+
+define KernelPackage/fsl-dpaa2-console
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=NXP DPAA2 Debug console
+  DEPENDS:=@(TARGET_armsr_armv8)
+  KCONFIG:=CONFIG_DPAA2_CONSOLE
+  FILES=$(LINUX_DIR)/drivers/soc/fsl/dpaa2-console.ko
+  AUTOLOAD=$(call AutoLoad,40,dpaa2-console)
+endef
+
+define KernelPackage/fsl-dpaa2-console/description
+  Kernel modules for the NXP DPAA2 debug consoles
+  (Management Complex and AIOP).
+endef
+
+$(eval $(call KernelPackage,fsl-dpaa2-console))
+
+define KernelPackage/marvell-mdio
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=Marvell Armada platform MDIO driver
+  DEPENDS:=@(TARGET_armsr_armv8) +kmod-libphy +kmod-of-mdio +kmod-acpi-mdio
+  KCONFIG:=CONFIG_MVMDIO
+  FILES=$(LINUX_DIR)/drivers/net/ethernet/marvell/mvmdio.ko
+  AUTOLOAD=$(call AutoLoad,30,marvell-mdio)
+endef
+
+$(eval $(call KernelPackage,marvell-mdio))
+
+define KernelPackage/phy-marvell-10g
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=Marvell Alaska 10G PHY driver
+  DEPENDS:=@(TARGET_armsr_armv8) +kmod-libphy
+  KCONFIG:=CONFIG_MARVELL_10G_PHY
+  FILES=$(LINUX_DIR)/drivers/net/phy/marvell10g.ko
+  AUTOLOAD=$(call AutoLoad,35,marvell10g)
+endef
+
+$(eval $(call KernelPackage,phy-marvell-10g))
+
+define KernelPackage/mvneta
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=Marvell Armada 370/38x/XP/37xx network driver
+  DEPENDS:=@(TARGET_armsr_armv8) +kmod-marvell-mdio +kmod-phylink
+  KCONFIG:=CONFIG_MVNETA
+  FILES:=$(LINUX_DIR)/drivers/net/ethernet/marvell/mvneta.ko
+  AUTOLOAD=$(call AutoLoad,30,mvneta)
+endef
+
+$(eval $(call KernelPackage,mvneta))
+
+define KernelPackage/mvpp2
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=Marvell Armada 375/7K/8K network driver
+  DEPENDS:=@(TARGET_armsr_armv8) +kmod-marvell-mdio +kmod-phylink
+  KCONFIG:=CONFIG_MVPP2 \
+    CONFIG_MVPP2_PTP=n
+  FILES=$(LINUX_DIR)/drivers/net/ethernet/marvell/mvpp2/mvpp2.ko
+  AUTOLOAD=$(call AutoLoad,40,mvpp2)
+endef
+
+$(eval $(call KernelPackage,mvpp2))
+
+define KernelPackage/imx2-wdt
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=NXP (Freescale) i.MX2+ and Layerscape watchdog driver
+  KCONFIG:=CONFIG_IMX2_WDT
+  FILES=$(LINUX_DIR)/drivers/watchdog/imx2_wdt.ko
+  AUTOLOAD=$(call AutoLoad,60,imx2_wdt)
+endef
+
+$(eval $(call KernelPackage,imx2-wdt))
+
+define KernelPackage/imx7-ulp-wdt
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=NXP (Freescale) i.MX7ULP and later watchdog
+  KCONFIG:=CONFIG_IMX7ULP_WDT
+  FILES=$(LINUX_DIR)/drivers/watchdog/imx7ulp_wdt.ko
+  AUTOLOAD=$(call AutoLoad,60,imx7ulp_wdt)
+endef
+
+$(eval $(call KernelPackage,imx7-ulp-wdt))
+
+define KernelPackage/stmmac-core
+  SUBMENU=$(NETWORK_DEVICES_MENU)
+  TITLE:=Synopsis Ethernet Controller core (NXP,STMMicro,others)
+  DEPENDS:=@(TARGET_armsr_armv8) +kmod-pcs-xpcs +kmod-ptp \
+    +kmod-of-mdio
+  KCONFIG:=CONFIG_STMMAC_ETH \
+    CONFIG_STMMAC_SELFTESTS=n \
+    CONFIG_STMMAC_PLATFORM \
+    CONFIG_CONFIG_DWMAC_DWC_QOS_ETH=n \
+    CONFIG_DWMAC_GENERIC
+  FILES=$(LINUX_DIR)/drivers/net/ethernet/stmicro/stmmac/stmmac.ko \
+    $(LINUX_DIR)/drivers/net/ethernet/stmicro/stmmac/stmmac-platform.ko \
+    $(LINUX_DIR)/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.ko
+  AUTOLOAD=$(call AutoLoad,40,stmmac stmmac-platform dwmac-generic)
+endef
+
+$(eval $(call KernelPackage,stmmac-core))
+
+define KernelPackage/dwmac-imx
+  SUBMENU=$(NETWORK_DEVICES_MENU)
+  TITLE:=NXP i.MX8 Ethernet controller
+  DEPENDS:=+kmod-stmmac-core
+  KCONFIG:=CONFIG_DWMAC_IMX8
+  FILES=$(LINUX_DIR)/drivers/net/ethernet/stmicro/stmmac/dwmac-imx.ko
+  AUTOLOAD=$(call AutoLoad,45,dwmac-imx)
+endef
+
+$(eval $(call KernelPackage,dwmac-imx))
+
+define KernelPackage/dwmac-sun8i
+  SUBMENU=$(NETWORK_DEVICES_MENU)
+  TITLE:=Allwinner H3/A83T/A64 (sun8i) Ethernet
+  DEPENDS:=+kmod-stmmac-core +kmod-mdio-bus-mux
+  KCONFIG:=CONFIG_DWMAC_SUN8I
+  FILES=$(LINUX_DIR)/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.ko
+  AUTOLOAD=$(call AutoLoad,45,dwmac-sun8i)
+endef
+
+$(eval $(call KernelPackage,dwmac-sun8i))
+
+define KernelPackage/dwmac-rockchip
+  SUBMENU=$(NETWORK_DEVICES_MENU)
+  TITLE:=Rockchip RK3328/RK3399/RK3568 Ethernet
+  DEPENDS:=+kmod-stmmac-core +kmod-mdio-bus-mux
+  KCONFIG:=CONFIG_DWMAC_ROCKCHIP
+  FILES=$(LINUX_DIR)/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.ko
+  AUTOLOAD=$(call AutoLoad,45,dwmac-rk)
+endef
+
+$(eval $(call KernelPackage,dwmac-rockchip))
+
+define KernelPackage/thunderx-net
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=Marvell (Cavium) ThunderX/2 network drivers
+  DEPENDS:=@(TARGET_armsr_armv8) +kmod-phylink +kmod-of-mdio
+  KCONFIG:=CONFIG_NET_VENDOR_CAVIUM \
+    CONFIG_THUNDER_NIC_PF \
+    CONFIG_THUNDER_NIC_VF \
+    CONFIG_THUNDER_NIC_BGX \
+    CONFIG_THUNDER_NIC_RGX
+  FILES=$(LINUX_DIR)/drivers/net/ethernet/cavium/thunder/nicvf.ko \
+    $(LINUX_DIR)/drivers/net/ethernet/cavium/thunder/nicpf.ko \
+    $(LINUX_DIR)/drivers/net/ethernet/cavium/thunder/thunder_xcv.ko \
+    $(LINUX_DIR)/drivers/net/ethernet/cavium/thunder/thunder_bgx.ko
+  AUTOLOAD=$(call AutoLoad,40,nicpf nicvf thunder_xcv thunder_bgx)
+endef
+
+$(eval $(call KernelPackage,thunderx-net))
+
+define KernelPackage/wdt-sp805
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=ARM SP805 Watchdog
+  KCONFIG:=CONFIG_ARM_SP805_WATCHDOG
+  FILES=$(LINUX_DIR)/drivers/watchdog/sp805_wdt.ko
+  AUTOLOAD=$(call AutoLoad,50,sp805_wdt)
+endef
+
+define KernelPackage/wdt-sp805/description
+  Support for the ARM SP805 wathchdog module.
+  This is present in the NXP Layerscape family,
+  HiSilicon HI3660 among others.
+endef
+
+$(eval $(call KernelPackage,wdt-sp805))
+
diff --git a/target/linux/armsr/patches-6.1/221-armsr-disable_gc_sections_armv7.patch b/target/linux/armsr/patches-6.1/221-armsr-disable_gc_sections_armv7.patch
new file mode 100644
index 00000000000000..cb124c1cf8fde3
--- /dev/null
+++ b/target/linux/armsr/patches-6.1/221-armsr-disable_gc_sections_armv7.patch
@@ -0,0 +1,23 @@
+From b77c0ecdc7915e5c5c515da1aa6cfaf6f4eb8351 Mon Sep 17 00:00:00 2001
+From: Mathew McBride <matt@traverse.com.au>
+Date: Wed, 28 Sep 2022 16:39:31 +1000
+Subject: [PATCH] arm: disable code size reduction measures
+ (gc-sections,-f*-sections)
+
+This interferes with the EFI boot stub on armv7l.
+
+Signed-off-by: Mathew McBride <matt@traverse.com.au>
+---
+ arch/arm/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -122,7 +122,6 @@ config ARM
+ 	select HAVE_UID16
+ 	select HAVE_VIRT_CPU_ACCOUNTING_GEN
+ 	select IRQ_FORCED_THREADING
+-	select HAVE_LD_DEAD_CODE_DATA_ELIMINATION
+ 	select MODULES_USE_ELF_REL
+ 	select NEED_DMA_MAP_STATE
+ 	select OF_EARLY_FLATTREE if OF
diff --git a/target/linux/armsr/patches-6.1/701-v6.2-0001-net-dpaa2-eth-don-t-use-ENOTSUPP-error-code.patch b/target/linux/armsr/patches-6.1/701-v6.2-0001-net-dpaa2-eth-don-t-use-ENOTSUPP-error-code.patch
new file mode 100644
index 00000000000000..6238c0a9039cd6
--- /dev/null
+++ b/target/linux/armsr/patches-6.1/701-v6.2-0001-net-dpaa2-eth-don-t-use-ENOTSUPP-error-code.patch
@@ -0,0 +1,44 @@
+From f3763a0c1b07273218cbf5886bdf8df9df501111 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Tue, 29 Nov 2022 16:12:10 +0200
+Subject: [PATCH 03/14] net: dpaa2-eth: don't use -ENOTSUPP error code
+
+dpaa2_eth_setup_dpni() is called from the probe path and
+dpaa2_eth_set_link_ksettings() is propagated to user space.
+
+include/linux/errno.h says that ENOTSUPP is "Defined for the NFSv3
+protocol". Conventional wisdom has it to not use it in networking
+drivers. Replace it with -EOPNOTSUPP.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c     | 2 +-
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+@@ -3613,7 +3613,7 @@ static int dpaa2_eth_setup_dpni(struct f
+ 		dev_err(dev, "DPNI version %u.%u not supported, need >= %u.%u\n",
+ 			priv->dpni_ver_major, priv->dpni_ver_minor,
+ 			DPNI_VER_MAJOR, DPNI_VER_MINOR);
+-		err = -ENOTSUPP;
++		err = -EOPNOTSUPP;
+ 		goto close;
+ 	}
+ 
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c
+@@ -118,7 +118,7 @@ dpaa2_eth_set_link_ksettings(struct net_
+ 	struct dpaa2_eth_priv *priv = netdev_priv(net_dev);
+ 
+ 	if (!dpaa2_eth_is_type_phy(priv))
+-		return -ENOTSUPP;
++		return -EOPNOTSUPP;
+ 
+ 	return phylink_ethtool_ksettings_set(priv->mac->phylink, link_settings);
+ }
diff --git a/target/linux/armsr/patches-6.1/701-v6.2-0002-net-dpaa2-replace-dpaa2_mac_is_type_fixed-with-dpaa2.patch b/target/linux/armsr/patches-6.1/701-v6.2-0002-net-dpaa2-replace-dpaa2_mac_is_type_fixed-with-dpaa2.patch
new file mode 100644
index 00000000000000..501eaf42ff33dd
--- /dev/null
+++ b/target/linux/armsr/patches-6.1/701-v6.2-0002-net-dpaa2-replace-dpaa2_mac_is_type_fixed-with-dpaa2.patch
@@ -0,0 +1,99 @@
+From 022a11062261dc4703da846d3bf4d194ef6bebf5 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Tue, 29 Nov 2022 16:12:11 +0200
+Subject: [PATCH 04/14] net: dpaa2: replace dpaa2_mac_is_type_fixed() with
+ dpaa2_mac_is_type_phy()
+
+dpaa2_mac_is_type_fixed() is a header with no implementation and no
+callers, which is referenced from the documentation though. It can be
+deleted.
+
+On the other hand, it would be useful to reuse the code between
+dpaa2_eth_is_type_phy() and dpaa2_switch_port_is_type_phy(). That common
+code should be called dpaa2_mac_is_type_phy(), so let's create that.
+
+The removal and the addition are merged into the same patch because,
+in fact, is_type_phy() is the logical opposite of is_type_fixed().
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ .../ethernet/freescale/dpaa2/mac-phy-support.rst       |  9 ++++++---
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h       |  7 +------
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.h       | 10 ++++++++--
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.h    |  7 +------
+ 4 files changed, 16 insertions(+), 17 deletions(-)
+
+--- a/Documentation/networking/device_drivers/ethernet/freescale/dpaa2/mac-phy-support.rst
++++ b/Documentation/networking/device_drivers/ethernet/freescale/dpaa2/mac-phy-support.rst
+@@ -181,10 +181,13 @@ when necessary using the below listed AP
+  - int dpaa2_mac_connect(struct dpaa2_mac *mac);
+  - void dpaa2_mac_disconnect(struct dpaa2_mac *mac);
+ 
+-A phylink integration is necessary only when the partner DPMAC is not of TYPE_FIXED.
+-One can check for this condition using the below API::
++A phylink integration is necessary only when the partner DPMAC is not of
++``TYPE_FIXED``. This means it is either of ``TYPE_PHY``, or of
++``TYPE_BACKPLANE`` (the difference being the two that in the ``TYPE_BACKPLANE``
++mode, the MC firmware does not access the PCS registers). One can check for
++this condition using the following helper::
+ 
+- - bool dpaa2_mac_is_type_fixed(struct fsl_mc_device *dpmac_dev,struct fsl_mc_io *mc_io);
++ - static inline bool dpaa2_mac_is_type_phy(struct dpaa2_mac *mac);
+ 
+ Before connection to a MAC, the caller must allocate and populate the
+ dpaa2_mac structure with the associated net_device, a pointer to the MC portal
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h
+@@ -733,12 +733,7 @@ static inline unsigned int dpaa2_eth_rx_
+ 
+ static inline bool dpaa2_eth_is_type_phy(struct dpaa2_eth_priv *priv)
+ {
+-	if (priv->mac &&
+-	    (priv->mac->attr.link_type == DPMAC_LINK_TYPE_PHY ||
+-	     priv->mac->attr.link_type == DPMAC_LINK_TYPE_BACKPLANE))
+-		return true;
+-
+-	return false;
++	return dpaa2_mac_is_type_phy(priv->mac);
+ }
+ 
+ static inline bool dpaa2_eth_has_mac(struct dpaa2_eth_priv *priv)
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.h
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.h
+@@ -30,8 +30,14 @@ struct dpaa2_mac {
+ 	struct phy *serdes_phy;
+ };
+ 
+-bool dpaa2_mac_is_type_fixed(struct fsl_mc_device *dpmac_dev,
+-			     struct fsl_mc_io *mc_io);
++static inline bool dpaa2_mac_is_type_phy(struct dpaa2_mac *mac)
++{
++	if (!mac)
++		return false;
++
++	return mac->attr.link_type == DPMAC_LINK_TYPE_PHY ||
++	       mac->attr.link_type == DPMAC_LINK_TYPE_BACKPLANE;
++}
+ 
+ int dpaa2_mac_open(struct dpaa2_mac *mac);
+ 
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.h
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.h
+@@ -230,12 +230,7 @@ static inline bool dpaa2_switch_supports
+ static inline bool
+ dpaa2_switch_port_is_type_phy(struct ethsw_port_priv *port_priv)
+ {
+-	if (port_priv->mac &&
+-	    (port_priv->mac->attr.link_type == DPMAC_LINK_TYPE_PHY ||
+-	     port_priv->mac->attr.link_type == DPMAC_LINK_TYPE_BACKPLANE))
+-		return true;
+-
+-	return false;
++	return dpaa2_mac_is_type_phy(port_priv->mac);
+ }
+ 
+ static inline bool dpaa2_switch_port_has_mac(struct ethsw_port_priv *port_priv)
diff --git a/target/linux/armsr/patches-6.1/701-v6.2-0003-net-dpaa2-mac-absorb-phylink_start-call-into-dpaa2_m.patch b/target/linux/armsr/patches-6.1/701-v6.2-0003-net-dpaa2-mac-absorb-phylink_start-call-into-dpaa2_m.patch
new file mode 100644
index 00000000000000..e84195f3cd7eff
--- /dev/null
+++ b/target/linux/armsr/patches-6.1/701-v6.2-0003-net-dpaa2-mac-absorb-phylink_start-call-into-dpaa2_m.patch
@@ -0,0 +1,88 @@
+From 97c07369ab8bf9895e05d4b468f18e6567263154 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Tue, 29 Nov 2022 16:12:12 +0200
+Subject: [PATCH 05/14] net: dpaa2-mac: absorb phylink_start() call into
+ dpaa2_mac_start()
+
+The phylink handling is intended to be hidden inside the dpaa2_mac
+object. Move the phylink_start() call into dpaa2_mac_start(), and
+phylink_stop() into dpaa2_mac_stop().
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c    | 5 +----
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c    | 8 ++++++++
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c | 5 +----
+ 3 files changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+@@ -2082,10 +2082,8 @@ static int dpaa2_eth_open(struct net_dev
+ 		goto enable_err;
+ 	}
+ 
+-	if (dpaa2_eth_is_type_phy(priv)) {
++	if (dpaa2_eth_is_type_phy(priv))
+ 		dpaa2_mac_start(priv->mac);
+-		phylink_start(priv->mac->phylink);
+-	}
+ 
+ 	return 0;
+ 
+@@ -2159,7 +2157,6 @@ static int dpaa2_eth_stop(struct net_dev
+ 	int retries = 10;
+ 
+ 	if (dpaa2_eth_is_type_phy(priv)) {
+-		phylink_stop(priv->mac->phylink);
+ 		dpaa2_mac_stop(priv->mac);
+ 	} else {
+ 		netif_tx_stop_all_queues(net_dev);
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c
+@@ -336,12 +336,20 @@ static void dpaa2_mac_set_supported_inte
+ 
+ void dpaa2_mac_start(struct dpaa2_mac *mac)
+ {
++	ASSERT_RTNL();
++
+ 	if (mac->serdes_phy)
+ 		phy_power_on(mac->serdes_phy);
++
++	phylink_start(mac->phylink);
+ }
+ 
+ void dpaa2_mac_stop(struct dpaa2_mac *mac)
+ {
++	ASSERT_RTNL();
++
++	phylink_stop(mac->phylink);
++
+ 	if (mac->serdes_phy)
+ 		phy_power_off(mac->serdes_phy);
+ }
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
+@@ -703,10 +703,8 @@ static int dpaa2_switch_port_open(struct
+ 
+ 	dpaa2_switch_enable_ctrl_if_napi(ethsw);
+ 
+-	if (dpaa2_switch_port_is_type_phy(port_priv)) {
++	if (dpaa2_switch_port_is_type_phy(port_priv))
+ 		dpaa2_mac_start(port_priv->mac);
+-		phylink_start(port_priv->mac->phylink);
+-	}
+ 
+ 	return 0;
+ }
+@@ -718,7 +716,6 @@ static int dpaa2_switch_port_stop(struct
+ 	int err;
+ 
+ 	if (dpaa2_switch_port_is_type_phy(port_priv)) {
+-		phylink_stop(port_priv->mac->phylink);
+ 		dpaa2_mac_stop(port_priv->mac);
+ 	} else {
+ 		netif_tx_stop_all_queues(netdev);
diff --git a/target/linux/armsr/patches-6.1/701-v6.2-0004-net-dpaa2-mac-remove-defensive-check-in-dpaa2_mac_di.patch b/target/linux/armsr/patches-6.1/701-v6.2-0004-net-dpaa2-mac-remove-defensive-check-in-dpaa2_mac_di.patch
new file mode 100644
index 00000000000000..c3028357fe5894
--- /dev/null
+++ b/target/linux/armsr/patches-6.1/701-v6.2-0004-net-dpaa2-mac-remove-defensive-check-in-dpaa2_mac_di.patch
@@ -0,0 +1,50 @@
+From 095ef388f714d622aa503fcccf20dc4095b72762 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Tue, 29 Nov 2022 16:12:13 +0200
+Subject: [PATCH 06/14] net: dpaa2-mac: remove defensive check in
+ dpaa2_mac_disconnect()
+
+dpaa2_mac_disconnect() will only be called with a NULL mac->phylink if
+dpaa2_mac_connect() failed, or was never called.
+
+The callers are these:
+
+dpaa2_eth_disconnect_mac():
+
+	if (dpaa2_eth_is_type_phy(priv))
+		dpaa2_mac_disconnect(priv->mac);
+
+dpaa2_switch_port_disconnect_mac():
+
+	if (dpaa2_switch_port_is_type_phy(port_priv))
+		dpaa2_mac_disconnect(port_priv->mac);
+
+priv->mac can be NULL, but in that case, dpaa2_eth_is_type_phy() returns
+false, and dpaa2_mac_disconnect() is never called. Similar for
+dpaa2-switch.
+
+When priv->mac is non-NULL, it means that dpaa2_mac_connect() returned
+zero (success), and therefore, priv->mac->phylink is also a valid
+pointer.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c
+@@ -446,9 +446,6 @@ err_pcs_destroy:
+ 
+ void dpaa2_mac_disconnect(struct dpaa2_mac *mac)
+ {
+-	if (!mac->phylink)
+-		return;
+-
+ 	phylink_disconnect_phy(mac->phylink);
+ 	phylink_destroy(mac->phylink);
+ 	dpaa2_pcs_destroy(mac);
diff --git a/target/linux/armsr/patches-6.1/701-v6.2-0005-net-dpaa2-eth-assign-priv-mac-after-dpaa2_mac_connec.patch b/target/linux/armsr/patches-6.1/701-v6.2-0005-net-dpaa2-eth-assign-priv-mac-after-dpaa2_mac_connec.patch
new file mode 100644
index 00000000000000..8c7ed6c793fefa
--- /dev/null
+++ b/target/linux/armsr/patches-6.1/701-v6.2-0005-net-dpaa2-eth-assign-priv-mac-after-dpaa2_mac_connec.patch
@@ -0,0 +1,101 @@
+From 06efc9b8a1360cad83cae6e71558e5458cc1fbf3 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Tue, 29 Nov 2022 16:12:14 +0200
+Subject: [PATCH 07/14] net: dpaa2-eth: assign priv->mac after
+ dpaa2_mac_connect() call
+
+There are 2 requirements for correct code:
+
+- Any time the driver accesses the priv->mac pointer at runtime, it
+  either holds NULL to indicate a DPNI-DPNI connection (or unconnected
+  DPNI), or a struct dpaa2_mac whose phylink instance was fully
+  initialized (created and connected to the PHY). No changes are made to
+  priv->mac while it is being used. Currently, rtnl_lock() watches over
+  the call to dpaa2_eth_connect_mac(), so it serves the purpose of
+  serializing this with all readers of priv->mac.
+
+- dpaa2_mac_connect() should run unlocked, because inside it are 2
+  phylink calls with incompatible locking requirements: phylink_create()
+  requires that the rtnl_mutex isn't held, and phylink_fwnode_phy_connect()
+  requires that the rtnl_mutex is held. The only way to solve those
+  contradictory requirements is to let dpaa2_mac_connect() take
+  rtnl_lock() when it needs to.
+
+To solve both requirements, we need to identify the writer side of the
+priv->mac pointer, which can be wrapped in a mutex private to the driver
+in a future patch. The dpaa2_mac_connect() cannot be part of the writer
+side critical section, because of an AB/BA deadlock with rtnl_lock().
+
+So the strategy needs to be that where we prepare the DPMAC by calling
+dpaa2_mac_connect(), and only make priv->mac point to it once it's fully
+prepared. This ensures that the writer side critical section has the
+absolute minimum surface it can.
+
+The reverse strategy is adopted in the dpaa2_eth_disconnect_mac() code
+path. This makes sure that priv->mac is NULL when we start tearing down
+the DPMAC that we disconnected from, and concurrent code will simply not
+see it.
+
+No locking changes in this patch (concurrent code is still blocked by
+the rtnl_mutex).
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ .../net/ethernet/freescale/dpaa2/dpaa2-eth.c  | 21 +++++++++++--------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+@@ -4443,9 +4443,8 @@ static int dpaa2_eth_connect_mac(struct
+ 	err = dpaa2_mac_open(mac);
+ 	if (err)
+ 		goto err_free_mac;
+-	priv->mac = mac;
+ 
+-	if (dpaa2_eth_is_type_phy(priv)) {
++	if (dpaa2_mac_is_type_phy(mac)) {
+ 		err = dpaa2_mac_connect(mac);
+ 		if (err && err != -EPROBE_DEFER)
+ 			netdev_err(priv->net_dev, "Error connecting to the MAC endpoint: %pe",
+@@ -4454,11 +4453,12 @@ static int dpaa2_eth_connect_mac(struct
+ 			goto err_close_mac;
+ 	}
+ 
++	priv->mac = mac;
++
+ 	return 0;
+ 
+ err_close_mac:
+ 	dpaa2_mac_close(mac);
+-	priv->mac = NULL;
+ err_free_mac:
+ 	kfree(mac);
+ 	return err;
+@@ -4466,15 +4466,18 @@ err_free_mac:
+ 
+ static void dpaa2_eth_disconnect_mac(struct dpaa2_eth_priv *priv)
+ {
+-	if (dpaa2_eth_is_type_phy(priv))
+-		dpaa2_mac_disconnect(priv->mac);
++	struct dpaa2_mac *mac = priv->mac;
++
++	priv->mac = NULL;
+ 
+-	if (!dpaa2_eth_has_mac(priv))
++	if (!mac)
+ 		return;
+ 
+-	dpaa2_mac_close(priv->mac);
+-	kfree(priv->mac);
+-	priv->mac = NULL;
++	if (dpaa2_mac_is_type_phy(mac))
++		dpaa2_mac_disconnect(mac);
++
++	dpaa2_mac_close(mac);
++	kfree(mac);
+ }
+ 
+ static irqreturn_t dpni_irq0_handler_thread(int irq_num, void *arg)
diff --git a/target/linux/armsr/patches-6.1/701-v6.2-0006-net-dpaa2-switch-assign-port_priv-mac-after-dpaa2_ma.patch b/target/linux/armsr/patches-6.1/701-v6.2-0006-net-dpaa2-switch-assign-port_priv-mac-after-dpaa2_ma.patch
new file mode 100644
index 00000000000000..e63654984a5194
--- /dev/null
+++ b/target/linux/armsr/patches-6.1/701-v6.2-0006-net-dpaa2-switch-assign-port_priv-mac-after-dpaa2_ma.patch
@@ -0,0 +1,73 @@
+From a5e7f7e277bd4403c45c1c7922d56d0eb08dbc7c Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Tue, 29 Nov 2022 16:12:15 +0200
+Subject: [PATCH 08/14] net: dpaa2-switch: assign port_priv->mac after
+ dpaa2_mac_connect() call
+
+The dpaa2-switch has the exact same locking requirements when connected
+to a DPMAC, so it needs port_priv->mac to always point either to NULL,
+or to a DPMAC with a fully initialized phylink instance.
+
+Make the same preparatory change in the dpaa2-switch driver as in the
+dpaa2-eth one.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ .../ethernet/freescale/dpaa2/dpaa2-switch.c   | 21 +++++++++++--------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
+@@ -1450,9 +1450,8 @@ static int dpaa2_switch_port_connect_mac
+ 	err = dpaa2_mac_open(mac);
+ 	if (err)
+ 		goto err_free_mac;
+-	port_priv->mac = mac;
+ 
+-	if (dpaa2_switch_port_is_type_phy(port_priv)) {
++	if (dpaa2_mac_is_type_phy(mac)) {
+ 		err = dpaa2_mac_connect(mac);
+ 		if (err) {
+ 			netdev_err(port_priv->netdev,
+@@ -1462,11 +1461,12 @@ static int dpaa2_switch_port_connect_mac
+ 		}
+ 	}
+ 
++	port_priv->mac = mac;
++
+ 	return 0;
+ 
+ err_close_mac:
+ 	dpaa2_mac_close(mac);
+-	port_priv->mac = NULL;
+ err_free_mac:
+ 	kfree(mac);
+ 	return err;
+@@ -1474,15 +1474,18 @@ err_free_mac:
+ 
+ static void dpaa2_switch_port_disconnect_mac(struct ethsw_port_priv *port_priv)
+ {
+-	if (dpaa2_switch_port_is_type_phy(port_priv))
+-		dpaa2_mac_disconnect(port_priv->mac);
++	struct dpaa2_mac *mac = port_priv->mac;
++
++	port_priv->mac = NULL;
+ 
+-	if (!dpaa2_switch_port_has_mac(port_priv))
++	if (!mac)
+ 		return;
+ 
+-	dpaa2_mac_close(port_priv->mac);
+-	kfree(port_priv->mac);
+-	port_priv->mac = NULL;
++	if (dpaa2_mac_is_type_phy(mac))
++		dpaa2_mac_disconnect(mac);
++
++	dpaa2_mac_close(mac);
++	kfree(mac);
+ }
+ 
+ static irqreturn_t dpaa2_switch_irq0_handler_thread(int irq_num, void *arg)
diff --git a/target/linux/armsr/patches-6.1/701-v6.2-0007-net-dpaa2-publish-MAC-stringset-to-ethtool-S-even-if.patch b/target/linux/armsr/patches-6.1/701-v6.2-0007-net-dpaa2-publish-MAC-stringset-to-ethtool-S-even-if.patch
new file mode 100644
index 00000000000000..c790ba1bd50680
--- /dev/null
+++ b/target/linux/armsr/patches-6.1/701-v6.2-0007-net-dpaa2-publish-MAC-stringset-to-ethtool-S-even-if.patch
@@ -0,0 +1,111 @@
+From ce44b6ed9ee65efa9b3025552c513842eabcab88 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Tue, 29 Nov 2022 16:12:16 +0200
+Subject: [PATCH 09/14] net: dpaa2: publish MAC stringset to ethtool -S even if
+ MAC is missing
+
+DPNIs and DPSW objects can connect and disconnect at runtime from DPMAC
+objects on the same fsl-mc bus. The DPMAC object also holds "ethtool -S"
+unstructured counters. Those counters are only shown for the entity
+owning the netdev (DPNI, DPSW) if it's connected to a DPMAC.
+
+The ethtool stringset code path is split into multiple callbacks, but
+currently, connecting and disconnecting the DPMAC takes the rtnl_lock().
+This blocks the entire ethtool code path from running, see
+ethnl_default_doit() -> rtnl_lock() -> ops->prepare_data() ->
+strset_prepare_data().
+
+This is going to be a problem if we are going to no longer require
+rtnl_lock() when connecting/disconnecting the DPMAC, because the DPMAC
+could appear between ops->get_sset_count() and ops->get_strings().
+If it appears out of the blue, we will provide a stringset into an array
+that was dimensioned thinking the DPMAC wouldn't be there => array
+accessed out of bounds.
+
+There isn't really a good way to work around that, and I don't want to
+put too much pressure on the ethtool framework by playing locking games.
+Just make the DPMAC counters be always available. They'll be zeroes if
+the DPNI or DPSW isn't connected to a DPMAC.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c | 12 +++---------
+ .../ethernet/freescale/dpaa2/dpaa2-switch-ethtool.c  | 11 ++---------
+ 2 files changed, 5 insertions(+), 18 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c
+@@ -186,7 +186,6 @@ static int dpaa2_eth_set_pauseparam(stru
+ static void dpaa2_eth_get_strings(struct net_device *netdev, u32 stringset,
+ 				  u8 *data)
+ {
+-	struct dpaa2_eth_priv *priv = netdev_priv(netdev);
+ 	u8 *p = data;
+ 	int i;
+ 
+@@ -200,22 +199,17 @@ static void dpaa2_eth_get_strings(struct
+ 			strscpy(p, dpaa2_ethtool_extras[i], ETH_GSTRING_LEN);
+ 			p += ETH_GSTRING_LEN;
+ 		}
+-		if (dpaa2_eth_has_mac(priv))
+-			dpaa2_mac_get_strings(p);
++		dpaa2_mac_get_strings(p);
+ 		break;
+ 	}
+ }
+ 
+ static int dpaa2_eth_get_sset_count(struct net_device *net_dev, int sset)
+ {
+-	int num_ss_stats = DPAA2_ETH_NUM_STATS + DPAA2_ETH_NUM_EXTRA_STATS;
+-	struct dpaa2_eth_priv *priv = netdev_priv(net_dev);
+-
+ 	switch (sset) {
+ 	case ETH_SS_STATS: /* ethtool_get_stats(), ethtool_get_drvinfo() */
+-		if (dpaa2_eth_has_mac(priv))
+-			num_ss_stats += dpaa2_mac_get_sset_count();
+-		return num_ss_stats;
++		return DPAA2_ETH_NUM_STATS + DPAA2_ETH_NUM_EXTRA_STATS +
++		       dpaa2_mac_get_sset_count();
+ 	default:
+ 		return -EOPNOTSUPP;
+ 	}
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-ethtool.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-ethtool.c
+@@ -145,14 +145,9 @@ dpaa2_switch_set_link_ksettings(struct n
+ static int
+ dpaa2_switch_ethtool_get_sset_count(struct net_device *netdev, int sset)
+ {
+-	struct ethsw_port_priv *port_priv = netdev_priv(netdev);
+-	int num_ss_stats = DPAA2_SWITCH_NUM_COUNTERS;
+-
+ 	switch (sset) {
+ 	case ETH_SS_STATS:
+-		if (port_priv->mac)
+-			num_ss_stats += dpaa2_mac_get_sset_count();
+-		return num_ss_stats;
++		return DPAA2_SWITCH_NUM_COUNTERS + dpaa2_mac_get_sset_count();
+ 	default:
+ 		return -EOPNOTSUPP;
+ 	}
+@@ -161,7 +156,6 @@ dpaa2_switch_ethtool_get_sset_count(stru
+ static void dpaa2_switch_ethtool_get_strings(struct net_device *netdev,
+ 					     u32 stringset, u8 *data)
+ {
+-	struct ethsw_port_priv *port_priv = netdev_priv(netdev);
+ 	u8 *p = data;
+ 	int i;
+ 
+@@ -172,8 +166,7 @@ static void dpaa2_switch_ethtool_get_str
+ 			       ETH_GSTRING_LEN);
+ 			p += ETH_GSTRING_LEN;
+ 		}
+-		if (port_priv->mac)
+-			dpaa2_mac_get_strings(p);
++		dpaa2_mac_get_strings(p);
+ 		break;
+ 	}
+ }
diff --git a/target/linux/armsr/patches-6.1/701-v6.2-0008-net-dpaa2-switch-replace-direct-MAC-access-with-dpaa.patch b/target/linux/armsr/patches-6.1/701-v6.2-0008-net-dpaa2-switch-replace-direct-MAC-access-with-dpaa.patch
new file mode 100644
index 00000000000000..0663bf6fb10f17
--- /dev/null
+++ b/target/linux/armsr/patches-6.1/701-v6.2-0008-net-dpaa2-switch-replace-direct-MAC-access-with-dpaa.patch
@@ -0,0 +1,28 @@
+From c838d9fd7e6ba9ddd6006bf0a296396266e9f121 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Tue, 29 Nov 2022 16:12:17 +0200
+Subject: [PATCH 10/14] net: dpaa2-switch replace direct MAC access with
+ dpaa2_switch_port_has_mac()
+
+The helper function will gain a lockdep annotation in a future patch.
+Make sure to benefit from it.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-ethtool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-ethtool.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-ethtool.c
+@@ -189,7 +189,7 @@ static void dpaa2_switch_ethtool_get_sta
+ 				   dpaa2_switch_ethtool_counters[i].name, err);
+ 	}
+ 
+-	if (port_priv->mac)
++	if (dpaa2_switch_port_has_mac(port_priv))
+ 		dpaa2_mac_get_ethtool_stats(port_priv->mac, data + i);
+ }
+ 
diff --git a/target/linux/armsr/patches-6.1/701-v6.2-0009-net-dpaa2-eth-connect-to-MAC-before-requesting-the-e.patch b/target/linux/armsr/patches-6.1/701-v6.2-0009-net-dpaa2-eth-connect-to-MAC-before-requesting-the-e.patch
new file mode 100644
index 00000000000000..37831f264b8e64
--- /dev/null
+++ b/target/linux/armsr/patches-6.1/701-v6.2-0009-net-dpaa2-eth-connect-to-MAC-before-requesting-the-e.patch
@@ -0,0 +1,93 @@
+From e0ea63162cb5f1ca7f844d6ef5fc4079448ee2d5 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Tue, 29 Nov 2022 16:12:18 +0200
+Subject: [PATCH 11/14] net: dpaa2-eth: connect to MAC before requesting the
+ "endpoint changed" IRQ
+
+dpaa2_eth_connect_mac() is called both from dpaa2_eth_probe() and from
+dpni_irq0_handler_thread().
+
+It could happen that the DPNI gets connected to a DPMAC on the fsl-mc
+bus exactly during probe, as soon as the "endpoint change" interrupt is
+requested in dpaa2_eth_setup_irqs(). This will cause the
+dpni_irq0_handler_thread() to register a phylink instance for that DPMAC.
+
+Then, the probing function will also try to register a phylink instance
+for the same DPMAC, operation which should fail (and this will fail the
+probing of the driver).
+
+Reorder dpaa2_eth_setup_irqs() and dpaa2_eth_connect_mac(), such that
+dpni_irq0_handler_thread() never races with the DPMAC-related portion of
+the probing path.
+
+Also reorder dpaa2_eth_disconnect_mac() to be in the mirror position of
+dpaa2_eth_connect_mac() in the teardown path.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ .../net/ethernet/freescale/dpaa2/dpaa2-eth.c   | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+@@ -4710,6 +4710,10 @@ static int dpaa2_eth_probe(struct fsl_mc
+ 	}
+ #endif
+ 
++	err = dpaa2_eth_connect_mac(priv);
++	if (err)
++		goto err_connect_mac;
++
+ 	err = dpaa2_eth_setup_irqs(dpni_dev);
+ 	if (err) {
+ 		netdev_warn(net_dev, "Failed to set link interrupt, fall back to polling\n");
+@@ -4722,10 +4726,6 @@ static int dpaa2_eth_probe(struct fsl_mc
+ 		priv->do_link_poll = true;
+ 	}
+ 
+-	err = dpaa2_eth_connect_mac(priv);
+-	if (err)
+-		goto err_connect_mac;
+-
+ 	err = dpaa2_eth_dl_alloc(priv);
+ 	if (err)
+ 		goto err_dl_register;
+@@ -4759,13 +4759,13 @@ err_dl_port_add:
+ err_dl_trap_register:
+ 	dpaa2_eth_dl_free(priv);
+ err_dl_register:
+-	dpaa2_eth_disconnect_mac(priv);
+-err_connect_mac:
+ 	if (priv->do_link_poll)
+ 		kthread_stop(priv->poll_thread);
+ 	else
+ 		fsl_mc_free_irqs(dpni_dev);
+ err_poll_thread:
++	dpaa2_eth_disconnect_mac(priv);
++err_connect_mac:
+ 	dpaa2_eth_free_rings(priv);
+ err_alloc_rings:
+ err_csum:
+@@ -4813,9 +4813,6 @@ static int dpaa2_eth_remove(struct fsl_m
+ #endif
+ 
+ 	unregister_netdev(net_dev);
+-	rtnl_lock();
+-	dpaa2_eth_disconnect_mac(priv);
+-	rtnl_unlock();
+ 
+ 	dpaa2_eth_dl_port_del(priv);
+ 	dpaa2_eth_dl_traps_unregister(priv);
+@@ -4826,6 +4823,9 @@ static int dpaa2_eth_remove(struct fsl_m
+ 	else
+ 		fsl_mc_free_irqs(ls_dev);
+ 
++	rtnl_lock();
++	dpaa2_eth_disconnect_mac(priv);
++	rtnl_unlock();
+ 	dpaa2_eth_free_rings(priv);
+ 	free_percpu(priv->fd);
+ 	free_percpu(priv->sgt_cache);
diff --git a/target/linux/armsr/patches-6.1/701-v6.2-0010-net-dpaa2-eth-serialize-changes-to-priv-mac-with-a-m.patch b/target/linux/armsr/patches-6.1/701-v6.2-0010-net-dpaa2-eth-serialize-changes-to-priv-mac-with-a-m.patch
new file mode 100644
index 00000000000000..89f58412d40523
--- /dev/null
+++ b/target/linux/armsr/patches-6.1/701-v6.2-0010-net-dpaa2-eth-serialize-changes-to-priv-mac-with-a-m.patch
@@ -0,0 +1,320 @@
+From 5e448a17dfa2e95166534df7f677a3694ef6187d Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Tue, 29 Nov 2022 16:12:19 +0200
+Subject: [PATCH 12/14] net: dpaa2-eth: serialize changes to priv->mac with a
+ mutex
+
+The dpaa2 architecture permits dynamic connections between objects on
+the fsl-mc bus, specifically between a DPNI object (represented by a
+struct net_device) and a DPMAC object (represented by a struct phylink).
+
+The DPNI driver is notified when those connections are created/broken
+through the dpni_irq0_handler_thread() method. To ensure that ethtool
+operations, as well as netdev up/down operations serialize with the
+connection/disconnection of the DPNI with a DPMAC,
+dpni_irq0_handler_thread() takes the rtnl_lock() to block those other
+operations from taking place.
+
+There is code called by dpaa2_mac_connect() which wants to acquire the
+rtnl_mutex once again, see phylink_create() -> phylink_register_sfp() ->
+sfp_bus_add_upstream() -> rtnl_lock(). So the strategy doesn't quite
+work out, even though it's fairly simple.
+
+Create a different strategy, where all code paths in the dpaa2-eth
+driver access priv->mac only while they are holding priv->mac_lock.
+The phylink instance is not created or connected to the PHY under the
+priv->mac_lock, but only assigned to priv->mac then. This will eliminate
+the reliance on the rtnl_mutex.
+
+Add lockdep annotations and put comments where holding the lock is not
+necessary, and priv->mac can be dereferenced freely.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ .../net/ethernet/freescale/dpaa2/dpaa2-eth.c  | 43 ++++++++++++--
+ .../net/ethernet/freescale/dpaa2/dpaa2-eth.h  |  6 ++
+ .../ethernet/freescale/dpaa2/dpaa2-ethtool.c  | 58 +++++++++++++++----
+ 3 files changed, 91 insertions(+), 16 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+@@ -2020,8 +2020,11 @@ static int dpaa2_eth_link_state_update(s
+ 
+ 	/* When we manage the MAC/PHY using phylink there is no need
+ 	 * to manually update the netif_carrier.
++	 * We can avoid locking because we are called from the "link changed"
++	 * IRQ handler, which is the same as the "endpoint changed" IRQ handler
++	 * (the writer to priv->mac), so we cannot race with it.
+ 	 */
+-	if (dpaa2_eth_is_type_phy(priv))
++	if (dpaa2_mac_is_type_phy(priv->mac))
+ 		goto out;
+ 
+ 	/* Chech link state; speed / duplex changes are not treated yet */
+@@ -2060,6 +2063,8 @@ static int dpaa2_eth_open(struct net_dev
+ 			   priv->dpbp_dev->obj_desc.id, priv->bpid);
+ 	}
+ 
++	mutex_lock(&priv->mac_lock);
++
+ 	if (!dpaa2_eth_is_type_phy(priv)) {
+ 		/* We'll only start the txqs when the link is actually ready;
+ 		 * make sure we don't race against the link up notification,
+@@ -2078,6 +2083,7 @@ static int dpaa2_eth_open(struct net_dev
+ 
+ 	err = dpni_enable(priv->mc_io, 0, priv->mc_token);
+ 	if (err < 0) {
++		mutex_unlock(&priv->mac_lock);
+ 		netdev_err(net_dev, "dpni_enable() failed\n");
+ 		goto enable_err;
+ 	}
+@@ -2085,6 +2091,8 @@ static int dpaa2_eth_open(struct net_dev
+ 	if (dpaa2_eth_is_type_phy(priv))
+ 		dpaa2_mac_start(priv->mac);
+ 
++	mutex_unlock(&priv->mac_lock);
++
+ 	return 0;
+ 
+ enable_err:
+@@ -2156,6 +2164,8 @@ static int dpaa2_eth_stop(struct net_dev
+ 	int dpni_enabled = 0;
+ 	int retries = 10;
+ 
++	mutex_lock(&priv->mac_lock);
++
+ 	if (dpaa2_eth_is_type_phy(priv)) {
+ 		dpaa2_mac_stop(priv->mac);
+ 	} else {
+@@ -2163,6 +2173,8 @@ static int dpaa2_eth_stop(struct net_dev
+ 		netif_carrier_off(net_dev);
+ 	}
+ 
++	mutex_unlock(&priv->mac_lock);
++
+ 	/* On dpni_disable(), the MC firmware will:
+ 	 * - stop MAC Rx and wait for all Rx frames to be enqueued to software
+ 	 * - cut off WRIOP dequeues from egress FQs and wait until transmission
+@@ -2488,12 +2500,20 @@ static int dpaa2_eth_ts_ioctl(struct net
+ static int dpaa2_eth_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+ {
+ 	struct dpaa2_eth_priv *priv = netdev_priv(dev);
++	int err;
+ 
+ 	if (cmd == SIOCSHWTSTAMP)
+ 		return dpaa2_eth_ts_ioctl(dev, rq, cmd);
+ 
+-	if (dpaa2_eth_is_type_phy(priv))
+-		return phylink_mii_ioctl(priv->mac->phylink, rq, cmd);
++	mutex_lock(&priv->mac_lock);
++
++	if (dpaa2_eth_is_type_phy(priv)) {
++		err = phylink_mii_ioctl(priv->mac->phylink, rq, cmd);
++		mutex_unlock(&priv->mac_lock);
++		return err;
++	}
++
++	mutex_unlock(&priv->mac_lock);
+ 
+ 	return -EOPNOTSUPP;
+ }
+@@ -4453,7 +4473,9 @@ static int dpaa2_eth_connect_mac(struct
+ 			goto err_close_mac;
+ 	}
+ 
++	mutex_lock(&priv->mac_lock);
+ 	priv->mac = mac;
++	mutex_unlock(&priv->mac_lock);
+ 
+ 	return 0;
+ 
+@@ -4466,9 +4488,12 @@ err_free_mac:
+ 
+ static void dpaa2_eth_disconnect_mac(struct dpaa2_eth_priv *priv)
+ {
+-	struct dpaa2_mac *mac = priv->mac;
++	struct dpaa2_mac *mac;
+ 
++	mutex_lock(&priv->mac_lock);
++	mac = priv->mac;
+ 	priv->mac = NULL;
++	mutex_unlock(&priv->mac_lock);
+ 
+ 	if (!mac)
+ 		return;
+@@ -4487,6 +4512,7 @@ static irqreturn_t dpni_irq0_handler_thr
+ 	struct fsl_mc_device *dpni_dev = to_fsl_mc_device(dev);
+ 	struct net_device *net_dev = dev_get_drvdata(dev);
+ 	struct dpaa2_eth_priv *priv = netdev_priv(net_dev);
++	bool had_mac;
+ 	int err;
+ 
+ 	err = dpni_get_irq_status(dpni_dev->mc_io, 0, dpni_dev->mc_handle,
+@@ -4504,7 +4530,12 @@ static irqreturn_t dpni_irq0_handler_thr
+ 		dpaa2_eth_update_tx_fqids(priv);
+ 
+ 		rtnl_lock();
+-		if (dpaa2_eth_has_mac(priv))
++		/* We can avoid locking because the "endpoint changed" IRQ
++		 * handler is the only one who changes priv->mac at runtime,
++		 * so we are not racing with anyone.
++		 */
++		had_mac = !!priv->mac;
++		if (had_mac)
+ 			dpaa2_eth_disconnect_mac(priv);
+ 		else
+ 			dpaa2_eth_connect_mac(priv);
+@@ -4605,6 +4636,8 @@ static int dpaa2_eth_probe(struct fsl_mc
+ 	priv = netdev_priv(net_dev);
+ 	priv->net_dev = net_dev;
+ 
++	mutex_init(&priv->mac_lock);
++
+ 	priv->iommu_domain = iommu_get_domain_for_dev(dev);
+ 
+ 	priv->tx_tstamp_type = HWTSTAMP_TX_OFF;
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h
+@@ -580,6 +580,8 @@ struct dpaa2_eth_priv {
+ #endif
+ 
+ 	struct dpaa2_mac *mac;
++	/* Serializes changes to priv->mac */
++	struct mutex		mac_lock;
+ 	struct workqueue_struct	*dpaa2_ptp_wq;
+ 	struct work_struct	tx_onestep_tstamp;
+ 	struct sk_buff_head	tx_skbs;
+@@ -733,11 +735,15 @@ static inline unsigned int dpaa2_eth_rx_
+ 
+ static inline bool dpaa2_eth_is_type_phy(struct dpaa2_eth_priv *priv)
+ {
++	lockdep_assert_held(&priv->mac_lock);
++
+ 	return dpaa2_mac_is_type_phy(priv->mac);
+ }
+ 
+ static inline bool dpaa2_eth_has_mac(struct dpaa2_eth_priv *priv)
+ {
++	lockdep_assert_held(&priv->mac_lock);
++
+ 	return priv->mac ? true : false;
+ }
+ 
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c
+@@ -86,11 +86,16 @@ static void dpaa2_eth_get_drvinfo(struct
+ static int dpaa2_eth_nway_reset(struct net_device *net_dev)
+ {
+ 	struct dpaa2_eth_priv *priv = netdev_priv(net_dev);
++	int err = -EOPNOTSUPP;
++
++	mutex_lock(&priv->mac_lock);
+ 
+ 	if (dpaa2_eth_is_type_phy(priv))
+-		return phylink_ethtool_nway_reset(priv->mac->phylink);
++		err = phylink_ethtool_nway_reset(priv->mac->phylink);
++
++	mutex_unlock(&priv->mac_lock);
+ 
+-	return -EOPNOTSUPP;
++	return err;
+ }
+ 
+ static int
+@@ -98,10 +103,18 @@ dpaa2_eth_get_link_ksettings(struct net_
+ 			     struct ethtool_link_ksettings *link_settings)
+ {
+ 	struct dpaa2_eth_priv *priv = netdev_priv(net_dev);
++	int err;
+ 
+-	if (dpaa2_eth_is_type_phy(priv))
+-		return phylink_ethtool_ksettings_get(priv->mac->phylink,
+-						     link_settings);
++	mutex_lock(&priv->mac_lock);
++
++	if (dpaa2_eth_is_type_phy(priv)) {
++		err = phylink_ethtool_ksettings_get(priv->mac->phylink,
++						    link_settings);
++		mutex_unlock(&priv->mac_lock);
++		return err;
++	}
++
++	mutex_unlock(&priv->mac_lock);
+ 
+ 	link_settings->base.autoneg = AUTONEG_DISABLE;
+ 	if (!(priv->link_state.options & DPNI_LINK_OPT_HALF_DUPLEX))
+@@ -116,11 +129,17 @@ dpaa2_eth_set_link_ksettings(struct net_
+ 			     const struct ethtool_link_ksettings *link_settings)
+ {
+ 	struct dpaa2_eth_priv *priv = netdev_priv(net_dev);
++	int err = -EOPNOTSUPP;
+ 
+-	if (!dpaa2_eth_is_type_phy(priv))
+-		return -EOPNOTSUPP;
++	mutex_lock(&priv->mac_lock);
++
++	if (dpaa2_eth_is_type_phy(priv))
++		err = phylink_ethtool_ksettings_set(priv->mac->phylink,
++						    link_settings);
+ 
+-	return phylink_ethtool_ksettings_set(priv->mac->phylink, link_settings);
++	mutex_unlock(&priv->mac_lock);
++
++	return err;
+ }
+ 
+ static void dpaa2_eth_get_pauseparam(struct net_device *net_dev,
+@@ -129,11 +148,16 @@ static void dpaa2_eth_get_pauseparam(str
+ 	struct dpaa2_eth_priv *priv = netdev_priv(net_dev);
+ 	u64 link_options = priv->link_state.options;
+ 
++	mutex_lock(&priv->mac_lock);
++
+ 	if (dpaa2_eth_is_type_phy(priv)) {
+ 		phylink_ethtool_get_pauseparam(priv->mac->phylink, pause);
++		mutex_unlock(&priv->mac_lock);
+ 		return;
+ 	}
+ 
++	mutex_unlock(&priv->mac_lock);
++
+ 	pause->rx_pause = dpaa2_eth_rx_pause_enabled(link_options);
+ 	pause->tx_pause = dpaa2_eth_tx_pause_enabled(link_options);
+ 	pause->autoneg = AUTONEG_DISABLE;
+@@ -152,9 +176,17 @@ static int dpaa2_eth_set_pauseparam(stru
+ 		return -EOPNOTSUPP;
+ 	}
+ 
+-	if (dpaa2_eth_is_type_phy(priv))
+-		return phylink_ethtool_set_pauseparam(priv->mac->phylink,
+-						      pause);
++	mutex_lock(&priv->mac_lock);
++
++	if (dpaa2_eth_is_type_phy(priv)) {
++		err = phylink_ethtool_set_pauseparam(priv->mac->phylink,
++						     pause);
++		mutex_unlock(&priv->mac_lock);
++		return err;
++	}
++
++	mutex_unlock(&priv->mac_lock);
++
+ 	if (pause->autoneg)
+ 		return -EOPNOTSUPP;
+ 
+@@ -309,8 +341,12 @@ static void dpaa2_eth_get_ethtool_stats(
+ 	}
+ 	*(data + i++) = buf_cnt;
+ 
++	mutex_lock(&priv->mac_lock);
++
+ 	if (dpaa2_eth_has_mac(priv))
+ 		dpaa2_mac_get_ethtool_stats(priv->mac, data + i);
++
++	mutex_unlock(&priv->mac_lock);
+ }
+ 
+ static int dpaa2_eth_prep_eth_rule(struct ethhdr *eth_value, struct ethhdr *eth_mask,
diff --git a/target/linux/armsr/patches-6.1/701-v6.2-0011-net-dpaa2-switch-serialize-changes-to-priv-mac-with.patch b/target/linux/armsr/patches-6.1/701-v6.2-0011-net-dpaa2-switch-serialize-changes-to-priv-mac-with.patch
new file mode 100644
index 00000000000000..7ea446516bf6ee
--- /dev/null
+++ b/target/linux/armsr/patches-6.1/701-v6.2-0011-net-dpaa2-switch-serialize-changes-to-priv-mac-with.patch
@@ -0,0 +1,203 @@
+From 80d12452a5f160c39d63efc1be07df36f9d07133 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Tue, 29 Nov 2022 16:12:20 +0200
+Subject: [PATCH 13/14] net: dpaa2-switch: serialize changes to priv->mac with
+ a mutex
+
+The dpaa2-switch driver uses a DPMAC in the same way as the dpaa2-eth
+driver, so we need to duplicate the locking solution established by the
+previous change to the switch driver as well.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ .../freescale/dpaa2/dpaa2-switch-ethtool.c    | 32 +++++++++++++++----
+ .../ethernet/freescale/dpaa2/dpaa2-switch.c   | 31 ++++++++++++++++--
+ .../ethernet/freescale/dpaa2/dpaa2-switch.h   |  2 ++
+ 3 files changed, 55 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-ethtool.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-ethtool.c
+@@ -60,11 +60,18 @@ dpaa2_switch_get_link_ksettings(struct n
+ {
+ 	struct ethsw_port_priv *port_priv = netdev_priv(netdev);
+ 	struct dpsw_link_state state = {0};
+-	int err = 0;
++	int err;
+ 
+-	if (dpaa2_switch_port_is_type_phy(port_priv))
+-		return phylink_ethtool_ksettings_get(port_priv->mac->phylink,
+-						     link_ksettings);
++	mutex_lock(&port_priv->mac_lock);
++
++	if (dpaa2_switch_port_is_type_phy(port_priv)) {
++		err = phylink_ethtool_ksettings_get(port_priv->mac->phylink,
++						    link_ksettings);
++		mutex_unlock(&port_priv->mac_lock);
++		return err;
++	}
++
++	mutex_unlock(&port_priv->mac_lock);
+ 
+ 	err = dpsw_if_get_link_state(port_priv->ethsw_data->mc_io, 0,
+ 				     port_priv->ethsw_data->dpsw_handle,
+@@ -99,9 +106,16 @@ dpaa2_switch_set_link_ksettings(struct n
+ 	bool if_running;
+ 	int err = 0, ret;
+ 
+-	if (dpaa2_switch_port_is_type_phy(port_priv))
+-		return phylink_ethtool_ksettings_set(port_priv->mac->phylink,
+-						     link_ksettings);
++	mutex_lock(&port_priv->mac_lock);
++
++	if (dpaa2_switch_port_is_type_phy(port_priv)) {
++		err = phylink_ethtool_ksettings_set(port_priv->mac->phylink,
++						    link_ksettings);
++		mutex_unlock(&port_priv->mac_lock);
++		return err;
++	}
++
++	mutex_unlock(&port_priv->mac_lock);
+ 
+ 	/* Interface needs to be down to change link settings */
+ 	if_running = netif_running(netdev);
+@@ -189,8 +203,12 @@ static void dpaa2_switch_ethtool_get_sta
+ 				   dpaa2_switch_ethtool_counters[i].name, err);
+ 	}
+ 
++	mutex_lock(&port_priv->mac_lock);
++
+ 	if (dpaa2_switch_port_has_mac(port_priv))
+ 		dpaa2_mac_get_ethtool_stats(port_priv->mac, data + i);
++
++	mutex_unlock(&port_priv->mac_lock);
+ }
+ 
+ const struct ethtool_ops dpaa2_switch_port_ethtool_ops = {
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
+@@ -603,8 +603,11 @@ static int dpaa2_switch_port_link_state_
+ 
+ 	/* When we manage the MAC/PHY using phylink there is no need
+ 	 * to manually update the netif_carrier.
++	 * We can avoid locking because we are called from the "link changed"
++	 * IRQ handler, which is the same as the "endpoint changed" IRQ handler
++	 * (the writer to port_priv->mac), so we cannot race with it.
+ 	 */
+-	if (dpaa2_switch_port_is_type_phy(port_priv))
++	if (dpaa2_mac_is_type_phy(port_priv->mac))
+ 		return 0;
+ 
+ 	/* Interrupts are received even though no one issued an 'ifconfig up'
+@@ -684,6 +687,8 @@ static int dpaa2_switch_port_open(struct
+ 	struct ethsw_core *ethsw = port_priv->ethsw_data;
+ 	int err;
+ 
++	mutex_lock(&port_priv->mac_lock);
++
+ 	if (!dpaa2_switch_port_is_type_phy(port_priv)) {
+ 		/* Explicitly set carrier off, otherwise
+ 		 * netif_carrier_ok() will return true and cause 'ip link show'
+@@ -697,6 +702,7 @@ static int dpaa2_switch_port_open(struct
+ 			     port_priv->ethsw_data->dpsw_handle,
+ 			     port_priv->idx);
+ 	if (err) {
++		mutex_unlock(&port_priv->mac_lock);
+ 		netdev_err(netdev, "dpsw_if_enable err %d\n", err);
+ 		return err;
+ 	}
+@@ -706,6 +712,8 @@ static int dpaa2_switch_port_open(struct
+ 	if (dpaa2_switch_port_is_type_phy(port_priv))
+ 		dpaa2_mac_start(port_priv->mac);
+ 
++	mutex_unlock(&port_priv->mac_lock);
++
+ 	return 0;
+ }
+ 
+@@ -715,6 +723,8 @@ static int dpaa2_switch_port_stop(struct
+ 	struct ethsw_core *ethsw = port_priv->ethsw_data;
+ 	int err;
+ 
++	mutex_lock(&port_priv->mac_lock);
++
+ 	if (dpaa2_switch_port_is_type_phy(port_priv)) {
+ 		dpaa2_mac_stop(port_priv->mac);
+ 	} else {
+@@ -722,6 +732,8 @@ static int dpaa2_switch_port_stop(struct
+ 		netif_carrier_off(netdev);
+ 	}
+ 
++	mutex_unlock(&port_priv->mac_lock);
++
+ 	err = dpsw_if_disable(port_priv->ethsw_data->mc_io, 0,
+ 			      port_priv->ethsw_data->dpsw_handle,
+ 			      port_priv->idx);
+@@ -1461,7 +1473,9 @@ static int dpaa2_switch_port_connect_mac
+ 		}
+ 	}
+ 
++	mutex_lock(&port_priv->mac_lock);
+ 	port_priv->mac = mac;
++	mutex_unlock(&port_priv->mac_lock);
+ 
+ 	return 0;
+ 
+@@ -1474,9 +1488,12 @@ err_free_mac:
+ 
+ static void dpaa2_switch_port_disconnect_mac(struct ethsw_port_priv *port_priv)
+ {
+-	struct dpaa2_mac *mac = port_priv->mac;
++	struct dpaa2_mac *mac;
+ 
++	mutex_lock(&port_priv->mac_lock);
++	mac = port_priv->mac;
+ 	port_priv->mac = NULL;
++	mutex_unlock(&port_priv->mac_lock);
+ 
+ 	if (!mac)
+ 		return;
+@@ -1495,6 +1512,7 @@ static irqreturn_t dpaa2_switch_irq0_han
+ 	struct ethsw_port_priv *port_priv;
+ 	u32 status = ~0;
+ 	int err, if_id;
++	bool had_mac;
+ 
+ 	err = dpsw_get_irq_status(ethsw->mc_io, 0, ethsw->dpsw_handle,
+ 				  DPSW_IRQ_INDEX_IF, &status);
+@@ -1513,7 +1531,12 @@ static irqreturn_t dpaa2_switch_irq0_han
+ 
+ 	if (status & DPSW_IRQ_EVENT_ENDPOINT_CHANGED) {
+ 		rtnl_lock();
+-		if (dpaa2_switch_port_has_mac(port_priv))
++		/* We can avoid locking because the "endpoint changed" IRQ
++		 * handler is the only one who changes priv->mac at runtime,
++		 * so we are not racing with anyone.
++		 */
++		had_mac = !!port_priv->mac;
++		if (had_mac)
+ 			dpaa2_switch_port_disconnect_mac(port_priv);
+ 		else
+ 			dpaa2_switch_port_connect_mac(port_priv);
+@@ -3256,6 +3279,8 @@ static int dpaa2_switch_probe_port(struc
+ 	port_priv->netdev = port_netdev;
+ 	port_priv->ethsw_data = ethsw;
+ 
++	mutex_init(&port_priv->mac_lock);
++
+ 	port_priv->idx = port_idx;
+ 	port_priv->stp_state = BR_STATE_FORWARDING;
+ 
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.h
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.h
+@@ -161,6 +161,8 @@ struct ethsw_port_priv {
+ 
+ 	struct dpaa2_switch_filter_block *filter_block;
+ 	struct dpaa2_mac	*mac;
++	/* Protects against changes to port_priv->mac */
++	struct mutex		mac_lock;
+ };
+ 
+ /* Switch data */
diff --git a/target/linux/armsr/patches-6.1/701-v6.2-0012-net-dpaa2-mac-move-rtnl_lock-only-around-phylink.patch b/target/linux/armsr/patches-6.1/701-v6.2-0012-net-dpaa2-mac-move-rtnl_lock-only-around-phylink.patch
new file mode 100644
index 00000000000000..976c2a03354e06
--- /dev/null
+++ b/target/linux/armsr/patches-6.1/701-v6.2-0012-net-dpaa2-mac-move-rtnl_lock-only-around-phylink.patch
@@ -0,0 +1,113 @@
+From 4ea2faf5bb13d9ba9f07e996d495c4cbe34a4236 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Tue, 29 Nov 2022 16:12:21 +0200
+Subject: [PATCH 14/14] net: dpaa2-mac: move rtnl_lock() only around
+ phylink_{,dis}connect_phy()
+
+After the introduction of a private mac_lock that serializes access to
+priv->mac (and port_priv->mac in the switch), the only remaining purpose
+of rtnl_lock() is to satisfy the locking requirements of
+phylink_fwnode_phy_connect() and phylink_disconnect_phy().
+
+But the functions these live in, dpaa2_mac_connect() and
+dpaa2_mac_disconnect(), have contradictory locking requirements.
+While phylink_fwnode_phy_connect() wants rtnl_lock() to be held,
+phylink_create() wants it to not be held.
+
+Move the rtnl_lock() from top-level (in the dpaa2-eth and dpaa2-switch
+drivers) to only surround the phylink calls that require it, in the
+dpaa2-mac library code.
+
+This is possible because dpaa2_mac_connect() and dpaa2_mac_disconnect()
+run unlocked, and there isn't any danger of an AB/BA deadlock between
+the rtnl_mutex and other private locks.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c    | 4 ----
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c    | 5 +++++
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c | 4 ----
+ 3 files changed, 5 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+@@ -4529,7 +4529,6 @@ static irqreturn_t dpni_irq0_handler_thr
+ 		dpaa2_eth_set_mac_addr(netdev_priv(net_dev));
+ 		dpaa2_eth_update_tx_fqids(priv);
+ 
+-		rtnl_lock();
+ 		/* We can avoid locking because the "endpoint changed" IRQ
+ 		 * handler is the only one who changes priv->mac at runtime,
+ 		 * so we are not racing with anyone.
+@@ -4539,7 +4538,6 @@ static irqreturn_t dpni_irq0_handler_thr
+ 			dpaa2_eth_disconnect_mac(priv);
+ 		else
+ 			dpaa2_eth_connect_mac(priv);
+-		rtnl_unlock();
+ 	}
+ 
+ 	return IRQ_HANDLED;
+@@ -4856,9 +4854,7 @@ static int dpaa2_eth_remove(struct fsl_m
+ 	else
+ 		fsl_mc_free_irqs(ls_dev);
+ 
+-	rtnl_lock();
+ 	dpaa2_eth_disconnect_mac(priv);
+-	rtnl_unlock();
+ 	dpaa2_eth_free_rings(priv);
+ 	free_percpu(priv->fd);
+ 	free_percpu(priv->sgt_cache);
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c
+@@ -428,7 +428,9 @@ int dpaa2_mac_connect(struct dpaa2_mac *
+ 	}
+ 	mac->phylink = phylink;
+ 
++	rtnl_lock();
+ 	err = phylink_fwnode_phy_connect(mac->phylink, dpmac_node, 0);
++	rtnl_unlock();
+ 	if (err) {
+ 		netdev_err(net_dev, "phylink_fwnode_phy_connect() = %d\n", err);
+ 		goto err_phylink_destroy;
+@@ -446,7 +448,10 @@ err_pcs_destroy:
+ 
+ void dpaa2_mac_disconnect(struct dpaa2_mac *mac)
+ {
++	rtnl_lock();
+ 	phylink_disconnect_phy(mac->phylink);
++	rtnl_unlock();
++
+ 	phylink_destroy(mac->phylink);
+ 	dpaa2_pcs_destroy(mac);
+ 	of_phy_put(mac->serdes_phy);
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
+@@ -1530,7 +1530,6 @@ static irqreturn_t dpaa2_switch_irq0_han
+ 	}
+ 
+ 	if (status & DPSW_IRQ_EVENT_ENDPOINT_CHANGED) {
+-		rtnl_lock();
+ 		/* We can avoid locking because the "endpoint changed" IRQ
+ 		 * handler is the only one who changes priv->mac at runtime,
+ 		 * so we are not racing with anyone.
+@@ -1540,7 +1539,6 @@ static irqreturn_t dpaa2_switch_irq0_han
+ 			dpaa2_switch_port_disconnect_mac(port_priv);
+ 		else
+ 			dpaa2_switch_port_connect_mac(port_priv);
+-		rtnl_unlock();
+ 	}
+ 
+ out:
+@@ -2958,9 +2956,7 @@ static void dpaa2_switch_remove_port(str
+ {
+ 	struct ethsw_port_priv *port_priv = ethsw->ports[port_idx];
+ 
+-	rtnl_lock();
+ 	dpaa2_switch_port_disconnect_mac(port_priv);
+-	rtnl_unlock();
+ 	free_netdev(port_priv->netdev);
+ 	ethsw->ports[port_idx] = NULL;
+ }
diff --git a/target/linux/at91/Makefile b/target/linux/at91/Makefile
index af0dc3f338494d..7867290b7ea1d5 100644
--- a/target/linux/at91/Makefile
+++ b/target/linux/at91/Makefile
@@ -10,7 +10,7 @@ BOARDNAME:=Microchip (Atmel AT91)
 FEATURES:=ext4 squashfs targz usbgadget ubifs
 SUBTARGETS:=sama7 sama5 sam9x
 
-KERNEL_PATCHVER:=5.10
+KERNEL_PATCHVER:=5.15
 
 include $(INCLUDE_DIR)/target.mk
 
diff --git a/target/linux/at91/image/Config.in b/target/linux/at91/image/Config.in
index 596accaa49736b..ae559edca1fe44 100644
--- a/target/linux/at91/image/Config.in
+++ b/target/linux/at91/image/Config.in
@@ -1,10 +1,8 @@
 config AT91_DFBOOT
 	bool "Build dataflashboot loader"
 	depends on TARGET_at91
-	default n
 
 config FLEXIBITY_ROOT
 	bool "Build Flexibity RootFS (with embedded kernel)"
 	depends on TARGET_at91_flexibity
-	default n
 
diff --git a/target/linux/at91/image/sam9x.mk b/target/linux/at91/image/sam9x.mk
index b6c5e33ac44fe5..409e43ca6e9050 100644
--- a/target/linux/at91/image/sam9x.mk
+++ b/target/linux/at91/image/sam9x.mk
@@ -35,7 +35,7 @@ define Build/at91-sdcard
   ./gen_at91_sdcard_img.sh \
 	$@.img \
 	$@.boot \
-	$(KDIR)/root.ext4 \
+	$(IMAGE_ROOTFS) \
 	$(AT91_SD_BOOT_PARTSIZE) \
 	$(CONFIG_TARGET_ROOTFS_PARTSIZE)
 
@@ -126,7 +126,8 @@ define Device/calamp_lmu5000
   DEVICE_VENDOR := CalAmp
   DEVICE_MODEL := LMU5000
   DEVICE_PACKAGES := kmod-rtc-pcf2123 kmod-usb-acm \
-	kmod-usb-serial-option kmod-usb-serial-sierrawireless kmod-gpio-mcp23s08
+	kmod-usb-serial-option kmod-usb-serial-sierrawireless \
+	kmod-pinctrl-mcp23s08-spi
 endef
 TARGET_DEVICES += calamp_lmu5000
 
diff --git a/target/linux/at91/image/sama5.mk b/target/linux/at91/image/sama5.mk
index 39db3e1cd022b3..7f4dd3316a888e 100644
--- a/target/linux/at91/image/sama5.mk
+++ b/target/linux/at91/image/sama5.mk
@@ -39,7 +39,7 @@ define Build/at91-sdcard
   ./gen_at91_sdcard_img.sh \
 	$@.img \
 	$@.boot \
-	$(KDIR)/root.ext4 \
+	$(IMAGE_ROOTFS) \
 	$(AT91_SD_BOOT_PARTSIZE) \
 	$(CONFIG_TARGET_ROOTFS_PARTSIZE)
 
diff --git a/target/linux/at91/image/sama7.mk b/target/linux/at91/image/sama7.mk
index bf1704dfb3371f..8d6f67d80e6356 100644
--- a/target/linux/at91/image/sama7.mk
+++ b/target/linux/at91/image/sama7.mk
@@ -35,7 +35,7 @@ define Build/at91-sdcard
   ./gen_at91_sdcard_img.sh \
 	$@.img \
 	$@.boot \
-	$(KDIR)/root.ext4 \
+	$(IMAGE_ROOTFS) \
 	$(AT91_SD_BOOT_PARTSIZE) \
 	$(CONFIG_TARGET_ROOTFS_PARTSIZE)
 
diff --git a/target/linux/at91/patches-5.15/100-clk-at91-re-factor-clocks-suspend-resume.patch b/target/linux/at91/patches-5.15/100-clk-at91-re-factor-clocks-suspend-resume.patch
new file mode 100644
index 00000000000000..5d399f6535e8ee
--- /dev/null
+++ b/target/linux/at91/patches-5.15/100-clk-at91-re-factor-clocks-suspend-resume.patch
@@ -0,0 +1,1342 @@
+From 65bb4687b2a5c6f02f44345540c3389d6e7523e7 Mon Sep 17 00:00:00 2001
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+Date: Mon, 11 Oct 2021 14:27:05 +0300
+Subject: [PATCH 234/247] clk: at91: re-factor clocks suspend/resume
+
+SAMA5D2 and SAMA7G5 have a special power saving mode (backup mode) where
+most of the SoC's components are powered off (including PMC). Resuming
+from this mode is done with the help of bootloader. Peripherals are not
+aware of the power saving mode thus most of them are disabling clocks in
+proper suspend API and re-enable them in resume API without taking into
+account the previously setup rate. Moreover some of the peripherals are
+acting as wakeup sources and are not disabling the clocks in this
+scenario, when suspending. Since backup mode cuts the power for
+peripherals, in resume part these clocks needs to be re-configured.
+
+The initial PMC suspend/resume code was designed only for SAMA5D2's PMC
+(as it was the only one supporting backup mode). SAMA7G supports also
+backup mode and its PMC is different (few new functionalities, different
+registers offsets, different offsets in registers for each
+functionalities). To address both SAMA5D2 and SAMA7G5 PMC add
+.save_context()/.resume_context() support to each clocks driver and call
+this from PMC driver.
+
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20211011112719.3951784-2-claudiu.beznea@microchip.com
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+---
+ drivers/clk/at91/clk-generated.c    |  46 +++++--
+ drivers/clk/at91/clk-main.c         |  66 ++++++++++
+ drivers/clk/at91/clk-master.c       | 194 ++++++++++++++++++++++++++--
+ drivers/clk/at91/clk-peripheral.c   |  40 +++++-
+ drivers/clk/at91/clk-pll.c          |  39 ++++++
+ drivers/clk/at91/clk-programmable.c |  29 ++++-
+ drivers/clk/at91/clk-sam9x60-pll.c  |  68 +++++++++-
+ drivers/clk/at91/clk-system.c       |  20 +++
+ drivers/clk/at91/clk-usb.c          |  27 ++++
+ drivers/clk/at91/clk-utmi.c         |  39 ++++++
+ drivers/clk/at91/pmc.c              | 147 +--------------------
+ drivers/clk/at91/pmc.h              |  24 ++--
+ 12 files changed, 558 insertions(+), 181 deletions(-)
+
+--- a/drivers/clk/at91/clk-generated.c
++++ b/drivers/clk/at91/clk-generated.c
+@@ -27,6 +27,7 @@ struct clk_generated {
+ 	u32 id;
+ 	u32 gckdiv;
+ 	const struct clk_pcr_layout *layout;
++	struct at91_clk_pms pms;
+ 	u8 parent_id;
+ 	int chg_pid;
+ };
+@@ -34,25 +35,35 @@ struct clk_generated {
+ #define to_clk_generated(hw) \
+ 	container_of(hw, struct clk_generated, hw)
+ 
+-static int clk_generated_enable(struct clk_hw *hw)
++static int clk_generated_set(struct clk_generated *gck, int status)
+ {
+-	struct clk_generated *gck = to_clk_generated(hw);
+ 	unsigned long flags;
+-
+-	pr_debug("GCLK: %s, gckdiv = %d, parent id = %d\n",
+-		 __func__, gck->gckdiv, gck->parent_id);
++	unsigned int enable = status ? AT91_PMC_PCR_GCKEN : 0;
+ 
+ 	spin_lock_irqsave(gck->lock, flags);
+ 	regmap_write(gck->regmap, gck->layout->offset,
+ 		     (gck->id & gck->layout->pid_mask));
+ 	regmap_update_bits(gck->regmap, gck->layout->offset,
+ 			   AT91_PMC_PCR_GCKDIV_MASK | gck->layout->gckcss_mask |
+-			   gck->layout->cmd | AT91_PMC_PCR_GCKEN,
++			   gck->layout->cmd | enable,
+ 			   field_prep(gck->layout->gckcss_mask, gck->parent_id) |
+ 			   gck->layout->cmd |
+ 			   FIELD_PREP(AT91_PMC_PCR_GCKDIV_MASK, gck->gckdiv) |
+-			   AT91_PMC_PCR_GCKEN);
++			   enable);
+ 	spin_unlock_irqrestore(gck->lock, flags);
++
++	return 0;
++}
++
++static int clk_generated_enable(struct clk_hw *hw)
++{
++	struct clk_generated *gck = to_clk_generated(hw);
++
++	pr_debug("GCLK: %s, gckdiv = %d, parent id = %d\n",
++		 __func__, gck->gckdiv, gck->parent_id);
++
++	clk_generated_set(gck, 1);
++
+ 	return 0;
+ }
+ 
+@@ -249,6 +260,23 @@ static int clk_generated_set_rate(struct
+ 	return 0;
+ }
+ 
++static int clk_generated_save_context(struct clk_hw *hw)
++{
++	struct clk_generated *gck = to_clk_generated(hw);
++
++	gck->pms.status = clk_generated_is_enabled(&gck->hw);
++
++	return 0;
++}
++
++static void clk_generated_restore_context(struct clk_hw *hw)
++{
++	struct clk_generated *gck = to_clk_generated(hw);
++
++	if (gck->pms.status)
++		clk_generated_set(gck, gck->pms.status);
++}
++
+ static const struct clk_ops generated_ops = {
+ 	.enable = clk_generated_enable,
+ 	.disable = clk_generated_disable,
+@@ -258,6 +286,8 @@ static const struct clk_ops generated_op
+ 	.get_parent = clk_generated_get_parent,
+ 	.set_parent = clk_generated_set_parent,
+ 	.set_rate = clk_generated_set_rate,
++	.save_context = clk_generated_save_context,
++	.restore_context = clk_generated_restore_context,
+ };
+ 
+ /**
+@@ -324,8 +354,6 @@ at91_clk_register_generated(struct regma
+ 	if (ret) {
+ 		kfree(gck);
+ 		hw = ERR_PTR(ret);
+-	} else {
+-		pmc_register_id(id);
+ 	}
+ 
+ 	return hw;
+--- a/drivers/clk/at91/clk-main.c
++++ b/drivers/clk/at91/clk-main.c
+@@ -28,6 +28,7 @@
+ struct clk_main_osc {
+ 	struct clk_hw hw;
+ 	struct regmap *regmap;
++	struct at91_clk_pms pms;
+ };
+ 
+ #define to_clk_main_osc(hw) container_of(hw, struct clk_main_osc, hw)
+@@ -37,6 +38,7 @@ struct clk_main_rc_osc {
+ 	struct regmap *regmap;
+ 	unsigned long frequency;
+ 	unsigned long accuracy;
++	struct at91_clk_pms pms;
+ };
+ 
+ #define to_clk_main_rc_osc(hw) container_of(hw, struct clk_main_rc_osc, hw)
+@@ -51,6 +53,7 @@ struct clk_rm9200_main {
+ struct clk_sam9x5_main {
+ 	struct clk_hw hw;
+ 	struct regmap *regmap;
++	struct at91_clk_pms pms;
+ 	u8 parent;
+ };
+ 
+@@ -120,10 +123,29 @@ static int clk_main_osc_is_prepared(stru
+ 	return (status & AT91_PMC_MOSCS) && clk_main_parent_select(tmp);
+ }
+ 
++static int clk_main_osc_save_context(struct clk_hw *hw)
++{
++	struct clk_main_osc *osc = to_clk_main_osc(hw);
++
++	osc->pms.status = clk_main_osc_is_prepared(hw);
++
++	return 0;
++}
++
++static void clk_main_osc_restore_context(struct clk_hw *hw)
++{
++	struct clk_main_osc *osc = to_clk_main_osc(hw);
++
++	if (osc->pms.status)
++		clk_main_osc_prepare(hw);
++}
++
+ static const struct clk_ops main_osc_ops = {
+ 	.prepare = clk_main_osc_prepare,
+ 	.unprepare = clk_main_osc_unprepare,
+ 	.is_prepared = clk_main_osc_is_prepared,
++	.save_context = clk_main_osc_save_context,
++	.restore_context = clk_main_osc_restore_context,
+ };
+ 
+ struct clk_hw * __init
+@@ -240,12 +262,31 @@ static unsigned long clk_main_rc_osc_rec
+ 	return osc->accuracy;
+ }
+ 
++static int clk_main_rc_osc_save_context(struct clk_hw *hw)
++{
++	struct clk_main_rc_osc *osc = to_clk_main_rc_osc(hw);
++
++	osc->pms.status = clk_main_rc_osc_is_prepared(hw);
++
++	return 0;
++}
++
++static void clk_main_rc_osc_restore_context(struct clk_hw *hw)
++{
++	struct clk_main_rc_osc *osc = to_clk_main_rc_osc(hw);
++
++	if (osc->pms.status)
++		clk_main_rc_osc_prepare(hw);
++}
++
+ static const struct clk_ops main_rc_osc_ops = {
+ 	.prepare = clk_main_rc_osc_prepare,
+ 	.unprepare = clk_main_rc_osc_unprepare,
+ 	.is_prepared = clk_main_rc_osc_is_prepared,
+ 	.recalc_rate = clk_main_rc_osc_recalc_rate,
+ 	.recalc_accuracy = clk_main_rc_osc_recalc_accuracy,
++	.save_context = clk_main_rc_osc_save_context,
++	.restore_context = clk_main_rc_osc_restore_context,
+ };
+ 
+ struct clk_hw * __init
+@@ -465,12 +506,37 @@ static u8 clk_sam9x5_main_get_parent(str
+ 	return clk_main_parent_select(status);
+ }
+ 
++static int clk_sam9x5_main_save_context(struct clk_hw *hw)
++{
++	struct clk_sam9x5_main *clkmain = to_clk_sam9x5_main(hw);
++
++	clkmain->pms.status = clk_main_rc_osc_is_prepared(&clkmain->hw);
++	clkmain->pms.parent = clk_sam9x5_main_get_parent(&clkmain->hw);
++
++	return 0;
++}
++
++static void clk_sam9x5_main_restore_context(struct clk_hw *hw)
++{
++	struct clk_sam9x5_main *clkmain = to_clk_sam9x5_main(hw);
++	int ret;
++
++	ret = clk_sam9x5_main_set_parent(hw, clkmain->pms.parent);
++	if (ret)
++		return;
++
++	if (clkmain->pms.status)
++		clk_sam9x5_main_prepare(hw);
++}
++
+ static const struct clk_ops sam9x5_main_ops = {
+ 	.prepare = clk_sam9x5_main_prepare,
+ 	.is_prepared = clk_sam9x5_main_is_prepared,
+ 	.recalc_rate = clk_sam9x5_main_recalc_rate,
+ 	.set_parent = clk_sam9x5_main_set_parent,
+ 	.get_parent = clk_sam9x5_main_get_parent,
++	.save_context = clk_sam9x5_main_save_context,
++	.restore_context = clk_sam9x5_main_restore_context,
+ };
+ 
+ struct clk_hw * __init
+--- a/drivers/clk/at91/clk-master.c
++++ b/drivers/clk/at91/clk-master.c
+@@ -37,6 +37,7 @@ struct clk_master {
+ 	spinlock_t *lock;
+ 	const struct clk_master_layout *layout;
+ 	const struct clk_master_characteristics *characteristics;
++	struct at91_clk_pms pms;
+ 	u32 *mux_table;
+ 	u32 mckr;
+ 	int chg_pid;
+@@ -112,10 +113,52 @@ static unsigned long clk_master_div_reca
+ 	return rate;
+ }
+ 
++static int clk_master_div_save_context(struct clk_hw *hw)
++{
++	struct clk_master *master = to_clk_master(hw);
++	struct clk_hw *parent_hw = clk_hw_get_parent(hw);
++	unsigned long flags;
++	unsigned int mckr, div;
++
++	spin_lock_irqsave(master->lock, flags);
++	regmap_read(master->regmap, master->layout->offset, &mckr);
++	spin_unlock_irqrestore(master->lock, flags);
++
++	mckr &= master->layout->mask;
++	div = (mckr >> MASTER_DIV_SHIFT) & MASTER_DIV_MASK;
++	div = master->characteristics->divisors[div];
++
++	master->pms.parent_rate = clk_hw_get_rate(parent_hw);
++	master->pms.rate = DIV_ROUND_CLOSEST(master->pms.parent_rate, div);
++
++	return 0;
++}
++
++static void clk_master_div_restore_context(struct clk_hw *hw)
++{
++	struct clk_master *master = to_clk_master(hw);
++	unsigned long flags;
++	unsigned int mckr;
++	u8 div;
++
++	spin_lock_irqsave(master->lock, flags);
++	regmap_read(master->regmap, master->layout->offset, &mckr);
++	spin_unlock_irqrestore(master->lock, flags);
++
++	mckr &= master->layout->mask;
++	div = (mckr >> MASTER_DIV_SHIFT) & MASTER_DIV_MASK;
++	div = master->characteristics->divisors[div];
++
++	if (div != DIV_ROUND_CLOSEST(master->pms.parent_rate, master->pms.rate))
++		pr_warn("MCKR DIV not configured properly by firmware!\n");
++}
++
+ static const struct clk_ops master_div_ops = {
+ 	.prepare = clk_master_prepare,
+ 	.is_prepared = clk_master_is_prepared,
+ 	.recalc_rate = clk_master_div_recalc_rate,
++	.save_context = clk_master_div_save_context,
++	.restore_context = clk_master_div_restore_context,
+ };
+ 
+ static int clk_master_div_set_rate(struct clk_hw *hw, unsigned long rate,
+@@ -125,7 +168,9 @@ static int clk_master_div_set_rate(struc
+ 	const struct clk_master_characteristics *characteristics =
+ 						master->characteristics;
+ 	unsigned long flags;
++	unsigned int mckr, tmp;
+ 	int div, i;
++	int ret;
+ 
+ 	div = DIV_ROUND_CLOSEST(parent_rate, rate);
+ 	if (div > ARRAY_SIZE(characteristics->divisors))
+@@ -145,11 +190,24 @@ static int clk_master_div_set_rate(struc
+ 		return -EINVAL;
+ 
+ 	spin_lock_irqsave(master->lock, flags);
+-	regmap_update_bits(master->regmap, master->layout->offset,
+-			   (MASTER_DIV_MASK << MASTER_DIV_SHIFT),
+-			   (div << MASTER_DIV_SHIFT));
++	ret = regmap_read(master->regmap, master->layout->offset, &mckr);
++	if (ret)
++		goto unlock;
++
++	tmp = mckr & master->layout->mask;
++	tmp = (tmp >> MASTER_DIV_SHIFT) & MASTER_DIV_MASK;
++	if (tmp == div)
++		goto unlock;
++
++	mckr &= ~(MASTER_DIV_MASK << MASTER_DIV_SHIFT);
++	mckr |= (div << MASTER_DIV_SHIFT);
++	ret = regmap_write(master->regmap, master->layout->offset, mckr);
++	if (ret)
++		goto unlock;
++
+ 	while (!clk_master_ready(master))
+ 		cpu_relax();
++unlock:
+ 	spin_unlock_irqrestore(master->lock, flags);
+ 
+ 	return 0;
+@@ -197,12 +255,25 @@ static int clk_master_div_determine_rate
+ 	return 0;
+ }
+ 
++static void clk_master_div_restore_context_chg(struct clk_hw *hw)
++{
++	struct clk_master *master = to_clk_master(hw);
++	int ret;
++
++	ret = clk_master_div_set_rate(hw, master->pms.rate,
++				      master->pms.parent_rate);
++	if (ret)
++		pr_warn("Failed to restore MCK DIV clock\n");
++}
++
+ static const struct clk_ops master_div_ops_chg = {
+ 	.prepare = clk_master_prepare,
+ 	.is_prepared = clk_master_is_prepared,
+ 	.recalc_rate = clk_master_div_recalc_rate,
+ 	.determine_rate = clk_master_div_determine_rate,
+ 	.set_rate = clk_master_div_set_rate,
++	.save_context = clk_master_div_save_context,
++	.restore_context = clk_master_div_restore_context_chg,
+ };
+ 
+ static void clk_sama7g5_master_best_diff(struct clk_rate_request *req,
+@@ -272,7 +343,8 @@ static int clk_master_pres_set_rate(stru
+ {
+ 	struct clk_master *master = to_clk_master(hw);
+ 	unsigned long flags;
+-	unsigned int pres;
++	unsigned int pres, mckr, tmp;
++	int ret;
+ 
+ 	pres = DIV_ROUND_CLOSEST(parent_rate, rate);
+ 	if (pres > MASTER_PRES_MAX)
+@@ -284,15 +356,27 @@ static int clk_master_pres_set_rate(stru
+ 		pres = ffs(pres) - 1;
+ 
+ 	spin_lock_irqsave(master->lock, flags);
+-	regmap_update_bits(master->regmap, master->layout->offset,
+-			   (MASTER_PRES_MASK << master->layout->pres_shift),
+-			   (pres << master->layout->pres_shift));
++	ret = regmap_read(master->regmap, master->layout->offset, &mckr);
++	if (ret)
++		goto unlock;
++
++	mckr &= master->layout->mask;
++	tmp = (mckr >> master->layout->pres_shift) & MASTER_PRES_MASK;
++	if (pres == tmp)
++		goto unlock;
++
++	mckr &= ~(MASTER_PRES_MASK << master->layout->pres_shift);
++	mckr |= (pres << master->layout->pres_shift);
++	ret = regmap_write(master->regmap, master->layout->offset, mckr);
++	if (ret)
++		goto unlock;
+ 
+ 	while (!clk_master_ready(master))
+ 		cpu_relax();
++unlock:
+ 	spin_unlock_irqrestore(master->lock, flags);
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ static unsigned long clk_master_pres_recalc_rate(struct clk_hw *hw,
+@@ -330,11 +414,68 @@ static u8 clk_master_pres_get_parent(str
+ 	return mckr & AT91_PMC_CSS;
+ }
+ 
++static int clk_master_pres_save_context(struct clk_hw *hw)
++{
++	struct clk_master *master = to_clk_master(hw);
++	struct clk_hw *parent_hw = clk_hw_get_parent(hw);
++	unsigned long flags;
++	unsigned int val, pres;
++
++	spin_lock_irqsave(master->lock, flags);
++	regmap_read(master->regmap, master->layout->offset, &val);
++	spin_unlock_irqrestore(master->lock, flags);
++
++	val &= master->layout->mask;
++	pres = (val >> master->layout->pres_shift) & MASTER_PRES_MASK;
++	if (pres == MASTER_PRES_MAX && master->characteristics->have_div3_pres)
++		pres = 3;
++	else
++		pres = (1 << pres);
++
++	master->pms.parent = val & AT91_PMC_CSS;
++	master->pms.parent_rate = clk_hw_get_rate(parent_hw);
++	master->pms.rate = DIV_ROUND_CLOSEST_ULL(master->pms.parent_rate, pres);
++
++	return 0;
++}
++
++static void clk_master_pres_restore_context(struct clk_hw *hw)
++{
++	struct clk_master *master = to_clk_master(hw);
++	unsigned long flags;
++	unsigned int val, pres;
++
++	spin_lock_irqsave(master->lock, flags);
++	regmap_read(master->regmap, master->layout->offset, &val);
++	spin_unlock_irqrestore(master->lock, flags);
++
++	val &= master->layout->mask;
++	pres = (val >> master->layout->pres_shift) & MASTER_PRES_MASK;
++	if (pres == MASTER_PRES_MAX && master->characteristics->have_div3_pres)
++		pres = 3;
++	else
++		pres = (1 << pres);
++
++	if (master->pms.rate !=
++	    DIV_ROUND_CLOSEST_ULL(master->pms.parent_rate, pres) ||
++	    (master->pms.parent != (val & AT91_PMC_CSS)))
++		pr_warn("MCKR PRES was not configured properly by firmware!\n");
++}
++
++static void clk_master_pres_restore_context_chg(struct clk_hw *hw)
++{
++	struct clk_master *master = to_clk_master(hw);
++
++	clk_master_pres_set_rate(hw, master->pms.rate, master->pms.parent_rate);
++}
++
+ static const struct clk_ops master_pres_ops = {
+ 	.prepare = clk_master_prepare,
+ 	.is_prepared = clk_master_is_prepared,
+ 	.recalc_rate = clk_master_pres_recalc_rate,
+ 	.get_parent = clk_master_pres_get_parent,
++	.save_context = clk_master_pres_save_context,
++	.restore_context = clk_master_pres_restore_context,
+ };
+ 
+ static const struct clk_ops master_pres_ops_chg = {
+@@ -344,6 +485,8 @@ static const struct clk_ops master_pres_
+ 	.recalc_rate = clk_master_pres_recalc_rate,
+ 	.get_parent = clk_master_pres_get_parent,
+ 	.set_rate = clk_master_pres_set_rate,
++	.save_context = clk_master_pres_save_context,
++	.restore_context = clk_master_pres_restore_context_chg,
+ };
+ 
+ static struct clk_hw * __init
+@@ -539,20 +682,21 @@ static int clk_sama7g5_master_set_parent
+ 	return 0;
+ }
+ 
+-static int clk_sama7g5_master_enable(struct clk_hw *hw)
++static void clk_sama7g5_master_set(struct clk_master *master,
++				   unsigned int status)
+ {
+-	struct clk_master *master = to_clk_master(hw);
+ 	unsigned long flags;
+ 	unsigned int val, cparent;
++	unsigned int enable = status ? PMC_MCR_EN : 0;
+ 
+ 	spin_lock_irqsave(master->lock, flags);
+ 
+ 	regmap_write(master->regmap, PMC_MCR, PMC_MCR_ID(master->id));
+ 	regmap_read(master->regmap, PMC_MCR, &val);
+ 	regmap_update_bits(master->regmap, PMC_MCR,
+-			   PMC_MCR_EN | PMC_MCR_CSS | PMC_MCR_DIV |
++			   enable | PMC_MCR_CSS | PMC_MCR_DIV |
+ 			   PMC_MCR_CMD | PMC_MCR_ID_MSK,
+-			   PMC_MCR_EN | (master->parent << PMC_MCR_CSS_SHIFT) |
++			   enable | (master->parent << PMC_MCR_CSS_SHIFT) |
+ 			   (master->div << MASTER_DIV_SHIFT) |
+ 			   PMC_MCR_CMD | PMC_MCR_ID(master->id));
+ 
+@@ -563,6 +707,13 @@ static int clk_sama7g5_master_enable(str
+ 		cpu_relax();
+ 
+ 	spin_unlock_irqrestore(master->lock, flags);
++}
++
++static int clk_sama7g5_master_enable(struct clk_hw *hw)
++{
++	struct clk_master *master = to_clk_master(hw);
++
++	clk_sama7g5_master_set(master, 1);
+ 
+ 	return 0;
+ }
+@@ -620,6 +771,23 @@ static int clk_sama7g5_master_set_rate(s
+ 	return 0;
+ }
+ 
++static int clk_sama7g5_master_save_context(struct clk_hw *hw)
++{
++	struct clk_master *master = to_clk_master(hw);
++
++	master->pms.status = clk_sama7g5_master_is_enabled(hw);
++
++	return 0;
++}
++
++static void clk_sama7g5_master_restore_context(struct clk_hw *hw)
++{
++	struct clk_master *master = to_clk_master(hw);
++
++	if (master->pms.status)
++		clk_sama7g5_master_set(master, master->pms.status);
++}
++
+ static const struct clk_ops sama7g5_master_ops = {
+ 	.enable = clk_sama7g5_master_enable,
+ 	.disable = clk_sama7g5_master_disable,
+@@ -629,6 +797,8 @@ static const struct clk_ops sama7g5_mast
+ 	.set_rate = clk_sama7g5_master_set_rate,
+ 	.get_parent = clk_sama7g5_master_get_parent,
+ 	.set_parent = clk_sama7g5_master_set_parent,
++	.save_context = clk_sama7g5_master_save_context,
++	.restore_context = clk_sama7g5_master_restore_context,
+ };
+ 
+ struct clk_hw * __init
+--- a/drivers/clk/at91/clk-peripheral.c
++++ b/drivers/clk/at91/clk-peripheral.c
+@@ -37,6 +37,7 @@ struct clk_sam9x5_peripheral {
+ 	u32 id;
+ 	u32 div;
+ 	const struct clk_pcr_layout *layout;
++	struct at91_clk_pms pms;
+ 	bool auto_div;
+ 	int chg_pid;
+ };
+@@ -155,10 +156,11 @@ static void clk_sam9x5_peripheral_autodi
+ 	periph->div = shift;
+ }
+ 
+-static int clk_sam9x5_peripheral_enable(struct clk_hw *hw)
++static int clk_sam9x5_peripheral_set(struct clk_sam9x5_peripheral *periph,
++				     unsigned int status)
+ {
+-	struct clk_sam9x5_peripheral *periph = to_clk_sam9x5_peripheral(hw);
+ 	unsigned long flags;
++	unsigned int enable = status ? AT91_PMC_PCR_EN : 0;
+ 
+ 	if (periph->id < PERIPHERAL_ID_MIN)
+ 		return 0;
+@@ -168,15 +170,21 @@ static int clk_sam9x5_peripheral_enable(
+ 		     (periph->id & periph->layout->pid_mask));
+ 	regmap_update_bits(periph->regmap, periph->layout->offset,
+ 			   periph->layout->div_mask | periph->layout->cmd |
+-			   AT91_PMC_PCR_EN,
++			   enable,
+ 			   field_prep(periph->layout->div_mask, periph->div) |
+-			   periph->layout->cmd |
+-			   AT91_PMC_PCR_EN);
++			   periph->layout->cmd | enable);
+ 	spin_unlock_irqrestore(periph->lock, flags);
+ 
+ 	return 0;
+ }
+ 
++static int clk_sam9x5_peripheral_enable(struct clk_hw *hw)
++{
++	struct clk_sam9x5_peripheral *periph = to_clk_sam9x5_peripheral(hw);
++
++	return clk_sam9x5_peripheral_set(periph, 1);
++}
++
+ static void clk_sam9x5_peripheral_disable(struct clk_hw *hw)
+ {
+ 	struct clk_sam9x5_peripheral *periph = to_clk_sam9x5_peripheral(hw);
+@@ -393,6 +401,23 @@ static int clk_sam9x5_peripheral_set_rat
+ 	return -EINVAL;
+ }
+ 
++static int clk_sam9x5_peripheral_save_context(struct clk_hw *hw)
++{
++	struct clk_sam9x5_peripheral *periph = to_clk_sam9x5_peripheral(hw);
++
++	periph->pms.status = clk_sam9x5_peripheral_is_enabled(hw);
++
++	return 0;
++}
++
++static void clk_sam9x5_peripheral_restore_context(struct clk_hw *hw)
++{
++	struct clk_sam9x5_peripheral *periph = to_clk_sam9x5_peripheral(hw);
++
++	if (periph->pms.status)
++		clk_sam9x5_peripheral_set(periph, periph->pms.status);
++}
++
+ static const struct clk_ops sam9x5_peripheral_ops = {
+ 	.enable = clk_sam9x5_peripheral_enable,
+ 	.disable = clk_sam9x5_peripheral_disable,
+@@ -400,6 +425,8 @@ static const struct clk_ops sam9x5_perip
+ 	.recalc_rate = clk_sam9x5_peripheral_recalc_rate,
+ 	.round_rate = clk_sam9x5_peripheral_round_rate,
+ 	.set_rate = clk_sam9x5_peripheral_set_rate,
++	.save_context = clk_sam9x5_peripheral_save_context,
++	.restore_context = clk_sam9x5_peripheral_restore_context,
+ };
+ 
+ static const struct clk_ops sam9x5_peripheral_chg_ops = {
+@@ -409,6 +436,8 @@ static const struct clk_ops sam9x5_perip
+ 	.recalc_rate = clk_sam9x5_peripheral_recalc_rate,
+ 	.determine_rate = clk_sam9x5_peripheral_determine_rate,
+ 	.set_rate = clk_sam9x5_peripheral_set_rate,
++	.save_context = clk_sam9x5_peripheral_save_context,
++	.restore_context = clk_sam9x5_peripheral_restore_context,
+ };
+ 
+ struct clk_hw * __init
+@@ -460,7 +489,6 @@ at91_clk_register_sam9x5_peripheral(stru
+ 		hw = ERR_PTR(ret);
+ 	} else {
+ 		clk_sam9x5_peripheral_autodiv(periph);
+-		pmc_register_id(id);
+ 	}
+ 
+ 	return hw;
+--- a/drivers/clk/at91/clk-pll.c
++++ b/drivers/clk/at91/clk-pll.c
+@@ -40,6 +40,7 @@ struct clk_pll {
+ 	u16 mul;
+ 	const struct clk_pll_layout *layout;
+ 	const struct clk_pll_characteristics *characteristics;
++	struct at91_clk_pms pms;
+ };
+ 
+ static inline bool clk_pll_ready(struct regmap *regmap, int id)
+@@ -260,6 +261,42 @@ static int clk_pll_set_rate(struct clk_h
+ 	return 0;
+ }
+ 
++static int clk_pll_save_context(struct clk_hw *hw)
++{
++	struct clk_pll *pll = to_clk_pll(hw);
++	struct clk_hw *parent_hw = clk_hw_get_parent(hw);
++
++	pll->pms.parent_rate = clk_hw_get_rate(parent_hw);
++	pll->pms.rate = clk_pll_recalc_rate(&pll->hw, pll->pms.parent_rate);
++	pll->pms.status = clk_pll_ready(pll->regmap, PLL_REG(pll->id));
++
++	return 0;
++}
++
++static void clk_pll_restore_context(struct clk_hw *hw)
++{
++	struct clk_pll *pll = to_clk_pll(hw);
++	unsigned long calc_rate;
++	unsigned int pllr, pllr_out, pllr_count;
++	u8 out = 0;
++
++	if (pll->characteristics->out)
++		out = pll->characteristics->out[pll->range];
++
++	regmap_read(pll->regmap, PLL_REG(pll->id), &pllr);
++
++	calc_rate = (pll->pms.parent_rate / PLL_DIV(pllr)) *
++		     (PLL_MUL(pllr, pll->layout) + 1);
++	pllr_count = (pllr >> PLL_COUNT_SHIFT) & PLL_MAX_COUNT;
++	pllr_out = (pllr >> PLL_OUT_SHIFT) & out;
++
++	if (pll->pms.rate != calc_rate ||
++	    pll->pms.status != clk_pll_ready(pll->regmap, PLL_REG(pll->id)) ||
++	    pllr_count != PLL_MAX_COUNT ||
++	    (out && pllr_out != out))
++		pr_warn("PLLAR was not configured properly by firmware\n");
++}
++
+ static const struct clk_ops pll_ops = {
+ 	.prepare = clk_pll_prepare,
+ 	.unprepare = clk_pll_unprepare,
+@@ -267,6 +304,8 @@ static const struct clk_ops pll_ops = {
+ 	.recalc_rate = clk_pll_recalc_rate,
+ 	.round_rate = clk_pll_round_rate,
+ 	.set_rate = clk_pll_set_rate,
++	.save_context = clk_pll_save_context,
++	.restore_context = clk_pll_restore_context,
+ };
+ 
+ struct clk_hw * __init
+--- a/drivers/clk/at91/clk-programmable.c
++++ b/drivers/clk/at91/clk-programmable.c
+@@ -24,6 +24,7 @@ struct clk_programmable {
+ 	u32 *mux_table;
+ 	u8 id;
+ 	const struct clk_programmable_layout *layout;
++	struct at91_clk_pms pms;
+ };
+ 
+ #define to_clk_programmable(hw) container_of(hw, struct clk_programmable, hw)
+@@ -177,12 +178,38 @@ static int clk_programmable_set_rate(str
+ 	return 0;
+ }
+ 
++static int clk_programmable_save_context(struct clk_hw *hw)
++{
++	struct clk_programmable *prog = to_clk_programmable(hw);
++	struct clk_hw *parent_hw = clk_hw_get_parent(hw);
++
++	prog->pms.parent = clk_programmable_get_parent(hw);
++	prog->pms.parent_rate = clk_hw_get_rate(parent_hw);
++	prog->pms.rate = clk_programmable_recalc_rate(hw, prog->pms.parent_rate);
++
++	return 0;
++}
++
++static void clk_programmable_restore_context(struct clk_hw *hw)
++{
++	struct clk_programmable *prog = to_clk_programmable(hw);
++	int ret;
++
++	ret = clk_programmable_set_parent(hw, prog->pms.parent);
++	if (ret)
++		return;
++
++	clk_programmable_set_rate(hw, prog->pms.rate, prog->pms.parent_rate);
++}
++
+ static const struct clk_ops programmable_ops = {
+ 	.recalc_rate = clk_programmable_recalc_rate,
+ 	.determine_rate = clk_programmable_determine_rate,
+ 	.get_parent = clk_programmable_get_parent,
+ 	.set_parent = clk_programmable_set_parent,
+ 	.set_rate = clk_programmable_set_rate,
++	.save_context = clk_programmable_save_context,
++	.restore_context = clk_programmable_restore_context,
+ };
+ 
+ struct clk_hw * __init
+@@ -221,8 +248,6 @@ at91_clk_register_programmable(struct re
+ 	if (ret) {
+ 		kfree(prog);
+ 		hw = ERR_PTR(ret);
+-	} else {
+-		pmc_register_pck(id);
+ 	}
+ 
+ 	return hw;
+--- a/drivers/clk/at91/clk-sam9x60-pll.c
++++ b/drivers/clk/at91/clk-sam9x60-pll.c
+@@ -38,12 +38,14 @@ struct sam9x60_pll_core {
+ 
+ struct sam9x60_frac {
+ 	struct sam9x60_pll_core core;
++	struct at91_clk_pms pms;
+ 	u32 frac;
+ 	u16 mul;
+ };
+ 
+ struct sam9x60_div {
+ 	struct sam9x60_pll_core core;
++	struct at91_clk_pms pms;
+ 	u8 div;
+ };
+ 
+@@ -75,9 +77,8 @@ static unsigned long sam9x60_frac_pll_re
+ 		DIV_ROUND_CLOSEST_ULL((u64)parent_rate * frac->frac, (1 << 22));
+ }
+ 
+-static int sam9x60_frac_pll_prepare(struct clk_hw *hw)
++static int sam9x60_frac_pll_set(struct sam9x60_pll_core *core)
+ {
+-	struct sam9x60_pll_core *core = to_sam9x60_pll_core(hw);
+ 	struct sam9x60_frac *frac = to_sam9x60_frac(core);
+ 	struct regmap *regmap = core->regmap;
+ 	unsigned int val, cfrac, cmul;
+@@ -141,6 +142,13 @@ unlock:
+ 	return 0;
+ }
+ 
++static int sam9x60_frac_pll_prepare(struct clk_hw *hw)
++{
++	struct sam9x60_pll_core *core = to_sam9x60_pll_core(hw);
++
++	return sam9x60_frac_pll_set(core);
++}
++
+ static void sam9x60_frac_pll_unprepare(struct clk_hw *hw)
+ {
+ 	struct sam9x60_pll_core *core = to_sam9x60_pll_core(hw);
+@@ -280,6 +288,25 @@ unlock:
+ 	return ret;
+ }
+ 
++static int sam9x60_frac_pll_save_context(struct clk_hw *hw)
++{
++	struct sam9x60_pll_core *core = to_sam9x60_pll_core(hw);
++	struct sam9x60_frac *frac = to_sam9x60_frac(core);
++
++	frac->pms.status = sam9x60_pll_ready(core->regmap, core->id);
++
++	return 0;
++}
++
++static void sam9x60_frac_pll_restore_context(struct clk_hw *hw)
++{
++	struct sam9x60_pll_core *core = to_sam9x60_pll_core(hw);
++	struct sam9x60_frac *frac = to_sam9x60_frac(core);
++
++	if (frac->pms.status)
++		sam9x60_frac_pll_set(core);
++}
++
+ static const struct clk_ops sam9x60_frac_pll_ops = {
+ 	.prepare = sam9x60_frac_pll_prepare,
+ 	.unprepare = sam9x60_frac_pll_unprepare,
+@@ -287,6 +314,8 @@ static const struct clk_ops sam9x60_frac
+ 	.recalc_rate = sam9x60_frac_pll_recalc_rate,
+ 	.round_rate = sam9x60_frac_pll_round_rate,
+ 	.set_rate = sam9x60_frac_pll_set_rate,
++	.save_context = sam9x60_frac_pll_save_context,
++	.restore_context = sam9x60_frac_pll_restore_context,
+ };
+ 
+ static const struct clk_ops sam9x60_frac_pll_ops_chg = {
+@@ -296,11 +325,12 @@ static const struct clk_ops sam9x60_frac
+ 	.recalc_rate = sam9x60_frac_pll_recalc_rate,
+ 	.round_rate = sam9x60_frac_pll_round_rate,
+ 	.set_rate = sam9x60_frac_pll_set_rate_chg,
++	.save_context = sam9x60_frac_pll_save_context,
++	.restore_context = sam9x60_frac_pll_restore_context,
+ };
+ 
+-static int sam9x60_div_pll_prepare(struct clk_hw *hw)
++static int sam9x60_div_pll_set(struct sam9x60_pll_core *core)
+ {
+-	struct sam9x60_pll_core *core = to_sam9x60_pll_core(hw);
+ 	struct sam9x60_div *div = to_sam9x60_div(core);
+ 	struct regmap *regmap = core->regmap;
+ 	unsigned long flags;
+@@ -334,6 +364,13 @@ unlock:
+ 	return 0;
+ }
+ 
++static int sam9x60_div_pll_prepare(struct clk_hw *hw)
++{
++	struct sam9x60_pll_core *core = to_sam9x60_pll_core(hw);
++
++	return sam9x60_div_pll_set(core);
++}
++
+ static void sam9x60_div_pll_unprepare(struct clk_hw *hw)
+ {
+ 	struct sam9x60_pll_core *core = to_sam9x60_pll_core(hw);
+@@ -482,6 +519,25 @@ unlock:
+ 	return 0;
+ }
+ 
++static int sam9x60_div_pll_save_context(struct clk_hw *hw)
++{
++	struct sam9x60_pll_core *core = to_sam9x60_pll_core(hw);
++	struct sam9x60_div *div = to_sam9x60_div(core);
++
++	div->pms.status = sam9x60_div_pll_is_prepared(hw);
++
++	return 0;
++}
++
++static void sam9x60_div_pll_restore_context(struct clk_hw *hw)
++{
++	struct sam9x60_pll_core *core = to_sam9x60_pll_core(hw);
++	struct sam9x60_div *div = to_sam9x60_div(core);
++
++	if (div->pms.status)
++		sam9x60_div_pll_set(core);
++}
++
+ static const struct clk_ops sam9x60_div_pll_ops = {
+ 	.prepare = sam9x60_div_pll_prepare,
+ 	.unprepare = sam9x60_div_pll_unprepare,
+@@ -489,6 +545,8 @@ static const struct clk_ops sam9x60_div_
+ 	.recalc_rate = sam9x60_div_pll_recalc_rate,
+ 	.round_rate = sam9x60_div_pll_round_rate,
+ 	.set_rate = sam9x60_div_pll_set_rate,
++	.save_context = sam9x60_div_pll_save_context,
++	.restore_context = sam9x60_div_pll_restore_context,
+ };
+ 
+ static const struct clk_ops sam9x60_div_pll_ops_chg = {
+@@ -498,6 +556,8 @@ static const struct clk_ops sam9x60_div_
+ 	.recalc_rate = sam9x60_div_pll_recalc_rate,
+ 	.round_rate = sam9x60_div_pll_round_rate,
+ 	.set_rate = sam9x60_div_pll_set_rate_chg,
++	.save_context = sam9x60_div_pll_save_context,
++	.restore_context = sam9x60_div_pll_restore_context,
+ };
+ 
+ struct clk_hw * __init
+--- a/drivers/clk/at91/clk-system.c
++++ b/drivers/clk/at91/clk-system.c
+@@ -20,6 +20,7 @@
+ struct clk_system {
+ 	struct clk_hw hw;
+ 	struct regmap *regmap;
++	struct at91_clk_pms pms;
+ 	u8 id;
+ };
+ 
+@@ -77,10 +78,29 @@ static int clk_system_is_prepared(struct
+ 	return !!(status & (1 << sys->id));
+ }
+ 
++static int clk_system_save_context(struct clk_hw *hw)
++{
++	struct clk_system *sys = to_clk_system(hw);
++
++	sys->pms.status = clk_system_is_prepared(hw);
++
++	return 0;
++}
++
++static void clk_system_restore_context(struct clk_hw *hw)
++{
++	struct clk_system *sys = to_clk_system(hw);
++
++	if (sys->pms.status)
++		clk_system_prepare(&sys->hw);
++}
++
+ static const struct clk_ops system_ops = {
+ 	.prepare = clk_system_prepare,
+ 	.unprepare = clk_system_unprepare,
+ 	.is_prepared = clk_system_is_prepared,
++	.save_context = clk_system_save_context,
++	.restore_context = clk_system_restore_context,
+ };
+ 
+ struct clk_hw * __init
+--- a/drivers/clk/at91/clk-usb.c
++++ b/drivers/clk/at91/clk-usb.c
+@@ -24,6 +24,7 @@
+ struct at91sam9x5_clk_usb {
+ 	struct clk_hw hw;
+ 	struct regmap *regmap;
++	struct at91_clk_pms pms;
+ 	u32 usbs_mask;
+ 	u8 num_parents;
+ };
+@@ -148,12 +149,38 @@ static int at91sam9x5_clk_usb_set_rate(s
+ 	return 0;
+ }
+ 
++static int at91sam9x5_usb_save_context(struct clk_hw *hw)
++{
++	struct at91sam9x5_clk_usb *usb = to_at91sam9x5_clk_usb(hw);
++	struct clk_hw *parent_hw = clk_hw_get_parent(hw);
++
++	usb->pms.parent = at91sam9x5_clk_usb_get_parent(hw);
++	usb->pms.parent_rate = clk_hw_get_rate(parent_hw);
++	usb->pms.rate = at91sam9x5_clk_usb_recalc_rate(hw, usb->pms.parent_rate);
++
++	return 0;
++}
++
++static void at91sam9x5_usb_restore_context(struct clk_hw *hw)
++{
++	struct at91sam9x5_clk_usb *usb = to_at91sam9x5_clk_usb(hw);
++	int ret;
++
++	ret = at91sam9x5_clk_usb_set_parent(hw, usb->pms.parent);
++	if (ret)
++		return;
++
++	at91sam9x5_clk_usb_set_rate(hw, usb->pms.rate, usb->pms.parent_rate);
++}
++
+ static const struct clk_ops at91sam9x5_usb_ops = {
+ 	.recalc_rate = at91sam9x5_clk_usb_recalc_rate,
+ 	.determine_rate = at91sam9x5_clk_usb_determine_rate,
+ 	.get_parent = at91sam9x5_clk_usb_get_parent,
+ 	.set_parent = at91sam9x5_clk_usb_set_parent,
+ 	.set_rate = at91sam9x5_clk_usb_set_rate,
++	.save_context = at91sam9x5_usb_save_context,
++	.restore_context = at91sam9x5_usb_restore_context,
+ };
+ 
+ static int at91sam9n12_clk_usb_enable(struct clk_hw *hw)
+--- a/drivers/clk/at91/clk-utmi.c
++++ b/drivers/clk/at91/clk-utmi.c
+@@ -23,6 +23,7 @@ struct clk_utmi {
+ 	struct clk_hw hw;
+ 	struct regmap *regmap_pmc;
+ 	struct regmap *regmap_sfr;
++	struct at91_clk_pms pms;
+ };
+ 
+ #define to_clk_utmi(hw) container_of(hw, struct clk_utmi, hw)
+@@ -113,11 +114,30 @@ static unsigned long clk_utmi_recalc_rat
+ 	return UTMI_RATE;
+ }
+ 
++static int clk_utmi_save_context(struct clk_hw *hw)
++{
++	struct clk_utmi *utmi = to_clk_utmi(hw);
++
++	utmi->pms.status = clk_utmi_is_prepared(hw);
++
++	return 0;
++}
++
++static void clk_utmi_restore_context(struct clk_hw *hw)
++{
++	struct clk_utmi *utmi = to_clk_utmi(hw);
++
++	if (utmi->pms.status)
++		clk_utmi_prepare(hw);
++}
++
+ static const struct clk_ops utmi_ops = {
+ 	.prepare = clk_utmi_prepare,
+ 	.unprepare = clk_utmi_unprepare,
+ 	.is_prepared = clk_utmi_is_prepared,
+ 	.recalc_rate = clk_utmi_recalc_rate,
++	.save_context = clk_utmi_save_context,
++	.restore_context = clk_utmi_restore_context,
+ };
+ 
+ static struct clk_hw * __init
+@@ -232,10 +252,29 @@ static int clk_utmi_sama7g5_is_prepared(
+ 	return 0;
+ }
+ 
++static int clk_utmi_sama7g5_save_context(struct clk_hw *hw)
++{
++	struct clk_utmi *utmi = to_clk_utmi(hw);
++
++	utmi->pms.status = clk_utmi_sama7g5_is_prepared(hw);
++
++	return 0;
++}
++
++static void clk_utmi_sama7g5_restore_context(struct clk_hw *hw)
++{
++	struct clk_utmi *utmi = to_clk_utmi(hw);
++
++	if (utmi->pms.status)
++		clk_utmi_sama7g5_prepare(hw);
++}
++
+ static const struct clk_ops sama7g5_utmi_ops = {
+ 	.prepare = clk_utmi_sama7g5_prepare,
+ 	.is_prepared = clk_utmi_sama7g5_is_prepared,
+ 	.recalc_rate = clk_utmi_recalc_rate,
++	.save_context = clk_utmi_sama7g5_save_context,
++	.restore_context = clk_utmi_sama7g5_restore_context,
+ };
+ 
+ struct clk_hw * __init
+--- a/drivers/clk/at91/pmc.c
++++ b/drivers/clk/at91/pmc.c
+@@ -3,6 +3,7 @@
+  *  Copyright (C) 2013 Boris BREZILLON <b.brezillon@overkiz.com>
+  */
+ 
++#include <linux/clk.h>
+ #include <linux/clk-provider.h>
+ #include <linux/clkdev.h>
+ #include <linux/clk/at91_pmc.h>
+@@ -14,8 +15,6 @@
+ 
+ #include <asm/proc-fns.h>
+ 
+-#include <dt-bindings/clock/at91.h>
+-
+ #include "pmc.h"
+ 
+ #define PMC_MAX_IDS 128
+@@ -111,147 +110,19 @@ struct pmc_data *pmc_data_allocate(unsig
+ }
+ 
+ #ifdef CONFIG_PM
+-static struct regmap *pmcreg;
+-
+-static u8 registered_ids[PMC_MAX_IDS];
+-static u8 registered_pcks[PMC_MAX_PCKS];
+-
+-static struct
+-{
+-	u32 scsr;
+-	u32 pcsr0;
+-	u32 uckr;
+-	u32 mor;
+-	u32 mcfr;
+-	u32 pllar;
+-	u32 mckr;
+-	u32 usb;
+-	u32 imr;
+-	u32 pcsr1;
+-	u32 pcr[PMC_MAX_IDS];
+-	u32 audio_pll0;
+-	u32 audio_pll1;
+-	u32 pckr[PMC_MAX_PCKS];
+-} pmc_cache;
+-
+-/*
+- * As Peripheral ID 0 is invalid on AT91 chips, the identifier is stored
+- * without alteration in the table, and 0 is for unused clocks.
+- */
+-void pmc_register_id(u8 id)
++static int at91_pmc_suspend(void)
+ {
+-	int i;
+-
+-	for (i = 0; i < PMC_MAX_IDS; i++) {
+-		if (registered_ids[i] == 0) {
+-			registered_ids[i] = id;
+-			break;
+-		}
+-		if (registered_ids[i] == id)
+-			break;
+-	}
++	return clk_save_context();
+ }
+ 
+-/*
+- * As Programmable Clock 0 is valid on AT91 chips, there is an offset
+- * of 1 between the stored value and the real clock ID.
+- */
+-void pmc_register_pck(u8 pck)
++static void at91_pmc_resume(void)
+ {
+-	int i;
+-
+-	for (i = 0; i < PMC_MAX_PCKS; i++) {
+-		if (registered_pcks[i] == 0) {
+-			registered_pcks[i] = pck + 1;
+-			break;
+-		}
+-		if (registered_pcks[i] == (pck + 1))
+-			break;
+-	}
+-}
+-
+-static int pmc_suspend(void)
+-{
+-	int i;
+-	u8 num;
+-
+-	regmap_read(pmcreg, AT91_PMC_SCSR, &pmc_cache.scsr);
+-	regmap_read(pmcreg, AT91_PMC_PCSR, &pmc_cache.pcsr0);
+-	regmap_read(pmcreg, AT91_CKGR_UCKR, &pmc_cache.uckr);
+-	regmap_read(pmcreg, AT91_CKGR_MOR, &pmc_cache.mor);
+-	regmap_read(pmcreg, AT91_CKGR_MCFR, &pmc_cache.mcfr);
+-	regmap_read(pmcreg, AT91_CKGR_PLLAR, &pmc_cache.pllar);
+-	regmap_read(pmcreg, AT91_PMC_MCKR, &pmc_cache.mckr);
+-	regmap_read(pmcreg, AT91_PMC_USB, &pmc_cache.usb);
+-	regmap_read(pmcreg, AT91_PMC_IMR, &pmc_cache.imr);
+-	regmap_read(pmcreg, AT91_PMC_PCSR1, &pmc_cache.pcsr1);
+-
+-	for (i = 0; registered_ids[i]; i++) {
+-		regmap_write(pmcreg, AT91_PMC_PCR,
+-			     (registered_ids[i] & AT91_PMC_PCR_PID_MASK));
+-		regmap_read(pmcreg, AT91_PMC_PCR,
+-			    &pmc_cache.pcr[registered_ids[i]]);
+-	}
+-	for (i = 0; registered_pcks[i]; i++) {
+-		num = registered_pcks[i] - 1;
+-		regmap_read(pmcreg, AT91_PMC_PCKR(num), &pmc_cache.pckr[num]);
+-	}
+-
+-	return 0;
+-}
+-
+-static bool pmc_ready(unsigned int mask)
+-{
+-	unsigned int status;
+-
+-	regmap_read(pmcreg, AT91_PMC_SR, &status);
+-
+-	return ((status & mask) == mask) ? 1 : 0;
+-}
+-
+-static void pmc_resume(void)
+-{
+-	int i;
+-	u8 num;
+-	u32 tmp;
+-	u32 mask = AT91_PMC_MCKRDY | AT91_PMC_LOCKA;
+-
+-	regmap_read(pmcreg, AT91_PMC_MCKR, &tmp);
+-	if (pmc_cache.mckr != tmp)
+-		pr_warn("MCKR was not configured properly by the firmware\n");
+-	regmap_read(pmcreg, AT91_CKGR_PLLAR, &tmp);
+-	if (pmc_cache.pllar != tmp)
+-		pr_warn("PLLAR was not configured properly by the firmware\n");
+-
+-	regmap_write(pmcreg, AT91_PMC_SCER, pmc_cache.scsr);
+-	regmap_write(pmcreg, AT91_PMC_PCER, pmc_cache.pcsr0);
+-	regmap_write(pmcreg, AT91_CKGR_UCKR, pmc_cache.uckr);
+-	regmap_write(pmcreg, AT91_CKGR_MOR, pmc_cache.mor);
+-	regmap_write(pmcreg, AT91_CKGR_MCFR, pmc_cache.mcfr);
+-	regmap_write(pmcreg, AT91_PMC_USB, pmc_cache.usb);
+-	regmap_write(pmcreg, AT91_PMC_IMR, pmc_cache.imr);
+-	regmap_write(pmcreg, AT91_PMC_PCER1, pmc_cache.pcsr1);
+-
+-	for (i = 0; registered_ids[i]; i++) {
+-		regmap_write(pmcreg, AT91_PMC_PCR,
+-			     pmc_cache.pcr[registered_ids[i]] |
+-			     AT91_PMC_PCR_CMD);
+-	}
+-	for (i = 0; registered_pcks[i]; i++) {
+-		num = registered_pcks[i] - 1;
+-		regmap_write(pmcreg, AT91_PMC_PCKR(num), pmc_cache.pckr[num]);
+-	}
+-
+-	if (pmc_cache.uckr & AT91_PMC_UPLLEN)
+-		mask |= AT91_PMC_LOCKU;
+-
+-	while (!pmc_ready(mask))
+-		cpu_relax();
++	clk_restore_context();
+ }
+ 
+ static struct syscore_ops pmc_syscore_ops = {
+-	.suspend = pmc_suspend,
+-	.resume = pmc_resume,
++	.suspend = at91_pmc_suspend,
++	.resume = at91_pmc_resume,
+ };
+ 
+ static const struct of_device_id sama5d2_pmc_dt_ids[] = {
+@@ -271,11 +142,7 @@ static int __init pmc_register_ops(void)
+ 		of_node_put(np);
+ 		return -ENODEV;
+ 	}
+-
+-	pmcreg = device_node_to_regmap(np);
+ 	of_node_put(np);
+-	if (IS_ERR(pmcreg))
+-		return PTR_ERR(pmcreg);
+ 
+ 	register_syscore_ops(&pmc_syscore_ops);
+ 
+--- a/drivers/clk/at91/pmc.h
++++ b/drivers/clk/at91/pmc.h
+@@ -13,6 +13,8 @@
+ #include <linux/regmap.h>
+ #include <linux/spinlock.h>
+ 
++#include <dt-bindings/clock/at91.h>
++
+ extern spinlock_t pmc_pcr_lock;
+ 
+ struct pmc_data {
+@@ -98,6 +100,20 @@ struct clk_pcr_layout {
+ 	u32 pid_mask;
+ };
+ 
++/**
++ * struct at91_clk_pms - Power management state for AT91 clock
++ * @rate: clock rate
++ * @parent_rate: clock parent rate
++ * @status: clock status (enabled or disabled)
++ * @parent: clock parent index
++ */
++struct at91_clk_pms {
++	unsigned long rate;
++	unsigned long parent_rate;
++	unsigned int status;
++	unsigned int parent;
++};
++
+ #define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
+ #define field_prep(_mask, _val) (((_val) << (ffs(_mask) - 1)) & (_mask))
+ 
+@@ -248,12 +264,4 @@ struct clk_hw * __init
+ at91_clk_sama7g5_register_utmi(struct regmap *regmap, const char *name,
+ 			       const char *parent_name);
+ 
+-#ifdef CONFIG_PM
+-void pmc_register_id(u8 id);
+-void pmc_register_pck(u8 pck);
+-#else
+-static inline void pmc_register_id(u8 id) {}
+-static inline void pmc_register_pck(u8 pck) {}
+-#endif
+-
+ #endif /* __PMC_H_ */
diff --git a/target/linux/at91/patches-5.15/101-clk-at91-pmc-execute-suspend-resume-only-for-backup-.patch b/target/linux/at91/patches-5.15/101-clk-at91-pmc-execute-suspend-resume-only-for-backup-.patch
new file mode 100644
index 00000000000000..19f1f6fdf2d0f3
--- /dev/null
+++ b/target/linux/at91/patches-5.15/101-clk-at91-pmc-execute-suspend-resume-only-for-backup-.patch
@@ -0,0 +1,89 @@
+From 63a0c32028148e91ea91cfbf95841c4ecd69d21b Mon Sep 17 00:00:00 2001
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+Date: Mon, 11 Oct 2021 14:27:06 +0300
+Subject: [PATCH 235/247] clk: at91: pmc: execute suspend/resume only for
+ backup mode
+
+Before going to backup mode architecture specific PM code sets the first
+word in securam (file arch/arm/mach-at91/pm.c, function at91_pm_begin()).
+Thus take this into account when suspending/resuming clocks. This will
+avoid executing unnecessary instructions when suspending to non backup
+modes.
+
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20211011112719.3951784-3-claudiu.beznea@microchip.com
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+---
+ drivers/clk/at91/pmc.c | 39 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 39 insertions(+)
+
+--- a/drivers/clk/at91/pmc.c
++++ b/drivers/clk/at91/pmc.c
+@@ -8,6 +8,7 @@
+ #include <linux/clkdev.h>
+ #include <linux/clk/at91_pmc.h>
+ #include <linux/of.h>
++#include <linux/of_address.h>
+ #include <linux/mfd/syscon.h>
+ #include <linux/platform_device.h>
+ #include <linux/regmap.h>
+@@ -110,13 +111,35 @@ struct pmc_data *pmc_data_allocate(unsig
+ }
+ 
+ #ifdef CONFIG_PM
++
++/* Address in SECURAM that say if we suspend to backup mode. */
++static void __iomem *at91_pmc_backup_suspend;
++
+ static int at91_pmc_suspend(void)
+ {
++	unsigned int backup;
++
++	if (!at91_pmc_backup_suspend)
++		return 0;
++
++	backup = readl_relaxed(at91_pmc_backup_suspend);
++	if (!backup)
++		return 0;
++
+ 	return clk_save_context();
+ }
+ 
+ static void at91_pmc_resume(void)
+ {
++	unsigned int backup;
++
++	if (!at91_pmc_backup_suspend)
++		return;
++
++	backup = readl_relaxed(at91_pmc_backup_suspend);
++	if (!backup)
++		return;
++
+ 	clk_restore_context();
+ }
+ 
+@@ -144,6 +167,22 @@ static int __init pmc_register_ops(void)
+ 	}
+ 	of_node_put(np);
+ 
++	np = of_find_compatible_node(NULL, NULL, "atmel,sama5d2-securam");
++	if (!np)
++		return -ENODEV;
++
++	if (!of_device_is_available(np)) {
++		of_node_put(np);
++		return -ENODEV;
++	}
++	of_node_put(np);
++
++	at91_pmc_backup_suspend = of_iomap(np, 0);
++	if (!at91_pmc_backup_suspend) {
++		pr_warn("%s(): unable to map securam\n", __func__);
++		return -ENOMEM;
++	}
++
+ 	register_syscore_ops(&pmc_syscore_ops);
+ 
+ 	return 0;
diff --git a/target/linux/at91/patches-5.15/102-clk-at91-clk-master-add-register-definition-for-sama.patch b/target/linux/at91/patches-5.15/102-clk-at91-clk-master-add-register-definition-for-sama.patch
new file mode 100644
index 00000000000000..726d9b33e40e84
--- /dev/null
+++ b/target/linux/at91/patches-5.15/102-clk-at91-clk-master-add-register-definition-for-sama.patch
@@ -0,0 +1,124 @@
+From c716562753d1e51a1c53647aa77a332f97187d15 Mon Sep 17 00:00:00 2001
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+Date: Mon, 11 Oct 2021 14:27:08 +0300
+Subject: [PATCH 237/247] clk: at91: clk-master: add register definition for
+ sama7g5's master clock
+
+SAMA7G5 has 4 master clocks (MCK1..4) which are controlled though the
+register at offset 0x30 (relative to PMC). In the last/first phase of
+suspend/resume procedure (which is architecture specific) the parent
+of master clocks are changed (via assembly code) for more power saving
+(see file arch/arm/mach-at91/pm_suspend.S, macros at91_mckx_ps_enable
+and at91_mckx_ps_restore). Thus the macros corresponding to register
+at offset 0x30 need to be shared b/w clk-master.c and pm_suspend.S.
+commit ec03f18cc222 ("clk: at91: add register definition for sama7g5's
+master clock") introduced the proper macros but didn't adapted the
+clk-master.c as well. Thus, this commit adapt the clk-master.c to use
+the macros introduced in commit ec03f18cc222 ("clk: at91: add register
+definition for sama7g5's master clock").
+
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20211011112719.3951784-5-claudiu.beznea@microchip.com
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+---
+ drivers/clk/at91/clk-master.c | 50 ++++++++++++++++-------------------
+ 1 file changed, 23 insertions(+), 27 deletions(-)
+
+--- a/drivers/clk/at91/clk-master.c
++++ b/drivers/clk/at91/clk-master.c
+@@ -17,15 +17,7 @@
+ #define MASTER_DIV_SHIFT	8
+ #define MASTER_DIV_MASK		0x7
+ 
+-#define PMC_MCR			0x30
+-#define PMC_MCR_ID_MSK		GENMASK(3, 0)
+-#define PMC_MCR_CMD		BIT(7)
+-#define PMC_MCR_DIV		GENMASK(10, 8)
+-#define PMC_MCR_CSS		GENMASK(20, 16)
+ #define PMC_MCR_CSS_SHIFT	(16)
+-#define PMC_MCR_EN		BIT(28)
+-
+-#define PMC_MCR_ID(x)		((x) & PMC_MCR_ID_MSK)
+ 
+ #define MASTER_MAX_ID		4
+ 
+@@ -687,20 +679,22 @@ static void clk_sama7g5_master_set(struc
+ {
+ 	unsigned long flags;
+ 	unsigned int val, cparent;
+-	unsigned int enable = status ? PMC_MCR_EN : 0;
++	unsigned int enable = status ? AT91_PMC_MCR_V2_EN : 0;
+ 
+ 	spin_lock_irqsave(master->lock, flags);
+ 
+-	regmap_write(master->regmap, PMC_MCR, PMC_MCR_ID(master->id));
+-	regmap_read(master->regmap, PMC_MCR, &val);
+-	regmap_update_bits(master->regmap, PMC_MCR,
+-			   enable | PMC_MCR_CSS | PMC_MCR_DIV |
+-			   PMC_MCR_CMD | PMC_MCR_ID_MSK,
++	regmap_write(master->regmap, AT91_PMC_MCR_V2,
++		     AT91_PMC_MCR_V2_ID(master->id));
++	regmap_read(master->regmap, AT91_PMC_MCR_V2, &val);
++	regmap_update_bits(master->regmap, AT91_PMC_MCR_V2,
++			   enable | AT91_PMC_MCR_V2_CSS | AT91_PMC_MCR_V2_DIV |
++			   AT91_PMC_MCR_V2_CMD | AT91_PMC_MCR_V2_ID_MSK,
+ 			   enable | (master->parent << PMC_MCR_CSS_SHIFT) |
+ 			   (master->div << MASTER_DIV_SHIFT) |
+-			   PMC_MCR_CMD | PMC_MCR_ID(master->id));
++			   AT91_PMC_MCR_V2_CMD |
++			   AT91_PMC_MCR_V2_ID(master->id));
+ 
+-	cparent = (val & PMC_MCR_CSS) >> PMC_MCR_CSS_SHIFT;
++	cparent = (val & AT91_PMC_MCR_V2_CSS) >> PMC_MCR_CSS_SHIFT;
+ 
+ 	/* Wait here only if parent is being changed. */
+ 	while ((cparent != master->parent) && !clk_master_ready(master))
+@@ -725,10 +719,12 @@ static void clk_sama7g5_master_disable(s
+ 
+ 	spin_lock_irqsave(master->lock, flags);
+ 
+-	regmap_write(master->regmap, PMC_MCR, master->id);
+-	regmap_update_bits(master->regmap, PMC_MCR,
+-			   PMC_MCR_EN | PMC_MCR_CMD | PMC_MCR_ID_MSK,
+-			   PMC_MCR_CMD | PMC_MCR_ID(master->id));
++	regmap_write(master->regmap, AT91_PMC_MCR_V2, master->id);
++	regmap_update_bits(master->regmap, AT91_PMC_MCR_V2,
++			   AT91_PMC_MCR_V2_EN | AT91_PMC_MCR_V2_CMD |
++			   AT91_PMC_MCR_V2_ID_MSK,
++			   AT91_PMC_MCR_V2_CMD |
++			   AT91_PMC_MCR_V2_ID(master->id));
+ 
+ 	spin_unlock_irqrestore(master->lock, flags);
+ }
+@@ -741,12 +737,12 @@ static int clk_sama7g5_master_is_enabled
+ 
+ 	spin_lock_irqsave(master->lock, flags);
+ 
+-	regmap_write(master->regmap, PMC_MCR, master->id);
+-	regmap_read(master->regmap, PMC_MCR, &val);
++	regmap_write(master->regmap, AT91_PMC_MCR_V2, master->id);
++	regmap_read(master->regmap, AT91_PMC_MCR_V2, &val);
+ 
+ 	spin_unlock_irqrestore(master->lock, flags);
+ 
+-	return !!(val & PMC_MCR_EN);
++	return !!(val & AT91_PMC_MCR_V2_EN);
+ }
+ 
+ static int clk_sama7g5_master_set_rate(struct clk_hw *hw, unsigned long rate,
+@@ -842,10 +838,10 @@ at91_clk_sama7g5_register_master(struct
+ 	master->mux_table = mux_table;
+ 
+ 	spin_lock_irqsave(master->lock, flags);
+-	regmap_write(master->regmap, PMC_MCR, master->id);
+-	regmap_read(master->regmap, PMC_MCR, &val);
+-	master->parent = (val & PMC_MCR_CSS) >> PMC_MCR_CSS_SHIFT;
+-	master->div = (val & PMC_MCR_DIV) >> MASTER_DIV_SHIFT;
++	regmap_write(master->regmap, AT91_PMC_MCR_V2, master->id);
++	regmap_read(master->regmap, AT91_PMC_MCR_V2, &val);
++	master->parent = (val & AT91_PMC_MCR_V2_CSS) >> PMC_MCR_CSS_SHIFT;
++	master->div = (val & AT91_PMC_MCR_V2_DIV) >> MASTER_DIV_SHIFT;
+ 	spin_unlock_irqrestore(master->lock, flags);
+ 
+ 	hw = &master->hw;
diff --git a/target/linux/at91/patches-5.15/103-clk-at91-clk-master-improve-readability-by-using-loc.patch b/target/linux/at91/patches-5.15/103-clk-at91-clk-master-improve-readability-by-using-loc.patch
new file mode 100644
index 00000000000000..a5b57a67adba16
--- /dev/null
+++ b/target/linux/at91/patches-5.15/103-clk-at91-clk-master-improve-readability-by-using-loc.patch
@@ -0,0 +1,40 @@
+From 17b53ad1574cb5f41789993289d3d94f7a50f0ce Mon Sep 17 00:00:00 2001
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+Date: Mon, 11 Oct 2021 14:27:09 +0300
+Subject: [PATCH 238/247] clk: at91: clk-master: improve readability by using
+ local variables
+
+Improve readability in clk_sama7g5_master_set() by using local
+variables.
+
+Suggested-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20211011112719.3951784-6-claudiu.beznea@microchip.com
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+---
+ drivers/clk/at91/clk-master.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/clk/at91/clk-master.c
++++ b/drivers/clk/at91/clk-master.c
+@@ -680,6 +680,8 @@ static void clk_sama7g5_master_set(struc
+ 	unsigned long flags;
+ 	unsigned int val, cparent;
+ 	unsigned int enable = status ? AT91_PMC_MCR_V2_EN : 0;
++	unsigned int parent = master->parent << PMC_MCR_CSS_SHIFT;
++	unsigned int div = master->div << MASTER_DIV_SHIFT;
+ 
+ 	spin_lock_irqsave(master->lock, flags);
+ 
+@@ -689,9 +691,7 @@ static void clk_sama7g5_master_set(struc
+ 	regmap_update_bits(master->regmap, AT91_PMC_MCR_V2,
+ 			   enable | AT91_PMC_MCR_V2_CSS | AT91_PMC_MCR_V2_DIV |
+ 			   AT91_PMC_MCR_V2_CMD | AT91_PMC_MCR_V2_ID_MSK,
+-			   enable | (master->parent << PMC_MCR_CSS_SHIFT) |
+-			   (master->div << MASTER_DIV_SHIFT) |
+-			   AT91_PMC_MCR_V2_CMD |
++			   enable | parent | div | AT91_PMC_MCR_V2_CMD |
+ 			   AT91_PMC_MCR_V2_ID(master->id));
+ 
+ 	cparent = (val & AT91_PMC_MCR_V2_CSS) >> PMC_MCR_CSS_SHIFT;
diff --git a/target/linux/at91/patches-5.15/104-clk-at91-pmc-add-sama7g5-to-the-list-of-available-pm.patch b/target/linux/at91/patches-5.15/104-clk-at91-pmc-add-sama7g5-to-the-list-of-available-pm.patch
new file mode 100644
index 00000000000000..2918de17008474
--- /dev/null
+++ b/target/linux/at91/patches-5.15/104-clk-at91-pmc-add-sama7g5-to-the-list-of-available-pm.patch
@@ -0,0 +1,39 @@
+From 8a38e0dda46c9d941a61d8b2e6c14704531b7871 Mon Sep 17 00:00:00 2001
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+Date: Mon, 11 Oct 2021 14:27:10 +0300
+Subject: [PATCH 239/247] clk: at91: pmc: add sama7g5 to the list of available
+ pmcs
+
+Add SAMA7G5 to the list of available PMCs such that the suspend/resume
+code for clocks to be used on backup mode.
+
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20211011112719.3951784-7-claudiu.beznea@microchip.com
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+---
+ drivers/clk/at91/pmc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/at91/pmc.c
++++ b/drivers/clk/at91/pmc.c
+@@ -148,8 +148,9 @@ static struct syscore_ops pmc_syscore_op
+ 	.resume = at91_pmc_resume,
+ };
+ 
+-static const struct of_device_id sama5d2_pmc_dt_ids[] = {
++static const struct of_device_id pmc_dt_ids[] = {
+ 	{ .compatible = "atmel,sama5d2-pmc" },
++	{ .compatible = "microchip,sama7g5-pmc", },
+ 	{ /* sentinel */ }
+ };
+ 
+@@ -157,7 +158,7 @@ static int __init pmc_register_ops(void)
+ {
+ 	struct device_node *np;
+ 
+-	np = of_find_matching_node(NULL, sama5d2_pmc_dt_ids);
++	np = of_find_matching_node(NULL, pmc_dt_ids);
+ 	if (!np)
+ 		return -ENODEV;
+ 
diff --git a/target/linux/at91/patches-5.15/105-clk-at91-clk-master-mask-mckr-against-layout-mask.patch b/target/linux/at91/patches-5.15/105-clk-at91-clk-master-mask-mckr-against-layout-mask.patch
new file mode 100644
index 00000000000000..ea869c948530e4
--- /dev/null
+++ b/target/linux/at91/patches-5.15/105-clk-at91-clk-master-mask-mckr-against-layout-mask.patch
@@ -0,0 +1,46 @@
+From 27c11c09346b7b9f67eeb39db1b943f4a9742ff3 Mon Sep 17 00:00:00 2001
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+Date: Mon, 11 Oct 2021 14:27:13 +0300
+Subject: [PATCH 241/247] clk: at91: clk-master: mask mckr against layout->mask
+
+Mask values read/written from/to MCKR against layout->mask as this
+mask may be different b/w PMC versions.
+
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20211011112719.3951784-10-claudiu.beznea@microchip.com
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+---
+ drivers/clk/at91/clk-master.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/at91/clk-master.c
++++ b/drivers/clk/at91/clk-master.c
+@@ -186,8 +186,8 @@ static int clk_master_div_set_rate(struc
+ 	if (ret)
+ 		goto unlock;
+ 
+-	tmp = mckr & master->layout->mask;
+-	tmp = (tmp >> MASTER_DIV_SHIFT) & MASTER_DIV_MASK;
++	mckr &= master->layout->mask;
++	tmp = (mckr >> MASTER_DIV_SHIFT) & MASTER_DIV_MASK;
+ 	if (tmp == div)
+ 		goto unlock;
+ 
+@@ -384,6 +384,7 @@ static unsigned long clk_master_pres_rec
+ 	regmap_read(master->regmap, master->layout->offset, &val);
+ 	spin_unlock_irqrestore(master->lock, flags);
+ 
++	val &= master->layout->mask;
+ 	pres = (val >> master->layout->pres_shift) & MASTER_PRES_MASK;
+ 	if (pres == MASTER_PRES_MAX && characteristics->have_div3_pres)
+ 		pres = 3;
+@@ -403,6 +404,8 @@ static u8 clk_master_pres_get_parent(str
+ 	regmap_read(master->regmap, master->layout->offset, &mckr);
+ 	spin_unlock_irqrestore(master->lock, flags);
+ 
++	mckr &= master->layout->mask;
++
+ 	return mckr & AT91_PMC_CSS;
+ }
+ 
diff --git a/target/linux/at91/patches-5.15/106-clk-at91-clk-sam9x60-pll-add-notifier-for-div-part-o.patch b/target/linux/at91/patches-5.15/106-clk-at91-clk-sam9x60-pll-add-notifier-for-div-part-o.patch
new file mode 100644
index 00000000000000..e5ebdc4ea4141e
--- /dev/null
+++ b/target/linux/at91/patches-5.15/106-clk-at91-clk-sam9x60-pll-add-notifier-for-div-part-o.patch
@@ -0,0 +1,312 @@
+From e76d2af5009f52aa02d3db7ae32d150ad66398f9 Mon Sep 17 00:00:00 2001
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+Date: Mon, 11 Oct 2021 14:27:15 +0300
+Subject: [PATCH 243/247] clk: at91: clk-sam9x60-pll: add notifier for div part
+ of PLL
+
+SAM9X60's PLL which is also part of SAMA7G5 is composed of 2 parts:
+one fractional part and one divider. On SAMA7G5 the CPU PLL could be
+changed at run-time to implement DVFS. The hardware clock tree on
+SAMA7G5 for CPU PLL is as follows:
+
+                       +---- div1 ----------------> cpuck
+                       |
+FRAC PLL ---> DIV PLL -+-> prescaler ---> div0 ---> mck0
+
+The div1 block is not implemented in Linux; on prescaler block it has
+been discovered a bug on some scenarios and will be removed from Linux
+in next commits. Thus, the final clock tree that will be used in Linux
+will be as follows:
+
+                       +-----------> cpuck
+                       |
+FRAC PLL ---> DIV PLL -+-> div0 ---> mck0
+
+It has been proposed in [1] to not introduce a new CPUFreq driver but
+to overload the proper clock drivers with proper operation such that
+cpufreq-dt to be used. To accomplish this DIV PLL and div0 implement
+clock notifiers which applies safe dividers before FRAC PLL is changed.
+The current commit treats only the DIV PLL by adding a notifier that
+sets a safe divider on PRE_RATE_CHANGE events. The safe divider is
+provided by initialization clock code (sama7g5.c). The div0 is treated
+in next commits (to keep the changes as clean as possible).
+
+[1] https://lore.kernel.org/lkml/20210105104426.4tmgc2l3vyicwedd@vireshk-i7/
+
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20211011112719.3951784-12-claudiu.beznea@microchip.com
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+---
+ drivers/clk/at91/clk-sam9x60-pll.c | 102 ++++++++++++++++++++++-------
+ drivers/clk/at91/pmc.h             |   3 +-
+ drivers/clk/at91/sam9x60.c         |   6 +-
+ drivers/clk/at91/sama7g5.c         |  13 +++-
+ 4 files changed, 95 insertions(+), 29 deletions(-)
+
+--- a/drivers/clk/at91/clk-sam9x60-pll.c
++++ b/drivers/clk/at91/clk-sam9x60-pll.c
+@@ -5,6 +5,7 @@
+  */
+ 
+ #include <linux/bitfield.h>
++#include <linux/clk.h>
+ #include <linux/clk-provider.h>
+ #include <linux/clkdev.h>
+ #include <linux/clk/at91_pmc.h>
+@@ -47,12 +48,15 @@ struct sam9x60_div {
+ 	struct sam9x60_pll_core core;
+ 	struct at91_clk_pms pms;
+ 	u8 div;
++	u8 safe_div;
+ };
+ 
+ #define to_sam9x60_pll_core(hw)	container_of(hw, struct sam9x60_pll_core, hw)
+ #define to_sam9x60_frac(core)	container_of(core, struct sam9x60_frac, core)
+ #define to_sam9x60_div(core)	container_of(core, struct sam9x60_div, core)
+ 
++static struct sam9x60_div *notifier_div;
++
+ static inline bool sam9x60_pll_ready(struct regmap *regmap, int id)
+ {
+ 	unsigned int status;
+@@ -329,6 +333,26 @@ static const struct clk_ops sam9x60_frac
+ 	.restore_context = sam9x60_frac_pll_restore_context,
+ };
+ 
++/* This function should be called with spinlock acquired. */
++static void sam9x60_div_pll_set_div(struct sam9x60_pll_core *core, u32 div,
++				    bool enable)
++{
++	struct regmap *regmap = core->regmap;
++	u32 ena_msk = enable ? core->layout->endiv_mask : 0;
++	u32 ena_val = enable ? (1 << core->layout->endiv_shift) : 0;
++
++	regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0,
++			   core->layout->div_mask | ena_msk,
++			   (div << core->layout->div_shift) | ena_val);
++
++	regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
++			   AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++			   AT91_PMC_PLL_UPDT_UPDATE | core->id);
++
++	while (!sam9x60_pll_ready(regmap, core->id))
++		cpu_relax();
++}
++
+ static int sam9x60_div_pll_set(struct sam9x60_pll_core *core)
+ {
+ 	struct sam9x60_div *div = to_sam9x60_div(core);
+@@ -346,17 +370,7 @@ static int sam9x60_div_pll_set(struct sa
+ 	if (!!(val & core->layout->endiv_mask) && cdiv == div->div)
+ 		goto unlock;
+ 
+-	regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0,
+-			   core->layout->div_mask | core->layout->endiv_mask,
+-			   (div->div << core->layout->div_shift) |
+-			   (1 << core->layout->endiv_shift));
+-
+-	regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+-			   AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+-			   AT91_PMC_PLL_UPDT_UPDATE | core->id);
+-
+-	while (!sam9x60_pll_ready(regmap, core->id))
+-		cpu_relax();
++	sam9x60_div_pll_set_div(core, div->div, 1);
+ 
+ unlock:
+ 	spin_unlock_irqrestore(core->lock, flags);
+@@ -502,16 +516,7 @@ static int sam9x60_div_pll_set_rate_chg(
+ 	if (cdiv == div->div)
+ 		goto unlock;
+ 
+-	regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0,
+-			   core->layout->div_mask,
+-			   (div->div << core->layout->div_shift));
+-
+-	regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+-			   AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+-			   AT91_PMC_PLL_UPDT_UPDATE | core->id);
+-
+-	while (!sam9x60_pll_ready(regmap, core->id))
+-		cpu_relax();
++	sam9x60_div_pll_set_div(core, div->div, 0);
+ 
+ unlock:
+ 	spin_unlock_irqrestore(core->lock, irqflags);
+@@ -538,6 +543,48 @@ static void sam9x60_div_pll_restore_cont
+ 		sam9x60_div_pll_set(core);
+ }
+ 
++static int sam9x60_div_pll_notifier_fn(struct notifier_block *notifier,
++				       unsigned long code, void *data)
++{
++	struct sam9x60_div *div = notifier_div;
++	struct sam9x60_pll_core core = div->core;
++	struct regmap *regmap = core.regmap;
++	unsigned long irqflags;
++	u32 val, cdiv;
++	int ret = NOTIFY_DONE;
++
++	if (code != PRE_RATE_CHANGE)
++		return ret;
++
++	/*
++	 * We switch to safe divider to avoid overclocking of other domains
++	 * feed by us while the frac PLL (our parent) is changed.
++	 */
++	div->div = div->safe_div;
++
++	spin_lock_irqsave(core.lock, irqflags);
++	regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
++			   core.id);
++	regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val);
++	cdiv = (val & core.layout->div_mask) >> core.layout->div_shift;
++
++	/* Stop if nothing changed. */
++	if (cdiv == div->safe_div)
++		goto unlock;
++
++	sam9x60_div_pll_set_div(&core, div->div, 0);
++	ret = NOTIFY_OK;
++
++unlock:
++	spin_unlock_irqrestore(core.lock, irqflags);
++
++	return ret;
++}
++
++static struct notifier_block sam9x60_div_pll_notifier = {
++	.notifier_call = sam9x60_div_pll_notifier_fn,
++};
++
+ static const struct clk_ops sam9x60_div_pll_ops = {
+ 	.prepare = sam9x60_div_pll_prepare,
+ 	.unprepare = sam9x60_div_pll_unprepare,
+@@ -647,7 +694,8 @@ struct clk_hw * __init
+ sam9x60_clk_register_div_pll(struct regmap *regmap, spinlock_t *lock,
+ 			     const char *name, const char *parent_name, u8 id,
+ 			     const struct clk_pll_characteristics *characteristics,
+-			     const struct clk_pll_layout *layout, u32 flags)
++			     const struct clk_pll_layout *layout, u32 flags,
++			     u32 safe_div)
+ {
+ 	struct sam9x60_div *div;
+ 	struct clk_hw *hw;
+@@ -656,9 +704,13 @@ sam9x60_clk_register_div_pll(struct regm
+ 	unsigned int val;
+ 	int ret;
+ 
+-	if (id > PLL_MAX_ID || !lock)
++	/* We only support one changeable PLL. */
++	if (id > PLL_MAX_ID || !lock || (safe_div && notifier_div))
+ 		return ERR_PTR(-EINVAL);
+ 
++	if (safe_div >= PLL_DIV_MAX)
++		safe_div = PLL_DIV_MAX - 1;
++
+ 	div = kzalloc(sizeof(*div), GFP_KERNEL);
+ 	if (!div)
+ 		return ERR_PTR(-ENOMEM);
+@@ -678,6 +730,7 @@ sam9x60_clk_register_div_pll(struct regm
+ 	div->core.layout = layout;
+ 	div->core.regmap = regmap;
+ 	div->core.lock = lock;
++	div->safe_div = safe_div;
+ 
+ 	spin_lock_irqsave(div->core.lock, irqflags);
+ 
+@@ -693,6 +746,9 @@ sam9x60_clk_register_div_pll(struct regm
+ 	if (ret) {
+ 		kfree(div);
+ 		hw = ERR_PTR(ret);
++	} else if (div->safe_div) {
++		notifier_div = div;
++		clk_notifier_register(hw->clk, &sam9x60_div_pll_notifier);
+ 	}
+ 
+ 	return hw;
+--- a/drivers/clk/at91/pmc.h
++++ b/drivers/clk/at91/pmc.h
+@@ -214,7 +214,8 @@ struct clk_hw * __init
+ sam9x60_clk_register_div_pll(struct regmap *regmap, spinlock_t *lock,
+ 			     const char *name, const char *parent_name, u8 id,
+ 			     const struct clk_pll_characteristics *characteristics,
+-			     const struct clk_pll_layout *layout, u32 flags);
++			     const struct clk_pll_layout *layout, u32 flags,
++			     u32 safe_div);
+ 
+ struct clk_hw * __init
+ sam9x60_clk_register_frac_pll(struct regmap *regmap, spinlock_t *lock,
+--- a/drivers/clk/at91/sam9x60.c
++++ b/drivers/clk/at91/sam9x60.c
+@@ -242,7 +242,7 @@ static void __init sam9x60_pmc_setup(str
+ 					    * This feeds CPU. It should not
+ 					    * be disabled.
+ 					    */
+-					  CLK_IS_CRITICAL | CLK_SET_RATE_GATE);
++					  CLK_IS_CRITICAL | CLK_SET_RATE_GATE, 0);
+ 	if (IS_ERR(hw))
+ 		goto err_free;
+ 
+@@ -260,7 +260,7 @@ static void __init sam9x60_pmc_setup(str
+ 					  &pll_div_layout,
+ 					  CLK_SET_RATE_GATE |
+ 					  CLK_SET_PARENT_GATE |
+-					  CLK_SET_RATE_PARENT);
++					  CLK_SET_RATE_PARENT, 0);
+ 	if (IS_ERR(hw))
+ 		goto err_free;
+ 
+@@ -279,7 +279,7 @@ static void __init sam9x60_pmc_setup(str
+ 	hw = at91_clk_register_master_div(regmap, "masterck_div",
+ 					  "masterck_pres", &sam9x60_master_layout,
+ 					  &mck_characteristics, &mck_lock,
+-					  CLK_SET_RATE_GATE);
++					  CLK_SET_RATE_GATE, 0);
+ 	if (IS_ERR(hw))
+ 		goto err_free;
+ 
+--- a/drivers/clk/at91/sama7g5.c
++++ b/drivers/clk/at91/sama7g5.c
+@@ -127,6 +127,8 @@ static const struct clk_pll_characterist
+  * @t:		clock type
+  * @f:		clock flags
+  * @eid:	export index in sama7g5->chws[] array
++ * @safe_div:	intermediate divider need to be set on PRE_RATE_CHANGE
++ *		notification
+  */
+ static const struct {
+ 	const char *n;
+@@ -136,6 +138,7 @@ static const struct {
+ 	unsigned long f;
+ 	u8 t;
+ 	u8 eid;
++	u8 safe_div;
+ } sama7g5_plls[][PLL_ID_MAX] = {
+ 	[PLL_ID_CPU] = {
+ 		{ .n = "cpupll_fracck",
+@@ -156,7 +159,12 @@ static const struct {
+ 		  .t = PLL_TYPE_DIV,
+ 		   /* This feeds CPU. It should not be disabled. */
+ 		  .f = CLK_IS_CRITICAL | CLK_SET_RATE_PARENT,
+-		  .eid = PMC_CPUPLL, },
++		  .eid = PMC_CPUPLL,
++		  /*
++		   * Safe div=15 should be safe even for switching b/w 1GHz and
++		   * 90MHz (frac pll might go up to 1.2GHz).
++		   */
++		  .safe_div = 15, },
+ 	},
+ 
+ 	[PLL_ID_SYS] = {
+@@ -966,7 +974,8 @@ static void __init sama7g5_pmc_setup(str
+ 					sama7g5_plls[i][j].p, i,
+ 					sama7g5_plls[i][j].c,
+ 					sama7g5_plls[i][j].l,
+-					sama7g5_plls[i][j].f);
++					sama7g5_plls[i][j].f,
++					sama7g5_plls[i][j].safe_div);
+ 				break;
+ 
+ 			default:
diff --git a/target/linux/at91/patches-5.15/107-clk-at91-clk-master-add-notifier-for-divider.patch b/target/linux/at91/patches-5.15/107-clk-at91-clk-master-add-notifier-for-divider.patch
new file mode 100644
index 00000000000000..83839e6a744992
--- /dev/null
+++ b/target/linux/at91/patches-5.15/107-clk-at91-clk-master-add-notifier-for-divider.patch
@@ -0,0 +1,519 @@
+From 75d5d1d584ae73ba0c36d1d7255db6153ca4d3f3 Mon Sep 17 00:00:00 2001
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+Date: Mon, 11 Oct 2021 14:27:16 +0300
+Subject: [PATCH 244/247] clk: at91: clk-master: add notifier for divider
+
+SAMA7G5 supports DVFS by changing cpuck. On SAMA7G5 mck0 shares the same
+parent with cpuck as seen in the following clock tree:
+
+                       +----------> cpuck
+                       |
+FRAC PLL ---> DIV PLL -+-> DIV ---> mck0
+
+mck0 could go b/w 32KHz and 200MHz on SAMA7G5. To avoid mck0 overclocking
+while changing FRAC PLL or DIV PLL the commit implements a notifier for
+mck0 which applies a safe divider to register (maximum value of the divider
+which is 5) on PRE_RATE_CHANGE events (such that changes on PLL to not
+overclock mck0) and sets the maximum allowed rate on POST_RATE_CHANGE
+events.
+
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20211011112719.3951784-13-claudiu.beznea@microchip.com
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+---
+ drivers/clk/at91/at91rm9200.c  |   2 +-
+ drivers/clk/at91/at91sam9260.c |   2 +-
+ drivers/clk/at91/at91sam9g45.c |   2 +-
+ drivers/clk/at91/at91sam9n12.c |   2 +-
+ drivers/clk/at91/at91sam9rl.c  |   2 +-
+ drivers/clk/at91/at91sam9x5.c  |   2 +-
+ drivers/clk/at91/clk-master.c  | 244 +++++++++++++++++++++++----------
+ drivers/clk/at91/dt-compat.c   |   2 +-
+ drivers/clk/at91/pmc.h         |   2 +-
+ drivers/clk/at91/sama5d2.c     |   2 +-
+ drivers/clk/at91/sama5d3.c     |   2 +-
+ drivers/clk/at91/sama5d4.c     |   2 +-
+ drivers/clk/at91/sama7g5.c     |   2 +-
+ 13 files changed, 186 insertions(+), 82 deletions(-)
+
+--- a/drivers/clk/at91/at91rm9200.c
++++ b/drivers/clk/at91/at91rm9200.c
+@@ -152,7 +152,7 @@ static void __init at91rm9200_pmc_setup(
+ 					  "masterck_pres",
+ 					  &at91rm9200_master_layout,
+ 					  &rm9200_mck_characteristics,
+-					  &rm9200_mck_lock, CLK_SET_RATE_GATE);
++					  &rm9200_mck_lock, CLK_SET_RATE_GATE, 0);
+ 	if (IS_ERR(hw))
+ 		goto err_free;
+ 
+--- a/drivers/clk/at91/at91sam9260.c
++++ b/drivers/clk/at91/at91sam9260.c
+@@ -429,7 +429,7 @@ static void __init at91sam926x_pmc_setup
+ 					  &at91rm9200_master_layout,
+ 					  data->mck_characteristics,
+ 					  &at91sam9260_mck_lock,
+-					  CLK_SET_RATE_GATE);
++					  CLK_SET_RATE_GATE, 0);
+ 	if (IS_ERR(hw))
+ 		goto err_free;
+ 
+--- a/drivers/clk/at91/at91sam9g45.c
++++ b/drivers/clk/at91/at91sam9g45.c
+@@ -164,7 +164,7 @@ static void __init at91sam9g45_pmc_setup
+ 					  &at91rm9200_master_layout,
+ 					  &mck_characteristics,
+ 					  &at91sam9g45_mck_lock,
+-					  CLK_SET_RATE_GATE);
++					  CLK_SET_RATE_GATE, 0);
+ 	if (IS_ERR(hw))
+ 		goto err_free;
+ 
+--- a/drivers/clk/at91/at91sam9n12.c
++++ b/drivers/clk/at91/at91sam9n12.c
+@@ -191,7 +191,7 @@ static void __init at91sam9n12_pmc_setup
+ 					  &at91sam9x5_master_layout,
+ 					  &mck_characteristics,
+ 					  &at91sam9n12_mck_lock,
+-					  CLK_SET_RATE_GATE);
++					  CLK_SET_RATE_GATE, 0);
+ 	if (IS_ERR(hw))
+ 		goto err_free;
+ 
+--- a/drivers/clk/at91/at91sam9rl.c
++++ b/drivers/clk/at91/at91sam9rl.c
+@@ -132,7 +132,7 @@ static void __init at91sam9rl_pmc_setup(
+ 					  "masterck_pres",
+ 					  &at91rm9200_master_layout,
+ 					  &sam9rl_mck_characteristics,
+-					  &sam9rl_mck_lock, CLK_SET_RATE_GATE);
++					  &sam9rl_mck_lock, CLK_SET_RATE_GATE, 0);
+ 	if (IS_ERR(hw))
+ 		goto err_free;
+ 
+--- a/drivers/clk/at91/at91sam9x5.c
++++ b/drivers/clk/at91/at91sam9x5.c
+@@ -210,7 +210,7 @@ static void __init at91sam9x5_pmc_setup(
+ 					  "masterck_pres",
+ 					  &at91sam9x5_master_layout,
+ 					  &mck_characteristics, &mck_lock,
+-					  CLK_SET_RATE_GATE);
++					  CLK_SET_RATE_GATE, 0);
+ 	if (IS_ERR(hw))
+ 		goto err_free;
+ 
+--- a/drivers/clk/at91/clk-master.c
++++ b/drivers/clk/at91/clk-master.c
+@@ -5,6 +5,7 @@
+ 
+ #include <linux/clk-provider.h>
+ #include <linux/clkdev.h>
++#include <linux/clk.h>
+ #include <linux/clk/at91_pmc.h>
+ #include <linux/of.h>
+ #include <linux/mfd/syscon.h>
+@@ -36,8 +37,12 @@ struct clk_master {
+ 	u8 id;
+ 	u8 parent;
+ 	u8 div;
++	u32 safe_div;
+ };
+ 
++/* MCK div reference to be used by notifier. */
++static struct clk_master *master_div;
++
+ static inline bool clk_master_ready(struct clk_master *master)
+ {
+ 	unsigned int bit = master->id ? AT91_PMC_MCKXRDY : AT91_PMC_MCKRDY;
+@@ -153,107 +158,81 @@ static const struct clk_ops master_div_o
+ 	.restore_context = clk_master_div_restore_context,
+ };
+ 
+-static int clk_master_div_set_rate(struct clk_hw *hw, unsigned long rate,
+-				   unsigned long parent_rate)
++/* This function must be called with lock acquired. */
++static int clk_master_div_set(struct clk_master *master,
++			      unsigned long parent_rate, int div)
+ {
+-	struct clk_master *master = to_clk_master(hw);
+ 	const struct clk_master_characteristics *characteristics =
+ 						master->characteristics;
+-	unsigned long flags;
+-	unsigned int mckr, tmp;
+-	int div, i;
++	unsigned long rate = parent_rate;
++	unsigned int max_div = 0, div_index = 0, max_div_index = 0;
++	unsigned int i, mckr, tmp;
+ 	int ret;
+ 
+-	div = DIV_ROUND_CLOSEST(parent_rate, rate);
+-	if (div > ARRAY_SIZE(characteristics->divisors))
+-		return -EINVAL;
+-
+ 	for (i = 0; i < ARRAY_SIZE(characteristics->divisors); i++) {
+ 		if (!characteristics->divisors[i])
+ 			break;
+ 
+-		if (div == characteristics->divisors[i]) {
+-			div = i;
+-			break;
++		if (div == characteristics->divisors[i])
++			div_index = i;
++
++		if (max_div < characteristics->divisors[i]) {
++			max_div = characteristics->divisors[i];
++			max_div_index = i;
+ 		}
+ 	}
+ 
+-	if (i == ARRAY_SIZE(characteristics->divisors))
+-		return -EINVAL;
++	if (div > max_div)
++		div_index = max_div_index;
+ 
+-	spin_lock_irqsave(master->lock, flags);
+ 	ret = regmap_read(master->regmap, master->layout->offset, &mckr);
+ 	if (ret)
+-		goto unlock;
++		return ret;
+ 
+ 	mckr &= master->layout->mask;
+ 	tmp = (mckr >> MASTER_DIV_SHIFT) & MASTER_DIV_MASK;
+-	if (tmp == div)
+-		goto unlock;
++	if (tmp == div_index)
++		return 0;
++
++	rate /= characteristics->divisors[div_index];
++	if (rate < characteristics->output.min)
++		pr_warn("master clk div is underclocked");
++	else if (rate > characteristics->output.max)
++		pr_warn("master clk div is overclocked");
+ 
+ 	mckr &= ~(MASTER_DIV_MASK << MASTER_DIV_SHIFT);
+-	mckr |= (div << MASTER_DIV_SHIFT);
++	mckr |= (div_index << MASTER_DIV_SHIFT);
+ 	ret = regmap_write(master->regmap, master->layout->offset, mckr);
+ 	if (ret)
+-		goto unlock;
++		return ret;
+ 
+ 	while (!clk_master_ready(master))
+ 		cpu_relax();
+-unlock:
+-	spin_unlock_irqrestore(master->lock, flags);
++
++	master->div = characteristics->divisors[div_index];
+ 
+ 	return 0;
+ }
+ 
+-static int clk_master_div_determine_rate(struct clk_hw *hw,
+-					 struct clk_rate_request *req)
++static unsigned long clk_master_div_recalc_rate_chg(struct clk_hw *hw,
++						    unsigned long parent_rate)
+ {
+ 	struct clk_master *master = to_clk_master(hw);
+-	const struct clk_master_characteristics *characteristics =
+-						master->characteristics;
+-	struct clk_hw *parent;
+-	unsigned long parent_rate, tmp_rate, best_rate = 0;
+-	int i, best_diff = INT_MIN, tmp_diff;
+-
+-	parent = clk_hw_get_parent(hw);
+-	if (!parent)
+-		return -EINVAL;
+-
+-	parent_rate = clk_hw_get_rate(parent);
+-	if (!parent_rate)
+-		return -EINVAL;
+ 
+-	for (i = 0; i < ARRAY_SIZE(characteristics->divisors); i++) {
+-		if (!characteristics->divisors[i])
+-			break;
+-
+-		tmp_rate = DIV_ROUND_CLOSEST_ULL(parent_rate,
+-						 characteristics->divisors[i]);
+-		tmp_diff = abs(tmp_rate - req->rate);
+-
+-		if (!best_rate || best_diff > tmp_diff) {
+-			best_diff = tmp_diff;
+-			best_rate = tmp_rate;
+-		}
+-
+-		if (!best_diff)
+-			break;
+-	}
+-
+-	req->best_parent_rate = best_rate;
+-	req->best_parent_hw = parent;
+-	req->rate = best_rate;
+-
+-	return 0;
++	return DIV_ROUND_CLOSEST_ULL(parent_rate, master->div);
+ }
+ 
+ static void clk_master_div_restore_context_chg(struct clk_hw *hw)
+ {
+ 	struct clk_master *master = to_clk_master(hw);
++	unsigned long flags;
+ 	int ret;
+ 
+-	ret = clk_master_div_set_rate(hw, master->pms.rate,
+-				      master->pms.parent_rate);
++	spin_lock_irqsave(master->lock, flags);
++	ret = clk_master_div_set(master, master->pms.parent_rate,
++				 DIV_ROUND_CLOSEST(master->pms.parent_rate,
++						   master->pms.rate));
++	spin_unlock_irqrestore(master->lock, flags);
+ 	if (ret)
+ 		pr_warn("Failed to restore MCK DIV clock\n");
+ }
+@@ -261,13 +240,116 @@ static void clk_master_div_restore_conte
+ static const struct clk_ops master_div_ops_chg = {
+ 	.prepare = clk_master_prepare,
+ 	.is_prepared = clk_master_is_prepared,
+-	.recalc_rate = clk_master_div_recalc_rate,
+-	.determine_rate = clk_master_div_determine_rate,
+-	.set_rate = clk_master_div_set_rate,
++	.recalc_rate = clk_master_div_recalc_rate_chg,
+ 	.save_context = clk_master_div_save_context,
+ 	.restore_context = clk_master_div_restore_context_chg,
+ };
+ 
++static int clk_master_div_notifier_fn(struct notifier_block *notifier,
++				      unsigned long code, void *data)
++{
++	const struct clk_master_characteristics *characteristics =
++						master_div->characteristics;
++	struct clk_notifier_data *cnd = data;
++	unsigned long flags, new_parent_rate, new_rate;
++	unsigned int mckr, div, new_div = 0;
++	int ret, i;
++	long tmp_diff;
++	long best_diff = -1;
++
++	spin_lock_irqsave(master_div->lock, flags);
++	switch (code) {
++	case PRE_RATE_CHANGE:
++		/*
++		 * We want to avoid any overclocking of MCK DIV domain. To do
++		 * this we set a safe divider (the underclocking is not of
++		 * interest as we can go as low as 32KHz). The relation
++		 * b/w this clock and its parents are as follows:
++		 *
++		 * FRAC PLL -> DIV PLL -> MCK DIV
++		 *
++		 * With the proper safe divider we should be good even with FRAC
++		 * PLL at its maximum value.
++		 */
++		ret = regmap_read(master_div->regmap, master_div->layout->offset,
++				  &mckr);
++		if (ret) {
++			ret = NOTIFY_STOP_MASK;
++			goto unlock;
++		}
++
++		mckr &= master_div->layout->mask;
++		div = (mckr >> MASTER_DIV_SHIFT) & MASTER_DIV_MASK;
++
++		/* Switch to safe divider. */
++		clk_master_div_set(master_div,
++				   cnd->old_rate * characteristics->divisors[div],
++				   master_div->safe_div);
++		break;
++
++	case POST_RATE_CHANGE:
++		/*
++		 * At this point we want to restore MCK DIV domain to its maximum
++		 * allowed rate.
++		 */
++		ret = regmap_read(master_div->regmap, master_div->layout->offset,
++				  &mckr);
++		if (ret) {
++			ret = NOTIFY_STOP_MASK;
++			goto unlock;
++		}
++
++		mckr &= master_div->layout->mask;
++		div = (mckr >> MASTER_DIV_SHIFT) & MASTER_DIV_MASK;
++		new_parent_rate = cnd->new_rate * characteristics->divisors[div];
++
++		for (i = 0; i < ARRAY_SIZE(characteristics->divisors); i++) {
++			if (!characteristics->divisors[i])
++				break;
++
++			new_rate = DIV_ROUND_CLOSEST_ULL(new_parent_rate,
++							 characteristics->divisors[i]);
++
++			tmp_diff = characteristics->output.max - new_rate;
++			if (tmp_diff < 0)
++				continue;
++
++			if (best_diff < 0 || best_diff > tmp_diff) {
++				new_div = characteristics->divisors[i];
++				best_diff = tmp_diff;
++			}
++
++			if (!tmp_diff)
++				break;
++		}
++
++		if (!new_div) {
++			ret = NOTIFY_STOP_MASK;
++			goto unlock;
++		}
++
++		/* Update the div to preserve MCK DIV clock rate. */
++		clk_master_div_set(master_div, new_parent_rate,
++				   new_div);
++
++		ret = NOTIFY_OK;
++		break;
++
++	default:
++		ret = NOTIFY_DONE;
++		break;
++	}
++
++unlock:
++	spin_unlock_irqrestore(master_div->lock, flags);
++
++	return ret;
++}
++
++static struct notifier_block clk_master_div_notifier = {
++	.notifier_call = clk_master_div_notifier_fn,
++};
++
+ static void clk_sama7g5_master_best_diff(struct clk_rate_request *req,
+ 					 struct clk_hw *parent,
+ 					 unsigned long parent_rate,
+@@ -496,6 +578,8 @@ at91_clk_register_master_internal(struct
+ 	struct clk_master *master;
+ 	struct clk_init_data init;
+ 	struct clk_hw *hw;
++	unsigned int mckr;
++	unsigned long irqflags;
+ 	int ret;
+ 
+ 	if (!name || !num_parents || !parent_names || !lock)
+@@ -518,6 +602,16 @@ at91_clk_register_master_internal(struct
+ 	master->chg_pid = chg_pid;
+ 	master->lock = lock;
+ 
++	if (ops == &master_div_ops_chg) {
++		spin_lock_irqsave(master->lock, irqflags);
++		regmap_read(master->regmap, master->layout->offset, &mckr);
++		spin_unlock_irqrestore(master->lock, irqflags);
++
++		mckr &= layout->mask;
++		mckr = (mckr >> MASTER_DIV_SHIFT) & MASTER_DIV_MASK;
++		master->div = characteristics->divisors[mckr];
++	}
++
+ 	hw = &master->hw;
+ 	ret = clk_hw_register(NULL, &master->hw);
+ 	if (ret) {
+@@ -554,19 +648,29 @@ at91_clk_register_master_div(struct regm
+ 		const char *name, const char *parent_name,
+ 		const struct clk_master_layout *layout,
+ 		const struct clk_master_characteristics *characteristics,
+-		spinlock_t *lock, u32 flags)
++		spinlock_t *lock, u32 flags, u32 safe_div)
+ {
+ 	const struct clk_ops *ops;
++	struct clk_hw *hw;
+ 
+ 	if (flags & CLK_SET_RATE_GATE)
+ 		ops = &master_div_ops;
+ 	else
+ 		ops = &master_div_ops_chg;
+ 
+-	return at91_clk_register_master_internal(regmap, name, 1,
+-						 &parent_name, layout,
+-						 characteristics, ops,
+-						 lock, flags, -EINVAL);
++	hw = at91_clk_register_master_internal(regmap, name, 1,
++					       &parent_name, layout,
++					       characteristics, ops,
++					       lock, flags, -EINVAL);
++
++	if (!IS_ERR(hw) && safe_div) {
++		master_div = to_clk_master(hw);
++		master_div->safe_div = safe_div;
++		clk_notifier_register(hw->clk,
++				      &clk_master_div_notifier);
++	}
++
++	return hw;
+ }
+ 
+ static unsigned long
+--- a/drivers/clk/at91/dt-compat.c
++++ b/drivers/clk/at91/dt-compat.c
+@@ -399,7 +399,7 @@ of_at91_clk_master_setup(struct device_n
+ 
+ 	hw = at91_clk_register_master_div(regmap, name, "masterck_pres",
+ 					  layout, characteristics,
+-					  &mck_lock, CLK_SET_RATE_GATE);
++					  &mck_lock, CLK_SET_RATE_GATE, 0);
+ 	if (IS_ERR(hw))
+ 		goto out_free_characteristics;
+ 
+--- a/drivers/clk/at91/pmc.h
++++ b/drivers/clk/at91/pmc.h
+@@ -182,7 +182,7 @@ at91_clk_register_master_div(struct regm
+ 			     const char *parent_names,
+ 			     const struct clk_master_layout *layout,
+ 			     const struct clk_master_characteristics *characteristics,
+-			     spinlock_t *lock, u32 flags);
++			     spinlock_t *lock, u32 flags, u32 safe_div);
+ 
+ struct clk_hw * __init
+ at91_clk_sama7g5_register_master(struct regmap *regmap,
+--- a/drivers/clk/at91/sama5d2.c
++++ b/drivers/clk/at91/sama5d2.c
+@@ -249,7 +249,7 @@ static void __init sama5d2_pmc_setup(str
+ 					  "masterck_pres",
+ 					  &at91sam9x5_master_layout,
+ 					  &mck_characteristics, &mck_lock,
+-					  CLK_SET_RATE_GATE);
++					  CLK_SET_RATE_GATE, 0);
+ 	if (IS_ERR(hw))
+ 		goto err_free;
+ 
+--- a/drivers/clk/at91/sama5d3.c
++++ b/drivers/clk/at91/sama5d3.c
+@@ -184,7 +184,7 @@ static void __init sama5d3_pmc_setup(str
+ 					  "masterck_pres",
+ 					  &at91sam9x5_master_layout,
+ 					  &mck_characteristics, &mck_lock,
+-					  CLK_SET_RATE_GATE);
++					  CLK_SET_RATE_GATE, 0);
+ 	if (IS_ERR(hw))
+ 		goto err_free;
+ 
+--- a/drivers/clk/at91/sama5d4.c
++++ b/drivers/clk/at91/sama5d4.c
+@@ -199,7 +199,7 @@ static void __init sama5d4_pmc_setup(str
+ 					  "masterck_pres",
+ 					  &at91sam9x5_master_layout,
+ 					  &mck_characteristics, &mck_lock,
+-					  CLK_SET_RATE_GATE);
++					  CLK_SET_RATE_GATE, 0);
+ 	if (IS_ERR(hw))
+ 		goto err_free;
+ 
+--- a/drivers/clk/at91/sama7g5.c
++++ b/drivers/clk/at91/sama7g5.c
+@@ -993,7 +993,7 @@ static void __init sama7g5_pmc_setup(str
+ 	parent_names[0] = "cpupll_divpmcck";
+ 	hw = at91_clk_register_master_div(regmap, "mck0", "cpupll_divpmcck",
+ 					  &mck0_layout, &mck0_characteristics,
+-					  &pmc_mck0_lock, 0);
++					  &pmc_mck0_lock, CLK_GET_RATE_NOCACHE, 5);
+ 	if (IS_ERR(hw))
+ 		goto err_free;
+ 
diff --git a/target/linux/at91/patches-5.15/108-clk-at91-sama7g5-set-low-limit-for-mck0-at-32KHz.patch b/target/linux/at91/patches-5.15/108-clk-at91-sama7g5-set-low-limit-for-mck0-at-32KHz.patch
new file mode 100644
index 00000000000000..6cdec0add7821c
--- /dev/null
+++ b/target/linux/at91/patches-5.15/108-clk-at91-sama7g5-set-low-limit-for-mck0-at-32KHz.patch
@@ -0,0 +1,26 @@
+From 9fd5a49f6da9de5da83f4a53eccefad647ab15ed Mon Sep 17 00:00:00 2001
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+Date: Mon, 11 Oct 2021 14:27:18 +0300
+Subject: [PATCH 246/247] clk: at91: sama7g5: set low limit for mck0 at 32KHz
+
+MCK0 could go as low as 32KHz. Set this limit.
+
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20211011112719.3951784-15-claudiu.beznea@microchip.com
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+---
+ drivers/clk/at91/sama7g5.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/at91/sama7g5.c
++++ b/drivers/clk/at91/sama7g5.c
+@@ -849,7 +849,7 @@ static const struct {
+ 
+ /* MCK0 characteristics. */
+ static const struct clk_master_characteristics mck0_characteristics = {
+-	.output = { .min = 50000000, .max = 200000000 },
++	.output = { .min = 32768, .max = 200000000 },
+ 	.divisors = { 1, 2, 4, 3, 5 },
+ 	.have_div3_pres = 1,
+ };
diff --git a/target/linux/at91/patches-5.15/109-clk-use-clk_core_get_rate_recalc-in-clk_rate_get.patch b/target/linux/at91/patches-5.15/109-clk-use-clk_core_get_rate_recalc-in-clk_rate_get.patch
new file mode 100644
index 00000000000000..32e760ac17543d
--- /dev/null
+++ b/target/linux/at91/patches-5.15/109-clk-use-clk_core_get_rate_recalc-in-clk_rate_get.patch
@@ -0,0 +1,32 @@
+From fe07791494a78d5a4be1363385e6ba7940740644 Mon Sep 17 00:00:00 2001
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+Date: Mon, 11 Oct 2021 14:27:19 +0300
+Subject: [PATCH 247/247] clk: use clk_core_get_rate_recalc() in clk_rate_get()
+
+In case clock flags contains CLK_GET_RATE_NOCACHE the clk_rate_get()
+will return the cached rate. Thus, use clk_core_get_rate_recalc() which
+takes proper action when clock flags contains CLK_GET_RATE_NOCACHE.
+
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20211011112719.3951784-16-claudiu.beznea@microchip.com
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+[sboyd@kernel.org: Grab prepare lock around operation]
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+---
+ drivers/clk/clk.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -3131,7 +3131,10 @@ static int clk_rate_get(void *data, u64
+ {
+ 	struct clk_core *core = data;
+ 
+-	*val = core->rate;
++	clk_prepare_lock();
++	*val = clk_core_get_rate_recalc(core);
++	clk_prepare_unlock();
++
+ 	return 0;
+ }
+ 
diff --git a/target/linux/at91/sam9x/config-5.15 b/target/linux/at91/sam9x/config-5.15
new file mode 100644
index 00000000000000..34c6d96b1cef52
--- /dev/null
+++ b/target/linux/at91/sam9x/config-5.15
@@ -0,0 +1,317 @@
+CONFIG_ALIGNMENT_TRAP=y
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_AT91=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+CONFIG_ARCH_MULTIPLATFORM=y
+# CONFIG_ARCH_MULTI_V4 is not set
+CONFIG_ARCH_MULTI_V4T=y
+CONFIG_ARCH_MULTI_V4_V5=y
+CONFIG_ARCH_MULTI_V5=y
+CONFIG_ARCH_NR_GPIO=0
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARM=y
+CONFIG_ARM_CPU_SUSPEND=y
+CONFIG_ARM_CRYPTO=y
+CONFIG_ARM_HAS_SG_CHAIN=y
+CONFIG_ARM_L1_CACHE_SHIFT=5
+CONFIG_ARM_PATCH_PHYS_VIRT=y
+CONFIG_ARM_THUMB=y
+CONFIG_ARM_UNWIND=y
+# CONFIG_AT91RM9200_WATCHDOG is not set
+CONFIG_AT91SAM9X_WATCHDOG=y
+# CONFIG_AT91_ADC is not set
+CONFIG_AT91_SAMA5D2_ADC=y
+CONFIG_AT91_SOC_ID=y
+# CONFIG_AT91_SOC_SFR is not set
+CONFIG_ATMEL_AIC5_IRQ=y
+CONFIG_ATMEL_AIC_IRQ=y
+CONFIG_ATMEL_CLOCKSOURCE_PIT=y
+CONFIG_ATMEL_CLOCKSOURCE_TCB=y
+CONFIG_ATMEL_EBI=y
+CONFIG_ATMEL_PIT=y
+CONFIG_ATMEL_PM=y
+CONFIG_ATMEL_SDRAMC=y
+CONFIG_ATMEL_SSC=y
+CONFIG_ATMEL_ST=y
+CONFIG_ATMEL_TCB_CLKSRC=y
+CONFIG_AT_HDMAC=y
+CONFIG_AT_XDMAC=y
+CONFIG_AUTO_ZRELADDR=y
+CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK=y
+CONFIG_BLK_PM=y
+CONFIG_CLKSRC_MMIO=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMMON_CLK_AT91=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONFIGFS_FS=y
+CONFIG_CPU_32v4T=y
+CONFIG_CPU_32v5=y
+CONFIG_CPU_ABRT_EV4T=y
+CONFIG_CPU_ABRT_EV5TJ=y
+CONFIG_CPU_ARM920T=y
+CONFIG_CPU_ARM926T=y
+# CONFIG_CPU_CACHE_ROUND_ROBIN is not set
+CONFIG_CPU_CACHE_V4WT=y
+CONFIG_CPU_CACHE_VIVT=y
+CONFIG_CPU_COPY_V4WB=y
+CONFIG_CPU_CP15=y
+CONFIG_CPU_CP15_MMU=y
+# CONFIG_CPU_DCACHE_WRITETHROUGH is not set
+CONFIG_CPU_NO_EFFICIENT_FFS=y
+CONFIG_CPU_PABRT_LEGACY=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_THUMB_CAPABLE=y
+CONFIG_CPU_TLB_V4WBI=y
+CONFIG_CPU_USE_DOMAINS=y
+CONFIG_CRC16=y
+CONFIG_CRC7=y
+CONFIG_CRC_CCITT=y
+CONFIG_CRC_ITU_T=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_DEBUG_LL_INCLUDE="mach/debug-macro.S"
+CONFIG_DMADEVICES=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_OPS=y
+CONFIG_DMA_REMAP=y
+CONFIG_DTC=y
+CONFIG_EDAC_ATOMIC_SCRUB=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EEPROM_AT24=y
+CONFIG_EXT4_FS=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FREEZER=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CACHE=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_MULTI_HANDLER=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GLOB=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_ATMEL=y
+CONFIG_HZ=128
+CONFIG_HZ_FIXED=128
+CONFIG_HZ_PERIODIC=y
+CONFIG_I2C=y
+CONFIG_I2C_ALGOBIT=y
+CONFIG_I2C_AT91=y
+# CONFIG_I2C_AT91_SLAVE_EXPERIMENTAL is not set
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_COMPAT=y
+CONFIG_I2C_GPIO=y
+CONFIG_IIO=y
+CONFIG_IIO_BUFFER=y
+CONFIG_IIO_KFIFO_BUF=y
+CONFIG_IIO_TRIGGER=y
+CONFIG_IIO_TRIGGERED_BUFFER=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_INPUT=y
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+CONFIG_JBD2=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PWM=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_GPIO=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MACB=y
+CONFIG_MACB_USE_HWSTAMP=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MEMORY=y
+CONFIG_MFD_AT91_USART=y
+CONFIG_MFD_ATMEL_FLEXCOM=y
+CONFIG_MFD_ATMEL_HLCDC=y
+CONFIG_MFD_ATMEL_SMC=y
+CONFIG_MFD_CORE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MICREL_PHY=y
+CONFIG_MICROCHIP_PIT64B=y
+CONFIG_MIGRATION=y
+CONFIG_MMC=y
+CONFIG_MMC_ATMELMCI=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_OF_AT91=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MTD_CMDLINE_PARTS=y
+CONFIG_MTD_DATAFLASH=y
+# CONFIG_MTD_DATAFLASH_OTP is not set
+# CONFIG_MTD_DATAFLASH_WRITE_VERIFY is not set
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_LIMIT=20
+# CONFIG_MTD_UBI_BLOCK is not set
+CONFIG_MTD_UBI_FASTMAP=y
+CONFIG_MTD_UBI_GLUEBI=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_KUSER_HELPERS=y
+CONFIG_NEED_PER_CPU_KM=y
+CONFIG_NET_PTP_CLASSIFY=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NLS=y
+CONFIG_NVMEM=y
+# CONFIG_NVMEM_MICROCHIP_OTPC is not set
+CONFIG_NVMEM_SYSFS=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_OLD_SIGACTION=y
+CONFIG_OLD_SIGSUSPEND3=y
+CONFIG_PAGE_OFFSET=0xC0000000
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PINCTRL=y
+CONFIG_PINCTRL_AT91=y
+# CONFIG_PINCTRL_AT91PIO4 is not set
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_SLEEP=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_AT91_POWEROFF=y
+CONFIG_POWER_RESET_AT91_RESET=y
+CONFIG_POWER_RESET_AT91_SAMA5D2_SHDWC=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PPS=y
+CONFIG_PTP_1588_CLOCK=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_PWM=y
+CONFIG_PWM_ATMEL=y
+CONFIG_PWM_ATMEL_HLCDC_PWM=y
+CONFIG_PWM_ATMEL_TCB=y
+CONFIG_PWM_SYSFS=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_AT91RM9200=y
+CONFIG_RTC_DRV_AT91SAM9=y
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RTC_MC146818_LIB=y
+CONFIG_SAMA5D4_WATCHDOG=y
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIAL_ATMEL=y
+CONFIG_SERIAL_ATMEL_CONSOLE=y
+CONFIG_SERIAL_ATMEL_PDC=y
+# CONFIG_SERIAL_ATMEL_TTYAT is not set
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SOC_AT91RM9200=y
+CONFIG_SOC_AT91SAM9=y
+CONFIG_SOC_BUS=y
+CONFIG_SOC_SAM9X60=y
+CONFIG_SOC_SAM_V4_V5=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SPI=y
+# CONFIG_SPI_AT91_USART is not set
+CONFIG_SPI_ATMEL=y
+CONFIG_SPI_ATMEL_QUADSPI=y
+CONFIG_SPI_BITBANG=y
+CONFIG_SPI_GPIO=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SPI_SPIDEV=y
+CONFIG_SPLIT_PTLOCK_CPUS=999999
+CONFIG_SRAM=y
+CONFIG_SRAM_EXEC=y
+CONFIG_SRCU=y
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+CONFIG_SWPHY=y
+CONFIG_SYS_SUPPORTS_APM_EMULATION=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TINY_SRCU=y
+CONFIG_UBIFS_FS=y
+CONFIG_UBIFS_FS_ADVANCED_COMPR=y
+CONFIG_UNCOMPRESS_INCLUDE="debug/uncompress.h"
+CONFIG_UNWINDER_ARM=y
+CONFIG_USB=y
+CONFIG_USB_ACM=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+# CONFIG_USB_AT91 is not set
+# CONFIG_USB_ATMEL_USBA is not set
+CONFIG_USB_COMMON=y
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_HCD_AT91=y
+# CONFIG_USB_EHCI_HCD_PLATFORM is not set
+CONFIG_USB_GADGET=y
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_HCD_AT91=y
+CONFIG_USB_OHCI_HCD_PLATFORM=y
+CONFIG_USB_SERIAL=y
+# CONFIG_USB_SERIAL_CONSOLE is not set
+CONFIG_USB_SERIAL_FTDI_SIO=y
+CONFIG_USB_SERIAL_PL2303=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_OF=y
+# CONFIG_VFP is not set
+CONFIG_WATCHDOG_CORE=y
+CONFIG_XXHASH=y
+CONFIG_ZBOOT_ROM_BSS=0x0
+CONFIG_ZBOOT_ROM_TEXT=0x0
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/at91/sama5/config-5.15 b/target/linux/at91/sama5/config-5.15
new file mode 100644
index 00000000000000..3e51deb98effcf
--- /dev/null
+++ b/target/linux/at91/sama5/config-5.15
@@ -0,0 +1,492 @@
+CONFIG_ALIGNMENT_TRAP=y
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_AT91=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+CONFIG_ARCH_MULTIPLATFORM=y
+CONFIG_ARCH_MULTI_V6_V7=y
+CONFIG_ARCH_MULTI_V7=y
+CONFIG_ARCH_NR_GPIO=0
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX=y
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARM=y
+CONFIG_ARM_AT91_CPUIDLE=y
+CONFIG_ARM_CPU_SUSPEND=y
+CONFIG_ARM_CRYPTO=y
+CONFIG_ARM_HAS_SG_CHAIN=y
+CONFIG_ARM_HEAVY_MB=y
+CONFIG_ARM_L1_CACHE_SHIFT=6
+CONFIG_ARM_L1_CACHE_SHIFT_6=y
+CONFIG_ARM_PATCH_IDIV=y
+CONFIG_ARM_PATCH_PHYS_VIRT=y
+CONFIG_ARM_THUMB=y
+CONFIG_ARM_UNWIND=y
+CONFIG_ARM_VIRT_EXT=y
+CONFIG_AT91SAM9X_WATCHDOG=y
+CONFIG_AT91_ADC=y
+CONFIG_AT91_SAMA5D2_ADC=y
+CONFIG_AT91_SOC_ID=y
+# CONFIG_AT91_SOC_SFR is not set
+CONFIG_ATMEL_AIC5_IRQ=y
+# CONFIG_ATMEL_CLOCKSOURCE_PIT is not set
+CONFIG_ATMEL_CLOCKSOURCE_TCB=y
+CONFIG_ATMEL_EBI=y
+CONFIG_ATMEL_PM=y
+CONFIG_ATMEL_SDRAMC=y
+CONFIG_ATMEL_SSC=y
+CONFIG_ATMEL_TCB_CLKSRC=y
+CONFIG_AT_HDMAC=y
+CONFIG_AT_XDMAC=y
+CONFIG_AUTO_ZRELADDR=y
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+CONFIG_BACKLIGHT_PWM=y
+CONFIG_BATTERY_ACT8945A=y
+CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=4
+CONFIG_BLK_DEV_RAM_SIZE=8192
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_PM=y
+CONFIG_CACHE_L2X0=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CMA=y
+CONFIG_CMA_ALIGNMENT=8
+CONFIG_CMA_AREAS=7
+# CONFIG_CMA_DEBUG is not set
+# CONFIG_CMA_DEBUGFS is not set
+CONFIG_CMA_SIZE_MBYTES=16
+# CONFIG_CMA_SIZE_SEL_MAX is not set
+CONFIG_CMA_SIZE_SEL_MBYTES=y
+# CONFIG_CMA_SIZE_SEL_MIN is not set
+# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
+# CONFIG_CMA_SYSFS is not set
+CONFIG_CMDLINE="console=ttyS0,115200 initrd=0x21100000,25165824 root=/dev/ram0 rw"
+CONFIG_CMDLINE_FROM_BOOTLOADER=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMMON_CLK_AT91=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONFIGFS_FS=y
+CONFIG_CONTIG_ALLOC=y
+CONFIG_COREDUMP=y
+CONFIG_CPU_32v6K=y
+CONFIG_CPU_32v7=y
+CONFIG_CPU_ABRT_EV7=y
+CONFIG_CPU_CACHE_V7=y
+CONFIG_CPU_CACHE_VIPT=y
+CONFIG_CPU_COPY_V6=y
+CONFIG_CPU_CP15=y
+CONFIG_CPU_CP15_MMU=y
+CONFIG_CPU_HAS_ASID=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_PABRT_V7=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_SPECTRE=y
+CONFIG_CPU_THUMB_CAPABLE=y
+CONFIG_CPU_TLB_V7=y
+CONFIG_CPU_V7=y
+CONFIG_CRASH_CORE=y
+CONFIG_CRASH_DUMP=y
+CONFIG_CRC16=y
+# CONFIG_CRC32_SARWATE is not set
+CONFIG_CRC32_SLICEBY8=y
+CONFIG_CROSS_MEMORY_ATTACH=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_DRBG=y
+CONFIG_CRYPTO_DRBG_HMAC=y
+CONFIG_CRYPTO_DRBG_MENU=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_JITTERENTROPY=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_RNG_DEFAULT=y
+CONFIG_CRYPTO_SEQIV=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DEBUG_LL_INCLUDE="mach/debug-macro.S"
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_DEBUG_USER=y
+CONFIG_DMADEVICES=y
+CONFIG_DMA_CMA=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_OPS=y
+CONFIG_DMA_REMAP=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DNOTIFY=y
+CONFIG_DRM=y
+CONFIG_DRM_ATMEL_HLCDC=y
+CONFIG_DRM_BRIDGE=y
+CONFIG_DRM_DP_AUX_BUS=y
+CONFIG_DRM_FBDEV_EMULATION=y
+CONFIG_DRM_FBDEV_OVERALLOC=100
+CONFIG_DRM_GEM_CMA_HELPER=y
+CONFIG_DRM_KMS_CMA_HELPER=y
+CONFIG_DRM_KMS_HELPER=y
+CONFIG_DRM_PANEL=y
+CONFIG_DRM_PANEL_BRIDGE=y
+CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y
+CONFIG_DRM_PANEL_SIMPLE=y
+CONFIG_DTC=y
+CONFIG_DVB_CORE=y
+CONFIG_EDAC_ATOMIC_SCRUB=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EEPROM_AT24=y
+CONFIG_ELF_CORE=y
+CONFIG_EXT4_FS=y
+CONFIG_FAT_FS=y
+CONFIG_FB=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+CONFIG_FB_CMDLINE=y
+CONFIG_FB_DEFERRED_IO=y
+CONFIG_FB_SYS_COPYAREA=y
+CONFIG_FB_SYS_FILLRECT=y
+CONFIG_FB_SYS_FOPS=y
+CONFIG_FB_SYS_IMAGEBLIT=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FORCE_MAX_ZONEORDER=15
+CONFIG_FREEZER=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CACHE=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_MULTI_HANDLER=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GENERIC_VDSO_32=y
+CONFIG_GLOB=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDEN_BRANCH_PREDICTOR=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HAVE_SMP=y
+CONFIG_HDMI=y
+CONFIG_HID=y
+CONFIG_HID_GENERIC=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_ATMEL=y
+CONFIG_HZ_FIXED=0
+CONFIG_I2C=y
+CONFIG_I2C_ALGOBIT=y
+CONFIG_I2C_AT91=y
+# CONFIG_I2C_AT91_SLAVE_EXPERIMENTAL is not set
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_COMPAT=y
+CONFIG_I2C_GPIO=y
+CONFIG_I2C_HELPER_AUTO=y
+CONFIG_IIO=y
+CONFIG_IIO_BUFFER=y
+CONFIG_IIO_KFIFO_BUF=y
+CONFIG_IIO_TRIGGER=y
+CONFIG_IIO_TRIGGERED_BUFFER=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_INPUT=y
+CONFIG_INPUT_EVDEV=y
+CONFIG_INPUT_KEYBOARD=y
+CONFIG_INPUT_LEDS=y
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+CONFIG_JBD2=y
+# CONFIG_JFFS2_FS is not set
+CONFIG_KCMP=y
+CONFIG_KERNEL_GZIP=y
+# CONFIG_KERNEL_XZ is not set
+CONFIG_KEXEC=y
+CONFIG_KEXEC_CORE=y
+CONFIG_KEYBOARD_GPIO=y
+CONFIG_KEYBOARD_QT1070=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PWM=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_GPIO=y
+CONFIG_LIBFDT=y
+CONFIG_LOCALVERSION_AUTO=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOG_BUF_SHIFT=16
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MACB=y
+CONFIG_MACB_USE_HWSTAMP=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEDIA_ANALOG_TV_SUPPORT=y
+CONFIG_MEDIA_ATTACH=y
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_MEDIA_DIGITAL_TV_SUPPORT=y
+CONFIG_MEDIA_PLATFORM_SUPPORT=y
+CONFIG_MEDIA_RADIO_SUPPORT=y
+CONFIG_MEDIA_SDR_SUPPORT=y
+CONFIG_MEDIA_SUPPORT=y
+CONFIG_MEDIA_TEST_SUPPORT=y
+CONFIG_MEDIA_TUNER=y
+CONFIG_MEDIA_USB_SUPPORT=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MEMORY=y
+CONFIG_MEMORY_ISOLATION=y
+CONFIG_MFD_ACT8945A=y
+CONFIG_MFD_AT91_USART=y
+CONFIG_MFD_ATMEL_FLEXCOM=y
+CONFIG_MFD_ATMEL_HLCDC=y
+CONFIG_MFD_ATMEL_SMC=y
+CONFIG_MFD_CORE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MICREL_PHY=y
+CONFIG_MIGHT_HAVE_CACHE_L2X0=y
+CONFIG_MIGRATION=y
+CONFIG_MMC=y
+CONFIG_MMC_ATMELMCI=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_OF_AT91=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MODULES_USE_ELF_REL=y
+# CONFIG_MTD_CFI_AMDSTD is not set
+# CONFIG_MTD_CFI_INTELEXT is not set
+CONFIG_MTD_CMDLINE_PARTS=y
+# CONFIG_MTD_COMPLEX_MAPPINGS is not set
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_LIMIT=20
+# CONFIG_MTD_UBI_BLOCK is not set
+CONFIG_MTD_UBI_FASTMAP=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_PER_CPU_KM=y
+# CONFIG_NEON is not set
+CONFIG_NET_PTP_CLASSIFY=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NLS=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_CODEPAGE_850=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_UTF8=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NVMEM=y
+# CONFIG_NVMEM_MICROCHIP_OTPC is not set
+CONFIG_NVMEM_SYSFS=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_OLD_SIGACTION=y
+CONFIG_OLD_SIGSUSPEND3=y
+CONFIG_OUTER_CACHE=y
+CONFIG_OUTER_CACHE_SYNC=y
+CONFIG_PAGE_OFFSET=0xC0000000
+# CONFIG_PARTITION_ADVANCED is not set
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PINCTRL=y
+CONFIG_PINCTRL_AT91=y
+CONFIG_PINCTRL_AT91PIO4=y
+# CONFIG_PINCTRL_SINGLE is not set
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_SLEEP=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_AT91_POWEROFF=y
+CONFIG_POWER_RESET_AT91_RESET=y
+CONFIG_POWER_RESET_AT91_SAMA5D2_SHDWC=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PPS=y
+# CONFIG_PREVENT_FIRMWARE_BUILD is not set
+CONFIG_PRINTK_TIME=y
+CONFIG_PROC_VMCORE=y
+CONFIG_PTP_1588_CLOCK=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_PWM=y
+CONFIG_PWM_ATMEL=y
+CONFIG_PWM_ATMEL_HLCDC_PWM=y
+CONFIG_PWM_ATMEL_TCB=y
+CONFIG_PWM_SYSFS=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGMAP_SPI=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_ACT8865=y
+CONFIG_REGULATOR_ACT8945A=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_AT91RM9200=y
+# CONFIG_RTC_DRV_AT91SAM9 is not set
+# CONFIG_RTC_DRV_CMOS is not set
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_SAMA5D4_WATCHDOG=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+# CONFIG_SCSI_LOWLEVEL is not set
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIAL_ATMEL=y
+CONFIG_SERIAL_ATMEL_CONSOLE=y
+CONFIG_SERIAL_ATMEL_PDC=y
+# CONFIG_SERIAL_ATMEL_TTYAT is not set
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SG_POOL=y
+CONFIG_SND=y
+CONFIG_SND_ARM=y
+# CONFIG_SND_AT73C213 is not set
+# CONFIG_SND_AT91_SOC_SAM9G20_WM8731 is not set
+# CONFIG_SND_AT91_SOC_SAM9X5_WM8731 is not set
+CONFIG_SND_ATMEL_SOC=y
+CONFIG_SND_ATMEL_SOC_CLASSD=y
+CONFIG_SND_ATMEL_SOC_DMA=y
+CONFIG_SND_ATMEL_SOC_I2S=y
+CONFIG_SND_ATMEL_SOC_PDC=y
+# CONFIG_SND_ATMEL_SOC_PDMIC is not set
+CONFIG_SND_ATMEL_SOC_SSC=y
+CONFIG_SND_ATMEL_SOC_SSC_DMA=y
+# CONFIG_SND_ATMEL_SOC_SSC_PDC is not set
+# CONFIG_SND_ATMEL_SOC_TSE850_PCM5142 is not set
+CONFIG_SND_ATMEL_SOC_WM8904=y
+# CONFIG_SND_COMPRESS_OFFLOAD is not set
+CONFIG_SND_DMAENGINE_PCM=y
+CONFIG_SND_JACK=y
+CONFIG_SND_JACK_INPUT_DEV=y
+# CONFIG_SND_MCHP_SOC_I2S_MCC is not set
+# CONFIG_SND_MCHP_SOC_SPDIFRX is not set
+# CONFIG_SND_MCHP_SOC_SPDIFTX is not set
+CONFIG_SND_PCM=y
+CONFIG_SND_PCM_TIMER=y
+CONFIG_SND_SOC=y
+CONFIG_SND_SOC_GENERIC_DMAENGINE_PCM=y
+CONFIG_SND_SOC_I2C_AND_SPI=y
+CONFIG_SND_SOC_MIKROE_PROTO=y
+CONFIG_SND_SOC_WM8731=y
+CONFIG_SND_SOC_WM8904=y
+CONFIG_SND_SPI=y
+CONFIG_SND_SUPPORT_OLD_API=y
+CONFIG_SND_TIMER=y
+CONFIG_SOC_BUS=y
+CONFIG_SOC_SAMA5=y
+CONFIG_SOC_SAMA5D2=y
+CONFIG_SOC_SAMA5D3=y
+CONFIG_SOC_SAMA5D4=y
+# CONFIG_SOC_SAMA7G5 is not set
+CONFIG_SOC_SAM_V7=y
+CONFIG_SOUND=y
+CONFIG_SOUND_OSS_CORE=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SPI=y
+# CONFIG_SPI_AT91_USART is not set
+CONFIG_SPI_ATMEL=y
+CONFIG_SPI_ATMEL_QUADSPI=y
+CONFIG_SPI_BITBANG=y
+CONFIG_SPI_GPIO=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+# CONFIG_SQUASHFS is not set
+CONFIG_SRAM=y
+CONFIG_SRAM_EXEC=y
+CONFIG_SRCU=y
+# CONFIG_STANDALONE is not set
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+CONFIG_SWPHY=y
+# CONFIG_SWP_EMULATE is not set
+CONFIG_SYNC_FILE=y
+CONFIG_SYS_SUPPORTS_APM_EMULATION=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TINY_SRCU=y
+CONFIG_TOUCHSCREEN_ATMEL_MXT=y
+CONFIG_UACCESS_WITH_MEMCPY=y
+CONFIG_UBIFS_FS=y
+CONFIG_UNCOMPRESS_INCLUDE="debug/uncompress.h"
+CONFIG_UNWINDER_ARM=y
+CONFIG_USB=y
+CONFIG_USB_ACM=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+# CONFIG_USB_AT91 is not set
+# CONFIG_USB_ATMEL_USBA is not set
+CONFIG_USB_COMMON=y
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_HCD_AT91=y
+# CONFIG_USB_EHCI_HCD_PLATFORM is not set
+# CONFIG_USB_EHCI_ROOT_HUB_TT is not set
+CONFIG_USB_GADGET=y
+CONFIG_USB_HID=y
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_HCD_AT91=y
+CONFIG_USB_OHCI_HCD_PLATFORM=y
+# CONFIG_USB_PWC is not set
+CONFIG_USB_SERIAL=y
+# CONFIG_USB_SERIAL_CONSOLE is not set
+CONFIG_USB_SERIAL_FTDI_SIO=y
+CONFIG_USB_SERIAL_PL2303=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_OF=y
+CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_VFAT_FS=y
+CONFIG_VFP=y
+CONFIG_VFPv3=y
+CONFIG_VIDEOMODE_HELPERS=y
+# CONFIG_VIDEO_CPIA2 is not set
+CONFIG_VIDEO_DEV=y
+CONFIG_VIDEO_V4L2=y
+CONFIG_VIDEO_V4L2_I2C=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_WATCHDOG_CORE=y
+# CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set
+CONFIG_XXHASH=y
+CONFIG_ZBOOT_ROM_BSS=0x0
+CONFIG_ZBOOT_ROM_TEXT=0x0
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/at91/sama7/config-5.15 b/target/linux/at91/sama7/config-5.15
new file mode 100644
index 00000000000000..150059bf503f6e
--- /dev/null
+++ b/target/linux/at91/sama7/config-5.15
@@ -0,0 +1,405 @@
+CONFIG_ALIGNMENT_TRAP=y
+# CONFIG_ALLOW_DEV_COREDUMP is not set
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_AT91=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+CONFIG_ARCH_MULTIPLATFORM=y
+CONFIG_ARCH_MULTI_V6_V7=y
+CONFIG_ARCH_MULTI_V7=y
+CONFIG_ARCH_NR_GPIO=0
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX=y
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARM=y
+CONFIG_ARM_CRYPTO=y
+CONFIG_ARM_GIC=y
+CONFIG_ARM_HAS_SG_CHAIN=y
+CONFIG_ARM_L1_CACHE_SHIFT=6
+CONFIG_ARM_L1_CACHE_SHIFT_6=y
+# CONFIG_ARM_PATCH_IDIV is not set
+CONFIG_ARM_PATCH_PHYS_VIRT=y
+CONFIG_ARM_THUMB=y
+CONFIG_ARM_UNWIND=y
+CONFIG_ARM_VIRT_EXT=y
+# CONFIG_AT91SAM9X_WATCHDOG is not set
+# CONFIG_AT91_ADC is not set
+CONFIG_AT91_SAMA5D2_ADC=y
+CONFIG_AT91_SOC_ID=y
+# CONFIG_AT91_SOC_SFR is not set
+CONFIG_ATMEL_CLOCKSOURCE_TCB=y
+# CONFIG_ATMEL_EBI is not set
+CONFIG_ATMEL_SDRAMC=y
+CONFIG_ATMEL_TCB_CLKSRC=y
+# CONFIG_AT_HDMAC is not set
+CONFIG_AT_XDMAC=y
+CONFIG_AUTO_ZRELADDR=y
+CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=1
+CONFIG_BLK_DEV_RAM_SIZE=8192
+CONFIG_BLK_DEV_SD=y
+# CONFIG_CACHE_L2X0 is not set
+CONFIG_CAN=y
+CONFIG_CLKSRC_MMIO=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CMA=y
+CONFIG_CMA_ALIGNMENT=9
+CONFIG_CMA_AREAS=7
+# CONFIG_CMA_DEBUG is not set
+# CONFIG_CMA_DEBUGFS is not set
+CONFIG_CMA_SIZE_MBYTES=256
+# CONFIG_CMA_SIZE_SEL_MAX is not set
+CONFIG_CMA_SIZE_SEL_MBYTES=y
+# CONFIG_CMA_SIZE_SEL_MIN is not set
+# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
+# CONFIG_CMA_SYSFS is not set
+CONFIG_CMDLINE="console=ttyS0,115200 earlyprintk nocache ignore_loglevel"
+CONFIG_CMDLINE_FROM_BOOTLOADER=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMMON_CLK_AT91=y
+# CONFIG_COMPACTION is not set
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONFIGFS_FS=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CONTIG_ALLOC=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+CONFIG_CPU_32v6K=y
+CONFIG_CPU_32v7=y
+CONFIG_CPU_ABRT_EV7=y
+CONFIG_CPU_CACHE_V7=y
+CONFIG_CPU_CACHE_VIPT=y
+CONFIG_CPU_COPY_V6=y
+CONFIG_CPU_CP15=y
+CONFIG_CPU_CP15_MMU=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_HAS_ASID=y
+CONFIG_CPU_PABRT_V7=y
+CONFIG_CPU_SPECTRE=y
+# CONFIG_CPU_SW_DOMAIN_PAN is not set
+CONFIG_CPU_THUMB_CAPABLE=y
+CONFIG_CPU_TLB_V7=y
+CONFIG_CPU_V7=y
+CONFIG_CRC16=y
+CONFIG_CRC_CCITT=y
+CONFIG_CRC_ITU_T=y
+CONFIG_CRYPTO_CMAC=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_DRBG=y
+CONFIG_CRYPTO_DRBG_HMAC=y
+CONFIG_CRYPTO_DRBG_MENU=y
+CONFIG_CRYPTO_ECB=y
+CONFIG_CRYPTO_ECC=y
+CONFIG_CRYPTO_ECDH=y
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_JITTERENTROPY=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_RNG_DEFAULT=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DEBUG_AT91_SAMA7G5_FLEXCOM3=y
+CONFIG_DEBUG_AT91_UART=y
+CONFIG_DEBUG_LL=y
+CONFIG_DEBUG_LL_INCLUDE="debug/at91.S"
+CONFIG_DEBUG_UART_PHYS=0xe1824200
+CONFIG_DEBUG_UART_VIRT=0xe0824200
+# CONFIG_DEBUG_UNCOMPRESS is not set
+CONFIG_DEBUG_USER=y
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_DMADEVICES=y
+CONFIG_DMATEST=y
+CONFIG_DMA_CMA=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_ENGINE_RAID=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_OPS=y
+CONFIG_DMA_REMAP=y
+CONFIG_DTC=y
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_EARLY_PRINTK=y
+CONFIG_EDAC_ATOMIC_SCRUB=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EEPROM_AT24=y
+# CONFIG_EFI_PARTITION is not set
+CONFIG_EXT4_FS=y
+CONFIG_FANOTIFY=y
+CONFIG_FAT_FS=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FORCE_MAX_ZONEORDER=15
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_MULTI_HANDLER=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GENERIC_VDSO_32=y
+CONFIG_GLOB=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_GRACE_PERIOD=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDEN_BRANCH_PREDICTOR=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HAVE_SMP=y
+CONFIG_HW_CONSOLE=y
+CONFIG_HW_RANDOM=y
+CONFIG_HZ_FIXED=0
+CONFIG_I2C=y
+CONFIG_I2C_AT91=y
+# CONFIG_I2C_AT91_SLAVE_EXPERIMENTAL is not set
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_IIO=y
+CONFIG_IIO_BUFFER=y
+CONFIG_IIO_CONFIGFS=y
+# CONFIG_IIO_HRTIMER_TRIGGER is not set
+CONFIG_IIO_KFIFO_BUF=y
+CONFIG_IIO_SW_TRIGGER=y
+# CONFIG_IIO_TIGHTLOOP_TRIGGER is not set
+CONFIG_IIO_TRIGGER=y
+CONFIG_IIO_TRIGGERED_BUFFER=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_INPUT=y
+CONFIG_IP_PNP=y
+# CONFIG_IP_PNP_BOOTP is not set
+CONFIG_IP_PNP_DHCP=y
+# CONFIG_IP_PNP_RARP is not set
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+CONFIG_JBD2=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LIBFDT=y
+CONFIG_LOCKD=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOG_BUF_SHIFT=16
+CONFIG_LSM="N"
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MACB=y
+CONFIG_MACB_USE_HWSTAMP=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_MEDIA_CONTROLLER=y
+CONFIG_MEDIA_PLATFORM_SUPPORT=y
+CONFIG_MEDIA_SUPPORT=y
+CONFIG_MEDIA_SUPPORT_FILTER=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MEMORY=y
+CONFIG_MEMORY_ISOLATION=y
+CONFIG_MESSAGE_LOGLEVEL_DEFAULT=7
+CONFIG_MFD_AT91_USART=y
+CONFIG_MFD_ATMEL_FLEXCOM=y
+CONFIG_MFD_CORE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MICREL_PHY=y
+CONFIG_MICROCHIP_PIT64B=y
+CONFIG_MIGHT_HAVE_CACHE_L2X0=y
+CONFIG_MIGRATION=y
+CONFIG_MMC=y
+# CONFIG_MMC_ATMELMCI is not set
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_OF_AT91=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MODULE_FORCE_LOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+CONFIG_MTD_CMDLINE_PARTS=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_PER_CPU_KM=y
+CONFIG_NEON=y
+CONFIG_NET_PTP_CLASSIFY=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NFS_FS=y
+CONFIG_NLS=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_CODEPAGE_850=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_UTF8=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NVMEM=y
+# CONFIG_NVMEM_MICROCHIP_OTPC is not set
+CONFIG_NVMEM_SYSFS=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_OLD_SIGACTION=y
+CONFIG_OLD_SIGSUSPEND3=y
+CONFIG_PAGE_OFFSET=0xC0000000
+CONFIG_PCCARD=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PINCTRL=y
+CONFIG_PINCTRL_AT91=y
+CONFIG_PINCTRL_AT91PIO4=y
+CONFIG_PM_OPP=y
+CONFIG_POWER_RESET=y
+# CONFIG_POWER_RESET_AT91_POWEROFF is not set
+CONFIG_POWER_RESET_AT91_RESET=y
+CONFIG_POWER_RESET_AT91_SAMA5D2_SHDWC=y
+CONFIG_PPS=y
+# CONFIG_PREVENT_FIRMWARE_BUILD is not set
+CONFIG_PRINTK_TIME=y
+CONFIG_PTP_1588_CLOCK=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_PWM=y
+CONFIG_PWM_ATMEL=y
+CONFIG_PWM_SYSFS=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGMAP_SPI=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_MCP16502=y
+CONFIG_ROOT_NFS=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_AT91RM9200=y
+CONFIG_RTC_DRV_AT91SAM9=y
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RTC_MC146818_LIB=y
+# CONFIG_RUNTIME_TESTING_MENU is not set
+CONFIG_SAMA5D4_WATCHDOG=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIAL_ATMEL=y
+CONFIG_SERIAL_ATMEL_CONSOLE=y
+CONFIG_SERIAL_ATMEL_PDC=y
+# CONFIG_SERIAL_ATMEL_TTYAT is not set
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SG_POOL=y
+CONFIG_SND=y
+CONFIG_SND_ATMEL_SOC=y
+# CONFIG_SND_ATMEL_SOC_CLASSD is not set
+# CONFIG_SND_ATMEL_SOC_I2S is not set
+# CONFIG_SND_ATMEL_SOC_PDMIC is not set
+# CONFIG_SND_COMPRESS_OFFLOAD is not set
+CONFIG_SND_DMAENGINE_PCM=y
+CONFIG_SND_JACK=y
+CONFIG_SND_JACK_INPUT_DEV=y
+CONFIG_SND_MCHP_SOC_I2S_MCC=y
+CONFIG_SND_MCHP_SOC_SPDIFRX=y
+CONFIG_SND_MCHP_SOC_SPDIFTX=y
+CONFIG_SND_PCM=y
+CONFIG_SND_SIMPLE_CARD=y
+CONFIG_SND_SIMPLE_CARD_UTILS=y
+CONFIG_SND_SOC=y
+CONFIG_SND_SOC_GENERIC_DMAENGINE_PCM=y
+CONFIG_SND_SOC_I2C_AND_SPI=y
+# CONFIG_SND_SOC_MIKROE_PROTO is not set
+CONFIG_SND_SOC_PCM5102A=y
+CONFIG_SND_SOC_SPDIF=y
+CONFIG_SOC_BUS=y
+# CONFIG_SOC_SAMA5D2 is not set
+# CONFIG_SOC_SAMA5D3 is not set
+# CONFIG_SOC_SAMA5D4 is not set
+CONFIG_SOC_SAMA7=y
+CONFIG_SOC_SAMA7G5=y
+CONFIG_SOC_SAM_V7=y
+CONFIG_SOUND=y
+CONFIG_SOUND_OSS_CORE=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SPI=y
+# CONFIG_SPI_AT91_USART is not set
+CONFIG_SPI_ATMEL=y
+# CONFIG_SPI_ATMEL_QUADSPI is not set
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRCU=y
+CONFIG_STACKTRACE=y
+# CONFIG_STANDALONE is not set
+CONFIG_SUNRPC=y
+# CONFIG_SWAP is not set
+CONFIG_SWPHY=y
+# CONFIG_SWP_EMULATE is not set
+CONFIG_SYSFS_DEPRECATED=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_SYS_SUPPORTS_APM_EMULATION=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TINY_SRCU=y
+CONFIG_UACCESS_WITH_MEMCPY=y
+CONFIG_UNCOMPRESS_INCLUDE="debug/uncompress.h"
+CONFIG_UNWINDER_ARM=y
+CONFIG_USE_OF=y
+CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_VFAT_FS=y
+CONFIG_VFP=y
+CONFIG_VFPv3=y
+# CONFIG_VIDEO_ATMEL_XISC is not set
+CONFIG_VIDEO_DEV=y
+CONFIG_VIDEO_V4L2=y
+CONFIG_VIDEO_V4L2_I2C=y
+CONFIG_VIDEO_V4L2_SUBDEV_API=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+# CONFIG_VT_HW_CONSOLE_BINDING is not set
+CONFIG_WATCHDOG_CORE=y
+CONFIG_ZBOOT_ROM_BSS=0x0
+CONFIG_ZBOOT_ROM_TEXT=0x0
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
diff --git a/target/linux/ath25/Makefile b/target/linux/ath25/Makefile
index ebbc9141d9fd31..84d22ca361f19a 100644
--- a/target/linux/ath25/Makefile
+++ b/target/linux/ath25/Makefile
@@ -7,10 +7,10 @@ include $(TOPDIR)/rules.mk
 ARCH:=mips
 BOARD:=ath25
 BOARDNAME:=Atheros AR231x/AR5312
-FEATURES:=squashfs low_mem small_flash
+FEATURES:=squashfs low_mem small_flash source-only
+SUBTARGETS:=generic
 
-KERNEL_PATCHVER:=5.10
-KERNEL_TESTING_PATCHVER:=5.10
+KERNEL_PATCHVER:=5.15
 
 define Target/Description
 	Build firmware images for Atheros SoC boards
@@ -18,6 +18,6 @@ endef
 
 include $(INCLUDE_DIR)/target.mk
 
-DEFAULT_PACKAGES += wpad-basic-wolfssl kmod-ath5k swconfig kmod-gpio-button-hotplug
+DEFAULT_PACKAGES += wpad-basic-mbedtls kmod-ath5k swconfig kmod-gpio-button-hotplug
 
 $(eval $(call BuildTarget))
diff --git a/target/linux/ath25/config-5.15 b/target/linux/ath25/config-5.15
new file mode 100644
index 00000000000000..a27ad4980fa002
--- /dev/null
+++ b/target/linux/ath25/config-5.15
@@ -0,0 +1,132 @@
+CONFIG_ADM6996_PHY=y
+CONFIG_AR2315_WDT=y
+CONFIG_AR8216_PHY=y
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ATH25=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_CEVT_R4K=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CMDLINE="console=ttyS0,9600 rootfstype=squashfs,jffs2"
+CONFIG_CMDLINE_BOOL=y
+# CONFIG_CMDLINE_OVERRIDE is not set
+# CONFIG_COMMON_CLK is not set
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_MIPS32=y
+CONFIG_CPU_MIPS32_R1=y
+CONFIG_CPU_MIPSR1=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CSRC_R4K=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_EARLY_PRINTK=y
+CONFIG_ETHERNET_PACKET_MANGLE=y
+CONFIG_FORCE_PCI=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GPIO_AR2315=y
+CONFIG_GPIO_AR5312=y
+CONFIG_GPIO_CDEV=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDWARE_WATCHPOINTS=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HW_RANDOM=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IP17XX_PHY=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+CONFIG_MIPS_CLOCK_VSYSCALL=y
+# CONFIG_MIPS_CMDLINE_BUILTIN_EXTEND is not set
+CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER=y
+CONFIG_MIPS_EBPF_JIT=y
+CONFIG_MIPS_L1_CACHE_SHIFT=5
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MTD_AR2315=y
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+# CONFIG_MTD_CFI_GEOMETRY is not set
+# CONFIG_MTD_CFI_INTELEXT is not set
+CONFIG_MTD_MYLOADER_PARTS=y
+CONFIG_MTD_PHYSMAP=y
+CONFIG_MTD_REDBOOT_DIRECTORY_BLOCK=-3
+CONFIG_MTD_REDBOOT_PARTS=y
+CONFIG_MVSWITCH_PHY=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_PER_CPU_KM=y
+CONFIG_NET_AR231X=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+# CONFIG_OF is not set
+CONFIG_PCI=y
+CONFIG_PCI_AR2315=y
+CONFIG_PCI_DISABLE_COMMON_QUIRKS=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DRIVERS_LEGACY=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_SERIAL_8250_NR_UARTS=1
+CONFIG_SERIAL_8250_RUNTIME_UARTS=1
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SOC_AR2315=y
+CONFIG_SOC_AR5312=y
+CONFIG_SRCU=y
+# CONFIG_SWAP is not set
+CONFIG_SWCONFIG=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYS_HAS_CPU_MIPS32_R1=y
+CONFIG_SYS_HAS_EARLY_PRINTK=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+CONFIG_TARGET_ISA_REV=1
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TINY_SRCU=y
+CONFIG_USB_SUPPORT=y
diff --git a/target/linux/ath25/files/drivers/net/phy/mvswitch.c b/target/linux/ath25/files/drivers/net/phy/mvswitch.c
index e3550d55baf883..285d306ef09d08 100644
--- a/target/linux/ath25/files/drivers/net/phy/mvswitch.c
+++ b/target/linux/ath25/files/drivers/net/phy/mvswitch.c
@@ -312,10 +312,10 @@ mvswitch_config_init(struct phy_device *pdev)
 	priv->orig_features = dev->features;
 
 #ifdef HEADER_MODE
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,15,0)
-	dev->extra_priv_flags |= IFF_NO_IP_ALIGN;
-#else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6,1,0)
 	dev->priv_flags |= IFF_NO_IP_ALIGN;
+#else
+	dev->extra_priv_flags |= IFF_NO_IP_ALIGN;
 #endif
 	dev->features |= NETIF_F_HW_VLAN_CTAG_RX | NETIF_F_HW_VLAN_CTAG_TX;
 #else
@@ -376,10 +376,10 @@ mvswitch_detach(struct phy_device *pdev)
 	dev->eth_mangle_rx = NULL;
 	dev->eth_mangle_tx = NULL;
 	dev->features = priv->orig_features;
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,15,0)
-	dev->extra_priv_flags &= ~IFF_NO_IP_ALIGN;
-#else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6,1,0)
 	dev->priv_flags &= ~IFF_NO_IP_ALIGN;
+#else
+	dev->extra_priv_flags &= ~IFF_NO_IP_ALIGN;
 #endif
 }
 
diff --git a/target/linux/ath25/generic/target.mk b/target/linux/ath25/generic/target.mk
new file mode 100644
index 00000000000000..f5cb1fb19b943f
--- /dev/null
+++ b/target/linux/ath25/generic/target.mk
@@ -0,0 +1 @@
+BOARDNAME:=Generic
diff --git a/target/linux/ath25/patches-5.15/107-ar5312_gpio.patch b/target/linux/ath25/patches-5.15/107-ar5312_gpio.patch
new file mode 100644
index 00000000000000..4ad1d40facd2fb
--- /dev/null
+++ b/target/linux/ath25/patches-5.15/107-ar5312_gpio.patch
@@ -0,0 +1,212 @@
+--- a/arch/mips/ath25/Kconfig
++++ b/arch/mips/ath25/Kconfig
+@@ -2,6 +2,7 @@
+ config SOC_AR5312
+ 	bool "Atheros AR5312/AR2312+ SoC support"
+ 	depends on ATH25
++	select GPIO_AR5312
+ 	default y
+ 
+ config SOC_AR2315
+--- a/arch/mips/ath25/ar5312.c
++++ b/arch/mips/ath25/ar5312.c
+@@ -23,6 +23,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/mtd/physmap.h>
+ #include <linux/reboot.h>
++#include <linux/gpio.h>
+ #include <asm/bootinfo.h>
+ #include <asm/reboot.h>
+ #include <asm/time.h>
+@@ -177,6 +178,22 @@ static struct platform_device ar5312_phy
+ 	.num_resources = 1,
+ };
+ 
++static struct resource ar5312_gpio_res[] = {
++	{
++		.name = "ar5312-gpio",
++		.flags = IORESOURCE_MEM,
++		.start = AR5312_GPIO_BASE,
++		.end = AR5312_GPIO_BASE + AR5312_GPIO_SIZE - 1,
++	},
++};
++
++static struct platform_device ar5312_gpio = {
++	.name = "ar5312-gpio",
++	.id = -1,
++	.resource = ar5312_gpio_res,
++	.num_resources = ARRAY_SIZE(ar5312_gpio_res),
++};
++
+ static void __init ar5312_flash_init(void)
+ {
+ 	void __iomem *flashctl_base;
+@@ -244,6 +261,8 @@ void __init ar5312_init_devices(void)
+ 
+ 	platform_device_register(&ar5312_physmap_flash);
+ 
++	platform_device_register(&ar5312_gpio);
++
+ 	switch (ath25_soc) {
+ 	case ATH25_SOC_AR5312:
+ 		if (!ath25_board.radio)
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -143,6 +143,13 @@ config GPIO_AMDPT
+ 	  driver for GPIO functionality on Promontory IOHub
+ 	  Require ACPI ASL code to enumerate as a platform device.
+ 
++config GPIO_AR5312
++	bool "AR5312 SoC GPIO support"
++	default y if SOC_AR5312
++	depends on SOC_AR5312
++	help
++	  Say yes here to enable GPIO support for Atheros AR5312/AR2312+ SoCs.
++
+ config GPIO_ASPEED
+ 	tristate "Aspeed GPIO support"
+ 	depends on (ARCH_ASPEED || COMPILE_TEST) && OF_GPIO
+--- a/drivers/gpio/Makefile
++++ b/drivers/gpio/Makefile
+@@ -32,6 +32,7 @@ obj-$(CONFIG_GPIO_ALTERA)  		+= gpio-alt
+ obj-$(CONFIG_GPIO_AMD8111)		+= gpio-amd8111.o
+ obj-$(CONFIG_GPIO_AMD_FCH)		+= gpio-amd-fch.o
+ obj-$(CONFIG_GPIO_AMDPT)		+= gpio-amdpt.o
++obj-$(CONFIG_GPIO_AR5312)		+= gpio-ar5312.o
+ obj-$(CONFIG_GPIO_ARIZONA)		+= gpio-arizona.o
+ obj-$(CONFIG_GPIO_ASPEED)		+= gpio-aspeed.o
+ obj-$(CONFIG_GPIO_ASPEED_SGPIO)		+= gpio-aspeed-sgpio.o
+--- /dev/null
++++ b/drivers/gpio/gpio-ar5312.c
+@@ -0,0 +1,121 @@
++/*
++ * This file is subject to the terms and conditions of the GNU General Public
++ * License.  See the file "COPYING" in the main directory of this archive
++ * for more details.
++ *
++ * Copyright (C) 2003 Atheros Communications, Inc.,  All Rights Reserved.
++ * Copyright (C) 2006 FON Technology, SL.
++ * Copyright (C) 2006 Imre Kaloz <kaloz@openwrt.org>
++ * Copyright (C) 2006-2009 Felix Fietkau <nbd@nbd.name>
++ * Copyright (C) 2012 Alexandros C. Couloumbis <alex@ozo.com>
++ */
++
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/platform_device.h>
++#include <linux/gpio.h>
++
++#define DRIVER_NAME	"ar5312-gpio"
++
++#define AR5312_GPIO_DO		0x00		/* output register */
++#define AR5312_GPIO_DI		0x04		/* intput register */
++#define AR5312_GPIO_CR		0x08		/* control register */
++
++#define AR5312_GPIO_CR_M(x)	(1 << (x))	/* mask for i/o */
++#define AR5312_GPIO_CR_O(x)	(0 << (x))	/* mask for output */
++#define AR5312_GPIO_CR_I(x)	(1 << (x))	/* mask for input */
++#define AR5312_GPIO_CR_INT(x)	(1 << ((x)+8))	/* mask for interrupt */
++#define AR5312_GPIO_CR_UART(x)	(1 << ((x)+16))	/* uart multiplex */
++
++#define AR5312_GPIO_NUM		8
++
++static void __iomem *ar5312_mem;
++
++static inline u32 ar5312_gpio_reg_read(unsigned reg)
++{
++	return __raw_readl(ar5312_mem + reg);
++}
++
++static inline void ar5312_gpio_reg_write(unsigned reg, u32 val)
++{
++	__raw_writel(val, ar5312_mem + reg);
++}
++
++static inline void ar5312_gpio_reg_mask(unsigned reg, u32 mask, u32 val)
++{
++	ar5312_gpio_reg_write(reg, (ar5312_gpio_reg_read(reg) & ~mask) | val);
++}
++
++static int ar5312_gpio_get_val(struct gpio_chip *chip, unsigned gpio)
++{
++	return (ar5312_gpio_reg_read(AR5312_GPIO_DI) >> gpio) & 1;
++}
++
++static void ar5312_gpio_set_val(struct gpio_chip *chip, unsigned gpio, int val)
++{
++	u32 reg = ar5312_gpio_reg_read(AR5312_GPIO_DO);
++
++	reg = val ? reg | (1 << gpio) : reg & ~(1 << gpio);
++	ar5312_gpio_reg_write(AR5312_GPIO_DO, reg);
++}
++
++static int ar5312_gpio_dir_in(struct gpio_chip *chip, unsigned gpio)
++{
++	ar5312_gpio_reg_mask(AR5312_GPIO_CR, 0, 1 << gpio);
++	return 0;
++}
++
++static int ar5312_gpio_dir_out(struct gpio_chip *chip, unsigned gpio, int val)
++{
++	ar5312_gpio_reg_mask(AR5312_GPIO_CR, 1 << gpio, 0);
++	ar5312_gpio_set_val(chip, gpio, val);
++	return 0;
++}
++
++static struct gpio_chip ar5312_gpio_chip = {
++	.label			= DRIVER_NAME,
++	.direction_input	= ar5312_gpio_dir_in,
++	.direction_output	= ar5312_gpio_dir_out,
++	.set			= ar5312_gpio_set_val,
++	.get			= ar5312_gpio_get_val,
++	.base			= 0,
++	.ngpio			= AR5312_GPIO_NUM,
++};
++
++static int ar5312_gpio_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct resource *res;
++	int ret;
++
++	if (ar5312_mem)
++		return -EBUSY;
++
++	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	ar5312_mem = devm_ioremap_resource(dev, res);
++	if (IS_ERR(ar5312_mem))
++		return PTR_ERR(ar5312_mem);
++
++	ar5312_gpio_chip.parent = dev;
++	ret = gpiochip_add(&ar5312_gpio_chip);
++	if (ret) {
++		dev_err(dev, "failed to add gpiochip\n");
++		return ret;
++	}
++
++	return 0;
++}
++
++static struct platform_driver ar5312_gpio_driver = {
++	.probe = ar5312_gpio_probe,
++	.driver = {
++		.name = DRIVER_NAME,
++		.owner = THIS_MODULE,
++	}
++};
++
++static int __init ar5312_gpio_init(void)
++{
++	return platform_driver_register(&ar5312_gpio_driver);
++}
++subsys_initcall(ar5312_gpio_init);
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -230,6 +230,7 @@ config ATH25
+ 	select CEVT_R4K
+ 	select CSRC_R4K
+ 	select DMA_NONCOHERENT
++	select GPIOLIB
+ 	select IRQ_MIPS_CPU
+ 	select IRQ_DOMAIN
+ 	select SYS_HAS_CPU_MIPS32_R1
diff --git a/target/linux/ath25/patches-5.15/108-ar2315_gpio.patch b/target/linux/ath25/patches-5.15/108-ar2315_gpio.patch
new file mode 100644
index 00000000000000..f2e1e4a9a321ef
--- /dev/null
+++ b/target/linux/ath25/patches-5.15/108-ar2315_gpio.patch
@@ -0,0 +1,363 @@
+--- a/arch/mips/ath25/Kconfig
++++ b/arch/mips/ath25/Kconfig
+@@ -8,6 +8,7 @@ config SOC_AR5312
+ config SOC_AR2315
+ 	bool "Atheros AR2315+ SoC support"
+ 	depends on ATH25
++	select GPIO_AR2315
+ 	default y
+ 
+ config PCI_AR2315
+--- a/arch/mips/ath25/ar2315.c
++++ b/arch/mips/ath25/ar2315.c
+@@ -22,6 +22,8 @@
+ #include <linux/memblock.h>
+ #include <linux/platform_device.h>
+ #include <linux/reboot.h>
++#include <linux/delay.h>
++#include <linux/gpio.h>
+ #include <asm/bootinfo.h>
+ #include <asm/reboot.h>
+ #include <asm/time.h>
+@@ -165,11 +167,42 @@ void __init ar2315_arch_init_irq(void)
+ 	ar2315_misc_irq_domain = domain;
+ }
+ 
++static struct resource ar2315_gpio_res[] = {
++	{
++		.name = "ar2315-gpio",
++		.flags = IORESOURCE_MEM,
++		.start = AR2315_RST_BASE + AR2315_GPIO,
++		.end = AR2315_RST_BASE + AR2315_GPIO + 0x10 - 1,
++	},
++	{
++		.name = "ar2315-gpio",
++		.flags = IORESOURCE_IRQ,
++	},
++	{
++		.name = "ar2315-gpio-irq-base",
++		.flags = IORESOURCE_IRQ,
++		.start = AR231X_GPIO_IRQ_BASE,
++		.end = AR231X_GPIO_IRQ_BASE,
++	}
++};
++
++static struct platform_device ar2315_gpio = {
++	.id = -1,
++	.name = "ar2315-gpio",
++	.resource = ar2315_gpio_res,
++	.num_resources = ARRAY_SIZE(ar2315_gpio_res)
++};
++
+ void __init ar2315_init_devices(void)
+ {
+ 	/* Find board configuration */
+ 	ath25_find_config(AR2315_SPI_READ_BASE, AR2315_SPI_READ_SIZE);
+ 
++	ar2315_gpio_res[1].start = irq_create_mapping(ar2315_misc_irq_domain,
++						      AR2315_MISC_IRQ_GPIO);
++	ar2315_gpio_res[1].end = ar2315_gpio_res[1].start;
++	platform_device_register(&ar2315_gpio);
++
+ 	ath25_add_wmac(0, AR2315_WLAN0_BASE, AR2315_IRQ_WLAN0);
+ }
+ 
+@@ -185,8 +218,8 @@ static void ar2315_restart(char *command
+ 	/* Cold reset does not work on the AR2315/6, use the GPIO reset bits
+ 	 * a workaround. Give it some time to attempt a gpio based hardware
+ 	 * reset (atheros reference design workaround) */
+-
+-	/* TODO: implement the GPIO reset workaround */
++	gpio_request_one(AR2315_RESET_GPIO, GPIOF_OUT_INIT_LOW, "Reset");
++	mdelay(100);
+ 
+ 	/* Some boards (e.g. Senao EOC-2610) don't implement the reset logic
+ 	 * workaround. Attempt to jump to the mips reset location -
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -143,6 +143,13 @@ config GPIO_AMDPT
+ 	  driver for GPIO functionality on Promontory IOHub
+ 	  Require ACPI ASL code to enumerate as a platform device.
+ 
++config GPIO_AR2315
++	bool "AR2315 SoC GPIO support"
++	default y if SOC_AR2315
++	depends on SOC_AR2315
++	help
++	  Say yes here to enable GPIO support for Atheros AR2315+ SoCs.
++
+ config GPIO_AR5312
+ 	bool "AR5312 SoC GPIO support"
+ 	default y if SOC_AR5312
+--- a/drivers/gpio/Makefile
++++ b/drivers/gpio/Makefile
+@@ -32,6 +32,7 @@ obj-$(CONFIG_GPIO_ALTERA)  		+= gpio-alt
+ obj-$(CONFIG_GPIO_AMD8111)		+= gpio-amd8111.o
+ obj-$(CONFIG_GPIO_AMD_FCH)		+= gpio-amd-fch.o
+ obj-$(CONFIG_GPIO_AMDPT)		+= gpio-amdpt.o
++obj-$(CONFIG_GPIO_AR2315)		+= gpio-ar2315.o
+ obj-$(CONFIG_GPIO_AR5312)		+= gpio-ar5312.o
+ obj-$(CONFIG_GPIO_ARIZONA)		+= gpio-arizona.o
+ obj-$(CONFIG_GPIO_ASPEED)		+= gpio-aspeed.o
+--- /dev/null
++++ b/drivers/gpio/gpio-ar2315.c
+@@ -0,0 +1,233 @@
++/*
++ * This file is subject to the terms and conditions of the GNU General Public
++ * License.  See the file "COPYING" in the main directory of this archive
++ * for more details.
++ *
++ * Copyright (C) 2003 Atheros Communications, Inc.,  All Rights Reserved.
++ * Copyright (C) 2006 FON Technology, SL.
++ * Copyright (C) 2006 Imre Kaloz <kaloz@openwrt.org>
++ * Copyright (C) 2006 Felix Fietkau <nbd@nbd.name>
++ * Copyright (C) 2012 Alexandros C. Couloumbis <alex@ozo.com>
++ */
++
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/platform_device.h>
++#include <linux/gpio.h>
++#include <linux/irq.h>
++
++#define DRIVER_NAME	"ar2315-gpio"
++
++#define AR2315_GPIO_DI			0x0000
++#define AR2315_GPIO_DO			0x0008
++#define AR2315_GPIO_DIR			0x0010
++#define AR2315_GPIO_INT			0x0018
++
++#define AR2315_GPIO_DIR_M(x)		(1 << (x))	/* mask for i/o */
++#define AR2315_GPIO_DIR_O(x)		(1 << (x))	/* output */
++#define AR2315_GPIO_DIR_I(x)		(0)		/* input */
++
++#define AR2315_GPIO_INT_NUM_M		0x3F		/* mask for GPIO num */
++#define AR2315_GPIO_INT_TRIG(x)		((x) << 6)	/* interrupt trigger */
++#define AR2315_GPIO_INT_TRIG_M		(0x3 << 6)	/* mask for int trig */
++
++#define AR2315_GPIO_INT_TRIG_OFF	0	/* Triggerring off */
++#define AR2315_GPIO_INT_TRIG_LOW	1	/* Low Level Triggered */
++#define AR2315_GPIO_INT_TRIG_HIGH	2	/* High Level Triggered */
++#define AR2315_GPIO_INT_TRIG_EDGE	3	/* Edge Triggered */
++
++#define AR2315_GPIO_NUM		22
++
++static u32 ar2315_gpio_intmask;
++static u32 ar2315_gpio_intval;
++static unsigned ar2315_gpio_irq_base;
++static void __iomem *ar2315_mem;
++
++static inline u32 ar2315_gpio_reg_read(unsigned reg)
++{
++	return __raw_readl(ar2315_mem + reg);
++}
++
++static inline void ar2315_gpio_reg_write(unsigned reg, u32 val)
++{
++	__raw_writel(val, ar2315_mem + reg);
++}
++
++static inline void ar2315_gpio_reg_mask(unsigned reg, u32 mask, u32 val)
++{
++	ar2315_gpio_reg_write(reg, (ar2315_gpio_reg_read(reg) & ~mask) | val);
++}
++
++static void ar2315_gpio_irq_handler(struct irq_desc *desc)
++{
++	u32 pend;
++	int bit = -1;
++
++	/* only do one gpio interrupt at a time */
++	pend = ar2315_gpio_reg_read(AR2315_GPIO_DI);
++	pend ^= ar2315_gpio_intval;
++	pend &= ar2315_gpio_intmask;
++
++	if (pend) {
++		bit = fls(pend) - 1;
++		pend &= ~(1 << bit);
++		ar2315_gpio_intval ^= (1 << bit);
++	}
++
++	/* Enable interrupt with edge detection */
++	if ((ar2315_gpio_reg_read(AR2315_GPIO_DIR) & AR2315_GPIO_DIR_M(bit)) !=
++	    AR2315_GPIO_DIR_I(bit))
++		return;
++
++	if (bit >= 0)
++		generic_handle_irq(ar2315_gpio_irq_base + bit);
++}
++
++static void ar2315_gpio_int_setup(unsigned gpio, int trig)
++{
++	u32 reg = ar2315_gpio_reg_read(AR2315_GPIO_INT);
++
++	reg &= ~(AR2315_GPIO_INT_NUM_M | AR2315_GPIO_INT_TRIG_M);
++	reg |= gpio | AR2315_GPIO_INT_TRIG(trig);
++	ar2315_gpio_reg_write(AR2315_GPIO_INT, reg);
++}
++
++static void ar2315_gpio_irq_unmask(struct irq_data *d)
++{
++	unsigned gpio = d->irq - ar2315_gpio_irq_base;
++	u32 dir = ar2315_gpio_reg_read(AR2315_GPIO_DIR);
++
++	/* Enable interrupt with edge detection */
++	if ((dir & AR2315_GPIO_DIR_M(gpio)) != AR2315_GPIO_DIR_I(gpio))
++		return;
++
++	ar2315_gpio_intmask |= (1 << gpio);
++	ar2315_gpio_int_setup(gpio, AR2315_GPIO_INT_TRIG_EDGE);
++}
++
++static void ar2315_gpio_irq_mask(struct irq_data *d)
++{
++	unsigned gpio = d->irq - ar2315_gpio_irq_base;
++
++	/* Disable interrupt */
++	ar2315_gpio_intmask &= ~(1 << gpio);
++	ar2315_gpio_int_setup(gpio, AR2315_GPIO_INT_TRIG_OFF);
++}
++
++static struct irq_chip ar2315_gpio_irq_chip = {
++	.name		= DRIVER_NAME,
++	.irq_unmask	= ar2315_gpio_irq_unmask,
++	.irq_mask	= ar2315_gpio_irq_mask,
++};
++
++static void ar2315_gpio_irq_init(unsigned irq)
++{
++	unsigned i;
++
++	ar2315_gpio_intval = ar2315_gpio_reg_read(AR2315_GPIO_DI);
++	for (i = 0; i < AR2315_GPIO_NUM; i++) {
++		unsigned _irq = ar2315_gpio_irq_base + i;
++
++		irq_set_chip_and_handler(_irq, &ar2315_gpio_irq_chip,
++					 handle_level_irq);
++	}
++	irq_set_chained_handler(irq, ar2315_gpio_irq_handler);
++}
++
++static int ar2315_gpio_get_val(struct gpio_chip *chip, unsigned gpio)
++{
++	return (ar2315_gpio_reg_read(AR2315_GPIO_DI) >> gpio) & 1;
++}
++
++static void ar2315_gpio_set_val(struct gpio_chip *chip, unsigned gpio, int val)
++{
++	u32 reg = ar2315_gpio_reg_read(AR2315_GPIO_DO);
++
++	reg = val ? reg | (1 << gpio) : reg & ~(1 << gpio);
++	ar2315_gpio_reg_write(AR2315_GPIO_DO, reg);
++}
++
++static int ar2315_gpio_dir_in(struct gpio_chip *chip, unsigned gpio)
++{
++	ar2315_gpio_reg_mask(AR2315_GPIO_DIR, 1 << gpio, 0);
++	return 0;
++}
++
++static int ar2315_gpio_dir_out(struct gpio_chip *chip, unsigned gpio, int val)
++{
++	ar2315_gpio_reg_mask(AR2315_GPIO_DIR, 0, 1 << gpio);
++	ar2315_gpio_set_val(chip, gpio, val);
++	return 0;
++}
++
++static int ar2315_gpio_to_irq(struct gpio_chip *chip, unsigned gpio)
++{
++	return ar2315_gpio_irq_base + gpio;
++}
++
++static struct gpio_chip ar2315_gpio_chip = {
++	.label			= DRIVER_NAME,
++	.direction_input	= ar2315_gpio_dir_in,
++	.direction_output	= ar2315_gpio_dir_out,
++	.set			= ar2315_gpio_set_val,
++	.get			= ar2315_gpio_get_val,
++	.to_irq			= ar2315_gpio_to_irq,
++	.base			= 0,
++	.ngpio			= AR2315_GPIO_NUM,
++};
++
++static int ar2315_gpio_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct resource *res;
++	unsigned irq;
++	int ret;
++
++	if (ar2315_mem)
++		return -EBUSY;
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_IRQ,
++					   "ar2315-gpio-irq-base");
++	if (!res) {
++		dev_err(dev, "not found GPIO IRQ base\n");
++		return -ENXIO;
++	}
++	ar2315_gpio_irq_base = res->start;
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_IRQ, DRIVER_NAME);
++	if (!res) {
++		dev_err(dev, "not found IRQ number\n");
++		return -ENXIO;
++	}
++	irq = res->start;
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, DRIVER_NAME);
++	ar2315_mem = devm_ioremap_resource(dev, res);
++	if (IS_ERR(ar2315_mem))
++		return PTR_ERR(ar2315_mem);
++
++	ar2315_gpio_chip.parent = dev;
++	ret = gpiochip_add(&ar2315_gpio_chip);
++	if (ret) {
++		dev_err(dev, "failed to add gpiochip\n");
++		return ret;
++	}
++
++	ar2315_gpio_irq_init(irq);
++
++	return 0;
++}
++
++static struct platform_driver ar2315_gpio_driver = {
++	.probe = ar2315_gpio_probe,
++	.driver = {
++		.name = DRIVER_NAME,
++		.owner = THIS_MODULE,
++	}
++};
++
++static int __init ar2315_gpio_init(void)
++{
++	return platform_driver_register(&ar2315_gpio_driver);
++}
++subsys_initcall(ar2315_gpio_init);
+--- a/arch/mips/ath25/devices.h
++++ b/arch/mips/ath25/devices.h
+@@ -4,6 +4,11 @@
+ 
+ #include <linux/cpu.h>
+ 
++#define AR231X_GPIO_IRQ_BASE		0x30
++
++/* GPIO number for AR2315/16 reset issue workaround */
++#define AR2315_RESET_GPIO		5
++
+ #define ATH25_REG_MS(_val, _field)	(((_val) & _field##_M) >> _field##_S)
+ 
+ #define ATH25_IRQ_CPU_CLOCK	(MIPS_CPU_IRQ_BASE + 7)	/* C0_CAUSE: 0x8000 */
+--- a/arch/mips/ath25/ar2315_regs.h
++++ b/arch/mips/ath25/ar2315_regs.h
+@@ -315,6 +315,9 @@
+ #define AR2315_MEM_CFG_BANKADDR_BITS_M	0x00000018
+ #define AR2315_MEM_CFG_BANKADDR_BITS_S	3
+ 
++/* GPIO MMR base address */
++#define AR2315_GPIO			0x0088
++
+ /*
+  * Local Bus Interface Registers
+  */
diff --git a/target/linux/ath25/patches-5.15/110-ar2313_ethernet.patch b/target/linux/ath25/patches-5.15/110-ar2313_ethernet.patch
new file mode 100644
index 00000000000000..fcb6abff7d7f3c
--- /dev/null
+++ b/target/linux/ath25/patches-5.15/110-ar2313_ethernet.patch
@@ -0,0 +1,1733 @@
+--- a/drivers/net/ethernet/atheros/Makefile
++++ b/drivers/net/ethernet/atheros/Makefile
+@@ -9,3 +9,4 @@ obj-$(CONFIG_ATL2) += atlx/
+ obj-$(CONFIG_ATL1E) += atl1e/
+ obj-$(CONFIG_ATL1C) += atl1c/
+ obj-$(CONFIG_ALX) += alx/
++obj-$(CONFIG_NET_AR231X) += ar231x/
+--- a/drivers/net/ethernet/atheros/Kconfig
++++ b/drivers/net/ethernet/atheros/Kconfig
+@@ -6,7 +6,7 @@
+ config NET_VENDOR_ATHEROS
+ 	bool "Atheros devices"
+ 	default y
+-	depends on (PCI || ATH79)
++	depends on (PCI || ATH25 || ATH79)
+ 	help
+ 	  If you have a network (Ethernet) card belonging to this class, say Y.
+ 
+@@ -88,4 +88,10 @@ config ALX
+ 	  To compile this driver as a module, choose M here.  The module
+ 	  will be called alx.
+ 
++config NET_AR231X
++	tristate "Atheros AR231X built-in Ethernet support"
++	depends on ATH25
++	help
++	  Support for the AR231x/531x ethernet controller
++
+ endif # NET_VENDOR_ATHEROS
+--- /dev/null
++++ b/drivers/net/ethernet/atheros/ar231x/Makefile
+@@ -0,0 +1 @@
++obj-$(CONFIG_NET_AR231X) += ar231x.o
+--- /dev/null
++++ b/drivers/net/ethernet/atheros/ar231x/ar231x.c
+@@ -0,0 +1,1117 @@
++/*
++ * ar231x.c: Linux driver for the Atheros AR231x Ethernet device.
++ *
++ * Copyright (C) 2004 by Sameer Dekate <sdekate@arubanetworks.com>
++ * Copyright (C) 2006 Imre Kaloz <kaloz@openwrt.org>
++ * Copyright (C) 2006-2009 Felix Fietkau <nbd@nbd.name>
++ *
++ * Thanks to Atheros for providing hardware and documentation
++ * enabling me to write this driver.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * Additional credits:
++ * This code is taken from John Taylor's Sibyte driver and then
++ * modified for the AR2313.
++ */
++
++#include <linux/module.h>
++#include <linux/types.h>
++#include <linux/errno.h>
++#include <linux/ioport.h>
++#include <linux/netdevice.h>
++#include <linux/etherdevice.h>
++#include <linux/interrupt.h>
++#include <linux/skbuff.h>
++#include <linux/init.h>
++#include <linux/delay.h>
++#include <linux/mm.h>
++#include <linux/mii.h>
++#include <linux/phy.h>
++#include <linux/platform_device.h>
++#include <linux/io.h>
++
++#define AR2313_MTU                     1692
++#define AR2313_PRIOS                   1
++#define AR2313_QUEUES                  (2*AR2313_PRIOS)
++#define AR2313_DESCR_ENTRIES           64
++
++#ifndef min
++#define min(a, b)	(((a) < (b)) ? (a) : (b))
++#endif
++
++#ifndef SMP_CACHE_BYTES
++#define SMP_CACHE_BYTES	L1_CACHE_BYTES
++#endif
++
++#define AR2313_MBOX_SET_BIT  0x8
++
++#include "ar231x.h"
++
++/**
++ * New interrupt handler strategy:
++ *
++ * An old interrupt handler worked using the traditional method of
++ * replacing an skbuff with a new one when a packet arrives. However
++ * the rx rings do not need to contain a static number of buffer
++ * descriptors, thus it makes sense to move the memory allocation out
++ * of the main interrupt handler and do it in a bottom half handler
++ * and only allocate new buffers when the number of buffers in the
++ * ring is below a certain threshold. In order to avoid starving the
++ * NIC under heavy load it is however necessary to force allocation
++ * when hitting a minimum threshold. The strategy for alloction is as
++ * follows:
++ *
++ *     RX_LOW_BUF_THRES    - allocate buffers in the bottom half
++ *     RX_PANIC_LOW_THRES  - we are very low on buffers, allocate
++ *                           the buffers in the interrupt handler
++ *     RX_RING_THRES       - maximum number of buffers in the rx ring
++ *
++ * One advantagous side effect of this allocation approach is that the
++ * entire rx processing can be done without holding any spin lock
++ * since the rx rings and registers are totally independent of the tx
++ * ring and its registers.  This of course includes the kmalloc's of
++ * new skb's. Thus start_xmit can run in parallel with rx processing
++ * and the memory allocation on SMP systems.
++ *
++ * Note that running the skb reallocation in a bottom half opens up
++ * another can of races which needs to be handled properly. In
++ * particular it can happen that the interrupt handler tries to run
++ * the reallocation while the bottom half is either running on another
++ * CPU or was interrupted on the same CPU. To get around this the
++ * driver uses bitops to prevent the reallocation routines from being
++ * reentered.
++ *
++ * TX handling can also be done without holding any spin lock, wheee
++ * this is fun! since tx_csm is only written to by the interrupt
++ * handler.
++ */
++
++/**
++ * Threshold values for RX buffer allocation - the low water marks for
++ * when to start refilling the rings are set to 75% of the ring
++ * sizes. It seems to make sense to refill the rings entirely from the
++ * intrrupt handler once it gets below the panic threshold, that way
++ * we don't risk that the refilling is moved to another CPU when the
++ * one running the interrupt handler just got the slab code hot in its
++ * cache.
++ */
++#define RX_RING_SIZE		AR2313_DESCR_ENTRIES
++#define RX_PANIC_THRES	        (RX_RING_SIZE/4)
++#define RX_LOW_THRES	        ((3*RX_RING_SIZE)/4)
++#define CRC_LEN                 4
++#define RX_OFFSET               2
++
++#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
++#define VLAN_HDR                4
++#else
++#define VLAN_HDR                0
++#endif
++
++#define AR2313_BUFSIZE		(AR2313_MTU + VLAN_HDR + ETH_HLEN + CRC_LEN + \
++				 RX_OFFSET)
++
++#ifdef MODULE
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Sameer Dekate <sdekate@arubanetworks.com>, Imre Kaloz <kaloz@openwrt.org>, Felix Fietkau <nbd@nbd.name>");
++MODULE_DESCRIPTION("AR231x Ethernet driver");
++#endif
++
++/* prototypes */
++static void ar231x_halt(struct net_device *dev);
++static void rx_tasklet_func(unsigned long data);
++static void rx_tasklet_cleanup(struct net_device *dev);
++static void ar231x_multicast_list(struct net_device *dev);
++static void ar231x_tx_timeout(struct net_device *dev, unsigned int txqueue);
++
++static int ar231x_mdiobus_read(struct mii_bus *bus, int phy_addr, int regnum);
++static int ar231x_mdiobus_write(struct mii_bus *bus, int phy_addr, int regnum,
++				u16 value);
++static int ar231x_mdiobus_reset(struct mii_bus *bus);
++static int ar231x_mdiobus_probe(struct net_device *dev);
++static void ar231x_adjust_link(struct net_device *dev);
++
++#ifndef ERR
++#define ERR(fmt, args...) printk("%s: " fmt, __func__, ##args)
++#endif
++
++#ifdef CONFIG_NET_POLL_CONTROLLER
++static void
++ar231x_netpoll(struct net_device *dev)
++{
++	unsigned long flags;
++
++	local_irq_save(flags);
++	ar231x_interrupt(dev->irq, dev);
++	local_irq_restore(flags);
++}
++#endif
++
++static const struct net_device_ops ar231x_ops = {
++	.ndo_open		= ar231x_open,
++	.ndo_stop		= ar231x_close,
++	.ndo_start_xmit		= ar231x_start_xmit,
++	.ndo_set_rx_mode	= ar231x_multicast_list,
++	.ndo_do_ioctl		= ar231x_ioctl,
++	.ndo_validate_addr	= eth_validate_addr,
++	.ndo_set_mac_address	= eth_mac_addr,
++	.ndo_tx_timeout		= ar231x_tx_timeout,
++#ifdef CONFIG_NET_POLL_CONTROLLER
++	.ndo_poll_controller	= ar231x_netpoll,
++#endif
++};
++
++static int ar231x_probe(struct platform_device *pdev)
++{
++	struct net_device *dev;
++	struct ar231x_private *sp;
++	struct resource *res;
++	unsigned long ar_eth_base;
++	char buf[64];
++
++	dev = alloc_etherdev(sizeof(struct ar231x_private));
++
++	if (dev == NULL) {
++		printk(KERN_ERR
++			   "ar231x: Unable to allocate net_device structure!\n");
++		return -ENOMEM;
++	}
++
++	platform_set_drvdata(pdev, dev);
++
++	SET_NETDEV_DEV(dev, &pdev->dev);
++
++	sp = netdev_priv(dev);
++	sp->dev = dev;
++	sp->pdev = pdev;
++	sp->cfg = pdev->dev.platform_data;
++
++	sprintf(buf, "eth%d_membase", pdev->id);
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, buf);
++	if (!res)
++		return -ENODEV;
++
++	sp->link = 0;
++	ar_eth_base = res->start;
++
++	sprintf(buf, "eth%d_irq", pdev->id);
++	dev->irq = platform_get_irq_byname(pdev, buf);
++
++	spin_lock_init(&sp->lock);
++
++	dev->features |= NETIF_F_HIGHDMA;
++	dev->netdev_ops = &ar231x_ops;
++
++	tasklet_init(&sp->rx_tasklet, rx_tasklet_func, (unsigned long)dev);
++	tasklet_disable(&sp->rx_tasklet);
++
++	sp->eth_regs = ioremap(ar_eth_base, sizeof(*sp->eth_regs));
++	if (!sp->eth_regs) {
++		printk("Can't remap eth registers\n");
++		return -ENXIO;
++	}
++
++	/**
++	 * When there's only one MAC, PHY regs are typically on ENET0,
++	 * even though the MAC might be on ENET1.
++	 * So remap PHY regs separately.
++	 */
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "eth0_mii");
++	if (!res) {
++		res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
++						   "eth1_mii");
++		if (!res)
++			return -ENODEV;
++	}
++	sp->phy_regs = ioremap(res->start, resource_size(res));
++	if (!sp->phy_regs) {
++		printk("Can't remap phy registers\n");
++		return -ENXIO;
++	}
++
++	sp->dma_regs = ioremap(ar_eth_base + 0x1000,
++			       sizeof(*sp->dma_regs));
++	if (!sp->dma_regs) {
++		printk("Can't remap DMA registers\n");
++		return -ENXIO;
++	}
++	dev->base_addr = ar_eth_base + 0x1000;
++
++	strncpy(sp->name, "Atheros AR231x", sizeof(sp->name) - 1);
++	sp->name[sizeof(sp->name) - 1] = '\0';
++	memcpy(dev->dev_addr, sp->cfg->macaddr, 6);
++
++	if (ar231x_init(dev)) {
++		/* ar231x_init() calls ar231x_init_cleanup() on error */
++		kfree(dev);
++		return -ENODEV;
++	}
++
++	if (register_netdev(dev)) {
++		printk("%s: register_netdev failed\n", __func__);
++		return -1;
++	}
++
++	printk("%s: %s: %pM, irq %d\n", dev->name, sp->name, dev->dev_addr,
++	       dev->irq);
++
++	sp->mii_bus = mdiobus_alloc();
++	if (sp->mii_bus == NULL)
++		return -1;
++
++	sp->mii_bus->priv = dev;
++	sp->mii_bus->read = ar231x_mdiobus_read;
++	sp->mii_bus->write = ar231x_mdiobus_write;
++	sp->mii_bus->reset = ar231x_mdiobus_reset;
++	sp->mii_bus->name = "ar231x_eth_mii";
++	snprintf(sp->mii_bus->id, MII_BUS_ID_SIZE, "%d", pdev->id);
++
++	mdiobus_register(sp->mii_bus);
++
++	if (ar231x_mdiobus_probe(dev) != 0) {
++		printk(KERN_ERR "%s: mdiobus_probe failed\n", dev->name);
++		rx_tasklet_cleanup(dev);
++		ar231x_init_cleanup(dev);
++		unregister_netdev(dev);
++		kfree(dev);
++		return -ENODEV;
++	}
++
++	return 0;
++}
++
++static void ar231x_multicast_list(struct net_device *dev)
++{
++	struct ar231x_private *sp = netdev_priv(dev);
++	unsigned int filter;
++
++	filter = sp->eth_regs->mac_control;
++
++	if (dev->flags & IFF_PROMISC)
++		filter |= MAC_CONTROL_PR;
++	else
++		filter &= ~MAC_CONTROL_PR;
++	if ((dev->flags & IFF_ALLMULTI) || (netdev_mc_count(dev) > 0))
++		filter |= MAC_CONTROL_PM;
++	else
++		filter &= ~MAC_CONTROL_PM;
++
++	sp->eth_regs->mac_control = filter;
++}
++
++static void rx_tasklet_cleanup(struct net_device *dev)
++{
++	struct ar231x_private *sp = netdev_priv(dev);
++
++	/**
++	 * Tasklet may be scheduled. Need to get it removed from the list
++	 * since we're about to free the struct.
++	 */
++
++	sp->unloading = 1;
++	tasklet_enable(&sp->rx_tasklet);
++	tasklet_kill(&sp->rx_tasklet);
++}
++
++static int ar231x_remove(struct platform_device *pdev)
++{
++	struct net_device *dev = platform_get_drvdata(pdev);
++	struct ar231x_private *sp = netdev_priv(dev);
++
++	rx_tasklet_cleanup(dev);
++	ar231x_init_cleanup(dev);
++	unregister_netdev(dev);
++	mdiobus_unregister(sp->mii_bus);
++	mdiobus_free(sp->mii_bus);
++	kfree(dev);
++	return 0;
++}
++
++/**
++ * Restart the AR2313 ethernet controller.
++ */
++static int ar231x_restart(struct net_device *dev)
++{
++	/* disable interrupts */
++	disable_irq(dev->irq);
++
++	/* stop mac */
++	ar231x_halt(dev);
++
++	/* initialize */
++	ar231x_init(dev);
++
++	/* enable interrupts */
++	enable_irq(dev->irq);
++
++	return 0;
++}
++
++static struct platform_driver ar231x_driver = {
++	.driver.name = "ar231x-eth",
++	.probe = ar231x_probe,
++	.remove = ar231x_remove,
++};
++
++module_platform_driver(ar231x_driver);
++
++static void ar231x_free_descriptors(struct net_device *dev)
++{
++	struct ar231x_private *sp = netdev_priv(dev);
++
++	if (sp->rx_ring != NULL) {
++		kfree((void *)KSEG0ADDR(sp->rx_ring));
++		sp->rx_ring = NULL;
++		sp->tx_ring = NULL;
++	}
++}
++
++static int ar231x_allocate_descriptors(struct net_device *dev)
++{
++	struct ar231x_private *sp = netdev_priv(dev);
++	int size;
++	int j;
++	ar231x_descr_t *space;
++
++	if (sp->rx_ring != NULL) {
++		printk("%s: already done.\n", __func__);
++		return 0;
++	}
++
++	size = sizeof(ar231x_descr_t) * (AR2313_DESCR_ENTRIES * AR2313_QUEUES);
++	space = kmalloc(size, GFP_KERNEL);
++	if (space == NULL)
++		return 1;
++
++	/* invalidate caches */
++	dma_cache_inv((unsigned int)space, size);
++
++	/* now convert pointer to KSEG1 */
++	space = (ar231x_descr_t *)KSEG1ADDR(space);
++
++	memset((void *)space, 0, size);
++
++	sp->rx_ring = space;
++	space += AR2313_DESCR_ENTRIES;
++
++	sp->tx_ring = space;
++	space += AR2313_DESCR_ENTRIES;
++
++	/* Initialize the transmit Descriptors */
++	for (j = 0; j < AR2313_DESCR_ENTRIES; j++) {
++		ar231x_descr_t *td = &sp->tx_ring[j];
++
++		td->status = 0;
++		td->devcs = DMA_TX1_CHAINED;
++		td->addr = 0;
++		td->descr = virt_to_phys(&sp->tx_ring[DSC_NEXT(j)]);
++	}
++
++	return 0;
++}
++
++/**
++ * Generic cleanup handling data allocated during init. Used when the
++ * module is unloaded or if an error occurs during initialization
++ */
++static void ar231x_init_cleanup(struct net_device *dev)
++{
++	struct ar231x_private *sp = netdev_priv(dev);
++	struct sk_buff *skb;
++	int j;
++
++	ar231x_free_descriptors(dev);
++
++	if (sp->eth_regs)
++		iounmap((void *)sp->eth_regs);
++	if (sp->dma_regs)
++		iounmap((void *)sp->dma_regs);
++	if (sp->phy_regs)
++		iounmap((void *)sp->phy_regs);
++
++	if (sp->rx_skb) {
++		for (j = 0; j < AR2313_DESCR_ENTRIES; j++) {
++			skb = sp->rx_skb[j];
++			if (skb) {
++				sp->rx_skb[j] = NULL;
++				dev_kfree_skb(skb);
++			}
++		}
++		kfree(sp->rx_skb);
++		sp->rx_skb = NULL;
++	}
++
++	if (sp->tx_skb) {
++		for (j = 0; j < AR2313_DESCR_ENTRIES; j++) {
++			skb = sp->tx_skb[j];
++			if (skb) {
++				sp->tx_skb[j] = NULL;
++				dev_kfree_skb(skb);
++			}
++		}
++		kfree(sp->tx_skb);
++		sp->tx_skb = NULL;
++	}
++}
++
++static int ar231x_reset_reg(struct net_device *dev)
++{
++	struct ar231x_private *sp = netdev_priv(dev);
++	unsigned int ethsal, ethsah;
++	unsigned int flags;
++
++	sp->cfg->reset_set(sp->cfg->reset_mac);
++	mdelay(10);
++	sp->cfg->reset_clear(sp->cfg->reset_mac);
++	mdelay(10);
++	sp->cfg->reset_set(sp->cfg->reset_phy);
++	mdelay(10);
++	sp->cfg->reset_clear(sp->cfg->reset_phy);
++	mdelay(10);
++
++	sp->dma_regs->bus_mode = (DMA_BUS_MODE_SWR);
++	mdelay(10);
++	sp->dma_regs->bus_mode =
++		((32 << DMA_BUS_MODE_PBL_SHIFT) | DMA_BUS_MODE_BLE);
++
++	/* enable interrupts */
++	sp->dma_regs->intr_ena = DMA_STATUS_AIS | DMA_STATUS_NIS |
++				 DMA_STATUS_RI | DMA_STATUS_TI |
++				 DMA_STATUS_FBE;
++	sp->dma_regs->xmt_base = virt_to_phys(sp->tx_ring);
++	sp->dma_regs->rcv_base = virt_to_phys(sp->rx_ring);
++	sp->dma_regs->control =
++		(DMA_CONTROL_SR | DMA_CONTROL_ST | DMA_CONTROL_SF);
++
++	sp->eth_regs->flow_control = (FLOW_CONTROL_FCE);
++	sp->eth_regs->vlan_tag = (0x8100);
++
++	/* Enable Ethernet Interface */
++	flags = (MAC_CONTROL_TE |	/* transmit enable */
++			 MAC_CONTROL_PM |	/* pass mcast */
++			 MAC_CONTROL_F |	/* full duplex */
++			 MAC_CONTROL_HBD);	/* heart beat disabled */
++
++	if (dev->flags & IFF_PROMISC) {	/* set promiscuous mode */
++		flags |= MAC_CONTROL_PR;
++	}
++	sp->eth_regs->mac_control = flags;
++
++	/* Set all Ethernet station address registers to their initial values */
++	ethsah = (((u_int) (dev->dev_addr[5]) << 8) & (u_int) 0x0000FF00) |
++		 (((u_int) (dev->dev_addr[4]) << 0) & (u_int) 0x000000FF);
++
++	ethsal = (((u_int) (dev->dev_addr[3]) << 24) & (u_int) 0xFF000000) |
++		 (((u_int) (dev->dev_addr[2]) << 16) & (u_int) 0x00FF0000) |
++		 (((u_int) (dev->dev_addr[1]) << 8) & (u_int) 0x0000FF00) |
++		 (((u_int) (dev->dev_addr[0]) << 0) & (u_int) 0x000000FF);
++
++	sp->eth_regs->mac_addr[0] = ethsah;
++	sp->eth_regs->mac_addr[1] = ethsal;
++
++	mdelay(10);
++
++	return 0;
++}
++
++static int ar231x_init(struct net_device *dev)
++{
++	struct ar231x_private *sp = netdev_priv(dev);
++	int ecode = 0;
++
++	/* Allocate descriptors */
++	if (ar231x_allocate_descriptors(dev)) {
++		printk("%s: %s: ar231x_allocate_descriptors failed\n",
++		       dev->name, __func__);
++		ecode = -EAGAIN;
++		goto init_error;
++	}
++
++	/* Get the memory for the skb rings */
++	if (sp->rx_skb == NULL) {
++		sp->rx_skb =
++			kmalloc(sizeof(struct sk_buff *) * AR2313_DESCR_ENTRIES,
++				GFP_KERNEL);
++		if (!(sp->rx_skb)) {
++			printk("%s: %s: rx_skb kmalloc failed\n",
++			       dev->name, __func__);
++			ecode = -EAGAIN;
++			goto init_error;
++		}
++	}
++	memset(sp->rx_skb, 0, sizeof(struct sk_buff *) * AR2313_DESCR_ENTRIES);
++
++	if (sp->tx_skb == NULL) {
++		sp->tx_skb =
++			kmalloc(sizeof(struct sk_buff *) * AR2313_DESCR_ENTRIES,
++				GFP_KERNEL);
++		if (!(sp->tx_skb)) {
++			printk("%s: %s: tx_skb kmalloc failed\n",
++			       dev->name, __func__);
++			ecode = -EAGAIN;
++			goto init_error;
++		}
++	}
++	memset(sp->tx_skb, 0, sizeof(struct sk_buff *) * AR2313_DESCR_ENTRIES);
++
++	/**
++	 * Set tx_csm before we start receiving interrupts, otherwise
++	 * the interrupt handler might think it is supposed to process
++	 * tx ints before we are up and running, which may cause a null
++	 * pointer access in the int handler.
++	 */
++	sp->rx_skbprd = 0;
++	sp->cur_rx = 0;
++	sp->tx_prd = 0;
++	sp->tx_csm = 0;
++
++	/* Zero the stats before starting the interface */
++	memset(&dev->stats, 0, sizeof(dev->stats));
++
++	/**
++	 * We load the ring here as there seem to be no way to tell the
++	 * firmware to wipe the ring without re-initializing it.
++	 */
++	ar231x_load_rx_ring(dev, RX_RING_SIZE);
++
++	/* Init hardware */
++	ar231x_reset_reg(dev);
++
++	/* Get the IRQ */
++	ecode = request_irq(dev->irq, &ar231x_interrupt, 0,
++			    dev->name, dev);
++	if (ecode) {
++		printk(KERN_WARNING "%s: %s: Requested IRQ %d is busy\n",
++		       dev->name, __func__, dev->irq);
++		goto init_error;
++	}
++
++	tasklet_enable(&sp->rx_tasklet);
++
++	return 0;
++
++init_error:
++	ar231x_init_cleanup(dev);
++	return ecode;
++}
++
++/**
++ * Load the rx ring.
++ *
++ * Loading rings is safe without holding the spin lock since this is
++ * done only before the device is enabled, thus no interrupts are
++ * generated and by the interrupt handler/tasklet handler.
++ */
++static void ar231x_load_rx_ring(struct net_device *dev, int nr_bufs)
++{
++	struct ar231x_private *sp = netdev_priv(dev);
++	short i, idx;
++
++	idx = sp->rx_skbprd;
++
++	for (i = 0; i < nr_bufs; i++) {
++		struct sk_buff *skb;
++		ar231x_descr_t *rd;
++
++		if (sp->rx_skb[idx])
++			break;
++
++		skb = netdev_alloc_skb_ip_align(dev, AR2313_BUFSIZE);
++		if (!skb) {
++			printk("\n\n\n\n %s: No memory in system\n\n\n\n",
++			       __func__);
++			break;
++		}
++
++		/* Make sure IP header starts on a fresh cache line */
++		skb->dev = dev;
++		sp->rx_skb[idx] = skb;
++
++		rd = (ar231x_descr_t *)&sp->rx_ring[idx];
++
++		/* initialize dma descriptor */
++		rd->devcs = ((AR2313_BUFSIZE << DMA_RX1_BSIZE_SHIFT) |
++					 DMA_RX1_CHAINED);
++		rd->addr = virt_to_phys(skb->data);
++		rd->descr = virt_to_phys(&sp->rx_ring[DSC_NEXT(idx)]);
++		rd->status = DMA_RX_OWN;
++
++		idx = DSC_NEXT(idx);
++	}
++
++	if (i)
++		sp->rx_skbprd = idx;
++}
++
++#define AR2313_MAX_PKTS_PER_CALL        64
++
++static int ar231x_rx_int(struct net_device *dev)
++{
++	struct ar231x_private *sp = netdev_priv(dev);
++	struct sk_buff *skb, *skb_new;
++	ar231x_descr_t *rxdesc;
++	unsigned int status;
++	u32 idx;
++	int pkts = 0;
++	int rval;
++
++	idx = sp->cur_rx;
++
++	/* process at most the entire ring and then wait for another int */
++	while (1) {
++		rxdesc = &sp->rx_ring[idx];
++		status = rxdesc->status;
++
++		if (status & DMA_RX_OWN) {
++			/* SiByte owns descriptor or descr not yet filled in */
++			rval = 0;
++			break;
++		}
++
++		if (++pkts > AR2313_MAX_PKTS_PER_CALL) {
++			rval = 1;
++			break;
++		}
++
++		if ((status & DMA_RX_ERROR) && !(status & DMA_RX_LONG)) {
++			dev->stats.rx_errors++;
++			dev->stats.rx_dropped++;
++
++			/* add statistics counters */
++			if (status & DMA_RX_ERR_CRC)
++				dev->stats.rx_crc_errors++;
++			if (status & DMA_RX_ERR_COL)
++				dev->stats.rx_over_errors++;
++			if (status & DMA_RX_ERR_LENGTH)
++				dev->stats.rx_length_errors++;
++			if (status & DMA_RX_ERR_RUNT)
++				dev->stats.rx_over_errors++;
++			if (status & DMA_RX_ERR_DESC)
++				dev->stats.rx_over_errors++;
++
++		} else {
++			/* alloc new buffer. */
++			skb_new = netdev_alloc_skb_ip_align(dev,
++							    AR2313_BUFSIZE);
++			if (skb_new != NULL) {
++				skb = sp->rx_skb[idx];
++				/* set skb */
++				skb_put(skb, ((status >> DMA_RX_LEN_SHIFT) &
++					0x3fff) - CRC_LEN);
++
++				dev->stats.rx_bytes += skb->len;
++				skb->protocol = eth_type_trans(skb, dev);
++				/* pass the packet to upper layers */
++				netif_rx(skb);
++
++				skb_new->dev = dev;
++				/* reset descriptor's curr_addr */
++				rxdesc->addr = virt_to_phys(skb_new->data);
++
++				dev->stats.rx_packets++;
++				sp->rx_skb[idx] = skb_new;
++			} else {
++				dev->stats.rx_dropped++;
++			}
++		}
++
++		rxdesc->devcs = ((AR2313_BUFSIZE << DMA_RX1_BSIZE_SHIFT) |
++						 DMA_RX1_CHAINED);
++		rxdesc->status = DMA_RX_OWN;
++
++		idx = DSC_NEXT(idx);
++	}
++
++	sp->cur_rx = idx;
++
++	return rval;
++}
++
++static void ar231x_tx_int(struct net_device *dev)
++{
++	struct ar231x_private *sp = netdev_priv(dev);
++	u32 idx;
++	struct sk_buff *skb;
++	ar231x_descr_t *txdesc;
++	unsigned int status = 0;
++
++	idx = sp->tx_csm;
++
++	while (idx != sp->tx_prd) {
++		txdesc = &sp->tx_ring[idx];
++		status = txdesc->status;
++
++		if (status & DMA_TX_OWN) {
++			/* ar231x dma still owns descr */
++			break;
++		}
++		/* done with this descriptor */
++		dma_unmap_single(&sp->pdev->dev, txdesc->addr,
++				 txdesc->devcs & DMA_TX1_BSIZE_MASK,
++				 DMA_TO_DEVICE);
++		txdesc->status = 0;
++
++		if (status & DMA_TX_ERROR) {
++			dev->stats.tx_errors++;
++			dev->stats.tx_dropped++;
++			if (status & DMA_TX_ERR_UNDER)
++				dev->stats.tx_fifo_errors++;
++			if (status & DMA_TX_ERR_HB)
++				dev->stats.tx_heartbeat_errors++;
++			if (status & (DMA_TX_ERR_LOSS | DMA_TX_ERR_LINK))
++				dev->stats.tx_carrier_errors++;
++			if (status & (DMA_TX_ERR_LATE | DMA_TX_ERR_COL |
++			    DMA_TX_ERR_JABBER | DMA_TX_ERR_DEFER))
++				dev->stats.tx_aborted_errors++;
++		} else {
++			/* transmit OK */
++			dev->stats.tx_packets++;
++		}
++
++		skb = sp->tx_skb[idx];
++		sp->tx_skb[idx] = NULL;
++		idx = DSC_NEXT(idx);
++		dev->stats.tx_bytes += skb->len;
++		dev_kfree_skb_irq(skb);
++	}
++
++	sp->tx_csm = idx;
++}
++
++static void rx_tasklet_func(unsigned long data)
++{
++	struct net_device *dev = (struct net_device *)data;
++	struct ar231x_private *sp = netdev_priv(dev);
++
++	if (sp->unloading)
++		return;
++
++	if (ar231x_rx_int(dev)) {
++		tasklet_hi_schedule(&sp->rx_tasklet);
++	} else {
++		unsigned long flags;
++
++		spin_lock_irqsave(&sp->lock, flags);
++		sp->dma_regs->intr_ena |= DMA_STATUS_RI;
++		spin_unlock_irqrestore(&sp->lock, flags);
++	}
++}
++
++static void rx_schedule(struct net_device *dev)
++{
++	struct ar231x_private *sp = netdev_priv(dev);
++
++	sp->dma_regs->intr_ena &= ~DMA_STATUS_RI;
++
++	tasklet_hi_schedule(&sp->rx_tasklet);
++}
++
++static irqreturn_t ar231x_interrupt(int irq, void *dev_id)
++{
++	struct net_device *dev = (struct net_device *)dev_id;
++	struct ar231x_private *sp = netdev_priv(dev);
++	unsigned int status, enabled;
++
++	/* clear interrupt */
++	/* Don't clear RI bit if currently disabled */
++	status = sp->dma_regs->status;
++	enabled = sp->dma_regs->intr_ena;
++	sp->dma_regs->status = status & enabled;
++
++	if (status & DMA_STATUS_NIS) {
++		/* normal status */
++		/**
++		 * Don't schedule rx processing if interrupt
++		 * is already disabled.
++		 */
++		if (status & enabled & DMA_STATUS_RI) {
++			/* receive interrupt */
++			rx_schedule(dev);
++		}
++		if (status & DMA_STATUS_TI) {
++			/* transmit interrupt */
++			ar231x_tx_int(dev);
++		}
++	}
++
++	/* abnormal status */
++	if (status & (DMA_STATUS_FBE | DMA_STATUS_TPS))
++		ar231x_restart(dev);
++
++	return IRQ_HANDLED;
++}
++
++static int ar231x_open(struct net_device *dev)
++{
++	struct ar231x_private *sp = netdev_priv(dev);
++	unsigned int ethsal, ethsah;
++
++	/* reset the hardware, in case the MAC address changed */
++	ethsah = (((u_int) (dev->dev_addr[5]) << 8) & (u_int) 0x0000FF00) |
++		 (((u_int) (dev->dev_addr[4]) << 0) & (u_int) 0x000000FF);
++
++	ethsal = (((u_int) (dev->dev_addr[3]) << 24) & (u_int) 0xFF000000) |
++		 (((u_int) (dev->dev_addr[2]) << 16) & (u_int) 0x00FF0000) |
++		 (((u_int) (dev->dev_addr[1]) << 8) & (u_int) 0x0000FF00) |
++		 (((u_int) (dev->dev_addr[0]) << 0) & (u_int) 0x000000FF);
++
++	sp->eth_regs->mac_addr[0] = ethsah;
++	sp->eth_regs->mac_addr[1] = ethsal;
++
++	mdelay(10);
++
++	dev->mtu = 1500;
++	netif_start_queue(dev);
++
++	sp->eth_regs->mac_control |= MAC_CONTROL_RE;
++
++	phy_start(sp->phy_dev);
++
++	return 0;
++}
++
++static void ar231x_tx_timeout(struct net_device *dev, unsigned int txqueue)
++{
++	struct ar231x_private *sp = netdev_priv(dev);
++	unsigned long flags;
++
++	spin_lock_irqsave(&sp->lock, flags);
++	ar231x_restart(dev);
++	spin_unlock_irqrestore(&sp->lock, flags);
++}
++
++static void ar231x_halt(struct net_device *dev)
++{
++	struct ar231x_private *sp = netdev_priv(dev);
++	int j;
++
++	tasklet_disable(&sp->rx_tasklet);
++
++	/* kill the MAC */
++	sp->eth_regs->mac_control &= ~(MAC_CONTROL_RE |	/* disable Receives */
++				       MAC_CONTROL_TE);	/* disable Transmits */
++	/* stop dma */
++	sp->dma_regs->control = 0;
++	sp->dma_regs->bus_mode = DMA_BUS_MODE_SWR;
++
++	/* place phy and MAC in reset */
++	sp->cfg->reset_set(sp->cfg->reset_mac);
++	sp->cfg->reset_set(sp->cfg->reset_phy);
++
++	/* free buffers on tx ring */
++	for (j = 0; j < AR2313_DESCR_ENTRIES; j++) {
++		struct sk_buff *skb;
++		ar231x_descr_t *txdesc;
++
++		txdesc = &sp->tx_ring[j];
++		txdesc->descr = 0;
++
++		skb = sp->tx_skb[j];
++		if (skb) {
++			dev_kfree_skb(skb);
++			sp->tx_skb[j] = NULL;
++		}
++	}
++}
++
++/**
++ * close should do nothing. Here's why. It's called when
++ * 'ifconfig bond0 down' is run. If it calls free_irq then
++ * the irq is gone forever ! When bond0 is made 'up' again,
++ * the ar231x_open () does not call request_irq (). Worse,
++ * the call to ar231x_halt() generates a WDOG reset due to
++ * the write to reset register and the box reboots.
++ * Commenting this out is good since it allows the
++ * system to resume when bond0 is made up again.
++ */
++static int ar231x_close(struct net_device *dev)
++{
++	struct ar231x_private *sp = netdev_priv(dev);
++#if 0
++	/* Disable interrupts */
++	disable_irq(dev->irq);
++
++	/**
++	 * Without (or before) releasing irq and stopping hardware, this
++	 * is an absolute non-sense, by the way. It will be reset instantly
++	 * by the first irq.
++	 */
++	netif_stop_queue(dev);
++
++	/* stop the MAC and DMA engines */
++	ar231x_halt(dev);
++
++	/* release the interrupt */
++	free_irq(dev->irq, dev);
++
++#endif
++
++	phy_stop(sp->phy_dev);
++
++	return 0;
++}
++
++static int ar231x_start_xmit(struct sk_buff *skb, struct net_device *dev)
++{
++	struct ar231x_private *sp = netdev_priv(dev);
++	ar231x_descr_t *td;
++	u32 idx;
++
++	idx = sp->tx_prd;
++	td = &sp->tx_ring[idx];
++
++	if (td->status & DMA_TX_OWN) {
++		/* free skbuf and lie to the caller that we sent it out */
++		dev->stats.tx_dropped++;
++		dev_kfree_skb(skb);
++
++		/* restart transmitter in case locked */
++		sp->dma_regs->xmt_poll = 0;
++		return 0;
++	}
++
++	/* Setup the transmit descriptor. */
++	td->devcs = ((skb->len << DMA_TX1_BSIZE_SHIFT) |
++				 (DMA_TX1_LS | DMA_TX1_IC | DMA_TX1_CHAINED));
++	td->addr = dma_map_single(&sp->pdev->dev, skb->data, skb->len, DMA_TO_DEVICE);
++	td->status = DMA_TX_OWN;
++
++	/* kick transmitter last */
++	sp->dma_regs->xmt_poll = 0;
++
++	sp->tx_skb[idx] = skb;
++	idx = DSC_NEXT(idx);
++	sp->tx_prd = idx;
++
++	return 0;
++}
++
++static int ar231x_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
++{
++	struct ar231x_private *sp = netdev_priv(dev);
++
++	switch (cmd) {
++	case SIOCGMIIPHY:
++	case SIOCGMIIREG:
++	case SIOCSMIIREG:
++		return phy_mii_ioctl(sp->phy_dev, ifr, cmd);
++
++	default:
++		break;
++	}
++
++	return -EOPNOTSUPP;
++}
++
++static void ar231x_adjust_link(struct net_device *dev)
++{
++	struct ar231x_private *sp = netdev_priv(dev);
++	struct phy_device *phydev = sp->phy_dev;
++	u32 mc;
++
++	if (!phydev->link) {
++		if (sp->link) {
++			pr_info("%s: link down\n", dev->name);
++			sp->link = 0;
++		}
++		return;
++	}
++	sp->link = 1;
++
++	pr_info("%s: link up (%uMbps/%s duplex)\n", dev->name,
++		phydev->speed, phydev->duplex ? "full" : "half");
++
++	mc = sp->eth_regs->mac_control;
++	if (phydev->duplex)
++		mc = (mc | MAC_CONTROL_F) & ~MAC_CONTROL_DRO;
++	else
++		mc = (mc | MAC_CONTROL_DRO) & ~MAC_CONTROL_F;
++	sp->eth_regs->mac_control = mc;
++	sp->duplex = phydev->duplex;
++}
++
++#define MII_ADDR(phy, reg) \
++	((reg << MII_ADDR_REG_SHIFT) | (phy << MII_ADDR_PHY_SHIFT))
++
++static int
++ar231x_mdiobus_read(struct mii_bus *bus, int phy_addr, int regnum)
++{
++	struct net_device *const dev = bus->priv;
++	struct ar231x_private *sp = netdev_priv(dev);
++	volatile MII *ethernet = sp->phy_regs;
++
++	ethernet->mii_addr = MII_ADDR(phy_addr, regnum);
++	while (ethernet->mii_addr & MII_ADDR_BUSY)
++		;
++	return ethernet->mii_data >> MII_DATA_SHIFT;
++}
++
++static int
++ar231x_mdiobus_write(struct mii_bus *bus, int phy_addr, int regnum, u16 value)
++{
++	struct net_device *const dev = bus->priv;
++	struct ar231x_private *sp = netdev_priv(dev);
++	volatile MII *ethernet = sp->phy_regs;
++
++	while (ethernet->mii_addr & MII_ADDR_BUSY)
++		;
++	ethernet->mii_data = value << MII_DATA_SHIFT;
++	ethernet->mii_addr = MII_ADDR(phy_addr, regnum) | MII_ADDR_WRITE;
++
++	return 0;
++}
++
++static int ar231x_mdiobus_reset(struct mii_bus *bus)
++{
++	struct net_device *const dev = bus->priv;
++
++	ar231x_reset_reg(dev);
++
++	return 0;
++}
++
++static int ar231x_mdiobus_probe(struct net_device *dev)
++{
++	__ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
++	struct ar231x_private *const sp = netdev_priv(dev);
++	struct phy_device *phydev = NULL;
++
++	/* find the first (lowest address) PHY on the current MAC's MII bus */
++	phydev = phy_find_first(sp->mii_bus);
++	if (!phydev) {
++		printk(KERN_ERR "ar231x: %s: no PHY found\n", dev->name);
++		return -1;
++	}
++
++	/* now we are supposed to have a proper phydev, to attach to... */
++	BUG_ON(phydev->attached_dev);
++
++	phydev = phy_connect(dev, phydev_name(phydev), &ar231x_adjust_link,
++			     PHY_INTERFACE_MODE_MII);
++	if (IS_ERR(phydev)) {
++		printk(KERN_ERR "%s: Could not attach to PHY\n", dev->name);
++		return PTR_ERR(phydev);
++	}
++
++	/* mask with MAC supported features */
++	linkmode_set_bit_array(phy_10_100_features_array,
++			       ARRAY_SIZE(phy_10_100_features_array),
++			       mask);
++	linkmode_set_bit(ETHTOOL_LINK_MODE_Autoneg_BIT, mask);
++	linkmode_set_bit(ETHTOOL_LINK_MODE_MII_BIT, mask);
++	linkmode_set_bit(ETHTOOL_LINK_MODE_TP_BIT, mask);
++
++	linkmode_and(phydev->supported, phydev->supported, mask);
++	linkmode_copy(phydev->advertising, phydev->supported);
++
++	sp->phy_dev = phydev;
++
++	printk(KERN_INFO "%s: attached PHY driver [%s] (mii_bus:phy_addr=%s)\n",
++	       dev->name, phydev->drv->name, phydev_name(phydev));
++
++	return 0;
++}
++
+--- /dev/null
++++ b/drivers/net/ethernet/atheros/ar231x/ar231x.h
+@@ -0,0 +1,282 @@
++/*
++ * ar231x.h: Linux driver for the Atheros AR231x Ethernet device.
++ *
++ * Copyright (C) 2004 by Sameer Dekate <sdekate@arubanetworks.com>
++ * Copyright (C) 2006 Imre Kaloz <kaloz@openwrt.org>
++ * Copyright (C) 2006-2009 Felix Fietkau <nbd@nbd.name>
++ *
++ * Thanks to Atheros for providing hardware and documentation
++ * enabling me to write this driver.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ */
++
++#ifndef _AR2313_H_
++#define _AR2313_H_
++
++#include <linux/interrupt.h>
++#include <generated/autoconf.h>
++#include <linux/bitops.h>
++#include <ath25_platform.h>
++
++/* probe link timer - 5 secs */
++#define LINK_TIMER    (5*HZ)
++
++#define IS_DMA_TX_INT(X)   (((X) & (DMA_STATUS_TI)) != 0)
++#define IS_DMA_RX_INT(X)   (((X) & (DMA_STATUS_RI)) != 0)
++#define IS_DRIVER_OWNED(X) (((X) & (DMA_TX_OWN))    == 0)
++
++#define AR2313_TX_TIMEOUT (HZ/4)
++
++/* Rings */
++#define DSC_RING_ENTRIES_SIZE	(AR2313_DESCR_ENTRIES * sizeof(struct desc))
++#define DSC_NEXT(idx)	        ((idx + 1) & (AR2313_DESCR_ENTRIES - 1))
++
++#define AR2313_MBGET		2
++#define AR2313_MBSET		3
++#define AR2313_PCI_RECONFIG	4
++#define AR2313_PCI_DUMP		5
++#define AR2313_TEST_PANIC	6
++#define AR2313_TEST_NULLPTR	7
++#define AR2313_READ_DATA	8
++#define AR2313_WRITE_DATA	9
++#define AR2313_GET_VERSION	10
++#define AR2313_TEST_HANG	11
++#define AR2313_SYNC		12
++
++#define DMA_RX_ERR_CRC		BIT(1)
++#define DMA_RX_ERR_DRIB		BIT(2)
++#define DMA_RX_ERR_MII		BIT(3)
++#define DMA_RX_EV2		BIT(5)
++#define DMA_RX_ERR_COL		BIT(6)
++#define DMA_RX_LONG		BIT(7)
++#define DMA_RX_LS		BIT(8)	/* last descriptor */
++#define DMA_RX_FS		BIT(9)	/* first descriptor */
++#define DMA_RX_MF		BIT(10)	/* multicast frame */
++#define DMA_RX_ERR_RUNT		BIT(11)	/* runt frame */
++#define DMA_RX_ERR_LENGTH	BIT(12)	/* length error */
++#define DMA_RX_ERR_DESC		BIT(14)	/* descriptor error */
++#define DMA_RX_ERROR		BIT(15)	/* error summary */
++#define DMA_RX_LEN_MASK		0x3fff0000
++#define DMA_RX_LEN_SHIFT	16
++#define DMA_RX_FILT		BIT(30)
++#define DMA_RX_OWN		BIT(31)	/* desc owned by DMA controller */
++
++#define DMA_RX1_BSIZE_MASK	0x000007ff
++#define DMA_RX1_BSIZE_SHIFT	0
++#define DMA_RX1_CHAINED		BIT(24)
++#define DMA_RX1_RER		BIT(25)
++
++#define DMA_TX_ERR_UNDER	BIT(1)	/* underflow error */
++#define DMA_TX_ERR_DEFER	BIT(2)	/* excessive deferral */
++#define DMA_TX_COL_MASK		0x78
++#define DMA_TX_COL_SHIFT	3
++#define DMA_TX_ERR_HB		BIT(7)	/* hearbeat failure */
++#define DMA_TX_ERR_COL		BIT(8)	/* excessive collisions */
++#define DMA_TX_ERR_LATE		BIT(9)	/* late collision */
++#define DMA_TX_ERR_LINK		BIT(10)	/* no carrier */
++#define DMA_TX_ERR_LOSS		BIT(11)	/* loss of carrier */
++#define DMA_TX_ERR_JABBER	BIT(14)	/* transmit jabber timeout */
++#define DMA_TX_ERROR		BIT(15)	/* frame aborted */
++#define DMA_TX_OWN		BIT(31)	/* descr owned by DMA controller */
++
++#define DMA_TX1_BSIZE_MASK	0x000007ff
++#define DMA_TX1_BSIZE_SHIFT	0
++#define DMA_TX1_CHAINED		BIT(24)	/* chained descriptors */
++#define DMA_TX1_TER		BIT(25)	/* transmit end of ring */
++#define DMA_TX1_FS		BIT(29)	/* first segment */
++#define DMA_TX1_LS		BIT(30)	/* last segment */
++#define DMA_TX1_IC		BIT(31)	/* interrupt on completion */
++
++#define RCVPKT_LENGTH(X)	(X  >> 16)	/* Received pkt Length */
++
++#define MAC_CONTROL_RE		BIT(2)	/* receive enable */
++#define MAC_CONTROL_TE		BIT(3)	/* transmit enable */
++#define MAC_CONTROL_DC		BIT(5)	/* Deferral check */
++#define MAC_CONTROL_ASTP	BIT(8)	/* Auto pad strip */
++#define MAC_CONTROL_DRTY	BIT(10)	/* Disable retry */
++#define MAC_CONTROL_DBF		BIT(11)	/* Disable bcast frames */
++#define MAC_CONTROL_LCC		BIT(12)	/* late collision ctrl */
++#define MAC_CONTROL_HP		BIT(13)	/* Hash Perfect filtering */
++#define MAC_CONTROL_HASH	BIT(14)	/* Unicast hash filtering */
++#define MAC_CONTROL_HO		BIT(15)	/* Hash only filtering */
++#define MAC_CONTROL_PB		BIT(16)	/* Pass Bad frames */
++#define MAC_CONTROL_IF		BIT(17)	/* Inverse filtering */
++#define MAC_CONTROL_PR		BIT(18)	/* promis mode (valid frames only) */
++#define MAC_CONTROL_PM		BIT(19)	/* pass multicast */
++#define MAC_CONTROL_F		BIT(20)	/* full-duplex */
++#define MAC_CONTROL_DRO		BIT(23)	/* Disable Receive Own */
++#define MAC_CONTROL_HBD		BIT(28)	/* heart-beat disabled (MUST BE SET) */
++#define MAC_CONTROL_BLE		BIT(30)	/* big endian mode */
++#define MAC_CONTROL_RA		BIT(31)	/* rcv all (valid and invalid frames) */
++
++#define MII_ADDR_BUSY		BIT(0)
++#define MII_ADDR_WRITE		BIT(1)
++#define MII_ADDR_REG_SHIFT	6
++#define MII_ADDR_PHY_SHIFT	11
++#define MII_DATA_SHIFT		0
++
++#define FLOW_CONTROL_FCE	BIT(1)
++
++#define DMA_BUS_MODE_SWR	BIT(0)	/* software reset */
++#define DMA_BUS_MODE_BLE	BIT(7)	/* big endian mode */
++#define DMA_BUS_MODE_PBL_SHIFT	8	/* programmable burst length 32 */
++#define DMA_BUS_MODE_DBO	BIT(20)	/* big-endian descriptors */
++
++#define DMA_STATUS_TI		BIT(0)	/* transmit interrupt */
++#define DMA_STATUS_TPS		BIT(1)	/* transmit process stopped */
++#define DMA_STATUS_TU		BIT(2)	/* transmit buffer unavailable */
++#define DMA_STATUS_TJT		BIT(3)	/* transmit buffer timeout */
++#define DMA_STATUS_UNF		BIT(5)	/* transmit underflow */
++#define DMA_STATUS_RI		BIT(6)	/* receive interrupt */
++#define DMA_STATUS_RU		BIT(7)	/* receive buffer unavailable */
++#define DMA_STATUS_RPS		BIT(8)	/* receive process stopped */
++#define DMA_STATUS_ETI		BIT(10)	/* early transmit interrupt */
++#define DMA_STATUS_FBE		BIT(13)	/* fatal bus interrupt */
++#define DMA_STATUS_ERI		BIT(14)	/* early receive interrupt */
++#define DMA_STATUS_AIS		BIT(15)	/* abnormal interrupt summary */
++#define DMA_STATUS_NIS		BIT(16)	/* normal interrupt summary */
++#define DMA_STATUS_RS_SHIFT	17	/* receive process state */
++#define DMA_STATUS_TS_SHIFT	20	/* transmit process state */
++#define DMA_STATUS_EB_SHIFT	23	/* error bits */
++
++#define DMA_CONTROL_SR		BIT(1)	/* start receive */
++#define DMA_CONTROL_ST		BIT(13)	/* start transmit */
++#define DMA_CONTROL_SF		BIT(21)	/* store and forward */
++
++typedef struct {
++	volatile unsigned int status;	/* OWN, Device control and status. */
++	volatile unsigned int devcs;	/* pkt Control bits + Length */
++	volatile unsigned int addr;	/* Current Address. */
++	volatile unsigned int descr;	/* Next descriptor in chain. */
++} ar231x_descr_t;
++
++/**
++ * New Combo structure for Both Eth0 AND eth1
++ *
++ * Don't directly access MII related regs since phy chip could be actually
++ * connected to another ethernet block.
++ */
++typedef struct {
++	volatile unsigned int mac_control;	/* 0x00 */
++	volatile unsigned int mac_addr[2];	/* 0x04 - 0x08 */
++	volatile unsigned int mcast_table[2];	/* 0x0c - 0x10 */
++	volatile unsigned int __mii_addr;	/* 0x14 */
++	volatile unsigned int __mii_data;	/* 0x18 */
++	volatile unsigned int flow_control;	/* 0x1c */
++	volatile unsigned int vlan_tag;	/* 0x20 */
++	volatile unsigned int pad[7];	/* 0x24 - 0x3c */
++	volatile unsigned int ucast_table[8];	/* 0x40-0x5c */
++} ETHERNET_STRUCT;
++
++typedef struct {
++	volatile unsigned int mii_addr;
++	volatile unsigned int mii_data;
++} MII;
++
++/********************************************************************
++ * Interrupt controller
++ ********************************************************************/
++
++typedef struct {
++	volatile unsigned int wdog_control;	/* 0x08 */
++	volatile unsigned int wdog_timer;	/* 0x0c */
++	volatile unsigned int misc_status;	/* 0x10 */
++	volatile unsigned int misc_mask;	/* 0x14 */
++	volatile unsigned int global_status;	/* 0x18 */
++	volatile unsigned int reserved;	/* 0x1c */
++	volatile unsigned int reset_control;	/* 0x20 */
++} INTERRUPT;
++
++/********************************************************************
++ * DMA controller
++ ********************************************************************/
++typedef struct {
++	volatile unsigned int bus_mode;	/* 0x00 (CSR0) */
++	volatile unsigned int xmt_poll;	/* 0x04 (CSR1) */
++	volatile unsigned int rcv_poll;	/* 0x08 (CSR2) */
++	volatile unsigned int rcv_base;	/* 0x0c (CSR3) */
++	volatile unsigned int xmt_base;	/* 0x10 (CSR4) */
++	volatile unsigned int status;	/* 0x14 (CSR5) */
++	volatile unsigned int control;	/* 0x18 (CSR6) */
++	volatile unsigned int intr_ena;	/* 0x1c (CSR7) */
++	volatile unsigned int rcv_missed;	/* 0x20 (CSR8) */
++	volatile unsigned int reserved[11];	/* 0x24-0x4c (CSR9-19) */
++	volatile unsigned int cur_tx_buf_addr;	/* 0x50 (CSR20) */
++	volatile unsigned int cur_rx_buf_addr;	/* 0x50 (CSR21) */
++} DMA;
++
++/**
++ * Struct private for the Sibyte.
++ *
++ * Elements are grouped so variables used by the tx handling goes
++ * together, and will go into the same cache lines etc. in order to
++ * avoid cache line contention between the rx and tx handling on SMP.
++ *
++ * Frequently accessed variables are put at the beginning of the
++ * struct to help the compiler generate better/shorter code.
++ */
++struct ar231x_private {
++	struct net_device *dev;
++	struct platform_device *pdev;
++	int version;
++	u32 mb[2];
++
++	volatile MII *phy_regs;
++	volatile ETHERNET_STRUCT *eth_regs;
++	volatile DMA *dma_regs;
++	struct ar231x_eth *cfg;
++
++	spinlock_t lock;			/* Serialise access to device */
++
++	/* RX and TX descriptors, must be adjacent */
++	ar231x_descr_t *rx_ring;
++	ar231x_descr_t *tx_ring;
++
++	struct sk_buff **rx_skb;
++	struct sk_buff **tx_skb;
++
++	/* RX elements */
++	u32 rx_skbprd;
++	u32 cur_rx;
++
++	/* TX elements */
++	u32 tx_prd;
++	u32 tx_csm;
++
++	/* Misc elements */
++	char name[48];
++	struct {
++		u32 address;
++		u32 length;
++		char *mapping;
++	} desc;
++
++	unsigned short link;		/* 0 - link down, 1 - link up */
++	unsigned short duplex;		/* 0 - half, 1 - full */
++
++	struct tasklet_struct rx_tasklet;
++	int unloading;
++
++	struct phy_device *phy_dev;
++	struct mii_bus *mii_bus;
++};
++
++/* Prototypes */
++static int ar231x_init(struct net_device *dev);
++#ifdef TX_TIMEOUT
++static void ar231x_tx_timeout(struct net_device *dev);
++#endif
++static int ar231x_restart(struct net_device *dev);
++static void ar231x_load_rx_ring(struct net_device *dev, int bufs);
++static irqreturn_t ar231x_interrupt(int irq, void *dev_id);
++static int ar231x_open(struct net_device *dev);
++static int ar231x_start_xmit(struct sk_buff *skb, struct net_device *dev);
++static int ar231x_close(struct net_device *dev);
++static int ar231x_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd);
++static void ar231x_init_cleanup(struct net_device *dev);
++
++#endif	/* _AR2313_H_ */
+--- a/arch/mips/ath25/ar2315_regs.h
++++ b/arch/mips/ath25/ar2315_regs.h
+@@ -57,6 +57,9 @@
+ #define AR2315_PCI_EXT_BASE	0x80000000	/* PCI external */
+ #define AR2315_PCI_EXT_SIZE	0x40000000
+ 
++/* MII registers offset inside Ethernet MMR region */
++#define AR2315_ENET0_MII_BASE	(AR2315_ENET0_BASE + 0x14)
++
+ /*
+  * Configuration registers
+  */
+--- a/arch/mips/ath25/ar5312_regs.h
++++ b/arch/mips/ath25/ar5312_regs.h
+@@ -64,6 +64,10 @@
+ #define AR5312_AR5312_REV7	0x0057		/* AR5312 WMAC (AP30-040) */
+ #define AR5312_AR2313_REV8	0x0058		/* AR2313 WMAC (AP43-030) */
+ 
++/* MII registers offset inside Ethernet MMR region */
++#define AR5312_ENET0_MII_BASE	(AR5312_ENET0_BASE + 0x14)
++#define AR5312_ENET1_MII_BASE	(AR5312_ENET1_BASE + 0x14)
++
+ /* Reset/Timer Block Address Map */
+ #define AR5312_TIMER		0x0000 /* countdown timer */
+ #define AR5312_RELOAD		0x0004 /* timer reload value */
+--- a/arch/mips/ath25/ar2315.c
++++ b/arch/mips/ath25/ar2315.c
+@@ -132,6 +132,8 @@ static void ar2315_irq_dispatch(void)
+ 
+ 	if (pending & CAUSEF_IP3)
+ 		do_IRQ(AR2315_IRQ_WLAN0);
++	else if (pending & CAUSEF_IP4)
++		do_IRQ(AR2315_IRQ_ENET0);
+ #ifdef CONFIG_PCI_AR2315
+ 	else if (pending & CAUSEF_IP5)
+ 		do_IRQ(AR2315_IRQ_LCBUS_PCI);
+@@ -167,6 +169,29 @@ void __init ar2315_arch_init_irq(void)
+ 	ar2315_misc_irq_domain = domain;
+ }
+ 
++static void ar2315_device_reset_set(u32 mask)
++{
++	u32 val;
++
++	val = ar2315_rst_reg_read(AR2315_RESET);
++	ar2315_rst_reg_write(AR2315_RESET, val | mask);
++}
++
++static void ar2315_device_reset_clear(u32 mask)
++{
++	u32 val;
++
++	val = ar2315_rst_reg_read(AR2315_RESET);
++	ar2315_rst_reg_write(AR2315_RESET, val & ~mask);
++}
++
++static struct ar231x_eth ar2315_eth_data = {
++	.reset_set = ar2315_device_reset_set,
++	.reset_clear = ar2315_device_reset_clear,
++	.reset_mac = AR2315_RESET_ENET0,
++	.reset_phy = AR2315_RESET_EPHY0,
++};
++
+ static struct resource ar2315_gpio_res[] = {
+ 	{
+ 		.name = "ar2315-gpio",
+@@ -203,6 +228,11 @@ void __init ar2315_init_devices(void)
+ 	ar2315_gpio_res[1].end = ar2315_gpio_res[1].start;
+ 	platform_device_register(&ar2315_gpio);
+ 
++	ar2315_eth_data.macaddr = ath25_board.config->enet0_mac;
++	ath25_add_ethernet(0, AR2315_ENET0_BASE, "eth0_mii",
++			   AR2315_ENET0_MII_BASE, AR2315_IRQ_ENET0,
++			   &ar2315_eth_data);
++
+ 	ath25_add_wmac(0, AR2315_WLAN0_BASE, AR2315_IRQ_WLAN0);
+ }
+ 
+--- a/arch/mips/ath25/ar5312.c
++++ b/arch/mips/ath25/ar5312.c
+@@ -127,6 +127,10 @@ static void ar5312_irq_dispatch(void)
+ 
+ 	if (pending & CAUSEF_IP2)
+ 		do_IRQ(AR5312_IRQ_WLAN0);
++	else if (pending & CAUSEF_IP3)
++		do_IRQ(AR5312_IRQ_ENET0);
++	else if (pending & CAUSEF_IP4)
++		do_IRQ(AR5312_IRQ_ENET1);
+ 	else if (pending & CAUSEF_IP5)
+ 		do_IRQ(AR5312_IRQ_WLAN1);
+ 	else if (pending & CAUSEF_IP6)
+@@ -160,6 +164,36 @@ void __init ar5312_arch_init_irq(void)
+ 	ar5312_misc_irq_domain = domain;
+ }
+ 
++static void ar5312_device_reset_set(u32 mask)
++{
++	u32 val;
++
++	val = ar5312_rst_reg_read(AR5312_RESET);
++	ar5312_rst_reg_write(AR5312_RESET, val | mask);
++}
++
++static void ar5312_device_reset_clear(u32 mask)
++{
++	u32 val;
++
++	val = ar5312_rst_reg_read(AR5312_RESET);
++	ar5312_rst_reg_write(AR5312_RESET, val & ~mask);
++}
++
++static struct ar231x_eth ar5312_eth0_data = {
++	.reset_set = ar5312_device_reset_set,
++	.reset_clear = ar5312_device_reset_clear,
++	.reset_mac = AR5312_RESET_ENET0,
++	.reset_phy = AR5312_RESET_EPHY0,
++};
++
++static struct ar231x_eth ar5312_eth1_data = {
++	.reset_set = ar5312_device_reset_set,
++	.reset_clear = ar5312_device_reset_clear,
++	.reset_mac = AR5312_RESET_ENET1,
++	.reset_phy = AR5312_RESET_EPHY1,
++};
++
+ static struct physmap_flash_data ar5312_flash_data = {
+ 	.width = 2,
+ };
+@@ -240,6 +274,7 @@ static void __init ar5312_flash_init(voi
+ void __init ar5312_init_devices(void)
+ {
+ 	struct ath25_boarddata *config;
++	u8 *c;
+ 
+ 	ar5312_flash_init();
+ 
+@@ -263,8 +298,30 @@ void __init ar5312_init_devices(void)
+ 
+ 	platform_device_register(&ar5312_gpio);
+ 
++	/* Fix up MAC addresses if necessary */
++	if (is_broadcast_ether_addr(config->enet0_mac))
++		ether_addr_copy(config->enet0_mac, config->enet1_mac);
++
++	/* If ENET0 and ENET1 have the same mac address,
++	 * increment the one from ENET1 */
++	if (ether_addr_equal(config->enet0_mac, config->enet1_mac)) {
++		c = config->enet1_mac + 5;
++		while ((c >= config->enet1_mac) && !(++(*c)))
++			c--;
++	}
++
+ 	switch (ath25_soc) {
+ 	case ATH25_SOC_AR5312:
++		ar5312_eth0_data.macaddr = config->enet0_mac;
++		ath25_add_ethernet(0, AR5312_ENET0_BASE, "eth0_mii",
++				   AR5312_ENET0_MII_BASE, AR5312_IRQ_ENET0,
++				   &ar5312_eth0_data);
++
++		ar5312_eth1_data.macaddr = config->enet1_mac;
++		ath25_add_ethernet(1, AR5312_ENET1_BASE, "eth1_mii",
++				   AR5312_ENET1_MII_BASE, AR5312_IRQ_ENET1,
++				   &ar5312_eth1_data);
++
+ 		if (!ath25_board.radio)
+ 			return;
+ 
+@@ -273,8 +330,18 @@ void __init ar5312_init_devices(void)
+ 
+ 		ath25_add_wmac(0, AR5312_WLAN0_BASE, AR5312_IRQ_WLAN0);
+ 		break;
++	/*
++	 * AR2312/3 ethernet uses the PHY of ENET0, but the MAC
++	 * of ENET1. Atheros calls it 'twisted' for a reason :)
++	 */
+ 	case ATH25_SOC_AR2312:
+ 	case ATH25_SOC_AR2313:
++		ar5312_eth1_data.reset_phy = ar5312_eth0_data.reset_phy;
++		ar5312_eth1_data.macaddr = config->enet0_mac;
++		ath25_add_ethernet(1, AR5312_ENET1_BASE, "eth0_mii",
++				   AR5312_ENET0_MII_BASE, AR5312_IRQ_ENET1,
++				   &ar5312_eth1_data);
++
+ 		if (!ath25_board.radio)
+ 			return;
+ 		break;
+--- a/arch/mips/ath25/devices.h
++++ b/arch/mips/ath25/devices.h
+@@ -33,6 +33,8 @@ extern struct ar231x_board_config ath25_
+ extern void (*ath25_irq_dispatch)(void);
+ 
+ int ath25_find_config(phys_addr_t offset, unsigned long size);
++int ath25_add_ethernet(int nr, u32 base, const char *mii_name, u32 mii_base,
++		       int irq, void *pdata);
+ void ath25_serial_setup(u32 mapbase, int irq, unsigned int uartclk);
+ int ath25_add_wmac(int nr, u32 base, int irq);
+ 
+--- a/arch/mips/ath25/devices.c
++++ b/arch/mips/ath25/devices.c
+@@ -13,6 +13,51 @@
+ struct ar231x_board_config ath25_board;
+ enum ath25_soc_type ath25_soc = ATH25_SOC_UNKNOWN;
+ 
++static struct resource ath25_eth0_res[] = {
++	{
++		.name = "eth0_membase",
++		.flags = IORESOURCE_MEM,
++	},
++	{
++		.name = "eth0_mii",
++		.flags = IORESOURCE_MEM,
++	},
++	{
++		.name = "eth0_irq",
++		.flags = IORESOURCE_IRQ,
++	}
++};
++
++static struct resource ath25_eth1_res[] = {
++	{
++		.name = "eth1_membase",
++		.flags = IORESOURCE_MEM,
++	},
++	{
++		.name = "eth1_mii",
++		.flags = IORESOURCE_MEM,
++	},
++	{
++		.name = "eth1_irq",
++		.flags = IORESOURCE_IRQ,
++	}
++};
++
++static struct platform_device ath25_eth[] = {
++	{
++		.id = 0,
++		.name = "ar231x-eth",
++		.resource = ath25_eth0_res,
++		.num_resources = ARRAY_SIZE(ath25_eth0_res)
++	},
++	{
++		.id = 1,
++		.name = "ar231x-eth",
++		.resource = ath25_eth1_res,
++		.num_resources = ARRAY_SIZE(ath25_eth1_res)
++	}
++};
++
+ static struct resource ath25_wmac0_res[] = {
+ 	{
+ 		.name = "wmac0_membase",
+@@ -71,6 +116,25 @@ const char *get_system_type(void)
+ 	return soc_type_strings[ath25_soc];
+ }
+ 
++int __init ath25_add_ethernet(int nr, u32 base, const char *mii_name,
++			      u32 mii_base, int irq, void *pdata)
++{
++	struct resource *res;
++
++	ath25_eth[nr].dev.platform_data = pdata;
++	res = &ath25_eth[nr].resource[0];
++	res->start = base;
++	res->end = base + 0x2000 - 1;
++	res++;
++	res->name = mii_name;
++	res->start = mii_base;
++	res->end = mii_base + 8 - 1;
++	res++;
++	res->start = irq;
++	res->end = irq;
++	return platform_device_register(&ath25_eth[nr]);
++}
++
+ void __init ath25_serial_setup(u32 mapbase, int irq, unsigned int uartclk)
+ {
+ #ifdef CONFIG_SERIAL_8250_CONSOLE
+--- a/arch/mips/include/asm/mach-ath25/ath25_platform.h
++++ b/arch/mips/include/asm/mach-ath25/ath25_platform.h
+@@ -71,4 +71,15 @@ struct ar231x_board_config {
+ 	const char *radio;
+ };
+ 
++/*
++ * Platform device information for the Ethernet MAC
++ */
++struct ar231x_eth {
++	void (*reset_set)(u32);
++	void (*reset_clear)(u32);
++	u32 reset_mac;
++	u32 reset_phy;
++	char *macaddr;
++};
++
+ #endif /* __ASM_MACH_ATH25_PLATFORM_H */
diff --git a/target/linux/ath25/patches-5.15/120-spiflash.patch b/target/linux/ath25/patches-5.15/120-spiflash.patch
new file mode 100644
index 00000000000000..b7a9607ac9b473
--- /dev/null
+++ b/target/linux/ath25/patches-5.15/120-spiflash.patch
@@ -0,0 +1,631 @@
+--- a/drivers/mtd/devices/Kconfig
++++ b/drivers/mtd/devices/Kconfig
+@@ -120,6 +120,10 @@ config MTD_BCM47XXSFLASH
+ 	  registered by bcma as platform devices. This enables driver for
+ 	  serial flash memories.
+ 
++config MTD_AR2315
++	tristate "Atheros AR2315+ SPI Flash support"
++	depends on SOC_AR2315
++
+ config MTD_SLRAM
+ 	tristate "Uncached system RAM"
+ 	help
+--- a/drivers/mtd/devices/Makefile
++++ b/drivers/mtd/devices/Makefile
+@@ -16,6 +16,7 @@ obj-$(CONFIG_MTD_MCHP23K256)	+= mchp23k2
+ obj-$(CONFIG_MTD_MCHP48L640)	+= mchp48l640.o
+ obj-$(CONFIG_MTD_SPEAR_SMI)	+= spear_smi.o
+ obj-$(CONFIG_MTD_SST25L)	+= sst25l.o
++obj-$(CONFIG_MTD_AR2315)	+= ar2315.o
+ obj-$(CONFIG_MTD_BCM47XXSFLASH)	+= bcm47xxsflash.o
+ obj-$(CONFIG_MTD_ST_SPI_FSM)    += st_spi_fsm.o
+ obj-$(CONFIG_MTD_POWERNV_FLASH)	+= powernv_flash.o
+--- /dev/null
++++ b/drivers/mtd/devices/ar2315.c
+@@ -0,0 +1,456 @@
++
++/*
++ * MTD driver for the SPI Flash Memory support on Atheros AR2315
++ *
++ * Copyright (c) 2005-2006 Atheros Communications Inc.
++ * Copyright (C) 2006-2007 FON Technology, SL.
++ * Copyright (C) 2006-2007 Imre Kaloz <kaloz@openwrt.org>
++ * Copyright (C) 2006-2009 Felix Fietkau <nbd@nbd.name>
++ * Copyright (C) 2012 Alexandros C. Couloumbis <alex@ozo.com>
++ *
++ * This code is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/types.h>
++#include <linux/errno.h>
++#include <linux/slab.h>
++#include <linux/mtd/mtd.h>
++#include <linux/mtd/partitions.h>
++#include <linux/platform_device.h>
++#include <linux/sched.h>
++#include <linux/delay.h>
++#include <linux/io.h>
++#include <linux/mutex.h>
++
++#include "ar2315_spiflash.h"
++
++#define DRIVER_NAME "ar2315-spiflash"
++
++#define busy_wait(_priv, _condition, _wait) do { \
++	while (_condition) { \
++		if (_wait > 1) \
++			msleep(_wait); \
++		else if ((_wait == 1) && need_resched()) \
++			schedule(); \
++		else \
++			udelay(1); \
++	} \
++} while (0)
++
++enum {
++	FLASH_NONE,
++	FLASH_1MB,
++	FLASH_2MB,
++	FLASH_4MB,
++	FLASH_8MB,
++	FLASH_16MB,
++};
++
++/* Flash configuration table */
++struct flashconfig {
++	u32 byte_cnt;
++	u32 sector_cnt;
++	u32 sector_size;
++};
++
++static const struct flashconfig flashconfig_tbl[] = {
++	[FLASH_NONE] = { 0, 0, 0},
++	[FLASH_1MB]  = { STM_1MB_BYTE_COUNT, STM_1MB_SECTOR_COUNT,
++			 STM_1MB_SECTOR_SIZE},
++	[FLASH_2MB]  = { STM_2MB_BYTE_COUNT, STM_2MB_SECTOR_COUNT,
++			 STM_2MB_SECTOR_SIZE},
++	[FLASH_4MB]  = { STM_4MB_BYTE_COUNT, STM_4MB_SECTOR_COUNT,
++			 STM_4MB_SECTOR_SIZE},
++	[FLASH_8MB]  = { STM_8MB_BYTE_COUNT, STM_8MB_SECTOR_COUNT,
++			 STM_8MB_SECTOR_SIZE},
++	[FLASH_16MB] = { STM_16MB_BYTE_COUNT, STM_16MB_SECTOR_COUNT,
++			 STM_16MB_SECTOR_SIZE}
++};
++
++/* Mapping of generic opcodes to STM serial flash opcodes */
++enum {
++	SPI_WRITE_ENABLE,
++	SPI_WRITE_DISABLE,
++	SPI_RD_STATUS,
++	SPI_WR_STATUS,
++	SPI_RD_DATA,
++	SPI_FAST_RD_DATA,
++	SPI_PAGE_PROGRAM,
++	SPI_SECTOR_ERASE,
++	SPI_BULK_ERASE,
++	SPI_DEEP_PWRDOWN,
++	SPI_RD_SIG,
++};
++
++struct opcodes {
++	__u16 code;
++	__s8 tx_cnt;
++	__s8 rx_cnt;
++};
++
++static const struct opcodes stm_opcodes[] = {
++	[SPI_WRITE_ENABLE] = {STM_OP_WR_ENABLE, 1, 0},
++	[SPI_WRITE_DISABLE] = {STM_OP_WR_DISABLE, 1, 0},
++	[SPI_RD_STATUS] = {STM_OP_RD_STATUS, 1, 1},
++	[SPI_WR_STATUS] = {STM_OP_WR_STATUS, 1, 0},
++	[SPI_RD_DATA] = {STM_OP_RD_DATA, 4, 4},
++	[SPI_FAST_RD_DATA] = {STM_OP_FAST_RD_DATA, 5, 0},
++	[SPI_PAGE_PROGRAM] = {STM_OP_PAGE_PGRM, 8, 0},
++	[SPI_SECTOR_ERASE] = {STM_OP_SECTOR_ERASE, 4, 0},
++	[SPI_BULK_ERASE] = {STM_OP_BULK_ERASE, 1, 0},
++	[SPI_DEEP_PWRDOWN] = {STM_OP_DEEP_PWRDOWN, 1, 0},
++	[SPI_RD_SIG] = {STM_OP_RD_SIG, 4, 1},
++};
++
++/* Driver private data structure */
++struct spiflash_priv {
++	struct mtd_info mtd;
++	void __iomem *readaddr; /* memory mapped data for read  */
++	void __iomem *mmraddr;  /* memory mapped register space */
++	struct mutex lock;	/* serialize registers access */
++};
++
++#define to_spiflash(_mtd) container_of(_mtd, struct spiflash_priv, mtd)
++
++enum {
++	FL_READY,
++	FL_READING,
++	FL_ERASING,
++	FL_WRITING
++};
++
++/*****************************************************************************/
++
++static u32
++spiflash_read_reg(struct spiflash_priv *priv, int reg)
++{
++	return ioread32(priv->mmraddr + reg);
++}
++
++static void
++spiflash_write_reg(struct spiflash_priv *priv, int reg, u32 data)
++{
++	iowrite32(data, priv->mmraddr + reg);
++}
++
++static u32
++spiflash_wait_busy(struct spiflash_priv *priv)
++{
++	u32 reg;
++
++	busy_wait(priv, (reg = spiflash_read_reg(priv, SPI_FLASH_CTL)) &
++		SPI_CTL_BUSY, 0);
++	return reg;
++}
++
++static u32
++spiflash_sendcmd(struct spiflash_priv *priv, int opcode, u32 addr)
++{
++	const struct opcodes *op;
++	u32 reg, mask;
++
++	op = &stm_opcodes[opcode];
++	reg = spiflash_wait_busy(priv);
++	spiflash_write_reg(priv, SPI_FLASH_OPCODE,
++			   ((u32)op->code) | (addr << 8));
++
++	reg &= ~SPI_CTL_TX_RX_CNT_MASK;
++	reg |= SPI_CTL_START | op->tx_cnt | (op->rx_cnt << 4);
++
++	spiflash_write_reg(priv, SPI_FLASH_CTL, reg);
++	spiflash_wait_busy(priv);
++
++	if (!op->rx_cnt)
++		return 0;
++
++	reg = spiflash_read_reg(priv, SPI_FLASH_DATA);
++
++	switch (op->rx_cnt) {
++	case 1:
++		mask = 0x000000ff;
++		break;
++	case 2:
++		mask = 0x0000ffff;
++		break;
++	case 3:
++		mask = 0x00ffffff;
++		break;
++	default:
++		mask = 0xffffffff;
++		break;
++	}
++	reg &= mask;
++
++	return reg;
++}
++
++/*
++ * Probe SPI flash device
++ * Function returns 0 for failure.
++ * and flashconfig_tbl array index for success.
++ */
++static int
++spiflash_probe_chip(struct platform_device *pdev, struct spiflash_priv *priv)
++{
++	u32 sig = spiflash_sendcmd(priv, SPI_RD_SIG, 0);
++	int flash_size;
++
++	switch (sig) {
++	case STM_8MBIT_SIGNATURE:
++		flash_size = FLASH_1MB;
++		break;
++	case STM_16MBIT_SIGNATURE:
++		flash_size = FLASH_2MB;
++		break;
++	case STM_32MBIT_SIGNATURE:
++		flash_size = FLASH_4MB;
++		break;
++	case STM_64MBIT_SIGNATURE:
++		flash_size = FLASH_8MB;
++		break;
++	case STM_128MBIT_SIGNATURE:
++		flash_size = FLASH_16MB;
++		break;
++	default:
++		dev_warn(&pdev->dev, "read of flash device signature failed!\n");
++		return 0;
++	}
++
++	return flash_size;
++}
++
++static void
++spiflash_wait_complete(struct spiflash_priv *priv, unsigned int timeout)
++{
++	busy_wait(priv, spiflash_sendcmd(priv, SPI_RD_STATUS, 0) &
++		SPI_STATUS_WIP, timeout);
++}
++
++static int
++spiflash_erase(struct mtd_info *mtd, struct erase_info *instr)
++{
++	struct spiflash_priv *priv = to_spiflash(mtd);
++	const struct opcodes *op;
++	u32 temp, reg;
++
++	if (instr->addr + instr->len > mtd->size)
++		return -EINVAL;
++
++	mutex_lock(&priv->lock);
++
++	spiflash_sendcmd(priv, SPI_WRITE_ENABLE, 0);
++	reg = spiflash_wait_busy(priv);
++
++	op = &stm_opcodes[SPI_SECTOR_ERASE];
++	temp = ((u32)instr->addr << 8) | (u32)(op->code);
++	spiflash_write_reg(priv, SPI_FLASH_OPCODE, temp);
++
++	reg &= ~SPI_CTL_TX_RX_CNT_MASK;
++	reg |= op->tx_cnt | SPI_CTL_START;
++	spiflash_write_reg(priv, SPI_FLASH_CTL, reg);
++
++	spiflash_wait_complete(priv, 20);
++
++	mutex_unlock(&priv->lock);
++
++	return 0;
++}
++
++static int
++spiflash_read(struct mtd_info *mtd, loff_t from, size_t len, size_t *retlen,
++	      u_char *buf)
++{
++	struct spiflash_priv *priv = to_spiflash(mtd);
++
++	if (!len)
++		return 0;
++
++	if (from + len > mtd->size)
++		return -EINVAL;
++
++	*retlen = len;
++
++	mutex_lock(&priv->lock);
++
++	memcpy_fromio(buf, priv->readaddr + from, len);
++
++	mutex_unlock(&priv->lock);
++
++	return 0;
++}
++
++static int
++spiflash_write(struct mtd_info *mtd, loff_t to, size_t len, size_t *retlen,
++	       const u8 *buf)
++{
++	struct spiflash_priv *priv = to_spiflash(mtd);
++	u32 opcode, bytes_left;
++
++	*retlen = 0;
++
++	if (!len)
++		return 0;
++
++	if (to + len > mtd->size)
++		return -EINVAL;
++
++	bytes_left = len;
++
++	do {
++		u32 read_len, reg, page_offset, spi_data = 0;
++
++		read_len = min(bytes_left, sizeof(u32));
++
++		/* 32-bit writes cannot span across a page boundary
++		 * (256 bytes). This types of writes require two page
++		 * program operations to handle it correctly. The STM part
++		 * will write the overflow data to the beginning of the
++		 * current page as opposed to the subsequent page.
++		 */
++		page_offset = (to & (STM_PAGE_SIZE - 1)) + read_len;
++
++		if (page_offset > STM_PAGE_SIZE)
++			read_len -= (page_offset - STM_PAGE_SIZE);
++
++		mutex_lock(&priv->lock);
++
++		spiflash_sendcmd(priv, SPI_WRITE_ENABLE, 0);
++		spi_data = 0;
++		switch (read_len) {
++		case 4:
++			spi_data |= buf[3] << 24;
++			fallthrough;
++		case 3:
++			spi_data |= buf[2] << 16;
++			fallthrough;
++		case 2:
++			spi_data |= buf[1] << 8;
++			fallthrough;
++		case 1:
++			spi_data |= buf[0] & 0xff;
++			break;
++		default:
++			break;
++		}
++
++		spiflash_write_reg(priv, SPI_FLASH_DATA, spi_data);
++		opcode = stm_opcodes[SPI_PAGE_PROGRAM].code |
++			(to & 0x00ffffff) << 8;
++		spiflash_write_reg(priv, SPI_FLASH_OPCODE, opcode);
++
++		reg = spiflash_read_reg(priv, SPI_FLASH_CTL);
++		reg &= ~SPI_CTL_TX_RX_CNT_MASK;
++		reg |= (read_len + 4) | SPI_CTL_START;
++		spiflash_write_reg(priv, SPI_FLASH_CTL, reg);
++
++		spiflash_wait_complete(priv, 1);
++
++		mutex_unlock(&priv->lock);
++
++		bytes_left -= read_len;
++		to += read_len;
++		buf += read_len;
++
++		*retlen += read_len;
++	} while (bytes_left != 0);
++
++	return 0;
++}
++
++#if defined CONFIG_MTD_REDBOOT_PARTS || CONFIG_MTD_MYLOADER_PARTS
++static const char * const part_probe_types[] = {
++	"cmdlinepart", "RedBoot", "MyLoader", NULL
++};
++#endif
++
++static int
++spiflash_probe(struct platform_device *pdev)
++{
++	struct spiflash_priv *priv;
++	struct mtd_info *mtd;
++	struct resource *res;
++	int index;
++	int result = 0;
++
++	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	mutex_init(&priv->lock);
++	mtd = &priv->mtd;
++
++	res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
++	priv->mmraddr = devm_ioremap_resource(&pdev->dev, res);
++	if (IS_ERR(priv->mmraddr)) {
++		dev_warn(&pdev->dev, "failed to map flash MMR\n");
++		return PTR_ERR(priv->mmraddr);
++	}
++
++	index = spiflash_probe_chip(pdev, priv);
++	if (!index) {
++		dev_warn(&pdev->dev, "found no flash device\n");
++		return -ENODEV;
++	}
++
++	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	priv->readaddr = devm_ioremap_resource(&pdev->dev, res);
++	if (IS_ERR(priv->readaddr)) {
++		dev_warn(&pdev->dev, "failed to map flash read mem\n");
++		return PTR_ERR(priv->readaddr);
++	}
++
++	platform_set_drvdata(pdev, priv);
++	mtd->name = "spiflash";
++	mtd->type = MTD_NORFLASH;
++	mtd->flags = (MTD_CAP_NORFLASH|MTD_WRITEABLE);
++	mtd->size = flashconfig_tbl[index].byte_cnt;
++	mtd->erasesize = flashconfig_tbl[index].sector_size;
++	mtd->writesize = 1;
++	mtd->numeraseregions = 0;
++	mtd->eraseregions = NULL;
++	mtd->_erase = spiflash_erase;
++	mtd->_read = spiflash_read;
++	mtd->_write = spiflash_write;
++	mtd->owner = THIS_MODULE;
++
++	dev_info(&pdev->dev, "%lld Kbytes flash detected\n", mtd->size >> 10);
++
++#if defined CONFIG_MTD_REDBOOT_PARTS || CONFIG_MTD_MYLOADER_PARTS
++	/* parse redboot partitions */
++
++	result = mtd_device_parse_register(mtd, part_probe_types,
++					   NULL, NULL, 0);
++#endif
++
++	return result;
++}
++
++static int
++spiflash_remove(struct platform_device *pdev)
++{
++	struct spiflash_priv *priv = platform_get_drvdata(pdev);
++
++	mtd_device_unregister(&priv->mtd);
++
++	return 0;
++}
++
++static struct platform_driver spiflash_driver = {
++	.driver.name = DRIVER_NAME,
++	.probe = spiflash_probe,
++	.remove = spiflash_remove,
++};
++
++module_platform_driver(spiflash_driver);
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("OpenWrt.org");
++MODULE_AUTHOR("Atheros Communications Inc");
++MODULE_DESCRIPTION("MTD driver for SPI Flash on Atheros AR2315+ SOC");
++MODULE_ALIAS("platform:" DRIVER_NAME);
++
+--- /dev/null
++++ b/drivers/mtd/devices/ar2315_spiflash.h
+@@ -0,0 +1,106 @@
++/*
++ * Atheros AR2315 SPI Flash Memory support header file.
++ *
++ * Copyright (c) 2005, Atheros Communications Inc.
++ * Copyright (C) 2006 FON Technology, SL.
++ * Copyright (C) 2006 Imre Kaloz <kaloz@openwrt.org>
++ * Copyright (C) 2006-2009 Felix Fietkau <nbd@nbd.name>
++ *
++ * This code is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ */
++#ifndef __AR2315_SPIFLASH_H
++#define __AR2315_SPIFLASH_H
++
++#define STM_PAGE_SIZE           256
++
++#define SFI_WRITE_BUFFER_SIZE   4
++#define SFI_FLASH_ADDR_MASK     0x00ffffff
++
++#define STM_8MBIT_SIGNATURE     0x13
++#define STM_M25P80_BYTE_COUNT   1048576
++#define STM_M25P80_SECTOR_COUNT 16
++#define STM_M25P80_SECTOR_SIZE  0x10000
++
++#define STM_16MBIT_SIGNATURE    0x14
++#define STM_M25P16_BYTE_COUNT   2097152
++#define STM_M25P16_SECTOR_COUNT 32
++#define STM_M25P16_SECTOR_SIZE  0x10000
++
++#define STM_32MBIT_SIGNATURE    0x15
++#define STM_M25P32_BYTE_COUNT   4194304
++#define STM_M25P32_SECTOR_COUNT 64
++#define STM_M25P32_SECTOR_SIZE  0x10000
++
++#define STM_64MBIT_SIGNATURE    0x16
++#define STM_M25P64_BYTE_COUNT   8388608
++#define STM_M25P64_SECTOR_COUNT 128
++#define STM_M25P64_SECTOR_SIZE  0x10000
++
++#define STM_128MBIT_SIGNATURE   0x17
++#define STM_M25P128_BYTE_COUNT   16777216
++#define STM_M25P128_SECTOR_COUNT 256
++#define STM_M25P128_SECTOR_SIZE  0x10000
++
++#define STM_1MB_BYTE_COUNT   STM_M25P80_BYTE_COUNT
++#define STM_1MB_SECTOR_COUNT STM_M25P80_SECTOR_COUNT
++#define STM_1MB_SECTOR_SIZE  STM_M25P80_SECTOR_SIZE
++#define STM_2MB_BYTE_COUNT   STM_M25P16_BYTE_COUNT
++#define STM_2MB_SECTOR_COUNT STM_M25P16_SECTOR_COUNT
++#define STM_2MB_SECTOR_SIZE  STM_M25P16_SECTOR_SIZE
++#define STM_4MB_BYTE_COUNT   STM_M25P32_BYTE_COUNT
++#define STM_4MB_SECTOR_COUNT STM_M25P32_SECTOR_COUNT
++#define STM_4MB_SECTOR_SIZE  STM_M25P32_SECTOR_SIZE
++#define STM_8MB_BYTE_COUNT   STM_M25P64_BYTE_COUNT
++#define STM_8MB_SECTOR_COUNT STM_M25P64_SECTOR_COUNT
++#define STM_8MB_SECTOR_SIZE  STM_M25P64_SECTOR_SIZE
++#define STM_16MB_BYTE_COUNT   STM_M25P128_BYTE_COUNT
++#define STM_16MB_SECTOR_COUNT STM_M25P128_SECTOR_COUNT
++#define STM_16MB_SECTOR_SIZE  STM_M25P128_SECTOR_SIZE
++
++/*
++ * ST Microelectronics Opcodes for Serial Flash
++ */
++
++#define STM_OP_WR_ENABLE       0x06     /* Write Enable */
++#define STM_OP_WR_DISABLE      0x04     /* Write Disable */
++#define STM_OP_RD_STATUS       0x05     /* Read Status */
++#define STM_OP_WR_STATUS       0x01     /* Write Status */
++#define STM_OP_RD_DATA         0x03     /* Read Data */
++#define STM_OP_FAST_RD_DATA    0x0b     /* Fast Read Data */
++#define STM_OP_PAGE_PGRM       0x02     /* Page Program */
++#define STM_OP_SECTOR_ERASE    0xd8     /* Sector Erase */
++#define STM_OP_BULK_ERASE      0xc7     /* Bulk Erase */
++#define STM_OP_DEEP_PWRDOWN    0xb9     /* Deep Power-Down Mode */
++#define STM_OP_RD_SIG          0xab     /* Read Electronic Signature */
++
++#define STM_STATUS_WIP       0x01       /* Write-In-Progress */
++#define STM_STATUS_WEL       0x02       /* Write Enable Latch */
++#define STM_STATUS_BP0       0x04       /* Block Protect 0 */
++#define STM_STATUS_BP1       0x08       /* Block Protect 1 */
++#define STM_STATUS_BP2       0x10       /* Block Protect 2 */
++#define STM_STATUS_SRWD      0x80       /* Status Register Write Disable */
++
++/*
++ * SPI Flash Interface Registers
++ */
++
++#define SPI_FLASH_CTL           0x00
++#define SPI_FLASH_OPCODE        0x04
++#define SPI_FLASH_DATA          0x08
++
++#define SPI_CTL_START           0x00000100
++#define SPI_CTL_BUSY            0x00010000
++#define SPI_CTL_TXCNT_MASK      0x0000000f
++#define SPI_CTL_RXCNT_MASK      0x000000f0
++#define SPI_CTL_TX_RX_CNT_MASK  0x000000ff
++#define SPI_CTL_SIZE_MASK       0x00060000
++
++#define SPI_CTL_CLK_SEL_MASK    0x03000000
++#define SPI_OPCODE_MASK         0x000000ff
++
++#define SPI_STATUS_WIP		STM_STATUS_WIP
++
++#endif
+--- a/arch/mips/ath25/ar2315.c
++++ b/arch/mips/ath25/ar2315.c
+@@ -218,6 +218,28 @@ static struct platform_device ar2315_gpi
+ 	.num_resources = ARRAY_SIZE(ar2315_gpio_res)
+ };
+ 
++static struct resource ar2315_spiflash_res[] = {
++	{
++		.name = "spiflash_read",
++		.flags = IORESOURCE_MEM,
++		.start = AR2315_SPI_READ_BASE,
++		.end = AR2315_SPI_READ_BASE + AR2315_SPI_READ_SIZE - 1,
++	},
++	{
++		.name = "spiflash_mmr",
++		.flags = IORESOURCE_MEM,
++		.start = AR2315_SPI_MMR_BASE,
++		.end = AR2315_SPI_MMR_BASE + AR2315_SPI_MMR_SIZE - 1,
++	},
++};
++
++static struct platform_device ar2315_spiflash = {
++	.id = 0,
++	.name = "ar2315-spiflash",
++	.resource = ar2315_spiflash_res,
++	.num_resources = ARRAY_SIZE(ar2315_spiflash_res)
++};
++
+ void __init ar2315_init_devices(void)
+ {
+ 	/* Find board configuration */
+@@ -228,6 +250,8 @@ void __init ar2315_init_devices(void)
+ 	ar2315_gpio_res[1].end = ar2315_gpio_res[1].start;
+ 	platform_device_register(&ar2315_gpio);
+ 
++	platform_device_register(&ar2315_spiflash);
++
+ 	ar2315_eth_data.macaddr = ath25_board.config->enet0_mac;
+ 	ath25_add_ethernet(0, AR2315_ENET0_BASE, "eth0_mii",
+ 			   AR2315_ENET0_MII_BASE, AR2315_IRQ_ENET0,
diff --git a/target/linux/ath25/patches-5.15/130-watchdog.patch b/target/linux/ath25/patches-5.15/130-watchdog.patch
new file mode 100644
index 00000000000000..eb0bc5630d782e
--- /dev/null
+++ b/target/linux/ath25/patches-5.15/130-watchdog.patch
@@ -0,0 +1,277 @@
+--- /dev/null
++++ b/drivers/watchdog/ar2315-wtd.c
+@@ -0,0 +1,209 @@
++/*
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, see <http://www.gnu.org/licenses/>.
++ *
++ * Copyright (C) 2008 John Crispin <blogic@openwrt.org>
++ * Based on EP93xx and ifxmips wdt driver
++ */
++
++#include <linux/interrupt.h>
++#include <linux/module.h>
++#include <linux/moduleparam.h>
++#include <linux/types.h>
++#include <linux/miscdevice.h>
++#include <linux/watchdog.h>
++#include <linux/fs.h>
++#include <linux/ioport.h>
++#include <linux/notifier.h>
++#include <linux/reboot.h>
++#include <linux/init.h>
++#include <linux/platform_device.h>
++#include <linux/io.h>
++#include <linux/uaccess.h>
++
++#define DRIVER_NAME	"ar2315-wdt"
++
++#define CLOCK_RATE 40000000
++#define HEARTBEAT(x) (x < 1 || x > 90 ? 20 : x)
++
++#define WDT_REG_TIMER		0x00
++#define WDT_REG_CTRL		0x04
++
++#define WDT_CTRL_ACT_NONE	0x00000000	/* No action */
++#define WDT_CTRL_ACT_NMI	0x00000001	/* NMI on watchdog */
++#define WDT_CTRL_ACT_RESET	0x00000002	/* reset on watchdog */
++
++static int wdt_timeout = 20;
++static int started;
++static int in_use;
++static void __iomem *wdt_base;
++
++static inline void ar2315_wdt_wr(unsigned reg, u32 val)
++{
++	iowrite32(val, wdt_base + reg);
++}
++
++static void
++ar2315_wdt_enable(void)
++{
++	ar2315_wdt_wr(WDT_REG_TIMER, wdt_timeout * CLOCK_RATE);
++}
++
++static ssize_t
++ar2315_wdt_write(struct file *file, const char __user *data, size_t len,
++		 loff_t *ppos)
++{
++	if (len)
++		ar2315_wdt_enable();
++	return len;
++}
++
++static int
++ar2315_wdt_open(struct inode *inode, struct file *file)
++{
++	if (in_use)
++		return -EBUSY;
++	ar2315_wdt_enable();
++	in_use = 1;
++	started = 1;
++	return nonseekable_open(inode, file);
++}
++
++static int
++ar2315_wdt_release(struct inode *inode, struct file *file)
++{
++	in_use = 0;
++	return 0;
++}
++
++static irqreturn_t
++ar2315_wdt_interrupt(int irq, void *dev)
++{
++	struct platform_device *pdev = (struct platform_device *)dev;
++
++	if (started) {
++		dev_crit(&pdev->dev, "watchdog expired, rebooting system\n");
++		emergency_restart();
++	} else {
++		ar2315_wdt_wr(WDT_REG_CTRL, 0);
++		ar2315_wdt_wr(WDT_REG_TIMER, 0);
++	}
++	return IRQ_HANDLED;
++}
++
++static struct watchdog_info ident = {
++	.options = WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING,
++	.identity = "ar2315 Watchdog",
++};
++
++static long
++ar2315_wdt_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
++{
++	int new_wdt_timeout;
++	int ret = -ENOIOCTLCMD;
++
++	switch (cmd) {
++	case WDIOC_GETSUPPORT:
++		ret = copy_to_user((void __user *)arg, &ident, sizeof(ident)) ?
++		      -EFAULT : 0;
++		break;
++	case WDIOC_KEEPALIVE:
++		ar2315_wdt_enable();
++		ret = 0;
++		break;
++	case WDIOC_SETTIMEOUT:
++		ret = get_user(new_wdt_timeout, (int __user *)arg);
++		if (ret)
++			break;
++		wdt_timeout = HEARTBEAT(new_wdt_timeout);
++		ar2315_wdt_enable();
++		break;
++	case WDIOC_GETTIMEOUT:
++		ret = put_user(wdt_timeout, (int __user *)arg);
++		break;
++	}
++	return ret;
++}
++
++static const struct file_operations ar2315_wdt_fops = {
++	.owner		= THIS_MODULE,
++	.llseek		= no_llseek,
++	.write		= ar2315_wdt_write,
++	.unlocked_ioctl	= ar2315_wdt_ioctl,
++	.open		= ar2315_wdt_open,
++	.release	= ar2315_wdt_release,
++};
++
++static struct miscdevice ar2315_wdt_miscdev = {
++	.minor	= WATCHDOG_MINOR,
++	.name	= "watchdog",
++	.fops	= &ar2315_wdt_fops,
++};
++
++static int
++ar2315_wdt_probe(struct platform_device *dev)
++{
++	struct resource *mem_res, *irq_res;
++	int ret = 0;
++
++	if (wdt_base)
++		return -EBUSY;
++
++	irq_res = platform_get_resource(dev, IORESOURCE_IRQ, 0);
++	if (!irq_res) {
++		dev_err(&dev->dev, "no IRQ resource\n");
++		return -ENOENT;
++	}
++
++	mem_res = platform_get_resource(dev, IORESOURCE_MEM, 0);
++	wdt_base = devm_ioremap_resource(&dev->dev, mem_res);
++	if (IS_ERR(wdt_base))
++		return PTR_ERR(wdt_base);
++
++	ret = devm_request_irq(&dev->dev, irq_res->start, ar2315_wdt_interrupt,
++			       0, DRIVER_NAME, dev);
++	if (ret) {
++		dev_err(&dev->dev, "failed to register inetrrupt\n");
++		goto out;
++	}
++
++	ret = misc_register(&ar2315_wdt_miscdev);
++	if (ret)
++		dev_err(&dev->dev, "failed to register miscdev\n");
++
++out:
++	return ret;
++}
++
++static int
++ar2315_wdt_remove(struct platform_device *dev)
++{
++	misc_deregister(&ar2315_wdt_miscdev);
++	return 0;
++}
++
++static struct platform_driver ar2315_wdt_driver = {
++	.probe = ar2315_wdt_probe,
++	.remove = ar2315_wdt_remove,
++	.driver = {
++		.name = DRIVER_NAME,
++		.owner = THIS_MODULE,
++	},
++};
++
++module_platform_driver(ar2315_wdt_driver);
++
++MODULE_DESCRIPTION("Atheros AR2315 hardware watchdog driver");
++MODULE_AUTHOR("John Crispin <blogic@openwrt.org>");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:" DRIVER_NAME);
+--- a/drivers/watchdog/Kconfig
++++ b/drivers/watchdog/Kconfig
+@@ -1829,6 +1829,13 @@ config PIC32_DMT
+ 	  To compile this driver as a loadable module, choose M here.
+ 	  The module will be called pic32-dmt.
+ 
++config AR2315_WDT
++	tristate "Atheros AR2315+ WiSoCs Watchdog Timer"
++	depends on ATH25
++	help
++	  Hardware driver for the built-in watchdog timer on the Atheros
++	  AR2315/AR2316 WiSoCs.
++
+ # PARISC Architecture
+ 
+ # POWERPC Architecture
+--- a/drivers/watchdog/Makefile
++++ b/drivers/watchdog/Makefile
+@@ -161,6 +161,7 @@ obj-$(CONFIG_JZ4740_WDT) += jz4740_wdt.o
+ obj-$(CONFIG_WDT_MTX1) += mtx-1_wdt.o
+ obj-$(CONFIG_SIBYTE_WDOG) += sb_wdog.o
+ obj-$(CONFIG_AR7_WDT) += ar7_wdt.o
++obj-$(CONFIG_AR2315_WDT) += ar2315-wtd.o
+ obj-$(CONFIG_TXX9_WDT) += txx9wdt.o
+ obj-$(CONFIG_OCTEON_WDT) += octeon-wdt.o
+ octeon-wdt-y := octeon-wdt-main.o octeon-wdt-nmi.o
+--- a/arch/mips/ath25/ar2315.c
++++ b/arch/mips/ath25/ar2315.c
+@@ -218,6 +218,24 @@ static struct platform_device ar2315_gpi
+ 	.num_resources = ARRAY_SIZE(ar2315_gpio_res)
+ };
+ 
++static struct resource ar2315_wdt_res[] = {
++	{
++		.flags = IORESOURCE_MEM,
++		.start = AR2315_RST_BASE + AR2315_WDT_TIMER,
++		.end = AR2315_RST_BASE + AR2315_WDT_TIMER + 8 - 1,
++	},
++	{
++		.flags = IORESOURCE_IRQ,
++	}
++};
++
++static struct platform_device ar2315_wdt = {
++	.id = 0,
++	.name = "ar2315-wdt",
++	.resource = ar2315_wdt_res,
++	.num_resources = ARRAY_SIZE(ar2315_wdt_res)
++};
++
+ static struct resource ar2315_spiflash_res[] = {
+ 	{
+ 		.name = "spiflash_read",
+@@ -250,6 +268,11 @@ void __init ar2315_init_devices(void)
+ 	ar2315_gpio_res[1].end = ar2315_gpio_res[1].start;
+ 	platform_device_register(&ar2315_gpio);
+ 
++	ar2315_wdt_res[1].start = irq_create_mapping(ar2315_misc_irq_domain,
++						     AR2315_MISC_IRQ_WATCHDOG);
++	ar2315_wdt_res[1].end = ar2315_wdt_res[1].start;
++	platform_device_register(&ar2315_wdt);
++
+ 	platform_device_register(&ar2315_spiflash);
+ 
+ 	ar2315_eth_data.macaddr = ath25_board.config->enet0_mac;
diff --git a/target/linux/ath25/patches-5.15/140-redboot_boardconfig.patch b/target/linux/ath25/patches-5.15/140-redboot_boardconfig.patch
new file mode 100644
index 00000000000000..5f506aaa3abb5c
--- /dev/null
+++ b/target/linux/ath25/patches-5.15/140-redboot_boardconfig.patch
@@ -0,0 +1,60 @@
+--- a/drivers/mtd/parsers/redboot.c
++++ b/drivers/mtd/parsers/redboot.c
+@@ -16,6 +16,8 @@
+ #include <linux/mtd/partitions.h>
+ #include <linux/module.h>
+ 
++#define BOARD_CONFIG_PART		"boardconfig"
++
+ struct fis_image_desc {
+ 	unsigned char name[16];      // Null terminated name
+ 	u32	  flash_base;    // Address within FLASH of image
+@@ -73,6 +75,7 @@ static int parse_redboot_partitions(stru
+ 				    const struct mtd_partition **pparts,
+ 				    struct mtd_part_parser_data *data)
+ {
++	unsigned long max_offset = 0;
+ 	int nrparts = 0;
+ 	struct fis_image_desc *buf;
+ 	struct mtd_partition *parts;
+@@ -239,14 +242,15 @@ nogood:
+ 		}
+ 	}
+ #endif
+-	parts = kzalloc(sizeof(*parts) * nrparts + nulllen + namelen, GFP_KERNEL);
++	parts = kzalloc(sizeof(*parts) * (nrparts + 1) + nulllen + namelen +
++			sizeof(BOARD_CONFIG_PART), GFP_KERNEL);
+ 
+ 	if (!parts) {
+ 		ret = -ENOMEM;
+ 		goto out;
+ 	}
+ 
+-	nullname = (char *)&parts[nrparts];
++	nullname = (char *)&parts[nrparts + 1];
+ #ifdef CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED
+ 	if (nulllen > 0)
+ 		strcpy(nullname, nullstring);
+@@ -264,6 +268,8 @@ nogood:
+ 	}
+ #endif
+ 	for ( ; i < nrparts; i++) {
++		if (max_offset < buf[i].flash_base + buf[i].size)
++				max_offset = buf[i].flash_base + buf[i].size;
+ 		parts[i].size = fl->img->size;
+ 		parts[i].offset = fl->img->flash_base;
+ 		parts[i].name = names;
+@@ -297,6 +303,13 @@ nogood:
+ 		fl = fl->next;
+ 		kfree(tmp_fl);
+ 	}
++	if (master->size - max_offset >= master->erasesize) {
++		parts[nrparts].size = master->size - max_offset;
++		parts[nrparts].offset = max_offset;
++		parts[nrparts].name = names;
++		strcpy(names, BOARD_CONFIG_PART);
++		nrparts++;
++	}
+ 	ret = nrparts;
+ 	*pparts = parts;
+  out:
diff --git a/target/linux/ath25/patches-5.15/141-redboot_partition_scan.patch b/target/linux/ath25/patches-5.15/141-redboot_partition_scan.patch
new file mode 100644
index 00000000000000..f9c98c9a37a3fb
--- /dev/null
+++ b/target/linux/ath25/patches-5.15/141-redboot_partition_scan.patch
@@ -0,0 +1,44 @@
+--- a/drivers/mtd/parsers/redboot.c
++++ b/drivers/mtd/parsers/redboot.c
+@@ -94,12 +94,18 @@ static int parse_redboot_partitions(stru
+ 
+ 	parse_redboot_of(master);
+ 
++	buf = vmalloc(master->erasesize);
++	if (!buf)
++		return -ENOMEM;
++
++restart:
+ 	if (directory < 0) {
+ 		offset = master->size + directory * master->erasesize;
+ 		while (mtd_block_isbad(master, offset)) {
+ 			if (!offset) {
+ nogood:
+ 				pr_notice("Failed to find a non-bad block to check for RedBoot partition table\n");
++				vfree(buf);
+ 				return -EIO;
+ 			}
+ 			offset -= master->erasesize;
+@@ -112,10 +118,6 @@ nogood:
+ 				goto nogood;
+ 		}
+ 	}
+-	buf = vmalloc(master->erasesize);
+-
+-	if (!buf)
+-		return -ENOMEM;
+ 
+ 	pr_notice("Searching for RedBoot partition table in %s at offset 0x%lx\n",
+ 		  master->name, offset);
+@@ -187,6 +189,11 @@ nogood:
+ 	}
+ 	if (i == numslots) {
+ 		/* Didn't find it */
++		if (offset + master->erasesize < master->size) {
++			/* not at the end of the flash yet, maybe next block */
++			directory++;
++			goto restart;
++		}
+ 		pr_notice("No RedBoot partition table detected in %s\n",
+ 			  master->name);
+ 		ret = 0;
diff --git a/target/linux/ath25/patches-5.15/142-redboot_various_erase_size_fix.patch b/target/linux/ath25/patches-5.15/142-redboot_various_erase_size_fix.patch
new file mode 100644
index 00000000000000..ca9e6861770ab2
--- /dev/null
+++ b/target/linux/ath25/patches-5.15/142-redboot_various_erase_size_fix.patch
@@ -0,0 +1,83 @@
+--- a/drivers/mtd/parsers/redboot.c
++++ b/drivers/mtd/parsers/redboot.c
+@@ -71,6 +71,22 @@ static void parse_redboot_of(struct mtd_
+ 	directory = dirblock;
+ }
+ 
++static uint32_t mtd_get_offset_erasesize(struct mtd_info *mtd, uint64_t offset)
++{
++	struct mtd_erase_region_info *regions = mtd->eraseregions;
++	int i;
++
++	for (i = 0; i < mtd->numeraseregions; i++) {
++		if (regions[i].offset +
++		    regions[i].numblocks * regions[i].erasesize <= offset)
++			continue;
++
++		return regions[i].erasesize;
++	}
++
++	return mtd->erasesize;
++}
++
+ static int parse_redboot_partitions(struct mtd_info *master,
+ 				    const struct mtd_partition **pparts,
+ 				    struct mtd_part_parser_data *data)
+@@ -87,6 +103,7 @@ static int parse_redboot_partitions(stru
+ 	int namelen = 0;
+ 	int nulllen = 0;
+ 	int numslots;
++	int first_slot;
+ 	unsigned long offset;
+ #ifdef CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED
+ 	static char nullstring[] = "unallocated";
+@@ -134,7 +151,9 @@ nogood:
+ 	}
+ 
+ 	numslots = (master->erasesize / sizeof(struct fis_image_desc));
+-	for (i = 0; i < numslots; i++) {
++	first_slot = (buf[i].flash_base & (master->erasesize - 1)) /
++				  sizeof(struct fis_image_desc);
++	for (i = first_slot; i < first_slot + numslots; i++) {
+ 		if (!memcmp(buf[i].name, "FIS directory", 14)) {
+ 			/* This is apparently the FIS directory entry for the
+ 			 * FIS directory itself.  The FIS directory size is
+@@ -200,7 +219,10 @@ nogood:
+ 		goto out;
+ 	}
+ 
+-	for (i = 0; i < numslots; i++) {
++	first_slot = (buf[i].flash_base & (master->erasesize - 1)) /
++		     sizeof(struct fis_image_desc);
++
++	for (i = first_slot; i < first_slot + numslots; i++) {
+ 		struct fis_list *new_fl, **prev;
+ 
+ 		if (buf[i].name[0] == 0xff) {
+@@ -275,12 +297,13 @@ nogood:
+ 	}
+ #endif
+ 	for ( ; i < nrparts; i++) {
+-		if (max_offset < buf[i].flash_base + buf[i].size)
+-				max_offset = buf[i].flash_base + buf[i].size;
+ 		parts[i].size = fl->img->size;
+ 		parts[i].offset = fl->img->flash_base;
+ 		parts[i].name = names;
+ 
++		if (max_offset < parts[i].offset + parts[i].size)
++				max_offset = parts[i].offset + parts[i].size;
++
+ 		strcpy(names, fl->img->name);
+ #ifdef CONFIG_MTD_REDBOOT_PARTS_READONLY
+ 		if (!memcmp(names, "RedBoot", 8) ||
+@@ -310,7 +333,9 @@ nogood:
+ 		fl = fl->next;
+ 		kfree(tmp_fl);
+ 	}
+-	if (master->size - max_offset >= master->erasesize) {
++
++	if (master->size - max_offset >=
++	    mtd_get_offset_erasesize(master, max_offset)) {
+ 		parts[nrparts].size = master->size - max_offset;
+ 		parts[nrparts].offset = max_offset;
+ 		parts[nrparts].name = names;
diff --git a/target/linux/ath25/patches-5.15/210-reset_button.patch b/target/linux/ath25/patches-5.15/210-reset_button.patch
new file mode 100644
index 00000000000000..b3f7a14cda6835
--- /dev/null
+++ b/target/linux/ath25/patches-5.15/210-reset_button.patch
@@ -0,0 +1,71 @@
+--- a/arch/mips/ath25/Makefile
++++ b/arch/mips/ath25/Makefile
+@@ -8,7 +8,7 @@
+ # Copyright (C) 2006-2009 Felix Fietkau <nbd@openwrt.org>
+ #
+ 
+-obj-y += board.o prom.o devices.o
++obj-y += board.o prom.o devices.o reset.o
+ 
+ obj-$(CONFIG_EARLY_PRINTK) += early_printk.o
+ 
+--- /dev/null
++++ b/arch/mips/ath25/reset.c
+@@ -0,0 +1,57 @@
++#include <linux/init.h>
++#include <linux/slab.h>
++#include <linux/platform_device.h>
++#include <linux/gpio_keys.h>
++#include <linux/input.h>
++#include <ath25_platform.h>
++#include "devices.h"
++
++static int __init
++ar231x_init_reset(void)
++{
++	struct platform_device *pdev;
++	struct gpio_keys_platform_data pdata;
++	struct gpio_keys_button *p;
++	int err;
++
++	if (ath25_board.config->reset_config_gpio == 0xffff)
++		return -ENODEV;
++
++	p = kzalloc(sizeof(*p), GFP_KERNEL);
++	if (!p)
++		goto err;
++
++	p->desc = "reset";
++	p->type = EV_KEY;
++	p->code = KEY_RESTART;
++	p->debounce_interval = 60;
++	p->gpio = ath25_board.config->reset_config_gpio;
++
++	memset(&pdata, 0, sizeof(pdata));
++	pdata.poll_interval = 20;
++	pdata.buttons = p;
++	pdata.nbuttons = 1;
++
++	pdev = platform_device_alloc("gpio-keys-polled", 0);
++	if (!pdev)
++		goto err_free;
++
++	err = platform_device_add_data(pdev, &pdata, sizeof(pdata));
++	if (err)
++		goto err_put_pdev;
++
++	err = platform_device_add(pdev);
++	if (err)
++		goto err_put_pdev;
++
++	return 0;
++
++err_put_pdev:
++	platform_device_put(pdev);
++err_free:
++	kfree(p);
++err:
++	return -ENOMEM;
++}
++
++device_initcall(ar231x_init_reset);
diff --git a/target/linux/ath25/patches-5.15/220-enet_micrel_workaround.patch b/target/linux/ath25/patches-5.15/220-enet_micrel_workaround.patch
new file mode 100644
index 00000000000000..b97cb3622fcfc1
--- /dev/null
+++ b/target/linux/ath25/patches-5.15/220-enet_micrel_workaround.patch
@@ -0,0 +1,111 @@
+--- a/drivers/net/ethernet/atheros/ar231x/ar231x.c
++++ b/drivers/net/ethernet/atheros/ar231x/ar231x.c
+@@ -133,6 +133,7 @@ static int ar231x_mdiobus_write(struct m
+ static int ar231x_mdiobus_reset(struct mii_bus *bus);
+ static int ar231x_mdiobus_probe(struct net_device *dev);
+ static void ar231x_adjust_link(struct net_device *dev);
++static bool no_phy;
+ 
+ #ifndef ERR
+ #define ERR(fmt, args...) printk("%s: " fmt, __func__, ##args)
+@@ -164,6 +165,32 @@ static const struct net_device_ops ar231
+ #endif
+ };
+ 
++static int get_phy_id(struct mii_bus *bus, int addr, u32 *phy_id)
++{
++	int phy_reg;
++
++	/**
++	 * Grab the bits from PHYIR1, and put them
++	 * in the upper half.
++	 */
++	phy_reg = mdiobus_read(bus, addr, MII_PHYSID1);
++
++	if (phy_reg < 0)
++		return -EIO;
++
++	*phy_id = (phy_reg & 0xffff) << 16;
++
++	/* Grab the bits from PHYIR2, and put them in the lower half */
++	phy_reg = mdiobus_read(bus, addr, MII_PHYSID2);
++
++	if (phy_reg < 0)
++		return -EIO;
++
++	*phy_id |= (phy_reg & 0xffff);
++
++	return 0;
++}
++
+ static int ar231x_probe(struct platform_device *pdev)
+ {
+ 	struct net_device *dev;
+@@ -271,6 +298,24 @@ static int ar231x_probe(struct platform_
+ 
+ 	mdiobus_register(sp->mii_bus);
+ 
++	/**
++	 * Workaround for Micrel switch, which is only available on
++	 * one PHY and cannot be configured through MDIO.
++	 */
++	if (!no_phy) {
++		u32 phy_id = 0;
++
++		get_phy_id(sp->mii_bus, 1, &phy_id);
++		if (phy_id == 0x00221450)
++			no_phy = true;
++	}
++	if (no_phy) {
++		sp->link = 1;
++		netif_carrier_on(dev);
++		return 0;
++	}
++	no_phy = true;
++
+ 	if (ar231x_mdiobus_probe(dev) != 0) {
+ 		printk(KERN_ERR "%s: mdiobus_probe failed\n", dev->name);
+ 		rx_tasklet_cleanup(dev);
+@@ -324,8 +369,10 @@ static int ar231x_remove(struct platform
+ 	rx_tasklet_cleanup(dev);
+ 	ar231x_init_cleanup(dev);
+ 	unregister_netdev(dev);
+-	mdiobus_unregister(sp->mii_bus);
+-	mdiobus_free(sp->mii_bus);
++	if (sp->mii_bus) {
++		mdiobus_unregister(sp->mii_bus);
++		mdiobus_free(sp->mii_bus);
++	}
+ 	kfree(dev);
+ 	return 0;
+ }
+@@ -868,7 +915,8 @@ static int ar231x_open(struct net_device
+ 
+ 	sp->eth_regs->mac_control |= MAC_CONTROL_RE;
+ 
+-	phy_start(sp->phy_dev);
++	if (sp->phy_dev)
++		phy_start(sp->phy_dev);
+ 
+ 	return 0;
+ }
+@@ -949,7 +997,8 @@ static int ar231x_close(struct net_devic
+ 
+ #endif
+ 
+-	phy_stop(sp->phy_dev);
++	if (sp->phy_dev)
++		phy_stop(sp->phy_dev);
+ 
+ 	return 0;
+ }
+@@ -993,6 +1042,9 @@ static int ar231x_ioctl(struct net_devic
+ {
+ 	struct ar231x_private *sp = netdev_priv(dev);
+ 
++	if (!sp->phy_dev)
++		return -ENODEV;
++
+ 	switch (cmd) {
+ 	case SIOCGMIIPHY:
+ 	case SIOCGMIIREG:
diff --git a/target/linux/ath25/patches-5.15/330-board_leds.patch b/target/linux/ath25/patches-5.15/330-board_leds.patch
new file mode 100644
index 00000000000000..3d762db80e8420
--- /dev/null
+++ b/target/linux/ath25/patches-5.15/330-board_leds.patch
@@ -0,0 +1,116 @@
+--- a/arch/mips/ath25/ar2315.c
++++ b/arch/mips/ath25/ar2315.c
+@@ -24,6 +24,7 @@
+ #include <linux/reboot.h>
+ #include <linux/delay.h>
+ #include <linux/gpio.h>
++#include <linux/leds.h>
+ #include <asm/bootinfo.h>
+ #include <asm/reboot.h>
+ #include <asm/time.h>
+@@ -258,6 +259,50 @@ static struct platform_device ar2315_spi
+ 	.num_resources = ARRAY_SIZE(ar2315_spiflash_res)
+ };
+ 
++#ifdef CONFIG_LEDS_GPIO
++static struct gpio_led ar2315_leds[6];
++static struct gpio_led_platform_data ar2315_led_data = {
++	.leds = (void *)ar2315_leds,
++};
++
++static struct platform_device ar2315_gpio_leds = {
++	.name = "leds-gpio",
++	.id = -1,
++	.dev = {
++		.platform_data = (void *)&ar2315_led_data,
++	}
++};
++
++static void __init ar2315_init_gpio_leds(void)
++{
++	static char led_names[6][6];
++	int i, led = 0;
++
++	ar2315_led_data.num_leds = 0;
++	for (i = 1; i < 8; i++) {
++		if ((i == AR2315_RESET_GPIO) ||
++		    (i == ath25_board.config->reset_config_gpio))
++			continue;
++
++		if (i == ath25_board.config->sys_led_gpio)
++			strcpy(led_names[led], "wlan");
++		else
++			sprintf(led_names[led], "gpio%d", i);
++
++		ar2315_leds[led].name = led_names[led];
++		ar2315_leds[led].gpio = i;
++		ar2315_leds[led].active_low = 0;
++		led++;
++	}
++	ar2315_led_data.num_leds = led;
++	platform_device_register(&ar2315_gpio_leds);
++}
++#else
++static inline void ar2315_init_gpio_leds(void)
++{
++}
++#endif
++
+ void __init ar2315_init_devices(void)
+ {
+ 	/* Find board configuration */
+@@ -268,6 +313,8 @@ void __init ar2315_init_devices(void)
+ 	ar2315_gpio_res[1].end = ar2315_gpio_res[1].start;
+ 	platform_device_register(&ar2315_gpio);
+ 
++	ar2315_init_gpio_leds();
++
+ 	ar2315_wdt_res[1].start = irq_create_mapping(ar2315_misc_irq_domain,
+ 						     AR2315_MISC_IRQ_WATCHDOG);
+ 	ar2315_wdt_res[1].end = ar2315_wdt_res[1].start;
+--- a/arch/mips/ath25/ar5312.c
++++ b/arch/mips/ath25/ar5312.c
+@@ -24,6 +24,7 @@
+ #include <linux/mtd/physmap.h>
+ #include <linux/reboot.h>
+ #include <linux/gpio.h>
++#include <linux/leds.h>
+ #include <asm/bootinfo.h>
+ #include <asm/reboot.h>
+ #include <asm/time.h>
+@@ -228,6 +229,23 @@ static struct platform_device ar5312_gpi
+ 	.num_resources = ARRAY_SIZE(ar5312_gpio_res),
+ };
+ 
++#ifdef CONFIG_LEDS_GPIO
++static struct gpio_led ar5312_leds[] = {
++	{ .name = "wlan", .gpio = 0, .active_low = 1, },
++};
++
++static const struct gpio_led_platform_data ar5312_led_data = {
++	.num_leds = ARRAY_SIZE(ar5312_leds),
++	.leds = (void *)ar5312_leds,
++};
++
++static struct platform_device ar5312_gpio_leds = {
++	.name = "leds-gpio",
++	.id = -1,
++	.dev.platform_data = (void *)&ar5312_led_data,
++};
++#endif
++
+ static void __init ar5312_flash_init(void)
+ {
+ 	void __iomem *flashctl_base;
+@@ -298,6 +316,11 @@ void __init ar5312_init_devices(void)
+ 
+ 	platform_device_register(&ar5312_gpio);
+ 
++#ifdef CONFIG_LEDS_GPIO
++	ar5312_leds[0].gpio = config->sys_led_gpio;
++	platform_device_register(&ar5312_gpio_leds);
++#endif
++
+ 	/* Fix up MAC addresses if necessary */
+ 	if (is_broadcast_ether_addr(config->enet0_mac))
+ 		ether_addr_copy(config->enet0_mac, config->enet1_mac);
diff --git a/target/linux/ath25/patches-5.15/700-swconfig_mvswitch.patch b/target/linux/ath25/patches-5.15/700-swconfig_mvswitch.patch
new file mode 100644
index 00000000000000..dcfc019f1282d8
--- /dev/null
+++ b/target/linux/ath25/patches-5.15/700-swconfig_mvswitch.patch
@@ -0,0 +1,23 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -96,6 +96,10 @@ config IP17XX_PHY
+ 	tristate "Driver for IC+ IP17xx switches"
+ 	select SWCONFIG
+ 
++config MVSWITCH_PHY
++	tristate "Driver for Marvell 88E6060 switches"
++	select ETHERNET_PACKET_MANGLE
++
+ config PSB6970_PHY
+ 	tristate "Lantiq XWAY Tantos (PSB6970) Ethernet switch"
+ 	select SWCONFIG
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -31,6 +31,7 @@ ar8xxx-y			+= ar8216.o
+ ar8xxx-y			+= ar8327.o
+ obj-$(CONFIG_SWCONFIG_B53)	+= b53/
+ obj-$(CONFIG_IP17XX_PHY)	+= ip17xx.o
++obj-$(CONFIG_MVSWITCH_PHY)	+= mvswitch.o
+ obj-$(CONFIG_PSB6970_PHY)	+= psb6970.o
+ obj-$(CONFIG_RTL8306_PHY)	+= rtl8306.o
+ obj-$(CONFIG_RTL8366_SMI)	+= rtl8366_smi.o
diff --git a/target/linux/ath79/Makefile b/target/linux/ath79/Makefile
index 20dae789af19f4..d6ba3b0eadae08 100644
--- a/target/linux/ath79/Makefile
+++ b/target/linux/ath79/Makefile
@@ -8,8 +8,7 @@ SUBTARGETS:=generic mikrotik nand tiny
 
 FEATURES:=ramdisk squashfs usbgadget
 
-KERNEL_PATCHVER:=5.10
-KERNEL_TESTING_PATCHVER:=5.15
+KERNEL_PATCHVER:=5.15
 
 include $(INCLUDE_DIR)/target.mk
 
diff --git a/target/linux/ath79/config-5.15 b/target/linux/ath79/config-5.15
index acb6b840bf39b7..ce987c5539023e 100644
--- a/target/linux/ath79/config-5.15
+++ b/target/linux/ath79/config-5.15
@@ -123,6 +123,7 @@ CONFIG_MTD_CMDLINE_PARTS=y
 # CONFIG_MTD_MAP_BANK_WIDTH_1 is not set
 # CONFIG_MTD_MAP_BANK_WIDTH_4 is not set
 CONFIG_MTD_PARSER_CYBERTAN=y
+# CONFIG_MTD_PARSER_TPLINK_SAFELOADER is not set
 CONFIG_MTD_PHYSMAP=y
 CONFIG_MTD_SPI_NOR=y
 CONFIG_MTD_SPLIT_ELF_FW=y
diff --git a/target/linux/ath79/dts/ar7100.dtsi b/target/linux/ath79/dts/ar7100.dtsi
index 12ab7e503941d0..a03f282a0f10bd 100644
--- a/target/linux/ath79/dts/ar7100.dtsi
+++ b/target/linux/ath79/dts/ar7100.dtsi
@@ -21,6 +21,13 @@
 		};
 	};
 
+	extosc: ref {
+		compatible = "fixed-clock";
+		#clock-cells = <0>;
+		clock-output-names = "ref";
+		clock-frequency = <40000000>;
+	};
+
 	ahb {
 		apb {
 			ddr_ctrl: memory-controller@18000000 {
@@ -73,8 +80,8 @@
 				compatible = "qca,ar7100-pll", "syscon";
 				reg = <0x18050000 0x20>;
 
+				clocks = <&extosc>;
 				clock-names = "ref";
-				/* The board must provides the ref clock */
 
 				#clock-cells = <1>;
 				clock-output-names = "cpu", "ddr", "ahb";
@@ -149,6 +156,11 @@
 
 		#address-cells = <1>;
 		#size-cells = <0>;
+
+		usb_ehci_port: port@1 {
+			reg = <1>;
+			#trigger-source-cells = <0>;
+		};
 	};
 
 	usb1: usb@1c000000 {
@@ -165,6 +177,11 @@
 
 		#address-cells = <1>;
 		#size-cells = <0>;
+
+		usb_ohci_port: port@1 {
+			reg = <1>;
+			#trigger-source-cells = <0>;
+		};
 	};
 
 	spi: spi@1f000000 {
diff --git a/target/linux/ath79/dts/ar7161_aruba_ap-105.dts b/target/linux/ath79/dts/ar7161_aruba_ap-105.dts
index da68ada2c02083..949d70ec07a10f 100644
--- a/target/linux/ath79/dts/ar7161_aruba_ap-105.dts
+++ b/target/linux/ath79/dts/ar7161_aruba_ap-105.dts
@@ -21,13 +21,6 @@
 		label-mac-device = &eth0;
 	};
 
-	extosc: ref {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-		clock-output-names = "ref";
-		clock-frequency = <40000000>;
-	};
-
 	leds {
 		compatible = "gpio-leds";
 
diff --git a/target/linux/ath79/dts/ar7161_aruba_ap-175.dts b/target/linux/ath79/dts/ar7161_aruba_ap-175.dts
new file mode 100644
index 00000000000000..dd29a687ba0e1d
--- /dev/null
+++ b/target/linux/ath79/dts/ar7161_aruba_ap-175.dts
@@ -0,0 +1,244 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "ar7100.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "aruba,ap-175", "qca,ar7161";
+	model = "Aruba AP-175";
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	aliases {
+		led-boot = &led_power_amber;
+		led-failsafe = &led_power_amber;
+		led-upgrade = &led_power_amber;
+		label-mac-device = &eth0;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		/* These internal LEDs cannot be seen when case is closed */
+		internal_2g_green {
+			label = "green:internal_2g";
+			gpios = <&gpio 3 GPIO_ACTIVE_HIGH>;
+		};
+
+		internal_5g_green {
+			label = "green:internal_5g";
+			gpios = <&gpio 4 GPIO_ACTIVE_HIGH>;
+		};
+
+        /* These external LEDs are visible from the bottom panel */
+
+		led_power_amber: power_amber {
+			label = "amber:power";
+			gpios = <&gpio_ext 5 GPIO_ACTIVE_HIGH>;
+			panic-indicator;
+		};
+
+		r1_act_blue {
+			label = "blue:r1_act";
+			gpios = <&gpio_ext 0 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		r1_rssi1_blue {
+			label = "blue:r1_rssi1";
+			gpios = <&gpio_ext 1 GPIO_ACTIVE_HIGH>;
+		};
+
+		r1_rssi2_blue {
+			label = "blue:r1_rssi2";
+			gpios = <&gpio_ext 2 GPIO_ACTIVE_HIGH>;
+		};
+
+		r1_rssi3_blue {
+			label = "blue:r1_rssi3";
+			gpios = <&gpio_ext 3 GPIO_ACTIVE_HIGH>;
+		};
+
+		r1_rssi4_blue {
+			label = "blue:r1_rssi4";
+			gpios = <&gpio_ext 4 GPIO_ACTIVE_HIGH>;
+		};
+
+		r0_act_amber {
+			label = "amber:r0_act";
+			gpios = <&gpio_ext 8 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		r0_rssi1_amber {
+			label = "amber:r0_rssi1";
+			gpios = <&gpio_ext 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		r0_rssi2_amber {
+			label = "amber:r0_rssi2";
+			gpios = <&gpio_ext 10 GPIO_ACTIVE_HIGH>;
+		};
+
+		r0_rssi3_amber {
+			label = "amber:r0_rssi3";
+			gpios = <&gpio_ext 11 GPIO_ACTIVE_HIGH>;
+		};
+
+		r0_rssi4_amber {
+			label = "amber:r0_rssi4";
+			gpios = <&gpio_ext 12 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 6 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	i2c0: i2c {
+		compatible = "i2c-gpio";
+		i2c-gpio,delay-us = <10>;
+		i2c-gpio,timeout-ms = <1>;
+		sda-gpios = <&gpio 1 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio 2 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN)>;
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+};
+
+&pcie0 {
+	status = "okay";
+
+	ath9k0: wifi@0,11 {
+		compatible = "pci168c,0029";
+		nvmem-cells = <&macaddr_hwinfo_1c>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <1>;
+		reg = <0x8800 0 0 0 0>;
+		#gpio-cells = <2>;
+		gpio-controller;
+	};
+
+	ath9k1: wifi@0,12 {
+		compatible = "pci168c,0029";
+		nvmem-cells = <&macaddr_hwinfo_1c>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <2>;
+		reg = <0x9000 0 0 0 0>;
+		#gpio-cells = <2>;
+		gpio-controller;
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy1: ethernet-phy@1 {
+		reg = <0x1>;
+	};
+};
+
+&eth0 {
+	status = "okay";
+	nvmem-cells = <&macaddr_hwinfo_1c>;
+	nvmem-cell-names = "mac-address";
+
+	phy-mode = "rgmii";
+	phy-handle = <&phy1>;
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x40000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "firmware";
+				reg = <0x40000 0xfa0000>;
+				compatible = "denx,uimage";
+			};
+
+			hwinfo: partition@fe0000 {
+				label = "hwinfo";
+				reg = <0xfe0000 0x10000>;
+				read-only;
+			};
+
+			partition@ff0000 {
+				label = "u-boot-env";
+				reg = <0xff0000 0x10000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&hwinfo {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_hwinfo_1c: macaddr@1c {
+		reg = <0x1c 0x6>;
+	};
+};
+
+&i2c0 {
+	gpio_ext: gpio@21 {
+		status = "okay";
+
+		compatible = "ti,tca6416";
+		reg = <0x21>;
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		gpio-controller;
+		#gpio-cells = <2>;
+	};
+
+	temp-sensor@4a {
+		 compatible = "national,lm75";
+		 reg = <0x4a>;
+	};
+
+	eeprom@50 { /* 24lc2561 */
+		compatible = "atmel,24c256","at24";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0x50>;
+		size = <256>;
+	};
+
+	ds1374c: rtc@68 {
+		status = "okay";
+
+		compatible = "dallas,ds1374";
+		reg = <0x68>;
+	};
+};
diff --git a/target/linux/ath79/dts/ar7161_buffalo_wzr-hp-ag300h.dtsi b/target/linux/ath79/dts/ar7161_buffalo_wzr-hp-ag300h.dtsi
index 35e083bc6178d7..6e1ba2d47e4c5d 100644
--- a/target/linux/ath79/dts/ar7161_buffalo_wzr-hp-ag300h.dtsi
+++ b/target/linux/ath79/dts/ar7161_buffalo_wzr-hp-ag300h.dtsi
@@ -12,13 +12,6 @@
 		led-upgrade = &led_diag;
 	};
 
-	extosc: ref {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-		clock-output-names = "ref";
-		clock-frequency = <40000000>;
-	};
-
 	leds {
 		compatible = "gpio-leds";
 
@@ -177,25 +170,11 @@
 };
 
 &usb1 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	usb_ohci_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb2 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	usb_ehci_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &pcie0 {
@@ -218,10 +197,6 @@
 	};
 };
 
-&pll {
-	clocks = <&extosc>;
-};
-
 &spi {
 	status = "okay";
 
diff --git a/target/linux/ath79/dts/ar7161_dlink_dir-825-b1.dts b/target/linux/ath79/dts/ar7161_dlink_dir-825-b1.dts
index 8188027c4c1af5..0e39be7d0bb97c 100644
--- a/target/linux/ath79/dts/ar7161_dlink_dir-825-b1.dts
+++ b/target/linux/ath79/dts/ar7161_dlink_dir-825-b1.dts
@@ -16,13 +16,6 @@
 		led-upgrade = &led_power_orange;
 	};
 
-	extosc: ref {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-		clock-output-names = "ref";
-		clock-frequency = <40000000>;
-	};
-
 	leds {
 		compatible = "gpio-leds";
 
@@ -109,28 +102,31 @@
 			};
 		};
 	};
+
+	virtual_flash {
+		compatible = "mtd-concat";
+		devices = <&fwconcat0 &fwconcat1>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x0 0x0>;
+			};
+		};
+	};
 };
 
 &usb1 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	usb_ohci_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb2 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	usb_ehci_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy {
@@ -143,7 +139,8 @@
 	ath9k0: wifi@0,11 {
 		compatible = "pci168c,0029";
 		reg = <0x8800 0 0 0 0>;
-		qca,no-eeprom;
+		nvmem-cells = <&macaddr_lan>, <&cal_art_1000>;
+		nvmem-cell-names = "mac-address-ascii", "calibration";
 		#gpio-cells = <2>;
 		gpio-controller;
 	};
@@ -151,16 +148,14 @@
 	ath9k1: wifi@0,12 {
 		compatible = "pci168c,0029";
 		reg = <0x9000 0 0 0 0>;
-		qca,no-eeprom;
+		nvmem-cells = <&macaddr_wan>, <&cal_art_5000>;
+		nvmem-cell-names = "mac-address-ascii", "calibration";
+		mac-address-increment = <1>;
 		#gpio-cells = <2>;
 		gpio-controller;
 	};
 };
 
-&pll {
-	clocks = <&extosc>;
-};
-
 &spi {
 	status = "okay";
 
@@ -186,22 +181,39 @@
 				read-only;
 			};
 
-			partition@50000 {
-				compatible = "denx,uimage";
-				label = "firmware";
+			fwconcat0: partition@50000 {
+				label = "fwconcat0";
 				reg = <0x050000 0x610000>;
 			};
 
 			partition@660000 {
+				compatible = "nvmem-cells";
 				label = "caldata";
 				reg = <0x660000 0x010000>;
 				read-only;
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				cal_art_1000: cal@1000 {
+					reg = <0x1000 0xeb8>;
+				};
+
+				cal_art_5000: cal@5000 {
+					reg = <0x5000 0xeb8>;
+				};
+
+				macaddr_lan: macaddr@ffa0 {
+					reg = <0xffa0 0x11>;
+				};
+
+				macaddr_wan: macaddr@ffb4 {
+					reg = <0xffb4 0x11>;
+				};
 			};
 
-			partition@670000 {
-				label = "unknown";
+			fwconcat1: partition@670000 {
+				label = "fwconcat1";
 				reg = <0x670000 0x190000>;
-				read-only;
 			};
 		};
 	};
@@ -212,6 +224,9 @@
 
 	pll-data = <0x11110000 0x00001099 0x00991099>;
 
+	nvmem-cells = <&macaddr_lan>;
+	nvmem-cell-names = "mac-address-ascii";
+
 	fixed-link {
 		speed = <1000>;
 		full-duplex;
@@ -223,5 +238,9 @@
 
 	pll-data = <0x11110000 0x00001099 0x00991099>;
 
+	nvmem-cells = <&macaddr_wan>;
+	nvmem-cell-names = "mac-address-ascii";
+
 	phy-handle = <&phy4>;
 };
+
diff --git a/target/linux/ath79/dts/ar7161_jjplus_ja76pf2.dts b/target/linux/ath79/dts/ar7161_jjplus_ja76pf2.dts
index dca226d2623b58..7f2a118b8457d4 100644
--- a/target/linux/ath79/dts/ar7161_jjplus_ja76pf2.dts
+++ b/target/linux/ath79/dts/ar7161_jjplus_ja76pf2.dts
@@ -26,13 +26,6 @@
 		led-upgrade = &led_d2;
 	};
 
-	extosc: ref {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-		clock-output-names = "ref";
-		clock-frequency = <40000000>;
-	};
-
 	i2c {
 		compatible = "i2c-gpio";
 		sda-gpios = <&gpio 1 GPIO_ACTIVE_HIGH>;
diff --git a/target/linux/ath79/dts/ar7161_meraki_mr16.dts b/target/linux/ath79/dts/ar7161_meraki_mr16.dts
index eb27e16e563f66..7a19da82e36ee8 100644
--- a/target/linux/ath79/dts/ar7161_meraki_mr16.dts
+++ b/target/linux/ath79/dts/ar7161_meraki_mr16.dts
@@ -16,13 +16,6 @@
 		led-upgrade = &led_power_orange;
 	};
 
-	extosc: ref {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-		clock-output-names = "ref";
-		clock-frequency = <40000000>;
-	};
-
 	leds {
 		compatible = "gpio-leds";
 
@@ -100,10 +93,6 @@
 	};
 };
 
-&pll {
-	clocks = <&extosc>;
-};
-
 &mdio0 {
 	status = "okay";
 
diff --git a/target/linux/ath79/dts/ar7161_netgear_wndap360.dts b/target/linux/ath79/dts/ar7161_netgear_wndap360.dts
index 37a475d3ac7498..21dc423c357632 100644
--- a/target/linux/ath79/dts/ar7161_netgear_wndap360.dts
+++ b/target/linux/ath79/dts/ar7161_netgear_wndap360.dts
@@ -16,13 +16,6 @@
 		led-upgrade = &led_power_orange;
 	};
 
-	extosc: ref {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-		clock-output-names = "ref";
-		clock-frequency = <40000000>;
-	};
-
 	leds {
 		compatible = "gpio-leds";
 
@@ -114,10 +107,34 @@
 				read-only;
 			};
 
-			art: partition@7f0000 {
+			partition@7f0000 {
 				label = "art";
 				reg = <0x7f0000 0x010000>;
 				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_art_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_art_120c: macaddr@120c {
+					reg = <0x120c 0x6>;
+				};
+
+				macaddr_art_520c: macaddr@520c {
+					reg = <0x520c 0x6>;
+				};
+
+				calibration_art_1000: calibration@1000 {
+					reg = <0x1000 0xeb8>;
+				};
+
+				calibration_art_5000: calibration@5000 {
+					reg = <0x5000 0xeb8>;
+				};
 			};
 		};
 	};
@@ -129,9 +146,8 @@
 	ath9k0: wifi@0,11 {
 		compatible = "pci168c,0029";
 		reg = <0x8800 0 0 0 0>;
-		qca,no-eeprom;
-		nvmem-cells = <&macaddr_art_120c>;
-		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_art_120c>, <&calibration_art_1000>;
+		nvmem-cell-names = "mac-address", "calibration";
 		#gpio-cells = <2>;
 		gpio-controller;
 	};
@@ -139,30 +155,10 @@
 	ath9k1: wifi@0,12 {
 		compatible = "pci168c,0029";
 		reg = <0x9000 0 0 0 0>;
-		qca,no-eeprom;
-		nvmem-cells = <&macaddr_art_520c>;
-		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_art_520c>, <&calibration_art_5000>;
+		nvmem-cell-names = "mac-address", "calibration";
 		mac-address-increment = <1>;
 		#gpio-cells = <2>;
 		gpio-controller;
 	};
 };
-
-
-&art {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_art_0: macaddr@0 {
-		reg = <0x0 0x6>;
-	};
-
-	macaddr_art_120c: macaddr@120c {
-		reg = <0x120c 0x6>;
-	};
-
-	macaddr_art_520c: macaddr@520c {
-		reg = <0x520c 0x6>;
-	};
-};
diff --git a/target/linux/ath79/dts/ar7161_netgear_wndr.dtsi b/target/linux/ath79/dts/ar7161_netgear_wndr.dtsi
index c66348e71e3ca2..296ecc8c4e08fc 100644
--- a/target/linux/ath79/dts/ar7161_netgear_wndr.dtsi
+++ b/target/linux/ath79/dts/ar7161_netgear_wndr.dtsi
@@ -14,13 +14,6 @@
 		led-upgrade = &led_power_orange;
 	};
 
-	extosc: ref {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-		clock-output-names = "ref";
-		clock-frequency = <40000000>;
-	};
-
 	reset-leds {
 		compatible = "reset-leds";
 
@@ -123,25 +116,11 @@
 };
 
 &usb1 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	usb_ohci_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb2 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	usb_ehci_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &pcie0 {
diff --git a/target/linux/ath79/dts/ar7161_ruckus_gd11.dtsi b/target/linux/ath79/dts/ar7161_ruckus_gd11.dtsi
new file mode 100644
index 00000000000000..e97e31e58ec656
--- /dev/null
+++ b/target/linux/ath79/dts/ar7161_ruckus_gd11.dtsi
@@ -0,0 +1,243 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "ar7100.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "ruckus,gd11", "qca,ar7161";
+
+	aliases {
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_red;
+		label-mac-device = &eth0;
+	};
+
+	keys: keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		dir-green {
+			label = "green:dir";
+			gpios = <&gpio 6 GPIO_ACTIVE_HIGH>;
+		};
+
+		opt-green {
+			label = "green:opt";
+			gpios = <&gpio 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_power_green: power-green {
+			label = "green:power";
+			gpios = <&gpio 0 GPIO_ACTIVE_HIGH>;
+			default-state = "on";
+		};
+
+		led_power_red: power-red {
+			label = "red:power";
+			gpios = <&gpio 1 GPIO_ACTIVE_HIGH>;
+			panic-indicator;
+		};
+
+		wlan2g-green {
+			label = "green:wlan2g";
+			gpios = <&gpio 2 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy0assoc";
+		};
+
+		wlan2g-yellow {
+			label = "yellow:wlan2g";
+			gpios = <&gpio 3 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wlan5g-green {
+			label = "green:wlan5g";
+			gpios = <&gpio 4 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy1assoc";
+		};
+
+		wlan5g-yellow {
+			label = "yellow:wlan5g";
+			gpios = <&gpio 5 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy1tpt";
+		};
+	};
+
+	reserved-memory {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+
+		ruckus-himem@3ff0000 {
+			/* Ruckus Himem area used to control
+			 * redundant boot image selection
+			 */
+			compatible = "nvmem-rmem";
+			reg = <0x3ff0000 0x10000>;
+			no-map;
+		};
+	};
+
+	beamforming-2g-spi {
+		compatible = "spi-gpio";
+		mosi-gpios = <&ath9k0 5 GPIO_ACTIVE_HIGH>;
+		sck-gpios = <&ath9k0 6 GPIO_ACTIVE_HIGH>;
+		num-chipselects = <0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		beamforming_2g_gpio: beamforming-2g-gpio@0 {
+			compatible = "fairchild,74hc595";
+			reg = <0>;
+			registers-number = <1>;
+			spi-max-frequency = <24000000>;
+			gpio-controller;
+			#gpio-cells = <2>;
+		};
+	};
+
+	beamforming-5g-spi {
+		compatible = "spi-gpio";
+		mosi-gpios = <&ath9k1 5 GPIO_ACTIVE_HIGH>;
+		sck-gpios = <&ath9k1 6 GPIO_ACTIVE_HIGH>;
+		num-chipselects = <0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		beamforming_5g_gpio: beamforming-5g-gpio@0 {
+			compatible = "fairchild,74hc595";
+			reg = <0>;
+			registers-number = <1>;
+			spi-max-frequency = <24000000>;
+			gpio-controller;
+			#gpio-cells = <2>;
+		};
+	};
+};
+
+&pcie0 {
+	status = "okay";
+
+	ath9k0: wifi@0,11 { /* 2.4 GHz */
+		compatible = "pci168c,0029";
+		reg = <0x8800 0 0 0 0>;
+		nvmem-cells = <&macaddr_bdata_60>;
+		nvmem-cell-names = "mac-address";
+		#gpio-cells = <2>;
+		gpio-controller;
+	};
+
+	ath9k1: wifi@0,12 { /* 5 GHz */
+		compatible = "pci168c,0029";
+		reg = <0x9000 0 0 0 0>;
+		nvmem-cells = <&macaddr_bdata_76>;
+		nvmem-cell-names = "mac-address";
+		#gpio-cells = <2>;
+		gpio-controller;
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy0: ethernet-phy@1e {
+		reg = <0x1e>;
+	};
+};
+
+&eth0 {
+	status = "okay";
+	nvmem-cells = <&macaddr_bdata_66>;
+	nvmem-cell-names = "mac-address";
+
+	pll-data = <0x00110000 0x00001099 0x00991099>;
+	phy-handle = <&phy0>;
+	phy-mode = "rgmii-id";
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <104000000>;
+		m25p,fast-read;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				reg = <0x0 0x40000>;
+				label = "u-boot";
+				read-only;
+			};
+
+			/* On stock FW this encompasses rcks_wlan.main,
+			 * rcks_wlan.bkup and datafs partitions
+			 */
+			partition@40000 {
+				compatible = "openwrt,uimage", "denx,uimage";
+				reg = <0x40000 0xf40000>;
+				label = "firmware";
+			};
+
+			partition@f80000 {
+				compatible = "u-boot,env";
+				reg = <0xf80000 0x40000>;
+				label = "u-boot-env";
+			};
+
+			board_data: partition@fc0000 {
+				reg = <0xfc0000 0x40000>;
+				label = "board-data";
+				read-only;
+			};
+		};
+	};
+};
+
+&usb1 {
+	status = "okay";
+};
+
+&usb2 {
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&board_data {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_bdata_60: macaddr@60 {
+		reg = <0x60 0x6>;
+	};
+
+	macaddr_bdata_66: macaddr@66 {
+		reg = <0x66 0x6>;
+	};
+
+	macaddr_bdata_76: macaddr@76 {
+		reg = <0x76 0x6>;
+	};
+};
diff --git a/target/linux/ath79/dts/ar7161_ruckus_zf7341.dts b/target/linux/ath79/dts/ar7161_ruckus_zf7341.dts
new file mode 100644
index 00000000000000..17735e596f54f7
--- /dev/null
+++ b/target/linux/ath79/dts/ar7161_ruckus_zf7341.dts
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "ar7161_ruckus_zf734x.dtsi"
+
+/ {
+	model = "Ruckus ZoneFlex 7341[-U]";
+	compatible = "ruckus,zf7341", "qca,ar7161";
+};
diff --git a/target/linux/ath79/dts/ar7161_ruckus_zf734x.dtsi b/target/linux/ath79/dts/ar7161_ruckus_zf734x.dtsi
new file mode 100644
index 00000000000000..8861b09d1b7268
--- /dev/null
+++ b/target/linux/ath79/dts/ar7161_ruckus_zf734x.dtsi
@@ -0,0 +1,119 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "ar7161_ruckus_gd11.dtsi"
+
+&keys {
+	opt {
+		/* Not used by stock firmware */
+		label = "opt";
+		linux,code = <KEY_WPS_BUTTON>;
+		gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
+		debounce-interval = <60>;
+	};
+};
+
+&beamforming_2g_gpio {
+	/* Default beamforming switches configuration from stock firmware,
+	 * the AP is started and for broadcast frames - all outputs high */
+	lb0 {
+		line-name = "beamforming:2g:lb0";
+		gpios = <0 GPIO_ACTIVE_LOW>;
+		output-high;
+		gpio-hog;
+	};
+
+	lb1 {
+		line-name = "beamforming:2g:lb1";
+		gpios = <1 GPIO_ACTIVE_LOW>;
+		output-high;
+		gpio-hog;
+	};
+
+	lb2 {
+		line-name = "beamforming:2g:lb2";
+		gpios = <2 GPIO_ACTIVE_LOW>;
+		output-high;
+		gpio-hog;
+	};
+
+	lb3 {
+		line-name = "beamforming:2g:lb3";
+		gpios = <3 GPIO_ACTIVE_LOW>;
+		output-high;
+		gpio-hog;
+	};
+
+	lb4 {
+		line-name = "beamforming:2g:lb4";
+		gpios = <4 GPIO_ACTIVE_LOW>;
+		output-high;
+		gpio-hog;
+	};
+
+	lb5 {
+		line-name = "beamforming:2g:lb5";
+		gpios = <5 GPIO_ACTIVE_LOW>;
+		output-high;
+		gpio-hog;
+	};
+
+	lb6 {
+		line-name = "beamforming:2g:lb6";
+		gpios = <6 GPIO_ACTIVE_LOW>;
+		output-high;
+		gpio-hog;
+	};
+
+	lb7 {
+		line-name = "beamforming:2g:lb7";
+		gpios = <7 GPIO_ACTIVE_LOW>;
+		output-high;
+		gpio-hog;
+	};
+};
+
+&beamforming_5g_gpio {
+	/* Default beamforming switches configuration from stock firmware,
+	 * the AP is started and for broadcast frames - all outputs high */
+	hb0 {
+		line-name = "beamforming:5g:hb0";
+		gpios = <0 GPIO_ACTIVE_LOW>;
+		output-high;
+		gpio-hog;
+	};
+
+	hb1 {
+		line-name = "beamforming:5g:hb1";
+		gpios = <1 GPIO_ACTIVE_LOW>;
+		output-high;
+		gpio-hog;
+	};
+
+	hb2 {
+		line-name = "beamforming:5g:hb2";
+		gpios = <2 GPIO_ACTIVE_LOW>;
+		output-high;
+		gpio-hog;
+	};
+
+	hb3 {
+		line-name = "beamforming:5g:hb3";
+		gpios = <3 GPIO_ACTIVE_LOW>;
+		output-high;
+		gpio-hog;
+	};
+
+	hb4 {
+		line-name = "beamforming:5g:hb4";
+		gpios = <4 GPIO_ACTIVE_LOW>;
+		output-high;
+		gpio-hog;
+	};
+
+	hb5 {
+		line-name = "beamforming:5g:hb5";
+		gpios = <5 GPIO_ACTIVE_LOW>;
+		output-high;
+		gpio-hog;
+	};
+};
diff --git a/target/linux/ath79/dts/ar7161_ruckus_zf7351.dts b/target/linux/ath79/dts/ar7161_ruckus_zf7351.dts
new file mode 100644
index 00000000000000..37ea305790083a
--- /dev/null
+++ b/target/linux/ath79/dts/ar7161_ruckus_zf7351.dts
@@ -0,0 +1,115 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "ar7161_ruckus_gd11.dtsi"
+
+/ {
+	model = "Ruckus ZoneFlex 7351[-U]";
+	compatible = "ruckus,zf7351", "qca,ar7161";
+
+};
+
+&beamforming_2g_gpio {
+	/* Default beamforming switches configuration from stock firmware,
+	 * the AP is started and for broadcast frames - all outputs high */
+	lb0 {
+		line-name = "beamforming:2g:lb0";
+		gpios = <0 GPIO_ACTIVE_HIGH>;
+		output-high;
+		gpio-hog;
+	};
+
+	lb1 {
+		line-name = "beamforming:2g:lb1";
+		gpios = <1 GPIO_ACTIVE_HIGH>;
+		output-high;
+		gpio-hog;
+	};
+
+	lb2 {
+		line-name = "beamforming:2g:lb2";
+		gpios = <2 GPIO_ACTIVE_HIGH>;
+		output-high;
+		gpio-hog;
+	};
+
+	lb3 {
+		line-name = "beamforming:2g:lb3";
+		gpios = <4 GPIO_ACTIVE_HIGH>;
+		output-high;
+		gpio-hog;
+	};
+
+	lb4 {
+		line-name = "beamforming:2g:lb4";
+		gpios = <5 GPIO_ACTIVE_HIGH>;
+		output-high;
+		gpio-hog;
+	};
+
+	lb5 {
+		line-name = "beamforming:2g:lb5";
+		gpios = <6 GPIO_ACTIVE_HIGH>;
+		output-high;
+		gpio-hog;
+	};
+};
+
+&beamforming_5g_gpio {
+	/* Default beamforming switches configuration from stock firmware,
+	 * the AP is started and for broadcast frames - all outputs high */
+	hb0 {
+		line-name = "beamforming:5g:hb0";
+		gpios = <0 GPIO_ACTIVE_HIGH>;
+		output-high;
+		gpio-hog;
+	};
+
+	hb1 {
+		line-name = "beamforming:5g:hb1";
+		gpios = <1 GPIO_ACTIVE_HIGH>;
+		output-high;
+		gpio-hog;
+	};
+
+	hb2 {
+		line-name = "beamforming:5g:hb2";
+		gpios = <2 GPIO_ACTIVE_HIGH>;
+		output-high;
+		gpio-hog;
+	};
+
+	hb3 {
+		line-name = "beamforming:5g:hb3";
+		gpios = <3 GPIO_ACTIVE_HIGH>;
+		output-high;
+		gpio-hog;
+	};
+
+	hb4 {
+		line-name = "beamforming:5g:hb4";
+		gpios = <4 GPIO_ACTIVE_HIGH>;
+		output-high;
+		gpio-hog;
+	};
+
+	hb5 {
+		line-name = "beamforming:5g:hb5";
+		gpios = <5 GPIO_ACTIVE_HIGH>;
+		output-high;
+		gpio-hog;
+	};
+
+	hb6 {
+		line-name = "beamforming:5g:hb6";
+		gpios = <6 GPIO_ACTIVE_HIGH>;
+		output-high;
+		gpio-hog;
+	};
+
+	hb7 {
+		line-name = "beamforming:5g:hb7";
+		gpios = <7 GPIO_ACTIVE_HIGH>;
+		output-high;
+		gpio-hog;
+	};
+};
diff --git a/target/linux/ath79/dts/ar7161_ruckus_zf7363.dts b/target/linux/ath79/dts/ar7161_ruckus_zf7363.dts
new file mode 100644
index 00000000000000..4ece56dd0a0422
--- /dev/null
+++ b/target/linux/ath79/dts/ar7161_ruckus_zf7363.dts
@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "ar7161_ruckus_zf734x.dtsi"
+
+/ {
+	model = "Ruckus ZoneFlex 7343/7363[-U]";
+	compatible = "ruckus,zf7363", "qca,ar7161";
+};
+
+&mdio0 {
+	ethernet-phy@0 {
+		reg = <0x0>;
+		max-speed = <100>;
+	};
+
+	ethernet-phy@1 {
+		reg = <0x1>;
+		max-speed = <100>;
+	};
+};
+
+&eth1 {
+	status = "okay";
+	pll-data = <0x00110000 0x00001099 0x00991099>;
+	nvmem-cells = <&macaddr_bdata_6c>;
+	nvmem-cell-names = "mac-address";
+	phy-mode = "rgmii-id";
+
+	fixed-link {
+		speed = <100>;
+		full-duplex;
+	};
+};
+
+&board_data {
+	macaddr_bdata_6c: macaddr@6c {
+		reg = <0x6c 0x6>;
+	};
+};
diff --git a/target/linux/ath79/dts/ar7161_siemens_ws-ap3610.dts b/target/linux/ath79/dts/ar7161_siemens_ws-ap3610.dts
index 2cdcce0d152790..56a2cfab67b916 100644
--- a/target/linux/ath79/dts/ar7161_siemens_ws-ap3610.dts
+++ b/target/linux/ath79/dts/ar7161_siemens_ws-ap3610.dts
@@ -17,13 +17,6 @@
 		label-mac-device = &eth0;
 	};
 
-	extosc: ref {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-		clock-output-names = "ref";
-		clock-frequency = <40000000>;
-	};
-
 	leds {
 		compatible = "gpio-leds";
 
diff --git a/target/linux/ath79/dts/ar7161_trendnet_tew-673gru.dts b/target/linux/ath79/dts/ar7161_trendnet_tew-673gru.dts
new file mode 100644
index 00000000000000..a770ca04a87b75
--- /dev/null
+++ b/target/linux/ath79/dts/ar7161_trendnet_tew-673gru.dts
@@ -0,0 +1,169 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "ar7100.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "trendnet,tew-673gru", "qca,ar7161";
+	model = "TRENDNET TEW-673GRU";
+
+	aliases {
+		led-boot = &led_wps;
+		led-failsafe = &led_wps;
+		led-running = &led_wps;
+		led-upgrade = &led_wps;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_wps: wps {
+			label = "blue:wps";
+			gpios = <&gpio 9 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	rtl8366s {
+		compatible = "realtek,rtl8366s";
+		gpio-sda = <&gpio 5 GPIO_ACTIVE_HIGH>;
+		gpio-sck = <&gpio 7 GPIO_ACTIVE_HIGH>;
+		realtek,initvals = <0x06 0x0108>;
+
+		mdio-bus {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			phy4: ethernet-phy@4 {
+				reg = <4>;
+				phy-mode = "rgmii";
+			};
+		};
+	};
+
+	virtual_flash {
+		compatible = "mtd-concat";
+		devices = <&fwconcat0 &fwconcat1>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x0 0x0>;
+			};
+		};
+	};
+};
+
+&usb1 {
+	status = "okay";
+};
+
+&usb2 {
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+
+	wifi@0,11 {
+		compatible = "pci168c,0029";
+		reg = <0x8800 0 0 0 0>;
+		qca,no-eeprom;
+	};
+
+	wifi@0,12 {
+		compatible = "pci168c,0029";
+		reg = <0x9000 0 0 0 0>;
+		qca,no-eeprom;
+	};
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x040000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "config";
+				reg = <0x040000 0x010000>;
+				read-only;
+			};
+
+			fwconcat0: partition@50000 {
+				label = "fwconcat0";
+				reg = <0x050000 0x610000>;
+			};
+
+			partition@660000 {
+				label = "caldata";
+				reg = <0x660000 0x010000>;
+				read-only;
+			};
+
+			fwconcat1: partition@670000 {
+				label = "fwconcat1";
+				reg = <0x670000 0x190000>;
+			};
+		};
+	};
+};
+
+&eth0 {
+	status = "okay";
+
+	pll-data = <0x11110000 0x00001099 0x00991099>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&eth1 {
+	status = "okay";
+
+	pll-data = <0x11110000 0x00001099 0x00991099>;
+
+	phy-handle = <&phy4>;
+};
diff --git a/target/linux/ath79/dts/ar7161_ubnt_routerstation.dtsi b/target/linux/ath79/dts/ar7161_ubnt_routerstation.dtsi
index 172b0af1eb3bfe..ef4b0323778310 100644
--- a/target/linux/ath79/dts/ar7161_ubnt_routerstation.dtsi
+++ b/target/linux/ath79/dts/ar7161_ubnt_routerstation.dtsi
@@ -14,13 +14,6 @@
 		led-upgrade = &led_rf;
 	};
 
-	extosc: ref {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-		clock-output-names = "ref";
-		clock-frequency = <40000000>;
-	};
-
 	leds {
 		compatible = "gpio-leds";
 
@@ -106,22 +99,8 @@
 
 &usb1 {
 	status = "okay";
-	#address-cells = <1>;
-	#size-cells = <0>;
-
-	usb_ohci_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb2 {
 	status = "okay";
-	#address-cells = <1>;
-	#size-cells = <0>;
-
-	usb_ehci_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
diff --git a/target/linux/ath79/dts/ar7240.dtsi b/target/linux/ath79/dts/ar7240.dtsi
index 425d75f0d7c763..afbae33a803dad 100644
--- a/target/linux/ath79/dts/ar7240.dtsi
+++ b/target/linux/ath79/dts/ar7240.dtsi
@@ -32,6 +32,11 @@
 
 		#address-cells = <1>;
 		#size-cells = <0>;
+
+		hub_port: port@1 {
+			reg = <1>;
+			#trigger-source-cells = <0>;
+		};
 	};
 };
 
diff --git a/target/linux/ath79/dts/ar7240_openmesh_om2p-v1.dts b/target/linux/ath79/dts/ar7240_openmesh_om2p-v1.dts
index 456724a750a18c..a66d91401509ef 100644
--- a/target/linux/ath79/dts/ar7240_openmesh_om2p-v1.dts
+++ b/target/linux/ath79/dts/ar7240_openmesh_om2p-v1.dts
@@ -122,10 +122,26 @@
 				reg = <0x8c0000 0x700000>;
 			};
 
-			art: partition@fc0000 {
+			partition@fc0000 {
 				label = "ART";
 				reg = <0xfc0000 0x040000>;
 				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_art_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_art_6: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+
+				calibration_art_1000: calibration@1000 {
+					reg = <0x1000 0x440>;
+				};
 			};
 		};
 	};
@@ -149,22 +165,9 @@
 	wifi@0,0 {
 		compatible = "pci168c,002a";
 		reg = <0x0000 0 0 0 0>;
-		qca,no-eeprom;
+		nvmem-cells = <&calibration_art_1000>;
+		nvmem-cell-names = "calibration";
 		#gpio-cells = <2>;
 		gpio-controller;
 	};
 };
-
-&art {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_art_0: macaddr@0 {
-		reg = <0x0 0x6>;
-	};
-
-	macaddr_art_6: macaddr@6 {
-		reg = <0x6 0x6>;
-	};
-};
diff --git a/target/linux/ath79/dts/ar7240_ruckus_zf7025.dts b/target/linux/ath79/dts/ar7240_ruckus_zf7025.dts
new file mode 100644
index 00000000000000..9e0671d638c0c7
--- /dev/null
+++ b/target/linux/ath79/dts/ar7240_ruckus_zf7025.dts
@@ -0,0 +1,196 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "ar7240.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+
+/ {
+	model = "Ruckus ZoneFlex 7025";
+	compatible = "ruckus,zf7025", "qca,ar7240";
+
+	aliases {
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_red;
+		label-mac-device = &eth0;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		hard-reset {
+			label = "hard-reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds: leds {
+		compatible = "gpio-leds";
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&jtag_disable_pins &switch_led_disable_pins &clks_disable_pins>;
+
+		dir {
+			label = "green:dir";
+			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		lan1 {
+			label = "green:lan1";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+		};
+
+		lan2 {
+			label = "green:lan2";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		lan3 {
+			label = "green:lan3";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		};
+
+		lan4 {
+			label = "green:lan4";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		};
+
+		lan5 {
+			label = "green:lan5";
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+		};
+
+		opt {
+			label = "green:opt";
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_red: power-red {
+			label = "red:power";
+			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+			panic-indicator;
+		};
+
+		led_power_green: power-green {
+			label = "green:power";
+			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+
+		wlan-green {
+			label = "green:wlan";
+			gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0assoc";
+		};
+
+		wlan-yellow {
+			label = "yellow:wlan";
+			gpios = <&gpio 6 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+	};
+
+	reserved-memory {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+
+		ruckus-himem@3ff0000 {
+			/* Ruckus Himem area used to control
+			 * redundant boot image selection
+			 */
+			compatible = "nvmem-rmem";
+			reg = <0x3ff0000 0x10000>;
+			no-map;
+		};
+	};
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <104000000>;
+		m25p,fast-read;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				reg = <0x0 0x40000>;
+				label = "u-boot";
+				read-only;
+			};
+
+			/* On stock FW this encompasses rcks_wlan.main,
+			 * rcks_wlan.bkup and datafs partitions
+			 */
+			partition@40000 {
+				compatible = "openwrt,uimage", "denx,uimage";
+				reg = <0x40000 0xf40000>;
+				label = "firmware";
+			};
+
+			partition@f80000 {
+				compatible = "u-boot,env";
+				reg = <0xf80000 0x40000>;
+				label = "u-boot-env";
+			};
+
+			board_data: partition@fc0000 {
+				reg = <0xfc0000 0x40000>;
+				label = "board-data";
+				read-only;
+			};
+		};
+	};
+};
+
+&eth0 {
+	nvmem-cells = <&macaddr_board_data_66>;
+	nvmem-cell-names = "mac-address";
+};
+
+&eth1 {
+	status = "okay";
+	nvmem-cells = <&macaddr_board_data_6c>;
+	nvmem-cell-names = "mac-address";
+};
+
+&pcie {
+	status = "okay";
+
+	ath9k: wifi@0,0 {
+		compatible = "pci168c,002b";
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&macaddr_board_data_60>;
+		nvmem-cell-names = "mac-address";
+	};
+};
+
+&board_data {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_board_data_60: macaddr@60 {
+		reg = <0x60 0x6>;
+	};
+
+	macaddr_board_data_66: macaddr@66 {
+		reg = <0x66 0x6>;
+	};
+
+	macaddr_board_data_6c: macaddr@6c {
+		reg = <0x6c 0x6>;
+	};
+};
diff --git a/target/linux/ath79/dts/ar7241.dtsi b/target/linux/ath79/dts/ar7241.dtsi
index ff7a61f9214203..8d0e60da4024e3 100644
--- a/target/linux/ath79/dts/ar7241.dtsi
+++ b/target/linux/ath79/dts/ar7241.dtsi
@@ -39,6 +39,11 @@
 
 		#address-cells = <1>;
 		#size-cells = <0>;
+
+		hub_port: port@1 {
+			reg = <1>;
+			#trigger-source-cells = <0>;
+		};
 	};
 };
 
diff --git a/target/linux/ath79/dts/ar7241_netgear_wnr2200.dtsi b/target/linux/ath79/dts/ar7241_netgear_wnr2200.dtsi
index 6119af4a03c1b7..e17a485396ff2c 100644
--- a/target/linux/ath79/dts/ar7241_netgear_wnr2200.dtsi
+++ b/target/linux/ath79/dts/ar7241_netgear_wnr2200.dtsi
@@ -183,12 +183,5 @@
 };
 
 &usb {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
diff --git a/target/linux/ath79/dts/ar7241_tplink.dtsi b/target/linux/ath79/dts/ar7241_tplink.dtsi
index 84a9a4f63d6f9e..0861cc62322608 100644
--- a/target/linux/ath79/dts/ar7241_tplink.dtsi
+++ b/target/linux/ath79/dts/ar7241_tplink.dtsi
@@ -94,18 +94,17 @@
 	};
 };
 
-&eth0 {
+&eth0 {		/* WAN interface, initialized last as eth1 */
 	status = "okay";
 
 	nvmem-cells = <&macaddr_uboot_1fc00>;
 	nvmem-cell-names = "mac-address";
-	mac-address-increment = <(-1)>;
+	mac-address-increment = <1>;
 };
 
-&eth1 {
+&eth1 {		/* LAN interface, initialized first as eth0 */
 	nvmem-cells = <&macaddr_uboot_1fc00>;
 	nvmem-cell-names = "mac-address";
-	mac-address-increment = <1>;
 };
 
 &uboot {
diff --git a/target/linux/ath79/dts/ar7241_tplink_tl-mr3x20.dtsi b/target/linux/ath79/dts/ar7241_tplink_tl-mr3x20.dtsi
index 218ea5e4296c3f..a4bda13bced327 100644
--- a/target/linux/ath79/dts/ar7241_tplink_tl-mr3x20.dtsi
+++ b/target/linux/ath79/dts/ar7241_tplink_tl-mr3x20.dtsi
@@ -25,14 +25,7 @@
 };
 
 &usb {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy {
diff --git a/target/linux/ath79/dts/ar7241_tplink_tl-wr842n-v1.dts b/target/linux/ath79/dts/ar7241_tplink_tl-wr842n-v1.dts
index df77ca0fdc0bf3..6ee7d9ec4f9959 100644
--- a/target/linux/ath79/dts/ar7241_tplink_tl-wr842n-v1.dts
+++ b/target/linux/ath79/dts/ar7241_tplink_tl-wr842n-v1.dts
@@ -78,14 +78,7 @@
 };
 
 &usb {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy {
diff --git a/target/linux/ath79/dts/ar7241_ubnt_unifi-ap-outdoor-plus.dts b/target/linux/ath79/dts/ar7241_ubnt_unifi-ap-outdoor-plus.dts
index 9ccbdbd450d40e..3f965ec9deaea0 100644
--- a/target/linux/ath79/dts/ar7241_ubnt_unifi-ap-outdoor-plus.dts
+++ b/target/linux/ath79/dts/ar7241_ubnt_unifi-ap-outdoor-plus.dts
@@ -41,7 +41,7 @@
 			#address-cells = <1>;
 			#size-cells = <1>;
 
-			uboot: partition@0 {
+			partition@0 {
 				label = "u-boot";
 				reg = <0x0 0x40000>;
 				read-only;
@@ -82,10 +82,26 @@
 				read-only;
 			};
 
-			art: partition@ff0000 {
+			partition@ff0000 {
 				label = "art";
 				reg = <0xff0000 0x10000>;
 				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_art_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_art_6: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+
+				calibration_art_1000: calibration@1000 {
+					reg = <0x1000 0xeb8>;
+				};
 			};
 		};
 	};
@@ -105,18 +121,6 @@
 
 &wifi {
 	ubnt,hsr;
-};
-
-&art {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_art_0: macaddr@0 {
-		reg = <0x0 0x6>;
-	};
-
-	macaddr_art_6: macaddr@6 {
-		reg = <0x6 0x6>;
-	};
+	nvmem-cells = <&calibration_art_1000>;
+	nvmem-cell-names = "calibration";
 };
diff --git a/target/linux/ath79/dts/ar7241_ubnt_unifi-ap.dtsi b/target/linux/ath79/dts/ar7241_ubnt_unifi-ap.dtsi
index c70a1c02dba9d2..02166a26eb8610 100644
--- a/target/linux/ath79/dts/ar7241_ubnt_unifi-ap.dtsi
+++ b/target/linux/ath79/dts/ar7241_ubnt_unifi-ap.dtsi
@@ -68,15 +68,32 @@
 				read-only;
 			};
 
-			art: partition@7f0000 {
+			partition@7f0000 {
 				label = "art";
 				reg = <0x7f0000 0x010000>;
 				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_art_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				calibration_art_1000: calibration@1000 {
+					reg = <0x1000 0x440>;
+				};
 			};
 		};
 	};
 };
 
+&wifi {
+	nvmem-cells = <&calibration_art_1000>;
+	nvmem-cell-names = "calibration";
+};
+
 &eth0 {
 	nvmem-cells = <&macaddr_art_0>;
 	nvmem-cell-names = "mac-address";
@@ -85,13 +102,3 @@
 &eth1 {
 	compatible = "syscon", "simple-mfd";
 };
-
-&art {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_art_0: macaddr@0 {
-		reg = <0x0 0x6>;
-	};
-};
diff --git a/target/linux/ath79/dts/ar7241_ubnt_unifi.dtsi b/target/linux/ath79/dts/ar7241_ubnt_unifi.dtsi
index d05ed080a8c5f9..fa6c2337333bab 100644
--- a/target/linux/ath79/dts/ar7241_ubnt_unifi.dtsi
+++ b/target/linux/ath79/dts/ar7241_ubnt_unifi.dtsi
@@ -10,12 +10,6 @@
 		label-mac-device = &eth0;
 	};
 
-	extosc: ref {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-		clock-frequency = <40000000>;
-	};
-
 	keys {
 		compatible = "gpio-keys";
 
@@ -27,16 +21,11 @@
 	};
 };
 
-&pll {
-	clocks = <&extosc>;
-};
-
 &pcie {
 	status = "okay";
 
 	wifi: wifi@0,0 {
 		reg = <0x0000 0 0 0 0>;
-		qca,no-eeprom;
 	};
 };
 
diff --git a/target/linux/ath79/dts/ar7242.dtsi b/target/linux/ath79/dts/ar7242.dtsi
index eda1b16309ed3b..96b04426145e0b 100644
--- a/target/linux/ath79/dts/ar7242.dtsi
+++ b/target/linux/ath79/dts/ar7242.dtsi
@@ -39,6 +39,11 @@
 
 		#address-cells = <1>;
 		#size-cells = <0>;
+
+		hub_port: port@1 {
+			reg = <1>;
+			#trigger-source-cells = <0>;
+		};
 	};
 };
 
diff --git a/target/linux/ath79/dts/ar7242_buffalo_wzr-bhr.dtsi b/target/linux/ath79/dts/ar7242_buffalo_wzr-bhr.dtsi
index 18e524f802af59..15a808ad2ac966 100644
--- a/target/linux/ath79/dts/ar7242_buffalo_wzr-bhr.dtsi
+++ b/target/linux/ath79/dts/ar7242_buffalo_wzr-bhr.dtsi
@@ -12,12 +12,6 @@
 		led-upgrade = &led_diag;
 	};
 
-	extosc: ref {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-		clock-frequency = <40000000>;
-	};
-
 	keys: keys {
 		compatible = "gpio-keys";
 
@@ -136,21 +130,10 @@
 	phy-handle = <&phy0>;
 };
 
-&pll {
-	clocks = <&extosc>;
-};
-
 &usb_phy {
 	status = "okay";
 };
 
 &usb {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
diff --git a/target/linux/ath79/dts/ar7242_buffalo_wzr-hp-g302h-a1a0.dts b/target/linux/ath79/dts/ar7242_buffalo_wzr-hp-g302h-a1a0.dts
index f454725f6a9ba9..4a2f749cc4547f 100644
--- a/target/linux/ath79/dts/ar7242_buffalo_wzr-hp-g302h-a1a0.dts
+++ b/target/linux/ath79/dts/ar7242_buffalo_wzr-hp-g302h-a1a0.dts
@@ -15,12 +15,6 @@
 		led-upgrade = &led_diag;
 	};
 
-	extosc: ref {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-		clock-frequency = <40000000>;
-	};
-
 	keys {
 		compatible = "gpio-keys";
 
@@ -139,10 +133,22 @@
 				label = "u-boot-env";
 			};
 
-			art: partition@50000 {
+			partition@50000 {
 				reg = <0x50000 0x10000>;
 				label = "art";
 				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_art_120c: macaddr@120c {
+					reg = <0x120c 0x6>;
+				};
+
+				calibration_art_1000: calibration@1000 {
+					reg = <0x1000 0xeb8>;
+				};
 			};
 
 			partition@60000 {
@@ -203,39 +209,17 @@
 	ath9k: wifi@0,0 {
 		compatible = "pci168c,002a";
 		reg = <0x0000 0 0 0 0>;
-		nvmem-cells = <&macaddr_art_120c>;
-		nvmem-cell-names = "mac-address";
-		qca,no-eeprom;
+		nvmem-cells = <&macaddr_art_120c>, <&calibration_art_1000>;
+		nvmem-cell-names = "mac-address", "calibration";
 		#gpio-cells = <2>;
 		gpio-controller;
 	};
 };
 
-&pll {
-	clocks = <&extosc>;
-};
-
 &usb_phy {
 	status = "okay";
 };
 
 &usb {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
-};
-
-&art {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_art_120c: macaddr@120c {
-		reg = <0x120c 0x6>;
-	};
 };
diff --git a/target/linux/ath79/dts/ar7242_meraki_mr12.dts b/target/linux/ath79/dts/ar7242_meraki_mr12.dts
index 5e82b5bb6bcedd..42b4966e744b75 100644
--- a/target/linux/ath79/dts/ar7242_meraki_mr12.dts
+++ b/target/linux/ath79/dts/ar7242_meraki_mr12.dts
@@ -16,13 +16,6 @@
 		led-upgrade = &led_power_orange;
 	};
 
-	extosc: ref {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-		clock-output-names = "ref";
-		clock-frequency = <40000000>;
-	};
-
 	leds {
 		compatible = "gpio-leds";
 
@@ -87,10 +80,6 @@
 	};
 };
 
-&pll {
-	clocks = <&extosc>;
-};
-
 &mdio0 {
 	status = "okay";
 
diff --git a/target/linux/ath79/dts/ar7242_tplink_tl-wr2543-v1.dts b/target/linux/ath79/dts/ar7242_tplink_tl-wr2543-v1.dts
index ae4867521a7fd7..e250f2a5b45db8 100644
--- a/target/linux/ath79/dts/ar7242_tplink_tl-wr2543-v1.dts
+++ b/target/linux/ath79/dts/ar7242_tplink_tl-wr2543-v1.dts
@@ -21,12 +21,6 @@
 		bootargs = "console=ttyS0,115200n8";
 	};
 
-	extosc: ref {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-		clock-frequency = <40000000>;
-	};
-
 	keys {
 		compatible = "gpio-keys";
 
@@ -95,10 +89,6 @@
 	};
 };
 
-&pll {
-	clocks = <&extosc>;
-};
-
 &spi {
 	status = "okay";
 
@@ -125,7 +115,7 @@
 				reg = <0x020000 0x7d0000>;
 			};
 
-			partition@7f0000 {
+			art: partition@7f0000 {
 				label = "art";
 				reg = <0x7f0000 0x010000>;
 				read-only;
@@ -135,14 +125,7 @@
 };
 
 &usb {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy {
@@ -156,9 +139,8 @@
 		reg = <0x0000 0 0 0 0>;
 		#gpio-cells = <2>;
 		gpio-controller;
-		qca,no-eeprom;
-		nvmem-cells = <&macaddr_uboot_1fc00>;
-		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_uboot_1fc00>, <&cal_art_1000>;
+		nvmem-cell-names = "mac-address", "calibration";
 	};
 };
 
@@ -185,3 +167,13 @@
 		reg = <0x1fc00 0x6>;
 	};
 };
+
+&art {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	cal_art_1000: cal@1000 {
+		reg = <0x1000 0x440>;
+	};
+};
diff --git a/target/linux/ath79/dts/ar7242_ubnt_edgeswitch-8xp.dts b/target/linux/ath79/dts/ar7242_ubnt_edgeswitch-8xp.dts
index 915b4414dd0333..2ee7ab56c5a6c8 100644
--- a/target/linux/ath79/dts/ar7242_ubnt_edgeswitch-8xp.dts
+++ b/target/linux/ath79/dts/ar7242_ubnt_edgeswitch-8xp.dts
@@ -160,7 +160,6 @@
 
 			phy0: port8@8 {
 				reg = <8>;
-				label = "cpu";
 				ethernet = <&eth0>;
 
 				fixed-link {
diff --git a/target/linux/ath79/dts/ar7242_ubnt_sw.dtsi b/target/linux/ath79/dts/ar7242_ubnt_sw.dtsi
index c776c8ef6e7839..0268146b061503 100644
--- a/target/linux/ath79/dts/ar7242_ubnt_sw.dtsi
+++ b/target/linux/ath79/dts/ar7242_ubnt_sw.dtsi
@@ -114,14 +114,7 @@
 };
 
 &usb {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &pcie {
diff --git a/target/linux/ath79/dts/ar724x.dtsi b/target/linux/ath79/dts/ar724x.dtsi
index 882b0bc51a93e3..c090eb5e0fc31b 100644
--- a/target/linux/ath79/dts/ar724x.dtsi
+++ b/target/linux/ath79/dts/ar724x.dtsi
@@ -24,6 +24,13 @@
 		};
 	};
 
+	extosc: ref {
+		compatible = "fixed-clock";
+		#clock-cells = <0>;
+		clock-output-names = "ref";
+		clock-frequency = <40000000>;
+	};
+
 	ahb: ahb {
 		apb {
 			ddr_ctrl: memory-controller@18000000 {
@@ -89,8 +96,8 @@
 				compatible = "qca,ar7240-pll", "syscon";
 				reg = <0x18050000 0x3c>;
 
+				clocks = <&extosc>;
 				clock-names = "ref";
-				/* The board must provides the ref clock */
 
 				#clock-cells = <1>;
 				clock-output-names = "cpu", "ddr", "ahb";
diff --git a/target/linux/ath79/dts/ar9132.dtsi b/target/linux/ath79/dts/ar9132.dtsi
index 44a5870ad7afe3..71181c46de68dd 100644
--- a/target/linux/ath79/dts/ar9132.dtsi
+++ b/target/linux/ath79/dts/ar9132.dtsi
@@ -24,6 +24,13 @@
 		};
 	};
 
+	extosc: ref {
+		compatible = "fixed-clock";
+		#clock-cells = <0>;
+		clock-output-names = "ref";
+		clock-frequency = <40000000>;
+	};
+
 	cpuintc: interrupt-controller {
 		compatible = "qca,ar9132-cpu-intc", "qca,ar7100-cpu-intc";
 
@@ -94,8 +101,8 @@
 						"qca,ar9130-pll", "syscon";
 				reg = <0x18050000 0x20>;
 
+				clocks = <&extosc>;
 				clock-names = "ref";
-				/* The board must provides the ref clock */
 
 				#clock-cells = <1>;
 				clock-output-names = "cpu", "ddr", "ahb";
@@ -145,6 +152,14 @@
 			phys = <&usb_phy>;
 
 			status = "disabled";
+
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			hub_port: port@1 {
+				reg = <1>;
+				#trigger-source-cells = <0>;
+			};
 		};
 
 		spi: spi@1f000000 {
diff --git a/target/linux/ath79/dts/ar9132_buffalo_wzr-hp-g300nh.dtsi b/target/linux/ath79/dts/ar9132_buffalo_wzr-hp-g300nh.dtsi
index a84e794c0b6530..ac3af134577fa2 100644
--- a/target/linux/ath79/dts/ar9132_buffalo_wzr-hp-g300nh.dtsi
+++ b/target/linux/ath79/dts/ar9132_buffalo_wzr-hp-g300nh.dtsi
@@ -11,12 +11,6 @@
 		led-upgrade = &led_diag;
 	};
 
-	clock40mhz: ref {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-		clock-frequency = <40000000>;
-	};
-
 	/* There is a GPIO driven NXP 74HC153 dual 4-way multiplexer on board
 	 * used for buttons that are on top of the the device.
          */
@@ -184,7 +178,6 @@
 
 		gpio-sda = <&gpio 19 GPIO_ACTIVE_HIGH>;
 		gpio-sck = <&gpio 20 GPIO_ACTIVE_HIGH>;
-		mii-bus = <&mdio0>;
 
 		mdio-bus {
 			status = "okay";
@@ -250,20 +243,8 @@
 	status = "okay";
 };
 
-&pll {
-	clocks = <&clock40mhz>;
-};
-
 &usb {
 	status = "okay";
-
-	#address-cells = <1>;
-	#size-cells = <0>;
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy {
diff --git a/target/linux/ath79/dts/ar9132_tplink_tl-wa901nd-v2.dts b/target/linux/ath79/dts/ar9132_tplink_tl-wa901nd-v2.dts
index 354213c440487a..fd4a6c7a4d34c7 100644
--- a/target/linux/ath79/dts/ar9132_tplink_tl-wa901nd-v2.dts
+++ b/target/linux/ath79/dts/ar9132_tplink_tl-wa901nd-v2.dts
@@ -17,12 +17,6 @@
 		label-mac-device = &eth0;
 	};
 
-	extosc: ref {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-		clock-frequency = <40000000>;
-	};
-
 	keys {
 		compatible = "gpio-keys";
 
@@ -62,10 +56,6 @@
 	};
 };
 
-&pll {
-	clocks = <&extosc>;
-};
-
 &spi {
 	status = "okay";
 
diff --git a/target/linux/ath79/dts/ar9132_tplink_tl-wr1043nd-v1.dts b/target/linux/ath79/dts/ar9132_tplink_tl-wr1043nd-v1.dts
index 12e417d3a479f9..6eb2a0acb5f872 100644
--- a/target/linux/ath79/dts/ar9132_tplink_tl-wr1043nd-v1.dts
+++ b/target/linux/ath79/dts/ar9132_tplink_tl-wr1043nd-v1.dts
@@ -17,12 +17,6 @@
 		label-mac-device = &eth0;
 	};
 
-	extosc: ref {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-		clock-frequency = <40000000>;
-	};
-
 	keys {
 		compatible = "gpio-keys";
 
@@ -79,19 +73,8 @@
 	};
 };
 
-&pll {
-	clocks = <&extosc>;
-};
-
 &usb {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy {
diff --git a/target/linux/ath79/dts/ar9132_tplink_tl-wr941-v2.dts b/target/linux/ath79/dts/ar9132_tplink_tl-wr941-v2.dts
index 58586eb03615b3..106ca56e7ed696 100644
--- a/target/linux/ath79/dts/ar9132_tplink_tl-wr941-v2.dts
+++ b/target/linux/ath79/dts/ar9132_tplink_tl-wr941-v2.dts
@@ -99,7 +99,6 @@
 
 			port@5 {
 				reg = <5>;
-				label = "cpu";
 				ethernet = <&eth0>;
 			};
 		};
diff --git a/target/linux/ath79/dts/ar9330.dtsi b/target/linux/ath79/dts/ar9330.dtsi
index aed8e205adacdb..466e0fb25dc5a1 100644
--- a/target/linux/ath79/dts/ar9330.dtsi
+++ b/target/linux/ath79/dts/ar9330.dtsi
@@ -28,6 +28,12 @@
 		bootargs = "console=ttyATH0,115200";
 	};
 
+	ref: ref {
+		compatible = "fixed-clock";
+		#clock-cells = <0>;
+		clock-output-names = "ref";
+	};
+
 	ahb {
 		apb {
 			ddr_ctrl: memory-controller@18000000 {
@@ -83,7 +89,11 @@
 				compatible = "qca,ar9330-pll";
 				reg = <0x18050000 0x100>;
 
+				clocks = <&ref>;
+				clock-names = "ref";
+
 				#clock-cells = <1>;
+				clock-output-names = "cpu", "ddr", "ahb";
 			};
 
 			wdt: wdt@18060008 {
@@ -119,6 +129,11 @@
 
 			#address-cells = <1>;
 			#size-cells = <0>;
+
+			hub_port: port@1 {
+				reg = <1>;
+				#trigger-source-cells = <0>;
+			};
 		};
 
 		spi: spi@1f000000 {
diff --git a/target/linux/ath79/dts/ar9331.dtsi b/target/linux/ath79/dts/ar9331.dtsi
index 2141f338635b7b..d363130278abd4 100644
--- a/target/linux/ath79/dts/ar9331.dtsi
+++ b/target/linux/ath79/dts/ar9331.dtsi
@@ -4,9 +4,4 @@
 
 / {
 	compatible = "qca,ar9331";
-
-	ref: ref {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-	};
 };
diff --git a/target/linux/ath79/dts/ar9331_arduino_yun.dts b/target/linux/ath79/dts/ar9331_arduino_yun.dts
index 389a83dd2282e0..bf3a46f96261ca 100644
--- a/target/linux/ath79/dts/ar9331_arduino_yun.dts
+++ b/target/linux/ath79/dts/ar9331_arduino_yun.dts
@@ -57,7 +57,7 @@
 		usb {
 			label = "white:usb";
 			gpios = <&gpio 1 GPIO_ACTIVE_HIGH>;
-			trigger-sources = <&hub_port1>;
+			trigger-sources = <&hub_port>;
 			linux,default-trigger = "usbport";
 		};
 	};
@@ -125,22 +125,8 @@
 &usb {
 	status = "okay";
 
-	#address-cells = <1>;
-	#size-cells = <0>;
 	dr_mode = "host";
 	vbus-supply = <&reg_usb_vbus>;
-
-	port@1 {
-		#address-cells = <1>;
-		#size-cells = <0>;
-		reg = <1>;
-		#trigger-source-cells = <0>;
-
-		hub_port1: port@1 {
-			reg = <1>;
-			#trigger-source-cells = <0>;
-		};
-	};
 };
 
 &usb_phy {
diff --git a/target/linux/ath79/dts/ar9331_teltonika_rut230-v1.dts b/target/linux/ath79/dts/ar9331_teltonika_rut230-v1.dts
index 1858c74272b137..26004c1cfd6724 100644
--- a/target/linux/ath79/dts/ar9331_teltonika_rut230-v1.dts
+++ b/target/linux/ath79/dts/ar9331_teltonika_rut230-v1.dts
@@ -10,7 +10,7 @@
 	compatible = "teltonika,rut230-v1", "qca,ar9331";
 
 	aliases {
-		label-mac-device = &wmac;
+		label-mac-device = &eth1;
 		led-boot = &led_ss0;
 		led-failsafe = &led_ss0;
 		led-upgrade = &led_ss0;
@@ -111,6 +111,7 @@
 
 	nvmem-cells = <&macaddr_config_0>;
 	nvmem-cell-names = "mac-address";
+	mac-address-increment = <1>;
 };
 
 &eth1 {
@@ -118,7 +119,6 @@
 
 	nvmem-cells = <&macaddr_config_0>;
 	nvmem-cell-names = "mac-address";
-	mac-address-increment = <1>;
 };
 
 &spi {
diff --git a/target/linux/ath79/dts/ar9331_tplink_tl-mr3020-v1.dts b/target/linux/ath79/dts/ar9331_tplink_tl-mr3020-v1.dts
index c420c1a4cd5195..c23e5dac5165d1 100644
--- a/target/linux/ath79/dts/ar9331_tplink_tl-mr3020-v1.dts
+++ b/target/linux/ath79/dts/ar9331_tplink_tl-mr3020-v1.dts
@@ -86,16 +86,9 @@
 };
 
 &usb {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	dr_mode = "host";
 	vbus-supply = <&reg_usb_vbus>;
 	status = "okay";
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy {
diff --git a/target/linux/ath79/dts/ar9331_tplink_tl-mr3040-v2.dts b/target/linux/ath79/dts/ar9331_tplink_tl-mr3040-v2.dts
index 619fd09ee99443..b0f24bbfa705d4 100644
--- a/target/linux/ath79/dts/ar9331_tplink_tl-mr3040-v2.dts
+++ b/target/linux/ath79/dts/ar9331_tplink_tl-mr3040-v2.dts
@@ -82,16 +82,9 @@
 };
 
 &usb {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	dr_mode = "host";
 	vbus-supply = <&reg_usb_vbus>;
 	status = "okay";
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy {
diff --git a/target/linux/ath79/dts/ar9331_tplink_tl-wr741nd-v4.dtsi b/target/linux/ath79/dts/ar9331_tplink_tl-wr741nd-v4.dtsi
index b74b8251ce5c0a..4d3b1dba1d6ff9 100644
--- a/target/linux/ath79/dts/ar9331_tplink_tl-wr741nd-v4.dtsi
+++ b/target/linux/ath79/dts/ar9331_tplink_tl-wr741nd-v4.dtsi
@@ -118,7 +118,7 @@
 	};
 };
 
-&eth0 {
+&eth0 {		/* WAN interface, initialized last as eth1 */
 	status = "okay";
 
 	nvmem-cells = <&macaddr_uboot_1fc00>;
@@ -133,12 +133,11 @@
 	};
 };
 
-&eth1 {
+&eth1 {		/* LAN interface, initialized first as eth0 */
 	status = "okay";
 
 	nvmem-cells = <&macaddr_uboot_1fc00>;
 	nvmem-cell-names = "mac-address";
-	mac-address-increment = <(-1)>;
 };
 
 &wmac {
diff --git a/target/linux/ath79/dts/ar9341_tplink_tl-mr3420-v2.dts b/target/linux/ath79/dts/ar9341_tplink_tl-mr3420-v2.dts
index f86c4423bf98d7..2ccd50d7836a03 100644
--- a/target/linux/ath79/dts/ar9341_tplink_tl-mr3420-v2.dts
+++ b/target/linux/ath79/dts/ar9341_tplink_tl-mr3420-v2.dts
@@ -82,14 +82,7 @@
 };
 
 &usb {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy {
diff --git a/target/linux/ath79/dts/ar9341_tplink_tl-wr842n-v2.dts b/target/linux/ath79/dts/ar9341_tplink_tl-wr842n-v2.dts
index 5d20df9261edc6..0fc34884453fe4 100644
--- a/target/linux/ath79/dts/ar9341_tplink_tl-wr842n-v2.dts
+++ b/target/linux/ath79/dts/ar9341_tplink_tl-wr842n-v2.dts
@@ -83,14 +83,7 @@
 };
 
 &usb {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy {
diff --git a/target/linux/ath79/dts/ar9342_mikrotik_routerboard-912uag-2hpnd.dts b/target/linux/ath79/dts/ar9342_mikrotik_routerboard-912uag-2hpnd.dts
index 6435393a736c06..cda96494e70138 100644
--- a/target/linux/ath79/dts/ar9342_mikrotik_routerboard-912uag-2hpnd.dts
+++ b/target/linux/ath79/dts/ar9342_mikrotik_routerboard-912uag-2hpnd.dts
@@ -10,11 +10,11 @@
 	model = "MikroTik RouterBOARD 912UAG-2HPnD";
 
 	aliases {
-                led-boot = &led_power;
-                led-failsafe = &led_power;
-                led-running = &led_power;
-                led-upgrade = &led_power;
-        };
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
 
 	gpio_key: gpio_key {
 		compatible = "mikrotik,gpio-rb91x-key";
@@ -147,7 +147,7 @@
 };
 
 &ref {
-	clock-frequency = <25000000>;
+	clock-frequency = <40000000>;
 };
 
 &spi {
diff --git a/target/linux/ath79/dts/ar9342_ubnt_aircube-ac.dts b/target/linux/ath79/dts/ar9342_ubnt_aircube-ac.dts
index e93c1b8dabc54e..49cf39062a22a8 100644
--- a/target/linux/ath79/dts/ar9342_ubnt_aircube-ac.dts
+++ b/target/linux/ath79/dts/ar9342_ubnt_aircube-ac.dts
@@ -58,10 +58,26 @@
 				read-only;
 			};
 
-			art: partition@ff0000 {
+			partition@ff0000 {
 				label = "art";
 				reg = <0xff0000 0x010000>;
 				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_art_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				calibration_art_1000: calibration@1000 {
+					reg = <0x1000 0x440>;
+				};
+
+				calibration_art_5000: calibration@5000 {
+					reg = <0x5000 0x844>;
+				};
 			};
 		};
 	};
@@ -73,6 +89,13 @@
 
 &pcie {
 	status = "okay";
+
+	wifi@0,0 {
+		compatible = "qcom,ath10k";
+		reg = <0x0 0 0 0 0>;
+		nvmem-cells = <&calibration_art_5000>;
+		nvmem-cell-names = "calibration";
+	};
 };
 
 &mdio0 {
@@ -109,15 +132,6 @@
 &wmac {
 	status = "okay";
 
-	mtd-cal-data = <&art 0x1000>;
-};
-
-&art {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_art_0: macaddr@0 {
-		reg = <0x0 0x6>;
-	};
+	nvmem-cells = <&calibration_art_1000>;
+	nvmem-cell-names = "calibration";
 };
diff --git a/target/linux/ath79/dts/ar9344_araknis_an-300-ap-i-n.dts b/target/linux/ath79/dts/ar9344_araknis_an-300-ap-i-n.dts
index a886b4c0010f69..ac39a626790b51 100644
--- a/target/linux/ath79/dts/ar9344_araknis_an-300-ap-i-n.dts
+++ b/target/linux/ath79/dts/ar9344_araknis_an-300-ap-i-n.dts
@@ -87,11 +87,10 @@
 	ath9k: wifi@0,0,0 {
 		compatible = "pci168c,0030";
 		reg = <0x0 0 0 0 0>;
-		nvmem-cells = <&macaddr_art_0>;
-		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_art_0>, <&calibration_art_5000>;
+		nvmem-cell-names = "mac-address", "calibration";
 		mac-address-increment = <1>;
-		qca,disable-5ghz;
-		qca,no-eeprom;
+		ieee80211-freq-limit = <2402000 2482000>;
 		#gpio-cells = <2>;
 		gpio-controller;
 	};
@@ -100,12 +99,10 @@
 &wmac {
 	status = "okay";
 
-	qca,disable-2ghz;
+	ieee80211-freq-limit = <4900000 5990000>;
 
-	mtd-cal-data = <&art 0x1000>;
-
-	nvmem-cells = <&macaddr_art_0>;
-	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_art_0>, <&calibration_art_1000>;
+	nvmem-cell-names = "mac-address", "calibration";
 	mac-address-increment = <2>;
 };
 
@@ -117,4 +114,12 @@
 	macaddr_art_0: macaddr@0 {
 		reg = <0x0 0x6>;
 	};
+
+	calibration_art_1000: calibration@1000 {
+		reg = <0x1000 0x440>;
+	};
+
+	calibration_art_5000: calibration@5000 {
+		reg = <0x5000 0x440>;
+	};
 };
diff --git a/target/linux/ath79/dts/ar9344_atheros_db120.dts b/target/linux/ath79/dts/ar9344_atheros_db120.dts
index 906335ed6fcf9b..8811d4f4576baa 100644
--- a/target/linux/ath79/dts/ar9344_atheros_db120.dts
+++ b/target/linux/ath79/dts/ar9344_atheros_db120.dts
@@ -41,7 +41,7 @@
 		usb {
 			label = "green:usb";
 			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
-			trigger-sources = <&hub_port1>;
+			trigger-sources = <&hub_port>;
 			linux,default-trigger = "usbport";
 		};
 	};
@@ -135,10 +135,30 @@
 				reg = <0x7e0000 0x010000>;
 			};
 
-			art: partition@7f0000 {
+			partition@7f0000 {
 				label = "art";
 				reg = <0x7f0000 0x010000>;
 				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_art_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_art_6: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+
+				calibration_art_1000: calibration@1000 {
+					reg = <0x1000 0x440>;
+				};
+
+				calibration_art_5000: calibration@5000 {
+					reg = <0x5000 0x440>;
+				};
 			};
 		};
 	};
@@ -204,7 +224,8 @@
 	ath9k: wifi@0,0 {
 		compatible = "pci168c,0030";
 		reg = <0x0000 0 0 0 0>;
-		qca,no-eeprom;
+		nvmem-cells = <&calibration_art_5000>;
+		nvmem-cell-names = "calibration";
 		ieee80211-freq-limit = <4900000 5990000>;
 		#gpio-cells = <2>;
 		gpio-controller;
@@ -214,35 +235,14 @@
 &wmac {
 	status = "okay";
 
-	mtd-cal-data = <&art 0x1000>;
+	nvmem-cells = <&calibration_art_1000>;
+	nvmem-cell-names = "calibration";
 };
 
 &usb {
 	status = "okay";
-
-	#address-cells = <1>;
-	#size-cells = <0>;
-
-	hub_port1: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy {
 	status = "okay";
 };
-
-&art {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_art_0: macaddr@0 {
-		reg = <0x0 0x6>;
-	};
-
-	macaddr_art_6: macaddr@6 {
-		reg = <0x6 0x6>;
-	};
-};
diff --git a/target/linux/ath79/dts/ar9344_dlink_dir-825-c1.dts b/target/linux/ath79/dts/ar9344_dlink_dir-825-c1.dts
index e6f18cea69580e..35d0e26d8530d9 100644
--- a/target/linux/ath79/dts/ar9344_dlink_dir-825-c1.dts
+++ b/target/linux/ath79/dts/ar9344_dlink_dir-825-c1.dts
@@ -28,7 +28,7 @@
 			label = "blue:usb";
 			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
 			linux,default-trigger = "usbport";
-			trigger-sources = <&hub_port1>;
+			trigger-sources = <&hub_port>;
 		};
 
 		wan_blue {
diff --git a/target/linux/ath79/dts/ar9344_dlink_dir-8x5.dtsi b/target/linux/ath79/dts/ar9344_dlink_dir-8x5.dtsi
index dded9d665597bb..8e21b0dd9e8ff8 100644
--- a/target/linux/ath79/dts/ar9344_dlink_dir-8x5.dtsi
+++ b/target/linux/ath79/dts/ar9344_dlink_dir-8x5.dtsi
@@ -29,6 +29,9 @@
 	/* default for ar934x, except for 1000M */
 	pll-data = <0x06000000 0x00000101 0x00001616>;
 
+	nvmem-cells = <&macaddr_lan>;
+	nvmem-cell-names = "mac-address-ascii";
+
 	phy-mode = "rgmii";
 	phy-handle = <&phy0>;
 };
@@ -55,7 +58,13 @@
 	ath9k: wifi@0,0 {
 		compatible = "pci168c,0030";
 		reg = <0x0000 0 0 0 0>;
-		qca,no-eeprom;
+		/* "mac-address-ascii" currently does not work for
+		   ath9k pci devices. these below are retained for future
+		   improvements. */
+		/* nvmem-cells = <&macaddr_wan>, <&cal_art_5000>;
+		   nvmem-cell-names = "mac-address-ascii", "calibration";
+		   mac-address-increment = <1>; */
+		qca,no-eeprom; /* remove this when "mac-address-ascii" works  */
 		gpio-controller;
 		#gpio-cells = <2>;
 	};
@@ -102,16 +111,40 @@
 				read-only;
 			};
 
-			partition@fe0000 {
+			mac: partition@fe0000 {
 				label = "mac";
 				reg = <0xfe0000 0x010000>;
 				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_lan: macaddr@4 {
+					reg = <0x4 0x11>;
+				};
+
+				macaddr_wan: macaddr@18 {
+					reg = <0x18 0x11>;
+				};
 			};
 
-			partition@ff0000 {
+			art: partition@ff0000 {
 				label = "art";
 				reg = <0xff0000 0x010000>;
 				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				cal_art_1000: cal@1000 {
+					reg = <0x1000 0x440>;
+				};
+
+				cal_art_5000: cal@5000 {
+					reg = <0x5000 0x440>;
+				};
 			};
 		};
 	};
@@ -119,13 +152,6 @@
 
 &usb {
 	status = "okay";
-	#address-cells = <1>;
-	#size-cells = <0>;
-
-	hub_port1: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy {
@@ -134,5 +160,6 @@
 
 &wmac {
 	status = "okay";
-	qca,no-eeprom;
+	nvmem-cells = <&macaddr_lan>, <&cal_art_1000>;
+	nvmem-cell-names = "mac-address-ascii", "calibration";
 };
diff --git a/target/linux/ath79/dts/ar9344_engenius_eap600.dts b/target/linux/ath79/dts/ar9344_engenius_eap600.dts
index 50e0674be48f2f..618660802c09e7 100644
--- a/target/linux/ath79/dts/ar9344_engenius_eap600.dts
+++ b/target/linux/ath79/dts/ar9344_engenius_eap600.dts
@@ -36,14 +36,14 @@
 
 &pcie {
 	wifi@0,0,0 {
-		nvmem-cells = <&macaddr_art_0>;
-		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_art_0>, <&calibration_art_5000>;
+		nvmem-cell-names = "mac-address", "calibration";
 	};
 };
 
 &wmac {
-	nvmem-cells = <&macaddr_art_0>;
-	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_art_0>, <&calibration_art_1000>;
+	nvmem-cell-names = "mac-address", "calibration";
 	mac-address-increment = <(-1)>;
 };
 
@@ -55,4 +55,12 @@
 	macaddr_art_0: macaddr@0 {
 		reg = <0x0 0x6>;
 	};
+
+	calibration_art_1000: calibration@1000 {
+		reg = <0x1000 0x440>;
+	};
+
+	calibration_art_5000: calibration@5000 {
+		reg = <0x5000 0x440>;
+	};
 };
diff --git a/target/linux/ath79/dts/ar9344_engenius_ecb600.dts b/target/linux/ath79/dts/ar9344_engenius_ecb600.dts
index ad32dc9e392a3f..5f6ffb130d79a8 100644
--- a/target/linux/ath79/dts/ar9344_engenius_ecb600.dts
+++ b/target/linux/ath79/dts/ar9344_engenius_ecb600.dts
@@ -30,15 +30,15 @@
 
 &pcie {
 	wifi@0,0,0 {
-		nvmem-cells = <&macaddr_art_0>;
-		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_art_0>, <&calibration_art_5000>;
+		nvmem-cell-names = "mac-address", "calibration";
 		mac-address-increment = <(-2)>;
 	};
 };
 
 &wmac {
-	nvmem-cells = <&macaddr_art_0>;
-	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_art_0>, <&calibration_art_1000>;
+	nvmem-cell-names = "mac-address", "calibration";
 	mac-address-increment = <(-1)>;
 };
 
@@ -50,4 +50,12 @@
 	macaddr_art_0: macaddr@0 {
 		reg = <0x0 0x6>;
 	};
+
+	calibration_art_1000: calibration@1000 {
+		reg = <0x1000 0x440>;
+	};
+
+	calibration_art_5000: calibration@5000 {
+		reg = <0x5000 0x440>;
+	};
 };
diff --git a/target/linux/ath79/dts/ar9344_fortinet_ap-dual.dtsi b/target/linux/ath79/dts/ar9344_fortinet_ap-dual.dtsi
new file mode 100644
index 00000000000000..d5275c496e341b
--- /dev/null
+++ b/target/linux/ath79/dts/ar9344_fortinet_ap-dual.dtsi
@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "ar9344.dtsi"
+#include "ar934x_fortinet_loader.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,9600";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+};
+
+&ref {
+	clock-frequency = <25000000>;
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		eee-broken-100tx;
+		eee-broken-1000t;
+	};
+};
+
+&eth0 {
+	status = "okay";
+
+	phy-handle = <&phy0>;
+	phy-mode = "rgmii-txid";
+
+	pll-data = <0x02000000 0x00000101 0x00001313>;
+};
+
+&pcie {
+	status = "okay";
+
+	ath9k: wifi@0,0,0 {
+		compatible = "pci168c,0030";
+		reg = <0x0 0 0 0 0>;
+	};
+};
+
+&wmac {
+	status = "okay";
+};
diff --git a/target/linux/ath79/dts/ar9344_fortinet_fap-221-b.dts b/target/linux/ath79/dts/ar9344_fortinet_fap-221-b.dts
new file mode 100644
index 00000000000000..b78a588f5ccd47
--- /dev/null
+++ b/target/linux/ath79/dts/ar9344_fortinet_fap-221-b.dts
@@ -0,0 +1,75 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "ar9344_fortinet_ap-dual.dtsi"
+
+/ {
+	compatible = "fortinet,fap-221-b", "qca,ar9344";
+	model = "Fortinet FAP-221-B";
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: power_green {
+			label = "green:power";
+			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+
+		power_amber {
+			label = "amber:power";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		};
+
+		eth_green {
+			label = "green:eth";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		};
+
+		eth_amber {
+			label = "amber:eth";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		wifi5g {
+			label = "green:wifi5g";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wifi2g {
+			label = "amber:wifi2g";
+			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+	};
+
+	virtual_flash {
+		devices = <&fwconcat0 &fwconcat1 &fwconcat2>;
+	};
+};
+
+&ath9k {
+	ieee80211-freq-limit = <2402000 2482000>;
+
+	nvmem-cells = <&calibration_pcie>;
+	nvmem-cell-names = "calibration";
+};
+
+&wmac {
+	ieee80211-freq-limit = <2402000 2482000 4900000 5990000>;
+
+	nvmem-cells = <&calibration_wmac>;
+	nvmem-cell-names = "calibration";
+};
+
+&art {
+	compatible = "nvmem-cells";
+
+	calibration_wmac: calibration@1000 {
+		reg = <0x1000 0x440>;
+	};
+
+	calibration_pcie: calibration@5000 {
+		reg = <0x5000 0x440>;
+	};
+};
diff --git a/target/linux/ath79/dts/ar9344_mikrotik_routerboard-16m-nor.dtsi b/target/linux/ath79/dts/ar9344_mikrotik_routerboard-16m-nor.dtsi
index 7cc4bb689cd814..b915dd5a723dba 100644
--- a/target/linux/ath79/dts/ar9344_mikrotik_routerboard-16m-nor.dtsi
+++ b/target/linux/ath79/dts/ar9344_mikrotik_routerboard-16m-nor.dtsi
@@ -1,7 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 
-#include "ar9344.dtsi"
-
 &spi {
 	status = "okay";
 
@@ -55,9 +53,3 @@
 		};
 	};
 };
-
-&wmac {
-	status = "okay";
-
-	qca,no-eeprom;
-};
diff --git a/target/linux/ath79/dts/ar9344_mikrotik_routerboard-911-lite.dts b/target/linux/ath79/dts/ar9344_mikrotik_routerboard-911-lite.dts
new file mode 100644
index 00000000000000..0315f49d07480d
--- /dev/null
+++ b/target/linux/ath79/dts/ar9344_mikrotik_routerboard-911-lite.dts
@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "ar9344_mikrotik_routerboard.dtsi"
+#include "ar9344_mikrotik_routerboard-16m-nor.dtsi"
+
+/ {
+	model = "MikroTik RouterBOARD 911-2Hn/5Hn (Lite2/Lite5)";
+	compatible = "mikrotik,routerboard-911-lite", "qca,ar9344";
+};
+
+&leds {
+	pinctrl-names = "default";
+	pinctrl-0 = <&enable_gpio_20>;
+
+	lan {
+		label = "green:lan";
+		gpios = <&gpio 20 GPIO_ACTIVE_LOW>;
+	};
+
+	power {
+		label = "green:power";
+		gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
+		default-state = "on";
+	};
+
+	led_user: user {
+		label = "green:user";
+		gpios = <&gpio 3 (GPIO_ACTIVE_LOW|GPIO_OPEN_DRAIN)>;
+	};
+};
+
+&pinmux {
+	enable_gpio_20: pinmux_gpio_out_function5 {
+		pinctrl-single,bits = <0x14 0x0 0xff>;
+	};
+};
diff --git a/target/linux/ath79/dts/ar9344_mikrotik_routerboard-951ui-2hnd.dts b/target/linux/ath79/dts/ar9344_mikrotik_routerboard-951ui-2hnd.dts
new file mode 100644
index 00000000000000..3d59a30f1128fa
--- /dev/null
+++ b/target/linux/ath79/dts/ar9344_mikrotik_routerboard-951ui-2hnd.dts
@@ -0,0 +1,153 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "ar9344_mikrotik_routerboard.dtsi"
+
+/ {
+	compatible = "mikrotik,routerboard-951ui-2hnd", "qca,ar9344";
+	model = "Mikrotik RouterBOARD 951Ui-2HnD";
+
+	/delete-node/ leds;
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_user: user {
+			label = "green:user";
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+		};
+
+		port1 {
+			label = "green:port1";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		};
+
+		port2 {
+			label = "green:port2";
+			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
+		};
+
+		port3 {
+			label = "green:port3";
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+		};
+
+		port4 {
+			label = "green:port4";
+			gpios = <&gpio 21 GPIO_ACTIVE_LOW>;
+		};
+
+		port5 {
+			label = "green:port5";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio-export {
+		compatible = "gpio-export";
+
+		gpio_poe_power {
+			gpio-export,name = "rb951ui2hnd:power:poe";
+			gpio-export,output = <1>;
+			gpios = <&gpio 2 GPIO_ACTIVE_HIGH>;
+		};
+
+		gpio_usb_power {
+			gpio-export,name = "rb951ui2hnd:power:usb";
+			gpio-export,output = <1>;
+			gpios = <&gpio 20 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&gpio {
+	nand_power {
+		gpio-hog;
+		gpios = <14 GPIO_ACTIVE_LOW>;
+		output-high;
+	};
+};
+
+&nand {
+	status = "okay";
+
+	nand-ecc-mode = "soft";
+	qca,nand-swap-dma;
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "booter";
+			reg = <0x0000000 0x0040000>;
+			read-only;
+		};
+
+		partition@40000 {
+			label = "kernel";
+			reg = <0x0040000 0x03c0000>;
+		};
+
+		partition@400000 {
+			label = "ubi";
+			reg = <0x0400000 0x7c00000>;
+		};
+	};
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "mikrotik,routerboot-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "routerboot";
+				reg = <0x0 0x0>;
+				read-only;
+			};
+
+			hard_config: hard_config {
+				read-only;
+			};
+
+			bios {
+				size = <0x1000>;
+				read-only;
+			};
+
+			soft_config {
+			};
+		};
+	};
+};
+
+&eth0 {
+	phy-handle = <&swphy4>;
+
+	/delete-node/ gmac-config;
+};
+
+&eth1 {
+	compatible = "qca,ar9340-eth", "syscon";
+};
+
+&wmac {
+	qca,led-pin = /bits/ 8 <11>;
+};
+
+&usb {
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
diff --git a/target/linux/ath79/dts/ar9344_mikrotik_routerboard-lhg-5nd.dts b/target/linux/ath79/dts/ar9344_mikrotik_routerboard-lhg-5nd.dts
index 194a789fb21657..b6de8c4b7b119f 100644
--- a/target/linux/ath79/dts/ar9344_mikrotik_routerboard-lhg-5nd.dts
+++ b/target/linux/ath79/dts/ar9344_mikrotik_routerboard-lhg-5nd.dts
@@ -1,91 +1,27 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 
+#include "ar9344_mikrotik_routerboard.dtsi"
 #include "ar9344_mikrotik_routerboard-16m-nor.dtsi"
 
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
-
 / {
 	compatible = "mikrotik,routerboard-lhg-5nd", "qca,ar9344";
 	model = "MikroTik RouterBOARD LHG 5nD";
+};
 
-	aliases {
-		led-boot = &led_user;
-		led-failsafe = &led_user;
-		led-running = &led_user;
-		led-upgrade = &led_user;
-	};
-
-	leds {
-		compatible = "gpio-leds";
-
-		power {
-			label = "blue:power";
-			gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
-			default-state = "on";
-		};
-
-		rssilow {
-			label = "green:rssilow";
-			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
-		};
-
-		rssimediumlow {
-			label = "green:rssimediumlow";
-			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
-		};
-
-		rssimedium {
-			label = "green:rssimedium";
-			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
-		};
-
-		rssimediumhigh {
-			label = "green:rssimediumhigh";
-			gpios = <&gpio 21 GPIO_ACTIVE_LOW>;
-		};
-
-		rssihigh {
-			label = "green:rssihigh";
-			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
-		};
-
-		led_user: user {
-			label = "white:user";
-			gpios = <&gpio 20 GPIO_ACTIVE_LOW>;
-		};
-
-		lan {
-			label = "green:lan";
-			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
-		};
+&leds {
+	power {
+		label = "blue:power";
+		gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
+		default-state = "on";
 	};
 
-	keys {
-		compatible = "gpio-keys";
-
-		reset {
-			label = "reset";
-			linux,code = <KEY_RESTART>;
-			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
-			debounce-interval = <60>;
-		};
+	led_user: user {
+		label = "white:user";
+		gpios = <&gpio 20 GPIO_ACTIVE_LOW>;
 	};
-};
-
-&eth0 {
-	status = "okay";
 
-	phy-handle = <&swphy0>;
-
-	gmac-config {
-		device = <&gmac>;
-		switch-phy-swap = <1>;
+	lan {
+		label = "green:lan";
+		gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
 	};
 };
-
-&eth1 {
-	status = "okay";
-
-	compatible = "syscon", "simple-mfd";
-};
diff --git a/target/linux/ath79/dts/ar9344_mikrotik_routerboard-sxt-5nd-r2.dts b/target/linux/ath79/dts/ar9344_mikrotik_routerboard-sxt-5nd-r2.dts
index 3d0b941c24c679..a4485320345c1a 100644
--- a/target/linux/ath79/dts/ar9344_mikrotik_routerboard-sxt-5nd-r2.dts
+++ b/target/linux/ath79/dts/ar9344_mikrotik_routerboard-sxt-5nd-r2.dts
@@ -1,8 +1,115 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 
-#include "ar9344_mikrotik_routerboard-sxt-5n.dtsi"
+#include "ar9344_mikrotik_routerboard.dtsi"
 
 / {
 	compatible = "mikrotik,routerboard-sxt-5nd-r2", "qca,ar9344";
 	model = "MikroTik RouterBOARD SXT 5nD r2 (SXT Lite5)";
+
+	gpio-export {
+		compatible = "gpio-export";
+
+		gpio_nand_power {
+			gpio-export,name = "sxt5n:power:nand";
+			gpio-export,output = <0>;
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	beeper {
+		compatible = "gpio-beeper";
+		gpios = <&gpio 19 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&leds {
+	power {
+		label = "green:power";
+		gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
+		default-state = "on";
+	};
+
+	led_user: user {
+		label = "green:user";
+		gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <40000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "RouterBoot";
+				reg = <0x0 0x20000>;
+				compatible = "mikrotik,routerboot-partitions";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				partition@0 {
+					label = "bootloader1";
+					reg = <0x0 0x0>;
+					read-only;
+				};
+
+				hard_config {
+					read-only;
+				};
+
+				bios {
+					size = <0x1000>;
+					read-only;
+				};
+
+				soft_config {
+				};
+
+				partition@10000 {
+					label = "bootloader2";
+					reg = <0x10000 0x10000>;
+					read-only;
+				};
+			};
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	nand-ecc-mode = "soft";
+	nand-ecc-step-size = <2048>;
+	qca,nand-swap-dma;
+	qca,nand-scan-fixup;
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "booter";
+			reg = <0x0000000 0x0040000>;
+			read-only;
+		};
+
+		partition@40000 {
+			label = "kernel";
+			reg = <0x0040000 0x03c0000>;
+		};
+
+		partition@400000 {
+			label = "ubi";
+			reg = <0x0400000 0x7c00000>;
+		};
+	};
 };
diff --git a/target/linux/ath79/dts/ar9344_mikrotik_routerboard.dtsi b/target/linux/ath79/dts/ar9344_mikrotik_routerboard.dtsi
new file mode 100644
index 00000000000000..10233e3d4eefed
--- /dev/null
+++ b/target/linux/ath79/dts/ar9344_mikrotik_routerboard.dtsi
@@ -0,0 +1,78 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "ar9344.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	aliases {
+		led-boot = &led_user;
+		led-failsafe = &led_user;
+		led-running = &led_user;
+		led-upgrade = &led_user;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds: leds {
+		compatible = "gpio-leds";
+
+		rssilow {
+			label = "green:rssilow";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		};
+
+		rssimediumlow {
+			label = "green:rssimediumlow";
+			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
+		};
+
+		rssimedium {
+			label = "green:rssimedium";
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+		};
+
+		rssimediumhigh {
+			label = "green:rssimediumhigh";
+			gpios = <&gpio 21 GPIO_ACTIVE_LOW>;
+		};
+
+		rssihigh {
+			label = "green:rssihigh";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&eth0 {
+	status = "okay";
+
+	phy-handle = <&swphy0>;
+
+	gmac-config {
+		device = <&gmac>;
+		switch-phy-swap = <1>;
+	};
+};
+
+&eth1 {
+	status = "okay";
+
+	compatible = "syscon", "simple-mfd";
+};
+
+&wmac {
+	status = "okay";
+
+	qca,no-eeprom;
+};
diff --git a/target/linux/ath79/dts/ar9344_netgear_r6100.dts b/target/linux/ath79/dts/ar9344_netgear_r6100.dts
index 80951d62490c7d..76bd77d4c65ef3 100644
--- a/target/linux/ath79/dts/ar9344_netgear_r6100.dts
+++ b/target/linux/ath79/dts/ar9344_netgear_r6100.dts
@@ -181,8 +181,8 @@
 		compatible = "qcom,ath10k";
 		reg = <0x0000 0 0 0 0>;
 
-		nvmem-cells = <&macaddr_caldata_c>;
-		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&cal_ath10k>, <&macaddr_caldata_c>;
+		nvmem-cell-names = "calibration", "mac-address";
 	};
 };
 
@@ -192,14 +192,6 @@
 
 &usb {
 	status = "okay";
-
-	#address-cells = <1>;
-	#size-cells = <0>;
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy {
@@ -209,7 +201,8 @@
 &wmac {
 	status = "okay";
 
-	mtd-cal-data = <&caldata 0x1000>;
+	nvmem-cells = <&cal_ath9k>;
+	nvmem-cell-names = "calibration";
 };
 
 &caldata {
@@ -217,6 +210,14 @@
 	#address-cells = <1>;
 	#size-cells = <1>;
 
+	cal_ath9k: calibration@1000 {
+		reg = <0x1000 0x440>;
+	};
+
+	cal_ath10k: calibration@5000 {
+		reg = <0x5000 0x844>;
+	};
+
 	macaddr_caldata_0: macaddr@0 {
 		reg = <0x0 0x6>;
 	};
diff --git a/target/linux/ath79/dts/ar9344_netgear_wndr.dtsi b/target/linux/ath79/dts/ar9344_netgear_wndr.dtsi
index 077bbe4bf11626..331a4c6fa32c86 100644
--- a/target/linux/ath79/dts/ar9344_netgear_wndr.dtsi
+++ b/target/linux/ath79/dts/ar9344_netgear_wndr.dtsi
@@ -243,9 +243,8 @@
 &wmac {
 	status = "okay";
 
-	nvmem-cells = <&macaddr_caldata_0>;
-	nvmem-cell-names = "mac-address";
-	qca,no-eeprom;
+	nvmem-cells = <&macaddr_caldata_0>, <&cal_art_1000>;
+	nvmem-cell-names = "mac-address", "calibration";
 };
 
 &pcie {
@@ -254,9 +253,8 @@
 	ath9k: wifi@0,0 {
 		compatible = "pci168c,0033";
 		reg = <0x0000 0 0 0 0>;
-		nvmem-cells = <&macaddr_caldata_c>;
-		nvmem-cell-names = "mac-address";
-		qca,no-eeprom;
+		nvmem-cells = <&macaddr_caldata_c>, <&cal_art_5000>;
+		nvmem-cell-names = "mac-address", "calibration";
 		#gpio-cells = <2>;
 		gpio-controller;
 	};
@@ -274,4 +272,12 @@
 	macaddr_caldata_c: macaddr@c {
 		reg = <0xc 0x6>;
 	};
+
+	cal_art_1000: cal@1000 {
+		reg = <0x1000 0x440>;
+	};
+
+	cal_art_5000: cal@5000 {
+		reg = <0x5000 0x440>;
+	};
 };
diff --git a/target/linux/ath79/dts/ar9344_netgear_wndr_usb.dtsi b/target/linux/ath79/dts/ar9344_netgear_wndr_usb.dtsi
index 0ca3b761bf1dd3..bd1eb59f4faba3 100644
--- a/target/linux/ath79/dts/ar9344_netgear_wndr_usb.dtsi
+++ b/target/linux/ath79/dts/ar9344_netgear_wndr_usb.dtsi
@@ -24,11 +24,4 @@
 
 &usb {
 	status = "okay";
-	#address-cells = <1>;
-	#size-cells = <0>;
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
diff --git a/target/linux/ath79/dts/ar9344_ocedo_raccoon.dts b/target/linux/ath79/dts/ar9344_ocedo_raccoon.dts
index 8ac035f1258732..11205413f4ce43 100644
--- a/target/linux/ath79/dts/ar9344_ocedo_raccoon.dts
+++ b/target/linux/ath79/dts/ar9344_ocedo_raccoon.dts
@@ -79,7 +79,7 @@
 			#address-cells = <1>;
 			#size-cells = <1>;
 
-			uboot: partition@0 {
+			partition@0 {
 				label = "u-boot";
 				reg = <0x000000 0x040000>;
 				read-only;
@@ -91,15 +91,10 @@
 			};
 
 			partition@50000 {
+				/* Dual-Flash layout combined */
 				compatible = "denx,uimage";
 				label = "firmware";
-				reg = <0x050000 0x740000>;
-			};
-
-			partition@790000 {
-				label = "vendor";
-				reg = <0x790000 0x740000>;
-				read-only;
+				reg = <0x050000 0xe80000>;
 			};
 
 			partition@ed0000 {
@@ -114,10 +109,34 @@
 				read-only;
 			};
 
-			art: partition@ff0000 {
+			partition@ff0000 {
 				label = "art";
 				reg = <0xff0000 0x010000>;
 				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_art_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_art_6: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+
+				macaddr_art_c: macaddr@c {
+					reg = <0xc 0x6>;
+				};
+
+				calibration_art_1000: calibration@1000 {
+					reg = <0x1000 0x440>;
+				};
+
+				calibration_art_5000: calibration@5000 {
+					reg = <0x5000 0x440>;
+				};
 			};
 		};
 	};
@@ -129,9 +148,8 @@
 	ath9k: wifi@0,0 {
 		compatible = "pci168c,0030";
 		reg = <0x0000 0 0 0 0>;
-		nvmem-cells = <&macaddr_art_c>;
-		nvmem-cell-names = "mac-address";
-		qca,no-eeprom;
+		nvmem-cells = <&macaddr_art_c>, <&calibration_art_5000>;
+		nvmem-cell-names = "mac-address", "calibration";
 		#gpio-cells = <2>;
 		gpio-controller;
 	};
@@ -140,9 +158,8 @@
 &wmac {
 	status = "okay";
 
-	mtd-cal-data = <&art 0x1000>;
-	nvmem-cells = <&macaddr_art_6>;
-	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_art_6>, <&calibration_art_1000>;
+	nvmem-cell-names = "mac-address", "calibration";
 };
 
 &mdio0 {
@@ -175,21 +192,3 @@
 		txd-delay = <0>;
 	};
 };
-
-&art {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_art_0: macaddr@0 {
-		reg = <0x0 0x6>;
-	};
-
-	macaddr_art_6: macaddr@6 {
-		reg = <0x6 0x6>;
-	};
-
-	macaddr_art_c: macaddr@c {
-		reg = <0xc 0x6>;
-	};
-};
diff --git a/target/linux/ath79/dts/ar9344_openmesh_mr600.dtsi b/target/linux/ath79/dts/ar9344_openmesh_mr600.dtsi
index 5a6ef3b0fceb43..b35d699bdc1675 100644
--- a/target/linux/ath79/dts/ar9344_openmesh_mr600.dtsi
+++ b/target/linux/ath79/dts/ar9344_openmesh_mr600.dtsi
@@ -70,10 +70,26 @@
 				reg = <0x850000 0x7a0000>;
 			};
 
-			art: partition@ff0000 {
+			partition@ff0000 {
 				label = "ART";
 				reg = <0xff0000 0x010000>;
 				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_art_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				calibration_art_1000: calibration@1000 {
+					reg = <0x1000 0x440>;
+				};
+
+				calibration_art_5000: calibration@5000 {
+					reg = <0x5000 0x440>;
+				};
 			};
 		};
 	};
@@ -111,9 +127,8 @@
 &wmac {
 	status = "okay";
 
-	mtd-cal-data = <&art 0x1000>;
-	nvmem-cells = <&macaddr_art_0>;
-	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_art_0>, <&calibration_art_1000>;
+	nvmem-cell-names = "mac-address", "calibration";
 	mac-address-increment = <1>;
 };
 
@@ -123,22 +138,11 @@
 	ath9k: wifi@0,0 {
 		compatible = "pci168c,0030";
 		reg = <0x0000 0 0 0 0>;
-		qca,no-eeprom;
-		nvmem-cells = <&macaddr_art_0>;
-		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_art_0>, <&calibration_art_5000>;
+		nvmem-cell-names = "mac-address", "calibration";
 		mac-address-increment = <8>;
 
 		gpio-controller;
 		#gpio-cells = <2>;
 	};
 };
-
-&art {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_art_0: macaddr@0 {
-		reg = <0x0 0x6>;
-	};
-};
diff --git a/target/linux/ath79/dts/ar9344_openmesh_om5p-an.dts b/target/linux/ath79/dts/ar9344_openmesh_om5p-an.dts
index 1925031e0b0f09..6fab2b3219b959 100644
--- a/target/linux/ath79/dts/ar9344_openmesh_om5p-an.dts
+++ b/target/linux/ath79/dts/ar9344_openmesh_om5p-an.dts
@@ -148,10 +148,26 @@
 				reg = <0x850000 0x7a0000>;
 			};
 
-			art: partition@ff0000 {
+			partition@ff0000 {
 				label = "ART";
 				reg = <0xff0000 0x010000>;
 				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_art_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				calibration_art_1000: calibration@1000 {
+					reg = <0x1000 0x440>;
+				};
+
+				calibration_art_5000: calibration@5000 {
+					reg = <0x5000 0x440>;
+				};
 			};
 		};
 	};
@@ -198,9 +214,8 @@
 &wmac {
 	status = "okay";
 
-	mtd-cal-data = <&art 0x1000>;
-	nvmem-cells = <&macaddr_art_0>;
-	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_art_0>, <&calibration_art_1000>;
+	nvmem-cell-names = "mac-address", "calibration";
 	mac-address-increment = <2>;
 };
 
@@ -210,19 +225,8 @@
 	wifi@0,0 {
 		compatible = "pci168c,0030";
 		reg = <0x0000 0 0 0 0>;
-		qca,no-eeprom;
-		nvmem-cells = <&macaddr_art_0>;
-		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_art_0>, <&calibration_art_5000>;
+		nvmem-cell-names = "mac-address", "calibration";
 		mac-address-increment = <16>;
 	};
 };
-
-&art {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_art_0: macaddr@0 {
-		reg = <0x0 0x6>;
-	};
-};
diff --git a/target/linux/ath79/dts/ar9344_pcs_cr5000.dts b/target/linux/ath79/dts/ar9344_pcs_cr5000.dts
index d4b198b3f5d145..b5fef91eacc5f2 100644
--- a/target/linux/ath79/dts/ar9344_pcs_cr5000.dts
+++ b/target/linux/ath79/dts/ar9344_pcs_cr5000.dts
@@ -106,13 +106,6 @@
 
 &usb {
 	status = "okay";
-	#address-cells = <1>;
-	#size-cells = <0>;
-
-	hub_port1: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy {
diff --git a/target/linux/ath79/dts/ar9344_ruckus_zf7372.dts b/target/linux/ath79/dts/ar9344_ruckus_zf7372.dts
index 4bf7276db5b58a..2cf7240931177c 100644
--- a/target/linux/ath79/dts/ar9344_ruckus_zf7372.dts
+++ b/target/linux/ath79/dts/ar9344_ruckus_zf7372.dts
@@ -63,6 +63,8 @@
 		mosi-gpios = <&gpio 15 GPIO_ACTIVE_HIGH>;
 		sck-gpios = <&gpio 14 GPIO_ACTIVE_HIGH>;
 		num-chipselects = <0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
 
 		beamforming-2g-gpio@0 {
 			compatible = "fairchild,74hc595";
@@ -79,6 +81,8 @@
 		mosi-gpios = <&ath9k 15 GPIO_ACTIVE_HIGH>;
 		sck-gpios = <&ath9k 14 GPIO_ACTIVE_HIGH>;
 		num-chipselects = <0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
 
 		beamforming-5g-gpio@0 {
 			compatible = "fairchild,74hc595";
diff --git a/target/linux/ath79/dts/ar9344_senao_ap-dual.dtsi b/target/linux/ath79/dts/ar9344_senao_ap-dual.dtsi
index c963138f6a118c..c0e95065d5ae6f 100644
--- a/target/linux/ath79/dts/ar9344_senao_ap-dual.dtsi
+++ b/target/linux/ath79/dts/ar9344_senao_ap-dual.dtsi
@@ -63,7 +63,6 @@
 		compatible = "pci168c,0030";
 		reg = <0x0 0 0 0 0>;
 		ieee80211-freq-limit = <2402000 2482000>;
-		qca,no-eeprom;
 		#gpio-cells = <2>;
 		gpio-controller;
 	};
@@ -73,6 +72,4 @@
 	status = "okay";
 
 	ieee80211-freq-limit = <4900000 5990000>;
-
-	mtd-cal-data = <&art 0x1000>;
 };
diff --git a/target/linux/ath79/dts/ar9344_teltonika_rut9xx.dtsi b/target/linux/ath79/dts/ar9344_teltonika_rut9xx.dtsi
index c989a30b108500..937095959c9e0a 100644
--- a/target/linux/ath79/dts/ar9344_teltonika_rut9xx.dtsi
+++ b/target/linux/ath79/dts/ar9344_teltonika_rut9xx.dtsi
@@ -113,29 +113,26 @@
 };
 
 &usb {
+	status = "okay";
+};
+
+&hub_port {
 	#address-cells = <1>;
 	#size-cells = <0>;
-	status = "okay";
 
 	port@1 {
-		#address-cells = <1>;
-		#size-cells = <0>;
+		compatible = "usb-a-connector";
 		reg = <1>;
+	};
 
-		port@1 {
-			compatible = "usb-a-connector";
-			reg = <1>;
-		};
-
-		port@3 {
-			label = "RS-232 serial adapter";
-			reg = <3>;
-		};
+	port@3 {
+		label = "RS-232 serial adapter";
+		reg = <3>;
+	};
 
-		port@4 {
-			label = "internal wwan modem";
-			reg = <4>;
-		};
+	port@4 {
+		label = "internal wwan modem";
+		reg = <4>;
 	};
 };
 
diff --git a/target/linux/ath79/dts/ar9344_tplink_cpe605-v1.dts b/target/linux/ath79/dts/ar9344_tplink_cpe605-v1.dts
new file mode 100644
index 00000000000000..0c6eee7ba6347e
--- /dev/null
+++ b/target/linux/ath79/dts/ar9344_tplink_cpe605-v1.dts
@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "ar9344_tplink_cpe.dtsi"
+
+/ {
+	model = "TP-Link CPE605 v1";
+	compatible = "tplink,cpe605-v1", "qca,ar9344";
+
+	aliases {
+		led-boot = &led_lan;
+		led-failsafe = &led_lan;
+		led-upgrade = &led_lan;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_lan: lan {
+			label = "green:lan";
+			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		wlan5g {
+			label = "green:wlan5g";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+	};
+};
+
+&eth1 {
+	compatible = "syscon", "simple-mfd";
+};
diff --git a/target/linux/ath79/dts/ar9344_tplink_tl-wdr3500-v1.dts b/target/linux/ath79/dts/ar9344_tplink_tl-wdr3500-v1.dts
index 6c5d013ccd6102..1600e12b644816 100644
--- a/target/linux/ath79/dts/ar9344_tplink_tl-wdr3500-v1.dts
+++ b/target/linux/ath79/dts/ar9344_tplink_tl-wdr3500-v1.dts
@@ -42,14 +42,7 @@
 };
 
 &usb {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy {
@@ -57,16 +50,9 @@
 };
 
 &ath9k {
-	nvmem-cells = <&macaddr_uboot_1fc00>;
-	nvmem-cell-names = "mac-address";
 	mac-address-increment = <1>;
 };
 
-&wmac {
-	nvmem-cells = <&macaddr_uboot_1fc00>;
-	nvmem-cell-names = "mac-address";
-};
-
 &eth1 {
 	status = "okay";
 
@@ -90,13 +76,3 @@
 	nvmem-cell-names = "mac-address";
 	mac-address-increment = <2>;
 };
-
-&uboot {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_uboot_1fc00: macaddr@1fc00 {
-		reg = <0x1fc00 0x6>;
-	};
-};
diff --git a/target/linux/ath79/dts/ar9344_tplink_tl-wdr4300.dtsi b/target/linux/ath79/dts/ar9344_tplink_tl-wdr4300.dtsi
index 546cf49f34ef2a..d2791aee709d9c 100644
--- a/target/linux/ath79/dts/ar9344_tplink_tl-wdr4300.dtsi
+++ b/target/linux/ath79/dts/ar9344_tplink_tl-wdr4300.dtsi
@@ -53,25 +53,21 @@
 };
 
 &usb {
+	status = "okay";
+};
+
+&hub_port {
 	#address-cells = <1>;
 	#size-cells = <0>;
-	status = "okay";
 
-	port@1 {
-		#address-cells = <1>;
-		#size-cells = <0>;
+	hub_port1: port@1 {
 		reg = <1>;
 		#trigger-source-cells = <0>;
+	};
 
-		hub_port1: port@1 {
-			reg = <1>;
-			#trigger-source-cells = <0>;
-		};
-
-		hub_port2: port@2 {
-			reg = <2>;
-			#trigger-source-cells = <0>;
-		};
+	hub_port2: port@2 {
+		reg = <2>;
+		#trigger-source-cells = <0>;
 	};
 };
 
@@ -79,14 +75,7 @@
 	status = "okay";
 };
 
-&ath9k {
-	nvmem-cells = <&macaddr_uboot_1fc00>;
-	nvmem-cell-names = "mac-address";
-};
-
 &wmac {
-	nvmem-cells = <&macaddr_uboot_1fc00>;
-	nvmem-cell-names = "mac-address";
 	mac-address-increment = <(-1)>;
 };
 
@@ -121,13 +110,3 @@
 	phy-mode = "rgmii";
 	phy-handle = <&phy0>;
 };
-
-&uboot {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_uboot_1fc00: macaddr@1fc00 {
-		reg = <0x1fc00 0x6>;
-	};
-};
diff --git a/target/linux/ath79/dts/ar9344_tplink_tl-wdrxxxx.dtsi b/target/linux/ath79/dts/ar9344_tplink_tl-wdrxxxx.dtsi
index a3f4dc036d987d..a2649d19e9356e 100644
--- a/target/linux/ath79/dts/ar9344_tplink_tl-wdrxxxx.dtsi
+++ b/target/linux/ath79/dts/ar9344_tplink_tl-wdrxxxx.dtsi
@@ -106,14 +106,39 @@
 	ath9k: wifi@0,0 {
 		compatible = "pci168c,0033";
 		reg = <0x0000 0 0 0 0>;
-		qca,no-eeprom;
 		#gpio-cells = <2>;
 		gpio-controller;
+		nvmem-cells = <&macaddr_uboot_1fc00>, <&cal_art_5000>;
+		nvmem-cell-names = "mac-address", "calibration";
 	};
 };
 
 &wmac {
 	status = "okay";
+	nvmem-cells = <&macaddr_uboot_1fc00>, <&cal_art_1000>;
+	nvmem-cell-names = "mac-address", "calibration";
+};
+
+&uboot {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_uboot_1fc00: macaddr@1fc00 {
+		reg = <0x1fc00 0x6>;
+	};
+};
 
-	mtd-cal-data = <&art 0x1000>;
+&art {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	cal_art_1000: cal@1000 {
+		reg = <0x1000 0x440>;
+	};
+
+	cal_art_5000: cal@5000 {
+		reg = <0x5000 0x440>;
+	};
 };
diff --git a/target/linux/ath79/dts/ar9344_tplink_tl-wr841hp-v2.dts b/target/linux/ath79/dts/ar9344_tplink_tl-wr841hp-v2.dts
index 360443565b1e80..49526fb6d233ff 100644
--- a/target/linux/ath79/dts/ar9344_tplink_tl-wr841hp-v2.dts
+++ b/target/linux/ath79/dts/ar9344_tplink_tl-wr841hp-v2.dts
@@ -16,7 +16,7 @@
 		led-upgrade = &led_system;
 		label-mac-device = &wmac;
 	};
-	
+
 	keys {
 		compatible = "gpio-keys";
 
@@ -26,7 +26,7 @@
 			debounce-interval = <60>;
 		};
 	};
-	
+
 	leds {
 		compatible = "gpio-leds";
 
@@ -54,12 +54,12 @@
 			label = "green:lan4";
 			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
 		};
-		
+
 		wps {
 			label = "green:wps";
 			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
 		};
-		
+
 		wlan {
 			label = "green:wlan";
 			gpios = <&gpio 21 GPIO_ACTIVE_LOW>;
@@ -130,16 +130,16 @@
 
 &wmac {
 	status = "okay";
-	
+
 	mtd-cal-data = <&art 0x1000>;
-	
+
 	nvmem-cells = <&macaddr_uboot_1fc00>;
 	nvmem-cell-names = "mac-address";
 };
 
 &eth0 {
 	status = "okay";
-	
+
 	phy-handle = <&swphy0>;
 
 	nvmem-cells = <&macaddr_uboot_1fc00>;
@@ -152,7 +152,7 @@
 
 	nvmem-cells = <&macaddr_uboot_1fc00>;
 	nvmem-cell-names = "mac-address";
-	
+
 	gmac-config {
 		device = <&gmac>;
 		switch-phy-swap = <1>;
diff --git a/target/linux/ath79/dts/ar9344_ubnt_unifi-ap-pro.dts b/target/linux/ath79/dts/ar9344_ubnt_unifi-ap-pro.dts
index 8471be9b6b83a6..55626c42995a57 100644
--- a/target/linux/ath79/dts/ar9344_ubnt_unifi-ap-pro.dts
+++ b/target/linux/ath79/dts/ar9344_ubnt_unifi-ap-pro.dts
@@ -100,10 +100,26 @@
 				read-only;
 			};
 
-			art: partition@ff0000 {
+			partition@ff0000 {
 				label = "art";
 				reg = <0xff0000 0x10000>;
 				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_art_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				calibration_art_1000: calibration@1000 {
+					reg = <0x1000 0x440>;
+				};
+
+				calibration_art_5000: calibration@5000 {
+					reg = <0x5000 0x440>;
+				};
 			};
 		};
 	};
@@ -115,14 +131,16 @@
 	wifi@0,0 {
 		compatible = "pci168c,0033";
 		reg = <0 0 0 0 0>;
-		qca,no-eeprom;
+		nvmem-cells = <&calibration_art_5000>;
+		nvmem-cell-names = "calibration";
 	};
 };
 
 &wmac {
 	status = "okay";
 
-	mtd-cal-data = <&art 0x1000>;
+	nvmem-cells = <&calibration_art_1000>;
+	nvmem-cell-names = "calibration";
 };
 
 &mdio0 {
@@ -150,13 +168,3 @@
 	phy-mode = "rgmii";
 	phy-handle = <&phy0>;
 };
-
-&art {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_art_0: macaddr@0 {
-		reg = <0x0 0x6>;
-	};
-};
diff --git a/target/linux/ath79/dts/ar9344_watchguard_ap100.dts b/target/linux/ath79/dts/ar9344_watchguard_ap100.dts
index d2ebe14979d4a1..0ab10c36ce2ab2 100644
--- a/target/linux/ath79/dts/ar9344_watchguard_ap100.dts
+++ b/target/linux/ath79/dts/ar9344_watchguard_ap100.dts
@@ -63,13 +63,18 @@
 
 &pcie {
 	status = "disabled";
+
+	wifi@0,0,0 {
+		nvmem-cells = <&calibration_art_5000>;
+		nvmem-cell-names = "calibration";
+	};
 };
 
 &wmac {
-	/delete-property/ qca,disable-2ghz;
+	/delete-property/ ieee80211-freq-limit;
 
-	nvmem-cells = <&macaddr_art_0>;
-	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_art_0>, <&calibration_art_1000>;
+	nvmem-cell-names = "mac-address", "calibration";
 	mac-address-increment = <(-2)>;
 };
 
@@ -81,4 +86,12 @@
 	macaddr_art_0: macaddr@0 {
 		reg = <0x0 0x6>;
 	};
+
+	calibration_art_1000: calibration@1000 {
+		reg = <0x1000 0x440>;
+	};
+
+	calibration_art_5000: calibration@5000 {
+		reg = <0x5000 0x440>;
+	};
 };
diff --git a/target/linux/ath79/dts/ar9344_watchguard_ap200.dts b/target/linux/ath79/dts/ar9344_watchguard_ap200.dts
index 0cd966476c2e3c..88c7637fc9b11f 100644
--- a/target/linux/ath79/dts/ar9344_watchguard_ap200.dts
+++ b/target/linux/ath79/dts/ar9344_watchguard_ap200.dts
@@ -63,15 +63,15 @@
 
 &pcie {
 	wifi@0,0,0 {
-		nvmem-cells = <&macaddr_art_0>;
-		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_art_0>, <&calibration_art_5000>;
+		nvmem-cell-names = "mac-address", "calibration";
 		mac-address-increment = <(-1)>;
 	};
 };
 
 &wmac {
-	nvmem-cells = <&macaddr_art_0>;
-	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_art_0>, <&calibration_art_1000>;
+	nvmem-cell-names = "mac-address", "calibration";
 	mac-address-increment = <(-2)>;
 };
 
@@ -83,4 +83,12 @@
 	macaddr_art_0: macaddr@0 {
 		reg = <0x0 0x6>;
 	};
+
+	calibration_art_1000: calibration@1000 {
+		reg = <0x1000 0x440>;
+	};
+
+	calibration_art_5000: calibration@5000 {
+		reg = <0x5000 0x440>;
+	};
 };
diff --git a/target/linux/ath79/dts/ar9344_wd_mynet-n600.dts b/target/linux/ath79/dts/ar9344_wd_mynet-n600.dts
index 81788fb348ebe1..3c0e9c56a1c81b 100644
--- a/target/linux/ath79/dts/ar9344_wd_mynet-n600.dts
+++ b/target/linux/ath79/dts/ar9344_wd_mynet-n600.dts
@@ -18,27 +18,27 @@
 		compatible = "gpio-leds";
 
 		led-0 {
-                        color = <LED_COLOR_ID_BLUE>;
-                        function = LED_FUNCTION_WLAN;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WLAN;
 			gpios = <&gpio 0 GPIO_ACTIVE_HIGH>;
 		};
 
 		led_power: led-1 {
 			label = "blue:power";
-                        color = <LED_COLOR_ID_BLUE>;
-                        function = LED_FUNCTION_POWER;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_POWER;
 			gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
 		};
 
 		led-2 {
-                        color = <LED_COLOR_ID_BLUE>;
-                        function = LED_FUNCTION_WAN;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WAN;
 			gpios = <&gpio 12 GPIO_ACTIVE_HIGH>;
 		};
 
 		led-3 {
-                        color = <LED_COLOR_ID_BLUE>;
-                        function = LED_FUNCTION_WPS;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WPS;
 			gpios = <&gpio 13 GPIO_ACTIVE_HIGH>;
 		};
 	};
diff --git a/target/linux/ath79/dts/ar9344_wd_mynet-n750.dts b/target/linux/ath79/dts/ar9344_wd_mynet-n750.dts
index f4a18b051f3304..d18ffff34d03e1 100644
--- a/target/linux/ath79/dts/ar9344_wd_mynet-n750.dts
+++ b/target/linux/ath79/dts/ar9344_wd_mynet-n750.dts
@@ -69,26 +69,7 @@
 };
 
 &usb {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	port@1 {
-		#address-cells = <1>;
-		#size-cells = <0>;
-		reg = <1>;
-		#trigger-source-cells = <0>;
-
-		hub_port1: port@1 {
-			reg = <1>;
-			#trigger-source-cells = <0>;
-		};
-
-		hub_port2: port@2 {
-			reg = <2>;
-			#trigger-source-cells = <0>;
-		};
-	};
 };
 
 &mdio0 {
diff --git a/target/linux/ath79/dts/ar9344_winchannel_wb2000.dts b/target/linux/ath79/dts/ar9344_winchannel_wb2000.dts
index f27a58b8d7c15a..cbde191ac78352 100644
--- a/target/linux/ath79/dts/ar9344_winchannel_wb2000.dts
+++ b/target/linux/ath79/dts/ar9344_winchannel_wb2000.dts
@@ -46,7 +46,7 @@
 		usb {
 			label = "green:usb";
 			gpios = <&gpio 21 GPIO_ACTIVE_HIGH>;
-			trigger-sources = <&hub_port1>, <&hub_port2>;
+			trigger-sources = <&hub_port>;
 			linux,default-trigger = "usbport";
 		};
 
@@ -119,16 +119,36 @@
 				read-only;
 			};
 
-			art: partition@fe0000 {
+			partition@fe0000 {
 				label = "art";
 				reg = <0xfe0000 0x10000>;
 				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				calibration_art_1000: calibration@1000 {
+					reg = <0x1000 0x440>;
+				};
+
+				calibration_art_5000: calibration@5000 {
+					reg = <0x5000 0x440>;
+				};
 			};
 
-			addr: partition@ff0000 {
+			partition@ff0000 {
 				label = "addr";
 				reg = <0xff0000 0x10000>;
 				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_addr_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
 			};
 		};
 	};
@@ -140,9 +160,8 @@
 	ath9k: wifi@0,0 {
 		compatible = "pci168c,0030";
 		reg = <0x0000 0 0 0 0>;
-		qca,no-eeprom;
-		nvmem-cells = <&macaddr_addr_0>;
-		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_addr_0>, <&calibration_art_5000>;
+		nvmem-cell-names = "mac-address", "calibration";
 		mac-address-increment = <0x10>;
 		#gpio-cells = <2>;
 		gpio-controller;
@@ -150,26 +169,7 @@
 };
 
 &usb {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	port@1 {
-		#address-cells = <1>;
-		#size-cells = <0>;
-		reg = <1>;
-		#trigger-source-cells = <0>;
-
-		hub_port1: port@1 {
-			reg = <1>;
-			#trigger-source-cells = <0>;
-		};
-
-		hub_port2: port@2 {
-			reg = <2>;
-			#trigger-source-cells = <0>;
-		};
-	};
 };
 
 &usb_phy {
@@ -179,9 +179,8 @@
 &wmac {
 	status = "okay";
 
-	mtd-cal-data = <&art 0x1000>;
-	nvmem-cells = <&macaddr_addr_0>;
-	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_addr_0>, <&calibration_art_1000>;
+	nvmem-cell-names = "mac-address", "calibration";
 };
 
 &mdio0 {
@@ -212,12 +211,3 @@
 	};
 };
 
-&addr {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_addr_0: macaddr@0 {
-		reg = <0x0 0x6>;
-	};
-};
diff --git a/target/linux/ath79/dts/ar934x.dtsi b/target/linux/ath79/dts/ar934x.dtsi
index d88c7bfabc17ce..94dfde4125a247 100644
--- a/target/linux/ath79/dts/ar934x.dtsi
+++ b/target/linux/ath79/dts/ar934x.dtsi
@@ -178,6 +178,11 @@
 
 			#address-cells = <1>;
 			#size-cells = <0>;
+
+			hub_port: port@1 {
+				reg = <1>;
+				#trigger-source-cells = <0>;
+			};
 		};
 
 		nand: nand@1b000200 {
diff --git a/target/linux/ath79/dts/ar934x_fortinet_loader.dtsi b/target/linux/ath79/dts/ar934x_fortinet_loader.dtsi
new file mode 100644
index 00000000000000..d7cbf2e73796a4
--- /dev/null
+++ b/target/linux/ath79/dts/ar934x_fortinet_loader.dtsi
@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include <dt-bindings/mtd/partitions/uimage.h>
+
+/ {
+	virtual_flash {
+		compatible = "mtd-concat";
+
+		devices = <&fwconcat0 &fwconcat1>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				compatible = "openwrt,uimage", "denx,uimage";
+				openwrt,ih-magic = <0x73714f4b>;
+				label = "firmware";
+				reg = <0x0 0x0>;
+			};
+		};
+	};
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <40000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x040000>;
+				read-only;
+			};
+
+			fwconcat0: partition@40000 {
+				label = "fwconcat0";
+				reg = <0x040000 0x900000>;
+			};
+
+			partition@940000 {
+				label = "loader";
+				reg = <0x940000 0x010000>;
+			};
+
+			fwconcat1: partition@950000 {
+				label = "fwconcat1";
+				reg = <0x950000 0x1a0000>;
+			};
+
+			fwconcat2: partition@af0000 {
+				label = "reserved";
+				reg = <0xaf0000 0x500000>;
+			};
+
+			art: partition@ff0000 {
+				label = "art";
+				reg = <0xff0000 0x010000>;
+				read-only;
+			};
+		};
+	};
+};
diff --git a/target/linux/ath79/dts/qca9531_alcatel_hh40v.dts b/target/linux/ath79/dts/qca9531_alcatel_hh40v.dts
new file mode 100644
index 00000000000000..7873f75528b92a
--- /dev/null
+++ b/target/linux/ath79/dts/qca9531_alcatel_hh40v.dts
@@ -0,0 +1,172 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca953x.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "alcatel,hh40v", "qca,qca9531";
+	model = "Alcatel HH40V";
+
+	aliases {
+		label-mac-device = &wmac;
+		led-boot = &led_lan_link;
+		led-failsafe = &led_lan_link;
+		led-upgrade = &led_lan_link;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+		};
+
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&jtag_disable_pins>;
+
+		lan_active {
+			label = "green:lan";
+			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led_lan_link: lan_link {
+			label = "orange:lan";
+			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
+		};
+
+		wan_active {
+			label = "green:wan";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		};
+
+		wan_link {
+			label = "orange:wan";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		};
+
+		wifi {
+			label = "blue:wifi";
+			gpios = <&gpio 0 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy0tpt";
+		};
+	};
+};
+
+&usb0 {
+	status = "okay";
+
+	dr_mode = "host";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&spi {
+	status = "okay";
+
+	/* Winbond W25Q256 SPI flash */
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x040000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "u-boot-env";
+				reg = <0x040000 0x010000>;
+			};
+
+			partition@50000 {
+				label = "oem";
+				reg = <0x050000 0x100000>;
+				read-only;
+			};
+
+			partition@150000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x150000 0xea0000>;
+			};
+
+			art: partition@ff0000 {
+				label = "art";
+				reg = <0xff0000 0x010000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				cal_art_1000: cal@1000 {
+					reg = <0x1000 0x440>;
+				};
+
+				macaddr_art_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_art_6: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+
+				macaddr_art_1002: macaddr@1002 {
+					reg = <0x1002 0x6>;
+				};
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+};
+
+
+&eth0 {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_art_0>;
+	nvmem-cell-names = "mac-address";
+
+	phy-handle = <&swphy4>;
+};
+
+&eth1 {
+	compatible = "qca,qca9530-eth", "syscon", "simple-mfd";
+
+	nvmem-cells = <&macaddr_art_6>;
+	nvmem-cell-names = "mac-address";
+};
+
+&wmac {
+	status = "okay";
+
+	nvmem-cells = <&cal_art_1000>, <&macaddr_art_1002>;
+	nvmem-cell-names = "calibration", "mac-address";
+};
diff --git a/target/linux/ath79/dts/qca9531_alfa-network_r36a.dtsi b/target/linux/ath79/dts/qca9531_alfa-network_r36a.dtsi
index 9704e69211b46a..406985d576f58d 100644
--- a/target/linux/ath79/dts/qca9531_alfa-network_r36a.dtsi
+++ b/target/linux/ath79/dts/qca9531_alfa-network_r36a.dtsi
@@ -111,14 +111,6 @@
 
 &usb0 {
 	status = "okay";
-
-	#address-cells = <1>;
-	#size-cells = <0>;
-
-	hub_port0: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy {
diff --git a/target/linux/ath79/dts/qca9531_comfast_cf-e314n-v2.dts b/target/linux/ath79/dts/qca9531_comfast_cf-e314n-v2.dts
index c182390b21730c..92881267885368 100644
--- a/target/linux/ath79/dts/qca9531_comfast_cf-e314n-v2.dts
+++ b/target/linux/ath79/dts/qca9531_comfast_cf-e314n-v2.dts
@@ -33,23 +33,23 @@
 		};
 
 		rssilow {
-			label = "red:signal1";
+			label = "red:rssilow";
 			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
 		};
 
 		rssimediumlow {
-			label = "red:signal2";
+			label = "red:rssimediumlow";
 			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
 		};
 
 		rssimediumhigh {
-			label = "green:signal3";
-			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			label = "green:rssimediumhigh";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
 		};
 
 		led_rssihigh: rssihigh {
-			label = "green:signal4";
-			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+			label = "green:rssihigh";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
 		};
 
 		wlan {
diff --git a/target/linux/ath79/dts/qca9531_comfast_cf-e5.dts b/target/linux/ath79/dts/qca9531_comfast_cf-e5.dts
index d83972525855de..17cbe1df142b4b 100644
--- a/target/linux/ath79/dts/qca9531_comfast_cf-e5.dts
+++ b/target/linux/ath79/dts/qca9531_comfast_cf-e5.dts
@@ -62,14 +62,7 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy {
diff --git a/target/linux/ath79/dts/qca9531_comfast_cf-e560ac.dts b/target/linux/ath79/dts/qca9531_comfast_cf-e560ac.dts
index 477a2bddc6b475..75e30ff1b7bb03 100644
--- a/target/linux/ath79/dts/qca9531_comfast_cf-e560ac.dts
+++ b/target/linux/ath79/dts/qca9531_comfast_cf-e560ac.dts
@@ -135,14 +135,7 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &eth0 {
diff --git a/target/linux/ath79/dts/qca9531_glinet_gl-ar300m-lite.dts b/target/linux/ath79/dts/qca9531_glinet_gl-ar300m-lite.dts
index a34abb1dd2d87f..c712236114cc3d 100644
--- a/target/linux/ath79/dts/qca9531_glinet_gl-ar300m-lite.dts
+++ b/target/linux/ath79/dts/qca9531_glinet_gl-ar300m-lite.dts
@@ -7,7 +7,6 @@
 	model = "GL.iNet GL-AR300M-Lite";
 };
 
-/delete-node/ &reg_usb_vbus;
 
 /delete-node/ &nand_flash;
 
@@ -30,6 +29,3 @@
 	label = "green:wlan";
 };
 
-&usb0 {
-	/delete-property/ vbus-supply;
-};
diff --git a/target/linux/ath79/dts/qca9531_glinet_gl-ar300m.dtsi b/target/linux/ath79/dts/qca9531_glinet_gl-ar300m.dtsi
index d64ffa7115d261..667f779b171ff9 100644
--- a/target/linux/ath79/dts/qca9531_glinet_gl-ar300m.dtsi
+++ b/target/linux/ath79/dts/qca9531_glinet_gl-ar300m.dtsi
@@ -37,14 +37,14 @@
 		};
 	};
 
-	reg_usb_vbus: reg_usb_vbus {
-		compatible = "regulator-fixed";
-
-		regulator-name = "usb_vbus";
-		regulator-min-microvolt = <5000000>;
-		regulator-max-microvolt = <5000000>;
-		gpio = <&gpio 2 GPIO_ACTIVE_HIGH>;
-		enable-active-high;
+	gpio-export {
+		compatible = "gpio-export";
+
+		gpio_usb_power {
+			gpio-export,name = "usb_power";
+			gpio-export,output = <1>;
+			gpios = <&gpio 2 GPIO_ACTIVE_HIGH>;
+		};
 	};
 
 	leds {
@@ -142,9 +142,6 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
-	vbus-supply = <&reg_usb_vbus>;
 	status = "okay";
 };
 
diff --git a/target/linux/ath79/dts/qca9531_glinet_gl-x750.dts b/target/linux/ath79/dts/qca9531_glinet_gl-x750.dts
index 7fd622a8c5f15e..0b2030bb49cecf 100644
--- a/target/linux/ath79/dts/qca9531_glinet_gl-x750.dts
+++ b/target/linux/ath79/dts/qca9531_glinet_gl-x750.dts
@@ -60,14 +60,7 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy {
diff --git a/target/linux/ath79/dts/qca9531_glinet_gl-xe300.dts b/target/linux/ath79/dts/qca9531_glinet_gl-xe300.dts
index 9c2760398bd802..9212c0a7548b58 100644
--- a/target/linux/ath79/dts/qca9531_glinet_gl-xe300.dts
+++ b/target/linux/ath79/dts/qca9531_glinet_gl-xe300.dts
@@ -9,6 +9,10 @@
 	compatible = "glinet,gl-xe300", "qca,qca9531";
 	model = "GL.iNet GL-XE300";
 
+	aliases {
+		label-mac-device = &eth0;
+	};
+
 	gpio-export {
 		compatible = "gpio-export";
 
diff --git a/target/linux/ath79/dts/qca9531_letv_lba-047-ch.dts b/target/linux/ath79/dts/qca9531_letv_lba-047-ch.dts
index d65417c0d52510..586facc9e5be34 100644
--- a/target/linux/ath79/dts/qca9531_letv_lba-047-ch.dts
+++ b/target/linux/ath79/dts/qca9531_letv_lba-047-ch.dts
@@ -4,6 +4,7 @@
 
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
 #include <dt-bindings/mtd/partitions/uimage.h>
 
 / {
@@ -11,11 +12,11 @@
 	compatible = "letv,lba-047-ch", "qca,qca9531";
 
 	aliases {
-		led-boot = &led_status_red;
-		led-failsafe = &led_status_red;
-		led-running = &led_status_blue;
-		led-upgrade = &led_status_red;
 		label-mac-device = &eth0;
+		led-boot = &led_status_red;
+		led-failsafe = &led_status_blue;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_blue;
 	};
 
 	keys {
@@ -31,16 +32,24 @@
 	leds {
 		compatible = "gpio-leds";
 
-		pinctrl-names = "default";
-		pinctrl-0 = <&led_wan_pin>;
-
-		led_status_blue: status_blue {
+		led_status_blue: led-0 {
 			label = "blue:status";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
 			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
 		};
 
-		led_status_red: status_red {
+		led_status_green: led-1 {
+			label = "green:status";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_red: led-2 {
 			label = "red:status";
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
 			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
 		};
 	};
@@ -64,20 +73,13 @@
 	};
 };
 
-&pinmux {
-	/* GPIO 4: LED_LINK_5 (WAN) */
-	led_wan_pin: pinmux_led_wan_pin {
-		pinctrl-single,bits = <0x04 0x0000002d 0x000000ff>;
-	};
-};
-
 &spi {
 	status = "okay";
 
 	flash@0 {
 		compatible = "jedec,spi-nor";
 		reg = <0>;
-		spi-max-frequency = <50000000>;
+		spi-max-frequency = <30000000>;
 		m25p,fast-read;
 
 		partitions {
@@ -112,10 +114,26 @@
 				reg = <0xe90000 0x160000>;
 			};
 
-			art: partition@ff0000 {
+			partition@ff0000 {
 				label = "art";
 				reg = <0xff0000 0x10000>;
 				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_art_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_art_6: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+
+				cal_art_1000: calibration@1000 {
+					reg = <0x1000 0x440>;
+				};
 			};
 		};
 	};
@@ -140,19 +158,6 @@
 &wmac {
 	status = "okay";
 
-	mtd-cal-data = <&art 0x1000>;
-};
-
-&art {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_art_0: macaddr@0 {
-		reg = <0x0 0x6>;
-	};
-
-	macaddr_art_6: macaddr@6 {
-		reg = <0x6 0x6>;
-	};
+	nvmem-cells = <&cal_art_1000>;
+	nvmem-cell-names = "calibration";
 };
diff --git a/target/linux/ath79/dts/qca9531_teltonika_rut300.dts b/target/linux/ath79/dts/qca9531_teltonika_rut300.dts
new file mode 100644
index 00000000000000..f79be8dca54be4
--- /dev/null
+++ b/target/linux/ath79/dts/qca9531_teltonika_rut300.dts
@@ -0,0 +1,157 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include "qca953x.dtsi"
+
+/ {
+	compatible = "teltonika,rut300", "teltonika,rut30x", "qca,qca9531";
+	model = "TELTONIKA RUT300";
+
+	aliases {
+		label-mac-device = &eth1;
+		led-boot = &led_wan;
+		led-failsafe = &led_wan;
+		led-running = &led_wan;
+		led-upgrade = &led_wan;
+		serial0 = &uart;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-names = "default";
+		pinctrl-0 = <&pmx_leds_switch>, <&jtag_disable_pins>;
+
+		led_wan: wan {
+			label = "yellow:wan";
+			gpios = <&gpio 0 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan1 {
+			label = "yellow:lan1";
+			gpios = <&gpio 4 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan2 {
+			label = "yellow:lan2";
+			gpios = <&gpio 3 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan3 {
+			label = "yellow:lan3";
+			gpios = <&gpio 2 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan4 {
+			label = "yellow:lan4";
+			gpios = <&gpio 1 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&spi {
+	status = "okay";
+	num-cs = <1>;
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x020000>;
+				read-only;
+			};
+
+			config: partition@20000 {
+				label = "config";
+				reg = <0x020000 0x010000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "art";
+				reg = <0x030000 0x010000>;
+				read-only;
+			};
+
+			partition@40000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x040000 0xf30000>;
+			};
+
+			partition@f70000 {
+				label = "event-log";
+				reg = <0xf70000 0x090000>;
+			};
+		};
+	};
+};
+
+&usb0 {
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&uart {
+	status = "okay";
+};
+
+&config {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_config_0: macaddr@0 {
+		reg = <0x0 0x6>;
+	};
+};
+
+&eth0 {
+	status = "okay";
+	phy-handle = <&swphy0>;
+
+	nvmem-cells = <&macaddr_config_0>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <1>;
+};
+
+&eth1 {
+	phy-handle = <&swphy4>;
+	nvmem-cells = <&macaddr_config_0>;
+	nvmem-cell-names = "mac-address";
+
+	gmac-config {
+		device = <&gmac>;
+		switch-phy-swap = <1>;
+	};
+};
+
+&pinmux {
+	pmx_leds_switch: leds_switch {
+		// switch port LEDs on GPIO 0~4
+		pinctrl-single,bits =	<0x0 0x00000000 0xffffffff>,
+					<0x4 0x00000000 0x000000ff>;
+	};
+};
diff --git a/target/linux/ath79/dts/qca9531_tplink_archer-d50-v1.dts b/target/linux/ath79/dts/qca9531_tplink_archer-d50-v1.dts
index 27b70e082af4a2..0fc2bd3df82756 100644
--- a/target/linux/ath79/dts/qca9531_tplink_archer-d50-v1.dts
+++ b/target/linux/ath79/dts/qca9531_tplink_archer-d50-v1.dts
@@ -178,14 +178,7 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port0: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &romfile {
diff --git a/target/linux/ath79/dts/qca9531_tplink_tl-mr3420-v3.dts b/target/linux/ath79/dts/qca9531_tplink_tl-mr3420-v3.dts
index 818ec776952797..e6fb85259612bf 100644
--- a/target/linux/ath79/dts/qca9531_tplink_tl-mr3420-v3.dts
+++ b/target/linux/ath79/dts/qca9531_tplink_tl-mr3420-v3.dts
@@ -102,7 +102,7 @@
 		usb {
 			label = "green:usb";
 			gpios = <&led_gpio 7 GPIO_ACTIVE_LOW>;
-			trigger-sources = <&hub_port>;
+			trigger-sources = <&hub_port0>;
 			linux,default-trigger = "usbport";
 		};
 
@@ -190,14 +190,7 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy {
diff --git a/target/linux/ath79/dts/qca9531_tplink_tl-mr6400-v1.dts b/target/linux/ath79/dts/qca9531_tplink_tl-mr6400-v1.dts
index ca7832ebd49a54..5a990fff023009 100644
--- a/target/linux/ath79/dts/qca9531_tplink_tl-mr6400-v1.dts
+++ b/target/linux/ath79/dts/qca9531_tplink_tl-mr6400-v1.dts
@@ -148,14 +148,7 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy {
diff --git a/target/linux/ath79/dts/qca9531_tplink_tl-wr902ac-v1.dts b/target/linux/ath79/dts/qca9531_tplink_tl-wr902ac-v1.dts
index 7ce8cd30cdf947..09f086b90ddda4 100644
--- a/target/linux/ath79/dts/qca9531_tplink_tl-wr902ac-v1.dts
+++ b/target/linux/ath79/dts/qca9531_tplink_tl-wr902ac-v1.dts
@@ -178,14 +178,7 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port0: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &info {
diff --git a/target/linux/ath79/dts/qca9533_kuwfi_c910.dts b/target/linux/ath79/dts/qca9533_kuwfi_c910.dts
new file mode 100644
index 00000000000000..a705aa8686bdc6
--- /dev/null
+++ b/target/linux/ath79/dts/qca9533_kuwfi_c910.dts
@@ -0,0 +1,194 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca953x.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/mtd/partitions/uimage.h>
+
+/ {
+	compatible = "kuwfi,c910", "qca,qca9533";
+	model = "KuWFi C910";
+
+	aliases {
+		label-mac-device = &eth1;
+		led-boot = &internet_red;
+		led-failsafe = &internet_red;
+		led-upgrade = &internet_red;
+	};
+
+	virtual_flash {
+		compatible = "mtd-concat";
+		devices = <&fwconcat0 &fwconcat1>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				reg = <0x0 0x0>;
+				label = "firmware";
+				compatible = "openwrt,uimage", "denx,uimage";
+				openwrt,ih-magic = <IH_MAGIC_OKLI>;
+			};
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		internet_blue {
+			label = "blue:internet";
+			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		wifi {
+			label = "white:wifi";
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		internet_green {
+			label = "green:internet";
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+		};
+
+		wan {
+			label = "white:wan";
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+		};
+
+		lan2 {
+			label = "white:lan2";
+			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		// gpio 12 enables or disables LTE (Quectel EC200T)
+
+		internet_red: internet_red {
+			label = "red:internet";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		};
+
+		lan1 {
+			label = "white:lan1";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "winbond,w25q128", "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x020000>;
+				read-only;
+			};
+
+			partition@20000 {
+				label = "u-boot-env";
+				reg = <0x020000 0x010000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "config";
+				reg = <0x030000 0x020000>;
+				read-only;
+			};
+
+			fwconcat0: partition@50000 {
+				label = "fwconcat0";
+				reg = <0x050000 0xe30000>;
+			};
+
+			partition@e80000 {
+				label = "loader";
+				reg = <0xe80000 0x10000>;
+			};
+
+			fwconcat1: partition@e90000 {
+				label = "fwconcat1";
+				reg = <0xe90000 0x160000>;
+			};
+
+			partition@ff0000 {
+				label = "art";
+				reg = <0xff0000 0x010000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				calibration_art_1000: macaddr@1000 {
+					reg = <0x1000 0x440>;
+				};
+
+				macaddr_art_1002: macaddr@1002 {
+					reg = <0x1002 0x6>;
+				};
+			};
+		};
+	};
+};
+
+&usb0 {
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&eth0 {
+	status = "okay";
+
+	phy-handle = <&swphy0>;
+
+	nvmem-cells = <&macaddr_art_1002>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <1>;
+};
+
+&eth1 {
+	phy-handle = <&swphy4>;
+
+	nvmem-cells = <&macaddr_art_1002>;
+	nvmem-cell-names = "mac-address";
+
+	gmac-config {
+		device = <&gmac>;
+		switch-phy-swap = <1>;
+	};
+};
+
+&wmac {
+	status = "okay";
+
+	nvmem-cells = <&calibration_art_1000>;
+	nvmem-cell-names = "calibration";
+};
diff --git a/target/linux/ath79/dts/qca9533_tplink_tl-wr842n-v3.dts b/target/linux/ath79/dts/qca9533_tplink_tl-wr842n-v3.dts
index e171984511dffd..2d00159909b300 100644
--- a/target/linux/ath79/dts/qca9533_tplink_tl-wr842n-v3.dts
+++ b/target/linux/ath79/dts/qca9533_tplink_tl-wr842n-v3.dts
@@ -71,7 +71,7 @@
 			label = "green:usb";
 			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
 			linux,default-trigger = "usbport";
-			trigger-sources = <&hub_port>;
+			trigger-sources = <&hub_port0>;
 		};
 	};
 
@@ -95,14 +95,7 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy {
diff --git a/target/linux/ath79/dts/qca953x.dtsi b/target/linux/ath79/dts/qca953x.dtsi
index 745c736b745ddc..4300c741adbf41 100644
--- a/target/linux/ath79/dts/qca953x.dtsi
+++ b/target/linux/ath79/dts/qca953x.dtsi
@@ -104,7 +104,9 @@
 
 				#clock-cells = <1>;
 				clock-output-names = "cpu", "ddr", "ahb";
+
 				clocks = <&extosc>;
+				clock-names = "ref";
 			};
 
 			wdt: wdt@18060008 {
@@ -204,6 +206,11 @@
 
 			#address-cells = <1>;
 			#size-cells = <0>;
+
+			hub_port0: port@1 {
+				reg = <1>;
+				#trigger-source-cells = <0>;
+			};
 		};
 
 		spi: spi@1f000000 {
diff --git a/target/linux/ath79/dts/qca9557_8dev_rambutan.dts b/target/linux/ath79/dts/qca9557_8dev_rambutan.dts
index 2724c3a1b67dd4..a81687469285ec 100644
--- a/target/linux/ath79/dts/qca9557_8dev_rambutan.dts
+++ b/target/linux/ath79/dts/qca9557_8dev_rambutan.dts
@@ -110,9 +110,6 @@
 
 &usb0 {
 	status = "okay";
-
-	#address-cells = <1>;
-	#size-cells = <0>;
 };
 
 &usb_phy1 {
@@ -121,9 +118,6 @@
 
 &usb1 {
 	status = "okay";
-
-	#address-cells = <1>;
-	#size-cells = <0>;
 };
 
 &art {
diff --git a/target/linux/ath79/dts/qca9557_araknis_an-500-ap-i-ac.dts b/target/linux/ath79/dts/qca9557_araknis_an-500-ap-i-ac.dts
index 419e77c4f85507..bd9f3e8da8a002 100644
--- a/target/linux/ath79/dts/qca9557_araknis_an-500-ap-i-ac.dts
+++ b/target/linux/ath79/dts/qca9557_araknis_an-500-ap-i-ac.dts
@@ -94,6 +94,10 @@
 	mac-address-increment = <1>;
 };
 
+&pcie0 {
+	status = "okay";
+};
+
 &art {
 	compatible = "nvmem-cells";
 	#address-cells = <1>;
diff --git a/target/linux/ath79/dts/qca9557_engenius_eap1200h.dts b/target/linux/ath79/dts/qca9557_engenius_eap1200h.dts
index 3b3a3e3c3d2d51..d20a0444753a13 100644
--- a/target/linux/ath79/dts/qca9557_engenius_eap1200h.dts
+++ b/target/linux/ath79/dts/qca9557_engenius_eap1200h.dts
@@ -57,10 +57,26 @@
 };
 
 &partitions {
-	art: partition@ff0000 {
+	partition@ff0000 {
 		label = "art";
 		reg = <0xff0000 0x010000>;
 		read-only;
+
+		compatible = "nvmem-cells";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		macaddr_art_0: macaddr@0 {
+			reg = <0x0 0x6>;
+		};
+
+		calibration_art_1000: calibration@1000 {
+			reg = <0x1000 0x440>;
+		};
+
+		calibration_art_5000: calibration@5000 {
+			reg = <0x5000 0x844>;
+		};
 	};
 };
 
@@ -89,18 +105,19 @@
 &wmac {
 	status = "okay";
 
-	mtd-cal-data = <&art 0x1000>;
-	nvmem-cells = <&macaddr_art_0>;
-	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_art_0>, <&calibration_art_1000>;
+	nvmem-cell-names = "mac-address", "calibration";
 	mac-address-increment = <1>;
 };
 
-&art {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
+&ath10k_0 {
+	status = "okay";
 
-	macaddr_art_0: macaddr@0 {
-		reg = <0x0 0x6>;
-	};
+	nvmem-cells = <&macaddr_art_0>, <&calibration_art_5000>;
+	nvmem-cell-names = "mac-address", "calibration";
+	mac-address-increment = <2>;
+};
+
+&pcie0 {
+	status = "okay";
 };
diff --git a/target/linux/ath79/dts/qca9557_engenius_enstationac-v1.dts b/target/linux/ath79/dts/qca9557_engenius_enstationac-v1.dts
index 812fcfc5dcbf89..12740b9bdf7d35 100644
--- a/target/linux/ath79/dts/qca9557_engenius_enstationac-v1.dts
+++ b/target/linux/ath79/dts/qca9557_engenius_enstationac-v1.dts
@@ -111,6 +111,10 @@
 	qca955x-sgmii-fixup;
 };
 
+&pcie0 {
+	status = "okay";
+};
+
 &art {
 	compatible = "nvmem-cells";
 	#address-cells = <1>;
diff --git a/target/linux/ath79/dts/qca9557_engenius_esr1200.dts b/target/linux/ath79/dts/qca9557_engenius_esr1200.dts
new file mode 100644
index 00000000000000..a70dc4739dfc74
--- /dev/null
+++ b/target/linux/ath79/dts/qca9557_engenius_esr1200.dts
@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca955x_senao_router-dual.dtsi"
+
+/ {
+	compatible = "engenius,esr1200", "qca,qca9557";
+	model = "EnGenius ESR1200";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: power {
+			label = "amber:power";
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+
+		wlan2g {
+			label = "blue:wlan2g";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		wlan5g {
+			label = "blue:wlan5g";
+			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wps_amber {
+			label = "amber:wps";
+			gpios = <&gpio 22 GPIO_ACTIVE_LOW>;
+		};
+
+		wps_blue {
+			label = "blue:wps";
+			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&phy0 {
+	qca,mib-poll-interval = <500>;
+
+	qca,ar8327-initvals = <
+		0x04 0x87680000 /* PORT0 PAD MODE CTRL */
+		0x10 0x40000000 /* POWER_ON_STRAP */
+		0x50 0xcf35cf35 /* LED_CTRL0 */
+		0x54 0xcf35cf35 /* LED_CTRL1 */
+		0x58 0xcf35cf35 /* LED_CTRL2 */
+		0x5c 0x03ffff00 /* LED_CTRL3 */
+		0x7c 0x0000007e /* PORT0_STATUS */
+	>;
+};
+
+&usb_phy1 {
+	status = "okay";
+};
+
+&usb1 {
+	status = "okay";
+};
+
+&wmac {
+	nvmem-cells = <&calibration_art_1000>;
+	nvmem-cell-names = "calibration";
+};
+
+&ath10k_0 {
+	nvmem-cells = <&calibration_art_5000>;
+	nvmem-cell-names = "calibration";
+};
diff --git a/target/linux/ath79/dts/qca9557_extreme-networks_ws-ap3805i.dts b/target/linux/ath79/dts/qca9557_extreme-networks_ws-ap3805i.dts
index 8b1477b5937ba3..59dd83d5f87417 100644
--- a/target/linux/ath79/dts/qca9557_extreme-networks_ws-ap3805i.dts
+++ b/target/linux/ath79/dts/qca9557_extreme-networks_ws-ap3805i.dts
@@ -7,7 +7,7 @@
 
 / {
 	compatible = "extreme-networks,ws-ap3805i", "qca,qca9557";
-	model = "Extreme Networks AP3805i";
+	model = "Extreme Networks WS-AP3805i";
 
 	aliases {
 		led-boot = &led_power_green;
diff --git a/target/linux/ath79/dts/qca9557_meraki_mr18.dts b/target/linux/ath79/dts/qca9557_meraki_mr18.dts
new file mode 100644
index 00000000000000..a88e2bcd377a10
--- /dev/null
+++ b/target/linux/ath79/dts/qca9557_meraki_mr18.dts
@@ -0,0 +1,203 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca955x.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "meraki,mr18", "qca,qca9558";
+	model = "Meraki MR18";
+
+	aliases {
+		label-mac-device = &eth0;
+		led-boot = &white;
+		led-failsafe = &orange;
+		led-running = &green;
+		led-upgrade = &white;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		white: white {
+			label = "white:power";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+		};
+
+		orange: orange {
+			label = "orange:power";
+			gpios = <&gpio 21 GPIO_ACTIVE_HIGH>;
+			panic-indicator;
+		};
+	};
+
+	uleds {
+		compatible = "virtual-leds";
+#if 0
+		/*
+		 * RGB leds are not supported by uleds driver.
+		 * but this is what the definitions for a as
+		 * of yet unwritten leds_nu801 would look like.
+		 */
+
+		rgbled-0 {
+			function = LED_FUNCTION_POWER;
+			color = <LED_COLOR_ID_RGB>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			led@0 {
+				reg = <0>;
+				color = <LED_COLOR_ID_RED>;
+			};
+
+			green: led@1 {
+				reg = <1>;
+				color = <LED_COLOR_ID_GREEN>;
+			};
+
+			led@2 {
+				reg = <2>;
+				color = <LED_COLOR_ID_BLUE>;
+			};
+		};
+
+#else
+		red {
+			label = "red:tricolor";
+			color = <LED_COLOR_ID_RED>;
+		};
+
+		green: green {
+			label = "green:tricolor";
+			color = <LED_COLOR_ID_GREEN>;
+		};
+
+		blue {
+			label = "blue:tricolor";
+			color = <LED_COLOR_ID_BLUE>;
+		};
+#endif
+	};
+
+	button {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "Reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+	};
+};
+
+&nand {
+	status = "okay";
+
+	nand-ecc-mode = "soft";
+	nand-ecc-algo = "bch";
+	nand-ecc-strength = <4>;
+	nand-ecc-step-size = <512>;
+	nand-is-boot-medium;
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "nandloader";
+			reg = <0x0 0x80000>;
+			read-only;
+		};
+
+		partition@80000 {
+			label = "kernel";
+			reg = <0x80000 0x800000>;
+		};
+
+		partition@880000 {
+			label = "recovery";
+			reg = <0x880000 0x800000>;
+		};
+
+		partition@1080000 {
+			label = "ubi";
+			reg = <0x1080000 0x6f00000>;
+		};
+
+		partition@7fe0000 {
+			/*
+			 * This is not always present. And if
+			 * it is, then Meraki (or contractor)
+			 * used a different ecc method than
+			 * the one we need for the UBI partition.
+			 * Reading this causes various reading
+			 * errors.
+			 *
+			 * As a result: Please don't convert
+			 * this to nvmem-cells. Instead there's
+			 * a ubi-volume "caldata" that has the
+			 * necessary data.
+			 */
+
+			label = "odm-caldata";
+			reg = <0x7fe0000 0x20000>;
+			read-only;
+		};
+	};
+};
+
+&pcie0 {
+	status = "okay";
+
+	wifi@0,0 {
+		compatible = "pci168c,0033";
+		reg = <0x0000 0 0 0 0>;
+		qca,no-eeprom;
+	};
+};
+
+&pcie1 {
+	status = "okay";
+
+	wifi@0,0 {
+		compatible = "pci168c,0033";
+		reg = <0x0000 0 0 0 0>;
+		qca,no-eeprom;
+	};
+};
+
+&uart {
+	status = "okay";
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy: ethernet-phy@3 {
+		reg = <3>;
+	};
+};
+
+&eth0 {
+	status = "okay";
+	pll-data = <0xa6000000 0xa0000101 0x80001313>;
+	phy-handle = <&phy>;
+
+	gmac-config {
+		device = <&gmac>;
+		rgmii-enabled = <1>;
+		rxd-delay = <3>;
+		rxdv-delay = <3>;
+	};
+};
+
+&wmac {
+	status = "okay";
+	qca,no-eeprom;
+};
diff --git a/target/linux/ath79/dts/qca9558_allnet_all-wap02860ac.dts b/target/linux/ath79/dts/qca9558_allnet_all-wap02860ac.dts
index aa1f4ad02bdd40..c8b1d94c96572f 100644
--- a/target/linux/ath79/dts/qca9558_allnet_all-wap02860ac.dts
+++ b/target/linux/ath79/dts/qca9558_allnet_all-wap02860ac.dts
@@ -95,6 +95,10 @@
 	mac-address-increment = <1>;
 };
 
+&pcie0 {
+	status = "okay";
+};
+
 &art {
 	compatible = "nvmem-cells";
 	#address-cells = <1>;
diff --git a/target/linux/ath79/dts/qca9558_araknis_an-700-ap-i-ac.dts b/target/linux/ath79/dts/qca9558_araknis_an-700-ap-i-ac.dts
index 304eac5e62f1ea..520ca60144b265 100644
--- a/target/linux/ath79/dts/qca9558_araknis_an-700-ap-i-ac.dts
+++ b/target/linux/ath79/dts/qca9558_araknis_an-700-ap-i-ac.dts
@@ -93,6 +93,10 @@
 	mac-address-increment = <1>;
 };
 
+&pcie0 {
+	status = "okay";
+};
+
 &art {
 	compatible = "nvmem-cells";
 	#address-cells = <1>;
diff --git a/target/linux/ath79/dts/qca9558_belkin_f9x-v2.dtsi b/target/linux/ath79/dts/qca9558_belkin_f9x-v2.dtsi
index 23fe321efbf9c2..72e52129a4cf08 100644
--- a/target/linux/ath79/dts/qca9558_belkin_f9x-v2.dtsi
+++ b/target/linux/ath79/dts/qca9558_belkin_f9x-v2.dtsi
@@ -104,14 +104,7 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port0: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &spi {
diff --git a/target/linux/ath79/dts/qca9558_dlink_dir-629-a1.dts b/target/linux/ath79/dts/qca9558_dlink_dir-629-a1.dts
new file mode 100644
index 00000000000000..41b0039e9303ae
--- /dev/null
+++ b/target/linux/ath79/dts/qca9558_dlink_dir-629-a1.dts
@@ -0,0 +1,170 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca955x.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "dlink,dir-629-a1", "qca,qca9558";
+	model = "D-Link DIR-629 A1";
+
+	aliases {
+		label-mac-device = &eth0;
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+		serial0 = &uart;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN;
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led_power: led-1 {
+			label = "green:power";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_POWER;
+			gpios = <&gpio 21 GPIO_ACTIVE_LOW>;
+		};
+
+		led-2 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WPS;
+			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&eth0 {
+	status = "okay";
+
+	phy-mode = "mii";
+
+	nvmem-cells = <&macaddr_mfcdata_35>;
+	nvmem-cell-names = "mac-address-ascii";
+
+	fixed-link {
+		speed = <100>;
+		full-duplex;
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	switch0@1f {
+		compatible = "qca,ar8236";
+		reg = <0x1f>;
+	};
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <30000000>;
+		m25p,fast-read;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x040000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "u-boot-env";
+				reg = <0x040000 0x008000>;
+				read-only;
+			};
+
+			partition@48000 {
+				label = "mfcdata";
+				reg = <0x048000 0x008000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_mfcdata_35: macaddr@35 {
+					reg = <0x35 0x11>;
+				};
+
+				macaddr_mfcdata_51: macaddr@51 {
+					reg = <0x51 0x11>;
+				};
+			};
+
+			partition@50000 {
+				label = "devconf";
+				reg = <0x050000 0x010000>;
+				read-only;
+			};
+
+			partition@60000 {
+				label = "langpack";
+				reg = <0x060000 0x020000>;
+				read-only;
+			};
+
+			partition@80000 {
+				label = "art";
+				reg = <0x080000 0x010000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				cal_art_1000: calibration@1000 {
+					reg = <0x1000 0x440>;
+				};
+			};
+
+			partition@90000 {
+				compatible = "seama";
+				label = "firmware";
+				reg = <0x090000 0x770000>;
+			};
+		};
+	};
+};
+
+&wmac {
+	status = "okay";
+
+	nvmem-cells = <&cal_art_1000>, <&macaddr_mfcdata_51>;
+	nvmem-cell-names = "calibration", "mac-address-ascii";
+};
diff --git a/target/linux/ath79/dts/qca9558_domywifi_dw33d.dts b/target/linux/ath79/dts/qca9558_domywifi_dw33d.dts
index 5b3318b8b280e0..976ac551f72ff0 100644
--- a/target/linux/ath79/dts/qca9558_domywifi_dw33d.dts
+++ b/target/linux/ath79/dts/qca9558_domywifi_dw33d.dts
@@ -76,14 +76,7 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port0: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy1 {
@@ -91,14 +84,7 @@
 };
 
 &usb1 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port1: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &spi {
diff --git a/target/linux/ath79/dts/qca9558_engenius_eap1750h.dts b/target/linux/ath79/dts/qca9558_engenius_eap1750h.dts
new file mode 100644
index 00000000000000..e17eda3840b1eb
--- /dev/null
+++ b/target/linux/ath79/dts/qca9558_engenius_eap1750h.dts
@@ -0,0 +1,123 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca955x_senao_loader.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "engenius,eap1750h", "qca,qca9558";
+	model = "EnGenius EAP1750H";
+
+	aliases {
+		label-mac-device = &eth0;
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: power {
+			label = "amber:power";
+			gpios = <&gpio 22 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+
+		wifi2g {
+			label = "blue:wifi2g";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		wifi5g {
+			label = "green:wifi5g";
+			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wps {
+			label = "blue:wps";
+			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&partitions {
+	partition@ff0000 {
+		label = "art";
+		reg = <0xff0000 0x010000>;
+		read-only;
+
+		compatible = "nvmem-cells";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		macaddr_art_0: macaddr@0 {
+			reg = <0x0 0x6>;
+		};
+
+		calibration_art_1000: calibration@1000 {
+			reg = <0x1000 0x440>;
+		};
+
+		calibration_art_5000: calibration@5000 {
+			reg = <0x5000 0x844>;
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy5: ethernet-phy@5 {
+		reg = <5>;
+		eee-broken-100tx;
+		eee-broken-1000t;
+	};
+};
+
+&eth0 {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_art_0>;
+	nvmem-cell-names = "mac-address";
+
+	phy-handle = <&phy5>;
+	phy-mode = "rgmii-id";
+
+	pll-data = <0x82000000 0x80000101 0x80001313>;
+};
+
+&wmac {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_art_0>, <&calibration_art_1000>;
+	nvmem-cell-names = "mac-address", "calibration";
+	mac-address-increment = <1>;
+};
+
+&ath10k_0 {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_art_0>, <&calibration_art_5000>;
+	nvmem-cell-names = "mac-address", "calibration";
+	mac-address-increment = <2>;
+};
+
+&pcie0 {
+	status = "okay";
+};
diff --git a/target/linux/ath79/dts/qca9558_engenius_epg5000.dts b/target/linux/ath79/dts/qca9558_engenius_epg5000.dts
index 35716152add615..36aba0714e4e13 100644
--- a/target/linux/ath79/dts/qca9558_engenius_epg5000.dts
+++ b/target/linux/ath79/dts/qca9558_engenius_epg5000.dts
@@ -1,9 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 
-#include "qca955x.dtsi"
-
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
+#include "qca955x_senao_router-dual.dtsi"
 
 / {
 	model = "EnGenius EPG5000";
@@ -47,110 +44,20 @@
 			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
 		};
 	};
-
-	keys {
-		compatible = "gpio-keys";
-
-		reset {
-			label = "reset";
-			linux,code = <KEY_RESTART>;
-			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
-			debounce-interval = <60>;
-		};
-
-		wps {
-			label = "wps";
-			linux,code = <KEY_WPS_BUTTON>;
-			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
-			debounce-interval = <60>;
-		};
-	};
-};
-
-&eth0 {
-	status = "okay";
-
-	phy-handle = <&phy0>;
-	pll-data = <0xa6000000 0x00000101 0x00001616>;
-};
-
-&mdio0 {
-	status = "okay";
-
-	phy0: ethernet-phy@0 {
-		reg = <0>;
-
-		qca,ar8327-initvals = <
-			0x04 0x87600000 /* PORT0 PAD MODE CTRL */
-			0x7c 0x0000007e /* PORT0_STATUS */
-			>;
-	};
-};
-
-&pcie0 {
-	status = "okay";
-
-	wifi@0,0 {
-		compatible = "pci168c,003c";
-		reg = <0x0000 0 0 0 0>;
-	};
 };
 
-&spi {
-	status = "okay";
-
-	flash@0 {
-		compatible = "jedec,spi-nor";
-		reg = <0>;
-		spi-max-frequency = <25000000>;
-
-		partitions {
-			compatible = "fixed-partitions";
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			partition@0 {
-				label = "u-boot";
-				reg = <0x000000 0x030000>;
-				read-only;
-			};
-
-			partition@30000 {
-				label = "u-boot-env";
-				reg = <0x030000 0x010000>;
-			};
-
-			partition@40000 {
-				compatible = "denx,uimage";
-				label = "firmware";
-				reg = <0x040000 0xe50000>;
-			};
-
-			partition@790000 {
-				label = "manufacture";
-				reg = <0xe90000 0x100000>;
-				read-only;
-			};
-
-			partition@ed0000 {
-				label = "backup";
-				reg = <0xf90000 0x010000>;
-				read-only;
-			};
-
-			partition@fe0000 {
-				label = "storage";
-				reg = <0xfa0000 0x050000>;
-				read-only;
-			};
-
-			partition@ff0000 {
-				label = "art";
-				reg = <0xff0000 0x010000>;
-				read-only;
-			};
-		};
-	};
+&phy0 {
+	qca,mib-poll-interval = <500>;
+
+	qca,ar8327-initvals = <
+		0x04 0x87680000 /* PORT0 PAD MODE CTRL */
+		0x10 0x40000000 /* POWER_ON_STRAP */
+		0x50 0xcf35cf35 /* LED_CTRL0 */
+		0x54 0xcf35cf35 /* LED_CTRL1 */
+		0x58 0xcf35cf35 /* LED_CTRL2 */
+		0x5c 0x03ffff00 /* LED_CTRL3 */
+		0x7c 0x0000007e /* PORT0_STATUS */
+	>;
 };
 
 &usb_phy1 {
@@ -162,7 +69,11 @@
 };
 
 &wmac {
-	status = "okay";
+	nvmem-cells = <&calibration_art_1000>;
+	nvmem-cell-names = "calibration";
+};
 
-	qca,no-eeprom;
+&ath10k_0 {
+	nvmem-cells = <&calibration_art_5000>;
+	nvmem-cell-names = "calibration";
 };
diff --git a/target/linux/ath79/dts/qca9558_engenius_esr1750.dts b/target/linux/ath79/dts/qca9558_engenius_esr1750.dts
new file mode 100644
index 00000000000000..4cfdfc1f280279
--- /dev/null
+++ b/target/linux/ath79/dts/qca9558_engenius_esr1750.dts
@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca955x_senao_router-dual.dtsi"
+
+/ {
+	compatible = "engenius,esr1750", "qca,qca9558";
+	model = "EnGenius ESR1750";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: power {
+			label = "amber:power";
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+
+		wlan2g {
+			label = "blue:wlan2g";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		wlan5g {
+			label = "blue:wlan5g";
+			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wps_amber {
+			label = "amber:wps";
+			gpios = <&gpio 22 GPIO_ACTIVE_LOW>;
+		};
+
+		wps_blue {
+			label = "blue:wps";
+			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&phy0 {
+	qca,mib-poll-interval = <500>;
+
+	qca,ar8327-initvals = <
+		0x04 0x87680000 /* PORT0 PAD MODE CTRL */
+		0x10 0x40000000 /* POWER_ON_STRAP */
+		0x50 0xcf35cf35 /* LED_CTRL0 */
+		0x54 0xcf35cf35 /* LED_CTRL1 */
+		0x58 0xcf35cf35 /* LED_CTRL2 */
+		0x5c 0x03ffff00 /* LED_CTRL3 */
+		0x7c 0x0000007e /* PORT0_STATUS */
+	>;
+};
+
+&usb_phy1 {
+	status = "okay";
+};
+
+&usb1 {
+	status = "okay";
+};
+
+&wmac {
+	nvmem-cells = <&calibration_art_1000>;
+	nvmem-cell-names = "calibration";
+};
+
+&ath10k_0 {
+	nvmem-cells = <&calibration_art_5000>;
+	nvmem-cell-names = "calibration";
+};
diff --git a/target/linux/ath79/dts/qca9558_engenius_esr900.dts b/target/linux/ath79/dts/qca9558_engenius_esr900.dts
new file mode 100644
index 00000000000000..269f743223c71f
--- /dev/null
+++ b/target/linux/ath79/dts/qca9558_engenius_esr900.dts
@@ -0,0 +1,85 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca955x_senao_router-dual.dtsi"
+
+/ {
+	compatible = "engenius,esr900", "qca,qca9558";
+	model = "EnGenius ESR900";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: power {
+			label = "amber:power";
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+
+		wlan2g {
+			label = "blue:wlan2g";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		wlan5g {
+			label = "blue:wlan5g";
+			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wps_amber {
+			label = "amber:wps";
+			gpios = <&gpio 22 GPIO_ACTIVE_LOW>;
+		};
+
+		wps_blue {
+			label = "blue:wps";
+			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&phy0 {
+	qca,mib-poll-interval = <500>;
+
+	qca,ar8327-initvals = <
+		0x04 0x07680000 /* PORT0 PAD MODE CTRL */
+		0x10 0x40000000 /* POWER_ON_STRAP */
+		0x50 0xcf35cf35 /* LED_CTRL0 */
+		0x54 0xcf35cf35 /* LED_CTRL1 */
+		0x58 0xcf35cf35 /* LED_CTRL2 */
+		0x5c 0x03ffff00 /* LED_CTRL3 */
+		0x7c 0x0000007e /* PORT0_STATUS */
+	>;
+};
+
+&usb_phy1 {
+	status = "okay";
+};
+
+&usb1 {
+	status = "okay";
+};
+
+&wmac {
+	nvmem-cells = <&calibration_art_1000>;
+	nvmem-cell-names = "calibration";
+};
+
+&pcie0 {
+	status = "okay";
+
+	wifi@0,0,0 {
+		compatible = "pci168c,0033";
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&calibration_art_5000>;
+		nvmem-cell-names = "calibration";
+	};
+};
diff --git a/target/linux/ath79/dts/qca9558_engenius_ews660ap.dts b/target/linux/ath79/dts/qca9558_engenius_ews660ap.dts
new file mode 100644
index 00000000000000..eca3a6091f71fb
--- /dev/null
+++ b/target/linux/ath79/dts/qca9558_engenius_ews660ap.dts
@@ -0,0 +1,132 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca955x_senao_loader.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "engenius,ews660ap", "qca,qca9558";
+	model = "EnGenius EWS660AP";
+
+	aliases {
+		label-mac-device = &eth0;
+		led-boot = &led_wifi5g;
+		led-failsafe = &led_wifi5g;
+		led-upgrade = &led_wifi5g;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 21 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		wifi2g {
+			label = "green:wifi2g";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		led_wifi5g: wifi5g {
+			label = "green:wifi5g";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+	};
+};
+
+&partitions {
+	partition@ff0000 {
+		label = "art";
+		reg = <0xff0000 0x010000>;
+		read-only;
+
+		compatible = "nvmem-cells";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		macaddr_art_0: macaddr@0 {
+			reg = <0x0 0x6>;
+		};
+
+		calibration_art_1000: calibration@1000 {
+			reg = <0x1000 0x440>;
+		};
+
+		calibration_art_5000: calibration@5000 {
+			reg = <0x5000 0x844>;
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy1: ethernet-phy@1 {
+		reg = <1>;
+		eee-broken-100tx;
+		eee-broken-1000t;
+	};
+
+	phy2: ethernet-phy@2 {
+		reg = <2>;
+		eee-broken-100tx;
+		eee-broken-1000t;
+		at803x-override-sgmii-link-check;
+	};
+};
+
+&eth0 {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_art_0>;
+	nvmem-cell-names = "mac-address";
+
+	phy-handle = <&phy1>;
+	phy-mode = "rgmii-id";
+
+	pll-data = <0x82000000 0x80000101 0x80001313>;
+};
+
+&eth1 {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_art_0>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <1>;
+
+	phy-handle = <&phy2>;
+
+	pll-data = <0x03000000 0x00000101 0x00001313>;
+
+	qca955x-sgmii-fixup;
+};
+
+&wmac {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_art_0>, <&calibration_art_1000>;
+	nvmem-cell-names = "mac-address", "calibration";
+	mac-address-increment = <2>;
+};
+
+&ath10k_1 {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_art_0>, <&calibration_art_5000>;
+	nvmem-cell-names = "mac-address", "calibration";
+	mac-address-increment = <3>;
+};
+
+&pcie1 {
+	status = "okay";
+};
diff --git a/target/linux/ath79/dts/qca9558_librerouter_librerouter-v1.dts b/target/linux/ath79/dts/qca9558_librerouter_librerouter-v1.dts
index 6cd8ba4578beea..b3447f8be368b1 100644
--- a/target/linux/ath79/dts/qca9558_librerouter_librerouter-v1.dts
+++ b/target/linux/ath79/dts/qca9558_librerouter_librerouter-v1.dts
@@ -40,6 +40,10 @@
 	keys {
 		compatible = "gpio-keys";
 
+		pinctrl-names = "default";
+		/* GPIO1 (poe_pass) and GPIO2 (watchdog) requires jtag disabled */
+		pinctrl-0 = <&jtag_disable_pins>;
+
 		reset {
 			label = "Reset";
 			linux,code = <KEY_RESTART>;
@@ -80,8 +84,6 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
 };
 
@@ -90,8 +92,6 @@
 };
 
 &usb1 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
 };
 
diff --git a/target/linux/ath79/dts/qca9558_linksys_ea4500-v3.dts b/target/linux/ath79/dts/qca9558_linksys_ea4500-v3.dts
new file mode 100644
index 00000000000000..000dbce8e11a8e
--- /dev/null
+++ b/target/linux/ath79/dts/qca9558_linksys_ea4500-v3.dts
@@ -0,0 +1,211 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca955x.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "linksys,ea4500-v3", "qca,qca9558";
+	model = "Linksys EA4500 v3";
+
+	aliases {
+		led-boot = &led_system;
+		led-failsafe = &led_system;
+		led-running = &led_system;
+		led-upgrade = &led_system;
+		label-mac-device = &eth1;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_system: system {
+			label = "green:system";
+			gpios = <&gpio 21 GPIO_ACTIVE_HIGH>;
+			default-state = "on";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+};
+
+&pcie0 {
+	status = "okay";
+
+	wifi@0,0 {
+		compatible = "pci168c,0033";
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&cal_ath9k_pci>;
+		nvmem-cell-names = "calibration";
+	};
+};
+
+&usb_phy0 {
+	status = "okay";
+};
+
+&usb0 {
+	status = "okay";
+};
+
+&nand {
+	status = "okay";
+
+	partitions {
+		compatible = "fixed-partitions";
+
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "uboot";
+			reg = <0x0 0x100000>;
+			read-only;
+		};
+
+		partition@100000 {
+			label = "u_env";
+			reg = <0x100000 0x40000>;
+		};
+
+		partition@140000 {
+			label = "caldata";
+			reg = <0x140000 0x40000>;
+			read-only;
+
+			compatible = "nvmem-cells";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			cal_macaddr: macaddr@0 {
+				reg = <0x6 0x6>;
+			};
+
+			cal_ath9k_soc: cal_ath9k@1000 {
+				reg = <0x1000 0x440>;
+			};
+
+			cal_ath9k_pci: cal_ath9k@5000 {
+				reg = <0x5000 0x440>;
+			};
+		};
+
+		partition@180000 {
+			label = "s_env";
+			reg = <0x180000 0x40000>;
+			read-only;
+		};
+
+		partition@1c0000 {
+			label = "devinfo";
+			reg = <0x1c0000 0x100000>;
+			read-only;
+		};
+
+		partition@2c0000 {
+			label = "firmware";
+			reg = <0x2c0000 0x5000000>;
+
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "kernel";
+				reg = <0x0 0x400000>;
+			};
+
+			partition@400000 {
+				label = "ubi";
+				reg = <0x400000 0x4c00000>;
+			};
+
+			/* Original layout for secondary partitions */
+			/* partition@2800000 {
+				label = "kernel2";
+				reg = <0x2800000 0x400000>;
+			};
+
+			partition@2c00000 {
+				label = "ubi2";
+				reg = <0x2c00000 0x2400000>;
+			}; */
+		};
+
+		partition@52c0000 {
+			label = "syscfg";
+			reg = <0x52c0000 0x2d40000>;
+			read-only;
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+
+		qca,ar8327-initvals = <
+			0x04 0x07600000 /* PORT0 PAD MODE CTRL: RGMII, to eth0 */
+			0x0c 0x00000080 /* PORT6 PAD MODE CTRL: SGMII, to eth1 */
+			0x50 0xc833c833 /* LED_CTRL0: orange, blinking with act */
+			0x54 0xcf85cf85 /* LED_CTRL1: green, on with link */
+			0x58 0x00000000	/* LED_CTRL2: unpopulated */
+			0x5c 0x00f3cf00 /* LED_CTRL3: enable led 0 and 1 */
+			0x7c 0x0000007e /* PORT0_STATUS */
+			0x94 0x0000007e /* PORT6 STATUS */
+		>;
+	};
+};
+
+&eth0 {
+	status = "okay";
+
+	nvmem-cells = <&cal_macaddr>;
+	nvmem-cell-names = "mac-address";
+	phy-handle = <&phy0>;
+	pll-data = <0x96000000 0x00000101 0x00001616>;
+
+	gmac-config {
+		device = <&gmac>;
+		rgmii-enabled = <1>;
+	};
+};
+
+&eth1 {
+	status = "okay";
+
+	nvmem-cells = <&cal_macaddr>;
+	nvmem-cell-names = "mac-address";
+	pll-data = <0x03000101 0x00000101 0x00001616>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&wmac {
+	status = "okay";
+
+	nvmem-cells = <&cal_ath9k_soc>;
+	nvmem-cell-names = "calibration";
+};
diff --git a/target/linux/ath79/dts/qca9558_mikrotik_routerboard-92x.dtsi b/target/linux/ath79/dts/qca9558_mikrotik_routerboard-92x.dtsi
index 7b7e3a65f87ab2..d668259b1b0025 100644
--- a/target/linux/ath79/dts/qca9558_mikrotik_routerboard-92x.dtsi
+++ b/target/linux/ath79/dts/qca9558_mikrotik_routerboard-92x.dtsi
@@ -150,6 +150,7 @@
 	status = "okay";
 
 	nand-ecc-mode = "soft";
+	nand-ecc-step-size = <2048>;
 	qca,nand-swap-dma;
 	qca,nand-scan-fixup;
 
diff --git a/target/linux/ath79/dts/qca9558_netgear_ex7300.dts b/target/linux/ath79/dts/qca9558_netgear_ex7300.dts
index 9802210b32c678..b94ccd30b7d9e7 100644
--- a/target/linux/ath79/dts/qca9558_netgear_ex7300.dts
+++ b/target/linux/ath79/dts/qca9558_netgear_ex7300.dts
@@ -1,8 +1,246 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 
-#include "qca9558_netgear_ex7300.dtsi"
+#include "qca955x.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
 
 / {
 	model = "Netgear EX7300";
 	compatible = "netgear,ex7300", "qca,qca9558";
+
+	aliases {
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_amber;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_amber;
+		label-mac-device = &eth0;
+	};
+
+	led_spi {
+		compatible = "spi-gpio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		sck-gpios = <&gpio 18 GPIO_ACTIVE_HIGH>;
+		mosi-gpios = <&gpio 15 GPIO_ACTIVE_HIGH>;
+		num-chipselects = <0>;
+
+		led_gpio: led_gpio@0 {
+			compatible = "nxp,74lvc594";
+			reg = <0>;
+			gpio-controller;
+			#gpio-cells = <2>;
+			registers-number = <1>;
+			spi-max-frequency = <500000>;
+
+			gpio_latch_bit {
+				gpio-hog;
+				gpios = <4 GPIO_ACTIVE_HIGH>;
+				output-high;
+				line-name = "gpio-latch-bit";
+			};
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power_green: power_green {
+			label = "green:power";
+			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_amber: power_amber {
+			label = "amber:power";
+			gpios = <&gpio 20 GPIO_ACTIVE_LOW>;
+		};
+
+		left_blue {
+			label = "blue:left";
+			gpios = <&led_gpio 7 GPIO_ACTIVE_LOW>;
+		};
+
+		right_blue {
+			label = "blue:right";
+			gpios = <&led_gpio 6 GPIO_ACTIVE_LOW>;
+		};
+
+		wps_green {
+			label = "green:wps";
+			gpios = <&led_gpio 5 GPIO_ACTIVE_LOW>;
+		};
+
+		client_red {
+			label = "red:client";
+			gpios = <&led_gpio 3 GPIO_ACTIVE_LOW>;
+		};
+
+		client_green {
+			label = "green:client";
+			gpios = <&led_gpio 2 GPIO_ACTIVE_LOW>;
+		};
+
+		router_red {
+			label = "red:router";
+			gpios = <&led_gpio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		router_green {
+			label = "green:router";
+			gpios = <&led_gpio 0 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "Reset button";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+		wps {
+			label = "WPS button";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&gpio 22 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+		extender_apmode {
+			label = "EXTENDER/APMODE switch";
+			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+			linux,input-type = <EV_SW>;
+			debounce-interval = <60>;
+		};
+	};
+};
+
+&pcie0 {
+	status = "okay";
+
+	wifi@0,0 {
+		compatible = "qcom,ath10k";
+		reg = <0 0 0 0 0>;
+
+		nvmem-cells = <&macaddr_caldata_c>, <&precal_caldata_5000>;
+		nvmem-cell-names = "mac-address", "pre-calibration";
+	};
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			uboot: partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x040000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "u-boot-env";
+				reg = <0x040000 0x010000>;
+			};
+
+			caldata: partition@50000 {
+				label = "caldata";
+				reg = <0x050000 0x010000>;
+				read-only;
+			};
+
+			partition@60000 {
+				label = "caldata-backup";
+				reg = <0x060000 0x010000>;
+				read-only;
+			};
+
+			partition@70000 {
+				label = "config";
+				reg = <0x070000 0x010000>;
+			};
+
+			partition@80000 {
+				label = "pot";
+				reg = <0x080000 0x010000>;
+			};
+
+			partition@90000 {
+				label = "firmware";
+				reg = <0x090000 0xf30000>;
+				compatible = "denx,uimage";
+			};
+
+			partition@fc0000 {
+				label = "language";
+				reg = <0xfc0000 0x040000>;
+			};
+		};
+	};
+};
+
+&wmac {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_caldata_6>, <&cal_caldata_1000>;
+	nvmem-cell-names = "mac-address", "calibration";
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+		phy-mode = "rgmii";
+	};
+};
+
+&eth0 {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_caldata_0>;
+	nvmem-cell-names = "mac-address";
+
+	phy-handle = <&phy4>;
+	phy-mode = "rgmii-rxid";
+
+	pll-data = <0x86000000 0x80000101 0x80001313>;
+};
+
+&caldata {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_caldata_0: macaddr@0 {
+		reg = <0x0 0x6>;
+	};
+
+	macaddr_caldata_6: macaddr@6 {
+		reg = <0x6 0x6>;
+	};
+
+	macaddr_caldata_c: macaddr@c {
+		reg = <0xc 0x6>;
+	};
+
+	cal_caldata_1000: cal@1000 {
+		reg = <0x1000 0x440>;
+	};
+
+	precal_caldata_5000: precal@5000 {
+		reg = <0x5000 0x2f20>;
+	};
 };
diff --git a/target/linux/ath79/dts/qca9558_ocedo_koala.dts b/target/linux/ath79/dts/qca9558_ocedo_koala.dts
index 66f8c6589b2022..85fd43699eec92 100644
--- a/target/linux/ath79/dts/qca9558_ocedo_koala.dts
+++ b/target/linux/ath79/dts/qca9558_ocedo_koala.dts
@@ -59,10 +59,6 @@
 	status = "okay";
 };
 
-&pll {
-	clocks = <&extosc>;
-};
-
 &spi {
 	status = "okay";
 
@@ -88,15 +84,10 @@
 			};
 
 			partition@50000 {
+				/* Dual-Flash layout combined */
 				compatible = "denx,uimage";
 				label = "firmware";
-				reg = <0x050000 0x740000>;
-			};
-
-			partition@790000 {
-				label = "vendor";
-				reg = <0x790000 0x740000>;
-				read-only;
+				reg = <0x050000 0xe80000>;
 			};
 
 			partition@ed0000 {
diff --git a/target/linux/ath79/dts/qca9558_ocedo_ursus.dts b/target/linux/ath79/dts/qca9558_ocedo_ursus.dts
index 2dc4c07e918c50..be958d19a08cc2 100644
--- a/target/linux/ath79/dts/qca9558_ocedo_ursus.dts
+++ b/target/linux/ath79/dts/qca9558_ocedo_ursus.dts
@@ -30,10 +30,6 @@
 	status = "okay";
 };
 
-&pll {
-	clocks = <&extosc>;
-};
-
 &spi {
 	status = "okay";
 
@@ -59,15 +55,10 @@
 			};
 
 			partition@50000 {
+				/* Dual-Flash layout combined */
 				compatible = "denx,uimage";
 				label = "firmware";
-				reg = <0x050000 0x740000>;
-			};
-
-			partition@790000 {
-				label = "vendor";
-				reg = <0x790000 0x740000>;
-				read-only;
+				reg = <0x050000 0xe80000>;
 			};
 
 			partition@ed0000 {
diff --git a/target/linux/ath79/dts/qca9558_sitecom_wlr-8100.dts b/target/linux/ath79/dts/qca9558_sitecom_wlr-8100.dts
index eee3e39bc3c471..01a69fce15de0a 100644
--- a/target/linux/ath79/dts/qca9558_sitecom_wlr-8100.dts
+++ b/target/linux/ath79/dts/qca9558_sitecom_wlr-8100.dts
@@ -136,8 +136,6 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
 };
 
diff --git a/target/linux/ath79/dts/qca9558_sophos_ap.dtsi b/target/linux/ath79/dts/qca9558_sophos_ap.dtsi
index c9f3aefbbfb9b6..3d38ca79fe4e3d 100644
--- a/target/linux/ath79/dts/qca9558_sophos_ap.dtsi
+++ b/target/linux/ath79/dts/qca9558_sophos_ap.dtsi
@@ -169,9 +169,4 @@
 
 &usb0 {
 	vbus-supply = <&reg_usb_vbus>;
-
-	hub_port0: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
diff --git a/target/linux/ath79/dts/qca9558_tplink_archer-c.dtsi b/target/linux/ath79/dts/qca9558_tplink_archer-c.dtsi
index f629838f1ae2a0..221582e66db2e3 100644
--- a/target/linux/ath79/dts/qca9558_tplink_archer-c.dtsi
+++ b/target/linux/ath79/dts/qca9558_tplink_archer-c.dtsi
@@ -85,14 +85,7 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port0: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy1 {
@@ -100,14 +93,7 @@
 };
 
 &usb1 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port1: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &spi {
diff --git a/target/linux/ath79/dts/qca9558_tplink_archer-d7.dtsi b/target/linux/ath79/dts/qca9558_tplink_archer-d7.dtsi
index f9e8adcc9eb6c9..c4d910bf1e0f91 100644
--- a/target/linux/ath79/dts/qca9558_tplink_archer-d7.dtsi
+++ b/target/linux/ath79/dts/qca9558_tplink_archer-d7.dtsi
@@ -141,16 +141,9 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	dr_mode = "host";
 	vbus-supply = <&reg_usb0_vbus>;
 	status = "okay";
-
-	hub_port0: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy1 {
@@ -158,14 +151,7 @@
 };
 
 &usb1 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	dr_mode = "host";
 	vbus-supply = <&reg_usb1_vbus>;
 	status = "okay";
-
-	hub_port1: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
diff --git a/target/linux/ath79/dts/qca9558_tplink_tl-wdr4900-v2.dts b/target/linux/ath79/dts/qca9558_tplink_tl-wdr4900-v2.dts
index 5b69a1708eafdc..c6b9b077da29cf 100644
--- a/target/linux/ath79/dts/qca9558_tplink_tl-wdr4900-v2.dts
+++ b/target/linux/ath79/dts/qca9558_tplink_tl-wdr4900-v2.dts
@@ -96,10 +96,9 @@
 	ath9k: wifi@0,0 {
 		compatible = "pci168c,0033";
 		reg = <0x0000 0 0 0 0>;
-		nvmem-cells = <&macaddr_uboot_1fc00>;
-		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_uboot_1fc00>, <&cal_ath9k_pci>;
+		nvmem-cell-names = "mac-address", "calibration";
 		mac-address-increment = <(-2)>;
-		qca,no-eeprom;
 		#gpio-cells = <2>;
 		gpio-controller;
 	};
@@ -110,14 +109,7 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port0: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy1 {
@@ -125,14 +117,7 @@
 };
 
 &usb1 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port1: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &spi {
@@ -152,6 +137,14 @@
 				label = "u-boot";
 				reg = <0x000000 0x020000>;
 				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_uboot_1fc00: macaddr@1fc00 {
+					reg = <0x1fc00 0x6>;
+				};
 			};
 
 			partition@20000 {
@@ -164,6 +157,18 @@
 				label = "art";
 				reg = <0x7f0000 0x010000>;
 				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				cal_ath9k_soc: cal_ath9k@1000 {
+					reg = <0x1000 0x440>;
+				};
+
+				cal_ath9k_pci: cal_ath9k@5000 {
+					reg = <0x5000 0x440>;
+				};
 			};
 		};
 	};
@@ -219,18 +224,7 @@
 &wmac {
 	status = "okay";
 
-	mtd-cal-data = <&art 0x1000>;
-	nvmem-cells = <&macaddr_uboot_1fc00>;
-	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_uboot_1fc00>, <&cal_ath9k_soc>;
+	nvmem-cell-names = "mac-address", "calibration";
 	mac-address-increment = <(-1)>;
 };
-
-&uboot {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_uboot_1fc00: macaddr@1fc00 {
-		reg = <0x1fc00 0x6>;
-	};
-};
diff --git a/target/linux/ath79/dts/qca9558_tplink_tl-wr1043nd.dtsi b/target/linux/ath79/dts/qca9558_tplink_tl-wr1043nd.dtsi
index ff7ea7da039ba0..52996bba34767d 100644
--- a/target/linux/ath79/dts/qca9558_tplink_tl-wr1043nd.dtsi
+++ b/target/linux/ath79/dts/qca9558_tplink_tl-wr1043nd.dtsi
@@ -77,14 +77,7 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port0: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &spi {
diff --git a/target/linux/ath79/dts/qca9558_trendnet_tew-823dru.dts b/target/linux/ath79/dts/qca9558_trendnet_tew-823dru.dts
index 22569bfc1d0503..176fe97cc0a96e 100644
--- a/target/linux/ath79/dts/qca9558_trendnet_tew-823dru.dts
+++ b/target/linux/ath79/dts/qca9558_trendnet_tew-823dru.dts
@@ -72,14 +72,7 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port0: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy1 {
@@ -87,14 +80,7 @@
 };
 
 &usb1 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port1: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &spi {
diff --git a/target/linux/ath79/dts/qca9558_ubnt_nanobeam-ac-xc.dts b/target/linux/ath79/dts/qca9558_ubnt_nanobeam-ac-xc.dts
index dce88ac2189286..91675ff615322d 100644
--- a/target/linux/ath79/dts/qca9558_ubnt_nanobeam-ac-xc.dts
+++ b/target/linux/ath79/dts/qca9558_ubnt_nanobeam-ac-xc.dts
@@ -5,7 +5,7 @@
  * Copyright (C) 2022 Daniel González Cabanelas <dgcbueu@gmail.com>
  * based on device tree from qca9558_ubnt_powerbeam-5ac-500.dts
  */
- 
+
 #include "qca955x_ubnt_xc.dtsi"
 
 / {
diff --git a/target/linux/ath79/dts/qca9558_watchguard_ap300.dts b/target/linux/ath79/dts/qca9558_watchguard_ap300.dts
index 90f5cddfa77375..799883c350f2bf 100644
--- a/target/linux/ath79/dts/qca9558_watchguard_ap300.dts
+++ b/target/linux/ath79/dts/qca9558_watchguard_ap300.dts
@@ -121,6 +121,10 @@
 	mac-address-increment = <1>;
 };
 
+&pcie0 {
+	status = "okay";
+};
+
 &art {
 	compatible = "nvmem-cells";
 	#address-cells = <1>;
diff --git a/target/linux/ath79/dts/qca955x.dtsi b/target/linux/ath79/dts/qca955x.dtsi
index b6e08f9f12a454..e7daa9d827b5d2 100644
--- a/target/linux/ath79/dts/qca955x.dtsi
+++ b/target/linux/ath79/dts/qca955x.dtsi
@@ -119,6 +119,7 @@
 				clock-output-names = "cpu", "ddr", "ahb";
 
 				clocks = <&extosc>;
+				clock-names = "ref";
 			};
 
 			wdt: wdt@18060008 {
@@ -267,6 +268,11 @@
 
 			#address-cells = <1>;
 			#size-cells = <0>;
+
+			hub_port0: port@1 {
+				reg = <1>;
+				#trigger-source-cells = <0>;
+			};
 		};
 
 		usb1: usb@1b400000 {
@@ -288,6 +294,11 @@
 
 			#address-cells = <1>;
 			#size-cells = <0>;
+
+			hub_port1: port@1 {
+				reg = <1>;
+				#trigger-source-cells = <0>;
+			};
 		};
 
 		nand: nand@1b800200 {
diff --git a/target/linux/ath79/dts/qca955x_senao_loader.dtsi b/target/linux/ath79/dts/qca955x_senao_loader.dtsi
index ac9f03ec652cbc..cf82c050b6d537 100644
--- a/target/linux/ath79/dts/qca955x_senao_loader.dtsi
+++ b/target/linux/ath79/dts/qca955x_senao_loader.dtsi
@@ -26,14 +26,19 @@
 };
 
 &pcie0 {
-	status = "okay";
-
-	wifi@0,0,0 {
+	ath10k_0: wifi@0,0,0 {
 		compatible = "qcom,ath10k";
 		reg = <0x0 0 0 0 0>;
 	};
 };
 
+&pcie1 {
+	ath10k_1: wifi@0,1,0 {
+		compatible = "qcom,ath10k";
+		reg = <0x0 1 0 0 0>;
+	};
+};
+
 &spi {
 	status = "okay";
 
diff --git a/target/linux/ath79/dts/qca955x_senao_router-dual.dtsi b/target/linux/ath79/dts/qca955x_senao_router-dual.dtsi
new file mode 100644
index 00000000000000..e1b76bcbd1f81b
--- /dev/null
+++ b/target/linux/ath79/dts/qca955x_senao_router-dual.dtsi
@@ -0,0 +1,122 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca955x.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+};
+
+&eth0 {
+	status = "okay";
+
+	phy-handle = <&phy0>;
+	pll-data = <0xa6000000 0x00000101 0x00001616>;
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+	};
+};
+
+&pcie0 {
+	status = "okay";
+
+	ath10k_0: wifi@0,0,0 {
+		compatible = "qcom,ath10k";
+		reg = <0x0000 0 0 0 0>;
+	};
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <40000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x030000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x030000 0x010000>;
+				read-only;
+			};
+
+			partition@40000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x040000 0xe50000>;
+			};
+
+			partition@e90000 {
+				label = "manufacture";
+				reg = <0xe90000 0x100000>;
+				read-only;
+			};
+
+			partition@f90000 {
+				label = "backup";
+				reg = <0xf90000 0x010000>;
+				read-only;
+			};
+
+			partition@fa0000 {
+				label = "storage";
+				reg = <0xfa0000 0x050000>;
+				read-only;
+			};
+
+			art: partition@ff0000 {
+				label = "art";
+				reg = <0xff0000 0x010000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+
+				calibration_art_1000: calibration@1000 {
+					reg = <0x1000 0x440>;
+				};
+
+				calibration_art_5000: calibration@5000 {
+					reg = <0x5000 0x844>;
+				};
+			};
+		};
+	};
+};
+
+&wmac {
+	status = "okay";
+};
diff --git a/target/linux/ath79/dts/qca955x_zyxel_nbg6x16.dtsi b/target/linux/ath79/dts/qca955x_zyxel_nbg6x16.dtsi
index 9e1ce89c464b5e..7de1c4fa69602c 100644
--- a/target/linux/ath79/dts/qca955x_zyxel_nbg6x16.dtsi
+++ b/target/linux/ath79/dts/qca955x_zyxel_nbg6x16.dtsi
@@ -116,19 +116,8 @@
 
 &usb0 {
 	status = "okay";
-
-	hub_port0: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
-
 };
 
 &usb1 {
 	status = "okay";
-
-	hub_port1: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
diff --git a/target/linux/ath79/dts/qca9561_tplink_archer-c59-v1.dts b/target/linux/ath79/dts/qca9561_tplink_archer-c59-v1.dts
index c385eb15925649..f05a290d2f8945 100644
--- a/target/linux/ath79/dts/qca9561_tplink_archer-c59-v1.dts
+++ b/target/linux/ath79/dts/qca9561_tplink_archer-c59-v1.dts
@@ -16,19 +16,12 @@
 		label = "green:usb";
 		gpios = <&led_gpio 7 GPIO_ACTIVE_LOW>;
 		linux,default-trigger = "usbport";
-		trigger-sources = <&hub_port>;
+		trigger-sources = <&hub_port0>;
 	};
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy0 {
diff --git a/target/linux/ath79/dts/qca9561_tplink_archer-c59-v2.dts b/target/linux/ath79/dts/qca9561_tplink_archer-c59-v2.dts
index 5a277723e3ad05..4be23ffbc02f7b 100644
--- a/target/linux/ath79/dts/qca9561_tplink_archer-c59-v2.dts
+++ b/target/linux/ath79/dts/qca9561_tplink_archer-c59-v2.dts
@@ -16,19 +16,12 @@
 		label =	"green:usb";
 		gpios =	<&led_gpio 7 GPIO_ACTIVE_LOW>;
 		linux,default-trigger =	"usbport";
-		trigger-sources	= <&hub_port>;
+		trigger-sources	= <&hub_port0>;
 	};
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy0 {
diff --git a/target/linux/ath79/dts/qca9561_tplink_tl-wdr6500-v2.dts b/target/linux/ath79/dts/qca9561_tplink_tl-wdr6500-v2.dts
new file mode 100644
index 00000000000000..15c586865975f9
--- /dev/null
+++ b/target/linux/ath79/dts/qca9561_tplink_tl-wdr6500-v2.dts
@@ -0,0 +1,172 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca956x.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "tplink,tl-wdr6500-v2", "qca,qca9561";
+	model = "TP-Link TL-WDR6500 v2";
+
+	aliases {
+		led-boot = &led_system;
+		led-failsafe = &led_system;
+		led-running = &led_system;
+		led-upgrade = &led_system;
+		label-mac-device = &eth1;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "Reset button";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		lan4 {
+			label = "green:lan4";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		};
+
+		lan3 {
+			label = "green:lan3";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		lan2 {
+			label = "green:lan2";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+		};
+
+		lan1 {
+			label = "green:lan1";
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+		};
+
+		wan {
+			label = "green:wan";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+		};
+
+		led_system: system {
+			label = "white:system";
+			gpios = <&gpio 21 GPIO_ACTIVE_HIGH>;
+			default-state = "on";
+		};
+	};
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x010000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_uboot_0fc00: macaddr@0fc00 {
+					reg = <0x0fc00 0x6>;
+				};
+			};
+
+			partition@10000 {
+				compatible = "tplink,firmware";
+				label = "firmware";
+				reg = <0x010000 0x7e0000>;
+			};
+
+			partition@7f0000 {
+				label = "art";
+				reg = <0x7f0000 0x010000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				calibration_ath9k: calibration@1000 {
+					reg = <0x1000 0x440>;
+				};
+
+				calibration_ath10k: calibration@5000 {
+					reg = <0x5000 0x844>;
+				};
+			};
+		};
+	};
+};
+
+&uart {
+	status = "okay";
+};
+
+&pcie {
+	status = "okay";
+
+	wifi@0,0 {
+		compatible = "qcom,ath10k";
+		reg = <0 0 0 0 0>;
+
+		nvmem-cells = <&macaddr_uboot_0fc00>, <&calibration_ath10k>;
+		nvmem-cell-names = "mac-address", "calibration";
+		mac-address-increment = <(-2)>;
+	};
+};
+
+&mdio0 {
+	status = "okay";
+};
+
+&eth0 {
+	status = "okay";
+
+	phy-handle = <&swphy4>;
+
+	nvmem-cells = <&macaddr_uboot_0fc00>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <1>;
+};
+
+&eth1 {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_uboot_0fc00>;
+	nvmem-cell-names = "mac-address";
+};
+
+&wmac {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_uboot_0fc00>, <&calibration_ath9k>;
+	nvmem-cell-names = "mac-address", "calibration";
+	mac-address-increment = <(-1)>;
+};
+
+&usb0 {
+	status = "okay";
+};
+
+&usb_phy0 {
+	status = "okay";
+};
diff --git a/target/linux/ath79/dts/qca9563_dlink_dir-859-a1.dts b/target/linux/ath79/dts/qca9563_dlink_dir-859-a1.dts
index 804f3434c37875..93bd8e363e85e7 100644
--- a/target/linux/ath79/dts/qca9563_dlink_dir-859-a1.dts
+++ b/target/linux/ath79/dts/qca9563_dlink_dir-859-a1.dts
@@ -1,9 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 
-#include "qca956x.dtsi"
-
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
+#include "qca9563_dlink_dir-8x9-a1.dtsi"
 
 / {
 	model = "D-Link DIR-859 A1";
@@ -40,122 +37,4 @@
 			linux,default-trigger = "phy0tpt";
 		};
 	};
-
-	keys {
-		compatible = "gpio-keys";
-
-		wps {
-			linux,code = <KEY_WPS_BUTTON>;
-			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
-			debounce-interval = <60>;
-		};
-
-		reset {
-			linux,code = <KEY_RESTART>;
-			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
-			debounce-interval = <60>;
-		};
-	};
-
-	gpio-export {
-		compatible = "gpio-export";
-		#size-cells = <0>;
-
-		gpio_switch_reset {
-			gpio-export,name = "dir-859-a1:reset:switch";
-			gpio-export,output = <1>;
-			gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
-		};
-	};
-};
-
-&pcie {
-	status = "okay";
-};
-
-&spi {
-	status = "okay";
-
-	flash@0 {
-		compatible = "jedec,spi-nor";
-		reg = <0>;
-		spi-max-frequency = <50000000>;
-
-		partitions {
-			compatible = "fixed-partitions";
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			partition@0 {
-				label = "bootloader";
-				reg = <0x000000 0x40000>;
-				read-only;
-			};
-
-			partition@40000 {
-				label = "bdcfg";
-				reg = <0x040000 0x10000>;
-				read-only;
-			};
-
-			partition@50000 {
-				label = "devdata";
-				reg = <0x050000 0x10000>;
-				read-only;
-			};
-
-			partition@60000 {
-				label = "devconf";
-				reg = <0x060000 0x10000>;
-				read-only;
-			};
-
-			partition@70000 {
-				compatible = "seama";
-				label = "firmware";
-				reg = <0x070000 0xf80000>;
-			};
-
-			art: partition@ff0000 {
-				label = "art";
-				reg = <0xff0000 0x010000>;
-				read-only;
-			};
-		};
-	};
-};
-
-&mdio0 {
-	status = "okay";
-
-	phy0: ethernet-phy@0 {
-		reg = <0>;
-		phy-mode = "sgmii";
-		qca,mib-poll-interval = <500>;
-
-		qca,ar8327-initvals = <
-			0x04 0x00080080 /* PORT0 PAD MODE CTRL */
-			0x10 0x81000080 /* POWER_ON_STRAP */
-			0x50 0xcc35cc35 /* LED_CTRL0 */
-			0x54 0xcb37cb37 /* LED_CTRL1 */
-			0x58 0x00000000 /* LED_CTRL2 */
-			0x5c 0x00f3cf00 /* LED_CTRL3 */
-			0x7c 0x0000007e /* PORT0_STATUS */
-			>;
-	};
-};
-
-&eth0 {
-	status = "okay";
-
-	pll-data = <0x03000101 0x00000101 0x00001919>;
-
-	phy-mode = "sgmii";
-	phy-handle = <&phy0>;
-};
-
-&wmac {
-	status = "okay";
-
-	qca,no-eeprom;
 };
diff --git a/target/linux/ath79/dts/qca9563_dlink_dir-859-a3.dts b/target/linux/ath79/dts/qca9563_dlink_dir-859-a3.dts
new file mode 100644
index 00000000000000..164e0802f9fb6f
--- /dev/null
+++ b/target/linux/ath79/dts/qca9563_dlink_dir-859-a3.dts
@@ -0,0 +1,64 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca9563_dlink_dir-8x9-a1.dtsi"
+
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "dlink,dir-859-a3", "qca,qca9563";
+	model = "D-Link DIR-859 A3";
+
+	aliases {
+		label-mac-device = &wmac;
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: power {
+			label = "green:power";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_POWER;
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		wan {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+		};
+
+		wlan {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN;
+			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wps {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WPS;
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&ath10k {
+	nvmem-cells = <&calibration_ath10k>, <&macaddr_bdcfg_ethaddr 2>;
+	nvmem-cell-names = "calibration", "mac-address";
+};
+
+&bdcfg {
+	macaddr_bdcfg_ethaddr: ethaddr {
+		#nvmem-cell-cells = <1>;
+	};
+};
+
+&wmac {
+	nvmem-cells = <&calibration_ath9k>, <&macaddr_bdcfg_ethaddr 0>;
+	nvmem-cell-names = "calibration", "mac-address";
+};
diff --git a/target/linux/ath79/dts/qca9563_dlink_dir-869-a1.dts b/target/linux/ath79/dts/qca9563_dlink_dir-869-a1.dts
new file mode 100644
index 00000000000000..5afe683613b42c
--- /dev/null
+++ b/target/linux/ath79/dts/qca9563_dlink_dir-869-a1.dts
@@ -0,0 +1,29 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca9563_dlink_dir-8x9-a1.dtsi"
+
+/ {
+	model = "D-Link DIR-869 A1";
+	compatible = "dlink,dir-869-a1", "qca,qca9563";
+
+	aliases {
+		led-boot = &led_power_orange;
+		led-failsafe = &led_power_orange;
+		led-running = &led_power_white;
+		led-upgrade = &led_power_orange;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power_orange: power_orange {
+			label = "orange:power";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_white: power_white {
+			label = "white:power";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
diff --git a/target/linux/ath79/dts/qca9563_dlink_dir-8x9-a1.dtsi b/target/linux/ath79/dts/qca9563_dlink_dir-8x9-a1.dtsi
new file mode 100644
index 00000000000000..3fd9790c4a2382
--- /dev/null
+++ b/target/linux/ath79/dts/qca9563_dlink_dir-8x9-a1.dtsi
@@ -0,0 +1,152 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca956x.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	keys {
+		compatible = "gpio-keys";
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+
+	ath10k: wifi@0,0 {
+		compatible = "qcom,ath10k";
+		reg = <0x0000 0 0 0 0>;
+
+		nvmem-cells = <&calibration_ath10k>, <&macaddr_devdata_94>;
+		nvmem-cell-names = "calibration", "mac-address-ascii";
+	};
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "bootloader";
+				reg = <0x000000 0x040000>;
+				read-only;
+			};
+
+			bdcfg: partition@40000 {
+				compatible = "u-boot,env";
+				label = "bdcfg";
+				reg = <0x040000 0x010000>;
+			};
+
+			partition@50000 {
+				label = "devdata";
+				reg = <0x050000 0x010000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_devdata_94: macaddr@94 {
+					reg = <0x94 0x11>;
+				};
+
+				macaddr_devdata_b0: macaddr@b0 {
+					reg = <0xb0 0x11>;
+				};
+			};
+
+			partition@60000 {
+				label = "devconf";
+				reg = <0x060000 0x010000>;
+				read-only;
+			};
+
+			partition@70000 {
+				compatible = "seama";
+				label = "firmware";
+				reg = <0x070000 0xf80000>;
+			};
+
+			partition@ff0000 {
+				label = "art";
+				reg = <0xff0000 0x010000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				calibration_ath9k: calibration@1000 {
+					reg = <0x1000 0x440>;
+				};
+
+				calibration_ath10k: calibration@5000 {
+					reg = <0x5000 0x844>;
+				};	
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		phy-mode = "sgmii";
+		qca,mib-poll-interval = <500>;
+
+		reset-gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+
+		qca,ar8327-initvals = <
+			0x04 0x00080080 /* PORT0 PAD MODE CTRL */
+			0x10 0x81000080 /* POWER_ON_STRAP */
+			0x50 0xcc35cc35 /* LED_CTRL0 */
+			0x54 0xcb37cb37 /* LED_CTRL1 */
+			0x58 0x00000000 /* LED_CTRL2 */
+			0x5c 0x00f3cf00 /* LED_CTRL3 */
+			0x7c 0x0000007e /* PORT0_STATUS */
+			>;
+	};
+};
+
+&eth0 {
+	status = "okay";
+
+	pll-data = <0x03000101 0x00000101 0x00001919>;
+
+	phy-mode = "sgmii";
+	phy-handle = <&phy0>;
+};
+
+&wmac {
+	status = "okay";
+
+	nvmem-cells = <&calibration_ath9k>, <&macaddr_devdata_b0>;
+	nvmem-cell-names = "calibration", "mac-address-ascii";
+};
diff --git a/target/linux/ath79/dts/qca9563_elecom_wrc-1750ghbk2-i.dts b/target/linux/ath79/dts/qca9563_elecom_wrc-1750ghbk2-i.dts
index 510b577d190df3..f7358891b04824 100644
--- a/target/linux/ath79/dts/qca9563_elecom_wrc-1750ghbk2-i.dts
+++ b/target/linux/ath79/dts/qca9563_elecom_wrc-1750ghbk2-i.dts
@@ -44,11 +44,34 @@
 		label = "art";
 		reg = <0xff0000 0x010000>;
 		read-only;
+
+		compatible = "nvmem-cells";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		cal_art_1000: cal@1000 {
+			reg = <0x1000 0x440>;
+		};
+
+		macaddr_art_1002: macaddr@1002 {
+			reg = <0x1002 0x6>;
+		};
+
+		cal_art_5000: cal@5000 {
+			reg = <0x5000 0x844>;
+		};
 	};
 };
 
 &pcie {
 	status = "okay";
+
+	wifi@0,0 {
+		compatible = "qcom,ath10k";
+		reg = <0x0 0 0 0 0>;
+		nvmem-cells = <&cal_art_5000>;
+		nvmem-cell-names = "calibration";
+	};
 };
 
 &eth0 {
@@ -58,15 +81,6 @@
 };
 
 &wmac {
-	mtd-cal-data = <&art 0x1000>;
-};
-
-&art {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_art_1002: macaddr@1002 {
-		reg = <0x1002 0x6>;
-	};
+	nvmem-cells = <&cal_art_1000>;
+	nvmem-cell-names = "calibration";
 };
diff --git a/target/linux/ath79/dts/qca9563_elecom_wrc-300ghbk2-i.dts b/target/linux/ath79/dts/qca9563_elecom_wrc-300ghbk2-i.dts
index 28ffce643456e6..5ffff57b482313 100644
--- a/target/linux/ath79/dts/qca9563_elecom_wrc-300ghbk2-i.dts
+++ b/target/linux/ath79/dts/qca9563_elecom_wrc-300ghbk2-i.dts
@@ -38,6 +38,18 @@
 		label = "art";
 		reg = <0x7f0000 0x010000>;
 		read-only;
+
+		compatible = "nvmem-cells";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		cal_art_1000: cal@1000 {
+			reg = <0x1000 0x440>;
+		};
+
+		macaddr_art_1002: macaddr@1002 {
+			reg = <0x1002 0x6>;
+		};
 	};
 };
 
@@ -48,15 +60,6 @@
 };
 
 &wmac {
-	mtd-cal-data = <&art 0x1000>;
-};
-
-&art {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_art_1002: macaddr@1002 {
-		reg = <0x1002 0x6>;
-	};
+	nvmem-cells = <&cal_art_1000>;
+	nvmem-cell-names = "calibration";
 };
diff --git a/target/linux/ath79/dts/qca9563_glinet_gl-x1200-nor-nand.dts b/target/linux/ath79/dts/qca9563_glinet_gl-x1200-nor-nand.dts
new file mode 100644
index 00000000000000..2a26d959c99da2
--- /dev/null
+++ b/target/linux/ath79/dts/qca9563_glinet_gl-x1200-nor-nand.dts
@@ -0,0 +1,29 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca9563_glinet_gl-x1200.dtsi"
+
+/ {
+	compatible = "glinet,gl-x1200-nor-nand", "qca,qca9563";
+	model = "GL.iNet GL-X1200 (NOR/NAND)";
+};
+
+&nor_partitions {
+	partition@60000 {
+		label = "kernel";
+		reg = <0x060000 0x400000>;
+
+		/*
+		 * U-Boot bootcmd is "bootm 0x9f060000".
+		 * So this might be possible to resize in the future.
+		 */
+	};
+
+	partition@460000 {
+		label = "nor_reserved";
+		reg = <0x460000 0xba0000>;
+	};
+};
+
+&nand_ubi {
+	label = "ubi";
+};
diff --git a/target/linux/ath79/dts/qca9563_glinet_gl-x1200-nor.dts b/target/linux/ath79/dts/qca9563_glinet_gl-x1200-nor.dts
new file mode 100644
index 00000000000000..dfce3818b0ef2b
--- /dev/null
+++ b/target/linux/ath79/dts/qca9563_glinet_gl-x1200-nor.dts
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca9563_glinet_gl-x1200.dtsi"
+
+/ {
+	compatible = "glinet,gl-x1200-nor", "qca,qca9563";
+	model = "GL.iNet GL-X1200 (NOR)";
+};
+
+&nor_partitions {
+	partition@60000 {
+		compatible = "denx,uimage";
+		label = "firmware";
+		reg = <0x060000 0xfa0000>;
+	};
+};
diff --git a/target/linux/ath79/dts/qca9563_glinet_gl-x1200.dtsi b/target/linux/ath79/dts/qca9563_glinet_gl-x1200.dtsi
new file mode 100644
index 00000000000000..8980f772e7459c
--- /dev/null
+++ b/target/linux/ath79/dts/qca9563_glinet_gl-x1200.dtsi
@@ -0,0 +1,209 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca956x.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	aliases {
+		led-boot = &led_system;
+		led-failsafe = &led_system;
+		led-running = &led_system;
+		led-upgrade = &led_system;
+		label-mac-device = &eth0;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&jtag_disable_pins>;
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_system: system {
+			label = "red:system";
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+			default-state = "keep";
+		};
+
+		wlan2g {
+			label = "green:wlan2g";
+			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		wlan5g {
+			label = "green:wlan5g";
+			gpios = <&gpio 20 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy0tpt";
+		};
+	};
+
+	gpio-export {
+		compatible = "gpio-export";
+
+		gpio_modem1_power {
+			gpio-export,name = "gl-x1200:4g1:power";
+			gpio-export,output = <0>;
+			gpios = <&gpio 5 GPIO_ACTIVE_LOW>;
+		};
+
+		gpio_modem2_power {
+			gpio-export,name = "gl-x1200:4g2:power";
+			gpio-export,output = <0>;
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		nor_partitions: partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x040000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "u-boot-env";
+				reg = <0x040000 0x010000>;
+			};
+
+			partition@50000 {
+				label = "art";
+				reg = <0x050000 0x010000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				calibration_ath9k: calibration@1000 {
+					reg = <0x1000 0x440>;
+				};
+
+				calibration_ath10k: calibration@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+
+				macaddr_art_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_art_1002: macaddr@1002 {
+					reg = <0x1002 0x6>;
+				};
+
+				macaddr_art_5006: macaddr@5006 {
+					reg = <0x5006 0x6>;
+				};
+			};
+
+			/* Firmware / Kernel flash type specific */
+		};
+	};
+
+	flash@1 {
+		compatible = "spi-nand";
+		reg = <1>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			nand_ubi: partition@0 {
+				label = "nand_ubi";
+				reg = <0x000000 0x8000000>;
+			};
+		};
+	};
+};
+
+&eth0 {
+	status = "okay";
+
+	phy-handle = <&phy0>;
+
+	nvmem-cells = <&macaddr_art_0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gpio {
+	usb_vbus {
+		gpio-hog;
+		gpios = <7 GPIO_ACTIVE_HIGH>;
+		output-high;
+		line-name = "usb-vbus";
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		phy-mode = "sgmii";
+		qca,ar8327-initvals = <
+			0x04 0x00080080 /* PORT0 PAD MODE CTRL */
+			0x7c 0x0000007e /* PORT0_STATUS */
+		>;
+	};
+};
+
+&pcie {
+	status = "okay";
+
+	wifi@0,0 {
+		compatible = "qcom,ath10k";
+		reg = <0 0 0 0 0>;
+
+		nvmem-cells = <&macaddr_art_5006>, <&calibration_ath10k>;
+		nvmem-cell-names = "mac-address", "pre-calibration";
+	};
+};
+
+&usb0 {
+	status = "okay";
+};
+
+&usb1 {
+	status = "okay";
+};
+
+&usb_phy0 {
+	status = "okay";
+};
+
+&usb_phy1 {
+	status = "okay";
+};
+
+&wmac {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_art_1002>, <&calibration_ath9k>;
+	nvmem-cell-names = "mac-address", "calibration";
+};
diff --git a/target/linux/ath79/dts/qca9563_netgear_wndr.dtsi b/target/linux/ath79/dts/qca9563_netgear_wndr.dtsi
index 0fdabb6f19c290..a51fb1964b0432 100644
--- a/target/linux/ath79/dts/qca9563_netgear_wndr.dtsi
+++ b/target/linux/ath79/dts/qca9563_netgear_wndr.dtsi
@@ -209,9 +209,8 @@
 &wmac {
 	status = "okay";
 
-	nvmem-cells = <&macaddr_caldata_0>;
-	nvmem-cell-names = "mac-address";
-	qca,no-eeprom;
+	nvmem-cells = <&macaddr_caldata_0>, <&cal_art_1000>;
+	nvmem-cell-names = "mac-address", "calibration";
 };
 
 &pcie {
@@ -221,9 +220,8 @@
 		/* chip is AR9580, override bogus PCI ID 168c:abcd */
 		compatible = "pci168c,0033";
 		reg = <0x0000 0 0 0 0>;
-		nvmem-cells = <&macaddr_caldata_c>;
-		nvmem-cell-names = "mac-address";
-		qca,no-eeprom;
+		nvmem-cells = <&macaddr_caldata_c>, <&cal_art_5000>;
+		nvmem-cell-names = "mac-address", "calibration";
 		qca,gpio-mask=<0xf6ff>;	/* unmask pin 9 for RFKILL button */
 		#gpio-cells = <2>;
 		gpio-controller;
@@ -235,14 +233,7 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port0: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &caldata {
@@ -257,4 +248,12 @@
 	macaddr_caldata_c: macaddr@c {
 		reg = <0xc 0x6>;
 	};
+
+	cal_art_1000: cal@1000 {
+		reg = <0x1000 0x440>;
+	};
+
+	cal_art_5000: cal@5000 {
+		reg = <0x5000 0x440>;
+	};
 };
diff --git a/target/linux/ath79/dts/qca9563_netgear_wndr4500-v3.dts b/target/linux/ath79/dts/qca9563_netgear_wndr4500-v3.dts
index 6e25215501c599..4c33c0197ffd56 100644
--- a/target/linux/ath79/dts/qca9563_netgear_wndr4500-v3.dts
+++ b/target/linux/ath79/dts/qca9563_netgear_wndr4500-v3.dts
@@ -28,12 +28,5 @@
 };
 
 &usb1 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port1: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
diff --git a/target/linux/ath79/dts/qca9563_qxwlan_e1700ac.dtsi b/target/linux/ath79/dts/qca9563_qxwlan_e1700ac.dtsi
index 8902e1726ccc86..c6c610dbee2749 100644
--- a/target/linux/ath79/dts/qca9563_qxwlan_e1700ac.dtsi
+++ b/target/linux/ath79/dts/qca9563_qxwlan_e1700ac.dtsi
@@ -125,14 +125,7 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port0: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy1 {
diff --git a/target/linux/ath79/dts/qca9563_rosinson_wr818.dts b/target/linux/ath79/dts/qca9563_rosinson_wr818.dts
index c80e1c9d7ad434..c73d5a6e58305a 100644
--- a/target/linux/ath79/dts/qca9563_rosinson_wr818.dts
+++ b/target/linux/ath79/dts/qca9563_rosinson_wr818.dts
@@ -123,14 +123,7 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy1 {
@@ -138,14 +131,7 @@
 };
 
 &usb1 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	port@2 {
-		reg = <2>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &info {
diff --git a/target/linux/ath79/dts/qca9563_tplink_archer-c7-v4.dts b/target/linux/ath79/dts/qca9563_tplink_archer-c7-v4.dts
index 2fdce55d0e7539..3c6b8c4fb9468a 100644
--- a/target/linux/ath79/dts/qca9563_tplink_archer-c7-v4.dts
+++ b/target/linux/ath79/dts/qca9563_tplink_archer-c7-v4.dts
@@ -152,14 +152,7 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port0: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &usb_phy1 {
@@ -167,14 +160,7 @@
 };
 
 &usb1 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port1: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &spi {
diff --git a/target/linux/ath79/dts/qca9563_tplink_archer-x7-v5.dtsi b/target/linux/ath79/dts/qca9563_tplink_archer-x7-v5.dtsi
index fd0f10ff27e0bd..f6a959903fb916 100644
--- a/target/linux/ath79/dts/qca9563_tplink_archer-x7-v5.dtsi
+++ b/target/linux/ath79/dts/qca9563_tplink_archer-x7-v5.dtsi
@@ -108,14 +108,7 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port0: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &spi {
diff --git a/target/linux/ath79/dts/qca9563_tplink_deco-m4r-v1.dts b/target/linux/ath79/dts/qca9563_tplink_deco-m4r-v1.dts
index 4b2d80aa8271b5..8cd9004bd3fb37 100644
--- a/target/linux/ath79/dts/qca9563_tplink_deco-m4r-v1.dts
+++ b/target/linux/ath79/dts/qca9563_tplink_deco-m4r-v1.dts
@@ -24,7 +24,7 @@
 			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
 			linux,default-trigger = "phy1tpt";
 		};
-		
+
 		led_power: power {
 			label = "green:power";
 			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
@@ -41,7 +41,7 @@
 
 	keys {
 		compatible = "gpio-keys";
-		
+
 		reset {
 			label = "Reset button";
 			linux,code = <KEY_RESTART>;
@@ -83,19 +83,19 @@
 			compatible = "fixed-partitions";
 			#address-cells = <1>;
 			#size-cells = <1>;
-			
+
 			uboot: partition@0 {
 				label = "u-boot";
 				reg = <0x000000 0x080000>;
 				read-only;
 			};
-			
+
 			partition@80000 {
 				compatible = "denx,uimage";
 				label = "firmware";
 				reg = <0x080000 0xe00000>;
 			};
-			
+
 			partition@e80000 {
 				label = "product-info";
 				reg = <0xe80000 0x05000>;
@@ -107,7 +107,7 @@
 				reg = <0xe85000 0x16b000>;
 				read-only;
 			};
-			
+
 			art: partition@ff0000 {
 				label = "art";
 				reg = <0xff0000 0x010000>;
@@ -122,7 +122,7 @@
 
 	phy-mode = "sgmii";
 	phy-handle = <&phy0>;
-	
+
 	nvmem-cells = <&macaddr_config_8>;
 	nvmem-cell-names = "mac-address";
 };
diff --git a/target/linux/ath79/dts/qca9563_tplink_tl-wr1043nd-v4.dts b/target/linux/ath79/dts/qca9563_tplink_tl-wr1043nd-v4.dts
index bf01f06de69572..80a63f6efc0c6a 100644
--- a/target/linux/ath79/dts/qca9563_tplink_tl-wr1043nd-v4.dts
+++ b/target/linux/ath79/dts/qca9563_tplink_tl-wr1043nd-v4.dts
@@ -94,14 +94,7 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port0: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &eth0 {
diff --git a/target/linux/ath79/dts/qca9563_ubnt_unifiac.dtsi b/target/linux/ath79/dts/qca9563_ubnt_unifiac.dtsi
index 2e407c348642cf..6704ec983b0bee 100644
--- a/target/linux/ath79/dts/qca9563_ubnt_unifiac.dtsi
+++ b/target/linux/ath79/dts/qca9563_ubnt_unifiac.dtsi
@@ -69,17 +69,12 @@
 			};
 
 			partition@70000 {
+				/* Combine kernel0 & kernel1 */
 				label = "firmware";
-				reg = <0x070000 0x790000>;
+				reg = <0x070000 0xf20000>;
 				compatible = "denx,uimage";
 			};
 
-			partition@800000 {
-				label = "kernel1";
-				reg = <0x800000 0x790000>;
-				read-only;
-			};
-
 			partition@f90000 {
 				label = "bs";
 				reg = <0xf90000 0x020000>;
diff --git a/target/linux/ath79/dts/qca9563_zte_mf281.dts b/target/linux/ath79/dts/qca9563_zte_mf281.dts
index 2f4b7316bf919e..9205061e2432bf 100644
--- a/target/linux/ath79/dts/qca9563_zte_mf281.dts
+++ b/target/linux/ath79/dts/qca9563_zte_mf281.dts
@@ -3,246 +3,157 @@
 // Copyright (c) 2021, 2022 Lech Perczak
 // Copyright (c) 2022 David Bauer <mail@david-bauer.net>
 
-#include "qca956x.dtsi"
-
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
-#include <dt-bindings/leds/common.h>
+#include "qca9563_zte_mf28x.dtsi"
 
 / {
 	model = "ZTE MF281";
 	compatible = "zte,mf281", "qca,qca9563";
 
-	aliases {
-		led-boot = &led_debug;
-		led-failsafe = &led_debug;
-		led-running = &led_debug;
-		led-upgrade = &led_debug;
-		label-mac-device = &eth0;
-	};
-
 	leds {
-		compatible = "gpio-leds";
 		pinctrl-names = "default";
 		pinctrl-0 = <&enable_wlan_led_gpio>;
-
-		/* Hidden SMD LED below signal strength LEDs.
-		 * Visible through slits underside of the case.
-		 */
-		led_debug: debug {
-			label = "green:debug";
-			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
-			default-state = "on";
-		};
 	};
+};
 
-	keys {
-		compatible = "gpio-keys";
+&led_debug {
+	label = "green:debug";
+	color = <LED_COLOR_ID_GREEN>;
+};
 
-		reset {
-			label = "reset";
-			linux,code = <KEY_RESTART>;
-			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
-			debounce-interval = <60>;
+&boot_flash {
+	partitions {
+		partition@0 {
+			label = "u-boot";
+			reg = <0x0 0xa0000>;
+			read-only;
 		};
 
-		wps {
-			label = "wps";
-			linux,code = <KEY_WPS_BUTTON>;
-			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
-			debounce-interval = <60>;
+		partition@80000 {
+			label = "u-boot-env";
+			reg = <0xa0000 0x20000>;
+			read-only;
 		};
 	};
-
-	/* This GPIO is used to reset whole board _including_ the modem */
-	gpio-restart {
-		compatible = "gpio-restart";
-		gpios = <&gpio 5 GPIO_ACTIVE_HIGH>;
-		active-delay = <3000>;
-		inactive-delay = <1000>;
-	};
 };
 
-&spi {
-	status = "okay";
+&system_flash {
+	partitions {
+		partition@0 {
+			label = "fota-flag";
+			reg = <0x000000 0xa0000>;
+			read-only;
+		};
 
-	flash@0 {
-		compatible = "jedec,spi-nor";
-		reg = <0>;
-		spi-max-frequency = <25000000>;
+		partition@a0000 {
+			label = "art";
+			reg = <0xa0000 0x80000>;
+			read-only;
 
-		partitions {
-			compatible = "fixed-partitions";
+			compatible = "nvmem-cells";
 			#address-cells = <1>;
 			#size-cells = <1>;
 
-			partition@0 {
-				label = "u-boot";
-				reg = <0x0 0xa0000>;
-				read-only;
+			cal_caldata_1000: cal@1000 {
+				reg = <0x1000 0x440>;
 			};
 
-			partition@80000 {
-				label = "u-boot-env";
-				reg = <0xa0000 0x20000>;
-				read-only;
+			cal_caldata_5000: cal@5000 {
+				reg = <0x5000 0x2f20>;
 			};
 		};
-	};
 
-	flash@1 {
-		compatible = "spi-nand";
-		reg = <1>;
-		spi-max-frequency = <25000000>;
+		partition@120000 {
+			label = "mac";
+			reg = <0x120000 0x80000>;
+			read-only;
 
-		partitions {
-			compatible = "fixed-partitions";
+			compatible = "nvmem-cells";
 			#address-cells = <1>;
 			#size-cells = <1>;
 
-			partition@0 {
-				label = "fota-flag";
-				reg = <0x000000 0xa0000>;
-				read-only;
-			};
-
-			partition@a0000 {
-				label = "art";
-				reg = <0xa0000 0x80000>;
-				read-only;
-
-				compatible = "nvmem-cells";
-				#address-cells = <1>;
-				#size-cells = <1>;
-
-				cal_caldata_1000: cal@1000 {
-					reg = <0x1000 0x440>;
-				};
-
-				cal_caldata_5000: cal@5000 {
-					reg = <0x5000 0x2f20>;
-				};
-			};
-
-			partition@120000 {
-				label = "mac";
-				reg = <0x120000 0x80000>;
-				read-only;
-
-				compatible = "nvmem-cells";
-				#address-cells = <1>;
-				#size-cells = <1>;
-
-				macaddr_mac_0: macaddr@0 {
-					reg = <0x0 0x6>;
-				};
-			};
-
-			partition@1a0000 {
-				label = "reserved2";
-				reg = <0x1a0000 0xc0000>;
-				read-only;
-			};
-
-			partition@260000 {
-				label = "cfg-param";
-				reg = <0x260000 0x400000>;
-				read-only;
+			macaddr_mac_0: macaddr@0 {
+				reg = <0x0 0x6>;
 			};
+		};
 
-			partition@660000 {
-				label = "log";
-				reg = <0x660000 0x400000>;
-				read-only;
-			};
+		partition@1a0000 {
+			label = "reserved2";
+			reg = <0x1a0000 0xc0000>;
+			read-only;
+		};
 
-			partition@a60000 {
-				label = "oops";
-				reg = <0xa60000 0xa0000>;
-				read-only;
-			};
+		partition@260000 {
+			label = "cfg-param";
+			reg = <0x260000 0x400000>;
+			read-only;
+		};
 
-			partition@b00000 {
-				label = "reserved3";
-				reg = <0xb00000 0x500000>;
-				read-only;
-			};
+		partition@660000 {
+			label = "log";
+			reg = <0x660000 0x400000>;
+			read-only;
+		};
 
-			partition@1000000 {
-				label = "web";
-				reg = <0x1000000 0x800000>;
-				read-only;
-			};
+		partition@a60000 {
+			label = "oops";
+			reg = <0xa60000 0xa0000>;
+			read-only;
+		};
 
-			partition@1800000 {
-				label = "firmware";
-				reg = <0x1800000 0x1d00000>;
+		partition@b00000 {
+			label = "reserved3";
+			reg = <0xb00000 0x500000>;
+			read-only;
+		};
 
-				compatible = "fixed-partitions";
-				#address-cells = <1>;
-				#size-cells = <1>;
+		partition@1000000 {
+			label = "web";
+			reg = <0x1000000 0x800000>;
+			read-only;
+		};
 
-				partition@0 {
-					label = "kernel";
-					reg = <0x0 0x600000>;
-				};
+		partition@1800000 {
+			label = "firmware";
+			reg = <0x1800000 0x1d00000>;
 
-				partition@600000 {
-					label = "ubi";
-					reg = <0x600000 0x1700000>;
-				};
-			};
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
 
-			partition@3500000 {
-				label = "data";
-				reg = <0x3500000 0x1900000>;
-				read-only;
+			partition@0 {
+				label = "kernel";
+				reg = <0x0 0x600000>;
 			};
 
-			partition@4e00000 {
-				label = "fota";
-				reg = <0x4e00000 0x3200000>;
-				read-only;
+			partition@600000 {
+				label = "ubi";
+				reg = <0x600000 0x1700000>;
 			};
 		};
-	};
-};
 
-&mdio0 {
-	status = "okay";
-
-	phy0: ethernet-phy@0 {
-		reg = <0>;
-		phy-mode = "sgmii";
+		partition@3500000 {
+			label = "data";
+			reg = <0x3500000 0x1900000>;
+			read-only;
+		};
 
-		qca,ar8327-initvals = <
-			0x04 0x00080080 /* PORT0 PAD MODE CTRL */
-			0x7c 0x0000007e /* PORT0_STATUS */
-		>;
+		partition@4e00000 {
+			label = "fota";
+			reg = <0x4e00000 0x3200000>;
+			read-only;
+		};
 	};
 };
 
 &eth0 {
-	status = "okay";
-
-	phy-mode = "sgmii";
-	phy-handle = <&phy0>;
-
 	nvmem-cells = <&macaddr_mac_0>;
 	nvmem-cell-names = "mac-address";
 };
 
-&pcie {
-	status = "okay";
-
-	wifi@0,0 {
-		compatible = "qcom,ath10k";
-		reg = <0x0 0 0 0 0>;
-
-		nvmem-cells = <&macaddr_mac_0>, <&cal_caldata_5000>;
-		nvmem-cell-names = "mac-address", "pre-calibration";
-		mac-address-increment = <1>;
-	};
+&wifi_ath10k {
+	nvmem-cells = <&macaddr_mac_0>, <&cal_caldata_5000>;
+	nvmem-cell-names = "mac-address", "pre-calibration";
+	mac-address-increment = <1>;
 };
 
 &pinmux {
@@ -252,24 +163,6 @@
 };
 
 &wmac {
-	status = "okay";
-
 	nvmem-cells = <&macaddr_mac_0>, <&cal_caldata_1000>;
 	nvmem-cell-names = "mac-address", "calibration";
 };
-
-&usb_phy0 {
-	status = "okay";
-};
-
-&usb0 {
-	status = "okay";
-};
-
-&usb_phy1 {
-	status = "okay";
-};
-
-&usb1 {
-	status = "okay";
-};
diff --git a/target/linux/ath79/dts/qca9563_zte_mf282.dts b/target/linux/ath79/dts/qca9563_zte_mf282.dts
new file mode 100644
index 00000000000000..1f3038dacedce8
--- /dev/null
+++ b/target/linux/ath79/dts/qca9563_zte_mf282.dts
@@ -0,0 +1,129 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+// Copyright (c) 2021 Cezary Jackiewicz
+// Copyright (c) 2021, 2022 Lech Perczak
+// Copyright (c) 2022 David Bauer <mail@david-bauer.net>
+// Copyright (c) 2023 Andreas Böhler <dev@aboehler.at>
+
+#include "qca9563_zte_mf28x.dtsi"
+
+/ {
+	model = "ZTE MF282";
+	compatible = "zte,mf282", "qca,qca9563";
+
+	ubi-concat {
+		compatible = "mtd-concat";
+		devices = <&ubiconcat0 &ubiconcat1>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				reg = <0x0 0x7440000>;
+				label = "ubi";
+			};
+		};
+	};
+};
+
+&led_debug {
+	label = "blue:debug";
+	color = <LED_COLOR_ID_BLUE>;
+};
+
+&boot_flash {
+	partitions {
+		partition@0 {
+			label = "u-boot";
+			reg = <0x0 0x80000>;
+			read-only;
+		};
+
+		partition@80000 {
+			label = "u-boot-env";
+			reg = <0x80000 0x20000>;
+			read-only;
+		};
+	};
+};
+
+&system_flash {
+	partitions {
+		partition@0 {
+			label = "fota-flag";
+			reg = <0x000000 0x140000>;
+			read-only;
+		};
+
+		partition@140000 {
+			label = "caldata";
+			reg = <0x140000 0x140000>;
+			read-only;
+
+			compatible = "nvmem-cells";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			cal_caldata_1000: cal@1000 {
+				reg = <0x1000 0x440>;
+			};
+
+			cal_caldata_5000: cal@5000 {
+				reg = <0x5000 0x844>;
+			};
+		};
+
+		partition@280000 {
+			label = "mac";
+			reg = <0x280000 0x140000>;
+			read-only;
+
+			compatible = "nvmem-cells";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			macaddr_mac_0: macaddr@0 {
+				reg = <0x0 0x6>;
+			};
+		};
+
+		/* This encompasses stock cfg-param, oops, web partitions,
+		 * which can be overwritten safely
+		 */
+		ubiconcat0: partition@3c0000 {
+			label = "ubiconcat0";
+			reg = <0x3c0000 0xf40000>;
+		};
+
+		/* Kernel MTD size is increased to 8MB from stock 3MB */
+		partition@1300000 {
+			label = "kernel";
+			reg = <0x1300000 0x800000>;
+		};
+
+		/* This encompasses stock rootfs, data, fota partitions,
+		 * which can be overwritten safely
+		 */
+		ubiconcat1: partition@1b00000 {
+			label = "ubiconcat1";
+			reg = <0x1b00000 0x6500000>;
+		};
+	};
+};
+
+&eth0 {
+	nvmem-cells = <&macaddr_mac_0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&wifi_ath10k {
+	nvmem-cells = <&macaddr_mac_0>, <&cal_caldata_5000>;
+	nvmem-cell-names = "mac-address", "calibration";
+	mac-address-increment = <1>;
+};
+
+&wmac {
+	nvmem-cells = <&macaddr_mac_0>, <&cal_caldata_1000>;
+	nvmem-cell-names = "mac-address", "calibration";
+};
diff --git a/target/linux/ath79/dts/qca9563_zte_mf286.dts b/target/linux/ath79/dts/qca9563_zte_mf286.dts
index 2e528a6b97106e..877075c7699780 100644
--- a/target/linux/ath79/dts/qca9563_zte_mf286.dts
+++ b/target/linux/ath79/dts/qca9563_zte_mf286.dts
@@ -119,8 +119,8 @@
 };
 
 &wifi_ath10k {
-	nvmem-cells = <&macaddr_mac_0>, <&cal_caldata_5000>;
-	nvmem-cell-names = "mac-address", "calibration";
+	nvmem-cells = <&macaddr_mac_0>, <&cal_caldata_5000>, <&cal_caldata_5000>;
+	nvmem-cell-names = "mac-address", "calibration", "pre-calibration";
 	mac-address-increment = <1>;
 };
 
diff --git a/target/linux/ath79/dts/qca9563_zte_mf286.dtsi b/target/linux/ath79/dts/qca9563_zte_mf286.dtsi
index f794195c3f0f91..df9a9d3f6989f9 100644
--- a/target/linux/ath79/dts/qca9563_zte_mf286.dtsi
+++ b/target/linux/ath79/dts/qca9563_zte_mf286.dtsi
@@ -1,36 +1,13 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 // Copyright (c) 2021 Cezary Jackiewicz
 // Copyright (c) 2021, 2022 Lech Perczak
-#include "qca956x.dtsi"
-
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
-#include <dt-bindings/leds/common.h>
+#include "qca9563_zte_mf28x.dtsi"
 
 / {
-	aliases {
-		led-boot = &led_debug;
-		led-failsafe = &led_debug;
-		led-running = &led_debug;
-		led-upgrade = &led_debug;
-		label-mac-device = &eth0;
-	};
-
 	leds {
-		compatible = "gpio-leds";
 		pinctrl-names = "default";
 		pinctrl-0 = <&enable_wlan_led_gpio>;
 
-		/* Hidden SMD LED below signal strength LEDs.
-		 * Visible through slits underside of the case,
-		 * and slightly through the case below signal state LEDs
-		 */
-		led_debug: led-0 {
-			function = LED_FUNCTION_DEBUG;
-			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
-			default-state = "on";
-		};
-
 		led-1 {
 			function = LED_FUNCTION_WLAN;
 			color = <LED_COLOR_ID_BLUE>;
@@ -40,22 +17,6 @@
 	};
 
 	keys {
-		compatible = "gpio-keys";
-
-		reset {
-			label = "reset";
-			linux,code = <KEY_RESTART>;
-			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
-			debounce-interval = <60>;
-		};
-
-		wps {
-			label = "wps";
-			linux,code = <KEY_WPS_BUTTON>;
-			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
-			debounce-interval = <60>;
-		};
-
 		wifi {
 			label = "wifi";
 			linux,code = <KEY_RFKILL>;
@@ -63,72 +24,6 @@
 			debounce-interval = <60>;
 		};
 	};
-
-	/* This GPIO is used to reset whole board _including_ the modem */
-	gpio-restart {
-		compatible = "gpio-restart";
-		gpios = <&gpio 5 GPIO_ACTIVE_HIGH>;
-		active-delay = <3000>;
-		inactive-delay = <1000>;
-	};
-};
-
-&spi {
-	status = "okay";
-
-	boot_flash: flash@0 {
-		compatible = "jedec,spi-nor";
-		reg = <0>;
-		spi-max-frequency = <25000000>;
-
-		partitions {
-			compatible = "fixed-partitions";
-			#address-cells = <1>;
-			#size-cells = <1>;
-		};
-	};
-
-	system_flash: flash@1 {
-		compatible = "spi-nand";
-		reg = <1>;
-		spi-max-frequency = <25000000>;
-
-		partitions {
-			compatible = "fixed-partitions";
-			#address-cells = <1>;
-			#size-cells = <1>;
-		};
-	};
-};
-
-&mdio0 {
-	status = "okay";
-
-	phy0: ethernet-phy@0 {
-		reg = <0>;
-		phy-mode = "sgmii";
-
-		qca,ar8327-initvals = <
-			0x04 0x00080080 /* PORT0 PAD MODE CTRL */
-			0x7c 0x0000007e /* PORT0_STATUS */
-		>;
-	};
-};
-
-&eth0 {
-	status = "okay";
-
-	phy-mode = "sgmii";
-	phy-handle = <&phy0>;
-};
-
-&pcie {
-	status = "okay";
-
-	wifi_ath10k: wifi@0,0 {
-		compatible = "qcom,ath10k";
-		reg = <0x0 0 0 0 0>;
-	};
 };
 
 &pinmux {
@@ -136,23 +31,3 @@
 		pinctrl-single,bits = <0x10 0x0 0xff000000>;
 	};
 };
-
-&wmac {
-	status = "okay";
-};
-
-&usb_phy0 {
-	status = "okay";
-};
-
-&usb0 {
-	status = "okay";
-};
-
-&usb_phy1 {
-	status = "okay";
-};
-
-&usb1 {
-	status = "okay";
-};
diff --git a/target/linux/ath79/dts/qca9563_zte_mf28x.dtsi b/target/linux/ath79/dts/qca9563_zte_mf28x.dtsi
new file mode 100644
index 00000000000000..1edcd7e5ea68ee
--- /dev/null
+++ b/target/linux/ath79/dts/qca9563_zte_mf28x.dtsi
@@ -0,0 +1,136 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+// Copyright (c) 2021 Cezary Jackiewicz
+// Copyright (c) 2021, 2022 Lech Perczak
+#include "qca956x.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	aliases {
+		led-boot = &led_debug;
+		led-failsafe = &led_debug;
+		led-running = &led_debug;
+		led-upgrade = &led_debug;
+		label-mac-device = &eth0;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		/* Hidden SMD LED below signal strength LEDs.
+		 * Visible through slits underside of the case,
+		 * and slightly through the case below signal state LEDs
+		 */
+		led_debug: led-0 {
+			function = LED_FUNCTION_DEBUG;
+			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+
+	/* This GPIO is used to reset whole board _including_ the modem */
+	gpio-restart {
+		compatible = "gpio-restart";
+		gpios = <&gpio 5 GPIO_ACTIVE_HIGH>;
+		active-delay = <3000>;
+		inactive-delay = <1000>;
+	};
+};
+
+&spi {
+	status = "okay";
+
+	boot_flash: flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+		};
+	};
+
+	system_flash: flash@1 {
+		compatible = "spi-nand";
+		reg = <1>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		phy-mode = "sgmii";
+
+		qca,ar8327-initvals = <
+			0x04 0x00080080 /* PORT0 PAD MODE CTRL */
+			0x7c 0x0000007e /* PORT0_STATUS */
+		>;
+	};
+};
+
+&eth0 {
+	status = "okay";
+
+	phy-mode = "sgmii";
+	phy-handle = <&phy0>;
+};
+
+&pcie {
+	status = "okay";
+
+	wifi_ath10k: wifi@0,0 {
+		compatible = "qcom,ath10k";
+		reg = <0x0 0 0 0 0>;
+	};
+};
+
+&wmac {
+	status = "okay";
+};
+
+&usb_phy0 {
+	status = "okay";
+};
+
+&usb0 {
+	status = "okay";
+};
+
+&usb_phy1 {
+	status = "okay";
+};
+
+&usb1 {
+	status = "okay";
+};
diff --git a/target/linux/ath79/dts/qca956x.dtsi b/target/linux/ath79/dts/qca956x.dtsi
index f2452e9dc7e8dc..e46f0676e282fb 100644
--- a/target/linux/ath79/dts/qca956x.dtsi
+++ b/target/linux/ath79/dts/qca956x.dtsi
@@ -95,6 +95,7 @@
 				clock-output-names = "cpu", "ddr", "ahb";
 
 				clocks = <&extosc>;
+				clock-names = "ref";
 			};
 
 			wdt: wdt@18060008 {
@@ -203,6 +204,11 @@
 
 			#address-cells = <1>;
 			#size-cells = <0>;
+
+			hub_port0: port@1 {
+				reg = <1>;
+				#trigger-source-cells = <0>;
+			};
 		};
 
 		usb1: usb@1b400000 {
@@ -225,6 +231,11 @@
 
 			#address-cells = <1>;
 			#size-cells = <0>;
+
+			hub_port1: port@1 {
+				reg = <1>;
+				#trigger-source-cells = <0>;
+			};
 		};
 
 		spi: spi@1f000000 {
diff --git a/target/linux/ath79/dts/qcn5502_netgear_ex7300-v2.dts b/target/linux/ath79/dts/qcn5502_netgear_ex7300-v2.dts
index e5d897029dd540..4ebbdcc1054d24 100644
--- a/target/linux/ath79/dts/qcn5502_netgear_ex7300-v2.dts
+++ b/target/linux/ath79/dts/qcn5502_netgear_ex7300-v2.dts
@@ -124,10 +124,6 @@
 	};
 };
 
-&pll {
-	clocks = <&extosc>;
-};
-
 &spi {
 	status = "okay";
 
diff --git a/target/linux/ath79/dts/qcn5502_tplink_archer-a9-v6.dts b/target/linux/ath79/dts/qcn5502_tplink_archer-a9-v6.dts
index 9af119b560536e..ef0ea321e07ed4 100644
--- a/target/linux/ath79/dts/qcn5502_tplink_archer-a9-v6.dts
+++ b/target/linux/ath79/dts/qcn5502_tplink_archer-a9-v6.dts
@@ -227,14 +227,7 @@
 };
 
 &usb0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
 	status = "okay";
-
-	hub_port0: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
 };
 
 &wmac {
diff --git a/target/linux/ath79/files/drivers/gpio/gpio-latch.c b/target/linux/ath79/files/drivers/gpio/gpio-latch.c
index 976e68323083a6..68f9290b2a5c64 100644
--- a/target/linux/ath79/files/drivers/gpio/gpio-latch.c
+++ b/target/linux/ath79/files/drivers/gpio/gpio-latch.c
@@ -134,7 +134,7 @@ static int gpio_latch_probe(struct platform_device *pdev)
 			GPIOD_OUT_LOW);
 		if (IS_ERR(glc->gpios[i])) {
 			if (PTR_ERR(glc->gpios[i]) != -EPROBE_DEFER) {
-				dev_err(dev, "failed to get gpio %d: %d\n", i,
+				dev_err(dev, "failed to get gpio %d: %ld\n", i,
 					PTR_ERR(glc->gpios[i]));
 			}
 			return PTR_ERR(glc->gpios[i]);
diff --git a/target/linux/ath79/files/drivers/mtd/nand/raw/ar934x_nand.c b/target/linux/ath79/files/drivers/mtd/nand/raw/ar934x_nand.c
index fafb3f56b83d40..28bdcb066d6032 100644
--- a/target/linux/ath79/files/drivers/mtd/nand/raw/ar934x_nand.c
+++ b/target/linux/ath79/files/drivers/mtd/nand/raw/ar934x_nand.c
@@ -1325,10 +1325,10 @@ static int ar934x_nfc_attach_chip(struct nand_chip *nand)
 	if (ret)
 		return ret;
 
-	if (mtd->writesize == 2048)
-		nand->options |= NAND_NO_SUBPAGE_WRITE;
-
 	if (nand->ecc.engine_type == NAND_ECC_ENGINE_TYPE_ON_HOST) {
+		if (mtd->writesize == 2048)
+			nand->options |= NAND_NO_SUBPAGE_WRITE;
+
 		ret = ar934x_nfc_setup_hwecc(nfc);
 		if (ret)
 			return ret;
diff --git a/target/linux/ath79/files/drivers/mtd/nand/raw/rb91x_nand.c b/target/linux/ath79/files/drivers/mtd/nand/raw/rb91x_nand.c
index 244fd27590337b..c502f4a06497e7 100644
--- a/target/linux/ath79/files/drivers/mtd/nand/raw/rb91x_nand.c
+++ b/target/linux/ath79/files/drivers/mtd/nand/raw/rb91x_nand.c
@@ -286,7 +286,7 @@ static int rb91x_nand_probe(struct platform_device *pdev)
 	gpios = gpiod_get_array(dev, NULL, GPIOD_OUT_LOW);
 	if (IS_ERR(gpios)) {
 		if (PTR_ERR(gpios) != -EPROBE_DEFER) {
-			dev_err(dev, "failed to get gpios: %d\n",
+			dev_err(dev, "failed to get gpios: %ld\n",
 				PTR_ERR(gpios));
 		}
 		return PTR_ERR(gpios);
diff --git a/target/linux/ath79/files/drivers/net/ethernet/atheros/ag71xx/Kconfig b/target/linux/ath79/files/drivers/net/ethernet/atheros/ag71xx/Kconfig
index 4df2d21e34b86f..dfcedcf70e853c 100644
--- a/target/linux/ath79/files/drivers/net/ethernet/atheros/ag71xx/Kconfig
+++ b/target/linux/ath79/files/drivers/net/ethernet/atheros/ag71xx/Kconfig
@@ -10,14 +10,12 @@ if AG71XX
 
 config AG71XX_DEBUG
 	bool "Atheros AR71xx built-in ethernet driver debugging"
-	default n
 	help
 	  Atheros AR71xx built-in ethernet driver debugging messages.
 
 config AG71XX_DEBUG_FS
 	bool "Atheros AR71xx built-in ethernet driver debugfs support"
 	depends on DEBUG_FS
-	default n
 	help
 	  Say Y, if you need access to various statistics provided by
 	  the ag71xx driver.
diff --git a/target/linux/ath79/files/drivers/net/ethernet/atheros/ag71xx/ag71xx.h b/target/linux/ath79/files/drivers/net/ethernet/atheros/ag71xx/ag71xx.h
index 1955cd288f3c5e..0773f1a5af0e52 100644
--- a/target/linux/ath79/files/drivers/net/ethernet/atheros/ag71xx/ag71xx.h
+++ b/target/linux/ath79/files/drivers/net/ethernet/atheros/ag71xx/ag71xx.h
@@ -65,7 +65,7 @@
 #define AG71XX_TX_RING_SIZE_DEFAULT	128
 #define AG71XX_RX_RING_SIZE_DEFAULT	256
 
-#define AG71XX_TX_RING_SIZE_MAX		128
+#define AG71XX_TX_RING_SIZE_MAX		256
 #define AG71XX_RX_RING_SIZE_MAX		256
 
 #ifdef CONFIG_AG71XX_DEBUG
diff --git a/target/linux/ath79/files/drivers/net/ethernet/atheros/ag71xx/ag71xx_main.c b/target/linux/ath79/files/drivers/net/ethernet/atheros/ag71xx/ag71xx_main.c
index d553c62401a5a6..06ebbd8ea3893f 100644
--- a/target/linux/ath79/files/drivers/net/ethernet/atheros/ag71xx/ag71xx_main.c
+++ b/target/linux/ath79/files/drivers/net/ethernet/atheros/ag71xx/ag71xx_main.c
@@ -1352,11 +1352,7 @@ static int ag71xx_rx_packets(struct ag71xx *ag, int limit)
 		dev->stats.rx_packets++;
 		dev->stats.rx_bytes += pktlen;
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5,12,0)
-		skb = build_skb(ring->buf[i].rx_buf, ag71xx_buffer_size(ag));
-#else
 		skb = napi_build_skb(ring->buf[i].rx_buf, ag71xx_buffer_size(ag));
-#endif
 		if (!skb) {
 			skb_free_frag(ring->buf[i].rx_buf);
 			goto next;
diff --git a/target/linux/ath79/generic/base-files/etc/board.d/01_leds b/target/linux/ath79/generic/base-files/etc/board.d/01_leds
index 606a194f7eb7ba..10c67991fd29ab 100644
--- a/target/linux/ath79/generic/base-files/etc/board.d/01_leds
+++ b/target/linux/ath79/generic/base-files/etc/board.d/01_leds
@@ -10,6 +10,12 @@ case "$board" in
 	ucidef_set_led_netdev "lan" "LAN" "orange:eth0" "eth0"
 	ucidef_set_led_switch "wan" "WAN" "orange:eth1" "switch0" "0x04"
 	;;
+alcatel,hh40v)
+	ucidef_set_led_netdev "lan_data" "LAN Data" "green:lan" "eth1" "tx rx"
+	ucidef_set_led_netdev "lan_link" "LAN Link" "orange:lan" "eth1" "link"
+	ucidef_set_led_netdev "wan_data" "WAN Data" "green:wan" "eth0" "tx rx"
+	ucidef_set_led_netdev "wan_link" "WAN Link" "orange:wan" "eth0" "link"
+	;;
 alfa-network,ap121f|\
 alfa-network,ap121fe|\
 avm,fritz450e|\
@@ -18,11 +24,19 @@ glinet,6416|\
 glinet,gl-ar300m-lite|\
 glinet,gl-ar300m16|\
 pcs,cap324|\
+tplink,cpe605-v1|\
 tplink,cpe610-v1|\
 tplink,cpe610-v2|\
 tplink,tl-wa1201-v2)
 	ucidef_set_led_netdev "lan" "LAN" "green:lan" "eth0"
 	;;
+tplink,tl-wdr6500-v2)
+	ucidef_set_led_netdev "wan" "WAN" "green:wan" "eth1"
+	ucidef_set_led_switch "lan1" "LAN1" "green:lan1" "switch0" "0x02"
+	ucidef_set_led_switch "lan2" "LAN2" "green:lan2" "switch0" "0x04"
+	ucidef_set_led_switch "lan3" "LAN3" "green:lan3" "switch0" "0x08"
+	ucidef_set_led_switch "lan4" "LAN4" "green:lan4" "switch0" "0x10"
+	;;
 alfa-network,n2q)
 	ucidef_set_led_netdev "lan2" "LAN2" "orange:lan2" "eth1"
 	ucidef_set_led_switch "lan1" "LAN1" "orange:lan1" "switch0" "0x10"
@@ -227,6 +241,9 @@ dlink,dap-1365-a1)
 dlink,dir-859-a1)
 	ucidef_set_led_switch "internet" "WAN" "green:internet" "switch0" "0x20"
 	;;
+dlink,dir-859-a3)
+	ucidef_set_led_switch "wan" "WAN" "green:wan" "switch0" "0x20"
+	;;
 engenius,ens202ext-v1|\
 engenius,enstationac-v1)
 	ucidef_set_rssimon "wlan0" "200000" "1"
@@ -267,6 +284,11 @@ hiwifi,hc6361)
 	ucidef_set_led_netdev "wan" "WAN" "blue:wan" "eth1"
 	ucidef_set_led_wlan "wlan" "WLAN" "blue:wlan" "phy0tpt"
 	;;
+kuwfi,c910)
+	ucidef_set_led_netdev "wan" "WAN" "white:wan" "eth1"
+	ucidef_set_led_switch "lan1" "LAN1" "white:lan1" "switch0" "0x10"
+	ucidef_set_led_switch "lan2" "LAN2" "white:lan2" "switch0" "0x02"
+	;;
 meraki,mr12|\
 tplink,cpe210-v2|\
 tplink,cpe210-v3)
@@ -327,6 +349,13 @@ qca,ap143-16m)
 qihoo,c301)
 	ucidef_set_led_wlan "wlan" "WLAN" "green:wlan" "phy0tpt"
 	;;
+ruckus,zf7025)
+	ucidef_set_led_netdev "lan" "LAN5" "green:lan5" "eth0"
+	ucidef_set_led_switch "lan1" "LAN1" "green:lan1" "switch0" "0x10"
+	ucidef_set_led_switch "lan2" "LAN2" "green:lan2" "switch0" "0x08"
+	ucidef_set_led_switch "lan3" "LAN3" "green:lan3" "switch0" "0x04"
+	ucidef_set_led_switch "lan4" "LAN4" "green:lan4" "switch0" "0x02"
+	;;
 ruckus,zf7372)
 	ucidef_set_led_switch "lan" "LAN" "green:eth1" "switch0" "0x02"
 	;;
@@ -337,6 +366,13 @@ teltonika,rut230-v1)
 	ucidef_set_led_netdev "wan" "WAN" "green:wan" "eth1"
 	ucidef_set_led_switch "lan" "LAN" "green:lan" "switch0" "0x04"
 	;;
+teltonika,rut300)
+	ucidef_set_led_netdev "wan" "WAN" "yellow:wan" "eth1"
+	ucidef_set_led_switch "lan1" "LAN1" "yellow:lan1" "switch0" "0x02"
+	ucidef_set_led_switch "lan2" "LAN2" "yellow:lan2" "switch0" "0x10"
+	ucidef_set_led_switch "lan3" "LAN3" "yellow:lan3" "switch0" "0x08"
+	ucidef_set_led_switch "lan4" "LAN4" "yellow:lan4" "switch0" "0x04"
+	;;
 tplink,archer-a7-v5|\
 tplink,archer-c7-v4|\
 tplink,archer-c7-v5)
diff --git a/target/linux/ath79/generic/base-files/etc/board.d/02_network b/target/linux/ath79/generic/base-files/etc/board.d/02_network
index a2ae5cb8de41ac..d18eddf5b74ef0 100644
--- a/target/linux/ath79/generic/base-files/etc/board.d/02_network
+++ b/target/linux/ath79/generic/base-files/etc/board.d/02_network
@@ -19,6 +19,7 @@ ath79_setup_interfaces()
 	araknis,an-700-ap-i-ac|\
 	arduino,yun|\
 	aruba,ap-105|\
+	aruba,ap-175|\
 	asus,rp-ac51|\
 	asus,rp-ac66|\
 	avm,fritz1750e|\
@@ -38,17 +39,18 @@ ath79_setup_interfaces()
 	dlink,dap-3320-a1|\
 	dlink,dir-505|\
 	engenius,eap1200h|\
+	engenius,eap1750h|\
 	engenius,eap600|\
 	engenius,ecb1200|\
 	engenius,ecb1750|\
 	engenius,ecb600|\
 	enterasys,ws-ap3705i|\
 	extreme-networks,ws-ap3805i|\
+	fortinet,fap-221-b|\
 	glinet,gl-ar300m-lite|\
 	glinet,gl-usb150|\
 	hak5,wifi-pineapple-nano|\
 	meraki,mr16|\
-	netgear,ex6400|\
 	netgear,ex7300|\
 	netgear,ex7300-v2|\
 	netgear,wndap360|\
@@ -66,6 +68,8 @@ ath79_setup_interfaces()
 	pisen,wmb001n|\
 	pisen,wmm003n|\
 	ruckus,zf7321|\
+	ruckus,zf7341|\
+	ruckus,zf7351|\
 	siemens,ws-ap3610|\
 	sophos,ap15|\
 	sophos,ap55|\
@@ -76,6 +80,7 @@ ath79_setup_interfaces()
 	tplink,cpe210-v3|\
 	tplink,cpe510-v2|\
 	tplink,cpe510-v3|\
+	tplink,cpe605-v1|\
 	tplink,cpe610-v1|\
 	tplink,cpe610-v2|\
 	tplink,cpe710-v1|\
@@ -134,7 +139,9 @@ ath79_setup_interfaces()
 	devolo,dvl1750e|\
 	engenius,enstationac-v1|\
 	engenius,ews511ap|\
+	engenius,ews660ap|\
 	ocedo,ursus|\
+	ruckus,zf7363|\
 	ruckus,zf7372|\
 	ubnt,unifi-ap-outdoor-plus)
 		ucidef_set_interface_lan "eth0 eth1"
@@ -193,9 +200,15 @@ ath79_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"0@eth0" "1:lan:4" "2:lan:3" "3:lan:2" "4:lan:1"
 		;;
+	teltonika,rut300)
+		ucidef_set_interface_wan "eth1"
+		ucidef_add_switch "switch0" \
+			"0@eth0" "1:lan:1" "2:lan:4" "3:lan:3" "4:lan:2"
+		;;
 	buffalo,wzr-hp-g300nh-rb|\
 	buffalo,wzr-hp-g300nh-s|\
-	dlink,dir-825-b1)
+	dlink,dir-825-b1|\
+	trendnet,tew-673gru)
 		ucidef_set_interface_wan "eth1"
 		ucidef_add_switch "switch0" \
 			"0:lan" "1:lan" "2:lan" "3:lan" "5@eth0"
@@ -204,6 +217,7 @@ ath79_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"0@eth0" "1:lan:1" "3:lan:4" "4:lan:3" "5:lan:2" "2:wan"
 		;;
+	alcatel,hh40v|\
 	comfast,cf-e110n-v2|\
 	comfast,cf-e120a-v3|\
 	comfast,cf-e314n-v2|\
@@ -233,7 +247,8 @@ ath79_setup_interfaces()
 	comfast,cf-e560ac|\
 	qca,ap143-8m|\
 	qca,ap143-16m|\
-	tplink,tl-wr841hp-v3)
+	tplink,tl-wr841hp-v3|\
+	tplink,tl-wdr6500-v2)
 		ucidef_set_interface_wan "eth1"
 		ucidef_add_switch "switch0" \
 			"0@eth0" "1:lan" "2:lan" "3:lan" "4:lan"
@@ -270,13 +285,19 @@ ath79_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"0@eth0" "1:lan:2" "2:lan:1"
 		;;
+	dlink,dir-629-a1|\
 	dlink,dir-825-c1|\
 	dlink,dir-835-a1|\
 	dlink,dir-842-c1|\
 	dlink,dir-842-c2|\
 	dlink,dir-842-c3|\
 	dlink,dir-859-a1|\
+	dlink,dir-859-a3|\
+	dlink,dir-869-a1|\
 	engenius,epg5000|\
+	engenius,esr1200|\
+	engenius,esr1750|\
+	engenius,esr900|\
 	sitecom,wlr-7100|\
 	tplink,archer-c2-v3|\
 	tplink,tl-wr1043nd-v4|\
@@ -339,6 +360,11 @@ ath79_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"0@eth0" "2:lan:3" "3:lan:2" "4:lan:1"
 		;;
+	kuwfi,c910)
+		ucidef_set_interface_wan "eth1"
+		ucidef_add_switch "switch0" \
+			"0@eth0" "1:lan:2" "4:lan:1"
+		;;
 	letv,lba-047-ch)
 		ucidef_set_interface_wan "eth0"
 		ucidef_add_switch "switch0" \
@@ -428,6 +454,11 @@ ath79_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"0@eth0" "1:lan" "2:lan" "3:wan"
 		;;
+	ruckus,zf7025)
+		ucidef_set_interface_lan "eth0 eth1"
+		ucidef_add_switch "switch0" \
+			"0u@eth1" "4:lan:1" "3:lan:2" "2:lan:3" "1:lan:4"
+		;;
 	teltonika,rut955|\
 	teltonika,rut955-h7v3c0)
 		ucidef_set_interface_wan "eth1"
@@ -605,7 +636,10 @@ ath79_setup_macs()
 	dlink,dap-3662-a1)
 		label_mac=$(mtd_get_mac_ascii bdcfg "wlanmac")
 		;;
-	dlink,dir-825-b1)
+	dlink,dir-629-a1)
+		wan_mac=$(mtd_get_mac_text "mfcdata" 0x6a)
+		;;
+	trendnet,tew-673gru)
 		lan_mac=$(mtd_get_mac_text "caldata" 0xffa0)
 		wan_mac=$(mtd_get_mac_text "caldata" 0xffb4)
 		label_mac=$wan_mac
@@ -615,7 +649,6 @@ ath79_setup_macs()
 		;;
 	dlink,dir-825-c1|\
 	dlink,dir-835-a1)
-		lan_mac=$(mtd_get_mac_text "mac" 0x4)
 		wan_mac=$(mtd_get_mac_text "mac" 0x18)
 		;;
 	dlink,dir-842-c1|\
@@ -626,6 +659,14 @@ ath79_setup_macs()
 		label_mac=$lan_mac
 		;;
 	dlink,dir-859-a1|\
+	dlink,dir-869-a1)
+		lan_mac=$(mtd_get_mac_text "devdata" 0xc9)
+		wan_mac=$(mtd_get_mac_text "devdata" 0x79)
+		;;
+	dlink,dir-859-a3)
+		lan_mac=$(get_mac_label)
+		wan_mac=$(macaddr_add "$lan_mac" 3)
+		;;
 	qihoo,c301|\
 	wd,mynet-n600|\
 	wd,mynet-n750)
@@ -634,14 +675,18 @@ ath79_setup_macs()
 		;;
 	elecom,wrc-1750ghbk2-i|\
 	elecom,wrc-300ghbk2-i)
-		wan_mac=$(macaddr_add "$(mtd_get_mac_binary art 0x1002)" -2)
+		wan_mac=$(mtd_get_mac_ascii hwconfig "HW.WAN.MAC.Address")
+		label_mac=$wan_mac
 		;;
 	engenius,ecb1200|\
 	engenius,ecb1750)
 		lan_mac=$(mtd_get_mac_ascii u-boot-env ethaddr)
 		label_mac=$lan_mac
 		;;
-	engenius,epg5000)
+	engenius,epg5000|\
+	engenius,esr1200|\
+	engenius,esr1750|\
+	engenius,esr900)
 		lan_mac=$(mtd_get_mac_ascii u-boot-env ethaddr)
 		wan_mac=$(mtd_get_mac_ascii u-boot-env wanaddr)
 		;;
@@ -654,6 +699,10 @@ ath79_setup_macs()
 	enterasys,ws-ap3705i)
 		label_mac=$(mtd_get_mac_ascii u-boot-env0 ethaddr)
 		;;
+	fortinet,fap-221-b)
+		lan_mac=$(mtd_get_mac_text u-boot 0x3ff80 12)
+		label_mac=$lan_mac
+		;;
 	hak5,lan-turtle|\
 	hak5,packet-squirrel)
 		label_mac=$(mtd_get_mac_binary u-boot 0x1fc00)
@@ -708,7 +757,11 @@ ath79_setup_macs()
 		wan_mac=$(mtd_get_mac_binary factory 0x0)
 		lan_mac=$(macaddr_setbit_la "$wan_mac")
 		;;
+	ruckus,zf7025|\
 	ruckus,zf7321|\
+	ruckus,zf7341|\
+	ruckus,zf7351|\
+	ruckus,zf7363|\
 	ruckus,zf7372)
 		lan_mac=$(mtd_get_mac_binary board-data 0x807E)
 		label_mac=$lan_mac
diff --git a/target/linux/ath79/generic/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom b/target/linux/ath79/generic/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
index 04705aadf88f86..a57479b87cf9ef 100644
--- a/target/linux/ath79/generic/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
+++ b/target/linux/ath79/generic/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
@@ -23,16 +23,13 @@ case "$FIRMWARE" in
 	avm,fritzdvbc)
 		caldata_extract_reverse "urlader" 0x1541 0x440
 		;;
-	dlink,dir-505|\
-	dlink,dir-825-c1|\
-	dlink,dir-835-a1)
+	dlink,dir-505)
 		caldata_extract "art" 0x1000 0x440
 		ath9k_patch_mac $(mtd_get_mac_text "mac" 0x4)
 		;;
 	dlink,dir-842-c1|\
 	dlink,dir-842-c2|\
 	dlink,dir-842-c3|\
-	dlink,dir-859-a1|\
 	nec,wf1200cr|\
 	nec,wg1200cr|\
 	wd,mynet-n600|\
@@ -45,7 +42,14 @@ case "$FIRMWARE" in
 		caldata_extract "art" 0x1000 0x440
 		ath9k_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env athaddr) 1)
 		;;
-	engenius,epg5000|\
+	enterasys,ws-ap3705i)
+		caldata_extract "calibrate" 0x1000 0x440
+		ath9k_patch_mac $(mtd_get_mac_ascii u-boot-env0 RADIOADDR1)
+		;;
+	extreme-networks,ws-ap3805i)
+		caldata_extract "art" 0x1000 0x440
+		ath9k_patch_mac $(mtd_get_mac_ascii cfg1 RADIOADDR1)
+		;;
 	iodata,wn-ac1167dgr|\
 	iodata,wn-ac1600dgr|\
 	iodata,wn-ac1600dgr2|\
@@ -55,14 +59,6 @@ case "$FIRMWARE" in
 		caldata_extract "art" 0x1000 0x440
 		ath9k_patch_mac $(mtd_get_mac_ascii u-boot-env ethaddr)
 		;;
-	enterasys,ws-ap3705i)
-		caldata_extract "calibrate" 0x1000 0x440
-		ath9k_patch_mac $(mtd_get_mac_ascii u-boot-env0 RADIOADDR1)
-		;;
-	extreme-networks,ws-ap3805i)
-		caldata_extract "art" 0x1000 0x440
-		ath9k_patch_mac $(mtd_get_mac_ascii cfg1 RADIOADDR1)
-		;;
 	nec,wg800hp)
 		caldata_extract "art" 0x1000 0x440
 		ath9k_patch_mac $(mtd_get_mac_text board_data 0x680)
@@ -83,33 +79,11 @@ case "$FIRMWARE" in
 	;;
 "ath9k-eeprom-pci-0000:00:00.0.bin")
 	case $board in
-	araknis,an-300-ap-i-n|\
-	atheros,db120|\
-	engenius,eap600|\
-	engenius,ecb600|\
-	mercury,mw4530r-v1|\
-	ocedo,raccoon|\
-	tplink,tl-wdr3500-v1|\
-	tplink,tl-wdr3600-v1|\
-	tplink,tl-wdr4300-v1|\
-	tplink,tl-wdr4300-v1-il|\
-	tplink,tl-wdr4310-v1|\
-	tplink,tl-wdr4900-v2|\
-	ubnt,unifi-ap-pro|\
-	watchguard,ap100|\
-	watchguard,ap200|\
-	winchannel,wb2000)
-		caldata_extract "art" 0x5000 0x440
-		;;
 	avm,fritz300e)
 		caldata_extract_reverse "urloader" 0x1541 0x440
 		;;
-	buffalo,wzr-hp-g302h-a1a0|\
-	ubnt,unifi-ap-outdoor-plus)
-		caldata_extract "art" 0x1000 0xeb8
-		;;
 	buffalo,wzr-hp-g450h|\
-	ubnt,unifi)
+	pcs,cap324)
 		caldata_extract "art" 0x1000 0x440
 		;;
 	dlink,dir-825-c1|\
@@ -126,18 +100,8 @@ case "$FIRMWARE" in
 		;;
 	netgear,wnr2200-8m|\
 	netgear,wnr2200-16m|\
-	pcs,cap324|\
-	tplink,tl-wr2543-v1|\
 	tplink,tl-wr842n-v1)
-		caldata_extract "art" 0x1000 0x1000
-		;;
-	openmesh,mr600-v1|\
-	openmesh,mr600-v2|\
-	openmesh,om5p-an)
-		caldata_extract "ART" 0x5000 0x440
-		;;
-	openmesh,om2p-v1)
-		caldata_extract "ART" 0x1000 0x440
+		caldata_extract "art" 0x1000 0x3e0
 		;;
 	wd,mynet-n600|\
 	wd,mynet-n750)
@@ -145,7 +109,7 @@ case "$FIRMWARE" in
 		ath9k_patch_mac $(mtd_get_mac_ascii devdata "wlan5mac")
 		;;
 	wd,mynet-wifi-rangeextender)
-		caldata_extract "art" 0x1000 0x1000
+		caldata_extract "art" 0x1000 0x440
 		ath9k_patch_mac $(nvram get wl0_hwaddr)
 		;;
 	*)
@@ -156,11 +120,10 @@ case "$FIRMWARE" in
 "ath9k-eeprom-pci-0000:00:11.0.bin")
 	case $board in
 	buffalo,wzr-600dhp|\
-	buffalo,wzr-hp-ag300h|\
-	netgear,wndap360)
+	buffalo,wzr-hp-ag300h)
 		caldata_extract "art" 0x1000 0xeb8
 		;;
-	dlink,dir-825-b1)
+	trendnet,tew-673gru)
 		caldata_extract "caldata" 0x1000 0xeb8
 		ath9k_patch_mac_crc $(mtd_get_mac_text "caldata" 0xffa0) 0x20c
 		;;
@@ -175,11 +138,10 @@ case "$FIRMWARE" in
 "ath9k-eeprom-pci-0000:00:12.0.bin")
 	case $board in
 	buffalo,wzr-600dhp|\
-	buffalo,wzr-hp-ag300h|\
-	netgear,wndap360)
+	buffalo,wzr-hp-ag300h)
 		caldata_extract "art" 0x5000 0xeb8
 		;;
-	dlink,dir-825-b1)
+	trendnet,tew-673gru)
 		caldata_extract "caldata" 0x5000 0xeb8
 		ath9k_patch_mac_crc $(macaddr_add $(mtd_get_mac_text "caldata" 0xffb4) 1) 0x20c
 		;;
diff --git a/target/linux/ath79/generic/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ath79/generic/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
index 57e59a89d62d0e..f0a3755de91060 100644
--- a/target/linux/ath79/generic/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+++ b/target/linux/ath79/generic/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
@@ -13,7 +13,6 @@ case "$FIRMWARE" in
 	allnet,all-wap02860ac|\
 	araknis,an-500-ap-i-ac|\
 	araknis,an-700-ap-i-ac|\
-	engenius,eap1200h|\
 	engenius,enstationac-v1|\
 	glinet,gl-x750|\
 	watchguard,ap300)
@@ -36,7 +35,6 @@ case "$FIRMWARE" in
 	sophos,ap55c|\
 	sophos,ap100|\
 	sophos,ap100c|\
-	ubnt,aircube-ac|\
 	ubnt,bullet-ac|\
 	ubnt,unifiac-lite|\
 	ubnt,unifiac-lr|\
@@ -70,26 +68,11 @@ case "$FIRMWARE" in
 		caldata_extract "art" 0x5000 0x844
 		ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary art 0x0) -1)
 		;;
-	dlink,dir-859-a1)
-		caldata_extract "art" 0x5000 0x844
-		ath10k_patch_mac $(mtd_get_mac_ascii devdata "wlan5mac")
-		;;
-	elecom,wrc-1750ghbk2-i)
-		caldata_extract "art" 0x5000 0x844
-		;;
 	engenius,ecb1200|\
 	engenius,ecb1750)
 		caldata_extract "art" 0x5000 0x844
 		ath10k_patch_mac $(mtd_get_mac_ascii u-boot-env athaddr)
 		;;
-	engenius,epg5000|\
-	iodata,wn-ac1167dgr|\
-	iodata,wn-ac1600dgr2|\
-	sitecom,wlr-7100|\
-	zyxel,nbg6616)
-		caldata_extract "art" 0x5000 0x844
-		ath10k_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) 1)
-		;;
 	engenius,ews511ap)
 		caldata_extract "art" 0x5000 0x844
 		ath10k_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) 1)
@@ -102,6 +85,13 @@ case "$FIRMWARE" in
 		caldata_extract "art" 0x5000 0x844
 		ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary art 0x0) 1)
 		;;
+	iodata,wn-ac1167dgr|\
+	iodata,wn-ac1600dgr2|\
+	sitecom,wlr-7100|\
+	zyxel,nbg6616)
+		caldata_extract "art" 0x5000 0x844
+		ath10k_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) 1)
+		;;
 	nec,wg800hp)
 		caldata_extract "art" 0x5000 0x844
 		ath10k_patch_mac $(mtd_get_mac_text board_data 0x880)
@@ -221,11 +211,6 @@ case "$FIRMWARE" in
 		ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
 			/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
 		;;
-	netgear,ex6400|\
-	netgear,ex7300)
-		caldata_extract "caldata" 0x5000 0x2f20
-		ath10k_patch_mac $(mtd_get_mac_binary caldata 0xc)
-		;;
 	phicomm,k2t)
 		caldata_extract "art" 0x5000 0x2f20
 		ath10k_patch_mac $(k2t_get_mac "5g_mac")
diff --git a/target/linux/ath79/generic/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac b/target/linux/ath79/generic/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
index 57458cdef0768c..5d74208a5d8eea 100644
--- a/target/linux/ath79/generic/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
+++ b/target/linux/ath79/generic/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
@@ -35,6 +35,15 @@ case "$board" in
 		[ "$PHYNBR" -eq 1 ] && \
 			mtd_get_mac_ascii bdcfg "wlanmac" > /sys${DEVPATH}/macaddress
 		;;
+	engenius,epg5000|\
+	engenius,esr1200|\
+	engenius,esr1750|\
+	engenius,esr900)
+		macaddr_add "$(mtd_get_mac_ascii u-boot-env ethaddr)" "$PHYNBR" > /sys${DEVPATH}/macaddress
+		;;
+	fortinet,fap-221-b)
+		macaddr_add "$(mtd_get_mac_text u-boot 0x3ff80 12)" $((PHYNBR*7+1)) > /sys${DEVPATH}/macaddress
+		;;
 	iodata,wn-ac1600dgr)
 		# There is no eeprom data for 5 GHz wlan in "art" partition
 		# which would allow to patch the macaddress
diff --git a/target/linux/ath79/generic/base-files/etc/uci-defaults/09_fix-checksum b/target/linux/ath79/generic/base-files/etc/uci-defaults/09_fix-checksum
index 92048fd8104871..0ea81a8dc3ac53 100644
--- a/target/linux/ath79/generic/base-files/etc/uci-defaults/09_fix-checksum
+++ b/target/linux/ath79/generic/base-files/etc/uci-defaults/09_fix-checksum
@@ -21,6 +21,10 @@ dlink,dap-3320-a1|\
 dlink,dap-3662-a1)
 	fixwrgg
 	;;
+dlink,dir-629-a1|\
+dlink,dir-859-a1|\
+dlink,dir-859-a3|\
+dlink,dir-869-a1|\
 qihoo,c301)
 	fix_seama_header
 	;;
diff --git a/target/linux/ath79/generic/base-files/lib/preinit/02_sysinfo_fixup b/target/linux/ath79/generic/base-files/lib/preinit/02_sysinfo_fixup
new file mode 100644
index 00000000000000..e01469f0d99107
--- /dev/null
+++ b/target/linux/ath79/generic/base-files/lib/preinit/02_sysinfo_fixup
@@ -0,0 +1,42 @@
+. /lib/functions.sh
+
+do_sysinfo_ath79_fixup() {
+	local model=""
+
+	case $(board_name) in
+	netgear,ex7300)
+		local part=$(find_mtd_part caldata)
+		local board_hw_id=$(dd if=$part bs=1 skip=67 count=10 2>/dev/null)
+		case "$board_hw_id" in
+		5508013406)
+			model="Netgear EX6400"
+			;;
+		5508013271)
+			model="Netgear EX7300"
+			;;
+		esac
+		;;
+	netgear,ex7300-v2)
+		local part=$(find_mtd_part artmtd)
+		local antenna_cfg=$(dd if=$part bs=1 skip=59 count=7 2>/dev/null)
+		local board_hw_id=$(dd if=$part bs=1 skip=67 count=6 2>/dev/null)
+		case "$antenna_cfg" in
+		3X3+3X3)
+			model="Netgear EX6250"
+			;;
+		3X3+4X4)
+			# EX6400 v2, EX6410, EX6420
+			model="Netgear ${board_hw_id:-EX6400 v2}"
+			;;
+		4X4+4X4)
+			# EX7300 v2, EX7320
+			model="Netgear ${board_hw_id:-EX7300 v2}"
+			;;
+		esac
+		;;
+	esac
+
+	[ -n "$model" ] && echo "$model" > /tmp/sysinfo/model
+}
+
+boot_hook_add preinit_main do_sysinfo_ath79_fixup
diff --git a/target/linux/ath79/generic/base-files/lib/preinit/10_fix_eth_mac.sh b/target/linux/ath79/generic/base-files/lib/preinit/10_fix_eth_mac.sh
index d06f043ad4e4e1..5fa23e8eb68c3e 100644
--- a/target/linux/ath79/generic/base-files/lib/preinit/10_fix_eth_mac.sh
+++ b/target/linux/ath79/generic/base-files/lib/preinit/10_fix_eth_mac.sh
@@ -12,6 +12,12 @@ preinit_set_mac_address() {
 		ip link set dev eth0 address $(mtd_get_mac_ascii bdcfg "lanmac")
 		ip link set dev eth1 address $(mtd_get_mac_ascii bdcfg "wanmac")
 		;;
+	engenius,epg5000|\
+	engenius,esr1200|\
+	engenius,esr1750|\
+	engenius,esr900)
+		ip link set dev eth0 address $(mtd_get_mac_ascii u-boot-env ethaddr)
+		;;
 	enterasys,ws-ap3705i)
 		ip link set dev eth0 address $(mtd_get_mac_ascii u-boot-env0 ethaddr)
 		;;
@@ -19,6 +25,9 @@ preinit_set_mac_address() {
 	siemens,ws-ap3610)
 		ip link set dev eth0 address $(mtd_get_mac_ascii cfg1 ethaddr)
 		;;
+	fortinet,fap-221-b)
+		ip link set dev eth0 address $(mtd_get_mac_text u-boot 0x3ff80 12)
+		;;
 	tplink,deco-s4-v2)
 		base_mac=$(mtd_get_mac_encrypted_deco $(find_mtd_part config))
 		ip link set dev eth0 address $base_mac
diff --git a/target/linux/ath79/generic/base-files/lib/upgrade/failsafe_datachk.sh b/target/linux/ath79/generic/base-files/lib/upgrade/failsafe_datachk.sh
index de84233de10b5c..23847a1aae4ff6 100644
--- a/target/linux/ath79/generic/base-files/lib/upgrade/failsafe_datachk.sh
+++ b/target/linux/ath79/generic/base-files/lib/upgrade/failsafe_datachk.sh
@@ -8,8 +8,6 @@
 # So the kernel check is for the loader, the rootfs check is for kernel + rootfs
 
 platform_do_upgrade_failsafe_datachk() {
-	local setenv_script="/tmp/fw_env_upgrade"
-
 	local flash_base=0x9f000000
 
 	local kernel_mtd=$(find_mtd_index ${KERNEL_PART:-kernel})
@@ -34,31 +32,33 @@ platform_do_upgrade_failsafe_datachk() {
 	local rootfs_md5=$($IMAGE_CMD $ROOTFS_FILE | dd bs=4k count=$rootfs_blocks iflag=fullblock | md5sum | cut -d ' ' -f1)
 
 	# prepare new u-boot-env vars
-	printf "vmlinux_start_addr 0x%08x\n" $((flash_base + kernel_offset)) >> $setenv_script
-	printf "vmlinux_size 0x%08x\n" ${kernel_size} >> $setenv_script
-	printf "vmlinux_checksum %s\n" ${kernel_md5} >> $setenv_script
+	printf "vmlinux_start_addr 0x%08x\n" $((flash_base + kernel_offset)) >> $ENV_SCRIPT
+	printf "vmlinux_size 0x%08x\n" ${kernel_size} >> $ENV_SCRIPT
+	printf "vmlinux_checksum %s\n" ${kernel_md5} >> $ENV_SCRIPT
 
-	printf "rootfs_start_addr 0x%08x\n" $((flash_base + rootfs_offset)) >> $setenv_script
-	printf "rootfs_size 0x%08x\n" ${rootfs_size} >> $setenv_script
-	printf "rootfs_checksum %s\n" ${rootfs_md5} >> $setenv_script
+	printf "rootfs_start_addr 0x%08x\n" $((flash_base + rootfs_offset)) >> $ENV_SCRIPT
+	printf "rootfs_size 0x%08x\n" ${rootfs_size} >> $ENV_SCRIPT
+	printf "rootfs_checksum %s\n" ${rootfs_md5} >> $ENV_SCRIPT
 
 	# store u-boot-env
 	mkdir -p /var/lock
-	fw_setenv -s $setenv_script || {
+	[ -n "$SKIP_HASH" ] || fw_setenv -s $ENV_SCRIPT || {
 		echo 'failed to update U-Boot environment'
 		exit 1
 	}
 
 	# sysupgrade
-	sleep 2
-	sync
-	echo 3 > /proc/sys/vm/drop_caches
+	sleep 2 && sync && echo 3 > /proc/sys/vm/drop_caches
+
 	$IMAGE_CMD $KERNEL_FILE | mtd $MTD_ARGS write - ${KERNEL_PART:-kernel}
-	sleep 2
-	sync
+
+	sleep 2 && sync && echo 3 > /proc/sys/vm/drop_caches
+
 	if [ -n "$UPGRADE_BACKUP" ]; then
 		$IMAGE_CMD $ROOTFS_FILE | mtd $MTD_ARGS $MTD_CONFIG_ARGS -j $UPGRADE_BACKUP write - ${ROOTFS_PART:-rootfs}
 	else
 		$IMAGE_CMD $ROOTFS_FILE | mtd $MTD_ARGS write - ${ROOTFS_PART:-rootfs}
 	fi
+
+	sync
 }
diff --git a/target/linux/ath79/generic/base-files/lib/upgrade/platform.sh b/target/linux/ath79/generic/base-files/lib/upgrade/platform.sh
index 8aa7e90ab8a8c7..67a3635075b8a1 100644
--- a/target/linux/ath79/generic/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ath79/generic/base-files/lib/upgrade/platform.sh
@@ -36,14 +36,28 @@ platform_do_upgrade() {
 	araknis,an-500-ap-i-ac|\
 	araknis,an-700-ap-i-ac|\
 	engenius,eap1200h|\
+	engenius,eap1750h|\
 	engenius,eap300-v2|\
 	engenius,eap600|\
 	engenius,ecb600|\
 	engenius,ens202ext-v1|\
 	engenius,enstationac-v1|\
+	engenius,ews660ap|\
 	watchguard,ap100|\
 	watchguard,ap200|\
 	watchguard,ap300)
+		ENV_SCRIPT="/tmp/fw_env"
+		IMAGE_LIST="tar tzf $1"
+		IMAGE_CMD="tar xzOf $1"
+		KERNEL_PART="loader"
+		ROOTFS_PART="fwconcat0"
+		KERNEL_FILE="uImage-lzma.bin"
+		ROOTFS_FILE="root.squashfs"
+		platform_do_upgrade_failsafe_datachk "$1"
+		;;
+	fortinet,fap-221-b)
+		SKIP_HASH="1"
+		ENV_SCRIPT="/dev/null"
 		IMAGE_LIST="tar tzf $1"
 		IMAGE_CMD="tar xzOf $1"
 		KERNEL_PART="loader"
diff --git a/target/linux/ath79/generic/config-default b/target/linux/ath79/generic/config-default
index dd59a354900eeb..06f264b626a72b 100644
--- a/target/linux/ath79/generic/config-default
+++ b/target/linux/ath79/generic/config-default
@@ -15,6 +15,8 @@ CONFIG_MARVELL_PHY=y
 CONFIG_MICREL_PHY=y
 CONFIG_MTD_REDBOOT_PARTS=y
 CONFIG_MTD_SPLIT_EVA_FW=y
+CONFIG_NVMEM_SYSFS=y
+CONFIG_NVMEM_U_BOOT_ENV=y
 CONFIG_PHY_AR7100_USB=y
 CONFIG_PHY_AR7200_USB=y
 CONFIG_REALTEK_PHY=y
diff --git a/target/linux/ath79/generic/target.mk b/target/linux/ath79/generic/target.mk
index 4e53c8926053dc..27c3365a296735 100644
--- a/target/linux/ath79/generic/target.mk
+++ b/target/linux/ath79/generic/target.mk
@@ -1,6 +1,6 @@
 BOARDNAME:=Generic
 
-DEFAULT_PACKAGES += wpad-basic-wolfssl
+DEFAULT_PACKAGES += wpad-basic-mbedtls
 
 define Target/Description
 	Build firmware images for generic Atheros AR71xx/AR913x/AR934x based boards.
diff --git a/target/linux/ath79/image/Makefile b/target/linux/ath79/image/Makefile
index 712ab941e18a5c..8328be7667cf8d 100644
--- a/target/linux/ath79/image/Makefile
+++ b/target/linux/ath79/image/Makefile
@@ -83,7 +83,7 @@ define Device/loader-okli-uimage
   LOADER_TYPE := bin
   COMPILE := loader-$(1).bin loader-$(1).uImage
   COMPILE/loader-$(1).bin := loader-okli-compile
-  COMPILE/loader-$(1).uImage := append-loader-okli $(1) | pad-to 64k | \
+  COMPILE/loader-$(1).uImage := loader-okli-compile | pad-to 64k | \
 	lzma | uImage lzma
 endef
 
diff --git a/target/linux/ath79/image/common-mikrotik.mk b/target/linux/ath79/image/common-mikrotik.mk
index fb3dc7822667a8..b37c8b7197067c 100644
--- a/target/linux/ath79/image/common-mikrotik.mk
+++ b/target/linux/ath79/image/common-mikrotik.mk
@@ -9,6 +9,7 @@ endef
 
 define Device/mikrotik_nor
   $(Device/mikrotik)
+  DEVICE_PACKAGES := -yafut
   IMAGE/sysupgrade.bin := append-kernel | kernel2minor -s 1024 -e | \
 	pad-to $$$$(BLOCKSIZE) | append-rootfs | pad-rootfs | \
 	check-size | append-metadata
@@ -16,8 +17,9 @@ endef
 
 define Device/mikrotik_nand
   $(Device/mikrotik)
-  IMAGE/sysupgrade.bin = append-kernel | kernel2minor -s 2048 -e -c | \
-	sysupgrade-tar kernel=$$$$@ | append-metadata
-  DEVICE_PACKAGES := nand-utils
-  DEFAULT := n
+  IMAGE/sysupgrade.bin = append-kernel | sysupgrade-tar | append-metadata
+  DEVICE_COMPAT_MESSAGE := \
+       NAND images switched to yafut. If running older image, reinstall from initramfs.
+  DEVICE_COMPAT_VERSION := 1.1
+
 endef
diff --git a/target/linux/ath79/image/common-netgear.mk b/target/linux/ath79/image/common-netgear.mk
index 5a61caf1f64249..c3b20cf1dc9731 100644
--- a/target/linux/ath79/image/common-netgear.mk
+++ b/target/linux/ath79/image/common-netgear.mk
@@ -12,7 +12,7 @@ define Build/netgear-squashfs
 	rm -rf $@.fs $@.squashfs
 	mkdir -p $@.fs/image
 	cp $@ $@.fs/image/uImage
-	$(STAGING_DIR_HOST)/bin/mksquashfs-lzma  \
+	$(STAGING_DIR_HOST)/bin/mksquashfs3-lzma  \
 		$@.fs $@.squashfs -be \
 		-noappend -root-owned -b 65536 \
 		$(if $(SOURCE_DATE_EPOCH),-fixed-time $(SOURCE_DATE_EPOCH))
diff --git a/target/linux/ath79/image/common-senao.mk b/target/linux/ath79/image/common-senao.mk
index e0e60dbe277730..9034aa28dbc96d 100644
--- a/target/linux/ath79/image/common-senao.mk
+++ b/target/linux/ath79/image/common-senao.mk
@@ -37,6 +37,7 @@ endef
 define Device/senao_loader_okli
   $(Device/loader-okli-uimage)
   KERNEL := kernel-bin | append-dtb | lzma | uImage lzma -M 0x73714f4b
+  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel | uImage none
   LOADER_KERNEL_MAGIC := 0x73714f4b
   IMAGES += factory.bin
   IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs | pad-rootfs | \
diff --git a/target/linux/ath79/image/generic-tp-link.mk b/target/linux/ath79/image/generic-tp-link.mk
index 598085e50b0517..460297e7e99732 100644
--- a/target/linux/ath79/image/generic-tp-link.mk
+++ b/target/linux/ath79/image/generic-tp-link.mk
@@ -350,6 +350,16 @@ define Device/tplink_cpe510-v3
 endef
 TARGET_DEVICES += tplink_cpe510-v3
 
+define Device/tplink_cpe605-v1
+  $(Device/tplink-safeloader-okli)
+  SOC := ar9344
+  IMAGE_SIZE := 7680k
+  DEVICE_MODEL := CPE605
+  DEVICE_VARIANT := v1
+  TPLINK_BOARD_ID := CPE605V1
+endef
+TARGET_DEVICES += tplink_cpe605-v1
+
 define Device/tplink_cpe610-v1
   $(Device/tplink-safeloader-okli)
   SOC := ar9344
@@ -499,7 +509,7 @@ define Device/tplink_deco-s4-v2
   IMAGE_SIZE := 13824k
   DEVICE_MODEL := Deco S4
   DEVICE_VARIANT := v2
-  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9888-ct uencrypt
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9888-ct uencrypt-mbedtls
   SUPPORTED_DEVICES += deco-s4-v2
   TPLINK_BOARD_ID := DECO-S4-V2
 endef
@@ -666,6 +676,22 @@ define Device/tplink_tl-wdr4900-v2
 endef
 TARGET_DEVICES += tplink_tl-wdr4900-v2
 
+define Device/tplink_tl-wdr6500-v2
+  $(Device/tplink-8mlzma)
+  SOC := qca9561
+  DEVICE_MODEL := TL-WDR6500
+  DEVICE_VARIANT := v2
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ledtrig-usbdev \
+	kmod-ath9k kmod-ath10k-ct ath10k-firmware-qca988x-ct
+  IMAGE_SIZE := 8000k
+  KERNEL := kernel-bin | append-dtb | lzma | uImage lzma
+  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | uImage lzma
+  TPLINK_HWID := 0x65000002
+  TPLINK_HEADER_VERSION := 1
+  SUPPORTED_DEVICES += tl-wdr6500-v2
+endef
+TARGET_DEVICES += tplink_tl-wdr6500-v2
+
 define Device/tplink_tl-wdr7500-v3
   $(Device/tplink-8mlzma)
   SOC := qca9558
@@ -697,6 +723,7 @@ define Device/tplink_tl-wr1043nd-v1
   DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport kmod-switch-rtl8366rb
   TPLINK_HWID := 0x10430001
   SUPPORTED_DEVICES += tl-wr1043nd
+  DEFAULT := n
 endef
 TARGET_DEVICES += tplink_tl-wr1043nd-v1
 
@@ -779,6 +806,7 @@ define Device/tplink_tl-wr710n-v1
   DEVICE_PACKAGES := kmod-usb-chipidea2 kmod-usb-ledtrig-usbport
   TPLINK_HWID := 0x07100001
   SUPPORTED_DEVICES += tl-wr710n
+  DEFAULT := n
 endef
 TARGET_DEVICES += tplink_tl-wr710n-v1
 
@@ -791,6 +819,7 @@ define Device/tplink_tl-wr710n-v2.1
   TPLINK_HWID := 0x07100002
   TPLINK_HWREV := 0x2
   SUPPORTED_DEVICES += tl-wr710n
+  DEFAULT := n
 endef
 TARGET_DEVICES += tplink_tl-wr710n-v2.1
 
@@ -812,6 +841,7 @@ define Device/tplink_tl-wr810n-v2
   DEVICE_VARIANT := v2
   TPLINK_HWID := 0x8100002
   SUPPORTED_DEVICES += tl-wr810n-v2
+  DEFAULT := n
 endef
 TARGET_DEVICES += tplink_tl-wr810n-v2
 
@@ -841,6 +871,7 @@ define Device/tplink_tl-wr842n-v1
   DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport
   TPLINK_HWID := 0x8420001
   SUPPORTED_DEVICES += tl-mr3420
+  DEFAULT := n
 endef
 TARGET_DEVICES += tplink_tl-wr842n-v1
 
@@ -852,6 +883,7 @@ define Device/tplink_tl-wr842n-v2
   DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport
   TPLINK_HWID := 0x8420002
   SUPPORTED_DEVICES += tl-wr842n-v2
+  DEFAULT := n
 endef
 TARGET_DEVICES += tplink_tl-wr842n-v2
 
diff --git a/target/linux/ath79/image/generic-ubnt.mk b/target/linux/ath79/image/generic-ubnt.mk
index fe158e584b8043..0f70649d031503 100644
--- a/target/linux/ath79/image/generic-ubnt.mk
+++ b/target/linux/ath79/image/generic-ubnt.mk
@@ -43,6 +43,7 @@ define Device/ubnt_edgeswitch-8xp
   $(Device/ubnt-sw)
   DEVICE_MODEL := EdgeSwitch 8XP
   DEVICE_PACKAGES += kmod-switch-bcm53xx-mdio
+  DEFAULT := n
 endef
 TARGET_DEVICES += ubnt_edgeswitch-8xp
 
@@ -167,7 +168,7 @@ endef
 TARGET_DEVICES += ubnt_rocket-5ac-lite
 
 define Device/ubnt_routerstation_common
-  DEVICE_PACKAGES := -kmod-ath9k -wpad-basic-wolfssl -uboot-envtools kmod-usb-ohci \
+  DEVICE_PACKAGES := -kmod-ath9k -wpad-basic-mbedtls -uboot-envtools kmod-usb-ohci \
 	kmod-usb2 fconfig
   DEVICE_VENDOR := Ubiquiti
   SOC := ar7161
@@ -228,7 +229,7 @@ TARGET_DEVICES += ubnt_unifi-ap-lr
 define Device/ubnt_unifiac
   DEVICE_VENDOR := Ubiquiti
   SOC := qca9563
-  IMAGE_SIZE := 7744k
+  IMAGE_SIZE := 15488k
   DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
 endef
 
diff --git a/target/linux/ath79/image/generic.mk b/target/linux/ath79/image/generic.mk
index 1ba02fc0fc512b..788520120de5ba 100644
--- a/target/linux/ath79/image/generic.mk
+++ b/target/linux/ath79/image/generic.mk
@@ -10,24 +10,7 @@ DEVICE_VARS += SEAMA_SIGNATURE SEAMA_MTDBLOCK
 DEVICE_VARS += KERNEL_INITRAMFS_PREFIX DAP_SIGNATURE
 DEVICE_VARS += EDIMAX_HEADER_MAGIC EDIMAX_HEADER_MODEL
 DEVICE_VARS += OPENMESH_CE_TYPE ZYXEL_MODEL_STRING
-
-define Build/add-elecom-factory-initramfs
-  $(eval edimax_model=$(word 1,$(1)))
-  $(eval product=$(word 2,$(1)))
-
-  $(STAGING_DIR_HOST)/bin/mkedimaximg \
-	-b -s CSYS -m $(edimax_model) \
-	-f 0x70000 -S 0x01100000 \
-	-i $@ -o $@.factory
-
-  $(call Build/elecom-product-header,$(product) $@.factory)
-
-  if [ "$$(stat -c%s $@.factory)" -le $$(($(subst k,* 1024,$(subst m, * 1024k,$(IMAGE_SIZE))))) ]; then \
-	mv $@.factory $(BIN_DIR)/$(KERNEL_INITRAMFS_PREFIX)-factory.bin; \
-  else \
-	echo "WARNING: initramfs kernel image too big, cannot generate factory image" >&2; \
-  fi
-endef
+DEVICE_VARS += SUPPORTED_TELTONIKA_DEVICES
 
 define Build/addpattern
 	-$(STAGING_DIR_HOST)/bin/addpattern -B $(ADDPATTERN_ID) \
@@ -157,6 +140,35 @@ define Build/teltonika-v1-header
 	@mv $@.new $@
 endef
 
+metadata_json_teltonika = \
+	'{ $(if $(IMAGE_METADATA),$(IMAGE_METADATA)$(comma)) \
+		"metadata_version": "1.1", \
+		"compat_version": "$(call json_quote,$(compat_version))", \
+		"version":"$(call json_quote,$(VERSION_DIST))-$(call json_quote,$(VERSION_NUMBER))-$(call json_quote,$(REVISION))", \
+		"device_code": [".*"], \
+		"hwver": [".*"], \
+		"batch": [".*"], \
+		"serial": [".*"], \
+		$(if $(DEVICE_COMPAT_MESSAGE),"compat_message": "$(call json_quote,$(DEVICE_COMPAT_MESSAGE))"$(comma)) \
+		$(if $(filter-out 1.0,$(compat_version)),"new_supported_devices": \
+			[$(call metadata_devices,$(SUPPORTED_TELTONIKA_DEVICES))]$(comma) \
+			"supported_devices": ["$(call json_quote,$(legacy_supported_message))"]$(comma)) \
+		$(if $(filter 1.0,$(compat_version)),"supported_devices":[$(call metadata_devices,$(SUPPORTED_TELTONIKA_DEVICES))]$(comma)) \
+		"version_wrt": { \
+			"dist": "$(call json_quote,$(VERSION_DIST))", \
+			"version": "$(call json_quote,$(VERSION_NUMBER))", \
+			"revision": "$(call json_quote,$(REVISION))", \
+			"target": "$(call json_quote,$(TARGETID))", \
+			"board": "$(call json_quote,$(if $(BOARD_NAME),$(BOARD_NAME),$(DEVICE_NAME)))" \
+		}, \
+		"hw_support": {}, \
+		"hw_mods": {} \
+	}'
+
+define Build/append-metadata-teltonika
+	echo $(call metadata_json_teltonika) | fwtool -I - $@
+endef
+
 define Build/wrgg-pad-rootfs
 	$(STAGING_DIR_HOST)/bin/padjffs2 $(IMAGE_ROOTFS) -c 64 >>$@
 endef
@@ -234,6 +246,18 @@ define Device/adtran_bsap1840
 endef
 TARGET_DEVICES += adtran_bsap1840
 
+define Device/alcatel_hh40v
+  SOC := qca9531
+  DEVICE_VENDOR := Alcatel
+  DEVICE_MODEL := HH40V
+  DEVICE_PACKAGES := kmod-usb2 kmod-usb-serial-option kmod-usb-net-rndis
+  IMAGE_SIZE := 14976k
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
+	append-rootfs | pad-rootfs
+endef
+TARGET_DEVICES += alcatel_hh40v
+
 define Device/airtight_c-75
   SOC := qca9550
   DEVICE_VENDOR := AirTight Networks
@@ -380,9 +404,30 @@ define Device/aruba_ap-105
   DEVICE_MODEL := AP-105
   IMAGE_SIZE := 16000k
   DEVICE_PACKAGES := kmod-i2c-gpio kmod-tpm-i2c-atmel
+  LOADER_TYPE := bin
+  LOADER_FLASH_OFFS := 0x42000
+  COMPILE := loader-$(1).bin
+  COMPILE/loader-$(1).bin := loader-okli-compile
+  KERNEL := kernel-bin | append-dtb | lzma | uImage lzma -M 0x4f4b4c49 | loader-okli $(1) 8128 | uImage none
+  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel | uImage none
 endef
 TARGET_DEVICES += aruba_ap-105
 
+define Device/aruba_ap-175
+  SOC := ar7161
+  DEVICE_VENDOR := Aruba
+  DEVICE_MODEL := AP-175
+  IMAGE_SIZE := 16000k
+  DEVICE_PACKAGES := kmod-gpio-pca953x kmod-hwmon-lm75 kmod-i2c-gpio kmod-rtc-ds1374
+  LOADER_TYPE := bin
+  LOADER_FLASH_OFFS := 0x42000
+  COMPILE := loader-$(1).bin
+  COMPILE/loader-$(1).bin := loader-okli-compile
+  KERNEL := kernel-bin | append-dtb | lzma | uImage lzma -M 0x4f4b4c49 | loader-okli $(1) 8128 | uImage none
+  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel | uImage none
+endef
+TARGET_DEVICES += aruba_ap-175
+
 define Device/asus_pl-ac56
   SOC := qca9563
   DEVICE_VENDOR := ASUS
@@ -402,6 +447,8 @@ define Device/asus_rp-ac51
   DEVICE_MODEL := RP-AC51
   IMAGE_SIZE := 16000k
   IMAGES += factory.bin
+  IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
+	append-rootfs | pad-rootfs
   DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9888-ct \
 	-swconfig
 endef
@@ -582,13 +629,14 @@ endef
 define Device/buffalo_wzr-hp-g300nh-rb
   $(Device/buffalo_wzr-hp-g300nh)
   DEVICE_MODEL := WZR-HP-G300NH (RTL8366RB switch)
+  DEVICE_PACKAGES += kmod-switch-rtl8366rb
 endef
 TARGET_DEVICES += buffalo_wzr-hp-g300nh-rb
 
 define Device/buffalo_wzr-hp-g300nh-s
   $(Device/buffalo_wzr-hp-g300nh)
   DEVICE_MODEL := WZR-HP-G300NH (RTL8366S switch)
-  DEVICE_PACKAGES += kmod-switch-rtl8366rb
+  DEVICE_PACKAGES += kmod-switch-rtl8366s
 endef
 TARGET_DEVICES += buffalo_wzr-hp-g300nh-s
 
@@ -793,55 +841,48 @@ TARGET_DEVICES += compex_wpj563
 
 define Device/devolo_dlan-pro-1200plus-ac
   SOC := ar9344
-  DEVICE_VENDOR := Devolo
+  DEVICE_VENDOR := devolo
   DEVICE_MODEL := dLAN pro 1200+ WiFi ac
   DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
   IMAGE_SIZE := 15872k
 endef
 TARGET_DEVICES += devolo_dlan-pro-1200plus-ac
 
-define Device/devolo_dvl1200e
+define Device/devolo_wifi-pro
   SOC := qca9558
   DEVICE_VENDOR := devolo
-  DEVICE_MODEL := WiFi pro 1200e
   DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
   IMAGE_SIZE := 15936k
 endef
+
+define Device/devolo_dvl1200e
+  $(Device/devolo_wifi-pro)
+  DEVICE_MODEL := WiFi pro 1200e
+endef
 TARGET_DEVICES += devolo_dvl1200e
 
 define Device/devolo_dvl1200i
-  SOC := qca9558
-  DEVICE_VENDOR := devolo
+  $(Device/devolo_wifi-pro)
   DEVICE_MODEL := WiFi pro 1200i
-  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
-  IMAGE_SIZE := 15936k
 endef
 TARGET_DEVICES += devolo_dvl1200i
 
 define Device/devolo_dvl1750c
-  SOC := qca9558
-  DEVICE_VENDOR := devolo
+  $(Device/devolo_wifi-pro)
   DEVICE_MODEL := WiFi pro 1750c
-  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
-  IMAGE_SIZE := 15936k
 endef
 TARGET_DEVICES += devolo_dvl1750c
 
 define Device/devolo_dvl1750e
-  SOC := qca9558
-  DEVICE_VENDOR := devolo
+  $(Device/devolo_wifi-pro)
   DEVICE_MODEL := WiFi pro 1750e
-  DEVICE_PACKAGES := kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca988x-ct
-  IMAGE_SIZE := 15936k
+  DEVICE_PACKAGES += kmod-usb2
 endef
 TARGET_DEVICES += devolo_dvl1750e
 
 define Device/devolo_dvl1750i
-  SOC := qca9558
-  DEVICE_VENDOR := devolo
+  $(Device/devolo_wifi-pro)
   DEVICE_MODEL := WiFi pro 1750i
-  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
-  IMAGE_SIZE := 15936k
 endef
 TARGET_DEVICES += devolo_dvl1750i
 
@@ -856,7 +897,7 @@ TARGET_DEVICES += devolo_dvl1750x
 
 define Device/devolo_magic-2-wifi
   SOC := ar9344
-  DEVICE_VENDOR := Devolo
+  DEVICE_VENDOR := devolo
   DEVICE_MODEL := Magic 2 WiFi
   DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
   IMAGE_SIZE := 15872k
@@ -996,17 +1037,32 @@ define Device/dlink_dir-505
 endef
 TARGET_DEVICES += dlink_dir-505
 
+define Device/dlink_dir-629-a1
+  $(Device/seama)
+  SOC := qca9558
+  IMAGE_SIZE := 7616k
+  DEVICE_VENDOR := D-Link
+  DEVICE_MODEL := DIR-629
+  DEVICE_VARIANT := A1
+  DEVICE_PACKAGES := -uboot-envtools
+  SEAMA_MTDBLOCK := 6
+  SEAMA_SIGNATURE := wrgn83_dlob.hans_dir629
+endef
+TARGET_DEVICES += dlink_dir-629-a1
+
 define Device/dlink_dir-825-b1
   SOC := ar7161
   DEVICE_VENDOR := D-Link
   DEVICE_MODEL := DIR-825
   DEVICE_VARIANT := B1
-  IMAGE_SIZE := 6208k
-  IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | \
-	check-size | append-metadata
   DEVICE_PACKAGES := kmod-usb-ohci kmod-usb2 kmod-usb-ledtrig-usbport \
 	kmod-leds-reset kmod-owl-loader kmod-switch-rtl8366s
-  SUPPORTED_DEVICES += dir-825-b1
+  IMAGE_SIZE := 7808k
+  FACTORY_SIZE := 6144k
+  IMAGES += factory.bin
+  IMAGE/factory.bin = append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs | \
+	pad-rootfs | check-size $$$$(FACTORY_SIZE) | pad-to $$$$(FACTORY_SIZE) | \
+	append-string 01AP94-AR7161-RT-080619-00
 endef
 TARGET_DEVICES += dlink_dir-825-b1
 
@@ -1087,25 +1143,52 @@ define Device/dlink_dir-842-c3
 endef
 TARGET_DEVICES += dlink_dir-842-c3
 
-define Device/dlink_dir-859-a1
+define Device/dlink_dir-859-ax
   $(Device/seama)
   SOC := qca9563
   DEVICE_VENDOR := D-Link
   DEVICE_MODEL := DIR-859
-  DEVICE_VARIANT := A1
   IMAGE_SIZE := 15872k
-  DEVICE_PACKAGES :=  kmod-usb2 kmod-ath10k-ct-smallbuffers ath10k-firmware-qca988x-ct
+  DEVICE_PACKAGES := kmod-usb2 kmod-ath10k-ct-smallbuffers ath10k-firmware-qca988x-ct
   SEAMA_SIGNATURE := wrgac37_dlink.2013gui_dir859
 endef
+
+define Device/dlink_dir-859-a1
+  $(Device/dlink_dir-859-ax)
+  DEVICE_VARIANT := A1
+endef
 TARGET_DEVICES += dlink_dir-859-a1
 
+define Device/dlink_dir-859-a3
+  $(Device/dlink_dir-859-ax)
+  DEVICE_VARIANT := A3
+endef
+TARGET_DEVICES += dlink_dir-859-a3
+
+define Device/dlink_dir-869-a1
+  $(Device/seama)
+  SOC := qca9563
+  DEVICE_VENDOR := D-Link
+  DEVICE_MODEL := DIR-869
+  DEVICE_VARIANT := A1
+  IMAGE_SIZE := 15872k
+  DEVICE_PACKAGES := kmod-usb2 kmod-ath10k-ct-smallbuffers ath10k-firmware-qca988x-ct
+  SEAMA_SIGNATURE := wrgac54_dlink.2015_dir869
+  SUPPORTED_DEVICES += dir-869-a1
+endef
+TARGET_DEVICES += dlink_dir-869-a1
+
 define Device/elecom_wrc-1750ghbk2-i
   SOC := qca9563
   DEVICE_VENDOR := ELECOM
   DEVICE_MODEL := WRC-1750GHBK2-I/C
   IMAGE_SIZE := 15808k
-  KERNEL_INITRAMFS := $$(KERNEL) | pad-to 2 | \
-	add-elecom-factory-initramfs RN68 WRC-1750GHBK2
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+  ARTIFACTS := initramfs-factory.bin
+  ARTIFACT/initramfs-factory.bin := append-image initramfs-kernel.bin | \
+	pad-to 2 | edimax-header -b -s CSYS -m RN68 -f 0x70000 -S 0x01100000 | \
+	elecom-product-header WRC-1750GHBK2 | check-size
+endif
   DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
 endef
 TARGET_DEVICES += elecom_wrc-1750ghbk2-i
@@ -1115,8 +1198,12 @@ define Device/elecom_wrc-300ghbk2-i
   DEVICE_VENDOR := ELECOM
   DEVICE_MODEL := WRC-300GHBK2-I
   IMAGE_SIZE := 7616k
-  KERNEL_INITRAMFS := $$(KERNEL) | pad-to 2 | \
-	add-elecom-factory-initramfs RN51 WRC-300GHBK2-I
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+  ARTIFACTS := initramfs-factory.bin
+  ARTIFACT/initramfs-factory.bin := append-image initramfs-kernel.bin | \
+	pad-to 2 | edimax-header -b -s CSYS -m RN51 -f 0x70000 -S 0x01100000 | \
+	elecom-product-header WRC-300GHBK2-I | check-size
+endif
 endef
 TARGET_DEVICES += elecom_wrc-300ghbk2-i
 
@@ -1150,6 +1237,18 @@ define Device/engenius_eap1200h
 endef
 TARGET_DEVICES += engenius_eap1200h
 
+define Device/engenius_eap1750h
+  $(Device/senao_loader_okli)
+  SOC := qca9558
+  DEVICE_VENDOR := EnGenius
+  DEVICE_MODEL := EAP1750H
+  DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct
+  IMAGE_SIZE := 11584k
+  LOADER_FLASH_OFFS := 0x220000
+  SENAO_IMGNAME := ar71xx-generic-eap1750h
+endef
+TARGET_DEVICES += engenius_eap1750h
+
 define Device/engenius_eap300-v2
   $(Device/senao_loader_okli)
   SOC := ar9341
@@ -1250,6 +1349,48 @@ define Device/engenius_epg5000
 endef
 TARGET_DEVICES += engenius_epg5000
 
+define Device/engenius_esr1200
+  SOC := qca9557
+  DEVICE_VENDOR := EnGenius
+  DEVICE_MODEL := ESR1200
+  DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct kmod-usb2
+  IMAGE_SIZE := 14656k
+  IMAGES += factory.dlf
+  IMAGE/factory.dlf := append-kernel | pad-to $$$$(BLOCKSIZE) | \
+	append-rootfs | pad-rootfs | check-size | \
+	senao-header -r 0x101 -p 0x61 -t 2
+  SUPPORTED_DEVICES += esr1200 esr1750 engenius,esr1750
+endef
+TARGET_DEVICES += engenius_esr1200
+
+define Device/engenius_esr1750
+  SOC := qca9558
+  DEVICE_VENDOR := EnGenius
+  DEVICE_MODEL := ESR1750
+  DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct kmod-usb2
+  IMAGE_SIZE := 14656k
+  IMAGES += factory.dlf
+  IMAGE/factory.dlf := append-kernel | pad-to $$$$(BLOCKSIZE) | \
+	append-rootfs | pad-rootfs | check-size | \
+	senao-header -r 0x101 -p 0x62 -t 2
+  SUPPORTED_DEVICES += esr1750 esr1200 engenius,esr1200
+endef
+TARGET_DEVICES += engenius_esr1750
+
+define Device/engenius_esr900
+  SOC := qca9558
+  DEVICE_VENDOR := EnGenius
+  DEVICE_MODEL := ESR900
+  DEVICE_PACKAGES := kmod-usb2
+  IMAGE_SIZE := 14656k
+  IMAGES += factory.dlf
+  IMAGE/factory.dlf := append-kernel | pad-to $$$$(BLOCKSIZE) | \
+	append-rootfs | pad-rootfs | check-size | \
+	senao-header -r 0x101 -p 0x4e -t 2
+  SUPPORTED_DEVICES += esr900
+endef
+TARGET_DEVICES += engenius_esr900
+
 define Device/engenius_ews511ap
   SOC := qca9531
   DEVICE_VENDOR := EnGenius
@@ -1259,6 +1400,18 @@ define Device/engenius_ews511ap
 endef
 TARGET_DEVICES += engenius_ews511ap
 
+define Device/engenius_ews660ap
+  $(Device/senao_loader_okli)
+  SOC := qca9558
+  DEVICE_VENDOR := EnGenius
+  DEVICE_MODEL := EWS660AP
+  DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct
+  IMAGE_SIZE := 11584k
+  LOADER_FLASH_OFFS := 0x220000
+  SENAO_IMGNAME := ar71xx-generic-ews660ap
+endef
+TARGET_DEVICES += engenius_ews660ap
+
 define Device/enterasys_ws-ap3705i
   SOC := ar9344
   DEVICE_VENDOR := Enterasys
@@ -1288,6 +1441,22 @@ define Device/extreme-networks_ws-ap3805i
 endef
 TARGET_DEVICES += extreme-networks_ws-ap3805i
 
+define Device/fortinet_fap-221-b
+  $(Device/senao_loader_okli)
+  SOC := ar9344
+  DEVICE_VENDOR := Fortinet
+  DEVICE_MODEL := FAP-221-B
+  FACTORY_IMG_NAME := FP221B-9.99-AP-build999-999999-patch99
+  IMAGE_SIZE := 9216k
+  LOADER_FLASH_OFFS := 0x040000
+  IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
+	append-rootfs | pad-rootfs | \
+	check-size | pad-to $$$$(IMAGE_SIZE) | \
+	append-loader-okli-uimage $(1) | pad-to 10944k | \
+	gzip-filename $$$$(FACTORY_IMG_NAME)
+endef
+TARGET_DEVICES += fortinet_fap-221-b
+
 define Device/glinet_6408
   $(Device/tplink-8mlzma)
   SOC := ar9331
@@ -1400,7 +1569,7 @@ define Device/hak5_lan-turtle
   TPLINK_HWID := 0x5348334c
   IMAGES := sysupgrade.bin
   DEVICE_PACKAGES := kmod-usb-chipidea2 -iwinfo -kmod-ath9k -swconfig \
-	-uboot-envtools -wpad-basic-wolfssl
+	-uboot-envtools -wpad-basic-mbedtls
   SUPPORTED_DEVICES += lan-turtle
 endef
 TARGET_DEVICES += hak5_lan-turtle
@@ -1413,7 +1582,7 @@ define Device/hak5_packet-squirrel
   TPLINK_HWID := 0x5351524c
   IMAGES := sysupgrade.bin
   DEVICE_PACKAGES := kmod-usb-chipidea2 -iwinfo -kmod-ath9k -swconfig \
-	-uboot-envtools -wpad-basic-wolfssl
+	-uboot-envtools -wpad-basic-mbedtls
   SUPPORTED_DEVICES += packet-squirrel
 endef
 TARGET_DEVICES += hak5_packet-squirrel
@@ -1448,7 +1617,7 @@ define Device/iodata_etg3-r
   DEVICE_VENDOR := I-O DATA
   DEVICE_MODEL := ETG3-R
   IMAGE_SIZE := 7680k
-  DEVICE_PACKAGES := -iwinfo -kmod-ath9k -wpad-basic-wolfssl
+  DEVICE_PACKAGES := -iwinfo -kmod-ath9k -wpad-basic-mbedtls
 endef
 TARGET_DEVICES += iodata_etg3-r
 
@@ -1508,7 +1677,7 @@ define Device/jjplus_ja76pf2
   SOC := ar7161
   DEVICE_VENDOR := jjPlus
   DEVICE_MODEL := JA76PF2
-  DEVICE_PACKAGES += -kmod-ath9k -swconfig -wpad-basic-wolfssl -uboot-envtools fconfig kmod-hwmon-lm75
+  DEVICE_PACKAGES += -kmod-ath9k -swconfig -wpad-basic-mbedtls -uboot-envtools fconfig kmod-hwmon-lm75
   LOADER_TYPE := bin
   LOADER_FLASH_OFFS := 0x60000
   COMPILE := loader-$(1).bin
@@ -1547,18 +1716,36 @@ define Device/joyit_jt-or750i
 endef
 TARGET_DEVICES += joyit_jt-or750i
 
+define Device/kuwfi_c910
+  $(Device/loader-okli-uimage)
+  SOC := qca9533
+  DEVICE_VENDOR := KuWFi
+  DEVICE_MODEL := C910
+  DEVICE_PACKAGES := kmod-usb2 kmod-usb-net-cdc-ether comgt-ncm
+  LOADER_FLASH_OFFS := 0x50000
+  KERNEL := kernel-bin | append-dtb | lzma | uImage lzma -M 0x4f4b4c49
+  IMAGE_SIZE := 15936k
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
+	append-rootfs | pad-rootfs | check-size | pad-to 14528k | \
+	append-loader-okli-uimage $(1) | pad-to 64k
+endef
+TARGET_DEVICES += kuwfi_c910
+
 define Device/letv_lba-047-ch
   $(Device/loader-okli-uimage)
   SOC := qca9531
   DEVICE_VENDOR := Letv
   DEVICE_MODEL := LBA-047-CH
+  DEVICE_PACKAGES := -uboot-envtools
+  FACTORY_SIZE := 14528k
   IMAGE_SIZE := 15936k
   LOADER_FLASH_OFFS := 0x50000
   KERNEL := kernel-bin | append-dtb | lzma | uImage lzma -M 0x4f4b4c49
-  IMAGES += factory.bin
-  IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
-	append-rootfs | pad-rootfs | check-size | pad-to 14528k | \
-	append-loader-okli-uimage $(1) | pad-to 64k
+  IMAGES += kernel.bin rootfs.bin
+  IMAGE/kernel.bin := append-loader-okli-uimage $(1) | pad-to 64k
+  IMAGE/rootfs.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
+	append-rootfs | pad-rootfs | check-size $$$$(FACTORY_SIZE)
 endef
 TARGET_DEVICES += letv_lba-047-ch
 
@@ -1664,41 +1851,45 @@ define Device/nec_wg800hp
 endef
 TARGET_DEVICES += nec_wg800hp
 
-define Device/netgear_ex6400_ex7300
-  $(Device/netgear_generic)
+define Device/netgear_ex7300
   SOC := qca9558
-  UIMAGE_MAGIC := 0x27051956
+  DEVICE_VENDOR := NETGEAR
+  DEVICE_MODEL := EX7300
+  DEVICE_ALT0_VENDOR := NETGEAR
+  DEVICE_ALT0_MODEL := EX6400
   NETGEAR_BOARD_ID := EX7300series
   NETGEAR_HW_ID := 29765104+16+0+128
   IMAGE_SIZE := 15552k
+  IMAGES += factory.img
   IMAGE/default := append-kernel | pad-offset $$$$(BLOCKSIZE) 64 | \
 	netgear-rootfs | pad-rootfs
   IMAGE/sysupgrade.bin := $$(IMAGE/default) | check-size | append-metadata
   IMAGE/factory.img := $$(IMAGE/default) | netgear-dni | check-size
   DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca99x0-ct
-endef
-
-define Device/netgear_ex6400
-  $(Device/netgear_ex6400_ex7300)
-  DEVICE_MODEL := EX6400
-endef
-TARGET_DEVICES += netgear_ex6400
-
-define Device/netgear_ex7300
-  $(Device/netgear_ex6400_ex7300)
-  DEVICE_MODEL := EX7300
+  SUPPORTED_DEVICES += netgear,ex6400
 endef
 TARGET_DEVICES += netgear_ex7300
 
 define Device/netgear_ex7300-v2
-  $(Device/netgear_generic)
   SOC := qcn5502
+  DEVICE_VENDOR := NETGEAR
   DEVICE_MODEL := EX7300
   DEVICE_VARIANT := v2
-  UIMAGE_MAGIC := 0x27051956
+  DEVICE_ALT0_VENDOR := NETGEAR
+  DEVICE_ALT0_MODEL := EX6250
+  DEVICE_ALT1_VENDOR := NETGEAR
+  DEVICE_ALT1_MODEL := EX6400
+  DEVICE_ALT1_VARIANT := v2
+  DEVICE_ALT2_VENDOR := NETGEAR
+  DEVICE_ALT2_MODEL := EX6410
+  DEVICE_ALT3_VENDOR := NETGEAR
+  DEVICE_ALT3_MODEL := EX6420
+  DEVICE_ALT4_VENDOR := NETGEAR
+  DEVICE_ALT4_MODEL := EX7320
   NETGEAR_BOARD_ID := EX7300v2series
   NETGEAR_HW_ID := 29765907+16+0+128
   IMAGE_SIZE := 14528k
+  IMAGES += factory.img
   IMAGE/default := append-kernel | pad-offset $$$$(BLOCKSIZE) 64 | \
 	netgear-rootfs | pad-rootfs
   IMAGE/sysupgrade.bin := $$(IMAGE/default) | check-size | append-metadata
@@ -1711,7 +1902,7 @@ define Device/netgear_wndap360
   $(Device/netgear_generic)
   SOC := ar7161
   DEVICE_MODEL := WNDAP360
-  DEVICE_PACKAGES := kmod-leds-reset kmod-owl-loader
+  DEVICE_PACKAGES := kmod-leds-reset
   IMAGE_SIZE := 7744k
   BLOCKSIZE := 256k
   KERNEL := kernel-bin | append-dtb | gzip | uImage gzip
@@ -1839,7 +2030,7 @@ define Device/ocedo_koala
   DEVICE_MODEL := Koala
   DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
   SUPPORTED_DEVICES += koala
-  IMAGE_SIZE := 7424k
+  IMAGE_SIZE := 14848k
 endef
 TARGET_DEVICES += ocedo_koala
 
@@ -1847,7 +2038,7 @@ define Device/ocedo_raccoon
   SOC := ar9344
   DEVICE_VENDOR := Ocedo
   DEVICE_MODEL := Raccoon
-  IMAGE_SIZE := 7424k
+  IMAGE_SIZE := 14848k
 endef
 TARGET_DEVICES += ocedo_raccoon
 
@@ -1856,7 +2047,7 @@ define Device/ocedo_ursus
   DEVICE_VENDOR := Ocedo
   DEVICE_MODEL := Ursus
   DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
-  IMAGE_SIZE := 7424k
+  IMAGE_SIZE := 14848k
 endef
 TARGET_DEVICES += ocedo_ursus
 
@@ -2380,15 +2571,58 @@ define Device/rosinson_wr818
 endef
 TARGET_DEVICES += rosinson_wr818
 
-define Device/ruckus_zf73xx_common
+define Device/ruckus_common
   DEVICE_VENDOR := Ruckus
-  DEVICE_PACKAGES := -swconfig kmod-usb2 kmod-usb-chipidea2
-  IMAGE_SIZE := 31744k
   LOADER_TYPE := bin
   KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | uImage none
   KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel | uImage none
 endef
 
+define Device/ruckus_zf7025
+  $(Device/ruckus_common)
+  SOC := ar7240
+  DEVICE_MODEL := ZoneFlex 7025
+  IMAGE_SIZE := 15616k
+  BLOCKSIZE := 256k
+endef
+TARGET_DEVICES += ruckus_zf7025
+
+define Device/ruckus_gd11_common
+  $(Device/ruckus_common)
+  SOC := ar7161
+  IMAGE_SIZE := 15616k
+  BLOCKSIZE := 256k
+  DEVICE_PACKAGES := kmod-usb2 kmod-usb-chipidea2
+endef
+
+define Device/ruckus_zf7341
+  $(Device/ruckus_gd11_common)
+  DEVICE_MODEL := ZoneFlex 7341[-U]
+  DEVICE_PACKAGES += -swconfig
+endef
+TARGET_DEVICES += ruckus_zf7341
+
+define Device/ruckus_zf7351
+  $(Device/ruckus_gd11_common)
+  DEVICE_MODEL := ZoneFlex 7351[-U]
+  DEVICE_PACKAGES += -swconfig
+endef
+TARGET_DEVICES += ruckus_zf7351
+
+define Device/ruckus_zf7363
+  $(Device/ruckus_gd11_common)
+  DEVICE_MODEL := ZoneFlex 7363[-U]
+  DEVICE_ALT0_VENDOR := Ruckus
+  DEVICE_ALT0_MODEL := ZoneFlex 7343[-U]
+endef
+TARGET_DEVICES += ruckus_zf7363
+
+define Device/ruckus_zf73xx_common
+  $(Device/ruckus_common)
+  DEVICE_PACKAGES := -swconfig kmod-usb2 kmod-usb-chipidea2
+  IMAGE_SIZE := 31744k
+endef
+
 define Device/ruckus_zf7321
   $(Device/ruckus_zf73xx_common)
   SOC := ar9342
@@ -2535,6 +2769,23 @@ define Device/teltonika_rut230-v1
 endef
 TARGET_DEVICES += teltonika_rut230-v1
 
+define Device/teltonika_rut300
+  SOC := qca9531
+  DEVICE_VENDOR := Teltonika
+  DEVICE_MODEL := RUT300
+  SUPPORTED_TELTONIKA_DEVICES := teltonika,rut30x
+  DEVICE_PACKAGES := -kmod-ath9k -uboot-envtools -wpad-basic-mbedtls kmod-usb2
+  IMAGE_SIZE := 15552k
+  IMAGES += factory.bin
+  IMAGE/factory.bin = append-kernel | pad-to $$$$(BLOCKSIZE) | \
+			 append-rootfs | pad-rootfs | append-metadata-teltonika | \
+			 check-size $$$$(IMAGE_SIZE)
+  IMAGE/sysupgrade.bin = append-kernel | pad-to $$$$(BLOCKSIZE) | \
+			 append-rootfs | pad-rootfs | append-metadata | \
+			 check-size $$$$(IMAGE_SIZE)
+endef
+TARGET_DEVICES += teltonika_rut300
+
 define Device/teltonika_rut955
   SOC := ar9344
   DEVICE_VENDOR := Teltonika
@@ -2562,6 +2813,22 @@ define Device/teltonika_rut955-h7v3c0
 endef
 TARGET_DEVICES += teltonika_rut955-h7v3c0
 
+define Device/trendnet_tew-673gru
+  SOC := ar7161
+  DEVICE_VENDOR := Trendnet
+  DEVICE_MODEL := TEW-673GRU
+  DEVICE_VARIANT := v1.0R
+  DEVICE_PACKAGES := -uboot-envtools kmod-usb-ohci kmod-usb2 \
+	kmod-owl-loader kmod-switch-rtl8366s
+  IMAGE_SIZE := 7808k
+  FACTORY_SIZE := 6144k
+  IMAGES += factory.bin
+  IMAGE/factory.bin = append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs | \
+	pad-rootfs | check-size $$$$(FACTORY_SIZE) | pad-to $$$$(FACTORY_SIZE) | \
+	append-string AP94-AR7161-RT-080619-01
+endef
+TARGET_DEVICES += trendnet_tew-673gru
+
 define Device/trendnet_tew-823dru
   SOC := qca9558
   DEVICE_VENDOR := Trendnet
@@ -2667,6 +2934,7 @@ define Device/wd_mynet-wifi-rangeextender
   IMAGE/sysupgrade.bin := append-rootfs | pad-rootfs | cybertan-trx | \
 	addpattern | append-metadata
   SUPPORTED_DEVICES += mynet-rext
+  DEFAULT := n
 endef
 TARGET_DEVICES += wd_mynet-wifi-rangeextender
 
@@ -2757,6 +3025,7 @@ define Device/ziking_cpe46b
   DEVICE_MODEL := CPE46B
   IMAGE_SIZE := 8000k
   DEVICE_PACKAGES := kmod-i2c-gpio
+  DEFAULT := n
 endef
 TARGET_DEVICES += ziking_cpe46b
 
diff --git a/target/linux/ath79/image/lzma-loader/src/ar71xx_regs.h b/target/linux/ath79/image/lzma-loader/src/ar71xx_regs.h
index 19a4785bb44aed..245042fdab74af 100644
--- a/target/linux/ath79/image/lzma-loader/src/ar71xx_regs.h
+++ b/target/linux/ath79/image/lzma-loader/src/ar71xx_regs.h
@@ -128,6 +128,17 @@
 #define AR9300_OTP_STATUS_SM_BUSY	0x1
 #define AR9300_OTP_READ_DATA	0x15f1c
 
+#define QCA955X_OTP_BASE        (AR71XX_APB_BASE + 0x00130000)
+#define QCA955X_OTP_REG_MEM_0	0x0000
+#define QCA955X_OTP_REG_INTF2	0x1008
+#define QCA955X_OTP_REG_STATUS0	0x1018
+#define QCA955X_OTP_STATUS0_EFUSE_VALID	BIT(2)
+
+#define QCA955X_OTP_REG_STATUS1		0x101c
+#define QCA955X_OTP_REG_LDO_CTRL	0x1024
+#define QCA955X_OTP_REG_LDO_STATUS	0x102c
+#define QCA955X_OTP_LDO_STATUS_POWER_ON		BIT(0)
+
 /*
  * DDR_CTRL block
  */
@@ -344,6 +355,7 @@
 
 #define QCA955X_RESET_REG_BOOTSTRAP		0xb0
 #define QCA955X_RESET_REG_EXT_INT_STATUS	0xac
+#define QCA955X_RESET_REG_RESET_MODULE		0x1c
 
 #define MISC_INT_ETHSW			BIT(12)
 #define MISC_INT_TIMER4			BIT(10)
@@ -436,6 +448,9 @@
 #define AR934X_RESET_MBOX		BIT(1)
 #define AR934X_RESET_I2S		BIT(0)
 
+#define QCA955X_RESET_SGMII_ANALOG	BIT(12)
+#define QCA955X_RESET_SGMII		BIT(8)
+
 #define AR933X_BOOTSTRAP_MDIO_GPIO_EN	BIT(18)
 #define AR933X_BOOTSTRAP_EEPBUSY	BIT(4)
 #define AR933X_BOOTSTRAP_REF_CLK_40	BIT(0)
@@ -722,4 +737,6 @@
 #define QCA955X_ETH_CFG_RGMII_GMAC0	BIT(0)
 #define QCA955X_ETH_CFG_SGMII_GMAC0	BIT(6)
 
+#define QCA955X_GMAC_REG_SGMII_SERDES	0x0018
+
 #endif /* __ASM_MACH_AR71XX_REGS_H */
diff --git a/target/linux/ath79/image/lzma-loader/src/board.c b/target/linux/ath79/image/lzma-loader/src/board.c
index 2f4dd6b1f6456a..7b1e110ee2d902 100644
--- a/target/linux/ath79/image/lzma-loader/src/board.c
+++ b/target/linux/ath79/image/lzma-loader/src/board.c
@@ -10,6 +10,7 @@
 
 #include <stddef.h>
 #include "config.h"
+#include "printf.h"
 #include "ar71xx_regs.h"
 
 #define READREG(r)	*(volatile unsigned int *)(r)
@@ -50,7 +51,139 @@ static void tlwr1043nd_init(void)
 static inline void tlwr1043nd_init(void) {}
 #endif
 
+#ifdef CONFIG_BOARD_MERAKI_MR18
+
+static int mr18_extract_sgmii_res_cal(void)
+{
+	unsigned int base;
+	unsigned int reversed_sgmii_value;
+
+	unsigned int otp_value, otp_per_val, rbias_per, read_data;
+	unsigned int rbias_pos_or_neg;
+	unsigned int sgmii_res_cal_value;
+	int res_cal_val;
+
+	base = KSEG1ADDR(QCA955X_OTP_BASE);
+
+	WRITEREG(base + QCA955X_OTP_REG_INTF2, 0x7d);
+	WRITEREG(base + QCA955X_OTP_REG_LDO_CTRL, 0x00);
+
+	while (READREG(base + QCA955X_OTP_REG_LDO_STATUS) &
+		QCA955X_OTP_LDO_STATUS_POWER_ON)
+		;
+
+	READREG(base + QCA955X_OTP_REG_MEM_0 + 4);
+
+	while (!(READREG(base + QCA955X_OTP_REG_STATUS0) &
+		QCA955X_OTP_STATUS0_EFUSE_VALID))
+		;
+
+	read_data = READREG(base + QCA955X_OTP_REG_STATUS1);
+
+	if (!(read_data & 0x1fff))
+		return 0;
+
+	if (read_data & 0x00001000)
+		otp_value = (read_data & 0xfc0) >> 6;
+	else
+		otp_value = read_data & 0x3f;
+
+	if (otp_value > 31) {
+		otp_per_val = 63 - otp_value;
+		rbias_pos_or_neg = 1;
+	} else {
+		otp_per_val = otp_value;
+		rbias_pos_or_neg = 0;
+	}
+
+	rbias_per = otp_per_val * 15;
+
+	if (rbias_pos_or_neg == 1)
+		res_cal_val = (rbias_per + 34) / 21;
+	else if (rbias_per > 34)
+		res_cal_val = -((rbias_per - 34) / 21);
+	else
+		res_cal_val = (34 - rbias_per) / 21;
+
+	sgmii_res_cal_value = (8 + res_cal_val) & 0xf;
+
+	reversed_sgmii_value  = (sgmii_res_cal_value & 8) >> 3;
+	reversed_sgmii_value |= (sgmii_res_cal_value & 4) >> 1;
+	reversed_sgmii_value |= (sgmii_res_cal_value & 2) << 1;
+	reversed_sgmii_value |= (sgmii_res_cal_value & 1) << 3;
+	printf("SGMII cal value = 0x%x\n", reversed_sgmii_value);
+	return reversed_sgmii_value;
+}
+
+#define QCA955X_SGMII_SERDES_RES_CALIBRATION		BIT(23)
+#define QCA955X_SGMII_SERDES_RES_CALIBRATION_MASK	0xf
+#define QCA955X_SGMII_SERDES_RES_CALIBRATION_SHIFT	23
+#define QCA955X_SGMII_SERDES_LOCK_DETECT_STATUS		BIT(15)
+#define QCA955X_PLL_ETH_SGMII_SERDES_LOCK_DETECT	BIT(2)
+#define QCA955X_PLL_ETH_SGMII_SERDES_PLL_REFCLK		BIT(1)
+#define QCA955X_PLL_ETH_SGMII_SERDES_EN_PLL		BIT(0)
+#define QCA955X_PLL_CLK_CTRL_REG			0x08
+#define QCA955X_PLL_ETH_XMII_CONTROL_REG		0x28
+#define QCA955X_PLL_ETH_SGMII_CONTROL_REG		0x48
+#define QCA955X_PLL_ETH_SGMII_SERDES_REG		0x4c
+
+static void qca955x_device_reset_clear(unsigned int mask)
+{
+	unsigned int t, reg;
+
+	reg = KSEG1ADDR(AR71XX_RESET_BASE +
+			QCA955X_RESET_REG_RESET_MODULE);
+
+	t = READREG(reg);
+	WRITEREG(reg, t & ~mask);
+}
+
+static void mr18_setup_qca955x_eth_serdes_cal(unsigned int sgmii_value)
+{
+	unsigned int ethbase, pllbase, t;
+
+	ethbase = KSEG1ADDR(QCA955X_GMAC_BASE);
+	pllbase = KSEG1ADDR(AR71XX_PLL_BASE);
+
+	/* To Check the locking of the SGMII PLL */
+	t = READREG(ethbase + QCA955X_GMAC_REG_SGMII_SERDES);
+	t &= ~(QCA955X_SGMII_SERDES_RES_CALIBRATION_MASK <<
+	       QCA955X_SGMII_SERDES_RES_CALIBRATION_SHIFT);
+	t |= (sgmii_value & QCA955X_SGMII_SERDES_RES_CALIBRATION_MASK) <<
+	     QCA955X_SGMII_SERDES_RES_CALIBRATION_SHIFT;
+	WRITEREG(ethbase + QCA955X_GMAC_REG_SGMII_SERDES, t);
+
+	WRITEREG(pllbase + QCA955X_PLL_ETH_SGMII_SERDES_REG,
+		 QCA955X_PLL_ETH_SGMII_SERDES_LOCK_DETECT |
+		 QCA955X_PLL_ETH_SGMII_SERDES_PLL_REFCLK |
+		 QCA955X_PLL_ETH_SGMII_SERDES_EN_PLL)
+		;
+
+	qca955x_device_reset_clear(QCA955X_RESET_SGMII_ANALOG);
+	qca955x_device_reset_clear(QCA955X_RESET_SGMII);
+
+	while (!(READREG(ethbase + QCA955X_GMAC_REG_SGMII_SERDES) &
+		QCA955X_SGMII_SERDES_LOCK_DETECT_STATUS))
+		;
+}
+
+static inline void mr18_init(void)
+{
+	int res;
+
+	printf("Meraki MR18\n");
+
+	res = mr18_extract_sgmii_res_cal();
+	if (res >= 0)
+		mr18_setup_qca955x_eth_serdes_cal(res);
+
+}
+#else
+static inline void mr18_init(void) { }
+#endif
+
 void board_init(void)
 {
 	tlwr1043nd_init();
+	mr18_init();
 }
diff --git a/target/linux/ath79/image/mikrotik.mk b/target/linux/ath79/image/mikrotik.mk
index c90579fbb58d65..3f65b35c8c5627 100644
--- a/target/linux/ath79/image/mikrotik.mk
+++ b/target/linux/ath79/image/mikrotik.mk
@@ -9,6 +9,16 @@ define Device/mikrotik_routerboard-493g
 endef
 TARGET_DEVICES += mikrotik_routerboard-493g
 
+define Device/mikrotik_routerboard-911-lite
+  $(Device/mikrotik_nor)
+  SOC := ar9344
+  DEVICE_MODEL := RouterBOARD 911 Lite2/Lite5 (2Hn/5Hn)
+  DEVICE_PACKAGES += rssileds
+  IMAGE_SIZE := 16256k
+  SUPPORTED_DEVICES += rb-911-2hn rb-911-5hn
+endef
+TARGET_DEVICES += mikrotik_routerboard-911-lite
+
 define Device/mikrotik_routerboard-912uag-2hpnd
   $(Device/mikrotik_nand)
   SOC := ar9342
@@ -38,6 +48,15 @@ define Device/mikrotik_routerboard-922uags-5hpacd
 endef
 TARGET_DEVICES += mikrotik_routerboard-922uags-5hpacd
 
+define Device/mikrotik_routerboard-951ui-2hnd
+  $(Device/mikrotik_nand)
+  SOC := ar9344
+  DEVICE_MODEL := RouterBOARD 951Ui-2HnD
+  DEVICE_PACKAGES += kmod-usb-ohci kmod-usb2
+  SUPPORTED_DEVICES += rb-951ui-2hnd
+endef
+TARGET_DEVICES += mikrotik_routerboard-951ui-2hnd
+
 define Device/mikrotik_routerboard-951ui-2nd
   $(Device/mikrotik_nor)
   SOC := qca9531
diff --git a/target/linux/ath79/image/nand.mk b/target/linux/ath79/image/nand.mk
index 117f6e99cd6173..84a589809f0cda 100644
--- a/target/linux/ath79/image/nand.mk
+++ b/target/linux/ath79/image/nand.mk
@@ -11,6 +11,14 @@ define Build/dongwon-header
 	mv $@.tmp $@
 endef
 
+define Build/meraki-header
+        -$(STAGING_DIR_HOST)/bin/mkmerakifw \
+                -B $(1) -s \
+                -i $@ \
+                -o $@.new
+        @mv $@.new $@
+endef
+
 # attention: only zlib compression is allowed for the boot fs
 define Build/zyxel-buildkerneljffs
 	mkdir -p $@.tmp/boot
@@ -199,7 +207,8 @@ define Device/glinet_gl-xe300
   SOC := qca9531
   DEVICE_VENDOR := GL.iNet
   DEVICE_MODEL := GL-XE300
-  DEVICE_PACKAGES := kmod-usb2 block-mount kmod-usb-serial-ch341
+  DEVICE_PACKAGES := kmod-usb2 block-mount kmod-usb-serial-ch341 \
+	kmod-usb-net-qmi-wwan uqmi
   KERNEL_SIZE := 4096k
   IMAGE_SIZE := 131072k
   PAGESIZE := 2048
@@ -211,7 +220,72 @@ define Device/glinet_gl-xe300
 endef
 TARGET_DEVICES += glinet_gl-xe300
 
-# fake rootfs is mandatory, pad-offset 129 equals (2 * uimage_header + 0xff)
+define Device/glinet_gl-x1200-common
+  SOC := qca9563
+  DEVICE_VENDOR := GL.iNet
+  DEVICE_MODEL := GL-X1200
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9888-ct-htt kmod-usb2 \
+	kmod-usb-storage block-mount kmod-usb-net-qmi-wwan uqmi
+  IMAGE_SIZE := 16000k
+endef
+
+define Device/glinet_gl-x1200-nor-nand
+  $(Device/glinet_gl-x1200-common)
+  DEVICE_VARIANT := NOR/NAND
+  KERNEL_SIZE := 4096k
+  IMAGE_SIZE := 131072k
+  PAGESIZE := 2048
+  VID_HDR_OFFSET := 2048
+  BLOCKSIZE := 128k
+  IMAGES += factory.img
+  IMAGE/factory.img := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-ubi
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += glinet_gl-x1200-nor-nand
+
+define Device/glinet_gl-x1200-nor
+  $(Device/glinet_gl-x1200-common)
+  DEVICE_VARIANT := NOR
+endef
+TARGET_DEVICES += glinet_gl-x1200-nor
+
+define Device/linksys_ea4500-v3
+  SOC := qca9558
+  DEVICE_VENDOR := Linksys
+  DEVICE_MODEL := EA4500
+  DEVICE_VARIANT := v3
+  DEVICE_PACKAGES := kmod-usb2
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_SIZE := 4096k
+  IMAGE_SIZE := 81920k
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  LINKSYS_HWNAME := EA4500V3
+  IMAGES += factory.img
+  IMAGE/factory.img := append-kernel | pad-to $$$$(KERNEL_SIZE) | \
+	append-ubi | check-size | linksys-image type=$$$$(LINKSYS_HWNAME)
+  UBINIZE_OPTS := -E 5
+endef
+TARGET_DEVICES += linksys_ea4500-v3
+
+define Device/meraki_mr18
+  SOC := qca9557
+  DEVICE_VENDOR := Meraki
+  DEVICE_MODEL := MR18
+  DEVICE_PACKAGES := kmod-leds-uleds kmod-spi-gpio nu801
+  KERNEL_SIZE := 8m
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  LOADER_TYPE := bin
+  KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | meraki-header MR18
+# Initramfs-build fails due to size issues
+# KERNEL_INITRAMFS := $$(KERNEL)
+  KERNEL_INITRAMFS :=
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += meraki_mr18
+
+# fake rootfs is mandatory, pad-offset 64 equals (1 * uimage_header)
 define Device/netgear_ath79_nand
   DEVICE_VENDOR := NETGEAR
   DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport
@@ -219,15 +293,12 @@ define Device/netgear_ath79_nand
   BLOCKSIZE := 128k
   PAGESIZE := 2048
   IMAGE_SIZE := 25600k
-  KERNEL := kernel-bin | append-dtb | lzma -d20 | \
-	pad-offset $$(KERNEL_SIZE) 129 | uImage lzma | \
-	append-string -e '\xff' | \
-	append-uImage-fakehdr filesystem $$(UIMAGE_MAGIC)
-  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma -d20 | uImage lzma
+  KERNEL := kernel-bin | append-dtb | lzma | uImage lzma | \
+	pad-offset $$(BLOCKSIZE) 64 | append-uImage-fakehdr filesystem $$(UIMAGE_MAGIC)
   IMAGES := sysupgrade.bin factory.img
-  IMAGE/factory.img := append-kernel | append-ubi | netgear-dni | \
-	check-size
-  IMAGE/sysupgrade.bin := sysupgrade-tar | check-size | append-metadata
+  IMAGE/factory.img := append-kernel | pad-to $$$$(KERNEL_SIZE) | \
+	append-ubi | check-size | netgear-dni
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   UBINIZE_OPTS := -E 5
 endef
 
@@ -243,8 +314,7 @@ define Device/netgear_pgzng1
   IMAGE_SIZE := 83968k
   PAGESIZE := 2048
   BLOCKSIZE := 128k
-  KERNEL := kernel-bin | append-dtb | lzma | uImage lzma
-  IMAGE/sysupgrade.bin := sysupgrade-tar | check-size | append-metadata
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
 endef
 TARGET_DEVICES += netgear_pgzng1
 
@@ -345,12 +415,20 @@ define Device/zte_mf281
 endef
 TARGET_DEVICES += zte_mf281
 
-define Device/zte_mf286
+define Device/zte_mf282
   $(Device/zte_mf28x_common)
-  DEVICE_MODEL := MF286
+  DEVICE_MODEL := MF282
   DEVICE_PACKAGES += ath10k-firmware-qca988x-ct kmod-usb-net-qmi-wwan \
 	kmod-usb-serial-option uqmi
 endef
+TARGET_DEVICES += zte_mf282
+
+define Device/zte_mf286
+  $(Device/zte_mf28x_common)
+  DEVICE_MODEL := MF286
+  DEVICE_PACKAGES += ath10k-firmware-qca988x-ct ath10k-firmware-qca9888-ct \
+	kmod-usb-net-qmi-wwan kmod-usb-serial-option uqmi
+endef
 TARGET_DEVICES += zte_mf286
 
 define Device/zte_mf286a
diff --git a/target/linux/ath79/image/tiny-tp-link.mk b/target/linux/ath79/image/tiny-tp-link.mk
index 30474149d3aee4..93cbc7d148cfd3 100644
--- a/target/linux/ath79/image/tiny-tp-link.mk
+++ b/target/linux/ath79/image/tiny-tp-link.mk
@@ -234,6 +234,7 @@ define Device/tplink_tl-wpa8630p-v2
     so the JFFS2 settings partition MUST be reformatted to avoid data corruption. \
     Backup your settings before upgrading, then during sysupgrade, \
     de-select "Keep settings" and select "Force" to continue (equivilant to "sysupgrade -n -F").
+  DEFAULT := n
 endef
 
 define Device/tplink_tl-wpa8630p-v2-int
diff --git a/target/linux/ath79/image/tiny-ubnt.mk b/target/linux/ath79/image/tiny-ubnt.mk
index 805d193d454664..07333714418f2a 100644
--- a/target/linux/ath79/image/tiny-ubnt.mk
+++ b/target/linux/ath79/image/tiny-ubnt.mk
@@ -5,6 +5,7 @@ define Device/ubnt_airrouter
   SOC := ar7241
   DEVICE_MODEL := AirRouter
   SUPPORTED_DEVICES += airrouter
+  DEFAULT := n
 endef
 TARGET_DEVICES += ubnt_airrouter
 
@@ -14,6 +15,7 @@ define Device/ubnt_nanobridge-m
   DEVICE_MODEL := NanoBridge M
   DEVICE_PACKAGES += rssileds
   SUPPORTED_DEVICES += bullet-m
+  DEFAULT := n
 endef
 TARGET_DEVICES += ubnt_nanobridge-m
 
@@ -24,6 +26,7 @@ define Device/ubnt_bullet-m-ar7240
   DEVICE_VARIANT := XM (AR7240)
   DEVICE_PACKAGES += rssileds
   SUPPORTED_DEVICES += bullet-m
+  DEFAULT := n
 endef
 TARGET_DEVICES += ubnt_bullet-m-ar7240
 
@@ -34,6 +37,7 @@ define Device/ubnt_bullet-m-ar7241
   DEVICE_VARIANT := XM (AR7241)
   DEVICE_PACKAGES += rssileds
   SUPPORTED_DEVICES += bullet-m ubnt,bullet-m
+  DEFAULT := n
 endef
 TARGET_DEVICES += ubnt_bullet-m-ar7241
 
@@ -43,6 +47,7 @@ define Device/ubnt_picostation-m
   DEVICE_MODEL := Picostation M
   DEVICE_PACKAGES += rssileds
   SUPPORTED_DEVICES += bullet-m
+  DEFAULT := n
 endef
 TARGET_DEVICES += ubnt_picostation-m
 
@@ -52,6 +57,7 @@ define Device/ubnt_nanostation-m
   DEVICE_MODEL := Nanostation M
   DEVICE_PACKAGES += rssileds
   SUPPORTED_DEVICES += nanostation-m
+  DEFAULT := n
 endef
 TARGET_DEVICES += ubnt_nanostation-m
 
@@ -61,6 +67,7 @@ define Device/ubnt_nanostation-loco-m
   DEVICE_MODEL := Nanostation Loco M
   DEVICE_PACKAGES += rssileds
   SUPPORTED_DEVICES += bullet-m
+  DEFAULT := n
 endef
 TARGET_DEVICES += ubnt_nanostation-loco-m
 
diff --git a/target/linux/ath79/image/tiny.mk b/target/linux/ath79/image/tiny.mk
index 0f355ef9142ed2..6baa3afff79b31 100644
--- a/target/linux/ath79/image/tiny.mk
+++ b/target/linux/ath79/image/tiny.mk
@@ -76,5 +76,6 @@ define Device/pqi_air-pen
   DEVICE_PACKAGES := kmod-usb-chipidea2
   IMAGE_SIZE := 7680k
   SUPPORTED_DEVICES += pqi-air-pen
+  DEFAULT := n
 endef
 TARGET_DEVICES += pqi_air-pen
diff --git a/target/linux/ath79/mikrotik/base-files/etc/board.d/01_leds b/target/linux/ath79/mikrotik/base-files/etc/board.d/01_leds
index 76b91a54a5f28e..31346ebdf581bf 100644
--- a/target/linux/ath79/mikrotik/base-files/etc/board.d/01_leds
+++ b/target/linux/ath79/mikrotik/base-files/etc/board.d/01_leds
@@ -6,6 +6,17 @@ board_config_update
 board=$(board_name)
 
 case "$board" in
+mikrotik,routerboard-911-lite|\
+mikrotik,routerboard-lhg-5nd)
+	ucidef_set_led_netdev "lan" "lan" "green:lan" "eth0"
+	ucidef_set_rssimon "wlan0" "200000" "1"
+	ucidef_set_led_rssi "rssilow" "rssilow" "green:rssilow" "wlan0" "1" "100"
+	ucidef_set_led_rssi "rssimediumlow" "rssimediumlow" "green:rssimediumlow" "wlan0" "20" "100"
+	ucidef_set_led_rssi "rssimedium" "rssimedium" "green:rssimedium" "wlan0" "40" "100"
+	ucidef_set_led_rssi "rssimediumhigh" "rssimediumhigh" "green:rssimediumhigh" "wlan0" "60" "100"
+	ucidef_set_led_rssi "rssihigh" "rssihigh" "green:rssihigh" "wlan0" "80" "100"
+	;;
+mikrotik,routerboard-951ui-2hnd|\
 mikrotik,routerboard-951ui-2nd|\
 mikrotik,routerboard-952ui-5ac2nd)
 	ucidef_set_led_netdev "port1" "port1" "green:port1" "eth1"
@@ -19,15 +30,6 @@ mikrotik,routerboard-mapl-2nd|\
 mikrotik,routerboard-wap-2nd)
 	ucidef_set_led_netdev "lan" "lan" "green:lan" "eth0"
 	;;
-mikrotik,routerboard-lhg-5nd)
-	ucidef_set_led_netdev "lan" "lan" "green:lan" "eth0"
-	ucidef_set_rssimon "wlan0" "200000" "1"
-	ucidef_set_led_rssi "rssilow" "rssilow" "green:rssilow" "wlan0" "1" "100"
-	ucidef_set_led_rssi "rssimediumlow" "rssimediumlow" "green:rssimediumlow" "wlan0" "20" "100"
-	ucidef_set_led_rssi "rssimedium" "rssimedium" "green:rssimedium" "wlan0" "40" "100"
-	ucidef_set_led_rssi "rssimediumhigh" "rssimediumhigh" "green:rssimediumhigh" "wlan0" "60" "100"
-	ucidef_set_led_rssi "rssihigh" "rssihigh" "green:rssihigh" "wlan0" "80" "100"
-	;;
 mikrotik,routerboard-map-2nd)
 	ucidef_set_led_netdev "eth_1" "eth_1" "green:eth_1" "eth1"
 	ucidef_set_led_switch "eth_2" "eth_2" "green:eth_2" "switch0" "0x4"
diff --git a/target/linux/ath79/mikrotik/base-files/etc/board.d/02_network b/target/linux/ath79/mikrotik/base-files/etc/board.d/02_network
index 5646d8cf68a7f9..aba811fb2d15a7 100644
--- a/target/linux/ath79/mikrotik/base-files/etc/board.d/02_network
+++ b/target/linux/ath79/mikrotik/base-files/etc/board.d/02_network
@@ -14,6 +14,7 @@ ath79_setup_interfaces()
 		ucidef_add_switch "switch1" \
 			"0@eth1" "1:lan:4" "2:lan:1" "3:lan:2" "4:lan:3"
 		;;
+	mikrotik,routerboard-911-lite|\
 	mikrotik,routerboard-912uag-2hpnd|\
 	mikrotik,routerboard-lhg-2nd|\
 	mikrotik,routerboard-lhg-5nd|\
@@ -24,6 +25,7 @@ ath79_setup_interfaces()
 	mikrotik,routerboard-wapr-2nd)
 		ucidef_set_interface_lan "eth0"
 		;;
+	mikrotik,routerboard-951ui-2hnd|\
 	mikrotik,routerboard-951ui-2nd|\
 	mikrotik,routerboard-952ui-5ac2nd)
 		ucidef_set_interface_wan "eth1"
@@ -52,6 +54,7 @@ ath79_setup_macs()
 	local mac_base="$(cat /sys/firmware/mikrotik/hard_config/mac_base)"
 
 	case "$board" in
+	mikrotik,routerboard-911-lite|\
 	mikrotik,routerboard-912uag-2hpnd|\
 	mikrotik,routerboard-lhg-2nd|\
 	mikrotik,routerboard-lhg-5nd|\
diff --git a/target/linux/ath79/mikrotik/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom b/target/linux/ath79/mikrotik/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
index aa5354bfdb37de..b23bd05bcd5567 100644
--- a/target/linux/ath79/mikrotik/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
+++ b/target/linux/ath79/mikrotik/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
@@ -23,6 +23,7 @@ board=$(board_name)
 case "$FIRMWARE" in
 "ath9k-eeprom-ahb-18100000.wmac.bin")
 	case $board in
+	mikrotik,routerboard-911-lite|\
 	mikrotik,routerboard-912uag-2hpnd|\
 	mikrotik,routerboard-lhg-2nd|\
 	mikrotik,routerboard-lhg-5nd|\
@@ -45,6 +46,9 @@ case "$FIRMWARE" in
 	mikrotik,routerboard-962uigs-5hact2hnt)
 		caldata_mikrotik_ath9k 0x1000 0x440 $(macaddr_add "$mac_base" 7)
 		;;
+	mikrotik,routerboard-951ui-2hnd)
+		caldata_mikrotik_ath9k 0x1000 0x440 $(macaddr_add "$mac_base" +11)
+		;;
 	*)
 		caldata_die "board $board is not supported yet"
 		;;
diff --git a/target/linux/ath79/mikrotik/base-files/lib/upgrade/platform.sh b/target/linux/ath79/mikrotik/base-files/lib/upgrade/platform.sh
index 6962c6fdcc508c..cefbc5d3341513 100644
--- a/target/linux/ath79/mikrotik/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ath79/mikrotik/base-files/lib/upgrade/platform.sh
@@ -7,8 +7,7 @@ platform_check_image() {
 	return 0
 }
 
-RAMFS_COPY_BIN='fw_printenv fw_setenv nandwrite'
-RAMFS_COPY_DATA='/etc/fw_env.config /var/lock/fw_printenv.lock'
+RAMFS_COPY_BIN='yafut'
 
 platform_do_upgrade_mikrotik_nand() {
 	CI_KERNPART=none
@@ -21,8 +20,7 @@ platform_do_upgrade_mikrotik_nand() {
 	board_dir=${board_dir%/}
 	[ -n "$board_dir" ] || return
 
-	mtd erase kernel
-	tar xf "$1" ${board_dir}/kernel -O | nandwrite -o "$fw_mtd" -
+	tar xf "$1" ${board_dir}/kernel -O | yafut -d "$fw_mtd" -w -i - -o kernel -m 0755 || return
 
 	nand_do_upgrade "$1"
 }
@@ -35,6 +33,7 @@ platform_do_upgrade() {
 	mikrotik,routerboard-912uag-2hpnd|\
 	mikrotik,routerboard-921gs-5hpacd-15s|\
 	mikrotik,routerboard-922uags-5hpacd|\
+	mikrotik,routerboard-951ui-2hnd|\
 	mikrotik,routerboard-sxt-5nd-r2)
 		platform_do_upgrade_mikrotik_nand "$1"
 		;;
diff --git a/target/linux/ath79/mikrotik/target.mk b/target/linux/ath79/mikrotik/target.mk
index f5df9044875060..a3c876d7a79e23 100644
--- a/target/linux/ath79/mikrotik/target.mk
+++ b/target/linux/ath79/mikrotik/target.mk
@@ -3,7 +3,7 @@ FEATURES += minor nand
 KERNELNAME := vmlinux vmlinuz
 IMAGES_DIR := ../../..
 
-DEFAULT_PACKAGES += wpad-basic-wolfssl
+DEFAULT_PACKAGES += wpad-basic-mbedtls yafut
 
 define Target/Description
 	Build firmware images for MikroTik devices based on Qualcomm Atheros
diff --git a/target/linux/ath79/nand/base-files/etc/board.d/02_network b/target/linux/ath79/nand/base-files/etc/board.d/02_network
index b252d7d9e88fe3..60f085d3783c90 100644
--- a/target/linux/ath79/nand/base-files/etc/board.d/02_network
+++ b/target/linux/ath79/nand/base-files/etc/board.d/02_network
@@ -8,7 +8,8 @@ ath79_setup_interfaces()
 
 	case "$board" in
 	aerohive,hiveap-121|\
-	glinet,gl-e750)
+	glinet,gl-e750|\
+	meraki,mr18)
 		ucidef_set_interface_lan "eth0"
 		;;
 	domywifi,dw33d)
@@ -30,6 +31,15 @@ ath79_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"0@eth0" "4:lan"
 		;;
+	glinet,gl-x1200-nor|\
+	glinet,gl-x1200-nor-nand)
+		ucidef_add_switch "switch0" \
+			"0@eth0" "1:lan:4" "2:lan:3" "3:lan:2" "4:lan:1" "5:wan"
+		;;
+	linksys,ea4500-v3)
+		ucidef_add_switch "switch0" \
+			"6@eth1" "1:lan" "2:lan" "3:lan" "4:lan" "5:wan" "0@eth0"
+		;;
 	netgear,pgzng1)
 		ucidef_set_interfaces_lan_wan "eth1" "eth0"
 		;;
@@ -57,6 +67,10 @@ ath79_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"0@eth0" "5:lan"
 		;;
+	zte,mf282)
+		ucidef_set_interface_lan "eth0"
+		ucidef_set_interface "wan" device "/dev/cdc-wdm0" protocol "qmi"
+		;;
 	zte,mf286|\
 	zte,mf286a|\
 	zte,mf286r)
@@ -84,6 +98,14 @@ ath79_setup_macs()
 		wan_mac=$(mtd_get_mac_binary art 0x0)
 		label_mac=$wan_mac
 		;;
+	glinet,gl-x1200-nor|\
+	glinet,gl-x1200-nor-nand)
+		wan_mac=$(mtd_get_mac_binary art 0x0)
+		lan_mac=$(macaddr_add "$wan_mac" 1)
+		;;
+	meraki,mr18)
+		lan_mac=$(mtd_get_mac_binary_ubi board-config 102)
+		;;
 	netgear,wndr3700-v4|\
 	netgear,wndr4300|\
 	netgear,wndr4300sw|\
diff --git a/target/linux/ath79/nand/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom b/target/linux/ath79/nand/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
index cac955905af138..c4ccb04f5bc765 100644
--- a/target/linux/ath79/nand/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
+++ b/target/linux/ath79/nand/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
@@ -12,13 +12,15 @@ case "$FIRMWARE" in
 	8dev,rambutan)
 		caldata_extract "caldata" 0x1000 0x800
 		;;
-	netgear,wndr3700-v4|\
-	netgear,wndr4300|\
-	netgear,wndr4300sw|\
-	netgear,wndr4300tn|\
-	netgear,wndr4300-v2|\
-	netgear,wndr4500-v3)
-		caldata_extract "caldata" 0x1000 0x440
+	meraki,mr18)
+		. /lib/upgrade/nand.sh
+
+		if [ -n "$(nand_find_volume ubi0 caldata)" ]; then
+			caldata_extract_ubi "caldata" 0x1000 0x440
+		else
+			caldata_extract "odm-caldata" 0x1000 0x440
+		fi
+		ath9k_patch_mac $(macaddr_add $(mtd_get_mac_binary_ubi board-config 102) 1)
 		;;
 	*)
 		caldata_die "board $board is not supported yet"
@@ -27,13 +29,32 @@ case "$FIRMWARE" in
 	;;
 "ath9k-eeprom-pci-0000:00:00.0.bin")
 	case $board in
-	netgear,wndr3700-v4|\
-	netgear,wndr4300|\
-	netgear,wndr4300sw|\
-	netgear,wndr4300tn|\
-	netgear,wndr4300-v2|\
-	netgear,wndr4500-v3)
-		caldata_extract "caldata" 0x5000 0x440
+	meraki,mr18)
+		. /lib/upgrade/nand.sh
+
+		if [ -n "$(nand_find_volume ubi0 caldata)" ]; then
+			caldata_extract_ubi "caldata" 0x5000 0x440
+		else
+			caldata_extract "odm-caldata" 0x5000 0x440
+		fi
+		ath9k_patch_mac $(macaddr_add $(mtd_get_mac_binary_ubi board-config 102) 2)
+		;;
+	*)
+		caldata_die "board $board is not supported yet"
+		;;
+	esac
+	;;
+"ath9k-eeprom-pci-0000:01:00.0.bin")
+	case $board in
+	meraki,mr18)
+		. /lib/upgrade/nand.sh
+
+		if [ -n "$(nand_find_volume ubi0 caldata)" ]; then
+			caldata_extract_ubi "caldata" 0x9000 0x440
+		else
+			caldata_extract "odm-caldata" 0x9000 0x440
+		fi
+		ath9k_patch_mac $(macaddr_add $(mtd_get_mac_binary_ubi board-config 102) 3)
 		;;
 	*)
 		caldata_die "board $board is not supported yet"
diff --git a/target/linux/ath79/nand/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ath79/nand/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
index e5c26d6bb5dc8f..d26625981ee3a8 100644
--- a/target/linux/ath79/nand/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+++ b/target/linux/ath79/nand/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
@@ -18,9 +18,6 @@ case "$FIRMWARE" in
 		caldata_extract "art" 0x5000 0x844
 		ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary art 0x0) 1)
 		;;
-	netgear,r6100)
-		caldata_extract "caldata" 0x5000 0x844
-		;;
 	zyxel,emg2926-q10a|\
 	zyxel,nbg6716)
 		caldata_extract "art" 0x5000 0x844
diff --git a/target/linux/ath79/nand/base-files/etc/init.d/bootcount b/target/linux/ath79/nand/base-files/etc/init.d/bootcount
index 87654ba095ed71..4d7a814f05a8c1 100755
--- a/target/linux/ath79/nand/base-files/etc/init.d/bootcount
+++ b/target/linux/ath79/nand/base-files/etc/init.d/bootcount
@@ -8,5 +8,9 @@ boot() {
 	glinet,gl-ar300m-nand)
 		fw_setenv bootcount 0
 		;;
+	linksys,ea4500-v3)
+		[ $(fw_printenv -n auto_recovery) = yes ] && \
+			fw_setenv auto_recovery no
+		;;
 	esac
 }
diff --git a/target/linux/ath79/nand/base-files/lib/upgrade/platform.sh b/target/linux/ath79/nand/base-files/lib/upgrade/platform.sh
index ea77345b061d5b..5a4f76ba51645c 100644
--- a/target/linux/ath79/nand/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ath79/nand/base-files/lib/upgrade/platform.sh
@@ -19,7 +19,9 @@ platform_do_upgrade() {
 		glinet_nand_nor_do_upgrade "$1"
 		;;
 	glinet,gl-ar750s-nor|\
-	glinet,gl-ar750s-nor-nand)
+	glinet,gl-ar750s-nor-nand|\
+	glinet,gl-x1200-nor|\
+	glinet,gl-x1200-nor-nand)
 		nand_nor_do_upgrade "$1"
 		;;
 	*)
diff --git a/target/linux/ath79/nand/config-default b/target/linux/ath79/nand/config-default
index c04a3d19900d8e..3072feea2f2c8b 100644
--- a/target/linux/ath79/nand/config-default
+++ b/target/linux/ath79/nand/config-default
@@ -8,6 +8,7 @@ CONFIG_LZO_DECOMPRESS=y
 CONFIG_MTD_NAND=y
 CONFIG_MTD_NAND_AR934X=y
 CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC_SW_BCH=y
 CONFIG_MTD_RAW_NAND=y
 CONFIG_MTD_SPI_NAND=y
 CONFIG_MTD_UBI=y
diff --git a/target/linux/ath79/nand/target.mk b/target/linux/ath79/nand/target.mk
index 7ea9b57f45d5fb..e0900abfe45fa6 100644
--- a/target/linux/ath79/nand/target.mk
+++ b/target/linux/ath79/nand/target.mk
@@ -2,7 +2,7 @@ BOARDNAME := Generic devices with NAND flash
 
 FEATURES += nand
 
-DEFAULT_PACKAGES += wpad-basic-wolfssl
+DEFAULT_PACKAGES += wpad-basic-mbedtls
 
 define Target/Description
 	Firmware for boards using Qualcomm Atheros, MIPS-based SoCs
diff --git a/target/linux/ath79/patches-5.15/0003-leds-add-reset-controller-based-driver.patch b/target/linux/ath79/patches-5.15/0003-leds-add-reset-controller-based-driver.patch
index f958e79608ac9f..7122756c526687 100644
--- a/target/linux/ath79/patches-5.15/0003-leds-add-reset-controller-based-driver.patch
+++ b/target/linux/ath79/patches-5.15/0003-leds-add-reset-controller-based-driver.patch
@@ -13,9 +13,9 @@ Signed-off-by: John Crispin <john@phrozen.org>
 
 --- a/drivers/leds/Kconfig
 +++ b/drivers/leds/Kconfig
-@@ -886,6 +886,17 @@ config LEDS_UBNT_LEDBAR
- 	  To compile this driver as a module, choose M here: the module
- 	  will be called leds-ubnt-ledbar.
+@@ -876,6 +876,17 @@ source "drivers/leds/blink/Kconfig"
+ comment "Flash and Torch LED drivers"
+ source "drivers/leds/flash/Kconfig"
  
 +config LEDS_RESET
 +	tristate "LED support for reset-controller API"
@@ -176,10 +176,10 @@ Signed-off-by: John Crispin <john@phrozen.org>
 +MODULE_ALIAS("platform:leds-reset");
 --- a/drivers/leds/Makefile
 +++ b/drivers/leds/Makefile
-@@ -88,6 +88,7 @@ obj-$(CONFIG_LEDS_WM831X_STATUS)	+= leds
+@@ -87,6 +87,7 @@ obj-$(CONFIG_LEDS_TURRIS_OMNIA)		+= leds
+ obj-$(CONFIG_LEDS_WM831X_STATUS)	+= leds-wm831x-status.o
  obj-$(CONFIG_LEDS_WM8350)		+= leds-wm8350.o
  obj-$(CONFIG_LEDS_WRAP)			+= leds-wrap.o
- obj-$(CONFIG_LEDS_UBNT_LEDBAR)		+= leds-ubnt-ledbar.o
 +obj-$(CONFIG_LEDS_RESET)		+= leds-reset.o
  
  # LED SPI Drivers
diff --git a/target/linux/ath79/patches-5.15/0018-MIPS-pci-ar71xx-convert-to-OF.patch b/target/linux/ath79/patches-5.15/0018-MIPS-pci-ar71xx-convert-to-OF.patch
index e600a4f0d9459e..9a315aed0b2655 100644
--- a/target/linux/ath79/patches-5.15/0018-MIPS-pci-ar71xx-convert-to-OF.patch
+++ b/target/linux/ath79/patches-5.15/0018-MIPS-pci-ar71xx-convert-to-OF.patch
@@ -141,7 +141,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
  	irq_set_chained_handler_and_data(apc->irq, ar71xx_pci_irq_handler,
  					 apc);
  }
-@@ -325,6 +337,11 @@ static void ar71xx_pci_reset(void)
+@@ -325,10 +337,14 @@ static void ar71xx_pci_reset(void)
  	mdelay(100);
  }
  
@@ -153,7 +153,11 @@ Signed-off-by: John Crispin <john@phrozen.org>
  static int ar71xx_pci_probe(struct platform_device *pdev)
  {
  	struct ar71xx_pci_controller *apc;
-@@ -345,26 +362,6 @@ static int ar71xx_pci_probe(struct platf
+-	struct resource *res;
+ 	u32 t;
+ 
+ 	apc = devm_kzalloc(&pdev->dev, sizeof(struct ar71xx_pci_controller),
+@@ -345,26 +361,6 @@ static int ar71xx_pci_probe(struct platf
  	if (apc->irq < 0)
  		return -EINVAL;
  
@@ -180,7 +184,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
  	ar71xx_pci_reset();
  
  	/* setup COMMAND register */
-@@ -377,9 +374,11 @@ static int ar71xx_pci_probe(struct platf
+@@ -377,9 +373,11 @@ static int ar71xx_pci_probe(struct platf
  
  	ar71xx_pci_irq_init(apc);
  
@@ -192,7 +196,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
  
  	register_pci_controller(&apc->pci_ctrl);
  
-@@ -390,6 +389,7 @@ static struct platform_driver ar71xx_pci
+@@ -390,6 +388,7 @@ static struct platform_driver ar71xx_pci
  	.probe = ar71xx_pci_probe,
  	.driver = {
  		.name = "ar71xx-pci",
diff --git a/target/linux/ath79/patches-5.15/0020-MIPS-pci-ar724x-convert-to-OF.patch b/target/linux/ath79/patches-5.15/0020-MIPS-pci-ar724x-convert-to-OF.patch
index 2772c533928be4..7927c1cbf5f87c 100644
--- a/target/linux/ath79/patches-5.15/0020-MIPS-pci-ar724x-convert-to-OF.patch
+++ b/target/linux/ath79/patches-5.15/0020-MIPS-pci-ar724x-convert-to-OF.patch
@@ -154,7 +154,15 @@ Signed-off-by: John Crispin <john@phrozen.org>
  	irq_set_chained_handler_and_data(apc->irq, ar724x_pci_irq_handler,
  					 apc);
  }
-@@ -388,29 +396,11 @@ static int ar724x_pci_probe(struct platf
+@@ -360,7 +368,6 @@ static void ar724x_pci_hw_init(struct ar
+ static int ar724x_pci_probe(struct platform_device *pdev)
+ {
+ 	struct ar724x_pci_controller *apc;
+-	struct resource *res;
+ 	int id;
+ 
+ 	id = pdev->id;
+@@ -388,29 +395,11 @@ static int ar724x_pci_probe(struct platf
  	if (apc->irq < 0)
  		return -EINVAL;
  
@@ -186,7 +194,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
  
  	/*
  	 * Do the full PCIE Root Complex Initialization Sequence if the PCIe
-@@ -432,10 +422,16 @@ static int ar724x_pci_probe(struct platf
+@@ -432,10 +421,16 @@ static int ar724x_pci_probe(struct platf
  	return 0;
  }
  
diff --git a/target/linux/ath79/patches-5.15/0034-MIPS-ath79-ath9k-exports.patch b/target/linux/ath79/patches-5.15/0034-MIPS-ath79-ath9k-exports.patch
index 71acc22210a246..e460fe58f3fc04 100644
--- a/target/linux/ath79/patches-5.15/0034-MIPS-ath79-ath9k-exports.patch
+++ b/target/linux/ath79/patches-5.15/0034-MIPS-ath79-ath9k-exports.patch
@@ -1,3 +1,12 @@
+From: John Crispin <john@phrozen.org>
+Subject: [PATCH] ath79: make ahb wifi work
+
+Submitted-by: John Crispin <john@phrozen.org>
+---
+ arch/mips/ath79/common.c                      | 3 +++
+ mips/include/asm/mach-ath79/ath79.h           | 1+
+ 1 file changed, 4 insertions(+)
+
 --- a/arch/mips/ath79/common.c
 +++ b/arch/mips/ath79/common.c
 @@ -31,11 +31,13 @@ EXPORT_SYMBOL_GPL(ath79_ddr_freq);
diff --git a/target/linux/ath79/patches-5.15/0036-MIPS-ath79-remove-irq-code-from-pci.patch b/target/linux/ath79/patches-5.15/0036-MIPS-ath79-remove-irq-code-from-pci.patch
index 80fcd0a7f55a3c..01549eec68d342 100644
--- a/target/linux/ath79/patches-5.15/0036-MIPS-ath79-remove-irq-code-from-pci.patch
+++ b/target/linux/ath79/patches-5.15/0036-MIPS-ath79-remove-irq-code-from-pci.patch
@@ -1,3 +1,13 @@
+From: John Crispin <john@phrozen.org>
+Subject: ath79: fix remove irq code from pci driver patch
+
+This patch got mangled in the void while rebasing it.
+
+Submitted-by: John Crispin <john@phrozen.org>
+---
+ arch/mips/pci/pci-ar71xx.c                    | 107 ------------------
+ 1 file changed, 141 deletions(-)
+
 --- a/arch/mips/pci/pci-ar71xx.c
 +++ b/arch/mips/pci/pci-ar71xx.c
 @@ -51,11 +51,9 @@
@@ -117,7 +127,7 @@
  static void ar71xx_pci_reset(void)
  {
  	ath79_device_reset_set(AR71XX_RESET_PCI_BUS | AR71XX_RESET_PCI_CORE);
-@@ -358,10 +258,6 @@ static int ar71xx_pci_probe(struct platf
+@@ -357,10 +257,6 @@ static int ar71xx_pci_probe(struct platf
  	if (IS_ERR(apc->cfg_base))
  		return PTR_ERR(apc->cfg_base);
  
@@ -128,7 +138,7 @@
  	ar71xx_pci_reset();
  
  	/* setup COMMAND register */
-@@ -372,8 +268,6 @@ static int ar71xx_pci_probe(struct platf
+@@ -371,8 +267,6 @@ static int ar71xx_pci_probe(struct platf
  	/* clear bus errors */
  	ar71xx_pci_check_error(apc, 1);
  
diff --git a/target/linux/ath79/patches-5.15/0037-missing-registers.patch b/target/linux/ath79/patches-5.15/0037-missing-registers.patch
index 9067e4ca7ba901..0e6ac52ade6ee1 100644
--- a/target/linux/ath79/patches-5.15/0037-missing-registers.patch
+++ b/target/linux/ath79/patches-5.15/0037-missing-registers.patch
@@ -1,6 +1,5 @@
-commit f3ffac90bc7266b7d917616f3233f58e8c08a196
-Author: Christian Lamparter <chunkeey@gmail.com>
-Date:   Fri Aug 10 23:24:47 2018 +0200
+From: Christian Lamparter <chunkeey@gmail.com>
+Subject: [PATCH] ath79: gmac: add parsers for rxd(v)- and tx(d|en)-delay for
 
     ath79: gmac: add parsers for rxd(v)- and tx(d|en)-delay for AR9344
 
diff --git a/target/linux/ath79/patches-5.15/0039-MIPS-ath79-export-UART1-reference-clock.patch b/target/linux/ath79/patches-5.15/0039-MIPS-ath79-export-UART1-reference-clock.patch
index edf888c7e7163e..b24ff216928f60 100644
--- a/target/linux/ath79/patches-5.15/0039-MIPS-ath79-export-UART1-reference-clock.patch
+++ b/target/linux/ath79/patches-5.15/0039-MIPS-ath79-export-UART1-reference-clock.patch
@@ -1,3 +1,18 @@
+From: Daniel Golle <daniel@makrotopia.org>
+Subject: [PATCH] ath79: add support for Atheros AR934x HS UART
+
+AR934x chips also got the 'old' qca,ar9330-uart in addition to the
+'new' ns16550a compatible one. Add support for UART1 clock selector as
+well as device-tree bindings in ar934x.dtsi to make use of that uart.
+
+Reported-by: Piotr Dymacz <pepe2k@gmail.com>
+Submitted-by: Daniel Golle <daniel@makrotopia.org>
+---
+ arch/mips/ath79/clock.c                       | 7 +++++++
+ .../mips/include/asm/mach-ath79/ar71xx_regs.h | 1 +
+ include/dt-bindings/clock/ath79-clk.h         | 3 ++-
+ 3 files changed, 10 insertions(+), 1 deletion(-)
+
 --- a/arch/mips/ath79/clock.c
 +++ b/arch/mips/ath79/clock.c
 @@ -40,6 +40,7 @@ static const char * const clk_names[ATH7
diff --git a/target/linux/ath79/patches-5.15/004-register_gpio_driver_earlier.patch b/target/linux/ath79/patches-5.15/004-register_gpio_driver_earlier.patch
index 153cfb438a4d0b..a8680ceac4f2e5 100644
--- a/target/linux/ath79/patches-5.15/004-register_gpio_driver_earlier.patch
+++ b/target/linux/ath79/patches-5.15/004-register_gpio_driver_earlier.patch
@@ -1,6 +1,14 @@
+From: John Crispin <john@phrozen.org>
+Subject: ath79: Register GPIO driver earlier
+
 HACK: register the GPIO driver earlier to ensure that gpio_request calls
 from mach files succeed.
 
+Submitted-by: John Crispin <john@phrozen.org>
+---
+ drivers/gpio/gpio-ath79.c                     | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
 --- a/drivers/gpio/gpio-ath79.c
 +++ b/drivers/gpio/gpio-ath79.c
 @@ -297,7 +297,11 @@ static struct platform_driver ath79_gpio
diff --git a/target/linux/ath79/patches-5.15/0040-ath79-sgmii-config.patch b/target/linux/ath79/patches-5.15/0040-ath79-sgmii-config.patch
index bf7cbf2716adce..4c2b94899aed2f 100644
--- a/target/linux/ath79/patches-5.15/0040-ath79-sgmii-config.patch
+++ b/target/linux/ath79/patches-5.15/0040-ath79-sgmii-config.patch
@@ -1,3 +1,24 @@
+From: David Bauer <mail@david-bauer.net>
+Subject: [PATCH] ath79: force SGMII SerDes mode to MAC operation
+
+The mode on the SGMII SerDes on the QCA9563 is 1000 Base-X by default.
+This only allows for 1000 Mbit/s links, however when used with an SGMII
+PHY in 100 Mbit/s link mode, the link remains dead.
+
+This strictly has nothing to do with the SerDes calibration, however it
+is done at the same point in the QCA reference U-Boot which is the
+blueprint for everything happening here. As the current state is more or
+less a hack, this should be fine.
+
+This fixes the issues outlined above on a TP-Link EAP-225 Outdoor.
+
+Reported-by: Tom Herbers <freifunk@tomherbers.de>
+Tested-by: Tom Herbers <freifunk@tomherbers.de>
+Submitted-by: David Bauer <mail@david-bauer.net>
+---
+ arch/mips/include/asm/mach-ath79/ar71xx_regs.h           | 1 +
+ 1 files changed, 1 insertion(+)
+
 --- a/arch/mips/include/asm/mach-ath79/ar71xx_regs.h
 +++ b/arch/mips/include/asm/mach-ath79/ar71xx_regs.h
 @@ -1376,5 +1376,6 @@
diff --git a/target/linux/ath79/patches-5.15/0062-MIPS-pci-ar724x-add-QCA9550-reset-sequence.patch b/target/linux/ath79/patches-5.15/0062-MIPS-pci-ar724x-add-QCA9550-reset-sequence.patch
index f596ddb7336f64..1949a9f886ed9a 100644
--- a/target/linux/ath79/patches-5.15/0062-MIPS-pci-ar724x-add-QCA9550-reset-sequence.patch
+++ b/target/linux/ath79/patches-5.15/0062-MIPS-pci-ar724x-add-QCA9550-reset-sequence.patch
@@ -96,7 +96,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  
  	/* set PCIE Application Control to ready */
  	app = __raw_readl(apc->ctrl_base + AR724X_PCI_REG_APP);
-@@ -396,6 +412,14 @@ static int ar724x_pci_probe(struct platf
+@@ -395,6 +411,14 @@ static int ar724x_pci_probe(struct platf
  	if (apc->irq < 0)
  		return -EINVAL;
  
@@ -111,7 +111,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  	apc->np = pdev->dev.of_node;
  	apc->pci_controller.pci_ops = &ar724x_pci_ops;
  	apc->pci_controller.io_resource = &apc->io_res;
-@@ -406,7 +430,7 @@ static int ar724x_pci_probe(struct platf
+@@ -405,7 +429,7 @@ static int ar724x_pci_probe(struct platf
  	 * Do the full PCIE Root Complex Initialization Sequence if the PCIe
  	 * host controller is in reset.
  	 */
@@ -120,7 +120,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  		ar724x_pci_hw_init(apc);
  
  	apc->link_up = ar724x_pci_check_link(apc);
-@@ -424,6 +448,7 @@ static int ar724x_pci_probe(struct platf
+@@ -423,6 +447,7 @@ static int ar724x_pci_probe(struct platf
  
  static const struct of_device_id ar724x_pci_ids[] = {
  	{ .compatible = "qcom,ar7240-pci" },
diff --git a/target/linux/ath79/patches-5.15/401-mtd-nor-support-mtd-name-from-device-tree.patch b/target/linux/ath79/patches-5.15/401-mtd-nor-support-mtd-name-from-device-tree.patch
index afedf0be884e9c..163bafdb2e5b34 100644
--- a/target/linux/ath79/patches-5.15/401-mtd-nor-support-mtd-name-from-device-tree.patch
+++ b/target/linux/ath79/patches-5.15/401-mtd-nor-support-mtd-name-from-device-tree.patch
@@ -10,7 +10,7 @@ Signed-off-by: Abhimanyu Vishwakarma <Abhimanyu.Vishwakarma@imgtec.com>
 
 --- a/drivers/mtd/spi-nor/core.c
 +++ b/drivers/mtd/spi-nor/core.c
-@@ -3095,6 +3095,7 @@ int spi_nor_scan(struct spi_nor *nor, co
+@@ -3107,6 +3107,7 @@ int spi_nor_scan(struct spi_nor *nor, co
  	struct device *dev = nor->dev;
  	struct mtd_info *mtd = &nor->mtd;
  	struct device_node *np = spi_nor_get_flash_node(nor);
@@ -18,7 +18,7 @@ Signed-off-by: Abhimanyu Vishwakarma <Abhimanyu.Vishwakarma@imgtec.com>
  	int ret;
  	int i;
  
-@@ -3149,7 +3150,12 @@ int spi_nor_scan(struct spi_nor *nor, co
+@@ -3161,7 +3162,12 @@ int spi_nor_scan(struct spi_nor *nor, co
  	if (ret)
  		return ret;
  
@@ -34,7 +34,7 @@ Signed-off-by: Abhimanyu Vishwakarma <Abhimanyu.Vishwakarma@imgtec.com>
  	mtd->type = MTD_NORFLASH;
 --- a/drivers/mtd/mtdcore.c
 +++ b/drivers/mtd/mtdcore.c
-@@ -849,6 +849,17 @@ out_error:
+@@ -847,6 +847,17 @@ out_error:
   */
  static void mtd_set_dev_defaults(struct mtd_info *mtd)
  {
diff --git a/target/linux/ath79/patches-5.15/404-mtd-cybertan-trx-parser.patch b/target/linux/ath79/patches-5.15/404-mtd-cybertan-trx-parser.patch
index 923589661ee049..4e8e536e2945e4 100644
--- a/target/linux/ath79/patches-5.15/404-mtd-cybertan-trx-parser.patch
+++ b/target/linux/ath79/patches-5.15/404-mtd-cybertan-trx-parser.patch
@@ -1,3 +1,21 @@
+From: Christian Lamparter <chunkeey@gmail.com>
+Subject: [PATCH] ath79: port cybertan_part from ar71xx
+
+This patch ports the cybertan_part code from ar71xx and converts the
+driver to a DT-supported mtd parser. As a result, it will no longer
+add the u-boot, nvram and art partitions, which were never part of
+the special Cybertan header.
+
+Instead these partitions have to be specified in the DT, which has the
+upside of making it possible to add properties (i.e.: read-only), labels
+and references to these important partitions.
+
+Submitted-by: Christian Lamparter <chunkeey@gmail.com>
+---
+ drivers/mtd/parsers/Makefile                  | 1 +
+ drivers/mtd/parsers/Kconfig                   | 8 ++++++++
+ 2 files changed, 9 insertions(+)
+
 --- a/drivers/mtd/parsers/Makefile
 +++ b/drivers/mtd/parsers/Makefile
 @@ -8,6 +8,7 @@ obj-$(CONFIG_MTD_OF_PARTS)		+= ofpart.o
@@ -7,7 +25,7 @@
 +obj-$(CONFIG_MTD_PARSER_CYBERTAN)	+= parser_cybertan.o
  obj-$(CONFIG_MTD_PARSER_IMAGETAG)	+= parser_imagetag.o
  obj-$(CONFIG_MTD_AFS_PARTS)		+= afs.o
- obj-$(CONFIG_MTD_PARSER_TRX)		+= parser_trx.o
+ obj-$(CONFIG_MTD_PARSER_TPLINK_SAFELOADER)	+= tplink_safeloader.o
 --- a/drivers/mtd/parsers/Kconfig
 +++ b/drivers/mtd/parsers/Kconfig
 @@ -102,6 +102,14 @@ config MTD_OF_PARTS_LINKSYS_NS
diff --git a/target/linux/ath79/patches-5.15/420-net-use-downstream-ag71xx.patch b/target/linux/ath79/patches-5.15/420-net-use-downstream-ag71xx.patch
index 7a1a03430d5cfe..54e64fb11cf8e9 100644
--- a/target/linux/ath79/patches-5.15/420-net-use-downstream-ag71xx.patch
+++ b/target/linux/ath79/patches-5.15/420-net-use-downstream-ag71xx.patch
@@ -1,3 +1,16 @@
+From: John Crispin <john@phrozen.org>
+Subject: [PATCH] ath79: add new OF only target for QCA MIPS silicon
+
+This target aims to replace ar71xx mid-term. The big part that is still
+missing is making the MMIO/AHB wifi work using OF. NAND and mikrotik
+subtargets will follow.
+
+Submitted-by: John Crispin <john@phrozen.org>
+---
+ drivers/net/ethernet/atheros/Kconfig          | 8 +-------
+ drivers/net/ethernet/atheros/Makefile         | 2 +-
+ 2 files changed, 2 insertions(+), 8 deletions(-)
+
 --- a/drivers/net/ethernet/atheros/Kconfig
 +++ b/drivers/net/ethernet/atheros/Kconfig
 @@ -17,14 +17,7 @@ config NET_VENDOR_ATHEROS
diff --git a/target/linux/ath79/patches-5.15/430-drivers-link-spi-before-mtd.patch b/target/linux/ath79/patches-5.15/430-drivers-link-spi-before-mtd.patch
index 4c6558db90ccde..0cd96909eb9b4d 100644
--- a/target/linux/ath79/patches-5.15/430-drivers-link-spi-before-mtd.patch
+++ b/target/linux/ath79/patches-5.15/430-drivers-link-spi-before-mtd.patch
@@ -1,3 +1,11 @@
+From: Gabor Juhos <juhosg@openwrt.org>
+Subject: [PATCH] ar71xx: Link SPI before MTD
+
+SVN-Revision: 22863
+---
+ drivers/Makefile                              |   2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
 --- a/drivers/Makefile
 +++ b/drivers/Makefile
 @@ -80,8 +80,8 @@ obj-y				+= scsi/
diff --git a/target/linux/ath79/patches-5.15/440-mtd-ar934x-nand-driver.patch b/target/linux/ath79/patches-5.15/440-mtd-ar934x-nand-driver.patch
index 3ce64aa51d7ab2..63bc98e14c1533 100644
--- a/target/linux/ath79/patches-5.15/440-mtd-ar934x-nand-driver.patch
+++ b/target/linux/ath79/patches-5.15/440-mtd-ar934x-nand-driver.patch
@@ -1,3 +1,12 @@
+From: Gabor Juhos <juhosg@openwrt.org>
+Subject: ar71xx: ar934x_nfc: experimental NAND Flash Controller driver for AR934x
+
+SVN-Revision: 33385
+---
+ drivers/mtd/nand/raw/Kconfig                  | 8 ++++++++
+ drivers/mtd/nand/raw/Makefile                 | 1 +
+ 2 files changed, 9 insertions(+)
+
 --- a/drivers/mtd/nand/raw/Kconfig
 +++ b/drivers/mtd/nand/raw/Kconfig
 @@ -555,4 +555,12 @@ config MTD_NAND_DISKONCHIP_BBTWRITE
diff --git a/target/linux/ath79/patches-5.15/470-MIPS-ath79-swizzle-pci-address-for-ar71xx.patch b/target/linux/ath79/patches-5.15/470-MIPS-ath79-swizzle-pci-address-for-ar71xx.patch
index 924faec5098d6d..1e2715b84c3677 100644
--- a/target/linux/ath79/patches-5.15/470-MIPS-ath79-swizzle-pci-address-for-ar71xx.patch
+++ b/target/linux/ath79/patches-5.15/470-MIPS-ath79-swizzle-pci-address-for-ar71xx.patch
@@ -1,3 +1,14 @@
+From: Gabor Juhos <juhosg@openwrt.org>
+Subject: [PATCH] ar71xx: swizzle address for PCI byte/word access on AR71xx
+
+Closes #11683.
+
+SVN-Revision: 32639
+---
+ .../mips/include/asm/mach-ath79/mangle-port.h | 111 ++++++++++++++++++
+ 1 file changed, 111 insertions(+)
+ create mode 100644 arch/mips/include/asm/mach-ath79/mangle-port.h
+
 --- /dev/null
 +++ b/arch/mips/include/asm/mach-ath79/mangle-port.h
 @@ -0,0 +1,37 @@
@@ -86,7 +97,7 @@
  static inline u32 ar71xx_pci_get_ble(int where, int size, int local)
  {
  	u32 t;
-@@ -276,6 +315,9 @@ static int ar71xx_pci_probe(struct platf
+@@ -275,6 +314,9 @@ static int ar71xx_pci_probe(struct platf
  
  	register_pci_controller(&apc->pci_ctrl);
  
diff --git a/target/linux/ath79/patches-5.15/900-mdio_bitbang_ignore_ta_value.patch b/target/linux/ath79/patches-5.15/900-mdio_bitbang_ignore_ta_value.patch
index 4c8d2c2ea9a34c..5363bb37b03a1b 100644
--- a/target/linux/ath79/patches-5.15/900-mdio_bitbang_ignore_ta_value.patch
+++ b/target/linux/ath79/patches-5.15/900-mdio_bitbang_ignore_ta_value.patch
@@ -1,3 +1,15 @@
+From: Jonas Gorski <jogo@openwrt.org>
+Subject: ar71xx: add a workaround for ar8316 not always driving the TA bit to low
+
+AR8316 behind a GPIO bitbanged MDIO bus fails to drive the turnaround bit
+to low despite returning a valid value. Ignore it and just use the
+returned value anyway.
+
+SVN-Revision: 28422
+---
+ drivers/net/mdio/mdio-bitbang.c               | 16 ++-----------------
+ 1 file changed, 2 insertions(+), 14 deletions(-)
+
 --- a/drivers/net/mdio/mdio-bitbang.c
 +++ b/drivers/net/mdio/mdio-bitbang.c
 @@ -152,7 +152,7 @@ static int mdiobb_cmd_addr(struct mdiobb
diff --git a/target/linux/ath79/patches-5.15/910-unaligned_access_hacks.patch b/target/linux/ath79/patches-5.15/910-unaligned_access_hacks.patch
index 1eaeefef00ce0a..c2b646643e0389 100644
--- a/target/linux/ath79/patches-5.15/910-unaligned_access_hacks.patch
+++ b/target/linux/ath79/patches-5.15/910-unaligned_access_hacks.patch
@@ -1,3 +1,47 @@
+From: Felix Fietkau <nbd@openwrt.org>
+Subject: [PATCH] ar71xx: fix unaligned access in a few more places
+
+SVN-Revision: 35130
+---
+ arch/mips/include/asm/checksum.h              | 83 +++---------------
+ include/uapi/linux/ip.h                       |  2 +-
+ include/uapi/linux/ipv6.h                     |  2 +-
+ include/uapi/linux/tcp.h                      |  4 ++--
+ include/uapi/linux/udp.h                      |  2 +-
+ net/netfilter/nf_conntrack_core.c             |  4 ++--
+ include/uapi/linux/icmp.h                     |  2 +-
+ include/uapi/linux/in6.h                      |  2 +-
+ net/ipv6/tcp_ipv6.c                           |  9 +++--
+ net/ipv6/datagram.c                           |  6 ++--
+ net/ipv6/exthdrs.c                            |  2 +-
+ include/linux/types.h                         |  5 +++
+ net/ipv4/af_inet.c                            |  4 ++--
+ net/ipv4/tcp_output.c                         | 69 +++++++++--------
+ include/uapi/linux/igmp.h                     |  8 +++---
+ net/core/flow_dissector.c                     |  2 +-
+ include/uapi/linux/icmpv6.h                   |  2 +-
+ include/net/ndisc.h                           | 10 ++++----
+ net/sched/cls_u32.c                           |  6 +++---
+ net/ipv6/ip6_offload.c                        |  2 +-
+ include/net/addrconf.h                        |  2 +-
+ include/net/inet_ecn.h                        |  4 ++--
+ include/net/ipv6.h                            | 23 +++++----
+ include/net/secure_seq.h                      |  1 +
+ include/uapi/linux/in.h                       |  2 +-
+ net/ipv6/ip6_fib.h                            |  2 +-
+ net/netfilter/nf_conntrack_proto_tcp.c        |  2 +-
+ net/xfrm/xfrm_input.c                         |  4 ++--
+ net/ipv4/tcp_input.c                          | 12 ++++---
+ include/uapi/linux/if_pppox.h                 |  1 +
+ net/ipv6/netfilter/nf_log_ipv6.c              |  4 ++--
+ include/net/neighbour.h                       |  6 +++--
+ include/uapi/linux/netfilter_arp/arp_tables.h |  2 +-
+ net/core/utils.c                              | 10 +++++--
+ include/linux/etherdevice.h                   | 11 ++++---
+ net/ipv4/tcp_offload.c                        |  6 +++---
+ net/ipv6/netfilter/ip6table_mangle.c          |  4 ++--
+ 37 file changed, 171 insertions(+), 141 deletions(-)
+
 --- a/arch/mips/include/asm/checksum.h
 +++ b/arch/mips/include/asm/checksum.h
 @@ -100,26 +100,30 @@ static inline __sum16 ip_fast_csum(const
@@ -118,9 +162,9 @@
  
 --- a/include/uapi/linux/ip.h
 +++ b/include/uapi/linux/ip.h
-@@ -103,7 +103,7 @@ struct iphdr {
- 	__be32	saddr;
- 	__be32	daddr;
+@@ -106,7 +106,7 @@ struct iphdr {
+ 		__be32	daddr;
+ 	);
  	/*The options start here. */
 -};
 +} __attribute__((packed, aligned(2)));
@@ -129,10 +173,10 @@
  struct ip_auth_hdr {
 --- a/include/uapi/linux/ipv6.h
 +++ b/include/uapi/linux/ipv6.h
-@@ -132,7 +132,7 @@ struct ipv6hdr {
- 
- 	struct	in6_addr	saddr;
- 	struct	in6_addr	daddr;
+@@ -135,7 +135,7 @@ struct ipv6hdr {
+ 		struct	in6_addr	saddr;
+ 		struct	in6_addr	daddr;
+ 	);
 -};
 +} __attribute__((packed, aligned(2)));
  
@@ -171,7 +215,7 @@
  #define UDP_CORK	1	/* Never send partially complete segments */
 --- a/net/netfilter/nf_conntrack_core.c
 +++ b/net/netfilter/nf_conntrack_core.c
-@@ -305,8 +305,8 @@ nf_ct_get_tuple(const struct sk_buff *sk
+@@ -308,8 +308,8 @@ nf_ct_get_tuple(const struct sk_buff *sk
  
  	switch (l3num) {
  	case NFPROTO_IPV4:
@@ -214,7 +258,7 @@
  #include <linux/uaccess.h>
  #include <linux/ipv6.h>
  #include <linux/icmpv6.h>
-@@ -941,10 +942,10 @@ static void tcp_v6_send_response(const s
+@@ -944,10 +945,10 @@ static void tcp_v6_send_response(const s
  	topt = (__be32 *)(t1 + 1);
  
  	if (tsecr) {
@@ -267,7 +311,7 @@
  		case IPV6_2292HOPOPTS:
 --- a/net/ipv6/exthdrs.c
 +++ b/net/ipv6/exthdrs.c
-@@ -1009,7 +1009,7 @@ static bool ipv6_hop_jumbo(struct sk_buf
+@@ -1002,7 +1002,7 @@ static bool ipv6_hop_jumbo(struct sk_buf
  		goto drop;
  	}
  
@@ -292,7 +336,7 @@
  #endif /* _LINUX_TYPES_H */
 --- a/net/ipv4/af_inet.c
 +++ b/net/ipv4/af_inet.c
-@@ -1475,8 +1475,8 @@ struct sk_buff *inet_gro_receive(struct
+@@ -1477,8 +1477,8 @@ struct sk_buff *inet_gro_receive(struct
  	if (unlikely(ip_fast_csum((u8 *)iph, 5)))
  		goto out_unlock;
  
@@ -693,7 +737,7 @@
  				       | TCPOLEN_TIMESTAMP))
 --- a/net/xfrm/xfrm_input.c
 +++ b/net/xfrm/xfrm_input.c
-@@ -165,8 +165,8 @@ int xfrm_parse_spi(struct sk_buff *skb,
+@@ -166,8 +166,8 @@ int xfrm_parse_spi(struct sk_buff *skb,
  	if (!pskb_may_pull(skb, hlen))
  		return -EINVAL;
  
@@ -706,7 +750,7 @@
  EXPORT_SYMBOL(xfrm_parse_spi);
 --- a/net/ipv4/tcp_input.c
 +++ b/net/ipv4/tcp_input.c
-@@ -4140,14 +4140,16 @@ static bool tcp_parse_aligned_timestamp(
+@@ -4152,14 +4152,16 @@ static bool tcp_parse_aligned_timestamp(
  {
  	const __be32 *ptr = (const __be32 *)(th + 1);
  
@@ -785,7 +829,7 @@
  		*sum = csum_fold(csum_partial(diff, sizeof(diff),
 --- a/include/linux/etherdevice.h
 +++ b/include/linux/etherdevice.h
-@@ -511,7 +511,7 @@ static inline bool is_etherdev_addr(cons
+@@ -525,7 +525,7 @@ static inline bool is_etherdev_addr(cons
   * @b: Pointer to Ethernet header
   *
   * Compare two Ethernet headers, returns 0 if equal.
@@ -794,7 +838,7 @@
   * aligned OR the platform can handle unaligned access.  This is the
   * case for all packets coming into netif_receive_skb or similar
   * entry points.
-@@ -534,11 +534,12 @@ static inline unsigned long compare_ethe
+@@ -548,11 +548,12 @@ static inline unsigned long compare_ethe
  	fold |= *(unsigned long *)(a + 6) ^ *(unsigned long *)(b + 6);
  	return fold;
  #else
diff --git a/target/linux/ath79/patches-5.15/920-mikrotik-rb4xx.patch b/target/linux/ath79/patches-5.15/920-mikrotik-rb4xx.patch
index 904f212e412868..4743ad46e2522e 100644
--- a/target/linux/ath79/patches-5.15/920-mikrotik-rb4xx.patch
+++ b/target/linux/ath79/patches-5.15/920-mikrotik-rb4xx.patch
@@ -1,6 +1,51 @@
+From: Christopher Hill <ch6574@gmail.com>
+Subject: [PATCH] ath79: add Mikrotik rb4xx series drivers
+
+This adds 3 Mikrotik rb4xx series drivers as follows:
+
+rb4xx-cpld: This is in the mfd subsystem, and is the parent CPLD device
+that interfaces between the SoC SPI bus and its two children below.
+rb4xx-gpio: This is the GPIO expander.
+rb4xx-nand: This is the NAND driver.
+
+The history of this code comes in three phases.
+
+1. The first is a May 2015 attempt to push the equivalient ar71xx rb4xx
+drivers upstream. See https://lore.kernel.org/patchwork/patch/940880/.
+
+Module-author: Gabor Juhos <juhosg@openwrt.org>
+Module-author: Imre Kaloz <kaloz@openwrt.org>
+Module-author: Bert Vermeulen <bert@biot.com>
+
+2. Next several ar71xx patches were applied bringing the code current.
+
+commit 7bbf4117c6fe4b764d9d7c62fb2bcf6dd93bff2c
+Submitted-by: Hauke Mehrtens <hauke@hauke-m.de>
+
+commit af79fdbe4af32a287798b579141204bda056b8aa
+commit 889272d92db689fd9c910243635e44c9d8323095
+commit e21cb649a235180563363b8af5ba8296b9ac0baa
+commit 7c09fa4a7492ca436f2c94bd9a465b7c5bbeed6f
+Submitted-by: Felix Fietkau <nbd@nbd.name>
+
+3. Finally a heavy refactor to split the driver into the three new
+subsystems, and updated to work with the device tree configuration, plus
+updates and review feedback incorporated
+
+Reviewed-by: Thibaut VARÈNE <hacks@slashdirt.org>
+Submitted-by: Christopher Hill <ch6574@gmail.com>
+---
+ drivers/mfd/Kconfig                           | 8 ++++++++
+ drivers/mfd/Makefile                          | 1 +
+ drivers/gpio/Kconfig                          | 6 ++++++
+ drivers/gpio/Makefile                         | 1 +
+ drivers/mtd/nand/raw/Kconfig                  | 7 +++++++
+ drivers/mtd/nand/raw/Makefile                 | 1 +
+ 6 files changed, 24 insertions(+)
+
 --- a/drivers/mfd/Kconfig
 +++ b/drivers/mfd/Kconfig
-@@ -2174,6 +2174,14 @@ config RAVE_SP_CORE
+@@ -2176,6 +2176,14 @@ config RAVE_SP_CORE
  	  Select this to get support for the Supervisory Processor
  	  device found on several devices in RAVE line of hardware.
  
diff --git a/target/linux/ath79/patches-5.15/939-mikrotik-rb91x.patch b/target/linux/ath79/patches-5.15/939-mikrotik-rb91x.patch
index 4a852886bf3b87..94967bf674c471 100644
--- a/target/linux/ath79/patches-5.15/939-mikrotik-rb91x.patch
+++ b/target/linux/ath79/patches-5.15/939-mikrotik-rb91x.patch
@@ -1,3 +1,32 @@
+From: Denis Kalashnikov <denis281089@gmail.com>
+Subject: [PATCH] ath79: add support for reset key on MikroTik RB912UAG-2HPnD
+
+On MikroTik RB91x board series a reset key shares SoC gpio
+line #15 with NAND ALE and NAND IO7. So we need a custom
+gpio driver to manage this non-trivial connection schema.
+Also rb91x-nand needs to have an ability to disable a polling
+of the key while it works with NAND.
+
+While we've been integrating rb91x-key into a firmware, we've
+figured out that:
+* In the gpio-latch driver we need to add a "cansleep" suffix to
+several gpiolib calls,
+* When gpio-latch and rb91x-nand fail to get a gpio and an error
+is -EPROBE_DEFER, they shouldn't report about this, since this
+actually is not an error and occurs when the gpio-latch probe
+function is called before the rb91x-key probe.
+We fix these related things here too.
+
+Submitted-by: Denis Kalashnikov <denis281089@gmail.com>
+Reviewed-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
+---
+ drivers/gpio/Kconfig                          | 11 +++++++++++
+ drivers/gpio/Makefile                         |  2 ++
+ drivers/mtd/nand/raw/Kconfig                  |  6 ++++++
+ drivers/mtd/nand/raw/Makefile                 |  1 +
+ 7 files changed, 20 insertions(+)
+
 --- a/drivers/gpio/Kconfig
 +++ b/drivers/gpio/Kconfig
 @@ -353,6 +353,13 @@ config GPIO_IXP4XX
diff --git a/target/linux/ath79/tiny/base-files/lib/upgrade/failsafe_datachk.sh b/target/linux/ath79/tiny/base-files/lib/upgrade/failsafe_datachk.sh
index de84233de10b5c..23847a1aae4ff6 100644
--- a/target/linux/ath79/tiny/base-files/lib/upgrade/failsafe_datachk.sh
+++ b/target/linux/ath79/tiny/base-files/lib/upgrade/failsafe_datachk.sh
@@ -8,8 +8,6 @@
 # So the kernel check is for the loader, the rootfs check is for kernel + rootfs
 
 platform_do_upgrade_failsafe_datachk() {
-	local setenv_script="/tmp/fw_env_upgrade"
-
 	local flash_base=0x9f000000
 
 	local kernel_mtd=$(find_mtd_index ${KERNEL_PART:-kernel})
@@ -34,31 +32,33 @@ platform_do_upgrade_failsafe_datachk() {
 	local rootfs_md5=$($IMAGE_CMD $ROOTFS_FILE | dd bs=4k count=$rootfs_blocks iflag=fullblock | md5sum | cut -d ' ' -f1)
 
 	# prepare new u-boot-env vars
-	printf "vmlinux_start_addr 0x%08x\n" $((flash_base + kernel_offset)) >> $setenv_script
-	printf "vmlinux_size 0x%08x\n" ${kernel_size} >> $setenv_script
-	printf "vmlinux_checksum %s\n" ${kernel_md5} >> $setenv_script
+	printf "vmlinux_start_addr 0x%08x\n" $((flash_base + kernel_offset)) >> $ENV_SCRIPT
+	printf "vmlinux_size 0x%08x\n" ${kernel_size} >> $ENV_SCRIPT
+	printf "vmlinux_checksum %s\n" ${kernel_md5} >> $ENV_SCRIPT
 
-	printf "rootfs_start_addr 0x%08x\n" $((flash_base + rootfs_offset)) >> $setenv_script
-	printf "rootfs_size 0x%08x\n" ${rootfs_size} >> $setenv_script
-	printf "rootfs_checksum %s\n" ${rootfs_md5} >> $setenv_script
+	printf "rootfs_start_addr 0x%08x\n" $((flash_base + rootfs_offset)) >> $ENV_SCRIPT
+	printf "rootfs_size 0x%08x\n" ${rootfs_size} >> $ENV_SCRIPT
+	printf "rootfs_checksum %s\n" ${rootfs_md5} >> $ENV_SCRIPT
 
 	# store u-boot-env
 	mkdir -p /var/lock
-	fw_setenv -s $setenv_script || {
+	[ -n "$SKIP_HASH" ] || fw_setenv -s $ENV_SCRIPT || {
 		echo 'failed to update U-Boot environment'
 		exit 1
 	}
 
 	# sysupgrade
-	sleep 2
-	sync
-	echo 3 > /proc/sys/vm/drop_caches
+	sleep 2 && sync && echo 3 > /proc/sys/vm/drop_caches
+
 	$IMAGE_CMD $KERNEL_FILE | mtd $MTD_ARGS write - ${KERNEL_PART:-kernel}
-	sleep 2
-	sync
+
+	sleep 2 && sync && echo 3 > /proc/sys/vm/drop_caches
+
 	if [ -n "$UPGRADE_BACKUP" ]; then
 		$IMAGE_CMD $ROOTFS_FILE | mtd $MTD_ARGS $MTD_CONFIG_ARGS -j $UPGRADE_BACKUP write - ${ROOTFS_PART:-rootfs}
 	else
 		$IMAGE_CMD $ROOTFS_FILE | mtd $MTD_ARGS write - ${ROOTFS_PART:-rootfs}
 	fi
+
+	sync
 }
diff --git a/target/linux/ath79/tiny/base-files/lib/upgrade/platform.sh b/target/linux/ath79/tiny/base-files/lib/upgrade/platform.sh
index 6d05b88d45c660..eb8441c6d267fa 100644
--- a/target/linux/ath79/tiny/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ath79/tiny/base-files/lib/upgrade/platform.sh
@@ -19,6 +19,7 @@ platform_do_upgrade() {
 	engenius,eap350-v1|\
 	engenius,ecb350-v1|\
 	engenius,enh202-v1)
+		ENV_SCRIPT="/tmp/fw_env"
 		IMAGE_LIST="tar tzf $1"
 		IMAGE_CMD="tar xzOf $1"
 		KERNEL_PART="loader"
diff --git a/target/linux/ath79/tiny/target.mk b/target/linux/ath79/tiny/target.mk
index 28e02f7a674c43..fef82fdd7ffabd 100644
--- a/target/linux/ath79/tiny/target.mk
+++ b/target/linux/ath79/tiny/target.mk
@@ -1,7 +1,7 @@
 BOARDNAME:=Devices with small flash
 FEATURES += low_mem small_flash
 
-DEFAULT_PACKAGES += wpad-basic-wolfssl
+DEFAULT_PACKAGES += wpad-basic-mbedtls
 
 define Target/Description
 	Build firmware images for Atheros AR71xx/AR913x/AR934x based boards with small flash
diff --git a/target/linux/bcm27xx/Makefile b/target/linux/bcm27xx/Makefile
index e408c9040cd9e4..99c5fa75aa9ada 100644
--- a/target/linux/bcm27xx/Makefile
+++ b/target/linux/bcm27xx/Makefile
@@ -11,7 +11,7 @@ BOARDNAME:=Broadcom BCM27xx
 FEATURES:=audio boot-part display ext4 fpu gpio rootfs-part rtc squashfs usb usbgadget
 SUBTARGETS:=bcm2708 bcm2709 bcm2710 bcm2711
 
-KERNEL_PATCHVER:=5.15
+KERNEL_PATCHVER:=6.1
 
 define Target/Description
 	Build firmware image for Broadcom BCM27xx SoC devices.
diff --git a/target/linux/bcm27xx/bcm2708/config-6.1 b/target/linux/bcm27xx/bcm2708/config-6.1
new file mode 100644
index 00000000000000..edf74c4fad8f64
--- /dev/null
+++ b/target/linux/bcm27xx/bcm2708/config-6.1
@@ -0,0 +1,388 @@
+# CONFIG_AIO is not set
+CONFIG_ALIGNMENT_TRAP=y
+CONFIG_APERTURE_HELPERS=y
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_BCM=y
+CONFIG_ARCH_BCM2835=y
+CONFIG_ARCH_FORCE_MAX_ORDER=11
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+CONFIG_ARCH_MULTIPLATFORM=y
+CONFIG_ARCH_MULTI_V6=y
+CONFIG_ARCH_MULTI_V6_V7=y
+CONFIG_ARCH_NR_GPIO=0
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARM=y
+CONFIG_ARM_AMBA=y
+CONFIG_ARM_CPU_SUSPEND=y
+CONFIG_ARM_ERRATA_411920=y
+CONFIG_ARM_HAS_GROUP_RELOCS=y
+CONFIG_ARM_L1_CACHE_SHIFT=5
+# CONFIG_ARM_MHU_V2 is not set
+CONFIG_ARM_PATCH_PHYS_VIRT=y
+CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
+CONFIG_ARM_THUMB=y
+CONFIG_ARM_TIMER_SP804=y
+CONFIG_ARM_UNWIND=y
+CONFIG_AUTO_ZRELADDR=y
+CONFIG_BCM2708_VCMEM=y
+# CONFIG_BCM2711_THERMAL is not set
+CONFIG_BCM2835_DEVGPIOMEM=y
+CONFIG_BCM2835_FAST_MEMCPY=y
+CONFIG_BCM2835_MBOX=y
+CONFIG_BCM2835_POWER=y
+# CONFIG_BCM2835_SMI is not set
+CONFIG_BCM2835_THERMAL=y
+CONFIG_BCM2835_TIMER=y
+CONFIG_BCM2835_VCHIQ=y
+# CONFIG_BCM2835_VCHIQ_MMAL is not set
+CONFIG_BCM2835_WDT=y
+CONFIG_BCM_VCIO=y
+# CONFIG_BCM_VC_SM_CMA is not set
+CONFIG_BCM_VIDEOCORE=y
+CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK=y
+# CONFIG_BLK_DEV_INITRD is not set
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_PM=y
+CONFIG_BRCMSTB_L2_IRQ=y
+CONFIG_BRCM_CHAR_DRIVERS=y
+# CONFIG_CACHE_L2X0 is not set
+CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
+CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
+CONFIG_CC_NO_ARRAY_BOUNDS=y
+CONFIG_CLKSRC_MMIO=y
+CONFIG_CLK_BCM2711_DVP=y
+CONFIG_CLK_BCM2835=y
+CONFIG_CLK_RASPBERRYPI=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CMA=y
+CONFIG_CMA_ALIGNMENT=8
+CONFIG_CMA_AREAS=7
+# CONFIG_CMA_DEBUG is not set
+# CONFIG_CMA_DEBUGFS is not set
+CONFIG_CMA_SIZE_MBYTES=5
+# CONFIG_CMA_SIZE_SEL_MAX is not set
+CONFIG_CMA_SIZE_SEL_MBYTES=y
+# CONFIG_CMA_SIZE_SEL_MIN is not set
+# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
+# CONFIG_CMA_SYSFS is not set
+CONFIG_COMMON_CLK=y
+CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONFIGFS_FS=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CONTIG_ALLOC=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+CONFIG_CPU_32v6=y
+CONFIG_CPU_32v6K=y
+CONFIG_CPU_ABRT_EV6=y
+CONFIG_CPU_CACHE_V6=y
+CONFIG_CPU_CACHE_VIPT=y
+CONFIG_CPU_COPY_V6=y
+CONFIG_CPU_CP15=y
+CONFIG_CPU_CP15_MMU=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_HAS_ASID=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_PABRT_V6=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_THUMB_CAPABLE=y
+CONFIG_CPU_TLB_V6=y
+CONFIG_CPU_V6K=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_CRC32=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_SHA1=y
+CONFIG_CRYPTO_LIB_UTILS=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CURRENT_POINTER_IN_TPIDRURO=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DEBUG_LL_INCLUDE="mach/debug-macro.S"
+CONFIG_DMABUF_HEAPS=y
+CONFIG_DMABUF_HEAPS_CMA=y
+CONFIG_DMABUF_HEAPS_SYSTEM=y
+CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2708=y
+CONFIG_DMA_BCM2835=y
+CONFIG_DMA_CMA=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_OPS=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DMA_VIRTUAL_CHANNELS=y
+CONFIG_DNOTIFY=y
+CONFIG_DTC=y
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_EDAC_ATOMIC_SCRUB=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EXCLUSIVE_SYSTEM_RAM=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_EXTCON=y
+CONFIG_F2FS_FS=y
+CONFIG_FB=y
+CONFIG_FB_BCM2708=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+CONFIG_FB_CMDLINE=y
+# CONFIG_FB_RPISENSE is not set
+CONFIG_FB_SIMPLE=y
+CONFIG_FIQ=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FONT_8x16=y
+CONFIG_FONT_8x8=y
+CONFIG_FONT_SUPPORT=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY is not set
+CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
+CONFIG_FRAME_WARN=1024
+CONFIG_FREEZER=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FS_POSIX_ACL=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CACHE=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_FW_LOADER_SYSFS=y
+CONFIG_GCC11_NO_ARRAY_BOUNDS=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_MULTI_HANDLER=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GPIOLIB_IRQCHIP=y
+# CONFIG_GPIO_BCM_VIRT is not set
+CONFIG_GPIO_CDEV=y
+# CONFIG_GPIO_FSM is not set
+CONFIG_GPIO_RASPBERRYPI_EXP=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HW_CONSOLE=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_BCM2835=y
+CONFIG_HZ_FIXED=0
+CONFIG_I2C=y
+# CONFIG_I2C_BCM2708 is not set
+CONFIG_I2C_BOARDINFO=y
+CONFIG_INPUT=y
+CONFIG_INPUT_MOUSEDEV=y
+# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+CONFIG_IRQCHIP=y
+CONFIG_IRQSTACKS=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+CONFIG_JBD2=y
+CONFIG_KERNEL_GZIP=y
+# CONFIG_KERNEL_XZ is not set
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PWM=y
+CONFIG_LEDS_TRIGGER_ACTPWR=y
+CONFIG_LEDS_TRIGGER_INPUT=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOGO=y
+CONFIG_LOGO_LINUX_CLUT224=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_MAC_PARTITION=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MAILBOX=y
+# CONFIG_MAILBOX_TEST is not set
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MEMORY_ISOLATION=y
+CONFIG_MFD_CORE=y
+# CONFIG_MFD_RASPBERRYPI_POE_HAT is not set
+# CONFIG_MFD_RPISENSE_CORE is not set
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGHT_HAVE_CACHE_L2X0=y
+CONFIG_MIGRATION=y
+CONFIG_MMC=y
+# CONFIG_MMC_BCM2835 is not set
+CONFIG_MMC_BCM2835_DMA=y
+CONFIG_MMC_BCM2835_MMC=y
+CONFIG_MMC_BCM2835_PIO_DMA_BARRIER=2
+CONFIG_MMC_BCM2835_SDHOST=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MODULES_USE_ELF_REL=y
+# CONFIG_MTD is not set
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_PER_CPU_KM=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NLS=y
+CONFIG_NLS_ASCII=y
+CONFIG_NOP_USB_XCEIV=y
+CONFIG_NO_HZ=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_CONFIGFS=y
+CONFIG_OF_DYNAMIC=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_OF_OVERLAY=y
+CONFIG_OF_RESOLVE=y
+CONFIG_OLD_SIGACTION=y
+CONFIG_OLD_SIGSUSPEND3=y
+CONFIG_PAGE_OFFSET=0xC0000000
+CONFIG_PAGE_POOL=y
+CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
+CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PINCTRL=y
+CONFIG_PINCTRL_BCM2835=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_PM_GENERIC_DOMAINS_SLEEP=y
+CONFIG_PM_OPP=y
+CONFIG_PM_SLEEP=y
+# CONFIG_PM_USERSPACE_AUTOSLEEP is not set
+CONFIG_POWER_SUPPLY=y
+CONFIG_PREEMPT_NONE_BUILD=y
+CONFIG_PRINTK_TIME=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_PWM=y
+CONFIG_PWM_BCM2835=y
+CONFIG_PWM_SYSFS=y
+CONFIG_RANDSTRUCT_NONE=y
+CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_RASPBERRYPI_POWER=y
+CONFIG_RATIONAL=y
+# CONFIG_RAVE_SP_CORE is not set
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_RESET_CONTROLLER=y
+# CONFIG_RESET_RASPBERRYPI is not set
+CONFIG_RESET_SIMPLE=y
+# CONFIG_RPIVID_MEM is not set
+# CONFIG_RPI_POE_POWER is not set
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+# CONFIG_SCSI_LOWLEVEL is not set
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_SERIAL_8250_BCM2835AUX=y
+# CONFIG_SERIAL_8250_DMA is not set
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_FSL=y
+CONFIG_SERIAL_8250_NR_UARTS=1
+CONFIG_SERIAL_8250_RUNTIME_UARTS=0
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_DEV_BUS=y
+# CONFIG_SERIAL_DEV_CTRL_TTYPORT is not set
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SG_POOL=y
+CONFIG_SMSC_PHY=y
+CONFIG_SOFTIRQ_ON_OWN_STACK=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SRCU=y
+# CONFIG_STRIP_ASM_SYMS is not set
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+CONFIG_SWPHY=y
+CONFIG_SYS_SUPPORTS_APM_EMULATION=y
+# CONFIG_TEXTSEARCH is not set
+CONFIG_THERMAL=y
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_GOV_STEP_WISE=y
+CONFIG_THERMAL_OF=y
+CONFIG_THREAD_INFO_IN_TASK=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TINY_SRCU=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_UEVENT_HELPER_PATH=""
+# CONFIG_UID16 is not set
+CONFIG_UNCOMPRESS_INCLUDE="debug/uncompress.h"
+CONFIG_UNWINDER_ARM=y
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_DWCOTG=y
+CONFIG_USB_NET_DRIVERS=y
+CONFIG_USB_NET_SMSC95XX=y
+CONFIG_USB_PHY=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_UAS=y
+CONFIG_USB_USBNET=y
+CONFIG_USE_OF=y
+CONFIG_VCHIQ_CDEV=y
+CONFIG_VFP=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_CONSOLE_SLEEP=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_XZ_DEC_ARM=y
+CONFIG_XZ_DEC_BCJ=y
+CONFIG_ZBOOT_ROM_BSS=0x0
+CONFIG_ZBOOT_ROM_TEXT=0x0
diff --git a/target/linux/bcm27xx/bcm2709/config-6.1 b/target/linux/bcm27xx/bcm2709/config-6.1
new file mode 100644
index 00000000000000..4f9be6d37164ae
--- /dev/null
+++ b/target/linux/bcm27xx/bcm2709/config-6.1
@@ -0,0 +1,489 @@
+# CONFIG_AIO is not set
+CONFIG_ALIGNMENT_TRAP=y
+CONFIG_APERTURE_HELPERS=y
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_BCM=y
+CONFIG_ARCH_BCM2835=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_ARCH_FORCE_MAX_ORDER=11
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+CONFIG_ARCH_MULTIPLATFORM=y
+CONFIG_ARCH_MULTI_V6_V7=y
+CONFIG_ARCH_MULTI_V7=y
+CONFIG_ARCH_NR_GPIO=0
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX=y
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARM=y
+CONFIG_ARM_AMBA=y
+CONFIG_ARM_ARCH_TIMER=y
+CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+CONFIG_ARM_CPU_SUSPEND=y
+CONFIG_ARM_GIC=y
+CONFIG_ARM_HAS_GROUP_RELOCS=y
+CONFIG_ARM_L1_CACHE_SHIFT=6
+CONFIG_ARM_L1_CACHE_SHIFT_6=y
+CONFIG_ARM_LPAE=y
+# CONFIG_ARM_MHU_V2 is not set
+CONFIG_ARM_PATCH_IDIV=y
+CONFIG_ARM_PATCH_PHYS_VIRT=y
+CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
+CONFIG_ARM_THUMB=y
+CONFIG_ARM_TIMER_SP804=y
+CONFIG_ARM_UNWIND=y
+CONFIG_ARM_VIRT_EXT=y
+CONFIG_ASSOCIATIVE_ARRAY=y
+CONFIG_AUTO_ZRELADDR=y
+CONFIG_BCM2708_VCMEM=y
+CONFIG_BCM2711_THERMAL=y
+CONFIG_BCM2835_DEVGPIOMEM=y
+CONFIG_BCM2835_MBOX=y
+CONFIG_BCM2835_POWER=y
+# CONFIG_BCM2835_SMI is not set
+CONFIG_BCM2835_THERMAL=y
+CONFIG_BCM2835_TIMER=y
+CONFIG_BCM2835_VCHIQ=y
+# CONFIG_BCM2835_VCHIQ_MMAL is not set
+CONFIG_BCM2835_WDT=y
+CONFIG_BCM7XXX_PHY=y
+CONFIG_BCMGENET=y
+CONFIG_BCM_NET_PHYLIB=y
+CONFIG_BCM_VCIO=y
+# CONFIG_BCM_VC_SM_CMA is not set
+CONFIG_BCM_VIDEOCORE=y
+CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK=y
+# CONFIG_BLK_DEV_INITRD is not set
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BOUNCE=y
+CONFIG_BRCMSTB_L2_IRQ=y
+CONFIG_BRCM_CHAR_DRIVERS=y
+CONFIG_BROADCOM_PHY=y
+# CONFIG_CACHE_L2X0 is not set
+CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
+CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
+CONFIG_CC_NO_ARRAY_BOUNDS=y
+CONFIG_CLKSRC_MMIO=y
+CONFIG_CLK_BCM2711_DVP=y
+CONFIG_CLK_BCM2835=y
+CONFIG_CLK_RASPBERRYPI=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CMA=y
+CONFIG_CMA_ALIGNMENT=8
+CONFIG_CMA_AREAS=7
+# CONFIG_CMA_DEBUG is not set
+# CONFIG_CMA_DEBUGFS is not set
+CONFIG_CMA_SIZE_MBYTES=5
+# CONFIG_CMA_SIZE_SEL_MAX is not set
+CONFIG_CMA_SIZE_SEL_MBYTES=y
+# CONFIG_CMA_SIZE_SEL_MIN is not set
+# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
+# CONFIG_CMA_SYSFS is not set
+CONFIG_COMMON_CLK=y
+CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONFIGFS_FS=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CONTEXT_TRACKING=y
+CONFIG_CONTEXT_TRACKING_IDLE=y
+CONFIG_CONTIG_ALLOC=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+CONFIG_CPU_32v6K=y
+CONFIG_CPU_32v7=y
+CONFIG_CPU_ABRT_EV7=y
+CONFIG_CPU_CACHE_V7=y
+CONFIG_CPU_CACHE_VIPT=y
+CONFIG_CPU_COPY_V6=y
+CONFIG_CPU_CP15=y
+CONFIG_CPU_CP15_MMU=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_HAS_ASID=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_PABRT_V7=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SPECTRE=y
+CONFIG_CPU_THUMB_CAPABLE=y
+CONFIG_CPU_TLB_V7=y
+CONFIG_CPU_V7=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CRC32=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_CTS=y
+CONFIG_CRYPTO_DRBG=y
+CONFIG_CRYPTO_DRBG_HMAC=y
+CONFIG_CRYPTO_DRBG_MENU=y
+CONFIG_CRYPTO_ECB=y
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_JITTERENTROPY=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_SHA1=y
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_LIB_UTILS=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_RNG_DEFAULT=y
+CONFIG_CRYPTO_SEQIV=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_XTS=y
+CONFIG_CURRENT_POINTER_IN_TPIDRURO=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DEBUG_LL_INCLUDE="mach/debug-macro.S"
+CONFIG_DIMLIB=y
+CONFIG_DMABUF_HEAPS=y
+CONFIG_DMABUF_HEAPS_CMA=y
+CONFIG_DMABUF_HEAPS_SYSTEM=y
+CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2708=y
+CONFIG_DMA_BCM2835=y
+CONFIG_DMA_CMA=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_OPS=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DMA_VIRTUAL_CHANNELS=y
+CONFIG_DNOTIFY=y
+CONFIG_DTC=y
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_EDAC_ATOMIC_SCRUB=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EXCLUSIVE_SYSTEM_RAM=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_EXTCON=y
+CONFIG_F2FS_FS=y
+CONFIG_FB=y
+CONFIG_FB_BCM2708=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+CONFIG_FB_CMDLINE=y
+# CONFIG_FB_RPISENSE is not set
+CONFIG_FB_SIMPLE=y
+CONFIG_FIQ=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FONT_8x16=y
+CONFIG_FONT_8x8=y
+CONFIG_FONT_SUPPORT=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY is not set
+CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
+CONFIG_FRAME_WARN=1024
+CONFIG_FREEZER=y
+CONFIG_FS_ENCRYPTION=y
+CONFIG_FS_ENCRYPTION_ALGS=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FS_POSIX_ACL=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CACHE=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_FW_LOADER_SYSFS=y
+CONFIG_GCC11_NO_ARRAY_BOUNDS=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ARCH_TOPOLOGY=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_GENERIC_IRQ_MULTI_HANDLER=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_MSI_IRQ=y
+CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GENERIC_VDSO_32=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_BCM_VIRT=y
+CONFIG_GPIO_CDEV=y
+# CONFIG_GPIO_FSM is not set
+CONFIG_GPIO_RASPBERRYPI_EXP=y
+CONFIG_HARDEN_BRANCH_PREDICTOR=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HAVE_SMP=y
+CONFIG_HIGHMEM=y
+CONFIG_HIGHPTE=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HW_CONSOLE=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_BCM2835=y
+CONFIG_HW_RANDOM_IPROC_RNG200=y
+CONFIG_HZ_FIXED=0
+CONFIG_I2C=y
+# CONFIG_I2C_BCM2708 is not set
+CONFIG_I2C_BOARDINFO=y
+CONFIG_INPUT=y
+CONFIG_INPUT_MOUSEDEV=y
+# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+CONFIG_IRQCHIP=y
+CONFIG_IRQSTACKS=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+CONFIG_JBD2=y
+CONFIG_KEYS=y
+CONFIG_KMAP_LOCAL=y
+CONFIG_KMAP_LOCAL_NON_LINEAR_PTE_ARRAY=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PWM=y
+CONFIG_LEDS_TRIGGER_ACTPWR=y
+CONFIG_LEDS_TRIGGER_INPUT=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_LOGO=y
+CONFIG_LOGO_LINUX_CLUT224=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_MAC_PARTITION=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MAILBOX=y
+# CONFIG_MAILBOX_TEST is not set
+CONFIG_MDIO_BCM_UNIMAC=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MEMORY_ISOLATION=y
+CONFIG_MFD_CORE=y
+# CONFIG_MFD_RASPBERRYPI_POE_HAT is not set
+# CONFIG_MFD_RPISENSE_CORE is not set
+CONFIG_MFD_SYSCON=y
+CONFIG_MICROCHIP_PHY=y
+CONFIG_MIGHT_HAVE_CACHE_L2X0=y
+CONFIG_MIGRATION=y
+CONFIG_MMC=y
+# CONFIG_MMC_BCM2835 is not set
+CONFIG_MMC_BCM2835_DMA=y
+CONFIG_MMC_BCM2835_MMC=y
+CONFIG_MMC_BCM2835_PIO_DMA_BARRIER=2
+CONFIG_MMC_BCM2835_SDHOST=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_IO_ACCESSORS=y
+CONFIG_MMC_SDHCI_IPROC=y
+# CONFIG_MMC_SDHCI_PCI is not set
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MODULES_USE_ELF_REL=y
+# CONFIG_MTD is not set
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEON=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_PTP_CLASSIFY=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NLS=y
+CONFIG_NLS_ASCII=y
+CONFIG_NOP_USB_XCEIV=y
+CONFIG_NO_HZ=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NR_CPUS=4
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_CONFIGFS=y
+CONFIG_OF_DYNAMIC=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_OF_OVERLAY=y
+CONFIG_OF_RESOLVE=y
+CONFIG_OLD_SIGACTION=y
+CONFIG_OLD_SIGSUSPEND3=y
+CONFIG_PADATA=y
+CONFIG_PAGE_OFFSET=0xC0000000
+CONFIG_PAGE_POOL=y
+CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
+CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
+CONFIG_PCI=y
+CONFIG_PCIEAER=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_BRCMSTB=y
+CONFIG_PCIE_PME=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PCI_MSI=y
+CONFIG_PCI_MSI_IRQ_DOMAIN=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=3
+CONFIG_PHYLIB=y
+CONFIG_PHYS_ADDR_T_64BIT=y
+CONFIG_PINCTRL=y
+CONFIG_PINCTRL_BCM2835=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_PM_GENERIC_DOMAINS_SLEEP=y
+CONFIG_PM_OPP=y
+CONFIG_PM_SLEEP=y
+CONFIG_PM_SLEEP_SMP=y
+# CONFIG_PM_USERSPACE_AUTOSLEEP is not set
+CONFIG_POWER_SUPPLY=y
+CONFIG_PPS=y
+CONFIG_PREEMPT_NONE_BUILD=y
+CONFIG_PRINTK_TIME=y
+CONFIG_PTP_1588_CLOCK=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_PWM=y
+CONFIG_PWM_BCM2835=y
+CONFIG_PWM_SYSFS=y
+CONFIG_RANDSTRUCT_NONE=y
+CONFIG_RAS=y
+CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_RASPBERRYPI_POWER=y
+CONFIG_RATIONAL=y
+# CONFIG_RAVE_SP_CORE is not set
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_GPIO=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RESET_RASPBERRYPI=y
+CONFIG_RESET_SIMPLE=y
+CONFIG_RFS_ACCEL=y
+# CONFIG_RPIVID_MEM is not set
+# CONFIG_RPI_POE_POWER is not set
+CONFIG_RPS=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+# CONFIG_SCSI_LOWLEVEL is not set
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_SERIAL_8250_BCM2835AUX=y
+# CONFIG_SERIAL_8250_DMA is not set
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_FSL=y
+CONFIG_SERIAL_8250_NR_UARTS=1
+CONFIG_SERIAL_8250_RUNTIME_UARTS=0
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_DEV_BUS=y
+# CONFIG_SERIAL_DEV_CTRL_TTYPORT is not set
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SG_POOL=y
+CONFIG_SMP=y
+CONFIG_SMP_ON_UP=y
+CONFIG_SMSC_PHY=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOFTIRQ_ON_OWN_STACK=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SRCU=y
+# CONFIG_STRIP_ASM_SYMS is not set
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+CONFIG_SWIOTLB=y
+CONFIG_SWPHY=y
+CONFIG_SWP_EMULATE=y
+CONFIG_SYS_SUPPORTS_APM_EMULATION=y
+# CONFIG_TEXTSEARCH is not set
+CONFIG_THERMAL=y
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_GOV_STEP_WISE=y
+CONFIG_THERMAL_OF=y
+CONFIG_THREAD_INFO_IN_TASK=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+# CONFIG_UCLAMP_TASK is not set
+CONFIG_UEVENT_HELPER_PATH=""
+# CONFIG_UID16 is not set
+CONFIG_UNCOMPRESS_INCLUDE="debug/uncompress.h"
+CONFIG_UNWINDER_ARM=y
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_DWCOTG=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_LAN78XX=y
+CONFIG_USB_NET_DRIVERS=y
+CONFIG_USB_NET_SMSC95XX=y
+CONFIG_USB_PCI=y
+CONFIG_USB_PHY=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_UAS=y
+# CONFIG_USB_UHCI_HCD is not set
+CONFIG_USB_USBNET=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_PCI=y
+CONFIG_USB_XHCI_PLATFORM=y
+CONFIG_USE_OF=y
+CONFIG_VCHIQ_CDEV=y
+CONFIG_VFP=y
+CONFIG_VFPv3=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_CONSOLE_SLEEP=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_XPS=y
+CONFIG_XZ_DEC_ARM=y
+CONFIG_XZ_DEC_BCJ=y
+CONFIG_ZBOOT_ROM_BSS=0
+CONFIG_ZBOOT_ROM_TEXT=0
diff --git a/target/linux/bcm27xx/bcm2710/config-6.1 b/target/linux/bcm27xx/bcm2710/config-6.1
new file mode 100644
index 00000000000000..295b6655895ec7
--- /dev/null
+++ b/target/linux/bcm27xx/bcm2710/config-6.1
@@ -0,0 +1,478 @@
+CONFIG_64BIT=y
+# CONFIG_AIO is not set
+CONFIG_APERTURE_HELPERS=y
+CONFIG_ARCH_BCM=y
+CONFIG_ARCH_BCM2835=y
+CONFIG_ARCH_BINFMT_ELF_EXTRA_PHDRS=y
+CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_ARCH_FORCE_MAX_ORDER=11
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
+CONFIG_ARCH_MMAP_RND_BITS=18
+CONFIG_ARCH_MMAP_RND_BITS_MAX=24
+CONFIG_ARCH_MMAP_RND_BITS_MIN=18
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=11
+CONFIG_ARCH_NR_GPIO=0
+CONFIG_ARCH_PROC_KCORE_TEXT=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_STACKWALK=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARCH_WANTS_NO_INSTR=y
+CONFIG_ARCH_WANTS_THP_SWAP=y
+CONFIG_ARM64=y
+CONFIG_ARM64_4K_PAGES=y
+CONFIG_ARM64_CNP=y
+CONFIG_ARM64_EPAN=y
+CONFIG_ARM64_ERRATUM_819472=y
+CONFIG_ARM64_ERRATUM_824069=y
+CONFIG_ARM64_ERRATUM_826319=y
+CONFIG_ARM64_ERRATUM_827319=y
+CONFIG_ARM64_ERRATUM_832075=y
+CONFIG_ARM64_ERRATUM_843419=y
+CONFIG_ARM64_HW_AFDBM=y
+CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
+CONFIG_ARM64_PAGE_SHIFT=12
+CONFIG_ARM64_PAN=y
+CONFIG_ARM64_PA_BITS=48
+CONFIG_ARM64_PA_BITS_48=y
+CONFIG_ARM64_PTR_AUTH=y
+CONFIG_ARM64_PTR_AUTH_KERNEL=y
+CONFIG_ARM64_SVE=y
+CONFIG_ARM64_TAGGED_ADDR_ABI=y
+CONFIG_ARM64_VA_BITS=39
+CONFIG_ARM64_VA_BITS_39=y
+CONFIG_ARM64_WORKAROUND_CLEAN_CACHE=y
+CONFIG_ARM_AMBA=y
+CONFIG_ARM_ARCH_TIMER=y
+CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+CONFIG_ARM_ARCH_TIMER_OOL_WORKAROUND=y
+CONFIG_ARM_GIC=y
+CONFIG_ARM_GIC_V2M=y
+CONFIG_ARM_GIC_V3=y
+CONFIG_ARM_GIC_V3_ITS=y
+CONFIG_ARM_GIC_V3_ITS_PCI=y
+# CONFIG_ARM_MHU_V2 is not set
+CONFIG_ARM_PSCI_FW=y
+CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
+CONFIG_ARM_TIMER_SP804=y
+CONFIG_ASSOCIATIVE_ARRAY=y
+CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
+CONFIG_BCM2708_VCMEM=y
+# CONFIG_BCM2711_THERMAL is not set
+CONFIG_BCM2835_DEVGPIOMEM=y
+CONFIG_BCM2835_MBOX=y
+CONFIG_BCM2835_POWER=y
+# CONFIG_BCM2835_SMI is not set
+CONFIG_BCM2835_THERMAL=y
+CONFIG_BCM2835_VCHIQ=y
+# CONFIG_BCM2835_VCHIQ_MMAL is not set
+CONFIG_BCM2835_WDT=y
+CONFIG_BCM_VCIO=y
+# CONFIG_BCM_VC_SM_CMA is not set
+CONFIG_BCM_VIDEOCORE=y
+# CONFIG_BLK_DEV_INITRD is not set
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BRCMSTB_L2_IRQ=y
+CONFIG_BRCM_CHAR_DRIVERS=y
+CONFIG_CAVIUM_ERRATUM_22375=y
+CONFIG_CAVIUM_ERRATUM_23154=y
+CONFIG_CAVIUM_ERRATUM_27456=y
+CONFIG_CC_HAVE_SHADOW_CALL_STACK=y
+CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
+CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
+CONFIG_CC_NO_ARRAY_BOUNDS=y
+CONFIG_CLKSRC_MMIO=y
+CONFIG_CLK_BCM2711_DVP=y
+CONFIG_CLK_BCM2835=y
+CONFIG_CLK_RASPBERRYPI=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CMA=y
+CONFIG_CMA_ALIGNMENT=8
+CONFIG_CMA_AREAS=7
+# CONFIG_CMA_DEBUG is not set
+# CONFIG_CMA_DEBUGFS is not set
+CONFIG_CMA_SIZE_MBYTES=5
+# CONFIG_CMA_SIZE_SEL_MAX is not set
+CONFIG_CMA_SIZE_SEL_MBYTES=y
+# CONFIG_CMA_SIZE_SEL_MIN is not set
+# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
+# CONFIG_CMA_SYSFS is not set
+CONFIG_COMMON_CLK=y
+CONFIG_COMMON_CLK_XGENE=y
+CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
+# CONFIG_COMPAT_32BIT_TIME is not set
+CONFIG_CONFIGFS_FS=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CONTEXT_TRACKING=y
+CONFIG_CONTEXT_TRACKING_IDLE=y
+CONFIG_CONTIG_ALLOC=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_RMAP=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_BS=y
+CONFIG_CRYPTO_AES_ARM64_NEON_BLK=y
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CRC32=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_CRYPTD=y
+CONFIG_CRYPTO_CTS=y
+CONFIG_CRYPTO_DRBG=y
+CONFIG_CRYPTO_DRBG_HMAC=y
+CONFIG_CRYPTO_DRBG_MENU=y
+CONFIG_CRYPTO_ECB=y
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_JITTERENTROPY=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_SHA1=y
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_LIB_UTILS=y
+# CONFIG_CRYPTO_POLYVAL_ARM64_CE is not set
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_RNG_DEFAULT=y
+CONFIG_CRYPTO_SEQIV=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA256_ARM64=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_SHA512_ARM64=y
+# CONFIG_CRYPTO_SM4_ARM64_CE_BLK is not set
+# CONFIG_CRYPTO_SM4_ARM64_NEON_BLK is not set
+CONFIG_CRYPTO_XTS=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DMABUF_HEAPS=y
+CONFIG_DMABUF_HEAPS_CMA=y
+CONFIG_DMABUF_HEAPS_SYSTEM=y
+CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2708=y
+CONFIG_DMA_BCM2835=y
+CONFIG_DMA_CMA=y
+CONFIG_DMA_DIRECT_REMAP=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DMA_VIRTUAL_CHANNELS=y
+CONFIG_DNOTIFY=y
+CONFIG_DTC=y
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EXCLUSIVE_SYSTEM_RAM=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_EXTCON=y
+CONFIG_F2FS_FS=y
+CONFIG_FB=y
+CONFIG_FB_BCM2708=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+CONFIG_FB_CMDLINE=y
+# CONFIG_FB_RPISENSE is not set
+CONFIG_FB_SIMPLE=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FONT_8x16=y
+CONFIG_FONT_8x8=y
+CONFIG_FONT_SUPPORT=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY is not set
+CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
+CONFIG_FRAME_POINTER=y
+CONFIG_FRAME_WARN=2048
+CONFIG_FREEZER=y
+CONFIG_FSL_ERRATUM_A008585=y
+CONFIG_FS_ENCRYPTION=y
+CONFIG_FS_ENCRYPTION_ALGS=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FS_POSIX_ACL=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CACHE=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_FW_LOADER_SYSFS=y
+CONFIG_GCC11_NO_ARRAY_BOUNDS=y
+CONFIG_GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_REGS=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ARCH_TOPOLOGY=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_CSUM=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IOREMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_MSI_IRQ=y
+CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_BCM_VIRT=y
+CONFIG_GPIO_CDEV=y
+# CONFIG_GPIO_FSM is not set
+CONFIG_GPIO_RASPBERRYPI_EXP=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HW_CONSOLE=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_BCM2835=y
+CONFIG_I2C=y
+# CONFIG_I2C_BCM2708 is not set
+CONFIG_I2C_BOARDINFO=y
+CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
+CONFIG_INPUT=y
+CONFIG_INPUT_MOUSEDEV=y
+# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+CONFIG_JBD2=y
+CONFIG_KEYS=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PWM=y
+CONFIG_LEDS_TRIGGER_ACTPWR=y
+CONFIG_LEDS_TRIGGER_INPUT=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_LOGO=y
+CONFIG_LOGO_LINUX_CLUT224=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_MAC_PARTITION=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MAILBOX=y
+# CONFIG_MAILBOX_TEST is not set
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MEMORY_ISOLATION=y
+CONFIG_MFD_CORE=y
+# CONFIG_MFD_RASPBERRYPI_POE_HAT is not set
+# CONFIG_MFD_RPISENSE_CORE is not set
+CONFIG_MFD_SYSCON=y
+CONFIG_MICROCHIP_PHY=y
+CONFIG_MIGRATION=y
+CONFIG_MMC=y
+# CONFIG_MMC_BCM2835 is not set
+CONFIG_MMC_BCM2835_DMA=y
+CONFIG_MMC_BCM2835_MMC=y
+CONFIG_MMC_BCM2835_PIO_DMA_BARRIER=2
+CONFIG_MMC_BCM2835_SDHOST=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_IO_ACCESSORS=y
+CONFIG_MMC_SDHCI_IPROC=y
+# CONFIG_MMC_SDHCI_PCI is not set
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MODULES_USE_ELF_RELA=y
+# CONFIG_MTD is not set
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_SG_DMA_LENGTH=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NLS=y
+CONFIG_NLS_ASCII=y
+CONFIG_NOP_USB_XCEIV=y
+CONFIG_NO_HZ=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NR_CPUS=4
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_CONFIGFS=y
+CONFIG_OF_DYNAMIC=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_OF_OVERLAY=y
+CONFIG_OF_RESOLVE=y
+CONFIG_PADATA=y
+CONFIG_PAGE_POOL=y
+CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
+CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
+CONFIG_PARTITION_PERCPU=y
+CONFIG_PCI=y
+# CONFIG_PCIE_BRCMSTB is not set
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PCI_MSI=y
+CONFIG_PCI_MSI_IRQ_DOMAIN=y
+CONFIG_PGTABLE_LEVELS=3
+CONFIG_PHYLIB=y
+CONFIG_PHYS_ADDR_T_64BIT=y
+CONFIG_PINCTRL=y
+CONFIG_PINCTRL_BCM2835=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_PM_GENERIC_DOMAINS_SLEEP=y
+CONFIG_PM_OPP=y
+CONFIG_PM_SLEEP=y
+CONFIG_PM_SLEEP_SMP=y
+# CONFIG_PM_USERSPACE_AUTOSLEEP is not set
+CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PREEMPT_NONE_BUILD=y
+CONFIG_PRINTK_TIME=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_PWM=y
+CONFIG_PWM_BCM2835=y
+CONFIG_PWM_SYSFS=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RANDSTRUCT_NONE=y
+CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_RASPBERRYPI_POWER=y
+CONFIG_RATIONAL=y
+# CONFIG_RAVE_SP_CORE is not set
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_GPIO=y
+CONFIG_RESET_CONTROLLER=y
+# CONFIG_RESET_RASPBERRYPI is not set
+CONFIG_RESET_SIMPLE=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RODATA_FULL_DEFAULT_ENABLED=y
+# CONFIG_RPIVID_MEM is not set
+# CONFIG_RPI_POE_POWER is not set
+CONFIG_RPS=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+# CONFIG_SCSI_LOWLEVEL is not set
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_SERIAL_8250_BCM2835AUX=y
+# CONFIG_SERIAL_8250_DMA is not set
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_FSL=y
+CONFIG_SERIAL_8250_NR_UARTS=1
+CONFIG_SERIAL_8250_RUNTIME_UARTS=0
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_DEV_BUS=y
+# CONFIG_SERIAL_DEV_CTRL_TTYPORT is not set
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SG_POOL=y
+CONFIG_SMP=y
+CONFIG_SMSC_PHY=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOFTIRQ_ON_OWN_STACK=y
+CONFIG_SPARSEMEM=y
+CONFIG_SPARSEMEM_EXTREME=y
+CONFIG_SPARSEMEM_VMEMMAP=y
+CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SRCU=y
+# CONFIG_STRIP_ASM_SYMS is not set
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+CONFIG_SWIOTLB=y
+CONFIG_SWPHY=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+# CONFIG_TEXTSEARCH is not set
+CONFIG_THERMAL=y
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_GOV_STEP_WISE=y
+CONFIG_THERMAL_OF=y
+CONFIG_THERMAL_WRITABLE_TRIPS=y
+CONFIG_THREAD_INFO_IN_TASK=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+# CONFIG_UCLAMP_TASK is not set
+CONFIG_UEVENT_HELPER_PATH=""
+CONFIG_UNMAP_KERNEL_AT_EL0=y
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_DWCOTG=y
+CONFIG_USB_LAN78XX=y
+CONFIG_USB_NET_DRIVERS=y
+CONFIG_USB_NET_SMSC95XX=y
+CONFIG_USB_PHY=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_UAS=y
+CONFIG_USB_USBNET=y
+CONFIG_VCHIQ_CDEV=y
+CONFIG_VMAP_STACK=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_CONSOLE_SLEEP=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_XPS=y
+CONFIG_XZ_DEC_ARM=y
+CONFIG_XZ_DEC_BCJ=y
+CONFIG_ZONE_DMA32=y
diff --git a/target/linux/bcm27xx/bcm2711/config-6.1 b/target/linux/bcm27xx/bcm2711/config-6.1
new file mode 100644
index 00000000000000..6642a88142d1d5
--- /dev/null
+++ b/target/linux/bcm27xx/bcm2711/config-6.1
@@ -0,0 +1,492 @@
+CONFIG_64BIT=y
+# CONFIG_AIO is not set
+CONFIG_APERTURE_HELPERS=y
+CONFIG_ARCH_BCM=y
+CONFIG_ARCH_BCM2835=y
+CONFIG_ARCH_BINFMT_ELF_EXTRA_PHDRS=y
+CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_ARCH_FORCE_MAX_ORDER=11
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
+CONFIG_ARCH_MMAP_RND_BITS=18
+CONFIG_ARCH_MMAP_RND_BITS_MAX=24
+CONFIG_ARCH_MMAP_RND_BITS_MIN=18
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=11
+CONFIG_ARCH_NR_GPIO=0
+CONFIG_ARCH_PROC_KCORE_TEXT=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_STACKWALK=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARCH_WANTS_NO_INSTR=y
+CONFIG_ARCH_WANTS_THP_SWAP=y
+CONFIG_ARM64=y
+CONFIG_ARM64_4K_PAGES=y
+CONFIG_ARM64_CNP=y
+CONFIG_ARM64_EPAN=y
+CONFIG_ARM64_ERRATUM_819472=y
+CONFIG_ARM64_ERRATUM_824069=y
+CONFIG_ARM64_ERRATUM_826319=y
+CONFIG_ARM64_ERRATUM_827319=y
+CONFIG_ARM64_ERRATUM_832075=y
+CONFIG_ARM64_ERRATUM_843419=y
+CONFIG_ARM64_HW_AFDBM=y
+CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
+CONFIG_ARM64_PAGE_SHIFT=12
+CONFIG_ARM64_PAN=y
+CONFIG_ARM64_PA_BITS=48
+CONFIG_ARM64_PA_BITS_48=y
+CONFIG_ARM64_PTR_AUTH=y
+CONFIG_ARM64_PTR_AUTH_KERNEL=y
+CONFIG_ARM64_SVE=y
+CONFIG_ARM64_TAGGED_ADDR_ABI=y
+CONFIG_ARM64_VA_BITS=39
+CONFIG_ARM64_VA_BITS_39=y
+CONFIG_ARM64_WORKAROUND_CLEAN_CACHE=y
+CONFIG_ARM_AMBA=y
+CONFIG_ARM_ARCH_TIMER=y
+CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+CONFIG_ARM_ARCH_TIMER_OOL_WORKAROUND=y
+CONFIG_ARM_GIC=y
+CONFIG_ARM_GIC_V2M=y
+CONFIG_ARM_GIC_V3=y
+CONFIG_ARM_GIC_V3_ITS=y
+CONFIG_ARM_GIC_V3_ITS_PCI=y
+# CONFIG_ARM_MHU_V2 is not set
+CONFIG_ARM_PSCI_FW=y
+CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
+CONFIG_ARM_TIMER_SP804=y
+CONFIG_ASSOCIATIVE_ARRAY=y
+CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
+CONFIG_BCM2708_VCMEM=y
+CONFIG_BCM2711_THERMAL=y
+CONFIG_BCM2835_DEVGPIOMEM=y
+CONFIG_BCM2835_MBOX=y
+CONFIG_BCM2835_POWER=y
+# CONFIG_BCM2835_SMI is not set
+# CONFIG_BCM2835_THERMAL is not set
+CONFIG_BCM2835_VCHIQ=y
+# CONFIG_BCM2835_VCHIQ_MMAL is not set
+CONFIG_BCM2835_WDT=y
+CONFIG_BCM7XXX_PHY=y
+CONFIG_BCMGENET=y
+CONFIG_BCM_NET_PHYLIB=y
+CONFIG_BCM_VCIO=y
+# CONFIG_BCM_VC_SM_CMA is not set
+CONFIG_BCM_VIDEOCORE=y
+# CONFIG_BLK_DEV_INITRD is not set
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BRCMSTB_L2_IRQ=y
+CONFIG_BRCM_CHAR_DRIVERS=y
+CONFIG_BROADCOM_PHY=y
+CONFIG_CAVIUM_ERRATUM_22375=y
+CONFIG_CAVIUM_ERRATUM_23154=y
+CONFIG_CAVIUM_ERRATUM_27456=y
+CONFIG_CC_HAVE_SHADOW_CALL_STACK=y
+CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
+CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
+CONFIG_CC_NO_ARRAY_BOUNDS=y
+CONFIG_CLKSRC_MMIO=y
+CONFIG_CLK_BCM2711_DVP=y
+CONFIG_CLK_BCM2835=y
+CONFIG_CLK_RASPBERRYPI=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CMA=y
+CONFIG_CMA_ALIGNMENT=8
+CONFIG_CMA_AREAS=7
+# CONFIG_CMA_DEBUG is not set
+# CONFIG_CMA_DEBUGFS is not set
+CONFIG_CMA_SIZE_MBYTES=5
+# CONFIG_CMA_SIZE_SEL_MAX is not set
+CONFIG_CMA_SIZE_SEL_MBYTES=y
+# CONFIG_CMA_SIZE_SEL_MIN is not set
+# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
+# CONFIG_CMA_SYSFS is not set
+CONFIG_COMMON_CLK=y
+CONFIG_COMMON_CLK_XGENE=y
+CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
+# CONFIG_COMPAT_32BIT_TIME is not set
+CONFIG_CONFIGFS_FS=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CONTEXT_TRACKING=y
+CONFIG_CONTEXT_TRACKING_IDLE=y
+CONFIG_CONTIG_ALLOC=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_RMAP=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_BS=y
+CONFIG_CRYPTO_AES_ARM64_NEON_BLK=y
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CRC32=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_CRYPTD=y
+CONFIG_CRYPTO_CTS=y
+CONFIG_CRYPTO_DRBG=y
+CONFIG_CRYPTO_DRBG_HMAC=y
+CONFIG_CRYPTO_DRBG_MENU=y
+CONFIG_CRYPTO_ECB=y
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_JITTERENTROPY=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_SHA1=y
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_LIB_UTILS=y
+# CONFIG_CRYPTO_POLYVAL_ARM64_CE is not set
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_RNG_DEFAULT=y
+CONFIG_CRYPTO_SEQIV=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA256_ARM64=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_SHA512_ARM64=y
+# CONFIG_CRYPTO_SM4_ARM64_CE_BLK is not set
+# CONFIG_CRYPTO_SM4_ARM64_NEON_BLK is not set
+CONFIG_CRYPTO_XTS=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DIMLIB=y
+CONFIG_DMABUF_HEAPS=y
+CONFIG_DMABUF_HEAPS_CMA=y
+CONFIG_DMABUF_HEAPS_SYSTEM=y
+CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2708=y
+CONFIG_DMA_BCM2835=y
+CONFIG_DMA_CMA=y
+CONFIG_DMA_DIRECT_REMAP=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DMA_VIRTUAL_CHANNELS=y
+CONFIG_DNOTIFY=y
+CONFIG_DTC=y
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EXCLUSIVE_SYSTEM_RAM=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_EXTCON=y
+CONFIG_F2FS_FS=y
+CONFIG_FB=y
+CONFIG_FB_BCM2708=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+CONFIG_FB_CMDLINE=y
+# CONFIG_FB_RPISENSE is not set
+CONFIG_FB_SIMPLE=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FONT_8x16=y
+CONFIG_FONT_8x8=y
+CONFIG_FONT_SUPPORT=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY is not set
+CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
+CONFIG_FRAME_POINTER=y
+CONFIG_FRAME_WARN=2048
+CONFIG_FREEZER=y
+CONFIG_FSL_ERRATUM_A008585=y
+CONFIG_FS_ENCRYPTION=y
+CONFIG_FS_ENCRYPTION_ALGS=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FS_POSIX_ACL=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CACHE=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_FW_LOADER_SYSFS=y
+CONFIG_GCC11_NO_ARRAY_BOUNDS=y
+CONFIG_GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_REGS=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ARCH_TOPOLOGY=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_CSUM=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IOREMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_MSI_IRQ=y
+CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_BCM_VIRT=y
+CONFIG_GPIO_CDEV=y
+# CONFIG_GPIO_FSM is not set
+CONFIG_GPIO_RASPBERRYPI_EXP=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HW_CONSOLE=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_IPROC_RNG200=y
+CONFIG_I2C=y
+# CONFIG_I2C_BCM2708 is not set
+CONFIG_I2C_BOARDINFO=y
+CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
+CONFIG_INPUT=y
+CONFIG_INPUT_MOUSEDEV=y
+# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+CONFIG_JBD2=y
+CONFIG_KEYS=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PWM=y
+CONFIG_LEDS_TRIGGER_ACTPWR=y
+CONFIG_LEDS_TRIGGER_INPUT=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_LOGO=y
+CONFIG_LOGO_LINUX_CLUT224=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_MAC_PARTITION=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MAILBOX=y
+# CONFIG_MAILBOX_TEST is not set
+CONFIG_MDIO_BCM_UNIMAC=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MEMORY_ISOLATION=y
+CONFIG_MFD_CORE=y
+# CONFIG_MFD_RASPBERRYPI_POE_HAT is not set
+# CONFIG_MFD_RPISENSE_CORE is not set
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MMC=y
+# CONFIG_MMC_BCM2835 is not set
+CONFIG_MMC_BCM2835_DMA=y
+CONFIG_MMC_BCM2835_MMC=y
+CONFIG_MMC_BCM2835_PIO_DMA_BARRIER=2
+CONFIG_MMC_BCM2835_SDHOST=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_IO_ACCESSORS=y
+CONFIG_MMC_SDHCI_IPROC=y
+# CONFIG_MMC_SDHCI_PCI is not set
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MODULES_USE_ELF_RELA=y
+# CONFIG_MTD is not set
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_SG_DMA_LENGTH=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_PTP_CLASSIFY=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NLS=y
+CONFIG_NLS_ASCII=y
+CONFIG_NOP_USB_XCEIV=y
+CONFIG_NO_HZ=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NR_CPUS=4
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_CONFIGFS=y
+CONFIG_OF_DYNAMIC=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_OF_OVERLAY=y
+CONFIG_OF_RESOLVE=y
+CONFIG_PADATA=y
+CONFIG_PAGE_POOL=y
+CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
+CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
+CONFIG_PARTITION_PERCPU=y
+CONFIG_PCI=y
+CONFIG_PCIEAER=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_BRCMSTB=y
+CONFIG_PCIE_PME=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PCI_MSI=y
+CONFIG_PCI_MSI_IRQ_DOMAIN=y
+CONFIG_PGTABLE_LEVELS=3
+CONFIG_PHYLIB=y
+CONFIG_PHYS_ADDR_T_64BIT=y
+CONFIG_PINCTRL=y
+CONFIG_PINCTRL_BCM2835=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_PM_GENERIC_DOMAINS_SLEEP=y
+CONFIG_PM_OPP=y
+CONFIG_PM_SLEEP=y
+CONFIG_PM_SLEEP_SMP=y
+# CONFIG_PM_USERSPACE_AUTOSLEEP is not set
+CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PPS=y
+CONFIG_PREEMPT_NONE_BUILD=y
+CONFIG_PRINTK_TIME=y
+CONFIG_PTP_1588_CLOCK=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_PWM=y
+CONFIG_PWM_BCM2835=y
+CONFIG_PWM_SYSFS=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RANDSTRUCT_NONE=y
+CONFIG_RAS=y
+CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_RASPBERRYPI_POWER=y
+CONFIG_RATIONAL=y
+# CONFIG_RAVE_SP_CORE is not set
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_GPIO=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RESET_RASPBERRYPI=y
+CONFIG_RESET_SIMPLE=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RODATA_FULL_DEFAULT_ENABLED=y
+# CONFIG_RPIVID_MEM is not set
+# CONFIG_RPI_POE_POWER is not set
+CONFIG_RPS=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+# CONFIG_SCSI_LOWLEVEL is not set
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_SERIAL_8250_BCM2835AUX=y
+# CONFIG_SERIAL_8250_DMA is not set
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_FSL=y
+CONFIG_SERIAL_8250_NR_UARTS=1
+CONFIG_SERIAL_8250_RUNTIME_UARTS=0
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_DEV_BUS=y
+# CONFIG_SERIAL_DEV_CTRL_TTYPORT is not set
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SG_POOL=y
+CONFIG_SMP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOFTIRQ_ON_OWN_STACK=y
+CONFIG_SPARSEMEM=y
+CONFIG_SPARSEMEM_EXTREME=y
+CONFIG_SPARSEMEM_VMEMMAP=y
+CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SRCU=y
+# CONFIG_STRIP_ASM_SYMS is not set
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+CONFIG_SWIOTLB=y
+CONFIG_SWPHY=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+# CONFIG_TEXTSEARCH is not set
+CONFIG_THERMAL=y
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_GOV_STEP_WISE=y
+CONFIG_THERMAL_OF=y
+CONFIG_THERMAL_WRITABLE_TRIPS=y
+CONFIG_THREAD_INFO_IN_TASK=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+# CONFIG_UCLAMP_TASK is not set
+CONFIG_UEVENT_HELPER_PATH=""
+CONFIG_UNMAP_KERNEL_AT_EL0=y
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_DWCOTG=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_PCI=y
+CONFIG_USB_PHY=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_UAS=y
+# CONFIG_USB_UHCI_HCD is not set
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_PCI=y
+CONFIG_USB_XHCI_PLATFORM=y
+CONFIG_VCHIQ_CDEV=y
+CONFIG_VMAP_STACK=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_CONSOLE_SLEEP=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_XPS=y
+CONFIG_XZ_DEC_ARM=y
+CONFIG_XZ_DEC_BCJ=y
+CONFIG_ZONE_DMA32=y
diff --git a/target/linux/bcm27xx/image/Makefile b/target/linux/bcm27xx/image/Makefile
index 4cd1052941cc74..ad79ac7d0cb550 100644
--- a/target/linux/bcm27xx/image/Makefile
+++ b/target/linux/bcm27xx/image/Makefile
@@ -76,8 +76,8 @@ define Device/rpi
 	raspberrypi,model-zero raspberrypi,model-zero-w
   DEVICE_PACKAGES := \
 	cypress-firmware-43430-sdio \
-	cypress-nvram-43430-sdio-rpi-zero-w \
-	kmod-brcmfmac wpad-basic-wolfssl
+	brcmfmac-nvram-43430-sdio \
+	kmod-brcmfmac wpad-basic-mbedtls
 endef
 ifeq ($(SUBTARGET),bcm2708)
   TARGET_DEVICES += rpi
@@ -87,10 +87,10 @@ define Device/rpi-2
   DEVICE_MODEL := 2B/2B 1.2
   DEVICE_VARIANT := (32bit)
   DEVICE_ALT0_VENDOR := Raspberry Pi
-  DEVICE_ALT0_MODEL := 3B/3B+/3CM
+  DEVICE_ALT0_MODEL := 3B/3B+/CM3
   DEVICE_ALT0_VARIANT := (32bit)
   DEVICE_ALT1_VENDOR := Raspberry Pi
-  DEVICE_ALT1_MODEL := 4B/400/4CM
+  DEVICE_ALT1_MODEL := 4B/400/CM4
   DEVICE_ALT1_VARIANT := (32bit)
   DEVICE_DTS := \
 	bcm2709-rpi-2-b bcm2710-rpi-2-b \
@@ -107,10 +107,10 @@ define Device/rpi-2
 	raspberrypi,model-zero-2
   DEVICE_PACKAGES := \
 	cypress-firmware-43430-sdio \
-	cypress-nvram-43430-sdio-rpi-3b \
+	brcmfmac-nvram-43430-sdio \
 	cypress-firmware-43455-sdio \
-	cypress-nvram-43455-sdio-rpi-3b-plus cypress-nvram-43455-sdio-rpi-4b \
-	kmod-brcmfmac wpad-basic-wolfssl
+	brcmfmac-nvram-43455-sdio \
+	kmod-brcmfmac wpad-basic-mbedtls
   IMAGE/sysupgrade.img.gz := boot-common | boot-2708 | boot-2711 | sdcard-img | gzip | append-metadata
   IMAGE/factory.img.gz := boot-common | boot-2708 | boot-2711 | sdcard-img | gzip
 endef
@@ -119,7 +119,7 @@ ifeq ($(SUBTARGET),bcm2709)
 endif
 
 define Device/rpi-3
-  DEVICE_MODEL := 3B/3B+/3CM
+  DEVICE_MODEL := 3B/3B+/CM3
   DEVICE_VARIANT := (64bit)
   DEVICE_ALT0_VENDOR := Raspberry Pi
   DEVICE_ALT0_MODEL := 2B-1.2
@@ -138,17 +138,17 @@ define Device/rpi-3
 	raspberrypi,model-zero-2
   DEVICE_PACKAGES := \
 	cypress-firmware-43430-sdio \
-	cypress-nvram-43430-sdio-rpi-3b \
+	brcmfmac-nvram-43430-sdio \
 	cypress-firmware-43455-sdio \
-	cypress-nvram-43455-sdio-rpi-3b-plus \
-	kmod-brcmfmac wpad-basic-wolfssl
+	brcmfmac-nvram-43455-sdio \
+	kmod-brcmfmac wpad-basic-mbedtls
 endef
 ifeq ($(SUBTARGET),bcm2710)
   TARGET_DEVICES += rpi-3
 endif
 
 define Device/rpi-4
-  DEVICE_MODEL := 4B/400/4CM
+  DEVICE_MODEL := 4B/400/CM4
   DEVICE_VARIANT := (64bit)
   KERNEL_IMG := kernel8.img
   DEVICE_DTS := \
@@ -161,9 +161,10 @@ define Device/rpi-4
 	raspberrypi,4-model-b
   DEVICE_PACKAGES := \
 	cypress-firmware-43455-sdio \
-	cypress-nvram-43455-sdio-rpi-4b \
-	kmod-brcmfmac wpad-basic-wolfssl \
-	kmod-usb-net-lan78xx
+	brcmfmac-nvram-43455-sdio \
+	kmod-brcmfmac wpad-basic-mbedtls \
+	kmod-usb-net-lan78xx \
+	kmod-r8169
   IMAGE/sysupgrade.img.gz := boot-common | boot-2711 | sdcard-img | gzip | append-metadata
   IMAGE/factory.img.gz := boot-common | boot-2711 | sdcard-img | gzip
 endef
diff --git a/target/linux/bcm27xx/modules/other.mk b/target/linux/bcm27xx/modules/other.mk
index a9103029edb2d0..99b71d4d695af1 100644
--- a/target/linux/bcm27xx/modules/other.mk
+++ b/target/linux/bcm27xx/modules/other.mk
@@ -10,7 +10,7 @@ define KernelPackage/pwm-raspberrypi-poe
     CONFIG_PWM_RASPBERRYPI_POE
   FILES:=$(LINUX_DIR)/drivers/pwm/pwm-raspberrypi-poe.ko
   AUTOLOAD:=$(call AutoLoad,20,pwm-raspberrypi-poe)
-  DEPENDS:=@TARGET_bcm27xx @LINUX_5_15 +kmod-hwmon-pwmfan
+  DEPENDS:=@TARGET_bcm27xx +kmod-hwmon-pwmfan
 endef
 
 define KernelPackage/pwm-raspberrypi-poe/description
diff --git a/target/linux/bcm27xx/modules/sound.mk b/target/linux/bcm27xx/modules/sound.mk
index cf12ec33a19170..e61f07852b6a79 100644
--- a/target/linux/bcm27xx/modules/sound.mk
+++ b/target/linux/bcm27xx/modules/sound.mk
@@ -371,8 +371,7 @@ define KernelPackage/sound-soc-chipdip-dac
     $(LINUX_DIR)/sound/soc/bcm/snd-soc-chipdip-dac.ko
   AUTOLOAD:=$(call AutoLoad,68,snd-soc-chipdip-dac)
   DEPENDS:= \
-    kmod-sound-soc-bcm2835-i2s \
-    @LINUX_5_10
+    kmod-sound-soc-bcm2835-i2s
   $(call AddDepends/sound)
 endef
 
@@ -383,6 +382,29 @@ endef
 $(eval $(call KernelPackage,sound-soc-chipdip-dac))
 
 
+define KernelPackage/sound-soc-dacberry-soundcard
+  TITLE:=Support for DACBERRY400 Soundcard
+  KCONFIG:= \
+    CONFIG_SND_DACBERRY400 \
+    CONFIG_SND_SOC_TLV320AIC3X_I2C
+  FILES:= \
+    $(LINUX_DIR)/sound/soc/bcm/snd-soc-dacberry400.ko \
+    $(LINUX_DIR)/sound/soc/codecs/snd-soc-tlv320aic3x.ko
+  AUTOLOAD:=$(call AutoLoad,68,snd-soc-tlv320aic3x-i2c snd-soc-dacberry400)
+  DEPENDS:= \
+    kmod-sound-soc-bcm2835-i2s \
+    +kmod-i2c-bcm2835 \
+    +kmod-regmap-i2c
+  $(call AddDepends/sound)
+endef
+
+define KernelPackage/sound-soc-dacberry-soundcard/description
+  This package contains support for DACBERRY400 Soundcard
+endef
+
+$(eval $(call KernelPackage,sound-soc-dacberry-soundcard))
+
+
 define KernelPackage/sound-soc-digidac1-soundcard
   TITLE:=Support for RRA DigiDAC1
   KCONFIG:= \
@@ -660,14 +682,17 @@ define KernelPackage/sound-soc-hifiberry-digi
   TITLE:=Support for HifiBerry Digi / Digi+ / Digi+ Pro
   KCONFIG:= \
     CONFIG_SND_BCM2708_SOC_HIFIBERRY_DIGI \
-    CONFIG_SND_SOC_WM8804
+    CONFIG_SND_SOC_WM8804 \
+    CONFIG_SND_SOC_WM8804_I2C
   FILES:= \
-    $(LINUX_DIR)/sound/soc/codecs/snd-soc-wm8804.ko
-  AUTOLOAD:=$(call AutoLoad,68,snd-soc-wm8804)
+    $(LINUX_DIR)/sound/soc/codecs/snd-soc-wm8804.ko \
+    $(LINUX_DIR)/sound/soc/codecs/snd-soc-wm8804-i2c.ko
+  AUTOLOAD:=$(call AutoLoad,68,snd-soc-wm8804 snd-soc-wm8804-i2c)
   DEPENDS:= \
     kmod-sound-soc-bcm2835-i2s \
     +kmod-sound-soc-rpi-wm8804-soundcard \
-    +kmod-i2c-bcm2835
+    +kmod-i2c-bcm2835 \
+    +kmod-regmap-i2c
   $(call AddDepends/sound)
 endef
 
@@ -803,17 +828,23 @@ define KernelPackage/sound-soc-justboom-both
   KCONFIG:= \
     CONFIG_SND_BCM2708_SOC_JUSTBOOM_BOTH \
     CONFIG_SND_SOC_PCM512x \
-    CONFIG_SND_SOC_WM8804
+    CONFIG_SND_SOC_PCM512x_I2C \
+    CONFIG_SND_SOC_WM8804 \
+    CONFIG_SND_SOC_WM8804_I2C
   FILES:= \
     $(LINUX_DIR)/sound/soc/bcm/snd-soc-justboom-both.ko \
     $(LINUX_DIR)/sound/soc/codecs/snd-soc-pcm512x.ko \
-    $(LINUX_DIR)/sound/soc/codecs/snd-soc-wm8804.ko
-  AUTOLOAD:=$(call AutoLoad,68,snd-soc-pcm512x snd-soc-wm8804 \
+    $(LINUX_DIR)/sound/soc/codecs/snd-soc-pcm512x-i2c.ko \
+    $(LINUX_DIR)/sound/soc/codecs/snd-soc-wm8804.ko \
+    $(LINUX_DIR)/sound/soc/codecs/snd-soc-wm8804-i2c.ko
+  AUTOLOAD:=$(call AutoLoad,68,snd-soc-pcm512x-i2c snd-soc-pcm512x \
+    snd-soc-wm8804-i2c snd-soc-wm8804 \
     snd-soc-justboom-both)
   DEPENDS:= \
     kmod-sound-soc-bcm2835-i2s \
     +kmod-sound-soc-rpi-wm8804-soundcard \
-    +kmod-i2c-bcm2835
+    +kmod-i2c-bcm2835 \
+    +kmod-regmap-i2c
   $(call AddDepends/sound)
 endef
 
@@ -828,14 +859,18 @@ define KernelPackage/sound-soc-justboom-dac
   TITLE:=Support for JustBoom DAC
   KCONFIG:= \
     CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC \
-    CONFIG_SND_SOC_PCM512x
+    CONFIG_SND_SOC_PCM512x \
+    CONFIG_SND_SOC_PCM512x_I2C
   FILES:= \
     $(LINUX_DIR)/sound/soc/bcm/snd-soc-justboom-dac.ko \
-    $(LINUX_DIR)/sound/soc/codecs/snd-soc-pcm512x.ko
-  AUTOLOAD:=$(call AutoLoad,68,snd-soc-pcm512x snd-soc-justboom-dac)
+    $(LINUX_DIR)/sound/soc/codecs/snd-soc-pcm512x.ko \
+    $(LINUX_DIR)/sound/soc/codecs/snd-soc-pcm512x-i2c.ko
+  AUTOLOAD:=$(call AutoLoad,68,snd-soc-pcm512x-i2c snd-soc-pcm512x \
+    snd-soc-justboom-dac)
   DEPENDS:= \
     kmod-sound-soc-bcm2835-i2s \
-    +kmod-i2c-bcm2835
+    +kmod-i2c-bcm2835 \
+    +kmod-regmap-i2c
   $(call AddDepends/sound)
 endef
 
@@ -850,14 +885,17 @@ define KernelPackage/sound-soc-justboom-digi
   TITLE:=Support for JustBoom Digi
   KCONFIG:= \
     CONFIG_SND_BCM2708_SOC_JUSTBOOM_DIGI \
-    CONFIG_SND_SOC_WM8804
+    CONFIG_SND_SOC_WM8804 \
+    CONFIG_SND_SOC_WM8804_I2C
   FILES:= \
-    $(LINUX_DIR)/sound/soc/codecs/snd-soc-wm8804.ko
-  AUTOLOAD:=$(call AutoLoad,68,snd-soc-wm8804)
+    $(LINUX_DIR)/sound/soc/codecs/snd-soc-wm8804.ko \
+    $(LINUX_DIR)/sound/soc/codecs/snd-soc-wm8804-i2c.ko
+  AUTOLOAD:=$(call AutoLoad,68,snd-soc-wm8804-i2c snd-soc-wm8804)
   DEPENDS:= \
     kmod-sound-soc-bcm2835-i2s \
     +kmod-sound-soc-rpi-wm8804-soundcard \
-    +kmod-i2c-bcm2835
+    +kmod-i2c-bcm2835 \
+    +kmod-regmap-i2c
   $(call AddDepends/sound)
 endef
 
@@ -932,6 +970,7 @@ define KernelPackage/sound-soc-rpi-cirrus
     CONFIG_SND_SOC_WM8804 \
     CONFIG_SND_SOC_WM_ADSP
   FILES:= \
+    $(LINUX_DIR)/drivers/firmware/cirrus/cs_dsp.ko \
     $(LINUX_DIR)/drivers/mfd/arizona.ko \
     $(LINUX_DIR)/drivers/mfd/arizona-i2c.ko \
     $(LINUX_DIR)/sound/soc/bcm/snd-soc-rpi-cirrus.ko \
@@ -939,7 +978,7 @@ define KernelPackage/sound-soc-rpi-cirrus
     $(LINUX_DIR)/sound/soc/codecs/snd-soc-wm-adsp.ko \
     $(LINUX_DIR)/sound/soc/codecs/snd-soc-wm5102.ko \
     $(LINUX_DIR)/sound/soc/codecs/snd-soc-wm8804.ko
-  AUTOLOAD:=$(call AutoLoad,68,snd-soc-pcm1794a snd-soc-rpi-cirrus)
+  AUTOLOAD:=$(call AutoLoad,68,snd-soc-rpi-cirrus)
   DEPENDS:= \
     kmod-sound-soc-bcm2835-i2s \
     +kmod-i2c-bcm2835 \
diff --git a/target/linux/bcm27xx/modules/video.mk b/target/linux/bcm27xx/modules/video.mk
index 7e80203cba79b0..86fc44c0a4fa9c 100644
--- a/target/linux/bcm27xx/modules/video.mk
+++ b/target/linux/bcm27xx/modules/video.mk
@@ -7,7 +7,12 @@ define KernelPackage/camera-bcm2835
   KCONFIG:= \
     CONFIG_VIDEO_BCM2835 \
     CONFIG_VIDEO_BCM2835_MMAL \
+    CONFIG_VIDEO_ARDUCAM_64MP=n \
+    CONFIG_VIDEO_ARDUCAM_PIVARIETY=n \
     CONFIG_VIDEO_BCM2835_UNICAM=n \
+    CONFIG_VIDEO_IMX296=n \
+    CONFIG_VIDEO_IMX519=n \
+    CONFIG_VIDEO_IMX708=n \
     CONFIG_VIDEO_ISP_BCM2835=n
   FILES:= \
     $(LINUX_DIR)/drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko
@@ -37,9 +42,10 @@ define KernelPackage/drm-vc4
     CONFIG_DRM_V3D=n \
     CONFIG_DRM_TVE200=n
   FILES:= \
+    $(LINUX_DIR)/drivers/gpu/drm/display/drm_display_helper.ko \
+    $(LINUX_DIR)/drivers/gpu/drm/drm_dma_helper.ko \
     $(LINUX_DIR)/drivers/gpu/drm/vc4/vc4.ko \
     $(LINUX_DIR)/drivers/gpu/drm/drm_kms_helper.ko \
-    $(LINUX_DIR)/drivers/media/cec/cec.ko@lt5.10 \
     $(LINUX_DIR)/drivers/media/cec/core/cec.ko
   AUTOLOAD:=$(call AutoProbe,vc4)
 endef
diff --git a/target/linux/bcm27xx/patches-6.1/950-0001-Support-RPi-DPI-interface-in-mode6-for-18-bit-color.patch b/target/linux/bcm27xx/patches-6.1/950-0001-Support-RPi-DPI-interface-in-mode6-for-18-bit-color.patch
new file mode 100644
index 00000000000000..1dd352d1896fad
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0001-Support-RPi-DPI-interface-in-mode6-for-18-bit-color.patch
@@ -0,0 +1,32 @@
+From 6da5134dcde68af6d86003931375ca1a6e6d0169 Mon Sep 17 00:00:00 2001
+From: Joerg Quinten <aBUGSworstnightmare@gmail.com>
+Date: Fri, 18 Jun 2021 13:02:29 +0200
+Subject: [PATCH] Support RPi DPI interface in mode6 for 18-bit color
+
+A matching media bus format was added and an overlay for using it,
+both with FB and VC4 was added as well.
+
+Signed-off-by: Joerg Quinten <aBUGSworstnightmare@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_dpi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_dpi.c
++++ b/drivers/gpu/drm/vc4/vc4_dpi.c
+@@ -170,10 +170,16 @@ static void vc4_dpi_encoder_enable(struc
+ 				dpi_c |= VC4_SET_FIELD(DPI_ORDER_BGR,
+ 						       DPI_ORDER);
+ 				break;
++			case MEDIA_BUS_FMT_BGR666_1X24_CPADHI:
++				dpi_c |= VC4_SET_FIELD(DPI_ORDER_BGR, DPI_ORDER);
++				fallthrough;
+ 			case MEDIA_BUS_FMT_RGB666_1X24_CPADHI:
+ 				dpi_c |= VC4_SET_FIELD(DPI_FORMAT_18BIT_666_RGB_2,
+ 						       DPI_FORMAT);
+ 				break;
++			case MEDIA_BUS_FMT_BGR666_1X18:
++				dpi_c |= VC4_SET_FIELD(DPI_ORDER_BGR, DPI_ORDER);
++				fallthrough;
+ 			case MEDIA_BUS_FMT_RGB666_1X18:
+ 				dpi_c |= VC4_SET_FIELD(DPI_FORMAT_18BIT_666_RGB_1,
+ 						       DPI_FORMAT);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0002-drm-vc4-Add-FKMS-as-an-acceptable-node-for-dma-range.patch b/target/linux/bcm27xx/patches-6.1/950-0002-drm-vc4-Add-FKMS-as-an-acceptable-node-for-dma-range.patch
new file mode 100644
index 00000000000000..a64d7821db4676
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0002-drm-vc4-Add-FKMS-as-an-acceptable-node-for-dma-range.patch
@@ -0,0 +1,27 @@
+From 588c5e6269307ccd908986b7514676d6729e0e0d Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 19 May 2020 16:20:30 +0100
+Subject: [PATCH] drm/vc4: Add FKMS as an acceptable node for dma
+ ranges.
+
+Under FKMS, the firmware (via FKMS) also requires the VideoCore cache
+aliases for image planes, as defined by the dma-ranges under /soc.
+
+Add rpi-firmware-kms to the list of acceptable nodes to look for
+to copy dma config from.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_drv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.c
++++ b/drivers/gpu/drm/vc4/vc4_drv.c
+@@ -276,6 +276,7 @@ static void vc4_component_unbind_all(voi
+ static const struct of_device_id vc4_dma_range_matches[] = {
+ 	{ .compatible = "brcm,bcm2711-hvs" },
+ 	{ .compatible = "brcm,bcm2835-hvs" },
++	{ .compatible = "raspberrypi,rpi-firmware-kms" },
+ 	{ .compatible = "brcm,bcm2835-v3d" },
+ 	{ .compatible = "brcm,cygnus-v3d" },
+ 	{ .compatible = "brcm,vc4-v3d" },
diff --git a/target/linux/bcm27xx/patches-6.1/950-0003-drm-vc4-Add-the-2711-HVS-as-a-suitable-DMA-node.patch b/target/linux/bcm27xx/patches-6.1/950-0003-drm-vc4-Add-the-2711-HVS-as-a-suitable-DMA-node.patch
new file mode 100644
index 00000000000000..a319e1cb3fff3b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0003-drm-vc4-Add-the-2711-HVS-as-a-suitable-DMA-node.patch
@@ -0,0 +1,24 @@
+From 535402af94be945587cc7c7f3346b31e3fa46bc9 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 26 Oct 2020 12:38:27 +0000
+Subject: [PATCH] drm/vc4: Add the 2711 HVS as a suitable DMA node
+
+With vc4-drv node not being under /soc on Pi4, we need to
+adopt the correct DMA parameters from a suitable sub-component.
+Add "brcm,bcm2711-hvs" to that list of components.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_drv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.c
++++ b/drivers/gpu/drm/vc4/vc4_drv.c
+@@ -276,6 +276,7 @@ static void vc4_component_unbind_all(voi
+ static const struct of_device_id vc4_dma_range_matches[] = {
+ 	{ .compatible = "brcm,bcm2711-hvs" },
+ 	{ .compatible = "brcm,bcm2835-hvs" },
++	{ .compatible = "brcm,bcm2711-hvs" },
+ 	{ .compatible = "raspberrypi,rpi-firmware-kms" },
+ 	{ .compatible = "brcm,bcm2835-v3d" },
+ 	{ .compatible = "brcm,cygnus-v3d" },
diff --git a/target/linux/bcm27xx/patches-6.1/950-0004-drm-vc4-Change-the-default-DPI-format-to-being-18bpp.patch b/target/linux/bcm27xx/patches-6.1/950-0004-drm-vc4-Change-the-default-DPI-format-to-being-18bpp.patch
new file mode 100644
index 00000000000000..317f9fbea1d4ae
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0004-drm-vc4-Change-the-default-DPI-format-to-being-18bpp.patch
@@ -0,0 +1,34 @@
+From 6f0bbf91998cb04030731bc8b254209345cbe9f1 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 12 Feb 2021 17:31:37 +0000
+Subject: [PATCH] drm/vc4: Change the default DPI format to being
+ 18bpp, not 24.
+
+DPI hasn't really been used up until now, so the default has
+been meaningless.
+In theory we should be able to pass the desired format for the
+adjacent bridge chip through, but framework seems to be missing
+for that.
+
+As the main device to use DPI is the VGA666 or Adafruit Kippah,
+both of which use RGB666, change the default to being RGB666 instead
+of RGB888.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_dpi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_dpi.c
++++ b/drivers/gpu/drm/vc4/vc4_dpi.c
+@@ -150,8 +150,8 @@ static void vc4_dpi_encoder_enable(struc
+ 	}
+ 	drm_connector_list_iter_end(&conn_iter);
+ 
+-	/* Default to 24bit if no connector or format found. */
+-	dpi_c |= VC4_SET_FIELD(DPI_FORMAT_24BIT_888_RGB, DPI_FORMAT);
++	/* Default to 18bit if no connector or format found. */
++	dpi_c |= VC4_SET_FIELD(DPI_FORMAT_18BIT_666_RGB_1, DPI_FORMAT);
+ 
+ 	if (connector) {
+ 		if (connector->display_info.num_bus_formats) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0005-drm-atomic-Don-t-fixup-modes-that-haven-t-been-reset.patch b/target/linux/bcm27xx/patches-6.1/950-0005-drm-atomic-Don-t-fixup-modes-that-haven-t-been-reset.patch
new file mode 100644
index 00000000000000..0de0b474f327ac
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0005-drm-atomic-Don-t-fixup-modes-that-haven-t-been-reset.patch
@@ -0,0 +1,24 @@
+From 5e5243cf497ccec7265b79cf84beb0f60550e113 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 7 Jan 2021 16:30:55 +0000
+Subject: [PATCH] drm/atomic: Don't fixup modes that haven't been reset
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/drm_atomic_helper.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/gpu/drm/drm_atomic_helper.c
++++ b/drivers/gpu/drm/drm_atomic_helper.c
+@@ -438,6 +438,11 @@ mode_fixup(struct drm_atomic_state *stat
+ 		new_crtc_state =
+ 			drm_atomic_get_new_crtc_state(state, new_conn_state->crtc);
+ 
++		if (!new_crtc_state->mode_changed &&
++		    !new_crtc_state->connectors_changed) {
++			continue;
++		}
++
+ 		/*
+ 		 * Each encoder has at most one connector (since we always steal
+ 		 * it away), so we won't call ->mode_fixup twice.
diff --git a/target/linux/bcm27xx/patches-6.1/950-0006-drm-vc4-Fix-timings-for-VEC-modes.patch b/target/linux/bcm27xx/patches-6.1/950-0006-drm-vc4-Fix-timings-for-VEC-modes.patch
new file mode 100644
index 00000000000000..bc5643ee774a27
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0006-drm-vc4-Fix-timings-for-VEC-modes.patch
@@ -0,0 +1,127 @@
+From 607f72974246d1495059932286b3d5307c1645a5 Mon Sep 17 00:00:00 2001
+From: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
+Date: Thu, 15 Jul 2021 01:07:30 +0200
+Subject: [PATCH] drm/vc4: Fix timings for VEC modes
+
+This commit fixes vertical timings of the VEC (composite output) modes
+to accurately represent the 525-line ("NTSC") and 625-line ("PAL") ITU-R
+standards.
+
+Previous timings were actually defined as 502 and 601 lines, resulting
+in non-standard 62.69 Hz and 52 Hz signals being generated,
+respectively.
+
+Changes to vc4_crtc.c have also been made, to make the PixelValve
+vertical timings accurately correspond to the DRM modeline in interlaced
+modes. The resulting VERTA/VERTB register values have been verified
+against the reference values set by the Raspberry Pi firmware.
+
+Signed-off-by: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c | 70 +++++++++++++++++++++-------------
+ 1 file changed, 43 insertions(+), 27 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -326,8 +326,14 @@ static void vc4_crtc_config_pv(struct dr
+ 	bool is_dsi = (vc4_encoder->type == VC4_ENCODER_TYPE_DSI0 ||
+ 		       vc4_encoder->type == VC4_ENCODER_TYPE_DSI1);
+ 	bool is_dsi1 = vc4_encoder->type == VC4_ENCODER_TYPE_DSI1;
++	bool is_vec = vc4_encoder->type == VC4_ENCODER_TYPE_VEC;
+ 	u32 format = is_dsi1 ? PV_CONTROL_FORMAT_DSIV_24 : PV_CONTROL_FORMAT_24;
+ 	u8 ppc = pv_data->pixels_per_clock;
++
++	u16 vert_bp = mode->crtc_vtotal - mode->crtc_vsync_end;
++	u16 vert_sync = mode->crtc_vsync_end - mode->crtc_vsync_start;
++	u16 vert_fp = mode->crtc_vsync_start - mode->crtc_vdisplay;
++
+ 	bool debug_dump_regs = false;
+ 	int idx;
+ 
+@@ -355,49 +361,59 @@ static void vc4_crtc_config_pv(struct dr
+ 		   VC4_SET_FIELD(mode->hdisplay * pixel_rep / ppc,
+ 				 PV_HORZB_HACTIVE));
+ 
+-	CRTC_WRITE(PV_VERTA,
+-		   VC4_SET_FIELD(mode->crtc_vtotal - mode->crtc_vsync_end +
+-				 interlace,
+-				 PV_VERTA_VBP) |
+-		   VC4_SET_FIELD(mode->crtc_vsync_end - mode->crtc_vsync_start,
+-				 PV_VERTA_VSYNC));
+-	CRTC_WRITE(PV_VERTB,
+-		   VC4_SET_FIELD(mode->crtc_vsync_start - mode->crtc_vdisplay,
+-				 PV_VERTB_VFP) |
+-		   VC4_SET_FIELD(mode->crtc_vdisplay, PV_VERTB_VACTIVE));
+-
+ 	if (interlace) {
++		bool odd_field_first = false;
++		u32 field_delay = mode->htotal * pixel_rep / (2 * ppc);
++		u16 vert_bp_even = vert_bp;
++		u16 vert_fp_even = vert_fp;
++
++		if (is_vec) {
++			/* VEC (composite output) */
++			++field_delay;
++			if (mode->htotal == 858) {
++				/* 525-line mode (NTSC or PAL-M) */
++				odd_field_first = true;
++			}
++		}
++
++		if (odd_field_first)
++			++vert_fp_even;
++		else
++			++vert_bp;
++
+ 		CRTC_WRITE(PV_VERTA_EVEN,
+-			   VC4_SET_FIELD(mode->crtc_vtotal -
+-					 mode->crtc_vsync_end,
+-					 PV_VERTA_VBP) |
+-			   VC4_SET_FIELD(mode->crtc_vsync_end -
+-					 mode->crtc_vsync_start,
+-					 PV_VERTA_VSYNC));
++			   VC4_SET_FIELD(vert_bp_even, PV_VERTA_VBP) |
++			   VC4_SET_FIELD(vert_sync, PV_VERTA_VSYNC));
+ 		CRTC_WRITE(PV_VERTB_EVEN,
+-			   VC4_SET_FIELD(mode->crtc_vsync_start -
+-					 mode->crtc_vdisplay,
+-					 PV_VERTB_VFP) |
++			   VC4_SET_FIELD(vert_fp_even, PV_VERTB_VFP) |
+ 			   VC4_SET_FIELD(mode->crtc_vdisplay, PV_VERTB_VACTIVE));
+ 
+-		/* We set up first field even mode for HDMI.  VEC's
+-		 * NTSC mode would want first field odd instead, once
+-		 * we support it (to do so, set ODD_FIRST and put the
+-		 * delay in VSYNCD_EVEN instead).
++		/* We set up first field even mode for HDMI and VEC's PAL.
++		 * For NTSC, we need first field odd.
+ 		 */
+ 		CRTC_WRITE(PV_V_CONTROL,
+ 			   PV_VCONTROL_CONTINUOUS |
+ 			   (is_dsi ? PV_VCONTROL_DSI : 0) |
+ 			   PV_VCONTROL_INTERLACE |
+-			   VC4_SET_FIELD(mode->htotal * pixel_rep / (2 * ppc),
+-					 PV_VCONTROL_ODD_DELAY));
+-		CRTC_WRITE(PV_VSYNCD_EVEN, 0);
++			   (odd_field_first
++				   ? PV_VCONTROL_ODD_FIRST
++				   : VC4_SET_FIELD(field_delay,
++						   PV_VCONTROL_ODD_DELAY)));
++		CRTC_WRITE(PV_VSYNCD_EVEN,
++			   (odd_field_first ? field_delay : 0));
+ 	} else {
+ 		CRTC_WRITE(PV_V_CONTROL,
+ 			   PV_VCONTROL_CONTINUOUS |
+ 			   (is_dsi ? PV_VCONTROL_DSI : 0));
+ 	}
+ 
++	CRTC_WRITE(PV_VERTA,
++		   VC4_SET_FIELD(vert_bp, PV_VERTA_VBP) |
++		   VC4_SET_FIELD(vert_sync, PV_VERTA_VSYNC));
++	CRTC_WRITE(PV_VERTB,
++		   VC4_SET_FIELD(vert_fp, PV_VERTB_VFP) |
++		   VC4_SET_FIELD(mode->crtc_vdisplay, PV_VERTB_VACTIVE));
++
+ 	if (is_dsi)
+ 		CRTC_WRITE(PV_HACT_ACT, mode->hdisplay * pixel_rep);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0007-drm-vc4-Fix-definition-of-PAL-M-mode.patch b/target/linux/bcm27xx/patches-6.1/950-0007-drm-vc4-Fix-definition-of-PAL-M-mode.patch
new file mode 100644
index 00000000000000..b6345ee50bb0e3
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0007-drm-vc4-Fix-definition-of-PAL-M-mode.patch
@@ -0,0 +1,77 @@
+From 5bcc290bd33f2b2fb7c6d7b30555b40b1074fd93 Mon Sep 17 00:00:00 2001
+From: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
+Date: Thu, 15 Jul 2021 01:07:53 +0200
+Subject: [PATCH] drm/vc4: Fix definition of PAL-M mode
+
+PAL-M is a Brazilian analog TV standard that uses a PAL-style chroma
+subcarrier at 3.575611[888111] MHz on top of 525-line (480i60) timings.
+This commit makes the driver actually use the proper VEC preset for this
+mode instead of just changing PAL subcarrier frequency.
+
+DRM mode constant names have also been changed, as they no longer
+correspond to the "NTSC" or "PAL" terms.
+
+Signed-off-by: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_vec.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_vec.c
++++ b/drivers/gpu/drm/vc4/vc4_vec.c
+@@ -69,6 +69,7 @@
+ #define VEC_CONFIG0_STD_MASK		GENMASK(1, 0)
+ #define VEC_CONFIG0_NTSC_STD		0
+ #define VEC_CONFIG0_PAL_BDGHI_STD	1
++#define VEC_CONFIG0_PAL_M_STD		2
+ #define VEC_CONFIG0_PAL_N_STD		3
+ 
+ #define VEC_SCHPH			0x108
+@@ -224,14 +225,14 @@ static const struct debugfs_reg32 vec_re
+ 	VC4_REG32(VEC_DAC_MISC),
+ };
+ 
+-static const struct drm_display_mode ntsc_mode = {
++static const struct drm_display_mode drm_mode_480i = {
+ 	DRM_MODE("720x480", DRM_MODE_TYPE_DRIVER, 13500,
+ 		 720, 720 + 14, 720 + 14 + 64, 720 + 14 + 64 + 60, 0,
+ 		 480, 480 + 7, 480 + 7 + 6, 525, 0,
+ 		 DRM_MODE_FLAG_INTERLACE)
+ };
+ 
+-static const struct drm_display_mode pal_mode = {
++static const struct drm_display_mode drm_mode_576i = {
+ 	DRM_MODE("720x576", DRM_MODE_TYPE_DRIVER, 13500,
+ 		 720, 720 + 20, 720 + 20 + 64, 720 + 20 + 64 + 60, 0,
+ 		 576, 576 + 4, 576 + 4 + 6, 625, 0,
+@@ -240,25 +241,24 @@ static const struct drm_display_mode pal
+ 
+ static const struct vc4_vec_tv_mode vc4_vec_tv_modes[] = {
+ 	[VC4_VEC_TV_MODE_NTSC] = {
+-		.mode = &ntsc_mode,
++		.mode = &drm_mode_480i,
+ 		.config0 = VEC_CONFIG0_NTSC_STD | VEC_CONFIG0_PDEN,
+ 		.config1 = VEC_CONFIG1_C_CVBS_CVBS,
+ 	},
+ 	[VC4_VEC_TV_MODE_NTSC_J] = {
+-		.mode = &ntsc_mode,
++		.mode = &drm_mode_480i,
+ 		.config0 = VEC_CONFIG0_NTSC_STD,
+ 		.config1 = VEC_CONFIG1_C_CVBS_CVBS,
+ 	},
+ 	[VC4_VEC_TV_MODE_PAL] = {
+-		.mode = &pal_mode,
++		.mode = &drm_mode_576i,
+ 		.config0 = VEC_CONFIG0_PAL_BDGHI_STD,
+ 		.config1 = VEC_CONFIG1_C_CVBS_CVBS,
+ 	},
+ 	[VC4_VEC_TV_MODE_PAL_M] = {
+-		.mode = &pal_mode,
+-		.config0 = VEC_CONFIG0_PAL_BDGHI_STD,
+-		.config1 = VEC_CONFIG1_C_CVBS_CVBS | VEC_CONFIG1_CUSTOM_FREQ,
+-		.custom_freq = 0x223b61d1,
++		.mode = &drm_mode_480i,
++		.config0 = VEC_CONFIG0_PAL_M_STD,
++		.config1 = VEC_CONFIG1_C_CVBS_CVBS,
+ 	},
+ };
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0008-drm-vc4-Add-support-for-more-analog-TV-standards.patch b/target/linux/bcm27xx/patches-6.1/950-0008-drm-vc4-Add-support-for-more-analog-TV-standards.patch
new file mode 100644
index 00000000000000..e1c9170a55c498
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0008-drm-vc4-Add-support-for-more-analog-TV-standards.patch
@@ -0,0 +1,148 @@
+From 5040ce6a1488fb6bf43d10172e0209c13de99a80 Mon Sep 17 00:00:00 2001
+From: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
+Date: Thu, 15 Jul 2021 01:07:58 +0200
+Subject: [PATCH] drm/vc4: Add support for more analog TV standards
+
+Add support for the following composite output modes (all of them are
+somewhat more obscure than the previously defined ones):
+
+- NTSC_443 - NTSC-style signal with the chroma subcarrier shifted to
+  4.43361875 MHz (the PAL subcarrier frequency). Never used for
+  broadcasting, but sometimes used as a hack to play NTSC content in PAL
+  regions (e.g. on VCRs).
+- PAL_N - PAL with alternative chroma subcarrier frequency,
+  3.58205625 MHz. Used as a broadcast standard in Argentina, Paraguay
+  and Uruguay to fit 576i50 with colour in 6 MHz channel raster.
+- PAL60 - 480i60 signal with PAL-style color at normal European PAL
+  frequency. Another non-standard, non-broadcast mode, used in similar
+  contexts as NTSC_443. Some displays support one but not the other.
+- SECAM - French frequency-modulated analog color standard; also have
+  been broadcast in Eastern Europe and various parts of Africa and Asia.
+  Uses the same 576i50 timings as PAL.
+
+Also added some comments explaining color subcarrier frequency
+registers.
+
+Signed-off-by: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_vec.c | 63 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 63 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_vec.c
++++ b/drivers/gpu/drm/vc4/vc4_vec.c
+@@ -46,6 +46,7 @@
+ #define VEC_CONFIG0_YDEL(x)		((x) << 26)
+ #define VEC_CONFIG0_CDEL_MASK		GENMASK(25, 24)
+ #define VEC_CONFIG0_CDEL(x)		((x) << 24)
++#define VEC_CONFIG0_SECAM_STD		BIT(21)
+ #define VEC_CONFIG0_PBPR_FIL		BIT(18)
+ #define VEC_CONFIG0_CHROMA_GAIN_MASK	GENMASK(17, 16)
+ #define VEC_CONFIG0_CHROMA_GAIN_UNITY	(0 << 16)
+@@ -76,6 +77,27 @@
+ #define VEC_SOFT_RESET			0x10c
+ #define VEC_CLMP0_START			0x144
+ #define VEC_CLMP0_END			0x148
++
++/*
++ * These set the color subcarrier frequency
++ * if VEC_CONFIG1_CUSTOM_FREQ is enabled.
++ *
++ * VEC_FREQ1_0 contains the most significant 16-bit half-word,
++ * VEC_FREQ3_2 contains the least significant 16-bit half-word.
++ * 0x80000000 seems to be equivalent to the pixel clock
++ * (which itself is the VEC clock divided by 8).
++ *
++ * Reference values (with the default pixel clock of 13.5 MHz):
++ *
++ * NTSC  (3579545.[45] Hz)     - 0x21F07C1F
++ * PAL   (4433618.75 Hz)       - 0x2A098ACB
++ * PAL-M (3575611.[888111] Hz) - 0x21E6EFE3
++ * PAL-N (3582056.25 Hz)       - 0x21F69446
++ *
++ * NOTE: For SECAM, it is used as the Dr center frequency,
++ * regardless of whether VEC_CONFIG1_CUSTOM_FREQ is enabled or not;
++ * that is specified as 4406250 Hz, which corresponds to 0x29C71C72.
++ */
+ #define VEC_FREQ3_2			0x180
+ #define VEC_FREQ1_0			0x184
+ 
+@@ -118,6 +140,14 @@
+ 
+ #define VEC_INTERRUPT_CONTROL		0x190
+ #define VEC_INTERRUPT_STATUS		0x194
++
++/*
++ * Db center frequency for SECAM; the clock for this is the same as for
++ * VEC_FREQ3_2/VEC_FREQ1_0, which is used for Dr center frequency.
++ *
++ * This is specified as 4250000 Hz, which corresponds to 0x284BDA13.
++ * That is also the default value, so no need to set it explicitly.
++ */
+ #define VEC_FCW_SECAM_B			0x198
+ #define VEC_SECAM_GAIN_VAL		0x19c
+ 
+@@ -187,8 +217,12 @@ encoder_to_vc4_vec(struct drm_encoder *e
+ enum vc4_vec_tv_mode_id {
+ 	VC4_VEC_TV_MODE_NTSC,
+ 	VC4_VEC_TV_MODE_NTSC_J,
++	VC4_VEC_TV_MODE_NTSC_443,
+ 	VC4_VEC_TV_MODE_PAL,
+ 	VC4_VEC_TV_MODE_PAL_M,
++	VC4_VEC_TV_MODE_PAL_N,
++	VC4_VEC_TV_MODE_PAL60,
++	VC4_VEC_TV_MODE_SECAM,
+ };
+ 
+ struct vc4_vec_tv_mode {
+@@ -250,6 +284,13 @@ static const struct vc4_vec_tv_mode vc4_
+ 		.config0 = VEC_CONFIG0_NTSC_STD,
+ 		.config1 = VEC_CONFIG1_C_CVBS_CVBS,
+ 	},
++	[VC4_VEC_TV_MODE_NTSC_443] = {
++		/* NTSC with PAL chroma frequency */
++		.mode = &drm_mode_480i,
++		.config0 = VEC_CONFIG0_NTSC_STD,
++		.config1 = VEC_CONFIG1_C_CVBS_CVBS | VEC_CONFIG1_CUSTOM_FREQ,
++		.custom_freq = 0x2a098acb,
++	},
+ 	[VC4_VEC_TV_MODE_PAL] = {
+ 		.mode = &drm_mode_576i,
+ 		.config0 = VEC_CONFIG0_PAL_BDGHI_STD,
+@@ -260,6 +301,24 @@ static const struct vc4_vec_tv_mode vc4_
+ 		.config0 = VEC_CONFIG0_PAL_M_STD,
+ 		.config1 = VEC_CONFIG1_C_CVBS_CVBS,
+ 	},
++	[VC4_VEC_TV_MODE_PAL_N] = {
++		.mode = &drm_mode_576i,
++		.config0 = VEC_CONFIG0_PAL_N_STD,
++		.config1 = VEC_CONFIG1_C_CVBS_CVBS,
++	},
++	[VC4_VEC_TV_MODE_PAL60] = {
++		/* PAL-M with chroma frequency of regular PAL */
++		.mode = &drm_mode_480i,
++		.config0 = VEC_CONFIG0_PAL_M_STD,
++		.config1 = VEC_CONFIG1_C_CVBS_CVBS | VEC_CONFIG1_CUSTOM_FREQ,
++		.custom_freq = 0x2a098acb,
++	},
++	[VC4_VEC_TV_MODE_SECAM] = {
++		.mode = &drm_mode_576i,
++		.config0 = VEC_CONFIG0_SECAM_STD,
++		.config1 = VEC_CONFIG1_C_CVBS_CVBS,
++		.custom_freq = 0x29c71c72,
++	},
+ };
+ 
+ static enum drm_connector_status
+@@ -503,8 +562,12 @@ static const struct of_device_id vc4_vec
+ static const char * const tv_mode_names[] = {
+ 	[VC4_VEC_TV_MODE_NTSC] = "NTSC",
+ 	[VC4_VEC_TV_MODE_NTSC_J] = "NTSC-J",
++	[VC4_VEC_TV_MODE_NTSC_443] = "NTSC-443",
+ 	[VC4_VEC_TV_MODE_PAL] = "PAL",
+ 	[VC4_VEC_TV_MODE_PAL_M] = "PAL-M",
++	[VC4_VEC_TV_MODE_PAL_N] = "PAL-N",
++	[VC4_VEC_TV_MODE_PAL60] = "PAL60",
++	[VC4_VEC_TV_MODE_SECAM] = "SECAM",
+ };
+ 
+ static int vc4_vec_bind(struct device *dev, struct device *master, void *data)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0009-drm-vc4-Allow-setting-the-TV-norm-via-module-paramet.patch b/target/linux/bcm27xx/patches-6.1/950-0009-drm-vc4-Allow-setting-the-TV-norm-via-module-paramet.patch
new file mode 100644
index 00000000000000..cfdcf12d469a4b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0009-drm-vc4-Allow-setting-the-TV-norm-via-module-paramet.patch
@@ -0,0 +1,143 @@
+From b5b92244feaa5b39a66fe0dace0d25d576079f0d Mon Sep 17 00:00:00 2001
+From: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
+Date: Thu, 15 Jul 2021 01:08:01 +0200
+Subject: [PATCH] drm/vc4: Allow setting the TV norm via module
+ parameter
+
+Similar to the ch7006 and nouveau drivers, introduce a "tv_mode" module
+parameter that allow setting the TV norm by specifying vc4.tv_norm= on
+the kernel command line.
+
+If that is not specified, try inferring one of the most popular norms
+(PAL or NTSC) from the video mode specified on the command line. On
+Raspberry Pis, this causes the most common cases of the sdtv_mode
+setting in config.txt to be respected.
+
+Signed-off-by: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_vec.c | 72 ++++++++++++++++++++++++++++-------
+ 1 file changed, 58 insertions(+), 14 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_vec.c
++++ b/drivers/gpu/drm/vc4/vc4_vec.c
+@@ -67,7 +67,7 @@
+ #define VEC_CONFIG0_YCDELAY		BIT(4)
+ #define VEC_CONFIG0_RAMPEN		BIT(2)
+ #define VEC_CONFIG0_YCDIS		BIT(2)
+-#define VEC_CONFIG0_STD_MASK		GENMASK(1, 0)
++#define VEC_CONFIG0_STD_MASK		(VEC_CONFIG0_SECAM_STD | GENMASK(1, 0))
+ #define VEC_CONFIG0_NTSC_STD		0
+ #define VEC_CONFIG0_PAL_BDGHI_STD	1
+ #define VEC_CONFIG0_PAL_M_STD		2
+@@ -186,6 +186,8 @@
+ #define VEC_DAC_MISC_DAC_RST_N		BIT(0)
+ 
+ 
++static char *vc4_vec_tv_norm;
++
+ struct vc4_vec_variant {
+ 	u32 dac_config;
+ };
+@@ -321,6 +323,44 @@ static const struct vc4_vec_tv_mode vc4_
+ 	},
+ };
+ 
++static const char * const tv_mode_names[] = {
++	[VC4_VEC_TV_MODE_NTSC] = "NTSC",
++	[VC4_VEC_TV_MODE_NTSC_J] = "NTSC-J",
++	[VC4_VEC_TV_MODE_NTSC_443] = "NTSC-443",
++	[VC4_VEC_TV_MODE_PAL] = "PAL",
++	[VC4_VEC_TV_MODE_PAL_M] = "PAL-M",
++	[VC4_VEC_TV_MODE_PAL_N] = "PAL-N",
++	[VC4_VEC_TV_MODE_PAL60] = "PAL60",
++	[VC4_VEC_TV_MODE_SECAM] = "SECAM",
++};
++
++enum vc4_vec_tv_mode_id
++vc4_vec_get_default_mode(struct drm_connector *connector)
++{
++	int i;
++
++	if (vc4_vec_tv_norm) {
++		for (i = 0; i < ARRAY_SIZE(tv_mode_names); i++)
++			if (strcmp(vc4_vec_tv_norm, tv_mode_names[i]) == 0)
++				return (enum vc4_vec_tv_mode_id) i;
++	} else if (connector->cmdline_mode.specified &&
++		   ((connector->cmdline_mode.refresh_specified &&
++		     (connector->cmdline_mode.refresh == 25 ||
++		      connector->cmdline_mode.refresh == 50)) ||
++		    (!connector->cmdline_mode.refresh_specified &&
++		     (connector->cmdline_mode.yres == 288 ||
++		      connector->cmdline_mode.yres == 576)))) {
++		/*
++		 * no explicitly specified TV norm; use PAL if a mode that
++		 * looks like PAL has been specified on the command line
++		 */
++		return VC4_VEC_TV_MODE_PAL;
++	}
++
++	/* in all other cases, default to NTSC */
++	return VC4_VEC_TV_MODE_NTSC;
++}
++
+ static enum drm_connector_status
+ vc4_vec_connector_detect(struct drm_connector *connector, bool force)
+ {
+@@ -344,10 +384,18 @@ static int vc4_vec_connector_get_modes(s
+ 	return 1;
+ }
+ 
++static void vc4_vec_connector_reset(struct drm_connector *connector)
++{
++	drm_atomic_helper_connector_reset(connector);
++	/* preserve TV standard */
++	if (connector->state)
++		connector->state->tv.mode = vc4_vec_get_default_mode(connector);
++}
++
+ static const struct drm_connector_funcs vc4_vec_connector_funcs = {
+ 	.detect = vc4_vec_connector_detect,
+ 	.fill_modes = drm_helper_probe_single_connector_modes,
+-	.reset = drm_atomic_helper_connector_reset,
++	.reset = vc4_vec_connector_reset,
+ 	.atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
+ 	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+ };
+@@ -372,7 +420,7 @@ static int vc4_vec_connector_init(struct
+ 
+ 	drm_object_attach_property(&connector->base,
+ 				   dev->mode_config.tv_mode_property,
+-				   VC4_VEC_TV_MODE_NTSC);
++				   vc4_vec_get_default_mode(connector));
+ 
+ 	drm_connector_attach_encoder(connector, &vec->encoder.base);
+ 
+@@ -559,17 +607,6 @@ static const struct of_device_id vc4_vec
+ 	{ /* sentinel */ },
+ };
+ 
+-static const char * const tv_mode_names[] = {
+-	[VC4_VEC_TV_MODE_NTSC] = "NTSC",
+-	[VC4_VEC_TV_MODE_NTSC_J] = "NTSC-J",
+-	[VC4_VEC_TV_MODE_NTSC_443] = "NTSC-443",
+-	[VC4_VEC_TV_MODE_PAL] = "PAL",
+-	[VC4_VEC_TV_MODE_PAL_M] = "PAL-M",
+-	[VC4_VEC_TV_MODE_PAL_N] = "PAL-N",
+-	[VC4_VEC_TV_MODE_PAL60] = "PAL60",
+-	[VC4_VEC_TV_MODE_SECAM] = "SECAM",
+-};
+-
+ static int vc4_vec_bind(struct device *dev, struct device *master, void *data)
+ {
+ 	struct platform_device *pdev = to_platform_device(dev);
+@@ -650,3 +687,10 @@ struct platform_driver vc4_vec_driver =
+ 		.of_match_table = vc4_vec_dt_match,
+ 	},
+ };
++
++module_param_named(tv_norm, vc4_vec_tv_norm, charp, 0600);
++MODULE_PARM_DESC(tv_norm, "Default TV norm.\n"
++		 "\t\tSupported: NTSC, NTSC-J, NTSC-443, PAL, PAL-M, PAL-N,\n"
++		 "\t\t\tPAL60, SECAM.\n"
++		 "\t\tDefault: PAL if a 50 Hz mode has been set via video=,\n"
++		 "\t\t\tNTSC otherwise");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0010-drm-vc4-Refactor-mode-checking-logic.patch b/target/linux/bcm27xx/patches-6.1/950-0010-drm-vc4-Refactor-mode-checking-logic.patch
new file mode 100644
index 00000000000000..ca67a9c4cde8f5
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0010-drm-vc4-Refactor-mode-checking-logic.patch
@@ -0,0 +1,82 @@
+From 3246c9abe5f4358cc5c60b8621485faa9883d06b Mon Sep 17 00:00:00 2001
+From: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
+Date: Thu, 15 Jul 2021 01:08:05 +0200
+Subject: [PATCH] drm/vc4: Refactor mode checking logic
+
+Replace drm_encoder_helper_funcs::atomic_check with
+drm_connector_helper_funcs::atomic_check - the former is not called
+during drm_mode_obj_set_property_ioctl(). Set crtc_state->mode_changed
+if TV norm changes even without explicit mode change. This makes things
+like "xrandr --output Composite-1 --set mode PAL-M" work properly.
+
+Signed-off-by: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_vec.c | 42 ++++++++++++++++++++++-------------
+ 1 file changed, 26 insertions(+), 16 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_vec.c
++++ b/drivers/gpu/drm/vc4/vc4_vec.c
+@@ -392,6 +392,31 @@ static void vc4_vec_connector_reset(stru
+ 		connector->state->tv.mode = vc4_vec_get_default_mode(connector);
+ }
+ 
++static int vc4_vec_connector_atomic_check(struct drm_connector *conn,
++					  struct drm_atomic_state *state)
++{
++	struct drm_connector_state *old_state =
++		drm_atomic_get_old_connector_state(state, conn);
++	struct drm_connector_state *new_state =
++		drm_atomic_get_new_connector_state(state, conn);
++
++	const struct vc4_vec_tv_mode *vec_mode =
++		&vc4_vec_tv_modes[new_state->tv.mode];
++
++	if (new_state->crtc) {
++		struct drm_crtc_state *crtc_state =
++			drm_atomic_get_new_crtc_state(state, new_state->crtc);
++
++		if (!drm_mode_equal(vec_mode->mode, &crtc_state->mode))
++			return -EINVAL;
++
++		if (old_state->tv.mode != new_state->tv.mode)
++			crtc_state->mode_changed = true;
++	}
++
++	return 0;
++}
++
+ static const struct drm_connector_funcs vc4_vec_connector_funcs = {
+ 	.detect = vc4_vec_connector_detect,
+ 	.fill_modes = drm_helper_probe_single_connector_modes,
+@@ -402,6 +427,7 @@ static const struct drm_connector_funcs
+ 
+ static const struct drm_connector_helper_funcs vc4_vec_connector_helper_funcs = {
+ 	.get_modes = vc4_vec_connector_get_modes,
++	.atomic_check = vc4_vec_connector_atomic_check,
+ };
+ 
+ static int vc4_vec_connector_init(struct drm_device *dev, struct vc4_vec *vec)
+@@ -550,23 +576,7 @@ err_dev_exit:
+ 	drm_dev_exit(idx);
+ }
+ 
+-static int vc4_vec_encoder_atomic_check(struct drm_encoder *encoder,
+-					struct drm_crtc_state *crtc_state,
+-					struct drm_connector_state *conn_state)
+-{
+-	const struct vc4_vec_tv_mode *vec_mode;
+-
+-	vec_mode = &vc4_vec_tv_modes[conn_state->tv.mode];
+-
+-	if (conn_state->crtc &&
+-	    !drm_mode_equal(vec_mode->mode, &crtc_state->adjusted_mode))
+-		return -EINVAL;
+-
+-	return 0;
+-}
+-
+ static const struct drm_encoder_helper_funcs vc4_vec_encoder_helper_funcs = {
+-	.atomic_check = vc4_vec_encoder_atomic_check,
+ 	.atomic_disable = vc4_vec_encoder_disable,
+ 	.atomic_enable = vc4_vec_encoder_enable,
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0011-drm-vc4-Add-firmware-kms-mode.patch b/target/linux/bcm27xx/patches-6.1/950-0011-drm-vc4-Add-firmware-kms-mode.patch
new file mode 100644
index 00000000000000..b01a78c0150585
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0011-drm-vc4-Add-firmware-kms-mode.patch
@@ -0,0 +1,2476 @@
+From 2f74e0d6dd9f545a3b1dcc8d3cdf0ccf55a6f7d0 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 7 Sep 2020 17:32:27 +0100
+Subject: [PATCH] drm/vc4: Add firmware-kms mode
+
+This is a squash of all firmware-kms related patches from previous
+branches, up to and including
+"drm/vc4: Set the possible crtcs mask correctly for planes with FKMS"
+plus a couple of minor fixups for the 5.9 branch.
+Please refer to earlier branches for full history.
+
+This patch includes work by Eric Anholt, James Hughes, Phil Elwell,
+Dave Stevenson, Dom Cobley, and Jonathon Bell.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/vc4: Fixup firmware-kms after "drm/atomic: Pass the full state to CRTC atomic enable/disable"
+
+Prototype for those calls changed, so amend fkms (which isn't
+upstream) to match.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/vc4: Fixup fkms for API change
+
+Atomic flush and check changed API, so fix up the downstream-only
+FKMS driver.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/vc4: Make normalize_zpos conditional on using fkms
+
+Eric's view was that there was no point in having zpos
+support on vc4 as all the planes had the same functionality.
+
+Can be later squashed into (and fixes):
+drm/vc4: Add firmware-kms mode
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+drm/vc4: FKMS: Change of Broadcast RGB mode needs a mode change
+
+The Broadcast RGB (aka HDMI limited/full range) property is only
+notified to the firmware on mode change, so this needs to be
+signalled when set.
+
+https://github.com/raspberrypi/firmware/issues/1580
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+vc4/drv: Only notify firmware of display done with kms
+
+fkms driver still wants firmware display to be active
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+ydrm/vc4: fkms: Fix margin calculations for the right/bottom edges
+
+The calculations clipped the right/bottom edge of the clipped
+range based on the left/top margins.
+
+https://github.com/raspberrypi/linux/issues/4447
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/vc4: fkms: Use new devm_rpi_firmware_get api
+
+drm/kms: Add allow_fb_modifiers
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/vc4/Makefile           |    1 +
+ drivers/gpu/drm/vc4/vc4_debugfs.c      |    3 +-
+ drivers/gpu/drm/vc4/vc4_drv.c          |   29 +-
+ drivers/gpu/drm/vc4/vc4_drv.h          |    7 +
+ drivers/gpu/drm/vc4/vc4_firmware_kms.c | 1997 ++++++++++++++++++++++++
+ drivers/gpu/drm/vc4/vc4_kms.c          |   35 +-
+ drivers/gpu/drm/vc4/vc_image_types.h   |  175 +++
+ 7 files changed, 2233 insertions(+), 14 deletions(-)
+ create mode 100644 drivers/gpu/drm/vc4/vc4_firmware_kms.c
+ create mode 100644 drivers/gpu/drm/vc4/vc_image_types.h
+
+--- a/drivers/gpu/drm/vc4/Makefile
++++ b/drivers/gpu/drm/vc4/Makefile
+@@ -9,6 +9,7 @@ vc4-y := \
+ 	vc4_dpi.o \
+ 	vc4_dsi.o \
+ 	vc4_fence.o \
++	vc4_firmware_kms.o \
+ 	vc4_kms.o \
+ 	vc4_gem.o \
+ 	vc4_hdmi.o \
+--- a/drivers/gpu/drm/vc4/vc4_debugfs.c
++++ b/drivers/gpu/drm/vc4/vc4_debugfs.c
+@@ -24,7 +24,8 @@ vc4_debugfs_init(struct drm_minor *minor
+ 	struct vc4_dev *vc4 = to_vc4_dev(minor->dev);
+ 	struct drm_device *drm = &vc4->base;
+ 
+-	drm_WARN_ON(drm, vc4_hvs_debugfs_init(minor));
++	if (vc4->hvs)
++		drm_WARN_ON(drm, vc4_hvs_debugfs_init(minor));
+ 
+ 	if (vc4->v3d) {
+ 		drm_WARN_ON(drm, vc4_bo_debugfs_init(minor));
+--- a/drivers/gpu/drm/vc4/vc4_drv.c
++++ b/drivers/gpu/drm/vc4/vc4_drv.c
+@@ -284,6 +284,18 @@ static const struct of_device_id vc4_dma
+ 	{}
+ };
+ 
++/*
++ * we need this helper function for determining presence of fkms
++ * before it's been bound
++ */
++static bool firmware_kms(void)
++{
++	return of_device_is_available(of_find_compatible_node(NULL, NULL,
++	       "raspberrypi,rpi-firmware-kms")) ||
++	       of_device_is_available(of_find_compatible_node(NULL, NULL,
++	       "raspberrypi,rpi-firmware-kms-2711"));
++}
++
+ static int vc4_drm_bind(struct device *dev)
+ {
+ 	struct platform_device *pdev = to_platform_device(dev);
+@@ -357,7 +369,7 @@ static int vc4_drm_bind(struct device *d
+ 	if (ret)
+ 		return ret;
+ 
+-	if (firmware) {
++	if (firmware && !firmware_kms()) {
+ 		ret = rpi_firmware_property(firmware,
+ 					    RPI_FIRMWARE_NOTIFY_DISPLAY_DONE,
+ 					    NULL, 0);
+@@ -375,16 +387,20 @@ static int vc4_drm_bind(struct device *d
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = vc4_plane_create_additional_planes(drm);
+-	if (ret)
+-		goto unbind_all;
++	if (!vc4->firmware_kms) {
++		ret = vc4_plane_create_additional_planes(drm);
++		if (ret)
++			return ret;
++	}
+ 
+ 	ret = vc4_kms_load(drm);
+ 	if (ret < 0)
+ 		goto unbind_all;
+ 
+-	drm_for_each_crtc(crtc, drm)
+-		vc4_crtc_disable_at_boot(crtc);
++	if (!vc4->firmware_kms) {
++		drm_for_each_crtc(crtc, drm)
++			vc4_crtc_disable_at_boot(crtc);
++	}
+ 
+ 	ret = drm_dev_register(drm, 0);
+ 	if (ret < 0)
+@@ -428,6 +444,7 @@ static struct platform_driver *const com
+ 	&vc4_dsi_driver,
+ 	&vc4_txp_driver,
+ 	&vc4_crtc_driver,
++	&vc4_firmware_kms_driver,
+ 	&vc4_v3d_driver,
+ };
+ 
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -82,8 +82,12 @@ struct vc4_dev {
+ 
+ 	unsigned int irq;
+ 
++	bool firmware_kms;
++	struct rpi_firmware *firmware;
++
+ 	struct vc4_hvs *hvs;
+ 	struct vc4_v3d *v3d;
++	struct vc4_fkms *fkms;
+ 
+ 	struct vc4_hang_state *hang_state;
+ 
+@@ -905,6 +909,9 @@ extern struct platform_driver vc4_dsi_dr
+ /* vc4_fence.c */
+ extern const struct dma_fence_ops vc4_fence_ops;
+ 
++/* vc4_firmware_kms.c */
++extern struct platform_driver vc4_firmware_kms_driver;
++
+ /* vc4_gem.c */
+ int vc4_gem_init(struct drm_device *dev);
+ int vc4_submit_cl_ioctl(struct drm_device *dev, void *data,
+--- /dev/null
++++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+@@ -0,0 +1,1997 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Copyright (C) 2016 Broadcom
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++/**
++ * DOC: VC4 firmware KMS module.
++ *
++ * As a hack to get us from the current closed source driver world
++ * toward a totally open stack, implement KMS on top of the Raspberry
++ * Pi's firmware display stack.
++ */
++
++#include <drm/drm_atomic_helper.h>
++#include <drm/drm_crtc_helper.h>
++#include <drm/drm_blend.h>
++#include <drm/drm_drv.h>
++#include <drm/drm_edid.h>
++#include <drm/drm_fb_dma_helper.h>
++#include <drm/drm_fourcc.h>
++#include <drm/drm_framebuffer.h>
++#include <drm/drm_gem_atomic_helper.h>
++#include <drm/drm_plane_helper.h>
++#include <drm/drm_probe_helper.h>
++#include <drm/drm_vblank.h>
++
++#include <linux/component.h>
++#include <linux/clk.h>
++#include <linux/debugfs.h>
++#include <linux/module.h>
++
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
++#include "vc4_drv.h"
++#include "vc4_regs.h"
++#include "vc_image_types.h"
++
++int fkms_max_refresh_rate = 85;
++module_param(fkms_max_refresh_rate, int, 0644);
++MODULE_PARM_DESC(fkms_max_refresh_rate, "Max supported refresh rate");
++
++struct get_display_cfg {
++	u32  max_pixel_clock[2];  //Max pixel clock for each display
++};
++
++struct vc4_fkms {
++	struct get_display_cfg cfg;
++	bool bcm2711;
++};
++
++#define PLANES_PER_CRTC		8
++
++struct set_plane {
++	u8 display;
++	u8 plane_id;
++	u8 vc_image_type;
++	s8 layer;
++
++	u16 width;
++	u16 height;
++
++	u16 pitch;
++	u16 vpitch;
++
++	u32 src_x;	/* 16p16 */
++	u32 src_y;	/* 16p16 */
++
++	u32 src_w;	/* 16p16 */
++	u32 src_h;	/* 16p16 */
++
++	s16 dst_x;
++	s16 dst_y;
++
++	u16 dst_w;
++	u16 dst_h;
++
++	u8 alpha;
++	u8 num_planes;
++	u8 is_vu;
++	u8 color_encoding;
++
++	u32 planes[4];  /* DMA address of each plane */
++
++	u32 transform;
++};
++
++/* Values for the transform field */
++#define TRANSFORM_NO_ROTATE	0
++#define TRANSFORM_ROTATE_180	BIT(1)
++#define TRANSFORM_FLIP_HRIZ	BIT(16)
++#define TRANSFORM_FLIP_VERT	BIT(17)
++
++struct mailbox_set_plane {
++	struct rpi_firmware_property_tag_header tag;
++	struct set_plane plane;
++};
++
++struct mailbox_blank_display {
++	struct rpi_firmware_property_tag_header tag1;
++	u32 display;
++	struct rpi_firmware_property_tag_header tag2;
++	u32 blank;
++};
++
++struct mailbox_display_pwr {
++	struct rpi_firmware_property_tag_header tag1;
++	u32 display;
++	u32 state;
++};
++
++struct mailbox_get_edid {
++	struct rpi_firmware_property_tag_header tag1;
++	u32 block;
++	u32 display_number;
++	u8 edid[128];
++};
++
++struct set_timings {
++	u8 display;
++	u8 padding;
++	u16 video_id_code;
++
++	u32 clock;		/* in kHz */
++
++	u16 hdisplay;
++	u16 hsync_start;
++
++	u16 hsync_end;
++	u16 htotal;
++
++	u16 hskew;
++	u16 vdisplay;
++
++	u16 vsync_start;
++	u16 vsync_end;
++
++	u16 vtotal;
++	u16 vscan;
++
++	u16 vrefresh;
++	u16 padding2;
++
++	u32 flags;
++#define  TIMINGS_FLAGS_H_SYNC_POS	BIT(0)
++#define  TIMINGS_FLAGS_H_SYNC_NEG	0
++#define  TIMINGS_FLAGS_V_SYNC_POS	BIT(1)
++#define  TIMINGS_FLAGS_V_SYNC_NEG	0
++#define  TIMINGS_FLAGS_INTERLACE	BIT(2)
++
++#define TIMINGS_FLAGS_ASPECT_MASK	GENMASK(7, 4)
++#define TIMINGS_FLAGS_ASPECT_NONE	(0 << 4)
++#define TIMINGS_FLAGS_ASPECT_4_3	(1 << 4)
++#define TIMINGS_FLAGS_ASPECT_16_9	(2 << 4)
++#define TIMINGS_FLAGS_ASPECT_64_27	(3 << 4)
++#define TIMINGS_FLAGS_ASPECT_256_135	(4 << 4)
++
++/* Limited range RGB flag. Not set corresponds to full range. */
++#define TIMINGS_FLAGS_RGB_LIMITED	BIT(8)
++/* DVI monitor, therefore disable infoframes. Not set corresponds to HDMI. */
++#define TIMINGS_FLAGS_DVI		BIT(9)
++/* Double clock */
++#define TIMINGS_FLAGS_DBL_CLK		BIT(10)
++};
++
++struct mailbox_set_mode {
++	struct rpi_firmware_property_tag_header tag1;
++	struct set_timings timings;
++};
++
++static const struct vc_image_format {
++	u32 drm;	/* DRM_FORMAT_* */
++	u32 vc_image;	/* VC_IMAGE_* */
++	u32 is_vu;
++} vc_image_formats[] = {
++	{
++		.drm = DRM_FORMAT_XRGB8888,
++		.vc_image = VC_IMAGE_XRGB8888,
++	},
++	{
++		.drm = DRM_FORMAT_ARGB8888,
++		.vc_image = VC_IMAGE_ARGB8888,
++	},
++/*
++ *	FIXME: Need to resolve which DRM format goes to which vc_image format
++ *	for the remaining RGBA and RGBX formats.
++ *	{
++ *		.drm = DRM_FORMAT_ABGR8888,
++ *		.vc_image = VC_IMAGE_RGBA8888,
++ *	},
++ *	{
++ *		.drm = DRM_FORMAT_XBGR8888,
++ *		.vc_image = VC_IMAGE_RGBA8888,
++ *	},
++ */
++	{
++		.drm = DRM_FORMAT_RGB565,
++		.vc_image = VC_IMAGE_RGB565,
++	},
++	{
++		.drm = DRM_FORMAT_RGB888,
++		.vc_image = VC_IMAGE_BGR888,
++	},
++	{
++		.drm = DRM_FORMAT_BGR888,
++		.vc_image = VC_IMAGE_RGB888,
++	},
++	{
++		.drm = DRM_FORMAT_YUV422,
++		.vc_image = VC_IMAGE_YUV422PLANAR,
++	},
++	{
++		.drm = DRM_FORMAT_YUV420,
++		.vc_image = VC_IMAGE_YUV420,
++	},
++	{
++		.drm = DRM_FORMAT_YVU420,
++		.vc_image = VC_IMAGE_YUV420,
++		.is_vu = 1,
++	},
++	{
++		.drm = DRM_FORMAT_NV12,
++		.vc_image = VC_IMAGE_YUV420SP,
++	},
++	{
++		.drm = DRM_FORMAT_NV21,
++		.vc_image = VC_IMAGE_YUV420SP,
++		.is_vu = 1,
++	},
++	{
++		.drm = DRM_FORMAT_P030,
++		.vc_image = VC_IMAGE_YUV10COL,
++	},
++};
++
++static const struct vc_image_format *vc4_get_vc_image_fmt(u32 drm_format)
++{
++	unsigned int i;
++
++	for (i = 0; i < ARRAY_SIZE(vc_image_formats); i++) {
++		if (vc_image_formats[i].drm == drm_format)
++			return &vc_image_formats[i];
++	}
++
++	return NULL;
++}
++
++/* The firmware delivers a vblank interrupt to us through the SMI
++ * hardware, which has only this one register.
++ */
++#define SMICS 0x0
++#define SMIDSW0 0x14
++#define SMIDSW1 0x1C
++#define SMICS_INTERRUPTS (BIT(9) | BIT(10) | BIT(11))
++
++/* Flag to denote that the firmware is giving multiple display callbacks */
++#define SMI_NEW 0xabcd0000
++
++#define vc4_crtc vc4_kms_crtc
++#define to_vc4_crtc to_vc4_kms_crtc
++struct vc4_crtc {
++	struct drm_crtc base;
++	struct drm_encoder *encoder;
++	struct drm_connector *connector;
++	void __iomem *regs;
++
++	struct drm_pending_vblank_event *event;
++	bool vblank_enabled;
++	u32 display_number;
++	u32 display_type;
++};
++
++static inline struct vc4_crtc *to_vc4_crtc(struct drm_crtc *crtc)
++{
++	return container_of(crtc, struct vc4_crtc, base);
++}
++
++struct vc4_fkms_encoder {
++	struct drm_encoder base;
++	bool hdmi_monitor;
++	bool rgb_range_selectable;
++	int display_num;
++};
++
++static inline struct vc4_fkms_encoder *
++to_vc4_fkms_encoder(struct drm_encoder *encoder)
++{
++	return container_of(encoder, struct vc4_fkms_encoder, base);
++}
++
++/* "Broadcast RGB" property.
++ * Allows overriding of HDMI full or limited range RGB
++ */
++#define VC4_BROADCAST_RGB_AUTO 0
++#define VC4_BROADCAST_RGB_FULL 1
++#define VC4_BROADCAST_RGB_LIMITED 2
++
++/* VC4 FKMS connector KMS struct */
++struct vc4_fkms_connector {
++	struct drm_connector base;
++
++	/* Since the connector is attached to just the one encoder,
++	 * this is the reference to it so we can do the best_encoder()
++	 * hook.
++	 */
++	struct drm_encoder *encoder;
++	struct vc4_dev *vc4_dev;
++	u32 display_number;
++	u32 display_type;
++
++	struct drm_property *broadcast_rgb_property;
++};
++
++static inline struct vc4_fkms_connector *
++to_vc4_fkms_connector(struct drm_connector *connector)
++{
++	return container_of(connector, struct vc4_fkms_connector, base);
++}
++
++/* VC4 FKMS connector state */
++struct vc4_fkms_connector_state {
++	struct drm_connector_state base;
++
++	int broadcast_rgb;
++};
++
++#define to_vc4_fkms_connector_state(x) \
++			container_of(x, struct vc4_fkms_connector_state, base)
++
++static u32 vc4_get_display_type(u32 display_number)
++{
++	const u32 display_types[] = {
++		/* The firmware display (DispmanX) IDs map to specific types in
++		 * a fixed manner.
++		 */
++		DRM_MODE_ENCODER_DSI,	/* MAIN_LCD - DSI or DPI */
++		DRM_MODE_ENCODER_DSI,	/* AUX_LCD */
++		DRM_MODE_ENCODER_TMDS,	/* HDMI0 */
++		DRM_MODE_ENCODER_TVDAC,	/* VEC */
++		DRM_MODE_ENCODER_NONE,	/* FORCE_LCD */
++		DRM_MODE_ENCODER_NONE,	/* FORCE_TV */
++		DRM_MODE_ENCODER_NONE,	/* FORCE_OTHER */
++		DRM_MODE_ENCODER_TMDS,	/* HDMI1 */
++		DRM_MODE_ENCODER_NONE,	/* FORCE_TV2 */
++	};
++	return display_number > ARRAY_SIZE(display_types) - 1 ?
++			DRM_MODE_ENCODER_NONE : display_types[display_number];
++}
++
++/* Firmware's structure for making an FB mbox call. */
++struct fbinfo_s {
++	u32 xres, yres, xres_virtual, yres_virtual;
++	u32 pitch, bpp;
++	u32 xoffset, yoffset;
++	u32 base;
++	u32 screen_size;
++	u16 cmap[256];
++};
++
++struct vc4_fkms_plane {
++	struct drm_plane base;
++	struct fbinfo_s *fbinfo;
++	dma_addr_t fbinfo_bus_addr;
++	u32 pitch;
++	struct mailbox_set_plane mb;
++};
++
++static inline struct vc4_fkms_plane *to_vc4_fkms_plane(struct drm_plane *plane)
++{
++	return (struct vc4_fkms_plane *)plane;
++}
++
++static int vc4_plane_set_blank(struct drm_plane *plane, bool blank)
++{
++	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
++	struct vc4_fkms_plane *vc4_plane = to_vc4_fkms_plane(plane);
++	struct mailbox_set_plane blank_mb = {
++		.tag = { RPI_FIRMWARE_SET_PLANE, sizeof(struct set_plane), 0 },
++		.plane = {
++			.display = vc4_plane->mb.plane.display,
++			.plane_id = vc4_plane->mb.plane.plane_id,
++		}
++	};
++	static const char * const plane_types[] = {
++							"overlay",
++							"primary",
++							"cursor"
++						  };
++	int ret;
++
++	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] %s plane %s",
++			 plane->base.id, plane->name, plane_types[plane->type],
++			 blank ? "blank" : "unblank");
++
++	if (blank)
++		ret = rpi_firmware_property_list(vc4->firmware, &blank_mb,
++						 sizeof(blank_mb));
++	else
++		ret = rpi_firmware_property_list(vc4->firmware, &vc4_plane->mb,
++						 sizeof(vc4_plane->mb));
++
++	WARN_ONCE(ret, "%s: firmware call failed. Please update your firmware",
++		  __func__);
++	return ret;
++}
++
++static void vc4_fkms_crtc_get_margins(struct drm_crtc_state *state,
++				      unsigned int *left, unsigned int *right,
++				      unsigned int *top, unsigned int *bottom)
++{
++	struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(state);
++	struct drm_connector_state *conn_state;
++	struct drm_connector *conn;
++	int i;
++
++	*left = vc4_state->margins.left;
++	*right = vc4_state->margins.right;
++	*top = vc4_state->margins.top;
++	*bottom = vc4_state->margins.bottom;
++
++	/* We have to interate over all new connector states because
++	 * vc4_fkms_crtc_get_margins() might be called before
++	 * vc4_fkms_crtc_atomic_check() which means margins info in
++	 * vc4_crtc_state might be outdated.
++	 */
++	for_each_new_connector_in_state(state->state, conn, conn_state, i) {
++		if (conn_state->crtc != state->crtc)
++			continue;
++
++		*left = conn_state->tv.margins.left;
++		*right = conn_state->tv.margins.right;
++		*top = conn_state->tv.margins.top;
++		*bottom = conn_state->tv.margins.bottom;
++		break;
++	}
++}
++
++static int vc4_fkms_margins_adj(struct drm_plane_state *pstate,
++				struct set_plane *plane)
++{
++	unsigned int left, right, top, bottom;
++	int adjhdisplay, adjvdisplay;
++	struct drm_crtc_state *crtc_state;
++
++	crtc_state = drm_atomic_get_new_crtc_state(pstate->state,
++						   pstate->crtc);
++
++	vc4_fkms_crtc_get_margins(crtc_state, &left, &right, &top, &bottom);
++
++	if (!left && !right && !top && !bottom)
++		return 0;
++
++	if (left + right >= crtc_state->mode.hdisplay ||
++	    top + bottom >= crtc_state->mode.vdisplay)
++		return -EINVAL;
++
++	adjhdisplay = crtc_state->mode.hdisplay - (left + right);
++	plane->dst_x = DIV_ROUND_CLOSEST(plane->dst_x * adjhdisplay,
++					 (int)crtc_state->mode.hdisplay);
++	plane->dst_x += left;
++	if (plane->dst_x > (int)(crtc_state->mode.hdisplay - right))
++		plane->dst_x = crtc_state->mode.hdisplay - right;
++
++	adjvdisplay = crtc_state->mode.vdisplay - (top + bottom);
++	plane->dst_y = DIV_ROUND_CLOSEST(plane->dst_y * adjvdisplay,
++					 (int)crtc_state->mode.vdisplay);
++	plane->dst_y += top;
++	if (plane->dst_y > (int)(crtc_state->mode.vdisplay - bottom))
++		plane->dst_y = crtc_state->mode.vdisplay - bottom;
++
++	plane->dst_w = DIV_ROUND_CLOSEST(plane->dst_w * adjhdisplay,
++					 crtc_state->mode.hdisplay);
++	plane->dst_h = DIV_ROUND_CLOSEST(plane->dst_h * adjvdisplay,
++					 crtc_state->mode.vdisplay);
++
++	if (!plane->dst_w || !plane->dst_h)
++		return -EINVAL;
++
++	return 0;
++}
++
++static void vc4_plane_atomic_update(struct drm_plane *plane,
++				    struct drm_atomic_state *old_state)
++{
++	struct drm_plane_state *state = plane->state;
++
++	/*
++	 * Do NOT set now, as we haven't checked if the crtc is active or not.
++	 * Set from vc4_plane_set_blank instead.
++	 *
++	 * If the CRTC is on (or going to be on) and we're enabled,
++	 * then unblank.  Otherwise, stay blank until CRTC enable.
++	 */
++	if (state->crtc->state->active)
++		vc4_plane_set_blank(plane, false);
++}
++
++static void vc4_plane_atomic_disable(struct drm_plane *plane,
++				     struct drm_atomic_state *old_state)
++{
++	struct drm_plane_state *state = plane->state;
++	struct vc4_fkms_plane *vc4_plane = to_vc4_fkms_plane(plane);
++
++	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] plane disable %dx%d@%d +%d,%d\n",
++			 plane->base.id, plane->name,
++			 state->crtc_w,
++			 state->crtc_h,
++			 vc4_plane->mb.plane.vc_image_type,
++			 state->crtc_x,
++			 state->crtc_y);
++	vc4_plane_set_blank(plane, true);
++}
++
++static bool plane_enabled(struct drm_plane_state *state)
++{
++	return state->fb && state->crtc;
++}
++
++static int vc4_plane_to_mb(struct drm_plane *plane,
++			   struct mailbox_set_plane *mb,
++			   struct drm_plane_state *state)
++{
++	struct drm_framebuffer *fb = state->fb;
++	struct drm_gem_dma_object *bo = drm_fb_dma_get_gem_obj(fb, 0);
++	const struct drm_format_info *drm_fmt = fb->format;
++	const struct vc_image_format *vc_fmt =
++					vc4_get_vc_image_fmt(drm_fmt->format);
++	int num_planes = fb->format->num_planes;
++	unsigned int rotation;
++
++	mb->plane.vc_image_type = vc_fmt->vc_image;
++	mb->plane.width = fb->width;
++	mb->plane.height = fb->height;
++	mb->plane.pitch = fb->pitches[0];
++	mb->plane.src_w = state->src_w;
++	mb->plane.src_h = state->src_h;
++	mb->plane.src_x = state->src_x;
++	mb->plane.src_y = state->src_y;
++	mb->plane.dst_w = state->crtc_w;
++	mb->plane.dst_h = state->crtc_h;
++	mb->plane.dst_x = state->crtc_x;
++	mb->plane.dst_y = state->crtc_y;
++	mb->plane.alpha = state->alpha >> 8;
++	mb->plane.layer = state->normalized_zpos ?
++					state->normalized_zpos : -127;
++	mb->plane.num_planes = num_planes;
++	mb->plane.is_vu = vc_fmt->is_vu;
++	mb->plane.planes[0] = bo->dma_addr + fb->offsets[0];
++
++	rotation = drm_rotation_simplify(state->rotation,
++					 DRM_MODE_ROTATE_0 |
++					 DRM_MODE_REFLECT_X |
++					 DRM_MODE_REFLECT_Y);
++
++	mb->plane.transform = TRANSFORM_NO_ROTATE;
++	if (rotation & DRM_MODE_REFLECT_X)
++		mb->plane.transform |= TRANSFORM_FLIP_HRIZ;
++	if (rotation & DRM_MODE_REFLECT_Y)
++		mb->plane.transform |= TRANSFORM_FLIP_VERT;
++
++	vc4_fkms_margins_adj(state, &mb->plane);
++
++	if (num_planes > 1) {
++		/* Assume this must be YUV */
++		/* Makes assumptions on the stride for the chroma planes as we
++		 * can't easily plumb in non-standard pitches.
++		 */
++		mb->plane.planes[1] = bo->dma_addr + fb->offsets[1];
++		if (num_planes > 2)
++			mb->plane.planes[2] = bo->dma_addr + fb->offsets[2];
++		else
++			mb->plane.planes[2] = 0;
++
++		/* Special case the YUV420 with U and V as line interleaved
++		 * planes as we have special handling for that case.
++		 */
++		if (num_planes == 3 &&
++		    (fb->offsets[2] - fb->offsets[1]) == fb->pitches[1])
++			mb->plane.vc_image_type = VC_IMAGE_YUV420_S;
++
++		switch (state->color_encoding) {
++		default:
++		case DRM_COLOR_YCBCR_BT601:
++			if (state->color_range == DRM_COLOR_YCBCR_LIMITED_RANGE)
++				mb->plane.color_encoding =
++						VC_IMAGE_YUVINFO_CSC_ITUR_BT601;
++			else
++				mb->plane.color_encoding =
++						VC_IMAGE_YUVINFO_CSC_JPEG_JFIF;
++			break;
++		case DRM_COLOR_YCBCR_BT709:
++			/* Currently no support for a full range BT709 */
++			mb->plane.color_encoding =
++						VC_IMAGE_YUVINFO_CSC_ITUR_BT709;
++			break;
++		case DRM_COLOR_YCBCR_BT2020:
++			/* Currently no support for a full range BT2020 */
++			mb->plane.color_encoding =
++					VC_IMAGE_YUVINFO_CSC_REC_2020;
++			break;
++		}
++	} else {
++		mb->plane.planes[1] = 0;
++		mb->plane.planes[2] = 0;
++	}
++	mb->plane.planes[3] = 0;
++
++	switch (fourcc_mod_broadcom_mod(fb->modifier)) {
++	case DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED:
++		switch (mb->plane.vc_image_type) {
++		case VC_IMAGE_XRGB8888:
++			mb->plane.vc_image_type = VC_IMAGE_TF_RGBX32;
++			break;
++		case VC_IMAGE_ARGB8888:
++			mb->plane.vc_image_type = VC_IMAGE_TF_RGBA32;
++			break;
++		case VC_IMAGE_RGB565:
++			mb->plane.vc_image_type = VC_IMAGE_TF_RGB565;
++			break;
++		}
++		break;
++	case DRM_FORMAT_MOD_BROADCOM_SAND128:
++		switch (mb->plane.vc_image_type) {
++		case VC_IMAGE_YUV420SP:
++			mb->plane.vc_image_type = VC_IMAGE_YUV_UV;
++			break;
++		/* VC_IMAGE_YUV10COL could be included in here, but it is only
++		 * valid as a SAND128 format, so the table at the top will have
++		 * already set the correct format.
++		 */
++		}
++		/* Note that the column pitch is passed across in lines, not
++		 * bytes.
++		 */
++		mb->plane.pitch = fourcc_mod_broadcom_param(fb->modifier);
++		break;
++	}
++
++	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] plane update %dx%d@%d +dst(%d,%d, %d,%d) +src(%d,%d, %d,%d) 0x%08x/%08x/%08x/%d, alpha %u zpos %u\n",
++			 plane->base.id, plane->name,
++			 mb->plane.width,
++			 mb->plane.height,
++			 mb->plane.vc_image_type,
++			 state->crtc_x,
++			 state->crtc_y,
++			 state->crtc_w,
++			 state->crtc_h,
++			 mb->plane.src_x,
++			 mb->plane.src_y,
++			 mb->plane.src_w,
++			 mb->plane.src_h,
++			 mb->plane.planes[0],
++			 mb->plane.planes[1],
++			 mb->plane.planes[2],
++			 fb->pitches[0],
++			 state->alpha,
++			 state->normalized_zpos);
++
++	return 0;
++}
++
++static int vc4_plane_atomic_check(struct drm_plane *plane,
++				  struct drm_atomic_state *state)
++{
++	struct drm_plane_state *new_plane_state = drm_atomic_get_new_plane_state(state,
++										 plane);
++	struct vc4_fkms_plane *vc4_plane = to_vc4_fkms_plane(plane);
++
++	if (!plane_enabled(new_plane_state))
++		return 0;
++
++	return vc4_plane_to_mb(plane, &vc4_plane->mb, new_plane_state);
++}
++
++/* Called during init to allocate the plane's atomic state. */
++static void vc4_plane_reset(struct drm_plane *plane)
++{
++	struct vc4_plane_state *vc4_state;
++
++	WARN_ON(plane->state);
++
++	vc4_state = kzalloc(sizeof(*vc4_state), GFP_KERNEL);
++	if (!vc4_state)
++		return;
++
++	__drm_atomic_helper_plane_reset(plane, &vc4_state->base);
++}
++
++static void vc4_plane_destroy(struct drm_plane *plane)
++{
++	drm_plane_cleanup(plane);
++}
++
++static bool vc4_fkms_format_mod_supported(struct drm_plane *plane,
++					  uint32_t format,
++					  uint64_t modifier)
++{
++	/* Support T_TILING for RGB formats only. */
++	switch (format) {
++	case DRM_FORMAT_XRGB8888:
++	case DRM_FORMAT_ARGB8888:
++	case DRM_FORMAT_RGB565:
++		switch (modifier) {
++		case DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED:
++		case DRM_FORMAT_MOD_LINEAR:
++			return true;
++		default:
++			return false;
++		}
++	case DRM_FORMAT_NV12:
++		switch (fourcc_mod_broadcom_mod(modifier)) {
++		case DRM_FORMAT_MOD_LINEAR:
++		case DRM_FORMAT_MOD_BROADCOM_SAND128:
++			return true;
++		default:
++			return false;
++		}
++	case DRM_FORMAT_P030:
++		switch (fourcc_mod_broadcom_mod(modifier)) {
++		case DRM_FORMAT_MOD_BROADCOM_SAND128:
++			return true;
++		default:
++			return false;
++		}
++	case DRM_FORMAT_NV21:
++	case DRM_FORMAT_RGB888:
++	case DRM_FORMAT_BGR888:
++	case DRM_FORMAT_YUV422:
++	case DRM_FORMAT_YUV420:
++	case DRM_FORMAT_YVU420:
++	default:
++		return (modifier == DRM_FORMAT_MOD_LINEAR);
++	}
++}
++
++static struct drm_plane_state *vc4_plane_duplicate_state(struct drm_plane *plane)
++{
++	struct vc4_plane_state *vc4_state;
++
++	if (WARN_ON(!plane->state))
++		return NULL;
++
++	vc4_state = kzalloc(sizeof(*vc4_state), GFP_KERNEL);
++	if (!vc4_state)
++		return NULL;
++
++	__drm_atomic_helper_plane_duplicate_state(plane, &vc4_state->base);
++
++	return &vc4_state->base;
++}
++
++static const struct drm_plane_funcs vc4_plane_funcs = {
++	.update_plane = drm_atomic_helper_update_plane,
++	.disable_plane = drm_atomic_helper_disable_plane,
++	.destroy = vc4_plane_destroy,
++	.set_property = NULL,
++	.reset = vc4_plane_reset,
++	.atomic_duplicate_state = vc4_plane_duplicate_state,
++	.atomic_destroy_state = drm_atomic_helper_plane_destroy_state,
++	.format_mod_supported = vc4_fkms_format_mod_supported,
++};
++
++static const struct drm_plane_helper_funcs vc4_plane_helper_funcs = {
++	.prepare_fb = drm_gem_plane_helper_prepare_fb,
++	.cleanup_fb = NULL,
++	.atomic_check = vc4_plane_atomic_check,
++	.atomic_update = vc4_plane_atomic_update,
++	.atomic_disable = vc4_plane_atomic_disable,
++};
++
++static struct drm_plane *vc4_fkms_plane_init(struct drm_device *dev,
++					     enum drm_plane_type type,
++					     u8 display_num,
++					     u8 plane_id)
++{
++	struct drm_plane *plane = NULL;
++	struct vc4_fkms_plane *vc4_plane;
++	u32 formats[ARRAY_SIZE(vc_image_formats)];
++	unsigned int default_zpos = 0;
++	u32 num_formats = 0;
++	int ret = 0;
++	static const uint64_t modifiers[] = {
++		DRM_FORMAT_MOD_LINEAR,
++		/* VC4_T_TILED should come after linear, because we
++		 * would prefer to scan out linear (less bus traffic).
++		 */
++		DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED,
++		DRM_FORMAT_MOD_BROADCOM_SAND128,
++		DRM_FORMAT_MOD_INVALID,
++	};
++	int i;
++
++	vc4_plane = devm_kzalloc(dev->dev, sizeof(*vc4_plane),
++				 GFP_KERNEL);
++	if (!vc4_plane) {
++		ret = -ENOMEM;
++		goto fail;
++	}
++
++	for (i = 0; i < ARRAY_SIZE(vc_image_formats); i++)
++		formats[num_formats++] = vc_image_formats[i].drm;
++
++	plane = &vc4_plane->base;
++	ret = drm_universal_plane_init(dev, plane, 0,
++				       &vc4_plane_funcs,
++				       formats, num_formats, modifiers,
++				       type, NULL);
++
++	/* FIXME: Do we need to be checking return values from all these calls?
++	 */
++	drm_plane_helper_add(plane, &vc4_plane_helper_funcs);
++
++	drm_plane_create_alpha_property(plane);
++	drm_plane_create_rotation_property(plane, DRM_MODE_ROTATE_0,
++					   DRM_MODE_ROTATE_0 |
++					   DRM_MODE_ROTATE_180 |
++					   DRM_MODE_REFLECT_X |
++					   DRM_MODE_REFLECT_Y);
++	drm_plane_create_color_properties(plane,
++					  BIT(DRM_COLOR_YCBCR_BT601) |
++					  BIT(DRM_COLOR_YCBCR_BT709) |
++					  BIT(DRM_COLOR_YCBCR_BT2020),
++					  BIT(DRM_COLOR_YCBCR_LIMITED_RANGE) |
++					  BIT(DRM_COLOR_YCBCR_FULL_RANGE),
++					  DRM_COLOR_YCBCR_BT709,
++					  DRM_COLOR_YCBCR_LIMITED_RANGE);
++
++	/*
++	 * Default frame buffer setup is with FB on -127, and raspistill etc
++	 * tend to drop overlays on layer 2. Cursor plane was on layer +127.
++	 *
++	 * For F-KMS the mailbox call allows for a s8.
++	 * Remap zpos 0 to -127 for the background layer, but leave all the
++	 * other layers as requested by KMS.
++	 */
++	switch (type) {
++	default:
++	case DRM_PLANE_TYPE_PRIMARY:
++		default_zpos = 0;
++		break;
++	case DRM_PLANE_TYPE_OVERLAY:
++		default_zpos = 1;
++		break;
++	case DRM_PLANE_TYPE_CURSOR:
++		default_zpos = 2;
++		break;
++	}
++	drm_plane_create_zpos_property(plane, default_zpos, 0, 127);
++
++	/* Prepare the static elements of the mailbox structure */
++	vc4_plane->mb.tag.tag = RPI_FIRMWARE_SET_PLANE;
++	vc4_plane->mb.tag.buf_size = sizeof(struct set_plane);
++	vc4_plane->mb.tag.req_resp_size = 0;
++	vc4_plane->mb.plane.display = display_num;
++	vc4_plane->mb.plane.plane_id = plane_id;
++	vc4_plane->mb.plane.layer = default_zpos ? default_zpos : -127;
++
++	return plane;
++fail:
++	if (plane)
++		vc4_plane_destroy(plane);
++
++	return ERR_PTR(ret);
++}
++
++static void vc4_crtc_mode_set_nofb(struct drm_crtc *crtc)
++{
++	struct drm_device *dev = crtc->dev;
++	struct vc4_dev *vc4 = to_vc4_dev(dev);
++	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
++	struct drm_display_mode *mode = &crtc->state->adjusted_mode;
++	struct vc4_fkms_encoder *vc4_encoder =
++					to_vc4_fkms_encoder(vc4_crtc->encoder);
++	struct mailbox_set_mode mb = {
++		.tag1 = { RPI_FIRMWARE_SET_TIMING,
++			  sizeof(struct set_timings), 0},
++	};
++	union hdmi_infoframe frame;
++	int ret;
++
++	ret = drm_hdmi_avi_infoframe_from_display_mode(&frame.avi, vc4_crtc->connector, mode);
++	if (ret < 0) {
++		DRM_ERROR("couldn't fill AVI infoframe\n");
++		return;
++	}
++
++	DRM_DEBUG_KMS("Setting mode for display num %u mode name %s, clk %d, h(disp %d, start %d, end %d, total %d, skew %d) v(disp %d, start %d, end %d, total %d, scan %d), vrefresh %d, par %u, flags 0x%04x\n",
++		      vc4_crtc->display_number, mode->name, mode->clock,
++		      mode->hdisplay, mode->hsync_start, mode->hsync_end,
++		      mode->htotal, mode->hskew, mode->vdisplay,
++		      mode->vsync_start, mode->vsync_end, mode->vtotal,
++		      mode->vscan, drm_mode_vrefresh(mode),
++		      mode->picture_aspect_ratio, mode->flags);
++	mb.timings.display = vc4_crtc->display_number;
++
++	mb.timings.clock = mode->clock;
++	mb.timings.hdisplay = mode->hdisplay;
++	mb.timings.hsync_start = mode->hsync_start;
++	mb.timings.hsync_end = mode->hsync_end;
++	mb.timings.htotal = mode->htotal;
++	mb.timings.hskew = mode->hskew;
++	mb.timings.vdisplay = mode->vdisplay;
++	mb.timings.vsync_start = mode->vsync_start;
++	mb.timings.vsync_end = mode->vsync_end;
++	mb.timings.vtotal = mode->vtotal;
++	mb.timings.vscan = mode->vscan;
++	mb.timings.vrefresh = drm_mode_vrefresh(mode);
++	mb.timings.flags = 0;
++	if (mode->flags & DRM_MODE_FLAG_PHSYNC)
++		mb.timings.flags |= TIMINGS_FLAGS_H_SYNC_POS;
++	if (mode->flags & DRM_MODE_FLAG_PVSYNC)
++		mb.timings.flags |= TIMINGS_FLAGS_V_SYNC_POS;
++
++	switch (frame.avi.picture_aspect) {
++	default:
++	case HDMI_PICTURE_ASPECT_NONE:
++		mb.timings.flags |= TIMINGS_FLAGS_ASPECT_NONE;
++		break;
++	case HDMI_PICTURE_ASPECT_4_3:
++		mb.timings.flags |= TIMINGS_FLAGS_ASPECT_4_3;
++		break;
++	case HDMI_PICTURE_ASPECT_16_9:
++		mb.timings.flags |= TIMINGS_FLAGS_ASPECT_16_9;
++		break;
++	case HDMI_PICTURE_ASPECT_64_27:
++		mb.timings.flags |= TIMINGS_FLAGS_ASPECT_64_27;
++		break;
++	case HDMI_PICTURE_ASPECT_256_135:
++		mb.timings.flags |= TIMINGS_FLAGS_ASPECT_256_135;
++		break;
++	}
++
++	if (mode->flags & DRM_MODE_FLAG_INTERLACE)
++		mb.timings.flags |= TIMINGS_FLAGS_INTERLACE;
++	if (mode->flags & DRM_MODE_FLAG_DBLCLK)
++		mb.timings.flags |= TIMINGS_FLAGS_DBL_CLK;
++
++	mb.timings.video_id_code = frame.avi.video_code;
++
++	if (!vc4_encoder->hdmi_monitor) {
++		mb.timings.flags |= TIMINGS_FLAGS_DVI;
++	} else {
++		struct vc4_fkms_connector_state *conn_state =
++			to_vc4_fkms_connector_state(vc4_crtc->connector->state);
++
++		if (conn_state->broadcast_rgb == VC4_BROADCAST_RGB_AUTO) {
++			/* See CEA-861-E - 5.1 Default Encoding Parameters */
++			if (drm_default_rgb_quant_range(mode) ==
++					HDMI_QUANTIZATION_RANGE_LIMITED)
++				mb.timings.flags |= TIMINGS_FLAGS_RGB_LIMITED;
++		} else {
++			if (conn_state->broadcast_rgb ==
++						VC4_BROADCAST_RGB_LIMITED)
++				mb.timings.flags |= TIMINGS_FLAGS_RGB_LIMITED;
++
++			/* If not using the default range, then do not provide
++			 * a VIC as the HDMI spec requires that we do not
++			 * signal the opposite of the defined range in the AVI
++			 * infoframe.
++			 */
++			if (!!(mb.timings.flags & TIMINGS_FLAGS_RGB_LIMITED) !=
++			    (drm_default_rgb_quant_range(mode) ==
++					HDMI_QUANTIZATION_RANGE_LIMITED))
++				mb.timings.video_id_code = 0;
++		}
++	}
++
++	/*
++	 * FIXME: To implement
++	 * switch(mode->flag & DRM_MODE_FLAG_3D_MASK) {
++	 * case DRM_MODE_FLAG_3D_NONE:
++	 * case DRM_MODE_FLAG_3D_FRAME_PACKING:
++	 * case DRM_MODE_FLAG_3D_FIELD_ALTERNATIVE:
++	 * case DRM_MODE_FLAG_3D_LINE_ALTERNATIVE:
++	 * case DRM_MODE_FLAG_3D_SIDE_BY_SIDE_FULL:
++	 * case DRM_MODE_FLAG_3D_L_DEPTH:
++	 * case DRM_MODE_FLAG_3D_L_DEPTH_GFX_GFX_DEPTH:
++	 * case DRM_MODE_FLAG_3D_TOP_AND_BOTTOM:
++	 * case DRM_MODE_FLAG_3D_SIDE_BY_SIDE_HALF:
++	 * }
++	 */
++
++	ret = rpi_firmware_property_list(vc4->firmware, &mb, sizeof(mb));
++}
++
++static void vc4_crtc_disable(struct drm_crtc *crtc,
++			     struct drm_atomic_state *state)
++{
++	struct drm_device *dev = crtc->dev;
++	struct drm_plane *plane;
++
++	DRM_DEBUG_KMS("[CRTC:%d] vblanks off.\n",
++		      crtc->base.id);
++	drm_crtc_vblank_off(crtc);
++
++	/* Always turn the planes off on CRTC disable. In DRM, planes
++	 * are enabled/disabled through the update/disable hooks
++	 * above, and the CRTC enable/disable independently controls
++	 * whether anything scans out at all, but the firmware doesn't
++	 * give us a CRTC-level control for that.
++	 */
++
++	drm_atomic_crtc_for_each_plane(plane, crtc)
++		vc4_plane_atomic_disable(plane, state);
++
++	/*
++	 * Make sure we issue a vblank event after disabling the CRTC if
++	 * someone was waiting it.
++	 */
++	if (crtc->state->event) {
++		unsigned long flags;
++
++		spin_lock_irqsave(&dev->event_lock, flags);
++		drm_crtc_send_vblank_event(crtc, crtc->state->event);
++		crtc->state->event = NULL;
++		spin_unlock_irqrestore(&dev->event_lock, flags);
++	}
++}
++
++static void vc4_crtc_consume_event(struct drm_crtc *crtc)
++{
++	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
++	struct drm_device *dev = crtc->dev;
++	unsigned long flags;
++
++	if (!crtc->state->event)
++		return;
++
++	crtc->state->event->pipe = drm_crtc_index(crtc);
++
++	WARN_ON(drm_crtc_vblank_get(crtc) != 0);
++
++	spin_lock_irqsave(&dev->event_lock, flags);
++	vc4_crtc->event = crtc->state->event;
++	crtc->state->event = NULL;
++	spin_unlock_irqrestore(&dev->event_lock, flags);
++}
++
++static void vc4_crtc_enable(struct drm_crtc *crtc,
++			    struct drm_atomic_state *state)
++{
++	struct drm_plane *plane;
++
++	DRM_DEBUG_KMS("[CRTC:%d] vblanks on.\n",
++		      crtc->base.id);
++	drm_crtc_vblank_on(crtc);
++	vc4_crtc_consume_event(crtc);
++
++	/* Unblank the planes (if they're supposed to be displayed). */
++	drm_atomic_crtc_for_each_plane(plane, crtc)
++		if (plane->state->fb)
++			vc4_plane_set_blank(plane, plane->state->visible);
++}
++
++static enum drm_mode_status
++vc4_crtc_mode_valid(struct drm_crtc *crtc, const struct drm_display_mode *mode)
++{
++	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
++	struct drm_device *dev = crtc->dev;
++	struct vc4_dev *vc4 = to_vc4_dev(dev);
++	struct vc4_fkms *fkms = vc4->fkms;
++
++	/* Do not allow doublescan modes from user space */
++	if (mode->flags & DRM_MODE_FLAG_DBLSCAN) {
++		DRM_DEBUG_KMS("[CRTC:%d] Doublescan mode rejected.\n",
++			      crtc->base.id);
++		return MODE_NO_DBLESCAN;
++	}
++
++	/* Disable refresh rates > defined threshold (default 85Hz) as limited
++	 * gain from them
++	 */
++	if (drm_mode_vrefresh(mode) > fkms_max_refresh_rate)
++		return MODE_BAD_VVALUE;
++
++	/* Limit the pixel clock based on the HDMI clock limits from the
++	 * firmware
++	 */
++	switch (vc4_crtc->display_number) {
++	case 2:	/* HDMI0 */
++		if (fkms->cfg.max_pixel_clock[0] &&
++		    mode->clock > fkms->cfg.max_pixel_clock[0])
++			return MODE_CLOCK_HIGH;
++		break;
++	case 7:	/* HDMI1 */
++		if (fkms->cfg.max_pixel_clock[1] &&
++		    mode->clock > fkms->cfg.max_pixel_clock[1])
++			return MODE_CLOCK_HIGH;
++		break;
++	}
++
++	/* Pi4 can't generate odd horizontal timings on HDMI, so reject modes
++	 * that would set them.
++	 */
++	if (fkms->bcm2711 &&
++	    (vc4_crtc->display_number == 2 || vc4_crtc->display_number == 7) &&
++	    !(mode->flags & DRM_MODE_FLAG_DBLCLK) &&
++	    ((mode->hdisplay |				/* active */
++	      (mode->hsync_start - mode->hdisplay) |	/* front porch */
++	      (mode->hsync_end - mode->hsync_start) |	/* sync pulse */
++	      (mode->htotal - mode->hsync_end)) & 1))	/* back porch */ {
++		DRM_DEBUG_KMS("[CRTC:%d] Odd timing rejected %u %u %u %u.\n",
++			      crtc->base.id, mode->hdisplay, mode->hsync_start,
++			      mode->hsync_end, mode->htotal);
++		return MODE_H_ILLEGAL;
++	}
++
++	return MODE_OK;
++}
++
++static int vc4_crtc_atomic_check(struct drm_crtc *crtc,
++				 struct drm_atomic_state *state)
++{
++	struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state,
++									  crtc);
++	struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(crtc_state);
++	struct drm_connector *conn;
++	struct drm_connector_state *conn_state;
++	int i;
++
++	DRM_DEBUG_KMS("[CRTC:%d] crtc_atomic_check.\n", crtc->base.id);
++
++	for_each_new_connector_in_state(crtc_state->state, conn, conn_state, i) {
++		if (conn_state->crtc != crtc)
++			continue;
++
++		vc4_state->margins.left = conn_state->tv.margins.left;
++		vc4_state->margins.right = conn_state->tv.margins.right;
++		vc4_state->margins.top = conn_state->tv.margins.top;
++		vc4_state->margins.bottom = conn_state->tv.margins.bottom;
++		break;
++	}
++	return 0;
++}
++
++static void vc4_crtc_atomic_flush(struct drm_crtc *crtc,
++				  struct drm_atomic_state *state)
++{
++	struct drm_crtc_state *old_state = drm_atomic_get_old_crtc_state(state,
++									 crtc);
++
++	DRM_DEBUG_KMS("[CRTC:%d] crtc_atomic_flush.\n",
++		      crtc->base.id);
++	if (crtc->state->active && old_state->active && crtc->state->event)
++		vc4_crtc_consume_event(crtc);
++}
++
++static void vc4_crtc_handle_page_flip(struct vc4_crtc *vc4_crtc)
++{
++	struct drm_crtc *crtc = &vc4_crtc->base;
++	struct drm_device *dev = crtc->dev;
++	unsigned long flags;
++
++	spin_lock_irqsave(&dev->event_lock, flags);
++	if (vc4_crtc->event) {
++		drm_crtc_send_vblank_event(crtc, vc4_crtc->event);
++		vc4_crtc->event = NULL;
++		drm_crtc_vblank_put(crtc);
++	}
++	spin_unlock_irqrestore(&dev->event_lock, flags);
++}
++
++static irqreturn_t vc4_crtc_irq_handler(int irq, void *data)
++{
++	struct vc4_crtc **crtc_list = data;
++	int i;
++	u32 stat = readl(crtc_list[0]->regs + SMICS);
++	irqreturn_t ret = IRQ_NONE;
++	u32 chan;
++
++	if (stat & SMICS_INTERRUPTS) {
++		writel(0, crtc_list[0]->regs + SMICS);
++
++		chan = readl(crtc_list[0]->regs + SMIDSW0);
++
++		if ((chan & 0xFFFF0000) != SMI_NEW) {
++			/* Older firmware. Treat the one interrupt as vblank/
++			 * complete for all crtcs.
++			 */
++			for (i = 0; crtc_list[i]; i++) {
++				if (crtc_list[i]->vblank_enabled)
++					drm_crtc_handle_vblank(&crtc_list[i]->base);
++				vc4_crtc_handle_page_flip(crtc_list[i]);
++			}
++		} else {
++			if (chan & 1) {
++				writel(SMI_NEW, crtc_list[0]->regs + SMIDSW0);
++				if (crtc_list[0]->vblank_enabled)
++					drm_crtc_handle_vblank(&crtc_list[0]->base);
++				vc4_crtc_handle_page_flip(crtc_list[0]);
++			}
++
++			if (crtc_list[1]) {
++				/* Check for the secondary display too */
++				chan = readl(crtc_list[0]->regs + SMIDSW1);
++
++				if (chan & 1) {
++					writel(SMI_NEW, crtc_list[0]->regs + SMIDSW1);
++
++					if (crtc_list[1]->vblank_enabled)
++						drm_crtc_handle_vblank(&crtc_list[1]->base);
++					vc4_crtc_handle_page_flip(crtc_list[1]);
++				}
++			}
++		}
++
++		ret = IRQ_HANDLED;
++	}
++
++	return ret;
++}
++
++static int vc4_fkms_page_flip(struct drm_crtc *crtc,
++			      struct drm_framebuffer *fb,
++			      struct drm_pending_vblank_event *event,
++			      uint32_t flags,
++			      struct drm_modeset_acquire_ctx *ctx)
++{
++	if (flags & DRM_MODE_PAGE_FLIP_ASYNC) {
++		DRM_ERROR("Async flips aren't allowed\n");
++		return -EINVAL;
++	}
++
++	return drm_atomic_helper_page_flip(crtc, fb, event, flags, ctx);
++}
++
++static struct drm_crtc_state *
++vc4_fkms_crtc_duplicate_state(struct drm_crtc *crtc)
++{
++	struct vc4_crtc_state *vc4_state, *old_vc4_state;
++
++	vc4_state = kzalloc(sizeof(*vc4_state), GFP_KERNEL);
++	if (!vc4_state)
++		return NULL;
++
++	old_vc4_state = to_vc4_crtc_state(crtc->state);
++	vc4_state->margins = old_vc4_state->margins;
++
++	__drm_atomic_helper_crtc_duplicate_state(crtc, &vc4_state->base);
++	return &vc4_state->base;
++}
++
++static void
++vc4_fkms_crtc_reset(struct drm_crtc *crtc)
++{
++	if (crtc->state)
++		__drm_atomic_helper_crtc_destroy_state(crtc->state);
++
++	crtc->state = kzalloc(sizeof(*crtc->state), GFP_KERNEL);
++	if (crtc->state)
++		crtc->state->crtc = crtc;
++}
++
++static int vc4_fkms_enable_vblank(struct drm_crtc *crtc)
++{
++	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
++
++	DRM_DEBUG_KMS("[CRTC:%d] enable_vblank.\n",
++		      crtc->base.id);
++	vc4_crtc->vblank_enabled = true;
++
++	return 0;
++}
++
++static void vc4_fkms_disable_vblank(struct drm_crtc *crtc)
++{
++	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
++
++	DRM_DEBUG_KMS("[CRTC:%d] disable_vblank.\n",
++		      crtc->base.id);
++	vc4_crtc->vblank_enabled = false;
++}
++
++static const struct drm_crtc_funcs vc4_crtc_funcs = {
++	.set_config = drm_atomic_helper_set_config,
++	.destroy = drm_crtc_cleanup,
++	.page_flip = vc4_fkms_page_flip,
++	.set_property = NULL,
++	.cursor_set = NULL, /* handled by drm_mode_cursor_universal */
++	.cursor_move = NULL, /* handled by drm_mode_cursor_universal */
++	.reset = vc4_fkms_crtc_reset,
++	.atomic_duplicate_state = vc4_fkms_crtc_duplicate_state,
++	.atomic_destroy_state = drm_atomic_helper_crtc_destroy_state,
++	.enable_vblank = vc4_fkms_enable_vblank,
++	.disable_vblank = vc4_fkms_disable_vblank,
++};
++
++static const struct drm_crtc_helper_funcs vc4_crtc_helper_funcs = {
++	.mode_set_nofb = vc4_crtc_mode_set_nofb,
++	.mode_valid = vc4_crtc_mode_valid,
++	.atomic_check = vc4_crtc_atomic_check,
++	.atomic_flush = vc4_crtc_atomic_flush,
++	.atomic_enable = vc4_crtc_enable,
++	.atomic_disable = vc4_crtc_disable,
++};
++
++static const struct of_device_id vc4_firmware_kms_dt_match[] = {
++	{ .compatible = "raspberrypi,rpi-firmware-kms" },
++	{ .compatible = "raspberrypi,rpi-firmware-kms-2711",
++	  .data = (void *)1 },
++	{}
++};
++
++static enum drm_connector_status
++vc4_fkms_connector_detect(struct drm_connector *connector, bool force)
++{
++	DRM_DEBUG_KMS("connector detect.\n");
++	return connector_status_connected;
++}
++
++/* Queries the firmware to populate a drm_mode structure for this display */
++static int vc4_fkms_get_fw_mode(struct vc4_fkms_connector *fkms_connector,
++				struct drm_display_mode *mode)
++{
++	struct vc4_dev *vc4 = fkms_connector->vc4_dev;
++	struct set_timings timings = { 0 };
++	int ret;
++
++	timings.display = fkms_connector->display_number;
++
++	ret = rpi_firmware_property(vc4->firmware,
++				    RPI_FIRMWARE_GET_DISPLAY_TIMING, &timings,
++				    sizeof(timings));
++	if (ret || !timings.clock)
++		/* No mode returned - abort */
++		return -1;
++
++	/* Equivalent to DRM_MODE macro. */
++	memset(mode, 0, sizeof(*mode));
++	strncpy(mode->name, "FIXED_MODE", sizeof(mode->name));
++	mode->status = 0;
++	mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
++	mode->clock = timings.clock;
++	mode->hdisplay = timings.hdisplay;
++	mode->hsync_start = timings.hsync_start;
++	mode->hsync_end = timings.hsync_end;
++	mode->htotal = timings.htotal;
++	mode->hskew = 0;
++	mode->vdisplay = timings.vdisplay;
++	mode->vsync_start = timings.vsync_start;
++	mode->vsync_end = timings.vsync_end;
++	mode->vtotal = timings.vtotal;
++	mode->vscan = timings.vscan;
++
++	if (timings.flags & TIMINGS_FLAGS_H_SYNC_POS)
++		mode->flags |= DRM_MODE_FLAG_PHSYNC;
++	else
++		mode->flags |= DRM_MODE_FLAG_NHSYNC;
++
++	if (timings.flags & TIMINGS_FLAGS_V_SYNC_POS)
++		mode->flags |= DRM_MODE_FLAG_PVSYNC;
++	else
++		mode->flags |= DRM_MODE_FLAG_NVSYNC;
++
++	if (timings.flags & TIMINGS_FLAGS_INTERLACE)
++		mode->flags |= DRM_MODE_FLAG_INTERLACE;
++
++	return 0;
++}
++
++static int vc4_fkms_get_edid_block(void *data, u8 *buf, unsigned int block,
++				   size_t len)
++{
++	struct vc4_fkms_connector *fkms_connector =
++					(struct vc4_fkms_connector *)data;
++	struct vc4_dev *vc4 = fkms_connector->vc4_dev;
++	struct mailbox_get_edid mb = {
++		.tag1 = { RPI_FIRMWARE_GET_EDID_BLOCK_DISPLAY,
++			  128 + 8, 0 },
++		.block = block,
++		.display_number = fkms_connector->display_number,
++	};
++	int ret = 0;
++
++	ret = rpi_firmware_property_list(vc4->firmware, &mb, sizeof(mb));
++
++	if (!ret)
++		memcpy(buf, mb.edid, len);
++
++	return ret;
++}
++
++static int vc4_fkms_connector_get_modes(struct drm_connector *connector)
++{
++	struct vc4_fkms_connector *fkms_connector =
++					to_vc4_fkms_connector(connector);
++	struct drm_encoder *encoder = fkms_connector->encoder;
++	struct vc4_fkms_encoder *vc4_encoder = to_vc4_fkms_encoder(encoder);
++	struct drm_display_mode fw_mode;
++	struct drm_display_mode *mode;
++	struct edid *edid;
++	int num_modes;
++
++	if (!vc4_fkms_get_fw_mode(fkms_connector, &fw_mode)) {
++		drm_mode_debug_printmodeline(&fw_mode);
++		mode = drm_mode_duplicate(connector->dev,
++					  &fw_mode);
++		drm_mode_probed_add(connector, mode);
++		num_modes = 1;	/* 1 mode */
++	} else {
++		edid = drm_do_get_edid(connector, vc4_fkms_get_edid_block,
++				       fkms_connector);
++
++		/* FIXME: Can we do CEC?
++		 * cec_s_phys_addr_from_edid(vc4->hdmi->cec_adap, edid);
++		 * if (!edid)
++		 *	return -ENODEV;
++		 */
++
++		vc4_encoder->hdmi_monitor = drm_detect_hdmi_monitor(edid);
++
++		drm_connector_update_edid_property(connector, edid);
++		num_modes = drm_add_edid_modes(connector, edid);
++		kfree(edid);
++	}
++
++	return num_modes;
++}
++
++/* This is the DSI panel resolution. Use this as a default should the firmware
++ * not respond to our request for the timings.
++ */
++static const struct drm_display_mode lcd_mode = {
++	DRM_MODE("800x480", DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED,
++		 25979400 / 1000,
++		 800, 800 + 1, 800 + 1 + 2, 800 + 1 + 2 + 46, 0,
++		 480, 480 + 7, 480 + 7 + 2, 480 + 7 + 2 + 21, 0,
++		 0)
++};
++
++static int vc4_fkms_lcd_connector_get_modes(struct drm_connector *connector)
++{
++	struct vc4_fkms_connector *fkms_connector =
++					to_vc4_fkms_connector(connector);
++	struct drm_display_mode *mode;
++	struct drm_display_mode fw_mode;
++
++	if (!vc4_fkms_get_fw_mode(fkms_connector, &fw_mode) && fw_mode.clock)
++		mode = drm_mode_duplicate(connector->dev,
++					  &fw_mode);
++	else
++		mode = drm_mode_duplicate(connector->dev,
++					  &lcd_mode);
++
++	if (!mode) {
++		DRM_ERROR("Failed to create a new display mode\n");
++		return -ENOMEM;
++	}
++
++	drm_mode_probed_add(connector, mode);
++
++	/* We have one mode */
++	return 1;
++}
++
++static struct drm_encoder *
++vc4_fkms_connector_best_encoder(struct drm_connector *connector)
++{
++	struct vc4_fkms_connector *fkms_connector =
++		to_vc4_fkms_connector(connector);
++	DRM_DEBUG_KMS("best_connector.\n");
++	return fkms_connector->encoder;
++}
++
++static void vc4_fkms_connector_destroy(struct drm_connector *connector)
++{
++	DRM_DEBUG_KMS("[CONNECTOR:%d] destroy.\n",
++		      connector->base.id);
++	drm_connector_unregister(connector);
++	drm_connector_cleanup(connector);
++}
++
++/**
++ * vc4_connector_duplicate_state - duplicate connector state
++ * @connector: digital connector
++ *
++ * Allocates and returns a copy of the connector state (both common and
++ * digital connector specific) for the specified connector.
++ *
++ * Returns: The newly allocated connector state, or NULL on failure.
++ */
++struct drm_connector_state *
++vc4_connector_duplicate_state(struct drm_connector *connector)
++{
++	struct vc4_fkms_connector_state *state;
++
++	state = kmemdup(connector->state, sizeof(*state), GFP_KERNEL);
++	if (!state)
++		return NULL;
++
++	__drm_atomic_helper_connector_duplicate_state(connector, &state->base);
++	return &state->base;
++}
++
++/**
++ * vc4_connector_atomic_get_property - hook for connector->atomic_get_property.
++ * @connector: Connector to get the property for.
++ * @state: Connector state to retrieve the property from.
++ * @property: Property to retrieve.
++ * @val: Return value for the property.
++ *
++ * Returns the atomic property value for a digital connector.
++ */
++int vc4_connector_atomic_get_property(struct drm_connector *connector,
++				      const struct drm_connector_state *state,
++				      struct drm_property *property,
++				      uint64_t *val)
++{
++	struct vc4_fkms_connector *fkms_connector =
++					to_vc4_fkms_connector(connector);
++	struct vc4_fkms_connector_state *vc4_conn_state =
++					to_vc4_fkms_connector_state(state);
++
++	if (property == fkms_connector->broadcast_rgb_property) {
++		*val = vc4_conn_state->broadcast_rgb;
++	} else {
++		DRM_DEBUG_ATOMIC("Unknown property [PROP:%d:%s]\n",
++				 property->base.id, property->name);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/**
++ * vc4_connector_atomic_set_property - hook for connector->atomic_set_property.
++ * @connector: Connector to set the property for.
++ * @state: Connector state to set the property on.
++ * @property: Property to set.
++ * @val: New value for the property.
++ *
++ * Sets the atomic property value for a digital connector.
++ */
++int vc4_connector_atomic_set_property(struct drm_connector *connector,
++				      struct drm_connector_state *state,
++				      struct drm_property *property,
++				      uint64_t val)
++{
++	struct vc4_fkms_connector *fkms_connector =
++					to_vc4_fkms_connector(connector);
++	struct vc4_fkms_connector_state *vc4_conn_state =
++					to_vc4_fkms_connector_state(state);
++
++	if (property == fkms_connector->broadcast_rgb_property) {
++		vc4_conn_state->broadcast_rgb = val;
++		return 0;
++	}
++
++	DRM_DEBUG_ATOMIC("Unknown property [PROP:%d:%s]\n",
++			 property->base.id, property->name);
++	return -EINVAL;
++}
++
++int vc4_connector_atomic_check(struct drm_connector *connector,
++			       struct drm_atomic_state *state)
++{
++	struct drm_connector_state *old_state =
++		drm_atomic_get_old_connector_state(state, connector);
++	struct vc4_fkms_connector_state *vc4_old_state =
++					to_vc4_fkms_connector_state(old_state);
++	struct drm_connector_state *new_state =
++		drm_atomic_get_new_connector_state(state, connector);
++	struct vc4_fkms_connector_state *vc4_new_state =
++					to_vc4_fkms_connector_state(new_state);
++	struct drm_crtc *crtc = new_state->crtc;
++
++	if (!crtc)
++		return 0;
++
++	if (vc4_old_state->broadcast_rgb != vc4_new_state->broadcast_rgb) {
++		struct drm_crtc_state *crtc_state;
++
++		crtc_state = drm_atomic_get_crtc_state(state, crtc);
++		if (IS_ERR(crtc_state))
++			return PTR_ERR(crtc_state);
++
++		crtc_state->mode_changed = true;
++	}
++	return 0;
++}
++
++static void vc4_hdmi_connector_reset(struct drm_connector *connector)
++{
++	drm_atomic_helper_connector_reset(connector);
++	drm_atomic_helper_connector_tv_reset(connector);
++}
++
++static const struct drm_connector_funcs vc4_fkms_connector_funcs = {
++	.detect = vc4_fkms_connector_detect,
++	.fill_modes = drm_helper_probe_single_connector_modes,
++	.destroy = vc4_fkms_connector_destroy,
++	.reset = vc4_hdmi_connector_reset,
++	.atomic_duplicate_state = vc4_connector_duplicate_state,
++	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
++	.atomic_get_property = vc4_connector_atomic_get_property,
++	.atomic_set_property = vc4_connector_atomic_set_property,
++};
++
++static const struct drm_connector_helper_funcs vc4_fkms_connector_helper_funcs = {
++	.get_modes = vc4_fkms_connector_get_modes,
++	.best_encoder = vc4_fkms_connector_best_encoder,
++	.atomic_check = vc4_connector_atomic_check,
++};
++
++static const struct drm_connector_helper_funcs vc4_fkms_lcd_conn_helper_funcs = {
++	.get_modes = vc4_fkms_lcd_connector_get_modes,
++	.best_encoder = vc4_fkms_connector_best_encoder,
++};
++
++static const struct drm_prop_enum_list broadcast_rgb_names[] = {
++	{ VC4_BROADCAST_RGB_AUTO, "Automatic" },
++	{ VC4_BROADCAST_RGB_FULL, "Full" },
++	{ VC4_BROADCAST_RGB_LIMITED, "Limited 16:235" },
++};
++
++static void
++vc4_attach_broadcast_rgb_property(struct vc4_fkms_connector *fkms_connector)
++{
++	struct drm_device *dev = fkms_connector->base.dev;
++	struct drm_property *prop;
++
++	prop = fkms_connector->broadcast_rgb_property;
++	if (!prop) {
++		prop = drm_property_create_enum(dev, DRM_MODE_PROP_ENUM,
++						"Broadcast RGB",
++						broadcast_rgb_names,
++						ARRAY_SIZE(broadcast_rgb_names));
++		if (!prop)
++			return;
++
++		fkms_connector->broadcast_rgb_property = prop;
++	}
++
++	drm_object_attach_property(&fkms_connector->base.base, prop, 0);
++}
++
++static struct drm_connector *
++vc4_fkms_connector_init(struct drm_device *dev, struct drm_encoder *encoder,
++			u32 display_num)
++{
++	struct drm_connector *connector = NULL;
++	struct vc4_fkms_connector *fkms_connector;
++	struct vc4_fkms_connector_state *conn_state = NULL;
++	struct vc4_dev *vc4_dev = to_vc4_dev(dev);
++	int ret = 0;
++
++	DRM_DEBUG_KMS("connector_init, display_num %u\n", display_num);
++
++	fkms_connector = devm_kzalloc(dev->dev, sizeof(*fkms_connector),
++				      GFP_KERNEL);
++	if (!fkms_connector)
++		return ERR_PTR(-ENOMEM);
++
++	/*
++	 * Allocate enough memory to hold vc4_fkms_connector_state,
++	 */
++	conn_state = kzalloc(sizeof(*conn_state), GFP_KERNEL);
++	if (!conn_state) {
++		kfree(fkms_connector);
++		return ERR_PTR(-ENOMEM);
++	}
++
++	connector = &fkms_connector->base;
++
++	fkms_connector->encoder = encoder;
++	fkms_connector->display_number = display_num;
++	fkms_connector->display_type = vc4_get_display_type(display_num);
++	fkms_connector->vc4_dev = vc4_dev;
++
++	__drm_atomic_helper_connector_reset(connector,
++					    &conn_state->base);
++
++	if (fkms_connector->display_type == DRM_MODE_ENCODER_DSI) {
++		drm_connector_init(dev, connector, &vc4_fkms_connector_funcs,
++				   DRM_MODE_CONNECTOR_DSI);
++		drm_connector_helper_add(connector,
++					 &vc4_fkms_lcd_conn_helper_funcs);
++		connector->interlace_allowed = 0;
++	} else if (fkms_connector->display_type == DRM_MODE_ENCODER_TVDAC) {
++		drm_connector_init(dev, connector, &vc4_fkms_connector_funcs,
++				   DRM_MODE_CONNECTOR_Composite);
++		drm_connector_helper_add(connector,
++					 &vc4_fkms_lcd_conn_helper_funcs);
++		connector->interlace_allowed = 1;
++	} else {
++		drm_connector_init(dev, connector, &vc4_fkms_connector_funcs,
++				   DRM_MODE_CONNECTOR_HDMIA);
++		drm_connector_helper_add(connector,
++					 &vc4_fkms_connector_helper_funcs);
++		connector->interlace_allowed = 1;
++	}
++
++	ret = drm_mode_create_tv_margin_properties(dev);
++	if (ret)
++		goto fail;
++
++	drm_connector_attach_tv_margin_properties(connector);
++
++	connector->polled = (DRM_CONNECTOR_POLL_CONNECT |
++			     DRM_CONNECTOR_POLL_DISCONNECT);
++
++	connector->doublescan_allowed = 0;
++
++	vc4_attach_broadcast_rgb_property(fkms_connector);
++
++	drm_connector_attach_encoder(connector, encoder);
++
++	return connector;
++
++ fail:
++	if (connector)
++		vc4_fkms_connector_destroy(connector);
++
++	return ERR_PTR(ret);
++}
++
++static void vc4_fkms_encoder_destroy(struct drm_encoder *encoder)
++{
++	DRM_DEBUG_KMS("Encoder_destroy\n");
++	drm_encoder_cleanup(encoder);
++}
++
++static const struct drm_encoder_funcs vc4_fkms_encoder_funcs = {
++	.destroy = vc4_fkms_encoder_destroy,
++};
++
++static void vc4_fkms_display_power(struct drm_encoder *encoder, bool power)
++{
++	struct vc4_fkms_encoder *vc4_encoder = to_vc4_fkms_encoder(encoder);
++	struct vc4_dev *vc4 = to_vc4_dev(encoder->dev);
++
++	struct mailbox_display_pwr pwr = {
++		.tag1 = {RPI_FIRMWARE_SET_DISPLAY_POWER, 8, 0, },
++		.display = vc4_encoder->display_num,
++		.state = power ? 1 : 0,
++	};
++
++	rpi_firmware_property_list(vc4->firmware, &pwr, sizeof(pwr));
++}
++
++static void vc4_fkms_encoder_enable(struct drm_encoder *encoder)
++{
++	vc4_fkms_display_power(encoder, true);
++	DRM_DEBUG_KMS("Encoder_enable\n");
++}
++
++static void vc4_fkms_encoder_disable(struct drm_encoder *encoder)
++{
++	vc4_fkms_display_power(encoder, false);
++	DRM_DEBUG_KMS("Encoder_disable\n");
++}
++
++static const struct drm_encoder_helper_funcs vc4_fkms_encoder_helper_funcs = {
++	.enable = vc4_fkms_encoder_enable,
++	.disable = vc4_fkms_encoder_disable,
++};
++
++static int vc4_fkms_create_screen(struct device *dev, struct drm_device *drm,
++				  int display_idx, int display_ref,
++				  struct vc4_crtc **ret_crtc)
++{
++	struct vc4_dev *vc4 = to_vc4_dev(drm);
++	struct vc4_crtc *vc4_crtc;
++	struct vc4_fkms_encoder *vc4_encoder;
++	struct drm_crtc *crtc;
++	struct drm_plane *destroy_plane, *temp;
++	struct mailbox_blank_display blank = {
++		.tag1 = {RPI_FIRMWARE_FRAMEBUFFER_SET_DISPLAY_NUM, 4, 0, },
++		.display = display_idx,
++		.tag2 = { RPI_FIRMWARE_FRAMEBUFFER_BLANK, 4, 0, },
++		.blank = 1,
++	};
++	struct drm_plane *planes[PLANES_PER_CRTC];
++	int ret, i;
++
++	vc4_crtc = devm_kzalloc(dev, sizeof(*vc4_crtc), GFP_KERNEL);
++	if (!vc4_crtc)
++		return -ENOMEM;
++	crtc = &vc4_crtc->base;
++
++	vc4_crtc->display_number = display_ref;
++	vc4_crtc->display_type = vc4_get_display_type(display_ref);
++
++	/* Blank the firmware provided framebuffer */
++	rpi_firmware_property_list(vc4->firmware, &blank, sizeof(blank));
++
++	for (i = 0; i < PLANES_PER_CRTC; i++) {
++		planes[i] = vc4_fkms_plane_init(drm,
++						(i == 0) ?
++						  DRM_PLANE_TYPE_PRIMARY :
++						  (i == PLANES_PER_CRTC - 1) ?
++							DRM_PLANE_TYPE_CURSOR :
++							DRM_PLANE_TYPE_OVERLAY,
++						display_ref,
++						i + (display_idx * PLANES_PER_CRTC)
++					       );
++		if (IS_ERR(planes[i])) {
++			dev_err(dev, "failed to construct plane %u\n", i);
++			ret = PTR_ERR(planes[i]);
++			goto err;
++		}
++	}
++
++	drm_crtc_init_with_planes(drm, crtc, planes[0],
++				  planes[PLANES_PER_CRTC - 1], &vc4_crtc_funcs,
++				  NULL);
++	drm_crtc_helper_add(crtc, &vc4_crtc_helper_funcs);
++
++	/* Update the possible_crtcs mask for the overlay plane(s) */
++	for (i = 1; i < (PLANES_PER_CRTC - 1); i++)
++		planes[i]->possible_crtcs = drm_crtc_mask(crtc);
++
++	vc4_encoder = devm_kzalloc(dev, sizeof(*vc4_encoder), GFP_KERNEL);
++	if (!vc4_encoder)
++		return -ENOMEM;
++	vc4_crtc->encoder = &vc4_encoder->base;
++
++	vc4_encoder->display_num = display_ref;
++	vc4_encoder->base.possible_crtcs |= drm_crtc_mask(crtc);
++
++	drm_encoder_init(drm, &vc4_encoder->base, &vc4_fkms_encoder_funcs,
++			 vc4_crtc->display_type, NULL);
++	drm_encoder_helper_add(&vc4_encoder->base,
++			       &vc4_fkms_encoder_helper_funcs);
++
++	vc4_crtc->connector = vc4_fkms_connector_init(drm, &vc4_encoder->base,
++						      display_ref);
++	if (IS_ERR(vc4_crtc->connector)) {
++		ret = PTR_ERR(vc4_crtc->connector);
++		goto err_destroy_encoder;
++	}
++
++	*ret_crtc = vc4_crtc;
++
++	return 0;
++
++err_destroy_encoder:
++	vc4_fkms_encoder_destroy(vc4_crtc->encoder);
++	list_for_each_entry_safe(destroy_plane, temp,
++				 &drm->mode_config.plane_list, head) {
++		if (destroy_plane->possible_crtcs == 1 << drm_crtc_index(crtc))
++			destroy_plane->funcs->destroy(destroy_plane);
++	}
++err:
++	return ret;
++}
++
++static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
++{
++	struct platform_device *pdev = to_platform_device(dev);
++	struct drm_device *drm = dev_get_drvdata(master);
++	struct vc4_dev *vc4 = to_vc4_dev(drm);
++	struct device_node *firmware_node;
++	const struct of_device_id *match;
++	struct vc4_crtc **crtc_list;
++	u32 num_displays, display_num;
++	struct vc4_fkms *fkms;
++	int ret;
++	u32 display_id;
++
++	vc4->firmware_kms = true;
++
++	fkms = devm_kzalloc(dev, sizeof(*fkms), GFP_KERNEL);
++	if (!fkms)
++		return -ENOMEM;
++
++	match = of_match_device(vc4_firmware_kms_dt_match, dev);
++	if (!match)
++		return -ENODEV;
++	if (match->data)
++		fkms->bcm2711 = true;
++
++	firmware_node = of_parse_phandle(dev->of_node, "brcm,firmware", 0);
++	vc4->firmware = devm_rpi_firmware_get(&pdev->dev, firmware_node);
++	if (!vc4->firmware) {
++		DRM_DEBUG("Failed to get Raspberry Pi firmware reference.\n");
++		return -EPROBE_DEFER;
++	}
++	of_node_put(firmware_node);
++
++	ret = rpi_firmware_property(vc4->firmware,
++				    RPI_FIRMWARE_FRAMEBUFFER_GET_NUM_DISPLAYS,
++				    &num_displays, sizeof(u32));
++
++	/* If we fail to get the number of displays, then
++	 * assume old firmware that doesn't have the mailbox call, so just
++	 * set one display
++	 */
++	if (ret) {
++		num_displays = 1;
++		DRM_WARN("Unable to determine number of displays - assuming 1\n");
++		ret = 0;
++	}
++
++	ret = rpi_firmware_property(vc4->firmware,
++				    RPI_FIRMWARE_GET_DISPLAY_CFG,
++				    &fkms->cfg, sizeof(fkms->cfg));
++
++	if (ret)
++		return -EINVAL;
++	/* The firmware works in Hz. This will be compared against kHz, so div
++	 * 1000 now rather than multiple times later.
++	 */
++	fkms->cfg.max_pixel_clock[0] /= 1000;
++	fkms->cfg.max_pixel_clock[1] /= 1000;
++
++	/* Allocate a list, with space for a NULL on the end */
++	crtc_list = devm_kzalloc(dev, sizeof(crtc_list) * (num_displays + 1),
++				 GFP_KERNEL);
++	if (!crtc_list)
++		return -ENOMEM;
++
++	for (display_num = 0; display_num < num_displays; display_num++) {
++		display_id = display_num;
++		ret = rpi_firmware_property(vc4->firmware,
++					    RPI_FIRMWARE_FRAMEBUFFER_GET_DISPLAY_ID,
++					    &display_id, sizeof(display_id));
++		/* FIXME: Determine the correct error handling here.
++		 * Should we fail to create the one "screen" but keep the
++		 * others, or fail the whole thing?
++		 */
++		if (ret)
++			DRM_ERROR("Failed to get display id %u\n", display_num);
++
++		ret = vc4_fkms_create_screen(dev, drm, display_num, display_id,
++					     &crtc_list[display_num]);
++		if (ret)
++			DRM_ERROR("Oh dear, failed to create display %u\n",
++				  display_num);
++	}
++
++	if (num_displays > 0) {
++		/* Map the SMI interrupt reg */
++		crtc_list[0]->regs = vc4_ioremap_regs(pdev, 0);
++		if (IS_ERR(crtc_list[0]->regs))
++			DRM_ERROR("Oh dear, failed to map registers\n");
++
++		writel(0, crtc_list[0]->regs + SMICS);
++		ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
++				       vc4_crtc_irq_handler, 0,
++				       "vc4 firmware kms", crtc_list);
++		if (ret)
++			DRM_ERROR("Oh dear, failed to register IRQ\n");
++	} else {
++		DRM_WARN("No displays found. Consider forcing hotplug if HDMI is attached\n");
++	}
++
++	vc4->fkms = fkms;
++
++	platform_set_drvdata(pdev, crtc_list);
++
++	return 0;
++}
++
++static void vc4_fkms_unbind(struct device *dev, struct device *master,
++			    void *data)
++{
++	struct platform_device *pdev = to_platform_device(dev);
++	struct vc4_crtc **crtc_list = dev_get_drvdata(dev);
++	int i;
++
++	for (i = 0; crtc_list[i]; i++) {
++		vc4_fkms_connector_destroy(crtc_list[i]->connector);
++		vc4_fkms_encoder_destroy(crtc_list[i]->encoder);
++		drm_crtc_cleanup(&crtc_list[i]->base);
++	}
++
++	platform_set_drvdata(pdev, NULL);
++}
++
++static const struct component_ops vc4_fkms_ops = {
++	.bind   = vc4_fkms_bind,
++	.unbind = vc4_fkms_unbind,
++};
++
++static int vc4_fkms_probe(struct platform_device *pdev)
++{
++	return component_add(&pdev->dev, &vc4_fkms_ops);
++}
++
++static int vc4_fkms_remove(struct platform_device *pdev)
++{
++	component_del(&pdev->dev, &vc4_fkms_ops);
++	return 0;
++}
++
++struct platform_driver vc4_firmware_kms_driver = {
++	.probe = vc4_fkms_probe,
++	.remove = vc4_fkms_remove,
++	.driver = {
++		.name = "vc4_firmware_kms",
++		.of_match_table = vc4_firmware_kms_dt_match,
++	},
++};
+--- a/drivers/gpu/drm/vc4/vc4_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_kms.c
+@@ -162,6 +162,9 @@ vc4_ctm_commit(struct vc4_dev *vc4, stru
+ 	struct vc4_ctm_state *ctm_state = to_vc4_ctm_state(vc4->ctm_manager.state);
+ 	struct drm_color_ctm *ctm = ctm_state->ctm;
+ 
++	if (vc4->firmware_kms)
++		return;
++
+ 	if (ctm_state->fifo) {
+ 		HVS_WRITE(SCALER_OLEDCOEF2,
+ 			  VC4_SET_FIELD(vc4_ctm_s31_32_to_s0_9(ctm->matrix[0]),
+@@ -367,7 +370,7 @@ static void vc4_atomic_commit_tail(struc
+ 	for_each_new_crtc_in_state(state, crtc, new_crtc_state, i) {
+ 		struct vc4_crtc_state *vc4_crtc_state;
+ 
+-		if (!new_crtc_state->commit)
++		if (!new_crtc_state->commit || vc4->firmware_kms)
+ 			continue;
+ 
+ 		vc4_crtc_state = to_vc4_crtc_state(new_crtc_state);
+@@ -393,7 +396,7 @@ static void vc4_atomic_commit_tail(struc
+ 		old_hvs_state->fifo_state[channel].pending_commit = NULL;
+ 	}
+ 
+-	if (vc4->is_vc5) {
++	if (vc4->is_vc5 && !vc4->firmware_kms) {
+ 		unsigned long state_rate = max(old_hvs_state->core_clock_rate,
+ 					       new_hvs_state->core_clock_rate);
+ 		unsigned long core_rate = max_t(unsigned long,
+@@ -412,10 +415,12 @@ static void vc4_atomic_commit_tail(struc
+ 
+ 	vc4_ctm_commit(vc4, state);
+ 
+-	if (vc4->is_vc5)
+-		vc5_hvs_pv_muxing_commit(vc4, state);
+-	else
+-		vc4_hvs_pv_muxing_commit(vc4, state);
++	if (!vc4->firmware_kms) {
++		if (vc4->is_vc5)
++			vc5_hvs_pv_muxing_commit(vc4, state);
++		else
++			vc4_hvs_pv_muxing_commit(vc4, state);
++	}
+ 
+ 	drm_atomic_helper_commit_planes(dev, state,
+ 					DRM_PLANE_COMMIT_ACTIVE_ONLY);
+@@ -430,7 +435,7 @@ static void vc4_atomic_commit_tail(struc
+ 
+ 	drm_atomic_helper_cleanup_planes(dev, state);
+ 
+-	if (vc4->is_vc5) {
++	if (vc4->is_vc5 && !vc4->firmware_kms) {
+ 		drm_dbg(dev, "Running the core clock at %lu Hz\n",
+ 			new_hvs_state->core_clock_rate);
+ 
+@@ -447,11 +452,21 @@ static void vc4_atomic_commit_tail(struc
+ 
+ static int vc4_atomic_commit_setup(struct drm_atomic_state *state)
+ {
++	struct drm_device *dev = state->dev;
++	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 	struct drm_crtc_state *crtc_state;
+ 	struct vc4_hvs_state *hvs_state;
+ 	struct drm_crtc *crtc;
+ 	unsigned int i;
+ 
++	/* We know for sure we don't want an async update here. Set
++	 * state->legacy_cursor_update to false to prevent
++	 * drm_atomic_helper_setup_commit() from auto-completing
++	 * commit->flip_done.
++	 */
++	if (!vc4->firmware_kms)
++		state->legacy_cursor_update = false;
++
+ 	hvs_state = vc4_hvs_get_new_global_state(state);
+ 	if (WARN_ON(IS_ERR(hvs_state)))
+ 		return PTR_ERR(hvs_state);
+@@ -806,6 +821,7 @@ static int vc4_hvs_channels_obj_init(str
+ static int vc4_pv_muxing_atomic_check(struct drm_device *dev,
+ 				      struct drm_atomic_state *state)
+ {
++	struct vc4_dev *vc4 = to_vc4_dev(state->dev);
+ 	struct vc4_hvs_state *hvs_new_state;
+ 	struct drm_crtc_state *old_crtc_state, *new_crtc_state;
+ 	struct drm_crtc *crtc;
+@@ -829,6 +845,9 @@ static int vc4_pv_muxing_atomic_check(st
+ 		unsigned int matching_channels;
+ 		unsigned int channel;
+ 
++		if (vc4->firmware_kms)
++			continue;
++
+ 		drm_dbg(dev, "%s: Trying to find a channel.\n", crtc->name);
+ 
+ 		/* Nothing to do here, let's skip it */
+@@ -1047,6 +1066,8 @@ int vc4_kms_load(struct drm_device *dev)
+ 	dev->mode_config.helper_private = &vc4_mode_config_helpers;
+ 	dev->mode_config.preferred_depth = 24;
+ 	dev->mode_config.async_page_flip = true;
++	if (vc4->firmware_kms)
++		dev->mode_config.normalize_zpos = true;
+ 
+ 	ret = vc4_ctm_obj_init(vc4);
+ 	if (ret)
+--- /dev/null
++++ b/drivers/gpu/drm/vc4/vc_image_types.h
+@@ -0,0 +1,175 @@
++
++/*
++ * Copyright (c) 2012, Broadcom Europe Ltd
++ *
++ * Values taken from vc_image_types.h released by Broadcom at
++ * https://github.com/raspberrypi/userland/blob/master/interface/vctypes/vc_image_types.h
++ * and vc_image_structs.h at
++ * https://github.com/raspberrypi/userland/blob/master/interface/vctypes/vc_image_structs.h
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++enum {
++	VC_IMAGE_MIN = 0, //bounds for error checking
++
++	VC_IMAGE_RGB565 = 1,
++	VC_IMAGE_1BPP,
++	VC_IMAGE_YUV420,
++	VC_IMAGE_48BPP,
++	VC_IMAGE_RGB888,
++	VC_IMAGE_8BPP,
++	/* 4bpp palettised image */
++	VC_IMAGE_4BPP,
++	/* A separated format of 16 colour/light shorts followed by 16 z
++	 * values
++	 */
++	VC_IMAGE_3D32,
++	/* 16 colours followed by 16 z values */
++	VC_IMAGE_3D32B,
++	/* A separated format of 16 material/colour/light shorts followed by
++	 * 16 z values
++	 */
++	VC_IMAGE_3D32MAT,
++	/* 32 bit format containing 18 bits of 6.6.6 RGB, 9 bits per short */
++	VC_IMAGE_RGB2X9,
++	/* 32-bit format holding 18 bits of 6.6.6 RGB */
++	VC_IMAGE_RGB666,
++	/* 4bpp palettised image with embedded palette */
++	VC_IMAGE_PAL4_OBSOLETE,
++	/* 8bpp palettised image with embedded palette */
++	VC_IMAGE_PAL8_OBSOLETE,
++	/* RGB888 with an alpha byte after each pixel */
++	VC_IMAGE_RGBA32,
++	/* a line of Y (32-byte padded), a line of U (16-byte padded), and a
++	 * line of V (16-byte padded)
++	 */
++	VC_IMAGE_YUV422,
++	/* RGB565 with a transparent patch */
++	VC_IMAGE_RGBA565,
++	/* Compressed (4444) version of RGBA32 */
++	VC_IMAGE_RGBA16,
++	/* VCIII codec format */
++	VC_IMAGE_YUV_UV,
++	/* VCIII T-format RGBA8888 */
++	VC_IMAGE_TF_RGBA32,
++	/* VCIII T-format RGBx8888 */
++	VC_IMAGE_TF_RGBX32,
++	/* VCIII T-format float */
++	VC_IMAGE_TF_FLOAT,
++	/* VCIII T-format RGBA4444 */
++	VC_IMAGE_TF_RGBA16,
++	/* VCIII T-format RGB5551 */
++	VC_IMAGE_TF_RGBA5551,
++	/* VCIII T-format RGB565 */
++	VC_IMAGE_TF_RGB565,
++	/* VCIII T-format 8-bit luma and 8-bit alpha */
++	VC_IMAGE_TF_YA88,
++	/* VCIII T-format 8 bit generic sample */
++	VC_IMAGE_TF_BYTE,
++	/* VCIII T-format 8-bit palette */
++	VC_IMAGE_TF_PAL8,
++	/* VCIII T-format 4-bit palette */
++	VC_IMAGE_TF_PAL4,
++	/* VCIII T-format Ericsson Texture Compressed */
++	VC_IMAGE_TF_ETC1,
++	/* RGB888 with R & B swapped */
++	VC_IMAGE_BGR888,
++	/* RGB888 with R & B swapped, but with no pitch, i.e. no padding after
++	 * each row of pixels
++	 */
++	VC_IMAGE_BGR888_NP,
++	/* Bayer image, extra defines which variant is being used */
++	VC_IMAGE_BAYER,
++	/* General wrapper for codec images e.g. JPEG from camera */
++	VC_IMAGE_CODEC,
++	/* VCIII codec format */
++	VC_IMAGE_YUV_UV32,
++	/* VCIII T-format 8-bit luma */
++	VC_IMAGE_TF_Y8,
++	/* VCIII T-format 8-bit alpha */
++	VC_IMAGE_TF_A8,
++	/* VCIII T-format 16-bit generic sample */
++	VC_IMAGE_TF_SHORT,
++	/* VCIII T-format 1bpp black/white */
++	VC_IMAGE_TF_1BPP,
++	VC_IMAGE_OPENGL,
++	/* VCIII-B0 HVS YUV 4:4:4 interleaved samples */
++	VC_IMAGE_YUV444I,
++	/* Y, U, & V planes separately (VC_IMAGE_YUV422 has them interleaved on
++	 * a per line basis)
++	 */
++	VC_IMAGE_YUV422PLANAR,
++	/* 32bpp with 8bit alpha at MS byte, with R, G, B (LS byte) */
++	VC_IMAGE_ARGB8888,
++	/* 32bpp with 8bit unused at MS byte, with R, G, B (LS byte) */
++	VC_IMAGE_XRGB8888,
++
++	/* interleaved 8 bit samples of Y, U, Y, V (4 flavours) */
++	VC_IMAGE_YUV422YUYV,
++	VC_IMAGE_YUV422YVYU,
++	VC_IMAGE_YUV422UYVY,
++	VC_IMAGE_YUV422VYUY,
++
++	/* 32bpp like RGBA32 but with unused alpha */
++	VC_IMAGE_RGBX32,
++	/* 32bpp, corresponding to RGBA with unused alpha */
++	VC_IMAGE_RGBX8888,
++	/* 32bpp, corresponding to BGRA with unused alpha */
++	VC_IMAGE_BGRX8888,
++
++	/* Y as a plane, then UV byte interleaved in plane with same pitch,
++	 * half height
++	 */
++	VC_IMAGE_YUV420SP,
++
++	/* Y, U, & V planes separately 4:4:4 */
++	VC_IMAGE_YUV444PLANAR,
++
++	/* T-format 8-bit U - same as TF_Y8 buf from U plane */
++	VC_IMAGE_TF_U8,
++	/* T-format 8-bit U - same as TF_Y8 buf from V plane */
++	VC_IMAGE_TF_V8,
++
++	/* YUV4:2:0 planar, 16bit values */
++	VC_IMAGE_YUV420_16,
++	/* YUV4:2:0 codec format, 16bit values */
++	VC_IMAGE_YUV_UV_16,
++	/* YUV4:2:0 with U,V in side-by-side format */
++	VC_IMAGE_YUV420_S,
++	/* 10-bit YUV 420 column image format */
++	VC_IMAGE_YUV10COL,
++	/* 32-bpp, 10-bit R/G/B, 2-bit Alpha */
++	VC_IMAGE_RGBA1010102,
++
++	VC_IMAGE_MAX,     /* bounds for error checking */
++	VC_IMAGE_FORCE_ENUM_16BIT = 0xffff,
++};
++
++enum {
++	/* Unknown or unset - defaults to BT601 interstitial */
++	VC_IMAGE_YUVINFO_UNSPECIFIED    = 0,
++
++	/* colour-space conversions data [4 bits] */
++
++	/* ITU-R BT.601-5 [SDTV] (compatible with VideoCore-II) */
++	VC_IMAGE_YUVINFO_CSC_ITUR_BT601      = 1,
++	/* ITU-R BT.709-3 [HDTV] */
++	VC_IMAGE_YUVINFO_CSC_ITUR_BT709      = 2,
++	/* JPEG JFIF */
++	VC_IMAGE_YUVINFO_CSC_JPEG_JFIF       = 3,
++	/* Title 47 Code of Federal Regulations (2003) 73.682 (a) (20) */
++	VC_IMAGE_YUVINFO_CSC_FCC             = 4,
++	/* Society of Motion Picture and Television Engineers 240M (1999) */
++	VC_IMAGE_YUVINFO_CSC_SMPTE_240M      = 5,
++	/* ITU-R BT.470-2 System M */
++	VC_IMAGE_YUVINFO_CSC_ITUR_BT470_2_M  = 6,
++	/* ITU-R BT.470-2 System B,G */
++	VC_IMAGE_YUVINFO_CSC_ITUR_BT470_2_BG = 7,
++	/* JPEG JFIF, but with 16..255 luma */
++	VC_IMAGE_YUVINFO_CSC_JPEG_JFIF_Y16_255 = 8,
++	/* Rec 2020 */
++	VC_IMAGE_YUVINFO_CSC_REC_2020        = 9,
++};
diff --git a/target/linux/bcm27xx/patches-6.1/950-0012-drm-vc4-Add-support-for-gamma-on-BCM2711.patch b/target/linux/bcm27xx/patches-6.1/950-0012-drm-vc4-Add-support-for-gamma-on-BCM2711.patch
new file mode 100644
index 00000000000000..1ec4c4252e1f54
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0012-drm-vc4-Add-support-for-gamma-on-BCM2711.patch
@@ -0,0 +1,276 @@
+From 387b65c16c0d763ee4610675ce61e1072fa6cd72 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 27 Apr 2021 14:24:21 +0200
+Subject: [PATCH] drm/vc4: Add support for gamma on BCM2711
+
+BCM2711 changes from a 256 entry lookup table to a 16 point
+piecewise linear function as the pipeline bitdepth has increased
+to make a LUT unwieldy.
+
+Implement a simple conversion from a 256 entry LUT that userspace
+is likely to expect to 16 evenly spread points in the PWL. This
+could be improved with curve fitting at a later date.
+
+Co-developed-by: Juerg Haefliger <juergh@canonical.com>
+Signed-off-by: Juerg Haefliger <juergh@canonical.com>
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c | 35 ++++++++++---
+ drivers/gpu/drm/vc4/vc4_drv.h  | 28 +++++++++--
+ drivers/gpu/drm/vc4/vc4_hvs.c  | 89 ++++++++++++++++++++++++++++++++--
+ drivers/gpu/drm/vc4/vc4_regs.h | 22 +++++++++
+ 4 files changed, 162 insertions(+), 12 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -1326,19 +1326,42 @@ int vc4_crtc_init(struct drm_device *drm
+ 
+ 	if (!vc4->is_vc5) {
+ 		drm_mode_crtc_set_gamma_size(crtc, ARRAY_SIZE(vc4_crtc->lut_r));
++	} else {
++		/* This is a lie for hvs5 which uses a 16 point PWL, but it
++		 * allows for something smarter than just 16 linearly spaced
++		 * segments. Conversion is done in vc5_hvs_update_gamma_lut.
++		 */
++		drm_mode_crtc_set_gamma_size(crtc, 256);
++	}
+ 
+-		drm_crtc_enable_color_mgmt(crtc, 0, false, crtc->gamma_size);
++	drm_crtc_enable_color_mgmt(crtc, 0, false, crtc->gamma_size);
+ 
++	if (!vc4->is_vc5) {
+ 		/* We support CTM, but only for one CRTC at a time. It's therefore
+ 		 * implemented as private driver state in vc4_kms, not here.
+ 		 */
+ 		drm_crtc_enable_color_mgmt(crtc, 0, true, crtc->gamma_size);
+-	}
+ 
+-	for (i = 0; i < crtc->gamma_size; i++) {
+-		vc4_crtc->lut_r[i] = i;
+-		vc4_crtc->lut_g[i] = i;
+-		vc4_crtc->lut_b[i] = i;
++		/* Initialize the VC4 gamma LUTs */
++		for (i = 0; i < crtc->gamma_size; i++) {
++			vc4_crtc->lut_r[i] = i;
++			vc4_crtc->lut_g[i] = i;
++			vc4_crtc->lut_b[i] = i;
++		}
++	} else {
++		/* Initialize the VC5 gamma PWL entries. Assume 12-bit pipeline,
++		 * evenly spread over full range.
++		 */
++		for (i = 0; i < SCALER5_DSPGAMMA_NUM_POINTS; i++) {
++			vc4_crtc->pwl_r[i] =
++				VC5_HVS_SET_GAMMA_ENTRY(i << 8, i << 12, 1 << 8);
++			vc4_crtc->pwl_g[i] =
++				VC5_HVS_SET_GAMMA_ENTRY(i << 8, i << 12, 1 << 8);
++			vc4_crtc->pwl_b[i] =
++				VC5_HVS_SET_GAMMA_ENTRY(i << 8, i << 12, 1 << 8);
++			vc4_crtc->pwl_a[i] =
++				VC5_HVS_SET_GAMMA_ENTRY(i << 8, i << 12, 1 << 8);
++		}
+ 	}
+ 
+ 	return 0;
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -20,6 +20,7 @@
+ #include <drm/drm_modeset_lock.h>
+ 
+ #include "uapi/drm/vc4_drm.h"
++#include "vc4_regs.h"
+ 
+ struct drm_device;
+ struct drm_gem_object;
+@@ -481,6 +482,17 @@ struct vc4_pv_data {
+ 	enum vc4_encoder_type encoder_types[4];
+ };
+ 
++struct vc5_gamma_entry {
++	u32 x_c_terms;
++	u32 grad_term;
++};
++
++#define VC5_HVS_SET_GAMMA_ENTRY(x, c, g) (struct vc5_gamma_entry){	\
++	.x_c_terms = VC4_SET_FIELD((x), SCALER5_DSPGAMMA_OFF_X) | 	\
++		     VC4_SET_FIELD((c), SCALER5_DSPGAMMA_OFF_C),	\
++	.grad_term = (g)						\
++}
++
+ struct vc4_crtc {
+ 	struct drm_crtc base;
+ 	struct platform_device *pdev;
+@@ -490,9 +502,19 @@ struct vc4_crtc {
+ 	/* Timestamp at start of vblank irq - unaffected by lock delays. */
+ 	ktime_t t_vblank;
+ 
+-	u8 lut_r[256];
+-	u8 lut_g[256];
+-	u8 lut_b[256];
++	union {
++		struct {  /* VC4 gamma LUT */
++			u8 lut_r[256];
++			u8 lut_g[256];
++			u8 lut_b[256];
++		};
++		struct {  /* VC5 gamma PWL entries */
++			struct vc5_gamma_entry pwl_r[SCALER5_DSPGAMMA_NUM_POINTS];
++			struct vc5_gamma_entry pwl_g[SCALER5_DSPGAMMA_NUM_POINTS];
++			struct vc5_gamma_entry pwl_b[SCALER5_DSPGAMMA_NUM_POINTS];
++			struct vc5_gamma_entry pwl_a[SCALER5_DSPGAMMA_NUM_POINTS];
++		};
++	};
+ 
+ 	struct drm_pending_vblank_event *event;
+ 
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -241,7 +241,8 @@ static void vc4_hvs_lut_load(struct vc4_
+ static void vc4_hvs_update_gamma_lut(struct vc4_hvs *hvs,
+ 				     struct vc4_crtc *vc4_crtc)
+ {
+-	struct drm_crtc_state *crtc_state = vc4_crtc->base.state;
++	struct drm_crtc *crtc = &vc4_crtc->base;
++	struct drm_crtc_state *crtc_state = crtc->state;
+ 	struct drm_color_lut *lut = crtc_state->gamma_lut->data;
+ 	u32 length = drm_color_lut_size(crtc_state->gamma_lut);
+ 	u32 i;
+@@ -255,6 +256,81 @@ static void vc4_hvs_update_gamma_lut(str
+ 	vc4_hvs_lut_load(hvs, vc4_crtc);
+ }
+ 
++static void vc5_hvs_write_gamma_entry(struct vc4_hvs *hvs,
++				      u32 offset,
++				      struct vc5_gamma_entry *gamma)
++{
++	HVS_WRITE(offset, gamma->x_c_terms);
++	HVS_WRITE(offset + 4, gamma->grad_term);
++}
++
++static void vc5_hvs_lut_load(struct vc4_hvs *hvs,
++			     struct vc4_crtc *vc4_crtc)
++{
++	struct drm_crtc *crtc = &vc4_crtc->base;
++	struct drm_crtc_state *crtc_state = crtc->state;
++	struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(crtc_state);
++	u32 i;
++	u32 offset = SCALER5_DSPGAMMA_START +
++		vc4_state->assigned_channel * SCALER5_DSPGAMMA_CHAN_OFFSET;
++
++	for (i = 0; i < SCALER5_DSPGAMMA_NUM_POINTS; i++, offset += 8)
++		vc5_hvs_write_gamma_entry(hvs, offset, &vc4_crtc->pwl_r[i]);
++	for (i = 0; i < SCALER5_DSPGAMMA_NUM_POINTS; i++, offset += 8)
++		vc5_hvs_write_gamma_entry(hvs, offset, &vc4_crtc->pwl_g[i]);
++	for (i = 0; i < SCALER5_DSPGAMMA_NUM_POINTS; i++, offset += 8)
++		vc5_hvs_write_gamma_entry(hvs, offset, &vc4_crtc->pwl_b[i]);
++
++	if (vc4_state->assigned_channel == 2) {
++		/* Alpha only valid on channel 2 */
++		for (i = 0; i < SCALER5_DSPGAMMA_NUM_POINTS; i++, offset += 8)
++			vc5_hvs_write_gamma_entry(hvs, offset, &vc4_crtc->pwl_a[i]);
++	}
++}
++
++static void vc5_hvs_update_gamma_lut(struct vc4_hvs *hvs,
++				     struct vc4_crtc *vc4_crtc)
++{
++	struct drm_crtc *crtc = &vc4_crtc->base;
++	struct drm_color_lut *lut = crtc->state->gamma_lut->data;
++	unsigned int step, i;
++	u32 start, end;
++
++#define VC5_HVS_UPDATE_GAMMA_ENTRY_FROM_LUT(pwl, chan)			\
++	start = drm_color_lut_extract(lut[i * step].chan, 12);		\
++	end = drm_color_lut_extract(lut[(i + 1) * step - 1].chan, 12);	\
++									\
++	/* Negative gradients not permitted by the hardware, so		\
++	 * flatten such points out.					\
++	 */								\
++	if (end < start)						\
++		end = start;						\
++									\
++	/* Assume 12bit pipeline.					\
++	 * X evenly spread over full range (12 bit).			\
++	 * C as U12.4 format.						\
++	 * Gradient as U4.8 format.					\
++	*/								\
++	vc4_crtc->pwl[i] =						\
++		VC5_HVS_SET_GAMMA_ENTRY(i << 8, start << 4,		\
++				((end - start) << 4) / (step - 1))
++
++	/* HVS5 has a 16 point piecewise linear function for each colour
++	 * channel (including alpha on channel 2) on each display channel.
++	 *
++	 * Currently take a crude subsample of the gamma LUT, but this could
++	 * be improved to implement curve fitting.
++	 */
++	step = crtc->gamma_size / SCALER5_DSPGAMMA_NUM_POINTS;
++	for (i = 0; i < SCALER5_DSPGAMMA_NUM_POINTS; i++) {
++		VC5_HVS_UPDATE_GAMMA_ENTRY_FROM_LUT(pwl_r, red);
++		VC5_HVS_UPDATE_GAMMA_ENTRY_FROM_LUT(pwl_g, green);
++		VC5_HVS_UPDATE_GAMMA_ENTRY_FROM_LUT(pwl_b, blue);
++	}
++
++	vc5_hvs_lut_load(hvs, vc4_crtc);
++}
++
+ u8 vc4_hvs_get_fifo_frame_count(struct vc4_hvs *hvs, unsigned int fifo)
+ {
+ 	struct drm_device *drm = &hvs->vc4->base;
+@@ -398,7 +474,10 @@ static int vc4_hvs_init_channel(struct v
+ 	/* Reload the LUT, since the SRAMs would have been disabled if
+ 	 * all CRTCs had SCALER_DISPBKGND_GAMMA unset at once.
+ 	 */
+-	vc4_hvs_lut_load(hvs, vc4_crtc);
++	if (!vc4->is_vc5)
++		vc4_hvs_lut_load(hvs, vc4_crtc);
++	else
++		vc5_hvs_lut_load(hvs, vc4_crtc);
+ 
+ 	drm_dev_exit(idx);
+ 
+@@ -628,7 +707,11 @@ void vc4_hvs_atomic_flush(struct drm_crt
+ 		u32 dispbkgndx = HVS_READ(SCALER_DISPBKGNDX(channel));
+ 
+ 		if (crtc->state->gamma_lut) {
+-			vc4_hvs_update_gamma_lut(hvs, vc4_crtc);
++			if (!vc4->is_vc5)
++				vc4_hvs_update_gamma_lut(hvs, vc4_crtc);
++			else
++				vc5_hvs_update_gamma_lut(hvs, vc4_crtc);
++
+ 			dispbkgndx |= SCALER_DISPBKGND_GAMMA;
+ 		} else {
+ 			/* Unsetting DISPBKGND_GAMMA skips the gamma lut step
+--- a/drivers/gpu/drm/vc4/vc4_regs.h
++++ b/drivers/gpu/drm/vc4/vc4_regs.h
+@@ -512,6 +512,28 @@
+ #define SCALER_DLIST_START                      0x00002000
+ #define SCALER_DLIST_SIZE                       0x00004000
+ 
++/* Gamma PWL for each channel. 16 points for each of 4 colour channels (alpha
++ * only on channel 2). 8 bytes per entry, offsets first, then gradient:
++ *   Y = GRAD * X + C
++ *
++ * Values for X and C are left justified, and vary depending on the width of
++ * the HVS channel:
++ *    8-bit pipeline: X uses [31:24], C is U8.8 format, and GRAD is U4.8.
++ *   12-bit pipeline: X uses [31:20], C is U12.4 format, and GRAD is U4.8.
++ *
++ * The 3 HVS channels start at 0x400 offsets (ie chan 1 starts at 0x2400, and
++ * chan 2 at 0x2800).
++ */
++#define SCALER5_DSPGAMMA_NUM_POINTS		16
++#define SCALER5_DSPGAMMA_START			0x00002000
++#define SCALER5_DSPGAMMA_CHAN_OFFSET		0x400
++# define SCALER5_DSPGAMMA_OFF_X_MASK		VC4_MASK(31, 20)
++# define SCALER5_DSPGAMMA_OFF_X_SHIFT		20
++# define SCALER5_DSPGAMMA_OFF_C_MASK		VC4_MASK(15, 0)
++# define SCALER5_DSPGAMMA_OFF_C_SHIFT		0
++# define SCALER5_DSPGAMMA_GRAD_MASK		VC4_MASK(11, 0)
++# define SCALER5_DSPGAMMA_GRAD_SHIFT		0
++
+ #define SCALER5_DLIST_START			0x00004000
+ 
+ # define VC4_HDMI_SW_RESET_FORMAT_DETECT	BIT(1)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0013-drm-vc4-Add-debugfs-node-that-dumps-the-vc5-gamma-PW.patch b/target/linux/bcm27xx/patches-6.1/950-0013-drm-vc4-Add-debugfs-node-that-dumps-the-vc5-gamma-PW.patch
new file mode 100644
index 00000000000000..4b4dcb64df90e6
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0013-drm-vc4-Add-debugfs-node-that-dumps-the-vc5-gamma-PW.patch
@@ -0,0 +1,122 @@
+From 3905be68859b15731ec41b3d22cd1a9069375f7f Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 28 Apr 2021 12:32:10 +0200
+Subject: [PATCH] drm/vc4: Add debugfs node that dumps the vc5 gamma
+ PWL entries
+
+This helps with debugging the conversion from a 256 point gamma LUT to
+16 point PWL entries as used by the BCM2711.
+
+Co-developed-by: Juerg Haefliger <juergh@canonical.com>
+Signed-off-by: Juerg Haefliger <juergh@canonical.com>
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 85 ++++++++++++++++++++++++++++++++++-
+ 1 file changed, 84 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -141,6 +141,85 @@ static int vc4_hvs_debugfs_dlist(struct
+ 	return 0;
+ }
+ 
++static int vc5_hvs_debugfs_gamma(struct seq_file *m, void *data)
++{
++	struct drm_info_node *node = m->private;
++	struct drm_device *dev = node->minor->dev;
++	struct vc4_dev *vc4 = to_vc4_dev(dev);
++	struct vc4_hvs *hvs = vc4->hvs;
++	struct drm_printer p = drm_seq_file_printer(m);
++	unsigned int i, chan;
++	u32 dispstat, dispbkgndx;
++
++	for (chan = 0; chan < SCALER_CHANNELS_COUNT; chan++) {
++		u32 x_c, grad;
++		u32 offset = SCALER5_DSPGAMMA_START +
++			chan * SCALER5_DSPGAMMA_CHAN_OFFSET;
++
++		dispstat = VC4_GET_FIELD(HVS_READ(SCALER_DISPSTATX(chan)),
++					 SCALER_DISPSTATX_MODE);
++		if (dispstat == SCALER_DISPSTATX_MODE_DISABLED ||
++		    dispstat == SCALER_DISPSTATX_MODE_EOF) {
++			drm_printf(&p, "HVS channel %u: Channel disabled\n", chan);
++			continue;
++		}
++
++		dispbkgndx = HVS_READ(SCALER_DISPBKGNDX(chan));
++		if (!(dispbkgndx & SCALER_DISPBKGND_GAMMA)) {
++			drm_printf(&p, "HVS channel %u: Gamma disabled\n", chan);
++			continue;
++		}
++
++		drm_printf(&p, "HVS channel %u:\n", chan);
++		drm_printf(&p, "  red:\n");
++		for (i = 0; i < SCALER5_DSPGAMMA_NUM_POINTS; i++, offset += 8) {
++			x_c = HVS_READ(offset);
++			grad = HVS_READ(offset + 4);
++			drm_printf(&p, "  %08x %08x - x %u, c %u, grad %u\n",
++				   x_c, grad,
++				   VC4_GET_FIELD(x_c, SCALER5_DSPGAMMA_OFF_X),
++				   VC4_GET_FIELD(x_c, SCALER5_DSPGAMMA_OFF_C),
++				   grad);
++		}
++		drm_printf(&p, "  green:\n");
++		for (i = 0; i < SCALER5_DSPGAMMA_NUM_POINTS; i++, offset += 8) {
++			x_c = HVS_READ(offset);
++			grad = HVS_READ(offset + 4);
++			drm_printf(&p, "  %08x %08x - x %u, c %u, grad %u\n",
++				   x_c, grad,
++				   VC4_GET_FIELD(x_c, SCALER5_DSPGAMMA_OFF_X),
++				   VC4_GET_FIELD(x_c, SCALER5_DSPGAMMA_OFF_C),
++				   grad);
++		}
++		drm_printf(&p, "  blue:\n");
++		for (i = 0; i < SCALER5_DSPGAMMA_NUM_POINTS; i++, offset += 8) {
++			x_c = HVS_READ(offset);
++			grad = HVS_READ(offset + 4);
++			drm_printf(&p, "  %08x %08x - x %u, c %u, grad %u\n",
++				   x_c, grad,
++				   VC4_GET_FIELD(x_c, SCALER5_DSPGAMMA_OFF_X),
++				   VC4_GET_FIELD(x_c, SCALER5_DSPGAMMA_OFF_C),
++				   grad);
++		}
++
++		/* Alpha only valid on channel 2 */
++		if (chan != 2)
++			continue;
++
++		drm_printf(&p, "  alpha:\n");
++		for (i = 0; i < SCALER5_DSPGAMMA_NUM_POINTS; i++, offset += 8) {
++			x_c = HVS_READ(offset);
++			grad = HVS_READ(offset + 4);
++			drm_printf(&p, "  %08x %08x - x %u, c %u, grad %u\n",
++				   x_c, grad,
++				   VC4_GET_FIELD(x_c, SCALER5_DSPGAMMA_OFF_X),
++				   VC4_GET_FIELD(x_c, SCALER5_DSPGAMMA_OFF_C),
++				   grad);
++		}
++	}
++	return 0;
++}
++
+ /* The filter kernel is composed of dwords each containing 3 9-bit
+  * signed integers packed next to each other.
+  */
+@@ -833,11 +912,15 @@ int vc4_hvs_debugfs_init(struct drm_mino
+ 	if (!vc4->hvs)
+ 		return -ENODEV;
+ 
+-	if (!vc4->is_vc5)
++	if (!vc4->is_vc5) {
+ 		debugfs_create_bool("hvs_load_tracker", S_IRUGO | S_IWUSR,
+ 				    minor->debugfs_root,
+ 				    &vc4->load_tracker_enabled);
+ 
++		vc4_debugfs_add_file(minor, "hvs_gamma", vc5_hvs_debugfs_gamma,
++				     NULL);
++	}
++
+ 	ret = vc4_debugfs_add_file(minor, "hvs_dlists",
+ 				   vc4_hvs_debugfs_dlist, NULL);
+ 	if (ret)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0014-drm-vc4-hvs-Force-modeset-on-gamma-lut-change.patch b/target/linux/bcm27xx/patches-6.1/950-0014-drm-vc4-hvs-Force-modeset-on-gamma-lut-change.patch
new file mode 100644
index 00000000000000..cb6f834861c24e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0014-drm-vc4-hvs-Force-modeset-on-gamma-lut-change.patch
@@ -0,0 +1,105 @@
+From 132865ef0ce76d66a27152eee131ba4335639df4 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 14 Jun 2021 15:28:30 +0200
+Subject: [PATCH] drm/vc4: hvs: Force modeset on gamma lut change
+
+The HVS Gamma block can only be updated when idle, so we need to disable
+the HVS channel when the gamma property is set in an atomic commit.
+
+Since the pixelvalve cannot have its assigned channel halted without
+stalling unless it's disabled as well, in our case that means forcing a
+full disable / enable cycle on the pipeline.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c | 17 +++++++++++++++++
+ drivers/gpu/drm/vc4/vc4_drv.h  |  3 +++
+ drivers/gpu/drm/vc4/vc4_hvs.c  | 32 +++++++++++++++++++++++++++++++-
+ 3 files changed, 51 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -293,6 +293,23 @@ struct drm_encoder *vc4_get_crtc_encoder
+ 	return NULL;
+ }
+ 
++#define drm_for_each_connector_mask(connector, dev, connector_mask) \
++	list_for_each_entry((connector), &(dev)->mode_config.connector_list, head) \
++		for_each_if ((connector_mask) & drm_connector_mask(connector))
++
++struct drm_connector *vc4_get_crtc_connector(struct drm_crtc *crtc,
++					     struct drm_crtc_state *state)
++{
++	struct drm_connector *connector;
++
++	WARN_ON(hweight32(state->connector_mask) > 1);
++
++	drm_for_each_connector_mask(connector, crtc->dev, state->connector_mask)
++		return connector;
++
++	return NULL;
++}
++
+ static void vc4_crtc_pixelvalve_reset(struct drm_crtc *crtc)
+ {
+ 	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -568,6 +568,9 @@ vc4_crtc_to_vc4_pv_data(const struct vc4
+ 	return container_of(data, struct vc4_pv_data, base);
+ }
+ 
++struct drm_connector *vc4_get_crtc_connector(struct drm_crtc *crtc,
++					     struct drm_crtc_state *state);
++
+ struct drm_encoder *vc4_get_crtc_encoder(struct drm_crtc *crtc,
+ 					 struct drm_crtc_state *state);
+ 
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -594,6 +594,36 @@ out:
+ 	drm_dev_exit(idx);
+ }
+ 
++static int vc4_hvs_gamma_check(struct drm_crtc *crtc,
++			       struct drm_atomic_state *state)
++{
++	struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
++	struct drm_connector_state *conn_state;
++	struct drm_connector *connector;
++	struct drm_device *dev = crtc->dev;
++	struct vc4_dev *vc4 = to_vc4_dev(dev);
++
++	if (!vc4->is_vc5)
++		return 0;
++
++	if (!crtc_state->color_mgmt_changed)
++		return 0;
++
++	connector = vc4_get_crtc_connector(crtc, crtc_state);
++	if (!connector)
++		return -EINVAL;
++
++	if (!(connector->connector_type == DRM_MODE_CONNECTOR_HDMIA))
++		return 0;
++
++	conn_state = drm_atomic_get_connector_state(state, connector);
++	if (!conn_state)
++		return -EINVAL;
++
++	crtc_state->mode_changed = true;
++	return 0;
++}
++
+ int vc4_hvs_atomic_check(struct drm_crtc *crtc, struct drm_atomic_state *state)
+ {
+ 	struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
+@@ -624,7 +654,7 @@ int vc4_hvs_atomic_check(struct drm_crtc
+ 	if (ret)
+ 		return ret;
+ 
+-	return 0;
++	return vc4_hvs_gamma_check(crtc, state);
+ }
+ 
+ static void vc4_hvs_install_dlist(struct drm_crtc *crtc)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0015-drm-vc4-Relax-VEC-modeline-requirements-and-add-prog.patch b/target/linux/bcm27xx/patches-6.1/950-0015-drm-vc4-Relax-VEC-modeline-requirements-and-add-prog.patch
new file mode 100644
index 00000000000000..9b7bc332ef8002
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0015-drm-vc4-Relax-VEC-modeline-requirements-and-add-prog.patch
@@ -0,0 +1,149 @@
+From a4614b6f6c4e3a9ef80c88f272c1503b91f7ef8c Mon Sep 17 00:00:00 2001
+From: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
+Date: Thu, 15 Jul 2021 01:08:08 +0200
+Subject: [PATCH] drm/vc4: Relax VEC modeline requirements and add
+ progressive mode support
+
+Make vc4_vec_encoder_atomic_check() accept arbitrary modelines, as long
+as they result in somewhat sane output from the VEC. The bounds have
+been determined empirically. Additionally, add support for the
+progressive 262-line and 312-line modes.
+
+Signed-off-by: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c |  1 +
+ drivers/gpu/drm/vc4/vc4_vec.c  | 94 ++++++++++++++++++++++++++++++----
+ 2 files changed, 85 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -422,6 +422,7 @@ static void vc4_crtc_config_pv(struct dr
+ 		CRTC_WRITE(PV_V_CONTROL,
+ 			   PV_VCONTROL_CONTINUOUS |
+ 			   (is_dsi ? PV_VCONTROL_DSI : 0));
++		CRTC_WRITE(PV_VSYNCD_EVEN, 0);
+ 	}
+ 
+ 	CRTC_WRITE(PV_VERTA,
+--- a/drivers/gpu/drm/vc4/vc4_vec.c
++++ b/drivers/gpu/drm/vc4/vc4_vec.c
+@@ -400,18 +400,11 @@ static int vc4_vec_connector_atomic_chec
+ 	struct drm_connector_state *new_state =
+ 		drm_atomic_get_new_connector_state(state, conn);
+ 
+-	const struct vc4_vec_tv_mode *vec_mode =
+-		&vc4_vec_tv_modes[new_state->tv.mode];
+-
+-	if (new_state->crtc) {
++	if (new_state->crtc && old_state->tv.mode != new_state->tv.mode) {
+ 		struct drm_crtc_state *crtc_state =
+ 			drm_atomic_get_new_crtc_state(state, new_state->crtc);
+ 
+-		if (!drm_mode_equal(vec_mode->mode, &crtc_state->mode))
+-			return -EINVAL;
+-
+-		if (old_state->tv.mode != new_state->tv.mode)
+-			crtc_state->mode_changed = true;
++		crtc_state->mode_changed = true;
+ 	}
+ 
+ 	return 0;
+@@ -546,7 +539,10 @@ static void vc4_vec_encoder_enable(struc
+ 	VEC_WRITE(VEC_CLMP0_START, 0xac);
+ 	VEC_WRITE(VEC_CLMP0_END, 0xec);
+ 	VEC_WRITE(VEC_CONFIG2,
+-		  VEC_CONFIG2_UV_DIG_DIS | VEC_CONFIG2_RGB_DIG_DIS);
++		  VEC_CONFIG2_UV_DIG_DIS |
++		  VEC_CONFIG2_RGB_DIG_DIS |
++		  ((encoder->crtc->state->adjusted_mode.flags &
++		    DRM_MODE_FLAG_INTERLACE) ? 0 : VEC_CONFIG2_PROG_SCAN));
+ 	VEC_WRITE(VEC_CONFIG3, VEC_CONFIG3_HORIZ_LEN_STD);
+ 	VEC_WRITE(VEC_DAC_CONFIG, vec->variant->dac_config);
+ 
+@@ -575,8 +571,86 @@ err_put_runtime_pm:
+ err_dev_exit:
+ 	drm_dev_exit(idx);
+ }
++static int vc4_vec_encoder_atomic_check(struct drm_encoder *encoder,
++					struct drm_crtc_state *crtc_state,
++					struct drm_connector_state *conn_state)
++{
++	const struct drm_display_mode *reference_mode =
++		vc4_vec_tv_modes[conn_state->tv.mode].mode;
++
++	if (crtc_state->adjusted_mode.crtc_clock != reference_mode->clock ||
++	    crtc_state->adjusted_mode.crtc_htotal != reference_mode->htotal ||
++	    crtc_state->adjusted_mode.crtc_hdisplay % 4 != 0 ||
++	    crtc_state->adjusted_mode.crtc_hsync_end -
++		    crtc_state->adjusted_mode.crtc_hsync_start < 1)
++		return -EINVAL;
++
++	switch (reference_mode->vtotal) {
++	case 525:
++		if (crtc_state->adjusted_mode.crtc_vdisplay < 1 ||
++		    crtc_state->adjusted_mode.crtc_vdisplay > 253 ||
++		    crtc_state->adjusted_mode.crtc_vsync_start -
++			    crtc_state->adjusted_mode.crtc_vdisplay < 1 ||
++		    crtc_state->adjusted_mode.crtc_vsync_end -
++			    crtc_state->adjusted_mode.crtc_vsync_start != 3 ||
++		    crtc_state->adjusted_mode.crtc_vtotal -
++			    crtc_state->adjusted_mode.crtc_vsync_end < 4 ||
++		    crtc_state->adjusted_mode.crtc_vtotal > 262)
++			return -EINVAL;
++
++		if ((crtc_state->adjusted_mode.flags &
++		     DRM_MODE_FLAG_INTERLACE) &&
++		    (crtc_state->adjusted_mode.vdisplay % 2 != 0 ||
++		     crtc_state->adjusted_mode.vsync_start % 2 != 1 ||
++		     crtc_state->adjusted_mode.vsync_end % 2 != 1 ||
++		     crtc_state->adjusted_mode.vtotal % 2 != 1))
++			return -EINVAL;
++
++		/* progressive mode is hard-wired to 262 total lines */
++		if (!(crtc_state->adjusted_mode.flags &
++		      DRM_MODE_FLAG_INTERLACE) &&
++		    crtc_state->adjusted_mode.crtc_vtotal != 262)
++			return -EINVAL;
++
++		break;
++
++	case 625:
++		if (crtc_state->adjusted_mode.crtc_vdisplay < 1 ||
++		    crtc_state->adjusted_mode.crtc_vdisplay > 305 ||
++		    crtc_state->adjusted_mode.crtc_vsync_start -
++			    crtc_state->adjusted_mode.crtc_vdisplay < 1 ||
++		    crtc_state->adjusted_mode.crtc_vsync_end -
++			    crtc_state->adjusted_mode.crtc_vsync_start != 3 ||
++		    crtc_state->adjusted_mode.crtc_vtotal -
++			    crtc_state->adjusted_mode.crtc_vsync_end < 2 ||
++		    crtc_state->adjusted_mode.crtc_vtotal > 312)
++			return -EINVAL;
++
++		if ((crtc_state->adjusted_mode.flags &
++		     DRM_MODE_FLAG_INTERLACE) &&
++		    (crtc_state->adjusted_mode.vdisplay % 2 != 0 ||
++		     crtc_state->adjusted_mode.vsync_start % 2 != 0 ||
++		     crtc_state->adjusted_mode.vsync_end % 2 != 0 ||
++		     crtc_state->adjusted_mode.vtotal % 2 != 1))
++			return -EINVAL;
++
++		/* progressive mode is hard-wired to 312 total lines */
++		if (!(crtc_state->adjusted_mode.flags &
++		      DRM_MODE_FLAG_INTERLACE) &&
++		    crtc_state->adjusted_mode.crtc_vtotal != 312)
++			return -EINVAL;
++
++		break;
++
++	default:
++		return -EINVAL;
++	}
++
++	return 0;
++}
+ 
+ static const struct drm_encoder_helper_funcs vc4_vec_encoder_helper_funcs = {
++	.atomic_check = vc4_vec_encoder_atomic_check,
+ 	.atomic_disable = vc4_vec_encoder_disable,
+ 	.atomic_enable = vc4_vec_encoder_enable,
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0016-drm-vc4-Make-VEC-progressive-modes-readily-accessibl.patch b/target/linux/bcm27xx/patches-6.1/950-0016-drm-vc4-Make-VEC-progressive-modes-readily-accessibl.patch
new file mode 100644
index 00000000000000..43eab7edda6484
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0016-drm-vc4-Make-VEC-progressive-modes-readily-accessibl.patch
@@ -0,0 +1,165 @@
+From bfd6f67af0450e29378d390386210ac91c5dcfce Mon Sep 17 00:00:00 2001
+From: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
+Date: Thu, 15 Jul 2021 01:08:11 +0200
+Subject: [PATCH] drm/vc4: Make VEC progressive modes readily
+ accessible
+
+Add predefined modelines for the 240p (NTSC) and 288p (PAL) progressive
+modes, and report them through vc4_vec_connector_get_modes().
+
+Signed-off-by: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_vec.c | 73 ++++++++++++++++++++++++++---------
+ 1 file changed, 55 insertions(+), 18 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_vec.c
++++ b/drivers/gpu/drm/vc4/vc4_vec.c
+@@ -228,7 +228,8 @@ enum vc4_vec_tv_mode_id {
+ };
+ 
+ struct vc4_vec_tv_mode {
+-	const struct drm_display_mode *mode;
++	const struct drm_display_mode *interlaced_mode;
++	const struct drm_display_mode *progressive_mode;
+ 	u32 config0;
+ 	u32 config1;
+ 	u32 custom_freq;
+@@ -262,61 +263,81 @@ static const struct debugfs_reg32 vec_re
+ };
+ 
+ static const struct drm_display_mode drm_mode_480i = {
+-	DRM_MODE("720x480", DRM_MODE_TYPE_DRIVER, 13500,
++	DRM_MODE("720x480i", DRM_MODE_TYPE_DRIVER, 13500,
+ 		 720, 720 + 14, 720 + 14 + 64, 720 + 14 + 64 + 60, 0,
+ 		 480, 480 + 7, 480 + 7 + 6, 525, 0,
+ 		 DRM_MODE_FLAG_INTERLACE)
+ };
+ 
++static const struct drm_display_mode drm_mode_240p = {
++	DRM_MODE("720x240", DRM_MODE_TYPE_DRIVER, 13500,
++		 720, 720 + 14, 720 + 14 + 64, 720 + 14 + 64 + 60, 0,
++		 240, 240 + 3, 240 + 3 + 3, 262, 0, 0)
++};
++
+ static const struct drm_display_mode drm_mode_576i = {
+-	DRM_MODE("720x576", DRM_MODE_TYPE_DRIVER, 13500,
++	DRM_MODE("720x576i", DRM_MODE_TYPE_DRIVER, 13500,
+ 		 720, 720 + 20, 720 + 20 + 64, 720 + 20 + 64 + 60, 0,
+ 		 576, 576 + 4, 576 + 4 + 6, 625, 0,
+ 		 DRM_MODE_FLAG_INTERLACE)
+ };
+ 
++static const struct drm_display_mode drm_mode_288p = {
++	DRM_MODE("720x288", DRM_MODE_TYPE_DRIVER, 13500,
++		 720, 720 + 20, 720 + 20 + 64, 720 + 20 + 64 + 60, 0,
++		 288, 288 + 2, 288 + 2 + 3, 312, 0, 0)
++};
++
+ static const struct vc4_vec_tv_mode vc4_vec_tv_modes[] = {
+ 	[VC4_VEC_TV_MODE_NTSC] = {
+-		.mode = &drm_mode_480i,
++		.interlaced_mode = &drm_mode_480i,
++		.progressive_mode = &drm_mode_240p,
+ 		.config0 = VEC_CONFIG0_NTSC_STD | VEC_CONFIG0_PDEN,
+ 		.config1 = VEC_CONFIG1_C_CVBS_CVBS,
+ 	},
+ 	[VC4_VEC_TV_MODE_NTSC_J] = {
+-		.mode = &drm_mode_480i,
++		.interlaced_mode = &drm_mode_480i,
++		.progressive_mode = &drm_mode_240p,
+ 		.config0 = VEC_CONFIG0_NTSC_STD,
+ 		.config1 = VEC_CONFIG1_C_CVBS_CVBS,
+ 	},
+ 	[VC4_VEC_TV_MODE_NTSC_443] = {
+ 		/* NTSC with PAL chroma frequency */
+-		.mode = &drm_mode_480i,
++		.interlaced_mode = &drm_mode_480i,
++		.progressive_mode = &drm_mode_240p,
+ 		.config0 = VEC_CONFIG0_NTSC_STD,
+ 		.config1 = VEC_CONFIG1_C_CVBS_CVBS | VEC_CONFIG1_CUSTOM_FREQ,
+ 		.custom_freq = 0x2a098acb,
+ 	},
+ 	[VC4_VEC_TV_MODE_PAL] = {
+-		.mode = &drm_mode_576i,
++		.interlaced_mode = &drm_mode_576i,
++		.progressive_mode = &drm_mode_288p,
+ 		.config0 = VEC_CONFIG0_PAL_BDGHI_STD,
+ 		.config1 = VEC_CONFIG1_C_CVBS_CVBS,
+ 	},
+ 	[VC4_VEC_TV_MODE_PAL_M] = {
+-		.mode = &drm_mode_480i,
++		.interlaced_mode = &drm_mode_480i,
++		.progressive_mode = &drm_mode_240p,
+ 		.config0 = VEC_CONFIG0_PAL_M_STD,
+ 		.config1 = VEC_CONFIG1_C_CVBS_CVBS,
+ 	},
+ 	[VC4_VEC_TV_MODE_PAL_N] = {
+-		.mode = &drm_mode_576i,
++		.interlaced_mode = &drm_mode_576i,
++		.progressive_mode = &drm_mode_288p,
+ 		.config0 = VEC_CONFIG0_PAL_N_STD,
+ 		.config1 = VEC_CONFIG1_C_CVBS_CVBS,
+ 	},
+ 	[VC4_VEC_TV_MODE_PAL60] = {
+ 		/* PAL-M with chroma frequency of regular PAL */
+-		.mode = &drm_mode_480i,
++		.interlaced_mode = &drm_mode_480i,
++		.progressive_mode = &drm_mode_240p,
+ 		.config0 = VEC_CONFIG0_PAL_M_STD,
+ 		.config1 = VEC_CONFIG1_C_CVBS_CVBS | VEC_CONFIG1_CUSTOM_FREQ,
+ 		.custom_freq = 0x2a098acb,
+ 	},
+ 	[VC4_VEC_TV_MODE_SECAM] = {
+-		.mode = &drm_mode_576i,
++		.interlaced_mode = &drm_mode_576i,
++		.progressive_mode = &drm_mode_288p,
+ 		.config0 = VEC_CONFIG0_SECAM_STD,
+ 		.config1 = VEC_CONFIG1_C_CVBS_CVBS,
+ 		.custom_freq = 0x29c71c72,
+@@ -370,16 +391,32 @@ vc4_vec_connector_detect(struct drm_conn
+ static int vc4_vec_connector_get_modes(struct drm_connector *connector)
+ {
+ 	struct drm_connector_state *state = connector->state;
+-	struct drm_display_mode *mode;
++	struct drm_display_mode *interlaced_mode, *progressive_mode;
+ 
+-	mode = drm_mode_duplicate(connector->dev,
+-				  vc4_vec_tv_modes[state->tv.mode].mode);
+-	if (!mode) {
++	interlaced_mode =
++		drm_mode_duplicate(connector->dev,
++				   vc4_vec_tv_modes[state->tv.mode].interlaced_mode);
++	progressive_mode =
++		drm_mode_duplicate(connector->dev,
++				   vc4_vec_tv_modes[state->tv.mode].progressive_mode);
++	if (!interlaced_mode || !progressive_mode) {
+ 		DRM_ERROR("Failed to create a new display mode\n");
++		drm_mode_destroy(connector->dev, interlaced_mode);
++		drm_mode_destroy(connector->dev, progressive_mode);
+ 		return -ENOMEM;
+ 	}
+ 
+-	drm_mode_probed_add(connector, mode);
++	if (connector->cmdline_mode.specified &&
++	    connector->cmdline_mode.refresh_specified &&
++	    !connector->cmdline_mode.interlace)
++		/* progressive mode set at boot, let's make it preferred */
++		progressive_mode->type |= DRM_MODE_TYPE_PREFERRED;
++	else
++		/* otherwise, interlaced mode is preferred */
++		interlaced_mode->type |= DRM_MODE_TYPE_PREFERRED;
++
++	drm_mode_probed_add(connector, interlaced_mode);
++	drm_mode_probed_add(connector, progressive_mode);
+ 
+ 	return 1;
+ }
+@@ -576,7 +613,7 @@ static int vc4_vec_encoder_atomic_check(
+ 					struct drm_connector_state *conn_state)
+ {
+ 	const struct drm_display_mode *reference_mode =
+-		vc4_vec_tv_modes[conn_state->tv.mode].mode;
++		vc4_vec_tv_modes[conn_state->tv.mode].interlaced_mode;
+ 
+ 	if (crtc_state->adjusted_mode.crtc_clock != reference_mode->clock ||
+ 	    crtc_state->adjusted_mode.crtc_htotal != reference_mode->htotal ||
diff --git a/target/linux/bcm27xx/patches-6.1/950-0017-drm-Check-whether-the-gamma-lut-has-changed-before-u.patch b/target/linux/bcm27xx/patches-6.1/950-0017-drm-Check-whether-the-gamma-lut-has-changed-before-u.patch
new file mode 100644
index 00000000000000..c5b06b44428b35
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0017-drm-Check-whether-the-gamma-lut-has-changed-before-u.patch
@@ -0,0 +1,30 @@
+From 39a1d2daa0440779a0790ca32543f30220b451da Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 2 Nov 2021 16:01:36 +0000
+Subject: [PATCH] drm: Check whether the gamma lut has changed before
+ updating
+
+drm_crtc_legacy_gamma_set updates the gamma_lut blob unconditionally,
+which leads to unnecessary reprogramming of hardware.
+
+Check whether the blob contents has actually changed before
+signalling that it has been updated.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/drm_color_mgmt.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_color_mgmt.c
++++ b/drivers/gpu/drm/drm_color_mgmt.c
+@@ -330,7 +330,9 @@ static int drm_crtc_legacy_gamma_set(str
+ 	replaced = drm_property_replace_blob(&crtc_state->degamma_lut,
+ 					     use_gamma_lut ? NULL : blob);
+ 	replaced |= drm_property_replace_blob(&crtc_state->ctm, NULL);
+-	replaced |= drm_property_replace_blob(&crtc_state->gamma_lut,
++	if (!crtc_state->gamma_lut || !crtc_state->gamma_lut->data ||
++	    memcmp(crtc_state->gamma_lut->data, blob_data, blob->length))
++		replaced |= drm_property_replace_blob(&crtc_state->gamma_lut,
+ 					      use_gamma_lut ? blob : NULL);
+ 	crtc_state->color_mgmt_changed |= replaced;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0018-drm-vc4-Enable-gamma-block-only-when-required.patch b/target/linux/bcm27xx/patches-6.1/950-0018-drm-vc4-Enable-gamma-block-only-when-required.patch
new file mode 100644
index 00000000000000..0a49472ddbd66d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0018-drm-vc4-Enable-gamma-block-only-when-required.patch
@@ -0,0 +1,66 @@
+From 23c8491ac23b95c0557fc398f338ecc62393cf53 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 8 Nov 2021 17:32:45 +0000
+Subject: [PATCH] drm/vc4: Enable gamma block only when required.
+
+With HVS5 the gamma block is now only reprogrammed with
+a disable/enable. Loading the table from vc4_hvs_init_channel
+(called from vc4_hvs_atomic_enable) appears to be at an
+invalid point in time and so isn't applied.
+
+Switch to enabling and disabling the gamma table instead. This
+isn't safe if the pipeline is running, but it isn't now.
+For HVS4 it is safe to enable and disable dynamically, so
+adopt that approach there too.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -546,8 +546,11 @@ static int vc4_hvs_init_channel(struct v
+ 	dispbkgndx &= ~SCALER_DISPBKGND_GAMMA;
+ 	dispbkgndx &= ~SCALER_DISPBKGND_INTERLACE;
+ 
++	if (crtc->state->gamma_lut)
++		/* Enable gamma on if required */
++		dispbkgndx |= SCALER_DISPBKGND_GAMMA;
++
+ 	HVS_WRITE(SCALER_DISPBKGNDX(chan), dispbkgndx |
+-		  ((!vc4->is_vc5) ? SCALER_DISPBKGND_GAMMA : 0) |
+ 		  (interlace ? SCALER_DISPBKGND_INTERLACE : 0));
+ 
+ 	/* Reload the LUT, since the SRAMs would have been disabled if
+@@ -816,18 +819,25 @@ void vc4_hvs_atomic_flush(struct drm_crt
+ 		u32 dispbkgndx = HVS_READ(SCALER_DISPBKGNDX(channel));
+ 
+ 		if (crtc->state->gamma_lut) {
+-			if (!vc4->is_vc5)
++			if (!vc4->is_vc5) {
+ 				vc4_hvs_update_gamma_lut(hvs, vc4_crtc);
+-			else
++				dispbkgndx |= SCALER_DISPBKGND_GAMMA;
++			} else {
+ 				vc5_hvs_update_gamma_lut(hvs, vc4_crtc);
+-
+-			dispbkgndx |= SCALER_DISPBKGND_GAMMA;
++			}
+ 		} else {
+ 			/* Unsetting DISPBKGND_GAMMA skips the gamma lut step
+ 			 * in hardware, which is the same as a linear lut that
+ 			 * DRM expects us to use in absence of a user lut.
++			 *
++			 * Do NOT change state dynamically for hvs5 as it
++			 * inserts a delay in the pipeline that will cause
++			 * stalls if enabled/disabled whilst running. The other
++			 * should already be disabling/enabling the pipeline
++			 * when gamma changes.
+ 			 */
+-			dispbkgndx &= ~SCALER_DISPBKGND_GAMMA;
++			if (!vc4->is_vc5)
++				dispbkgndx &= ~SCALER_DISPBKGND_GAMMA;
+ 		}
+ 		HVS_WRITE(SCALER_DISPBKGNDX(channel), dispbkgndx);
+ 	}
diff --git a/target/linux/bcm27xx/patches-6.1/950-0019-drm-vc4-Only-add-gamma-properties-once.patch b/target/linux/bcm27xx/patches-6.1/950-0019-drm-vc4-Only-add-gamma-properties-once.patch
new file mode 100644
index 00000000000000..c817b6287708bb
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0019-drm-vc4-Only-add-gamma-properties-once.patch
@@ -0,0 +1,26 @@
+From 7b997c4910042491c90202df414f0e574a320258 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 8 Nov 2021 18:25:49 +0000
+Subject: [PATCH] drm/vc4: Only add gamma properties once.
+
+Two calls were made to drm_crtc_enable_color_mgmt to add gamma
+and CTM, however they were both set to add the gamma properties,
+so they ended up added twice.
+
+Fixes: 766cc6b1f7fc "drm/vc4: Add CTM support"
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -1358,7 +1358,7 @@ int vc4_crtc_init(struct drm_device *drm
+ 		/* We support CTM, but only for one CRTC at a time. It's therefore
+ 		 * implemented as private driver state in vc4_kms, not here.
+ 		 */
+-		drm_crtc_enable_color_mgmt(crtc, 0, true, crtc->gamma_size);
++		drm_crtc_enable_color_mgmt(crtc, 0, true, 0);
+ 
+ 		/* Initialize the VC4 gamma LUTs */
+ 		for (i = 0; i < crtc->gamma_size; i++) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0020-drm-vc4-Validate-the-size-of-the-gamma_lut.patch b/target/linux/bcm27xx/patches-6.1/950-0020-drm-vc4-Validate-the-size-of-the-gamma_lut.patch
new file mode 100644
index 00000000000000..1d4ba76e705c24
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0020-drm-vc4-Validate-the-size-of-the-gamma_lut.patch
@@ -0,0 +1,32 @@
+From fc4d71fb629da4be7fee128bced80b9625acf3bb Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 10 Nov 2021 16:36:12 +0000
+Subject: [PATCH] drm/vc4: Validate the size of the gamma_lut
+
+Add a check to vc4_hvs_gamma_check to ensure a new non-empty
+gamma LUT is of the correct length before accepting it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -612,6 +612,16 @@ static int vc4_hvs_gamma_check(struct dr
+ 	if (!crtc_state->color_mgmt_changed)
+ 		return 0;
+ 
++	if (crtc_state->gamma_lut) {
++		unsigned int len = drm_color_lut_size(crtc_state->gamma_lut);
++
++		if (len != crtc->gamma_size) {
++			DRM_DEBUG_KMS("Invalid LUT size; got %u, expected %u\n",
++				      len, crtc->gamma_size);
++			return -EINVAL;
++		}
++	}
++
+ 	connector = vc4_get_crtc_connector(crtc, crtc_state);
+ 	if (!connector)
+ 		return -EINVAL;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0021-drm-vc4-Disable-Gamma-control-on-HVS5-due-to-issues-.patch b/target/linux/bcm27xx/patches-6.1/950-0021-drm-vc4-Disable-Gamma-control-on-HVS5-due-to-issues-.patch
new file mode 100644
index 00000000000000..8b443b9d56c3d0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0021-drm-vc4-Disable-Gamma-control-on-HVS5-due-to-issues-.patch
@@ -0,0 +1,36 @@
+From bb3a24c168067c1813b9b607b6c44c43a4a889e8 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 13 Jan 2022 11:30:42 +0000
+Subject: [PATCH] drm/vc4: Disable Gamma control on HVS5 due to issues
+ writing the table
+
+Still under investigation, but the conditions under which the HVS
+will accept values written to the gamma PWL are not straightforward.
+
+Disable gamma on HVS5 again until it can be resolved to avoid
+gamma being enabled with an incorrect table.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -1344,15 +1344,9 @@ int vc4_crtc_init(struct drm_device *drm
+ 
+ 	if (!vc4->is_vc5) {
+ 		drm_mode_crtc_set_gamma_size(crtc, ARRAY_SIZE(vc4_crtc->lut_r));
+-	} else {
+-		/* This is a lie for hvs5 which uses a 16 point PWL, but it
+-		 * allows for something smarter than just 16 linearly spaced
+-		 * segments. Conversion is done in vc5_hvs_update_gamma_lut.
+-		 */
+-		drm_mode_crtc_set_gamma_size(crtc, 256);
++		drm_crtc_enable_color_mgmt(crtc, 0, false, crtc->gamma_size);
+ 	}
+ 
+-	drm_crtc_enable_color_mgmt(crtc, 0, false, crtc->gamma_size);
+ 
+ 	if (!vc4->is_vc5) {
+ 		/* We support CTM, but only for one CRTC at a time. It's therefore
diff --git a/target/linux/bcm27xx/patches-6.1/950-0022-drm-vc4_hdmi-Add-Broadcast-RGB-property-to-allow-ove.patch b/target/linux/bcm27xx/patches-6.1/950-0022-drm-vc4_hdmi-Add-Broadcast-RGB-property-to-allow-ove.patch
new file mode 100644
index 00000000000000..60a96ca8e448aa
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0022-drm-vc4_hdmi-Add-Broadcast-RGB-property-to-allow-ove.patch
@@ -0,0 +1,223 @@
+From b975642ea1ebaf66f6ed0ac403dfa82fa9d0e206 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 8 Apr 2020 16:12:02 +0100
+Subject: [PATCH] drm/vc4_hdmi: Add Broadcast RGB property to allow
+ override of RGB range
+
+Copy Intel's "Broadcast RGB" property semantics to add manual override
+of the HDMI pixel range for monitors that don't abide by the content
+of the AVI Infoframe.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 104 +++++++++++++++++++++++++++++++++
+ drivers/gpu/drm/vc4/vc4_hdmi.h |  15 +++++
+ 2 files changed, 119 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -57,6 +57,14 @@
+ #include "vc4_hdmi_regs.h"
+ #include "vc4_regs.h"
+ 
++/*
++ * "Broadcast RGB" property.
++ * Allows overriding of HDMI full or limited range RGB
++ */
++#define VC4_BROADCAST_RGB_AUTO 0
++#define VC4_BROADCAST_RGB_FULL 1
++#define VC4_BROADCAST_RGB_LIMITED 2
++
+ #define VC5_HDMI_HORZA_HFP_SHIFT		16
+ #define VC5_HDMI_HORZA_HFP_MASK			VC4_MASK(28, 16)
+ #define VC5_HDMI_HORZA_VPOS			BIT(15)
+@@ -155,6 +163,11 @@ static bool vc4_hdmi_is_full_range_rgb(s
+ {
+ 	struct drm_display_info *display = &vc4_hdmi->connector.display_info;
+ 
++	if (vc4_hdmi->broadcast_rgb == VC4_BROADCAST_RGB_LIMITED)
++		return false;
++	else if (vc4_hdmi->broadcast_rgb == VC4_BROADCAST_RGB_FULL)
++		return true;
++
+ 	return !display->is_hdmi ||
+ 		drm_default_rgb_quant_range(mode) == HDMI_QUANTIZATION_RANGE_FULL;
+ }
+@@ -544,6 +557,65 @@ static int vc4_hdmi_connector_atomic_che
+ 	return 0;
+ }
+ 
++/**
++ * vc4_hdmi_connector_atomic_get_property - hook for
++ *						connector->atomic_get_property.
++ * @connector: Connector to get the property for.
++ * @state: Connector state to retrieve the property from.
++ * @property: Property to retrieve.
++ * @val: Return value for the property.
++ *
++ * Returns the atomic property value for a digital connector.
++ */
++int vc4_hdmi_connector_get_property(struct drm_connector *connector,
++				    const struct drm_connector_state *state,
++				    struct drm_property *property,
++				    uint64_t *val)
++{
++	struct vc4_hdmi *vc4_hdmi = connector_to_vc4_hdmi(connector);
++	const struct vc4_hdmi_connector_state *vc4_conn_state =
++				const_conn_state_to_vc4_hdmi_conn_state(state);
++
++	if (property == vc4_hdmi->broadcast_rgb_property) {
++		*val = vc4_conn_state->broadcast_rgb;
++	} else {
++		DRM_DEBUG_ATOMIC("Unknown property [PROP:%d:%s]\n",
++				 property->base.id, property->name);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/**
++ * vc4_hdmi_connector_atomic_set_property - hook for
++ *						connector->atomic_set_property.
++ * @connector: Connector to set the property for.
++ * @state: Connector state to set the property on.
++ * @property: Property to set.
++ * @val: New value for the property.
++ *
++ * Sets the atomic property value for a digital connector.
++ */
++int vc4_hdmi_connector_set_property(struct drm_connector *connector,
++				    struct drm_connector_state *state,
++				    struct drm_property *property,
++				    uint64_t val)
++{
++	struct vc4_hdmi *vc4_hdmi = connector_to_vc4_hdmi(connector);
++	struct vc4_hdmi_connector_state *vc4_conn_state =
++				conn_state_to_vc4_hdmi_conn_state(state);
++
++	if (property == vc4_hdmi->broadcast_rgb_property) {
++		vc4_conn_state->broadcast_rgb = val;
++		return 0;
++	}
++
++	DRM_DEBUG_ATOMIC("Unknown property [PROP:%d:%s]\n",
++			 property->base.id, property->name);
++	return -EINVAL;
++}
++
+ static void vc4_hdmi_connector_reset(struct drm_connector *connector)
+ {
+ 	struct vc4_hdmi_connector_state *old_state =
+@@ -580,6 +652,7 @@ vc4_hdmi_connector_duplicate_state(struc
+ 	new_state->tmds_char_rate = vc4_state->tmds_char_rate;
+ 	new_state->output_bpc = vc4_state->output_bpc;
+ 	new_state->output_format = vc4_state->output_format;
++	new_state->broadcast_rgb = vc4_state->broadcast_rgb;
+ 	__drm_atomic_helper_connector_duplicate_state(connector, &new_state->base);
+ 
+ 	return &new_state->base;
+@@ -590,6 +663,8 @@ static const struct drm_connector_funcs
+ 	.reset = vc4_hdmi_connector_reset,
+ 	.atomic_duplicate_state = vc4_hdmi_connector_duplicate_state,
+ 	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
++	.atomic_get_property = vc4_hdmi_connector_get_property,
++	.atomic_set_property = vc4_hdmi_connector_set_property,
+ };
+ 
+ static const struct drm_connector_helper_funcs vc4_hdmi_connector_helper_funcs = {
+@@ -598,6 +673,32 @@ static const struct drm_connector_helper
+ 	.atomic_check = vc4_hdmi_connector_atomic_check,
+ };
+ 
++static const struct drm_prop_enum_list broadcast_rgb_names[] = {
++	{ VC4_BROADCAST_RGB_AUTO, "Automatic" },
++	{ VC4_BROADCAST_RGB_FULL, "Full" },
++	{ VC4_BROADCAST_RGB_LIMITED, "Limited 16:235" },
++};
++
++static void
++vc4_hdmi_attach_broadcast_rgb_property(struct drm_device *dev,
++				       struct vc4_hdmi *vc4_hdmi)
++{
++	struct drm_property *prop = vc4_hdmi->broadcast_rgb_property;
++
++	if (!prop) {
++		prop = drm_property_create_enum(dev, DRM_MODE_PROP_ENUM,
++						"Broadcast RGB",
++						broadcast_rgb_names,
++						ARRAY_SIZE(broadcast_rgb_names));
++		if (!prop)
++			return;
++
++		vc4_hdmi->broadcast_rgb_property = prop;
++	}
++
++	drm_object_attach_property(&vc4_hdmi->connector.base, prop, 0);
++}
++
+ static int vc4_hdmi_connector_init(struct drm_device *dev,
+ 				   struct vc4_hdmi *vc4_hdmi)
+ {
+@@ -644,6 +745,8 @@ static int vc4_hdmi_connector_init(struc
+ 	if (vc4_hdmi->variant->supports_hdr)
+ 		drm_connector_attach_hdr_output_metadata_property(connector);
+ 
++	vc4_hdmi_attach_broadcast_rgb_property(dev, vc4_hdmi);
++
+ 	drm_connector_attach_encoder(connector, encoder);
+ 
+ 	return 0;
+@@ -1683,6 +1786,7 @@ static void vc4_hdmi_encoder_atomic_mode
+ 	mutex_lock(&vc4_hdmi->mutex);
+ 	drm_mode_copy(&vc4_hdmi->saved_adjusted_mode,
+ 		      &crtc_state->adjusted_mode);
++	vc4_hdmi->broadcast_rgb = vc4_state->broadcast_rgb;
+ 	vc4_hdmi->output_bpc = vc4_state->output_bpc;
+ 	vc4_hdmi->output_format = vc4_state->output_format;
+ 	mutex_unlock(&vc4_hdmi->mutex);
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.h
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.h
+@@ -129,6 +129,8 @@ struct vc4_hdmi {
+ 
+ 	struct delayed_work scrambling_work;
+ 
++	struct drm_property *broadcast_rgb_property;
++
+ 	struct i2c_adapter *ddc;
+ 	void __iomem *hdmicore_regs;
+ 	void __iomem *hd_regs;
+@@ -229,6 +231,12 @@ struct vc4_hdmi {
+ 	 * for use outside of KMS hooks. Protected by @mutex.
+ 	 */
+ 	enum vc4_hdmi_output_format output_format;
++
++	/**
++	 * @broadcast_rgb: Copy of @vc4_connector_state.broadcast_rgb
++	 * for use outside of KMS hooks. Protected by @mutex.
++	 */
++	int broadcast_rgb;
+ };
+ 
+ static inline struct vc4_hdmi *
+@@ -249,6 +257,7 @@ struct vc4_hdmi_connector_state {
+ 	unsigned long long		tmds_char_rate;
+ 	unsigned int 			output_bpc;
+ 	enum vc4_hdmi_output_format	output_format;
++	int				broadcast_rgb;
+ };
+ 
+ static inline struct vc4_hdmi_connector_state *
+@@ -256,6 +265,12 @@ conn_state_to_vc4_hdmi_conn_state(struct
+ {
+ 	return container_of(conn_state, struct vc4_hdmi_connector_state, base);
+ }
++
++static inline const struct vc4_hdmi_connector_state *
++const_conn_state_to_vc4_hdmi_conn_state(const struct drm_connector_state *conn_state)
++{
++	return container_of(conn_state, struct vc4_hdmi_connector_state, base);
++}
+ 
+ void vc4_hdmi_phy_init(struct vc4_hdmi *vc4_hdmi,
+ 		       struct vc4_hdmi_connector_state *vc4_conn_state);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0023-drm-vc4-Add-DRM-210101010-RGB-formats-for-hvs5.patch b/target/linux/bcm27xx/patches-6.1/950-0023-drm-vc4-Add-DRM-210101010-RGB-formats-for-hvs5.patch
new file mode 100644
index 00000000000000..3d66af6e886785
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0023-drm-vc4-Add-DRM-210101010-RGB-formats-for-hvs5.patch
@@ -0,0 +1,51 @@
+From 496704e90c065015a808fc31356c7aecc5bfeccd Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 31 Jan 2022 16:28:43 +0000
+Subject: [PATCH] drm/vc4: Add DRM 210101010 RGB formats for hvs5.
+
+HVS5 supports the 210101010 RGB[A|X] formats, but they were
+missing from the DRM to HVS mapping list, so weren't available.
+Add them in.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -139,6 +139,34 @@ static const struct hvs_format {
+ 		.pixel_order = HVS_PIXEL_ORDER_XYCBCR,
+ 		.hvs5_only = true,
+ 	},
++	{
++		.drm = DRM_FORMAT_XRGB2101010,
++		.hvs = HVS_PIXEL_FORMAT_RGBA1010102,
++		.pixel_order = HVS_PIXEL_ORDER_ABGR,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_ARGB,
++		.hvs5_only = true,
++	},
++	{
++		.drm = DRM_FORMAT_ARGB2101010,
++		.hvs = HVS_PIXEL_FORMAT_RGBA1010102,
++		.pixel_order = HVS_PIXEL_ORDER_ABGR,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_ARGB,
++		.hvs5_only = true,
++	},
++	{
++		.drm = DRM_FORMAT_ABGR2101010,
++		.hvs = HVS_PIXEL_FORMAT_RGBA1010102,
++		.pixel_order = HVS_PIXEL_ORDER_ARGB,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_ABGR,
++		.hvs5_only = true,
++	},
++	{
++		.drm = DRM_FORMAT_XBGR2101010,
++		.hvs = HVS_PIXEL_FORMAT_RGBA1010102,
++		.pixel_order = HVS_PIXEL_ORDER_ARGB,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_ABGR,
++		.hvs5_only = true,
++	},
+ };
+ 
+ static const struct hvs_format *vc4_get_hvs_format(u32 drm_format)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0024-drm-vc4-dpi-Support-DPI-interface-in-mode3-for-RGB56.patch b/target/linux/bcm27xx/patches-6.1/950-0024-drm-vc4-dpi-Support-DPI-interface-in-mode3-for-RGB56.patch
new file mode 100644
index 00000000000000..2142cf58ce9f09
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0024-drm-vc4-dpi-Support-DPI-interface-in-mode3-for-RGB56.patch
@@ -0,0 +1,31 @@
+From 1c22021723d142524d744f6e2a6d81fc39b1b366 Mon Sep 17 00:00:00 2001
+From: Chris Morgan <macromorgan@hotmail.com>
+Date: Fri, 28 Jan 2022 17:39:54 -0600
+Subject: [PATCH] drm/vc4: dpi: Support DPI interface in mode3 for
+ RGB565
+
+Add support for the VC4 DPI driver to utilize DPI mode 3. This is
+defined here as xxxRRRRRxxGGGGGGxxxBBBBB:
+https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#parallel-display-interface-dpi
+
+This mode is required to use the Geekworm MZP280 DPI display.
+
+Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
+Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_dpi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_dpi.c
++++ b/drivers/gpu/drm/vc4/vc4_dpi.c
+@@ -188,6 +188,10 @@ static void vc4_dpi_encoder_enable(struc
+ 				dpi_c |= VC4_SET_FIELD(DPI_FORMAT_16BIT_565_RGB_1,
+ 						       DPI_FORMAT);
+ 				break;
++			case MEDIA_BUS_FMT_RGB565_1X24_CPADHI:
++				dpi_c |= VC4_SET_FIELD(DPI_FORMAT_16BIT_565_RGB_2,
++						       DPI_FORMAT);
++				break;
+ 			default:
+ 				DRM_ERROR("Unknown media bus format %d\n",
+ 					  bus_format);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0025-drm-panel-Add-and-initialise-an-orientation-field-to.patch b/target/linux/bcm27xx/patches-6.1/950-0025-drm-panel-Add-and-initialise-an-orientation-field-to.patch
new file mode 100644
index 00000000000000..9cdbe6d7c800cb
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0025-drm-panel-Add-and-initialise-an-orientation-field-to.patch
@@ -0,0 +1,89 @@
+From 49d74639d19ec3ae9810a1d6ae6c0ff725c75881 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 1 Feb 2022 12:20:20 +0000
+Subject: [PATCH] drm/panel: Add and initialise an orientation field to
+ drm_panel
+
+Current usage of drm_connector_set_panel_orientation is from a panel's
+get_modes call. However if the panel orientation property doesn't
+exist on the connector at this point, then drm_mode_object triggers
+WARNs as the connector is already registered.
+
+Add an orientation variable to struct drm_panel and initialise it from
+drm_panel_init.
+panel_bridge_attach can then create the property before the connector
+is registered.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/bridge/panel.c |  4 ++++
+ drivers/gpu/drm/drm_panel.c    | 15 ++++++++++-----
+ include/drm/drm_panel.h        |  8 ++++++++
+ 3 files changed, 22 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/bridge/panel.c
++++ b/drivers/gpu/drm/bridge/panel.c
+@@ -81,6 +81,10 @@ static int panel_bridge_attach(struct dr
+ 		return ret;
+ 	}
+ 
++	/* set up connector's "panel orientation" property */
++	drm_connector_set_panel_orientation(&panel_bridge->connector,
++					    panel_bridge->panel->orientation);
++
+ 	drm_connector_attach_encoder(&panel_bridge->connector,
+ 					  bridge->encoder);
+ 
+--- a/drivers/gpu/drm/drm_panel.c
++++ b/drivers/gpu/drm/drm_panel.c
+@@ -61,6 +61,9 @@ void drm_panel_init(struct drm_panel *pa
+ 	panel->dev = dev;
+ 	panel->funcs = funcs;
+ 	panel->connector_type = connector_type;
++
++	panel->orientation = DRM_MODE_PANEL_ORIENTATION_UNKNOWN;
++	of_drm_get_panel_orientation(dev->of_node, &panel->orientation);
+ }
+ EXPORT_SYMBOL(drm_panel_init);
+ 
+@@ -289,16 +292,18 @@ int of_drm_get_panel_orientation(const s
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	if (rotation == 0)
++	if (rotation == 0) {
+ 		*orientation = DRM_MODE_PANEL_ORIENTATION_NORMAL;
+-	else if (rotation == 90)
++	} else if (rotation == 90) {
+ 		*orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP;
+-	else if (rotation == 180)
++	} else if (rotation == 180) {
+ 		*orientation = DRM_MODE_PANEL_ORIENTATION_BOTTOM_UP;
+-	else if (rotation == 270)
++	} else if (rotation == 270) {
+ 		*orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP;
+-	else
++	} else {
++		DRM_ERROR("%pOF: invalid orientation %d\n", np, ret);
+ 		return -EINVAL;
++	}
+ 
+ 	return 0;
+ }
+--- a/include/drm/drm_panel.h
++++ b/include/drm/drm_panel.h
+@@ -183,6 +183,14 @@ struct drm_panel {
+ 	int connector_type;
+ 
+ 	/**
++	 * @orientation:
++	 *
++	 * Panel orientation at initialisation. This is used to initialise the
++	 * drm_connector property for panel orientation.
++	 */
++	enum drm_panel_orientation orientation;
++
++	/**
+ 	 * @list:
+ 	 *
+ 	 * Panel entry in registry.
diff --git a/target/linux/bcm27xx/patches-6.1/950-0026-drm-dsi-Document-the-meaning-and-spec-references-for.patch b/target/linux/bcm27xx/patches-6.1/950-0026-drm-dsi-Document-the-meaning-and-spec-references-for.patch
new file mode 100644
index 00000000000000..a26f56e03ed53b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0026-drm-dsi-Document-the-meaning-and-spec-references-for.patch
@@ -0,0 +1,76 @@
+From b99fa92c1ff228cf2d6c6ee02cdc2650fe7bfef1 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 17 Dec 2021 13:36:52 +0000
+Subject: [PATCH] drm/dsi: Document the meaning and spec references for
+ MIPI_DSI_MODE_*
+
+The MIPI_DSI_MODE_* flags have fairly terse descriptions and no reference
+to the DSI specification as to their exact meaning. Usage has therefore
+been rather fluid.
+
+Extend the descriptions and provide references to the part of the
+MIPI DSI specification regarding what they mean.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ include/drm/drm_mipi_dsi.h | 38 ++++++++++++++++++++++++++------------
+ 1 file changed, 26 insertions(+), 12 deletions(-)
+
+--- a/include/drm/drm_mipi_dsi.h
++++ b/include/drm/drm_mipi_dsi.h
+@@ -113,29 +113,43 @@ struct mipi_dsi_host *of_find_mipi_dsi_h
+ 
+ /* DSI mode flags */
+ 
+-/* video mode */
++/* Video mode display.
++ * Not set denotes a command mode display.
++ */
+ #define MIPI_DSI_MODE_VIDEO		BIT(0)
+-/* video burst mode */
++/* Video burst mode.
++ * Link frequency to be configured via platform configuration.
++ * This should always be set in conjunction with MIPI_DSI_MODE_VIDEO.
++ * (DSI spec V1.1 8.11.4)
++ */
+ #define MIPI_DSI_MODE_VIDEO_BURST	BIT(1)
+-/* video pulse mode */
++/* Video pulse mode.
++ * Not set denotes sync event mode. (DSI spec V1.1 8.11.2)
++ */
+ #define MIPI_DSI_MODE_VIDEO_SYNC_PULSE	BIT(2)
+-/* enable auto vertical count mode */
++/* Enable auto vertical count mode */
+ #define MIPI_DSI_MODE_VIDEO_AUTO_VERT	BIT(3)
+-/* enable hsync-end packets in vsync-pulse and v-porch area */
++/* Enable hsync-end packets in vsync-pulse and v-porch area */
+ #define MIPI_DSI_MODE_VIDEO_HSE		BIT(4)
+-/* disable hfront-porch area */
++/* Transmit NULL packets or LP mode during hfront-porch area.
++ * Not set denotes sending a blanking packet instead. (DSI spec V1.1 8.11.1)
++ */
+ #define MIPI_DSI_MODE_VIDEO_NO_HFP	BIT(5)
+-/* disable hback-porch area */
++/* Transmit NULL packets or LP mode during hback-porch area.
++ * Not set denotes sending a blanking packet instead. (DSI spec V1.1 8.11.1)
++ */
+ #define MIPI_DSI_MODE_VIDEO_NO_HBP	BIT(6)
+-/* disable hsync-active area */
++/* Transmit NULL packets or LP mode during hsync-active area.
++ * Not set denotes sending a blanking packet instead. (DSI spec V1.1 8.11.1)
++ */
+ #define MIPI_DSI_MODE_VIDEO_NO_HSA	BIT(7)
+-/* flush display FIFO on vsync pulse */
++/* Flush display FIFO on vsync pulse */
+ #define MIPI_DSI_MODE_VSYNC_FLUSH	BIT(8)
+-/* disable EoT packets in HS mode */
++/* Disable EoT packets in HS mode. (DSI spec V1.1 8.1)  */
+ #define MIPI_DSI_MODE_NO_EOT_PACKET	BIT(9)
+-/* device supports non-continuous clock behavior (DSI spec 5.6.1) */
++/* Device supports non-continuous clock behavior (DSI spec V1.1 5.6.1) */
+ #define MIPI_DSI_CLOCK_NON_CONTINUOUS	BIT(10)
+-/* transmit data in low power */
++/* Transmit data in low power */
+ #define MIPI_DSI_MODE_LPM		BIT(11)
+ /* transmit data ending at the same time for all lanes within one hsync */
+ #define MIPI_DSI_HS_PKT_END_ALIGNED	BIT(12)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0027-drm-bridge-tc358762-Ignore-EPROBE_DEFER-when-logging.patch b/target/linux/bcm27xx/patches-6.1/950-0027-drm-bridge-tc358762-Ignore-EPROBE_DEFER-when-logging.patch
new file mode 100644
index 00000000000000..ce9bab645a2e57
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0027-drm-bridge-tc358762-Ignore-EPROBE_DEFER-when-logging.patch
@@ -0,0 +1,25 @@
+From 135340b06a02d3a5ad0b214b3c0d59f6adb79dba Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 20 Jan 2022 17:29:36 +0000
+Subject: [PATCH] drm/bridge: tc358762: Ignore EPROBE_DEFER when
+ logging errors
+
+mipi_dsi_attach can fail due to resources not being available
+yet, therefore do not log error messages should they occur.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/bridge/tc358762.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/bridge/tc358762.c
++++ b/drivers/gpu/drm/bridge/tc358762.c
+@@ -235,7 +235,7 @@ static int tc358762_probe(struct mipi_ds
+ 	ret = mipi_dsi_attach(dsi);
+ 	if (ret < 0) {
+ 		drm_bridge_remove(&ctx->bridge);
+-		dev_err(dev, "failed to attach dsi\n");
++		dev_err_probe(dev, ret, "failed to attach dsi\n");
+ 	}
+ 
+ 	return ret;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0028-drm-vc4-Rename-bridge-to-out_bridge.patch b/target/linux/bcm27xx/patches-6.1/950-0028-drm-vc4-Rename-bridge-to-out_bridge.patch
new file mode 100644
index 00000000000000..1ebf4efd51bb5f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0028-drm-vc4-Rename-bridge-to-out_bridge.patch
@@ -0,0 +1,56 @@
+From ed34c4192a6189ef27ea4a1958ea843906afbe4d Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 30 Sep 2021 17:51:16 +0100
+Subject: [PATCH] drm/vc4: Rename bridge to out_bridge
+
+In preparation for converting the encoder to being a bridge,
+rename the variable holding the next bridge in the chain to
+out_bridge, so that our bridge can be called bridge.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_dsi.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_dsi.c
++++ b/drivers/gpu/drm/vc4/vc4_dsi.c
+@@ -556,7 +556,7 @@ struct vc4_dsi {
+ 
+ 	struct platform_device *pdev;
+ 
+-	struct drm_bridge *bridge;
++	struct drm_bridge *out_bridge;
+ 	struct list_head bridge_chain;
+ 
+ 	void __iomem *regs;
+@@ -800,7 +800,7 @@ static void vc4_dsi_encoder_disable(stru
+ 		if (iter->funcs->disable)
+ 			iter->funcs->disable(iter);
+ 
+-		if (iter == dsi->bridge)
++		if (iter == dsi->out_bridge)
+ 			break;
+ 	}
+ 
+@@ -1723,9 +1723,9 @@ static int vc4_dsi_bind(struct device *d
+ 		return ret;
+ 	}
+ 
+-	dsi->bridge = drmm_of_get_bridge(drm, dev->of_node, 0, 0);
+-	if (IS_ERR(dsi->bridge))
+-		return PTR_ERR(dsi->bridge);
++	dsi->out_bridge = drmm_of_get_bridge(drm, dev->of_node, 0, 0);
++	if (IS_ERR(dsi->out_bridge))
++		return PTR_ERR(dsi->out_bridge);
+ 
+ 	/* The esc clock rate is supposed to always be 100Mhz. */
+ 	ret = clk_set_rate(dsi->escape_clock, 100 * 1000000);
+@@ -1751,7 +1751,7 @@ static int vc4_dsi_bind(struct device *d
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = drm_bridge_attach(encoder, dsi->bridge, NULL, 0);
++	ret = drm_bridge_attach(encoder, dsi->out_bridge, NULL, 0);
+ 	if (ret)
+ 		return ret;
+ 	/* Disable the atomic helper calls into the bridge.  We
diff --git a/target/linux/bcm27xx/patches-6.1/950-0029-drm-vc4-Move-DSI-initialisation-to-encoder_mode_set.patch b/target/linux/bcm27xx/patches-6.1/950-0029-drm-vc4-Move-DSI-initialisation-to-encoder_mode_set.patch
new file mode 100644
index 00000000000000..9803df95d1152e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0029-drm-vc4-Move-DSI-initialisation-to-encoder_mode_set.patch
@@ -0,0 +1,64 @@
+From 5590c79c417064363236f24ffe40d87d6cfd128e Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 7 Feb 2022 17:14:51 +0000
+Subject: [PATCH] drm/vc4: Move DSI initialisation to encoder_mode_set.
+
+Breaking the bridge chain does not work for atomic bridges/panels
+and generally causes issues.
+We need to initialise the DSI host before the bridge pre_enables
+are called, so move that to encoder_mode_set in the same way that
+dw-mipi-dsi does.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_dsi.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_dsi.c
++++ b/drivers/gpu/drm/vc4/vc4_dsi.c
+@@ -867,18 +867,18 @@ static bool vc4_dsi_encoder_mode_fixup(s
+ 	return true;
+ }
+ 
+-static void vc4_dsi_encoder_enable(struct drm_encoder *encoder)
++static void vc4_dsi_encoder_mode_set(struct drm_encoder *encoder,
++				     struct drm_display_mode *mode,
++				     struct drm_display_mode *adjusted_mode)
+ {
+-	struct drm_display_mode *mode = &encoder->crtc->state->adjusted_mode;
+ 	struct vc4_dsi *dsi = to_vc4_dsi(encoder);
+ 	struct device *dev = &dsi->pdev->dev;
+ 	bool debug_dump_regs = false;
+-	struct drm_bridge *iter;
+ 	unsigned long hs_clock;
+ 	u32 ui_ns;
+ 	/* Minimum LP state duration in escape clock cycles. */
+ 	u32 lpx = dsi_esc_timing(60);
+-	unsigned long pixel_clock_hz = mode->clock * 1000;
++	unsigned long pixel_clock_hz = adjusted_mode->clock * 1000;
+ 	unsigned long dsip_clock;
+ 	unsigned long phy_clock;
+ 	int ret;
+@@ -1105,6 +1105,14 @@ static void vc4_dsi_encoder_enable(struc
+ 		       ~DSI_PORT_BIT(PHY_AFEC0_RESET));
+ 
+ 	vc4_dsi_ulps(dsi, false);
++}
++
++static void vc4_dsi_encoder_enable(struct drm_encoder *encoder)
++{
++	struct vc4_dsi_encoder *vc4_encoder = to_vc4_dsi_encoder(encoder);
++	struct vc4_dsi *dsi = vc4_encoder->dsi;
++	bool debug_dump_regs = false;
++	struct drm_bridge *iter;
+ 
+ 	list_for_each_entry_reverse(iter, &dsi->bridge_chain, chain_node) {
+ 		if (iter->funcs->pre_enable)
+@@ -1370,6 +1378,7 @@ static const struct drm_encoder_helper_f
+ 	.disable = vc4_dsi_encoder_disable,
+ 	.enable = vc4_dsi_encoder_enable,
+ 	.mode_fixup = vc4_dsi_encoder_mode_fixup,
++	.mode_set = vc4_dsi_encoder_mode_set,
+ };
+ 
+ static int vc4_dsi_late_register(struct drm_encoder *encoder)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0030-drm-vc4-Remove-splitting-the-bridge-chain-from-the-d.patch b/target/linux/bcm27xx/patches-6.1/950-0030-drm-vc4-Remove-splitting-the-bridge-chain-from-the-d.patch
new file mode 100644
index 00000000000000..7718e3be81036d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0030-drm-vc4-Remove-splitting-the-bridge-chain-from-the-d.patch
@@ -0,0 +1,118 @@
+From bd58cbe5c5155279ccd85c29ddef53094cf6dc81 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 15 Dec 2021 17:44:49 +0000
+Subject: [PATCH] drm/vc4: Remove splitting the bridge chain from the
+ driver.
+
+Splitting the bridge chain fails for atomic bridges as the
+framework can't add the relevant state in
+drm_atomic_add_encoder_bridges.
+The chain was split because we needed to power up before
+calling pre_enable, but that is now done in mode_set, and will
+move into the framework.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_dsi.c | 47 -----------------------------------
+ 1 file changed, 47 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_dsi.c
++++ b/drivers/gpu/drm/vc4/vc4_dsi.c
+@@ -557,7 +557,6 @@ struct vc4_dsi {
+ 	struct platform_device *pdev;
+ 
+ 	struct drm_bridge *out_bridge;
+-	struct list_head bridge_chain;
+ 
+ 	void __iomem *regs;
+ 
+@@ -794,23 +793,9 @@ static void vc4_dsi_encoder_disable(stru
+ {
+ 	struct vc4_dsi *dsi = to_vc4_dsi(encoder);
+ 	struct device *dev = &dsi->pdev->dev;
+-	struct drm_bridge *iter;
+-
+-	list_for_each_entry_reverse(iter, &dsi->bridge_chain, chain_node) {
+-		if (iter->funcs->disable)
+-			iter->funcs->disable(iter);
+-
+-		if (iter == dsi->out_bridge)
+-			break;
+-	}
+ 
+ 	vc4_dsi_ulps(dsi, true);
+ 
+-	list_for_each_entry_from(iter, &dsi->bridge_chain, chain_node) {
+-		if (iter->funcs->post_disable)
+-			iter->funcs->post_disable(iter);
+-	}
+-
+ 	clk_disable_unprepare(dsi->pll_phy_clock);
+ 	clk_disable_unprepare(dsi->escape_clock);
+ 	clk_disable_unprepare(dsi->pixel_clock);
+@@ -1112,12 +1097,6 @@ static void vc4_dsi_encoder_enable(struc
+ 	struct vc4_dsi_encoder *vc4_encoder = to_vc4_dsi_encoder(encoder);
+ 	struct vc4_dsi *dsi = vc4_encoder->dsi;
+ 	bool debug_dump_regs = false;
+-	struct drm_bridge *iter;
+-
+-	list_for_each_entry_reverse(iter, &dsi->bridge_chain, chain_node) {
+-		if (iter->funcs->pre_enable)
+-			iter->funcs->pre_enable(iter);
+-	}
+ 
+ 	if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO) {
+ 		DSI_PORT_WRITE(DISP0_CTRL,
+@@ -1134,11 +1113,6 @@ static void vc4_dsi_encoder_enable(struc
+ 			       DSI_DISP0_ENABLE);
+ 	}
+ 
+-	list_for_each_entry(iter, &dsi->bridge_chain, chain_node) {
+-		if (iter->funcs->enable)
+-			iter->funcs->enable(iter);
+-	}
+-
+ 	if (debug_dump_regs) {
+ 		struct drm_printer p = drm_info_printer(&dsi->pdev->dev);
+ 		dev_info(&dsi->pdev->dev, "DSI regs after:\n");
+@@ -1626,7 +1600,6 @@ static int vc4_dsi_bind(struct device *d
+ 
+ 	dsi->variant = of_device_get_match_data(dev);
+ 
+-	INIT_LIST_HEAD(&dsi->bridge_chain);
+ 	dsi->encoder.type = dsi->variant->port ?
+ 		VC4_ENCODER_TYPE_DSI1 : VC4_ENCODER_TYPE_DSI0;
+ 
+@@ -1763,32 +1736,12 @@ static int vc4_dsi_bind(struct device *d
+ 	ret = drm_bridge_attach(encoder, dsi->out_bridge, NULL, 0);
+ 	if (ret)
+ 		return ret;
+-	/* Disable the atomic helper calls into the bridge.  We
+-	 * manually call the bridge pre_enable / enable / etc. calls
+-	 * from our driver, since we need to sequence them within the
+-	 * encoder's enable/disable paths.
+-	 */
+-	list_splice_init(&encoder->bridge_chain, &dsi->bridge_chain);
+ 
+ 	return 0;
+ }
+ 
+-static void vc4_dsi_unbind(struct device *dev, struct device *master,
+-			   void *data)
+-{
+-	struct vc4_dsi *dsi = dev_get_drvdata(dev);
+-	struct drm_encoder *encoder = &dsi->encoder.base;
+-
+-	/*
+-	 * Restore the bridge_chain so the bridge detach procedure can happen
+-	 * normally.
+-	 */
+-	list_splice_init(&dsi->bridge_chain, &encoder->bridge_chain);
+-}
+-
+ static const struct component_ops vc4_dsi_ops = {
+ 	.bind   = vc4_dsi_bind,
+-	.unbind = vc4_dsi_unbind,
+ };
+ 
+ static int vc4_dsi_dev_probe(struct platform_device *pdev)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0031-drm-vc4-Convert-vc4_dsi-to-use-atomic-enable-disable.patch b/target/linux/bcm27xx/patches-6.1/950-0031-drm-vc4-Convert-vc4_dsi-to-use-atomic-enable-disable.patch
new file mode 100644
index 00000000000000..2554944748793a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0031-drm-vc4-Convert-vc4_dsi-to-use-atomic-enable-disable.patch
@@ -0,0 +1,84 @@
+From ab6f22f1747903266a88b73f628eb4f89474c84c Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 15 Dec 2021 17:47:14 +0000
+Subject: [PATCH] drm/vc4: Convert vc4_dsi to use atomic
+ enable/disable/mode_set.
+
+The atomic calls are preferred as the non-atomic ones
+are deprecated. In preparation for conversion to a bridge,
+switch to the atomic calls.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_dsi.c | 23 +++++++++++++++--------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_dsi.c
++++ b/drivers/gpu/drm/vc4/vc4_dsi.c
+@@ -789,7 +789,8 @@ dsi_esc_timing(u32 ns)
+ 	return DIV_ROUND_UP(ns, ESC_TIME_NS);
+ }
+ 
+-static void vc4_dsi_encoder_disable(struct drm_encoder *encoder)
++static void vc4_dsi_encoder_disable(struct drm_encoder *encoder,
++				    struct drm_atomic_state *state)
+ {
+ 	struct vc4_dsi *dsi = to_vc4_dsi(encoder);
+ 	struct device *dev = &dsi->pdev->dev;
+@@ -853,17 +854,18 @@ static bool vc4_dsi_encoder_mode_fixup(s
+ }
+ 
+ static void vc4_dsi_encoder_mode_set(struct drm_encoder *encoder,
+-				     struct drm_display_mode *mode,
+-				     struct drm_display_mode *adjusted_mode)
++				     struct drm_crtc_state *crtc_state,
++				     struct drm_connector_state *conn_state)
+ {
+ 	struct vc4_dsi *dsi = to_vc4_dsi(encoder);
+ 	struct device *dev = &dsi->pdev->dev;
++	const struct drm_display_mode *mode;
+ 	bool debug_dump_regs = false;
+ 	unsigned long hs_clock;
+ 	u32 ui_ns;
+ 	/* Minimum LP state duration in escape clock cycles. */
+ 	u32 lpx = dsi_esc_timing(60);
+-	unsigned long pixel_clock_hz = adjusted_mode->clock * 1000;
++	unsigned long pixel_clock_hz;
+ 	unsigned long dsip_clock;
+ 	unsigned long phy_clock;
+ 	int ret;
+@@ -880,6 +882,10 @@ static void vc4_dsi_encoder_mode_set(str
+ 		drm_print_regset32(&p, &dsi->regset);
+ 	}
+ 
++	mode = &crtc_state->adjusted_mode;
++
++	pixel_clock_hz = mode->clock * 1000;
++
+ 	/* Round up the clk_set_rate() request slightly, since
+ 	 * PLLD_DSI1 is an integer divider and its rate selection will
+ 	 * never round up.
+@@ -1092,7 +1098,8 @@ static void vc4_dsi_encoder_mode_set(str
+ 	vc4_dsi_ulps(dsi, false);
+ }
+ 
+-static void vc4_dsi_encoder_enable(struct drm_encoder *encoder)
++static void vc4_dsi_encoder_enable(struct drm_encoder *encoder,
++				   struct drm_atomic_state *state)
+ {
+ 	struct vc4_dsi_encoder *vc4_encoder = to_vc4_dsi_encoder(encoder);
+ 	struct vc4_dsi *dsi = vc4_encoder->dsi;
+@@ -1349,10 +1356,10 @@ static const struct mipi_dsi_host_ops vc
+ };
+ 
+ static const struct drm_encoder_helper_funcs vc4_dsi_encoder_helper_funcs = {
+-	.disable = vc4_dsi_encoder_disable,
+-	.enable = vc4_dsi_encoder_enable,
++	.atomic_disable = vc4_dsi_encoder_disable,
++	.atomic_enable = vc4_dsi_encoder_enable,
+ 	.mode_fixup = vc4_dsi_encoder_mode_fixup,
+-	.mode_set = vc4_dsi_encoder_mode_set,
++	.atomic_mode_set = vc4_dsi_encoder_mode_set,
+ };
+ 
+ static int vc4_dsi_late_register(struct drm_encoder *encoder)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0032-drm-vc4-Convert-vc4_dsi-to-using-a-bridge-instead-of.patch b/target/linux/bcm27xx/patches-6.1/950-0032-drm-vc4-Convert-vc4_dsi-to-using-a-bridge-instead-of.patch
new file mode 100644
index 00000000000000..480a600e632bbc
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0032-drm-vc4-Convert-vc4_dsi-to-using-a-bridge-instead-of.patch
@@ -0,0 +1,266 @@
+From c0611a36761fb6abf5a806bbfe417db1f4464a56 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 15 Dec 2021 17:57:45 +0000
+Subject: [PATCH] drm/vc4: Convert vc4_dsi to using a bridge instead of
+ encoder.
+
+Remove the encoder functions, and create a bridge attached to
+this dumb encoder which implements the same functionality.
+
+As a bridge has state which an encoder doesn't, we need to
+add the state management functions as well.
+
+As there is no bridge atomic_mode_set, move the initialisation
+code that was in mode_set into _pre_enable.
+The code to actually enable and disable sending video are split
+from the general control into _enable and _disable.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_dsi.c | 122 +++++++++++++++++++++++++---------
+ 1 file changed, 90 insertions(+), 32 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_dsi.c
++++ b/drivers/gpu/drm/vc4/vc4_dsi.c
+@@ -557,6 +557,7 @@ struct vc4_dsi {
+ 	struct platform_device *pdev;
+ 
+ 	struct drm_bridge *out_bridge;
++	struct drm_bridge bridge;
+ 
+ 	void __iomem *regs;
+ 
+@@ -608,6 +609,12 @@ to_vc4_dsi(struct drm_encoder *encoder)
+ 	return container_of(encoder, struct vc4_dsi, encoder.base);
+ }
+ 
++static inline struct vc4_dsi *
++bridge_to_vc4_dsi(struct drm_bridge *bridge)
++{
++	return container_of(bridge, struct vc4_dsi, bridge);
++}
++
+ static inline void
+ dsi_dma_workaround_write(struct vc4_dsi *dsi, u32 offset, u32 val)
+ {
+@@ -789,10 +796,21 @@ dsi_esc_timing(u32 ns)
+ 	return DIV_ROUND_UP(ns, ESC_TIME_NS);
+ }
+ 
+-static void vc4_dsi_encoder_disable(struct drm_encoder *encoder,
+-				    struct drm_atomic_state *state)
++static void vc4_dsi_bridge_disable(struct drm_bridge *bridge,
++				   struct drm_bridge_state *state)
+ {
+-	struct vc4_dsi *dsi = to_vc4_dsi(encoder);
++	struct vc4_dsi *dsi = bridge_to_vc4_dsi(bridge);
++	u32 disp0_ctrl;
++
++	disp0_ctrl = DSI_PORT_READ(DISP0_CTRL);
++	disp0_ctrl &= ~DSI_DISP0_ENABLE;
++	DSI_PORT_WRITE(DISP0_CTRL, disp0_ctrl);
++}
++
++static void vc4_dsi_bridge_post_disable(struct drm_bridge *bridge,
++					struct drm_bridge_state *state)
++{
++	struct vc4_dsi *dsi = bridge_to_vc4_dsi(bridge);
+ 	struct device *dev = &dsi->pdev->dev;
+ 
+ 	vc4_dsi_ulps(dsi, true);
+@@ -817,11 +835,11 @@ static void vc4_dsi_encoder_disable(stru
+  * higher-than-expected clock rate to the panel, but that's what the
+  * firmware does too.
+  */
+-static bool vc4_dsi_encoder_mode_fixup(struct drm_encoder *encoder,
+-				       const struct drm_display_mode *mode,
+-				       struct drm_display_mode *adjusted_mode)
++static bool vc4_dsi_bridge_mode_fixup(struct drm_bridge *bridge,
++				      const struct drm_display_mode *mode,
++				      struct drm_display_mode *adjusted_mode)
+ {
+-	struct vc4_dsi *dsi = to_vc4_dsi(encoder);
++	struct vc4_dsi *dsi = bridge_to_vc4_dsi(bridge);
+ 	struct clk *phy_parent = clk_get_parent(dsi->pll_phy_clock);
+ 	unsigned long parent_rate = clk_get_rate(phy_parent);
+ 	unsigned long pixel_clock_hz = mode->clock * 1000;
+@@ -853,15 +871,18 @@ static bool vc4_dsi_encoder_mode_fixup(s
+ 	return true;
+ }
+ 
+-static void vc4_dsi_encoder_mode_set(struct drm_encoder *encoder,
+-				     struct drm_crtc_state *crtc_state,
+-				     struct drm_connector_state *conn_state)
++static void vc4_dsi_bridge_pre_enable(struct drm_bridge *bridge,
++				      struct drm_bridge_state *old_state)
+ {
+-	struct vc4_dsi *dsi = to_vc4_dsi(encoder);
++	struct drm_atomic_state *state = old_state->base.state;
++	struct vc4_dsi *dsi = bridge_to_vc4_dsi(bridge);
++	const struct drm_crtc_state *crtc_state;
+ 	struct device *dev = &dsi->pdev->dev;
+ 	const struct drm_display_mode *mode;
++	struct drm_connector *connector;
+ 	bool debug_dump_regs = false;
+ 	unsigned long hs_clock;
++	struct drm_crtc *crtc;
+ 	u32 ui_ns;
+ 	/* Minimum LP state duration in escape clock cycles. */
+ 	u32 lpx = dsi_esc_timing(60);
+@@ -882,6 +903,14 @@ static void vc4_dsi_encoder_mode_set(str
+ 		drm_print_regset32(&p, &dsi->regset);
+ 	}
+ 
++	/*
++	 * Retrieve the CRTC adjusted mode. This requires a little dance to go
++	 * from the bridge to the encoder, to the connector and to the CRTC.
++	 */
++	connector = drm_atomic_get_new_connector_for_encoder(state,
++							     bridge->encoder);
++	crtc = drm_atomic_get_new_connector_state(state, connector)->crtc;
++	crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
+ 	mode = &crtc_state->adjusted_mode;
+ 
+ 	pixel_clock_hz = mode->clock * 1000;
+@@ -1096,14 +1125,6 @@ static void vc4_dsi_encoder_mode_set(str
+ 		       ~DSI_PORT_BIT(PHY_AFEC0_RESET));
+ 
+ 	vc4_dsi_ulps(dsi, false);
+-}
+-
+-static void vc4_dsi_encoder_enable(struct drm_encoder *encoder,
+-				   struct drm_atomic_state *state)
+-{
+-	struct vc4_dsi_encoder *vc4_encoder = to_vc4_dsi_encoder(encoder);
+-	struct vc4_dsi *dsi = vc4_encoder->dsi;
+-	bool debug_dump_regs = false;
+ 
+ 	if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO) {
+ 		DSI_PORT_WRITE(DISP0_CTRL,
+@@ -1112,13 +1133,23 @@ static void vc4_dsi_encoder_enable(struc
+ 			       VC4_SET_FIELD(dsi->format, DSI_DISP0_PFORMAT) |
+ 			       VC4_SET_FIELD(DSI_DISP0_LP_STOP_PERFRAME,
+ 					     DSI_DISP0_LP_STOP_CTRL) |
+-			       DSI_DISP0_ST_END |
+-			       DSI_DISP0_ENABLE);
++			       DSI_DISP0_ST_END);
+ 	} else {
+ 		DSI_PORT_WRITE(DISP0_CTRL,
+-			       DSI_DISP0_COMMAND_MODE |
+-			       DSI_DISP0_ENABLE);
++			       DSI_DISP0_COMMAND_MODE);
+ 	}
++}
++
++static void vc4_dsi_bridge_enable(struct drm_bridge *bridge,
++				  struct drm_bridge_state *old_state)
++{
++	struct vc4_dsi *dsi = bridge_to_vc4_dsi(bridge);
++	bool debug_dump_regs = false;
++	u32 disp0_ctrl;
++
++	disp0_ctrl = DSI_PORT_READ(DISP0_CTRL);
++	disp0_ctrl |= DSI_DISP0_ENABLE;
++	DSI_PORT_WRITE(DISP0_CTRL, disp0_ctrl);
+ 
+ 	if (debug_dump_regs) {
+ 		struct drm_printer p = drm_info_printer(&dsi->pdev->dev);
+@@ -1127,6 +1158,16 @@ static void vc4_dsi_encoder_enable(struc
+ 	}
+ }
+ 
++static int vc4_dsi_bridge_attach(struct drm_bridge *bridge,
++				 enum drm_bridge_attach_flags flags)
++{
++	struct vc4_dsi *dsi = bridge_to_vc4_dsi(bridge);
++
++	/* Attach the panel or bridge to the dsi bridge */
++	return drm_bridge_attach(bridge->encoder, dsi->out_bridge,
++				 &dsi->bridge, flags);
++}
++
+ static ssize_t vc4_dsi_host_transfer(struct mipi_dsi_host *host,
+ 				     const struct mipi_dsi_msg *msg)
+ {
+@@ -1303,6 +1344,7 @@ static int vc4_dsi_host_attach(struct mi
+ 			       struct mipi_dsi_device *device)
+ {
+ 	struct vc4_dsi *dsi = host_to_dsi(host);
++	int ret;
+ 
+ 	dsi->lanes = device->lanes;
+ 	dsi->channel = device->channel;
+@@ -1337,7 +1379,15 @@ static int vc4_dsi_host_attach(struct mi
+ 		return 0;
+ 	}
+ 
+-	return component_add(&dsi->pdev->dev, &vc4_dsi_ops);
++	drm_bridge_add(&dsi->bridge);
++
++	ret = component_add(&dsi->pdev->dev, &vc4_dsi_ops);
++	if (ret) {
++		drm_bridge_remove(&dsi->bridge);
++		return ret;
++	}
++
++	return 0;
+ }
+ 
+ static int vc4_dsi_host_detach(struct mipi_dsi_host *host,
+@@ -1346,6 +1396,7 @@ static int vc4_dsi_host_detach(struct mi
+ 	struct vc4_dsi *dsi = host_to_dsi(host);
+ 
+ 	component_del(&dsi->pdev->dev, &vc4_dsi_ops);
++	drm_bridge_remove(&dsi->bridge);
+ 	return 0;
+ }
+ 
+@@ -1355,11 +1406,16 @@ static const struct mipi_dsi_host_ops vc
+ 	.transfer = vc4_dsi_host_transfer,
+ };
+ 
+-static const struct drm_encoder_helper_funcs vc4_dsi_encoder_helper_funcs = {
+-	.atomic_disable = vc4_dsi_encoder_disable,
+-	.atomic_enable = vc4_dsi_encoder_enable,
+-	.mode_fixup = vc4_dsi_encoder_mode_fixup,
+-	.atomic_mode_set = vc4_dsi_encoder_mode_set,
++static const struct drm_bridge_funcs vc4_dsi_bridge_funcs = {
++	.atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state,
++	.atomic_destroy_state = drm_atomic_helper_bridge_destroy_state,
++	.atomic_reset = drm_atomic_helper_bridge_reset,
++	.atomic_pre_enable = vc4_dsi_bridge_pre_enable,
++	.atomic_enable = vc4_dsi_bridge_enable,
++	.atomic_disable = vc4_dsi_bridge_disable,
++	.atomic_post_disable = vc4_dsi_bridge_post_disable,
++	.attach = vc4_dsi_bridge_attach,
++	.mode_fixup = vc4_dsi_bridge_mode_fixup,
+ };
+ 
+ static int vc4_dsi_late_register(struct drm_encoder *encoder)
+@@ -1734,13 +1790,11 @@ static int vc4_dsi_bind(struct device *d
+ 	if (ret)
+ 		return ret;
+ 
+-	drm_encoder_helper_add(encoder, &vc4_dsi_encoder_helper_funcs);
+-
+ 	ret = devm_pm_runtime_enable(dev);
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = drm_bridge_attach(encoder, dsi->out_bridge, NULL, 0);
++	ret = drm_bridge_attach(encoder, &dsi->bridge, NULL, 0);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -1762,7 +1816,11 @@ static int vc4_dsi_dev_probe(struct plat
+ 	dev_set_drvdata(dev, dsi);
+ 
+ 	kref_init(&dsi->kref);
++
+ 	dsi->pdev = pdev;
++	dsi->bridge.funcs = &vc4_dsi_bridge_funcs;
++	dsi->bridge.of_node = dev->of_node;
++	dsi->bridge.type = DRM_MODE_CONNECTOR_DSI;
+ 	dsi->dsi_host.ops = &vc4_dsi_host_ops;
+ 	dsi->dsi_host.dev = dev;
+ 	mipi_dsi_host_register(&dsi->dsi_host);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0033-drm-vc4-Remove-entry-to-ULPS-from-vc4_dsi-post_disab.patch b/target/linux/bcm27xx/patches-6.1/950-0033-drm-vc4-Remove-entry-to-ULPS-from-vc4_dsi-post_disab.patch
new file mode 100644
index 00000000000000..e9aefd181bd535
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0033-drm-vc4-Remove-entry-to-ULPS-from-vc4_dsi-post_disab.patch
@@ -0,0 +1,32 @@
+From b0b5ae1ea6701cf9395f3132d559a5379a4fb73e Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 11 Feb 2022 14:15:26 +0000
+Subject: [PATCH] drm/vc4: Remove entry to ULPS from vc4_dsi
+ post_disable
+
+Post_disable was sending the D-PHY sequence to put any device
+into ULPS suspend mode, and then cutting power to the DSI block.
+The power-on reset state of the DSI block is for DSI to be in
+an operational state, not ULPS, so it then never sent the sequence
+for exiting ULPS. Any attached device that didn't have an external
+reset therefore remained in ULPS / standby, and didn't function.
+
+Use of ULPS isn't well specified in DRM, therefore remove entering
+it to avoid the above situation.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_dsi.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_dsi.c
++++ b/drivers/gpu/drm/vc4/vc4_dsi.c
+@@ -813,8 +813,6 @@ static void vc4_dsi_bridge_post_disable(
+ 	struct vc4_dsi *dsi = bridge_to_vc4_dsi(bridge);
+ 	struct device *dev = &dsi->pdev->dev;
+ 
+-	vc4_dsi_ulps(dsi, true);
+-
+ 	clk_disable_unprepare(dsi->pll_phy_clock);
+ 	clk_disable_unprepare(dsi->escape_clock);
+ 	clk_disable_unprepare(dsi->pixel_clock);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0034-drm-bridge-Introduce-pre_enable_upstream_first-to-al.patch b/target/linux/bcm27xx/patches-6.1/950-0034-drm-bridge-Introduce-pre_enable_upstream_first-to-al.patch
new file mode 100644
index 00000000000000..bab4ed9b90727f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0034-drm-bridge-Introduce-pre_enable_upstream_first-to-al.patch
@@ -0,0 +1,308 @@
+From 5365030a003a6cb0c336202256341e4bc9d65d52 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 16 Dec 2021 15:25:35 +0000
+Subject: [PATCH] drm/bridge: Introduce pre_enable_upstream_first to
+ alter bridge init order
+
+DSI sink devices typically want the DSI host powered up and configured
+before they are powered up. pre_enable is the place this would normally
+happen, but they are called in reverse order from panel/connector towards
+the encoder, which is the "wrong" order.
+
+Add a new flag pre_enable_upstream_first that any bridge can set
+to swap the order of pre_enable (and post_disable) for that and the
+immediately upstream bridge.
+Should the immediately upstream bridge also set the
+pre_enable_upstream_first flag, the bridge upstream of that will be called
+before either of those which requested pre_enable_upstream_first.
+
+eg:
+- Panel
+- Bridge 1
+- Bridge 2 pre_enable_upstream_first
+- Bridge 3
+- Bridge 4 pre_enable_upstream_first
+- Bridge 5 pre_enable_upstream_first
+- Bridge 6
+- Encoder
+Would result in pre_enable's being called as Panel, Bridge 1, Bridge 3,
+Bridge 2, Bridge 6, Bridge 5, Bridge 4, Encoder.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/drm_bridge.c | 177 +++++++++++++++++++++++++----------
+ include/drm/drm_bridge.h     |   8 ++
+ 2 files changed, 137 insertions(+), 48 deletions(-)
+
+--- a/drivers/gpu/drm/drm_bridge.c
++++ b/drivers/gpu/drm/drm_bridge.c
+@@ -547,20 +547,15 @@ EXPORT_SYMBOL(drm_bridge_chain_disable);
+  * encoder chain, starting from the first bridge to the last. These are called
+  * after completing the encoder's prepare op.
+  *
++ * If a bridge sets @pre_enable_upstream_first, then the @post_disable for that
++ * bridge will be called before the previous one to reverse the @pre_enable
++ * calling direction.
++ *
+  * Note: the bridge passed should be the one closest to the encoder
+  */
+ void drm_bridge_chain_post_disable(struct drm_bridge *bridge)
+ {
+-	struct drm_encoder *encoder;
+-
+-	if (!bridge)
+-		return;
+-
+-	encoder = bridge->encoder;
+-	list_for_each_entry_from(bridge, &encoder->bridge_chain, chain_node) {
+-		if (bridge->funcs->post_disable)
+-			bridge->funcs->post_disable(bridge);
+-	}
++	drm_atomic_bridge_chain_post_disable(bridge, NULL);
+ }
+ EXPORT_SYMBOL(drm_bridge_chain_post_disable);
+ 
+@@ -602,24 +597,14 @@ EXPORT_SYMBOL(drm_bridge_chain_mode_set)
+  * chain, starting from the last bridge to the first. These are called
+  * before calling the encoder's commit op.
+  *
++ * If a bridge sets @pre_enable_upstream_first, then the @pre_enable for the
++ * previous bridge will be called before @pre_enable of this bridge.
++ *
+  * Note: the bridge passed should be the one closest to the encoder
+  */
+ void drm_bridge_chain_pre_enable(struct drm_bridge *bridge)
+ {
+-	struct drm_encoder *encoder;
+-	struct drm_bridge *iter;
+-
+-	if (!bridge)
+-		return;
+-
+-	encoder = bridge->encoder;
+-	list_for_each_entry_reverse(iter, &encoder->bridge_chain, chain_node) {
+-		if (iter->funcs->pre_enable)
+-			iter->funcs->pre_enable(iter);
+-
+-		if (iter == bridge)
+-			break;
+-	}
++	drm_atomic_bridge_chain_pre_enable(bridge, NULL);
+ }
+ EXPORT_SYMBOL(drm_bridge_chain_pre_enable);
+ 
+@@ -691,6 +676,25 @@ void drm_atomic_bridge_chain_disable(str
+ }
+ EXPORT_SYMBOL(drm_atomic_bridge_chain_disable);
+ 
++static void drm_atomic_bridge_call_post_disable(struct drm_bridge *bridge,
++						struct drm_atomic_state *old_state)
++{
++	if (old_state && bridge->funcs->atomic_post_disable) {
++		struct drm_bridge_state *old_bridge_state;
++
++		old_bridge_state =
++			drm_atomic_get_old_bridge_state(old_state,
++							bridge);
++		if (WARN_ON(!old_bridge_state))
++			return;
++
++		bridge->funcs->atomic_post_disable(bridge,
++						   old_bridge_state);
++	} else if (bridge->funcs->post_disable) {
++		bridge->funcs->post_disable(bridge);
++	}
++}
++
+ /**
+  * drm_atomic_bridge_chain_post_disable - cleans up after disabling all bridges
+  *					  in the encoder chain
+@@ -701,6 +705,9 @@ EXPORT_SYMBOL(drm_atomic_bridge_chain_di
+  * &drm_bridge_funcs.post_disable) op for all the bridges in the encoder chain,
+  * starting from the first bridge to the last. These are called after completing
+  * &drm_encoder_helper_funcs.atomic_disable
++ * If a bridge sets @pre_enable_upstream_first, then the @post_disable for that
++ * bridge will be called before the previous one to reverse the @pre_enable
++ * calling direction.
+  *
+  * Note: the bridge passed should be the one closest to the encoder
+  */
+@@ -708,30 +715,75 @@ void drm_atomic_bridge_chain_post_disabl
+ 					  struct drm_atomic_state *old_state)
+ {
+ 	struct drm_encoder *encoder;
++	struct drm_bridge *next, *limit;
+ 
+ 	if (!bridge)
+ 		return;
+ 
+ 	encoder = bridge->encoder;
++
+ 	list_for_each_entry_from(bridge, &encoder->bridge_chain, chain_node) {
+-		if (bridge->funcs->atomic_post_disable) {
+-			struct drm_bridge_state *old_bridge_state;
++		limit = NULL;
+ 
+-			old_bridge_state =
+-				drm_atomic_get_old_bridge_state(old_state,
+-								bridge);
+-			if (WARN_ON(!old_bridge_state))
+-				return;
++		if (!list_is_last(&bridge->chain_node, &encoder->bridge_chain)) {
++			next = list_next_entry(bridge, chain_node);
+ 
+-			bridge->funcs->atomic_post_disable(bridge,
+-							   old_bridge_state);
+-		} else if (bridge->funcs->post_disable) {
+-			bridge->funcs->post_disable(bridge);
++			if (next->pre_enable_upstream_first) {
++				/* Downstream bridge had requested that upstream
++				 * was enabled first, so disabled last
++				 */
++				limit = next;
++
++				/* Find the next bridge that has NOT requested
++				 * upstream to be enabled first / disabled last
++				 */
++				list_for_each_entry_from(next, &encoder->bridge_chain,
++							 chain_node) {
++					if (next->pre_enable_upstream_first) {
++						next = list_prev_entry(next, chain_node);
++						limit = next;
++						break;
++					}
++				}
++
++				/* Call these bridges in reverse order */
++				list_for_each_entry_from_reverse(next, &encoder->bridge_chain,
++								 chain_node) {
++					if (next == bridge)
++						break;
++
++					drm_atomic_bridge_call_post_disable(next,
++									    old_state);
++				}
++			}
+ 		}
++
++		drm_atomic_bridge_call_post_disable(bridge, old_state);
++
++		if (limit)
++			bridge = limit;
+ 	}
+ }
+ EXPORT_SYMBOL(drm_atomic_bridge_chain_post_disable);
+ 
++static void drm_atomic_bridge_call_pre_enable(struct drm_bridge *bridge,
++					      struct drm_atomic_state *old_state)
++{
++	if (old_state && bridge->funcs->atomic_pre_enable) {
++		struct drm_bridge_state *old_bridge_state;
++
++		old_bridge_state =
++			drm_atomic_get_old_bridge_state(old_state,
++							bridge);
++		if (WARN_ON(!old_bridge_state))
++			return;
++
++		bridge->funcs->atomic_pre_enable(bridge, old_bridge_state);
++	} else if (bridge->funcs->pre_enable) {
++		bridge->funcs->pre_enable(bridge);
++	}
++}
++
+ /**
+  * drm_atomic_bridge_chain_pre_enable - prepares for enabling all bridges in
+  *					the encoder chain
+@@ -743,33 +795,62 @@ EXPORT_SYMBOL(drm_atomic_bridge_chain_po
+  * starting from the last bridge to the first. These are called before calling
+  * &drm_encoder_helper_funcs.atomic_enable
+  *
++ * If a bridge sets @pre_enable_upstream_first, then the pre_enable for the
++ * upstream bridge will be called before pre_enable of this bridge.
++ *
+  * Note: the bridge passed should be the one closest to the encoder
+  */
+ void drm_atomic_bridge_chain_pre_enable(struct drm_bridge *bridge,
+ 					struct drm_atomic_state *old_state)
+ {
+ 	struct drm_encoder *encoder;
+-	struct drm_bridge *iter;
++	struct drm_bridge *iter, *next, *limit;
+ 
+ 	if (!bridge)
+ 		return;
+ 
+ 	encoder = bridge->encoder;
+-	list_for_each_entry_reverse(iter, &encoder->bridge_chain, chain_node) {
+-		if (iter->funcs->atomic_pre_enable) {
+-			struct drm_bridge_state *old_bridge_state;
+ 
+-			old_bridge_state =
+-				drm_atomic_get_old_bridge_state(old_state,
+-								iter);
+-			if (WARN_ON(!old_bridge_state))
+-				return;
++	list_for_each_entry_reverse(iter, &encoder->bridge_chain, chain_node) {
++		if (iter->pre_enable_upstream_first) {
++			next = iter;
++			limit = bridge;
++			list_for_each_entry_from_reverse(next,
++							 &encoder->bridge_chain,
++							 chain_node) {
++				if (next == bridge)
++					break;
++
++				if (!next->pre_enable_upstream_first) {
++					/* Found first bridge that does NOT
++					 * request upstream to be enabled first
++					 */
++					limit = list_prev_entry(next, chain_node);
++					break;
++				}
++			}
++
++			list_for_each_entry_from(next, &encoder->bridge_chain, chain_node) {
++				/* Call requested upstream bridge pre_enable
++				 * in order.
++				 */
++				if (next == iter)
++					/* At the first bridgge to request upstream
++					 * bridges called first.
++					 */
++					break;
+ 
+-			iter->funcs->atomic_pre_enable(iter, old_bridge_state);
+-		} else if (iter->funcs->pre_enable) {
+-			iter->funcs->pre_enable(iter);
++				drm_atomic_bridge_call_pre_enable(next, old_state);
++			}
+ 		}
+ 
++		drm_atomic_bridge_call_pre_enable(iter, old_state);
++
++		if (iter->pre_enable_upstream_first)
++			/* Jump all bridges that we have already pre_enabled
++			 */
++			iter = limit;
++
+ 		if (iter == bridge)
+ 			break;
+ 	}
+--- a/include/drm/drm_bridge.h
++++ b/include/drm/drm_bridge.h
+@@ -769,6 +769,14 @@ struct drm_bridge {
+ 	 */
+ 	bool interlace_allowed;
+ 	/**
++	 * @pre_enable_upstream_first: The bridge requires that the upstream
++	 * bridge @pre_enable function is called before its @pre_enable,
++	 * and conversely for post_disable. This is most frequently a
++	 * requirement for DSI devices which need the host to be initialised
++	 * before the peripheral.
++	 */
++	bool pre_enable_upstream_first;
++	/**
+ 	 * @ddc: Associated I2C adapter for DDC access, if any.
+ 	 */
+ 	struct i2c_adapter *ddc;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0035-drm-panel-Add-prepare_upstream_first-flag-to-drm_pan.patch b/target/linux/bcm27xx/patches-6.1/950-0035-drm-panel-Add-prepare_upstream_first-flag-to-drm_pan.patch
new file mode 100644
index 00000000000000..6ca65ab3f3ca1e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0035-drm-panel-Add-prepare_upstream_first-flag-to-drm_pan.patch
@@ -0,0 +1,48 @@
+From 9ac3eedd8cda7d5f2429edc0bdba137c35e07157 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 23 Feb 2022 15:36:56 +0000
+Subject: [PATCH] drm/panel: Add prepare_upstream_first flag to
+ drm_panel
+
+Mapping to the drm_bridge flag pre_enable_upstream_first,
+add a new flag prepare_upstream_first to drm_panel to allow
+the panel driver to request that the upstream bridge should
+be pre_enabled before the panel prepare.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/bridge/panel.c |  3 +++
+ include/drm/drm_panel.h        | 10 ++++++++++
+ 2 files changed, 13 insertions(+)
+
+--- a/drivers/gpu/drm/bridge/panel.c
++++ b/drivers/gpu/drm/bridge/panel.c
+@@ -258,6 +258,9 @@ struct drm_bridge *drm_panel_bridge_add_
+ 	panel_bridge->bridge.ops = DRM_BRIDGE_OP_MODES;
+ 	panel_bridge->bridge.type = connector_type;
+ 
++	panel_bridge->bridge.pre_enable_upstream_first =
++						panel->prepare_upstream_first;
++
+ 	drm_bridge_add(&panel_bridge->bridge);
+ 
+ 	return &panel_bridge->bridge;
+--- a/include/drm/drm_panel.h
++++ b/include/drm/drm_panel.h
+@@ -196,6 +196,16 @@ struct drm_panel {
+ 	 * Panel entry in registry.
+ 	 */
+ 	struct list_head list;
++
++	/**
++	 * @prepare_upstream_first:
++	 *
++	 * The upstream controller should be prepared first, before the prepare
++	 * for the panel is called. This is largely required for DSI panels
++	 * where the DSI host controller should be initialised to LP-11 before
++	 * the panel is powered up.
++	 */
++	bool prepare_upstream_first;
+ };
+ 
+ void drm_panel_init(struct drm_panel *panel, struct device *dev,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0036-drm-Include-drm_connector.h-from-drm_panel.h.patch b/target/linux/bcm27xx/patches-6.1/950-0036-drm-Include-drm_connector.h-from-drm_panel.h.patch
new file mode 100644
index 00000000000000..75a4a30cafbea6
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0036-drm-Include-drm_connector.h-from-drm_panel.h.patch
@@ -0,0 +1,36 @@
+From 16e9466e562335961f89ec25bd60bff4cf82f7ad Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 11 Mar 2022 17:24:37 +0000
+Subject: [PATCH] drm: Include drm_connector.h from drm_panel.h
+
+drm_panel.h wants to reference enum drm_panel_orientation which is defined
+in drm_connector.h (despite the name).
+Include drm_connector.h in drm_panel.h to avoid the rare situation where
+drm_panel.h is used with drm_connector.h
+
+https://github.com/raspberrypi/linux/issues/4919
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ include/drm/drm_panel.h | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/include/drm/drm_panel.h
++++ b/include/drm/drm_panel.h
+@@ -24,6 +24,7 @@
+ #ifndef __DRM_PANEL_H__
+ #define __DRM_PANEL_H__
+ 
++#include <drm/drm_connector.h>
+ #include <linux/err.h>
+ #include <linux/errno.h>
+ #include <linux/list.h>
+@@ -36,8 +37,6 @@ struct drm_device;
+ struct drm_panel;
+ struct display_timing;
+ 
+-enum drm_panel_orientation;
+-
+ /**
+  * struct drm_panel_funcs - perform operations on a given panel
+  *
diff --git a/target/linux/bcm27xx/patches-6.1/950-0037-drm-tc358762-Set-the-pre_enable_upstream_first-flag-.patch b/target/linux/bcm27xx/patches-6.1/950-0037-drm-tc358762-Set-the-pre_enable_upstream_first-flag-.patch
new file mode 100644
index 00000000000000..2cf35236bda573
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0037-drm-tc358762-Set-the-pre_enable_upstream_first-flag-.patch
@@ -0,0 +1,25 @@
+From 2551dd11f3c6f1633f7aa9ec2c68b1c9831b3559 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 16 Dec 2021 15:33:43 +0000
+Subject: [PATCH] drm/tc358762: Set the pre_enable_upstream_first flag
+ to configure DSI host
+
+TC358762 wants the DSI host to be prepared before it is powered up, so
+set the flag to request that the upstream bridges have their
+pre_enable called first.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/bridge/tc358762.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/bridge/tc358762.c
++++ b/drivers/gpu/drm/bridge/tc358762.c
+@@ -229,6 +229,7 @@ static int tc358762_probe(struct mipi_ds
+ 	ctx->bridge.funcs = &tc358762_bridge_funcs;
+ 	ctx->bridge.type = DRM_MODE_CONNECTOR_DPI;
+ 	ctx->bridge.of_node = dev->of_node;
++	ctx->bridge.pre_enable_upstream_first = true;
+ 
+ 	drm_bridge_add(&ctx->bridge);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0038-drm-vc4-Support-zpos-on-all-planes.patch b/target/linux/bcm27xx/patches-6.1/950-0038-drm-vc4-Support-zpos-on-all-planes.patch
new file mode 100644
index 00000000000000..068862766f696d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0038-drm-vc4-Support-zpos-on-all-planes.patch
@@ -0,0 +1,144 @@
+From 7354aa4ed8b97b3bd7706e6440a087491a47fb39 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 25 Jan 2022 17:28:18 +0000
+Subject: [PATCH] drm/vc4: Support zpos on all planes
+
+Adds the zpos property to all planes, and creates the dlist
+by placing the fragments in the correct order based on zpos.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c   | 43 +++++++++++++++++++++------------
+ drivers/gpu/drm/vc4/vc4_kms.c   |  3 +--
+ drivers/gpu/drm/vc4/vc4_plane.c | 22 ++++++++++++++---
+ 3 files changed, 48 insertions(+), 20 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -769,6 +769,8 @@ void vc4_hvs_atomic_flush(struct drm_crt
+ 	bool enable_bg_fill = false;
+ 	u32 __iomem *dlist_start = vc4->hvs->dlist + vc4_state->mm.start;
+ 	u32 __iomem *dlist_next = dlist_start;
++	unsigned int zpos = 0;
++	bool found = false;
+ 	int idx;
+ 
+ 	if (!drm_dev_enter(dev, &idx)) {
+@@ -782,23 +784,34 @@ void vc4_hvs_atomic_flush(struct drm_crt
+ 	}
+ 
+ 	/* Copy all the active planes' dlist contents to the hardware dlist. */
+-	drm_atomic_crtc_for_each_plane(plane, crtc) {
+-		/* Is this the first active plane? */
+-		if (dlist_next == dlist_start) {
+-			/* We need to enable background fill when a plane
+-			 * could be alpha blending from the background, i.e.
+-			 * where no other plane is underneath. It suffices to
+-			 * consider the first active plane here since we set
+-			 * needs_bg_fill such that either the first plane
+-			 * already needs it or all planes on top blend from
+-			 * the first or a lower plane.
+-			 */
+-			vc4_plane_state = to_vc4_plane_state(plane->state);
+-			enable_bg_fill = vc4_plane_state->needs_bg_fill;
++	do {
++		found = false;
++
++		drm_atomic_crtc_for_each_plane(plane, crtc) {
++			if (plane->state->normalized_zpos != zpos)
++				continue;
++
++			/* Is this the first active plane? */
++			if (dlist_next == dlist_start) {
++				/* We need to enable background fill when a plane
++				 * could be alpha blending from the background, i.e.
++				 * where no other plane is underneath. It suffices to
++				 * consider the first active plane here since we set
++				 * needs_bg_fill such that either the first plane
++				 * already needs it or all planes on top blend from
++				 * the first or a lower plane.
++				 */
++				vc4_plane_state = to_vc4_plane_state(plane->state);
++				enable_bg_fill = vc4_plane_state->needs_bg_fill;
++			}
++
++			dlist_next += vc4_plane_write_dlist(plane, dlist_next);
++
++			found = true;
+ 		}
+ 
+-		dlist_next += vc4_plane_write_dlist(plane, dlist_next);
+-	}
++		zpos++;
++	} while (found);
+ 
+ 	writel(SCALER_CTL0_END, dlist_next);
+ 	dlist_next++;
+--- a/drivers/gpu/drm/vc4/vc4_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_kms.c
+@@ -1066,8 +1066,7 @@ int vc4_kms_load(struct drm_device *dev)
+ 	dev->mode_config.helper_private = &vc4_mode_config_helpers;
+ 	dev->mode_config.preferred_depth = 24;
+ 	dev->mode_config.async_page_flip = true;
+-	if (vc4->firmware_kms)
+-		dev->mode_config.normalize_zpos = true;
++	dev->mode_config.normalize_zpos = true;
+ 
+ 	ret = vc4_ctm_obj_init(vc4);
+ 	if (ret)
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -1600,9 +1600,14 @@ struct drm_plane *vc4_plane_init(struct
+ 					  DRM_COLOR_YCBCR_BT709,
+ 					  DRM_COLOR_YCBCR_LIMITED_RANGE);
+ 
++	if (type == DRM_PLANE_TYPE_PRIMARY)
++		drm_plane_create_zpos_immutable_property(plane, 0);
++
+ 	return plane;
+ }
+ 
++#define VC4_NUM_OVERLAY_PLANES	16
++
+ int vc4_plane_create_additional_planes(struct drm_device *drm)
+ {
+ 	struct drm_plane *cursor_plane;
+@@ -1618,24 +1623,35 @@ int vc4_plane_create_additional_planes(s
+ 	 * modest number of planes to expose, that should hopefully
+ 	 * still cover any sane usecase.
+ 	 */
+-	for (i = 0; i < 16; i++) {
++	for (i = 0; i < VC4_NUM_OVERLAY_PLANES; i++) {
+ 		struct drm_plane *plane =
+ 			vc4_plane_init(drm, DRM_PLANE_TYPE_OVERLAY,
+ 				       GENMASK(drm->mode_config.num_crtc - 1, 0));
+ 
+ 		if (IS_ERR(plane))
+ 			continue;
++
++		/* Create zpos property. Max of all the overlays + 1 primary +
++		 * 1 cursor plane on a crtc.
++		 */
++		drm_plane_create_zpos_property(plane, i + 1, 1,
++					       VC4_NUM_OVERLAY_PLANES + 1);
+ 	}
+ 
+ 	drm_for_each_crtc(crtc, drm) {
+ 		/* Set up the legacy cursor after overlay initialization,
+-		 * since we overlay planes on the CRTC in the order they were
+-		 * initialized.
++		 * since the zpos fallback is that planes are rendered by plane
++		 * ID order, and that then puts the cursor on top.
+ 		 */
+ 		cursor_plane = vc4_plane_init(drm, DRM_PLANE_TYPE_CURSOR,
+ 					      drm_crtc_mask(crtc));
+ 		if (!IS_ERR(cursor_plane)) {
+ 			crtc->cursor = cursor_plane;
++
++			drm_plane_create_zpos_property(cursor_plane,
++						       VC4_NUM_OVERLAY_PLANES + 1,
++						       1,
++						       VC4_NUM_OVERLAY_PLANES + 1);
+ 		}
+ 	}
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0039-drm-vc4-hdmi-Add-CSC-for-BT601-709-2020-limited-and-.patch b/target/linux/bcm27xx/patches-6.1/950-0039-drm-vc4-hdmi-Add-CSC-for-BT601-709-2020-limited-and-.patch
new file mode 100644
index 00000000000000..b1fa4825e581e6
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0039-drm-vc4-hdmi-Add-CSC-for-BT601-709-2020-limited-and-.patch
@@ -0,0 +1,301 @@
+From 6729f3d6ace95770cfda201fd04fafcc2e46fd36 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 7 Mar 2022 15:19:38 +0000
+Subject: [PATCH] drm/vc4: hdmi: Add CSC for BT601/709/2020 limited and
+ full range output
+
+The HVS always composes in the RGB domain, but there is a colourspace
+conversion block on the output to allow for sending YCbCr over the
+HDMI interface.
+The colourspace on that link is configurable via the "Colorspace"
+property on the connector, and that updates the infoframes. There
+is also selection of limited or full range based on the mode selected
+or an override.
+
+Add code to update the CSC as well so that the metadata matches the
+image data.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 196 ++++++++++++++++++++++++---------
+ 1 file changed, 145 insertions(+), 51 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -158,8 +158,8 @@ static bool vc4_hdmi_mode_needs_scrambli
+ 	return clock > HDMI_14_MAX_TMDS_CLK;
+ }
+ 
+-static bool vc4_hdmi_is_full_range_rgb(struct vc4_hdmi *vc4_hdmi,
+-				       const struct drm_display_mode *mode)
++static bool vc4_hdmi_is_full_range(struct vc4_hdmi *vc4_hdmi,
++				   const struct drm_display_mode *mode)
+ {
+ 	struct drm_display_info *display = &vc4_hdmi->connector.display_info;
+ 
+@@ -901,7 +901,7 @@ static void vc4_hdmi_set_avi_infoframe(s
+ 
+ 	drm_hdmi_avi_infoframe_quant_range(&frame.avi,
+ 					   connector, mode,
+-					   vc4_hdmi_is_full_range_rgb(vc4_hdmi, mode) ?
++					   vc4_hdmi_is_full_range(vc4_hdmi, mode) ?
+ 					   HDMI_QUANTIZATION_RANGE_FULL :
+ 					   HDMI_QUANTIZATION_RANGE_LIMITED);
+ 	drm_hdmi_avi_infoframe_colorimetry(&frame.avi, cstate);
+@@ -1154,7 +1154,7 @@ static void vc4_hdmi_csc_setup(struct vc
+ 	csc_ctl = VC4_SET_FIELD(VC4_HD_CSC_CTL_ORDER_BGR,
+ 				VC4_HD_CSC_CTL_ORDER);
+ 
+-	if (!vc4_hdmi_is_full_range_rgb(vc4_hdmi, mode)) {
++	if (!vc4_hdmi_is_full_range(vc4_hdmi, mode)) {
+ 		/* CEA VICs other than #1 requre limited range RGB
+ 		 * output unless overridden by an AVI infoframe.
+ 		 * Apply a colorspace conversion to squash 0-255 down
+@@ -1193,15 +1193,6 @@ static void vc4_hdmi_csc_setup(struct vc
+  * [ 0      1      0      0]
+  * [ 0      0      1      0]
+  *
+- * Matrix is signed 2p13 fixed point, with signed 9p6 offsets
+- */
+-static const u16 vc5_hdmi_csc_full_rgb_unity[3][4] = {
+-	{ 0x2000, 0x0000, 0x0000, 0x0000 },
+-	{ 0x0000, 0x2000, 0x0000, 0x0000 },
+-	{ 0x0000, 0x0000, 0x2000, 0x0000 },
+-};
+-
+-/*
+  * CEA VICs other than #1 require limited range RGB output unless
+  * overridden by an AVI infoframe. Apply a colorspace conversion to
+  * squash 0-255 down to 16-235. The matrix here is:
+@@ -1212,43 +1203,105 @@ static const u16 vc5_hdmi_csc_full_rgb_u
+  *
+  * Matrix is signed 2p13 fixed point, with signed 9p6 offsets
+  */
+-static const u16 vc5_hdmi_csc_full_rgb_to_limited_rgb[3][4] = {
+-	{ 0x1b80, 0x0000, 0x0000, 0x0400 },
+-	{ 0x0000, 0x1b80, 0x0000, 0x0400 },
+-	{ 0x0000, 0x0000, 0x1b80, 0x0400 },
++static const u16 vc5_hdmi_csc_full_rgb_to_rgb[2][3][4] = {
++	{
++		/* Full range - unity */
++		{ 0x2000, 0x0000, 0x0000, 0x0000 },
++		{ 0x0000, 0x2000, 0x0000, 0x0000 },
++		{ 0x0000, 0x0000, 0x2000, 0x0000 },
++	}, {
++		/* Limited range */
++		{ 0x1b80, 0x0000, 0x0000, 0x0400 },
++		{ 0x0000, 0x1b80, 0x0000, 0x0400 },
++		{ 0x0000, 0x0000, 0x1b80, 0x0400 },
++	}
++};
++
++/*
++ * Conversion between Full Range RGB and YUV using the BT.601 Colorspace
++ *
++ * Full range
++ * [    0.299000   0.587000   0.114000   0.000000 ]
++ * [   -0.168736  -0.331264   0.500000 128.000000 ]
++ * [    0.500000  -0.418688  -0.081312 128.000000 ]
++ *
++ * Limited range
++ * [    0.255785   0.502160   0.097523  16.000000 ]
++ * [   -0.147644  -0.289856   0.437500 128.000000 ]
++ * [    0.437500  -0.366352  -0.071148 128.000000 ]
++ *
++ * Matrix is signed 2p13 fixed point, with signed 9p6 offsets
++ */
++static const u16 vc5_hdmi_csc_full_rgb_to_yuv_bt601[2][3][4] = {
++	{
++		/* Full range */
++		{ 0x0991, 0x12c9, 0x03a6, 0x0000 },
++		{ 0xfa9b, 0xf567, 0x1000, 0x2000 },
++		{ 0x1000, 0xf29b, 0xfd67, 0x2000 },
++	}, {
++		/* Limited range */
++		{ 0x082f, 0x1012, 0x031f, 0x0400 },
++		{ 0xfb48, 0xf6ba, 0x0e00, 0x2000 },
++		{ 0x0e00, 0xf448, 0xfdba, 0x2000 },
++	}
+ };
+ 
+ /*
+- * Conversion between Full Range RGB and Full Range YUV422 using the
+- * BT.709 Colorspace
++ * Conversion between Full Range RGB and YUV using the BT.709 Colorspace
+  *
++ * Full range
++ * [    0.212600   0.715200   0.072200   0.000000 ]
++ * [   -0.114572  -0.385428   0.500000 128.000000 ]
++ * [    0.500000  -0.454153  -0.045847 128.000000 ]
+  *
+- * [  0.181906  0.611804  0.061758  16  ]
+- * [ -0.100268 -0.337232  0.437500  128 ]
+- * [  0.437500 -0.397386 -0.040114  128 ]
++ * Limited range
++ * [    0.181873   0.611831   0.061765  16.000000 ]
++ * [   -0.100251  -0.337249   0.437500 128.000000 ]
++ * [    0.437500  -0.397384  -0.040116 128.000000 ]
+  *
+  * Matrix is signed 2p13 fixed point, with signed 9p6 offsets
+  */
+-static const u16 vc5_hdmi_csc_full_rgb_to_limited_yuv422_bt709[3][4] = {
+-	{ 0x05d2, 0x1394, 0x01fa, 0x0400 },
+-	{ 0xfccc, 0xf536, 0x0e00, 0x2000 },
+-	{ 0x0e00, 0xf34a, 0xfeb8, 0x2000 },
++static const u16 vc5_hdmi_csc_full_rgb_to_yuv_bt709[2][3][4] = {
++	{
++		/* Full range */
++		{ 0x06ce, 0x16e3, 0x024f, 0x0000 },
++		{ 0xfc56, 0xf3ac, 0x1000, 0x2000 },
++		{ 0x1000, 0xf179, 0xfe89, 0x2000 },
++	}, {
++		/* Limited range	*/
++		{ 0x05d2, 0x1394, 0x01fa, 0x0400 },
++		{ 0xfccc, 0xf536, 0x0e00, 0x2000 },
++		{ 0x0e00, 0xf34a, 0xfeb8, 0x2000 },
++	}
+ };
+ 
+ /*
+- * Conversion between Full Range RGB and Full Range YUV444 using the
+- * BT.709 Colorspace
++ * Conversion between Full Range RGB and YUV using the BT.2020 Colorspace
+  *
+- * [ -0.100268 -0.337232  0.437500  128 ]
+- * [  0.437500 -0.397386 -0.040114  128 ]
+- * [  0.181906  0.611804  0.061758  16  ]
++ * Full range
++ * [    0.262700   0.678000   0.059300   0.000000 ]
++ * [   -0.139630  -0.360370   0.500000 128.000000 ]
++ * [    0.500000  -0.459786  -0.040214 128.000000 ]
++ *
++ * Limited range
++ * [    0.224732   0.580008   0.050729  16.000000 ]
++ * [   -0.122176  -0.315324   0.437500 128.000000 ]
++ * [    0.437500  -0.402312  -0.035188 128.000000 ]
+  *
+  * Matrix is signed 2p13 fixed point, with signed 9p6 offsets
+  */
+-static const u16 vc5_hdmi_csc_full_rgb_to_limited_yuv444_bt709[3][4] = {
+-	{ 0xfccc, 0xf536, 0x0e00, 0x2000 },
+-	{ 0x0e00, 0xf34a, 0xfeb8, 0x2000 },
+-	{ 0x05d2, 0x1394, 0x01fa, 0x0400 },
++static const u16 vc5_hdmi_csc_full_rgb_to_yuv_bt2020[2][3][4] = {
++	{
++		/* Full range */
++		{ 0x0868, 0x15b2, 0x01e6, 0x0000 },
++		{ 0xfb89, 0xf479, 0x1000, 0x2000 },
++		{ 0x1000, 0xf14a, 0xfeb8, 0x2000 },
++	}, {
++		/* Limited range */
++		{ 0x0731, 0x128f, 0x01a0, 0x0400 },
++		{ 0xfc18, 0xf5ea, 0x0e00, 0x2000 },
++		{ 0x0e00, 0xf321, 0xfee1, 0x2000 },
++	}
+ };
+ 
+ static void vc5_hdmi_set_csc_coeffs(struct vc4_hdmi *vc4_hdmi,
+@@ -1264,6 +1317,20 @@ static void vc5_hdmi_set_csc_coeffs(stru
+ 	HDMI_WRITE(HDMI_CSC_34_33, (coeffs[2][3] << 16) | coeffs[2][2]);
+ }
+ 
++static void vc5_hdmi_set_csc_coeffs_swap(struct vc4_hdmi *vc4_hdmi,
++					 const u16 coeffs[3][4])
++{
++	lockdep_assert_held(&vc4_hdmi->hw_lock);
++
++	/* YUV444 needs the CSC matrices using the channels in a different order */
++	HDMI_WRITE(HDMI_CSC_12_11, (coeffs[2][1] << 16) | coeffs[2][0]);
++	HDMI_WRITE(HDMI_CSC_14_13, (coeffs[2][3] << 16) | coeffs[2][2]);
++	HDMI_WRITE(HDMI_CSC_22_21, (coeffs[0][1] << 16) | coeffs[0][0]);
++	HDMI_WRITE(HDMI_CSC_24_23, (coeffs[0][3] << 16) | coeffs[0][2]);
++	HDMI_WRITE(HDMI_CSC_32_31, (coeffs[1][1] << 16) | coeffs[1][0]);
++	HDMI_WRITE(HDMI_CSC_34_33, (coeffs[1][3] << 16) | coeffs[1][2]);
++}
++
+ static void vc5_hdmi_csc_setup(struct vc4_hdmi *vc4_hdmi,
+ 			       struct drm_connector_state *state,
+ 			       const struct drm_display_mode *mode)
+@@ -1271,6 +1338,8 @@ static void vc5_hdmi_csc_setup(struct vc
+ 	struct drm_device *drm = vc4_hdmi->connector.dev;
+ 	struct vc4_hdmi_connector_state *vc4_state =
+ 		conn_state_to_vc4_hdmi_conn_state(state);
++	unsigned int lim_range = vc4_hdmi_is_full_range(vc4_hdmi, mode) ? 0 : 1;
++	const u16 (*csc)[4];
+ 	unsigned long flags;
+ 	u32 if_cfg = 0;
+ 	u32 if_xbar = 0x543210;
+@@ -1286,31 +1355,56 @@ static void vc5_hdmi_csc_setup(struct vc
+ 
+ 	switch (vc4_state->output_format) {
+ 	case VC4_HDMI_OUTPUT_YUV444:
+-		vc5_hdmi_set_csc_coeffs(vc4_hdmi, vc5_hdmi_csc_full_rgb_to_limited_yuv444_bt709);
+-		break;
+-
+ 	case VC4_HDMI_OUTPUT_YUV422:
+-		csc_ctl |= VC4_SET_FIELD(VC5_MT_CP_CSC_CTL_FILTER_MODE_444_TO_422_STANDARD,
+-					 VC5_MT_CP_CSC_CTL_FILTER_MODE_444_TO_422) |
+-			VC5_MT_CP_CSC_CTL_USE_444_TO_422 |
+-			VC5_MT_CP_CSC_CTL_USE_RNG_SUPPRESSION;
+-
+-		csc_chan_ctl |= VC4_SET_FIELD(VC5_MT_CP_CHANNEL_CTL_OUTPUT_REMAP_LEGACY_STYLE,
+-					      VC5_MT_CP_CHANNEL_CTL_OUTPUT_REMAP);
++		switch (state->colorspace) {
++		default:
++		case DRM_MODE_COLORIMETRY_NO_DATA:
++		case DRM_MODE_COLORIMETRY_BT709_YCC:
++		case DRM_MODE_COLORIMETRY_XVYCC_709:
++		case DRM_MODE_COLORIMETRY_RGB_WIDE_FIXED:
++		case DRM_MODE_COLORIMETRY_RGB_WIDE_FLOAT:
++			csc = vc5_hdmi_csc_full_rgb_to_yuv_bt709[lim_range];
++			break;
++		case DRM_MODE_COLORIMETRY_SMPTE_170M_YCC:
++		case DRM_MODE_COLORIMETRY_XVYCC_601:
++		case DRM_MODE_COLORIMETRY_SYCC_601:
++		case DRM_MODE_COLORIMETRY_OPYCC_601:
++		case DRM_MODE_COLORIMETRY_BT601_YCC:
++			csc = vc5_hdmi_csc_full_rgb_to_yuv_bt601[lim_range];
++			break;
++		case DRM_MODE_COLORIMETRY_BT2020_CYCC:
++		case DRM_MODE_COLORIMETRY_BT2020_YCC:
++		case DRM_MODE_COLORIMETRY_BT2020_RGB:
++		case DRM_MODE_COLORIMETRY_DCI_P3_RGB_D65:
++		case DRM_MODE_COLORIMETRY_DCI_P3_RGB_THEATER:
++			csc = vc5_hdmi_csc_full_rgb_to_yuv_bt2020[lim_range];
++			break;
++		}
+ 
+-		if_cfg |= VC4_SET_FIELD(VC5_DVP_HT_VEC_INTERFACE_CFG_SEL_422_FORMAT_422_LEGACY,
+-					VC5_DVP_HT_VEC_INTERFACE_CFG_SEL_422);
++		if (vc4_state->output_format == VC4_HDMI_OUTPUT_YUV422) {
++			csc_ctl |= VC4_SET_FIELD(VC5_MT_CP_CSC_CTL_FILTER_MODE_444_TO_422_STANDARD,
++						 VC5_MT_CP_CSC_CTL_FILTER_MODE_444_TO_422) |
++				VC5_MT_CP_CSC_CTL_USE_444_TO_422 |
++				VC5_MT_CP_CSC_CTL_USE_RNG_SUPPRESSION;
++
++			csc_chan_ctl |= VC4_SET_FIELD(VC5_MT_CP_CHANNEL_CTL_OUTPUT_REMAP_LEGACY_STYLE,
++						      VC5_MT_CP_CHANNEL_CTL_OUTPUT_REMAP);
++
++			if_cfg |= VC4_SET_FIELD(VC5_DVP_HT_VEC_INTERFACE_CFG_SEL_422_FORMAT_422_LEGACY,
++						VC5_DVP_HT_VEC_INTERFACE_CFG_SEL_422);
++
++			vc5_hdmi_set_csc_coeffs(vc4_hdmi, csc);
++		} else {
++			vc5_hdmi_set_csc_coeffs_swap(vc4_hdmi, csc);
++		}
+ 
+-		vc5_hdmi_set_csc_coeffs(vc4_hdmi, vc5_hdmi_csc_full_rgb_to_limited_yuv422_bt709);
+ 		break;
+ 
+ 	case VC4_HDMI_OUTPUT_RGB:
+ 		if_xbar = 0x354021;
+ 
+-		if (!vc4_hdmi_is_full_range_rgb(vc4_hdmi, mode))
+-			vc5_hdmi_set_csc_coeffs(vc4_hdmi, vc5_hdmi_csc_full_rgb_to_limited_rgb);
+-		else
+-			vc5_hdmi_set_csc_coeffs(vc4_hdmi, vc5_hdmi_csc_full_rgb_unity);
++		vc5_hdmi_set_csc_coeffs(vc4_hdmi,
++					vc5_hdmi_csc_full_rgb_to_rgb[lim_range]);
+ 		break;
+ 
+ 	default:
diff --git a/target/linux/bcm27xx/patches-6.1/950-0040-vc4-drm-vc4_plane-Keep-fractional-source-coords-insi.patch b/target/linux/bcm27xx/patches-6.1/950-0040-vc4-drm-vc4_plane-Keep-fractional-source-coords-insi.patch
new file mode 100644
index 00000000000000..0b4b2bc6cdf0d5
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0040-vc4-drm-vc4_plane-Keep-fractional-source-coords-insi.patch
@@ -0,0 +1,212 @@
+From dabc8fbdb2e159d27b5f02ac428fa5788c2c4c2a Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Mon, 14 Mar 2022 17:56:10 +0000
+Subject: [PATCH] vc4/drm: vc4_plane: Keep fractional source coords
+ inside state
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_drv.h   |  2 +-
+ drivers/gpu/drm/vc4/vc4_plane.c | 68 ++++++++++++++++-----------------
+ 2 files changed, 34 insertions(+), 36 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -384,7 +384,7 @@ struct vc4_plane_state {
+ 
+ 	/* Clipped coordinates of the plane on the display. */
+ 	int crtc_x, crtc_y, crtc_w, crtc_h;
+-	/* Clipped area being scanned from in the FB. */
++	/* Clipped area being scanned from in the FB in u16.16 format */
+ 	u32 src_x, src_y;
+ 
+ 	u32 src_w[2], src_h[2];
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -183,9 +183,9 @@ static const struct hvs_format *vc4_get_
+ 
+ static enum vc4_scaling_mode vc4_get_scaling_mode(u32 src, u32 dst)
+ {
+-	if (dst == src)
++	if (dst == src >> 16)
+ 		return VC4_SCALING_NONE;
+-	if (3 * dst >= 2 * src)
++	if (3 * dst >= 2 * (src >> 16))
+ 		return VC4_SCALING_PPF;
+ 	else
+ 		return VC4_SCALING_TPZ;
+@@ -394,15 +394,10 @@ static int vc4_plane_setup_clipping_and_
+ 		vc4_state->offsets[i] = bo->dma_addr + fb->offsets[i];
+ 	}
+ 
+-	/*
+-	 * We don't support subpixel source positioning for scaling,
+-	 * but fractional coordinates can be generated by clipping
+-	 * so just round for now
+-	 */
+-	vc4_state->src_x = DIV_ROUND_CLOSEST(state->src.x1, 1 << 16);
+-	vc4_state->src_y = DIV_ROUND_CLOSEST(state->src.y1, 1 << 16);
+-	vc4_state->src_w[0] = DIV_ROUND_CLOSEST(state->src.x2, 1 << 16) - vc4_state->src_x;
+-	vc4_state->src_h[0] = DIV_ROUND_CLOSEST(state->src.y2, 1 << 16) - vc4_state->src_y;
++	vc4_state->src_x = state->src.x1;
++	vc4_state->src_y = state->src.y1;
++	vc4_state->src_w[0] = state->src.x2 - vc4_state->src_x;
++	vc4_state->src_h[0] = state->src.y2 - vc4_state->src_y;
+ 
+ 	vc4_state->crtc_x = state->dst.x1;
+ 	vc4_state->crtc_y = state->dst.y1;
+@@ -455,7 +450,7 @@ static void vc4_write_tpz(struct vc4_pla
+ {
+ 	u32 scale, recip;
+ 
+-	scale = (1 << 16) * src / dst;
++	scale = src / dst;
+ 
+ 	/* The specs note that while the reciprocal would be defined
+ 	 * as (1<<32)/scale, ~0 is close enough.
+@@ -501,7 +496,7 @@ static u32 vc4_lbm_size(struct drm_plane
+ 	if (vc4_state->x_scaling[0] == VC4_SCALING_TPZ)
+ 		pix_per_line = vc4_state->crtc_w;
+ 	else
+-		pix_per_line = vc4_state->src_w[0];
++		pix_per_line = vc4_state->src_w[0] >> 16;
+ 
+ 	if (!vc4_state->is_yuv) {
+ 		if (vc4_state->y_scaling[0] == VC4_SCALING_TPZ)
+@@ -592,7 +587,8 @@ static void vc4_plane_calc_load(struct d
+ 	for (i = 0; i < fb->format->num_planes; i++) {
+ 		/* Even if the bandwidth/plane required for a single frame is
+ 		 *
+-		 * vc4_state->src_w[i] * vc4_state->src_h[i] * cpp * vrefresh
++		 * (vc4_state->src_w[i] >> 16) * (vc4_state->src_h[i] >> 16) *
++		 *  cpp * vrefresh
+ 		 *
+ 		 * when downscaling, we have to read more pixels per line in
+ 		 * the time frame reserved for a single line, so the bandwidth
+@@ -601,11 +597,11 @@ static void vc4_plane_calc_load(struct d
+ 		 * load by this number. We're likely over-estimating the read
+ 		 * demand, but that's better than under-estimating it.
+ 		 */
+-		vscale_factor = DIV_ROUND_UP(vc4_state->src_h[i],
++		vscale_factor = DIV_ROUND_UP(vc4_state->src_h[i] >> 16,
+ 					     vc4_state->crtc_h);
+-		vc4_state->membus_load += vc4_state->src_w[i] *
+-					  vc4_state->src_h[i] * vscale_factor *
+-					  fb->format->cpp[i];
++		vc4_state->membus_load += (vc4_state->src_w[i] >> 16) *
++					  (vc4_state->src_h[i] >> 16) *
++					  vscale_factor * fb->format->cpp[i];
+ 		vc4_state->hvs_load += vc4_state->crtc_h * vc4_state->crtc_w;
+ 	}
+ 
+@@ -758,7 +754,8 @@ static int vc4_plane_mode_set(struct drm
+ 	bool mix_plane_alpha;
+ 	bool covers_screen;
+ 	u32 scl0, scl1, pitch0;
+-	u32 tiling, src_y;
++	u32 tiling, src_x, src_y;
++	u32 width, height;
+ 	u32 hvs_format = format->hvs;
+ 	unsigned int rotation;
+ 	int ret, i;
+@@ -770,6 +767,9 @@ static int vc4_plane_mode_set(struct drm
+ 	if (ret)
+ 		return ret;
+ 
++	width = vc4_state->src_w[0] >> 16;
++	height = vc4_state->src_h[0] >> 16;
++
+ 	/* SCL1 is used for Cb/Cr scaling of planar formats.  For RGB
+ 	 * and 4:4:4, scl1 should be set to scl0 so both channels of
+ 	 * the scaler do the same thing.  For YUV, the Y plane needs
+@@ -790,9 +790,11 @@ static int vc4_plane_mode_set(struct drm
+ 					 DRM_MODE_REFLECT_Y);
+ 
+ 	/* We must point to the last line when Y reflection is enabled. */
+-	src_y = vc4_state->src_y;
++	src_y = vc4_state->src_y >> 16;
+ 	if (rotation & DRM_MODE_REFLECT_Y)
+-		src_y += vc4_state->src_h[0] - 1;
++		src_y += height - 1;
++
++	src_x = vc4_state->src_x >> 16;
+ 
+ 	switch (base_format_mod) {
+ 	case DRM_FORMAT_MOD_LINEAR:
+@@ -807,7 +809,7 @@ static int vc4_plane_mode_set(struct drm
+ 						 (i ? v_subsample : 1) *
+ 						 fb->pitches[i];
+ 
+-			vc4_state->offsets[i] += vc4_state->src_x /
++			vc4_state->offsets[i] += src_x /
+ 						 (i ? h_subsample : 1) *
+ 						 fb->format->cpp[i];
+ 		}
+@@ -830,7 +832,7 @@ static int vc4_plane_mode_set(struct drm
+ 		 *	pitch * tile_h == tile_size * tiles_per_row
+ 		 */
+ 		u32 tiles_w = fb->pitches[0] >> (tile_size_shift - tile_h_shift);
+-		u32 tiles_l = vc4_state->src_x >> tile_w_shift;
++		u32 tiles_l = src_x >> tile_w_shift;
+ 		u32 tiles_r = tiles_w - tiles_l;
+ 		u32 tiles_t = src_y >> tile_h_shift;
+ 		/* Intra-tile offsets, which modify the base address (the
+@@ -840,7 +842,7 @@ static int vc4_plane_mode_set(struct drm
+ 		u32 tile_y = (src_y >> 4) & 1;
+ 		u32 subtile_y = (src_y >> 2) & 3;
+ 		u32 utile_y = src_y & 3;
+-		u32 x_off = vc4_state->src_x & tile_w_mask;
++		u32 x_off = src_x & tile_w_mask;
+ 		u32 y_off = src_y & tile_h_mask;
+ 
+ 		/* When Y reflection is requested we must set the
+@@ -936,7 +938,7 @@ static int vc4_plane_mode_set(struct drm
+ 				 * of the 12-pixels in that 128-bit word is the
+ 				 * first pixel to be used
+ 				 */
+-				u32 remaining_pixels = vc4_state->src_x % 96;
++				u32 remaining_pixels = src_x % 96;
+ 				u32 aligned = remaining_pixels / 12;
+ 				u32 last_bits = remaining_pixels % 12;
+ 
+@@ -958,12 +960,12 @@ static int vc4_plane_mode_set(struct drm
+ 					return -EINVAL;
+ 				}
+ 				pix_per_tile = tile_w / fb->format->cpp[0];
+-				x_off = (vc4_state->src_x % pix_per_tile) /
++				x_off = (src_x % pix_per_tile) /
+ 					(i ? h_subsample : 1) *
+ 					fb->format->cpp[i];
+ 			}
+ 
+-			tile = vc4_state->src_x / pix_per_tile;
++			tile = src_x / pix_per_tile;
+ 
+ 			vc4_state->offsets[i] += param * tile_w * tile;
+ 			vc4_state->offsets[i] += src_y /
+@@ -1024,10 +1026,8 @@ static int vc4_plane_mode_set(struct drm
+ 		vc4_dlist_write(vc4_state,
+ 				(mix_plane_alpha ? SCALER_POS2_ALPHA_MIX : 0) |
+ 				vc4_hvs4_get_alpha_blend_mode(state) |
+-				VC4_SET_FIELD(vc4_state->src_w[0],
+-					      SCALER_POS2_WIDTH) |
+-				VC4_SET_FIELD(vc4_state->src_h[0],
+-					      SCALER_POS2_HEIGHT));
++				VC4_SET_FIELD(width, SCALER_POS2_WIDTH) |
++				VC4_SET_FIELD(height, SCALER_POS2_HEIGHT));
+ 
+ 		/* Position Word 3: Context.  Written by the HVS. */
+ 		vc4_dlist_write(vc4_state, 0xc0c0c0c0);
+@@ -1085,10 +1085,8 @@ static int vc4_plane_mode_set(struct drm
+ 		/* Position Word 2: Source Image Size */
+ 		vc4_state->pos2_offset = vc4_state->dlist_count;
+ 		vc4_dlist_write(vc4_state,
+-				VC4_SET_FIELD(vc4_state->src_w[0],
+-					      SCALER5_POS2_WIDTH) |
+-				VC4_SET_FIELD(vc4_state->src_h[0],
+-					      SCALER5_POS2_HEIGHT));
++				VC4_SET_FIELD(width, SCALER5_POS2_WIDTH) |
++				VC4_SET_FIELD(height, SCALER5_POS2_HEIGHT));
+ 
+ 		/* Position Word 3: Context.  Written by the HVS. */
+ 		vc4_dlist_write(vc4_state, 0xc0c0c0c0);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0041-vc4-drm-Handle-fractional-coordinates-using-the-phas.patch b/target/linux/bcm27xx/patches-6.1/950-0041-vc4-drm-Handle-fractional-coordinates-using-the-phas.patch
new file mode 100644
index 00000000000000..087ec8ee2b9c31
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0041-vc4-drm-Handle-fractional-coordinates-using-the-phas.patch
@@ -0,0 +1,105 @@
+From 1f344e8eb017093573ddccd939b2dc5d930569dc Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Fri, 9 Apr 2021 15:00:40 +0100
+Subject: [PATCH] vc4/drm: Handle fractional coordinates using the
+ phase field
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 61 ++++++++++++++++++++++++++++++---
+ 1 file changed, 56 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -464,14 +464,47 @@ static void vc4_write_tpz(struct vc4_pla
+ 			VC4_SET_FIELD(recip, SCALER_TPZ1_RECIP));
+ }
+ 
+-static void vc4_write_ppf(struct vc4_plane_state *vc4_state, u32 src, u32 dst)
++/* phase magnitude bits */
++#define PHASE_BITS 6
++
++static void vc4_write_ppf(struct vc4_plane_state *vc4_state, u32 src, u32 dst, u32 xy, int channel)
+ {
+-	u32 scale = (1 << 16) * src / dst;
++	u32 scale = src / dst;
++	s32 offset, offset2;
++	s32 phase;
++
++	/* Start the phase at 1/2 pixel from the 1st pixel at src_x.
++	   1/4 pixel for YUV. */
++	if (channel) {
++		/* the phase is relative to scale_src->x, so shift it for display list's x value */
++		offset = (xy & 0x1ffff) >> (16 - PHASE_BITS) >> 1;
++		offset += -(1 << PHASE_BITS >> 2);
++	} else {
++		/* the phase is relative to scale_src->x, so shift it for display list's x value */
++		offset = (xy & 0xffff) >> (16 - PHASE_BITS);
++		offset += -(1 << PHASE_BITS >> 1);
++
++		/* This is a kludge to make sure the scaling factors are consitent with YUV's luma scaling.
++		   we lose 1bit precision because of this. */
++		scale &= ~1;
++	}
++
++	/* There may be a also small error introduced by precision of scale.
++	   Add half of that as a compromise */
++	offset2 = src - dst * scale;
++	offset2 >>= 16 - PHASE_BITS;
++	phase = offset + (offset2 >> 1);
++
++	/* Ensure +ve values don't touch the sign bit, then truncate negative values */
++	if (phase >= 1 << PHASE_BITS)
++		phase = (1 << PHASE_BITS) - 1;
++
++	phase &= SCALER_PPF_IPHASE_MASK;
+ 
+ 	vc4_dlist_write(vc4_state,
+ 			SCALER_PPF_AGC |
+ 			VC4_SET_FIELD(scale, SCALER_PPF_SCALE) |
+-			VC4_SET_FIELD(0, SCALER_PPF_IPHASE));
++			VC4_SET_FIELD(phase, SCALER_PPF_IPHASE));
+ }
+ 
+ static u32 vc4_lbm_size(struct drm_plane_state *state)
+@@ -530,13 +563,13 @@ static void vc4_write_scaling_parameters
+ 	/* Ch0 H-PPF Word 0: Scaling Parameters */
+ 	if (vc4_state->x_scaling[channel] == VC4_SCALING_PPF) {
+ 		vc4_write_ppf(vc4_state,
+-			      vc4_state->src_w[channel], vc4_state->crtc_w);
++			      vc4_state->src_w[channel], vc4_state->crtc_w, vc4_state->src_x, channel);
+ 	}
+ 
+ 	/* Ch0 V-PPF Words 0-1: Scaling Parameters, Context */
+ 	if (vc4_state->y_scaling[channel] == VC4_SCALING_PPF) {
+ 		vc4_write_ppf(vc4_state,
+-			      vc4_state->src_h[channel], vc4_state->crtc_h);
++			      vc4_state->src_h[channel], vc4_state->crtc_h, vc4_state->src_y, channel);
+ 		vc4_dlist_write(vc4_state, 0xc0c0c0c0);
+ 	}
+ 
+@@ -984,6 +1017,24 @@ static int vc4_plane_mode_set(struct drm
+ 		return -EINVAL;
+ 	}
+ 
++	/* fetch an extra pixel if we don't actually line up with the left edge. */
++	if ((vc4_state->src_x & 0xffff) && vc4_state->src_x < (state->fb->width << 16))
++		width++;
++
++	/* same for the right side */
++	if (((vc4_state->src_x + vc4_state->src_w[0]) & 0xffff) &&
++	       vc4_state->src_x + vc4_state->src_w[0] < (state->fb->width << 16))
++		width++;
++
++	/* now for the top */
++	if ((vc4_state->src_y & 0xffff) && vc4_state->src_y < (state->fb->height << 16))
++		height++;
++
++	/* and the bottom */
++	if (((vc4_state->src_y + vc4_state->src_h[0]) & 0xffff) &&
++	       vc4_state->src_y + vc4_state->src_h[0] < (state->fb->height << 16))
++		height++;
++
+ 	/* Don't waste cycles mixing with plane alpha if the set alpha
+ 	 * is opaque or there is no per-pixel alpha information.
+ 	 * In any case we use the alpha property value as the fixed alpha.
diff --git a/target/linux/bcm27xx/patches-6.1/950-0042-drm-Add-chroma-siting-properties.patch b/target/linux/bcm27xx/patches-6.1/950-0042-drm-Add-chroma-siting-properties.patch
new file mode 100644
index 00000000000000..7ae221e8a905f8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0042-drm-Add-chroma-siting-properties.patch
@@ -0,0 +1,170 @@
+From ca82414470eea1d81f8fe4169ee19b89245989dc Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Wed, 26 Jan 2022 15:58:13 +0000
+Subject: [PATCH] drm: Add chroma siting properties
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/drm_atomic_state_helper.c | 14 +++++++++
+ drivers/gpu/drm/drm_atomic_uapi.c         |  8 +++++
+ drivers/gpu/drm/drm_color_mgmt.c          | 36 +++++++++++++++++++++++
+ include/drm/drm_color_mgmt.h              |  3 ++
+ include/drm/drm_plane.h                   | 36 +++++++++++++++++++++++
+ 5 files changed, 97 insertions(+)
+
+--- a/drivers/gpu/drm/drm_atomic_state_helper.c
++++ b/drivers/gpu/drm/drm_atomic_state_helper.c
+@@ -267,6 +267,20 @@ void __drm_atomic_helper_plane_state_res
+ 			plane_state->color_range = val;
+ 	}
+ 
++	if (plane->chroma_siting_h_property) {
++		if (!drm_object_property_get_default_value(&plane->base,
++							   plane->chroma_siting_h_property,
++							   &val))
++			plane_state->chroma_siting_h = val;
++	}
++
++	if (plane->chroma_siting_v_property) {
++		if (!drm_object_property_get_default_value(&plane->base,
++							   plane->chroma_siting_v_property,
++							   &val))
++			plane_state->chroma_siting_v = val;
++	}
++
+ 	if (plane->zpos_property) {
+ 		if (!drm_object_property_get_default_value(&plane->base,
+ 							   plane->zpos_property,
+--- a/drivers/gpu/drm/drm_atomic_uapi.c
++++ b/drivers/gpu/drm/drm_atomic_uapi.c
+@@ -562,6 +562,10 @@ static int drm_atomic_plane_set_property
+ 		state->color_encoding = val;
+ 	} else if (property == plane->color_range_property) {
+ 		state->color_range = val;
++	} else if (property == plane->chroma_siting_h_property) {
++		state->chroma_siting_h = val;
++	} else if (property == plane->chroma_siting_v_property) {
++		state->chroma_siting_v = val;
+ 	} else if (property == config->prop_fb_damage_clips) {
+ 		ret = drm_atomic_replace_property_blob_from_id(dev,
+ 					&state->fb_damage_clips,
+@@ -628,6 +632,10 @@ drm_atomic_plane_get_property(struct drm
+ 		*val = state->color_encoding;
+ 	} else if (property == plane->color_range_property) {
+ 		*val = state->color_range;
++	} else if (property == plane->chroma_siting_h_property) {
++		*val = state->chroma_siting_h;
++	} else if (property == plane->chroma_siting_v_property) {
++		*val = state->chroma_siting_v;
+ 	} else if (property == config->prop_fb_damage_clips) {
+ 		*val = (state->fb_damage_clips) ?
+ 			state->fb_damage_clips->base.id : 0;
+--- a/drivers/gpu/drm/drm_color_mgmt.c
++++ b/drivers/gpu/drm/drm_color_mgmt.c
+@@ -591,6 +591,42 @@ int drm_plane_create_color_properties(st
+ EXPORT_SYMBOL(drm_plane_create_color_properties);
+ 
+ /**
++ * drm_plane_create_chroma_siting_properties - chroma siting related plane properties
++ * @plane: plane object
++ *
++ * Create and attach plane specific CHROMA_SITING
++ * properties to @plane.
++ */
++int drm_plane_create_chroma_siting_properties(struct drm_plane *plane,
++						int32_t default_chroma_siting_h,
++						int32_t default_chroma_siting_v)
++{
++	struct drm_device *dev = plane->dev;
++	struct drm_property *prop;
++
++	prop = drm_property_create_range(dev, 0, "CHROMA_SITING_H",
++					0, 1<<16);
++	if (!prop)
++		return -ENOMEM;
++	plane->chroma_siting_h_property = prop;
++	drm_object_attach_property(&plane->base, prop, default_chroma_siting_h);
++
++	prop = drm_property_create_range(dev, 0, "CHROMA_SITING_V",
++					0, 1<<16);
++	if (!prop)
++		return -ENOMEM;
++	plane->chroma_siting_v_property = prop;
++	drm_object_attach_property(&plane->base, prop, default_chroma_siting_v);
++
++	if (plane->state) {
++		plane->state->chroma_siting_h = default_chroma_siting_h;
++		plane->state->chroma_siting_v = default_chroma_siting_v;
++	}
++	return 0;
++}
++EXPORT_SYMBOL(drm_plane_create_chroma_siting_properties);
++
++/**
+  * drm_color_lut_check - check validity of lookup table
+  * @lut: property blob containing LUT to check
+  * @tests: bitmask of tests to run
+--- a/include/drm/drm_color_mgmt.h
++++ b/include/drm/drm_color_mgmt.h
+@@ -93,6 +93,9 @@ int drm_plane_create_color_properties(st
+ 				      enum drm_color_encoding default_encoding,
+ 				      enum drm_color_range default_range);
+ 
++int drm_plane_create_chroma_siting_properties(struct drm_plane *plane,
++						int32_t default_chroma_siting_h, int32_t default_chroma_siting_v);
++
+ /**
+  * enum drm_color_lut_tests - hw-specific LUT tests to perform
+  *
+--- a/include/drm/drm_plane.h
++++ b/include/drm/drm_plane.h
+@@ -178,6 +178,24 @@ struct drm_plane_state {
+ 	enum drm_color_range color_range;
+ 
+ 	/**
++	 * @chroma_siting_h:
++	 *
++	 * Location of chroma samples horizontally compared to luma
++	 * 0 means chroma is sited with left luma
++	 * 0x8000 is interstitial. 0x10000 is sited with right luma
++	 */
++	int32_t chroma_siting_h;
++
++	/**
++	 * @chroma_siting_v:
++	 *
++	 * Location of chroma samples vertically compared to luma
++	 * 0 means chroma is sited with top luma
++	 * 0x8000 is interstitial. 0x10000 is sited with bottom luma
++	 */
++	int32_t chroma_siting_v;
++
++	/**
+ 	 * @fb_damage_clips:
+ 	 *
+ 	 * Blob representing damage (area in plane framebuffer that changed
+@@ -748,6 +766,24 @@ struct drm_plane {
+ 	 * scaling.
+ 	 */
+ 	struct drm_property *scaling_filter_property;
++
++	/**
++	 * @chroma_siting_h_property:
++	 *
++	 * Optional "CHROMA_SITING_H" property for specifying
++	 * chroma siting for YUV formats.
++	 * See drm_plane_create_chroma_siting_properties().
++	 */
++	struct drm_property *chroma_siting_h_property;
++
++	/**
++	 * @chroma_siting_v_property:
++	 *
++	 * Optional "CHROMA_SITING_V" property for specifying
++	 * chroma siting for YUV formats.
++	 * See drm_plane_create_chroma_siting_properties().
++	 */
++	struct drm_property *chroma_siting_v_property;
+ };
+ 
+ #define obj_to_plane(x) container_of(x, struct drm_plane, base)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0043-vc4-drm-plane-Make-use-of-chroma-siting-parameter.patch b/target/linux/bcm27xx/patches-6.1/950-0043-vc4-drm-plane-Make-use-of-chroma-siting-parameter.patch
new file mode 100644
index 00000000000000..b5ebb28bbfb7ac
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0043-vc4-drm-plane-Make-use-of-chroma-siting-parameter.patch
@@ -0,0 +1,60 @@
+From 2b8db0ad29be4c12f2a1c5a209e15e5e14efc047 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Thu, 27 Jan 2022 15:32:04 +0000
+Subject: [PATCH] vc4/drm:plane: Make use of chroma siting parameter
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -467,17 +467,18 @@ static void vc4_write_tpz(struct vc4_pla
+ /* phase magnitude bits */
+ #define PHASE_BITS 6
+ 
+-static void vc4_write_ppf(struct vc4_plane_state *vc4_state, u32 src, u32 dst, u32 xy, int channel)
++static void vc4_write_ppf(struct vc4_plane_state *vc4_state, u32 src, u32 dst, u32 xy, int channel, int chroma_offset)
+ {
+ 	u32 scale = src / dst;
+ 	s32 offset, offset2;
+ 	s32 phase;
+ 
+ 	/* Start the phase at 1/2 pixel from the 1st pixel at src_x.
+-	   1/4 pixel for YUV. */
++	   1/4 pixel for YUV, plus the offset for chroma siting */
+ 	if (channel) {
+ 		/* the phase is relative to scale_src->x, so shift it for display list's x value */
+ 		offset = (xy & 0x1ffff) >> (16 - PHASE_BITS) >> 1;
++		offset -= chroma_offset >> (17 - PHASE_BITS);
+ 		offset += -(1 << PHASE_BITS >> 2);
+ 	} else {
+ 		/* the phase is relative to scale_src->x, so shift it for display list's x value */
+@@ -563,13 +564,15 @@ static void vc4_write_scaling_parameters
+ 	/* Ch0 H-PPF Word 0: Scaling Parameters */
+ 	if (vc4_state->x_scaling[channel] == VC4_SCALING_PPF) {
+ 		vc4_write_ppf(vc4_state,
+-			      vc4_state->src_w[channel], vc4_state->crtc_w, vc4_state->src_x, channel);
++			      vc4_state->src_w[channel], vc4_state->crtc_w, vc4_state->src_x, channel,
++			      state->chroma_siting_h);
+ 	}
+ 
+ 	/* Ch0 V-PPF Words 0-1: Scaling Parameters, Context */
+ 	if (vc4_state->y_scaling[channel] == VC4_SCALING_PPF) {
+ 		vc4_write_ppf(vc4_state,
+-			      vc4_state->src_h[channel], vc4_state->crtc_h, vc4_state->src_y, channel);
++			      vc4_state->src_h[channel], vc4_state->crtc_h, vc4_state->src_y, channel,
++			      state->chroma_siting_v);
+ 		vc4_dlist_write(vc4_state, 0xc0c0c0c0);
+ 	}
+ 
+@@ -1649,6 +1652,8 @@ struct drm_plane *vc4_plane_init(struct
+ 					  DRM_COLOR_YCBCR_BT709,
+ 					  DRM_COLOR_YCBCR_LIMITED_RANGE);
+ 
++	drm_plane_create_chroma_siting_properties(plane, 0, 0);
++
+ 	if (type == DRM_PLANE_TYPE_PRIMARY)
+ 		drm_plane_create_zpos_immutable_property(plane, 0);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0044-drm-vc4-Force-trigger-of-dlist-update-on-margins-cha.patch b/target/linux/bcm27xx/patches-6.1/950-0044-drm-vc4-Force-trigger-of-dlist-update-on-margins-cha.patch
new file mode 100644
index 00000000000000..0820d27ba76c50
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0044-drm-vc4-Force-trigger-of-dlist-update-on-margins-cha.patch
@@ -0,0 +1,58 @@
+From b583024119e8ea35f7a6d2d8b143c0eb390afa70 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 1 Apr 2022 11:31:38 +0100
+Subject: [PATCH] drm/vc4: Force trigger of dlist update on margins
+ change
+
+When the margins are changed, the dlist needs to be regenerated
+with the changed updated dest regions for each of the planes.
+
+Setting the zpos_changed flag is sufficient to trigger that
+without doing a full modeset, therefore set it should the
+margins be changed.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c | 14 ++++++++++----
+ drivers/gpu/drm/vc4/vc4_drv.h  |  7 +------
+ 2 files changed, 11 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -757,10 +757,16 @@ static int vc4_crtc_atomic_check(struct
+ 		if (conn_state->crtc != crtc)
+ 			continue;
+ 
+-		vc4_state->margins.left = conn_state->tv.margins.left;
+-		vc4_state->margins.right = conn_state->tv.margins.right;
+-		vc4_state->margins.top = conn_state->tv.margins.top;
+-		vc4_state->margins.bottom = conn_state->tv.margins.bottom;
++		if (memcmp(&vc4_state->margins, &conn_state->tv.margins,
++			   sizeof(vc4_state->margins))) {
++			memcpy(&vc4_state->margins, &conn_state->tv.margins,
++			       sizeof(vc4_state->margins));
++
++			/* Need to force the dlist entries for all planes to be
++			 * updated so that the dest rectangles are changed.
++			 */
++			crtc_state->zpos_changed = true;
++		}
+ 		break;
+ 	}
+ 
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -581,12 +581,7 @@ struct vc4_crtc_state {
+ 	bool txp_armed;
+ 	unsigned int assigned_channel;
+ 
+-	struct {
+-		unsigned int left;
+-		unsigned int right;
+-		unsigned int top;
+-		unsigned int bottom;
+-	} margins;
++	struct drm_connector_tv_margins margins;
+ 
+ 	unsigned long hvs_load;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0045-drm-atomic-helpers-remove-legacy_cursor_update-hacks.patch b/target/linux/bcm27xx/patches-6.1/950-0045-drm-atomic-helpers-remove-legacy_cursor_update-hacks.patch
new file mode 100644
index 00000000000000..520d6fa7ebc802
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0045-drm-atomic-helpers-remove-legacy_cursor_update-hacks.patch
@@ -0,0 +1,121 @@
+From 34b4470575bd300507847093497516f1adbc5020 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Fri, 23 Oct 2020 14:39:23 +0200
+Subject: [PATCH] drm/atomic-helpers: remove legacy_cursor_update hacks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The stuff never really worked, and leads to lots of fun because it
+out-of-order frees atomic states. Which upsets KASAN, among other
+things.
+
+For async updates we now have a more solid solution with the
+->atomic_async_check and ->atomic_async_commit hooks. Support for that
+for msm and vc4 landed. nouveau and i915 have their own commit
+routines, doing something similar.
+
+For everyone else it's probably better to remove the use-after-free
+bug, and encourage folks to use the async support instead. The
+affected drivers which register a legacy cursor plane and don't either
+use the new async stuff or their own commit routine are: amdgpu,
+atmel, mediatek, qxl, rockchip, sti, sun4i, tegra, virtio, and vmwgfx.
+
+Inspired by an amdgpu bug report.
+
+v2: Drop RFC, I think with amdgpu converted over to use
+atomic_async_check/commit done in
+
+commit 674e78acae0dfb4beb56132e41cbae5b60f7d662
+Author: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Date:   Wed Dec 5 14:59:07 2018 -0500
+
+    drm/amd/display: Add fast path for cursor plane updates
+
+we don't have any driver anymore where we have userspace expecting
+solid legacy cursor support _and_ they are using the atomic helpers in
+their fully glory. So we can retire this.
+
+v3: Paper over msm and i915 regression. The complete_all is the only
+thing missing afaict.
+
+v4: Rebased on recent kernel, added extra link for vc4 bug.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=199425
+Link: https://lore.kernel.org/all/20220221134155.125447-9-maxime@cerno.tech/
+Cc: mikita.lipski@amd.com
+Cc: Michel Dänzer <michel@daenzer.net>
+Cc: harry.wentland@amd.com
+Cc: Rob Clark <robdclark@gmail.com>
+Cc: "Kazlauskas, Nicholas" <nicholas.kazlauskas@amd.com>
+Tested-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/drm_atomic_helper.c          | 13 -------------
+ drivers/gpu/drm/i915/display/intel_display.c | 13 +++++++++++++
+ drivers/gpu/drm/msm/msm_atomic.c             |  2 ++
+ 3 files changed, 15 insertions(+), 13 deletions(-)
+
+--- a/drivers/gpu/drm/drm_atomic_helper.c
++++ b/drivers/gpu/drm/drm_atomic_helper.c
+@@ -1608,13 +1608,6 @@ drm_atomic_helper_wait_for_vblanks(struc
+ 	int i, ret;
+ 	unsigned int crtc_mask = 0;
+ 
+-	 /*
+-	  * Legacy cursor ioctls are completely unsynced, and userspace
+-	  * relies on that (by doing tons of cursor updates).
+-	  */
+-	if (old_state->legacy_cursor_update)
+-		return;
+-
+ 	for_each_oldnew_crtc_in_state(old_state, crtc, old_crtc_state, new_crtc_state, i) {
+ 		if (!new_crtc_state->active)
+ 			continue;
+@@ -2264,12 +2257,6 @@ int drm_atomic_helper_setup_commit(struc
+ 			complete_all(&commit->flip_done);
+ 			continue;
+ 		}
+-
+-		/* Legacy cursor updates are fully unsynced. */
+-		if (state->legacy_cursor_update) {
+-			complete_all(&commit->flip_done);
+-			continue;
+-		}
+ 
+ 		if (!new_crtc_state->event) {
+ 			commit->event = kzalloc(sizeof(*commit->event),
+--- a/drivers/gpu/drm/i915/display/intel_display.c
++++ b/drivers/gpu/drm/i915/display/intel_display.c
+@@ -7766,6 +7766,19 @@ static int intel_atomic_commit(struct dr
+ 				state->base.legacy_cursor_update = false;
+ 	}
+ 
++	/*
++	 * FIXME: Cut over to (async) commit helpers instead of hand-rolling
++	 * everything.
++	 */
++	if (state->base.legacy_cursor_update) {
++		struct intel_crtc_state *new_crtc_state;
++		struct intel_crtc *crtc;
++		int i;
++
++		for_each_new_intel_crtc_in_state(state, crtc, new_crtc_state, i)
++			complete_all(&new_crtc_state->uapi.commit->flip_done);
++	}
++
+ 	ret = intel_atomic_prepare_commit(state);
+ 	if (ret) {
+ 		drm_dbg_atomic(&dev_priv->drm,
+--- a/drivers/gpu/drm/msm/msm_atomic.c
++++ b/drivers/gpu/drm/msm/msm_atomic.c
+@@ -222,6 +222,8 @@ void msm_atomic_commit_tail(struct drm_a
+ 		/* async updates are limited to single-crtc updates: */
+ 		WARN_ON(crtc_mask != drm_crtc_mask(async_crtc));
+ 
++		complete_all(&async_crtc->state->commit->flip_done);
++
+ 		/*
+ 		 * Start timer if we don't already have an update pending
+ 		 * on this crtc:
diff --git a/target/linux/bcm27xx/patches-6.1/950-0046-drm-vc4_hdmi-Force-a-modeset-when-Broadcast-RGB-sett.patch b/target/linux/bcm27xx/patches-6.1/950-0046-drm-vc4_hdmi-Force-a-modeset-when-Broadcast-RGB-sett.patch
new file mode 100644
index 00000000000000..42301da88f7993
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0046-drm-vc4_hdmi-Force-a-modeset-when-Broadcast-RGB-sett.patch
@@ -0,0 +1,33 @@
+From bf53b44573db760e243ef2fdf542bc3e991c97a6 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Thu, 5 May 2022 18:50:04 +0100
+Subject: [PATCH] drm/vc4_hdmi: Force a modeset when Broadcast RGB
+ setting changes
+
+Without this the change is not visible until the next modeset
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -536,14 +536,17 @@ static int vc4_hdmi_connector_atomic_che
+ {
+ 	struct drm_connector_state *old_state =
+ 		drm_atomic_get_old_connector_state(state, connector);
++	struct vc4_hdmi_connector_state *old_vc4_state = conn_state_to_vc4_hdmi_conn_state(old_state);
+ 	struct drm_connector_state *new_state =
+ 		drm_atomic_get_new_connector_state(state, connector);
++	struct vc4_hdmi_connector_state *new_vc4_state = conn_state_to_vc4_hdmi_conn_state(new_state);
+ 	struct drm_crtc *crtc = new_state->crtc;
+ 
+ 	if (!crtc)
+ 		return 0;
+ 
+ 	if (old_state->colorspace != new_state->colorspace ||
++	    old_vc4_state->broadcast_rgb != new_vc4_state->broadcast_rgb ||
+ 	    !drm_connector_atomic_hdr_metadata_equal(old_state, new_state)) {
+ 		struct drm_crtc_state *crtc_state;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0047-drm-atomic-If-margins-are-updated-update-all-planes.patch b/target/linux/bcm27xx/patches-6.1/950-0047-drm-atomic-If-margins-are-updated-update-all-planes.patch
new file mode 100644
index 00000000000000..671f651538aef2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0047-drm-atomic-If-margins-are-updated-update-all-planes.patch
@@ -0,0 +1,60 @@
+From 62813ba7cbf8c2df7af04036a297175fc0457626 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 1 Apr 2022 17:10:37 +0100
+Subject: [PATCH] drm/atomic: If margins are updated, update all
+ planes.
+
+Margins may be implemented by scaling the planes, but as there
+is no way of intercepting the set_property for a standard property,
+and all planes are checked in drm_atomic_check_only before the
+connectors, there's now way to add the planes into the state
+from the driver.
+
+If the margin properties change, add all corresponding planes to
+the state.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/drm_atomic_uapi.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/gpu/drm/drm_atomic_uapi.c
++++ b/drivers/gpu/drm/drm_atomic_uapi.c
+@@ -679,6 +679,7 @@ static int drm_atomic_connector_set_prop
+ {
+ 	struct drm_device *dev = connector->dev;
+ 	struct drm_mode_config *config = &dev->mode_config;
++	bool margins_updated = false;
+ 	bool replaced = false;
+ 	int ret;
+ 
+@@ -698,12 +699,16 @@ static int drm_atomic_connector_set_prop
+ 		state->tv.subconnector = val;
+ 	} else if (property == config->tv_left_margin_property) {
+ 		state->tv.margins.left = val;
++		margins_updated = true;
+ 	} else if (property == config->tv_right_margin_property) {
+ 		state->tv.margins.right = val;
++		margins_updated = true;
+ 	} else if (property == config->tv_top_margin_property) {
+ 		state->tv.margins.top = val;
++		margins_updated = true;
+ 	} else if (property == config->tv_bottom_margin_property) {
+ 		state->tv.margins.bottom = val;
++		margins_updated = true;
+ 	} else if (property == config->tv_mode_property) {
+ 		state->tv.mode = val;
+ 	} else if (property == config->tv_brightness_property) {
+@@ -784,6 +789,12 @@ static int drm_atomic_connector_set_prop
+ 		return -EINVAL;
+ 	}
+ 
++	if (margins_updated && state->crtc) {
++		ret = drm_atomic_add_affected_planes(state->state, state->crtc);
++
++		return ret;
++	}
++
+ 	return 0;
+ }
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0048-drm-vc4-hvs-Ignore-atomic_flush-if-we-re-disabled.patch b/target/linux/bcm27xx/patches-6.1/950-0048-drm-vc4-hvs-Ignore-atomic_flush-if-we-re-disabled.patch
new file mode 100644
index 00000000000000..4ddda92e1693d2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0048-drm-vc4-hvs-Ignore-atomic_flush-if-we-re-disabled.patch
@@ -0,0 +1,27 @@
+From 2f38c1f89175b33aaa091d055a804f4f31c47ec2 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 6 Dec 2021 16:32:10 +0100
+Subject: [PATCH] drm/vc4: hvs: Ignore atomic_flush if we're disabled
+
+atomic_flush will be called for each CRTC even if they aren't enabled.
+
+The whole code we have there will thus run without a properly affected
+channel, which can then result in all sorts of weird behaviour.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -778,6 +778,9 @@ void vc4_hvs_atomic_flush(struct drm_crt
+ 		return;
+ 	}
+ 
++	if (vc4_state->assigned_channel == VC4_HVS_CHANNEL_DISABLED)
++		return;
++
+ 	if (debug_dump_regs) {
+ 		DRM_INFO("CRTC %d HVS before:\n", drm_crtc_index(crtc));
+ 		vc4_hvs_dump_state(hvs);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0049-drm-vc4-0-is-a-valid-value-for-pixel_order_hvs5-so-f.patch b/target/linux/bcm27xx/patches-6.1/950-0049-drm-vc4-0-is-a-valid-value-for-pixel_order_hvs5-so-f.patch
new file mode 100644
index 00000000000000..ebc9ce44ec722b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0049-drm-vc4-0-is-a-valid-value-for-pixel_order_hvs5-so-f.patch
@@ -0,0 +1,118 @@
+From b16dcc5f735739444da66149b473bb88fb44d4d9 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 3 Jun 2022 16:49:09 +0100
+Subject: [PATCH] drm: vc4: 0 is a valid value for pixel_order_hvs5, so
+ fix conditionals
+
+vc4_plane_mode_set for HVS5 was using pixel_order unless pixel_order_hvs5
+was non-zero, except 0 is a valid value for the pixel_order.
+
+Specify pixel_order_hvs5 for all formats and remove the conditional.
+
+Reported-by: vrazzer <teamvraz@pipmail.net>
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -65,11 +65,13 @@ static const struct hvs_format {
+ 		.drm = DRM_FORMAT_RGB565,
+ 		.hvs = HVS_PIXEL_FORMAT_RGB565,
+ 		.pixel_order = HVS_PIXEL_ORDER_XRGB,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_XRGB,
+ 	},
+ 	{
+ 		.drm = DRM_FORMAT_BGR565,
+ 		.hvs = HVS_PIXEL_FORMAT_RGB565,
+ 		.pixel_order = HVS_PIXEL_ORDER_XBGR,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_XBGR,
+ 	},
+ 	{
+ 		.drm = DRM_FORMAT_ARGB1555,
+@@ -87,56 +89,67 @@ static const struct hvs_format {
+ 		.drm = DRM_FORMAT_RGB888,
+ 		.hvs = HVS_PIXEL_FORMAT_RGB888,
+ 		.pixel_order = HVS_PIXEL_ORDER_XRGB,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_XRGB,
+ 	},
+ 	{
+ 		.drm = DRM_FORMAT_BGR888,
+ 		.hvs = HVS_PIXEL_FORMAT_RGB888,
+ 		.pixel_order = HVS_PIXEL_ORDER_XBGR,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_XBGR,
+ 	},
+ 	{
+ 		.drm = DRM_FORMAT_YUV422,
+ 		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV422_3PLANE,
+ 		.pixel_order = HVS_PIXEL_ORDER_XYCBCR,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_XYCBCR,
+ 	},
+ 	{
+ 		.drm = DRM_FORMAT_YVU422,
+ 		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV422_3PLANE,
+ 		.pixel_order = HVS_PIXEL_ORDER_XYCRCB,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_XYCRCB,
+ 	},
+ 	{
+ 		.drm = DRM_FORMAT_YUV420,
+ 		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV420_3PLANE,
+ 		.pixel_order = HVS_PIXEL_ORDER_XYCBCR,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_XYCBCR,
+ 	},
+ 	{
+ 		.drm = DRM_FORMAT_YVU420,
+ 		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV420_3PLANE,
+ 		.pixel_order = HVS_PIXEL_ORDER_XYCRCB,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_XYCRCB,
+ 	},
+ 	{
+ 		.drm = DRM_FORMAT_NV12,
+ 		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV420_2PLANE,
+ 		.pixel_order = HVS_PIXEL_ORDER_XYCBCR,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_XYCBCR,
+ 	},
+ 	{
+ 		.drm = DRM_FORMAT_NV21,
+ 		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV420_2PLANE,
+ 		.pixel_order = HVS_PIXEL_ORDER_XYCRCB,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_XYCRCB,
+ 	},
+ 	{
+ 		.drm = DRM_FORMAT_NV16,
+ 		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV422_2PLANE,
+ 		.pixel_order = HVS_PIXEL_ORDER_XYCBCR,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_XYCBCR,
+ 	},
+ 	{
+ 		.drm = DRM_FORMAT_NV61,
+ 		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV422_2PLANE,
+ 		.pixel_order = HVS_PIXEL_ORDER_XYCRCB,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_XYCRCB,
+ 	},
+ 	{
+ 		.drm = DRM_FORMAT_P030,
+ 		.hvs = HVS_PIXEL_FORMAT_YCBCR_10BIT,
+ 		.pixel_order = HVS_PIXEL_ORDER_XYCBCR,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_XYCBCR,
+ 		.hvs5_only = true,
+ 	},
+ 	{
+@@ -1087,15 +1100,10 @@ static int vc4_plane_mode_set(struct drm
+ 		vc4_dlist_write(vc4_state, 0xc0c0c0c0);
+ 
+ 	} else {
+-		u32 hvs_pixel_order = format->pixel_order;
+-
+-		if (format->pixel_order_hvs5)
+-			hvs_pixel_order = format->pixel_order_hvs5;
+-
+ 		/* Control word */
+ 		vc4_dlist_write(vc4_state,
+ 				SCALER_CTL0_VALID |
+-				(hvs_pixel_order << SCALER_CTL0_ORDER_SHIFT) |
++				(format->pixel_order_hvs5 << SCALER_CTL0_ORDER_SHIFT) |
+ 				(hvs_format << SCALER_CTL0_PIXEL_FORMAT_SHIFT) |
+ 				VC4_SET_FIELD(tiling, SCALER_CTL0_TILING) |
+ 				(vc4_state->is_unity ?
diff --git a/target/linux/bcm27xx/patches-6.1/950-0050-drm-vc4-Omit-pixel_order-from-the-hvs_format-for-hvs.patch b/target/linux/bcm27xx/patches-6.1/950-0050-drm-vc4-Omit-pixel_order-from-the-hvs_format-for-hvs.patch
new file mode 100644
index 00000000000000..e59ab2cf836967
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0050-drm-vc4-Omit-pixel_order-from-the-hvs_format-for-hvs.patch
@@ -0,0 +1,54 @@
+From e229805297bd5ff53b5fc63d08c5f37c2404c2d6 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 6 Jun 2022 12:23:28 +0100
+Subject: [PATCH] drm: vc4: Omit pixel_order from the hvs_format for
+ hvs5 only formats
+
+pixel_order is used for the earlier versions of the HVS, so is
+redundant on the 10:10:10:2 and 10bit YUV formats that are only
+supported on HVS5.
+Remove the assignment from the table to avoid confusion.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -148,35 +148,30 @@ static const struct hvs_format {
+ 	{
+ 		.drm = DRM_FORMAT_P030,
+ 		.hvs = HVS_PIXEL_FORMAT_YCBCR_10BIT,
+-		.pixel_order = HVS_PIXEL_ORDER_XYCBCR,
+ 		.pixel_order_hvs5 = HVS_PIXEL_ORDER_XYCBCR,
+ 		.hvs5_only = true,
+ 	},
+ 	{
+ 		.drm = DRM_FORMAT_XRGB2101010,
+ 		.hvs = HVS_PIXEL_FORMAT_RGBA1010102,
+-		.pixel_order = HVS_PIXEL_ORDER_ABGR,
+ 		.pixel_order_hvs5 = HVS_PIXEL_ORDER_ARGB,
+ 		.hvs5_only = true,
+ 	},
+ 	{
+ 		.drm = DRM_FORMAT_ARGB2101010,
+ 		.hvs = HVS_PIXEL_FORMAT_RGBA1010102,
+-		.pixel_order = HVS_PIXEL_ORDER_ABGR,
+ 		.pixel_order_hvs5 = HVS_PIXEL_ORDER_ARGB,
+ 		.hvs5_only = true,
+ 	},
+ 	{
+ 		.drm = DRM_FORMAT_ABGR2101010,
+ 		.hvs = HVS_PIXEL_FORMAT_RGBA1010102,
+-		.pixel_order = HVS_PIXEL_ORDER_ARGB,
+ 		.pixel_order_hvs5 = HVS_PIXEL_ORDER_ABGR,
+ 		.hvs5_only = true,
+ 	},
+ 	{
+ 		.drm = DRM_FORMAT_XBGR2101010,
+ 		.hvs = HVS_PIXEL_FORMAT_RGBA1010102,
+-		.pixel_order = HVS_PIXEL_ORDER_ARGB,
+ 		.pixel_order_hvs5 = HVS_PIXEL_ORDER_ABGR,
+ 		.hvs5_only = true,
+ 	},
diff --git a/target/linux/bcm27xx/patches-6.1/950-0051-drm-vc4-Add-3-3-2-and-4-4-4-4-RGB-RGBX-RGBA-formats.patch b/target/linux/bcm27xx/patches-6.1/950-0051-drm-vc4-Add-3-3-2-and-4-4-4-4-RGB-RGBX-RGBA-formats.patch
new file mode 100644
index 00000000000000..c4e0050589a168
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0051-drm-vc4-Add-3-3-2-and-4-4-4-4-RGB-RGBX-RGBA-formats.patch
@@ -0,0 +1,104 @@
+From db4cb2248e9d98cc513300964c3ecdc80b8bc364 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 3 Jun 2022 16:57:04 +0100
+Subject: [PATCH] drm: vc4: Add 3:3:2 and 4:4:4:4 RGB/RGBX/RGBA formats
+
+The hardware supports the 332 8bpp and 4:4:4:4 16bpp formats,
+but the table of supported formats didn't include them.
+Add them in.
+
+In theory they are supported for T-format as well as linear,
+but without a way to test them just add them as linear for now.
+
+Suggested-by: vrazzer <teamvraz@pipmail.net>
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 70 +++++++++++++++++++++++++++++++++
+ 1 file changed, 70 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -175,6 +175,66 @@ static const struct hvs_format {
+ 		.pixel_order_hvs5 = HVS_PIXEL_ORDER_ABGR,
+ 		.hvs5_only = true,
+ 	},
++	{
++		.drm = DRM_FORMAT_RGB332,
++		.hvs = HVS_PIXEL_FORMAT_RGB332,
++		.pixel_order = HVS_PIXEL_ORDER_ARGB,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_ARGB,
++	},
++	{
++		.drm = DRM_FORMAT_BGR233,
++		.hvs = HVS_PIXEL_FORMAT_RGB332,
++		.pixel_order = HVS_PIXEL_ORDER_ABGR,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_ABGR,
++	},
++	{
++		.drm = DRM_FORMAT_XRGB4444,
++		.hvs = HVS_PIXEL_FORMAT_RGBA4444,
++		.pixel_order = HVS_PIXEL_ORDER_ABGR,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_ARGB,
++	},
++	{
++		.drm = DRM_FORMAT_ARGB4444,
++		.hvs = HVS_PIXEL_FORMAT_RGBA4444,
++		.pixel_order = HVS_PIXEL_ORDER_ABGR,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_ARGB,
++	},
++	{
++		.drm = DRM_FORMAT_XBGR4444,
++		.hvs = HVS_PIXEL_FORMAT_RGBA4444,
++		.pixel_order = HVS_PIXEL_ORDER_ARGB,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_ABGR,
++	},
++	{
++		.drm = DRM_FORMAT_ABGR4444,
++		.hvs = HVS_PIXEL_FORMAT_RGBA4444,
++		.pixel_order = HVS_PIXEL_ORDER_ARGB,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_ABGR,
++	},
++	{
++		.drm = DRM_FORMAT_BGRX4444,
++		.hvs = HVS_PIXEL_FORMAT_RGBA4444,
++		.pixel_order = HVS_PIXEL_ORDER_RGBA,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_BGRA,
++	},
++	{
++		.drm = DRM_FORMAT_BGRA4444,
++		.hvs = HVS_PIXEL_FORMAT_RGBA4444,
++		.pixel_order = HVS_PIXEL_ORDER_RGBA,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_BGRA,
++	},
++	{
++		.drm = DRM_FORMAT_RGBX4444,
++		.hvs = HVS_PIXEL_FORMAT_RGBA4444,
++		.pixel_order = HVS_PIXEL_ORDER_BGRA,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_RGBA,
++	},
++	{
++		.drm = DRM_FORMAT_RGBA4444,
++		.hvs = HVS_PIXEL_FORMAT_RGBA4444,
++		.pixel_order = HVS_PIXEL_ORDER_BGRA,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_RGBA,
++	},
+ };
+ 
+ static const struct hvs_format *vc4_get_hvs_format(u32 drm_format)
+@@ -1575,6 +1635,16 @@ static bool vc4_format_mod_supported(str
+ 	case DRM_FORMAT_BGRX1010102:
+ 	case DRM_FORMAT_RGBA1010102:
+ 	case DRM_FORMAT_BGRA1010102:
++	case DRM_FORMAT_XRGB4444:
++	case DRM_FORMAT_ARGB4444:
++	case DRM_FORMAT_XBGR4444:
++	case DRM_FORMAT_ABGR4444:
++	case DRM_FORMAT_RGBX4444:
++	case DRM_FORMAT_RGBA4444:
++	case DRM_FORMAT_BGRX4444:
++	case DRM_FORMAT_BGRA4444:
++	case DRM_FORMAT_RGB332:
++	case DRM_FORMAT_BGR233:
+ 	case DRM_FORMAT_YUV422:
+ 	case DRM_FORMAT_YVU422:
+ 	case DRM_FORMAT_YUV420:
diff --git a/target/linux/bcm27xx/patches-6.1/950-0052-drm-vc4-Add-comments-for-which-HVS_PIXEL_ORDER_xxx-d.patch b/target/linux/bcm27xx/patches-6.1/950-0052-drm-vc4-Add-comments-for-which-HVS_PIXEL_ORDER_xxx-d.patch
new file mode 100644
index 00000000000000..83f1fdca90f6fa
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0052-drm-vc4-Add-comments-for-which-HVS_PIXEL_ORDER_xxx-d.patch
@@ -0,0 +1,36 @@
+From 30f0c2f0da952655da949c2af36bf53138092ba5 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 6 Jun 2022 14:53:56 +0100
+Subject: [PATCH] drm: vc4: Add comments for which HVS_PIXEL_ORDER_xxx
+ defines apply
+
+The HVS_PIXEL_ORDER_xxx defines apply to specific HVS_PIXEL_FORMAT_xxx
+modes, so add comments to make this obvious.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_regs.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_regs.h
++++ b/drivers/gpu/drm/vc4/vc4_regs.h
+@@ -870,16 +870,19 @@ enum hvs_pixel_format {
+ /* Note: the LSB is the rightmost character shown.  Only valid for
+  * HVS_PIXEL_FORMAT_RGB8888, not RGB888.
+  */
++/* For modes 332, 4444, 555, 5551, 6666, 8888, 10:10:10:2 */
+ #define HVS_PIXEL_ORDER_RGBA			0
+ #define HVS_PIXEL_ORDER_BGRA			1
+ #define HVS_PIXEL_ORDER_ARGB			2
+ #define HVS_PIXEL_ORDER_ABGR			3
+ 
++/* For modes 666 and 888 (4 & 5) */
+ #define HVS_PIXEL_ORDER_XBRG			0
+ #define HVS_PIXEL_ORDER_XRBG			1
+ #define HVS_PIXEL_ORDER_XRGB			2
+ #define HVS_PIXEL_ORDER_XBGR			3
+ 
++/* For YCbCr modes (8-12, and 17) */
+ #define HVS_PIXEL_ORDER_XYCBCR			0
+ #define HVS_PIXEL_ORDER_XYCRCB			1
+ #define HVS_PIXEL_ORDER_YXCBCR			2
diff --git a/target/linux/bcm27xx/patches-6.1/950-0053-drm-vc4-Add-async-update-support-for-cursor-planes.patch b/target/linux/bcm27xx/patches-6.1/950-0053-drm-vc4-Add-async-update-support-for-cursor-planes.patch
new file mode 100644
index 00000000000000..24e46f87e7831b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0053-drm-vc4-Add-async-update-support-for-cursor-planes.patch
@@ -0,0 +1,87 @@
+From e6f7f8f83e736bb94b146781b149810853b2bff3 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <8911409+pelwell@users.noreply.github.com>
+Date: Wed, 24 Aug 2022 11:14:40 +0100
+Subject: [PATCH] drm/vc4: Add async update support for cursor planes
+
+Now that cursors are implemented as regular planes, all cursor
+movements result in atomic updates. As the firmware-kms driver
+doesn't support asynchronous updates, these are synchronous, which
+limits the update rate to the screen refresh rate. Xorg seems unaware
+of this (or at least of the effect of this), because if the mouse is
+configured with a higher update rate than the screen then continuous
+mouse movement results in an increasing backlog of mouse events -
+cue extreme lag.
+
+Add minimal support for asynchronous updates - limited to cursor
+planes - to eliminate the lag.
+
+See: https://github.com/raspberrypi/linux/pull/4971
+     https://github.com/raspberrypi/linux/issues/4988
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_firmware_kms.c | 46 ++++++++++++++++++++++++++
+ 1 file changed, 46 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+@@ -675,6 +675,50 @@ static int vc4_plane_atomic_check(struct
+ 	return vc4_plane_to_mb(plane, &vc4_plane->mb, new_plane_state);
+ }
+ 
++static void vc4_plane_atomic_async_update(struct drm_plane *plane,
++					  struct drm_atomic_state *state)
++{
++	struct drm_plane_state *new_plane_state =
++		drm_atomic_get_new_plane_state(state, plane);
++
++	swap(plane->state->fb, new_plane_state->fb);
++	plane->state->crtc_x = new_plane_state->crtc_x;
++	plane->state->crtc_y = new_plane_state->crtc_y;
++	plane->state->crtc_w = new_plane_state->crtc_w;
++	plane->state->crtc_h = new_plane_state->crtc_h;
++	plane->state->src_x = new_plane_state->src_x;
++	plane->state->src_y = new_plane_state->src_y;
++	plane->state->src_w = new_plane_state->src_w;
++	plane->state->src_h = new_plane_state->src_h;
++	plane->state->alpha = new_plane_state->alpha;
++	plane->state->pixel_blend_mode = new_plane_state->pixel_blend_mode;
++	plane->state->rotation = new_plane_state->rotation;
++	plane->state->zpos = new_plane_state->zpos;
++	plane->state->normalized_zpos = new_plane_state->normalized_zpos;
++	plane->state->color_encoding = new_plane_state->color_encoding;
++	plane->state->color_range = new_plane_state->color_range;
++	plane->state->src = new_plane_state->src;
++	plane->state->dst = new_plane_state->dst;
++	plane->state->visible = new_plane_state->visible;
++
++	vc4_plane_set_blank(plane, false);
++}
++
++static int vc4_plane_atomic_async_check(struct drm_plane *plane,
++					struct drm_atomic_state *state)
++{
++	struct drm_plane_state *new_plane_state =
++		drm_atomic_get_new_plane_state(state, plane);
++	int ret = -EINVAL;
++
++	if (plane->type == 2 &&
++	    plane->state->fb &&
++	    new_plane_state->crtc->state->active)
++		ret = 0;
++
++	return ret;
++}
++
+ /* Called during init to allocate the plane's atomic state. */
+ static void vc4_plane_reset(struct drm_plane *plane)
+ {
+@@ -769,6 +813,8 @@ static const struct drm_plane_helper_fun
+ 	.atomic_check = vc4_plane_atomic_check,
+ 	.atomic_update = vc4_plane_atomic_update,
+ 	.atomic_disable = vc4_plane_atomic_disable,
++	.atomic_async_check = vc4_plane_atomic_async_check,
++	.atomic_async_update = vc4_plane_atomic_async_update,
+ };
+ 
+ static struct drm_plane *vc4_fkms_plane_init(struct drm_device *dev,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0054-drm-vc4-Configure-the-HVS-COB-allocations.patch b/target/linux/bcm27xx/patches-6.1/950-0054-drm-vc4-Configure-the-HVS-COB-allocations.patch
new file mode 100644
index 00000000000000..41d2d00dc504d0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0054-drm-vc4-Configure-the-HVS-COB-allocations.patch
@@ -0,0 +1,96 @@
+From 4477b8c71c8b3b5aa8bd15f9993f48d02d178fc5 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 11 Aug 2022 13:49:16 +0100
+Subject: [PATCH] drm/vc4: Configure the HVS COB allocations
+
+The HVS Composite Output Buffer (COB) is the memory used to
+generate the output pixel data.
+Until now the vc4 driver has been relying on the firmware to
+have set these to sensible values.
+
+In testing triple screen support it has been noted that only
+1 line was being assigned to HVS channel 2. Whilst that is fine
+for the transposer (TXP), and indeed needed as only some pixels
+have an alpha channel, it is insufficient to run a live display.
+
+Split the COB more evenly between the 3 HVS channels.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+Revert vc4_regs change
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 56 ++++++++++++++++++++++++++++++++++-
+ 1 file changed, 55 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -1013,7 +1013,7 @@ static int vc4_hvs_bind(struct device *d
+ 	struct vc4_hvs *hvs = NULL;
+ 	int ret;
+ 	u32 dispctrl;
+-	u32 reg;
++	u32 reg, top;
+ 
+ 	hvs = drmm_kzalloc(drm, sizeof(*hvs), GFP_KERNEL);
+ 	if (!hvs)
+@@ -1151,6 +1151,60 @@ static int vc4_hvs_bind(struct device *d
+ 
+ 	HVS_WRITE(SCALER_DISPCTRL, dispctrl);
+ 
++	/* Recompute Composite Output Buffer (COB) allocations for the displays
++	 */
++	if (!vc4->is_vc5) {
++		/* The COB is 20736 pixels, or just over 10 lines at 2048 wide.
++		 * The bottom 2048 pixels are full 32bpp RGBA (intended for the
++		 * TXP composing RGBA to memory), whilst the remainder are only
++		 * 24bpp RGB.
++		 *
++		 * Assign 3 lines to channels 1 & 2, and just over 4 lines to
++		 * channel 0.
++		 */
++		#define VC4_COB_SIZE		20736
++		#define VC4_COB_LINE_WIDTH	2048
++		#define VC4_COB_NUM_LINES	3
++		reg = 0;
++		top = VC4_COB_LINE_WIDTH * VC4_COB_NUM_LINES;
++		reg |= (top - 1) << 16;
++		HVS_WRITE(SCALER_DISPBASE2, reg);
++		reg = top;
++		top += VC4_COB_LINE_WIDTH * VC4_COB_NUM_LINES;
++		reg |= (top - 1) << 16;
++		HVS_WRITE(SCALER_DISPBASE1, reg);
++		reg = top;
++		top = VC4_COB_SIZE;
++		reg |= (top - 1) << 16;
++		HVS_WRITE(SCALER_DISPBASE0, reg);
++	} else {
++		/* The COB is 44416 pixels, or 10.8 lines at 4096 wide.
++		 * The bottom 4096 pixels are full RGBA (intended for the TXP
++		 * composing RGBA to memory), whilst the remainder are only
++		 * RGB. Addressing is always pixel wide.
++		 *
++		 * Assign 3 lines of 4096 to channels 1 & 2, and just over 4
++		 * lines. to channel 0.
++		 */
++		#define VC5_COB_SIZE		44416
++		#define VC5_COB_LINE_WIDTH	4096
++		#define VC5_COB_NUM_LINES	3
++		reg = 0;
++		top = VC5_COB_LINE_WIDTH * VC5_COB_NUM_LINES;
++		reg |= top << 16;
++		HVS_WRITE(SCALER_DISPBASE2, reg);
++		top += 16;
++		reg = top;
++		top += VC5_COB_LINE_WIDTH * VC5_COB_NUM_LINES;
++		reg |= top << 16;
++		HVS_WRITE(SCALER_DISPBASE1, reg);
++		top += 16;
++		reg = top;
++		top = VC5_COB_SIZE;
++		reg |= top << 16;
++		HVS_WRITE(SCALER_DISPBASE0, reg);
++	}
++
+ 	ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
+ 			       vc4_hvs_irq_handler, 0, "vc4 hvs", drm);
+ 	if (ret)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0055-drm-vc4-Set-AXI-panic-modes-for-the-HVS.patch b/target/linux/bcm27xx/patches-6.1/950-0055-drm-vc4-Set-AXI-panic-modes-for-the-HVS.patch
new file mode 100644
index 00000000000000..40465b0373db43
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0055-drm-vc4-Set-AXI-panic-modes-for-the-HVS.patch
@@ -0,0 +1,39 @@
+From b6b9915ad0b9c70c3b7edc45dfca2fdcfd4ba5cb Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 11 Aug 2022 13:59:34 +0100
+Subject: [PATCH] drm/vc4: Set AXI panic modes for the HVS
+
+The HVS can change AXI request mode based on how full the COB
+FIFOs are.
+Until now the vc4 driver has been relying on the firmware to
+have set these to sensible values.
+
+With HVS channel 2 now being used for live video, change the
+panic mode for all channels to be explicitly set by the driver,
+and the same for all channels.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -1149,6 +1149,17 @@ static int vc4_hvs_bind(struct device *d
+ 	dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC1);
+ 	dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC2);
+ 
++	/* Set AXI panic mode.
++	 * VC4 panics when < 2 lines in FIFO.
++	 * VC5 panics when less than 1 line in the FIFO.
++	 */
++	dispctrl &= ~(SCALER_DISPCTRL_PANIC0_MASK |
++		      SCALER_DISPCTRL_PANIC1_MASK |
++		      SCALER_DISPCTRL_PANIC2_MASK);
++	dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC0);
++	dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC1);
++	dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC2);
++
+ 	HVS_WRITE(SCALER_DISPCTRL, dispctrl);
+ 
+ 	/* Recompute Composite Output Buffer (COB) allocations for the displays
diff --git a/target/linux/bcm27xx/patches-6.1/950-0056-drm-vc4-hvs-Skip-DebugFS-Registration-for-FKMS.patch b/target/linux/bcm27xx/patches-6.1/950-0056-drm-vc4-hvs-Skip-DebugFS-Registration-for-FKMS.patch
new file mode 100644
index 00000000000000..d40d5a7b252d19
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0056-drm-vc4-hvs-Skip-DebugFS-Registration-for-FKMS.patch
@@ -0,0 +1,25 @@
+From 6674a753e11c7c623926a8fed128a9ed86530e5c Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 11 Jul 2022 10:38:25 +0200
+Subject: [PATCH] drm/vc4: hvs: Skip DebugFS Registration for FKMS
+
+FKMS doesn't have an HVS and it's expected. Return from the debugfs init
+function immediately if we're running with fkms.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -975,6 +975,9 @@ int vc4_hvs_debugfs_init(struct drm_mino
+ 	struct vc4_hvs *hvs = vc4->hvs;
+ 	int ret;
+ 
++	if (vc4->firmware_kms)
++		return 0;
++
+ 	if (!vc4->hvs)
+ 		return -ENODEV;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0057-media-uapi-Add-some-RGB-bus-formats-for-VC4-DPI-outp.patch b/target/linux/bcm27xx/patches-6.1/950-0057-media-uapi-Add-some-RGB-bus-formats-for-VC4-DPI-outp.patch
new file mode 100644
index 00000000000000..2979aede23dd7f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0057-media-uapi-Add-some-RGB-bus-formats-for-VC4-DPI-outp.patch
@@ -0,0 +1,40 @@
+From 8400889a0f241a12353673c35087bf6c38ea09e9 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 15 Aug 2022 13:34:02 +0200
+Subject: [PATCH] media: uapi: Add some RGB bus formats for VC4 DPI
+ output
+
+The VC4 DPI controller can output more RGB formats that aren't described
+through a media bus format yet, so let's add them.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ include/uapi/linux/media-bus-format.h | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/include/uapi/linux/media-bus-format.h
++++ b/include/uapi/linux/media-bus-format.h
+@@ -34,19 +34,22 @@
+ 
+ #define MEDIA_BUS_FMT_FIXED			0x0001
+ 
+-/* RGB - next is	0x1022 */
++/* RGB - next is	0x1025 */
+ #define MEDIA_BUS_FMT_RGB444_1X12		0x1016
+ #define MEDIA_BUS_FMT_RGB444_2X8_PADHI_BE	0x1001
+ #define MEDIA_BUS_FMT_RGB444_2X8_PADHI_LE	0x1002
+ #define MEDIA_BUS_FMT_RGB555_2X8_PADHI_BE	0x1003
+ #define MEDIA_BUS_FMT_RGB555_2X8_PADHI_LE	0x1004
+ #define MEDIA_BUS_FMT_RGB565_1X16		0x1017
++#define MEDIA_BUS_FMT_RGB565_1X24_CPADHI	0x1022
+ #define MEDIA_BUS_FMT_BGR565_2X8_BE		0x1005
+ #define MEDIA_BUS_FMT_BGR565_2X8_LE		0x1006
+ #define MEDIA_BUS_FMT_RGB565_2X8_BE		0x1007
+ #define MEDIA_BUS_FMT_RGB565_2X8_LE		0x1008
++#define MEDIA_BUS_FMT_BGR666_1X18		0x1023
+ #define MEDIA_BUS_FMT_RGB666_1X18		0x1009
+ #define MEDIA_BUS_FMT_RBG888_1X24		0x100e
++#define MEDIA_BUS_FMT_BGR666_1X24_CPADHI	0x1024
+ #define MEDIA_BUS_FMT_RGB666_1X24_CPADHI	0x1015
+ #define MEDIA_BUS_FMT_RGB666_1X7X3_SPWG		0x1010
+ #define MEDIA_BUS_FMT_BGR888_1X24		0x1013
diff --git a/target/linux/bcm27xx/patches-6.1/950-0058-raspberrypi-firmware-Update-mailbox-commands.patch b/target/linux/bcm27xx/patches-6.1/950-0058-raspberrypi-firmware-Update-mailbox-commands.patch
new file mode 100644
index 00000000000000..4db60cca8037f1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0058-raspberrypi-firmware-Update-mailbox-commands.patch
@@ -0,0 +1,99 @@
+From 9c48213eaa5603790ef3213637fd49bdb07e234a Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Thu, 7 Apr 2022 18:23:07 +0100
+Subject: [PATCH] raspberrypi-firmware: Update mailbox commands
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ include/soc/bcm2835/raspberrypi-firmware.h | 28 +++++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+--- a/include/soc/bcm2835/raspberrypi-firmware.h
++++ b/include/soc/bcm2835/raspberrypi-firmware.h
+@@ -36,6 +36,8 @@ struct rpi_firmware_property_tag_header
+ enum rpi_firmware_property_tag {
+ 	RPI_FIRMWARE_PROPERTY_END =                           0,
+ 	RPI_FIRMWARE_GET_FIRMWARE_REVISION =                  0x00000001,
++	RPI_FIRMWARE_GET_FIRMWARE_VARIANT =                   0x00000002,
++	RPI_FIRMWARE_GET_FIRMWARE_HASH =                      0x00000003,
+ 
+ 	RPI_FIRMWARE_SET_CURSOR_INFO =                        0x00008010,
+ 	RPI_FIRMWARE_SET_CURSOR_STATE =                       0x00008011,
+@@ -71,6 +73,7 @@ enum rpi_firmware_property_tag {
+ 	RPI_FIRMWARE_GET_DISPMANX_RESOURCE_MEM_HANDLE =       0x00030014,
+ 	RPI_FIRMWARE_GET_EDID_BLOCK =                         0x00030020,
+ 	RPI_FIRMWARE_GET_CUSTOMER_OTP =                       0x00030021,
++	RPI_FIRMWARE_GET_EDID_BLOCK_DISPLAY =                 0x00030023,
+ 	RPI_FIRMWARE_GET_DOMAIN_STATE =                       0x00030030,
+ 	RPI_FIRMWARE_GET_THROTTLED =                          0x00030046,
+ 	RPI_FIRMWARE_GET_CLOCK_MEASURED =                     0x00030047,
+@@ -89,8 +92,11 @@ enum rpi_firmware_property_tag {
+ 	RPI_FIRMWARE_GET_PERIPH_REG =                         0x00030045,
+ 	RPI_FIRMWARE_SET_PERIPH_REG =                         0x00038045,
+ 	RPI_FIRMWARE_GET_POE_HAT_VAL =                        0x00030049,
+-	RPI_FIRMWARE_SET_POE_HAT_VAL =                        0x00030050,
++	RPI_FIRMWARE_SET_POE_HAT_VAL =                        0x00038049,
++	RPI_FIRMWARE_SET_POE_HAT_VAL_OLD =                    0x00030050,
+ 	RPI_FIRMWARE_NOTIFY_XHCI_RESET =                      0x00030058,
++	RPI_FIRMWARE_GET_REBOOT_FLAGS =                       0x00030064,
++	RPI_FIRMWARE_SET_REBOOT_FLAGS =                       0x00038064,
+ 	RPI_FIRMWARE_NOTIFY_DISPLAY_DONE =                    0x00030066,
+ 
+ 	/* Dispmanx TAGS */
+@@ -105,9 +111,16 @@ enum rpi_firmware_property_tag {
+ 	RPI_FIRMWARE_FRAMEBUFFER_GET_VIRTUAL_OFFSET =         0x00040009,
+ 	RPI_FIRMWARE_FRAMEBUFFER_GET_OVERSCAN =               0x0004000a,
+ 	RPI_FIRMWARE_FRAMEBUFFER_GET_PALETTE =                0x0004000b,
++	RPI_FIRMWARE_FRAMEBUFFER_GET_LAYER =                  0x0004000c,
++	RPI_FIRMWARE_FRAMEBUFFER_GET_TRANSFORM =              0x0004000d,
++	RPI_FIRMWARE_FRAMEBUFFER_GET_VSYNC =                  0x0004000e,
+ 	RPI_FIRMWARE_FRAMEBUFFER_GET_TOUCHBUF =               0x0004000f,
+ 	RPI_FIRMWARE_FRAMEBUFFER_GET_GPIOVIRTBUF =            0x00040010,
+ 	RPI_FIRMWARE_FRAMEBUFFER_RELEASE =                    0x00048001,
++	RPI_FIRMWARE_FRAMEBUFFER_GET_DISPLAY_ID =             0x00040016,
++	RPI_FIRMWARE_FRAMEBUFFER_SET_DISPLAY_NUM =            0x00048013,
++	RPI_FIRMWARE_FRAMEBUFFER_GET_NUM_DISPLAYS =           0x00040013,
++	RPI_FIRMWARE_FRAMEBUFFER_GET_DISPLAY_SETTINGS =       0x00040014,
+ 	RPI_FIRMWARE_FRAMEBUFFER_TEST_PHYSICAL_WIDTH_HEIGHT = 0x00044003,
+ 	RPI_FIRMWARE_FRAMEBUFFER_TEST_VIRTUAL_WIDTH_HEIGHT =  0x00044004,
+ 	RPI_FIRMWARE_FRAMEBUFFER_TEST_DEPTH =                 0x00044005,
+@@ -116,26 +129,39 @@ enum rpi_firmware_property_tag {
+ 	RPI_FIRMWARE_FRAMEBUFFER_TEST_VIRTUAL_OFFSET =        0x00044009,
+ 	RPI_FIRMWARE_FRAMEBUFFER_TEST_OVERSCAN =              0x0004400a,
+ 	RPI_FIRMWARE_FRAMEBUFFER_TEST_PALETTE =               0x0004400b,
++	RPI_FIRMWARE_FRAMEBUFFER_TEST_LAYER =                 0x0004400c,
++	RPI_FIRMWARE_FRAMEBUFFER_TEST_TRANSFORM =             0x0004400d,
+ 	RPI_FIRMWARE_FRAMEBUFFER_TEST_VSYNC =                 0x0004400e,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_PHYSICAL_WIDTH_HEIGHT =  0x00048003,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_WIDTH_HEIGHT =   0x00048004,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_DEPTH =                  0x00048005,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_PIXEL_ORDER =            0x00048006,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_ALPHA_MODE =             0x00048007,
++	RPI_FIRMWARE_FRAMEBUFFER_SET_PITCH =                  0x00048008,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_OFFSET =         0x00048009,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_OVERSCAN =               0x0004800a,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_PALETTE =                0x0004800b,
++
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_TOUCHBUF =               0x0004801f,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_GPIOVIRTBUF =            0x00048020,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_VSYNC =                  0x0004800e,
++	RPI_FIRMWARE_FRAMEBUFFER_SET_LAYER =                  0x0004800c,
++	RPI_FIRMWARE_FRAMEBUFFER_SET_TRANSFORM =              0x0004800d,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_BACKLIGHT =              0x0004800f,
+ 
+ 	RPI_FIRMWARE_VCHIQ_INIT =                             0x00048010,
+ 
++	RPI_FIRMWARE_SET_PLANE =                              0x00048015,
++	RPI_FIRMWARE_GET_DISPLAY_TIMING =                     0x00040017,
++	RPI_FIRMWARE_SET_TIMING =                             0x00048017,
++	RPI_FIRMWARE_GET_DISPLAY_CFG =                        0x00040018,
++	RPI_FIRMWARE_SET_DISPLAY_POWER =		      0x00048019,
+ 	RPI_FIRMWARE_GET_COMMAND_LINE =                       0x00050001,
+ 	RPI_FIRMWARE_GET_DMA_CHANNELS =                       0x00060001,
+ };
+ 
++#define GET_DISPLAY_SETTINGS_PAYLOAD_SIZE 64
++
+ #if IS_ENABLED(CONFIG_RASPBERRYPI_FIRMWARE)
+ int rpi_firmware_property(struct rpi_firmware *fw,
+ 			  u32 tag, void *data, size_t len);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0059-clk-bcm-rpi-Create-helper-to-retrieve-private-data.patch b/target/linux/bcm27xx/patches-6.1/950-0059-clk-bcm-rpi-Create-helper-to-retrieve-private-data.patch
new file mode 100644
index 00000000000000..1fd0792ddc62e6
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0059-clk-bcm-rpi-Create-helper-to-retrieve-private-data.patch
@@ -0,0 +1,70 @@
+From cdb7a9e14810f5cd40abf9cd3959294ee9283069 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 11 Jul 2022 15:58:36 +0200
+Subject: [PATCH] clk: bcm: rpi: Create helper to retrieve private data
+
+The RaspberryPi firmware clocks driver uses in several instances a
+container_of to retrieve the struct raspberrypi_clk_data from a pointer
+to struct clk_hw. Let's create a small function to avoid duplicating it
+all over the place.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/clk/bcm/clk-raspberrypi.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/clk/bcm/clk-raspberrypi.c
++++ b/drivers/clk/bcm/clk-raspberrypi.c
+@@ -75,6 +75,12 @@ struct raspberrypi_clk_data {
+ 	struct raspberrypi_clk *rpi;
+ };
+ 
++static inline
++const struct raspberrypi_clk_data *clk_hw_to_data(const struct clk_hw *hw)
++{
++	return container_of(hw, struct raspberrypi_clk_data, hw);
++}
++
+ struct raspberrypi_clk_variant {
+ 	bool		export;
+ 	char		*clkdev;
+@@ -187,8 +193,7 @@ static int raspberrypi_clock_property(st
+ 
+ static int raspberrypi_fw_is_prepared(struct clk_hw *hw)
+ {
+-	struct raspberrypi_clk_data *data =
+-		container_of(hw, struct raspberrypi_clk_data, hw);
++	const struct raspberrypi_clk_data *data = clk_hw_to_data(hw);
+ 	struct raspberrypi_clk *rpi = data->rpi;
+ 	u32 val = 0;
+ 	int ret;
+@@ -205,8 +210,7 @@ static int raspberrypi_fw_is_prepared(st
+ static unsigned long raspberrypi_fw_get_rate(struct clk_hw *hw,
+ 					     unsigned long parent_rate)
+ {
+-	struct raspberrypi_clk_data *data =
+-		container_of(hw, struct raspberrypi_clk_data, hw);
++	const struct raspberrypi_clk_data *data = clk_hw_to_data(hw);
+ 	struct raspberrypi_clk *rpi = data->rpi;
+ 	u32 val = 0;
+ 	int ret;
+@@ -222,8 +226,7 @@ static unsigned long raspberrypi_fw_get_
+ static int raspberrypi_fw_set_rate(struct clk_hw *hw, unsigned long rate,
+ 				   unsigned long parent_rate)
+ {
+-	struct raspberrypi_clk_data *data =
+-		container_of(hw, struct raspberrypi_clk_data, hw);
++	const struct raspberrypi_clk_data *data = clk_hw_to_data(hw);
+ 	struct raspberrypi_clk *rpi = data->rpi;
+ 	u32 _rate = rate;
+ 	int ret;
+@@ -240,8 +243,7 @@ static int raspberrypi_fw_set_rate(struc
+ static int raspberrypi_fw_dumb_determine_rate(struct clk_hw *hw,
+ 					      struct clk_rate_request *req)
+ {
+-	struct raspberrypi_clk_data *data =
+-		container_of(hw, struct raspberrypi_clk_data, hw);
++	const struct raspberrypi_clk_data *data = clk_hw_to_data(hw);
+ 	struct raspberrypi_clk_variant *variant = data->variant;
+ 
+ 	/*
diff --git a/target/linux/bcm27xx/patches-6.1/950-0060-arm64-setup-Fix-build-warning.patch b/target/linux/bcm27xx/patches-6.1/950-0060-arm64-setup-Fix-build-warning.patch
new file mode 100644
index 00000000000000..bc6065bce84df1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0060-arm64-setup-Fix-build-warning.patch
@@ -0,0 +1,24 @@
+From eedea0d30a542f255626876be44929af8efc337a Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 6 Jun 2022 11:02:16 +0200
+Subject: [PATCH] arm64: setup: Fix build warning
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ arch/arm64/kernel/setup.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/kernel/setup.c
++++ b/arch/arm64/kernel/setup.c
+@@ -222,9 +222,9 @@ static void __init request_standard_reso
+ 	size_t res_size;
+ 
+ 	kernel_code.start   = __pa_symbol(_stext);
+-	kernel_code.end     = __pa_symbol(__init_begin - 1);
++	kernel_code.end     = __pa_symbol(__init_begin) - 1;
+ 	kernel_data.start   = __pa_symbol(_sdata);
+-	kernel_data.end     = __pa_symbol(_end - 1);
++	kernel_data.end     = __pa_symbol(_end) - 1;
+ 	insert_resource(&iomem_resource, &kernel_code);
+ 	insert_resource(&iomem_resource, &kernel_data);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0061-BCM2708-Add-core-Device-Tree-support.patch b/target/linux/bcm27xx/patches-6.1/950-0061-BCM2708-Add-core-Device-Tree-support.patch
new file mode 100644
index 00000000000000..442abb456fde12
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0061-BCM2708-Add-core-Device-Tree-support.patch
@@ -0,0 +1,37866 @@
+From c34870e7abd75a66d473b1e3c12d47e8b9c349e6 Mon Sep 17 00:00:00 2001
+From: notro <notro@tronnes.org>
+Date: Wed, 9 Jul 2014 14:46:08 +0200
+Subject: [PATCH] BCM2708: Add core Device Tree support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Add the bare minimum needed to boot BCM2708 from a Device Tree.
+
+Signed-off-by: Noralf Tronnes <notro@tronnes.org>
+
+BCM2708: DT: change 'axi' nodename to 'soc'
+
+Change DT node named 'axi' to 'soc' so it matches ARCH_BCM2835.
+The VC4 bootloader fills in certain properties in the 'axi' subtree,
+but since this is part of an upstreaming effort, the name is changed.
+
+Signed-off-by: Noralf Tronnes notro@tronnes.org
+
+BCM2708_DT: Correct length of the peripheral space
+
+Use dts-dirs feature for overlays.
+
+The kernel makefiles have a dts-dirs target that is for vendor subdirectories.
+
+Using this fixes the install_dtbs target, which previously did not install the overlays.
+
+BCM270X_DT: configure I2S DMA channels
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+BCM270X_DT: switch to bcm2835-i2s
+
+I2S soundcard drivers with proper devicetree support (i.e. not linking
+to the cpu_dai/platform via name but to cpu/platform via of_node)
+will work out of the box without any modifications.
+
+When the kernel is compiled without devicetree support the platform
+code will instantiate the bcm2708-i2s driver and I2S soundcard drivers
+will link to it via name, as before.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+SDIO-overlay: add poll_once-boolean parameter
+
+Add paramter to toggle sdio-device-polling
+done every second or once at boot-time.
+
+Signed-off-by: Patrick Boettcher <patrick.boettcher@posteo.de>
+
+BCM270X_DT: Make mmc overlay compatible with current firmware
+
+The original DT overlay logic followed a merge-then-patch procedure,
+i.e. parameters are applied to the loaded overlay before the overlay
+is merged into the base DTB. This sequence has been changed to
+patch-then-merge, in order to support parameterised node names, and
+to protect against bad overlays. As a result, overrides (parameters)
+must only target labels in the overlay, but the overlay can obviously target nodes in the base DTB.
+
+mmc-overlay.dts (that switches back to the original mmc sdcard
+driver) is the only overlay violating that rule, and this patch
+fixes it.
+
+bcm270x_dt: Use the sdhost MMC controller by default
+
+The "mmc" overlay reverts to using the other controller.
+
+squash: Add cprman to dt
+
+BCM270X_DT: Use clk_core for I2C interfaces
+
+BCM270X_DT: Use bcm283x.dtsi, bcm2835.dtsi and bcm2836.dtsi
+
+The mainline Device Tree files are quite close to downstream now.
+Let's use bcm283x.dtsi, bcm2835.dtsi and bcm2836.dtsi as base files
+for our dts files.
+
+Mainline dts files are based on these files:
+
+          bcm2835-rpi.dtsi
+  bcm2835.dtsi    bcm2836.dtsi
+          bcm283x.dtsi
+
+Current downstream are based on these:
+
+  bcm2708.dtsi    bcm2709.dtsi    bcm2710.dtsi
+             bcm2708_common.dtsi
+
+This patch introduces this dependency:
+
+  bcm2708.dtsi    bcm2709.dtsi
+          bcm2708-rpi.dtsi
+          bcm270x.dtsi
+  bcm2835.dtsi    bcm2836.dtsi
+          bcm283x.dtsi
+
+And:
+          bcm2710.dtsi
+          bcm2708-rpi.dtsi
+          bcm270x.dtsi
+          bcm283x.dtsi
+
+bcm270x.dtsi contains the downstream bcm283x.dtsi diff.
+bcm2708-rpi.dtsi is the downstream version of bcm2835-rpi.dtsi.
+
+Other changes:
+- The led node has moved from /soc/leds to /leds. This is not a problem
+  since the label is used to reference it.
+- The clk_osc reg property changes from 6 to 3.
+- The gpu nodes has their interrupt property set in the base file.
+- the clocks label does not point to the /clocks node anymore, but
+  points to the cprman node. This is not a problem since the overlays
+  that use the clock node refer to it directly: target-path = "/clocks";
+- some nodes now have 2 labels since mainline and downstream differs in
+  this respect: cprman/clocks, spi0/spi, gpu/vc4.
+- some nodes doesn't have an explicit status = "okay" since they're not
+  disabled in the base file: watchdog and random.
+- gpiomem doesn't need an explicit status = "okay".
+- bcm2708-rpi-cm.dts got the hpd-gpios property from bcm2708_common.dtsi,
+  it's now set directly in that file.
+- bcm2709-rpi-2-b.dts has the timer node moved from /soc/timer to /timer.
+- Removed clock-frequency property on the bcm{2709,2710}.dtsi timer nodes.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+BCM270X_DT: Use raspberrypi-power to turn on USB power
+
+Use the raspberrypi-power driver to turn on USB power.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+BCM270X_DT: Add a .dtbo target, use for overlays
+
+Change the filenames and extensions to keep the pre-DDT style of
+overlay (<name>-overlay.dtb) distinct from new ones that use a
+different style of local fixups (<name>.dtbo), and to match other
+platforms.
+
+The RPi firmware uses the DDTK trailer atom to choose which type of
+overlay to use for each kernel.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+BCM270X_DT: Don't generate "linux,phandle" props
+
+The EPAPR standard says to use "phandle" properties to store phandles,
+rather than the deprecated "linux,phandle" version. By default, dtc
+generates both, but adding "-H epapr" causes it to only generate
+"phandle"s, saving some space and clutter.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+BCM270X_DT: Add overlay for enc28j60 on SPI2
+
+Works on SPI2 for compute module
+
+BCM270X_DT: Add midi-uart0 overlay
+
+MIDI requires 31.25kbaud, a baudrate unsupported by Linux. The
+midi-uart0 overlay configures uart0 (ttyAMA0) to use a fake clock
+so that requesting 38.4kbaud actually gets 31.25kbaud.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+BCM270X_DT: Add i2c-sensor overlay
+
+The i2c-sensor overlay is a container for various pressure and
+temperature sensors, currently bmp085 and bmp280. The standalone
+bmp085_i2c-sensor overlay is now deprecated.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+BCM270X_DT: overlays/*-overlay.dtb -> overlays/*.dtbo (#1752)
+
+We now create overlays as .dtbo files.
+
+build: support for .dtbo files for dtb overlays
+
+Kernel 4.4.6+ on RaspberryPi support .dtbo files for overlays, instead of .dtb.
+Patch the kernel, which has faulty rules to generate .dtbo the way yocto does
+
+Signed-off-by: Herve Jourdain <herve.jourdain@neuf.fr>
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+
+BCM270X: Drop position requirement for CMA in VC4 overlay.
+
+No longer necessary since 2aefcd576195a739a7a256099571c9c4a401005f,
+and will probably let peeople that want to choose a larger CMA
+allocation (particularly on pi0/1).
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+
+BCM270X_DT: RPi Device Tree tidy
+
+Use the upstream sdhost node, add thermal-zones, and factor out some
+common elements.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+kbuild: Silence unhelpful DTC warnings
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+BCM270X_DT: DT build rules no longer arch-specific
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ arch/arm/boot/dts/Makefile                    |   31 +
+ arch/arm/boot/dts/bcm2708-rpi-b-plus.dts      |  200 +
+ arch/arm/boot/dts/bcm2708-rpi-b-rev1.dts      |  208 +
+ arch/arm/boot/dts/bcm2708-rpi-b.dts           |  190 +
+ arch/arm/boot/dts/bcm2708-rpi-bt.dtsi         |   26 +
+ arch/arm/boot/dts/bcm2708-rpi-cm.dts          |  171 +
+ arch/arm/boot/dts/bcm2708-rpi-cm.dtsi         |   22 +
+ arch/arm/boot/dts/bcm2708-rpi-zero-w.dts      |  246 +
+ arch/arm/boot/dts/bcm2708-rpi-zero.dts        |  187 +
+ arch/arm/boot/dts/bcm2708-rpi.dtsi            |   40 +
+ arch/arm/boot/dts/bcm2708.dtsi                |   18 +
+ arch/arm/boot/dts/bcm2709-rpi-2-b.dts         |  200 +
+ arch/arm/boot/dts/bcm2709-rpi-cm2.dts         |  221 +
+ arch/arm/boot/dts/bcm2709-rpi.dtsi            |    5 +
+ arch/arm/boot/dts/bcm2709.dtsi                |   24 +
+ arch/arm/boot/dts/bcm270x-rpi.dtsi            |  177 +
+ arch/arm/boot/dts/bcm270x.dtsi                |  294 ++
+ arch/arm/boot/dts/bcm2710-rpi-2-b.dts         |  200 +
+ arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts    |  289 ++
+ arch/arm/boot/dts/bcm2710-rpi-3-b.dts         |  291 ++
+ arch/arm/boot/dts/bcm2710-rpi-cm3.dts         |  220 +
+ arch/arm/boot/dts/bcm2710-rpi-zero-2-w.dts    |  267 +
+ arch/arm/boot/dts/bcm2710-rpi-zero-2.dts      |    1 +
+ arch/arm/boot/dts/bcm2710.dtsi                |   27 +
+ arch/arm/boot/dts/bcm2711-rpi-4-b.dts         |  320 +-
+ arch/arm/boot/dts/bcm2711-rpi-400.dts         |  532 +-
+ arch/arm/boot/dts/bcm2711-rpi-cm4.dts         |  578 +++
+ arch/arm/boot/dts/bcm2711-rpi-cm4s.dts        |  427 ++
+ arch/arm/boot/dts/bcm2711-rpi-ds.dtsi         |  292 ++
+ arch/arm/boot/dts/bcm2711-rpi.dtsi            |   13 +
+ arch/arm/boot/dts/bcm271x-rpi-bt.dtsi         |   26 +
+ arch/arm/boot/dts/bcm283x-rpi-csi0-2lane.dtsi |    4 +
+ arch/arm/boot/dts/bcm283x-rpi-csi1-2lane.dtsi |    4 +
+ arch/arm/boot/dts/bcm283x-rpi-csi1-4lane.dtsi |    4 +
+ .../boot/dts/bcm283x-rpi-i2c0mux_0_28.dtsi    |    4 +
+ .../boot/dts/bcm283x-rpi-i2c0mux_0_44.dtsi    |    4 +
+ arch/arm/boot/dts/overlays/Makefile           |  287 ++
+ arch/arm/boot/dts/overlays/README             | 4513 +++++++++++++++++
+ .../arm/boot/dts/overlays/act-led-overlay.dts |   27 +
+ .../dts/overlays/adafruit-st7735r-overlay.dts |   83 +
+ .../boot/dts/overlays/adafruit18-overlay.dts  |   55 +
+ .../dts/overlays/adau1977-adc-overlay.dts     |   40 +
+ .../dts/overlays/adau7002-simple-overlay.dts  |   52 +
+ .../arm/boot/dts/overlays/ads1015-overlay.dts |   98 +
+ .../arm/boot/dts/overlays/ads1115-overlay.dts |  103 +
+ .../arm/boot/dts/overlays/ads7846-overlay.dts |   89 +
+ .../boot/dts/overlays/adv7282m-overlay.dts    |   73 +
+ .../boot/dts/overlays/adv728x-m-overlay.dts   |   37 +
+ .../overlays/akkordion-iqdacplus-overlay.dts  |   49 +
+ .../allo-boss-dac-pcm512x-audio-overlay.dts   |   59 +
+ .../overlays/allo-boss2-dac-audio-overlay.dts |   57 +
+ .../dts/overlays/allo-digione-overlay.dts     |   44 +
+ .../allo-katana-dac-audio-overlay.dts         |   57 +
+ .../allo-piano-dac-pcm512x-audio-overlay.dts  |   54 +
+ ...o-piano-dac-plus-pcm512x-audio-overlay.dts |   57 +
+ arch/arm/boot/dts/overlays/anyspi-overlay.dts |  205 +
+ .../boot/dts/overlays/apds9960-overlay.dts    |   55 +
+ .../boot/dts/overlays/applepi-dac-overlay.dts |   57 +
+ .../dts/overlays/arducam-64mp-overlay.dts     |   94 +
+ .../overlays/arducam-pivariety-overlay.dts    |   94 +
+ .../boot/dts/overlays/at86rf233-overlay.dts   |   57 +
+ .../overlays/audioinjector-addons-overlay.dts |   60 +
+ .../audioinjector-bare-i2s-overlay.dts        |   50 +
+ ...dioinjector-isolated-soundcard-overlay.dts |   55 +
+ .../overlays/audioinjector-ultra-overlay.dts  |   71 +
+ .../audioinjector-wm8731-audio-overlay.dts    |   39 +
+ .../dts/overlays/audiosense-pi-overlay.dts    |   82 +
+ .../boot/dts/overlays/audremap-overlay.dts    |   44 +
+ .../boot/dts/overlays/balena-fin-overlay.dts  |  125 +
+ .../dts/overlays/camera-mux-2port-overlay.dts |  409 ++
+ .../dts/overlays/camera-mux-4port-overlay.dts |  684 +++
+ .../arm/boot/dts/overlays/cap1106-overlay.dts |   52 +
+ .../boot/dts/overlays/chipdip-dac-overlay.dts |   46 +
+ .../dts/overlays/cirrus-wm5102-overlay.dts    |  172 +
+ arch/arm/boot/dts/overlays/cma-overlay.dts    |   36 +
+ .../dts/overlays/cutiepi-panel-overlay.dts    |  117 +
+ .../boot/dts/overlays/dacberry400-overlay.dts |   71 +
+ arch/arm/boot/dts/overlays/dht11-overlay.dts  |   48 +
+ .../dts/overlays/dionaudio-kiwi-overlay.dts   |   39 +
+ .../dts/overlays/dionaudio-loco-overlay.dts   |   39 +
+ .../overlays/dionaudio-loco-v2-overlay.dts    |   49 +
+ .../boot/dts/overlays/disable-bt-overlay.dts  |   64 +
+ .../dts/overlays/disable-wifi-overlay.dts     |   20 +
+ arch/arm/boot/dts/overlays/dpi18-overlay.dts  |   39 +
+ .../boot/dts/overlays/dpi18cpadhi-overlay.dts |   26 +
+ arch/arm/boot/dts/overlays/dpi24-overlay.dts  |   39 +
+ arch/arm/boot/dts/overlays/draws-overlay.dts  |  208 +
+ .../arm/boot/dts/overlays/dwc-otg-overlay.dts |   14 +
+ arch/arm/boot/dts/overlays/dwc2-overlay.dts   |   26 +
+ .../boot/dts/overlays/edt-ft5406-overlay.dts  |   26 +
+ arch/arm/boot/dts/overlays/edt-ft5406.dtsi    |   47 +
+ .../boot/dts/overlays/enc28j60-overlay.dts    |   53 +
+ .../dts/overlays/enc28j60-spi2-overlay.dts    |   47 +
+ .../arm/boot/dts/overlays/exc3000-overlay.dts |   48 +
+ arch/arm/boot/dts/overlays/fbtft-overlay.dts  |  611 +++
+ .../boot/dts/overlays/fe-pi-audio-overlay.dts |   70 +
+ .../boot/dts/overlays/fsm-demo-overlay.dts    |  104 +
+ arch/arm/boot/dts/overlays/gc9a01-overlay.dts |  151 +
+ .../boot/dts/overlays/ghost-amp-overlay.dts   |  145 +
+ arch/arm/boot/dts/overlays/goodix-overlay.dts |   46 +
+ .../googlevoicehat-soundcard-overlay.dts      |   49 +
+ .../boot/dts/overlays/gpio-fan-overlay.dts    |   89 +
+ .../boot/dts/overlays/gpio-hog-overlay.dts    |   27 +
+ .../arm/boot/dts/overlays/gpio-ir-overlay.dts |   49 +
+ .../boot/dts/overlays/gpio-ir-tx-overlay.dts  |   36 +
+ .../boot/dts/overlays/gpio-key-overlay.dts    |   48 +
+ .../boot/dts/overlays/gpio-led-overlay.dts    |   97 +
+ .../overlays/gpio-no-bank0-irq-overlay.dts    |   14 +
+ .../boot/dts/overlays/gpio-no-irq-overlay.dts |   14 +
+ .../dts/overlays/gpio-poweroff-overlay.dts    |   39 +
+ .../dts/overlays/gpio-shutdown-overlay.dts    |   86 +
+ .../boot/dts/overlays/hd44780-lcd-overlay.dts |   46 +
+ .../hdmi-backlight-hwhack-gpio-overlay.dts    |   47 +
+ .../dts/overlays/hifiberry-amp-overlay.dts    |   39 +
+ .../dts/overlays/hifiberry-amp100-overlay.dts |   64 +
+ .../dts/overlays/hifiberry-amp3-overlay.dts   |   57 +
+ .../dts/overlays/hifiberry-dac-overlay.dts    |   34 +
+ .../overlays/hifiberry-dacplus-overlay.dts    |   65 +
+ .../overlays/hifiberry-dacplusadc-overlay.dts |   72 +
+ .../hifiberry-dacplusadcpro-overlay.dts       |   70 +
+ .../overlays/hifiberry-dacplusdsp-overlay.dts |   34 +
+ .../overlays/hifiberry-dacplushd-overlay.dts  |   94 +
+ .../dts/overlays/hifiberry-digi-overlay.dts   |   41 +
+ .../overlays/hifiberry-digi-pro-overlay.dts   |   43 +
+ .../boot/dts/overlays/highperi-overlay.dts    |   63 +
+ arch/arm/boot/dts/overlays/hy28a-overlay.dts  |   93 +
+ .../boot/dts/overlays/hy28b-2017-overlay.dts  |  152 +
+ arch/arm/boot/dts/overlays/hy28b-overlay.dts  |  148 +
+ .../boot/dts/overlays/i-sabre-q2m-overlay.dts |   39 +
+ .../boot/dts/overlays/i2c-bcm2708-overlay.dts |   13 +
+ .../arm/boot/dts/overlays/i2c-fan-overlay.dts |  108 +
+ .../boot/dts/overlays/i2c-gpio-overlay.dts    |   47 +
+ .../arm/boot/dts/overlays/i2c-mux-overlay.dts |  139 +
+ .../dts/overlays/i2c-pwm-pca9685a-overlay.dts |   26 +
+ .../arm/boot/dts/overlays/i2c-rtc-common.dtsi |  351 ++
+ .../dts/overlays/i2c-rtc-gpio-overlay.dts     |   31 +
+ .../arm/boot/dts/overlays/i2c-rtc-overlay.dts |   42 +
+ .../boot/dts/overlays/i2c-sensor-common.dtsi  |  341 ++
+ .../boot/dts/overlays/i2c-sensor-overlay.dts  |   42 +
+ arch/arm/boot/dts/overlays/i2c0-overlay.dts   |   83 +
+ arch/arm/boot/dts/overlays/i2c1-overlay.dts   |   44 +
+ arch/arm/boot/dts/overlays/i2c3-overlay.dts   |   36 +
+ arch/arm/boot/dts/overlays/i2c4-overlay.dts   |   36 +
+ arch/arm/boot/dts/overlays/i2c5-overlay.dts   |   36 +
+ arch/arm/boot/dts/overlays/i2c6-overlay.dts   |   36 +
+ .../arm/boot/dts/overlays/i2s-dac-overlay.dts |   34 +
+ .../dts/overlays/i2s-gpio28-31-overlay.dts    |   18 +
+ .../boot/dts/overlays/ilitek251x-overlay.dts  |   45 +
+ arch/arm/boot/dts/overlays/imx219-overlay.dts |   89 +
+ arch/arm/boot/dts/overlays/imx219.dtsi        |   27 +
+ arch/arm/boot/dts/overlays/imx258-overlay.dts |  131 +
+ arch/arm/boot/dts/overlays/imx258.dtsi        |   27 +
+ arch/arm/boot/dts/overlays/imx290-overlay.dts |   32 +
+ .../boot/dts/overlays/imx290_327-overlay.dtsi |  112 +
+ arch/arm/boot/dts/overlays/imx290_327.dtsi    |   24 +
+ arch/arm/boot/dts/overlays/imx296-overlay.dts |  103 +
+ arch/arm/boot/dts/overlays/imx327-overlay.dts |   32 +
+ arch/arm/boot/dts/overlays/imx378-overlay.dts |   10 +
+ arch/arm/boot/dts/overlays/imx462-overlay.dts |   32 +
+ arch/arm/boot/dts/overlays/imx477-overlay.dts |   10 +
+ .../boot/dts/overlays/imx477_378-overlay.dtsi |   83 +
+ arch/arm/boot/dts/overlays/imx477_378.dtsi    |   24 +
+ arch/arm/boot/dts/overlays/imx519-overlay.dts |   96 +
+ .../dts/overlays/iqaudio-codec-overlay.dts    |   42 +
+ .../boot/dts/overlays/iqaudio-dac-overlay.dts |   46 +
+ .../dts/overlays/iqaudio-dacplus-overlay.dts  |   49 +
+ .../iqaudio-digi-wm8804-audio-overlay.dts     |   47 +
+ arch/arm/boot/dts/overlays/iqs550-overlay.dts |   59 +
+ .../arm/boot/dts/overlays/irs1125-overlay.dts |   90 +
+ .../dts/overlays/jedec-spi-nor-overlay.dts    |  309 ++
+ .../dts/overlays/justboom-both-overlay.dts    |   65 +
+ .../dts/overlays/justboom-dac-overlay.dts     |   46 +
+ .../dts/overlays/justboom-digi-overlay.dts    |   41 +
+ .../arm/boot/dts/overlays/ltc294x-overlay.dts |   86 +
+ .../boot/dts/overlays/max98357a-overlay.dts   |   84 +
+ .../boot/dts/overlays/maxtherm-overlay.dts    |  186 +
+ .../boot/dts/overlays/mbed-dac-overlay.dts    |   64 +
+ .../boot/dts/overlays/mcp23017-overlay.dts    |   69 +
+ .../boot/dts/overlays/mcp23s17-overlay.dts    |  732 +++
+ .../dts/overlays/mcp2515-can0-overlay.dts     |   73 +
+ .../dts/overlays/mcp2515-can1-overlay.dts     |   73 +
+ .../arm/boot/dts/overlays/mcp2515-overlay.dts |  156 +
+ .../boot/dts/overlays/mcp251xfd-overlay.dts   |  226 +
+ .../arm/boot/dts/overlays/mcp3008-overlay.dts |  205 +
+ .../arm/boot/dts/overlays/mcp3202-overlay.dts |  205 +
+ .../arm/boot/dts/overlays/mcp342x-overlay.dts |  164 +
+ .../dts/overlays/media-center-overlay.dts     |  134 +
+ .../boot/dts/overlays/merus-amp-overlay.dts   |   59 +
+ .../boot/dts/overlays/midi-uart0-overlay.dts  |   36 +
+ .../boot/dts/overlays/midi-uart1-overlay.dts  |   43 +
+ .../boot/dts/overlays/midi-uart2-overlay.dts  |   37 +
+ .../boot/dts/overlays/midi-uart3-overlay.dts  |   38 +
+ .../boot/dts/overlays/midi-uart4-overlay.dts  |   38 +
+ .../boot/dts/overlays/midi-uart5-overlay.dts  |   38 +
+ .../boot/dts/overlays/minipitft13-overlay.dts |   70 +
+ .../boot/dts/overlays/miniuart-bt-overlay.dts |   93 +
+ .../dts/overlays/mipi-dbi-spi-overlay.dts     |  175 +
+ .../boot/dts/overlays/mlx90640-overlay.dts    |   22 +
+ arch/arm/boot/dts/overlays/mmc-overlay.dts    |   46 +
+ .../arm/boot/dts/overlays/mpu6050-overlay.dts |   29 +
+ .../arm/boot/dts/overlays/mz61581-overlay.dts |  117 +
+ arch/arm/boot/dts/overlays/ov2311-overlay.dts |   77 +
+ arch/arm/boot/dts/overlays/ov2311.dtsi        |   26 +
+ arch/arm/boot/dts/overlays/ov5647-overlay.dts |   92 +
+ arch/arm/boot/dts/overlays/ov5647.dtsi        |   25 +
+ arch/arm/boot/dts/overlays/ov7251-overlay.dts |   77 +
+ arch/arm/boot/dts/overlays/ov7251.dtsi        |   28 +
+ arch/arm/boot/dts/overlays/ov9281-overlay.dts |   78 +
+ arch/arm/boot/dts/overlays/ov9281.dtsi        |   27 +
+ arch/arm/boot/dts/overlays/overlay_map.dts    |  211 +
+ .../arm/boot/dts/overlays/papirus-overlay.dts |   84 +
+ .../arm/boot/dts/overlays/pca953x-overlay.dts |  240 +
+ .../dts/overlays/pcie-32bit-dma-overlay.dts   |   38 +
+ arch/arm/boot/dts/overlays/pibell-overlay.dts |   81 +
+ .../dts/overlays/pifacedigital-overlay.dts    |  144 +
+ .../arm/boot/dts/overlays/pifi-40-overlay.dts |   50 +
+ .../boot/dts/overlays/pifi-dac-hd-overlay.dts |   49 +
+ .../dts/overlays/pifi-dac-zero-overlay.dts    |   49 +
+ .../dts/overlays/pifi-mini-210-overlay.dts    |   42 +
+ arch/arm/boot/dts/overlays/piglow-overlay.dts |   97 +
+ .../boot/dts/overlays/piscreen-overlay.dts    |  102 +
+ .../boot/dts/overlays/piscreen2r-overlay.dts  |  106 +
+ .../arm/boot/dts/overlays/pisound-overlay.dts |  120 +
+ .../arm/boot/dts/overlays/pitft22-overlay.dts |   69 +
+ .../overlays/pitft28-capacitive-overlay.dts   |   91 +
+ .../overlays/pitft28-resistive-overlay.dts    |  121 +
+ .../overlays/pitft35-resistive-overlay.dts    |  122 +
+ .../boot/dts/overlays/pps-gpio-overlay.dts    |   39 +
+ .../boot/dts/overlays/proto-codec-overlay.dts |   39 +
+ .../boot/dts/overlays/pwm-2chan-overlay.dts   |   49 +
+ .../boot/dts/overlays/pwm-ir-tx-overlay.dts   |   40 +
+ arch/arm/boot/dts/overlays/pwm-overlay.dts    |   45 +
+ .../arm/boot/dts/overlays/qca7000-overlay.dts |   55 +
+ .../dts/overlays/qca7000-uart0-overlay.dts    |   46 +
+ .../arm/boot/dts/overlays/ramoops-overlay.dts |   25 +
+ .../boot/dts/overlays/ramoops-pi4-overlay.dts |   25 +
+ .../dts/overlays/rotary-encoder-overlay.dts   |   59 +
+ .../dts/overlays/rpi-backlight-overlay.dts    |   21 +
+ .../dts/overlays/rpi-codeczero-overlay.dts    |    9 +
+ .../boot/dts/overlays/rpi-dacplus-overlay.dts |   17 +
+ .../boot/dts/overlays/rpi-dacpro-overlay.dts  |   17 +
+ .../dts/overlays/rpi-digiampplus-overlay.dts  |   17 +
+ .../boot/dts/overlays/rpi-ft5406-overlay.dts  |   25 +
+ .../arm/boot/dts/overlays/rpi-poe-overlay.dts |  154 +
+ .../dts/overlays/rpi-poe-plus-overlay.dts     |   49 +
+ .../boot/dts/overlays/rpi-sense-overlay.dts   |   47 +
+ .../dts/overlays/rpi-sense-v2-overlay.dts     |   47 +
+ arch/arm/boot/dts/overlays/rpi-tv-overlay.dts |   34 +
+ .../rra-digidac1-wm8741-audio-overlay.dts     |   49 +
+ .../boot/dts/overlays/sainsmart18-overlay.dts |   52 +
+ .../dts/overlays/sc16is750-i2c-overlay.dts    |   43 +
+ .../dts/overlays/sc16is752-i2c-overlay.dts    |   43 +
+ .../dts/overlays/sc16is752-spi0-overlay.dts   |   49 +
+ .../dts/overlays/sc16is752-spi1-overlay.dts   |   67 +
+ arch/arm/boot/dts/overlays/sdhost-overlay.dts |   38 +
+ arch/arm/boot/dts/overlays/sdio-overlay.dts   |   77 +
+ .../overlays/seeed-can-fd-hat-v1-overlay.dts  |  138 +
+ .../overlays/seeed-can-fd-hat-v2-overlay.dts  |  117 +
+ .../boot/dts/overlays/sh1106-spi-overlay.dts  |   84 +
+ .../boot/dts/overlays/si446x-spi0-overlay.dts |   53 +
+ .../arm/boot/dts/overlays/smi-dev-overlay.dts |   20 +
+ .../boot/dts/overlays/smi-nand-overlay.dts    |   66 +
+ arch/arm/boot/dts/overlays/smi-overlay.dts    |   37 +
+ .../dts/overlays/spi-gpio35-39-overlay.dts    |   31 +
+ .../dts/overlays/spi-gpio40-45-overlay.dts    |   36 +
+ .../arm/boot/dts/overlays/spi-rtc-overlay.dts |   75 +
+ .../boot/dts/overlays/spi0-0cs-overlay.dts    |   39 +
+ .../boot/dts/overlays/spi0-1cs-overlay.dts    |   42 +
+ .../boot/dts/overlays/spi0-2cs-overlay.dts    |   37 +
+ .../boot/dts/overlays/spi1-1cs-overlay.dts    |   57 +
+ .../boot/dts/overlays/spi1-2cs-overlay.dts    |   69 +
+ .../boot/dts/overlays/spi1-3cs-overlay.dts    |   81 +
+ .../boot/dts/overlays/spi2-1cs-overlay.dts    |   57 +
+ .../boot/dts/overlays/spi2-2cs-overlay.dts    |   69 +
+ .../boot/dts/overlays/spi2-3cs-overlay.dts    |   81 +
+ .../boot/dts/overlays/spi3-1cs-overlay.dts    |   44 +
+ .../boot/dts/overlays/spi3-2cs-overlay.dts    |   56 +
+ .../boot/dts/overlays/spi4-1cs-overlay.dts    |   44 +
+ .../boot/dts/overlays/spi4-2cs-overlay.dts    |   56 +
+ .../boot/dts/overlays/spi5-1cs-overlay.dts    |   44 +
+ .../boot/dts/overlays/spi5-2cs-overlay.dts    |   56 +
+ .../boot/dts/overlays/spi6-1cs-overlay.dts    |   44 +
+ .../boot/dts/overlays/spi6-2cs-overlay.dts    |   56 +
+ .../arm/boot/dts/overlays/ssd1306-overlay.dts |   36 +
+ .../boot/dts/overlays/ssd1306-spi-overlay.dts |   84 +
+ .../boot/dts/overlays/ssd1331-spi-overlay.dts |   83 +
+ .../boot/dts/overlays/ssd1351-spi-overlay.dts |   83 +
+ .../dts/overlays/superaudioboard-overlay.dts  |   73 +
+ arch/arm/boot/dts/overlays/sx150x-overlay.dts | 1706 +++++++
+ .../dts/overlays/tc358743-audio-overlay.dts   |   52 +
+ .../boot/dts/overlays/tc358743-overlay.dts    |  109 +
+ .../boot/dts/overlays/tinylcd35-overlay.dts   |  222 +
+ .../boot/dts/overlays/tpm-slb9670-overlay.dts |   44 +
+ .../boot/dts/overlays/tpm-slb9673-overlay.dts |   50 +
+ arch/arm/boot/dts/overlays/uart0-overlay.dts  |   32 +
+ arch/arm/boot/dts/overlays/uart1-overlay.dts  |   38 +
+ arch/arm/boot/dts/overlays/uart2-overlay.dts  |   27 +
+ arch/arm/boot/dts/overlays/uart3-overlay.dts  |   27 +
+ arch/arm/boot/dts/overlays/uart4-overlay.dts  |   27 +
+ arch/arm/boot/dts/overlays/uart5-overlay.dts  |   27 +
+ arch/arm/boot/dts/overlays/udrc-overlay.dts   |  128 +
+ .../dts/overlays/ugreen-dabboard-overlay.dts  |   49 +
+ .../boot/dts/overlays/upstream-overlay.dts    |  101 +
+ .../dts/overlays/upstream-pi4-overlay.dts     |  137 +
+ .../dts/overlays/vc4-fkms-v3d-overlay.dts     |   40 +
+ .../dts/overlays/vc4-fkms-v3d-pi4-overlay.dts |   44 +
+ .../overlays/vc4-kms-dpi-generic-overlay.dts  |   81 +
+ .../dts/overlays/vc4-kms-dpi-hyperpixel.dtsi  |   94 +
+ .../vc4-kms-dpi-hyperpixel2r-overlay.dts      |  114 +
+ .../vc4-kms-dpi-hyperpixel4-overlay.dts       |   57 +
+ .../vc4-kms-dpi-hyperpixel4sq-overlay.dts     |   36 +
+ .../overlays/vc4-kms-dpi-panel-overlay.dts    |   69 +
+ arch/arm/boot/dts/overlays/vc4-kms-dpi.dtsi   |  111 +
+ .../overlays/vc4-kms-dsi-7inch-overlay.dts    |  118 +
+ .../vc4-kms-dsi-lt070me05000-overlay.dts      |   69 +
+ .../vc4-kms-dsi-lt070me05000-v2-overlay.dts   |   64 +
+ .../overlays/vc4-kms-kippah-7inch-overlay.dts |   26 +
+ .../boot/dts/overlays/vc4-kms-v3d-overlay.dts |  124 +
+ .../dts/overlays/vc4-kms-v3d-pi4-overlay.dts  |  200 +
+ .../dts/overlays/vc4-kms-vga666-overlay.dts   |  100 +
+ arch/arm/boot/dts/overlays/vga666-overlay.dts |   30 +
+ arch/arm/boot/dts/overlays/vl805-overlay.dts  |   18 +
+ .../arm/boot/dts/overlays/w1-gpio-overlay.dts |   40 +
+ .../dts/overlays/w1-gpio-pullup-overlay.dts   |   42 +
+ arch/arm/boot/dts/overlays/w5500-overlay.dts  |   63 +
+ .../overlays/watterott-display-overlay.dts    |  150 +
+ .../waveshare-can-fd-hat-mode-a-overlay.dts   |  140 +
+ .../waveshare-can-fd-hat-mode-b-overlay.dts   |  103 +
+ .../arm/boot/dts/overlays/wittypi-overlay.dts |   44 +
+ .../dts/overlays/wm8960-soundcard-overlay.dts |   82 +
+ arch/arm64/boot/dts/Makefile                  |    2 +
+ arch/arm64/boot/dts/broadcom/Makefile         |   14 +
+ .../boot/dts/broadcom/bcm2710-rpi-2-b.dts     |    1 +
+ .../dts/broadcom/bcm2710-rpi-3-b-plus.dts     |    1 +
+ .../boot/dts/broadcom/bcm2710-rpi-3-b.dts     |    1 +
+ .../boot/dts/broadcom/bcm2710-rpi-cm3.dts     |    1 +
+ .../dts/broadcom/bcm2710-rpi-zero-2-w.dts     |    1 +
+ .../boot/dts/broadcom/bcm2710-rpi-zero-2.dts  |    1 +
+ .../boot/dts/broadcom/bcm2711-rpi-4-b.dts     |    3 +-
+ .../boot/dts/broadcom/bcm2711-rpi-400.dts     |    3 +-
+ .../boot/dts/broadcom/bcm2711-rpi-cm4.dts     |    1 +
+ .../boot/dts/broadcom/bcm2711-rpi-cm4s.dts    |    1 +
+ .../dts/broadcom/bcm283x-rpi-csi1-2lane.dtsi  |    1 +
+ .../dts/broadcom/bcm283x-rpi-lan7515.dtsi     |    1 +
+ arch/arm64/boot/dts/overlays                  |    1 +
+ include/dt-bindings/gpio/gpio-fsm.h           |   21 +
+ scripts/Makefile.dtbinst                      |    3 +-
+ scripts/Makefile.lib                          |   13 +
+ 348 files changed, 34772 insertions(+), 16 deletions(-)
+ create mode 100644 arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
+ create mode 100644 arch/arm/boot/dts/bcm2708-rpi-b-rev1.dts
+ create mode 100644 arch/arm/boot/dts/bcm2708-rpi-b.dts
+ create mode 100644 arch/arm/boot/dts/bcm2708-rpi-bt.dtsi
+ create mode 100644 arch/arm/boot/dts/bcm2708-rpi-cm.dts
+ create mode 100644 arch/arm/boot/dts/bcm2708-rpi-cm.dtsi
+ create mode 100644 arch/arm/boot/dts/bcm2708-rpi-zero-w.dts
+ create mode 100644 arch/arm/boot/dts/bcm2708-rpi-zero.dts
+ create mode 100644 arch/arm/boot/dts/bcm2708-rpi.dtsi
+ create mode 100644 arch/arm/boot/dts/bcm2708.dtsi
+ create mode 100644 arch/arm/boot/dts/bcm2709-rpi-2-b.dts
+ create mode 100644 arch/arm/boot/dts/bcm2709-rpi-cm2.dts
+ create mode 100644 arch/arm/boot/dts/bcm2709-rpi.dtsi
+ create mode 100644 arch/arm/boot/dts/bcm2709.dtsi
+ create mode 100644 arch/arm/boot/dts/bcm270x-rpi.dtsi
+ create mode 100644 arch/arm/boot/dts/bcm270x.dtsi
+ create mode 100644 arch/arm/boot/dts/bcm2710-rpi-2-b.dts
+ create mode 100644 arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
+ create mode 100644 arch/arm/boot/dts/bcm2710-rpi-3-b.dts
+ create mode 100644 arch/arm/boot/dts/bcm2710-rpi-cm3.dts
+ create mode 100644 arch/arm/boot/dts/bcm2710-rpi-zero-2-w.dts
+ create mode 100644 arch/arm/boot/dts/bcm2710-rpi-zero-2.dts
+ create mode 100644 arch/arm/boot/dts/bcm2710.dtsi
+ create mode 100644 arch/arm/boot/dts/bcm2711-rpi-cm4.dts
+ create mode 100644 arch/arm/boot/dts/bcm2711-rpi-cm4s.dts
+ create mode 100644 arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
+ create mode 100644 arch/arm/boot/dts/bcm271x-rpi-bt.dtsi
+ create mode 100644 arch/arm/boot/dts/bcm283x-rpi-csi0-2lane.dtsi
+ create mode 100644 arch/arm/boot/dts/bcm283x-rpi-csi1-2lane.dtsi
+ create mode 100644 arch/arm/boot/dts/bcm283x-rpi-csi1-4lane.dtsi
+ create mode 100644 arch/arm/boot/dts/bcm283x-rpi-i2c0mux_0_28.dtsi
+ create mode 100644 arch/arm/boot/dts/bcm283x-rpi-i2c0mux_0_44.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/Makefile
+ create mode 100644 arch/arm/boot/dts/overlays/README
+ create mode 100644 arch/arm/boot/dts/overlays/act-led-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/adafruit-st7735r-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/adafruit18-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/adau1977-adc-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/adau7002-simple-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ads1015-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ads1115-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ads7846-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/adv7282m-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/adv728x-m-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/akkordion-iqdacplus-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/allo-boss-dac-pcm512x-audio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/allo-boss2-dac-audio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/allo-digione-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/allo-katana-dac-audio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/allo-piano-dac-pcm512x-audio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/allo-piano-dac-plus-pcm512x-audio-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/anyspi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/apds9960-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/applepi-dac-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/arducam-64mp-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/arducam-pivariety-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/at86rf233-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/audioinjector-bare-i2s-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/audioinjector-isolated-soundcard-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/audioinjector-ultra-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/audioinjector-wm8731-audio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/audiosense-pi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/audremap-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/balena-fin-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/camera-mux-2port-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/camera-mux-4port-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/cap1106-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/chipdip-dac-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/cirrus-wm5102-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/cma-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/cutiepi-panel-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/dacberry400-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/dht11-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/dionaudio-kiwi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/dionaudio-loco-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/dionaudio-loco-v2-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/disable-bt-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/disable-wifi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/dpi18-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/dpi18cpadhi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/dpi24-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/draws-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/dwc-otg-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/dwc2-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/edt-ft5406-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/edt-ft5406.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/enc28j60-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/enc28j60-spi2-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/exc3000-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/fbtft-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/fsm-demo-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/gc9a01-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ghost-amp-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/goodix-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/googlevoicehat-soundcard-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/gpio-fan-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/gpio-hog-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/gpio-ir-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/gpio-ir-tx-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/gpio-key-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/gpio-led-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/gpio-no-bank0-irq-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/gpio-no-irq-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/gpio-poweroff-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/gpio-shutdown-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hd44780-lcd-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hdmi-backlight-hwhack-gpio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-amp-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-amp100-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-amp3-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-dac-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-dacplus-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-dacplusadc-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-dacplusadcpro-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-dacplusdsp-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-dacplushd-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-digi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-digi-pro-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/highperi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hy28a-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hy28b-2017-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hy28b-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i-sabre-q2m-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c-bcm2708-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c-fan-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c-rtc-common.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+ create mode 100755 arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c0-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c1-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c3-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c4-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c6-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2s-dac-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2s-gpio28-31-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ilitek251x-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx219-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx219.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/imx258-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx258.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/imx290-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx290_327-overlay.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/imx290_327.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/imx296-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx327-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx378-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx462-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx477-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx477_378-overlay.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/imx477_378.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/imx519-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/iqaudio-codec-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/iqaudio-dac-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/iqaudio-dacplus-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/iqaudio-digi-wm8804-audio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/iqs550-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/irs1125-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/jedec-spi-nor-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/justboom-both-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/justboom-dac-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/justboom-digi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ltc294x-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/max98357a-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/maxtherm-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mbed-dac-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mcp23017-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mcp23s17-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/mcp2515-can0-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mcp2515-can1-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mcp2515-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mcp251xfd-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/mcp3008-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/mcp3202-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mcp342x-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/media-center-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/merus-amp-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/midi-uart0-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/midi-uart1-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/midi-uart2-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/midi-uart3-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/midi-uart4-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/midi-uart5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/minipitft13-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/miniuart-bt-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mipi-dbi-spi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mlx90640-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mmc-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mpu6050-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mz61581-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ov2311-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ov2311.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/ov5647-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ov5647.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/ov7251-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ov7251.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/ov9281-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ov9281.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/overlay_map.dts
+ create mode 100644 arch/arm/boot/dts/overlays/papirus-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pca953x-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pcie-32bit-dma-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pibell-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pifacedigital-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pifi-40-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pifi-dac-hd-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pifi-dac-zero-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pifi-mini-210-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/piglow-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/piscreen-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/piscreen2r-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pisound-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pitft22-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pitft28-capacitive-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pps-gpio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/proto-codec-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pwm-2chan-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pwm-ir-tx-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pwm-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/qca7000-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/qca7000-uart0-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ramoops-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ramoops-pi4-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rotary-encoder-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-backlight-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-codeczero-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-dacplus-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-dacpro-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-digiampplus-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-ft5406-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-poe-plus-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-sense-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-sense-v2-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-tv-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rra-digidac1-wm8741-audio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sainsmart18-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sc16is752-spi0-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sc16is752-spi1-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sdhost-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sdio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/seeed-can-fd-hat-v1-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/seeed-can-fd-hat-v2-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sh1106-spi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/si446x-spi0-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/smi-dev-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/smi-nand-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/smi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi-gpio35-39-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi-gpio40-45-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi-rtc-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi0-0cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi0-1cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi0-2cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi1-1cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi1-2cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi1-3cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi2-1cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi2-2cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi2-3cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi3-1cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi3-2cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi4-1cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi4-2cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi5-1cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi5-2cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi6-1cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi6-2cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ssd1306-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ssd1306-spi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ssd1331-spi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ssd1351-spi-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/superaudioboard-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sx150x-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/tc358743-audio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/tc358743-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/tinylcd35-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/tpm-slb9670-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/tpm-slb9673-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/uart0-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/uart1-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/uart2-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/uart3-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/uart4-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/uart5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/udrc-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ugreen-dabboard-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/upstream-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/upstream-pi4-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-fkms-v3d-pi4-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dpi-generic-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel2r-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel4-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel4sq-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dpi-panel-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dpi.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dsi-7inch-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dsi-lt070me05000-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dsi-lt070me05000-v2-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-kippah-7inch-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-v3d-pi4-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-vga666-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vga666-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vl805-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/w1-gpio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/w5500-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/watterott-display-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/waveshare-can-fd-hat-mode-a-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/waveshare-can-fd-hat-mode-b-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/wittypi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/wm8960-soundcard-overlay.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2710-rpi-2-b.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b-plus.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2710-rpi-cm3.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2710-rpi-zero-2-w.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2710-rpi-zero-2.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2711-rpi-cm4.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2711-rpi-cm4s.dts
+ create mode 120000 arch/arm64/boot/dts/broadcom/bcm283x-rpi-csi1-2lane.dtsi
+ create mode 120000 arch/arm64/boot/dts/broadcom/bcm283x-rpi-lan7515.dtsi
+ create mode 120000 arch/arm64/boot/dts/overlays
+ create mode 100644 include/dt-bindings/gpio/gpio-fsm.h
+
+diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
+index 6aa7dc4db2fc..f7d8d09c0a16 100644
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -1,4 +1,25 @@
+ # SPDX-License-Identifier: GPL-2.0
++
++dtb-$(CONFIG_ARCH_BCM2835) += \
++	bcm2708-rpi-b.dtb \
++	bcm2708-rpi-b-rev1.dtb \
++	bcm2708-rpi-b-plus.dtb \
++	bcm2708-rpi-cm.dtb \
++	bcm2708-rpi-zero.dtb \
++	bcm2708-rpi-zero-w.dtb \
++	bcm2710-rpi-zero-2.dtb \
++	bcm2710-rpi-zero-2-w.dtb \
++	bcm2709-rpi-2-b.dtb \
++	bcm2710-rpi-2-b.dtb \
++	bcm2710-rpi-3-b.dtb \
++	bcm2710-rpi-3-b-plus.dtb \
++	bcm2711-rpi-4-b.dtb \
++	bcm2711-rpi-400.dtb \
++	bcm2709-rpi-cm2.dtb \
++	bcm2710-rpi-cm3.dtb \
++	bcm2711-rpi-cm4.dtb \
++	bcm2711-rpi-cm4s.dtb
++
+ dtb-$(CONFIG_ARCH_ALPINE) += \
+ 	alpine-db.dtb
+ dtb-$(CONFIG_MACH_ARTPEC6) += \
+@@ -1633,3 +1654,13 @@ dtb-$(CONFIG_ARCH_ASPEED) += \
+ 	aspeed-bmc-vegman-n110.dtb \
+ 	aspeed-bmc-vegman-rx20.dtb \
+ 	aspeed-bmc-vegman-sx20.dtb
++
++targets += dtbs dtbs_install
++targets += $(dtb-y)
++
++subdir-y	:= overlays
++
++# Enable fixups to support overlays on BCM2835 platforms
++ifeq ($(CONFIG_ARCH_BCM2835),y)
++	DTC_FLAGS += -@
++endif
+diff --git a/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts b/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
+new file mode 100644
+index 000000000000..b3b18a7b5fe9
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
+@@ -0,0 +1,200 @@
++/dts-v1/;
++
++#include "bcm2708.dtsi"
++#include "bcm2708-rpi.dtsi"
++#include "bcm283x-rpi-smsc9514.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_28.dtsi"
++
++/ {
++	compatible = "raspberrypi,model-b-plus", "brcm,bcm2835";
++	model = "Raspberry Pi Model B+";
++};
++
++&gpio {
++	/*
++	 * Taken from Raspberry-Pi-B-Plus-V1.2-Schematics.pdf
++	 * RPI-BPLUS sheet 1
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "SDA1",
++			  "SCL1",
++			  "GPIO_GCLK",
++			  "GPIO5",
++			  "GPIO6",
++			  "SPI_CE1_N",
++			  "SPI_CE0_N",
++			  "SPI_MISO",
++			  "SPI_MOSI",
++			  "SPI_SCLK",
++			  "GPIO12",
++			  "GPIO13",
++			  /* Serial port */
++			  "TXD0",
++			  "RXD0",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "SDA0",
++			  "SCL0",
++			  "NC", /* GPIO30 */
++			  "LAN_RUN", /* GPIO31 */
++			  "CAM_GPIO1", /* GPIO32 */
++			  "NC", /* GPIO33 */
++			  "NC", /* GPIO34 */
++			  "PWR_LOW_N", /* GPIO35 */
++			  "NC", /* GPIO36 */
++			  "NC", /* GPIO37 */
++			  "USB_LIMIT", /* GPIO38 */
++			  "NC", /* GPIO39 */
++			  "PWM0_OUT", /* GPIO40 */
++			  "CAM_GPIO0", /* GPIO41 */
++			  "NC", /* GPIO42 */
++			  "NC", /* GPIO43 */
++			  "ETH_CLK", /* GPIO44 */
++			  "PWM1_OUT", /* GPIO45 */
++			  "HDMI_HPD_N",
++			  "STATUS_LED",
++			  /* Used by SD Card */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins = <40 45>;
++		brcm,function = <4>;
++		brcm,pull = <0>;
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&leds {
++	act_led: led-act {
++		label = "led0";
++		linux,default-trigger = "mmc0";
++		gpios = <&gpio 47 0>;
++	};
++
++	pwr_led: led-pwr {
++		label = "led1";
++		linux,default-trigger = "input";
++		gpios = <&gpio 35 0>;
++	};
++};
++
++&hdmi {
++	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&cam1_reg {
++	gpio = <&gpio 41 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_headphones=1 snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_headphones=0 snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&act_led>,"gpios:4";
++		act_led_activelow = <&act_led>,"gpios:8";
++		act_led_trigger = <&act_led>,"linux,default-trigger";
++
++		pwr_led_gpio = <&pwr_led>,"gpios:4";
++		pwr_led_activelow = <&pwr_led>,"gpios:8";
++		pwr_led_trigger = <&pwr_led>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/bcm2708-rpi-b-rev1.dts b/arch/arm/boot/dts/bcm2708-rpi-b-rev1.dts
+new file mode 100644
+index 000000000000..50ac75e8d3d9
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2708-rpi-b-rev1.dts
+@@ -0,0 +1,208 @@
++/dts-v1/;
++
++#include "bcm2708.dtsi"
++#include "bcm2708-rpi.dtsi"
++#include "bcm283x-rpi-smsc9512.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++
++/ {
++	compatible = "raspberrypi,model-b", "brcm,bcm2835";
++	model = "Raspberry Pi Model B";
++};
++
++&gpio {
++	/*
++	 * Taken from Raspberry-Pi-Rev-1.0-Model-AB-Schematics.pdf
++	 * RPI00021 sheet 02
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "SDA0",
++			  "SCL0",
++			  "SDA1",
++			  "SCL1",
++			  "GPIO_GCLK",
++			  "CAM_GPIO1",
++			  "LAN_RUN",
++			  "SPI_CE1_N",
++			  "SPI_CE0_N",
++			  "SPI_MISO",
++			  "SPI_MOSI",
++			  "SPI_SCLK",
++			  "NC", /* GPIO12 */
++			  "NC", /* GPIO13 */
++			  /* Serial port */
++			  "TXD0",
++			  "RXD0",
++			  "STATUS_LED_N",
++			  "GPIO17",
++			  "GPIO18",
++			  "NC", /* GPIO19 */
++			  "NC", /* GPIO20 */
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "NC", /* GPIO26 */
++			  "CAM_GPIO0",
++			  /* Binary number representing build/revision */
++			  "CONFIG0",
++			  "CONFIG1",
++			  "CONFIG2",
++			  "CONFIG3",
++			  "NC", /* GPIO32 */
++			  "NC", /* GPIO33 */
++			  "NC", /* GPIO34 */
++			  "NC", /* GPIO35 */
++			  "NC", /* GPIO36 */
++			  "NC", /* GPIO37 */
++			  "NC", /* GPIO38 */
++			  "NC", /* GPIO39 */
++			  "PWM0_OUT",
++			  "NC", /* GPIO41 */
++			  "NC", /* GPIO42 */
++			  "NC", /* GPIO43 */
++			  "NC", /* GPIO44 */
++			  "PWM1_OUT",
++			  "HDMI_HPD_P",
++			  "SD_CARD_DET",
++			  /* Used by SD Card */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <28 29 30 31>;
++		brcm,function = <6>; /* alt2 */
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins = <40 45>;
++		brcm,function = <4>;
++		brcm,pull = <0>;
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++/delete-node/ &i2c0mux;
++
++i2c0: &i2c0if {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c0_pins>;
++	clock-frequency = <100000>;
++};
++
++i2c_csi_dsi: &i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++/ {
++	aliases {
++		i2c0 = &i2c0;
++	};
++
++	/* Provide an i2c0mux label to avoid undefined symbols in overlays */
++	i2c0mux: i2c0mux {
++	};
++
++	__overrides__ {
++		i2c0 = <&i2c0>, "status";
++	};
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&leds {
++	act_led: led-act {
++		label = "led0";
++		linux,default-trigger = "mmc0";
++		gpios = <&gpio 16 1>;
++	};
++};
++
++&hdmi {
++	hpd-gpios = <&gpio 46 GPIO_ACTIVE_HIGH>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&cam1_reg {
++	gpio = <&gpio 27 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_headphones=1 snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_headphones=0 snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&act_led>,"gpios:4";
++		act_led_activelow = <&act_led>,"gpios:8";
++		act_led_trigger = <&act_led>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/bcm2708-rpi-b.dts b/arch/arm/boot/dts/bcm2708-rpi-b.dts
+new file mode 100644
+index 000000000000..4d7444a31bb6
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2708-rpi-b.dts
+@@ -0,0 +1,190 @@
++/dts-v1/;
++
++#include "bcm2708.dtsi"
++#include "bcm2708-rpi.dtsi"
++#include "bcm283x-rpi-smsc9512.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_28.dtsi"
++
++/ {
++	compatible = "raspberrypi,model-b", "brcm,bcm2835";
++	model = "Raspberry Pi Model B";
++};
++
++&gpio {
++	/*
++	 * Taken from Raspberry-Pi-Rev-2.0-Model-AB-Schematics.pdf
++	 * RPI00022 sheet 02
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "SDA0",
++			  "SCL0",
++			  "SDA1",
++			  "SCL1",
++			  "GPIO_GCLK",
++			  "CAM_GPIO1",
++			  "LAN_RUN",
++			  "SPI_CE1_N",
++			  "SPI_CE0_N",
++			  "SPI_MISO",
++			  "SPI_MOSI",
++			  "SPI_SCLK",
++			  "NC", /* GPIO12 */
++			  "NC", /* GPIO13 */
++			  /* Serial port */
++			  "TXD0",
++			  "RXD0",
++			  "STATUS_LED_N",
++			  "GPIO17",
++			  "GPIO18",
++			  "NC", /* GPIO19 */
++			  "NC", /* GPIO20 */
++			  "CAM_GPIO0",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "NC", /* GPIO26 */
++			  "GPIO27",
++			  "GPIO28",
++			  "GPIO29",
++			  "GPIO30",
++			  "GPIO31",
++			  "NC", /* GPIO32 */
++			  "NC", /* GPIO33 */
++			  "NC", /* GPIO34 */
++			  "NC", /* GPIO35 */
++			  "NC", /* GPIO36 */
++			  "NC", /* GPIO37 */
++			  "NC", /* GPIO38 */
++			  "NC", /* GPIO39 */
++			  "PWM0_OUT",
++			  "NC", /* GPIO41 */
++			  "NC", /* GPIO42 */
++			  "NC", /* GPIO43 */
++			  "NC", /* GPIO44 */
++			  "PWM1_OUT",
++			  "HDMI_HPD_P",
++			  "SD_CARD_DET",
++			  /* Used by SD Card */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <28 29 30 31>;
++		brcm,function = <6>; /* alt2 */
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins = <40 45>;
++		brcm,function = <4>;
++		brcm,pull = <0>;
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&leds {
++	act_led: led-act {
++		label = "led0";
++		linux,default-trigger = "mmc0";
++		gpios = <&gpio 16 1>;
++	};
++};
++
++&hdmi {
++	hpd-gpios = <&gpio 46 GPIO_ACTIVE_HIGH>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&cam1_reg {
++	gpio = <&gpio 21 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_headphones=1 snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_headphones=0 snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&act_led>,"gpios:4";
++		act_led_activelow = <&act_led>,"gpios:8";
++		act_led_trigger = <&act_led>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/bcm2708-rpi-bt.dtsi b/arch/arm/boot/dts/bcm2708-rpi-bt.dtsi
+new file mode 100644
+index 000000000000..a18f80af97d3
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2708-rpi-bt.dtsi
+@@ -0,0 +1,26 @@
++// SPDX-License-Identifier: GPL-2.0
++
++&uart0 {
++	bt: bluetooth {
++		compatible = "brcm,bcm43438-bt";
++		max-speed = <3000000>;
++		shutdown-gpios = <&gpio 45 GPIO_ACTIVE_HIGH>;
++		status = "disabled";
++	};
++};
++
++&uart1 {
++	minibt: bluetooth {
++		compatible = "brcm,bcm43438-bt";
++		max-speed = <460800>;
++		shutdown-gpios = <&gpio 45 GPIO_ACTIVE_HIGH>;
++		status = "disabled";
++	};
++};
++
++/ {
++	__overrides__ {
++		krnbt = <&bt>,"status";
++		krnbt_baudrate = <&bt>,"max-speed:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/bcm2708-rpi-cm.dts b/arch/arm/boot/dts/bcm2708-rpi-cm.dts
+new file mode 100644
+index 000000000000..6a97189afe58
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2708-rpi-cm.dts
+@@ -0,0 +1,171 @@
++/dts-v1/;
++
++#include "bcm2708-rpi-cm.dtsi"
++#include "bcm283x-rpi-csi0-2lane.dtsi"
++#include "bcm283x-rpi-csi1-4lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_28.dtsi"
++
++/ {
++	compatible = "raspberrypi,compute-module", "brcm,bcm2835";
++	model = "Raspberry Pi Compute Module";
++};
++
++&cam1_reg {
++	gpio = <&gpio 2 GPIO_ACTIVE_HIGH>;
++	status = "disabled";
++};
++
++cam0_reg: &cam0_regulator {
++	gpio = <&gpio 30 GPIO_ACTIVE_HIGH>;
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&gpio {
++	/*
++	 * This is based on the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "GPIO0",
++			  "GPIO1",
++			  "GPIO2",
++			  "GPIO3",
++			  "GPIO4",
++			  "GPIO5",
++			  "GPIO6",
++			  "GPIO7",
++			  "GPIO8",
++			  "GPIO9",
++			  "GPIO10",
++			  "GPIO11",
++			  "GPIO12",
++			  "GPIO13",
++			  "GPIO14",
++			  "GPIO15",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "GPIO28",
++			  "GPIO29",
++			  "GPIO30",
++			  "GPIO31",
++			  "GPIO32",
++			  "GPIO33",
++			  "GPIO34",
++			  "GPIO35",
++			  "GPIO36",
++			  "GPIO37",
++			  "GPIO38",
++			  "GPIO39",
++			  "GPIO40",
++			  "GPIO41",
++			  "GPIO42",
++			  "GPIO43",
++			  "GPIO44",
++			  "GPIO45",
++			  "HDMI_HPD_N",
++			  /* Also used as ACT LED */
++			  "EMMC_EN_N",
++			  /* Used by eMMC */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins;
++		brcm,function;
++	};
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&hdmi {
++	hpd-gpios = <&gpio 46 GPIO_ACTIVE_HIGH>;
++};
+diff --git a/arch/arm/boot/dts/bcm2708-rpi-cm.dtsi b/arch/arm/boot/dts/bcm2708-rpi-cm.dtsi
+new file mode 100644
+index 000000000000..c7845d2ba7ff
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2708-rpi-cm.dtsi
+@@ -0,0 +1,22 @@
++#include "bcm2708.dtsi"
++#include "bcm2708-rpi.dtsi"
++
++&leds {
++	act_led: led-act {
++		label = "led0";
++		linux,default-trigger = "mmc0";
++		gpios = <&gpio 47 0>;
++	};
++};
++
++/ {
++	__overrides__ {
++		act_led_gpio = <&act_led>,"gpios:4";
++		act_led_activelow = <&act_led>,"gpios:8";
++		act_led_trigger = <&act_led>,"linux,default-trigger";
++		cam0_reg = <&cam0_reg>,"status";
++		cam0_reg_gpio = <&cam0_reg>,"gpio:4";
++		cam1_reg = <&cam1_reg>,"status";
++		cam1_reg_gpio = <&cam1_reg>,"gpio:4";
++	};
++};
+diff --git a/arch/arm/boot/dts/bcm2708-rpi-zero-w.dts b/arch/arm/boot/dts/bcm2708-rpi-zero-w.dts
+new file mode 100644
+index 000000000000..323fa2ebf730
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2708-rpi-zero-w.dts
+@@ -0,0 +1,246 @@
++/dts-v1/;
++
++#include "bcm2708.dtsi"
++#include "bcm2708-rpi.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_28.dtsi"
++#include "bcm2708-rpi-bt.dtsi"
++
++/ {
++	compatible = "raspberrypi,model-zero-w", "brcm,bcm2835";
++	model = "Raspberry Pi Zero W";
++
++	chosen {
++		bootargs = "coherent_pool=1M 8250.nr_uarts=1 snd_bcm2835.enable_headphones=0";
++	};
++
++	aliases {
++		serial0 = &uart1;
++		serial1 = &uart0;
++		mmc1 = &mmcnr;
++	};
++};
++
++&gpio {
++	/*
++	 * This is based on the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "SDA1",
++			  "SCL1",
++			  "GPIO_GCLK",
++			  "GPIO5",
++			  "GPIO6",
++			  "SPI_CE1_N",
++			  "SPI_CE0_N",
++			  "SPI_MISO",
++			  "SPI_MOSI",
++			  "SPI_SCLK",
++			  "GPIO12",
++			  "GPIO13",
++			  /* Serial port */
++			  "TXD1",
++			  "RXD1",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "SDA0",
++			  "SCL0",
++			  /* Used by BT module */
++			  "CTS0",
++			  "RTS0",
++			  "TXD0",
++			  "RXD0",
++			  /* Used by Wifi */
++			  "SD1_CLK",
++			  "SD1_CMD",
++			  "SD1_DATA0",
++			  "SD1_DATA1",
++			  "SD1_DATA2",
++			  "SD1_DATA3",
++			  "CAM_GPIO1", /* GPIO40 */
++			  "WL_ON", /* GPIO41 */
++			  "NC", /* GPIO42 */
++			  "WIFI_CLK", /* GPIO43 */
++			  "CAM_GPIO0", /* GPIO44 */
++			  "BT_ON", /* GPIO45 */
++			  "HDMI_HPD_N",
++			  "STATUS_LED_N",
++			  /* Used by SD Card */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	sdio_pins: sdio_pins {
++		brcm,pins = <34 35 36 37 38 39>;
++		brcm,function = <7>; /* ALT3 = SD1 */
++		brcm,pull = <0 2 2 2 2 2>;
++	};
++
++	bt_pins: bt_pins {
++		brcm,pins = <43>;
++		brcm,function = <4>; /* alt0:GPCLK2 */
++		brcm,pull = <0>; /* none */
++	};
++
++	uart0_pins: uart0_pins {
++		brcm,pins = <30 31 32 33>;
++		brcm,function = <7>; /* alt3=UART0 */
++		brcm,pull = <2 0 0 2>; /* up none none up */
++	};
++
++	uart1_pins: uart1_pins {
++		brcm,pins;
++		brcm,function;
++		brcm,pull;
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins = <>;
++		brcm,function = <>;
++	};
++};
++
++&mmcnr {
++	pinctrl-names = "default";
++	pinctrl-0 = <&sdio_pins>;
++	bus-width = <4>;
++	status = "okay";
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	brcmf: wifi@1 {
++		reg = <1>;
++		compatible = "brcm,bcm4329-fmac";
++	};
++};
++
++&uart0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart0_pins &bt_pins>;
++	status = "okay";
++};
++
++&uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart1_pins>;
++	status = "okay";
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&leds {
++	act_led: led-act {
++		label = "led0";
++		linux,default-trigger = "actpwr";
++		gpios = <&gpio 47 GPIO_ACTIVE_LOW>;
++	};
++};
++
++&hdmi {
++	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&cam1_reg {
++	gpio = <&gpio 44 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&act_led>,"gpios:4";
++		act_led_activelow = <&act_led>,"gpios:8";
++		act_led_trigger = <&act_led>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/bcm2708-rpi-zero.dts b/arch/arm/boot/dts/bcm2708-rpi-zero.dts
+new file mode 100644
+index 000000000000..406f945d4093
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2708-rpi-zero.dts
+@@ -0,0 +1,187 @@
++/dts-v1/;
++
++#include "bcm2708.dtsi"
++#include "bcm2708-rpi.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_28.dtsi"
++
++/ {
++	compatible = "raspberrypi,model-zero", "brcm,bcm2835";
++	model = "Raspberry Pi Zero";
++};
++
++&gpio {
++	/*
++	 * This is based on the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "SDA1",
++			  "SCL1",
++			  "GPIO_GCLK",
++			  "GPIO5",
++			  "GPIO6",
++			  "SPI_CE1_N",
++			  "SPI_CE0_N",
++			  "SPI_MISO",
++			  "SPI_MOSI",
++			  "SPI_SCLK",
++			  "GPIO12",
++			  "GPIO13",
++			  /* Serial port */
++			  "TXD0",
++			  "RXD0",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "SDA0",
++			  "SCL0",
++			  "NC", /* GPIO30 */
++			  "NC", /* GPIO31 */
++			  "CAM_GPIO1", /* GPIO32 */
++			  "NC", /* GPIO33 */
++			  "NC", /* GPIO34 */
++			  "NC", /* GPIO35 */
++			  "NC", /* GPIO36 */
++			  "NC", /* GPIO37 */
++			  "NC", /* GPIO38 */
++			  "NC", /* GPIO39 */
++			  "NC", /* GPIO40 */
++			  "CAM_GPIO0", /* GPIO41 */
++			  "NC", /* GPIO42 */
++			  "NC", /* GPIO43 */
++			  "NC", /* GPIO44 */
++			  "NC", /* GPIO45 */
++			  "HDMI_HPD_N",
++			  "STATUS_LED_N",
++			  /* Used by SD Card */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins = <>;
++		brcm,function = <>;
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&leds {
++	act_led: led-act {
++		label = "led0";
++		linux,default-trigger = "actpwr";
++		gpios = <&gpio 47 GPIO_ACTIVE_LOW>;
++	};
++};
++
++&hdmi {
++	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&cam1_reg {
++	gpio = <&gpio 41 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&act_led>,"gpios:4";
++		act_led_activelow = <&act_led>,"gpios:8";
++		act_led_trigger = <&act_led>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/bcm2708-rpi.dtsi b/arch/arm/boot/dts/bcm2708-rpi.dtsi
+new file mode 100644
+index 000000000000..f774eda1ae55
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2708-rpi.dtsi
+@@ -0,0 +1,40 @@
++/* Downstream modifications common to bcm2835, bcm2836, bcm2837 */
++
++#define i2c0 i2c0mux
++#include "bcm2835-rpi.dtsi"
++#undef i2c0
++#include "bcm270x-rpi.dtsi"
++
++/ {
++	memory@0 {
++		device_type = "memory";
++		reg = <0x0 0x0>;
++	};
++
++	aliases {
++		i2c2 = &i2c2;
++	};
++
++	__overrides__ {
++		hdmi = <&hdmi>,"status";
++		i2c2_iknowwhatimdoing = <&i2c2>,"status";
++		i2c2_baudrate = <&i2c2>,"clock-frequency:0";
++		sd = <&sdhost>,"status";
++		sd_poll_once = <&sdhost>,"non-removable?";
++	};
++};
++
++&sdhost {
++	pinctrl-names = "default";
++	pinctrl-0 = <&sdhost_gpio48>;
++	status = "okay";
++};
++
++&hdmi {
++	power-domains = <&power RPI_POWER_DOMAIN_HDMI>;
++	status = "disabled";
++};
++
++&i2c2 {
++	status = "disabled";
++};
+diff --git a/arch/arm/boot/dts/bcm2708.dtsi b/arch/arm/boot/dts/bcm2708.dtsi
+new file mode 100644
+index 000000000000..b3cf34cdcc0e
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2708.dtsi
+@@ -0,0 +1,18 @@
++#define i2c0 i2c0if
++#include "bcm2835.dtsi"
++#undef i2c0
++#include "bcm270x.dtsi"
++
++/ {
++	__overrides__ {
++		arm_freq;
++	};
++};
++
++&soc {
++	dma-ranges = <0x80000000 0x00000000 0x20000000>;
++};
++
++&vc4 {
++	status = "disabled";
++};
+diff --git a/arch/arm/boot/dts/bcm2709-rpi-2-b.dts b/arch/arm/boot/dts/bcm2709-rpi-2-b.dts
+new file mode 100644
+index 000000000000..c6220e6d5fbc
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2709-rpi-2-b.dts
+@@ -0,0 +1,200 @@
++/dts-v1/;
++
++#include "bcm2709.dtsi"
++#include "bcm2709-rpi.dtsi"
++#include "bcm283x-rpi-smsc9514.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_28.dtsi"
++
++/ {
++	compatible = "raspberrypi,2-model-b", "brcm,bcm2836";
++	model = "Raspberry Pi 2 Model B";
++};
++
++&gpio {
++	/*
++	 * Taken from rpi_SCH_2b_1p2_reduced.pdf and
++	 * the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "SDA1",
++			  "SCL1",
++			  "GPIO_GCLK",
++			  "GPIO5",
++			  "GPIO6",
++			  "SPI_CE1_N",
++			  "SPI_CE0_N",
++			  "SPI_MISO",
++			  "SPI_MOSI",
++			  "SPI_SCLK",
++			  "GPIO12",
++			  "GPIO13",
++			  /* Serial port */
++			  "TXD0",
++			  "RXD0",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "SDA0",
++			  "SCL0",
++			  "NC", /* GPIO30 */
++			  "LAN_RUN",
++			  "CAM_GPIO1",
++			  "NC", /* GPIO33 */
++			  "NC", /* GPIO34 */
++			  "PWR_LOW_N",
++			  "NC", /* GPIO36 */
++			  "NC", /* GPIO37 */
++			  "USB_LIMIT",
++			  "NC", /* GPIO39 */
++			  "PWM0_OUT",
++			  "CAM_GPIO0",
++			  "SMPS_SCL",
++			  "SMPS_SDA",
++			  "ETH_CLK",
++			  "PWM1_OUT",
++			  "HDMI_HPD_N",
++			  "STATUS_LED",
++			  /* Used by SD Card */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins = <40 45>;
++		brcm,function = <4>;
++		brcm,pull = <0>;
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&leds {
++	act_led: led-act {
++		label = "led0";
++		linux,default-trigger = "mmc0";
++		gpios = <&gpio 47 0>;
++	};
++
++	pwr_led: led-pwr {
++		label = "led1";
++		linux,default-trigger = "input";
++		gpios = <&gpio 35 0>;
++	};
++};
++
++&hdmi {
++	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&cam1_reg {
++	gpio = <&gpio 41 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_headphones=1 snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_headphones=0 snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&act_led>,"gpios:4";
++		act_led_activelow = <&act_led>,"gpios:8";
++		act_led_trigger = <&act_led>,"linux,default-trigger";
++
++		pwr_led_gpio = <&pwr_led>,"gpios:4";
++		pwr_led_activelow = <&pwr_led>,"gpios:8";
++		pwr_led_trigger = <&pwr_led>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/bcm2709-rpi-cm2.dts b/arch/arm/boot/dts/bcm2709-rpi-cm2.dts
+new file mode 100644
+index 000000000000..c9e47c46f4f7
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2709-rpi-cm2.dts
+@@ -0,0 +1,221 @@
++/dts-v1/;
++
++#include "bcm2709.dtsi"
++#include "bcm2709-rpi.dtsi"
++#include "bcm283x-rpi-csi0-2lane.dtsi"
++#include "bcm283x-rpi-csi1-4lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_28.dtsi"
++
++/ {
++	compatible = "raspberrypi,2-compute-module", "brcm,bcm2836";
++	model = "Raspberry Pi Compute Module 2";
++};
++
++&cam1_reg {
++	gpio = <&gpio 2 GPIO_ACTIVE_HIGH>;
++	status = "disabled";
++};
++
++cam0_reg: &cam0_regulator {
++	gpio = <&gpio 30 GPIO_ACTIVE_HIGH>;
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&gpio {
++	/*
++	 * This is based on the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "GPIO0",
++			  "GPIO1",
++			  "GPIO2",
++			  "GPIO3",
++			  "GPIO4",
++			  "GPIO5",
++			  "GPIO6",
++			  "GPIO7",
++			  "GPIO8",
++			  "GPIO9",
++			  "GPIO10",
++			  "GPIO11",
++			  "GPIO12",
++			  "GPIO13",
++			  "GPIO14",
++			  "GPIO15",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "GPIO28",
++			  "GPIO29",
++			  "GPIO30",
++			  "GPIO31",
++			  "GPIO32",
++			  "GPIO33",
++			  "GPIO34",
++			  "GPIO35",
++			  "GPIO36",
++			  "GPIO37",
++			  "GPIO38",
++			  "GPIO39",
++			  "GPIO40",
++			  "GPIO41",
++			  "GPIO42",
++			  "GPIO43",
++			  "GPIO44",
++			  "GPIO45",
++			  "SMPS_SCL",
++			  "SMPS_SDA",
++			  /* Used by eMMC */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins;
++		brcm,function;
++	};
++};
++
++&soc {
++	virtgpio: virtgpio {
++		compatible = "brcm,bcm2835-virtgpio";
++		gpio-controller;
++		#gpio-cells = <2>;
++		firmware = <&firmware>;
++		status = "okay";
++	};
++
++};
++
++&firmware {
++	expgpio: expgpio {
++		compatible = "raspberrypi,firmware-gpio";
++		gpio-controller;
++		#gpio-cells = <2>;
++		gpio-line-names = "HDMI_HPD_N",
++				  "EMMC_EN_N",
++				  "NC",
++				  "NC",
++				  "NC",
++				  "NC",
++				  "NC",
++				  "NC";
++		status = "okay";
++	};
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&leds {
++	act_led: led-act {
++		label = "led0";
++		linux,default-trigger = "mmc0";
++		gpios = <&virtgpio 0 0>;
++	};
++};
++
++&hdmi {
++	hpd-gpios = <&expgpio 0 GPIO_ACTIVE_LOW>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&act_led>,"gpios:4";
++		act_led_activelow = <&act_led>,"gpios:8";
++		act_led_trigger = <&act_led>,"linux,default-trigger";
++		cam0_reg = <&cam0_reg>,"status";
++		cam0_reg_gpio = <&cam0_reg>,"gpio:4";
++		cam1_reg = <&cam1_reg>,"status";
++		cam1_reg_gpio = <&cam1_reg>,"gpio:4";
++	};
++};
+diff --git a/arch/arm/boot/dts/bcm2709-rpi.dtsi b/arch/arm/boot/dts/bcm2709-rpi.dtsi
+new file mode 100644
+index 000000000000..babfa41cd9f7
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2709-rpi.dtsi
+@@ -0,0 +1,5 @@
++#include "bcm2708-rpi.dtsi"
++
++&vchiq {
++	compatible = "brcm,bcm2836-vchiq", "brcm,bcm2835-vchiq";
++};
+diff --git a/arch/arm/boot/dts/bcm2709.dtsi b/arch/arm/boot/dts/bcm2709.dtsi
+new file mode 100644
+index 000000000000..e195f7247813
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2709.dtsi
+@@ -0,0 +1,24 @@
++#define i2c0 i2c0if
++#include "bcm2836.dtsi"
++#undef i2c0
++#include "bcm270x.dtsi"
++
++/ {
++	soc {
++		ranges = <0x7e000000 0x3f000000 0x01000000>,
++		         <0x40000000 0x40000000 0x00040000>;
++
++		/delete-node/ timer@7e003000;
++	};
++
++	__overrides__ {
++		arm_freq = <&v7_cpu0>, "clock-frequency:0",
++			   <&v7_cpu1>, "clock-frequency:0",
++			   <&v7_cpu2>, "clock-frequency:0",
++			   <&v7_cpu3>, "clock-frequency:0";
++	};
++};
++
++&vc4 {
++	status = "disabled";
++};
+diff --git a/arch/arm/boot/dts/bcm270x-rpi.dtsi b/arch/arm/boot/dts/bcm270x-rpi.dtsi
+new file mode 100644
+index 000000000000..1401d7b261f8
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm270x-rpi.dtsi
+@@ -0,0 +1,177 @@
++/* Downstream modifications to bcm2835-rpi.dtsi */
++
++/ {
++	aliases {
++		aux = &aux;
++		sound = &sound;
++		soc = &soc;
++		dma = &dma;
++		intc = &intc;
++		watchdog = &watchdog;
++		random = &random;
++		mailbox = &mailbox;
++		gpio = &gpio;
++		uart0 = &uart0;
++		uart1 = &uart1;
++		sdhost = &sdhost;
++		mmc = &mmc;
++		mmc1 = &mmc;
++		mmc0 = &sdhost;
++		i2s = &i2s;
++		i2c0 = &i2c0;
++		i2c1 = &i2c1;
++		i2c10 = &i2c_csi_dsi;
++		spi0 = &spi0;
++		spi1 = &spi1;
++		spi2 = &spi2;
++		usb = &usb;
++		leds = &leds;
++		fb = &fb;
++		thermal = &thermal;
++		axiperf = &axiperf;
++	};
++
++	/* Define these notional regulators for use by overlays */
++	vdd_3v3_reg: fixedregulator_3v3 {
++		compatible = "regulator-fixed";
++		regulator-always-on;
++		regulator-max-microvolt = <3300000>;
++		regulator-min-microvolt = <3300000>;
++		regulator-name = "3v3";
++	};
++
++	vdd_5v0_reg: fixedregulator_5v0 {
++		compatible = "regulator-fixed";
++		regulator-always-on;
++		regulator-max-microvolt = <5000000>;
++		regulator-min-microvolt = <5000000>;
++		regulator-name = "5v0";
++	};
++
++	leds: leds {
++		compatible = "gpio-leds";
++	};
++
++	soc {
++		gpiomem {
++			compatible = "brcm,bcm2835-gpiomem";
++			reg = <0x7e200000 0x1000>;
++		};
++
++		fb: fb {
++			compatible = "brcm,bcm2708-fb";
++			firmware = <&firmware>;
++			status = "okay";
++		};
++
++		/* External sound card */
++		sound: sound {
++			status = "disabled";
++		};
++	};
++
++	__overrides__ {
++		cache_line_size;
++
++		uart0 = <&uart0>,"status";
++		uart1 = <&uart1>,"status";
++		i2s = <&i2s>,"status";
++		spi = <&spi0>,"status";
++		i2c0 = <&i2c0if>,"status",<&i2c0mux>,"status";
++		i2c1 = <&i2c1>,"status";
++		i2c0_baudrate = <&i2c0if>,"clock-frequency:0";
++		i2c1_baudrate = <&i2c1>,"clock-frequency:0";
++
++		watchdog = <&watchdog>,"status";
++		random = <&random>,"status";
++		sd_overclock = <&sdhost>,"brcm,overclock-50:0";
++		sd_force_pio = <&sdhost>,"brcm,force-pio?";
++		sd_pio_limit = <&sdhost>,"brcm,pio-limit:0";
++		sd_debug     = <&sdhost>,"brcm,debug";
++		sdio_overclock = <&mmc>,"brcm,overclock-50:0",
++				 <&mmcnr>,"brcm,overclock-50:0";
++		axiperf      = <&axiperf>,"status";
++	};
++};
++
++&uart0 {
++	skip-init;
++};
++
++&uart1 {
++	skip-init;
++};
++
++&txp {
++	status = "disabled";
++};
++
++&i2c0if {
++	status = "disabled";
++};
++
++&i2c0mux {
++	pinctrl-names = "i2c0", "i2c_csi_dsi";
++	/delete-property/ clock-frequency;
++	status = "disabled";
++};
++
++&i2c1 {
++	status = "disabled";
++};
++
++&clocks {
++	firmware = <&firmware>;
++};
++
++&sdhci {
++	pinctrl-names = "default";
++	pinctrl-0 = <&emmc_gpio48>;
++	bus-width = <4>;
++};
++
++&cpu_thermal {
++	// Add some labels
++	thermal_trips: trips {
++		cpu-crit {
++			// Raise upstream limit of 90C
++			temperature = <110000>;
++		};
++	};
++	cooling_maps: cooling-maps {
++	};
++};
++
++&vec {
++	clocks = <&firmware_clocks 15>;
++	status = "disabled";
++};
++
++&firmware {
++#ifndef BCM2711
++	firmware_clocks: clocks {
++		compatible = "raspberrypi,firmware-clocks";
++		#clock-cells = <1>;
++	};
++#endif
++
++	vcio: vcio {
++		compatible = "raspberrypi,vcio";
++	};
++};
++
++&vc4 {
++	raspberrypi,firmware = <&firmware>;
++};
++
++#ifndef BCM2711
++
++&hdmi {
++	reg-names = "hdmi",
++		    "hd";
++	clocks = <&firmware_clocks 9>,
++		 <&firmware_clocks 13>;
++	dmas = <&dma (17|(1<<27)|(1<<24))>;
++};
++
++#endif
+diff --git a/arch/arm/boot/dts/bcm270x.dtsi b/arch/arm/boot/dts/bcm270x.dtsi
+new file mode 100644
+index 000000000000..bb8e7a9d1b22
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm270x.dtsi
+@@ -0,0 +1,294 @@
++/* Downstream bcm283x.dtsi diff */
++#include <dt-bindings/power/raspberrypi-power.h>
++
++/ {
++	chosen: chosen {
++		// Disable audio by default
++		bootargs = "coherent_pool=1M snd_bcm2835.enable_headphones=0";
++		/delete-property/ stdout-path;
++	};
++
++	soc: soc {
++		watchdog: watchdog@7e100000 {
++			/* Add label */
++		};
++
++		random: rng@7e104000 {
++			/* Add label */
++		};
++
++		spi0: spi@7e204000 {
++			/* Add label */
++		};
++
++#ifndef BCM2711
++		pixelvalve0: pixelvalve@7e206000 {
++			/* Add label */
++			status = "disabled";
++		};
++
++		pixelvalve1: pixelvalve@7e207000 {
++			/* Add label */
++			status = "disabled";
++		};
++#endif
++
++		/delete-node/ mmc@7e300000;
++
++		sdhci: mmc: mmc@7e300000 {
++			compatible = "brcm,bcm2835-mmc", "brcm,bcm2835-sdhci";
++			reg = <0x7e300000 0x100>;
++			interrupts = <2 30>;
++			clocks = <&clocks BCM2835_CLOCK_EMMC>;
++			dmas = <&dma 11>;
++			dma-names = "rx-tx";
++			brcm,overclock-50 = <0>;
++			status = "disabled";
++		};
++
++		/* A clone of mmc but with non-removable set */
++		mmcnr: mmcnr@7e300000 {
++			compatible = "brcm,bcm2835-mmc", "brcm,bcm2835-sdhci";
++			reg = <0x7e300000 0x100>;
++			interrupts = <2 30>;
++			clocks = <&clocks BCM2835_CLOCK_EMMC>;
++			dmas = <&dma 11>;
++			dma-names = "rx-tx";
++			brcm,overclock-50 = <0>;
++			non-removable;
++			status = "disabled";
++		};
++
++		hvs: hvs@7e400000 {
++			/* Add label */
++			status = "disabled";
++		};
++
++		firmwarekms: firmwarekms@7e600000 {
++			compatible = "raspberrypi,rpi-firmware-kms";
++			/* SMI interrupt reg */
++			reg = <0x7e600000 0x100>;
++			interrupts = <2 16>;
++			brcm,firmware = <&firmware>;
++			status = "disabled";
++		};
++
++		smi: smi@7e600000 {
++			compatible = "brcm,bcm2835-smi";
++			reg = <0x7e600000 0x100>;
++			interrupts = <2 16>;
++			clocks = <&clocks BCM2835_CLOCK_SMI>;
++			assigned-clocks = <&clocks BCM2835_CLOCK_SMI>;
++			assigned-clock-rates = <125000000>;
++			dmas = <&dma 4>;
++			dma-names = "rx-tx";
++			status = "disabled";
++		};
++
++		csi0: csi@7e800000 {
++			compatible = "brcm,bcm2835-unicam";
++			reg = <0x7e800000 0x800>,
++			      <0x7e802000 0x4>;
++			interrupts = <2 6>;
++			clocks = <&clocks BCM2835_CLOCK_CAM0>,
++				 <&firmware_clocks 4>;
++			clock-names = "lp", "vpu";
++			power-domains = <&power RPI_POWER_DOMAIN_UNICAM0>;
++			#address-cells = <1>;
++			#size-cells = <0>;
++			#clock-cells = <1>;
++			status = "disabled";
++		};
++
++		csi1: csi@7e801000 {
++			compatible = "brcm,bcm2835-unicam";
++			reg = <0x7e801000 0x800>,
++			      <0x7e802004 0x4>;
++			interrupts = <2 7>;
++			clocks = <&clocks BCM2835_CLOCK_CAM1>,
++				 <&firmware_clocks 4>;
++			clock-names = "lp", "vpu";
++			power-domains = <&power RPI_POWER_DOMAIN_UNICAM1>;
++			#address-cells = <1>;
++			#size-cells = <0>;
++			#clock-cells = <1>;
++			status = "disabled";
++		};
++
++#ifndef BCM2711
++		pixelvalve2: pixelvalve@7e807000 {
++			/* Add label */
++			status = "disabled";
++		};
++#endif
++
++		hdmi@7e902000 { /* hdmi */
++			status = "disabled";
++		};
++
++		usb@7e980000 { /* usb */
++			compatible = "brcm,bcm2708-usb";
++			reg = <0x7e980000 0x10000>,
++			      <0x7e006000 0x1000>;
++			interrupt-names = "usb",
++					  "soft";
++			interrupts = <1 9>,
++				     <2 0>;
++		};
++
++#ifndef BCM2711
++		v3d@7ec00000 { /* vd3 */
++			compatible = "brcm,vc4-v3d";
++			power-domains = <&power RPI_POWER_DOMAIN_V3D>;
++			status = "disabled";
++		};
++#endif
++
++		axiperf: axiperf {
++			compatible = "brcm,bcm2835-axiperf";
++			reg = <0x7e009800 0x100>,
++			      <0x7ee08000 0x100>;
++			firmware = <&firmware>;
++			status = "disabled";
++		};
++
++		i2c0mux: i2c0mux {
++			compatible = "i2c-mux-pinctrl";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			i2c-parent = <&i2c0if>;
++
++			status = "disabled";
++
++			i2c0: i2c@0 {
++				reg = <0>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++			};
++
++			i2c_csi_dsi: i2c@1 {
++				reg = <1>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++			};
++		};
++	};
++
++	cam1_reg: cam1_regulator {
++		compatible = "regulator-fixed";
++		regulator-name = "cam1-reg";
++		enable-active-high;
++		/* Needs to be enabled, as removing a regulator is very unsafe */
++		status = "okay";
++	};
++
++	cam1_clk: cam1_clk {
++		compatible = "fixed-clock";
++		#clock-cells = <0>;
++		status = "disabled";
++	};
++
++	cam0_regulator: cam0_regulator {
++		compatible = "regulator-fixed";
++		regulator-name = "cam0-reg";
++		enable-active-high;
++		status = "disabled";
++	};
++
++	cam0_clk: cam0_clk {
++		compatible = "fixed-clock";
++		#clock-cells = <0>;
++		status = "disabled";
++	};
++
++	cam_dummy_reg: cam_dummy_reg {
++		compatible = "regulator-fixed";
++		regulator-name = "cam-dummy-reg";
++		status = "okay";
++	};
++
++	__overrides__ {
++		cam0-pwdn-ctrl;
++		cam0-pwdn;
++		cam0-led-ctrl;
++		cam0-led;
++	};
++};
++
++&gpio {
++	interrupts = <2 17>, <2 18>;
++
++	dpi_18bit_cpadhi_gpio0: dpi_18bit_cpadhi_gpio0 {
++		brcm,pins = <0 1 2 3 4 5 6 7 8 9
++			     12 13 14 15 16 17
++			     20 21 22 23 24 25>;
++		brcm,function = <BCM2835_FSEL_ALT2>;
++		brcm,pull = <0>; /* no pull */
++	};
++	dpi_18bit_cpadhi_gpio2: dpi_18bit_cpadhi_gpio2 {
++		brcm,pins = <2 3 4 5 6 7 8 9
++			     12 13 14 15 16 17
++			     20 21 22 23 24 25>;
++		brcm,function = <BCM2835_FSEL_ALT2>;
++	};
++	dpi_18bit_gpio0: dpi_18bit_gpio0 {
++		brcm,pins = <0 1 2 3 4 5 6 7 8 9 10 11
++			     12 13 14 15 16 17 18 19
++			     20 21>;
++		brcm,function = <BCM2835_FSEL_ALT2>;
++	};
++	dpi_18bit_gpio2: dpi_18bit_gpio2 {
++		brcm,pins = <2 3 4 5 6 7 8 9 10 11
++			     12 13 14 15 16 17 18 19
++			     20 21>;
++		brcm,function = <BCM2835_FSEL_ALT2>;
++	};
++	dpi_16bit_gpio0: dpi_16bit_gpio0 {
++		brcm,pins = <0 1 2 3 4 5 6 7 8 9 10 11
++			     12 13 14 15 16 17 18 19>;
++		brcm,function = <BCM2835_FSEL_ALT2>;
++	};
++	dpi_16bit_gpio2: dpi_16bit_gpio2 {
++		brcm,pins = <2 3 4 5 6 7 8 9 10 11
++			     12 13 14 15 16 17 18 19>;
++		brcm,function = <BCM2835_FSEL_ALT2>;
++	};
++	dpi_16bit_cpadhi_gpio0: dpi_16bit_cpadhi_gpio0 {
++		brcm,pins = <0 1 2 3 4 5 6 7 8
++			     12 13 14 15 16 17
++			     20 21 22 23 24>;
++		brcm,function = <BCM2835_FSEL_ALT2>;
++	};
++	dpi_16bit_cpadhi_gpio2: dpi_16bit_cpadhi_gpio2 {
++		brcm,pins = <2 3 4 5 6 7 8
++			     12 13 14 15 16 17
++			     20 21 22 23 24>;
++		brcm,function = <BCM2835_FSEL_ALT2>;
++	};
++};
++
++&uart0 {
++	/* Enable CTS bug workaround */
++	cts-event-workaround;
++};
++
++&i2s {
++	#sound-dai-cells = <0>;
++	dmas = <&dma 2>, <&dma 3>;
++	dma-names = "tx", "rx";
++};
++
++&sdhost {
++	dmas = <&dma (13|(1<<29))>;
++	dma-names = "rx-tx";
++	bus-width = <4>;
++	brcm,overclock-50 = <0>;
++	brcm,pio-limit = <1>;
++	firmware = <&firmware>;
++};
++
++&spi0 {
++	dmas = <&dma 6>, <&dma 7>;
++	dma-names = "tx", "rx";
++};
+diff --git a/arch/arm/boot/dts/bcm2710-rpi-2-b.dts b/arch/arm/boot/dts/bcm2710-rpi-2-b.dts
+new file mode 100644
+index 000000000000..c77ff30aa738
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2710-rpi-2-b.dts
+@@ -0,0 +1,200 @@
++/dts-v1/;
++
++#include "bcm2710.dtsi"
++#include "bcm2709-rpi.dtsi"
++#include "bcm283x-rpi-smsc9514.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_28.dtsi"
++
++/ {
++	compatible = "raspberrypi,2-model-b-rev2", "brcm,bcm2837";
++	model = "Raspberry Pi 2 Model B rev 1.2";
++};
++
++&gpio {
++	/*
++	 * Taken from rpi_SCH_2b_1p2_reduced.pdf and
++	 * the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "SDA1",
++			  "SCL1",
++			  "GPIO_GCLK",
++			  "GPIO5",
++			  "GPIO6",
++			  "SPI_CE1_N",
++			  "SPI_CE0_N",
++			  "SPI_MISO",
++			  "SPI_MOSI",
++			  "SPI_SCLK",
++			  "GPIO12",
++			  "GPIO13",
++			  /* Serial port */
++			  "TXD0",
++			  "RXD0",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "SDA0",
++			  "SCL0",
++			  "NC", /* GPIO30 */
++			  "LAN_RUN",
++			  "CAM_GPIO1",
++			  "NC", /* GPIO33 */
++			  "NC", /* GPIO34 */
++			  "PWR_LOW_N",
++			  "NC", /* GPIO36 */
++			  "NC", /* GPIO37 */
++			  "USB_LIMIT",
++			  "NC", /* GPIO39 */
++			  "PWM0_OUT",
++			  "CAM_GPIO0",
++			  "SMPS_SCL",
++			  "SMPS_SDA",
++			  "ETH_CLK",
++			  "PWM1_OUT",
++			  "HDMI_HPD_N",
++			  "STATUS_LED",
++			  /* Used by SD Card */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins = <40 45>;
++		brcm,function = <4>;
++		brcm,pull = <0>;
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&leds {
++	act_led: led-act {
++		label = "led0";
++		linux,default-trigger = "mmc0";
++		gpios = <&gpio 47 0>;
++	};
++
++	pwr_led: led-pwr {
++		label = "led1";
++		linux,default-trigger = "input";
++		gpios = <&gpio 35 0>;
++	};
++};
++
++&hdmi {
++	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&cam1_reg {
++	gpio = <&gpio 41 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_headphones=1 snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_headphones=0 snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&act_led>,"gpios:4";
++		act_led_activelow = <&act_led>,"gpios:8";
++		act_led_trigger = <&act_led>,"linux,default-trigger";
++
++		pwr_led_gpio = <&pwr_led>,"gpios:4";
++		pwr_led_activelow = <&pwr_led>,"gpios:8";
++		pwr_led_trigger = <&pwr_led>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
+new file mode 100644
+index 000000000000..04621bd197c3
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
+@@ -0,0 +1,289 @@
++/dts-v1/;
++
++#include "bcm2710.dtsi"
++#include "bcm2709-rpi.dtsi"
++#include "bcm283x-rpi-lan7515.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_44.dtsi"
++#include "bcm271x-rpi-bt.dtsi"
++
++/ {
++	compatible = "raspberrypi,3-model-b-plus", "brcm,bcm2837";
++	model = "Raspberry Pi 3 Model B+";
++
++	chosen {
++		bootargs = "coherent_pool=1M 8250.nr_uarts=1 snd_bcm2835.enable_headphones=0";
++	};
++
++	aliases {
++		serial0 = &uart1;
++		serial1 = &uart0;
++		mmc1 = &mmcnr;
++	};
++};
++
++&gpio {
++	/*
++	 * Taken from rpi_SCH_3bplus_1p0_reduced.pdf and
++	 * the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "SDA1",
++			  "SCL1",
++			  "GPIO_GCLK",
++			  "GPIO5",
++			  "GPIO6",
++			  "SPI_CE1_N",
++			  "SPI_CE0_N",
++			  "SPI_MISO",
++			  "SPI_MOSI",
++			  "SPI_SCLK",
++			  "GPIO12",
++			  "GPIO13",
++			  /* Serial port */
++			  "TXD1",
++			  "RXD1",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "HDMI_HPD_N",
++			  "STATUS_LED_G",
++			  /* Used by BT module */
++			  "CTS0",
++			  "RTS0",
++			  "TXD0",
++			  "RXD0",
++			  /* Used by Wifi */
++			  "SD1_CLK",
++			  "SD1_CMD",
++			  "SD1_DATA0",
++			  "SD1_DATA1",
++			  "SD1_DATA2",
++			  "SD1_DATA3",
++			  "PWM0_OUT",
++			  "PWM1_OUT",
++			  "ETH_CLK",
++			  "WIFI_CLK",
++			  "SDA0",
++			  "SCL0",
++			  "SMPS_SCL",
++			  "SMPS_SDA",
++			  /* Used by SD Card */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	sdio_pins: sdio_pins {
++		brcm,pins =     <34 35 36 37 38 39>;
++		brcm,function = <7>; // alt3 = SD1
++		brcm,pull =     <0 2 2 2 2 2>;
++	};
++
++	bt_pins: bt_pins {
++		brcm,pins = <43>;
++		brcm,function = <4>; /* alt0:GPCLK2 */
++		brcm,pull = <0>;
++	};
++
++	uart0_pins: uart0_pins {
++		brcm,pins = <32 33>;
++		brcm,function = <7>; /* alt3=UART0 */
++		brcm,pull = <0 2>;
++	};
++
++	uart1_pins: uart1_pins {
++		brcm,pins;
++		brcm,function;
++		brcm,pull;
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins = <40 41>;
++		brcm,function = <4>;
++		brcm,pull = <0>;
++	};
++};
++
++&mmcnr {
++	pinctrl-names = "default";
++	pinctrl-0 = <&sdio_pins>;
++	bus-width = <4>;
++	status = "okay";
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	brcmf: wifi@1 {
++		reg = <1>;
++		compatible = "brcm,bcm4329-fmac";
++	};
++};
++
++&firmware {
++	expgpio: expgpio {
++		compatible = "raspberrypi,firmware-gpio";
++		gpio-controller;
++		#gpio-cells = <2>;
++		gpio-line-names = "BT_ON",
++				  "WL_ON",
++				  "PWR_LED_R",
++				  "LAN_RUN",
++				  "NC",
++				  "CAM_GPIO0",
++				  "CAM_GPIO1",
++				  "NC";
++		status = "okay";
++	};
++};
++
++&uart0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart0_pins &bt_pins>;
++	status = "okay";
++};
++
++&uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart1_pins>;
++	status = "okay";
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&leds {
++	act_led: led-act {
++		label = "led0";
++		linux,default-trigger = "mmc0";
++		gpios = <&gpio 29 0>;
++	};
++
++	pwr_led: led-pwr {
++		label = "led1";
++		linux,default-trigger = "default-on";
++		gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
++	};
++};
++
++&hdmi {
++	hpd-gpios = <&gpio 28 GPIO_ACTIVE_LOW>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&eth_phy {
++	microchip,eee-enabled;
++	microchip,tx-lpi-timer = <600>; /* non-aggressive*/
++	microchip,downshift-after = <2>;
++};
++
++&cam1_reg {
++	gpio = <&expgpio 5 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_headphones=1 snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_headphones=0 snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&act_led>,"gpios:4";
++		act_led_activelow = <&act_led>,"gpios:8";
++		act_led_trigger = <&act_led>,"linux,default-trigger";
++
++		pwr_led_gpio = <&pwr_led>,"gpios:4";
++		pwr_led_activelow = <&pwr_led>,"gpios:8";
++		pwr_led_trigger = <&pwr_led>,"linux,default-trigger";
++
++		eee = <&eth_phy>,"microchip,eee-enabled?";
++		tx_lpi_timer = <&eth_phy>,"microchip,tx-lpi-timer:0";
++		eth_led0 = <&eth_phy>,"microchip,led-modes:0";
++		eth_led1 = <&eth_phy>,"microchip,led-modes:4";
++		eth_downshift_after = <&eth_phy>,"microchip,downshift-after:0";
++		eth_max_speed = <&eth_phy>,"max-speed:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
+new file mode 100644
+index 000000000000..e0b233562c03
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
+@@ -0,0 +1,291 @@
++/dts-v1/;
++
++#include "bcm2710.dtsi"
++#include "bcm2709-rpi.dtsi"
++#include "bcm283x-rpi-smsc9514.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_44.dtsi"
++#include "bcm271x-rpi-bt.dtsi"
++
++/ {
++	compatible = "raspberrypi,3-model-b", "brcm,bcm2837";
++	model = "Raspberry Pi 3 Model B";
++
++	chosen {
++		bootargs = "coherent_pool=1M 8250.nr_uarts=1 snd_bcm2835.enable_headphones=0";
++	};
++
++	aliases {
++		serial0 = &uart1;
++		serial1 = &uart0;
++		mmc1 = &mmcnr;
++	};
++};
++
++&gpio {
++	/*
++	 * Taken from rpi_SCH_3b_1p2_reduced.pdf and
++	 * the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "SDA1",
++			  "SCL1",
++			  "GPIO_GCLK",
++			  "GPIO5",
++			  "GPIO6",
++			  "SPI_CE1_N",
++			  "SPI_CE0_N",
++			  "SPI_MISO",
++			  "SPI_MOSI",
++			  "SPI_SCLK",
++			  "GPIO12",
++			  "GPIO13",
++			  /* Serial port */
++			  "TXD1",
++			  "RXD1",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "NC", /* GPIO 28 */
++			  "LAN_RUN_BOOT",
++			  /* Used by BT module */
++			  "CTS0",
++			  "RTS0",
++			  "TXD0",
++			  "RXD0",
++			  /* Used by Wifi */
++			  "SD1_CLK",
++			  "SD1_CMD",
++			  "SD1_DATA0",
++			  "SD1_DATA1",
++			  "SD1_DATA2",
++			  "SD1_DATA3",
++			  "PWM0_OUT",
++			  "PWM1_OUT",
++			  "ETH_CLK",
++			  "WIFI_CLK",
++			  "SDA0",
++			  "SCL0",
++			  "SMPS_SCL",
++			  "SMPS_SDA",
++			  /* Used by SD Card */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	sdio_pins: sdio_pins {
++		brcm,pins =     <34 35 36 37 38 39>;
++		brcm,function = <7>; // alt3 = SD1
++		brcm,pull =     <0 2 2 2 2 2>;
++	};
++
++	bt_pins: bt_pins {
++		brcm,pins = <43>;
++		brcm,function = <4>; /* alt0:GPCLK2 */
++		brcm,pull = <0>;
++	};
++
++	uart0_pins: uart0_pins {
++		brcm,pins = <32 33>;
++		brcm,function = <7>; /* alt3=UART0 */
++		brcm,pull = <0 2>;
++	};
++
++	uart1_pins: uart1_pins {
++		brcm,pins;
++		brcm,function;
++		brcm,pull;
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins = <40 41>;
++		brcm,function = <4>;
++		brcm,pull = <0>;
++	};
++};
++
++&mmcnr {
++	pinctrl-names = "default";
++	pinctrl-0 = <&sdio_pins>;
++	bus-width = <4>;
++	status = "okay";
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	brcmf: wifi@1 {
++		reg = <1>;
++		compatible = "brcm,bcm4329-fmac";
++	};
++};
++
++&soc {
++	virtgpio: virtgpio {
++		compatible = "brcm,bcm2835-virtgpio";
++		gpio-controller;
++		#gpio-cells = <2>;
++		firmware = <&firmware>;
++		status = "okay";
++	};
++
++};
++
++&firmware {
++	expgpio: expgpio {
++		compatible = "raspberrypi,firmware-gpio";
++		gpio-controller;
++		#gpio-cells = <2>;
++		gpio-line-names = "BT_ON",
++				  "WL_ON",
++				  "STATUS_LED",
++				  "LAN_RUN",
++				  "HDMI_HPD_N",
++				  "CAM_GPIO0",
++				  "CAM_GPIO1",
++				  "PWR_LOW_N";
++		status = "okay";
++	};
++};
++
++&uart0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart0_pins &bt_pins>;
++	status = "okay";
++};
++
++&uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart1_pins>;
++	status = "okay";
++};
++
++&bt {
++	max-speed = <921600>;
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&leds {
++	act_led: led-act {
++		label = "led0";
++		linux,default-trigger = "mmc0";
++		gpios = <&virtgpio 0 0>;
++	};
++
++	pwr_led: led-pwr {
++		label = "led1";
++		linux,default-trigger = "input";
++		gpios = <&expgpio 7 0>;
++	};
++};
++
++&hdmi {
++	hpd-gpios = <&expgpio 4 GPIO_ACTIVE_LOW>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&cam1_reg {
++	gpio = <&expgpio 5 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_headphones=1 snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_headphones=0 snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&act_led>,"gpios:4";
++		act_led_activelow = <&act_led>,"gpios:8";
++		act_led_trigger = <&act_led>,"linux,default-trigger";
++
++		pwr_led_gpio = <&pwr_led>,"gpios:4";
++		pwr_led_activelow = <&pwr_led>,"gpios:8";
++		pwr_led_trigger = <&pwr_led>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/bcm2710-rpi-cm3.dts b/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
+new file mode 100644
+index 000000000000..5b9b44e0f30e
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
+@@ -0,0 +1,220 @@
++/dts-v1/;
++
++#include "bcm2710.dtsi"
++#include "bcm2709-rpi.dtsi"
++#include "bcm283x-rpi-csi0-2lane.dtsi"
++#include "bcm283x-rpi-csi1-4lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_28.dtsi"
++/ {
++	compatible = "raspberrypi,3-compute-module", "brcm,bcm2837";
++	model = "Raspberry Pi Compute Module 3";
++};
++
++&cam1_reg {
++	gpio = <&gpio 2 GPIO_ACTIVE_HIGH>;
++	status = "disabled";
++};
++
++cam0_reg: &cam0_regulator {
++	gpio = <&gpio 30 GPIO_ACTIVE_HIGH>;
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&gpio {
++	/*
++	 * This is based on the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "GPIO0",
++			  "GPIO1",
++			  "GPIO2",
++			  "GPIO3",
++			  "GPIO4",
++			  "GPIO5",
++			  "GPIO6",
++			  "GPIO7",
++			  "GPIO8",
++			  "GPIO9",
++			  "GPIO10",
++			  "GPIO11",
++			  "GPIO12",
++			  "GPIO13",
++			  "GPIO14",
++			  "GPIO15",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "GPIO28",
++			  "GPIO29",
++			  "GPIO30",
++			  "GPIO31",
++			  "GPIO32",
++			  "GPIO33",
++			  "GPIO34",
++			  "GPIO35",
++			  "GPIO36",
++			  "GPIO37",
++			  "GPIO38",
++			  "GPIO39",
++			  "GPIO40",
++			  "GPIO41",
++			  "GPIO42",
++			  "GPIO43",
++			  "GPIO44",
++			  "GPIO45",
++			  "SMPS_SCL",
++			  "SMPS_SDA",
++			  /* Used by eMMC */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins;
++		brcm,function;
++	};
++};
++
++&soc {
++	virtgpio: virtgpio {
++		compatible = "brcm,bcm2835-virtgpio";
++		gpio-controller;
++		#gpio-cells = <2>;
++		firmware = <&firmware>;
++		status = "okay";
++	};
++
++};
++
++&firmware {
++	expgpio: expgpio {
++		compatible = "raspberrypi,firmware-gpio";
++		gpio-controller;
++		#gpio-cells = <2>;
++		gpio-line-names = "HDMI_HPD_N",
++				  "EMMC_EN_N",
++				  "NC",
++				  "NC",
++				  "NC",
++				  "NC",
++				  "NC",
++				  "NC";
++		status = "okay";
++	};
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&leds {
++	act_led: led-act {
++		label = "led0";
++		linux,default-trigger = "mmc0";
++		gpios = <&virtgpio 0 0>;
++	};
++};
++
++&hdmi {
++	hpd-gpios = <&expgpio 0 GPIO_ACTIVE_LOW>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&act_led>,"gpios:4";
++		act_led_activelow = <&act_led>,"gpios:8";
++		act_led_trigger = <&act_led>,"linux,default-trigger";
++		cam0_reg = <&cam0_reg>,"status";
++		cam0_reg_gpio = <&cam0_reg>,"gpio:4";
++		cam1_reg = <&cam1_reg>,"status";
++		cam1_reg_gpio = <&cam1_reg>,"gpio:4";
++	};
++};
+diff --git a/arch/arm/boot/dts/bcm2710-rpi-zero-2-w.dts b/arch/arm/boot/dts/bcm2710-rpi-zero-2-w.dts
+new file mode 100644
+index 000000000000..6522d2aa3d52
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2710-rpi-zero-2-w.dts
+@@ -0,0 +1,267 @@
++/dts-v1/;
++
++#include "bcm2710.dtsi"
++#include "bcm2709-rpi.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_44.dtsi"
++#include "bcm2708-rpi-bt.dtsi"
++
++/ {
++	compatible = "raspberrypi,model-zero-2-w", "brcm,bcm2837";
++	model = "Raspberry Pi Zero 2 W";
++
++	chosen {
++		bootargs = "coherent_pool=1M 8250.nr_uarts=1 snd_bcm2835.enable_headphones=0";
++	};
++
++	aliases {
++		serial0 = &uart1;
++		serial1 = &uart0;
++		mmc1 = &mmcnr;
++	};
++};
++
++&gpio {
++	/*
++	 * This is based on the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "SDA1",
++			  "SCL1",
++			  "GPIO_GCLK",
++			  "GPIO5",
++			  "GPIO6",
++			  "SPI_CE1_N",
++			  "SPI_CE0_N",
++			  "SPI_MISO",
++			  "SPI_MOSI",
++			  "SPI_SCLK",
++			  "GPIO12",
++			  "GPIO13",
++			  /* Serial port */
++			  "TXD1",
++			  "RXD1",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "HDMI_HPD_N",
++			  "STATUS_LED_N",
++			  /* Used by BT module */
++			  "CTS0",
++			  "RTS0",
++			  "TXD0",
++			  "RXD0",
++			  /* Used by Wifi */
++			  "SD1_CLK",
++			  "SD1_CMD",
++			  "SD1_DATA0",
++			  "SD1_DATA1",
++			  "SD1_DATA2",
++			  "SD1_DATA3",
++			  "CAM_GPIO1", /* GPIO40 */
++			  "WL_ON", /* GPIO41 */
++			  "BT_ON", /* GPIO42 */
++			  "WIFI_CLK", /* GPIO43 */
++			  "SDA0", /* GPIO44 */
++			  "SCL0", /* GPIO45 */
++			  "SMPS_SCL", /* GPIO46 */
++			  "SMPS_SDA", /* GPIO47 */
++			  /* Used by SD Card */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	sdio_pins: sdio_pins {
++		brcm,pins =     <34 35 36 37 38 39>;
++		brcm,function = <7>; // alt3 = SD1
++		brcm,pull =     <0 2 2 2 2 2>;
++	};
++
++	bt_pins: bt_pins {
++		brcm,pins = <43>;
++		brcm,function = <4>; /* alt0:GPCLK2 */
++		brcm,pull = <0>;
++	};
++
++	uart0_pins: uart0_pins {
++		brcm,pins = <30 31 32 33>;
++		brcm,function = <7>; /* alt3=UART0 */
++		brcm,pull = <2 0 0 2>; /* up none none up */
++	};
++
++	uart1_pins: uart1_pins {
++		brcm,pins;
++		brcm,function;
++		brcm,pull;
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins = <>;
++		brcm,function = <>;
++	};
++};
++
++&mmcnr {
++	pinctrl-names = "default";
++	pinctrl-0 = <&sdio_pins>;
++	bus-width = <4>;
++	status = "okay";
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	brcmf: wifi@1 {
++		reg = <1>;
++		compatible = "brcm,bcm4329-fmac";
++
++		firmwares {
++			fw_43436p {
++				chipid = <43430>;
++				revmask = <4>;
++				fw_base = "brcm/brcmfmac43436-sdio";
++			};
++			fw_43436s {
++				chipid = <43430>;
++				revmask = <2>;
++				fw_base = "brcm/brcmfmac43436s-sdio";
++			};
++		};
++	};
++};
++
++&uart0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart0_pins &bt_pins>;
++	status = "okay";
++};
++
++&uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart1_pins>;
++	status = "okay";
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&leds {
++	act_led: led-act {
++		label = "led0";
++		linux,default-trigger = "actpwr";
++		gpios = <&gpio 29 GPIO_ACTIVE_LOW>;
++	};
++};
++
++&hdmi {
++	hpd-gpios = <&gpio 28 GPIO_ACTIVE_LOW>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&bt {
++	shutdown-gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
++};
++
++&minibt {
++	shutdown-gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
++};
++
++&cam1_reg {
++	gpio = <&gpio 40 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&act_led>,"gpios:4";
++		act_led_activelow = <&act_led>,"gpios:8";
++		act_led_trigger = <&act_led>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/bcm2710-rpi-zero-2.dts b/arch/arm/boot/dts/bcm2710-rpi-zero-2.dts
+new file mode 100644
+index 000000000000..daa12bd30d6b
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2710-rpi-zero-2.dts
+@@ -0,0 +1 @@
++#include "bcm2710-rpi-zero-2-w.dts"
+diff --git a/arch/arm/boot/dts/bcm2710.dtsi b/arch/arm/boot/dts/bcm2710.dtsi
+new file mode 100644
+index 000000000000..31b13b24affb
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2710.dtsi
+@@ -0,0 +1,27 @@
++#define i2c0 i2c0if
++#include "bcm2837.dtsi"
++#undef i2c0
++#include "bcm270x.dtsi"
++
++/ {
++	compatible = "brcm,bcm2837", "brcm,bcm2836";
++
++	arm-pmu {
++		compatible = "arm,cortex-a53-pmu", "arm,cortex-a7-pmu";
++	};
++
++	soc {
++		/delete-node/ timer@7e003000;
++	};
++
++	__overrides__ {
++		arm_freq = <&cpu0>, "clock-frequency:0",
++		       <&cpu1>, "clock-frequency:0",
++		       <&cpu2>, "clock-frequency:0",
++		       <&cpu3>, "clock-frequency:0";
++	};
++};
++
++&vc4 {
++	status = "disabled";
++};
+diff --git a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
+index 4432412044de..43a6cdcb7150 100644
+--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
+@@ -1,9 +1,15 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /dts-v1/;
++#define BCM2711
++#define i2c0 i2c0if
+ #include "bcm2711.dtsi"
+-#include "bcm2711-rpi.dtsi"
+-#include "bcm283x-rpi-usb-peripheral.dtsi"
+ #include "bcm283x-rpi-wifi-bt.dtsi"
++#undef i2c0
++#include "bcm270x.dtsi"
++#define i2c0 i2c0mux
++#include "bcm2711-rpi.dtsi"
++#undef i2c0
++//#include "bcm283x-rpi-usb-peripheral.dtsi"
+ 
+ / {
+ 	compatible = "raspberrypi,4-model-b", "brcm,bcm2711";
+@@ -72,7 +78,7 @@ &expgpio {
+ 			  "VDD_SD_IO_SEL",
+ 			  "CAM_GPIO",		/*  5 */
+ 			  "SD_PWR_ON",
+-			  "";
++			  "SD_OC_N";
+ };
+ 
+ &gpio {
+@@ -240,3 +246,311 @@ &vec {
+ &wifi_pwrseq {
+ 	reset-gpios = <&expgpio 1 GPIO_ACTIVE_LOW>;
+ };
++
++// =============================================
++// Downstream rpi- changes
++
++#include "bcm271x-rpi-bt.dtsi"
++
++/ {
++	soc {
++		/delete-node/ pixelvalve@7e807000;
++		/delete-node/ hdmi@7e902000;
++	};
++};
++
++#include "bcm2711-rpi-ds.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_44.dtsi"
++
++/ {
++	chosen {
++		bootargs = "coherent_pool=1M 8250.nr_uarts=1 snd_bcm2835.enable_headphones=0";
++	};
++
++	aliases {
++		serial0 = &uart1;
++		serial1 = &uart0;
++		mmc0 = &emmc2;
++		mmc1 = &mmcnr;
++		mmc2 = &sdhost;
++		i2c3 = &i2c3;
++		i2c4 = &i2c4;
++		i2c5 = &i2c5;
++		i2c6 = &i2c6;
++		i2c20 = &ddc0;
++		i2c21 = &ddc1;
++		spi3 = &spi3;
++		spi4 = &spi4;
++		spi5 = &spi5;
++		spi6 = &spi6;
++		/delete-property/ intc;
++	};
++
++	/delete-node/ wifi-pwrseq;
++};
++
++&mmcnr {
++	pinctrl-names = "default";
++	pinctrl-0 = <&sdio_pins>;
++	bus-width = <4>;
++	status = "okay";
++};
++
++&uart0 {
++	pinctrl-0 = <&uart0_pins &bt_pins>;
++	status = "okay";
++};
++
++&uart1 {
++	pinctrl-0 = <&uart1_pins>;
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&gpio {
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi3_pins: spi3_pins {
++		brcm,pins = <1 2 3>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi3_cs_pins: spi3_cs_pins {
++		brcm,pins = <0 24>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi4_pins: spi4_pins {
++		brcm,pins = <5 6 7>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi4_cs_pins: spi4_cs_pins {
++		brcm,pins = <4 25>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi5_pins: spi5_pins {
++		brcm,pins = <13 14 15>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi5_cs_pins: spi5_cs_pins {
++		brcm,pins = <12 26>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi6_pins: spi6_pins {
++		brcm,pins = <19 20 21>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi6_cs_pins: spi6_cs_pins {
++		brcm,pins = <18 27>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c3_pins: i2c3 {
++		brcm,pins = <4 5>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c4_pins: i2c4 {
++		brcm,pins = <8 9>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c5_pins: i2c5 {
++		brcm,pins = <12 13>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c6_pins: i2c6 {
++		brcm,pins = <22 23>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++	};
++
++	sdio_pins: sdio_pins {
++		brcm,pins =     <34 35 36 37 38 39>;
++		brcm,function = <BCM2835_FSEL_ALT3>; // alt3 = SD1
++		brcm,pull =     <0 2 2 2 2 2>;
++	};
++
++	bt_pins: bt_pins {
++		brcm,pins = "-"; // non-empty to keep btuart happy, //4 = 0
++				 // to fool pinctrl
++		brcm,function = <0>;
++		brcm,pull = <2>;
++	};
++
++	uart0_pins: uart0_pins {
++		brcm,pins = <32 33>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++		brcm,pull = <0 2>;
++	};
++
++	uart1_pins: uart1_pins {
++		brcm,pins;
++		brcm,function;
++		brcm,pull;
++	};
++
++	uart2_pins: uart2_pins {
++		brcm,pins = <0 1>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++
++	uart3_pins: uart3_pins {
++		brcm,pins = <4 5>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++
++	uart4_pins: uart4_pins {
++		brcm,pins = <8 9>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++
++	uart5_pins: uart5_pins {
++		brcm,pins = <12 13>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++// =============================================
++// Board specific stuff here
++
++&sdhost {
++	status = "disabled";
++};
++
++&phy1 {
++	led-modes = <0x00 0x08>; /* link/activity link */
++};
++
++&gpio {
++	audio_pins: audio_pins {
++		brcm,pins = <40 41>;
++		brcm,function = <4>;
++		brcm,pull = <0>;
++	};
++};
++
++&leds {
++	act_led: led-act {
++		label = "led0";
++		linux,default-trigger = "mmc0";
++		gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
++	};
++
++	pwr_led: led-pwr {
++		label = "led1";
++		linux,default-trigger = "default-on";
++		gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
++	};
++};
++
++&pwm1 {
++	status = "disabled";
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&cam1_reg {
++	gpio = <&expgpio 5 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_headphones=1 snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_headphones=0 snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&act_led>,"gpios:4";
++		act_led_activelow = <&act_led>,"gpios:8";
++		act_led_trigger = <&act_led>,"linux,default-trigger";
++
++		pwr_led_gpio = <&pwr_led>,"gpios:4";
++		pwr_led_activelow = <&pwr_led>,"gpios:8";
++		pwr_led_trigger = <&pwr_led>,"linux,default-trigger";
++
++		eth_led0 = <&phy1>,"led-modes:0";
++		eth_led1 = <&phy1>,"led-modes:4";
++
++		sd_poll_once = <&emmc2>, "non-removable?";
++		spi_dma4 = <&spi0>, "dmas:0=", <&dma40>,
++			   <&spi0>, "dmas:8=", <&dma40>;
++	};
++};
+diff --git a/arch/arm/boot/dts/bcm2711-rpi-400.dts b/arch/arm/boot/dts/bcm2711-rpi-400.dts
+index c53d9eb0b802..67df994170c7 100644
+--- a/arch/arm/boot/dts/bcm2711-rpi-400.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-400.dts
+@@ -1,6 +1,15 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /dts-v1/;
+-#include "bcm2711-rpi-4-b.dts"
++#define BCM2711
++#define i2c0 i2c0if
++#include "bcm2711.dtsi"
++#include "bcm283x-rpi-wifi-bt.dtsi"
++#undef i2c0
++#include "bcm270x.dtsi"
++#define i2c0 i2c0mux
++#include "bcm2711-rpi.dtsi"
++#undef i2c0
++//#include "bcm283x-rpi-usb-peripheral.dtsi"
+ 
+ / {
+ 	compatible = "raspberrypi,400", "brcm,bcm2711";
+@@ -12,19 +21,55 @@ chosen {
+ 	};
+ 
+ 	leds {
+-		/delete-node/ led-act;
++		led-act {
++			gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
++		};
+ 
+ 		led-pwr {
+-			gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
++			label = "PWR";
++			gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
++			default-state = "keep";
++			linux,default-trigger = "default-on";
+ 		};
+ 	};
+ 
+-	gpio-poweroff {
+-		compatible = "gpio-poweroff";
+-		gpios = <&expgpio 5 GPIO_ACTIVE_HIGH>;
++	sd_io_1v8_reg: sd_io_1v8_reg {
++		compatible = "regulator-gpio";
++		regulator-name = "vdd-sd-io";
++		regulator-min-microvolt = <1800000>;
++		regulator-max-microvolt = <3300000>;
++		regulator-boot-on;
++		regulator-always-on;
++		regulator-settling-time-us = <5000>;
++		gpios = <&expgpio 4 GPIO_ACTIVE_HIGH>;
++		states = <1800000 0x1>,
++			 <3300000 0x0>;
++		status = "okay";
++	};
++
++	sd_vcc_reg: sd_vcc_reg {
++		compatible = "regulator-fixed";
++		regulator-name = "vcc-sd";
++		regulator-min-microvolt = <3300000>;
++		regulator-max-microvolt = <3300000>;
++		regulator-boot-on;
++		enable-active-high;
++		gpio = <&expgpio 6 GPIO_ACTIVE_HIGH>;
+ 	};
+ };
+ 
++&bt {
++	shutdown-gpios = <&expgpio 0 GPIO_ACTIVE_HIGH>;
++};
++
++&ddc0 {
++	status = "okay";
++};
++
++&ddc1 {
++	status = "okay";
++};
++
+ &expgpio {
+ 	gpio-line-names = "BT_ON",
+ 			  "WL_ON",
+@@ -36,10 +81,481 @@ &expgpio {
+ 			  "SHUTDOWN_REQUEST";
+ };
+ 
++&gpio {
++	/*
++	 * Parts taken from rpi_SCH_4b_4p0_reduced.pdf and
++	 * the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "SDA1",
++			  "SCL1",
++			  "GPIO_GCLK",
++			  "GPIO5",
++			  "GPIO6",
++			  "SPI_CE1_N",
++			  "SPI_CE0_N",
++			  "SPI_MISO",
++			  "SPI_MOSI",
++			  "SPI_SCLK",
++			  "GPIO12",
++			  "GPIO13",
++			  /* Serial port */
++			  "TXD1",
++			  "RXD1",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "RGMII_MDIO",
++			  "RGMIO_MDC",
++			  /* Used by BT module */
++			  "CTS0",
++			  "RTS0",
++			  "TXD0",
++			  "RXD0",
++			  /* Used by Wifi */
++			  "SD1_CLK",
++			  "SD1_CMD",
++			  "SD1_DATA0",
++			  "SD1_DATA1",
++			  "SD1_DATA2",
++			  "SD1_DATA3",
++			  /* Shared with SPI flash */
++			  "PWM0_MISO",
++			  "PWM1_MOSI",
++			  "STATUS_LED_G_CLK",
++			  "SPIFLASH_CE_N",
++			  "SDA0",
++			  "SCL0",
++			  "RGMII_RXCLK",
++			  "RGMII_RXCTL",
++			  "RGMII_RXD0",
++			  "RGMII_RXD1",
++			  "RGMII_RXD2",
++			  "RGMII_RXD3",
++			  "RGMII_TXCLK",
++			  "RGMII_TXCTL",
++			  "RGMII_TXD0",
++			  "RGMII_TXD1",
++			  "RGMII_TXD2",
++			  "RGMII_TXD3";
++};
++
++&hdmi0 {
++	status = "okay";
++};
++
++&hdmi1 {
++	status = "okay";
++};
++
++&pixelvalve0 {
++	status = "okay";
++};
++
++&pixelvalve1 {
++	status = "okay";
++};
++
++&pixelvalve2 {
++	status = "okay";
++};
++
++&pixelvalve4 {
++	status = "okay";
++};
++
++&pwm1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pwm1_0_gpio40 &pwm1_1_gpio41>;
++	status = "okay";
++};
++
++/* EMMC2 is used to drive the SD card */
++&emmc2 {
++	vqmmc-supply = <&sd_io_1v8_reg>;
++	vmmc-supply = <&sd_vcc_reg>;
++	broken-cd;
++	status = "okay";
++};
++
++&genet {
++	phy-handle = <&phy1>;
++	phy-mode = "rgmii-rxid";
++	status = "okay";
++};
++
++&genet_mdio {
++	phy1: ethernet-phy@1 {
++		/* No PHY interrupt */
++		reg = <0x1>;
++	};
++};
++
++&pcie0 {
++	pci@0,0 {
++		device_type = "pci";
++		#address-cells = <3>;
++		#size-cells = <2>;
++		ranges;
++
++		reg = <0 0 0 0 0>;
++
++		usb@0,0 {
++			reg = <0 0 0 0 0>;
++			resets = <&reset RASPBERRYPI_FIRMWARE_RESET_ID_USB>;
++		};
++	};
++};
++
++/* uart0 communicates with the BT module */
++&uart0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart0_ctsrts_gpio30 &uart0_gpio32>;
++	uart-has-rtscts;
++};
++
++/* uart1 is mapped to the pin header */
++&uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart1_gpio14>;
++	status = "okay";
++};
++
++&vc4 {
++	status = "okay";
++};
++
++&vec {
++	status = "disabled";
++};
++
++&wifi_pwrseq {
++	reset-gpios = <&expgpio 1 GPIO_ACTIVE_LOW>;
++};
++
++// =============================================
++// Downstream rpi- changes
++
++#include "bcm271x-rpi-bt.dtsi"
++
++/ {
++	soc {
++		/delete-node/ pixelvalve@7e807000;
++		/delete-node/ hdmi@7e902000;
++	};
++};
++
++#include "bcm2711-rpi-ds.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_44.dtsi"
++
++/ {
++	chosen {
++		bootargs = "coherent_pool=1M 8250.nr_uarts=1 snd_bcm2835.enable_headphones=0";
++	};
++
++	aliases {
++		serial0 = &uart1;
++		serial1 = &uart0;
++		mmc0 = &emmc2;
++		mmc1 = &mmcnr;
++		mmc2 = &sdhost;
++		i2c3 = &i2c3;
++		i2c4 = &i2c4;
++		i2c5 = &i2c5;
++		i2c6 = &i2c6;
++		i2c20 = &ddc0;
++		i2c21 = &ddc1;
++		spi3 = &spi3;
++		spi4 = &spi4;
++		spi5 = &spi5;
++		spi6 = &spi6;
++		/delete-property/ intc;
++	};
++
++	/delete-node/ wifi-pwrseq;
++};
++
++&mmcnr {
++	pinctrl-names = "default";
++	pinctrl-0 = <&sdio_pins>;
++	bus-width = <4>;
++	status = "okay";
++};
++
++&uart0 {
++	pinctrl-0 = <&uart0_pins &bt_pins>;
++	status = "okay";
++};
++
++&uart1 {
++	pinctrl-0 = <&uart1_pins>;
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&gpio {
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi3_pins: spi3_pins {
++		brcm,pins = <1 2 3>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi3_cs_pins: spi3_cs_pins {
++		brcm,pins = <0 24>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi4_pins: spi4_pins {
++		brcm,pins = <5 6 7>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi4_cs_pins: spi4_cs_pins {
++		brcm,pins = <4 25>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi5_pins: spi5_pins {
++		brcm,pins = <13 14 15>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi5_cs_pins: spi5_cs_pins {
++		brcm,pins = <12 26>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi6_pins: spi6_pins {
++		brcm,pins = <19 20 21>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi6_cs_pins: spi6_cs_pins {
++		brcm,pins = <18 27>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c3_pins: i2c3 {
++		brcm,pins = <4 5>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c4_pins: i2c4 {
++		brcm,pins = <8 9>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c5_pins: i2c5 {
++		brcm,pins = <12 13>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c6_pins: i2c6 {
++		brcm,pins = <22 23>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++	};
++
++	sdio_pins: sdio_pins {
++		brcm,pins =     <34 35 36 37 38 39>;
++		brcm,function = <BCM2835_FSEL_ALT3>; // alt3 = SD1
++		brcm,pull =     <0 2 2 2 2 2>;
++	};
++
++	bt_pins: bt_pins {
++		brcm,pins = "-"; // non-empty to keep btuart happy, //4 = 0
++				 // to fool pinctrl
++		brcm,function = <0>;
++		brcm,pull = <2>;
++	};
++
++	uart0_pins: uart0_pins {
++		brcm,pins = <32 33>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++		brcm,pull = <0 2>;
++	};
++
++	uart1_pins: uart1_pins {
++		brcm,pins;
++		brcm,function;
++		brcm,pull;
++	};
++
++	uart2_pins: uart2_pins {
++		brcm,pins = <0 1>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++
++	uart3_pins: uart3_pins {
++		brcm,pins = <4 5>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++
++	uart4_pins: uart4_pins {
++		brcm,pins = <8 9>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++
++	uart5_pins: uart5_pins {
++		brcm,pins = <12 13>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++// =============================================
++// Board specific stuff here
++
++/ {
++	power_ctrl: power_ctrl {
++		compatible = "gpio-poweroff";
++		gpios = <&expgpio 5 0>;
++		force;
++	};
++};
++
++&sdhost {
++	status = "disabled";
++};
++
++&phy1 {
++	led-modes = <0x00 0x08>; /* link/activity link */
++};
++
++&gpio {
++	audio_pins: audio_pins {
++		brcm,pins = <>;
++		brcm,function = <>;
++	};
++};
++
++&leds {
++	act_led: led-act {
++		label = "led0";
++		linux,default-trigger = "default-on";
++		default-state = "on";
++		gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
++	};
++
++	pwr_led: led-pwr {
++		label = "led1";
++		linux,default-trigger = "default-on";
++		gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
++	};
++};
++
++&pwm1 {
++	status = "disabled";
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
+ &genet_mdio {
+ 	clock-frequency = <1950000>;
+ };
+ 
+-&pm {
+-	/delete-property/ system-power-controller;
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&act_led>,"gpios:4";
++		act_led_activelow = <&act_led>,"gpios:8";
++		act_led_trigger = <&act_led>,"linux,default-trigger";
++
++		pwr_led_gpio = <&pwr_led>,"gpios:4";
++		pwr_led_activelow = <&pwr_led>,"gpios:8";
++		pwr_led_trigger = <&pwr_led>,"linux,default-trigger";
++
++		eth_led0 = <&phy1>,"led-modes:0";
++		eth_led1 = <&phy1>,"led-modes:4";
++
++		sd_poll_once = <&emmc2>, "non-removable?";
++		spi_dma4 = <&spi0>, "dmas:0=", <&dma40>,
++			   <&spi0>, "dmas:8=", <&dma40>;
++	};
+ };
+diff --git a/arch/arm/boot/dts/bcm2711-rpi-cm4.dts b/arch/arm/boot/dts/bcm2711-rpi-cm4.dts
+new file mode 100644
+index 000000000000..5510a1b731c1
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2711-rpi-cm4.dts
+@@ -0,0 +1,578 @@
++// SPDX-License-Identifier: GPL-2.0
++/dts-v1/;
++#define BCM2711
++#define i2c0 i2c0if
++#include "bcm2711.dtsi"
++#include "bcm283x-rpi-wifi-bt.dtsi"
++#undef i2c0
++#include "bcm270x.dtsi"
++#define i2c0 i2c0mux
++#include "bcm2711-rpi.dtsi"
++#undef i2c0
++//#include "bcm283x-rpi-usb-peripheral.dtsi"
++
++/ {
++	compatible = "raspberrypi,4-compute-module", "brcm,bcm2711";
++	model = "Raspberry Pi Compute Module 4";
++
++	chosen {
++		/* 8250 auxiliary UART instead of pl011 */
++		stdout-path = "serial1:115200n8";
++	};
++
++	leds {
++		led-act {
++			gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
++		};
++
++		led-pwr {
++			label = "PWR";
++			gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
++			default-state = "keep";
++			linux,default-trigger = "default-on";
++		};
++	};
++
++	sd_io_1v8_reg: sd_io_1v8_reg {
++		compatible = "regulator-gpio";
++		regulator-name = "vdd-sd-io";
++		regulator-min-microvolt = <1800000>;
++		regulator-max-microvolt = <3300000>;
++		regulator-boot-on;
++		regulator-always-on;
++		regulator-settling-time-us = <5000>;
++		gpios = <&expgpio 4 GPIO_ACTIVE_HIGH>;
++		states = <1800000 0x1>,
++			 <3300000 0x0>;
++		status = "okay";
++	};
++
++	sd_vcc_reg: sd_vcc_reg {
++		compatible = "regulator-fixed";
++		regulator-name = "vcc-sd";
++		regulator-min-microvolt = <3300000>;
++		regulator-max-microvolt = <3300000>;
++		regulator-boot-on;
++		enable-active-high;
++		gpio = <&expgpio 6 GPIO_ACTIVE_HIGH>;
++	};
++};
++
++&bt {
++	shutdown-gpios = <&expgpio 0 GPIO_ACTIVE_HIGH>;
++};
++
++&ddc0 {
++	status = "okay";
++};
++
++&ddc1 {
++	status = "okay";
++};
++
++&expgpio {
++	gpio-line-names = "BT_ON",
++			  "WL_ON",
++			  "PWR_LED_OFF",
++			  "ANT1",
++			  "VDD_SD_IO_SEL",
++			  "CAM_GPIO",
++			  "SD_PWR_ON",
++			  "ANT2";
++
++	ant1: ant1 {
++		gpio-hog;
++		gpios = <3 GPIO_ACTIVE_HIGH>;
++		output-high;
++	};
++
++	ant2: ant2 {
++		gpio-hog;
++		gpios = <7 GPIO_ACTIVE_HIGH>;
++		output-low;
++	};
++};
++
++&gpio {
++	/*
++	 * Parts taken from rpi_SCH_4b_4p0_reduced.pdf and
++	 * the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "SDA1",
++			  "SCL1",
++			  "GPIO_GCLK",
++			  "GPIO5",
++			  "GPIO6",
++			  "SPI_CE1_N",
++			  "SPI_CE0_N",
++			  "SPI_MISO",
++			  "SPI_MOSI",
++			  "SPI_SCLK",
++			  "GPIO12",
++			  "GPIO13",
++			  /* Serial port */
++			  "TXD1",
++			  "RXD1",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "RGMII_MDIO",
++			  "RGMIO_MDC",
++			  /* Used by BT module */
++			  "CTS0",
++			  "RTS0",
++			  "TXD0",
++			  "RXD0",
++			  /* Used by Wifi */
++			  "SD1_CLK",
++			  "SD1_CMD",
++			  "SD1_DATA0",
++			  "SD1_DATA1",
++			  "SD1_DATA2",
++			  "SD1_DATA3",
++			  /* Shared with SPI flash */
++			  "PWM0_MISO",
++			  "PWM1_MOSI",
++			  "STATUS_LED_G_CLK",
++			  "SPIFLASH_CE_N",
++			  "SDA0",
++			  "SCL0",
++			  "RGMII_RXCLK",
++			  "RGMII_RXCTL",
++			  "RGMII_RXD0",
++			  "RGMII_RXD1",
++			  "RGMII_RXD2",
++			  "RGMII_RXD3",
++			  "RGMII_TXCLK",
++			  "RGMII_TXCTL",
++			  "RGMII_TXD0",
++			  "RGMII_TXD1",
++			  "RGMII_TXD2",
++			  "RGMII_TXD3";
++};
++
++&hdmi0 {
++	status = "okay";
++};
++
++&hdmi1 {
++	status = "okay";
++};
++
++&pixelvalve0 {
++	status = "okay";
++};
++
++&pixelvalve1 {
++	status = "okay";
++};
++
++&pixelvalve2 {
++	status = "okay";
++};
++
++&pixelvalve4 {
++	status = "okay";
++};
++
++&pwm1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pwm1_0_gpio40 &pwm1_1_gpio41>;
++	status = "okay";
++};
++
++/* EMMC2 is used to drive the EMMC card */
++&emmc2 {
++	bus-width = <8>;
++	vqmmc-supply = <&sd_io_1v8_reg>;
++	vmmc-supply = <&sd_vcc_reg>;
++	broken-cd;
++	status = "okay";
++};
++
++&genet {
++	phy-handle = <&phy1>;
++	phy-mode = "rgmii-rxid";
++	status = "okay";
++};
++
++&genet_mdio {
++	phy1: ethernet-phy@0 {
++		/* No PHY interrupt */
++		reg = <0x0>;
++	};
++};
++
++&pcie0 {
++	pci@0,0 {
++		device_type = "pci";
++		#address-cells = <3>;
++		#size-cells = <2>;
++		ranges;
++
++		reg = <0 0 0 0 0>;
++	};
++};
++
++/* uart0 communicates with the BT module */
++&uart0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart0_ctsrts_gpio30 &uart0_gpio32>;
++	uart-has-rtscts;
++};
++
++/* uart1 is mapped to the pin header */
++&uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart1_gpio14>;
++	status = "okay";
++};
++
++&vc4 {
++	status = "okay";
++};
++
++&vec {
++	status = "disabled";
++};
++
++&wifi_pwrseq {
++	reset-gpios = <&expgpio 1 GPIO_ACTIVE_LOW>;
++};
++
++// =============================================
++// Downstream rpi- changes
++
++#include "bcm271x-rpi-bt.dtsi"
++
++/ {
++	soc {
++		/delete-node/ pixelvalve@7e807000;
++		/delete-node/ hdmi@7e902000;
++	};
++};
++
++#include "bcm2711-rpi-ds.dtsi"
++#include "bcm283x-rpi-csi0-2lane.dtsi"
++#include "bcm283x-rpi-csi1-4lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_44.dtsi"
++
++/ {
++	chosen {
++		bootargs = "coherent_pool=1M 8250.nr_uarts=1 snd_bcm2835.enable_headphones=0";
++	};
++
++	aliases {
++		serial0 = &uart1;
++		serial1 = &uart0;
++		mmc0 = &emmc2;
++		mmc1 = &mmcnr;
++		mmc2 = &sdhost;
++		i2c3 = &i2c3;
++		i2c4 = &i2c4;
++		i2c5 = &i2c5;
++		i2c6 = &i2c6;
++		i2c20 = &ddc0;
++		i2c21 = &ddc1;
++		spi3 = &spi3;
++		spi4 = &spi4;
++		spi5 = &spi5;
++		spi6 = &spi6;
++		/delete-property/ intc;
++	};
++
++	/delete-node/ wifi-pwrseq;
++};
++
++&mmcnr {
++	pinctrl-names = "default";
++	pinctrl-0 = <&sdio_pins>;
++	bus-width = <4>;
++	status = "okay";
++};
++
++&uart0 {
++	pinctrl-0 = <&uart0_pins &bt_pins>;
++	status = "okay";
++};
++
++&uart1 {
++	pinctrl-0 = <&uart1_pins>;
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&gpio {
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi3_pins: spi3_pins {
++		brcm,pins = <1 2 3>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi3_cs_pins: spi3_cs_pins {
++		brcm,pins = <0 24>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi4_pins: spi4_pins {
++		brcm,pins = <5 6 7>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi4_cs_pins: spi4_cs_pins {
++		brcm,pins = <4 25>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi5_pins: spi5_pins {
++		brcm,pins = <13 14 15>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi5_cs_pins: spi5_cs_pins {
++		brcm,pins = <12 26>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi6_pins: spi6_pins {
++		brcm,pins = <19 20 21>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi6_cs_pins: spi6_cs_pins {
++		brcm,pins = <18 27>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c3_pins: i2c3 {
++		brcm,pins = <4 5>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c4_pins: i2c4 {
++		brcm,pins = <8 9>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c5_pins: i2c5 {
++		brcm,pins = <12 13>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c6_pins: i2c6 {
++		brcm,pins = <22 23>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++	};
++
++	sdio_pins: sdio_pins {
++		brcm,pins =     <34 35 36 37 38 39>;
++		brcm,function = <BCM2835_FSEL_ALT3>; // alt3 = SD1
++		brcm,pull =     <0 2 2 2 2 2>;
++	};
++
++	bt_pins: bt_pins {
++		brcm,pins = "-"; // non-empty to keep btuart happy, //4 = 0
++				 // to fool pinctrl
++		brcm,function = <0>;
++		brcm,pull = <2>;
++	};
++
++	uart0_pins: uart0_pins {
++		brcm,pins = <32 33>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++		brcm,pull = <0 2>;
++	};
++
++	uart1_pins: uart1_pins {
++		brcm,pins;
++		brcm,function;
++		brcm,pull;
++	};
++
++	uart2_pins: uart2_pins {
++		brcm,pins = <0 1>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++
++	uart3_pins: uart3_pins {
++		brcm,pins = <4 5>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++
++	uart4_pins: uart4_pins {
++		brcm,pins = <8 9>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++
++	uart5_pins: uart5_pins {
++		brcm,pins = <12 13>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++// =============================================
++// Board specific stuff here
++
++&pcie0 {
++       brcm,enable-l1ss;
++};
++
++&sdhost {
++	status = "disabled";
++};
++
++&phy1 {
++	led-modes = <0x00 0x08>; /* link/activity link */
++};
++
++&gpio {
++	audio_pins: audio_pins {
++		brcm,pins = <>;
++		brcm,function = <>;
++	};
++};
++
++&leds {
++	act_led: led-act {
++		label = "led0";
++		linux,default-trigger = "mmc0";
++		gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
++	};
++
++	pwr_led: led-pwr {
++		label = "led1";
++		linux,default-trigger = "default-on";
++		gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
++	};
++};
++
++&pwm1 {
++	status = "disabled";
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++cam0_reg: &cam1_reg {
++	gpio = <&expgpio 5 GPIO_ACTIVE_HIGH>;
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&act_led>,"gpios:4";
++		act_led_activelow = <&act_led>,"gpios:8";
++		act_led_trigger = <&act_led>,"linux,default-trigger";
++
++		pwr_led_gpio = <&pwr_led>,"gpios:4";
++		pwr_led_activelow = <&pwr_led>,"gpios:8";
++		pwr_led_trigger = <&pwr_led>,"linux,default-trigger";
++
++		eth_led0 = <&phy1>,"led-modes:0";
++		eth_led1 = <&phy1>,"led-modes:4";
++
++		ant1 =  <&ant1>,"output-high?=on",
++			<&ant1>, "output-low?=off",
++			<&ant2>, "output-high?=off",
++			<&ant2>, "output-low?=on";
++		ant2 =  <&ant1>,"output-high?=off",
++			<&ant1>, "output-low?=on",
++			<&ant2>, "output-high?=on",
++			<&ant2>, "output-low?=off";
++		noant = <&ant1>,"output-high?=off",
++			<&ant1>, "output-low?=on",
++			<&ant2>, "output-high?=off",
++			<&ant2>, "output-low?=on";
++
++		sd_poll_once = <&emmc2>, "non-removable?";
++		spi_dma4 = <&spi0>, "dmas:0=", <&dma40>,
++			   <&spi0>, "dmas:8=", <&dma40>;
++	};
++};
+diff --git a/arch/arm/boot/dts/bcm2711-rpi-cm4s.dts b/arch/arm/boot/dts/bcm2711-rpi-cm4s.dts
+new file mode 100644
+index 000000000000..1a1d7af1d148
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2711-rpi-cm4s.dts
+@@ -0,0 +1,427 @@
++// SPDX-License-Identifier: GPL-2.0
++/dts-v1/;
++#define BCM2711
++#define i2c0 i2c0if
++#include "bcm2711.dtsi"
++//#include "bcm283x-rpi-wifi-bt.dtsi"
++#undef i2c0
++#include "bcm270x.dtsi"
++#define i2c0 i2c0mux
++#include "bcm2711-rpi.dtsi"
++#undef i2c0
++
++/ {
++	compatible = "raspberrypi,4-compute-module-s", "brcm,bcm2711";
++	model = "Raspberry Pi Compute Module 4S";
++
++	leds {
++		led-act {
++			gpios = <&virtgpio 0 0>;
++		};
++	};
++};
++
++&ddc0 {
++	status = "okay";
++};
++
++&gpio {
++	/*
++	 * Parts taken from rpi_SCH_4b_4p0_reduced.pdf and
++	 * the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "SDA1",
++			  "SCL1",
++			  "GPIO_GCLK",
++			  "GPIO5",
++			  "GPIO6",
++			  "SPI_CE1_N",
++			  "SPI_CE0_N",
++			  "SPI_MISO",
++			  "SPI_MOSI",
++			  "SPI_SCLK",
++			  "GPIO12",
++			  "GPIO13",
++			  /* Serial port */
++			  "TXD1",
++			  "RXD1",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "GPIO28",
++			  "GPIO29",
++			  "GPIO30",
++			  "GPIO31",
++			  "GPIO32",
++			  "GPIO33",
++			  "GPIO34",
++			  "GPIO35",
++			  "GPIO36",
++			  "GPIO37",
++			  "GPIO38",
++			  "GPIO39",
++			  "PWM0_MISO",
++			  "PWM1_MOSI",
++			  "GPIO42",
++			  "GPIO43",
++			  "GPIO44",
++			  "GPIO45";
++};
++
++&hdmi0 {
++	status = "okay";
++};
++
++&pixelvalve0 {
++	status = "okay";
++};
++
++&pixelvalve1 {
++	status = "okay";
++};
++
++&pixelvalve2 {
++	status = "okay";
++};
++
++&pixelvalve4 {
++	status = "okay";
++};
++
++&pwm1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pwm1_0_gpio40 &pwm1_1_gpio41>;
++	status = "okay";
++};
++
++/* EMMC2 is used to drive the EMMC card */
++&emmc2 {
++	bus-width = <8>;
++	broken-cd;
++	status = "okay";
++};
++
++&pcie0 {
++	status = "disabled";
++};
++
++&vchiq {
++	interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
++};
++
++&vc4 {
++	status = "okay";
++};
++
++&vec {
++	status = "disabled";
++};
++
++// =============================================
++// Downstream rpi- changes
++
++#include "bcm2711-rpi-ds.dtsi"
++
++/ {
++	soc {
++		/delete-node/ pixelvalve@7e807000;
++		/delete-node/ hdmi@7e902000;
++
++		virtgpio: virtgpio {
++			compatible = "brcm,bcm2835-virtgpio";
++			gpio-controller;
++			#gpio-cells = <2>;
++			firmware = <&firmware>;
++			status = "okay";
++		};
++	};
++};
++
++#include "bcm283x-rpi-csi0-2lane.dtsi"
++#include "bcm283x-rpi-csi1-4lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_28.dtsi"
++
++/ {
++	chosen {
++		bootargs = "coherent_pool=1M snd_bcm2835.enable_headphones=0";
++	};
++
++	aliases {
++		serial0 = &uart0;
++		mmc0 = &emmc2;
++		mmc1 = &mmcnr;
++		mmc2 = &sdhost;
++		i2c3 = &i2c3;
++		i2c4 = &i2c4;
++		i2c5 = &i2c5;
++		i2c6 = &i2c6;
++		spi3 = &spi3;
++		spi4 = &spi4;
++		spi5 = &spi5;
++		spi6 = &spi6;
++		/delete-property/ intc;
++	};
++
++	/delete-node/ wifi-pwrseq;
++};
++
++&uart0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart0_pins>;
++	status = "okay";
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&gpio {
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi3_pins: spi3_pins {
++		brcm,pins = <1 2 3>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi3_cs_pins: spi3_cs_pins {
++		brcm,pins = <0 24>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi4_pins: spi4_pins {
++		brcm,pins = <5 6 7>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi4_cs_pins: spi4_cs_pins {
++		brcm,pins = <4 25>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi5_pins: spi5_pins {
++		brcm,pins = <13 14 15>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi5_cs_pins: spi5_cs_pins {
++		brcm,pins = <12 26>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi6_pins: spi6_pins {
++		brcm,pins = <19 20 21>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi6_cs_pins: spi6_cs_pins {
++		brcm,pins = <18 27>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c3_pins: i2c3 {
++		brcm,pins = <4 5>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c4_pins: i2c4 {
++		brcm,pins = <8 9>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c5_pins: i2c5 {
++		brcm,pins = <12 13>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c6_pins: i2c6 {
++		brcm,pins = <22 23>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++	};
++
++	sdio_pins: sdio_pins {
++		brcm,pins =     <34 35 36 37 38 39>;
++		brcm,function = <BCM2835_FSEL_ALT3>; // alt3 = SD1
++		brcm,pull =     <0 2 2 2 2 2>;
++	};
++
++	uart0_pins: uart0_pins {
++		brcm,pins;
++		brcm,function;
++		brcm,pull;
++	};
++
++	uart2_pins: uart2_pins {
++		brcm,pins = <0 1>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++
++	uart3_pins: uart3_pins {
++		brcm,pins = <4 5>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++
++	uart4_pins: uart4_pins {
++		brcm,pins = <8 9>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++
++	uart5_pins: uart5_pins {
++		brcm,pins = <12 13>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++// =============================================
++// Board specific stuff here
++
++/* Enable USB in OTG-aware mode */
++&usb {
++	compatible = "brcm,bcm2835-usb";
++	dr_mode = "otg";
++	g-np-tx-fifo-size = <32>;
++	g-rx-fifo-size = <558>;
++	g-tx-fifo-size = <512 512 512 512 512 256 256>;
++	status = "okay";
++};
++
++&sdhost {
++	status = "disabled";
++};
++
++&gpio {
++	audio_pins: audio_pins {
++		brcm,pins = <>;
++		brcm,function = <>;
++	};
++};
++
++/* Permanently disable HDMI1 */
++&hdmi1 {
++	compatible = "disabled";
++};
++
++/* Permanently disable DDC1 */
++&ddc1 {
++	compatible = "disabled";
++};
++
++&leds {
++	act_led: led-act {
++		label = "led0";
++		linux,default-trigger = "mmc0";
++	};
++};
++
++&pwm1 {
++	status = "disabled";
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&cam1_reg {
++	gpio = <&gpio 2 GPIO_ACTIVE_HIGH>;
++	status = "disabled";
++};
++
++cam0_reg: &cam0_regulator {
++	gpio = <&gpio 30 GPIO_ACTIVE_HIGH>;
++	status = "disabled";
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&act_led>,"gpios:4";
++		act_led_activelow = <&act_led>,"gpios:8";
++		act_led_trigger = <&act_led>,"linux,default-trigger";
++
++		sd_poll_once = <&emmc2>, "non-removable?";
++		spi_dma4 = <&spi0>, "dmas:0=", <&dma40>,
++			   <&spi0>, "dmas:8=", <&dma40>;
++	};
++};
+diff --git a/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi b/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
+new file mode 100644
+index 000000000000..5f9a5bad98ad
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
+@@ -0,0 +1,292 @@
++// SPDX-License-Identifier: GPL-2.0
++#include "bcm270x-rpi.dtsi"
++
++/ {
++	__overrides__ {
++		arm_freq;
++		hdmi = <&hdmi0>,"status",
++		       <&hdmi1>,"status";
++		pcie = <&pcie0>,"status";
++		sd = <&emmc2>,"status";
++	};
++
++	scb: scb {
++	     /* Add a label */
++	};
++
++	arm-pmu {
++		compatible = "arm,cortex-a72-pmu", "arm,armv8-pmuv3", "arm,cortex-a7-pmu";
++
++	};
++
++	chosen {
++		/delete-property/ stdout-path;
++	};
++};
++
++&vc4 {
++	raspberrypi,firmware = <&firmware>;
++};
++
++&cma {
++	/* Limit cma to the lower 768MB to allow room for HIGHMEM on 32-bit */
++	alloc-ranges = <0x0 0x00000000 0x30000000>;
++};
++
++&scb {
++	#size-cells = <2>;
++
++	ranges = <0x0 0x7c000000  0x0 0xfc000000  0x0 0x03800000>,
++		 <0x0 0x40000000  0x0 0xff800000  0x0 0x00800000>,
++		 <0x6 0x00000000  0x6 0x00000000  0x0 0x40000000>,
++		 <0x0 0x00000000  0x0 0x00000000  0x0 0xfc000000>;
++	dma-ranges = <0x0 0x00000000  0x0 0x00000000  0x4 0x00000000>;
++
++	dma40: dma@7e007b00 {
++		compatible = "brcm,bcm2711-dma";
++		reg = <0x0 0x7e007b00  0x0 0x400>;
++		interrupts =
++			<GIC_SPI 89 IRQ_TYPE_LEVEL_HIGH>, /* dma4 11 */
++			<GIC_SPI 90 IRQ_TYPE_LEVEL_HIGH>, /* dma4 12 */
++			<GIC_SPI 91 IRQ_TYPE_LEVEL_HIGH>, /* dma4 13 */
++			<GIC_SPI 92 IRQ_TYPE_LEVEL_HIGH>; /* dma4 14 */
++		interrupt-names = "dma11",
++			"dma12",
++			"dma13",
++			"dma14";
++		#dma-cells = <1>;
++		brcm,dma-channel-mask = <0x7800>;
++	};
++
++	xhci: xhci@7e9c0000 {
++		compatible = "generic-xhci";
++		status = "disabled";
++		reg = <0x0 0x7e9c0000  0x0 0x100000>;
++		interrupts = <GIC_SPI 176 IRQ_TYPE_LEVEL_HIGH>;
++		power-domains = <&power RPI_POWER_DOMAIN_USB>;
++	};
++
++	codec@7eb10000 {
++		compatible = "raspberrypi,rpivid-vid-decoder";
++		reg = <0x0 0x7eb10000  0x0 0x1000>,  /* INTC */
++		      <0x0 0x7eb00000  0x0 0x10000>; /* HEVC */
++		reg-names = "intc",
++			    "hevc";
++		interrupts = <GIC_SPI 98 IRQ_TYPE_LEVEL_HIGH>;
++
++		clocks = <&firmware_clocks 11>;
++		clock-names = "hevc";
++	};
++};
++
++&pcie0 {
++	reg = <0x0 0x7d500000  0x0 0x9310>;
++	ranges = <0x02000000 0x0 0xc0000000 0x6 0x00000000
++		  0x0 0x40000000>;
++};
++
++&genet {
++	reg = <0x0 0x7d580000  0x0 0x10000>;
++};
++
++&dma40 {
++	/* The VPU firmware uses DMA channel 11 for VCHIQ */
++	brcm,dma-channel-mask = <0x7000>;
++};
++
++&vchiq {
++	compatible = "brcm,bcm2711-vchiq";
++};
++
++&firmwarekms {
++	compatible = "raspberrypi,rpi-firmware-kms-2711";
++	interrupts = <GIC_SPI 112 IRQ_TYPE_LEVEL_HIGH>;
++};
++
++&smi {
++	interrupts = <GIC_SPI 112 IRQ_TYPE_LEVEL_HIGH>;
++};
++
++&mmc {
++	interrupts = <GIC_SPI 126 IRQ_TYPE_LEVEL_HIGH>;
++};
++
++&mmcnr {
++	interrupts = <GIC_SPI 126 IRQ_TYPE_LEVEL_HIGH>;
++};
++
++&csi0 {
++	interrupts = <GIC_SPI 102 IRQ_TYPE_LEVEL_HIGH>;
++};
++
++&csi1 {
++	interrupts = <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>;
++};
++
++&random {
++	compatible = "brcm,bcm2711-rng200";
++	status = "okay";
++};
++
++&usb {
++	/* Enable the FIQ support */
++	reg = <0x7e980000 0x10000>,
++	      <0x7e00b200 0x200>;
++	interrupts = <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>,
++		     <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>;
++	status = "disabled";
++};
++
++&gpio {
++	interrupts = <GIC_SPI 113 IRQ_TYPE_LEVEL_HIGH>,
++		     <GIC_SPI 114 IRQ_TYPE_LEVEL_HIGH>;
++};
++
++&emmc2 {
++	mmc-ddr-3_3v;
++};
++
++&vc4 {
++	status = "disabled";
++};
++
++&pixelvalve0 {
++	status = "disabled";
++};
++
++&pixelvalve1 {
++	status = "disabled";
++};
++
++&pixelvalve2 {
++	status = "disabled";
++};
++
++&pixelvalve3 {
++	status = "disabled";
++};
++
++&pixelvalve4 {
++	status = "disabled";
++};
++
++&hdmi0 {
++	reg = <0x7ef00700 0x300>,
++	      <0x7ef00300 0x200>,
++	      <0x7ef00f00 0x80>,
++	      <0x7ef00f80 0x80>,
++	      <0x7ef01b00 0x200>,
++	      <0x7ef01f00 0x400>,
++	      <0x7ef00200 0x80>,
++	      <0x7ef04300 0x100>,
++	      <0x7ef20000 0x100>,
++	      <0x7ef00100 0x30>;
++	reg-names = "hdmi",
++		    "dvp",
++		    "phy",
++		    "rm",
++		    "packet",
++		    "metadata",
++		    "csc",
++		    "cec",
++		    "hd",
++		    "intr2";
++	clocks = <&firmware_clocks 13>,
++		 <&firmware_clocks 14>,
++		 <&dvp 0>,
++		 <&clk_27MHz>;
++	dmas = <&dma (10|(1<<27)|(1<<24)|(10<<16)|(15<<20))>;
++	status = "disabled";
++};
++
++&ddc0 {
++	status = "disabled";
++};
++
++&hdmi1 {
++	reg = <0x7ef05700 0x300>,
++	      <0x7ef05300 0x200>,
++	      <0x7ef05f00 0x80>,
++	      <0x7ef05f80 0x80>,
++	      <0x7ef06b00 0x200>,
++	      <0x7ef06f00 0x400>,
++	      <0x7ef00280 0x80>,
++	      <0x7ef09300 0x100>,
++	      <0x7ef20000 0x100>,
++	      <0x7ef00100 0x30>;
++	reg-names = "hdmi",
++		    "dvp",
++		    "phy",
++		    "rm",
++		    "packet",
++		    "metadata",
++		    "csc",
++		    "cec",
++		    "hd",
++		    "intr2";
++	clocks = <&firmware_clocks 13>,
++		 <&firmware_clocks 14>,
++		 <&dvp 1>,
++		 <&clk_27MHz>;
++	dmas = <&dma (17|(1<<27)|(1<<24)|(10<<16)|(15<<20))>;
++	status = "disabled";
++};
++
++&ddc1 {
++	status = "disabled";
++};
++
++&dvp {
++	status = "disabled";
++};
++
++&vec {
++	clocks = <&firmware_clocks 15>;
++};
++
++&aon_intr {
++	interrupts = <GIC_SPI 96 IRQ_TYPE_EDGE_RISING>;
++	status = "disabled";
++};
++
++&system_timer {
++	status = "disabled";
++};
++
++&i2c0 {
++      /delete-property/ compatible;
++      /delete-property/ interrupts;
++};
++
++&i2c0if {
++	compatible = "brcm,bcm2711-i2c", "brcm,bcm2835-i2c";
++	interrupts = <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>;
++};
++
++/delete-node/ &v3d;
++
++/ {
++	v3dbus: v3dbus {
++		compatible = "simple-bus";
++		#address-cells = <1>;
++		#size-cells = <2>;
++		ranges = <0x7c500000  0x0 0xfc500000  0x0 0x03300000>,
++			 <0x40000000  0x0 0xff800000  0x0 0x00800000>;
++		dma-ranges = <0x00000000  0x0 0x00000000  0x4 0x00000000>;
++
++		v3d: v3d@7ec04000 {
++			compatible = "brcm,2711-v3d";
++			reg =
++			    <0x7ec00000  0x0 0x4000>,
++			    <0x7ec04000  0x0 0x4000>;
++			reg-names = "hub", "core0";
++
++			power-domains = <&pm BCM2835_POWER_DOMAIN_GRAFX_V3D>;
++			resets = <&pm BCM2835_RESET_V3D>;
++			clocks = <&firmware_clocks 5>;
++			clocks-names = "v3d";
++			interrupts = <GIC_SPI 74 IRQ_TYPE_LEVEL_HIGH>;
++			status = "disabled";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/bcm2711-rpi.dtsi b/arch/arm/boot/dts/bcm2711-rpi.dtsi
+index 98817a6675b9..7b9e946db985 100644
+--- a/arch/arm/boot/dts/bcm2711-rpi.dtsi
++++ b/arch/arm/boot/dts/bcm2711-rpi.dtsi
+@@ -15,6 +15,7 @@ aliases {
+ 		ethernet0 = &genet;
+ 		pcie0 = &pcie0;
+ 		blconfig = &blconfig;
++		blpubkey = &blpubkey;
+ 	};
+ };
+ 
+@@ -67,6 +68,18 @@ blconfig: nvram@0 {
+ 		no-map;
+ 		status = "disabled";
+ 	};
++	/*
++	 * RPi4 will copy the binary public key blob (if present) from the bootloader
++	 * into memory for use by the OS.
++	 */
++	blpubkey: nvram@1 {
++		compatible = "raspberrypi,bootloader-public-key", "nvmem-rmem";
++		#address-cells = <1>;
++		#size-cells = <1>;
++		reg = <0x0 0x0 0x0>;
++		no-map;
++		status = "disabled";
++	};
+ };
+ 
+ &v3d {
+diff --git a/arch/arm/boot/dts/bcm271x-rpi-bt.dtsi b/arch/arm/boot/dts/bcm271x-rpi-bt.dtsi
+new file mode 100644
+index 000000000000..6b9b79f74cf3
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm271x-rpi-bt.dtsi
+@@ -0,0 +1,26 @@
++// SPDX-License-Identifier: GPL-2.0
++
++&uart0 {
++	bt: bluetooth {
++		compatible = "brcm,bcm43438-bt";
++		max-speed = <3000000>;
++		shutdown-gpios = <&expgpio 0 GPIO_ACTIVE_HIGH>;
++		status = "disabled";
++	};
++};
++
++&uart1 {
++	minibt: bluetooth {
++		compatible = "brcm,bcm43438-bt";
++		max-speed = <460800>;
++		shutdown-gpios = <&expgpio 0 GPIO_ACTIVE_HIGH>;
++		status = "disabled";
++	};
++};
++
++/ {
++	__overrides__ {
++		krnbt = <&bt>,"status";
++		krnbt_baudrate = <&bt>,"max-speed:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/bcm283x-rpi-csi0-2lane.dtsi b/arch/arm/boot/dts/bcm283x-rpi-csi0-2lane.dtsi
+new file mode 100644
+index 000000000000..6e4ce8622b47
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm283x-rpi-csi0-2lane.dtsi
+@@ -0,0 +1,4 @@
++// SPDX-License-Identifier: GPL-2.0-only
++&csi0 {
++	brcm,num-data-lanes = <2>;
++};
+diff --git a/arch/arm/boot/dts/bcm283x-rpi-csi1-2lane.dtsi b/arch/arm/boot/dts/bcm283x-rpi-csi1-2lane.dtsi
+new file mode 100644
+index 000000000000..6938f4daacdc
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm283x-rpi-csi1-2lane.dtsi
+@@ -0,0 +1,4 @@
++// SPDX-License-Identifier: GPL-2.0-only
++&csi1 {
++	brcm,num-data-lanes = <2>;
++};
+diff --git a/arch/arm/boot/dts/bcm283x-rpi-csi1-4lane.dtsi b/arch/arm/boot/dts/bcm283x-rpi-csi1-4lane.dtsi
+new file mode 100644
+index 000000000000..b37037437bee
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm283x-rpi-csi1-4lane.dtsi
+@@ -0,0 +1,4 @@
++// SPDX-License-Identifier: GPL-2.0-only
++&csi1 {
++	brcm,num-data-lanes = <4>;
++};
+diff --git a/arch/arm/boot/dts/bcm283x-rpi-i2c0mux_0_28.dtsi b/arch/arm/boot/dts/bcm283x-rpi-i2c0mux_0_28.dtsi
+new file mode 100644
+index 000000000000..38f0074bce3f
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm283x-rpi-i2c0mux_0_28.dtsi
+@@ -0,0 +1,4 @@
++&i2c0mux {
++	pinctrl-0 = <&i2c0_gpio0>;
++	pinctrl-1 = <&i2c0_gpio28>;
++};
+diff --git a/arch/arm/boot/dts/bcm283x-rpi-i2c0mux_0_44.dtsi b/arch/arm/boot/dts/bcm283x-rpi-i2c0mux_0_44.dtsi
+new file mode 100644
+index 000000000000..119946d878db
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm283x-rpi-i2c0mux_0_44.dtsi
+@@ -0,0 +1,4 @@
++&i2c0mux {
++	pinctrl-0 = <&i2c0_gpio0>;
++	pinctrl-1 = <&i2c0_gpio44>;
++};
+diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
+new file mode 100644
+index 000000000000..37254235b641
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -0,0 +1,287 @@
++# Overlays for the Raspberry Pi platform
++
++dtb-$(CONFIG_ARCH_BCM2835) += overlay_map.dtb
++
++dtbo-$(CONFIG_ARCH_BCM2835) += \
++	act-led.dtbo \
++	adafruit-st7735r.dtbo \
++	adafruit18.dtbo \
++	adau1977-adc.dtbo \
++	adau7002-simple.dtbo \
++	ads1015.dtbo \
++	ads1115.dtbo \
++	ads7846.dtbo \
++	adv7282m.dtbo \
++	adv728x-m.dtbo \
++	akkordion-iqdacplus.dtbo \
++	allo-boss-dac-pcm512x-audio.dtbo \
++	allo-boss2-dac-audio.dtbo \
++	allo-digione.dtbo \
++	allo-katana-dac-audio.dtbo \
++	allo-piano-dac-pcm512x-audio.dtbo \
++	allo-piano-dac-plus-pcm512x-audio.dtbo \
++	anyspi.dtbo \
++	apds9960.dtbo \
++	applepi-dac.dtbo \
++	arducam-64mp.dtbo \
++	arducam-pivariety.dtbo \
++	at86rf233.dtbo \
++	audioinjector-addons.dtbo \
++	audioinjector-bare-i2s.dtbo \
++	audioinjector-isolated-soundcard.dtbo \
++	audioinjector-ultra.dtbo \
++	audioinjector-wm8731-audio.dtbo \
++	audiosense-pi.dtbo \
++	audremap.dtbo \
++	balena-fin.dtbo \
++	camera-mux-2port.dtbo \
++	camera-mux-4port.dtbo \
++	cap1106.dtbo \
++	chipdip-dac.dtbo \
++	cirrus-wm5102.dtbo \
++	cma.dtbo \
++	cutiepi-panel.dtbo \
++	dacberry400.dtbo \
++	dht11.dtbo \
++	dionaudio-kiwi.dtbo \
++	dionaudio-loco.dtbo \
++	dionaudio-loco-v2.dtbo \
++	disable-bt.dtbo \
++	disable-wifi.dtbo \
++	dpi18.dtbo \
++	dpi18cpadhi.dtbo \
++	dpi24.dtbo \
++	draws.dtbo \
++	dwc-otg.dtbo \
++	dwc2.dtbo \
++	edt-ft5406.dtbo \
++	enc28j60.dtbo \
++	enc28j60-spi2.dtbo \
++	exc3000.dtbo \
++	fbtft.dtbo \
++	fe-pi-audio.dtbo \
++	fsm-demo.dtbo \
++	gc9a01.dtbo \
++	ghost-amp.dtbo \
++	goodix.dtbo \
++	googlevoicehat-soundcard.dtbo \
++	gpio-fan.dtbo \
++	gpio-hog.dtbo \
++	gpio-ir.dtbo \
++	gpio-ir-tx.dtbo \
++	gpio-key.dtbo \
++	gpio-led.dtbo \
++	gpio-no-bank0-irq.dtbo \
++	gpio-no-irq.dtbo \
++	gpio-poweroff.dtbo \
++	gpio-shutdown.dtbo \
++	hd44780-lcd.dtbo \
++	hdmi-backlight-hwhack-gpio.dtbo \
++	hifiberry-amp.dtbo \
++	hifiberry-amp100.dtbo \
++	hifiberry-amp3.dtbo \
++	hifiberry-dac.dtbo \
++	hifiberry-dacplus.dtbo \
++	hifiberry-dacplusadc.dtbo \
++	hifiberry-dacplusadcpro.dtbo \
++	hifiberry-dacplusdsp.dtbo \
++	hifiberry-dacplushd.dtbo \
++	hifiberry-digi.dtbo \
++	hifiberry-digi-pro.dtbo \
++	highperi.dtbo \
++	hy28a.dtbo \
++	hy28b.dtbo \
++	hy28b-2017.dtbo \
++	i-sabre-q2m.dtbo \
++	i2c-bcm2708.dtbo \
++	i2c-fan.dtbo \
++	i2c-gpio.dtbo \
++	i2c-mux.dtbo \
++	i2c-pwm-pca9685a.dtbo \
++	i2c-rtc.dtbo \
++	i2c-rtc-gpio.dtbo \
++	i2c-sensor.dtbo \
++	i2c0.dtbo \
++	i2c1.dtbo \
++	i2c3.dtbo \
++	i2c4.dtbo \
++	i2c5.dtbo \
++	i2c6.dtbo \
++	i2s-dac.dtbo \
++	i2s-gpio28-31.dtbo \
++	ilitek251x.dtbo \
++	imx219.dtbo \
++	imx258.dtbo \
++	imx290.dtbo \
++	imx296.dtbo \
++	imx327.dtbo \
++	imx378.dtbo \
++	imx462.dtbo \
++	imx477.dtbo \
++	imx519.dtbo \
++	iqaudio-codec.dtbo \
++	iqaudio-dac.dtbo \
++	iqaudio-dacplus.dtbo \
++	iqaudio-digi-wm8804-audio.dtbo \
++	iqs550.dtbo \
++	irs1125.dtbo \
++	jedec-spi-nor.dtbo \
++	justboom-both.dtbo \
++	justboom-dac.dtbo \
++	justboom-digi.dtbo \
++	ltc294x.dtbo \
++	max98357a.dtbo \
++	maxtherm.dtbo \
++	mbed-dac.dtbo \
++	mcp23017.dtbo \
++	mcp23s17.dtbo \
++	mcp2515.dtbo \
++	mcp2515-can0.dtbo \
++	mcp2515-can1.dtbo \
++	mcp251xfd.dtbo \
++	mcp3008.dtbo \
++	mcp3202.dtbo \
++	mcp342x.dtbo \
++	media-center.dtbo \
++	merus-amp.dtbo \
++	midi-uart0.dtbo \
++	midi-uart1.dtbo \
++	midi-uart2.dtbo \
++	midi-uart3.dtbo \
++	midi-uart4.dtbo \
++	midi-uart5.dtbo \
++	minipitft13.dtbo \
++	miniuart-bt.dtbo \
++	mipi-dbi-spi.dtbo \
++	mlx90640.dtbo \
++	mmc.dtbo \
++	mpu6050.dtbo \
++	mz61581.dtbo \
++	ov2311.dtbo \
++	ov5647.dtbo \
++	ov7251.dtbo \
++	ov9281.dtbo \
++	papirus.dtbo \
++	pca953x.dtbo \
++	pcie-32bit-dma.dtbo \
++	pibell.dtbo \
++	pifacedigital.dtbo \
++	pifi-40.dtbo \
++	pifi-dac-hd.dtbo \
++	pifi-dac-zero.dtbo \
++	pifi-mini-210.dtbo \
++	piglow.dtbo \
++	piscreen.dtbo \
++	piscreen2r.dtbo \
++	pisound.dtbo \
++	pitft22.dtbo \
++	pitft28-capacitive.dtbo \
++	pitft28-resistive.dtbo \
++	pitft35-resistive.dtbo \
++	pps-gpio.dtbo \
++	proto-codec.dtbo \
++	pwm.dtbo \
++	pwm-2chan.dtbo \
++	pwm-ir-tx.dtbo \
++	qca7000.dtbo \
++	qca7000-uart0.dtbo \
++	ramoops.dtbo \
++	ramoops-pi4.dtbo \
++	rotary-encoder.dtbo \
++	rpi-backlight.dtbo \
++	rpi-codeczero.dtbo \
++	rpi-dacplus.dtbo \
++	rpi-dacpro.dtbo \
++	rpi-digiampplus.dtbo \
++	rpi-ft5406.dtbo \
++	rpi-poe.dtbo \
++	rpi-poe-plus.dtbo \
++	rpi-sense.dtbo \
++	rpi-sense-v2.dtbo \
++	rpi-tv.dtbo \
++	rra-digidac1-wm8741-audio.dtbo \
++	sainsmart18.dtbo \
++	sc16is750-i2c.dtbo \
++	sc16is752-i2c.dtbo \
++	sc16is752-spi0.dtbo \
++	sc16is752-spi1.dtbo \
++	sdhost.dtbo \
++	sdio.dtbo \
++	seeed-can-fd-hat-v1.dtbo \
++	seeed-can-fd-hat-v2.dtbo \
++	sh1106-spi.dtbo \
++	si446x-spi0.dtbo \
++	smi.dtbo \
++	smi-dev.dtbo \
++	smi-nand.dtbo \
++	spi-gpio35-39.dtbo \
++	spi-gpio40-45.dtbo \
++	spi-rtc.dtbo \
++	spi0-0cs.dtbo \
++	spi0-1cs.dtbo \
++	spi0-2cs.dtbo \
++	spi1-1cs.dtbo \
++	spi1-2cs.dtbo \
++	spi1-3cs.dtbo \
++	spi2-1cs.dtbo \
++	spi2-2cs.dtbo \
++	spi2-3cs.dtbo \
++	spi3-1cs.dtbo \
++	spi3-2cs.dtbo \
++	spi4-1cs.dtbo \
++	spi4-2cs.dtbo \
++	spi5-1cs.dtbo \
++	spi5-2cs.dtbo \
++	spi6-1cs.dtbo \
++	spi6-2cs.dtbo \
++	ssd1306.dtbo \
++	ssd1306-spi.dtbo \
++	ssd1331-spi.dtbo \
++	ssd1351-spi.dtbo \
++	superaudioboard.dtbo \
++	sx150x.dtbo \
++	tc358743.dtbo \
++	tc358743-audio.dtbo \
++	tinylcd35.dtbo \
++	tpm-slb9670.dtbo \
++	tpm-slb9673.dtbo \
++	uart0.dtbo \
++	uart1.dtbo \
++	uart2.dtbo \
++	uart3.dtbo \
++	uart4.dtbo \
++	uart5.dtbo \
++	udrc.dtbo \
++	ugreen-dabboard.dtbo \
++	upstream.dtbo \
++	upstream-pi4.dtbo \
++	vc4-fkms-v3d.dtbo \
++	vc4-fkms-v3d-pi4.dtbo \
++	vc4-kms-dpi-generic.dtbo \
++	vc4-kms-dpi-hyperpixel2r.dtbo \
++	vc4-kms-dpi-hyperpixel4.dtbo \
++	vc4-kms-dpi-hyperpixel4sq.dtbo \
++	vc4-kms-dpi-panel.dtbo \
++	vc4-kms-dsi-7inch.dtbo \
++	vc4-kms-dsi-lt070me05000.dtbo \
++	vc4-kms-dsi-lt070me05000-v2.dtbo \
++	vc4-kms-kippah-7inch.dtbo \
++	vc4-kms-v3d.dtbo \
++	vc4-kms-v3d-pi4.dtbo \
++	vc4-kms-vga666.dtbo \
++	vga666.dtbo \
++	vl805.dtbo \
++	w1-gpio.dtbo \
++	w1-gpio-pullup.dtbo \
++	w5500.dtbo \
++	watterott-display.dtbo \
++	waveshare-can-fd-hat-mode-a.dtbo \
++	waveshare-can-fd-hat-mode-b.dtbo \
++	wittypi.dtbo \
++	wm8960-soundcard.dtbo
++
++targets += dtbs dtbs_install
++targets += $(dtbo-y)
++
++always-y	:= $(dtbo-y)
++clean-files	:= *.dtbo
+diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
+new file mode 100644
+index 000000000000..90d861b85c9e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/README
+@@ -0,0 +1,4513 @@
++Introduction
++============
++
++This directory contains Device Tree overlays. Device Tree makes it possible
++to support many hardware configurations with a single kernel and without the
++need to explicitly load or blacklist kernel modules. Note that this isn't a
++"pure" Device Tree configuration (c.f. MACH_BCM2835) - some on-board devices
++are still configured by the board support code, but the intention is to
++eventually reach that goal.
++
++On Raspberry Pi, Device Tree usage is controlled from /boot/config.txt. By
++default, the Raspberry Pi kernel boots with device tree enabled. You can
++completely disable DT usage (for now) by adding:
++
++    device_tree=
++
++to your config.txt, which should cause your Pi to revert to the old way of
++doing things after a reboot.
++
++In /boot you will find a .dtb for each base platform. This describes the
++hardware that is part of the Raspberry Pi board. The loader (start.elf and its
++siblings) selects the .dtb file appropriate for the platform by name, and reads
++it into memory. At this point, all of the optional interfaces (i2c, i2s, spi)
++are disabled, but they can be enabled using Device Tree parameters:
++
++    dtparam=i2c=on,i2s=on,spi=on
++
++However, this shouldn't be necessary in many use cases because loading an
++overlay that requires one of those interfaces will cause it to be enabled
++automatically, and it is advisable to only enable interfaces if they are
++needed.
++
++Configuring additional, optional hardware is done using Device Tree overlays
++(see below).
++
++GPIO numbering uses the hardware pin numbering scheme (aka BCM scheme) and
++not the physical pin numbers.
++
++raspi-config
++============
++
++The Advanced Options section of the raspi-config utility can enable and disable
++Device Tree use, as well as toggling the I2C and SPI interfaces. Note that it
++is possible to both enable an interface and blacklist the driver, if for some
++reason you should want to defer the loading.
++
++Modules
++=======
++
++As well as describing the hardware, Device Tree also gives enough information
++to allow suitable driver modules to be located and loaded, with the corollary
++that unneeded modules are not loaded. As a result it should be possible to
++remove lines from /etc/modules, and /etc/modprobe.d/raspi-blacklist.conf can
++have its contents deleted (or commented out).
++
++Using Overlays
++==============
++
++Overlays are loaded using the "dtoverlay" config.txt setting. As an example,
++consider I2C Real Time Clock drivers. In the pre-DT world these would be loaded
++by writing a magic string comprising a device identifier and an I2C address to
++a special file in /sys/class/i2c-adapter, having first loaded the driver for
++the I2C interface and the RTC device - something like this:
++
++    modprobe i2c-bcm2835
++    modprobe rtc-ds1307
++    echo ds1307 0x68 > /sys/class/i2c-adapter/i2c-1/new_device
++
++With DT enabled, this becomes a line in config.txt:
++
++    dtoverlay=i2c-rtc,ds1307
++
++This causes the file /boot/overlays/i2c-rtc.dtbo to be loaded and a "node"
++describing the DS1307 I2C device to be added to the Device Tree for the Pi. By
++default it usees address 0x68, but this can be modified with an additional DT
++parameter:
++
++    dtoverlay=i2c-rtc,ds1307,addr=0x68
++
++Parameters usually have default values, although certain parameters are
++mandatory. See the list of overlays below for a description of the parameters
++and their defaults.
++
++Making new Overlays based on existing Overlays
++==============================================
++
++Recent overlays have been designed in a more general way, so that they can be
++adapted to hardware by changing their parameters. When you have additional
++hardware with more than one device of a kind, you end up using the same overlay
++multiple times with other parameters, e.g.
++
++    # 2 CAN FD interfaces on spi but with different pins
++    dtoverlay=mcp251xfd,spi0-0,interrupt=25
++    dtoverlay=mcp251xfd,spi0-1,interrupt=24
++
++    # a realtime clock on i2c
++    dtoverlay=i2c-rtc,pcf85063
++
++While this approach does work, it requires knowledge about the hardware design.
++It is more feasible to simplify things for the end user by providing a single
++overlay as it is done the traditional way.
++
++A new overlay can be generated by using ovmerge utility.
++https://github.com/raspberrypi/utils/blob/master/ovmerge/ovmerge
++
++To generate an overlay for the above configuration we pass the configuration
++to ovmerge and add the -c flag.
++
++    ovmerge -c mcp251xfd-overlay.dts,spi0-0,interrupt=25 \
++               mcp251xfd-overlay.dts,spi0-1,interrupt=24 \
++               i2c-rtc-overlay.dts,pcf85063 \
++    >> merged-overlay.dts
++
++The -c option writes the command above as a comment into the overlay as
++a marker that this overlay is generated and how it was generated.
++After compiling the overlay it can be loaded in a single line.
++
++    dtoverlay=merged
++
++It does the same as the original configuration but without parameters.
++
++The Overlay and Parameter Reference
++===================================
++
++N.B. When editing this file, please preserve the indentation levels to make it
++simple to parse programmatically. NO HARD TABS.
++
++
++Name:   <The base DTB>
++Info:   Configures the base Raspberry Pi hardware
++Load:   <loaded automatically>
++Params:
++        ant1                    Select antenna 1 (default). CM4 only.
++
++        ant2                    Select antenna 2. CM4 only.
++
++        noant                   Disable both antennas. CM4 only.
++
++        audio                   Set to "on" to enable the onboard ALSA audio
++                                interface (default "off")
++
++        axiperf                 Set to "on" to enable the AXI bus performance
++                                monitors.
++                                See /sys/kernel/debug/raspberrypi_axi_monitor
++                                for the results.
++
++        cam0_reg                Enables CAM 0 regulator. CM1 & 3 only.
++
++        cam0_reg_gpio           Set GPIO for CAM 0 regulator. Default 30.
++                                CM1 & 3 only.
++
++        cam1_reg                Enables CAM 1 regulator. CM1 & 3 only.
++
++        cam1_reg_gpio           Set GPIO for CAM 1 regulator. Default 2.
++                                CM1 & 3 only.
++
++        eee                     Enable Energy Efficient Ethernet support for
++                                compatible devices (default "on"). See also
++                                "tx_lpi_timer". Pi3B+ only.
++
++        eth_downshift_after     Set the number of auto-negotiation failures
++                                after which the 1000Mbps modes are disabled.
++                                Legal values are 2, 3, 4, 5 and 0, where
++                                0 means never downshift (default 2). Pi3B+ only.
++
++        eth_led0                Set mode of LED0 - amber on Pi3B+ (default "1"),
++                                green on Pi4 (default "0").
++                                The legal values are:
++
++                                Pi3B+
++
++                                0=link/activity          1=link1000/activity
++                                2=link100/activity       3=link10/activity
++                                4=link100/1000/activity  5=link10/1000/activity
++                                6=link10/100/activity    14=off    15=on
++
++                                Pi4
++
++                                0=Speed/Activity         1=Speed
++                                2=Flash activity         3=FDX
++                                4=Off                    5=On
++                                6=Alt                    7=Speed/Flash
++                                8=Link                   9=Activity
++
++        eth_led1                Set mode of LED1 - green on Pi3B+ (default "6"),
++                                amber on Pi4 (default "8"). See eth_led0 for
++                                legal values.
++
++        eth_max_speed           Set the maximum speed a link is allowed
++                                to negotiate. Legal values are 10, 100 and
++                                1000 (default 1000). Pi3B+ only.
++
++        hdmi                    Set to "off" to disable the HDMI interface
++                                (default "on")
++
++        i2c_arm                 Set to "on" to enable the ARM's i2c interface
++                                (default "off")
++
++        i2c_vc                  Set to "on" to enable the i2c interface
++                                usually reserved for the VideoCore processor
++                                (default "off")
++
++        i2c                     An alias for i2c_arm
++
++        i2c_arm_baudrate        Set the baudrate of the ARM's i2c interface
++                                (default "100000")
++
++        i2c_vc_baudrate         Set the baudrate of the VideoCore i2c interface
++                                (default "100000")
++
++        i2c_baudrate            An alias for i2c_arm_baudrate
++
++        i2s                     Set to "on" to enable the i2s interface
++                                (default "off")
++
++        krnbt                   Set to "on" to enable autoprobing of Bluetooth
++                                driver without need of hciattach/btattach
++                                (default "off")
++
++        krnbt_baudrate          Set the baudrate of the PL011 UART when used
++                                with krnbt=on
++
++        pcie                    Set to "off" to disable the PCIe interface
++                                (default "on")
++                                (2711 only, but not applicable on CM4S)
++                                N.B. USB-A ports on 4B are subsequently disabled
++
++        spi                     Set to "on" to enable the spi interfaces
++                                (default "off")
++
++        spi_dma4                Use to enable 40-bit DMA on spi interfaces
++                                (the assigned value doesn't matter)
++                                (2711 only)
++
++        random                  Set to "on" to enable the hardware random
++                                number generator (default "on")
++
++        sd                      Set to "off" to disable the SD card (or eMMC on
++                                non-lite SKU of CM4).
++                                (default "on")
++
++        sd_overclock            Clock (in MHz) to use when the MMC framework
++                                requests 50MHz
++
++        sd_poll_once            Looks for a card once after booting. Useful
++                                for network booting scenarios to avoid the
++                                overhead of continuous polling. N.B. Using
++                                this option restricts the system to using a
++                                single card per boot (or none at all).
++                                (default off)
++
++        sd_force_pio            Disable DMA support for SD driver (default off)
++
++        sd_pio_limit            Number of blocks above which to use DMA for
++                                SD card (default 1)
++
++        sd_debug                Enable debug output from SD driver (default off)
++
++        sdio_overclock          Clock (in MHz) to use when the MMC framework
++                                requests 50MHz for the SDIO/WLAN interface.
++
++        tx_lpi_timer            Set the delay in microseconds between going idle
++                                and entering the low power state (default 600).
++                                Requires EEE to be enabled - see "eee".
++
++        uart0                   Set to "off" to disable uart0 (default "on")
++
++        uart1                   Set to "on" or "off" to enable or disable uart1
++                                (default varies)
++
++        watchdog                Set to "on" to enable the hardware watchdog
++                                (default "off")
++
++        act_led_trigger         Choose which activity the LED tracks.
++                                Use "heartbeat" for a nice load indicator.
++                                (default "mmc")
++
++        act_led_activelow       Set to "on" to invert the sense of the LED
++                                (default "off")
++                                N.B. For Pi 3B, 3B+, 3A+ and 4B, use the act-led
++                                overlay.
++
++        act_led_gpio            Set which GPIO to use for the activity LED
++                                (in case you want to connect it to an external
++                                device)
++                                (default "16" on a non-Plus board, "47" on a
++                                Plus or Pi 2)
++                                N.B. For Pi 3B, 3B+, 3A+ and 4B, use the act-led
++                                overlay.
++
++        pwr_led_trigger
++        pwr_led_activelow
++        pwr_led_gpio
++                                As for act_led_*, but using the PWR LED.
++                                Not available on Model A/B boards.
++
++        N.B. It is recommended to only enable those interfaces that are needed.
++        Leaving all interfaces enabled can lead to unwanted behaviour (i2c_vc
++        interfering with Pi Camera, I2S and SPI hogging GPIO pins, etc.)
++        Note also that i2c, i2c_arm and i2c_vc are aliases for the physical
++        interfaces i2c0 and i2c1. Use of the numeric variants is still possible
++        but deprecated because the ARM/VC assignments differ between board
++        revisions. The same board-specific mapping applies to i2c_baudrate,
++        and the other i2c baudrate parameters.
++
++
++Name:   act-led
++Info:   Pi 3B, 3B+, 3A+ and 4B use a GPIO expander to drive the LEDs which can
++        only be accessed from the VPU. There is a special driver for this with a
++        separate DT node, which has the unfortunate consequence of breaking the
++        act_led_gpio and act_led_activelow dtparams.
++        This overlay changes the GPIO controller back to the standard one and
++        restores the dtparams.
++Load:   dtoverlay=act-led,<param>=<val>
++Params: activelow               Set to "on" to invert the sense of the LED
++                                (default "off")
++
++        gpio                    Set which GPIO to use for the activity LED
++                                (in case you want to connect it to an external
++                                device)
++                                REQUIRED
++
++
++Name:   adafruit-st7735r
++Info:   Overlay for the SPI-connected Adafruit 1.8" 160x128 or 128x128 displays,
++        based on the ST7735R chip.
++        This overlay uses the newer DRM/KMS "Tiny" driver.
++Load:   dtoverlay=adafruit-st7735r,<param>=<val>
++Params: 128x128                 Select the 128x128 driver (default 160x128)
++        rotate                  Display rotation {0,90,180,270} (default 90)
++        speed                   SPI bus speed in Hz (default 4000000)
++        dc_pin                  GPIO pin for D/C (default 24)
++        reset_pin               GPIO pin for RESET (default 25)
++        led_pin                 GPIO used to control backlight (default 18)
++
++
++Name:   adafruit18
++Info:   Overlay for the SPI-connected Adafruit 1.8" display (based on the
++        ST7735R chip). It includes support for the "green tab" version.
++        This overlay uses the older fbtft driver.
++Load:   dtoverlay=adafruit18,<param>=<val>
++Params: green                   Use the adafruit18_green variant.
++        rotate                  Display rotation {0,90,180,270}
++        speed                   SPI bus speed in Hz (default 4000000)
++        fps                     Display frame rate in Hz
++        bgr                     Enable BGR mode (default off)
++        debug                   Debug output level {0-7}
++        dc_pin                  GPIO pin for D/C (default 24)
++        reset_pin               GPIO pin for RESET (default 25)
++        led_pin                 GPIO used to control backlight (default 18)
++
++
++Name:   adau1977-adc
++Info:   Overlay for activation of ADAU1977 ADC codec over I2C for control
++        and I2S for data.
++Load:   dtoverlay=adau1977-adc
++Params: <None>
++
++
++Name:   adau7002-simple
++Info:   Overlay for the activation of ADAU7002 stereo PDM to I2S converter.
++Load:   dtoverlay=adau7002-simple,<param>=<val>
++Params: card-name               Override the default, "adau7002", card name.
++
++
++Name:   ads1015
++Info:   Overlay for activation of Texas Instruments ADS1015 ADC over I2C
++Load:   dtoverlay=ads1015,<param>=<val>
++Params: addr                    I2C bus address of device. Set based on how the
++                                addr pin is wired. (default=0x48 assumes addr
++                                is pulled to GND)
++        cha_enable              Enable virtual channel a. (default=true)
++        cha_cfg                 Set the configuration for virtual channel a.
++                                (default=4 configures this channel for the
++                                voltage at A0 with respect to GND)
++        cha_datarate            Set the datarate (samples/sec) for this channel.
++                                (default=4 sets 1600 sps)
++        cha_gain                Set the gain of the Programmable Gain
++                                Amplifier for this channel. (default=2 sets the
++                                full scale of the channel to 2.048 Volts)
++
++        Channel (ch) parameters can be set for each enabled channel.
++        A maximum of 4 channels can be enabled (letters a thru d).
++        For more information refer to the device datasheet at:
++        http://www.ti.com/lit/ds/symlink/ads1015.pdf
++
++
++Name:   ads1115
++Info:   Texas Instruments ADS1115 ADC
++Load:   dtoverlay=ads1115,<param>[=<val>]
++Params: addr                    I2C bus address of device. Set based on how the
++                                addr pin is wired. (default=0x48 assumes addr
++                                is pulled to GND)
++        cha_enable              Enable virtual channel a.
++        cha_cfg                 Set the configuration for virtual channel a.
++                                (default=4 configures this channel for the
++                                voltage at A0 with respect to GND)
++        cha_datarate            Set the datarate (samples/sec) for this channel.
++                                (default=7 sets 860 sps)
++        cha_gain                Set the gain of the Programmable Gain
++                                Amplifier for this channel. (Default 1 sets the
++                                full scale of the channel to 4.096 Volts)
++
++        Channel parameters can be set for each enabled channel.
++        A maximum of 4 channels can be enabled (letters a thru d).
++        For more information refer to the device datasheet at:
++        http://www.ti.com/lit/ds/symlink/ads1115.pdf
++
++
++Name:   ads7846
++Info:   ADS7846 Touch controller
++Load:   dtoverlay=ads7846,<param>=<val>
++Params: cs                      SPI bus Chip Select (default 1)
++        speed                   SPI bus speed (default 2MHz, max 3.25MHz)
++        penirq                  GPIO used for PENIRQ. REQUIRED
++        penirq_pull             Set GPIO pull (default 0=none, 2=pullup)
++        swapxy                  Swap x and y axis
++        xmin                    Minimum value on the X axis (default 0)
++        ymin                    Minimum value on the Y axis (default 0)
++        xmax                    Maximum value on the X axis (default 4095)
++        ymax                    Maximum value on the Y axis (default 4095)
++        pmin                    Minimum reported pressure value (default 0)
++        pmax                    Maximum reported pressure value (default 65535)
++        xohms                   Touchpanel sensitivity (X-plate resistance)
++                                (default 400)
++
++        penirq is required and usually xohms (60-100) has to be set as well.
++        Apart from that, pmax (255) and swapxy are also common.
++        The rest of the calibration can be done with xinput-calibrator.
++        See: github.com/notro/fbtft/wiki/FBTFT-on-Raspian
++        Device Tree binding document:
++        www.kernel.org/doc/Documentation/devicetree/bindings/input/ads7846.txt
++
++
++Name:   adv7282m
++Info:   Analog Devices ADV7282M analogue video to CSI2 bridge.
++        Uses Unicam1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=adv7282m,<param>=<val>
++Params: addr                    Overrides the I2C address (default 0x21)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default off)
++
++
++Name:   adv728x-m
++Info:   Analog Devices ADV728[0|1|2]-M analogue video to CSI2 bridges.
++        This is a wrapper for adv7282m, and defaults to ADV7282M.
++Load:   dtoverlay=adv728x-m,<param>=<val>
++Params: addr                    Overrides the I2C address (default 0x21)
++        adv7280m                Select ADV7280-M.
++        adv7281m                Select ADV7281-M.
++        adv7281ma               Select ADV7281-MA.
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default off)
++
++
++Name:   akkordion-iqdacplus
++Info:   Configures the Digital Dreamtime Akkordion Music Player (based on the
++        OEM IQAudIO DAC+ or DAC Zero module).
++Load:   dtoverlay=akkordion-iqdacplus,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                dtoverlay=akkordion-iqdacplus,24db_digital_gain
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24db_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++
++
++Name:   allo-boss-dac-pcm512x-audio
++Info:   Configures the Allo Boss DAC audio cards.
++Load:   dtoverlay=allo-boss-dac-pcm512x-audio,<param>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=allo-boss-dac-pcm512x-audio,
++                                24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24db_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++        slave                   Force Boss DAC into slave mode, using Pi a
++                                master for bit clock and frame clock. Enable
++                                with "dtoverlay=allo-boss-dac-pcm512x-audio,
++                                slave"
++
++
++Name:   allo-boss2-dac-audio
++Info:   Configures the Allo Boss2 DAC audio card
++Load:   dtoverlay=allo-boss2-dac-audio
++Params: <None>
++
++
++Name:   allo-digione
++Info:   Configures the Allo Digione audio card
++Load:   dtoverlay=allo-digione
++Params: <None>
++
++
++Name:   allo-katana-dac-audio
++Info:   Configures the Allo Katana DAC audio card
++Load:   dtoverlay=allo-katana-dac-audio
++Params: <None>
++
++
++Name:   allo-piano-dac-pcm512x-audio
++Info:   Configures the Allo Piano DAC (2.0/2.1) audio cards.
++        (NB. This initial support is for 2.0 channel audio ONLY! ie. stereo.
++        The subwoofer outputs on the Piano 2.1 are not currently supported!)
++Load:   dtoverlay=allo-piano-dac-pcm512x-audio,<param>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control.
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24db_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++
++
++Name:   allo-piano-dac-plus-pcm512x-audio
++Info:   Configures the Allo Piano DAC (2.1) audio cards.
++Load:   dtoverlay=allo-piano-dac-plus-pcm512x-audio,<param>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control.
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24db_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++        glb_mclk                This option is only with Kali board. If enabled,
++                                MCLK for Kali is used and PLL is disabled for
++                                better voice quality. (default Off)
++
++
++Name:   anyspi
++Info:   Universal device tree overlay for SPI devices
++
++        Just specify the SPI address and device name ("compatible" property).
++        This overlay lacks any device-specific parameter support!
++
++        For devices on spi1 or spi2, the interfaces should be enabled
++        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++
++        Examples:
++        1. SPI NOR flash on spi0.1, maximum SPI clock frequency 45MHz:
++            dtoverlay=anyspi:spi0-1,dev="jedec,spi-nor",speed=45000000
++        2. MCP3204 ADC on spi1.2, maximum SPI clock frequency 500kHz:
++            dtoverlay=anyspi:spi1-2,dev="microchip,mcp3204"
++Load:   dtoverlay=anyspi,<param>=<val>
++Params: spi<n>-<m>              Configure device at spi<n>, cs<m>
++                                (boolean, required)
++        dev                     Set device name to search compatible module
++                                (string, required)
++        speed                   Set SPI clock frequency in Hz
++                                (integer, optional, default 500000)
++
++
++Name:   apds9960
++Info:   Configures the AVAGO APDS9960 digital proximity, ambient light, RGB and
++        gesture sensor
++Load:   dtoverlay=apds9960,<param>=<val>
++Params: gpiopin                 GPIO used for INT (default 4)
++        noints                  Disable the interrupt GPIO line.
++
++
++Name:   applepi-dac
++Info:   Configures the Orchard Audio ApplePi-DAC audio card
++Load:   dtoverlay=applepi-dac
++Params: <None>
++
++
++Name:   arducam-64mp
++Info:   Arducam 64MP camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=arducam-64mp,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   arducam-pivariety
++Info:   Arducam Pivariety camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=arducam-pivariety,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   at86rf233
++Info:   Configures the Atmel AT86RF233 802.15.4 low-power WPAN transceiver,
++        connected to spi0.0
++Load:   dtoverlay=at86rf233,<param>=<val>
++Params: interrupt               GPIO used for INT (default 23)
++        reset                   GPIO used for Reset (default 24)
++        sleep                   GPIO used for Sleep (default 25)
++        speed                   SPI bus speed in Hz (default 3000000)
++        trim                    Fine tuning of the internal capacitance
++                                arrays (0=+0pF, 15=+4.5pF, default 15)
++
++
++Name:   audioinjector-addons
++Info:   Configures the audioinjector.net audio add on soundcards
++Load:   dtoverlay=audioinjector-addons,<param>=<val>
++Params: non-stop-clocks         Keeps the clocks running even when the stream
++                                is paused or stopped (default off)
++
++
++Name:   audioinjector-bare-i2s
++Info:   Configures the audioinjector.net audio bare i2s soundcard
++Load:   dtoverlay=audioinjector-bare-i2s
++Params: <None>
++
++
++Name:   audioinjector-isolated-soundcard
++Info:   Configures the audioinjector.net isolated soundcard
++Load:   dtoverlay=audioinjector-isolated-soundcard
++Params: <None>
++
++
++Name:   audioinjector-ultra
++Info:   Configures the audioinjector.net ultra soundcard
++Load:   dtoverlay=audioinjector-ultra
++Params: <None>
++
++
++Name:   audioinjector-wm8731-audio
++Info:   Configures the audioinjector.net audio add on soundcard
++Load:   dtoverlay=audioinjector-wm8731-audio
++Params: <None>
++
++
++Name:   audiosense-pi
++Info:   Configures the audiosense-pi add on soundcard
++        For more information refer to
++        https://gitlab.com/kakar0t/audiosense-pi
++Load:   dtoverlay=audiosense-pi
++Params: <None>
++
++
++Name:   audremap
++Info:   Switches PWM sound output to GPIOs on the 40-pin header
++Load:   dtoverlay=audremap,<param>=<val>
++Params: swap_lr                 Reverse the channel allocation, which will also
++                                swap the audio jack outputs (default off)
++        enable_jack             Don't switch off the audio jack output
++                                (default off)
++        pins_12_13              Select GPIOs 12 & 13 (default)
++        pins_18_19              Select GPIOs 18 & 19
++
++
++Name:   balena-fin
++Info:   Overlay that enables WLAN, Bluetooth and the GPIO expander on the
++        balenaFin carrier board for the Raspberry Pi Compute Module 3/3+ Lite.
++Load:   dtoverlay=balena-fin
++Params: <None>
++
++
++Name:   bmp085_i2c-sensor
++Info:   This overlay is now deprecated - see i2c-sensor
++Load:   <Deprecated>
++
++
++Name:   camera-mux-2port
++Info:   Configures a 2 port camera multiplexer
++        Note that currently ALL IMX290 modules share a common clock, therefore
++        all modules will need to have the same clock frequency.
++Load:   dtoverlay=camera-mux-2port,<param>=<val>
++Params: cam0-imx219             Select IMX219 for camera on port 0
++        cam0-imx258             Select IMX258 for camera on port 0
++        cam0-imx290             Select IMX290 for camera on port 0
++        cam0-imx477             Select IMX477 for camera on port 0
++        cam0-ov2311             Select OV2311 for camera on port 0
++        cam0-ov5647             Select OV5647 for camera on port 0
++        cam0-ov7251             Select OV7251 for camera on port 0
++        cam0-ov9281             Select OV9281 for camera on port 0
++        cam0-imx290-clk-freq    Set clock frequency for an IMX290 on port 0
++        cam1-imx219             Select IMX219 for camera on port 1
++        cam1-imx258             Select IMX258 for camera on port 1
++        cam1-imx290             Select IMX290 for camera on port 1
++        cam1-imx477             Select IMX477 for camera on port 1
++        cam1-ov2311             Select OV2311 for camera on port 1
++        cam1-ov5647             Select OV5647 for camera on port 1
++        cam1-ov7251             Select OV7251 for camera on port 1
++        cam1-ov9281             Select OV9281 for camera on port 1
++        cam1-imx290-clk-freq    Set clock frequency for an IMX290 on port 1
++
++
++Name:   camera-mux-4port
++Info:   Configures a 4 port camera multiplexer
++        Note that currently ALL IMX290 modules share a common clock, therefore
++        all modules will need to have the same clock frequency.
++Load:   dtoverlay=camera-mux-4port,<param>=<val>
++Params: cam0-imx219             Select IMX219 for camera on port 0
++        cam0-imx258             Select IMX258 for camera on port 0
++        cam0-imx290             Select IMX290 for camera on port 0
++        cam0-imx477             Select IMX477 for camera on port 0
++        cam0-ov2311             Select OV2311 for camera on port 0
++        cam0-ov5647             Select OV5647 for camera on port 0
++        cam0-ov7251             Select OV7251 for camera on port 0
++        cam0-ov9281             Select OV9281 for camera on port 0
++        cam0-imx290-clk-freq    Set clock frequency for an IMX290 on port 0
++        cam1-imx219             Select IMX219 for camera on port 1
++        cam1-imx258             Select IMX258 for camera on port 1
++        cam1-imx290             Select IMX290 for camera on port 1
++        cam1-imx477             Select IMX477 for camera on port 1
++        cam1-ov2311             Select OV2311 for camera on port 1
++        cam1-ov5647             Select OV5647 for camera on port 1
++        cam1-ov7251             Select OV7251 for camera on port 1
++        cam1-ov9281             Select OV9281 for camera on port 1
++        cam1-imx290-clk-freq    Set clock frequency for an IMX290 on port 1
++        cam2-imx219             Select IMX219 for camera on port 2
++        cam2-imx258             Select IMX258 for camera on port 2
++        cam2-imx290             Select IMX290 for camera on port 2
++        cam2-imx477             Select IMX477 for camera on port 2
++        cam2-ov2311             Select OV2311 for camera on port 2
++        cam2-ov5647             Select OV5647 for camera on port 2
++        cam2-ov7251             Select OV7251 for camera on port 2
++        cam2-ov9281             Select OV9281 for camera on port 2
++        cam2-imx290-clk-freq    Set clock frequency for an IMX290 on port 2
++        cam3-imx219             Select IMX219 for camera on port 3
++        cam3-imx258             Select IMX258 for camera on port 3
++        cam3-imx290             Select IMX290 for camera on port 3
++        cam3-imx477             Select IMX477 for camera on port 3
++        cam3-ov2311             Select OV2311 for camera on port 3
++        cam3-ov5647             Select OV5647 for camera on port 3
++        cam3-ov7251             Select OV7251 for camera on port 3
++        cam3-ov9281             Select OV9281 for camera on port 3
++        cam3-imx290-clk-freq    Set clock frequency for an IMX290 on port 3
++
++
++Name:   cap1106
++Info:   Enables the ability to use the cap1106 touch sensor as a keyboard
++Load:   dtoverlay=cap1106,<param>=<val>
++Params: int_pin                 GPIO pin for interrupt signal (default 23)
++
++
++Name:   chipdip-dac
++Info:   Configures Chip Dip audio cards.
++Load:   dtoverlay=chipdip-dac
++Params: <None>
++
++
++Name:   cirrus-wm5102
++Info:   Configures the Cirrus Logic Audio Card
++Load:   dtoverlay=cirrus-wm5102
++Params: <None>
++
++
++Name:   cma
++Info:   Set custom CMA sizes, only use if you know what you are doing, might
++        clash with other overlays like vc4-fkms-v3d and vc4-kms-v3d.
++Load:   dtoverlay=cma,<param>=<val>
++Params: cma-512                 CMA is 512MB (needs 1GB)
++        cma-448                 CMA is 448MB (needs 1GB)
++        cma-384                 CMA is 384MB (needs 1GB)
++        cma-320                 CMA is 320MB (needs 1GB)
++        cma-256                 CMA is 256MB (needs 1GB)
++        cma-192                 CMA is 192MB (needs 1GB)
++        cma-128                 CMA is 128MB
++        cma-96                  CMA is 96MB
++        cma-64                  CMA is 64MB
++        cma-size                CMA size in bytes, 4MB aligned
++        cma-default             Use upstream's default value
++
++
++Name:   cutiepi-panel
++Info:   8" TFT LCD display and touch panel used by cutiepi.io
++Load:   dtoverlay=cutiepi-panel
++Params: <None>
++
++
++Name:   dacberry400
++Info:   Configures the dacberry400 add on soundcard
++Load:   dtoverlay=dacberry400
++Params: <None>
++
++
++Name:   dht11
++Info:   Overlay for the DHT11/DHT21/DHT22 humidity/temperature sensors
++        Also sometimes found with the part number(s) AM230x.
++Load:   dtoverlay=dht11,<param>=<val>
++Params: gpiopin                 GPIO connected to the sensor's DATA output.
++                                (default 4)
++
++
++Name:   dionaudio-kiwi
++Info:   Configures the Dion Audio KIWI STREAMER
++Load:   dtoverlay=dionaudio-kiwi
++Params: <None>
++
++
++Name:   dionaudio-loco
++Info:   Configures the Dion Audio LOCO DAC-AMP
++Load:   dtoverlay=dionaudio-loco
++Params: <None>
++
++
++Name:   dionaudio-loco-v2
++Info:   Configures the Dion Audio LOCO-V2 DAC-AMP
++Load:   dtoverlay=dionaudio-loco-v2,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=hifiberry-dacplus,24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24dB_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++
++
++Name:   disable-bt
++Info:   Disable onboard Bluetooth on Pi 3B, 3B+, 3A+, 4B and Zero W, restoring
++        UART0/ttyAMA0 over GPIOs 14 & 15.
++        N.B. To disable the systemd service that initialises the modem so it
++        doesn't use the UART, use 'sudo systemctl disable hciuart'.
++Load:   dtoverlay=disable-bt
++Params: <None>
++
++
++Name:   disable-wifi
++Info:   Disable onboard WLAN on Pi 3B, 3B+, 3A+, 4B and Zero W.
++Load:   dtoverlay=disable-wifi
++Params: <None>
++
++
++Name:   dpi18
++Info:   Overlay for a generic 18-bit DPI display
++        This uses GPIOs 0-21 (so no I2C, uart etc.), and activates the output
++        2-3 seconds after the kernel has started.
++Load:   dtoverlay=dpi18
++Params: <None>
++
++
++Name:   dpi18cpadhi
++Info:   Overlay for a generic 18-bit DPI display (in 'mode 6' connection scheme)
++        This uses GPIOs 0-9,12-17,20-25 (so no I2C, uart etc.), and activates
++        the output 3-3 seconds after the kernel has started.
++Load:   dtoverlay=dpi18cpadhi
++Params: <None>
++
++
++Name:   dpi24
++Info:   Overlay for a generic 24-bit DPI display
++        This uses GPIOs 0-27 (so no I2C, uart etc.), and activates the output
++        2-3 seconds after the kernel has started.
++Load:   dtoverlay=dpi24
++Params: <None>
++
++
++Name:   draws
++Info:   Configures the NW Digital Radio DRAWS Hat
++
++        The board includes an ADC to measure various board values and also
++        provides two analog user inputs on the expansion header.  The ADC
++        can be configured for various sample rates and gain values to adjust
++        the input range.  Tables describing the two parameters follow.
++
++        ADC Gain Values:
++            0 = +/- 6.144V
++            1 = +/- 4.096V
++            2 = +/- 2.048V
++            3 = +/- 1.024V
++            4 = +/- 0.512V
++            5 = +/- 0.256V
++            6 = +/- 0.256V
++            7 = +/- 0.256V
++
++        ADC Datarate Values:
++            0 = 128sps
++            1 = 250sps
++            2 = 490sps
++            3 = 920sps
++            4 = 1600sps (default)
++            5 = 2400sps
++            6 = 3300sps
++            7 = 3300sps
++Load:   dtoverlay=draws,<param>=<val>
++Params: draws_adc_ch4_gain      Sets the full scale resolution of the ADCs
++                                input voltage sensor (default 1)
++
++        draws_adc_ch4_datarate  Sets the datarate of the ADCs input voltage
++                                sensor
++
++        draws_adc_ch5_gain      Sets the full scale resolution of the ADCs
++                                5V rail voltage sensor (default 1)
++
++        draws_adc_ch5_datarate  Sets the datarate of the ADCs 4V rail voltage
++                                sensor
++
++        draws_adc_ch6_gain      Sets the full scale resolution of the ADCs
++                                AIN2 input (default 2)
++
++        draws_adc_ch6_datarate  Sets the datarate of the ADCs AIN2 input
++
++        draws_adc_ch7_gain      Sets the full scale resolution of the ADCs
++                                AIN3 input (default 2)
++
++        draws_adc_ch7_datarate  Sets the datarate of the ADCs AIN3 input
++
++        alsaname                Name of the ALSA audio device (default "draws")
++
++
++Name:   dwc-otg
++Info:   Selects the dwc_otg USB controller driver which has fiq support. This
++        is the default on all except the Pi Zero which defaults to dwc2.
++Load:   dtoverlay=dwc-otg
++Params: <None>
++
++
++Name:   dwc2
++Info:   Selects the dwc2 USB controller driver
++Load:   dtoverlay=dwc2,<param>=<val>
++Params: dr_mode                 Dual role mode: "host", "peripheral" or "otg"
++
++        g-rx-fifo-size          Size of rx fifo size in gadget mode
++
++        g-np-tx-fifo-size       Size of non-periodic tx fifo size in gadget
++                                mode
++
++
++[ The ds1307-rtc overlay has been deleted. See i2c-rtc. ]
++
++
++Name:   edt-ft5406
++Info:   Overlay for the EDT FT5406 touchscreen on the CSI/DSI I2C interface.
++        This works with the Raspberry Pi 7" touchscreen when not being polled
++        by the firmware.
++        You MUST use either "disable_touchscreen=1" or "ignore_lcd=1" in
++        config.txt to stop the firmware polling the touchscreen.
++Load:   dtoverlay=edt-ft5406,<param>=<val>
++Params: sizex                   Touchscreen size x (default 800)
++        sizey                   Touchscreen size y (default 480)
++        invx                    Touchscreen inverted x axis
++        invy                    Touchscreen inverted y axis
++        swapxy                  Touchscreen swapped x y axis
++
++
++Name:   enc28j60
++Info:   Overlay for the Microchip ENC28J60 Ethernet Controller on SPI0
++Load:   dtoverlay=enc28j60,<param>=<val>
++Params: int_pin                 GPIO used for INT (default 25)
++
++        speed                   SPI bus speed (default 12000000)
++
++
++Name:   enc28j60-spi2
++Info:   Overlay for the Microchip ENC28J60 Ethernet Controller on SPI2
++Load:   dtoverlay=enc28j60-spi2,<param>=<val>
++Params: int_pin                 GPIO used for INT (default 39)
++
++        speed                   SPI bus speed (default 12000000)
++
++
++Name:   exc3000
++Info:   Enables I2C connected EETI EXC3000 multiple touch controller using
++        GPIO 4 (pin 7 on GPIO header) for interrupt.
++Load:   dtoverlay=exc3000,<param>=<val>
++Params: interrupt               GPIO used for interrupt (default 4)
++        sizex                   Touchscreen size x (default 4096)
++        sizey                   Touchscreen size y (default 4096)
++        invx                    Touchscreen inverted x axis
++        invy                    Touchscreen inverted y axis
++        swapxy                  Touchscreen swapped x y axis
++
++
++Name:   fbtft
++Info:   Overlay for SPI-connected displays using the fbtft drivers.
++
++        This overlay seeks to replace the functionality provided by fbtft_device
++        which is now gone from the kernel.
++
++        Most displays from fbtft_device have been ported over.
++        Example:
++          dtoverlay=fbtft,spi0-0,rpi-display,reset_pin=23,dc_pin=24,led_pin=18,rotate=270
++
++        It is also possible to specify the controller (this will use the default
++        init sequence in the driver).
++        Example:
++          dtoverlay=fbtft,spi0-0,ili9341,bgr,reset_pin=23,dc_pin=24,led_pin=18,rotate=270
++
++        For devices on spi1 or spi2, the interfaces should be enabled
++        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++
++        The following features of fbtft_device have not been ported over:
++        - parallel bus is not supported
++        - the init property which overrides the controller initialization
++          sequence is not supported as a parameter due to memory limitations in
++          the bootloader responsible for applying the overlay.
++
++        See https://github.com/notro/fbtft/wiki/FBTFT-RPI-overlays for how to
++        create an overlay.
++
++Load:   dtoverlay=fbtft,<param>=<val>
++Params:
++        spi<n>-<m>              Configure device at spi<n>, cs<m>
++                                (boolean, required)
++        speed                   SPI bus speed in Hz (default 32000000)
++        cpha                    Shifted clock phase (CPHA) mode
++        cpol                    Inverse clock polarity (CPOL) mode
++
++        adafruit18              Adafruit 1.8
++        adafruit22              Adafruit 2.2 (old)
++        adafruit22a             Adafruit 2.2
++        adafruit28              Adafruit 2.8
++        adafruit13m             Adafruit 1.3 OLED
++        admatec_c-berry28       C-Berry28
++        dogs102                 EA DOGS102
++        er_tftm050_2            ER-TFTM070-2
++        er_tftm070_5            ER-TFTM070-5
++        ew24ha0                 EW24HA0
++        ew24ha0_9bit            EW24HA0 in 9-bit mode
++        freetronicsoled128      Freetronics OLED128
++        hy28a                   HY28A
++        hy28b                   HY28B
++        itdb28_spi              ITDB02-2.8 with SPI interface circuit
++        mi0283qt-2              Watterott MI0283QT-2
++        mi0283qt-9a             Watterott MI0283QT-9A
++        nokia3310               Nokia 3310
++        nokia3310a              Nokia 3310a
++        nokia5110               Nokia 5110
++        piscreen                PiScreen
++        pitft                   Adafruit PiTFT 2.8
++        pioled                  ILSoft OLED
++        rpi-display             Watterott rpi-display
++        sainsmart18             Sainsmart 1.8
++        sainsmart32_spi         Sainsmart 3.2 with SPI interfce circuit
++        tinylcd35               TinyLCD 3.5
++        tm022hdh26              Tianma TM022HDH26
++        tontec35_9481           Tontect 3.5 with ILI9481 controller
++        tontec35_9486           Tontect 3.5 with ILI9486 controller
++        waveshare32b            Waveshare 3.2
++        waveshare22             Waveshare 2.2
++
++        bd663474                BD663474 display controller
++        hx8340bn                HX8340BN display controller
++        hx8347d                 HX8347D display controller
++        hx8353d                 HX8353D display controller
++        hx8357d                 HX8357D display controller
++        ili9163                 ILI9163 display controller
++        ili9320                 ILI9320 display controller
++        ili9325                 ILI9325 display controller
++        ili9340                 ILI9340 display controller
++        ili9341                 ILI9341 display controller
++        ili9481                 ILI9481 display controller
++        ili9486                 ILI9486 display controller
++        pcd8544                 PCD8544 display controller
++        ra8875                  RA8875 display controller
++        s6d02a1                 S6D02A1 display controller
++        s6d1121                 S6D1121 display controller
++        seps525                 SEPS525 display controller
++        sh1106                  SH1106 display controller
++        ssd1289                 SSD1289 display controller
++        ssd1305                 SSD1305 display controller
++        ssd1306                 SSD1306 display controller
++        ssd1325                 SSD1325 display controller
++        ssd1331                 SSD1331 display controller
++        ssd1351                 SSD1351 display controller
++        st7735r                 ST7735R display controller
++        st7789v                 ST7789V display controller
++        tls8204                 TLS8204 display controller
++        uc1611                  UC1611 display controller
++        uc1701                  UC1701 display controller
++        upd161704               UPD161704 display controller
++
++        width                   Display width in pixels
++        height                  Display height in pixels
++        regwidth                Display controller register width (default is
++                                driver specific)
++        buswidth                Display bus interface width (default 8)
++        debug                   Debug output level {0-7}
++        rotate                  Display rotation {0, 90, 180, 270} (counter
++                                clockwise). Not supported by all drivers.
++        bgr                     Enable BGR mode (default off). Use if Red and
++                                Blue are swapped. Not supported by all drivers.
++        fps                     Frames per second (default 30). In effect this
++                                states how long the driver will wait after video
++                                memory has been changed until display update
++                                transfer is started.
++        txbuflen                Length of the FBTFT transmit buffer
++                                (default 4096)
++        startbyte               Sets the Start byte used by fb_ili9320,
++                                fb_ili9325 and fb_hx8347d. Common value is 0x70.
++        gamma                   String representation of Gamma Curve(s). Driver
++                                specific. Not supported by all drivers.
++        reset_pin               GPIO pin for RESET
++        dc_pin                  GPIO pin for D/C
++        led_pin                 GPIO pin for LED backlight
++
++
++Name:   fe-pi-audio
++Info:   Configures the Fe-Pi Audio Sound Card
++Load:   dtoverlay=fe-pi-audio
++Params: <None>
++
++
++Name:   fsm-demo
++Info:   A demonstration of the gpio-fsm driver. The GPIOs are chosen to work
++        nicely with a "traffic-light" display of red, amber and green LEDs on
++        GPIOs 7, 8 and 25 respectively.
++Load:   dtoverlay=fsm-demo,<param>=<val>
++Params: fsm_debug               Enable debug logging (default off)
++
++
++Name:   gc9a01
++Info:   Enables GalaxyCore's GC9A01 single chip driver based displays on
++        SPI0 as fb1, using GPIOs DC=25, RST=27 and BL=18 (physical
++        GPIO header pins 22, 13 and 12 respectively) in addition to the
++        SPI0 pins DIN=10, CLK=11 and CS=8 (physical GPIO header pins 19,
++        23 and 24 respectively).
++Load:   dtoverlay=gc9a01,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        width                   Width of the display
++
++        height                  Height of the display
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++
++Name:   ghost-amp
++Info:   An overlay for the Ghost amplifier.
++Load:   dtoverlay=ghost-amp,<param>=<val>
++Params: fsm_debug               Enable debug logging of the GPIO FSM (default
++                                off)
++
++
++Name:   goodix
++Info:   Enables I2C connected Goodix gt9271 multiple touch controller using
++        GPIOs 4 and 17 (pins 7 and 11 on GPIO header) for interrupt and reset.
++Load:   dtoverlay=goodix,<param>=<val>
++Params: interrupt               GPIO used for interrupt (default 4)
++        reset                   GPIO used for reset (default 17)
++
++
++Name:   googlevoicehat-soundcard
++Info:   Configures the Google voiceHAT soundcard
++Load:   dtoverlay=googlevoicehat-soundcard
++Params: <None>
++
++
++Name:   gpio-fan
++Info:   Configure a GPIO pin to control a cooling fan.
++Load:   dtoverlay=gpio-fan,<param>=<val>
++Params: gpiopin                 GPIO used to control the fan (default 12)
++        temp                    Temperature at which the fan switches on, in
++                                millicelcius (default 55000)
++        hyst                    Temperature delta (in millicelcius) below
++                                temp at which the fan will drop to minrpm
++                                (default 10000)
++
++
++Name:   gpio-hog
++Info:   Activate a "hog" for a GPIO - request that the kernel configures it as
++        an output, driven low or high as indicated by the presence or absence
++        of the active_low parameter. Note that a hogged GPIO is not available
++        to other drivers or for gpioset/gpioget.
++Load:   dtoverlay=gpio-hog,<param>=<val>
++Params: gpio                    GPIO pin to hog (default 26)
++        active_low              If set, the hog drives the GPIO low (defaults
++                                to off - the GPIO is driven high)
++
++
++Name:   gpio-ir
++Info:   Use GPIO pin as rc-core style infrared receiver input. The rc-core-
++        based gpio_ir_recv driver maps received keys directly to a
++        /dev/input/event* device, all decoding is done by the kernel - LIRC is
++        not required! The key mapping and other decoding parameters can be
++        configured by "ir-keytable" tool.
++Load:   dtoverlay=gpio-ir,<param>=<val>
++Params: gpio_pin                Input pin number. Default is 18.
++
++        gpio_pull               Desired pull-up/down state (off, down, up)
++                                Default is "up".
++
++        invert                  "1" = invert the input (active-low signalling).
++                                "0" = non-inverted input (active-high
++                                signalling). Default is "1".
++
++        rc-map-name             Default rc keymap (can also be changed by
++                                ir-keytable), defaults to "rc-rc6-mce"
++
++
++Name:   gpio-ir-tx
++Info:   Use GPIO pin as bit-banged infrared transmitter output.
++        This is an alternative to "pwm-ir-tx". gpio-ir-tx doesn't require
++        a PWM so it can be used together with onboard analog audio.
++Load:   dtoverlay=gpio-ir-tx,<param>=<val>
++Params: gpio_pin                Output GPIO (default 18)
++
++        invert                  "1" = invert the output (make it active-low).
++                                Default is "0" (active-high).
++
++
++Name:   gpio-key
++Info:   This is a generic overlay for activating GPIO keypresses using
++        the gpio-keys library and this dtoverlay. Multiple keys can be
++        set up using multiple calls to the overlay for configuring
++        additional buttons or joysticks. You can see available keycodes
++        at https://github.com/torvalds/linux/blob/v4.12/include/uapi/
++        linux/input-event-codes.h#L64
++Load:   dtoverlay=gpio-key,<param>=<val>
++Params: gpio                    GPIO pin to trigger on (default 3)
++        active_low              When this is 1 (active low), a falling
++                                edge generates a key down event and a
++                                rising edge generates a key up event.
++                                When this is 0 (active high), this is
++                                reversed. The default is 1 (active low)
++        gpio_pull               Desired pull-up/down state (off, down, up)
++                                Default is "up". Note that the default pin
++                                (GPIO3) has an external pullup
++        label                   Set a label for the key
++        keycode                 Set the key code for the button
++
++
++
++Name:   gpio-led
++Info:   This is a generic overlay for activating LEDs (or any other component)
++        by a GPIO pin. Multiple LEDs can be set up using multiple calls to the
++        overlay. While there are many existing methods to activate LEDs on the
++        RPi, this method offers some advantages:
++        1) Does not require any userspace programs.
++        2) LEDs can be connected to the kernel's led-trigger framework,
++           and drive the LED based on triggers such as cpu load, heartbeat,
++           kernel panic, key input, timers and others.
++        3) LED can be tied to the input state of another GPIO pin.
++        4) The LED is setup early during the kernel boot process (useful
++           for cpu/heartbeat/panic triggers).
++
++        Typical electrical connection is:
++           RPI-GPIO.19  ->  LED  -> 300ohm resister  -> RPI-GND
++        The GPIO pin number can be changed with the 'gpio=' parameter.
++
++        To control an LED from userspace, write a 0 or 1 value:
++           echo 1 > /sys/class/leds/myled1/brightness
++        The 'myled1' name can be changed with the 'label=' parameter.
++
++        To connect the LED to a kernel trigger from userspace:
++           echo cpu > /sys/class/leds/myled1/trigger
++           echo heartbeat > /sys/class/leds/myled1/trigger
++           echo none > /sys/class/leds/myled1/trigger
++        To connect the LED to GPIO.26 pin (physical pin 37):
++           echo gpio > /sys/class/leds/myled1/trigger
++           echo 26 > /sys/class/leds/myled1/gpio
++        Available triggers:
++           cat /sys/class/leds/myled1/trigger
++
++        More information about the Linux kernel LED/Trigger system:
++           https://www.kernel.org/doc/Documentation/leds/leds-class.rst
++           https://www.kernel.org/doc/Documentation/leds/ledtrig-oneshot.rst
++Load:   dtoverlay=gpio-led,<param>=<val>
++Params: gpio                    GPIO pin connected to the LED (default 19)
++        label                   The label for this LED. It will appear under
++                                /sys/class/leds/<label> . Default 'myled1'.
++        trigger                 Set the led-trigger to connect to this LED.
++                                default 'none' (LED is user-controlled).
++                                Some possible triggers:
++                                 cpu - CPU load (all CPUs)
++                                 cpu0 - CPU load of first CPU.
++                                 mmc - disk activity (all disks)
++                                 panic - turn on on kernel panic
++                                 heartbeat - indicate system health
++                                 gpio - connect to a GPIO input pin (note:
++                                        currently the GPIO PIN can not be set
++                                        using overlay parameters, must be
++                                        done in userspace, see examples above.
++        active_low              Set to 1 to turn invert the LED control
++                                (writing 0 to /sys/class/leds/XXX/brightness
++                                will turn on the GPIO/LED). Default '0'.
++
++
++Name:   gpio-no-bank0-irq
++Info:   Use this overlay to disable GPIO interrupts for GPIOs in bank 0 (0-27),
++        which can be useful for UIO drivers.
++        N.B. Using this overlay will trigger a kernel WARN during booting, but
++        this can safely be ignored - the system should work as expected.
++Load:   dtoverlay=gpio-no-bank0-irq
++Params: <None>
++
++
++Name:   gpio-no-irq
++Info:   Use this overlay to disable all GPIO interrupts, which can be useful
++        for user-space GPIO edge detection systems.
++Load:   dtoverlay=gpio-no-irq
++Params: <None>
++
++
++Name:   gpio-poweroff
++Info:   Drives a GPIO high or low on poweroff (including halt). Using this
++        overlay interferes with the normal power-down sequence, preventing the
++        kernel from resetting the SoC (a necessary step in a normal power-off
++        or reboot). This also disables the ability to trigger a boot by driving
++        GPIO3 low.
++
++        The GPIO starts in an inactive state. At poweroff time it is driven
++        active for 100ms, then inactive for 100ms, then active again. It is
++        safe to remove the power at any point after the initial activation of
++        the GPIO.
++
++        Users of this overlay are required to provide an external mechanism to
++        switch off the power supply when signalled - failure to do so results
++        in a kernel BUG, increased power consumption and undefined behaviour.
++Load:   dtoverlay=gpio-poweroff,<param>=<val>
++Params: gpiopin                 GPIO for signalling (default 26)
++
++        active_low              Set if the power control device requires a
++                                high->low transition to trigger a power-down.
++                                Note that this will require the support of a
++                                custom dt-blob.bin to prevent a power-down
++                                during the boot process, and that a reboot
++                                will also cause the pin to go low.
++        input                   Set if the gpio pin should be configured as
++                                an input.
++        export                  Set to export the configured pin to sysfs
++        active_delay_ms         Initial GPIO active period (default 100)
++        inactive_delay_ms       Subsequent GPIO inactive period (default 100)
++        timeout_ms              Specify (in ms) how long the kernel waits for
++                                power-down before issuing a WARN (default 3000).
++
++
++Name:   gpio-shutdown
++Info:   Initiates a shutdown when GPIO pin changes. The given GPIO pin
++        is configured as an input key that generates KEY_POWER events.
++
++        This event is handled by systemd-logind by initiating a
++        shutdown. Systemd versions older than 225 need an udev rule
++        enable listening to the input device:
++
++                ACTION!="REMOVE", SUBSYSTEM=="input", KERNEL=="event*", \
++                        SUBSYSTEMS=="platform", DRIVERS=="gpio-keys", \
++                        ATTRS{keys}=="116", TAG+="power-switch"
++
++        Alternatively this event can be handled also on systems without
++        systemd, just by traditional SysV init daemon. KEY_POWER event
++        (keycode 116) needs to be mapped to KeyboardSignal on console
++        and then kb::kbrequest inittab action which is triggered by
++        KeyboardSignal from console can be configured to issue system
++        shutdown. Steps for this configuration are:
++
++            Add following lines to the /etc/console-setup/remap.inc file:
++
++                # Key Power as special keypress
++                keycode 116 = KeyboardSignal
++
++            Then add following lines to /etc/inittab file:
++
++                # Action on special keypress (Key Power)
++                kb::kbrequest:/sbin/shutdown -t1 -a -h -P now
++
++            And finally reload configuration by calling following commands:
++
++                # dpkg-reconfigure console-setup
++                # service console-setup reload
++                # init q
++
++        This overlay only handles shutdown. After shutdown, the system
++        can be powered up again by driving GPIO3 low. The default
++        configuration uses GPIO3 with a pullup, so if you connect a
++        button between GPIO3 and GND (pin 5 and 6 on the 40-pin header),
++        you get a shutdown and power-up button. Please note that
++        Raspberry Pi 1 Model B rev 1 uses GPIO1 instead of GPIO3.
++Load:   dtoverlay=gpio-shutdown,<param>=<val>
++Params: gpio_pin                GPIO pin to trigger on (default 3)
++                                For Raspberry Pi 1 Model B rev 1 set this
++                                explicitly to value 1, e.g.:
++
++                                    dtoverlay=gpio-shutdown,gpio_pin=1
++
++        active_low              When this is 1 (active low), a falling
++                                edge generates a key down event and a
++                                rising edge generates a key up event.
++                                When this is 0 (active high), this is
++                                reversed. The default is 1 (active low).
++
++        gpio_pull               Desired pull-up/down state (off, down, up)
++                                Default is "up".
++
++                                Note that the default pin (GPIO3) has an
++                                external pullup. Same applies for GPIO1
++                                on Raspberry Pi 1 Model B rev 1.
++
++        debounce                Specify the debounce interval in milliseconds
++                                (default 100)
++
++
++Name:   hd44780-lcd
++Info:   Configures an HD44780 compatible LCD display. Uses 4 gpio pins for
++        data, 2 gpio pins for enable and register select and 1 optional pin
++        for enabling/disabling the backlight display.
++Load:   dtoverlay=hd44780-lcd,<param>=<val>
++Params: pin_d4                  GPIO pin for data pin D4 (default 6)
++
++        pin_d5                  GPIO pin for data pin D5 (default 13)
++
++        pin_d6                  GPIO pin for data pin D6 (default 19)
++
++        pin_d7                  GPIO pin for data pin D7 (default 26)
++
++        pin_en                  GPIO pin for "Enable" (default 21)
++
++        pin_rs                  GPIO pin for "Register Select" (default 20)
++
++        pin_bl                  Optional pin for enabling/disabling the
++                                display backlight. (default disabled)
++
++        display_height          Height of the display in characters
++
++        display_width           Width of the display in characters
++
++
++Name:   hdmi-backlight-hwhack-gpio
++Info:   Devicetree overlay for GPIO based backlight on/off capability.
++        Use this if you have one of those HDMI displays whose backlight cannot
++        be controlled via DPMS over HDMI and plan to do a little soldering to
++        use an RPi gpio pin for on/off switching. See:
++        https://www.waveshare.com/wiki/7inch_HDMI_LCD_(C)#Backlight_Control
++Load:   dtoverlay=hdmi-backlight-hwhack-gpio,<param>=<val>
++Params: gpio_pin                GPIO pin used (default 17)
++        active_low              Set this to 1 if the display backlight is
++                                switched on when the wire goes low.
++                                Leave the default (value 0) if the backlight
++                                expects a high to switch it on.
++
++
++Name:   hifiberry-amp
++Info:   Configures the HifiBerry Amp and Amp+ audio cards
++Load:   dtoverlay=hifiberry-amp
++Params: <None>
++
++
++Name:   hifiberry-amp100
++Info:   Configures the HifiBerry AMP100 audio card
++Load:   dtoverlay=hifiberry-amp100,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=hifiberry-amp100,24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24dB_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++        slave                   Force DAC+ Pro into slave mode, using Pi as
++                                master for bit clock and frame clock.
++        leds_off                If set to 'true' the onboard indicator LEDs
++                                are switched off at all times.
++        auto_mute               If set to 'true' the amplifier is automatically
++                                muted when the DAC is not playing.
++        mute_ext_ctl            The amplifier's HW mute control is enabled
++                                in ALSA mixer and set to <val>.
++                                Will be overwritten by ALSA user settings.
++
++
++Name:   hifiberry-amp3
++Info:   Configures the HifiBerry Amp3 audio card
++Load:   dtoverlay=hifiberry-amp3
++Params: <None>
++
++
++Name:   hifiberry-dac
++Info:   Configures the HifiBerry DAC audio cards
++Load:   dtoverlay=hifiberry-dac
++Params: <None>
++
++
++Name:   hifiberry-dacplus
++Info:   Configures the HifiBerry DAC+ audio card
++Load:   dtoverlay=hifiberry-dacplus,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=hifiberry-dacplus,24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24dB_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++        slave                   Force DAC+ Pro into slave mode, using Pi as
++                                master for bit clock and frame clock.
++        leds_off                If set to 'true' the onboard indicator LEDs
++                                are switched off at all times.
++
++
++Name:   hifiberry-dacplusadc
++Info:   Configures the HifiBerry DAC+ADC audio card
++Load:   dtoverlay=hifiberry-dacplusadc,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=hifiberry-dacplus,24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24dB_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++        slave                   Force DAC+ Pro into slave mode, using Pi as
++                                master for bit clock and frame clock.
++        leds_off                If set to 'true' the onboard indicator LEDs
++                                are switched off at all times.
++
++
++Name:   hifiberry-dacplusadcpro
++Info:   Configures the HifiBerry DAC+ADC PRO audio card
++Load:   dtoverlay=hifiberry-dacplusadcpro,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=hifiberry-dacplusadcpro,24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24dB_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++        slave                   Force DAC+ADC Pro into slave mode, using Pi as
++                                master for bit clock and frame clock.
++        leds_off                If set to 'true' the onboard indicator LEDs
++                                are switched off at all times.
++
++
++Name:   hifiberry-dacplusdsp
++Info:   Configures the HifiBerry DAC+DSP audio card
++Load:   dtoverlay=hifiberry-dacplusdsp
++Params: <None>
++
++
++Name:   hifiberry-dacplushd
++Info:   Configures the HifiBerry DAC+ HD audio card
++Load:   dtoverlay=hifiberry-dacplushd
++Params: <None>
++
++
++Name:   hifiberry-digi
++Info:   Configures the HifiBerry Digi and Digi+ audio card
++Load:   dtoverlay=hifiberry-digi
++Params: <None>
++
++
++Name:   hifiberry-digi-pro
++Info:   Configures the HifiBerry Digi+ Pro audio card
++Load:   dtoverlay=hifiberry-digi-pro
++Params: <None>
++
++
++Name:   highperi
++Info:   Enables "High Peripheral" mode
++Load:   dtoverlay=highperi
++Params: <None>
++
++
++Name:   hy28a
++Info:   HY28A - 2.8" TFT LCD Display Module by HAOYU Electronics
++        Default values match Texy's display shield
++Load:   dtoverlay=hy28a,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++        xohms                   Touchpanel sensitivity (X-plate resistance)
++
++        resetgpio               GPIO used to reset controller
++
++        ledgpio                 GPIO used to control backlight
++
++
++Name:   hy28b
++Info:   HY28B - 2.8" TFT LCD Display Module by HAOYU Electronics
++        Default values match Texy's display shield
++Load:   dtoverlay=hy28b,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++        xohms                   Touchpanel sensitivity (X-plate resistance)
++
++        resetgpio               GPIO used to reset controller
++
++        ledgpio                 GPIO used to control backlight
++
++
++Name:   hy28b-2017
++Info:   HY28B 2017 version - 2.8" TFT LCD Display Module by HAOYU Electronics
++        Default values match Texy's display shield
++Load:   dtoverlay=hy28b-2017,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++        xohms                   Touchpanel sensitivity (X-plate resistance)
++
++        resetgpio               GPIO used to reset controller
++
++        ledgpio                 GPIO used to control backlight
++
++
++Name:   i-sabre-q2m
++Info:   Configures the Audiophonics I-SABRE Q2M DAC
++Load:   dtoverlay=i-sabre-q2m
++Params: <None>
++
++
++Name:   i2c-bcm2708
++Info:   Fall back to the i2c_bcm2708 driver for the i2c_arm bus.
++Load:   dtoverlay=i2c-bcm2708
++Params: <None>
++
++
++Name:   i2c-fan
++Info:   Adds support for a number of I2C fan controllers
++Load:   dtoverlay=i2c-fan,<param>=<val>
++Params: addr                    Sets the address for the fan controller. Note
++                                that the device must be configured to use the
++                                specified address.
++
++        i2c0                    Choose the I2C0 bus on GPIOs 0&1
++
++        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++
++        i2c3                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++
++        i2c4                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++
++        i2c5                    Choose the I2C5 bus (configure with the i2c4
++                                overlay - BCM2711 only)
++
++        i2c6                    Choose the I2C6 bus (configure with the i2c6
++                                overlay - BCM2711 only)
++
++        minpwm                  PWM setting for the fan when the SoC is below
++                                mintemp (range 0-255. default 0)
++        maxpwm                  PWM setting for the fan when the SoC is above
++                                maxtemp (range 0-255. default 255)
++        midtemp                 Temperature (in millicelcius) at which the fan
++                                begins to speed up (default 50000)
++
++        midtemp_hyst            Temperature delta (in millicelcius) below
++                                mintemp at which the fan will drop to minrpm
++                                (default 2000)
++
++        maxtemp                 Temperature (in millicelcius) at which the fan
++                                will be held at maxrpm (default 70000)
++
++        maxtemp_hyst            Temperature delta (in millicelcius) below
++                                maxtemp at which the fan begins to slow down
++                                (default 2000)
++
++        emc2301                 Select the Microchip EMC230x controller family
++                                - EMC2301, EMC2302, EMC2303, EMC2305.
++
++
++Name:   i2c-gpio
++Info:   Adds support for software i2c controller on gpio pins
++Load:   dtoverlay=i2c-gpio,<param>=<val>
++Params: i2c_gpio_sda            GPIO used for I2C data (default "23")
++
++        i2c_gpio_scl            GPIO used for I2C clock (default "24")
++
++        i2c_gpio_delay_us       Clock delay in microseconds
++                                (default "2" = ~100kHz)
++
++        bus                     Set to a unique, non-zero value if wanting
++                                multiple i2c-gpio busses. If set, will be used
++                                as the preferred bus number (/dev/i2c-<n>). If
++                                not set, the default value is 0, but the bus
++                                number will be dynamically assigned - probably
++                                3.
++
++
++Name:   i2c-mux
++Info:   Adds support for a number of I2C bus multiplexers on i2c_arm
++Load:   dtoverlay=i2c-mux,<param>=<val>
++Params: pca9542                 Select the NXP PCA9542 device
++
++        pca9545                 Select the NXP PCA9545 device
++
++        pca9548                 Select the NXP PCA9548 device
++
++        addr                    Change I2C address of the device (default 0x70)
++
++
++[ The i2c-mux-pca9548a overlay has been deleted. See i2c-mux. ]
++
++
++Name:   i2c-pwm-pca9685a
++Info:   Adds support for an NXP PCA9685A I2C PWM controller on i2c_arm
++Load:   dtoverlay=i2c-pwm-pca9685a,<param>=<val>
++Params: addr                    I2C address of PCA9685A (default 0x40)
++
++
++Name:   i2c-rtc
++Info:   Adds support for a number of I2C Real Time Clock devices
++Load:   dtoverlay=i2c-rtc,<param>=<val>
++Params: abx80x                  Select one of the ABx80x family:
++                                  AB0801, AB0803, AB0804, AB0805,
++                                  AB1801, AB1803, AB1804, AB1805
++
++        bq32000                 Select the TI BQ32000 device
++
++        ds1307                  Select the DS1307 device
++
++        ds1339                  Select the DS1339 device
++
++        ds1340                  Select the DS1340 device
++
++        ds3231                  Select the DS3231 device
++
++        m41t62                  Select the M41T62 device
++
++        mcp7940x                Select the MCP7940x device
++
++        mcp7941x                Select the MCP7941x device
++
++        pcf2127                 Select the PCF2127 device
++
++        pcf2129                 Select the PCF2129 device
++
++        pcf85063                Select the PCF85063 device
++
++        pcf85063a               Select the PCF85063A device
++
++        pcf8523                 Select the PCF8523 device
++
++        pcf85363                Select the PCF85363 device
++
++        pcf8563                 Select the PCF8563 device
++
++        rv1805                  Select the Micro Crystal RV1805 device
++
++        rv3028                  Select the Micro Crystal RV3028 device
++
++        rv8803                  Select the Micro Crystal RV8803 device
++
++        sd3078                  Select the ZXW Shenzhen whwave SD3078 device
++
++        s35390a                 Select the ABLIC S35390A device
++
++        i2c0                    Choose the I2C0 bus on GPIOs 0&1
++
++        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++
++        i2c3                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++
++        i2c4                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++
++        i2c5                    Choose the I2C5 bus (configure with the i2c4
++                                overlay - BCM2711 only)
++
++        i2c6                    Choose the I2C6 bus (configure with the i2c6
++                                overlay - BCM2711 only)
++
++        addr                    Sets the address for the RTC. Note that the
++                                device must be configured to use the specified
++                                address.
++
++        trickle-diode-disable   Do not use the internal trickle charger diode
++                                (BQ32000 only)
++
++        trickle-diode-type      Diode type for trickle charge - "standard" or
++                                "schottky" (ABx80x and RV1805 only)
++
++        trickle-resistor-ohms   Resistor value for trickle charge (DS1339,
++                                ABx80x, RV1805, RV3028)
++
++        wakeup-source           Specify that the RTC can be used as a wakeup
++                                source
++
++        backup-switchover-mode  Backup power supply switch mode. Must be 0 for
++                                off or 1 for Vdd < VBackup (RV3028 only)
++
++
++Name:   i2c-rtc-gpio
++Info:   Adds support for a number of I2C Real Time Clock devices
++        using the software i2c controller
++Load:   dtoverlay=i2c-rtc-gpio,<param>=<val>
++Params: abx80x                  Select one of the ABx80x family:
++                                  AB0801, AB0803, AB0804, AB0805,
++                                  AB1801, AB1803, AB1804, AB1805
++
++        bq32000                 Select the TI BQ32000 device
++
++        ds1307                  Select the DS1307 device
++
++        ds1339                  Select the DS1339 device
++
++        ds1340                  Select the DS1340 device
++
++        ds3231                  Select the DS3231 device
++
++        m41t62                  Select the M41T62 device
++
++        mcp7940x                Select the MCP7940x device
++
++        mcp7941x                Select the MCP7941x device
++
++        pcf2127                 Select the PCF2127 device
++
++        pcf2129                 Select the PCF2129 device
++
++        pcf85063                Select the PCF85063 device
++
++        pcf85063a               Select the PCF85063A device
++
++        pcf8523                 Select the PCF8523 device
++
++        pcf85363                Select the PCF85363 device
++
++        pcf8563                 Select the PCF8563 device
++
++        rv1805                  Select the Micro Crystal RV1805 device
++
++        rv3028                  Select the Micro Crystal RV3028 device
++
++        rv8803                  Select the Micro Crystal RV8803 device
++
++        sd3078                  Select the ZXW Shenzhen whwave SD3078 device
++
++        s35390a                 Select the ABLIC S35390A device
++
++        addr                    Sets the address for the RTC. Note that the
++                                device must be configured to use the specified
++                                address.
++
++        trickle-diode-disable   Do not use the internal trickle charger diode
++                                (BQ32000 only)
++
++        trickle-diode-type      Diode type for trickle charge - "standard" or
++                                "schottky" (ABx80x and RV1805 only)
++
++        trickle-resistor-ohms   Resistor value for trickle charge (DS1339,
++                                ABx80x, RV1805, RV3028)
++
++        wakeup-source           Specify that the RTC can be used as a wakeup
++                                source
++
++        backup-switchover-mode  Backup power supply switch mode. Must be 0 for
++                                off or 1 for Vdd < VBackup (RV3028 only)
++
++        i2c_gpio_sda            GPIO used for I2C data (default "23")
++
++        i2c_gpio_scl            GPIO used for I2C clock (default "24")
++
++        i2c_gpio_delay_us       Clock delay in microseconds
++                                (default "2" = ~100kHz)
++
++
++Name:   i2c-sensor
++Info:   Adds support for a number of I2C barometric pressure, temperature,
++        light level and chemical sensors on i2c_arm
++Load:   dtoverlay=i2c-sensor,<param>=<val>
++Params: addr                    Set the address for the BH1750, BME280, BME680,
++                                BMP280, CCS811, DS1621, HDC100X, LM75, SHT3x or
++                                TMP102
++
++        bh1750                  Select the Rohm BH1750 ambient light sensor
++                                Valid addresses 0x23 or 0x5c, default 0x23
++
++        bme280                  Select the Bosch Sensortronic BME280
++                                Valid addresses 0x76-0x77, default 0x76
++
++        bme680                  Select the Bosch Sensortronic BME680
++                                Valid addresses 0x76-0x77, default 0x76
++
++        bmp085                  Select the Bosch Sensortronic BMP085
++
++        bmp180                  Select the Bosch Sensortronic BMP180
++
++        bmp280                  Select the Bosch Sensortronic BMP280
++                                Valid addresses 0x76-0x77, default 0x76
++
++        ccs811                  Select the AMS CCS811 digital gas sensor
++                                Valid addresses 0x5a-0x5b, default 0x5b
++
++        ds1621                  Select the Dallas Semiconductors DS1621 temp
++                                sensor. Valid addresses 0x48-0x4f, default 0x48
++
++        hdc100x                 Select the Texas Instruments HDC100x temp sensor
++                                Valid addresses 0x40-0x43, default 0x40
++
++        htu21                   Select the HTU21 temperature and humidity sensor
++
++        int_pin                 Set the GPIO to use for interrupts (max30102
++                                only)
++
++        lm75                    Select the Maxim LM75 temperature sensor
++                                Valid addresses 0x48-0x4f, default 0x4f
++
++        lm75addr                Deprecated - use addr parameter instead
++
++        max17040                Select the Maxim Integrated MAX17040 battery
++                                monitor
++
++        max30102                Select the Maxim Integrated MAX30102 heart-rate
++                                and blood-oxygen sensor
++
++        sht3x                   Select the Sensiron SHT3x temperature and
++                                humidity sensor. Valid addresses 0x44-0x45,
++                                default 0x44
++
++        si7020                  Select the Silicon Labs Si7013/20/21 humidity/
++                                temperature sensor
++
++        sps30                   Select the Sensirion SPS30 particulate matter
++                                sensor. Fixed address 0x69.
++
++        sgp30                   Select the Sensirion SGP30 VOC sensor.
++                                Fixed address 0x58.
++
++        tmp102                  Select the Texas Instruments TMP102 temp sensor
++                                Valid addresses 0x48-0x4b, default 0x48
++
++        tsl4531                 Select the AMS TSL4531 digital ambient light
++                                sensor
++
++        veml6070                Select the Vishay VEML6070 ultraviolet light
++                                sensor
++
++        i2c0                    Choose the I2C0 bus on GPIOs 0&1
++
++        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++
++        i2c3                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++
++        i2c4                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++
++        i2c5                    Choose the I2C5 bus (configure with the i2c4
++                                overlay - BCM2711 only)
++
++        i2c6                    Choose the I2C6 bus (configure with the i2c6
++                                overlay - BCM2711 only)
++
++
++Name:   i2c0
++Info:   Change i2c0 pin usage. Not all pin combinations are usable on all
++        platforms - platforms other then Compute Modules can only use this
++        to disable transaction combining.
++        Do NOT use in conjunction with dtparam=i2c_vc=on. From the 5.4 kernel
++        onwards the base DT includes the use of i2c_mux_pinctrl to expose two
++        muxings of BSC0 - GPIOs 0&1, and whichever combination is used for the
++        camera and display connectors. This overlay disables that mux and
++        configures /dev/i2c0 to point at whichever set of pins is requested.
++        dtparam=i2c_vc=on will try and enable the mux, so combining the two
++        will cause conflicts.
++Load:   dtoverlay=i2c0,<param>=<val>
++Params: pins_0_1                Use pins 0 and 1 (default)
++        pins_28_29              Use pins 28 and 29
++        pins_44_45              Use pins 44 and 45
++        pins_46_47              Use pins 46 and 47
++        combine                 Allow transactions to be combined (default
++                                "yes")
++
++
++Name:   i2c0-bcm2708
++Info:   Deprecated, legacy version of i2c0.
++Load:   <Deprecated>
++
++
++Name:   i2c1
++Info:   Change i2c1 pin usage. Not all pin combinations are usable on all
++        platforms - platforms other then Compute Modules can only use this
++        to disable transaction combining.
++Load:   dtoverlay=i2c1,<param>=<val>
++Params: pins_2_3                Use pins 2 and 3 (default)
++        pins_44_45              Use pins 44 and 45
++        combine                 Allow transactions to be combined (default
++                                "yes")
++
++
++Name:   i2c1-bcm2708
++Info:   Deprecated, legacy version of i2c1.
++Load:   <Deprecated>
++
++
++Name:   i2c3
++Info:   Enable the i2c3 bus. BCM2711 only.
++Load:   dtoverlay=i2c3,<param>
++Params: pins_2_3                Use GPIOs 2 and 3
++        pins_4_5                Use GPIOs 4 and 5 (default)
++        baudrate                Set the baudrate for the interface (default
++                                "100000")
++
++
++Name:   i2c4
++Info:   Enable the i2c4 bus. BCM2711 only.
++Load:   dtoverlay=i2c4,<param>
++Params: pins_6_7                Use GPIOs 6 and 7
++        pins_8_9                Use GPIOs 8 and 9 (default)
++        baudrate                Set the baudrate for the interface (default
++                                "100000")
++
++
++Name:   i2c5
++Info:   Enable the i2c5 bus. BCM2711 only.
++Load:   dtoverlay=i2c5,<param>
++Params: pins_10_11              Use GPIOs 10 and 11
++        pins_12_13              Use GPIOs 12 and 13 (default)
++        baudrate                Set the baudrate for the interface (default
++                                "100000")
++
++
++Name:   i2c6
++Info:   Enable the i2c6 bus. BCM2711 only.
++Load:   dtoverlay=i2c6,<param>
++Params: pins_0_1                Use GPIOs 0 and 1
++        pins_22_23              Use GPIOs 22 and 23 (default)
++        baudrate                Set the baudrate for the interface (default
++                                "100000")
++
++
++Name:   i2s-dac
++Info:   Configures any passive I2S DAC soundcard.
++Load:   dtoverlay=i2s-dac
++Params: <None>
++
++
++Name:   i2s-gpio28-31
++Info:   move I2S function block to GPIO 28 to 31
++Load:   dtoverlay=i2s-gpio28-31
++Params: <None>
++
++
++Name:   ilitek251x
++Info:   Enables I2C connected Ilitek 251x multiple touch controller using
++        GPIO 4 (pin 7 on GPIO header) for interrupt.
++Load:   dtoverlay=ilitek251x,<param>=<val>
++Params: interrupt               GPIO used for interrupt (default 4)
++        sizex                   Touchscreen size x, horizontal resolution of
++                                touchscreen (in pixels)
++        sizey                   Touchscreen size y, vertical resolution of
++                                touchscreen (in pixels)
++
++
++Name:   imx219
++Info:   Sony IMX219 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=imx219,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 180)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++        vcm                     Configure a VCM focus drive on the sensor.
++
++
++Name:   imx258
++Info:   Sony IMX258 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=imx258,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 180)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++        vcm                     Configure a VCM focus drive on the sensor.
++        4lane                   Enable 4 CSI2 lanes. This requires a Compute
++                                Module (1, 3, or 4).
++
++
++Name:   imx290
++Info:   Sony IMX290 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=imx290,<param>
++Params: 4lane                   Enable 4 CSI2 lanes. This requires a Compute
++                                Module (1, 3, or 4).
++        clock-frequency         Sets the clock frequency to match that used on
++                                the board.
++                                Modules from Vision Components use 37.125MHz
++                                (the default), whilst those from Innomaker use
++                                74.25MHz.
++        mono                    Denote that the module is a mono sensor.
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   imx296
++Info:   Sony IMX296 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=imx296,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 180)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   imx327
++Info:   Sony IMX327 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=imx327,<param>
++Params: 4lane                   Enable 4 CSI2 lanes. This requires a Compute
++                                Module (1, 3, or 4).
++        clock-frequency         Sets the clock frequency to match that used on
++                                the board.
++                                Modules from Vision Components use 37.125MHz
++                                (the default), whilst those from Innomaker use
++                                74.25MHz.
++        mono                    Denote that the module is a mono sensor.
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   imx378
++Info:   Sony IMX378 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=imx378,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 180)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   imx462
++Info:   Sony IMX462 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=imx462,<param>
++Params: 4lane                   Enable 4 CSI2 lanes. This requires a Compute
++                                Module (1, 3, or 4).
++        clock-frequency         Sets the clock frequency to match that used on
++                                the board.
++                                Modules from Vision Components use 37.125MHz
++                                (the default), whilst those from Innomaker use
++                                74.25MHz.
++        mono                    Denote that the module is a mono sensor.
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   imx477
++Info:   Sony IMX477 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=imx477,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 180)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   imx519
++Info:   Sony IMX519 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=imx519,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   iqaudio-codec
++Info:   Configures the IQaudio Codec audio card
++Load:   dtoverlay=iqaudio-codec
++Params: <None>
++
++
++Name:   iqaudio-dac
++Info:   Configures the IQaudio DAC audio card
++Load:   dtoverlay=iqaudio-dac,<param>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=iqaudio-dac,24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24db_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++
++
++Name:   iqaudio-dacplus
++Info:   Configures the IQaudio DAC+ audio card
++Load:   dtoverlay=iqaudio-dacplus,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=iqaudio-dacplus,24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24db_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++        auto_mute_amp           If specified, unmute/mute the IQaudIO amp when
++                                starting/stopping audio playback.
++        unmute_amp              If specified, unmute the IQaudIO amp once when
++                                the DAC driver module loads.
++
++
++Name:   iqaudio-digi-wm8804-audio
++Info:   Configures the IQAudIO Digi WM8804 audio card
++Load:   dtoverlay=iqaudio-digi-wm8804-audio,<param>=<val>
++Params: card_name               Override the default, "IQAudIODigi", card name.
++        dai_name                Override the default, "IQAudIO Digi", dai name.
++        dai_stream_name         Override the default, "IQAudIO Digi HiFi",
++                                dai stream name.
++
++
++Name:   iqs550
++Info:   Enables I2C connected Azoteq IQS550 trackpad/touchscreen controller
++        using GPIO 4 (pin 7 on GPIO header) for interrupt.
++Load:   dtoverlay=iqs550,<param>=<val>
++Params: interrupt               GPIO used for interrupt (default 4)
++        reset                   GPIO used for reset (optional)
++        sizex                   Touchscreen size x (default 800)
++        sizey                   Touchscreen size y (default 480)
++        invx                    Touchscreen inverted x axis
++        invy                    Touchscreen inverted y axis
++        swapxy                  Touchscreen swapped x y axis
++
++
++Name:   irs1125
++Info:   Infineon irs1125 TOF camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=irs1125,<param>=<val>
++Params: media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default off)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   jedec-spi-nor
++Info:   Adds support for JEDEC-compliant SPI NOR flash devices.  (Note: The
++        "jedec,spi-nor" kernel driver was formerly known as "m25p80".)
++Load:   dtoverlay=jedec-spi-nor,<param>=<val>
++Params: flash-spi<n>-<m>        Enables flash device on SPI<n>, CS#<m>.
++        flash-fastr-spi<n>-<m>  Enables flash device with fast read capability
++                                on SPI<n>, CS#<m>.
++
++
++Name:   justboom-both
++Info:   Simultaneous usage of an justboom-dac and justboom-digi based
++        card
++Load:   dtoverlay=justboom-both,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=justboom-dac,24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24dB_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++
++
++Name:   justboom-dac
++Info:   Configures the JustBoom DAC HAT, Amp HAT, DAC Zero and Amp Zero audio
++        cards
++Load:   dtoverlay=justboom-dac,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=justboom-dac,24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24dB_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++
++
++Name:   justboom-digi
++Info:   Configures the JustBoom Digi HAT and Digi Zero audio cards
++Load:   dtoverlay=justboom-digi
++Params: <None>
++
++
++Name:   lirc-rpi
++Info:   This overlay has been deprecated and removed - see gpio-ir
++Load:   <Deprecated>
++
++
++Name:   ltc294x
++Info:   Adds support for the ltc294x family of battery gauges
++Load:   dtoverlay=ltc294x,<param>=<val>
++Params: ltc2941                 Select the ltc2941 device
++
++        ltc2942                 Select the ltc2942 device
++
++        ltc2943                 Select the ltc2943 device
++
++        ltc2944                 Select the ltc2944 device
++
++        resistor-sense          The sense resistor value in milli-ohms.
++                                Can be a 32-bit negative value when the battery
++                                has been connected to the wrong end of the
++                                resistor.
++
++        prescaler-exponent      Range and accuracy of the gauge. The value is
++                                programmed into the chip only if it differs
++                                from the current setting.
++                                For LTC2941 only:
++                                - Default value is 128
++                                - the exponent is in the range 0-7 (default 7)
++                                See the datasheet for more information.
++
++
++Name:   max98357a
++Info:   Configures the Maxim MAX98357A I2S DAC
++Load:   dtoverlay=max98357a,<param>=<val>
++Params: no-sdmode               Driver does not manage the state of the DAC's
++                                SD_MODE pin (i.e. chip is always on).
++        sdmode-pin              integer, GPIO pin connected to the SD_MODE input
++                                of the DAC (default GPIO4 if parameter omitted).
++
++
++Name:   maxtherm
++Info:   Configure a MAX6675, MAX31855 or MAX31856 thermocouple as an IIO device.
++
++        For devices on spi1 or spi2, the interfaces should be enabled
++        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++        The overlay expects to disable the relevant spidev node, so also using
++        e.g. cs0_spidev=off is unnecessary.
++
++        Example:
++        MAX31855 on /dev/spidev0.0
++            dtoverlay=maxtherm,spi0-0,max31855
++        MAX31856 using a type J thermocouple on /dev/spidev2.1
++            dtoverlay=spi2-2cs
++            dtoverlay=maxtherm,spi2-1,max31856,type_j
++
++Load:   dtoverlay=maxtherm,<param>=<val>
++Params: spi<n>-<m>              Configure device at spi<n>, cs<m>
++                                (boolean, required)
++        max6675                 Enable support for the MAX6675 (default)
++        max31855                Enable support for the MAX31855
++        max31855e               Enable support for the MAX31855E
++        max31855j               Enable support for the MAX31855J
++        max31855k               Enable support for the MAX31855K
++        max31855n               Enable support for the MAX31855N
++        max31855r               Enable support for the MAX31855R
++        max31855s               Enable support for the MAX31855S
++        max31855t               Enable support for the MAX31855T
++        max31856                Enable support for the MAX31856 (with type K)
++        type_b                  Select a type B sensor for max31856
++        type_e                  Select a type E sensor for max31856
++        type_j                  Select a type J sensor for max31856
++        type_k                  Select a type K sensor for max31856
++        type_n                  Select a type N sensor for max31856
++        type_r                  Select a type R sensor for max31856
++        type_s                  Select a type S sensor for max31856
++        type_t                  Select a type T sensor for max31856
++
++
++Name:   mbed-dac
++Info:   Configures the mbed AudioCODEC (TLV320AIC23B)
++Load:   dtoverlay=mbed-dac
++Params: <None>
++
++
++Name:   mcp23017
++Info:   Configures the MCP23017 I2C GPIO expander
++Load:   dtoverlay=mcp23017,<param>=<val>
++Params: gpiopin                 Gpio pin connected to the INTA output of the
++                                MCP23017 (default: 4)
++
++        addr                    I2C address of the MCP23017 (default: 0x20)
++
++        mcp23008                Configure an MCP23008 instead.
++        noints                  Disable the interrupt GPIO line.
++
++
++Name:   mcp23s17
++Info:   Configures the MCP23S08/17 SPI GPIO expanders.
++        If devices are present on SPI1 or SPI2, those interfaces must be enabled
++        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++        If interrupts are enabled for a device on a given CS# on a SPI bus, that
++        device must be the only one present on that SPI bus/CS#.
++Load:   dtoverlay=mcp23s17,<param>=<val>
++Params: s08-spi<n>-<m>-present  4-bit integer, bitmap indicating MCP23S08
++                                devices present on SPI<n>, CS#<m>
++
++        s17-spi<n>-<m>-present  8-bit integer, bitmap indicating MCP23S17
++                                devices present on SPI<n>, CS#<m>
++
++        s08-spi<n>-<m>-int-gpio integer, enables interrupts on a single
++                                MCP23S08 device on SPI<n>, CS#<m>, specifies
++                                the GPIO pin to which INT output of MCP23S08
++                                is connected.
++
++        s17-spi<n>-<m>-int-gpio integer, enables mirrored interrupts on a
++                                single MCP23S17 device on SPI<n>, CS#<m>,
++                                specifies the GPIO pin to which either INTA
++                                or INTB output of MCP23S17 is connected.
++
++
++Name:   mcp2515
++Info:   Configures the MCP2515 CAN controller on spi0/1/2
++        For devices on spi1 or spi2, the interfaces should be enabled
++        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++Load:   dtoverlay=mcp2515,<param>=<val>
++Params: spi<n>-<m>              Configure device at spi<n>, cs<m>
++                                (boolean, required)
++
++        oscillator              Clock frequency for the CAN controller (Hz)
++
++        speed                   Maximum SPI frequence (Hz)
++
++        interrupt               GPIO for interrupt signal
++
++
++Name:   mcp2515-can0
++Info:   Configures the MCP2515 CAN controller on spi0.0
++Load:   dtoverlay=mcp2515-can0,<param>=<val>
++Params: oscillator              Clock frequency for the CAN controller (Hz)
++
++        spimaxfrequency         Maximum SPI frequence (Hz)
++
++        interrupt               GPIO for interrupt signal
++
++
++Name:   mcp2515-can1
++Info:   Configures the MCP2515 CAN controller on spi0.1
++Load:   dtoverlay=mcp2515-can1,<param>=<val>
++Params: oscillator              Clock frequency for the CAN controller (Hz)
++
++        spimaxfrequency         Maximum SPI frequence (Hz)
++
++        interrupt               GPIO for interrupt signal
++
++
++Name:   mcp251xfd
++Info:   Configures the MCP251XFD CAN controller family
++        For devices on spi1 or spi2, the interfaces should be enabled
++        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++Load:   dtoverlay=mcp251xfd,<param>=<val>
++Params: spi<n>-<m>              Configure device at spi<n>, cs<m>
++                                (boolean, required)
++
++        oscillator              Clock frequency for the CAN controller (Hz)
++
++        speed                   Maximum SPI frequence (Hz)
++
++        interrupt               GPIO for interrupt signal
++
++        rx_interrupt            GPIO for RX interrupt signal (nINT1) (optional)
++
++        xceiver_enable          GPIO for CAN transceiver enable (optional)
++
++        xceiver_active_high     specifiy if CAN transceiver enable pin is
++                                active high (optional, default: active low)
++
++
++Name:   mcp3008
++Info:   Configures MCP3008 A/D converters
++        For devices on spi1 or spi2, the interfaces should be enabled
++        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++Load:   dtoverlay=mcp3008,<param>[=<val>]
++Params: spi<n>-<m>-present      boolean, configure device at spi<n>, cs<m>
++        spi<n>-<m>-speed        integer, set the spi bus speed for this device
++
++
++Name:   mcp3202
++Info:   Configures MCP3202 A/D converters
++        For devices on spi1 or spi2, the interfaces should be enabled
++        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++Load:   dtoverlay=mcp3202,<param>[=<val>]
++Params: spi<n>-<m>-present      boolean, configure device at spi<n>, cs<m>
++        spi<n>-<m>-speed        integer, set the spi bus speed for this device
++
++
++Name:   mcp342x
++Info:   Overlay for activation of Microchip MCP3421-3428 ADCs over I2C
++Load:   dtoverlay=mcp342x,<param>=<val>
++Params: addr                    I2C bus address of device, for devices with
++                                addresses that are configurable, e.g. by
++                                hardware links (default=0x68)
++        mcp3421                 The device is an MCP3421
++        mcp3422                 The device is an MCP3422
++        mcp3423                 The device is an MCP3423
++        mcp3424                 The device is an MCP3424
++        mcp3425                 The device is an MCP3425
++        mcp3426                 The device is an MCP3426
++        mcp3427                 The device is an MCP3427
++        mcp3428                 The device is an MCP3428
++
++
++Name:   media-center
++Info:   Media Center HAT - 2.83" Touch Display + extras by Pi Supply
++Load:   dtoverlay=media-center,<param>=<val>
++Params: speed                   Display SPI bus speed
++        rotate                  Display rotation {0,90,180,270}
++        fps                     Delay between frame updates
++        xohms                   Touchpanel sensitivity (X-plate resistance)
++        swapxy                  Swap x and y axis
++        backlight               Change backlight GPIO pin {e.g. 12, 18}
++        gpio_out_pin            GPIO for output (default "17")
++        gpio_in_pin             GPIO for input (default "18")
++        gpio_in_pull            Pull up/down/off on the input pin
++                                (default "down")
++        sense                   Override the IR receive auto-detection logic:
++                                 "0" = force active-high
++                                 "1" = force active-low
++                                 "-1" = use auto-detection
++                                (default "-1")
++        softcarrier             Turn the software carrier "on" or "off"
++                                (default "on")
++        invert                  "on" = invert the output pin (default "off")
++        debug                   "on" = enable additional debug messages
++                                (default "off")
++
++
++Name:   merus-amp
++Info:   Configures the merus-amp audio card
++Load:   dtoverlay=merus-amp
++Params: <None>
++
++
++Name:   midi-uart0
++Info:   Configures UART0 (ttyAMA0) so that a requested 38.4kbaud actually gets
++        31.25kbaud, the frequency required for MIDI
++Load:   dtoverlay=midi-uart0
++Params: <None>
++
++
++Name:   midi-uart1
++Info:   Configures UART1 (ttyS0) so that a requested 38.4kbaud actually gets
++        31.25kbaud, the frequency required for MIDI
++Load:   dtoverlay=midi-uart1
++Params: <None>
++
++
++Name:   midi-uart2
++Info:   Configures UART2 (ttyAMA1) so that a requested 38.4kbaud actually gets
++        31.25kbaud, the frequency required for MIDI
++Load:   dtoverlay=midi-uart2
++Params: <None>
++
++
++Name:   midi-uart3
++Info:   Configures UART3 (ttyAMA2) so that a requested 38.4kbaud actually gets
++        31.25kbaud, the frequency required for MIDI
++Load:   dtoverlay=midi-uart3
++Params: <None>
++
++
++Name:   midi-uart4
++Info:   Configures UART4 (ttyAMA3) so that a requested 38.4kbaud actually gets
++        31.25kbaud, the frequency required for MIDI
++Load:   dtoverlay=midi-uart4
++Params: <None>
++
++
++Name:   midi-uart5
++Info:   Configures UART5 (ttyAMA4) so that a requested 38.4kbaud actually gets
++        31.25kbaud, the frequency required for MIDI
++Load:   dtoverlay=midi-uart5
++Params: <None>
++
++
++Name:   minipitft13
++Info:   Overlay for AdaFruit Mini Pi 1.3" TFT via SPI using fbtft driver.
++Load:   dtoverlay=minipitft13,<param>=<val>
++Params: speed                   SPI bus speed (default 32000000)
++        rotate                  Display rotation (0, 90, 180 or 270; default 0)
++        width                   Display width (default 240)
++        height                  Display height (default 240)
++        fps                     Delay between frame updates (default 25)
++        debug                   Debug output level (0-7; default 0)
++
++
++Name:   miniuart-bt
++Info:   Switch the onboard Bluetooth function on Pi 3B, 3B+, 3A+, 4B and Zero W
++        to use the mini-UART (ttyS0) and restore UART0/ttyAMA0 over GPIOs 14 &
++        15. Note that this may reduce the maximum usable baudrate.
++        N.B. It is also necessary to edit /lib/systemd/system/hciuart.service
++        and replace ttyAMA0 with ttyS0, unless using Raspbian or another
++        distribution with udev rules that create /dev/serial0 and /dev/serial1,
++        in which case use /dev/serial1 instead because it will always be
++        correct. Furthermore, you must also set core_freq and core_freq_min to
++        the same value in config.txt or the miniuart will not work.
++Load:   dtoverlay=miniuart-bt,<param>=<val>
++Params: krnbt                   Set to "on" to enable autoprobing of Bluetooth
++                                driver without need of hciattach/btattach
++
++
++Name:   mipi-dbi-spi
++Info:   Overlay for SPI-connected MIPI DBI displays using the panel-mipi-dbi
++        driver. The driver will load a file /lib/firmware/panel.bin containing
++        the initialisation commands.
++
++        Example:
++          dtoverlay=mipi-dbi-spi,spi0-0,speed=70000000
++          dtparam=width=320,height=240
++          dtparam=reset-gpio=23,dc-gpio=24
++          dtparam=backlight-gpio=18
++
++        Compared to fbtft panel-mipi-dbi runs pixel data at spi-max-frequency
++        and init commands at 10MHz. This makes it possible to push the envelope
++        without messing up the controller configuration due to command
++        transmission errors.
++
++        For devices on spi1 or spi2, the interfaces should be enabled
++        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++
++        See https://github.com/notro/panel-mipi-dbi/wiki for more info.
++
++Load:   dtoverlay=mipi-dbi-spi,<param>=<val>
++Params:
++        compatible              Set the compatible string to load a different
++                                firmware file. Both the panel compatible value
++                                used to load the firmware file and the value
++                                used to load the driver has to be set having a
++                                NUL (\0) separator between them.
++                                Example:
++                                dtparam=compatible=mypanel\0panel-mipi-dbi-spi
++        spi<n>-<m>              Configure device at spi<n>, cs<m>
++                                (boolean, required)
++        speed                   SPI bus speed in Hz (default 32000000)
++        cpha                    Shifted SPI clock phase (CPHA) mode
++        cpol                    Inverse SPI clock polarity (CPOL) mode
++        write-only              Controller is not readable
++                                (ie. MISO is not wired up).
++
++        width                   Panel width in pixels (required)
++        height                  Panel height in pixels (required)
++        width-mm                Panel width in mm
++        height-mm               Panel height in mm
++        x-offset                Panel x-offset in controller RAM
++        y-offset                Panel y-offset in controller RAM
++
++        clock-frequency         Panel clock frequency in Hz
++                                (optional, just informational).
++
++        reset-gpio              GPIO pin to be used for RESET
++        dc-gpio                 GPIO pin to be used for D/C
++
++        backlight-gpio          GPIO pin to be used for backlight control
++                                (default of none).
++        backlight-pwm           PWM channel to be used for backlight control
++                                (default of none). NB Disables audio headphone
++                                output as that also uses PWM.
++        backlight-pwm-chan      Choose channel on &pwm node for backlight
++                                control (default 0).
++        backlight-pwm-gpio      GPIO pin to be used for the PWM backlight. See
++                                pwm-2chan for valid options (default 18).
++        backlight-pwm-func      Pin function of GPIO used for the PWM backlight.
++                                See pwm-2chan for valid options (default 2).
++        backlight-def-brightness
++                                Set the default brightness. Normal range 1-16.
++                                (default 16).
++
++
++Name:   mlx90640
++Info:   Overlay for i2c connected mlx90640 thermal camera
++Load:   dtoverlay=mlx90640
++Params: <None>
++
++
++Name:   mmc
++Info:   Selects the bcm2835-mmc SD/MMC driver, optionally with overclock
++Load:   dtoverlay=mmc,<param>=<val>
++Params: overclock_50            Clock (in MHz) to use when the MMC framework
++                                requests 50MHz
++
++
++Name:   mpu6050
++Info:   Overlay for i2c connected mpu6050 imu
++Load:   dtoverlay=mpu6050,<param>=<val>
++Params: interrupt               GPIO pin for interrupt (default 4)
++        addr                    I2C address of the device (default 0x68)
++
++
++Name:   mz61581
++Info:   MZ61581 display by Tontec
++Load:   dtoverlay=mz61581,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        txbuflen                Transmit buffer length (default 32768)
++
++        debug                   Debug output level {0-7}
++
++        xohms                   Touchpanel sensitivity (X-plate resistance)
++
++
++Name:   ov2311
++Info:   Omnivision OV2311 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=ov2311,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   ov5647
++Info:   Omnivision OV5647 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=ov5647,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++        vcm                     Configure a VCM focus drive on the sensor.
++
++
++Name:   ov7251
++Info:   Omnivision OV7251 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=ov7251,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default off)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   ov9281
++Info:   Omnivision OV9281 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=ov9281,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   papirus
++Info:   PaPiRus ePaper Screen by Pi Supply (both HAT and pHAT)
++Load:   dtoverlay=papirus,<param>=<val>
++Params: panel                   Display panel (required):
++                                1.44": e1144cs021
++                                2.0":  e2200cs021
++                                2.7":  e2271cs021
++
++        speed                   Display SPI bus speed
++
++
++Name:   pca953x
++Info:   TI PCA953x family of I2C GPIO expanders. Default is for NXP PCA9534.
++Load:   dtoverlay=pca953x,<param>=<val>
++Params: addr                    I2C address of expander. Default 0x20.
++        pca6416                 Select the NXP PCA6416 (16 bit)
++        pca9505                 Select the NXP PCA9505 (40 bit)
++        pca9535                 Select the NXP PCA9535 (16 bit)
++        pca9536                 Select the NXP PCA9536 or TI PCA9536 (4 bit)
++        pca9537                 Select the NXP PCA9537 (4 bit)
++        pca9538                 Select the NXP PCA9538 (8 bit)
++        pca9539                 Select the NXP PCA9539 (16 bit)
++        pca9554                 Select the NXP PCA9554 (8 bit)
++        pca9555                 Select the NXP PCA9555 (16 bit)
++        pca9556                 Select the NXP PCA9556 (8 bit)
++        pca9557                 Select the NXP PCA9557 (8 bit)
++        pca9574                 Select the NXP PCA9574 (8 bit)
++        pca9575                 Select the NXP PCA9575 (16 bit)
++        pca9698                 Select the NXP PCA9698 (40 bit)
++        pca16416                Select the NXP PCA16416 (16 bit)
++        pca16524                Select the NXP PCA16524 (24 bit)
++        pca19555a               Select the NXP PCA19555A (16 bit)
++        max7310                 Select the Maxim MAX7310 (8 bit)
++        max7312                 Select the Maxim MAX7312 (16 bit)
++        max7313                 Select the Maxim MAX7313 (16 bit)
++        max7315                 Select the Maxim MAX7315 (8 bit)
++        pca6107                 Select the TI PCA6107 (8 bit)
++        tca6408                 Select the TI TCA6408 (8 bit)
++        tca6416                 Select the TI TCA6416 (16 bit)
++        tca6424                 Select the TI TCA6424 (24 bit)
++        tca9539                 Select the TI TCA9539 (16 bit)
++        tca9554                 Select the TI TCA9554 (8 bit)
++        cat9554                 Select the Onnn CAT9554 (8 bit)
++        pca9654                 Select the Onnn PCA9654 (8 bit)
++        xra1202                 Select the Exar XRA1202 (8 bit)
++
++
++Name:   pcie-32bit-dma
++Info:   Force PCIe config to support 32bit DMA addresses at the expense of
++        having to bounce buffers.
++Load:   dtoverlay=pcie-32bit-dma
++Params: <None>
++
++
++[ The pcf2127-rtc overlay has been deleted. See i2c-rtc. ]
++
++
++[ The pcf8523-rtc overlay has been deleted. See i2c-rtc. ]
++
++
++[ The pcf8563-rtc overlay has been deleted. See i2c-rtc. ]
++
++
++Name:   pi3-act-led
++Info:   This overlay has been renamed act-led, keeping pi3-act-led as an alias
++        for backwards compatibility.
++Load:   <Deprecated>
++
++
++Name:   pi3-disable-bt
++Info:   This overlay has been renamed disable-bt, keeping pi3-disable-bt as an
++        alias for backwards compatibility.
++Load:   <Deprecated>
++
++
++Name:   pi3-disable-wifi
++Info:   This overlay has been renamed disable-wifi, keeping pi3-disable-wifi as
++        an alias for backwards compatibility.
++Load:   <Deprecated>
++
++
++Name:   pi3-miniuart-bt
++Info:   This overlay has been renamed miniuart-bt, keeping pi3-miniuart-bt as
++        an alias for backwards compatibility.
++Load:   <Deprecated>
++
++
++Name:   pibell
++Info:   Configures the pibell audio card.
++Load:   dtoverlay=pibell,<param>=<val>
++Params: alsaname                Set the name as it appears in ALSA (default
++                                "PiBell")
++
++
++Name:   pifacedigital
++Info:   Configures the PiFace Digital mcp23s17 GPIO port expander.
++Load:   dtoverlay=pifacedigital,<param>=<val>
++Params: spi-present-mask        8-bit integer, bitmap indicating MCP23S17 SPI0
++                                CS0 address. PiFace Digital supports addresses
++                                0-3, which can be configured with JP1 and JP2.
++
++
++Name:   pifi-40
++Info:   Configures the PiFi 40W stereo amplifier
++Load:   dtoverlay=pifi-40
++Params: <None>
++
++
++Name:   pifi-dac-hd
++Info:   Configures the PiFi DAC HD
++Load:   dtoverlay=pifi-dac-hd
++Params: <None>
++
++
++Name:   pifi-dac-zero
++Info:   Configures the PiFi DAC Zero
++Load:   dtoverlay=pifi-dac-zero
++Params: <None>
++
++
++Name:   pifi-mini-210
++Info:   Configures the PiFi Mini stereo amplifier
++Load:   dtoverlay=pifi-mini-210
++Params: <None>
++
++
++Name:   piglow
++Info:   Configures the PiGlow by pimoroni.com
++Load:   dtoverlay=piglow
++Params: <None>
++
++
++Name:   piscreen
++Info:   PiScreen display by OzzMaker.com
++Load:   dtoverlay=piscreen,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++        xohms                   Touchpanel sensitivity (X-plate resistance)
++
++
++Name:   piscreen2r
++Info:   PiScreen 2 with resistive TP display by OzzMaker.com
++Load:   dtoverlay=piscreen2r,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++        xohms                   Touchpanel sensitivity (X-plate resistance)
++
++
++Name:   pisound
++Info:   Configures the Blokas Labs pisound card
++Load:   dtoverlay=pisound
++Params: <None>
++
++
++Name:   pitft22
++Info:   Adafruit PiTFT 2.2" screen
++Load:   dtoverlay=pitft22,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++
++Name:   pitft28-capacitive
++Info:   Adafruit PiTFT 2.8" capacitive touch screen
++Load:   dtoverlay=pitft28-capacitive,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++        touch-sizex             Touchscreen size x (default 240)
++
++        touch-sizey             Touchscreen size y (default 320)
++
++        touch-invx              Touchscreen inverted x axis
++
++        touch-invy              Touchscreen inverted y axis
++
++        touch-swapxy            Touchscreen swapped x y axis
++
++
++Name:   pitft28-resistive
++Info:   Adafruit PiTFT 2.8" resistive touch screen
++Load:   dtoverlay=pitft28-resistive,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++        drm                     Force the use of the mi0283qt DRM driver (by
++                                default the ili9340 framebuffer driver will
++                                be used in preference if available)
++
++
++Name:   pitft35-resistive
++Info:   Adafruit PiTFT 3.5" resistive touch screen
++Load:   dtoverlay=pitft35-resistive,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++        drm                     Force the use of the hx8357d DRM driver (by
++                                default the fb_hx8357d framebuffer driver will
++                                be used in preference if available)
++
++
++Name:   pps-gpio
++Info:   Configures the pps-gpio (pulse-per-second time signal via GPIO).
++Load:   dtoverlay=pps-gpio,<param>=<val>
++Params: gpiopin                 Input GPIO (default "18")
++        assert_falling_edge     When present, assert is indicated by a falling
++                                edge, rather than by a rising edge (default
++                                off)
++        capture_clear           Generate clear events on the trailing edge
++                                (default off)
++        pull                    Desired pull-up/down state (off, down, up)
++                                Default is "off".
++
++
++Name:   proto-codec
++Info:   Configures the PROTO Audio Codec card
++Load:   dtoverlay=proto-codec
++Params: <None>
++
++
++Name:   pwm
++Info:   Configures a single PWM channel
++        Legal pin,function combinations for each channel:
++          PWM0: 12,4(Alt0) 18,2(Alt5) 40,4(Alt0)            52,5(Alt1)
++          PWM1: 13,4(Alt0) 19,2(Alt5) 41,4(Alt0) 45,4(Alt0) 53,5(Alt1)
++        N.B.:
++          1) Pin 18 is the only one available on all platforms, and
++             it is the one used by the I2S audio interface.
++             Pins 12 and 13 might be better choices on an A+, B+ or Pi2.
++          2) The onboard analogue audio output uses both PWM channels.
++          3) So be careful mixing audio and PWM.
++          4) Currently the clock must have been enabled and configured
++             by other means.
++Load:   dtoverlay=pwm,<param>=<val>
++Params: pin                     Output pin (default 18) - see table
++        func                    Pin function (default 2 = Alt5) - see above
++        clock                   PWM clock frequency (informational)
++
++
++Name:   pwm-2chan
++Info:   Configures both PWM channels
++        Legal pin,function combinations for each channel:
++          PWM0: 12,4(Alt0) 18,2(Alt5) 40,4(Alt0)            52,5(Alt1)
++          PWM1: 13,4(Alt0) 19,2(Alt5) 41,4(Alt0) 45,4(Alt0) 53,5(Alt1)
++        N.B.:
++          1) Pin 18 is the only one available on all platforms, and
++             it is the one used by the I2S audio interface.
++             Pins 12 and 13 might be better choices on an A+, B+ or Pi2.
++          2) The onboard analogue audio output uses both PWM channels.
++          3) So be careful mixing audio and PWM.
++          4) Currently the clock must have been enabled and configured
++             by other means.
++Load:   dtoverlay=pwm-2chan,<param>=<val>
++Params: pin                     Output pin (default 18) - see table
++        pin2                    Output pin for other channel (default 19)
++        func                    Pin function (default 2 = Alt5) - see above
++        func2                   Function for pin2 (default 2 = Alt5)
++        clock                   PWM clock frequency (informational)
++
++
++Name:   pwm-ir-tx
++Info:   Use GPIO pin as pwm-assisted infrared transmitter output.
++        This is an alternative to "gpio-ir-tx". pwm-ir-tx makes use
++        of PWM0 to reduce the CPU load during transmission compared to
++        gpio-ir-tx which uses bit-banging.
++        Legal pin,function combinations are:
++          12,4(Alt0) 18,2(Alt5) 40,4(Alt0) 52,5(Alt1)
++Load:   dtoverlay=pwm-ir-tx,<param>=<val>
++Params: gpio_pin                Output GPIO (default 18)
++
++        func                    Pin function (default 2 = Alt5)
++
++
++Name:   qca7000
++Info:   in-tech's Evaluation Board for PLC Stamp micro
++        This uses spi0 and a separate GPIO interrupt to connect the QCA7000.
++Load:   dtoverlay=qca7000,<param>=<val>
++Params: int_pin                 GPIO pin for interrupt signal (default 23)
++
++        speed                   SPI bus speed (default 12 MHz)
++
++
++Name:   qca7000-uart0
++Info:   in-tech's Evaluation Board for PLC Stamp micro (UART)
++        This uses uart0/ttyAMA0 over GPIOs 14 & 15 to connect the QCA7000.
++        But it requires disabling of onboard Bluetooth on
++        Pi 3B, 3B+, 3A+, 4B and Zero W.
++Load:   dtoverlay=qca7000-uart0,<param>=<val>
++Params: baudrate                Set the baudrate for the UART (default
++                                "115200")
++
++
++Name:   ramoops
++Info:   Enable the preservation of crash logs across a reboot. With
++        systemd-pstore enabled (as it is on Raspberry Pi OS) the crash logs
++        are moved to /var/lib/systemd/pstore/ on reboot.
++Load:   dtoverlay=ramoops,<param>=<val>
++Params: base-addr               Where to place the capture buffer (default
++                                0x0b000000)
++        total-size              How much memory to allocate altogether (in
++                                bytes - default 64kB)
++        record-size             How much space to use for each capture, i.e.
++                                total-size / record-size = number of captures
++                                (default 16kB)
++        console-size            Size of non-panic dmesg captures (default 0)
++
++
++Name:   ramoops-pi4
++Info:   The version of the ramoops overlay for the Pi 4 family. It should be
++        loaded automatically if dtoverlay=ramoops is specified on a Pi 4.
++Load:   dtoverlay=ramoops-pi4,<param>=<val>
++Params: base-addr               Where to place the capture buffer (default
++                                0x0b000000)
++        total-size              How much memory to allocate altogether (in
++                                bytes - default 64kB)
++        record-size             How much space to use for each capture, i.e.
++                                total-size / record-size = number of captures
++                                (default 16kB)
++        console-size            Size of non-panic dmesg captures (default 0)
++
++
++Name:   rotary-encoder
++Info:   Overlay for GPIO connected rotary encoder.
++Load:   dtoverlay=rotary-encoder,<param>=<val>
++Params: pin_a                   GPIO connected to rotary encoder channel A
++                                (default 4).
++        pin_b                   GPIO connected to rotary encoder channel B
++                                (default 17).
++        relative_axis           register a relative axis rather than an
++                                absolute one. Relative axis will only
++                                generate +1/-1 events on the input device,
++                                hence no steps need to be passed.
++        linux_axis              the input subsystem axis to map to this
++                                rotary encoder. Defaults to 0 (ABS_X / REL_X)
++        rollover                Automatic rollover when the rotary value
++                                becomes greater than the specified steps or
++                                smaller than 0. For absolute axis only.
++        steps-per-period        Number of steps (stable states) per period.
++                                The values have the following meaning:
++                                1: Full-period mode (default)
++                                2: Half-period mode
++                                4: Quarter-period mode
++        steps                   Number of steps in a full turnaround of the
++                                encoder. Only relevant for absolute axis.
++                                Defaults to 24 which is a typical value for
++                                such devices.
++        wakeup                  Boolean, rotary encoder can wake up the
++                                system.
++        encoding                String, the method used to encode steps.
++                                Supported are "gray" (the default and more
++                                common) and "binary".
++
++
++Name:   rpi-backlight
++Info:   Raspberry Pi official display backlight driver
++Load:   dtoverlay=rpi-backlight
++Params: <None>
++
++
++Name:   rpi-cirrus-wm5102
++Info:   This overlay has been renamed to cirrus-wm5102
++Load:   <Deprecated>
++
++
++Name:   rpi-codeczero
++Info:   Configures the Raspberry Pi Codec Zero sound card
++Load:   dtoverlay=rpi-codeczero
++Params: <None>
++
++
++Name:   rpi-dac
++Info:   This overlay has been renaamed to i2s-dac.
++Load:   <Deprecated>
++
++
++Name:   rpi-dacplus
++Info:   Configures the Raspberry Pi DAC+ card
++Load:   dtoverlay=rpi-dacplus,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                digital volume control. Enable by adding
++                                "dtparam=24db_digital_gain" to config.txt
++                                before any "dtoverlay" lines.
++                                The default behaviour is that the digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24db_digital_gain parameter, the digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the digital volume control is set to a value
++                                that does not result in clipping/distortion!
++
++
++Name:   rpi-dacpro
++Info:   Configures the Raspberry Pi DAC Pro sound card
++Load:   dtoverlay=rpi-dacpro,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                digital volume control. Enable by adding
++                                "dtparam=24db_digital_gain" to config.txt
++                                before any "dtoverlay" lines.
++                                The default behaviour is that the digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24db_digital_gain parameter, the digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the digital volume control is set to a value
++                                that does not result in clipping/distortion!
++
++
++Name:   rpi-digiampplus
++Info:   Configures the Raspberry Pi DigiAMP+ sound card
++Load:   dtoverlay=rpi-digiampplus,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                digital volume control. Enable by adding
++                                "dtparam=24db_digital_gain" to config.txt
++                                before any "dtoverlay" lines.
++                                The default behaviour is that the digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24db_digital_gain parameter, the digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the digital volume control is set to a value
++                                that does not result in clipping/distortion!
++        auto_mute_amp           If specified, unmute/mute the DigiAMP+ when
++                                starting/stopping audio playback (default "on").
++        unmute_amp              If specified, unmute the DigiAMP+ amp once when
++                                the DAC driver module loads (default "off").
++
++
++Name:   rpi-display
++Info:   This overlay has been renamed to watterott-display
++Load:   <Deprecated>
++
++
++Name:   rpi-ft5406
++Info:   Official Raspberry Pi display touchscreen
++Load:   dtoverlay=rpi-ft5406,<param>=<val>
++Params: touchscreen-size-x      Touchscreen X resolution (default 800)
++        touchscreen-size-y      Touchscreen Y resolution (default 600);
++        touchscreen-inverted-x  Invert touchscreen X coordinates (default 0);
++        touchscreen-inverted-y  Invert touchscreen Y coordinates (default 0);
++        touchscreen-swapped-x-y Swap X and Y cordinates (default 0);
++
++
++Name:   rpi-poe
++Info:   Raspberry Pi PoE HAT fan
++Load:   dtoverlay=rpi-poe,<param>[=<val>]
++Params: poe_fan_temp0           Temperature (in millicelcius) at which the fan
++                                turns on (default 40000)
++        poe_fan_temp0_hyst      Temperature delta (in millicelcius) at which
++                                the fan turns off (default 2000)
++        poe_fan_temp1           Temperature (in millicelcius) at which the fan
++                                speeds up (default 45000)
++        poe_fan_temp1_hyst      Temperature delta (in millicelcius) at which
++                                the fan slows down (default 2000)
++        poe_fan_temp2           Temperature (in millicelcius) at which the fan
++                                speeds up (default 50000)
++        poe_fan_temp2_hyst      Temperature delta (in millicelcius) at which
++                                the fan slows down (default 2000)
++        poe_fan_temp3           Temperature (in millicelcius) at which the fan
++                                speeds up (default 55000)
++        poe_fan_temp3_hyst      Temperature delta (in millicelcius) at which
++                                the fan slows down (default 5000)
++        i2c                     Control the fan via Linux I2C drivers instead of
++                                the firmware.
++
++
++Name:   rpi-poe-plus
++Info:   Raspberry Pi PoE+ HAT fan
++Load:   dtoverlay=rpi-poe-plus,<param>[=<val>]
++Params: poe_fan_temp0           Temperature (in millicelcius) at which the fan
++                                turns on (default 40000)
++        poe_fan_temp0_hyst      Temperature delta (in millicelcius) at which
++                                the fan turns off (default 2000)
++        poe_fan_temp1           Temperature (in millicelcius) at which the fan
++                                speeds up (default 45000)
++        poe_fan_temp1_hyst      Temperature delta (in millicelcius) at which
++                                the fan slows down (default 2000)
++        poe_fan_temp2           Temperature (in millicelcius) at which the fan
++                                speeds up (default 50000)
++        poe_fan_temp2_hyst      Temperature delta (in millicelcius) at which
++                                the fan slows down (default 2000)
++        poe_fan_temp3           Temperature (in millicelcius) at which the fan
++                                speeds up (default 55000)
++        poe_fan_temp3_hyst      Temperature delta (in millicelcius) at which
++                                the fan slows down (default 5000)
++        i2c                     Control the fan via Linux I2C drivers instead of
++                                the firmware.
++
++
++Name:   rpi-proto
++Info:   This overlay has been renamaed to proto-codec.
++Load:   <Deprecated>
++
++
++Name:   rpi-sense
++Info:   Raspberry Pi Sense HAT
++Load:   dtoverlay=rpi-sense
++Params: <None>
++
++
++Name:   rpi-sense-v2
++Info:   Raspberry Pi Sense HAT v2
++Load:   dtoverlay=rpi-sense-v2
++Params: <None>
++
++
++Name:   rpi-tv
++Info:   Raspberry Pi TV HAT
++Load:   dtoverlay=rpi-tv
++Params: <None>
++
++
++Name:   rpivid-v4l2
++Info:   This overlay has been deprecated and deleted as the V4L2 stateless
++        video decoder driver is enabled by default.
++Load:   <Deprecated>
++
++
++Name:   rra-digidac1-wm8741-audio
++Info:   Configures the Red Rocks Audio DigiDAC1 soundcard
++Load:   dtoverlay=rra-digidac1-wm8741-audio
++Params: <None>
++
++
++Name:   sainsmart18
++Info:   Overlay for the SPI-connected Sainsmart 1.8" display (based on the
++        ST7735R chip).
++Load:   dtoverlay=sainsmart18,<param>=<val>
++Params: rotate                  Display rotation {0,90,180,270}
++        speed                   SPI bus speed in Hz (default 4000000)
++        fps                     Display frame rate in Hz
++        bgr                     Enable BGR mode (default off)
++        debug                   Debug output level {0-7}
++        dc_pin                  GPIO pin for D/C (default 24)
++        reset_pin               GPIO pin for RESET (default 25)
++
++
++Name:   sc16is750-i2c
++Info:   Overlay for the NXP SC16IS750 UART with I2C Interface
++        Enables the chip on I2C1 at 0x48 (or the "addr" parameter value). To
++        select another address, please refer to table 10 in reference manual.
++Load:   dtoverlay=sc16is750-i2c,<param>=<val>
++Params: int_pin                 GPIO used for IRQ (default 24)
++        addr                    Address (default 0x48)
++        xtal                    On-board crystal frequency (default 14745600)
++
++
++Name:   sc16is752-i2c
++Info:   Overlay for the NXP SC16IS752 dual UART with I2C Interface
++        Enables the chip on I2C1 at 0x48 (or the "addr" parameter value). To
++        select another address, please refer to table 10 in reference manual.
++Load:   dtoverlay=sc16is752-i2c,<param>=<val>
++Params: int_pin                 GPIO used for IRQ (default 24)
++        addr                    Address (default 0x48)
++        xtal                    On-board crystal frequency (default 14745600)
++
++
++Name:   sc16is752-spi0
++Info:   Overlay for the NXP SC16IS752 Dual UART with SPI Interface
++        Enables the chip on SPI0.
++Load:   dtoverlay=sc16is752-spi0,<param>=<val>
++Params: int_pin                 GPIO used for IRQ (default 24)
++        xtal                    On-board crystal frequency (default 14745600)
++
++
++Name:   sc16is752-spi1
++Info:   Overlay for the NXP SC16IS752 Dual UART with SPI Interface
++        Enables the chip on SPI1.
++        N.B.: spi1 is only accessible on devices with a 40pin header, eg:
++              A+, B+, Zero and PI2 B; as well as the Compute Module.
++
++Load:   dtoverlay=sc16is752-spi1,<param>=<val>
++Params: int_pin                 GPIO used for IRQ (default 24)
++        xtal                    On-board crystal frequency (default 14745600)
++
++
++Name:   sdhost
++Info:   Selects the bcm2835-sdhost SD/MMC driver, optionally with overclock.
++        N.B. This overlay is designed for situations where the mmc driver is
++        the default, so it disables the other (mmc) interface - this will kill
++        WLAN on a Pi3. If this isn't what you want, either use the sdtweak
++        overlay or the new sd_* dtparams of the base DTBs.
++Load:   dtoverlay=sdhost,<param>=<val>
++Params: overclock_50            Clock (in MHz) to use when the MMC framework
++                                requests 50MHz
++
++        force_pio               Disable DMA support (default off)
++
++        pio_limit               Number of blocks above which to use DMA
++                                (default 1)
++
++        debug                   Enable debug output (default off)
++
++
++Name:   sdio
++Info:   Selects the bcm2835-sdhost SD/MMC driver, optionally with overclock,
++        and enables SDIO via GPIOs 22-27. An example of use in 1-bit mode is
++        "dtoverlay=sdio,bus_width=1,gpios_22_25"
++Load:   dtoverlay=sdio,<param>=<val>
++Params: sdio_overclock          SDIO Clock (in MHz) to use when the MMC
++                                framework requests 50MHz
++
++        poll_once               Disable SDIO-device polling every second
++                                (default on: polling once at boot-time)
++
++        bus_width               Set the SDIO host bus width (default 4 bits)
++
++        gpios_22_25             Select GPIOs 22-25 for 1-bit mode. Must be used
++                                with bus_width=1. This replaces the sdio-1bit
++                                overlay, which is now deprecated.
++
++        gpios_34_37             Select GPIOs 34-37 for 1-bit mode. Must be used
++                                with bus_width=1.
++
++        gpios_34_39             Select GPIOs 34-39 for 4-bit mode. Must be used
++                                with bus_width=4 (the default).
++
++
++Name:   sdio-1bit
++Info:   This overlay is now deprecated. Use
++        "dtoverlay=sdio,bus_width=1,gpios_22_25" instead.
++Load:   <Deprecated>
++
++
++Name:   sdtweak
++Info:   This overlay is now deprecated. Use the sd_* dtparams in the
++        base DTB, e.g. "dtoverlay=sdtweak,poll_once" becomes
++        "dtparam=sd_poll_once".
++Load:   <Deprecated>
++
++
++Name:   seeed-can-fd-hat-v1
++Info:   Overlay for Seeed Studio CAN BUS FD HAT with two CAN FD
++        channels without RTC. Use this overlay if your HAT has no
++        battery holder.
++        https://www.seeedstudio.com/2-Channel-CAN-BUS-FD-Shield-for-Raspberry-Pi-p-4072.html
++Load:   dtoverlay=seeed-can-fd-hat-v1
++Params: <None>
++
++
++Name:   seeed-can-fd-hat-v2
++Info:   Overlay for Seeed Studio CAN BUS FD HAT with two CAN FD
++        channels and an RTC. Use this overlay if your HAT has a
++        battery holder.
++        https://www.seeedstudio.com/CAN-BUS-FD-HAT-for-Raspberry-Pi-p-4742.html
++Load:   dtoverlay=seeed-can-fd-hat-v2
++Params: <None>
++
++
++Name:   sh1106-spi
++Info:   Overlay for SH1106 OLED via SPI using fbtft staging driver.
++Load:   dtoverlay=sh1106-spi,<param>=<val>
++Params: speed                   SPI bus speed (default 4000000)
++        rotate                  Display rotation (0, 90, 180 or 270; default 0)
++        fps                     Delay between frame updates (default 25)
++        debug                   Debug output level (0-7; default 0)
++        dc_pin                  GPIO pin for D/C (default 24)
++        reset_pin               GPIO pin for RESET (default 25)
++        height                  Display height (32 or 64; default 64)
++
++
++Name:   si446x-spi0
++Info:   Overlay for Si446x UHF Transceiver via SPI using si446x driver.
++        The driver is currently out-of-tree at
++        https://github.com/sunipkmukherjee/silabs.git
++Load:   dtoverlay=si446x-spi0,<param>=<val>
++Params: speed                   SPI bus speed (default 4000000)
++        int_pin                 GPIO pin for interrupts (default 17)
++        reset_pin               GPIO pin for RESET (default 27)
++
++
++Name:   smi
++Info:   Enables the Secondary Memory Interface peripheral. Uses GPIOs 2-25!
++Load:   dtoverlay=smi
++Params: <None>
++
++
++Name:   smi-dev
++Info:   Enables the userspace interface for the SMI driver
++Load:   dtoverlay=smi-dev
++Params: <None>
++
++
++Name:   smi-nand
++Info:   Enables access to NAND flash via the SMI interface
++Load:   dtoverlay=smi-nand
++Params: <None>
++
++
++Name:   spi-gpio35-39
++Info:   Move SPI function block to GPIO 35 to 39
++Load:   dtoverlay=spi-gpio35-39
++Params: <None>
++
++
++Name:   spi-gpio40-45
++Info:   Move SPI function block to GPIOs 40 to 45
++Load:   dtoverlay=spi-gpio40-45
++Params: <None>
++
++
++Name:   spi-rtc
++Info:   Adds support for a number of SPI Real Time Clock devices
++Load:   dtoverlay=spi-rtc,<param>=<val>
++Params: ds3232                  Select the DS3232 device
++        ds3234                  Select the DS3234 device
++        pcf2123                 Select the PCF2123 device
++
++        spi0_0                  Use spi0.0 (default)
++        spi0_1                  Use spi0.1
++        spi1_0                  Use spi1.0
++        spi1_1                  Use spi1.1
++        spi2_0                  Use spi2.0
++        spi2_1                  Use spi2.1
++        cs_high                 This device requires an active-high CS
++
++
++Name:   spi0-0cs
++Info:   Don't claim any CS pins for SPI0. Requires a device with its chip
++        select permanently enabled, but frees a GPIO for e.g. a DPI display.
++Load:   dtoverlay=spi0-0cs,<param>=<val>
++Params: no_miso                 Don't claim and use the MISO pin (9), freeing
++                                it for other uses.
++
++
++Name:   spi0-1cs
++Info:   Only use one CS pin for SPI0
++Load:   dtoverlay=spi0-1cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 8)
++        no_miso                 Don't claim and use the MISO pin (9), freeing
++                                it for other uses.
++
++
++Name:   spi0-2cs
++Info:   Change the CS pins for SPI0
++Load:   dtoverlay=spi0-2cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 8)
++        cs1_pin                 GPIO pin for CS1 (default 7)
++        no_miso                 Don't claim and use the MISO pin (9), freeing
++                                it for other uses.
++
++
++Name:   spi0-cs
++Info:   This overlay has been renamed spi0-2cs, keeping spi0-cs as an
++        alias for backwards compatibility.
++Load:   <Deprecated>
++
++
++Name:   spi0-hw-cs
++Info:   This overlay has been deprecated and removed because it is no longer
++        necessary and has been seen to prevent spi0 from working.
++Load:   <Deprecated>
++
++
++Name:   spi1-1cs
++Info:   Enables spi1 with a single chip select (CS) line and associated spidev
++        dev node. The gpio pin number for the CS line and spidev device node
++        creation are configurable.
++        N.B.: spi1 is only accessible on devices with a 40pin header, eg:
++              A+, B+, Zero and PI2 B; as well as the Compute Module.
++Load:   dtoverlay=spi1-1cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 18 - BCM SPI1_CE0).
++        cs0_spidev              Set to 'disabled' to stop the creation of a
++                                userspace device node /dev/spidev1.0 (default
++                                is 'okay' or enabled).
++
++
++Name:   spi1-2cs
++Info:   Enables spi1 with two chip select (CS) lines and associated spidev
++        dev nodes. The gpio pin numbers for the CS lines and spidev device node
++        creation are configurable.
++        N.B.: spi1 is only accessible on devices with a 40pin header, eg:
++              A+, B+, Zero and PI2 B; as well as the Compute Module.
++Load:   dtoverlay=spi1-2cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 18 - BCM SPI1_CE0).
++        cs1_pin                 GPIO pin for CS1 (default 17 - BCM SPI1_CE1).
++        cs0_spidev              Set to 'disabled' to stop the creation of a
++                                userspace device node /dev/spidev1.0 (default
++                                is 'okay' or enabled).
++        cs1_spidev              Set to 'disabled' to stop the creation of a
++                                userspace device node /dev/spidev1.1 (default
++                                is 'okay' or enabled).
++
++
++Name:   spi1-3cs
++Info:   Enables spi1 with three chip select (CS) lines and associated spidev
++        dev nodes. The gpio pin numbers for the CS lines and spidev device node
++        creation are configurable.
++        N.B.: spi1 is only accessible on devices with a 40pin header, eg:
++              A+, B+, Zero and PI2 B; as well as the Compute Module.
++Load:   dtoverlay=spi1-3cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 18 - BCM SPI1_CE0).
++        cs1_pin                 GPIO pin for CS1 (default 17 - BCM SPI1_CE1).
++        cs2_pin                 GPIO pin for CS2 (default 16 - BCM SPI1_CE2).
++        cs0_spidev              Set to 'disabled' to stop the creation of a
++                                userspace device node /dev/spidev1.0 (default
++                                is 'okay' or enabled).
++        cs1_spidev              Set to 'disabled' to stop the creation of a
++                                userspace device node /dev/spidev1.1 (default
++                                is 'okay' or enabled).
++        cs2_spidev              Set to 'disabled' to stop the creation of a
++                                userspace device node /dev/spidev1.2 (default
++                                is 'okay' or enabled).
++
++
++Name:   spi2-1cs
++Info:   Enables spi2 with a single chip select (CS) line and associated spidev
++        dev node. The gpio pin number for the CS line and spidev device node
++        creation are configurable.
++        N.B.: spi2 is only accessible with the Compute Module.
++Load:   dtoverlay=spi2-1cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 43 - BCM SPI2_CE0).
++        cs0_spidev              Set to 'disabled' to stop the creation of a
++                                userspace device node /dev/spidev2.0 (default
++                                is 'okay' or enabled).
++
++
++Name:   spi2-2cs
++Info:   Enables spi2 with two chip select (CS) lines and associated spidev
++        dev nodes. The gpio pin numbers for the CS lines and spidev device node
++        creation are configurable.
++        N.B.: spi2 is only accessible with the Compute Module.
++Load:   dtoverlay=spi2-2cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 43 - BCM SPI2_CE0).
++        cs1_pin                 GPIO pin for CS1 (default 44 - BCM SPI2_CE1).
++        cs0_spidev              Set to 'disabled' to stop the creation of a
++                                userspace device node /dev/spidev2.0 (default
++                                is 'okay' or enabled).
++        cs1_spidev              Set to 'disabled' to stop the creation of a
++                                userspace device node /dev/spidev2.1 (default
++                                is 'okay' or enabled).
++
++
++Name:   spi2-3cs
++Info:   Enables spi2 with three chip select (CS) lines and associated spidev
++        dev nodes. The gpio pin numbers for the CS lines and spidev device node
++        creation are configurable.
++        N.B.: spi2 is only accessible with the Compute Module.
++Load:   dtoverlay=spi2-3cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 43 - BCM SPI2_CE0).
++        cs1_pin                 GPIO pin for CS1 (default 44 - BCM SPI2_CE1).
++        cs2_pin                 GPIO pin for CS2 (default 45 - BCM SPI2_CE2).
++        cs0_spidev              Set to 'disabled' to stop the creation of a
++                                userspace device node /dev/spidev2.0 (default
++                                is 'okay' or enabled).
++        cs1_spidev              Set to 'disabled' to stop the creation of a
++                                userspace device node /dev/spidev2.1 (default
++                                is 'okay' or enabled).
++        cs2_spidev              Set to 'disabled' to stop the creation of a
++                                userspace device node /dev/spidev2.2 (default
++                                is 'okay' or enabled).
++
++
++Name:   spi3-1cs
++Info:   Enables spi3 with a single chip select (CS) line and associated spidev
++        dev node. The gpio pin number for the CS line and spidev device node
++        creation are configurable. BCM2711 only.
++Load:   dtoverlay=spi3-1cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 0 - BCM SPI3_CE0).
++        cs0_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev3.0 (default
++                                is 'on' or enabled).
++
++
++Name:   spi3-2cs
++Info:   Enables spi3 with two chip select (CS) lines and associated spidev
++        dev nodes. The gpio pin numbers for the CS lines and spidev device node
++        creation are configurable. BCM2711 only.
++Load:   dtoverlay=spi3-2cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 0 - BCM SPI3_CE0).
++        cs1_pin                 GPIO pin for CS1 (default 24 - BCM SPI3_CE1).
++        cs0_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev3.0 (default
++                                is 'on' or enabled).
++        cs1_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev3.1 (default
++                                is 'on' or enabled).
++
++
++Name:   spi4-1cs
++Info:   Enables spi4 with a single chip select (CS) line and associated spidev
++        dev node. The gpio pin number for the CS line and spidev device node
++        creation are configurable. BCM2711 only.
++Load:   dtoverlay=spi4-1cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 4 - BCM SPI4_CE0).
++        cs0_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev4.0 (default
++                                is 'on' or enabled).
++
++
++Name:   spi4-2cs
++Info:   Enables spi4 with two chip select (CS) lines and associated spidev
++        dev nodes. The gpio pin numbers for the CS lines and spidev device node
++        creation are configurable. BCM2711 only.
++Load:   dtoverlay=spi4-2cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 4 - BCM SPI4_CE0).
++        cs1_pin                 GPIO pin for CS1 (default 25 - BCM SPI4_CE1).
++        cs0_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev4.0 (default
++                                is 'on' or enabled).
++        cs1_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev4.1 (default
++                                is 'on' or enabled).
++
++
++Name:   spi5-1cs
++Info:   Enables spi5 with a single chip select (CS) line and associated spidev
++        dev node. The gpio pin numbers for the CS lines and spidev device node
++        creation are configurable. BCM2711 only.
++Load:   dtoverlay=spi5-1cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 12 - BCM SPI5_CE0).
++        cs0_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev5.0 (default
++                                is 'on' or enabled).
++
++
++Name:   spi5-2cs
++Info:   Enables spi5 with two chip select (CS) lines and associated spidev
++        dev nodes. The gpio pin numbers for the CS lines and spidev device node
++        creation are configurable. BCM2711 only.
++Load:   dtoverlay=spi5-2cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 12 - BCM SPI5_CE0).
++        cs1_pin                 GPIO pin for CS1 (default 26 - BCM SPI5_CE1).
++        cs0_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev5.0 (default
++                                is 'on' or enabled).
++        cs1_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev5.1 (default
++                                is 'on' or enabled).
++
++
++Name:   spi6-1cs
++Info:   Enables spi6 with a single chip select (CS) line and associated spidev
++        dev node. The gpio pin number for the CS line and spidev device node
++        creation are configurable. BCM2711 only.
++Load:   dtoverlay=spi6-1cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 18 - BCM SPI6_CE0).
++        cs0_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev6.0 (default
++                                is 'on' or enabled).
++
++
++Name:   spi6-2cs
++Info:   Enables spi6 with two chip select (CS) lines and associated spidev
++        dev nodes. The gpio pin numbers for the CS lines and spidev device node
++        creation are configurable. BCM2711 only.
++Load:   dtoverlay=spi6-2cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 18 - BCM SPI6_CE0).
++        cs1_pin                 GPIO pin for CS1 (default 27 - BCM SPI6_CE1).
++        cs0_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev6.0 (default
++                                is 'on' or enabled).
++        cs1_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev6.1 (default
++                                is 'on' or enabled).
++
++
++Name:   ssd1306
++Info:   Overlay for activation of SSD1306 over I2C OLED display framebuffer.
++Load:   dtoverlay=ssd1306,<param>=<val>
++Params: address                 Location in display memory of first character.
++                                (default=0)
++        width                   Width of display. (default=128)
++        height                  Height of display. (default=64)
++        offset                  virtual channel a. (default=0)
++        normal                  Has no effect on displays tested. (default=not
++                                set)
++        sequential              Set this if every other scan line is missing.
++                                (default=not set)
++        remapped                Set this if display is garbled. (default=not
++                                set)
++        inverted                Set this if display is inverted and mirrored.
++                                (default=not set)
++
++        Examples:
++        Typical usage for 128x64 display: dtoverlay=ssd1306,inverted
++
++        Typical usage for 128x32 display: dtoverlay=ssd1306,inverted,sequential
++
++        i2c_baudrate=400000 will speed up the display.
++
++        i2c_baudrate=1000000 seems to work even though it's not officially
++        supported by the hardware, and is faster still.
++
++        For more information refer to the device datasheet at:
++        https://cdn-shop.adafruit.com/datasheets/SSD1306.pdf
++
++
++Name:   ssd1306-spi
++Info:   Overlay for SSD1306 OLED via SPI using fbtft staging driver.
++Load:   dtoverlay=ssd1306-spi,<param>=<val>
++Params: speed                   SPI bus speed (default 10000000)
++        rotate                  Display rotation (0, 90, 180 or 270; default 0)
++        fps                     Delay between frame updates (default 25)
++        debug                   Debug output level (0-7; default 0)
++        dc_pin                  GPIO pin for D/C (default 24)
++        reset_pin               GPIO pin for RESET (default 25)
++        height                  Display height (32 or 64; default 64)
++
++
++Name:   ssd1331-spi
++Info:   Overlay for SSD1331 OLED via SPI using fbtft staging driver.
++Load:   dtoverlay=ssd1331-spi,<param>=<val>
++Params: speed                   SPI bus speed (default 4500000)
++        rotate                  Display rotation (0, 90, 180 or 270; default 0)
++        fps                     Delay between frame updates (default 25)
++        debug                   Debug output level (0-7; default 0)
++        dc_pin                  GPIO pin for D/C (default 24)
++        reset_pin               GPIO pin for RESET (default 25)
++
++
++Name:   ssd1351-spi
++Info:   Overlay for SSD1351 OLED via SPI using fbtft staging driver.
++Load:   dtoverlay=ssd1351-spi,<param>=<val>
++Params: speed                   SPI bus speed (default 4500000)
++        rotate                  Display rotation (0, 90, 180 or 270; default 0)
++        fps                     Delay between frame updates (default 25)
++        debug                   Debug output level (0-7; default 0)
++        dc_pin                  GPIO pin for D/C (default 24)
++        reset_pin               GPIO pin for RESET (default 25)
++
++
++Name:   superaudioboard
++Info:   Configures the SuperAudioBoard sound card
++Load:   dtoverlay=superaudioboard,<param>=<val>
++Params: gpiopin                 GPIO pin for codec reset
++
++
++Name:   sx150x
++Info:   Configures the Semtech SX150X I2C GPIO expanders.
++Load:   dtoverlay=sx150x,<param>=<val>
++Params: sx150<x>-<n>-<m>        Enables SX150X device on I2C#<n> with slave
++                                address <m>. <x> may be 1-9. <n> may be 0 or 1.
++                                Permissible values of <m> (which is denoted in
++                                hex) depend on the device variant. For SX1501,
++                                SX1502, SX1504 and SX1505, <m> may be 20 or 21.
++                                For SX1503 and SX1506, <m> may be 20. For
++                                SX1507 and SX1509, <m> may be 3E, 3F, 70 or 71.
++                                For SX1508, <m> may be 20, 21, 22 or 23.
++
++        sx150<x>-<n>-<m>-int-gpio
++                                Integer, enables interrupts on SX150X device on
++                                I2C#<n> with slave address <m>, specifies
++                                the GPIO pin to which NINT output of SX150X is
++                                connected.
++
++
++Name:   tc358743
++Info:   Toshiba TC358743 HDMI to CSI-2 bridge chip.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=tc358743,<param>=<val>
++Params: 4lane                   Use 4 lanes (only applicable to Compute Modules
++                                CAM1 connector).
++
++        link-frequency          Set the link frequency. Only values of 297000000
++                                (574Mbit/s) and 486000000 (972Mbit/s - default)
++                                are supported by the driver.
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default off)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   tc358743-audio
++Info:   Used in combination with the tc358743-fast overlay to route the audio
++        from the TC358743 over I2S to the Pi.
++        Wiring is LRCK/WFS to GPIO 19, BCK/SCK to GPIO 18, and DATA/SD to GPIO
++        20.
++Load:   dtoverlay=tc358743-audio,<param>=<val>
++Params: card-name               Override the default, "tc358743", card name.
++
++
++Name:   tinylcd35
++Info:   3.5" Color TFT Display by www.tinylcd.com
++        Options: Touch, RTC, keypad
++Load:   dtoverlay=tinylcd35,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++        touch                   Enable touch panel
++
++        touchgpio               Touch controller IRQ GPIO
++
++        xohms                   Touchpanel: Resistance of X-plate in ohms
++
++        rtc-pcf                 PCF8563 Real Time Clock
++
++        rtc-ds                  DS1307 Real Time Clock
++
++        keypad                  Enable keypad
++
++        Examples:
++            Display with touchpanel, PCF8563 RTC and keypad:
++                dtoverlay=tinylcd35,touch,rtc-pcf,keypad
++            Old touch display:
++                dtoverlay=tinylcd35,touch,touchgpio=3
++
++
++Name:   tpm-slb9670
++Info:   Enables support for Infineon SLB9670 Trusted Platform Module add-on
++        boards, which can be used as a secure key storage and hwrng,
++        available as "Iridium SLB9670" by Infineon and "LetsTrust TPM" by pi3g.
++Load:   dtoverlay=tpm-slb9670
++Params: <None>
++
++
++Name:   tpm-slb9673
++Info:   Enables support for Infineon SLB9673 Trusted Platform Module add-on
++        boards, which can be used as a secure key storage and hwrng
++        via the I2C protocol.
++Load:   dtoverlay=tpm-slb9673
++Params: <None>
++
++
++Name:   uart0
++Info:   Change the pin usage of uart0
++Load:   dtoverlay=uart0,<param>=<val>
++Params: txd0_pin                GPIO pin for TXD0 (14, 32 or 36 - default 14)
++
++        rxd0_pin                GPIO pin for RXD0 (15, 33 or 37 - default 15)
++
++        pin_func                Alternative pin function - 4(Alt0) for 14&15,
++                                7(Alt3) for 32&33, 6(Alt2) for 36&37
++
++
++Name:   uart1
++Info:   Change the pin usage of uart1
++Load:   dtoverlay=uart1,<param>=<val>
++Params: txd1_pin                GPIO pin for TXD1 (14, 32 or 40 - default 14)
++
++        rxd1_pin                GPIO pin for RXD1 (15, 33 or 41 - default 15)
++
++
++Name:   uart2
++Info:   Enable uart 2 on GPIOs 0-3. BCM2711 only.
++Load:   dtoverlay=uart2,<param>
++Params: ctsrts                  Enable CTS/RTS on GPIOs 2-3 (default off)
++
++
++Name:   uart3
++Info:   Enable uart 3 on GPIOs 4-7. BCM2711 only.
++Load:   dtoverlay=uart3,<param>
++Params: ctsrts                  Enable CTS/RTS on GPIOs 6-7 (default off)
++
++
++Name:   uart4
++Info:   Enable uart 4 on GPIOs 8-11. BCM2711 only.
++Load:   dtoverlay=uart4,<param>
++Params: ctsrts                  Enable CTS/RTS on GPIOs 10-11 (default off)
++
++
++Name:   uart5
++Info:   Enable uart 5 on GPIOs 12-15. BCM2711 only.
++Load:   dtoverlay=uart5,<param>
++Params: ctsrts                  Enable CTS/RTS on GPIOs 14-15 (default off)
++
++
++Name:   udrc
++Info:   Configures the NW Digital Radio UDRC Hat
++Load:   dtoverlay=udrc,<param>=<val>
++Params: alsaname                Name of the ALSA audio device (default "udrc")
++
++
++Name:   ugreen-dabboard
++Info:   Configures the ugreen-dabboard I2S overlay
++        This is a simple overlay based on the simple-audio-card and the dmic
++        codec. It has the speciality that it is configured to use the codec
++        as a master I2S device. It works for example with the Si468x DAB
++        receiver on the uGreen DABBoard.
++Load:   dtoverlay=ugreen-dabboard,<param>=<val>
++Params: card-name               Override the default, "dabboard", card name.
++
++
++Name:   upstream
++Info:   Allow usage of downstream .dtb with upstream kernel. Comprises the
++        vc4-kms-v3d and dwc2 overlays.
++Load:   dtoverlay=upstream
++Params: <None>
++
++
++Name:   upstream-aux-interrupt
++Info:   This overlay has been deprecated and removed because it is no longer
++        necessary.
++Load:   <Deprecated>
++
++
++Name:   upstream-pi4
++Info:   Allow usage of downstream .dtb with upstream kernel on Pi 4. Comprises
++        the vc4-kms-v3d-pi4 and dwc2 overlays.
++Load:   dtoverlay=upstream-pi4
++Params: <None>
++
++
++Name:   vc4-fkms-v3d
++Info:   Enable Eric Anholt's DRM VC4 V3D driver on top of the dispmanx
++        display stack.
++Load:   dtoverlay=vc4-fkms-v3d,<param>
++Params: cma-512                 CMA is 512MB (needs 1GB)
++        cma-448                 CMA is 448MB (needs 1GB)
++        cma-384                 CMA is 384MB (needs 1GB)
++        cma-320                 CMA is 320MB (needs 1GB)
++        cma-256                 CMA is 256MB (needs 1GB)
++        cma-192                 CMA is 192MB (needs 1GB)
++        cma-128                 CMA is 128MB
++        cma-96                  CMA is 96MB
++        cma-64                  CMA is 64MB
++        cma-size                CMA size in bytes, 4MB aligned
++        cma-default             Use upstream's default value
++
++
++Name:   vc4-fkms-v3d-pi4
++Info:   Enable Eric Anholt's DRM VC4 V3D driver on top of the dispmanx
++        display stack.
++Load:   dtoverlay=vc4-fkms-v3d-pi4,<param>
++Params: cma-512                 CMA is 512MB (needs 1GB)
++        cma-448                 CMA is 448MB (needs 1GB)
++        cma-384                 CMA is 384MB (needs 1GB)
++        cma-320                 CMA is 320MB (needs 1GB)
++        cma-256                 CMA is 256MB (needs 1GB)
++        cma-192                 CMA is 192MB (needs 1GB)
++        cma-128                 CMA is 128MB
++        cma-96                  CMA is 96MB
++        cma-64                  CMA is 64MB
++        cma-size                CMA size in bytes, 4MB aligned
++        cma-default             Use upstream's default value
++
++
++Name:   vc4-kms-dpi-at056tn53v1
++Info:   This overlay is now deprecated - see vc4-kms-dpi-panel,at056tn53v1
++Load:   <Deprecated>
++
++
++Name:   vc4-kms-dpi-generic
++Info:   Enable a generic DPI display under KMS. Default timings are for the
++        Adafruit Kippah with 800x480 panel and RGB666 (GPIOs 0-21)
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dpi-generic,<param>=<val>
++Params: clock-frequency         Display clock frequency (Hz)
++        hactive                 Horizontal active pixels
++        hfp                     Horizontal front porch
++        hsync                   Horizontal sync pulse width
++        hbp                     Horizontal back porch
++        vactive                 Vertical active lines
++        vfp                     Vertical front porch
++        vsync                   Vertical sync pulse width
++        vbp                     Vertical back porch
++        hsync-invert            Horizontal sync active low
++        vsync-invert            Vertical sync active low
++        de-invert               Data Enable active low
++        pixclk-invert           Negative edge pixel clock
++        width-mm                Define the screen width in mm
++        height-mm               Define the screen height in mm
++        rgb565                  Change to RGB565 output on GPIOs 0-19
++        rgb565-padhi            Change to RGB565 output on GPIOs 0-8, 12-17, and
++                                20-24
++        bgr666                  Change to BGR666 output on GPIOs 0-21.
++        bgr666-padhi            Change to BGR666 output on GPIOs 0-9, 12-17, and
++                                20-25
++        rgb666-padhi            Change to RGB666 output on GPIOs 0-9, 12-17, and
++                                20-25
++        bgr888                  Change to BGR888 output on GPIOs 0-27
++        rgb888                  Change to RGB888 output on GPIOs 0-27
++        bus-format              Override the bus format for a MEDIA_BUS_FMT_*
++                                value. NB also overridden by rgbXXX overrides.
++        backlight-gpio          Defines a GPIO to be used for backlight control
++                                (default of none).
++        backlight-pwm           Defines a PWM channel to be used for backlight
++                                control (default of none). NB Disables audio
++                                headphone output as that also uses PWM.
++        backlight-pwm-chan      Choose channel on &pwm node for backlight
++                                control.
++                                (default 0).
++        backlight-pwm-gpio      GPIO pin to be used for the PWM backlight. See
++                                pwm-2chan for valid options.
++                                (default 18 - note this can only work with
++                                 rgb666-padhi).
++        backlight-pwm-func      Pin function of GPIO used for the PWM
++                                backlight.
++                                See pwm-2chan for valid options.
++                                (default 2).
++        backlight-def-brightness
++                                Set the default brightness. Normal range 1-16.
++                                (default 16).
++        rotate                  Display rotation {0,90,180,270} (default 0)
++
++
++Name:   vc4-kms-dpi-hyperpixel2r
++Info:   Enable the KMS drivers for the Pimoroni HyperPixel2 Round DPI display.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dpi-hyperpixel2r,<param>=<val>
++Params: disable-touch           Disables the touch controller
++        touchscreen-inverted-x  Inverts X direction of touch controller
++        touchscreen-inverted-y  Inverts Y direction of touch controller
++        touchscreen-swapped-x-y Swaps X & Y axes of touch controller
++        rotate                  Display rotation {0,90,180,270} (default 0)
++
++
++Name:   vc4-kms-dpi-hyperpixel4
++Info:   Enable the KMS drivers for the Pimoroni HyperPixel4 DPI display.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dpi-hyperpixel4,<param>=<val>
++Params: disable-touch           Disables the touch controller
++        touchscreen-inverted-x  Inverts X direction of touch controller
++        touchscreen-inverted-y  Inverts Y direction of touch controller
++        touchscreen-swapped-x-y Swaps X & Y axes of touch controller
++        rotate                  Display rotation {0,90,180,270} (default 0)
++
++
++Name:   vc4-kms-dpi-hyperpixel4sq
++Info:   Enable the KMS drivers for the Pimoroni HyperPixel4 Square DPI display.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dpi-hyperpixel4sq,<param>=<val>
++Params: disable-touch           Disables the touch controller
++        touchscreen-inverted-x  Inverts X direction of touch controller
++        touchscreen-inverted-y  Inverts Y direction of touch controller
++        touchscreen-swapped-x-y Swaps X & Y axes of touch controller
++        rotate                  Display rotation {0,90,180,270} (default 0)
++
++
++Name:   vc4-kms-dpi-panel
++Info:   Enable a preconfigured KMS DPI panel.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dpi-panel,<param>=<val>
++Params: at056tn53v1             Enable an Innolux 5.6in VGA TFT
++        kippah-7inch            Enable an Adafruit Kippah with 7inch panel.
++        mzp280                  Enable a Geekworm MZP280 panel.
++        backlight-gpio          Defines a GPIO to be used for backlight control
++                                (default of none).
++        backlight-pwm           Defines a PWM channel to be used for backlight
++                                control (default of none). NB Disables audio
++                                headphone output as that also uses PWM.
++        backlight-pwm-chan      Choose channel on &pwm node for backlight
++                                control.
++                                (default 0).
++        backlight-pwm-gpio      GPIO pin to be used for the PWM backlight. See
++                                pwm-2chan for valid options.
++                                (default 18 - note this can only work with
++                                 rgb666-padhi).
++        backlight-pwm-func      Pin function of GPIO used for the PWM
++                                backlight.
++                                See pwm-2chan for valid options.
++                                (default 2).
++        backlight-def-brightness
++                                Set the default brightness. Normal range 1-16.
++                                (default 16).
++        rotate                  Display rotation {0,90,180,270} (default 0)
++
++
++Name:   vc4-kms-dsi-7inch
++Info:   Enable the Raspberry Pi DSI 7" screen.
++        Includes the edt-ft5406 for the touchscreen element.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dsi-7inch,<param>=<val>
++Params: sizex                   Touchscreen size x (default 800)
++        sizey                   Touchscreen size y (default 480)
++        invx                    Touchscreen inverted x axis
++        invy                    Touchscreen inverted y axis
++        swapxy                  Touchscreen swapped x y axis
++        disable_touch           Disables the touch screen overlay driver
++
++
++Name:   vc4-kms-dsi-lt070me05000
++Info:   Enable a JDI LT070ME05000 DSI display on DSI1.
++        Note that this is a 4 lane DSI device, so it will only work on a Compute
++        Module.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dsi-lt070me05000,<param>
++Params: reset                   GPIO for the reset signal (default 17)
++        enable                  GPIO for the enable signal (default 4)
++        dcdc-en                 GPIO for the DC-DC converter enable (default 5)
++
++
++Name:   vc4-kms-dsi-lt070me05000-v2
++Info:   Enable a JDI LT070ME05000 DSI display on DSI1 using Harlab's V2
++        interface board.
++        Note that this is a 4 lane DSI device, so it will only work on a Compute
++        Module.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dsi-lt070me05000-v2
++Params: <None>
++
++
++Name:   vc4-kms-kippah-7inch
++Info:   This overlay is now deprecated - see vc4-kms-dpi-panel,kippah-7inch
++Load:   <Deprecated>
++
++
++Name:   vc4-kms-v3d
++Info:   Enable Eric Anholt's DRM VC4 HDMI/HVS/V3D driver.
++Load:   dtoverlay=vc4-kms-v3d,<param>
++Params: cma-512                 CMA is 512MB (needs 1GB)
++        cma-448                 CMA is 448MB (needs 1GB)
++        cma-384                 CMA is 384MB (needs 1GB)
++        cma-320                 CMA is 320MB (needs 1GB)
++        cma-256                 CMA is 256MB (needs 1GB)
++        cma-192                 CMA is 192MB (needs 1GB)
++        cma-128                 CMA is 128MB
++        cma-96                  CMA is 96MB
++        cma-64                  CMA is 64MB
++        cma-size                CMA size in bytes, 4MB aligned
++        cma-default             Use upstream's default value
++        audio                   Enable or disable audio over HDMI (default "on")
++        noaudio                 Disable all HDMI audio (default "off")
++        composite               Enable the composite output (default "off")
++                                N.B. Disables all other outputs on a Pi 4.
++        nohdmi                  Disable HDMI output
++
++
++Name:   vc4-kms-v3d-pi4
++Info:   Enable Eric Anholt's DRM VC4 HDMI/HVS/V3D driver for Pi4.
++Load:   dtoverlay=vc4-kms-v3d-pi4,<param>
++Params: cma-512                 CMA is 512MB
++        cma-448                 CMA is 448MB
++        cma-384                 CMA is 384MB
++        cma-320                 CMA is 320MB
++        cma-256                 CMA is 256MB
++        cma-192                 CMA is 192MB
++        cma-128                 CMA is 128MB
++        cma-96                  CMA is 96MB
++        cma-64                  CMA is 64MB
++        cma-size                CMA size in bytes, 4MB aligned
++        cma-default             Use upstream's default value
++        audio                   Enable or disable audio over HDMI0 (default
++                                "on")
++        audio1                  Enable or disable audio over HDMI1 (default
++                                "on")
++        noaudio                 Disable all HDMI audio (default "off")
++        composite               Enable the composite output (disables all other
++                                outputs)
++        nohdmi                  Disable both HDMI 0 & 1 outputs
++        nohdmi0                 Disable HDMI 0 output
++        nohdmi1                 Disable HDMI 1 output
++
++
++
++Name:   vc4-kms-vga666
++Info:   Enable the VGA666 (resistor ladder ADC) for the vc4-kms-v3d driver.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-vga666,<param>
++Params: ddc                     Enables GPIOs 0&1 as the I2C to read the EDID
++                                from the display. NB These are NOT 5V tolerant
++                                GPIOs, therefore level shifters are required.
++
++
++Name:   vga666
++Info:   Overlay for the Fen Logic VGA666 board
++        This uses GPIOs 2-21 (so no I2C), and activates the output 2-3 seconds
++        after the kernel has started.
++        NOT for use with vc4-kms-v3d.
++Load:   dtoverlay=vga666
++Params: <None>
++
++
++Name:   vl805
++Info:   Overlay to enable a VIA VL805 USB3 controller on CM4 carriers
++        Will be loaded automatically by up-to-date firmware if "VL805=1" is
++        set in the EEPROM config.
++Load:   dtoverlay=vl805
++Params: <None>
++
++
++Name:   w1-gpio
++Info:   Configures the w1-gpio Onewire interface module.
++        Use this overlay if you *don't* need a GPIO to drive an external pullup.
++Load:   dtoverlay=w1-gpio,<param>=<val>
++Params: gpiopin                 GPIO for I/O (default "4")
++        pullup                  Now enabled by default (ignored)
++
++
++Name:   w1-gpio-pullup
++Info:   Configures the w1-gpio Onewire interface module.
++        Use this overlay if you *do* need a GPIO to drive an external pullup.
++Load:   dtoverlay=w1-gpio-pullup,<param>=<val>
++Params: gpiopin                 GPIO for I/O (default "4")
++        extpullup               GPIO for external pullup (default "5")
++        pullup                  Now enabled by default (ignored)
++
++
++Name:   w5500
++Info:   Overlay for the Wiznet W5500 Ethernet Controller on SPI0
++Load:   dtoverlay=w5500,<param>=<val>
++Params: int_pin                 GPIO used for INT (default 25)
++
++        speed                   SPI bus speed (default 30000000)
++
++        cs                      SPI bus Chip Select (default 0)
++
++
++Name:   watterott-display
++Info:   Watterott RPi-Display - 2.8" Touch Display
++        Linux has 2 drivers that support this display and this overlay supports
++        both.
++
++        Examples:
++          fbtft/fb_ili9341: dtoverlay=watterott-display
++          drm/mi0283qt: dtoverlay=watterott-display,drm,backlight-pwm,rotate=180
++
++        Some notable differences with the DRM driver compared to fbtft:
++        - The display is turned on when it's first used and not on driver load
++          as with fbtft. So if nothing uses the display it stays off.
++        - Can run with a higher SPI clock increasing framerate. This is possible
++          since the driver avoids messing up the controller configuration due to
++          transmission errors by running config commands at 10MHz and only pixel
++          data at full speed (occasional pixel glitch might occur).
++        - PWM backlight is supported.
++
++Load:   dtoverlay=watterott-display,<param>=<val>
++Params: speed                   Display SPI bus speed
++        rotate                  Display rotation {0,90,180,270}
++        fps                     Delay between frame updates (fbtft only)
++        debug                   Debug output level {0-7} (fbtft only)
++        xohms                   Touchpanel sensitivity (X-plate resistance)
++        swapxy                  Swap x and y axis
++        backlight               Change backlight GPIO pin {e.g. 12, 18}
++                                (fbtft only)
++        drm                     Use DRM/KMS driver mi0283qt instead of fbtft.
++                                Set the SPI clock to 70MHz.
++                                This has to be the first parameter.
++        backlight-pwm           Use pwm for backlight (drm only). NB: Disables
++                                audio headphone output as that also uses PWM.
++
++
++Name:   waveshare-can-fd-hat-mode-a
++Info:   Overlay for the Waveshare 2-Channel Isolated CAN FD Expansion HAT
++        for Raspberry Pi, Multi Protections. Use this overlay when the
++        HAT is configured in Mode A (Default), with can0 on spi0.0
++        and can1 on spi1.0.
++        https://www.waveshare.com/2-ch-can-fd-hat.htm
++Load:   dtoverlay=waveshare-can-fd-hat-mode-a
++Params: <None>
++
++
++Name:   waveshare-can-fd-hat-mode-b
++Info:   Overlay for the Waveshare 2-Channel Isolated CAN FD Expansion HAT
++        for Raspberry Pi, Multi Protections. Use this overlay when the
++        HAT is configured in Mode B (requires hardware modification), with
++        can0 on spi0.0 and can1 on spi0.1.
++        https://www.waveshare.com/2-ch-can-fd-hat.htm
++Load:   dtoverlay=waveshare-can-fd-hat-mode-b
++Params: <None>
++
++
++Name:   wittypi
++Info:   Configures the wittypi RTC module.
++Load:   dtoverlay=wittypi,<param>=<val>
++Params: led_gpio                GPIO for LED (default "17")
++        led_trigger             Choose which activity the LED tracks (default
++                                "default-on")
++
++
++Name:   wm8960-soundcard
++Info:   Overlay for the Waveshare wm8960 soundcard
++Load:   dtoverlay=wm8960-soundcard,<param>=<val>
++Params: alsaname                Changes the card name in ALSA
++        compatible              Changes the codec compatibility
++
++
++Troubleshooting
++===============
++
++If you are experiencing problems that you think are DT-related, enable DT
++diagnostic output by adding this to /boot/config.txt:
++
++    dtdebug=on
++
++and rebooting. Then run:
++
++    sudo vcdbg log msg
++
++and look for relevant messages.
++
++Further reading
++===============
++
++This is only meant to be a quick introduction to the subject of Device Tree on
++Raspberry Pi. There is a more complete explanation here:
++
++http://www.raspberrypi.org/documentation/configuration/device-tree.md
+diff --git a/arch/arm/boot/dts/overlays/act-led-overlay.dts b/arch/arm/boot/dts/overlays/act-led-overlay.dts
+new file mode 100644
+index 000000000000..2f4bbb407f89
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/act-led-overlay.dts
+@@ -0,0 +1,27 @@
++/dts-v1/;
++/plugin/;
++
++/* Pi3 uses a GPIO expander to drive the LEDs which can only be accessed
++   from the VPU. There is a special driver for this with a separate DT node,
++   which has the unfortunate consequence of breaking the act_led_gpio and
++   act_led_activelow dtparams.
++
++   This overlay changes the GPIO controller back to the standard one and
++   restores the dtparams.
++*/
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&act_led>;
++		frag0: __overlay__ {
++			gpios = <&gpio 0 0>;
++		};
++	};
++
++	__overrides__ {
++		gpio = <&frag0>,"gpios:4";
++		activelow = <&frag0>,"gpios:8";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/adafruit-st7735r-overlay.dts b/arch/arm/boot/dts/overlays/adafruit-st7735r-overlay.dts
+new file mode 100644
+index 000000000000..6e69bd7fa031
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/adafruit-st7735r-overlay.dts
+@@ -0,0 +1,83 @@
++/*
++ * adafruit-st7735r-overlay.dts
++ *
++ * ST7735R based SPI LCD displays. Either
++ * Adafruit 1.8" 160x128
++ *   or
++ * Okaya 1.44" 128x128
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			adafruit_pins: adafruit_pins {
++				brcm,pins = <25 24>;
++				brcm,function = <1>; /* out */
++			};
++			backlight_pins: backlight_pins {
++				brcm,pins = <18>;
++				brcm,function = <1>; /* out */
++			};
++		};
++	};
++
++	fragment@2 {
++		target-path = "/";
++		__overlay__ {
++			af18_backlight: backlight {
++				compatible = "gpio-backlight";
++				gpios = <&gpio 18 GPIO_ACTIVE_HIGH>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&backlight_pins>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			af18: adafruit18@0 {
++				compatible = "jianda,jd-t18003-t01";
++				reg = <0>;
++				spi-max-frequency = <32000000>;
++				dc-gpios = <&gpio 24 GPIO_ACTIVE_HIGH>;
++				reset-gpios = <&gpio 25 GPIO_ACTIVE_HIGH>;
++				rotation = <90>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&adafruit_pins>;
++				backlight = <&af18_backlight>;
++			};
++		};
++	};
++
++	__overrides__ {
++		128x128 = <&af18>, "compatible=okaya,rh128128t";
++		speed = <&af18>,"spi-max-frequency:0";
++		rotate = <&af18>,"rotation:0";
++		dc_pin = <&af18>,"dc-gpios:4", <&adafruit_pins>,"brcm,pins:4";
++		reset_pin = <&af18>,"reset-gpios:4",
++			    <&adafruit_pins>,"brcm,pins:0";
++		led_pin = <&af18_backlight>,"gpios:4",
++			  <&backlight_pins>,"brcm,pins:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/adafruit18-overlay.dts b/arch/arm/boot/dts/overlays/adafruit18-overlay.dts
+new file mode 100644
+index 000000000000..e1ce94a8cd3e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/adafruit18-overlay.dts
+@@ -0,0 +1,55 @@
++/*
++ * Device Tree overlay for Adafruit 1.8" TFT LCD with ST7735R chip 160x128
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			af18: adafruit18@0 {
++				compatible = "fbtft,adafruit18";
++				reg = <0>;
++				pinctrl-names = "default";
++				spi-max-frequency = <40000000>;
++				rotate = <90>;
++				buswidth = <8>;
++				fps = <50>;
++				height = <160>;
++				width = <128>;
++				reset-gpios = <&gpio 25 1>;
++				dc-gpios = <&gpio 24 0>;
++				led-gpios = <&gpio 18 0>;
++				debug = <0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		green = <&af18>, "compatible=fbtft,adafruit18_green";
++		speed     = <&af18>,"spi-max-frequency:0";
++		rotate    = <&af18>,"rotate:0";
++		fps       = <&af18>,"fps:0";
++		bgr       = <&af18>,"bgr?";
++		debug     = <&af18>,"debug:0";
++		dc_pin    = <&af18>,"dc-gpios:4";
++		reset_pin = <&af18>,"reset-gpios:4";
++		led_pin   = <&af18>,"led-gpios:4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/adau1977-adc-overlay.dts b/arch/arm/boot/dts/overlays/adau1977-adc-overlay.dts
+new file mode 100644
+index 000000000000..298488e19156
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/adau1977-adc-overlay.dts
+@@ -0,0 +1,40 @@
++// Definitions for ADAU1977 ADC
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++    
++	fragment@0 {
++        	target = <&i2c>;
++        	
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			
++			adau1977: codec@11 {
++                        	compatible = "adi,adau1977";
++                        	reg = <0x11>;
++                        	reset-gpios = <&gpio 5 0>;
++				AVDD-supply = <&vdd_3v3_reg>;
++                	};
++        	};
++	};
++
++	fragment@1 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "adi,adau1977-adc";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/adau7002-simple-overlay.dts b/arch/arm/boot/dts/overlays/adau7002-simple-overlay.dts
+new file mode 100644
+index 000000000000..5fed769d2526
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/adau7002-simple-overlay.dts
+@@ -0,0 +1,52 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++
++    fragment@0 {
++        target = <&i2s>;
++        __overlay__ {
++            status = "okay";
++        };
++    };
++
++    fragment@1 {
++        target-path = "/";
++        __overlay__ {
++                adau7002_codec: adau7002-codec {
++                #sound-dai-cells = <0>;
++                compatible = "adi,adau7002";
++/*                IOVDD-supply = <&supply>;*/
++                status = "okay";
++            };
++        };
++    };
++
++    fragment@2 {
++        target = <&sound>;
++            sound_overlay: __overlay__ {
++            compatible = "simple-audio-card";
++            simple-audio-card,format = "i2s";
++            simple-audio-card,name = "adau7002";
++            simple-audio-card,bitclock-slave = <&dailink0_slave>;
++            simple-audio-card,frame-slave = <&dailink0_slave>;
++            simple-audio-card,widgets =
++                    "Microphone", "Microphone Jack";
++            simple-audio-card,routing =
++                    "PDM_DAT", "Microphone Jack";
++            status = "okay";
++            simple-audio-card,cpu {
++                sound-dai = <&i2s>;
++            };
++            dailink0_slave: simple-audio-card,codec {
++                sound-dai = <&adau7002_codec>;
++            };
++        };
++    };
++
++
++    __overrides__ {
++        card-name = <&sound_overlay>,"simple-audio-card,name";
++    };
++};
+diff --git a/arch/arm/boot/dts/overlays/ads1015-overlay.dts b/arch/arm/boot/dts/overlays/ads1015-overlay.dts
+new file mode 100644
+index 000000000000..dc1764613a8b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ads1015-overlay.dts
+@@ -0,0 +1,98 @@
++/*
++ * 2016 - Erik Sejr
++ */
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++    /* ----------- ADS1015 ------------ */
++    fragment@0 {
++        target = <&i2c_arm>;
++        __overlay__ {
++            #address-cells = <1>;
++            #size-cells = <0>;
++            status = "okay";
++            ads1015: ads1015@48 {
++                compatible = "ti,ads1015";
++                status = "okay";
++                #address-cells = <1>;
++                #size-cells = <0>;
++                reg = <0x48>;
++            };
++        };
++    };
++
++    fragment@1 {
++        target = <&ads1015>;
++        __overlay__ {
++            #address-cells = <1>;
++            #size-cells = <0>;
++            channel_a: channel_a {
++                reg = <4>;
++                ti,gain = <2>;
++                ti,datarate = <4>;
++            };
++        };
++    };
++
++    fragment@2 {
++        target = <&ads1015>;
++        __dormant__ {
++            #address-cells = <1>;
++            #size-cells = <0>;
++            channel_b: channel_b {
++                reg = <5>;
++                ti,gain = <2>;
++                ti,datarate = <4>;
++            };
++        };
++    };
++
++    fragment@3 {
++        target = <&ads1015>;
++        __dormant__ {
++            #address-cells = <1>;
++            #size-cells = <0>;
++            channel_c: channel_c {
++                reg = <6>;
++                ti,gain = <2>;
++                ti,datarate = <4>;
++            };
++        };
++    };
++
++    fragment@4 {
++        target = <&ads1015>;
++        __dormant__ {
++            #address-cells = <1>;
++            #size-cells = <0>;
++            channel_d: channel_d {
++                reg = <7>;
++                ti,gain = <2>;
++                ti,datarate = <4>;
++            };
++        };
++    };
++
++    __overrides__ {
++        addr =            <&ads1015>,"reg:0";
++        cha_enable =      <0>,"=1";
++        cha_cfg =         <&channel_a>,"reg:0";
++        cha_gain =        <&channel_a>,"ti,gain:0";
++        cha_datarate =    <&channel_a>,"ti,datarate:0";
++        chb_enable =      <0>,"=2";
++        chb_cfg =         <&channel_b>,"reg:0";
++        chb_gain =        <&channel_b>,"ti,gain:0";
++        chb_datarate =    <&channel_b>,"ti,datarate:0";
++        chc_enable =      <0>,"=3";
++        chc_cfg =         <&channel_c>,"reg:0";
++        chc_gain =        <&channel_c>,"ti,gain:0";
++        chc_datarate =    <&channel_c>,"ti,datarate:0";
++        chd_enable =      <0>,"=4";
++        chd_cfg =         <&channel_d>,"reg:0";
++        chd_gain =        <&channel_d>,"ti,gain:0";
++        chd_datarate =    <&channel_d>,"ti,datarate:0";
++   };
++
++};
+diff --git a/arch/arm/boot/dts/overlays/ads1115-overlay.dts b/arch/arm/boot/dts/overlays/ads1115-overlay.dts
+new file mode 100644
+index 000000000000..e44ced704ee2
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ads1115-overlay.dts
+@@ -0,0 +1,103 @@
++/*
++ * TI ADS1115 multi-channel ADC overlay
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ads1115: ads1115@48 {
++				compatible = "ti,ads1115";
++				status = "okay";
++				#address-cells = <1>;
++				#size-cells = <0>;
++				reg = <0x48>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&ads1115>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			channel_a: channel_a {
++				reg = <4>;
++				ti,gain = <1>;
++				ti,datarate = <7>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&ads1115>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			channel_b: channel_b {
++				reg = <5>;
++				ti,gain = <1>;
++				ti,datarate = <7>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&ads1115>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			channel_c: channel_c {
++				reg = <6>;
++				ti,gain = <1>;
++				ti,datarate = <7>;
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&ads1115>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			channel_d: channel_d {
++				reg = <7>;
++				ti,gain = <1>;
++				ti,datarate = <7>;
++			};
++		};
++	};
++
++	__overrides__ {
++		addr =            <&ads1115>,"reg:0";
++		cha_enable =      <0>,"=1";
++		cha_cfg =         <&channel_a>,"reg:0";
++		cha_gain =        <&channel_a>,"ti,gain:0";
++		cha_datarate =    <&channel_a>,"ti,datarate:0";
++		chb_enable =      <0>,"=2";
++		chb_cfg =         <&channel_b>,"reg:0";
++		chb_gain =        <&channel_b>,"ti,gain:0";
++		chb_datarate =    <&channel_b>,"ti,datarate:0";
++		chc_enable =      <0>,"=3";
++		chc_cfg =         <&channel_c>,"reg:0";
++		chc_gain =        <&channel_c>,"ti,gain:0";
++		chc_datarate =    <&channel_c>,"ti,datarate:0";
++		chd_enable =      <0>,"=4";
++		chd_cfg =         <&channel_d>,"reg:0";
++		chd_gain =        <&channel_d>,"ti,gain:0";
++		chd_datarate =    <&channel_d>,"ti,datarate:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/ads7846-overlay.dts b/arch/arm/boot/dts/overlays/ads7846-overlay.dts
+new file mode 100644
+index 000000000000..1c5c9b6bb6ff
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ads7846-overlay.dts
+@@ -0,0 +1,89 @@
++/*
++ * Generic Device Tree overlay for the ADS7846 touch controller
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			ads7846_pins: ads7846_pins {
++				brcm,pins = <255>; /* illegal default value */
++				brcm,function = <0>; /* in */
++				brcm,pull = <0>; /* none */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			ads7846: ads7846@1 {
++				compatible = "ti,ads7846";
++				reg = <1>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&ads7846_pins>;
++
++				spi-max-frequency = <2000000>;
++				interrupts = <255 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				pendown-gpio = <&gpio 255 0>;
++
++				/* driver defaults */
++				ti,x-min = /bits/ 16 <0>;
++				ti,y-min = /bits/ 16 <0>;
++				ti,x-max = /bits/ 16 <0x0FFF>;
++				ti,y-max = /bits/ 16 <0x0FFF>;
++				ti,pressure-min = /bits/ 16 <0>;
++				ti,pressure-max = /bits/ 16 <0xFFFF>;
++				ti,x-plate-ohms = /bits/ 16 <400>;
++			};
++		};
++	};
++	__overrides__ {
++		cs =     <&ads7846>,"reg:0";
++		speed =  <&ads7846>,"spi-max-frequency:0";
++		penirq = <&ads7846_pins>,"brcm,pins:0", /* REQUIRED */
++			 <&ads7846>,"interrupts:0",
++			 <&ads7846>,"pendown-gpio:4";
++		penirq_pull = <&ads7846_pins>,"brcm,pull:0";
++		swapxy = <&ads7846>,"ti,swap-xy?";
++		xmin =   <&ads7846>,"ti,x-min;0";
++		ymin =   <&ads7846>,"ti,y-min;0";
++		xmax =   <&ads7846>,"ti,x-max;0";
++		ymax =   <&ads7846>,"ti,y-max;0";
++		pmin =   <&ads7846>,"ti,pressure-min;0";
++		pmax =   <&ads7846>,"ti,pressure-max;0";
++		xohms =  <&ads7846>,"ti,x-plate-ohms;0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/adv7282m-overlay.dts b/arch/arm/boot/dts/overlays/adv7282m-overlay.dts
+new file mode 100644
+index 000000000000..f7e97c4a13d8
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/adv7282m-overlay.dts
+@@ -0,0 +1,73 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for Analog Devices ADV7282-M video to CSI2 bridge on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			adv728x: adv728x@21 {
++				compatible = "adi,adv7282-m";
++				reg = <0x21>;
++				status = "okay";
++				clock-frequency = <24000000>;
++				port {
++					adv728x_0: endpoint {
++						remote-endpoint = <&csi1_ep>;
++						clock-lanes = <0>;
++						data-lanes = <1>;
++						link-frequencies =
++							/bits/ 64 <297000000>;
++
++						mclk-frequency = <12000000>;
++					};
++				};
++			};
++		};
++	};
++	fragment@1 {
++		target = <&csi1>;
++		__overlay__ {
++			status = "okay";
++
++			port {
++				csi1_ep: endpoint {
++					remote-endpoint = <&adv728x_0>;
++					data-lanes = <1>;
++				};
++			};
++		};
++	};
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&csi1>;
++		__dormant__ {
++			brcm,media-controller;
++		};
++	};
++
++	__overrides__ {
++		addr =			<&adv728x>,"reg:0";
++		media-controller = <0>,"=4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/adv728x-m-overlay.dts b/arch/arm/boot/dts/overlays/adv728x-m-overlay.dts
+new file mode 100644
+index 000000000000..ea392e886984
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/adv728x-m-overlay.dts
+@@ -0,0 +1,37 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for Analog Devices ADV728[0|1|2]-M video to CSI2 bridges on VC
++// I2C bus
++
++#include "adv7282m-overlay.dts"
++
++/{
++	compatible = "brcm,bcm2835";
++
++	// Fragment numbers deliberately high to avoid conflicts with the
++	// included adv7282m overlay file.
++
++	fragment@101 {
++		target = <&adv728x>;
++		__dormant__ {
++			compatible = "adi,adv7280-m";
++		};
++	};
++	fragment@102 {
++		target = <&adv728x>;
++		__dormant__ {
++			compatible = "adi,adv7281-m";
++		};
++	};
++	fragment@103 {
++		target = <&adv728x>;
++		__dormant__ {
++			compatible = "adi,adv7281-ma";
++		};
++	};
++
++	__overrides__ {
++		adv7280m = <0>, "+101";
++		adv7281m = <0>, "+102";
++		adv7281ma = <0>, "+103";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/akkordion-iqdacplus-overlay.dts b/arch/arm/boot/dts/overlays/akkordion-iqdacplus-overlay.dts
+new file mode 100644
+index 000000000000..82f9b3734fb1
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/akkordion-iqdacplus-overlay.dts
+@@ -0,0 +1,49 @@
++// Definitions for Digital Dreamtime Akkordion using IQaudIO DAC+ or DACZero
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4c {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4c>;
++				AVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		frag2: __overlay__ {
++			compatible = "iqaudio,iqaudio-dac";
++			card_name = "Akkordion";
++			dai_name = "IQaudIO DAC";
++			dai_stream_name = "IQaudIO DAC HiFi";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain = <&frag2>,"iqaudio,24db_digital_gain?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/allo-boss-dac-pcm512x-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-boss-dac-pcm512x-audio-overlay.dts
+new file mode 100644
+index 000000000000..873cb2fab52b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/allo-boss-dac-pcm512x-audio-overlay.dts
+@@ -0,0 +1,59 @@
++/*
++ * Definitions for Allo Boss DAC board
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			boss_osc: boss_osc {
++				compatible = "allo,dac-clk";
++				#clock-cells = <0>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4d {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				clocks = <&boss_osc>;
++				reg = <0x4d>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		boss_dac: __overlay__ {
++			compatible = "allo,boss-dac";
++			i2s-controller = <&i2s>;
++			mute-gpios = <&gpio 6 1>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain = <&boss_dac>,"allo,24db_digital_gain?";
++		slave = <&boss_dac>,"allo,slave?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/allo-boss2-dac-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-boss2-dac-audio-overlay.dts
+new file mode 100644
+index 000000000000..a6adfb495eb9
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/allo-boss2-dac-audio-overlay.dts
+@@ -0,0 +1,57 @@
++/* * Definitions for Allo Boss2 DAC boards
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			#sound-dai-cells = <0>;
++			status = "okay";
++			cpu_port: port {
++				cpu_endpoint: endpoint {
++					remote-endpoint = <&codec_endpoint>;
++					bitclock-master = <&codec_endpoint>;
++					frame-master = <&codec_endpoint>;
++					dai-format = "i2s";
++				};
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			allo-cs43130@30 {
++				#sound-dai-cells = <0>;
++				compatible = "allo,allo-cs43198";
++				clock44-gpio = <&gpio 5 0>;
++				clock48-gpio = <&gpio 6 0>;
++				reg = <0x30>;
++				port {
++					codec_endpoint: endpoint {
++					remote-endpoint = <&cpu_endpoint>;
++					};
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		boss2_dac: __overlay__ {
++			compatible = "audio-graph-card";
++			label = "Allo Boss2";
++			dais = <&cpu_port>;
++			status = "okay";
++		};
++	};
++};
++
+diff --git a/arch/arm/boot/dts/overlays/allo-digione-overlay.dts b/arch/arm/boot/dts/overlays/allo-digione-overlay.dts
+new file mode 100644
+index 000000000000..ea018ace34d4
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/allo-digione-overlay.dts
+@@ -0,0 +1,44 @@
++// Definitions for Allo DigiOne
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			wm8804@3b {
++				#sound-dai-cells = <0>;
++				compatible = "wlf,wm8804";
++				reg = <0x3b>;
++				PVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++				wlf,reset-gpio = <&gpio 17 0>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "allo,allo-digione";
++			i2s-controller = <&i2s>;
++			status = "okay";
++			clock44-gpio = <&gpio 5 0>;
++			clock48-gpio = <&gpio 6 0>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/allo-katana-dac-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-katana-dac-audio-overlay.dts
+new file mode 100644
+index 000000000000..b25fd681f09f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/allo-katana-dac-audio-overlay.dts
+@@ -0,0 +1,57 @@
++/*
++ * Definitions for Allo Katana DAC boards
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			#sound-dai-cells = <0>;
++			status = "okay";
++			cpu_port: port {
++				cpu_endpoint: endpoint {
++					remote-endpoint = <&codec_endpoint>;
++					bitclock-master = <&codec_endpoint>;
++					frame-master = <&codec_endpoint>;
++					dai-format = "i2s";
++				};
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			allo-katana-codec@30 {
++				#sound-dai-cells = <0>;
++				compatible = "allo,allo-katana-codec";
++				reg = <0x30>;
++				port {
++					codec_endpoint: endpoint {
++					remote-endpoint = <&cpu_endpoint>;
++					};
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		katana_dac: __overlay__ {
++			compatible = "audio-graph-card";
++			label = "Allo Katana";
++			dais = <&cpu_port>;
++			status = "okay";
++		};
++	};
++};
++
+diff --git a/arch/arm/boot/dts/overlays/allo-piano-dac-pcm512x-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-piano-dac-pcm512x-audio-overlay.dts
+new file mode 100644
+index 000000000000..bfc66da6295a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/allo-piano-dac-pcm512x-audio-overlay.dts
+@@ -0,0 +1,54 @@
++/*
++ * Definitions for Allo Piano DAC (2.0/2.1) boards
++ *
++ * NB. The Piano DAC 2.1 board contains 2x TI PCM5142 DAC's. One DAC is stereo
++ * (left/right) and the other provides a subwoofer output, using DSP on the
++ * chip for digital high/low pass crossover.
++ * The initial support for this hardware, that doesn't require any codec driver
++ * modifications, uses only one DAC chip for stereo (left/right) output, the
++ * chip with 0x4c slave address. The other chip at 0x4d is currently ignored!
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5142@4c {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5142";
++				reg = <0x4c>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		piano_dac: __overlay__ {
++			compatible = "allo,piano-dac";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain =
++			<&piano_dac>,"allo,24db_digital_gain?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/allo-piano-dac-plus-pcm512x-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-piano-dac-plus-pcm512x-audio-overlay.dts
+new file mode 100644
+index 000000000000..d47a35def4f7
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/allo-piano-dac-plus-pcm512x-audio-overlay.dts
+@@ -0,0 +1,57 @@
++// Definitions for Piano DAC
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			allo_pcm5122_4c: pcm5122@4c {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4c>;
++				sound-name-prefix = "Main";
++				status = "okay";
++			};
++			allo_pcm5122_4d: pcm5122@4d {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4d>;
++				sound-name-prefix = "Sub";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		piano_dac: __overlay__ {
++			compatible = "allo,piano-dac-plus";
++			audio-codec = <&allo_pcm5122_4c &allo_pcm5122_4d>;
++			i2s-controller = <&i2s>;
++			mute1-gpios = <&gpio 6 1>;
++			mute2-gpios = <&gpio 25 1>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain =
++			<&piano_dac>,"allo,24db_digital_gain?";
++		glb_mclk =
++			<&piano_dac>,"allo,glb_mclk?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/anyspi-overlay.dts b/arch/arm/boot/dts/overlays/anyspi-overlay.dts
+new file mode 100755
+index 000000000000..87523dcca318
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/anyspi-overlay.dts
+@@ -0,0 +1,205 @@
++/*
++ * Universal device tree overlay for SPI devices
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev1>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target-path = "spi1/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target-path = "spi1/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@4 {
++		target-path = "spi1/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@5 {
++		target-path = "spi2/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@6 {
++		target-path = "spi2/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@7 {
++		target-path = "spi2/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@8 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			anyspi_00: anyspi@0 {
++				reg = <0>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	fragment@9 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			anyspi_01: anyspi@1 {
++				reg = <1>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	fragment@10 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			anyspi_10: anyspi@0 {
++				reg = <0>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	fragment@11 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			anyspi_11: anyspi@1 {
++				reg = <1>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	fragment@12 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			anyspi_12: anyspi@2 {
++				reg = <2>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	fragment@13 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			anyspi_20: anyspi@0 {
++				reg = <0>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	fragment@14 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			anyspi_21: anyspi@1 {
++				reg = <1>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	fragment@15 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			anyspi_22: anyspi@2 {
++				reg = <2>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	__overrides__ {
++		spi0-0 = <0>, "+0+8";
++		spi0-1 = <0>, "+1+9";
++		spi1-0 = <0>, "+2+10";
++		spi1-1 = <0>, "+3+11";
++		spi1-2 = <0>, "+4+12";
++		spi2-0 = <0>, "+5+13";
++		spi2-1 = <0>, "+6+14";
++		spi2-2 = <0>, "+7+15";
++		dev = <&anyspi_00>,"compatible",
++		      <&anyspi_01>,"compatible",
++		      <&anyspi_10>,"compatible",
++		      <&anyspi_11>,"compatible",
++		      <&anyspi_12>,"compatible",
++		      <&anyspi_20>,"compatible",
++		      <&anyspi_21>,"compatible",
++		      <&anyspi_22>,"compatible";
++		speed = <&anyspi_00>, "spi-max-frequency:0",
++		        <&anyspi_01>, "spi-max-frequency:0",
++		        <&anyspi_10>, "spi-max-frequency:0",
++		        <&anyspi_11>, "spi-max-frequency:0",
++		        <&anyspi_12>, "spi-max-frequency:0",
++		        <&anyspi_20>, "spi-max-frequency:0",
++		        <&anyspi_21>, "spi-max-frequency:0",
++		        <&anyspi_22>, "spi-max-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/apds9960-overlay.dts b/arch/arm/boot/dts/overlays/apds9960-overlay.dts
+new file mode 100644
+index 000000000000..bb18cca1ac66
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/apds9960-overlay.dts
+@@ -0,0 +1,55 @@
++// Definitions for APDS-9960 ambient light and gesture sensor
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c1>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			apds9960_pins: apds9960_pins@39 {
++				brcm,pins = <4>;
++				brcm,function = <0>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&apds9960>;
++		apds9960_irq: __overlay__ {
++			#interrupt-cells = <2>;
++			interrupt-parent = <&gpio>;
++			interrupts = <4 1>;
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			apds9960: apds@39 {
++				compatible = "avago,apds9960";
++				reg = <0x39>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		gpiopin = <&apds9960_pins>,"brcm,pins:0",
++				<&apds9960_irq>,"interrupts:0";
++		noints = <0>,"!1!2";
++	};
++};
++
+diff --git a/arch/arm/boot/dts/overlays/applepi-dac-overlay.dts b/arch/arm/boot/dts/overlays/applepi-dac-overlay.dts
+new file mode 100644
+index 000000000000..4769296ec9d6
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/applepi-dac-overlay.dts
+@@ -0,0 +1,57 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++
++    fragment@0 {
++        target = <&sound>;
++        __overlay__ {
++            compatible = "simple-audio-card";
++            simple-audio-card,name = "ApplePi-DAC";
++
++            status = "okay";
++
++            playback_link: simple-audio-card,dai-link@1 {
++                format = "i2s";
++
++                p_cpu_dai: cpu {
++                    sound-dai = <&i2s>;
++                    dai-tdm-slot-num = <2>;
++                    dai-tdm-slot-width = <32>;
++                };
++
++                p_codec_dai: codec {
++                    sound-dai = <&codec_out>;
++                };
++            };
++        };
++    };
++
++    fragment@1 {
++        target-path = "/";
++        __overlay__ {
++            codec_out: pcm1794a-codec {
++                #sound-dai-cells = <0>;
++                compatible = "ti,pcm1794a";
++                status = "okay";
++            };
++        };
++    };
++
++    fragment@2 {
++        target = <&i2s>;
++        __overlay__ {
++            #sound-dai-cells = <0>;
++            status = "okay";
++        };
++    };
++};
++
++/*
++   Written by: Leonid Ayzenshtat
++   Company: Orchard Audio (www.orchardaudio.com)
++
++   compile with:
++   dtc -@ -H epapr -O dtb -o ApplePi-DAC.dtbo -W no-unit_address_vs_reg ApplePi-DAC.dts
++*/
+diff --git a/arch/arm/boot/dts/overlays/arducam-64mp-overlay.dts b/arch/arm/boot/dts/overlays/arducam-64mp-overlay.dts
+new file mode 100644
+index 000000000000..19c8cb6e451c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/arducam-64mp-overlay.dts
+@@ -0,0 +1,94 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for Arducam 64MP camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			arducam_64mp: arducam_64mp@1a {
++				compatible = "arducam,64mp";
++				reg = <0x1a>;
++				status = "okay";
++
++				clocks = <&cam1_clk>;
++				clock-names = "xclk";
++
++				VANA-supply = <&cam1_reg>;	/* 2.8v */
++				VDIG-supply = <&cam_dummy_reg>;	/* 1.8v */
++				VDDL-supply = <&cam_dummy_reg>;	/* 1.2v */
++
++				rotation = <0>;
++				orientation = <2>;
++
++				port {
++					arducam_64mp_0: endpoint {
++						remote-endpoint = <&csi1_ep>;
++						clock-lanes = <0>;
++						data-lanes = <1 2>;
++						clock-noncontinuous;
++						link-frequencies =
++							/bits/ 64 <456000000>;
++					};
++				};
++			};
++		};
++	};
++
++	csi_frag: fragment@1 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++			brcm,media-controller;
++
++			port{
++				csi1_ep: endpoint{
++					remote-endpoint = <&arducam_64mp_0>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@3 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			clock-frequency = <24000000>;
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		rotation = <&arducam_64mp>,"rotation:0";
++		orientation = <&arducam_64mp>,"orientation:0";
++		media-controller = <&csi>,"brcm,media-controller?";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_vc>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&arducam_64mp>, "clocks:0=",<&cam0_clk>,
++		       <&arducam_64mp>, "VANA-supply:0=",<&cam0_reg>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/arducam-pivariety-overlay.dts b/arch/arm/boot/dts/overlays/arducam-pivariety-overlay.dts
+new file mode 100644
+index 000000000000..7434e242dba6
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/arducam-pivariety-overlay.dts
+@@ -0,0 +1,94 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for Arducam Pivariety camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			arducam_pivariety: arducam_pivariety@c {
++				compatible = "arducam,arducam-pivariety";
++				reg = <0x0c>;
++				status = "okay";
++
++				clocks = <&cam1_clk>;
++				clock-names = "xclk";
++
++				VANA-supply = <&cam1_reg>;	/* 2.8v */
++				VDIG-supply = <&cam_dummy_reg>;	/* 1.8v */
++				VDDL-supply = <&cam_dummy_reg>;	/* 1.2v */
++
++				rotation = <0>;
++				orientation = <2>;
++
++				port {
++					arducam_pivariety_0: endpoint {
++						remote-endpoint = <&csi1_ep>;
++						clock-lanes = <0>;
++						data-lanes = <1 2>;
++						clock-noncontinuous;
++						link-frequencies =
++							/bits/ 64 <493500000>;
++					};
++				};
++			};
++		};
++	};
++
++	csi_frag: fragment@1 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++			brcm,media-controller;
++
++			port{
++				csi1_ep: endpoint{
++					remote-endpoint = <&arducam_pivariety_0>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@3 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			clock-frequency = <24000000>;
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		rotation = <&arducam_pivariety>,"rotation:0";
++		orientation = <&arducam_pivariety>,"orientation:0";
++		media-controller = <&csi>,"brcm,media-controller?";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_vc>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&arducam_pivariety>, "clocks:0=",<&cam0_clk>,
++		       <&arducam_pivariety>, "VANA-supply:0=",<&cam0_reg>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/at86rf233-overlay.dts b/arch/arm/boot/dts/overlays/at86rf233-overlay.dts
+new file mode 100644
+index 000000000000..5a3f4571ee78
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/at86rf233-overlay.dts
+@@ -0,0 +1,57 @@
++/dts-v1/;
++/plugin/;
++
++/* Overlay for Atmel AT86RF233 IEEE 802.15.4 WPAN transceiver on spi0.0 */
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			lowpan0: at86rf233@0 {
++				compatible = "atmel,at86rf233";
++				reg = <0>;
++				interrupt-parent = <&gpio>;
++				interrupts = <23 4>; /* active high */
++				reset-gpio = <&gpio 24 1>;
++				sleep-gpio = <&gpio 25 1>;
++				spi-max-frequency = <3000000>;
++				xtal-trim = /bits/ 8 <0xf>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			lowpan0_pins: lowpan0_pins {
++				brcm,pins = <23 24 25>;
++				brcm,function = <0 1 1>; /* in out out */
++			};
++		};
++	};
++
++	__overrides__ {
++		interrupt = <&lowpan0>, "interrupts:0",
++			<&lowpan0_pins>, "brcm,pins:0";
++		reset     = <&lowpan0>, "reset-gpio:4",
++			<&lowpan0_pins>, "brcm,pins:4";
++		sleep     = <&lowpan0>, "sleep-gpio:4",
++			<&lowpan0_pins>, "brcm,pins:8";
++		speed     = <&lowpan0>, "spi-max-frequency:0";
++		trim      = <&lowpan0>, "xtal-trim.0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts b/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts
+new file mode 100644
+index 000000000000..57a66eac8e9b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts
+@@ -0,0 +1,60 @@
++// Definitions for audioinjector.net audio add on soundcard
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			cs42448_mclk: codec-mclk {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <49152000>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			cs42448: cs42448@48 {
++				#sound-dai-cells = <0>;
++				compatible = "cirrus,cs42448";
++				reg = <0x48>;
++				clocks = <&cs42448_mclk>;
++				clock-names = "mclk";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		snd: __overlay__ {
++			compatible = "ai,audioinjector-octo-soundcard";
++			mult-gpios = <&gpio 27 0>, <&gpio 22 0>, <&gpio 23 0>,
++				     <&gpio 24 0>;
++			reset-gpios = <&gpio 5 0>;
++			i2s-controller = <&i2s>;
++			codec = <&cs42448>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		non-stop-clocks = <&snd>, "non-stop-clocks?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/audioinjector-bare-i2s-overlay.dts b/arch/arm/boot/dts/overlays/audioinjector-bare-i2s-overlay.dts
+new file mode 100644
+index 000000000000..7565ac4d1c28
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/audioinjector-bare-i2s-overlay.dts
+@@ -0,0 +1,50 @@
++// Definitions for audioinjector.net audio soundcard
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			codec_bare: codec_bare {
++				compatible = "linux,spdif-dit";
++				#sound-dai-cells = <0>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "simple-audio-card";
++			i2s-controller = <&i2s>;
++			status = "okay";
++
++			simple-audio-card,name = "audioinjector-bare";
++			simple-audio-card,format = "i2s";
++
++			simple-audio-card,bitclock-master = <&dailink0_master>;
++			simple-audio-card,frame-master = <&dailink0_master>;
++
++			dailink0_master: simple-audio-card,cpu {
++				sound-dai = <&i2s>;
++				dai-tdm-slot-num = <2>;
++				dai-tdm-slot-width = <32>;
++			};
++
++			snd_codec: simple-audio-card,codec {
++					sound-dai = <&codec_bare>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/audioinjector-isolated-soundcard-overlay.dts b/arch/arm/boot/dts/overlays/audioinjector-isolated-soundcard-overlay.dts
+new file mode 100644
+index 000000000000..63e05cf9665d
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/audioinjector-isolated-soundcard-overlay.dts
+@@ -0,0 +1,55 @@
++// Definitions for audioinjector.net audio isolated soundcard
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			cs4272_mclk: codec-mclk {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <24576000>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			cs4272: cs4271@10 {
++				#sound-dai-cells = <0>;
++				compatible = "cirrus,cs4271";
++				reg = <0x10>;
++				reset-gpio = <&gpio 5 0>;
++				clocks = <&cs4272_mclk>;
++				clock-names = "mclk";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		snd: __overlay__ {
++			compatible = "ai,audioinjector-isolated-soundcard";
++			mute-gpios = <&gpio 17 0>;
++			i2s-controller = <&i2s>;
++			codec = <&cs4272>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/audioinjector-ultra-overlay.dts b/arch/arm/boot/dts/overlays/audioinjector-ultra-overlay.dts
+new file mode 100644
+index 000000000000..fb4a4678a17a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/audioinjector-ultra-overlay.dts
+@@ -0,0 +1,71 @@
++// Definitions for audioinjector.net audio add on soundcard
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			cs4265: cs4265@4e {
++				#sound-dai-cells = <0>;
++				compatible = "cirrus,cs4265";
++				reg = <0x4e>;
++				reset-gpios = <&gpio 5 0>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "simple-audio-card";
++			i2s-controller = <&i2s>;
++			status = "okay";
++
++			simple-audio-card,name = "audioinjector-ultra";
++
++			simple-audio-card,widgets =
++				"Line", "OUTPUTS",
++				"Line", "INPUTS";
++
++			simple-audio-card,routing =
++				"OUTPUTS","LINEOUTL",
++				"OUTPUTS","LINEOUTR",
++				"OUTPUTS","SPDIFOUT",
++				"LINEINL","INPUTS",
++				"LINEINR","INPUTS",
++				"MICL","INPUTS",
++				"MICR","INPUTS";
++
++			simple-audio-card,format = "i2s";
++
++			simple-audio-card,bitclock-master = <&sound_master>;
++			simple-audio-card,frame-master = <&sound_master>;
++
++			simple-audio-card,cpu {
++				sound-dai = <&i2s>;
++				dai-tdm-slot-num = <2>;
++				dai-tdm-slot-width = <32>;
++			};
++
++			sound_master: simple-audio-card,codec {
++				sound-dai = <&cs4265>;
++				system-clock-frequency = <12288000>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/audioinjector-wm8731-audio-overlay.dts b/arch/arm/boot/dts/overlays/audioinjector-wm8731-audio-overlay.dts
+new file mode 100644
+index 000000000000..68f4427d86c3
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/audioinjector-wm8731-audio-overlay.dts
+@@ -0,0 +1,39 @@
++// Definitions for audioinjector.net audio add on soundcard
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			wm8731@1a {
++				#sound-dai-cells = <0>;
++				compatible = "wlf,wm8731";
++				reg = <0x1a>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "ai,audioinjector-pi-soundcard";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/audiosense-pi-overlay.dts b/arch/arm/boot/dts/overlays/audiosense-pi-overlay.dts
+new file mode 100644
+index 000000000000..81af26374d92
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/audiosense-pi-overlay.dts
+@@ -0,0 +1,82 @@
++// Definitions for audiosense add on soundcard
++/dts-v1/;
++/plugin/;
++#include <dt-bindings/pinctrl/bcm2835.h>
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			codec_reg_1v8: codec-reg-1v8 {
++				compatible = "regulator-fixed";
++				regulator-name = "tlv320aic3204_1v8";
++				regulator-min-microvolt = <1800000>;
++				regulator-max-microvolt = <1800000>;
++				regulator-always-on;
++			};
++
++			/* audio external oscillator */
++			codec_osc: codec_osc {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <12000000>;	/* 12 MHz */
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			codec_rst: codec-rst {
++				brcm,pins = <26>;
++				brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			codec: tlv320aic32x4@18 {
++				#sound-dai-cells = <0>;
++				compatible = "ti,tlv320aic32x4";
++				reg = <0x18>;
++
++				clocks = <&codec_osc>;
++				clock-names = "mclk";
++
++				iov-supply = <&vdd_3v3_reg>;
++				ldoin-supply = <&vdd_3v3_reg>;
++
++				gpio-controller;
++				#gpio-cells = <2>;
++				reset-gpios = <&gpio 26 GPIO_ACTIVE_HIGH>;
++
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "as,audiosense-pi";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/audremap-overlay.dts b/arch/arm/boot/dts/overlays/audremap-overlay.dts
+new file mode 100644
+index 000000000000..29399c5c84f6
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/audremap-overlay.dts
+@@ -0,0 +1,44 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++        compatible = "brcm,bcm2835";
++
++        fragment@0 {
++                target = <&audio_pins>;
++                frag0: __overlay__ {
++                };
++        };
++
++	fragment@1 {
++                target = <&audio_pins>;
++                __overlay__ {
++                        brcm,pins = < 12 13 >;
++                        brcm,function = < 4 >; /* alt0 alt0 */
++                        brcm,pull = < 0 >;
++                };
++        };
++
++	fragment@2 {
++		target = <&audio_pins>;
++		__dormant__ {
++                        brcm,pins = < 18 19 >;
++                        brcm,function = < 2 >; /* alt5 alt5 */
++                        brcm,pull = < 0 >;
++		};
++	};
++
++	fragment@3 {
++		target = <&chosen>;
++		__overlay__  {
++			bootargs = "snd_bcm2835.enable_headphones=1";
++		};
++	};
++
++	__overrides__ {
++		swap_lr = <&frag0>, "swap_lr?";
++		enable_jack = <&frag0>, "enable_jack?";
++		pins_12_13 = <0>,"+1-2";
++		pins_18_19 = <0>,"-1+2";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/balena-fin-overlay.dts b/arch/arm/boot/dts/overlays/balena-fin-overlay.dts
+new file mode 100644
+index 000000000000..8fc22587e69c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/balena-fin-overlay.dts
+@@ -0,0 +1,125 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&mmcnr>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&sdio_pins>;
++			bus-width = <4>;
++			brcm,overclock-50 = <35>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			sdio_pins: sdio_ovl_pins {
++				brcm,pins = <34 35 36 37 38 39>;
++				brcm,function = <7>; /* ALT3 = SD1 */
++				brcm,pull = <0 2 2 2 2 2>;
++			};
++
++			power_ctrl_pins: power_ctrl_pins {
++				brcm,pins = <40>;
++				brcm,function = <1>; // out
++			};
++		};
++	};
++
++	fragment@2 {
++		target-path = "/";
++		__overlay__ {
++			// We should switch to mmc-pwrseq-sd8787 after making it
++			// compatible with sd8887
++			// Currently that module requires two GPIOs to function since it
++			// targets a slightly different chip
++			power_ctrl: power_ctrl {
++				compatible = "gpio-poweroff";
++				gpios = <&gpio 40 1>;
++				force;
++				pinctrl-names = "default";
++				pinctrl-0 = <&power_ctrl_pins>;
++			};
++
++			i2c_soft: i2c@0 {
++				compatible = "i2c-gpio";
++				gpios = <&gpio 43 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN) /* sda */
++				         &gpio 42 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN) /* scl */>;
++				i2c-gpio,delay-us = <5>;
++				i2c-gpio,scl-open-drain;
++				i2c-gpio,sda-open-drain;
++				#address-cells = <1>;
++				#size-cells = <0>;
++			};
++
++			sd8xxx-wlan {
++				drvdbg = <0x6>;
++				drv_mode = <0x1>;
++				cfg80211_wext = <0xf>;
++				sta_name = "wlan";
++				wfd_name = "p2p";
++				cal_data_cfg = "none";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c_soft>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			gpio_expander: gpio_expander@20 {
++				compatible = "nxp,pca9554";
++				gpio-controller;
++				#gpio-cells = <2>;
++				reg = <0x20>;
++				status = "okay";
++			};
++
++			// rtc clock
++			ds1307: ds1307@68 {
++				compatible = "dallas,ds1307";
++				reg = <0x68>;
++				status = "okay";
++			};
++
++			// RGB LEDs (>= v1.1.0)
++			pca9633: pca9633@62 {
++				compatible = "nxp,pca9633";
++				reg = <0x62>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				red@0 {
++					label = "red";
++					reg = <0>;
++					linux,default-trigger = "none";
++				};
++				green@1 {
++					label = "green";
++					reg = <1>;
++					linux,default-trigger = "none";
++				};
++				blue@2 {
++					label = "blue";
++					reg = <2>;
++					linux,default-trigger = "none";
++				};
++				unused@3 {
++					label = "unused";
++					reg = <3>;
++					linux,default-trigger = "none";
++				};
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/camera-mux-2port-overlay.dts b/arch/arm/boot/dts/overlays/camera-mux-2port-overlay.dts
+new file mode 100644
+index 000000000000..ef24d5a7f78c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/camera-mux-2port-overlay.dts
+@@ -0,0 +1,409 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Overlay to configure a 2 port camera multiplexer
++//
++// Configuration is based on the Arducam Doubleplexer
++// which uses a PCA9543 I2C multiplexer to handle the
++// I2C, and GPIO 4 to control the MIPI mux, and GPIO 17
++// to enable the CSI-2 mux output (gpio-hog).
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	/* Fragments that complete the individual sensor fragments */
++	/* IMX290 */
++	fragment@0 {
++		target = <&imx290_0_ep>;
++		__overlay__ {
++			data-lanes = <1 2>;
++			link-frequencies =
++				/bits/ 64 <445500000 297000000>;
++		};
++	};
++
++	fragment@1 {
++		target = <&imx290_1_ep>;
++		__overlay__ {
++			data-lanes = <1 2>;
++			link-frequencies =
++				/bits/ 64 <445500000 297000000>;
++		};
++	};
++
++	/* IMX477 */
++	fragment@10 {
++		target = <&imx477_0>;
++		__overlay__ {
++			compatible = "sony,imx477";
++		};
++	};
++
++	fragment@11 {
++		target = <&imx477_1>;
++		__overlay__ {
++			compatible = "sony,imx477";
++		};
++	};
++
++	/* Additional fragments affecting the mux nodes */
++	fragment@100 {
++		target = <&mux_in0>;
++		__dormant__ {
++			data-lanes = <1>;
++		};
++	};
++	fragment@101 {
++		target = <&mux_in0>;
++		__overlay__ {
++			data-lanes = <1 2>;
++		};
++	};
++
++	fragment@102 {
++		target = <&mux_in1>;
++		__dormant__ {
++			data-lanes = <1>;
++		};
++	};
++	fragment@103 {
++		target = <&mux_in1>;
++		__overlay__ {
++			data-lanes = <1 2>;
++		};
++	};
++
++	/* Mux define */
++	fragment@200 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pca@70 {
++				reg = <0x70>;
++				compatible = "nxp,pca9543";
++
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				i2c@0 {
++					reg = <0>;
++					#address-cells = <1>;
++					#size-cells = <0>;
++
++					#define cam_node imx219_0
++					#define cam_endpoint imx219_0_ep
++					#define cam1_clk clk_24mhz
++					#include "imx219.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx477_0
++					#define cam_endpoint imx477_0_ep
++					#define cam1_clk clk_24mhz
++					#include "imx477_378.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov5647_0
++					#define cam_endpoint ov5647_0_ep
++					#define cam1_clk clk_25mhz
++					#include "ov5647.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov7251_0
++					#define cam_endpoint ov7251_0_ep
++					#define cam1_clk clk_24mhz
++					#include "ov7251.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov9281_0
++					#define cam_endpoint ov9281_0_ep
++					#define cam1_clk clk_24mhz
++					#include "ov9281.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx258_0
++					#define cam_endpoint imx258_0_ep
++					#define cam1_clk clk_24mhz
++					#include "imx258.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx290_0
++					#define cam_endpoint imx290_0_ep
++					#define cam1_clk clk_imx290
++					#include "imx290_327.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov2311_0
++					#define cam_endpoint ov2311_0_ep
++					#define cam1_clk clk_24mhz
++					#include "ov2311.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++				};
++
++				i2c@1 {
++					reg = <1>;
++					#address-cells = <1>;
++					#size-cells = <0>;
++
++					#define cam_node imx219_1
++					#define cam_endpoint imx219_1_ep
++					#define cam1_clk clk_24mhz
++					#include "imx219.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx477_1
++					#define cam_endpoint imx477_1_ep
++					#define cam1_clk clk_24mhz
++					#include "imx477_378.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov5647_1
++					#define cam_endpoint ov5647_1_ep
++					#define cam1_clk clk_25mhz
++					#include "ov5647.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov7251_1
++					#define cam_endpoint ov7251_1_ep
++					#define cam1_clk clk_24mhz
++					#include "ov7251.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov9281_1
++					#define cam_endpoint ov9281_1_ep
++					#define cam1_clk clk_24mhz
++					#include "ov9281.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx258_1
++					#define cam_endpoint imx258_1_ep
++					#define cam1_clk clk_24mhz
++					#include "imx258.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx290_1
++					#define cam_endpoint imx290_1_ep
++					#define cam1_clk clk_imx290
++					#include "imx290_327.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov2311_1
++					#define cam_endpoint ov2311_1_ep
++					#define cam1_clk clk_24mhz
++					#include "ov2311.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++				};
++			};
++		};
++	};
++
++	fragment@201 {
++		target = <&csi1>;
++		__overlay__ {
++			status = "okay";
++
++			brcm,media-controller;
++
++			port {
++				csi1_ep: endpoint {
++					remote-endpoint = <&mux_out>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++				};
++			};
++		};
++	};
++
++	fragment@202 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@203 {
++		target-path="/";
++		__overlay__ {
++			mux: mux-controller {
++				compatible = "gpio-mux";
++				#mux-control-cells = <0>;
++
++				mux-gpios = <&gpio 4 GPIO_ACTIVE_HIGH>;
++			};
++
++			video-mux {
++				compatible = "video-mux";
++				mux-controls = <&mux>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				port@0 {
++					reg = <0>;
++
++					mux_in0: endpoint {
++						clock-lanes = <0>;
++					};
++				};
++
++				port@1 {
++					reg = <1>;
++
++					mux_in1: endpoint {
++						clock-lanes = <0>;
++					};
++				};
++
++				port@2 {
++					reg = <2>;
++
++					mux_out: endpoint {
++						remote-endpoint = <&csi1_ep>;
++						clock-lanes = <0>;
++					};
++				};
++			};
++
++			clk_24mhz: clk_24mhz {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++
++				clock-frequency = <24000000>;
++				status = "okay";
++			};
++
++			clk_25mhz: clk_25mhz {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++
++				clock-frequency = <25000000>;
++				status = "okay";
++			};
++
++			clk_imx290: clk_imx290 {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++
++				clock-frequency = <37125000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@204 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@205 {
++		target = <&gpio>;
++		__overlay__ {
++			mipi_sw_oe_hog {
++				gpio-hog;
++				gpios = <17 GPIO_ACTIVE_LOW>;
++				output-high;
++			};
++		};
++	};
++
++	__overrides__ {
++		cam0-imx219 = <&mux_in0>, "remote-endpoint:0=",<&imx219_0_ep>,
++			      <&imx219_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&mux_in0>, "clock-noncontinuous?",
++			      <&imx219_0>, "status=okay";
++		cam0-imx477 = <&mux_in0>, "remote-endpoint:0=",<&imx477_0_ep>,
++			      <&imx477_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&mux_in0>, "clock-noncontinuous?",
++			      <&imx477_0>, "status=okay";
++		cam0-ov5647 = <&mux_in0>, "remote-endpoint:0=",<&ov5647_0_ep>,
++			      <&ov5647_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&ov5647_0>, "status=okay";
++		cam0-ov7251 = <&mux_in0>, "remote-endpoint:0=",<&ov7251_0_ep>,
++			      <&ov7251_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&ov7251_0>, "status=okay",
++			      <0>,"+100-101";
++		cam0-ov9281 = <&mux_in0>, "remote-endpoint:0=",<&ov9281_0_ep>,
++			      <&ov9281_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&ov9281_0>, "status=okay";
++		cam0-imx258 = <&mux_in0>, "remote-endpoint:0=",<&imx258_0_ep>,
++			      <&imx258_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&imx258_0>, "status=okay";
++		cam0-imx290 = <&mux_in0>, "remote-endpoint:0=",<&imx290_0_ep>,
++			      <&imx290_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&imx290_0>, "status=okay";
++		cam0-ov2311 = <&mux_in0>, "remote-endpoint:0=",<&ov2311_0_ep>,
++			      <&ov2311_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&ov2311_0>, "status=okay";
++
++		cam1-imx219 = <&mux_in1>, "remote-endpoint:0=",<&imx219_1_ep>,
++			      <&imx219_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&mux_in1>, "clock-noncontinuous?",
++			      <&imx219_1>, "status=okay";
++		cam1-imx477 = <&mux_in1>, "remote-endpoint:0=",<&imx477_1_ep>,
++			      <&imx477_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&mux_in1>, "clock-noncontinuous?",
++			      <&imx477_1>, "status=okay";
++		cam1-ov5647 = <&mux_in1>, "remote-endpoint:0=",<&ov5647_1_ep>,
++			      <&ov5647_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&ov5647_1>, "status=okay";
++		cam1-ov7251 = <&mux_in1>, "remote-endpoint:0=",<&ov7251_1_ep>,
++			      <&ov7251_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&ov7251_1>, "status=okay",
++			      <0>,"+102-103";
++		cam1-ov9281 = <&mux_in1>, "remote-endpoint:0=",<&ov9281_1_ep>,
++			      <&ov9281_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&ov9281_1>, "status=okay";
++		cam1-imx258 = <&mux_in1>, "remote-endpoint:0=",<&imx258_1_ep>,
++			      <&imx258_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&imx258_1>, "status=okay";
++		cam1-imx290 = <&mux_in1>, "remote-endpoint:0=",<&imx290_1_ep>,
++			      <&imx290_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&imx290_1>, "status=okay";
++		cam1-ov2311 = <&mux_in1>, "remote-endpoint:0=",<&ov2311_1_ep>,
++			      <&ov2311_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&ov2311_1>, "status=okay";
++
++		cam0-imx290-clk-freq = <&clk_imx290>,"clock-frequency:0",
++				       <&imx290_0>,"clock-frequency:0";
++		cam1-imx290-clk-freq = <&clk_imx290>,"clock-frequency:0",
++				       <&imx290_1>,"clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/camera-mux-4port-overlay.dts b/arch/arm/boot/dts/overlays/camera-mux-4port-overlay.dts
+new file mode 100644
+index 000000000000..e1a9529c4173
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/camera-mux-4port-overlay.dts
+@@ -0,0 +1,684 @@
++// SPDX-License-Identifier: GPL-2.0-only
++
++// Overlay to configure a 4 port camera multiplexer
++//
++// Configuration is based on the Arducam 4 channel multiplexer
++// which uses a PCA9543 I2C multiplexer to handle the
++// I2C, and GPIOs 4, 17, and 18 to control the MIPI muxes.
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	/* Fragments that complete the individual sensor fragments */
++	/* IMX290 */
++	fragment@0 {
++		target = <&imx290_0_ep>;
++		__overlay__ {
++			data-lanes = <1 2>;
++			link-frequencies =
++				/bits/ 64 <445500000 297000000>;
++		};
++	};
++
++	fragment@1 {
++		target = <&imx290_1_ep>;
++		__overlay__ {
++			data-lanes = <1 2>;
++			link-frequencies =
++				/bits/ 64 <445500000 297000000>;
++		};
++	};
++
++	fragment@2 {
++		target = <&imx290_2_ep>;
++		__overlay__ {
++			data-lanes = <1 2>;
++			link-frequencies =
++				/bits/ 64 <445500000 297000000>;
++		};
++	};
++
++	fragment@3 {
++		target = <&imx290_3_ep>;
++		__overlay__ {
++			data-lanes = <1 2>;
++			link-frequencies =
++				/bits/ 64 <445500000 297000000>;
++		};
++	};
++
++	/* IMX477 */
++	fragment@10 {
++		target = <&imx477_0>;
++		__overlay__ {
++			compatible = "sony,imx477";
++		};
++	};
++
++	fragment@11 {
++		target = <&imx477_1>;
++		__overlay__ {
++			compatible = "sony,imx477";
++		};
++	};
++
++	fragment@12 {
++		target = <&imx477_2>;
++		__overlay__ {
++			compatible = "sony,imx477";
++		};
++	};
++
++	fragment@13 {
++		target = <&imx477_3>;
++		__overlay__ {
++			compatible = "sony,imx477";
++		};
++	};
++
++	/* Additional fragments affecting the mux nodes */
++	fragment@100 {
++		target = <&mux_in0>;
++		__dormant__ {
++			data-lanes = <1>;
++		};
++	};
++	fragment@101 {
++		target = <&mux_in0>;
++		__overlay__ {
++			data-lanes = <1 2>;
++		};
++	};
++
++	fragment@102 {
++		target = <&mux_in1>;
++		__dormant__ {
++			data-lanes = <1>;
++		};
++	};
++	fragment@103 {
++		target = <&mux_in1>;
++		__overlay__ {
++			data-lanes = <1 2>;
++		};
++	};
++
++	fragment@104 {
++		target = <&mux_in2>;
++		__dormant__ {
++			data-lanes = <1>;
++		};
++	};
++	fragment@105 {
++		target = <&mux_in2>;
++		__overlay__ {
++			data-lanes = <1 2>;
++		};
++	};
++
++	fragment@106 {
++		target = <&mux_in3>;
++		__dormant__ {
++			data-lanes = <1>;
++		};
++	};
++	fragment@107 {
++		target = <&mux_in3>;
++		__overlay__ {
++			data-lanes = <1 2>;
++		};
++	};
++
++	/* Mux define */
++	fragment@200 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pca@70 {
++				reg = <0x70>;
++				compatible = "nxp,pca9544";
++
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				i2c@0 {
++					reg = <0>;
++					#address-cells = <1>;
++					#size-cells = <0>;
++
++					#define cam_node imx219_0
++					#define cam_endpoint imx219_0_ep
++					#define cam1_clk clk_24mhz
++					#include "imx219.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx477_0
++					#define cam_endpoint imx477_0_ep
++					#define cam1_clk clk_24mhz
++					#include "imx477_378.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov5647_0
++					#define cam_endpoint ov5647_0_ep
++					#define cam1_clk clk_25mhz
++					#include "ov5647.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov7251_0
++					#define cam_endpoint ov7251_0_ep
++					#define cam1_clk clk_24mhz
++					#include "ov7251.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov9281_0
++					#define cam_endpoint ov9281_0_ep
++					#define cam1_clk clk_24mhz
++					#include "ov9281.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx258_0
++					#define cam_endpoint imx258_0_ep
++					#define cam1_clk clk_24mhz
++					#include "imx258.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx290_0
++					#define cam_endpoint imx290_0_ep
++					#define cam1_clk clk_imx290
++					#include "imx290_327.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov2311_0
++					#define cam_endpoint ov2311_0_ep
++					#define cam1_clk clk_24mhz
++					#include "ov2311.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++				};
++
++				i2c@1 {
++					reg = <1>;
++					#address-cells = <1>;
++					#size-cells = <0>;
++
++					#define cam_node imx219_1
++					#define cam_endpoint imx219_1_ep
++					#define cam1_clk clk_24mhz
++					#include "imx219.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx477_1
++					#define cam_endpoint imx477_1_ep
++					#define cam1_clk clk_24mhz
++					#include "imx477_378.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov5647_1
++					#define cam_endpoint ov5647_1_ep
++					#define cam1_clk clk_25mhz
++					#include "ov5647.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov7251_1
++					#define cam_endpoint ov7251_1_ep
++					#define cam1_clk clk_24mhz
++					#include "ov7251.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov9281_1
++					#define cam_endpoint ov9281_1_ep
++					#define cam1_clk clk_24mhz
++					#include "ov9281.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx258_1
++					#define cam_endpoint imx258_1_ep
++					#define cam1_clk clk_24mhz
++					#include "imx258.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx290_1
++					#define cam_endpoint imx290_1_ep
++					#define cam1_clk clk_imx290
++					#include "imx290_327.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov2311_1
++					#define cam_endpoint ov2311_1_ep
++					#define cam1_clk clk_24mhz
++					#include "ov2311.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++				};
++
++				i2c@2 {
++					reg = <2>;
++					#address-cells = <1>;
++					#size-cells = <0>;
++
++					#define cam_node imx219_2
++					#define cam_endpoint imx219_2_ep
++					#define cam1_clk clk_24mhz
++					#include "imx219.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx477_2
++					#define cam_endpoint imx477_2_ep
++					#define cam1_clk clk_24mhz
++					#include "imx477_378.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov5647_2
++					#define cam_endpoint ov5647_2_ep
++					#define cam1_clk clk_25mhz
++					#include "ov5647.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov7251_2
++					#define cam_endpoint ov7251_2_ep
++					#define cam1_clk clk_24mhz
++					#include "ov7251.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov9281_2
++					#define cam_endpoint ov9281_2_ep
++					#define cam1_clk clk_24mhz
++					#include "ov9281.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx258_2
++					#define cam_endpoint imx258_2_ep
++					#define cam1_clk clk_24mhz
++					#include "imx258.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx290_2
++					#define cam_endpoint imx290_2_ep
++					#define cam1_clk clk_imx290
++					#include "imx290_327.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov2311_2
++					#define cam_endpoint ov2311_2_ep
++					#define cam1_clk clk_24mhz
++					#include "ov2311.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++				};
++
++				i2c@3 {
++					reg = <3>;
++					#address-cells = <1>;
++					#size-cells = <0>;
++
++					#define cam_node imx219_3
++					#define cam_endpoint imx219_3_ep
++					#define cam1_clk clk_24mhz
++					#include "imx219.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx477_3
++					#define cam_endpoint imx477_3_ep
++					#define cam1_clk clk_24mhz
++					#include "imx477_378.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov5647_3
++					#define cam_endpoint ov5647_3_ep
++					#define cam1_clk clk_25mhz
++					#include "ov5647.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov7251_3
++					#define cam_endpoint ov7251_3_ep
++					#define cam1_clk clk_24mhz
++					#include "ov7251.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov9281_3
++					#define cam_endpoint ov9281_3_ep
++					#define cam1_clk clk_24mhz
++					#include "ov9281.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx258_3
++					#define cam_endpoint imx258_3_ep
++					#define cam1_clk clk_24mhz
++					#include "imx258.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx290_3
++					#define cam_endpoint imx290_3_ep
++					#define cam1_clk clk_imx290
++					#include "imx290_327.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov2311_3
++					#define cam_endpoint ov2311_3_ep
++					#define cam1_clk clk_24mhz
++					#include "ov2311.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++				};
++			};
++		};
++	};
++
++	fragment@201 {
++		target = <&csi1>;
++		__overlay__ {
++			status = "okay";
++
++			brcm,media-controller;
++
++			port {
++				csi1_ep: endpoint {
++					remote-endpoint = <&mux_out>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++				};
++			};
++		};
++	};
++
++	fragment@202 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@203 {
++		target-path="/";
++		__overlay__ {
++			mux: mux-controller {
++				compatible = "gpio-mux";
++				#mux-control-cells = <0>;
++
++				/* SEL, En2, En1 */
++				mux-gpios = <&gpio 4 GPIO_ACTIVE_HIGH>,
++					    <&gpio 18 GPIO_ACTIVE_HIGH>,
++					    <&gpio 17 GPIO_ACTIVE_HIGH>;
++			};
++
++			video-mux {
++				compatible = "video-mux";
++				mux-controls = <&mux>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				/* GPIO mappings settings for selecting the different
++				 * camera connectors are not direct, hence port@ values
++				 * are not straight forward.
++				 */
++				port@2 {
++					/* Port A - GPIO 17 = 0, GPIO 18 = 1,GPIO 4 = 0 */
++					reg = <2>;
++
++					mux_in0: endpoint {
++						clock-lanes = <0>;
++					};
++				};
++
++				port@3 {
++					/* Port B - GPIO 17 = 0, GPIO 18 = 1,GPIO 4 = 1 */
++					reg = <3>;
++
++					mux_in1: endpoint {
++						clock-lanes = <0>;
++					};
++				};
++
++				port@4 {
++					/* Port C - GPIO 17 = 1, GPIO 18 = 0, GPIO 4 = 0 */
++					reg = <4>;
++
++					mux_in2: endpoint {
++						clock-lanes = <0>;
++					};
++				};
++
++				port@5 {
++					/* Port D - GPIO 17 = 1, GPIO 18 = 0, GPIO 4 = 1 */
++					reg = <5>;
++
++					mux_in3: endpoint {
++						clock-lanes = <0>;
++					};
++				};
++
++				port@6 {
++					/* Output port needs to be the highest port number */
++					reg = <6>;
++
++					mux_out: endpoint {
++						remote-endpoint = <&csi1_ep>;
++						clock-lanes = <0>;
++					};
++				};
++			};
++
++			clk_24mhz: clk_24mhz {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++
++				clock-frequency = <24000000>;
++				status = "okay";
++			};
++
++			clk_25mhz: clk_25mhz {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++
++				clock-frequency = <25000000>;
++				status = "okay";
++			};
++
++			clk_imx290: clk_imx290 {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++
++				clock-frequency = <37125000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@204 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		cam0-imx219 = <&mux_in0>, "remote-endpoint:0=",<&imx219_0_ep>,
++			      <&imx219_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&mux_in0>, "clock-noncontinuous?",
++			      <&imx219_0>, "status=okay";
++		cam0-imx477 = <&mux_in0>, "remote-endpoint:0=",<&imx477_0_ep>,
++			      <&imx477_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&mux_in0>, "clock-noncontinuous?",
++			      <&imx477_0>, "status=okay";
++		cam0-ov5647 = <&mux_in0>, "remote-endpoint:0=",<&ov5647_0_ep>,
++			      <&ov5647_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&ov5647_0>, "status=okay";
++		cam0-ov7251 = <&mux_in0>, "remote-endpoint:0=",<&ov7251_0_ep>,
++			      <&ov7251_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&ov7251_0>, "status=okay",
++			      <0>,"+100-101";
++		cam0-ov9281 = <&mux_in0>, "remote-endpoint:0=",<&ov9281_0_ep>,
++			      <&ov9281_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&ov9281_0>, "status=okay";
++		cam0-imx258 = <&mux_in0>, "remote-endpoint:0=",<&imx258_0_ep>,
++			      <&imx258_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&imx258_0>, "status=okay";
++		cam0-imx290 = <&mux_in0>, "remote-endpoint:0=",<&imx290_0_ep>,
++			      <&imx290_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&imx290_0>, "status=okay";
++		cam0-ov2311 = <&mux_in0>, "remote-endpoint:0=",<&ov2311_0_ep>,
++			      <&ov2311_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&ov2311_0>, "status=okay";
++
++		cam1-imx219 = <&mux_in1>, "remote-endpoint:0=",<&imx219_1_ep>,
++			      <&imx219_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&mux_in1>, "clock-noncontinuous?",
++			      <&imx219_1>, "status=okay";
++		cam1-imx477 = <&mux_in1>, "remote-endpoint:0=",<&imx477_1_ep>,
++			      <&imx477_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&mux_in1>, "clock-noncontinuous?",
++			      <&imx477_1>, "status=okay";
++		cam1-ov5647 = <&mux_in1>, "remote-endpoint:0=",<&ov5647_1_ep>,
++			      <&ov5647_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&ov5647_1>, "status=okay";
++		cam1-ov7251 = <&mux_in1>, "remote-endpoint:0=",<&ov7251_1_ep>,
++			      <&ov7251_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&ov7251_1>, "status=okay",
++			      <0>,"+102-103";
++		cam1-ov9281 = <&mux_in1>, "remote-endpoint:0=",<&ov9281_1_ep>,
++			      <&ov9281_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&ov9281_1>, "status=okay";
++		cam1-imx258 = <&mux_in1>, "remote-endpoint:0=",<&imx258_1_ep>,
++			      <&imx258_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&imx258_1>, "status=okay";
++		cam1-imx290 = <&mux_in1>, "remote-endpoint:0=",<&imx290_1_ep>,
++			      <&imx290_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&imx290_1>, "status=okay";
++		cam1-ov2311 = <&mux_in1>, "remote-endpoint:0=",<&ov2311_1_ep>,
++			      <&ov2311_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&ov2311_1>, "status=okay";
++
++		cam2-imx219 = <&mux_in2>, "remote-endpoint:0=",<&imx219_2_ep>,
++			      <&imx219_2_ep>, "remote-endpoint:0=",<&mux_in2>,
++			      <&mux_in2>, "clock-noncontinuous?",
++			      <&imx219_2>, "status=okay";
++		cam2-imx477 = <&mux_in2>, "remote-endpoint:0=",<&imx477_2_ep>,
++			      <&imx477_2_ep>, "remote-endpoint:0=",<&mux_in2>,
++			      <&mux_in2>, "clock-noncontinuous?",
++			      <&imx477_2>, "status=okay";
++		cam2-ov5647 = <&mux_in2>, "remote-endpoint:0=",<&ov5647_2_ep>,
++			      <&ov5647_2_ep>, "remote-endpoint:0=",<&mux_in2>,
++			      <&ov5647_2>, "status=okay";
++		cam2-ov7251 = <&mux_in2>, "remote-endpoint:0=",<&ov7251_2_ep>,
++			      <&ov7251_2_ep>, "remote-endpoint:0=",<&mux_in2>,
++			      <&ov7251_2>, "status=okay",
++			      <0>,"+104-105";
++		cam2-ov9281 = <&mux_in2>, "remote-endpoint:0=",<&ov9281_2_ep>,
++			      <&ov9281_2_ep>, "remote-endpoint:0=",<&mux_in2>,
++			      <&ov9281_2>, "status=okay";
++		cam2-imx258 = <&mux_in2>, "remote-endpoint:0=",<&imx258_2_ep>,
++			      <&imx258_2>, "status=okay",
++			      <&imx258_2>, "remote-endpoint:0=",<&mux_in2>;
++		cam2-imx290 = <&mux_in2>, "remote-endpoint:0=",<&imx290_2_ep>,
++			      <&imx290_2_ep>, "remote-endpoint:0=",<&mux_in2>,
++			      <&imx290_2>, "status=okay";
++		cam2-ov2311 = <&mux_in2>, "remote-endpoint:0=",<&ov2311_2_ep>,
++			      <&ov2311_2_ep>, "remote-endpoint:0=",<&mux_in2>,
++			      <&ov2311_2>, "status=okay";
++
++		cam3-imx219 = <&mux_in3>, "remote-endpoint:0=",<&imx219_3_ep>,
++			      <&imx219_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++			      <&mux_in3>, "clock-noncontinuous?",
++			      <&imx219_3>, "status=okay";
++		cam3-imx477 = <&mux_in3>, "remote-endpoint:0=",<&imx477_3_ep>,
++			      <&imx477_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++			      <&mux_in3>, "clock-noncontinuous?",
++			      <&imx477_3>, "status=okay";
++		cam3-ov5647 = <&mux_in3>, "remote-endpoint:0=",<&ov5647_3_ep>,
++			      <&ov5647_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++			      <&ov5647_3>, "status=okay";
++		cam3-ov7251 = <&mux_in3>, "remote-endpoint:0=",<&ov7251_3_ep>,
++			      <&ov7251_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++			      <&ov7251_3>, "status=okay",
++			      <0>,"+106-107";
++		cam3-ov9281 = <&mux_in3>, "remote-endpoint:0=",<&ov9281_3_ep>,
++			      <&ov9281_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++			      <&ov9281_3>, "status=okay";
++		cam3-imx258 = <&mux_in3>, "remote-endpoint:0=",<&imx258_3_ep>,
++			      <&imx258_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++			      <&imx258_3>, "status=okay";
++		cam3-imx290 = <&mux_in3>, "remote-endpoint:0=",<&imx290_3_ep>,
++			      <&imx290_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++			      <&imx290_3>, "status=okay";
++		cam3-ov2311 = <&mux_in3>, "remote-endpoint:0=",<&ov2311_3_ep>,
++			      <&ov2311_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++			      <&ov2311_3>, "status=okay";
++
++		cam0-imx290-clk-freq = <&clk_imx290>,"clock-frequency:0",
++				       <&imx290_0>,"clock-frequency:0";
++		cam1-imx290-clk-freq = <&clk_imx290>,"clock-frequency:0",
++				       <&imx290_1>,"clock-frequency:0";
++		cam2-imx290-clk-freq = <&clk_imx290>,"clock-frequency:0",
++				       <&imx290_2>,"clock-frequency:0";
++		cam3-imx290-clk-freq = <&clk_imx290>,"clock-frequency:0",
++				       <&imx290_3>,"clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/cap1106-overlay.dts b/arch/arm/boot/dts/overlays/cap1106-overlay.dts
+new file mode 100644
+index 000000000000..0a585e725f84
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/cap1106-overlay.dts
+@@ -0,0 +1,52 @@
++// Overlay for cap1106 from  Microchip Semiconductor
++// add CONFIG_KEYBOARD_CAP11XX=y
++
++/dts-v1/;
++/plugin/;
++
++/ {
++        compatible = "brcm,bcm2835";
++        fragment@0 {
++                target = <&i2c1>;
++                __overlay__{
++                        status = "okay";
++                        cap1106: cap1106@28 {
++                                compatible = "microchip,cap1106";
++                                pinctrl-0 = <&cap1106_pins>;
++                                pinctrl-names = "default";
++                                interrupt-parent = <&gpio>;
++                                interrupts = <4 2>;
++                                reg = <0x28>;
++                                autorepeat;
++                                microchip,sensor-gain = <2>;
++
++                                linux,keycodes = <2>,           /* KEY_1 */
++                                                <3>,            /* KEY_2 */
++                                                <4>,            /* KEY_3 */
++                                                <5>,            /* KEY_4 */
++                                                <6>,            /* KEY_5 */
++                                                <7>;            /* KEY_6 */
++
++                                #address-cells = <1>;
++                                #size-cells = <0>;
++                                status = "okay";
++
++                        };
++                };
++        };
++        fragment@1 {
++                target = <&gpio>;
++                __overlay__ {
++                        cap1106_pins: cap1106_pins {
++                                brcm,pins = <4>;
++                                brcm,function = <0>; /* in */
++                                brcm,pull = <0>; /* none */
++                        };
++                };
++        };
++
++        __overrides__ {
++                int_pin = <&cap1106>, "interrupts:0",
++                          <&cap1106_pins>, "brcm,pins:0";
++        };
++};
+diff --git a/arch/arm/boot/dts/overlays/chipdip-dac-overlay.dts b/arch/arm/boot/dts/overlays/chipdip-dac-overlay.dts
+new file mode 100644
+index 000000000000..09c7417b4707
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/chipdip-dac-overlay.dts
+@@ -0,0 +1,46 @@
++/*
++ * Device Tree overlay for ChipDip DAC
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			spdif-transmitter {
++				#address-cells = <0>;
++				#size-cells = <0>;
++				#sound-dai-cells = <0>;
++				compatible = "linux,spdif-dit";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "chipdip,chipdip-dac";
++			i2s-controller = <&i2s>;
++			sr0-gpios = <&gpio 5 0>;
++			sr1-gpios = <&gpio 6 0>;
++			sr2-gpios = <&gpio 12 0>;
++			res0-gpios = <&gpio 24 0>;
++			res1-gpios = <&gpio 27 0>;
++			mute-gpios = <&gpio 4 0>;
++			sdwn-gpios = <&gpio 13 0>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/cirrus-wm5102-overlay.dts b/arch/arm/boot/dts/overlays/cirrus-wm5102-overlay.dts
+new file mode 100644
+index 000000000000..ed0c2745399f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/cirrus-wm5102-overlay.dts
+@@ -0,0 +1,172 @@
++// Definitions for the Cirrus Logic Audio Card
++/dts-v1/;
++/plugin/;
++#include <dt-bindings/pinctrl/bcm2835.h>
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/mfd/arizona.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			wlf_5102_pins: wlf_5102_pins {
++				brcm,pins = <17 22 27>;
++				brcm,function = <
++					BCM2835_FSEL_GPIO_OUT
++					BCM2835_FSEL_GPIO_OUT
++					BCM2835_FSEL_GPIO_IN
++				>;
++			};
++			wlf_8804_pins: wlf_8804_pins {
++				brcm,pins = <8>;
++				brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&spi0_cs_pins>;
++		__overlay__ {
++			brcm,pins = <7>;
++			brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++		};
++	};
++
++
++	fragment@3 {
++		target-path = "/";
++		__overlay__ {
++			rpi_cirrus_reg_1v8: rpi_cirrus_reg_1v8 {
++				compatible = "regulator-fixed";
++				regulator-name = "RPi-Cirrus 1v8";
++				regulator-min-microvolt = <1800000>;
++				regulator-max-microvolt = <1800000>;
++				regulator-always-on;
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@5 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@6 {
++		target = <&spi0>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			cs-gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
++
++			wm5102@0{
++				compatible = "wlf,wm5102";
++				reg = <0>;
++
++				pinctrl-names = "default";
++				pinctrl-0 = <&wlf_5102_pins>;
++
++				spi-max-frequency = <500000>;
++
++				interrupt-parent = <&gpio>;
++				interrupts = <27 8>;
++				interrupt-controller;
++				#interrupt-cells = <2>;
++
++				gpio-controller;
++				#gpio-cells = <2>;
++
++				LDOVDD-supply = <&rpi_cirrus_reg_1v8>;
++				AVDD-supply = <&rpi_cirrus_reg_1v8>;
++				DBVDD1-supply = <&rpi_cirrus_reg_1v8>;
++				DBVDD2-supply = <&vdd_3v3_reg>;
++				DBVDD3-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&rpi_cirrus_reg_1v8>;
++				SPKVDDL-supply = <&vdd_5v0_reg>;
++				SPKVDDR-supply = <&vdd_5v0_reg>;
++				DCVDD-supply = <&arizona_ldo1>;
++
++				reset-gpios = <&gpio 17 GPIO_ACTIVE_HIGH>;
++				wlf,ldoena = <&gpio 22 GPIO_ACTIVE_HIGH>;
++				wlf,gpio-defaults = <
++					ARIZONA_GP_DEFAULT
++					ARIZONA_GP_DEFAULT
++					ARIZONA_GP_DEFAULT
++					ARIZONA_GP_DEFAULT
++					ARIZONA_GP_DEFAULT
++				>;
++				wlf,micd-configs = <0 1 0>;
++				wlf,dmic-ref = <
++					ARIZONA_DMIC_MICVDD
++					ARIZONA_DMIC_MICBIAS2
++					ARIZONA_DMIC_MICVDD
++					ARIZONA_DMIC_MICVDD
++				>;
++				wlf,inmode = <
++					ARIZONA_INMODE_DIFF
++					ARIZONA_INMODE_DMIC
++					ARIZONA_INMODE_SE
++					ARIZONA_INMODE_DIFF
++				>;
++				status = "okay";
++
++				arizona_ldo1: ldo1 {
++					regulator-name = "LDO1";
++					// default constraints as in
++					// arizona-ldo1.c
++					regulator-min-microvolt = <1200000>;
++					regulator-max-microvolt = <1800000>;
++				};
++			};
++		};
++	};
++
++	fragment@7 {
++		target = <&i2c1>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			wm8804@3b {
++				compatible = "wlf,wm8804";
++				reg = <0x3b>;
++				status = "okay";
++
++				pinctrl-names = "default";
++				pinctrl-0 = <&wlf_8804_pins>;
++
++				PVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				wlf,reset-gpio = <&gpio 8 GPIO_ACTIVE_HIGH>;
++			};
++		};
++	};
++
++	fragment@8 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "wlf,rpi-cirrus";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/cma-overlay.dts b/arch/arm/boot/dts/overlays/cma-overlay.dts
+new file mode 100644
+index 000000000000..1d87c599f909
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/cma-overlay.dts
+@@ -0,0 +1,36 @@
++/*
++ * cma.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&cma>;
++		frag0: __overlay__ {
++			/*
++			 * The default size when using this overlay is 256 MB
++			 * and should be kept as is for backwards
++			 * compatibility.
++			 */
++			size = <0x10000000>;
++		};
++	};
++
++	__overrides__ {
++		cma-512 = <&frag0>,"size:0=",<0x20000000>;
++		cma-448 = <&frag0>,"size:0=",<0x1c000000>;
++		cma-384 = <&frag0>,"size:0=",<0x18000000>;
++		cma-320 = <&frag0>,"size:0=",<0x14000000>;
++		cma-256 = <&frag0>,"size:0=",<0x10000000>;
++		cma-192 = <&frag0>,"size:0=",<0xC000000>;
++		cma-128 = <&frag0>,"size:0=",<0x8000000>;
++		cma-96  = <&frag0>,"size:0=",<0x6000000>;
++		cma-64  = <&frag0>,"size:0=",<0x4000000>;
++		cma-size = <&frag0>,"size:0"; /* in bytes, 4MB aligned */
++		cma-default = <0>,"-0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/cutiepi-panel-overlay.dts b/arch/arm/boot/dts/overlays/cutiepi-panel-overlay.dts
+new file mode 100644
+index 000000000000..6f9694e81d6a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/cutiepi-panel-overlay.dts
+@@ -0,0 +1,117 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2711";
++
++    fragment@0 {
++        target=<&dsi1>;
++
++        __overlay__ {
++            status = "okay";
++
++            #address-cells = <1>;
++            #size-cells = <0>;
++
++            port {
++                dsi1_out_port: endpoint {
++                    remote-endpoint = <&panel_dsi_in1>;
++                };
++            };
++
++            display1: panel@0 {
++                compatible = "nwe,nwe080";
++                reg=<0>;
++                backlight = <&rpi_backlight>;
++                reset-gpios = <&gpio 20 0>;
++                port {
++                    panel_dsi_in1: endpoint {
++                        remote-endpoint = <&dsi1_out_port>;
++                    };
++                };
++            };
++        };
++    };
++
++    fragment@1 {
++        target = <&gpio>;
++        __overlay__ {
++            pwm_pins: pwm_pins {
++                brcm,pins = <12>;
++                brcm,function = <4>; // ALT0
++            };
++        };
++    };
++
++    fragment@2 {
++        target = <&pwm>;
++        frag1: __overlay__ {
++            pinctrl-names = "default";
++            pinctrl-0 = <&pwm_pins>;
++            assigned-clock-rates = <1000000>;
++            status = "okay";
++        };
++    };
++
++    fragment@3 {
++        target-path = "/";
++        __overlay__ {
++            rpi_backlight: rpi_backlight {
++                compatible = "pwm-backlight";
++                brightness-levels = <0 6 8 12 16 24 32 40 48 64 96 128 160 192 224 255>;
++                default-brightness-level = <6>;
++                pwms = <&pwm 0 200000>;
++                power-supply = <&vdd_3v3_reg>;
++                status = "okay";
++            };
++        };
++    };
++
++    fragment@4 {
++        target = <&i2c6>;
++        frag0: __overlay__ {
++            status = "okay";
++            pinctrl-names = "default";
++            pinctrl-0 = <&i2c6_pins>;
++            clock-frequency = <100000>;
++        };
++    };
++
++    fragment@5 {
++        target = <&i2c6_pins>;
++        __overlay__ {
++            brcm,pins = <22 23>;
++        };
++    };
++
++    fragment@6 {
++            target = <&gpio>;
++            __overlay__ {
++                goodix_pins: goodix_pins {
++                    brcm,pins = <21 26>; // interrupt and reset
++                    brcm,function = <0 0>; // in
++                    brcm,pull = <2 2>; // pull-up
++                };
++            };
++    };
++
++    fragment@7 {
++        target = <&i2c6>;
++        __overlay__ {
++            #address-cells = <1>;
++            #size-cells = <0>;
++            status = "okay";
++
++            gt9xx: gt9xx@5d {
++                compatible = "goodix,gt9271"; 
++                reg = <0x5D>;
++                pinctrl-names = "default";
++                pinctrl-0 = <&goodix_pins>;
++                interrupt-parent = <&gpio>;
++                interrupts = <21 2>; // high-to-low edge triggered
++                irq-gpios = <&gpio 21 0>; 
++                reset-gpios = <&gpio 26 0>;
++            };
++        };
++    };
++};
+diff --git a/arch/arm/boot/dts/overlays/dacberry400-overlay.dts b/arch/arm/boot/dts/overlays/dacberry400-overlay.dts
+new file mode 100644
+index 000000000000..4e03baadbd71
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/dacberry400-overlay.dts
+@@ -0,0 +1,71 @@
++// Definitions for DACberry400
++/dts-v1/;
++/plugin/;
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			codec_1v8_reg: codec-1v8-reg {
++			compatible = "regulator-fixed";
++			regulator-name = "tlv320aic3104_1v8";
++			regulator-min-microvolt = <1800000>;
++			regulator-max-microvolt = <1800000>;
++			regulator-always-on;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			codec_rst: codec-rst {
++				brcm,pins = <26>;
++				brcm,function = <1>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			tlv320aic3104@18 {
++				#sound-dai-cells = <0>;
++				reg = <0x18>;
++
++				compatible = "ti,tlv320aic3x";
++				AVDD-supply = <&vdd_3v3_reg>;
++				DRVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&codec_1v8_reg>;
++				IOVDD-supply = <&codec_1v8_reg>;
++
++				gpio-controller;
++				reset-gpios = <&gpio 26 1>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "osaelectronics,dacberry400";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++};
++
++
+diff --git a/arch/arm/boot/dts/overlays/dht11-overlay.dts b/arch/arm/boot/dts/overlays/dht11-overlay.dts
+new file mode 100644
+index 000000000000..8b0fc6b7a3cb
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/dht11-overlay.dts
+@@ -0,0 +1,48 @@
++/*
++ * Overlay for the DHT11/21/22 humidity/temperature sensor modules.
++ */
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			dht11: dht11@4 {
++				compatible = "dht11";
++				pinctrl-names = "default";
++				pinctrl-0 = <&dht11_pins>;
++				gpios = <&gpio 4 0>;
++				status = "okay";
++				#io-channel-cells = <1>;
++			};
++
++			iio: iio-hwmon@4 {
++				compatible = "iio-hwmon";
++				status = "okay";
++				io-channels = <&dht11 0>, <&dht11 1>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			dht11_pins: dht11_pins@4 {
++				brcm,pins = <4>;
++				brcm,function = <0>; // in
++				brcm,pull = <0>; // off
++			};
++		};
++	};
++
++	__overrides__ {
++		gpiopin = <&dht11_pins>,"brcm,pins:0",
++			<&dht11_pins>, "reg:0",
++			<&dht11>,"gpios:4",
++			<&dht11>,"reg:0",
++			<&iio>,"reg:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/dionaudio-kiwi-overlay.dts b/arch/arm/boot/dts/overlays/dionaudio-kiwi-overlay.dts
+new file mode 100644
+index 000000000000..128ef54eb89f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/dionaudio-kiwi-overlay.dts
+@@ -0,0 +1,39 @@
++// Definitions for Dion Audio KIWI streamer
++
++/*
++ * PCM1794 DAC (in hardware mode).
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			pcm1794a-codec {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm1794a";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "dionaudio,dionaudio-kiwi";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/dionaudio-loco-overlay.dts b/arch/arm/boot/dts/overlays/dionaudio-loco-overlay.dts
+new file mode 100644
+index 000000000000..d863e5c167cc
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/dionaudio-loco-overlay.dts
+@@ -0,0 +1,39 @@
++// Definitions for Dion Audio LOCO DAC-AMP
++
++/*
++ * PCM5242 DAC (in hardware mode) and TPA3118 AMP.
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			pcm5102a-codec {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5102a";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "dionaudio,loco-pcm5242-tpa3118";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/dionaudio-loco-v2-overlay.dts b/arch/arm/boot/dts/overlays/dionaudio-loco-v2-overlay.dts
+new file mode 100644
+index 000000000000..dfb8922a654b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/dionaudio-loco-v2-overlay.dts
+@@ -0,0 +1,49 @@
++/*
++ * Definitions for Dion Audio LOCO-V2 DAC-AMP
++ *  eg. dtoverlay=dionaudio-loco-v2
++ *
++ * PCM5242 DAC (in software mode) and TPA3255 AMP.
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&sound>;
++		frag0: __overlay__ {
++			compatible = "dionaudio,dionaudio-loco-v2";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4c {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4d>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain = <&frag0>,"dionaudio,24db_digital_gain?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/disable-bt-overlay.dts b/arch/arm/boot/dts/overlays/disable-bt-overlay.dts
+new file mode 100644
+index 000000000000..d5a66e5d76a9
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/disable-bt-overlay.dts
+@@ -0,0 +1,64 @@
++/dts-v1/;
++/plugin/;
++
++/* Disable Bluetooth and restore UART0/ttyAMA0 over GPIOs 14 & 15.
++   To disable the systemd service that initialises the modem so it doesn't use
++   the UART:
++
++       sudo systemctl disable hciuart
++*/
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&uart1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&uart0>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&uart0_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&bt>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&uart0_pins>;
++		__overlay__ {
++			brcm,pins;
++			brcm,function;
++			brcm,pull;
++		};
++	};
++
++	fragment@4 {
++		target = <&bt_pins>;
++		__overlay__ {
++			brcm,pins;
++			brcm,function;
++			brcm,pull;
++		};
++	};
++
++	fragment@5 {
++		target-path = "/aliases";
++		__overlay__ {
++			serial0 = "/soc/serial@7e201000";
++			serial1 = "/soc/serial@7e215040";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/disable-wifi-overlay.dts b/arch/arm/boot/dts/overlays/disable-wifi-overlay.dts
+new file mode 100644
+index 000000000000..75e046463900
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/disable-wifi-overlay.dts
+@@ -0,0 +1,20 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&mmc>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&mmcnr>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/dpi18-overlay.dts b/arch/arm/boot/dts/overlays/dpi18-overlay.dts
+new file mode 100644
+index 000000000000..4abe5be744db
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/dpi18-overlay.dts
+@@ -0,0 +1,39 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	// There is no DPI driver module, but we need a platform device
++	// node (that doesn't already use pinctrl) to hang the pinctrl
++	// reference on - leds will do
++
++	fragment@0 {
++		target = <&fb>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&dpi18_pins>;
++		};
++	};
++
++	fragment@1 {
++		target = <&vc4>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&dpi18_pins>;
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			dpi18_pins: dpi18_pins {
++				brcm,pins = <0 1 2 3 4 5 6 7 8 9 10 11
++					     12 13 14 15 16 17 18 19 20
++					     21>;
++				brcm,function = <6>; /* alt2 */
++				brcm,pull = <0>; /* no pull */
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/dpi18cpadhi-overlay.dts b/arch/arm/boot/dts/overlays/dpi18cpadhi-overlay.dts
+new file mode 100644
+index 000000000000..50c88a1ed299
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/dpi18cpadhi-overlay.dts
+@@ -0,0 +1,26 @@
++/*
++ * dpi18cpadhi-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&fb>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&dpi_18bit_cpadhi_gpio0>;
++		};
++	};
++
++	fragment@1 {
++		target = <&vc4>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&dpi_18bit_cpadhi_gpio0>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/dpi24-overlay.dts b/arch/arm/boot/dts/overlays/dpi24-overlay.dts
+new file mode 100644
+index 000000000000..44335cc81277
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/dpi24-overlay.dts
+@@ -0,0 +1,39 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	// There is no DPI driver module, but we need a platform device
++	// node (that doesn't already use pinctrl) to hang the pinctrl
++	// reference on - leds will do
++
++	fragment@0 {
++		target = <&fb>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&dpi24_pins>;
++		};
++	};
++
++	fragment@1 {
++		target = <&vc4>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&dpi24_pins>;
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			dpi24_pins: dpi24_pins {
++				brcm,pins = <0 1 2 3 4 5 6 7 8 9 10 11
++					     12 13 14 15 16 17 18 19 20
++					     21 22 23 24 25 26 27>;
++				brcm,function = <6>; /* alt2 */
++				brcm,pull = <0>; /* no pull */
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/draws-overlay.dts b/arch/arm/boot/dts/overlays/draws-overlay.dts
+new file mode 100644
+index 000000000000..d18187d7f343
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/draws-overlay.dts
+@@ -0,0 +1,208 @@
++#include <dt-bindings/clock/bcm2835.h>
++/*
++ * Device tree overlay for the DRAWS Hardware
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++    fragment@0 {
++        target = <&i2s>;
++        __overlay__ {
++            status = "okay";
++        };
++    };
++
++    fragment@1 {
++        target-path = "/";
++        __overlay__ {
++            regulators {
++                compatible = "simple-bus";
++                #address-cells = <1>;
++                #size-cells = <0>;
++
++                udrc0_ldoin: udrc0_ldoin {
++                    compatible = "regulator-fixed";
++                    regulator-name = "ldoin";
++                    regulator-min-microvolt = <3300000>;
++                    regulator-max-microvolt = <3300000>;
++                    regulator-always-on;
++                };
++
++                sc16is752_clk: sc16is752_draws_clk {
++                    compatible = "fixed-clock";
++                    #clock-cells = <0>;
++                    clock-frequency = <1843200>;
++                };
++            };
++
++            pps: pps {
++                compatible = "pps-gpio";
++                pinctrl-names = "default";
++                pinctrl-0 = <&pps_pins>;
++                gpios = <&gpio 7 0>;
++                status = "okay";
++            };
++
++            iio-hwmon {
++                compatible = "iio-hwmon";
++                status = "okay";
++                io-channels = <&tla2024 4>, <&tla2024 5>, <&tla2024 6>,
++                              <&tla2024 7>;
++            };
++        };
++    };
++
++    fragment@2 {
++        target = <&i2c_arm>;
++        __overlay__ {
++            #address-cells = <1>;
++            #size-cells = <0>;
++            status = "okay";
++
++            tlv320aic32x4: tlv320aic32x4@18 {
++                compatible = "ti,tlv320aic32x4";
++                reg = <0x18>;
++                #sound-dai-cells = <0>;
++                status = "okay";
++
++                clocks = <&clocks BCM2835_CLOCK_GP0>;
++                clock-names = "mclk";
++                assigned-clocks = <&clocks BCM2835_CLOCK_GP0>;
++                assigned-clock-rates = <25000000>;
++
++                pinctrl-names = "default";
++                pinctrl-0 = <&gpclk0_pin &aic3204_reset>;
++
++                reset-gpios = <&gpio 13 0>;
++
++                iov-supply = <&udrc0_ldoin>;
++                ldoin-supply = <&udrc0_ldoin>;
++            };
++
++            sc16is752: sc16is752@50 {
++                compatible = "nxp,sc16is752";
++                reg = <0x50>;
++                clocks = <&sc16is752_clk>;
++                interrupt-parent = <&gpio>;
++                interrupts = <17 2>; /* IRQ_TYPE_EDGE_FALLING */
++
++                pinctrl-names = "default";
++                pinctrl-0 = <&sc16is752_irq>;
++            };
++
++            tla2024: tla2024@48 {
++                compatible = "ti,ads1015";
++                reg = <0x48>;
++                #address-cells = <1>;
++                #size-cells = <0>;
++                #io-channel-cells = <1>;
++
++                adc_ch4: channel@4 {
++                    reg = <4>;
++                    ti,gain = <1>;
++                    ti,datarate = <4>;
++                };
++
++                adc_ch5: channel@5 {
++                    reg = <5>;
++                    ti,gain = <1>;
++                    ti,datarate = <4>;
++                };
++
++                adc_ch6: channel@6 {
++                    reg = <6>;
++                    ti,gain = <2>;
++                    ti,datarate = <4>;
++                };
++
++                adc_ch7: channel@7 {
++                    reg = <7>;
++                    ti,gain = <2>;
++                    ti,datarate = <4>;
++                };
++            };
++        };
++    };
++
++    fragment@3 {
++        target = <&sound>;
++        snd: __overlay__ {
++            compatible = "simple-audio-card";
++            i2s-controller = <&i2s>;
++            status = "okay";
++
++            simple-audio-card,name = "draws";
++            simple-audio-card,format = "i2s";
++
++            simple-audio-card,bitclock-master = <&dailink0_master>;
++            simple-audio-card,frame-master = <&dailink0_master>;
++
++            simple-audio-card,widgets =
++                "Line", "Line In",
++                "Line", "Line Out";
++
++            simple-audio-card,routing =
++                "IN1_R", "Line In",
++                "IN1_L", "Line In",
++                "CM_L", "Line In",
++                "CM_R", "Line In",
++                "Line Out", "LOR",
++                "Line Out", "LOL";
++
++            dailink0_master: simple-audio-card,cpu {
++                sound-dai = <&i2s>;
++            };
++
++            simple-audio-card,codec {
++                sound-dai = <&tlv320aic32x4>;
++            };
++        };
++    };
++
++    fragment@4 {
++        target = <&gpio>;
++        __overlay__ {
++            gpclk0_pin: gpclk0_pin {
++                brcm,pins = <4>;
++                brcm,function = <4>;
++            };
++
++            aic3204_reset: aic3204_reset {
++                brcm,pins = <13>;
++                brcm,function = <1>;
++                brcm,pull = <1>;
++            };
++
++            aic3204_gpio: aic3204_gpio {
++                brcm,pins = <26>;
++            };
++
++            sc16is752_irq: sc16is752_irq {
++                brcm,pins = <17>;
++                brcm,function = <0>;
++                brcm,pull = <2>;
++            };
++
++            pps_pins: pps_pins {
++                brcm,pins = <7>;
++                brcm,function = <0>;
++                brcm,pull = <0>;
++            };
++        };
++    };
++
++    __overrides__ {
++        draws_adc_ch4_gain = <&adc_ch4>,"ti,gain:0";
++        draws_adc_ch4_datarate = <&adc_ch4>,"ti,datarate:0";
++        draws_adc_ch5_gain = <&adc_ch5>,"ti,gain:0";
++        draws_adc_ch5_datarate = <&adc_ch5>,"ti,datarate:0";
++        draws_adc_ch6_gain = <&adc_ch6>,"ti,gain:0";
++        draws_adc_ch6_datarate = <&adc_ch6>,"ti,datarate:0";
++        draws_adc_ch7_gain = <&adc_ch7>,"ti,gain:0";
++        draws_adc_ch7_datarate = <&adc_ch7>,"ti,datarate:0";
++        alsaname = <&snd>, "simple-audio-card,name";
++    };
++};
+diff --git a/arch/arm/boot/dts/overlays/dwc-otg-overlay.dts b/arch/arm/boot/dts/overlays/dwc-otg-overlay.dts
+new file mode 100644
+index 000000000000..78c5e9f85048
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/dwc-otg-overlay.dts
+@@ -0,0 +1,14 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&usb>;
++		__overlay__ {
++			compatible = "brcm,bcm2708-usb";
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/dwc2-overlay.dts b/arch/arm/boot/dts/overlays/dwc2-overlay.dts
+new file mode 100644
+index 000000000000..0d83e344ad97
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/dwc2-overlay.dts
+@@ -0,0 +1,26 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&usb>;
++		#address-cells = <1>;
++		#size-cells = <1>;
++		dwc2_usb: __overlay__ {
++			compatible = "brcm,bcm2835-usb";
++			dr_mode = "otg";
++			g-np-tx-fifo-size = <32>;
++			g-rx-fifo-size = <558>;
++			g-tx-fifo-size = <512 512 512 512 512 256 256>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		dr_mode = <&dwc2_usb>, "dr_mode";
++		g-np-tx-fifo-size = <&dwc2_usb>,"g-np-tx-fifo-size:0";
++		g-rx-fifo-size = <&dwc2_usb>,"g-rx-fifo-size:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/edt-ft5406-overlay.dts b/arch/arm/boot/dts/overlays/edt-ft5406-overlay.dts
+new file mode 100644
+index 000000000000..1210e4b8e6dc
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/edt-ft5406-overlay.dts
+@@ -0,0 +1,26 @@
++/*
++ * Device Tree overlay for EDT 5406 touchscreen controller, as used on the
++ * Raspberry Pi 7" panel
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include "edt-ft5406.dtsi"
++
++/ {
++	fragment@0 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/edt-ft5406.dtsi b/arch/arm/boot/dts/overlays/edt-ft5406.dtsi
+new file mode 100644
+index 000000000000..2d0ff0e8b24e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/edt-ft5406.dtsi
+@@ -0,0 +1,47 @@
++/*
++ * Device Tree overlay for an EDT FT5406 touchscreen
++ *
++ * Note that this is included from vc4-kms-dsi-7inch, hence the
++ * fragment numbers not starting at 0.
++ */
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@10 {
++		target = <&ft5406>;
++		__overlay__ {
++			touchscreen-inverted-x;
++		};
++	};
++
++	fragment@11 {
++		target = <&ft5406>;
++		__overlay__ {
++			touchscreen-inverted-y;
++		};
++	};
++
++	fragment@12 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			ft5406: ts@38 {
++				compatible = "edt,edt-ft5506";
++				reg = <0x38>;
++
++				touchscreen-size-x = < 800 >;
++				touchscreen-size-y = < 480 >;
++			};
++		};
++	};
++
++	__overrides__ {
++		sizex = <&ft5406>,"touchscreen-size-x:0";
++		sizey = <&ft5406>,"touchscreen-size-y:0";
++		invx = <0>, "-10";
++		invy = <0>, "-11";
++		swapxy = <&ft5406>,"touchscreen-swapped-x-y?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/enc28j60-overlay.dts b/arch/arm/boot/dts/overlays/enc28j60-overlay.dts
+new file mode 100644
+index 000000000000..7af5c2e607ea
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/enc28j60-overlay.dts
+@@ -0,0 +1,53 @@
++// Overlay for the Microchip ENC28J60 Ethernet Controller
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			eth1: enc28j60@0{
++				compatible = "microchip,enc28j60";
++				reg = <0>; /* CE0 */
++				pinctrl-names = "default";
++				pinctrl-0 = <&eth1_pins>;
++				interrupt-parent = <&gpio>;
++				interrupts = <25 0x2>; /* falling edge */
++				spi-max-frequency = <12000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			eth1_pins: eth1_pins {
++				brcm,pins = <25>;
++				brcm,function = <0>; /* in */
++				brcm,pull = <0>; /* none */
++			};
++		};
++	};
++
++	__overrides__ {
++		int_pin = <&eth1>, "interrupts:0",
++		          <&eth1_pins>, "brcm,pins:0";
++		speed   = <&eth1>, "spi-max-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/enc28j60-spi2-overlay.dts b/arch/arm/boot/dts/overlays/enc28j60-spi2-overlay.dts
+new file mode 100644
+index 000000000000..17cb5b8fa485
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/enc28j60-spi2-overlay.dts
+@@ -0,0 +1,47 @@
++// Overlay for the Microchip ENC28J60 Ethernet Controller - SPI2 Compute Module
++// Interrupt pin: 39
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi2>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			eth1: enc28j60@0{
++				compatible = "microchip,enc28j60";
++				reg = <0>; /* CE0 */
++				pinctrl-names = "default";
++				pinctrl-0 = <&eth1_pins>;
++				interrupt-parent = <&gpio>;
++				interrupts = <39 0x2>; /* falling edge */
++				spi-max-frequency = <12000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			eth1_pins: eth1_pins {
++				brcm,pins = <39>;
++				brcm,function = <0>; /* in */
++				brcm,pull = <0>; /* none */
++			};
++		};
++	};
++
++	__overrides__ {
++		int_pin = <&eth1>, "interrupts:0",
++		          <&eth1_pins>, "brcm,pins:0";
++		speed   = <&eth1>, "spi-max-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/exc3000-overlay.dts b/arch/arm/boot/dts/overlays/exc3000-overlay.dts
+new file mode 100644
+index 000000000000..6f087fb20661
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/exc3000-overlay.dts
+@@ -0,0 +1,48 @@
++// Device tree overlay for I2C connected EETI EXC3000 multiple touch controller
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			exc3000_pins: exc3000_pins {
++				brcm,pins = <4>; // interrupt
++				brcm,function = <0>; // in
++				brcm,pull = <2>; // pull-up
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			exc3000: exc3000@2a {
++				compatible = "eeti,exc3000";
++				reg = <0x2a>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&exc3000_pins>;
++				interrupt-parent = <&gpio>;
++				interrupts = <4 8>; // active low level-sensitive
++				touchscreen-size-x = <4096>;
++				touchscreen-size-y = <4096>;
++			};
++		};
++	};
++
++	__overrides__ {
++		interrupt = <&exc3000_pins>,"brcm,pins:0",
++			<&exc3000>,"interrupts:0";
++		sizex = <&exc3000>,"touchscreen-size-x:0";
++		sizey = <&exc3000>,"touchscreen-size-y:0";
++		invx = <&exc3000>,"touchscreen-inverted-x?";
++		invy = <&exc3000>,"touchscreen-inverted-y?";
++		swapxy = <&exc3000>,"touchscreen-swapped-x-y?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/fbtft-overlay.dts b/arch/arm/boot/dts/overlays/fbtft-overlay.dts
+new file mode 100644
+index 000000000000..db45f8c53bcc
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/fbtft-overlay.dts
+@@ -0,0 +1,611 @@
++/*
++ * Device Tree overlay for fbtft drivers
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	/* adafruit18 */
++	fragment@0 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "sitronix,st7735r";
++			spi-max-frequency = <32000000>;
++			gamma = "02 1c 07 12 37 32 29 2d 29 25 2B 39 00 01 03 10\n03 1d 07 06 2E 2C 29 2D 2E 2E 37 3F 00 00 02 10";
++		};
++	};
++
++	/* adafruit22 */
++	fragment@1 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "himax,hx8340bn";
++			spi-max-frequency = <32000000>;
++			buswidth = <9>;
++			bgr;
++		};
++	};
++
++	/* adafruit22a */
++	fragment@2 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9340";
++			spi-max-frequency = <32000000>;
++			bgr;
++		};
++	};
++
++	/* adafruit28 */
++	fragment@3 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9341";
++			spi-max-frequency = <32000000>;
++			bgr;
++		};
++	};
++
++	/* adafruit13m */
++	fragment@4 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "solomon,ssd1306";
++			spi-max-frequency = <16000000>;
++		};
++	};
++
++	/* admatec_c-berry28 */
++	fragment@5 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "sitronix,st7789v";
++			spi-max-frequency = <48000000>;
++			init = <0x01000011
++				0x02000078
++				0x0100003A 0x05
++				0x010000B2 0x0C 0x0C 0x00 0x33 0x33
++				0x010000B7 0x35
++				0x010000C2 0x01 0xFF
++				0x010000C3 0x17
++				0x010000C4 0x20
++				0x010000BB 0x17
++				0x010000C5 0x20
++				0x010000D0 0xA4 0xA1
++				0x01000029>;
++			gamma = "D0 00 14 15 13 2C 42 43 4E 09 16 14 18 21\nD0 00 14 15 13 0B 43 55 53 0C 17 14 23 20";
++		};
++	};
++
++	/* dogs102 */
++	fragment@6 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "UltraChip,uc1701";
++			spi-max-frequency = <8000000>;
++			bgr;
++		};
++	};
++
++	/* er_tftm050_2 */
++	fragment@7 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "raio,ra8875";
++			spi-max-frequency = <5000000>;
++			spi-cpha;
++			spi-cpol;
++			width = <480>;
++			height = <272>;
++			bgr;
++		};
++	};
++
++	/* er_tftm070_5 */
++	fragment@8 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "raio,ra8875";
++			spi-max-frequency = <5000000>;
++			spi-cpha;
++			spi-cpol;
++			width = <800>;
++			height = <480>;
++			bgr;
++		};
++	};
++
++	/* ew24ha0 */
++	fragment@9 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ultrachip,uc1611";
++			spi-max-frequency = <32000000>;
++			spi-cpha;
++			spi-cpol;
++		};
++	};
++
++	/* ew24ha0_9bit */
++	fragment@10 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ultrachip,uc1611";
++			spi-max-frequency = <32000000>;
++			spi-cpha;
++			spi-cpol;
++			buswidth = <9>;
++		};
++	};
++
++	/* freetronicsoled128 */
++	fragment@11 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "solomon,ssd1351";
++			spi-max-frequency = <20000000>;
++			backlight = <2>; /* FBTFT_ONBOARD_BACKLIGHT */
++			bgr;
++		};
++	};
++
++	/* hy28a */
++	fragment@12 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9320";
++			spi-max-frequency = <32000000>;
++			spi-cpha;
++			spi-cpol;
++			startbyte = <0x70>;
++			bgr;
++		};
++	};
++
++	/* hy28b */
++	fragment@13 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9325";
++			spi-max-frequency = <48000000>;
++			spi-cpha;
++			spi-cpol;
++			init = <0x010000e7 0x0010
++				0x01000000 0x0001
++				0x01000001 0x0100
++				0x01000002 0x0700
++				0x01000003 0x1030
++				0x01000004 0x0000
++				0x01000008 0x0207
++				0x01000009 0x0000
++				0x0100000a 0x0000
++				0x0100000c 0x0001
++				0x0100000d 0x0000
++				0x0100000f 0x0000
++				0x01000010 0x0000
++				0x01000011 0x0007
++				0x01000012 0x0000
++				0x01000013 0x0000
++				0x02000032
++				0x01000010 0x1590
++				0x01000011 0x0227
++				0x02000032
++				0x01000012 0x009c
++				0x02000032
++				0x01000013 0x1900
++				0x01000029 0x0023
++				0x0100002b 0x000e
++				0x02000032
++				0x01000020 0x0000
++				0x01000021 0x0000
++				0x02000032
++				0x01000050 0x0000
++				0x01000051 0x00ef
++				0x01000052 0x0000
++				0x01000053 0x013f
++				0x01000060 0xa700
++				0x01000061 0x0001
++				0x0100006a 0x0000
++				0x01000080 0x0000
++				0x01000081 0x0000
++				0x01000082 0x0000
++				0x01000083 0x0000
++				0x01000084 0x0000
++				0x01000085 0x0000
++				0x01000090 0x0010
++				0x01000092 0x0000
++				0x01000093 0x0003
++				0x01000095 0x0110
++				0x01000097 0x0000
++				0x01000098 0x0000
++				0x01000007 0x0133
++				0x01000020 0x0000
++				0x01000021 0x0000
++				0x02000064>;
++			startbyte = <0x70>;
++			bgr;
++			fps = <50>;
++			gamma = "04 1F 4 7 7 0 7 7 6 0\n0F 00 1 7 4 0 0 0 6 7";
++		};
++	};
++
++	/* itdb28_spi */
++	fragment@14 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9325";
++			spi-max-frequency = <32000000>;
++			bgr;
++		};
++	};
++
++	/* mi0283qt-2 */
++	fragment@15 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "himax,hx8347d";
++			spi-max-frequency = <32000000>;
++			startbyte = <0x70>;
++			bgr;
++		};
++	};
++
++	/* mi0283qt-9a */
++	fragment@16 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9341";
++			spi-max-frequency = <32000000>;
++			buswidth = <9>;
++			bgr;
++		};
++	};
++
++	/* nokia3310 */
++	fragment@17 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "philips,pcd8544";
++			spi-max-frequency = <400000>;
++		};
++	};
++
++	/* nokia3310a */
++	fragment@18 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "teralane,tls8204";
++			spi-max-frequency = <1000000>;
++		};
++	};
++
++	/* nokia5110 */
++	fragment@19 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9163";
++			spi-max-frequency = <12000000>;
++			bgr;
++		};
++	};
++
++	/* piscreen */
++	fragment@20 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9486";
++			spi-max-frequency = <32000000>;
++			regwidth = <16>;
++			bgr;
++		};
++	};
++
++	/* pitft */
++	fragment@21 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9340";
++			spi-max-frequency = <32000000>;
++			init = <0x01000001
++				0x02000005
++				0x01000028
++				0x010000EF 0x03 0x80 0x02
++				0x010000CF 0x00 0xC1 0x30
++				0x010000ED 0x64 0x03 0x12 0x81
++				0x010000E8 0x85 0x00 0x78
++				0x010000CB 0x39 0x2C 0x00 0x34 0x02
++				0x010000F7 0x20
++				0x010000EA 0x00 0x00
++				0x010000C0 0x23
++				0x010000C1 0x10
++				0x010000C5 0x3E 0x28
++				0x010000C7 0x86
++				0x0100003A 0x55
++				0x010000B1 0x00 0x18
++				0x010000B6 0x08 0x82 0x27
++				0x010000F2 0x00
++				0x01000026 0x01
++				0x010000E0 0x0F 0x31 0x2B 0x0C 0x0E 0x08 0x4E 0xF1 0x37 0x07 0x10 0x03 0x0E 0x09 0x00
++				0x010000E1 0x00 0x0E 0x14 0x03 0x11 0x07 0x31 0xC1 0x48 0x08 0x0F 0x0C 0x31 0x36 0x0F
++				0x01000011
++				0x02000064
++				0x01000029
++				0x02000014>;
++			bgr;
++		};
++	};
++
++	/* pioled */
++	fragment@22 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "solomon,ssd1351";
++			spi-max-frequency = <20000000>;
++			bgr;
++			gamma = "0 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4";
++		};
++	};
++
++	/* rpi-display */
++	fragment@23 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9341";
++			spi-max-frequency = <32000000>;
++			bgr;
++		};
++	};
++
++	/* sainsmart18 */
++	fragment@24 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "sitronix,st7735r";
++			spi-max-frequency = <32000000>;
++		};
++	};
++
++	/* sainsmart32_spi */
++	fragment@25 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "solomon,ssd1289";
++			spi-max-frequency = <16000000>;
++			bgr;
++		};
++	};
++
++	/* tinylcd35 */
++	fragment@26 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "neosec,tinylcd";
++			spi-max-frequency = <32000000>;
++			bgr;
++		};
++	};
++
++	/* tm022hdh26 */
++	fragment@27 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9341";
++			spi-max-frequency = <32000000>;
++			bgr;
++		};
++	};
++
++	/* tontec35_9481 - boards before 02 July 2014 */
++	fragment@28 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9481";
++			spi-max-frequency = <128000000>;
++			spi-cpha;
++			spi-cpol;
++			bgr;
++		};
++	};
++
++	/* tontec35_9486 - boards after 02 July 2014 */
++	fragment@29 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9486";
++			spi-max-frequency = <128000000>;
++			spi-cpha;
++			spi-cpol;
++			bgr;
++		};
++	};
++
++	/* waveshare32b */
++	fragment@30 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9340";
++			spi-max-frequency = <48000000>;
++			init = <0x010000CB 0x39 0x2C 0x00 0x34 0x02
++				0x010000CF 0x00 0xC1 0x30
++				0x010000E8 0x85 0x00 0x78
++				0x010000EA 0x00 0x00
++				0x010000ED 0x64 0x03 0x12 0x81
++				0x010000F7 0x20
++				0x010000C0 0x23
++				0x010000C1 0x10
++				0x010000C5 0x3E 0x28
++				0x010000C7 0x86
++				0x01000036 0x28
++				0x0100003A 0x55
++				0x010000B1 0x00 0x18
++				0x010000B6 0x08 0x82 0x27
++				0x010000F2 0x00
++				0x01000026 0x01
++				0x010000E0 0x0F 0x31 0x2B 0x0C 0x0E 0x08 0x4E 0xF1 0x37 0x07 0x10 0x03 0x0E 0x09 0x00
++				0x010000E1 0x00 0x0E 0x14 0x03 0x11 0x07 0x31 0xC1 0x48 0x08 0x0F 0x0C 0x31 0x36 0x0F
++				0x01000011
++				0x02000078
++				0x01000029
++				0x0100002C>;
++			bgr;
++		};
++	};
++
++	/* waveshare22 */
++	fragment@31 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "hitachi,bd663474";
++			spi-max-frequency = <32000000>;
++			spi-cpha;
++			spi-cpol;
++		};
++	};
++
++	spidev_fragment: fragment@100 {
++		target-path = "spi0/spidev@0";
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	display_fragment: fragment@101 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			display: display@0{
++				reg = <0>;
++				spi-max-frequency = <32000000>;
++				fps = <30>;
++				buswidth = <8>;
++			};
++		};
++	};
++
++	__overrides__ {
++		spi0-0        = <&display_fragment>, "target:0=",<&spi0>,
++				<&spidev_fragment>, "target-path=spi0/spidev@0",
++				<&display>, "reg:0=0";
++		spi0-1        = <&display_fragment>, "target:0=",<&spi0>,
++				<&spidev_fragment>, "target-path=spi0/spidev@1",
++				<&display>, "reg:0=1";
++		spi1-0        = <&display_fragment>, "target:0=",<&spi1>,
++				<&spidev_fragment>, "target-path=spi1/spidev@0",
++				<&display>, "reg:0=0";
++		spi1-1        = <&display_fragment>, "target:0=",<&spi1>,
++				<&spidev_fragment>, "target-path=spi1/spidev@1",
++				<&display>, "reg:0=1";
++		spi1-2        = <&display_fragment>, "target:0=",<&spi1>,
++				<&spidev_fragment>, "target-path=spi1/spidev@2",
++				<&display>, "reg:0=2";
++		spi2-0        = <&display_fragment>, "target:0=",<&spi2>,
++				<&spidev_fragment>, "target-path=spi2/spidev@0",
++				<&display>, "reg:0=0";
++		spi2-1        = <&display_fragment>, "target:0=",<&spi2>,
++				<&spidev_fragment>, "target-path=spi2/spidev@1",
++				<&display>, "reg:0=1";
++		spi2-2        = <&display_fragment>, "target:0=",<&spi2>,
++				<&spidev_fragment>, "target-path=spi2/spidev@2",
++				<&display>, "reg:0=2";
++
++		speed         = <&display>, "spi-max-frequency:0";
++		cpha          = <&display>, "spi-cpha?";
++		cpol          = <&display>, "spi-cpol?";
++
++		/* Displays */
++		adafruit18    = <0>, "+0";
++		adafruit22    = <0>, "+1";
++		adafruit22a   = <0>, "+2";
++		adafruit28    = <0>, "+3";
++		adafruit13m   = <0>, "+4";
++		admatec_c-berry28 = <0>, "+5";
++		dogs102       = <0>, "+6";
++		er_tftm050_2  = <0>, "+7";
++		er_tftm070_5  = <0>, "+8";
++		ew24ha0       = <0>, "+9";
++		ew24ha0_9bit  = <0>, "+10";
++		freetronicsoled128 = <0>, "+11";
++		hy28a         = <0>, "+12";
++		hy28b         = <0>, "+13";
++		itdb28_spi    = <0>, "+14";
++		mi0283qt-2    = <0>, "+15";
++		mi0283qt-9a   = <0>, "+16";
++		nokia3310     = <0>, "+17";
++		nokia3310a    = <0>, "+18";
++		nokia5110     = <0>, "+19";
++		piscreen      = <0>, "+20";
++		pitft         = <0>, "+21";
++		pioled        = <0>, "+22";
++		rpi-display   = <0>, "+23";
++		sainsmart18   = <0>, "+24";
++		sainsmart32_spi = <0>, "+25";
++		tinylcd35     = <0>, "+26";
++		tm022hdh26    = <0>, "+27";
++		tontec35_9481 = <0>, "+28";
++		tontec35_9486 = <0>, "+29";
++		waveshare32b  = <0>, "+30";
++		waveshare22   = <0>, "+31";
++
++		/* Controllers */
++		bd663474      = <&display>, "compatible=hitachi,bd663474";
++		hx8340bn      = <&display>, "compatible=himax,hx8340bn";
++		hx8347d       = <&display>, "compatible=himax,hx8347d";
++		hx8353d       = <&display>, "compatible=himax,hx8353d";
++		hx8357d       = <&display>, "compatible=himax,hx8357d";
++		ili9163       = <&display>, "compatible=ilitek,ili9163";
++		ili9320       = <&display>, "compatible=ilitek,ili9320";
++		ili9325       = <&display>, "compatible=ilitek,ili9325";
++		ili9340       = <&display>, "compatible=ilitek,ili9340";
++		ili9341       = <&display>, "compatible=ilitek,ili9341";
++		ili9481       = <&display>, "compatible=ilitek,ili9481";
++		ili9486       = <&display>, "compatible=ilitek,ili9486";
++		pcd8544       = <&display>, "compatible=philips,pcd8544";
++		ra8875        = <&display>, "compatible=raio,ra8875";
++		s6d02a1       = <&display>, "compatible=samsung,s6d02a1";
++		s6d1121       = <&display>, "compatible=samsung,s6d1121";
++		seps525       = <&display>, "compatible=syncoam,seps525";
++		sh1106        = <&display>, "compatible=sinowealth,sh1106";
++		ssd1289       = <&display>, "compatible=solomon,ssd1289";
++		ssd1305       = <&display>, "compatible=solomon,ssd1305";
++		ssd1306       = <&display>, "compatible=solomon,ssd1306";
++		ssd1325       = <&display>, "compatible=solomon,ssd1325";
++		ssd1331       = <&display>, "compatible=solomon,ssd1331";
++		ssd1351       = <&display>, "compatible=solomon,ssd1351";
++		st7735r       = <&display>, "compatible=sitronix,st7735r";
++		st7789v       = <&display>, "compatible=sitronix,st7789v";
++		tls8204       = <&display>, "compatible=teralane,tls8204";
++		uc1611        = <&display>, "compatible=ultrachip,uc1611";
++		uc1701        = <&display>, "compatible=UltraChip,uc1701";
++		upd161704     = <&display>, "compatible=nec,upd161704";
++
++		width         = <&display>, "width:0";
++		height        = <&display>, "height:0";
++		regwidth      = <&display>, "regwidth:0";
++		buswidth      = <&display>, "buswidth:0";
++		debug         = <&display>, "debug:0";
++		rotate        = <&display>, "rotate:0";
++		bgr           = <&display>, "bgr?";
++		fps           = <&display>, "fps:0";
++		txbuflen      = <&display>, "txbuflen:0";
++		startbyte     = <&display>, "startbyte:0";
++		gamma         = <&display>, "gamma";
++
++		reset_pin     = <&display>, "reset-gpios:0=", <&gpio>,
++				<&display>, "reset-gpios:4",
++				<&display>, "reset-gpios:8=1"; /* GPIO_ACTIVE_LOW */
++		dc_pin        = <&display>, "dc-gpios:0=", <&gpio>,
++				<&display>, "dc-gpios:4",
++				<&display>, "dc-gpios:8=0"; /* GPIO_ACTIVE_HIGH */
++		led_pin       = <&display>, "led-gpios:0=", <&gpio>,
++				<&display>, "led-gpios:4",
++				<&display>, "led-gpios:8=0"; /* GPIO_ACTIVE_HIGH */
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts b/arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts
+new file mode 100644
+index 000000000000..1ab71e653e20
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts
+@@ -0,0 +1,70 @@
++// Definitions for Fe-Pi Audio
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			sgtl5000_mclk: sgtl5000_mclk {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <12288000>;
++				clock-output-names = "sgtl5000-mclk";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&soc>;
++		__overlay__ {
++			reg_1v8: reg_1v8@0 {
++				compatible = "regulator-fixed";
++				regulator-name = "1V8";
++				regulator-min-microvolt = <1800000>;
++				regulator-max-microvolt = <1800000>;
++				regulator-always-on;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			sgtl5000@a {
++				#sound-dai-cells = <0>;
++				compatible = "fsl,sgtl5000";
++				reg = <0x0a>;
++				clocks = <&sgtl5000_mclk>;
++				micbias-resistor-k-ohms = <2>;
++				micbias-voltage-m-volts = <3000>;
++				VDDA-supply = <&vdd_3v3_reg>;
++				VDDIO-supply = <&vdd_3v3_reg>;
++				VDDD-supply = <&reg_1v8>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "fe-pi,fe-pi-audio";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/fsm-demo-overlay.dts b/arch/arm/boot/dts/overlays/fsm-demo-overlay.dts
+new file mode 100644
+index 000000000000..e9944f5cd258
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/fsm-demo-overlay.dts
+@@ -0,0 +1,104 @@
++// Demo overlay for the gpio-fsm driver
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio-fsm.h>
++
++#define BUTTON1 GF_IP(0)
++#define BUTTON2 GF_SW(0)
++#define RED   GF_OP(0) // GPIO7
++#define AMBER GF_OP(1) // GPIO8
++#define GREEN GF_OP(2) // GPIO25
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			fsm_demo: fsm-demo {
++				compatible = "rpi,gpio-fsm";
++
++				debug = <0>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				num-swgpios = <1>;
++				gpio-line-names = "button2";
++				input-gpios  = <&gpio 6 1>;  // BUTTON1 (active-low)
++				output-gpios = <&gpio 7 0>,  // RED
++					       <&gpio 8 0>,  // AMBER
++					       <&gpio 25 0>; // GREEN
++				shutdown-timeout-ms = <2000>;
++
++				start {
++					start_state;
++					set = <RED 1>, <AMBER 0>, <GREEN 0>;
++					start2 = <GF_DELAY 250>;
++				};
++
++				start2 {
++					set = <RED 0>, <AMBER 1>;
++					go = <GF_DELAY 250>;
++				};
++
++				go {
++					set = <RED 0>, <AMBER 0>, <GREEN 1>;
++					ready_wait = <BUTTON1 0>;
++					shutdown1 = <GF_SHUTDOWN 0>;
++				};
++
++				ready_wait {
++					// Clear the soft GPIO
++					set = <BUTTON2 0>;
++					ready = <GF_DELAY 1000>;
++					shutdown1 = <GF_SHUTDOWN 0>;
++				};
++
++				ready {
++					stopping = <BUTTON1 1>, <BUTTON2 1>;
++					shutdown1 = <GF_SHUTDOWN 0>;
++				};
++
++				stopping {
++					set = <GREEN 0>, <AMBER 1>;
++					stopped = <GF_DELAY 1000>;
++				};
++
++				stopped {
++					set = <AMBER 0>, <RED 1>;
++					get_set = <GF_DELAY 3000>;
++					shutdown1 = <GF_SHUTDOWN 0>;
++				};
++
++				get_set {
++					set = <AMBER 1>;
++					go = <GF_DELAY 1000>;
++				};
++
++				shutdown1 {
++					set = <RED 0>, <AMBER 0>, <GREEN 1>;
++					shutdown2 = <GF_SHUTDOWN 250>;
++				};
++
++				shutdown2 {
++					set = <AMBER 1>, <GREEN 0>;
++					shutdown3 = <GF_SHUTDOWN 250>;
++				};
++
++				shutdown3 {
++					set = <RED 1>, <AMBER 0>;
++					shutdown4 = <GF_SHUTDOWN 250>;
++				};
++
++				shutdown4 {
++					shutdown_state;
++					set = <RED 0>, <AMBER 0>, <GREEN 0>;
++				};
++			};
++	       };
++        };
++
++	__overrides__ {
++		fsm_debug = <&fsm_demo>,"debug:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/gc9a01-overlay.dts b/arch/arm/boot/dts/overlays/gc9a01-overlay.dts
+new file mode 100644
+index 000000000000..3d31030c5564
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gc9a01-overlay.dts
+@@ -0,0 +1,151 @@
++/*
++    Device Tree overlay for Galaxycore GC9A01A single chip driver
++    for use on SPI TFT LCD, 240x240 65K RGB
++    Based on Galaxycore's GC9A01A datasheet Rev.1.0 (2019/07/02)
++    Copyright (C) 2022, Julianno F. C. Silva (@juliannojungle)
++
++    This program is free software: you can redistribute it and/or modify
++    it under the terms of the GNU Affero General Public License as published
++    by the Free Software Foundation, either version 3 of the License, or
++    (at your option) any later version.
++
++    This program is distributed in the hope that it will be useful,
++    but WITHOUT ANY WARRANTY; without even the implied warranty of
++    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++    GNU Affero General Public License for more details.
++
++    You should have received a copy of the GNU Affero General Public License
++    along with this program.  If not, see <https://www.gnu.org/licenses/agpl-3.0.html>.
++
++    Init sequence partially based on Waveshare team's Arduino LCD_Driver V1.0 (2020/12/09).
++
++    Permission is hereby granted, free of UBYTEge, to any person obtaining a copy
++    of this software and associated documnetation files (the "Software"), to deal
++    in the Software without restriction, including without limitation the rights
++    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++    copies of the Software, and to permit persons to whom the Software is
++    furished to do so, subject to the following conditions:
++
++    The above copyright notice and this permission notice shall be included in
++    all copies or substantial portions of the Software.
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++
++    fragment@0 {
++        target = <&spidev0>;
++        __overlay__ {
++            status = "disabled";
++        };
++    };
++
++    fragment@1 {
++        target = <&gpio>;
++        __overlay__ {
++            gc9a01_pins: gc9a01_pins {
++                brcm,pins = <25 27>;
++                brcm,function = <1 1>; /* out */
++                brcm,pull = <0 0>; /* none */
++            };
++        };
++    };
++
++    fragment@2 {
++        target = <&spi0>;
++        __overlay__ {
++            /* needed to avoid dtc warning */
++            #address-cells = <1>;
++            #size-cells = <0>;
++            status = "okay";
++
++            gc9a01: gc9a01@0 {
++                compatible = "ilitek,ili9340";
++                reg = <0>;
++                pinctrl-names = "default";
++                pinctrl-0 = <&gc9a01_pins>;
++                reset-gpios = <&gpio 27 1>;
++                dc-gpios = <&gpio 25 0>;
++                led-gpios = <&gpio 18 0>;
++                spi-max-frequency = <40000000>;
++                buswidth = <8>;
++                width = <240>;
++                height = <240>;
++                rotate = <0>;
++                fps = <50>;
++                bgr;
++                debug = <0>;
++                init = <
++                    0x01000011 /* Sleep mode OFF */
++                    0x02000078 /* Delay 120ms */
++                    0x010000EF /* Inter register enable 2 */
++                    0x010000EB 0x14
++                    /* BEGIN set inter_command HIGH */
++                    0x010000FE /* Inter register enable 1 */
++                    0x010000EF /* Inter register enable 2 */
++                    /* END set inter_command HIGH */
++                    0x010000EB 0x14
++                    0x01000084 0x40
++                    0x01000085 0xFF
++                    0x01000086 0xFF
++                    0x01000087 0xFF
++                    0x01000088 0x0A
++                    0x01000089 0x21
++                    0x0100008A 0x00
++                    0x0100008B 0x80
++                    0x0100008C 0x01
++                    0x0100008D 0x01
++                    0x0100008E 0xFF
++                    0x0100008F 0xFF
++                    0x010000B6 0x00 0x00 /* Display function control */
++                    0x01000036 0x08 /* Memory access control */
++                    0x0100003A 0x05 /* Pixel format */
++                    0x01000090 0x08 0x08 0x08 0x08
++                    0x010000BD 0x06
++                    0x010000BC 0x00
++                    0x010000FF 0x60 0x01 0x04
++                    0x010000C3 0x13 /* Voltage regulator 1a */
++                    0x010000C4 0x13 /* Voltage regulator 1b */
++                    0x010000C9 0x22 /* Voltage regulator 2a */
++                    0x010000BE 0x11
++                    0x010000E1 0x10 0x0E
++                    0x010000DF 0x21 0x0c 0x02
++                    0x010000F0 0x45 0x09 0x08 0x08 0x26 0x2A /* Set gamma1 */
++                    0x010000F1 0x43 0x70 0x72 0x36 0x37 0x6F /* Set gamma2 */
++                    0x010000F2 0x45 0x09 0x08 0x08 0x26 0x2A /* Set gamma3 */
++                    0x010000F3 0x43 0x70 0x72 0x36 0x37 0x6F /* Set gamma4 */
++                    0x010000ED 0x1B 0x0B
++                    0x010000AE 0x77
++                    0x010000CD 0x63
++                    0x01000070 0x07 0x07 0x04 0x0E 0x0F 0x09 0x07 0x08 0x03
++                    0x010000E8 0x34 /* Frame rate */
++                    0x01000062 0x18 0x0D 0x71 0xED 0x70 0x70 0x18 0x0F 0x71 0xEF 0x70 0x70
++                    0x01000063 0x18 0x11 0x71 0xF1 0x70 0x70 0x18 0x13 0x71 0xF3 0x70 0x70
++                    0x01000064 0x28 0x29 0xF1 0x01 0xF1 0x00 0x07
++                    0x01000066 0x3C 0x00 0xCD 0x67 0x45 0x45 0x10 0x00 0x00 0x00
++                    0x01000067 0x00 0x3C 0x00 0x00 0x00 0x01 0x54 0x10 0x32 0x98
++                    0x01000074 0x10 0x85 0x80 0x00 0x00 0x4E 0x00
++                    0x01000098 0x3e 0x07
++                    0x01000035 /* Tearing effect ON */
++                    0x01000021 /* Display inversion ON */
++                    0x01000011 /* Sleep mode OFF */
++                    0x0200000C /* Delay 12ms */
++                    0x01000029 /* Display ON */
++                    0x02000014 /* Delay 20ms */
++                    >;
++            };
++        };
++    };
++
++    __overrides__ {
++        speed = <&gc9a01>,"spi-max-frequency:0";
++        rotate = <&gc9a01>,"rotate:0";
++        width = <&gc9a01>,"width:0";
++        height = <&gc9a01>,"height:0";
++        fps = <&gc9a01>,"fps:0";
++        debug = <&gc9a01>,"debug:0";
++    };
++};
+diff --git a/arch/arm/boot/dts/overlays/ghost-amp-overlay.dts b/arch/arm/boot/dts/overlays/ghost-amp-overlay.dts
+new file mode 100644
+index 000000000000..7509e00679c8
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ghost-amp-overlay.dts
+@@ -0,0 +1,145 @@
++// Overlay for the PCM5122-based Ghost amplifier using gpio-fsm
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio-fsm.h>
++
++#define ENABLE   GF_SW(0)
++#define FAULT    GF_IP(0) // GPIO5
++#define RELAY1   GF_OP(0) // GPIO22
++#define RELAY2   GF_OP(1) // GPIO23
++#define RELAYSSR GF_OP(2) // GPIO24
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4c {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4c>;
++				AVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		iqaudio_dac: __overlay__ {
++			compatible = "iqaudio,iqaudio-dac";
++			i2s-controller = <&i2s>;
++			mute-gpios = <&amp 0 0>;
++			iqaudio-dac,auto-mute-amp;
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target-path = "/";
++		__overlay__ {
++			amp: ghost-amp {
++				compatible = "rpi,gpio-fsm";
++				pinctrl-names = "default";
++				pinctrl-0 = <&ghost_amp_pins>;
++
++				debug = <0>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				num-swgpios = <1>;
++				gpio-line-names = "enable";
++				input-gpios  = <&gpio 5 1>;  // FAULT (active low)
++				output-gpios = <&gpio 22 0>, // RELAY1
++					       <&gpio 23 0>, // RELAY2
++					       <&gpio 24 0>; // RELAYSSR
++				shutdown-timeout-ms = <1000>;
++
++				amp_off {
++					start_state;
++					shutdown_state;
++
++					set = <RELAYSSR 0>,
++					      <RELAY2 0>,
++					      <RELAY1 0>;
++					amp_on_1 = <ENABLE 1>;
++					fault = <FAULT 1>;
++				};
++
++				amp_on_1 {
++					set = <RELAY1 1>;
++					amp_on_2 = <GF_DELAY 1000>;
++					amp_off = <GF_SHUTDOWN 0>;
++					fault = <FAULT 1>;
++				};
++
++				amp_on_2 {
++					set = <RELAY2 1>;
++					amp_on_wait = <ENABLE 0>;
++					amp_on = <GF_DELAY 1>;
++					fault = <FAULT 1>;
++				};
++
++				amp_on {
++					set = <RELAYSSR 1>;
++					amp_on_wait = <ENABLE 0>;
++					fault = <FAULT 1>;
++				};
++
++				amp_on_wait {
++					set = <RELAYSSR 0>;
++					amp_off_1 = <GF_DELAY (30*60*1000)>,
++						    <GF_SHUTDOWN 0>;
++					amp_on = <ENABLE 1>;
++					fault = <FAULT 1>;
++				};
++
++				amp_off_1 {
++					set = <RELAY2 0>;
++					amp_on = <ENABLE 1>;
++					amp_off = <GF_DELAY 100>;
++					fault = <FAULT 1>;
++				};
++
++				// Keep this a distinct state to prevent
++				// changes and for the diagnostic output
++				fault {
++					set = <RELAYSSR 0>,
++					      <RELAY2 0>,
++					      <RELAY1 0>;
++					amp_off = <FAULT 0>;
++					shutdown_state;
++				};
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&gpio>;
++		__overlay__ {
++			ghost_amp_pins: ghost_amp_pins {
++				brcm,pins = <5 22 23 24>;
++				brcm,function = <0 1 1 1>; /* in out out out */
++				brcm,pull = <2 0 0 0>; /* up none none none */
++			};
++		};
++	};
++
++	__overrides__ {
++		fsm_debug = <&amp>,"debug:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/goodix-overlay.dts b/arch/arm/boot/dts/overlays/goodix-overlay.dts
+new file mode 100644
+index 000000000000..8571527de49a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/goodix-overlay.dts
+@@ -0,0 +1,46 @@
++// Device tree overlay for I2C connected Goodix gt9271 multiple touch controller
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			goodix_pins: goodix_pins {
++				brcm,pins = <4 17>; // interrupt and reset
++				brcm,function = <0 0>; // in
++				brcm,pull = <2 2>; // pull-up
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			gt9271: gt9271@14 {
++				compatible = "goodix,gt9271";
++				reg = <0x14>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&goodix_pins>;
++				interrupt-parent = <&gpio>;
++				interrupts = <4 2>; // high-to-low edge triggered
++				irq-gpios = <&gpio 4 0>; // Pin7 on GPIO header
++				reset-gpios = <&gpio 17 0>; // Pin11 on GPIO header
++			};
++		};
++	};
++
++	__overrides__ {
++		interrupt = <&goodix_pins>,"brcm,pins:0",
++			<&gt9271>,"interrupts:0",
++			<&gt9271>,"irq-gpios:4";
++		reset = <&goodix_pins>,"brcm,pins:4",
++			<&gt9271>,"reset-gpios:4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/googlevoicehat-soundcard-overlay.dts b/arch/arm/boot/dts/overlays/googlevoicehat-soundcard-overlay.dts
+new file mode 100644
+index 000000000000..e443be1f9a0e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/googlevoicehat-soundcard-overlay.dts
+@@ -0,0 +1,49 @@
++// Definitions for Google voiceHAT v1 soundcard overlay
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			googlevoicehat_pins: googlevoicehat_pins {
++				brcm,pins = <16>;
++				brcm,function = <1>; /* out */
++				brcm,pull = <0>; /* up */
++			};
++		};
++	};
++
++
++	fragment@2 {
++		target-path = "/";
++		__overlay__ {
++			voicehat-codec {
++				#sound-dai-cells = <0>;
++				compatible = "google,voicehat";
++				pinctrl-names = "default";
++				pinctrl-0 = <&googlevoicehat_pins>;
++				sdmode-gpios= <&gpio 16 0>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "googlevoicehat,googlevoicehat-soundcard";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/gpio-fan-overlay.dts b/arch/arm/boot/dts/overlays/gpio-fan-overlay.dts
+new file mode 100644
+index 000000000000..17b77bb27931
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-fan-overlay.dts
+@@ -0,0 +1,89 @@
++/*
++ * Overlay for the Raspberry Pi GPIO Fan @ BCM GPIO12.
++ * References: 
++ *	- https://www.raspberrypi.org/forums/viewtopic.php?f=107&p=1367135#p1365084
++ *
++ * Optional parameters:
++ *	- "gpiopin"	- BCM number of the pin driving the fan, default 12 (GPIO12);
++ * 	- "temp"	- CPU temperature at which fan is started in millicelsius, default 55000;
++ *
++ * Requires:
++ *	- kernel configurations: CONFIG_SENSORS_GPIO_FAN=m;
++ *	- kernel rebuild;
++ *	- N-MOSFET connected to gpiopin, 2N7002-[https://en.wikipedia.org/wiki/2N7000];
++ *	- DC Fan connected to N-MOSFET Drain terminal, a 12V fan is working fine and quite silently;
++ *	  [https://www.tme.eu/en/details/ee40101s1-999-a/dc12v-fans/sunon/ee40101s1-1000u-999/]
++ *
++ *                   ┌─────────────────────┐
++ *                   │Fan negative terminal│
++ *                   └┬────────────────────┘
++ *                    │D
++ *             G   │──┘
++ * [GPIO12]──────┤ │<─┐  2N7002
++ *                 │──┤
++ *                    │S
++ *                   ─┴─
++ *                   GND
++ *
++ * Build:
++ * 	- `sudo dtc -W no-unit_address_vs_reg -@ -I dts -O dtb -o /boot/overlays/gpio-fan.dtbo gpio-fan-overlay.dts`
++ * Activate:
++ *	- sudo nano /boot/config.txt add "dtoverlay=gpio-fan" or "dtoverlay=gpio-fan,gpiopin=12,temp=45000"
++ *	 or
++ *	- sudo sh -c 'printf "\n# Enable PI GPIO-Fan Default\ndtoverlay=gpio-fan\n" >> /boot/config.txt'
++ *	- sudo sh -c 'printf "\n# Enable PI GPIO-Fan Custom\ndtoverlay=gpio-fan,gpiopin=12,temp=45000\n" >> /boot/config.txt'
++ *
++ */
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			fan0: gpio-fan@0 {
++				compatible = "gpio-fan";
++				gpios = <&gpio 12 0>;
++				gpio-fan,speed-map = <0    0>,
++									 <5000 1>;
++				#cooling-cells = <2>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&cpu_thermal>;
++		__overlay__ {
++			polling-delay = <2000>;	/* milliseconds */
++		};
++	};
++
++	fragment@2 {
++		target = <&thermal_trips>;
++		__overlay__ {
++			cpu_hot: trip-point@0 {
++				temperature = <55000>;	/* (millicelsius) Fan started at 55°C */
++				hysteresis = <10000>;	/* (millicelsius) Fan stopped at 45°C */
++				type = "active";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&cooling_maps>;
++		__overlay__ {
++			map0 {
++				trip = <&cpu_hot>;
++				cooling-device = <&fan0 1 1>;
++			};
++		};
++	};
++
++	__overrides__ {
++		gpiopin = <&fan0>,"gpios:4", <&fan0>,"brcm,pins:0";
++		temp = <&cpu_hot>,"temperature:0";
++		hyst = <&cpu_hot>,"hysteresis:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/gpio-hog-overlay.dts b/arch/arm/boot/dts/overlays/gpio-hog-overlay.dts
+new file mode 100644
+index 000000000000..c9e39046fed9
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-hog-overlay.dts
+@@ -0,0 +1,27 @@
++// Configure a "hog" on the specified GPIO
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			hog: hog@1a {
++			     gpio-hog;
++			     gpios = <26 GPIO_ACTIVE_HIGH>;
++			     output-high;
++			};
++		};
++	};
++
++	__overrides__ {
++		gpio =       <&hog>,"reg:0",
++		             <&hog>,"gpios:0";
++		active_low = <&hog>,"output-high!",
++			     <&hog>,"output-low?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/gpio-ir-overlay.dts b/arch/arm/boot/dts/overlays/gpio-ir-overlay.dts
+new file mode 100644
+index 000000000000..162b6ce07dc9
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-ir-overlay.dts
+@@ -0,0 +1,49 @@
++// Definitions for ir-gpio module
++/dts-v1/;
++/plugin/;
++
++/ {
++        compatible = "brcm,bcm2835";
++
++        fragment@0 {
++                target-path = "/";
++                __overlay__ {
++                        gpio_ir: ir-receiver@12 {
++                                compatible = "gpio-ir-receiver";
++                                pinctrl-names = "default";
++                                pinctrl-0 = <&gpio_ir_pins>;
++
++                                // pin number, high or low
++                                gpios = <&gpio 18 1>;
++
++                                // parameter for keymap name
++                                linux,rc-map-name = "rc-rc6-mce";
++
++                                status = "okay";
++                        };
++                };
++        };
++
++        fragment@1 {
++                target = <&gpio>;
++                __overlay__ {
++                        gpio_ir_pins: gpio_ir_pins@12 {
++                                brcm,pins = <18>;                       // pin 18
++                                brcm,function = <0>;                    // in
++                                brcm,pull = <2>;                        // up
++                        };
++                };
++        };
++
++        __overrides__ {
++                // parameters
++                gpio_pin =      <&gpio_ir>,"gpios:4",           // pin number
++                                <&gpio_ir>,"reg:0",
++                                <&gpio_ir_pins>,"brcm,pins:0",
++                                <&gpio_ir_pins>,"reg:0";
++                gpio_pull = <&gpio_ir_pins>,"brcm,pull:0";              // pull-up/down state
++                invert = <&gpio_ir>,"gpios:8";                          // 0 = active high input
++
++                rc-map-name = <&gpio_ir>,"linux,rc-map-name";           // default rc map
++        };
++};
+diff --git a/arch/arm/boot/dts/overlays/gpio-ir-tx-overlay.dts b/arch/arm/boot/dts/overlays/gpio-ir-tx-overlay.dts
+new file mode 100644
+index 000000000000..3625431b7560
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-ir-tx-overlay.dts
+@@ -0,0 +1,36 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			gpio_ir_tx_pins: gpio_ir_tx_pins@12 {
++				brcm,pins = <18>;
++				brcm,function = <1>;	// out
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			gpio_ir_tx: gpio-ir-transmitter@12 {
++				compatible = "gpio-ir-tx";
++				pinctrl-names = "default";
++				pinctrl-0 = <&gpio_ir_tx_pins>;
++				gpios = <&gpio 18 0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		gpio_pin = <&gpio_ir_tx>, "gpios:4",           	// pin number
++			   <&gpio_ir_tx>, "reg:0",
++			   <&gpio_ir_tx_pins>, "brcm,pins:0",
++			   <&gpio_ir_tx_pins>, "reg:0";
++		invert = <&gpio_ir_tx>, "gpios:8";		// 1 = active low
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/gpio-key-overlay.dts b/arch/arm/boot/dts/overlays/gpio-key-overlay.dts
+new file mode 100644
+index 000000000000..2e7253d1d0ab
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-key-overlay.dts
+@@ -0,0 +1,48 @@
++// Definitions for gpio-key module
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		// Configure the gpio pin controller
++		target = <&gpio>;
++		__overlay__ {
++			pin_state: button_pins@0 {
++				brcm,pins = <3>; // gpio number
++				brcm,function = <0>; // 0 = input, 1 = output
++				brcm,pull = <2>; // 0 = none, 1 = pull down, 2 = pull up
++			};
++		};
++	};
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			button: button@0 {
++				compatible = "gpio-keys";
++				pinctrl-names = "default";
++				pinctrl-0 = <&pin_state>;
++				status = "okay";
++
++				key: key {
++					linux,code = <116>;
++					gpios = <&gpio 3 1>;
++					label = "KEY_POWER";
++				};
++			};
++		};
++	};
++
++	__overrides__ {
++		gpio =       <&key>,"gpios:4",
++		             <&button>,"reg:0",
++		             <&pin_state>,"brcm,pins:0",
++		             <&pin_state>,"reg:0";
++		label =      <&key>,"label";
++		keycode =    <&key>,"linux,code:0";
++		gpio_pull =  <&pin_state>,"brcm,pull:0";
++		active_low = <&key>,"gpios:8";
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/gpio-led-overlay.dts b/arch/arm/boot/dts/overlays/gpio-led-overlay.dts
+new file mode 100755
+index 000000000000..d8e9d53f1b61
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-led-overlay.dts
+@@ -0,0 +1,97 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * gpio-led - generic connection of kernel's LED framework to the RPI's GPIO.
++ * Copyright (C) 2021 House Gordon Software Company Ltd. <assafgordon@gmail.com>
++ *
++ * Based on information from:
++ *   https://mjoldfield.com/atelier/2017/03/rpi-devicetree.html
++ *   https://www.raspberrypi.org/documentation/configuration/device-tree.md
++ *   https://www.kernel.org/doc/html/latest/leds/index.html
++ *
++ * compile with:
++ *   dtc -@ -Hepapr -I dts -O dtb -o gpio-led.dtbo gpio-led-overlay.dts
++ *
++ * There will be some warnings (can be ignored):
++ *  Warning (label_is_string): /__overrides__:label: property is not a string
++ *  Warning (unit_address_vs_reg): /fragment@0/__overlay__/led_pins@0:
++ *                                 node has a unit name, but no reg property
++ *  Warning (unit_address_vs_reg): /fragment@1/__overlay__/leds@0:
++ *                                 node has a unit name, but no reg property
++ *  Warning (gpios_property): /__overrides__: Missing property
++ *                 '#gpio-cells' in node /fragment@1/__overlay__/leds@0/led
++ *                  or bad phandle (referred from gpio[0])
++ *
++ * Typical electrical connection is:
++ *    RPI-GPIO.19  ->  LED  -> 300ohm resister  -> RPI-GND
++ *    The GPIO pin number can be changed with the 'gpio=' parameter.
++ *
++ * Test from user-space with:
++ *   # if nothing is shown, the overlay file isn't found in /boot/overlays
++ *   dtoverlay -a | grep gpio-led
++ *
++ *   # Load the overlay
++ *   dtoverlay gpio-led label=moo gpio=19
++ *
++ *   # if nothing is shown, the overlay wasn't loaded successfully
++ *   dtoverlay -l | grep gpio-led
++ *
++ *   echo 1 > /sys/class/leds/moo/brightness
++ *   echo 0 > /sys/class/leds/moo/brightness
++ *   echo cpu > /sys/class/leds/moo/trigger
++ *   echo heartbeat > /sys/class/leds/moo/trigger
++ *
++ *   # unload the overlay
++ *   dtoverlay -r gpio-led
++ *
++ * To load in /boot/config.txt add lines such as:
++ *   dtoverlay=gpio-led,gpio=19,label=heart,trigger=heartbeat
++ *   dtoverlay=gpio-led,gpio=26,label=brain,trigger=cpu
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		// Configure the gpio pin controller
++		target = <&gpio>;
++		__overlay__ {
++			led_pin: led_pins@19 {
++				brcm,pins = <19>; // gpio number
++				brcm,function = <1>; // 0 = input, 1 = output
++				brcm,pull = <0>; // 0 = none, 1 = pull down, 2 = pull up
++			};
++		};
++	};
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			leds: leds@0 {
++				compatible = "gpio-leds";
++				pinctrl-names = "default";
++				pinctrl-0 = <&led_pin>;
++				status = "okay";
++
++				led: led {
++			                label = "myled1";
++					gpios = <&gpio 19 0>;
++			                linux,default-trigger = "none";
++				};
++			};
++		};
++	};
++
++	__overrides__ {
++		gpio =       <&led>,"gpios:4",
++		             <&leds>,"reg:0",
++		             <&led_pin>,"brcm,pins:0",
++		             <&led_pin>,"reg:0";
++		label =      <&led>,"label";
++		active_low = <&led>,"gpios:8";
++		trigger =    <&led>,"linux,default-trigger";
++	};
++
++};
++
+diff --git a/arch/arm/boot/dts/overlays/gpio-no-bank0-irq-overlay.dts b/arch/arm/boot/dts/overlays/gpio-no-bank0-irq-overlay.dts
+new file mode 100755
+index 000000000000..96cbe80820b7
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-no-bank0-irq-overlay.dts
+@@ -0,0 +1,14 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		// Configure the gpio pin controller
++		target = <&gpio>;
++		__overlay__ {
++			    interrupts = <255 255>, <2 18>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/gpio-no-irq-overlay.dts b/arch/arm/boot/dts/overlays/gpio-no-irq-overlay.dts
+new file mode 100644
+index 000000000000..55f9bff3a8f6
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-no-irq-overlay.dts
+@@ -0,0 +1,14 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		// Configure the gpio pin controller
++		target = <&gpio>;
++		__overlay__ {
++			    interrupts;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/gpio-poweroff-overlay.dts b/arch/arm/boot/dts/overlays/gpio-poweroff-overlay.dts
+new file mode 100644
+index 000000000000..8153f83f0427
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-poweroff-overlay.dts
+@@ -0,0 +1,39 @@
++// Definitions for gpio-poweroff module
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			power_ctrl: power_ctrl {
++				compatible = "gpio-poweroff";
++				gpios = <&gpio 26 0>;
++				force;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			power_ctrl_pins: power_ctrl_pins {
++				brcm,pins = <26>;
++				brcm,function = <1>; // out
++			};
++		};
++	};
++
++	__overrides__ {
++		gpiopin =       <&power_ctrl>,"gpios:4",
++				<&power_ctrl_pins>,"brcm,pins:0";
++		active_low =    <&power_ctrl>,"gpios:8";
++		input =         <&power_ctrl>,"input?";
++		export =        <&power_ctrl>,"export?";
++		timeout_ms =    <&power_ctrl>,"timeout-ms:0";
++		active_delay_ms = <&power_ctrl>,"active-delay-ms:0";
++		inactive_delay_ms = <&power_ctrl>,"inactive-delay-ms:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/gpio-shutdown-overlay.dts b/arch/arm/boot/dts/overlays/gpio-shutdown-overlay.dts
+new file mode 100644
+index 000000000000..da148064aedd
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-shutdown-overlay.dts
+@@ -0,0 +1,86 @@
++// Definitions for gpio-poweroff module
++/dts-v1/;
++/plugin/;
++
++// This overlay sets up an input device that generates KEY_POWER events
++// when a given GPIO pin changes. It defaults to using GPIO3, which can
++// also be used to wake up (start) the Rpi again after shutdown.
++// Raspberry Pi 1 Model B rev 1 can be wake up only by GPIO1 pin, so for
++// these boards change default GPIO pin to 1 via gpio_pin parameter. Since
++// wakeup is active-low, this defaults to active-low with a pullup
++// enabled, but all of this can be changed using overlay parameters (but
++// note that GPIO3 has an external pullup on at least some boards).
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		// Configure the gpio pin controller
++		target = <&gpio>;
++		__overlay__ {
++			// Define a pinctrl state, that sets up the gpio
++			// as an input with a pullup enabled. This does
++			// not take effect by itself, only when referenced
++			// by a "pinctrl client", as is done below. See:
++			//   https://www.kernel.org/doc/Documentation/devicetree/bindings/pinctrl/pinctrl-bindings.txt
++			//   https://www.kernel.org/doc/Documentation/devicetree/bindings/pinctrl/brcm,bcm2835-gpio.txt
++			pin_state: shutdown_button_pins@3 {
++				brcm,pins = <3>; // gpio number
++				brcm,function = <0>; // 0 = input, 1 = output
++				brcm,pull = <2>; // 0 = none, 1 = pull down, 2 = pull up
++			};
++		};
++	};
++	fragment@1 {
++		// Add a new device to the /soc devicetree node
++		target-path = "/soc";
++		__overlay__ {
++			shutdown_button: shutdown_button@3 {
++				// Let the gpio-keys driver handle this device. See:
++				// https://www.kernel.org/doc/Documentation/devicetree/bindings/input/gpio-keys.txt
++				compatible = "gpio-keys";
++
++				// Declare a single pinctrl state (referencing the one declared above) and name it
++				// default, so it is activated automatically.
++				pinctrl-names = "default";
++				pinctrl-0 = <&pin_state>;
++
++				// Enable this device
++				status = "okay";
++
++				// Define a single key, called "shutdown" that monitors the gpio and sends KEY_POWER
++				// (keycode 116, see
++				// https://github.com/torvalds/linux/blob/v4.12/include/uapi/linux/input-event-codes.h#L190)
++				button: shutdown {
++					label = "shutdown";
++					linux,code = <116>; // KEY_POWER
++					gpios = <&gpio 3 1>;
++					debounce-interval = <100>; // ms
++				};
++			};
++		};
++	};
++
++	// This defines parameters that can be specified when loading
++	// the overlay. Each foo = line specifies one parameter, named
++	// foo. The rest of the specification gives properties where the
++	// parameter value is inserted into (changing the values above
++	// or adding new ones).
++	__overrides__ {
++		// Allow overriding the GPIO number.
++		gpio_pin = <&button>,"gpios:4",
++			   <&shutdown_button>,"reg:0",
++			   <&pin_state>,"reg:0",
++		           <&pin_state>,"brcm,pins:0";
++
++		// Allow changing the internal pullup/down state. 0 = none, 1 = pulldown, 2 = pullup
++		// Note that GPIO3 and GPIO2 are the I2c pins and have an external pullup (at least
++		// on some boards). Same applies for GPIO1 on Raspberry Pi 1 Model B rev 1.
++		gpio_pull = <&pin_state>,"brcm,pull:0";
++
++		// Allow setting the active_low flag. 0 = active high, 1 = active low
++		active_low = <&button>,"gpios:8";
++		debounce = <&button>,"debounce-interval:0";
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/hd44780-lcd-overlay.dts b/arch/arm/boot/dts/overlays/hd44780-lcd-overlay.dts
+new file mode 100644
+index 000000000000..ee726669ff51
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hd44780-lcd-overlay.dts
+@@ -0,0 +1,46 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++
++    fragment@0 {
++        target-path = "/";
++        __overlay__ {
++            lcd_screen: auxdisplay {
++                compatible = "hit,hd44780";
++
++                data-gpios = <&gpio 6 0>,
++                             <&gpio 13 0>,
++                             <&gpio 19 0>,
++                             <&gpio 26 0>;
++                enable-gpios = <&gpio 21 0>;
++                rs-gpios = <&gpio 20 0>;
++
++                display-height-chars = <2>;
++                display-width-chars = <16>;
++            };
++
++        };
++    };
++
++    fragment@1 {
++       target = <&lcd_screen>;
++        __dormant__ {
++            backlight-gpios = <&gpio 12 0>;
++        };
++    };
++
++    __overrides__ {
++        pin_d4 = <&lcd_screen>,"data-gpios:4";
++        pin_d5 = <&lcd_screen>,"data-gpios:16";
++        pin_d6 = <&lcd_screen>,"data-gpios:28";
++        pin_d7 = <&lcd_screen>,"data-gpios:40";
++        pin_en = <&lcd_screen>,"enable-gpios:4";
++        pin_rs = <&lcd_screen>,"rs-gpios:4";
++        pin_bl = <0>,"+1", <&lcd_screen>,"backlight-gpios:4";
++        display_height = <&lcd_screen>,"display-height-chars:0";
++        display_width = <&lcd_screen>,"display-width-chars:0";
++    };
++
++};
+diff --git a/arch/arm/boot/dts/overlays/hdmi-backlight-hwhack-gpio-overlay.dts b/arch/arm/boot/dts/overlays/hdmi-backlight-hwhack-gpio-overlay.dts
+new file mode 100644
+index 000000000000..50b9a2665c80
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hdmi-backlight-hwhack-gpio-overlay.dts
+@@ -0,0 +1,47 @@
++/*
++ * Devicetree overlay for GPIO based backlight on/off capability.
++ *
++ * Use this if you have one of those HDMI displays whose backlight cannot be
++ * controlled via DPMS over HDMI and plan to do a little soldering to use an
++ * RPi gpio pin for on/off switching.
++ *
++ * See: https://www.waveshare.com/wiki/7inch_HDMI_LCD_(C)#Backlight_Control
++ *
++ */
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			hdmi_backlight_hwhack_gpio_pins: hdmi_backlight_hwhack_gpio_pins {
++				brcm,pins = <17>;
++				brcm,function = <1>; /* out */
++			};
++		};
++	};
++
++	fragment@2 {
++		target-path = "/";
++		__overlay__ {
++			hdmi_backlight_hwhack_gpio: hdmi_backlight_hwhack_gpio {
++				compatible = "gpio-backlight";
++
++				pinctrl-names = "default";
++				pinctrl-0 = <&hdmi_backlight_hwhack_gpio_pins>;
++
++				gpios = <&gpio 17 0>;
++				default-on;
++			};
++		};
++	};
++
++	__overrides__ {
++		gpio_pin   = <&hdmi_backlight_hwhack_gpio>,"gpios:4",
++		             <&hdmi_backlight_hwhack_gpio_pins>,"brcm,pins:0";
++		active_low = <&hdmi_backlight_hwhack_gpio>,"gpios:8";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-amp-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-amp-overlay.dts
+new file mode 100644
+index 000000000000..142518ab348b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-amp-overlay.dts
+@@ -0,0 +1,39 @@
++// Definitions for HiFiBerry Amp/Amp+
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			tas5713@1b {
++				#sound-dai-cells = <0>;
++				compatible = "ti,tas5713";
++				reg = <0x1b>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "hifiberry,hifiberry-amp";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-amp100-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-amp100-overlay.dts
+new file mode 100644
+index 000000000000..ebdef55d6110
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-amp100-overlay.dts
+@@ -0,0 +1,64 @@
++// Definitions for HiFiBerry AMP100
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			dacpro_osc: dacpro_osc {
++				compatible = "hifiberry,dacpro-clk";
++				#clock-cells = <0>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4d {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4d>;
++				clocks = <&dacpro_osc>;
++				AVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		hifiberry_dacplus: __overlay__ {
++			compatible = "hifiberry,hifiberry-dacplus";
++			i2s-controller = <&i2s>;
++			status = "okay";
++			mute-gpio = <&gpio 4 0>;
++			reset-gpio = <&gpio 17 0x11>;
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain =
++			<&hifiberry_dacplus>,"hifiberry,24db_digital_gain?";
++		slave = <&hifiberry_dacplus>,"hifiberry-dacplus,slave?";
++		leds_off = <&hifiberry_dacplus>,"hifiberry-dacplus,leds_off?";
++		mute_ext_ctl = <&hifiberry_dacplus>,"hifiberry-dacplus,mute_ext_ctl:0";
++		auto_mute = <&hifiberry_dacplus>,"hifiberry-dacplus,auto_mute?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-amp3-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-amp3-overlay.dts
+new file mode 100644
+index 000000000000..a01e263a133b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-amp3-overlay.dts
+@@ -0,0 +1,57 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for HiFiBerry's Amp3
++/dts-v1/;
++/plugin/;
++#include <dt-bindings/pinctrl/bcm2835.h>
++#include <dt-bindings/gpio/gpio.h>
++
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			hifiberry_amp3_pins: hifiberry_amp3_pins {
++				brcm,pins = <23 17>;
++				brcm,function = <0 1>;
++				brcm,pull = <2 1>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			hifiberry_amp2: ma120x0p@20 {
++				#sound-dai-cells = <0>;
++				compatible = "ma,ma120x0p";
++				reg = <0x20>;
++				status = "okay";
++				pinctrl-names = "default";
++				pinctrl-0 = <&hifiberry_amp3_pins>;
++				error_gp-gpios = <&gpio 23 GPIO_ACTIVE_HIGH>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "hifiberry,hifiberry-amp3";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-dac-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dac-overlay.dts
+new file mode 100644
+index 000000000000..ea8a6c8f36c0
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-dac-overlay.dts
+@@ -0,0 +1,34 @@
++// Definitions for HiFiBerry DAC
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			pcm5102a-codec {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5102a";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "hifiberry,hifiberry-dac";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-dacplus-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dacplus-overlay.dts
+new file mode 100644
+index 000000000000..ff19015ba656
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-dacplus-overlay.dts
+@@ -0,0 +1,65 @@
++// Definitions for HiFiBerry DAC+
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			dacpro_osc: dacpro_osc {
++				compatible = "hifiberry,dacpro-clk";
++				#clock-cells = <0>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4d {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4d>;
++				clocks = <&dacpro_osc>;
++				AVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++			hpamp: hpamp@60 {
++				compatible = "ti,tpa6130a2";
++				reg = <0x60>;
++				status = "disabled";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		hifiberry_dacplus: __overlay__ {
++			compatible = "hifiberry,hifiberry-dacplus";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain =
++			<&hifiberry_dacplus>,"hifiberry,24db_digital_gain?";
++		slave = <&hifiberry_dacplus>,"hifiberry-dacplus,slave?";
++		leds_off = <&hifiberry_dacplus>,"hifiberry-dacplus,leds_off?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-dacplusadc-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dacplusadc-overlay.dts
+new file mode 100644
+index 000000000000..540563dec10f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-dacplusadc-overlay.dts
+@@ -0,0 +1,72 @@
++// Definitions for HiFiBerry DAC+ADC
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			dacpro_osc: dacpro_osc {
++				compatible = "hifiberry,dacpro-clk";
++				#clock-cells = <0>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm_codec: pcm5122@4d {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4d>;
++				clocks = <&dacpro_osc>;
++				AVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target-path = "/";
++		__overlay__ {
++			dmic {
++				#sound-dai-cells = <0>;
++				compatible = "dmic-codec";
++				num-channels = <2>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&sound>;
++		hifiberry_dacplusadc: __overlay__ {
++			compatible = "hifiberry,hifiberry-dacplusadc";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain =
++			<&hifiberry_dacplusadc>,"hifiberry,24db_digital_gain?";
++		slave = <&hifiberry_dacplusadc>,"hifiberry-dacplusadc,slave?";
++		leds_off = <&hifiberry_dacplusadc>,"hifiberry-dacplusadc,leds_off?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-dacplusadcpro-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dacplusadcpro-overlay.dts
+new file mode 100644
+index 000000000000..561cd84bbb79
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-dacplusadcpro-overlay.dts
+@@ -0,0 +1,70 @@
++// Definitions for HiFiBerry DAC+ADC PRO
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			dacpro_osc: dacpro_osc {
++				compatible = "hifiberry,dacpro-clk";
++				#clock-cells = <0>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			hb_dac: pcm5122@4d {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4d>;
++				clocks = <&dacpro_osc>;
++				status = "okay";
++			};
++			hb_adc: pcm186x@4a {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm1863";
++				reg = <0x4a>;
++				clocks = <&dacpro_osc>;
++				status = "okay";
++			};
++			hpamp: hpamp@60 {
++				compatible = "ti,tpa6130a2";
++				reg = <0x60>;
++				status = "disabled";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		hifiberry_dacplusadcpro: __overlay__ {
++			compatible = "hifiberry,hifiberry-dacplusadcpro";
++			audio-codec = <&hb_dac &hb_adc>;
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain =
++			<&hifiberry_dacplusadcpro>,"hifiberry-dacplusadcpro,24db_digital_gain?";
++		slave = <&hifiberry_dacplusadcpro>,"hifiberry-dacplusadcpro,slave?";
++		leds_off = <&hifiberry_dacplusadcpro>,"hifiberry-dacplusadcpro,leds_off?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-dacplusdsp-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dacplusdsp-overlay.dts
+new file mode 100644
+index 000000000000..63432e8b983f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-dacplusdsp-overlay.dts
+@@ -0,0 +1,34 @@
++// Definitions for hifiberry DAC+DSP soundcard overlay
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			dacplusdsp-codec {
++				#sound-dai-cells = <0>;
++				compatible = "hifiberry,dacplusdsp";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "hifiberrydacplusdsp,hifiberrydacplusdsp-soundcard";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-dacplushd-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dacplushd-overlay.dts
+new file mode 100644
+index 000000000000..b9165138c7ad
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-dacplushd-overlay.dts
+@@ -0,0 +1,94 @@
++// Definitions for HiFiBerry DAC+ HD
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm1792a@4c {
++				compatible = "ti,pcm1792a";
++				#sound-dai-cells = <0>;
++				#clock-cells = <0>;
++				reg = <0x4c>;
++				status = "okay";
++			};
++			pll: pll@62 {
++				compatible = "hifiberry,dachd-clk";
++				#clock-cells = <0>;
++				reg = <0x62>;
++				status = "okay";
++				common_pll_regs = [
++					02 53 03 00 07 20 0F 00
++					10 0D 11 1D 12 0D 13 8C
++					14 8C 15 8C 16 8C 17 8C
++					18 2A 1C 00 1D 0F 1F 00
++					2A 00 2C 00 2F 00 30 00
++					31 00 32 00 34 00 37 00
++					38 00 39 00 3A 00 3B 01
++					3E 00 3F 00 40 00 41 00
++					5A 00 5B 00 95 00 96 00
++					97 00 98 00 99 00 9A 00
++					9B 00 A2 00 A3 00 A4 00
++					B7 92 ];
++				192k_pll_regs = [
++					1A 0C 1B 35 1E F0 20 09
++					21 50 2B 02 2D 10 2E 40
++					33 01 35 22 36 80 3C 22
++					3D 46 ];
++				96k_pll_regs = [
++					1A 0C 1B 35 1E F0 20 09
++					21 50 2B 02 2D 10 2E 40
++					33 01 35 47 36 00 3C 32
++					3D 46 ];
++				48k_pll_regs = [
++					1A 0C 1B 35 1E F0 20 09
++					21 50 2B 02 2D 10 2E 40
++					33 01 35 90 36 00 3C 42
++					3D 46 ];
++				176k4_pll_regs = [
++					1A 3D 1B 09 1E F3 20 13
++					21 75 2B 04 2D 11 2E E0
++					33 02 35 25 36 C0 3C 22
++					3D 7A ];
++				88k2_pll_regs = [
++					1A 3D 1B 09 1E F3 20 13
++					21 75 2B 04 2D 11 2E E0
++					33 01 35 4D 36 80 3C 32
++					3D 7A ];
++				44k1_pll_regs = [
++					1A 3D 1B 09 1E F3 20 13
++					21 75 2B 04 2D 11 2E E0
++					33 01 35 9D 36 00 3C 42
++					3D 7A ];
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "hifiberry,hifiberry-dacplushd";
++			i2s-controller = <&i2s>;
++			clocks = <&pll 0>;
++			reset-gpio = <&gpio 16 GPIO_ACTIVE_LOW>;
++			status = "okay";
++		};
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-digi-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-digi-overlay.dts
+new file mode 100644
+index 000000000000..a2309a50e8d8
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-digi-overlay.dts
+@@ -0,0 +1,41 @@
++// Definitions for HiFiBerry Digi
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			wm8804@3b {
++				#sound-dai-cells = <0>;
++				compatible = "wlf,wm8804";
++				reg = <0x3b>;
++				PVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "hifiberry,hifiberry-digi";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-digi-pro-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-digi-pro-overlay.dts
+new file mode 100644
+index 000000000000..83de602e76ba
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-digi-pro-overlay.dts
+@@ -0,0 +1,43 @@
++// Definitions for HiFiBerry Digi Pro
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			wm8804@3b {
++				#sound-dai-cells = <0>;
++				compatible = "wlf,wm8804";
++				reg = <0x3b>;
++				PVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "hifiberry,hifiberry-digi";
++			i2s-controller = <&i2s>;
++			status = "okay";
++			clock44-gpio = <&gpio 5 0>;
++			clock48-gpio = <&gpio 6 0>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/highperi-overlay.dts b/arch/arm/boot/dts/overlays/highperi-overlay.dts
+new file mode 100644
+index 000000000000..46cb76c2d34f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/highperi-overlay.dts
+@@ -0,0 +1,63 @@
++/*
++ * highperi.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&soc>;
++		#address-cells = <2>;
++		#size-cells = <1>;
++
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <1>;
++			ranges = <0x7c000000  0x4 0x7c000000  0x04000000>,
++				 <0x40000000  0x4 0xc0000000  0x00800000>;
++		};
++	};
++
++	fragment@1 {
++		target = <&scb>;
++		#address-cells = <2>;
++		#size-cells = <1>;
++
++		__overlay__ {
++			#address-cells = <2>;
++			#size-cells = <2>;
++			ranges = <0x0 0x7c000000  0x4 0x7c000000  0x0 0x04000000>,
++				 <0x0 0x40000000  0x4 0xc0000000  0x0 0x00800000>,
++				 <0x6 0x00000000  0x6 0x00000000  0x0 0x40000000>;
++			dma-ranges = <0x0 0x00000000  0x0 0x00000000  0x2 0x00000000>;
++		};
++	};
++
++	fragment@2 {
++		target = <&v3dbus>;
++		#address-cells = <2>;
++		#size-cells = <1>;
++
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <2>;
++			ranges = <0x7c500000  0x4 0x7c500000  0x0 0x03300000>,
++				 <0x40000000  0x4 0xc0000000  0x0 0x00800000>;
++		};
++	};
++
++	fragment@3 {
++		target = <&emmc2bus>;
++		#address-cells = <2>;
++		#size-cells = <1>;
++
++		__overlay__ {
++			#address-cells = <2>;
++			#size-cells = <1>;
++			ranges = <0x0 0x7e000000  0x4 0x7e000000  0x01800000>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hy28a-overlay.dts b/arch/arm/boot/dts/overlays/hy28a-overlay.dts
+new file mode 100644
+index 000000000000..5843a5e9c86a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hy28a-overlay.dts
+@@ -0,0 +1,93 @@
++/*
++ * Device Tree overlay for HY28A display
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			hy28a_pins: hy28a_pins {
++				brcm,pins = <17 25 18>;
++				brcm,function = <0 1 1>; /* in out out */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			hy28a: hy28a@0{
++				compatible = "ilitek,ili9320";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&hy28a_pins>;
++
++				spi-max-frequency = <32000000>;
++				spi-cpol;
++				spi-cpha;
++				rotate = <270>;
++				bgr;
++				fps = <50>;
++				buswidth = <8>;
++				startbyte = <0x70>;
++				reset-gpios = <&gpio 25 1>;
++				led-gpios = <&gpio 18 1>;
++				debug = <0>;
++			};
++
++			hy28a_ts: hy28a-ts@1 {
++				compatible = "ti,ads7846";
++				reg = <1>;
++
++				spi-max-frequency = <2000000>;
++				interrupts = <17 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				pendown-gpio = <&gpio 17 0>;
++				ti,x-plate-ohms = /bits/ 16 <100>;
++				ti,pressure-max = /bits/ 16 <255>;
++			};
++		};
++	};
++	__overrides__ {
++		speed =		<&hy28a>,"spi-max-frequency:0";
++		rotate =	<&hy28a>,"rotate:0";
++		fps =		<&hy28a>,"fps:0";
++		debug =		<&hy28a>,"debug:0";
++		xohms =		<&hy28a_ts>,"ti,x-plate-ohms;0";
++		resetgpio =	<&hy28a>,"reset-gpios:4",
++				<&hy28a_pins>, "brcm,pins:4";
++		ledgpio =	<&hy28a>,"led-gpios:4",
++				<&hy28a_pins>, "brcm,pins:8";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hy28b-2017-overlay.dts b/arch/arm/boot/dts/overlays/hy28b-2017-overlay.dts
+new file mode 100644
+index 000000000000..95bfb1eadc20
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hy28b-2017-overlay.dts
+@@ -0,0 +1,152 @@
++/*
++ * Device Tree overlay for HY28b display shield by Texy.
++ * Modified for 2017 version with ILI9325 D chip
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			hy28b_pins: hy28b_pins {
++				brcm,pins = <17 25 18>;
++				brcm,function = <0 1 1>; /* in out out */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			hy28b: hy28b@0{
++				compatible = "ilitek,ili9325";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&hy28b_pins>;
++
++				spi-max-frequency = <48000000>;
++				spi-cpol;
++				spi-cpha;
++				rotate = <270>;
++				bgr;
++				fps = <50>;
++				buswidth = <8>;
++				startbyte = <0x70>;
++				reset-gpios = <&gpio 25 1>;
++				led-gpios = <&gpio 18 1>;
++
++				init = <0x10000e5 0x78F0
++					0x1000001 0x0100
++					0x1000002 0x0700
++				        0x1000003 0x1030
++					0x1000004 0x0000
++					0x1000008 0x0207
++					0x1000009 0x0000
++				        0x100000a 0x0000
++					0x100000c 0x0000
++					0x100000d 0x0000
++					0x100000f 0x0000
++				        0x1000010 0x0000
++					0x1000011 0x0007
++					0x1000012 0x0000
++					0x1000013 0x0000
++					0x1000007 0x0001
++				        0x2000032
++				        0x2000032
++				        0x2000032
++				        0x2000032
++					0x1000010 0x1090
++					0x1000011 0x0227
++				        0x2000032
++					0x1000012 0x001f
++				        0x2000032
++				        0x1000013 0x1500
++					0x1000029 0x0027
++					0x100002b 0x000d
++				        0x2000032
++				        0x1000020 0x0000
++					0x1000021 0x0000
++				        0x2000032
++					0x1000030 0x0000
++					0x1000031 0x0707
++					0x1000032 0x0307
++					0x1000035 0x0200
++					0x1000036 0x0008
++					0x1000037 0x0004
++					0x1000038 0x0000
++					0x1000039 0x0707
++					0x100003c 0x0002
++					0x100003d 0x1d04
++					0x1000050 0x0000
++				        0x1000051 0x00ef
++					0x1000052 0x0000
++					0x1000053 0x013f
++					0x1000060 0xa700
++				        0x1000061 0x0001
++					0x100006a 0x0000
++					0x1000080 0x0000
++					0x1000081 0x0000
++				        0x1000082 0x0000
++					0x1000083 0x0000
++					0x1000084 0x0000
++					0x1000085 0x0000
++				        0x1000090 0x0010
++					0x1000092 0x0600
++					0x1000007 0x0133>;
++				debug = <0>;
++			};
++
++			hy28b_ts: hy28b-ts@1 {
++				compatible = "ti,ads7846";
++				reg = <1>;
++
++				spi-max-frequency = <2000000>;
++				interrupts = <17 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				pendown-gpio = <&gpio 17 0>;
++				ti,x-plate-ohms = /bits/ 16 <100>;
++				ti,pressure-max = /bits/ 16 <255>;
++			};
++		};
++	};
++	__overrides__ {
++		speed = 	<&hy28b>,"spi-max-frequency:0";
++		rotate = 	<&hy28b>,"rotate:0";
++		fps = 		<&hy28b>,"fps:0";
++		debug = 	<&hy28b>,"debug:0";
++		xohms =		<&hy28b_ts>,"ti,x-plate-ohms;0";
++		resetgpio =	<&hy28b>,"reset-gpios:4",
++				<&hy28b_pins>, "brcm,pins:4";
++		ledgpio =	<&hy28b>,"led-gpios:4",
++				<&hy28b_pins>, "brcm,pins:8";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hy28b-overlay.dts b/arch/arm/boot/dts/overlays/hy28b-overlay.dts
+new file mode 100644
+index 000000000000..9edd0848d555
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hy28b-overlay.dts
+@@ -0,0 +1,148 @@
++/*
++ * Device Tree overlay for HY28b display shield by Texy
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			hy28b_pins: hy28b_pins {
++				brcm,pins = <17 25 18>;
++				brcm,function = <0 1 1>; /* in out out */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			hy28b: hy28b@0{
++				compatible = "ilitek,ili9325";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&hy28b_pins>;
++
++				spi-max-frequency = <48000000>;
++				spi-cpol;
++				spi-cpha;
++				rotate = <270>;
++				bgr;
++				fps = <50>;
++				buswidth = <8>;
++				startbyte = <0x70>;
++				reset-gpios = <&gpio 25 1>;
++				led-gpios = <&gpio 18 1>;
++
++				gamma = "04 1F 4 7 7 0 7 7 6 0\n0F 00 1 7 4 0 0 0 6 7";
++
++				init = <0x10000e7 0x0010
++					0x1000000 0x0001
++					0x1000001 0x0100
++					0x1000002 0x0700
++				        0x1000003 0x1030
++					0x1000004 0x0000
++					0x1000008 0x0207
++					0x1000009 0x0000
++				        0x100000a 0x0000
++					0x100000c 0x0001
++					0x100000d 0x0000
++					0x100000f 0x0000
++				        0x1000010 0x0000
++					0x1000011 0x0007
++					0x1000012 0x0000
++					0x1000013 0x0000
++				        0x2000032
++					0x1000010 0x1590
++					0x1000011 0x0227
++				        0x2000032
++					0x1000012 0x009c
++				        0x2000032
++				        0x1000013 0x1900
++					0x1000029 0x0023
++					0x100002b 0x000e
++				        0x2000032
++				        0x1000020 0x0000
++					0x1000021 0x0000
++				        0x2000032
++					0x1000050 0x0000
++				        0x1000051 0x00ef
++					0x1000052 0x0000
++					0x1000053 0x013f
++					0x1000060 0xa700
++				        0x1000061 0x0001
++					0x100006a 0x0000
++					0x1000080 0x0000
++					0x1000081 0x0000
++				        0x1000082 0x0000
++					0x1000083 0x0000
++					0x1000084 0x0000
++					0x1000085 0x0000
++				        0x1000090 0x0010
++					0x1000092 0x0000
++					0x1000093 0x0003
++					0x1000095 0x0110
++				        0x1000097 0x0000
++					0x1000098 0x0000
++					0x1000007 0x0133
++					0x1000020 0x0000
++				        0x1000021 0x0000
++				        0x2000064>;
++				debug = <0>;
++			};
++
++			hy28b_ts: hy28b-ts@1 {
++				compatible = "ti,ads7846";
++				reg = <1>;
++
++				spi-max-frequency = <2000000>;
++				interrupts = <17 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				pendown-gpio = <&gpio 17 0>;
++				ti,x-plate-ohms = /bits/ 16 <100>;
++				ti,pressure-max = /bits/ 16 <255>;
++			};
++		};
++	};
++	__overrides__ {
++		speed = 	<&hy28b>,"spi-max-frequency:0";
++		rotate = 	<&hy28b>,"rotate:0";
++		fps = 		<&hy28b>,"fps:0";
++		debug = 	<&hy28b>,"debug:0";
++		xohms =		<&hy28b_ts>,"ti,x-plate-ohms;0";
++		resetgpio =	<&hy28b>,"reset-gpios:4",
++				<&hy28b_pins>, "brcm,pins:4";
++		ledgpio =	<&hy28b>,"led-gpios:4",
++				<&hy28b_pins>, "brcm,pins:8";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i-sabre-q2m-overlay.dts b/arch/arm/boot/dts/overlays/i-sabre-q2m-overlay.dts
+new file mode 100644
+index 000000000000..0c4cff354674
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i-sabre-q2m-overlay.dts
+@@ -0,0 +1,39 @@
++// Definitions for I-Sabre Q2M
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&sound>;
++		frag0: __overlay__ {
++			compatible = "audiophonics,i-sabre-q2m";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			i-sabre-codec@48 {
++				#sound-dai-cells = <0>;
++				compatible = "audiophonics,i-sabre-codec";
++				reg = <0x48>;
++				status = "okay";
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c-bcm2708-overlay.dts b/arch/arm/boot/dts/overlays/i2c-bcm2708-overlay.dts
+new file mode 100644
+index 000000000000..8204b6b3aef8
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c-bcm2708-overlay.dts
+@@ -0,0 +1,13 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			compatible = "brcm,bcm2708-i2c";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c-fan-overlay.dts b/arch/arm/boot/dts/overlays/i2c-fan-overlay.dts
+new file mode 100644
+index 000000000000..ee25780a2810
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c-fan-overlay.dts
+@@ -0,0 +1,108 @@
++// Definitions for I2C based sensors using the Industrial IO or HWMON interface.
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/thermal/thermal.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			emc2301: emc2301@2f {
++				compatible = "microchip,emc2301";
++				reg = <0x2f>;
++				status = "okay";
++				#cooling-cells = <0x02>;
++			};
++		};
++	};
++
++	frag100: fragment@100 {
++		target = <&i2c_arm>;
++		i2cbus: __overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@101 {
++		target = <&i2c0if>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@102 {
++		target = <&i2c0mux>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@103 {
++		target = <&cpu_thermal>;
++		__overlay__ {
++			polling-delay = <2000>; /* milliseconds */
++		};
++	};
++
++	fragment@104 {
++		target = <&thermal_trips>;
++		__overlay__ {
++			fanmid0: fanmid0 {
++				temperature = <50000>;
++				hysteresis = <2000>;
++				type = "active";
++			};
++			fanmax0: fanmax0 {
++				temperature = <75000>;
++				hysteresis = <2000>;
++				type = "active";
++			};
++		};
++	};
++
++	fragment@105 {
++		target = <&cooling_maps>;
++		__overlay__ {
++			map0: map0 {
++				trip = <&fanmid0>;
++				cooling-device = <&emc2301 2 6>;
++			};
++			map1: map1 {
++				trip = <&fanmax0>;
++				cooling-device = <&emc2301 7 THERMAL_NO_LIMIT>;
++			};
++		};
++	};
++
++	__overrides__ {
++		i2c0 =		<&frag100>,"target:0=",<&i2c0>;
++		i2c_csi_dsi =	<&frag100>,"target:0=",<&i2c_csi_dsi>,
++				<0>,"+101+102";
++		i2c3 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c3";
++		i2c4 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c4";
++		i2c5 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c5";
++		i2c6 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c6";
++		addr =		<&emc2301>,"reg:0";
++		minpwm =	<&emc2301>,"emc2305,pwm-min;0";
++		maxpwm =	<&emc2301>,"emc2305,pwm-max;0";
++		midtemp =	<&fanmid0>,"temperature:0";
++		midtemp_hyst =	<&fanmid0>,"hysteresis:0";
++		maxtemp =	<&fanmax0>,"temperature:0";
++		maxtemp_hyst =	<&fanmax0>,"hysteresis:0";
++
++		emc2301 =	<0>,"+0",
++				<&map0>,"cooling-device:0=",<&emc2301>,
++				<&map1>,"cooling-device:0=",<&emc2301>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts b/arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts
+new file mode 100644
+index 000000000000..63231b5d7c0c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts
+@@ -0,0 +1,47 @@
++// Overlay for i2c_gpio bitbanging host bus.
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++
++		__overlay__ {
++			i2c_gpio: i2c@0 {
++				reg = <0xffffffff>;
++				compatible = "i2c-gpio";
++				gpios = <&gpio 23 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN) /* sda */
++					 &gpio 24 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN) /* scl */
++					>;
++				i2c-gpio,delay-us = <2>;        /* ~100 kHz */
++				#address-cells = <1>;
++				#size-cells = <0>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/aliases";
++		__overlay__ {
++			i2c_gpio = "/i2c@0";
++		};
++	};
++
++	fragment@2 {
++		target-path = "/__symbols__";
++		__overlay__ {
++			i2c_gpio = "/i2c@0";
++		};
++	};
++
++	__overrides__ {
++		i2c_gpio_sda = <&i2c_gpio>,"gpios:4";
++		i2c_gpio_scl = <&i2c_gpio>,"gpios:16";
++		i2c_gpio_delay_us = <&i2c_gpio>,"i2c-gpio,delay-us:0";
++		bus = <&i2c_gpio>, "reg:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts b/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
+new file mode 100644
+index 000000000000..112aed91ecb2
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
+@@ -0,0 +1,139 @@
++// Umbrella I2C Mux overlay
++
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pca9542: mux@70 {
++				compatible = "nxp,pca9542";
++				reg = <0x70>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				i2c@0 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <0>;
++				};
++				i2c@1 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <1>;
++				};
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c_arm>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pca9545: mux@70 {
++				compatible = "nxp,pca9545";
++				reg = <0x70>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				i2c@0 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <0>;
++				};
++				i2c@1 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <1>;
++				};
++				i2c@2 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <2>;
++				};
++				i2c@3 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <3>;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c_arm>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pca9548: mux@70 {
++				compatible = "nxp,pca9548";
++				reg = <0x70>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				i2c@0 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <0>;
++				};
++				i2c@1 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <1>;
++				};
++				i2c@2 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <2>;
++				};
++				i2c@3 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <3>;
++				};
++				i2c@4 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <4>;
++				};
++				i2c@5 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <5>;
++				};
++				i2c@6 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <6>;
++				};
++				i2c@7 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <7>;
++				};
++			};
++		};
++	};
++
++	__overrides__ {
++		pca9542 = <0>, "+0";
++		pca9545 = <0>, "+1";
++		pca9548 = <0>, "+2";
++
++		addr =  <&pca9542>,"reg:0",
++			<&pca9545>,"reg:0",
++			<&pca9548>,"reg:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts b/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
+new file mode 100644
+index 000000000000..9bb16465a50e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
+@@ -0,0 +1,26 @@
++// Definitions for NXP PCA9685A I2C PWM controller on ARM I2C bus.
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pca: pca@40 {
++				compatible = "nxp,pca9685-pwm";
++				#pwm-cells = <2>;
++				reg = <0x40>;
++				status = "okay";
++			};
++		};
++	};
++	__overrides__ {
++		addr = <&pca>,"reg:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c-rtc-common.dtsi b/arch/arm/boot/dts/overlays/i2c-rtc-common.dtsi
+new file mode 100644
+index 000000000000..94b0243bc328
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c-rtc-common.dtsi
+@@ -0,0 +1,351 @@
++// Definitions for several I2C based Real Time Clocks
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			abx80x: abx80x@69 {
++				compatible = "abracon,abx80x";
++				reg = <0x69>;
++				abracon,tc-diode = "standard";
++				abracon,tc-resistor = <0>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			ds1307: ds1307@68 {
++				compatible = "dallas,ds1307";
++				reg = <0x68>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			ds1339: ds1339@68 {
++				compatible = "dallas,ds1339";
++				trickle-resistor-ohms = <0>;
++				reg = <0x68>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			ds3231: ds3231@68 {
++				compatible = "maxim,ds3231";
++				reg = <0x68>;
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp7940x: mcp7940x@6f {
++				compatible = "microchip,mcp7940x";
++				reg = <0x6f>;
++			};
++		};
++	};
++
++	fragment@5 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp7941x: mcp7941x@6f {
++				compatible = "microchip,mcp7941x";
++				reg = <0x6f>;
++			};
++		};
++	};
++
++	fragment@6 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pcf2127@51 {
++				compatible = "nxp,pcf2127";
++				reg = <0x51>;
++			};
++		};
++	};
++
++	fragment@7 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pcf8523: pcf8523@68 {
++				compatible = "nxp,pcf8523";
++				reg = <0x68>;
++			};
++		};
++	};
++
++	fragment@8 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pcf8563: pcf8563@51 {
++				compatible = "nxp,pcf8563";
++				reg = <0x51>;
++			};
++		};
++	};
++
++	fragment@9 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			m41t62: m41t62@68 {
++				compatible = "st,m41t62";
++				reg = <0x68>;
++			};
++		};
++	};
++
++	fragment@10 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			rv3028: rv3028@52 {
++				compatible = "microcrystal,rv3028";
++				reg = <0x52>;
++			};
++		};
++	};
++
++	fragment@11 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pcf2129@51 {
++				compatible = "nxp,pcf2129";
++				reg = <0x51>;
++			};
++		};
++	};
++
++	fragment@12 {
++		target = <&i2cbus>;
++	       __dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pcf85363@51 {
++				compatible = "nxp,pcf85363";
++				reg = <0x51>;
++			};
++		};
++	};
++
++	fragment@13 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			rv1805: rv1805@69 {
++				compatible = "microcrystal,rv1805";
++				reg = <0x69>;
++				abracon,tc-diode = "standard";
++				abracon,tc-resistor = <0>;
++			};
++		};
++	};
++
++	fragment@14 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sd3078: sd3078@32 {
++				compatible = "whwave,sd3078";
++				reg = <0x32>;
++			};
++		};
++	};
++
++	fragment@15 {
++		target = <&i2cbus>;
++	       __dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pcf85063@51 {
++				compatible = "nxp,pcf85063";
++				reg = <0x51>;
++			};
++		};
++	};
++
++	fragment@16 {
++		target = <&i2cbus>;
++	       __dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pcf85063a@51 {
++				compatible = "nxp,pcf85063a";
++				reg = <0x51>;
++			};
++		};
++	};
++
++	fragment@17 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			ds1340: ds1340@68 {
++				compatible = "dallas,ds1340";
++				trickle-resistor-ohms = <0>;
++				reg = <0x68>;
++			};
++		};
++	};
++
++	fragment@18 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			s35390a: s35390a@30 {
++				compatible = "ablic,s35390a";
++				reg = <0x30>;
++			};
++		};
++	};
++
++	fragment@19 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			bq32000: bq32000@68 {
++				compatible = "ti,bq32000";
++				trickle-resistor-ohms = <0>;
++				reg = <0x68>;
++			};
++		};
++	};
++
++	fragment@20 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			rv8803: rv8803@32 {
++				compatible = "microcrystal,rv8803";
++				reg = <0x32>;
++			};
++		};
++	};
++
++	fragment@21 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			rv3032: rv3032@51 {
++				compatible = "microcrystal,rv3032";
++				reg = <0x51>;
++			};
++		};
++	};
++
++
++	__overrides__ {
++		abx80x = <0>,"+0";
++		ds1307 = <0>,"+1";
++		ds1339 = <0>,"+2";
++		ds1340 = <0>,"+17";
++		ds3231 = <0>,"+3";
++		mcp7940x = <0>,"+4";
++		mcp7941x = <0>,"+5";
++		pcf2127 = <0>,"+6";
++		pcf8523 = <0>,"+7";
++		pcf8563 = <0>,"+8";
++		m41t62 = <0>,"+9";
++		rv3028 = <0>,"+10";
++		pcf2129 = <0>,"+11";
++		pcf85363 = <0>,"+12";
++		rv1805 = <0>,"+13";
++		sd3078 = <0>,"+14";
++		pcf85063 = <0>,"+15";
++		pcf85063a = <0>,"+16";
++		s35390a = <0>,"+18";
++		bq32000 = <0>,"+19";
++		rv8803 = <0>,"+20";
++		rv3032 = <0>,"+21";
++
++		addr = <&abx80x>, "reg:0",
++		       <&ds1307>, "reg:0",
++		       <&ds1339>, "reg:0",
++		       <&ds3231>, "reg:0",
++		       <&mcp7940x>, "reg:0",
++		       <&mcp7941x>, "reg:0",
++		       <&pcf8523>, "reg:0",
++		       <&pcf8563>, "reg:0",
++		       <&m41t62>, "reg:0",
++		       <&rv1805>, "reg:0",
++		       <&s35390a>, "reg:0";
++		trickle-diode-disable = <&bq32000>,"trickle-diode-disable?";
++		trickle-diode-type = <&abx80x>,"abracon,tc-diode",
++				     <&rv1805>,"abracon,tc-diode";
++		trickle-resistor-ohms = <&ds1339>,"trickle-resistor-ohms:0",
++					<&ds1340>,"trickle-resistor-ohms:0",
++					<&abx80x>,"abracon,tc-resistor:0",
++					<&rv3028>,"trickle-resistor-ohms:0",
++					<&rv1805>,"abracon,tc-resistor:0",
++					<&bq32000>,"abracon,tc-resistor:0";
++		backup-switchover-mode = <&rv3028>,"backup-switchover-mode:0";
++		wakeup-source = <&ds1339>,"wakeup-source?",
++				<&ds3231>,"wakeup-source?",
++				<&mcp7940x>,"wakeup-source?",
++				<&mcp7941x>,"wakeup-source?",
++				<&m41t62>,"wakeup-source?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts b/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
+new file mode 100644
+index 000000000000..c83480c1c327
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
+@@ -0,0 +1,31 @@
++// Definitions for several I2C based Real Time Clocks
++// Available through i2c-gpio
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++#include "i2c-rtc-common.dtsi"
++
++/ {
++	fragment@100 {
++		target-path = "/";
++		__overlay__ {
++			i2cbus: i2c-gpio-rtc@0 {
++				compatible = "i2c-gpio";
++				gpios = <&gpio 23 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN) /* sda */
++					 &gpio 24 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN) /* scl */
++					>;
++				i2c-gpio,delay-us = <2>;        /* ~100 kHz */
++				#address-cells = <1>;
++				#size-cells = <0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		i2c_gpio_sda = <&i2cbus>,"gpios:4";
++		i2c_gpio_scl = <&i2cbus>,"gpios:16";
++		i2c_gpio_delay_us = <&i2cbus>,"i2c-gpio,delay-us:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
+new file mode 100644
+index 000000000000..cd31eac7e333
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
+@@ -0,0 +1,42 @@
++// Definitions for several I2C based Real Time Clocks
++/dts-v1/;
++/plugin/;
++
++#include "i2c-rtc-common.dtsi"
++
++/ {
++	frag100: fragment@100 {
++		target = <&i2c_arm>;
++		i2cbus: __overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@101 {
++		target = <&i2c0if>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@102 {
++		target = <&i2c0mux>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		i2c0 = <&frag100>, "target:0=",<&i2c0>;
++		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
++			      <0>,"+101+102";
++		i2c3 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c3";
++		i2c4 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c4";
++		i2c5 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c5";
++		i2c6 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c6";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi b/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+new file mode 100755
+index 000000000000..2716898e24a4
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+@@ -0,0 +1,341 @@
++// Definitions for I2C based sensors using the Industrial IO or HWMON interface.
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			bme280: bme280@76 {
++				compatible = "bosch,bme280";
++				reg = <0x76>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			bmp085: bmp085@77 {
++				compatible = "bosch,bmp085";
++				reg = <0x77>;
++				default-oversampling = <3>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			bmp180: bmp180@77 {
++				compatible = "bosch,bmp180";
++				reg = <0x77>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			bmp280: bmp280@76 {
++				compatible = "bosch,bmp280";
++				reg = <0x76>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			htu21: htu21@40 {
++				compatible = "htu21";
++				reg = <0x40>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@5 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			lm75: lm75@4f {
++				compatible = "lm75";
++				reg = <0x4f>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@6 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			si7020: si7020@40 {
++				compatible = "si7020";
++				reg = <0x40>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@7 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			tmp102: tmp102@48 {
++				compatible = "ti,tmp102";
++				reg = <0x48>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@8 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			hdc100x: hdc100x@40 {
++				compatible = "hdc100x";
++				reg = <0x40>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@9 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			tsl4531: tsl4531@29 {
++				compatible = "tsl4531";
++				reg = <0x29>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@10 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			veml6070: veml6070@38 {
++				compatible = "veml6070";
++				reg = <0x38>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@11 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			sht3x: sht3x@44 {
++				compatible = "sht3x";
++				reg = <0x44>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@12 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ds1621: ds1621@48 {
++				compatible = "ds1621";
++				reg = <0x48>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@13 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			max17040: max17040@36 {
++				compatible = "maxim,max17040";
++				reg = <0x36>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@14 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			bme680: bme680@76 {
++				compatible = "bosch,bme680";
++				reg = <0x76>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@15 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			sps30: sps30@69 {
++				compatible = "sensirion,sps30";
++				reg = <0x69>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@16 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			sgp30: sgp30@58 {
++				compatible = "sensirion,sgp30";
++				reg = <0x58>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@17 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ccs811: ccs811@5b {
++				compatible = "ccs811";
++				reg = <0x5b>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@18 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			bh1750: bh1750@23 {
++				compatible = "bh1750";
++				reg = <0x23>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@19 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			max30102: max30102@57 {
++				compatible = "maxim,max30102";
++				reg = <0x57>;
++				maxim,red-led-current-microamp = <7000>;
++				maxim,ir-led-current-microamp  = <7000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <4 2>;
++			};
++		};
++	};
++
++	__overrides__ {
++		bme280 = <0>,"+0";
++		bmp085 = <0>,"+1";
++		bmp180 = <0>,"+2";
++		bmp280 = <0>,"+3";
++		htu21 = <0>,"+4";
++		lm75 = <0>,"+5";
++		lm75addr = <&lm75>,"reg:0";
++		si7020 = <0>,"+6";
++		tmp102 = <0>,"+7";
++		hdc100x = <0>,"+8";
++		tsl4531 = <0>,"+9";
++		veml6070 = <0>,"+10";
++		sht3x = <0>,"+11";
++		ds1621 = <0>,"+12";
++		max17040 = <0>,"+13";
++		bme680 = <0>,"+14";
++		sps30 = <0>,"+15";
++		sgp30 = <0>,"+16";
++		ccs811 = <0>, "+17";
++		bh1750 = <0>, "+18";
++		max30102 = <0>,"+19";
++
++		addr =  <&bme280>,"reg:0", <&bmp280>,"reg:0", <&tmp102>,"reg:0",
++			<&lm75>,"reg:0", <&hdc100x>,"reg:0", <&sht3x>,"reg:0",
++			<&ds1621>,"reg:0", <&bme680>,"reg:0", <&ccs811>,"reg:0",
++			<&bh1750>,"reg:0";
++		int_pin = <&max30102>, "interrupts:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts b/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
+new file mode 100755
+index 000000000000..f8a39659d83e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
+@@ -0,0 +1,42 @@
++// Definitions for I2C based sensors using the Industrial IO or HWMON interface.
++/dts-v1/;
++/plugin/;
++
++#include "i2c-sensor-common.dtsi"
++
++/ {
++	frag100: fragment@100 {
++		target = <&i2c_arm>;
++		i2cbus: __overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@101 {
++		target = <&i2c0if>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@102 {
++		target = <&i2c0mux>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		i2c0 = <&frag100>, "target:0=",<&i2c0>;
++		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
++			      <0>,"+101+102";
++		i2c3 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c3";
++		i2c4 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c4";
++		i2c5 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c5";
++		i2c6 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c6";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c0-overlay.dts b/arch/arm/boot/dts/overlays/i2c0-overlay.dts
+new file mode 100644
+index 000000000000..46bf1bf2dc5c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c0-overlay.dts
+@@ -0,0 +1,83 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++			pinctrl-names = "default";
++			pinctrl-0 = <&i2c0_pins>;
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c0_pins>;
++		pins1: __overlay__ {
++			brcm,pins = <0 1>;
++			brcm,function = <4>; /* alt0 */
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0_pins>;
++		pins2: __dormant__ {
++			brcm,pins = <28 29>;
++			brcm,function = <4>; /* alt0 */
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0_pins>;
++		pins3: __dormant__ {
++			brcm,pins = <44 45>;
++			brcm,function = <5>; /* alt1 */
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c0_pins>;
++		pins4: __dormant__ {
++			brcm,pins = <46 47>;
++			brcm,function = <4>; /* alt0 */
++		};
++	};
++
++	fragment@5 {
++		target = <&i2c0>;
++		__dormant__ {
++			compatible = "brcm,bcm2708-i2c";
++		};
++	};
++
++	fragment@6 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@7 {
++		target-path = "/aliases";
++		__overlay__ {
++			i2c0 = "/soc/i2c@7e205000";
++		};
++	};
++
++	fragment@8 {
++		target-path = "/__symbols__";
++		__overlay__ {
++			i2c0 = "/soc/i2c@7e205000";
++		};
++	};
++
++	__overrides__ {
++		pins_0_1   = <0>,"+1-2-3-4";
++		pins_28_29 = <0>,"-1+2-3-4";
++		pins_44_45 = <0>,"-1-2+3-4";
++		pins_46_47 = <0>,"-1-2-3+4";
++		combine = <0>, "!5";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c1-overlay.dts b/arch/arm/boot/dts/overlays/i2c1-overlay.dts
+new file mode 100644
+index 000000000000..addaed73e665
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c1-overlay.dts
+@@ -0,0 +1,44 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c1>;
++		__overlay__ {
++			status = "okay";
++			pinctrl-names = "default";
++			pinctrl-0 = <&i2c1_pins>;
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1_pins>;
++		pins1: __overlay__ {
++			brcm,pins = <2 3>;
++			brcm,function = <4>; /* alt 0 */
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1_pins>;
++		pins2: __dormant__ {
++			brcm,pins = <44 45>;
++			brcm,function = <6>; /* alt 2 */
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c1>;
++		__dormant__ {
++			compatible = "brcm,bcm2708-i2c";
++		};
++	};
++
++	__overrides__ {
++		pins_2_3   = <0>,"=1!2";
++		pins_44_45 = <0>,"!1=2";
++		combine = <0>, "!3";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c3-overlay.dts b/arch/arm/boot/dts/overlays/i2c3-overlay.dts
+new file mode 100644
+index 000000000000..e24a1df21f99
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c3-overlay.dts
+@@ -0,0 +1,36 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&i2c3>;
++		frag0: __overlay__ {
++			status = "okay";
++			pinctrl-names = "default";
++			pinctrl-0 = <&i2c3_pins>;
++			clock-frequency = <100000>;
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c3_pins>;
++		__dormant__ {
++			brcm,pins = <2 3>;
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c3_pins>;
++		__overlay__ {
++			brcm,pins = <4 5>;
++		};
++	};
++
++	__overrides__ {
++		pins_2_3 = <0>,"=1!2";
++		pins_4_5 = <0>,"!1=2";
++		baudrate = <&frag0>, "clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c4-overlay.dts b/arch/arm/boot/dts/overlays/i2c4-overlay.dts
+new file mode 100644
+index 000000000000..14c7f4d1da4c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c4-overlay.dts
+@@ -0,0 +1,36 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&i2c4>;
++		frag0: __overlay__ {
++			status = "okay";
++			pinctrl-names = "default";
++			pinctrl-0 = <&i2c4_pins>;
++			clock-frequency = <100000>;
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c4_pins>;
++		__dormant__ {
++			brcm,pins = <6 7>;
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c4_pins>;
++		__overlay__ {
++			brcm,pins = <8 9>;
++		};
++	};
++
++	__overrides__ {
++		pins_6_7 = <0>,"=1!2";
++		pins_8_9 = <0>,"!1=2";
++		baudrate = <&frag0>, "clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c5-overlay.dts b/arch/arm/boot/dts/overlays/i2c5-overlay.dts
+new file mode 100644
+index 000000000000..7953621112de
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c5-overlay.dts
+@@ -0,0 +1,36 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&i2c5>;
++		frag0: __overlay__ {
++			status = "okay";
++			pinctrl-names = "default";
++			pinctrl-0 = <&i2c5_pins>;
++			clock-frequency = <100000>;
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c5_pins>;
++		__dormant__ {
++			brcm,pins = <10 11>;
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c5_pins>;
++		__overlay__ {
++			brcm,pins = <12 13>;
++		};
++	};
++
++	__overrides__ {
++		pins_10_11 = <0>,"=1!2";
++		pins_12_13 = <0>,"!1=2";
++		baudrate = <&frag0>, "clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c6-overlay.dts b/arch/arm/boot/dts/overlays/i2c6-overlay.dts
+new file mode 100644
+index 000000000000..555305a7ee1f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c6-overlay.dts
+@@ -0,0 +1,36 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&i2c6>;
++		frag0: __overlay__ {
++			status = "okay";
++			pinctrl-names = "default";
++			pinctrl-0 = <&i2c6_pins>;
++			clock-frequency = <100000>;
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c6_pins>;
++		__dormant__ {
++			brcm,pins = <0 1>;
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c6_pins>;
++		__overlay__ {
++			brcm,pins = <22 23>;
++		};
++	};
++
++	__overrides__ {
++		pins_0_1 = <0>,"=1!2";
++		pins_22_23 = <0>,"!1=2";
++		baudrate = <&frag0>, "clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2s-dac-overlay.dts b/arch/arm/boot/dts/overlays/i2s-dac-overlay.dts
+new file mode 100644
+index 000000000000..07a915342702
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2s-dac-overlay.dts
+@@ -0,0 +1,34 @@
++// Definitions for RPi DAC
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			pcm1794a-codec {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm1794a";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "rpi,rpi-dac";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2s-gpio28-31-overlay.dts b/arch/arm/boot/dts/overlays/i2s-gpio28-31-overlay.dts
+new file mode 100644
+index 000000000000..cf43094c6ff4
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2s-gpio28-31-overlay.dts
+@@ -0,0 +1,18 @@
++/*
++ * Device tree overlay to move i2s to gpio 28 to 31 on CM
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_pins>;
++		__overlay__ {
++			brcm,pins = <28 29 30 31>;
++			brcm,function = <6>; /* alt2 */
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/ilitek251x-overlay.dts b/arch/arm/boot/dts/overlays/ilitek251x-overlay.dts
+new file mode 100644
+index 000000000000..551aba591d26
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ilitek251x-overlay.dts
+@@ -0,0 +1,45 @@
++// Device tree overlay for I2C connected Ilitek multiple touch controller
++/dts-v1/;
++/plugin/;
++
++ / {
++	compatible = "brcm,bcm2835";
++
++ 	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {		
++			ili251x_pins: ili251x_pins {
++				brcm,pins = <4>; // interrupt
++				brcm,function = <0>; // in
++				brcm,pull = <2>; // pull-up //
++			};
++		};
++	};
++
++ 	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++ 			ili251x: ili251x@41 {
++				compatible = "ilitek,ili251x";
++				reg = <0x41>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&ili251x_pins>;
++				interrupt-parent = <&gpio>;
++				interrupts = <4 8>; // high-to-low edge triggered
++				touchscreen-size-x = <16384>;
++				touchscreen-size-y = <9600>;
++			};
++		};
++	};
++
++ 	__overrides__ {
++		interrupt = <&ili251x_pins>,"brcm,pins:0",
++			<&ili251x>,"interrupts:0";
++		sizex = <&ili251x>,"touchscreen-size-x:0";
++		sizey = <&ili251x>,"touchscreen-size-y:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/imx219-overlay.dts b/arch/arm/boot/dts/overlays/imx219-overlay.dts
+new file mode 100644
+index 000000000000..aa97450ac994
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx219-overlay.dts
+@@ -0,0 +1,89 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX219 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@1 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			status = "okay";
++			clock-frequency = <24000000>;
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	i2c_frag: fragment@100 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "imx219.dtsi"
++
++			vcm: ad5398@c {
++				compatible = "adi,ad5398";
++				reg = <0x0c>;
++				status = "disabled";
++				VANA-supply = <&cam1_reg>;
++			};
++		};
++	};
++
++	csi_frag: fragment@101 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++			brcm,media-controller;
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	__overrides__ {
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <&csi>,"brcm,media-controller?";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_vc>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "VANA-supply:0=",<&cam0_reg>,
++		       <&vcm>, "VANA-supply:0=", <&cam0_reg>;
++		vcm = <&vcm>, "status=okay",
++		      <&cam_node>,"lens-focus:0=", <&vcm>;
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
+diff --git a/arch/arm/boot/dts/overlays/imx219.dtsi b/arch/arm/boot/dts/overlays/imx219.dtsi
+new file mode 100644
+index 000000000000..fa870f77ef07
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx219.dtsi
+@@ -0,0 +1,27 @@
++// Fragment that configures an imx219
++
++cam_node: imx219@10 {
++	compatible = "sony,imx219";
++	reg = <0x10>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "xclk";
++
++	VANA-supply = <&cam1_reg>;	/* 2.8v */
++	VDIG-supply = <&cam_dummy_reg>;	/* 1.8v */
++	VDDL-supply = <&cam_dummy_reg>;	/* 1.2v */
++
++	rotation = <180>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			data-lanes = <1 2>;
++			clock-noncontinuous;
++			link-frequencies =
++				/bits/ 64 <456000000>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/imx258-overlay.dts b/arch/arm/boot/dts/overlays/imx258-overlay.dts
+new file mode 100644
+index 000000000000..7117682ab095
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx258-overlay.dts
+@@ -0,0 +1,131 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX258 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@1 {
++		target = <&cam1_clk>;
++		cam_clk: __overlay__ {
++			clock-frequency = <24000000>;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@11 {
++		target = <&cam_endpoint>;
++		__overlay__ {
++			data-lanes = <1 2>;
++			link-frequencies = /bits/ 64 <633600000
++						      320000000>;
++		};
++	};
++
++	fragment@12 {
++		target = <&cam_endpoint>;
++		__dormant__ {
++			data-lanes = <1 2 3 4>;
++			link-frequencies =
++				/bits/ 64 <633600000 320000000>;
++		};
++	};
++
++	fragment@13 {
++		target = <&csi_ep>;
++		__overlay__ {
++			data-lanes = <1 2>;
++		};
++	};
++
++	fragment@14 {
++		target = <&csi_ep>;
++		__dormant__ {
++			data-lanes = <1 2 3 4>;
++		};
++	};
++
++	csi_frag: fragment@101 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++			brcm,media-controller;
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++					clock-lanes = <0>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	reg_frag: fragment@5 {
++		target = <&cam1_reg>;
++		cam_reg: __overlay__ {
++			regulator-name = "imx258_vana";
++			startup-delay-us = <300000>;
++			regulator-min-microvolt = <2700000>;
++			regulator-max-microvolt = <2700000>;
++		};
++	};
++
++	i2c_frag: fragment@100 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "imx258.dtsi"
++
++			vcm: ad5398@c {
++				compatible = "adi,ad5398";
++				reg = <0x0c>;
++				status = "disabled";
++				VANA-supply = <&cam1_reg>;
++			};
++		};
++	};
++
++	__overrides__ {
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <&csi>,"brcm,media-controller?";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_vc>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&reg_frag>, "target:0=",<&cam0_reg>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "vana-supply:0=",<&cam0_reg>;
++		vcm = <&vcm>, "status=okay",
++		      <&cam_node>,"lens-focus:0=", <&vcm>;
++		4lane = <0>, "-11+12-13+14";
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
+diff --git a/arch/arm/boot/dts/overlays/imx258.dtsi b/arch/arm/boot/dts/overlays/imx258.dtsi
+new file mode 100644
+index 000000000000..cca81e1aa8b3
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx258.dtsi
+@@ -0,0 +1,27 @@
++// Fragment that configures a Sony IMX258
++
++cam_node: imx258@10 {
++	compatible = "sony,imx258";
++	reg = <0x10>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "xclk";
++
++	vana-supply = <&cam1_reg>;	/* 2.8v */
++	vdig-supply = <&cam_dummy_reg>;	/* 1.05v */
++	vif-supply = <&cam_dummy_reg>;	/* 1.8v */
++
++	rotation = <180>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			clock-noncontinuous;
++			link-frequencies =
++				/bits/ 64 <633600000
++					320000000>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/imx290-overlay.dts b/arch/arm/boot/dts/overlays/imx290-overlay.dts
+new file mode 100644
+index 000000000000..2e70e17ed29b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx290-overlay.dts
+@@ -0,0 +1,32 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX290 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include "imx290_327-overlay.dtsi"
++
++/{
++	compatible = "brcm,bcm2835";
++
++	// Fragment numbers deliberately high to avoid conflicts with the
++	// included imx290_327 overlay file.
++
++	fragment@101 {
++		target = <&cam_node>;
++		__overlay__ {
++			compatible = "sony,imx290";
++		};
++	};
++
++	fragment@102 {
++		target = <&cam_node>;
++		__dormant__ {
++			compatible = "sony,imx290-mono";
++		};
++	};
++
++	__overrides__ {
++		mono = <0>, "-101+102";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/imx290_327-overlay.dtsi b/arch/arm/boot/dts/overlays/imx290_327-overlay.dtsi
+new file mode 100644
+index 000000000000..d8141de672e2
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx290_327-overlay.dtsi
+@@ -0,0 +1,112 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Partial definitions for IMX290 or IMX327 camera module on VC I2C bus
++// The compatible string should be set in an overlay that then includes this one
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "imx290_327.dtsi"
++		};
++	};
++
++	csi_frag: fragment@1 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++			brcm,media-controller;
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@3 {
++		target = <&cam1_clk>;
++		cam_clk: __overlay__ {
++			status = "okay";
++			clock-frequency = <37125000>;
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@6 {
++		target = <&cam_endpoint>;
++		__overlay__ {
++			data-lanes = <1 2>;
++			link-frequencies =
++				/bits/ 64 <445500000 297000000>;
++		};
++	};
++
++	fragment@7 {
++		target = <&cam_endpoint>;
++		__dormant__ {
++			data-lanes = <1 2 3 4>;
++			link-frequencies =
++				/bits/ 64 <222750000 148500000>;
++		};
++	};
++
++	fragment@8 {
++		target = <&csi_ep>;
++		__overlay__ {
++			data-lanes = <1 2>;
++		};
++	};
++
++	fragment@9 {
++		target = <&csi_ep>;
++		__dormant__ {
++			data-lanes = <1 2 3 4>;
++		};
++	};
++
++	__overrides__ {
++		4lane = <0>, "-6+7-8+9";
++		clock-frequency = <&cam_clk>,"clock-frequency:0",
++				  <&cam_node>,"clock-frequency:0";
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <&csi>,"brcm,media-controller?";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_vc>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "vdda-supply:0=",<&cam0_reg>;
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
+diff --git a/arch/arm/boot/dts/overlays/imx290_327.dtsi b/arch/arm/boot/dts/overlays/imx290_327.dtsi
+new file mode 100644
+index 000000000000..9afe7e9f470c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx290_327.dtsi
+@@ -0,0 +1,24 @@
++// Fragment to configure and IMX290 / IMX327 / IMX462 image sensor
++
++cam_node: imx290@1a {
++	compatible = "sony,imx290";
++	reg = <0x1a>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "xclk";
++	clock-frequency = <37125000>;
++
++	rotation = <0>;
++	orientation = <2>;
++
++	vdda-supply = <&cam1_reg>;	/* 2.8v */
++	vdddo-supply = <&cam_dummy_reg>;	/* 1.8v */
++	vddd-supply = <&cam_dummy_reg>;	/* 1.5v */
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/imx296-overlay.dts b/arch/arm/boot/dts/overlays/imx296-overlay.dts
+new file mode 100644
+index 000000000000..85b6f7e7fca1
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx296-overlay.dts
+@@ -0,0 +1,103 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX296 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@1 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			status = "okay";
++			clock-frequency = <37125000>;
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	reg_frag: fragment@5 {
++		target = <&cam1_reg>;
++		cam_reg: __overlay__ {
++			startup-delay-us = <500000>;
++		};
++	};
++
++	i2c_frag: fragment@100 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			imx296: imx296@1a {
++				compatible = "sony,imx296";
++				reg = <0x1a>;
++				status = "okay";
++
++				clocks = <&cam1_clk>;
++				clock-names = "inck";
++
++				avdd-supply = <&cam1_reg>;	/* 3.3v */
++				dvdd-supply = <&cam_dummy_reg>;	/* 1.8v */
++				ovdd-supply = <&cam_dummy_reg>;	/* 1.2v */
++
++				rotation = <180>;
++				orientation = <2>;
++
++				port {
++					imx296_0: endpoint {
++						remote-endpoint = <&csi_ep>;
++						clock-lanes = <0>;
++						data-lanes = <1>;
++						clock-noncontinuous;
++						link-frequencies =
++							/bits/ 64 <594000000>;
++					};
++				};
++			};
++		};
++	};
++
++	csi_frag: fragment@101 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++			brcm,media-controller;
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&imx296_0>;
++					clock-lanes = <0>;
++					data-lanes = <1>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	__overrides__ {
++		rotation = <&imx296>,"rotation:0";
++		orientation = <&imx296>,"orientation:0";
++		media-controller = <&csi>,"brcm,media-controller?";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_vc>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&imx296>, "clocks:0=",<&cam0_clk>,
++		       <&imx296>, "VANA-supply:0=",<&cam0_reg>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/imx327-overlay.dts b/arch/arm/boot/dts/overlays/imx327-overlay.dts
+new file mode 100644
+index 000000000000..d01a67c5df09
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx327-overlay.dts
+@@ -0,0 +1,32 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX327 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include "imx290_327-overlay.dtsi"
++
++/{
++	compatible = "brcm,bcm2835";
++
++	// Fragment numbers deliberately high to avoid conflicts with the
++	// included imx290_327 overlay file.
++
++	fragment@101 {
++		target = <&cam_node>;
++		__overlay__ {
++			compatible = "sony,imx327";
++		};
++	};
++
++	fragment@102 {
++		target = <&cam_node>;
++		__dormant__ {
++			compatible = "sony,imx327-mono";
++		};
++	};
++
++	__overrides__ {
++		mono = <0>, "-101+102";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/imx378-overlay.dts b/arch/arm/boot/dts/overlays/imx378-overlay.dts
+new file mode 100644
+index 000000000000..6a999914056a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx378-overlay.dts
+@@ -0,0 +1,10 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX378 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include "imx477_378-overlay.dtsi"
++
++&cam_node {
++	compatible = "sony,imx378";
++};
+diff --git a/arch/arm/boot/dts/overlays/imx462-overlay.dts b/arch/arm/boot/dts/overlays/imx462-overlay.dts
+new file mode 100644
+index 000000000000..e2b54a7a9f98
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx462-overlay.dts
+@@ -0,0 +1,32 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX462 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include "imx290_327-overlay.dtsi"
++
++/{
++	compatible = "brcm,bcm2835";
++
++	// Fragment numbers deliberately high to avoid conflicts with the
++	// included imx290_327 overlay file.
++
++	fragment@101 {
++		target = <&cam_node>;
++		__overlay__ {
++			compatible = "sony,imx462";
++		};
++	};
++
++	fragment@102 {
++		target = <&cam_node>;
++		__dormant__ {
++			compatible = "sony,imx462-mono";
++		};
++	};
++
++	__overrides__ {
++		mono = <0>, "-101+102";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/imx477-overlay.dts b/arch/arm/boot/dts/overlays/imx477-overlay.dts
+new file mode 100644
+index 000000000000..f6482a990cfc
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx477-overlay.dts
+@@ -0,0 +1,10 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX477 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include "imx477_378-overlay.dtsi"
++
++&cam_node {
++	compatible = "sony,imx477";
++};
+diff --git a/arch/arm/boot/dts/overlays/imx477_378-overlay.dtsi b/arch/arm/boot/dts/overlays/imx477_378-overlay.dtsi
+new file mode 100644
+index 000000000000..7afc0a248569
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx477_378-overlay.dtsi
+@@ -0,0 +1,83 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX477 camera module on VC I2C bus
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@1 {
++		target = <&cam1_clk>;
++		cam_clk: __overlay__ {
++			clock-frequency = <24000000>;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	reg_frag: fragment@3 {
++		target = <&cam1_reg>;
++		cam_reg: __overlay__ {
++			startup-delay-us = <300000>;
++		};
++	};
++
++	i2c_frag: fragment@100 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "imx477_378.dtsi"
++		};
++	};
++
++	csi_frag: fragment@101 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++			brcm,media-controller;
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	__overrides__ {
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <&csi>,"brcm,media-controller?";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_vc>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&reg_frag>, "target:0=",<&cam0_reg>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "VANA-supply:0=",<&cam0_reg>;
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
+diff --git a/arch/arm/boot/dts/overlays/imx477_378.dtsi b/arch/arm/boot/dts/overlays/imx477_378.dtsi
+new file mode 100644
+index 000000000000..a0c154c2a11f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx477_378.dtsi
+@@ -0,0 +1,24 @@
++cam_node: imx477@1a {
++	reg = <0x1a>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "xclk";
++
++	VANA-supply = <&cam1_reg>;	/* 2.8v */
++	VDIG-supply = <&cam_dummy_reg>;	/* 1.05v */
++	VDDL-supply = <&cam_dummy_reg>;	/* 1.8v */
++
++	rotation = <180>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			data-lanes = <1 2>;
++			clock-noncontinuous;
++			link-frequencies =
++				/bits/ 64 <450000000>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/imx519-overlay.dts b/arch/arm/boot/dts/overlays/imx519-overlay.dts
+new file mode 100644
+index 000000000000..ada1224dd19b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx519-overlay.dts
+@@ -0,0 +1,96 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for imx519 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			imx519: imx519@1a {
++				compatible = "sony,imx519";
++				reg = <0x1a>;
++				status = "okay";
++
++				clocks = <&cam1_clk>;
++				clock-names = "xclk";
++
++				VANA-supply = <&cam1_reg>;	/* 2.8v */
++				VDIG-supply = <&cam_dummy_reg>;	/* 1.8v */
++				VDDL-supply = <&cam_dummy_reg>;	/* 1.2v */
++
++				rotation = <0>;
++				orientation = <2>;
++
++				port {
++					imx519_0: endpoint {
++						remote-endpoint = <&csi1_ep>;
++						clock-lanes = <0>;
++						data-lanes = <1 2>;
++						clock-noncontinuous;
++						link-frequencies =
++							/bits/ 64 <493500000>;
++					};
++				};
++			};
++		};
++	};
++
++	csi_frag: fragment@1 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++			brcm,media-controller;
++
++			port{
++				csi1_ep: endpoint{
++					remote-endpoint = <&imx519_0>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@3 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			clock-frequency = <24000000>;
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		rotation = <&imx519>,"rotation:0";
++		orientation = <&imx519>,"orientation:0";
++		media-controller = <&csi>,"brcm,media-controller?";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_vc>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&imx519>, "clocks:0=",<&cam0_clk>,
++		       <&imx519>, "VANA-supply:0=",<&cam0_reg>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/iqaudio-codec-overlay.dts b/arch/arm/boot/dts/overlays/iqaudio-codec-overlay.dts
+new file mode 100644
+index 000000000000..9110f5d34298
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/iqaudio-codec-overlay.dts
+@@ -0,0 +1,42 @@
++// Definitions for IQaudIO CODEC
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			da2713@1a {
++				#sound-dai-cells = <0>;
++				compatible = "dlg,da7213";
++				reg = <0x1a>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		iqaudio_dac: __overlay__ {
++			compatible = "iqaudio,iqaudio-codec";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/iqaudio-dac-overlay.dts b/arch/arm/boot/dts/overlays/iqaudio-dac-overlay.dts
+new file mode 100644
+index 000000000000..24073cadd0ef
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/iqaudio-dac-overlay.dts
+@@ -0,0 +1,46 @@
++// Definitions for IQaudIO DAC
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4c {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4c>;
++				AVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		frag2: __overlay__ {
++			compatible = "iqaudio,iqaudio-dac";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain = <&frag2>,"iqaudio,24db_digital_gain?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/iqaudio-dacplus-overlay.dts b/arch/arm/boot/dts/overlays/iqaudio-dacplus-overlay.dts
+new file mode 100644
+index 000000000000..7c70b25e58d7
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/iqaudio-dacplus-overlay.dts
+@@ -0,0 +1,49 @@
++// Definitions for IQaudIO DAC+
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4c {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4c>;
++				AVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		iqaudio_dac: __overlay__ {
++			compatible = "iqaudio,iqaudio-dac";
++			i2s-controller = <&i2s>;
++			mute-gpios = <&gpio 22 0>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain = <&iqaudio_dac>,"iqaudio,24db_digital_gain?";
++		auto_mute_amp = <&iqaudio_dac>,"iqaudio-dac,auto-mute-amp?";
++		unmute_amp = <&iqaudio_dac>,"iqaudio-dac,unmute-amp?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/iqaudio-digi-wm8804-audio-overlay.dts b/arch/arm/boot/dts/overlays/iqaudio-digi-wm8804-audio-overlay.dts
+new file mode 100644
+index 000000000000..ee54095c869b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/iqaudio-digi-wm8804-audio-overlay.dts
+@@ -0,0 +1,47 @@
++// Definitions for IQAudIO Digi WM8804 audio board
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			wm8804@3b {
++				#sound-dai-cells = <0>;
++				compatible = "wlf,wm8804";
++				reg = <0x3b>;
++				status = "okay";
++				DVDD-supply = <&vdd_3v3_reg>;
++				PVDD-supply = <&vdd_3v3_reg>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		wm8804_digi: __overlay__ {
++			compatible = "iqaudio,wm8804-digi";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		card_name = <&wm8804_digi>,"wm8804-digi,card-name";
++		dai_name = <&wm8804_digi>,"wm8804-digi,dai-name";
++		dai_stream_name = <&wm8804_digi>,"wm8804-digi,dai-stream-name";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/iqs550-overlay.dts b/arch/arm/boot/dts/overlays/iqs550-overlay.dts
+new file mode 100644
+index 000000000000..c3956937055f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/iqs550-overlay.dts
+@@ -0,0 +1,59 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++// Definitions for Azoteq IQS550 trackpad/touchscreen controller
++/dts-v1/;
++/plugin/;
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			iqs550: iqs550@74 {
++				compatible = "azoteq,iqs550";
++				reg = <0x74>;
++				interrupt-parent = <&gpio>;
++				interrupts = <4 IRQ_TYPE_LEVEL_HIGH>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&iqs550_pins>;
++				touchscreen-size-x = <800>;
++				touchscreen-size-y = <480>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&iqs550>;
++		iqs550_reset: __dormant__ {
++			reset-gpios = <&gpio 255 (GPIO_ACTIVE_LOW |
++						  GPIO_PUSH_PULL)>;
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			iqs550_pins: iqs550_pins {
++				brcm,pins = <4>;
++				brcm,pull = <1>;
++			};
++		};
++	};
++
++	__overrides__ {
++		interrupt = <&iqs550>,"interrupts:0",
++			    <&iqs550_pins>,"brcm,pins:0";
++		reset = <0>,"+1", <&iqs550_reset>,"reset-gpios:4";
++		sizex = <&iqs550>,"touchscreen-size-x:0";
++		sizey = <&iqs550>,"touchscreen-size-y:0";
++		invx = <&iqs550>,"touchscreen-inverted-x?";
++		invy = <&iqs550>,"touchscreen-inverted-y?";
++		swapxy = <&iqs550>,"touchscreen-swapped-x-y?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/irs1125-overlay.dts b/arch/arm/boot/dts/overlays/irs1125-overlay.dts
+new file mode 100644
+index 000000000000..8f8432c07a89
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/irs1125-overlay.dts
+@@ -0,0 +1,90 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IRS1125 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			irs1125: irs1125@3d {
++				compatible = "infineon,irs1125";
++				reg = <0x3d>;
++				status = "okay";
++
++				pwdn-gpios = <&gpio 5 0>;
++				clocks = <&cam1_clk>;
++
++				port {
++					irs1125_0: endpoint {
++						remote-endpoint = <&csi1_ep>;
++						clock-lanes = <0>;
++						data-lanes = <1 2>;
++						clock-noncontinuous;
++						link-frequencies =
++							/bits/ 64 <297000000>;
++					};
++				};
++			};
++		};
++	};
++
++	csi_frag: fragment@1 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++
++			port {
++				csi1_ep: endpoint {
++					remote-endpoint = <&irs1125_0>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target-path="/__overrides__";
++		__overlay__ {
++			cam0-pwdn-ctrl = <&irs1125>,"pwdn-gpios:0";
++			cam0-pwdn      = <&irs1125>,"pwdn-gpios:4";
++		};
++	};
++
++	clk_frag: fragment@5 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			status = "okay";
++			clock-frequency = <26000000>;
++		};
++	};
++
++	__overrides__ {
++		media-controller = <&csi>,"brcm,media-controller?";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_vc>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&irs1125>, "clocks:0=",<&cam0_clk>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/jedec-spi-nor-overlay.dts b/arch/arm/boot/dts/overlays/jedec-spi-nor-overlay.dts
+new file mode 100644
+index 000000000000..585c7dbcdf7f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/jedec-spi-nor-overlay.dts
+@@ -0,0 +1,309 @@
++// Overlay for JEDEC SPI-NOR Flash Devices (aka m25p80)
++
++// dtparams:
++//     flash-spi<n>-<m>        - Enables flash device on SPI<n>, CS#<m>.
++//     flash-fastr-spi<n>-<m>  - Enables flash device with fast read capability on SPI<n>, CS#<m>.
++//
++// If devices are present on SPI1 or SPI2, those interfaces must be enabled with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++//
++// Example: A single flash device with fast read capability on SPI0, CS#0:
++// dtoverlay=jedec-spi-nor:flash-fastr-spi0-0
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	// disable spi-dev on spi0.0
++	fragment@0 {
++		target = <&spidev0>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi0.1
++	fragment@1 {
++		target = <&spidev1>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi1.0
++	fragment@2 {
++		target-path = "spi1/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi1.1
++	fragment@3 {
++		target-path = "spi1/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi1.2
++	fragment@4 {
++		target-path = "spi1/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi2.0
++	fragment@5 {
++		target-path = "spi2/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi2.1
++	fragment@6 {
++		target-path = "spi2/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi2.2
++	fragment@7 {
++		target-path = "spi2/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// enable flash on spi0.0
++	fragment@8 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			spi_nor_00: spi_nor@0 {
++				#address-cells = <1>;
++				#size-cells = <1>;
++				compatible = "jedec,spi-nor";
++				reg = <0>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	// enable flash on spi0.1
++	fragment@9 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			spi_nor_01: spi_nor@1 {
++				#address-cells = <1>;
++				#size-cells = <1>;
++				compatible = "jedec,spi-nor";
++				reg = <1>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	// enable flash on spi1.0
++	fragment@10 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			spi_nor_10: spi_nor@0 {
++				#address-cells = <1>;
++				#size-cells = <1>;
++				compatible = "jedec,spi-nor";
++				reg = <0>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	// enable flash on spi1.1
++	fragment@11 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			spi_nor_11: spi_nor@1 {
++				#address-cells = <1>;
++				#size-cells = <1>;
++				compatible = "jedec,spi-nor";
++				reg = <1>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	// enable flash on spi1.2
++	fragment@12 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			spi_nor_12: spi_nor@2 {
++				#address-cells = <1>;
++				#size-cells = <1>;
++				compatible = "jedec,spi-nor";
++				reg = <2>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	// enable flash on spi2.0
++	fragment@13 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			spi_nor_20: spi_nor@0 {
++				#address-cells = <1>;
++				#size-cells = <1>;
++				compatible = "jedec,spi-nor";
++				reg = <0>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	// enable flash on spi2.1
++	fragment@14 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			spi_nor_21: spi_nor@1 {
++				#address-cells = <1>;
++				#size-cells = <1>;
++				compatible = "jedec,spi-nor";
++				reg = <1>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	// enable flash on spi2.2
++	fragment@15 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			spi_nor_22: spi_nor@2 {
++				#address-cells = <1>;
++				#size-cells = <1>;
++				compatible = "jedec,spi-nor";
++				reg = <2>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	// Enable fast read for device on spi0.0.
++	// Use default active low interrupt signalling.
++	fragment@16 {
++		target = <&spi_nor_00>;
++		__dormant__ {
++			m25p,fast-read;
++		};
++	};
++
++	// Enable fast read for device on spi0.1.
++	// Use default active low interrupt signalling.
++	fragment@17 {
++		target = <&spi_nor_01>;
++		__dormant__ {
++			m25p,fast-read;
++		};
++	};
++
++	// Enable fast read for device on spi1.0.
++	// Use default active low interrupt signalling.
++	fragment@18 {
++		target = <&spi_nor_10>;
++		__dormant__ {
++			m25p,fast-read;
++		};
++	};
++
++	// Enable fast read for device on spi1.1.
++	// Use default active low interrupt signalling.
++	fragment@19 {
++		target = <&spi_nor_11>;
++		__dormant__ {
++			m25p,fast-read;
++		};
++	};
++
++	// Enable fast read for device on spi1.2.
++	// Use default active low interrupt signalling.
++	fragment@20 {
++		target = <&spi_nor_12>;
++		__dormant__ {
++			m25p,fast-read;
++		};
++	};
++
++	// Enable fast read for device on spi2.0.
++	// Use default active low interrupt signalling.
++	fragment@21 {
++		target = <&spi_nor_20>;
++		__dormant__ {
++			m25p,fast-read;
++		};
++	};
++
++	// Enable fast read for device on spi2.1.
++	// Use default active low interrupt signalling.
++	fragment@22 {
++		target = <&spi_nor_21>;
++		__dormant__ {
++			m25p,fast-read;
++		};
++	};
++
++	// Enable fast read for device on spi2.2.
++	// Use default active low interrupt signalling.
++	fragment@23 {
++		target = <&spi_nor_22>;
++		__dormant__ {
++			m25p,fast-read;
++		};
++	};
++
++	__overrides__ {
++		flash-spi0-0       = <0>,"+0+8";
++		flash-spi0-1       = <0>,"+1+9";
++		flash-spi1-0       = <0>,"+2+10";
++		flash-spi1-1       = <0>,"+3+11";
++		flash-spi1-2       = <0>,"+4+12";
++		flash-spi2-0       = <0>,"+5+13";
++		flash-spi2-1       = <0>,"+6+14";
++		flash-spi2-2       = <0>,"+7+15";
++		flash-fastr-spi0-0 = <0>,"+0+8+16";
++		flash-fastr-spi0-1 = <0>,"+1+9+17";
++		flash-fastr-spi1-0 = <0>,"+2+10+18";
++		flash-fastr-spi1-1 = <0>,"+3+11+19";
++		flash-fastr-spi1-2 = <0>,"+4+12+20";
++		flash-fastr-spi2-0 = <0>,"+5+13+21";
++		flash-fastr-spi2-1 = <0>,"+6+14+22";
++		flash-fastr-spi2-2 = <0>,"+7+15+23";
++	};
++};
++
+diff --git a/arch/arm/boot/dts/overlays/justboom-both-overlay.dts b/arch/arm/boot/dts/overlays/justboom-both-overlay.dts
+new file mode 100644
+index 000000000000..9c42670631c0
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/justboom-both-overlay.dts
+@@ -0,0 +1,65 @@
++// SPDX-License-Identifier: GPL-2.0
++// Definitions for JustBoom Both (Digi+DAC)
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			wm8804@3b {
++				#sound-dai-cells = <0>;
++				compatible = "wlf,wm8804";
++				reg = <0x3b>;
++				PVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4d {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4d>;
++				AVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		frag3: __overlay__ {
++			compatible = "justboom,justboom-both";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain = <&frag3>,"justboom,24db_digital_gain?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/justboom-dac-overlay.dts b/arch/arm/boot/dts/overlays/justboom-dac-overlay.dts
+new file mode 100644
+index 000000000000..d00515dca419
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/justboom-dac-overlay.dts
+@@ -0,0 +1,46 @@
++// Definitions for JustBoom DAC
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4d {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4d>;
++				AVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		frag2: __overlay__ {
++			compatible = "justboom,justboom-dac";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain = <&frag2>,"justboom,24db_digital_gain?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/justboom-digi-overlay.dts b/arch/arm/boot/dts/overlays/justboom-digi-overlay.dts
+new file mode 100644
+index 000000000000..e73336029c54
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/justboom-digi-overlay.dts
+@@ -0,0 +1,41 @@
++// Definitions for JustBoom Digi
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			wm8804@3b {
++				#sound-dai-cells = <0>;
++				compatible = "wlf,wm8804";
++				reg = <0x3b>;
++				PVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "justboom,justboom-digi";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/ltc294x-overlay.dts b/arch/arm/boot/dts/overlays/ltc294x-overlay.dts
+new file mode 100644
+index 000000000000..6d971f3649ca
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ltc294x-overlay.dts
+@@ -0,0 +1,86 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ltc2941: ltc2941@64 {
++				compatible = "lltc,ltc2941";
++				reg = <0x64>;
++				lltc,resistor-sense = <50>;
++				lltc,prescaler-exponent = <7>; 
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c_arm>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ltc2942: ltc2942@64 {
++				compatible = "lltc,ltc2942";
++				reg = <0x64>;
++				lltc,resistor-sense = <50>;
++				lltc,prescaler-exponent = <7>; 
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c_arm>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ltc2943: ltc2943@64 {
++				compatible = "lltc,ltc2943";
++				reg = <0x64>;
++				lltc,resistor-sense = <50>;
++				lltc,prescaler-exponent = <7>; 
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c_arm>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ltc2944: ltc2944@64 {
++				compatible = "lltc,ltc2944";
++				reg = <0x64>;
++				lltc,resistor-sense = <50>;
++				lltc,prescaler-exponent = <7>; 
++			};
++		};
++	};
++
++	__overrides__ {
++		ltc2941 = <0>,"+0";
++		ltc2942 = <0>,"+1";
++		ltc2943 = <0>,"+2";
++		ltc2944 = <0>,"+3";
++		resistor-sense = <&ltc2941>, "lltc,resistor-sense:0",
++			         <&ltc2942>, "lltc,resistor-sense:0",
++				 <&ltc2943>, "lltc,resistor-sense:0",
++				 <&ltc2944>, "lltc,resistor-sense:0";
++		prescaler-exponent = <&ltc2941>, "lltc,prescaler-exponent:0",
++			         <&ltc2942>, "lltc,prescaler-exponent:0",
++				 <&ltc2943>, "lltc,prescaler-exponent:0",
++				 <&ltc2944>, "lltc,prescaler-exponent:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/max98357a-overlay.dts b/arch/arm/boot/dts/overlays/max98357a-overlay.dts
+new file mode 100644
+index 000000000000..9e2afb05b7cb
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/max98357a-overlay.dts
+@@ -0,0 +1,84 @@
++// Overlay for Maxim MAX98357A audio DAC
++
++// dtparams:
++//     no-sdmode  - SD_MODE pin not managed by driver.
++//     sdmode-pin - Specify GPIO pin to which SD_MODE is connected (default 4).
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	/* Enable I2S */
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	/* DAC whose SD_MODE pin is managed by driver (via GPIO pin) */
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			max98357a_dac: max98357a {
++				compatible = "maxim,max98357a";
++				#sound-dai-cells = <0>;
++				sdmode-gpios = <&gpio 4 0>;   /* 2nd word overwritten by sdmode-pin parameter */
++				status = "okay";
++			};
++		};
++	};
++
++	/* DAC whose SD_MODE pin is not managed by driver */
++	fragment@2 {
++		target-path = "/";
++		__dormant__ {
++			max98357a_nsd: max98357a {
++				compatible = "maxim,max98357a";
++				#sound-dai-cells = <0>;
++				status = "okay";
++			};
++		};
++	};
++
++	/* Soundcard connecting I2S to DAC with SD_MODE */
++	fragment@3 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "simple-audio-card";
++			simple-audio-card,format = "i2s";
++			simple-audio-card,name = "MAX98357A";
++			status = "okay";
++			simple-audio-card,cpu {
++				sound-dai = <&i2s>;
++			};
++			simple-audio-card,codec {
++				sound-dai = <&max98357a_dac>;
++			};
++		};
++	};
++
++	/* Soundcard connecting I2S to DAC without SD_MODE */
++	fragment@4 {
++		target = <&sound>;
++		__dormant__ {
++			compatible = "simple-audio-card";
++			simple-audio-card,format = "i2s";
++			simple-audio-card,name = "MAX98357A";
++			status = "okay";
++			simple-audio-card,cpu {
++				sound-dai = <&i2s>;
++			};
++			simple-audio-card,codec {
++				sound-dai = <&max98357a_nsd>;
++			};
++		};
++	};
++
++	__overrides__ {
++		no-sdmode  = <0>,"-1+2-3+4";
++		sdmode-pin = <&max98357a_dac>,"sdmode-gpios:4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/maxtherm-overlay.dts b/arch/arm/boot/dts/overlays/maxtherm-overlay.dts
+new file mode 100644
+index 000000000000..9964e246c14f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/maxtherm-overlay.dts
+@@ -0,0 +1,186 @@
++/*
++ * Universal device tree overlay for SPI devices
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/iio/temperature/thermocouple.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev1>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target-path = "spi1/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target-path = "spi1/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@4 {
++		target-path = "spi1/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@5 {
++		target-path = "spi2/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@6 {
++		target-path = "spi2/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@7 {
++		target-path = "spi2/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	maxfrag: fragment@8 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			max: maxtherm@0 {
++				compatible = "maxim,max6675";
++				reg = <0>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	fragment@9 {
++		target = <&max>;
++		__dormant__ {
++			compatible = "maxim,max31855e", "maxim,max31855";
++		};
++	};
++
++	fragment@10 {
++		target = <&max>;
++		__dormant__ {
++			compatible = "maxim,max31855j", "maxim,max31855";
++		};
++	};
++
++	fragment@11 {
++		target = <&max>;
++		__dormant__ {
++			compatible = "maxim,max31855k", "maxim,max31855";
++		};
++	};
++
++	fragment@12 {
++		target = <&max>;
++		__dormant__ {
++			compatible = "maxim,max31855n", "maxim,max31855";
++		};
++	};
++
++	fragment@13 {
++		target = <&max>;
++		__dormant__ {
++			compatible = "maxim,max31855r", "maxim,max31855";
++		};
++	};
++
++	fragment@14 {
++		target = <&max>;
++		__dormant__ {
++			compatible = "maxim,max31855s", "maxim,max31855";
++		};
++	};
++
++	fragment@15 {
++		target = <&max>;
++		__dormant__ {
++			compatible = "maxim,max31855t", "maxim,max31855";
++		};
++	};
++
++	fragment@16 {
++		target = <&max>;
++		__dormant__ {
++			compatible = "maxim,max31856";
++			spi-cpha;
++			thermocouple-type = <THERMOCOUPLE_TYPE_K>;
++		};
++	};
++
++	__overrides__ {
++		spi0-0 = <0>, "+0",
++			 <&maxfrag>,"target:0=",<&spi0>,
++			 <&max>,"reg:0=0";
++		spi0-1 = <0>, "+1",
++			 <&maxfrag>,"target:0=",<&spi0>,
++			 <&max>,"reg:0=1";
++		spi1-0 = <0>, "+2",
++			 <&maxfrag>,"target:0=",<&spi1>,
++			 <&max>,"reg:0=0";
++		spi1-1 = <0>, "+3",
++			 <&maxfrag>,"target:0=",<&spi1>,
++			 <&max>,"reg:0=1";
++		spi1-2 = <0>, "+4",
++			 <&maxfrag>,"target:0=",<&spi1>,
++			 <&max>,"reg:0=2";
++		spi2-0 = <0>, "+5",
++			 <&maxfrag>,"target:0=",<&spi2>,
++			 <&max>,"reg:0=0";
++		spi2-1 = <0>, "+6",
++			 <&maxfrag>,"target:0=",<&spi2>,
++			 <&max>,"reg:0=1";
++		spi2-2 = <0>, "+7",
++			 <&maxfrag>,"target:0=",<&spi2>,
++			 <&max>,"reg:0=2";
++		max6675 = <&max>,"compatible=maxim,max6675";
++		max31855 = <&max>,"compatible=maxim,max31855";
++		max31855e = <0>,"+9";
++		max31855j = <0>,"+10";
++		max31855k = <0>,"+11";
++		max31855n = <0>,"+12";
++		max31855r = <0>,"+13";
++		max31855s = <0>,"+14";
++		max31855t = <0>,"+15";
++		max31856  = <0>,"+16";
++		type_b    = <&max>,"thermocouple-type:0=",<THERMOCOUPLE_TYPE_B>;
++		type_e    = <&max>,"thermocouple-type:0=",<THERMOCOUPLE_TYPE_E>;
++		type_j    = <&max>,"thermocouple-type:0=",<THERMOCOUPLE_TYPE_J>;
++		type_k    = <&max>,"thermocouple-type:0=",<THERMOCOUPLE_TYPE_K>;
++		type_n    = <&max>,"thermocouple-type:0=",<THERMOCOUPLE_TYPE_N>;
++		type_r    = <&max>,"thermocouple-type:0=",<THERMOCOUPLE_TYPE_R>;
++		type_s    = <&max>,"thermocouple-type:0=",<THERMOCOUPLE_TYPE_S>;
++		type_t    = <&max>,"thermocouple-type:0=",<THERMOCOUPLE_TYPE_T>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/mbed-dac-overlay.dts b/arch/arm/boot/dts/overlays/mbed-dac-overlay.dts
+new file mode 100644
+index 000000000000..840dd9b31db4
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mbed-dac-overlay.dts
+@@ -0,0 +1,64 @@
++// Definitions for mbed DAC
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++                        #size-cells = <0>;
++			status = "okay";
++
++			tlv320aic23: codec@1a {
++				#sound-dai-cells = <0>;
++				reg = <0x1a>;
++				compatible = "ti,tlv320aic23";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "simple-audio-card";
++			i2s-controller = <&i2s>;
++			status = "okay";
++
++			simple-audio-card,name = "mbed-DAC";
++
++			simple-audio-card,widgets =
++				"Microphone", "Mic Jack",
++				"Line", "Line In",
++				"Headphone", "Headphone Jack";
++
++			simple-audio-card,routing =
++				"Headphone Jack", "LHPOUT",
++				"Headphone Jack", "RHPOUT",
++				"LLINEIN", "Line In",
++				"RLINEIN", "Line In",
++				"MICIN", "Mic Jack";
++
++			simple-audio-card,format = "i2s";
++
++			simple-audio-card,cpu {
++				sound-dai = <&i2s>;
++			};
++
++			sound_master: simple-audio-card,codec {
++				sound-dai = <&tlv320aic23>;
++				system-clock-frequency = <12288000>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/mcp23017-overlay.dts b/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
+new file mode 100644
+index 000000000000..c546d8ba7e6d
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
+@@ -0,0 +1,69 @@
++// Definitions for MCP23017 Gpio Extender from Microchip Semiconductor
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c1>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp23017_pins: mcp23017_pins@20 {
++				brcm,pins = <4>;
++				brcm,function = <0>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp23017: mcp@20 {
++				compatible = "microchip,mcp23017";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&mcp23017>;
++		__dormant__ {
++			compatible = "microchip,mcp23008";
++		};
++	};
++
++	fragment@4 {
++		target = <&mcp23017>;
++		mcp23017_irq: __overlay__ {
++			#interrupt-cells=<2>;
++			interrupt-parent = <&gpio>;
++			interrupts = <4 2>;
++			interrupt-controller;
++			microchip,irq-mirror;
++		};
++	};
++
++	__overrides__ {
++		gpiopin = <&mcp23017_pins>,"brcm,pins:0",
++				<&mcp23017_irq>,"interrupts:0";
++		addr = <&mcp23017>,"reg:0", <&mcp23017_pins>,"reg:0";
++		mcp23008 = <0>,"=3";
++		noints = <0>,"!1!4";
++	};
++};
++
+diff --git a/arch/arm/boot/dts/overlays/mcp23s17-overlay.dts b/arch/arm/boot/dts/overlays/mcp23s17-overlay.dts
+new file mode 100644
+index 000000000000..484d64b225fb
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mcp23s17-overlay.dts
+@@ -0,0 +1,732 @@
++// Overlay for MCP23S08/17 GPIO Extenders from Microchip Semiconductor
++
++// dtparams:
++//     s08-spi<n>-<m>-present  - 4-bit integer, bitmap indicating MCP23S08 devices present on SPI<n>, CS#<m>.
++//     s17-spi<n>-<m>-present  - 8-bit integer, bitmap indicating MCP23S17 devices present on SPI<n>, CS#<m>.
++//     s08-spi<n>-<m>-int-gpio - integer, enables interrupts on a single MCP23S08 device on SPI<n>, CS#<m>, specifies the GPIO pin to which INT output is connected.
++//     s17-spi<n>-<m>-int-gpio - integer, enables mirrored interrupts on a single MCP23S17 device on SPI<n>, CS#<m>, specifies the GPIO pin to which either INTA or INTB output is connected.
++//
++// If devices are present on SPI1 or SPI2, those interfaces must be enabled with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++// If interrupts are enabled for a device on a given CS# on a SPI bus, that device must be the only one present on that SPI bus/CS#.
++//
++// Example 1: A single MCP23S17 device on SPI0, CS#0 with its SPI addr set to 0 and INTA output connected to GPIO25:
++// dtoverlay=mcp23s17:s17-spi0-0-present=1,s17-spi0-0-int-gpio=25
++//
++// Example 2: Two MCP23S08 devices on SPI1, CS#0 with their addrs set to 2 and 3. Three MCP23S17 devices on SPI1, CS#1 with their addrs set to 0, 1 and 7:
++// dtoverlay=spi1-2cs
++// dtoverlay=mcp23s17:s08-spi1-0-present=12,s17-spi1-1-present=131
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	// disable spi-dev on spi0.0
++	fragment@0 {
++		target = <&spidev0>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi0.1
++	fragment@1 {
++		target = <&spidev1>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi1.0
++	fragment@2 {
++		target-path = "spi1/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi1.1
++	fragment@3 {
++		target-path = "spi1/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi1.2
++	fragment@4 {
++		target-path = "spi1/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi2.0
++	fragment@5 {
++		target-path = "spi2/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi2.1
++	fragment@6 {
++		target-path = "spi2/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi2.2
++	fragment@7 {
++		target-path = "spi2/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// enable one or more mcp23s08s on spi0.0
++	fragment@8 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s08_00: mcp23s08@0 {
++				compatible = "microchip,mcp23s08";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi0-0-present parameter */
++     				reg = <0>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi0-0-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s08s on spi0.1
++	fragment@9 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s08_01: mcp23s08@1 {
++				compatible = "microchip,mcp23s08";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi0-1-present parameter */
++     				reg = <1>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi0-1-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s08s on spi1.0
++	fragment@10 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s08_10: mcp23s08@0 {
++				compatible = "microchip,mcp23s08";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi1-0-present parameter */
++     				reg = <0>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi1-0-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s08s on spi1.1
++	fragment@11 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s08_11: mcp23s08@1 {
++				compatible = "microchip,mcp23s08";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi1-1-present parameter */
++     				reg = <1>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi1-1-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s08s on spi1.2
++	fragment@12 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s08_12: mcp23s08@2 {
++				compatible = "microchip,mcp23s08";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi1-2-present parameter */
++     				reg = <2>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi1-2-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s08s on spi2.0
++	fragment@13 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s08_20: mcp23s08@0 {
++				compatible = "microchip,mcp23s08";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi2-0-present parameter */
++     				reg = <0>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi2-0-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s08s on spi2.1
++	fragment@14 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s08_21: mcp23s08@1 {
++				compatible = "microchip,mcp23s08";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi2-1-present parameter */
++     				reg = <1>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi2-1-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s08s on spi2.2
++	fragment@15 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s08_22: mcp23s08@2 {
++				compatible = "microchip,mcp23s08";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi2-2-present parameter */
++     				reg = <2>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi2-2-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s17s on spi0.0
++	fragment@16 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s17_00: mcp23s17@0 {
++				compatible = "microchip,mcp23s17";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi0-0-present parameter */
++     				reg = <0>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi0-0-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s17s on spi0.1
++	fragment@17 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s17_01: mcp23s17@1 {
++				compatible = "microchip,mcp23s17";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi0-1-present parameter */
++     				reg = <1>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi0-1-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s17s on spi1.0
++	fragment@18 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s17_10: mcp23s17@0 {
++				compatible = "microchip,mcp23s17";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi1-0-present parameter */
++     				reg = <0>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi1-0-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s17s on spi1.1
++	fragment@19 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s17_11: mcp23s17@1 {
++				compatible = "microchip,mcp23s17";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi1-1-present parameter */
++     				reg = <1>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi1-1-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s17s on spi1.2
++	fragment@20 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s17_12: mcp23s17@2 {
++				compatible = "microchip,mcp23s17";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi1-2-present parameter */
++     				reg = <2>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi1-2-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s17s on spi2.0
++	fragment@21 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s17_20: mcp23s17@0 {
++				compatible = "microchip,mcp23s17";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi2-0-present parameter */
++     				reg = <0>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi2-0-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s17s on spi2.1
++	fragment@22 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s17_21: mcp23s17@1 {
++				compatible = "microchip,mcp23s17";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi2-1-present parameter */
++     				reg = <1>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi2-1-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s17s on spi2.2
++	fragment@23 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s17_22: mcp23s17@2 {
++				compatible = "microchip,mcp23s17";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi2-2-present parameter */
++     				reg = <2>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi2-2-int-gpio parameter */
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi0.0 as a input with no pull-up/down
++	fragment@24 {
++		target = <&gpio>;
++		__dormant__ {
++			spi0_0_int_pins: spi0_0_int_pins {
++				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi0-0-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi0.1 as a input with no pull-up/down
++	fragment@25 {
++		target = <&gpio>;
++		__dormant__ {
++			spi0_1_int_pins: spi0_1_int_pins {
++				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi0-1-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi1.0 as a input with no pull-up/down
++	fragment@26 {
++		target = <&gpio>;
++		__dormant__ {
++			spi1_0_int_pins: spi1_0_int_pins {
++				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi1-0-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi1.1 as a input with no pull-up/down
++	fragment@27 {
++		target = <&gpio>;
++		__dormant__ {
++			spi1_1_int_pins: spi1_1_int_pins {
++				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi1-1-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi1.2 as a input with no pull-up/down
++	fragment@28 {
++		target = <&gpio>;
++		__dormant__ {
++			spi1_2_int_pins: spi1_2_int_pins {
++				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi1-2-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi2.0 as a input with no pull-up/down
++	fragment@29 {
++		target = <&gpio>;
++		__dormant__ {
++			spi2_0_int_pins: spi2_0_int_pins {
++				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi2-0-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi2.1 as a input with no pull-up/down
++	fragment@30 {
++		target = <&gpio>;
++		__dormant__ {
++			spi2_1_int_pins: spi2_1_int_pins {
++				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi2-1-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi2.2 as a input with no pull-up/down
++	fragment@31 {
++		target = <&gpio>;
++		__dormant__ {
++			spi2_2_int_pins: spi2_2_int_pins {
++				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi2-2-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Enable interrupts for a mcp23s08 on spi0.0.
++	// Use default active low interrupt signalling.
++	fragment@32 {
++		target = <&mcp23s08_00>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++		};
++	};
++
++	// Enable interrupts for a mcp23s08 on spi0.1.
++	// Use default active low interrupt signalling.
++	fragment@33 {
++		target = <&mcp23s08_01>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++		};
++	};
++
++	// Enable interrupts for a mcp23s08 on spi1.0.
++	// Use default active low interrupt signalling.
++	fragment@34 {
++		target = <&mcp23s08_10>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++		};
++	};
++
++	// Enable interrupts for a mcp23s08 on spi1.1.
++	// Use default active low interrupt signalling.
++	fragment@35 {
++		target = <&mcp23s08_11>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++		};
++	};
++
++	// Enable interrupts for a mcp23s08 on spi1.2.
++	// Use default active low interrupt signalling.
++	fragment@36 {
++		target = <&mcp23s08_12>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++		};
++	};
++
++	// Enable interrupts for a mcp23s08 on spi2.0.
++	// Use default active low interrupt signalling.
++	fragment@37 {
++		target = <&mcp23s08_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++		};
++	};
++
++	// Enable interrupts for a mcp23s08 on spi2.1.
++	// Use default active low interrupt signalling.
++	fragment@38 {
++		target = <&mcp23s08_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++		};
++	};
++
++	// Enable interrupts for a mcp23s08 on spi2.2.
++	// Use default active low interrupt signalling.
++	fragment@39 {
++		target = <&mcp23s08_22>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++		};
++	};
++
++	// Enable interrupts for a mcp23s17 on spi0.0.
++	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
++	// Use default active low interrupt signalling.
++	fragment@40 {
++		target = <&mcp23s17_00>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			microchip,irq-mirror;
++		};
++	};
++
++	// Enable interrupts for a mcp23s17 on spi0.1.
++	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
++	// Configure INTA/B outputs of mcp23s08/17 as active low.
++	fragment@41 {
++		target = <&mcp23s17_01>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			microchip,irq-mirror;
++		};
++	};
++
++	// Enable interrupts for a mcp23s17 on spi1.0.
++	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
++	// Configure INTA/B outputs of mcp23s08/17 as active low.
++	fragment@42 {
++		target = <&mcp23s17_10>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			microchip,irq-mirror;
++		};
++	};
++
++	// Enable interrupts for a mcp23s17 on spi1.1.
++	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
++	// Configure INTA/B outputs of mcp23s08/17 as active low.
++	fragment@43 {
++		target = <&mcp23s17_11>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			microchip,irq-mirror;
++		};
++	};
++
++	// Enable interrupts for a mcp23s17 on spi1.2.
++	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
++	// Configure INTA/B outputs of mcp23s08/17 as active low.
++	fragment@44 {
++		target = <&mcp23s17_12>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			microchip,irq-mirror;
++		};
++	};
++
++	// Enable interrupts for a mcp23s17 on spi2.0.
++	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
++	// Configure INTA/B outputs of mcp23s08/17 as active low.
++	fragment@45 {
++		target = <&mcp23s17_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			microchip,irq-mirror;
++		};
++	};
++
++	// Enable interrupts for a mcp23s17 on spi2.1.
++	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
++	// Configure INTA/B outputs of mcp23s08/17 as active low.
++	fragment@46 {
++		target = <&mcp23s17_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			microchip,irq-mirror;
++		};
++	};
++
++	// Enable interrupts for a mcp23s17 on spi2.2.
++	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
++	// Configure INTA/B outputs of mcp23s08/17 as active low.
++	fragment@47 {
++		target = <&mcp23s17_22>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			microchip,irq-mirror;
++		};
++	};
++
++	__overrides__ {
++		s08-spi0-0-present = <0>,"+0+8",  <&mcp23s08_00>,"microchip,spi-present-mask:0";
++		s08-spi0-1-present = <0>,"+1+9",  <&mcp23s08_01>,"microchip,spi-present-mask:0";
++		s08-spi1-0-present = <0>,"+2+10", <&mcp23s08_10>,"microchip,spi-present-mask:0";
++		s08-spi1-1-present = <0>,"+3+11", <&mcp23s08_11>,"microchip,spi-present-mask:0";
++		s08-spi1-2-present = <0>,"+4+12", <&mcp23s08_12>,"microchip,spi-present-mask:0";
++		s08-spi2-0-present = <0>,"+5+13", <&mcp23s08_20>,"microchip,spi-present-mask:0";
++		s08-spi2-1-present = <0>,"+6+14", <&mcp23s08_21>,"microchip,spi-present-mask:0";
++		s08-spi2-2-present = <0>,"+7+15", <&mcp23s08_22>,"microchip,spi-present-mask:0";
++		s17-spi0-0-present = <0>,"+0+16", <&mcp23s17_00>,"microchip,spi-present-mask:0";
++		s17-spi0-1-present = <0>,"+1+17", <&mcp23s17_01>,"microchip,spi-present-mask:0";
++		s17-spi1-0-present = <0>,"+2+18", <&mcp23s17_10>,"microchip,spi-present-mask:0";
++		s17-spi1-1-present = <0>,"+3+19", <&mcp23s17_11>,"microchip,spi-present-mask:0";
++		s17-spi1-2-present = <0>,"+4+20", <&mcp23s17_12>,"microchip,spi-present-mask:0";
++		s17-spi2-0-present = <0>,"+5+21", <&mcp23s17_20>,"microchip,spi-present-mask:0";
++		s17-spi2-1-present = <0>,"+6+22", <&mcp23s17_21>,"microchip,spi-present-mask:0";
++		s17-spi2-2-present = <0>,"+7+23", <&mcp23s17_22>,"microchip,spi-present-mask:0";
++		s08-spi0-0-int-gpio = <0>,"+24+32", <&spi0_0_int_pins>,"brcm,pins:0", <&mcp23s08_00>,"interrupts:0";
++		s08-spi0-1-int-gpio = <0>,"+25+33", <&spi0_1_int_pins>,"brcm,pins:0", <&mcp23s08_01>,"interrupts:0";
++		s08-spi1-0-int-gpio = <0>,"+26+34", <&spi1_0_int_pins>,"brcm,pins:0", <&mcp23s08_10>,"interrupts:0";
++		s08-spi1-1-int-gpio = <0>,"+27+35", <&spi1_1_int_pins>,"brcm,pins:0", <&mcp23s08_11>,"interrupts:0";
++		s08-spi1-2-int-gpio = <0>,"+28+36", <&spi1_2_int_pins>,"brcm,pins:0", <&mcp23s08_12>,"interrupts:0";
++		s08-spi2-0-int-gpio = <0>,"+29+37", <&spi2_0_int_pins>,"brcm,pins:0", <&mcp23s08_20>,"interrupts:0";
++		s08-spi2-1-int-gpio = <0>,"+30+38", <&spi2_1_int_pins>,"brcm,pins:0", <&mcp23s08_21>,"interrupts:0";
++		s08-spi2-2-int-gpio = <0>,"+31+39", <&spi2_2_int_pins>,"brcm,pins:0", <&mcp23s08_22>,"interrupts:0";
++		s17-spi0-0-int-gpio = <0>,"+24+40", <&spi0_0_int_pins>,"brcm,pins:0", <&mcp23s17_00>,"interrupts:0";
++		s17-spi0-1-int-gpio = <0>,"+25+41", <&spi0_1_int_pins>,"brcm,pins:0", <&mcp23s17_01>,"interrupts:0";
++		s17-spi1-0-int-gpio = <0>,"+26+42", <&spi1_0_int_pins>,"brcm,pins:0", <&mcp23s17_10>,"interrupts:0";
++		s17-spi1-1-int-gpio = <0>,"+27+43", <&spi1_1_int_pins>,"brcm,pins:0", <&mcp23s17_11>,"interrupts:0";
++		s17-spi1-2-int-gpio = <0>,"+28+44", <&spi1_2_int_pins>,"brcm,pins:0", <&mcp23s17_12>,"interrupts:0";
++		s17-spi2-0-int-gpio = <0>,"+29+45", <&spi2_0_int_pins>,"brcm,pins:0", <&mcp23s17_20>,"interrupts:0";
++		s17-spi2-1-int-gpio = <0>,"+30+46", <&spi2_1_int_pins>,"brcm,pins:0", <&mcp23s17_21>,"interrupts:0";
++		s17-spi2-2-int-gpio = <0>,"+31+47", <&spi2_2_int_pins>,"brcm,pins:0", <&mcp23s17_22>,"interrupts:0";
++	};
++};
++
+diff --git a/arch/arm/boot/dts/overlays/mcp2515-can0-overlay.dts b/arch/arm/boot/dts/overlays/mcp2515-can0-overlay.dts
+new file mode 100755
+index 000000000000..46f143d809cc
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mcp2515-can0-overlay.dts
+@@ -0,0 +1,73 @@
++/*
++ * Device tree overlay for mcp251x/can0 on spi0.0
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++    /* disable spi-dev for spi0.0 */
++    fragment@0 {
++        target = <&spi0>;
++        __overlay__ {
++            status = "okay";
++        };
++    };
++
++    fragment@1 {
++	target = <&spidev0>;
++	__overlay__ {
++	    status = "disabled";
++	};
++    };
++
++    /* the interrupt pin of the can-controller */
++    fragment@2 {
++        target = <&gpio>;
++        __overlay__ {
++            can0_pins: can0_pins {
++                brcm,pins = <25>;
++                brcm,function = <0>; /* input */
++            };
++        };
++    };
++
++    /* the clock/oscillator of the can-controller */
++    fragment@3 {
++        target-path = "/";
++        __overlay__ {
++            /* external oscillator of mcp2515 on SPI0.0 */
++            can0_osc: can0_osc {
++                compatible = "fixed-clock";
++                #clock-cells = <0>;
++                clock-frequency  = <16000000>;
++            };
++        };
++    };
++
++    /* the spi config of the can-controller itself binding everything together */
++    fragment@4 {
++        target = <&spi0>;
++        __overlay__ {
++            /* needed to avoid dtc warning */
++            #address-cells = <1>;
++            #size-cells = <0>;
++            can0: mcp2515@0 {
++                reg = <0>;
++                compatible = "microchip,mcp2515";
++                pinctrl-names = "default";
++                pinctrl-0 = <&can0_pins>;
++                spi-max-frequency = <10000000>;
++                interrupt-parent = <&gpio>;
++                interrupts = <25 8>; /* IRQ_TYPE_LEVEL_LOW */
++                clocks = <&can0_osc>;
++            };
++        };
++    };
++    __overrides__ {
++        oscillator = <&can0_osc>,"clock-frequency:0";
++        spimaxfrequency = <&can0>,"spi-max-frequency:0";
++        interrupt = <&can0_pins>,"brcm,pins:0",<&can0>,"interrupts:0";
++    };
++};
+diff --git a/arch/arm/boot/dts/overlays/mcp2515-can1-overlay.dts b/arch/arm/boot/dts/overlays/mcp2515-can1-overlay.dts
+new file mode 100644
+index 000000000000..0a8dd576818e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mcp2515-can1-overlay.dts
+@@ -0,0 +1,73 @@
++/*
++ * Device tree overlay for mcp251x/can1 on spi0.1 edited by petit_miner
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++    /* disable spi-dev for spi0.1 */
++    fragment@0 {
++        target = <&spi0>;
++        __overlay__ {
++            status = "okay";
++        };
++    };
++
++    fragment@1 {
++	target = <&spidev1>;
++	__overlay__ {
++	    status = "disabled";
++	};
++    };
++
++    /* the interrupt pin of the can-controller */
++    fragment@2 {
++        target = <&gpio>;
++        __overlay__ {
++            can1_pins: can1_pins {
++                brcm,pins = <25>;
++                brcm,function = <0>; /* input */
++            };
++        };
++    };
++
++    /* the clock/oscillator of the can-controller */
++    fragment@3 {
++        target-path = "/";
++        __overlay__ {
++            /* external oscillator of mcp2515 on spi0.1 */
++            can1_osc: can1_osc {
++                compatible = "fixed-clock";
++                #clock-cells = <0>;
++                clock-frequency  = <16000000>;
++            };
++        };
++    };
++
++    /* the spi config of the can-controller itself binding everything together */
++    fragment@4 {
++        target = <&spi0>;
++        __overlay__ {
++            /* needed to avoid dtc warning */
++            #address-cells = <1>;
++            #size-cells = <0>;
++            can1: mcp2515@1 {
++                reg = <1>;
++                compatible = "microchip,mcp2515";
++                pinctrl-names = "default";
++                pinctrl-0 = <&can1_pins>;
++                spi-max-frequency = <10000000>;
++                interrupt-parent = <&gpio>;
++                interrupts = <25 8>; /* IRQ_TYPE_LEVEL_LOW */
++                clocks = <&can1_osc>;
++            };
++        };
++    };
++    __overrides__ {
++        oscillator = <&can1_osc>,"clock-frequency:0";
++        spimaxfrequency = <&can1>,"spi-max-frequency:0";
++        interrupt = <&can1_pins>,"brcm,pins:0",<&can1>,"interrupts:0";
++    };
++};
+diff --git a/arch/arm/boot/dts/overlays/mcp2515-overlay.dts b/arch/arm/boot/dts/overlays/mcp2515-overlay.dts
+new file mode 100644
+index 000000000000..cda1fb0b1199
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mcp2515-overlay.dts
+@@ -0,0 +1,156 @@
++// SPDX-License-Identifier: (GPL-2.0 OR MIT)
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev1>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target-path = "spi1/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target-path = "spi1/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@4 {
++		target-path = "spi1/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@5 {
++		target-path = "spi2/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@6 {
++		target-path = "spi2/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@7 {
++		target-path = "spi2/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@8 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp2515_pins: mcp2515_pins {
++				brcm,pins = <25>;
++				brcm,function = <BCM2835_FSEL_GPIO_IN>;
++			};
++		};
++	};
++
++	fragment@9 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_mcp2515_osc: mcp2515-osc {
++				#clock-cells = <0>;
++				compatible = "fixed-clock";
++				clock-frequency = <16000000>;
++			};
++		};
++	};
++
++	mcp2515_frag: fragment@10 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp2515: mcp2515@0 {
++				compatible = "microchip,mcp2515";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp2515_pins>;
++				spi-max-frequency = <10000000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <25 IRQ_TYPE_LEVEL_LOW>;
++				clocks = <&clk_mcp2515_osc>;
++			};
++		};
++	};
++
++	__overrides__ {
++		spi0-0 = <0>, "+0",
++			<&mcp2515_frag>, "target:0=", <&spi0>,
++			<&mcp2515>, "reg:0=0",
++			<&mcp2515_pins>, "name=mcp2515_spi0_0_pins",
++			<&clk_mcp2515_osc>, "name=mcp2515-spi0-0-osc";
++		spi0-1 = <0>, "+1",
++			<&mcp2515_frag>, "target:0=", <&spi0>,
++			<&mcp2515>, "reg:0=1",
++			<&mcp2515_pins>, "name=mcp2515_spi0_1_pins",
++			<&clk_mcp2515_osc>, "name=mcp2515-spi0-1-osc";
++		spi1-0 = <0>, "+2",
++			<&mcp2515_frag>, "target:0=", <&spi1>,
++			<&mcp2515>, "reg:0=0",
++			<&mcp2515_pins>, "name=mcp2515_spi1_0_pins",
++			<&clk_mcp2515_osc>, "name=mcp2515-spi1-0-osc";
++		spi1-1 = <0>, "+3",
++			<&mcp2515_frag>, "target:0=", <&spi1>,
++			<&mcp2515>, "reg:0=1",
++			<&mcp2515_pins>, "name=mcp2515_spi1_1_pins",
++			<&clk_mcp2515_osc>, "name=mcp2515-spi1-1-osc";
++		spi1-2 = <0>, "+4",
++			<&mcp2515_frag>, "target:0=", <&spi1>,
++			<&mcp2515>, "reg:0=2",
++			<&mcp2515_pins>, "name=mcp2515_spi1_2_pins",
++			<&clk_mcp2515_osc>, "name=mcp2515-spi1-2-osc";
++		spi2-0 = <0>, "+5",
++			<&mcp2515_frag>, "target:0=", <&spi2>,
++			<&mcp2515>, "reg:0=0",
++			<&mcp2515_pins>, "name=mcp2515_spi2_0_pins",
++			<&clk_mcp2515_osc>, "name=mcp2515-spi2-0-osc";
++		spi2-1 = <0>, "+6",
++			<&mcp2515_frag>, "target:0=", <&spi2>,
++			<&mcp2515>, "reg:0=1",
++			<&mcp2515_pins>, "name=mcp2515_spi2_1_pins",
++			<&clk_mcp2515_osc>, "name=mcp2515-spi2-1-osc";
++		spi2-2 = <0>, "+7",
++			<&mcp2515_frag>, "target:0=", <&spi2>,
++			<&mcp2515>, "reg:0=2",
++			<&mcp2515_pins>, "name=mcp2515_spi2_2_pins",
++			<&clk_mcp2515_osc>, "name=mcp2515-spi2-2-osc";
++		oscillator = <&clk_mcp2515_osc>, "clock-frequency:0";
++		speed = <&mcp2515>, "spi-max-frequency:0";
++		interrupt = <&mcp2515_pins>, "brcm,pins:0",
++			<&mcp2515>, "interrupts:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/mcp251xfd-overlay.dts b/arch/arm/boot/dts/overlays/mcp251xfd-overlay.dts
+new file mode 100644
+index 000000000000..65c861bbd340
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mcp251xfd-overlay.dts
+@@ -0,0 +1,226 @@
++// SPDX-License-Identifier: (GPL-2.0 OR MIT)
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev1>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target-path = "spi1/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target-path = "spi1/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@4 {
++		target-path = "spi1/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@5 {
++		target-path = "spi2/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@6 {
++		target-path = "spi2/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@7 {
++		target-path = "spi2/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@8 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp251xfd_pins: mcp251xfd_pins {
++				brcm,pins = <25>;
++				brcm,function = <BCM2835_FSEL_GPIO_IN>;
++			};
++		};
++	};
++
++	fragment@9 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_mcp251xfd_osc: mcp251xfd-osc {
++				#clock-cells = <0>;
++				compatible = "fixed-clock";
++				clock-frequency = <40000000>;
++			};
++		};
++	};
++
++	mcp251xfd_frag: fragment@10 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp251xfd: mcp251xfd@0 {
++				compatible = "microchip,mcp251xfd";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp251xfd_pins>;
++				spi-max-frequency = <20000000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <25 IRQ_TYPE_LEVEL_LOW>;
++				clocks = <&clk_mcp251xfd_osc>;
++			};
++		};
++	};
++
++	fragment@11 {
++		target = <&mcp251xfd>;
++		mcp251xfd_rx_int_gpios: __dormant__ {
++			microchip,rx-int-gpios = <&gpio 255 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	fragment@12 {
++		target = <&gpio>;
++		__dormant__ {
++			mcp251xfd_xceiver_pins: mcp251xfd_xceiver_pins {
++				brcm,pins = <255>;
++				brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++			};
++		};
++	};
++
++	fragment@13 {
++		target-path = "/";
++		__dormant__ {
++			reg_mcp251xfd_xceiver: reg_mcp251xfd_xceiver {
++				compatible = "regulator-fixed";
++				regulator-name = "mcp251xfd_xceiver";
++				regulator-min-microvolt = <3300000>;
++				regulator-max-microvolt = <3300000>;
++				gpio = <&gpio 4 GPIO_ACTIVE_HIGH>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp251xfd_xceiver_pins>;
++			};
++		};
++	};
++
++	fragment@14 {
++		target = <&mcp251xfd>;
++		__dormant__ {
++			xceiver-supply = <&reg_mcp251xfd_xceiver>;
++		};
++	};
++
++	__overrides__ {
++		spi0-0 = <0>, "+0",
++			<&mcp251xfd_frag>, "target:0=", <&spi0>,
++			<&mcp251xfd>, "reg:0=0",
++			<&mcp251xfd_pins>, "name=mcp251xfd_spi0_0_pins",
++			<&clk_mcp251xfd_osc>, "name=mcp251xfd-spi0-0-osc",
++			<&mcp251xfd_xceiver_pins>, "name=mcp251xfd_spi0_0_xceiver_pins",
++			<&reg_mcp251xfd_xceiver>, "name=reg-mcp251xfd-spi0-0-xceiver",
++			<&reg_mcp251xfd_xceiver>, "regulator-name=mcp251xfd-spi0-0-xceiver";
++		spi0-1 = <0>, "+1",
++			<&mcp251xfd_frag>, "target:0=", <&spi0>,
++			<&mcp251xfd>, "reg:0=1",
++			<&mcp251xfd_pins>, "name=mcp251xfd_spi0_1_pins",
++			<&clk_mcp251xfd_osc>, "name=mcp251xfd-spi0-1-osc",
++			<&mcp251xfd_xceiver_pins>, "name=mcp251xfd_spi0_1_xceiver_pins",
++			<&reg_mcp251xfd_xceiver>, "name=reg-mcp251xfd-spi0-1-xceiver",
++			<&reg_mcp251xfd_xceiver>, "regulator-name=mcp251xfd-spi0-1-xceiver";
++		spi1-0 = <0>, "+2",
++			<&mcp251xfd_frag>, "target:0=", <&spi1>,
++			<&mcp251xfd>, "reg:0=0",
++			<&mcp251xfd_pins>, "name=mcp251xfd_spi1_0_pins",
++			<&clk_mcp251xfd_osc>, "name=mcp251xfd-spi1-0-osc",
++			<&mcp251xfd_xceiver_pins>, "name=mcp251xfd_spi1_0_xceiver_pins",
++			<&reg_mcp251xfd_xceiver>, "name=reg-mcp251xfd-spi1-0-xceiver",
++			<&reg_mcp251xfd_xceiver>, "regulator-name=mcp251xfd-spi1-0-xceiver";
++		spi1-1 = <0>, "+3",
++			<&mcp251xfd_frag>, "target:0=", <&spi1>,
++			<&mcp251xfd>, "reg:0=1",
++			<&mcp251xfd_pins>, "name=mcp251xfd_spi1_1_pins",
++			<&clk_mcp251xfd_osc>, "name=mcp251xfd-spi1-1-osc",
++			<&mcp251xfd_xceiver_pins>, "name=mcp251xfd_spi1_1_xceiver_pins",
++			<&reg_mcp251xfd_xceiver>, "name=reg-mcp251xfd-spi1-1-xceiver",
++			<&reg_mcp251xfd_xceiver>, "regulator-name=mcp251xfd-spi1-1-xceiver";
++		spi1-2 = <0>, "+4",
++			<&mcp251xfd_frag>, "target:0=", <&spi1>,
++			<&mcp251xfd>, "reg:0=2",
++			<&mcp251xfd_pins>, "name=mcp251xfd_spi1_2_pins",
++			<&clk_mcp251xfd_osc>, "name=mcp251xfd-spi1-2-osc",
++			<&mcp251xfd_xceiver_pins>, "name=mcp251xfd_spi1_2_xceiver_pins",
++			<&reg_mcp251xfd_xceiver>, "name=reg-mcp251xfd-spi1-2-xceiver",
++			<&reg_mcp251xfd_xceiver>, "regulator-name=mcp251xfd-spi1-2-xceiver";
++		spi2-0 = <0>, "+5",
++			<&mcp251xfd_frag>, "target:0=", <&spi2>,
++			<&mcp251xfd>, "reg:0=0",
++			<&mcp251xfd_pins>, "name=mcp251xfd_spi2_0_pins",
++			<&clk_mcp251xfd_osc>, "name=mcp251xfd-spi2-0-osc",
++			<&mcp251xfd_xceiver_pins>, "name=mcp251xfd_spi2_0_xceiver_pins",
++			<&reg_mcp251xfd_xceiver>, "name=reg-mcp251xfd-spi2-0-xceiver",
++			<&reg_mcp251xfd_xceiver>, "regulator-name=mcp251xfd-spi2-0-xceiver";
++		spi2-1 = <0>, "+6",
++			<&mcp251xfd_frag>, "target:0=", <&spi2>,
++			<&mcp251xfd>, "reg:0=1",
++			<&mcp251xfd_pins>, "name=mcp251xfd_spi2_1_pins",
++			<&clk_mcp251xfd_osc>, "name=mcp251xfd-spi2-1-osc",
++			<&mcp251xfd_xceiver_pins>, "name=mcp251xfd_spi2_1_xceiver_pins",
++			<&reg_mcp251xfd_xceiver>, "name=reg-mcp251xfd-spi2-1-xceiver",
++			<&reg_mcp251xfd_xceiver>, "regulator-name=mcp251xfd-spi2-1-xceiver";
++		spi2-2 = <0>, "+7",
++			<&mcp251xfd_frag>, "target:0=", <&spi2>,
++			<&mcp251xfd>, "reg:0=2",
++			<&mcp251xfd_pins>, "name=mcp251xfd_spi2_2_pins",
++			<&clk_mcp251xfd_osc>, "name=mcp251xfd-spi2-2-osc",
++			<&mcp251xfd_xceiver_pins>, "name=mcp251xfd_spi2_2_xceiver_pins",
++			<&reg_mcp251xfd_xceiver>, "name=reg-mcp251xfd-spi2-2-xceiver",
++			<&reg_mcp251xfd_xceiver>, "regulator-name=mcp251xfd-spi2-2-xceiver";
++		oscillator = <&clk_mcp251xfd_osc>, "clock-frequency:0";
++		speed = <&mcp251xfd>, "spi-max-frequency:0";
++		interrupt = <&mcp251xfd_pins>, "brcm,pins:0",
++			<&mcp251xfd>, "interrupts:0";
++		rx_interrupt = <0>, "+11",
++			<&mcp251xfd_pins>, "brcm,pins:4",
++			<&mcp251xfd_rx_int_gpios>, "microchip,rx-int-gpios:4";
++		xceiver_enable = <0>, "+12+13+14",
++			<&mcp251xfd_xceiver_pins>, "brcm,pins:0",
++			<&reg_mcp251xfd_xceiver>, "gpio:4";
++		xceiver_active_high = <&reg_mcp251xfd_xceiver>, "enable-active-high?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/mcp3008-overlay.dts b/arch/arm/boot/dts/overlays/mcp3008-overlay.dts
+new file mode 100755
+index 000000000000..957fdb9310af
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mcp3008-overlay.dts
+@@ -0,0 +1,205 @@
++/*
++ * Device tree overlay for Microchip mcp3008 10-Bit A/D Converters
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev1>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target-path = "spi1/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target-path = "spi1/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@4 {
++		target-path = "spi1/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@5 {
++		target-path = "spi2/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@6 {
++		target-path = "spi2/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@7 {
++		target-path = "spi2/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@8 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3008_00: mcp3008@0 {
++				compatible = "microchip,mcp3008";
++				reg = <0>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@9 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3008_01: mcp3008@1 {
++				compatible = "microchip,mcp3008";
++				reg = <1>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@10 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3008_10: mcp3008@0 {
++				compatible = "microchip,mcp3008";
++				reg = <0>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@11 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3008_11: mcp3008@1 {
++				compatible = "microchip,mcp3008";
++				reg = <1>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@12 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3008_12: mcp3008@2 {
++				compatible = "microchip,mcp3008";
++				reg = <2>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@13 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3008_20: mcp3008@0 {
++				compatible = "microchip,mcp3008";
++				reg = <0>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@14 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3008_21: mcp3008@1 {
++				compatible = "microchip,mcp3008";
++				reg = <1>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@15 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3008_22: mcp3008@2 {
++				compatible = "microchip,mcp3008";
++				reg = <2>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	__overrides__ {
++		spi0-0-present = <0>, "+0+8";
++		spi0-1-present = <0>, "+1+9";
++		spi1-0-present = <0>, "+2+10";
++		spi1-1-present = <0>, "+3+11";
++		spi1-2-present = <0>, "+4+12";
++		spi2-0-present = <0>, "+5+13";
++		spi2-1-present = <0>, "+6+14";
++		spi2-2-present = <0>, "+7+15";
++		spi0-0-speed = <&mcp3008_00>, "spi-max-frequency:0";
++		spi0-1-speed = <&mcp3008_01>, "spi-max-frequency:0";
++		spi1-0-speed = <&mcp3008_10>, "spi-max-frequency:0";
++		spi1-1-speed = <&mcp3008_11>, "spi-max-frequency:0";
++		spi1-2-speed = <&mcp3008_12>, "spi-max-frequency:0";
++		spi2-0-speed = <&mcp3008_20>, "spi-max-frequency:0";
++		spi2-1-speed = <&mcp3008_21>, "spi-max-frequency:0";
++		spi2-2-speed = <&mcp3008_22>, "spi-max-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/mcp3202-overlay.dts b/arch/arm/boot/dts/overlays/mcp3202-overlay.dts
+new file mode 100755
+index 000000000000..8e4e9f60f285
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mcp3202-overlay.dts
+@@ -0,0 +1,205 @@
++/*
++ * Device tree overlay for Microchip mcp3202 12-Bit A/D Converters
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev1>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target-path = "spi1/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target-path = "spi1/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@4 {
++		target-path = "spi1/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@5 {
++		target-path = "spi2/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@6 {
++		target-path = "spi2/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@7 {
++		target-path = "spi2/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@8 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3202_00: mcp3202@0 {
++				compatible = "mcp3202";
++				reg = <0>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@9 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3202_01: mcp3202@1 {
++				compatible = "mcp3202";
++				reg = <1>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@10 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3202_10: mcp3202@0 {
++				compatible = "mcp3202";
++				reg = <0>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@11 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3202_11: mcp3202@1 {
++				compatible = "mcp3202";
++				reg = <1>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@12 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3202_12: mcp3202@2 {
++				compatible = "mcp3202";
++				reg = <2>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@13 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3202_20: mcp3202@0 {
++				compatible = "mcp3202";
++				reg = <0>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@14 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3202_21: mcp3202@1 {
++				compatible = "mcp3202";
++				reg = <1>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@15 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3202_22: mcp3202@2 {
++				compatible = "mcp3202";
++				reg = <2>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	__overrides__ {
++		spi0-0-present = <0>, "+0+8";
++		spi0-1-present = <0>, "+1+9";
++		spi1-0-present = <0>, "+2+10";
++		spi1-1-present = <0>, "+3+11";
++		spi1-2-present = <0>, "+4+12";
++		spi2-0-present = <0>, "+5+13";
++		spi2-1-present = <0>, "+6+14";
++		spi2-2-present = <0>, "+7+15";
++		spi0-0-speed = <&mcp3202_00>, "spi-max-frequency:0";
++		spi0-1-speed = <&mcp3202_01>, "spi-max-frequency:0";
++		spi1-0-speed = <&mcp3202_10>, "spi-max-frequency:0";
++		spi1-1-speed = <&mcp3202_11>, "spi-max-frequency:0";
++		spi1-2-speed = <&mcp3202_12>, "spi-max-frequency:0";
++		spi2-0-speed = <&mcp3202_20>, "spi-max-frequency:0";
++		spi2-1-speed = <&mcp3202_21>, "spi-max-frequency:0";
++		spi2-2-speed = <&mcp3202_22>, "spi-max-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/mcp342x-overlay.dts b/arch/arm/boot/dts/overlays/mcp342x-overlay.dts
+new file mode 100644
+index 000000000000..714eca5a4b5e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mcp342x-overlay.dts
+@@ -0,0 +1,164 @@
++// Overlay for MCP3421-8 ADCs from Microchip Semiconductor
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			mcp3421: mcp@68 {
++				reg = <0x68>;
++				compatible = "microchip,mcp3421";
++
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			mcp3422: mcp@68 {
++				reg = <0x68>;
++				compatible = "microchip,mcp3422";
++
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			mcp3423: mcp@68 {
++				reg = <0x68>;
++				compatible = "microchip,mcp3423";
++
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			mcp3424: mcp@68 {
++				reg = <0x68>;
++				compatible = "microchip,mcp3424";
++
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			mcp3425: mcp@68 {
++				reg = <0x68>;
++				compatible = "microchip,mcp3425","mcp3425";
++
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@5 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			mcp3426: mcp@68 {
++				reg = <0x68>;
++				compatible = "microchip,mcp3426";
++
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@6 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			mcp3427: mcp@68 {
++				reg = <0x68>;
++				compatible = "microchip,mcp3427";
++
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@7 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			mcp3428: mcp@68 {
++				reg = <0x68>;
++				compatible = "microchip,mcp3428";
++
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		addr = <&mcp3421>,"reg:0",
++		       <&mcp3422>,"reg:0",
++		       <&mcp3423>,"reg:0",
++		       <&mcp3424>,"reg:0",
++		       <&mcp3425>,"reg:0",
++		       <&mcp3426>,"reg:0",
++		       <&mcp3427>,"reg:0",
++		       <&mcp3428>,"reg:0";
++		mcp3421 = <0>,"=0";
++		mcp3422 = <0>,"=1";
++		mcp3423 = <0>,"=2";
++		mcp3424 = <0>,"=3";
++		mcp3425 = <0>,"=4";
++		mcp3426 = <0>,"=5";
++		mcp3427 = <0>,"=6";
++		mcp3428 = <0>,"=7";
++	};
++};
++
+diff --git a/arch/arm/boot/dts/overlays/media-center-overlay.dts b/arch/arm/boot/dts/overlays/media-center-overlay.dts
+new file mode 100644
+index 000000000000..9fab935d89d3
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/media-center-overlay.dts
+@@ -0,0 +1,134 @@
++/*
++ * Device Tree overlay for Media Center HAT by Pi Supply
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			rpi_display_pins: rpi_display_pins {
++				brcm,pins = <12 23 24 25>;
++				brcm,function = <1 1 1 0>; /* out out out in */
++				brcm,pull = <0 0 0 2>; /* - - - up */
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			rpidisplay: rpi-display@0{
++				compatible = "ilitek,ili9341";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&rpi_display_pins>;
++
++				spi-max-frequency = <32000000>;
++				rotate = <90>;
++				bgr;
++				fps = <30>;
++				buswidth = <8>;
++				reset-gpios = <&gpio 23 1>;
++				dc-gpios = <&gpio 24 0>;
++				led-gpios = <&gpio 12 0>;
++				debug = <0>;
++			};
++
++			rpidisplay_ts: rpi-display-ts@1 {
++				compatible = "ti,ads7846";
++				reg = <1>;
++
++				spi-max-frequency = <2000000>;
++				interrupts = <25 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				pendown-gpio = <&gpio 25 1>;
++				ti,x-plate-ohms = /bits/ 16 <60>;
++				ti,pressure-max = /bits/ 16 <255>;
++			};
++		};
++	};
++
++	fragment@4 {
++		target-path = "/";
++		__overlay__ {
++			lirc_rpi: lirc_rpi {
++				compatible = "rpi,lirc-rpi";
++				pinctrl-names = "default";
++				pinctrl-0 = <&lirc_pins>;
++				status = "okay";
++
++				// Override autodetection of IR receiver circuit
++				// (0 = active high, 1 = active low, -1 = no override )
++				rpi,sense = <0xffffffff>;
++
++				// Software carrier
++				// (0 = off, 1 = on)
++				rpi,softcarrier = <1>;
++
++				// Invert output
++				// (0 = off, 1 = on)
++				rpi,invert = <0>;
++
++				// Enable debugging messages
++				// (0 = off, 1 = on)
++				rpi,debug = <0>;
++			};
++		};
++	};
++
++	fragment@5 {
++		target = <&gpio>;
++		__overlay__ {
++			lirc_pins: lirc_pins {
++				brcm,pins = <6 5>;
++				brcm,function = <1 0>; // out in
++				brcm,pull = <0 1>; // off down
++			};
++		};
++	};
++
++	__overrides__ {
++		speed =     <&rpidisplay>,"spi-max-frequency:0";
++		rotate =    <&rpidisplay>,"rotate:0";
++		fps =       <&rpidisplay>,"fps:0";
++		debug =     <&rpidisplay>,"debug:0", 
++		            <&lirc_rpi>,"rpi,debug:0";
++		xohms =     <&rpidisplay_ts>,"ti,x-plate-ohms;0";
++		swapxy =    <&rpidisplay_ts>,"ti,swap-xy?";
++		backlight = <&rpidisplay>,"led-gpios:4",
++		            <&rpi_display_pins>,"brcm,pins:0";
++
++		gpio_out_pin =  <&lirc_pins>,"brcm,pins:0";
++		gpio_in_pin =   <&lirc_pins>,"brcm,pins:4";
++		gpio_in_pull =  <&lirc_pins>,"brcm,pull:4";
++
++		sense =         <&lirc_rpi>,"rpi,sense:0";
++		softcarrier =   <&lirc_rpi>,"rpi,softcarrier:0";
++		invert =        <&lirc_rpi>,"rpi,invert:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/merus-amp-overlay.dts b/arch/arm/boot/dts/overlays/merus-amp-overlay.dts
+new file mode 100644
+index 000000000000..ec5c7c28f728
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/merus-amp-overlay.dts
+@@ -0,0 +1,59 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for Infineon Merus-Amp
++/dts-v1/;
++/plugin/;
++#include <dt-bindings/pinctrl/bcm2835.h>
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			merus_amp_pins: merus_amp_pins {
++				brcm,pins = <23 8>;
++				brcm,function = <0 0>;
++				brcm,pull = <2 0>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			merus_amp: ma120x0p@20 {
++				#sound-dai-cells = <0>;
++				compatible = "ma,ma120x0p";
++				reg = <0x20>;
++				status = "okay";
++				pinctrl-names = "default";
++				pinctrl-0 = <&merus_amp_pins>;
++				enable_gp-gpios = <&gpio 14 GPIO_ACTIVE_HIGH>;
++				mute_gp-gpios = <&gpio 15 GPIO_ACTIVE_HIGH>;
++				booster_gp-gpios = <&gpio 17 GPIO_ACTIVE_HIGH>;
++				error_gp-gpios = <&gpio 23 GPIO_ACTIVE_HIGH>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "merus,merus-amp";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/midi-uart0-overlay.dts b/arch/arm/boot/dts/overlays/midi-uart0-overlay.dts
+new file mode 100644
+index 000000000000..f7e44d29e101
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/midi-uart0-overlay.dts
+@@ -0,0 +1,36 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/bcm2835.h>
++
++/*
++ * Fake a higher clock rate to get a larger divisor, and thereby a lower
++ * baudrate. The real clock is 48MHz, which we scale so that requesting
++ * 38.4kHz results in an actual 31.25kHz.
++ *
++ *   48000000*38400/31250 = 58982400
++ */
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			midi_clk: midi_clk {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-output-names = "uart0_pclk";
++				clock-frequency = <58982400>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&uart0>;
++		__overlay__ {
++			clocks = <&midi_clk>,
++			         <&clocks BCM2835_CLOCK_VPU>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/midi-uart1-overlay.dts b/arch/arm/boot/dts/overlays/midi-uart1-overlay.dts
+new file mode 100644
+index 000000000000..e0bc410acbff
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/midi-uart1-overlay.dts
+@@ -0,0 +1,43 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/bcm2835-aux.h>
++
++/*
++ * Fake a higher clock rate to get a larger divisor, and thereby a lower
++ * baudrate. The real clock is 48MHz, which we scale so that requesting
++ * 38.4kHz results in an actual 31.25kHz.
++ *
++ *   48000000*38400/31250 = 58982400
++ */
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/clocks";
++		__overlay__ {
++			midi_clk: clock@5 {
++				compatible = "fixed-factor-clock";
++				#clock-cells = <0>;
++				clocks = <&aux BCM2835_AUX_CLOCK_UART>;
++				clock-mult = <38400>;
++				clock-div  = <31250>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&uart1>;
++		__overlay__ {
++			clocks = <&midi_clk>;
++		};
++	};
++
++	fragment@2 {
++		target = <&aux>;
++		__overlay__ {
++			clock-output-names = "aux_uart", "aux_spi1", "aux_spi2";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/midi-uart2-overlay.dts b/arch/arm/boot/dts/overlays/midi-uart2-overlay.dts
+new file mode 100644
+index 000000000000..66f3092e9a74
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/midi-uart2-overlay.dts
+@@ -0,0 +1,37 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/bcm2835.h>
++
++/*
++ * Fake a higher clock rate to get a larger divisor, and thereby a lower
++ * baudrate. The real clock is 48MHz, which we scale so that requesting
++ * 38.4kHz results in an actual 31.25kHz.
++ *
++ *   48000000*38400/31250 = 58982400
++ */
++
++/{
++        compatible = "brcm,bcm2835";
++
++        fragment@0 {
++                target-path = "/";
++                __overlay__ {
++                        midi_clk: midi_clk2 {
++                                compatible = "fixed-clock";
++                                #clock-cells = <0>;
++                                clock-output-names = "uart2_pclk";
++                                clock-frequency = <58982400>;
++                        };
++                };
++        };
++
++        fragment@1 {
++                target = <&uart2>;
++                __overlay__ {
++                        clocks = <&midi_clk>,
++                                 <&clocks BCM2835_CLOCK_VPU>;
++                };
++        };
++};
++
+diff --git a/arch/arm/boot/dts/overlays/midi-uart3-overlay.dts b/arch/arm/boot/dts/overlays/midi-uart3-overlay.dts
+new file mode 100644
+index 000000000000..55c6cb94f963
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/midi-uart3-overlay.dts
+@@ -0,0 +1,38 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/bcm2835.h>
++
++/*
++ * Fake a higher clock rate to get a larger divisor, and thereby a lower
++ * baudrate. The real clock is 48MHz, which we scale so that requesting
++ * 38.4kHz results in an actual 31.25kHz.
++ *
++ *   48000000*38400/31250 = 58982400
++ */
++
++/{
++        compatible = "brcm,bcm2835";
++
++        fragment@0 {
++                target-path = "/";
++                __overlay__ {
++                        midi_clk: midi_clk3 {
++                                compatible = "fixed-clock";
++                                #clock-cells = <0>;
++                                clock-output-names = "uart3_pclk";
++                                clock-frequency = <58982400>;
++                        };
++                };
++        };
++
++        fragment@1 {
++                target = <&uart3>;
++                __overlay__ {
++                        clocks = <&midi_clk>,
++                                 <&clocks BCM2835_CLOCK_VPU>;
++                };
++        };
++};
++
++
+diff --git a/arch/arm/boot/dts/overlays/midi-uart4-overlay.dts b/arch/arm/boot/dts/overlays/midi-uart4-overlay.dts
+new file mode 100644
+index 000000000000..5819df1a6b2e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/midi-uart4-overlay.dts
+@@ -0,0 +1,38 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/bcm2835.h>
++
++/*
++ * Fake a higher clock rate to get a larger divisor, and thereby a lower
++ * baudrate. The real clock is 48MHz, which we scale so that requesting
++ * 38.4kHz results in an actual 31.25kHz.
++ *
++ *   48000000*38400/31250 = 58982400
++ */
++
++/{
++        compatible = "brcm,bcm2835";
++
++        fragment@0 {
++                target-path = "/";
++                __overlay__ {
++                        midi_clk: midi_clk4 {
++                                compatible = "fixed-clock";
++                                #clock-cells = <0>;
++                                clock-output-names = "uart4_pclk";
++                                clock-frequency = <58982400>;
++                        };
++                };
++        };
++
++        fragment@1 {
++                target = <&uart4>;
++                __overlay__ {
++                        clocks = <&midi_clk>,
++                                 <&clocks BCM2835_CLOCK_VPU>;
++                };
++        };
++};
++
++
+diff --git a/arch/arm/boot/dts/overlays/midi-uart5-overlay.dts b/arch/arm/boot/dts/overlays/midi-uart5-overlay.dts
+new file mode 100644
+index 000000000000..a1d37f7103ff
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/midi-uart5-overlay.dts
+@@ -0,0 +1,38 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/bcm2835.h>
++
++/*
++ * Fake a higher clock rate to get a larger divisor, and thereby a lower
++ * baudrate. The real clock is 48MHz, which we scale so that requesting
++ * 38.4kHz results in an actual 31.25kHz.
++ *
++ *   48000000*38400/31250 = 58982400
++ */
++
++/{
++        compatible = "brcm,bcm2835";
++
++        fragment@0 {
++                target-path = "/";
++                __overlay__ {
++                        midi_clk: midi_clk5 {
++                                compatible = "fixed-clock";
++                                #clock-cells = <0>;
++                                clock-output-names = "uart5_pclk";
++                                clock-frequency = <58982400>;
++                        };
++                };
++        };
++
++        fragment@1 {
++                target = <&uart5>;
++                __overlay__ {
++                        clocks = <&midi_clk>,
++                                 <&clocks BCM2835_CLOCK_VPU>;
++                };
++        };
++};
++
++
+diff --git a/arch/arm/boot/dts/overlays/minipitft13-overlay.dts b/arch/arm/boot/dts/overlays/minipitft13-overlay.dts
+new file mode 100644
+index 000000000000..5e0941e8ba54
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/minipitft13-overlay.dts
+@@ -0,0 +1,70 @@
++/*
++ * Device Tree overlay for Adafruit Mini PiTFT 1.3" and 1.5" 240x240 Display
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++        compatible = "brcm,bcm2835";
++
++        fragment@0 {
++                target = <&spidev0>;
++                __overlay__ {
++                        status = "disabled";
++                };
++        };
++
++        fragment@1 {
++                target = <&spidev1>;
++                __overlay__ {
++                        status = "disabled";
++                };
++        };
++
++        fragment@2 {
++                target = <&gpio>;
++                __overlay__ {
++                        pitft_pins: pitft_pins {
++                                brcm,pins = <25>;
++                                brcm,function = <1>; /* out */
++                                brcm,pull = <0>; /* none */
++                        };
++                };
++        };
++
++        fragment@3 {
++                target = <&spi0>;
++                __overlay__ {
++                        /* needed to avoid dtc warning */
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++                        status = "okay";
++
++                        pitft: pitft@0 {
++                                compatible = "fbtft,minipitft13";
++                                reg = <0>;
++                                pinctrl-names = "default";
++                                pinctrl-0 = <&pitft_pins>;
++                                spi-max-frequency = <32000000>;
++                                rotate = <0>;
++                                width = <240>;
++                                height = <240>;
++                                buswidth = <8>;
++                                dc-gpios = <&gpio 25 0>;
++                                led-gpios = <&gpio 26 0>;
++                                debug = <0>;
++                        };
++                };
++        };
++
++        __overrides__ {
++                speed =   <&pitft>,"spi-max-frequency:0";
++                rotate =  <&pitft>,"rotate:0";
++                width =   <&pitft>,"width:0";
++                height =  <&pitft>,"height:0";
++                fps =     <&pitft>,"fps:0";
++                debug =   <&pitft>,"debug:0";
++        };
++};
+diff --git a/arch/arm/boot/dts/overlays/miniuart-bt-overlay.dts b/arch/arm/boot/dts/overlays/miniuart-bt-overlay.dts
+new file mode 100644
+index 000000000000..da49f14a0940
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/miniuart-bt-overlay.dts
+@@ -0,0 +1,93 @@
++/dts-v1/;
++/plugin/;
++
++/* Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore
++   UART0/ttyAMA0 over GPIOs 14 & 15. Note that this may reduce the maximum
++   usable baudrate.
++
++   It is also necessary to edit /lib/systemd/system/hciuart.service and
++   replace ttyAMA0 with ttyS0, unless you have a system with udev rules
++   that create /dev/serial0 and /dev/serial1, in which case use /dev/serial1
++   instead because it will always be correct.
++
++   If cmdline.txt uses the alias serial0 to refer to the user-accessable port
++   then the firmware will replace with the appropriate port whether or not
++   this overlay is used.
++*/
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&uart0>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&uart0_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&bt>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&uart1>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&uart1_pins &bt_pins &fake_bt_cts>;
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&uart0_pins>;
++		__overlay__ {
++			brcm,pins;
++			brcm,function;
++			brcm,pull;
++		};
++	};
++
++	fragment@4 {
++		target = <&uart1_pins>;
++		__overlay__ {
++			brcm,pins = <32 33>;
++			brcm,function = <2>; /* alt5=UART1 */
++			brcm,pull = <0 2>;
++		};
++	};
++
++	fragment@5 {
++		target = <&gpio>;
++		__overlay__ {
++			fake_bt_cts: fake_bt_cts {
++				brcm,pins = <31>;
++				brcm,function = <1>; /* output */
++			};
++		};
++	};
++
++	fragment@6 {
++		target-path = "/aliases";
++		__overlay__ {
++			serial0 = "/soc/serial@7e201000";
++			serial1 = "/soc/serial@7e215040";
++		};
++	};
++
++	fragment@7 {
++		target = <&minibt>;
++		minibt_frag: __overlay__ {
++		};
++	};
++
++	__overrides__ {
++		krnbt = <&minibt_frag>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/mipi-dbi-spi-overlay.dts b/arch/arm/boot/dts/overlays/mipi-dbi-spi-overlay.dts
+new file mode 100644
+index 000000000000..9b9c654402c6
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mipi-dbi-spi-overlay.dts
+@@ -0,0 +1,175 @@
++/*
++ * mipi-dbi-spi-overlay.dts
++ */
++
++#include <dt-bindings/gpio/gpio.h>
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	spidev_fragment: fragment@0 {
++		target-path = "spi0/spidev@0";
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	panel_fragment: fragment@1 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			panel: panel@0 {
++				compatible = "panel", "panel-mipi-dbi-spi";
++				reg = <0>;
++				spi-max-frequency = <32000000>;
++
++				width-mm = <0>;
++				height-mm = <0>;
++
++				timing: panel-timing {
++					hactive = <320>;
++					vactive = <240>;
++					hback-porch = <0>;
++					vback-porch = <0>;
++
++					clock-frequency = <0>;
++					hfront-porch = <0>;
++					hsync-len = <0>;
++					vfront-porch = <0>;
++					vsync-len = <0>;
++				};
++			};
++		};
++	};
++
++	fragment@10 {
++		target = <&panel>;
++		__dormant__  {
++			backlight = <&backlight_gpio>;
++		};
++	};
++
++	fragment@11 {
++		target-path = "/";
++		__dormant__  {
++			backlight_gpio: backlight_gpio {
++				compatible = "gpio-backlight";
++				gpios = <&gpio 255 GPIO_ACTIVE_HIGH>;
++			};
++		};
++	};
++
++	fragment@20 {
++		target = <&panel>;
++		__dormant__  {
++			backlight = <&backlight_pwm>;
++		};
++	};
++
++	fragment@21 {
++		target-path = "/";
++		__dormant__  {
++			backlight_pwm: backlight_pwm {
++				compatible = "pwm-backlight";
++				brightness-levels = <0 6 8 12 16 24 32 40 48 64 96 128 160 192 224 255>;
++				default-brightness-level = <16>;
++				pwms = <&pwm 0 200000>;
++			};
++		};
++	};
++
++	fragment@22 {
++		target = <&pwm>;
++		__dormant__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&pwm_pins>;
++			assigned-clock-rates = <1000000>;
++			status = "okay";
++		};
++	};
++
++	fragment@23 {
++		target = <&gpio>;
++		__dormant__ {
++			pwm_pins: pwm_pins {
++				brcm,pins = <18>;
++				brcm,function = <2>; /* Alt5 */
++			};
++		};
++	};
++
++	fragment@24 {
++		target = <&chosen>;
++		__dormant__  {
++			bootargs = "snd_bcm2835.enable_headphones=0";
++		};
++	};
++
++	__overrides__ {
++		compatible    = <&panel>, "compatible";
++
++		spi0-0        = <&panel_fragment>, "target:0=",<&spi0>,
++				<&spidev_fragment>, "target-path=spi0/spidev@0",
++				<&panel>, "reg:0=0";
++		spi0-1        = <&panel_fragment>, "target:0=",<&spi0>,
++				<&spidev_fragment>, "target-path=spi0/spidev@1",
++				<&panel>, "reg:0=1";
++		spi1-0        = <&panel_fragment>, "target:0=",<&spi1>,
++				<&spidev_fragment>, "target-path=spi1/spidev@0",
++				<&panel>, "reg:0=0";
++		spi1-1        = <&panel_fragment>, "target:0=",<&spi1>,
++				<&spidev_fragment>, "target-path=spi1/spidev@1",
++				<&panel>, "reg:0=1";
++		spi1-2        = <&panel_fragment>, "target:0=",<&spi1>,
++				<&spidev_fragment>, "target-path=spi1/spidev@2",
++				<&panel>, "reg:0=2";
++		spi2-0        = <&panel_fragment>, "target:0=",<&spi2>,
++				<&spidev_fragment>, "target-path=spi2/spidev@0",
++				<&panel>, "reg:0=0";
++		spi2-1        = <&panel_fragment>, "target:0=",<&spi2>,
++				<&spidev_fragment>, "target-path=spi2/spidev@1",
++				<&panel>, "reg:0=1";
++		spi2-2        = <&panel_fragment>, "target:0=",<&spi2>,
++				<&spidev_fragment>, "target-path=spi2/spidev@2",
++				<&panel>, "reg:0=2";
++
++		speed         = <&panel>, "spi-max-frequency:0";
++		cpha          = <&panel>, "spi-cpha?";
++		cpol          = <&panel>, "spi-cpol?";
++
++		write-only    = <&panel>, "write-only?";
++
++		width         = <&timing>, "hactive:0";
++		height        = <&timing>, "vactive:0";
++		x-offset      = <&timing>, "hback-porch:0";
++		y-offset      = <&timing>, "vback-porch:0";
++		clock-frequency = <&timing>, "clock-frequency:0";
++
++		width-mm      = <&panel>, "width-mm:0";
++		height-mm     = <&panel>, "height-mm:0";
++
++		/* optional gpios */
++		reset-gpio    = <&panel>, "reset-gpios:0=", <&gpio>,
++				<&panel>, "reset-gpios:4",
++				<&panel>, "reset-gpios:8=0"; /* GPIO_ACTIVE_HIGH */
++		dc-gpio       = <&panel>, "dc-gpios:0=", <&gpio>,
++				<&panel>, "dc-gpios:4",
++				<&panel>, "dc-gpios:8=0"; /* GPIO_ACTIVE_HIGH */
++
++		backlight-gpio        = <0>, "+10+11",
++					<&backlight_gpio>, "gpios:4";
++		backlight-pwm         = <0>, "+20+21+22+23+24";
++		backlight-pwm-chan    = <&backlight_pwm>, "pwms:4";
++		backlight-pwm-gpio    = <&pwm_pins>, "brcm,pins:0";
++		backlight-pwm-func    = <&pwm_pins>, "brcm,function:0";
++		backlight-def-brightness = <&backlight_pwm>, "default-brightness-level:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/mlx90640-overlay.dts b/arch/arm/boot/dts/overlays/mlx90640-overlay.dts
+new file mode 100644
+index 000000000000..a2655ed82585
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mlx90640-overlay.dts
+@@ -0,0 +1,22 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			clock-frequency = <400000>;
++
++			mlx90640: mlx90640@33 {
++				compatible = "melexis,mlx90640";
++				reg = <0x33>;
++				status = "okay";
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/mmc-overlay.dts b/arch/arm/boot/dts/overlays/mmc-overlay.dts
+new file mode 100644
+index 000000000000..c1a2f691aa1e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mmc-overlay.dts
+@@ -0,0 +1,46 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&mmc>;
++		frag0: __overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&mmc_pins>;
++			bus-width = <4>;
++			brcm,overclock-50 = <0>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			mmc_pins: mmc_pins {
++				brcm,pins = <48 49 50 51 52 53>;
++				brcm,function = <7>; /* alt3 */
++				brcm,pull = <0 2 2 2 2 2>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sdhost>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&mmcnr>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	__overrides__ {
++		overclock_50     = <&frag0>,"brcm,overclock-50:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/mpu6050-overlay.dts b/arch/arm/boot/dts/overlays/mpu6050-overlay.dts
+new file mode 100644
+index 000000000000..1b4c06535687
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mpu6050-overlay.dts
+@@ -0,0 +1,29 @@
++// Definitions for MPU6050
++/dts-v1/;
++/plugin/;
++
++/ {
++        compatible = "brcm,bcm2835";
++
++        fragment@0 {
++                target = <&i2c1>;
++                __overlay__ {
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++                        status = "okay";
++                        clock-frequency = <400000>;
++
++                        mpu6050: mpu6050@68 {
++                                compatible = "invensense,mpu6050";
++                                reg = <0x68>;
++                                interrupt-parent = <&gpio>;
++                                interrupts = <4 1>;
++                        };
++                };
++        };
++
++        __overrides__ {
++                interrupt = <&mpu6050>,"interrupts:0";
++                addr = <&mpu6050>,"reg:0";
++        };
++};
+diff --git a/arch/arm/boot/dts/overlays/mz61581-overlay.dts b/arch/arm/boot/dts/overlays/mz61581-overlay.dts
+new file mode 100644
+index 000000000000..6e00e8b2ddf2
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mz61581-overlay.dts
+@@ -0,0 +1,117 @@
++/*
++ * Device Tree overlay for MZ61581-PI-EXT 2014.12.28 by Tontec
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			mz61581_pins: mz61581_pins {
++				brcm,pins = <4 15 18 25>;
++				brcm,function = <0 1 1 1>; /* in out out out */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mz61581: mz61581@0{
++				compatible = "samsung,s6d02a1";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mz61581_pins>;
++
++				spi-max-frequency = <128000000>;
++				spi-cpol;
++				spi-cpha;
++
++				width = <320>;
++				height = <480>;
++				rotate = <270>;
++				bgr;
++				fps = <30>;
++				buswidth = <8>;
++				txbuflen = <32768>;
++
++				reset-gpios = <&gpio 15 1>;
++				dc-gpios = <&gpio 25 0>;
++				led-gpios = <&gpio 18 0>;
++
++				init = <0x10000b0 00
++					0x1000011
++					0x20000ff
++					0x10000b3 0x02 0x00 0x00 0x00
++					0x10000c0 0x13 0x3b 0x00 0x02 0x00 0x01 0x00 0x43
++					0x10000c1 0x08 0x16 0x08 0x08
++					0x10000c4 0x11 0x07 0x03 0x03
++					0x10000c6 0x00
++					0x10000c8 0x03 0x03 0x13 0x5c 0x03 0x07 0x14 0x08 0x00 0x21 0x08 0x14 0x07 0x53 0x0c 0x13 0x03 0x03 0x21 0x00
++					0x1000035 0x00
++					0x1000036 0xa0
++					0x100003a 0x55
++					0x1000044 0x00 0x01
++					0x10000d0 0x07 0x07 0x1d 0x03
++					0x10000d1 0x03 0x30 0x10
++					0x10000d2 0x03 0x14 0x04
++					0x1000029
++					0x100002c>;
++
++				/* This is a workaround to make sure the init sequence slows down and doesn't fail */
++				debug = <3>;
++			};
++
++			mz61581_ts: mz61581_ts@1 {
++				compatible = "ti,ads7846";
++				reg = <1>;
++
++				spi-max-frequency = <2000000>;
++				interrupts = <4 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				pendown-gpio = <&gpio 4 0>;
++
++				ti,x-plate-ohms = /bits/ 16 <60>;
++				ti,pressure-max = /bits/ 16 <255>;
++			};
++		};
++	};
++	__overrides__ {
++		speed =   <&mz61581>, "spi-max-frequency:0";
++		rotate =  <&mz61581>, "rotate:0";
++		fps =     <&mz61581>, "fps:0";
++		txbuflen = <&mz61581>, "txbuflen:0";
++		debug =   <&mz61581>, "debug:0";
++		xohms =   <&mz61581_ts>,"ti,x-plate-ohms;0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/ov2311-overlay.dts b/arch/arm/boot/dts/overlays/ov2311-overlay.dts
+new file mode 100644
+index 000000000000..aeefca50e8a2
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ov2311-overlay.dts
+@@ -0,0 +1,77 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for OV2311 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "ov2311.dtsi"
++		};
++	};
++
++	csi_frag: fragment@1 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++			brcm,media-controller;
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++					data-lanes = <1 2>;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@4{
++		target = <&cam1_clk>;
++		__overlay__ {
++			status = "okay";
++			clock-frequency = <24000000>;
++		};
++	};
++
++	__overrides__ {
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <&csi>,"brcm,media-controller?";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_vc>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "avdd-supply:0=",<&cam0_reg>;
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
+diff --git a/arch/arm/boot/dts/overlays/ov2311.dtsi b/arch/arm/boot/dts/overlays/ov2311.dtsi
+new file mode 100644
+index 000000000000..a1714d6941c3
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ov2311.dtsi
+@@ -0,0 +1,26 @@
++// Fragment that configures an ov2311
++
++cam_node: ov2311@60 {
++	compatible = "ovti,ov2311";
++	reg = <0x60>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "xvclk";
++
++	avdd-supply = <&cam1_reg>;
++	dovdd-supply = <&cam_dummy_reg>;
++	dvdd-supply = <&cam_dummy_reg>;
++
++	rotation = <0>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			data-lanes = <1 2>;
++			link-frequencies =
++				/bits/ 64 <400000000>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/ov5647-overlay.dts b/arch/arm/boot/dts/overlays/ov5647-overlay.dts
+new file mode 100644
+index 000000000000..3fcb0b8d9952
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ov5647-overlay.dts
+@@ -0,0 +1,92 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for OV5647 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "ov5647.dtsi"
++
++			vcm: ad5398@c {
++				compatible = "adi,ad5398";
++				reg = <0x0c>;
++				status = "disabled";
++				VANA-supply = <&cam1_reg>;
++			};
++		};
++	};
++
++	csi_frag: fragment@1 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++			brcm,media-controller;
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++					data-lanes = <1 2>;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	reg_frag: fragment@4 {
++		target = <&cam1_reg>;
++		__overlay__ {
++			startup-delay-us = <20000>;
++		};
++	};
++
++	clk_frag: fragment@5 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			status = "okay";
++			clock-frequency = <25000000>;
++		};
++	};
++
++	__overrides__ {
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <&csi>,"brcm,media-controller?";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_vc>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&reg_frag>, "target:0=",<&cam0_reg>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "avdd-supply:0=",<&cam0_reg>;
++		vcm = <&vcm>, "status=okay",
++		      <&cam_node>,"lens-focus:0=", <&vcm>;
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
+diff --git a/arch/arm/boot/dts/overlays/ov5647.dtsi b/arch/arm/boot/dts/overlays/ov5647.dtsi
+new file mode 100644
+index 000000000000..6455a191a394
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ov5647.dtsi
+@@ -0,0 +1,25 @@
++cam_node: ov5647@36 {
++	compatible = "ovti,ov5647";
++	reg = <0x36>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++
++	avdd-supply = <&cam1_reg>;
++	dovdd-supply = <&cam_dummy_reg>;
++	dvdd-supply = <&cam_dummy_reg>;
++
++	rotation = <0>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			data-lanes = <1 2>;
++			clock-noncontinuous;
++			link-frequencies =
++				/bits/ 64 <297000000>;
++		};
++	};
++};
++
+diff --git a/arch/arm/boot/dts/overlays/ov7251-overlay.dts b/arch/arm/boot/dts/overlays/ov7251-overlay.dts
+new file mode 100644
+index 000000000000..9e490aa90fa0
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ov7251-overlay.dts
+@@ -0,0 +1,77 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for OV7251 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "ov7251.dtsi"
++		};
++	};
++
++	csi_frag: fragment@1 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++			brcm,media-controller;
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++					data-lanes = <1>;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@4 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			status = "okay";
++			clock-frequency = <24000000>;
++		};
++	};
++
++	__overrides__ {
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <&csi>,"brcm,media-controller?";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_vc>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "vdda-supply:0=",<&cam0_reg>;
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
+diff --git a/arch/arm/boot/dts/overlays/ov7251.dtsi b/arch/arm/boot/dts/overlays/ov7251.dtsi
+new file mode 100644
+index 000000000000..561fed1db837
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ov7251.dtsi
+@@ -0,0 +1,28 @@
++// Fragment that configures an ov7251
++
++cam_node: ov7251@60 {
++	compatible = "ovti,ov7251";
++	reg = <0x60>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "xclk";
++	clock-frequency = <24000000>;
++
++	vdddo-supply = <&cam_dummy_reg>;
++	vdda-supply = <&cam1_reg>;
++	vddd-supply = <&cam_dummy_reg>;
++
++	rotation = <0>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			data-lanes = <1>;
++			clock-noncontinuous;
++			link-frequencies =
++				/bits/ 64 <240000000>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/ov9281-overlay.dts b/arch/arm/boot/dts/overlays/ov9281-overlay.dts
+new file mode 100644
+index 000000000000..8a678d420c38
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ov9281-overlay.dts
+@@ -0,0 +1,78 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for OV9281 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "ov9281.dtsi"
++		};
++	};
++
++	csi_frag: fragment@1 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++			brcm,media-controller;
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@4 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			status = "okay";
++			clock-frequency = <24000000>;
++		};
++	};
++
++	__overrides__ {
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <&csi>,"brcm,media-controller?";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_vc>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "avdd-supply:0=",<&cam0_reg>;
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
+diff --git a/arch/arm/boot/dts/overlays/ov9281.dtsi b/arch/arm/boot/dts/overlays/ov9281.dtsi
+new file mode 100644
+index 000000000000..7df43bc6ef39
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ov9281.dtsi
+@@ -0,0 +1,27 @@
++// Fragment that configures an ov9281
++
++cam_node: ov9281@60 {
++	compatible = "ovti,ov9281";
++	reg = <0x60>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "xvclk";
++
++	avdd-supply = <&cam1_reg>;
++	dovdd-supply = <&cam_dummy_reg>;
++	dvdd-supply = <&cam_dummy_reg>;
++
++	rotation = <0>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			data-lanes = <1 2>;
++			clock-noncontinuous;
++			link-frequencies =
++				/bits/ 64 <400000000>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/overlay_map.dts b/arch/arm/boot/dts/overlays/overlay_map.dts
+new file mode 100644
+index 000000000000..18d888109019
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/overlay_map.dts
+@@ -0,0 +1,211 @@
++/dts-v1/;
++
++/ {
++	bmp085_i2c-sensor {
++		deprecated = "use i2c-sensor,bmp085";
++	};
++
++	cutiepi-panel {
++		bcm2711;
++	};
++
++	highperi {
++		bcm2711;
++	};
++
++	i2c0-bcm2708 {
++		deprecated = "use i2c0";
++	};
++
++	i2c1-bcm2708 {
++		deprecated = "use i2c1";
++	};
++
++	i2c3 {
++		bcm2711;
++	};
++
++	i2c4 {
++		bcm2711;
++	};
++
++	i2c5 {
++		bcm2711;
++	};
++
++	i2c6 {
++		bcm2711;
++	};
++
++	lirc-rpi {
++		deprecated = "use gpio-ir";
++	};
++
++	midi-uart2 {
++		bcm2711;
++	};
++
++	midi-uart3 {
++		bcm2711;
++	};
++
++	midi-uart4 {
++		bcm2711;
++	};
++
++	midi-uart5 {
++		bcm2711;
++	};
++
++	pcie-32bit-dma {
++		bcm2711;
++	};
++
++	pi3-act-led {
++		renamed = "act-led";
++	};
++
++	pi3-disable-bt {
++		renamed = "disable-bt";
++	};
++
++	pi3-disable-wifi {
++		renamed = "disable-wifi";
++	};
++
++	pi3-miniuart-bt {
++		renamed = "miniuart-bt";
++	};
++
++	ramoops {
++		bcm2835;
++		bcm2711 = "ramoops-pi4";
++	};
++
++	ramoops-pi4 {
++		bcm2711;
++	};
++
++	rpi-cirrus-wm5102 {
++		renamed = "cirrus-wm5102";
++	};
++
++	rpi-dac {
++		renamed = "i2s-dac";
++	};
++
++	rpi-display {
++		renamed = "watterott-display";
++	};
++
++	rpi-proto {
++		renamed = "proto-codec";
++	};
++
++	rpivid-v4l2 {
++		deprecated = "no longer necessary";
++	};
++
++	sdio-1bit {
++		deprecated = "use sdio,bus_width=1,gpios_22_25";
++	};
++
++	sdtweak {
++		deprecated = "use 'dtparam=sd_poll_once' etc.";
++	};
++
++	spi0-cs {
++		renamed = "spi0-2cs";
++	};
++
++	spi0-hw-cs {
++		deprecated = "no longer necessary";
++	};
++
++	spi3-1cs {
++		bcm2711;
++	};
++
++	spi3-2cs {
++		bcm2711;
++	};
++
++	spi4-1cs {
++		bcm2711;
++	};
++
++	spi4-2cs {
++		bcm2711;
++	};
++
++	spi5-1cs {
++		bcm2711;
++	};
++
++	spi5-2cs {
++		bcm2711;
++	};
++
++	spi6-1cs {
++		bcm2711;
++	};
++
++	spi6-2cs {
++		bcm2711;
++	};
++
++	uart2 {
++		bcm2711;
++	};
++
++	uart3 {
++		bcm2711;
++	};
++
++	uart4 {
++		bcm2711;
++	};
++
++	uart5 {
++		bcm2711;
++	};
++
++	upstream {
++		bcm2835;
++		bcm2711 = "upstream-pi4";
++	};
++
++	upstream-aux-interrupt {
++		deprecated = "no longer necessary";
++	};
++
++	upstream-pi4 {
++		bcm2711;
++	};
++
++	vc4-fkms-v3d {
++		bcm2835;
++		bcm2711 = "vc4-fkms-v3d-pi4";
++	};
++
++	vc4-fkms-v3d-pi4 {
++		bcm2711;
++	};
++
++	vc4-kms-dpi-at056tn53v1 {
++		deprecated = "use vc4-kms-dpi-panel,at056tn53v1";
++	};
++
++	vc4-kms-v3d {
++		bcm2835;
++		bcm2711 = "vc4-kms-v3d-pi4";
++	};
++
++	vc4-kms-v3d-pi4 {
++		bcm2711;
++	};
++
++	vl805 {
++		bcm2711;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/papirus-overlay.dts b/arch/arm/boot/dts/overlays/papirus-overlay.dts
+new file mode 100644
+index 000000000000..d3e819c0578d
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/papirus-overlay.dts
+@@ -0,0 +1,84 @@
++/* PaPiRus ePaper Screen by Pi Supply */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			display_temp: lm75@48 {
++				compatible = "lm75b";
++				reg = <0x48>;
++				status = "okay";
++				#thermal-sensor-cells = <0>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/thermal-zones";
++		__overlay__ {
++			display {
++				polling-delay-passive = <0>;
++				polling-delay = <0>;
++				thermal-sensors = <&display_temp>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			repaper_pins: repaper_pins {
++				brcm,pins = <14 15 23 24 25>;
++				brcm,function = <1 1 1 1 0>; /* out out out out in */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			repaper: repaper@0{
++				compatible = "not_set";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&repaper_pins>;
++
++				spi-max-frequency = <8000000>;
++
++				panel-on-gpios = <&gpio 23 0>;
++				border-gpios = <&gpio 14 0>;
++				discharge-gpios = <&gpio 15 0>;
++				reset-gpios = <&gpio 24 0>;
++				busy-gpios = <&gpio 25 0>;
++
++				repaper-thermal-zone = "display";
++			};
++		};
++	};
++
++	__overrides__ {
++		panel = <&repaper>, "compatible";
++		speed = <&repaper>, "spi-max-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pca953x-overlay.dts b/arch/arm/boot/dts/overlays/pca953x-overlay.dts
+new file mode 100644
+index 000000000000..8b6ee44665ce
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pca953x-overlay.dts
+@@ -0,0 +1,240 @@
++// Definitions for NXP PCA953x family of I2C GPIO controllers on ARM I2C bus.
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pca: pca@20 {
++				compatible = "nxp,pca9534";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca6416";
++		};
++	};
++	fragment@2 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9505";
++		};
++	};
++	fragment@3 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9535";
++		};
++	};
++	fragment@4 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9536";
++		};
++	};
++	fragment@5 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9537";
++		};
++	};
++	fragment@6 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9538";
++		};
++	};
++	fragment@7 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9539";
++		};
++	};
++	fragment@8 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9554";
++		};
++	};
++	fragment@9 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9555";
++		};
++	};
++	fragment@10 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9556";
++		};
++	};
++	fragment@11 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9557";
++		};
++	};
++	fragment@12 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9574";
++		};
++	};
++	fragment@13 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9575";
++		};
++	};
++	fragment@14 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9698";
++		};
++	};
++	fragment@15 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca16416";
++		};
++	};
++	fragment@16 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca16524";
++		};
++	};
++	fragment@17 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca19555a";
++		};
++	};
++	fragment@18 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "maxim,max7310";
++		};
++	};
++	fragment@19 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "maxim,max7312";
++		};
++	};
++	fragment@20 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "maxim,max7313";
++		};
++	};
++	fragment@21 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "maxim,max7315";
++		};
++	};
++	fragment@22 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "ti,pca6107";
++		};
++	};
++	fragment@23 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "ti,tca6408";
++		};
++	};
++	fragment@24 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "ti,tca6416";
++		};
++	};
++	fragment@25 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "ti,tca6424";
++		};
++	};
++	fragment@26 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "ti,tca9539";
++		};
++	};
++	fragment@27 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "ti,tca9554";
++		};
++	};
++	fragment@28 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "onnn,cat9554";
++		};
++	};
++	fragment@29 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "onnn,pca9654";
++		};
++	};
++	fragment@30 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "exar,xra1202";
++		};
++	};
++
++	__overrides__ {
++		addr = <&pca>,"reg:0";
++		pca6416 = <0>, "+1";
++		pca9505 = <0>, "+2";
++		pca9535 = <0>, "+3";
++		pca9536 = <0>, "+4";
++		pca9537 = <0>, "+5";
++		pca9538 = <0>, "+6";
++		pca9539 = <0>, "+7";
++		pca9554 = <0>, "+8";
++		pca9555 = <0>, "+9";
++		pca9556 = <0>, "+10";
++		pca9557 = <0>, "+11";
++		pca9574 = <0>, "+12";
++		pca9575 = <0>, "+13";
++		pca9698 = <0>, "+14";
++		pca16416 = <0>, "+15";
++		pca16524 = <0>, "+16";
++		pca19555a = <0>, "+17";
++		max7310 = <0>, "+18";
++		max7312 = <0>, "+19";
++		max7313 = <0>, "+20";
++		max7315 = <0>, "+21";
++		pca6107 = <0>, "+22";
++		tca6408 = <0>, "+23";
++		tca6416 = <0>, "+24";
++		tca6424 = <0>, "+25";
++		tca9539 = <0>, "+26";
++		tca9554 = <0>, "+27";
++		cat9554 = <0>, "+28";
++		pca9654 = <0>, "+29";
++		xra1202 = <0>, "+30";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pcie-32bit-dma-overlay.dts b/arch/arm/boot/dts/overlays/pcie-32bit-dma-overlay.dts
+new file mode 100644
+index 000000000000..955703563df7
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pcie-32bit-dma-overlay.dts
+@@ -0,0 +1,38 @@
++/*
++ * pcie-32bit-dma-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target-path = "/aliases";
++		__overlay__ {
++			/*
++			 * Removing this alias stops the firmware patching the
++			 * PCIE DT dma-ranges based on the detected chip
++			 * revision.
++			 */
++			pcie0 = "";
++		};
++	};
++
++	fragment@1 {
++		target = <&pcie0>;
++		__overlay__ {
++			/*
++			 * The size of the range is rounded up to a power of 2,
++			 * so the range ends up being 0-4GB, and the MSI vector
++			 * gets pushed beyond 4GB.
++			 */
++			#address-cells = <3>;
++			#size-cells = <2>;
++			dma-ranges = <0x02000000 0x0 0x00000000 0x0 0x00000000
++				      0x0 0x80000000>;
++		};
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/pibell-overlay.dts b/arch/arm/boot/dts/overlays/pibell-overlay.dts
+new file mode 100644
+index 000000000000..9333a9b09772
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pibell-overlay.dts
+@@ -0,0 +1,81 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++
++    fragment@0 {
++        target-path = "/";
++        __overlay__ {
++            codec_out: spdif-transmitter {
++                #address-cells = <0>;
++                #size-cells = <0>;
++                #sound-dai-cells = <0>;
++                compatible = "linux,spdif-dit";
++                status = "okay";
++            };
++
++            codec_in: card-codec {
++                #sound-dai-cells = <0>;
++                compatible = "invensense,ics43432";
++                status = "okay";
++            };
++        };
++    };
++
++    fragment@1 {
++        target = <&i2s>;
++        __overlay__ {
++            #sound-dai-cells = <0>;
++            status = "okay";
++        };
++    };
++
++    fragment@2 {
++        target = <&sound>;
++        snd: __overlay__ {
++            compatible = "simple-audio-card";
++            simple-audio-card,name = "PiBell";
++
++            status="okay";
++
++            capture_link: simple-audio-card,dai-link@0 {
++                format = "i2s";
++
++                r_cpu_dai: cpu {
++                    sound-dai = <&i2s>;
++
++/* example TDM slot configuration
++                    dai-tdm-slot-num = <2>;
++                    dai-tdm-slot-width = <32>;
++*/
++                };
++
++                r_codec_dai: codec {
++                    sound-dai = <&codec_in>;
++                };
++            };
++
++            playback_link: simple-audio-card,dai-link@1 {
++                format = "i2s";
++
++                p_cpu_dai: cpu {
++                    sound-dai = <&i2s>;
++
++/* example TDM slot configuration
++                    dai-tdm-slot-num = <2>;
++                    dai-tdm-slot-width = <32>;
++*/
++                };
++
++                p_codec_dai: codec {
++                    sound-dai = <&codec_out>;
++                };
++            };
++        };
++    };
++
++    __overrides__ {
++        alsaname = <&snd>, "simple-audio-card,name";
++    };
++};
+diff --git a/arch/arm/boot/dts/overlays/pifacedigital-overlay.dts b/arch/arm/boot/dts/overlays/pifacedigital-overlay.dts
+new file mode 100644
+index 000000000000..532a858683d6
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pifacedigital-overlay.dts
+@@ -0,0 +1,144 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * PiFace Digital, Device Tree Overlay.
++ * Copyright (C) 2020 Thomas Preston <thomas.preston@codethink.co.uk>
++ *
++ * The PiFace Digital is a convenient breakout board for the Microchip mcp23s17
++ * SPI GPIO port expander.
++ *
++ * The first eight GPIOs 0..7 (bank A) are connected to eight output terminals
++ * and LEDs, plus two relays on the first two outputs. These output loads are
++ * active-high.
++ *
++ * The next eight GPIOs 8..15 (bank B) are connected to eight input terminals
++ * with four on-board switches connecting them to ground. Inputs devices are
++ * therefore expected to bridge terminals to ground, so the mcp23s17 pullups are
++ * activated for GPIO bank B.
++ *
++ * On PiFace Digital, the mcp23s17 is connected to the Raspberry Pi's SPI0 CS0
++ * bus. Each SPI bus supports up to eight addressable child devices. The PiFace
++ * Digital only supports addresses 0-4, which can be configured by jumpers JP1
++ * and JP2.
++ *
++ * You can tell the driver about these jumper configurations with the
++ * spi-present-mask bitmask:
++ *
++ *     | JP1 | JP2 | dtoverlay line in /boot/config.txt         |
++ *     | --- | --- | ------------------------------------------ |
++ *     |  0  |  0  | dtoverlay=pifacedigital                    |
++ *     |  0  |  0  | dtoverlay=pifacedigital:spi-present-mask=1 |
++ *     |  0  |  1  | dtoverlay=pifacedigital:spi-present-mask=2 |
++ *     |  1  |  0  | dtoverlay=pifacedigital:spi-present-mask=4 |
++ *     |  1  |  1  | dtoverlay=pifacedigital:spi-present-mask=8 |
++ *
++ * # Example
++ * Set the dtoverlay config in /boot/config.txt and power off the Raspberry Pi:
++ *
++ *     $ grep pifacedigital /boot/config.txt
++ *     dtoverlay=pifacedigital
++ *     $ sudo systemctl poweroff
++ *
++ * Attach the PiFace Digital and power on the Raspberry Pi.
++ * Then use the libgpiod tools to query the device:
++ *
++ *     $ sudo apt install gpiod
++ *     $ gpiodetect | grep mcp23s17
++ *     gpiochip2 [mcp23s17.0] (16 lines)
++ *
++ * Set GPIO outputs 0, 2 and 5:
++ *
++ *     $ gpioset gpiochip2 0=1 2=1 5=1
++ *
++ * Get GPIO status (input GPIO 8..15 are high, because they are active-low):
++ *
++ *     $ gpioget gpiochip2 {8..15}
++ *     1 1 1 1 1 1 1 1
++ *
++ * And even monitor interrupts:
++ *
++ *     $ gpiomon gpiochip2 {8..15}
++ *     event: FALLING EDGE offset: 11 timestamp: [1597361662.926741667]
++ *     event:  RISING EDGE offset: 11 timestamp: [1597361663.062555051]
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	/* Disable exposing /dev/spidev0.0 */
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	/* Add the PiFace Digital device node to the spi0.0 device. */
++	fragment@1 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pfdigital: pifacedigital@0 {
++				compatible = "microchip,mcp23s17";
++				reg = <0>;
++
++				/* Set devices present with 8-bit mask. */
++				microchip,spi-present-mask = <0x01>;
++				spi-max-frequency = <500000>;
++
++				gpio-controller;
++				#gpio-cells = <2>;
++
++				/* This device can pass through interrupts. */
++				interrupt-controller;
++				#interrupt-cells = <2>;
++
++				/* INTB is connected to GPIO 25.
++				 * 0x8 active-low level-sensitive
++				 */
++				interrupts = <25 0x8>;
++				interrupt-parent = <&gpio>;
++
++				/* Configure pull-ups on bank B GPIOs */
++				pinctrl-0 = <&pfdigital_irq &pfdigital_pullups>;
++				pinctrl-names = "default";
++				pfdigital_pullups: pinmux {
++					pins =
++						"gpio8",
++						"gpio9",
++						"gpio10",
++						"gpio11",
++						"gpio12",
++						"gpio13",
++						"gpio14",
++						"gpio15";
++					bias-pull-up;
++				};
++			};
++		};
++	};
++
++	/* PiFace Digital mcp23s17 INTB pin is connected to GPIO 25. The INTB
++	 * pin is configured active-low (0 on interrupt), so expect to see
++	 * FALLING_EDGE when inputs are bridged to ground (switch is pressed).
++	 */
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			pfdigital_irq: pifacedigital_irq {
++				brcm,pins = <25>;
++				brcm,function = <0>; /* input */
++			};
++		};
++	};
++
++	__overrides__ {
++		spi-present-mask = <&pfdigital>, "microchip,spi-present-mask:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pifi-40-overlay.dts b/arch/arm/boot/dts/overlays/pifi-40-overlay.dts
+new file mode 100644
+index 000000000000..51a20e54977f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pifi-40-overlay.dts
+@@ -0,0 +1,50 @@
++// Definitions for PiFi-40 Amp
++/dts-v1/;
++/plugin/;
++#include <dt-bindings/gpio/gpio.h>
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			tas5711l: audio-codec@1a {
++				compatible = "ti,tas5711";
++				reg = <0x1a>;
++				#sound-dai-cells = <0>;
++				sound-name-prefix = "Left";
++				status = "okay";
++			};
++
++			tas5711r: audio-codec@1b {
++				compatible = "ti,tas5711";
++				reg = <0x1b>;
++				#sound-dai-cells = <0>;
++				sound-name-prefix = "Right";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		pifi_40: __overlay__ {
++			compatible = "pifi,pifi-40";
++			audio-codec = <&tas5711l &tas5711r>;
++			i2s-controller = <&i2s>;
++			pdn-gpios = <&gpio 23 1>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pifi-dac-hd-overlay.dts b/arch/arm/boot/dts/overlays/pifi-dac-hd-overlay.dts
+new file mode 100644
+index 000000000000..67f50db7861a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pifi-dac-hd-overlay.dts
+@@ -0,0 +1,49 @@
++// Overlay for PiFi-DAC-HD
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells =<0>;
++
++			pcm5142: pcm5142@4c {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5142";
++				reg = <0x4c>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "simple-audio-card";
++			simple-audio-card,name = "PiFi-DAC-HD";
++			status = "okay";
++
++			simple-audio-card,dai-link@1 {
++				format = "i2s";
++				cpu {
++					sound-dai = <&i2s>;
++				};
++				codec {
++					sound-dai = <&pcm5142>;
++				};
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pifi-dac-zero-overlay.dts b/arch/arm/boot/dts/overlays/pifi-dac-zero-overlay.dts
+new file mode 100644
+index 000000000000..645ea74cb435
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pifi-dac-zero-overlay.dts
+@@ -0,0 +1,49 @@
++// Overlay for PiFi-DAC-Zero
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "simple-audio-card";
++			simple-audio-card,name = "PiFi-DAC-Zero";
++			status = "okay";
++
++			simple-audio-card,dai-link@1 {
++				format = "i2s";
++
++				cpu {
++					sound-dai = <&i2s>;
++					dai-tdm-slot-num = <2>;
++					dai-tdm-slot-width = <32>;
++				};
++
++				codec {
++					sound-dai = <&codec_out>;
++				};
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			codec_out: pcm5102a-codec {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5102a";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2s>;
++		__overlay__ {
++			#sound-dai-cells = <0>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pifi-mini-210-overlay.dts b/arch/arm/boot/dts/overlays/pifi-mini-210-overlay.dts
+new file mode 100644
+index 000000000000..963597d611b5
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pifi-mini-210-overlay.dts
+@@ -0,0 +1,42 @@
++// Definitions for PiFi Mini 210
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			tas5711@1a {
++				#sound-dai-cells = <0>;
++				compatible = "ti,tas5711";
++				reg = <0x1a>;
++				status = "okay";
++				pdn-gpios = <&gpio 23 1>;
++				reset-gpios = <&gpio 24 1>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "pifi,pifi-mini-210";
++			i2s-controller = <&i2s>;
++
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/piglow-overlay.dts b/arch/arm/boot/dts/overlays/piglow-overlay.dts
+new file mode 100644
+index 000000000000..075bceef158c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/piglow-overlay.dts
+@@ -0,0 +1,97 @@
++// Definitions for SN3218 LED driver from Si-En Technology on PiGlow
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			sn3218@54 {
++				compatible = "si-en,sn3218";
++				reg = <0x54>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++				status = "okay";
++
++				led@1 {
++					reg = <1>;
++					label = "piglow:red:led1";
++				};
++				led@2 {
++					reg = <2>;
++					label = "piglow:orange:led2";
++				};
++				led@3 {
++					reg = <3>;
++					label = "piglow:yellow:led3";
++				};
++				led@4 {
++					reg = <4>;
++					label = "piglow:green:led4";
++				};
++				led@5 {
++					reg = <5>;
++					label = "piglow:blue:led5";
++				};
++				led@6 {
++					reg = <6>;
++					label = "piglow:green:led6";
++				};
++				led@7 {
++					reg = <7>;
++					label = "piglow:red:led7";
++				};
++				led@8 {
++					reg = <8>;
++					label = "piglow:orange:led8";
++				};
++				led@9 {
++					reg = <9>;
++					label = "piglow:yellow:led9";
++				};
++				led@10 {
++					reg = <10>;
++					label = "piglow:white:led10";
++				};
++				led@11 {
++					reg = <11>;
++					label = "piglow:white:led11";
++				};
++				led@12 {
++					reg = <12>;
++					label = "piglow:blue:led12";
++				};
++				led@13 {
++					reg = <13>;
++					label = "piglow:white:led13";
++				};
++				led@14 {
++					reg = <14>;
++					label = "piglow:green:led14";
++				};
++				led@15 {
++					reg = <15>;
++					label = "piglow:blue:led15";
++				};
++				led@16 {
++					reg = <16>;
++					label = "piglow:yellow:led16";
++				};
++				led@17 {
++					reg = <17>;
++					label = "piglow:orange:led17";
++				};
++				led@18 {
++					reg = <18>;
++					label = "piglow:red:led18";
++				};
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/piscreen-overlay.dts b/arch/arm/boot/dts/overlays/piscreen-overlay.dts
+new file mode 100644
+index 000000000000..1ac75a248fab
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/piscreen-overlay.dts
+@@ -0,0 +1,102 @@
++/*
++ * Device Tree overlay for PiScreen 3.5" display shield by Ozzmaker
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			piscreen_pins: piscreen_pins {
++				brcm,pins = <17 25 24 22>;
++				brcm,function = <0 1 1 1>; /* in out out out */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			piscreen: piscreen@0{
++				compatible = "ilitek,ili9486";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&piscreen_pins>;
++
++				spi-max-frequency = <24000000>;
++				rotate = <270>;
++				bgr;
++				fps = <30>;
++				buswidth = <8>;
++				regwidth = <16>;
++				reset-gpios = <&gpio 25 1>;
++				dc-gpios = <&gpio 24 0>;
++				led-gpios = <&gpio 22 0>;
++				debug = <0>;
++
++				init = <0x10000b0 0x00
++				        0x1000011
++					0x20000ff
++					0x100003a 0x55
++					0x1000036 0x28
++					0x10000c2 0x44
++					0x10000c5 0x00 0x00 0x00 0x00
++					0x10000e0 0x0f 0x1f 0x1c 0x0c 0x0f 0x08 0x48 0x98 0x37 0x0a 0x13 0x04 0x11 0x0d 0x00
++					0x10000e1 0x0f 0x32 0x2e 0x0b 0x0d 0x05 0x47 0x75 0x37 0x06 0x10 0x03 0x24 0x20 0x00
++					0x10000e2 0x0f 0x32 0x2e 0x0b 0x0d 0x05 0x47 0x75 0x37 0x06 0x10 0x03 0x24 0x20 0x00
++					0x1000011
++					0x1000029>;
++			};
++
++			piscreen_ts: piscreen-ts@1 {
++				compatible = "ti,ads7846";
++				reg = <1>;
++
++				spi-max-frequency = <2000000>;
++				interrupts = <17 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				pendown-gpio = <&gpio 17 0>;
++				ti,swap-xy;
++				ti,x-plate-ohms = /bits/ 16 <100>;
++				ti,pressure-max = /bits/ 16 <255>;
++			};
++		};
++	};
++	__overrides__ {
++		speed =		<&piscreen>,"spi-max-frequency:0";
++		rotate =	<&piscreen>,"rotate:0";
++		fps =		<&piscreen>,"fps:0";
++		debug =		<&piscreen>,"debug:0";
++		xohms =		<&piscreen_ts>,"ti,x-plate-ohms;0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/piscreen2r-overlay.dts b/arch/arm/boot/dts/overlays/piscreen2r-overlay.dts
+new file mode 100644
+index 000000000000..9d2b51101969
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/piscreen2r-overlay.dts
+@@ -0,0 +1,106 @@
++ /*
++ * Device Tree overlay for PiScreen2 3.5" TFT with resistive touch  by Ozzmaker.com
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			piscreen2_pins: piscreen2_pins {
++				brcm,pins = <17 25 24 22>;
++				brcm,function = <0 1 1 1>; /* in out out out */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			piscreen2: piscreen2@0{
++				compatible = "ilitek,ili9486";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&piscreen2_pins>;
++				bgr;
++				spi-max-frequency = <64000000>;
++				rotate = <90>;
++				fps = <30>;
++				buswidth = <8>;
++				regwidth = <16>;
++				txbuflen = <32768>;
++				reset-gpios = <&gpio 25 1>;
++				dc-gpios = <&gpio 24 0>;
++				led-gpios = <&gpio 22 0>;
++				debug = <0>;
++
++                                init = <0x10000b0 0x00
++                                        0x1000011
++                                        0x20000ff
++                                        0x100003a 0x55
++                                        0x1000036 0x28
++                                        0x10000c0 0x11 0x09
++                                        0x10000c1 0x41
++                                        0x10000c5 0x00 0x00 0x00 0x00
++                                        0x10000b6 0x00 0x02
++                                        0x10000f7 0xa9 0x51 0x2c 0x2
++                                        0x10000be 0x00 0x04
++                                        0x10000e9 0x00
++                                        0x1000011
++                                        0x1000029>;
++
++			};
++
++			piscreen2_ts: piscreen2-ts@1 {
++				compatible = "ti,ads7846";
++				reg = <1>;
++
++				spi-max-frequency = <2000000>;
++				interrupts = <17 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				pendown-gpio = <&gpio 17 0>;
++				ti,swap-xy;
++				ti,x-plate-ohms = /bits/ 16 <100>;
++				ti,pressure-max = /bits/ 16 <255>;
++			};
++		};
++	};
++	__overrides__ {
++		speed =		<&piscreen2>,"spi-max-frequency:0";
++		rotate =	<&piscreen2>,"rotate:0";
++		fps =		<&piscreen2>,"fps:0";
++		debug =		<&piscreen2>,"debug:0";
++		xohms =		<&piscreen2_ts>,"ti,x-plate-ohms;0";
++	};
++};
++
+diff --git a/arch/arm/boot/dts/overlays/pisound-overlay.dts b/arch/arm/boot/dts/overlays/pisound-overlay.dts
+new file mode 100644
+index 000000000000..49efb2b768fb
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pisound-overlay.dts
+@@ -0,0 +1,120 @@
++/*
++ * Pisound Linux kernel module.
++ * Copyright (C) 2016-2017  Vilniaus Blokas UAB, https://blokas.io/pisound
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * as published by the Free Software Foundation; version 2 of the
++ * License.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&spi0>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pisound_spi: pisound_spi@0{
++				compatible = "blokaslabs,pisound-spi";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&spi0_pins>;
++				spi-max-frequency = <1000000>;
++			};
++		};
++	};
++
++	fragment@4 {
++		target-path = "/";
++		__overlay__ {
++			pcm5102a-codec {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5102a";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@5 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "blokaslabs,pisound";
++			i2s-controller = <&i2s>;
++			status = "okay";
++
++			pinctrl-0 = <&pisound_button_pins>;
++
++			osr-gpios =
++				<&gpio 13 GPIO_ACTIVE_HIGH>,
++				<&gpio 26 GPIO_ACTIVE_HIGH>,
++				<&gpio 16 GPIO_ACTIVE_HIGH>;
++
++			reset-gpios =
++				<&gpio 12 GPIO_ACTIVE_HIGH>,
++				<&gpio 24 GPIO_ACTIVE_HIGH>;
++
++			data_available-gpios = <&gpio 25 GPIO_ACTIVE_HIGH>;
++
++			button-gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	fragment@6 {
++		target = <&gpio>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&pisound_button_pins>;
++
++			pisound_button_pins: pisound_button_pins {
++				brcm,pins = <17>;
++				brcm,function = <0>; // Input
++				brcm,pull = <2>; // Pull-Up
++			};
++		};
++	};
++
++	fragment@7 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pitft22-overlay.dts b/arch/arm/boot/dts/overlays/pitft22-overlay.dts
+new file mode 100644
+index 000000000000..4c44ab66bc1c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pitft22-overlay.dts
+@@ -0,0 +1,69 @@
++/*
++ * Device Tree overlay for pitft by Adafruit
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++        compatible = "brcm,bcm2835";
++
++        fragment@0 {
++                target = <&spidev0>;
++                __overlay__ {
++                        status = "disabled";
++                };
++        };
++
++        fragment@1 {
++                target = <&spidev1>;
++                __overlay__ {
++                        status = "disabled";
++                };
++        };
++
++        fragment@2 {
++                target = <&gpio>;
++                __overlay__ {
++                        pitft_pins: pitft_pins {
++                                brcm,pins = <25>;
++                                brcm,function = <1>; /* out */
++                                brcm,pull = <0>; /* none */
++                        };
++                };
++        };
++
++        fragment@3 {
++                target = <&spi0>;
++                __overlay__ {
++                        /* needed to avoid dtc warning */
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++                        status = "okay";
++
++                        pitft: pitft@0{
++                                compatible = "ilitek,ili9340";
++                                reg = <0>;
++                                pinctrl-names = "default";
++                                pinctrl-0 = <&pitft_pins>;
++
++                                spi-max-frequency = <32000000>;
++                                rotate = <90>;
++                                fps = <25>;
++                                bgr;
++                                buswidth = <8>;
++                                dc-gpios = <&gpio 25 0>;
++                                debug = <0>;
++                        };
++
++                };
++        };
++
++        __overrides__ {
++                speed =   <&pitft>,"spi-max-frequency:0";
++                rotate =  <&pitft>,"rotate:0";
++                fps =     <&pitft>,"fps:0";
++                debug =   <&pitft>,"debug:0";
++        };
++};
+diff --git a/arch/arm/boot/dts/overlays/pitft28-capacitive-overlay.dts b/arch/arm/boot/dts/overlays/pitft28-capacitive-overlay.dts
+new file mode 100644
+index 000000000000..33901ee1db7a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pitft28-capacitive-overlay.dts
+@@ -0,0 +1,91 @@
++/*
++ * Device Tree overlay for Adafruit PiTFT 2.8" capacitive touch screen
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++        compatible = "brcm,bcm2835";
++
++        fragment@0 {
++                target = <&spi0>;
++                __overlay__ {
++                        status = "okay";
++                };
++        };
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++        fragment@2 {
++                target = <&gpio>;
++                __overlay__ {
++                        pitft_pins: pitft_pins {
++                                brcm,pins = <24 25>;
++                                brcm,function = <0 1>; /* in out */
++                                brcm,pull = <2 0>; /* pullup none */
++                        };
++                };
++        };
++
++        fragment@3 {
++                target = <&spi0>;
++                __overlay__ {
++                        /* needed to avoid dtc warning */
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++
++                        pitft: pitft@0{
++                                compatible = "ilitek,ili9340";
++                                reg = <0>;
++                                pinctrl-names = "default";
++                                pinctrl-0 = <&pitft_pins>;
++
++                                spi-max-frequency = <32000000>;
++                                rotate = <90>;
++                                fps = <25>;
++                                bgr;
++                                buswidth = <8>;
++                                dc-gpios = <&gpio 25 0>;
++                                debug = <0>;
++                        };
++                };
++        };
++
++        fragment@4 {
++                target = <&i2c1>;
++                __overlay__ {
++                        /* needed to avoid dtc warning */
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++
++                        ft6236: ft6236@38 {
++                                compatible = "focaltech,ft6236";
++                                reg = <0x38>;
++
++                                interrupt-parent = <&gpio>;
++                                interrupts = <24 2>;
++                                touchscreen-size-x = <240>;
++                                touchscreen-size-y = <320>;
++                        };
++                };
++        };
++
++        __overrides__ {
++                speed =   <&pitft>,"spi-max-frequency:0";
++                rotate =  <&pitft>,"rotate:0";
++                fps =     <&pitft>,"fps:0";
++                debug =   <&pitft>,"debug:0";
++                touch-sizex = <&ft6236>,"touchscreen-size-x?";
++                touch-sizey = <&ft6236>,"touchscreen-size-y?";
++                touch-invx  = <&ft6236>,"touchscreen-inverted-x?";
++                touch-invy  = <&ft6236>,"touchscreen-inverted-y?";
++                touch-swapxy = <&ft6236>,"touchscreen-swapped-x-y?";
++        };
++};
+diff --git a/arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts b/arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts
+new file mode 100644
+index 000000000000..cfe7d2f39732
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts
+@@ -0,0 +1,121 @@
++/*
++ * Device Tree overlay for Adafruit PiTFT 2.8" resistive touch screen
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			pitft_pins: pitft_pins {
++				brcm,pins = <24 25>;
++				brcm,function = <0 1>; /* in out */
++				brcm,pull = <2 0>; /* pullup none */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pitft: pitft@0{
++				compatible = "ilitek,ili9340", "multi-inno,mi0283qt";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&pitft_pins>;
++
++				spi-max-frequency = <32000000>;
++				rotate = <90>;
++				fps = <25>;
++				bgr;
++				buswidth = <8>;
++				dc-gpios = <&gpio 25 0>;
++				debug = <0>;
++			};
++
++			pitft_ts@1 {
++				compatible = "st,stmpe610";
++				reg = <1>;
++
++				spi-max-frequency = <500000>;
++				irq-gpio = <&gpio 24 0x2>; /* IRQF_TRIGGER_FALLING */
++				interrupts = <24 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				interrupt-controller;
++
++				stmpe_touchscreen {
++					compatible = "st,stmpe-ts";
++					st,sample-time = <4>;
++					st,mod-12b = <1>;
++					st,ref-sel = <0>;
++					st,adc-freq = <2>;
++					st,ave-ctrl = <3>;
++					st,touch-det-delay = <4>;
++					st,settling = <2>;
++					st,fraction-z = <7>;
++					st,i-drive = <0>;
++				};
++
++				stmpe_gpio: stmpe_gpio {
++					#gpio-cells = <2>;
++					compatible = "st,stmpe-gpio";
++					/*
++					 * only GPIO2 is wired/available
++					 * and it is wired to the backlight
++					 */
++					st,norequest-mask = <0x7b>;
++				};
++			};
++		};
++	};
++
++	fragment@5 {
++		target-path = "/soc";
++		__overlay__ {
++			backlight {
++				compatible = "gpio-backlight";
++				gpios = <&stmpe_gpio 2 0>;
++				default-on;
++			};
++		};
++	};
++
++	__overrides__ {
++		speed =   <&pitft>,"spi-max-frequency:0";
++		rotate =  <&pitft>,"rotate:0", /* fbtft */
++			  <&pitft>,"rotation:0"; /* drm */
++		fps =     <&pitft>,"fps:0";
++		debug =   <&pitft>,"debug:0";
++		drm =     <&pitft>,"compatible=multi-inno,mi0283qt";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts b/arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts
+new file mode 100644
+index 000000000000..fc0f5e5446ee
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts
+@@ -0,0 +1,122 @@
++/*
++ * Device Tree overlay for Adafruit PiTFT 3.5" resistive touch screen
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			pitft_pins: pitft_pins {
++				brcm,pins = <24 25>;
++				brcm,function = <0 1>; /* in out */
++				brcm,pull = <2 0>; /* pullup none */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pitft: pitft@0{
++				compatible = "himax,hx8357d", "adafruit,yx350hv15";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&pitft_pins>;
++
++				spi-max-frequency = <32000000>;
++				rotate = <90>;
++				fps = <25>;
++				bgr;
++				buswidth = <8>;
++				dc-gpios = <&gpio 25 0>;
++				debug = <0>;
++			};
++
++			pitft_ts@1 {
++				compatible = "st,stmpe610";
++				reg = <1>;
++
++				spi-max-frequency = <500000>;
++				irq-gpio = <&gpio 24 0x2>; /* IRQF_TRIGGER_FALLING */
++				interrupts = <24 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				interrupt-controller;
++
++				stmpe_touchscreen {
++					compatible = "st,stmpe-ts";
++					st,sample-time = <4>;
++					st,mod-12b = <1>;
++					st,ref-sel = <0>;
++					st,adc-freq = <2>;
++					st,ave-ctrl = <3>;
++					st,touch-det-delay = <4>;
++					st,settling = <2>;
++					st,fraction-z = <7>;
++					st,i-drive = <0>;
++				};
++
++				stmpe_gpio: stmpe_gpio {
++					#gpio-cells = <2>;
++					compatible = "st,stmpe-gpio";
++					/*
++					 * only GPIO2 is wired/available
++					 * and it is wired to the backlight
++					 */
++					st,norequest-mask = <0x7b>;
++				};
++			};
++		};
++	};
++
++	fragment@5 {
++		target-path = "/soc";
++		__overlay__ {
++			backlight: backlight {
++				compatible = "gpio-backlight";
++				gpios = <&stmpe_gpio 2 0>;
++				default-on;
++			};
++		};
++	};
++
++	__overrides__ {
++		speed =   <&pitft>,"spi-max-frequency:0";
++		rotate =  <&pitft>,"rotate:0", /* fbtft */
++			  <&pitft>,"rotation:0"; /* drm */
++		fps =     <&pitft>,"fps:0";
++		debug =   <&pitft>,"debug:0";
++		drm =     <&pitft>,"compatible=adafruit,yx350hv15",
++			  <&pitft>,"backlight:0=",<&backlight>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pps-gpio-overlay.dts b/arch/arm/boot/dts/overlays/pps-gpio-overlay.dts
+new file mode 100644
+index 000000000000..a4f6b868aad8
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pps-gpio-overlay.dts
+@@ -0,0 +1,39 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			pps: pps@12 {
++				compatible = "pps-gpio";
++				pinctrl-names = "default";
++				pinctrl-0 = <&pps_pins>;
++				gpios = <&gpio 18 0>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			pps_pins: pps_pins@12 {
++				brcm,pins =     <18>;
++				brcm,function = <0>;    // in
++				brcm,pull =     <0>;    // off
++			};
++		};
++	};
++
++	__overrides__ {
++		gpiopin = <&pps>,"gpios:4",
++			  <&pps>,"reg:0",
++			  <&pps_pins>,"brcm,pins:0",
++			  <&pps_pins>,"reg:0";
++		assert_falling_edge = <&pps>,"assert-falling-edge?";
++		capture_clear = <&pps>,"capture-clear?";
++		pull = <&pps_pins>,"brcm,pull:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/proto-codec-overlay.dts b/arch/arm/boot/dts/overlays/proto-codec-overlay.dts
+new file mode 100644
+index 000000000000..9cda044a0f62
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/proto-codec-overlay.dts
+@@ -0,0 +1,39 @@
++// Definitions for Rpi-Proto
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			wm8731@1a {
++				#sound-dai-cells = <0>;
++				compatible = "wlf,wm8731";
++				reg = <0x1a>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "rpi,rpi-proto";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pwm-2chan-overlay.dts b/arch/arm/boot/dts/overlays/pwm-2chan-overlay.dts
+new file mode 100644
+index 000000000000..4ddbbfa04065
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pwm-2chan-overlay.dts
+@@ -0,0 +1,49 @@
++/dts-v1/;
++/plugin/;
++
++/*
++This is the 2-channel overlay - only use it if you need both channels.
++
++Legal pin,function combinations for each channel:
++  PWM0: 12,4(Alt0) 18,2(Alt5) 40,4(Alt0)            52,5(Alt1)
++  PWM1: 13,4(Alt0) 19,2(Alt5) 41,4(Alt0) 45,4(Alt0) 53,5(Alt1)
++
++N.B.:
++  1) Pin 18 is the only one available on all platforms, and
++     it is the one used by the I2S audio interface.
++     Pins 12 and 13 might be better choices on an A+, B+ or Pi2.
++  2) The onboard analogue audio output uses both PWM channels.
++  3) So be careful mixing audio and PWM.
++*/
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			pwm_pins: pwm_pins {
++				brcm,pins = <18 19>;
++				brcm,function = <2 2>; /* Alt5 */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&pwm>;
++		frag1: __overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&pwm_pins>;
++			assigned-clock-rates = <100000000>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		pin   = <&pwm_pins>,"brcm,pins:0";
++		pin2  = <&pwm_pins>,"brcm,pins:4";
++		func  = <&pwm_pins>,"brcm,function:0";
++		func2 = <&pwm_pins>,"brcm,function:4";
++		clock = <&frag1>,"assigned-clock-rates:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pwm-ir-tx-overlay.dts b/arch/arm/boot/dts/overlays/pwm-ir-tx-overlay.dts
+new file mode 100644
+index 000000000000..119caf746b3b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pwm-ir-tx-overlay.dts
+@@ -0,0 +1,40 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			pwm0_pins: pwm0_pins {
++				brcm,pins = <18>;
++				brcm,function = <2>; /* Alt5 */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&pwm>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&pwm0_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target-path = "/";
++		__overlay__ {
++			pwm-ir-transmitter {
++				compatible = "pwm-ir-tx";
++				pwms = <&pwm 0 100>;
++			};
++		};
++	};
++
++	__overrides__ {
++		gpio_pin = <&pwm0_pins>, "brcm,pins:0";
++		func = <&pwm0_pins>,"brcm,function:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pwm-overlay.dts b/arch/arm/boot/dts/overlays/pwm-overlay.dts
+new file mode 100644
+index 000000000000..92876ab3bc8c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pwm-overlay.dts
+@@ -0,0 +1,45 @@
++/dts-v1/;
++/plugin/;
++
++/*
++Legal pin,function combinations for each channel:
++  PWM0: 12,4(Alt0) 18,2(Alt5) 40,4(Alt0)            52,5(Alt1)
++  PWM1: 13,4(Alt0) 19,2(Alt5) 41,4(Alt0) 45,4(Alt0) 53,5(Alt1)
++
++N.B.:
++  1) Pin 18 is the only one available on all platforms, and
++     it is the one used by the I2S audio interface.
++     Pins 12 and 13 might be better choices on an A+, B+ or Pi2.
++  2) The onboard analogue audio output uses both PWM channels.
++  3) So be careful mixing audio and PWM.
++*/
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			pwm_pins: pwm_pins {
++				brcm,pins = <18>;
++				brcm,function = <2>; /* Alt5 */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&pwm>;
++		frag1: __overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&pwm_pins>;
++			assigned-clock-rates = <100000000>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		pin   = <&pwm_pins>,"brcm,pins:0";
++		func  = <&pwm_pins>,"brcm,function:0";
++		clock = <&frag1>,"assigned-clock-rates:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/qca7000-overlay.dts b/arch/arm/boot/dts/overlays/qca7000-overlay.dts
+new file mode 100644
+index 000000000000..f695f36024fa
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/qca7000-overlay.dts
+@@ -0,0 +1,55 @@
++// Overlay for the Qualcomm Atheros QCA7000 on PLC Stamp micro EVK
++// Visit: https://in-tech-smartcharging.com/products/evaluation-tools/plc-stamp-micro-2-evaluation-board for details
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			eth1: qca7000@0 {
++				compatible = "qca,qca7000";
++				reg = <0>; /* CE0 */
++				pinctrl-names = "default";
++				pinctrl-0 = <&eth1_pins>;
++				interrupt-parent = <&gpio>;
++				interrupts = <23 0x1>; /* rising edge */
++				spi-max-frequency = <12000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			eth1_pins: eth1_pins {
++				brcm,pins = <23>;
++				brcm,function = <0>; /* in */
++				brcm,pull = <0>; /* none */
++			};
++		};
++	};
++
++	__overrides__ {
++		int_pin = <&eth1>, "interrupts:0",
++		          <&eth1_pins>, "brcm,pins:0";
++		speed   = <&eth1>, "spi-max-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/qca7000-uart0-overlay.dts b/arch/arm/boot/dts/overlays/qca7000-uart0-overlay.dts
+new file mode 100644
+index 000000000000..f103916c9e1c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/qca7000-uart0-overlay.dts
+@@ -0,0 +1,46 @@
++// Overlay for the Qualcomm Atheros QCA7000 on PLC Stamp micro EVK
++// Visit: https://in-tech-smartcharging.com/products/evaluation-tools/plc-stamp-micro-2-evaluation-board for details
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&uart0>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&uart0_pins>;
++			status = "okay";
++
++			eth2: qca7000 {
++				compatible = "qca,qca7000";
++				current-speed = <115200>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			uart0_pins: uart0_ovl_pins {
++				brcm,pins = <14 15>;
++				brcm,function = <4>; /* alt0 */
++				brcm,pull = <0 2>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target-path = "/aliases";
++		__overlay__ {
++			serial0 = "/soc/serial@7e201000";
++			serial1 = "/soc/serial@7e215040";
++		};
++	};
++
++	__overrides__ {
++		baudrate = <&eth2>, "current-speed:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/ramoops-overlay.dts b/arch/arm/boot/dts/overlays/ramoops-overlay.dts
+new file mode 100644
+index 000000000000..e5038658138d
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ramoops-overlay.dts
+@@ -0,0 +1,25 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&rmem>;
++		__overlay__ {
++			ramoops: ramoops@b000000 {
++				compatible = "ramoops";
++				reg = <0x0b000000 0x10000>; /* 64kB */
++				record-size = <0x4000>; /* 16kB */
++				console-size = <0>; /* disabled by default */
++			};
++		};
++	};
++
++	__overrides__ {
++		base-addr = <&ramoops>,"reg:0";
++		total-size = <&ramoops>,"reg:4";
++		record-size = <&ramoops>,"record-size:0";
++		console-size = <&ramoops>,"console-size:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/ramoops-pi4-overlay.dts b/arch/arm/boot/dts/overlays/ramoops-pi4-overlay.dts
+new file mode 100644
+index 000000000000..4f3d30ef069a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ramoops-pi4-overlay.dts
+@@ -0,0 +1,25 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&rmem>;
++		__overlay__ {
++			ramoops: ramoops@b000000 {
++				compatible = "ramoops";
++				reg = <0x0 0x0b000000 0x10000>; /* 64kB */
++				record-size = <0x4000>; /* 16kB */
++				console-size = <0>; /* disabled by default */
++			};
++		};
++	};
++
++	__overrides__ {
++		base-addr = <&ramoops>,"reg#0";
++		total-size = <&ramoops>,"reg:8";
++		record-size = <&ramoops>,"record-size:0";
++		console-size = <&ramoops>,"console-size:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/rotary-encoder-overlay.dts b/arch/arm/boot/dts/overlays/rotary-encoder-overlay.dts
+new file mode 100644
+index 000000000000..ea1d952734e9
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rotary-encoder-overlay.dts
+@@ -0,0 +1,59 @@
++// Device tree overlay for GPIO connected rotary encoder.
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			rotary_pins: rotary_pins@4 {
++				brcm,pins = <4 17>; /* gpio 4 17 */
++				brcm,function = <0 0>; /* input */
++				brcm,pull = <2 2>; /* pull-up */
++			};
++
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			rotary: rotary@4 {
++				compatible = "rotary-encoder";
++				status = "okay";
++				pinctrl-names = "default";
++				pinctrl-0 = <&rotary_pins>;
++				gpios = <&gpio 4 0>, <&gpio 17 0>;
++				linux,axis = <0>; /* REL_X */
++				rotary-encoder,encoding = "gray";
++				rotary-encoder,steps = <24>; /* 24 default */
++				rotary-encoder,steps-per-period = <1>; /* corresponds to full period mode. See README */
++			};
++		};
++
++	};  
++
++	__overrides__ {
++		pin_a =		    <&rotary>,"gpios:4",
++				    <&rotary_pins>,"brcm,pins:0",
++				    /* modify reg values to allow multiple instantiation */
++				    <&rotary>,"reg:0",
++				    <&rotary_pins>,"reg:0";
++		pin_b =		    <&rotary>,"gpios:16",
++				    <&rotary_pins>,"brcm,pins:4";
++		relative_axis =     <&rotary>,"rotary-encoder,relative-axis?";
++		linux_axis =        <&rotary>,"linux,axis:0";
++		rollover =          <&rotary>,"rotary-encoder,rollover?";
++		steps-per-period =  <&rotary>,"rotary-encoder,steps-per-period:0";
++		steps =             <&rotary>,"rotary-encoder,steps:0";
++		wakeup =            <&rotary>,"wakeup-source?";
++		encoding =          <&rotary>,"rotary-encoder,encoding";
++                /* legacy parameters*/
++		rotary0_pin_a =     <&rotary>,"gpios:4",
++		                    <&rotary_pins>,"brcm,pins:0";
++		rotary0_pin_b =     <&rotary>,"gpios:16",
++		                    <&rotary_pins>,"brcm,pins:4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-backlight-overlay.dts b/arch/arm/boot/dts/overlays/rpi-backlight-overlay.dts
+new file mode 100644
+index 000000000000..cac5e44c6ec5
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-backlight-overlay.dts
+@@ -0,0 +1,21 @@
++/*
++ * Devicetree overlay for mailbox-driven Raspberry Pi DSI Display
++ * backlight controller
++ */
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			rpi_backlight: rpi_backlight {
++				compatible = "raspberrypi,rpi-backlight";
++				firmware = <&firmware>;
++				status = "okay";
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-codeczero-overlay.dts b/arch/arm/boot/dts/overlays/rpi-codeczero-overlay.dts
+new file mode 100644
+index 000000000000..c3b0564b2fb2
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-codeczero-overlay.dts
+@@ -0,0 +1,9 @@
++// Overlay for the Raspberry Pi Codec Zero soundcard
++
++#include "iqaudio-codec-overlay.dts"
++
++&iqaudio_dac {
++	card_name = "RPi Codec Zero";
++	dai_name = "Raspberry Pi Codec Zero";
++	dai_stream_name = "Raspberry Pi Codec Zero HiFi";
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-dacplus-overlay.dts b/arch/arm/boot/dts/overlays/rpi-dacplus-overlay.dts
+new file mode 100644
+index 000000000000..47557aa17f19
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-dacplus-overlay.dts
+@@ -0,0 +1,17 @@
++// Overlay for the Raspberry Pi DAC Plus soundcard
++
++#include "iqaudio-dacplus-overlay.dts"
++
++&iqaudio_dac {
++	card_name = "RPi DAC+";
++	dai_name = "Raspberry Pi DAC+";
++	dai_stream_name = "Raspberry Pi DAC+ HiFi";
++	/delete-property/ mute-gpios;
++};
++
++/ {
++	__overrides__ {
++		/delete-property/ auto_mute_amp;
++		/delete-property/ unmute_amp;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-dacpro-overlay.dts b/arch/arm/boot/dts/overlays/rpi-dacpro-overlay.dts
+new file mode 100644
+index 000000000000..412260c64edf
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-dacpro-overlay.dts
+@@ -0,0 +1,17 @@
++// Overlay for the Raspberry Pi DAC Pro soundcard
++
++#include "iqaudio-dacplus-overlay.dts"
++
++&iqaudio_dac {
++	card_name = "RPi DAC Pro";
++	dai_name = "Raspberry Pi DAC Pro";
++	dai_stream_name = "Raspberry Pi DAC Pro HiFi";
++	/delete-property/ mute-gpios;
++};
++
++/ {
++	__overrides__ {
++		/delete-property/ auto_mute_amp;
++		/delete-property/ unmute_amp;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-digiampplus-overlay.dts b/arch/arm/boot/dts/overlays/rpi-digiampplus-overlay.dts
+new file mode 100644
+index 000000000000..5e73d6c1bf42
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-digiampplus-overlay.dts
+@@ -0,0 +1,17 @@
++// Overlay for the Raspberry Pi DAC Plus soundcard
++
++#include "iqaudio-dacplus-overlay.dts"
++
++&iqaudio_dac {
++	card_name = "RPi DigiAMP+";
++	dai_name = "Raspberry Pi DigiAMP+";
++	dai_stream_name = "Raspberry Pi DigiAMP+ HiFi";
++	iqaudio-dac,auto-mute-amp;
++};
++
++/ {
++	__overrides__ {
++		unmute_amp = <&iqaudio_dac>,"iqaudio-dac,unmute-amp?",
++			     <&iqaudio_dac>,"iqaudio-dac,auto-mute-amp!";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-ft5406-overlay.dts b/arch/arm/boot/dts/overlays/rpi-ft5406-overlay.dts
+new file mode 100644
+index 000000000000..8483c4f4b2eb
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-ft5406-overlay.dts
+@@ -0,0 +1,25 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/soc/firmware";
++		__overlay__ {
++			ts: touchscreen {
++				compatible = "raspberrypi,firmware-ts";
++				touchscreen-size-x = <800>;
++				touchscreen-size-y = <480>;
++			};
++		};
++	};
++
++	__overrides__ {
++		touchscreen-size-x = <&ts>,"touchscreen-size-x:0";
++		touchscreen-size-y = <&ts>,"touchscreen-size-y:0";
++		touchscreen-inverted-x = <&ts>,"touchscreen-inverted-x?";
++		touchscreen-inverted-y = <&ts>,"touchscreen-inverted-y?";
++		touchscreen-swapped-x-y = <&ts>,"touchscreen-swapped-x-y?";
++        };
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts b/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
+new file mode 100644
+index 000000000000..a4530c10dd42
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
+@@ -0,0 +1,154 @@
++/*
++ * Overlay for the Raspberry Pi POE HAT.
++ */
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			fan: pwm-fan {
++				compatible = "pwm-fan";
++				cooling-levels = <0 1 10 100 255>;
++				#cooling-cells = <2>;
++				pwms = <&fwpwm 0 80000>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&cpu_thermal>;
++		__overlay__ {
++			polling-delay = <2000>; /* milliseconds */
++		};
++	};
++
++	fragment@2 {
++		target = <&thermal_trips>;
++		__overlay__ {
++			trip0: trip0 {
++				temperature = <40000>;
++				hysteresis = <2000>;
++				type = "active";
++			};
++			trip1: trip1 {
++				temperature = <45000>;
++				hysteresis = <2000>;
++				type = "active";
++			};
++			trip2: trip2 {
++				temperature = <50000>;
++				hysteresis = <2000>;
++				type = "active";
++			};
++			trip3: trip3 {
++				temperature = <55000>;
++				hysteresis = <5000>;
++				type = "active";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&cooling_maps>;
++		__overlay__ {
++			map0 {
++				trip = <&trip0>;
++				cooling-device = <&fan 0 1>;
++			};
++			map1 {
++				trip = <&trip1>;
++				cooling-device = <&fan 1 2>;
++			};
++			map2 {
++				trip = <&trip2>;
++				cooling-device = <&fan 2 3>;
++			};
++			map3 {
++				trip = <&trip3>;
++				cooling-device = <&fan 3 4>;
++			};
++		};
++	};
++
++	fragment@4 {
++		target-path = "/__overrides__";
++		params: __overlay__ {
++			poe_fan_temp0 =		<&trip0>,"temperature:0";
++			poe_fan_temp0_hyst =	<&trip0>,"hysteresis:0";
++			poe_fan_temp1 =		<&trip1>,"temperature:0";
++			poe_fan_temp1_hyst =	<&trip1>,"hysteresis:0";
++			poe_fan_temp2 =		<&trip2>,"temperature:0";
++			poe_fan_temp2_hyst =	<&trip2>,"hysteresis:0";
++			poe_fan_temp3 =		<&trip3>,"temperature:0";
++			poe_fan_temp3_hyst =	<&trip3>,"hysteresis:0";
++			poe_fan_i2c =		<&fwpwm>,"status=disabled",
++						<&poe_mfd>,"status=okay",
++						<&fan>,"pwms:0=",<&poe_mfd_pwm>;
++		};
++	};
++
++	fragment@5 {
++		target = <&firmware>;
++		__overlay__ {
++			fwpwm: pwm {
++				compatible = "raspberrypi,firmware-poe-pwm";
++				#pwm-cells = <2>;
++			};
++		};
++	};
++
++	fragment@6 {
++		target = <&i2c0>;
++		i2c_bus: __overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			poe_mfd: poe@51 {
++				compatible = "raspberrypi,poe-core";
++				reg = <0x51>;
++				status = "disabled";
++
++				poe_mfd_pwm: poe_pwm@f0 {
++					compatible = "raspberrypi,poe-pwm";
++					reg = <0xf0>;
++					status = "okay";
++					#pwm-cells = <2>;
++				};
++			};
++		};
++	};
++
++	fragment@7 {
++		target = <&i2c0if>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@8 {
++		target = <&i2c0mux>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		poe_fan_temp0 =		<&trip0>,"temperature:0";
++		poe_fan_temp0_hyst =	<&trip0>,"hysteresis:0";
++		poe_fan_temp1 =		<&trip1>,"temperature:0";
++		poe_fan_temp1_hyst =	<&trip1>,"hysteresis:0";
++		poe_fan_temp2 =		<&trip2>,"temperature:0";
++		poe_fan_temp2_hyst =	<&trip2>,"hysteresis:0";
++		poe_fan_temp3 =		<&trip3>,"temperature:0";
++		poe_fan_temp3_hyst =	<&trip3>,"hysteresis:0";
++		i2c =			<0>, "+5+6",
++					<&fwpwm>,"status=disabled",
++					<&i2c_bus>,"status=okay",
++					<&poe_mfd>,"status=okay",
++					<&fan>,"pwms:0=",<&poe_mfd_pwm>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-poe-plus-overlay.dts b/arch/arm/boot/dts/overlays/rpi-poe-plus-overlay.dts
+new file mode 100644
+index 000000000000..54deda2f18c3
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-poe-plus-overlay.dts
+@@ -0,0 +1,49 @@
++// SPDX-License-Identifier: (GPL-2.0 OR MIT)
++// Overlay for the Raspberry Pi PoE+ HAT.
++
++#include "rpi-poe-overlay.dts"
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@10 {
++		target-path = "/";
++		__overlay__ {
++			rpi_poe_power_supply: rpi-poe-power-supply {
++				compatible = "raspberrypi,rpi-poe-power-supply";
++				firmware = <&firmware>;
++				status = "okay";
++			};
++		};
++	};
++	fragment@11 {
++		target = <&poe_mfd>;
++		__overlay__ {
++			rpi-poe-power-supply@f2 {
++				compatible = "raspberrypi,rpi-poe-power-supply";
++				reg = <0xf2>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		i2c =	<0>, "+5+6",
++			<&fwpwm>,"status=disabled",
++			<&rpi_poe_power_supply>,"status=disabled",
++			<&i2c_bus>,"status=okay",
++			<&poe_mfd>,"status=okay",
++			<&fan>,"pwms:0=",<&poe_mfd_pwm>;
++	};
++};
++
++&fan {
++	cooling-levels = <0 32 64 128 255>;
++};
++
++&params {
++	poe_fan_i2c = <&fwpwm>,"status=disabled",
++		      <&rpi_poe_power_supply>,"status=disabled",
++		      <&poe_mfd>,"status=okay",
++		      <&fan>,"pwms:0=",<&poe_mfd_pwm>;
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-sense-overlay.dts b/arch/arm/boot/dts/overlays/rpi-sense-overlay.dts
+new file mode 100644
+index 000000000000..89d8d2ea6b2e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-sense-overlay.dts
+@@ -0,0 +1,47 @@
++// rpi-sense HAT
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			rpi-sense@46 {
++				compatible = "rpi,rpi-sense";
++				reg = <0x46>;
++				keys-int-gpios = <&gpio 23 1>;
++				status = "okay";
++			};
++
++			lsm9ds1-magn@1c {
++				compatible = "st,lsm9ds1-magn";
++				reg = <0x1c>;
++				status = "okay";
++			};
++
++			lsm9ds1-accel6a {
++				compatible = "st,lsm9ds1-accel";
++				reg = <0x6a>;
++				status = "okay";
++			};
++
++			lps25h-press@5c {
++				compatible = "st,lps25h-press";
++				reg = <0x5c>;
++				status = "okay";
++			};
++
++			hts221-humid@5f {
++				compatible = "st,hts221-humid", "st,hts221";
++				reg = <0x5f>;
++				status = "okay";
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-sense-v2-overlay.dts b/arch/arm/boot/dts/overlays/rpi-sense-v2-overlay.dts
+new file mode 100644
+index 000000000000..1b86c032259b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-sense-v2-overlay.dts
+@@ -0,0 +1,47 @@
++// rpi-sense HAT
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			rpi-sense@46 {
++				compatible = "rpi,rpi-sense";
++				reg = <0x46>;
++				keys-int-gpios = <&gpio 23 1>;
++				status = "okay";
++			};
++
++			lsm9ds1-magn@1c {
++				compatible = "st,lsm9ds1-magn";
++				reg = <0x1c>;
++				status = "okay";
++			};
++
++			lps25h-press@5c {
++				compatible = "st,lps25h-press";
++				reg = <0x5c>;
++				status = "okay";
++			};
++
++			hts221-humid@5f {
++				compatible = "st,hts221-humid", "st,hts221";
++				reg = <0x5f>;
++				status = "okay";
++			};
++
++			lsm9ds1-accel@6a {
++				compatible = "st,lsm9ds1-accel";
++				reg = <0x6a>;
++				status = "okay";
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-tv-overlay.dts b/arch/arm/boot/dts/overlays/rpi-tv-overlay.dts
+new file mode 100644
+index 000000000000..3c97a545d820
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-tv-overlay.dts
+@@ -0,0 +1,34 @@
++// rpi-tv HAT
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			cxd2880@0 {
++				compatible = "sony,cxd2880";
++				reg = <0>; /* CE0 */
++				spi-max-frequency = <50000000>;
++				status = "okay";
++			};
++		};
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/rra-digidac1-wm8741-audio-overlay.dts b/arch/arm/boot/dts/overlays/rra-digidac1-wm8741-audio-overlay.dts
+new file mode 100644
+index 000000000000..87e9a326eff1
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rra-digidac1-wm8741-audio-overlay.dts
+@@ -0,0 +1,49 @@
++// Definitions for RRA DigiDAC1 Audio card
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			wm8804@3b {
++				#sound-dai-cells = <0>;
++				compatible = "wlf,wm8804";
++				reg = <0x3b>;
++				status = "okay";
++				PVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++			};
++
++			wm8742: wm8741@1a {
++				compatible = "wlf,wm8741";
++				reg = <0x1a>;
++				status = "okay";
++				AVDD-supply = <&vdd_5v0_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "rra,digidac1-soundcard";
++			i2s-controller = <&i2s>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sainsmart18-overlay.dts b/arch/arm/boot/dts/overlays/sainsmart18-overlay.dts
+new file mode 100644
+index 000000000000..c51f1c030a55
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sainsmart18-overlay.dts
+@@ -0,0 +1,52 @@
++/*
++ * Device Tree overlay for the Sainsmart 1.8" TFT LCD with ST7735R chip 160x128
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ss18: sainsmart18@0 {
++				compatible = "fbtft,sainsmart18";
++				reg = <0>;
++				pinctrl-names = "default";
++				spi-max-frequency = <40000000>;
++				rotate = <90>;
++				buswidth = <8>;
++				fps = <50>;
++				height = <160>;
++				width = <128>;
++				reset-gpios = <&gpio 25 1>;
++				dc-gpios = <&gpio 24 0>;
++				debug = <0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		speed     = <&ss18>,"spi-max-frequency:0";
++		rotate    = <&ss18>,"rotate:0";
++		fps       = <&ss18>,"fps:0";
++		bgr       = <&ss18>,"bgr?";
++		debug     = <&ss18>,"debug:0";
++		dc_pin    = <&ss18>,"dc-gpios:4";
++		reset_pin = <&ss18>,"reset-gpios:4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts b/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
+new file mode 100644
+index 000000000000..04d74d62897b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
+@@ -0,0 +1,43 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			sc16is750: sc16is750@48 {
++				compatible = "nxp,sc16is750";
++				reg = <0x48>; /* i2c address */
++				clocks = <&sc16is750_clk>;
++				interrupt-parent = <&gpio>;
++				interrupts = <24 2>; /* IRQ_TYPE_EDGE_FALLING */
++				gpio-controller;
++				#gpio-cells = <2>;
++				i2c-max-frequency = <400000>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			sc16is750_clk: sc16is750_i2c_clk@48 {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <14745600>;
++			};
++		};
++	};
++
++	__overrides__ {
++		int_pin = <&sc16is750>,"interrupts:0";
++		addr = <&sc16is750>,"reg:0", <&sc16is750_clk>,"name";
++		xtal = <&sc16is750_clk>,"clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts b/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
+new file mode 100644
+index 000000000000..da05e981314c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
+@@ -0,0 +1,43 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			sc16is752: sc16is752@48 {
++				compatible = "nxp,sc16is752";
++				reg = <0x48>; /* i2c address */
++				clocks = <&sc16is752_clk>;
++				interrupt-parent = <&gpio>;
++				interrupts = <24 2>; /* IRQ_TYPE_EDGE_FALLING */
++				gpio-controller;
++				#gpio-cells = <2>;
++				i2c-max-frequency = <400000>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			sc16is752_clk: sc16is752_i2c_clk@48 {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <14745600>;
++			};
++		};
++	};
++
++	__overrides__ {
++		int_pin = <&sc16is752>,"interrupts:0";
++		addr = <&sc16is752>,"reg:0",<&sc16is752_clk>,"name";
++		xtal = <&sc16is752_clk>,"clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sc16is752-spi0-overlay.dts b/arch/arm/boot/dts/overlays/sc16is752-spi0-overlay.dts
+new file mode 100644
+index 000000000000..a49a04722b99
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sc16is752-spi0-overlay.dts
+@@ -0,0 +1,49 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			sc16is752: sc16is752@0 {
++				compatible = "nxp,sc16is752";
++				reg = <0>; /* CE0 */
++				clocks = <&sc16is752_clk>;
++				interrupt-parent = <&gpio>;
++				interrupts = <24 2>; /* IRQ_TYPE_EDGE_FALLING */
++				gpio-controller;
++				#gpio-cells = <2>;
++				spi-max-frequency = <4000000>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target-path = "/";
++		__overlay__ {
++			sc16is752_clk: sc16is752_spi0_0_clk {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <14745600>;
++			};
++		};
++	};
++
++	__overrides__ {
++		int_pin = <&sc16is752>,"interrupts:0";
++		xtal = <&sc16is752_clk>,"clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sc16is752-spi1-overlay.dts b/arch/arm/boot/dts/overlays/sc16is752-spi1-overlay.dts
+new file mode 100644
+index 000000000000..730c6e8cd614
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sc16is752-spi1-overlay.dts
+@@ -0,0 +1,67 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			spi1_pins: spi1_pins {
++				brcm,pins = <19 20 21>;
++				brcm,function = <3>; /* alt4 */
++			};
++
++			spi1_cs_pins: spi1_cs_pins {
++				brcm,pins = <18>;
++				brcm,function = <1>; /* output */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&spi1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&spi1_pins &spi1_cs_pins>;
++			cs-gpios = <&gpio 18 1>;
++			status = "okay";
++
++			sc16is752: sc16is752@0 {
++				compatible = "nxp,sc16is752";
++				reg = <0>; /* CE0 */
++				clocks = <&sc16is752_clk>;
++				interrupt-parent = <&gpio>;
++				interrupts = <24 2>; /* IRQ_TYPE_EDGE_FALLING */
++				gpio-controller;
++				#gpio-cells = <2>;
++				spi-max-frequency = <4000000>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&aux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target-path = "/";
++		__overlay__ {
++			sc16is752_clk: sc16is752_spi1_0_clk {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <14745600>;
++			};
++		};
++	};
++
++	__overrides__ {
++		int_pin = <&sc16is752>,"interrupts:0";
++		xtal = <&sc16is752_clk>,"clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sdhost-overlay.dts b/arch/arm/boot/dts/overlays/sdhost-overlay.dts
+new file mode 100644
+index 000000000000..0b72b4eeac88
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sdhost-overlay.dts
+@@ -0,0 +1,38 @@
++/dts-v1/;
++/plugin/;
++
++/* Provide backwards compatible aliases for the old sdhost dtparams. */
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&sdhost>;
++		frag0: __overlay__ {
++			brcm,overclock-50 = <0>;
++			brcm,pio-limit = <1>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&mmc>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&mmcnr>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	__overrides__ {
++		overclock_50     = <&frag0>,"brcm,overclock-50:0";
++		force_pio        = <&frag0>,"brcm,force-pio?";
++		pio_limit        = <&frag0>,"brcm,pio-limit:0";
++		debug            = <&frag0>,"brcm,debug?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sdio-overlay.dts b/arch/arm/boot/dts/overlays/sdio-overlay.dts
+new file mode 100644
+index 000000000000..873e49056379
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sdio-overlay.dts
+@@ -0,0 +1,77 @@
++/dts-v1/;
++/plugin/;
++
++/* Enable SDIO from MMC interface via various GPIO groups */
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&mmcnr>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&mmc>;
++		sdio_ovl: __overlay__ {
++			pinctrl-0 = <&sdio_ovl_pins>;
++			pinctrl-names = "default";
++			non-removable;
++			bus-width = <4>;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			sdio_ovl_pins: sdio_ovl_pins {
++				brcm,pins = <22 23 24 25 26 27>;
++				brcm,function = <7>; /* ALT3 = SD1 */
++				brcm,pull = <0 2 2 2 2 2>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sdio_ovl_pins>;
++		__dormant__ {
++			brcm,pins = <22 23 24 25>;
++			brcm,pull = <0 2 2 2>;
++		};
++	};
++
++	fragment@4 {
++		target = <&sdio_ovl_pins>;
++		__dormant__ {
++			brcm,pins = <34 35 36 37>;
++			brcm,pull = <0 2 2 2>;
++		};
++	};
++
++	fragment@5 {
++		target = <&sdio_ovl_pins>;
++		__dormant__ {
++			brcm,pins = <34 35 36 37 38 39>;
++			brcm,pull = <0 2 2 2 2 2>;
++		};
++	};
++
++	fragment@6 {
++		target-path = "/aliases";
++		__overlay__ {
++			mmc1 = "/soc/mmc@7e300000";
++		};
++	};
++
++	__overrides__ {
++		poll_once = <&sdio_ovl>,"non-removable?";
++		bus_width = <&sdio_ovl>,"bus-width:0";
++		sdio_overclock = <&sdio_ovl>,"brcm,overclock-50:0";
++		gpios_22_25 = <0>,"=3";
++		gpios_34_37 = <0>,"=4";
++		gpios_34_39 = <0>,"=5";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/seeed-can-fd-hat-v1-overlay.dts b/arch/arm/boot/dts/overlays/seeed-can-fd-hat-v1-overlay.dts
+new file mode 100644
+index 000000000000..210d027a073e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/seeed-can-fd-hat-v1-overlay.dts
+@@ -0,0 +1,138 @@
++// redo: ovmerge -c spi1-1cs-overlay.dts,cs0_pin=18,cs0_spidev=false mcp251xfd-overlay.dts,spi0-0,interrupt=25 mcp251xfd-overlay.dts,spi1-0,interrupt=24
++
++// Device tree overlay for https://www.seeedstudio.com/2-Channel-CAN-BUS-FD-Shield-for-Raspberry-Pi-p-4072.html
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			spi1_pins: spi1_pins {
++				brcm,pins = <19 20 21>;
++				brcm,function = <3>;
++			};
++			spi1_cs_pins: spi1_cs_pins {
++				brcm,pins = <18>;
++				brcm,function = <1>;
++			};
++		};
++	};
++	fragment@1 {
++		target = <&spi1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&spi1_pins &spi1_cs_pins>;
++			cs-gpios = <&gpio 18 1>;
++			status = "okay";
++			spidev@0 {
++				compatible = "spidev";
++				reg = <0>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "disabled";
++			};
++		};
++	};
++	fragment@2 {
++		target = <&aux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@3 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@4 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp251xfd_pins: mcp251xfd_spi0_0_pins {
++				brcm,pins = <25>;
++				brcm,function = <BCM2835_FSEL_GPIO_IN>;
++			};
++		};
++	};
++	fragment@5 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_mcp251xfd_osc: mcp251xfd-spi0-0-osc {
++				#clock-cells = <0>;
++				compatible = "fixed-clock";
++				clock-frequency = <40000000>;
++			};
++		};
++	};
++	fragment@6 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			mcp251xfd@0 {
++				compatible = "microchip,mcp251xfd";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp251xfd_pins>;
++				spi-max-frequency = <20000000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <25 IRQ_TYPE_LEVEL_LOW>;
++				clocks = <&clk_mcp251xfd_osc>;
++			};
++		};
++	};
++	fragment@7 {
++		target-path = "spi1/spidev@0";
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@8 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp251xfd_pins_1: mcp251xfd_spi1_0_pins {
++				brcm,pins = <24>;
++				brcm,function = <BCM2835_FSEL_GPIO_IN>;
++			};
++		};
++	};
++	fragment@9 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_mcp251xfd_osc_1: mcp251xfd-spi1-0-osc {
++				#clock-cells = <0>;
++				compatible = "fixed-clock";
++				clock-frequency = <40000000>;
++			};
++		};
++	};
++	fragment@10 {
++		target = <&spi1>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			mcp251xfd@0 {
++				compatible = "microchip,mcp251xfd";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp251xfd_pins_1>;
++				spi-max-frequency = <20000000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <24 IRQ_TYPE_LEVEL_LOW>;
++				clocks = <&clk_mcp251xfd_osc_1>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/seeed-can-fd-hat-v2-overlay.dts b/arch/arm/boot/dts/overlays/seeed-can-fd-hat-v2-overlay.dts
+new file mode 100644
+index 000000000000..e843d0b19745
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/seeed-can-fd-hat-v2-overlay.dts
+@@ -0,0 +1,117 @@
++// redo: ovmerge -c mcp251xfd-overlay.dts,spi0-0,interrupt=25 mcp251xfd-overlay.dts,spi0-1,interrupt=24 i2c-rtc-overlay.dts,pcf85063
++
++// Device tree overlay for https://www.seeedstudio.com/CAN-BUS-FD-HAT-for-Raspberry-Pi-p-4742.html 
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp251xfd_pins: mcp251xfd_spi0_0_pins {
++				brcm,pins = <25>;
++				brcm,function = <BCM2835_FSEL_GPIO_IN>;
++			};
++		};
++	};
++	fragment@2 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_mcp251xfd_osc: mcp251xfd-spi0-0-osc {
++				#clock-cells = <0>;
++				compatible = "fixed-clock";
++				clock-frequency = <40000000>;
++			};
++		};
++	};
++	fragment@3 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			mcp251xfd@0 {
++				compatible = "microchip,mcp251xfd";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp251xfd_pins>;
++				spi-max-frequency = <20000000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <25 IRQ_TYPE_LEVEL_LOW>;
++				clocks = <&clk_mcp251xfd_osc>;
++			};
++		};
++	};
++	fragment@4 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@5 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp251xfd_pins_1: mcp251xfd_spi0_1_pins {
++				brcm,pins = <24>;
++				brcm,function = <BCM2835_FSEL_GPIO_IN>;
++			};
++		};
++	};
++	fragment@6 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_mcp251xfd_osc_1: mcp251xfd-spi0-1-osc {
++				#clock-cells = <0>;
++				compatible = "fixed-clock";
++				clock-frequency = <40000000>;
++			};
++		};
++	};
++	fragment@7 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			mcp251xfd@1 {
++				compatible = "microchip,mcp251xfd";
++				reg = <1>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp251xfd_pins_1>;
++				spi-max-frequency = <20000000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <24 IRQ_TYPE_LEVEL_LOW>;
++				clocks = <&clk_mcp251xfd_osc_1>;
++			};
++		};
++	};
++	fragment@8 {
++		target = <&i2cbus>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			pcf85063@51 {
++				compatible = "nxp,pcf85063";
++				reg = <0x51>;
++			};
++		};
++	};
++	fragment@9 {
++		target = <&i2c_arm>;
++		i2cbus: __overlay__ {
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sh1106-spi-overlay.dts b/arch/arm/boot/dts/overlays/sh1106-spi-overlay.dts
+new file mode 100644
+index 000000000000..57a0cc9b1741
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sh1106-spi-overlay.dts
+@@ -0,0 +1,84 @@
++/*
++ * Device Tree overlay for SH1106 based SPI OLED display
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			sh1106_pins: sh1106_pins {
++                                brcm,pins = <25 24>;
++                                brcm,function = <1 1>; /* out out */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sh1106: sh1106@0{
++				compatible = "sinowealth,sh1106";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&sh1106_pins>;
++
++				spi-max-frequency = <4000000>;
++				bgr = <0>;
++				bpp = <1>;
++				rotate = <0>;
++				fps = <25>;
++				buswidth = <8>;
++				reset-gpios = <&gpio 25 1>;
++				dc-gpios = <&gpio 24 0>;
++				debug = <0>;
++
++				sinowealth,height = <64>;
++				sinowealth,width = <128>;
++				sinowealth,page-offset = <0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		speed     = <&sh1106>,"spi-max-frequency:0";
++		rotate    = <&sh1106>,"rotate:0";
++		fps       = <&sh1106>,"fps:0";
++		debug     = <&sh1106>,"debug:0";
++		dc_pin    = <&sh1106>,"dc-gpios:4",
++		            <&sh1106_pins>,"brcm,pins:4";
++		reset_pin = <&sh1106>,"reset-gpios:4",
++		            <&sh1106_pins>,"brcm,pins:0";
++		height    = <&sh1106>,"sinowealth,height:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/si446x-spi0-overlay.dts b/arch/arm/boot/dts/overlays/si446x-spi0-overlay.dts
+new file mode 100644
+index 000000000000..90495f0941fb
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/si446x-spi0-overlay.dts
+@@ -0,0 +1,53 @@
++// Overlay for the SiLabs Si446X Controller - SPI0
++// Default Interrupt Pin: 17
++// Default SDN Pin: 27
++/dts-v1/;
++/plugin/;
++
++   / {
++    compatible = "brcm,bcm2835";
++
++    fragment@0 {
++        target = <&spi0>;
++        __overlay__ {
++            // needed to avoid dtc warning
++            #address-cells = <1>;
++            #size-cells = <0>;
++
++            status = "okay";
++
++            uhf0: si446x@0{
++                compatible = "silabs,si446x";
++                reg = <0>; // CE0
++                pinctrl-names = "default";
++                pinctrl-0 = <&uhf0_pins>;
++                interrupt-parent = <&gpio>;
++                interrupts = <17 0x2>; // falling edge
++                spi-max-frequency = <4000000>;
++                sdn_pin = <27>;
++                irq_pin = <17>;
++                status = "okay";
++            };
++        };
++    };
++
++    fragment@1 {
++        target = <&gpio>;
++        __overlay__ {
++            uhf0_pins: uhf0_pins {
++                brcm,pins = <17 27>;
++                brcm,function = <0 1>; // in, out
++                brcm,pull = <2 0>; // high, none
++            };
++        };
++    };
++
++    __overrides__ {
++        int_pin = <&uhf0>, "interrupts:0",
++                  <&uhf0>, "irq_pin:0",
++                  <&uhf0_pins>, "brcm,pins:0";
++        reset_pin = <&uhf0>, "sdn_pin:0",
++                    <&uhf0_pins>, "brcm,pins:4";
++        speed   = <&uhf0>, "spi-max-frequency:0";
++    };
++};
+diff --git a/arch/arm/boot/dts/overlays/smi-dev-overlay.dts b/arch/arm/boot/dts/overlays/smi-dev-overlay.dts
+new file mode 100644
+index 000000000000..bafab6c92506
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/smi-dev-overlay.dts
+@@ -0,0 +1,20 @@
++// Description: Overlay to enable character device interface for SMI.
++// Author:	Luke Wren <luke@raspberrypi.org>
++
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&soc>;
++		__overlay__ {
++			smi_dev {
++				compatible = "brcm,bcm2835-smi-dev";
++				smi_handle = <&smi>;
++				status = "okay";
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/smi-nand-overlay.dts b/arch/arm/boot/dts/overlays/smi-nand-overlay.dts
+new file mode 100644
+index 000000000000..ae1e50329d66
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/smi-nand-overlay.dts
+@@ -0,0 +1,66 @@
++// Description: Overlay to enable NAND flash through
++// the secondary memory interface
++// Author:	Luke Wren
++
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&smi>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&smi_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&soc>;
++		__overlay__ {
++			nand: flash@0 {
++				compatible = "brcm,bcm2835-smi-nand";
++				smi_handle = <&smi>;
++				#address-cells = <1>;
++				#size-cells = <1>;
++				status = "okay";
++
++				partition@0 {
++					label = "stage2";
++					// 128k
++					reg = <0 0x20000>;
++					read-only;
++				};
++				partition@1 {
++					label = "firmware";
++					// 16M
++					reg = <0x20000 0x1000000>;
++					read-only;
++				};
++				partition@2 {
++					label = "root";
++					// 2G (will need to use 64 bit for >=4G)
++					reg = <0x1020000 0x80000000>;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			smi_pins: smi_pins {
++				brcm,pins = <0 1 2 3 4 5 6 7 8 9 10 11
++					12 13 14 15>;
++				/* Alt 1: SMI */
++				brcm,function = <5 5 5 5 5 5 5 5 5 5 5
++					5 5 5 5 5>;
++				/* /CS, /WE and /OE are pulled high, as they are
++				   generally active low signals */
++				brcm,pull = <2 2 2 2 2 2 2 2 0 0 0 0 0 0 0 0>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/smi-overlay.dts b/arch/arm/boot/dts/overlays/smi-overlay.dts
+new file mode 100644
+index 000000000000..bb8c7830df23
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/smi-overlay.dts
+@@ -0,0 +1,37 @@
++// Description:	Overlay to enable the secondary memory interface peripheral
++// Author:	Luke Wren
++
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&smi>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&smi_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			smi_pins: smi_pins {
++				/* Don't configure the top two address bits, as
++				   these are already used as ID_SD and ID_SC */
++				brcm,pins = <2 3 4 5 6 7 8 9 10 11 12 13 14 15
++					     16 17 18 19 20 21 22 23 24 25>;
++				/* Alt 1: SMI */
++				brcm,function = <5 5 5 5 5 5 5 5 5 5 5 5 5 5 5
++						 5 5 5 5 5 5 5 5 5>;
++				/* /CS, /WE and /OE are pulled high, as they are
++				   generally active low signals */
++				brcm,pull = <2 2 2 2 2 2 0 0 0 0 0 0 0 0 0 0 0
++					     0 0 0 0 0 0 0>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi-gpio35-39-overlay.dts b/arch/arm/boot/dts/overlays/spi-gpio35-39-overlay.dts
+new file mode 100644
+index 000000000000..a132b8637c31
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi-gpio35-39-overlay.dts
+@@ -0,0 +1,31 @@
++/*
++ * Device tree overlay to move spi0 to gpio 35 to 39 on CM
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			cs-gpios = <&gpio 36 1>, <&gpio 35 1>;
++		};
++	};
++
++	fragment@1 {
++		target = <&spi0_cs_pins>;
++		__overlay__ {
++			brcm,pins = <36 35>;
++		};
++	};
++
++	fragment@2 {
++		target = <&spi0_pins>;
++		__overlay__ {
++			brcm,pins = <37 38 39>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi-gpio40-45-overlay.dts b/arch/arm/boot/dts/overlays/spi-gpio40-45-overlay.dts
+new file mode 100644
+index 000000000000..9ebcaf1b5ea0
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi-gpio40-45-overlay.dts
+@@ -0,0 +1,36 @@
++/*
++ * Boot EEPROM overlay
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			cs-gpios = <&gpio 43 1>, <&gpio 44 1>, <&gpio 45 1>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spi0_cs_pins>;
++		__overlay__ {
++			brcm,pins = <45 44 43>;
++			brcm,function = <1>; /* output */
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&spi0_pins>;
++		__overlay__ {
++			brcm,pins = <40 41 42>;
++			brcm,function = <3>; /* alt4 */
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi-rtc-overlay.dts b/arch/arm/boot/dts/overlays/spi-rtc-overlay.dts
+new file mode 100644
+index 000000000000..51b7fec281c0
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi-rtc-overlay.dts
+@@ -0,0 +1,75 @@
++// Definitions for several SPI-based Real Time Clocks
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&rtc>;
++		__dormant__ {
++			compatible = "maxim,ds3232";
++		};
++	};
++
++	fragment@1 {
++		target = <&rtc>;
++		__dormant__ {
++			compatible = "maxim,ds3234";
++		};
++	};
++
++	fragment@2 {
++		target = <&rtc>;
++		__dormant__ {
++			compatible = "nxp,rtc-pcf2123";
++		};
++	};
++
++	spidev: fragment@100 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	frag101: fragment@101 {
++		target = <&spi0>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			rtc: rtc@0 {
++				reg = <0>;
++				spi-max-frequency = <5000000>;
++			};
++		};
++	};
++
++	__overrides__ {
++		spi0_0 = <&spidev>, "target:0=",<&spidev0>,
++		         <&frag101>, "target:0=",<&spi0>,
++		         <&rtc>, "reg:0=0";
++		spi0_1 = <&spidev>, "target:0=",<&spidev1>,
++		         <&frag101>, "target:0=",<&spi0>,
++		         <&rtc>, "reg:0=1";
++		spi1_0 = <0>,"-100",
++		         <&frag101>, "target:0=",<&spi1>,
++		         <&rtc>, "reg:0=0";
++		spi1_1 = <0>,"-100",
++		         <&frag101>, "target:0=",<&spi1>,
++		         <&rtc>, "reg:0=1";
++		spi2_0 = <0>,"-100",
++		         <&frag101>, "target:0=",<&spi2>,
++		         <&rtc>, "reg:0=0";
++		spi2_1 = <0>,"-100",
++		         <&frag101>, "target:0=",<&spi2>,
++		         <&rtc>, "reg:0=1";
++		cs_high = <&rtc>, "spi-cs-high?";
++
++		ds3232 = <0>,"+0";
++		ds3234 = <0>,"+1";
++		pcf2123 = <0>,"+2";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi0-0cs-overlay.dts b/arch/arm/boot/dts/overlays/spi0-0cs-overlay.dts
+new file mode 100644
+index 000000000000..0d2acabf56a4
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi0-0cs-overlay.dts
+@@ -0,0 +1,39 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins;
++		};
++	};
++
++	fragment@1 {
++		target = <&spi0>;
++		__overlay__ {
++			cs-gpios;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&spi0_pins>;
++		__dormant__ {
++			brcm,pins = <10 11>;
++		};
++	};
++
++	__overrides__ {
++		no_miso = <0>,"=3";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi0-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi0-1cs-overlay.dts
+new file mode 100644
+index 000000000000..e6eb66e2076a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi0-1cs-overlay.dts
+@@ -0,0 +1,42 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <8>;
++		};
++	};
++
++	fragment@1 {
++		target = <&spi0>;
++		frag1: __overlay__ {
++			cs-gpios = <&gpio 8 1>;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&spi0_pins>;
++		__dormant__ {
++			brcm,pins = <10 11>;
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		no_miso = <0>,"=3";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi0-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi0-2cs-overlay.dts
+new file mode 100644
+index 000000000000..df6519537c3a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi0-2cs-overlay.dts
+@@ -0,0 +1,37 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <8 7>;
++		};
++	};
++
++	fragment@1 {
++		target = <&spi0>;
++		frag1: __overlay__ {
++			cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&spi0_pins>;
++		__dormant__ {
++			brcm,pins = <10 11>;
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs1_pin  = <&frag0>,"brcm,pins:4",
++			   <&frag1>,"cs-gpios:16";
++		no_miso = <0>,"=2";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi1-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi1-1cs-overlay.dts
+new file mode 100644
+index 000000000000..ea2794bc5fd5
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi1-1cs-overlay.dts
+@@ -0,0 +1,57 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			spi1_pins: spi1_pins {
++				brcm,pins = <19 20 21>;
++				brcm,function = <3>; /* alt4 */
++			};
++
++			spi1_cs_pins: spi1_cs_pins {
++				brcm,pins = <18>;
++				brcm,function = <1>; /* output */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&spi1>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&spi1_pins &spi1_cs_pins>;
++			cs-gpios = <&gpio 18 1>;
++			status = "okay";
++
++			spidev1_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&aux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&spi1_cs_pins>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs0_spidev = <&spidev1_0>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi1-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi1-2cs-overlay.dts
+new file mode 100644
+index 000000000000..dab34ee79ae2
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi1-2cs-overlay.dts
+@@ -0,0 +1,69 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			spi1_pins: spi1_pins {
++				brcm,pins = <19 20 21>;
++				brcm,function = <3>; /* alt4 */
++			};
++
++			spi1_cs_pins: spi1_cs_pins {
++				brcm,pins = <18 17>;
++				brcm,function = <1>; /* output */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&spi1>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&spi1_pins &spi1_cs_pins>;
++			cs-gpios = <&gpio 18 1>, <&gpio 17 1>;
++			status = "okay";
++
++			spidev1_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev1_1: spidev@1 {
++				compatible = "spidev";
++				reg = <1>;      /* CE1 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&aux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&spi1_cs_pins>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs1_pin  = <&spi1_cs_pins>,"brcm,pins:4",
++			   <&frag1>,"cs-gpios:16";
++		cs0_spidev = <&spidev1_0>,"status";
++		cs1_spidev = <&spidev1_1>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi1-3cs-overlay.dts b/arch/arm/boot/dts/overlays/spi1-3cs-overlay.dts
+new file mode 100644
+index 000000000000..bc7e7d04324b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi1-3cs-overlay.dts
+@@ -0,0 +1,81 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			spi1_pins: spi1_pins {
++				brcm,pins = <19 20 21>;
++				brcm,function = <3>; /* alt4 */
++			};
++
++			spi1_cs_pins: spi1_cs_pins {
++				brcm,pins = <18 17 16>;
++				brcm,function = <1>; /* output */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&spi1>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&spi1_pins &spi1_cs_pins>;
++			cs-gpios = <&gpio 18 1>, <&gpio 17 1>, <&gpio 16 1>;
++			status = "okay";
++
++			spidev1_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev1_1: spidev@1 {
++				compatible = "spidev";
++				reg = <1>;      /* CE1 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev1_2: spidev@2 {
++				compatible = "spidev";
++				reg = <2>;      /* CE2 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&aux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&spi1_cs_pins>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs1_pin  = <&spi1_cs_pins>,"brcm,pins:4",
++			   <&frag1>,"cs-gpios:16";
++		cs2_pin  = <&spi1_cs_pins>,"brcm,pins:8",
++			   <&frag1>,"cs-gpios:28";
++		cs0_spidev = <&spidev1_0>,"status";
++		cs1_spidev = <&spidev1_1>,"status";
++		cs2_spidev = <&spidev1_2>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi2-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi2-1cs-overlay.dts
+new file mode 100644
+index 000000000000..2a29750462af
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi2-1cs-overlay.dts
+@@ -0,0 +1,57 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			spi2_pins: spi2_pins {
++				brcm,pins = <40 41 42>;
++				brcm,function = <3>; /* alt4 */
++			};
++
++			spi2_cs_pins: spi2_cs_pins {
++				brcm,pins = <43>;
++				brcm,function = <1>; /* output */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&spi2>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&spi2_pins &spi2_cs_pins>;
++			cs-gpios = <&gpio 43 1>;
++			status = "okay";
++
++			spidev2_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&aux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&spi2_cs_pins>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs0_spidev = <&spidev2_0>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi2-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi2-2cs-overlay.dts
+new file mode 100644
+index 000000000000..642678fc9ddd
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi2-2cs-overlay.dts
+@@ -0,0 +1,69 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			spi2_pins: spi2_pins {
++				brcm,pins = <40 41 42>;
++				brcm,function = <3>; /* alt4 */
++			};
++
++			spi2_cs_pins: spi2_cs_pins {
++				brcm,pins = <43 44>;
++				brcm,function = <1>; /* output */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&spi2>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&spi2_pins &spi2_cs_pins>;
++			cs-gpios = <&gpio 43 1>, <&gpio 44 1>;
++			status = "okay";
++
++			spidev2_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev2_1: spidev@1 {
++				compatible = "spidev";
++				reg = <1>;      /* CE1 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&aux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&spi2_cs_pins>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs1_pin  = <&spi2_cs_pins>,"brcm,pins:4",
++			   <&frag1>,"cs-gpios:16";
++		cs0_spidev = <&spidev2_0>,"status";
++		cs1_spidev = <&spidev2_1>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi2-3cs-overlay.dts b/arch/arm/boot/dts/overlays/spi2-3cs-overlay.dts
+new file mode 100644
+index 000000000000..28d40c6c3c37
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi2-3cs-overlay.dts
+@@ -0,0 +1,81 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			spi2_pins: spi2_pins {
++				brcm,pins = <40 41 42>;
++				brcm,function = <3>; /* alt4 */
++			};
++
++			spi2_cs_pins: spi2_cs_pins {
++				brcm,pins = <43 44 45>;
++				brcm,function = <1>; /* output */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&spi2>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&spi2_pins &spi2_cs_pins>;
++			cs-gpios = <&gpio 43 1>, <&gpio 44 1>, <&gpio 45 1>;
++			status = "okay";
++
++			spidev2_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev2_1: spidev@1 {
++				compatible = "spidev";
++				reg = <1>;      /* CE1 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev2_2: spidev@2 {
++				compatible = "spidev";
++				reg = <2>;      /* CE2 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&aux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&spi2_cs_pins>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs1_pin  = <&spi2_cs_pins>,"brcm,pins:4",
++			   <&frag1>,"cs-gpios:16";
++		cs2_pin  = <&spi2_cs_pins>,"brcm,pins:8",
++			   <&frag1>,"cs-gpios:28";
++		cs0_spidev = <&spidev2_0>,"status";
++		cs1_spidev = <&spidev2_1>,"status";
++		cs2_spidev = <&spidev2_2>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi3-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi3-1cs-overlay.dts
+new file mode 100644
+index 000000000000..335af8637051
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi3-1cs-overlay.dts
+@@ -0,0 +1,44 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&spi3_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <0>;
++			brcm,function = <1>; /* output */
++		};
++	};
++
++	fragment@1 {
++		target = <&spi3>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pinctrl-names = "default";
++		        pinctrl-0 = <&spi3_pins &spi3_cs_pins>;
++			cs-gpios = <&gpio 0 1>;
++			status = "okay";
++
++			spidev3_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs0_spidev = <&spidev3_0>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi3-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi3-2cs-overlay.dts
+new file mode 100644
+index 000000000000..ce65da27f767
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi3-2cs-overlay.dts
+@@ -0,0 +1,56 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&spi3_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <0 24>;
++			brcm,function = <1>; /* output */
++		};
++	};
++
++	fragment@1 {
++		target = <&spi3>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pinctrl-names = "default";
++		        pinctrl-0 = <&spi3_pins &spi3_cs_pins>;
++			cs-gpios = <&gpio 0 1>, <&gpio 24 1>;
++			status = "okay";
++
++			spidev3_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev3_1: spidev@1 {
++				compatible = "spidev";
++				reg = <1>;      /* CE1 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs1_pin  = <&frag0>,"brcm,pins:4",
++			   <&frag1>,"cs-gpios:16";
++		cs0_spidev = <&spidev3_0>,"status";
++		cs1_spidev = <&spidev3_1>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi4-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi4-1cs-overlay.dts
+new file mode 100644
+index 000000000000..85d70b40352b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi4-1cs-overlay.dts
+@@ -0,0 +1,44 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&spi4_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <4>;
++			brcm,function = <1>; /* output */
++		};
++	};
++
++	fragment@1 {
++		target = <&spi4>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pinctrl-names = "default";
++		        pinctrl-0 = <&spi4_pins &spi4_cs_pins>;
++			cs-gpios = <&gpio 4 1>;
++			status = "okay";
++
++			spidev4_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs0_spidev = <&spidev4_0>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi4-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi4-2cs-overlay.dts
+new file mode 100644
+index 000000000000..8bc2215a6a7e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi4-2cs-overlay.dts
+@@ -0,0 +1,56 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&spi4_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <4 25>;
++			brcm,function = <1>; /* output */
++		};
++	};
++
++	fragment@1 {
++		target = <&spi4>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pinctrl-names = "default";
++		        pinctrl-0 = <&spi4_pins &spi4_cs_pins>;
++			cs-gpios = <&gpio 4 1>, <&gpio 25 1>;
++			status = "okay";
++
++			spidev4_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev4_1: spidev@1 {
++				compatible = "spidev";
++				reg = <1>;      /* CE1 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs1_pin  = <&frag0>,"brcm,pins:4",
++			   <&frag1>,"cs-gpios:16";
++		cs0_spidev = <&spidev4_0>,"status";
++		cs1_spidev = <&spidev4_1>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi5-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi5-1cs-overlay.dts
+new file mode 100644
+index 000000000000..c0f8cb8510ee
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi5-1cs-overlay.dts
+@@ -0,0 +1,44 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&spi5_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <12>;
++			brcm,function = <1>; /* output */
++		};
++	};
++
++	fragment@1 {
++		target = <&spi5>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pinctrl-names = "default";
++		        pinctrl-0 = <&spi5_pins &spi5_cs_pins>;
++			cs-gpios = <&gpio 12 1>;
++			status = "okay";
++
++			spidev5_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs0_spidev = <&spidev5_0>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi5-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi5-2cs-overlay.dts
+new file mode 100644
+index 000000000000..7758b9c00b4e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi5-2cs-overlay.dts
+@@ -0,0 +1,56 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&spi5_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <12 26>;
++			brcm,function = <1>; /* output */
++		};
++	};
++
++	fragment@1 {
++		target = <&spi5>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pinctrl-names = "default";
++		        pinctrl-0 = <&spi5_pins &spi5_cs_pins>;
++			cs-gpios = <&gpio 12 1>, <&gpio 26 1>;
++			status = "okay";
++
++			spidev5_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev5_1: spidev@1 {
++				compatible = "spidev";
++				reg = <1>;      /* CE1 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs1_pin  = <&frag0>,"brcm,pins:4",
++			   <&frag1>,"cs-gpios:16";
++		cs0_spidev = <&spidev5_0>,"status";
++		cs1_spidev = <&spidev5_1>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi6-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi6-1cs-overlay.dts
+new file mode 100644
+index 000000000000..8c8a953eca01
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi6-1cs-overlay.dts
+@@ -0,0 +1,44 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&spi6_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <18>;
++			brcm,function = <1>; /* output */
++		};
++	};
++
++	fragment@1 {
++		target = <&spi6>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pinctrl-names = "default";
++		        pinctrl-0 = <&spi6_pins &spi6_cs_pins>;
++			cs-gpios = <&gpio 18 1>;
++			status = "okay";
++
++			spidev6_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs0_spidev = <&spidev6_0>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi6-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi6-2cs-overlay.dts
+new file mode 100644
+index 000000000000..2ff897f21aed
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi6-2cs-overlay.dts
+@@ -0,0 +1,56 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&spi6_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <18 27>;
++			brcm,function = <1>; /* output */
++		};
++	};
++
++	fragment@1 {
++		target = <&spi6>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pinctrl-names = "default";
++		        pinctrl-0 = <&spi6_pins &spi6_cs_pins>;
++			cs-gpios = <&gpio 18 1>, <&gpio 27 1>;
++			status = "okay";
++
++			spidev6_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev6_1: spidev@1 {
++				compatible = "spidev";
++				reg = <1>;      /* CE1 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs1_pin  = <&frag0>,"brcm,pins:4",
++			   <&frag1>,"cs-gpios:16";
++		cs0_spidev = <&spidev6_0>,"status";
++		cs1_spidev = <&spidev6_1>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/ssd1306-overlay.dts b/arch/arm/boot/dts/overlays/ssd1306-overlay.dts
+new file mode 100644
+index 000000000000..84cf10e489d3
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ssd1306-overlay.dts
+@@ -0,0 +1,36 @@
++// Overlay for SSD1306 128x64 and 128x32 OLED displays
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++
++    fragment@0 {
++	target = <&i2c1>;
++	__overlay__ {
++	    status = "okay";
++
++	    #address-cells = <1>;
++	    #size-cells = <0>;
++
++	    ssd1306: oled@3c{
++		compatible = "solomon,ssd1306fb-i2c";
++		reg = <0x3c>;
++		solomon,width = <128>;
++		solomon,height = <64>;
++		solomon,page-offset = <0>;
++	    };
++	};
++    };
++
++    __overrides__ {
++	address = <&ssd1306>,"reg:0";
++	width = <&ssd1306>,"solomon,width:0";
++	height = <&ssd1306>,"solomon,height:0";
++	offset = <&ssd1306>,"solomon,page-offset:0";
++	normal = <&ssd1306>,"solomon,segment-no-remap?";
++	sequential = <&ssd1306>,"solomon,com-seq?";
++	remapped = <&ssd1306>,"solomon,com-lrremap?";
++	inverted = <&ssd1306>,"solomon,com-invdir?";
++    };
++};
+diff --git a/arch/arm/boot/dts/overlays/ssd1306-spi-overlay.dts b/arch/arm/boot/dts/overlays/ssd1306-spi-overlay.dts
+new file mode 100644
+index 000000000000..ffc90c7cecf6
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ssd1306-spi-overlay.dts
+@@ -0,0 +1,84 @@
++/*
++ * Device Tree overlay for SSD1306 based SPI OLED display
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			ssd1306_pins: ssd1306_pins {
++                                brcm,pins = <25 24>;
++                                brcm,function = <1 1>; /* out out */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			ssd1306: ssd1306@0{
++				compatible = "solomon,ssd1306";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&ssd1306_pins>;
++
++				spi-max-frequency = <10000000>;
++				bgr = <0>;
++				bpp = <1>;
++				rotate = <0>;
++				fps = <25>;
++				buswidth = <8>;
++				reset-gpios = <&gpio 25 1>;
++				dc-gpios = <&gpio 24 0>;
++				debug = <0>;
++
++				solomon,height = <64>;
++				solomon,width = <128>;
++				solomon,page-offset = <0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		speed     = <&ssd1306>,"spi-max-frequency:0";
++		rotate    = <&ssd1306>,"rotate:0";
++		fps       = <&ssd1306>,"fps:0";
++		debug     = <&ssd1306>,"debug:0";
++		dc_pin    = <&ssd1306>,"dc-gpios:4",
++		            <&ssd1306_pins>,"brcm,pins:4";
++		reset_pin = <&ssd1306>,"reset-gpios:4",
++		            <&ssd1306_pins>,"brcm,pins:0";
++		height    = <&ssd1306>,"solomon,height:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/ssd1331-spi-overlay.dts b/arch/arm/boot/dts/overlays/ssd1331-spi-overlay.dts
+new file mode 100644
+index 000000000000..9fd5ebf2feda
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ssd1331-spi-overlay.dts
+@@ -0,0 +1,83 @@
++/*
++ * Device Tree overlay for SSD1331 based SPI OLED display
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++        compatible = "brcm,bcm2835";
++
++        fragment@0 {
++                target = <&spi0>;
++                __overlay__ {
++                        status = "okay";
++                };
++        };
++
++        fragment@1 {
++                target = <&spidev0>;
++                __overlay__ {
++                        status = "disabled";
++                };
++        };
++
++        fragment@2 {
++                target = <&spidev1>;
++                __overlay__ {
++                        status = "disabled";
++                };
++        };
++
++        fragment@3 {
++                target = <&gpio>;
++                __overlay__ {
++                        ssd1331_pins: ssd1331_pins {
++                                brcm,pins = <25 24>;
++                                brcm,function = <1 1>; /* out out */
++                        };
++                };
++        };
++
++        fragment@4 {
++                target = <&spi0>;
++                __overlay__ {
++                        /* needed to avoid dtc warning */
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++
++                        ssd1331: ssd1331@0{
++                                compatible = "solomon,ssd1331";
++                                reg = <0>;
++                                pinctrl-names = "default";
++                                pinctrl-0 = <&ssd1331_pins>;
++
++                                spi-max-frequency = <4500000>;
++                                bgr = <0>;
++                                bpp = <16>;
++                                rotate = <0>;
++                                fps = <25>;
++                                buswidth = <8>;
++                                reset-gpios = <&gpio 25 1>;
++                                dc-gpios = <&gpio 24 0>;
++                                debug = <0>;
++
++                                solomon,height = <64>;
++                                solomon,width = <96>;
++                                solomon,page-offset = <0>;
++                        };
++                };
++        };
++
++        __overrides__ {
++                speed     = <&ssd1331>,"spi-max-frequency:0";
++                rotate    = <&ssd1331>,"rotate:0";
++                fps       = <&ssd1331>,"fps:0";
++                debug     = <&ssd1331>,"debug:0";
++                dc_pin    = <&ssd1331>,"dc-gpios:4",
++                            <&ssd1331_pins>,"brcm,pins:4";
++                reset_pin = <&ssd1331>,"reset-gpios:4",
++                            <&ssd1331_pins>,"brcm,pins:0";
++        };
++};
+diff --git a/arch/arm/boot/dts/overlays/ssd1351-spi-overlay.dts b/arch/arm/boot/dts/overlays/ssd1351-spi-overlay.dts
+new file mode 100644
+index 000000000000..ffc872c60648
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ssd1351-spi-overlay.dts
+@@ -0,0 +1,83 @@
++/*
++ * Device Tree overlay for SSD1351 based SPI OLED display
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			ssd1351_pins: ssd1351_pins {
++                                brcm,pins = <25 24>;
++                                brcm,function = <1 1>; /* out out */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			ssd1351: ssd1351@0{
++				compatible = "solomon,ssd1351";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&ssd1351_pins>;
++
++				spi-max-frequency = <4500000>;
++				bgr = <0>;
++				bpp = <16>;
++				rotate = <0>;
++				fps = <25>;
++				buswidth = <8>;
++				reset-gpios = <&gpio 25 1>;
++				dc-gpios = <&gpio 24 0>;
++				debug = <0>;
++
++				solomon,height = <128>;
++				solomon,width = <128>;
++				solomon,page-offset = <0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		speed     = <&ssd1351>,"spi-max-frequency:0";
++		rotate    = <&ssd1351>,"rotate:0";
++		fps       = <&ssd1351>,"fps:0";
++		debug     = <&ssd1351>,"debug:0";
++		dc_pin    = <&ssd1351>,"dc-gpios:4",
++		            <&ssd1351_pins>,"brcm,pins:4";
++		reset_pin = <&ssd1351>,"reset-gpios:4",
++		            <&ssd1351_pins>,"brcm,pins:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/superaudioboard-overlay.dts b/arch/arm/boot/dts/overlays/superaudioboard-overlay.dts
+new file mode 100755
+index 000000000000..bad61535981e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/superaudioboard-overlay.dts
+@@ -0,0 +1,73 @@
++// Definitions for SuperAudioBoard
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "simple-audio-card";
++			i2s-controller = <&i2s>;
++			status = "okay";
++
++			simple-audio-card,name = "SuperAudioBoard";
++
++			simple-audio-card,widgets =
++				"Line", "Line In",
++				"Line", "Line Out";
++
++			simple-audio-card,routing =
++				"Line Out","AOUTA+",
++				"Line Out","AOUTA-",
++				"Line Out","AOUTB+",
++				"Line Out","AOUTB-",
++				"AINA","Line In",
++				"AINB","Line In";
++
++			simple-audio-card,format = "i2s";
++
++			simple-audio-card,bitclock-master = <&sound_master>;
++			simple-audio-card,frame-master = <&sound_master>;
++
++			simple-audio-card,cpu {
++				sound-dai = <&i2s>;
++				dai-tdm-slot-num = <2>;
++				dai-tdm-slot-width = <32>;
++			};
++
++			sound_master: simple-audio-card,codec {
++				sound-dai = <&cs4271>;
++				system-clock-frequency = <24576000>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++    
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			cs4271: cs4271@10 {
++				#sound-dai-cells = <0>;
++				compatible = "cirrus,cs4271";
++				reg = <0x10>;
++				status = "okay";
++				reset-gpio = <&gpio 26 0>; /* Pin 26, active high */
++			};
++		};
++	};
++	__overrides__ {
++		gpiopin = <&cs4271>,"reset-gpio:4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sx150x-overlay.dts b/arch/arm/boot/dts/overlays/sx150x-overlay.dts
+new file mode 100644
+index 000000000000..1d1069345da2
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sx150x-overlay.dts
+@@ -0,0 +1,1706 @@
++// Definitions for SX150x I2C GPIO Expanders from Semtech
++
++// dtparams:
++//     sx150<x>-<n>-<m>          - Enables SX150X device on I2C#<n> with slave address <m>. <x> may be 1-9.
++//                                 <n> may be 0 or 1.  Permissible values of <m> (which is denoted in hex)
++//                                 depend on the device variant.
++//                                 For SX1501, SX1502, SX1504 and SX1505, <m> may be 20 or 21.
++//                                 For SX1503 and SX1506, <m> may be 20.
++//                                 For SX1507 and SX1509, <m> may be 3E, 3F, 70 or 71.
++//                                 For SX1508, <m> may be 20, 21, 22 or 23.
++//     sx150<x>-<n>-<m>-int-gpio - Integer, enables interrupts on SX150X device on I2C#<n> with slave address <m>,
++//                                 specifies the GPIO pin to which NINT output of SX150X is connected.
++//
++//
++// Example 1: A single SX1505 device on I2C#1 with its slave address set to 0x20 and NINT output connected to GPIO25:
++// dtoverlay=sx150x:sx1505-1-20,sx1505-1-20-int-gpio=25
++//
++// Example 2: Two SX1507 devices on I2C#0 with their slave addresses set to 0x3E and 0x70 (interrupts not used):
++// dtoverlay=sx150x:sx1507-0-3E,sx1507-0-70
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	// Enable I2C#0 interface
++	fragment@0 {
++		target = <&i2c0>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	// Enable I2C#1 interface
++	fragment@1 {
++		target = <&i2c1>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	// Enable a SX1501 on I2C#0 at slave addr 0x20
++	fragment@2 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1501_0_20: sx150x@20 {
++				compatible = "semtech,sx1501q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1501-0-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1501 on I2C#1 at slave addr 0x20
++	fragment@3 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1501_1_20: sx150x@20 {
++				compatible = "semtech,sx1501q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1501-1-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1501 on I2C#0 at slave addr 0x21
++	fragment@4 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1501_0_21: sx150x@21 {
++				compatible = "semtech,sx1501q";
++				reg = <0x21>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1501-0-21-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1501 on I2C#1 at slave addr 0x21
++	fragment@5 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1501_1_21: sx150x@21 {
++				compatible = "semtech,sx1501q";
++				reg = <0x21>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1501-1-21-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1502 on I2C#0 at slave addr 0x20
++	fragment@6 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1502_0_20: sx150x@20 {
++				compatible = "semtech,sx1502q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1502-0-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1502 on I2C#1 at slave addr 0x20
++	fragment@7 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1502_1_20: sx150x@20 {
++				compatible = "semtech,sx1502q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1502-1-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1502 on I2C#0 at slave addr 0x21
++	fragment@8 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1502_0_21: sx150x@21 {
++				compatible = "semtech,sx1502q";
++				reg = <0x21>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1502-0-21-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1502 on I2C#1 at slave addr 0x21
++	fragment@9 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1502_1_21: sx150x@21 {
++				compatible = "semtech,sx1502q";
++				reg = <0x21>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1501-1-21-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1503 on I2C#0 at slave addr 0x20
++	fragment@10 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1503_0_20: sx150x@20 {
++				compatible = "semtech,sx1503q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1503-0-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1503 on I2C#1 at slave addr 0x20
++	fragment@11 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1503_1_20: sx150x@20 {
++				compatible = "semtech,sx1503q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1503-1-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1504 on I2C#0 at slave addr 0x20
++	fragment@12 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1504_0_20: sx150x@20 {
++				compatible = "semtech,sx1504q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1504-0-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1504 on I2C#1 at slave addr 0x20
++	fragment@13 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1504_1_20: sx150x@20 {
++				compatible = "semtech,sx1504q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1504-1-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1504 on I2C#0 at slave addr 0x21
++	fragment@14 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1504_0_21: sx150x@21 {
++				compatible = "semtech,sx1504q";
++				reg = <0x21>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1504-0-21-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1504 on I2C#1 at slave addr 0x21
++	fragment@15 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1504_1_21: sx150x@21 {
++				compatible = "semtech,sx1504q";
++				reg = <0x21>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1504-1-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1505 on I2C#0 at slave addr 0x20
++	fragment@16 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1505_0_20: sx150x@20 {
++				compatible = "semtech,sx1505q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1505-0-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1505 on I2C#1 at slave addr 0x20
++	fragment@17 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1505_1_20: sx150x@20 {
++				compatible = "semtech,sx1505q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1505-1-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1505 on I2C#0 at slave addr 0x21
++	fragment@18 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1505_0_21: sx150x@21 {
++				compatible = "semtech,sx1505q";
++				reg = <0x21>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1505-0-21-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1505 on I2C#1 at slave addr 0x21
++	fragment@19 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1505_1_21: sx150x@21 {
++				compatible = "semtech,sx1505q";
++				reg = <0x21>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1505-1-21-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1506 on I2C#0 at slave addr 0x20
++	fragment@20 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1506_0_20: sx150x@20 {
++				compatible = "semtech,sx1506q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1506-0-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1506 on I2C#1 at slave addr 0x20
++	fragment@21 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1506_1_20: sx150x@20 {
++				compatible = "semtech,sx1506q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1506-1-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1507 on I2C#0 at slave addr 0x3E
++	fragment@22 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1507_0_3E: sx150x@3E {
++				compatible = "semtech,sx1507q";
++				reg = <0x3E>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1507_0_3E-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1507 on I2C#1 at slave addr 0x3E
++	fragment@23 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1507_1_3E: sx150x@3E {
++				compatible = "semtech,sx1507q";
++				reg = <0x3E>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1507_1_3E-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1507 on I2C#0 at slave addr 0x3F
++	fragment@24 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1507_0_3F: sx150x@3F {
++				compatible = "semtech,sx1507q";
++				reg = <0x3F>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1507_0_3F-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1507 on I2C#1 at slave addr 0x3F
++	fragment@25 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1507_1_3F: sx150x@3F {
++				compatible = "semtech,sx1507q";
++				reg = <0x3F>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1507_1_3F-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1507 on I2C#0 at slave addr 0x70
++	fragment@26 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1507_0_70: sx150x@70 {
++				compatible = "semtech,sx1507q";
++				reg = <0x70>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1507-0-70-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1507 on I2C#1 at slave addr 0x70
++	fragment@27 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1507_1_70: sx150x@70 {
++				compatible = "semtech,sx1507q";
++				reg = <0x70>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1507-1-70-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1507 on I2C#0 at slave addr 0x71
++	fragment@28 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1507_0_71: sx150x@71 {
++				compatible = "semtech,sx1507q";
++				reg = <0x71>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1507-0-71-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1507 on I2C#1 at slave addr 0x71
++	fragment@29 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1507_1_71: sx150x@71 {
++				compatible = "semtech,sx1507q";
++				reg = <0x71>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1507-1-71-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1508 on I2C#0 at slave addr 0x20
++	fragment@30 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1508_0_20: sx150x@20 {
++				compatible = "semtech,sx1508q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1508-0-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1508 on I2C#1 at slave addr 0x20
++	fragment@31 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1508_1_20: sx150x@20 {
++				compatible = "semtech,sx1508q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1508-1-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1508 on I2C#0 at slave addr 0x21
++	fragment@32 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1508_0_21: sx150x@21 {
++				compatible = "semtech,sx1508q";
++				reg = <0x21>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1508-0-21-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1508 on I2C#1 at slave addr 0x21
++	fragment@33 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1508_1_21: sx150x@21 {
++				compatible = "semtech,sx1508q";
++				reg = <0x21>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1508-1-21-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1508 on I2C#0 at slave addr 0x22
++	fragment@34 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1508_0_22: sx150x@22 {
++				compatible = "semtech,sx1508q";
++				reg = <0x22>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1508-0-22-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1508 on I2C#1 at slave addr 0x22
++	fragment@35 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1508_1_22: sx150x@22 {
++				compatible = "semtech,sx1508q";
++				reg = <0x22>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1508-1-22-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1508 on I2C#0 at slave addr 0x23
++	fragment@36 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1508_0_23: sx150x@23 {
++				compatible = "semtech,sx1508q";
++				reg = <0x23>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1508-0-23-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1508 on I2C#1 at slave addr 0x23
++	fragment@37 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1508_1_23: sx150x@23 {
++				compatible = "semtech,sx1508q";
++				reg = <0x23>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1508-1-23-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1509 on I2C#0 at slave addr 0x3E
++	fragment@38 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1509_0_3E: sx150x@3E {
++				compatible = "semtech,sx1509q";
++				reg = <0x3E>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1509_0_3E-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1509 on I2C#1 at slave addr 0x3E
++	fragment@39 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1509_1_3E: sx150x@3E {
++				compatible = "semtech,sx1509q";
++				reg = <0x3E>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1509_1_3E-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1509 on I2C#0 at slave addr 0x3F
++	fragment@40 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1509_0_3F: sx150x@3F {
++				compatible = "semtech,sx1509q";
++				reg = <0x3F>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1509_0_3F-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1509 on I2C#1 at slave addr 0x3F
++	fragment@41 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1509_1_3F: sx150x@3F {
++				compatible = "semtech,sx1509q";
++				reg = <0x3F>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1509_1_3F-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1509 on I2C#0 at slave addr 0x70
++	fragment@42 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1509_0_70: sx150x@70 {
++				compatible = "semtech,sx1509q";
++				reg = <0x70>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1509-0-70-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1509 on I2C#1 at slave addr 0x70
++	fragment@43 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1509_1_70: sx150x@70 {
++				compatible = "semtech,sx1509q";
++				reg = <0x70>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1509-1-70-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1509 on I2C#0 at slave addr 0x71
++	fragment@44 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1509_0_71: sx150x@71 {
++				compatible = "semtech,sx1509q";
++				reg = <0x71>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1509-0-71-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1509 on I2C#1 at slave addr 0x71
++	fragment@45 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1509_1_71: sx150x@71 {
++				compatible = "semtech,sx1509q";
++				reg = <0x71>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1509-1-71-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable interrupts for a SX1501 on I2C#0 at slave addr 0x20
++	fragment@46 {
++		target = <&sx1501_0_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1501 on I2C#1 at slave addr 0x20
++	fragment@47 {
++		target = <&sx1501_1_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1501 on I2C#0 at slave addr 0x21
++	fragment@48 {
++		target = <&sx1501_0_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_21_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1501 on I2C#1 at slave addr 0x21
++	fragment@49 {
++		target = <&sx1501_1_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_21_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1502 on I2C#0 at slave addr 0x20
++	fragment@50 {
++		target = <&sx1502_0_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1502 on I2C#1 at slave addr 0x20
++	fragment@51 {
++		target = <&sx1502_1_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1502 on I2C#0 at slave addr 0x21
++	fragment@52 {
++		target = <&sx1502_0_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_21_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1502 on I2C#1 at slave addr 0x21
++	fragment@53 {
++		target = <&sx1502_1_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_21_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1503 on I2C#0 at slave addr 0x20
++	fragment@54 {
++		target = <&sx1503_0_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1503 on I2C#1 at slave addr 0x20
++	fragment@55 {
++		target = <&sx1503_1_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1504 on I2C#0 at slave addr 0x20
++	fragment@56 {
++		target = <&sx1504_0_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1504 on I2C#1 at slave addr 0x20
++	fragment@57 {
++		target = <&sx1504_1_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1504 on I2C#0 at slave addr 0x21
++	fragment@58 {
++		target = <&sx1504_0_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_21_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1504 on I2C#1 at slave addr 0x21
++	fragment@59 {
++		target = <&sx1504_1_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_21_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1505 on I2C#0 at slave addr 0x20
++	fragment@60 {
++		target = <&sx1505_0_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1505 on I2C#1 at slave addr 0x20
++	fragment@61 {
++		target = <&sx1505_1_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1505 on I2C#0 at slave addr 0x21
++	fragment@62 {
++		target = <&sx1505_0_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_21_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1505 on I2C#1 at slave addr 0x21
++	fragment@63 {
++		target = <&sx1505_1_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_21_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1506 on I2C#0 at slave addr 0x20
++	fragment@64 {
++		target = <&sx1506_0_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1506 on I2C#1 at slave addr 0x20
++	fragment@65 {
++		target = <&sx1506_1_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1507 on I2C#0 at slave addr 0x3E
++	fragment@66 {
++		target = <&sx1507_0_3E>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_3E_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1507 on I2C#1 at slave addr 0x3E
++	fragment@67 {
++		target = <&sx1507_1_3E>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_3E_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1507 on I2C#0 at slave addr 0x3F
++	fragment@68 {
++		target = <&sx1507_0_3F>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_3F_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1507 on I2C#1 at slave addr 0x3F
++	fragment@69 {
++		target = <&sx1507_1_3F>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_3F_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1507 on I2C#0 at slave addr 0x70
++	fragment@70 {
++		target = <&sx1507_0_70>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_70_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1507 on I2C#1 at slave addr 0x70
++	fragment@71 {
++		target = <&sx1507_1_70>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_70_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1507 on I2C#0 at slave addr 0x71
++	fragment@72 {
++		target = <&sx1507_0_71>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_71_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1507 on I2C#1 at slave addr 0x71
++	fragment@73 {
++		target = <&sx1507_1_71>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_71_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1508 on I2C#0 at slave addr 0x20
++	fragment@74 {
++		target = <&sx1508_0_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1508 on I2C#1 at slave addr 0x20
++	fragment@75 {
++		target = <&sx1508_1_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1508 on I2C#0 at slave addr 0x21
++	fragment@76 {
++		target = <&sx1508_0_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_21_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1508 on I2C#1 at slave addr 0x21
++	fragment@77 {
++		target = <&sx1508_1_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_21_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1508 on I2C#0 at slave addr 0x22
++	fragment@78 {
++		target = <&sx1508_0_22>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_22_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1508 on I2C#1 at slave addr 0x22
++	fragment@79 {
++		target = <&sx1508_1_22>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_22_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1508 on I2C#0 at slave addr 0x23
++	fragment@80 {
++		target = <&sx1508_0_23>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_23_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1508 on I2C#1 at slave addr 0x23
++	fragment@81 {
++		target = <&sx1508_1_23>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_23_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1509 on I2C#0 at slave addr 0x3E
++	fragment@82 {
++		target = <&sx1509_0_3E>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_3E_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1509 on I2C#1 at slave addr 0x3E
++	fragment@83 {
++		target = <&sx1509_1_3E>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_3E_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1509 on I2C#0 at slave addr 0x3F
++	fragment@84 {
++		target = <&sx1509_0_3F>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_3F_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1509 on I2C#1 at slave addr 0x3F
++	fragment@85 {
++		target = <&sx1509_1_3F>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_3F_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1509 on I2C#0 at slave addr 0x70
++	fragment@86 {
++		target = <&sx1509_0_70>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_70_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1509 on I2C#1 at slave addr 0x70
++	fragment@87 {
++		target = <&sx1509_1_70>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_70_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1509 on I2C#0 at slave addr 0x71
++	fragment@88 {
++		target = <&sx1509_0_71>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_71_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1509 on I2C#1 at slave addr 0x71
++	fragment@89 {
++		target = <&sx1509_1_71>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_71_pins>;
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x20
++        // Configure as a input with no pull-up/down
++	fragment@90 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_0_20_pins: sx150x_0_20_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-0-20-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x20
++        // Configure as a input with no pull-up/down
++	fragment@91 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_1_20_pins: sx150x_1_20_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-1-20-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x21
++        // Configure as a input with no pull-up/down
++	fragment@92 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_0_21_pins: sx150x_0_21_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-0-21-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x21
++        // Configure as a input with no pull-up/down
++	fragment@93 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_1_21_pins: sx150x_1_21_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-1-21-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x22
++        // Configure as a input with no pull-up/down
++	fragment@94 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_0_22_pins: sx150x_0_22_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-0-22-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x22
++        // Configure as a input with no pull-up/down
++	fragment@95 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_1_22_pins: sx150x_1_22_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-1-22-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x23
++        // Configure as a input with no pull-up/down
++	fragment@96 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_0_23_pins: sx150x_0_23_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-0-23-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x23
++        // Configure as a input with no pull-up/down
++	fragment@97 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_1_23_pins: sx150x_1_23_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-1-23-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x3E
++        // Configure as a input with no pull-up/down
++	fragment@98 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_0_3E_pins: sx150x_0_3E_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-0-3E-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x3E
++        // Configure as a input with no pull-up/down
++	fragment@99 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_1_3E_pins: sx150x_1_3E_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-1-3E-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x3F
++        // Configure as a input with no pull-up/down
++	fragment@100 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_0_3F_pins: sx150x_0_3F_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-0-3F-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x3F
++        // Configure as a input with no pull-up/down
++	fragment@101 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_1_3F_pins: sx150x_1_3F_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-1-3F-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x70
++        // Configure as a input with no pull-up/down
++	fragment@102 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_0_70_pins: sx150x_0_70_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-0-70-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x70
++        // Configure as a input with no pull-up/down
++	fragment@103 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_1_70_pins: sx150x_1_70_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-1-70-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x71
++        // Configure as a input with no pull-up/down
++	fragment@104 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_0_71_pins: sx150x_0_71_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-0-71-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x71
++        // Configure as a input with no pull-up/down
++	fragment@105 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_1_71_pins: sx150x_1_71_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-1-71-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		sx1501-0-20          = <0>,"+0+2";
++		sx1501-1-20          = <0>,"+1+3";
++		sx1501-0-21          = <0>,"+0+4";
++		sx1501-1-21          = <0>,"+1+5";
++		sx1502-0-20          = <0>,"+0+6";
++		sx1502-1-20          = <0>,"+1+7";
++		sx1502-0-21          = <0>,"+0+8";
++		sx1502-1-21          = <0>,"+1+9";
++		sx1503-0-20          = <0>,"+0+10";
++		sx1503-1-20          = <0>,"+1+11";
++		sx1504-0-20          = <0>,"+0+12";
++		sx1504-1-20          = <0>,"+1+13";
++		sx1504-0-21          = <0>,"+0+14";
++		sx1504-1-21          = <0>,"+1+15";
++		sx1505-0-20          = <0>,"+0+16";
++		sx1505-1-20          = <0>,"+1+17";
++		sx1505-0-21          = <0>,"+0+18";
++		sx1505-1-21          = <0>,"+1+19";
++		sx1506-0-20          = <0>,"+0+20";
++		sx1506-1-20          = <0>,"+1+21";
++		sx1507-0-3E          = <0>,"+0+22";
++		sx1507-1-3E          = <0>,"+1+23";
++		sx1507-0-3F          = <0>,"+0+24";
++		sx1507-1-3F          = <0>,"+1+25";
++		sx1507-0-70          = <0>,"+0+26";
++		sx1507-1-70          = <0>,"+1+27";
++		sx1507-0-71          = <0>,"+0+28";
++		sx1507-1-71          = <0>,"+1+29";
++		sx1508-0-20          = <0>,"+0+30";
++		sx1508-1-20          = <0>,"+1+31";
++		sx1508-0-21          = <0>,"+0+32";
++		sx1508-1-21          = <0>,"+1+33";
++		sx1508-0-22          = <0>,"+0+34";
++		sx1508-1-22          = <0>,"+1+35";
++		sx1508-0-23          = <0>,"+0+36";
++		sx1508-1-23          = <0>,"+1+37";
++		sx1509-0-3E          = <0>,"+0+38";
++		sx1509-1-3E          = <0>,"+1+39";
++		sx1509-0-3F          = <0>,"+0+40";
++		sx1509-1-3F          = <0>,"+1+41";
++		sx1509-0-70          = <0>,"+0+42";
++		sx1509-1-70          = <0>,"+1+43";
++		sx1509-0-71          = <0>,"+0+44";
++		sx1509-1-71          = <0>,"+1+45";
++		sx1501-0-20-int-gpio = <0>,"+46+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1501_0_20>,"interrupts:0";
++		sx1501-1-20-int-gpio = <0>,"+47+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1501_1_20>,"interrupts:0";
++		sx1501-0-21-int-gpio = <0>,"+48+92",  <&sx150x_0_21_pins>,"brcm,pins:0", <&sx1501_0_21>,"interrupts:0";
++		sx1501-1-21-int-gpio = <0>,"+49+93",  <&sx150x_1_21_pins>,"brcm,pins:0", <&sx1501_1_21>,"interrupts:0";
++		sx1502-0-20-int-gpio = <0>,"+50+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1502_0_20>,"interrupts:0";
++		sx1502-1-20-int-gpio = <0>,"+51+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1502_1_20>,"interrupts:0";
++		sx1502-0-21-int-gpio = <0>,"+52+92",  <&sx150x_0_21_pins>,"brcm,pins:0", <&sx1502_0_21>,"interrupts:0";
++		sx1502-1-21-int-gpio = <0>,"+53+93",  <&sx150x_1_21_pins>,"brcm,pins:0", <&sx1502_1_21>,"interrupts:0";
++		sx1503-0-20-int-gpio = <0>,"+54+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1503_0_20>,"interrupts:0";
++		sx1503-1-20-int-gpio = <0>,"+55+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1503_1_20>,"interrupts:0";
++		sx1504-0-20-int-gpio = <0>,"+56+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1504_0_20>,"interrupts:0";
++		sx1504-1-20-int-gpio = <0>,"+57+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1504_1_20>,"interrupts:0";
++		sx1504-0-21-int-gpio = <0>,"+58+92",  <&sx150x_0_21_pins>,"brcm,pins:0", <&sx1504_0_21>,"interrupts:0";
++		sx1504-1-21-int-gpio = <0>,"+59+93",  <&sx150x_1_21_pins>,"brcm,pins:0", <&sx1504_1_21>,"interrupts:0";
++		sx1505-0-20-int-gpio = <0>,"+60+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1505_0_20>,"interrupts:0";
++		sx1505-1-20-int-gpio = <0>,"+61+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1505_1_20>,"interrupts:0";
++		sx1505-0-21-int-gpio = <0>,"+62+92",  <&sx150x_0_21_pins>,"brcm,pins:0", <&sx1505_0_21>,"interrupts:0";
++		sx1505-1-21-int-gpio = <0>,"+63+93",  <&sx150x_1_21_pins>,"brcm,pins:0", <&sx1505_1_21>,"interrupts:0";
++		sx1506-0-20-int-gpio = <0>,"+64+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1506_0_20>,"interrupts:0";
++		sx1506-1-20-int-gpio = <0>,"+65+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1506_1_20>,"interrupts:0";
++		sx1507-0-3E-int-gpio = <0>,"+66+98",  <&sx150x_0_3E_pins>,"brcm,pins:0", <&sx1507_0_3E>,"interrupts:0";
++		sx1507-1-3E-int-gpio = <0>,"+67+99",  <&sx150x_1_3E_pins>,"brcm,pins:0", <&sx1507_1_3E>,"interrupts:0";
++		sx1507-0-3F-int-gpio = <0>,"+68+100", <&sx150x_0_3F_pins>,"brcm,pins:0", <&sx1507_0_3F>,"interrupts:0";
++		sx1507-1-3F-int-gpio = <0>,"+69+101", <&sx150x_1_3F_pins>,"brcm,pins:0", <&sx1507_1_3F>,"interrupts:0";
++		sx1507-0-70-int-gpio = <0>,"+60+102", <&sx150x_0_70_pins>,"brcm,pins:0", <&sx1507_0_70>,"interrupts:0";
++		sx1507-1-70-int-gpio = <0>,"+71+103", <&sx150x_1_70_pins>,"brcm,pins:0", <&sx1507_1_70>,"interrupts:0";
++		sx1507-0-71-int-gpio = <0>,"+72+104", <&sx150x_0_71_pins>,"brcm,pins:0", <&sx1507_0_71>,"interrupts:0";
++		sx1507-1-71-int-gpio = <0>,"+73+105", <&sx150x_1_71_pins>,"brcm,pins:0", <&sx1507_1_71>,"interrupts:0";
++		sx1508-0-20-int-gpio = <0>,"+74+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1508_0_20>,"interrupts:0";
++		sx1508-1-20-int-gpio = <0>,"+75+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1508_1_20>,"interrupts:0";
++		sx1508-0-21-int-gpio = <0>,"+76+92",  <&sx150x_0_21_pins>,"brcm,pins:0", <&sx1508_0_21>,"interrupts:0";
++		sx1508-1-21-int-gpio = <0>,"+77+93",  <&sx150x_1_21_pins>,"brcm,pins:0", <&sx1508_1_21>,"interrupts:0";
++		sx1508-0-22-int-gpio = <0>,"+78+94",  <&sx150x_0_22_pins>,"brcm,pins:0", <&sx1508_0_22>,"interrupts:0";
++		sx1508-1-22-int-gpio = <0>,"+79+95",  <&sx150x_1_22_pins>,"brcm,pins:0", <&sx1508_1_22>,"interrupts:0";
++		sx1508-0-23-int-gpio = <0>,"+80+96",  <&sx150x_0_23_pins>,"brcm,pins:0", <&sx1508_0_23>,"interrupts:0";
++		sx1508-1-23-int-gpio = <0>,"+81+97",  <&sx150x_1_23_pins>,"brcm,pins:0", <&sx1508_1_23>,"interrupts:0";
++		sx1509-0-3E-int-gpio = <0>,"+82+98",  <&sx150x_0_3E_pins>,"brcm,pins:0", <&sx1509_0_3E>,"interrupts:0";
++		sx1509-1-3E-int-gpio = <0>,"+83+99",  <&sx150x_1_3E_pins>,"brcm,pins:0", <&sx1509_1_3E>,"interrupts:0";
++		sx1509-0-3F-int-gpio = <0>,"+84+100", <&sx150x_0_3F_pins>,"brcm,pins:0", <&sx1509_0_3F>,"interrupts:0";
++		sx1509-1-3F-int-gpio = <0>,"+85+101", <&sx150x_1_3F_pins>,"brcm,pins:0", <&sx1509_1_3F>,"interrupts:0";
++		sx1509-0-70-int-gpio = <0>,"+86+102", <&sx150x_0_70_pins>,"brcm,pins:0", <&sx1509_0_70>,"interrupts:0";
++		sx1509-1-70-int-gpio = <0>,"+87+103", <&sx150x_1_70_pins>,"brcm,pins:0", <&sx1509_1_70>,"interrupts:0";
++		sx1509-0-71-int-gpio = <0>,"+88+104", <&sx150x_0_71_pins>,"brcm,pins:0", <&sx1509_0_71>,"interrupts:0";
++		sx1509-1-71-int-gpio = <0>,"+89+105", <&sx150x_1_71_pins>,"brcm,pins:0", <&sx1509_1_71>,"interrupts:0";
++	};
++};
++
+diff --git a/arch/arm/boot/dts/overlays/tc358743-audio-overlay.dts b/arch/arm/boot/dts/overlays/tc358743-audio-overlay.dts
+new file mode 100644
+index 000000000000..047695bb0c71
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/tc358743-audio-overlay.dts
+@@ -0,0 +1,52 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions to add I2S audio from the Toshiba TC358743 HDMI to CSI2 bridge.
++// Requires tc358743 overlay to have been loaded to actually function.
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			tc358743_codec: tc358743-codec {
++				#sound-dai-cells = <0>;
++				compatible = "linux,spdif-dir";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		sound_overlay: __overlay__ {
++			compatible = "simple-audio-card";
++			simple-audio-card,format = "i2s";
++			simple-audio-card,name = "tc358743";
++			simple-audio-card,bitclock-master = <&dailink0_slave>;
++			simple-audio-card,frame-master = <&dailink0_slave>;
++			status = "okay";
++
++			simple-audio-card,cpu {
++				sound-dai = <&i2s>;
++				dai-tdm-slot-num = <2>;
++				dai-tdm-slot-width = <32>;
++			};
++			dailink0_slave: simple-audio-card,codec {
++				sound-dai = <&tc358743_codec>;
++			};
++		};
++	};
++
++	__overrides__ {
++		card-name = <&sound_overlay>,"simple-audio-card,name";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/tc358743-overlay.dts b/arch/arm/boot/dts/overlays/tc358743-overlay.dts
+new file mode 100644
+index 000000000000..c3eebfd1f6ee
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/tc358743-overlay.dts
+@@ -0,0 +1,109 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for Toshiba TC358743 HDMI to CSI2 bridge on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			tc358743: tc358743@f {
++				compatible = "toshiba,tc358743";
++				reg = <0x0f>;
++				status = "okay";
++
++				clocks = <&cam1_clk>;
++				clock-names = "refclk";
++
++				port {
++					tc358743_0: endpoint {
++						remote-endpoint = <&csi1_ep>;
++						clock-lanes = <0>;
++						clock-noncontinuous;
++						link-frequencies =
++							/bits/ 64 <486000000>;
++					};
++				};
++			};
++		};
++	};
++
++	csi_frag: fragment@1 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++
++			port {
++				csi1_ep: endpoint {
++					remote-endpoint = <&tc358743_0>;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&tc358743_0>;
++		__overlay__ {
++			data-lanes = <1 2>;
++		};
++	};
++
++	fragment@3 {
++		target = <&tc358743_0>;
++		__dormant__ {
++			data-lanes = <1 2 3 4>;
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@5 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@6 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			status = "okay";
++			clock-frequency = <27000000>;
++		};
++	};
++
++	fragment@7 {
++		target = <&csi1_ep>;
++		__overlay__ {
++			data-lanes = <1 2>;
++		};
++	};
++
++	fragment@8 {
++		target = <&csi1_ep>;
++		__dormant__ {
++			data-lanes = <1 2 3 4>;
++		};
++	};
++
++	__overrides__ {
++		4lane = <0>, "-2+3-7+8";
++		link-frequency = <&tc358743_0>,"link-frequencies#0";
++		media-controller = <&csi>,"brcm,media-controller?";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_vc>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&tc358743>, "clocks:0=",<&cam0_clk>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts b/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts
+new file mode 100644
+index 000000000000..a102b09e3ab5
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts
+@@ -0,0 +1,222 @@
++/*
++ * tinylcd35-overlay.dts
++ *
++ * -------------------------------------------------
++ * www.tinlylcd.com
++ * -------------------------------------------------
++ * Device---Driver-----BUS       GPIO's
++ * display  tinylcd35  spi0.0    25 24 18
++ * touch    ads7846    spi0.1    5
++ * rtc      ds1307     i2c1-0068
++ * rtc      pcf8563    i2c1-0051
++ * keypad   gpio-keys  --------- 17 22 27 23 28
++ *
++ *
++ * TinyLCD.com 3.5 inch TFT
++ *
++ *  Version 001
++ *  5/3/2015  -- Noralf Trønnes     Initial Device tree framework
++ *  10/3/2015 -- tinylcd@gmail.com  added ds1307 support.
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			tinylcd35_pins: tinylcd35_pins {
++				brcm,pins = <25 24 18>;
++				brcm,function = <1>; /* out */
++			};
++			tinylcd35_ts_pins: tinylcd35_ts_pins {
++				brcm,pins = <5>;
++				brcm,function = <0>; /* in */
++			};
++			keypad_pins: keypad_pins {
++				brcm,pins = <4 17 22 23 27>;
++				brcm,function = <0>; /* in */
++				brcm,pull = <1>; /* down */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			tinylcd35: tinylcd35@0{
++				compatible = "neosec,tinylcd";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&tinylcd35_pins>,
++					    <&tinylcd35_ts_pins>;
++
++				spi-max-frequency = <48000000>;
++				rotate = <270>;
++				fps = <20>;
++				bgr;
++				buswidth = <8>;
++				reset-gpios = <&gpio 25 1>;
++				dc-gpios = <&gpio 24 0>;
++				led-gpios = <&gpio 18 0>;
++				debug = <0>;
++
++				init = <0x10000B0 0x80
++					0x10000C0 0x0A 0x0A
++					0x10000C1 0x01 0x01
++					0x10000C2 0x33
++					0x10000C5 0x00 0x42 0x80
++					0x10000B1 0xD0 0x11
++					0x10000B4 0x02
++					0x10000B6 0x00 0x22 0x3B
++					0x10000B7 0x07
++					0x1000036 0x58
++					0x10000F0 0x36 0xA5 0xD3
++					0x10000E5 0x80
++					0x10000E5 0x01
++					0x10000B3 0x00
++					0x10000E5 0x00
++					0x10000F0 0x36 0xA5 0x53
++					0x10000E0 0x00 0x35 0x33 0x00 0x00 0x00 0x00 0x35 0x33 0x00 0x00 0x00
++					0x100003A 0x55
++					0x1000011
++					0x2000001
++					0x1000029>;
++			};
++
++			tinylcd35_ts: tinylcd35_ts@1 {
++				compatible = "ti,ads7846";
++				reg = <1>;
++				status = "disabled";
++
++				spi-max-frequency = <2000000>;
++				interrupts = <5 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				pendown-gpio = <&gpio 5 0>;
++				ti,x-plate-ohms = /bits/ 16 <100>;
++				ti,pressure-max = /bits/ 16 <255>;
++			};
++		};
++	};
++
++	/*  RTC    */
++
++	fragment@5 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			pcf8563: pcf8563@51 {
++				compatible = "nxp,pcf8563";
++				reg = <0x51>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@6 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			ds1307: ds1307@68 {
++				compatible = "dallas,ds1307";
++				reg = <0x68>;
++				status = "okay";
++			};
++		};
++	};
++
++	/*
++	 * Values for input event code is found under the
++	 * 'Keys and buttons' heading in include/uapi/linux/input.h
++	 */
++	fragment@7 {
++		target-path = "/soc";
++		__overlay__ {
++			keypad: keypad {
++				compatible = "gpio-keys";
++				pinctrl-names = "default";
++				pinctrl-0 = <&keypad_pins>;
++				status = "disabled";
++				autorepeat;
++
++				button@17 {
++					label = "GPIO KEY_UP";
++					linux,code = <103>;
++					gpios = <&gpio 17 0>;
++				};
++				button@22 {
++					label = "GPIO KEY_DOWN";
++					linux,code = <108>;
++					gpios = <&gpio 22 0>;
++				};
++				button@27 {
++					label = "GPIO KEY_LEFT";
++					linux,code = <105>;
++					gpios = <&gpio 27 0>;
++				};
++				button@23 {
++					label = "GPIO KEY_RIGHT";
++					linux,code = <106>;
++					gpios = <&gpio 23 0>;
++				};
++				button@4 {
++					label = "GPIO KEY_ENTER";
++					linux,code = <28>;
++					gpios = <&gpio 4 0>;
++				};
++			};
++		};
++	};
++
++	__overrides__ {
++		speed =      <&tinylcd35>,"spi-max-frequency:0";
++		rotate =     <&tinylcd35>,"rotate:0";
++		fps =        <&tinylcd35>,"fps:0";
++		debug =      <&tinylcd35>,"debug:0";
++		touch =      <&tinylcd35_ts>,"status";
++		touchgpio =  <&tinylcd35_ts_pins>,"brcm,pins:0",
++			     <&tinylcd35_ts>,"interrupts:0",
++			     <&tinylcd35_ts>,"pendown-gpio:4";
++		xohms =      <&tinylcd35_ts>,"ti,x-plate-ohms;0";
++		rtc-pcf =    <0>,"=5";
++		rtc-ds =     <0>,"=6";
++		keypad =     <&keypad>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/tpm-slb9670-overlay.dts b/arch/arm/boot/dts/overlays/tpm-slb9670-overlay.dts
+new file mode 100644
+index 000000000000..e69188503ca3
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/tpm-slb9670-overlay.dts
+@@ -0,0 +1,44 @@
++/*
++ * Device Tree overlay for the Infineon SLB9670 Trusted Platform Module add-on
++ * boards, which can be used as a secure key storage and hwrng.
++ * available as "Iridium SLB9670" by Infineon and "LetsTrust TPM" by pi3g.
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			slb9670: slb9670@1 {
++				compatible = "infineon,slb9670";
++				reg = <1>;	/* CE1 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <32000000>;
++				status = "okay";
++			};
++
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/tpm-slb9673-overlay.dts b/arch/arm/boot/dts/overlays/tpm-slb9673-overlay.dts
+new file mode 100644
+index 000000000000..cba8c25c30e5
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/tpm-slb9673-overlay.dts
+@@ -0,0 +1,50 @@
++/*
++ * Device Tree overlay for the Infineon SLB9673 Trusted Platform Module add-on
++ * boards, which can be used as a secure key storage and hwrng.
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	/* Due to issue https://github.com/raspberrypi/linux/issues/4884 the
++	   hardware I2C needs to be disabled and software I2C enabled */
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			i2c1: i2c-gpio@1 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				compatible = "i2c-gpio";
++				gpios = <&gpio 2 6>, /* SDA GPIO_OPEN_DRAIN */
++				     	<&gpio 3 6>; /* CLK GPIO_OPEN_DRAIN */
++				clock-frequency = <400000>;
++				status = "okay";
++			};
++		};
++	};
++
++	/* Add the TPM */
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			slb9673: slb9673@2e {
++				compatible = "infineon,slb9673", "tcg,tpm-tis-i2c";
++				reg = <0x2e>;
++				status = "okay";
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/uart0-overlay.dts b/arch/arm/boot/dts/overlays/uart0-overlay.dts
+new file mode 100755
+index 000000000000..6bf2e0fd5c61
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/uart0-overlay.dts
+@@ -0,0 +1,32 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&uart0>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&uart0_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			uart0_pins: uart0_ovl_pins {
++				brcm,pins = <14 15>;
++				brcm,function = <4>; /* alt0 */
++				brcm,pull = <0 2>;
++			};
++		};
++	};
++
++	__overrides__ {
++		txd0_pin = <&uart0_pins>,"brcm,pins:0";
++		rxd0_pin = <&uart0_pins>,"brcm,pins:4";
++		pin_func = <&uart0_pins>,"brcm,function:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/uart1-overlay.dts b/arch/arm/boot/dts/overlays/uart1-overlay.dts
+new file mode 100644
+index 000000000000..64163bf932b7
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/uart1-overlay.dts
+@@ -0,0 +1,38 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&uart1>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&uart1_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			uart1_pins: uart1_ovl_pins {
++				brcm,pins = <14 15>;
++				brcm,function = <2>; /* alt5 */
++				brcm,pull = <0 2>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target-path = "/chosen";
++		__overlay__ {
++			bootargs = "8250.nr_uarts=1";
++		};
++	};
++
++	__overrides__ {
++		txd1_pin = <&uart1_pins>,"brcm,pins:0";
++		rxd1_pin = <&uart1_pins>,"brcm,pins:4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/uart2-overlay.dts b/arch/arm/boot/dts/overlays/uart2-overlay.dts
+new file mode 100644
+index 000000000000..9face240aca1
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/uart2-overlay.dts
+@@ -0,0 +1,27 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&uart2>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&uart2_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&uart2_pins>;
++		__dormant__ {
++			brcm,pins = <0 1 2 3>;
++			brcm,pull = <0 2 2 0>;
++		};
++	};
++
++	__overrides__ {
++		ctsrts = <0>,"=1";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/uart3-overlay.dts b/arch/arm/boot/dts/overlays/uart3-overlay.dts
+new file mode 100644
+index 000000000000..ae9f9fe5ea1d
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/uart3-overlay.dts
+@@ -0,0 +1,27 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&uart3>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&uart3_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&uart3_pins>;
++		__dormant__ {
++			brcm,pins = <4 5 6 7>;
++			brcm,pull = <0 2 2 0>;
++		};
++	};
++
++	__overrides__ {
++		ctsrts = <0>,"=1";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/uart4-overlay.dts b/arch/arm/boot/dts/overlays/uart4-overlay.dts
+new file mode 100644
+index 000000000000..ac004ffbadbf
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/uart4-overlay.dts
+@@ -0,0 +1,27 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&uart4>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&uart4_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&uart4_pins>;
++		__dormant__ {
++			brcm,pins = <8 9 10 11>;
++			brcm,pull = <0 2 2 0>;
++		};
++	};
++
++	__overrides__ {
++		ctsrts = <0>,"=1";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/uart5-overlay.dts b/arch/arm/boot/dts/overlays/uart5-overlay.dts
+new file mode 100644
+index 000000000000..04eaf376effe
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/uart5-overlay.dts
+@@ -0,0 +1,27 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&uart5>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&uart5_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&uart5_pins>;
++		__dormant__ {
++			brcm,pins = <12 13 14 15>;
++			brcm,pull = <0 2 2 0>;
++		};
++	};
++
++	__overrides__ {
++		ctsrts = <0>,"=1";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/udrc-overlay.dts b/arch/arm/boot/dts/overlays/udrc-overlay.dts
+new file mode 100644
+index 000000000000..ae7c37996894
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/udrc-overlay.dts
+@@ -0,0 +1,128 @@
++#include <dt-bindings/clock/bcm2835.h>
++/*
++ * Device tree overlay for the Universal Digital Radio Controller
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++    fragment@0 {
++        target = <&i2s>;
++        __overlay__ {
++            clocks = <&clocks BCM2835_CLOCK_PCM>;
++            clock-names = "pcm";
++            status = "okay";
++        };
++    };
++
++    fragment@1 {
++        target-path = "/";
++        __overlay__ {
++            regulators {
++                compatible = "simple-bus";
++                #address-cells = <1>;
++                #size-cells = <0>;
++
++                udrc0_ldoin: udrc0_ldoin {
++                    compatible = "regulator-fixed";
++                    regulator-name = "ldoin";
++                    regulator-min-microvolt = <3300000>;
++                    regulator-max-microvolt = <3300000>;
++                    regulator-always-on;
++                };
++            };
++        };
++    };
++
++    fragment@2 {
++        target = <&i2c1>;
++        __overlay__ {
++            #address-cells = <1>;
++            #size-cells = <0>;
++            status = "okay";
++            clocks = <&clocks BCM2835_CLOCK_VPU>;
++            clock-frequency = <400000>;
++
++            tlv320aic32x4: tlv320aic32x4@18 {
++                compatible = "ti,tlv320aic32x4";
++                #sound-dai-cells = <0>;
++                reg = <0x18>;
++                status = "okay";
++
++                clocks = <&clocks BCM2835_CLOCK_GP0>;
++                clock-names = "mclk";
++                assigned-clocks = <&clocks BCM2835_CLOCK_GP0>;
++                assigned-clock-rates = <25000000>;
++
++                pinctrl-names = "default";
++                pinctrl-0 = <&gpclk0_pin &aic3204_reset>;
++
++                reset-gpios = <&gpio 13 0>;
++
++                iov-supply = <&udrc0_ldoin>;
++                ldoin-supply = <&udrc0_ldoin>;
++            };
++        };
++    };
++
++    fragment@3 {
++        target = <&sound>;
++        snd: __overlay__ {
++            compatible = "simple-audio-card";
++            i2s-controller = <&i2s>;
++            status = "okay";
++
++            simple-audio-card,name = "udrc";
++            simple-audio-card,format = "i2s";
++
++            simple-audio-card,bitclock-master = <&dailink0_master>;
++            simple-audio-card,frame-master = <&dailink0_master>;
++
++            simple-audio-card,widgets =
++                "Line", "Line In",
++                "Line", "Line Out";
++
++            simple-audio-card,routing =
++                "IN1_R", "Line In",
++                "IN1_L", "Line In",
++                "CM_L", "Line In",
++                "CM_R", "Line In",
++                "Line Out", "LOR",
++                "Line Out", "LOL";
++
++            dailink0_master: simple-audio-card,cpu {
++                sound-dai = <&i2s>;
++            };
++
++            simple-audio-card,codec {
++                sound-dai = <&tlv320aic32x4>;
++            };
++        };
++    };
++
++    fragment@4 {
++        target = <&gpio>;
++        __overlay__ {
++            gpclk0_pin: gpclk0_pin {
++                brcm,pins = <4>;
++                brcm,function = <4>;
++            };
++
++            aic3204_reset: aic3204_reset {
++                brcm,pins = <13>;
++                brcm,function = <1>;
++                brcm,pull = <1>;
++            };
++
++            aic3204_gpio: aic3204_gpio {
++                brcm,pins = <26>;
++            };
++        };
++    };
++
++    __overrides__ {
++        alsaname = <&snd>, "simple-audio-card,name";
++    };
++};
+diff --git a/arch/arm/boot/dts/overlays/ugreen-dabboard-overlay.dts b/arch/arm/boot/dts/overlays/ugreen-dabboard-overlay.dts
+new file mode 100644
+index 000000000000..fc8d9b118068
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ugreen-dabboard-overlay.dts
+@@ -0,0 +1,49 @@
++// Definitions for the ugreen dabboard I2S
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			dmic_codec: dmic-codec {
++				#sound-dai-cells = <0>;
++				compatible = "dmic-codec";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		sound_overlay: __overlay__ {
++			compatible = "simple-audio-card";
++			simple-audio-card,format = "i2s";
++			simple-audio-card,name = "dabboard";
++			simple-audio-card,bitclock-master = <&dailink0_slave>;
++			simple-audio-card,frame-master = <&dailink0_slave>;
++			simple-audio-card,widgets = "Microphone", "Microphone Jack";
++			status = "okay";
++			simple-audio-card,cpu {
++				sound-dai = <&i2s>;
++			};
++			dailink0_slave: simple-audio-card,codec {
++				#sound-dai-cells = <0>;
++				sound-dai = <&dmic_codec>;
++			};
++		};
++	};
++
++	__overrides__ {
++		card-name = <&sound_overlay>,"simple-audio-card,name";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/upstream-overlay.dts b/arch/arm/boot/dts/overlays/upstream-overlay.dts
+new file mode 100644
+index 000000000000..55a99736a33b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/upstream-overlay.dts
+@@ -0,0 +1,101 @@
++// redo: ovmerge -c vc4-kms-v3d-overlay.dts,cma-default,composite dwc2-overlay.dts,dr_mode=otg
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++	fragment@0 {
++		target = <&i2c2>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@1 {
++		target = <&fb>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@2 {
++		target = <&pixelvalve0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@3 {
++		target = <&pixelvalve1>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@4 {
++		target = <&pixelvalve2>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@5 {
++		target = <&hvs>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@6 {
++		target = <&hdmi>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@7 {
++		target = <&v3d>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@8 {
++		target = <&vc4>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@9 {
++		target = <&clocks>;
++		__overlay__ {
++			claim-clocks = <BCM2835_PLLD_DSI0 BCM2835_PLLD_DSI1 BCM2835_PLLH_AUX BCM2835_PLLH_PIX>;
++		};
++	};
++	fragment@10 {
++		target = <&vec>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@11 {
++		target = <&txp>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@12 {
++		target = <&chosen>;
++		__overlay__ {
++			bootargs = "snd_bcm2835.enable_hdmi=0";
++		};
++	};
++	fragment@13 {
++		target = <&usb>;
++		#address-cells = <1>;
++		#size-cells = <1>;
++		__overlay__ {
++			compatible = "brcm,bcm2835-usb";
++			dr_mode = "otg";
++			g-np-tx-fifo-size = <32>;
++			g-rx-fifo-size = <558>;
++			g-tx-fifo-size = <512 512 512 512 512 256 256>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/upstream-pi4-overlay.dts b/arch/arm/boot/dts/overlays/upstream-pi4-overlay.dts
+new file mode 100644
+index 000000000000..1dc60ae6d967
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/upstream-pi4-overlay.dts
+@@ -0,0 +1,137 @@
++// redo: ovmerge -c vc4-kms-v3d-pi4-overlay.dts,cma-default dwc2-overlay.dts,dr_mode=otg
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2711";
++	fragment@0 {
++		target = <&ddc0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@1 {
++		target = <&ddc1>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@2 {
++		target = <&hdmi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@3 {
++		target = <&hdmi1>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@4 {
++		target = <&hvs>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@5 {
++		target = <&pixelvalve0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@6 {
++		target = <&pixelvalve1>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@7 {
++		target = <&pixelvalve2>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@8 {
++		target = <&pixelvalve3>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@9 {
++		target = <&pixelvalve4>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@10 {
++		target = <&v3d>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@11 {
++		target = <&vc4>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@12 {
++		target = <&txp>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@13 {
++		target = <&fb>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@14 {
++		target = <&firmwarekms>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@15 {
++		target = <&vec>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@16 {
++		target-path = "/chosen";
++		__overlay__ {
++			bootargs = "snd_bcm2835.enable_hdmi=0";
++		};
++	};
++	fragment@17 {
++		target = <&dvp>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@18 {
++		target = <&aon_intr>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@19 {
++		target = <&usb>;
++		#address-cells = <1>;
++		#size-cells = <1>;
++		__overlay__ {
++			compatible = "brcm,bcm2835-usb";
++			dr_mode = "otg";
++			g-np-tx-fifo-size = <32>;
++			g-rx-fifo-size = <558>;
++			g-tx-fifo-size = <512 512 512 512 512 256 256>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts b/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts
+new file mode 100644
+index 000000000000..ca344492bed8
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts
+@@ -0,0 +1,40 @@
++/*
++ * vc4-fkms-v3d-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include "cma-overlay.dts"
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@1 {
++		target = <&fb>;
++		__overlay__  {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&firmwarekms>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&v3d>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&vc4>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-fkms-v3d-pi4-overlay.dts b/arch/arm/boot/dts/overlays/vc4-fkms-v3d-pi4-overlay.dts
+new file mode 100644
+index 000000000000..7792ead0cbb3
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-fkms-v3d-pi4-overlay.dts
+@@ -0,0 +1,44 @@
++/*
++ * vc4-fkms-v3d-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include "cma-overlay.dts"
++
++&frag0 {
++	size = <((320-4)*1024*1024)>;
++};
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@1 {
++		target = <&fb>;
++		__overlay__  {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&firmwarekms>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&v3d>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&vc4>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dpi-generic-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-dpi-generic-overlay.dts
+new file mode 100644
+index 000000000000..85875c266296
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dpi-generic-overlay.dts
+@@ -0,0 +1,81 @@
++/*
++ * vc4-kms-dpi-generic-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include "vc4-kms-dpi.dtsi"
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&panel>;
++		panel_generic: __overlay__  {
++			compatible = "panel-dpi";
++
++			width-mm = <154>;
++			height-mm = <83>;
++			bus-format = <0x1009>;
++
++			timing: panel-timing {
++				clock-frequency = <29500000>;
++				hactive = <800>;
++				hfront-porch = <24>;
++				hsync-len = <72>;
++				hback-porch = <96>;
++				hsync-active = <1>;
++				vactive = <480>;
++				vfront-porch = <3>;
++				vsync-len = <10>;
++				vback-porch = <7>;
++				vsync-active = <1>;
++
++				de-active = <1>;
++				pixelclk-active = <1>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&dpi>;
++		dpi_node_generic: __overlay__  {
++			pinctrl-0 = <&dpi_18bit_gpio0>;
++		};
++	};
++
++	__overrides__ {
++		clock-frequency = <&timing>, "clock-frequency:0";
++		hactive = <&timing>, "hactive:0";
++		hfp = <&timing>, "hfront-porch:0";
++		hsync = <&timing>, "hsync-len:0";
++		hbp = <&timing>, "hback-porch:0";
++		vactive = <&timing>, "vactive:0";
++		vfp = <&timing>, "vfront-porch:0";
++		vsync = <&timing>, "vsync-len:0";
++		vbp = <&timing>, "vback-porch:0";
++		hsync-invert = <&timing>, "hsync-active:0=0";
++		vsync-invert = <&timing>, "vsync-active:0=0";
++		de-invert = <&timing>, "de-active:0=0";
++		pixclk-invert = <&timing>, "pixelclk-active:0=0";
++
++		width-mm = <&panel>, "width-mm:0";
++		height-mm = <&panel>, "height-mm:0";
++
++		rgb565 = <&panel_generic>, "bus-format:0=0x1017",
++			<&dpi_node_generic>, "pinctrl-0:0=",<&dpi_16bit_gpio0>;
++		rgb565-padhi = <&panel_generic>, "bus-format:0=0x1020",
++			<&dpi_node_generic>, "pinctrl-0:0=",<&dpi_16bit_cpadhi_gpio0>;
++		bgr666 = <&panel_generic>, "bus-format:0=0x101f";
++		bgr666-padhi = <&panel_generic>, "bus-format:0=0x101e",
++			<&dpi_node_generic>, "pinctrl-0:0=",<&dpi_18bit_cpadhi_gpio0>;
++		rgb666-padhi = <&panel_generic>, "bus-format:0=0x1015",
++			<&dpi_node_generic>, "pinctrl-0:0=",<&dpi_18bit_cpadhi_gpio0>;
++		bgr888 = <&panel_generic>, "bus-format:0=0x1013",
++			<&dpi_node_generic>, "pinctrl-0:0=",<&dpi_gpio0>;
++		rgb888 = <&panel_generic>, "bus-format:0=0x100a",
++			<&dpi_node_generic>, "pinctrl-0:0=",<&dpi_gpio0>;
++		bus-format = <&panel_generic>, "bus-format:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel.dtsi b/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel.dtsi
+new file mode 100644
+index 000000000000..585402a3b9b4
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel.dtsi
+@@ -0,0 +1,94 @@
++/*
++ * vc4-kms-dpi-hyperpixel4.dtsi
++ * Commmon initialisation for HyperPixel DPI displays
++ */
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			spi {
++				compatible = "spi-gpio";
++				#address-cells = <1>;
++				#size-cells = <0>;
++				pinctrl-0 = <&spi_pins>;
++				pinctrl-names = "default";
++
++				sck-gpios = <&gpio 27 GPIO_ACTIVE_HIGH>;
++				mosi-gpios = <&gpio 26 GPIO_ACTIVE_HIGH>;
++				cs-gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
++				num-chipselects = <1>;
++				sck-idle-input;
++
++				panel: display@0 {
++					reg = <0>;
++					/* 100 kHz */
++					spi-max-frequency = <100000>;
++					backlight = <&backlight>;
++					rotation = <0>;
++
++					port {
++						panel_in: endpoint {
++							remote-endpoint = <&dpi_out>;
++						};
++					};
++				};
++			};
++
++			backlight: backlight {
++				compatible = "gpio-backlight";
++				gpios = <&gpio 19 0>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&dpi>;
++		__overlay__  {
++			status = "okay";
++
++			pinctrl-names = "default";
++			pinctrl-0 = <&dpi_18bit_cpadhi_gpio0>;
++
++			port {
++				dpi_out: endpoint {
++					remote-endpoint = <&panel_in>;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			spi_pins: hyperpixel4_spi_pins {
++				brcm,pins = <27 18 26>;
++				brcm,pull = <BCM2835_PUD_UP BCM2835_PUD_UP BCM2835_PUD_OFF>;
++				brcm,function = <0>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target-path = "/";
++		__overlay__ {
++			i2c_gpio: i2c@0 {
++				compatible = "i2c-gpio";
++				gpios = <&gpio 10 0 /* sda */
++					 &gpio 11 0>; /* scl */
++				i2c-gpio,delay-us = <4>;        /* ~100 kHz */
++				#address-cells = <1>;
++				#size-cells = <0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		rotate = <&panel>, "rotation:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel2r-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel2r-overlay.dts
+new file mode 100644
+index 000000000000..4cd9d6a55c48
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel2r-overlay.dts
+@@ -0,0 +1,114 @@
++/*
++ * vc4-kms-dpi-hyperpixel2r-overlay.dts
++ */
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			spi {
++				compatible = "spi-gpio";
++				#address-cells = <1>;
++				#size-cells = <0>;
++				pinctrl-0 = <&spi_pins>;
++				pinctrl-names = "default";
++
++				sck-gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
++				mosi-gpios = <&gpio 10 GPIO_ACTIVE_HIGH>;
++				cs-gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
++				num-chipselects = <1>;
++
++				panel: display@0 {
++					compatible = "pimoroni,hyperpixel2round";
++					reg = <0>;
++					/* 100 kHz */
++					spi-max-frequency = <100000>;
++					backlight = <&backlight>;
++					rotation = <0>;
++
++					port {
++						panel_in: endpoint {
++							remote-endpoint = <&dpi_out>;
++						};
++					};
++				};
++			};
++
++			backlight: backlight {
++				compatible = "gpio-backlight";
++				gpios = <&gpio 19 0>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&dpi>;
++		__overlay__  {
++			status = "okay";
++
++			pinctrl-names = "default";
++			pinctrl-0 = <&dpi_18bit_cpadhi_gpio0>;
++
++			port {
++				dpi_out: endpoint {
++					remote-endpoint = <&panel_in>;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			spi_pins: hyperpixel4_spi_pins {
++				brcm,pins = <27 18 26>;
++				brcm,pull = <BCM2835_PUD_UP BCM2835_PUD_UP BCM2835_PUD_OFF>;
++				brcm,function = <0>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target-path = "/";
++		__overlay__ {
++			i2c_gpio: i2c@0 {
++				compatible = "i2c-gpio";
++				status = "disabled";
++
++				gpios = <&gpio 10 GPIO_ACTIVE_HIGH /* sda */
++					 &gpio 11 GPIO_ACTIVE_HIGH>; /* scl */
++				i2c-gpio,delay-us = <4>;        /* ~100 kHz */
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				polytouch: edt-ft5x06@15 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					compatible = "edt,edt-ft5406";
++					reg = <0x15>;
++					interrupt-parent = <&gpio>;
++					interrupts = <27 0x02>;
++					touchscreen-size-x = <240>;
++					touchscreen-size-y = <240>;
++				};
++			};
++		};
++	};
++
++	__overrides__ {
++		disable-touch = <0>,"-3";
++		touchscreen-inverted-x = <&polytouch>,"touchscreen-inverted-x?";
++		touchscreen-inverted-y = <&polytouch>,"touchscreen-inverted-y!";
++		touchscreen-swapped-x-y = <&polytouch>,"touchscreen-swapped-x-y!";
++		rotate = <&panel>, "rotation:0";
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel4-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel4-overlay.dts
+new file mode 100644
+index 000000000000..eafc25ad79ff
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel4-overlay.dts
+@@ -0,0 +1,57 @@
++/*
++ * vc4-kms-dpi-hyperpixel4sq-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include "vc4-kms-dpi-hyperpixel.dtsi"
++
++&panel {
++	compatible = "pimoroni,hyperpixel4";
++};
++
++/ {
++	fragment@11 {
++		target = <&i2c_gpio>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			ft6236_14: ft6236@14 {
++				compatible = "goodix,gt911";
++				reg = <0x14>;
++				interrupt-parent = <&gpio>;
++				interrupts = <27 2>;
++				touchscreen-size-x = <480>;
++				touchscreen-size-y = <800>;
++				touchscreen-x-mm = <51>;
++				touchscreen-y-mm = <85>;
++				touchscreen-inverted-y;
++				touchscreen-swapped-x-y;
++			};
++			ft6236_5d: ft6236@5d {
++				compatible = "goodix,gt911";
++				reg = <0x5d>;
++				interrupt-parent = <&gpio>;
++				interrupts = <27 2>;
++				touchscreen-size-x = <480>;
++				touchscreen-size-y = <800>;
++				touchscreen-x-mm = <51>;
++				touchscreen-y-mm = <85>;
++				touchscreen-inverted-y;
++				touchscreen-swapped-x-y;
++			};
++		};
++	};
++
++	__overrides__ {
++		disable-touch = <0>,"-3-11";
++		touchscreen-inverted-x = <&ft6236_14>,"touchscreen-inverted-x?",
++					 <&ft6236_5d>,"touchscreen-inverted-x?";
++		touchscreen-inverted-y = <&ft6236_14>,"touchscreen-inverted-y!",
++					 <&ft6236_5d>,"touchscreen-inverted-y!";
++		touchscreen-swapped-x-y = <&ft6236_14>,"touchscreen-swapped-x-y!",
++					  <&ft6236_5d>,"touchscreen-swapped-x-y!";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel4sq-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel4sq-overlay.dts
+new file mode 100644
+index 000000000000..700046348ecf
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel4sq-overlay.dts
+@@ -0,0 +1,36 @@
++/*
++ * vc4-kms-dpi-hyperpixel4-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include "vc4-kms-dpi-hyperpixel.dtsi"
++
++&panel {
++	compatible = "pimoroni,hyperpixel4square";
++};
++
++/ {
++	fragment@11 {
++		target = <&i2c_gpio>;
++		__overlay__ {
++			polytouch: edt-ft5x06@48 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				compatible = "edt,edt-ft5406";
++				reg = <0x48>;
++				interrupt-parent = <&gpio>;
++				interrupts = <27 0x02>;
++				touchscreen-size-x = <720>;
++				touchscreen-size-y = <720>;
++			};
++		};
++	};
++	__overrides__ {
++		disable-touch = <0>,"-3-11";
++		touchscreen-inverted-x = <&polytouch>,"touchscreen-inverted-x?";
++		touchscreen-inverted-y = <&polytouch>,"touchscreen-inverted-y!";
++		touchscreen-swapped-x-y = <&polytouch>,"touchscreen-swapped-x-y!";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dpi-panel-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-dpi-panel-overlay.dts
+new file mode 100644
+index 000000000000..ee9e2e8fd246
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dpi-panel-overlay.dts
+@@ -0,0 +1,69 @@
++/*
++ * vc4-kms-dpi-panel-overlay.dts
++ * Support for any predefined DPI panel.
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include "vc4-kms-dpi.dtsi"
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&panel>;
++		__dormant__  {
++			compatible = "innolux,at056tn53v1", "simple-panel";
++		};
++	};
++	fragment@1 {
++		target = <&panel>;
++		__dormant__  {
++			compatible = "ontat,yx700wv03", "simple-panel";
++		};
++	};
++	fragment@2 {
++		target = <&panel>;
++		__dormant__  {
++			compatible = "geekworm,mzp280", "simple-panel";
++		};
++	};
++
++	fragment@90 {
++		target = <&dpi>;
++		__dormant__  {
++			pinctrl-0 = <&dpi_18bit_cpadhi_gpio0>;
++		};
++	};
++	fragment@91 {
++		target = <&dpi>;
++		__dormant__  {
++			pinctrl-0 = <&dpi_18bit_gpio0>;
++		};
++	};
++	fragment@92 {
++		target = <&dpi>;
++		__dormant__  {
++			pinctrl-0 = <&dpi_gpio0>;
++		};
++	};
++	fragment@93 {
++		target = <&dpi>;
++		__dormant__  {
++			pinctrl-0 = <&dpi_16bit_cpadhi_gpio0>;
++		};
++	};
++	fragment@94 {
++		target = <&dpi>;
++		__dormant__  {
++			pinctrl-0 = <&dpi_16bit_gpio0>;
++		};
++	};
++
++	__overrides__ {
++		at056tn53v1 = <0>, "+0+90";
++		kippah-7inch = <0>, "+1+91";
++		mzp280 = <0>, "+2+93";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dpi.dtsi b/arch/arm/boot/dts/overlays/vc4-kms-dpi.dtsi
+new file mode 100644
+index 000000000000..27bb76598701
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dpi.dtsi
+@@ -0,0 +1,111 @@
++/*
++ * vc4-kms-dpi.dtsi
++ */
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/ {
++	fragment@100 {
++		target-path = "/";
++		__overlay__ {
++			panel: panel {
++				rotation = <0>;
++				port {
++					panel_in: endpoint {
++						remote-endpoint = <&dpi_out>;
++					};
++				};
++			};
++		};
++	};
++
++	fragment@101 {
++		target = <&dpi>;
++		dpi_node: __overlay__  {
++			status = "okay";
++
++			pinctrl-names = "default";
++
++			port {
++				dpi_out: endpoint {
++					remote-endpoint = <&panel_in>;
++				};
++			};
++		};
++	};
++
++	fragment@102 {
++		target = <&panel>;
++		__dormant__  {
++			backlight = <&backlight>;
++		};
++	};
++
++	fragment@103 {
++		target-path = "/";
++		__dormant__  {
++			backlight: backlight {
++				compatible = "gpio-backlight";
++				gpios = <&gpio 255 GPIO_ACTIVE_HIGH>;
++			};
++		};
++	};
++
++	fragment@104 {
++		target = <&panel>;
++		__dormant__  {
++			backlight = <&backlight_pwm>;
++		};
++	};
++
++	fragment@105 {
++		target-path = "/";
++		__dormant__  {
++			backlight_pwm: backlight_pwm {
++				compatible = "pwm-backlight";
++				brightness-levels = <0 6 8 12 16 24 32 40 48 64 96 128 160 192 224 255>;
++				default-brightness-level = <16>;
++				pwms = <&pwm 0 200000>;
++			};
++		};
++	};
++
++	fragment@106 {
++		target = <&pwm>;
++		__dormant__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&pwm_pins>;
++			assigned-clock-rates = <1000000>;
++			status = "okay";
++		};
++	};
++
++	fragment@107 {
++		target = <&gpio>;
++		__dormant__ {
++			pwm_pins: pwm_pins {
++				brcm,pins = <18>;
++				brcm,function = <2>; /* Alt5 */
++			};
++		};
++	};
++
++	fragment@108 {
++		target = <&chosen>;
++		__dormant__  {
++			bootargs = "snd_bcm2835.enable_headphones=0";
++		};
++	};
++
++	__overrides__ {
++		backlight-gpio = <0>, "+102+103",
++			<&backlight>, "gpios:4";
++		backlight-pwm = <0>, "+104+105+106+107+108";
++		backlight-pwm-chan = <&backlight_pwm>, "pwms:4";
++		backlight-pwm-gpio = <&pwm_pins>, "brcm,pins:0";
++		backlight-pwm-func = <&pwm_pins>, "brcm,function:0";
++		backlight-def-brightness = <&backlight_pwm>, "default-brightness-level:0";
++		rotate = <&panel>, "rotation:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dsi-7inch-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-dsi-7inch-overlay.dts
+new file mode 100644
+index 000000000000..5e1700d0367a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dsi-7inch-overlay.dts
+@@ -0,0 +1,118 @@
++/*
++ * Device Tree overlay for RaspberryPi 7" Touchscreen panel
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include "edt-ft5406.dtsi"
++
++/ {
++	/* No compatible as it will have come from edt-ft5406.dtsi */
++
++	fragment@0 {
++		target = <&dsi1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			port {
++				dsi_out: endpoint {
++					remote-endpoint = <&bridge_in>;
++				};
++			};
++			bridge@0 {
++				reg = <0>;
++				compatible = "toshiba,tc358762";
++				vddc-supply = <&reg_bridge>;
++				ports {
++					#address-cells = <1>;
++					#size-cells = <0>;
++
++					port@0 {
++						reg = <0>;
++						bridge_in: endpoint {
++							remote-endpoint = <&dsi_out>;
++						};
++					};
++
++					port@1 {
++						reg = <1>;
++						bridge_out: endpoint {
++							remote-endpoint = <&panel_in>;
++						};
++					};
++				};
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			panel_disp1: panel_disp1@0 {
++				reg = <0>;
++				compatible = "raspberrypi,7inch-dsi", "simple-panel";
++				backlight = <&reg_display>;
++				power-supply = <&reg_display>;
++
++				port {
++					panel_in: endpoint {
++						remote-endpoint = <&bridge_out>;
++					};
++				};
++			};
++
++			reg_bridge: reg_bridge@0 {
++				reg = <0>;
++				compatible = "regulator-fixed";
++				regulator-name = "bridge_reg";
++				gpio = <&reg_display 0 0>;
++				vin-supply = <&reg_display>;
++				enable-active-high;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			reg_display: reg_display@45 {
++				compatible = "raspberrypi,7inch-touchscreen-panel-regulator";
++				reg = <0x45>;
++				gpio-controller;
++				#gpio-cells = <2>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@5 {
++		target = <&ft5406>;
++		__overlay__ {
++			vcc-supply = <&reg_display>;
++			reset-gpio = <&reg_display 1 1>;
++		};
++	};
++
++	__overrides__ {
++		disable_touch = <0>, "-10-11-12";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dsi-lt070me05000-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-dsi-lt070me05000-overlay.dts
+new file mode 100644
+index 000000000000..d7b8f6713804
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dsi-lt070me05000-overlay.dts
+@@ -0,0 +1,69 @@
++/*
++ * Device Tree overlay to connect a JDI LT070ME05000 DSI panel to DSI1.
++ * This uses 4 DSI data lanes, so can only be used with a Compute Module.
++ *
++ * Credit to forum user gizmomouse on
++ * https://www.raspberrypi.org/forums/viewtopic.php?f=98&t=253912 and
++ * Andrey Vostrukhin of Harlab for the overlay.
++ *
++ * Refer to https://github.com/harlab/CM4_LCD_LT070ME05000 for schematics and
++ * other documentation.
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&dsi1>;
++		__overlay__{
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			port {
++				dsi_out_port:endpoint {
++					remote-endpoint = <&panel_dsi_port>;
++				};
++			};
++
++			lt070me05000:lt070me05000@0 {
++				compatible    = "jdi,lt070me05000";
++				status        = "okay";
++				reg           = <0>;
++				reset-gpios   = <&gpio 17 1>;   // LCD RST
++				enable-gpios  = <&gpio 4 0>;    // LCD Enable
++				dcdc-en-gpios = <&gpio 5 0>;    // LCD DC-DC Enable
++				port {
++					panel_dsi_port: endpoint {
++						remote-endpoint = <&dsi_out_port>;
++					};
++				};
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			lt070me05000_pins: lt070me05000_pins {
++				brcm,pins = <4 5 17>;
++				brcm,function = <1 1 1>; // out
++				brcm,pull = <0 0 0>; // off
++			};
++		};
++
++	};
++
++	__overrides__ {
++		reset = <&lt070me05000_pins>,"brcm,pins:8",
++			<&lt070me05000>,"reset-gpios:4";
++
++		enable = <&lt070me05000_pins>,"brcm,pins:0",
++			<&lt070me05000>,"enable-gpios:4";
++
++		dcdc-en = <&lt070me05000_pins>,"brcm,pins:4",
++			<&lt070me05000>,"dcdc-en-gpios:4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dsi-lt070me05000-v2-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-dsi-lt070me05000-v2-overlay.dts
+new file mode 100644
+index 000000000000..5dcd0f2243e2
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dsi-lt070me05000-v2-overlay.dts
+@@ -0,0 +1,64 @@
++/*
++ * Device Tree overlay to connect a JDI LT070ME05000 DSI panel to DSI1.
++ * This uses 4 DSI data lanes, so can only be used with a Compute Module.
++ *
++ * The overlay is for V2 of Harlab's interface board that uses a PCA9536 to
++ * handle the panel's control GPIOs instead of wiring it back to Pi GPIOs.
++ *
++ * Credit to Andrey Vostrukhin of Harlab for the overlay.
++ *
++ * Refer to https://github.com/harlab/CM4_LCD_LT070ME05000 for schematics and
++ * other documentation.
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pca: pca@41 {
++				compatible = "nxp,pca9536";
++				reg = <0x41>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&dsi1>;
++		__overlay__{
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			port {
++				dsi_out_port:endpoint {
++					remote-endpoint = <&panel_dsi_port>;
++				};
++			};
++
++			lt070me05000:lt070me05000@0 {
++				compatible    = "jdi,lt070me05000";
++				status        = "okay";
++				reg           = <0>;
++				reset-gpios   = <&pca 0 1>;
++				enable-gpios  = <&pca 2 0>;
++				dcdc-en-gpios = <&pca 1 0>;
++				port {
++					panel_dsi_port: endpoint {
++						remote-endpoint = <&dsi_out_port>;
++					};
++				};
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-kippah-7inch-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-kippah-7inch-overlay.dts
+new file mode 100644
+index 000000000000..4c1aa1c70158
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-kippah-7inch-overlay.dts
+@@ -0,0 +1,26 @@
++/*
++ * vc4-kms-kippah-7inch-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include "vc4-kms-dpi.dtsi"
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&panel>;
++		__overlay__  {
++			compatible = "ontat,yx700wv03", "simple-panel";
++		};
++	};
++
++	fragment@1 {
++		target = <&dpi>;
++		__overlay__  {
++			pinctrl-0 = <&dpi_18bit_gpio0>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
+new file mode 100644
+index 000000000000..26a5bd71945d
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
+@@ -0,0 +1,124 @@
++/*
++ * vc4-kms-v3d-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/bcm2835.h>
++
++#include "cma-overlay.dts"
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@1 {
++		target = <&i2c2>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&fb>;
++		__overlay__  {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&pixelvalve0>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&pixelvalve1>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@5 {
++		target = <&pixelvalve2>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@6 {
++		target = <&hvs>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@7 {
++		target = <&hdmi>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@8 {
++		target = <&v3d>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@9 {
++		target = <&vc4>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@10 {
++		target = <&clocks>;
++		__overlay__  {
++			claim-clocks = <
++				BCM2835_PLLD_DSI0
++				BCM2835_PLLD_DSI1
++				BCM2835_PLLH_AUX
++				BCM2835_PLLH_PIX
++			>;
++		};
++	};
++
++	fragment@11 {
++		target = <&vec>;
++		__dormant__  {
++			status = "okay";
++		};
++	};
++
++	fragment@12 {
++		target = <&txp>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@13 {
++		target = <&hdmi>;
++		__dormant__  {
++			dmas;
++		};
++	};
++
++	fragment@14 {
++		target = <&chosen>;
++		__overlay__  {
++			bootargs = "snd_bcm2835.enable_hdmi=0";
++		};
++	};
++
++	__overrides__ {
++		audio   = <0>,"!13";
++		noaudio = <0>,"=13";
++		composite = <0>, "=11";
++		nohdmi = <0>, "-1-7";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-v3d-pi4-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-v3d-pi4-overlay.dts
+new file mode 100644
+index 000000000000..1cf4ec5c8637
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-v3d-pi4-overlay.dts
+@@ -0,0 +1,200 @@
++/*
++ * vc4-kms-v3d-pi4-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/bcm2835.h>
++
++#include "cma-overlay.dts"
++
++&frag0 {
++	size = <((320-4)*1024*1024)>;
++};
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@1 {
++		target = <&ddc0>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&ddc1>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&hdmi0>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&hdmi1>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@5 {
++		target = <&hvs>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@6 {
++		target = <&pixelvalve0>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@7 {
++		target = <&pixelvalve1>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@8 {
++		target = <&pixelvalve2>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@9 {
++		target = <&pixelvalve3>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@10 {
++		target = <&pixelvalve4>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@11 {
++		target = <&v3d>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@12 {
++		target = <&vc4>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@13 {
++		target = <&txp>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@14 {
++		target = <&fb>;
++		__overlay__  {
++			status = "disabled";
++		};
++	};
++
++	fragment@15 {
++		target = <&firmwarekms>;
++		__overlay__  {
++			status = "disabled";
++		};
++	};
++
++	fragment@16 {
++		target = <&vec>;
++		__overlay__  {
++			status = "disabled";
++		};
++	};
++
++	fragment@17 {
++		target = <&hdmi0>;
++		__dormant__  {
++			dmas;
++		};
++	};
++
++	fragment@18 {
++		target = <&hdmi1>;
++		__dormant__  {
++			dmas;
++		};
++	};
++
++	fragment@19 {
++		target-path = "/chosen";
++		__overlay__  {
++			bootargs = "snd_bcm2835.enable_hdmi=0";
++		};
++	};
++
++	fragment@20 {
++		target = <&dvp>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@21 {
++		target = <&pixelvalve3>;
++		__dormant__  {
++			status = "okay";
++		};
++	};
++
++	fragment@22 {
++		target = <&vec>;
++		__dormant__  {
++			status = "okay";
++		};
++	};
++
++	fragment@23 {
++		target = <&aon_intr>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		audio   = <0>,"!17";
++		audio1   = <0>,"!18";
++		noaudio = <0>,"=17", <0>,"=18";
++		composite = <0>, "!1",
++			    <0>, "!2",
++			    <0>, "!3",
++			    <0>, "!4",
++			    <0>, "!6",
++			    <0>, "!7",
++			    <0>, "!8",
++			    <0>, "!9",
++			    <0>, "!10",
++			    <0>, "!16",
++			    <0>, "=21",
++			    <0>, "=22";
++		nohdmi0 =   <0>, "-1-3-8";
++		nohdmi1 =   <0>, "-2-4-10";
++		nohdmi =    <0>, "-1-2-3-4-8-10";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-vga666-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-vga666-overlay.dts
+new file mode 100644
+index 000000000000..6e787099e861
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-vga666-overlay.dts
+@@ -0,0 +1,100 @@
++/*
++ * vc4-kms-vga666-overlay.dts
++ * Configures a FenLogic or similar VGA666 DPI adapter when using the
++ * vc4-kms-v3d driver.
++ * If a suitable I2C level shifter is connected to GPIOs 0&1 and the VGA
++ * ID1/SDA (pin 12) and ID3/SCL (pin 15) lines, then there is the option to
++ * enable reading the EDID from the display.
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			vga_connector: vga_connector {
++				compatible = "vga-connector";
++				label = "vga";
++
++				port {
++					vga_con_in: endpoint {
++						remote-endpoint = <&vga666_out>;
++					};
++				};
++			};
++
++			vga_dac {
++				compatible = "dumb-vga-dac";
++
++				ports {
++					#address-cells = <1>;
++					#size-cells = <0>;
++
++					port@0 {
++						reg = <0>;
++
++						vga666_in: endpoint {
++							remote-endpoint = <&dpi_out>;
++						};
++					};
++
++					port@1 {
++						reg = <1>;
++
++						vga666_out: endpoint {
++							remote-endpoint = <&vga_con_in>;
++						};
++					};
++				};
++			};
++
++		};
++	};
++
++	fragment@1 {
++		target = <&dpi>;
++		__overlay__  {
++			status = "okay";
++
++			pinctrl-names = "default";
++			pinctrl-0 = <&dpi_18bit_gpio2>;
++
++			port {
++				dpi_out: endpoint@0 {
++					remote-endpoint = <&vga666_in>;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&vga_connector>;
++		__dormant__  {
++			ddc-i2c-bus = <&i2c_vc>;
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0if>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c0mux>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		ddc = <0>,"=2", <0>,"=3", <0>,"=4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vga666-overlay.dts b/arch/arm/boot/dts/overlays/vga666-overlay.dts
+new file mode 100644
+index 000000000000..a4968d180a5d
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vga666-overlay.dts
+@@ -0,0 +1,30 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	// There is no VGA driver module, but we need a platform device
++	// node (that doesn't already use pinctrl) to hang the pinctrl
++	// reference on - leds will do
++
++	fragment@0 {
++		target = <&leds>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&vga666_pins>;
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			vga666_pins: vga666_pins {
++				brcm,pins = <2 3 4 5 6 7 8 9 10 11 12
++					     13 14 15 16 17 18 19 20 21>;
++				brcm,function = <6>; /* alt2 */
++				brcm,pull = <0>; /* no pull */
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vl805-overlay.dts b/arch/arm/boot/dts/overlays/vl805-overlay.dts
+new file mode 100644
+index 000000000000..81adf34b29f2
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vl805-overlay.dts
+@@ -0,0 +1,18 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/reset/raspberrypi,firmware-reset.h>
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target-path = "pcie0/pci@0,0";
++		__overlay__ {
++			usb@0,0 {
++				reg = <0 0 0 0 0>;
++				resets = <&reset RASPBERRYPI_FIRMWARE_RESET_ID_USB>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/w1-gpio-overlay.dts b/arch/arm/boot/dts/overlays/w1-gpio-overlay.dts
+new file mode 100644
+index 000000000000..f44e325bc1f2
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/w1-gpio-overlay.dts
+@@ -0,0 +1,40 @@
++// Definitions for w1-gpio module (without external pullup)
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++
++			w1: onewire@0 {
++				compatible = "w1-gpio";
++				pinctrl-names = "default";
++				pinctrl-0 = <&w1_pins>;
++				gpios = <&gpio 4 0>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			w1_pins: w1_pins@0 {
++				brcm,pins = <4>;
++				brcm,function = <0>; // in (initially)
++				brcm,pull = <0>; // off
++			};
++		};
++	};
++
++	__overrides__ {
++		gpiopin =       <&w1>,"gpios:4",
++				<&w1>,"reg:0",
++				<&w1_pins>,"brcm,pins:0",
++				<&w1_pins>,"reg:0";
++		pullup;		// Silently ignore unneeded parameter
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts b/arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts
+new file mode 100644
+index 000000000000..953c6a1aeab9
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts
+@@ -0,0 +1,42 @@
++// Definitions for w1-gpio module (with external pullup)
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++
++			w1: onewire@0 {
++				compatible = "w1-gpio";
++				pinctrl-names = "default";
++				pinctrl-0 = <&w1_pins>;
++				gpios = <&gpio 4 0>, <&gpio 5 1>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			w1_pins: w1_pins@0 {
++				brcm,pins = <4 5>;
++				brcm,function = <0 1>; // in out
++				brcm,pull = <0 0>; // off off
++			};
++		};
++	};
++
++	__overrides__ {
++		gpiopin =       <&w1>,"gpios:4",
++				<&w1>,"reg:0",
++				<&w1_pins>,"brcm,pins:0",
++				<&w1_pins>,"reg:0";
++		extpullup =     <&w1>,"gpios:16",
++				<&w1_pins>,"brcm,pins:4";
++		pullup;		// Silently ignore unneeded parameter
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/w5500-overlay.dts b/arch/arm/boot/dts/overlays/w5500-overlay.dts
+new file mode 100644
+index 000000000000..4d3e66296753
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/w5500-overlay.dts
+@@ -0,0 +1,63 @@
++// Overlay for the Wiznet w5500 Ethernet Controller
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev1>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			eth1: w5500@0{
++				compatible = "wiznet,w5500";
++				reg = <0>; /* CE0 */
++				pinctrl-names = "default";
++				pinctrl-0 = <&eth1_pins>;
++				interrupt-parent = <&gpio>;
++				interrupts = <25 0x8>;
++				spi-max-frequency = <30000000>;
++//				local-mac-address = [aa bb cc dd ee ff];
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			eth1_pins: eth1_pins {
++				brcm,pins = <25>;
++				brcm,function = <0>; /* in */
++				brcm,pull = <0>; /* none */
++			};
++		};
++	};
++
++	__overrides__ {
++		int_pin = <&eth1>, "interrupts:0",
++		          <&eth1_pins>, "brcm,pins:0";
++		speed   = <&eth1>, "spi-max-frequency:0";
++		cs      = <&eth1>, "reg:0",
++			  <0>, "!0=1";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/watterott-display-overlay.dts b/arch/arm/boot/dts/overlays/watterott-display-overlay.dts
+new file mode 100644
+index 000000000000..c0e20afa3bf0
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/watterott-display-overlay.dts
+@@ -0,0 +1,150 @@
++/*
++ * Device Tree overlay for rpi-display by Watterott
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			rpi_display_pins: rpi_display_pins {
++				brcm,pins = <18 23 24 25>;
++				brcm,function = <1 1 1 0>; /* out out out in */
++				brcm,pull = <0 0 0 2>; /* - - - up */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			rpidisplay: rpi-display@0{
++				compatible = "ilitek,ili9341";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&rpi_display_pins>;
++
++				spi-max-frequency = <32000000>;
++				rotate = <270>;
++				bgr;
++				fps = <30>;
++				buswidth = <8>;
++				reset-gpios = <&gpio 23 1>;
++				dc-gpios = <&gpio 24 0>;
++				led-gpios = <&gpio 18 0>;
++				debug = <0>;
++			};
++
++			rpidisplay_ts: rpi-display-ts@1 {
++				compatible = "ti,ads7846";
++				reg = <1>;
++
++				spi-max-frequency = <2000000>;
++				interrupts = <25 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				pendown-gpio = <&gpio 25 1>;
++				ti,x-plate-ohms = /bits/ 16 <60>;
++				ti,pressure-max = /bits/ 16 <255>;
++			};
++		};
++	};
++
++	fragment@10 {
++		target = <&rpidisplay>;
++		__dormant__  {
++			backlight = <&backlight_gpio>;
++		};
++	};
++
++	fragment@11 {
++		target-path = "/";
++		__dormant__  {
++			backlight_gpio: backlight_gpio {
++				compatible = "gpio-backlight";
++				gpios = <&gpio 18 0>; /* GPIO_ACTIVE_HIGH */
++			};
++		};
++	};
++
++	fragment@20 {
++		target = <&rpidisplay>;
++		__dormant__  {
++			backlight = <&backlight_pwm>;
++		};
++	};
++
++	fragment@21 {
++		target-path = "/";
++		__dormant__  {
++			backlight_pwm: backlight_pwm {
++				compatible = "pwm-backlight";
++				brightness-levels = <0 6 8 12 16 24 32 40 48 64 96 128 160 192 224 255>;
++				default-brightness-level = <16>;
++				pwms = <&pwm 0 200000>;
++			};
++		};
++	};
++
++	fragment@22 {
++		target = <&pwm>;
++		__dormant__ {
++			assigned-clock-rates = <1000000>;
++			status = "okay";
++		};
++	};
++
++	fragment@23 {
++		target = <&chosen>;
++		__dormant__  {
++			bootargs = "snd_bcm2835.enable_headphones=0";
++		};
++	};
++
++	__overrides__ {
++		speed =     <&rpidisplay>,"spi-max-frequency:0";
++		rotate =    <&rpidisplay>,"rotate:0", /* fbtft */
++			    <&rpidisplay>,"rotation:0"; /* drm */
++		fps =       <&rpidisplay>,"fps:0";
++		debug =     <&rpidisplay>,"debug:0";
++		xohms =     <&rpidisplay_ts>,"ti,x-plate-ohms;0";
++		swapxy =    <&rpidisplay_ts>,"ti,swap-xy?";
++		backlight = <&rpidisplay>,"led-gpios:4",
++		            <&rpi_display_pins>,"brcm,pins:0";
++		drm =       <&rpidisplay>, "compatible=multi-inno,mi0283qt",
++			    <&rpidisplay>, "spi-max-frequency:0=70000000",
++			    <&rpidisplay>, "reset-gpios:8=0", /* GPIO_ACTIVE_HIGH */
++			    <0>, "+10+11";
++		backlight-pwm = <0>, "-10-11+20+21+22+23",
++				<&rpi_display_pins>, "brcm,function:0=2"; /* Alt5 */
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/waveshare-can-fd-hat-mode-a-overlay.dts b/arch/arm/boot/dts/overlays/waveshare-can-fd-hat-mode-a-overlay.dts
+new file mode 100644
+index 000000000000..59388cc3b0b9
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/waveshare-can-fd-hat-mode-a-overlay.dts
+@@ -0,0 +1,140 @@
++// redo: ovmerge -c spi1-1cs-overlay.dts,cs0_pin=26,cs0_spidev=false mcp251xfd-overlay.dts,spi0-0,interrupt=25 mcp251xfd-overlay.dts,spi1-0,interrupt=16
++
++// Device tree overlay for https://www.waveshare.com/2-ch-can-fd-hat.htm
++// in "Mode A" (default) configuration
++// for details see https://www.waveshare.com/wiki/2-CH_CAN_FD_HAT
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			spi1_pins: spi1_pins {
++				brcm,pins = <19 20 21>;
++				brcm,function = <3>;
++			};
++			spi1_cs_pins: spi1_cs_pins {
++				brcm,pins = <26>;
++				brcm,function = <1>;
++			};
++		};
++	};
++	fragment@1 {
++		target = <&spi1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&spi1_pins &spi1_cs_pins>;
++			cs-gpios = <&gpio 26 1>;
++			status = "okay";
++			spidev@0 {
++				compatible = "spidev";
++				reg = <0>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "disabled";
++			};
++		};
++	};
++	fragment@2 {
++		target = <&aux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@3 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@4 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp251xfd_pins: mcp251xfd_spi0_0_pins {
++				brcm,pins = <25>;
++				brcm,function = <BCM2835_FSEL_GPIO_IN>;
++			};
++		};
++	};
++	fragment@5 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_mcp251xfd_osc: mcp251xfd-spi0-0-osc {
++				#clock-cells = <0>;
++				compatible = "fixed-clock";
++				clock-frequency = <40000000>;
++			};
++		};
++	};
++	fragment@6 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			mcp251xfd@0 {
++				compatible = "microchip,mcp251xfd";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp251xfd_pins>;
++				spi-max-frequency = <20000000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <25 IRQ_TYPE_LEVEL_LOW>;
++				clocks = <&clk_mcp251xfd_osc>;
++			};
++		};
++	};
++	fragment@7 {
++		target-path = "spi1/spidev@0";
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@8 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp251xfd_pins_1: mcp251xfd_spi1_0_pins {
++				brcm,pins = <16>;
++				brcm,function = <BCM2835_FSEL_GPIO_IN>;
++			};
++		};
++	};
++	fragment@9 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_mcp251xfd_osc_1: mcp251xfd-spi1-0-osc {
++				#clock-cells = <0>;
++				compatible = "fixed-clock";
++				clock-frequency = <40000000>;
++			};
++		};
++	};
++	fragment@10 {
++		target = <&spi1>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			mcp251xfd@0 {
++				compatible = "microchip,mcp251xfd";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp251xfd_pins_1>;
++				spi-max-frequency = <20000000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <16 IRQ_TYPE_LEVEL_LOW>;
++				clocks = <&clk_mcp251xfd_osc_1>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/waveshare-can-fd-hat-mode-b-overlay.dts b/arch/arm/boot/dts/overlays/waveshare-can-fd-hat-mode-b-overlay.dts
+new file mode 100644
+index 000000000000..b2504922c8de
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/waveshare-can-fd-hat-mode-b-overlay.dts
+@@ -0,0 +1,103 @@
++// redo: ovmerge -c mcp251xfd-overlay.dts,spi0-0,interrupt=25 mcp251xfd-overlay.dts,spi0-1,interrupt=16
++
++// Device tree overlay for https://www.waveshare.com/2-ch-can-fd-hat.htm
++// in "Mode B" (requried hardware modification) configuration
++// for details see https://www.waveshare.com/wiki/2-CH_CAN_FD_HAT
++
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp251xfd_pins: mcp251xfd_spi0_0_pins {
++				brcm,pins = <25>;
++				brcm,function = <BCM2835_FSEL_GPIO_IN>;
++			};
++		};
++	};
++	fragment@2 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_mcp251xfd_osc: mcp251xfd-spi0-0-osc {
++				#clock-cells = <0>;
++				compatible = "fixed-clock";
++				clock-frequency = <40000000>;
++			};
++		};
++	};
++	fragment@3 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			mcp251xfd@0 {
++				compatible = "microchip,mcp251xfd";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp251xfd_pins>;
++				spi-max-frequency = <20000000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <25 IRQ_TYPE_LEVEL_LOW>;
++				clocks = <&clk_mcp251xfd_osc>;
++			};
++		};
++	};
++	fragment@4 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@5 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp251xfd_pins_1: mcp251xfd_spi0_1_pins {
++				brcm,pins = <16>;
++				brcm,function = <BCM2835_FSEL_GPIO_IN>;
++			};
++		};
++	};
++	fragment@6 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_mcp251xfd_osc_1: mcp251xfd-spi0-1-osc {
++				#clock-cells = <0>;
++				compatible = "fixed-clock";
++				clock-frequency = <40000000>;
++			};
++		};
++	};
++	fragment@7 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			mcp251xfd@1 {
++				compatible = "microchip,mcp251xfd";
++				reg = <1>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp251xfd_pins_1>;
++				spi-max-frequency = <20000000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <16 IRQ_TYPE_LEVEL_LOW>;
++				clocks = <&clk_mcp251xfd_osc_1>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/wittypi-overlay.dts b/arch/arm/boot/dts/overlays/wittypi-overlay.dts
+new file mode 100644
+index 000000000000..71ce806186de
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/wittypi-overlay.dts
+@@ -0,0 +1,44 @@
++/*
++ * Device Tree overlay for Witty Pi extension board by UUGear
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&leds>;
++		__overlay__ {
++			compatible = "gpio-leds";
++			wittypi_led: wittypi_led {
++				label = "wittypi_led";
++				linux,default-trigger = "default-on";
++				gpios = <&gpio 17 0>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			rtc: ds1337@68 {
++				compatible = "dallas,ds1337";
++				reg = <0x68>;
++				wakeup-source;
++			};
++		};
++	};
++
++	__overrides__ {
++		led_gpio =	<&wittypi_led>,"gpios:4";
++		led_trigger =	<&wittypi_led>,"linux,default-trigger";
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/wm8960-soundcard-overlay.dts b/arch/arm/boot/dts/overlays/wm8960-soundcard-overlay.dts
+new file mode 100644
+index 000000000000..289fa4dacdf1
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/wm8960-soundcard-overlay.dts
+@@ -0,0 +1,82 @@
++// Definitions for Waveshare WM8960 https://github.com/waveshare/WM8960-Audio-HAT
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path="/";
++		__overlay__ {
++			wm8960_mclk: wm8960_mclk {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <12288000>;
++			};
++		};
++	};
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			wm8960: wm8960 {
++				compatible = "wlf,wm8960";
++				reg = <0x1a>;
++				#sound-dai-cells = <0>;
++				AVDD-supply = <&vdd_5v0_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++			};
++		};
++	};
++
++
++	fragment@3 {
++		target = <&sound>;
++		slave_overlay: __overlay__ {
++			compatible = "simple-audio-card";
++			simple-audio-card,format = "i2s";
++			simple-audio-card,name = "wm8960-soundcard"; 
++			status = "okay";
++
++			simple-audio-card,widgets =
++				"Microphone", "Mic Jack",
++				"Line", "Line In",
++				"Line", "Line Out",
++				"Speaker", "Speaker",
++				"Headphone", "Headphone Jack";
++			simple-audio-card,routing =
++				"Headphone Jack", "HP_L",
++				"Headphone Jack", "HP_R",
++				"Speaker", "SPK_LP",
++				"Speaker", "SPK_LN",
++				"LINPUT1", "Mic Jack",
++				"LINPUT3", "Mic Jack",
++				"RINPUT1", "Mic Jack",
++				"RINPUT2", "Mic Jack";
++
++			simple-audio-card,cpu {
++				sound-dai = <&i2s>;
++			};
++			dailink0_slave: simple-audio-card,codec {
++				sound-dai = <&wm8960>;
++				clocks = <&wm8960_mclk>;
++				clock-names = "mclk";
++			};
++		};
++	};
++
++	__overrides__ {
++		alsaname = <&slave_overlay>,"simple-audio-card,name";
++		compatible = <&wm8960>,"compatible";
++	};
++};
+diff --git a/arch/arm64/boot/dts/Makefile b/arch/arm64/boot/dts/Makefile
+index 7b107fa7414b..12e6e2876ea6 100644
+--- a/arch/arm64/boot/dts/Makefile
++++ b/arch/arm64/boot/dts/Makefile
+@@ -32,3 +32,5 @@ subdir-y += tesla
+ subdir-y += ti
+ subdir-y += toshiba
+ subdir-y += xilinx
++
++subdir-y += overlays
+diff --git a/arch/arm64/boot/dts/broadcom/Makefile b/arch/arm64/boot/dts/broadcom/Makefile
+index 05d8c5ecf3b0..9b678d144085 100644
+--- a/arch/arm64/boot/dts/broadcom/Makefile
++++ b/arch/arm64/boot/dts/broadcom/Makefile
+@@ -8,6 +8,20 @@ dtb-$(CONFIG_ARCH_BCM2835) += bcm2711-rpi-400.dtb \
+ 			      bcm2837-rpi-cm3-io3.dtb \
+ 			      bcm2837-rpi-zero-2-w.dtb
+ 
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-zero-2.dtb
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-zero-2-w.dtb
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-2-b.dtb
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-3-b.dtb
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-3-b-plus.dtb
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-cm3.dtb
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2711-rpi-cm4.dtb
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2711-rpi-cm4s.dtb
++
+ subdir-y	+= bcmbca
+ subdir-y	+= northstar2
+ subdir-y	+= stingray
++
++# Enable fixups to support overlays on BCM2835 platforms
++ifeq ($(CONFIG_ARCH_BCM2835),y)
++	DTC_FLAGS += -@
++endif
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2710-rpi-2-b.dts b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-2-b.dts
+new file mode 100644
+index 000000000000..36ecea71f0ef
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-2-b.dts
+@@ -0,0 +1 @@
++#include "../../../../arm/boot/dts/bcm2710-rpi-2-b.dts"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b-plus.dts b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b-plus.dts
+new file mode 100644
+index 000000000000..22fc6a82f2a9
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b-plus.dts
+@@ -0,0 +1 @@
++#include "../../../../arm/boot/dts/bcm2710-rpi-3-b-plus.dts"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b.dts b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b.dts
+new file mode 100644
+index 000000000000..4cacc5b72ae3
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b.dts
+@@ -0,0 +1 @@
++#include "../../../../arm/boot/dts/bcm2710-rpi-3-b.dts"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2710-rpi-cm3.dts b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-cm3.dts
+new file mode 100644
+index 000000000000..e1e13784cff6
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-cm3.dts
+@@ -0,0 +1 @@
++#include "../../../../arm/boot/dts/bcm2710-rpi-cm3.dts"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2710-rpi-zero-2-w.dts b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-zero-2-w.dts
+new file mode 100644
+index 000000000000..4d34e0afd4cd
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-zero-2-w.dts
+@@ -0,0 +1 @@
++#include "../../../../arm/boot/dts/bcm2710-rpi-zero-2-w.dts"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2710-rpi-zero-2.dts b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-zero-2.dts
+new file mode 100644
+index 000000000000..4d34e0afd4cd
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-zero-2.dts
+@@ -0,0 +1 @@
++#include "../../../../arm/boot/dts/bcm2710-rpi-zero-2-w.dts"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2711-rpi-4-b.dts b/arch/arm64/boot/dts/broadcom/bcm2711-rpi-4-b.dts
+index d24c53682e44..bf69a4b0b172 100644
+--- a/arch/arm64/boot/dts/broadcom/bcm2711-rpi-4-b.dts
++++ b/arch/arm64/boot/dts/broadcom/bcm2711-rpi-4-b.dts
+@@ -1,2 +1 @@
+-// SPDX-License-Identifier: GPL-2.0
+-#include "arm/bcm2711-rpi-4-b.dts"
++#include "../../../../arm/boot/dts/bcm2711-rpi-4-b.dts"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2711-rpi-400.dts b/arch/arm64/boot/dts/broadcom/bcm2711-rpi-400.dts
+index b9000f58beb5..90c2b5a195d4 100644
+--- a/arch/arm64/boot/dts/broadcom/bcm2711-rpi-400.dts
++++ b/arch/arm64/boot/dts/broadcom/bcm2711-rpi-400.dts
+@@ -1,2 +1 @@
+-// SPDX-License-Identifier: GPL-2.0
+-#include "arm/bcm2711-rpi-400.dts"
++#include "../../../../arm/boot/dts/bcm2711-rpi-400.dts"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2711-rpi-cm4.dts b/arch/arm64/boot/dts/broadcom/bcm2711-rpi-cm4.dts
+new file mode 100644
+index 000000000000..8064a58155f1
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2711-rpi-cm4.dts
+@@ -0,0 +1 @@
++#include "../../../../arm/boot/dts/bcm2711-rpi-cm4.dts"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2711-rpi-cm4s.dts b/arch/arm64/boot/dts/broadcom/bcm2711-rpi-cm4s.dts
+new file mode 100644
+index 000000000000..28e0980a374b
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2711-rpi-cm4s.dts
+@@ -0,0 +1 @@
++#include "../../../../arm/boot/dts/bcm2711-rpi-cm4s.dts"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm283x-rpi-csi1-2lane.dtsi b/arch/arm64/boot/dts/broadcom/bcm283x-rpi-csi1-2lane.dtsi
+new file mode 120000
+index 000000000000..e5c400284467
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm283x-rpi-csi1-2lane.dtsi
+@@ -0,0 +1 @@
++../../../../arm/boot/dts/bcm283x-rpi-csi1-2lane.dtsi
+\ No newline at end of file
+diff --git a/arch/arm64/boot/dts/broadcom/bcm283x-rpi-lan7515.dtsi b/arch/arm64/boot/dts/broadcom/bcm283x-rpi-lan7515.dtsi
+new file mode 120000
+index 000000000000..fc4c05bbe7fd
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm283x-rpi-lan7515.dtsi
+@@ -0,0 +1 @@
++../../../../arm/boot/dts/bcm283x-rpi-lan7515.dtsi
+\ No newline at end of file
+diff --git a/arch/arm64/boot/dts/overlays b/arch/arm64/boot/dts/overlays
+new file mode 120000
+index 000000000000..ded08646b6f6
+--- /dev/null
++++ b/arch/arm64/boot/dts/overlays
+@@ -0,0 +1 @@
++../../../arm/boot/dts/overlays
+\ No newline at end of file
+diff --git a/include/dt-bindings/gpio/gpio-fsm.h b/include/dt-bindings/gpio/gpio-fsm.h
+new file mode 100644
+index 000000000000..eb40cfdc71df
+--- /dev/null
++++ b/include/dt-bindings/gpio/gpio-fsm.h
+@@ -0,0 +1,21 @@
++/* SPDX-License-Identifier: GPL-2.0+ */
++/*
++ * This header provides constants for binding rpi,gpio-fsm.
++ */
++
++#ifndef _DT_BINDINGS_GPIO_FSM_H
++#define _DT_BINDINGS_GPIO_FSM_H
++
++#define GF_IN       0
++#define GF_OUT      1
++#define GF_SOFT     2
++#define GF_DELAY    3
++#define GF_SHUTDOWN 4
++
++#define GF_IO(t, v) (((v) << 16) | ((t) & 0xffff))
++
++#define GF_IP(x)    GF_IO(GF_IN, (x))
++#define GF_OP(x)    GF_IO(GF_OUT, (x))
++#define GF_SW(x)    GF_IO(GF_SOFT, (x))
++
++#endif
+diff --git a/scripts/Makefile.dtbinst b/scripts/Makefile.dtbinst
+index 190d781e84f4..84c46c081218 100644
+--- a/scripts/Makefile.dtbinst
++++ b/scripts/Makefile.dtbinst
+@@ -18,9 +18,10 @@ include $(srctree)/scripts/Kbuild.include
+ include $(src)/Makefile
+ 
+ dtbs    := $(addprefix $(dst)/, $(dtb-y) $(if $(CONFIG_OF_ALL_DTBS),$(dtb-)))
++dtbos   := $(addprefix $(dst)/, $(dtbo-y) $(if $(CONFIG_OF_ALL_DTBS),$(dtb-)))
+ subdirs := $(addprefix $(obj)/, $(subdir-y) $(subdir-m))
+ 
+-__dtbs_install: $(dtbs) $(subdirs)
++__dtbs_install: $(dtbs) $(dtbos) $(subdirs)
+ 	@:
+ 
+ quiet_cmd_dtb_install = INSTALL $@
+diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
+index 3aa384cec76b..ed87353646bf 100644
+--- a/scripts/Makefile.lib
++++ b/scripts/Makefile.lib
+@@ -339,6 +339,7 @@ DTC_FLAGS += -Wno-interrupt_provider
+ # Disable noisy checks by default
+ ifeq ($(findstring 1,$(KBUILD_EXTRA_WARN)),)
+ DTC_FLAGS += -Wno-unit_address_vs_reg \
++	-Wno-gpios_property \
+ 	-Wno-avoid_unnecessary_addr_size \
+ 	-Wno-alias_paths \
+ 	-Wno-graph_child_address \
+@@ -408,6 +409,18 @@ $(obj)/%.dtb: $(src)/%.dts $(DTC) $(DT_TMP_SCHEMA) FORCE
+ $(obj)/%.dtbo: $(src)/%.dts $(DTC) FORCE
+ 	$(call if_changed_dep,dtc)
+ 
++quiet_cmd_dtco = DTCO    $@
++cmd_dtco = mkdir -p $(dir ${dtc-tmp}) ; \
++	$(CPP) $(dtc_cpp_flags) -x assembler-with-cpp -o $(dtc-tmp) $< ; \
++	$(DTC) -@ -H epapr -O dtb -o $@ -b 0 \
++		-i $(dir $<) $(DTC_FLAGS) \
++		-Wno-interrupts_property \
++		-d $(depfile).dtc.tmp $(dtc-tmp) ; \
++	cat $(depfile).pre.tmp $(depfile).dtc.tmp > $(depfile)
++
++$(obj)/%.dtbo: $(src)/%-overlay.dts FORCE
++	$(call if_changed_dep,dtco)
++
+ dtc-tmp = $(subst $(comma),_,$(dot-target).dts.tmp)
+ 
+ # Bzip2
+-- 
+2.30.2
+
diff --git a/target/linux/bcm27xx/patches-6.1/950-0062-clk-raspberrypi-Add-ISP-to-exported-clocks.patch b/target/linux/bcm27xx/patches-6.1/950-0062-clk-raspberrypi-Add-ISP-to-exported-clocks.patch
new file mode 100644
index 00000000000000..462c222015aca9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0062-clk-raspberrypi-Add-ISP-to-exported-clocks.patch
@@ -0,0 +1,22 @@
+From d4ebd5479019e939b14452f104f6cead150a59e7 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Tue, 12 Apr 2022 20:07:20 +0100
+Subject: [PATCH] clk-raspberrypi: Add ISP to exported clocks
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/clk/bcm/clk-raspberrypi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/clk/bcm/clk-raspberrypi.c
++++ b/drivers/clk/bcm/clk-raspberrypi.c
+@@ -143,6 +143,9 @@ raspberrypi_clk_variants[RPI_FIRMWARE_NU
+ 	[RPI_FIRMWARE_HEVC_CLK_ID] = {
+ 		.export = true,
+ 	},
++	[RPI_FIRMWARE_ISP_CLK_ID] = {
++		.export = true,
++	},
+ 	[RPI_FIRMWARE_PIXEL_BVB_CLK_ID] = {
+ 		.export = true,
+ 	},
diff --git a/target/linux/bcm27xx/patches-6.1/950-0063-Register-the-clocks-early-during-the-boot-process-so.patch b/target/linux/bcm27xx/patches-6.1/950-0063-Register-the-clocks-early-during-the-boot-process-so.patch
new file mode 100644
index 00000000000000..6d7c3a9db7290e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0063-Register-the-clocks-early-during-the-boot-process-so.patch
@@ -0,0 +1,45 @@
+From 1cfa0076e0673ed3c40bcd641c775394113107c1 Mon Sep 17 00:00:00 2001
+From: Martin Sperl <kernel@martin.sperl.org>
+Date: Fri, 2 Sep 2016 16:45:27 +0100
+Subject: [PATCH] Register the clocks early during the boot process, so
+ that special/critical clocks can get enabled early on in the boot process
+ avoiding the risk of disabling a clock, pll_divider or pll when a claiming
+ driver fails to install propperly - maybe it needs to defer.
+
+Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -2319,8 +2319,15 @@ static int bcm2835_clk_probe(struct plat
+ 	if (ret)
+ 		return ret;
+ 
+-	return of_clk_add_hw_provider(dev->of_node, of_clk_hw_onecell_get,
++	ret = of_clk_add_hw_provider(dev->of_node, of_clk_hw_onecell_get,
+ 				      &cprman->onecell);
++	if (ret)
++		return ret;
++
++	/* note that we have registered all the clocks */
++	dev_dbg(dev, "registered %d clocks\n", asize);
++
++	return 0;
+ }
+ 
+ static const struct cprman_plat_data cprman_bcm2835_plat_data = {
+@@ -2346,7 +2353,11 @@ static struct platform_driver bcm2835_cl
+ 	.probe          = bcm2835_clk_probe,
+ };
+ 
+-builtin_platform_driver(bcm2835_clk_driver);
++static int __init __bcm2835_clk_driver_init(void)
++{
++	return platform_driver_register(&bcm2835_clk_driver);
++}
++core_initcall(__bcm2835_clk_driver_init);
+ 
+ MODULE_AUTHOR("Eric Anholt <eric@anholt.net>");
+ MODULE_DESCRIPTION("BCM2835 clock driver");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0064-clk-bcm2835-Mark-used-PLLs-and-dividers-CRITICAL.patch b/target/linux/bcm27xx/patches-6.1/950-0064-clk-bcm2835-Mark-used-PLLs-and-dividers-CRITICAL.patch
new file mode 100644
index 00000000000000..a79b6f012d717d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0064-clk-bcm2835-Mark-used-PLLs-and-dividers-CRITICAL.patch
@@ -0,0 +1,28 @@
+From bb935818eb9d7a8ba76f184f9355c9e71c4f0f7f Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 13 Feb 2017 17:20:08 +0000
+Subject: [PATCH] clk-bcm2835: Mark used PLLs and dividers CRITICAL
+
+The VPU configures and relies on several PLLs and dividers. Mark all
+enabled dividers and their PLLs as CRITICAL to prevent the kernel from
+switching them off.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -1407,6 +1407,11 @@ bcm2835_register_pll_divider(struct bcm2
+ 	divider->div.hw.init = &init;
+ 	divider->div.table = NULL;
+ 
++	if (!(cprman_read(cprman, divider_data->cm_reg) & divider_data->hold_mask)) {
++		init.flags |= CLK_IS_CRITICAL;
++		divider->div.flags |= CLK_IS_CRITICAL;
++	}
++
+ 	divider->cprman = cprman;
+ 	divider->data = divider_data;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0065-clk-bcm2835-Add-claim-clocks-property.patch b/target/linux/bcm27xx/patches-6.1/950-0065-clk-bcm2835-Add-claim-clocks-property.patch
new file mode 100644
index 00000000000000..7889d29b6f82cf
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0065-clk-bcm2835-Add-claim-clocks-property.patch
@@ -0,0 +1,118 @@
+From d3fa68cc641f6a64a15f73203f1bf48f11de91a0 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 13 Feb 2017 17:20:08 +0000
+Subject: [PATCH] clk-bcm2835: Add claim-clocks property
+
+The claim-clocks property can be used to prevent PLLs and dividers
+from being marked as critical. It contains a vector of clock IDs,
+as defined by dt-bindings/clock/bcm2835.h.
+
+Use this mechanism to claim PLLD_DSI0, PLLD_DSI1, PLLH_AUX and
+PLLH_PIX for the vc4_kms_v3d driver.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 43 +++++++++++++++++++++++++++++++++--
+ 1 file changed, 41 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -1335,6 +1335,8 @@ static const struct clk_ops bcm2835_vpu_
+ 	.debug_init = bcm2835_clock_debug_init,
+ };
+ 
++static bool bcm2835_clk_is_claimed(const char *name);
++
+ static struct clk_hw *bcm2835_register_pll(struct bcm2835_cprman *cprman,
+ 					   const void *data)
+ {
+@@ -1352,6 +1354,9 @@ static struct clk_hw *bcm2835_register_p
+ 	init.ops = &bcm2835_pll_clk_ops;
+ 	init.flags = pll_data->flags | CLK_IGNORE_UNUSED;
+ 
++	if (!bcm2835_clk_is_claimed(pll_data->name))
++		init.flags |= CLK_IS_CRITICAL;
++
+ 	pll = kzalloc(sizeof(*pll), GFP_KERNEL);
+ 	if (!pll)
+ 		return NULL;
+@@ -1408,8 +1413,10 @@ bcm2835_register_pll_divider(struct bcm2
+ 	divider->div.table = NULL;
+ 
+ 	if (!(cprman_read(cprman, divider_data->cm_reg) & divider_data->hold_mask)) {
+-		init.flags |= CLK_IS_CRITICAL;
+-		divider->div.flags |= CLK_IS_CRITICAL;
++		if (!bcm2835_clk_is_claimed(divider_data->source_pll))
++			init.flags |= CLK_IS_CRITICAL;
++		if (!bcm2835_clk_is_claimed(divider_data->name))
++			divider->div.flags |= CLK_IS_CRITICAL;
+ 	}
+ 
+ 	divider->cprman = cprman;
+@@ -1466,6 +1473,15 @@ static struct clk_hw *bcm2835_register_c
+ 	init.flags = clock_data->flags | CLK_IGNORE_UNUSED;
+ 
+ 	/*
++	 * Some GPIO clocks for ethernet/wifi PLLs are marked as
++	 * critical (since some platforms use them), but if the
++	 * firmware didn't have them turned on then they clearly
++	 * aren't actually critical.
++	 */
++	if ((cprman_read(cprman, clock_data->ctl_reg) & CM_ENABLE) == 0)
++		init.flags &= ~CLK_IS_CRITICAL;
++
++	/*
+ 	 * Pass the CLK_SET_RATE_PARENT flag if we are allowed to propagate
+ 	 * rate changes on at least of the parents.
+ 	 */
+@@ -2245,6 +2261,8 @@ static const struct bcm2835_clk_desc clk
+ 		.ctl_reg = CM_PERIICTL),
+ };
+ 
++static bool bcm2835_clk_claimed[ARRAY_SIZE(clk_desc_array)];
++
+ /*
+  * Permanently take a reference on the parent of the SDRAM clock.
+  *
+@@ -2264,6 +2282,19 @@ static int bcm2835_mark_sdc_parent_criti
+ 	return clk_prepare_enable(parent);
+ }
+ 
++static bool bcm2835_clk_is_claimed(const char *name)
++{
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(clk_desc_array); i++) {
++		const char *clk_name = *(const char **)(clk_desc_array[i].data);
++		if (!strcmp(name, clk_name))
++		    return bcm2835_clk_claimed[i];
++	}
++
++	return false;
++}
++
+ static int bcm2835_clk_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
+@@ -2273,6 +2304,7 @@ static int bcm2835_clk_probe(struct plat
+ 	const size_t asize = ARRAY_SIZE(clk_desc_array);
+ 	const struct cprman_plat_data *pdata;
+ 	size_t i;
++	u32 clk_id;
+ 	int ret;
+ 
+ 	pdata = of_device_get_match_data(&pdev->dev);
+@@ -2291,6 +2323,13 @@ static int bcm2835_clk_probe(struct plat
+ 	if (IS_ERR(cprman->regs))
+ 		return PTR_ERR(cprman->regs);
+ 
++	memset(bcm2835_clk_claimed, 0, sizeof(bcm2835_clk_claimed));
++	for (i = 0;
++	     !of_property_read_u32_index(pdev->dev.of_node, "claim-clocks",
++					 i, &clk_id);
++	     i++)
++		bcm2835_clk_claimed[clk_id]= true;
++
+ 	memcpy(cprman->real_parent_names, cprman_parent_names,
+ 	       sizeof(cprman_parent_names));
+ 	of_clk_parent_fill(dev->of_node, cprman->real_parent_names,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0066-clk-bcm2835-Read-max-core-clock-from-firmware.patch b/target/linux/bcm27xx/patches-6.1/950-0066-clk-bcm2835-Read-max-core-clock-from-firmware.patch
new file mode 100644
index 00000000000000..58842651a402a4
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0066-clk-bcm2835-Read-max-core-clock-from-firmware.patch
@@ -0,0 +1,115 @@
+From a57b5bb7e16f524f39ce6a68f9d0dc9b64b075ed Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 6 Mar 2017 09:06:18 +0000
+Subject: [PATCH] clk-bcm2835: Read max core clock from firmware
+
+The VPU is responsible for managing the core clock, usually under
+direction from the bcm2835-cpufreq driver but not via the clk-bcm2835
+driver. Since the core frequency can change without warning, it is
+safer to report the maximum clock rate to users of the core clock -
+I2C, SPI and the mini UART - to err on the safe side when calculating
+clock divisors.
+
+If the DT node for the clock driver includes a reference to the
+firmware node, use the firmware API to query the maximum core clock
+instead of reading the divider registers.
+
+Prior to this patch, a "100KHz" I2C bus was sometimes clocked at about
+160KHz. In particular, switching to the 4.9 kernel was likely to break
+SenseHAT usage on a Pi3.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 39 ++++++++++++++++++++++++++++++++++-
+ 1 file changed, 38 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -36,6 +36,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/slab.h>
+ #include <dt-bindings/clock/bcm2835.h>
++#include <soc/bcm2835/raspberrypi-firmware.h>
+ 
+ #define CM_PASSWORD		0x5a000000
+ 
+@@ -296,6 +297,8 @@
+ #define SOC_BCM2711		BIT(1)
+ #define SOC_ALL			(SOC_BCM2835 | SOC_BCM2711)
+ 
++#define VCMSG_ID_CORE_CLOCK     4
++
+ /*
+  * Names of clocks used within the driver that need to be replaced
+  * with an external parent's name.  This array is in the order that
+@@ -314,6 +317,7 @@ static const char *const cprman_parent_n
+ struct bcm2835_cprman {
+ 	struct device *dev;
+ 	void __iomem *regs;
++	struct rpi_firmware *fw;
+ 	spinlock_t regs_lock; /* spinlock for all clocks */
+ 	unsigned int soc;
+ 
+@@ -1039,6 +1043,30 @@ static unsigned long bcm2835_clock_get_r
+ 	return rate;
+ }
+ 
++static unsigned long bcm2835_clock_get_rate_vpu(struct clk_hw *hw,
++						unsigned long parent_rate)
++{
++	struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw);
++	struct bcm2835_cprman *cprman = clock->cprman;
++
++	if (cprman->fw) {
++		struct {
++			u32 id;
++			u32 val;
++		} packet;
++
++		packet.id = VCMSG_ID_CORE_CLOCK;
++		packet.val = 0;
++
++		if (!rpi_firmware_property(cprman->fw,
++					   RPI_FIRMWARE_GET_MAX_CLOCK_RATE,
++					   &packet, sizeof(packet)))
++			return packet.val;
++	}
++
++	return bcm2835_clock_get_rate(hw, parent_rate);
++}
++
+ static void bcm2835_clock_wait_busy(struct bcm2835_clock *clock)
+ {
+ 	struct bcm2835_cprman *cprman = clock->cprman;
+@@ -1327,7 +1355,7 @@ static int bcm2835_vpu_clock_is_on(struc
+  */
+ static const struct clk_ops bcm2835_vpu_clock_clk_ops = {
+ 	.is_prepared = bcm2835_vpu_clock_is_on,
+-	.recalc_rate = bcm2835_clock_get_rate,
++	.recalc_rate = bcm2835_clock_get_rate_vpu,
+ 	.set_rate = bcm2835_clock_set_rate,
+ 	.determine_rate = bcm2835_clock_determine_rate,
+ 	.set_parent = bcm2835_clock_set_parent,
+@@ -2303,6 +2331,7 @@ static int bcm2835_clk_probe(struct plat
+ 	const struct bcm2835_clk_desc *desc;
+ 	const size_t asize = ARRAY_SIZE(clk_desc_array);
+ 	const struct cprman_plat_data *pdata;
++	struct device_node *fw_node;
+ 	size_t i;
+ 	u32 clk_id;
+ 	int ret;
+@@ -2323,6 +2352,14 @@ static int bcm2835_clk_probe(struct plat
+ 	if (IS_ERR(cprman->regs))
+ 		return PTR_ERR(cprman->regs);
+ 
++	fw_node = of_parse_phandle(dev->of_node, "firmware", 0);
++	if (fw_node) {
++		struct rpi_firmware *fw = rpi_firmware_get(NULL);
++		if (!fw)
++			return -EPROBE_DEFER;
++		cprman->fw = fw;
++	}
++
+ 	memset(bcm2835_clk_claimed, 0, sizeof(bcm2835_clk_claimed));
+ 	for (i = 0;
+ 	     !of_property_read_u32_index(pdev->dev.of_node, "claim-clocks",
diff --git a/target/linux/bcm27xx/patches-6.1/950-0067-clk-clk-bcm2835-Use-zd-when-printing-size_t.patch b/target/linux/bcm27xx/patches-6.1/950-0067-clk-clk-bcm2835-Use-zd-when-printing-size_t.patch
new file mode 100644
index 00000000000000..21bfb62c44deb1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0067-clk-clk-bcm2835-Use-zd-when-printing-size_t.patch
@@ -0,0 +1,24 @@
+From 9a6be4f7454aea16db1289664cf4dc5c31fe3a58 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Thu, 24 Jan 2019 15:09:28 +0000
+Subject: [PATCH] clk: clk-bcm2835: Use %zd when printing size_t
+
+The debug text for how many clocks have been registered
+uses "%d" with a size_t. Correct it to "%zd".
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -2406,7 +2406,7 @@ static int bcm2835_clk_probe(struct plat
+ 		return ret;
+ 
+ 	/* note that we have registered all the clocks */
+-	dev_dbg(dev, "registered %d clocks\n", asize);
++	dev_dbg(dev, "registered %zd clocks\n", asize);
+ 
+ 	return 0;
+ }
diff --git a/target/linux/bcm27xx/patches-6.1/950-0068-clk-bcm2835-Don-t-wait-for-pllh-lock.patch b/target/linux/bcm27xx/patches-6.1/950-0068-clk-bcm2835-Don-t-wait-for-pllh-lock.patch
new file mode 100644
index 00000000000000..1096f128a642af
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0068-clk-bcm2835-Don-t-wait-for-pllh-lock.patch
@@ -0,0 +1,38 @@
+From da8b166a070e74a575d376c951f863ff069b7db4 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Wed, 23 Jan 2019 16:11:50 +0000
+Subject: [PATCH] clk-bcm2835: Don't wait for pllh lock
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -647,15 +647,17 @@ static int bcm2835_pll_on(struct clk_hw
+ 	spin_unlock(&cprman->regs_lock);
+ 
+ 	/* Wait for the PLL to lock. */
+-	timeout = ktime_add_ns(ktime_get(), LOCK_TIMEOUT_NS);
+-	while (!(cprman_read(cprman, CM_LOCK) & data->lock_mask)) {
+-		if (ktime_after(ktime_get(), timeout)) {
+-			dev_err(cprman->dev, "%s: couldn't lock PLL\n",
+-				clk_hw_get_name(hw));
+-			return -ETIMEDOUT;
+-		}
++	if (strcmp(data->name, "pllh")) {
++		timeout = ktime_add_ns(ktime_get(), LOCK_TIMEOUT_NS);
++		while (!(cprman_read(cprman, CM_LOCK) & data->lock_mask)) {
++			if (ktime_after(ktime_get(), timeout)) {
++				dev_err(cprman->dev, "%s: couldn't lock PLL\n",
++					clk_hw_get_name(hw));
++				return -ETIMEDOUT;
++			}
+ 
+-		cpu_relax();
++			cpu_relax();
++		}
+ 	}
+ 
+ 	cprman_write(cprman, data->a2w_ctrl_reg,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0069-clk-bcm2835-Add-support-for-setting-leaf-clock-rates.patch b/target/linux/bcm27xx/patches-6.1/950-0069-clk-bcm2835-Add-support-for-setting-leaf-clock-rates.patch
new file mode 100644
index 00000000000000..a2fc5b006643f5
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0069-clk-bcm2835-Add-support-for-setting-leaf-clock-rates.patch
@@ -0,0 +1,53 @@
+From 704690d968a5f1cde04d15ad6c2b8410d7933461 Mon Sep 17 00:00:00 2001
+From: Eric Anholt <eric@anholt.net>
+Date: Thu, 2 May 2019 15:11:05 -0700
+Subject: [PATCH] clk: bcm2835: Add support for setting leaf clock
+ rates while running.
+
+As long as you wait for !BUSY, you can do glitch-free updates of clock
+rate while the clock is running.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -1138,15 +1138,19 @@ static int bcm2835_clock_set_rate(struct
+ 
+ 	spin_lock(&cprman->regs_lock);
+ 
+-	/*
+-	 * Setting up frac support
+-	 *
+-	 * In principle it is recommended to stop/start the clock first,
+-	 * but as we set CLK_SET_RATE_GATE during registration of the
+-	 * clock this requirement should be take care of by the
+-	 * clk-framework.
++	ctl = cprman_read(cprman, data->ctl_reg);
++
++	/* If the clock is running, we have to pause clock generation while
++	 * updating the control and div regs.  This is glitchless (no clock
++	 * signals generated faster than the rate) but each reg access is two
++	 * OSC cycles so the clock will slow down for a moment.
+ 	 */
+-	ctl = cprman_read(cprman, data->ctl_reg) & ~CM_FRAC;
++	if (ctl & CM_ENABLE) {
++		cprman_write(cprman, data->ctl_reg, ctl & ~CM_ENABLE);
++		bcm2835_clock_wait_busy(clock);
++	}
++
++	ctl &= ~CM_FRAC;
+ 	ctl |= (div & CM_DIV_FRAC_MASK) ? CM_FRAC : 0;
+ 	cprman_write(cprman, data->ctl_reg, ctl);
+ 
+@@ -1522,7 +1526,7 @@ static struct clk_hw *bcm2835_register_c
+ 		init.ops = &bcm2835_vpu_clock_clk_ops;
+ 	} else {
+ 		init.ops = &bcm2835_clock_clk_ops;
+-		init.flags |= CLK_SET_RATE_GATE | CLK_SET_PARENT_GATE;
++		init.flags |= CLK_SET_PARENT_GATE;
+ 
+ 		/* If the clock wasn't actually enabled at boot, it's not
+ 		 * critical.
diff --git a/target/linux/bcm27xx/patches-6.1/950-0070-clk-bcm2835-Allow-reparenting-leaf-clocks-while-they.patch b/target/linux/bcm27xx/patches-6.1/950-0070-clk-bcm2835-Allow-reparenting-leaf-clocks-while-they.patch
new file mode 100644
index 00000000000000..711d3d5fa42be5
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0070-clk-bcm2835-Allow-reparenting-leaf-clocks-while-they.patch
@@ -0,0 +1,71 @@
+From da04f315a9aad8344c363e08939dfb7fda22df2e Mon Sep 17 00:00:00 2001
+From: Eric Anholt <eric@anholt.net>
+Date: Thu, 2 May 2019 15:24:04 -0700
+Subject: [PATCH] clk: bcm2835: Allow reparenting leaf clocks while
+ they're running.
+
+This falls under the same "we can reprogram glitch-free as long as we
+pause generation" rule as updating the div/frac fields.  This can be
+used for runtime reclocking of V3D to manage power leakage.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -1127,8 +1127,10 @@ static int bcm2835_clock_on(struct clk_h
+ 	return 0;
+ }
+ 
+-static int bcm2835_clock_set_rate(struct clk_hw *hw,
+-				  unsigned long rate, unsigned long parent_rate)
++static int bcm2835_clock_set_rate_and_parent(struct clk_hw *hw,
++					     unsigned long rate,
++					     unsigned long parent_rate,
++					     u8 parent)
+ {
+ 	struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw);
+ 	struct bcm2835_cprman *cprman = clock->cprman;
+@@ -1150,6 +1152,11 @@ static int bcm2835_clock_set_rate(struct
+ 		bcm2835_clock_wait_busy(clock);
+ 	}
+ 
++	if (parent != 0xff) {
++		ctl &= ~(CM_SRC_MASK << CM_SRC_SHIFT);
++		ctl |= parent << CM_SRC_SHIFT;
++	}
++
+ 	ctl &= ~CM_FRAC;
+ 	ctl |= (div & CM_DIV_FRAC_MASK) ? CM_FRAC : 0;
+ 	cprman_write(cprman, data->ctl_reg, ctl);
+@@ -1161,6 +1168,12 @@ static int bcm2835_clock_set_rate(struct
+ 	return 0;
+ }
+ 
++static int bcm2835_clock_set_rate(struct clk_hw *hw,
++				  unsigned long rate, unsigned long parent_rate)
++{
++	return bcm2835_clock_set_rate_and_parent(hw, rate, parent_rate, 0xff);
++}
++
+ static bool
+ bcm2835_clk_is_pllc(struct clk_hw *hw)
+ {
+@@ -1344,6 +1357,7 @@ static const struct clk_ops bcm2835_cloc
+ 	.unprepare = bcm2835_clock_off,
+ 	.recalc_rate = bcm2835_clock_get_rate,
+ 	.set_rate = bcm2835_clock_set_rate,
++	.set_rate_and_parent = bcm2835_clock_set_rate_and_parent,
+ 	.determine_rate = bcm2835_clock_determine_rate,
+ 	.set_parent = bcm2835_clock_set_parent,
+ 	.get_parent = bcm2835_clock_get_parent,
+@@ -1526,7 +1540,6 @@ static struct clk_hw *bcm2835_register_c
+ 		init.ops = &bcm2835_vpu_clock_clk_ops;
+ 	} else {
+ 		init.ops = &bcm2835_clock_clk_ops;
+-		init.flags |= CLK_SET_PARENT_GATE;
+ 
+ 		/* If the clock wasn't actually enabled at boot, it's not
+ 		 * critical.
diff --git a/target/linux/bcm27xx/patches-6.1/950-0071-clk-bcm2835-Avoid-null-pointer-exception.patch b/target/linux/bcm27xx/patches-6.1/950-0071-clk-bcm2835-Avoid-null-pointer-exception.patch
new file mode 100644
index 00000000000000..a88362bcf119d9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0071-clk-bcm2835-Avoid-null-pointer-exception.patch
@@ -0,0 +1,29 @@
+From e2f6af2a6fb09163318ce8cdb3a49af3c9df9b20 Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Tue, 6 Aug 2019 15:23:14 +0100
+Subject: [PATCH] clk-bcm2835: Avoid null pointer exception
+
+clk_desc_array[BCM2835_PLLB] doesn't exist so we dereference null when iterating
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -2334,9 +2334,11 @@ static bool bcm2835_clk_is_claimed(const
+ 	int i;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(clk_desc_array); i++) {
+-		const char *clk_name = *(const char **)(clk_desc_array[i].data);
+-		if (!strcmp(name, clk_name))
+-		    return bcm2835_clk_claimed[i];
++		if (clk_desc_array[i].data) {
++			const char *clk_name = *(const char **)(clk_desc_array[i].data);
++			if (!strcmp(name, clk_name))
++				return bcm2835_clk_claimed[i];
++		}
+ 	}
+ 
+ 	return false;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0072-clk-bcm2835-Disable-v3d-clock.patch b/target/linux/bcm27xx/patches-6.1/950-0072-clk-bcm2835-Disable-v3d-clock.patch
new file mode 100644
index 00000000000000..15a8e67bb7e0ca
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0072-clk-bcm2835-Disable-v3d-clock.patch
@@ -0,0 +1,58 @@
+From 59d8d02b527bd16a03f1abf9669dae0e2ea94a02 Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Tue, 3 Sep 2019 20:28:00 +0100
+Subject: [PATCH] clk-bcm2835: Disable v3d clock
+
+This is controlled by firmware, see clk-raspberrypi.c
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 30 ++++++++++++------------------
+ 1 file changed, 12 insertions(+), 18 deletions(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -1764,16 +1764,12 @@ static const struct bcm2835_clk_desc clk
+ 		.hold_mask = CM_PLLA_HOLDCORE,
+ 		.fixed_divider = 1,
+ 		.flags = CLK_SET_RATE_PARENT),
+-	[BCM2835_PLLA_PER]	= REGISTER_PLL_DIV(
+-		SOC_ALL,
+-		.name = "plla_per",
+-		.source_pll = "plla",
+-		.cm_reg = CM_PLLA,
+-		.a2w_reg = A2W_PLLA_PER,
+-		.load_mask = CM_PLLA_LOADPER,
+-		.hold_mask = CM_PLLA_HOLDPER,
+-		.fixed_divider = 1,
+-		.flags = CLK_SET_RATE_PARENT),
++
++	/*
++	 * PLLA_PER is used for gpu clocks. Controlled by firmware, see
++	 * clk-raspberrypi.c.
++	 */
++
+ 	[BCM2835_PLLA_DSI0]	= REGISTER_PLL_DIV(
+ 		SOC_ALL,
+ 		.name = "plla_dsi0",
+@@ -2074,14 +2070,12 @@ static const struct bcm2835_clk_desc clk
+ 		.int_bits = 6,
+ 		.frac_bits = 0,
+ 		.tcnt_mux = 3),
+-	[BCM2835_CLOCK_V3D]	= REGISTER_VPU_CLK(
+-		SOC_ALL,
+-		.name = "v3d",
+-		.ctl_reg = CM_V3DCTL,
+-		.div_reg = CM_V3DDIV,
+-		.int_bits = 4,
+-		.frac_bits = 8,
+-		.tcnt_mux = 4),
++
++	/*
++	 * CLOCK_V3D is used for v3d clock. Controlled by firmware, see
++	 * clk-raspberrypi.c.
++	 */
++
+ 	/*
+ 	 * VPU clock.  This doesn't have an enable bit, since it drives
+ 	 * the bus for everything else, and is special so it doesn't need
diff --git a/target/linux/bcm27xx/patches-6.1/950-0073-clk-bcm2835-Pass-DT-node-to-rpi_firmware_get.patch b/target/linux/bcm27xx/patches-6.1/950-0073-clk-bcm2835-Pass-DT-node-to-rpi_firmware_get.patch
new file mode 100644
index 00000000000000..4221a4bfd775b9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0073-clk-bcm2835-Pass-DT-node-to-rpi_firmware_get.patch
@@ -0,0 +1,24 @@
+From 0bd540c587577c9f585b163f4b44842f83bebbf9 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 8 Jul 2021 09:37:10 +0100
+Subject: [PATCH] clk: bcm2835: Pass DT node to rpi_firmware_get
+
+The fw_node pointer has already been retrieved, and using it allows
+us to remove a downstream patch to the firmware driver.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -2369,7 +2369,7 @@ static int bcm2835_clk_probe(struct plat
+ 
+ 	fw_node = of_parse_phandle(dev->of_node, "firmware", 0);
+ 	if (fw_node) {
+-		struct rpi_firmware *fw = rpi_firmware_get(NULL);
++		struct rpi_firmware *fw = rpi_firmware_get(fw_node);
+ 		if (!fw)
+ 			return -EPROBE_DEFER;
+ 		cprman->fw = fw;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0074-clk-bcm2835-Remove-VEC-clock-support.patch b/target/linux/bcm27xx/patches-6.1/950-0074-clk-bcm2835-Remove-VEC-clock-support.patch
new file mode 100644
index 00000000000000..6271a815eb58fc
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0074-clk-bcm2835-Remove-VEC-clock-support.patch
@@ -0,0 +1,34 @@
+From abd81cbef43375bdca1414bb97960161e7a8fe49 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Tue, 19 Oct 2021 14:14:55 +0100
+Subject: [PATCH] clk-bcm2835: Remove VEC clock support
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 15 ---------------
+ 1 file changed, 15 deletions(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -2238,21 +2238,6 @@ static const struct bcm2835_clk_desc clk
+ 		.tcnt_mux = 28,
+ 		.round_up = true),
+ 
+-	/* TV encoder clock.  Only operating frequency is 108Mhz.  */
+-	[BCM2835_CLOCK_VEC]	= REGISTER_PER_CLK(
+-		SOC_ALL,
+-		.name = "vec",
+-		.ctl_reg = CM_VECCTL,
+-		.div_reg = CM_VECDIV,
+-		.int_bits = 4,
+-		.frac_bits = 0,
+-		/*
+-		 * Allow rate change propagation only on PLLH_AUX which is
+-		 * assigned index 7 in the parent array.
+-		 */
+-		.set_rate_parent = BIT(7),
+-		.tcnt_mux = 29),
+-
+ 	/* dsi clocks */
+ 	[BCM2835_CLOCK_DSI0E]	= REGISTER_PER_CLK(
+ 		SOC_ALL,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0075-arm-partially-revert-702b94bff3c50542a6e4ab9a4f4cef0.patch b/target/linux/bcm27xx/patches-6.1/950-0075-arm-partially-revert-702b94bff3c50542a6e4ab9a4f4cef0.patch
new file mode 100644
index 00000000000000..eb1903ee3ca95b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0075-arm-partially-revert-702b94bff3c50542a6e4ab9a4f4cef0.patch
@@ -0,0 +1,99 @@
+From b426d39ea63f239cc7778c9e0c4ff703c10cb65a Mon Sep 17 00:00:00 2001
+From: Dan Pasanen <dan.pasanen@gmail.com>
+Date: Thu, 21 Sep 2017 09:55:42 -0500
+Subject: [PATCH] arm: partially revert
+ 702b94bff3c50542a6e4ab9a4f4cef093262fe65
+
+* Re-expose some dmi APIs for use in VCSM
+---
+ arch/arm/include/asm/cacheflush.h | 21 +++++++++++++++++++++
+ arch/arm/include/asm/glue-cache.h |  2 ++
+ arch/arm/mm/proc-macros.S         |  2 ++
+ arch/arm/mm/proc-syms.c           |  3 +++
+ 4 files changed, 28 insertions(+)
+
+--- a/arch/arm/include/asm/cacheflush.h
++++ b/arch/arm/include/asm/cacheflush.h
+@@ -91,6 +91,21 @@
+  *	DMA Cache Coherency
+  *	===================
+  *
++ *	dma_inv_range(start, end)
++ *
++ *		Invalidate (discard) the specified virtual address range.
++ *		May not write back any entries.  If 'start' or 'end'
++ *		are not cache line aligned, those lines must be written
++ *		back.
++ *		- start  - virtual start address
++ *		- end    - virtual end address
++ *
++ *	dma_clean_range(start, end)
++ *
++ *		Clean (write back) the specified virtual address range.
++ *		- start  - virtual start address
++ *		- end    - virtual end address
++ *
+  *	dma_flush_range(start, end)
+  *
+  *		Clean and invalidate the specified virtual address range.
+@@ -112,6 +127,8 @@ struct cpu_cache_fns {
+ 	void (*dma_map_area)(const void *, size_t, int);
+ 	void (*dma_unmap_area)(const void *, size_t, int);
+ 
++	void (*dma_inv_range)(const void *, const void *);
++	void (*dma_clean_range)(const void *, const void *);
+ 	void (*dma_flush_range)(const void *, const void *);
+ } __no_randomize_layout;
+ 
+@@ -137,6 +154,8 @@ extern struct cpu_cache_fns cpu_cache;
+  * is visible to DMA, or data written by DMA to system memory is
+  * visible to the CPU.
+  */
++#define dmac_inv_range			cpu_cache.dma_inv_range
++#define dmac_clean_range		cpu_cache.dma_clean_range
+ #define dmac_flush_range		cpu_cache.dma_flush_range
+ 
+ #else
+@@ -156,6 +175,8 @@ extern void __cpuc_flush_dcache_area(voi
+  * is visible to DMA, or data written by DMA to system memory is
+  * visible to the CPU.
+  */
++extern void dmac_inv_range(const void *, const void *);
++extern void dmac_clean_range(const void *, const void *);
+ extern void dmac_flush_range(const void *, const void *);
+ 
+ #endif
+--- a/arch/arm/include/asm/glue-cache.h
++++ b/arch/arm/include/asm/glue-cache.h
+@@ -155,6 +155,8 @@ static inline void nop_dma_unmap_area(co
+ #define __cpuc_coherent_user_range	__glue(_CACHE,_coherent_user_range)
+ #define __cpuc_flush_dcache_area	__glue(_CACHE,_flush_kern_dcache_area)
+ 
++#define dmac_inv_range			__glue(_CACHE,_dma_inv_range)
++#define dmac_clean_range		__glue(_CACHE,_dma_clean_range)
+ #define dmac_flush_range		__glue(_CACHE,_dma_flush_range)
+ #endif
+ 
+--- a/arch/arm/mm/proc-macros.S
++++ b/arch/arm/mm/proc-macros.S
+@@ -333,6 +333,8 @@ ENTRY(\name\()_cache_fns)
+ 	.long	\name\()_flush_kern_dcache_area
+ 	.long	\name\()_dma_map_area
+ 	.long	\name\()_dma_unmap_area
++	.long	\name\()_dma_inv_range
++	.long	\name\()_dma_clean_range
+ 	.long	\name\()_dma_flush_range
+ 	.size	\name\()_cache_fns, . - \name\()_cache_fns
+ .endm
+--- a/arch/arm/mm/proc-syms.c
++++ b/arch/arm/mm/proc-syms.c
+@@ -27,6 +27,9 @@ EXPORT_SYMBOL(__cpuc_flush_user_all);
+ EXPORT_SYMBOL(__cpuc_flush_user_range);
+ EXPORT_SYMBOL(__cpuc_coherent_kern_range);
+ EXPORT_SYMBOL(__cpuc_flush_dcache_area);
++EXPORT_SYMBOL(dmac_inv_range);
++EXPORT_SYMBOL(dmac_clean_range);
++EXPORT_SYMBOL(dmac_flush_range);
+ #else
+ EXPORT_SYMBOL(cpu_cache);
+ #endif
diff --git a/target/linux/bcm27xx/patches-6.1/950-0076-cache-export-clean-and-invalidate.patch b/target/linux/bcm27xx/patches-6.1/950-0076-cache-export-clean-and-invalidate.patch
new file mode 100644
index 00000000000000..dc77637d86af19
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0076-cache-export-clean-and-invalidate.patch
@@ -0,0 +1,53 @@
+From d4d635fd535132c67f69837fa4c8bf95588de25d Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Fri, 25 Aug 2017 19:18:13 +0100
+Subject: [PATCH] cache: export clean and invalidate
+
+hack: cache: Fix linker error
+---
+ arch/arm/mm/cache-v6.S | 4 ++--
+ arch/arm/mm/cache-v7.S | 6 ++++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/mm/cache-v6.S
++++ b/arch/arm/mm/cache-v6.S
+@@ -198,7 +198,7 @@ ENTRY(v6_flush_kern_dcache_area)
+  *	- start   - virtual start address of region
+  *	- end     - virtual end address of region
+  */
+-v6_dma_inv_range:
++ENTRY(v6_dma_inv_range)
+ #ifdef CONFIG_DMA_CACHE_RWFO
+ 	ldrb	r2, [r0]			@ read for ownership
+ 	strb	r2, [r0]			@ write for ownership
+@@ -243,7 +243,7 @@ v6_dma_inv_range:
+  *	- start   - virtual start address of region
+  *	- end     - virtual end address of region
+  */
+-v6_dma_clean_range:
++ENTRY(v6_dma_clean_range)
+ 	bic	r0, r0, #D_CACHE_LINE_SIZE - 1
+ 1:
+ #ifdef CONFIG_DMA_CACHE_RWFO
+--- a/arch/arm/mm/cache-v7.S
++++ b/arch/arm/mm/cache-v7.S
+@@ -359,7 +359,8 @@ ENDPROC(v7_flush_kern_dcache_area)
+  *	- start   - virtual start address of region
+  *	- end     - virtual end address of region
+  */
+-v7_dma_inv_range:
++ENTRY(b15_dma_inv_range)
++ENTRY(v7_dma_inv_range)
+ 	dcache_line_size r2, r3
+ 	sub	r3, r2, #1
+ 	tst	r0, r3
+@@ -389,7 +390,8 @@ ENDPROC(v7_dma_inv_range)
+  *	- start   - virtual start address of region
+  *	- end     - virtual end address of region
+  */
+-v7_dma_clean_range:
++ENTRY(b15_dma_clean_range)
++ENTRY(v7_dma_clean_range)
+ 	dcache_line_size r2, r3
+ 	sub	r3, r2, #1
+ 	bic	r0, r0, r3
diff --git a/target/linux/bcm27xx/patches-6.1/950-0077-Revert-spi-spidev-Fix-CS-polarity-if-GPIO-descriptor.patch b/target/linux/bcm27xx/patches-6.1/950-0077-Revert-spi-spidev-Fix-CS-polarity-if-GPIO-descriptor.patch
new file mode 100644
index 00000000000000..6bd1ca5652e626
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0077-Revert-spi-spidev-Fix-CS-polarity-if-GPIO-descriptor.patch
@@ -0,0 +1,32 @@
+From b8b545ec6ce98fc33f5a6f86b55914dce0b56bdb Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 20 Apr 2020 13:41:10 +0100
+Subject: [PATCH] Revert "spi: spidev: Fix CS polarity if GPIO
+ descriptors are used"
+
+This reverts commit 83b2a8fe43bda0c11981ad6afa5dd0104d78be28.
+---
+ drivers/spi/spidev.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -414,7 +414,6 @@ spidev_ioctl(struct file *filp, unsigned
+ 		else
+ 			retval = get_user(tmp, (u32 __user *)arg);
+ 		if (retval == 0) {
+-			struct spi_controller *ctlr = spi->controller;
+ 			u32	save = spi->mode;
+ 
+ 			if (tmp & ~SPI_MODE_MASK) {
+@@ -422,10 +421,6 @@ spidev_ioctl(struct file *filp, unsigned
+ 				break;
+ 			}
+ 
+-			if (ctlr->use_gpio_descriptors && ctlr->cs_gpiods &&
+-			    ctlr->cs_gpiods[spi->chip_select])
+-				tmp |= SPI_CS_HIGH;
+-
+ 			tmp |= spi->mode & ~SPI_MODE_MASK;
+ 			spi->mode = tmp & SPI_MODE_USER_MASK;
+ 			retval = spi_setup(spi);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0078-Revert-Bluetooth-Always-request-for-user-confirmatio.patch b/target/linux/bcm27xx/patches-6.1/950-0078-Revert-Bluetooth-Always-request-for-user-confirmatio.patch
new file mode 100644
index 00000000000000..7304bf8bb6a7de
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0078-Revert-Bluetooth-Always-request-for-user-confirmatio.patch
@@ -0,0 +1,45 @@
+From 506255b7590382088a17f075952f8345e69a6c94 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 1 Mar 2021 09:12:44 +0000
+Subject: [PATCH] Revert "Bluetooth: Always request for user
+ confirmation for Just Works (LE SC)"
+
+This reverts commit ffee202a78c2980688bc5d2f7d56480e69a5e0c9.
+
+The commit "Bluetooth: Always request for user confirmation for Just
+Works" prevents BLE devices pairing in (at least) the Raspberry Pi OS
+GUI. After reverting it, pairing works again. Although this companion
+commit ("... (LE SC)") has not been demonstrated to be problematic,
+it follows the same logic and therefore could affect some use cases.
+
+If another solution to the problem is found then this reversion will
+be removed.
+
+See: https://github.com/raspberrypi/linux/issues/4139
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ net/bluetooth/smp.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/net/bluetooth/smp.c
++++ b/net/bluetooth/smp.c
+@@ -2207,7 +2207,7 @@ mackey_and_ltk:
+ 	if (err)
+ 		return SMP_UNSPECIFIED;
+ 
+-	if (smp->method == REQ_OOB) {
++	if (smp->method == JUST_WORKS || smp->method == REQ_OOB) {
+ 		if (hcon->out) {
+ 			sc_dhkey_check(smp);
+ 			SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
+@@ -2222,9 +2222,6 @@ mackey_and_ltk:
+ 	confirm_hint = 0;
+ 
+ confirm:
+-	if (smp->method == JUST_WORKS)
+-		confirm_hint = 1;
+-
+ 	err = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, hcon->type,
+ 					hcon->dst_type, passkey, confirm_hint);
+ 	if (err)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0079-Revert-Bluetooth-Always-request-for-user-confirmatio.patch b/target/linux/bcm27xx/patches-6.1/950-0079-Revert-Bluetooth-Always-request-for-user-confirmatio.patch
new file mode 100644
index 00000000000000..35d623ffa8227a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0079-Revert-Bluetooth-Always-request-for-user-confirmatio.patch
@@ -0,0 +1,43 @@
+From b7999d8bdd59c3551127df385d47c105ab1d9f47 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 1 Mar 2021 09:14:35 +0000
+Subject: [PATCH] Revert "Bluetooth: Always request for user
+ confirmation for Just Works"
+
+This reverts commit 92516cd97fd4d8ad5b1421a0d51771044f453a5f.
+
+Thi commit "Bluetooth: Always request for user confirmation for Just
+Works" prevents BLE devices pairing in (at least) the Raspberry Pi OS
+GUI. After reverting it, pairing works again.
+
+If another solution to the problem is found then this reversion will
+be removed.
+
+See: https://github.com/raspberrypi/linux/issues/4139
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ net/bluetooth/smp.c | 11 ++---------
+ 1 file changed, 2 insertions(+), 9 deletions(-)
+
+--- a/net/bluetooth/smp.c
++++ b/net/bluetooth/smp.c
+@@ -883,16 +883,9 @@ static int tk_request(struct l2cap_conn
+ 	    hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
+ 		smp->method = JUST_WORKS;
+ 
+-	/* If Just Works, Continue with Zero TK and ask user-space for
+-	 * confirmation */
++	/* If Just Works, Continue with Zero TK */
+ 	if (smp->method == JUST_WORKS) {
+-		ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
+-						hcon->type,
+-						hcon->dst_type,
+-						passkey, 1);
+-		if (ret)
+-			return ret;
+-		set_bit(SMP_FLAG_WAIT_USER, &smp->flags);
++		set_bit(SMP_FLAG_TK_VALID, &smp->flags);
+ 		return 0;
+ 	}
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0080-Revert-net-bcmgenet-Request-APD-DLL-disable-and-IDDQ.patch b/target/linux/bcm27xx/patches-6.1/950-0080-Revert-net-bcmgenet-Request-APD-DLL-disable-and-IDDQ.patch
new file mode 100644
index 00000000000000..9a29d617929bd2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0080-Revert-net-bcmgenet-Request-APD-DLL-disable-and-IDDQ.patch
@@ -0,0 +1,29 @@
+From b0c1da315623496404b3a0203c51ae7fc9d3ed88 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 7 Mar 2022 16:18:55 +0000
+Subject: [PATCH] Revert "net: bcmgenet: Request APD, DLL disable and
+ IDDQ-SR"
+
+This reverts commit c3a4c69360ab43560f212eed326c9d8bde35b14c, which
+broke rebooting when network booting.
+
+See: https://github.com/raspberrypi/rpi-eeprom/issues/417
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/ethernet/broadcom/genet/bcmmii.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+@@ -290,9 +290,7 @@ int bcmgenet_mii_probe(struct net_device
+ 	struct device_node *dn = kdev->of_node;
+ 	phy_interface_t phy_iface = priv->phy_interface;
+ 	struct phy_device *phydev;
+-	u32 phy_flags = PHY_BRCM_AUTO_PWRDWN_ENABLE |
+-			PHY_BRCM_DIS_TXCRXC_NOENRGY |
+-			PHY_BRCM_IDDQ_SUSPEND;
++	u32 phy_flags = 0;
+ 	int ret;
+ 
+ 	/* Communicate the integrated PHY revision */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0081-smsx95xx-fix-crimes-against-truesize.patch b/target/linux/bcm27xx/patches-6.1/950-0081-smsx95xx-fix-crimes-against-truesize.patch
new file mode 100644
index 00000000000000..388a5f25e64507
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0081-smsx95xx-fix-crimes-against-truesize.patch
@@ -0,0 +1,47 @@
+From 648c906a27d3713f589717f4be36583fc64f2ba1 Mon Sep 17 00:00:00 2001
+From: Steve Glendinning <steve.glendinning@smsc.com>
+Date: Thu, 19 Feb 2015 18:47:12 +0000
+Subject: [PATCH] smsx95xx: fix crimes against truesize
+
+smsc95xx is adjusting truesize when it shouldn't, and following a recent patch from Eric this is now triggering warnings.
+
+This patch stops smsc95xx from changing truesize.
+
+Signed-off-by: Steve Glendinning <steve.glendinning@smsc.com>
+---
+ drivers/net/usb/smsc95xx.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/usb/smsc95xx.c
++++ b/drivers/net/usb/smsc95xx.c
+@@ -79,6 +79,10 @@ static bool turbo_mode = true;
+ module_param(turbo_mode, bool, 0644);
+ MODULE_PARM_DESC(turbo_mode, "Enable multiple frames per Rx transaction");
+ 
++static bool truesize_mode = false;
++module_param(truesize_mode, bool, 0644);
++MODULE_PARM_DESC(truesize_mode, "Report larger truesize value");
++
+ static int __must_check smsc95xx_read_reg(struct usbnet *dev, u32 index,
+ 					  u32 *data)
+ {
+@@ -1868,7 +1872,8 @@ static int smsc95xx_rx_fixup(struct usbn
+ 				if (dev->net->features & NETIF_F_RXCSUM)
+ 					smsc95xx_rx_csum_offload(skb);
+ 				skb_trim(skb, skb->len - 4); /* remove fcs */
+-				skb->truesize = size + sizeof(struct sk_buff);
++				if (truesize_mode)
++					skb->truesize = size + sizeof(struct sk_buff);
+ 
+ 				return 1;
+ 			}
+@@ -1886,7 +1891,8 @@ static int smsc95xx_rx_fixup(struct usbn
+ 			if (dev->net->features & NETIF_F_RXCSUM)
+ 				smsc95xx_rx_csum_offload(ax_skb);
+ 			skb_trim(ax_skb, ax_skb->len - 4); /* remove fcs */
+-			ax_skb->truesize = size + sizeof(struct sk_buff);
++			if (truesize_mode)
++				ax_skb->truesize = size + sizeof(struct sk_buff);
+ 
+ 			usbnet_skb_return(dev, ax_skb);
+ 		}
diff --git a/target/linux/bcm27xx/patches-6.1/950-0082-smsc95xx-Experimental-Enable-turbo_mode-and-packetsi.patch b/target/linux/bcm27xx/patches-6.1/950-0082-smsc95xx-Experimental-Enable-turbo_mode-and-packetsi.patch
new file mode 100644
index 00000000000000..1bb5ae2b18ed7d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0082-smsc95xx-Experimental-Enable-turbo_mode-and-packetsi.patch
@@ -0,0 +1,43 @@
+From cd851377edc5c90b628f48b147d89181018ba282 Mon Sep 17 00:00:00 2001
+From: Sam Nazarko <email@samnazarko.co.uk>
+Date: Fri, 1 Apr 2016 17:27:21 +0100
+Subject: [PATCH] smsc95xx: Experimental: Enable turbo_mode and
+ packetsize=2560 by default
+
+See: http://forum.kodi.tv/showthread.php?tid=285288
+---
+ drivers/net/usb/smsc95xx.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/usb/smsc95xx.c
++++ b/drivers/net/usb/smsc95xx.c
+@@ -83,6 +83,10 @@ static bool truesize_mode = false;
+ module_param(truesize_mode, bool, 0644);
+ MODULE_PARM_DESC(truesize_mode, "Report larger truesize value");
+ 
++static int packetsize = 2560;
++module_param(packetsize, int, 0644);
++MODULE_PARM_DESC(packetsize, "Override the RX URB packet size");
++
+ static int __must_check smsc95xx_read_reg(struct usbnet *dev, u32 index,
+ 					  u32 *data)
+ {
+@@ -934,13 +938,13 @@ static int smsc95xx_reset(struct usbnet
+ 
+ 	if (!turbo_mode) {
+ 		burst_cap = 0;
+-		dev->rx_urb_size = MAX_SINGLE_PACKET_SIZE;
++		dev->rx_urb_size = packetsize ? packetsize : MAX_SINGLE_PACKET_SIZE;
+ 	} else if (dev->udev->speed == USB_SPEED_HIGH) {
+-		burst_cap = DEFAULT_HS_BURST_CAP_SIZE / HS_USB_PKT_SIZE;
+-		dev->rx_urb_size = DEFAULT_HS_BURST_CAP_SIZE;
++		dev->rx_urb_size = packetsize ? packetsize : DEFAULT_HS_BURST_CAP_SIZE;
++		burst_cap = dev->rx_urb_size / HS_USB_PKT_SIZE;
+ 	} else {
+-		burst_cap = DEFAULT_FS_BURST_CAP_SIZE / FS_USB_PKT_SIZE;
+-		dev->rx_urb_size = DEFAULT_FS_BURST_CAP_SIZE;
++		dev->rx_urb_size = packetsize ? packetsize : DEFAULT_FS_BURST_CAP_SIZE;
++		burst_cap = dev->rx_urb_size / FS_USB_PKT_SIZE;
+ 	}
+ 
+ 	netif_dbg(dev, ifup, dev->net, "rx_urb_size=%ld\n",
diff --git a/target/linux/bcm27xx/patches-6.1/950-0083-Allow-mac-address-to-be-set-in-smsc95xx.patch b/target/linux/bcm27xx/patches-6.1/950-0083-Allow-mac-address-to-be-set-in-smsc95xx.patch
new file mode 100644
index 00000000000000..e8d14ac99fed5d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0083-Allow-mac-address-to-be-set-in-smsc95xx.patch
@@ -0,0 +1,99 @@
+From 46f9261fd0c133038cc5adbdb91085a1791414c9 Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Tue, 26 Mar 2013 17:26:38 +0000
+Subject: [PATCH] Allow mac address to be set in smsc95xx
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+
+SQUASH: smsc95xx: Use dev_mod_addr to set MAC addr
+
+Since adeef3e32146 ("net: constify netdev->dev_addr") it has been
+illegal to write to the dev_addr MAC address field. Later commits
+have added explicit checks that it hasn't been modified by nefarious
+means. The dev_addr_mod helper function is the accepted way to change
+the dev_addr field, so use it.
+
+Squash with 96c1def63ee1 ("Allow mac address to be set in smsc95xx").
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/usb/smsc95xx.c | 54 ++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 54 insertions(+)
+
+--- a/drivers/net/usb/smsc95xx.c
++++ b/drivers/net/usb/smsc95xx.c
+@@ -87,6 +87,10 @@ static int packetsize = 2560;
+ module_param(packetsize, int, 0644);
+ MODULE_PARM_DESC(packetsize, "Override the RX URB packet size");
+ 
++static char *macaddr = ":";
++module_param(macaddr, charp, 0);
++MODULE_PARM_DESC(macaddr, "MAC address");
++
+ static int __must_check smsc95xx_read_reg(struct usbnet *dev, u32 index,
+ 					  u32 *data)
+ {
+@@ -807,6 +811,52 @@ static int smsc95xx_ioctl(struct net_dev
+ 	return phy_mii_ioctl(netdev->phydev, rq, cmd);
+ }
+ 
++/* Check the macaddr module parameter for a MAC address */
++static int smsc95xx_is_macaddr_param(struct usbnet *dev, struct net_device *nd)
++{
++       int i, j, got_num, num;
++       u8 mtbl[ETH_ALEN];
++
++       if (macaddr[0] == ':')
++               return 0;
++
++       i = 0;
++       j = 0;
++       num = 0;
++       got_num = 0;
++       while (j < ETH_ALEN) {
++               if (macaddr[i] && macaddr[i] != ':') {
++                       got_num++;
++                       if ('0' <= macaddr[i] && macaddr[i] <= '9')
++                               num = num * 16 + macaddr[i] - '0';
++                       else if ('A' <= macaddr[i] && macaddr[i] <= 'F')
++                               num = num * 16 + 10 + macaddr[i] - 'A';
++                       else if ('a' <= macaddr[i] && macaddr[i] <= 'f')
++                               num = num * 16 + 10 + macaddr[i] - 'a';
++                       else
++                               break;
++                       i++;
++               } else if (got_num == 2) {
++                       mtbl[j++] = (u8) num;
++                       num = 0;
++                       got_num = 0;
++                       i++;
++               } else {
++                       break;
++               }
++       }
++
++       if (j == ETH_ALEN) {
++               netif_dbg(dev, ifup, dev->net, "Overriding MAC address with: "
++               "%02x:%02x:%02x:%02x:%02x:%02x\n", mtbl[0], mtbl[1], mtbl[2],
++                                               mtbl[3], mtbl[4], mtbl[5]);
++	       dev_addr_mod(nd, 0, mtbl, ETH_ALEN);
++               return 1;
++       } else {
++               return 0;
++       }
++}
++
+ static void smsc95xx_init_mac_address(struct usbnet *dev)
+ {
+ 	u8 addr[ETH_ALEN];
+@@ -830,6 +880,10 @@ static void smsc95xx_init_mac_address(st
+ 		}
+ 	}
+ 
++	/* Check module parameters */
++	if (smsc95xx_is_macaddr_param(dev, dev->net))
++		return;
++
+ 	/* no useful static MAC address found. generate a random one */
+ 	eth_hw_addr_random(dev->net);
+ 	netif_dbg(dev, ifup, dev->net, "MAC address set to eth_random_addr\n");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0084-cgroup-Disable-cgroup-memory-by-default.patch b/target/linux/bcm27xx/patches-6.1/950-0084-cgroup-Disable-cgroup-memory-by-default.patch
new file mode 100644
index 00000000000000..77419cbc4b5325
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0084-cgroup-Disable-cgroup-memory-by-default.patch
@@ -0,0 +1,85 @@
+From 9a43e3e7af1f9a4b3961402755dc49251175aaee Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 27 Nov 2017 17:14:54 +0000
+Subject: [PATCH] cgroup: Disable cgroup "memory" by default
+
+Some Raspberry Pis have limited RAM and most users won't use the
+cgroup memory support so it is disabled by default. Enable with:
+
+    cgroup_enable=memory
+
+See: https://github.com/raspberrypi/linux/issues/1950
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ kernel/cgroup/cgroup.c | 38 ++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 38 insertions(+)
+
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -6046,6 +6046,9 @@ int __init cgroup_init_early(void)
+ 	return 0;
+ }
+ 
++static u16 cgroup_enable_mask __initdata;
++static int __init cgroup_disable(char *str);
++
+ /**
+  * cgroup_init - cgroup initialization
+  *
+@@ -6079,6 +6082,12 @@ int __init cgroup_init(void)
+ 
+ 	mutex_unlock(&cgroup_mutex);
+ 
++	/*
++	 * Apply an implicit disable, knowing that an explicit enable will
++	 * prevent if from doing anything.
++	 */
++	cgroup_disable("memory");
++
+ 	for_each_subsys(ss, ssid) {
+ 		if (ss->early_init) {
+ 			struct cgroup_subsys_state *css =
+@@ -6717,6 +6726,10 @@ static int __init cgroup_disable(char *s
+ 			    strcmp(token, ss->legacy_name))
+ 				continue;
+ 
++			/* An explicit cgroup_enable overrides a disable */
++			if (cgroup_enable_mask & (1 << i))
++				continue;
++
+ 			static_branch_disable(cgroup_subsys_enabled_key[i]);
+ 			pr_info("Disabling %s control group subsystem\n",
+ 				ss->name);
+@@ -6735,6 +6748,31 @@ static int __init cgroup_disable(char *s
+ }
+ __setup("cgroup_disable=", cgroup_disable);
+ 
++static int __init cgroup_enable(char *str)
++{
++	struct cgroup_subsys *ss;
++	char *token;
++	int i;
++
++	while ((token = strsep(&str, ",")) != NULL) {
++		if (!*token)
++			continue;
++
++		for_each_subsys(ss, i) {
++			if (strcmp(token, ss->name) &&
++			    strcmp(token, ss->legacy_name))
++				continue;
++
++			cgroup_enable_mask |= 1 << i;
++			static_branch_enable(cgroup_subsys_enabled_key[i]);
++			pr_info("Enabling %s control group subsystem\n",
++				ss->name);
++		}
++	}
++	return 1;
++}
++__setup("cgroup_enable=", cgroup_enable);
++
+ void __init __weak enable_debug_cgroup(void) { }
+ 
+ static int __init enable_cgroup_debug(char *str)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0085-Protect-__release_resource-against-resources-without.patch b/target/linux/bcm27xx/patches-6.1/950-0085-Protect-__release_resource-against-resources-without.patch
new file mode 100644
index 00000000000000..26aabf40bb333a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0085-Protect-__release_resource-against-resources-without.patch
@@ -0,0 +1,28 @@
+From 2b2d2bb2473fd1c6397f96e98b183e8cbee7c408 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Fri, 13 Mar 2015 12:43:36 +0000
+Subject: [PATCH] Protect __release_resource against resources without
+ parents
+
+Without this patch, removing a device tree overlay can crash here.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ kernel/resource.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/kernel/resource.c
++++ b/kernel/resource.c
+@@ -200,6 +200,12 @@ static int __release_resource(struct res
+ {
+ 	struct resource *tmp, **p, *chd;
+ 
++	if (!old->parent) {
++		WARN(old->sibling, "sibling but no parent");
++		if (old->sibling)
++			return -EINVAL;
++		return 0;
++	}
+ 	p = &old->parent->child;
+ 	for (;;) {
+ 		tmp = *p;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0086-irq-bcm2836-Avoid-Invalid-trigger-warning.patch b/target/linux/bcm27xx/patches-6.1/950-0086-irq-bcm2836-Avoid-Invalid-trigger-warning.patch
new file mode 100644
index 00000000000000..392f966876fcad
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0086-irq-bcm2836-Avoid-Invalid-trigger-warning.patch
@@ -0,0 +1,24 @@
+From 340481cbc2217c5d20da30963fd75c07d29a9876 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Thu, 9 Feb 2017 14:33:30 +0000
+Subject: [PATCH] irq-bcm2836: Avoid "Invalid trigger warning"
+
+Initialise the level for each IRQ to avoid a warning from the
+arm arch timer code.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/irqchip/irq-bcm2836.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/irqchip/irq-bcm2836.c
++++ b/drivers/irqchip/irq-bcm2836.c
+@@ -128,7 +128,7 @@ static int bcm2836_map(struct irq_domain
+ 	irq_set_percpu_devid(irq);
+ 	irq_domain_set_info(d, irq, hw, chip, d->host_data,
+ 			    handle_percpu_devid_irq, NULL, NULL);
+-	irq_set_status_flags(irq, IRQ_NOAUTOEN);
++	irq_set_status_flags(irq, IRQ_NOAUTOEN | IRQ_TYPE_LEVEL_LOW);
+ 
+ 	return 0;
+ }
diff --git a/target/linux/bcm27xx/patches-6.1/950-0087-irqchip-bcm2835-Add-FIQ-support.patch b/target/linux/bcm27xx/patches-6.1/950-0087-irqchip-bcm2835-Add-FIQ-support.patch
new file mode 100644
index 00000000000000..a6f5e58d7f2986
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0087-irqchip-bcm2835-Add-FIQ-support.patch
@@ -0,0 +1,127 @@
+From be5c4814f18effda98a7c111aefce9c9c51d0926 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Fri, 12 Jun 2015 19:01:05 +0200
+Subject: [PATCH] irqchip: bcm2835: Add FIQ support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Add a duplicate irq range with an offset on the hwirq's so the
+driver can detect that enable_fiq() is used.
+Tested with downstream dwc_otg USB controller driver.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+Reviewed-by: Eric Anholt <eric@anholt.net>
+Acked-by: Stephen Warren <swarren@wwwdotorg.org>
+---
+ arch/arm/mach-bcm/Kconfig     |  1 +
+ drivers/irqchip/irq-bcm2835.c | 51 +++++++++++++++++++++++++++++++----
+ 2 files changed, 47 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/mach-bcm/Kconfig
++++ b/arch/arm/mach-bcm/Kconfig
+@@ -159,6 +159,7 @@ config ARCH_BCM2835
+ 	select ARM_TIMER_SP804
+ 	select HAVE_ARM_ARCH_TIMER if ARCH_MULTI_V7
+ 	select BCM2835_TIMER
++	select FIQ
+ 	select PINCTRL
+ 	select PINCTRL_BCM2835
+ 	select MFD_CORE
+--- a/drivers/irqchip/irq-bcm2835.c
++++ b/drivers/irqchip/irq-bcm2835.c
+@@ -45,7 +45,7 @@
+ #include <asm/exception.h>
+ 
+ /* Put the bank and irq (32 bits) into the hwirq */
+-#define MAKE_HWIRQ(b, n)	((b << 5) | (n))
++#define MAKE_HWIRQ(b, n)	(((b) << 5) | (n))
+ #define HWIRQ_BANK(i)		(i >> 5)
+ #define HWIRQ_BIT(i)		BIT(i & 0x1f)
+ 
+@@ -62,9 +62,13 @@
+ 
+ #define REG_FIQ_CONTROL		0x0c
+ #define FIQ_CONTROL_ENABLE	BIT(7)
++#define REG_FIQ_ENABLE		FIQ_CONTROL_ENABLE
++#define REG_FIQ_DISABLE	0
+ 
+ #define NR_BANKS		3
+ #define IRQS_PER_BANK		32
++#define NUMBER_IRQS		MAKE_HWIRQ(NR_BANKS, 0)
++#define FIQ_START		(NR_IRQS_BANK0 + MAKE_HWIRQ(NR_BANKS - 1, 0))
+ 
+ static const int reg_pending[] __initconst = { 0x00, 0x04, 0x08 };
+ static const int reg_enable[] __initconst = { 0x18, 0x10, 0x14 };
+@@ -89,14 +93,38 @@ static void __exception_irq_entry bcm283
+ 	struct pt_regs *regs);
+ static void bcm2836_chained_handle_irq(struct irq_desc *desc);
+ 
++static inline unsigned int hwirq_to_fiq(unsigned long hwirq)
++{
++	hwirq -= NUMBER_IRQS;
++	/*
++	 * The hwirq numbering used in this driver is:
++	 *   BASE (0-7) GPU1 (32-63) GPU2 (64-95).
++	 * This differ from the one used in the FIQ register:
++	 *   GPU1 (0-31) GPU2 (32-63) BASE (64-71)
++	 */
++	if (hwirq >= 32)
++		return hwirq - 32;
++
++	return hwirq + 64;
++}
++
+ static void armctrl_mask_irq(struct irq_data *d)
+ {
+-	writel_relaxed(HWIRQ_BIT(d->hwirq), intc.disable[HWIRQ_BANK(d->hwirq)]);
++	if (d->hwirq >= NUMBER_IRQS)
++		writel_relaxed(REG_FIQ_DISABLE, intc.base + REG_FIQ_CONTROL);
++	else
++		writel_relaxed(HWIRQ_BIT(d->hwirq),
++			       intc.disable[HWIRQ_BANK(d->hwirq)]);
+ }
+ 
+ static void armctrl_unmask_irq(struct irq_data *d)
+ {
+-	writel_relaxed(HWIRQ_BIT(d->hwirq), intc.enable[HWIRQ_BANK(d->hwirq)]);
++	if (d->hwirq >= NUMBER_IRQS)
++		writel_relaxed(REG_FIQ_ENABLE | hwirq_to_fiq(d->hwirq),
++			       intc.base + REG_FIQ_CONTROL);
++	else
++		writel_relaxed(HWIRQ_BIT(d->hwirq),
++			       intc.enable[HWIRQ_BANK(d->hwirq)]);
+ }
+ 
+ static struct irq_chip armctrl_chip = {
+@@ -142,8 +170,9 @@ static int __init armctrl_of_init(struct
+ 	if (!base)
+ 		panic("%pOF: unable to map IC registers\n", node);
+ 
+-	intc.domain = irq_domain_add_linear(node, MAKE_HWIRQ(NR_BANKS, 0),
+-			&armctrl_ops, NULL);
++	intc.base = base;
++	intc.domain = irq_domain_add_linear(node, NUMBER_IRQS * 2,
++					    &armctrl_ops, NULL);
+ 	if (!intc.domain)
+ 		panic("%pOF: unable to create IRQ domain\n", node);
+ 
+@@ -186,6 +215,18 @@ static int __init armctrl_of_init(struct
+ 		set_handle_irq(bcm2835_handle_irq);
+ 	}
+ 
++	/* Make a duplicate irq range which is used to enable FIQ */
++	for (b = 0; b < NR_BANKS; b++) {
++		for (i = 0; i < bank_irqs[b]; i++) {
++			irq = irq_create_mapping(intc.domain,
++					MAKE_HWIRQ(b, i) + NUMBER_IRQS);
++			BUG_ON(irq <= 0);
++			irq_set_chip(irq, &armctrl_chip);
++			set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
++		}
++	}
++	init_FIQ(FIQ_START);
++
+ 	return 0;
+ }
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0088-irqchip-irq-bcm2835-Add-2836-FIQ-support.patch b/target/linux/bcm27xx/patches-6.1/950-0088-irqchip-irq-bcm2835-Add-2836-FIQ-support.patch
new file mode 100644
index 00000000000000..5a584cdbaa7a18
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0088-irqchip-irq-bcm2835-Add-2836-FIQ-support.patch
@@ -0,0 +1,99 @@
+From c20eb523fd40e08e5495cd5c615c99c25296ded3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Fri, 23 Oct 2015 16:26:55 +0200
+Subject: [PATCH] irqchip: irq-bcm2835: Add 2836 FIQ support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+---
+ drivers/irqchip/irq-bcm2835.c | 43 +++++++++++++++++++++++++++++++++--
+ 1 file changed, 41 insertions(+), 2 deletions(-)
+
+--- a/drivers/irqchip/irq-bcm2835.c
++++ b/drivers/irqchip/irq-bcm2835.c
+@@ -41,8 +41,11 @@
+ #include <linux/of_irq.h>
+ #include <linux/irqchip.h>
+ #include <linux/irqdomain.h>
++#include <linux/mfd/syscon.h>
++#include <linux/regmap.h>
+ 
+ #include <asm/exception.h>
++#include <asm/mach/irq.h>
+ 
+ /* Put the bank and irq (32 bits) into the hwirq */
+ #define MAKE_HWIRQ(b, n)	(((b) << 5) | (n))
+@@ -60,6 +63,9 @@
+ #define BANK0_VALID_MASK	(BANK0_HWIRQ_MASK | BANK1_HWIRQ | BANK2_HWIRQ \
+ 					| SHORTCUT1_MASK | SHORTCUT2_MASK)
+ 
++#undef ARM_LOCAL_GPU_INT_ROUTING
++#define ARM_LOCAL_GPU_INT_ROUTING 0x0c
++
+ #define REG_FIQ_CONTROL		0x0c
+ #define FIQ_CONTROL_ENABLE	BIT(7)
+ #define REG_FIQ_ENABLE		FIQ_CONTROL_ENABLE
+@@ -86,6 +92,7 @@ struct armctrl_ic {
+ 	void __iomem *enable[NR_BANKS];
+ 	void __iomem *disable[NR_BANKS];
+ 	struct irq_domain *domain;
++	struct regmap *local_regmap;
+ };
+ 
+ static struct armctrl_ic intc __read_mostly;
+@@ -119,12 +126,35 @@ static void armctrl_mask_irq(struct irq_
+ 
+ static void armctrl_unmask_irq(struct irq_data *d)
+ {
+-	if (d->hwirq >= NUMBER_IRQS)
++	if (d->hwirq >= NUMBER_IRQS) {
++		if (num_online_cpus() > 1) {
++			unsigned int data;
++			int ret;
++
++			if (!intc.local_regmap) {
++				pr_err("FIQ is disabled due to missing regmap\n");
++				return;
++			}
++
++			ret = regmap_read(intc.local_regmap,
++					  ARM_LOCAL_GPU_INT_ROUTING, &data);
++			if (ret) {
++				pr_err("Failed to read int routing %d\n", ret);
++				return;
++			}
++
++			data &= ~0xc;
++			data |= (1 << 2);
++			regmap_write(intc.local_regmap,
++				     ARM_LOCAL_GPU_INT_ROUTING, data);
++		}
++
+ 		writel_relaxed(REG_FIQ_ENABLE | hwirq_to_fiq(d->hwirq),
+ 			       intc.base + REG_FIQ_CONTROL);
+-	else
++	} else {
+ 		writel_relaxed(HWIRQ_BIT(d->hwirq),
+ 			       intc.enable[HWIRQ_BANK(d->hwirq)]);
++	}
+ }
+ 
+ static struct irq_chip armctrl_chip = {
+@@ -215,6 +245,15 @@ static int __init armctrl_of_init(struct
+ 		set_handle_irq(bcm2835_handle_irq);
+ 	}
+ 
++	if (is_2836) {
++		intc.local_regmap =
++			syscon_regmap_lookup_by_compatible("brcm,bcm2836-arm-local");
++		if (IS_ERR(intc.local_regmap)) {
++			pr_err("Failed to get local register map. FIQ is disabled for cpus > 1\n");
++			intc.local_regmap = NULL;
++		}
++	}
++
+ 	/* Make a duplicate irq range which is used to enable FIQ */
+ 	for (b = 0; b < NR_BANKS; b++) {
+ 		for (i = 0; i < bank_irqs[b]; i++) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0089-spi-spidev-Completely-disable-the-spidev-warning.patch b/target/linux/bcm27xx/patches-6.1/950-0089-spi-spidev-Completely-disable-the-spidev-warning.patch
new file mode 100644
index 00000000000000..e7323ccfb8524b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0089-spi-spidev-Completely-disable-the-spidev-warning.patch
@@ -0,0 +1,24 @@
+From 5e7a21ade0c4a28de3a8ef19b0563b6dfef4980c Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Mon, 24 Jan 2022 13:41:16 +0000
+Subject: [PATCH] spi: spidev: Completely disable the spidev warning
+
+An alternative strategy would be to use "rpi,spidev" instead, but that
+would require many Raspberry Pi Device Tree changes.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/spi/spidev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -707,7 +707,7 @@ MODULE_DEVICE_TABLE(spi, spidev_spi_ids)
+  */
+ static int spidev_of_check(struct device *dev)
+ {
+-	if (device_property_match_string(dev, "compatible", "spidev") < 0)
++	if (1 || device_property_match_string(dev, "compatible", "spidev") < 0)
+ 		return 0;
+ 
+ 	dev_err(dev, "spidev listed directly in DT is not supported\n");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0090-dmaengine-bcm2835-Load-driver-early-and-support-lega.patch b/target/linux/bcm27xx/patches-6.1/950-0090-dmaengine-bcm2835-Load-driver-early-and-support-lega.patch
new file mode 100644
index 00000000000000..3a534018a7bd2a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0090-dmaengine-bcm2835-Load-driver-early-and-support-lega.patch
@@ -0,0 +1,101 @@
+From 427f7b2d3185aab815c3388a3c60b9e047ce9232 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Sat, 3 Oct 2015 22:22:55 +0200
+Subject: [PATCH] dmaengine: bcm2835: Load driver early and support
+ legacy API
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Load driver early since at least bcm2708_fb doesn't support deferred
+probing and even if it did, we don't want the video driver deferred.
+Support the legacy DMA API which is needed by bcm2708_fb.
+Don't mask out channel 2.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+---
+ drivers/dma/Kconfig       |  2 +-
+ drivers/dma/bcm2835-dma.c | 26 +++++++++++++++++++++++++-
+ 2 files changed, 26 insertions(+), 2 deletions(-)
+
+--- a/drivers/dma/Kconfig
++++ b/drivers/dma/Kconfig
+@@ -135,7 +135,7 @@ config BCM_SBA_RAID
+ 
+ config DMA_BCM2835
+ 	tristate "BCM2835 DMA engine support"
+-	depends on ARCH_BCM2835
++	depends on ARCH_BCM2835 || ARCH_BCM2708 || ARCH_BCM2709
+ 	select DMA_ENGINE
+ 	select DMA_VIRTUAL_CHANNELS
+ 
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -25,6 +25,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/list.h>
+ #include <linux/module.h>
++#include <linux/platform_data/dma-bcm2708.h>
+ #include <linux/platform_device.h>
+ #include <linux/slab.h>
+ #include <linux/io.h>
+@@ -36,6 +37,7 @@
+ 
+ #define BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED 14
+ #define BCM2835_DMA_CHAN_NAME_SIZE 8
++#define BCM2835_DMA_BULK_MASK  BIT(0)
+ 
+ /**
+  * struct bcm2835_dmadev - BCM2835 DMA controller
+@@ -906,6 +908,9 @@ static int bcm2835_dma_probe(struct plat
+ 	base = devm_ioremap_resource(&pdev->dev, res);
+ 	if (IS_ERR(base))
+ 		return PTR_ERR(base);
++	rc = bcm_dmaman_probe(pdev, base, BCM2835_DMA_BULK_MASK);
++	if (rc)
++		dev_err(&pdev->dev, "Failed to initialize the legacy API\n");
+ 
+ 	od->base = base;
+ 
+@@ -951,6 +956,9 @@ static int bcm2835_dma_probe(struct plat
+ 		goto err_no_dma;
+ 	}
+ 
++	/* Channel 0 is used by the legacy API */
++	chans_available &= ~BCM2835_DMA_BULK_MASK;
++
+ 	/* get irqs for each channel that we support */
+ 	for (i = 0; i <= BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED; i++) {
+ 		/* skip masked out channels */
+@@ -1025,6 +1033,7 @@ static int bcm2835_dma_remove(struct pla
+ {
+ 	struct bcm2835_dmadev *od = platform_get_drvdata(pdev);
+ 
++	bcm_dmaman_remove(pdev);
+ 	dma_async_device_unregister(&od->ddev);
+ 	bcm2835_dma_free(od);
+ 
+@@ -1040,7 +1049,22 @@ static struct platform_driver bcm2835_dm
+ 	},
+ };
+ 
+-module_platform_driver(bcm2835_dma_driver);
++static int bcm2835_dma_init(void)
++{
++	return platform_driver_register(&bcm2835_dma_driver);
++}
++
++static void bcm2835_dma_exit(void)
++{
++	platform_driver_unregister(&bcm2835_dma_driver);
++}
++
++/*
++ * Load after serial driver (arch_initcall) so we see the messages if it fails,
++ * but before drivers (module_init) that need a DMA channel.
++ */
++subsys_initcall(bcm2835_dma_init);
++module_exit(bcm2835_dma_exit);
+ 
+ MODULE_ALIAS("platform:bcm2835-dma");
+ MODULE_DESCRIPTION("BCM2835 DMA engine driver");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0091-rtc-Add-SPI-alias-for-pcf2123-driver.patch b/target/linux/bcm27xx/patches-6.1/950-0091-rtc-Add-SPI-alias-for-pcf2123-driver.patch
new file mode 100644
index 00000000000000..3a427005ce7b8b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0091-rtc-Add-SPI-alias-for-pcf2123-driver.patch
@@ -0,0 +1,20 @@
+From e4b3776e69f480246c1eaa448fbd13db3568e08d Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Wed, 15 Jun 2016 16:48:41 +0100
+Subject: [PATCH] rtc: Add SPI alias for pcf2123 driver
+
+Without this alias, Device Tree won't cause the driver
+to be loaded.
+
+See: https://github.com/raspberrypi/linux/pull/1510
+---
+ drivers/rtc/rtc-pcf2123.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/rtc/rtc-pcf2123.c
++++ b/drivers/rtc/rtc-pcf2123.c
+@@ -474,3 +474,4 @@ module_spi_driver(pcf2123_driver);
+ MODULE_AUTHOR("Chris Verges <chrisv@cyberswitching.com>");
+ MODULE_DESCRIPTION("NXP PCF2123 RTC driver");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS("spi:rtc-pcf2123");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0092-watchdog-bcm2835-Support-setting-reboot-partition.patch b/target/linux/bcm27xx/patches-6.1/950-0092-watchdog-bcm2835-Support-setting-reboot-partition.patch
new file mode 100644
index 00000000000000..b1ba4ae6b89951
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0092-watchdog-bcm2835-Support-setting-reboot-partition.patch
@@ -0,0 +1,102 @@
+From 94119ec772b375c3b94d83b2ff61a9d447d8083a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Fri, 7 Oct 2016 16:50:59 +0200
+Subject: [PATCH] watchdog: bcm2835: Support setting reboot partition
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The Raspberry Pi firmware looks at the RSTS register to know which
+partition to boot from. The reboot syscall command
+LINUX_REBOOT_CMD_RESTART2 supports passing in a string argument.
+
+Add support for passing in a partition number 0..63 to boot from.
+Partition 63 is a special partiton indicating halt.
+If the partition doesn't exist, the firmware falls back to partition 0.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+---
+ drivers/watchdog/bcm2835_wdt.c | 49 +++++++++++++++++++---------------
+ 1 file changed, 27 insertions(+), 22 deletions(-)
+
+--- a/drivers/watchdog/bcm2835_wdt.c
++++ b/drivers/watchdog/bcm2835_wdt.c
+@@ -32,13 +32,7 @@
+ #define PM_RSTC_WRCFG_SET		0x00000030
+ #define PM_RSTC_WRCFG_FULL_RESET	0x00000020
+ #define PM_RSTC_RESET			0x00000102
+-
+-/*
+- * The Raspberry Pi firmware uses the RSTS register to know which partition
+- * to boot from. The partition value is spread into bits 0, 2, 4, 6, 8, 10.
+- * Partition 63 is a special partition used by the firmware to indicate halt.
+- */
+-#define PM_RSTS_RASPBERRYPI_HALT	0x555
++#define PM_RSTS_PARTITION_CLR          0xfffffaaa
+ 
+ #define SECS_TO_WDOG_TICKS(x) ((x) << 16)
+ #define WDOG_TICKS_TO_SECS(x) ((x) >> 16)
+@@ -97,9 +91,24 @@ static unsigned int bcm2835_wdt_get_time
+ 	return WDOG_TICKS_TO_SECS(ret & PM_WDOG_TIME_SET);
+ }
+ 
+-static void __bcm2835_restart(struct bcm2835_wdt *wdt)
++/*
++ * The Raspberry Pi firmware uses the RSTS register to know which partiton
++ * to boot from. The partiton value is spread into bits 0, 2, 4, 6, 8, 10.
++ * Partiton 63 is a special partition used by the firmware to indicate halt.
++ */
++
++static void __bcm2835_restart(struct bcm2835_wdt *wdt, u8 partition)
+ {
+-	u32 val;
++	u32 val, rsts;
++
++	rsts = (partition & BIT(0)) | ((partition & BIT(1)) << 1) |
++	       ((partition & BIT(2)) << 2) | ((partition & BIT(3)) << 3) |
++	       ((partition & BIT(4)) << 4) | ((partition & BIT(5)) << 5);
++
++	val = readl_relaxed(wdt->base + PM_RSTS);
++	val &= PM_RSTS_PARTITION_CLR;
++	val |= PM_PASSWORD | rsts;
++	writel_relaxed(val, wdt->base + PM_RSTS);
+ 
+ 	/* use a timeout of 10 ticks (~150us) */
+ 	writel_relaxed(10 | PM_PASSWORD, wdt->base + PM_WDOG);
+@@ -117,7 +126,13 @@ static int bcm2835_restart(struct watchd
+ {
+ 	struct bcm2835_wdt *wdt = watchdog_get_drvdata(wdog);
+ 
+-	__bcm2835_restart(wdt);
++	unsigned long long val;
++	u8 partition = 0;
++
++	if (data && !kstrtoull(data, 0, &val) && val <= 63)
++		partition = val;
++
++	__bcm2835_restart(wdt, partition);
+ 
+ 	return 0;
+ }
+@@ -152,19 +167,9 @@ static struct watchdog_device bcm2835_wd
+ static void bcm2835_power_off(void)
+ {
+ 	struct bcm2835_wdt *wdt = bcm2835_power_off_wdt;
+-	u32 val;
+-
+-	/*
+-	 * We set the watchdog hard reset bit here to distinguish this reset
+-	 * from the normal (full) reset. bootcode.bin will not reboot after a
+-	 * hard reset.
+-	 */
+-	val = readl_relaxed(wdt->base + PM_RSTS);
+-	val |= PM_PASSWORD | PM_RSTS_RASPBERRYPI_HALT;
+-	writel_relaxed(val, wdt->base + PM_RSTS);
+ 
+-	/* Continue with normal reset mechanism */
+-	__bcm2835_restart(wdt);
++	/* Partition 63 tells the firmware that this is a halt */
++	__bcm2835_restart(wdt, 63);
+ }
+ 
+ static int bcm2835_wdt_probe(struct platform_device *pdev)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0093-reboot-Use-power-off-rather-than-busy-spinning-when-.patch b/target/linux/bcm27xx/patches-6.1/950-0093-reboot-Use-power-off-rather-than-busy-spinning-when-.patch
new file mode 100644
index 00000000000000..d29fffbfe0f35c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0093-reboot-Use-power-off-rather-than-busy-spinning-when-.patch
@@ -0,0 +1,23 @@
+From 999eb8d0a8bc72e067a6abccec7db6dd72c9c531 Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Tue, 5 Apr 2016 19:40:12 +0100
+Subject: [PATCH] reboot: Use power off rather than busy spinning when
+ halt is requested
+
+---
+ arch/arm/kernel/reboot.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/arch/arm/kernel/reboot.c
++++ b/arch/arm/kernel/reboot.c
+@@ -102,9 +102,7 @@ void machine_shutdown(void)
+  */
+ void machine_halt(void)
+ {
+-	local_irq_disable();
+-	smp_send_stop();
+-	while (1);
++	machine_power_off();
+ }
+ 
+ /*
diff --git a/target/linux/bcm27xx/patches-6.1/950-0094-bcm-Make-RASPBERRYPI_POWER-depend-on-PM.patch b/target/linux/bcm27xx/patches-6.1/950-0094-bcm-Make-RASPBERRYPI_POWER-depend-on-PM.patch
new file mode 100644
index 00000000000000..2c7dfa44de89db
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0094-bcm-Make-RASPBERRYPI_POWER-depend-on-PM.patch
@@ -0,0 +1,19 @@
+From 0ae6d14764389f409facd3a7493d70c4de63a82c Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Wed, 9 Nov 2016 13:02:52 +0000
+Subject: [PATCH] bcm: Make RASPBERRYPI_POWER depend on PM
+
+---
+ drivers/soc/bcm/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/soc/bcm/Kconfig
++++ b/drivers/soc/bcm/Kconfig
+@@ -17,6 +17,7 @@ config RASPBERRYPI_POWER
+ 	bool "Raspberry Pi power domain driver"
+ 	depends on ARCH_BCM2835 || (COMPILE_TEST && OF)
+ 	depends on RASPBERRYPI_FIRMWARE=y
++	depends on PM
+ 	select PM_GENERIC_DOMAINS if PM
+ 	help
+ 	  This enables support for the RPi power domains which can be enabled
diff --git a/target/linux/bcm27xx/patches-6.1/950-0095-bcm2835-rng-Avoid-initialising-if-already-enabled.patch b/target/linux/bcm27xx/patches-6.1/950-0095-bcm2835-rng-Avoid-initialising-if-already-enabled.patch
new file mode 100644
index 00000000000000..e0f7d9a366056f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0095-bcm2835-rng-Avoid-initialising-if-already-enabled.patch
@@ -0,0 +1,25 @@
+From 5d37f1ed8bf4654f48c9e4b76021ee3813d18ac1 Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Tue, 6 Dec 2016 17:05:39 +0000
+Subject: [PATCH] bcm2835-rng: Avoid initialising if already enabled
+
+Avoids the 0x40000 cycles of warmup again if firmware has already used it
+---
+ drivers/char/hw_random/bcm2835-rng.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/hw_random/bcm2835-rng.c
++++ b/drivers/char/hw_random/bcm2835-rng.c
+@@ -106,8 +106,10 @@ static int bcm2835_rng_init(struct hwrng
+ 	}
+ 
+ 	/* set warm-up count & enable */
+-	rng_writel(priv, RNG_WARMUP_COUNT, RNG_STATUS);
+-	rng_writel(priv, RNG_RBGEN, RNG_CTRL);
++	if (!(rng_readl(priv, RNG_CTRL) & RNG_RBGEN)) {
++		rng_writel(priv, RNG_WARMUP_COUNT, RNG_STATUS);
++		rng_writel(priv, RNG_RBGEN, RNG_CTRL);
++	}
+ 
+ 	return ret;
+ }
diff --git a/target/linux/bcm27xx/patches-6.1/950-0096-sound-Demote-deferral-errors-to-INFO-level.patch b/target/linux/bcm27xx/patches-6.1/950-0096-sound-Demote-deferral-errors-to-INFO-level.patch
new file mode 100644
index 00000000000000..ce0c167b8078e0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0096-sound-Demote-deferral-errors-to-INFO-level.patch
@@ -0,0 +1,35 @@
+From b43bf8ecf329669ce3ae032c0332bc5f6e3a4701 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Thu, 9 Feb 2017 14:36:44 +0000
+Subject: [PATCH] sound: Demote deferral errors to INFO level
+
+At present there is no mechanism to specify driver load order,
+which can lead to deferrals and repeated retries until successful.
+Since this situation is expected, reduce the dmesg level to
+INFO and mention that the operation will be retried.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ sound/soc/soc-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -995,7 +995,7 @@ int snd_soc_add_pcm_runtime(struct snd_s
+ 	for_each_link_cpus(dai_link, i, cpu) {
+ 		asoc_rtd_to_cpu(rtd, i) = snd_soc_find_dai(cpu);
+ 		if (!asoc_rtd_to_cpu(rtd, i)) {
+-			dev_info(card->dev, "ASoC: CPU DAI %s not registered\n",
++			dev_info(card->dev, "ASoC: CPU DAI %s not registered - will retry\n",
+ 				 cpu->dai_name);
+ 			goto _err_defer;
+ 		}
+@@ -1006,7 +1006,7 @@ int snd_soc_add_pcm_runtime(struct snd_s
+ 	for_each_link_codecs(dai_link, i, codec) {
+ 		asoc_rtd_to_codec(rtd, i) = snd_soc_find_dai(codec);
+ 		if (!asoc_rtd_to_codec(rtd, i)) {
+-			dev_info(card->dev, "ASoC: CODEC DAI %s not registered\n",
++			dev_info(card->dev, "ASoC: CODEC DAI %s not registered- will retry\n",
+ 				 codec->dai_name);
+ 			goto _err_defer;
+ 		}
diff --git a/target/linux/bcm27xx/patches-6.1/950-0097-Update-vfpmodule.c.patch b/target/linux/bcm27xx/patches-6.1/950-0097-Update-vfpmodule.c.patch
new file mode 100644
index 00000000000000..1976747280a967
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0097-Update-vfpmodule.c.patch
@@ -0,0 +1,137 @@
+From aada9a494eef7ff6913d37db3bd9fb3ff82828db Mon Sep 17 00:00:00 2001
+From: Claggy3 <stephen.maclagan@hotmail.com>
+Date: Sat, 11 Feb 2017 14:00:30 +0000
+Subject: [PATCH] Update vfpmodule.c
+
+Christopher Alexander Tobias Schulze - May 2, 2015, 11:57 a.m.
+This patch fixes a problem with VFP state save and restore related
+to exception handling (panic with message "BUG: unsupported FP
+instruction in kernel mode") present on VFP11 floating point units
+(as used with ARM1176JZF-S CPUs, e.g. on first generation Raspberry
+Pi boards). This patch was developed and discussed on
+
+   https://github.com/raspberrypi/linux/issues/859
+
+A precondition to see the crashes is that floating point exception
+traps are enabled. In this case, the VFP11 might determine that a FPU
+operation needs to trap at a point in time when it is not possible to
+signal this to the ARM11 core any more. The VFP11 will then set the
+FPEXC.EX bit and store the trapped opcode in FPINST. (In some cases,
+a second opcode might have been accepted by the VFP11 before the
+exception was detected and could be reported to the ARM11 - in this
+case, the VFP11 also sets FPEXC.FP2V and stores the second opcode in
+FPINST2.)
+
+If FPEXC.EX is set, the VFP11 will "bounce" the next FPU opcode issued
+by the ARM11 CPU, which will be seen by the ARM11 as an undefined opcode
+trap. The VFP support code examines the FPEXC.EX and FPEXC.FP2V bits
+to decide what actions to take, i.e., whether to emulate the opcodes
+found in FPINST and FPINST2, and whether to retry the bounced instruction.
+
+If a user space application has left the VFP11 in this "pending trap"
+state, the next FPU opcode issued to the VFP11 might actually be the
+VSTMIA operation vfp_save_state() uses to store the FPU registers
+to memory (in our test cases, when building the signal stack frame).
+In this case, the kernel crashes as described above.
+
+This patch fixes the problem by making sure that vfp_save_state() is
+always entered with FPEXC.EX cleared. (The current value of FPEXC has
+already been saved, so this does not corrupt the context. Clearing
+FPEXC.EX has no effects on FPINST or FPINST2. Also note that many
+callers already modify FPEXC by setting FPEXC.EN before invoking
+vfp_save_state().)
+
+This patch also addresses a second problem related to FPEXC.EX: After
+returning from signal handling, the kernel reloads the VFP context
+from the user mode stack. However, the current code explicitly clears
+both FPEXC.EX and FPEXC.FP2V during reload. As VFP11 requires these
+bits to be preserved, this patch disables clearing them for VFP
+implementations belonging to architecture 1. There should be no
+negative side effects: the user can set both bits by executing FPU
+opcodes anyway, and while user code may now place arbitrary values
+into FPINST and FPINST2 (e.g., non-VFP ARM opcodes) the VFP support
+code knows which instructions can be emulated, and rejects other
+opcodes with "unhandled bounce" messages, so there should be no
+security impact from allowing reloading FPEXC.EX and FPEXC.FP2V.
+
+Signed-off-by: Christopher Alexander Tobias Schulze <cat.schulze@alice-dsl.net>
+---
+ arch/arm/vfp/vfpmodule.c | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+--- a/arch/arm/vfp/vfpmodule.c
++++ b/arch/arm/vfp/vfpmodule.c
+@@ -176,8 +176,11 @@ static int vfp_notifier(struct notifier_
+ 		 * case the thread migrates to a different CPU. The
+ 		 * restoring is done lazily.
+ 		 */
+-		if ((fpexc & FPEXC_EN) && vfp_current_hw_state[cpu])
++		if ((fpexc & FPEXC_EN) && vfp_current_hw_state[cpu]) {
++			/* vfp_save_state oopses on VFP11 if EX bit set */
++			fmxr(FPEXC, fpexc & ~FPEXC_EX);
+ 			vfp_save_state(vfp_current_hw_state[cpu], fpexc);
++		}
+ #endif
+ 
+ 		/*
+@@ -454,13 +457,16 @@ static int vfp_pm_suspend(void)
+ 	/* if vfp is on, then save state for resumption */
+ 	if (fpexc & FPEXC_EN) {
+ 		pr_debug("%s: saving vfp state\n", __func__);
++		/* vfp_save_state oopses on VFP11 if EX bit set */
++		fmxr(FPEXC, fpexc & ~FPEXC_EX);
+ 		vfp_save_state(&ti->vfpstate, fpexc);
+ 
+ 		/* disable, just in case */
+ 		fmxr(FPEXC, fmrx(FPEXC) & ~FPEXC_EN);
+ 	} else if (vfp_current_hw_state[ti->cpu]) {
+ #ifndef CONFIG_SMP
+-		fmxr(FPEXC, fpexc | FPEXC_EN);
++		/* vfp_save_state oopses on VFP11 if EX bit set */
++		fmxr(FPEXC, (fpexc & ~FPEXC_EX) | FPEXC_EN);
+ 		vfp_save_state(vfp_current_hw_state[ti->cpu], fpexc);
+ 		fmxr(FPEXC, fpexc);
+ #endif
+@@ -523,7 +529,8 @@ void vfp_sync_hwstate(struct thread_info
+ 		/*
+ 		 * Save the last VFP state on this CPU.
+ 		 */
+-		fmxr(FPEXC, fpexc | FPEXC_EN);
++		/* vfp_save_state oopses on VFP11 if EX bit set */
++		fmxr(FPEXC, (fpexc & ~FPEXC_EX) | FPEXC_EN);
+ 		vfp_save_state(&thread->vfpstate, fpexc | FPEXC_EN);
+ 		fmxr(FPEXC, fpexc);
+ 	}
+@@ -589,6 +596,7 @@ int vfp_restore_user_hwstate(struct user
+ 	struct thread_info *thread = current_thread_info();
+ 	struct vfp_hard_struct *hwstate = &thread->vfpstate.hard;
+ 	unsigned long fpexc;
++	u32 fpsid = fmrx(FPSID);
+ 
+ 	/* Disable VFP to avoid corrupting the new thread state. */
+ 	vfp_flush_hwstate(thread);
+@@ -611,8 +619,12 @@ int vfp_restore_user_hwstate(struct user
+ 	/* Ensure the VFP is enabled. */
+ 	fpexc |= FPEXC_EN;
+ 
+-	/* Ensure FPINST2 is invalid and the exception flag is cleared. */
+-	fpexc &= ~(FPEXC_EX | FPEXC_FP2V);
++	/* Mask FPXEC_EX and FPEXC_FP2V if not required by VFP arch */
++	if ((fpsid & FPSID_ARCH_MASK) != (1 << FPSID_ARCH_BIT)) {
++		/* Ensure FPINST2 is invalid and the exception flag is cleared. */
++		fpexc &= ~(FPEXC_EX | FPEXC_FP2V);
++	}
++
+ 	hwstate->fpexc = fpexc;
+ 
+ 	hwstate->fpinst = ufp_exc->fpinst;
+@@ -726,7 +738,8 @@ void kernel_neon_begin(void)
+ 	cpu = get_cpu();
+ 
+ 	fpexc = fmrx(FPEXC) | FPEXC_EN;
+-	fmxr(FPEXC, fpexc);
++	/* vfp_save_state oopses on VFP11 if EX bit set */
++	fmxr(FPEXC, fpexc & ~FPEXC_EX);
+ 
+ 	/*
+ 	 * Save the userland NEON/VFP state. Under UP,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0098-i2c-bcm2835-Add-debug-support.patch b/target/linux/bcm27xx/patches-6.1/950-0098-i2c-bcm2835-Add-debug-support.patch
new file mode 100644
index 00000000000000..79ea24b42197e8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0098-i2c-bcm2835-Add-debug-support.patch
@@ -0,0 +1,189 @@
+From 1e5524c80d2ff685951224ba3989b38dc4c80fa1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Tue, 1 Nov 2016 15:15:41 +0100
+Subject: [PATCH] i2c: bcm2835: Add debug support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This adds a debug module parameter to aid in debugging transfer issues
+by printing info to the kernel log. When enabled, status values are
+collected in the interrupt routine and msg info in
+bcm2835_i2c_start_transfer(). This is done in a way that tries to avoid
+affecting timing. Having printk in the isr can mask issues.
+
+debug values (additive):
+1: Print info on error
+2: Print info on all transfers
+3: Print messages before transfer is started
+
+The value can be changed at runtime:
+/sys/module/i2c_bcm2835/parameters/debug
+
+Example output, debug=3:
+[  747.114448] bcm2835_i2c_xfer: msg(1/2) write addr=0x54, len=2 flags= [i2c1]
+[  747.114463] bcm2835_i2c_xfer: msg(2/2) read addr=0x54, len=32 flags= [i2c1]
+[  747.117809] start_transfer: msg(1/2) write addr=0x54, len=2 flags= [i2c1]
+[  747.117825] isr: remain=2, status=0x30000055 : TA TXW TXD TXE  [i2c1]
+[  747.117839] start_transfer: msg(2/2) read addr=0x54, len=32 flags= [i2c1]
+[  747.117849] isr: remain=32, status=0xd0000039 : TA RXR TXD RXD  [i2c1]
+[  747.117861] isr: remain=20, status=0xd0000039 : TA RXR TXD RXD  [i2c1]
+[  747.117870] isr: remain=8, status=0x32 : DONE TXD RXD  [i2c1]
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+---
+ drivers/i2c/busses/i2c-bcm2835.c | 99 +++++++++++++++++++++++++++++++-
+ 1 file changed, 98 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-bcm2835.c
++++ b/drivers/i2c/busses/i2c-bcm2835.c
+@@ -56,6 +56,18 @@
+ #define BCM2835_I2C_CDIV_MIN	0x0002
+ #define BCM2835_I2C_CDIV_MAX	0xFFFE
+ 
++static unsigned int debug;
++module_param(debug, uint, 0644);
++MODULE_PARM_DESC(debug, "1=err, 2=isr, 3=xfer");
++
++#define BCM2835_DEBUG_MAX	512
++struct bcm2835_debug {
++	struct i2c_msg *msg;
++	int msg_idx;
++	size_t remain;
++	u32 status;
++};
++
+ struct bcm2835_i2c_dev {
+ 	struct device *dev;
+ 	void __iomem *regs;
+@@ -68,8 +80,78 @@ struct bcm2835_i2c_dev {
+ 	u32 msg_err;
+ 	u8 *msg_buf;
+ 	size_t msg_buf_remaining;
++	struct bcm2835_debug debug[BCM2835_DEBUG_MAX];
++	unsigned int debug_num;
++	unsigned int debug_num_msgs;
+ };
+ 
++static inline void bcm2835_debug_add(struct bcm2835_i2c_dev *i2c_dev, u32 s)
++{
++	if (!i2c_dev->debug_num_msgs || i2c_dev->debug_num >= BCM2835_DEBUG_MAX)
++		return;
++
++	i2c_dev->debug[i2c_dev->debug_num].msg = i2c_dev->curr_msg;
++	i2c_dev->debug[i2c_dev->debug_num].msg_idx =
++				i2c_dev->debug_num_msgs - i2c_dev->num_msgs;
++	i2c_dev->debug[i2c_dev->debug_num].remain = i2c_dev->msg_buf_remaining;
++	i2c_dev->debug[i2c_dev->debug_num].status = s;
++	i2c_dev->debug_num++;
++}
++
++static void bcm2835_debug_print_status(struct bcm2835_i2c_dev *i2c_dev,
++				       struct bcm2835_debug *d)
++{
++	u32 s = d->status;
++
++	pr_info("isr: remain=%zu, status=0x%x : %s%s%s%s%s%s%s%s%s%s [i2c%d]\n",
++		d->remain, s,
++		s & BCM2835_I2C_S_TA ? "TA " : "",
++		s & BCM2835_I2C_S_DONE ? "DONE " : "",
++		s & BCM2835_I2C_S_TXW ? "TXW " : "",
++		s & BCM2835_I2C_S_RXR ? "RXR " : "",
++		s & BCM2835_I2C_S_TXD ? "TXD " : "",
++		s & BCM2835_I2C_S_RXD ? "RXD " : "",
++		s & BCM2835_I2C_S_TXE ? "TXE " : "",
++		s & BCM2835_I2C_S_RXF ? "RXF " : "",
++		s & BCM2835_I2C_S_ERR ? "ERR " : "",
++		s & BCM2835_I2C_S_CLKT ? "CLKT " : "",
++		i2c_dev->adapter.nr);
++}
++
++static void bcm2835_debug_print_msg(struct bcm2835_i2c_dev *i2c_dev,
++				    struct i2c_msg *msg, int i, int total,
++				    const char *fname)
++{
++	pr_info("%s: msg(%d/%d) %s addr=0x%02x, len=%u flags=%s%s%s%s%s%s%s [i2c%d]\n",
++		fname, i, total,
++		msg->flags & I2C_M_RD ? "read" : "write", msg->addr, msg->len,
++		msg->flags & I2C_M_TEN ? "TEN" : "",
++		msg->flags & I2C_M_RECV_LEN ? "RECV_LEN" : "",
++		msg->flags & I2C_M_NO_RD_ACK ? "NO_RD_ACK" : "",
++		msg->flags & I2C_M_IGNORE_NAK ? "IGNORE_NAK" : "",
++		msg->flags & I2C_M_REV_DIR_ADDR ? "REV_DIR_ADDR" : "",
++		msg->flags & I2C_M_NOSTART ? "NOSTART" : "",
++		msg->flags & I2C_M_STOP ? "STOP" : "",
++		i2c_dev->adapter.nr);
++}
++
++static void bcm2835_debug_print(struct bcm2835_i2c_dev *i2c_dev)
++{
++	struct bcm2835_debug *d;
++	unsigned int i;
++
++	for (i = 0; i < i2c_dev->debug_num; i++) {
++		d = &i2c_dev->debug[i];
++		if (d->status == ~0)
++			bcm2835_debug_print_msg(i2c_dev, d->msg, d->msg_idx,
++				i2c_dev->debug_num_msgs, "start_transfer");
++		else
++			bcm2835_debug_print_status(i2c_dev, d);
++	}
++	if (i2c_dev->debug_num >= BCM2835_DEBUG_MAX)
++		pr_info("BCM2835_DEBUG_MAX reached\n");
++}
++
+ static inline void bcm2835_i2c_writel(struct bcm2835_i2c_dev *i2c_dev,
+ 				      u32 reg, u32 val)
+ {
+@@ -257,6 +339,7 @@ static void bcm2835_i2c_start_transfer(s
+ 	bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_A, msg->addr);
+ 	bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_DLEN, msg->len);
+ 	bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C, c);
++	bcm2835_debug_add(i2c_dev, ~0);
+ }
+ 
+ static void bcm2835_i2c_finish_transfer(struct bcm2835_i2c_dev *i2c_dev)
+@@ -283,6 +366,7 @@ static irqreturn_t bcm2835_i2c_isr(int t
+ 	u32 val, err;
+ 
+ 	val = bcm2835_i2c_readl(i2c_dev, BCM2835_I2C_S);
++	bcm2835_debug_add(i2c_dev, val);
+ 
+ 	err = val & (BCM2835_I2C_S_CLKT | BCM2835_I2C_S_ERR);
+ 	if (err) {
+@@ -349,6 +433,13 @@ static int bcm2835_i2c_xfer(struct i2c_a
+ 	unsigned long time_left;
+ 	int i;
+ 
++	if (debug)
++		i2c_dev->debug_num_msgs = num;
++
++	if (debug > 2)
++		for (i = 0; i < num; i++)
++			bcm2835_debug_print_msg(i2c_dev, &msgs[i], i + 1, num, __func__);
++
+ 	for (i = 0; i < (num - 1); i++)
+ 		if (msgs[i].flags & I2C_M_RD) {
+ 			dev_warn_once(i2c_dev->dev,
+@@ -367,6 +458,10 @@ static int bcm2835_i2c_xfer(struct i2c_a
+ 
+ 	bcm2835_i2c_finish_transfer(i2c_dev);
+ 
++	if (debug > 1 || (debug && (!time_left || i2c_dev->msg_err)))
++		bcm2835_debug_print(i2c_dev);
++	i2c_dev->debug_num_msgs = 0;
++	i2c_dev->debug_num = 0;
+ 	if (!time_left) {
+ 		bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C,
+ 				   BCM2835_I2C_C_CLEAR);
+@@ -377,7 +472,9 @@ static int bcm2835_i2c_xfer(struct i2c_a
+ 	if (!i2c_dev->msg_err)
+ 		return num;
+ 
+-	dev_dbg(i2c_dev->dev, "i2c transfer failed: %x\n", i2c_dev->msg_err);
++	if (debug)
++		dev_err(i2c_dev->dev, "i2c transfer failed: %x\n",
++			i2c_dev->msg_err);
+ 
+ 	if (i2c_dev->msg_err & BCM2835_I2C_S_ERR)
+ 		return -EREMOTEIO;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0099-irqchip-irq-bcm2836-Remove-regmap-and-syscon-use.patch b/target/linux/bcm27xx/patches-6.1/950-0099-irqchip-irq-bcm2836-Remove-regmap-and-syscon-use.patch
new file mode 100644
index 00000000000000..ea63aafffb05ff
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0099-irqchip-irq-bcm2836-Remove-regmap-and-syscon-use.patch
@@ -0,0 +1,112 @@
+From 179240b8f8d928abe71dbff54e4f88ef76fc5684 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 23 Jan 2018 16:52:45 +0000
+Subject: [PATCH] irqchip: irq-bcm2836: Remove regmap and syscon use
+
+The syscon node defines a register range that duplicates that used by
+the local_intc node on bcm2836/7. Since irq-bcm2835 and irq-bcm2836 are
+built in and always present together (both drivers are enabled by
+CONFIG_ARCH_BCM2835), it is possible to replace the syscon usage with a
+global variable that simplifies the code. Doing so does lose the
+locking provided by regmap, but as only one side is using the regmap
+interface (irq-bcm2835 uses readl and write) there is no loss of
+atomicity.
+
+See: https://github.com/raspberrypi/firmware/issues/926
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/irqchip/irq-bcm2835.c | 32 ++++++++++++--------------------
+ drivers/irqchip/irq-bcm2836.c |  5 +++++
+ 2 files changed, 17 insertions(+), 20 deletions(-)
+
+--- a/drivers/irqchip/irq-bcm2835.c
++++ b/drivers/irqchip/irq-bcm2835.c
+@@ -41,8 +41,6 @@
+ #include <linux/of_irq.h>
+ #include <linux/irqchip.h>
+ #include <linux/irqdomain.h>
+-#include <linux/mfd/syscon.h>
+-#include <linux/regmap.h>
+ 
+ #include <asm/exception.h>
+ #include <asm/mach/irq.h>
+@@ -92,7 +90,7 @@ struct armctrl_ic {
+ 	void __iomem *enable[NR_BANKS];
+ 	void __iomem *disable[NR_BANKS];
+ 	struct irq_domain *domain;
+-	struct regmap *local_regmap;
++	void __iomem *local_base;
+ };
+ 
+ static struct armctrl_ic intc __read_mostly;
+@@ -129,24 +127,20 @@ static void armctrl_unmask_irq(struct ir
+ 	if (d->hwirq >= NUMBER_IRQS) {
+ 		if (num_online_cpus() > 1) {
+ 			unsigned int data;
+-			int ret;
+ 
+-			if (!intc.local_regmap) {
+-				pr_err("FIQ is disabled due to missing regmap\n");
++			if (!intc.local_base) {
++				pr_err("FIQ is disabled due to missing arm_local_intc\n");
+ 				return;
+ 			}
+ 
+-			ret = regmap_read(intc.local_regmap,
+-					  ARM_LOCAL_GPU_INT_ROUTING, &data);
+-			if (ret) {
+-				pr_err("Failed to read int routing %d\n", ret);
+-				return;
+-			}
++			data = readl_relaxed(intc.local_base +
++					     ARM_LOCAL_GPU_INT_ROUTING);
+ 
+ 			data &= ~0xc;
+ 			data |= (1 << 2);
+-			regmap_write(intc.local_regmap,
+-				     ARM_LOCAL_GPU_INT_ROUTING, data);
++			writel_relaxed(data,
++				       intc.local_base +
++				       ARM_LOCAL_GPU_INT_ROUTING);
+ 		}
+ 
+ 		writel_relaxed(REG_FIQ_ENABLE | hwirq_to_fiq(d->hwirq),
+@@ -246,12 +240,10 @@ static int __init armctrl_of_init(struct
+ 	}
+ 
+ 	if (is_2836) {
+-		intc.local_regmap =
+-			syscon_regmap_lookup_by_compatible("brcm,bcm2836-arm-local");
+-		if (IS_ERR(intc.local_regmap)) {
+-			pr_err("Failed to get local register map. FIQ is disabled for cpus > 1\n");
+-			intc.local_regmap = NULL;
+-		}
++		extern void __iomem * __attribute__((weak)) arm_local_intc;
++		intc.local_base = arm_local_intc;
++		if (!intc.local_base)
++			pr_err("Failed to get local intc base. FIQ is disabled for cpus > 1\n");
+ 	}
+ 
+ 	/* Make a duplicate irq range which is used to enable FIQ */
+--- a/drivers/irqchip/irq-bcm2836.c
++++ b/drivers/irqchip/irq-bcm2836.c
+@@ -22,6 +22,9 @@ struct bcm2836_arm_irqchip_intc {
+ 
+ static struct bcm2836_arm_irqchip_intc intc  __read_mostly;
+ 
++void __iomem *arm_local_intc;
++EXPORT_SYMBOL_GPL(arm_local_intc);
++
+ static void bcm2836_arm_irqchip_mask_per_cpu_irq(unsigned int reg_offset,
+ 						 unsigned int bit,
+ 						 int cpu)
+@@ -323,6 +326,8 @@ static int __init bcm2836_arm_irqchip_l1
+ 		panic("%pOF: unable to map local interrupt registers\n", node);
+ 	}
+ 
++	arm_local_intc = intc.base;
++
+ 	bcm2835_init_local_timer_frequency();
+ 
+ 	intc.domain = irq_domain_add_linear(node, LAST_IRQ + 1,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0100-lan78xx-Enable-LEDs-and-auto-negotiation.patch b/target/linux/bcm27xx/patches-6.1/950-0100-lan78xx-Enable-LEDs-and-auto-negotiation.patch
new file mode 100644
index 00000000000000..9c5a7333c4f386
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0100-lan78xx-Enable-LEDs-and-auto-negotiation.patch
@@ -0,0 +1,49 @@
+From 06d4e2950cc7dd561975ec6888af14aefc7332d4 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 17 Oct 2017 15:04:29 +0100
+Subject: [PATCH] lan78xx: Enable LEDs and auto-negotiation
+
+For applications of the LAN78xx that don't have valid programmed
+EEPROMs or OTPs, enabling both LEDs and auto-negotiation by default
+seems reasonable.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/net/usb/lan78xx.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2881,6 +2881,11 @@ static int lan78xx_reset(struct lan78xx_
+ 	int ret;
+ 	u32 buf;
+ 	u8 sig;
++	bool has_eeprom;
++	bool has_otp;
++
++	has_eeprom = !lan78xx_read_eeprom(dev, 0, 0, NULL);
++	has_otp = !lan78xx_read_otp(dev, 0, 0, NULL);
+ 
+ 	ret = lan78xx_read_reg(dev, HW_CFG, &buf);
+ 	if (ret < 0)
+@@ -2945,6 +2950,10 @@ static int lan78xx_reset(struct lan78xx_
+ 
+ 	buf |= HW_CFG_MEF_;
+ 
++	/* If no valid EEPROM and no valid OTP, enable the LEDs by default */
++	if (!has_eeprom && !has_otp)
++	    buf |= HW_CFG_LED0_EN_ | HW_CFG_LED1_EN_;
++
+ 	ret = lan78xx_write_reg(dev, HW_CFG, buf);
+ 	if (ret < 0)
+ 		return ret;
+@@ -3043,6 +3052,9 @@ static int lan78xx_reset(struct lan78xx_
+ 			buf |= MAC_CR_AUTO_DUPLEX_ | MAC_CR_AUTO_SPEED_;
+ 		}
+ 	}
++	/* If no valid EEPROM and no valid OTP, enable AUTO negotiation */
++	if (!has_eeprom && !has_otp)
++	    buf |= MAC_CR_AUTO_DUPLEX_ | MAC_CR_AUTO_SPEED_;
+ 	ret = lan78xx_write_reg(dev, MAC_CR, buf);
+ 	if (ret < 0)
+ 		return ret;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0101-amba_pl011-Insert-mb-for-correct-FIFO-handling.patch b/target/linux/bcm27xx/patches-6.1/950-0101-amba_pl011-Insert-mb-for-correct-FIFO-handling.patch
new file mode 100644
index 00000000000000..9fd8339530a5b3
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0101-amba_pl011-Insert-mb-for-correct-FIFO-handling.patch
@@ -0,0 +1,27 @@
+From 29a82b892694e27f1537a84a0d1dfa163dd51af8 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Fri, 29 Sep 2017 10:32:19 +0100
+Subject: [PATCH] amba_pl011: Insert mb() for correct FIFO handling
+
+The pl011 register accessor functions use the _relaxed versions of the
+standard readl() and writel() functions, meaning that there are no
+automatic memory barriers. When polling a FIFO status register to check
+for fullness, it is necessary to ensure that any outstanding writes have
+completed; otherwise the flags are effectively stale, making it possible
+that the next write is to a full FIFO.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/tty/serial/amba-pl011.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -1430,6 +1430,7 @@ static bool pl011_tx_char(struct uart_am
+ 		return false; /* unable to transmit character */
+ 
+ 	pl011_write(c, uap, REG_DR);
++	mb();
+ 	uap->port.icount.tx++;
+ 
+ 	return true;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0102-amba_pl011-Add-cts-event-workaround-DT-property.patch b/target/linux/bcm27xx/patches-6.1/950-0102-amba_pl011-Add-cts-event-workaround-DT-property.patch
new file mode 100644
index 00000000000000..a67aa16259b7d2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0102-amba_pl011-Add-cts-event-workaround-DT-property.patch
@@ -0,0 +1,50 @@
+From 4864acae00c88dc62956bf4a0bb369cf1989314c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Fri, 29 Sep 2017 10:32:19 +0100
+Subject: [PATCH] amba_pl011: Add cts-event-workaround DT property
+
+The BCM2835 PL011 implementation seems to have a bug that can lead to a
+transmission lockup if CTS changes frequently. A workaround was added to
+the driver with a vendor-specific flag to enable it, but this flag is
+currently not set for ARM implementations.
+
+Add a "cts-event-workaround" property to Pi DTBs and use the presence
+of that property to force the flag to be enabled in the driver.
+
+See: https://github.com/raspberrypi/linux/issues/1280
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ Documentation/devicetree/bindings/serial/pl011.yaml | 6 ++++++
+ drivers/tty/serial/amba-pl011.c                     | 5 +++++
+ 2 files changed, 11 insertions(+)
+
+--- a/Documentation/devicetree/bindings/serial/pl011.yaml
++++ b/Documentation/devicetree/bindings/serial/pl011.yaml
+@@ -100,6 +100,12 @@ properties:
+       on the device.
+     enum: [1, 4]
+ 
++  cts-event-workaround:
++    description:
++      Enables the (otherwise vendor-specific) workaround for the
++      CTS-induced TX lockup.
++    type: boolean
++
+ required:
+   - compatible
+   - reg
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -2805,6 +2805,11 @@ static int pl011_probe(struct amba_devic
+ 	if (IS_ERR(uap->clk))
+ 		return PTR_ERR(uap->clk);
+ 
++	if (of_property_read_bool(dev->dev.of_node, "cts-event-workaround")) {
++	    vendor->cts_event_workaround = true;
++	    dev_info(&dev->dev, "cts_event_workaround enabled\n");
++	}
++
+ 	uap->reg_offset = vendor->reg_offset;
+ 	uap->vendor = vendor;
+ 	uap->fifosize = vendor->get_fifosize(dev);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0103-tty-amba-pl011-Avoid-rare-write-when-full-error.patch b/target/linux/bcm27xx/patches-6.1/950-0103-tty-amba-pl011-Avoid-rare-write-when-full-error.patch
new file mode 100644
index 00000000000000..08bf4098e3bae8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0103-tty-amba-pl011-Avoid-rare-write-when-full-error.patch
@@ -0,0 +1,42 @@
+From d3a78e76b3ff06c53fb85f47be90fdd0b8314134 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Wed, 29 Jan 2020 09:35:19 +0000
+Subject: [PATCH] tty: amba-pl011: Avoid rare write-when-full error
+
+Under some circumstances on BCM283x processors data loss can be
+observed - a single byte missing from the TX output stream. These bytes
+are always the last byte of a batch of 8 written from pl011_tx_chars
+when from_irq is true, meaning that the FIFO full flag is not checked
+before writing.
+
+The transmit optimisation relies on the FIFO being half-empty when the
+TX interrupt is raised. Instrumenting the driver further showed that
+the failure case correlated with the TX FIFO full flag being set at the
+point where the last byte was written to the data register, which
+explains the data loss but not how the FIFO appeared to be prematurely
+full. A possible explanation is that a FIFO write was in flight at the
+time the interrupt was raised, but as yet there is no hypothesis as to
+how this might occur.
+
+In the absence of a clear understanding of the failure mechanism, avoid
+the problem by checking the FIFO levels before writing the last byte of
+the group, which will have minimal performance impact.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/tty/serial/amba-pl011.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -1491,6 +1491,10 @@ static bool pl011_tx_chars(struct uart_a
+ 		if (likely(from_irq) && count-- == 0)
+ 			break;
+ 
++		if (likely(from_irq) && count == 0 &&
++		    pl011_read(uap, REG_FR) & UART01x_FR_TXFF)
++			break;
++
+ 		if (!pl011_tx_char(uap, xmit->buf[xmit->tail], from_irq))
+ 			break;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0104-pinctrl-bcm2835-Set-base-to-0-give-expected-gpio-num.patch b/target/linux/bcm27xx/patches-6.1/950-0104-pinctrl-bcm2835-Set-base-to-0-give-expected-gpio-num.patch
new file mode 100644
index 00000000000000..b9881364863957
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0104-pinctrl-bcm2835-Set-base-to-0-give-expected-gpio-num.patch
@@ -0,0 +1,40 @@
+From 6a7b06ce653de770fc66d34399e57a32b7734bac Mon Sep 17 00:00:00 2001
+From: notro <notro@tronnes.org>
+Date: Thu, 10 Jul 2014 13:59:47 +0200
+Subject: [PATCH] pinctrl-bcm2835: Set base to 0 give expected gpio
+ numbering
+
+Signed-off-by: Noralf Tronnes <notro@tronnes.org>
+
+SQUASH: pinctrl: bcm2835: Set base for bcm2711 GPIO to 0
+
+Without this patch GPIOs don't seem to work properly, primarily
+noticeable as broken LEDs.
+
+Squash with "pinctrl-bcm2835: Set base to 0 give expected gpio numbering"
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/pinctrl/bcm/pinctrl-bcm2835.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+@@ -393,7 +393,7 @@ static const struct gpio_chip bcm2835_gp
+ 	.get = bcm2835_gpio_get,
+ 	.set = bcm2835_gpio_set,
+ 	.set_config = gpiochip_generic_config,
+-	.base = -1,
++	.base = 0,
+ 	.ngpio = BCM2835_NUM_GPIOS,
+ 	.can_sleep = false,
+ 	.of_gpio_ranges_fallback = bcm2835_of_gpio_ranges_fallback,
+@@ -410,7 +410,7 @@ static const struct gpio_chip bcm2711_gp
+ 	.get = bcm2835_gpio_get,
+ 	.set = bcm2835_gpio_set,
+ 	.set_config = gpiochip_generic_config,
+-	.base = -1,
++	.base = 0,
+ 	.ngpio = BCM2711_NUM_GPIOS,
+ 	.can_sleep = false,
+ 	.of_gpio_ranges_fallback = bcm2835_of_gpio_ranges_fallback,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0105-Main-bcm2708-bcm2709-linux-port.patch b/target/linux/bcm27xx/patches-6.1/950-0105-Main-bcm2708-bcm2709-linux-port.patch
new file mode 100644
index 00000000000000..352325ed6fb3d4
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0105-Main-bcm2708-bcm2709-linux-port.patch
@@ -0,0 +1,150 @@
+From 923325f400f9fc6d22ddfe17cdb197a8fcfeb35a Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Sun, 12 May 2013 12:24:19 +0100
+Subject: [PATCH] Main bcm2708/bcm2709 linux port
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+bcm2709: Drop platform smp and timer init code
+
+irq-bcm2836 handles this through these functions:
+bcm2835_init_local_timer_frequency()
+bcm2836_arm_irqchip_smp_init()
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+bcm270x: Use watchdog for reboot/poweroff
+
+The watchdog driver already has support for reboot/poweroff.
+Make use of this and remove the code from the platform files.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+board_bcm2835: Remove coherent dma pool increase - API has gone
+---
+ arch/arm/mach-bcm/Kconfig         |  1 +
+ arch/arm/mm/proc-v6.S             | 15 ++++++++++++---
+ drivers/irqchip/irq-bcm2835.c     |  7 ++++++-
+ drivers/mailbox/bcm2835-mailbox.c | 18 ++++++++++++++++--
+ 4 files changed, 35 insertions(+), 6 deletions(-)
+
+--- a/arch/arm/mach-bcm/Kconfig
++++ b/arch/arm/mach-bcm/Kconfig
+@@ -163,6 +163,7 @@ config ARCH_BCM2835
+ 	select PINCTRL
+ 	select PINCTRL_BCM2835
+ 	select MFD_CORE
++	select MFD_SYSCON if ARCH_MULTI_V7
+ 	help
+ 	  This enables support for the Broadcom BCM2711 and BCM283x SoCs.
+ 	  This SoC is used in the Raspberry Pi and Roku 2 devices.
+--- a/arch/arm/mm/proc-v6.S
++++ b/arch/arm/mm/proc-v6.S
+@@ -70,10 +70,19 @@ ENDPROC(cpu_v6_reset)
+  *
+  *	IRQs are already disabled.
+  */
++
++/* See jira SW-5991 for details of this workaround */
+ ENTRY(cpu_v6_do_idle)
+-	mov	r1, #0
+-	mcr	p15, 0, r1, c7, c10, 4		@ DWB - WFI may enter a low-power mode
+-	mcr	p15, 0, r1, c7, c0, 4		@ wait for interrupt
++	.align 5
++	mov     r1, #2
++1:	subs	r1, #1
++	nop
++	mcreq	p15, 0, r1, c7, c10, 4		@ DWB - WFI may enter a low-power mode
++	mcreq	p15, 0, r1, c7, c0, 4		@ wait for interrupt
++	nop
++	nop
++	nop
++	bne 1b
+ 	ret	lr
+ 
+ ENTRY(cpu_v6_dcache_clean_area)
+--- a/drivers/irqchip/irq-bcm2835.c
++++ b/drivers/irqchip/irq-bcm2835.c
+@@ -43,7 +43,9 @@
+ #include <linux/irqdomain.h>
+ 
+ #include <asm/exception.h>
++#ifndef CONFIG_ARM64
+ #include <asm/mach/irq.h>
++#endif
+ 
+ /* Put the bank and irq (32 bits) into the hwirq */
+ #define MAKE_HWIRQ(b, n)	(((b) << 5) | (n))
+@@ -72,6 +74,7 @@
+ #define NR_BANKS		3
+ #define IRQS_PER_BANK		32
+ #define NUMBER_IRQS		MAKE_HWIRQ(NR_BANKS, 0)
++#undef FIQ_START
+ #define FIQ_START		(NR_IRQS_BANK0 + MAKE_HWIRQ(NR_BANKS - 1, 0))
+ 
+ static const int reg_pending[] __initconst = { 0x00, 0x04, 0x08 };
+@@ -253,10 +256,12 @@ static int __init armctrl_of_init(struct
+ 					MAKE_HWIRQ(b, i) + NUMBER_IRQS);
+ 			BUG_ON(irq <= 0);
+ 			irq_set_chip(irq, &armctrl_chip);
+-			set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
++			irq_set_probe(irq);
+ 		}
+ 	}
++#ifndef CONFIG_ARM64
+ 	init_FIQ(FIQ_START);
++#endif
+ 
+ 	return 0;
+ }
+--- a/drivers/mailbox/bcm2835-mailbox.c
++++ b/drivers/mailbox/bcm2835-mailbox.c
+@@ -45,12 +45,15 @@
+ #define MAIL1_WRT	(ARM_0_MAIL1 + 0x00)
+ #define MAIL1_STA	(ARM_0_MAIL1 + 0x18)
+ 
++/* On ARCH_BCM270x these come through <linux/interrupt.h> (arm_control.h ) */
++#ifndef ARM_MS_FULL
+ /* Status register: FIFO state. */
+ #define ARM_MS_FULL		BIT(31)
+ #define ARM_MS_EMPTY		BIT(30)
+ 
+ /* Configuration register: Enable interrupts. */
+ #define ARM_MC_IHAVEDATAIRQEN	BIT(0)
++#endif
+ 
+ struct bcm2835_mbox {
+ 	void __iomem *regs;
+@@ -144,7 +147,7 @@ static int bcm2835_mbox_probe(struct pla
+ 		return -ENOMEM;
+ 	spin_lock_init(&mbox->lock);
+ 
+-	ret = devm_request_irq(dev, irq_of_parse_and_map(dev->of_node, 0),
++	ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
+ 			       bcm2835_mbox_irq, 0, dev_name(dev), mbox);
+ 	if (ret) {
+ 		dev_err(dev, "Failed to register a mailbox IRQ handler: %d\n",
+@@ -192,7 +195,18 @@ static struct platform_driver bcm2835_mb
+ 	},
+ 	.probe		= bcm2835_mbox_probe,
+ };
+-module_platform_driver(bcm2835_mbox_driver);
++
++static int __init bcm2835_mbox_init(void)
++{
++	return platform_driver_register(&bcm2835_mbox_driver);
++}
++arch_initcall(bcm2835_mbox_init);
++
++static void __init bcm2835_mbox_exit(void)
++{
++	platform_driver_unregister(&bcm2835_mbox_driver);
++}
++module_exit(bcm2835_mbox_exit);
+ 
+ MODULE_AUTHOR("Lubomir Rintel <lkundrak@v3.sk>");
+ MODULE_DESCRIPTION("BCM2835 mailbox IPC driver");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0106-Add-dwc_otg-driver.patch b/target/linux/bcm27xx/patches-6.1/950-0106-Add-dwc_otg-driver.patch
new file mode 100644
index 00000000000000..6980592085dd32
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0106-Add-dwc_otg-driver.patch
@@ -0,0 +1,61022 @@
+From fe24a2249a07c6c70767d6030b4b467a5dc6717f Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Wed, 1 May 2013 19:46:17 +0100
+Subject: [PATCH] Add dwc_otg driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+
+usb: dwc: fix lockdep false positive
+
+Signed-off-by: Kari Suvanto <karis79@gmail.com>
+
+usb: dwc: fix inconsistent lock state
+
+Signed-off-by: Kari Suvanto <karis79@gmail.com>
+
+Add FIQ patch to dwc_otg driver. Enable with dwc_otg.fiq_fix_enable=1. Should give about 10% more ARM performance.
+Thanks to Gordon and Costas
+
+Avoid dynamic memory allocation for channel lock in USB driver. Thanks ddv2005.
+
+Add NAK holdoff scheme. Enabled by default, disable with dwc_otg.nak_holdoff_enable=0. Thanks gsh
+
+Make sure we wait for the reset to finish
+
+dwc_otg: fix bug in dwc_otg_hcd.c resulting in silent kernel
+	 memory corruption, escalating to OOPS under high USB load.
+
+dwc_otg: Fix unsafe access of QTD during URB enqueue
+
+In dwc_otg_hcd_urb_enqueue during qtd creation, it was possible that the
+transaction could complete almost immediately after the qtd was assigned
+to a host channel during URB enqueue, which meant the qtd pointer was no
+longer valid having been completed and removed. Usually, this resulted in
+an OOPS during URB submission. By predetermining whether transactions
+need to be queued or not, this unsafe pointer access is avoided.
+
+This bug was only evident on the Pi model A where a device was attached
+that had no periodic endpoints (e.g. USB pendrive or some wlan devices).
+
+dwc_otg: Fix incorrect URB allocation error handling
+
+If the memory allocation for a dwc_otg_urb failed, the kernel would OOPS
+because for some reason a member of the *unallocated* struct was set to
+zero. Error handling changed to fail correctly.
+
+dwc_otg: fix potential use-after-free case in interrupt handler
+
+If a transaction had previously aborted, certain interrupts are
+enabled to track error counts and reset where necessary. On IN
+endpoints the host generates an ACK interrupt near-simultaneously
+with completion of transfer. In the case where this transfer had
+previously had an error, this results in a use-after-free on
+the QTD memory space with a 1-byte length being overwritten to
+0x00.
+
+dwc_otg: add handling of SPLIT transaction data toggle errors
+
+Previously a data toggle error on packets from a USB1.1 device behind
+a TT would result in the Pi locking up as the driver never handled
+the associated interrupt. Patch adds basic retry mechanism and
+interrupt acknowledgement to cater for either a chance toggle error or
+for devices that have a broken initial toggle state (FT8U232/FT232BM).
+
+dwc_otg: implement tasklet for returning URBs to usbcore hcd layer
+
+The dwc_otg driver interrupt handler for transfer completion will spend
+a very long time with interrupts disabled when a URB is completed -
+this is because usb_hcd_giveback_urb is called from within the handler
+which for a USB device driver with complicated processing (e.g. webcam)
+will take an exorbitant amount of time to complete. This results in
+missed completion interrupts for other USB packets which lead to them
+being dropped due to microframe overruns.
+
+This patch splits returning the URB to the usb hcd layer into a
+high-priority tasklet. This will have most benefit for isochronous IN
+transfers but will also have incidental benefit where multiple periodic
+devices are active at once.
+
+dwc_otg: fix NAK holdoff and allow on split transactions only
+
+This corrects a bug where if a single active non-periodic endpoint
+had at least one transaction in its qh, on frnum == MAX_FRNUM the qh
+would get skipped and never get queued again. This would result in
+a silent device until error detection (automatic or otherwise) would
+either reset the device or flush and requeue the URBs.
+
+Additionally the NAK holdoff was enabled for all transactions - this
+would potentially stall a HS endpoint for 1ms if a previous error state
+enabled this interrupt and the next response was a NAK. Fix so that
+only split transactions get held off.
+
+dwc_otg: Call usb_hcd_unlink_urb_from_ep with lock held in completion handler
+
+usb_hcd_unlink_urb_from_ep must be called with the HCD lock held.  Calling it
+asynchronously in the tasklet was not safe (regression in
+c4564d4a1a0a9b10d4419e48239f5d99e88d2667).
+
+This change unlinks it from the endpoint prior to queueing it for handling in
+the tasklet, and also adds a check to ensure the urb is OK to be unlinked
+before doing so.
+
+NULL pointer dereference kernel oopses had been observed in usb_hcd_giveback_urb
+when a USB device was unplugged/replugged during data transfer.  This effect
+was reproduced using automated USB port power control, hundreds of replug
+events were performed during active transfers to confirm that the problem was
+eliminated.
+
+USB fix using a FIQ to implement split transactions
+
+This commit adds a FIQ implementaion that schedules
+the split transactions using a FIQ so we don't get
+held off by the interrupt latency of Linux
+
+dwc_otg: fix device attributes and avoid kernel warnings on boot
+
+dcw_otg: avoid logging function that can cause panics
+
+See: https://github.com/raspberrypi/firmware/issues/21
+Thanks to cleverca22 for fix
+
+dwc_otg: mask correct interrupts after transaction error recovery
+
+The dwc_otg driver will unmask certain interrupts on a transaction
+that previously halted in the error state in order to reset the
+QTD error count. The various fine-grained interrupt handlers do not
+consider that other interrupts besides themselves were unmasked.
+
+By disabling the two other interrupts only ever enabled in DMA mode
+for this purpose, we can avoid unnecessary function calls in the
+IRQ handler. This will also prevent an unneccesary FIQ interrupt
+from being generated if the FIQ is enabled.
+
+dwc_otg: fiq: prevent FIQ thrash and incorrect state passing to IRQ
+
+In the case of a transaction to a device that had previously aborted
+due to an error, several interrupts are enabled to reset the error
+count when a device responds. This has the side-effect of making the
+FIQ thrash because the hardware will generate multiple instances of
+a NAK on an IN bulk/interrupt endpoint and multiple instances of ACK
+on an OUT bulk/interrupt endpoint. Make the FIQ mask and clear the
+associated interrupts.
+
+Additionally, on non-split transactions make sure that only unmasked
+interrupts are cleared. This caused a hard-to-trigger but serious
+race condition when you had the combination of an endpoint awaiting
+error recovery and a transaction completed on an endpoint - due to
+the sequencing and timing of interrupts generated by the dwc_otg core,
+it was possible to confuse the IRQ handler.
+
+Fix function tracing
+
+dwc_otg: whitespace cleanup in dwc_otg_urb_enqueue
+
+dwc_otg: prevent OOPSes during device disconnects
+
+The dwc_otg_urb_enqueue function is thread-unsafe. In particular the
+access of urb->hcpriv, usb_hcd_link_urb_to_ep, dwc_otg_urb->qtd and
+friends does not occur within a critical section and so if a device
+was unplugged during activity there was a high chance that the
+usbcore hub_thread would try to disable the endpoint with partially-
+formed entries in the URB queue. This would result in BUG() or null
+pointer dereferences.
+
+Fix so that access of urb->hcpriv, enqueuing to the hardware and
+adding to usbcore endpoint URB lists is contained within a single
+critical section.
+
+dwc_otg: prevent BUG() in TT allocation if hub address is > 16
+
+A fixed-size array is used to track TT allocation. This was
+previously set to 16 which caused a crash because
+dwc_otg_hcd_allocate_port would read past the end of the array.
+
+This was hit if a hub was plugged in which enumerated as addr > 16,
+due to previous device resets or unplugs.
+
+Also add #ifdef FIQ_DEBUG around hcd->hub_port_alloc[], which grows
+to a large size if 128 hub addresses are supported. This field is
+for debug only for tracking which frame an allocate happened in.
+
+dwc_otg: make channel halts with unknown state less damaging
+
+If the IRQ received a channel halt interrupt through the FIQ
+with no other bits set, the IRQ would not release the host
+channel and never complete the URB.
+
+Add catchall handling to treat as a transaction error and retry.
+
+dwc_otg: fiq_split: use TTs with more granularity
+
+This fixes certain issues with split transaction scheduling.
+
+- Isochronous multi-packet OUT transactions now hog the TT until
+  they are completed - this prevents hubs aborting transactions
+  if they get a periodic start-split out-of-order
+- Don't perform TT allocation on non-periodic endpoints - this
+  allows simultaneous use of the TT's bulk/control and periodic
+  transaction buffers
+
+This commit will mainly affect USB audio playback.
+
+dwc_otg: fix potential sleep while atomic during urb enqueue
+
+Fixes a regression introduced with eb1b482a. Kmalloc called from
+dwc_otg_hcd_qtd_add / dwc_otg_hcd_qtd_create did not always have
+the GPF_ATOMIC flag set. Force this flag when inside the larger
+critical section.
+
+dwc_otg: make fiq_split_enable imply fiq_fix_enable
+
+Failing to set up the FIQ correctly would result in
+"IRQ 32: nobody cared" errors in dmesg.
+
+dwc_otg: prevent crashes on host port disconnects
+
+Fix several issues resulting in crashes or inconsistent state
+if a Model A root port was disconnected.
+
+- Clean up queue heads properly in kill_urbs_in_qh_list by
+  removing the empty QHs from the schedule lists
+- Set the halt status properly to prevent IRQ handlers from
+  using freed memory
+- Add fiq_split related cleanup for saved registers
+- Make microframe scheduling reclaim host channels if
+  active during a disconnect
+- Abort URBs with -ESHUTDOWN status response, informing
+  device drivers so they respond in a more correct fashion
+  and don't try to resubmit URBs
+- Prevent IRQ handlers from attempting to handle channel
+  interrupts if the associated URB was dequeued (and the
+  driver state was cleared)
+
+dwc_otg: prevent leaking URBs during enqueue
+
+A dwc_otg_urb would get leaked if the HCD enqueue function
+failed for any reason. Free the URB at the appropriate points.
+
+dwc_otg: Enable NAK holdoff for control split transactions
+
+Certain low-speed devices take a very long time to complete a
+data or status stage of a control transaction, producing NAK
+responses until they complete internal processing - the USB2.0
+spec limit is up to 500mS. This causes the same type of interrupt
+storm as seen with USB-serial dongles prior to c8edb238.
+
+In certain circumstances, usually while booting, this interrupt
+storm could cause SD card timeouts.
+
+dwc_otg: Fix for occasional lockup on boot when doing a USB reset
+
+dwc_otg: Don't issue traffic to LS devices in FS mode
+
+Issuing low-speed packets when the root port is in full-speed mode
+causes the root port to stop responding. Explicitly fail when
+enqueuing URBs to a LS endpoint on a FS bus.
+
+Fix ARM architecture issue with local_irq_restore()
+
+If local_fiq_enable() is called before a local_irq_restore(flags) where
+the flags variable has the F bit set, the FIQ will be erroneously disabled.
+
+Fixup arch_local_irq_restore to avoid trampling the F bit in CPSR.
+
+Also fix some of the hacks previously implemented for previous dwc_otg
+incarnations.
+
+dwc_otg: fiq_fsm: Base commit for driver rewrite
+
+This commit removes the previous FIQ fixes entirely and adds fiq_fsm.
+
+This rewrite features much more complete support for split transactions
+and takes into account several OTG hardware bugs. High-speed
+isochronous transactions are also capable of being performed by fiq_fsm.
+
+All driver options have been removed and replaced with:
+  - dwc_otg.fiq_enable (bool)
+  - dwc_otg.fiq_fsm_enable (bool)
+  - dwc_otg.fiq_fsm_mask (bitmask)
+  - dwc_otg.nak_holdoff (unsigned int)
+
+Defaults are specified such that fiq_fsm behaves similarly to the
+previously implemented FIQ fixes.
+
+fiq_fsm: Push error recovery into the FIQ when fiq_fsm is used
+
+If the transfer associated with a QTD failed due to a bus error, the HCD
+would retry the transfer up to 3 times (implementing the USB2.0
+three-strikes retry in software).
+
+Due to the masking mechanism used by fiq_fsm, it is only possible to pass
+a single interrupt through to the HCD per-transfer.
+
+In this instance host channels would fall off the radar because the error
+reset would function, but the subsequent channel halt would be lost.
+
+Push the error count reset into the FIQ handler.
+
+fiq_fsm: Implement timeout mechanism
+
+For full-speed endpoints with a large packet size, interrupt latency
+runs the risk of the FIQ starting a transaction too late in a full-speed
+frame. If the device is still transmitting data when EOF2 for the
+downstream frame occurs, the hub will disable the port. This change is
+not reflected in the hub status endpoint and the device becomes
+unresponsive.
+
+Prevent high-bandwidth transactions from being started too late in a
+frame. The mechanism is not guaranteed: a combination of bit stuffing
+and hub latency may still result in a device overrunning.
+
+fiq_fsm: fix bounce buffer utilisation for Isochronous OUT
+
+Multi-packet isochronous OUT transactions were subject to a few bounday
+bugs. Fix them.
+
+Audio playback is now much more robust: however, an issue stands with
+devices that have adaptive sinks - ALSA plays samples too fast.
+
+dwc_otg: Return full-speed frame numbers in HS mode
+
+The frame counter increments on every *microframe* in high-speed mode.
+Most device drivers expect this number to be in full-speed frames - this
+caused considerable confusion to e.g. snd_usb_audio which uses the
+frame counter to estimate the number of samples played.
+
+fiq_fsm: save PID on completion of interrupt OUT transfers
+
+Also add edge case handling for interrupt transports.
+
+Note that for periodic split IN, data toggles are unimplemented in the
+OTG host hardware - it unconditionally accepts any PID.
+
+fiq_fsm: add missing case for fiq_fsm_tt_in_use()
+
+Certain combinations of bitrate and endpoint activity could
+result in a periodic transaction erroneously getting started
+while the previous Isochronous OUT was still active.
+
+fiq_fsm: clear hcintmsk for aborted transactions
+
+Prevents the FIQ from erroneously handling interrupts
+on a timed out channel.
+
+fiq_fsm: enable by default
+
+fiq_fsm: fix dequeues for non-periodic split transactions
+
+If a dequeue happened between the SSPLIT and CSPLIT phases of the
+transaction, the HCD would never receive an interrupt.
+
+fiq_fsm: Disable by default
+
+fiq_fsm: Handle HC babble errors
+
+The HCTSIZ transfer size field raises a babble interrupt if
+the counter wraps. Handle the resulting interrupt in this case.
+
+dwc_otg: fix interrupt registration for fiq_enable=0
+
+Additionally make the module parameter conditional for wherever
+hcd->fiq_state is touched.
+
+fiq_fsm: Enable by default
+
+dwc_otg: Fix various issues with root port and transaction errors
+
+Process the host port interrupts correctly (and don't trample them).
+Root port hotplug now functional again.
+
+Fix a few thinkos with the transaction error passthrough for fiq_fsm.
+
+fiq_fsm: Implement hack for Split Interrupt transactions
+
+Hubs aren't too picky about which endpoint we send Control type split
+transactions to. By treating Interrupt transfers as Control, it is
+possible to use the non-periodic queue in the OTG core as well as the
+non-periodic FIFOs in the hub itself. This massively reduces the
+microframe exclusivity/contention that periodic split transactions
+otherwise have to enforce.
+
+It goes without saying that this is a fairly egregious USB specification
+violation, but it works.
+
+Original idea by Hans Petter Selasky @ FreeBSD.org.
+
+dwc_otg: FIQ support on SMP. Set up FIQ stack and handler on Core 0 only.
+
+dwc_otg: introduce fiq_fsm_spin(un|)lock()
+
+SMP safety for the FIQ relies on register read-modify write cycles being
+completed in the correct order. Several places in the DWC code modify
+registers also touched by the FIQ. Protect these by a bare-bones lock
+mechanism.
+
+This also makes it possible to run the FIQ and IRQ handlers on different
+cores.
+
+fiq_fsm: fix build on bcm2708 and bcm2709 platforms
+
+dwc_otg: put some barriers back where they should be for UP
+
+bcm2709/dwc_otg: Setup FIQ on core 1 if >1 core active
+
+dwc_otg: fixup read-modify-write in critical paths
+
+Be more careful about read-modify-write on registers that the FIQ
+also touches.
+
+Guard fiq_fsm_spin_lock with fiq_enable check
+
+fiq_fsm: Falling out of the state machine isn't fatal
+
+This edge case can be hit if the port is disabled while the FIQ is
+in the middle of a transaction. Make the effects less severe.
+
+Also get rid of the useless return value.
+
+squash: dwc_otg: Allow to build without SMP
+
+usb: core: make overcurrent messages more prominent
+
+Hub overcurrent messages are more serious than "debug". Increase loglevel.
+
+usb: dwc_otg: Don't use dma_to_virt()
+
+Commit 6ce0d20 changes dma_to_virt() which breaks this driver.
+Open code the old dma_to_virt() implementation to work around this.
+
+Limit the use of __bus_to_virt() to cases where transfer_buffer_length
+is set and transfer_buffer is not set. This is done to increase the
+chance that this driver will also work on ARCH_BCM2835.
+
+transfer_buffer should not be NULL if the length is set, but the
+comment in the code indicates that there are situations where this
+might happen. drivers/usb/isp1760/isp1760-hcd.c also has a similar
+comment pointing to a possible: 'usb storage / SCSI bug'.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dwc_otg: Fix crash when fiq_enable=0
+
+dwc_otg: fiq_fsm: Make high-speed isochronous strided transfers work properly
+
+Certain low-bandwidth high-speed USB devices (specialist audio devices,
+compressed-frame webcams) have packet intervals > 1 microframe.
+
+Stride these transfers in the FIQ by using the start-of-frame interrupt
+to restart the channel at the right time.
+
+dwc_otg: Force host mode to fix incorrect compute module boards
+
+dwc_otg: Add ARCH_BCM2835 support
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dwc_otg: Simplify FIQ irq number code
+
+Dropping ATAGS means we can simplify the FIQ irq number code.
+Also add error checking on the returned irq number.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dwc_otg: Remove duplicate gadget probe/unregister function
+
+dwc_otg: Properly set the HFIR
+
+Douglas Anderson reported:
+
+According to the most up to date version of the dwc2 databook, the FRINT
+field of the HFIR register should be programmed to:
+* 125 us * (PHY clock freq for HS) - 1
+* 1000 us * (PHY clock freq for FS/LS) - 1
+
+This is opposed to older versions of the doc that claimed it should be:
+* 125 us * (PHY clock freq for HS)
+* 1000 us * (PHY clock freq for FS/LS)
+
+and reported lower timing jitter on a USB analyser
+
+dcw_otg: trim xfer length when buffer larger than allocated size is received
+
+dwc_otg: Don't free qh align buffers in atomic context
+
+dwc_otg: Enable the hack for Split Interrupt transactions by default
+
+dwc_otg.fiq_fsm_mask=0xF has long been a suggestion for users with audio stutters or other USB bandwidth issues.
+So far we are aware of many success stories but no failure caused by this setting.
+Make it a default to learn more.
+
+See: https://www.raspberrypi.org/forums/viewtopic.php?f=28&t=70437
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+
+dwc_otg: Use kzalloc when suitable
+
+dwc_otg: Pass struct device to dma_alloc*()
+
+This makes it possible to get the bus address from Device Tree.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dwc_otg: fix summarize urb->actual_length for isochronous transfers
+
+Kernel does not copy input data of ISO transfers to userspace
+if actual_length is set only in ISO transfers and not summarized
+in urb->actual_length. Fixes raspberrypi/linux#903
+
+fiq_fsm: Use correct states when starting isoc OUT transfers
+
+In fiq_fsm_start_next_periodic() if an isochronous OUT transfer
+was selected, no regard was given as to whether this was a single-packet
+transfer or a multi-packet staged transfer.
+
+For single-packet transfers, this had the effect of repeatedly sending
+OUT packets with bogus data and lengths.
+
+Eventually if the channel was repeatedly enabled enough times, this
+would lock up the OTG core and no further bus transfers would happen.
+
+Set the FSM state up properly if we select a single-packet transfer.
+
+Fixes https://github.com/raspberrypi/linux/issues/1842
+
+dwc_otg: make nak_holdoff work as intended with empty queues
+
+If URBs reading from non-periodic split endpoints were dequeued and
+the last transfer from the endpoint was a NAK handshake, the resulting
+qh->nak_frame value was stale which would result in unnecessarily long
+polling intervals for the first subsequent transfer with a fresh URB.
+
+Fixup qh->nak_frame in dwc_otg_hcd_urb_dequeue and also guard against
+a case where a single URB is submitted to the endpoint, a NAK was
+received on the transfer immediately prior to receiving data and the
+device subsequently resubmits another URB past the qh->nak_frame interval.
+
+Fixes https://github.com/raspberrypi/linux/issues/1709
+
+dwc_otg: fix split transaction data toggle handling around dequeues
+
+See https://github.com/raspberrypi/linux/issues/1709
+
+Fix several issues regarding endpoint state when URBs are dequeued
+- If the HCD is disconnected, flush FIQ-enabled channels properly
+- Save the data toggle state for bulk endpoints if the last transfer
+  from an endpoint where URBs were dequeued returned a data packet
+- Reset hc->start_pkt_count properly in assign_and_init_hc()
+
+dwc_otg: fix several potential crash sources
+
+On root port disconnect events, the host driver state is cleared and
+in-progress host channels are forcibly stopped. This doesn't play
+well with the FIQ running in the background, so:
+- Guard the disconnect callback with both the host spinlock and FIQ
+  spinlock
+- Move qtd dereference in dwc_otg_handle_hc_fsm() after the early-out
+  so we don't dereference a qtd that has gone away
+- Turn catch-all BUG()s in dwc_otg_handle_hc_fsm() into warnings.
+
+dwc_otg: delete hcd->channel_lock
+
+The lock serves no purpose as it is only held while the HCD spinlock
+is already being held.
+
+dwc_otg: remove unnecessary dma-mode channel halts on disconnect interrupt
+
+Host channels are already halted in kill_urbs_in_qh_list() with the
+subsequent interrupt processing behaving as if the URB was dequeued
+via HCD callback.
+
+There's no need to clobber the host channel registers a second time
+as this exposes races between the driver and host channel resulting
+in hcd->free_hc_list becoming corrupted.
+
+dwcotg: Allow to build without FIQ on ARM64
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+
+dwc_otg: make periodic scheduling behave properly for FS buses
+
+If the root port is in full-speed mode, transfer times at 12mbit/s
+would be calculated but matched against high-speed quotas.
+
+Reinitialise hcd->frame_usecs[i] on each port enable event so that
+full-speed bandwidth can be tracked sensibly.
+
+Also, don't bother using the FIQ for transfers when in full-speed
+mode - at the slower bus speed, interrupt frequency is reduced by
+an order of magnitude.
+
+Related issue: https://github.com/raspberrypi/linux/issues/2020
+
+dwc_otg: fiq_fsm: Make isochronous compatibility checks work properly
+
+Get rid of the spammy printk and local pointer mangling.
+Also, there is a nominal benefit for using fiq_fsm for isochronous
+transfers in FS mode (~1.1k IRQs per second vs 2.1k IRQs per second)
+so remove the root port speed check.
+
+dwc_otg: add module parameter int_ep_interval_min
+
+Add a module parameter (defaulting to ignored) that clamps the polling rate
+of high-speed Interrupt endpoints to a minimum microframe interval.
+
+The parameter is modifiable at runtime as it is used when activating new
+endpoints (such as on device connect).
+
+dwc_otg: fiq_fsm: Add non-periodic TT exclusivity constraints
+
+Certain hub types do not discriminate between pipe direction (IN or OUT)
+when considering non-periodic transfers. Therefore these hubs get confused
+if multiple transfers are issued in different directions with the same
+device address and endpoint number.
+
+Constrain queuing non-periodic split transactions so they are performed
+serially in such cases.
+
+Related: https://github.com/raspberrypi/linux/issues/2024
+
+dwc_otg: Fixup change to DRIVER_ATTR interface
+
+dwc_otg: Fix compilation warnings
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+USB_DWCOTG: Disable building dwc_otg as a module (#2265)
+
+When dwc_otg is built as a module, build will fail with the following
+error:
+
+ERROR: "DWC_TASK_HI_SCHEDULE" [drivers/usb/host/dwc_otg/dwc_otg.ko] undefined!
+scripts/Makefile.modpost:91: recipe for target '__modpost' failed
+make[1]: *** [__modpost] Error 1
+Makefile:1199: recipe for target 'modules' failed
+make: *** [modules] Error 2
+
+Even if the error is solved by including the missing
+DWC_TASK_HI_SCHEDULE function, the kernel will panic when loading
+dwc_otg.
+
+As a workaround, simply prevent user from building dwc_otg as a module
+as the current kernel does not support it.
+
+See: https://github.com/raspberrypi/linux/issues/2258
+
+Signed-off-by: Malik Olivier Boussejra <malik@boussejra.com>
+
+dwc_otg: New timer API
+
+dwc_otg: Fix removed ACCESS_ONCE->READ_ONCE
+
+dwc_otg: don't unconditionally force host mode in dwc_otg_cil_init()
+
+Add the ability to disable force_host_mode for those that want to use
+dwc_otg in both device and host modes.
+
+dwc_otg: Fix a regression when dequeueing isochronous transfers
+
+In 282bed95 (dwc_otg: make nak_holdoff work as intended with empty queues)
+the dequeue mechanism was changed to leave FIQ-enabled transfers to run
+to completion - to avoid leaving hub TT buffers with stale packets lying
+around.
+
+This broke FIQ-accelerated isochronous transfers, as this then meant that
+dozens of transfers were performed after the dequeue function returned.
+
+Restore the state machine fence for isochronous transfers.
+
+fiq_fsm: rewind DMA pointer for OUT transactions that fail (#2288)
+
+See: https://github.com/raspberrypi/linux/issues/2140
+
+dwc_otg: add smp_mb() to prevent driver state corruption on boot
+
+Occasional crashes have been seen where the FIQ code dereferences
+invalid/random pointers immediately after being set up, leading to
+panic on boot.
+
+The crash occurs as the FIQ code races against hcd_init_fiq() and
+the hcd_init_fiq() code races against the outstanding memory stores
+from dwc_otg_hcd_init(). Use explicit barriers after touching
+driver state.
+
+usb: dwc_otg: fix memory corruption in dwc_otg driver
+
+[Upstream commit 51b1b6491752ac066ee8d32cc66042fcc955fef6]
+
+The move from the staging tree to the main tree exposed a
+longstanding memory corruption bug in the dwc2 driver. The
+reordering of the driver initialization caused the dwc2 driver
+to corrupt the initialization data of the sdhci driver on the
+Raspberry Pi platform, which made the bug show up.
+
+The error is in calling to_usb_device(hsotg->dev), since ->dev
+is not a member of struct usb_device. The easiest fix is to
+just remove the offending code, since it is not really needed.
+
+Thanks to Stephen Warren for tracking down the cause of this.
+
+Reported-by: Andre Heider <a.heider@gmail.com>
+Tested-by: Stephen Warren <swarren@wwwdotorg.org>
+Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[lukas: port from upstream dwc2 to out-of-tree dwc_otg driver]
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+
+usb: dwb_otg: Fix unreachable switch statement warning
+
+This warning appears with GCC 7.3.0 from toolchains.bootlin.com:
+
+../drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c: In function ‘fiq_fsm_update_hs_isoc’:
+../drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c:595:61: warning: statement will never be executed [-Wswitch-unreachable]
+   st->hctsiz_copy.b.xfersize = nrpackets * st->hcchar_copy.b.mps;
+                                            ~~~~~~~~~~~~~~~~~^~~~
+
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+
+dwc_otg: fiq_fsm: fix incorrect DMA register offset calculation
+
+Rationalise the offset and update all call sites.
+
+Fixes https://github.com/raspberrypi/linux/issues/2408
+
+dwc_otg: fix bug with port_addr assignment for single-TT hubs
+
+See https://github.com/raspberrypi/linux/issues/2734
+
+The "Hub Port" field in the split transaction packet was always set
+to 1 for single-TT hubs. The majority of single-TT hub products
+apparently ignore this field and broadcast to all downstream enabled
+ports, which masked the issue. A subset of hub devices apparently
+need the port number to be exact or split transactions will fail.
+
+usb: dwc_otg: Clean up build warnings on 64bit kernels
+
+No functional changes. Almost all are changes to logging lines.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+usb: dwc_otg: Use dma allocation for mphi dummy_send buffer
+
+The FIQ driver used a kzalloc'ed buffer for dummy_send,
+passing a kernel virtual address to the hardware block.
+The buffer is only ever used for a dummy read, so it
+should be harmless, but there is the chance that it will
+cause exceptions.
+
+Use a dma allocation so that we have a genuine bus address,
+and read from that.
+Free the allocation when done for good measure.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+dwc_otg: only do_split when we actually need to do a split
+
+The previous test would fail if the root port was in fullspeed mode
+and there was a hub between the FS device and the root port. While
+the transfer worked, the schedule mangling performed for high-speed
+split transfers would break leading to an 8ms polling interval.
+
+dwc_otg: fix locking around dequeueing and killing URBs
+
+kill_urbs_in_qh_list() is practically only ever called with the fiq lock
+already held, so don't spinlock twice in the case where we need to cancel
+an isochronous transfer.
+
+Also fix up a case where the global interrupt register could be read with
+the fiq lock not held.
+
+Fixes the deadlock seen in https://github.com/raspberrypi/linux/issues/2907
+
+ARM64/DWC_OTG: Port dwc_otg driver to ARM64
+
+In ARM64, the FIQ mechanism used by this driver is not current
+implemented.   As a workaround, reqular IRQ is used instead
+of FIQ.
+
+In a separate change, the IRQ-CPU mapping is round robined
+on ARM64 to increase concurrency and allow multiple interrupts
+to be serviced at a time.  This reduces the need for FIQ.
+
+Tests Run:
+
+This mechanism is most likely to break when multiple USB devices
+are attached at the same time.  So the system was tested under
+stress.
+
+Devices:
+
+1. USB Speakers playing back a FLAC audio through VLC
+   at 96KHz.(Higher then typically, but supported on my speakers).
+
+2. sftp transferring large files through the buildin ethernet
+   connection which is connected through USB.
+
+3. Keyboard and mouse attached and being used.
+
+Although I do occasionally hear some glitches, the music seems to
+play quite well.
+
+Signed-off-by: Michael Zoran <mzoran@crowfest.net>
+
+usb: dwc_otg: Clean up interrupt claiming code
+
+The FIQ/IRQ interrupt number identification code is scattered through
+the dwc_otg driver. Rationalise it, simplifying the code and solving
+an existing issue.
+
+See: https://github.com/raspberrypi/linux/issues/2612
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+dwc_otg: Choose appropriate IRQ handover strategy
+
+2711 has no MPHI peripheral, but the ARM Control block can fake
+interrupts. Use the size of the DTB "mphi" reg block to determine
+which is required.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+usb: host: dwc_otg: fix compiling in separate directory
+
+The dwc_otg Makefile does not respect the O=path argument correctly:
+include paths in CFLAGS are given relatively to object path, not source
+path. Compiling in a separate directory yields #include errors.
+
+Signed-off-by: Marek Behún <marek.behun@nic.cz>
+
+dwc_otg: use align_buf for small IN control transfers (#3150)
+
+The hardware will do a 4-byte write to memory on any IN packet received
+that is between 1 and 3 bytes long. This tramples memory in the uvcvideo
+driver, as it uses a sequence of 1- and 2-byte control transfers to
+query the min/max/range/step of each individual camera control and
+gives us buffers that are offsets into a struct.
+
+Catch small control transfers in the data phase and use the align_buf
+to bounce the correct number of bytes into the URB's buffer.
+
+In general, short packets on non-control endpoints should be OK as URBs
+should have enough buffer space for a wMaxPacket size transfer.
+
+See: https://github.com/raspberrypi/linux/issues/3148
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+
+dwc_otg: Declare DMA capability with HCD_DMA flag
+
+Following [1], USB controllers have to declare DMA capabilities in
+order for them to be used by adding the HCD_DMA flag to their hc_driver
+struct.
+
+[1] 7b81cb6bddd2 ("usb: add a HCD_DMA flag instead of guestimating DMA capabilities")
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+dwc_otg: checking the urb->transfer_buffer too early (#3332)
+
+After enable the HIGHMEM and VMSPLIT_3G, the dwc_otg driver doesn't
+work well on Pi2/3 boards with 1G physical ram. Users experience
+the failure when copying a file of 600M size to the USB stick. And
+at the same time, the dmesg shows:
+usb 1-1.1.2: reset high-speed USB device number 8 using dwc_otg
+sd 0:0:0:0: [sda] tag#0 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK
+blk_update_request: I/O error, dev sda, sector 3024048 op 0x1:(WRITE) flags 0x4000 phys_seg 15 prio class 0
+
+When this happens, the sg_buf sent to the driver is located in the
+highmem region, the usb_sg_init() in the core/message.c will leave
+transfer_buffer to NULL if the sg_buf is in highmem, but in the
+dwc_otg driver, it returns -EINVAL unconditionally if transfer_buffer
+is NULL.
+
+The driver can handle the situation of buffer to be NULL, if it is in
+DMA mode, it will convert an address from transfer_dma.
+
+But if the conversion fails or it is in the PIO mode, we should check
+buffer and return -EINVAL if it is NULL.
+
+BugLink: https://bugs.launchpad.net/bugs/1852510
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+dwc_otg: constrain endpoint max packet and transfer size on split IN
+
+The hcd would unconditionally set the transfer length to the endpoint
+packet size for non-isoc IN transfers. If the remaining buffer length
+was less than the length of returned data, random memory would get
+scribbled over, with bad effects if it crossed a page boundary.
+
+Force a babble error if this happens by limiting the max transfer size
+to the available buffer space. DMA will stop writing to memory on a
+babble condition.
+
+The hardware expects xfersize to be an integer multiple of maxpacket
+size, so override hcchar.b.mps as well.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+
+dwc_otg: fiq_fsm: pause when cancelling split transactions
+
+Non-periodic splits will DMA to/from the driver-provided transfer_buffer,
+which may be freed immediately after the dequeue call returns. Block until
+we know the transfer is complete.
+
+A similar delay is needed when cleaning up disconnects, as the FIQ could
+have started a periodic transfer in the previous microframe to the one
+that triggered a disconnect.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+
+dwc_otg: fiq_fsm: add a barrier on entry into FIQ handler(s)
+
+On BCM2835, there is no hardware guarantee that multiple outstanding
+reads to different peripherals will complete in-order. The FIQ code
+uses peripheral reads without barriers for performance, so in the case
+where a read to a slow peripheral was issued immediately prior to FIQ
+entry, the first peripheral read that the FIQ did could end up with
+wrong read data returned.
+
+Add dsb(sy) on entry so that all outstanding reads are retired.
+
+The FIQ only issues reads to the dwc_otg core, so per-read barriers
+in the handler itself are not required.
+
+On BCM2836 and BCM2837 the barrier is not strictly required due to
+differences in how the peripheral bus is implemented, but having
+arch-specific handlers that introduce different latencies is risky.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+
+dwc_otg: whitelist_table is now productlist_table
+
+dwc_otg: initialise sched_frame for periodic QHs that were parked
+
+If a periodic QH has no remaining QTDs, then it is removed from all
+periodic schedules. When re-adding, initialise the sched_frame and
+start_split_frame from the current value of the frame counter.
+
+See https://bugs.launchpad.net/raspbian/+bug/1819560
+and
+ https://github.com/raspberrypi/linux/issues/3883
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+dwc_otg: Minimise header and fix build warnings
+
+Delete a large amount of unused declaration from "usb.h", some of which
+were causing build warnings, and get the module building cleanly.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+dwc-otg: fix clang -Wignored-attributes warning
+
+warning: attribute declaration must precede definition
+
+dwc-otg: fix clang -Wsometimes-uninitialized warning
+
+warning: variable 'retval' is used uninitialized whenever 'if' condition is false
+
+dwc-otg: fix clang -Wpointer-bool-conversion warning
+
+warning: address of array 'desc->wMaxPacketSize' will always evaluate to 'true'
+
+The wMaxPacketSize field is actually a two element array which content should
+be accessed via the UGETW macro.
+
+dwc_otg: fix an undeclared variable
+Replace an undeclared variable used by DWC_DEBUGPL with the real endpoint address. DWC_DEBUGPL does nothing with DEBUG undefined so it did not go wrong before.
+Signed-off-by: Zixuan Wang <wangzixuan@sjtu.edu.cn>
+
+dwc_otg: Update NetBSD usb.h header licence
+
+NetBSD have changed their licensing requirements such that the 2-clause
+licence is preferred. Update usb.h in the downstream dwc_otg code
+accordingly.
+
+See https://www.netbsd.org/about/redistribution.html for more
+information.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+dwc_otg: pay attention to qh->interval when rescheduling periodic queues
+
+A regression introduced in https://github.com/raspberrypi/linux/pull/3887
+meant that if the newly scheduled transfer immediately returned data, and
+the driver resubmitted a single URB after every transfer, then the effective
+polling interval would end up being approx 1ms.
+
+Use the larger of SCHEDULE_SLOP or the configured endpoint interval.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ arch/arm/include/asm/irqflags.h               |   16 +-
+ arch/arm/kernel/fiqasm.S                      |    4 +
+ drivers/usb/Makefile                          |    1 +
+ drivers/usb/core/generic.c                    |    1 +
+ drivers/usb/core/hub.c                        |    2 +-
+ drivers/usb/core/message.c                    |   79 +
+ drivers/usb/core/otg_productlist.h            |  114 +-
+ drivers/usb/gadget/file_storage.c             | 3676 +++++++++
+ drivers/usb/host/Kconfig                      |   10 +
+ drivers/usb/host/Makefile                     |    1 +
+ drivers/usb/host/dwc_common_port/Makefile     |   58 +
+ .../usb/host/dwc_common_port/Makefile.fbsd    |   17 +
+ .../usb/host/dwc_common_port/Makefile.linux   |   49 +
+ drivers/usb/host/dwc_common_port/changes.txt  |  174 +
+ .../usb/host/dwc_common_port/doc/doxygen.cfg  |  270 +
+ drivers/usb/host/dwc_common_port/dwc_cc.c     |  532 ++
+ drivers/usb/host/dwc_common_port/dwc_cc.h     |  224 +
+ .../host/dwc_common_port/dwc_common_fbsd.c    | 1308 +++
+ .../host/dwc_common_port/dwc_common_linux.c   | 1409 ++++
+ .../host/dwc_common_port/dwc_common_nbsd.c    | 1275 +++
+ drivers/usb/host/dwc_common_port/dwc_crypto.c |  308 +
+ drivers/usb/host/dwc_common_port/dwc_crypto.h |  111 +
+ drivers/usb/host/dwc_common_port/dwc_dh.c     |  291 +
+ drivers/usb/host/dwc_common_port/dwc_dh.h     |  106 +
+ drivers/usb/host/dwc_common_port/dwc_list.h   |  594 ++
+ drivers/usb/host/dwc_common_port/dwc_mem.c    |  245 +
+ drivers/usb/host/dwc_common_port/dwc_modpow.c |  636 ++
+ drivers/usb/host/dwc_common_port/dwc_modpow.h |   34 +
+ .../usb/host/dwc_common_port/dwc_notifier.c   |  319 +
+ .../usb/host/dwc_common_port/dwc_notifier.h   |  122 +
+ drivers/usb/host/dwc_common_port/dwc_os.h     | 1275 +++
+ drivers/usb/host/dwc_common_port/usb.h        |  275 +
+ drivers/usb/host/dwc_otg/Makefile             |   85 +
+ drivers/usb/host/dwc_otg/doc/doxygen.cfg      |  224 +
+ drivers/usb/host/dwc_otg/dummy_audio.c        | 1574 ++++
+ drivers/usb/host/dwc_otg/dwc_cfi_common.h     |  142 +
+ drivers/usb/host/dwc_otg/dwc_otg_adp.c        |  854 ++
+ drivers/usb/host/dwc_otg/dwc_otg_adp.h        |   80 +
+ drivers/usb/host/dwc_otg/dwc_otg_attr.c       | 1212 +++
+ drivers/usb/host/dwc_otg/dwc_otg_attr.h       |   89 +
+ drivers/usb/host/dwc_otg/dwc_otg_cfi.c        | 1876 +++++
+ drivers/usb/host/dwc_otg/dwc_otg_cfi.h        |  320 +
+ drivers/usb/host/dwc_otg/dwc_otg_cil.c        | 7146 +++++++++++++++++
+ drivers/usb/host/dwc_otg/dwc_otg_cil.h        | 1464 ++++
+ drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c   | 1601 ++++
+ drivers/usb/host/dwc_otg/dwc_otg_core_if.h    |  705 ++
+ drivers/usb/host/dwc_otg/dwc_otg_dbg.h        |  117 +
+ drivers/usb/host/dwc_otg/dwc_otg_driver.c     | 1772 ++++
+ drivers/usb/host/dwc_otg/dwc_otg_driver.h     |   86 +
+ drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c    | 1433 ++++
+ drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h    |  399 +
+ drivers/usb/host/dwc_otg/dwc_otg_fiq_stub.S   |   80 +
+ drivers/usb/host/dwc_otg/dwc_otg_hcd.c        | 4363 ++++++++++
+ drivers/usb/host/dwc_otg/dwc_otg_hcd.h        |  870 ++
+ drivers/usb/host/dwc_otg/dwc_otg_hcd_ddma.c   | 1135 +++
+ drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h     |  421 +
+ drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c   | 2757 +++++++
+ drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c  | 1086 +++
+ drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c  |  974 +++
+ drivers/usb/host/dwc_otg/dwc_otg_os_dep.h     |  200 +
+ drivers/usb/host/dwc_otg/dwc_otg_pcd.c        | 2725 +++++++
+ drivers/usb/host/dwc_otg/dwc_otg_pcd.h        |  273 +
+ drivers/usb/host/dwc_otg/dwc_otg_pcd_if.h     |  361 +
+ drivers/usb/host/dwc_otg/dwc_otg_pcd_intr.c   | 5148 ++++++++++++
+ drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c  | 1262 +++
+ drivers/usb/host/dwc_otg/dwc_otg_regs.h       | 2550 ++++++
+ drivers/usb/host/dwc_otg/test/Makefile        |   16 +
+ drivers/usb/host/dwc_otg/test/dwc_otg_test.pm |  337 +
+ .../usb/host/dwc_otg/test/test_mod_param.pl   |  133 +
+ drivers/usb/host/dwc_otg/test/test_sysfs.pl   |  193 +
+ 70 files changed, 59583 insertions(+), 16 deletions(-)
+ create mode 100644 drivers/usb/gadget/file_storage.c
+ create mode 100644 drivers/usb/host/dwc_common_port/Makefile
+ create mode 100644 drivers/usb/host/dwc_common_port/Makefile.fbsd
+ create mode 100644 drivers/usb/host/dwc_common_port/Makefile.linux
+ create mode 100644 drivers/usb/host/dwc_common_port/changes.txt
+ create mode 100644 drivers/usb/host/dwc_common_port/doc/doxygen.cfg
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_cc.c
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_cc.h
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_common_fbsd.c
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_common_linux.c
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_common_nbsd.c
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_crypto.c
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_crypto.h
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_dh.c
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_dh.h
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_list.h
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_mem.c
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_modpow.c
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_modpow.h
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_notifier.c
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_notifier.h
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_os.h
+ create mode 100644 drivers/usb/host/dwc_common_port/usb.h
+ create mode 100644 drivers/usb/host/dwc_otg/Makefile
+ create mode 100644 drivers/usb/host/dwc_otg/doc/doxygen.cfg
+ create mode 100644 drivers/usb/host/dwc_otg/dummy_audio.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_cfi_common.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_adp.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_adp.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_attr.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_attr.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cfi.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cfi.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cil.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cil.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_core_if.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_dbg.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_driver.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_driver.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_fiq_stub.S
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_ddma.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_os_dep.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd_if.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd_intr.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_regs.h
+ create mode 100644 drivers/usb/host/dwc_otg/test/Makefile
+ create mode 100644 drivers/usb/host/dwc_otg/test/dwc_otg_test.pm
+ create mode 100644 drivers/usb/host/dwc_otg/test/test_mod_param.pl
+ create mode 100644 drivers/usb/host/dwc_otg/test/test_sysfs.pl
+
+--- a/arch/arm/include/asm/irqflags.h
++++ b/arch/arm/include/asm/irqflags.h
+@@ -163,13 +163,23 @@ static inline unsigned long arch_local_s
+ }
+ 
+ /*
+- * restore saved IRQ & FIQ state
++ * restore saved IRQ state
+  */
+ #define arch_local_irq_restore arch_local_irq_restore
+ static inline void arch_local_irq_restore(unsigned long flags)
+ {
+-	asm volatile(
+-		"	msr	" IRQMASK_REG_NAME_W ", %0	@ local_irq_restore"
++	unsigned long temp = 0;
++	flags &= ~(1 << 6);
++	asm volatile (
++		" mrs %0, cpsr"
++		: "=r" (temp)
++		:
++		: "memory", "cc");
++		/* Preserve FIQ bit */
++		temp &= (1 << 6);
++		flags = flags | temp;
++	asm volatile (
++		"    msr    cpsr_c, %0    @ local_irq_restore"
+ 		:
+ 		: "r" (flags)
+ 		: "memory", "cc");
+--- a/arch/arm/kernel/fiqasm.S
++++ b/arch/arm/kernel/fiqasm.S
+@@ -47,3 +47,7 @@ ENTRY(__get_fiq_regs)
+ 	mov	r0, r0		@ avoid hazard prior to ARMv4
+ 	ret	lr
+ ENDPROC(__get_fiq_regs)
++
++ENTRY(__FIQ_Branch)
++	mov pc, r8
++ENDPROC(__FIQ_Branch)
+--- a/drivers/usb/Makefile
++++ b/drivers/usb/Makefile
+@@ -9,6 +9,7 @@ obj-$(CONFIG_USB_COMMON)	+= common/
+ obj-$(CONFIG_USB)		+= core/
+ obj-$(CONFIG_USB_SUPPORT)	+= phy/
+ 
++obj-$(CONFIG_USB_DWCOTG)	+= host/
+ obj-$(CONFIG_USB_DWC3)		+= dwc3/
+ obj-$(CONFIG_USB_DWC2)		+= dwc2/
+ obj-$(CONFIG_USB_ISP1760)	+= isp1760/
+--- a/drivers/usb/core/generic.c
++++ b/drivers/usb/core/generic.c
+@@ -190,6 +190,7 @@ int usb_choose_configuration(struct usb_
+ 		dev_warn(&udev->dev,
+ 			"no configuration chosen from %d choice%s\n",
+ 			num_configs, plural(num_configs));
++		dev_warn(&udev->dev, "No support over %dmA\n", udev->bus_mA);
+ 	}
+ 	return i;
+ }
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -5580,7 +5580,7 @@ static void port_event(struct usb_hub *h
+ 		port_dev->over_current_count++;
+ 		port_over_current_notify(port_dev);
+ 
+-		dev_dbg(&port_dev->dev, "over-current change #%u\n",
++		dev_notice(&port_dev->dev, "over-current change #%u\n",
+ 			port_dev->over_current_count);
+ 		usb_clear_port_feature(hdev, port1,
+ 				USB_PORT_FEAT_C_OVER_CURRENT);
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -2140,6 +2140,85 @@ free_interfaces:
+ 	if (cp->string == NULL &&
+ 			!(dev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS))
+ 		cp->string = usb_cache_string(dev, cp->desc.iConfiguration);
++/* Uncomment this define to enable the HS Electrical Test support */
++#define DWC_HS_ELECT_TST 1
++#ifdef DWC_HS_ELECT_TST
++		/* Here we implement the HS Electrical Test support. The
++		 * tester uses a vendor ID of 0x1A0A to indicate we should
++		 * run a special test sequence. The product ID tells us
++		 * which sequence to run. We invoke the test sequence by
++		 * sending a non-standard SetFeature command to our root
++		 * hub port. Our dwc_otg_hcd_hub_control() routine will
++		 * recognize the command and perform the desired test
++		 * sequence.
++		 */
++		if (dev->descriptor.idVendor == 0x1A0A) {
++			/* HSOTG Electrical Test */
++			dev_warn(&dev->dev, "VID from HSOTG Electrical Test Fixture\n");
++
++			if (dev->bus && dev->bus->root_hub) {
++				struct usb_device *hdev = dev->bus->root_hub;
++				dev_warn(&dev->dev, "Got PID 0x%x\n", dev->descriptor.idProduct);
++
++				switch (dev->descriptor.idProduct) {
++				case 0x0101:	/* TEST_SE0_NAK */
++					dev_warn(&dev->dev, "TEST_SE0_NAK\n");
++					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
++							USB_REQ_SET_FEATURE, USB_RT_PORT,
++							USB_PORT_FEAT_TEST, 0x300, NULL, 0, HZ);
++					break;
++
++				case 0x0102:	/* TEST_J */
++					dev_warn(&dev->dev, "TEST_J\n");
++					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
++							USB_REQ_SET_FEATURE, USB_RT_PORT,
++							USB_PORT_FEAT_TEST, 0x100, NULL, 0, HZ);
++					break;
++
++				case 0x0103:	/* TEST_K */
++					dev_warn(&dev->dev, "TEST_K\n");
++					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
++							USB_REQ_SET_FEATURE, USB_RT_PORT,
++							USB_PORT_FEAT_TEST, 0x200, NULL, 0, HZ);
++					break;
++
++				case 0x0104:	/* TEST_PACKET */
++					dev_warn(&dev->dev, "TEST_PACKET\n");
++					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
++							USB_REQ_SET_FEATURE, USB_RT_PORT,
++							USB_PORT_FEAT_TEST, 0x400, NULL, 0, HZ);
++					break;
++
++				case 0x0105:	/* TEST_FORCE_ENABLE */
++					dev_warn(&dev->dev, "TEST_FORCE_ENABLE\n");
++					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
++							USB_REQ_SET_FEATURE, USB_RT_PORT,
++							USB_PORT_FEAT_TEST, 0x500, NULL, 0, HZ);
++					break;
++
++				case 0x0106:	/* HS_HOST_PORT_SUSPEND_RESUME */
++					dev_warn(&dev->dev, "HS_HOST_PORT_SUSPEND_RESUME\n");
++					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
++							USB_REQ_SET_FEATURE, USB_RT_PORT,
++							USB_PORT_FEAT_TEST, 0x600, NULL, 0, 40 * HZ);
++					break;
++
++				case 0x0107:	/* SINGLE_STEP_GET_DEVICE_DESCRIPTOR setup */
++					dev_warn(&dev->dev, "SINGLE_STEP_GET_DEVICE_DESCRIPTOR setup\n");
++					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
++							USB_REQ_SET_FEATURE, USB_RT_PORT,
++							USB_PORT_FEAT_TEST, 0x700, NULL, 0, 40 * HZ);
++					break;
++
++				case 0x0108:	/* SINGLE_STEP_GET_DEVICE_DESCRIPTOR execute */
++					dev_warn(&dev->dev, "SINGLE_STEP_GET_DEVICE_DESCRIPTOR execute\n");
++					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
++							USB_REQ_SET_FEATURE, USB_RT_PORT,
++							USB_PORT_FEAT_TEST, 0x800, NULL, 0, 40 * HZ);
++				}
++			}
++		}
++#endif /* DWC_HS_ELECT_TST */
+ 
+ 	/* Now that the interfaces are installed, re-enable LPM. */
+ 	usb_unlocked_enable_lpm(dev);
+--- a/drivers/usb/core/otg_productlist.h
++++ b/drivers/usb/core/otg_productlist.h
+@@ -11,33 +11,82 @@
+ static struct usb_device_id productlist_table[] = {
+ 
+ /* hubs are optional in OTG, but very handy ... */
++#define CERT_WITHOUT_HUBS
++#if defined(CERT_WITHOUT_HUBS)
++{ USB_DEVICE( 0x0000, 0x0000 ), }, /* Root HUB Only*/
++#else
+ { USB_DEVICE_INFO(USB_CLASS_HUB, 0, 0), },
+ { USB_DEVICE_INFO(USB_CLASS_HUB, 0, 1), },
++{ USB_DEVICE_INFO(USB_CLASS_HUB, 0, 2), },
++#endif
+ 
+ #ifdef	CONFIG_USB_PRINTER		/* ignoring nonstatic linkage! */
+ /* FIXME actually, printers are NOT supposed to use device classes;
+  * they're supposed to use interface classes...
+  */
+-{ USB_DEVICE_INFO(7, 1, 1) },
+-{ USB_DEVICE_INFO(7, 1, 2) },
+-{ USB_DEVICE_INFO(7, 1, 3) },
++//{ USB_DEVICE_INFO(7, 1, 1) },
++//{ USB_DEVICE_INFO(7, 1, 2) },
++//{ USB_DEVICE_INFO(7, 1, 3) },
+ #endif
+ 
+ #ifdef	CONFIG_USB_NET_CDCETHER
+ /* Linux-USB CDC Ethernet gadget */
+-{ USB_DEVICE(0x0525, 0xa4a1), },
++//{ USB_DEVICE(0x0525, 0xa4a1), },
+ /* Linux-USB CDC Ethernet + RNDIS gadget */
+-{ USB_DEVICE(0x0525, 0xa4a2), },
++//{ USB_DEVICE(0x0525, 0xa4a2), },
+ #endif
+ 
+ #if	IS_ENABLED(CONFIG_USB_TEST)
+ /* gadget zero, for testing */
+-{ USB_DEVICE(0x0525, 0xa4a0), },
++//{ USB_DEVICE(0x0525, 0xa4a0), },
+ #endif
+ 
++/* OPT Tester */
++{ USB_DEVICE( 0x1a0a, 0x0101 ), }, /* TEST_SE0_NAK */
++{ USB_DEVICE( 0x1a0a, 0x0102 ), }, /* Test_J */
++{ USB_DEVICE( 0x1a0a, 0x0103 ), }, /* Test_K */
++{ USB_DEVICE( 0x1a0a, 0x0104 ), }, /* Test_PACKET */
++{ USB_DEVICE( 0x1a0a, 0x0105 ), }, /* Test_FORCE_ENABLE */
++{ USB_DEVICE( 0x1a0a, 0x0106 ), }, /* HS_PORT_SUSPEND_RESUME  */
++{ USB_DEVICE( 0x1a0a, 0x0107 ), }, /* SINGLE_STEP_GET_DESCRIPTOR setup */
++{ USB_DEVICE( 0x1a0a, 0x0108 ), }, /* SINGLE_STEP_GET_DESCRIPTOR execute */
++
++/* Sony cameras */
++{ USB_DEVICE_VER(0x054c,0x0010,0x0410, 0x0500), },
++
++/* Memory Devices */
++//{ USB_DEVICE( 0x0781, 0x5150 ), }, /* SanDisk */
++//{ USB_DEVICE( 0x05DC, 0x0080 ), }, /* Lexar */
++//{ USB_DEVICE( 0x4146, 0x9281 ), }, /* IOMEGA */
++//{ USB_DEVICE( 0x067b, 0x2507 ), }, /* Hammer 20GB External HD  */
++{ USB_DEVICE( 0x0EA0, 0x2168 ), }, /* Ours Technology Inc. (BUFFALO ClipDrive)*/
++//{ USB_DEVICE( 0x0457, 0x0150 ), }, /* Silicon Integrated Systems Corp. */
++
++/* HP Printers */
++//{ USB_DEVICE( 0x03F0, 0x1102 ), }, /* HP Photosmart 245 */
++//{ USB_DEVICE( 0x03F0, 0x1302 ), }, /* HP Photosmart 370 Series */
++
++/* Speakers */
++//{ USB_DEVICE( 0x0499, 0x3002 ), }, /* YAMAHA YST-MS35D USB Speakers */
++//{ USB_DEVICE( 0x0672, 0x1041 ), }, /* Labtec USB Headset */
++
+ { }	/* Terminating entry */
+ };
+ 
++static inline void report_errors(struct usb_device *dev)
++{
++	/* OTG MESSAGE: report errors here, customize to match your product */
++	dev_info(&dev->dev, "device Vendor:%04x Product:%04x is not supported\n",
++		 le16_to_cpu(dev->descriptor.idVendor),
++		 le16_to_cpu(dev->descriptor.idProduct));
++        if (USB_CLASS_HUB == dev->descriptor.bDeviceClass){
++                dev_printk(KERN_CRIT, &dev->dev, "Unsupported Hub Topology\n");
++        } else {
++                dev_printk(KERN_CRIT, &dev->dev, "Attached Device is not Supported\n");
++        }
++}
++
++
+ static int is_targeted(struct usb_device *dev)
+ {
+ 	struct usb_device_id	*id = productlist_table;
+@@ -87,16 +136,57 @@ static int is_targeted(struct usb_device
+ 			continue;
+ 
+ 		return 1;
+-	}
++		/* NOTE: can't use usb_match_id() since interface caches
++		 * aren't set up yet. this is cut/paste from that code.
++		 */
++		for (id = productlist_table; id->match_flags; id++) {
++#ifdef DEBUG
++			dev_dbg(&dev->dev,
++				"ID: V:%04x P:%04x DC:%04x SC:%04x PR:%04x \n",
++				id->idVendor,
++				id->idProduct,
++				id->bDeviceClass,
++				id->bDeviceSubClass,
++				id->bDeviceProtocol);
++#endif
+ 
+-	/* add other match criteria here ... */
++			if ((id->match_flags & USB_DEVICE_ID_MATCH_VENDOR) &&
++			    id->idVendor != le16_to_cpu(dev->descriptor.idVendor))
++				continue;
++
++			if ((id->match_flags & USB_DEVICE_ID_MATCH_PRODUCT) &&
++			    id->idProduct != le16_to_cpu(dev->descriptor.idProduct))
++				continue;
++
++			/* No need to test id->bcdDevice_lo != 0, since 0 is never
++			   greater than any unsigned number. */
++			if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_LO) &&
++			    (id->bcdDevice_lo > le16_to_cpu(dev->descriptor.bcdDevice)))
++				continue;
++
++			if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_HI) &&
++			    (id->bcdDevice_hi < le16_to_cpu(dev->descriptor.bcdDevice)))
++				continue;
++
++			if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_CLASS) &&
++			    (id->bDeviceClass != dev->descriptor.bDeviceClass))
++				continue;
++
++			if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_SUBCLASS) &&
++			    (id->bDeviceSubClass != dev->descriptor.bDeviceSubClass))
++				continue;
++
++			if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_PROTOCOL) &&
++			    (id->bDeviceProtocol != dev->descriptor.bDeviceProtocol))
++				continue;
+ 
++			return 1;
++		}
++	}
+ 
+-	/* OTG MESSAGE: report errors here, customize to match your product */
+-	dev_err(&dev->dev, "device v%04x p%04x is not supported\n",
+-		le16_to_cpu(dev->descriptor.idVendor),
+-		le16_to_cpu(dev->descriptor.idProduct));
++	/* add other match criteria here ... */
+ 
++	report_errors(dev);
+ 	return 0;
+ }
+ 
+--- /dev/null
++++ b/drivers/usb/gadget/file_storage.c
+@@ -0,0 +1,3676 @@
++/*
++ * file_storage.c -- File-backed USB Storage Gadget, for USB development
++ *
++ * Copyright (C) 2003-2008 Alan Stern
++ * All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions, and the following disclaimer,
++ *    without modification.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. The names of the above-listed copyright holders may not be used
++ *    to endorse or promote products derived from this software without
++ *    specific prior written permission.
++ *
++ * ALTERNATIVELY, this software may be distributed under the terms of the
++ * GNU General Public License ("GPL") as published by the Free Software
++ * Foundation, either version 2 of that License or (at your option) any
++ * later version.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
++ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
++ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
++ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
++ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
++ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++
++/*
++ * The File-backed Storage Gadget acts as a USB Mass Storage device,
++ * appearing to the host as a disk drive or as a CD-ROM drive.  In addition
++ * to providing an example of a genuinely useful gadget driver for a USB
++ * device, it also illustrates a technique of double-buffering for increased
++ * throughput.  Last but not least, it gives an easy way to probe the
++ * behavior of the Mass Storage drivers in a USB host.
++ *
++ * Backing storage is provided by a regular file or a block device, specified
++ * by the "file" module parameter.  Access can be limited to read-only by
++ * setting the optional "ro" module parameter.  (For CD-ROM emulation,
++ * access is always read-only.)  The gadget will indicate that it has
++ * removable media if the optional "removable" module parameter is set.
++ *
++ * The gadget supports the Control-Bulk (CB), Control-Bulk-Interrupt (CBI),
++ * and Bulk-Only (also known as Bulk-Bulk-Bulk or BBB) transports, selected
++ * by the optional "transport" module parameter.  It also supports the
++ * following protocols: RBC (0x01), ATAPI or SFF-8020i (0x02), QIC-157 (0c03),
++ * UFI (0x04), SFF-8070i (0x05), and transparent SCSI (0x06), selected by
++ * the optional "protocol" module parameter.  In addition, the default
++ * Vendor ID, Product ID, release number and serial number can be overridden.
++ *
++ * There is support for multiple logical units (LUNs), each of which has
++ * its own backing file.  The number of LUNs can be set using the optional
++ * "luns" module parameter (anywhere from 1 to 8), and the corresponding
++ * files are specified using comma-separated lists for "file" and "ro".
++ * The default number of LUNs is taken from the number of "file" elements;
++ * it is 1 if "file" is not given.  If "removable" is not set then a backing
++ * file must be specified for each LUN.  If it is set, then an unspecified
++ * or empty backing filename means the LUN's medium is not loaded.  Ideally
++ * each LUN would be settable independently as a disk drive or a CD-ROM
++ * drive, but currently all LUNs have to be the same type.  The CD-ROM
++ * emulation includes a single data track and no audio tracks; hence there
++ * need be only one backing file per LUN.
++ *
++ * Requirements are modest; only a bulk-in and a bulk-out endpoint are
++ * needed (an interrupt-out endpoint is also needed for CBI).  The memory
++ * requirement amounts to two 16K buffers, size configurable by a parameter.
++ * Support is included for both full-speed and high-speed operation.
++ *
++ * Note that the driver is slightly non-portable in that it assumes a
++ * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
++ * interrupt-in endpoints.  With most device controllers this isn't an
++ * issue, but there may be some with hardware restrictions that prevent
++ * a buffer from being used by more than one endpoint.
++ *
++ * Module options:
++ *
++ *	file=filename[,filename...]
++ *				Required if "removable" is not set, names of
++ *					the files or block devices used for
++ *					backing storage
++ *	serial=HHHH...		Required serial number (string of hex chars)
++ *	ro=b[,b...]		Default false, booleans for read-only access
++ *	removable		Default false, boolean for removable media
++ *	luns=N			Default N = number of filenames, number of
++ *					LUNs to support
++ *	nofua=b[,b...]		Default false, booleans for ignore FUA flag
++ *					in SCSI WRITE(10,12) commands
++ *	stall			Default determined according to the type of
++ *					USB device controller (usually true),
++ *					boolean to permit the driver to halt
++ *					bulk endpoints
++ *	cdrom			Default false, boolean for whether to emulate
++ *					a CD-ROM drive
++ *	transport=XXX		Default BBB, transport name (CB, CBI, or BBB)
++ *	protocol=YYY		Default SCSI, protocol name (RBC, 8020 or
++ *					ATAPI, QIC, UFI, 8070, or SCSI;
++ *					also 1 - 6)
++ *	vendor=0xVVVV		Default 0x0525 (NetChip), USB Vendor ID
++ *	product=0xPPPP		Default 0xa4a5 (FSG), USB Product ID
++ *	release=0xRRRR		Override the USB release number (bcdDevice)
++ *	buflen=N		Default N=16384, buffer size used (will be
++ *					rounded down to a multiple of
++ *					PAGE_CACHE_SIZE)
++ *
++ * If CONFIG_USB_FILE_STORAGE_TEST is not set, only the "file", "serial", "ro",
++ * "removable", "luns", "nofua", "stall", and "cdrom" options are available;
++ * default values are used for everything else.
++ *
++ * The pathnames of the backing files and the ro settings are available in
++ * the attribute files "file", "nofua", and "ro" in the lun<n> subdirectory of
++ * the gadget's sysfs directory.  If the "removable" option is set, writing to
++ * these files will simulate ejecting/loading the medium (writing an empty
++ * line means eject) and adjusting a write-enable tab.  Changes to the ro
++ * setting are not allowed when the medium is loaded or if CD-ROM emulation
++ * is being used.
++ *
++ * This gadget driver is heavily based on "Gadget Zero" by David Brownell.
++ * The driver's SCSI command interface was based on the "Information
++ * technology - Small Computer System Interface - 2" document from
++ * X3T9.2 Project 375D, Revision 10L, 7-SEP-93, available at
++ * <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>.  The single exception
++ * is opcode 0x23 (READ FORMAT CAPACITIES), which was based on the
++ * "Universal Serial Bus Mass Storage Class UFI Command Specification"
++ * document, Revision 1.0, December 14, 1998, available at
++ * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
++ */
++
++
++/*
++ *				Driver Design
++ *
++ * The FSG driver is fairly straightforward.  There is a main kernel
++ * thread that handles most of the work.  Interrupt routines field
++ * callbacks from the controller driver: bulk- and interrupt-request
++ * completion notifications, endpoint-0 events, and disconnect events.
++ * Completion events are passed to the main thread by wakeup calls.  Many
++ * ep0 requests are handled at interrupt time, but SetInterface,
++ * SetConfiguration, and device reset requests are forwarded to the
++ * thread in the form of "exceptions" using SIGUSR1 signals (since they
++ * should interrupt any ongoing file I/O operations).
++ *
++ * The thread's main routine implements the standard command/data/status
++ * parts of a SCSI interaction.  It and its subroutines are full of tests
++ * for pending signals/exceptions -- all this polling is necessary since
++ * the kernel has no setjmp/longjmp equivalents.  (Maybe this is an
++ * indication that the driver really wants to be running in userspace.)
++ * An important point is that so long as the thread is alive it keeps an
++ * open reference to the backing file.  This will prevent unmounting
++ * the backing file's underlying filesystem and could cause problems
++ * during system shutdown, for example.  To prevent such problems, the
++ * thread catches INT, TERM, and KILL signals and converts them into
++ * an EXIT exception.
++ *
++ * In normal operation the main thread is started during the gadget's
++ * fsg_bind() callback and stopped during fsg_unbind().  But it can also
++ * exit when it receives a signal, and there's no point leaving the
++ * gadget running when the thread is dead.  So just before the thread
++ * exits, it deregisters the gadget driver.  This makes things a little
++ * tricky: The driver is deregistered at two places, and the exiting
++ * thread can indirectly call fsg_unbind() which in turn can tell the
++ * thread to exit.  The first problem is resolved through the use of the
++ * REGISTERED atomic bitflag; the driver will only be deregistered once.
++ * The second problem is resolved by having fsg_unbind() check
++ * fsg->state; it won't try to stop the thread if the state is already
++ * FSG_STATE_TERMINATED.
++ *
++ * To provide maximum throughput, the driver uses a circular pipeline of
++ * buffer heads (struct fsg_buffhd).  In principle the pipeline can be
++ * arbitrarily long; in practice the benefits don't justify having more
++ * than 2 stages (i.e., double buffering).  But it helps to think of the
++ * pipeline as being a long one.  Each buffer head contains a bulk-in and
++ * a bulk-out request pointer (since the buffer can be used for both
++ * output and input -- directions always are given from the host's
++ * point of view) as well as a pointer to the buffer and various state
++ * variables.
++ *
++ * Use of the pipeline follows a simple protocol.  There is a variable
++ * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
++ * At any time that buffer head may still be in use from an earlier
++ * request, so each buffer head has a state variable indicating whether
++ * it is EMPTY, FULL, or BUSY.  Typical use involves waiting for the
++ * buffer head to be EMPTY, filling the buffer either by file I/O or by
++ * USB I/O (during which the buffer head is BUSY), and marking the buffer
++ * head FULL when the I/O is complete.  Then the buffer will be emptied
++ * (again possibly by USB I/O, during which it is marked BUSY) and
++ * finally marked EMPTY again (possibly by a completion routine).
++ *
++ * A module parameter tells the driver to avoid stalling the bulk
++ * endpoints wherever the transport specification allows.  This is
++ * necessary for some UDCs like the SuperH, which cannot reliably clear a
++ * halt on a bulk endpoint.  However, under certain circumstances the
++ * Bulk-only specification requires a stall.  In such cases the driver
++ * will halt the endpoint and set a flag indicating that it should clear
++ * the halt in software during the next device reset.  Hopefully this
++ * will permit everything to work correctly.  Furthermore, although the
++ * specification allows the bulk-out endpoint to halt when the host sends
++ * too much data, implementing this would cause an unavoidable race.
++ * The driver will always use the "no-stall" approach for OUT transfers.
++ *
++ * One subtle point concerns sending status-stage responses for ep0
++ * requests.  Some of these requests, such as device reset, can involve
++ * interrupting an ongoing file I/O operation, which might take an
++ * arbitrarily long time.  During that delay the host might give up on
++ * the original ep0 request and issue a new one.  When that happens the
++ * driver should not notify the host about completion of the original
++ * request, as the host will no longer be waiting for it.  So the driver
++ * assigns to each ep0 request a unique tag, and it keeps track of the
++ * tag value of the request associated with a long-running exception
++ * (device-reset, interface-change, or configuration-change).  When the
++ * exception handler is finished, the status-stage response is submitted
++ * only if the current ep0 request tag is equal to the exception request
++ * tag.  Thus only the most recently received ep0 request will get a
++ * status-stage response.
++ *
++ * Warning: This driver source file is too long.  It ought to be split up
++ * into a header file plus about 3 separate .c files, to handle the details
++ * of the Gadget, USB Mass Storage, and SCSI protocols.
++ */
++
++
++/* #define VERBOSE_DEBUG */
++/* #define DUMP_MSGS */
++
++
++#include <linux/blkdev.h>
++#include <linux/completion.h>
++#include <linux/dcache.h>
++#include <linux/delay.h>
++#include <linux/device.h>
++#include <linux/fcntl.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/kref.h>
++#include <linux/kthread.h>
++#include <linux/limits.h>
++#include <linux/module.h>
++#include <linux/rwsem.h>
++#include <linux/slab.h>
++#include <linux/spinlock.h>
++#include <linux/string.h>
++#include <linux/freezer.h>
++#include <linux/utsname.h>
++
++#include <linux/usb/ch9.h>
++#include <linux/usb/gadget.h>
++
++#include "gadget_chips.h"
++
++
++
++/*
++ * Kbuild is not very cooperative with respect to linking separately
++ * compiled library objects into one module.  So for now we won't use
++ * separate compilation ... ensuring init/exit sections work to shrink
++ * the runtime footprint, and giving us at least some parts of what
++ * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
++ */
++#include "usbstring.c"
++#include "config.c"
++#include "epautoconf.c"
++
++/*-------------------------------------------------------------------------*/
++
++#define DRIVER_DESC		"File-backed Storage Gadget"
++#define DRIVER_NAME		"g_file_storage"
++#define DRIVER_VERSION		"1 September 2010"
++
++static       char fsg_string_manufacturer[64];
++static const char fsg_string_product[] = DRIVER_DESC;
++static const char fsg_string_config[] = "Self-powered";
++static const char fsg_string_interface[] = "Mass Storage";
++
++
++#include "storage_common.c"
++
++
++MODULE_DESCRIPTION(DRIVER_DESC);
++MODULE_AUTHOR("Alan Stern");
++MODULE_LICENSE("Dual BSD/GPL");
++
++/*
++ * This driver assumes self-powered hardware and has no way for users to
++ * trigger remote wakeup.  It uses autoconfiguration to select endpoints
++ * and endpoint addresses.
++ */
++
++
++/*-------------------------------------------------------------------------*/
++
++
++/* Encapsulate the module parameter settings */
++
++static struct {
++	char		*file[FSG_MAX_LUNS];
++	char		*serial;
++	bool		ro[FSG_MAX_LUNS];
++	bool		nofua[FSG_MAX_LUNS];
++	unsigned int	num_filenames;
++	unsigned int	num_ros;
++	unsigned int	num_nofuas;
++	unsigned int	nluns;
++
++	bool		removable;
++	bool		can_stall;
++	bool		cdrom;
++
++	char		*transport_parm;
++	char		*protocol_parm;
++	unsigned short	vendor;
++	unsigned short	product;
++	unsigned short	release;
++	unsigned int	buflen;
++
++	int		transport_type;
++	char		*transport_name;
++	int		protocol_type;
++	char		*protocol_name;
++
++} mod_data = {					// Default values
++	.transport_parm		= "BBB",
++	.protocol_parm		= "SCSI",
++	.removable		= 0,
++	.can_stall		= 1,
++	.cdrom			= 0,
++	.vendor			= FSG_VENDOR_ID,
++	.product		= FSG_PRODUCT_ID,
++	.release		= 0xffff,	// Use controller chip type
++	.buflen			= 16384,
++	};
++
++
++module_param_array_named(file, mod_data.file, charp, &mod_data.num_filenames,
++		S_IRUGO);
++MODULE_PARM_DESC(file, "names of backing files or devices");
++
++module_param_named(serial, mod_data.serial, charp, S_IRUGO);
++MODULE_PARM_DESC(serial, "USB serial number");
++
++module_param_array_named(ro, mod_data.ro, bool, &mod_data.num_ros, S_IRUGO);
++MODULE_PARM_DESC(ro, "true to force read-only");
++
++module_param_array_named(nofua, mod_data.nofua, bool, &mod_data.num_nofuas,
++		S_IRUGO);
++MODULE_PARM_DESC(nofua, "true to ignore SCSI WRITE(10,12) FUA bit");
++
++module_param_named(luns, mod_data.nluns, uint, S_IRUGO);
++MODULE_PARM_DESC(luns, "number of LUNs");
++
++module_param_named(removable, mod_data.removable, bool, S_IRUGO);
++MODULE_PARM_DESC(removable, "true to simulate removable media");
++
++module_param_named(stall, mod_data.can_stall, bool, S_IRUGO);
++MODULE_PARM_DESC(stall, "false to prevent bulk stalls");
++
++module_param_named(cdrom, mod_data.cdrom, bool, S_IRUGO);
++MODULE_PARM_DESC(cdrom, "true to emulate cdrom instead of disk");
++
++/* In the non-TEST version, only the module parameters listed above
++ * are available. */
++#ifdef CONFIG_USB_FILE_STORAGE_TEST
++
++module_param_named(transport, mod_data.transport_parm, charp, S_IRUGO);
++MODULE_PARM_DESC(transport, "type of transport (BBB, CBI, or CB)");
++
++module_param_named(protocol, mod_data.protocol_parm, charp, S_IRUGO);
++MODULE_PARM_DESC(protocol, "type of protocol (RBC, 8020, QIC, UFI, "
++		"8070, or SCSI)");
++
++module_param_named(vendor, mod_data.vendor, ushort, S_IRUGO);
++MODULE_PARM_DESC(vendor, "USB Vendor ID");
++
++module_param_named(product, mod_data.product, ushort, S_IRUGO);
++MODULE_PARM_DESC(product, "USB Product ID");
++
++module_param_named(release, mod_data.release, ushort, S_IRUGO);
++MODULE_PARM_DESC(release, "USB release number");
++
++module_param_named(buflen, mod_data.buflen, uint, S_IRUGO);
++MODULE_PARM_DESC(buflen, "I/O buffer size");
++
++#endif /* CONFIG_USB_FILE_STORAGE_TEST */
++
++
++/*
++ * These definitions will permit the compiler to avoid generating code for
++ * parts of the driver that aren't used in the non-TEST version.  Even gcc
++ * can recognize when a test of a constant expression yields a dead code
++ * path.
++ */
++
++#ifdef CONFIG_USB_FILE_STORAGE_TEST
++
++#define transport_is_bbb()	(mod_data.transport_type == USB_PR_BULK)
++#define transport_is_cbi()	(mod_data.transport_type == USB_PR_CBI)
++#define protocol_is_scsi()	(mod_data.protocol_type == USB_SC_SCSI)
++
++#else
++
++#define transport_is_bbb()	1
++#define transport_is_cbi()	0
++#define protocol_is_scsi()	1
++
++#endif /* CONFIG_USB_FILE_STORAGE_TEST */
++
++
++/*-------------------------------------------------------------------------*/
++
++
++struct fsg_dev {
++	/* lock protects: state, all the req_busy's, and cbbuf_cmnd */
++	spinlock_t		lock;
++	struct usb_gadget	*gadget;
++
++	/* filesem protects: backing files in use */
++	struct rw_semaphore	filesem;
++
++	/* reference counting: wait until all LUNs are released */
++	struct kref		ref;
++
++	struct usb_ep		*ep0;		// Handy copy of gadget->ep0
++	struct usb_request	*ep0req;	// For control responses
++	unsigned int		ep0_req_tag;
++	const char		*ep0req_name;
++
++	struct usb_request	*intreq;	// For interrupt responses
++	int			intreq_busy;
++	struct fsg_buffhd	*intr_buffhd;
++
++	unsigned int		bulk_out_maxpacket;
++	enum fsg_state		state;		// For exception handling
++	unsigned int		exception_req_tag;
++
++	u8			config, new_config;
++
++	unsigned int		running : 1;
++	unsigned int		bulk_in_enabled : 1;
++	unsigned int		bulk_out_enabled : 1;
++	unsigned int		intr_in_enabled : 1;
++	unsigned int		phase_error : 1;
++	unsigned int		short_packet_received : 1;
++	unsigned int		bad_lun_okay : 1;
++
++	unsigned long		atomic_bitflags;
++#define REGISTERED		0
++#define IGNORE_BULK_OUT		1
++#define SUSPENDED		2
++
++	struct usb_ep		*bulk_in;
++	struct usb_ep		*bulk_out;
++	struct usb_ep		*intr_in;
++
++	struct fsg_buffhd	*next_buffhd_to_fill;
++	struct fsg_buffhd	*next_buffhd_to_drain;
++
++	int			thread_wakeup_needed;
++	struct completion	thread_notifier;
++	struct task_struct	*thread_task;
++
++	int			cmnd_size;
++	u8			cmnd[MAX_COMMAND_SIZE];
++	enum data_direction	data_dir;
++	u32			data_size;
++	u32			data_size_from_cmnd;
++	u32			tag;
++	unsigned int		lun;
++	u32			residue;
++	u32			usb_amount_left;
++
++	/* The CB protocol offers no way for a host to know when a command
++	 * has completed.  As a result the next command may arrive early,
++	 * and we will still have to handle it.  For that reason we need
++	 * a buffer to store new commands when using CB (or CBI, which
++	 * does not oblige a host to wait for command completion either). */
++	int			cbbuf_cmnd_size;
++	u8			cbbuf_cmnd[MAX_COMMAND_SIZE];
++
++	unsigned int		nluns;
++	struct fsg_lun		*luns;
++	struct fsg_lun		*curlun;
++	/* Must be the last entry */
++	struct fsg_buffhd	buffhds[];
++};
++
++typedef void (*fsg_routine_t)(struct fsg_dev *);
++
++static int exception_in_progress(struct fsg_dev *fsg)
++{
++	return (fsg->state > FSG_STATE_IDLE);
++}
++
++/* Make bulk-out requests be divisible by the maxpacket size */
++static void set_bulk_out_req_length(struct fsg_dev *fsg,
++		struct fsg_buffhd *bh, unsigned int length)
++{
++	unsigned int	rem;
++
++	bh->bulk_out_intended_length = length;
++	rem = length % fsg->bulk_out_maxpacket;
++	if (rem > 0)
++		length += fsg->bulk_out_maxpacket - rem;
++	bh->outreq->length = length;
++}
++
++static struct fsg_dev			*the_fsg;
++static struct usb_gadget_driver		fsg_driver;
++
++
++/*-------------------------------------------------------------------------*/
++
++static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
++{
++	const char	*name;
++
++	if (ep == fsg->bulk_in)
++		name = "bulk-in";
++	else if (ep == fsg->bulk_out)
++		name = "bulk-out";
++	else
++		name = ep->name;
++	DBG(fsg, "%s set halt\n", name);
++	return usb_ep_set_halt(ep);
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++/*
++ * DESCRIPTORS ... most are static, but strings and (full) configuration
++ * descriptors are built on demand.  Also the (static) config and interface
++ * descriptors are adjusted during fsg_bind().
++ */
++
++/* There is only one configuration. */
++#define	CONFIG_VALUE		1
++
++static struct usb_device_descriptor
++device_desc = {
++	.bLength =		sizeof device_desc,
++	.bDescriptorType =	USB_DT_DEVICE,
++
++	.bcdUSB =		cpu_to_le16(0x0200),
++	.bDeviceClass =		USB_CLASS_PER_INTERFACE,
++
++	/* The next three values can be overridden by module parameters */
++	.idVendor =		cpu_to_le16(FSG_VENDOR_ID),
++	.idProduct =		cpu_to_le16(FSG_PRODUCT_ID),
++	.bcdDevice =		cpu_to_le16(0xffff),
++
++	.iManufacturer =	FSG_STRING_MANUFACTURER,
++	.iProduct =		FSG_STRING_PRODUCT,
++	.iSerialNumber =	FSG_STRING_SERIAL,
++	.bNumConfigurations =	1,
++};
++
++static struct usb_config_descriptor
++config_desc = {
++	.bLength =		sizeof config_desc,
++	.bDescriptorType =	USB_DT_CONFIG,
++
++	/* wTotalLength computed by usb_gadget_config_buf() */
++	.bNumInterfaces =	1,
++	.bConfigurationValue =	CONFIG_VALUE,
++	.iConfiguration =	FSG_STRING_CONFIG,
++	.bmAttributes =		USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
++	.bMaxPower =		CONFIG_USB_GADGET_VBUS_DRAW / 2,
++};
++
++
++static struct usb_qualifier_descriptor
++dev_qualifier = {
++	.bLength =		sizeof dev_qualifier,
++	.bDescriptorType =	USB_DT_DEVICE_QUALIFIER,
++
++	.bcdUSB =		cpu_to_le16(0x0200),
++	.bDeviceClass =		USB_CLASS_PER_INTERFACE,
++
++	.bNumConfigurations =	1,
++};
++
++static int populate_bos(struct fsg_dev *fsg, u8 *buf)
++{
++	memcpy(buf, &fsg_bos_desc, USB_DT_BOS_SIZE);
++	buf += USB_DT_BOS_SIZE;
++
++	memcpy(buf, &fsg_ext_cap_desc, USB_DT_USB_EXT_CAP_SIZE);
++	buf += USB_DT_USB_EXT_CAP_SIZE;
++
++	memcpy(buf, &fsg_ss_cap_desc, USB_DT_USB_SS_CAP_SIZE);
++
++	return USB_DT_BOS_SIZE + USB_DT_USB_SS_CAP_SIZE
++		+ USB_DT_USB_EXT_CAP_SIZE;
++}
++
++/*
++ * Config descriptors must agree with the code that sets configurations
++ * and with code managing interfaces and their altsettings.  They must
++ * also handle different speeds and other-speed requests.
++ */
++static int populate_config_buf(struct usb_gadget *gadget,
++		u8 *buf, u8 type, unsigned index)
++{
++	enum usb_device_speed			speed = gadget->speed;
++	int					len;
++	const struct usb_descriptor_header	**function;
++
++	if (index > 0)
++		return -EINVAL;
++
++	if (gadget_is_dualspeed(gadget) && type == USB_DT_OTHER_SPEED_CONFIG)
++		speed = (USB_SPEED_FULL + USB_SPEED_HIGH) - speed;
++	function = gadget_is_dualspeed(gadget) && speed == USB_SPEED_HIGH
++		? (const struct usb_descriptor_header **)fsg_hs_function
++		: (const struct usb_descriptor_header **)fsg_fs_function;
++
++	/* for now, don't advertise srp-only devices */
++	if (!gadget_is_otg(gadget))
++		function++;
++
++	len = usb_gadget_config_buf(&config_desc, buf, EP0_BUFSIZE, function);
++	((struct usb_config_descriptor *) buf)->bDescriptorType = type;
++	return len;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++/* These routines may be called in process context or in_irq */
++
++/* Caller must hold fsg->lock */
++static void wakeup_thread(struct fsg_dev *fsg)
++{
++	/* Tell the main thread that something has happened */
++	fsg->thread_wakeup_needed = 1;
++	if (fsg->thread_task)
++		wake_up_process(fsg->thread_task);
++}
++
++
++static void raise_exception(struct fsg_dev *fsg, enum fsg_state new_state)
++{
++	unsigned long		flags;
++
++	/* Do nothing if a higher-priority exception is already in progress.
++	 * If a lower-or-equal priority exception is in progress, preempt it
++	 * and notify the main thread by sending it a signal. */
++	spin_lock_irqsave(&fsg->lock, flags);
++	if (fsg->state <= new_state) {
++		fsg->exception_req_tag = fsg->ep0_req_tag;
++		fsg->state = new_state;
++		if (fsg->thread_task)
++			send_sig_info(SIGUSR1, SEND_SIG_FORCED,
++					fsg->thread_task);
++	}
++	spin_unlock_irqrestore(&fsg->lock, flags);
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++/* The disconnect callback and ep0 routines.  These always run in_irq,
++ * except that ep0_queue() is called in the main thread to acknowledge
++ * completion of various requests: set config, set interface, and
++ * Bulk-only device reset. */
++
++static void fsg_disconnect(struct usb_gadget *gadget)
++{
++	struct fsg_dev		*fsg = get_gadget_data(gadget);
++
++	DBG(fsg, "disconnect or port reset\n");
++	raise_exception(fsg, FSG_STATE_DISCONNECT);
++}
++
++
++static int ep0_queue(struct fsg_dev *fsg)
++{
++	int	rc;
++
++	rc = usb_ep_queue(fsg->ep0, fsg->ep0req, GFP_ATOMIC);
++	if (rc != 0 && rc != -ESHUTDOWN) {
++
++		/* We can't do much more than wait for a reset */
++		WARNING(fsg, "error in submission: %s --> %d\n",
++				fsg->ep0->name, rc);
++	}
++	return rc;
++}
++
++static void ep0_complete(struct usb_ep *ep, struct usb_request *req)
++{
++	struct fsg_dev		*fsg = ep->driver_data;
++
++	if (req->actual > 0)
++		dump_msg(fsg, fsg->ep0req_name, req->buf, req->actual);
++	if (req->status || req->actual != req->length)
++		DBG(fsg, "%s --> %d, %u/%u\n", __func__,
++				req->status, req->actual, req->length);
++	if (req->status == -ECONNRESET)		// Request was cancelled
++		usb_ep_fifo_flush(ep);
++
++	if (req->status == 0 && req->context)
++		((fsg_routine_t) (req->context))(fsg);
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++/* Bulk and interrupt endpoint completion handlers.
++ * These always run in_irq. */
++
++static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
++{
++	struct fsg_dev		*fsg = ep->driver_data;
++	struct fsg_buffhd	*bh = req->context;
++
++	if (req->status || req->actual != req->length)
++		DBG(fsg, "%s --> %d, %u/%u\n", __func__,
++				req->status, req->actual, req->length);
++	if (req->status == -ECONNRESET)		// Request was cancelled
++		usb_ep_fifo_flush(ep);
++
++	/* Hold the lock while we update the request and buffer states */
++	smp_wmb();
++	spin_lock(&fsg->lock);
++	bh->inreq_busy = 0;
++	bh->state = BUF_STATE_EMPTY;
++	wakeup_thread(fsg);
++	spin_unlock(&fsg->lock);
++}
++
++static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
++{
++	struct fsg_dev		*fsg = ep->driver_data;
++	struct fsg_buffhd	*bh = req->context;
++
++	dump_msg(fsg, "bulk-out", req->buf, req->actual);
++	if (req->status || req->actual != bh->bulk_out_intended_length)
++		DBG(fsg, "%s --> %d, %u/%u\n", __func__,
++				req->status, req->actual,
++				bh->bulk_out_intended_length);
++	if (req->status == -ECONNRESET)		// Request was cancelled
++		usb_ep_fifo_flush(ep);
++
++	/* Hold the lock while we update the request and buffer states */
++	smp_wmb();
++	spin_lock(&fsg->lock);
++	bh->outreq_busy = 0;
++	bh->state = BUF_STATE_FULL;
++	wakeup_thread(fsg);
++	spin_unlock(&fsg->lock);
++}
++
++
++#ifdef CONFIG_USB_FILE_STORAGE_TEST
++static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
++{
++	struct fsg_dev		*fsg = ep->driver_data;
++	struct fsg_buffhd	*bh = req->context;
++
++	if (req->status || req->actual != req->length)
++		DBG(fsg, "%s --> %d, %u/%u\n", __func__,
++				req->status, req->actual, req->length);
++	if (req->status == -ECONNRESET)		// Request was cancelled
++		usb_ep_fifo_flush(ep);
++
++	/* Hold the lock while we update the request and buffer states */
++	smp_wmb();
++	spin_lock(&fsg->lock);
++	fsg->intreq_busy = 0;
++	bh->state = BUF_STATE_EMPTY;
++	wakeup_thread(fsg);
++	spin_unlock(&fsg->lock);
++}
++
++#else
++static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
++{}
++#endif /* CONFIG_USB_FILE_STORAGE_TEST */
++
++
++/*-------------------------------------------------------------------------*/
++
++/* Ep0 class-specific handlers.  These always run in_irq. */
++
++#ifdef CONFIG_USB_FILE_STORAGE_TEST
++static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	struct usb_request	*req = fsg->ep0req;
++	static u8		cbi_reset_cmnd[6] = {
++			SEND_DIAGNOSTIC, 4, 0xff, 0xff, 0xff, 0xff};
++
++	/* Error in command transfer? */
++	if (req->status || req->length != req->actual ||
++			req->actual < 6 || req->actual > MAX_COMMAND_SIZE) {
++
++		/* Not all controllers allow a protocol stall after
++		 * receiving control-out data, but we'll try anyway. */
++		fsg_set_halt(fsg, fsg->ep0);
++		return;			// Wait for reset
++	}
++
++	/* Is it the special reset command? */
++	if (req->actual >= sizeof cbi_reset_cmnd &&
++			memcmp(req->buf, cbi_reset_cmnd,
++				sizeof cbi_reset_cmnd) == 0) {
++
++		/* Raise an exception to stop the current operation
++		 * and reinitialize our state. */
++		DBG(fsg, "cbi reset request\n");
++		raise_exception(fsg, FSG_STATE_RESET);
++		return;
++	}
++
++	VDBG(fsg, "CB[I] accept device-specific command\n");
++	spin_lock(&fsg->lock);
++
++	/* Save the command for later */
++	if (fsg->cbbuf_cmnd_size)
++		WARNING(fsg, "CB[I] overwriting previous command\n");
++	fsg->cbbuf_cmnd_size = req->actual;
++	memcpy(fsg->cbbuf_cmnd, req->buf, fsg->cbbuf_cmnd_size);
++
++	wakeup_thread(fsg);
++	spin_unlock(&fsg->lock);
++}
++
++#else
++static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{}
++#endif /* CONFIG_USB_FILE_STORAGE_TEST */
++
++
++static int class_setup_req(struct fsg_dev *fsg,
++		const struct usb_ctrlrequest *ctrl)
++{
++	struct usb_request	*req = fsg->ep0req;
++	int			value = -EOPNOTSUPP;
++	u16			w_index = le16_to_cpu(ctrl->wIndex);
++	u16                     w_value = le16_to_cpu(ctrl->wValue);
++	u16			w_length = le16_to_cpu(ctrl->wLength);
++
++	if (!fsg->config)
++		return value;
++
++	/* Handle Bulk-only class-specific requests */
++	if (transport_is_bbb()) {
++		switch (ctrl->bRequest) {
++
++		case US_BULK_RESET_REQUEST:
++			if (ctrl->bRequestType != (USB_DIR_OUT |
++					USB_TYPE_CLASS | USB_RECIP_INTERFACE))
++				break;
++			if (w_index != 0 || w_value != 0 || w_length != 0) {
++				value = -EDOM;
++				break;
++			}
++
++			/* Raise an exception to stop the current operation
++			 * and reinitialize our state. */
++			DBG(fsg, "bulk reset request\n");
++			raise_exception(fsg, FSG_STATE_RESET);
++			value = DELAYED_STATUS;
++			break;
++
++		case US_BULK_GET_MAX_LUN:
++			if (ctrl->bRequestType != (USB_DIR_IN |
++					USB_TYPE_CLASS | USB_RECIP_INTERFACE))
++				break;
++			if (w_index != 0 || w_value != 0 || w_length != 1) {
++				value = -EDOM;
++				break;
++			}
++			VDBG(fsg, "get max LUN\n");
++			*(u8 *) req->buf = fsg->nluns - 1;
++			value = 1;
++			break;
++		}
++	}
++
++	/* Handle CBI class-specific requests */
++	else {
++		switch (ctrl->bRequest) {
++
++		case USB_CBI_ADSC_REQUEST:
++			if (ctrl->bRequestType != (USB_DIR_OUT |
++					USB_TYPE_CLASS | USB_RECIP_INTERFACE))
++				break;
++			if (w_index != 0 || w_value != 0) {
++				value = -EDOM;
++				break;
++			}
++			if (w_length > MAX_COMMAND_SIZE) {
++				value = -EOVERFLOW;
++				break;
++			}
++			value = w_length;
++			fsg->ep0req->context = received_cbi_adsc;
++			break;
++		}
++	}
++
++	if (value == -EOPNOTSUPP)
++		VDBG(fsg,
++			"unknown class-specific control req "
++			"%02x.%02x v%04x i%04x l%u\n",
++			ctrl->bRequestType, ctrl->bRequest,
++			le16_to_cpu(ctrl->wValue), w_index, w_length);
++	return value;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++/* Ep0 standard request handlers.  These always run in_irq. */
++
++static int standard_setup_req(struct fsg_dev *fsg,
++		const struct usb_ctrlrequest *ctrl)
++{
++	struct usb_request	*req = fsg->ep0req;
++	int			value = -EOPNOTSUPP;
++	u16			w_index = le16_to_cpu(ctrl->wIndex);
++	u16			w_value = le16_to_cpu(ctrl->wValue);
++
++	/* Usually this just stores reply data in the pre-allocated ep0 buffer,
++	 * but config change events will also reconfigure hardware. */
++	switch (ctrl->bRequest) {
++
++	case USB_REQ_GET_DESCRIPTOR:
++		if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
++				USB_RECIP_DEVICE))
++			break;
++		switch (w_value >> 8) {
++
++		case USB_DT_DEVICE:
++			VDBG(fsg, "get device descriptor\n");
++			device_desc.bMaxPacketSize0 = fsg->ep0->maxpacket;
++			value = sizeof device_desc;
++			memcpy(req->buf, &device_desc, value);
++			break;
++		case USB_DT_DEVICE_QUALIFIER:
++			VDBG(fsg, "get device qualifier\n");
++			if (!gadget_is_dualspeed(fsg->gadget) ||
++					fsg->gadget->speed == USB_SPEED_SUPER)
++				break;
++			/*
++			 * Assume ep0 uses the same maxpacket value for both
++			 * speeds
++			 */
++			dev_qualifier.bMaxPacketSize0 = fsg->ep0->maxpacket;
++			value = sizeof dev_qualifier;
++			memcpy(req->buf, &dev_qualifier, value);
++			break;
++
++		case USB_DT_OTHER_SPEED_CONFIG:
++			VDBG(fsg, "get other-speed config descriptor\n");
++			if (!gadget_is_dualspeed(fsg->gadget) ||
++					fsg->gadget->speed == USB_SPEED_SUPER)
++				break;
++			goto get_config;
++		case USB_DT_CONFIG:
++			VDBG(fsg, "get configuration descriptor\n");
++get_config:
++			value = populate_config_buf(fsg->gadget,
++					req->buf,
++					w_value >> 8,
++					w_value & 0xff);
++			break;
++
++		case USB_DT_STRING:
++			VDBG(fsg, "get string descriptor\n");
++
++			/* wIndex == language code */
++			value = usb_gadget_get_string(&fsg_stringtab,
++					w_value & 0xff, req->buf);
++			break;
++
++		case USB_DT_BOS:
++			VDBG(fsg, "get bos descriptor\n");
++
++			if (gadget_is_superspeed(fsg->gadget))
++				value = populate_bos(fsg, req->buf);
++			break;
++		}
++
++		break;
++
++	/* One config, two speeds */
++	case USB_REQ_SET_CONFIGURATION:
++		if (ctrl->bRequestType != (USB_DIR_OUT | USB_TYPE_STANDARD |
++				USB_RECIP_DEVICE))
++			break;
++		VDBG(fsg, "set configuration\n");
++		if (w_value == CONFIG_VALUE || w_value == 0) {
++			fsg->new_config = w_value;
++
++			/* Raise an exception to wipe out previous transaction
++			 * state (queued bufs, etc) and set the new config. */
++			raise_exception(fsg, FSG_STATE_CONFIG_CHANGE);
++			value = DELAYED_STATUS;
++		}
++		break;
++	case USB_REQ_GET_CONFIGURATION:
++		if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
++				USB_RECIP_DEVICE))
++			break;
++		VDBG(fsg, "get configuration\n");
++		*(u8 *) req->buf = fsg->config;
++		value = 1;
++		break;
++
++	case USB_REQ_SET_INTERFACE:
++		if (ctrl->bRequestType != (USB_DIR_OUT| USB_TYPE_STANDARD |
++				USB_RECIP_INTERFACE))
++			break;
++		if (fsg->config && w_index == 0) {
++
++			/* Raise an exception to wipe out previous transaction
++			 * state (queued bufs, etc) and install the new
++			 * interface altsetting. */
++			raise_exception(fsg, FSG_STATE_INTERFACE_CHANGE);
++			value = DELAYED_STATUS;
++		}
++		break;
++	case USB_REQ_GET_INTERFACE:
++		if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
++				USB_RECIP_INTERFACE))
++			break;
++		if (!fsg->config)
++			break;
++		if (w_index != 0) {
++			value = -EDOM;
++			break;
++		}
++		VDBG(fsg, "get interface\n");
++		*(u8 *) req->buf = 0;
++		value = 1;
++		break;
++
++	default:
++		VDBG(fsg,
++			"unknown control req %02x.%02x v%04x i%04x l%u\n",
++			ctrl->bRequestType, ctrl->bRequest,
++			w_value, w_index, le16_to_cpu(ctrl->wLength));
++	}
++
++	return value;
++}
++
++
++static int fsg_setup(struct usb_gadget *gadget,
++		const struct usb_ctrlrequest *ctrl)
++{
++	struct fsg_dev		*fsg = get_gadget_data(gadget);
++	int			rc;
++	int			w_length = le16_to_cpu(ctrl->wLength);
++
++	++fsg->ep0_req_tag;		// Record arrival of a new request
++	fsg->ep0req->context = NULL;
++	fsg->ep0req->length = 0;
++	dump_msg(fsg, "ep0-setup", (u8 *) ctrl, sizeof(*ctrl));
++
++	if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS)
++		rc = class_setup_req(fsg, ctrl);
++	else
++		rc = standard_setup_req(fsg, ctrl);
++
++	/* Respond with data/status or defer until later? */
++	if (rc >= 0 && rc != DELAYED_STATUS) {
++		rc = min(rc, w_length);
++		fsg->ep0req->length = rc;
++		fsg->ep0req->zero = rc < w_length;
++		fsg->ep0req_name = (ctrl->bRequestType & USB_DIR_IN ?
++				"ep0-in" : "ep0-out");
++		rc = ep0_queue(fsg);
++	}
++
++	/* Device either stalls (rc < 0) or reports success */
++	return rc;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++/* All the following routines run in process context */
++
++
++/* Use this for bulk or interrupt transfers, not ep0 */
++static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
++		struct usb_request *req, int *pbusy,
++		enum fsg_buffer_state *state)
++{
++	int	rc;
++
++	if (ep == fsg->bulk_in)
++		dump_msg(fsg, "bulk-in", req->buf, req->length);
++	else if (ep == fsg->intr_in)
++		dump_msg(fsg, "intr-in", req->buf, req->length);
++
++	spin_lock_irq(&fsg->lock);
++	*pbusy = 1;
++	*state = BUF_STATE_BUSY;
++	spin_unlock_irq(&fsg->lock);
++	rc = usb_ep_queue(ep, req, GFP_KERNEL);
++	if (rc != 0) {
++		*pbusy = 0;
++		*state = BUF_STATE_EMPTY;
++
++		/* We can't do much more than wait for a reset */
++
++		/* Note: currently the net2280 driver fails zero-length
++		 * submissions if DMA is enabled. */
++		if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
++						req->length == 0))
++			WARNING(fsg, "error in submission: %s --> %d\n",
++					ep->name, rc);
++	}
++}
++
++
++static int sleep_thread(struct fsg_dev *fsg)
++{
++	int	rc = 0;
++
++	/* Wait until a signal arrives or we are woken up */
++	for (;;) {
++		try_to_freeze();
++		set_current_state(TASK_INTERRUPTIBLE);
++		if (signal_pending(current)) {
++			rc = -EINTR;
++			break;
++		}
++		if (fsg->thread_wakeup_needed)
++			break;
++		schedule();
++	}
++	__set_current_state(TASK_RUNNING);
++	fsg->thread_wakeup_needed = 0;
++	return rc;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int do_read(struct fsg_dev *fsg)
++{
++	struct fsg_lun		*curlun = fsg->curlun;
++	u32			lba;
++	struct fsg_buffhd	*bh;
++	int			rc;
++	u32			amount_left;
++	loff_t			file_offset, file_offset_tmp;
++	unsigned int		amount;
++	ssize_t			nread;
++
++	/* Get the starting Logical Block Address and check that it's
++	 * not too big */
++	if (fsg->cmnd[0] == READ_6)
++		lba = get_unaligned_be24(&fsg->cmnd[1]);
++	else {
++		lba = get_unaligned_be32(&fsg->cmnd[2]);
++
++		/* We allow DPO (Disable Page Out = don't save data in the
++		 * cache) and FUA (Force Unit Access = don't read from the
++		 * cache), but we don't implement them. */
++		if ((fsg->cmnd[1] & ~0x18) != 0) {
++			curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++			return -EINVAL;
++		}
++	}
++	if (lba >= curlun->num_sectors) {
++		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
++		return -EINVAL;
++	}
++	file_offset = ((loff_t) lba) << curlun->blkbits;
++
++	/* Carry out the file reads */
++	amount_left = fsg->data_size_from_cmnd;
++	if (unlikely(amount_left == 0))
++		return -EIO;		// No default reply
++
++	for (;;) {
++
++		/* Figure out how much we need to read:
++		 * Try to read the remaining amount.
++		 * But don't read more than the buffer size.
++		 * And don't try to read past the end of the file.
++		 */
++		amount = min((unsigned int) amount_left, mod_data.buflen);
++		amount = min((loff_t) amount,
++				curlun->file_length - file_offset);
++
++		/* Wait for the next buffer to become available */
++		bh = fsg->next_buffhd_to_fill;
++		while (bh->state != BUF_STATE_EMPTY) {
++			rc = sleep_thread(fsg);
++			if (rc)
++				return rc;
++		}
++
++		/* If we were asked to read past the end of file,
++		 * end with an empty buffer. */
++		if (amount == 0) {
++			curlun->sense_data =
++					SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
++			curlun->sense_data_info = file_offset >> curlun->blkbits;
++			curlun->info_valid = 1;
++			bh->inreq->length = 0;
++			bh->state = BUF_STATE_FULL;
++			break;
++		}
++
++		/* Perform the read */
++		file_offset_tmp = file_offset;
++		nread = vfs_read(curlun->filp,
++				(char __user *) bh->buf,
++				amount, &file_offset_tmp);
++		VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
++				(unsigned long long) file_offset,
++				(int) nread);
++		if (signal_pending(current))
++			return -EINTR;
++
++		if (nread < 0) {
++			LDBG(curlun, "error in file read: %d\n",
++					(int) nread);
++			nread = 0;
++		} else if (nread < amount) {
++			LDBG(curlun, "partial file read: %d/%u\n",
++					(int) nread, amount);
++			nread = round_down(nread, curlun->blksize);
++		}
++		file_offset  += nread;
++		amount_left  -= nread;
++		fsg->residue -= nread;
++
++		/* Except at the end of the transfer, nread will be
++		 * equal to the buffer size, which is divisible by the
++		 * bulk-in maxpacket size.
++		 */
++		bh->inreq->length = nread;
++		bh->state = BUF_STATE_FULL;
++
++		/* If an error occurred, report it and its position */
++		if (nread < amount) {
++			curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
++			curlun->sense_data_info = file_offset >> curlun->blkbits;
++			curlun->info_valid = 1;
++			break;
++		}
++
++		if (amount_left == 0)
++			break;		// No more left to read
++
++		/* Send this buffer and go read some more */
++		bh->inreq->zero = 0;
++		start_transfer(fsg, fsg->bulk_in, bh->inreq,
++				&bh->inreq_busy, &bh->state);
++		fsg->next_buffhd_to_fill = bh->next;
++	}
++
++	return -EIO;		// No default reply
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int do_write(struct fsg_dev *fsg)
++{
++	struct fsg_lun		*curlun = fsg->curlun;
++	u32			lba;
++	struct fsg_buffhd	*bh;
++	int			get_some_more;
++	u32			amount_left_to_req, amount_left_to_write;
++	loff_t			usb_offset, file_offset, file_offset_tmp;
++	unsigned int		amount;
++	ssize_t			nwritten;
++	int			rc;
++
++	if (curlun->ro) {
++		curlun->sense_data = SS_WRITE_PROTECTED;
++		return -EINVAL;
++	}
++	spin_lock(&curlun->filp->f_lock);
++	curlun->filp->f_flags &= ~O_SYNC;	// Default is not to wait
++	spin_unlock(&curlun->filp->f_lock);
++
++	/* Get the starting Logical Block Address and check that it's
++	 * not too big */
++	if (fsg->cmnd[0] == WRITE_6)
++		lba = get_unaligned_be24(&fsg->cmnd[1]);
++	else {
++		lba = get_unaligned_be32(&fsg->cmnd[2]);
++
++		/* We allow DPO (Disable Page Out = don't save data in the
++		 * cache) and FUA (Force Unit Access = write directly to the
++		 * medium).  We don't implement DPO; we implement FUA by
++		 * performing synchronous output. */
++		if ((fsg->cmnd[1] & ~0x18) != 0) {
++			curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++			return -EINVAL;
++		}
++		/* FUA */
++		if (!curlun->nofua && (fsg->cmnd[1] & 0x08)) {
++			spin_lock(&curlun->filp->f_lock);
++			curlun->filp->f_flags |= O_DSYNC;
++			spin_unlock(&curlun->filp->f_lock);
++		}
++	}
++	if (lba >= curlun->num_sectors) {
++		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
++		return -EINVAL;
++	}
++
++	/* Carry out the file writes */
++	get_some_more = 1;
++	file_offset = usb_offset = ((loff_t) lba) << curlun->blkbits;
++	amount_left_to_req = amount_left_to_write = fsg->data_size_from_cmnd;
++
++	while (amount_left_to_write > 0) {
++
++		/* Queue a request for more data from the host */
++		bh = fsg->next_buffhd_to_fill;
++		if (bh->state == BUF_STATE_EMPTY && get_some_more) {
++
++			/* Figure out how much we want to get:
++			 * Try to get the remaining amount,
++			 * but not more than the buffer size.
++			 */
++			amount = min(amount_left_to_req, mod_data.buflen);
++
++			/* Beyond the end of the backing file? */
++			if (usb_offset >= curlun->file_length) {
++				get_some_more = 0;
++				curlun->sense_data =
++					SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
++				curlun->sense_data_info = usb_offset >> curlun->blkbits;
++				curlun->info_valid = 1;
++				continue;
++			}
++
++			/* Get the next buffer */
++			usb_offset += amount;
++			fsg->usb_amount_left -= amount;
++			amount_left_to_req -= amount;
++			if (amount_left_to_req == 0)
++				get_some_more = 0;
++
++			/* Except at the end of the transfer, amount will be
++			 * equal to the buffer size, which is divisible by
++			 * the bulk-out maxpacket size.
++			 */
++			set_bulk_out_req_length(fsg, bh, amount);
++			start_transfer(fsg, fsg->bulk_out, bh->outreq,
++					&bh->outreq_busy, &bh->state);
++			fsg->next_buffhd_to_fill = bh->next;
++			continue;
++		}
++
++		/* Write the received data to the backing file */
++		bh = fsg->next_buffhd_to_drain;
++		if (bh->state == BUF_STATE_EMPTY && !get_some_more)
++			break;			// We stopped early
++		if (bh->state == BUF_STATE_FULL) {
++			smp_rmb();
++			fsg->next_buffhd_to_drain = bh->next;
++			bh->state = BUF_STATE_EMPTY;
++
++			/* Did something go wrong with the transfer? */
++			if (bh->outreq->status != 0) {
++				curlun->sense_data = SS_COMMUNICATION_FAILURE;
++				curlun->sense_data_info = file_offset >> curlun->blkbits;
++				curlun->info_valid = 1;
++				break;
++			}
++
++			amount = bh->outreq->actual;
++			if (curlun->file_length - file_offset < amount) {
++				LERROR(curlun,
++	"write %u @ %llu beyond end %llu\n",
++	amount, (unsigned long long) file_offset,
++	(unsigned long long) curlun->file_length);
++				amount = curlun->file_length - file_offset;
++			}
++
++			/* Don't accept excess data.  The spec doesn't say
++			 * what to do in this case.  We'll ignore the error.
++			 */
++			amount = min(amount, bh->bulk_out_intended_length);
++
++			/* Don't write a partial block */
++			amount = round_down(amount, curlun->blksize);
++			if (amount == 0)
++				goto empty_write;
++
++			/* Perform the write */
++			file_offset_tmp = file_offset;
++			nwritten = vfs_write(curlun->filp,
++					(char __user *) bh->buf,
++					amount, &file_offset_tmp);
++			VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
++					(unsigned long long) file_offset,
++					(int) nwritten);
++			if (signal_pending(current))
++				return -EINTR;		// Interrupted!
++
++			if (nwritten < 0) {
++				LDBG(curlun, "error in file write: %d\n",
++						(int) nwritten);
++				nwritten = 0;
++			} else if (nwritten < amount) {
++				LDBG(curlun, "partial file write: %d/%u\n",
++						(int) nwritten, amount);
++				nwritten = round_down(nwritten, curlun->blksize);
++			}
++			file_offset += nwritten;
++			amount_left_to_write -= nwritten;
++			fsg->residue -= nwritten;
++
++			/* If an error occurred, report it and its position */
++			if (nwritten < amount) {
++				curlun->sense_data = SS_WRITE_ERROR;
++				curlun->sense_data_info = file_offset >> curlun->blkbits;
++				curlun->info_valid = 1;
++				break;
++			}
++
++ empty_write:
++			/* Did the host decide to stop early? */
++			if (bh->outreq->actual < bh->bulk_out_intended_length) {
++				fsg->short_packet_received = 1;
++				break;
++			}
++			continue;
++		}
++
++		/* Wait for something to happen */
++		rc = sleep_thread(fsg);
++		if (rc)
++			return rc;
++	}
++
++	return -EIO;		// No default reply
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int do_synchronize_cache(struct fsg_dev *fsg)
++{
++	struct fsg_lun	*curlun = fsg->curlun;
++	int		rc;
++
++	/* We ignore the requested LBA and write out all file's
++	 * dirty data buffers. */
++	rc = fsg_lun_fsync_sub(curlun);
++	if (rc)
++		curlun->sense_data = SS_WRITE_ERROR;
++	return 0;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static void invalidate_sub(struct fsg_lun *curlun)
++{
++	struct file	*filp = curlun->filp;
++	struct inode	*inode = filp->f_path.dentry->d_inode;
++	unsigned long	rc;
++
++	rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
++	VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc);
++}
++
++static int do_verify(struct fsg_dev *fsg)
++{
++	struct fsg_lun		*curlun = fsg->curlun;
++	u32			lba;
++	u32			verification_length;
++	struct fsg_buffhd	*bh = fsg->next_buffhd_to_fill;
++	loff_t			file_offset, file_offset_tmp;
++	u32			amount_left;
++	unsigned int		amount;
++	ssize_t			nread;
++
++	/* Get the starting Logical Block Address and check that it's
++	 * not too big */
++	lba = get_unaligned_be32(&fsg->cmnd[2]);
++	if (lba >= curlun->num_sectors) {
++		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
++		return -EINVAL;
++	}
++
++	/* We allow DPO (Disable Page Out = don't save data in the
++	 * cache) but we don't implement it. */
++	if ((fsg->cmnd[1] & ~0x10) != 0) {
++		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++		return -EINVAL;
++	}
++
++	verification_length = get_unaligned_be16(&fsg->cmnd[7]);
++	if (unlikely(verification_length == 0))
++		return -EIO;		// No default reply
++
++	/* Prepare to carry out the file verify */
++	amount_left = verification_length << curlun->blkbits;
++	file_offset = ((loff_t) lba) << curlun->blkbits;
++
++	/* Write out all the dirty buffers before invalidating them */
++	fsg_lun_fsync_sub(curlun);
++	if (signal_pending(current))
++		return -EINTR;
++
++	invalidate_sub(curlun);
++	if (signal_pending(current))
++		return -EINTR;
++
++	/* Just try to read the requested blocks */
++	while (amount_left > 0) {
++
++		/* Figure out how much we need to read:
++		 * Try to read the remaining amount, but not more than
++		 * the buffer size.
++		 * And don't try to read past the end of the file.
++		 */
++		amount = min((unsigned int) amount_left, mod_data.buflen);
++		amount = min((loff_t) amount,
++				curlun->file_length - file_offset);
++		if (amount == 0) {
++			curlun->sense_data =
++					SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
++			curlun->sense_data_info = file_offset >> curlun->blkbits;
++			curlun->info_valid = 1;
++			break;
++		}
++
++		/* Perform the read */
++		file_offset_tmp = file_offset;
++		nread = vfs_read(curlun->filp,
++				(char __user *) bh->buf,
++				amount, &file_offset_tmp);
++		VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
++				(unsigned long long) file_offset,
++				(int) nread);
++		if (signal_pending(current))
++			return -EINTR;
++
++		if (nread < 0) {
++			LDBG(curlun, "error in file verify: %d\n",
++					(int) nread);
++			nread = 0;
++		} else if (nread < amount) {
++			LDBG(curlun, "partial file verify: %d/%u\n",
++					(int) nread, amount);
++			nread = round_down(nread, curlun->blksize);
++		}
++		if (nread == 0) {
++			curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
++			curlun->sense_data_info = file_offset >> curlun->blkbits;
++			curlun->info_valid = 1;
++			break;
++		}
++		file_offset += nread;
++		amount_left -= nread;
++	}
++	return 0;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int do_inquiry(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	u8	*buf = (u8 *) bh->buf;
++
++	static char vendor_id[] = "Linux   ";
++	static char product_disk_id[] = "File-Stor Gadget";
++	static char product_cdrom_id[] = "File-CD Gadget  ";
++
++	if (!fsg->curlun) {		// Unsupported LUNs are okay
++		fsg->bad_lun_okay = 1;
++		memset(buf, 0, 36);
++		buf[0] = 0x7f;		// Unsupported, no device-type
++		buf[4] = 31;		// Additional length
++		return 36;
++	}
++
++	memset(buf, 0, 8);
++	buf[0] = (mod_data.cdrom ? TYPE_ROM : TYPE_DISK);
++	if (mod_data.removable)
++		buf[1] = 0x80;
++	buf[2] = 2;		// ANSI SCSI level 2
++	buf[3] = 2;		// SCSI-2 INQUIRY data format
++	buf[4] = 31;		// Additional length
++				// No special options
++	sprintf(buf + 8, "%-8s%-16s%04x", vendor_id,
++			(mod_data.cdrom ? product_cdrom_id :
++				product_disk_id),
++			mod_data.release);
++	return 36;
++}
++
++
++static int do_request_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	struct fsg_lun	*curlun = fsg->curlun;
++	u8		*buf = (u8 *) bh->buf;
++	u32		sd, sdinfo;
++	int		valid;
++
++	/*
++	 * From the SCSI-2 spec., section 7.9 (Unit attention condition):
++	 *
++	 * If a REQUEST SENSE command is received from an initiator
++	 * with a pending unit attention condition (before the target
++	 * generates the contingent allegiance condition), then the
++	 * target shall either:
++	 *   a) report any pending sense data and preserve the unit
++	 *	attention condition on the logical unit, or,
++	 *   b) report the unit attention condition, may discard any
++	 *	pending sense data, and clear the unit attention
++	 *	condition on the logical unit for that initiator.
++	 *
++	 * FSG normally uses option a); enable this code to use option b).
++	 */
++#if 0
++	if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
++		curlun->sense_data = curlun->unit_attention_data;
++		curlun->unit_attention_data = SS_NO_SENSE;
++	}
++#endif
++
++	if (!curlun) {		// Unsupported LUNs are okay
++		fsg->bad_lun_okay = 1;
++		sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
++		sdinfo = 0;
++		valid = 0;
++	} else {
++		sd = curlun->sense_data;
++		sdinfo = curlun->sense_data_info;
++		valid = curlun->info_valid << 7;
++		curlun->sense_data = SS_NO_SENSE;
++		curlun->sense_data_info = 0;
++		curlun->info_valid = 0;
++	}
++
++	memset(buf, 0, 18);
++	buf[0] = valid | 0x70;			// Valid, current error
++	buf[2] = SK(sd);
++	put_unaligned_be32(sdinfo, &buf[3]);	/* Sense information */
++	buf[7] = 18 - 8;			// Additional sense length
++	buf[12] = ASC(sd);
++	buf[13] = ASCQ(sd);
++	return 18;
++}
++
++
++static int do_read_capacity(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	struct fsg_lun	*curlun = fsg->curlun;
++	u32		lba = get_unaligned_be32(&fsg->cmnd[2]);
++	int		pmi = fsg->cmnd[8];
++	u8		*buf = (u8 *) bh->buf;
++
++	/* Check the PMI and LBA fields */
++	if (pmi > 1 || (pmi == 0 && lba != 0)) {
++		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++		return -EINVAL;
++	}
++
++	put_unaligned_be32(curlun->num_sectors - 1, &buf[0]);
++						/* Max logical block */
++	put_unaligned_be32(curlun->blksize, &buf[4]);	/* Block length */
++	return 8;
++}
++
++
++static int do_read_header(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	struct fsg_lun	*curlun = fsg->curlun;
++	int		msf = fsg->cmnd[1] & 0x02;
++	u32		lba = get_unaligned_be32(&fsg->cmnd[2]);
++	u8		*buf = (u8 *) bh->buf;
++
++	if ((fsg->cmnd[1] & ~0x02) != 0) {		/* Mask away MSF */
++		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++		return -EINVAL;
++	}
++	if (lba >= curlun->num_sectors) {
++		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
++		return -EINVAL;
++	}
++
++	memset(buf, 0, 8);
++	buf[0] = 0x01;		/* 2048 bytes of user data, rest is EC */
++	store_cdrom_address(&buf[4], msf, lba);
++	return 8;
++}
++
++
++static int do_read_toc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	struct fsg_lun	*curlun = fsg->curlun;
++	int		msf = fsg->cmnd[1] & 0x02;
++	int		start_track = fsg->cmnd[6];
++	u8		*buf = (u8 *) bh->buf;
++
++	if ((fsg->cmnd[1] & ~0x02) != 0 ||		/* Mask away MSF */
++			start_track > 1) {
++		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++		return -EINVAL;
++	}
++
++	memset(buf, 0, 20);
++	buf[1] = (20-2);		/* TOC data length */
++	buf[2] = 1;			/* First track number */
++	buf[3] = 1;			/* Last track number */
++	buf[5] = 0x16;			/* Data track, copying allowed */
++	buf[6] = 0x01;			/* Only track is number 1 */
++	store_cdrom_address(&buf[8], msf, 0);
++
++	buf[13] = 0x16;			/* Lead-out track is data */
++	buf[14] = 0xAA;			/* Lead-out track number */
++	store_cdrom_address(&buf[16], msf, curlun->num_sectors);
++	return 20;
++}
++
++
++static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	struct fsg_lun	*curlun = fsg->curlun;
++	int		mscmnd = fsg->cmnd[0];
++	u8		*buf = (u8 *) bh->buf;
++	u8		*buf0 = buf;
++	int		pc, page_code;
++	int		changeable_values, all_pages;
++	int		valid_page = 0;
++	int		len, limit;
++
++	if ((fsg->cmnd[1] & ~0x08) != 0) {		// Mask away DBD
++		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++		return -EINVAL;
++	}
++	pc = fsg->cmnd[2] >> 6;
++	page_code = fsg->cmnd[2] & 0x3f;
++	if (pc == 3) {
++		curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
++		return -EINVAL;
++	}
++	changeable_values = (pc == 1);
++	all_pages = (page_code == 0x3f);
++
++	/* Write the mode parameter header.  Fixed values are: default
++	 * medium type, no cache control (DPOFUA), and no block descriptors.
++	 * The only variable value is the WriteProtect bit.  We will fill in
++	 * the mode data length later. */
++	memset(buf, 0, 8);
++	if (mscmnd == MODE_SENSE) {
++		buf[2] = (curlun->ro ? 0x80 : 0x00);		// WP, DPOFUA
++		buf += 4;
++		limit = 255;
++	} else {			// MODE_SENSE_10
++		buf[3] = (curlun->ro ? 0x80 : 0x00);		// WP, DPOFUA
++		buf += 8;
++		limit = 65535;		// Should really be mod_data.buflen
++	}
++
++	/* No block descriptors */
++
++	/* The mode pages, in numerical order.  The only page we support
++	 * is the Caching page. */
++	if (page_code == 0x08 || all_pages) {
++		valid_page = 1;
++		buf[0] = 0x08;		// Page code
++		buf[1] = 10;		// Page length
++		memset(buf+2, 0, 10);	// None of the fields are changeable
++
++		if (!changeable_values) {
++			buf[2] = 0x04;	// Write cache enable,
++					// Read cache not disabled
++					// No cache retention priorities
++			put_unaligned_be16(0xffff, &buf[4]);
++					/* Don't disable prefetch */
++					/* Minimum prefetch = 0 */
++			put_unaligned_be16(0xffff, &buf[8]);
++					/* Maximum prefetch */
++			put_unaligned_be16(0xffff, &buf[10]);
++					/* Maximum prefetch ceiling */
++		}
++		buf += 12;
++	}
++
++	/* Check that a valid page was requested and the mode data length
++	 * isn't too long. */
++	len = buf - buf0;
++	if (!valid_page || len > limit) {
++		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++		return -EINVAL;
++	}
++
++	/*  Store the mode data length */
++	if (mscmnd == MODE_SENSE)
++		buf0[0] = len - 1;
++	else
++		put_unaligned_be16(len - 2, buf0);
++	return len;
++}
++
++
++static int do_start_stop(struct fsg_dev *fsg)
++{
++	struct fsg_lun	*curlun = fsg->curlun;
++	int		loej, start;
++
++	if (!mod_data.removable) {
++		curlun->sense_data = SS_INVALID_COMMAND;
++		return -EINVAL;
++	}
++
++	// int immed = fsg->cmnd[1] & 0x01;
++	loej = fsg->cmnd[4] & 0x02;
++	start = fsg->cmnd[4] & 0x01;
++
++#ifdef CONFIG_USB_FILE_STORAGE_TEST
++	if ((fsg->cmnd[1] & ~0x01) != 0 ||		// Mask away Immed
++			(fsg->cmnd[4] & ~0x03) != 0) {	// Mask LoEj, Start
++		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++		return -EINVAL;
++	}
++
++	if (!start) {
++
++		/* Are we allowed to unload the media? */
++		if (curlun->prevent_medium_removal) {
++			LDBG(curlun, "unload attempt prevented\n");
++			curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
++			return -EINVAL;
++		}
++		if (loej) {		// Simulate an unload/eject
++			up_read(&fsg->filesem);
++			down_write(&fsg->filesem);
++			fsg_lun_close(curlun);
++			up_write(&fsg->filesem);
++			down_read(&fsg->filesem);
++		}
++	} else {
++
++		/* Our emulation doesn't support mounting; the medium is
++		 * available for use as soon as it is loaded. */
++		if (!fsg_lun_is_open(curlun)) {
++			curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
++			return -EINVAL;
++		}
++	}
++#endif
++	return 0;
++}
++
++
++static int do_prevent_allow(struct fsg_dev *fsg)
++{
++	struct fsg_lun	*curlun = fsg->curlun;
++	int		prevent;
++
++	if (!mod_data.removable) {
++		curlun->sense_data = SS_INVALID_COMMAND;
++		return -EINVAL;
++	}
++
++	prevent = fsg->cmnd[4] & 0x01;
++	if ((fsg->cmnd[4] & ~0x01) != 0) {		// Mask away Prevent
++		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++		return -EINVAL;
++	}
++
++	if (curlun->prevent_medium_removal && !prevent)
++		fsg_lun_fsync_sub(curlun);
++	curlun->prevent_medium_removal = prevent;
++	return 0;
++}
++
++
++static int do_read_format_capacities(struct fsg_dev *fsg,
++			struct fsg_buffhd *bh)
++{
++	struct fsg_lun	*curlun = fsg->curlun;
++	u8		*buf = (u8 *) bh->buf;
++
++	buf[0] = buf[1] = buf[2] = 0;
++	buf[3] = 8;		// Only the Current/Maximum Capacity Descriptor
++	buf += 4;
++
++	put_unaligned_be32(curlun->num_sectors, &buf[0]);
++						/* Number of blocks */
++	put_unaligned_be32(curlun->blksize, &buf[4]);	/* Block length */
++	buf[4] = 0x02;				/* Current capacity */
++	return 12;
++}
++
++
++static int do_mode_select(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	struct fsg_lun	*curlun = fsg->curlun;
++
++	/* We don't support MODE SELECT */
++	curlun->sense_data = SS_INVALID_COMMAND;
++	return -EINVAL;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
++{
++	int	rc;
++
++	rc = fsg_set_halt(fsg, fsg->bulk_in);
++	if (rc == -EAGAIN)
++		VDBG(fsg, "delayed bulk-in endpoint halt\n");
++	while (rc != 0) {
++		if (rc != -EAGAIN) {
++			WARNING(fsg, "usb_ep_set_halt -> %d\n", rc);
++			rc = 0;
++			break;
++		}
++
++		/* Wait for a short time and then try again */
++		if (msleep_interruptible(100) != 0)
++			return -EINTR;
++		rc = usb_ep_set_halt(fsg->bulk_in);
++	}
++	return rc;
++}
++
++static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
++{
++	int	rc;
++
++	DBG(fsg, "bulk-in set wedge\n");
++	rc = usb_ep_set_wedge(fsg->bulk_in);
++	if (rc == -EAGAIN)
++		VDBG(fsg, "delayed bulk-in endpoint wedge\n");
++	while (rc != 0) {
++		if (rc != -EAGAIN) {
++			WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc);
++			rc = 0;
++			break;
++		}
++
++		/* Wait for a short time and then try again */
++		if (msleep_interruptible(100) != 0)
++			return -EINTR;
++		rc = usb_ep_set_wedge(fsg->bulk_in);
++	}
++	return rc;
++}
++
++static int throw_away_data(struct fsg_dev *fsg)
++{
++	struct fsg_buffhd	*bh;
++	u32			amount;
++	int			rc;
++
++	while ((bh = fsg->next_buffhd_to_drain)->state != BUF_STATE_EMPTY ||
++			fsg->usb_amount_left > 0) {
++
++		/* Throw away the data in a filled buffer */
++		if (bh->state == BUF_STATE_FULL) {
++			smp_rmb();
++			bh->state = BUF_STATE_EMPTY;
++			fsg->next_buffhd_to_drain = bh->next;
++
++			/* A short packet or an error ends everything */
++			if (bh->outreq->actual < bh->bulk_out_intended_length ||
++					bh->outreq->status != 0) {
++				raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
++				return -EINTR;
++			}
++			continue;
++		}
++
++		/* Try to submit another request if we need one */
++		bh = fsg->next_buffhd_to_fill;
++		if (bh->state == BUF_STATE_EMPTY && fsg->usb_amount_left > 0) {
++			amount = min(fsg->usb_amount_left,
++					(u32) mod_data.buflen);
++
++			/* Except at the end of the transfer, amount will be
++			 * equal to the buffer size, which is divisible by
++			 * the bulk-out maxpacket size.
++			 */
++			set_bulk_out_req_length(fsg, bh, amount);
++			start_transfer(fsg, fsg->bulk_out, bh->outreq,
++					&bh->outreq_busy, &bh->state);
++			fsg->next_buffhd_to_fill = bh->next;
++			fsg->usb_amount_left -= amount;
++			continue;
++		}
++
++		/* Otherwise wait for something to happen */
++		rc = sleep_thread(fsg);
++		if (rc)
++			return rc;
++	}
++	return 0;
++}
++
++
++static int finish_reply(struct fsg_dev *fsg)
++{
++	struct fsg_buffhd	*bh = fsg->next_buffhd_to_fill;
++	int			rc = 0;
++
++	switch (fsg->data_dir) {
++	case DATA_DIR_NONE:
++		break;			// Nothing to send
++
++	/* If we don't know whether the host wants to read or write,
++	 * this must be CB or CBI with an unknown command.  We mustn't
++	 * try to send or receive any data.  So stall both bulk pipes
++	 * if we can and wait for a reset. */
++	case DATA_DIR_UNKNOWN:
++		if (mod_data.can_stall) {
++			fsg_set_halt(fsg, fsg->bulk_out);
++			rc = halt_bulk_in_endpoint(fsg);
++		}
++		break;
++
++	/* All but the last buffer of data must have already been sent */
++	case DATA_DIR_TO_HOST:
++		if (fsg->data_size == 0)
++			;		// Nothing to send
++
++		/* If there's no residue, simply send the last buffer */
++		else if (fsg->residue == 0) {
++			bh->inreq->zero = 0;
++			start_transfer(fsg, fsg->bulk_in, bh->inreq,
++					&bh->inreq_busy, &bh->state);
++			fsg->next_buffhd_to_fill = bh->next;
++		}
++
++		/* There is a residue.  For CB and CBI, simply mark the end
++		 * of the data with a short packet.  However, if we are
++		 * allowed to stall, there was no data at all (residue ==
++		 * data_size), and the command failed (invalid LUN or
++		 * sense data is set), then halt the bulk-in endpoint
++		 * instead. */
++		else if (!transport_is_bbb()) {
++			if (mod_data.can_stall &&
++					fsg->residue == fsg->data_size &&
++	(!fsg->curlun || fsg->curlun->sense_data != SS_NO_SENSE)) {
++				bh->state = BUF_STATE_EMPTY;
++				rc = halt_bulk_in_endpoint(fsg);
++			} else {
++				bh->inreq->zero = 1;
++				start_transfer(fsg, fsg->bulk_in, bh->inreq,
++						&bh->inreq_busy, &bh->state);
++				fsg->next_buffhd_to_fill = bh->next;
++			}
++		}
++
++		/*
++		 * For Bulk-only, mark the end of the data with a short
++		 * packet.  If we are allowed to stall, halt the bulk-in
++		 * endpoint.  (Note: This violates the Bulk-Only Transport
++		 * specification, which requires us to pad the data if we
++		 * don't halt the endpoint.  Presumably nobody will mind.)
++		 */
++		else {
++			bh->inreq->zero = 1;
++			start_transfer(fsg, fsg->bulk_in, bh->inreq,
++					&bh->inreq_busy, &bh->state);
++			fsg->next_buffhd_to_fill = bh->next;
++			if (mod_data.can_stall)
++				rc = halt_bulk_in_endpoint(fsg);
++		}
++		break;
++
++	/* We have processed all we want from the data the host has sent.
++	 * There may still be outstanding bulk-out requests. */
++	case DATA_DIR_FROM_HOST:
++		if (fsg->residue == 0)
++			;		// Nothing to receive
++
++		/* Did the host stop sending unexpectedly early? */
++		else if (fsg->short_packet_received) {
++			raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
++			rc = -EINTR;
++		}
++
++		/* We haven't processed all the incoming data.  Even though
++		 * we may be allowed to stall, doing so would cause a race.
++		 * The controller may already have ACK'ed all the remaining
++		 * bulk-out packets, in which case the host wouldn't see a
++		 * STALL.  Not realizing the endpoint was halted, it wouldn't
++		 * clear the halt -- leading to problems later on. */
++#if 0
++		else if (mod_data.can_stall) {
++			fsg_set_halt(fsg, fsg->bulk_out);
++			raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
++			rc = -EINTR;
++		}
++#endif
++
++		/* We can't stall.  Read in the excess data and throw it
++		 * all away. */
++		else
++			rc = throw_away_data(fsg);
++		break;
++	}
++	return rc;
++}
++
++
++static int send_status(struct fsg_dev *fsg)
++{
++	struct fsg_lun		*curlun = fsg->curlun;
++	struct fsg_buffhd	*bh;
++	int			rc;
++	u8			status = US_BULK_STAT_OK;
++	u32			sd, sdinfo = 0;
++
++	/* Wait for the next buffer to become available */
++	bh = fsg->next_buffhd_to_fill;
++	while (bh->state != BUF_STATE_EMPTY) {
++		rc = sleep_thread(fsg);
++		if (rc)
++			return rc;
++	}
++
++	if (curlun) {
++		sd = curlun->sense_data;
++		sdinfo = curlun->sense_data_info;
++	} else if (fsg->bad_lun_okay)
++		sd = SS_NO_SENSE;
++	else
++		sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
++
++	if (fsg->phase_error) {
++		DBG(fsg, "sending phase-error status\n");
++		status = US_BULK_STAT_PHASE;
++		sd = SS_INVALID_COMMAND;
++	} else if (sd != SS_NO_SENSE) {
++		DBG(fsg, "sending command-failure status\n");
++		status = US_BULK_STAT_FAIL;
++		VDBG(fsg, "  sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
++				"  info x%x\n",
++				SK(sd), ASC(sd), ASCQ(sd), sdinfo);
++	}
++
++	if (transport_is_bbb()) {
++		struct bulk_cs_wrap	*csw = bh->buf;
++
++		/* Store and send the Bulk-only CSW */
++		csw->Signature = cpu_to_le32(US_BULK_CS_SIGN);
++		csw->Tag = fsg->tag;
++		csw->Residue = cpu_to_le32(fsg->residue);
++		csw->Status = status;
++
++		bh->inreq->length = US_BULK_CS_WRAP_LEN;
++		bh->inreq->zero = 0;
++		start_transfer(fsg, fsg->bulk_in, bh->inreq,
++				&bh->inreq_busy, &bh->state);
++
++	} else if (mod_data.transport_type == USB_PR_CB) {
++
++		/* Control-Bulk transport has no status phase! */
++		return 0;
++
++	} else {			// USB_PR_CBI
++		struct interrupt_data	*buf = bh->buf;
++
++		/* Store and send the Interrupt data.  UFI sends the ASC
++		 * and ASCQ bytes.  Everything else sends a Type (which
++		 * is always 0) and the status Value. */
++		if (mod_data.protocol_type == USB_SC_UFI) {
++			buf->bType = ASC(sd);
++			buf->bValue = ASCQ(sd);
++		} else {
++			buf->bType = 0;
++			buf->bValue = status;
++		}
++		fsg->intreq->length = CBI_INTERRUPT_DATA_LEN;
++
++		fsg->intr_buffhd = bh;		// Point to the right buffhd
++		fsg->intreq->buf = bh->inreq->buf;
++		fsg->intreq->context = bh;
++		start_transfer(fsg, fsg->intr_in, fsg->intreq,
++				&fsg->intreq_busy, &bh->state);
++	}
++
++	fsg->next_buffhd_to_fill = bh->next;
++	return 0;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++/* Check whether the command is properly formed and whether its data size
++ * and direction agree with the values we already have. */
++static int check_command(struct fsg_dev *fsg, int cmnd_size,
++		enum data_direction data_dir, unsigned int mask,
++		int needs_medium, const char *name)
++{
++	int			i;
++	int			lun = fsg->cmnd[1] >> 5;
++	static const char	dirletter[4] = {'u', 'o', 'i', 'n'};
++	char			hdlen[20];
++	struct fsg_lun		*curlun;
++
++	/* Adjust the expected cmnd_size for protocol encapsulation padding.
++	 * Transparent SCSI doesn't pad. */
++	if (protocol_is_scsi())
++		;
++
++	/* There's some disagreement as to whether RBC pads commands or not.
++	 * We'll play it safe and accept either form. */
++	else if (mod_data.protocol_type == USB_SC_RBC) {
++		if (fsg->cmnd_size == 12)
++			cmnd_size = 12;
++
++	/* All the other protocols pad to 12 bytes */
++	} else
++		cmnd_size = 12;
++
++	hdlen[0] = 0;
++	if (fsg->data_dir != DATA_DIR_UNKNOWN)
++		sprintf(hdlen, ", H%c=%u", dirletter[(int) fsg->data_dir],
++				fsg->data_size);
++	VDBG(fsg, "SCSI command: %s;  Dc=%d, D%c=%u;  Hc=%d%s\n",
++			name, cmnd_size, dirletter[(int) data_dir],
++			fsg->data_size_from_cmnd, fsg->cmnd_size, hdlen);
++
++	/* We can't reply at all until we know the correct data direction
++	 * and size. */
++	if (fsg->data_size_from_cmnd == 0)
++		data_dir = DATA_DIR_NONE;
++	if (fsg->data_dir == DATA_DIR_UNKNOWN) {	// CB or CBI
++		fsg->data_dir = data_dir;
++		fsg->data_size = fsg->data_size_from_cmnd;
++
++	} else {					// Bulk-only
++		if (fsg->data_size < fsg->data_size_from_cmnd) {
++
++			/* Host data size < Device data size is a phase error.
++			 * Carry out the command, but only transfer as much
++			 * as we are allowed. */
++			fsg->data_size_from_cmnd = fsg->data_size;
++			fsg->phase_error = 1;
++		}
++	}
++	fsg->residue = fsg->usb_amount_left = fsg->data_size;
++
++	/* Conflicting data directions is a phase error */
++	if (fsg->data_dir != data_dir && fsg->data_size_from_cmnd > 0) {
++		fsg->phase_error = 1;
++		return -EINVAL;
++	}
++
++	/* Verify the length of the command itself */
++	if (cmnd_size != fsg->cmnd_size) {
++
++		/* Special case workaround: There are plenty of buggy SCSI
++		 * implementations. Many have issues with cbw->Length
++		 * field passing a wrong command size. For those cases we
++		 * always try to work around the problem by using the length
++		 * sent by the host side provided it is at least as large
++		 * as the correct command length.
++		 * Examples of such cases would be MS-Windows, which issues
++		 * REQUEST SENSE with cbw->Length == 12 where it should
++		 * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and
++		 * REQUEST SENSE with cbw->Length == 10 where it should
++		 * be 6 as well.
++		 */
++		if (cmnd_size <= fsg->cmnd_size) {
++			DBG(fsg, "%s is buggy! Expected length %d "
++					"but we got %d\n", name,
++					cmnd_size, fsg->cmnd_size);
++			cmnd_size = fsg->cmnd_size;
++		} else {
++			fsg->phase_error = 1;
++			return -EINVAL;
++		}
++	}
++
++	/* Check that the LUN values are consistent */
++	if (transport_is_bbb()) {
++		if (fsg->lun != lun)
++			DBG(fsg, "using LUN %d from CBW, "
++					"not LUN %d from CDB\n",
++					fsg->lun, lun);
++	}
++
++	/* Check the LUN */
++	curlun = fsg->curlun;
++	if (curlun) {
++		if (fsg->cmnd[0] != REQUEST_SENSE) {
++			curlun->sense_data = SS_NO_SENSE;
++			curlun->sense_data_info = 0;
++			curlun->info_valid = 0;
++		}
++	} else {
++		fsg->bad_lun_okay = 0;
++
++		/* INQUIRY and REQUEST SENSE commands are explicitly allowed
++		 * to use unsupported LUNs; all others may not. */
++		if (fsg->cmnd[0] != INQUIRY &&
++				fsg->cmnd[0] != REQUEST_SENSE) {
++			DBG(fsg, "unsupported LUN %d\n", fsg->lun);
++			return -EINVAL;
++		}
++	}
++
++	/* If a unit attention condition exists, only INQUIRY and
++	 * REQUEST SENSE commands are allowed; anything else must fail. */
++	if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
++			fsg->cmnd[0] != INQUIRY &&
++			fsg->cmnd[0] != REQUEST_SENSE) {
++		curlun->sense_data = curlun->unit_attention_data;
++		curlun->unit_attention_data = SS_NO_SENSE;
++		return -EINVAL;
++	}
++
++	/* Check that only command bytes listed in the mask are non-zero */
++	fsg->cmnd[1] &= 0x1f;			// Mask away the LUN
++	for (i = 1; i < cmnd_size; ++i) {
++		if (fsg->cmnd[i] && !(mask & (1 << i))) {
++			if (curlun)
++				curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++			return -EINVAL;
++		}
++	}
++
++	/* If the medium isn't mounted and the command needs to access
++	 * it, return an error. */
++	if (curlun && !fsg_lun_is_open(curlun) && needs_medium) {
++		curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/* wrapper of check_command for data size in blocks handling */
++static int check_command_size_in_blocks(struct fsg_dev *fsg, int cmnd_size,
++		enum data_direction data_dir, unsigned int mask,
++		int needs_medium, const char *name)
++{
++	if (fsg->curlun)
++		fsg->data_size_from_cmnd <<= fsg->curlun->blkbits;
++	return check_command(fsg, cmnd_size, data_dir,
++			mask, needs_medium, name);
++}
++
++static int do_scsi_command(struct fsg_dev *fsg)
++{
++	struct fsg_buffhd	*bh;
++	int			rc;
++	int			reply = -EINVAL;
++	int			i;
++	static char		unknown[16];
++
++	dump_cdb(fsg);
++
++	/* Wait for the next buffer to become available for data or status */
++	bh = fsg->next_buffhd_to_drain = fsg->next_buffhd_to_fill;
++	while (bh->state != BUF_STATE_EMPTY) {
++		rc = sleep_thread(fsg);
++		if (rc)
++			return rc;
++	}
++	fsg->phase_error = 0;
++	fsg->short_packet_received = 0;
++
++	down_read(&fsg->filesem);	// We're using the backing file
++	switch (fsg->cmnd[0]) {
++
++	case INQUIRY:
++		fsg->data_size_from_cmnd = fsg->cmnd[4];
++		if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
++				(1<<4), 0,
++				"INQUIRY")) == 0)
++			reply = do_inquiry(fsg, bh);
++		break;
++
++	case MODE_SELECT:
++		fsg->data_size_from_cmnd = fsg->cmnd[4];
++		if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
++				(1<<1) | (1<<4), 0,
++				"MODE SELECT(6)")) == 0)
++			reply = do_mode_select(fsg, bh);
++		break;
++
++	case MODE_SELECT_10:
++		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
++		if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
++				(1<<1) | (3<<7), 0,
++				"MODE SELECT(10)")) == 0)
++			reply = do_mode_select(fsg, bh);
++		break;
++
++	case MODE_SENSE:
++		fsg->data_size_from_cmnd = fsg->cmnd[4];
++		if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
++				(1<<1) | (1<<2) | (1<<4), 0,
++				"MODE SENSE(6)")) == 0)
++			reply = do_mode_sense(fsg, bh);
++		break;
++
++	case MODE_SENSE_10:
++		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
++		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
++				(1<<1) | (1<<2) | (3<<7), 0,
++				"MODE SENSE(10)")) == 0)
++			reply = do_mode_sense(fsg, bh);
++		break;
++
++	case ALLOW_MEDIUM_REMOVAL:
++		fsg->data_size_from_cmnd = 0;
++		if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
++				(1<<4), 0,
++				"PREVENT-ALLOW MEDIUM REMOVAL")) == 0)
++			reply = do_prevent_allow(fsg);
++		break;
++
++	case READ_6:
++		i = fsg->cmnd[4];
++		fsg->data_size_from_cmnd = (i == 0) ? 256 : i;
++		if ((reply = check_command_size_in_blocks(fsg, 6,
++				DATA_DIR_TO_HOST,
++				(7<<1) | (1<<4), 1,
++				"READ(6)")) == 0)
++			reply = do_read(fsg);
++		break;
++
++	case READ_10:
++		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
++		if ((reply = check_command_size_in_blocks(fsg, 10,
++				DATA_DIR_TO_HOST,
++				(1<<1) | (0xf<<2) | (3<<7), 1,
++				"READ(10)")) == 0)
++			reply = do_read(fsg);
++		break;
++
++	case READ_12:
++		fsg->data_size_from_cmnd = get_unaligned_be32(&fsg->cmnd[6]);
++		if ((reply = check_command_size_in_blocks(fsg, 12,
++				DATA_DIR_TO_HOST,
++				(1<<1) | (0xf<<2) | (0xf<<6), 1,
++				"READ(12)")) == 0)
++			reply = do_read(fsg);
++		break;
++
++	case READ_CAPACITY:
++		fsg->data_size_from_cmnd = 8;
++		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
++				(0xf<<2) | (1<<8), 1,
++				"READ CAPACITY")) == 0)
++			reply = do_read_capacity(fsg, bh);
++		break;
++
++	case READ_HEADER:
++		if (!mod_data.cdrom)
++			goto unknown_cmnd;
++		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
++		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
++				(3<<7) | (0x1f<<1), 1,
++				"READ HEADER")) == 0)
++			reply = do_read_header(fsg, bh);
++		break;
++
++	case READ_TOC:
++		if (!mod_data.cdrom)
++			goto unknown_cmnd;
++		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
++		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
++				(7<<6) | (1<<1), 1,
++				"READ TOC")) == 0)
++			reply = do_read_toc(fsg, bh);
++		break;
++
++	case READ_FORMAT_CAPACITIES:
++		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
++		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
++				(3<<7), 1,
++				"READ FORMAT CAPACITIES")) == 0)
++			reply = do_read_format_capacities(fsg, bh);
++		break;
++
++	case REQUEST_SENSE:
++		fsg->data_size_from_cmnd = fsg->cmnd[4];
++		if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
++				(1<<4), 0,
++				"REQUEST SENSE")) == 0)
++			reply = do_request_sense(fsg, bh);
++		break;
++
++	case START_STOP:
++		fsg->data_size_from_cmnd = 0;
++		if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
++				(1<<1) | (1<<4), 0,
++				"START-STOP UNIT")) == 0)
++			reply = do_start_stop(fsg);
++		break;
++
++	case SYNCHRONIZE_CACHE:
++		fsg->data_size_from_cmnd = 0;
++		if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
++				(0xf<<2) | (3<<7), 1,
++				"SYNCHRONIZE CACHE")) == 0)
++			reply = do_synchronize_cache(fsg);
++		break;
++
++	case TEST_UNIT_READY:
++		fsg->data_size_from_cmnd = 0;
++		reply = check_command(fsg, 6, DATA_DIR_NONE,
++				0, 1,
++				"TEST UNIT READY");
++		break;
++
++	/* Although optional, this command is used by MS-Windows.  We
++	 * support a minimal version: BytChk must be 0. */
++	case VERIFY:
++		fsg->data_size_from_cmnd = 0;
++		if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
++				(1<<1) | (0xf<<2) | (3<<7), 1,
++				"VERIFY")) == 0)
++			reply = do_verify(fsg);
++		break;
++
++	case WRITE_6:
++		i = fsg->cmnd[4];
++		fsg->data_size_from_cmnd = (i == 0) ? 256 : i;
++		if ((reply = check_command_size_in_blocks(fsg, 6,
++				DATA_DIR_FROM_HOST,
++				(7<<1) | (1<<4), 1,
++				"WRITE(6)")) == 0)
++			reply = do_write(fsg);
++		break;
++
++	case WRITE_10:
++		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
++		if ((reply = check_command_size_in_blocks(fsg, 10,
++				DATA_DIR_FROM_HOST,
++				(1<<1) | (0xf<<2) | (3<<7), 1,
++				"WRITE(10)")) == 0)
++			reply = do_write(fsg);
++		break;
++
++	case WRITE_12:
++		fsg->data_size_from_cmnd = get_unaligned_be32(&fsg->cmnd[6]);
++		if ((reply = check_command_size_in_blocks(fsg, 12,
++				DATA_DIR_FROM_HOST,
++				(1<<1) | (0xf<<2) | (0xf<<6), 1,
++				"WRITE(12)")) == 0)
++			reply = do_write(fsg);
++		break;
++
++	/* Some mandatory commands that we recognize but don't implement.
++	 * They don't mean much in this setting.  It's left as an exercise
++	 * for anyone interested to implement RESERVE and RELEASE in terms
++	 * of Posix locks. */
++	case FORMAT_UNIT:
++	case RELEASE:
++	case RESERVE:
++	case SEND_DIAGNOSTIC:
++		// Fall through
++
++	default:
++ unknown_cmnd:
++		fsg->data_size_from_cmnd = 0;
++		sprintf(unknown, "Unknown x%02x", fsg->cmnd[0]);
++		if ((reply = check_command(fsg, fsg->cmnd_size,
++				DATA_DIR_UNKNOWN, ~0, 0, unknown)) == 0) {
++			fsg->curlun->sense_data = SS_INVALID_COMMAND;
++			reply = -EINVAL;
++		}
++		break;
++	}
++	up_read(&fsg->filesem);
++
++	if (reply == -EINTR || signal_pending(current))
++		return -EINTR;
++
++	/* Set up the single reply buffer for finish_reply() */
++	if (reply == -EINVAL)
++		reply = 0;		// Error reply length
++	if (reply >= 0 && fsg->data_dir == DATA_DIR_TO_HOST) {
++		reply = min((u32) reply, fsg->data_size_from_cmnd);
++		bh->inreq->length = reply;
++		bh->state = BUF_STATE_FULL;
++		fsg->residue -= reply;
++	}				// Otherwise it's already set
++
++	return 0;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	struct usb_request		*req = bh->outreq;
++	struct bulk_cb_wrap	*cbw = req->buf;
++
++	/* Was this a real packet?  Should it be ignored? */
++	if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
++		return -EINVAL;
++
++	/* Is the CBW valid? */
++	if (req->actual != US_BULK_CB_WRAP_LEN ||
++			cbw->Signature != cpu_to_le32(
++				US_BULK_CB_SIGN)) {
++		DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
++				req->actual,
++				le32_to_cpu(cbw->Signature));
++
++		/* The Bulk-only spec says we MUST stall the IN endpoint
++		 * (6.6.1), so it's unavoidable.  It also says we must
++		 * retain this state until the next reset, but there's
++		 * no way to tell the controller driver it should ignore
++		 * Clear-Feature(HALT) requests.
++		 *
++		 * We aren't required to halt the OUT endpoint; instead
++		 * we can simply accept and discard any data received
++		 * until the next reset. */
++		wedge_bulk_in_endpoint(fsg);
++		set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
++		return -EINVAL;
++	}
++
++	/* Is the CBW meaningful? */
++	if (cbw->Lun >= FSG_MAX_LUNS || cbw->Flags & ~US_BULK_FLAG_IN ||
++			cbw->Length <= 0 || cbw->Length > MAX_COMMAND_SIZE) {
++		DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
++				"cmdlen %u\n",
++				cbw->Lun, cbw->Flags, cbw->Length);
++
++		/* We can do anything we want here, so let's stall the
++		 * bulk pipes if we are allowed to. */
++		if (mod_data.can_stall) {
++			fsg_set_halt(fsg, fsg->bulk_out);
++			halt_bulk_in_endpoint(fsg);
++		}
++		return -EINVAL;
++	}
++
++	/* Save the command for later */
++	fsg->cmnd_size = cbw->Length;
++	memcpy(fsg->cmnd, cbw->CDB, fsg->cmnd_size);
++	if (cbw->Flags & US_BULK_FLAG_IN)
++		fsg->data_dir = DATA_DIR_TO_HOST;
++	else
++		fsg->data_dir = DATA_DIR_FROM_HOST;
++	fsg->data_size = le32_to_cpu(cbw->DataTransferLength);
++	if (fsg->data_size == 0)
++		fsg->data_dir = DATA_DIR_NONE;
++	fsg->lun = cbw->Lun;
++	fsg->tag = cbw->Tag;
++	return 0;
++}
++
++
++static int get_next_command(struct fsg_dev *fsg)
++{
++	struct fsg_buffhd	*bh;
++	int			rc = 0;
++
++	if (transport_is_bbb()) {
++
++		/* Wait for the next buffer to become available */
++		bh = fsg->next_buffhd_to_fill;
++		while (bh->state != BUF_STATE_EMPTY) {
++			rc = sleep_thread(fsg);
++			if (rc)
++				return rc;
++		}
++
++		/* Queue a request to read a Bulk-only CBW */
++		set_bulk_out_req_length(fsg, bh, US_BULK_CB_WRAP_LEN);
++		start_transfer(fsg, fsg->bulk_out, bh->outreq,
++				&bh->outreq_busy, &bh->state);
++
++		/* We will drain the buffer in software, which means we
++		 * can reuse it for the next filling.  No need to advance
++		 * next_buffhd_to_fill. */
++
++		/* Wait for the CBW to arrive */
++		while (bh->state != BUF_STATE_FULL) {
++			rc = sleep_thread(fsg);
++			if (rc)
++				return rc;
++		}
++		smp_rmb();
++		rc = received_cbw(fsg, bh);
++		bh->state = BUF_STATE_EMPTY;
++
++	} else {		// USB_PR_CB or USB_PR_CBI
++
++		/* Wait for the next command to arrive */
++		while (fsg->cbbuf_cmnd_size == 0) {
++			rc = sleep_thread(fsg);
++			if (rc)
++				return rc;
++		}
++
++		/* Is the previous status interrupt request still busy?
++		 * The host is allowed to skip reading the status,
++		 * so we must cancel it. */
++		if (fsg->intreq_busy)
++			usb_ep_dequeue(fsg->intr_in, fsg->intreq);
++
++		/* Copy the command and mark the buffer empty */
++		fsg->data_dir = DATA_DIR_UNKNOWN;
++		spin_lock_irq(&fsg->lock);
++		fsg->cmnd_size = fsg->cbbuf_cmnd_size;
++		memcpy(fsg->cmnd, fsg->cbbuf_cmnd, fsg->cmnd_size);
++		fsg->cbbuf_cmnd_size = 0;
++		spin_unlock_irq(&fsg->lock);
++
++		/* Use LUN from the command */
++		fsg->lun = fsg->cmnd[1] >> 5;
++	}
++
++	/* Update current lun */
++	if (fsg->lun >= 0 && fsg->lun < fsg->nluns)
++		fsg->curlun = &fsg->luns[fsg->lun];
++	else
++		fsg->curlun = NULL;
++
++	return rc;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int enable_endpoint(struct fsg_dev *fsg, struct usb_ep *ep,
++		const struct usb_endpoint_descriptor *d)
++{
++	int	rc;
++
++	ep->driver_data = fsg;
++	ep->desc = d;
++	rc = usb_ep_enable(ep);
++	if (rc)
++		ERROR(fsg, "can't enable %s, result %d\n", ep->name, rc);
++	return rc;
++}
++
++static int alloc_request(struct fsg_dev *fsg, struct usb_ep *ep,
++		struct usb_request **preq)
++{
++	*preq = usb_ep_alloc_request(ep, GFP_ATOMIC);
++	if (*preq)
++		return 0;
++	ERROR(fsg, "can't allocate request for %s\n", ep->name);
++	return -ENOMEM;
++}
++
++/*
++ * Reset interface setting and re-init endpoint state (toggle etc).
++ * Call with altsetting < 0 to disable the interface.  The only other
++ * available altsetting is 0, which enables the interface.
++ */
++static int do_set_interface(struct fsg_dev *fsg, int altsetting)
++{
++	int	rc = 0;
++	int	i;
++	const struct usb_endpoint_descriptor	*d;
++
++	if (fsg->running)
++		DBG(fsg, "reset interface\n");
++
++reset:
++	/* Deallocate the requests */
++	for (i = 0; i < fsg_num_buffers; ++i) {
++		struct fsg_buffhd *bh = &fsg->buffhds[i];
++
++		if (bh->inreq) {
++			usb_ep_free_request(fsg->bulk_in, bh->inreq);
++			bh->inreq = NULL;
++		}
++		if (bh->outreq) {
++			usb_ep_free_request(fsg->bulk_out, bh->outreq);
++			bh->outreq = NULL;
++		}
++	}
++	if (fsg->intreq) {
++		usb_ep_free_request(fsg->intr_in, fsg->intreq);
++		fsg->intreq = NULL;
++	}
++
++	/* Disable the endpoints */
++	if (fsg->bulk_in_enabled) {
++		usb_ep_disable(fsg->bulk_in);
++		fsg->bulk_in_enabled = 0;
++	}
++	if (fsg->bulk_out_enabled) {
++		usb_ep_disable(fsg->bulk_out);
++		fsg->bulk_out_enabled = 0;
++	}
++	if (fsg->intr_in_enabled) {
++		usb_ep_disable(fsg->intr_in);
++		fsg->intr_in_enabled = 0;
++	}
++
++	fsg->running = 0;
++	if (altsetting < 0 || rc != 0)
++		return rc;
++
++	DBG(fsg, "set interface %d\n", altsetting);
++
++	/* Enable the endpoints */
++	d = fsg_ep_desc(fsg->gadget,
++			&fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc,
++			&fsg_ss_bulk_in_desc);
++	if ((rc = enable_endpoint(fsg, fsg->bulk_in, d)) != 0)
++		goto reset;
++	fsg->bulk_in_enabled = 1;
++
++	d = fsg_ep_desc(fsg->gadget,
++			&fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc,
++			&fsg_ss_bulk_out_desc);
++	if ((rc = enable_endpoint(fsg, fsg->bulk_out, d)) != 0)
++		goto reset;
++	fsg->bulk_out_enabled = 1;
++	fsg->bulk_out_maxpacket = usb_endpoint_maxp(d);
++	clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
++
++	if (transport_is_cbi()) {
++		d = fsg_ep_desc(fsg->gadget,
++				&fsg_fs_intr_in_desc, &fsg_hs_intr_in_desc,
++				&fsg_ss_intr_in_desc);
++		if ((rc = enable_endpoint(fsg, fsg->intr_in, d)) != 0)
++			goto reset;
++		fsg->intr_in_enabled = 1;
++	}
++
++	/* Allocate the requests */
++	for (i = 0; i < fsg_num_buffers; ++i) {
++		struct fsg_buffhd	*bh = &fsg->buffhds[i];
++
++		if ((rc = alloc_request(fsg, fsg->bulk_in, &bh->inreq)) != 0)
++			goto reset;
++		if ((rc = alloc_request(fsg, fsg->bulk_out, &bh->outreq)) != 0)
++			goto reset;
++		bh->inreq->buf = bh->outreq->buf = bh->buf;
++		bh->inreq->context = bh->outreq->context = bh;
++		bh->inreq->complete = bulk_in_complete;
++		bh->outreq->complete = bulk_out_complete;
++	}
++	if (transport_is_cbi()) {
++		if ((rc = alloc_request(fsg, fsg->intr_in, &fsg->intreq)) != 0)
++			goto reset;
++		fsg->intreq->complete = intr_in_complete;
++	}
++
++	fsg->running = 1;
++	for (i = 0; i < fsg->nluns; ++i)
++		fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
++	return rc;
++}
++
++
++/*
++ * Change our operational configuration.  This code must agree with the code
++ * that returns config descriptors, and with interface altsetting code.
++ *
++ * It's also responsible for power management interactions.  Some
++ * configurations might not work with our current power sources.
++ * For now we just assume the gadget is always self-powered.
++ */
++static int do_set_config(struct fsg_dev *fsg, u8 new_config)
++{
++	int	rc = 0;
++
++	/* Disable the single interface */
++	if (fsg->config != 0) {
++		DBG(fsg, "reset config\n");
++		fsg->config = 0;
++		rc = do_set_interface(fsg, -1);
++	}
++
++	/* Enable the interface */
++	if (new_config != 0) {
++		fsg->config = new_config;
++		if ((rc = do_set_interface(fsg, 0)) != 0)
++			fsg->config = 0;	// Reset on errors
++		else
++			INFO(fsg, "%s config #%d\n",
++			     usb_speed_string(fsg->gadget->speed),
++			     fsg->config);
++	}
++	return rc;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static void handle_exception(struct fsg_dev *fsg)
++{
++	siginfo_t		info;
++	int			sig;
++	int			i;
++	int			num_active;
++	struct fsg_buffhd	*bh;
++	enum fsg_state		old_state;
++	u8			new_config;
++	struct fsg_lun		*curlun;
++	unsigned int		exception_req_tag;
++	int			rc;
++
++	/* Clear the existing signals.  Anything but SIGUSR1 is converted
++	 * into a high-priority EXIT exception. */
++	for (;;) {
++		sig = dequeue_signal_lock(current, &current->blocked, &info);
++		if (!sig)
++			break;
++		if (sig != SIGUSR1) {
++			if (fsg->state < FSG_STATE_EXIT)
++				DBG(fsg, "Main thread exiting on signal\n");
++			raise_exception(fsg, FSG_STATE_EXIT);
++		}
++	}
++
++	/* Cancel all the pending transfers */
++	if (fsg->intreq_busy)
++		usb_ep_dequeue(fsg->intr_in, fsg->intreq);
++	for (i = 0; i < fsg_num_buffers; ++i) {
++		bh = &fsg->buffhds[i];
++		if (bh->inreq_busy)
++			usb_ep_dequeue(fsg->bulk_in, bh->inreq);
++		if (bh->outreq_busy)
++			usb_ep_dequeue(fsg->bulk_out, bh->outreq);
++	}
++
++	/* Wait until everything is idle */
++	for (;;) {
++		num_active = fsg->intreq_busy;
++		for (i = 0; i < fsg_num_buffers; ++i) {
++			bh = &fsg->buffhds[i];
++			num_active += bh->inreq_busy + bh->outreq_busy;
++		}
++		if (num_active == 0)
++			break;
++		if (sleep_thread(fsg))
++			return;
++	}
++
++	/* Clear out the controller's fifos */
++	if (fsg->bulk_in_enabled)
++		usb_ep_fifo_flush(fsg->bulk_in);
++	if (fsg->bulk_out_enabled)
++		usb_ep_fifo_flush(fsg->bulk_out);
++	if (fsg->intr_in_enabled)
++		usb_ep_fifo_flush(fsg->intr_in);
++
++	/* Reset the I/O buffer states and pointers, the SCSI
++	 * state, and the exception.  Then invoke the handler. */
++	spin_lock_irq(&fsg->lock);
++
++	for (i = 0; i < fsg_num_buffers; ++i) {
++		bh = &fsg->buffhds[i];
++		bh->state = BUF_STATE_EMPTY;
++	}
++	fsg->next_buffhd_to_fill = fsg->next_buffhd_to_drain =
++			&fsg->buffhds[0];
++
++	exception_req_tag = fsg->exception_req_tag;
++	new_config = fsg->new_config;
++	old_state = fsg->state;
++
++	if (old_state == FSG_STATE_ABORT_BULK_OUT)
++		fsg->state = FSG_STATE_STATUS_PHASE;
++	else {
++		for (i = 0; i < fsg->nluns; ++i) {
++			curlun = &fsg->luns[i];
++			curlun->prevent_medium_removal = 0;
++			curlun->sense_data = curlun->unit_attention_data =
++					SS_NO_SENSE;
++			curlun->sense_data_info = 0;
++			curlun->info_valid = 0;
++		}
++		fsg->state = FSG_STATE_IDLE;
++	}
++	spin_unlock_irq(&fsg->lock);
++
++	/* Carry out any extra actions required for the exception */
++	switch (old_state) {
++	default:
++		break;
++
++	case FSG_STATE_ABORT_BULK_OUT:
++		send_status(fsg);
++		spin_lock_irq(&fsg->lock);
++		if (fsg->state == FSG_STATE_STATUS_PHASE)
++			fsg->state = FSG_STATE_IDLE;
++		spin_unlock_irq(&fsg->lock);
++		break;
++
++	case FSG_STATE_RESET:
++		/* In case we were forced against our will to halt a
++		 * bulk endpoint, clear the halt now.  (The SuperH UDC
++		 * requires this.) */
++		if (test_and_clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
++			usb_ep_clear_halt(fsg->bulk_in);
++
++		if (transport_is_bbb()) {
++			if (fsg->ep0_req_tag == exception_req_tag)
++				ep0_queue(fsg);	// Complete the status stage
++
++		} else if (transport_is_cbi())
++			send_status(fsg);	// Status by interrupt pipe
++
++		/* Technically this should go here, but it would only be
++		 * a waste of time.  Ditto for the INTERFACE_CHANGE and
++		 * CONFIG_CHANGE cases. */
++		// for (i = 0; i < fsg->nluns; ++i)
++		//	fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
++		break;
++
++	case FSG_STATE_INTERFACE_CHANGE:
++		rc = do_set_interface(fsg, 0);
++		if (fsg->ep0_req_tag != exception_req_tag)
++			break;
++		if (rc != 0)			// STALL on errors
++			fsg_set_halt(fsg, fsg->ep0);
++		else				// Complete the status stage
++			ep0_queue(fsg);
++		break;
++
++	case FSG_STATE_CONFIG_CHANGE:
++		rc = do_set_config(fsg, new_config);
++		if (fsg->ep0_req_tag != exception_req_tag)
++			break;
++		if (rc != 0)			// STALL on errors
++			fsg_set_halt(fsg, fsg->ep0);
++		else				// Complete the status stage
++			ep0_queue(fsg);
++		break;
++
++	case FSG_STATE_DISCONNECT:
++		for (i = 0; i < fsg->nluns; ++i)
++			fsg_lun_fsync_sub(fsg->luns + i);
++		do_set_config(fsg, 0);		// Unconfigured state
++		break;
++
++	case FSG_STATE_EXIT:
++	case FSG_STATE_TERMINATED:
++		do_set_config(fsg, 0);			// Free resources
++		spin_lock_irq(&fsg->lock);
++		fsg->state = FSG_STATE_TERMINATED;	// Stop the thread
++		spin_unlock_irq(&fsg->lock);
++		break;
++	}
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int fsg_main_thread(void *fsg_)
++{
++	struct fsg_dev		*fsg = fsg_;
++
++	/* Allow the thread to be killed by a signal, but set the signal mask
++	 * to block everything but INT, TERM, KILL, and USR1. */
++	allow_signal(SIGINT);
++	allow_signal(SIGTERM);
++	allow_signal(SIGKILL);
++	allow_signal(SIGUSR1);
++
++	/* Allow the thread to be frozen */
++	set_freezable();
++
++	/* Arrange for userspace references to be interpreted as kernel
++	 * pointers.  That way we can pass a kernel pointer to a routine
++	 * that expects a __user pointer and it will work okay. */
++	set_fs(get_ds());
++
++	/* The main loop */
++	while (fsg->state != FSG_STATE_TERMINATED) {
++		if (exception_in_progress(fsg) || signal_pending(current)) {
++			handle_exception(fsg);
++			continue;
++		}
++
++		if (!fsg->running) {
++			sleep_thread(fsg);
++			continue;
++		}
++
++		if (get_next_command(fsg))
++			continue;
++
++		spin_lock_irq(&fsg->lock);
++		if (!exception_in_progress(fsg))
++			fsg->state = FSG_STATE_DATA_PHASE;
++		spin_unlock_irq(&fsg->lock);
++
++		if (do_scsi_command(fsg) || finish_reply(fsg))
++			continue;
++
++		spin_lock_irq(&fsg->lock);
++		if (!exception_in_progress(fsg))
++			fsg->state = FSG_STATE_STATUS_PHASE;
++		spin_unlock_irq(&fsg->lock);
++
++		if (send_status(fsg))
++			continue;
++
++		spin_lock_irq(&fsg->lock);
++		if (!exception_in_progress(fsg))
++			fsg->state = FSG_STATE_IDLE;
++		spin_unlock_irq(&fsg->lock);
++		}
++
++	spin_lock_irq(&fsg->lock);
++	fsg->thread_task = NULL;
++	spin_unlock_irq(&fsg->lock);
++
++	/* If we are exiting because of a signal, unregister the
++	 * gadget driver. */
++	if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
++		usb_gadget_unregister_driver(&fsg_driver);
++
++	/* Let the unbind and cleanup routines know the thread has exited */
++	complete_and_exit(&fsg->thread_notifier, 0);
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++
++/* The write permissions and store_xxx pointers are set in fsg_bind() */
++static DEVICE_ATTR(ro, 0444, fsg_show_ro, NULL);
++static DEVICE_ATTR(nofua, 0644, fsg_show_nofua, NULL);
++static DEVICE_ATTR(file, 0444, fsg_show_file, NULL);
++
++
++/*-------------------------------------------------------------------------*/
++
++static void fsg_release(struct kref *ref)
++{
++	struct fsg_dev	*fsg = container_of(ref, struct fsg_dev, ref);
++
++	kfree(fsg->luns);
++	kfree(fsg);
++}
++
++static void lun_release(struct device *dev)
++{
++	struct rw_semaphore	*filesem = dev_get_drvdata(dev);
++	struct fsg_dev		*fsg =
++		container_of(filesem, struct fsg_dev, filesem);
++
++	kref_put(&fsg->ref, fsg_release);
++}
++
++static void /* __init_or_exit */ fsg_unbind(struct usb_gadget *gadget)
++{
++	struct fsg_dev		*fsg = get_gadget_data(gadget);
++	int			i;
++	struct fsg_lun		*curlun;
++	struct usb_request	*req = fsg->ep0req;
++
++	DBG(fsg, "unbind\n");
++	clear_bit(REGISTERED, &fsg->atomic_bitflags);
++
++	/* If the thread isn't already dead, tell it to exit now */
++	if (fsg->state != FSG_STATE_TERMINATED) {
++		raise_exception(fsg, FSG_STATE_EXIT);
++		wait_for_completion(&fsg->thread_notifier);
++
++		/* The cleanup routine waits for this completion also */
++		complete(&fsg->thread_notifier);
++	}
++
++	/* Unregister the sysfs attribute files and the LUNs */
++	for (i = 0; i < fsg->nluns; ++i) {
++		curlun = &fsg->luns[i];
++		if (curlun->registered) {
++			device_remove_file(&curlun->dev, &dev_attr_nofua);
++			device_remove_file(&curlun->dev, &dev_attr_ro);
++			device_remove_file(&curlun->dev, &dev_attr_file);
++			fsg_lun_close(curlun);
++			device_unregister(&curlun->dev);
++			curlun->registered = 0;
++		}
++	}
++
++	/* Free the data buffers */
++	for (i = 0; i < fsg_num_buffers; ++i)
++		kfree(fsg->buffhds[i].buf);
++
++	/* Free the request and buffer for endpoint 0 */
++	if (req) {
++		kfree(req->buf);
++		usb_ep_free_request(fsg->ep0, req);
++	}
++
++	set_gadget_data(gadget, NULL);
++}
++
++
++static int __init check_parameters(struct fsg_dev *fsg)
++{
++	int	prot;
++	int	gcnum;
++
++	/* Store the default values */
++	mod_data.transport_type = USB_PR_BULK;
++	mod_data.transport_name = "Bulk-only";
++	mod_data.protocol_type = USB_SC_SCSI;
++	mod_data.protocol_name = "Transparent SCSI";
++
++	/* Some peripheral controllers are known not to be able to
++	 * halt bulk endpoints correctly.  If one of them is present,
++	 * disable stalls.
++	 */
++	if (gadget_is_at91(fsg->gadget))
++		mod_data.can_stall = 0;
++
++	if (mod_data.release == 0xffff) {	// Parameter wasn't set
++		gcnum = usb_gadget_controller_number(fsg->gadget);
++		if (gcnum >= 0)
++			mod_data.release = 0x0300 + gcnum;
++		else {
++			WARNING(fsg, "controller '%s' not recognized\n",
++				fsg->gadget->name);
++			mod_data.release = 0x0399;
++		}
++	}
++
++	prot = simple_strtol(mod_data.protocol_parm, NULL, 0);
++
++#ifdef CONFIG_USB_FILE_STORAGE_TEST
++	if (strnicmp(mod_data.transport_parm, "BBB", 10) == 0) {
++		;		// Use default setting
++	} else if (strnicmp(mod_data.transport_parm, "CB", 10) == 0) {
++		mod_data.transport_type = USB_PR_CB;
++		mod_data.transport_name = "Control-Bulk";
++	} else if (strnicmp(mod_data.transport_parm, "CBI", 10) == 0) {
++		mod_data.transport_type = USB_PR_CBI;
++		mod_data.transport_name = "Control-Bulk-Interrupt";
++	} else {
++		ERROR(fsg, "invalid transport: %s\n", mod_data.transport_parm);
++		return -EINVAL;
++	}
++
++	if (strnicmp(mod_data.protocol_parm, "SCSI", 10) == 0 ||
++			prot == USB_SC_SCSI) {
++		;		// Use default setting
++	} else if (strnicmp(mod_data.protocol_parm, "RBC", 10) == 0 ||
++			prot == USB_SC_RBC) {
++		mod_data.protocol_type = USB_SC_RBC;
++		mod_data.protocol_name = "RBC";
++	} else if (strnicmp(mod_data.protocol_parm, "8020", 4) == 0 ||
++			strnicmp(mod_data.protocol_parm, "ATAPI", 10) == 0 ||
++			prot == USB_SC_8020) {
++		mod_data.protocol_type = USB_SC_8020;
++		mod_data.protocol_name = "8020i (ATAPI)";
++	} else if (strnicmp(mod_data.protocol_parm, "QIC", 3) == 0 ||
++			prot == USB_SC_QIC) {
++		mod_data.protocol_type = USB_SC_QIC;
++		mod_data.protocol_name = "QIC-157";
++	} else if (strnicmp(mod_data.protocol_parm, "UFI", 10) == 0 ||
++			prot == USB_SC_UFI) {
++		mod_data.protocol_type = USB_SC_UFI;
++		mod_data.protocol_name = "UFI";
++	} else if (strnicmp(mod_data.protocol_parm, "8070", 4) == 0 ||
++			prot == USB_SC_8070) {
++		mod_data.protocol_type = USB_SC_8070;
++		mod_data.protocol_name = "8070i";
++	} else {
++		ERROR(fsg, "invalid protocol: %s\n", mod_data.protocol_parm);
++		return -EINVAL;
++	}
++
++	mod_data.buflen &= PAGE_CACHE_MASK;
++	if (mod_data.buflen <= 0) {
++		ERROR(fsg, "invalid buflen\n");
++		return -ETOOSMALL;
++	}
++
++#endif /* CONFIG_USB_FILE_STORAGE_TEST */
++
++	/* Serial string handling.
++	 * On a real device, the serial string would be loaded
++	 * from permanent storage. */
++	if (mod_data.serial) {
++		const char *ch;
++		unsigned len = 0;
++
++		/* Sanity check :
++		 * The CB[I] specification limits the serial string to
++		 * 12 uppercase hexadecimal characters.
++		 * BBB need at least 12 uppercase hexadecimal characters,
++		 * with a maximum of 126. */
++		for (ch = mod_data.serial; *ch; ++ch) {
++			++len;
++			if ((*ch < '0' || *ch > '9') &&
++			    (*ch < 'A' || *ch > 'F')) { /* not uppercase hex */
++				WARNING(fsg,
++					"Invalid serial string character: %c\n",
++					*ch);
++				goto no_serial;
++			}
++		}
++		if (len > 126 ||
++		    (mod_data.transport_type == USB_PR_BULK && len < 12) ||
++		    (mod_data.transport_type != USB_PR_BULK && len > 12)) {
++			WARNING(fsg, "Invalid serial string length!\n");
++			goto no_serial;
++		}
++		fsg_strings[FSG_STRING_SERIAL - 1].s = mod_data.serial;
++	} else {
++		WARNING(fsg, "No serial-number string provided!\n");
++ no_serial:
++		device_desc.iSerialNumber = 0;
++	}
++
++	return 0;
++}
++
++
++static int __init fsg_bind(struct usb_gadget *gadget)
++{
++	struct fsg_dev		*fsg = the_fsg;
++	int			rc;
++	int			i;
++	struct fsg_lun		*curlun;
++	struct usb_ep		*ep;
++	struct usb_request	*req;
++	char			*pathbuf, *p;
++
++	fsg->gadget = gadget;
++	set_gadget_data(gadget, fsg);
++	fsg->ep0 = gadget->ep0;
++	fsg->ep0->driver_data = fsg;
++
++	if ((rc = check_parameters(fsg)) != 0)
++		goto out;
++
++	if (mod_data.removable) {	// Enable the store_xxx attributes
++		dev_attr_file.attr.mode = 0644;
++		dev_attr_file.store = fsg_store_file;
++		if (!mod_data.cdrom) {
++			dev_attr_ro.attr.mode = 0644;
++			dev_attr_ro.store = fsg_store_ro;
++		}
++	}
++
++	/* Only for removable media? */
++	dev_attr_nofua.attr.mode = 0644;
++	dev_attr_nofua.store = fsg_store_nofua;
++
++	/* Find out how many LUNs there should be */
++	i = mod_data.nluns;
++	if (i == 0)
++		i = max(mod_data.num_filenames, 1u);
++	if (i > FSG_MAX_LUNS) {
++		ERROR(fsg, "invalid number of LUNs: %d\n", i);
++		rc = -EINVAL;
++		goto out;
++	}
++
++	/* Create the LUNs, open their backing files, and register the
++	 * LUN devices in sysfs. */
++	fsg->luns = kzalloc(i * sizeof(struct fsg_lun), GFP_KERNEL);
++	if (!fsg->luns) {
++		rc = -ENOMEM;
++		goto out;
++	}
++	fsg->nluns = i;
++
++	for (i = 0; i < fsg->nluns; ++i) {
++		curlun = &fsg->luns[i];
++		curlun->cdrom = !!mod_data.cdrom;
++		curlun->ro = mod_data.cdrom || mod_data.ro[i];
++		curlun->initially_ro = curlun->ro;
++		curlun->removable = mod_data.removable;
++		curlun->nofua = mod_data.nofua[i];
++		curlun->dev.release = lun_release;
++		curlun->dev.parent = &gadget->dev;
++		curlun->dev.driver = &fsg_driver.driver;
++		dev_set_drvdata(&curlun->dev, &fsg->filesem);
++		dev_set_name(&curlun->dev,"%s-lun%d",
++			     dev_name(&gadget->dev), i);
++
++		kref_get(&fsg->ref);
++		rc = device_register(&curlun->dev);
++		if (rc) {
++			INFO(fsg, "failed to register LUN%d: %d\n", i, rc);
++			put_device(&curlun->dev);
++			goto out;
++		}
++		curlun->registered = 1;
++
++		rc = device_create_file(&curlun->dev, &dev_attr_ro);
++		if (rc)
++			goto out;
++		rc = device_create_file(&curlun->dev, &dev_attr_nofua);
++		if (rc)
++			goto out;
++		rc = device_create_file(&curlun->dev, &dev_attr_file);
++		if (rc)
++			goto out;
++
++		if (mod_data.file[i] && *mod_data.file[i]) {
++			rc = fsg_lun_open(curlun, mod_data.file[i]);
++			if (rc)
++				goto out;
++		} else if (!mod_data.removable) {
++			ERROR(fsg, "no file given for LUN%d\n", i);
++			rc = -EINVAL;
++			goto out;
++		}
++	}
++
++	/* Find all the endpoints we will use */
++	usb_ep_autoconfig_reset(gadget);
++	ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc);
++	if (!ep)
++		goto autoconf_fail;
++	ep->driver_data = fsg;		// claim the endpoint
++	fsg->bulk_in = ep;
++
++	ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc);
++	if (!ep)
++		goto autoconf_fail;
++	ep->driver_data = fsg;		// claim the endpoint
++	fsg->bulk_out = ep;
++
++	if (transport_is_cbi()) {
++		ep = usb_ep_autoconfig(gadget, &fsg_fs_intr_in_desc);
++		if (!ep)
++			goto autoconf_fail;
++		ep->driver_data = fsg;		// claim the endpoint
++		fsg->intr_in = ep;
++	}
++
++	/* Fix up the descriptors */
++	device_desc.idVendor = cpu_to_le16(mod_data.vendor);
++	device_desc.idProduct = cpu_to_le16(mod_data.product);
++	device_desc.bcdDevice = cpu_to_le16(mod_data.release);
++
++	i = (transport_is_cbi() ? 3 : 2);	// Number of endpoints
++	fsg_intf_desc.bNumEndpoints = i;
++	fsg_intf_desc.bInterfaceSubClass = mod_data.protocol_type;
++	fsg_intf_desc.bInterfaceProtocol = mod_data.transport_type;
++	fsg_fs_function[i + FSG_FS_FUNCTION_PRE_EP_ENTRIES] = NULL;
++
++	if (gadget_is_dualspeed(gadget)) {
++		fsg_hs_function[i + FSG_HS_FUNCTION_PRE_EP_ENTRIES] = NULL;
++
++		/* Assume endpoint addresses are the same for both speeds */
++		fsg_hs_bulk_in_desc.bEndpointAddress =
++			fsg_fs_bulk_in_desc.bEndpointAddress;
++		fsg_hs_bulk_out_desc.bEndpointAddress =
++			fsg_fs_bulk_out_desc.bEndpointAddress;
++		fsg_hs_intr_in_desc.bEndpointAddress =
++			fsg_fs_intr_in_desc.bEndpointAddress;
++	}
++
++	if (gadget_is_superspeed(gadget)) {
++		unsigned		max_burst;
++
++		fsg_ss_function[i + FSG_SS_FUNCTION_PRE_EP_ENTRIES] = NULL;
++
++		/* Calculate bMaxBurst, we know packet size is 1024 */
++		max_burst = min_t(unsigned, mod_data.buflen / 1024, 15);
++
++		/* Assume endpoint addresses are the same for both speeds */
++		fsg_ss_bulk_in_desc.bEndpointAddress =
++			fsg_fs_bulk_in_desc.bEndpointAddress;
++		fsg_ss_bulk_in_comp_desc.bMaxBurst = max_burst;
++
++		fsg_ss_bulk_out_desc.bEndpointAddress =
++			fsg_fs_bulk_out_desc.bEndpointAddress;
++		fsg_ss_bulk_out_comp_desc.bMaxBurst = max_burst;
++	}
++
++	if (gadget_is_otg(gadget))
++		fsg_otg_desc.bmAttributes |= USB_OTG_HNP;
++
++	rc = -ENOMEM;
++
++	/* Allocate the request and buffer for endpoint 0 */
++	fsg->ep0req = req = usb_ep_alloc_request(fsg->ep0, GFP_KERNEL);
++	if (!req)
++		goto out;
++	req->buf = kmalloc(EP0_BUFSIZE, GFP_KERNEL);
++	if (!req->buf)
++		goto out;
++	req->complete = ep0_complete;
++
++	/* Allocate the data buffers */
++	for (i = 0; i < fsg_num_buffers; ++i) {
++		struct fsg_buffhd	*bh = &fsg->buffhds[i];
++
++		/* Allocate for the bulk-in endpoint.  We assume that
++		 * the buffer will also work with the bulk-out (and
++		 * interrupt-in) endpoint. */
++		bh->buf = kmalloc(mod_data.buflen, GFP_KERNEL);
++		if (!bh->buf)
++			goto out;
++		bh->next = bh + 1;
++	}
++	fsg->buffhds[fsg_num_buffers - 1].next = &fsg->buffhds[0];
++
++	/* This should reflect the actual gadget power source */
++	usb_gadget_set_selfpowered(gadget);
++
++	snprintf(fsg_string_manufacturer, sizeof fsg_string_manufacturer,
++			"%s %s with %s",
++			init_utsname()->sysname, init_utsname()->release,
++			gadget->name);
++
++	fsg->thread_task = kthread_create(fsg_main_thread, fsg,
++			"file-storage-gadget");
++	if (IS_ERR(fsg->thread_task)) {
++		rc = PTR_ERR(fsg->thread_task);
++		goto out;
++	}
++
++	INFO(fsg, DRIVER_DESC ", version: " DRIVER_VERSION "\n");
++	INFO(fsg, "NOTE: This driver is deprecated.  "
++			"Consider using g_mass_storage instead.\n");
++	INFO(fsg, "Number of LUNs=%d\n", fsg->nluns);
++
++	pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
++	for (i = 0; i < fsg->nluns; ++i) {
++		curlun = &fsg->luns[i];
++		if (fsg_lun_is_open(curlun)) {
++			p = NULL;
++			if (pathbuf) {
++				p = d_path(&curlun->filp->f_path,
++					   pathbuf, PATH_MAX);
++				if (IS_ERR(p))
++					p = NULL;
++			}
++			LINFO(curlun, "ro=%d, nofua=%d, file: %s\n",
++			      curlun->ro, curlun->nofua, (p ? p : "(error)"));
++		}
++	}
++	kfree(pathbuf);
++
++	DBG(fsg, "transport=%s (x%02x)\n",
++			mod_data.transport_name, mod_data.transport_type);
++	DBG(fsg, "protocol=%s (x%02x)\n",
++			mod_data.protocol_name, mod_data.protocol_type);
++	DBG(fsg, "VendorID=x%04x, ProductID=x%04x, Release=x%04x\n",
++			mod_data.vendor, mod_data.product, mod_data.release);
++	DBG(fsg, "removable=%d, stall=%d, cdrom=%d, buflen=%u\n",
++			mod_data.removable, mod_data.can_stall,
++			mod_data.cdrom, mod_data.buflen);
++	DBG(fsg, "I/O thread pid: %d\n", task_pid_nr(fsg->thread_task));
++
++	set_bit(REGISTERED, &fsg->atomic_bitflags);
++
++	/* Tell the thread to start working */
++	wake_up_process(fsg->thread_task);
++	return 0;
++
++autoconf_fail:
++	ERROR(fsg, "unable to autoconfigure all endpoints\n");
++	rc = -ENOTSUPP;
++
++out:
++	fsg->state = FSG_STATE_TERMINATED;	// The thread is dead
++	fsg_unbind(gadget);
++	complete(&fsg->thread_notifier);
++	return rc;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static void fsg_suspend(struct usb_gadget *gadget)
++{
++	struct fsg_dev		*fsg = get_gadget_data(gadget);
++
++	DBG(fsg, "suspend\n");
++	set_bit(SUSPENDED, &fsg->atomic_bitflags);
++}
++
++static void fsg_resume(struct usb_gadget *gadget)
++{
++	struct fsg_dev		*fsg = get_gadget_data(gadget);
++
++	DBG(fsg, "resume\n");
++	clear_bit(SUSPENDED, &fsg->atomic_bitflags);
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static struct usb_gadget_driver		fsg_driver = {
++	.max_speed	= USB_SPEED_SUPER,
++	.function	= (char *) fsg_string_product,
++	.unbind		= fsg_unbind,
++	.disconnect	= fsg_disconnect,
++	.setup		= fsg_setup,
++	.suspend	= fsg_suspend,
++	.resume		= fsg_resume,
++
++	.driver		= {
++		.name		= DRIVER_NAME,
++		.owner		= THIS_MODULE,
++		// .release = ...
++		// .suspend = ...
++		// .resume = ...
++	},
++};
++
++
++static int __init fsg_alloc(void)
++{
++	struct fsg_dev		*fsg;
++
++	fsg = kzalloc(sizeof *fsg +
++		      fsg_num_buffers * sizeof *(fsg->buffhds), GFP_KERNEL);
++
++	if (!fsg)
++		return -ENOMEM;
++	spin_lock_init(&fsg->lock);
++	init_rwsem(&fsg->filesem);
++	kref_init(&fsg->ref);
++	init_completion(&fsg->thread_notifier);
++
++	the_fsg = fsg;
++	return 0;
++}
++
++
++static int __init fsg_init(void)
++{
++	int		rc;
++	struct fsg_dev	*fsg;
++
++	rc = fsg_num_buffers_validate();
++	if (rc != 0)
++		return rc;
++
++	if ((rc = fsg_alloc()) != 0)
++		return rc;
++	fsg = the_fsg;
++	if ((rc = usb_gadget_probe_driver(&fsg_driver, fsg_bind)) != 0)
++		kref_put(&fsg->ref, fsg_release);
++	return rc;
++}
++module_init(fsg_init);
++
++
++static void __exit fsg_cleanup(void)
++{
++	struct fsg_dev	*fsg = the_fsg;
++
++	/* Unregister the driver iff the thread hasn't already done so */
++	if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
++		usb_gadget_unregister_driver(&fsg_driver);
++
++	/* Wait for the thread to finish up */
++	wait_for_completion(&fsg->thread_notifier);
++
++	kref_put(&fsg->ref, fsg_release);
++}
++module_exit(fsg_cleanup);
+--- a/drivers/usb/host/Kconfig
++++ b/drivers/usb/host/Kconfig
+@@ -742,6 +742,16 @@ config USB_RENESAS_USBHS_HCD
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called renesas-usbhs.
+ 
++config USB_DWCOTG
++	bool "Synopsis DWC host support"
++	depends on USB && (FIQ || ARM64)
++	help
++	  The Synopsis DWC controller is a dual-role
++	  host/peripheral/OTG ("On The Go") USB controllers.
++
++	  Enable this option to support this IP in host controller mode.
++	  If unsure, say N.
++
+ config USB_HCD_BCMA
+ 	tristate "BCMA usb host driver"
+ 	depends on BCMA
+--- a/drivers/usb/host/Makefile
++++ b/drivers/usb/host/Makefile
+@@ -78,6 +78,7 @@ obj-$(CONFIG_USB_SL811_HCD)	+= sl811-hcd
+ obj-$(CONFIG_USB_SL811_CS)	+= sl811_cs.o
+ obj-$(CONFIG_USB_U132_HCD)	+= u132-hcd.o
+ obj-$(CONFIG_USB_R8A66597_HCD)	+= r8a66597-hcd.o
++obj-$(CONFIG_USB_DWCOTG)        += dwc_otg/ dwc_common_port/
+ obj-$(CONFIG_USB_FSL_USB2)	+= fsl-mph-dr-of.o
+ obj-$(CONFIG_USB_EHCI_FSL)	+= fsl-mph-dr-of.o
+ obj-$(CONFIG_USB_EHCI_FSL)	+= ehci-fsl.o
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/Makefile
+@@ -0,0 +1,58 @@
++#
++# Makefile for DWC_common library
++#
++
++ifneq ($(KERNELRELEASE),)
++
++ccflags-y	+= -DDWC_LINUX
++#ccflags-y	+= -DDEBUG
++#ccflags-y	+= -DDWC_DEBUG_REGS
++#ccflags-y	+= -DDWC_DEBUG_MEMORY
++
++ccflags-y	+= -DDWC_LIBMODULE
++ccflags-y	+= -DDWC_CCLIB
++#ccflags-y	+= -DDWC_CRYPTOLIB
++ccflags-y	+= -DDWC_NOTIFYLIB
++ccflags-y	+= -DDWC_UTFLIB
++
++obj-$(CONFIG_USB_DWCOTG)	+= dwc_common_port_lib.o
++dwc_common_port_lib-objs := dwc_cc.o dwc_modpow.o dwc_dh.o \
++			    dwc_crypto.o dwc_notifier.o \
++			    dwc_common_linux.o dwc_mem.o
++
++kernrelwd := $(subst ., ,$(KERNELRELEASE))
++kernrel3 := $(word 1,$(kernrelwd)).$(word 2,$(kernrelwd)).$(word 3,$(kernrelwd))
++
++ifneq ($(kernrel3),2.6.20)
++# grayg - I only know that we use ccflags-y in 2.6.31 actually
++ccflags-y += $(CPPFLAGS)
++endif
++
++else
++
++#ifeq ($(KDIR),)
++#$(error Must give "KDIR=/path/to/kernel/source" on command line or in environment)
++#endif
++
++ifeq ($(ARCH),)
++$(error Must give "ARCH=<arch>" on command line or in environment. Also, if \
++ cross-compiling, must give "CROSS_COMPILE=/path/to/compiler/plus/tool-prefix-")
++endif
++
++ifeq ($(DOXYGEN),)
++DOXYGEN		:= doxygen
++endif
++
++default:
++	$(MAKE) -C$(KDIR) M=$(PWD) ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) modules
++
++docs:	$(wildcard *.[hc]) doc/doxygen.cfg
++	$(DOXYGEN) doc/doxygen.cfg
++
++tags:	$(wildcard *.[hc])
++	$(CTAGS) -e $(wildcard *.[hc]) $(wildcard linux/*.[hc]) $(wildcard $(KDIR)/include/linux/usb*.h)
++
++endif
++
++clean:
++	rm -rf *.o *.ko .*.cmd *.mod.c .*.o.d .*.o.tmp modules.order Module.markers Module.symvers .tmp_versions/
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/Makefile.fbsd
+@@ -0,0 +1,17 @@
++CFLAGS	+= -I/sys/i386/compile/GENERIC -I/sys/i386/include -I/usr/include
++CFLAGS	+= -DDWC_FREEBSD
++CFLAGS	+= -DDEBUG
++#CFLAGS	+= -DDWC_DEBUG_REGS
++#CFLAGS	+= -DDWC_DEBUG_MEMORY
++
++#CFLAGS	+= -DDWC_LIBMODULE
++#CFLAGS	+= -DDWC_CCLIB
++#CFLAGS	+= -DDWC_CRYPTOLIB
++#CFLAGS	+= -DDWC_NOTIFYLIB
++#CFLAGS	+= -DDWC_UTFLIB
++
++KMOD = dwc_common_port_lib
++SRCS = dwc_cc.c dwc_modpow.c dwc_dh.c dwc_crypto.c dwc_notifier.c \
++       dwc_common_fbsd.c dwc_mem.c
++
++.include <bsd.kmod.mk>
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/Makefile.linux
+@@ -0,0 +1,49 @@
++#
++# Makefile for DWC_common library
++#
++ifneq ($(KERNELRELEASE),)
++
++ccflags-y	+= -DDWC_LINUX
++#ccflags-y	+= -DDEBUG
++#ccflags-y	+= -DDWC_DEBUG_REGS
++#ccflags-y	+= -DDWC_DEBUG_MEMORY
++
++ccflags-y	+= -DDWC_LIBMODULE
++ccflags-y	+= -DDWC_CCLIB
++ccflags-y	+= -DDWC_CRYPTOLIB
++ccflags-y	+= -DDWC_NOTIFYLIB
++ccflags-y	+= -DDWC_UTFLIB
++
++obj-m			 := dwc_common_port_lib.o
++dwc_common_port_lib-objs := dwc_cc.o dwc_modpow.o dwc_dh.o \
++			    dwc_crypto.o dwc_notifier.o \
++			    dwc_common_linux.o dwc_mem.o
++
++else
++
++ifeq ($(KDIR),)
++$(error Must give "KDIR=/path/to/kernel/source" on command line or in environment)
++endif
++
++ifeq ($(ARCH),)
++$(error Must give "ARCH=<arch>" on command line or in environment. Also, if \
++ cross-compiling, must give "CROSS_COMPILE=/path/to/compiler/plus/tool-prefix-")
++endif
++
++ifeq ($(DOXYGEN),)
++DOXYGEN		:= doxygen
++endif
++
++default:
++	$(MAKE) -C$(KDIR) M=$(PWD) ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) modules
++
++docs:	$(wildcard *.[hc]) doc/doxygen.cfg
++	$(DOXYGEN) doc/doxygen.cfg
++
++tags:	$(wildcard *.[hc])
++	$(CTAGS) -e $(wildcard *.[hc]) $(wildcard linux/*.[hc]) $(wildcard $(KDIR)/include/linux/usb*.h)
++
++endif
++
++clean:
++	rm -rf *.o *.ko .*.cmd *.mod.c .*.o.d .*.o.tmp modules.order Module.markers Module.symvers .tmp_versions/
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/changes.txt
+@@ -0,0 +1,174 @@
++
++dwc_read_reg32() and friends now take an additional parameter, a pointer to an
++IO context struct. The IO context struct should live in an os-dependent struct
++in your driver. As an example, the dwc_usb3 driver has an os-dependent struct
++named 'os_dep' embedded in the main device struct. So there these calls look
++like this:
++
++	dwc_read_reg32(&usb3_dev->os_dep.ioctx, &pcd->dev_global_regs->dcfg);
++
++	dwc_write_reg32(&usb3_dev->os_dep.ioctx,
++			&pcd->dev_global_regs->dcfg, 0);
++
++Note that for the existing Linux driver ports, it is not necessary to actually
++define the 'ioctx' member in the os-dependent struct. Since Linux does not
++require an IO context, its macros for dwc_read_reg32() and friends do not
++use the context pointer, so it is optimized away by the compiler. But it is
++necessary to add the pointer parameter to all of the call sites, to be ready
++for any future ports (such as FreeBSD) which do require an IO context.
++
++
++Similarly, dwc_alloc(), dwc_alloc_atomic(), dwc_strdup(), and dwc_free() now
++take an additional parameter, a pointer to a memory context. Examples:
++
++	addr = dwc_alloc(&usb3_dev->os_dep.memctx, size);
++
++	dwc_free(&usb3_dev->os_dep.memctx, addr);
++
++Again, for the Linux ports, it is not necessary to actually define the memctx
++member, but it is necessary to add the pointer parameter to all of the call
++sites.
++
++
++Same for dwc_dma_alloc() and dwc_dma_free(). Examples:
++
++	virt_addr = dwc_dma_alloc(&usb3_dev->os_dep.dmactx, size, &phys_addr);
++
++	dwc_dma_free(&usb3_dev->os_dep.dmactx, size, virt_addr, phys_addr);
++
++
++Same for dwc_mutex_alloc() and dwc_mutex_free(). Examples:
++
++	mutex = dwc_mutex_alloc(&usb3_dev->os_dep.mtxctx);
++
++	dwc_mutex_free(&usb3_dev->os_dep.mtxctx, mutex);
++
++
++Same for dwc_spinlock_alloc() and dwc_spinlock_free(). Examples:
++
++	lock = dwc_spinlock_alloc(&usb3_dev->osdep.splctx);
++
++	dwc_spinlock_free(&usb3_dev->osdep.splctx, lock);
++
++
++Same for dwc_timer_alloc(). Example:
++
++	timer = dwc_timer_alloc(&usb3_dev->os_dep.tmrctx, "dwc_usb3_tmr1",
++				cb_func, cb_data);
++
++
++Same for dwc_waitq_alloc(). Example:
++
++	waitq = dwc_waitq_alloc(&usb3_dev->os_dep.wtqctx);
++
++
++Same for dwc_thread_run(). Example:
++
++	thread = dwc_thread_run(&usb3_dev->os_dep.thdctx, func,
++				"dwc_usb3_thd1", data);
++
++
++Same for dwc_workq_alloc(). Example:
++
++	workq = dwc_workq_alloc(&usb3_dev->osdep.wkqctx, "dwc_usb3_wkq1");
++
++
++Same for dwc_task_alloc(). Example:
++
++	task = dwc_task_alloc(&usb3_dev->os_dep.tskctx, "dwc_usb3_tsk1",
++			      cb_func, cb_data);
++
++
++In addition to the context pointer additions, a few core functions have had
++other changes made to their parameters:
++
++The 'flags' parameter to dwc_spinlock_irqsave() and dwc_spinunlock_irqrestore()
++has been changed from a uint64_t to a dwc_irqflags_t.
++
++dwc_thread_should_stop() now takes a 'dwc_thread_t *' parameter, because the
++FreeBSD equivalent of that function requires it.
++
++And, in addition to the context pointer, dwc_task_alloc() also adds a
++'char *name' parameter, to be consistent with dwc_thread_run() and
++dwc_workq_alloc(), and because the FreeBSD equivalent of that function
++requires a unique name.
++
++
++Here is a complete list of the core functions that now take a pointer to a
++context as their first parameter:
++
++	dwc_read_reg32
++	dwc_read_reg64
++	dwc_write_reg32
++	dwc_write_reg64
++	dwc_modify_reg32
++	dwc_modify_reg64
++	dwc_alloc
++	dwc_alloc_atomic
++	dwc_strdup
++	dwc_free
++	dwc_dma_alloc
++	dwc_dma_free
++	dwc_mutex_alloc
++	dwc_mutex_free
++	dwc_spinlock_alloc
++	dwc_spinlock_free
++	dwc_timer_alloc
++	dwc_waitq_alloc
++	dwc_thread_run
++	dwc_workq_alloc
++	dwc_task_alloc     Also adds a 'char *name' as its 2nd parameter
++
++And here are the core functions that have other changes to their parameters:
++
++	dwc_spinlock_irqsave      'flags' param is now a 'dwc_irqflags_t *'
++	dwc_spinunlock_irqrestore 'flags' param is now a 'dwc_irqflags_t'
++	dwc_thread_should_stop    Adds a 'dwc_thread_t *' parameter
++
++
++
++The changes to the core functions also require some of the other library
++functions to change:
++
++	dwc_cc_if_alloc() and dwc_cc_if_free() now take a 'void *memctx'
++	(for memory allocation) as the 1st param and a 'void *mtxctx'
++	(for mutex allocation) as the 2nd param.
++
++	dwc_cc_clear(), dwc_cc_add(), dwc_cc_change(), dwc_cc_remove(),
++	dwc_cc_data_for_save(), and dwc_cc_restore_from_data() now take a
++	'void *memctx' as the 1st param.
++
++	dwc_dh_modpow(), dwc_dh_pk(), and dwc_dh_derive_keys() now take a
++	'void *memctx' as the 1st param.
++
++	dwc_modpow() now takes a 'void *memctx' as the 1st param.
++
++	dwc_alloc_notification_manager() now takes a 'void *memctx' as the
++	1st param and a 'void *wkqctx' (for work queue allocation) as the 2nd
++	param, and also now returns an integer value that is non-zero if
++	allocation of its data structures or work queue fails.
++
++	dwc_register_notifier() now takes a 'void *memctx' as the 1st param.
++
++	dwc_memory_debug_start() now takes a 'void *mem_ctx' as the first
++	param, and also now returns an integer value that is non-zero if
++	allocation of its data structures fails.
++
++
++
++Other miscellaneous changes:
++
++The DEBUG_MEMORY and DEBUG_REGS #define's have been renamed to
++DWC_DEBUG_MEMORY and DWC_DEBUG_REGS.
++
++The following #define's have been added to allow selectively compiling library
++features:
++
++	DWC_CCLIB
++	DWC_CRYPTOLIB
++	DWC_NOTIFYLIB
++	DWC_UTFLIB
++
++A DWC_LIBMODULE #define has also been added. If this is not defined, then the
++module code in dwc_common_linux.c is not compiled in. This allows linking the
++library code directly into a driver module, instead of as a standalone module.
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/doc/doxygen.cfg
+@@ -0,0 +1,270 @@
++# Doxyfile 1.4.5
++
++#---------------------------------------------------------------------------
++# Project related configuration options
++#---------------------------------------------------------------------------
++PROJECT_NAME           = "Synopsys DWC Portability and Common Library for UWB"
++PROJECT_NUMBER         =
++OUTPUT_DIRECTORY       = doc
++CREATE_SUBDIRS         = NO
++OUTPUT_LANGUAGE        = English
++BRIEF_MEMBER_DESC      = YES
++REPEAT_BRIEF           = YES
++ABBREVIATE_BRIEF       = "The $name class" \
++                         "The $name widget" \
++                         "The $name file" \
++                         is \
++                         provides \
++                         specifies \
++                         contains \
++                         represents \
++                         a \
++                         an \
++                         the
++ALWAYS_DETAILED_SEC    = YES
++INLINE_INHERITED_MEMB  = NO
++FULL_PATH_NAMES        = NO
++STRIP_FROM_PATH        = ..
++STRIP_FROM_INC_PATH    =
++SHORT_NAMES            = NO
++JAVADOC_AUTOBRIEF      = YES
++MULTILINE_CPP_IS_BRIEF = NO
++DETAILS_AT_TOP         = YES
++INHERIT_DOCS           = YES
++SEPARATE_MEMBER_PAGES  = NO
++TAB_SIZE               = 8
++ALIASES                =
++OPTIMIZE_OUTPUT_FOR_C  = YES
++OPTIMIZE_OUTPUT_JAVA   = NO
++BUILTIN_STL_SUPPORT    = NO
++DISTRIBUTE_GROUP_DOC   = NO
++SUBGROUPING            = NO
++#---------------------------------------------------------------------------
++# Build related configuration options
++#---------------------------------------------------------------------------
++EXTRACT_ALL            = NO
++EXTRACT_PRIVATE        = NO
++EXTRACT_STATIC         = YES
++EXTRACT_LOCAL_CLASSES  = NO
++EXTRACT_LOCAL_METHODS  = NO
++HIDE_UNDOC_MEMBERS     = NO
++HIDE_UNDOC_CLASSES     = NO
++HIDE_FRIEND_COMPOUNDS  = NO
++HIDE_IN_BODY_DOCS      = NO
++INTERNAL_DOCS          = NO
++CASE_SENSE_NAMES       = YES
++HIDE_SCOPE_NAMES       = NO
++SHOW_INCLUDE_FILES     = NO
++INLINE_INFO            = YES
++SORT_MEMBER_DOCS       = NO
++SORT_BRIEF_DOCS        = NO
++SORT_BY_SCOPE_NAME     = NO
++GENERATE_TODOLIST      = YES
++GENERATE_TESTLIST      = YES
++GENERATE_BUGLIST       = YES
++GENERATE_DEPRECATEDLIST= YES
++ENABLED_SECTIONS       =
++MAX_INITIALIZER_LINES  = 30
++SHOW_USED_FILES        = YES
++SHOW_DIRECTORIES       = YES
++FILE_VERSION_FILTER    =
++#---------------------------------------------------------------------------
++# configuration options related to warning and progress messages
++#---------------------------------------------------------------------------
++QUIET                  = YES
++WARNINGS               = YES
++WARN_IF_UNDOCUMENTED   = NO
++WARN_IF_DOC_ERROR      = YES
++WARN_NO_PARAMDOC       = YES
++WARN_FORMAT            = "$file:$line: $text"
++WARN_LOGFILE           =
++#---------------------------------------------------------------------------
++# configuration options related to the input files
++#---------------------------------------------------------------------------
++INPUT                  = .
++FILE_PATTERNS          = *.c \
++                         *.cc \
++                         *.cxx \
++                         *.cpp \
++                         *.c++ \
++                         *.d \
++                         *.java \
++                         *.ii \
++                         *.ixx \
++                         *.ipp \
++                         *.i++ \
++                         *.inl \
++                         *.h \
++                         *.hh \
++                         *.hxx \
++                         *.hpp \
++                         *.h++ \
++                         *.idl \
++                         *.odl \
++                         *.cs \
++                         *.php \
++                         *.php3 \
++                         *.inc \
++                         *.m \
++                         *.mm \
++                         *.dox \
++                         *.py \
++                         *.C \
++                         *.CC \
++                         *.C++ \
++                         *.II \
++                         *.I++ \
++                         *.H \
++                         *.HH \
++                         *.H++ \
++                         *.CS \
++                         *.PHP \
++                         *.PHP3 \
++                         *.M \
++                         *.MM \
++                         *.PY
++RECURSIVE              = NO
++EXCLUDE                =
++EXCLUDE_SYMLINKS       = NO
++EXCLUDE_PATTERNS       =
++EXAMPLE_PATH           =
++EXAMPLE_PATTERNS       = *
++EXAMPLE_RECURSIVE      = NO
++IMAGE_PATH             =
++INPUT_FILTER           =
++FILTER_PATTERNS        =
++FILTER_SOURCE_FILES    = NO
++#---------------------------------------------------------------------------
++# configuration options related to source browsing
++#---------------------------------------------------------------------------
++SOURCE_BROWSER         = NO
++INLINE_SOURCES         = NO
++STRIP_CODE_COMMENTS    = YES
++REFERENCED_BY_RELATION = YES
++REFERENCES_RELATION    = YES
++USE_HTAGS              = NO
++VERBATIM_HEADERS       = NO
++#---------------------------------------------------------------------------
++# configuration options related to the alphabetical class index
++#---------------------------------------------------------------------------
++ALPHABETICAL_INDEX     = NO
++COLS_IN_ALPHA_INDEX    = 5
++IGNORE_PREFIX          =
++#---------------------------------------------------------------------------
++# configuration options related to the HTML output
++#---------------------------------------------------------------------------
++GENERATE_HTML          = YES
++HTML_OUTPUT            = html
++HTML_FILE_EXTENSION    = .html
++HTML_HEADER            =
++HTML_FOOTER            =
++HTML_STYLESHEET        =
++HTML_ALIGN_MEMBERS     = YES
++GENERATE_HTMLHELP      = NO
++CHM_FILE               =
++HHC_LOCATION           =
++GENERATE_CHI           = NO
++BINARY_TOC             = NO
++TOC_EXPAND             = NO
++DISABLE_INDEX          = NO
++ENUM_VALUES_PER_LINE   = 4
++GENERATE_TREEVIEW      = YES
++TREEVIEW_WIDTH         = 250
++#---------------------------------------------------------------------------
++# configuration options related to the LaTeX output
++#---------------------------------------------------------------------------
++GENERATE_LATEX         = NO
++LATEX_OUTPUT           = latex
++LATEX_CMD_NAME         = latex
++MAKEINDEX_CMD_NAME     = makeindex
++COMPACT_LATEX          = NO
++PAPER_TYPE             = a4wide
++EXTRA_PACKAGES         =
++LATEX_HEADER           =
++PDF_HYPERLINKS         = NO
++USE_PDFLATEX           = NO
++LATEX_BATCHMODE        = NO
++LATEX_HIDE_INDICES     = NO
++#---------------------------------------------------------------------------
++# configuration options related to the RTF output
++#---------------------------------------------------------------------------
++GENERATE_RTF           = NO
++RTF_OUTPUT             = rtf
++COMPACT_RTF            = NO
++RTF_HYPERLINKS         = NO
++RTF_STYLESHEET_FILE    =
++RTF_EXTENSIONS_FILE    =
++#---------------------------------------------------------------------------
++# configuration options related to the man page output
++#---------------------------------------------------------------------------
++GENERATE_MAN           = NO
++MAN_OUTPUT             = man
++MAN_EXTENSION          = .3
++MAN_LINKS              = NO
++#---------------------------------------------------------------------------
++# configuration options related to the XML output
++#---------------------------------------------------------------------------
++GENERATE_XML           = NO
++XML_OUTPUT             = xml
++XML_SCHEMA             =
++XML_DTD                =
++XML_PROGRAMLISTING     = YES
++#---------------------------------------------------------------------------
++# configuration options for the AutoGen Definitions output
++#---------------------------------------------------------------------------
++GENERATE_AUTOGEN_DEF   = NO
++#---------------------------------------------------------------------------
++# configuration options related to the Perl module output
++#---------------------------------------------------------------------------
++GENERATE_PERLMOD       = NO
++PERLMOD_LATEX          = NO
++PERLMOD_PRETTY         = YES
++PERLMOD_MAKEVAR_PREFIX =
++#---------------------------------------------------------------------------
++# Configuration options related to the preprocessor
++#---------------------------------------------------------------------------
++ENABLE_PREPROCESSING   = YES
++MACRO_EXPANSION        = NO
++EXPAND_ONLY_PREDEF     = NO
++SEARCH_INCLUDES        = YES
++INCLUDE_PATH           =
++INCLUDE_FILE_PATTERNS  =
++PREDEFINED             = DEBUG DEBUG_MEMORY
++EXPAND_AS_DEFINED      =
++SKIP_FUNCTION_MACROS   = YES
++#---------------------------------------------------------------------------
++# Configuration::additions related to external references
++#---------------------------------------------------------------------------
++TAGFILES               =
++GENERATE_TAGFILE       =
++ALLEXTERNALS           = NO
++EXTERNAL_GROUPS        = YES
++PERL_PATH              = /usr/bin/perl
++#---------------------------------------------------------------------------
++# Configuration options related to the dot tool
++#---------------------------------------------------------------------------
++CLASS_DIAGRAMS         = YES
++HIDE_UNDOC_RELATIONS   = YES
++HAVE_DOT               = NO
++CLASS_GRAPH            = YES
++COLLABORATION_GRAPH    = YES
++GROUP_GRAPHS           = YES
++UML_LOOK               = NO
++TEMPLATE_RELATIONS     = NO
++INCLUDE_GRAPH          = NO
++INCLUDED_BY_GRAPH      = YES
++CALL_GRAPH             = NO
++GRAPHICAL_HIERARCHY    = YES
++DIRECTORY_GRAPH        = YES
++DOT_IMAGE_FORMAT       = png
++DOT_PATH               =
++DOTFILE_DIRS           =
++MAX_DOT_GRAPH_DEPTH    = 1000
++DOT_TRANSPARENT        = NO
++DOT_MULTI_TARGETS      = NO
++GENERATE_LEGEND        = YES
++DOT_CLEANUP            = YES
++#---------------------------------------------------------------------------
++# Configuration::additions related to the search engine
++#---------------------------------------------------------------------------
++SEARCHENGINE           = NO
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_cc.c
+@@ -0,0 +1,532 @@
++/* =========================================================================
++ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_cc.c $
++ * $Revision: #4 $
++ * $Date: 2010/11/04 $
++ * $Change: 1621692 $
++ *
++ * Synopsys Portability Library Software and documentation
++ * (hereinafter, "Software") is an Unsupported proprietary work of
++ * Synopsys, Inc. unless otherwise expressly agreed to in writing
++ * between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product
++ * under any End User Software License Agreement or Agreement for
++ * Licensed Product with Synopsys or any supplement thereto. You are
++ * permitted to use and redistribute this Software in source and binary
++ * forms, with or without modification, provided that redistributions
++ * of source code must retain this notice. You may not view, use,
++ * disclose, copy or distribute this file or any information contained
++ * herein except pursuant to this license grant from Synopsys. If you
++ * do not agree with this notice, including the disclaimer below, then
++ * you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
++ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
++ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
++ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
++ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
++ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================= */
++#ifdef DWC_CCLIB
++
++#include "dwc_cc.h"
++
++typedef struct dwc_cc
++{
++	uint32_t uid;
++	uint8_t chid[16];
++	uint8_t cdid[16];
++	uint8_t ck[16];
++	uint8_t *name;
++	uint8_t length;
++        DWC_CIRCLEQ_ENTRY(dwc_cc) list_entry;
++} dwc_cc_t;
++
++DWC_CIRCLEQ_HEAD(context_list, dwc_cc);
++
++/** The main structure for CC management.  */
++struct dwc_cc_if
++{
++	dwc_mutex_t *mutex;
++	char *filename;
++
++	unsigned is_host:1;
++
++	dwc_notifier_t *notifier;
++
++	struct context_list list;
++};
++
++#ifdef DEBUG
++static inline void dump_bytes(char *name, uint8_t *bytes, int len)
++{
++	int i;
++	DWC_PRINTF("%s: ", name);
++	for (i=0; i<len; i++) {
++		DWC_PRINTF("%02x ", bytes[i]);
++	}
++	DWC_PRINTF("\n");
++}
++#else
++#define dump_bytes(x...)
++#endif
++
++static dwc_cc_t *alloc_cc(void *mem_ctx, uint8_t *name, uint32_t length)
++{
++	dwc_cc_t *cc = dwc_alloc(mem_ctx, sizeof(dwc_cc_t));
++	if (!cc) {
++		return NULL;
++	}
++	DWC_MEMSET(cc, 0, sizeof(dwc_cc_t));
++
++	if (name) {
++		cc->length = length;
++		cc->name = dwc_alloc(mem_ctx, length);
++		if (!cc->name) {
++			dwc_free(mem_ctx, cc);
++			return NULL;
++		}
++
++		DWC_MEMCPY(cc->name, name, length);
++	}
++
++	return cc;
++}
++
++static void free_cc(void *mem_ctx, dwc_cc_t *cc)
++{
++	if (cc->name) {
++		dwc_free(mem_ctx, cc->name);
++	}
++	dwc_free(mem_ctx, cc);
++}
++
++static uint32_t next_uid(dwc_cc_if_t *cc_if)
++{
++	uint32_t uid = 0;
++	dwc_cc_t *cc;
++	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
++		if (cc->uid > uid) {
++			uid = cc->uid;
++		}
++	}
++
++	if (uid == 0) {
++		uid = 255;
++	}
++
++	return uid + 1;
++}
++
++static dwc_cc_t *cc_find(dwc_cc_if_t *cc_if, uint32_t uid)
++{
++	dwc_cc_t *cc;
++	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
++		if (cc->uid == uid) {
++			return cc;
++		}
++	}
++	return NULL;
++}
++
++static unsigned int cc_data_size(dwc_cc_if_t *cc_if)
++{
++	unsigned int size = 0;
++	dwc_cc_t *cc;
++	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
++		size += (48 + 1);
++		if (cc->name) {
++			size += cc->length;
++		}
++	}
++	return size;
++}
++
++static uint32_t cc_match_chid(dwc_cc_if_t *cc_if, uint8_t *chid)
++{
++	uint32_t uid = 0;
++	dwc_cc_t *cc;
++
++	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
++		if (DWC_MEMCMP(cc->chid, chid, 16) == 0) {
++			uid = cc->uid;
++			break;
++		}
++	}
++	return uid;
++}
++static uint32_t cc_match_cdid(dwc_cc_if_t *cc_if, uint8_t *cdid)
++{
++	uint32_t uid = 0;
++	dwc_cc_t *cc;
++
++	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
++		if (DWC_MEMCMP(cc->cdid, cdid, 16) == 0) {
++			uid = cc->uid;
++			break;
++		}
++	}
++	return uid;
++}
++
++/* Internal cc_add */
++static int32_t cc_add(void *mem_ctx, dwc_cc_if_t *cc_if, uint8_t *chid,
++		      uint8_t *cdid, uint8_t *ck, uint8_t *name, uint8_t length)
++{
++	dwc_cc_t *cc;
++	uint32_t uid;
++
++	if (cc_if->is_host) {
++		uid = cc_match_cdid(cc_if, cdid);
++	}
++	else {
++		uid = cc_match_chid(cc_if, chid);
++	}
++
++	if (uid) {
++		DWC_DEBUGC("Replacing previous connection context id=%d name=%p name_len=%d", uid, name, length);
++		cc = cc_find(cc_if, uid);
++	}
++	else {
++		cc = alloc_cc(mem_ctx, name, length);
++		cc->uid = next_uid(cc_if);
++		DWC_CIRCLEQ_INSERT_TAIL(&cc_if->list, cc, list_entry);
++	}
++
++	DWC_MEMCPY(&(cc->chid[0]), chid, 16);
++	DWC_MEMCPY(&(cc->cdid[0]), cdid, 16);
++	DWC_MEMCPY(&(cc->ck[0]), ck, 16);
++
++	DWC_DEBUGC("Added connection context id=%d name=%p name_len=%d", cc->uid, name, length);
++	dump_bytes("CHID", cc->chid, 16);
++	dump_bytes("CDID", cc->cdid, 16);
++	dump_bytes("CK", cc->ck, 16);
++	return cc->uid;
++}
++
++/* Internal cc_clear */
++static void cc_clear(void *mem_ctx, dwc_cc_if_t *cc_if)
++{
++	while (!DWC_CIRCLEQ_EMPTY(&cc_if->list)) {
++		dwc_cc_t *cc = DWC_CIRCLEQ_FIRST(&cc_if->list);
++		DWC_CIRCLEQ_REMOVE_INIT(&cc_if->list, cc, list_entry);
++		free_cc(mem_ctx, cc);
++	}
++}
++
++dwc_cc_if_t *dwc_cc_if_alloc(void *mem_ctx, void *mtx_ctx,
++			     dwc_notifier_t *notifier, unsigned is_host)
++{
++	dwc_cc_if_t *cc_if = NULL;
++
++	/* Allocate a common_cc_if structure */
++	cc_if = dwc_alloc(mem_ctx, sizeof(dwc_cc_if_t));
++
++	if (!cc_if)
++		return NULL;
++
++#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES))
++	DWC_MUTEX_ALLOC_LINUX_DEBUG(cc_if->mutex);
++#else
++	cc_if->mutex = dwc_mutex_alloc(mtx_ctx);
++#endif
++	if (!cc_if->mutex) {
++		dwc_free(mem_ctx, cc_if);
++		return NULL;
++	}
++
++	DWC_CIRCLEQ_INIT(&cc_if->list);
++	cc_if->is_host = is_host;
++	cc_if->notifier = notifier;
++	return cc_if;
++}
++
++void dwc_cc_if_free(void *mem_ctx, void *mtx_ctx, dwc_cc_if_t *cc_if)
++{
++#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES))
++	DWC_MUTEX_FREE(cc_if->mutex);
++#else
++	dwc_mutex_free(mtx_ctx, cc_if->mutex);
++#endif
++	cc_clear(mem_ctx, cc_if);
++	dwc_free(mem_ctx, cc_if);
++}
++
++static void cc_changed(dwc_cc_if_t *cc_if)
++{
++	if (cc_if->notifier) {
++		dwc_notify(cc_if->notifier, DWC_CC_LIST_CHANGED_NOTIFICATION, cc_if);
++	}
++}
++
++void dwc_cc_clear(void *mem_ctx, dwc_cc_if_t *cc_if)
++{
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	cc_clear(mem_ctx, cc_if);
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++	cc_changed(cc_if);
++}
++
++int32_t dwc_cc_add(void *mem_ctx, dwc_cc_if_t *cc_if, uint8_t *chid,
++		   uint8_t *cdid, uint8_t *ck, uint8_t *name, uint8_t length)
++{
++	uint32_t uid;
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	uid = cc_add(mem_ctx, cc_if, chid, cdid, ck, name, length);
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++	cc_changed(cc_if);
++
++	return uid;
++}
++
++void dwc_cc_change(void *mem_ctx, dwc_cc_if_t *cc_if, int32_t id, uint8_t *chid,
++		   uint8_t *cdid, uint8_t *ck, uint8_t *name, uint8_t length)
++{
++	dwc_cc_t* cc;
++
++	DWC_DEBUGC("Change connection context %d", id);
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	cc = cc_find(cc_if, id);
++	if (!cc) {
++		DWC_ERROR("Uid %d not found in cc list\n", id);
++		DWC_MUTEX_UNLOCK(cc_if->mutex);
++		return;
++	}
++
++	if (chid) {
++		DWC_MEMCPY(&(cc->chid[0]), chid, 16);
++	}
++	if (cdid) {
++		DWC_MEMCPY(&(cc->cdid[0]), cdid, 16);
++	}
++	if (ck) {
++		DWC_MEMCPY(&(cc->ck[0]), ck, 16);
++	}
++
++	if (name) {
++		if (cc->name) {
++			dwc_free(mem_ctx, cc->name);
++		}
++		cc->name = dwc_alloc(mem_ctx, length);
++		if (!cc->name) {
++			DWC_ERROR("Out of memory in dwc_cc_change()\n");
++			DWC_MUTEX_UNLOCK(cc_if->mutex);
++			return;
++		}
++		cc->length = length;
++		DWC_MEMCPY(cc->name, name, length);
++	}
++
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++
++	cc_changed(cc_if);
++
++	DWC_DEBUGC("Changed connection context id=%d\n", id);
++	dump_bytes("New CHID", cc->chid, 16);
++	dump_bytes("New CDID", cc->cdid, 16);
++	dump_bytes("New CK", cc->ck, 16);
++}
++
++void dwc_cc_remove(void *mem_ctx, dwc_cc_if_t *cc_if, int32_t id)
++{
++	dwc_cc_t *cc;
++
++	DWC_DEBUGC("Removing connection context %d", id);
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	cc = cc_find(cc_if, id);
++	if (!cc) {
++		DWC_ERROR("Uid %d not found in cc list\n", id);
++		DWC_MUTEX_UNLOCK(cc_if->mutex);
++		return;
++	}
++
++	DWC_CIRCLEQ_REMOVE_INIT(&cc_if->list, cc, list_entry);
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++	free_cc(mem_ctx, cc);
++
++	cc_changed(cc_if);
++}
++
++uint8_t *dwc_cc_data_for_save(void *mem_ctx, dwc_cc_if_t *cc_if, unsigned int *length)
++{
++	uint8_t *buf, *x;
++	uint8_t zero = 0;
++	dwc_cc_t *cc;
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	*length = cc_data_size(cc_if);
++	if (!(*length)) {
++		DWC_MUTEX_UNLOCK(cc_if->mutex);
++		return NULL;
++	}
++
++	DWC_DEBUGC("Creating data for saving (length=%d)", *length);
++
++	buf = dwc_alloc(mem_ctx, *length);
++	if (!buf) {
++		*length = 0;
++		DWC_MUTEX_UNLOCK(cc_if->mutex);
++		return NULL;
++	}
++
++	x = buf;
++	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
++		DWC_MEMCPY(x, cc->chid, 16);
++		x += 16;
++		DWC_MEMCPY(x, cc->cdid, 16);
++		x += 16;
++		DWC_MEMCPY(x, cc->ck, 16);
++		x += 16;
++		if (cc->name) {
++			DWC_MEMCPY(x, &cc->length, 1);
++			x += 1;
++			DWC_MEMCPY(x, cc->name, cc->length);
++			x += cc->length;
++		}
++		else {
++			DWC_MEMCPY(x, &zero, 1);
++			x += 1;
++		}
++	}
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++
++	return buf;
++}
++
++void dwc_cc_restore_from_data(void *mem_ctx, dwc_cc_if_t *cc_if, uint8_t *data, uint32_t length)
++{
++	uint8_t name_length;
++	uint8_t *name;
++	uint8_t *chid;
++	uint8_t *cdid;
++	uint8_t *ck;
++	uint32_t i = 0;
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	cc_clear(mem_ctx, cc_if);
++
++	while (i < length) {
++		chid = &data[i];
++		i += 16;
++		cdid = &data[i];
++		i += 16;
++		ck = &data[i];
++		i += 16;
++
++		name_length = data[i];
++		i ++;
++
++		if (name_length) {
++			name = &data[i];
++			i += name_length;
++		}
++		else {
++			name = NULL;
++		}
++
++		/* check to see if we haven't overflown the buffer */
++		if (i > length) {
++			DWC_ERROR("Data format error while attempting to load CCs "
++				  "(nlen=%d, iter=%d, buflen=%d).\n", name_length, i, length);
++			break;
++		}
++
++		cc_add(mem_ctx, cc_if, chid, cdid, ck, name, name_length);
++	}
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++
++	cc_changed(cc_if);
++}
++
++uint32_t dwc_cc_match_chid(dwc_cc_if_t *cc_if, uint8_t *chid)
++{
++	uint32_t uid = 0;
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	uid = cc_match_chid(cc_if, chid);
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++	return uid;
++}
++uint32_t dwc_cc_match_cdid(dwc_cc_if_t *cc_if, uint8_t *cdid)
++{
++	uint32_t uid = 0;
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	uid = cc_match_cdid(cc_if, cdid);
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++	return uid;
++}
++
++uint8_t *dwc_cc_ck(dwc_cc_if_t *cc_if, int32_t id)
++{
++	uint8_t *ck = NULL;
++	dwc_cc_t *cc;
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	cc = cc_find(cc_if, id);
++	if (cc) {
++		ck = cc->ck;
++	}
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++
++	return ck;
++
++}
++
++uint8_t *dwc_cc_chid(dwc_cc_if_t *cc_if, int32_t id)
++{
++	uint8_t *retval = NULL;
++	dwc_cc_t *cc;
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	cc = cc_find(cc_if, id);
++	if (cc) {
++		retval = cc->chid;
++	}
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++
++	return retval;
++}
++
++uint8_t *dwc_cc_cdid(dwc_cc_if_t *cc_if, int32_t id)
++{
++	uint8_t *retval = NULL;
++	dwc_cc_t *cc;
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	cc = cc_find(cc_if, id);
++	if (cc) {
++		retval = cc->cdid;
++	}
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++
++	return retval;
++}
++
++uint8_t *dwc_cc_name(dwc_cc_if_t *cc_if, int32_t id, uint8_t *length)
++{
++	uint8_t *retval = NULL;
++	dwc_cc_t *cc;
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	*length = 0;
++	cc = cc_find(cc_if, id);
++	if (cc) {
++		*length = cc->length;
++		retval = cc->name;
++	}
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++
++	return retval;
++}
++
++#endif	/* DWC_CCLIB */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_cc.h
+@@ -0,0 +1,224 @@
++/* =========================================================================
++ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_cc.h $
++ * $Revision: #4 $
++ * $Date: 2010/09/28 $
++ * $Change: 1596182 $
++ *
++ * Synopsys Portability Library Software and documentation
++ * (hereinafter, "Software") is an Unsupported proprietary work of
++ * Synopsys, Inc. unless otherwise expressly agreed to in writing
++ * between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product
++ * under any End User Software License Agreement or Agreement for
++ * Licensed Product with Synopsys or any supplement thereto. You are
++ * permitted to use and redistribute this Software in source and binary
++ * forms, with or without modification, provided that redistributions
++ * of source code must retain this notice. You may not view, use,
++ * disclose, copy or distribute this file or any information contained
++ * herein except pursuant to this license grant from Synopsys. If you
++ * do not agree with this notice, including the disclaimer below, then
++ * you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
++ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
++ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
++ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
++ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
++ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================= */
++#ifndef _DWC_CC_H_
++#define _DWC_CC_H_
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++/** @file
++ *
++ * This file defines the Context Context library.
++ *
++ * The main data structure is dwc_cc_if_t which is returned by either the
++ * dwc_cc_if_alloc function or returned by the module to the user via a provided
++ * function. The data structure is opaque and should only be manipulated via the
++ * functions provied in this API.
++ *
++ * It manages a list of connection contexts and operations can be performed to
++ * add, remove, query, search, and change, those contexts.  Additionally,
++ * a dwc_notifier_t object can be requested from the manager so that
++ * the user can be notified whenever the context list has changed.
++ */
++
++#include "dwc_os.h"
++#include "dwc_list.h"
++#include "dwc_notifier.h"
++
++
++/* Notifications */
++#define DWC_CC_LIST_CHANGED_NOTIFICATION "DWC_CC_LIST_CHANGED_NOTIFICATION"
++
++struct dwc_cc_if;
++typedef struct dwc_cc_if dwc_cc_if_t;
++
++
++/** @name Connection Context Operations */
++/** @{ */
++
++/** This function allocates memory for a dwc_cc_if_t structure, initializes
++ * fields to default values, and returns a pointer to the structure or NULL on
++ * error. */
++extern dwc_cc_if_t *dwc_cc_if_alloc(void *mem_ctx, void *mtx_ctx,
++				    dwc_notifier_t *notifier, unsigned is_host);
++
++/** Frees the memory for the specified CC structure allocated from
++ * dwc_cc_if_alloc(). */
++extern void dwc_cc_if_free(void *mem_ctx, void *mtx_ctx, dwc_cc_if_t *cc_if);
++
++/** Removes all contexts from the connection context list */
++extern void dwc_cc_clear(void *mem_ctx, dwc_cc_if_t *cc_if);
++
++/** Adds a connection context (CHID, CK, CDID, Name) to the connection context list.
++ * If a CHID already exists, the CK and name are overwritten.  Statistics are
++ * not overwritten.
++ *
++ * @param cc_if The cc_if structure.
++ * @param chid A pointer to the 16-byte CHID.  This value will be copied.
++ * @param ck A pointer to the 16-byte CK.  This value will be copied.
++ * @param cdid A pointer to the 16-byte CDID.  This value will be copied.
++ * @param name An optional host friendly name as defined in the association model
++ * spec.  Must be a UTF16-LE unicode string.  Can be NULL to indicated no name.
++ * @param length The length othe unicode string.
++ * @return A unique identifier used to refer to this context that is valid for
++ * as long as this context is still in the list. */
++extern int32_t dwc_cc_add(void *mem_ctx, dwc_cc_if_t *cc_if, uint8_t *chid,
++			  uint8_t *cdid, uint8_t *ck, uint8_t *name,
++			  uint8_t length);
++
++/** Changes the CHID, CK, CDID, or Name values of a connection context in the
++ * list, preserving any accumulated statistics.  This would typically be called
++ * if the host decideds to change the context with a SET_CONNECTION request.
++ *
++ * @param cc_if The cc_if structure.
++ * @param id The identifier of the connection context.
++ * @param chid A pointer to the 16-byte CHID.  This value will be copied.  NULL
++ * indicates no change.
++ * @param cdid A pointer to the 16-byte CDID.  This value will be copied.  NULL
++ * indicates no change.
++ * @param ck A pointer to the 16-byte CK.  This value will be copied.  NULL
++ * indicates no change.
++ * @param name Host friendly name UTF16-LE.  NULL indicates no change.
++ * @param length Length of name. */
++extern void dwc_cc_change(void *mem_ctx, dwc_cc_if_t *cc_if, int32_t id,
++			  uint8_t *chid, uint8_t *cdid, uint8_t *ck,
++			  uint8_t *name, uint8_t length);
++
++/** Remove the specified connection context.
++ * @param cc_if The cc_if structure.
++ * @param id The identifier of the connection context to remove. */
++extern void dwc_cc_remove(void *mem_ctx, dwc_cc_if_t *cc_if, int32_t id);
++
++/** Get a binary block of data for the connection context list and attributes.
++ * This data can be used by the OS specific driver to save the connection
++ * context list into non-volatile memory.
++ *
++ * @param cc_if The cc_if structure.
++ * @param length Return the length of the data buffer.
++ * @return A pointer to the data buffer.  The memory for this buffer should be
++ * freed with DWC_FREE() after use. */
++extern uint8_t *dwc_cc_data_for_save(void *mem_ctx, dwc_cc_if_t *cc_if,
++				     unsigned int *length);
++
++/** Restore the connection context list from the binary data that was previously
++ * returned from a call to dwc_cc_data_for_save.  This can be used by the OS specific
++ * driver to load a connection context list from non-volatile memory.
++ *
++ * @param cc_if The cc_if structure.
++ * @param data The data bytes as returned from dwc_cc_data_for_save.
++ * @param length The length of the data. */
++extern void dwc_cc_restore_from_data(void *mem_ctx, dwc_cc_if_t *cc_if,
++				     uint8_t *data, unsigned int length);
++
++/** Find the connection context from the specified CHID.
++ *
++ * @param cc_if The cc_if structure.
++ * @param chid A pointer to the CHID data.
++ * @return A non-zero identifier of the connection context if the CHID matches.
++ * Otherwise returns 0. */
++extern uint32_t dwc_cc_match_chid(dwc_cc_if_t *cc_if, uint8_t *chid);
++
++/** Find the connection context from the specified CDID.
++ *
++ * @param cc_if The cc_if structure.
++ * @param cdid A pointer to the CDID data.
++ * @return A non-zero identifier of the connection context if the CHID matches.
++ * Otherwise returns 0. */
++extern uint32_t dwc_cc_match_cdid(dwc_cc_if_t *cc_if, uint8_t *cdid);
++
++/** Retrieve the CK from the specified connection context.
++ *
++ * @param cc_if The cc_if structure.
++ * @param id The identifier of the connection context.
++ * @return A pointer to the CK data.  The memory does not need to be freed. */
++extern uint8_t *dwc_cc_ck(dwc_cc_if_t *cc_if, int32_t id);
++
++/** Retrieve the CHID from the specified connection context.
++ *
++ * @param cc_if The cc_if structure.
++ * @param id The identifier of the connection context.
++ * @return A pointer to the CHID data.  The memory does not need to be freed. */
++extern uint8_t *dwc_cc_chid(dwc_cc_if_t *cc_if, int32_t id);
++
++/** Retrieve the CDID from the specified connection context.
++ *
++ * @param cc_if The cc_if structure.
++ * @param id The identifier of the connection context.
++ * @return A pointer to the CDID data.  The memory does not need to be freed. */
++extern uint8_t *dwc_cc_cdid(dwc_cc_if_t *cc_if, int32_t id);
++
++extern uint8_t *dwc_cc_name(dwc_cc_if_t *cc_if, int32_t id, uint8_t *length);
++
++/** Checks a buffer for non-zero.
++ * @param id A pointer to a 16 byte buffer.
++ * @return true if the 16 byte value is non-zero. */
++static inline unsigned dwc_assoc_is_not_zero_id(uint8_t *id) {
++	int i;
++	for (i=0; i<16; i++) {
++		if (id[i]) return 1;
++	}
++	return 0;
++}
++
++/** Checks a buffer for zero.
++ * @param id A pointer to a 16 byte buffer.
++ * @return true if the 16 byte value is zero. */
++static inline unsigned dwc_assoc_is_zero_id(uint8_t *id) {
++	return !dwc_assoc_is_not_zero_id(id);
++}
++
++/** Prints an ASCII representation for the 16-byte chid, cdid, or ck, into
++ * buffer. */
++static inline int dwc_print_id_string(char *buffer, uint8_t *id) {
++	char *ptr = buffer;
++	int i;
++	for (i=0; i<16; i++) {
++		ptr += DWC_SPRINTF(ptr, "%02x", id[i]);
++		if (i < 15) {
++			ptr += DWC_SPRINTF(ptr, " ");
++		}
++	}
++	return ptr - buffer;
++}
++
++/** @} */
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _DWC_CC_H_ */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_common_fbsd.c
+@@ -0,0 +1,1308 @@
++#include "dwc_os.h"
++#include "dwc_list.h"
++
++#ifdef DWC_CCLIB
++# include "dwc_cc.h"
++#endif
++
++#ifdef DWC_CRYPTOLIB
++# include "dwc_modpow.h"
++# include "dwc_dh.h"
++# include "dwc_crypto.h"
++#endif
++
++#ifdef DWC_NOTIFYLIB
++# include "dwc_notifier.h"
++#endif
++
++/* OS-Level Implementations */
++
++/* This is the FreeBSD 7.0 kernel implementation of the DWC platform library. */
++
++
++/* MISC */
++
++void *DWC_MEMSET(void *dest, uint8_t byte, uint32_t size)
++{
++	return memset(dest, byte, size);
++}
++
++void *DWC_MEMCPY(void *dest, void const *src, uint32_t size)
++{
++	return memcpy(dest, src, size);
++}
++
++void *DWC_MEMMOVE(void *dest, void *src, uint32_t size)
++{
++	bcopy(src, dest, size);
++	return dest;
++}
++
++int DWC_MEMCMP(void *m1, void *m2, uint32_t size)
++{
++	return memcmp(m1, m2, size);
++}
++
++int DWC_STRNCMP(void *s1, void *s2, uint32_t size)
++{
++	return strncmp(s1, s2, size);
++}
++
++int DWC_STRCMP(void *s1, void *s2)
++{
++	return strcmp(s1, s2);
++}
++
++int DWC_STRLEN(char const *str)
++{
++	return strlen(str);
++}
++
++char *DWC_STRCPY(char *to, char const *from)
++{
++	return strcpy(to, from);
++}
++
++char *DWC_STRDUP(char const *str)
++{
++	int len = DWC_STRLEN(str) + 1;
++	char *new = DWC_ALLOC_ATOMIC(len);
++
++	if (!new) {
++		return NULL;
++	}
++
++	DWC_MEMCPY(new, str, len);
++	return new;
++}
++
++int DWC_ATOI(char *str, int32_t *value)
++{
++	char *end = NULL;
++
++	*value = strtol(str, &end, 0);
++	if (*end == '\0') {
++		return 0;
++	}
++
++	return -1;
++}
++
++int DWC_ATOUI(char *str, uint32_t *value)
++{
++	char *end = NULL;
++
++	*value = strtoul(str, &end, 0);
++	if (*end == '\0') {
++		return 0;
++	}
++
++	return -1;
++}
++
++
++#ifdef DWC_UTFLIB
++/* From usbstring.c */
++
++int DWC_UTF8_TO_UTF16LE(uint8_t const *s, uint16_t *cp, unsigned len)
++{
++	int	count = 0;
++	u8	c;
++	u16	uchar;
++
++	/* this insists on correct encodings, though not minimal ones.
++	 * BUT it currently rejects legit 4-byte UTF-8 code points,
++	 * which need surrogate pairs.  (Unicode 3.1 can use them.)
++	 */
++	while (len != 0 && (c = (u8) *s++) != 0) {
++		if (unlikely(c & 0x80)) {
++			// 2-byte sequence:
++			// 00000yyyyyxxxxxx = 110yyyyy 10xxxxxx
++			if ((c & 0xe0) == 0xc0) {
++				uchar = (c & 0x1f) << 6;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c;
++
++			// 3-byte sequence (most CJKV characters):
++			// zzzzyyyyyyxxxxxx = 1110zzzz 10yyyyyy 10xxxxxx
++			} else if ((c & 0xf0) == 0xe0) {
++				uchar = (c & 0x0f) << 12;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c << 6;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c;
++
++				/* no bogus surrogates */
++				if (0xd800 <= uchar && uchar <= 0xdfff)
++					goto fail;
++
++			// 4-byte sequence (surrogate pairs, currently rare):
++			// 11101110wwwwzzzzyy + 110111yyyyxxxxxx
++			//     = 11110uuu 10uuzzzz 10yyyyyy 10xxxxxx
++			// (uuuuu = wwww + 1)
++			// FIXME accept the surrogate code points (only)
++			} else
++				goto fail;
++		} else
++			uchar = c;
++		put_unaligned (cpu_to_le16 (uchar), cp++);
++		count++;
++		len--;
++	}
++	return count;
++fail:
++	return -1;
++}
++
++#endif	/* DWC_UTFLIB */
++
++
++/* dwc_debug.h */
++
++dwc_bool_t DWC_IN_IRQ(void)
++{
++//	return in_irq();
++	return 0;
++}
++
++dwc_bool_t DWC_IN_BH(void)
++{
++//	return in_softirq();
++	return 0;
++}
++
++void DWC_VPRINTF(char *format, va_list args)
++{
++	vprintf(format, args);
++}
++
++int DWC_VSNPRINTF(char *str, int size, char *format, va_list args)
++{
++	return vsnprintf(str, size, format, args);
++}
++
++void DWC_PRINTF(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++
++int DWC_SPRINTF(char *buffer, char *format, ...)
++{
++	int retval;
++	va_list args;
++
++	va_start(args, format);
++	retval = vsprintf(buffer, format, args);
++	va_end(args);
++	return retval;
++}
++
++int DWC_SNPRINTF(char *buffer, int size, char *format, ...)
++{
++	int retval;
++	va_list args;
++
++	va_start(args, format);
++	retval = vsnprintf(buffer, size, format, args);
++	va_end(args);
++	return retval;
++}
++
++void __DWC_WARN(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++
++void __DWC_ERROR(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++
++void DWC_EXCEPTION(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++//	BUG_ON(1);	???
++}
++
++#ifdef DEBUG
++void __DWC_DEBUG(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++#endif
++
++
++/* dwc_mem.h */
++
++#if 0
++dwc_pool_t *DWC_DMA_POOL_CREATE(uint32_t size,
++				uint32_t align,
++				uint32_t alloc)
++{
++	struct dma_pool *pool = dma_pool_create("Pool", NULL,
++						size, align, alloc);
++	return (dwc_pool_t *)pool;
++}
++
++void DWC_DMA_POOL_DESTROY(dwc_pool_t *pool)
++{
++	dma_pool_destroy((struct dma_pool *)pool);
++}
++
++void *DWC_DMA_POOL_ALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
++{
++//	return dma_pool_alloc((struct dma_pool *)pool, GFP_KERNEL, dma_addr);
++	return dma_pool_alloc((struct dma_pool *)pool, M_WAITOK, dma_addr);
++}
++
++void *DWC_DMA_POOL_ZALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
++{
++	void *vaddr = DWC_DMA_POOL_ALLOC(pool, dma_addr);
++	memset(..);
++}
++
++void DWC_DMA_POOL_FREE(dwc_pool_t *pool, void *vaddr, void *daddr)
++{
++	dma_pool_free(pool, vaddr, daddr);
++}
++#endif
++
++static void dmamap_cb(void *arg, bus_dma_segment_t *segs, int nseg, int error)
++{
++	if (error)
++		return;
++	*(bus_addr_t *)arg = segs[0].ds_addr;
++}
++
++void *__DWC_DMA_ALLOC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr)
++{
++	dwc_dmactx_t *dma = (dwc_dmactx_t *)dma_ctx;
++	int error;
++
++	error = bus_dma_tag_create(
++#if __FreeBSD_version >= 700000
++			bus_get_dma_tag(dma->dev),	/* parent */
++#else
++			NULL,				/* parent */
++#endif
++			4, 0,				/* alignment, bounds */
++			BUS_SPACE_MAXADDR_32BIT,	/* lowaddr */
++			BUS_SPACE_MAXADDR,		/* highaddr */
++			NULL, NULL,			/* filter, filterarg */
++			size,				/* maxsize */
++			1,				/* nsegments */
++			size,				/* maxsegsize */
++			0,				/* flags */
++			NULL,				/* lockfunc */
++			NULL,				/* lockarg */
++			&dma->dma_tag);
++	if (error) {
++		device_printf(dma->dev, "%s: bus_dma_tag_create failed: %d\n",
++			      __func__, error);
++		goto fail_0;
++	}
++
++	error = bus_dmamem_alloc(dma->dma_tag, &dma->dma_vaddr,
++				 BUS_DMA_NOWAIT | BUS_DMA_COHERENT, &dma->dma_map);
++	if (error) {
++		device_printf(dma->dev, "%s: bus_dmamem_alloc(%ju) failed: %d\n",
++			      __func__, (uintmax_t)size, error);
++		goto fail_1;
++	}
++
++	dma->dma_paddr = 0;
++	error = bus_dmamap_load(dma->dma_tag, dma->dma_map, dma->dma_vaddr, size,
++				dmamap_cb, &dma->dma_paddr, BUS_DMA_NOWAIT);
++	if (error || dma->dma_paddr == 0) {
++		device_printf(dma->dev, "%s: bus_dmamap_load failed: %d\n",
++			      __func__, error);
++		goto fail_2;
++	}
++
++	*dma_addr = dma->dma_paddr;
++	return dma->dma_vaddr;
++
++fail_2:
++	bus_dmamap_unload(dma->dma_tag, dma->dma_map);
++fail_1:
++	bus_dmamem_free(dma->dma_tag, dma->dma_vaddr, dma->dma_map);
++	bus_dma_tag_destroy(dma->dma_tag);
++fail_0:
++	dma->dma_map = NULL;
++	dma->dma_tag = NULL;
++
++	return NULL;
++}
++
++void __DWC_DMA_FREE(void *dma_ctx, uint32_t size, void *virt_addr, dwc_dma_t dma_addr)
++{
++	dwc_dmactx_t *dma = (dwc_dmactx_t *)dma_ctx;
++
++	if (dma->dma_tag == NULL)
++		return;
++	if (dma->dma_map != NULL) {
++		bus_dmamap_sync(dma->dma_tag, dma->dma_map,
++				BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
++		bus_dmamap_unload(dma->dma_tag, dma->dma_map);
++		bus_dmamem_free(dma->dma_tag, dma->dma_vaddr, dma->dma_map);
++		dma->dma_map = NULL;
++	}
++
++	bus_dma_tag_destroy(dma->dma_tag);
++	dma->dma_tag = NULL;
++}
++
++void *__DWC_ALLOC(void *mem_ctx, uint32_t size)
++{
++	return malloc(size, M_DEVBUF, M_WAITOK | M_ZERO);
++}
++
++void *__DWC_ALLOC_ATOMIC(void *mem_ctx, uint32_t size)
++{
++	return malloc(size, M_DEVBUF, M_NOWAIT | M_ZERO);
++}
++
++void __DWC_FREE(void *mem_ctx, void *addr)
++{
++	free(addr, M_DEVBUF);
++}
++
++
++#ifdef DWC_CRYPTOLIB
++/* dwc_crypto.h */
++
++void DWC_RANDOM_BYTES(uint8_t *buffer, uint32_t length)
++{
++	get_random_bytes(buffer, length);
++}
++
++int DWC_AES_CBC(uint8_t *message, uint32_t messagelen, uint8_t *key, uint32_t keylen, uint8_t iv[16], uint8_t *out)
++{
++	struct crypto_blkcipher *tfm;
++	struct blkcipher_desc desc;
++	struct scatterlist sgd;
++	struct scatterlist sgs;
++
++	tfm = crypto_alloc_blkcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC);
++	if (tfm == NULL) {
++		printk("failed to load transform for aes CBC\n");
++		return -1;
++	}
++
++	crypto_blkcipher_setkey(tfm, key, keylen);
++	crypto_blkcipher_set_iv(tfm, iv, 16);
++
++	sg_init_one(&sgd, out, messagelen);
++	sg_init_one(&sgs, message, messagelen);
++
++	desc.tfm = tfm;
++	desc.flags = 0;
++
++	if (crypto_blkcipher_encrypt(&desc, &sgd, &sgs, messagelen)) {
++		crypto_free_blkcipher(tfm);
++		DWC_ERROR("AES CBC encryption failed");
++		return -1;
++	}
++
++	crypto_free_blkcipher(tfm);
++	return 0;
++}
++
++int DWC_SHA256(uint8_t *message, uint32_t len, uint8_t *out)
++{
++	struct crypto_hash *tfm;
++	struct hash_desc desc;
++	struct scatterlist sg;
++
++	tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
++	if (IS_ERR(tfm)) {
++		DWC_ERROR("Failed to load transform for sha256: %ld", PTR_ERR(tfm));
++		return 0;
++	}
++	desc.tfm = tfm;
++	desc.flags = 0;
++
++	sg_init_one(&sg, message, len);
++	crypto_hash_digest(&desc, &sg, len, out);
++	crypto_free_hash(tfm);
++
++	return 1;
++}
++
++int DWC_HMAC_SHA256(uint8_t *message, uint32_t messagelen,
++		    uint8_t *key, uint32_t keylen, uint8_t *out)
++{
++	struct crypto_hash *tfm;
++	struct hash_desc desc;
++	struct scatterlist sg;
++
++	tfm = crypto_alloc_hash("hmac(sha256)", 0, CRYPTO_ALG_ASYNC);
++	if (IS_ERR(tfm)) {
++		DWC_ERROR("Failed to load transform for hmac(sha256): %ld", PTR_ERR(tfm));
++		return 0;
++	}
++	desc.tfm = tfm;
++	desc.flags = 0;
++
++	sg_init_one(&sg, message, messagelen);
++	crypto_hash_setkey(tfm, key, keylen);
++	crypto_hash_digest(&desc, &sg, messagelen, out);
++	crypto_free_hash(tfm);
++
++	return 1;
++}
++
++#endif	/* DWC_CRYPTOLIB */
++
++
++/* Byte Ordering Conversions */
++
++uint32_t DWC_CPU_TO_LE32(uint32_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint32_t DWC_CPU_TO_BE32(uint32_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint32_t DWC_LE32_TO_CPU(uint32_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint32_t DWC_BE32_TO_CPU(uint32_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint16_t DWC_CPU_TO_LE16(uint16_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++uint16_t DWC_CPU_TO_BE16(uint16_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++uint16_t DWC_LE16_TO_CPU(uint16_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++uint16_t DWC_BE16_TO_CPU(uint16_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++
++/* Registers */
++
++uint32_t DWC_READ_REG32(void *io_ctx, uint32_t volatile *reg)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	return bus_space_read_4(io->iot, io->ioh, ior);
++}
++
++#if 0
++uint64_t DWC_READ_REG64(void *io_ctx, uint64_t volatile *reg)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	return bus_space_read_8(io->iot, io->ioh, ior);
++}
++#endif
++
++void DWC_WRITE_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t value)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	bus_space_write_4(io->iot, io->ioh, ior, value);
++}
++
++#if 0
++void DWC_WRITE_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t value)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	bus_space_write_8(io->iot, io->ioh, ior, value);
++}
++#endif
++
++void DWC_MODIFY_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t clear_mask,
++		      uint32_t set_mask)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	bus_space_write_4(io->iot, io->ioh, ior,
++			  (bus_space_read_4(io->iot, io->ioh, ior) &
++			   ~clear_mask) | set_mask);
++}
++
++#if 0
++void DWC_MODIFY_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t clear_mask,
++		      uint64_t set_mask)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	bus_space_write_8(io->iot, io->ioh, ior,
++			  (bus_space_read_8(io->iot, io->ioh, ior) &
++			   ~clear_mask) | set_mask);
++}
++#endif
++
++
++/* Locking */
++
++dwc_spinlock_t *DWC_SPINLOCK_ALLOC(void)
++{
++	struct mtx *sl = DWC_ALLOC(sizeof(*sl));
++
++	if (!sl) {
++		DWC_ERROR("Cannot allocate memory for spinlock");
++		return NULL;
++	}
++
++	mtx_init(sl, "dw3spn", NULL, MTX_SPIN);
++	return (dwc_spinlock_t *)sl;
++}
++
++void DWC_SPINLOCK_FREE(dwc_spinlock_t *lock)
++{
++	struct mtx *sl = (struct mtx *)lock;
++
++	mtx_destroy(sl);
++	DWC_FREE(sl);
++}
++
++void DWC_SPINLOCK(dwc_spinlock_t *lock)
++{
++	mtx_lock_spin((struct mtx *)lock);	// ???
++}
++
++void DWC_SPINUNLOCK(dwc_spinlock_t *lock)
++{
++	mtx_unlock_spin((struct mtx *)lock);	// ???
++}
++
++void DWC_SPINLOCK_IRQSAVE(dwc_spinlock_t *lock, dwc_irqflags_t *flags)
++{
++	mtx_lock_spin((struct mtx *)lock);
++}
++
++void DWC_SPINUNLOCK_IRQRESTORE(dwc_spinlock_t *lock, dwc_irqflags_t flags)
++{
++	mtx_unlock_spin((struct mtx *)lock);
++}
++
++dwc_mutex_t *DWC_MUTEX_ALLOC(void)
++{
++	struct mtx *m;
++	dwc_mutex_t *mutex = (dwc_mutex_t *)DWC_ALLOC(sizeof(struct mtx));
++
++	if (!mutex) {
++		DWC_ERROR("Cannot allocate memory for mutex");
++		return NULL;
++	}
++
++	m = (struct mtx *)mutex;
++	mtx_init(m, "dw3mtx", NULL, MTX_DEF);
++	return mutex;
++}
++
++#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES))
++#else
++void DWC_MUTEX_FREE(dwc_mutex_t *mutex)
++{
++	mtx_destroy((struct mtx *)mutex);
++	DWC_FREE(mutex);
++}
++#endif
++
++void DWC_MUTEX_LOCK(dwc_mutex_t *mutex)
++{
++	struct mtx *m = (struct mtx *)mutex;
++
++	mtx_lock(m);
++}
++
++int DWC_MUTEX_TRYLOCK(dwc_mutex_t *mutex)
++{
++	struct mtx *m = (struct mtx *)mutex;
++
++	return mtx_trylock(m);
++}
++
++void DWC_MUTEX_UNLOCK(dwc_mutex_t *mutex)
++{
++	struct mtx *m = (struct mtx *)mutex;
++
++	mtx_unlock(m);
++}
++
++
++/* Timing */
++
++void DWC_UDELAY(uint32_t usecs)
++{
++	DELAY(usecs);
++}
++
++void DWC_MDELAY(uint32_t msecs)
++{
++	do {
++		DELAY(1000);
++	} while (--msecs);
++}
++
++void DWC_MSLEEP(uint32_t msecs)
++{
++	struct timeval tv;
++
++	tv.tv_sec = msecs / 1000;
++	tv.tv_usec = (msecs - tv.tv_sec * 1000) * 1000;
++	pause("dw3slp", tvtohz(&tv));
++}
++
++uint32_t DWC_TIME(void)
++{
++	struct timeval tv;
++
++	microuptime(&tv);	// or getmicrouptime? (less precise, but faster)
++	return tv.tv_sec * 1000 + tv.tv_usec / 1000;
++}
++
++
++/* Timers */
++
++struct dwc_timer {
++	struct callout t;
++	char *name;
++	dwc_spinlock_t *lock;
++	dwc_timer_callback_t cb;
++	void *data;
++};
++
++dwc_timer_t *DWC_TIMER_ALLOC(char *name, dwc_timer_callback_t cb, void *data)
++{
++	dwc_timer_t *t = DWC_ALLOC(sizeof(*t));
++
++	if (!t) {
++		DWC_ERROR("Cannot allocate memory for timer");
++		return NULL;
++	}
++
++	callout_init(&t->t, 1);
++
++	t->name = DWC_STRDUP(name);
++	if (!t->name) {
++		DWC_ERROR("Cannot allocate memory for timer->name");
++		goto no_name;
++	}
++
++	t->lock = DWC_SPINLOCK_ALLOC();
++	if (!t->lock) {
++		DWC_ERROR("Cannot allocate memory for lock");
++		goto no_lock;
++	}
++
++	t->cb = cb;
++	t->data = data;
++
++	return t;
++
++ no_lock:
++	DWC_FREE(t->name);
++ no_name:
++	DWC_FREE(t);
++
++	return NULL;
++}
++
++void DWC_TIMER_FREE(dwc_timer_t *timer)
++{
++	callout_stop(&timer->t);
++	DWC_SPINLOCK_FREE(timer->lock);
++	DWC_FREE(timer->name);
++	DWC_FREE(timer);
++}
++
++void DWC_TIMER_SCHEDULE(dwc_timer_t *timer, uint32_t time)
++{
++	struct timeval tv;
++
++	tv.tv_sec = time / 1000;
++	tv.tv_usec = (time - tv.tv_sec * 1000) * 1000;
++	callout_reset(&timer->t, tvtohz(&tv), timer->cb, timer->data);
++}
++
++void DWC_TIMER_CANCEL(dwc_timer_t *timer)
++{
++	callout_stop(&timer->t);
++}
++
++
++/* Wait Queues */
++
++struct dwc_waitq {
++	struct mtx lock;
++	int abort;
++};
++
++dwc_waitq_t *DWC_WAITQ_ALLOC(void)
++{
++	dwc_waitq_t *wq = DWC_ALLOC(sizeof(*wq));
++
++	if (!wq) {
++		DWC_ERROR("Cannot allocate memory for waitqueue");
++		return NULL;
++	}
++
++	mtx_init(&wq->lock, "dw3wtq", NULL, MTX_DEF);
++	wq->abort = 0;
++
++	return wq;
++}
++
++void DWC_WAITQ_FREE(dwc_waitq_t *wq)
++{
++	mtx_destroy(&wq->lock);
++	DWC_FREE(wq);
++}
++
++int32_t DWC_WAITQ_WAIT(dwc_waitq_t *wq, dwc_waitq_condition_t cond, void *data)
++{
++//	intrmask_t ipl;
++	int result = 0;
++
++	mtx_lock(&wq->lock);
++//	ipl = splbio();
++
++	/* Skip the sleep if already aborted or triggered */
++	if (!wq->abort && !cond(data)) {
++//		splx(ipl);
++		result = msleep(wq, &wq->lock, PCATCH, "dw3wat", 0); // infinite timeout
++//		ipl = splbio();
++	}
++
++	if (result == ERESTART) {	// signaled - restart
++		result = -DWC_E_RESTART;
++
++	} else if (result == EINTR) {	// signaled - interrupt
++		result = -DWC_E_ABORT;
++
++	} else if (wq->abort) {
++		result = -DWC_E_ABORT;
++
++	} else {
++		result = 0;
++	}
++
++	wq->abort = 0;
++//	splx(ipl);
++	mtx_unlock(&wq->lock);
++	return result;
++}
++
++int32_t DWC_WAITQ_WAIT_TIMEOUT(dwc_waitq_t *wq, dwc_waitq_condition_t cond,
++			       void *data, int32_t msecs)
++{
++	struct timeval tv, tv1, tv2;
++//	intrmask_t ipl;
++	int result = 0;
++
++	tv.tv_sec = msecs / 1000;
++	tv.tv_usec = (msecs - tv.tv_sec * 1000) * 1000;
++
++	mtx_lock(&wq->lock);
++//	ipl = splbio();
++
++	/* Skip the sleep if already aborted or triggered */
++	if (!wq->abort && !cond(data)) {
++//		splx(ipl);
++		getmicrouptime(&tv1);
++		result = msleep(wq, &wq->lock, PCATCH, "dw3wto", tvtohz(&tv));
++		getmicrouptime(&tv2);
++//		ipl = splbio();
++	}
++
++	if (result == 0) {			// awoken
++		if (wq->abort) {
++			result = -DWC_E_ABORT;
++		} else {
++			tv2.tv_usec -= tv1.tv_usec;
++			if (tv2.tv_usec < 0) {
++				tv2.tv_usec += 1000000;
++				tv2.tv_sec--;
++			}
++
++			tv2.tv_sec -= tv1.tv_sec;
++			result = tv2.tv_sec * 1000 + tv2.tv_usec / 1000;
++			result = msecs - result;
++			if (result <= 0)
++				result = 1;
++		}
++	} else if (result == ERESTART) {	// signaled - restart
++		result = -DWC_E_RESTART;
++
++	} else if (result == EINTR) {		// signaled - interrupt
++		result = -DWC_E_ABORT;
++
++	} else {				// timed out
++		result = -DWC_E_TIMEOUT;
++	}
++
++	wq->abort = 0;
++//	splx(ipl);
++	mtx_unlock(&wq->lock);
++	return result;
++}
++
++void DWC_WAITQ_TRIGGER(dwc_waitq_t *wq)
++{
++	wakeup(wq);
++}
++
++void DWC_WAITQ_ABORT(dwc_waitq_t *wq)
++{
++//	intrmask_t ipl;
++
++	mtx_lock(&wq->lock);
++//	ipl = splbio();
++	wq->abort = 1;
++	wakeup(wq);
++//	splx(ipl);
++	mtx_unlock(&wq->lock);
++}
++
++
++/* Threading */
++
++struct dwc_thread {
++	struct proc *proc;
++	int abort;
++};
++
++dwc_thread_t *DWC_THREAD_RUN(dwc_thread_function_t func, char *name, void *data)
++{
++	int retval;
++	dwc_thread_t *thread = DWC_ALLOC(sizeof(*thread));
++
++	if (!thread) {
++		return NULL;
++	}
++
++	thread->abort = 0;
++	retval = kthread_create((void (*)(void *))func, data, &thread->proc,
++				RFPROC | RFNOWAIT, 0, "%s", name);
++	if (retval) {
++		DWC_FREE(thread);
++		return NULL;
++	}
++
++	return thread;
++}
++
++int DWC_THREAD_STOP(dwc_thread_t *thread)
++{
++	int retval;
++
++	thread->abort = 1;
++	retval = tsleep(&thread->abort, 0, "dw3stp", 60 * hz);
++
++	if (retval == 0) {
++		/* DWC_THREAD_EXIT() will free the thread struct */
++		return 0;
++	}
++
++	/* NOTE: We leak the thread struct if thread doesn't die */
++
++	if (retval == EWOULDBLOCK) {
++		return -DWC_E_TIMEOUT;
++	}
++
++	return -DWC_E_UNKNOWN;
++}
++
++dwc_bool_t DWC_THREAD_SHOULD_STOP(dwc_thread_t *thread)
++{
++	return thread->abort;
++}
++
++void DWC_THREAD_EXIT(dwc_thread_t *thread)
++{
++	wakeup(&thread->abort);
++	DWC_FREE(thread);
++	kthread_exit(0);
++}
++
++
++/* tasklets
++ - Runs in interrupt context (cannot sleep)
++ - Each tasklet runs on a single CPU [ How can we ensure this on FreeBSD? Does it matter? ]
++ - Different tasklets can be running simultaneously on different CPUs [ shouldn't matter ]
++ */
++struct dwc_tasklet {
++	struct task t;
++	dwc_tasklet_callback_t cb;
++	void *data;
++};
++
++static void tasklet_callback(void *data, int pending)	// what to do with pending ???
++{
++	dwc_tasklet_t *task = (dwc_tasklet_t *)data;
++
++	task->cb(task->data);
++}
++
++dwc_tasklet_t *DWC_TASK_ALLOC(char *name, dwc_tasklet_callback_t cb, void *data)
++{
++	dwc_tasklet_t *task = DWC_ALLOC(sizeof(*task));
++
++	if (task) {
++		task->cb = cb;
++		task->data = data;
++		TASK_INIT(&task->t, 0, tasklet_callback, task);
++	} else {
++		DWC_ERROR("Cannot allocate memory for tasklet");
++	}
++
++	return task;
++}
++
++void DWC_TASK_FREE(dwc_tasklet_t *task)
++{
++	taskqueue_drain(taskqueue_fast, &task->t);	// ???
++	DWC_FREE(task);
++}
++
++void DWC_TASK_SCHEDULE(dwc_tasklet_t *task)
++{
++	/* Uses predefined system queue */
++	taskqueue_enqueue_fast(taskqueue_fast, &task->t);
++}
++
++
++/* workqueues
++ - Runs in process context (can sleep)
++ */
++typedef struct work_container {
++	dwc_work_callback_t cb;
++	void *data;
++	dwc_workq_t *wq;
++	char *name;
++	int hz;
++
++#ifdef DEBUG
++	DWC_CIRCLEQ_ENTRY(work_container) entry;
++#endif
++	struct task task;
++} work_container_t;
++
++#ifdef DEBUG
++DWC_CIRCLEQ_HEAD(work_container_queue, work_container);
++#endif
++
++struct dwc_workq {
++	struct taskqueue *taskq;
++	dwc_spinlock_t *lock;
++	dwc_waitq_t *waitq;
++	int pending;
++
++#ifdef DEBUG
++	struct work_container_queue entries;
++#endif
++};
++
++static void do_work(void *data, int pending)	// what to do with pending ???
++{
++	work_container_t *container = (work_container_t *)data;
++	dwc_workq_t *wq = container->wq;
++	dwc_irqflags_t flags;
++
++	if (container->hz) {
++		pause("dw3wrk", container->hz);
++	}
++
++	container->cb(container->data);
++	DWC_DEBUG("Work done: %s, container=%p", container->name, container);
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++
++#ifdef DEBUG
++	DWC_CIRCLEQ_REMOVE(&wq->entries, container, entry);
++#endif
++	if (container->name)
++		DWC_FREE(container->name);
++	DWC_FREE(container);
++	wq->pending--;
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++	DWC_WAITQ_TRIGGER(wq->waitq);
++}
++
++static int work_done(void *data)
++{
++	dwc_workq_t *workq = (dwc_workq_t *)data;
++
++	return workq->pending == 0;
++}
++
++int DWC_WORKQ_WAIT_WORK_DONE(dwc_workq_t *workq, int timeout)
++{
++	return DWC_WAITQ_WAIT_TIMEOUT(workq->waitq, work_done, workq, timeout);
++}
++
++dwc_workq_t *DWC_WORKQ_ALLOC(char *name)
++{
++	dwc_workq_t *wq = DWC_ALLOC(sizeof(*wq));
++
++	if (!wq) {
++		DWC_ERROR("Cannot allocate memory for workqueue");
++		return NULL;
++	}
++
++	wq->taskq = taskqueue_create(name, M_NOWAIT, taskqueue_thread_enqueue, &wq->taskq);
++	if (!wq->taskq) {
++		DWC_ERROR("Cannot allocate memory for taskqueue");
++		goto no_taskq;
++	}
++
++	wq->pending = 0;
++
++	wq->lock = DWC_SPINLOCK_ALLOC();
++	if (!wq->lock) {
++		DWC_ERROR("Cannot allocate memory for spinlock");
++		goto no_lock;
++	}
++
++	wq->waitq = DWC_WAITQ_ALLOC();
++	if (!wq->waitq) {
++		DWC_ERROR("Cannot allocate memory for waitqueue");
++		goto no_waitq;
++	}
++
++	taskqueue_start_threads(&wq->taskq, 1, PWAIT, "%s taskq", "dw3tsk");
++
++#ifdef DEBUG
++	DWC_CIRCLEQ_INIT(&wq->entries);
++#endif
++	return wq;
++
++ no_waitq:
++	DWC_SPINLOCK_FREE(wq->lock);
++ no_lock:
++	taskqueue_free(wq->taskq);
++ no_taskq:
++	DWC_FREE(wq);
++
++	return NULL;
++}
++
++void DWC_WORKQ_FREE(dwc_workq_t *wq)
++{
++#ifdef DEBUG
++	dwc_irqflags_t flags;
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++
++	if (wq->pending != 0) {
++		struct work_container *container;
++
++		DWC_ERROR("Destroying work queue with pending work");
++
++		DWC_CIRCLEQ_FOREACH(container, &wq->entries, entry) {
++			DWC_ERROR("Work %s still pending", container->name);
++		}
++	}
++
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++#endif
++	DWC_WAITQ_FREE(wq->waitq);
++	DWC_SPINLOCK_FREE(wq->lock);
++	taskqueue_free(wq->taskq);
++	DWC_FREE(wq);
++}
++
++void DWC_WORKQ_SCHEDULE(dwc_workq_t *wq, dwc_work_callback_t cb, void *data,
++			char *format, ...)
++{
++	dwc_irqflags_t flags;
++	work_container_t *container;
++	static char name[128];
++	va_list args;
++
++	va_start(args, format);
++	DWC_VSNPRINTF(name, 128, format, args);
++	va_end(args);
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++	wq->pending++;
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++	DWC_WAITQ_TRIGGER(wq->waitq);
++
++	container = DWC_ALLOC_ATOMIC(sizeof(*container));
++	if (!container) {
++		DWC_ERROR("Cannot allocate memory for container");
++		return;
++	}
++
++	container->name = DWC_STRDUP(name);
++	if (!container->name) {
++		DWC_ERROR("Cannot allocate memory for container->name");
++		DWC_FREE(container);
++		return;
++	}
++
++	container->cb = cb;
++	container->data = data;
++	container->wq = wq;
++	container->hz = 0;
++
++	DWC_DEBUG("Queueing work: %s, container=%p", container->name, container);
++
++	TASK_INIT(&container->task, 0, do_work, container);
++
++#ifdef DEBUG
++	DWC_CIRCLEQ_INSERT_TAIL(&wq->entries, container, entry);
++#endif
++	taskqueue_enqueue_fast(wq->taskq, &container->task);
++}
++
++void DWC_WORKQ_SCHEDULE_DELAYED(dwc_workq_t *wq, dwc_work_callback_t cb,
++				void *data, uint32_t time, char *format, ...)
++{
++	dwc_irqflags_t flags;
++	work_container_t *container;
++	static char name[128];
++	struct timeval tv;
++	va_list args;
++
++	va_start(args, format);
++	DWC_VSNPRINTF(name, 128, format, args);
++	va_end(args);
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++	wq->pending++;
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++	DWC_WAITQ_TRIGGER(wq->waitq);
++
++	container = DWC_ALLOC_ATOMIC(sizeof(*container));
++	if (!container) {
++		DWC_ERROR("Cannot allocate memory for container");
++		return;
++	}
++
++	container->name = DWC_STRDUP(name);
++	if (!container->name) {
++		DWC_ERROR("Cannot allocate memory for container->name");
++		DWC_FREE(container);
++		return;
++	}
++
++	container->cb = cb;
++	container->data = data;
++	container->wq = wq;
++
++	tv.tv_sec = time / 1000;
++	tv.tv_usec = (time - tv.tv_sec * 1000) * 1000;
++	container->hz = tvtohz(&tv);
++
++	DWC_DEBUG("Queueing work: %s, container=%p", container->name, container);
++
++	TASK_INIT(&container->task, 0, do_work, container);
++
++#ifdef DEBUG
++	DWC_CIRCLEQ_INSERT_TAIL(&wq->entries, container, entry);
++#endif
++	taskqueue_enqueue_fast(wq->taskq, &container->task);
++}
++
++int DWC_WORKQ_PENDING(dwc_workq_t *wq)
++{
++	return wq->pending;
++}
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_common_linux.c
+@@ -0,0 +1,1409 @@
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/kthread.h>
++
++#ifdef DWC_CCLIB
++# include "dwc_cc.h"
++#endif
++
++#ifdef DWC_CRYPTOLIB
++# include "dwc_modpow.h"
++# include "dwc_dh.h"
++# include "dwc_crypto.h"
++#endif
++
++#ifdef DWC_NOTIFYLIB
++# include "dwc_notifier.h"
++#endif
++
++/* OS-Level Implementations */
++
++/* This is the Linux kernel implementation of the DWC platform library. */
++#include <linux/moduleparam.h>
++#include <linux/ctype.h>
++#include <linux/crypto.h>
++#include <linux/delay.h>
++#include <linux/device.h>
++#include <linux/dma-mapping.h>
++#include <linux/cdev.h>
++#include <linux/errno.h>
++#include <linux/interrupt.h>
++#include <linux/jiffies.h>
++#include <linux/list.h>
++#include <linux/pci.h>
++#include <linux/random.h>
++#include <linux/scatterlist.h>
++#include <linux/slab.h>
++#include <linux/stat.h>
++#include <linux/string.h>
++#include <linux/timer.h>
++#include <linux/usb.h>
++
++#include <linux/version.h>
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24)
++# include <linux/usb/gadget.h>
++#else
++# include <linux/usb_gadget.h>
++#endif
++
++#include <asm/io.h>
++#include <asm/page.h>
++#include <asm/uaccess.h>
++#include <asm/unaligned.h>
++
++#include "dwc_os.h"
++#include "dwc_list.h"
++
++
++/* MISC */
++
++void *DWC_MEMSET(void *dest, uint8_t byte, uint32_t size)
++{
++	return memset(dest, byte, size);
++}
++
++void *DWC_MEMCPY(void *dest, void const *src, uint32_t size)
++{
++	return memcpy(dest, src, size);
++}
++
++void *DWC_MEMMOVE(void *dest, void *src, uint32_t size)
++{
++	return memmove(dest, src, size);
++}
++
++int DWC_MEMCMP(void *m1, void *m2, uint32_t size)
++{
++	return memcmp(m1, m2, size);
++}
++
++int DWC_STRNCMP(void *s1, void *s2, uint32_t size)
++{
++	return strncmp(s1, s2, size);
++}
++
++int DWC_STRCMP(void *s1, void *s2)
++{
++	return strcmp(s1, s2);
++}
++
++int DWC_STRLEN(char const *str)
++{
++	return strlen(str);
++}
++
++char *DWC_STRCPY(char *to, char const *from)
++{
++	return strcpy(to, from);
++}
++
++char *DWC_STRDUP(char const *str)
++{
++	int len = DWC_STRLEN(str) + 1;
++	char *new = DWC_ALLOC_ATOMIC(len);
++
++	if (!new) {
++		return NULL;
++	}
++
++	DWC_MEMCPY(new, str, len);
++	return new;
++}
++
++int DWC_ATOI(const char *str, int32_t *value)
++{
++	char *end = NULL;
++
++	*value = simple_strtol(str, &end, 0);
++	if (*end == '\0') {
++		return 0;
++	}
++
++	return -1;
++}
++
++int DWC_ATOUI(const char *str, uint32_t *value)
++{
++	char *end = NULL;
++
++	*value = simple_strtoul(str, &end, 0);
++	if (*end == '\0') {
++		return 0;
++	}
++
++	return -1;
++}
++
++
++#ifdef DWC_UTFLIB
++/* From usbstring.c */
++
++int DWC_UTF8_TO_UTF16LE(uint8_t const *s, uint16_t *cp, unsigned len)
++{
++	int	count = 0;
++	u8	c;
++	u16	uchar;
++
++	/* this insists on correct encodings, though not minimal ones.
++	 * BUT it currently rejects legit 4-byte UTF-8 code points,
++	 * which need surrogate pairs.  (Unicode 3.1 can use them.)
++	 */
++	while (len != 0 && (c = (u8) *s++) != 0) {
++		if (unlikely(c & 0x80)) {
++			// 2-byte sequence:
++			// 00000yyyyyxxxxxx = 110yyyyy 10xxxxxx
++			if ((c & 0xe0) == 0xc0) {
++				uchar = (c & 0x1f) << 6;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c;
++
++			// 3-byte sequence (most CJKV characters):
++			// zzzzyyyyyyxxxxxx = 1110zzzz 10yyyyyy 10xxxxxx
++			} else if ((c & 0xf0) == 0xe0) {
++				uchar = (c & 0x0f) << 12;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c << 6;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c;
++
++				/* no bogus surrogates */
++				if (0xd800 <= uchar && uchar <= 0xdfff)
++					goto fail;
++
++			// 4-byte sequence (surrogate pairs, currently rare):
++			// 11101110wwwwzzzzyy + 110111yyyyxxxxxx
++			//     = 11110uuu 10uuzzzz 10yyyyyy 10xxxxxx
++			// (uuuuu = wwww + 1)
++			// FIXME accept the surrogate code points (only)
++			} else
++				goto fail;
++		} else
++			uchar = c;
++		put_unaligned (cpu_to_le16 (uchar), cp++);
++		count++;
++		len--;
++	}
++	return count;
++fail:
++	return -1;
++}
++#endif	/* DWC_UTFLIB */
++
++
++/* dwc_debug.h */
++
++dwc_bool_t DWC_IN_IRQ(void)
++{
++	return in_irq();
++}
++
++dwc_bool_t DWC_IN_BH(void)
++{
++	return in_softirq();
++}
++
++void DWC_VPRINTF(char *format, va_list args)
++{
++	vprintk(format, args);
++}
++
++int DWC_VSNPRINTF(char *str, int size, char *format, va_list args)
++{
++	return vsnprintf(str, size, format, args);
++}
++
++void DWC_PRINTF(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++
++int DWC_SPRINTF(char *buffer, char *format, ...)
++{
++	int retval;
++	va_list args;
++
++	va_start(args, format);
++	retval = vsprintf(buffer, format, args);
++	va_end(args);
++	return retval;
++}
++
++int DWC_SNPRINTF(char *buffer, int size, char *format, ...)
++{
++	int retval;
++	va_list args;
++
++	va_start(args, format);
++	retval = vsnprintf(buffer, size, format, args);
++	va_end(args);
++	return retval;
++}
++
++void __DWC_WARN(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_PRINTF(KERN_WARNING);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++
++void __DWC_ERROR(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_PRINTF(KERN_ERR);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++
++void DWC_EXCEPTION(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_PRINTF(KERN_ERR);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++	BUG_ON(1);
++}
++
++#ifdef DEBUG
++void __DWC_DEBUG(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_PRINTF(KERN_DEBUG);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++#endif
++
++
++/* dwc_mem.h */
++
++#if 0
++dwc_pool_t *DWC_DMA_POOL_CREATE(uint32_t size,
++				uint32_t align,
++				uint32_t alloc)
++{
++	struct dma_pool *pool = dma_pool_create("Pool", NULL,
++						size, align, alloc);
++	return (dwc_pool_t *)pool;
++}
++
++void DWC_DMA_POOL_DESTROY(dwc_pool_t *pool)
++{
++	dma_pool_destroy((struct dma_pool *)pool);
++}
++
++void *DWC_DMA_POOL_ALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
++{
++	return dma_pool_alloc((struct dma_pool *)pool, GFP_KERNEL, dma_addr);
++}
++
++void *DWC_DMA_POOL_ZALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
++{
++	void *vaddr = DWC_DMA_POOL_ALLOC(pool, dma_addr);
++	memset(..);
++}
++
++void DWC_DMA_POOL_FREE(dwc_pool_t *pool, void *vaddr, void *daddr)
++{
++	dma_pool_free(pool, vaddr, daddr);
++}
++#endif
++
++void *__DWC_DMA_ALLOC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr)
++{
++	return dma_alloc_coherent(dma_ctx, size, dma_addr, GFP_KERNEL | GFP_DMA32);
++}
++
++void *__DWC_DMA_ALLOC_ATOMIC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr)
++{
++	return dma_alloc_coherent(dma_ctx, size, dma_addr, GFP_ATOMIC);
++}
++
++void __DWC_DMA_FREE(void *dma_ctx, uint32_t size, void *virt_addr, dwc_dma_t dma_addr)
++{
++	dma_free_coherent(dma_ctx, size, virt_addr, dma_addr);
++}
++
++void *__DWC_ALLOC(void *mem_ctx, uint32_t size)
++{
++	return kzalloc(size, GFP_KERNEL);
++}
++
++void *__DWC_ALLOC_ATOMIC(void *mem_ctx, uint32_t size)
++{
++	return kzalloc(size, GFP_ATOMIC);
++}
++
++void __DWC_FREE(void *mem_ctx, void *addr)
++{
++	kfree(addr);
++}
++
++
++#ifdef DWC_CRYPTOLIB
++/* dwc_crypto.h */
++
++void DWC_RANDOM_BYTES(uint8_t *buffer, uint32_t length)
++{
++	get_random_bytes(buffer, length);
++}
++
++int DWC_AES_CBC(uint8_t *message, uint32_t messagelen, uint8_t *key, uint32_t keylen, uint8_t iv[16], uint8_t *out)
++{
++	struct crypto_blkcipher *tfm;
++	struct blkcipher_desc desc;
++	struct scatterlist sgd;
++	struct scatterlist sgs;
++
++	tfm = crypto_alloc_blkcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC);
++	if (tfm == NULL) {
++		printk("failed to load transform for aes CBC\n");
++		return -1;
++	}
++
++	crypto_blkcipher_setkey(tfm, key, keylen);
++	crypto_blkcipher_set_iv(tfm, iv, 16);
++
++	sg_init_one(&sgd, out, messagelen);
++	sg_init_one(&sgs, message, messagelen);
++
++	desc.tfm = tfm;
++	desc.flags = 0;
++
++	if (crypto_blkcipher_encrypt(&desc, &sgd, &sgs, messagelen)) {
++		crypto_free_blkcipher(tfm);
++		DWC_ERROR("AES CBC encryption failed");
++		return -1;
++	}
++
++	crypto_free_blkcipher(tfm);
++	return 0;
++}
++
++int DWC_SHA256(uint8_t *message, uint32_t len, uint8_t *out)
++{
++	struct crypto_hash *tfm;
++	struct hash_desc desc;
++	struct scatterlist sg;
++
++	tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
++	if (IS_ERR(tfm)) {
++		DWC_ERROR("Failed to load transform for sha256: %ld\n", PTR_ERR(tfm));
++		return 0;
++	}
++	desc.tfm = tfm;
++	desc.flags = 0;
++
++	sg_init_one(&sg, message, len);
++	crypto_hash_digest(&desc, &sg, len, out);
++	crypto_free_hash(tfm);
++
++	return 1;
++}
++
++int DWC_HMAC_SHA256(uint8_t *message, uint32_t messagelen,
++		    uint8_t *key, uint32_t keylen, uint8_t *out)
++{
++	struct crypto_hash *tfm;
++	struct hash_desc desc;
++	struct scatterlist sg;
++
++	tfm = crypto_alloc_hash("hmac(sha256)", 0, CRYPTO_ALG_ASYNC);
++	if (IS_ERR(tfm)) {
++		DWC_ERROR("Failed to load transform for hmac(sha256): %ld\n", PTR_ERR(tfm));
++		return 0;
++	}
++	desc.tfm = tfm;
++	desc.flags = 0;
++
++	sg_init_one(&sg, message, messagelen);
++	crypto_hash_setkey(tfm, key, keylen);
++	crypto_hash_digest(&desc, &sg, messagelen, out);
++	crypto_free_hash(tfm);
++
++	return 1;
++}
++#endif	/* DWC_CRYPTOLIB */
++
++
++/* Byte Ordering Conversions */
++
++uint32_t DWC_CPU_TO_LE32(uint32_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint32_t DWC_CPU_TO_BE32(uint32_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint32_t DWC_LE32_TO_CPU(uint32_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint32_t DWC_BE32_TO_CPU(uint32_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint16_t DWC_CPU_TO_LE16(uint16_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++uint16_t DWC_CPU_TO_BE16(uint16_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++uint16_t DWC_LE16_TO_CPU(uint16_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++uint16_t DWC_BE16_TO_CPU(uint16_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++
++/* Registers */
++
++uint32_t DWC_READ_REG32(uint32_t volatile *reg)
++{
++	return readl(reg);
++}
++
++#if 0
++uint64_t DWC_READ_REG64(uint64_t volatile *reg)
++{
++}
++#endif
++
++void DWC_WRITE_REG32(uint32_t volatile *reg, uint32_t value)
++{
++	writel(value, reg);
++}
++
++#if 0
++void DWC_WRITE_REG64(uint64_t volatile *reg, uint64_t value)
++{
++}
++#endif
++
++void DWC_MODIFY_REG32(uint32_t volatile *reg, uint32_t clear_mask, uint32_t set_mask)
++{
++	writel((readl(reg) & ~clear_mask) | set_mask, reg);
++}
++
++#if 0
++void DWC_MODIFY_REG64(uint64_t volatile *reg, uint64_t clear_mask, uint64_t set_mask)
++{
++}
++#endif
++
++
++/* Locking */
++
++dwc_spinlock_t *DWC_SPINLOCK_ALLOC(void)
++{
++	spinlock_t *sl = (spinlock_t *)1;
++
++#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
++	sl = DWC_ALLOC(sizeof(*sl));
++	if (!sl) {
++		DWC_ERROR("Cannot allocate memory for spinlock\n");
++		return NULL;
++	}
++
++	spin_lock_init(sl);
++#endif
++	return (dwc_spinlock_t *)sl;
++}
++
++void DWC_SPINLOCK_FREE(dwc_spinlock_t *lock)
++{
++#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
++	DWC_FREE(lock);
++#endif
++}
++
++void DWC_SPINLOCK(dwc_spinlock_t *lock)
++{
++#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
++	spin_lock((spinlock_t *)lock);
++#endif
++}
++
++void DWC_SPINUNLOCK(dwc_spinlock_t *lock)
++{
++#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
++	spin_unlock((spinlock_t *)lock);
++#endif
++}
++
++void DWC_SPINLOCK_IRQSAVE(dwc_spinlock_t *lock, dwc_irqflags_t *flags)
++{
++	dwc_irqflags_t f;
++
++#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
++	spin_lock_irqsave((spinlock_t *)lock, f);
++#else
++	local_irq_save(f);
++#endif
++	*flags = f;
++}
++
++void DWC_SPINUNLOCK_IRQRESTORE(dwc_spinlock_t *lock, dwc_irqflags_t flags)
++{
++#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
++	spin_unlock_irqrestore((spinlock_t *)lock, flags);
++#else
++	local_irq_restore(flags);
++#endif
++}
++
++dwc_mutex_t *DWC_MUTEX_ALLOC(void)
++{
++	struct mutex *m;
++	dwc_mutex_t *mutex = (dwc_mutex_t *)DWC_ALLOC(sizeof(struct mutex));
++
++	if (!mutex) {
++		DWC_ERROR("Cannot allocate memory for mutex\n");
++		return NULL;
++	}
++
++	m = (struct mutex *)mutex;
++	mutex_init(m);
++	return mutex;
++}
++
++#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES))
++#else
++void DWC_MUTEX_FREE(dwc_mutex_t *mutex)
++{
++	mutex_destroy((struct mutex *)mutex);
++	DWC_FREE(mutex);
++}
++#endif
++
++void DWC_MUTEX_LOCK(dwc_mutex_t *mutex)
++{
++	struct mutex *m = (struct mutex *)mutex;
++	mutex_lock(m);
++}
++
++int DWC_MUTEX_TRYLOCK(dwc_mutex_t *mutex)
++{
++	struct mutex *m = (struct mutex *)mutex;
++	return mutex_trylock(m);
++}
++
++void DWC_MUTEX_UNLOCK(dwc_mutex_t *mutex)
++{
++	struct mutex *m = (struct mutex *)mutex;
++	mutex_unlock(m);
++}
++
++
++/* Timing */
++
++void DWC_UDELAY(uint32_t usecs)
++{
++	udelay(usecs);
++}
++
++void DWC_MDELAY(uint32_t msecs)
++{
++	mdelay(msecs);
++}
++
++void DWC_MSLEEP(uint32_t msecs)
++{
++	msleep(msecs);
++}
++
++uint32_t DWC_TIME(void)
++{
++	return jiffies_to_msecs(jiffies);
++}
++
++
++/* Timers */
++
++struct dwc_timer {
++	struct timer_list t;
++	char *name;
++	dwc_timer_callback_t cb;
++	void *data;
++	uint8_t scheduled;
++	dwc_spinlock_t *lock;
++};
++
++static void timer_callback(struct timer_list *tt)
++{
++	dwc_timer_t *timer = from_timer(timer, tt, t);
++	dwc_irqflags_t flags;
++
++	DWC_SPINLOCK_IRQSAVE(timer->lock, &flags);
++	timer->scheduled = 0;
++	DWC_SPINUNLOCK_IRQRESTORE(timer->lock, flags);
++	DWC_DEBUGC("Timer %s callback", timer->name);
++	timer->cb(timer->data);
++}
++
++dwc_timer_t *DWC_TIMER_ALLOC(char *name, dwc_timer_callback_t cb, void *data)
++{
++	dwc_timer_t *t = DWC_ALLOC(sizeof(*t));
++
++	if (!t) {
++		DWC_ERROR("Cannot allocate memory for timer");
++		return NULL;
++	}
++
++	t->name = DWC_STRDUP(name);
++	if (!t->name) {
++		DWC_ERROR("Cannot allocate memory for timer->name");
++		goto no_name;
++	}
++
++#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_SPINLOCK))
++	DWC_SPINLOCK_ALLOC_LINUX_DEBUG(t->lock);
++#else
++	t->lock = DWC_SPINLOCK_ALLOC();
++#endif
++	if (!t->lock) {
++		DWC_ERROR("Cannot allocate memory for lock");
++		goto no_lock;
++	}
++
++	t->scheduled = 0;
++	t->t.expires = jiffies;
++	timer_setup(&t->t, timer_callback, 0);
++
++	t->cb = cb;
++	t->data = data;
++
++	return t;
++
++ no_lock:
++	DWC_FREE(t->name);
++ no_name:
++	DWC_FREE(t);
++	return NULL;
++}
++
++void DWC_TIMER_FREE(dwc_timer_t *timer)
++{
++	dwc_irqflags_t flags;
++
++	DWC_SPINLOCK_IRQSAVE(timer->lock, &flags);
++
++	if (timer->scheduled) {
++		del_timer(&timer->t);
++		timer->scheduled = 0;
++	}
++
++	DWC_SPINUNLOCK_IRQRESTORE(timer->lock, flags);
++	DWC_SPINLOCK_FREE(timer->lock);
++	DWC_FREE(timer->name);
++	DWC_FREE(timer);
++}
++
++void DWC_TIMER_SCHEDULE(dwc_timer_t *timer, uint32_t time)
++{
++	dwc_irqflags_t flags;
++
++	DWC_SPINLOCK_IRQSAVE(timer->lock, &flags);
++
++	if (!timer->scheduled) {
++		timer->scheduled = 1;
++		DWC_DEBUGC("Scheduling timer %s to expire in +%d msec", timer->name, time);
++		timer->t.expires = jiffies + msecs_to_jiffies(time);
++		add_timer(&timer->t);
++	} else {
++		DWC_DEBUGC("Modifying timer %s to expire in +%d msec", timer->name, time);
++		mod_timer(&timer->t, jiffies + msecs_to_jiffies(time));
++	}
++
++	DWC_SPINUNLOCK_IRQRESTORE(timer->lock, flags);
++}
++
++void DWC_TIMER_CANCEL(dwc_timer_t *timer)
++{
++	del_timer(&timer->t);
++}
++
++
++/* Wait Queues */
++
++struct dwc_waitq {
++	wait_queue_head_t queue;
++	int abort;
++};
++
++dwc_waitq_t *DWC_WAITQ_ALLOC(void)
++{
++	dwc_waitq_t *wq = DWC_ALLOC(sizeof(*wq));
++
++	if (!wq) {
++		DWC_ERROR("Cannot allocate memory for waitqueue\n");
++		return NULL;
++	}
++
++	init_waitqueue_head(&wq->queue);
++	wq->abort = 0;
++	return wq;
++}
++
++void DWC_WAITQ_FREE(dwc_waitq_t *wq)
++{
++	DWC_FREE(wq);
++}
++
++int32_t DWC_WAITQ_WAIT(dwc_waitq_t *wq, dwc_waitq_condition_t cond, void *data)
++{
++	int result = wait_event_interruptible(wq->queue,
++					      cond(data) || wq->abort);
++	if (result == -ERESTARTSYS) {
++		wq->abort = 0;
++		return -DWC_E_RESTART;
++	}
++
++	if (wq->abort == 1) {
++		wq->abort = 0;
++		return -DWC_E_ABORT;
++	}
++
++	wq->abort = 0;
++
++	if (result == 0) {
++		return 0;
++	}
++
++	return -DWC_E_UNKNOWN;
++}
++
++int32_t DWC_WAITQ_WAIT_TIMEOUT(dwc_waitq_t *wq, dwc_waitq_condition_t cond,
++			       void *data, int32_t msecs)
++{
++	int32_t tmsecs;
++	int result = wait_event_interruptible_timeout(wq->queue,
++						      cond(data) || wq->abort,
++						      msecs_to_jiffies(msecs));
++	if (result == -ERESTARTSYS) {
++		wq->abort = 0;
++		return -DWC_E_RESTART;
++	}
++
++	if (wq->abort == 1) {
++		wq->abort = 0;
++		return -DWC_E_ABORT;
++	}
++
++	wq->abort = 0;
++
++	if (result > 0) {
++		tmsecs = jiffies_to_msecs(result);
++		if (!tmsecs) {
++			return 1;
++		}
++
++		return tmsecs;
++	}
++
++	if (result == 0) {
++		return -DWC_E_TIMEOUT;
++	}
++
++	return -DWC_E_UNKNOWN;
++}
++
++void DWC_WAITQ_TRIGGER(dwc_waitq_t *wq)
++{
++	wq->abort = 0;
++	wake_up_interruptible(&wq->queue);
++}
++
++void DWC_WAITQ_ABORT(dwc_waitq_t *wq)
++{
++	wq->abort = 1;
++	wake_up_interruptible(&wq->queue);
++}
++
++
++/* Threading */
++
++dwc_thread_t *DWC_THREAD_RUN(dwc_thread_function_t func, char *name, void *data)
++{
++	struct task_struct *thread = kthread_run(func, data, name);
++
++	if (thread == ERR_PTR(-ENOMEM)) {
++		return NULL;
++	}
++
++	return (dwc_thread_t *)thread;
++}
++
++int DWC_THREAD_STOP(dwc_thread_t *thread)
++{
++	return kthread_stop((struct task_struct *)thread);
++}
++
++dwc_bool_t DWC_THREAD_SHOULD_STOP(void)
++{
++	return kthread_should_stop();
++}
++
++
++/* tasklets
++ - run in interrupt context (cannot sleep)
++ - each tasklet runs on a single CPU
++ - different tasklets can be running simultaneously on different CPUs
++ */
++struct dwc_tasklet {
++	struct tasklet_struct t;
++	dwc_tasklet_callback_t cb;
++	void *data;
++};
++
++static void tasklet_callback(unsigned long data)
++{
++	dwc_tasklet_t *t = (dwc_tasklet_t *)data;
++	t->cb(t->data);
++}
++
++dwc_tasklet_t *DWC_TASK_ALLOC(char *name, dwc_tasklet_callback_t cb, void *data)
++{
++	dwc_tasklet_t *t = DWC_ALLOC(sizeof(*t));
++
++	if (t) {
++		t->cb = cb;
++		t->data = data;
++		tasklet_init(&t->t, tasklet_callback, (unsigned long)t);
++	} else {
++		DWC_ERROR("Cannot allocate memory for tasklet\n");
++	}
++
++	return t;
++}
++
++void DWC_TASK_FREE(dwc_tasklet_t *task)
++{
++	DWC_FREE(task);
++}
++
++void DWC_TASK_SCHEDULE(dwc_tasklet_t *task)
++{
++	tasklet_schedule(&task->t);
++}
++
++void DWC_TASK_HI_SCHEDULE(dwc_tasklet_t *task)
++{
++	tasklet_hi_schedule(&task->t);
++}
++
++
++/* workqueues
++ - run in process context (can sleep)
++ */
++typedef struct work_container {
++	dwc_work_callback_t cb;
++	void *data;
++	dwc_workq_t *wq;
++	char *name;
++
++#ifdef DEBUG
++	DWC_CIRCLEQ_ENTRY(work_container) entry;
++#endif
++	struct delayed_work work;
++} work_container_t;
++
++#ifdef DEBUG
++DWC_CIRCLEQ_HEAD(work_container_queue, work_container);
++#endif
++
++struct dwc_workq {
++	struct workqueue_struct *wq;
++	dwc_spinlock_t *lock;
++	dwc_waitq_t *waitq;
++	int pending;
++
++#ifdef DEBUG
++	struct work_container_queue entries;
++#endif
++};
++
++static void do_work(struct work_struct *work)
++{
++	dwc_irqflags_t flags;
++	struct delayed_work *dw = container_of(work, struct delayed_work, work);
++	work_container_t *container = container_of(dw, struct work_container, work);
++	dwc_workq_t *wq = container->wq;
++
++	container->cb(container->data);
++
++#ifdef DEBUG
++	DWC_CIRCLEQ_REMOVE(&wq->entries, container, entry);
++#endif
++	DWC_DEBUGC("Work done: %s, container=%p", container->name, container);
++	if (container->name) {
++		DWC_FREE(container->name);
++	}
++	DWC_FREE(container);
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++	wq->pending--;
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++	DWC_WAITQ_TRIGGER(wq->waitq);
++}
++
++static int work_done(void *data)
++{
++	dwc_workq_t *workq = (dwc_workq_t *)data;
++	return workq->pending == 0;
++}
++
++int DWC_WORKQ_WAIT_WORK_DONE(dwc_workq_t *workq, int timeout)
++{
++	return DWC_WAITQ_WAIT_TIMEOUT(workq->waitq, work_done, workq, timeout);
++}
++
++dwc_workq_t *DWC_WORKQ_ALLOC(char *name)
++{
++	dwc_workq_t *wq = DWC_ALLOC(sizeof(*wq));
++
++	if (!wq) {
++		return NULL;
++	}
++
++	wq->wq = create_singlethread_workqueue(name);
++	if (!wq->wq) {
++		goto no_wq;
++	}
++
++	wq->pending = 0;
++
++#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_SPINLOCK))
++	DWC_SPINLOCK_ALLOC_LINUX_DEBUG(wq->lock);
++#else
++	wq->lock = DWC_SPINLOCK_ALLOC();
++#endif
++	if (!wq->lock) {
++		goto no_lock;
++	}
++
++	wq->waitq = DWC_WAITQ_ALLOC();
++	if (!wq->waitq) {
++		goto no_waitq;
++	}
++
++#ifdef DEBUG
++	DWC_CIRCLEQ_INIT(&wq->entries);
++#endif
++	return wq;
++
++ no_waitq:
++	DWC_SPINLOCK_FREE(wq->lock);
++ no_lock:
++	destroy_workqueue(wq->wq);
++ no_wq:
++	DWC_FREE(wq);
++
++	return NULL;
++}
++
++void DWC_WORKQ_FREE(dwc_workq_t *wq)
++{
++#ifdef DEBUG
++	if (wq->pending != 0) {
++		struct work_container *wc;
++		DWC_ERROR("Destroying work queue with pending work");
++		DWC_CIRCLEQ_FOREACH(wc, &wq->entries, entry) {
++			DWC_ERROR("Work %s still pending", wc->name);
++		}
++	}
++#endif
++	destroy_workqueue(wq->wq);
++	DWC_SPINLOCK_FREE(wq->lock);
++	DWC_WAITQ_FREE(wq->waitq);
++	DWC_FREE(wq);
++}
++
++void DWC_WORKQ_SCHEDULE(dwc_workq_t *wq, dwc_work_callback_t cb, void *data,
++			char *format, ...)
++{
++	dwc_irqflags_t flags;
++	work_container_t *container;
++	static char name[128];
++	va_list args;
++
++	va_start(args, format);
++	DWC_VSNPRINTF(name, 128, format, args);
++	va_end(args);
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++	wq->pending++;
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++	DWC_WAITQ_TRIGGER(wq->waitq);
++
++	container = DWC_ALLOC_ATOMIC(sizeof(*container));
++	if (!container) {
++		DWC_ERROR("Cannot allocate memory for container\n");
++		return;
++	}
++
++	container->name = DWC_STRDUP(name);
++	if (!container->name) {
++		DWC_ERROR("Cannot allocate memory for container->name\n");
++		DWC_FREE(container);
++		return;
++	}
++
++	container->cb = cb;
++	container->data = data;
++	container->wq = wq;
++	DWC_DEBUGC("Queueing work: %s, container=%p", container->name, container);
++	INIT_WORK(&container->work.work, do_work);
++
++#ifdef DEBUG
++	DWC_CIRCLEQ_INSERT_TAIL(&wq->entries, container, entry);
++#endif
++	queue_work(wq->wq, &container->work.work);
++}
++
++void DWC_WORKQ_SCHEDULE_DELAYED(dwc_workq_t *wq, dwc_work_callback_t cb,
++				void *data, uint32_t time, char *format, ...)
++{
++	dwc_irqflags_t flags;
++	work_container_t *container;
++	static char name[128];
++	va_list args;
++
++	va_start(args, format);
++	DWC_VSNPRINTF(name, 128, format, args);
++	va_end(args);
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++	wq->pending++;
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++	DWC_WAITQ_TRIGGER(wq->waitq);
++
++	container = DWC_ALLOC_ATOMIC(sizeof(*container));
++	if (!container) {
++		DWC_ERROR("Cannot allocate memory for container\n");
++		return;
++	}
++
++	container->name = DWC_STRDUP(name);
++	if (!container->name) {
++		DWC_ERROR("Cannot allocate memory for container->name\n");
++		DWC_FREE(container);
++		return;
++	}
++
++	container->cb = cb;
++	container->data = data;
++	container->wq = wq;
++	DWC_DEBUGC("Queueing work: %s, container=%p", container->name, container);
++	INIT_DELAYED_WORK(&container->work, do_work);
++
++#ifdef DEBUG
++	DWC_CIRCLEQ_INSERT_TAIL(&wq->entries, container, entry);
++#endif
++	queue_delayed_work(wq->wq, &container->work, msecs_to_jiffies(time));
++}
++
++int DWC_WORKQ_PENDING(dwc_workq_t *wq)
++{
++	return wq->pending;
++}
++
++
++#ifdef DWC_LIBMODULE
++
++#ifdef DWC_CCLIB
++/* CC */
++EXPORT_SYMBOL(dwc_cc_if_alloc);
++EXPORT_SYMBOL(dwc_cc_if_free);
++EXPORT_SYMBOL(dwc_cc_clear);
++EXPORT_SYMBOL(dwc_cc_add);
++EXPORT_SYMBOL(dwc_cc_remove);
++EXPORT_SYMBOL(dwc_cc_change);
++EXPORT_SYMBOL(dwc_cc_data_for_save);
++EXPORT_SYMBOL(dwc_cc_restore_from_data);
++EXPORT_SYMBOL(dwc_cc_match_chid);
++EXPORT_SYMBOL(dwc_cc_match_cdid);
++EXPORT_SYMBOL(dwc_cc_ck);
++EXPORT_SYMBOL(dwc_cc_chid);
++EXPORT_SYMBOL(dwc_cc_cdid);
++EXPORT_SYMBOL(dwc_cc_name);
++#endif	/* DWC_CCLIB */
++
++#ifdef DWC_CRYPTOLIB
++# ifndef CONFIG_MACH_IPMATE
++/* Modpow */
++EXPORT_SYMBOL(dwc_modpow);
++
++/* DH */
++EXPORT_SYMBOL(dwc_dh_modpow);
++EXPORT_SYMBOL(dwc_dh_derive_keys);
++EXPORT_SYMBOL(dwc_dh_pk);
++# endif	/* CONFIG_MACH_IPMATE */
++
++/* Crypto */
++EXPORT_SYMBOL(dwc_wusb_aes_encrypt);
++EXPORT_SYMBOL(dwc_wusb_cmf);
++EXPORT_SYMBOL(dwc_wusb_prf);
++EXPORT_SYMBOL(dwc_wusb_fill_ccm_nonce);
++EXPORT_SYMBOL(dwc_wusb_gen_nonce);
++EXPORT_SYMBOL(dwc_wusb_gen_key);
++EXPORT_SYMBOL(dwc_wusb_gen_mic);
++#endif	/* DWC_CRYPTOLIB */
++
++/* Notification */
++#ifdef DWC_NOTIFYLIB
++EXPORT_SYMBOL(dwc_alloc_notification_manager);
++EXPORT_SYMBOL(dwc_free_notification_manager);
++EXPORT_SYMBOL(dwc_register_notifier);
++EXPORT_SYMBOL(dwc_unregister_notifier);
++EXPORT_SYMBOL(dwc_add_observer);
++EXPORT_SYMBOL(dwc_remove_observer);
++EXPORT_SYMBOL(dwc_notify);
++#endif
++
++/* Memory Debugging Routines */
++#ifdef DWC_DEBUG_MEMORY
++EXPORT_SYMBOL(dwc_alloc_debug);
++EXPORT_SYMBOL(dwc_alloc_atomic_debug);
++EXPORT_SYMBOL(dwc_free_debug);
++EXPORT_SYMBOL(dwc_dma_alloc_debug);
++EXPORT_SYMBOL(dwc_dma_free_debug);
++#endif
++
++EXPORT_SYMBOL(DWC_MEMSET);
++EXPORT_SYMBOL(DWC_MEMCPY);
++EXPORT_SYMBOL(DWC_MEMMOVE);
++EXPORT_SYMBOL(DWC_MEMCMP);
++EXPORT_SYMBOL(DWC_STRNCMP);
++EXPORT_SYMBOL(DWC_STRCMP);
++EXPORT_SYMBOL(DWC_STRLEN);
++EXPORT_SYMBOL(DWC_STRCPY);
++EXPORT_SYMBOL(DWC_STRDUP);
++EXPORT_SYMBOL(DWC_ATOI);
++EXPORT_SYMBOL(DWC_ATOUI);
++
++#ifdef DWC_UTFLIB
++EXPORT_SYMBOL(DWC_UTF8_TO_UTF16LE);
++#endif	/* DWC_UTFLIB */
++
++EXPORT_SYMBOL(DWC_IN_IRQ);
++EXPORT_SYMBOL(DWC_IN_BH);
++EXPORT_SYMBOL(DWC_VPRINTF);
++EXPORT_SYMBOL(DWC_VSNPRINTF);
++EXPORT_SYMBOL(DWC_PRINTF);
++EXPORT_SYMBOL(DWC_SPRINTF);
++EXPORT_SYMBOL(DWC_SNPRINTF);
++EXPORT_SYMBOL(__DWC_WARN);
++EXPORT_SYMBOL(__DWC_ERROR);
++EXPORT_SYMBOL(DWC_EXCEPTION);
++
++#ifdef DEBUG
++EXPORT_SYMBOL(__DWC_DEBUG);
++#endif
++
++EXPORT_SYMBOL(__DWC_DMA_ALLOC);
++EXPORT_SYMBOL(__DWC_DMA_ALLOC_ATOMIC);
++EXPORT_SYMBOL(__DWC_DMA_FREE);
++EXPORT_SYMBOL(__DWC_ALLOC);
++EXPORT_SYMBOL(__DWC_ALLOC_ATOMIC);
++EXPORT_SYMBOL(__DWC_FREE);
++
++#ifdef DWC_CRYPTOLIB
++EXPORT_SYMBOL(DWC_RANDOM_BYTES);
++EXPORT_SYMBOL(DWC_AES_CBC);
++EXPORT_SYMBOL(DWC_SHA256);
++EXPORT_SYMBOL(DWC_HMAC_SHA256);
++#endif
++
++EXPORT_SYMBOL(DWC_CPU_TO_LE32);
++EXPORT_SYMBOL(DWC_CPU_TO_BE32);
++EXPORT_SYMBOL(DWC_LE32_TO_CPU);
++EXPORT_SYMBOL(DWC_BE32_TO_CPU);
++EXPORT_SYMBOL(DWC_CPU_TO_LE16);
++EXPORT_SYMBOL(DWC_CPU_TO_BE16);
++EXPORT_SYMBOL(DWC_LE16_TO_CPU);
++EXPORT_SYMBOL(DWC_BE16_TO_CPU);
++EXPORT_SYMBOL(DWC_READ_REG32);
++EXPORT_SYMBOL(DWC_WRITE_REG32);
++EXPORT_SYMBOL(DWC_MODIFY_REG32);
++
++#if 0
++EXPORT_SYMBOL(DWC_READ_REG64);
++EXPORT_SYMBOL(DWC_WRITE_REG64);
++EXPORT_SYMBOL(DWC_MODIFY_REG64);
++#endif
++
++EXPORT_SYMBOL(DWC_SPINLOCK_ALLOC);
++EXPORT_SYMBOL(DWC_SPINLOCK_FREE);
++EXPORT_SYMBOL(DWC_SPINLOCK);
++EXPORT_SYMBOL(DWC_SPINUNLOCK);
++EXPORT_SYMBOL(DWC_SPINLOCK_IRQSAVE);
++EXPORT_SYMBOL(DWC_SPINUNLOCK_IRQRESTORE);
++EXPORT_SYMBOL(DWC_MUTEX_ALLOC);
++
++#if (!defined(DWC_LINUX) || !defined(CONFIG_DEBUG_MUTEXES))
++EXPORT_SYMBOL(DWC_MUTEX_FREE);
++#endif
++
++EXPORT_SYMBOL(DWC_MUTEX_LOCK);
++EXPORT_SYMBOL(DWC_MUTEX_TRYLOCK);
++EXPORT_SYMBOL(DWC_MUTEX_UNLOCK);
++EXPORT_SYMBOL(DWC_UDELAY);
++EXPORT_SYMBOL(DWC_MDELAY);
++EXPORT_SYMBOL(DWC_MSLEEP);
++EXPORT_SYMBOL(DWC_TIME);
++EXPORT_SYMBOL(DWC_TIMER_ALLOC);
++EXPORT_SYMBOL(DWC_TIMER_FREE);
++EXPORT_SYMBOL(DWC_TIMER_SCHEDULE);
++EXPORT_SYMBOL(DWC_TIMER_CANCEL);
++EXPORT_SYMBOL(DWC_WAITQ_ALLOC);
++EXPORT_SYMBOL(DWC_WAITQ_FREE);
++EXPORT_SYMBOL(DWC_WAITQ_WAIT);
++EXPORT_SYMBOL(DWC_WAITQ_WAIT_TIMEOUT);
++EXPORT_SYMBOL(DWC_WAITQ_TRIGGER);
++EXPORT_SYMBOL(DWC_WAITQ_ABORT);
++EXPORT_SYMBOL(DWC_THREAD_RUN);
++EXPORT_SYMBOL(DWC_THREAD_STOP);
++EXPORT_SYMBOL(DWC_THREAD_SHOULD_STOP);
++EXPORT_SYMBOL(DWC_TASK_ALLOC);
++EXPORT_SYMBOL(DWC_TASK_FREE);
++EXPORT_SYMBOL(DWC_TASK_SCHEDULE);
++EXPORT_SYMBOL(DWC_WORKQ_WAIT_WORK_DONE);
++EXPORT_SYMBOL(DWC_WORKQ_ALLOC);
++EXPORT_SYMBOL(DWC_WORKQ_FREE);
++EXPORT_SYMBOL(DWC_WORKQ_SCHEDULE);
++EXPORT_SYMBOL(DWC_WORKQ_SCHEDULE_DELAYED);
++EXPORT_SYMBOL(DWC_WORKQ_PENDING);
++
++static int dwc_common_port_init_module(void)
++{
++	int result = 0;
++
++	printk(KERN_DEBUG "Module dwc_common_port init\n" );
++
++#ifdef DWC_DEBUG_MEMORY
++	result = dwc_memory_debug_start(NULL);
++	if (result) {
++		printk(KERN_ERR
++		       "dwc_memory_debug_start() failed with error %d\n",
++		       result);
++		return result;
++	}
++#endif
++
++#ifdef DWC_NOTIFYLIB
++	result = dwc_alloc_notification_manager(NULL, NULL);
++	if (result) {
++		printk(KERN_ERR
++		       "dwc_alloc_notification_manager() failed with error %d\n",
++		       result);
++		return result;
++	}
++#endif
++	return result;
++}
++
++static void dwc_common_port_exit_module(void)
++{
++	printk(KERN_DEBUG "Module dwc_common_port exit\n" );
++
++#ifdef DWC_NOTIFYLIB
++	dwc_free_notification_manager();
++#endif
++
++#ifdef DWC_DEBUG_MEMORY
++	dwc_memory_debug_stop();
++#endif
++}
++
++module_init(dwc_common_port_init_module);
++module_exit(dwc_common_port_exit_module);
++
++MODULE_DESCRIPTION("DWC Common Library - Portable version");
++MODULE_AUTHOR("Synopsys Inc.");
++MODULE_LICENSE ("GPL");
++
++#endif	/* DWC_LIBMODULE */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_common_nbsd.c
+@@ -0,0 +1,1275 @@
++#include "dwc_os.h"
++#include "dwc_list.h"
++
++#ifdef DWC_CCLIB
++# include "dwc_cc.h"
++#endif
++
++#ifdef DWC_CRYPTOLIB
++# include "dwc_modpow.h"
++# include "dwc_dh.h"
++# include "dwc_crypto.h"
++#endif
++
++#ifdef DWC_NOTIFYLIB
++# include "dwc_notifier.h"
++#endif
++
++/* OS-Level Implementations */
++
++/* This is the NetBSD 4.0.1 kernel implementation of the DWC platform library. */
++
++
++/* MISC */
++
++void *DWC_MEMSET(void *dest, uint8_t byte, uint32_t size)
++{
++	return memset(dest, byte, size);
++}
++
++void *DWC_MEMCPY(void *dest, void const *src, uint32_t size)
++{
++	return memcpy(dest, src, size);
++}
++
++void *DWC_MEMMOVE(void *dest, void *src, uint32_t size)
++{
++	bcopy(src, dest, size);
++	return dest;
++}
++
++int DWC_MEMCMP(void *m1, void *m2, uint32_t size)
++{
++	return memcmp(m1, m2, size);
++}
++
++int DWC_STRNCMP(void *s1, void *s2, uint32_t size)
++{
++	return strncmp(s1, s2, size);
++}
++
++int DWC_STRCMP(void *s1, void *s2)
++{
++	return strcmp(s1, s2);
++}
++
++int DWC_STRLEN(char const *str)
++{
++	return strlen(str);
++}
++
++char *DWC_STRCPY(char *to, char const *from)
++{
++	return strcpy(to, from);
++}
++
++char *DWC_STRDUP(char const *str)
++{
++	int len = DWC_STRLEN(str) + 1;
++	char *new = DWC_ALLOC_ATOMIC(len);
++
++	if (!new) {
++		return NULL;
++	}
++
++	DWC_MEMCPY(new, str, len);
++	return new;
++}
++
++int DWC_ATOI(char *str, int32_t *value)
++{
++	char *end = NULL;
++
++	/* NetBSD doesn't have 'strtol' in the kernel, but 'strtoul'
++	 * should be equivalent on 2's complement machines
++	 */
++	*value = strtoul(str, &end, 0);
++	if (*end == '\0') {
++		return 0;
++	}
++
++	return -1;
++}
++
++int DWC_ATOUI(char *str, uint32_t *value)
++{
++	char *end = NULL;
++
++	*value = strtoul(str, &end, 0);
++	if (*end == '\0') {
++		return 0;
++	}
++
++	return -1;
++}
++
++
++#ifdef DWC_UTFLIB
++/* From usbstring.c */
++
++int DWC_UTF8_TO_UTF16LE(uint8_t const *s, uint16_t *cp, unsigned len)
++{
++	int	count = 0;
++	u8	c;
++	u16	uchar;
++
++	/* this insists on correct encodings, though not minimal ones.
++	 * BUT it currently rejects legit 4-byte UTF-8 code points,
++	 * which need surrogate pairs.  (Unicode 3.1 can use them.)
++	 */
++	while (len != 0 && (c = (u8) *s++) != 0) {
++		if (unlikely(c & 0x80)) {
++			// 2-byte sequence:
++			// 00000yyyyyxxxxxx = 110yyyyy 10xxxxxx
++			if ((c & 0xe0) == 0xc0) {
++				uchar = (c & 0x1f) << 6;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c;
++
++			// 3-byte sequence (most CJKV characters):
++			// zzzzyyyyyyxxxxxx = 1110zzzz 10yyyyyy 10xxxxxx
++			} else if ((c & 0xf0) == 0xe0) {
++				uchar = (c & 0x0f) << 12;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c << 6;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c;
++
++				/* no bogus surrogates */
++				if (0xd800 <= uchar && uchar <= 0xdfff)
++					goto fail;
++
++			// 4-byte sequence (surrogate pairs, currently rare):
++			// 11101110wwwwzzzzyy + 110111yyyyxxxxxx
++			//     = 11110uuu 10uuzzzz 10yyyyyy 10xxxxxx
++			// (uuuuu = wwww + 1)
++			// FIXME accept the surrogate code points (only)
++			} else
++				goto fail;
++		} else
++			uchar = c;
++		put_unaligned (cpu_to_le16 (uchar), cp++);
++		count++;
++		len--;
++	}
++	return count;
++fail:
++	return -1;
++}
++
++#endif	/* DWC_UTFLIB */
++
++
++/* dwc_debug.h */
++
++dwc_bool_t DWC_IN_IRQ(void)
++{
++//	return in_irq();
++	return 0;
++}
++
++dwc_bool_t DWC_IN_BH(void)
++{
++//	return in_softirq();
++	return 0;
++}
++
++void DWC_VPRINTF(char *format, va_list args)
++{
++	vprintf(format, args);
++}
++
++int DWC_VSNPRINTF(char *str, int size, char *format, va_list args)
++{
++	return vsnprintf(str, size, format, args);
++}
++
++void DWC_PRINTF(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++
++int DWC_SPRINTF(char *buffer, char *format, ...)
++{
++	int retval;
++	va_list args;
++
++	va_start(args, format);
++	retval = vsprintf(buffer, format, args);
++	va_end(args);
++	return retval;
++}
++
++int DWC_SNPRINTF(char *buffer, int size, char *format, ...)
++{
++	int retval;
++	va_list args;
++
++	va_start(args, format);
++	retval = vsnprintf(buffer, size, format, args);
++	va_end(args);
++	return retval;
++}
++
++void __DWC_WARN(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++
++void __DWC_ERROR(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++
++void DWC_EXCEPTION(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++//	BUG_ON(1);	???
++}
++
++#ifdef DEBUG
++void __DWC_DEBUG(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++#endif
++
++
++/* dwc_mem.h */
++
++#if 0
++dwc_pool_t *DWC_DMA_POOL_CREATE(uint32_t size,
++				uint32_t align,
++				uint32_t alloc)
++{
++	struct dma_pool *pool = dma_pool_create("Pool", NULL,
++						size, align, alloc);
++	return (dwc_pool_t *)pool;
++}
++
++void DWC_DMA_POOL_DESTROY(dwc_pool_t *pool)
++{
++	dma_pool_destroy((struct dma_pool *)pool);
++}
++
++void *DWC_DMA_POOL_ALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
++{
++//	return dma_pool_alloc((struct dma_pool *)pool, GFP_KERNEL, dma_addr);
++	return dma_pool_alloc((struct dma_pool *)pool, M_WAITOK, dma_addr);
++}
++
++void *DWC_DMA_POOL_ZALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
++{
++	void *vaddr = DWC_DMA_POOL_ALLOC(pool, dma_addr);
++	memset(..);
++}
++
++void DWC_DMA_POOL_FREE(dwc_pool_t *pool, void *vaddr, void *daddr)
++{
++	dma_pool_free(pool, vaddr, daddr);
++}
++#endif
++
++void *__DWC_DMA_ALLOC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr)
++{
++	dwc_dmactx_t *dma = (dwc_dmactx_t *)dma_ctx;
++	int error;
++
++	error = bus_dmamem_alloc(dma->dma_tag, size, 1, size, dma->segs,
++				 sizeof(dma->segs) / sizeof(dma->segs[0]),
++				 &dma->nsegs, BUS_DMA_NOWAIT);
++	if (error) {
++		printf("%s: bus_dmamem_alloc(%ju) failed: %d\n", __func__,
++		       (uintmax_t)size, error);
++		goto fail_0;
++	}
++
++	error = bus_dmamem_map(dma->dma_tag, dma->segs, dma->nsegs, size,
++			       (caddr_t *)&dma->dma_vaddr,
++			       BUS_DMA_NOWAIT | BUS_DMA_COHERENT);
++	if (error) {
++		printf("%s: bus_dmamem_map failed: %d\n", __func__, error);
++		goto fail_1;
++	}
++
++	error = bus_dmamap_create(dma->dma_tag, size, 1, size, 0,
++				  BUS_DMA_NOWAIT, &dma->dma_map);
++	if (error) {
++		printf("%s: bus_dmamap_create failed: %d\n", __func__, error);
++		goto fail_2;
++	}
++
++	error = bus_dmamap_load(dma->dma_tag, dma->dma_map, dma->dma_vaddr,
++				size, NULL, BUS_DMA_NOWAIT);
++	if (error) {
++		printf("%s: bus_dmamap_load failed: %d\n", __func__, error);
++		goto fail_3;
++	}
++
++	dma->dma_paddr = (bus_addr_t)dma->segs[0].ds_addr;
++	*dma_addr = dma->dma_paddr;
++	return dma->dma_vaddr;
++
++fail_3:
++	bus_dmamap_destroy(dma->dma_tag, dma->dma_map);
++fail_2:
++	bus_dmamem_unmap(dma->dma_tag, dma->dma_vaddr, size);
++fail_1:
++	bus_dmamem_free(dma->dma_tag, dma->segs, dma->nsegs);
++fail_0:
++	dma->dma_map = NULL;
++	dma->dma_vaddr = NULL;
++	dma->nsegs = 0;
++
++	return NULL;
++}
++
++void __DWC_DMA_FREE(void *dma_ctx, uint32_t size, void *virt_addr, dwc_dma_t dma_addr)
++{
++	dwc_dmactx_t *dma = (dwc_dmactx_t *)dma_ctx;
++
++	if (dma->dma_map != NULL) {
++		bus_dmamap_sync(dma->dma_tag, dma->dma_map, 0, size,
++				BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
++		bus_dmamap_unload(dma->dma_tag, dma->dma_map);
++		bus_dmamap_destroy(dma->dma_tag, dma->dma_map);
++		bus_dmamem_unmap(dma->dma_tag, dma->dma_vaddr, size);
++		bus_dmamem_free(dma->dma_tag, dma->segs, dma->nsegs);
++		dma->dma_paddr = 0;
++		dma->dma_map = NULL;
++		dma->dma_vaddr = NULL;
++		dma->nsegs = 0;
++	}
++}
++
++void *__DWC_ALLOC(void *mem_ctx, uint32_t size)
++{
++	return malloc(size, M_DEVBUF, M_WAITOK | M_ZERO);
++}
++
++void *__DWC_ALLOC_ATOMIC(void *mem_ctx, uint32_t size)
++{
++	return malloc(size, M_DEVBUF, M_NOWAIT | M_ZERO);
++}
++
++void __DWC_FREE(void *mem_ctx, void *addr)
++{
++	free(addr, M_DEVBUF);
++}
++
++
++#ifdef DWC_CRYPTOLIB
++/* dwc_crypto.h */
++
++void DWC_RANDOM_BYTES(uint8_t *buffer, uint32_t length)
++{
++	get_random_bytes(buffer, length);
++}
++
++int DWC_AES_CBC(uint8_t *message, uint32_t messagelen, uint8_t *key, uint32_t keylen, uint8_t iv[16], uint8_t *out)
++{
++	struct crypto_blkcipher *tfm;
++	struct blkcipher_desc desc;
++	struct scatterlist sgd;
++	struct scatterlist sgs;
++
++	tfm = crypto_alloc_blkcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC);
++	if (tfm == NULL) {
++		printk("failed to load transform for aes CBC\n");
++		return -1;
++	}
++
++	crypto_blkcipher_setkey(tfm, key, keylen);
++	crypto_blkcipher_set_iv(tfm, iv, 16);
++
++	sg_init_one(&sgd, out, messagelen);
++	sg_init_one(&sgs, message, messagelen);
++
++	desc.tfm = tfm;
++	desc.flags = 0;
++
++	if (crypto_blkcipher_encrypt(&desc, &sgd, &sgs, messagelen)) {
++		crypto_free_blkcipher(tfm);
++		DWC_ERROR("AES CBC encryption failed");
++		return -1;
++	}
++
++	crypto_free_blkcipher(tfm);
++	return 0;
++}
++
++int DWC_SHA256(uint8_t *message, uint32_t len, uint8_t *out)
++{
++	struct crypto_hash *tfm;
++	struct hash_desc desc;
++	struct scatterlist sg;
++
++	tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
++	if (IS_ERR(tfm)) {
++		DWC_ERROR("Failed to load transform for sha256: %ld", PTR_ERR(tfm));
++		return 0;
++	}
++	desc.tfm = tfm;
++	desc.flags = 0;
++
++	sg_init_one(&sg, message, len);
++	crypto_hash_digest(&desc, &sg, len, out);
++	crypto_free_hash(tfm);
++
++	return 1;
++}
++
++int DWC_HMAC_SHA256(uint8_t *message, uint32_t messagelen,
++		    uint8_t *key, uint32_t keylen, uint8_t *out)
++{
++	struct crypto_hash *tfm;
++	struct hash_desc desc;
++	struct scatterlist sg;
++
++	tfm = crypto_alloc_hash("hmac(sha256)", 0, CRYPTO_ALG_ASYNC);
++	if (IS_ERR(tfm)) {
++		DWC_ERROR("Failed to load transform for hmac(sha256): %ld", PTR_ERR(tfm));
++		return 0;
++	}
++	desc.tfm = tfm;
++	desc.flags = 0;
++
++	sg_init_one(&sg, message, messagelen);
++	crypto_hash_setkey(tfm, key, keylen);
++	crypto_hash_digest(&desc, &sg, messagelen, out);
++	crypto_free_hash(tfm);
++
++	return 1;
++}
++
++#endif	/* DWC_CRYPTOLIB */
++
++
++/* Byte Ordering Conversions */
++
++uint32_t DWC_CPU_TO_LE32(uint32_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint32_t DWC_CPU_TO_BE32(uint32_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint32_t DWC_LE32_TO_CPU(uint32_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint32_t DWC_BE32_TO_CPU(uint32_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint16_t DWC_CPU_TO_LE16(uint16_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++uint16_t DWC_CPU_TO_BE16(uint16_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++uint16_t DWC_LE16_TO_CPU(uint16_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++uint16_t DWC_BE16_TO_CPU(uint16_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++
++/* Registers */
++
++uint32_t DWC_READ_REG32(void *io_ctx, uint32_t volatile *reg)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	return bus_space_read_4(io->iot, io->ioh, ior);
++}
++
++#if 0
++uint64_t DWC_READ_REG64(void *io_ctx, uint64_t volatile *reg)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	return bus_space_read_8(io->iot, io->ioh, ior);
++}
++#endif
++
++void DWC_WRITE_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t value)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	bus_space_write_4(io->iot, io->ioh, ior, value);
++}
++
++#if 0
++void DWC_WRITE_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t value)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	bus_space_write_8(io->iot, io->ioh, ior, value);
++}
++#endif
++
++void DWC_MODIFY_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t clear_mask,
++		      uint32_t set_mask)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	bus_space_write_4(io->iot, io->ioh, ior,
++			  (bus_space_read_4(io->iot, io->ioh, ior) &
++			   ~clear_mask) | set_mask);
++}
++
++#if 0
++void DWC_MODIFY_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t clear_mask,
++		      uint64_t set_mask)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	bus_space_write_8(io->iot, io->ioh, ior,
++			  (bus_space_read_8(io->iot, io->ioh, ior) &
++			   ~clear_mask) | set_mask);
++}
++#endif
++
++
++/* Locking */
++
++dwc_spinlock_t *DWC_SPINLOCK_ALLOC(void)
++{
++	struct simplelock *sl = DWC_ALLOC(sizeof(*sl));
++
++	if (!sl) {
++		DWC_ERROR("Cannot allocate memory for spinlock");
++		return NULL;
++	}
++
++	simple_lock_init(sl);
++	return (dwc_spinlock_t *)sl;
++}
++
++void DWC_SPINLOCK_FREE(dwc_spinlock_t *lock)
++{
++	struct simplelock *sl = (struct simplelock *)lock;
++
++	DWC_FREE(sl);
++}
++
++void DWC_SPINLOCK(dwc_spinlock_t *lock)
++{
++	simple_lock((struct simplelock *)lock);
++}
++
++void DWC_SPINUNLOCK(dwc_spinlock_t *lock)
++{
++	simple_unlock((struct simplelock *)lock);
++}
++
++void DWC_SPINLOCK_IRQSAVE(dwc_spinlock_t *lock, dwc_irqflags_t *flags)
++{
++	simple_lock((struct simplelock *)lock);
++	*flags = splbio();
++}
++
++void DWC_SPINUNLOCK_IRQRESTORE(dwc_spinlock_t *lock, dwc_irqflags_t flags)
++{
++	splx(flags);
++	simple_unlock((struct simplelock *)lock);
++}
++
++dwc_mutex_t *DWC_MUTEX_ALLOC(void)
++{
++	dwc_mutex_t *mutex = DWC_ALLOC(sizeof(struct lock));
++
++	if (!mutex) {
++		DWC_ERROR("Cannot allocate memory for mutex");
++		return NULL;
++	}
++
++	lockinit((struct lock *)mutex, 0, "dw3mtx", 0, 0);
++	return mutex;
++}
++
++#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES))
++#else
++void DWC_MUTEX_FREE(dwc_mutex_t *mutex)
++{
++	DWC_FREE(mutex);
++}
++#endif
++
++void DWC_MUTEX_LOCK(dwc_mutex_t *mutex)
++{
++	lockmgr((struct lock *)mutex, LK_EXCLUSIVE, NULL);
++}
++
++int DWC_MUTEX_TRYLOCK(dwc_mutex_t *mutex)
++{
++	int status;
++
++	status = lockmgr((struct lock *)mutex, LK_EXCLUSIVE | LK_NOWAIT, NULL);
++	return status == 0;
++}
++
++void DWC_MUTEX_UNLOCK(dwc_mutex_t *mutex)
++{
++	lockmgr((struct lock *)mutex, LK_RELEASE, NULL);
++}
++
++
++/* Timing */
++
++void DWC_UDELAY(uint32_t usecs)
++{
++	DELAY(usecs);
++}
++
++void DWC_MDELAY(uint32_t msecs)
++{
++	do {
++		DELAY(1000);
++	} while (--msecs);
++}
++
++void DWC_MSLEEP(uint32_t msecs)
++{
++	struct timeval tv;
++
++	tv.tv_sec = msecs / 1000;
++	tv.tv_usec = (msecs - tv.tv_sec * 1000) * 1000;
++	tsleep(&tv, 0, "dw3slp", tvtohz(&tv));
++}
++
++uint32_t DWC_TIME(void)
++{
++	struct timeval tv;
++
++	microuptime(&tv);	// or getmicrouptime? (less precise, but faster)
++	return tv.tv_sec * 1000 + tv.tv_usec / 1000;
++}
++
++
++/* Timers */
++
++struct dwc_timer {
++	struct callout t;
++	char *name;
++	dwc_spinlock_t *lock;
++	dwc_timer_callback_t cb;
++	void *data;
++};
++
++dwc_timer_t *DWC_TIMER_ALLOC(char *name, dwc_timer_callback_t cb, void *data)
++{
++	dwc_timer_t *t = DWC_ALLOC(sizeof(*t));
++
++	if (!t) {
++		DWC_ERROR("Cannot allocate memory for timer");
++		return NULL;
++	}
++
++	callout_init(&t->t);
++
++	t->name = DWC_STRDUP(name);
++	if (!t->name) {
++		DWC_ERROR("Cannot allocate memory for timer->name");
++		goto no_name;
++	}
++
++	t->lock = DWC_SPINLOCK_ALLOC();
++	if (!t->lock) {
++		DWC_ERROR("Cannot allocate memory for timer->lock");
++		goto no_lock;
++	}
++
++	t->cb = cb;
++	t->data = data;
++
++	return t;
++
++ no_lock:
++	DWC_FREE(t->name);
++ no_name:
++	DWC_FREE(t);
++
++	return NULL;
++}
++
++void DWC_TIMER_FREE(dwc_timer_t *timer)
++{
++	callout_stop(&timer->t);
++	DWC_SPINLOCK_FREE(timer->lock);
++	DWC_FREE(timer->name);
++	DWC_FREE(timer);
++}
++
++void DWC_TIMER_SCHEDULE(dwc_timer_t *timer, uint32_t time)
++{
++	struct timeval tv;
++
++	tv.tv_sec = time / 1000;
++	tv.tv_usec = (time - tv.tv_sec * 1000) * 1000;
++	callout_reset(&timer->t, tvtohz(&tv), timer->cb, timer->data);
++}
++
++void DWC_TIMER_CANCEL(dwc_timer_t *timer)
++{
++	callout_stop(&timer->t);
++}
++
++
++/* Wait Queues */
++
++struct dwc_waitq {
++	struct simplelock lock;
++	int abort;
++};
++
++dwc_waitq_t *DWC_WAITQ_ALLOC(void)
++{
++	dwc_waitq_t *wq = DWC_ALLOC(sizeof(*wq));
++
++	if (!wq) {
++		DWC_ERROR("Cannot allocate memory for waitqueue");
++		return NULL;
++	}
++
++	simple_lock_init(&wq->lock);
++	wq->abort = 0;
++
++	return wq;
++}
++
++void DWC_WAITQ_FREE(dwc_waitq_t *wq)
++{
++	DWC_FREE(wq);
++}
++
++int32_t DWC_WAITQ_WAIT(dwc_waitq_t *wq, dwc_waitq_condition_t cond, void *data)
++{
++	int ipl;
++	int result = 0;
++
++	simple_lock(&wq->lock);
++	ipl = splbio();
++
++	/* Skip the sleep if already aborted or triggered */
++	if (!wq->abort && !cond(data)) {
++		splx(ipl);
++		result = ltsleep(wq, PCATCH, "dw3wat", 0, &wq->lock); // infinite timeout
++		ipl = splbio();
++	}
++
++	if (result == 0) {			// awoken
++		if (wq->abort) {
++			wq->abort = 0;
++			result = -DWC_E_ABORT;
++		} else {
++			result = 0;
++		}
++
++		splx(ipl);
++		simple_unlock(&wq->lock);
++	} else {
++		wq->abort = 0;
++		splx(ipl);
++		simple_unlock(&wq->lock);
++
++		if (result == ERESTART) {	// signaled - restart
++			result = -DWC_E_RESTART;
++		} else {			// signaled - must be EINTR
++			result = -DWC_E_ABORT;
++		}
++	}
++
++	return result;
++}
++
++int32_t DWC_WAITQ_WAIT_TIMEOUT(dwc_waitq_t *wq, dwc_waitq_condition_t cond,
++			       void *data, int32_t msecs)
++{
++	struct timeval tv, tv1, tv2;
++	int ipl;
++	int result = 0;
++
++	tv.tv_sec = msecs / 1000;
++	tv.tv_usec = (msecs - tv.tv_sec * 1000) * 1000;
++
++	simple_lock(&wq->lock);
++	ipl = splbio();
++
++	/* Skip the sleep if already aborted or triggered */
++	if (!wq->abort && !cond(data)) {
++		splx(ipl);
++		getmicrouptime(&tv1);
++		result = ltsleep(wq, PCATCH, "dw3wto", tvtohz(&tv), &wq->lock);
++		getmicrouptime(&tv2);
++		ipl = splbio();
++	}
++
++	if (result == 0) {			// awoken
++		if (wq->abort) {
++			wq->abort = 0;
++			splx(ipl);
++			simple_unlock(&wq->lock);
++			result = -DWC_E_ABORT;
++		} else {
++			splx(ipl);
++			simple_unlock(&wq->lock);
++
++			tv2.tv_usec -= tv1.tv_usec;
++			if (tv2.tv_usec < 0) {
++				tv2.tv_usec += 1000000;
++				tv2.tv_sec--;
++			}
++
++			tv2.tv_sec -= tv1.tv_sec;
++			result = tv2.tv_sec * 1000 + tv2.tv_usec / 1000;
++			result = msecs - result;
++			if (result <= 0)
++				result = 1;
++		}
++	} else {
++		wq->abort = 0;
++		splx(ipl);
++		simple_unlock(&wq->lock);
++
++		if (result == ERESTART) {	// signaled - restart
++			result = -DWC_E_RESTART;
++
++		} else if (result == EINTR) {		// signaled - interrupt
++			result = -DWC_E_ABORT;
++
++		} else {				// timed out
++			result = -DWC_E_TIMEOUT;
++		}
++	}
++
++	return result;
++}
++
++void DWC_WAITQ_TRIGGER(dwc_waitq_t *wq)
++{
++	wakeup(wq);
++}
++
++void DWC_WAITQ_ABORT(dwc_waitq_t *wq)
++{
++	int ipl;
++
++	simple_lock(&wq->lock);
++	ipl = splbio();
++	wq->abort = 1;
++	wakeup(wq);
++	splx(ipl);
++	simple_unlock(&wq->lock);
++}
++
++
++/* Threading */
++
++struct dwc_thread {
++	struct proc *proc;
++	int abort;
++};
++
++dwc_thread_t *DWC_THREAD_RUN(dwc_thread_function_t func, char *name, void *data)
++{
++	int retval;
++	dwc_thread_t *thread = DWC_ALLOC(sizeof(*thread));
++
++	if (!thread) {
++		return NULL;
++	}
++
++	thread->abort = 0;
++	retval = kthread_create1((void (*)(void *))func, data, &thread->proc,
++				 "%s", name);
++	if (retval) {
++		DWC_FREE(thread);
++		return NULL;
++	}
++
++	return thread;
++}
++
++int DWC_THREAD_STOP(dwc_thread_t *thread)
++{
++	int retval;
++
++	thread->abort = 1;
++	retval = tsleep(&thread->abort, 0, "dw3stp", 60 * hz);
++
++	if (retval == 0) {
++		/* DWC_THREAD_EXIT() will free the thread struct */
++		return 0;
++	}
++
++	/* NOTE: We leak the thread struct if thread doesn't die */
++
++	if (retval == EWOULDBLOCK) {
++		return -DWC_E_TIMEOUT;
++	}
++
++	return -DWC_E_UNKNOWN;
++}
++
++dwc_bool_t DWC_THREAD_SHOULD_STOP(dwc_thread_t *thread)
++{
++	return thread->abort;
++}
++
++void DWC_THREAD_EXIT(dwc_thread_t *thread)
++{
++	wakeup(&thread->abort);
++	DWC_FREE(thread);
++	kthread_exit(0);
++}
++
++/* tasklets
++ - Runs in interrupt context (cannot sleep)
++ - Each tasklet runs on a single CPU
++ - Different tasklets can be running simultaneously on different CPUs
++ [ On NetBSD there is no corresponding mechanism, drivers don't have bottom-
++   halves. So we just call the callback directly from DWC_TASK_SCHEDULE() ]
++ */
++struct dwc_tasklet {
++	dwc_tasklet_callback_t cb;
++	void *data;
++};
++
++static void tasklet_callback(void *data)
++{
++	dwc_tasklet_t *task = (dwc_tasklet_t *)data;
++
++	task->cb(task->data);
++}
++
++dwc_tasklet_t *DWC_TASK_ALLOC(char *name, dwc_tasklet_callback_t cb, void *data)
++{
++	dwc_tasklet_t *task = DWC_ALLOC(sizeof(*task));
++
++	if (task) {
++		task->cb = cb;
++		task->data = data;
++	} else {
++		DWC_ERROR("Cannot allocate memory for tasklet");
++	}
++
++	return task;
++}
++
++void DWC_TASK_FREE(dwc_tasklet_t *task)
++{
++	DWC_FREE(task);
++}
++
++void DWC_TASK_SCHEDULE(dwc_tasklet_t *task)
++{
++	tasklet_callback(task);
++}
++
++
++/* workqueues
++ - Runs in process context (can sleep)
++ */
++typedef struct work_container {
++	dwc_work_callback_t cb;
++	void *data;
++	dwc_workq_t *wq;
++	char *name;
++	int hz;
++	struct work task;
++} work_container_t;
++
++struct dwc_workq {
++	struct workqueue *taskq;
++	dwc_spinlock_t *lock;
++	dwc_waitq_t *waitq;
++	int pending;
++	struct work_container *container;
++};
++
++static void do_work(struct work *task, void *data)
++{
++	dwc_workq_t *wq = (dwc_workq_t *)data;
++	work_container_t *container = wq->container;
++	dwc_irqflags_t flags;
++
++	if (container->hz) {
++		tsleep(container, 0, "dw3wrk", container->hz);
++	}
++
++	container->cb(container->data);
++	DWC_DEBUG("Work done: %s, container=%p", container->name, container);
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++	if (container->name)
++		DWC_FREE(container->name);
++	DWC_FREE(container);
++	wq->pending--;
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++	DWC_WAITQ_TRIGGER(wq->waitq);
++}
++
++static int work_done(void *data)
++{
++	dwc_workq_t *workq = (dwc_workq_t *)data;
++
++	return workq->pending == 0;
++}
++
++int DWC_WORKQ_WAIT_WORK_DONE(dwc_workq_t *workq, int timeout)
++{
++	return DWC_WAITQ_WAIT_TIMEOUT(workq->waitq, work_done, workq, timeout);
++}
++
++dwc_workq_t *DWC_WORKQ_ALLOC(char *name)
++{
++	int result;
++	dwc_workq_t *wq = DWC_ALLOC(sizeof(*wq));
++
++	if (!wq) {
++		DWC_ERROR("Cannot allocate memory for workqueue");
++		return NULL;
++	}
++
++	result = workqueue_create(&wq->taskq, name, do_work, wq, 0 /*PWAIT*/,
++				  IPL_BIO, 0);
++	if (result) {
++		DWC_ERROR("Cannot create workqueue");
++		goto no_taskq;
++	}
++
++	wq->pending = 0;
++
++	wq->lock = DWC_SPINLOCK_ALLOC();
++	if (!wq->lock) {
++		DWC_ERROR("Cannot allocate memory for spinlock");
++		goto no_lock;
++	}
++
++	wq->waitq = DWC_WAITQ_ALLOC();
++	if (!wq->waitq) {
++		DWC_ERROR("Cannot allocate memory for waitqueue");
++		goto no_waitq;
++	}
++
++	return wq;
++
++ no_waitq:
++	DWC_SPINLOCK_FREE(wq->lock);
++ no_lock:
++	workqueue_destroy(wq->taskq);
++ no_taskq:
++	DWC_FREE(wq);
++
++	return NULL;
++}
++
++void DWC_WORKQ_FREE(dwc_workq_t *wq)
++{
++#ifdef DEBUG
++	dwc_irqflags_t flags;
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++
++	if (wq->pending != 0) {
++		struct work_container *container = wq->container;
++
++		DWC_ERROR("Destroying work queue with pending work");
++
++		if (container && container->name) {
++			DWC_ERROR("Work %s still pending", container->name);
++		}
++	}
++
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++#endif
++	DWC_WAITQ_FREE(wq->waitq);
++	DWC_SPINLOCK_FREE(wq->lock);
++	workqueue_destroy(wq->taskq);
++	DWC_FREE(wq);
++}
++
++void DWC_WORKQ_SCHEDULE(dwc_workq_t *wq, dwc_work_callback_t cb, void *data,
++			char *format, ...)
++{
++	dwc_irqflags_t flags;
++	work_container_t *container;
++	static char name[128];
++	va_list args;
++
++	va_start(args, format);
++	DWC_VSNPRINTF(name, 128, format, args);
++	va_end(args);
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++	wq->pending++;
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++	DWC_WAITQ_TRIGGER(wq->waitq);
++
++	container = DWC_ALLOC_ATOMIC(sizeof(*container));
++	if (!container) {
++		DWC_ERROR("Cannot allocate memory for container");
++		return;
++	}
++
++	container->name = DWC_STRDUP(name);
++	if (!container->name) {
++		DWC_ERROR("Cannot allocate memory for container->name");
++		DWC_FREE(container);
++		return;
++	}
++
++	container->cb = cb;
++	container->data = data;
++	container->wq = wq;
++	container->hz = 0;
++	wq->container = container;
++
++	DWC_DEBUG("Queueing work: %s, container=%p", container->name, container);
++	workqueue_enqueue(wq->taskq, &container->task);
++}
++
++void DWC_WORKQ_SCHEDULE_DELAYED(dwc_workq_t *wq, dwc_work_callback_t cb,
++				void *data, uint32_t time, char *format, ...)
++{
++	dwc_irqflags_t flags;
++	work_container_t *container;
++	static char name[128];
++	struct timeval tv;
++	va_list args;
++
++	va_start(args, format);
++	DWC_VSNPRINTF(name, 128, format, args);
++	va_end(args);
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++	wq->pending++;
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++	DWC_WAITQ_TRIGGER(wq->waitq);
++
++	container = DWC_ALLOC_ATOMIC(sizeof(*container));
++	if (!container) {
++		DWC_ERROR("Cannot allocate memory for container");
++		return;
++	}
++
++	container->name = DWC_STRDUP(name);
++	if (!container->name) {
++		DWC_ERROR("Cannot allocate memory for container->name");
++		DWC_FREE(container);
++		return;
++	}
++
++	container->cb = cb;
++	container->data = data;
++	container->wq = wq;
++	tv.tv_sec = time / 1000;
++	tv.tv_usec = (time - tv.tv_sec * 1000) * 1000;
++	container->hz = tvtohz(&tv);
++	wq->container = container;
++
++	DWC_DEBUG("Queueing work: %s, container=%p", container->name, container);
++	workqueue_enqueue(wq->taskq, &container->task);
++}
++
++int DWC_WORKQ_PENDING(dwc_workq_t *wq)
++{
++	return wq->pending;
++}
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_crypto.c
+@@ -0,0 +1,308 @@
++/* =========================================================================
++ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_crypto.c $
++ * $Revision: #5 $
++ * $Date: 2010/09/28 $
++ * $Change: 1596182 $
++ *
++ * Synopsys Portability Library Software and documentation
++ * (hereinafter, "Software") is an Unsupported proprietary work of
++ * Synopsys, Inc. unless otherwise expressly agreed to in writing
++ * between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product
++ * under any End User Software License Agreement or Agreement for
++ * Licensed Product with Synopsys or any supplement thereto. You are
++ * permitted to use and redistribute this Software in source and binary
++ * forms, with or without modification, provided that redistributions
++ * of source code must retain this notice. You may not view, use,
++ * disclose, copy or distribute this file or any information contained
++ * herein except pursuant to this license grant from Synopsys. If you
++ * do not agree with this notice, including the disclaimer below, then
++ * you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
++ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
++ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
++ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
++ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
++ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================= */
++
++/** @file
++ * This file contains the WUSB cryptographic routines.
++ */
++
++#ifdef DWC_CRYPTOLIB
++
++#include "dwc_crypto.h"
++#include "usb.h"
++
++#ifdef DEBUG
++static inline void dump_bytes(char *name, uint8_t *bytes, int len)
++{
++	int i;
++	DWC_PRINTF("%s: ", name);
++	for (i=0; i<len; i++) {
++		DWC_PRINTF("%02x ", bytes[i]);
++	}
++	DWC_PRINTF("\n");
++}
++#else
++#define dump_bytes(x...)
++#endif
++
++/* Display a block */
++void show_block(const u8 *blk, const char *prefix, const char *suffix, int a)
++{
++#ifdef DWC_DEBUG_CRYPTO
++	int i, blksize = 16;
++
++	DWC_DEBUG("%s", prefix);
++
++	if (suffix == NULL) {
++		suffix = "\n";
++		blksize = a;
++	}
++
++	for (i = 0; i < blksize; i++)
++		DWC_PRINT("%02x%s", *blk++, ((i & 3) == 3) ? "  " : " ");
++	DWC_PRINT(suffix);
++#endif
++}
++
++/**
++ * Encrypts an array of bytes using the AES encryption engine.
++ * If <code>dst</code> == <code>src</code>, then the bytes will be encrypted
++ * in-place.
++ *
++ * @return  0 on success, negative error code on error.
++ */
++int dwc_wusb_aes_encrypt(u8 *src, u8 *key, u8 *dst)
++{
++	u8 block_t[16];
++	DWC_MEMSET(block_t, 0, 16);
++
++	return DWC_AES_CBC(src, 16, key, 16, block_t, dst);
++}
++
++/**
++ * The CCM-MAC-FUNCTION described in section 6.5 of the WUSB spec.
++ * This function takes a data string and returns the encrypted CBC
++ * Counter-mode MIC.
++ *
++ * @param key     The 128-bit symmetric key.
++ * @param nonce   The CCM nonce.
++ * @param label   The unique 14-byte ASCII text label.
++ * @param bytes   The byte array to be encrypted.
++ * @param len     Length of the byte array.
++ * @param result  Byte array to receive the 8-byte encrypted MIC.
++ */
++void dwc_wusb_cmf(u8 *key, u8 *nonce,
++		  char *label, u8 *bytes, int len, u8 *result)
++{
++	u8 block_m[16];
++	u8 block_x[16];
++	u8 block_t[8];
++	int idx, blkNum;
++	u16 la = (u16)(len + 14);
++
++	/* Set the AES-128 key */
++	//dwc_aes_setkey(tfm, key, 16);
++
++	/* Fill block B0 from flags = 0x59, N, and l(m) = 0 */
++	block_m[0] = 0x59;
++	for (idx = 0; idx < 13; idx++)
++		block_m[idx + 1] = nonce[idx];
++	block_m[14] = 0;
++	block_m[15] = 0;
++
++	/* Produce the CBC IV */
++	dwc_wusb_aes_encrypt(block_m, key, block_x);
++	show_block(block_m, "CBC IV in: ", "\n", 0);
++	show_block(block_x, "CBC IV out:", "\n", 0);
++
++	/* Fill block B1 from l(a) = Blen + 14, and A */
++	block_x[0] ^= (u8)(la >> 8);
++	block_x[1] ^= (u8)la;
++	for (idx = 0; idx < 14; idx++)
++		block_x[idx + 2] ^= label[idx];
++	show_block(block_x, "After xor: ", "b1\n", 16);
++
++	dwc_wusb_aes_encrypt(block_x, key, block_x);
++	show_block(block_x, "After AES: ", "b1\n", 16);
++
++	idx = 0;
++	blkNum = 0;
++
++	/* Fill remaining blocks with B */
++	while (len-- > 0) {
++		block_x[idx] ^= *bytes++;
++		if (++idx >= 16) {
++			idx = 0;
++			show_block(block_x, "After xor: ", "\n", blkNum);
++			dwc_wusb_aes_encrypt(block_x, key, block_x);
++			show_block(block_x, "After AES: ", "\n", blkNum);
++			blkNum++;
++		}
++	}
++
++	/* Handle partial last block */
++	if (idx > 0) {
++		show_block(block_x, "After xor: ", "\n", blkNum);
++		dwc_wusb_aes_encrypt(block_x, key, block_x);
++		show_block(block_x, "After AES: ", "\n", blkNum);
++	}
++
++	/* Save the MIC tag */
++	DWC_MEMCPY(block_t, block_x, 8);
++	show_block(block_t, "MIC tag  : ", NULL, 8);
++
++	/* Fill block A0 from flags = 0x01, N, and counter = 0 */
++	block_m[0] = 0x01;
++	block_m[14] = 0;
++	block_m[15] = 0;
++
++	/* Encrypt the counter */
++	dwc_wusb_aes_encrypt(block_m, key, block_x);
++	show_block(block_x, "CTR[MIC] : ", NULL, 8);
++
++	/* XOR with MIC tag */
++	for (idx = 0; idx < 8; idx++) {
++		block_t[idx] ^= block_x[idx];
++	}
++
++	/* Return result to caller */
++	DWC_MEMCPY(result, block_t, 8);
++	show_block(result, "CCM-MIC  : ", NULL, 8);
++
++}
++
++/**
++ * The PRF function described in section 6.5 of the WUSB spec. This function
++ * concatenates MIC values returned from dwc_cmf() to create a value of
++ * the requested length.
++ *
++ * @param prf_len  Length of the PRF function in bits (64, 128, or 256).
++ * @param key, nonce, label, bytes, len  Same as for dwc_cmf().
++ * @param result   Byte array to receive the result.
++ */
++void dwc_wusb_prf(int prf_len, u8 *key,
++		  u8 *nonce, char *label, u8 *bytes, int len, u8 *result)
++{
++	int i;
++
++	nonce[0] = 0;
++	for (i = 0; i < prf_len >> 6; i++, nonce[0]++) {
++		dwc_wusb_cmf(key, nonce, label, bytes, len, result);
++		result += 8;
++	}
++}
++
++/**
++ * Fills in CCM Nonce per the WUSB spec.
++ *
++ * @param[in] haddr Host address.
++ * @param[in] daddr Device address.
++ * @param[in] tkid Session Key(PTK) identifier.
++ * @param[out] nonce Pointer to where the CCM Nonce output is to be written.
++ */
++void dwc_wusb_fill_ccm_nonce(uint16_t haddr, uint16_t daddr, uint8_t *tkid,
++			     uint8_t *nonce)
++{
++
++	DWC_DEBUG("%s %x %x\n", __func__, daddr, haddr);
++
++	DWC_MEMSET(&nonce[0], 0, 16);
++
++	DWC_MEMCPY(&nonce[6], tkid, 3);
++	nonce[9] = daddr & 0xFF;
++	nonce[10] = (daddr >> 8) & 0xFF;
++	nonce[11] = haddr & 0xFF;
++	nonce[12] = (haddr >> 8) & 0xFF;
++
++	dump_bytes("CCM nonce", nonce, 16);
++}
++
++/**
++ * Generates a 16-byte cryptographic-grade random number for the Host/Device
++ * Nonce.
++ */
++void dwc_wusb_gen_nonce(uint16_t addr, uint8_t *nonce)
++{
++	uint8_t inonce[16];
++	uint32_t temp[4];
++
++	/* Fill in the Nonce */
++	DWC_MEMSET(&inonce[0], 0, sizeof(inonce));
++	inonce[9] = addr & 0xFF;
++	inonce[10] = (addr >> 8) & 0xFF;
++	inonce[11] = inonce[9];
++	inonce[12] = inonce[10];
++
++	/* Collect "randomness samples" */
++	DWC_RANDOM_BYTES((uint8_t *)temp, 16);
++
++	dwc_wusb_prf_128((uint8_t *)temp, nonce,
++			 "Random Numbers", (uint8_t *)temp, sizeof(temp),
++			 nonce);
++}
++
++/**
++ * Generates the Session Key (PTK) and Key Confirmation Key (KCK) per the
++ * WUSB spec.
++ *
++ * @param[in] ccm_nonce Pointer to CCM Nonce.
++ * @param[in] mk Master Key to derive the session from
++ * @param[in] hnonce Pointer to Host Nonce.
++ * @param[in] dnonce Pointer to Device Nonce.
++ * @param[out] kck Pointer to where the KCK output is to be written.
++ * @param[out] ptk Pointer to where the PTK output is to be written.
++ */
++void dwc_wusb_gen_key(uint8_t *ccm_nonce, uint8_t *mk, uint8_t *hnonce,
++		      uint8_t *dnonce, uint8_t *kck, uint8_t *ptk)
++{
++	uint8_t idata[32];
++	uint8_t odata[32];
++
++	dump_bytes("ck", mk, 16);
++	dump_bytes("hnonce", hnonce, 16);
++	dump_bytes("dnonce", dnonce, 16);
++
++	/* The data is the HNonce and DNonce concatenated */
++	DWC_MEMCPY(&idata[0], hnonce, 16);
++	DWC_MEMCPY(&idata[16], dnonce, 16);
++
++	dwc_wusb_prf_256(mk, ccm_nonce, "Pair-wise keys", idata, 32, odata);
++
++	/* Low 16 bytes of the result is the KCK, high 16 is the PTK */
++	DWC_MEMCPY(kck, &odata[0], 16);
++	DWC_MEMCPY(ptk, &odata[16], 16);
++
++	dump_bytes("kck", kck, 16);
++	dump_bytes("ptk", ptk, 16);
++}
++
++/**
++ * Generates the Message Integrity Code over the Handshake data per the
++ * WUSB spec.
++ *
++ * @param ccm_nonce Pointer to CCM Nonce.
++ * @param kck   Pointer to Key Confirmation Key.
++ * @param data  Pointer to Handshake data to be checked.
++ * @param mic   Pointer to where the MIC output is to be written.
++ */
++void dwc_wusb_gen_mic(uint8_t *ccm_nonce, uint8_t *kck,
++		      uint8_t *data, uint8_t *mic)
++{
++
++	dwc_wusb_prf_64(kck, ccm_nonce, "out-of-bandMIC",
++			data, WUSB_HANDSHAKE_LEN_FOR_MIC, mic);
++}
++
++#endif	/* DWC_CRYPTOLIB */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_crypto.h
+@@ -0,0 +1,111 @@
++/* =========================================================================
++ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_crypto.h $
++ * $Revision: #3 $
++ * $Date: 2010/09/28 $
++ * $Change: 1596182 $
++ *
++ * Synopsys Portability Library Software and documentation
++ * (hereinafter, "Software") is an Unsupported proprietary work of
++ * Synopsys, Inc. unless otherwise expressly agreed to in writing
++ * between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product
++ * under any End User Software License Agreement or Agreement for
++ * Licensed Product with Synopsys or any supplement thereto. You are
++ * permitted to use and redistribute this Software in source and binary
++ * forms, with or without modification, provided that redistributions
++ * of source code must retain this notice. You may not view, use,
++ * disclose, copy or distribute this file or any information contained
++ * herein except pursuant to this license grant from Synopsys. If you
++ * do not agree with this notice, including the disclaimer below, then
++ * you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
++ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
++ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
++ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
++ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
++ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================= */
++
++#ifndef _DWC_CRYPTO_H_
++#define _DWC_CRYPTO_H_
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++/** @file
++ *
++ * This file contains declarations for the WUSB Cryptographic routines as
++ * defined in the WUSB spec.  They are only to be used internally by the DWC UWB
++ * modules.
++ */
++
++#include "dwc_os.h"
++
++int dwc_wusb_aes_encrypt(u8 *src, u8 *key, u8 *dst);
++
++void dwc_wusb_cmf(u8 *key, u8 *nonce,
++		  char *label, u8 *bytes, int len, u8 *result);
++void dwc_wusb_prf(int prf_len, u8 *key,
++		  u8 *nonce, char *label, u8 *bytes, int len, u8 *result);
++
++/**
++ * The PRF-64 function described in section 6.5 of the WUSB spec.
++ *
++ * @param key, nonce, label, bytes, len, result  Same as for dwc_prf().
++ */
++static inline void dwc_wusb_prf_64(u8 *key, u8 *nonce,
++				   char *label, u8 *bytes, int len, u8 *result)
++{
++	dwc_wusb_prf(64, key, nonce, label, bytes, len, result);
++}
++
++/**
++ * The PRF-128 function described in section 6.5 of the WUSB spec.
++ *
++ * @param key, nonce, label, bytes, len, result  Same as for dwc_prf().
++ */
++static inline void dwc_wusb_prf_128(u8 *key, u8 *nonce,
++				    char *label, u8 *bytes, int len, u8 *result)
++{
++	dwc_wusb_prf(128, key, nonce, label, bytes, len, result);
++}
++
++/**
++ * The PRF-256 function described in section 6.5 of the WUSB spec.
++ *
++ * @param key, nonce, label, bytes, len, result  Same as for dwc_prf().
++ */
++static inline void dwc_wusb_prf_256(u8 *key, u8 *nonce,
++				    char *label, u8 *bytes, int len, u8 *result)
++{
++	dwc_wusb_prf(256, key, nonce, label, bytes, len, result);
++}
++
++
++void dwc_wusb_fill_ccm_nonce(uint16_t haddr, uint16_t daddr, uint8_t *tkid,
++			       uint8_t *nonce);
++void dwc_wusb_gen_nonce(uint16_t addr,
++			  uint8_t *nonce);
++
++void dwc_wusb_gen_key(uint8_t *ccm_nonce, uint8_t *mk,
++			uint8_t *hnonce, uint8_t *dnonce,
++			uint8_t *kck, uint8_t *ptk);
++
++
++void dwc_wusb_gen_mic(uint8_t *ccm_nonce, uint8_t
++			*kck, uint8_t *data, uint8_t *mic);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _DWC_CRYPTO_H_ */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_dh.c
+@@ -0,0 +1,291 @@
++/* =========================================================================
++ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_dh.c $
++ * $Revision: #3 $
++ * $Date: 2010/09/28 $
++ * $Change: 1596182 $
++ *
++ * Synopsys Portability Library Software and documentation
++ * (hereinafter, "Software") is an Unsupported proprietary work of
++ * Synopsys, Inc. unless otherwise expressly agreed to in writing
++ * between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product
++ * under any End User Software License Agreement or Agreement for
++ * Licensed Product with Synopsys or any supplement thereto. You are
++ * permitted to use and redistribute this Software in source and binary
++ * forms, with or without modification, provided that redistributions
++ * of source code must retain this notice. You may not view, use,
++ * disclose, copy or distribute this file or any information contained
++ * herein except pursuant to this license grant from Synopsys. If you
++ * do not agree with this notice, including the disclaimer below, then
++ * you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
++ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
++ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
++ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
++ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
++ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================= */
++#ifdef DWC_CRYPTOLIB
++
++#ifndef CONFIG_MACH_IPMATE
++
++#include "dwc_dh.h"
++#include "dwc_modpow.h"
++
++#ifdef DEBUG
++/* This function prints out a buffer in the format described in the Association
++ * Model specification. */
++static void dh_dump(char *str, void *_num, int len)
++{
++	uint8_t *num = _num;
++	int i;
++	DWC_PRINTF("%s\n", str);
++	for (i = 0; i < len; i ++) {
++		DWC_PRINTF("%02x", num[i]);
++		if (((i + 1) % 2) == 0) DWC_PRINTF(" ");
++		if (((i + 1) % 26) == 0) DWC_PRINTF("\n");
++	}
++
++	DWC_PRINTF("\n");
++}
++#else
++#define dh_dump(_x...) do {; } while(0)
++#endif
++
++/* Constant g value */
++static __u32 dh_g[] = {
++	0x02000000,
++};
++
++/* Constant p value */
++static __u32 dh_p[] = {
++	0xFFFFFFFF, 0xFFFFFFFF, 0xA2DA0FC9, 0x34C26821, 0x8B62C6C4, 0xD11CDC80, 0x084E0229, 0x74CC678A,
++	0xA6BE0B02, 0x229B133B, 0x79084A51, 0xDD04348E, 0xB31995EF, 0x1B433ACD, 0x6D0A2B30, 0x37145FF2,
++	0x6D35E14F, 0x45C2516D, 0x76B585E4, 0xC67E5E62, 0xE9424CF4, 0x6BED37A6, 0xB65CFF0B, 0xEDB706F4,
++	0xFB6B38EE, 0xA59F895A, 0x11249FAE, 0xE61F4B7C, 0x51662849, 0x3D5BE4EC, 0xB87C00C2, 0x05BF63A1,
++	0x3648DA98, 0x9AD3551C, 0xA83F1669, 0x5FCF24FD, 0x235D6583, 0x96ADA3DC, 0x56F3621C, 0xBB528520,
++	0x0729D59E, 0x6D969670, 0x4E350C67, 0x0498BC4A, 0x086C74F1, 0x7C2118CA, 0x465E9032, 0x3BCE362E,
++	0x2C779EE3, 0x03860E18, 0xA283279B, 0x8FA207EC, 0xF05DC5B5, 0xC9524C6F, 0xF6CB2BDE, 0x18175895,
++	0x7C499539, 0xE56A95EA, 0x1826D215, 0x1005FA98, 0x5A8E7215, 0x2DC4AA8A, 0x0D1733AD, 0x337A5004,
++	0xAB2155A8, 0x64BA1CDF, 0x0485FBEC, 0x0AEFDB58, 0x5771EA8A, 0x7D0C065D, 0x850F97B3, 0xC7E4E1A6,
++	0x8CAEF5AB, 0xD73309DB, 0xE0948C1E, 0x9D61254A, 0x26D2E3CE, 0x6BEED21A, 0x06FA2FF1, 0x64088AD9,
++	0x730276D8, 0x646AC83E, 0x182B1F52, 0x0C207B17, 0x5717E1BB, 0x6C5D617A, 0xC0880977, 0xE246D9BA,
++	0xA04FE208, 0x31ABE574, 0xFC5BDB43, 0x8E10FDE0, 0x20D1824B, 0xCAD23AA9, 0xFFFFFFFF, 0xFFFFFFFF,
++};
++
++static void dh_swap_bytes(void *_in, void *_out, uint32_t len)
++{
++	uint8_t *in = _in;
++	uint8_t *out = _out;
++	int i;
++	for (i=0; i<len; i++) {
++		out[i] = in[len-1-i];
++	}
++}
++
++/* Computes the modular exponentiation (num^exp % mod).  num, exp, and mod are
++ * big endian numbers of size len, in bytes.  Each len value must be a multiple
++ * of 4. */
++int dwc_dh_modpow(void *mem_ctx, void *num, uint32_t num_len,
++		  void *exp, uint32_t exp_len,
++		  void *mod, uint32_t mod_len,
++		  void *out)
++{
++	/* modpow() takes little endian numbers.  AM uses big-endian.  This
++	 * function swaps bytes of numbers before passing onto modpow. */
++
++	int retval = 0;
++	uint32_t *result;
++
++	uint32_t *bignum_num = dwc_alloc(mem_ctx, num_len + 4);
++	uint32_t *bignum_exp = dwc_alloc(mem_ctx, exp_len + 4);
++	uint32_t *bignum_mod = dwc_alloc(mem_ctx, mod_len + 4);
++
++	dh_swap_bytes(num, &bignum_num[1], num_len);
++	bignum_num[0] = num_len / 4;
++
++	dh_swap_bytes(exp, &bignum_exp[1], exp_len);
++	bignum_exp[0] = exp_len / 4;
++
++	dh_swap_bytes(mod, &bignum_mod[1], mod_len);
++	bignum_mod[0] = mod_len / 4;
++
++	result = dwc_modpow(mem_ctx, bignum_num, bignum_exp, bignum_mod);
++	if (!result) {
++		retval = -1;
++		goto dh_modpow_nomem;
++	}
++
++	dh_swap_bytes(&result[1], out, result[0] * 4);
++	dwc_free(mem_ctx, result);
++
++ dh_modpow_nomem:
++	dwc_free(mem_ctx, bignum_num);
++	dwc_free(mem_ctx, bignum_exp);
++	dwc_free(mem_ctx, bignum_mod);
++	return retval;
++}
++
++
++int dwc_dh_pk(void *mem_ctx, uint8_t nd, uint8_t *exp, uint8_t *pk, uint8_t *hash)
++{
++	int retval;
++	uint8_t m3[385];
++
++#ifndef DH_TEST_VECTORS
++	DWC_RANDOM_BYTES(exp, 32);
++#endif
++
++	/* Compute the pkd */
++	if ((retval = dwc_dh_modpow(mem_ctx, dh_g, 4,
++				    exp, 32,
++				    dh_p, 384, pk))) {
++		return retval;
++	}
++
++	m3[384] = nd;
++	DWC_MEMCPY(&m3[0], pk, 384);
++	DWC_SHA256(m3, 385, hash);
++
++	dh_dump("PK", pk, 384);
++	dh_dump("SHA-256(M3)", hash, 32);
++	return 0;
++}
++
++int dwc_dh_derive_keys(void *mem_ctx, uint8_t nd, uint8_t *pkh, uint8_t *pkd,
++		       uint8_t *exp, int is_host,
++		       char *dd, uint8_t *ck, uint8_t *kdk)
++{
++	int retval;
++	uint8_t mv[784];
++	uint8_t sha_result[32];
++	uint8_t dhkey[384];
++	uint8_t shared_secret[384];
++	char *message;
++	uint32_t vd;
++
++	uint8_t *pk;
++
++	if (is_host) {
++		pk = pkd;
++	}
++	else {
++		pk = pkh;
++	}
++
++	if ((retval = dwc_dh_modpow(mem_ctx, pk, 384,
++				    exp, 32,
++				    dh_p, 384, shared_secret))) {
++		return retval;
++	}
++	dh_dump("Shared Secret", shared_secret, 384);
++
++	DWC_SHA256(shared_secret, 384, dhkey);
++	dh_dump("DHKEY", dhkey, 384);
++
++	DWC_MEMCPY(&mv[0], pkd, 384);
++	DWC_MEMCPY(&mv[384], pkh, 384);
++	DWC_MEMCPY(&mv[768], "displayed digest", 16);
++	dh_dump("MV", mv, 784);
++
++	DWC_SHA256(mv, 784, sha_result);
++	dh_dump("SHA-256(MV)", sha_result, 32);
++	dh_dump("First 32-bits of SHA-256(MV)", sha_result, 4);
++
++	dh_swap_bytes(sha_result, &vd, 4);
++#ifdef DEBUG
++	DWC_PRINTF("Vd (decimal) = %d\n", vd);
++#endif
++
++	switch (nd) {
++	case 2:
++		vd = vd % 100;
++		DWC_SPRINTF(dd, "%02d", vd);
++		break;
++	case 3:
++		vd = vd % 1000;
++		DWC_SPRINTF(dd, "%03d", vd);
++		break;
++	case 4:
++		vd = vd % 10000;
++		DWC_SPRINTF(dd, "%04d", vd);
++		break;
++	}
++#ifdef DEBUG
++	DWC_PRINTF("Display Digits: %s\n", dd);
++#endif
++
++	message = "connection key";
++	DWC_HMAC_SHA256(message, DWC_STRLEN(message), dhkey, 32, sha_result);
++	dh_dump("HMAC(SHA-256, DHKey, connection key)", sha_result, 32);
++	DWC_MEMCPY(ck, sha_result, 16);
++
++	message = "key derivation key";
++	DWC_HMAC_SHA256(message, DWC_STRLEN(message), dhkey, 32, sha_result);
++	dh_dump("HMAC(SHA-256, DHKey, key derivation key)", sha_result, 32);
++	DWC_MEMCPY(kdk, sha_result, 32);
++
++	return 0;
++}
++
++
++#ifdef DH_TEST_VECTORS
++
++static __u8 dh_a[] = {
++	0x44, 0x00, 0x51, 0xd6,
++	0xf0, 0xb5, 0x5e, 0xa9,
++	0x67, 0xab, 0x31, 0xc6,
++	0x8a, 0x8b, 0x5e, 0x37,
++	0xd9, 0x10, 0xda, 0xe0,
++	0xe2, 0xd4, 0x59, 0xa4,
++	0x86, 0x45, 0x9c, 0xaa,
++	0xdf, 0x36, 0x75, 0x16,
++};
++
++static __u8 dh_b[] = {
++	0x5d, 0xae, 0xc7, 0x86,
++	0x79, 0x80, 0xa3, 0x24,
++	0x8c, 0xe3, 0x57, 0x8f,
++	0xc7, 0x5f, 0x1b, 0x0f,
++	0x2d, 0xf8, 0x9d, 0x30,
++	0x6f, 0xa4, 0x52, 0xcd,
++	0xe0, 0x7a, 0x04, 0x8a,
++	0xde, 0xd9, 0x26, 0x56,
++};
++
++void dwc_run_dh_test_vectors(void *mem_ctx)
++{
++	uint8_t pkd[384];
++	uint8_t pkh[384];
++	uint8_t hashd[32];
++	uint8_t hashh[32];
++	uint8_t ck[16];
++	uint8_t kdk[32];
++	char dd[5];
++
++	DWC_PRINTF("\n\n\nDH_TEST_VECTORS\n\n");
++
++	/* compute the PKd and SHA-256(PKd || Nd) */
++	DWC_PRINTF("Computing PKd\n");
++	dwc_dh_pk(mem_ctx, 2, dh_a, pkd, hashd);
++
++	/* compute the PKd and SHA-256(PKh || Nd) */
++	DWC_PRINTF("Computing PKh\n");
++	dwc_dh_pk(mem_ctx, 2, dh_b, pkh, hashh);
++
++	/* compute the dhkey */
++	dwc_dh_derive_keys(mem_ctx, 2, pkh, pkd, dh_a, 0, dd, ck, kdk);
++}
++#endif /* DH_TEST_VECTORS */
++
++#endif /* !CONFIG_MACH_IPMATE */
++
++#endif /* DWC_CRYPTOLIB */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_dh.h
+@@ -0,0 +1,106 @@
++/* =========================================================================
++ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_dh.h $
++ * $Revision: #4 $
++ * $Date: 2010/09/28 $
++ * $Change: 1596182 $
++ *
++ * Synopsys Portability Library Software and documentation
++ * (hereinafter, "Software") is an Unsupported proprietary work of
++ * Synopsys, Inc. unless otherwise expressly agreed to in writing
++ * between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product
++ * under any End User Software License Agreement or Agreement for
++ * Licensed Product with Synopsys or any supplement thereto. You are
++ * permitted to use and redistribute this Software in source and binary
++ * forms, with or without modification, provided that redistributions
++ * of source code must retain this notice. You may not view, use,
++ * disclose, copy or distribute this file or any information contained
++ * herein except pursuant to this license grant from Synopsys. If you
++ * do not agree with this notice, including the disclaimer below, then
++ * you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
++ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
++ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
++ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
++ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
++ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================= */
++#ifndef _DWC_DH_H_
++#define _DWC_DH_H_
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++#include "dwc_os.h"
++
++/** @file
++ *
++ * This file defines the common functions on device and host for performing
++ * numeric association as defined in the WUSB spec.  They are only to be
++ * used internally by the DWC UWB modules. */
++
++extern int dwc_dh_sha256(uint8_t *message, uint32_t len, uint8_t *out);
++extern int dwc_dh_hmac_sha256(uint8_t *message, uint32_t messagelen,
++			      uint8_t *key, uint32_t keylen,
++			      uint8_t *out);
++extern int dwc_dh_modpow(void *mem_ctx, void *num, uint32_t num_len,
++			 void *exp, uint32_t exp_len,
++			 void *mod, uint32_t mod_len,
++			 void *out);
++
++/** Computes PKD or PKH, and SHA-256(PKd || Nd)
++ *
++ * PK = g^exp mod p.
++ *
++ * Input:
++ * Nd = Number of digits on the device.
++ *
++ * Output:
++ * exp = A 32-byte buffer to be filled with a randomly generated number.
++ *       used as either A or B.
++ * pk = A 384-byte buffer to be filled with the PKH or PKD.
++ * hash = A 32-byte buffer to be filled with SHA-256(PK || ND).
++ */
++extern int dwc_dh_pk(void *mem_ctx, uint8_t nd, uint8_t *exp, uint8_t *pkd, uint8_t *hash);
++
++/** Computes the DHKEY, and VD.
++ *
++ * If called from host, then it will comput DHKEY=PKD^exp % p.
++ * If called from device, then it will comput DHKEY=PKH^exp % p.
++ *
++ * Input:
++ * pkd = The PKD value.
++ * pkh = The PKH value.
++ * exp = The A value (if device) or B value (if host) generated in dwc_wudev_dh_pk.
++ * is_host = Set to non zero if a WUSB host is calling this function.
++ *
++ * Output:
++
++ * dd = A pointer to an buffer to be set to the displayed digits string to be shown
++ *      to the user.  This buffer should be at 5 bytes long to hold 4 digits plus a
++ *      null termination character.  This buffer can be used directly for display.
++ * ck = A 16-byte buffer to be filled with the CK.
++ * kdk = A 32-byte buffer to be filled with the KDK.
++ */
++extern int dwc_dh_derive_keys(void *mem_ctx, uint8_t nd, uint8_t *pkh, uint8_t *pkd,
++			      uint8_t *exp, int is_host,
++			      char *dd, uint8_t *ck, uint8_t *kdk);
++
++#ifdef DH_TEST_VECTORS
++extern void dwc_run_dh_test_vectors(void);
++#endif
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _DWC_DH_H_ */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_list.h
+@@ -0,0 +1,594 @@
++/*	$OpenBSD: queue.h,v 1.26 2004/05/04 16:59:32 grange Exp $	*/
++/*	$NetBSD: queue.h,v 1.11 1996/05/16 05:17:14 mycroft Exp $	*/
++
++/*
++ * Copyright (c) 1991, 1993
++ *	The Regents of the University of California.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. Neither the name of the University nor the names of its contributors
++ *    may be used to endorse or promote products derived from this software
++ *    without specific prior written permission.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
++ * SUCH DAMAGE.
++ *
++ *	@(#)queue.h	8.5 (Berkeley) 8/20/94
++ */
++
++#ifndef _DWC_LIST_H_
++#define _DWC_LIST_H_
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++/** @file
++ *
++ * This file defines linked list operations.  It is derived from BSD with
++ * only the MACRO names being prefixed with DWC_.  This is because a few of
++ * these names conflict with those on Linux.  For documentation on use, see the
++ * inline comments in the source code.  The original license for this source
++ * code applies and is preserved in the dwc_list.h source file.
++ */
++
++/*
++ * This file defines five types of data structures: singly-linked lists,
++ * lists, simple queues, tail queues, and circular queues.
++ *
++ *
++ * A singly-linked list is headed by a single forward pointer. The elements
++ * are singly linked for minimum space and pointer manipulation overhead at
++ * the expense of O(n) removal for arbitrary elements. New elements can be
++ * added to the list after an existing element or at the head of the list.
++ * Elements being removed from the head of the list should use the explicit
++ * macro for this purpose for optimum efficiency. A singly-linked list may
++ * only be traversed in the forward direction.  Singly-linked lists are ideal
++ * for applications with large datasets and few or no removals or for
++ * implementing a LIFO queue.
++ *
++ * A list is headed by a single forward pointer (or an array of forward
++ * pointers for a hash table header). The elements are doubly linked
++ * so that an arbitrary element can be removed without a need to
++ * traverse the list. New elements can be added to the list before
++ * or after an existing element or at the head of the list. A list
++ * may only be traversed in the forward direction.
++ *
++ * A simple queue is headed by a pair of pointers, one the head of the
++ * list and the other to the tail of the list. The elements are singly
++ * linked to save space, so elements can only be removed from the
++ * head of the list. New elements can be added to the list before or after
++ * an existing element, at the head of the list, or at the end of the
++ * list. A simple queue may only be traversed in the forward direction.
++ *
++ * A tail queue is headed by a pair of pointers, one to the head of the
++ * list and the other to the tail of the list. The elements are doubly
++ * linked so that an arbitrary element can be removed without a need to
++ * traverse the list. New elements can be added to the list before or
++ * after an existing element, at the head of the list, or at the end of
++ * the list. A tail queue may be traversed in either direction.
++ *
++ * A circle queue is headed by a pair of pointers, one to the head of the
++ * list and the other to the tail of the list. The elements are doubly
++ * linked so that an arbitrary element can be removed without a need to
++ * traverse the list. New elements can be added to the list before or after
++ * an existing element, at the head of the list, or at the end of the list.
++ * A circle queue may be traversed in either direction, but has a more
++ * complex end of list detection.
++ *
++ * For details on the use of these macros, see the queue(3) manual page.
++ */
++
++/*
++ * Double-linked List.
++ */
++
++typedef struct dwc_list_link {
++	struct dwc_list_link *next;
++	struct dwc_list_link *prev;
++} dwc_list_link_t;
++
++#define DWC_LIST_INIT(link) do {	\
++	(link)->next = (link);		\
++	(link)->prev = (link);		\
++} while (0)
++
++#define DWC_LIST_FIRST(link)	((link)->next)
++#define DWC_LIST_LAST(link)	((link)->prev)
++#define DWC_LIST_END(link)	(link)
++#define DWC_LIST_NEXT(link)	((link)->next)
++#define DWC_LIST_PREV(link)	((link)->prev)
++#define DWC_LIST_EMPTY(link)	\
++	(DWC_LIST_FIRST(link) == DWC_LIST_END(link))
++#define DWC_LIST_ENTRY(link, type, field)			\
++	(type *)((uint8_t *)(link) - (size_t)(&((type *)0)->field))
++
++#if 0
++#define DWC_LIST_INSERT_HEAD(list, link) do {			\
++	(link)->next = (list)->next;				\
++	(link)->prev = (list);					\
++	(list)->next->prev = (link);				\
++	(list)->next = (link);					\
++} while (0)
++
++#define DWC_LIST_INSERT_TAIL(list, link) do {			\
++	(link)->next = (list);					\
++	(link)->prev = (list)->prev;				\
++	(list)->prev->next = (link);				\
++	(list)->prev = (link);					\
++} while (0)
++#else
++#define DWC_LIST_INSERT_HEAD(list, link) do {			\
++	dwc_list_link_t *__next__ = (list)->next;		\
++	__next__->prev = (link);				\
++	(link)->next = __next__;				\
++	(link)->prev = (list);					\
++	(list)->next = (link);					\
++} while (0)
++
++#define DWC_LIST_INSERT_TAIL(list, link) do {			\
++	dwc_list_link_t *__prev__ = (list)->prev;		\
++	(list)->prev = (link);					\
++	(link)->next = (list);					\
++	(link)->prev = __prev__;				\
++	__prev__->next = (link);				\
++} while (0)
++#endif
++
++#if 0
++static inline void __list_add(struct list_head *new,
++                              struct list_head *prev,
++                              struct list_head *next)
++{
++        next->prev = new;
++        new->next = next;
++        new->prev = prev;
++        prev->next = new;
++}
++
++static inline void list_add(struct list_head *new, struct list_head *head)
++{
++        __list_add(new, head, head->next);
++}
++
++static inline void list_add_tail(struct list_head *new, struct list_head *head)
++{
++        __list_add(new, head->prev, head);
++}
++
++static inline void __list_del(struct list_head * prev, struct list_head * next)
++{
++        next->prev = prev;
++        prev->next = next;
++}
++
++static inline void list_del(struct list_head *entry)
++{
++        __list_del(entry->prev, entry->next);
++        entry->next = LIST_POISON1;
++        entry->prev = LIST_POISON2;
++}
++#endif
++
++#define DWC_LIST_REMOVE(link) do {				\
++	(link)->next->prev = (link)->prev;			\
++	(link)->prev->next = (link)->next;			\
++} while (0)
++
++#define DWC_LIST_REMOVE_INIT(link) do {				\
++	DWC_LIST_REMOVE(link);					\
++	DWC_LIST_INIT(link);					\
++} while (0)
++
++#define DWC_LIST_MOVE_HEAD(list, link) do {			\
++	DWC_LIST_REMOVE(link);					\
++	DWC_LIST_INSERT_HEAD(list, link);			\
++} while (0)
++
++#define DWC_LIST_MOVE_TAIL(list, link) do {			\
++	DWC_LIST_REMOVE(link);					\
++	DWC_LIST_INSERT_TAIL(list, link);			\
++} while (0)
++
++#define DWC_LIST_FOREACH(var, list)				\
++	for((var) = DWC_LIST_FIRST(list);			\
++	    (var) != DWC_LIST_END(list);			\
++	    (var) = DWC_LIST_NEXT(var))
++
++#define DWC_LIST_FOREACH_SAFE(var, var2, list)			\
++	for((var) = DWC_LIST_FIRST(list), (var2) = DWC_LIST_NEXT(var);	\
++	    (var) != DWC_LIST_END(list);			\
++	    (var) = (var2), (var2) = DWC_LIST_NEXT(var2))
++
++#define DWC_LIST_FOREACH_REVERSE(var, list)			\
++	for((var) = DWC_LIST_LAST(list);			\
++	    (var) != DWC_LIST_END(list);			\
++	    (var) = DWC_LIST_PREV(var))
++
++/*
++ * Singly-linked List definitions.
++ */
++#define DWC_SLIST_HEAD(name, type)					\
++struct name {								\
++	struct type *slh_first;	/* first element */			\
++}
++
++#define DWC_SLIST_HEAD_INITIALIZER(head)				\
++	{ NULL }
++
++#define DWC_SLIST_ENTRY(type)						\
++struct {								\
++	struct type *sle_next;	/* next element */			\
++}
++
++/*
++ * Singly-linked List access methods.
++ */
++#define DWC_SLIST_FIRST(head)	((head)->slh_first)
++#define DWC_SLIST_END(head)		NULL
++#define DWC_SLIST_EMPTY(head)	(SLIST_FIRST(head) == SLIST_END(head))
++#define DWC_SLIST_NEXT(elm, field)	((elm)->field.sle_next)
++
++#define DWC_SLIST_FOREACH(var, head, field)				\
++	for((var) = SLIST_FIRST(head);					\
++	    (var) != SLIST_END(head);					\
++	    (var) = SLIST_NEXT(var, field))
++
++#define DWC_SLIST_FOREACH_PREVPTR(var, varp, head, field)		\
++	for((varp) = &SLIST_FIRST((head));				\
++	    ((var) = *(varp)) != SLIST_END(head);			\
++	    (varp) = &SLIST_NEXT((var), field))
++
++/*
++ * Singly-linked List functions.
++ */
++#define DWC_SLIST_INIT(head) {						\
++	SLIST_FIRST(head) = SLIST_END(head);				\
++}
++
++#define DWC_SLIST_INSERT_AFTER(slistelm, elm, field) do {		\
++	(elm)->field.sle_next = (slistelm)->field.sle_next;		\
++	(slistelm)->field.sle_next = (elm);				\
++} while (0)
++
++#define DWC_SLIST_INSERT_HEAD(head, elm, field) do {			\
++	(elm)->field.sle_next = (head)->slh_first;			\
++	(head)->slh_first = (elm);					\
++} while (0)
++
++#define DWC_SLIST_REMOVE_NEXT(head, elm, field) do {			\
++	(elm)->field.sle_next = (elm)->field.sle_next->field.sle_next;	\
++} while (0)
++
++#define DWC_SLIST_REMOVE_HEAD(head, field) do {				\
++	(head)->slh_first = (head)->slh_first->field.sle_next;		\
++} while (0)
++
++#define DWC_SLIST_REMOVE(head, elm, type, field) do {			\
++	if ((head)->slh_first == (elm)) {				\
++		SLIST_REMOVE_HEAD((head), field);			\
++	}								\
++	else {								\
++		struct type *curelm = (head)->slh_first;		\
++		while( curelm->field.sle_next != (elm) )		\
++			curelm = curelm->field.sle_next;		\
++		curelm->field.sle_next =				\
++		    curelm->field.sle_next->field.sle_next;		\
++	}								\
++} while (0)
++
++/*
++ * Simple queue definitions.
++ */
++#define DWC_SIMPLEQ_HEAD(name, type)					\
++struct name {								\
++	struct type *sqh_first;	/* first element */			\
++	struct type **sqh_last;	/* addr of last next element */		\
++}
++
++#define DWC_SIMPLEQ_HEAD_INITIALIZER(head)				\
++	{ NULL, &(head).sqh_first }
++
++#define DWC_SIMPLEQ_ENTRY(type)						\
++struct {								\
++	struct type *sqe_next;	/* next element */			\
++}
++
++/*
++ * Simple queue access methods.
++ */
++#define DWC_SIMPLEQ_FIRST(head)	    ((head)->sqh_first)
++#define DWC_SIMPLEQ_END(head)	    NULL
++#define DWC_SIMPLEQ_EMPTY(head)	    (SIMPLEQ_FIRST(head) == SIMPLEQ_END(head))
++#define DWC_SIMPLEQ_NEXT(elm, field)    ((elm)->field.sqe_next)
++
++#define DWC_SIMPLEQ_FOREACH(var, head, field)				\
++	for((var) = SIMPLEQ_FIRST(head);				\
++	    (var) != SIMPLEQ_END(head);					\
++	    (var) = SIMPLEQ_NEXT(var, field))
++
++/*
++ * Simple queue functions.
++ */
++#define DWC_SIMPLEQ_INIT(head) do {					\
++	(head)->sqh_first = NULL;					\
++	(head)->sqh_last = &(head)->sqh_first;				\
++} while (0)
++
++#define DWC_SIMPLEQ_INSERT_HEAD(head, elm, field) do {			\
++	if (((elm)->field.sqe_next = (head)->sqh_first) == NULL)	\
++		(head)->sqh_last = &(elm)->field.sqe_next;		\
++	(head)->sqh_first = (elm);					\
++} while (0)
++
++#define DWC_SIMPLEQ_INSERT_TAIL(head, elm, field) do {			\
++	(elm)->field.sqe_next = NULL;					\
++	*(head)->sqh_last = (elm);					\
++	(head)->sqh_last = &(elm)->field.sqe_next;			\
++} while (0)
++
++#define DWC_SIMPLEQ_INSERT_AFTER(head, listelm, elm, field) do {	\
++	if (((elm)->field.sqe_next = (listelm)->field.sqe_next) == NULL)\
++		(head)->sqh_last = &(elm)->field.sqe_next;		\
++	(listelm)->field.sqe_next = (elm);				\
++} while (0)
++
++#define DWC_SIMPLEQ_REMOVE_HEAD(head, field) do {			\
++	if (((head)->sqh_first = (head)->sqh_first->field.sqe_next) == NULL) \
++		(head)->sqh_last = &(head)->sqh_first;			\
++} while (0)
++
++/*
++ * Tail queue definitions.
++ */
++#define DWC_TAILQ_HEAD(name, type)					\
++struct name {								\
++	struct type *tqh_first;	/* first element */			\
++	struct type **tqh_last;	/* addr of last next element */		\
++}
++
++#define DWC_TAILQ_HEAD_INITIALIZER(head)				\
++	{ NULL, &(head).tqh_first }
++
++#define DWC_TAILQ_ENTRY(type)						\
++struct {								\
++	struct type *tqe_next;	/* next element */			\
++	struct type **tqe_prev;	/* address of previous next element */	\
++}
++
++/*
++ * tail queue access methods
++ */
++#define DWC_TAILQ_FIRST(head)		((head)->tqh_first)
++#define DWC_TAILQ_END(head)		NULL
++#define DWC_TAILQ_NEXT(elm, field)	((elm)->field.tqe_next)
++#define DWC_TAILQ_LAST(head, headname)					\
++	(*(((struct headname *)((head)->tqh_last))->tqh_last))
++/* XXX */
++#define DWC_TAILQ_PREV(elm, headname, field)				\
++	(*(((struct headname *)((elm)->field.tqe_prev))->tqh_last))
++#define DWC_TAILQ_EMPTY(head)						\
++	(DWC_TAILQ_FIRST(head) == DWC_TAILQ_END(head))
++
++#define DWC_TAILQ_FOREACH(var, head, field)				\
++	for ((var) = DWC_TAILQ_FIRST(head);				\
++	    (var) != DWC_TAILQ_END(head);				\
++	    (var) = DWC_TAILQ_NEXT(var, field))
++
++#define DWC_TAILQ_FOREACH_REVERSE(var, head, headname, field)		\
++	for ((var) = DWC_TAILQ_LAST(head, headname);			\
++	    (var) != DWC_TAILQ_END(head);				\
++	    (var) = DWC_TAILQ_PREV(var, headname, field))
++
++/*
++ * Tail queue functions.
++ */
++#define DWC_TAILQ_INIT(head) do {					\
++	(head)->tqh_first = NULL;					\
++	(head)->tqh_last = &(head)->tqh_first;				\
++} while (0)
++
++#define DWC_TAILQ_INSERT_HEAD(head, elm, field) do {			\
++	if (((elm)->field.tqe_next = (head)->tqh_first) != NULL)	\
++		(head)->tqh_first->field.tqe_prev =			\
++		    &(elm)->field.tqe_next;				\
++	else								\
++		(head)->tqh_last = &(elm)->field.tqe_next;		\
++	(head)->tqh_first = (elm);					\
++	(elm)->field.tqe_prev = &(head)->tqh_first;			\
++} while (0)
++
++#define DWC_TAILQ_INSERT_TAIL(head, elm, field) do {			\
++	(elm)->field.tqe_next = NULL;					\
++	(elm)->field.tqe_prev = (head)->tqh_last;			\
++	*(head)->tqh_last = (elm);					\
++	(head)->tqh_last = &(elm)->field.tqe_next;			\
++} while (0)
++
++#define DWC_TAILQ_INSERT_AFTER(head, listelm, elm, field) do {		\
++	if (((elm)->field.tqe_next = (listelm)->field.tqe_next) != NULL)\
++		(elm)->field.tqe_next->field.tqe_prev =			\
++		    &(elm)->field.tqe_next;				\
++	else								\
++		(head)->tqh_last = &(elm)->field.tqe_next;		\
++	(listelm)->field.tqe_next = (elm);				\
++	(elm)->field.tqe_prev = &(listelm)->field.tqe_next;		\
++} while (0)
++
++#define DWC_TAILQ_INSERT_BEFORE(listelm, elm, field) do {		\
++	(elm)->field.tqe_prev = (listelm)->field.tqe_prev;		\
++	(elm)->field.tqe_next = (listelm);				\
++	*(listelm)->field.tqe_prev = (elm);				\
++	(listelm)->field.tqe_prev = &(elm)->field.tqe_next;		\
++} while (0)
++
++#define DWC_TAILQ_REMOVE(head, elm, field) do {				\
++	if (((elm)->field.tqe_next) != NULL)				\
++		(elm)->field.tqe_next->field.tqe_prev =			\
++		    (elm)->field.tqe_prev;				\
++	else								\
++		(head)->tqh_last = (elm)->field.tqe_prev;		\
++	*(elm)->field.tqe_prev = (elm)->field.tqe_next;			\
++} while (0)
++
++#define DWC_TAILQ_REPLACE(head, elm, elm2, field) do {			\
++	if (((elm2)->field.tqe_next = (elm)->field.tqe_next) != NULL)	\
++		(elm2)->field.tqe_next->field.tqe_prev =		\
++		    &(elm2)->field.tqe_next;				\
++	else								\
++		(head)->tqh_last = &(elm2)->field.tqe_next;		\
++	(elm2)->field.tqe_prev = (elm)->field.tqe_prev;			\
++	*(elm2)->field.tqe_prev = (elm2);				\
++} while (0)
++
++/*
++ * Circular queue definitions.
++ */
++#define DWC_CIRCLEQ_HEAD(name, type)					\
++struct name {								\
++	struct type *cqh_first;		/* first element */		\
++	struct type *cqh_last;		/* last element */		\
++}
++
++#define DWC_CIRCLEQ_HEAD_INITIALIZER(head)				\
++	{ DWC_CIRCLEQ_END(&head), DWC_CIRCLEQ_END(&head) }
++
++#define DWC_CIRCLEQ_ENTRY(type)						\
++struct {								\
++	struct type *cqe_next;		/* next element */		\
++	struct type *cqe_prev;		/* previous element */		\
++}
++
++/*
++ * Circular queue access methods
++ */
++#define DWC_CIRCLEQ_FIRST(head)		((head)->cqh_first)
++#define DWC_CIRCLEQ_LAST(head)		((head)->cqh_last)
++#define DWC_CIRCLEQ_END(head)		((void *)(head))
++#define DWC_CIRCLEQ_NEXT(elm, field)	((elm)->field.cqe_next)
++#define DWC_CIRCLEQ_PREV(elm, field)	((elm)->field.cqe_prev)
++#define DWC_CIRCLEQ_EMPTY(head)						\
++	(DWC_CIRCLEQ_FIRST(head) == DWC_CIRCLEQ_END(head))
++
++#define DWC_CIRCLEQ_EMPTY_ENTRY(elm, field) (((elm)->field.cqe_next == NULL) && ((elm)->field.cqe_prev == NULL))
++
++#define DWC_CIRCLEQ_FOREACH(var, head, field)				\
++	for((var) = DWC_CIRCLEQ_FIRST(head);				\
++	    (var) != DWC_CIRCLEQ_END(head);				\
++	    (var) = DWC_CIRCLEQ_NEXT(var, field))
++
++#define DWC_CIRCLEQ_FOREACH_SAFE(var, var2, head, field)			\
++	for((var) = DWC_CIRCLEQ_FIRST(head), var2 = DWC_CIRCLEQ_NEXT(var, field); \
++	    (var) != DWC_CIRCLEQ_END(head);					\
++	    (var) = var2, var2 = DWC_CIRCLEQ_NEXT(var, field))
++
++#define DWC_CIRCLEQ_FOREACH_REVERSE(var, head, field)			\
++	for((var) = DWC_CIRCLEQ_LAST(head);				\
++	    (var) != DWC_CIRCLEQ_END(head);				\
++	    (var) = DWC_CIRCLEQ_PREV(var, field))
++
++/*
++ * Circular queue functions.
++ */
++#define DWC_CIRCLEQ_INIT(head) do {					\
++	(head)->cqh_first = DWC_CIRCLEQ_END(head);			\
++	(head)->cqh_last = DWC_CIRCLEQ_END(head);			\
++} while (0)
++
++#define DWC_CIRCLEQ_INIT_ENTRY(elm, field) do {				\
++	(elm)->field.cqe_next = NULL;					\
++	(elm)->field.cqe_prev = NULL;					\
++} while (0)
++
++#define DWC_CIRCLEQ_INSERT_AFTER(head, listelm, elm, field) do {	\
++	(elm)->field.cqe_next = (listelm)->field.cqe_next;		\
++	(elm)->field.cqe_prev = (listelm);				\
++	if ((listelm)->field.cqe_next == DWC_CIRCLEQ_END(head))		\
++		(head)->cqh_last = (elm);				\
++	else								\
++		(listelm)->field.cqe_next->field.cqe_prev = (elm);	\
++	(listelm)->field.cqe_next = (elm);				\
++} while (0)
++
++#define DWC_CIRCLEQ_INSERT_BEFORE(head, listelm, elm, field) do {	\
++	(elm)->field.cqe_next = (listelm);				\
++	(elm)->field.cqe_prev = (listelm)->field.cqe_prev;		\
++	if ((listelm)->field.cqe_prev == DWC_CIRCLEQ_END(head))		\
++		(head)->cqh_first = (elm);				\
++	else								\
++		(listelm)->field.cqe_prev->field.cqe_next = (elm);	\
++	(listelm)->field.cqe_prev = (elm);				\
++} while (0)
++
++#define DWC_CIRCLEQ_INSERT_HEAD(head, elm, field) do {			\
++	(elm)->field.cqe_next = (head)->cqh_first;			\
++	(elm)->field.cqe_prev = DWC_CIRCLEQ_END(head);			\
++	if ((head)->cqh_last == DWC_CIRCLEQ_END(head))			\
++		(head)->cqh_last = (elm);				\
++	else								\
++		(head)->cqh_first->field.cqe_prev = (elm);		\
++	(head)->cqh_first = (elm);					\
++} while (0)
++
++#define DWC_CIRCLEQ_INSERT_TAIL(head, elm, field) do {			\
++	(elm)->field.cqe_next = DWC_CIRCLEQ_END(head);			\
++	(elm)->field.cqe_prev = (head)->cqh_last;			\
++	if ((head)->cqh_first == DWC_CIRCLEQ_END(head))			\
++		(head)->cqh_first = (elm);				\
++	else								\
++		(head)->cqh_last->field.cqe_next = (elm);		\
++	(head)->cqh_last = (elm);					\
++} while (0)
++
++#define DWC_CIRCLEQ_REMOVE(head, elm, field) do {			\
++	if ((elm)->field.cqe_next == DWC_CIRCLEQ_END(head))		\
++		(head)->cqh_last = (elm)->field.cqe_prev;		\
++	else								\
++		(elm)->field.cqe_next->field.cqe_prev =			\
++		    (elm)->field.cqe_prev;				\
++	if ((elm)->field.cqe_prev == DWC_CIRCLEQ_END(head))		\
++		(head)->cqh_first = (elm)->field.cqe_next;		\
++	else								\
++		(elm)->field.cqe_prev->field.cqe_next =			\
++		    (elm)->field.cqe_next;				\
++} while (0)
++
++#define DWC_CIRCLEQ_REMOVE_INIT(head, elm, field) do {			\
++	DWC_CIRCLEQ_REMOVE(head, elm, field);				\
++	DWC_CIRCLEQ_INIT_ENTRY(elm, field);				\
++} while (0)
++
++#define DWC_CIRCLEQ_REPLACE(head, elm, elm2, field) do {		\
++	if (((elm2)->field.cqe_next = (elm)->field.cqe_next) ==		\
++	    DWC_CIRCLEQ_END(head))					\
++		(head).cqh_last = (elm2);				\
++	else								\
++		(elm2)->field.cqe_next->field.cqe_prev = (elm2);	\
++	if (((elm2)->field.cqe_prev = (elm)->field.cqe_prev) ==		\
++	    DWC_CIRCLEQ_END(head))					\
++		(head).cqh_first = (elm2);				\
++	else								\
++		(elm2)->field.cqe_prev->field.cqe_next = (elm2);	\
++} while (0)
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _DWC_LIST_H_ */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_mem.c
+@@ -0,0 +1,245 @@
++/* Memory Debugging */
++#ifdef DWC_DEBUG_MEMORY
++
++#include "dwc_os.h"
++#include "dwc_list.h"
++
++struct allocation {
++	void *addr;
++	void *ctx;
++	char *func;
++	int line;
++	uint32_t size;
++	int dma;
++	DWC_CIRCLEQ_ENTRY(allocation) entry;
++};
++
++DWC_CIRCLEQ_HEAD(allocation_queue, allocation);
++
++struct allocation_manager {
++	void *mem_ctx;
++	struct allocation_queue allocations;
++
++	/* statistics */
++	int num;
++	int num_freed;
++	int num_active;
++	uint32_t total;
++	uint32_t cur;
++	uint32_t max;
++};
++
++static struct allocation_manager *manager = NULL;
++
++static int add_allocation(void *ctx, uint32_t size, char const *func, int line, void *addr,
++			  int dma)
++{
++	struct allocation *a;
++
++	DWC_ASSERT(manager != NULL, "manager not allocated");
++
++	a = __DWC_ALLOC_ATOMIC(manager->mem_ctx, sizeof(*a));
++	if (!a) {
++		return -DWC_E_NO_MEMORY;
++	}
++
++	a->func = __DWC_ALLOC_ATOMIC(manager->mem_ctx, DWC_STRLEN(func) + 1);
++	if (!a->func) {
++		__DWC_FREE(manager->mem_ctx, a);
++		return -DWC_E_NO_MEMORY;
++	}
++
++	DWC_MEMCPY(a->func, func, DWC_STRLEN(func) + 1);
++	a->addr = addr;
++	a->ctx = ctx;
++	a->line = line;
++	a->size = size;
++	a->dma = dma;
++	DWC_CIRCLEQ_INSERT_TAIL(&manager->allocations, a, entry);
++
++	/* Update stats */
++	manager->num++;
++	manager->num_active++;
++	manager->total += size;
++	manager->cur += size;
++
++	if (manager->max < manager->cur) {
++		manager->max = manager->cur;
++	}
++
++	return 0;
++}
++
++static struct allocation *find_allocation(void *ctx, void *addr)
++{
++	struct allocation *a;
++
++	DWC_CIRCLEQ_FOREACH(a, &manager->allocations, entry) {
++		if (a->ctx == ctx && a->addr == addr) {
++			return a;
++		}
++	}
++
++	return NULL;
++}
++
++static void free_allocation(void *ctx, void *addr, char const *func, int line)
++{
++	struct allocation *a = find_allocation(ctx, addr);
++
++	if (!a) {
++		DWC_ASSERT(0,
++			   "Free of address %p that was never allocated or already freed %s:%d",
++			   addr, func, line);
++		return;
++	}
++
++	DWC_CIRCLEQ_REMOVE(&manager->allocations, a, entry);
++
++	manager->num_active--;
++	manager->num_freed++;
++	manager->cur -= a->size;
++	__DWC_FREE(manager->mem_ctx, a->func);
++	__DWC_FREE(manager->mem_ctx, a);
++}
++
++int dwc_memory_debug_start(void *mem_ctx)
++{
++	DWC_ASSERT(manager == NULL, "Memory debugging has already started\n");
++
++	if (manager) {
++		return -DWC_E_BUSY;
++	}
++
++	manager = __DWC_ALLOC(mem_ctx, sizeof(*manager));
++	if (!manager) {
++		return -DWC_E_NO_MEMORY;
++	}
++
++	DWC_CIRCLEQ_INIT(&manager->allocations);
++	manager->mem_ctx = mem_ctx;
++	manager->num = 0;
++	manager->num_freed = 0;
++	manager->num_active = 0;
++	manager->total = 0;
++	manager->cur = 0;
++	manager->max = 0;
++
++	return 0;
++}
++
++void dwc_memory_debug_stop(void)
++{
++	struct allocation *a;
++
++	dwc_memory_debug_report();
++
++	DWC_CIRCLEQ_FOREACH(a, &manager->allocations, entry) {
++		DWC_ERROR("Memory leaked from %s:%d\n", a->func, a->line);
++		free_allocation(a->ctx, a->addr, NULL, -1);
++	}
++
++	__DWC_FREE(manager->mem_ctx, manager);
++}
++
++void dwc_memory_debug_report(void)
++{
++	struct allocation *a;
++
++	DWC_PRINTF("\n\n\n----------------- Memory Debugging Report -----------------\n\n");
++	DWC_PRINTF("Num Allocations = %d\n", manager->num);
++	DWC_PRINTF("Freed = %d\n", manager->num_freed);
++	DWC_PRINTF("Active = %d\n", manager->num_active);
++	DWC_PRINTF("Current Memory Used = %d\n", manager->cur);
++	DWC_PRINTF("Total Memory Used = %d\n", manager->total);
++	DWC_PRINTF("Maximum Memory Used at Once = %d\n", manager->max);
++	DWC_PRINTF("Unfreed allocations:\n");
++
++	DWC_CIRCLEQ_FOREACH(a, &manager->allocations, entry) {
++		DWC_PRINTF("    addr=%p, size=%d from %s:%d, DMA=%d\n",
++			   a->addr, a->size, a->func, a->line, a->dma);
++	}
++}
++
++/* The replacement functions */
++void *dwc_alloc_debug(void *mem_ctx, uint32_t size, char const *func, int line)
++{
++	void *addr = __DWC_ALLOC(mem_ctx, size);
++
++	if (!addr) {
++		return NULL;
++	}
++
++	if (add_allocation(mem_ctx, size, func, line, addr, 0)) {
++		__DWC_FREE(mem_ctx, addr);
++		return NULL;
++	}
++
++	return addr;
++}
++
++void *dwc_alloc_atomic_debug(void *mem_ctx, uint32_t size, char const *func,
++			     int line)
++{
++	void *addr = __DWC_ALLOC_ATOMIC(mem_ctx, size);
++
++	if (!addr) {
++		return NULL;
++	}
++
++	if (add_allocation(mem_ctx, size, func, line, addr, 0)) {
++		__DWC_FREE(mem_ctx, addr);
++		return NULL;
++	}
++
++	return addr;
++}
++
++void dwc_free_debug(void *mem_ctx, void *addr, char const *func, int line)
++{
++	free_allocation(mem_ctx, addr, func, line);
++	__DWC_FREE(mem_ctx, addr);
++}
++
++void *dwc_dma_alloc_debug(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr,
++			  char const *func, int line)
++{
++	void *addr = __DWC_DMA_ALLOC(dma_ctx, size, dma_addr);
++
++	if (!addr) {
++		return NULL;
++	}
++
++	if (add_allocation(dma_ctx, size, func, line, addr, 1)) {
++		__DWC_DMA_FREE(dma_ctx, size, addr, *dma_addr);
++		return NULL;
++	}
++
++	return addr;
++}
++
++void *dwc_dma_alloc_atomic_debug(void *dma_ctx, uint32_t size,
++				 dwc_dma_t *dma_addr, char const *func, int line)
++{
++	void *addr = __DWC_DMA_ALLOC_ATOMIC(dma_ctx, size, dma_addr);
++
++	if (!addr) {
++		return NULL;
++	}
++
++	if (add_allocation(dma_ctx, size, func, line, addr, 1)) {
++		__DWC_DMA_FREE(dma_ctx, size, addr, *dma_addr);
++		return NULL;
++	}
++
++	return addr;
++}
++
++void dwc_dma_free_debug(void *dma_ctx, uint32_t size, void *virt_addr,
++			dwc_dma_t dma_addr, char const *func, int line)
++{
++	free_allocation(dma_ctx, virt_addr, func, line);
++	__DWC_DMA_FREE(dma_ctx, size, virt_addr, dma_addr);
++}
++
++#endif /* DWC_DEBUG_MEMORY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_modpow.c
+@@ -0,0 +1,636 @@
++/* Bignum routines adapted from PUTTY sources.  PuTTY copyright notice follows.
++ *
++ * PuTTY is copyright 1997-2007 Simon Tatham.
++ *
++ * Portions copyright Robert de Bath, Joris van Rantwijk, Delian
++ * Delchev, Andreas Schultz, Jeroen Massar, Wez Furlong, Nicolas Barry,
++ * Justin Bradford, Ben Harris, Malcolm Smith, Ahmad Khalifa, Markus
++ * Kuhn, and CORE SDI S.A.
++ *
++ * Permission is hereby granted, free of charge, to any person
++ * obtaining a copy of this software and associated documentation files
++ * (the "Software"), to deal in the Software without restriction,
++ * including without limitation the rights to use, copy, modify, merge,
++ * publish, distribute, sublicense, and/or sell copies of the Software,
++ * and to permit persons to whom the Software is furnished to do so,
++ * subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be
++ * included in all copies or substantial portions of the Software.
++
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
++ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
++ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
++ * NONINFRINGEMENT.  IN NO EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE
++ * FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
++ * CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
++ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
++ *
++ */
++#ifdef DWC_CRYPTOLIB
++
++#ifndef CONFIG_MACH_IPMATE
++
++#include "dwc_modpow.h"
++
++#define BIGNUM_INT_MASK  0xFFFFFFFFUL
++#define BIGNUM_TOP_BIT   0x80000000UL
++#define BIGNUM_INT_BITS  32
++
++
++static void *snmalloc(void *mem_ctx, size_t n, size_t size)
++{
++    void *p;
++    size *= n;
++    if (size == 0) size = 1;
++    p = dwc_alloc(mem_ctx, size);
++    return p;
++}
++
++#define snewn(ctx, n, type) ((type *)snmalloc((ctx), (n), sizeof(type)))
++#define sfree dwc_free
++
++/*
++ * Usage notes:
++ *  * Do not call the DIVMOD_WORD macro with expressions such as array
++ *    subscripts, as some implementations object to this (see below).
++ *  * Note that none of the division methods below will cope if the
++ *    quotient won't fit into BIGNUM_INT_BITS. Callers should be careful
++ *    to avoid this case.
++ *    If this condition occurs, in the case of the x86 DIV instruction,
++ *    an overflow exception will occur, which (according to a correspondent)
++ *    will manifest on Windows as something like
++ *      0xC0000095: Integer overflow
++ *    The C variant won't give the right answer, either.
++ */
++
++#define MUL_WORD(w1, w2) ((BignumDblInt)w1 * w2)
++
++#if defined __GNUC__ && defined __i386__
++#define DIVMOD_WORD(q, r, hi, lo, w) \
++    __asm__("div %2" : \
++	    "=d" (r), "=a" (q) : \
++	    "r" (w), "d" (hi), "a" (lo))
++#else
++#define DIVMOD_WORD(q, r, hi, lo, w) do { \
++    BignumDblInt n = (((BignumDblInt)hi) << BIGNUM_INT_BITS) | lo; \
++    q = n / w; \
++    r = n % w; \
++} while (0)
++#endif
++
++//    q = n / w;
++//    r = n % w;
++
++#define BIGNUM_INT_BYTES (BIGNUM_INT_BITS / 8)
++
++#define BIGNUM_INTERNAL
++
++static Bignum newbn(void *mem_ctx, int length)
++{
++    Bignum b = snewn(mem_ctx, length + 1, BignumInt);
++    //if (!b)
++    //abort();		       /* FIXME */
++    DWC_MEMSET(b, 0, (length + 1) * sizeof(*b));
++    b[0] = length;
++    return b;
++}
++
++void freebn(void *mem_ctx, Bignum b)
++{
++    /*
++     * Burn the evidence, just in case.
++     */
++    DWC_MEMSET(b, 0, sizeof(b[0]) * (b[0] + 1));
++    sfree(mem_ctx, b);
++}
++
++/*
++ * Compute c = a * b.
++ * Input is in the first len words of a and b.
++ * Result is returned in the first 2*len words of c.
++ */
++static void internal_mul(BignumInt *a, BignumInt *b,
++			 BignumInt *c, int len)
++{
++    int i, j;
++    BignumDblInt t;
++
++    for (j = 0; j < 2 * len; j++)
++	c[j] = 0;
++
++    for (i = len - 1; i >= 0; i--) {
++	t = 0;
++	for (j = len - 1; j >= 0; j--) {
++	    t += MUL_WORD(a[i], (BignumDblInt) b[j]);
++	    t += (BignumDblInt) c[i + j + 1];
++	    c[i + j + 1] = (BignumInt) t;
++	    t = t >> BIGNUM_INT_BITS;
++	}
++	c[i] = (BignumInt) t;
++    }
++}
++
++static void internal_add_shifted(BignumInt *number,
++				 unsigned n, int shift)
++{
++    int word = 1 + (shift / BIGNUM_INT_BITS);
++    int bshift = shift % BIGNUM_INT_BITS;
++    BignumDblInt addend;
++
++    addend = (BignumDblInt)n << bshift;
++
++    while (addend) {
++	addend += number[word];
++	number[word] = (BignumInt) addend & BIGNUM_INT_MASK;
++	addend >>= BIGNUM_INT_BITS;
++	word++;
++    }
++}
++
++/*
++ * Compute a = a % m.
++ * Input in first alen words of a and first mlen words of m.
++ * Output in first alen words of a
++ * (of which first alen-mlen words will be zero).
++ * The MSW of m MUST have its high bit set.
++ * Quotient is accumulated in the `quotient' array, which is a Bignum
++ * rather than the internal bigendian format. Quotient parts are shifted
++ * left by `qshift' before adding into quot.
++ */
++static void internal_mod(BignumInt *a, int alen,
++			 BignumInt *m, int mlen,
++			 BignumInt *quot, int qshift)
++{
++    BignumInt m0, m1;
++    unsigned int h;
++    int i, k;
++
++    m0 = m[0];
++    if (mlen > 1)
++	m1 = m[1];
++    else
++	m1 = 0;
++
++    for (i = 0; i <= alen - mlen; i++) {
++	BignumDblInt t;
++	unsigned int q, r, c, ai1;
++
++	if (i == 0) {
++	    h = 0;
++	} else {
++	    h = a[i - 1];
++	    a[i - 1] = 0;
++	}
++
++	if (i == alen - 1)
++	    ai1 = 0;
++	else
++	    ai1 = a[i + 1];
++
++	/* Find q = h:a[i] / m0 */
++	if (h >= m0) {
++	    /*
++	     * Special case.
++	     *
++	     * To illustrate it, suppose a BignumInt is 8 bits, and
++	     * we are dividing (say) A1:23:45:67 by A1:B2:C3. Then
++	     * our initial division will be 0xA123 / 0xA1, which
++	     * will give a quotient of 0x100 and a divide overflow.
++	     * However, the invariants in this division algorithm
++	     * are not violated, since the full number A1:23:... is
++	     * _less_ than the quotient prefix A1:B2:... and so the
++	     * following correction loop would have sorted it out.
++	     *
++	     * In this situation we set q to be the largest
++	     * quotient we _can_ stomach (0xFF, of course).
++	     */
++	    q = BIGNUM_INT_MASK;
++	} else {
++	    /* Macro doesn't want an array subscript expression passed
++	     * into it (see definition), so use a temporary. */
++	    BignumInt tmplo = a[i];
++	    DIVMOD_WORD(q, r, h, tmplo, m0);
++
++	    /* Refine our estimate of q by looking at
++	     h:a[i]:a[i+1] / m0:m1 */
++	    t = MUL_WORD(m1, q);
++	    if (t > ((BignumDblInt) r << BIGNUM_INT_BITS) + ai1) {
++		q--;
++		t -= m1;
++		r = (r + m0) & BIGNUM_INT_MASK;     /* overflow? */
++		if (r >= (BignumDblInt) m0 &&
++		    t > ((BignumDblInt) r << BIGNUM_INT_BITS) + ai1) q--;
++	    }
++	}
++
++	/* Subtract q * m from a[i...] */
++	c = 0;
++	for (k = mlen - 1; k >= 0; k--) {
++	    t = MUL_WORD(q, m[k]);
++	    t += c;
++	    c = (unsigned)(t >> BIGNUM_INT_BITS);
++	    if ((BignumInt) t > a[i + k])
++		c++;
++	    a[i + k] -= (BignumInt) t;
++	}
++
++	/* Add back m in case of borrow */
++	if (c != h) {
++	    t = 0;
++	    for (k = mlen - 1; k >= 0; k--) {
++		t += m[k];
++		t += a[i + k];
++		a[i + k] = (BignumInt) t;
++		t = t >> BIGNUM_INT_BITS;
++	    }
++	    q--;
++	}
++	if (quot)
++	    internal_add_shifted(quot, q, qshift + BIGNUM_INT_BITS * (alen - mlen - i));
++    }
++}
++
++/*
++ * Compute p % mod.
++ * The most significant word of mod MUST be non-zero.
++ * We assume that the result array is the same size as the mod array.
++ * We optionally write out a quotient if `quotient' is non-NULL.
++ * We can avoid writing out the result if `result' is NULL.
++ */
++void bigdivmod(void *mem_ctx, Bignum p, Bignum mod, Bignum result, Bignum quotient)
++{
++    BignumInt *n, *m;
++    int mshift;
++    int plen, mlen, i, j;
++
++    /* Allocate m of size mlen, copy mod to m */
++    /* We use big endian internally */
++    mlen = mod[0];
++    m = snewn(mem_ctx, mlen, BignumInt);
++    //if (!m)
++    //abort();		       /* FIXME */
++    for (j = 0; j < mlen; j++)
++	m[j] = mod[mod[0] - j];
++
++    /* Shift m left to make msb bit set */
++    for (mshift = 0; mshift < BIGNUM_INT_BITS-1; mshift++)
++	if ((m[0] << mshift) & BIGNUM_TOP_BIT)
++	    break;
++    if (mshift) {
++	for (i = 0; i < mlen - 1; i++)
++	    m[i] = (m[i] << mshift) | (m[i + 1] >> (BIGNUM_INT_BITS - mshift));
++	m[mlen - 1] = m[mlen - 1] << mshift;
++    }
++
++    plen = p[0];
++    /* Ensure plen > mlen */
++    if (plen <= mlen)
++	plen = mlen + 1;
++
++    /* Allocate n of size plen, copy p to n */
++    n = snewn(mem_ctx, plen, BignumInt);
++    //if (!n)
++    //abort();		       /* FIXME */
++    for (j = 0; j < plen; j++)
++	n[j] = 0;
++    for (j = 1; j <= (int)p[0]; j++)
++	n[plen - j] = p[j];
++
++    /* Main computation */
++    internal_mod(n, plen, m, mlen, quotient, mshift);
++
++    /* Fixup result in case the modulus was shifted */
++    if (mshift) {
++	for (i = plen - mlen - 1; i < plen - 1; i++)
++	    n[i] = (n[i] << mshift) | (n[i + 1] >> (BIGNUM_INT_BITS - mshift));
++	n[plen - 1] = n[plen - 1] << mshift;
++	internal_mod(n, plen, m, mlen, quotient, 0);
++	for (i = plen - 1; i >= plen - mlen; i--)
++	    n[i] = (n[i] >> mshift) | (n[i - 1] << (BIGNUM_INT_BITS - mshift));
++    }
++
++    /* Copy result to buffer */
++    if (result) {
++	for (i = 1; i <= (int)result[0]; i++) {
++	    int j = plen - i;
++	    result[i] = j >= 0 ? n[j] : 0;
++	}
++    }
++
++    /* Free temporary arrays */
++    for (i = 0; i < mlen; i++)
++	m[i] = 0;
++    sfree(mem_ctx, m);
++    for (i = 0; i < plen; i++)
++	n[i] = 0;
++    sfree(mem_ctx, n);
++}
++
++/*
++ * Simple remainder.
++ */
++Bignum bigmod(void *mem_ctx, Bignum a, Bignum b)
++{
++    Bignum r = newbn(mem_ctx, b[0]);
++    bigdivmod(mem_ctx, a, b, r, NULL);
++    return r;
++}
++
++/*
++ * Compute (base ^ exp) % mod.
++ */
++Bignum dwc_modpow(void *mem_ctx, Bignum base_in, Bignum exp, Bignum mod)
++{
++    BignumInt *a, *b, *n, *m;
++    int mshift;
++    int mlen, i, j;
++    Bignum base, result;
++
++    /*
++     * The most significant word of mod needs to be non-zero. It
++     * should already be, but let's make sure.
++     */
++    //assert(mod[mod[0]] != 0);
++
++    /*
++     * Make sure the base is smaller than the modulus, by reducing
++     * it modulo the modulus if not.
++     */
++    base = bigmod(mem_ctx, base_in, mod);
++
++    /* Allocate m of size mlen, copy mod to m */
++    /* We use big endian internally */
++    mlen = mod[0];
++    m = snewn(mem_ctx, mlen, BignumInt);
++    //if (!m)
++    //abort();		       /* FIXME */
++    for (j = 0; j < mlen; j++)
++	m[j] = mod[mod[0] - j];
++
++    /* Shift m left to make msb bit set */
++    for (mshift = 0; mshift < BIGNUM_INT_BITS - 1; mshift++)
++	if ((m[0] << mshift) & BIGNUM_TOP_BIT)
++	    break;
++    if (mshift) {
++	for (i = 0; i < mlen - 1; i++)
++	    m[i] =
++		(m[i] << mshift) | (m[i + 1] >>
++				    (BIGNUM_INT_BITS - mshift));
++	m[mlen - 1] = m[mlen - 1] << mshift;
++    }
++
++    /* Allocate n of size mlen, copy base to n */
++    n = snewn(mem_ctx, mlen, BignumInt);
++    //if (!n)
++    //abort();		       /* FIXME */
++    i = mlen - base[0];
++    for (j = 0; j < i; j++)
++	n[j] = 0;
++    for (j = 0; j < base[0]; j++)
++	n[i + j] = base[base[0] - j];
++
++    /* Allocate a and b of size 2*mlen. Set a = 1 */
++    a = snewn(mem_ctx, 2 * mlen, BignumInt);
++    //if (!a)
++    //abort();		       /* FIXME */
++    b = snewn(mem_ctx, 2 * mlen, BignumInt);
++    //if (!b)
++    //abort();		       /* FIXME */
++    for (i = 0; i < 2 * mlen; i++)
++	a[i] = 0;
++    a[2 * mlen - 1] = 1;
++
++    /* Skip leading zero bits of exp. */
++    i = 0;
++    j = BIGNUM_INT_BITS - 1;
++    while (i < exp[0] && (exp[exp[0] - i] & (1 << j)) == 0) {
++	j--;
++	if (j < 0) {
++	    i++;
++	    j = BIGNUM_INT_BITS - 1;
++	}
++    }
++
++    /* Main computation */
++    while (i < exp[0]) {
++	while (j >= 0) {
++	    internal_mul(a + mlen, a + mlen, b, mlen);
++	    internal_mod(b, mlen * 2, m, mlen, NULL, 0);
++	    if ((exp[exp[0] - i] & (1 << j)) != 0) {
++		internal_mul(b + mlen, n, a, mlen);
++		internal_mod(a, mlen * 2, m, mlen, NULL, 0);
++	    } else {
++		BignumInt *t;
++		t = a;
++		a = b;
++		b = t;
++	    }
++	    j--;
++	}
++	i++;
++	j = BIGNUM_INT_BITS - 1;
++    }
++
++    /* Fixup result in case the modulus was shifted */
++    if (mshift) {
++	for (i = mlen - 1; i < 2 * mlen - 1; i++)
++	    a[i] =
++		(a[i] << mshift) | (a[i + 1] >>
++				    (BIGNUM_INT_BITS - mshift));
++	a[2 * mlen - 1] = a[2 * mlen - 1] << mshift;
++	internal_mod(a, mlen * 2, m, mlen, NULL, 0);
++	for (i = 2 * mlen - 1; i >= mlen; i--)
++	    a[i] =
++		(a[i] >> mshift) | (a[i - 1] <<
++				    (BIGNUM_INT_BITS - mshift));
++    }
++
++    /* Copy result to buffer */
++    result = newbn(mem_ctx, mod[0]);
++    for (i = 0; i < mlen; i++)
++	result[result[0] - i] = a[i + mlen];
++    while (result[0] > 1 && result[result[0]] == 0)
++	result[0]--;
++
++    /* Free temporary arrays */
++    for (i = 0; i < 2 * mlen; i++)
++	a[i] = 0;
++    sfree(mem_ctx, a);
++    for (i = 0; i < 2 * mlen; i++)
++	b[i] = 0;
++    sfree(mem_ctx, b);
++    for (i = 0; i < mlen; i++)
++	m[i] = 0;
++    sfree(mem_ctx, m);
++    for (i = 0; i < mlen; i++)
++	n[i] = 0;
++    sfree(mem_ctx, n);
++
++    freebn(mem_ctx, base);
++
++    return result;
++}
++
++
++#ifdef UNITTEST
++
++static __u32 dh_p[] = {
++	96,
++	0xFFFFFFFF,
++	0xFFFFFFFF,
++	0xA93AD2CA,
++	0x4B82D120,
++	0xE0FD108E,
++	0x43DB5BFC,
++	0x74E5AB31,
++	0x08E24FA0,
++	0xBAD946E2,
++	0x770988C0,
++	0x7A615D6C,
++	0xBBE11757,
++	0x177B200C,
++	0x521F2B18,
++	0x3EC86A64,
++	0xD8760273,
++	0xD98A0864,
++	0xF12FFA06,
++	0x1AD2EE6B,
++	0xCEE3D226,
++	0x4A25619D,
++	0x1E8C94E0,
++	0xDB0933D7,
++	0xABF5AE8C,
++	0xA6E1E4C7,
++	0xB3970F85,
++	0x5D060C7D,
++	0x8AEA7157,
++	0x58DBEF0A,
++	0xECFB8504,
++	0xDF1CBA64,
++	0xA85521AB,
++	0x04507A33,
++	0xAD33170D,
++	0x8AAAC42D,
++	0x15728E5A,
++	0x98FA0510,
++	0x15D22618,
++	0xEA956AE5,
++	0x3995497C,
++	0x95581718,
++	0xDE2BCBF6,
++	0x6F4C52C9,
++	0xB5C55DF0,
++	0xEC07A28F,
++	0x9B2783A2,
++	0x180E8603,
++	0xE39E772C,
++	0x2E36CE3B,
++	0x32905E46,
++	0xCA18217C,
++	0xF1746C08,
++	0x4ABC9804,
++	0x670C354E,
++	0x7096966D,
++	0x9ED52907,
++	0x208552BB,
++	0x1C62F356,
++	0xDCA3AD96,
++	0x83655D23,
++	0xFD24CF5F,
++	0x69163FA8,
++	0x1C55D39A,
++	0x98DA4836,
++	0xA163BF05,
++	0xC2007CB8,
++	0xECE45B3D,
++	0x49286651,
++	0x7C4B1FE6,
++	0xAE9F2411,
++	0x5A899FA5,
++	0xEE386BFB,
++	0xF406B7ED,
++	0x0BFF5CB6,
++	0xA637ED6B,
++	0xF44C42E9,
++	0x625E7EC6,
++	0xE485B576,
++	0x6D51C245,
++	0x4FE1356D,
++	0xF25F1437,
++	0x302B0A6D,
++	0xCD3A431B,
++	0xEF9519B3,
++	0x8E3404DD,
++	0x514A0879,
++	0x3B139B22,
++	0x020BBEA6,
++	0x8A67CC74,
++	0x29024E08,
++	0x80DC1CD1,
++	0xC4C6628B,
++	0x2168C234,
++	0xC90FDAA2,
++	0xFFFFFFFF,
++	0xFFFFFFFF,
++};
++
++static __u32 dh_a[] = {
++	8,
++	0xdf367516,
++	0x86459caa,
++	0xe2d459a4,
++	0xd910dae0,
++	0x8a8b5e37,
++	0x67ab31c6,
++	0xf0b55ea9,
++	0x440051d6,
++};
++
++static __u32 dh_b[] = {
++	8,
++	0xded92656,
++	0xe07a048a,
++	0x6fa452cd,
++	0x2df89d30,
++	0xc75f1b0f,
++	0x8ce3578f,
++	0x7980a324,
++	0x5daec786,
++};
++
++static __u32 dh_g[] = {
++	1,
++	2,
++};
++
++int main(void)
++{
++	int i;
++	__u32 *k;
++	k = dwc_modpow(NULL, dh_g, dh_a, dh_p);
++
++	printf("\n\n");
++	for (i=0; i<k[0]; i++) {
++		__u32 word32 = k[k[0] - i];
++		__u16 l = word32 & 0xffff;
++		__u16 m = (word32 & 0xffff0000) >> 16;
++		printf("%04x %04x ", m, l);
++		if (!((i + 1)%13)) printf("\n");
++	}
++	printf("\n\n");
++
++	if ((k[0] == 0x60) && (k[1] == 0x28e490e5) && (k[0x60] == 0x5a0d3d4e)) {
++		printf("PASS\n\n");
++	}
++	else {
++		printf("FAIL\n\n");
++	}
++
++}
++
++#endif /* UNITTEST */
++
++#endif /* CONFIG_MACH_IPMATE */
++
++#endif /*DWC_CRYPTOLIB */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_modpow.h
+@@ -0,0 +1,34 @@
++/*
++ * dwc_modpow.h
++ * See dwc_modpow.c for license and changes
++ */
++#ifndef _DWC_MODPOW_H
++#define _DWC_MODPOW_H
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++#include "dwc_os.h"
++
++/** @file
++ *
++ * This file defines the module exponentiation function which is only used
++ * internally by the DWC UWB modules for calculation of PKs during numeric
++ * association.  The routine is taken from the PUTTY, an open source terminal
++ * emulator.  The PUTTY License is preserved in the dwc_modpow.c file.
++ *
++ */
++
++typedef uint32_t BignumInt;
++typedef uint64_t BignumDblInt;
++typedef BignumInt *Bignum;
++
++/* Compute modular exponentiaion */
++extern Bignum dwc_modpow(void *mem_ctx, Bignum base_in, Bignum exp, Bignum mod);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _LINUX_BIGNUM_H */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_notifier.c
+@@ -0,0 +1,319 @@
++#ifdef DWC_NOTIFYLIB
++
++#include "dwc_notifier.h"
++#include "dwc_list.h"
++
++typedef struct dwc_observer {
++	void *observer;
++	dwc_notifier_callback_t callback;
++	void *data;
++	char *notification;
++	DWC_CIRCLEQ_ENTRY(dwc_observer) list_entry;
++} observer_t;
++
++DWC_CIRCLEQ_HEAD(observer_queue, dwc_observer);
++
++typedef struct dwc_notifier {
++	void *mem_ctx;
++	void *object;
++	struct observer_queue observers;
++	DWC_CIRCLEQ_ENTRY(dwc_notifier) list_entry;
++} notifier_t;
++
++DWC_CIRCLEQ_HEAD(notifier_queue, dwc_notifier);
++
++typedef struct manager {
++	void *mem_ctx;
++	void *wkq_ctx;
++	dwc_workq_t *wq;
++//	dwc_mutex_t *mutex;
++	struct notifier_queue notifiers;
++} manager_t;
++
++static manager_t *manager = NULL;
++
++static int create_manager(void *mem_ctx, void *wkq_ctx)
++{
++	manager = dwc_alloc(mem_ctx, sizeof(manager_t));
++	if (!manager) {
++		return -DWC_E_NO_MEMORY;
++	}
++
++	DWC_CIRCLEQ_INIT(&manager->notifiers);
++
++	manager->wq = dwc_workq_alloc(wkq_ctx, "DWC Notification WorkQ");
++	if (!manager->wq) {
++		return -DWC_E_NO_MEMORY;
++	}
++
++	return 0;
++}
++
++static void free_manager(void)
++{
++	dwc_workq_free(manager->wq);
++
++	/* All notifiers must have unregistered themselves before this module
++	 * can be removed.  Hitting this assertion indicates a programmer
++	 * error. */
++	DWC_ASSERT(DWC_CIRCLEQ_EMPTY(&manager->notifiers),
++		   "Notification manager being freed before all notifiers have been removed");
++	dwc_free(manager->mem_ctx, manager);
++}
++
++#ifdef DEBUG
++static void dump_manager(void)
++{
++	notifier_t *n;
++	observer_t *o;
++
++	DWC_ASSERT(manager, "Notification manager not found");
++
++	DWC_DEBUG("List of all notifiers and observers:\n");
++	DWC_CIRCLEQ_FOREACH(n, &manager->notifiers, list_entry) {
++		DWC_DEBUG("Notifier %p has observers:\n", n->object);
++		DWC_CIRCLEQ_FOREACH(o, &n->observers, list_entry) {
++			DWC_DEBUG("    %p watching %s\n", o->observer, o->notification);
++		}
++	}
++}
++#else
++#define dump_manager(...)
++#endif
++
++static observer_t *alloc_observer(void *mem_ctx, void *observer, char *notification,
++				  dwc_notifier_callback_t callback, void *data)
++{
++	observer_t *new_observer = dwc_alloc(mem_ctx, sizeof(observer_t));
++
++	if (!new_observer) {
++		return NULL;
++	}
++
++	DWC_CIRCLEQ_INIT_ENTRY(new_observer, list_entry);
++	new_observer->observer = observer;
++	new_observer->notification = notification;
++	new_observer->callback = callback;
++	new_observer->data = data;
++	return new_observer;
++}
++
++static void free_observer(void *mem_ctx, observer_t *observer)
++{
++	dwc_free(mem_ctx, observer);
++}
++
++static notifier_t *alloc_notifier(void *mem_ctx, void *object)
++{
++	notifier_t *notifier;
++
++	if (!object) {
++		return NULL;
++	}
++
++	notifier = dwc_alloc(mem_ctx, sizeof(notifier_t));
++	if (!notifier) {
++		return NULL;
++	}
++
++	DWC_CIRCLEQ_INIT(&notifier->observers);
++	DWC_CIRCLEQ_INIT_ENTRY(notifier, list_entry);
++
++	notifier->mem_ctx = mem_ctx;
++	notifier->object = object;
++	return notifier;
++}
++
++static void free_notifier(notifier_t *notifier)
++{
++	observer_t *observer;
++
++	DWC_CIRCLEQ_FOREACH(observer, &notifier->observers, list_entry) {
++		free_observer(notifier->mem_ctx, observer);
++	}
++
++	dwc_free(notifier->mem_ctx, notifier);
++}
++
++static notifier_t *find_notifier(void *object)
++{
++	notifier_t *notifier;
++
++	DWC_ASSERT(manager, "Notification manager not found");
++
++	if (!object) {
++		return NULL;
++	}
++
++	DWC_CIRCLEQ_FOREACH(notifier, &manager->notifiers, list_entry) {
++		if (notifier->object == object) {
++			return notifier;
++		}
++	}
++
++	return NULL;
++}
++
++int dwc_alloc_notification_manager(void *mem_ctx, void *wkq_ctx)
++{
++	return create_manager(mem_ctx, wkq_ctx);
++}
++
++void dwc_free_notification_manager(void)
++{
++	free_manager();
++}
++
++dwc_notifier_t *dwc_register_notifier(void *mem_ctx, void *object)
++{
++	notifier_t *notifier;
++
++	DWC_ASSERT(manager, "Notification manager not found");
++
++	notifier = find_notifier(object);
++	if (notifier) {
++		DWC_ERROR("Notifier %p is already registered\n", object);
++		return NULL;
++	}
++
++	notifier = alloc_notifier(mem_ctx, object);
++	if (!notifier) {
++		return NULL;
++	}
++
++	DWC_CIRCLEQ_INSERT_TAIL(&manager->notifiers, notifier, list_entry);
++
++	DWC_INFO("Notifier %p registered", object);
++	dump_manager();
++
++	return notifier;
++}
++
++void dwc_unregister_notifier(dwc_notifier_t *notifier)
++{
++	DWC_ASSERT(manager, "Notification manager not found");
++
++	if (!DWC_CIRCLEQ_EMPTY(&notifier->observers)) {
++		observer_t *o;
++
++		DWC_ERROR("Notifier %p has active observers when removing\n", notifier->object);
++		DWC_CIRCLEQ_FOREACH(o, &notifier->observers, list_entry) {
++			DWC_DEBUGC("    %p watching %s\n", o->observer, o->notification);
++		}
++
++		DWC_ASSERT(DWC_CIRCLEQ_EMPTY(&notifier->observers),
++			   "Notifier %p has active observers when removing", notifier);
++	}
++
++	DWC_CIRCLEQ_REMOVE_INIT(&manager->notifiers, notifier, list_entry);
++	free_notifier(notifier);
++
++	DWC_INFO("Notifier unregistered");
++	dump_manager();
++}
++
++/* Add an observer to observe the notifier for a particular state, event, or notification. */
++int dwc_add_observer(void *observer, void *object, char *notification,
++		     dwc_notifier_callback_t callback, void *data)
++{
++	notifier_t *notifier = find_notifier(object);
++	observer_t *new_observer;
++
++	if (!notifier) {
++		DWC_ERROR("Notifier %p is not found when adding observer\n", object);
++		return -DWC_E_INVALID;
++	}
++
++	new_observer = alloc_observer(notifier->mem_ctx, observer, notification, callback, data);
++	if (!new_observer) {
++		return -DWC_E_NO_MEMORY;
++	}
++
++	DWC_CIRCLEQ_INSERT_TAIL(&notifier->observers, new_observer, list_entry);
++
++	DWC_INFO("Added observer %p to notifier %p observing notification %s, callback=%p, data=%p",
++		 observer, object, notification, callback, data);
++
++	dump_manager();
++	return 0;
++}
++
++int dwc_remove_observer(void *observer)
++{
++	notifier_t *n;
++
++	DWC_ASSERT(manager, "Notification manager not found");
++
++	DWC_CIRCLEQ_FOREACH(n, &manager->notifiers, list_entry) {
++		observer_t *o;
++		observer_t *o2;
++
++		DWC_CIRCLEQ_FOREACH_SAFE(o, o2, &n->observers, list_entry) {
++			if (o->observer == observer) {
++				DWC_CIRCLEQ_REMOVE_INIT(&n->observers, o, list_entry);
++				DWC_INFO("Removing observer %p from notifier %p watching notification %s:",
++					 o->observer, n->object, o->notification);
++				free_observer(n->mem_ctx, o);
++			}
++		}
++	}
++
++	dump_manager();
++	return 0;
++}
++
++typedef struct callback_data {
++	void *mem_ctx;
++	dwc_notifier_callback_t cb;
++	void *observer;
++	void *data;
++	void *object;
++	char *notification;
++	void *notification_data;
++} cb_data_t;
++
++static void cb_task(void *data)
++{
++	cb_data_t *cb = (cb_data_t *)data;
++
++	cb->cb(cb->object, cb->notification, cb->observer, cb->notification_data, cb->data);
++	dwc_free(cb->mem_ctx, cb);
++}
++
++void dwc_notify(dwc_notifier_t *notifier, char *notification, void *notification_data)
++{
++	observer_t *o;
++
++	DWC_ASSERT(manager, "Notification manager not found");
++
++	DWC_CIRCLEQ_FOREACH(o, &notifier->observers, list_entry) {
++		int len = DWC_STRLEN(notification);
++
++		if (DWC_STRLEN(o->notification) != len) {
++			continue;
++		}
++
++		if (DWC_STRNCMP(o->notification, notification, len) == 0) {
++			cb_data_t *cb_data = dwc_alloc(notifier->mem_ctx, sizeof(cb_data_t));
++
++			if (!cb_data) {
++				DWC_ERROR("Failed to allocate callback data\n");
++				return;
++			}
++
++			cb_data->mem_ctx = notifier->mem_ctx;
++			cb_data->cb = o->callback;
++			cb_data->observer = o->observer;
++			cb_data->data = o->data;
++			cb_data->object = notifier->object;
++			cb_data->notification = notification;
++			cb_data->notification_data = notification_data;
++			DWC_DEBUGC("Observer found %p for notification %s\n", o->observer, notification);
++			DWC_WORKQ_SCHEDULE(manager->wq, cb_task, cb_data,
++					   "Notify callback from %p for Notification %s, to observer %p",
++					   cb_data->object, notification, cb_data->observer);
++		}
++	}
++}
++
++#endif	/* DWC_NOTIFYLIB */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_notifier.h
+@@ -0,0 +1,122 @@
++
++#ifndef __DWC_NOTIFIER_H__
++#define __DWC_NOTIFIER_H__
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++#include "dwc_os.h"
++
++/** @file
++ *
++ * A simple implementation of the Observer pattern.  Any "module" can
++ * register as an observer or notifier.  The notion of "module" is abstract and
++ * can mean anything used to identify either an observer or notifier.  Usually
++ * it will be a pointer to a data structure which contains some state, ie an
++ * object.
++ *
++ * Before any notifiers can be added, the global notification manager must be
++ * brought up with dwc_alloc_notification_manager().
++ * dwc_free_notification_manager() will bring it down and free all resources.
++ * These would typically be called upon module load and unload.  The
++ * notification manager is a single global instance that handles all registered
++ * observable modules and observers so this should be done only once.
++ *
++ * A module can be observable by using Notifications to publicize some general
++ * information about it's state or operation.  It does not care who listens, or
++ * even if anyone listens, or what they do with the information.  The observable
++ * modules do not need to know any information about it's observers or their
++ * interface, or their state or data.
++ *
++ * Any module can register to emit Notifications.  It should publish a list of
++ * notifications that it can emit and their behavior, such as when they will get
++ * triggered, and what information will be provided to the observer.  Then it
++ * should register itself as an observable module. See dwc_register_notifier().
++ *
++ * Any module can observe any observable, registered module, provided it has a
++ * handle to the other module and knows what notifications to observe.  See
++ * dwc_add_observer().
++ *
++ * A function of type dwc_notifier_callback_t is called whenever a notification
++ * is triggered with one or more observers observing it.  This function is
++ * called in it's own process so it may sleep or block if needed.  It is
++ * guaranteed to be called sometime after the notification has occurred and will
++ * be called once per each time the notification is triggered.  It will NOT be
++ * called in the same process context used to trigger the notification.
++ *
++ * @section Limitiations
++ *
++ * Keep in mind that Notifications that can be triggered in rapid sucession may
++ * schedule too many processes too handle.  Be aware of this limitation when
++ * designing to use notifications, and only add notifications for appropriate
++ * observable information.
++ *
++ * Also Notification callbacks are not synchronous.  If you need to synchronize
++ * the behavior between module/observer you must use other means.  And perhaps
++ * that will mean Notifications are not the proper solution.
++ */
++
++struct dwc_notifier;
++typedef struct dwc_notifier dwc_notifier_t;
++
++/** The callback function must be of this type.
++ *
++ * @param object This is the object that is being observed.
++ * @param notification This is the notification that was triggered.
++ * @param observer This is the observer
++ * @param notification_data This is notification-specific data that the notifier
++ * has included in this notification.  The value of this should be published in
++ * the documentation of the observable module with the notifications.
++ * @param user_data This is any custom data that the observer provided when
++ * adding itself as an observer to the notification. */
++typedef void (*dwc_notifier_callback_t)(void *object, char *notification, void *observer,
++					void *notification_data, void *user_data);
++
++/** Brings up the notification manager. */
++extern int dwc_alloc_notification_manager(void *mem_ctx, void *wkq_ctx);
++/** Brings down the notification manager. */
++extern void dwc_free_notification_manager(void);
++
++/** This function registers an observable module.  A dwc_notifier_t object is
++ * returned to the observable module.  This is an opaque object that is used by
++ * the observable module to trigger notifications.  This object should only be
++ * accessible to functions that are authorized to trigger notifications for this
++ * module.  Observers do not need this object. */
++extern dwc_notifier_t *dwc_register_notifier(void *mem_ctx, void *object);
++
++/** This function unregisters an observable module.  All observers have to be
++ * removed prior to unregistration. */
++extern void dwc_unregister_notifier(dwc_notifier_t *notifier);
++
++/** Add a module as an observer to the observable module.  The observable module
++ * needs to have previously registered with the notification manager.
++ *
++ * @param observer The observer module
++ * @param object The module to observe
++ * @param notification The notification to observe
++ * @param callback The callback function to call
++ * @param user_data Any additional user data to pass into the callback function */
++extern int dwc_add_observer(void *observer, void *object, char *notification,
++			    dwc_notifier_callback_t callback, void *user_data);
++
++/** Removes the specified observer from all notifications that it is currently
++ * observing. */
++extern int dwc_remove_observer(void *observer);
++
++/** This function triggers a Notification.  It should be called by the
++ * observable module, or any module or library which the observable module
++ * allows to trigger notification on it's behalf.  Such as the dwc_cc_t.
++ *
++ * dwc_notify is a non-blocking function.  Callbacks are scheduled called in
++ * their own process context for each trigger.  Callbacks can be blocking.
++ * dwc_notify can be called from interrupt context if needed.
++ *
++ */
++void dwc_notify(dwc_notifier_t *notifier, char *notification, void *notification_data);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* __DWC_NOTIFIER_H__ */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_os.h
+@@ -0,0 +1,1275 @@
++/* =========================================================================
++ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_os.h $
++ * $Revision: #14 $
++ * $Date: 2010/11/04 $
++ * $Change: 1621695 $
++ *
++ * Synopsys Portability Library Software and documentation
++ * (hereinafter, "Software") is an Unsupported proprietary work of
++ * Synopsys, Inc. unless otherwise expressly agreed to in writing
++ * between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product
++ * under any End User Software License Agreement or Agreement for
++ * Licensed Product with Synopsys or any supplement thereto. You are
++ * permitted to use and redistribute this Software in source and binary
++ * forms, with or without modification, provided that redistributions
++ * of source code must retain this notice. You may not view, use,
++ * disclose, copy or distribute this file or any information contained
++ * herein except pursuant to this license grant from Synopsys. If you
++ * do not agree with this notice, including the disclaimer below, then
++ * you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
++ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
++ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
++ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
++ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
++ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================= */
++#ifndef _DWC_OS_H_
++#define _DWC_OS_H_
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++/** @file
++ *
++ * DWC portability library, low level os-wrapper functions
++ *
++ */
++
++/* These basic types need to be defined by some OS header file or custom header
++ * file for your specific target architecture.
++ *
++ * uint8_t, int8_t, uint16_t, int16_t, uint32_t, int32_t, uint64_t, int64_t
++ *
++ * Any custom or alternate header file must be added and enabled here.
++ */
++
++#ifdef DWC_LINUX
++# include <linux/types.h>
++# ifdef CONFIG_DEBUG_MUTEXES
++#  include <linux/mutex.h>
++# endif
++# include <linux/spinlock.h>
++# include <linux/errno.h>
++#endif
++
++#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
++# include <os_dep.h>
++#endif
++
++
++/** @name Primitive Types and Values */
++
++/** We define a boolean type for consistency.  Can be either YES or NO */
++typedef uint8_t dwc_bool_t;
++#define YES  1
++#define NO   0
++
++#ifdef DWC_LINUX
++
++/** @name Error Codes */
++#define DWC_E_INVALID		EINVAL
++#define DWC_E_NO_MEMORY		ENOMEM
++#define DWC_E_NO_DEVICE		ENODEV
++#define DWC_E_NOT_SUPPORTED	EOPNOTSUPP
++#define DWC_E_TIMEOUT		ETIMEDOUT
++#define DWC_E_BUSY		EBUSY
++#define DWC_E_AGAIN		EAGAIN
++#define DWC_E_RESTART		ERESTART
++#define DWC_E_ABORT		ECONNABORTED
++#define DWC_E_SHUTDOWN		ESHUTDOWN
++#define DWC_E_NO_DATA		ENODATA
++#define DWC_E_DISCONNECT	ECONNRESET
++#define DWC_E_UNKNOWN		EINVAL
++#define DWC_E_NO_STREAM_RES	ENOSR
++#define DWC_E_COMMUNICATION	ECOMM
++#define DWC_E_OVERFLOW		EOVERFLOW
++#define DWC_E_PROTOCOL		EPROTO
++#define DWC_E_IN_PROGRESS	EINPROGRESS
++#define DWC_E_PIPE		EPIPE
++#define DWC_E_IO		EIO
++#define DWC_E_NO_SPACE		ENOSPC
++
++#else
++
++/** @name Error Codes */
++#define DWC_E_INVALID		1001
++#define DWC_E_NO_MEMORY		1002
++#define DWC_E_NO_DEVICE		1003
++#define DWC_E_NOT_SUPPORTED	1004
++#define DWC_E_TIMEOUT		1005
++#define DWC_E_BUSY		1006
++#define DWC_E_AGAIN		1007
++#define DWC_E_RESTART		1008
++#define DWC_E_ABORT		1009
++#define DWC_E_SHUTDOWN		1010
++#define DWC_E_NO_DATA		1011
++#define DWC_E_DISCONNECT	2000
++#define DWC_E_UNKNOWN		3000
++#define DWC_E_NO_STREAM_RES	4001
++#define DWC_E_COMMUNICATION	4002
++#define DWC_E_OVERFLOW		4003
++#define DWC_E_PROTOCOL		4004
++#define DWC_E_IN_PROGRESS	4005
++#define DWC_E_PIPE		4006
++#define DWC_E_IO		4007
++#define DWC_E_NO_SPACE		4008
++
++#endif
++
++
++/** @name Tracing/Logging Functions
++ *
++ * These function provide the capability to add tracing, debugging, and error
++ * messages, as well exceptions as assertions.  The WUDEV uses these
++ * extensively.  These could be logged to the main console, the serial port, an
++ * internal buffer, etc.  These functions could also be no-op if they are too
++ * expensive on your system.  By default undefining the DEBUG macro already
++ * no-ops some of these functions. */
++
++/** Returns non-zero if in interrupt context. */
++extern dwc_bool_t DWC_IN_IRQ(void);
++#define dwc_in_irq DWC_IN_IRQ
++
++/** Returns "IRQ" if DWC_IN_IRQ is true. */
++static inline char *dwc_irq(void) {
++	return DWC_IN_IRQ() ? "IRQ" : "";
++}
++
++/** Returns non-zero if in bottom-half context. */
++extern dwc_bool_t DWC_IN_BH(void);
++#define dwc_in_bh DWC_IN_BH
++
++/** Returns "BH" if DWC_IN_BH is true. */
++static inline char *dwc_bh(void) {
++	return DWC_IN_BH() ? "BH" : "";
++}
++
++/**
++ * A vprintf() clone.  Just call vprintf if you've got it.
++ */
++extern void DWC_VPRINTF(char *format, va_list args);
++#define dwc_vprintf DWC_VPRINTF
++
++/**
++ * A vsnprintf() clone.  Just call vprintf if you've got it.
++ */
++extern int DWC_VSNPRINTF(char *str, int size, char *format, va_list args);
++#define dwc_vsnprintf DWC_VSNPRINTF
++
++/**
++ * printf() clone.  Just call printf if you've go it.
++ */
++extern void DWC_PRINTF(char *format, ...)
++/* This provides compiler level static checking of the parameters if you're
++ * using GCC. */
++#ifdef __GNUC__
++	__attribute__ ((format(printf, 1, 2)));
++#else
++	;
++#endif
++#define dwc_printf DWC_PRINTF
++
++/**
++ * sprintf() clone.  Just call sprintf if you've got it.
++ */
++extern int DWC_SPRINTF(char *string, char *format, ...)
++#ifdef __GNUC__
++	__attribute__ ((format(printf, 2, 3)));
++#else
++	;
++#endif
++#define dwc_sprintf DWC_SPRINTF
++
++/**
++ * snprintf() clone.  Just call snprintf if you've got it.
++ */
++extern int DWC_SNPRINTF(char *string, int size, char *format, ...)
++#ifdef __GNUC__
++	__attribute__ ((format(printf, 3, 4)));
++#else
++	;
++#endif
++#define dwc_snprintf DWC_SNPRINTF
++
++/**
++ * Prints a WARNING message.  On systems that don't differentiate between
++ * warnings and regular log messages, just print it.  Indicates that something
++ * may be wrong with the driver.  Works like printf().
++ *
++ * Use the DWC_WARN macro to call this function.
++ */
++extern void __DWC_WARN(char *format, ...)
++#ifdef __GNUC__
++	__attribute__ ((format(printf, 1, 2)));
++#else
++	;
++#endif
++
++/**
++ * Prints an error message.  On systems that don't differentiate between errors
++ * and regular log messages, just print it.  Indicates that something went wrong
++ * with the driver.  Works like printf().
++ *
++ * Use the DWC_ERROR macro to call this function.
++ */
++extern void __DWC_ERROR(char *format, ...)
++#ifdef __GNUC__
++	__attribute__ ((format(printf, 1, 2)));
++#else
++	;
++#endif
++
++/**
++ * Prints an exception error message and takes some user-defined action such as
++ * print out a backtrace or trigger a breakpoint.  Indicates that something went
++ * abnormally wrong with the driver such as programmer error, or other
++ * exceptional condition.  It should not be ignored so even on systems without
++ * printing capability, some action should be taken to notify the developer of
++ * it.  Works like printf().
++ */
++extern void DWC_EXCEPTION(char *format, ...)
++#ifdef __GNUC__
++	__attribute__ ((format(printf, 1, 2)));
++#else
++	;
++#endif
++#define dwc_exception DWC_EXCEPTION
++
++#ifndef DWC_OTG_DEBUG_LEV
++#define DWC_OTG_DEBUG_LEV 0
++#endif
++
++#ifdef DEBUG
++/**
++ * Prints out a debug message.  Used for logging/trace messages.
++ *
++ * Use the DWC_DEBUG macro to call this function
++ */
++extern void __DWC_DEBUG(char *format, ...)
++#ifdef __GNUC__
++	__attribute__ ((format(printf, 1, 2)));
++#else
++	;
++#endif
++#else
++#define __DWC_DEBUG printk
++#endif
++
++/**
++ * Prints out a Debug message.
++ */
++#define DWC_DEBUG(_format, _args...) __DWC_DEBUG("DEBUG:%s:%s: " _format "\n", \
++						 __func__, dwc_irq(), ## _args)
++#define dwc_debug DWC_DEBUG
++/**
++ * Prints out a Debug message if enabled at compile time.
++ */
++#if DWC_OTG_DEBUG_LEV > 0
++#define DWC_DEBUGC(_format, _args...) DWC_DEBUG(_format, ##_args )
++#else
++#define DWC_DEBUGC(_format, _args...)
++#endif
++#define dwc_debugc DWC_DEBUGC
++/**
++ * Prints out an informative message.
++ */
++#define DWC_INFO(_format, _args...) DWC_PRINTF("INFO:%s: " _format "\n", \
++					       dwc_irq(), ## _args)
++#define dwc_info DWC_INFO
++/**
++ * Prints out an informative message if enabled at compile time.
++ */
++#if DWC_OTG_DEBUG_LEV > 1
++#define DWC_INFOC(_format, _args...) DWC_INFO(_format, ##_args )
++#else
++#define DWC_INFOC(_format, _args...)
++#endif
++#define dwc_infoc DWC_INFOC
++/**
++ * Prints out a warning message.
++ */
++#define DWC_WARN(_format, _args...) __DWC_WARN("WARN:%s:%s:%d: " _format "\n", \
++					dwc_irq(), __func__, __LINE__, ## _args)
++#define dwc_warn DWC_WARN
++/**
++ * Prints out an error message.
++ */
++#define DWC_ERROR(_format, _args...) __DWC_ERROR("ERROR:%s:%s:%d: " _format "\n", \
++					dwc_irq(), __func__, __LINE__, ## _args)
++#define dwc_error DWC_ERROR
++
++#define DWC_PROTO_ERROR(_format, _args...) __DWC_WARN("ERROR:%s:%s:%d: " _format "\n", \
++						dwc_irq(), __func__, __LINE__, ## _args)
++#define dwc_proto_error DWC_PROTO_ERROR
++
++#ifdef DEBUG
++/** Prints out a exception error message if the _expr expression fails.  Disabled
++ * if DEBUG is not enabled. */
++#define DWC_ASSERT(_expr, _format, _args...) do { \
++	if (!(_expr)) { DWC_EXCEPTION("%s:%s:%d: " _format "\n", dwc_irq(), \
++				      __FILE__, __LINE__, ## _args); } \
++	} while (0)
++#else
++#define DWC_ASSERT(_x...)
++#endif
++#define dwc_assert DWC_ASSERT
++
++
++/** @name Byte Ordering
++ * The following functions are for conversions between processor's byte ordering
++ * and specific ordering you want.
++ */
++
++/** Converts 32 bit data in CPU byte ordering to little endian. */
++extern uint32_t DWC_CPU_TO_LE32(uint32_t *p);
++#define dwc_cpu_to_le32 DWC_CPU_TO_LE32
++
++/** Converts 32 bit data in CPU byte orderint to big endian. */
++extern uint32_t DWC_CPU_TO_BE32(uint32_t *p);
++#define dwc_cpu_to_be32 DWC_CPU_TO_BE32
++
++/** Converts 32 bit little endian data to CPU byte ordering. */
++extern uint32_t DWC_LE32_TO_CPU(uint32_t *p);
++#define dwc_le32_to_cpu DWC_LE32_TO_CPU
++
++/** Converts 32 bit big endian data to CPU byte ordering. */
++extern uint32_t DWC_BE32_TO_CPU(uint32_t *p);
++#define dwc_be32_to_cpu DWC_BE32_TO_CPU
++
++/** Converts 16 bit data in CPU byte ordering to little endian. */
++extern uint16_t DWC_CPU_TO_LE16(uint16_t *p);
++#define dwc_cpu_to_le16 DWC_CPU_TO_LE16
++
++/** Converts 16 bit data in CPU byte orderint to big endian. */
++extern uint16_t DWC_CPU_TO_BE16(uint16_t *p);
++#define dwc_cpu_to_be16 DWC_CPU_TO_BE16
++
++/** Converts 16 bit little endian data to CPU byte ordering. */
++extern uint16_t DWC_LE16_TO_CPU(uint16_t *p);
++#define dwc_le16_to_cpu DWC_LE16_TO_CPU
++
++/** Converts 16 bit bi endian data to CPU byte ordering. */
++extern uint16_t DWC_BE16_TO_CPU(uint16_t *p);
++#define dwc_be16_to_cpu DWC_BE16_TO_CPU
++
++
++/** @name Register Read/Write
++ *
++ * The following six functions should be implemented to read/write registers of
++ * 32-bit and 64-bit sizes.  All modules use this to read/write register values.
++ * The reg value is a pointer to the register calculated from the void *base
++ * variable passed into the driver when it is started.  */
++
++#ifdef DWC_LINUX
++/* Linux doesn't need any extra parameters for register read/write, so we
++ * just throw away the IO context parameter.
++ */
++/** Reads the content of a 32-bit register. */
++extern uint32_t DWC_READ_REG32(uint32_t volatile *reg);
++#define dwc_read_reg32(_ctx_,_reg_) DWC_READ_REG32(_reg_)
++
++/** Reads the content of a 64-bit register. */
++extern uint64_t DWC_READ_REG64(uint64_t volatile *reg);
++#define dwc_read_reg64(_ctx_,_reg_) DWC_READ_REG64(_reg_)
++
++/** Writes to a 32-bit register. */
++extern void DWC_WRITE_REG32(uint32_t volatile *reg, uint32_t value);
++#define dwc_write_reg32(_ctx_,_reg_,_val_) DWC_WRITE_REG32(_reg_, _val_)
++
++/** Writes to a 64-bit register. */
++extern void DWC_WRITE_REG64(uint64_t volatile *reg, uint64_t value);
++#define dwc_write_reg64(_ctx_,_reg_,_val_) DWC_WRITE_REG64(_reg_, _val_)
++
++/**
++ * Modify bit values in a register.  Using the
++ * algorithm: (reg_contents & ~clear_mask) | set_mask.
++ */
++extern void DWC_MODIFY_REG32(uint32_t volatile *reg, uint32_t clear_mask, uint32_t set_mask);
++#define dwc_modify_reg32(_ctx_,_reg_,_cmsk_,_smsk_) DWC_MODIFY_REG32(_reg_,_cmsk_,_smsk_)
++extern void DWC_MODIFY_REG64(uint64_t volatile *reg, uint64_t clear_mask, uint64_t set_mask);
++#define dwc_modify_reg64(_ctx_,_reg_,_cmsk_,_smsk_) DWC_MODIFY_REG64(_reg_,_cmsk_,_smsk_)
++
++#endif	/* DWC_LINUX */
++
++#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
++typedef struct dwc_ioctx {
++	struct device *dev;
++	bus_space_tag_t iot;
++	bus_space_handle_t ioh;
++} dwc_ioctx_t;
++
++/** BSD needs two extra parameters for register read/write, so we pass
++ * them in using the IO context parameter.
++ */
++/** Reads the content of a 32-bit register. */
++extern uint32_t DWC_READ_REG32(void *io_ctx, uint32_t volatile *reg);
++#define dwc_read_reg32 DWC_READ_REG32
++
++/** Reads the content of a 64-bit register. */
++extern uint64_t DWC_READ_REG64(void *io_ctx, uint64_t volatile *reg);
++#define dwc_read_reg64 DWC_READ_REG64
++
++/** Writes to a 32-bit register. */
++extern void DWC_WRITE_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t value);
++#define dwc_write_reg32 DWC_WRITE_REG32
++
++/** Writes to a 64-bit register. */
++extern void DWC_WRITE_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t value);
++#define dwc_write_reg64 DWC_WRITE_REG64
++
++/**
++ * Modify bit values in a register.  Using the
++ * algorithm: (reg_contents & ~clear_mask) | set_mask.
++ */
++extern void DWC_MODIFY_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t clear_mask, uint32_t set_mask);
++#define dwc_modify_reg32 DWC_MODIFY_REG32
++extern void DWC_MODIFY_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t clear_mask, uint64_t set_mask);
++#define dwc_modify_reg64 DWC_MODIFY_REG64
++
++#endif	/* DWC_FREEBSD || DWC_NETBSD */
++
++/** @cond */
++
++/** @name Some convenience MACROS used internally.  Define DWC_DEBUG_REGS to log the
++ * register writes. */
++
++#ifdef DWC_LINUX
++
++# ifdef DWC_DEBUG_REGS
++
++#define dwc_define_read_write_reg_n(_reg,_container_type) \
++static inline uint32_t dwc_read_##_reg##_n(_container_type *container, int num) { \
++	return DWC_READ_REG32(&container->regs->_reg[num]); \
++} \
++static inline void dwc_write_##_reg##_n(_container_type *container, int num, uint32_t data) { \
++	DWC_DEBUG("WRITING %8s[%d]: %p: %08x", #_reg, num, \
++		  &(((uint32_t*)container->regs->_reg)[num]), data); \
++	DWC_WRITE_REG32(&(((uint32_t*)container->regs->_reg)[num]), data); \
++}
++
++#define dwc_define_read_write_reg(_reg,_container_type) \
++static inline uint32_t dwc_read_##_reg(_container_type *container) { \
++	return DWC_READ_REG32(&container->regs->_reg); \
++} \
++static inline void dwc_write_##_reg(_container_type *container, uint32_t data) { \
++	DWC_DEBUG("WRITING %11s: %p: %08x", #_reg, &container->regs->_reg, data); \
++	DWC_WRITE_REG32(&container->regs->_reg, data); \
++}
++
++# else	/* DWC_DEBUG_REGS */
++
++#define dwc_define_read_write_reg_n(_reg,_container_type) \
++static inline uint32_t dwc_read_##_reg##_n(_container_type *container, int num) { \
++	return DWC_READ_REG32(&container->regs->_reg[num]); \
++} \
++static inline void dwc_write_##_reg##_n(_container_type *container, int num, uint32_t data) { \
++	DWC_WRITE_REG32(&(((uint32_t*)container->regs->_reg)[num]), data); \
++}
++
++#define dwc_define_read_write_reg(_reg,_container_type) \
++static inline uint32_t dwc_read_##_reg(_container_type *container) { \
++	return DWC_READ_REG32(&container->regs->_reg); \
++} \
++static inline void dwc_write_##_reg(_container_type *container, uint32_t data) { \
++	DWC_WRITE_REG32(&container->regs->_reg, data); \
++}
++
++# endif	/* DWC_DEBUG_REGS */
++
++#endif	/* DWC_LINUX */
++
++#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
++
++# ifdef DWC_DEBUG_REGS
++
++#define dwc_define_read_write_reg_n(_reg,_container_type) \
++static inline uint32_t dwc_read_##_reg##_n(void *io_ctx, _container_type *container, int num) { \
++	return DWC_READ_REG32(io_ctx, &container->regs->_reg[num]); \
++} \
++static inline void dwc_write_##_reg##_n(void *io_ctx, _container_type *container, int num, uint32_t data) { \
++	DWC_DEBUG("WRITING %8s[%d]: %p: %08x", #_reg, num, \
++		  &(((uint32_t*)container->regs->_reg)[num]), data); \
++	DWC_WRITE_REG32(io_ctx, &(((uint32_t*)container->regs->_reg)[num]), data); \
++}
++
++#define dwc_define_read_write_reg(_reg,_container_type) \
++static inline uint32_t dwc_read_##_reg(void *io_ctx, _container_type *container) { \
++	return DWC_READ_REG32(io_ctx, &container->regs->_reg); \
++} \
++static inline void dwc_write_##_reg(void *io_ctx, _container_type *container, uint32_t data) { \
++	DWC_DEBUG("WRITING %11s: %p: %08x", #_reg, &container->regs->_reg, data); \
++	DWC_WRITE_REG32(io_ctx, &container->regs->_reg, data); \
++}
++
++# else	/* DWC_DEBUG_REGS */
++
++#define dwc_define_read_write_reg_n(_reg,_container_type) \
++static inline uint32_t dwc_read_##_reg##_n(void *io_ctx, _container_type *container, int num) { \
++	return DWC_READ_REG32(io_ctx, &container->regs->_reg[num]); \
++} \
++static inline void dwc_write_##_reg##_n(void *io_ctx, _container_type *container, int num, uint32_t data) { \
++	DWC_WRITE_REG32(io_ctx, &(((uint32_t*)container->regs->_reg)[num]), data); \
++}
++
++#define dwc_define_read_write_reg(_reg,_container_type) \
++static inline uint32_t dwc_read_##_reg(void *io_ctx, _container_type *container) { \
++	return DWC_READ_REG32(io_ctx, &container->regs->_reg); \
++} \
++static inline void dwc_write_##_reg(void *io_ctx, _container_type *container, uint32_t data) { \
++	DWC_WRITE_REG32(io_ctx, &container->regs->_reg, data); \
++}
++
++# endif	/* DWC_DEBUG_REGS */
++
++#endif	/* DWC_FREEBSD || DWC_NETBSD */
++
++/** @endcond */
++
++
++#ifdef DWC_CRYPTOLIB
++/** @name Crypto Functions
++ *
++ * These are the low-level cryptographic functions used by the driver. */
++
++/** Perform AES CBC */
++extern int DWC_AES_CBC(uint8_t *message, uint32_t messagelen, uint8_t *key, uint32_t keylen, uint8_t iv[16], uint8_t *out);
++#define dwc_aes_cbc DWC_AES_CBC
++
++/** Fill the provided buffer with random bytes.  These should be cryptographic grade random numbers. */
++extern void DWC_RANDOM_BYTES(uint8_t *buffer, uint32_t length);
++#define dwc_random_bytes DWC_RANDOM_BYTES
++
++/** Perform the SHA-256 hash function */
++extern int DWC_SHA256(uint8_t *message, uint32_t len, uint8_t *out);
++#define dwc_sha256 DWC_SHA256
++
++/** Calculated the HMAC-SHA256 */
++extern int DWC_HMAC_SHA256(uint8_t *message, uint32_t messagelen, uint8_t *key, uint32_t keylen, uint8_t *out);
++#define dwc_hmac_sha256 DWC_HMAC_SHA256
++
++#endif	/* DWC_CRYPTOLIB */
++
++
++/** @name Memory Allocation
++ *
++ * These function provide access to memory allocation.  There are only 2 DMA
++ * functions and 3 Regular memory functions that need to be implemented.  None
++ * of the memory debugging routines need to be implemented.  The allocation
++ * routines all ZERO the contents of the memory.
++ *
++ * Defining DWC_DEBUG_MEMORY turns on memory debugging and statistic gathering.
++ * This checks for memory leaks, keeping track of alloc/free pairs.  It also
++ * keeps track of how much memory the driver is using at any given time. */
++
++#define DWC_PAGE_SIZE 4096
++#define DWC_PAGE_OFFSET(addr) (((uint32_t)addr) & 0xfff)
++#define DWC_PAGE_ALIGNED(addr) ((((uint32_t)addr) & 0xfff) == 0)
++
++#define DWC_INVALID_DMA_ADDR 0x0
++
++#ifdef DWC_LINUX
++/** Type for a DMA address */
++typedef dma_addr_t dwc_dma_t;
++#endif
++
++#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
++typedef bus_addr_t dwc_dma_t;
++#endif
++
++#ifdef DWC_FREEBSD
++typedef struct dwc_dmactx {
++	struct device *dev;
++	bus_dma_tag_t dma_tag;
++	bus_dmamap_t dma_map;
++	bus_addr_t dma_paddr;
++	void *dma_vaddr;
++} dwc_dmactx_t;
++#endif
++
++#ifdef DWC_NETBSD
++typedef struct dwc_dmactx {
++	struct device *dev;
++	bus_dma_tag_t dma_tag;
++	bus_dmamap_t dma_map;
++	bus_dma_segment_t segs[1];
++	int nsegs;
++	bus_addr_t dma_paddr;
++	void *dma_vaddr;
++} dwc_dmactx_t;
++#endif
++
++/* @todo these functions will be added in the future */
++#if 0
++/**
++ * Creates a DMA pool from which you can allocate DMA buffers.  Buffers
++ * allocated from this pool will be guaranteed to meet the size, alignment, and
++ * boundary requirements specified.
++ *
++ * @param[in] size Specifies the size of the buffers that will be allocated from
++ * this pool.
++ * @param[in] align Specifies the byte alignment requirements of the buffers
++ * allocated from this pool.  Must be a power of 2.
++ * @param[in] boundary Specifies the N-byte boundary that buffers allocated from
++ * this pool must not cross.
++ *
++ * @returns A pointer to an internal opaque structure which is not to be
++ * accessed outside of these library functions.  Use this handle to specify
++ * which pools to allocate/free DMA buffers from and also to destroy the pool,
++ * when you are done with it.
++ */
++extern dwc_pool_t *DWC_DMA_POOL_CREATE(uint32_t size, uint32_t align, uint32_t boundary);
++
++/**
++ * Destroy a DMA pool.  All buffers allocated from that pool must be freed first.
++ */
++extern void DWC_DMA_POOL_DESTROY(dwc_pool_t *pool);
++
++/**
++ * Allocate a buffer from the specified DMA pool and zeros its contents.
++ */
++extern void *DWC_DMA_POOL_ALLOC(dwc_pool_t *pool, uint64_t *dma_addr);
++
++/**
++ * Free a previously allocated buffer from the DMA pool.
++ */
++extern void DWC_DMA_POOL_FREE(dwc_pool_t *pool, void *vaddr, void *daddr);
++#endif
++
++/** Allocates a DMA capable buffer and zeroes its contents. */
++extern void *__DWC_DMA_ALLOC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr);
++
++/** Allocates a DMA capable buffer and zeroes its contents in atomic contest */
++extern void *__DWC_DMA_ALLOC_ATOMIC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr);
++
++/** Frees a previously allocated buffer. */
++extern void __DWC_DMA_FREE(void *dma_ctx, uint32_t size, void *virt_addr, dwc_dma_t dma_addr);
++
++/** Allocates a block of memory and zeroes its contents. */
++extern void *__DWC_ALLOC(void *mem_ctx, uint32_t size);
++
++/** Allocates a block of memory and zeroes its contents, in an atomic manner
++ * which can be used inside interrupt context.  The size should be sufficiently
++ * small, a few KB at most, such that failures are not likely to occur.  Can just call
++ * __DWC_ALLOC if it is atomic. */
++extern void *__DWC_ALLOC_ATOMIC(void *mem_ctx, uint32_t size);
++
++/** Frees a previously allocated buffer. */
++extern void __DWC_FREE(void *mem_ctx, void *addr);
++
++#ifndef DWC_DEBUG_MEMORY
++
++#define DWC_ALLOC(_size_) __DWC_ALLOC(NULL, _size_)
++#define DWC_ALLOC_ATOMIC(_size_) __DWC_ALLOC_ATOMIC(NULL, _size_)
++#define DWC_FREE(_addr_) __DWC_FREE(NULL, _addr_)
++
++# ifdef DWC_LINUX
++#define DWC_DMA_ALLOC(_dev, _size_, _dma_) __DWC_DMA_ALLOC(_dev, _size_, _dma_)
++#define DWC_DMA_ALLOC_ATOMIC(_dev, _size_, _dma_) __DWC_DMA_ALLOC_ATOMIC(_dev, _size_, _dma_)
++#define DWC_DMA_FREE(_dev, _size_,_virt_, _dma_) __DWC_DMA_FREE(_dev, _size_, _virt_, _dma_)
++# endif
++
++# if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
++#define DWC_DMA_ALLOC __DWC_DMA_ALLOC
++#define DWC_DMA_FREE __DWC_DMA_FREE
++# endif
++extern void *dwc_dma_alloc_atomic_debug(uint32_t size, dwc_dma_t *dma_addr, char const *func, int line);
++
++#else	/* DWC_DEBUG_MEMORY */
++
++extern void *dwc_alloc_debug(void *mem_ctx, uint32_t size, char const *func, int line);
++extern void *dwc_alloc_atomic_debug(void *mem_ctx, uint32_t size, char const *func, int line);
++extern void dwc_free_debug(void *mem_ctx, void *addr, char const *func, int line);
++extern void *dwc_dma_alloc_debug(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr,
++				 char const *func, int line);
++extern void *dwc_dma_alloc_atomic_debug(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr,
++				char const *func, int line);
++extern void dwc_dma_free_debug(void *dma_ctx, uint32_t size, void *virt_addr,
++			       dwc_dma_t dma_addr, char const *func, int line);
++
++extern int dwc_memory_debug_start(void *mem_ctx);
++extern void dwc_memory_debug_stop(void);
++extern void dwc_memory_debug_report(void);
++
++#define DWC_ALLOC(_size_) dwc_alloc_debug(NULL, _size_, __func__, __LINE__)
++#define DWC_ALLOC_ATOMIC(_size_) dwc_alloc_atomic_debug(NULL, _size_, \
++							__func__, __LINE__)
++#define DWC_FREE(_addr_) dwc_free_debug(NULL, _addr_, __func__, __LINE__)
++
++# ifdef DWC_LINUX
++#define DWC_DMA_ALLOC(_dev, _size_, _dma_) \
++	dwc_dma_alloc_debug(_dev, _size_, _dma_, __func__, __LINE__)
++#define DWC_DMA_ALLOC_ATOMIC(_dev, _size_, _dma_) \
++	dwc_dma_alloc_atomic_debug(_dev, _size_, _dma_, __func__, __LINE__)
++#define DWC_DMA_FREE(_dev, _size_, _virt_, _dma_) \
++	dwc_dma_free_debug(_dev, _size_, _virt_, _dma_, __func__, __LINE__)
++# endif
++
++# if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
++#define DWC_DMA_ALLOC(_ctx_,_size_,_dma_) dwc_dma_alloc_debug(_ctx_, _size_, \
++						_dma_, __func__, __LINE__)
++#define DWC_DMA_FREE(_ctx_,_size_,_virt_,_dma_) dwc_dma_free_debug(_ctx_, _size_, \
++						 _virt_, _dma_, __func__, __LINE__)
++# endif
++
++#endif /* DWC_DEBUG_MEMORY */
++
++#define dwc_alloc(_ctx_,_size_) DWC_ALLOC(_size_)
++#define dwc_alloc_atomic(_ctx_,_size_) DWC_ALLOC_ATOMIC(_size_)
++#define dwc_free(_ctx_,_addr_) DWC_FREE(_addr_)
++
++#ifdef DWC_LINUX
++/* Linux doesn't need any extra parameters for DMA buffer allocation, so we
++ * just throw away the DMA context parameter.
++ */
++#define dwc_dma_alloc(_ctx_,_size_,_dma_) DWC_DMA_ALLOC(_size_, _dma_)
++#define dwc_dma_alloc_atomic(_ctx_,_size_,_dma_) DWC_DMA_ALLOC_ATOMIC(_size_, _dma_)
++#define dwc_dma_free(_ctx_,_size_,_virt_,_dma_) DWC_DMA_FREE(_size_, _virt_, _dma_)
++#endif
++
++#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
++/** BSD needs several extra parameters for DMA buffer allocation, so we pass
++ * them in using the DMA context parameter.
++ */
++#define dwc_dma_alloc DWC_DMA_ALLOC
++#define dwc_dma_free DWC_DMA_FREE
++#endif
++
++
++/** @name Memory and String Processing */
++
++/** memset() clone */
++extern void *DWC_MEMSET(void *dest, uint8_t byte, uint32_t size);
++#define dwc_memset DWC_MEMSET
++
++/** memcpy() clone */
++extern void *DWC_MEMCPY(void *dest, void const *src, uint32_t size);
++#define dwc_memcpy DWC_MEMCPY
++
++/** memmove() clone */
++extern void *DWC_MEMMOVE(void *dest, void *src, uint32_t size);
++#define dwc_memmove DWC_MEMMOVE
++
++/** memcmp() clone */
++extern int DWC_MEMCMP(void *m1, void *m2, uint32_t size);
++#define dwc_memcmp DWC_MEMCMP
++
++/** strcmp() clone */
++extern int DWC_STRCMP(void *s1, void *s2);
++#define dwc_strcmp DWC_STRCMP
++
++/** strncmp() clone */
++extern int DWC_STRNCMP(void *s1, void *s2, uint32_t size);
++#define dwc_strncmp DWC_STRNCMP
++
++/** strlen() clone, for NULL terminated ASCII strings */
++extern int DWC_STRLEN(char const *str);
++#define dwc_strlen DWC_STRLEN
++
++/** strcpy() clone, for NULL terminated ASCII strings */
++extern char *DWC_STRCPY(char *to, const char *from);
++#define dwc_strcpy DWC_STRCPY
++
++/** strdup() clone.  If you wish to use memory allocation debugging, this
++ * implementation of strdup should use the DWC_* memory routines instead of
++ * calling a predefined strdup.  Otherwise the memory allocated by this routine
++ * will not be seen by the debugging routines. */
++extern char *DWC_STRDUP(char const *str);
++#define dwc_strdup(_ctx_,_str_) DWC_STRDUP(_str_)
++
++/** NOT an atoi() clone.  Read the description carefully.  Returns an integer
++ * converted from the string str in base 10 unless the string begins with a "0x"
++ * in which case it is base 16.  String must be a NULL terminated sequence of
++ * ASCII characters and may optionally begin with whitespace, a + or -, and a
++ * "0x" prefix if base 16.  The remaining characters must be valid digits for
++ * the number and end with a NULL character.  If any invalid characters are
++ * encountered or it returns with a negative error code and the results of the
++ * conversion are undefined.  On sucess it returns 0.  Overflow conditions are
++ * undefined.  An example implementation using atoi() can be referenced from the
++ * Linux implementation. */
++extern int DWC_ATOI(const char *str, int32_t *value);
++#define dwc_atoi DWC_ATOI
++
++/** Same as above but for unsigned. */
++extern int DWC_ATOUI(const char *str, uint32_t *value);
++#define dwc_atoui DWC_ATOUI
++
++#ifdef DWC_UTFLIB
++/** This routine returns a UTF16LE unicode encoded string from a UTF8 string. */
++extern int DWC_UTF8_TO_UTF16LE(uint8_t const *utf8string, uint16_t *utf16string, unsigned len);
++#define dwc_utf8_to_utf16le DWC_UTF8_TO_UTF16LE
++#endif
++
++
++/** @name Wait queues
++ *
++ * Wait queues provide a means of synchronizing between threads or processes.  A
++ * process can block on a waitq if some condition is not true, waiting for it to
++ * become true.  When the waitq is triggered all waiting process will get
++ * unblocked and the condition will be check again.  Waitqs should be triggered
++ * every time a condition can potentially change.*/
++struct dwc_waitq;
++
++/** Type for a waitq */
++typedef struct dwc_waitq dwc_waitq_t;
++
++/** The type of waitq condition callback function.  This is called every time
++ * condition is evaluated. */
++typedef int (*dwc_waitq_condition_t)(void *data);
++
++/** Allocate a waitq */
++extern dwc_waitq_t *DWC_WAITQ_ALLOC(void);
++#define dwc_waitq_alloc(_ctx_) DWC_WAITQ_ALLOC()
++
++/** Free a waitq */
++extern void DWC_WAITQ_FREE(dwc_waitq_t *wq);
++#define dwc_waitq_free DWC_WAITQ_FREE
++
++/** Check the condition and if it is false, block on the waitq.  When unblocked, check the
++ * condition again.  The function returns when the condition becomes true.  The return value
++ * is 0 on condition true, DWC_WAITQ_ABORTED on abort or killed, or DWC_WAITQ_UNKNOWN on error. */
++extern int32_t DWC_WAITQ_WAIT(dwc_waitq_t *wq, dwc_waitq_condition_t cond, void *data);
++#define dwc_waitq_wait DWC_WAITQ_WAIT
++
++/** Check the condition and if it is false, block on the waitq.  When unblocked,
++ * check the condition again.  The function returns when the condition become
++ * true or the timeout has passed.  The return value is 0 on condition true or
++ * DWC_TIMED_OUT on timeout, or DWC_WAITQ_ABORTED, or DWC_WAITQ_UNKNOWN on
++ * error. */
++extern int32_t DWC_WAITQ_WAIT_TIMEOUT(dwc_waitq_t *wq, dwc_waitq_condition_t cond,
++				      void *data, int32_t msecs);
++#define dwc_waitq_wait_timeout DWC_WAITQ_WAIT_TIMEOUT
++
++/** Trigger a waitq, unblocking all processes.  This should be called whenever a condition
++ * has potentially changed. */
++extern void DWC_WAITQ_TRIGGER(dwc_waitq_t *wq);
++#define dwc_waitq_trigger DWC_WAITQ_TRIGGER
++
++/** Unblock all processes waiting on the waitq with an ABORTED result. */
++extern void DWC_WAITQ_ABORT(dwc_waitq_t *wq);
++#define dwc_waitq_abort DWC_WAITQ_ABORT
++
++
++/** @name Threads
++ *
++ * A thread must be explicitly stopped.  It must check DWC_THREAD_SHOULD_STOP
++ * whenever it is woken up, and then return.  The DWC_THREAD_STOP function
++ * returns the value from the thread.
++ */
++
++struct dwc_thread;
++
++/** Type for a thread */
++typedef struct dwc_thread dwc_thread_t;
++
++/** The thread function */
++typedef int (*dwc_thread_function_t)(void *data);
++
++/** Create a thread and start it running the thread_function.  Returns a handle
++ * to the thread */
++extern dwc_thread_t *DWC_THREAD_RUN(dwc_thread_function_t func, char *name, void *data);
++#define dwc_thread_run(_ctx_,_func_,_name_,_data_) DWC_THREAD_RUN(_func_, _name_, _data_)
++
++/** Stops a thread.  Return the value returned by the thread.  Or will return
++ * DWC_ABORT if the thread never started. */
++extern int DWC_THREAD_STOP(dwc_thread_t *thread);
++#define dwc_thread_stop DWC_THREAD_STOP
++
++/** Signifies to the thread that it must stop. */
++#ifdef DWC_LINUX
++/* Linux doesn't need any parameters for kthread_should_stop() */
++extern dwc_bool_t DWC_THREAD_SHOULD_STOP(void);
++#define dwc_thread_should_stop(_thrd_) DWC_THREAD_SHOULD_STOP()
++
++/* No thread_exit function in Linux */
++#define dwc_thread_exit(_thrd_)
++#endif
++
++#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
++/** BSD needs the thread pointer for kthread_suspend_check() */
++extern dwc_bool_t DWC_THREAD_SHOULD_STOP(dwc_thread_t *thread);
++#define dwc_thread_should_stop DWC_THREAD_SHOULD_STOP
++
++/** The thread must call this to exit. */
++extern void DWC_THREAD_EXIT(dwc_thread_t *thread);
++#define dwc_thread_exit DWC_THREAD_EXIT
++#endif
++
++
++/** @name Work queues
++ *
++ * Workqs are used to queue a callback function to be called at some later time,
++ * in another thread. */
++struct dwc_workq;
++
++/** Type for a workq */
++typedef struct dwc_workq dwc_workq_t;
++
++/** The type of the callback function to be called. */
++typedef void (*dwc_work_callback_t)(void *data);
++
++/** Allocate a workq */
++extern dwc_workq_t *DWC_WORKQ_ALLOC(char *name);
++#define dwc_workq_alloc(_ctx_,_name_) DWC_WORKQ_ALLOC(_name_)
++
++/** Free a workq.  All work must be completed before being freed. */
++extern void DWC_WORKQ_FREE(dwc_workq_t *workq);
++#define dwc_workq_free DWC_WORKQ_FREE
++
++/** Schedule a callback on the workq, passing in data.  The function will be
++ * scheduled at some later time. */
++extern void DWC_WORKQ_SCHEDULE(dwc_workq_t *workq, dwc_work_callback_t cb,
++			       void *data, char *format, ...)
++#ifdef __GNUC__
++	__attribute__ ((format(printf, 4, 5)));
++#else
++	;
++#endif
++#define dwc_workq_schedule DWC_WORKQ_SCHEDULE
++
++/** Schedule a callback on the workq, that will be called until at least
++ * given number miliseconds have passed. */
++extern void DWC_WORKQ_SCHEDULE_DELAYED(dwc_workq_t *workq, dwc_work_callback_t cb,
++				       void *data, uint32_t time, char *format, ...)
++#ifdef __GNUC__
++	__attribute__ ((format(printf, 5, 6)));
++#else
++	;
++#endif
++#define dwc_workq_schedule_delayed DWC_WORKQ_SCHEDULE_DELAYED
++
++/** The number of processes in the workq */
++extern int DWC_WORKQ_PENDING(dwc_workq_t *workq);
++#define dwc_workq_pending DWC_WORKQ_PENDING
++
++/** Blocks until all the work in the workq is complete or timed out.  Returns <
++ * 0 on timeout. */
++extern int DWC_WORKQ_WAIT_WORK_DONE(dwc_workq_t *workq, int timeout);
++#define dwc_workq_wait_work_done DWC_WORKQ_WAIT_WORK_DONE
++
++
++/** @name Tasklets
++ *
++ */
++struct dwc_tasklet;
++
++/** Type for a tasklet */
++typedef struct dwc_tasklet dwc_tasklet_t;
++
++/** The type of the callback function to be called */
++typedef void (*dwc_tasklet_callback_t)(void *data);
++
++/** Allocates a tasklet */
++extern dwc_tasklet_t *DWC_TASK_ALLOC(char *name, dwc_tasklet_callback_t cb, void *data);
++#define dwc_task_alloc(_ctx_,_name_,_cb_,_data_) DWC_TASK_ALLOC(_name_, _cb_, _data_)
++
++/** Frees a tasklet */
++extern void DWC_TASK_FREE(dwc_tasklet_t *task);
++#define dwc_task_free DWC_TASK_FREE
++
++/** Schedules a tasklet to run */
++extern void DWC_TASK_SCHEDULE(dwc_tasklet_t *task);
++#define dwc_task_schedule DWC_TASK_SCHEDULE
++
++extern void DWC_TASK_HI_SCHEDULE(dwc_tasklet_t *task);
++#define dwc_task_hi_schedule DWC_TASK_HI_SCHEDULE
++
++/** @name Timer
++ *
++ * Callbacks must be small and atomic.
++ */
++struct dwc_timer;
++
++/** Type for a timer */
++typedef struct dwc_timer dwc_timer_t;
++
++/** The type of the callback function to be called */
++typedef void (*dwc_timer_callback_t)(void *data);
++
++/** Allocates a timer */
++extern dwc_timer_t *DWC_TIMER_ALLOC(char *name, dwc_timer_callback_t cb, void *data);
++#define dwc_timer_alloc(_ctx_,_name_,_cb_,_data_) DWC_TIMER_ALLOC(_name_,_cb_,_data_)
++
++/** Frees a timer */
++extern void DWC_TIMER_FREE(dwc_timer_t *timer);
++#define dwc_timer_free DWC_TIMER_FREE
++
++/** Schedules the timer to run at time ms from now.  And will repeat at every
++ * repeat_interval msec therafter
++ *
++ * Modifies a timer that is still awaiting execution to a new expiration time.
++ * The mod_time is added to the old time.  */
++extern void DWC_TIMER_SCHEDULE(dwc_timer_t *timer, uint32_t time);
++#define dwc_timer_schedule DWC_TIMER_SCHEDULE
++
++/** Disables the timer from execution. */
++extern void DWC_TIMER_CANCEL(dwc_timer_t *timer);
++#define dwc_timer_cancel DWC_TIMER_CANCEL
++
++
++/** @name Spinlocks
++ *
++ * These locks are used when the work between the lock/unlock is atomic and
++ * short.  Interrupts are also disabled during the lock/unlock and thus they are
++ * suitable to lock between interrupt/non-interrupt context.  They also lock
++ * between processes if you have multiple CPUs or Preemption.  If you don't have
++ * multiple CPUS or Preemption, then the you can simply implement the
++ * DWC_SPINLOCK and DWC_SPINUNLOCK to disable and enable interrupts.  Because
++ * the work between the lock/unlock is atomic, the process context will never
++ * change, and so you never have to lock between processes.  */
++
++struct dwc_spinlock;
++
++/** Type for a spinlock */
++typedef struct dwc_spinlock dwc_spinlock_t;
++
++/** Type for the 'flags' argument to spinlock funtions */
++typedef unsigned long dwc_irqflags_t;
++
++/** Returns an initialized lock variable.  This function should allocate and
++ * initialize the OS-specific data structure used for locking.  This data
++ * structure is to be used for the DWC_LOCK and DWC_UNLOCK functions and should
++ * be freed by the DWC_FREE_LOCK when it is no longer used.
++ *
++ * For Linux Spinlock Debugging make it macro because the debugging routines use
++ * the symbol name to determine recursive locking. Using a wrapper function
++ * makes it falsely think recursive locking occurs. */
++#if defined(DWC_LINUX) && defined(CONFIG_DEBUG_SPINLOCK)
++#define DWC_SPINLOCK_ALLOC_LINUX_DEBUG(lock) ({ \
++	lock = DWC_ALLOC(sizeof(spinlock_t)); \
++	if (lock) { \
++		spin_lock_init((spinlock_t *)lock); \
++	} \
++})
++#else
++extern dwc_spinlock_t *DWC_SPINLOCK_ALLOC(void);
++#define dwc_spinlock_alloc(_ctx_) DWC_SPINLOCK_ALLOC()
++#endif
++
++/** Frees an initialized lock variable. */
++extern void DWC_SPINLOCK_FREE(dwc_spinlock_t *lock);
++#define dwc_spinlock_free(_ctx_,_lock_) DWC_SPINLOCK_FREE(_lock_)
++
++/** Disables interrupts and blocks until it acquires the lock.
++ *
++ * @param lock Pointer to the spinlock.
++ * @param flags Unsigned long for irq flags storage.
++ */
++extern void DWC_SPINLOCK_IRQSAVE(dwc_spinlock_t *lock, dwc_irqflags_t *flags);
++#define dwc_spinlock_irqsave DWC_SPINLOCK_IRQSAVE
++
++/** Re-enables the interrupt and releases the lock.
++ *
++ * @param lock Pointer to the spinlock.
++ * @param flags Unsigned long for irq flags storage.  Must be the same as was
++ * passed into DWC_LOCK.
++ */
++extern void DWC_SPINUNLOCK_IRQRESTORE(dwc_spinlock_t *lock, dwc_irqflags_t flags);
++#define dwc_spinunlock_irqrestore DWC_SPINUNLOCK_IRQRESTORE
++
++/** Blocks until it acquires the lock.
++ *
++ * @param lock Pointer to the spinlock.
++ */
++extern void DWC_SPINLOCK(dwc_spinlock_t *lock);
++#define dwc_spinlock DWC_SPINLOCK
++
++/** Releases the lock.
++ *
++ * @param lock Pointer to the spinlock.
++ */
++extern void DWC_SPINUNLOCK(dwc_spinlock_t *lock);
++#define dwc_spinunlock DWC_SPINUNLOCK
++
++
++/** @name Mutexes
++ *
++ * Unlike spinlocks Mutexes lock only between processes and the work between the
++ * lock/unlock CAN block, therefore it CANNOT be called from interrupt context.
++ */
++
++struct dwc_mutex;
++
++/** Type for a mutex */
++typedef struct dwc_mutex dwc_mutex_t;
++
++/* For Linux Mutex Debugging make it inline because the debugging routines use
++ * the symbol to determine recursive locking.  This makes it falsely think
++ * recursive locking occurs. */
++#if defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES)
++#define DWC_MUTEX_ALLOC_LINUX_DEBUG(__mutexp) ({ \
++	__mutexp = (dwc_mutex_t *)DWC_ALLOC(sizeof(struct mutex)); \
++	mutex_init((struct mutex *)__mutexp); \
++})
++#endif
++
++/** Allocate a mutex */
++extern dwc_mutex_t *DWC_MUTEX_ALLOC(void);
++#define dwc_mutex_alloc(_ctx_) DWC_MUTEX_ALLOC()
++
++/* For memory leak debugging when using Linux Mutex Debugging */
++#if defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES)
++#define DWC_MUTEX_FREE(__mutexp) do { \
++	mutex_destroy((struct mutex *)__mutexp); \
++	DWC_FREE(__mutexp); \
++} while(0)
++#else
++/** Free a mutex */
++extern void DWC_MUTEX_FREE(dwc_mutex_t *mutex);
++#define dwc_mutex_free(_ctx_,_mutex_) DWC_MUTEX_FREE(_mutex_)
++#endif
++
++/** Lock a mutex */
++extern void DWC_MUTEX_LOCK(dwc_mutex_t *mutex);
++#define dwc_mutex_lock DWC_MUTEX_LOCK
++
++/** Non-blocking lock returns 1 on successful lock. */
++extern int DWC_MUTEX_TRYLOCK(dwc_mutex_t *mutex);
++#define dwc_mutex_trylock DWC_MUTEX_TRYLOCK
++
++/** Unlock a mutex */
++extern void DWC_MUTEX_UNLOCK(dwc_mutex_t *mutex);
++#define dwc_mutex_unlock DWC_MUTEX_UNLOCK
++
++
++/** @name Time */
++
++/** Microsecond delay.
++ *
++ * @param usecs  Microseconds to delay.
++ */
++extern void DWC_UDELAY(uint32_t usecs);
++#define dwc_udelay DWC_UDELAY
++
++/** Millisecond delay.
++ *
++ * @param msecs  Milliseconds to delay.
++ */
++extern void DWC_MDELAY(uint32_t msecs);
++#define dwc_mdelay DWC_MDELAY
++
++/** Non-busy waiting.
++ * Sleeps for specified number of milliseconds.
++ *
++ * @param msecs Milliseconds to sleep.
++ */
++extern void DWC_MSLEEP(uint32_t msecs);
++#define dwc_msleep DWC_MSLEEP
++
++/**
++ * Returns number of milliseconds since boot.
++ */
++extern uint32_t DWC_TIME(void);
++#define dwc_time DWC_TIME
++
++
++
++
++/* @mainpage DWC Portability and Common Library
++ *
++ * This is the documentation for the DWC Portability and Common Library.
++ *
++ * @section intro Introduction
++ *
++ * The DWC Portability library consists of wrapper calls and data structures to
++ * all low-level functions which are typically provided by the OS.  The WUDEV
++ * driver uses only these functions.  In order to port the WUDEV driver, only
++ * the functions in this library need to be re-implemented, with the same
++ * behavior as documented here.
++ *
++ * The Common library consists of higher level functions, which rely only on
++ * calling the functions from the DWC Portability library.  These common
++ * routines are shared across modules.  Some of the common libraries need to be
++ * used directly by the driver programmer when porting WUDEV.  Such as the
++ * parameter and notification libraries.
++ *
++ * @section low Portability Library OS Wrapper Functions
++ *
++ * Any function starting with DWC and in all CAPS is a low-level OS-wrapper that
++ * needs to be implemented when porting, for example DWC_MUTEX_ALLOC().  All of
++ * these functions are included in the dwc_os.h file.
++ *
++ * There are many functions here covering a wide array of OS services.  Please
++ * see dwc_os.h for details, and implementation notes for each function.
++ *
++ * @section common Common Library Functions
++ *
++ * Any function starting with dwc and in all lowercase is a common library
++ * routine.  These functions have a portable implementation and do not need to
++ * be reimplemented when porting.  The common routines can be used by any
++ * driver, and some must be used by the end user to control the drivers.  For
++ * example, you must use the Parameter common library in order to set the
++ * parameters in the WUDEV module.
++ *
++ * The common libraries consist of the following:
++ *
++ * - Connection Contexts - Used internally and can be used by end-user.  See dwc_cc.h
++ * - Parameters - Used internally and can be used by end-user.  See dwc_params.h
++ * - Notifications - Used internally and can be used by end-user.  See dwc_notifier.h
++ * - Lists - Used internally and can be used by end-user.  See dwc_list.h
++ * - Memory Debugging - Used internally and can be used by end-user.  See dwc_os.h
++ * - Modpow - Used internally only.  See dwc_modpow.h
++ * - DH - Used internally only.  See dwc_dh.h
++ * - Crypto - Used internally only.  See dwc_crypto.h
++ *
++ *
++ * @section prereq Prerequistes For dwc_os.h
++ * @subsection types Data Types
++ *
++ * The dwc_os.h file assumes that several low-level data types are pre defined for the
++ * compilation environment.  These data types are:
++ *
++ * - uint8_t - unsigned 8-bit data type
++ * - int8_t - signed 8-bit data type
++ * - uint16_t - unsigned 16-bit data type
++ * - int16_t - signed 16-bit data type
++ * - uint32_t - unsigned 32-bit data type
++ * - int32_t - signed 32-bit data type
++ * - uint64_t - unsigned 64-bit data type
++ * - int64_t - signed 64-bit data type
++ *
++ * Ensure that these are defined before using dwc_os.h.  The easiest way to do
++ * that is to modify the top of the file to include the appropriate header.
++ * This is already done for the Linux environment.  If the DWC_LINUX macro is
++ * defined, the correct header will be added.  A standard header <stdint.h> is
++ * also used for environments where standard C headers are available.
++ *
++ * @subsection stdarg Variable Arguments
++ *
++ * Variable arguments are provided by a standard C header <stdarg.h>.  it is
++ * available in Both the Linux and ANSI C enviornment.  An equivalent must be
++ * provided in your enviornment in order to use dwc_os.h with the debug and
++ * tracing message functionality.
++ *
++ * @subsection thread Threading
++ *
++ * WUDEV Core must be run on an operating system that provides for multiple
++ * threads/processes.  Threading can be implemented in many ways, even in
++ * embedded systems without an operating system.  At the bare minimum, the
++ * system should be able to start any number of processes at any time to handle
++ * special work.  It need not be a pre-emptive system.  Process context can
++ * change upon a call to a blocking function.  The hardware interrupt context
++ * that calls the module's ISR() function must be differentiable from process
++ * context, even if your processes are impemented via a hardware interrupt.
++ * Further locking mechanism between process must exist (or be implemented), and
++ * process context must have a way to disable interrupts for a period of time to
++ * lock them out.  If all of this exists, the functions in dwc_os.h related to
++ * threading should be able to be implemented with the defined behavior.
++ *
++ */
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _DWC_OS_H_ */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/usb.h
+@@ -0,0 +1,275 @@
++/*
++ * Copyright (c) 1998 The NetBSD Foundation, Inc.
++ * All rights reserved.
++ *
++ * This code is derived from software contributed to The NetBSD Foundation
++ * by Lennart Augustsson (lennart@augustsson.net) at
++ * Carlstedt Research & Technology.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
++ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
++ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
++ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
++ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
++ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
++ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
++ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
++ * POSSIBILITY OF SUCH DAMAGE.
++ */
++
++/* Modified by Synopsys, Inc, 12/12/2007 */
++
++
++#ifndef _USB_H_
++#define _USB_H_
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++/*
++ * The USB records contain some unaligned little-endian word
++ * components.  The U[SG]ETW macros take care of both the alignment
++ * and endian problem and should always be used to access non-byte
++ * values.
++ */
++typedef u_int8_t uByte;
++typedef u_int8_t uWord[2];
++typedef u_int8_t uDWord[4];
++
++#define UGETW(w) ((w)[0] | ((w)[1] << 8))
++#define USETW(w,v) ((w)[0] = (u_int8_t)(v), (w)[1] = (u_int8_t)((v) >> 8))
++#define UGETDW(w) ((w)[0] | ((w)[1] << 8) | ((w)[2] << 16) | ((w)[3] << 24))
++#define USETDW(w,v) ((w)[0] = (u_int8_t)(v), \
++		     (w)[1] = (u_int8_t)((v) >> 8), \
++		     (w)[2] = (u_int8_t)((v) >> 16), \
++		     (w)[3] = (u_int8_t)((v) >> 24))
++
++#define UPACKED __attribute__((__packed__))
++
++typedef struct {
++	uByte		bmRequestType;
++	uByte		bRequest;
++	uWord		wValue;
++	uWord		wIndex;
++	uWord		wLength;
++} UPACKED usb_device_request_t;
++
++#define UT_GET_DIR(a) ((a) & 0x80)
++#define UT_WRITE		0x00
++#define UT_READ			0x80
++
++#define UT_GET_TYPE(a) ((a) & 0x60)
++#define UT_STANDARD		0x00
++#define UT_CLASS		0x20
++#define UT_VENDOR		0x40
++
++#define UT_GET_RECIPIENT(a) ((a) & 0x1f)
++#define UT_DEVICE		0x00
++#define UT_INTERFACE		0x01
++#define UT_ENDPOINT		0x02
++#define UT_OTHER		0x03
++
++/* Requests */
++#define UR_GET_STATUS		0x00
++#define  USTAT_STANDARD_STATUS  0x00
++#define  WUSTAT_WUSB_FEATURE    0x01
++#define  WUSTAT_CHANNEL_INFO    0x02
++#define  WUSTAT_RECEIVED_DATA   0x03
++#define  WUSTAT_MAS_AVAILABILITY 0x04
++#define  WUSTAT_CURRENT_TRANSMIT_POWER 0x05
++#define UR_CLEAR_FEATURE	0x01
++#define UR_SET_FEATURE		0x03
++#define UR_SET_AND_TEST_FEATURE 0x0c
++#define UR_SET_ADDRESS		0x05
++#define UR_GET_DESCRIPTOR	0x06
++#define  UDESC_DEVICE		0x01
++#define  UDESC_CONFIG		0x02
++#define  UDESC_STRING		0x03
++#define  UDESC_INTERFACE	0x04
++#define  UDESC_ENDPOINT		0x05
++#define  UDESC_SS_USB_COMPANION	0x30
++#define  UDESC_DEVICE_QUALIFIER	0x06
++#define  UDESC_OTHER_SPEED_CONFIGURATION 0x07
++#define  UDESC_INTERFACE_POWER	0x08
++#define  UDESC_OTG		0x09
++#define  WUDESC_SECURITY	0x0c
++#define  WUDESC_KEY		0x0d
++#define   WUD_GET_KEY_INDEX(_wValue_) ((_wValue_) & 0xf)
++#define   WUD_GET_KEY_TYPE(_wValue_) (((_wValue_) & 0x30) >> 4)
++#define    WUD_KEY_TYPE_ASSOC    0x01
++#define    WUD_KEY_TYPE_GTK      0x02
++#define   WUD_GET_KEY_ORIGIN(_wValue_) (((_wValue_) & 0x40) >> 6)
++#define    WUD_KEY_ORIGIN_HOST   0x00
++#define    WUD_KEY_ORIGIN_DEVICE 0x01
++#define  WUDESC_ENCRYPTION_TYPE	0x0e
++#define  WUDESC_BOS		0x0f
++#define  WUDESC_DEVICE_CAPABILITY 0x10
++#define  WUDESC_WIRELESS_ENDPOINT_COMPANION 0x11
++#define  UDESC_BOS		0x0f
++#define  UDESC_DEVICE_CAPABILITY 0x10
++#define  UDESC_CS_DEVICE	0x21	/* class specific */
++#define  UDESC_CS_CONFIG	0x22
++#define  UDESC_CS_STRING	0x23
++#define  UDESC_CS_INTERFACE	0x24
++#define  UDESC_CS_ENDPOINT	0x25
++#define  UDESC_HUB		0x29
++#define UR_SET_DESCRIPTOR	0x07
++#define UR_GET_CONFIG		0x08
++#define UR_SET_CONFIG		0x09
++#define UR_GET_INTERFACE	0x0a
++#define UR_SET_INTERFACE	0x0b
++#define UR_SYNCH_FRAME		0x0c
++#define WUR_SET_ENCRYPTION      0x0d
++#define WUR_GET_ENCRYPTION	0x0e
++#define WUR_SET_HANDSHAKE	0x0f
++#define WUR_GET_HANDSHAKE	0x10
++#define WUR_SET_CONNECTION	0x11
++#define WUR_SET_SECURITY_DATA	0x12
++#define WUR_GET_SECURITY_DATA	0x13
++#define WUR_SET_WUSB_DATA	0x14
++#define  WUDATA_DRPIE_INFO	0x01
++#define  WUDATA_TRANSMIT_DATA	0x02
++#define  WUDATA_TRANSMIT_PARAMS	0x03
++#define  WUDATA_RECEIVE_PARAMS	0x04
++#define  WUDATA_TRANSMIT_POWER	0x05
++#define WUR_LOOPBACK_DATA_WRITE	0x15
++#define WUR_LOOPBACK_DATA_READ	0x16
++#define WUR_SET_INTERFACE_DS	0x17
++
++/* Feature numbers */
++#define UF_ENDPOINT_HALT	0
++#define UF_DEVICE_REMOTE_WAKEUP	1
++#define UF_TEST_MODE		2
++#define UF_DEVICE_B_HNP_ENABLE	3
++#define UF_DEVICE_A_HNP_SUPPORT	4
++#define UF_DEVICE_A_ALT_HNP_SUPPORT 5
++#define WUF_WUSB		3
++#define  WUF_TX_DRPIE		0x0
++#define  WUF_DEV_XMIT_PACKET	0x1
++#define  WUF_COUNT_PACKETS	0x2
++#define  WUF_CAPTURE_PACKETS	0x3
++#define UF_FUNCTION_SUSPEND	0
++#define UF_U1_ENABLE		48
++#define UF_U2_ENABLE		49
++#define UF_LTM_ENABLE		50
++
++/* Class requests from the USB 2.0 hub spec, table 11-15 */
++#define UCR_CLEAR_HUB_FEATURE		(0x2000 | UR_CLEAR_FEATURE)
++#define UCR_CLEAR_PORT_FEATURE		(0x2300 | UR_CLEAR_FEATURE)
++#define UCR_GET_HUB_DESCRIPTOR		(0xa000 | UR_GET_DESCRIPTOR)
++#define UCR_GET_HUB_STATUS		(0xa000 | UR_GET_STATUS)
++#define UCR_GET_PORT_STATUS		(0xa300 | UR_GET_STATUS)
++#define UCR_SET_HUB_FEATURE		(0x2000 | UR_SET_FEATURE)
++#define UCR_SET_PORT_FEATURE		(0x2300 | UR_SET_FEATURE)
++#define UCR_SET_AND_TEST_PORT_FEATURE	(0xa300 | UR_SET_AND_TEST_FEATURE)
++
++#ifdef _MSC_VER
++#include <pshpack1.h>
++#endif
++
++typedef struct {
++	uByte		bLength;
++	uByte		bDescriptorType;
++	uByte		bEndpointAddress;
++#define UE_GET_DIR(a)	((a) & 0x80)
++#define UE_SET_DIR(a,d)	((a) | (((d)&1) << 7))
++#define UE_DIR_IN	0x80
++#define UE_DIR_OUT	0x00
++#define UE_ADDR		0x0f
++#define UE_GET_ADDR(a)	((a) & UE_ADDR)
++	uByte		bmAttributes;
++#define UE_XFERTYPE	0x03
++#define  UE_CONTROL	0x00
++#define  UE_ISOCHRONOUS	0x01
++#define  UE_BULK	0x02
++#define  UE_INTERRUPT	0x03
++#define UE_GET_XFERTYPE(a)	((a) & UE_XFERTYPE)
++#define UE_ISO_TYPE	0x0c
++#define  UE_ISO_ASYNC	0x04
++#define  UE_ISO_ADAPT	0x08
++#define  UE_ISO_SYNC	0x0c
++#define UE_GET_ISO_TYPE(a)	((a) & UE_ISO_TYPE)
++	uWord		wMaxPacketSize;
++	uByte		bInterval;
++} UPACKED usb_endpoint_descriptor_t;
++#define USB_ENDPOINT_DESCRIPTOR_SIZE 7
++
++/* Hub specific request */
++#define UR_GET_BUS_STATE	0x02
++#define UR_CLEAR_TT_BUFFER	0x08
++#define UR_RESET_TT		0x09
++#define UR_GET_TT_STATE		0x0a
++#define UR_STOP_TT		0x0b
++
++/* Hub features */
++#define UHF_C_HUB_LOCAL_POWER	0
++#define UHF_C_HUB_OVER_CURRENT	1
++#define UHF_PORT_CONNECTION	0
++#define UHF_PORT_ENABLE		1
++#define UHF_PORT_SUSPEND	2
++#define UHF_PORT_OVER_CURRENT	3
++#define UHF_PORT_RESET		4
++#define UHF_PORT_L1		5
++#define UHF_PORT_POWER		8
++#define UHF_PORT_LOW_SPEED	9
++#define UHF_PORT_HIGH_SPEED	10
++#define UHF_C_PORT_CONNECTION	16
++#define UHF_C_PORT_ENABLE	17
++#define UHF_C_PORT_SUSPEND	18
++#define UHF_C_PORT_OVER_CURRENT	19
++#define UHF_C_PORT_RESET	20
++#define UHF_C_PORT_L1		23
++#define UHF_PORT_TEST		21
++#define UHF_PORT_INDICATOR	22
++
++typedef struct {
++	uByte		bDescLength;
++	uByte		bDescriptorType;
++	uByte		bNbrPorts;
++	uWord		wHubCharacteristics;
++#define UHD_PWR			0x0003
++#define  UHD_PWR_GANGED		0x0000
++#define  UHD_PWR_INDIVIDUAL	0x0001
++#define  UHD_PWR_NO_SWITCH	0x0002
++#define UHD_COMPOUND		0x0004
++#define UHD_OC			0x0018
++#define  UHD_OC_GLOBAL		0x0000
++#define  UHD_OC_INDIVIDUAL	0x0008
++#define  UHD_OC_NONE		0x0010
++#define UHD_TT_THINK		0x0060
++#define  UHD_TT_THINK_8		0x0000
++#define  UHD_TT_THINK_16	0x0020
++#define  UHD_TT_THINK_24	0x0040
++#define  UHD_TT_THINK_32	0x0060
++#define UHD_PORT_IND		0x0080
++	uByte		bPwrOn2PwrGood;	/* delay in 2 ms units */
++#define UHD_PWRON_FACTOR 2
++	uByte		bHubContrCurrent;
++	uByte		DeviceRemovable[32]; /* max 255 ports */
++#define UHD_NOT_REMOV(desc, i) \
++    (((desc)->DeviceRemovable[(i)/8] >> ((i) % 8)) & 1)
++	/* deprecated */ uByte		PortPowerCtrlMask[1];
++} UPACKED usb_hub_descriptor_t;
++#define USB_HUB_DESCRIPTOR_SIZE 9 /* includes deprecated PortPowerCtrlMask */
++
++#ifdef _MSC_VER
++#include <poppack.h>
++#endif
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _USB_H_ */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/Makefile
+@@ -0,0 +1,85 @@
++#
++# Makefile for DWC_otg Highspeed USB controller driver
++#
++
++ifneq ($(KERNELRELEASE),)
++
++# Use the BUS_INTERFACE variable to compile the software for either
++# PCI(PCI_INTERFACE) or LM(LM_INTERFACE) bus.
++ifeq ($(BUS_INTERFACE),)
++#	BUS_INTERFACE = -DPCI_INTERFACE
++#	BUS_INTERFACE = -DLM_INTERFACE
++        BUS_INTERFACE = -DPLATFORM_INTERFACE
++endif
++
++#ccflags-y	+= -DDEBUG
++#ccflags-y	+= -DDWC_OTG_DEBUGLEV=1 # reduce common debug msgs
++
++# Use one of the following flags to compile the software in host-only or
++# device-only mode.
++#ccflags-y        += -DDWC_HOST_ONLY
++#ccflags-y        += -DDWC_DEVICE_ONLY
++
++ccflags-y	+= -Dlinux -DDWC_HS_ELECT_TST
++#ccflags-y	+= -DDWC_EN_ISOC
++ccflags-y   	+= -I$(srctree)/drivers/usb/host/dwc_common_port
++#ccflags-y   	+= -I$(PORTLIB)
++ccflags-y   	+= -DDWC_LINUX
++ccflags-y   	+= $(CFI)
++ccflags-y	+= $(BUS_INTERFACE)
++#ccflags-y	+= -DDWC_DEV_SRPCAP
++
++obj-$(CONFIG_USB_DWCOTG) += dwc_otg.o
++
++dwc_otg-objs	:= dwc_otg_driver.o dwc_otg_attr.o
++dwc_otg-objs	+= dwc_otg_cil.o dwc_otg_cil_intr.o
++dwc_otg-objs	+= dwc_otg_pcd_linux.o dwc_otg_pcd.o dwc_otg_pcd_intr.o
++dwc_otg-objs	+= dwc_otg_hcd.o dwc_otg_hcd_linux.o dwc_otg_hcd_intr.o dwc_otg_hcd_queue.o dwc_otg_hcd_ddma.o
++dwc_otg-objs	+= dwc_otg_adp.o
++dwc_otg-objs	+= dwc_otg_fiq_fsm.o
++ifneq ($(CONFIG_ARM64),y)
++dwc_otg-objs	+= dwc_otg_fiq_stub.o
++endif
++
++ifneq ($(CFI),)
++dwc_otg-objs	+= dwc_otg_cfi.o
++endif
++
++kernrelwd := $(subst ., ,$(KERNELRELEASE))
++kernrel3 := $(word 1,$(kernrelwd)).$(word 2,$(kernrelwd)).$(word 3,$(kernrelwd))
++
++ifneq ($(kernrel3),2.6.20)
++ccflags-y += $(CPPFLAGS)
++endif
++
++else
++
++PWD		:= $(shell pwd)
++PORTLIB		:= $(PWD)/../dwc_common_port
++
++# Command paths
++CTAGS		:= $(CTAGS)
++DOXYGEN		:= $(DOXYGEN)
++
++default: portlib
++	$(MAKE) -C$(KDIR) M=$(PWD) ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) modules
++
++install: default
++	$(MAKE) -C$(KDIR) M=$(PORTLIB) modules_install
++	$(MAKE) -C$(KDIR) M=$(PWD) modules_install
++
++portlib:
++	$(MAKE) -C$(KDIR) M=$(PORTLIB) ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) modules
++	cp $(PORTLIB)/Module.symvers $(PWD)/
++
++docs:	$(wildcard *.[hc]) doc/doxygen.cfg
++	$(DOXYGEN) doc/doxygen.cfg
++
++tags:	$(wildcard *.[hc])
++	$(CTAGS) -e $(wildcard *.[hc]) $(wildcard linux/*.[hc]) $(wildcard $(KDIR)/include/linux/usb*.h)
++
++
++clean:
++	rm -rf   *.o *.ko .*cmd *.mod.c .tmp_versions Module.symvers
++
++endif
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/doc/doxygen.cfg
+@@ -0,0 +1,224 @@
++# Doxyfile 1.3.9.1
++
++#---------------------------------------------------------------------------
++# Project related configuration options
++#---------------------------------------------------------------------------
++PROJECT_NAME           = "DesignWare USB 2.0 OTG Controller (DWC_otg) Device Driver"
++PROJECT_NUMBER         = v3.00a
++OUTPUT_DIRECTORY       = ./doc/
++CREATE_SUBDIRS         = NO
++OUTPUT_LANGUAGE        = English
++BRIEF_MEMBER_DESC      = YES
++REPEAT_BRIEF           = YES
++ABBREVIATE_BRIEF       = "The $name class" \
++                         "The $name widget" \
++                         "The $name file" \
++                         is \
++                         provides \
++                         specifies \
++                         contains \
++                         represents \
++                         a \
++                         an \
++                         the
++ALWAYS_DETAILED_SEC    = NO
++INLINE_INHERITED_MEMB  = NO
++FULL_PATH_NAMES        = NO
++STRIP_FROM_PATH        =
++STRIP_FROM_INC_PATH    =
++SHORT_NAMES            = NO
++JAVADOC_AUTOBRIEF      = YES
++MULTILINE_CPP_IS_BRIEF = NO
++INHERIT_DOCS           = YES
++DISTRIBUTE_GROUP_DOC   = NO
++TAB_SIZE               = 8
++ALIASES                =
++OPTIMIZE_OUTPUT_FOR_C  = YES
++OPTIMIZE_OUTPUT_JAVA   = NO
++SUBGROUPING            = YES
++#---------------------------------------------------------------------------
++# Build related configuration options
++#---------------------------------------------------------------------------
++EXTRACT_ALL            = NO
++EXTRACT_PRIVATE        = YES
++EXTRACT_STATIC         = YES
++EXTRACT_LOCAL_CLASSES  = YES
++EXTRACT_LOCAL_METHODS  = NO
++HIDE_UNDOC_MEMBERS     = NO
++HIDE_UNDOC_CLASSES     = NO
++HIDE_FRIEND_COMPOUNDS  = NO
++HIDE_IN_BODY_DOCS      = NO
++INTERNAL_DOCS          = NO
++CASE_SENSE_NAMES       = NO
++HIDE_SCOPE_NAMES       = NO
++SHOW_INCLUDE_FILES     = YES
++INLINE_INFO            = YES
++SORT_MEMBER_DOCS       = NO
++SORT_BRIEF_DOCS        = NO
++SORT_BY_SCOPE_NAME     = NO
++GENERATE_TODOLIST      = YES
++GENERATE_TESTLIST      = YES
++GENERATE_BUGLIST       = YES
++GENERATE_DEPRECATEDLIST= YES
++ENABLED_SECTIONS       =
++MAX_INITIALIZER_LINES  = 30
++SHOW_USED_FILES        = YES
++SHOW_DIRECTORIES       = YES
++#---------------------------------------------------------------------------
++# configuration options related to warning and progress messages
++#---------------------------------------------------------------------------
++QUIET                  = YES
++WARNINGS               = YES
++WARN_IF_UNDOCUMENTED   = NO
++WARN_IF_DOC_ERROR      = YES
++WARN_FORMAT            = "$file:$line: $text"
++WARN_LOGFILE           =
++#---------------------------------------------------------------------------
++# configuration options related to the input files
++#---------------------------------------------------------------------------
++INPUT                  = .
++FILE_PATTERNS          = *.c \
++                         *.h \
++                         ./linux/*.c \
++                         ./linux/*.h
++RECURSIVE              = NO
++EXCLUDE                = ./test/ \
++                         ./dwc_otg/.AppleDouble/
++EXCLUDE_SYMLINKS       = YES
++EXCLUDE_PATTERNS       = *.mod.*
++EXAMPLE_PATH           =
++EXAMPLE_PATTERNS       = *
++EXAMPLE_RECURSIVE      = NO
++IMAGE_PATH             =
++INPUT_FILTER           =
++FILTER_PATTERNS        =
++FILTER_SOURCE_FILES    = NO
++#---------------------------------------------------------------------------
++# configuration options related to source browsing
++#---------------------------------------------------------------------------
++SOURCE_BROWSER         = YES
++INLINE_SOURCES         = NO
++STRIP_CODE_COMMENTS    = YES
++REFERENCED_BY_RELATION = NO
++REFERENCES_RELATION    = NO
++VERBATIM_HEADERS       = NO
++#---------------------------------------------------------------------------
++# configuration options related to the alphabetical class index
++#---------------------------------------------------------------------------
++ALPHABETICAL_INDEX     = NO
++COLS_IN_ALPHA_INDEX    = 5
++IGNORE_PREFIX          =
++#---------------------------------------------------------------------------
++# configuration options related to the HTML output
++#---------------------------------------------------------------------------
++GENERATE_HTML          = YES
++HTML_OUTPUT            = html
++HTML_FILE_EXTENSION    = .html
++HTML_HEADER            =
++HTML_FOOTER            =
++HTML_STYLESHEET        =
++HTML_ALIGN_MEMBERS     = YES
++GENERATE_HTMLHELP      = NO
++CHM_FILE               =
++HHC_LOCATION           =
++GENERATE_CHI           = NO
++BINARY_TOC             = NO
++TOC_EXPAND             = NO
++DISABLE_INDEX          = NO
++ENUM_VALUES_PER_LINE   = 4
++GENERATE_TREEVIEW      = YES
++TREEVIEW_WIDTH         = 250
++#---------------------------------------------------------------------------
++# configuration options related to the LaTeX output
++#---------------------------------------------------------------------------
++GENERATE_LATEX         = NO
++LATEX_OUTPUT           = latex
++LATEX_CMD_NAME         = latex
++MAKEINDEX_CMD_NAME     = makeindex
++COMPACT_LATEX          = NO
++PAPER_TYPE             = a4wide
++EXTRA_PACKAGES         =
++LATEX_HEADER           =
++PDF_HYPERLINKS         = NO
++USE_PDFLATEX           = NO
++LATEX_BATCHMODE        = NO
++LATEX_HIDE_INDICES     = NO
++#---------------------------------------------------------------------------
++# configuration options related to the RTF output
++#---------------------------------------------------------------------------
++GENERATE_RTF           = NO
++RTF_OUTPUT             = rtf
++COMPACT_RTF            = NO
++RTF_HYPERLINKS         = NO
++RTF_STYLESHEET_FILE    =
++RTF_EXTENSIONS_FILE    =
++#---------------------------------------------------------------------------
++# configuration options related to the man page output
++#---------------------------------------------------------------------------
++GENERATE_MAN           = NO
++MAN_OUTPUT             = man
++MAN_EXTENSION          = .3
++MAN_LINKS              = NO
++#---------------------------------------------------------------------------
++# configuration options related to the XML output
++#---------------------------------------------------------------------------
++GENERATE_XML           = NO
++XML_OUTPUT             = xml
++XML_SCHEMA             =
++XML_DTD                =
++XML_PROGRAMLISTING     = YES
++#---------------------------------------------------------------------------
++# configuration options for the AutoGen Definitions output
++#---------------------------------------------------------------------------
++GENERATE_AUTOGEN_DEF   = NO
++#---------------------------------------------------------------------------
++# configuration options related to the Perl module output
++#---------------------------------------------------------------------------
++GENERATE_PERLMOD       = NO
++PERLMOD_LATEX          = NO
++PERLMOD_PRETTY         = YES
++PERLMOD_MAKEVAR_PREFIX =
++#---------------------------------------------------------------------------
++# Configuration options related to the preprocessor
++#---------------------------------------------------------------------------
++ENABLE_PREPROCESSING   = YES
++MACRO_EXPANSION        = YES
++EXPAND_ONLY_PREDEF     = YES
++SEARCH_INCLUDES        = YES
++INCLUDE_PATH           =
++INCLUDE_FILE_PATTERNS  =
++PREDEFINED             = DEVICE_ATTR DWC_EN_ISOC
++EXPAND_AS_DEFINED      = DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW DWC_OTG_DEVICE_ATTR_BITFIELD_STORE DWC_OTG_DEVICE_ATTR_BITFIELD_RW DWC_OTG_DEVICE_ATTR_BITFIELD_RO DWC_OTG_DEVICE_ATTR_REG_SHOW DWC_OTG_DEVICE_ATTR_REG_STORE DWC_OTG_DEVICE_ATTR_REG32_RW DWC_OTG_DEVICE_ATTR_REG32_RO DWC_EN_ISOC
++SKIP_FUNCTION_MACROS   = NO
++#---------------------------------------------------------------------------
++# Configuration::additions related to external references
++#---------------------------------------------------------------------------
++TAGFILES               =
++GENERATE_TAGFILE       =
++ALLEXTERNALS           = NO
++EXTERNAL_GROUPS        = YES
++PERL_PATH              = /usr/bin/perl
++#---------------------------------------------------------------------------
++# Configuration options related to the dot tool
++#---------------------------------------------------------------------------
++CLASS_DIAGRAMS         = YES
++HIDE_UNDOC_RELATIONS   = YES
++HAVE_DOT               = NO
++CLASS_GRAPH            = YES
++COLLABORATION_GRAPH    = YES
++UML_LOOK               = NO
++TEMPLATE_RELATIONS     = NO
++INCLUDE_GRAPH          = YES
++INCLUDED_BY_GRAPH      = YES
++CALL_GRAPH             = NO
++GRAPHICAL_HIERARCHY    = YES
++DOT_IMAGE_FORMAT       = png
++DOT_PATH               =
++DOTFILE_DIRS           =
++MAX_DOT_GRAPH_DEPTH    = 1000
++GENERATE_LEGEND        = YES
++DOT_CLEANUP            = YES
++#---------------------------------------------------------------------------
++# Configuration::additions related to the search engine
++#---------------------------------------------------------------------------
++SEARCHENGINE           = NO
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dummy_audio.c
+@@ -0,0 +1,1574 @@
++/*
++ * zero.c -- Gadget Zero, for USB development
++ *
++ * Copyright (C) 2003-2004 David Brownell
++ * All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions, and the following disclaimer,
++ *    without modification.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. The names of the above-listed copyright holders may not be used
++ *    to endorse or promote products derived from this software without
++ *    specific prior written permission.
++ *
++ * ALTERNATIVELY, this software may be distributed under the terms of the
++ * GNU General Public License ("GPL") as published by the Free Software
++ * Foundation, either version 2 of that License or (at your option) any
++ * later version.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
++ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
++ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
++ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
++ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
++ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++
++/*
++ * Gadget Zero only needs two bulk endpoints, and is an example of how you
++ * can write a hardware-agnostic gadget driver running inside a USB device.
++ *
++ * Hardware details are visible (see CONFIG_USB_ZERO_* below) but don't
++ * affect most of the driver.
++ *
++ * Use it with the Linux host/master side "usbtest" driver to get a basic
++ * functional test of your device-side usb stack, or with "usb-skeleton".
++ *
++ * It supports two similar configurations.  One sinks whatever the usb host
++ * writes, and in return sources zeroes.  The other loops whatever the host
++ * writes back, so the host can read it.  Module options include:
++ *
++ *   buflen=N		default N=4096, buffer size used
++ *   qlen=N		default N=32, how many buffers in the loopback queue
++ *   loopdefault	default false, list loopback config first
++ *
++ * Many drivers will only have one configuration, letting them be much
++ * simpler if they also don't support high speed operation (like this
++ * driver does).
++ */
++
++#include <linux/config.h>
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/delay.h>
++#include <linux/ioport.h>
++#include <linux/sched.h>
++#include <linux/slab.h>
++#include <linux/smp_lock.h>
++#include <linux/errno.h>
++#include <linux/init.h>
++#include <linux/timer.h>
++#include <linux/list.h>
++#include <linux/interrupt.h>
++#include <linux/uts.h>
++#include <linux/version.h>
++#include <linux/device.h>
++#include <linux/moduleparam.h>
++#include <linux/proc_fs.h>
++
++#include <asm/byteorder.h>
++#include <asm/io.h>
++#include <asm/irq.h>
++#include <asm/system.h>
++#include <asm/unaligned.h>
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
++# include <linux/usb/ch9.h>
++#else
++# include <linux/usb_ch9.h>
++#endif
++
++#include <linux/usb_gadget.h>
++
++
++/*-------------------------------------------------------------------------*/
++/*-------------------------------------------------------------------------*/
++
++
++static int utf8_to_utf16le(const char *s, u16 *cp, unsigned len)
++{
++	int	count = 0;
++	u8	c;
++	u16	uchar;
++
++	/* this insists on correct encodings, though not minimal ones.
++	 * BUT it currently rejects legit 4-byte UTF-8 code points,
++	 * which need surrogate pairs.  (Unicode 3.1 can use them.)
++	 */
++	while (len != 0 && (c = (u8) *s++) != 0) {
++		if (unlikely(c & 0x80)) {
++			// 2-byte sequence:
++			// 00000yyyyyxxxxxx = 110yyyyy 10xxxxxx
++			if ((c & 0xe0) == 0xc0) {
++				uchar = (c & 0x1f) << 6;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c;
++
++			// 3-byte sequence (most CJKV characters):
++			// zzzzyyyyyyxxxxxx = 1110zzzz 10yyyyyy 10xxxxxx
++			} else if ((c & 0xf0) == 0xe0) {
++				uchar = (c & 0x0f) << 12;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c << 6;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c;
++
++				/* no bogus surrogates */
++				if (0xd800 <= uchar && uchar <= 0xdfff)
++					goto fail;
++
++			// 4-byte sequence (surrogate pairs, currently rare):
++			// 11101110wwwwzzzzyy + 110111yyyyxxxxxx
++			//     = 11110uuu 10uuzzzz 10yyyyyy 10xxxxxx
++			// (uuuuu = wwww + 1)
++			// FIXME accept the surrogate code points (only)
++
++			} else
++				goto fail;
++		} else
++			uchar = c;
++		put_unaligned (cpu_to_le16 (uchar), cp++);
++		count++;
++		len--;
++	}
++	return count;
++fail:
++	return -1;
++}
++
++
++/**
++ * usb_gadget_get_string - fill out a string descriptor
++ * @table: of c strings encoded using UTF-8
++ * @id: string id, from low byte of wValue in get string descriptor
++ * @buf: at least 256 bytes
++ *
++ * Finds the UTF-8 string matching the ID, and converts it into a
++ * string descriptor in utf16-le.
++ * Returns length of descriptor (always even) or negative errno
++ *
++ * If your driver needs stings in multiple languages, you'll probably
++ * "switch (wIndex) { ... }"  in your ep0 string descriptor logic,
++ * using this routine after choosing which set of UTF-8 strings to use.
++ * Note that US-ASCII is a strict subset of UTF-8; any string bytes with
++ * the eighth bit set will be multibyte UTF-8 characters, not ISO-8859/1
++ * characters (which are also widely used in C strings).
++ */
++int
++usb_gadget_get_string (struct usb_gadget_strings *table, int id, u8 *buf)
++{
++	struct usb_string	*s;
++	int			len;
++
++	/* descriptor 0 has the language id */
++	if (id == 0) {
++		buf [0] = 4;
++		buf [1] = USB_DT_STRING;
++		buf [2] = (u8) table->language;
++		buf [3] = (u8) (table->language >> 8);
++		return 4;
++	}
++	for (s = table->strings; s && s->s; s++)
++		if (s->id == id)
++			break;
++
++	/* unrecognized: stall. */
++	if (!s || !s->s)
++		return -EINVAL;
++
++	/* string descriptors have length, tag, then UTF16-LE text */
++	len = min ((size_t) 126, strlen (s->s));
++	memset (buf + 2, 0, 2 * len);	/* zero all the bytes */
++	len = utf8_to_utf16le(s->s, (u16 *)&buf[2], len);
++	if (len < 0)
++		return -EINVAL;
++	buf [0] = (len + 1) * 2;
++	buf [1] = USB_DT_STRING;
++	return buf [0];
++}
++
++
++/*-------------------------------------------------------------------------*/
++/*-------------------------------------------------------------------------*/
++
++
++/**
++ * usb_descriptor_fillbuf - fill buffer with descriptors
++ * @buf: Buffer to be filled
++ * @buflen: Size of buf
++ * @src: Array of descriptor pointers, terminated by null pointer.
++ *
++ * Copies descriptors into the buffer, returning the length or a
++ * negative error code if they can't all be copied.  Useful when
++ * assembling descriptors for an associated set of interfaces used
++ * as part of configuring a composite device; or in other cases where
++ * sets of descriptors need to be marshaled.
++ */
++int
++usb_descriptor_fillbuf(void *buf, unsigned buflen,
++		const struct usb_descriptor_header **src)
++{
++	u8	*dest = buf;
++
++	if (!src)
++		return -EINVAL;
++
++	/* fill buffer from src[] until null descriptor ptr */
++	for (; 0 != *src; src++) {
++		unsigned		len = (*src)->bLength;
++
++		if (len > buflen)
++			return -EINVAL;
++		memcpy(dest, *src, len);
++		buflen -= len;
++		dest += len;
++	}
++	return dest - (u8 *)buf;
++}
++
++
++/**
++ * usb_gadget_config_buf - builts a complete configuration descriptor
++ * @config: Header for the descriptor, including characteristics such
++ *	as power requirements and number of interfaces.
++ * @desc: Null-terminated vector of pointers to the descriptors (interface,
++ *	endpoint, etc) defining all functions in this device configuration.
++ * @buf: Buffer for the resulting configuration descriptor.
++ * @length: Length of buffer.  If this is not big enough to hold the
++ *	entire configuration descriptor, an error code will be returned.
++ *
++ * This copies descriptors into the response buffer, building a descriptor
++ * for that configuration.  It returns the buffer length or a negative
++ * status code.  The config.wTotalLength field is set to match the length
++ * of the result, but other descriptor fields (including power usage and
++ * interface count) must be set by the caller.
++ *
++ * Gadget drivers could use this when constructing a config descriptor
++ * in response to USB_REQ_GET_DESCRIPTOR.  They will need to patch the
++ * resulting bDescriptorType value if USB_DT_OTHER_SPEED_CONFIG is needed.
++ */
++int usb_gadget_config_buf(
++	const struct usb_config_descriptor	*config,
++	void					*buf,
++	unsigned				length,
++	const struct usb_descriptor_header	**desc
++)
++{
++	struct usb_config_descriptor		*cp = buf;
++	int					len;
++
++	/* config descriptor first */
++	if (length < USB_DT_CONFIG_SIZE || !desc)
++		return -EINVAL;
++	*cp = *config;
++
++	/* then interface/endpoint/class/vendor/... */
++	len = usb_descriptor_fillbuf(USB_DT_CONFIG_SIZE + (u8*)buf,
++			length - USB_DT_CONFIG_SIZE, desc);
++	if (len < 0)
++		return len;
++	len += USB_DT_CONFIG_SIZE;
++	if (len > 0xffff)
++		return -EINVAL;
++
++	/* patch up the config descriptor */
++	cp->bLength = USB_DT_CONFIG_SIZE;
++	cp->bDescriptorType = USB_DT_CONFIG;
++	cp->wTotalLength = cpu_to_le16(len);
++	cp->bmAttributes |= USB_CONFIG_ATT_ONE;
++	return len;
++}
++
++/*-------------------------------------------------------------------------*/
++/*-------------------------------------------------------------------------*/
++
++
++#define RBUF_LEN (1024*1024)
++static int rbuf_start;
++static int rbuf_len;
++static __u8 rbuf[RBUF_LEN];
++
++/*-------------------------------------------------------------------------*/
++
++#define DRIVER_VERSION		"St Patrick's Day 2004"
++
++static const char shortname [] = "zero";
++static const char longname [] = "YAMAHA YST-MS35D USB Speaker  ";
++
++static const char source_sink [] = "source and sink data";
++static const char loopback [] = "loop input to output";
++
++/*-------------------------------------------------------------------------*/
++
++/*
++ * driver assumes self-powered hardware, and
++ * has no way for users to trigger remote wakeup.
++ *
++ * this version autoconfigures as much as possible,
++ * which is reasonable for most "bulk-only" drivers.
++ */
++static const char *EP_IN_NAME;		/* source */
++static const char *EP_OUT_NAME;		/* sink */
++
++/*-------------------------------------------------------------------------*/
++
++/* big enough to hold our biggest descriptor */
++#define USB_BUFSIZ	512
++
++struct zero_dev {
++	spinlock_t		lock;
++	struct usb_gadget	*gadget;
++	struct usb_request	*req;		/* for control responses */
++
++	/* when configured, we have one of two configs:
++	 * - source data (in to host) and sink it (out from host)
++	 * - or loop it back (out from host back in to host)
++	 */
++	u8			config;
++	struct usb_ep		*in_ep, *out_ep;
++
++	/* autoresume timer */
++	struct timer_list	resume;
++};
++
++#define xprintk(d,level,fmt,args...) \
++	dev_printk(level , &(d)->gadget->dev , fmt , ## args)
++
++#ifdef DEBUG
++#define DBG(dev,fmt,args...) \
++	xprintk(dev , KERN_DEBUG , fmt , ## args)
++#else
++#define DBG(dev,fmt,args...) \
++	do { } while (0)
++#endif /* DEBUG */
++
++#ifdef VERBOSE
++#define VDBG	DBG
++#else
++#define VDBG(dev,fmt,args...) \
++	do { } while (0)
++#endif /* VERBOSE */
++
++#define ERROR(dev,fmt,args...) \
++	xprintk(dev , KERN_ERR , fmt , ## args)
++#define WARN(dev,fmt,args...) \
++	xprintk(dev , KERN_WARNING , fmt , ## args)
++#define INFO(dev,fmt,args...) \
++	xprintk(dev , KERN_INFO , fmt , ## args)
++
++/*-------------------------------------------------------------------------*/
++
++static unsigned buflen = 4096;
++static unsigned qlen = 32;
++static unsigned pattern = 0;
++
++module_param (buflen, uint, S_IRUGO|S_IWUSR);
++module_param (qlen, uint, S_IRUGO|S_IWUSR);
++module_param (pattern, uint, S_IRUGO|S_IWUSR);
++
++/*
++ * if it's nonzero, autoresume says how many seconds to wait
++ * before trying to wake up the host after suspend.
++ */
++static unsigned autoresume = 0;
++module_param (autoresume, uint, 0);
++
++/*
++ * Normally the "loopback" configuration is second (index 1) so
++ * it's not the default.  Here's where to change that order, to
++ * work better with hosts where config changes are problematic.
++ * Or controllers (like superh) that only support one config.
++ */
++static int loopdefault = 0;
++
++module_param (loopdefault, bool, S_IRUGO|S_IWUSR);
++
++/*-------------------------------------------------------------------------*/
++
++/* Thanks to NetChip Technologies for donating this product ID.
++ *
++ * DO NOT REUSE THESE IDs with a protocol-incompatible driver!!  Ever!!
++ * Instead:  allocate your own, using normal USB-IF procedures.
++ */
++#ifndef	CONFIG_USB_ZERO_HNPTEST
++#define DRIVER_VENDOR_NUM	0x0525		/* NetChip */
++#define DRIVER_PRODUCT_NUM	0xa4a0		/* Linux-USB "Gadget Zero" */
++#else
++#define DRIVER_VENDOR_NUM	0x1a0a		/* OTG test device IDs */
++#define DRIVER_PRODUCT_NUM	0xbadd
++#endif
++
++/*-------------------------------------------------------------------------*/
++
++/*
++ * DESCRIPTORS ... most are static, but strings and (full)
++ * configuration descriptors are built on demand.
++ */
++
++/*
++#define STRING_MANUFACTURER		25
++#define STRING_PRODUCT			42
++#define STRING_SERIAL			101
++*/
++#define STRING_MANUFACTURER		1
++#define STRING_PRODUCT			2
++#define STRING_SERIAL			3
++
++#define STRING_SOURCE_SINK		250
++#define STRING_LOOPBACK			251
++
++/*
++ * This device advertises two configurations; these numbers work
++ * on a pxa250 as well as more flexible hardware.
++ */
++#define	CONFIG_SOURCE_SINK	3
++#define	CONFIG_LOOPBACK		2
++
++/*
++static struct usb_device_descriptor
++device_desc = {
++	.bLength =		sizeof device_desc,
++	.bDescriptorType =	USB_DT_DEVICE,
++
++	.bcdUSB =		__constant_cpu_to_le16 (0x0200),
++	.bDeviceClass =		USB_CLASS_VENDOR_SPEC,
++
++	.idVendor =		__constant_cpu_to_le16 (DRIVER_VENDOR_NUM),
++	.idProduct =		__constant_cpu_to_le16 (DRIVER_PRODUCT_NUM),
++	.iManufacturer =	STRING_MANUFACTURER,
++	.iProduct =		STRING_PRODUCT,
++	.iSerialNumber =	STRING_SERIAL,
++	.bNumConfigurations =	2,
++};
++*/
++static struct usb_device_descriptor
++device_desc = {
++	.bLength =		sizeof device_desc,
++	.bDescriptorType =	USB_DT_DEVICE,
++	.bcdUSB =		__constant_cpu_to_le16 (0x0100),
++	.bDeviceClass =		USB_CLASS_PER_INTERFACE,
++	.bDeviceSubClass =      0,
++	.bDeviceProtocol =      0,
++	.bMaxPacketSize0 =      64,
++	.bcdDevice =            __constant_cpu_to_le16 (0x0100),
++	.idVendor =		__constant_cpu_to_le16 (0x0499),
++	.idProduct =		__constant_cpu_to_le16 (0x3002),
++	.iManufacturer =	STRING_MANUFACTURER,
++	.iProduct =		STRING_PRODUCT,
++	.iSerialNumber =	STRING_SERIAL,
++	.bNumConfigurations =	1,
++};
++
++static struct usb_config_descriptor
++z_config = {
++	.bLength =		sizeof z_config,
++	.bDescriptorType =	USB_DT_CONFIG,
++
++	/* compute wTotalLength on the fly */
++	.bNumInterfaces =	2,
++	.bConfigurationValue =	1,
++	.iConfiguration =	0,
++	.bmAttributes =		0x40,
++	.bMaxPower =		0,	/* self-powered */
++};
++
++
++static struct usb_otg_descriptor
++otg_descriptor = {
++	.bLength =		sizeof otg_descriptor,
++	.bDescriptorType =	USB_DT_OTG,
++
++	.bmAttributes =		USB_OTG_SRP,
++};
++
++/* one interface in each configuration */
++#ifdef	CONFIG_USB_GADGET_DUALSPEED
++
++/*
++ * usb 2.0 devices need to expose both high speed and full speed
++ * descriptors, unless they only run at full speed.
++ *
++ * that means alternate endpoint descriptors (bigger packets)
++ * and a "device qualifier" ... plus more construction options
++ * for the config descriptor.
++ */
++
++static struct usb_qualifier_descriptor
++dev_qualifier = {
++	.bLength =		sizeof dev_qualifier,
++	.bDescriptorType =	USB_DT_DEVICE_QUALIFIER,
++
++	.bcdUSB =		__constant_cpu_to_le16 (0x0200),
++	.bDeviceClass =		USB_CLASS_VENDOR_SPEC,
++
++	.bNumConfigurations =	2,
++};
++
++
++struct usb_cs_as_general_descriptor {
++	__u8  bLength;
++	__u8  bDescriptorType;
++
++	__u8  bDescriptorSubType;
++	__u8  bTerminalLink;
++	__u8  bDelay;
++	__u16  wFormatTag;
++} __attribute__ ((packed));
++
++struct usb_cs_as_format_descriptor {
++	__u8  bLength;
++	__u8  bDescriptorType;
++
++	__u8  bDescriptorSubType;
++	__u8  bFormatType;
++	__u8  bNrChannels;
++	__u8  bSubframeSize;
++	__u8  bBitResolution;
++	__u8  bSamfreqType;
++	__u8  tLowerSamFreq[3];
++	__u8  tUpperSamFreq[3];
++} __attribute__ ((packed));
++
++static const struct usb_interface_descriptor
++z_audio_control_if_desc = {
++	.bLength =		sizeof z_audio_control_if_desc,
++	.bDescriptorType =	USB_DT_INTERFACE,
++	.bInterfaceNumber = 0,
++	.bAlternateSetting = 0,
++	.bNumEndpoints = 0,
++	.bInterfaceClass = USB_CLASS_AUDIO,
++	.bInterfaceSubClass = 0x1,
++	.bInterfaceProtocol = 0,
++	.iInterface = 0,
++};
++
++static const struct usb_interface_descriptor
++z_audio_if_desc = {
++	.bLength =		sizeof z_audio_if_desc,
++	.bDescriptorType =	USB_DT_INTERFACE,
++	.bInterfaceNumber = 1,
++	.bAlternateSetting = 0,
++	.bNumEndpoints = 0,
++	.bInterfaceClass = USB_CLASS_AUDIO,
++	.bInterfaceSubClass = 0x2,
++	.bInterfaceProtocol = 0,
++	.iInterface = 0,
++};
++
++static const struct usb_interface_descriptor
++z_audio_if_desc2 = {
++	.bLength =		sizeof z_audio_if_desc,
++	.bDescriptorType =	USB_DT_INTERFACE,
++	.bInterfaceNumber = 1,
++	.bAlternateSetting = 1,
++	.bNumEndpoints = 1,
++	.bInterfaceClass = USB_CLASS_AUDIO,
++	.bInterfaceSubClass = 0x2,
++	.bInterfaceProtocol = 0,
++	.iInterface = 0,
++};
++
++static const struct usb_cs_as_general_descriptor
++z_audio_cs_as_if_desc = {
++	.bLength = 7,
++	.bDescriptorType = 0x24,
++
++	.bDescriptorSubType = 0x01,
++	.bTerminalLink = 0x01,
++	.bDelay = 0x0,
++	.wFormatTag = __constant_cpu_to_le16 (0x0001)
++};
++
++
++static const struct usb_cs_as_format_descriptor
++z_audio_cs_as_format_desc = {
++	.bLength = 0xe,
++	.bDescriptorType = 0x24,
++
++	.bDescriptorSubType = 2,
++	.bFormatType = 1,
++	.bNrChannels = 1,
++	.bSubframeSize = 1,
++	.bBitResolution = 8,
++	.bSamfreqType = 0,
++	.tLowerSamFreq = {0x7e, 0x13, 0x00},
++	.tUpperSamFreq = {0xe2, 0xd6, 0x00},
++};
++
++static const struct usb_endpoint_descriptor
++z_iso_ep = {
++	.bLength = 0x09,
++	.bDescriptorType = 0x05,
++	.bEndpointAddress = 0x04,
++	.bmAttributes = 0x09,
++	.wMaxPacketSize = 0x0038,
++	.bInterval = 0x01,
++	.bRefresh = 0x00,
++	.bSynchAddress = 0x00,
++};
++
++static char z_iso_ep2[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
++
++// 9 bytes
++static char z_ac_interface_header_desc[] =
++{ 0x09, 0x24, 0x01, 0x00, 0x01, 0x2b, 0x00, 0x01, 0x01 };
++
++// 12 bytes
++static char z_0[] = {0x0c, 0x24, 0x02, 0x01, 0x01, 0x01, 0x00, 0x02,
++		     0x03, 0x00, 0x00, 0x00};
++// 13 bytes
++static char z_1[] = {0x0d, 0x24, 0x06, 0x02, 0x01, 0x02, 0x15, 0x00,
++		     0x02, 0x00, 0x02, 0x00, 0x00};
++// 9 bytes
++static char z_2[] = {0x09, 0x24, 0x03, 0x03, 0x01, 0x03, 0x00, 0x02,
++		     0x00};
++
++static char za_0[] = {0x09, 0x04, 0x01, 0x02, 0x01, 0x01, 0x02, 0x00,
++		      0x00};
++
++static char za_1[] = {0x07, 0x24, 0x01, 0x01, 0x00, 0x01, 0x00};
++
++static char za_2[] = {0x0e, 0x24, 0x02, 0x01, 0x02, 0x01, 0x08, 0x00,
++		      0x7e, 0x13, 0x00, 0xe2, 0xd6, 0x00};
++
++static char za_3[] = {0x09, 0x05, 0x04, 0x09, 0x70, 0x00, 0x01, 0x00,
++		      0x00};
++
++static char za_4[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
++
++static char za_5[] = {0x09, 0x04, 0x01, 0x03, 0x01, 0x01, 0x02, 0x00,
++		      0x00};
++
++static char za_6[] = {0x07, 0x24, 0x01, 0x01, 0x00, 0x01, 0x00};
++
++static char za_7[] = {0x0e, 0x24, 0x02, 0x01, 0x01, 0x02, 0x10, 0x00,
++		      0x7e, 0x13, 0x00, 0xe2, 0xd6, 0x00};
++
++static char za_8[] = {0x09, 0x05, 0x04, 0x09, 0x70, 0x00, 0x01, 0x00,
++		      0x00};
++
++static char za_9[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
++
++static char za_10[] = {0x09, 0x04, 0x01, 0x04, 0x01, 0x01, 0x02, 0x00,
++		       0x00};
++
++static char za_11[] = {0x07, 0x24, 0x01, 0x01, 0x00, 0x01, 0x00};
++
++static char za_12[] = {0x0e, 0x24, 0x02, 0x01, 0x02, 0x02, 0x10, 0x00,
++		       0x73, 0x13, 0x00, 0xe2, 0xd6, 0x00};
++
++static char za_13[] = {0x09, 0x05, 0x04, 0x09, 0xe0, 0x00, 0x01, 0x00,
++		       0x00};
++
++static char za_14[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
++
++static char za_15[] = {0x09, 0x04, 0x01, 0x05, 0x01, 0x01, 0x02, 0x00,
++		       0x00};
++
++static char za_16[] = {0x07, 0x24, 0x01, 0x01, 0x00, 0x01, 0x00};
++
++static char za_17[] = {0x0e, 0x24, 0x02, 0x01, 0x01, 0x03, 0x14, 0x00,
++		       0x7e, 0x13, 0x00, 0xe2, 0xd6, 0x00};
++
++static char za_18[] = {0x09, 0x05, 0x04, 0x09, 0xa8, 0x00, 0x01, 0x00,
++		       0x00};
++
++static char za_19[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
++
++static char za_20[] = {0x09, 0x04, 0x01, 0x06, 0x01, 0x01, 0x02, 0x00,
++		       0x00};
++
++static char za_21[] = {0x07, 0x24, 0x01, 0x01, 0x00, 0x01, 0x00};
++
++static char za_22[] = {0x0e, 0x24, 0x02, 0x01, 0x02, 0x03, 0x14, 0x00,
++		       0x7e, 0x13, 0x00, 0xe2, 0xd6, 0x00};
++
++static char za_23[] = {0x09, 0x05, 0x04, 0x09, 0x50, 0x01, 0x01, 0x00,
++		       0x00};
++
++static char za_24[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
++
++
++
++static const struct usb_descriptor_header *z_function [] = {
++	(struct usb_descriptor_header *) &z_audio_control_if_desc,
++	(struct usb_descriptor_header *) &z_ac_interface_header_desc,
++	(struct usb_descriptor_header *) &z_0,
++	(struct usb_descriptor_header *) &z_1,
++	(struct usb_descriptor_header *) &z_2,
++	(struct usb_descriptor_header *) &z_audio_if_desc,
++	(struct usb_descriptor_header *) &z_audio_if_desc2,
++	(struct usb_descriptor_header *) &z_audio_cs_as_if_desc,
++	(struct usb_descriptor_header *) &z_audio_cs_as_format_desc,
++	(struct usb_descriptor_header *) &z_iso_ep,
++	(struct usb_descriptor_header *) &z_iso_ep2,
++	(struct usb_descriptor_header *) &za_0,
++	(struct usb_descriptor_header *) &za_1,
++	(struct usb_descriptor_header *) &za_2,
++	(struct usb_descriptor_header *) &za_3,
++	(struct usb_descriptor_header *) &za_4,
++	(struct usb_descriptor_header *) &za_5,
++	(struct usb_descriptor_header *) &za_6,
++	(struct usb_descriptor_header *) &za_7,
++	(struct usb_descriptor_header *) &za_8,
++	(struct usb_descriptor_header *) &za_9,
++	(struct usb_descriptor_header *) &za_10,
++	(struct usb_descriptor_header *) &za_11,
++	(struct usb_descriptor_header *) &za_12,
++	(struct usb_descriptor_header *) &za_13,
++	(struct usb_descriptor_header *) &za_14,
++	(struct usb_descriptor_header *) &za_15,
++	(struct usb_descriptor_header *) &za_16,
++	(struct usb_descriptor_header *) &za_17,
++	(struct usb_descriptor_header *) &za_18,
++	(struct usb_descriptor_header *) &za_19,
++	(struct usb_descriptor_header *) &za_20,
++	(struct usb_descriptor_header *) &za_21,
++	(struct usb_descriptor_header *) &za_22,
++	(struct usb_descriptor_header *) &za_23,
++	(struct usb_descriptor_header *) &za_24,
++	NULL,
++};
++
++/* maxpacket and other transfer characteristics vary by speed. */
++#define ep_desc(g,hs,fs) (((g)->speed==USB_SPEED_HIGH)?(hs):(fs))
++
++#else
++
++/* if there's no high speed support, maxpacket doesn't change. */
++#define ep_desc(g,hs,fs) fs
++
++#endif	/* !CONFIG_USB_GADGET_DUALSPEED */
++
++static char				manufacturer [40];
++//static char				serial [40];
++static char				serial [] = "Ser 00 em";
++
++/* static strings, in UTF-8 */
++static struct usb_string		strings [] = {
++	{ STRING_MANUFACTURER, manufacturer, },
++	{ STRING_PRODUCT, longname, },
++	{ STRING_SERIAL, serial, },
++	{ STRING_LOOPBACK, loopback, },
++	{ STRING_SOURCE_SINK, source_sink, },
++	{  }			/* end of list */
++};
++
++static struct usb_gadget_strings	stringtab = {
++	.language	= 0x0409,	/* en-us */
++	.strings	= strings,
++};
++
++/*
++ * config descriptors are also handcrafted.  these must agree with code
++ * that sets configurations, and with code managing interfaces and their
++ * altsettings.  other complexity may come from:
++ *
++ *  - high speed support, including "other speed config" rules
++ *  - multiple configurations
++ *  - interfaces with alternate settings
++ *  - embedded class or vendor-specific descriptors
++ *
++ * this handles high speed, and has a second config that could as easily
++ * have been an alternate interface setting (on most hardware).
++ *
++ * NOTE:  to demonstrate (and test) more USB capabilities, this driver
++ * should include an altsetting to test interrupt transfers, including
++ * high bandwidth modes at high speed.  (Maybe work like Intel's test
++ * device?)
++ */
++static int
++config_buf (struct usb_gadget *gadget, u8 *buf, u8 type, unsigned index)
++{
++	int len;
++	const struct usb_descriptor_header **function;
++
++	function = z_function;
++	len = usb_gadget_config_buf (&z_config, buf, USB_BUFSIZ, function);
++	if (len < 0)
++		return len;
++	((struct usb_config_descriptor *) buf)->bDescriptorType = type;
++	return len;
++}
++
++/*-------------------------------------------------------------------------*/
++
++static struct usb_request *
++alloc_ep_req (struct usb_ep *ep, unsigned length)
++{
++	struct usb_request	*req;
++
++	req = usb_ep_alloc_request (ep, GFP_ATOMIC);
++	if (req) {
++		req->length = length;
++		req->buf = usb_ep_alloc_buffer (ep, length,
++				&req->dma, GFP_ATOMIC);
++		if (!req->buf) {
++			usb_ep_free_request (ep, req);
++			req = NULL;
++		}
++	}
++	return req;
++}
++
++static void free_ep_req (struct usb_ep *ep, struct usb_request *req)
++{
++	if (req->buf)
++		usb_ep_free_buffer (ep, req->buf, req->dma, req->length);
++	usb_ep_free_request (ep, req);
++}
++
++/*-------------------------------------------------------------------------*/
++
++/* optionally require specific source/sink data patterns  */
++
++static int
++check_read_data (
++	struct zero_dev		*dev,
++	struct usb_ep		*ep,
++	struct usb_request	*req
++)
++{
++	unsigned	i;
++	u8		*buf = req->buf;
++
++	for (i = 0; i < req->actual; i++, buf++) {
++		switch (pattern) {
++		/* all-zeroes has no synchronization issues */
++		case 0:
++			if (*buf == 0)
++				continue;
++			break;
++		/* mod63 stays in sync with short-terminated transfers,
++		 * or otherwise when host and gadget agree on how large
++		 * each usb transfer request should be.  resync is done
++		 * with set_interface or set_config.
++		 */
++		case 1:
++			if (*buf == (u8)(i % 63))
++				continue;
++			break;
++		}
++		ERROR (dev, "bad OUT byte, buf [%d] = %d\n", i, *buf);
++		usb_ep_set_halt (ep);
++		return -EINVAL;
++	}
++	return 0;
++}
++
++/*-------------------------------------------------------------------------*/
++
++static void zero_reset_config (struct zero_dev *dev)
++{
++	if (dev->config == 0)
++		return;
++
++	DBG (dev, "reset config\n");
++
++	/* just disable endpoints, forcing completion of pending i/o.
++	 * all our completion handlers free their requests in this case.
++	 */
++	if (dev->in_ep) {
++		usb_ep_disable (dev->in_ep);
++		dev->in_ep = NULL;
++	}
++	if (dev->out_ep) {
++		usb_ep_disable (dev->out_ep);
++		dev->out_ep = NULL;
++	}
++	dev->config = 0;
++	del_timer (&dev->resume);
++}
++
++#define _write(f, buf, sz) (f->f_op->write(f, buf, sz, &f->f_pos))
++
++static void
++zero_isoc_complete (struct usb_ep *ep, struct usb_request *req)
++{
++	struct zero_dev	*dev = ep->driver_data;
++	int		status = req->status;
++	int i, j;
++
++	switch (status) {
++
++	case 0: 			/* normal completion? */
++		//printk ("\nzero ---------------> isoc normal completion %d bytes\n", req->actual);
++		for (i=0, j=rbuf_start; i<req->actual; i++) {
++			//printk ("%02x ", ((__u8*)req->buf)[i]);
++			rbuf[j] = ((__u8*)req->buf)[i];
++			j++;
++			if (j >= RBUF_LEN) j=0;
++		}
++		rbuf_start = j;
++		//printk ("\n\n");
++
++		if (rbuf_len < RBUF_LEN) {
++			rbuf_len += req->actual;
++			if (rbuf_len > RBUF_LEN) {
++				rbuf_len = RBUF_LEN;
++			}
++		}
++
++		break;
++
++	/* this endpoint is normally active while we're configured */
++	case -ECONNABORTED: 		/* hardware forced ep reset */
++	case -ECONNRESET:		/* request dequeued */
++	case -ESHUTDOWN:		/* disconnect from host */
++		VDBG (dev, "%s gone (%d), %d/%d\n", ep->name, status,
++				req->actual, req->length);
++		if (ep == dev->out_ep)
++			check_read_data (dev, ep, req);
++		free_ep_req (ep, req);
++		return;
++
++	case -EOVERFLOW:		/* buffer overrun on read means that
++					 * we didn't provide a big enough
++					 * buffer.
++					 */
++	default:
++#if 1
++		DBG (dev, "%s complete --> %d, %d/%d\n", ep->name,
++				status, req->actual, req->length);
++#endif
++	case -EREMOTEIO:		/* short read */
++		break;
++	}
++
++	status = usb_ep_queue (ep, req, GFP_ATOMIC);
++	if (status) {
++		ERROR (dev, "kill %s:  resubmit %d bytes --> %d\n",
++				ep->name, req->length, status);
++		usb_ep_set_halt (ep);
++		/* FIXME recover later ... somehow */
++	}
++}
++
++static struct usb_request *
++zero_start_isoc_ep (struct usb_ep *ep, int gfp_flags)
++{
++	struct usb_request	*req;
++	int			status;
++
++	req = alloc_ep_req (ep, 512);
++	if (!req)
++		return NULL;
++
++	req->complete = zero_isoc_complete;
++
++	status = usb_ep_queue (ep, req, gfp_flags);
++	if (status) {
++		struct zero_dev	*dev = ep->driver_data;
++
++		ERROR (dev, "start %s --> %d\n", ep->name, status);
++		free_ep_req (ep, req);
++		req = NULL;
++	}
++
++	return req;
++}
++
++/* change our operational config.  this code must agree with the code
++ * that returns config descriptors, and altsetting code.
++ *
++ * it's also responsible for power management interactions. some
++ * configurations might not work with our current power sources.
++ *
++ * note that some device controller hardware will constrain what this
++ * code can do, perhaps by disallowing more than one configuration or
++ * by limiting configuration choices (like the pxa2xx).
++ */
++static int
++zero_set_config (struct zero_dev *dev, unsigned number, int gfp_flags)
++{
++	int			result = 0;
++	struct usb_gadget	*gadget = dev->gadget;
++	const struct usb_endpoint_descriptor	*d;
++	struct usb_ep		*ep;
++
++	if (number == dev->config)
++		return 0;
++
++	zero_reset_config (dev);
++
++	gadget_for_each_ep (ep, gadget) {
++
++		if (strcmp (ep->name, "ep4") == 0) {
++
++			d = (struct usb_endpoint_descripter *)&za_23; // isoc ep desc for audio i/f alt setting 6
++			result = usb_ep_enable (ep, d);
++
++			if (result == 0) {
++				ep->driver_data = dev;
++				dev->in_ep = ep;
++
++				if (zero_start_isoc_ep (ep, gfp_flags) != 0) {
++
++					dev->in_ep = ep;
++					continue;
++				}
++
++				usb_ep_disable (ep);
++				result = -EIO;
++			}
++		}
++
++	}
++
++	dev->config = number;
++	return result;
++}
++
++/*-------------------------------------------------------------------------*/
++
++static void zero_setup_complete (struct usb_ep *ep, struct usb_request *req)
++{
++	if (req->status || req->actual != req->length)
++		DBG ((struct zero_dev *) ep->driver_data,
++				"setup complete --> %d, %d/%d\n",
++				req->status, req->actual, req->length);
++}
++
++/*
++ * The setup() callback implements all the ep0 functionality that's
++ * not handled lower down, in hardware or the hardware driver (like
++ * device and endpoint feature flags, and their status).  It's all
++ * housekeeping for the gadget function we're implementing.  Most of
++ * the work is in config-specific setup.
++ */
++static int
++zero_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
++{
++	struct zero_dev		*dev = get_gadget_data (gadget);
++	struct usb_request	*req = dev->req;
++	int			value = -EOPNOTSUPP;
++
++	/* usually this stores reply data in the pre-allocated ep0 buffer,
++	 * but config change events will reconfigure hardware.
++	 */
++	req->zero = 0;
++	switch (ctrl->bRequest) {
++
++	case USB_REQ_GET_DESCRIPTOR:
++
++		switch (ctrl->wValue >> 8) {
++
++		case USB_DT_DEVICE:
++			value = min (ctrl->wLength, (u16) sizeof device_desc);
++			memcpy (req->buf, &device_desc, value);
++			break;
++#ifdef CONFIG_USB_GADGET_DUALSPEED
++		case USB_DT_DEVICE_QUALIFIER:
++			if (!gadget->is_dualspeed)
++				break;
++			value = min (ctrl->wLength, (u16) sizeof dev_qualifier);
++			memcpy (req->buf, &dev_qualifier, value);
++			break;
++
++		case USB_DT_OTHER_SPEED_CONFIG:
++			if (!gadget->is_dualspeed)
++				break;
++			// FALLTHROUGH
++#endif /* CONFIG_USB_GADGET_DUALSPEED */
++		case USB_DT_CONFIG:
++			value = config_buf (gadget, req->buf,
++					ctrl->wValue >> 8,
++					ctrl->wValue & 0xff);
++			if (value >= 0)
++				value = min (ctrl->wLength, (u16) value);
++			break;
++
++		case USB_DT_STRING:
++			/* wIndex == language code.
++			 * this driver only handles one language, you can
++			 * add string tables for other languages, using
++			 * any UTF-8 characters
++			 */
++			value = usb_gadget_get_string (&stringtab,
++					ctrl->wValue & 0xff, req->buf);
++			if (value >= 0) {
++				value = min (ctrl->wLength, (u16) value);
++			}
++			break;
++		}
++		break;
++
++	/* currently two configs, two speeds */
++	case USB_REQ_SET_CONFIGURATION:
++		if (ctrl->bRequestType != 0)
++			goto unknown;
++
++		spin_lock (&dev->lock);
++		value = zero_set_config (dev, ctrl->wValue, GFP_ATOMIC);
++		spin_unlock (&dev->lock);
++		break;
++	case USB_REQ_GET_CONFIGURATION:
++		if (ctrl->bRequestType != USB_DIR_IN)
++			goto unknown;
++		*(u8 *)req->buf = dev->config;
++		value = min (ctrl->wLength, (u16) 1);
++		break;
++
++	/* until we add altsetting support, or other interfaces,
++	 * only 0/0 are possible.  pxa2xx only supports 0/0 (poorly)
++	 * and already killed pending endpoint I/O.
++	 */
++	case USB_REQ_SET_INTERFACE:
++
++		if (ctrl->bRequestType != USB_RECIP_INTERFACE)
++			goto unknown;
++		spin_lock (&dev->lock);
++		if (dev->config) {
++			u8		config = dev->config;
++
++			/* resets interface configuration, forgets about
++			 * previous transaction state (queued bufs, etc)
++			 * and re-inits endpoint state (toggle etc)
++			 * no response queued, just zero status == success.
++			 * if we had more than one interface we couldn't
++			 * use this "reset the config" shortcut.
++			 */
++			zero_reset_config (dev);
++			zero_set_config (dev, config, GFP_ATOMIC);
++			value = 0;
++		}
++		spin_unlock (&dev->lock);
++		break;
++	case USB_REQ_GET_INTERFACE:
++		if ((ctrl->bRequestType == 0x21) && (ctrl->wIndex == 0x02)) {
++			value = ctrl->wLength;
++			break;
++		}
++		else {
++			if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE))
++				goto unknown;
++			if (!dev->config)
++				break;
++			if (ctrl->wIndex != 0) {
++				value = -EDOM;
++				break;
++			}
++			*(u8 *)req->buf = 0;
++			value = min (ctrl->wLength, (u16) 1);
++		}
++		break;
++
++	/*
++	 * These are the same vendor-specific requests supported by
++	 * Intel's USB 2.0 compliance test devices.  We exceed that
++	 * device spec by allowing multiple-packet requests.
++	 */
++	case 0x5b:	/* control WRITE test -- fill the buffer */
++		if (ctrl->bRequestType != (USB_DIR_OUT|USB_TYPE_VENDOR))
++			goto unknown;
++		if (ctrl->wValue || ctrl->wIndex)
++			break;
++		/* just read that many bytes into the buffer */
++		if (ctrl->wLength > USB_BUFSIZ)
++			break;
++		value = ctrl->wLength;
++		break;
++	case 0x5c:	/* control READ test -- return the buffer */
++		if (ctrl->bRequestType != (USB_DIR_IN|USB_TYPE_VENDOR))
++			goto unknown;
++		if (ctrl->wValue || ctrl->wIndex)
++			break;
++		/* expect those bytes are still in the buffer; send back */
++		if (ctrl->wLength > USB_BUFSIZ
++				|| ctrl->wLength != req->length)
++			break;
++		value = ctrl->wLength;
++		break;
++
++	case 0x01: // SET_CUR
++	case 0x02:
++	case 0x03:
++	case 0x04:
++	case 0x05:
++		value = ctrl->wLength;
++		break;
++	case 0x81:
++		switch (ctrl->wValue) {
++		case 0x0201:
++		case 0x0202:
++			((u8*)req->buf)[0] = 0x00;
++			((u8*)req->buf)[1] = 0xe3;
++			break;
++		case 0x0300:
++		case 0x0500:
++			((u8*)req->buf)[0] = 0x00;
++			break;
++		}
++		//((u8*)req->buf)[0] = 0x81;
++		//((u8*)req->buf)[1] = 0x81;
++		value = ctrl->wLength;
++		break;
++	case 0x82:
++		switch (ctrl->wValue) {
++		case 0x0201:
++		case 0x0202:
++			((u8*)req->buf)[0] = 0x00;
++			((u8*)req->buf)[1] = 0xc3;
++			break;
++		case 0x0300:
++		case 0x0500:
++			((u8*)req->buf)[0] = 0x00;
++			break;
++		}
++		//((u8*)req->buf)[0] = 0x82;
++		//((u8*)req->buf)[1] = 0x82;
++		value = ctrl->wLength;
++		break;
++	case 0x83:
++		switch (ctrl->wValue) {
++		case 0x0201:
++		case 0x0202:
++			((u8*)req->buf)[0] = 0x00;
++			((u8*)req->buf)[1] = 0x00;
++			break;
++		case 0x0300:
++			((u8*)req->buf)[0] = 0x60;
++			break;
++		case 0x0500:
++			((u8*)req->buf)[0] = 0x18;
++			break;
++		}
++		//((u8*)req->buf)[0] = 0x83;
++		//((u8*)req->buf)[1] = 0x83;
++		value = ctrl->wLength;
++		break;
++	case 0x84:
++		switch (ctrl->wValue) {
++		case 0x0201:
++		case 0x0202:
++			((u8*)req->buf)[0] = 0x00;
++			((u8*)req->buf)[1] = 0x01;
++			break;
++		case 0x0300:
++		case 0x0500:
++			((u8*)req->buf)[0] = 0x08;
++			break;
++		}
++		//((u8*)req->buf)[0] = 0x84;
++		//((u8*)req->buf)[1] = 0x84;
++		value = ctrl->wLength;
++		break;
++	case 0x85:
++		((u8*)req->buf)[0] = 0x85;
++		((u8*)req->buf)[1] = 0x85;
++		value = ctrl->wLength;
++		break;
++
++
++	default:
++unknown:
++		printk("unknown control req%02x.%02x v%04x i%04x l%d\n",
++			ctrl->bRequestType, ctrl->bRequest,
++			ctrl->wValue, ctrl->wIndex, ctrl->wLength);
++	}
++
++	/* respond with data transfer before status phase? */
++	if (value >= 0) {
++		req->length = value;
++		req->zero = value < ctrl->wLength
++				&& (value % gadget->ep0->maxpacket) == 0;
++		value = usb_ep_queue (gadget->ep0, req, GFP_ATOMIC);
++		if (value < 0) {
++			DBG (dev, "ep_queue < 0 --> %d\n", value);
++			req->status = 0;
++			zero_setup_complete (gadget->ep0, req);
++		}
++	}
++
++	/* device either stalls (value < 0) or reports success */
++	return value;
++}
++
++static void
++zero_disconnect (struct usb_gadget *gadget)
++{
++	struct zero_dev		*dev = get_gadget_data (gadget);
++	unsigned long		flags;
++
++	spin_lock_irqsave (&dev->lock, flags);
++	zero_reset_config (dev);
++
++	/* a more significant application might have some non-usb
++	 * activities to quiesce here, saving resources like power
++	 * or pushing the notification up a network stack.
++	 */
++	spin_unlock_irqrestore (&dev->lock, flags);
++
++	/* next we may get setup() calls to enumerate new connections;
++	 * or an unbind() during shutdown (including removing module).
++	 */
++}
++
++static void
++zero_autoresume (unsigned long _dev)
++{
++	struct zero_dev	*dev = (struct zero_dev *) _dev;
++	int		status;
++
++	/* normally the host would be woken up for something
++	 * more significant than just a timer firing...
++	 */
++	if (dev->gadget->speed != USB_SPEED_UNKNOWN) {
++		status = usb_gadget_wakeup (dev->gadget);
++		DBG (dev, "wakeup --> %d\n", status);
++	}
++}
++
++/*-------------------------------------------------------------------------*/
++
++static void
++zero_unbind (struct usb_gadget *gadget)
++{
++	struct zero_dev		*dev = get_gadget_data (gadget);
++
++	DBG (dev, "unbind\n");
++
++	/* we've already been disconnected ... no i/o is active */
++	if (dev->req)
++		free_ep_req (gadget->ep0, dev->req);
++	del_timer_sync (&dev->resume);
++	kfree (dev);
++	set_gadget_data (gadget, NULL);
++}
++
++static int
++zero_bind (struct usb_gadget *gadget)
++{
++	struct zero_dev		*dev;
++	//struct usb_ep		*ep;
++
++	printk("binding\n");
++	/*
++	 * DRIVER POLICY CHOICE:  you may want to do this differently.
++	 * One thing to avoid is reusing a bcdDevice revision code
++	 * with different host-visible configurations or behavior
++	 * restrictions -- using ep1in/ep2out vs ep1out/ep3in, etc
++	 */
++	//device_desc.bcdDevice = __constant_cpu_to_le16 (0x0201);
++
++
++	/* ok, we made sense of the hardware ... */
++	dev = kzalloc (sizeof *dev, SLAB_KERNEL);
++	if (!dev)
++		return -ENOMEM;
++	spin_lock_init (&dev->lock);
++	dev->gadget = gadget;
++	set_gadget_data (gadget, dev);
++
++	/* preallocate control response and buffer */
++	dev->req = usb_ep_alloc_request (gadget->ep0, GFP_KERNEL);
++	if (!dev->req)
++		goto enomem;
++	dev->req->buf = usb_ep_alloc_buffer (gadget->ep0, USB_BUFSIZ,
++				&dev->req->dma, GFP_KERNEL);
++	if (!dev->req->buf)
++		goto enomem;
++
++	dev->req->complete = zero_setup_complete;
++
++	device_desc.bMaxPacketSize0 = gadget->ep0->maxpacket;
++
++#ifdef CONFIG_USB_GADGET_DUALSPEED
++	/* assume ep0 uses the same value for both speeds ... */
++	dev_qualifier.bMaxPacketSize0 = device_desc.bMaxPacketSize0;
++
++	/* and that all endpoints are dual-speed */
++	//hs_source_desc.bEndpointAddress = fs_source_desc.bEndpointAddress;
++	//hs_sink_desc.bEndpointAddress = fs_sink_desc.bEndpointAddress;
++#endif
++
++	usb_gadget_set_selfpowered (gadget);
++
++	init_timer (&dev->resume);
++	dev->resume.function = zero_autoresume;
++	dev->resume.data = (unsigned long) dev;
++
++	gadget->ep0->driver_data = dev;
++
++	INFO (dev, "%s, version: " DRIVER_VERSION "\n", longname);
++	INFO (dev, "using %s, OUT %s IN %s\n", gadget->name,
++		EP_OUT_NAME, EP_IN_NAME);
++
++	snprintf (manufacturer, sizeof manufacturer,
++		UTS_SYSNAME " " UTS_RELEASE " with %s",
++		gadget->name);
++
++	return 0;
++
++enomem:
++	zero_unbind (gadget);
++	return -ENOMEM;
++}
++
++/*-------------------------------------------------------------------------*/
++
++static void
++zero_suspend (struct usb_gadget *gadget)
++{
++	struct zero_dev		*dev = get_gadget_data (gadget);
++
++	if (gadget->speed == USB_SPEED_UNKNOWN)
++		return;
++
++	if (autoresume) {
++		mod_timer (&dev->resume, jiffies + (HZ * autoresume));
++		DBG (dev, "suspend, wakeup in %d seconds\n", autoresume);
++	} else
++		DBG (dev, "suspend\n");
++}
++
++static void
++zero_resume (struct usb_gadget *gadget)
++{
++	struct zero_dev		*dev = get_gadget_data (gadget);
++
++	DBG (dev, "resume\n");
++	del_timer (&dev->resume);
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static struct usb_gadget_driver zero_driver = {
++#ifdef CONFIG_USB_GADGET_DUALSPEED
++	.speed		= USB_SPEED_HIGH,
++#else
++	.speed		= USB_SPEED_FULL,
++#endif
++	.function	= (char *) longname,
++	.bind		= zero_bind,
++	.unbind		= zero_unbind,
++
++	.setup		= zero_setup,
++	.disconnect	= zero_disconnect,
++
++	.suspend	= zero_suspend,
++	.resume		= zero_resume,
++
++	.driver 	= {
++		.name		= (char *) shortname,
++		// .shutdown = ...
++		// .suspend = ...
++		// .resume = ...
++	},
++};
++
++MODULE_AUTHOR ("David Brownell");
++MODULE_LICENSE ("Dual BSD/GPL");
++
++static struct proc_dir_entry *pdir, *pfile;
++
++static int isoc_read_data (char *page, char **start,
++			   off_t off, int count,
++			   int *eof, void *data)
++{
++	int i;
++	static int c = 0;
++	static int done = 0;
++	static int s = 0;
++
++/*
++	printk ("\ncount: %d\n", count);
++	printk ("rbuf_start: %d\n", rbuf_start);
++	printk ("rbuf_len: %d\n", rbuf_len);
++	printk ("off: %d\n", off);
++	printk ("start: %p\n\n", *start);
++*/
++	if (done) {
++		c = 0;
++		done = 0;
++		*eof = 1;
++		return 0;
++	}
++
++	if (c == 0) {
++		if (rbuf_len == RBUF_LEN)
++			s = rbuf_start;
++		else s = 0;
++	}
++
++	for (i=0; i<count && c<rbuf_len; i++, c++) {
++		page[i] = rbuf[(c+s) % RBUF_LEN];
++	}
++	*start = page;
++
++	if (c >= rbuf_len) {
++		*eof = 1;
++		done = 1;
++	}
++
++
++	return i;
++}
++
++static int __init init (void)
++{
++
++	int retval = 0;
++
++	pdir = proc_mkdir("isoc_test", NULL);
++	if(pdir == NULL) {
++		retval = -ENOMEM;
++		printk("Error creating dir\n");
++		goto done;
++	}
++	pdir->owner = THIS_MODULE;
++
++	pfile = create_proc_read_entry("isoc_data",
++				       0444, pdir,
++				       isoc_read_data,
++				       NULL);
++	if (pfile == NULL) {
++		retval = -ENOMEM;
++		printk("Error creating file\n");
++		goto no_file;
++	}
++	pfile->owner = THIS_MODULE;
++
++	return usb_gadget_register_driver (&zero_driver);
++
++ no_file:
++	remove_proc_entry("isoc_data", NULL);
++ done:
++	return retval;
++}
++module_init (init);
++
++static void __exit cleanup (void)
++{
++
++	usb_gadget_unregister_driver (&zero_driver);
++
++	remove_proc_entry("isoc_data", pdir);
++	remove_proc_entry("isoc_test", NULL);
++}
++module_exit (cleanup);
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_cfi_common.h
+@@ -0,0 +1,142 @@
++/* ==========================================================================
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++#if !defined(__DWC_CFI_COMMON_H__)
++#define __DWC_CFI_COMMON_H__
++
++//#include <linux/types.h>
++
++/**
++ * @file
++ *
++ * This file contains the CFI specific common constants, interfaces
++ * (functions and macros) and structures for Linux. No PCD specific
++ * data structure or definition is to be included in this file.
++ *
++ */
++
++/** This is a request for all Core Features */
++#define VEN_CORE_GET_FEATURES		0xB1
++
++/** This is a request to get the value of a specific Core Feature */
++#define VEN_CORE_GET_FEATURE		0xB2
++
++/** This command allows the host to set the value of a specific Core Feature */
++#define VEN_CORE_SET_FEATURE		0xB3
++
++/** This command allows the host to set the default values of
++ * either all or any specific Core Feature
++ */
++#define VEN_CORE_RESET_FEATURES		0xB4
++
++/** This command forces the PCD to write the deferred values of a Core Features */
++#define VEN_CORE_ACTIVATE_FEATURES	0xB5
++
++/** This request reads a DWORD value from a register at the specified offset */
++#define VEN_CORE_READ_REGISTER		0xB6
++
++/** This request writes a DWORD value into a register at the specified offset */
++#define VEN_CORE_WRITE_REGISTER		0xB7
++
++/** This structure is the header of the Core Features dataset returned to
++ *  the Host
++ */
++struct cfi_all_features_header {
++/** The features header structure length is */
++#define CFI_ALL_FEATURES_HDR_LEN		8
++	/**
++	 * The total length of the features dataset returned to the Host
++	 */
++	uint16_t wTotalLen;
++
++	/**
++	 * CFI version number inBinary-Coded Decimal (i.e., 1.00 is 100H).
++	 * This field identifies the version of the CFI Specification with which
++	 * the device is compliant.
++	 */
++	uint16_t wVersion;
++
++	/** The ID of the Core */
++	uint16_t wCoreID;
++#define CFI_CORE_ID_UDC		1
++#define CFI_CORE_ID_OTG		2
++#define CFI_CORE_ID_WUDEV	3
++
++	/** Number of features returned by VEN_CORE_GET_FEATURES request */
++	uint16_t wNumFeatures;
++} UPACKED;
++
++typedef struct cfi_all_features_header cfi_all_features_header_t;
++
++/** This structure is a header of the Core Feature descriptor dataset returned to
++ *  the Host after the VEN_CORE_GET_FEATURES request
++ */
++struct cfi_feature_desc_header {
++#define CFI_FEATURE_DESC_HDR_LEN	8
++
++	/** The feature ID */
++	uint16_t wFeatureID;
++
++	/** Length of this feature descriptor in bytes - including the
++	 * length of the feature name string
++	 */
++	uint16_t wLength;
++
++	/** The data length of this feature in bytes */
++	uint16_t wDataLength;
++
++	/**
++	 * Attributes of this features
++	 * D0: Access rights
++	 * 0 - Read/Write
++	 * 1 - Read only
++	 */
++	uint8_t bmAttributes;
++#define CFI_FEATURE_ATTR_RO		1
++#define CFI_FEATURE_ATTR_RW		0
++
++	/** Length of the feature name in bytes */
++	uint8_t bNameLen;
++
++	/** The feature name buffer */
++	//uint8_t *name;
++} UPACKED;
++
++typedef struct cfi_feature_desc_header cfi_feature_desc_header_t;
++
++/**
++ * This structure describes a NULL terminated string referenced by its id field.
++ * It is very similar to usb_string structure but has the id field type set to 16-bit.
++ */
++struct cfi_string {
++	uint16_t id;
++	const uint8_t *s;
++};
++typedef struct cfi_string cfi_string_t;
++
++#endif
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_adp.c
+@@ -0,0 +1,854 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_adp.c $
++ * $Revision: #12 $
++ * $Date: 2011/10/26 $
++ * $Change: 1873028 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++#include "dwc_os.h"
++#include "dwc_otg_regs.h"
++#include "dwc_otg_cil.h"
++#include "dwc_otg_adp.h"
++
++/** @file
++ *
++ * This file contains the most of the Attach Detect Protocol implementation for
++ * the driver to support OTG Rev2.0.
++ *
++ */
++
++void dwc_otg_adp_write_reg(dwc_otg_core_if_t * core_if, uint32_t value)
++{
++	adpctl_data_t adpctl;
++
++	adpctl.d32 = value;
++	adpctl.b.ar = 0x2;
++
++	DWC_WRITE_REG32(&core_if->core_global_regs->adpctl, adpctl.d32);
++
++	while (adpctl.b.ar) {
++		adpctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->adpctl);
++	}
++
++}
++
++/**
++ * Function is called to read ADP registers
++ */
++uint32_t dwc_otg_adp_read_reg(dwc_otg_core_if_t * core_if)
++{
++	adpctl_data_t adpctl;
++
++	adpctl.d32 = 0;
++	adpctl.b.ar = 0x1;
++
++	DWC_WRITE_REG32(&core_if->core_global_regs->adpctl, adpctl.d32);
++
++	while (adpctl.b.ar) {
++		adpctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->adpctl);
++	}
++
++	return adpctl.d32;
++}
++
++/**
++ * Function is called to read ADPCTL register and filter Write-clear bits
++ */
++uint32_t dwc_otg_adp_read_reg_filter(dwc_otg_core_if_t * core_if)
++{
++	adpctl_data_t adpctl;
++
++	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
++	adpctl.b.adp_tmout_int = 0;
++	adpctl.b.adp_prb_int = 0;
++	adpctl.b.adp_tmout_int = 0;
++
++	return adpctl.d32;
++}
++
++/**
++ * Function is called to write ADP registers
++ */
++void dwc_otg_adp_modify_reg(dwc_otg_core_if_t * core_if, uint32_t clr,
++			    uint32_t set)
++{
++	dwc_otg_adp_write_reg(core_if,
++			      (dwc_otg_adp_read_reg(core_if) & (~clr)) | set);
++}
++
++static void adp_sense_timeout(void *ptr)
++{
++	dwc_otg_core_if_t *core_if = (dwc_otg_core_if_t *) ptr;
++	core_if->adp.sense_timer_started = 0;
++	DWC_PRINTF("ADP SENSE TIMEOUT\n");
++	if (core_if->adp_enable) {
++		dwc_otg_adp_sense_stop(core_if);
++		dwc_otg_adp_probe_start(core_if);
++	}
++}
++
++/**
++ * This function is called when the ADP vbus timer expires. Timeout is 1.1s.
++ */
++static void adp_vbuson_timeout(void *ptr)
++{
++	gpwrdn_data_t gpwrdn;
++	dwc_otg_core_if_t *core_if = (dwc_otg_core_if_t *) ptr;
++	hprt0_data_t hprt0 = {.d32 = 0 };
++	pcgcctl_data_t pcgcctl = {.d32 = 0 };
++	DWC_PRINTF("%s: 1.1 seconds expire after turning on VBUS\n",__FUNCTION__);
++	if (core_if) {
++		core_if->adp.vbuson_timer_started = 0;
++		/* Turn off vbus */
++		hprt0.b.prtpwr = 1;
++		DWC_MODIFY_REG32(core_if->host_if->hprt0, hprt0.d32, 0);
++		gpwrdn.d32 = 0;
++
++		/* Power off the core */
++		if (core_if->power_down == 2) {
++			/* Enable Wakeup Logic */
++//                      gpwrdn.b.wkupactiv = 1;
++			gpwrdn.b.pmuactv = 0;
++			gpwrdn.b.pwrdnrstn = 1;
++			gpwrdn.b.pwrdnclmp = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0,
++					 gpwrdn.d32);
++
++			/* Suspend the Phy Clock */
++			pcgcctl.b.stoppclk = 1;
++			DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
++
++			/* Switch on VDD */
++//                      gpwrdn.b.wkupactiv = 1;
++			gpwrdn.b.pmuactv = 1;
++			gpwrdn.b.pwrdnrstn = 1;
++			gpwrdn.b.pwrdnclmp = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0,
++					 gpwrdn.d32);
++		} else {
++			/* Enable Power Down Logic */
++			gpwrdn.b.pmuintsel = 1;
++			gpwrdn.b.pmuactv = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++		}
++
++		/* Power off the core */
++		if (core_if->power_down == 2) {
++			gpwrdn.d32 = 0;
++			gpwrdn.b.pwrdnswtch = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn,
++					 gpwrdn.d32, 0);
++		}
++
++		/* Unmask SRP detected interrupt from Power Down Logic */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.srp_det_msk = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++
++		dwc_otg_adp_probe_start(core_if);
++		dwc_otg_dump_global_registers(core_if);
++		dwc_otg_dump_host_registers(core_if);
++	}
++
++}
++
++/**
++ * Start the ADP Initial Probe timer to detect if Port Connected interrupt is
++ * not asserted within 1.1 seconds.
++ *
++ * @param core_if the pointer to core_if strucure.
++ */
++void dwc_otg_adp_vbuson_timer_start(dwc_otg_core_if_t * core_if)
++{
++	core_if->adp.vbuson_timer_started = 1;
++	if (core_if->adp.vbuson_timer)
++	{
++		DWC_PRINTF("SCHEDULING VBUSON TIMER\n");
++		/* 1.1 secs + 60ms necessary for cil_hcd_start*/
++		DWC_TIMER_SCHEDULE(core_if->adp.vbuson_timer, 1160);
++	} else {
++		DWC_WARN("VBUSON_TIMER = %p\n",core_if->adp.vbuson_timer);
++	}
++}
++
++#if 0
++/**
++ * Masks all DWC OTG core interrupts
++ *
++ */
++static void mask_all_interrupts(dwc_otg_core_if_t * core_if)
++{
++	int i;
++	gahbcfg_data_t ahbcfg = {.d32 = 0 };
++
++	/* Mask Host Interrupts */
++
++	/* Clear and disable HCINTs */
++	for (i = 0; i < core_if->core_params->host_channels; i++) {
++		DWC_WRITE_REG32(&core_if->host_if->hc_regs[i]->hcintmsk, 0);
++		DWC_WRITE_REG32(&core_if->host_if->hc_regs[i]->hcint, 0xFFFFFFFF);
++
++	}
++
++	/* Clear and disable HAINT */
++	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->haintmsk, 0x0000);
++	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->haint, 0xFFFFFFFF);
++
++	/* Mask Device Interrupts */
++	if (!core_if->multiproc_int_enable) {
++		/* Clear and disable IN Endpoint interrupts */
++		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->diepmsk, 0);
++		for (i = 0; i <= core_if->dev_if->num_in_eps; i++) {
++			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[i]->
++					diepint, 0xFFFFFFFF);
++		}
++
++		/* Clear and disable OUT Endpoint interrupts */
++		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->doepmsk, 0);
++		for (i = 0; i <= core_if->dev_if->num_out_eps; i++) {
++			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[i]->
++					doepint, 0xFFFFFFFF);
++		}
++
++		/* Clear and disable DAINT */
++		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->daint,
++				0xFFFFFFFF);
++		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->daintmsk, 0);
++	} else {
++		for (i = 0; i < core_if->dev_if->num_in_eps; ++i) {
++			DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->
++					diepeachintmsk[i], 0);
++			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[i]->
++					diepint, 0xFFFFFFFF);
++		}
++
++		for (i = 0; i < core_if->dev_if->num_out_eps; ++i) {
++			DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->
++					doepeachintmsk[i], 0);
++			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[i]->
++					doepint, 0xFFFFFFFF);
++		}
++
++		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->deachintmsk,
++				0);
++		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->deachint,
++				0xFFFFFFFF);
++
++	}
++
++	/* Disable interrupts */
++	ahbcfg.b.glblintrmsk = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gahbcfg, ahbcfg.d32, 0);
++
++	/* Disable all interrupts. */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, 0);
++
++	/* Clear any pending interrupts */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
++
++	/* Clear any pending OTG Interrupts */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gotgint, 0xFFFFFFFF);
++}
++
++/**
++ * Unmask Port Connection Detected interrupt
++ *
++ */
++static void unmask_conn_det_intr(dwc_otg_core_if_t * core_if)
++{
++	gintmsk_data_t gintmsk = {.d32 = 0,.b.portintr = 1 };
++
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, gintmsk.d32);
++}
++#endif
++
++/**
++ * Starts the ADP Probing
++ *
++ * @param core_if the pointer to core_if structure.
++ */
++uint32_t dwc_otg_adp_probe_start(dwc_otg_core_if_t * core_if)
++{
++
++	adpctl_data_t adpctl = {.d32 = 0};
++	gpwrdn_data_t gpwrdn;
++#if 0
++	adpctl_data_t adpctl_int = {.d32 = 0, .b.adp_prb_int = 1,
++								.b.adp_sns_int = 1, b.adp_tmout_int};
++#endif
++	dwc_otg_disable_global_interrupts(core_if);
++	DWC_PRINTF("ADP Probe Start\n");
++	core_if->adp.probe_enabled = 1;
++
++	adpctl.b.adpres = 1;
++	dwc_otg_adp_write_reg(core_if, adpctl.d32);
++
++	while (adpctl.b.adpres) {
++		adpctl.d32 = dwc_otg_adp_read_reg(core_if);
++	}
++
++	adpctl.d32 = 0;
++	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++
++	/* In Host mode unmask SRP detected interrupt */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.sts_chngint_msk = 1;
++	if (!gpwrdn.b.idsts) {
++		gpwrdn.b.srp_det_msk = 1;
++	}
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++
++	adpctl.b.adp_tmout_int_msk = 1;
++	adpctl.b.adp_prb_int_msk = 1;
++	adpctl.b.prb_dschg = 1;
++	adpctl.b.prb_delta = 1;
++	adpctl.b.prb_per = 1;
++	adpctl.b.adpen = 1;
++	adpctl.b.enaprb = 1;
++
++	dwc_otg_adp_write_reg(core_if, adpctl.d32);
++	DWC_PRINTF("ADP Probe Finish\n");
++	return 0;
++}
++
++/**
++ * Starts the ADP Sense timer to detect if ADP Sense interrupt is not asserted
++ * within 3 seconds.
++ *
++ * @param core_if the pointer to core_if strucure.
++ */
++void dwc_otg_adp_sense_timer_start(dwc_otg_core_if_t * core_if)
++{
++	core_if->adp.sense_timer_started = 1;
++	DWC_TIMER_SCHEDULE(core_if->adp.sense_timer, 3000 /* 3 secs */ );
++}
++
++/**
++ * Starts the ADP Sense
++ *
++ * @param core_if the pointer to core_if strucure.
++ */
++uint32_t dwc_otg_adp_sense_start(dwc_otg_core_if_t * core_if)
++{
++	adpctl_data_t adpctl;
++
++	DWC_PRINTF("ADP Sense Start\n");
++
++	/* Unmask ADP sense interrupt and mask all other from the core */
++	adpctl.d32 = dwc_otg_adp_read_reg_filter(core_if);
++	adpctl.b.adp_sns_int_msk = 1;
++	dwc_otg_adp_write_reg(core_if, adpctl.d32);
++	dwc_otg_disable_global_interrupts(core_if); // vahrama
++
++	/* Set ADP reset bit*/
++	adpctl.d32 = dwc_otg_adp_read_reg_filter(core_if);
++	adpctl.b.adpres = 1;
++	dwc_otg_adp_write_reg(core_if, adpctl.d32);
++
++	while (adpctl.b.adpres) {
++		adpctl.d32 = dwc_otg_adp_read_reg(core_if);
++	}
++
++	adpctl.b.adpres = 0;
++	adpctl.b.adpen = 1;
++	adpctl.b.enasns = 1;
++	dwc_otg_adp_write_reg(core_if, adpctl.d32);
++
++	dwc_otg_adp_sense_timer_start(core_if);
++
++	return 0;
++}
++
++/**
++ * Stops the ADP Probing
++ *
++ * @param core_if the pointer to core_if strucure.
++ */
++uint32_t dwc_otg_adp_probe_stop(dwc_otg_core_if_t * core_if)
++{
++
++	adpctl_data_t adpctl;
++	DWC_PRINTF("Stop ADP probe\n");
++	core_if->adp.probe_enabled = 0;
++	core_if->adp.probe_counter = 0;
++	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
++
++	adpctl.b.adpen = 0;
++	adpctl.b.adp_prb_int = 1;
++	adpctl.b.adp_tmout_int = 1;
++	adpctl.b.adp_sns_int = 1;
++	dwc_otg_adp_write_reg(core_if, adpctl.d32);
++
++	return 0;
++}
++
++/**
++ * Stops the ADP Sensing
++ *
++ * @param core_if the pointer to core_if strucure.
++ */
++uint32_t dwc_otg_adp_sense_stop(dwc_otg_core_if_t * core_if)
++{
++	adpctl_data_t adpctl;
++
++	core_if->adp.sense_enabled = 0;
++
++	adpctl.d32 = dwc_otg_adp_read_reg_filter(core_if);
++	adpctl.b.enasns = 0;
++	adpctl.b.adp_sns_int = 1;
++	dwc_otg_adp_write_reg(core_if, adpctl.d32);
++
++	return 0;
++}
++
++/**
++ * Called to turn on the VBUS after initial ADP probe in host mode.
++ * If port power was already enabled in cil_hcd_start function then
++ * only schedule a timer.
++ *
++ * @param core_if the pointer to core_if structure.
++ */
++void dwc_otg_adp_turnon_vbus(dwc_otg_core_if_t * core_if)
++{
++	hprt0_data_t hprt0 = {.d32 = 0 };
++	hprt0.d32 = dwc_otg_read_hprt0(core_if);
++	DWC_PRINTF("Turn on VBUS for 1.1s, port power is %d\n", hprt0.b.prtpwr);
++
++	if (hprt0.b.prtpwr == 0) {
++		hprt0.b.prtpwr = 1;
++		//DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++	}
++
++	dwc_otg_adp_vbuson_timer_start(core_if);
++}
++
++/**
++ * Called right after driver is loaded
++ * to perform initial actions for ADP
++ *
++ * @param core_if the pointer to core_if structure.
++ * @param is_host - flag for current mode of operation either from GINTSTS or GPWRDN
++ */
++void dwc_otg_adp_start(dwc_otg_core_if_t * core_if, uint8_t is_host)
++{
++	gpwrdn_data_t gpwrdn;
++
++	DWC_PRINTF("ADP Initial Start\n");
++	core_if->adp.adp_started = 1;
++
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
++	dwc_otg_disable_global_interrupts(core_if);
++	if (is_host) {
++		DWC_PRINTF("HOST MODE\n");
++		/* Enable Power Down Logic Interrupt*/
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pmuintsel = 1;
++		gpwrdn.b.pmuactv = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++		/* Initialize first ADP probe to obtain Ramp Time value */
++		core_if->adp.initial_probe = 1;
++		dwc_otg_adp_probe_start(core_if);
++	} else {
++		gotgctl_data_t gotgctl;
++		gotgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
++		DWC_PRINTF("DEVICE MODE\n");
++		if (gotgctl.b.bsesvld == 0) {
++			/* Enable Power Down Logic Interrupt*/
++			gpwrdn.d32 = 0;
++			DWC_PRINTF("VBUS is not valid - start ADP probe\n");
++			gpwrdn.b.pmuintsel = 1;
++			gpwrdn.b.pmuactv = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++			core_if->adp.initial_probe = 1;
++			dwc_otg_adp_probe_start(core_if);
++		} else {
++			DWC_PRINTF("VBUS is valid - initialize core as a Device\n");
++			core_if->op_state = B_PERIPHERAL;
++			dwc_otg_core_init(core_if);
++			dwc_otg_enable_global_interrupts(core_if);
++			cil_pcd_start(core_if);
++			dwc_otg_dump_global_registers(core_if);
++			dwc_otg_dump_dev_registers(core_if);
++		}
++	}
++}
++
++void dwc_otg_adp_init(dwc_otg_core_if_t * core_if)
++{
++	core_if->adp.adp_started = 0;
++	core_if->adp.initial_probe = 0;
++	core_if->adp.probe_timer_values[0] = -1;
++	core_if->adp.probe_timer_values[1] = -1;
++	core_if->adp.probe_enabled = 0;
++	core_if->adp.sense_enabled = 0;
++	core_if->adp.sense_timer_started = 0;
++	core_if->adp.vbuson_timer_started = 0;
++	core_if->adp.probe_counter = 0;
++	core_if->adp.gpwrdn = 0;
++	core_if->adp.attached = DWC_OTG_ADP_UNKOWN;
++	/* Initialize timers */
++	core_if->adp.sense_timer =
++	    DWC_TIMER_ALLOC("ADP SENSE TIMER", adp_sense_timeout, core_if);
++	core_if->adp.vbuson_timer =
++	    DWC_TIMER_ALLOC("ADP VBUS ON TIMER", adp_vbuson_timeout, core_if);
++	if (!core_if->adp.sense_timer || !core_if->adp.vbuson_timer)
++	{
++		DWC_ERROR("Could not allocate memory for ADP timers\n");
++	}
++}
++
++void dwc_otg_adp_remove(dwc_otg_core_if_t * core_if)
++{
++	gpwrdn_data_t gpwrdn = { .d32 = 0 };
++	gpwrdn.b.pmuintsel = 1;
++	gpwrdn.b.pmuactv = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	if (core_if->adp.probe_enabled)
++		dwc_otg_adp_probe_stop(core_if);
++	if (core_if->adp.sense_enabled)
++		dwc_otg_adp_sense_stop(core_if);
++	if (core_if->adp.sense_timer_started)
++		DWC_TIMER_CANCEL(core_if->adp.sense_timer);
++	if (core_if->adp.vbuson_timer_started)
++		DWC_TIMER_CANCEL(core_if->adp.vbuson_timer);
++	DWC_TIMER_FREE(core_if->adp.sense_timer);
++	DWC_TIMER_FREE(core_if->adp.vbuson_timer);
++}
++
++/////////////////////////////////////////////////////////////////////
++////////////// ADP Interrupt Handlers ///////////////////////////////
++/////////////////////////////////////////////////////////////////////
++/**
++ * This function sets Ramp Timer values
++ */
++static uint32_t set_timer_value(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	if (core_if->adp.probe_timer_values[0] == -1) {
++		core_if->adp.probe_timer_values[0] = val;
++		core_if->adp.probe_timer_values[1] = -1;
++		return 1;
++	} else {
++		core_if->adp.probe_timer_values[1] =
++		    core_if->adp.probe_timer_values[0];
++		core_if->adp.probe_timer_values[0] = val;
++		return 0;
++	}
++}
++
++/**
++ * This function compares Ramp Timer values
++ */
++static uint32_t compare_timer_values(dwc_otg_core_if_t * core_if)
++{
++	uint32_t diff;
++	if (core_if->adp.probe_timer_values[0]>=core_if->adp.probe_timer_values[1])
++			diff = core_if->adp.probe_timer_values[0]-core_if->adp.probe_timer_values[1];
++	else
++			diff = core_if->adp.probe_timer_values[1]-core_if->adp.probe_timer_values[0];
++	if(diff < 2) {
++		return 0;
++	} else {
++		return 1;
++	}
++}
++
++/**
++ * This function handles ADP Probe Interrupts
++ */
++static int32_t dwc_otg_adp_handle_prb_intr(dwc_otg_core_if_t * core_if,
++						 uint32_t val)
++{
++	adpctl_data_t adpctl = {.d32 = 0 };
++	gpwrdn_data_t gpwrdn, temp;
++	adpctl.d32 = val;
++
++	temp.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++	core_if->adp.probe_counter++;
++	core_if->adp.gpwrdn = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++	if (adpctl.b.rtim == 0 && !temp.b.idsts){
++		DWC_PRINTF("RTIM value is 0\n");
++		goto exit;
++	}
++	if (set_timer_value(core_if, adpctl.b.rtim) &&
++	    core_if->adp.initial_probe) {
++		core_if->adp.initial_probe = 0;
++		dwc_otg_adp_probe_stop(core_if);
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pmuactv = 1;
++		gpwrdn.b.pmuintsel = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++		DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
++
++		/* check which value is for device mode and which for Host mode */
++		if (!temp.b.idsts) {	/* considered host mode value is 0 */
++			/*
++			 * Turn on VBUS after initial ADP probe.
++			 */
++			core_if->op_state = A_HOST;
++			dwc_otg_enable_global_interrupts(core_if);
++			DWC_SPINUNLOCK(core_if->lock);
++			cil_hcd_start(core_if);
++			dwc_otg_adp_turnon_vbus(core_if);
++			DWC_SPINLOCK(core_if->lock);
++		} else {
++			/*
++			 * Initiate SRP after initial ADP probe.
++			 */
++			dwc_otg_enable_global_interrupts(core_if);
++			dwc_otg_initiate_srp(core_if);
++		}
++	} else if (core_if->adp.probe_counter > 2){
++		gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++		if (compare_timer_values(core_if)) {
++			DWC_PRINTF("Difference in timer values !!! \n");
++//                      core_if->adp.attached = DWC_OTG_ADP_ATTACHED;
++			dwc_otg_adp_probe_stop(core_if);
++
++			/* Power on the core */
++			if (core_if->power_down == 2) {
++				gpwrdn.b.pwrdnswtch = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++			}
++
++			/* check which value is for device mode and which for Host mode */
++			if (!temp.b.idsts) {	/* considered host mode value is 0 */
++				/* Disable Interrupt from Power Down Logic */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pmuintsel = 1;
++				gpwrdn.b.pmuactv = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, gpwrdn.d32, 0);
++
++				/*
++				 * Initialize the Core for Host mode.
++				 */
++				core_if->op_state = A_HOST;
++				dwc_otg_core_init(core_if);
++				dwc_otg_enable_global_interrupts(core_if);
++				cil_hcd_start(core_if);
++			} else {
++				gotgctl_data_t gotgctl;
++				/* Mask SRP detected interrupt from Power Down Logic */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.srp_det_msk = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, gpwrdn.d32, 0);
++
++				/* Disable Power Down Logic */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pmuintsel = 1;
++				gpwrdn.b.pmuactv = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, gpwrdn.d32, 0);
++
++				/*
++				 * Initialize the Core for Device mode.
++				 */
++				core_if->op_state = B_PERIPHERAL;
++				dwc_otg_core_init(core_if);
++				dwc_otg_enable_global_interrupts(core_if);
++				cil_pcd_start(core_if);
++
++				gotgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
++				if (!gotgctl.b.bsesvld) {
++					dwc_otg_initiate_srp(core_if);
++				}
++			}
++		}
++		if (core_if->power_down == 2) {
++			if (gpwrdn.b.bsessvld) {
++				/* Mask SRP detected interrupt from Power Down Logic */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.srp_det_msk = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++				/* Disable Power Down Logic */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pmuactv = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++				/*
++				 * Initialize the Core for Device mode.
++				 */
++				core_if->op_state = B_PERIPHERAL;
++				dwc_otg_core_init(core_if);
++				dwc_otg_enable_global_interrupts(core_if);
++				cil_pcd_start(core_if);
++			}
++		}
++	}
++exit:
++	/* Clear interrupt */
++	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
++	adpctl.b.adp_prb_int = 1;
++	dwc_otg_adp_write_reg(core_if, adpctl.d32);
++
++	return 0;
++}
++
++/**
++ * This function hadles ADP Sense Interrupt
++ */
++static int32_t dwc_otg_adp_handle_sns_intr(dwc_otg_core_if_t * core_if)
++{
++	adpctl_data_t adpctl;
++	/* Stop ADP Sense timer */
++	DWC_TIMER_CANCEL(core_if->adp.sense_timer);
++
++	/* Restart ADP Sense timer */
++	dwc_otg_adp_sense_timer_start(core_if);
++
++	/* Clear interrupt */
++	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
++	adpctl.b.adp_sns_int = 1;
++	dwc_otg_adp_write_reg(core_if, adpctl.d32);
++
++	return 0;
++}
++
++/**
++ * This function handles ADP Probe Interrupts
++ */
++static int32_t dwc_otg_adp_handle_prb_tmout_intr(dwc_otg_core_if_t * core_if,
++						 uint32_t val)
++{
++	adpctl_data_t adpctl = {.d32 = 0 };
++	adpctl.d32 = val;
++	set_timer_value(core_if, adpctl.b.rtim);
++
++	/* Clear interrupt */
++	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
++	adpctl.b.adp_tmout_int = 1;
++	dwc_otg_adp_write_reg(core_if, adpctl.d32);
++
++	return 0;
++}
++
++/**
++ * ADP Interrupt handler.
++ *
++ */
++int32_t dwc_otg_adp_handle_intr(dwc_otg_core_if_t * core_if)
++{
++	int retval = 0;
++	adpctl_data_t adpctl = {.d32 = 0};
++
++	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
++	DWC_PRINTF("ADPCTL = %08x\n",adpctl.d32);
++
++	if (adpctl.b.adp_sns_int & adpctl.b.adp_sns_int_msk) {
++		DWC_PRINTF("ADP Sense interrupt\n");
++		retval |= dwc_otg_adp_handle_sns_intr(core_if);
++	}
++	if (adpctl.b.adp_tmout_int & adpctl.b.adp_tmout_int_msk) {
++		DWC_PRINTF("ADP timeout interrupt\n");
++		retval |= dwc_otg_adp_handle_prb_tmout_intr(core_if, adpctl.d32);
++	}
++	if (adpctl.b.adp_prb_int & adpctl.b.adp_prb_int_msk) {
++		DWC_PRINTF("ADP Probe interrupt\n");
++		adpctl.b.adp_prb_int = 1;
++		retval |= dwc_otg_adp_handle_prb_intr(core_if, adpctl.d32);
++	}
++
++//	dwc_otg_adp_modify_reg(core_if, adpctl.d32, 0);
++	//dwc_otg_adp_write_reg(core_if, adpctl.d32);
++	DWC_PRINTF("RETURN FROM ADP ISR\n");
++
++	return retval;
++}
++
++/**
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++int32_t dwc_otg_adp_handle_srp_intr(dwc_otg_core_if_t * core_if)
++{
++
++#ifndef DWC_HOST_ONLY
++	hprt0_data_t hprt0;
++	gpwrdn_data_t gpwrdn;
++	DWC_DEBUGPL(DBG_ANY, "++ Power Down Logic Session Request Interrupt++\n");
++
++	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++	/* check which value is for device mode and which for Host mode */
++	if (!gpwrdn.b.idsts) {	/* considered host mode value is 0 */
++		DWC_PRINTF("SRP: Host mode\n");
++
++		if (core_if->adp_enable) {
++			dwc_otg_adp_probe_stop(core_if);
++
++			/* Power on the core */
++			if (core_if->power_down == 2) {
++				gpwrdn.b.pwrdnswtch = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++			}
++
++			core_if->op_state = A_HOST;
++			dwc_otg_core_init(core_if);
++			dwc_otg_enable_global_interrupts(core_if);
++			cil_hcd_start(core_if);
++		}
++
++		/* Turn on the port power bit. */
++		hprt0.d32 = dwc_otg_read_hprt0(core_if);
++		hprt0.b.prtpwr = 1;
++		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++
++		/* Start the Connection timer. So a message can be displayed
++		 * if connect does not occur within 10 seconds. */
++		cil_hcd_session_start(core_if);
++	} else {
++		DWC_PRINTF("SRP: Device mode %s\n", __FUNCTION__);
++		if (core_if->adp_enable) {
++			dwc_otg_adp_probe_stop(core_if);
++
++			/* Power on the core */
++			if (core_if->power_down == 2) {
++				gpwrdn.b.pwrdnswtch = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++			}
++
++			gpwrdn.d32 = 0;
++			gpwrdn.b.pmuactv = 0;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0,
++					 gpwrdn.d32);
++
++			core_if->op_state = B_PERIPHERAL;
++			dwc_otg_core_init(core_if);
++			dwc_otg_enable_global_interrupts(core_if);
++			cil_pcd_start(core_if);
++		}
++	}
++#endif
++	return 1;
++}
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_adp.h
+@@ -0,0 +1,80 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_adp.h $
++ * $Revision: #7 $
++ * $Date: 2011/10/24 $
++ * $Change: 1871159 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++#ifndef __DWC_OTG_ADP_H__
++#define __DWC_OTG_ADP_H__
++
++/**
++ * @file
++ *
++ * This file contains the Attach Detect Protocol interfaces and defines
++ * (functions) and structures for Linux.
++ *
++ */
++
++#define DWC_OTG_ADP_UNATTACHED	0
++#define DWC_OTG_ADP_ATTACHED	1
++#define DWC_OTG_ADP_UNKOWN	2
++
++typedef struct dwc_otg_adp {
++	uint32_t adp_started;
++	uint32_t initial_probe;
++	int32_t probe_timer_values[2];
++	uint32_t probe_enabled;
++	uint32_t sense_enabled;
++	dwc_timer_t *sense_timer;
++	uint32_t sense_timer_started;
++	dwc_timer_t *vbuson_timer;
++	uint32_t vbuson_timer_started;
++	uint32_t attached;
++	uint32_t probe_counter;
++	uint32_t gpwrdn;
++} dwc_otg_adp_t;
++
++/**
++ * Attach Detect Protocol functions
++ */
++
++extern void dwc_otg_adp_write_reg(dwc_otg_core_if_t * core_if, uint32_t value);
++extern uint32_t dwc_otg_adp_read_reg(dwc_otg_core_if_t * core_if);
++extern uint32_t dwc_otg_adp_probe_start(dwc_otg_core_if_t * core_if);
++extern uint32_t dwc_otg_adp_sense_start(dwc_otg_core_if_t * core_if);
++extern uint32_t dwc_otg_adp_probe_stop(dwc_otg_core_if_t * core_if);
++extern uint32_t dwc_otg_adp_sense_stop(dwc_otg_core_if_t * core_if);
++extern void dwc_otg_adp_start(dwc_otg_core_if_t * core_if, uint8_t is_host);
++extern void dwc_otg_adp_init(dwc_otg_core_if_t * core_if);
++extern void dwc_otg_adp_remove(dwc_otg_core_if_t * core_if);
++extern int32_t dwc_otg_adp_handle_intr(dwc_otg_core_if_t * core_if);
++extern int32_t dwc_otg_adp_handle_srp_intr(dwc_otg_core_if_t * core_if);
++
++#endif //__DWC_OTG_ADP_H__
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_attr.c
+@@ -0,0 +1,1212 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_attr.c $
++ * $Revision: #44 $
++ * $Date: 2010/11/29 $
++ * $Change: 1636033 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++/** @file
++ *
++ * The diagnostic interface will provide access to the controller for
++ * bringing up the hardware and testing.  The Linux driver attributes
++ * feature will be used to provide the Linux Diagnostic
++ * Interface. These attributes are accessed through sysfs.
++ */
++
++/** @page "Linux Module Attributes"
++ *
++ * The Linux module attributes feature is used to provide the Linux
++ * Diagnostic Interface.  These attributes are accessed through sysfs.
++ * The diagnostic interface will provide access to the controller for
++ * bringing up the hardware and testing.
++
++ The following table shows the attributes.
++ <table>
++ <tr>
++ <td><b> Name</b></td>
++ <td><b> Description</b></td>
++ <td><b> Access</b></td>
++ </tr>
++
++ <tr>
++ <td> mode </td>
++ <td> Returns the current mode: 0 for device mode, 1 for host mode</td>
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> hnpcapable </td>
++ <td> Gets or sets the "HNP-capable" bit in the Core USB Configuraton Register.
++ Read returns the current value.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> srpcapable </td>
++ <td> Gets or sets the "SRP-capable" bit in the Core USB Configuraton Register.
++ Read returns the current value.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> hsic_connect </td>
++ <td> Gets or sets the "HSIC-Connect" bit in the GLPMCFG Register.
++ Read returns the current value.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> inv_sel_hsic </td>
++ <td> Gets or sets the "Invert Select HSIC" bit in the GLPMFG Register.
++ Read returns the current value.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> hnp </td>
++ <td> Initiates the Host Negotiation Protocol.  Read returns the status.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> srp </td>
++ <td> Initiates the Session Request Protocol.  Read returns the status.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> buspower </td>
++ <td> Gets or sets the Power State of the bus (0 - Off or 1 - On)</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> bussuspend </td>
++ <td> Suspends the USB bus.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> busconnected </td>
++ <td> Gets the connection status of the bus</td>
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> gotgctl </td>
++ <td> Gets or sets the Core Control Status Register.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> gusbcfg </td>
++ <td> Gets or sets the Core USB Configuration Register</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> grxfsiz </td>
++ <td> Gets or sets the Receive FIFO Size Register</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> gnptxfsiz </td>
++ <td> Gets or sets the non-periodic Transmit Size Register</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> gpvndctl </td>
++ <td> Gets or sets the PHY Vendor Control Register</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> ggpio </td>
++ <td> Gets the value in the lower 16-bits of the General Purpose IO Register
++ or sets the upper 16 bits.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> guid </td>
++ <td> Gets or sets the value of the User ID Register</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> gsnpsid </td>
++ <td> Gets the value of the Synopsys ID Regester</td>
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> devspeed </td>
++ <td> Gets or sets the device speed setting in the DCFG register</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> enumspeed </td>
++ <td> Gets the device enumeration Speed.</td>
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> hptxfsiz </td>
++ <td> Gets the value of the Host Periodic Transmit FIFO</td>
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> hprt0 </td>
++ <td> Gets or sets the value in the Host Port Control and Status Register</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> regoffset </td>
++ <td> Sets the register offset for the next Register Access</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> regvalue </td>
++ <td> Gets or sets the value of the register at the offset in the regoffset attribute.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> remote_wakeup </td>
++ <td> On read, shows the status of Remote Wakeup. On write, initiates a remote
++ wakeup of the host. When bit 0 is 1 and Remote Wakeup is enabled, the Remote
++ Wakeup signalling bit in the Device Control Register is set for 1
++ milli-second.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> rem_wakeup_pwrdn </td>
++ <td> On read, shows the status core - hibernated or not. On write, initiates
++ a remote wakeup of the device from Hibernation. </td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> mode_ch_tim_en </td>
++ <td> This bit is used to enable or disable the host core to wait for 200 PHY
++ clock cycles at the end of Resume to change the opmode signal to the PHY to 00
++ after Suspend or LPM. </td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> fr_interval </td>
++ <td> On read, shows the value of HFIR Frame Interval. On write, dynamically
++ reload HFIR register during runtime. The application can write a value to this
++ register only after the Port Enable bit of the Host Port Control and Status
++ register (HPRT.PrtEnaPort) has been set </td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> disconnect_us </td>
++ <td> On read, shows the status of disconnect_device_us. On write, sets disconnect_us
++ which causes soft disconnect for 100us. Applicable only for device mode of operation.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> regdump </td>
++ <td> Dumps the contents of core registers.</td>
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> spramdump </td>
++ <td> Dumps the contents of core registers.</td>
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> hcddump </td>
++ <td> Dumps the current HCD state.</td>
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> hcd_frrem </td>
++ <td> Shows the average value of the Frame Remaining
++ field in the Host Frame Number/Frame Remaining register when an SOF interrupt
++ occurs. This can be used to determine the average interrupt latency. Also
++ shows the average Frame Remaining value for start_transfer and the "a" and
++ "b" sample points. The "a" and "b" sample points may be used during debugging
++ bto determine how long it takes to execute a section of the HCD code.</td>
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> rd_reg_test </td>
++ <td> Displays the time required to read the GNPTXFSIZ register many times
++ (the output shows the number of times the register is read).
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> wr_reg_test </td>
++ <td> Displays the time required to write the GNPTXFSIZ register many times
++ (the output shows the number of times the register is written).
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> lpm_response </td>
++ <td> Gets or sets lpm_response mode. Applicable only in device mode.
++ <td> Write</td>
++ </tr>
++
++ <tr>
++ <td> sleep_status </td>
++ <td> Shows sleep status of device.
++ <td> Read</td>
++ </tr>
++
++ </table>
++
++ Example usage:
++ To get the current mode:
++ cat /sys/devices/lm0/mode
++
++ To power down the USB:
++ echo 0 > /sys/devices/lm0/buspower
++ */
++
++#include "dwc_otg_os_dep.h"
++#include "dwc_os.h"
++#include "dwc_otg_driver.h"
++#include "dwc_otg_attr.h"
++#include "dwc_otg_core_if.h"
++#include "dwc_otg_pcd_if.h"
++#include "dwc_otg_hcd_if.h"
++
++/*
++ * MACROs for defining sysfs attribute
++ */
++#ifdef LM_INTERFACE
++
++#define DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
++{ \
++	struct lm_device *lm_dev = container_of(_dev, struct lm_device, dev); \
++	dwc_otg_device_t *otg_dev = lm_get_drvdata(lm_dev);		\
++	uint32_t val; \
++	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
++	return sprintf (buf, "%s = 0x%x\n", _string_, val); \
++}
++#define DWC_OTG_DEVICE_ATTR_BITFIELD_STORE(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
++					const char *buf, size_t count) \
++{ \
++	struct lm_device *lm_dev = container_of(_dev, struct lm_device, dev); \
++	dwc_otg_device_t *otg_dev = lm_get_drvdata(lm_dev); \
++	uint32_t set = simple_strtoul(buf, NULL, 16); \
++	dwc_otg_set_##_otg_attr_name_(otg_dev->core_if, set);\
++	return count; \
++}
++
++#elif defined(PCI_INTERFACE)
++
++#define DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
++{ \
++	dwc_otg_device_t *otg_dev = dev_get_drvdata(_dev);	\
++	uint32_t val; \
++	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
++	return sprintf (buf, "%s = 0x%x\n", _string_, val); \
++}
++#define DWC_OTG_DEVICE_ATTR_BITFIELD_STORE(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
++					const char *buf, size_t count) \
++{ \
++	dwc_otg_device_t *otg_dev = dev_get_drvdata(_dev);  \
++	uint32_t set = simple_strtoul(buf, NULL, 16); \
++	dwc_otg_set_##_otg_attr_name_(otg_dev->core_if, set);\
++	return count; \
++}
++
++#elif defined(PLATFORM_INTERFACE)
++
++#define DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
++{ \
++        struct platform_device *platform_dev = \
++                container_of(_dev, struct platform_device, dev); \
++        dwc_otg_device_t *otg_dev = platform_get_drvdata(platform_dev);  \
++	uint32_t val; \
++	DWC_PRINTF("%s(%p) -> platform_dev %p, otg_dev %p\n", \
++                    __func__, _dev, platform_dev, otg_dev); \
++	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
++	return sprintf (buf, "%s = 0x%x\n", _string_, val); \
++}
++#define DWC_OTG_DEVICE_ATTR_BITFIELD_STORE(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
++					const char *buf, size_t count) \
++{ \
++        struct platform_device *platform_dev = container_of(_dev, struct platform_device, dev); \
++        dwc_otg_device_t *otg_dev = platform_get_drvdata(platform_dev); \
++	uint32_t set = simple_strtoul(buf, NULL, 16); \
++	dwc_otg_set_##_otg_attr_name_(otg_dev->core_if, set);\
++	return count; \
++}
++#endif
++
++/*
++ * MACROs for defining sysfs attribute for 32-bit registers
++ */
++#ifdef LM_INTERFACE
++#define DWC_OTG_DEVICE_ATTR_REG_SHOW(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
++{ \
++	struct lm_device *lm_dev = container_of(_dev, struct lm_device, dev); \
++	dwc_otg_device_t *otg_dev = lm_get_drvdata(lm_dev); \
++	uint32_t val; \
++	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
++	return sprintf (buf, "%s = 0x%08x\n", _string_, val); \
++}
++#define DWC_OTG_DEVICE_ATTR_REG_STORE(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
++					const char *buf, size_t count) \
++{ \
++	struct lm_device *lm_dev = container_of(_dev, struct lm_device, dev); \
++	dwc_otg_device_t *otg_dev = lm_get_drvdata(lm_dev); \
++	uint32_t val = simple_strtoul(buf, NULL, 16); \
++	dwc_otg_set_##_otg_attr_name_ (otg_dev->core_if, val); \
++	return count; \
++}
++#elif defined(PCI_INTERFACE)
++#define DWC_OTG_DEVICE_ATTR_REG_SHOW(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
++{ \
++	dwc_otg_device_t *otg_dev = dev_get_drvdata(_dev);  \
++	uint32_t val; \
++	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
++	return sprintf (buf, "%s = 0x%08x\n", _string_, val); \
++}
++#define DWC_OTG_DEVICE_ATTR_REG_STORE(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
++					const char *buf, size_t count) \
++{ \
++	dwc_otg_device_t *otg_dev = dev_get_drvdata(_dev);  \
++	uint32_t val = simple_strtoul(buf, NULL, 16); \
++	dwc_otg_set_##_otg_attr_name_ (otg_dev->core_if, val); \
++	return count; \
++}
++
++#elif defined(PLATFORM_INTERFACE)
++#include "dwc_otg_dbg.h"
++#define DWC_OTG_DEVICE_ATTR_REG_SHOW(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
++{ \
++	struct platform_device *platform_dev = container_of(_dev, struct platform_device, dev); \
++	dwc_otg_device_t *otg_dev = platform_get_drvdata(platform_dev); \
++	uint32_t val; \
++	DWC_PRINTF("%s(%p) -> platform_dev %p, otg_dev %p\n", \
++                    __func__, _dev, platform_dev, otg_dev); \
++	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
++	return sprintf (buf, "%s = 0x%08x\n", _string_, val); \
++}
++#define DWC_OTG_DEVICE_ATTR_REG_STORE(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
++					const char *buf, size_t count) \
++{ \
++	struct platform_device *platform_dev = container_of(_dev, struct platform_device, dev); \
++	dwc_otg_device_t *otg_dev = platform_get_drvdata(platform_dev); \
++	uint32_t val = simple_strtoul(buf, NULL, 16); \
++	dwc_otg_set_##_otg_attr_name_ (otg_dev->core_if, val); \
++	return count; \
++}
++
++#endif
++
++#define DWC_OTG_DEVICE_ATTR_BITFIELD_RW(_otg_attr_name_,_string_) \
++DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW(_otg_attr_name_,_string_) \
++DWC_OTG_DEVICE_ATTR_BITFIELD_STORE(_otg_attr_name_,_string_) \
++DEVICE_ATTR(_otg_attr_name_,0644,_otg_attr_name_##_show,_otg_attr_name_##_store);
++
++#define DWC_OTG_DEVICE_ATTR_BITFIELD_RO(_otg_attr_name_,_string_) \
++DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW(_otg_attr_name_,_string_) \
++DEVICE_ATTR(_otg_attr_name_,0444,_otg_attr_name_##_show,NULL);
++
++#define DWC_OTG_DEVICE_ATTR_REG32_RW(_otg_attr_name_,_addr_,_string_) \
++DWC_OTG_DEVICE_ATTR_REG_SHOW(_otg_attr_name_,_string_) \
++DWC_OTG_DEVICE_ATTR_REG_STORE(_otg_attr_name_,_string_) \
++DEVICE_ATTR(_otg_attr_name_,0644,_otg_attr_name_##_show,_otg_attr_name_##_store);
++
++#define DWC_OTG_DEVICE_ATTR_REG32_RO(_otg_attr_name_,_addr_,_string_) \
++DWC_OTG_DEVICE_ATTR_REG_SHOW(_otg_attr_name_,_string_) \
++DEVICE_ATTR(_otg_attr_name_,0444,_otg_attr_name_##_show,NULL);
++
++/** @name Functions for Show/Store of Attributes */
++/**@{*/
++
++/**
++ * Helper function returning the otg_device structure of the given device
++ */
++static dwc_otg_device_t *dwc_otg_drvdev(struct device *_dev)
++{
++        dwc_otg_device_t *otg_dev;
++        DWC_OTG_GETDRVDEV(otg_dev, _dev);
++        return otg_dev;
++}
++
++/**
++ * Show the register offset of the Register Access.
++ */
++static ssize_t regoffset_show(struct device *_dev,
++			      struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	return snprintf(buf, sizeof("0xFFFFFFFF\n") + 1, "0x%08x\n",
++			otg_dev->os_dep.reg_offset);
++}
++
++/**
++ * Set the register offset for the next Register Access 	Read/Write
++ */
++static ssize_t regoffset_store(struct device *_dev,
++			       struct device_attribute *attr,
++			       const char *buf, size_t count)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t offset = simple_strtoul(buf, NULL, 16);
++#if defined(LM_INTERFACE) || defined(PLATFORM_INTERFACE)
++	if (offset < SZ_256K) {
++#elif  defined(PCI_INTERFACE)
++	if (offset < 0x00040000) {
++#endif
++		otg_dev->os_dep.reg_offset = offset;
++	} else {
++		dev_err(_dev, "invalid offset\n");
++	}
++
++	return count;
++}
++
++DEVICE_ATTR(regoffset, S_IRUGO | S_IWUSR, regoffset_show, regoffset_store);
++
++/**
++ * Show the value of the register at the offset in the reg_offset
++ * attribute.
++ */
++static ssize_t regvalue_show(struct device *_dev,
++			     struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t val;
++	volatile uint32_t *addr;
++
++	if (otg_dev->os_dep.reg_offset != 0xFFFFFFFF && 0 != otg_dev->os_dep.base) {
++		/* Calculate the address */
++		addr = (uint32_t *) (otg_dev->os_dep.reg_offset +
++				     (uint8_t *) otg_dev->os_dep.base);
++		val = DWC_READ_REG32(addr);
++		return snprintf(buf,
++				sizeof("Reg@0xFFFFFFFF = 0xFFFFFFFF\n") + 1,
++				"Reg@0x%06x = 0x%08x\n", otg_dev->os_dep.reg_offset,
++				val);
++	} else {
++		dev_err(_dev, "Invalid offset (0x%0x)\n", otg_dev->os_dep.reg_offset);
++		return sprintf(buf, "invalid offset\n");
++	}
++}
++
++/**
++ * Store the value in the register at the offset in the reg_offset
++ * attribute.
++ *
++ */
++static ssize_t regvalue_store(struct device *_dev,
++			      struct device_attribute *attr,
++			      const char *buf, size_t count)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	volatile uint32_t *addr;
++	uint32_t val = simple_strtoul(buf, NULL, 16);
++	//dev_dbg(_dev, "Offset=0x%08x Val=0x%08x\n", otg_dev->reg_offset, val);
++	if (otg_dev->os_dep.reg_offset != 0xFFFFFFFF && 0 != otg_dev->os_dep.base) {
++		/* Calculate the address */
++		addr = (uint32_t *) (otg_dev->os_dep.reg_offset +
++				     (uint8_t *) otg_dev->os_dep.base);
++		DWC_WRITE_REG32(addr, val);
++	} else {
++		dev_err(_dev, "Invalid Register Offset (0x%08x)\n",
++			otg_dev->os_dep.reg_offset);
++	}
++	return count;
++}
++
++DEVICE_ATTR(regvalue, S_IRUGO | S_IWUSR, regvalue_show, regvalue_store);
++
++/*
++ * Attributes
++ */
++DWC_OTG_DEVICE_ATTR_BITFIELD_RO(mode, "Mode");
++DWC_OTG_DEVICE_ATTR_BITFIELD_RW(hnpcapable, "HNPCapable");
++DWC_OTG_DEVICE_ATTR_BITFIELD_RW(srpcapable, "SRPCapable");
++DWC_OTG_DEVICE_ATTR_BITFIELD_RW(hsic_connect, "HSIC Connect");
++DWC_OTG_DEVICE_ATTR_BITFIELD_RW(inv_sel_hsic, "Invert Select HSIC");
++
++//DWC_OTG_DEVICE_ATTR_BITFIELD_RW(buspower,&(otg_dev->core_if->core_global_regs->gotgctl),(1<<8),8,"Mode");
++//DWC_OTG_DEVICE_ATTR_BITFIELD_RW(bussuspend,&(otg_dev->core_if->core_global_regs->gotgctl),(1<<8),8,"Mode");
++DWC_OTG_DEVICE_ATTR_BITFIELD_RO(busconnected, "Bus Connected");
++
++DWC_OTG_DEVICE_ATTR_REG32_RW(gotgctl, 0, "GOTGCTL");
++DWC_OTG_DEVICE_ATTR_REG32_RW(gusbcfg,
++			     &(otg_dev->core_if->core_global_regs->gusbcfg),
++			     "GUSBCFG");
++DWC_OTG_DEVICE_ATTR_REG32_RW(grxfsiz,
++			     &(otg_dev->core_if->core_global_regs->grxfsiz),
++			     "GRXFSIZ");
++DWC_OTG_DEVICE_ATTR_REG32_RW(gnptxfsiz,
++			     &(otg_dev->core_if->core_global_regs->gnptxfsiz),
++			     "GNPTXFSIZ");
++DWC_OTG_DEVICE_ATTR_REG32_RW(gpvndctl,
++			     &(otg_dev->core_if->core_global_regs->gpvndctl),
++			     "GPVNDCTL");
++DWC_OTG_DEVICE_ATTR_REG32_RW(ggpio,
++			     &(otg_dev->core_if->core_global_regs->ggpio),
++			     "GGPIO");
++DWC_OTG_DEVICE_ATTR_REG32_RW(guid, &(otg_dev->core_if->core_global_regs->guid),
++			     "GUID");
++DWC_OTG_DEVICE_ATTR_REG32_RO(gsnpsid,
++			     &(otg_dev->core_if->core_global_regs->gsnpsid),
++			     "GSNPSID");
++DWC_OTG_DEVICE_ATTR_BITFIELD_RW(devspeed, "Device Speed");
++DWC_OTG_DEVICE_ATTR_BITFIELD_RO(enumspeed, "Device Enumeration Speed");
++
++DWC_OTG_DEVICE_ATTR_REG32_RO(hptxfsiz,
++			     &(otg_dev->core_if->core_global_regs->hptxfsiz),
++			     "HPTXFSIZ");
++DWC_OTG_DEVICE_ATTR_REG32_RW(hprt0, otg_dev->core_if->host_if->hprt0, "HPRT0");
++
++/**
++ * @todo Add code to initiate the HNP.
++ */
++/**
++ * Show the HNP status bit
++ */
++static ssize_t hnp_show(struct device *_dev,
++			struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	return sprintf(buf, "HstNegScs = 0x%x\n",
++		       dwc_otg_get_hnpstatus(otg_dev->core_if));
++}
++
++/**
++ * Set the HNP Request bit
++ */
++static ssize_t hnp_store(struct device *_dev,
++			 struct device_attribute *attr,
++			 const char *buf, size_t count)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t in = simple_strtoul(buf, NULL, 16);
++	dwc_otg_set_hnpreq(otg_dev->core_if, in);
++	return count;
++}
++
++DEVICE_ATTR(hnp, 0644, hnp_show, hnp_store);
++
++/**
++ * @todo Add code to initiate the SRP.
++ */
++/**
++ * Show the SRP status bit
++ */
++static ssize_t srp_show(struct device *_dev,
++			struct device_attribute *attr, char *buf)
++{
++#ifndef DWC_HOST_ONLY
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	return sprintf(buf, "SesReqScs = 0x%x\n",
++		       dwc_otg_get_srpstatus(otg_dev->core_if));
++#else
++	return sprintf(buf, "Host Only Mode!\n");
++#endif
++}
++
++/**
++ * Set the SRP Request bit
++ */
++static ssize_t srp_store(struct device *_dev,
++			 struct device_attribute *attr,
++			 const char *buf, size_t count)
++{
++#ifndef DWC_HOST_ONLY
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	dwc_otg_pcd_initiate_srp(otg_dev->pcd);
++#endif
++	return count;
++}
++
++DEVICE_ATTR(srp, 0644, srp_show, srp_store);
++
++/**
++ * @todo Need to do more for power on/off?
++ */
++/**
++ * Show the Bus Power status
++ */
++static ssize_t buspower_show(struct device *_dev,
++			     struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	return sprintf(buf, "Bus Power = 0x%x\n",
++		       dwc_otg_get_prtpower(otg_dev->core_if));
++}
++
++/**
++ * Set the Bus Power status
++ */
++static ssize_t buspower_store(struct device *_dev,
++			      struct device_attribute *attr,
++			      const char *buf, size_t count)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t on = simple_strtoul(buf, NULL, 16);
++	dwc_otg_set_prtpower(otg_dev->core_if, on);
++	return count;
++}
++
++DEVICE_ATTR(buspower, 0644, buspower_show, buspower_store);
++
++/**
++ * @todo Need to do more for suspend?
++ */
++/**
++ * Show the Bus Suspend status
++ */
++static ssize_t bussuspend_show(struct device *_dev,
++			       struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	return sprintf(buf, "Bus Suspend = 0x%x\n",
++		       dwc_otg_get_prtsuspend(otg_dev->core_if));
++}
++
++/**
++ * Set the Bus Suspend status
++ */
++static ssize_t bussuspend_store(struct device *_dev,
++				struct device_attribute *attr,
++				const char *buf, size_t count)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t in = simple_strtoul(buf, NULL, 16);
++	dwc_otg_set_prtsuspend(otg_dev->core_if, in);
++	return count;
++}
++
++DEVICE_ATTR(bussuspend, 0644, bussuspend_show, bussuspend_store);
++
++/**
++ * Show the Mode Change Ready Timer status
++ */
++static ssize_t mode_ch_tim_en_show(struct device *_dev,
++				   struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	return sprintf(buf, "Mode Change Ready Timer Enable = 0x%x\n",
++		       dwc_otg_get_mode_ch_tim(otg_dev->core_if));
++}
++
++/**
++ * Set the Mode Change Ready Timer status
++ */
++static ssize_t mode_ch_tim_en_store(struct device *_dev,
++				    struct device_attribute *attr,
++				    const char *buf, size_t count)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t in = simple_strtoul(buf, NULL, 16);
++	dwc_otg_set_mode_ch_tim(otg_dev->core_if, in);
++	return count;
++}
++
++DEVICE_ATTR(mode_ch_tim_en, 0644, mode_ch_tim_en_show, mode_ch_tim_en_store);
++
++/**
++ * Show the value of HFIR Frame Interval bitfield
++ */
++static ssize_t fr_interval_show(struct device *_dev,
++				struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	return sprintf(buf, "Frame Interval = 0x%x\n",
++		       dwc_otg_get_fr_interval(otg_dev->core_if));
++}
++
++/**
++ * Set the HFIR Frame Interval value
++ */
++static ssize_t fr_interval_store(struct device *_dev,
++				 struct device_attribute *attr,
++				 const char *buf, size_t count)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t in = simple_strtoul(buf, NULL, 10);
++	dwc_otg_set_fr_interval(otg_dev->core_if, in);
++	return count;
++}
++
++DEVICE_ATTR(fr_interval, 0644, fr_interval_show, fr_interval_store);
++
++/**
++ * Show the status of Remote Wakeup.
++ */
++static ssize_t remote_wakeup_show(struct device *_dev,
++				  struct device_attribute *attr, char *buf)
++{
++#ifndef DWC_HOST_ONLY
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++
++	return sprintf(buf,
++		       "Remote Wakeup Sig = %d Enabled = %d LPM Remote Wakeup = %d\n",
++		       dwc_otg_get_remotewakesig(otg_dev->core_if),
++		       dwc_otg_pcd_get_rmwkup_enable(otg_dev->pcd),
++		       dwc_otg_get_lpm_remotewakeenabled(otg_dev->core_if));
++#else
++	return sprintf(buf, "Host Only Mode!\n");
++#endif /* DWC_HOST_ONLY */
++}
++
++/**
++ * Initiate a remote wakeup of the host.  The Device control register
++ * Remote Wakeup Signal bit is written if the PCD Remote wakeup enable
++ * flag is set.
++ *
++ */
++static ssize_t remote_wakeup_store(struct device *_dev,
++				   struct device_attribute *attr,
++				   const char *buf, size_t count)
++{
++#ifndef DWC_HOST_ONLY
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t val = simple_strtoul(buf, NULL, 16);
++
++	if (val & 1) {
++		dwc_otg_pcd_remote_wakeup(otg_dev->pcd, 1);
++	} else {
++		dwc_otg_pcd_remote_wakeup(otg_dev->pcd, 0);
++	}
++#endif /* DWC_HOST_ONLY */
++	return count;
++}
++
++DEVICE_ATTR(remote_wakeup, S_IRUGO | S_IWUSR, remote_wakeup_show,
++	    remote_wakeup_store);
++
++/**
++ * Show the whether core is hibernated or not.
++ */
++static ssize_t rem_wakeup_pwrdn_show(struct device *_dev,
++				     struct device_attribute *attr, char *buf)
++{
++#ifndef DWC_HOST_ONLY
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++
++	if (dwc_otg_get_core_state(otg_dev->core_if)) {
++		DWC_PRINTF("Core is in hibernation\n");
++	} else {
++		DWC_PRINTF("Core is not in hibernation\n");
++	}
++#endif /* DWC_HOST_ONLY */
++	return 0;
++}
++
++extern int dwc_otg_device_hibernation_restore(dwc_otg_core_if_t * core_if,
++					      int rem_wakeup, int reset);
++
++/**
++ * Initiate a remote wakeup of the device to exit from hibernation.
++ */
++static ssize_t rem_wakeup_pwrdn_store(struct device *_dev,
++				      struct device_attribute *attr,
++				      const char *buf, size_t count)
++{
++#ifndef DWC_HOST_ONLY
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	dwc_otg_device_hibernation_restore(otg_dev->core_if, 1, 0);
++#endif
++	return count;
++}
++
++DEVICE_ATTR(rem_wakeup_pwrdn, S_IRUGO | S_IWUSR, rem_wakeup_pwrdn_show,
++	    rem_wakeup_pwrdn_store);
++
++static ssize_t disconnect_us(struct device *_dev,
++			     struct device_attribute *attr,
++			     const char *buf, size_t count)
++{
++
++#ifndef DWC_HOST_ONLY
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t val = simple_strtoul(buf, NULL, 16);
++	DWC_PRINTF("The Passed value is %04x\n", val);
++
++	dwc_otg_pcd_disconnect_us(otg_dev->pcd, 50);
++
++#endif /* DWC_HOST_ONLY */
++	return count;
++}
++
++DEVICE_ATTR(disconnect_us, S_IWUSR, 0, disconnect_us);
++
++/**
++ * Dump global registers and either host or device registers (depending on the
++ * current mode of the core).
++ */
++static ssize_t regdump_show(struct device *_dev,
++			    struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++
++	dwc_otg_dump_global_registers(otg_dev->core_if);
++	if (dwc_otg_is_host_mode(otg_dev->core_if)) {
++		dwc_otg_dump_host_registers(otg_dev->core_if);
++	} else {
++		dwc_otg_dump_dev_registers(otg_dev->core_if);
++
++	}
++	return sprintf(buf, "Register Dump\n");
++}
++
++DEVICE_ATTR(regdump, S_IRUGO, regdump_show, 0);
++
++/**
++ * Dump global registers and either host or device registers (depending on the
++ * current mode of the core).
++ */
++static ssize_t spramdump_show(struct device *_dev,
++			      struct device_attribute *attr, char *buf)
++{
++#if 0
++	dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++
++	dwc_otg_dump_spram(otg_dev->core_if);
++#endif
++
++	return sprintf(buf, "SPRAM Dump\n");
++}
++
++DEVICE_ATTR(spramdump, S_IRUGO, spramdump_show, 0);
++
++/**
++ * Dump the current hcd state.
++ */
++static ssize_t hcddump_show(struct device *_dev,
++			    struct device_attribute *attr, char *buf)
++{
++#ifndef DWC_DEVICE_ONLY
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	dwc_otg_hcd_dump_state(otg_dev->hcd);
++#endif /* DWC_DEVICE_ONLY */
++	return sprintf(buf, "HCD Dump\n");
++}
++
++DEVICE_ATTR(hcddump, S_IRUGO, hcddump_show, 0);
++
++/**
++ * Dump the average frame remaining at SOF. This can be used to
++ * determine average interrupt latency. Frame remaining is also shown for
++ * start transfer and two additional sample points.
++ */
++static ssize_t hcd_frrem_show(struct device *_dev,
++			      struct device_attribute *attr, char *buf)
++{
++#ifndef DWC_DEVICE_ONLY
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++
++	dwc_otg_hcd_dump_frrem(otg_dev->hcd);
++#endif /* DWC_DEVICE_ONLY */
++	return sprintf(buf, "HCD Dump Frame Remaining\n");
++}
++
++DEVICE_ATTR(hcd_frrem, S_IRUGO, hcd_frrem_show, 0);
++
++/**
++ * Displays the time required to read the GNPTXFSIZ register many times (the
++ * output shows the number of times the register is read).
++ */
++#define RW_REG_COUNT 10000000
++#define MSEC_PER_JIFFIE 1000/HZ
++static ssize_t rd_reg_test_show(struct device *_dev,
++				struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	int i;
++	int time;
++	int start_jiffies;
++
++	printk("HZ %d, MSEC_PER_JIFFIE %d, loops_per_jiffy %lu\n",
++	       HZ, MSEC_PER_JIFFIE, loops_per_jiffy);
++	start_jiffies = jiffies;
++	for (i = 0; i < RW_REG_COUNT; i++) {
++		dwc_otg_get_gnptxfsiz(otg_dev->core_if);
++	}
++	time = jiffies - start_jiffies;
++	return sprintf(buf,
++		       "Time to read GNPTXFSIZ reg %d times: %d msecs (%d jiffies)\n",
++		       RW_REG_COUNT, time * MSEC_PER_JIFFIE, time);
++}
++
++DEVICE_ATTR(rd_reg_test, S_IRUGO, rd_reg_test_show, 0);
++
++/**
++ * Displays the time required to write the GNPTXFSIZ register many times (the
++ * output shows the number of times the register is written).
++ */
++static ssize_t wr_reg_test_show(struct device *_dev,
++				struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t reg_val;
++	int i;
++	int time;
++	int start_jiffies;
++
++	printk("HZ %d, MSEC_PER_JIFFIE %d, loops_per_jiffy %lu\n",
++	       HZ, MSEC_PER_JIFFIE, loops_per_jiffy);
++	reg_val = dwc_otg_get_gnptxfsiz(otg_dev->core_if);
++	start_jiffies = jiffies;
++	for (i = 0; i < RW_REG_COUNT; i++) {
++		dwc_otg_set_gnptxfsiz(otg_dev->core_if, reg_val);
++	}
++	time = jiffies - start_jiffies;
++	return sprintf(buf,
++		       "Time to write GNPTXFSIZ reg %d times: %d msecs (%d jiffies)\n",
++		       RW_REG_COUNT, time * MSEC_PER_JIFFIE, time);
++}
++
++DEVICE_ATTR(wr_reg_test, S_IRUGO, wr_reg_test_show, 0);
++
++#ifdef CONFIG_USB_DWC_OTG_LPM
++
++/**
++* Show the lpm_response attribute.
++*/
++static ssize_t lpmresp_show(struct device *_dev,
++			    struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++
++	if (!dwc_otg_get_param_lpm_enable(otg_dev->core_if))
++		return sprintf(buf, "** LPM is DISABLED **\n");
++
++	if (!dwc_otg_is_device_mode(otg_dev->core_if)) {
++		return sprintf(buf, "** Current mode is not device mode\n");
++	}
++	return sprintf(buf, "lpm_response = %d\n",
++		       dwc_otg_get_lpmresponse(otg_dev->core_if));
++}
++
++/**
++* Store the lpm_response attribute.
++*/
++static ssize_t lpmresp_store(struct device *_dev,
++			     struct device_attribute *attr,
++			     const char *buf, size_t count)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t val = simple_strtoul(buf, NULL, 16);
++
++	if (!dwc_otg_get_param_lpm_enable(otg_dev->core_if)) {
++		return 0;
++	}
++
++	if (!dwc_otg_is_device_mode(otg_dev->core_if)) {
++		return 0;
++	}
++
++	dwc_otg_set_lpmresponse(otg_dev->core_if, val);
++	return count;
++}
++
++DEVICE_ATTR(lpm_response, S_IRUGO | S_IWUSR, lpmresp_show, lpmresp_store);
++
++/**
++* Show the sleep_status attribute.
++*/
++static ssize_t sleepstatus_show(struct device *_dev,
++				struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	return sprintf(buf, "Sleep Status = %d\n",
++		       dwc_otg_get_lpm_portsleepstatus(otg_dev->core_if));
++}
++
++/**
++ * Store the sleep_status attribure.
++ */
++static ssize_t sleepstatus_store(struct device *_dev,
++				 struct device_attribute *attr,
++				 const char *buf, size_t count)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	dwc_otg_core_if_t *core_if = otg_dev->core_if;
++
++	if (dwc_otg_get_lpm_portsleepstatus(otg_dev->core_if)) {
++		if (dwc_otg_is_host_mode(core_if)) {
++
++			DWC_PRINTF("Host initiated resume\n");
++			dwc_otg_set_prtresume(otg_dev->core_if, 1);
++		}
++	}
++
++	return count;
++}
++
++DEVICE_ATTR(sleep_status, S_IRUGO | S_IWUSR, sleepstatus_show,
++	    sleepstatus_store);
++
++#endif /* CONFIG_USB_DWC_OTG_LPM_ENABLE */
++
++/**@}*/
++
++/**
++ * Create the device files
++ */
++void dwc_otg_attr_create(
++#ifdef LM_INTERFACE
++	struct lm_device *dev
++#elif  defined(PCI_INTERFACE)
++	struct pci_dev *dev
++#elif  defined(PLATFORM_INTERFACE)
++        struct platform_device *dev
++#endif
++    )
++{
++	int error;
++
++	error = device_create_file(&dev->dev, &dev_attr_regoffset);
++	error = device_create_file(&dev->dev, &dev_attr_regvalue);
++	error = device_create_file(&dev->dev, &dev_attr_mode);
++	error = device_create_file(&dev->dev, &dev_attr_hnpcapable);
++	error = device_create_file(&dev->dev, &dev_attr_srpcapable);
++	error = device_create_file(&dev->dev, &dev_attr_hsic_connect);
++	error = device_create_file(&dev->dev, &dev_attr_inv_sel_hsic);
++	error = device_create_file(&dev->dev, &dev_attr_hnp);
++	error = device_create_file(&dev->dev, &dev_attr_srp);
++	error = device_create_file(&dev->dev, &dev_attr_buspower);
++	error = device_create_file(&dev->dev, &dev_attr_bussuspend);
++	error = device_create_file(&dev->dev, &dev_attr_mode_ch_tim_en);
++	error = device_create_file(&dev->dev, &dev_attr_fr_interval);
++	error = device_create_file(&dev->dev, &dev_attr_busconnected);
++	error = device_create_file(&dev->dev, &dev_attr_gotgctl);
++	error = device_create_file(&dev->dev, &dev_attr_gusbcfg);
++	error = device_create_file(&dev->dev, &dev_attr_grxfsiz);
++	error = device_create_file(&dev->dev, &dev_attr_gnptxfsiz);
++	error = device_create_file(&dev->dev, &dev_attr_gpvndctl);
++	error = device_create_file(&dev->dev, &dev_attr_ggpio);
++	error = device_create_file(&dev->dev, &dev_attr_guid);
++	error = device_create_file(&dev->dev, &dev_attr_gsnpsid);
++	error = device_create_file(&dev->dev, &dev_attr_devspeed);
++	error = device_create_file(&dev->dev, &dev_attr_enumspeed);
++	error = device_create_file(&dev->dev, &dev_attr_hptxfsiz);
++	error = device_create_file(&dev->dev, &dev_attr_hprt0);
++	error = device_create_file(&dev->dev, &dev_attr_remote_wakeup);
++	error = device_create_file(&dev->dev, &dev_attr_rem_wakeup_pwrdn);
++	error = device_create_file(&dev->dev, &dev_attr_disconnect_us);
++	error = device_create_file(&dev->dev, &dev_attr_regdump);
++	error = device_create_file(&dev->dev, &dev_attr_spramdump);
++	error = device_create_file(&dev->dev, &dev_attr_hcddump);
++	error = device_create_file(&dev->dev, &dev_attr_hcd_frrem);
++	error = device_create_file(&dev->dev, &dev_attr_rd_reg_test);
++	error = device_create_file(&dev->dev, &dev_attr_wr_reg_test);
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	error = device_create_file(&dev->dev, &dev_attr_lpm_response);
++	error = device_create_file(&dev->dev, &dev_attr_sleep_status);
++#endif
++}
++
++/**
++ * Remove the device files
++ */
++void dwc_otg_attr_remove(
++#ifdef LM_INTERFACE
++	struct lm_device *dev
++#elif  defined(PCI_INTERFACE)
++	struct pci_dev *dev
++#elif  defined(PLATFORM_INTERFACE)
++	struct platform_device *dev
++#endif
++    )
++{
++	device_remove_file(&dev->dev, &dev_attr_regoffset);
++	device_remove_file(&dev->dev, &dev_attr_regvalue);
++	device_remove_file(&dev->dev, &dev_attr_mode);
++	device_remove_file(&dev->dev, &dev_attr_hnpcapable);
++	device_remove_file(&dev->dev, &dev_attr_srpcapable);
++	device_remove_file(&dev->dev, &dev_attr_hsic_connect);
++	device_remove_file(&dev->dev, &dev_attr_inv_sel_hsic);
++	device_remove_file(&dev->dev, &dev_attr_hnp);
++	device_remove_file(&dev->dev, &dev_attr_srp);
++	device_remove_file(&dev->dev, &dev_attr_buspower);
++	device_remove_file(&dev->dev, &dev_attr_bussuspend);
++	device_remove_file(&dev->dev, &dev_attr_mode_ch_tim_en);
++	device_remove_file(&dev->dev, &dev_attr_fr_interval);
++	device_remove_file(&dev->dev, &dev_attr_busconnected);
++	device_remove_file(&dev->dev, &dev_attr_gotgctl);
++	device_remove_file(&dev->dev, &dev_attr_gusbcfg);
++	device_remove_file(&dev->dev, &dev_attr_grxfsiz);
++	device_remove_file(&dev->dev, &dev_attr_gnptxfsiz);
++	device_remove_file(&dev->dev, &dev_attr_gpvndctl);
++	device_remove_file(&dev->dev, &dev_attr_ggpio);
++	device_remove_file(&dev->dev, &dev_attr_guid);
++	device_remove_file(&dev->dev, &dev_attr_gsnpsid);
++	device_remove_file(&dev->dev, &dev_attr_devspeed);
++	device_remove_file(&dev->dev, &dev_attr_enumspeed);
++	device_remove_file(&dev->dev, &dev_attr_hptxfsiz);
++	device_remove_file(&dev->dev, &dev_attr_hprt0);
++	device_remove_file(&dev->dev, &dev_attr_remote_wakeup);
++	device_remove_file(&dev->dev, &dev_attr_rem_wakeup_pwrdn);
++	device_remove_file(&dev->dev, &dev_attr_disconnect_us);
++	device_remove_file(&dev->dev, &dev_attr_regdump);
++	device_remove_file(&dev->dev, &dev_attr_spramdump);
++	device_remove_file(&dev->dev, &dev_attr_hcddump);
++	device_remove_file(&dev->dev, &dev_attr_hcd_frrem);
++	device_remove_file(&dev->dev, &dev_attr_rd_reg_test);
++	device_remove_file(&dev->dev, &dev_attr_wr_reg_test);
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	device_remove_file(&dev->dev, &dev_attr_lpm_response);
++	device_remove_file(&dev->dev, &dev_attr_sleep_status);
++#endif
++}
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_attr.h
+@@ -0,0 +1,89 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_attr.h $
++ * $Revision: #13 $
++ * $Date: 2010/06/21 $
++ * $Change: 1532021 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++#if !defined(__DWC_OTG_ATTR_H__)
++#define __DWC_OTG_ATTR_H__
++
++/** @file
++ * This file contains the interface to the Linux device attributes.
++ */
++extern struct device_attribute dev_attr_regoffset;
++extern struct device_attribute dev_attr_regvalue;
++
++extern struct device_attribute dev_attr_mode;
++extern struct device_attribute dev_attr_hnpcapable;
++extern struct device_attribute dev_attr_srpcapable;
++extern struct device_attribute dev_attr_hnp;
++extern struct device_attribute dev_attr_srp;
++extern struct device_attribute dev_attr_buspower;
++extern struct device_attribute dev_attr_bussuspend;
++extern struct device_attribute dev_attr_mode_ch_tim_en;
++extern struct device_attribute dev_attr_fr_interval;
++extern struct device_attribute dev_attr_busconnected;
++extern struct device_attribute dev_attr_gotgctl;
++extern struct device_attribute dev_attr_gusbcfg;
++extern struct device_attribute dev_attr_grxfsiz;
++extern struct device_attribute dev_attr_gnptxfsiz;
++extern struct device_attribute dev_attr_gpvndctl;
++extern struct device_attribute dev_attr_ggpio;
++extern struct device_attribute dev_attr_guid;
++extern struct device_attribute dev_attr_gsnpsid;
++extern struct device_attribute dev_attr_devspeed;
++extern struct device_attribute dev_attr_enumspeed;
++extern struct device_attribute dev_attr_hptxfsiz;
++extern struct device_attribute dev_attr_hprt0;
++#ifdef CONFIG_USB_DWC_OTG_LPM
++extern struct device_attribute dev_attr_lpm_response;
++extern struct device_attribute devi_attr_sleep_status;
++#endif
++
++void dwc_otg_attr_create(
++#ifdef LM_INTERFACE
++				struct lm_device *dev
++#elif  defined(PCI_INTERFACE)
++				struct pci_dev *dev
++#elif  defined(PLATFORM_INTERFACE)
++	struct platform_device *dev
++#endif
++    );
++
++void dwc_otg_attr_remove(
++#ifdef LM_INTERFACE
++				struct lm_device *dev
++#elif  defined(PCI_INTERFACE)
++				struct pci_dev *dev
++#elif  defined(PLATFORM_INTERFACE)
++	struct platform_device *dev
++#endif
++    );
++#endif
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_cfi.c
+@@ -0,0 +1,1876 @@
++/* ==========================================================================
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++/** @file
++ *
++ * This file contains the most of the CFI(Core Feature Interface)
++ * implementation for the OTG.
++ */
++
++#ifdef DWC_UTE_CFI
++
++#include "dwc_otg_pcd.h"
++#include "dwc_otg_cfi.h"
++
++/** This definition should actually migrate to the Portability Library */
++#define DWC_CONSTANT_CPU_TO_LE16(x) (x)
++
++extern dwc_otg_pcd_ep_t *get_ep_by_addr(dwc_otg_pcd_t * pcd, u16 wIndex);
++
++static int cfi_core_features_buf(uint8_t * buf, uint16_t buflen);
++static int cfi_get_feature_value(uint8_t * buf, uint16_t buflen,
++				 struct dwc_otg_pcd *pcd,
++				 struct cfi_usb_ctrlrequest *ctrl_req);
++static int cfi_set_feature_value(struct dwc_otg_pcd *pcd);
++static int cfi_ep_get_sg_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
++			     struct cfi_usb_ctrlrequest *req);
++static int cfi_ep_get_concat_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
++				 struct cfi_usb_ctrlrequest *req);
++static int cfi_ep_get_align_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
++				struct cfi_usb_ctrlrequest *req);
++static int cfi_preproc_reset(struct dwc_otg_pcd *pcd,
++			     struct cfi_usb_ctrlrequest *req);
++static void cfi_free_ep_bs_dyn_data(cfi_ep_t * cfiep);
++
++static uint16_t get_dfifo_size(dwc_otg_core_if_t * core_if);
++static int32_t get_rxfifo_size(dwc_otg_core_if_t * core_if, uint16_t wValue);
++static int32_t get_txfifo_size(struct dwc_otg_pcd *pcd, uint16_t wValue);
++
++static uint8_t resize_fifos(dwc_otg_core_if_t * core_if);
++
++/** This is the header of the all features descriptor */
++static cfi_all_features_header_t all_props_desc_header = {
++	.wVersion = DWC_CONSTANT_CPU_TO_LE16(0x100),
++	.wCoreID = DWC_CONSTANT_CPU_TO_LE16(CFI_CORE_ID_OTG),
++	.wNumFeatures = DWC_CONSTANT_CPU_TO_LE16(9),
++};
++
++/** This is an array of statically allocated feature descriptors */
++static cfi_feature_desc_header_t prop_descs[] = {
++
++	/* FT_ID_DMA_MODE */
++	{
++	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DMA_MODE),
++	 .bmAttributes = CFI_FEATURE_ATTR_RW,
++	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(1),
++	 },
++
++	/* FT_ID_DMA_BUFFER_SETUP */
++	{
++	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DMA_BUFFER_SETUP),
++	 .bmAttributes = CFI_FEATURE_ATTR_RW,
++	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(6),
++	 },
++
++	/* FT_ID_DMA_BUFF_ALIGN */
++	{
++	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DMA_BUFF_ALIGN),
++	 .bmAttributes = CFI_FEATURE_ATTR_RW,
++	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(2),
++	 },
++
++	/* FT_ID_DMA_CONCAT_SETUP */
++	{
++	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DMA_CONCAT_SETUP),
++	 .bmAttributes = CFI_FEATURE_ATTR_RW,
++	 //.wDataLength  = DWC_CONSTANT_CPU_TO_LE16(6),
++	 },
++
++	/* FT_ID_DMA_CIRCULAR */
++	{
++	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DMA_CIRCULAR),
++	 .bmAttributes = CFI_FEATURE_ATTR_RW,
++	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(6),
++	 },
++
++	/* FT_ID_THRESHOLD_SETUP */
++	{
++	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_THRESHOLD_SETUP),
++	 .bmAttributes = CFI_FEATURE_ATTR_RW,
++	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(6),
++	 },
++
++	/* FT_ID_DFIFO_DEPTH */
++	{
++	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DFIFO_DEPTH),
++	 .bmAttributes = CFI_FEATURE_ATTR_RO,
++	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(2),
++	 },
++
++	/* FT_ID_TX_FIFO_DEPTH */
++	{
++	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_TX_FIFO_DEPTH),
++	 .bmAttributes = CFI_FEATURE_ATTR_RW,
++	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(2),
++	 },
++
++	/* FT_ID_RX_FIFO_DEPTH */
++	{
++	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_RX_FIFO_DEPTH),
++	 .bmAttributes = CFI_FEATURE_ATTR_RW,
++	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(2),
++	 }
++};
++
++/** The table of feature names */
++cfi_string_t prop_name_table[] = {
++	{FT_ID_DMA_MODE, "dma_mode"},
++	{FT_ID_DMA_BUFFER_SETUP, "buffer_setup"},
++	{FT_ID_DMA_BUFF_ALIGN, "buffer_align"},
++	{FT_ID_DMA_CONCAT_SETUP, "concat_setup"},
++	{FT_ID_DMA_CIRCULAR, "buffer_circular"},
++	{FT_ID_THRESHOLD_SETUP, "threshold_setup"},
++	{FT_ID_DFIFO_DEPTH, "dfifo_depth"},
++	{FT_ID_TX_FIFO_DEPTH, "txfifo_depth"},
++	{FT_ID_RX_FIFO_DEPTH, "rxfifo_depth"},
++	{}
++};
++
++/************************************************************************/
++
++/**
++ * Returns the name of the feature by its ID
++ * or NULL if no featute ID matches.
++ *
++ */
++const uint8_t *get_prop_name(uint16_t prop_id, int *len)
++{
++	cfi_string_t *pstr;
++	*len = 0;
++
++	for (pstr = prop_name_table; pstr && pstr->s; pstr++) {
++		if (pstr->id == prop_id) {
++			*len = DWC_STRLEN(pstr->s);
++			return pstr->s;
++		}
++	}
++	return NULL;
++}
++
++/**
++ * This function handles all CFI specific control requests.
++ *
++ * Return a negative value to stall the DCE.
++ */
++int cfi_setup(struct dwc_otg_pcd *pcd, struct cfi_usb_ctrlrequest *ctrl)
++{
++	int retval = 0;
++	dwc_otg_pcd_ep_t *ep = NULL;
++	cfiobject_t *cfi = pcd->cfi;
++	struct dwc_otg_core_if *coreif = GET_CORE_IF(pcd);
++	uint16_t wLen = DWC_LE16_TO_CPU(&ctrl->wLength);
++	uint16_t wValue = DWC_LE16_TO_CPU(&ctrl->wValue);
++	uint16_t wIndex = DWC_LE16_TO_CPU(&ctrl->wIndex);
++	uint32_t regaddr = 0;
++	uint32_t regval = 0;
++
++	/* Save this Control Request in the CFI object.
++	 * The data field will be assigned in the data stage completion CB function.
++	 */
++	cfi->ctrl_req = *ctrl;
++	cfi->ctrl_req.data = NULL;
++
++	cfi->need_gadget_att = 0;
++	cfi->need_status_in_complete = 0;
++
++	switch (ctrl->bRequest) {
++	case VEN_CORE_GET_FEATURES:
++		retval = cfi_core_features_buf(cfi->buf_in.buf, CFI_IN_BUF_LEN);
++		if (retval >= 0) {
++			//dump_msg(cfi->buf_in.buf, retval);
++			ep = &pcd->ep0;
++
++			retval = min((uint16_t) retval, wLen);
++			/* Transfer this buffer to the host through the EP0-IN EP */
++			ep->dwc_ep.dma_addr = cfi->buf_in.addr;
++			ep->dwc_ep.start_xfer_buff = cfi->buf_in.buf;
++			ep->dwc_ep.xfer_buff = cfi->buf_in.buf;
++			ep->dwc_ep.xfer_len = retval;
++			ep->dwc_ep.xfer_count = 0;
++			ep->dwc_ep.sent_zlp = 0;
++			ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
++
++			pcd->ep0_pending = 1;
++			dwc_otg_ep0_start_transfer(coreif, &ep->dwc_ep);
++		}
++		retval = 0;
++		break;
++
++	case VEN_CORE_GET_FEATURE:
++		CFI_INFO("VEN_CORE_GET_FEATURE\n");
++		retval = cfi_get_feature_value(cfi->buf_in.buf, CFI_IN_BUF_LEN,
++					       pcd, ctrl);
++		if (retval >= 0) {
++			ep = &pcd->ep0;
++
++			retval = min((uint16_t) retval, wLen);
++			/* Transfer this buffer to the host through the EP0-IN EP */
++			ep->dwc_ep.dma_addr = cfi->buf_in.addr;
++			ep->dwc_ep.start_xfer_buff = cfi->buf_in.buf;
++			ep->dwc_ep.xfer_buff = cfi->buf_in.buf;
++			ep->dwc_ep.xfer_len = retval;
++			ep->dwc_ep.xfer_count = 0;
++			ep->dwc_ep.sent_zlp = 0;
++			ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
++
++			pcd->ep0_pending = 1;
++			dwc_otg_ep0_start_transfer(coreif, &ep->dwc_ep);
++		}
++		CFI_INFO("VEN_CORE_GET_FEATURE=%d\n", retval);
++		dump_msg(cfi->buf_in.buf, retval);
++		break;
++
++	case VEN_CORE_SET_FEATURE:
++		CFI_INFO("VEN_CORE_SET_FEATURE\n");
++		/* Set up an XFER to get the data stage of the control request,
++		 * which is the new value of the feature to be modified.
++		 */
++		ep = &pcd->ep0;
++		ep->dwc_ep.is_in = 0;
++		ep->dwc_ep.dma_addr = cfi->buf_out.addr;
++		ep->dwc_ep.start_xfer_buff = cfi->buf_out.buf;
++		ep->dwc_ep.xfer_buff = cfi->buf_out.buf;
++		ep->dwc_ep.xfer_len = wLen;
++		ep->dwc_ep.xfer_count = 0;
++		ep->dwc_ep.sent_zlp = 0;
++		ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
++
++		pcd->ep0_pending = 1;
++		/* Read the control write's data stage */
++		dwc_otg_ep0_start_transfer(coreif, &ep->dwc_ep);
++		retval = 0;
++		break;
++
++	case VEN_CORE_RESET_FEATURES:
++		CFI_INFO("VEN_CORE_RESET_FEATURES\n");
++		cfi->need_gadget_att = 1;
++		cfi->need_status_in_complete = 1;
++		retval = cfi_preproc_reset(pcd, ctrl);
++		CFI_INFO("VEN_CORE_RESET_FEATURES = (%d)\n", retval);
++		break;
++
++	case VEN_CORE_ACTIVATE_FEATURES:
++		CFI_INFO("VEN_CORE_ACTIVATE_FEATURES\n");
++		break;
++
++	case VEN_CORE_READ_REGISTER:
++		CFI_INFO("VEN_CORE_READ_REGISTER\n");
++		/* wValue optionally contains the HI WORD of the register offset and
++		 * wIndex contains the LOW WORD of the register offset
++		 */
++		if (wValue == 0) {
++			/* @TODO - MAS - fix the access to the base field */
++			regaddr = 0;
++			//regaddr = (uint32_t) pcd->otg_dev->os_dep.base;
++			//GET_CORE_IF(pcd)->co
++			regaddr |= wIndex;
++		} else {
++			regaddr = (wValue << 16) | wIndex;
++		}
++
++		/* Read a 32-bit value of the memory at the regaddr */
++		regval = DWC_READ_REG32((uint32_t *) regaddr);
++
++		ep = &pcd->ep0;
++		dwc_memcpy(cfi->buf_in.buf, &regval, sizeof(uint32_t));
++		ep->dwc_ep.is_in = 1;
++		ep->dwc_ep.dma_addr = cfi->buf_in.addr;
++		ep->dwc_ep.start_xfer_buff = cfi->buf_in.buf;
++		ep->dwc_ep.xfer_buff = cfi->buf_in.buf;
++		ep->dwc_ep.xfer_len = wLen;
++		ep->dwc_ep.xfer_count = 0;
++		ep->dwc_ep.sent_zlp = 0;
++		ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
++
++		pcd->ep0_pending = 1;
++		dwc_otg_ep0_start_transfer(coreif, &ep->dwc_ep);
++		cfi->need_gadget_att = 0;
++		retval = 0;
++		break;
++
++	case VEN_CORE_WRITE_REGISTER:
++		CFI_INFO("VEN_CORE_WRITE_REGISTER\n");
++		/* Set up an XFER to get the data stage of the control request,
++		 * which is the new value of the register to be modified.
++		 */
++		ep = &pcd->ep0;
++		ep->dwc_ep.is_in = 0;
++		ep->dwc_ep.dma_addr = cfi->buf_out.addr;
++		ep->dwc_ep.start_xfer_buff = cfi->buf_out.buf;
++		ep->dwc_ep.xfer_buff = cfi->buf_out.buf;
++		ep->dwc_ep.xfer_len = wLen;
++		ep->dwc_ep.xfer_count = 0;
++		ep->dwc_ep.sent_zlp = 0;
++		ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
++
++		pcd->ep0_pending = 1;
++		/* Read the control write's data stage */
++		dwc_otg_ep0_start_transfer(coreif, &ep->dwc_ep);
++		retval = 0;
++		break;
++
++	default:
++		retval = -DWC_E_NOT_SUPPORTED;
++		break;
++	}
++
++	return retval;
++}
++
++/**
++ * This function prepares the core features descriptors and copies its
++ * raw representation into the buffer <buf>.
++ *
++ * The buffer structure is as follows:
++ *	all_features_header (8 bytes)
++ *	features_#1 (8 bytes + feature name string length)
++ *	features_#2 (8 bytes + feature name string length)
++ *	.....
++ *	features_#n - where n=the total count of feature descriptors
++ */
++static int cfi_core_features_buf(uint8_t * buf, uint16_t buflen)
++{
++	cfi_feature_desc_header_t *prop_hdr = prop_descs;
++	cfi_feature_desc_header_t *prop;
++	cfi_all_features_header_t *all_props_hdr = &all_props_desc_header;
++	cfi_all_features_header_t *tmp;
++	uint8_t *tmpbuf = buf;
++	const uint8_t *pname = NULL;
++	int i, j, namelen = 0, totlen;
++
++	/* Prepare and copy the core features into the buffer */
++	CFI_INFO("%s:\n", __func__);
++
++	tmp = (cfi_all_features_header_t *) tmpbuf;
++	*tmp = *all_props_hdr;
++	tmpbuf += CFI_ALL_FEATURES_HDR_LEN;
++
++	j = sizeof(prop_descs) / sizeof(cfi_all_features_header_t);
++	for (i = 0; i < j; i++, prop_hdr++) {
++		pname = get_prop_name(prop_hdr->wFeatureID, &namelen);
++		prop = (cfi_feature_desc_header_t *) tmpbuf;
++		*prop = *prop_hdr;
++
++		prop->bNameLen = namelen;
++		prop->wLength =
++		    DWC_CONSTANT_CPU_TO_LE16(CFI_FEATURE_DESC_HDR_LEN +
++					     namelen);
++
++		tmpbuf += CFI_FEATURE_DESC_HDR_LEN;
++		dwc_memcpy(tmpbuf, pname, namelen);
++		tmpbuf += namelen;
++	}
++
++	totlen = tmpbuf - buf;
++
++	if (totlen > 0) {
++		tmp = (cfi_all_features_header_t *) buf;
++		tmp->wTotalLen = DWC_CONSTANT_CPU_TO_LE16(totlen);
++	}
++
++	return totlen;
++}
++
++/**
++ * This function releases all the dynamic memory in the CFI object.
++ */
++static void cfi_release(cfiobject_t * cfiobj)
++{
++	cfi_ep_t *cfiep;
++	dwc_list_link_t *tmp;
++
++	CFI_INFO("%s\n", __func__);
++
++	if (cfiobj->buf_in.buf) {
++		DWC_DMA_FREE(CFI_IN_BUF_LEN, cfiobj->buf_in.buf,
++			     cfiobj->buf_in.addr);
++		cfiobj->buf_in.buf = NULL;
++	}
++
++	if (cfiobj->buf_out.buf) {
++		DWC_DMA_FREE(CFI_OUT_BUF_LEN, cfiobj->buf_out.buf,
++			     cfiobj->buf_out.addr);
++		cfiobj->buf_out.buf = NULL;
++	}
++
++	/* Free the Buffer Setup values for each EP */
++	//list_for_each_entry(cfiep, &cfiobj->active_eps, lh) {
++	DWC_LIST_FOREACH(tmp, &cfiobj->active_eps) {
++		cfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
++		cfi_free_ep_bs_dyn_data(cfiep);
++	}
++}
++
++/**
++ * This function frees the dynamically allocated EP buffer setup data.
++ */
++static void cfi_free_ep_bs_dyn_data(cfi_ep_t * cfiep)
++{
++	if (cfiep->bm_sg) {
++		DWC_FREE(cfiep->bm_sg);
++		cfiep->bm_sg = NULL;
++	}
++
++	if (cfiep->bm_align) {
++		DWC_FREE(cfiep->bm_align);
++		cfiep->bm_align = NULL;
++	}
++
++	if (cfiep->bm_concat) {
++		if (NULL != cfiep->bm_concat->wTxBytes) {
++			DWC_FREE(cfiep->bm_concat->wTxBytes);
++			cfiep->bm_concat->wTxBytes = NULL;
++		}
++		DWC_FREE(cfiep->bm_concat);
++		cfiep->bm_concat = NULL;
++	}
++}
++
++/**
++ * This function initializes the default values of the features
++ * for a specific endpoint and should be called only once when
++ * the EP is enabled first time.
++ */
++static int cfi_ep_init_defaults(struct dwc_otg_pcd *pcd, cfi_ep_t * cfiep)
++{
++	int retval = 0;
++
++	cfiep->bm_sg = DWC_ALLOC(sizeof(ddma_sg_buffer_setup_t));
++	if (NULL == cfiep->bm_sg) {
++		CFI_INFO("Failed to allocate memory for SG feature value\n");
++		return -DWC_E_NO_MEMORY;
++	}
++	dwc_memset(cfiep->bm_sg, 0, sizeof(ddma_sg_buffer_setup_t));
++
++	/* For the Concatenation feature's default value we do not allocate
++	 * memory for the wTxBytes field - it will be done in the set_feature_value
++	 * request handler.
++	 */
++	cfiep->bm_concat = DWC_ALLOC(sizeof(ddma_concat_buffer_setup_t));
++	if (NULL == cfiep->bm_concat) {
++		CFI_INFO
++		    ("Failed to allocate memory for CONCATENATION feature value\n");
++		DWC_FREE(cfiep->bm_sg);
++		return -DWC_E_NO_MEMORY;
++	}
++	dwc_memset(cfiep->bm_concat, 0, sizeof(ddma_concat_buffer_setup_t));
++
++	cfiep->bm_align = DWC_ALLOC(sizeof(ddma_align_buffer_setup_t));
++	if (NULL == cfiep->bm_align) {
++		CFI_INFO
++		    ("Failed to allocate memory for Alignment feature value\n");
++		DWC_FREE(cfiep->bm_sg);
++		DWC_FREE(cfiep->bm_concat);
++		return -DWC_E_NO_MEMORY;
++	}
++	dwc_memset(cfiep->bm_align, 0, sizeof(ddma_align_buffer_setup_t));
++
++	return retval;
++}
++
++/**
++ * The callback function that notifies the CFI on the activation of
++ * an endpoint in the PCD. The following steps are done in this function:
++ *
++ *	Create a dynamically allocated cfi_ep_t object (a CFI wrapper to the PCD's
++ *		active endpoint)
++ *	Create MAX_DMA_DESCS_PER_EP count DMA Descriptors for the EP
++ *	Set the Buffer Mode to standard
++ *	Initialize the default values for all EP modes (SG, Circular, Concat, Align)
++ *	Add the cfi_ep_t object to the list of active endpoints in the CFI object
++ */
++static int cfi_ep_enable(struct cfiobject *cfi, struct dwc_otg_pcd *pcd,
++			 struct dwc_otg_pcd_ep *ep)
++{
++	cfi_ep_t *cfiep;
++	int retval = -DWC_E_NOT_SUPPORTED;
++
++	CFI_INFO("%s: epname=%s; epnum=0x%02x\n", __func__,
++		 "EP_" /*ep->ep.name */ , ep->desc->bEndpointAddress);
++	/* MAS - Check whether this endpoint already is in the list */
++	cfiep = get_cfi_ep_by_pcd_ep(cfi, ep);
++
++	if (NULL == cfiep) {
++		/* Allocate a cfi_ep_t object */
++		cfiep = DWC_ALLOC(sizeof(cfi_ep_t));
++		if (NULL == cfiep) {
++			CFI_INFO
++			    ("Unable to allocate memory for <cfiep> in function %s\n",
++			     __func__);
++			return -DWC_E_NO_MEMORY;
++		}
++		dwc_memset(cfiep, 0, sizeof(cfi_ep_t));
++
++		/* Save the dwc_otg_pcd_ep pointer in the cfiep object */
++		cfiep->ep = ep;
++
++		/* Allocate the DMA Descriptors chain of MAX_DMA_DESCS_PER_EP count */
++		ep->dwc_ep.descs =
++		    DWC_DMA_ALLOC(MAX_DMA_DESCS_PER_EP *
++				  sizeof(dwc_otg_dma_desc_t),
++				  &ep->dwc_ep.descs_dma_addr);
++
++		if (NULL == ep->dwc_ep.descs) {
++			DWC_FREE(cfiep);
++			return -DWC_E_NO_MEMORY;
++		}
++
++		DWC_LIST_INIT(&cfiep->lh);
++
++		/* Set the buffer mode to BM_STANDARD. It will be modified
++		 * when building descriptors for a specific buffer mode */
++		ep->dwc_ep.buff_mode = BM_STANDARD;
++
++		/* Create and initialize the default values for this EP's Buffer modes */
++		if ((retval = cfi_ep_init_defaults(pcd, cfiep)) < 0)
++			return retval;
++
++		/* Add the cfi_ep_t object to the CFI object's list of active endpoints */
++		DWC_LIST_INSERT_TAIL(&cfi->active_eps, &cfiep->lh);
++		retval = 0;
++	} else {		/* The sought EP already is in the list */
++		CFI_INFO("%s: The sought EP already is in the list\n",
++			 __func__);
++	}
++
++	return retval;
++}
++
++/**
++ * This function is called when the data stage of a 3-stage Control Write request
++ * is complete.
++ *
++ */
++static int cfi_ctrl_write_complete(struct cfiobject *cfi,
++				   struct dwc_otg_pcd *pcd)
++{
++	uint32_t addr, reg_value;
++	uint16_t wIndex, wValue;
++	uint8_t bRequest;
++	uint8_t *buf = cfi->buf_out.buf;
++	//struct usb_ctrlrequest *ctrl_req = &cfi->ctrl_req_saved;
++	struct cfi_usb_ctrlrequest *ctrl_req = &cfi->ctrl_req;
++	int retval = -DWC_E_NOT_SUPPORTED;
++
++	CFI_INFO("%s\n", __func__);
++
++	bRequest = ctrl_req->bRequest;
++	wIndex = DWC_CONSTANT_CPU_TO_LE16(ctrl_req->wIndex);
++	wValue = DWC_CONSTANT_CPU_TO_LE16(ctrl_req->wValue);
++
++	/*
++	 * Save the pointer to the data stage in the ctrl_req's <data> field.
++	 * The request should be already saved in the command stage by now.
++	 */
++	ctrl_req->data = cfi->buf_out.buf;
++	cfi->need_status_in_complete = 0;
++	cfi->need_gadget_att = 0;
++
++	switch (bRequest) {
++	case VEN_CORE_WRITE_REGISTER:
++		/* The buffer contains raw data of the new value for the register */
++		reg_value = *((uint32_t *) buf);
++		if (wValue == 0) {
++			addr = 0;
++			//addr = (uint32_t) pcd->otg_dev->os_dep.base;
++			addr += wIndex;
++		} else {
++			addr = (wValue << 16) | wIndex;
++		}
++
++		//writel(reg_value, addr);
++
++		retval = 0;
++		cfi->need_status_in_complete = 1;
++		break;
++
++	case VEN_CORE_SET_FEATURE:
++		/* The buffer contains raw data of the new value of the feature */
++		retval = cfi_set_feature_value(pcd);
++		if (retval < 0)
++			return retval;
++
++		cfi->need_status_in_complete = 1;
++		break;
++
++	default:
++		break;
++	}
++
++	return retval;
++}
++
++/**
++ * This function builds the DMA descriptors for the SG buffer mode.
++ */
++static void cfi_build_sg_descs(struct cfiobject *cfi, cfi_ep_t * cfiep,
++			       dwc_otg_pcd_request_t * req)
++{
++	struct dwc_otg_pcd_ep *ep = cfiep->ep;
++	ddma_sg_buffer_setup_t *sgval = cfiep->bm_sg;
++	struct dwc_otg_dma_desc *desc = cfiep->ep->dwc_ep.descs;
++	struct dwc_otg_dma_desc *desc_last = cfiep->ep->dwc_ep.descs;
++	dma_addr_t buff_addr = req->dma;
++	int i;
++	uint32_t txsize, off;
++
++	txsize = sgval->wSize;
++	off = sgval->bOffset;
++
++//      CFI_INFO("%s: %s TXSIZE=0x%08x; OFFSET=0x%08x\n",
++//              __func__, cfiep->ep->ep.name, txsize, off);
++
++	for (i = 0; i < sgval->bCount; i++) {
++		desc->status.b.bs = BS_HOST_BUSY;
++		desc->buf = buff_addr;
++		desc->status.b.l = 0;
++		desc->status.b.ioc = 0;
++		desc->status.b.sp = 0;
++		desc->status.b.bytes = txsize;
++		desc->status.b.bs = BS_HOST_READY;
++
++		/* Set the next address of the buffer */
++		buff_addr += txsize + off;
++		desc_last = desc;
++		desc++;
++	}
++
++	/* Set the last, ioc and sp bits on the Last DMA Descriptor */
++	desc_last->status.b.l = 1;
++	desc_last->status.b.ioc = 1;
++	desc_last->status.b.sp = ep->dwc_ep.sent_zlp;
++	/* Save the last DMA descriptor pointer */
++	cfiep->dma_desc_last = desc_last;
++	cfiep->desc_count = sgval->bCount;
++}
++
++/**
++ * This function builds the DMA descriptors for the Concatenation buffer mode.
++ */
++static void cfi_build_concat_descs(struct cfiobject *cfi, cfi_ep_t * cfiep,
++				   dwc_otg_pcd_request_t * req)
++{
++	struct dwc_otg_pcd_ep *ep = cfiep->ep;
++	ddma_concat_buffer_setup_t *concatval = cfiep->bm_concat;
++	struct dwc_otg_dma_desc *desc = cfiep->ep->dwc_ep.descs;
++	struct dwc_otg_dma_desc *desc_last = cfiep->ep->dwc_ep.descs;
++	dma_addr_t buff_addr = req->dma;
++	int i;
++	uint16_t *txsize;
++
++	txsize = concatval->wTxBytes;
++
++	for (i = 0; i < concatval->hdr.bDescCount; i++) {
++		desc->buf = buff_addr;
++		desc->status.b.bs = BS_HOST_BUSY;
++		desc->status.b.l = 0;
++		desc->status.b.ioc = 0;
++		desc->status.b.sp = 0;
++		desc->status.b.bytes = *txsize;
++		desc->status.b.bs = BS_HOST_READY;
++
++		txsize++;
++		/* Set the next address of the buffer */
++		buff_addr += UGETW(ep->desc->wMaxPacketSize);
++		desc_last = desc;
++		desc++;
++	}
++
++	/* Set the last, ioc and sp bits on the Last DMA Descriptor */
++	desc_last->status.b.l = 1;
++	desc_last->status.b.ioc = 1;
++	desc_last->status.b.sp = ep->dwc_ep.sent_zlp;
++	cfiep->dma_desc_last = desc_last;
++	cfiep->desc_count = concatval->hdr.bDescCount;
++}
++
++/**
++ * This function builds the DMA descriptors for the Circular buffer mode
++ */
++static void cfi_build_circ_descs(struct cfiobject *cfi, cfi_ep_t * cfiep,
++				 dwc_otg_pcd_request_t * req)
++{
++	/* @todo: MAS - add implementation when this feature needs to be tested */
++}
++
++/**
++ * This function builds the DMA descriptors for the Alignment buffer mode
++ */
++static void cfi_build_align_descs(struct cfiobject *cfi, cfi_ep_t * cfiep,
++				  dwc_otg_pcd_request_t * req)
++{
++	struct dwc_otg_pcd_ep *ep = cfiep->ep;
++	ddma_align_buffer_setup_t *alignval = cfiep->bm_align;
++	struct dwc_otg_dma_desc *desc = cfiep->ep->dwc_ep.descs;
++	dma_addr_t buff_addr = req->dma;
++
++	desc->status.b.bs = BS_HOST_BUSY;
++	desc->status.b.l = 1;
++	desc->status.b.ioc = 1;
++	desc->status.b.sp = ep->dwc_ep.sent_zlp;
++	desc->status.b.bytes = req->length;
++	/* Adjust the buffer alignment */
++	desc->buf = (buff_addr + alignval->bAlign);
++	desc->status.b.bs = BS_HOST_READY;
++	cfiep->dma_desc_last = desc;
++	cfiep->desc_count = 1;
++}
++
++/**
++ * This function builds the DMA descriptors chain for different modes of the
++ * buffer setup of an endpoint.
++ */
++static void cfi_build_descriptors(struct cfiobject *cfi,
++				  struct dwc_otg_pcd *pcd,
++				  struct dwc_otg_pcd_ep *ep,
++				  dwc_otg_pcd_request_t * req)
++{
++	cfi_ep_t *cfiep;
++
++	/* Get the cfiep by the dwc_otg_pcd_ep */
++	cfiep = get_cfi_ep_by_pcd_ep(cfi, ep);
++	if (NULL == cfiep) {
++		CFI_INFO("%s: Unable to find a matching active endpoint\n",
++			 __func__);
++		return;
++	}
++
++	cfiep->xfer_len = req->length;
++
++	/* Iterate through all the DMA descriptors */
++	switch (cfiep->ep->dwc_ep.buff_mode) {
++	case BM_SG:
++		cfi_build_sg_descs(cfi, cfiep, req);
++		break;
++
++	case BM_CONCAT:
++		cfi_build_concat_descs(cfi, cfiep, req);
++		break;
++
++	case BM_CIRCULAR:
++		cfi_build_circ_descs(cfi, cfiep, req);
++		break;
++
++	case BM_ALIGN:
++		cfi_build_align_descs(cfi, cfiep, req);
++		break;
++
++	default:
++		break;
++	}
++}
++
++/**
++ * Allocate DMA buffer for different Buffer modes.
++ */
++static void *cfi_ep_alloc_buf(struct cfiobject *cfi, struct dwc_otg_pcd *pcd,
++			      struct dwc_otg_pcd_ep *ep, dma_addr_t * dma,
++			      unsigned size, gfp_t flags)
++{
++	return DWC_DMA_ALLOC(size, dma);
++}
++
++/**
++ * This function initializes the CFI object.
++ */
++int init_cfi(cfiobject_t * cfiobj)
++{
++	CFI_INFO("%s\n", __func__);
++
++	/* Allocate a buffer for IN XFERs */
++	cfiobj->buf_in.buf =
++	    DWC_DMA_ALLOC(CFI_IN_BUF_LEN, &cfiobj->buf_in.addr);
++	if (NULL == cfiobj->buf_in.buf) {
++		CFI_INFO("Unable to allocate buffer for INs\n");
++		return -DWC_E_NO_MEMORY;
++	}
++
++	/* Allocate a buffer for OUT XFERs */
++	cfiobj->buf_out.buf =
++	    DWC_DMA_ALLOC(CFI_OUT_BUF_LEN, &cfiobj->buf_out.addr);
++	if (NULL == cfiobj->buf_out.buf) {
++		CFI_INFO("Unable to allocate buffer for OUT\n");
++		return -DWC_E_NO_MEMORY;
++	}
++
++	/* Initialize the callback function pointers */
++	cfiobj->ops.release = cfi_release;
++	cfiobj->ops.ep_enable = cfi_ep_enable;
++	cfiobj->ops.ctrl_write_complete = cfi_ctrl_write_complete;
++	cfiobj->ops.build_descriptors = cfi_build_descriptors;
++	cfiobj->ops.ep_alloc_buf = cfi_ep_alloc_buf;
++
++	/* Initialize the list of active endpoints in the CFI object */
++	DWC_LIST_INIT(&cfiobj->active_eps);
++
++	return 0;
++}
++
++/**
++ * This function reads the required feature's current value into the buffer
++ *
++ * @retval: Returns negative as error, or the data length of the feature
++ */
++static int cfi_get_feature_value(uint8_t * buf, uint16_t buflen,
++				 struct dwc_otg_pcd *pcd,
++				 struct cfi_usb_ctrlrequest *ctrl_req)
++{
++	int retval = -DWC_E_NOT_SUPPORTED;
++	struct dwc_otg_core_if *coreif = GET_CORE_IF(pcd);
++	uint16_t dfifo, rxfifo, txfifo;
++
++	switch (ctrl_req->wIndex) {
++		/* Whether the DDMA is enabled or not */
++	case FT_ID_DMA_MODE:
++		*buf = (coreif->dma_enable && coreif->dma_desc_enable) ? 1 : 0;
++		retval = 1;
++		break;
++
++	case FT_ID_DMA_BUFFER_SETUP:
++		retval = cfi_ep_get_sg_val(buf, pcd, ctrl_req);
++		break;
++
++	case FT_ID_DMA_BUFF_ALIGN:
++		retval = cfi_ep_get_align_val(buf, pcd, ctrl_req);
++		break;
++
++	case FT_ID_DMA_CONCAT_SETUP:
++		retval = cfi_ep_get_concat_val(buf, pcd, ctrl_req);
++		break;
++
++	case FT_ID_DMA_CIRCULAR:
++		CFI_INFO("GetFeature value (FT_ID_DMA_CIRCULAR)\n");
++		break;
++
++	case FT_ID_THRESHOLD_SETUP:
++		CFI_INFO("GetFeature value (FT_ID_THRESHOLD_SETUP)\n");
++		break;
++
++	case FT_ID_DFIFO_DEPTH:
++		dfifo = get_dfifo_size(coreif);
++		*((uint16_t *) buf) = dfifo;
++		retval = sizeof(uint16_t);
++		break;
++
++	case FT_ID_TX_FIFO_DEPTH:
++		retval = get_txfifo_size(pcd, ctrl_req->wValue);
++		if (retval >= 0) {
++			txfifo = retval;
++			*((uint16_t *) buf) = txfifo;
++			retval = sizeof(uint16_t);
++		}
++		break;
++
++	case FT_ID_RX_FIFO_DEPTH:
++		retval = get_rxfifo_size(coreif, ctrl_req->wValue);
++		if (retval >= 0) {
++			rxfifo = retval;
++			*((uint16_t *) buf) = rxfifo;
++			retval = sizeof(uint16_t);
++		}
++		break;
++	}
++
++	return retval;
++}
++
++/**
++ * This function resets the SG for the specified EP to its default value
++ */
++static int cfi_reset_sg_val(cfi_ep_t * cfiep)
++{
++	dwc_memset(cfiep->bm_sg, 0, sizeof(ddma_sg_buffer_setup_t));
++	return 0;
++}
++
++/**
++ * This function resets the Alignment for the specified EP to its default value
++ */
++static int cfi_reset_align_val(cfi_ep_t * cfiep)
++{
++	dwc_memset(cfiep->bm_sg, 0, sizeof(ddma_sg_buffer_setup_t));
++	return 0;
++}
++
++/**
++ * This function resets the Concatenation for the specified EP to its default value
++ * This function will also set the value of the wTxBytes field to NULL after
++ * freeing the memory previously allocated for this field.
++ */
++static int cfi_reset_concat_val(cfi_ep_t * cfiep)
++{
++	/* First we need to free the wTxBytes field */
++	if (cfiep->bm_concat->wTxBytes) {
++		DWC_FREE(cfiep->bm_concat->wTxBytes);
++		cfiep->bm_concat->wTxBytes = NULL;
++	}
++
++	dwc_memset(cfiep->bm_concat, 0, sizeof(ddma_concat_buffer_setup_t));
++	return 0;
++}
++
++/**
++ * This function resets all the buffer setups of the specified endpoint
++ */
++static int cfi_ep_reset_all_setup_vals(cfi_ep_t * cfiep)
++{
++	cfi_reset_sg_val(cfiep);
++	cfi_reset_align_val(cfiep);
++	cfi_reset_concat_val(cfiep);
++	return 0;
++}
++
++static int cfi_handle_reset_fifo_val(struct dwc_otg_pcd *pcd, uint8_t ep_addr,
++				     uint8_t rx_rst, uint8_t tx_rst)
++{
++	int retval = -DWC_E_INVALID;
++	uint16_t tx_siz[15];
++	uint16_t rx_siz = 0;
++	dwc_otg_pcd_ep_t *ep = NULL;
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_core_params_t *params = GET_CORE_IF(pcd)->core_params;
++
++	if (rx_rst) {
++		rx_siz = params->dev_rx_fifo_size;
++		params->dev_rx_fifo_size = GET_CORE_IF(pcd)->init_rxfsiz;
++	}
++
++	if (tx_rst) {
++		if (ep_addr == 0) {
++			int i;
++
++			for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
++				tx_siz[i] =
++				    core_if->core_params->dev_tx_fifo_size[i];
++				core_if->core_params->dev_tx_fifo_size[i] =
++				    core_if->init_txfsiz[i];
++			}
++		} else {
++
++			ep = get_ep_by_addr(pcd, ep_addr);
++
++			if (NULL == ep) {
++				CFI_INFO
++				    ("%s: Unable to get the endpoint addr=0x%02x\n",
++				     __func__, ep_addr);
++				return -DWC_E_INVALID;
++			}
++
++			tx_siz[0] =
++			    params->dev_tx_fifo_size[ep->dwc_ep.tx_fifo_num -
++						     1];
++			params->dev_tx_fifo_size[ep->dwc_ep.tx_fifo_num - 1] =
++			    GET_CORE_IF(pcd)->init_txfsiz[ep->
++							  dwc_ep.tx_fifo_num -
++							  1];
++		}
++	}
++
++	if (resize_fifos(GET_CORE_IF(pcd))) {
++		retval = 0;
++	} else {
++		CFI_INFO
++		    ("%s: Error resetting the feature Reset All(FIFO size)\n",
++		     __func__);
++		if (rx_rst) {
++			params->dev_rx_fifo_size = rx_siz;
++		}
++
++		if (tx_rst) {
++			if (ep_addr == 0) {
++				int i;
++				for (i = 0; i < core_if->hwcfg4.b.num_in_eps;
++				     i++) {
++					core_if->
++					    core_params->dev_tx_fifo_size[i] =
++					    tx_siz[i];
++				}
++			} else {
++				params->dev_tx_fifo_size[ep->
++							 dwc_ep.tx_fifo_num -
++							 1] = tx_siz[0];
++			}
++		}
++		retval = -DWC_E_INVALID;
++	}
++	return retval;
++}
++
++static int cfi_handle_reset_all(struct dwc_otg_pcd *pcd, uint8_t addr)
++{
++	int retval = 0;
++	cfi_ep_t *cfiep;
++	cfiobject_t *cfi = pcd->cfi;
++	dwc_list_link_t *tmp;
++
++	retval = cfi_handle_reset_fifo_val(pcd, addr, 1, 1);
++	if (retval < 0) {
++		return retval;
++	}
++
++	/* If the EP address is known then reset the features for only that EP */
++	if (addr) {
++		cfiep = get_cfi_ep_by_addr(pcd->cfi, addr);
++		if (NULL == cfiep) {
++			CFI_INFO("%s: Error getting the EP address 0x%02x\n",
++				 __func__, addr);
++			return -DWC_E_INVALID;
++		}
++		retval = cfi_ep_reset_all_setup_vals(cfiep);
++		cfiep->ep->dwc_ep.buff_mode = BM_STANDARD;
++	}
++	/* Otherwise (wValue == 0), reset all features of all EP's */
++	else {
++		/* Traverse all the active EP's and reset the feature(s) value(s) */
++		//list_for_each_entry(cfiep, &cfi->active_eps, lh) {
++		DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
++			cfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
++			retval = cfi_ep_reset_all_setup_vals(cfiep);
++			cfiep->ep->dwc_ep.buff_mode = BM_STANDARD;
++			if (retval < 0) {
++				CFI_INFO
++				    ("%s: Error resetting the feature Reset All\n",
++				     __func__);
++				return retval;
++			}
++		}
++	}
++	return retval;
++}
++
++static int cfi_handle_reset_dma_buff_setup(struct dwc_otg_pcd *pcd,
++					   uint8_t addr)
++{
++	int retval = 0;
++	cfi_ep_t *cfiep;
++	cfiobject_t *cfi = pcd->cfi;
++	dwc_list_link_t *tmp;
++
++	/* If the EP address is known then reset the features for only that EP */
++	if (addr) {
++		cfiep = get_cfi_ep_by_addr(pcd->cfi, addr);
++		if (NULL == cfiep) {
++			CFI_INFO("%s: Error getting the EP address 0x%02x\n",
++				 __func__, addr);
++			return -DWC_E_INVALID;
++		}
++		retval = cfi_reset_sg_val(cfiep);
++	}
++	/* Otherwise (wValue == 0), reset all features of all EP's */
++	else {
++		/* Traverse all the active EP's and reset the feature(s) value(s) */
++		//list_for_each_entry(cfiep, &cfi->active_eps, lh) {
++		DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
++			cfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
++			retval = cfi_reset_sg_val(cfiep);
++			if (retval < 0) {
++				CFI_INFO
++				    ("%s: Error resetting the feature Buffer Setup\n",
++				     __func__);
++				return retval;
++			}
++		}
++	}
++	return retval;
++}
++
++static int cfi_handle_reset_concat_val(struct dwc_otg_pcd *pcd, uint8_t addr)
++{
++	int retval = 0;
++	cfi_ep_t *cfiep;
++	cfiobject_t *cfi = pcd->cfi;
++	dwc_list_link_t *tmp;
++
++	/* If the EP address is known then reset the features for only that EP */
++	if (addr) {
++		cfiep = get_cfi_ep_by_addr(pcd->cfi, addr);
++		if (NULL == cfiep) {
++			CFI_INFO("%s: Error getting the EP address 0x%02x\n",
++				 __func__, addr);
++			return -DWC_E_INVALID;
++		}
++		retval = cfi_reset_concat_val(cfiep);
++	}
++	/* Otherwise (wValue == 0), reset all features of all EP's */
++	else {
++		/* Traverse all the active EP's and reset the feature(s) value(s) */
++		//list_for_each_entry(cfiep, &cfi->active_eps, lh) {
++		DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
++			cfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
++			retval = cfi_reset_concat_val(cfiep);
++			if (retval < 0) {
++				CFI_INFO
++				    ("%s: Error resetting the feature Concatenation Value\n",
++				     __func__);
++				return retval;
++			}
++		}
++	}
++	return retval;
++}
++
++static int cfi_handle_reset_align_val(struct dwc_otg_pcd *pcd, uint8_t addr)
++{
++	int retval = 0;
++	cfi_ep_t *cfiep;
++	cfiobject_t *cfi = pcd->cfi;
++	dwc_list_link_t *tmp;
++
++	/* If the EP address is known then reset the features for only that EP */
++	if (addr) {
++		cfiep = get_cfi_ep_by_addr(pcd->cfi, addr);
++		if (NULL == cfiep) {
++			CFI_INFO("%s: Error getting the EP address 0x%02x\n",
++				 __func__, addr);
++			return -DWC_E_INVALID;
++		}
++		retval = cfi_reset_align_val(cfiep);
++	}
++	/* Otherwise (wValue == 0), reset all features of all EP's */
++	else {
++		/* Traverse all the active EP's and reset the feature(s) value(s) */
++		//list_for_each_entry(cfiep, &cfi->active_eps, lh) {
++		DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
++			cfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
++			retval = cfi_reset_align_val(cfiep);
++			if (retval < 0) {
++				CFI_INFO
++				    ("%s: Error resetting the feature Aliignment Value\n",
++				     __func__);
++				return retval;
++			}
++		}
++	}
++	return retval;
++
++}
++
++static int cfi_preproc_reset(struct dwc_otg_pcd *pcd,
++			     struct cfi_usb_ctrlrequest *req)
++{
++	int retval = 0;
++
++	switch (req->wIndex) {
++	case 0:
++		/* Reset all features */
++		retval = cfi_handle_reset_all(pcd, req->wValue & 0xff);
++		break;
++
++	case FT_ID_DMA_BUFFER_SETUP:
++		/* Reset the SG buffer setup */
++		retval =
++		    cfi_handle_reset_dma_buff_setup(pcd, req->wValue & 0xff);
++		break;
++
++	case FT_ID_DMA_CONCAT_SETUP:
++		/* Reset the Concatenation buffer setup */
++		retval = cfi_handle_reset_concat_val(pcd, req->wValue & 0xff);
++		break;
++
++	case FT_ID_DMA_BUFF_ALIGN:
++		/* Reset the Alignment buffer setup */
++		retval = cfi_handle_reset_align_val(pcd, req->wValue & 0xff);
++		break;
++
++	case FT_ID_TX_FIFO_DEPTH:
++		retval =
++		    cfi_handle_reset_fifo_val(pcd, req->wValue & 0xff, 0, 1);
++		pcd->cfi->need_gadget_att = 0;
++		break;
++
++	case FT_ID_RX_FIFO_DEPTH:
++		retval = cfi_handle_reset_fifo_val(pcd, 0, 1, 0);
++		pcd->cfi->need_gadget_att = 0;
++		break;
++	default:
++		break;
++	}
++	return retval;
++}
++
++/**
++ * This function sets a new value for the SG buffer setup.
++ */
++static int cfi_ep_set_sg_val(uint8_t * buf, struct dwc_otg_pcd *pcd)
++{
++	uint8_t inaddr, outaddr;
++	cfi_ep_t *epin, *epout;
++	ddma_sg_buffer_setup_t *psgval;
++	uint32_t desccount, size;
++
++	CFI_INFO("%s\n", __func__);
++
++	psgval = (ddma_sg_buffer_setup_t *) buf;
++	desccount = (uint32_t) psgval->bCount;
++	size = (uint32_t) psgval->wSize;
++
++	/* Check the DMA descriptor count */
++	if ((desccount > MAX_DMA_DESCS_PER_EP) || (desccount == 0)) {
++		CFI_INFO
++		    ("%s: The count of DMA Descriptors should be between 1 and %d\n",
++		     __func__, MAX_DMA_DESCS_PER_EP);
++		return -DWC_E_INVALID;
++	}
++
++	/* Check the DMA descriptor count */
++
++	if (size == 0) {
++
++		CFI_INFO("%s: The transfer size should be at least 1 byte\n",
++			 __func__);
++
++		return -DWC_E_INVALID;
++
++	}
++
++	inaddr = psgval->bInEndpointAddress;
++	outaddr = psgval->bOutEndpointAddress;
++
++	epin = get_cfi_ep_by_addr(pcd->cfi, inaddr);
++	epout = get_cfi_ep_by_addr(pcd->cfi, outaddr);
++
++	if (NULL == epin || NULL == epout) {
++		CFI_INFO
++		    ("%s: Unable to get the endpoints inaddr=0x%02x outaddr=0x%02x\n",
++		     __func__, inaddr, outaddr);
++		return -DWC_E_INVALID;
++	}
++
++	epin->ep->dwc_ep.buff_mode = BM_SG;
++	dwc_memcpy(epin->bm_sg, psgval, sizeof(ddma_sg_buffer_setup_t));
++
++	epout->ep->dwc_ep.buff_mode = BM_SG;
++	dwc_memcpy(epout->bm_sg, psgval, sizeof(ddma_sg_buffer_setup_t));
++
++	return 0;
++}
++
++/**
++ * This function sets a new value for the buffer Alignment setup.
++ */
++static int cfi_ep_set_alignment_val(uint8_t * buf, struct dwc_otg_pcd *pcd)
++{
++	cfi_ep_t *ep;
++	uint8_t addr;
++	ddma_align_buffer_setup_t *palignval;
++
++	palignval = (ddma_align_buffer_setup_t *) buf;
++	addr = palignval->bEndpointAddress;
++
++	ep = get_cfi_ep_by_addr(pcd->cfi, addr);
++
++	if (NULL == ep) {
++		CFI_INFO("%s: Unable to get the endpoint addr=0x%02x\n",
++			 __func__, addr);
++		return -DWC_E_INVALID;
++	}
++
++	ep->ep->dwc_ep.buff_mode = BM_ALIGN;
++	dwc_memcpy(ep->bm_align, palignval, sizeof(ddma_align_buffer_setup_t));
++
++	return 0;
++}
++
++/**
++ * This function sets a new value for the Concatenation buffer setup.
++ */
++static int cfi_ep_set_concat_val(uint8_t * buf, struct dwc_otg_pcd *pcd)
++{
++	uint8_t addr;
++	cfi_ep_t *ep;
++	struct _ddma_concat_buffer_setup_hdr *pConcatValHdr;
++	uint16_t *pVals;
++	uint32_t desccount;
++	int i;
++	uint16_t mps;
++
++	pConcatValHdr = (struct _ddma_concat_buffer_setup_hdr *)buf;
++	desccount = (uint32_t) pConcatValHdr->bDescCount;
++	pVals = (uint16_t *) (buf + BS_CONCAT_VAL_HDR_LEN);
++
++	/* Check the DMA descriptor count */
++	if (desccount > MAX_DMA_DESCS_PER_EP) {
++		CFI_INFO("%s: Maximum DMA Descriptor count should be %d\n",
++			 __func__, MAX_DMA_DESCS_PER_EP);
++		return -DWC_E_INVALID;
++	}
++
++	addr = pConcatValHdr->bEndpointAddress;
++	ep = get_cfi_ep_by_addr(pcd->cfi, addr);
++	if (NULL == ep) {
++		CFI_INFO("%s: Unable to get the endpoint addr=0x%02x\n",
++			 __func__, addr);
++		return -DWC_E_INVALID;
++	}
++
++	mps = UGETW(ep->ep->desc->wMaxPacketSize);
++
++#if 0
++	for (i = 0; i < desccount; i++) {
++		CFI_INFO("%s: wTxSize[%d]=0x%04x\n", __func__, i, pVals[i]);
++	}
++	CFI_INFO("%s: epname=%s; mps=%d\n", __func__, ep->ep->ep.name, mps);
++#endif
++
++	/* Check the wTxSizes to be less than or equal to the mps */
++	for (i = 0; i < desccount; i++) {
++		if (pVals[i] > mps) {
++			CFI_INFO
++			    ("%s: ERROR - the wTxSize[%d] should be <= MPS (wTxSize=%d)\n",
++			     __func__, i, pVals[i]);
++			return -DWC_E_INVALID;
++		}
++	}
++
++	ep->ep->dwc_ep.buff_mode = BM_CONCAT;
++	dwc_memcpy(ep->bm_concat, pConcatValHdr, BS_CONCAT_VAL_HDR_LEN);
++
++	/* Free the previously allocated storage for the wTxBytes */
++	if (ep->bm_concat->wTxBytes) {
++		DWC_FREE(ep->bm_concat->wTxBytes);
++	}
++
++	/* Allocate a new storage for the wTxBytes field */
++	ep->bm_concat->wTxBytes =
++	    DWC_ALLOC(sizeof(uint16_t) * pConcatValHdr->bDescCount);
++	if (NULL == ep->bm_concat->wTxBytes) {
++		CFI_INFO("%s: Unable to allocate memory\n", __func__);
++		return -DWC_E_NO_MEMORY;
++	}
++
++	/* Copy the new values into the wTxBytes filed */
++	dwc_memcpy(ep->bm_concat->wTxBytes, buf + BS_CONCAT_VAL_HDR_LEN,
++		   sizeof(uint16_t) * pConcatValHdr->bDescCount);
++
++	return 0;
++}
++
++/**
++ * This function calculates the total of all FIFO sizes
++ *
++ * @param core_if Programming view of DWC_otg controller
++ *
++ * @return The total of data FIFO sizes.
++ *
++ */
++static uint16_t get_dfifo_size(dwc_otg_core_if_t * core_if)
++{
++	dwc_otg_core_params_t *params = core_if->core_params;
++	uint16_t dfifo_total = 0;
++	int i;
++
++	/* The shared RxFIFO size */
++	dfifo_total =
++	    params->dev_rx_fifo_size + params->dev_nperio_tx_fifo_size;
++
++	/* Add up each TxFIFO size to the total */
++	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
++		dfifo_total += params->dev_tx_fifo_size[i];
++	}
++
++	return dfifo_total;
++}
++
++/**
++ * This function returns Rx FIFO size
++ *
++ * @param core_if Programming view of DWC_otg controller
++ *
++ * @return The total of data FIFO sizes.
++ *
++ */
++static int32_t get_rxfifo_size(dwc_otg_core_if_t * core_if, uint16_t wValue)
++{
++	switch (wValue >> 8) {
++	case 0:
++		return (core_if->pwron_rxfsiz <
++			32768) ? core_if->pwron_rxfsiz : 32768;
++		break;
++	case 1:
++		return core_if->core_params->dev_rx_fifo_size;
++		break;
++	default:
++		return -DWC_E_INVALID;
++		break;
++	}
++}
++
++/**
++ * This function returns Tx FIFO size for IN EP
++ *
++ * @param core_if Programming view of DWC_otg controller
++ *
++ * @return The total of data FIFO sizes.
++ *
++ */
++static int32_t get_txfifo_size(struct dwc_otg_pcd *pcd, uint16_t wValue)
++{
++	dwc_otg_pcd_ep_t *ep;
++
++	ep = get_ep_by_addr(pcd, wValue & 0xff);
++
++	if (NULL == ep) {
++		CFI_INFO("%s: Unable to get the endpoint addr=0x%02x\n",
++			 __func__, wValue & 0xff);
++		return -DWC_E_INVALID;
++	}
++
++	if (!ep->dwc_ep.is_in) {
++		CFI_INFO
++		    ("%s: No Tx FIFO assingned to the Out endpoint addr=0x%02x\n",
++		     __func__, wValue & 0xff);
++		return -DWC_E_INVALID;
++	}
++
++	switch (wValue >> 8) {
++	case 0:
++		return (GET_CORE_IF(pcd)->pwron_txfsiz
++			[ep->dwc_ep.tx_fifo_num - 1] <
++			768) ? GET_CORE_IF(pcd)->pwron_txfsiz[ep->
++							      dwc_ep.tx_fifo_num
++							      - 1] : 32768;
++		break;
++	case 1:
++		return GET_CORE_IF(pcd)->core_params->
++		    dev_tx_fifo_size[ep->dwc_ep.num - 1];
++		break;
++	default:
++		return -DWC_E_INVALID;
++		break;
++	}
++}
++
++/**
++ * This function checks if the submitted combination of
++ * device mode FIFO sizes is possible or not.
++ *
++ * @param core_if Programming view of DWC_otg controller
++ *
++ * @return 1 if possible, 0 otherwise.
++ *
++ */
++static uint8_t check_fifo_sizes(dwc_otg_core_if_t * core_if)
++{
++	uint16_t dfifo_actual = 0;
++	dwc_otg_core_params_t *params = core_if->core_params;
++	uint16_t start_addr = 0;
++	int i;
++
++	dfifo_actual =
++	    params->dev_rx_fifo_size + params->dev_nperio_tx_fifo_size;
++
++	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
++		dfifo_actual += params->dev_tx_fifo_size[i];
++	}
++
++	if (dfifo_actual > core_if->total_fifo_size) {
++		return 0;
++	}
++
++	if (params->dev_rx_fifo_size > 32768 || params->dev_rx_fifo_size < 16)
++		return 0;
++
++	if (params->dev_nperio_tx_fifo_size > 32768
++	    || params->dev_nperio_tx_fifo_size < 16)
++		return 0;
++
++	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
++
++		if (params->dev_tx_fifo_size[i] > 768
++		    || params->dev_tx_fifo_size[i] < 4)
++			return 0;
++	}
++
++	if (params->dev_rx_fifo_size > core_if->pwron_rxfsiz)
++		return 0;
++	start_addr = params->dev_rx_fifo_size;
++
++	if (params->dev_nperio_tx_fifo_size > core_if->pwron_gnptxfsiz)
++		return 0;
++	start_addr += params->dev_nperio_tx_fifo_size;
++
++	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
++
++		if (params->dev_tx_fifo_size[i] > core_if->pwron_txfsiz[i])
++			return 0;
++		start_addr += params->dev_tx_fifo_size[i];
++	}
++
++	return 1;
++}
++
++/**
++ * This function resizes Device mode FIFOs
++ *
++ * @param core_if Programming view of DWC_otg controller
++ *
++ * @return 1 if successful, 0 otherwise
++ *
++ */
++static uint8_t resize_fifos(dwc_otg_core_if_t * core_if)
++{
++	int i = 0;
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	dwc_otg_core_params_t *params = core_if->core_params;
++	uint32_t rx_fifo_size;
++	fifosize_data_t nptxfifosize;
++	fifosize_data_t txfifosize[15];
++
++	uint32_t rx_fsz_bak;
++	uint32_t nptxfsz_bak;
++	uint32_t txfsz_bak[15];
++
++	uint16_t start_address;
++	uint8_t retval = 1;
++
++	if (!check_fifo_sizes(core_if)) {
++		return 0;
++	}
++
++	/* Configure data FIFO sizes */
++	if (core_if->hwcfg2.b.dynamic_fifo && params->enable_dynamic_fifo) {
++		rx_fsz_bak = DWC_READ_REG32(&global_regs->grxfsiz);
++		rx_fifo_size = params->dev_rx_fifo_size;
++		DWC_WRITE_REG32(&global_regs->grxfsiz, rx_fifo_size);
++
++		/*
++		 * Tx FIFOs These FIFOs are numbered from 1 to 15.
++		 * Indexes of the FIFO size module parameters in the
++		 * dev_tx_fifo_size array and the FIFO size registers in
++		 * the dtxfsiz array run from 0 to 14.
++		 */
++
++		/* Non-periodic Tx FIFO */
++		nptxfsz_bak = DWC_READ_REG32(&global_regs->gnptxfsiz);
++		nptxfifosize.b.depth = params->dev_nperio_tx_fifo_size;
++		start_address = params->dev_rx_fifo_size;
++		nptxfifosize.b.startaddr = start_address;
++
++		DWC_WRITE_REG32(&global_regs->gnptxfsiz, nptxfifosize.d32);
++
++		start_address += nptxfifosize.b.depth;
++
++		for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
++			txfsz_bak[i] = DWC_READ_REG32(&global_regs->dtxfsiz[i]);
++
++			txfifosize[i].b.depth = params->dev_tx_fifo_size[i];
++			txfifosize[i].b.startaddr = start_address;
++			DWC_WRITE_REG32(&global_regs->dtxfsiz[i],
++					txfifosize[i].d32);
++
++			start_address += txfifosize[i].b.depth;
++		}
++
++		/** Check if register values are set correctly */
++		if (rx_fifo_size != DWC_READ_REG32(&global_regs->grxfsiz)) {
++			retval = 0;
++		}
++
++		if (nptxfifosize.d32 != DWC_READ_REG32(&global_regs->gnptxfsiz)) {
++			retval = 0;
++		}
++
++		for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
++			if (txfifosize[i].d32 !=
++			    DWC_READ_REG32(&global_regs->dtxfsiz[i])) {
++				retval = 0;
++			}
++		}
++
++		/** If register values are not set correctly, reset old values */
++		if (retval == 0) {
++			DWC_WRITE_REG32(&global_regs->grxfsiz, rx_fsz_bak);
++
++			/* Non-periodic Tx FIFO */
++			DWC_WRITE_REG32(&global_regs->gnptxfsiz, nptxfsz_bak);
++
++			for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
++				DWC_WRITE_REG32(&global_regs->dtxfsiz[i],
++						txfsz_bak[i]);
++			}
++		}
++	} else {
++		return 0;
++	}
++
++	/* Flush the FIFOs */
++	dwc_otg_flush_tx_fifo(core_if, 0x10);	/* all Tx FIFOs */
++	dwc_otg_flush_rx_fifo(core_if);
++
++	return retval;
++}
++
++/**
++ * This function sets a new value for the buffer Alignment setup.
++ */
++static int cfi_ep_set_tx_fifo_val(uint8_t * buf, dwc_otg_pcd_t * pcd)
++{
++	int retval;
++	uint32_t fsiz;
++	uint16_t size;
++	uint16_t ep_addr;
++	dwc_otg_pcd_ep_t *ep;
++	dwc_otg_core_params_t *params = GET_CORE_IF(pcd)->core_params;
++	tx_fifo_size_setup_t *ptxfifoval;
++
++	ptxfifoval = (tx_fifo_size_setup_t *) buf;
++	ep_addr = ptxfifoval->bEndpointAddress;
++	size = ptxfifoval->wDepth;
++
++	ep = get_ep_by_addr(pcd, ep_addr);
++
++	CFI_INFO
++	    ("%s: Set Tx FIFO size: endpoint addr=0x%02x, depth=%d, FIFO Num=%d\n",
++	     __func__, ep_addr, size, ep->dwc_ep.tx_fifo_num);
++
++	if (NULL == ep) {
++		CFI_INFO("%s: Unable to get the endpoint addr=0x%02x\n",
++			 __func__, ep_addr);
++		return -DWC_E_INVALID;
++	}
++
++	fsiz = params->dev_tx_fifo_size[ep->dwc_ep.tx_fifo_num - 1];
++	params->dev_tx_fifo_size[ep->dwc_ep.tx_fifo_num - 1] = size;
++
++	if (resize_fifos(GET_CORE_IF(pcd))) {
++		retval = 0;
++	} else {
++		CFI_INFO
++		    ("%s: Error setting the feature Tx FIFO Size for EP%d\n",
++		     __func__, ep_addr);
++		params->dev_tx_fifo_size[ep->dwc_ep.tx_fifo_num - 1] = fsiz;
++		retval = -DWC_E_INVALID;
++	}
++
++	return retval;
++}
++
++/**
++ * This function sets a new value for the buffer Alignment setup.
++ */
++static int cfi_set_rx_fifo_val(uint8_t * buf, dwc_otg_pcd_t * pcd)
++{
++	int retval;
++	uint32_t fsiz;
++	uint16_t size;
++	dwc_otg_core_params_t *params = GET_CORE_IF(pcd)->core_params;
++	rx_fifo_size_setup_t *prxfifoval;
++
++	prxfifoval = (rx_fifo_size_setup_t *) buf;
++	size = prxfifoval->wDepth;
++
++	fsiz = params->dev_rx_fifo_size;
++	params->dev_rx_fifo_size = size;
++
++	if (resize_fifos(GET_CORE_IF(pcd))) {
++		retval = 0;
++	} else {
++		CFI_INFO("%s: Error setting the feature Rx FIFO Size\n",
++			 __func__);
++		params->dev_rx_fifo_size = fsiz;
++		retval = -DWC_E_INVALID;
++	}
++
++	return retval;
++}
++
++/**
++ * This function reads the SG of an EP's buffer setup into the buffer buf
++ */
++static int cfi_ep_get_sg_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
++			     struct cfi_usb_ctrlrequest *req)
++{
++	int retval = -DWC_E_INVALID;
++	uint8_t addr;
++	cfi_ep_t *ep;
++
++	/* The Low Byte of the wValue contains a non-zero address of the endpoint */
++	addr = req->wValue & 0xFF;
++	if (addr == 0)		/* The address should be non-zero */
++		return retval;
++
++	ep = get_cfi_ep_by_addr(pcd->cfi, addr);
++	if (NULL == ep) {
++		CFI_INFO("%s: Unable to get the endpoint address(0x%02x)\n",
++			 __func__, addr);
++		return retval;
++	}
++
++	dwc_memcpy(buf, ep->bm_sg, BS_SG_VAL_DESC_LEN);
++	retval = BS_SG_VAL_DESC_LEN;
++	return retval;
++}
++
++/**
++ * This function reads the Concatenation value of an EP's buffer mode into
++ * the buffer buf
++ */
++static int cfi_ep_get_concat_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
++				 struct cfi_usb_ctrlrequest *req)
++{
++	int retval = -DWC_E_INVALID;
++	uint8_t addr;
++	cfi_ep_t *ep;
++	uint8_t desc_count;
++
++	/* The Low Byte of the wValue contains a non-zero address of the endpoint */
++	addr = req->wValue & 0xFF;
++	if (addr == 0)		/* The address should be non-zero */
++		return retval;
++
++	ep = get_cfi_ep_by_addr(pcd->cfi, addr);
++	if (NULL == ep) {
++		CFI_INFO("%s: Unable to get the endpoint address(0x%02x)\n",
++			 __func__, addr);
++		return retval;
++	}
++
++	/* Copy the header to the buffer */
++	dwc_memcpy(buf, ep->bm_concat, BS_CONCAT_VAL_HDR_LEN);
++	/* Advance the buffer pointer by the header size */
++	buf += BS_CONCAT_VAL_HDR_LEN;
++
++	desc_count = ep->bm_concat->hdr.bDescCount;
++	/* Copy alll the wTxBytes to the buffer */
++	dwc_memcpy(buf, ep->bm_concat->wTxBytes, sizeof(uid16_t) * desc_count);
++
++	retval = BS_CONCAT_VAL_HDR_LEN + sizeof(uid16_t) * desc_count;
++	return retval;
++}
++
++/**
++ * This function reads the buffer Alignment value of an EP's buffer mode into
++ * the buffer buf
++ *
++ * @return The total number of bytes copied to the buffer or negative error code.
++ */
++static int cfi_ep_get_align_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
++				struct cfi_usb_ctrlrequest *req)
++{
++	int retval = -DWC_E_INVALID;
++	uint8_t addr;
++	cfi_ep_t *ep;
++
++	/* The Low Byte of the wValue contains a non-zero address of the endpoint */
++	addr = req->wValue & 0xFF;
++	if (addr == 0)		/* The address should be non-zero */
++		return retval;
++
++	ep = get_cfi_ep_by_addr(pcd->cfi, addr);
++	if (NULL == ep) {
++		CFI_INFO("%s: Unable to get the endpoint address(0x%02x)\n",
++			 __func__, addr);
++		return retval;
++	}
++
++	dwc_memcpy(buf, ep->bm_align, BS_ALIGN_VAL_HDR_LEN);
++	retval = BS_ALIGN_VAL_HDR_LEN;
++
++	return retval;
++}
++
++/**
++ * This function sets a new value for the specified feature
++ *
++ * @param	pcd	A pointer to the PCD object
++ *
++ * @return 0 if successful, negative error code otherwise to stall the DCE.
++ */
++static int cfi_set_feature_value(struct dwc_otg_pcd *pcd)
++{
++	int retval = -DWC_E_NOT_SUPPORTED;
++	uint16_t wIndex, wValue;
++	uint8_t bRequest;
++	struct dwc_otg_core_if *coreif;
++	cfiobject_t *cfi = pcd->cfi;
++	struct cfi_usb_ctrlrequest *ctrl_req;
++	uint8_t *buf;
++	ctrl_req = &cfi->ctrl_req;
++
++	buf = pcd->cfi->ctrl_req.data;
++
++	coreif = GET_CORE_IF(pcd);
++	bRequest = ctrl_req->bRequest;
++	wIndex = DWC_CONSTANT_CPU_TO_LE16(ctrl_req->wIndex);
++	wValue = DWC_CONSTANT_CPU_TO_LE16(ctrl_req->wValue);
++
++	/* See which feature is to be modified */
++	switch (wIndex) {
++	case FT_ID_DMA_BUFFER_SETUP:
++		/* Modify the feature */
++		if ((retval = cfi_ep_set_sg_val(buf, pcd)) < 0)
++			return retval;
++
++		/* And send this request to the gadget */
++		cfi->need_gadget_att = 1;
++		break;
++
++	case FT_ID_DMA_BUFF_ALIGN:
++		if ((retval = cfi_ep_set_alignment_val(buf, pcd)) < 0)
++			return retval;
++		cfi->need_gadget_att = 1;
++		break;
++
++	case FT_ID_DMA_CONCAT_SETUP:
++		/* Modify the feature */
++		if ((retval = cfi_ep_set_concat_val(buf, pcd)) < 0)
++			return retval;
++		cfi->need_gadget_att = 1;
++		break;
++
++	case FT_ID_DMA_CIRCULAR:
++		CFI_INFO("FT_ID_DMA_CIRCULAR\n");
++		break;
++
++	case FT_ID_THRESHOLD_SETUP:
++		CFI_INFO("FT_ID_THRESHOLD_SETUP\n");
++		break;
++
++	case FT_ID_DFIFO_DEPTH:
++		CFI_INFO("FT_ID_DFIFO_DEPTH\n");
++		break;
++
++	case FT_ID_TX_FIFO_DEPTH:
++		CFI_INFO("FT_ID_TX_FIFO_DEPTH\n");
++		if ((retval = cfi_ep_set_tx_fifo_val(buf, pcd)) < 0)
++			return retval;
++		cfi->need_gadget_att = 0;
++		break;
++
++	case FT_ID_RX_FIFO_DEPTH:
++		CFI_INFO("FT_ID_RX_FIFO_DEPTH\n");
++		if ((retval = cfi_set_rx_fifo_val(buf, pcd)) < 0)
++			return retval;
++		cfi->need_gadget_att = 0;
++		break;
++	}
++
++	return retval;
++}
++
++#endif //DWC_UTE_CFI
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_cfi.h
+@@ -0,0 +1,320 @@
++/* ==========================================================================
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++#if !defined(__DWC_OTG_CFI_H__)
++#define __DWC_OTG_CFI_H__
++
++#include "dwc_otg_pcd.h"
++#include "dwc_cfi_common.h"
++
++/**
++ * @file
++ * This file contains the CFI related OTG PCD specific common constants,
++ * interfaces(functions and macros) and data structures.The CFI Protocol is an
++ * optional interface for internal testing purposes that a DUT may implement to
++ * support testing of configurable features.
++ *
++ */
++
++struct dwc_otg_pcd;
++struct dwc_otg_pcd_ep;
++
++/** OTG CFI Features (properties) ID constants */
++/** This is a request for all Core Features */
++#define FT_ID_DMA_MODE					0x0001
++#define FT_ID_DMA_BUFFER_SETUP			0x0002
++#define FT_ID_DMA_BUFF_ALIGN			0x0003
++#define FT_ID_DMA_CONCAT_SETUP			0x0004
++#define FT_ID_DMA_CIRCULAR				0x0005
++#define FT_ID_THRESHOLD_SETUP			0x0006
++#define FT_ID_DFIFO_DEPTH				0x0007
++#define FT_ID_TX_FIFO_DEPTH				0x0008
++#define FT_ID_RX_FIFO_DEPTH				0x0009
++
++/**********************************************************/
++#define CFI_INFO_DEF
++
++#ifdef CFI_INFO_DEF
++#define CFI_INFO(fmt...)	DWC_PRINTF("CFI: " fmt);
++#else
++#define CFI_INFO(fmt...)
++#endif
++
++#define min(x,y) ({ \
++	x < y ? x : y; })
++
++#define max(x,y) ({ \
++	x > y ? x : y; })
++
++/**
++ * Descriptor DMA SG Buffer setup structure (SG buffer). This structure is
++ * also used for setting up a buffer for Circular DDMA.
++ */
++struct _ddma_sg_buffer_setup {
++#define BS_SG_VAL_DESC_LEN	6
++	/* The OUT EP address */
++	uint8_t bOutEndpointAddress;
++	/* The IN EP address */
++	uint8_t bInEndpointAddress;
++	/* Number of bytes to put between transfer segments (must be DWORD boundaries) */
++	uint8_t bOffset;
++	/* The number of transfer segments (a DMA descriptors per each segment) */
++	uint8_t bCount;
++	/* Size (in byte) of each transfer segment */
++	uint16_t wSize;
++} __attribute__ ((packed));
++typedef struct _ddma_sg_buffer_setup ddma_sg_buffer_setup_t;
++
++/** Descriptor DMA Concatenation Buffer setup structure */
++struct _ddma_concat_buffer_setup_hdr {
++#define BS_CONCAT_VAL_HDR_LEN	4
++	/* The endpoint for which the buffer is to be set up */
++	uint8_t bEndpointAddress;
++	/* The count of descriptors to be used */
++	uint8_t bDescCount;
++	/* The total size of the transfer */
++	uint16_t wSize;
++} __attribute__ ((packed));
++typedef struct _ddma_concat_buffer_setup_hdr ddma_concat_buffer_setup_hdr_t;
++
++/** Descriptor DMA Concatenation Buffer setup structure */
++struct _ddma_concat_buffer_setup {
++	/* The SG header */
++	ddma_concat_buffer_setup_hdr_t hdr;
++
++	/* The XFER sizes pointer (allocated dynamically) */
++	uint16_t *wTxBytes;
++} __attribute__ ((packed));
++typedef struct _ddma_concat_buffer_setup ddma_concat_buffer_setup_t;
++
++/** Descriptor DMA Alignment Buffer setup structure */
++struct _ddma_align_buffer_setup {
++#define BS_ALIGN_VAL_HDR_LEN	2
++	uint8_t bEndpointAddress;
++	uint8_t bAlign;
++} __attribute__ ((packed));
++typedef struct _ddma_align_buffer_setup ddma_align_buffer_setup_t;
++
++/** Transmit FIFO Size setup structure */
++struct _tx_fifo_size_setup {
++	uint8_t bEndpointAddress;
++	uint16_t wDepth;
++} __attribute__ ((packed));
++typedef struct _tx_fifo_size_setup tx_fifo_size_setup_t;
++
++/** Transmit FIFO Size setup structure */
++struct _rx_fifo_size_setup {
++	uint16_t wDepth;
++} __attribute__ ((packed));
++typedef struct _rx_fifo_size_setup rx_fifo_size_setup_t;
++
++/**
++ * struct cfi_usb_ctrlrequest - the CFI implementation of the struct usb_ctrlrequest
++ * This structure encapsulates the standard usb_ctrlrequest and adds a pointer
++ * to the data returned in the data stage of a 3-stage Control Write requests.
++ */
++struct cfi_usb_ctrlrequest {
++	uint8_t bRequestType;
++	uint8_t bRequest;
++	uint16_t wValue;
++	uint16_t wIndex;
++	uint16_t wLength;
++	uint8_t *data;
++} UPACKED;
++
++/*---------------------------------------------------------------------------*/
++
++/**
++ * The CFI wrapper of the enabled and activated dwc_otg_pcd_ep structures.
++ * This structure is used to store the buffer setup data for any
++ * enabled endpoint in the PCD.
++ */
++struct cfi_ep {
++	/* Entry for the list container */
++	dwc_list_link_t lh;
++	/* Pointer to the active PCD endpoint structure */
++	struct dwc_otg_pcd_ep *ep;
++	/* The last descriptor in the chain of DMA descriptors of the endpoint */
++	struct dwc_otg_dma_desc *dma_desc_last;
++	/* The SG feature value */
++	ddma_sg_buffer_setup_t *bm_sg;
++	/* The Circular feature value */
++	ddma_sg_buffer_setup_t *bm_circ;
++	/* The Concatenation feature value */
++	ddma_concat_buffer_setup_t *bm_concat;
++	/* The Alignment feature value */
++	ddma_align_buffer_setup_t *bm_align;
++	/* XFER length */
++	uint32_t xfer_len;
++	/*
++	 * Count of DMA descriptors currently used.
++	 * The total should not exceed the MAX_DMA_DESCS_PER_EP value
++	 * defined in the dwc_otg_cil.h
++	 */
++	uint32_t desc_count;
++};
++typedef struct cfi_ep cfi_ep_t;
++
++typedef struct cfi_dma_buff {
++#define CFI_IN_BUF_LEN	1024
++#define CFI_OUT_BUF_LEN	1024
++	dma_addr_t addr;
++	uint8_t *buf;
++} cfi_dma_buff_t;
++
++struct cfiobject;
++
++/**
++ * This is the interface for the CFI operations.
++ *
++ * @param	ep_enable			Called when any endpoint is enabled and activated.
++ * @param	release				Called when the CFI object is released and it needs to correctly
++ *								deallocate the dynamic memory
++ * @param	ctrl_write_complete	Called when the data stage of the request is complete
++ */
++typedef struct cfi_ops {
++	int (*ep_enable) (struct cfiobject * cfi, struct dwc_otg_pcd * pcd,
++			  struct dwc_otg_pcd_ep * ep);
++	void *(*ep_alloc_buf) (struct cfiobject * cfi, struct dwc_otg_pcd * pcd,
++			       struct dwc_otg_pcd_ep * ep, dma_addr_t * dma,
++			       unsigned size, gfp_t flags);
++	void (*release) (struct cfiobject * cfi);
++	int (*ctrl_write_complete) (struct cfiobject * cfi,
++				    struct dwc_otg_pcd * pcd);
++	void (*build_descriptors) (struct cfiobject * cfi,
++				   struct dwc_otg_pcd * pcd,
++				   struct dwc_otg_pcd_ep * ep,
++				   dwc_otg_pcd_request_t * req);
++} cfi_ops_t;
++
++struct cfiobject {
++	cfi_ops_t ops;
++	struct dwc_otg_pcd *pcd;
++	struct usb_gadget *gadget;
++
++	/* Buffers used to send/receive CFI-related request data */
++	cfi_dma_buff_t buf_in;
++	cfi_dma_buff_t buf_out;
++
++	/* CFI specific Control request wrapper */
++	struct cfi_usb_ctrlrequest ctrl_req;
++
++	/* The list of active EP's in the PCD of type cfi_ep_t */
++	dwc_list_link_t active_eps;
++
++	/* This flag shall control the propagation of a specific request
++	 * to the gadget's processing routines.
++	 * 0 - no gadget handling
++	 * 1 - the gadget needs to know about this request (w/o completing a status
++	 * phase - just return a 0 to the _setup callback)
++	 */
++	uint8_t need_gadget_att;
++
++	/* Flag indicating whether the status IN phase needs to be
++	 * completed by the PCD
++	 */
++	uint8_t need_status_in_complete;
++};
++typedef struct cfiobject cfiobject_t;
++
++#define DUMP_MSG
++
++#if defined(DUMP_MSG)
++static inline void dump_msg(const u8 * buf, unsigned int length)
++{
++	unsigned int start, num, i;
++	char line[52], *p;
++
++	if (length >= 512)
++		return;
++
++	start = 0;
++	while (length > 0) {
++		num = min(length, 16u);
++		p = line;
++		for (i = 0; i < num; ++i) {
++			if (i == 8)
++				*p++ = ' ';
++			DWC_SPRINTF(p, " %02x", buf[i]);
++			p += 3;
++		}
++		*p = 0;
++		DWC_DEBUG("%6x: %s\n", start, line);
++		buf += num;
++		start += num;
++		length -= num;
++	}
++}
++#else
++static inline void dump_msg(const u8 * buf, unsigned int length)
++{
++}
++#endif
++
++/**
++ * This function returns a pointer to cfi_ep_t object with the addr address.
++ */
++static inline struct cfi_ep *get_cfi_ep_by_addr(struct cfiobject *cfi,
++						uint8_t addr)
++{
++	struct cfi_ep *pcfiep;
++	dwc_list_link_t *tmp;
++
++	DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
++		pcfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
++
++		if (pcfiep->ep->desc->bEndpointAddress == addr) {
++			return pcfiep;
++		}
++	}
++
++	return NULL;
++}
++
++/**
++ * This function returns a pointer to cfi_ep_t object that matches
++ * the dwc_otg_pcd_ep object.
++ */
++static inline struct cfi_ep *get_cfi_ep_by_pcd_ep(struct cfiobject *cfi,
++						  struct dwc_otg_pcd_ep *ep)
++{
++	struct cfi_ep *pcfiep = NULL;
++	dwc_list_link_t *tmp;
++
++	DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
++		pcfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
++		if (pcfiep->ep == ep) {
++			return pcfiep;
++		}
++	}
++	return NULL;
++}
++
++int cfi_setup(struct dwc_otg_pcd *pcd, struct cfi_usb_ctrlrequest *ctrl);
++
++#endif /* (__DWC_OTG_CFI_H__) */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_cil.c
+@@ -0,0 +1,7146 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_cil.c $
++ * $Revision: #191 $
++ * $Date: 2012/08/10 $
++ * $Change: 2047372 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++/** @file
++ *
++ * The Core Interface Layer provides basic services for accessing and
++ * managing the DWC_otg hardware. These services are used by both the
++ * Host Controller Driver and the Peripheral Controller Driver.
++ *
++ * The CIL manages the memory map for the core so that the HCD and PCD
++ * don't have to do this separately. It also handles basic tasks like
++ * reading/writing the registers and data FIFOs in the controller.
++ * Some of the data access functions provide encapsulation of several
++ * operations required to perform a task, such as writing multiple
++ * registers to start a transfer. Finally, the CIL performs basic
++ * services that are not specific to either the host or device modes
++ * of operation. These services include management of the OTG Host
++ * Negotiation Protocol (HNP) and Session Request Protocol (SRP). A
++ * Diagnostic API is also provided to allow testing of the controller
++ * hardware.
++ *
++ * The Core Interface Layer has the following requirements:
++ * - Provides basic controller operations.
++ * - Minimal use of OS services.
++ * - The OS services used will be abstracted by using inline functions
++ *	 or macros.
++ *
++ */
++
++#include "dwc_os.h"
++#include "dwc_otg_regs.h"
++#include "dwc_otg_cil.h"
++
++extern bool cil_force_host;
++
++static int dwc_otg_setup_params(dwc_otg_core_if_t * core_if);
++
++/**
++ * This function is called to initialize the DWC_otg CSR data
++ * structures. The register addresses in the device and host
++ * structures are initialized from the base address supplied by the
++ * caller. The calling function must make the OS calls to get the
++ * base address of the DWC_otg controller registers. The core_params
++ * argument holds the parameters that specify how the core should be
++ * configured.
++ *
++ * @param reg_base_addr Base address of DWC_otg core registers
++ *
++ */
++dwc_otg_core_if_t *dwc_otg_cil_init(const uint32_t * reg_base_addr)
++{
++	dwc_otg_core_if_t *core_if = 0;
++	dwc_otg_dev_if_t *dev_if = 0;
++	dwc_otg_host_if_t *host_if = 0;
++	uint8_t *reg_base = (uint8_t *) reg_base_addr;
++	int i = 0;
++
++	DWC_DEBUGPL(DBG_CILV, "%s(%p)\n", __func__, reg_base_addr);
++
++	core_if = DWC_ALLOC(sizeof(dwc_otg_core_if_t));
++
++	if (core_if == NULL) {
++		DWC_DEBUGPL(DBG_CIL,
++			    "Allocation of dwc_otg_core_if_t failed\n");
++		return 0;
++	}
++	core_if->core_global_regs = (dwc_otg_core_global_regs_t *) reg_base;
++
++	/*
++	 * Allocate the Device Mode structures.
++	 */
++	dev_if = DWC_ALLOC(sizeof(dwc_otg_dev_if_t));
++
++	if (dev_if == NULL) {
++		DWC_DEBUGPL(DBG_CIL, "Allocation of dwc_otg_dev_if_t failed\n");
++		DWC_FREE(core_if);
++		return 0;
++	}
++
++	dev_if->dev_global_regs =
++	    (dwc_otg_device_global_regs_t *) (reg_base +
++					      DWC_DEV_GLOBAL_REG_OFFSET);
++
++	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
++		dev_if->in_ep_regs[i] = (dwc_otg_dev_in_ep_regs_t *)
++		    (reg_base + DWC_DEV_IN_EP_REG_OFFSET +
++		     (i * DWC_EP_REG_OFFSET));
++
++		dev_if->out_ep_regs[i] = (dwc_otg_dev_out_ep_regs_t *)
++		    (reg_base + DWC_DEV_OUT_EP_REG_OFFSET +
++		     (i * DWC_EP_REG_OFFSET));
++		DWC_DEBUGPL(DBG_CILV, "in_ep_regs[%d]->diepctl=%p\n",
++			    i, &dev_if->in_ep_regs[i]->diepctl);
++		DWC_DEBUGPL(DBG_CILV, "out_ep_regs[%d]->doepctl=%p\n",
++			    i, &dev_if->out_ep_regs[i]->doepctl);
++	}
++
++	dev_if->speed = 0;	// unknown
++
++	core_if->dev_if = dev_if;
++
++	/*
++	 * Allocate the Host Mode structures.
++	 */
++	host_if = DWC_ALLOC(sizeof(dwc_otg_host_if_t));
++
++	if (host_if == NULL) {
++		DWC_DEBUGPL(DBG_CIL,
++			    "Allocation of dwc_otg_host_if_t failed\n");
++		DWC_FREE(dev_if);
++		DWC_FREE(core_if);
++		return 0;
++	}
++
++	host_if->host_global_regs = (dwc_otg_host_global_regs_t *)
++	    (reg_base + DWC_OTG_HOST_GLOBAL_REG_OFFSET);
++
++	host_if->hprt0 =
++	    (uint32_t *) (reg_base + DWC_OTG_HOST_PORT_REGS_OFFSET);
++
++	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
++		host_if->hc_regs[i] = (dwc_otg_hc_regs_t *)
++		    (reg_base + DWC_OTG_HOST_CHAN_REGS_OFFSET +
++		     (i * DWC_OTG_CHAN_REGS_OFFSET));
++		DWC_DEBUGPL(DBG_CILV, "hc_reg[%d]->hcchar=%p\n",
++			    i, &host_if->hc_regs[i]->hcchar);
++	}
++
++	host_if->num_host_channels = MAX_EPS_CHANNELS;
++	core_if->host_if = host_if;
++
++	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
++		core_if->data_fifo[i] =
++		    (uint32_t *) (reg_base + DWC_OTG_DATA_FIFO_OFFSET +
++				  (i * DWC_OTG_DATA_FIFO_SIZE));
++		DWC_DEBUGPL(DBG_CILV, "data_fifo[%d]=0x%08lx\n",
++			    i, (unsigned long)core_if->data_fifo[i]);
++	}
++
++	core_if->pcgcctl = (uint32_t *) (reg_base + DWC_OTG_PCGCCTL_OFFSET);
++
++	/* Initiate lx_state to L3 disconnected state */
++	core_if->lx_state = DWC_OTG_L3;
++	/*
++	 * Store the contents of the hardware configuration registers here for
++	 * easy access later.
++	 */
++	core_if->hwcfg1.d32 =
++	    DWC_READ_REG32(&core_if->core_global_regs->ghwcfg1);
++	core_if->hwcfg2.d32 =
++	    DWC_READ_REG32(&core_if->core_global_regs->ghwcfg2);
++	core_if->hwcfg3.d32 =
++	    DWC_READ_REG32(&core_if->core_global_regs->ghwcfg3);
++	core_if->hwcfg4.d32 =
++	    DWC_READ_REG32(&core_if->core_global_regs->ghwcfg4);
++
++	/* Force host mode to get HPTXFSIZ exact power on value */
++	{
++		gusbcfg_data_t gusbcfg = {.d32 = 0 };
++		gusbcfg.d32 =  DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
++		gusbcfg.b.force_host_mode = 1;
++		DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, gusbcfg.d32);
++		dwc_mdelay(100);
++		core_if->hptxfsiz.d32 =
++		DWC_READ_REG32(&core_if->core_global_regs->hptxfsiz);
++		gusbcfg.d32 =  DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
++		if (cil_force_host)
++			gusbcfg.b.force_host_mode = 1;
++		else
++			gusbcfg.b.force_host_mode = 0;
++		DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, gusbcfg.d32);
++		dwc_mdelay(100);
++	}
++
++	DWC_DEBUGPL(DBG_CILV, "hwcfg1=%08x\n", core_if->hwcfg1.d32);
++	DWC_DEBUGPL(DBG_CILV, "hwcfg2=%08x\n", core_if->hwcfg2.d32);
++	DWC_DEBUGPL(DBG_CILV, "hwcfg3=%08x\n", core_if->hwcfg3.d32);
++	DWC_DEBUGPL(DBG_CILV, "hwcfg4=%08x\n", core_if->hwcfg4.d32);
++
++	core_if->hcfg.d32 =
++	    DWC_READ_REG32(&core_if->host_if->host_global_regs->hcfg);
++	core_if->dcfg.d32 =
++	    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
++
++	DWC_DEBUGPL(DBG_CILV, "hcfg=%08x\n", core_if->hcfg.d32);
++	DWC_DEBUGPL(DBG_CILV, "dcfg=%08x\n", core_if->dcfg.d32);
++
++	DWC_DEBUGPL(DBG_CILV, "op_mode=%0x\n", core_if->hwcfg2.b.op_mode);
++	DWC_DEBUGPL(DBG_CILV, "arch=%0x\n", core_if->hwcfg2.b.architecture);
++	DWC_DEBUGPL(DBG_CILV, "num_dev_ep=%d\n", core_if->hwcfg2.b.num_dev_ep);
++	DWC_DEBUGPL(DBG_CILV, "num_host_chan=%d\n",
++		    core_if->hwcfg2.b.num_host_chan);
++	DWC_DEBUGPL(DBG_CILV, "nonperio_tx_q_depth=0x%0x\n",
++		    core_if->hwcfg2.b.nonperio_tx_q_depth);
++	DWC_DEBUGPL(DBG_CILV, "host_perio_tx_q_depth=0x%0x\n",
++		    core_if->hwcfg2.b.host_perio_tx_q_depth);
++	DWC_DEBUGPL(DBG_CILV, "dev_token_q_depth=0x%0x\n",
++		    core_if->hwcfg2.b.dev_token_q_depth);
++
++	DWC_DEBUGPL(DBG_CILV, "Total FIFO SZ=%d\n",
++		    core_if->hwcfg3.b.dfifo_depth);
++	DWC_DEBUGPL(DBG_CILV, "xfer_size_cntr_width=%0x\n",
++		    core_if->hwcfg3.b.xfer_size_cntr_width);
++
++	/*
++	 * Set the SRP sucess bit for FS-I2c
++	 */
++	core_if->srp_success = 0;
++	core_if->srp_timer_started = 0;
++
++	/*
++	 * Create new workqueue and init works
++	 */
++	core_if->wq_otg = DWC_WORKQ_ALLOC("dwc_otg");
++	if (core_if->wq_otg == 0) {
++		DWC_WARN("DWC_WORKQ_ALLOC failed\n");
++		DWC_FREE(host_if);
++		DWC_FREE(dev_if);
++		DWC_FREE(core_if);
++		return 0;
++	}
++
++	core_if->snpsid = DWC_READ_REG32(&core_if->core_global_regs->gsnpsid);
++
++	DWC_PRINTF("Core Release: %x.%x%x%x\n",
++		   (core_if->snpsid >> 12 & 0xF),
++		   (core_if->snpsid >> 8 & 0xF),
++		   (core_if->snpsid >> 4 & 0xF), (core_if->snpsid & 0xF));
++
++	core_if->wkp_timer = DWC_TIMER_ALLOC("Wake Up Timer",
++					     w_wakeup_detected, core_if);
++	if (core_if->wkp_timer == 0) {
++		DWC_WARN("DWC_TIMER_ALLOC failed\n");
++		DWC_FREE(host_if);
++		DWC_FREE(dev_if);
++		DWC_WORKQ_FREE(core_if->wq_otg);
++		DWC_FREE(core_if);
++		return 0;
++	}
++
++	if (dwc_otg_setup_params(core_if)) {
++		DWC_WARN("Error while setting core params\n");
++	}
++
++	core_if->hibernation_suspend = 0;
++
++	/** ADP initialization */
++	dwc_otg_adp_init(core_if);
++
++	return core_if;
++}
++
++/**
++ * This function frees the structures allocated by dwc_otg_cil_init().
++ *
++ * @param core_if The core interface pointer returned from
++ * 		  dwc_otg_cil_init().
++ *
++ */
++void dwc_otg_cil_remove(dwc_otg_core_if_t * core_if)
++{
++	dctl_data_t dctl = {.d32 = 0 };
++	DWC_DEBUGPL(DBG_CILV, "%s(%p)\n", __func__, core_if);
++
++	/* Disable all interrupts */
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gahbcfg, 1, 0);
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, 0);
++
++	dctl.b.sftdiscon = 1;
++	if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0,
++				 dctl.d32);
++	}
++
++	if (core_if->wq_otg) {
++		DWC_WORKQ_WAIT_WORK_DONE(core_if->wq_otg, 500);
++		DWC_WORKQ_FREE(core_if->wq_otg);
++	}
++	if (core_if->dev_if) {
++		DWC_FREE(core_if->dev_if);
++	}
++	if (core_if->host_if) {
++		DWC_FREE(core_if->host_if);
++	}
++
++	/** Remove ADP Stuff  */
++	dwc_otg_adp_remove(core_if);
++	if (core_if->core_params) {
++		DWC_FREE(core_if->core_params);
++	}
++	if (core_if->wkp_timer) {
++		DWC_TIMER_FREE(core_if->wkp_timer);
++	}
++	if (core_if->srp_timer) {
++		DWC_TIMER_FREE(core_if->srp_timer);
++	}
++	DWC_FREE(core_if);
++}
++
++/**
++ * This function enables the controller's Global Interrupt in the AHB Config
++ * register.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++void dwc_otg_enable_global_interrupts(dwc_otg_core_if_t * core_if)
++{
++	gahbcfg_data_t ahbcfg = {.d32 = 0 };
++	ahbcfg.b.glblintrmsk = 1;	/* Enable interrupts */
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gahbcfg, 0, ahbcfg.d32);
++}
++
++/**
++ * This function disables the controller's Global Interrupt in the AHB Config
++ * register.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++void dwc_otg_disable_global_interrupts(dwc_otg_core_if_t * core_if)
++{
++	gahbcfg_data_t ahbcfg = {.d32 = 0 };
++	ahbcfg.b.glblintrmsk = 1;	/* Disable interrupts */
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gahbcfg, ahbcfg.d32, 0);
++}
++
++/**
++ * This function initializes the commmon interrupts, used in both
++ * device and host modes.
++ *
++ * @param core_if Programming view of the DWC_otg controller
++ *
++ */
++static void dwc_otg_enable_common_interrupts(dwc_otg_core_if_t * core_if)
++{
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	/* Clear any pending OTG Interrupts */
++	DWC_WRITE_REG32(&global_regs->gotgint, 0xFFFFFFFF);
++
++	/* Clear any pending interrupts */
++	DWC_WRITE_REG32(&global_regs->gintsts, 0xFFFFFFFF);
++
++	/*
++	 * Enable the interrupts in the GINTMSK.
++	 */
++	intr_mask.b.modemismatch = 1;
++	intr_mask.b.otgintr = 1;
++
++	if (!core_if->dma_enable) {
++		intr_mask.b.rxstsqlvl = 1;
++	}
++
++	intr_mask.b.conidstschng = 1;
++	intr_mask.b.wkupintr = 1;
++	intr_mask.b.disconnect = 0;
++	intr_mask.b.usbsuspend = 1;
++	intr_mask.b.sessreqintr = 1;
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	if (core_if->core_params->lpm_enable) {
++		intr_mask.b.lpmtranrcvd = 1;
++	}
++#endif
++	DWC_WRITE_REG32(&global_regs->gintmsk, intr_mask.d32);
++}
++
++/*
++ * The restore operation is modified to support Synopsys Emulated Powerdown and
++ * Hibernation. This function is for exiting from Device mode hibernation by
++ * Host Initiated Resume/Reset and Device Initiated Remote-Wakeup.
++ * @param core_if Programming view of DWC_otg controller.
++ * @param rem_wakeup - indicates whether resume is initiated by Device or Host.
++ * @param reset - indicates whether resume is initiated by Reset.
++ */
++int dwc_otg_device_hibernation_restore(dwc_otg_core_if_t * core_if,
++				       int rem_wakeup, int reset)
++{
++	gpwrdn_data_t gpwrdn = {.d32 = 0 };
++	pcgcctl_data_t pcgcctl = {.d32 = 0 };
++	dctl_data_t dctl = {.d32 = 0 };
++
++	int timeout = 2000;
++
++	if (!core_if->hibernation_suspend) {
++		DWC_PRINTF("Already exited from Hibernation\n");
++		return 1;
++	}
++
++	DWC_DEBUGPL(DBG_PCD, "%s called\n", __FUNCTION__);
++	/* Switch-on voltage to the core */
++	gpwrdn.b.pwrdnswtch = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Reset core */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnrstn = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Assert Restore signal */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.restore = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++	dwc_udelay(10);
++
++	/* Disable power clamps */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnclmp = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	if (rem_wakeup) {
++		dwc_udelay(70);
++	}
++
++	/* Deassert Reset core */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnrstn = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++	dwc_udelay(10);
++
++	/* Disable PMU interrupt */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pmuintsel = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	/* Mask interrupts from gpwrdn */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.connect_det_msk = 1;
++	gpwrdn.b.srp_det_msk = 1;
++	gpwrdn.b.disconn_det_msk = 1;
++	gpwrdn.b.rst_det_msk = 1;
++	gpwrdn.b.lnstchng_msk = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	/* Indicates that we are going out from hibernation */
++	core_if->hibernation_suspend = 0;
++
++	/*
++	 * Set Restore Essential Regs bit in PCGCCTL register, restore_mode = 1
++	 * indicates restore from remote_wakeup
++	 */
++	restore_essential_regs(core_if, rem_wakeup, 0);
++
++	/*
++	 * Wait a little for seeing new value of variable hibernation_suspend if
++	 * Restore done interrupt received before polling
++	 */
++	dwc_udelay(10);
++
++	if (core_if->hibernation_suspend == 0) {
++		/*
++		 * Wait For Restore_done Interrupt. This mechanism of polling the
++		 * interrupt is introduced to avoid any possible race conditions
++		 */
++		do {
++			gintsts_data_t gintsts;
++			gintsts.d32 =
++			    DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++			if (gintsts.b.restoredone) {
++				gintsts.d32 = 0;
++				gintsts.b.restoredone = 1;
++				DWC_WRITE_REG32(&core_if->core_global_regs->
++						gintsts, gintsts.d32);
++				DWC_PRINTF("Restore Done Interrupt seen\n");
++				break;
++			}
++			dwc_udelay(10);
++		} while (--timeout);
++		if (!timeout) {
++			DWC_PRINTF("Restore Done interrupt wasn't generated here\n");
++		}
++	}
++	/* Clear all pending interupts */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
++
++	/* De-assert Restore */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.restore = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	if (!rem_wakeup) {
++		pcgcctl.d32 = 0;
++		pcgcctl.b.rstpdwnmodule = 1;
++		DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
++	}
++
++	/* Restore GUSBCFG and DCFG */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg,
++			core_if->gr_backup->gusbcfg_local);
++	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg,
++			core_if->dr_backup->dcfg);
++
++	/* De-assert Wakeup Logic */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pmuactv = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	if (!rem_wakeup) {
++		/* Set Device programming done bit */
++		dctl.b.pwronprgdone = 1;
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
++	} else {
++		/* Start Remote Wakeup Signaling */
++		dctl.d32 = core_if->dr_backup->dctl;
++		dctl.b.rmtwkupsig = 1;
++		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32);
++	}
++
++	dwc_mdelay(2);
++	/* Clear all pending interupts */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
++
++	/* Restore global registers */
++	dwc_otg_restore_global_regs(core_if);
++	/* Restore device global registers */
++	dwc_otg_restore_dev_regs(core_if, rem_wakeup);
++
++	if (rem_wakeup) {
++		dwc_mdelay(7);
++		dctl.d32 = 0;
++		dctl.b.rmtwkupsig = 1;
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32, 0);
++	}
++
++	core_if->hibernation_suspend = 0;
++	/* The core will be in ON STATE */
++	core_if->lx_state = DWC_OTG_L0;
++	DWC_PRINTF("Hibernation recovery completes here\n");
++
++	return 1;
++}
++
++/*
++ * The restore operation is modified to support Synopsys Emulated Powerdown and
++ * Hibernation. This function is for exiting from Host mode hibernation by
++ * Host Initiated Resume/Reset and Device Initiated Remote-Wakeup.
++ * @param core_if Programming view of DWC_otg controller.
++ * @param rem_wakeup - indicates whether resume is initiated by Device or Host.
++ * @param reset - indicates whether resume is initiated by Reset.
++ */
++int dwc_otg_host_hibernation_restore(dwc_otg_core_if_t * core_if,
++				     int rem_wakeup, int reset)
++{
++	gpwrdn_data_t gpwrdn = {.d32 = 0 };
++	hprt0_data_t hprt0 = {.d32 = 0 };
++
++	int timeout = 2000;
++
++	DWC_DEBUGPL(DBG_HCD, "%s called\n", __FUNCTION__);
++	/* Switch-on voltage to the core */
++	gpwrdn.b.pwrdnswtch = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Reset core */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnrstn = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Assert Restore signal */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.restore = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++	dwc_udelay(10);
++
++	/* Disable power clamps */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnclmp = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	if (!rem_wakeup) {
++		dwc_udelay(50);
++	}
++
++	/* Deassert Reset core */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnrstn = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++	dwc_udelay(10);
++
++	/* Disable PMU interrupt */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pmuintsel = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	gpwrdn.d32 = 0;
++	gpwrdn.b.connect_det_msk = 1;
++	gpwrdn.b.srp_det_msk = 1;
++	gpwrdn.b.disconn_det_msk = 1;
++	gpwrdn.b.rst_det_msk = 1;
++	gpwrdn.b.lnstchng_msk = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	/* Indicates that we are going out from hibernation */
++	core_if->hibernation_suspend = 0;
++
++	/* Set Restore Essential Regs bit in PCGCCTL register */
++	restore_essential_regs(core_if, rem_wakeup, 1);
++
++	/* Wait a little for seeing new value of variable hibernation_suspend if
++	 * Restore done interrupt received before polling */
++	dwc_udelay(10);
++
++	if (core_if->hibernation_suspend == 0) {
++		/* Wait For Restore_done Interrupt. This mechanism of polling the
++		 * interrupt is introduced to avoid any possible race conditions
++		 */
++		do {
++			gintsts_data_t gintsts;
++			gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++			if (gintsts.b.restoredone) {
++				gintsts.d32 = 0;
++				gintsts.b.restoredone = 1;
++			DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++				DWC_DEBUGPL(DBG_HCD,"Restore Done Interrupt seen\n");
++				break;
++			}
++			dwc_udelay(10);
++		} while (--timeout);
++		if (!timeout) {
++			DWC_WARN("Restore Done interrupt wasn't generated\n");
++		}
++	}
++
++	/* Set the flag's value to 0 again after receiving restore done interrupt */
++	core_if->hibernation_suspend = 0;
++
++	/* This step is not described in functional spec but if not wait for this
++	 * delay, mismatch interrupts occurred because just after restore core is
++	 * in Device mode(gintsts.curmode == 0) */
++	dwc_mdelay(100);
++
++	/* Clear all pending interrupts */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
++
++	/* De-assert Restore */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.restore = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Restore GUSBCFG and HCFG */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg,
++			core_if->gr_backup->gusbcfg_local);
++	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hcfg,
++			core_if->hr_backup->hcfg_local);
++
++	/* De-assert Wakeup Logic */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pmuactv = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Start the Resume operation by programming HPRT0 */
++	hprt0.d32 = core_if->hr_backup->hprt0_local;
++	hprt0.b.prtpwr = 1;
++	hprt0.b.prtena = 0;
++	hprt0.b.prtsusp = 0;
++	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++
++	DWC_PRINTF("Resume Starts Now\n");
++	if (!reset) {		// Indicates it is Resume Operation
++		hprt0.d32 = core_if->hr_backup->hprt0_local;
++		hprt0.b.prtres = 1;
++		hprt0.b.prtpwr = 1;
++		hprt0.b.prtena = 0;
++		hprt0.b.prtsusp = 0;
++		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++
++		if (!rem_wakeup)
++			hprt0.b.prtres = 0;
++		/* Wait for Resume time and then program HPRT again */
++		dwc_mdelay(100);
++		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++
++	} else {		// Indicates it is Reset Operation
++		hprt0.d32 = core_if->hr_backup->hprt0_local;
++		hprt0.b.prtrst = 1;
++		hprt0.b.prtpwr = 1;
++		hprt0.b.prtena = 0;
++		hprt0.b.prtsusp = 0;
++		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++		/* Wait for Reset time and then program HPRT again */
++		dwc_mdelay(60);
++		hprt0.b.prtrst = 0;
++		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++	}
++	/* Clear all interrupt status */
++	hprt0.d32 = dwc_otg_read_hprt0(core_if);
++	hprt0.b.prtconndet = 1;
++	hprt0.b.prtenchng = 1;
++	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++
++	/* Clear all pending interupts */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
++
++	/* Restore global registers */
++	dwc_otg_restore_global_regs(core_if);
++	/* Restore host global registers */
++	dwc_otg_restore_host_regs(core_if, reset);
++
++	/* The core will be in ON STATE */
++	core_if->lx_state = DWC_OTG_L0;
++	DWC_PRINTF("Hibernation recovery is complete here\n");
++	return 0;
++}
++
++/** Saves some register values into system memory. */
++int dwc_otg_save_global_regs(dwc_otg_core_if_t * core_if)
++{
++	struct dwc_otg_global_regs_backup *gr;
++	int i;
++
++	gr = core_if->gr_backup;
++	if (!gr) {
++		gr = DWC_ALLOC(sizeof(*gr));
++		if (!gr) {
++			return -DWC_E_NO_MEMORY;
++		}
++		core_if->gr_backup = gr;
++	}
++
++	gr->gotgctl_local = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
++	gr->gintmsk_local = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
++	gr->gahbcfg_local = DWC_READ_REG32(&core_if->core_global_regs->gahbcfg);
++	gr->gusbcfg_local = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
++	gr->grxfsiz_local = DWC_READ_REG32(&core_if->core_global_regs->grxfsiz);
++	gr->gnptxfsiz_local = DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz);
++	gr->hptxfsiz_local = DWC_READ_REG32(&core_if->core_global_regs->hptxfsiz);
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	gr->glpmcfg_local = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++#endif
++	gr->gi2cctl_local = DWC_READ_REG32(&core_if->core_global_regs->gi2cctl);
++	gr->pcgcctl_local = DWC_READ_REG32(core_if->pcgcctl);
++	gr->gdfifocfg_local =
++	    DWC_READ_REG32(&core_if->core_global_regs->gdfifocfg);
++	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
++		gr->dtxfsiz_local[i] =
++		    DWC_READ_REG32(&(core_if->core_global_regs->dtxfsiz[i]));
++	}
++
++	DWC_DEBUGPL(DBG_ANY, "===========Backing Global registers==========\n");
++	DWC_DEBUGPL(DBG_ANY, "Backed up gotgctl   = %08x\n", gr->gotgctl_local);
++	DWC_DEBUGPL(DBG_ANY, "Backed up gintmsk   = %08x\n", gr->gintmsk_local);
++	DWC_DEBUGPL(DBG_ANY, "Backed up gahbcfg   = %08x\n", gr->gahbcfg_local);
++	DWC_DEBUGPL(DBG_ANY, "Backed up gusbcfg   = %08x\n", gr->gusbcfg_local);
++	DWC_DEBUGPL(DBG_ANY, "Backed up grxfsiz   = %08x\n", gr->grxfsiz_local);
++	DWC_DEBUGPL(DBG_ANY, "Backed up gnptxfsiz = %08x\n",
++		    gr->gnptxfsiz_local);
++	DWC_DEBUGPL(DBG_ANY, "Backed up hptxfsiz  = %08x\n",
++		    gr->hptxfsiz_local);
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	DWC_DEBUGPL(DBG_ANY, "Backed up glpmcfg   = %08x\n", gr->glpmcfg_local);
++#endif
++	DWC_DEBUGPL(DBG_ANY, "Backed up gi2cctl   = %08x\n", gr->gi2cctl_local);
++	DWC_DEBUGPL(DBG_ANY, "Backed up pcgcctl   = %08x\n", gr->pcgcctl_local);
++	DWC_DEBUGPL(DBG_ANY,"Backed up gdfifocfg   = %08x\n",gr->gdfifocfg_local);
++
++	return 0;
++}
++
++/** Saves GINTMSK register before setting the msk bits. */
++int dwc_otg_save_gintmsk_reg(dwc_otg_core_if_t * core_if)
++{
++	struct dwc_otg_global_regs_backup *gr;
++
++	gr = core_if->gr_backup;
++	if (!gr) {
++		gr = DWC_ALLOC(sizeof(*gr));
++		if (!gr) {
++			return -DWC_E_NO_MEMORY;
++		}
++		core_if->gr_backup = gr;
++	}
++
++	gr->gintmsk_local = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
++
++	DWC_DEBUGPL(DBG_ANY,"=============Backing GINTMSK registers============\n");
++	DWC_DEBUGPL(DBG_ANY, "Backed up gintmsk   = %08x\n", gr->gintmsk_local);
++
++	return 0;
++}
++
++int dwc_otg_save_dev_regs(dwc_otg_core_if_t * core_if)
++{
++	struct dwc_otg_dev_regs_backup *dr;
++	int i;
++
++	dr = core_if->dr_backup;
++	if (!dr) {
++		dr = DWC_ALLOC(sizeof(*dr));
++		if (!dr) {
++			return -DWC_E_NO_MEMORY;
++		}
++		core_if->dr_backup = dr;
++	}
++
++	dr->dcfg = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
++	dr->dctl = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dctl);
++	dr->daintmsk =
++	    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->daintmsk);
++	dr->diepmsk =
++	    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->diepmsk);
++	dr->doepmsk =
++	    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->doepmsk);
++
++	for (i = 0; i < core_if->dev_if->num_in_eps; ++i) {
++		dr->diepctl[i] =
++		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[i]->diepctl);
++		dr->dieptsiz[i] =
++		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[i]->dieptsiz);
++		dr->diepdma[i] =
++		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[i]->diepdma);
++	}
++
++	DWC_DEBUGPL(DBG_ANY,
++		    "=============Backing Host registers==============\n");
++	DWC_DEBUGPL(DBG_ANY, "Backed up dcfg            = %08x\n", dr->dcfg);
++	DWC_DEBUGPL(DBG_ANY, "Backed up dctl        = %08x\n", dr->dctl);
++	DWC_DEBUGPL(DBG_ANY, "Backed up daintmsk            = %08x\n",
++		    dr->daintmsk);
++	DWC_DEBUGPL(DBG_ANY, "Backed up diepmsk        = %08x\n", dr->diepmsk);
++	DWC_DEBUGPL(DBG_ANY, "Backed up doepmsk        = %08x\n", dr->doepmsk);
++	for (i = 0; i < core_if->dev_if->num_in_eps; ++i) {
++		DWC_DEBUGPL(DBG_ANY, "Backed up diepctl[%d]        = %08x\n", i,
++			    dr->diepctl[i]);
++		DWC_DEBUGPL(DBG_ANY, "Backed up dieptsiz[%d]        = %08x\n",
++			    i, dr->dieptsiz[i]);
++		DWC_DEBUGPL(DBG_ANY, "Backed up diepdma[%d]        = %08x\n", i,
++			    dr->diepdma[i]);
++	}
++
++	return 0;
++}
++
++int dwc_otg_save_host_regs(dwc_otg_core_if_t * core_if)
++{
++	struct dwc_otg_host_regs_backup *hr;
++	int i;
++
++	hr = core_if->hr_backup;
++	if (!hr) {
++		hr = DWC_ALLOC(sizeof(*hr));
++		if (!hr) {
++			return -DWC_E_NO_MEMORY;
++		}
++		core_if->hr_backup = hr;
++	}
++
++	hr->hcfg_local =
++	    DWC_READ_REG32(&core_if->host_if->host_global_regs->hcfg);
++	hr->haintmsk_local =
++	    DWC_READ_REG32(&core_if->host_if->host_global_regs->haintmsk);
++	for (i = 0; i < dwc_otg_get_param_host_channels(core_if); ++i) {
++		hr->hcintmsk_local[i] =
++		    DWC_READ_REG32(&core_if->host_if->hc_regs[i]->hcintmsk);
++	}
++	hr->hprt0_local = DWC_READ_REG32(core_if->host_if->hprt0);
++	hr->hfir_local =
++	    DWC_READ_REG32(&core_if->host_if->host_global_regs->hfir);
++
++	DWC_DEBUGPL(DBG_ANY,
++		    "=============Backing Host registers===============\n");
++	DWC_DEBUGPL(DBG_ANY, "Backed up hcfg		= %08x\n",
++		    hr->hcfg_local);
++	DWC_DEBUGPL(DBG_ANY, "Backed up haintmsk = %08x\n", hr->haintmsk_local);
++	for (i = 0; i < dwc_otg_get_param_host_channels(core_if); ++i) {
++		DWC_DEBUGPL(DBG_ANY, "Backed up hcintmsk[%02d]=%08x\n", i,
++			    hr->hcintmsk_local[i]);
++	}
++	DWC_DEBUGPL(DBG_ANY, "Backed up hprt0           = %08x\n",
++		    hr->hprt0_local);
++	DWC_DEBUGPL(DBG_ANY, "Backed up hfir           = %08x\n",
++		    hr->hfir_local);
++
++	return 0;
++}
++
++int dwc_otg_restore_global_regs(dwc_otg_core_if_t *core_if)
++{
++	struct dwc_otg_global_regs_backup *gr;
++	int i;
++
++	gr = core_if->gr_backup;
++	if (!gr) {
++		return -DWC_E_INVALID;
++	}
++
++	DWC_WRITE_REG32(&core_if->core_global_regs->gotgctl, gr->gotgctl_local);
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, gr->gintmsk_local);
++	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, gr->gusbcfg_local);
++	DWC_WRITE_REG32(&core_if->core_global_regs->gahbcfg, gr->gahbcfg_local);
++	DWC_WRITE_REG32(&core_if->core_global_regs->grxfsiz, gr->grxfsiz_local);
++	DWC_WRITE_REG32(&core_if->core_global_regs->gnptxfsiz,
++			gr->gnptxfsiz_local);
++	DWC_WRITE_REG32(&core_if->core_global_regs->hptxfsiz,
++			gr->hptxfsiz_local);
++	DWC_WRITE_REG32(&core_if->core_global_regs->gdfifocfg,
++			gr->gdfifocfg_local);
++	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
++		DWC_WRITE_REG32(&core_if->core_global_regs->dtxfsiz[i],
++				gr->dtxfsiz_local[i]);
++	}
++
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
++	DWC_WRITE_REG32(core_if->host_if->hprt0, 0x0000100A);
++	DWC_WRITE_REG32(&core_if->core_global_regs->gahbcfg,
++			(gr->gahbcfg_local));
++	return 0;
++}
++
++int dwc_otg_restore_dev_regs(dwc_otg_core_if_t * core_if, int rem_wakeup)
++{
++	struct dwc_otg_dev_regs_backup *dr;
++	int i;
++
++	dr = core_if->dr_backup;
++
++	if (!dr) {
++		return -DWC_E_INVALID;
++	}
++
++	if (!rem_wakeup) {
++		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl,
++				dr->dctl);
++	}
++
++	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->daintmsk, dr->daintmsk);
++	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->diepmsk, dr->diepmsk);
++	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->doepmsk, dr->doepmsk);
++
++	for (i = 0; i < core_if->dev_if->num_in_eps; ++i) {
++		DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[i]->dieptsiz, dr->dieptsiz[i]);
++		DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[i]->diepdma, dr->diepdma[i]);
++		DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[i]->diepctl, dr->diepctl[i]);
++	}
++
++	return 0;
++}
++
++int dwc_otg_restore_host_regs(dwc_otg_core_if_t * core_if, int reset)
++{
++	struct dwc_otg_host_regs_backup *hr;
++	int i;
++	hr = core_if->hr_backup;
++
++	if (!hr) {
++		return -DWC_E_INVALID;
++	}
++
++	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hcfg, hr->hcfg_local);
++	//if (!reset)
++	//{
++	//      DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hfir, hr->hfir_local);
++	//}
++
++	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->haintmsk,
++			hr->haintmsk_local);
++	for (i = 0; i < dwc_otg_get_param_host_channels(core_if); ++i) {
++		DWC_WRITE_REG32(&core_if->host_if->hc_regs[i]->hcintmsk,
++				hr->hcintmsk_local[i]);
++	}
++
++	return 0;
++}
++
++int restore_lpm_i2c_regs(dwc_otg_core_if_t * core_if)
++{
++	struct dwc_otg_global_regs_backup *gr;
++
++	gr = core_if->gr_backup;
++
++	/* Restore values for LPM and I2C */
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg, gr->glpmcfg_local);
++#endif
++	DWC_WRITE_REG32(&core_if->core_global_regs->gi2cctl, gr->gi2cctl_local);
++
++	return 0;
++}
++
++int restore_essential_regs(dwc_otg_core_if_t * core_if, int rmode, int is_host)
++{
++	struct dwc_otg_global_regs_backup *gr;
++	pcgcctl_data_t pcgcctl = {.d32 = 0 };
++	gahbcfg_data_t gahbcfg = {.d32 = 0 };
++	gusbcfg_data_t gusbcfg = {.d32 = 0 };
++	gintmsk_data_t gintmsk = {.d32 = 0 };
++
++	/* Restore LPM and I2C registers */
++	restore_lpm_i2c_regs(core_if);
++
++	/* Set PCGCCTL to 0 */
++	DWC_WRITE_REG32(core_if->pcgcctl, 0x00000000);
++
++	gr = core_if->gr_backup;
++	/* Load restore values for [31:14] bits */
++	DWC_WRITE_REG32(core_if->pcgcctl,
++			((gr->pcgcctl_local & 0xffffc000) | 0x00020000));
++
++	/* Umnask global Interrupt in GAHBCFG and restore it */
++	gahbcfg.d32 = gr->gahbcfg_local;
++	gahbcfg.b.glblintrmsk = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gahbcfg, gahbcfg.d32);
++
++	/* Clear all pending interupts */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
++
++	/* Unmask restore done interrupt */
++	gintmsk.b.restoredone = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, gintmsk.d32);
++
++	/* Restore GUSBCFG and HCFG/DCFG */
++	gusbcfg.d32 = core_if->gr_backup->gusbcfg_local;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, gusbcfg.d32);
++
++	if (is_host) {
++		hcfg_data_t hcfg = {.d32 = 0 };
++		hcfg.d32 = core_if->hr_backup->hcfg_local;
++		DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hcfg,
++				hcfg.d32);
++
++		/* Load restore values for [31:14] bits */
++		pcgcctl.d32 = gr->pcgcctl_local & 0xffffc000;
++		pcgcctl.d32 = gr->pcgcctl_local | 0x00020000;
++
++		if (rmode)
++			pcgcctl.b.restoremode = 1;
++		DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
++		dwc_udelay(10);
++
++		/* Load restore values for [31:14] bits and set EssRegRestored bit */
++		pcgcctl.d32 = gr->pcgcctl_local | 0xffffc000;
++		pcgcctl.d32 = gr->pcgcctl_local & 0xffffc000;
++		pcgcctl.b.ess_reg_restored = 1;
++		if (rmode)
++			pcgcctl.b.restoremode = 1;
++		DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
++	} else {
++		dcfg_data_t dcfg = {.d32 = 0 };
++		dcfg.d32 = core_if->dr_backup->dcfg;
++		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg, dcfg.d32);
++
++		/* Load restore values for [31:14] bits */
++		pcgcctl.d32 = gr->pcgcctl_local & 0xffffc000;
++		pcgcctl.d32 = gr->pcgcctl_local | 0x00020000;
++		if (!rmode) {
++			pcgcctl.d32 |= 0x208;
++		}
++		DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
++		dwc_udelay(10);
++
++		/* Load restore values for [31:14] bits */
++		pcgcctl.d32 = gr->pcgcctl_local & 0xffffc000;
++		pcgcctl.d32 = gr->pcgcctl_local | 0x00020000;
++		pcgcctl.b.ess_reg_restored = 1;
++		if (!rmode)
++			pcgcctl.d32 |= 0x208;
++		DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
++	}
++
++	return 0;
++}
++
++/**
++ * Initializes the FSLSPClkSel field of the HCFG register depending on the PHY
++ * type.
++ */
++static void init_fslspclksel(dwc_otg_core_if_t * core_if)
++{
++	uint32_t val;
++	hcfg_data_t hcfg;
++
++	if (((core_if->hwcfg2.b.hs_phy_type == 2) &&
++	     (core_if->hwcfg2.b.fs_phy_type == 1) &&
++	     (core_if->core_params->ulpi_fs_ls)) ||
++	    (core_if->core_params->phy_type == DWC_PHY_TYPE_PARAM_FS)) {
++		/* Full speed PHY */
++		val = DWC_HCFG_48_MHZ;
++	} else {
++		/* High speed PHY running at full speed or high speed */
++		val = DWC_HCFG_30_60_MHZ;
++	}
++
++	DWC_DEBUGPL(DBG_CIL, "Initializing HCFG.FSLSPClkSel to 0x%1x\n", val);
++	hcfg.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->hcfg);
++	hcfg.b.fslspclksel = val;
++	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hcfg, hcfg.d32);
++}
++
++/**
++ * Initializes the DevSpd field of the DCFG register depending on the PHY type
++ * and the enumeration speed of the device.
++ */
++static void init_devspd(dwc_otg_core_if_t * core_if)
++{
++	uint32_t val;
++	dcfg_data_t dcfg;
++
++	if (((core_if->hwcfg2.b.hs_phy_type == 2) &&
++	     (core_if->hwcfg2.b.fs_phy_type == 1) &&
++	     (core_if->core_params->ulpi_fs_ls)) ||
++	    (core_if->core_params->phy_type == DWC_PHY_TYPE_PARAM_FS)) {
++		/* Full speed PHY */
++		val = 0x3;
++	} else if (core_if->core_params->speed == DWC_SPEED_PARAM_FULL) {
++		/* High speed PHY running at full speed */
++		val = 0x1;
++	} else {
++		/* High speed PHY running at high speed */
++		val = 0x0;
++	}
++
++	DWC_DEBUGPL(DBG_CIL, "Initializing DCFG.DevSpd to 0x%1x\n", val);
++
++	dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
++	dcfg.b.devspd = val;
++	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg, dcfg.d32);
++}
++
++/**
++ * This function calculates the number of IN EPS
++ * using GHWCFG1 and GHWCFG2 registers values
++ *
++ * @param core_if Programming view of the DWC_otg controller
++ */
++static uint32_t calc_num_in_eps(dwc_otg_core_if_t * core_if)
++{
++	uint32_t num_in_eps = 0;
++	uint32_t num_eps = core_if->hwcfg2.b.num_dev_ep;
++	uint32_t hwcfg1 = core_if->hwcfg1.d32 >> 3;
++	uint32_t num_tx_fifos = core_if->hwcfg4.b.num_in_eps;
++	int i;
++
++	for (i = 0; i < num_eps; ++i) {
++		if (!(hwcfg1 & 0x1))
++			num_in_eps++;
++
++		hwcfg1 >>= 2;
++	}
++
++	if (core_if->hwcfg4.b.ded_fifo_en) {
++		num_in_eps =
++		    (num_in_eps > num_tx_fifos) ? num_tx_fifos : num_in_eps;
++	}
++
++	return num_in_eps;
++}
++
++/**
++ * This function calculates the number of OUT EPS
++ * using GHWCFG1 and GHWCFG2 registers values
++ *
++ * @param core_if Programming view of the DWC_otg controller
++ */
++static uint32_t calc_num_out_eps(dwc_otg_core_if_t * core_if)
++{
++	uint32_t num_out_eps = 0;
++	uint32_t num_eps = core_if->hwcfg2.b.num_dev_ep;
++	uint32_t hwcfg1 = core_if->hwcfg1.d32 >> 2;
++	int i;
++
++	for (i = 0; i < num_eps; ++i) {
++		if (!(hwcfg1 & 0x1))
++			num_out_eps++;
++
++		hwcfg1 >>= 2;
++	}
++	return num_out_eps;
++}
++
++/**
++ * This function initializes the DWC_otg controller registers and
++ * prepares the core for device mode or host mode operation.
++ *
++ * @param core_if Programming view of the DWC_otg controller
++ *
++ */
++void dwc_otg_core_init(dwc_otg_core_if_t * core_if)
++{
++	int i = 0;
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	gahbcfg_data_t ahbcfg = {.d32 = 0 };
++	gusbcfg_data_t usbcfg = {.d32 = 0 };
++	gi2cctl_data_t i2cctl = {.d32 = 0 };
++
++	DWC_DEBUGPL(DBG_CILV, "dwc_otg_core_init(%p) regs at %p\n",
++                    core_if, global_regs);
++
++	/* Common Initialization */
++	usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
++
++	/* Program the ULPI External VBUS bit if needed */
++	usbcfg.b.ulpi_ext_vbus_drv =
++	    (core_if->core_params->phy_ulpi_ext_vbus ==
++	     DWC_PHY_ULPI_EXTERNAL_VBUS) ? 1 : 0;
++
++	/* Set external TS Dline pulsing */
++	usbcfg.b.term_sel_dl_pulse =
++	    (core_if->core_params->ts_dline == 1) ? 1 : 0;
++	DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
++
++	/* Reset the Controller */
++	dwc_otg_core_reset(core_if);
++
++	core_if->adp_enable = core_if->core_params->adp_supp_enable;
++	core_if->power_down = core_if->core_params->power_down;
++	core_if->otg_sts = 0;
++
++	/* Initialize parameters from Hardware configuration registers. */
++	dev_if->num_in_eps = calc_num_in_eps(core_if);
++	dev_if->num_out_eps = calc_num_out_eps(core_if);
++
++	DWC_DEBUGPL(DBG_CIL, "num_dev_perio_in_ep=%d\n",
++		    core_if->hwcfg4.b.num_dev_perio_in_ep);
++
++	for (i = 0; i < core_if->hwcfg4.b.num_dev_perio_in_ep; i++) {
++		dev_if->perio_tx_fifo_size[i] =
++		    DWC_READ_REG32(&global_regs->dtxfsiz[i]) >> 16;
++		DWC_DEBUGPL(DBG_CIL, "Periodic Tx FIFO SZ #%d=0x%0x\n",
++			    i, dev_if->perio_tx_fifo_size[i]);
++	}
++
++	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
++		dev_if->tx_fifo_size[i] =
++		    DWC_READ_REG32(&global_regs->dtxfsiz[i]) >> 16;
++		DWC_DEBUGPL(DBG_CIL, "Tx FIFO SZ #%d=0x%0x\n",
++			    i, dev_if->tx_fifo_size[i]);
++	}
++
++	core_if->total_fifo_size = core_if->hwcfg3.b.dfifo_depth;
++	core_if->rx_fifo_size = DWC_READ_REG32(&global_regs->grxfsiz);
++	core_if->nperio_tx_fifo_size =
++	    DWC_READ_REG32(&global_regs->gnptxfsiz) >> 16;
++
++	DWC_DEBUGPL(DBG_CIL, "Total FIFO SZ=%d\n", core_if->total_fifo_size);
++	DWC_DEBUGPL(DBG_CIL, "Rx FIFO SZ=%d\n", core_if->rx_fifo_size);
++	DWC_DEBUGPL(DBG_CIL, "NP Tx FIFO SZ=%d\n",
++		    core_if->nperio_tx_fifo_size);
++
++	/* This programming sequence needs to happen in FS mode before any other
++	 * programming occurs */
++	if ((core_if->core_params->speed == DWC_SPEED_PARAM_FULL) &&
++	    (core_if->core_params->phy_type == DWC_PHY_TYPE_PARAM_FS)) {
++		/* If FS mode with FS PHY */
++
++		/* core_init() is now called on every switch so only call the
++		 * following for the first time through. */
++		if (!core_if->phy_init_done) {
++			core_if->phy_init_done = 1;
++			DWC_DEBUGPL(DBG_CIL, "FS_PHY detected\n");
++			usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
++			usbcfg.b.physel = 1;
++			DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
++
++			/* Reset after a PHY select */
++			dwc_otg_core_reset(core_if);
++		}
++
++		/* Program DCFG.DevSpd or HCFG.FSLSPclkSel to 48Mhz in FS.      Also
++		 * do this on HNP Dev/Host mode switches (done in dev_init and
++		 * host_init). */
++		if (dwc_otg_is_host_mode(core_if)) {
++			init_fslspclksel(core_if);
++		} else {
++			init_devspd(core_if);
++		}
++
++		if (core_if->core_params->i2c_enable) {
++			DWC_DEBUGPL(DBG_CIL, "FS_PHY Enabling I2c\n");
++			/* Program GUSBCFG.OtgUtmifsSel to I2C */
++			usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
++			usbcfg.b.otgutmifssel = 1;
++			DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
++
++			/* Program GI2CCTL.I2CEn */
++			i2cctl.d32 = DWC_READ_REG32(&global_regs->gi2cctl);
++			i2cctl.b.i2cdevaddr = 1;
++			i2cctl.b.i2cen = 0;
++			DWC_WRITE_REG32(&global_regs->gi2cctl, i2cctl.d32);
++			i2cctl.b.i2cen = 1;
++			DWC_WRITE_REG32(&global_regs->gi2cctl, i2cctl.d32);
++		}
++
++	} /* endif speed == DWC_SPEED_PARAM_FULL */
++	else {
++		/* High speed PHY. */
++		if (!core_if->phy_init_done) {
++			core_if->phy_init_done = 1;
++			/* HS PHY parameters.  These parameters are preserved
++			 * during soft reset so only program the first time.  Do
++			 * a soft reset immediately after setting phyif.  */
++
++			if (core_if->core_params->phy_type == 2) {
++				/* ULPI interface */
++				usbcfg.b.ulpi_utmi_sel = 1;
++				usbcfg.b.phyif = 0;
++				usbcfg.b.ddrsel =
++				    core_if->core_params->phy_ulpi_ddr;
++			} else if (core_if->core_params->phy_type == 1) {
++				/* UTMI+ interface */
++				usbcfg.b.ulpi_utmi_sel = 0;
++				if (core_if->core_params->phy_utmi_width == 16) {
++					usbcfg.b.phyif = 1;
++
++				} else {
++					usbcfg.b.phyif = 0;
++				}
++			} else {
++				DWC_ERROR("FS PHY TYPE\n");
++			}
++			DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
++			/* Reset after setting the PHY parameters */
++			dwc_otg_core_reset(core_if);
++		}
++	}
++
++	if ((core_if->hwcfg2.b.hs_phy_type == 2) &&
++	    (core_if->hwcfg2.b.fs_phy_type == 1) &&
++	    (core_if->core_params->ulpi_fs_ls)) {
++		DWC_DEBUGPL(DBG_CIL, "Setting ULPI FSLS\n");
++		usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
++		usbcfg.b.ulpi_fsls = 1;
++		usbcfg.b.ulpi_clk_sus_m = 1;
++		DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
++	} else {
++		usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
++		usbcfg.b.ulpi_fsls = 0;
++		usbcfg.b.ulpi_clk_sus_m = 0;
++		DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
++	}
++
++	/* Program the GAHBCFG Register. */
++	switch (core_if->hwcfg2.b.architecture) {
++
++	case DWC_SLAVE_ONLY_ARCH:
++		DWC_DEBUGPL(DBG_CIL, "Slave Only Mode\n");
++		ahbcfg.b.nptxfemplvl_txfemplvl =
++		    DWC_GAHBCFG_TXFEMPTYLVL_HALFEMPTY;
++		ahbcfg.b.ptxfemplvl = DWC_GAHBCFG_TXFEMPTYLVL_HALFEMPTY;
++		core_if->dma_enable = 0;
++		core_if->dma_desc_enable = 0;
++		break;
++
++	case DWC_EXT_DMA_ARCH:
++		DWC_DEBUGPL(DBG_CIL, "External DMA Mode\n");
++		{
++			uint8_t brst_sz = core_if->core_params->dma_burst_size;
++			ahbcfg.b.hburstlen = 0;
++			while (brst_sz > 1) {
++				ahbcfg.b.hburstlen++;
++				brst_sz >>= 1;
++			}
++		}
++		core_if->dma_enable = (core_if->core_params->dma_enable != 0);
++		core_if->dma_desc_enable =
++		    (core_if->core_params->dma_desc_enable != 0);
++		break;
++
++	case DWC_INT_DMA_ARCH:
++		DWC_DEBUGPL(DBG_CIL, "Internal DMA Mode\n");
++		/* Old value was DWC_GAHBCFG_INT_DMA_BURST_INCR - done for
++		  Host mode ISOC in issue fix - vahrama */
++		/* Broadcom had altered to (1<<3)|(0<<0) - WRESP=1, max 4 beats */
++		ahbcfg.b.hburstlen = (1<<3)|(0<<0);//DWC_GAHBCFG_INT_DMA_BURST_INCR4;
++		core_if->dma_enable = (core_if->core_params->dma_enable != 0);
++		core_if->dma_desc_enable =
++		    (core_if->core_params->dma_desc_enable != 0);
++		break;
++
++	}
++	if (core_if->dma_enable) {
++		if (core_if->dma_desc_enable) {
++			DWC_PRINTF("Using Descriptor DMA mode\n");
++		} else {
++			DWC_PRINTF("Using Buffer DMA mode\n");
++
++		}
++	} else {
++		DWC_PRINTF("Using Slave mode\n");
++		core_if->dma_desc_enable = 0;
++	}
++
++	if (core_if->core_params->ahb_single) {
++		ahbcfg.b.ahbsingle = 1;
++	}
++
++	ahbcfg.b.dmaenable = core_if->dma_enable;
++	DWC_WRITE_REG32(&global_regs->gahbcfg, ahbcfg.d32);
++
++	core_if->en_multiple_tx_fifo = core_if->hwcfg4.b.ded_fifo_en;
++
++	core_if->pti_enh_enable = core_if->core_params->pti_enable != 0;
++	core_if->multiproc_int_enable = core_if->core_params->mpi_enable;
++	DWC_PRINTF("Periodic Transfer Interrupt Enhancement - %s\n",
++		   ((core_if->pti_enh_enable) ? "enabled" : "disabled"));
++	DWC_PRINTF("Multiprocessor Interrupt Enhancement - %s\n",
++		   ((core_if->multiproc_int_enable) ? "enabled" : "disabled"));
++
++	/*
++	 * Program the GUSBCFG register.
++	 */
++	usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
++
++	switch (core_if->hwcfg2.b.op_mode) {
++	case DWC_MODE_HNP_SRP_CAPABLE:
++		usbcfg.b.hnpcap = (core_if->core_params->otg_cap ==
++				   DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE);
++		usbcfg.b.srpcap = (core_if->core_params->otg_cap !=
++				   DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE);
++		break;
++
++	case DWC_MODE_SRP_ONLY_CAPABLE:
++		usbcfg.b.hnpcap = 0;
++		usbcfg.b.srpcap = (core_if->core_params->otg_cap !=
++				   DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE);
++		break;
++
++	case DWC_MODE_NO_HNP_SRP_CAPABLE:
++		usbcfg.b.hnpcap = 0;
++		usbcfg.b.srpcap = 0;
++		break;
++
++	case DWC_MODE_SRP_CAPABLE_DEVICE:
++		usbcfg.b.hnpcap = 0;
++		usbcfg.b.srpcap = (core_if->core_params->otg_cap !=
++				   DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE);
++		break;
++
++	case DWC_MODE_NO_SRP_CAPABLE_DEVICE:
++		usbcfg.b.hnpcap = 0;
++		usbcfg.b.srpcap = 0;
++		break;
++
++	case DWC_MODE_SRP_CAPABLE_HOST:
++		usbcfg.b.hnpcap = 0;
++		usbcfg.b.srpcap = (core_if->core_params->otg_cap !=
++				   DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE);
++		break;
++
++	case DWC_MODE_NO_SRP_CAPABLE_HOST:
++		usbcfg.b.hnpcap = 0;
++		usbcfg.b.srpcap = 0;
++		break;
++	}
++
++	DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
++
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	if (core_if->core_params->lpm_enable) {
++		glpmcfg_data_t lpmcfg = {.d32 = 0 };
++
++		/* To enable LPM support set lpm_cap_en bit */
++		lpmcfg.b.lpm_cap_en = 1;
++
++		/* Make AppL1Res ACK */
++		lpmcfg.b.appl_resp = 1;
++
++		/* Retry 3 times */
++		lpmcfg.b.retry_count = 3;
++
++		DWC_MODIFY_REG32(&core_if->core_global_regs->glpmcfg,
++				 0, lpmcfg.d32);
++
++	}
++#endif
++	if (core_if->core_params->ic_usb_cap) {
++		gusbcfg_data_t gusbcfg = {.d32 = 0 };
++		gusbcfg.b.ic_usb_cap = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gusbcfg,
++				 0, gusbcfg.d32);
++	}
++	{
++		gotgctl_data_t gotgctl = {.d32 = 0 };
++		gotgctl.b.otgver = core_if->core_params->otg_ver;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gotgctl, 0,
++				 gotgctl.d32);
++		/* Set OTG version supported */
++		core_if->otg_ver = core_if->core_params->otg_ver;
++		DWC_PRINTF("OTG VER PARAM: %d, OTG VER FLAG: %d\n",
++			   core_if->core_params->otg_ver, core_if->otg_ver);
++	}
++
++
++	/* Enable common interrupts */
++	dwc_otg_enable_common_interrupts(core_if);
++
++	/* Do device or host intialization based on mode during PCD
++	 * and HCD initialization  */
++	if (dwc_otg_is_host_mode(core_if)) {
++		DWC_DEBUGPL(DBG_ANY, "Host Mode\n");
++		core_if->op_state = A_HOST;
++	} else {
++		DWC_DEBUGPL(DBG_ANY, "Device Mode\n");
++		core_if->op_state = B_PERIPHERAL;
++#ifdef DWC_DEVICE_ONLY
++		dwc_otg_core_dev_init(core_if);
++#endif
++	}
++}
++
++/**
++ * This function enables the Device mode interrupts.
++ *
++ * @param core_if Programming view of DWC_otg controller
++ */
++void dwc_otg_enable_device_interrupts(dwc_otg_core_if_t * core_if)
++{
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++
++	DWC_DEBUGPL(DBG_CIL, "%s()\n", __func__);
++
++	/* Disable all interrupts. */
++	DWC_WRITE_REG32(&global_regs->gintmsk, 0);
++
++	/* Clear any pending interrupts */
++	DWC_WRITE_REG32(&global_regs->gintsts, 0xFFFFFFFF);
++
++	/* Enable the common interrupts */
++	dwc_otg_enable_common_interrupts(core_if);
++
++	/* Enable interrupts */
++	intr_mask.b.usbreset = 1;
++	intr_mask.b.enumdone = 1;
++	/* Disable Disconnect interrupt in Device mode */
++	intr_mask.b.disconnect = 0;
++
++	if (!core_if->multiproc_int_enable) {
++		intr_mask.b.inepintr = 1;
++		intr_mask.b.outepintr = 1;
++	}
++
++	intr_mask.b.erlysuspend = 1;
++
++	if (core_if->en_multiple_tx_fifo == 0) {
++		intr_mask.b.epmismatch = 1;
++	}
++
++	//intr_mask.b.incomplisoout = 1;
++	intr_mask.b.incomplisoin = 1;
++
++/* Enable the ignore frame number for ISOC xfers - MAS */
++/* Disable to support high bandwith ISOC transfers - manukz */
++#if 0
++#ifdef DWC_UTE_PER_IO
++	if (core_if->dma_enable) {
++		if (core_if->dma_desc_enable) {
++			dctl_data_t dctl1 = {.d32 = 0 };
++			dctl1.b.ifrmnum = 1;
++			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
++					 dctl, 0, dctl1.d32);
++			DWC_DEBUG("----Enabled Ignore frame number (0x%08x)",
++				  DWC_READ_REG32(&core_if->dev_if->
++						 dev_global_regs->dctl));
++		}
++	}
++#endif
++#endif
++#ifdef DWC_EN_ISOC
++	if (core_if->dma_enable) {
++		if (core_if->dma_desc_enable == 0) {
++			if (core_if->pti_enh_enable) {
++				dctl_data_t dctl = {.d32 = 0 };
++				dctl.b.ifrmnum = 1;
++				DWC_MODIFY_REG32(&core_if->
++						 dev_if->dev_global_regs->dctl,
++						 0, dctl.d32);
++			} else {
++				intr_mask.b.incomplisoin = 1;
++				intr_mask.b.incomplisoout = 1;
++			}
++		}
++	} else {
++		intr_mask.b.incomplisoin = 1;
++		intr_mask.b.incomplisoout = 1;
++	}
++#endif /* DWC_EN_ISOC */
++
++	/** @todo NGS: Should this be a module parameter? */
++#ifdef USE_PERIODIC_EP
++	intr_mask.b.isooutdrop = 1;
++	intr_mask.b.eopframe = 1;
++	intr_mask.b.incomplisoin = 1;
++	intr_mask.b.incomplisoout = 1;
++#endif
++
++	DWC_MODIFY_REG32(&global_regs->gintmsk, intr_mask.d32, intr_mask.d32);
++
++	DWC_DEBUGPL(DBG_CIL, "%s() gintmsk=%0x\n", __func__,
++		    DWC_READ_REG32(&global_regs->gintmsk));
++}
++
++/**
++ * This function initializes the DWC_otg controller registers for
++ * device mode.
++ *
++ * @param core_if Programming view of DWC_otg controller
++ *
++ */
++void dwc_otg_core_dev_init(dwc_otg_core_if_t * core_if)
++{
++	int i;
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	dwc_otg_core_params_t *params = core_if->core_params;
++	dcfg_data_t dcfg = {.d32 = 0 };
++	depctl_data_t diepctl = {.d32 = 0 };
++	grstctl_t resetctl = {.d32 = 0 };
++	uint32_t rx_fifo_size;
++	fifosize_data_t nptxfifosize;
++	fifosize_data_t txfifosize;
++	dthrctl_data_t dthrctl;
++	fifosize_data_t ptxfifosize;
++	uint16_t rxfsiz, nptxfsiz;
++	gdfifocfg_data_t gdfifocfg = {.d32 = 0 };
++	hwcfg3_data_t hwcfg3 = {.d32 = 0 };
++
++	/* Restart the Phy Clock */
++	DWC_WRITE_REG32(core_if->pcgcctl, 0);
++
++	/* Device configuration register */
++	init_devspd(core_if);
++	dcfg.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dcfg);
++	dcfg.b.descdma = (core_if->dma_desc_enable) ? 1 : 0;
++	dcfg.b.perfrint = DWC_DCFG_FRAME_INTERVAL_80;
++	/* Enable Device OUT NAK in case of DDMA mode*/
++	if (core_if->core_params->dev_out_nak) {
++		dcfg.b.endevoutnak = 1;
++	}
++
++	if (core_if->core_params->cont_on_bna) {
++		dctl_data_t dctl = {.d32 = 0 };
++		dctl.b.encontonbna = 1;
++		DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, 0, dctl.d32);
++	}
++
++
++	DWC_WRITE_REG32(&dev_if->dev_global_regs->dcfg, dcfg.d32);
++
++	/* Configure data FIFO sizes */
++	if (core_if->hwcfg2.b.dynamic_fifo && params->enable_dynamic_fifo) {
++		DWC_DEBUGPL(DBG_CIL, "Total FIFO Size=%d\n",
++			    core_if->total_fifo_size);
++		DWC_DEBUGPL(DBG_CIL, "Rx FIFO Size=%d\n",
++			    params->dev_rx_fifo_size);
++		DWC_DEBUGPL(DBG_CIL, "NP Tx FIFO Size=%d\n",
++			    params->dev_nperio_tx_fifo_size);
++
++		/* Rx FIFO */
++		DWC_DEBUGPL(DBG_CIL, "initial grxfsiz=%08x\n",
++			    DWC_READ_REG32(&global_regs->grxfsiz));
++
++#ifdef DWC_UTE_CFI
++		core_if->pwron_rxfsiz = DWC_READ_REG32(&global_regs->grxfsiz);
++		core_if->init_rxfsiz = params->dev_rx_fifo_size;
++#endif
++		rx_fifo_size = params->dev_rx_fifo_size;
++		DWC_WRITE_REG32(&global_regs->grxfsiz, rx_fifo_size);
++
++		DWC_DEBUGPL(DBG_CIL, "new grxfsiz=%08x\n",
++			    DWC_READ_REG32(&global_regs->grxfsiz));
++
++		/** Set Periodic Tx FIFO Mask all bits 0 */
++		core_if->p_tx_msk = 0;
++
++		/** Set Tx FIFO Mask all bits 0 */
++		core_if->tx_msk = 0;
++
++		if (core_if->en_multiple_tx_fifo == 0) {
++			/* Non-periodic Tx FIFO */
++			DWC_DEBUGPL(DBG_CIL, "initial gnptxfsiz=%08x\n",
++				    DWC_READ_REG32(&global_regs->gnptxfsiz));
++
++			nptxfifosize.b.depth = params->dev_nperio_tx_fifo_size;
++			nptxfifosize.b.startaddr = params->dev_rx_fifo_size;
++
++			DWC_WRITE_REG32(&global_regs->gnptxfsiz,
++					nptxfifosize.d32);
++
++			DWC_DEBUGPL(DBG_CIL, "new gnptxfsiz=%08x\n",
++				    DWC_READ_REG32(&global_regs->gnptxfsiz));
++
++			/**@todo NGS: Fix Periodic FIFO Sizing! */
++			/*
++			 * Periodic Tx FIFOs These FIFOs are numbered from 1 to 15.
++			 * Indexes of the FIFO size module parameters in the
++			 * dev_perio_tx_fifo_size array and the FIFO size registers in
++			 * the dptxfsiz array run from 0 to 14.
++			 */
++			/** @todo Finish debug of this */
++			ptxfifosize.b.startaddr =
++			    nptxfifosize.b.startaddr + nptxfifosize.b.depth;
++			for (i = 0; i < core_if->hwcfg4.b.num_dev_perio_in_ep; i++) {
++				ptxfifosize.b.depth =
++				    params->dev_perio_tx_fifo_size[i];
++				DWC_DEBUGPL(DBG_CIL,
++					    "initial dtxfsiz[%d]=%08x\n", i,
++					    DWC_READ_REG32(&global_regs->dtxfsiz
++							   [i]));
++				DWC_WRITE_REG32(&global_regs->dtxfsiz[i],
++						ptxfifosize.d32);
++				DWC_DEBUGPL(DBG_CIL, "new dtxfsiz[%d]=%08x\n",
++					    i,
++					    DWC_READ_REG32(&global_regs->dtxfsiz
++							   [i]));
++				ptxfifosize.b.startaddr += ptxfifosize.b.depth;
++			}
++		} else {
++			/*
++			 * Tx FIFOs These FIFOs are numbered from 1 to 15.
++			 * Indexes of the FIFO size module parameters in the
++			 * dev_tx_fifo_size array and the FIFO size registers in
++			 * the dtxfsiz array run from 0 to 14.
++			 */
++
++			/* Non-periodic Tx FIFO */
++			DWC_DEBUGPL(DBG_CIL, "initial gnptxfsiz=%08x\n",
++				    DWC_READ_REG32(&global_regs->gnptxfsiz));
++
++#ifdef DWC_UTE_CFI
++			core_if->pwron_gnptxfsiz =
++			    (DWC_READ_REG32(&global_regs->gnptxfsiz) >> 16);
++			core_if->init_gnptxfsiz =
++			    params->dev_nperio_tx_fifo_size;
++#endif
++			nptxfifosize.b.depth = params->dev_nperio_tx_fifo_size;
++			nptxfifosize.b.startaddr = params->dev_rx_fifo_size;
++
++			DWC_WRITE_REG32(&global_regs->gnptxfsiz,
++					nptxfifosize.d32);
++
++			DWC_DEBUGPL(DBG_CIL, "new gnptxfsiz=%08x\n",
++				    DWC_READ_REG32(&global_regs->gnptxfsiz));
++
++			txfifosize.b.startaddr =
++			    nptxfifosize.b.startaddr + nptxfifosize.b.depth;
++
++			for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
++
++				txfifosize.b.depth =
++				    params->dev_tx_fifo_size[i];
++
++				DWC_DEBUGPL(DBG_CIL,
++					    "initial dtxfsiz[%d]=%08x\n",
++					    i,
++					    DWC_READ_REG32(&global_regs->dtxfsiz
++							   [i]));
++
++#ifdef DWC_UTE_CFI
++				core_if->pwron_txfsiz[i] =
++				    (DWC_READ_REG32
++				     (&global_regs->dtxfsiz[i]) >> 16);
++				core_if->init_txfsiz[i] =
++				    params->dev_tx_fifo_size[i];
++#endif
++				DWC_WRITE_REG32(&global_regs->dtxfsiz[i],
++						txfifosize.d32);
++
++				DWC_DEBUGPL(DBG_CIL,
++					    "new dtxfsiz[%d]=%08x\n",
++					    i,
++					    DWC_READ_REG32(&global_regs->dtxfsiz
++							   [i]));
++
++				txfifosize.b.startaddr += txfifosize.b.depth;
++			}
++			if (core_if->snpsid <= OTG_CORE_REV_2_94a) {
++				/* Calculating DFIFOCFG for Device mode to include RxFIFO and NPTXFIFO */
++				gdfifocfg.d32 = DWC_READ_REG32(&global_regs->gdfifocfg);
++				hwcfg3.d32 = DWC_READ_REG32(&global_regs->ghwcfg3);
++				gdfifocfg.b.gdfifocfg = (DWC_READ_REG32(&global_regs->ghwcfg3) >> 16);
++				DWC_WRITE_REG32(&global_regs->gdfifocfg, gdfifocfg.d32);
++				rxfsiz = (DWC_READ_REG32(&global_regs->grxfsiz) & 0x0000ffff);
++				nptxfsiz = (DWC_READ_REG32(&global_regs->gnptxfsiz) >> 16);
++				gdfifocfg.b.epinfobase = rxfsiz + nptxfsiz;
++				DWC_WRITE_REG32(&global_regs->gdfifocfg, gdfifocfg.d32);
++			}
++		}
++
++		/* Flush the FIFOs */
++		dwc_otg_flush_tx_fifo(core_if, 0x10);	/* all Tx FIFOs */
++		dwc_otg_flush_rx_fifo(core_if);
++
++		/* Flush the Learning Queue. */
++		resetctl.b.intknqflsh = 1;
++		DWC_WRITE_REG32(&core_if->core_global_regs->grstctl, resetctl.d32);
++
++		if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable) {
++			core_if->start_predict = 0;
++			for (i = 0; i<= core_if->dev_if->num_in_eps; ++i) {
++				core_if->nextep_seq[i] = 0xff;	// 0xff - EP not active
++			}
++			core_if->nextep_seq[0] = 0;
++			core_if->first_in_nextep_seq = 0;
++			diepctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[0]->diepctl);
++			diepctl.b.nextep = 0;
++			DWC_WRITE_REG32(&dev_if->in_ep_regs[0]->diepctl, diepctl.d32);
++
++			/* Update IN Endpoint Mismatch Count by active IN NP EP count + 1 */
++			dcfg.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dcfg);
++			dcfg.b.epmscnt = 2;
++			DWC_WRITE_REG32(&dev_if->dev_global_regs->dcfg, dcfg.d32);
++
++			DWC_DEBUGPL(DBG_CILV,"%s first_in_nextep_seq= %2d; nextep_seq[]:\n",
++				__func__, core_if->first_in_nextep_seq);
++			for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
++				DWC_DEBUGPL(DBG_CILV, "%2d ", core_if->nextep_seq[i]);
++			}
++			DWC_DEBUGPL(DBG_CILV,"\n");
++		}
++
++		/* Clear all pending Device Interrupts */
++		/** @todo - if the condition needed to be checked
++		 *  or in any case all pending interrutps should be cleared?
++	     */
++		if (core_if->multiproc_int_enable) {
++			for (i = 0; i < core_if->dev_if->num_in_eps; ++i) {
++				DWC_WRITE_REG32(&dev_if->
++						dev_global_regs->diepeachintmsk[i], 0);
++			}
++		}
++
++		for (i = 0; i < core_if->dev_if->num_out_eps; ++i) {
++			DWC_WRITE_REG32(&dev_if->
++					dev_global_regs->doepeachintmsk[i], 0);
++		}
++
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->deachint, 0xFFFFFFFF);
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->deachintmsk, 0);
++	} else {
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->diepmsk, 0);
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->doepmsk, 0);
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->daint, 0xFFFFFFFF);
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->daintmsk, 0);
++	}
++
++	for (i = 0; i <= dev_if->num_in_eps; i++) {
++		depctl_data_t depctl;
++		depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
++		if (depctl.b.epena) {
++			depctl.d32 = 0;
++			depctl.b.epdis = 1;
++			depctl.b.snak = 1;
++		} else {
++			depctl.d32 = 0;
++		}
++
++		DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepctl, depctl.d32);
++
++		DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->dieptsiz, 0);
++		DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepdma, 0);
++		DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepint, 0xFF);
++	}
++
++	for (i = 0; i <= dev_if->num_out_eps; i++) {
++		depctl_data_t depctl;
++		depctl.d32 = DWC_READ_REG32(&dev_if->out_ep_regs[i]->doepctl);
++		if (depctl.b.epena) {
++			dctl_data_t dctl = {.d32 = 0 };
++			gintmsk_data_t gintsts = {.d32 = 0 };
++			doepint_data_t doepint = {.d32 = 0 };
++			dctl.b.sgoutnak = 1;
++			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
++			do {
++				dwc_udelay(10);
++				gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++			} while (!gintsts.b.goutnakeff);
++			gintsts.d32 = 0;
++			gintsts.b.goutnakeff = 1;
++			DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++
++			depctl.d32 = 0;
++			depctl.b.epdis = 1;
++			depctl.b.snak = 1;
++			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[i]->doepctl, depctl.d32);
++			do {
++				dwc_udelay(10);
++				doepint.d32 = DWC_READ_REG32(&core_if->dev_if->
++					out_ep_regs[i]->doepint);
++			} while (!doepint.b.epdisabled);
++
++			doepint.b.epdisabled = 1;
++			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[i]->doepint, doepint.d32);
++
++			dctl.d32 = 0;
++			dctl.b.cgoutnak = 1;
++			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
++		} else {
++			depctl.d32 = 0;
++		}
++
++		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doepctl, depctl.d32);
++
++		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doeptsiz, 0);
++		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doepdma, 0);
++		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doepint, 0xFF);
++	}
++
++	if (core_if->en_multiple_tx_fifo && core_if->dma_enable) {
++		dev_if->non_iso_tx_thr_en = params->thr_ctl & 0x1;
++		dev_if->iso_tx_thr_en = (params->thr_ctl >> 1) & 0x1;
++		dev_if->rx_thr_en = (params->thr_ctl >> 2) & 0x1;
++
++		dev_if->rx_thr_length = params->rx_thr_length;
++		dev_if->tx_thr_length = params->tx_thr_length;
++
++		dev_if->setup_desc_index = 0;
++
++		dthrctl.d32 = 0;
++		dthrctl.b.non_iso_thr_en = dev_if->non_iso_tx_thr_en;
++		dthrctl.b.iso_thr_en = dev_if->iso_tx_thr_en;
++		dthrctl.b.tx_thr_len = dev_if->tx_thr_length;
++		dthrctl.b.rx_thr_en = dev_if->rx_thr_en;
++		dthrctl.b.rx_thr_len = dev_if->rx_thr_length;
++		dthrctl.b.ahb_thr_ratio = params->ahb_thr_ratio;
++
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->dtknqr3_dthrctl,
++				dthrctl.d32);
++
++		DWC_DEBUGPL(DBG_CIL,
++			    "Non ISO Tx Thr - %d\nISO Tx Thr - %d\nRx Thr - %d\nTx Thr Len - %d\nRx Thr Len - %d\n",
++			    dthrctl.b.non_iso_thr_en, dthrctl.b.iso_thr_en,
++			    dthrctl.b.rx_thr_en, dthrctl.b.tx_thr_len,
++			    dthrctl.b.rx_thr_len);
++
++	}
++
++	dwc_otg_enable_device_interrupts(core_if);
++
++	{
++		diepmsk_data_t msk = {.d32 = 0 };
++		msk.b.txfifoundrn = 1;
++		if (core_if->multiproc_int_enable) {
++			DWC_MODIFY_REG32(&dev_if->dev_global_regs->
++					 diepeachintmsk[0], msk.d32, msk.d32);
++		} else {
++			DWC_MODIFY_REG32(&dev_if->dev_global_regs->diepmsk,
++					 msk.d32, msk.d32);
++		}
++	}
++
++	if (core_if->multiproc_int_enable) {
++		/* Set NAK on Babble */
++		dctl_data_t dctl = {.d32 = 0 };
++		dctl.b.nakonbble = 1;
++		DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, 0, dctl.d32);
++	}
++
++	if (core_if->snpsid >= OTG_CORE_REV_2_94a) {
++		dctl_data_t dctl = {.d32 = 0 };
++		dctl.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dctl);
++		dctl.b.sftdiscon = 0;
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->dctl, dctl.d32);
++	}
++}
++
++/**
++ * This function enables the Host mode interrupts.
++ *
++ * @param core_if Programming view of DWC_otg controller
++ */
++void dwc_otg_enable_host_interrupts(dwc_otg_core_if_t * core_if)
++{
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	DWC_DEBUGPL(DBG_CIL, "%s(%p)\n", __func__, core_if);
++
++	/* Disable all interrupts. */
++	DWC_WRITE_REG32(&global_regs->gintmsk, 0);
++
++	/* Clear any pending interrupts. */
++	DWC_WRITE_REG32(&global_regs->gintsts, 0xFFFFFFFF);
++
++	/* Enable the common interrupts */
++	dwc_otg_enable_common_interrupts(core_if);
++
++	/*
++	 * Enable host mode interrupts without disturbing common
++	 * interrupts.
++	 */
++
++	intr_mask.b.disconnect = 1;
++	intr_mask.b.portintr = 1;
++	intr_mask.b.hcintr = 1;
++
++	DWC_MODIFY_REG32(&global_regs->gintmsk, intr_mask.d32, intr_mask.d32);
++}
++
++/**
++ * This function disables the Host Mode interrupts.
++ *
++ * @param core_if Programming view of DWC_otg controller
++ */
++void dwc_otg_disable_host_interrupts(dwc_otg_core_if_t * core_if)
++{
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	DWC_DEBUGPL(DBG_CILV, "%s()\n", __func__);
++
++	/*
++	 * Disable host mode interrupts without disturbing common
++	 * interrupts.
++	 */
++	intr_mask.b.sofintr = 1;
++	intr_mask.b.portintr = 1;
++	intr_mask.b.hcintr = 1;
++	intr_mask.b.ptxfempty = 1;
++	intr_mask.b.nptxfempty = 1;
++
++	DWC_MODIFY_REG32(&global_regs->gintmsk, intr_mask.d32, 0);
++}
++
++/**
++ * This function initializes the DWC_otg controller registers for
++ * host mode.
++ *
++ * This function flushes the Tx and Rx FIFOs and it flushes any entries in the
++ * request queues. Host channels are reset to ensure that they are ready for
++ * performing transfers.
++ *
++ * @param core_if Programming view of DWC_otg controller
++ *
++ */
++void dwc_otg_core_host_init(dwc_otg_core_if_t * core_if)
++{
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	dwc_otg_host_if_t *host_if = core_if->host_if;
++	dwc_otg_core_params_t *params = core_if->core_params;
++	hprt0_data_t hprt0 = {.d32 = 0 };
++	fifosize_data_t nptxfifosize;
++	fifosize_data_t ptxfifosize;
++	uint16_t rxfsiz, nptxfsiz, hptxfsiz;
++	gdfifocfg_data_t gdfifocfg = {.d32 = 0 };
++	int i;
++	hcchar_data_t hcchar;
++	hcfg_data_t hcfg;
++	hfir_data_t hfir;
++	dwc_otg_hc_regs_t *hc_regs;
++	int num_channels;
++	gotgctl_data_t gotgctl = {.d32 = 0 };
++
++	DWC_DEBUGPL(DBG_CILV, "%s(%p)\n", __func__, core_if);
++
++	/* Restart the Phy Clock */
++	DWC_WRITE_REG32(core_if->pcgcctl, 0);
++
++	/* Initialize Host Configuration Register */
++	init_fslspclksel(core_if);
++	if (core_if->core_params->speed == DWC_SPEED_PARAM_FULL) {
++		hcfg.d32 = DWC_READ_REG32(&host_if->host_global_regs->hcfg);
++		hcfg.b.fslssupp = 1;
++		DWC_WRITE_REG32(&host_if->host_global_regs->hcfg, hcfg.d32);
++
++	}
++
++	/* This bit allows dynamic reloading of the HFIR register
++	 * during runtime. This bit needs to be programmed during
++	 * initial configuration and its value must not be changed
++	 * during runtime.*/
++	if (core_if->core_params->reload_ctl == 1) {
++		hfir.d32 = DWC_READ_REG32(&host_if->host_global_regs->hfir);
++		hfir.b.hfirrldctrl = 1;
++		DWC_WRITE_REG32(&host_if->host_global_regs->hfir, hfir.d32);
++	}
++
++	if (core_if->core_params->dma_desc_enable) {
++		uint8_t op_mode = core_if->hwcfg2.b.op_mode;
++		if (!
++		    (core_if->hwcfg4.b.desc_dma
++		     && (core_if->snpsid >= OTG_CORE_REV_2_90a)
++		     && ((op_mode == DWC_HWCFG2_OP_MODE_HNP_SRP_CAPABLE_OTG)
++			 || (op_mode == DWC_HWCFG2_OP_MODE_SRP_ONLY_CAPABLE_OTG)
++			 || (op_mode ==
++			     DWC_HWCFG2_OP_MODE_NO_HNP_SRP_CAPABLE_OTG)
++			 || (op_mode == DWC_HWCFG2_OP_MODE_SRP_CAPABLE_HOST)
++			 || (op_mode ==
++			     DWC_HWCFG2_OP_MODE_NO_SRP_CAPABLE_HOST)))) {
++
++			DWC_ERROR("Host can't operate in Descriptor DMA mode.\n"
++				  "Either core version is below 2.90a or "
++				  "GHWCFG2, GHWCFG4 registers' values do not allow Descriptor DMA in host mode.\n"
++				  "To run the driver in Buffer DMA host mode set dma_desc_enable "
++				  "module parameter to 0.\n");
++			return;
++		}
++		hcfg.d32 = DWC_READ_REG32(&host_if->host_global_regs->hcfg);
++		hcfg.b.descdma = 1;
++		DWC_WRITE_REG32(&host_if->host_global_regs->hcfg, hcfg.d32);
++	}
++
++	/* Configure data FIFO sizes */
++	if (core_if->hwcfg2.b.dynamic_fifo && params->enable_dynamic_fifo) {
++		DWC_DEBUGPL(DBG_CIL, "Total FIFO Size=%d\n",
++			    core_if->total_fifo_size);
++		DWC_DEBUGPL(DBG_CIL, "Rx FIFO Size=%d\n",
++			    params->host_rx_fifo_size);
++		DWC_DEBUGPL(DBG_CIL, "NP Tx FIFO Size=%d\n",
++			    params->host_nperio_tx_fifo_size);
++		DWC_DEBUGPL(DBG_CIL, "P Tx FIFO Size=%d\n",
++			    params->host_perio_tx_fifo_size);
++
++		/* Rx FIFO */
++		DWC_DEBUGPL(DBG_CIL, "initial grxfsiz=%08x\n",
++			    DWC_READ_REG32(&global_regs->grxfsiz));
++		DWC_WRITE_REG32(&global_regs->grxfsiz,
++				params->host_rx_fifo_size);
++		DWC_DEBUGPL(DBG_CIL, "new grxfsiz=%08x\n",
++			    DWC_READ_REG32(&global_regs->grxfsiz));
++
++		/* Non-periodic Tx FIFO */
++		DWC_DEBUGPL(DBG_CIL, "initial gnptxfsiz=%08x\n",
++			    DWC_READ_REG32(&global_regs->gnptxfsiz));
++		nptxfifosize.b.depth = params->host_nperio_tx_fifo_size;
++		nptxfifosize.b.startaddr = params->host_rx_fifo_size;
++		DWC_WRITE_REG32(&global_regs->gnptxfsiz, nptxfifosize.d32);
++		DWC_DEBUGPL(DBG_CIL, "new gnptxfsiz=%08x\n",
++			    DWC_READ_REG32(&global_regs->gnptxfsiz));
++
++		/* Periodic Tx FIFO */
++		DWC_DEBUGPL(DBG_CIL, "initial hptxfsiz=%08x\n",
++			    DWC_READ_REG32(&global_regs->hptxfsiz));
++		ptxfifosize.b.depth = params->host_perio_tx_fifo_size;
++		ptxfifosize.b.startaddr =
++		    nptxfifosize.b.startaddr + nptxfifosize.b.depth;
++		DWC_WRITE_REG32(&global_regs->hptxfsiz, ptxfifosize.d32);
++		DWC_DEBUGPL(DBG_CIL, "new hptxfsiz=%08x\n",
++			    DWC_READ_REG32(&global_regs->hptxfsiz));
++
++		if (core_if->en_multiple_tx_fifo
++		    && core_if->snpsid <= OTG_CORE_REV_2_94a) {
++			/* Global DFIFOCFG calculation for Host mode - include RxFIFO, NPTXFIFO and HPTXFIFO */
++			gdfifocfg.d32 = DWC_READ_REG32(&global_regs->gdfifocfg);
++			rxfsiz = (DWC_READ_REG32(&global_regs->grxfsiz) & 0x0000ffff);
++			nptxfsiz = (DWC_READ_REG32(&global_regs->gnptxfsiz) >> 16);
++			hptxfsiz = (DWC_READ_REG32(&global_regs->hptxfsiz) >> 16);
++			gdfifocfg.b.epinfobase = rxfsiz + nptxfsiz + hptxfsiz;
++			DWC_WRITE_REG32(&global_regs->gdfifocfg, gdfifocfg.d32);
++		}
++	}
++
++	/* TODO - check this */
++	/* Clear Host Set HNP Enable in the OTG Control Register */
++	gotgctl.b.hstsethnpen = 1;
++	DWC_MODIFY_REG32(&global_regs->gotgctl, gotgctl.d32, 0);
++	/* Make sure the FIFOs are flushed. */
++	dwc_otg_flush_tx_fifo(core_if, 0x10 /* all TX FIFOs */ );
++	dwc_otg_flush_rx_fifo(core_if);
++
++	/* Clear Host Set HNP Enable in the OTG Control Register */
++	gotgctl.b.hstsethnpen = 1;
++	DWC_MODIFY_REG32(&global_regs->gotgctl, gotgctl.d32, 0);
++
++	if (!core_if->core_params->dma_desc_enable) {
++		/* Flush out any leftover queued requests. */
++		num_channels = core_if->core_params->host_channels;
++
++		for (i = 0; i < num_channels; i++) {
++			hc_regs = core_if->host_if->hc_regs[i];
++			hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++			hcchar.b.chen = 0;
++			hcchar.b.chdis = 1;
++			hcchar.b.epdir = 0;
++			DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++		}
++
++		/* Halt all channels to put them into a known state. */
++		for (i = 0; i < num_channels; i++) {
++			int count = 0;
++			hc_regs = core_if->host_if->hc_regs[i];
++			hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++			hcchar.b.chen = 1;
++			hcchar.b.chdis = 1;
++			hcchar.b.epdir = 0;
++			DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++			DWC_DEBUGPL(DBG_HCDV, "%s: Halt channel %d regs %p\n", __func__, i, hc_regs);
++			do {
++				hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++				if (++count > 1000) {
++					DWC_ERROR
++					    ("%s: Unable to clear halt on channel %d (timeout HCCHAR 0x%X @%p)\n",
++					     __func__, i, hcchar.d32, &hc_regs->hcchar);
++					break;
++				}
++				dwc_udelay(1);
++			} while (hcchar.b.chen);
++		}
++	}
++
++	/* Turn on the vbus power. */
++	DWC_PRINTF("Init: Port Power? op_state=%d\n", core_if->op_state);
++	if (core_if->op_state == A_HOST) {
++		hprt0.d32 = dwc_otg_read_hprt0(core_if);
++		DWC_PRINTF("Init: Power Port (%d)\n", hprt0.b.prtpwr);
++		if (hprt0.b.prtpwr == 0) {
++			hprt0.b.prtpwr = 1;
++			DWC_WRITE_REG32(host_if->hprt0, hprt0.d32);
++		}
++	}
++
++	dwc_otg_enable_host_interrupts(core_if);
++}
++
++/**
++ * Prepares a host channel for transferring packets to/from a specific
++ * endpoint. The HCCHARn register is set up with the characteristics specified
++ * in _hc. Host channel interrupts that may need to be serviced while this
++ * transfer is in progress are enabled.
++ *
++ * @param core_if Programming view of DWC_otg controller
++ * @param hc Information needed to initialize the host channel
++ */
++void dwc_otg_hc_init(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
++{
++	hcintmsk_data_t hc_intr_mask;
++	hcchar_data_t hcchar;
++	hcsplt_data_t hcsplt;
++
++	uint8_t hc_num = hc->hc_num;
++	dwc_otg_host_if_t *host_if = core_if->host_if;
++	dwc_otg_hc_regs_t *hc_regs = host_if->hc_regs[hc_num];
++
++	/* Clear old interrupt conditions for this host channel. */
++	hc_intr_mask.d32 = 0xFFFFFFFF;
++	hc_intr_mask.b.reserved14_31 = 0;
++	DWC_WRITE_REG32(&hc_regs->hcint, hc_intr_mask.d32);
++
++	/* Enable channel interrupts required for this transfer. */
++	hc_intr_mask.d32 = 0;
++	hc_intr_mask.b.chhltd = 1;
++	if (core_if->dma_enable) {
++		/* For Descriptor DMA mode core halts the channel on AHB error. Interrupt is not required */
++		if (!core_if->dma_desc_enable)
++			hc_intr_mask.b.ahberr = 1;
++		else {
++			if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC)
++				hc_intr_mask.b.xfercompl = 1;
++		}
++
++		if (hc->error_state && !hc->do_split &&
++		    hc->ep_type != DWC_OTG_EP_TYPE_ISOC) {
++			hc_intr_mask.b.ack = 1;
++			if (hc->ep_is_in) {
++				hc_intr_mask.b.datatglerr = 1;
++				if (hc->ep_type != DWC_OTG_EP_TYPE_INTR) {
++					hc_intr_mask.b.nak = 1;
++				}
++			}
++		}
++	} else {
++		switch (hc->ep_type) {
++		case DWC_OTG_EP_TYPE_CONTROL:
++		case DWC_OTG_EP_TYPE_BULK:
++			hc_intr_mask.b.xfercompl = 1;
++			hc_intr_mask.b.stall = 1;
++			hc_intr_mask.b.xacterr = 1;
++			hc_intr_mask.b.datatglerr = 1;
++			if (hc->ep_is_in) {
++				hc_intr_mask.b.bblerr = 1;
++			} else {
++				hc_intr_mask.b.nak = 1;
++				hc_intr_mask.b.nyet = 1;
++				if (hc->do_ping) {
++					hc_intr_mask.b.ack = 1;
++				}
++			}
++
++			if (hc->do_split) {
++				hc_intr_mask.b.nak = 1;
++				if (hc->complete_split) {
++					hc_intr_mask.b.nyet = 1;
++				} else {
++					hc_intr_mask.b.ack = 1;
++				}
++			}
++
++			if (hc->error_state) {
++				hc_intr_mask.b.ack = 1;
++			}
++			break;
++		case DWC_OTG_EP_TYPE_INTR:
++			hc_intr_mask.b.xfercompl = 1;
++			hc_intr_mask.b.nak = 1;
++			hc_intr_mask.b.stall = 1;
++			hc_intr_mask.b.xacterr = 1;
++			hc_intr_mask.b.datatglerr = 1;
++			hc_intr_mask.b.frmovrun = 1;
++
++			if (hc->ep_is_in) {
++				hc_intr_mask.b.bblerr = 1;
++			}
++			if (hc->error_state) {
++				hc_intr_mask.b.ack = 1;
++			}
++			if (hc->do_split) {
++				if (hc->complete_split) {
++					hc_intr_mask.b.nyet = 1;
++				} else {
++					hc_intr_mask.b.ack = 1;
++				}
++			}
++			break;
++		case DWC_OTG_EP_TYPE_ISOC:
++			hc_intr_mask.b.xfercompl = 1;
++			hc_intr_mask.b.frmovrun = 1;
++			hc_intr_mask.b.ack = 1;
++
++			if (hc->ep_is_in) {
++				hc_intr_mask.b.xacterr = 1;
++				hc_intr_mask.b.bblerr = 1;
++			}
++			break;
++		}
++	}
++	DWC_WRITE_REG32(&hc_regs->hcintmsk, hc_intr_mask.d32);
++
++	/*
++	 * Program the HCCHARn register with the endpoint characteristics for
++	 * the current transfer.
++	 */
++	hcchar.d32 = 0;
++	hcchar.b.devaddr = hc->dev_addr;
++	hcchar.b.epnum = hc->ep_num;
++	hcchar.b.epdir = hc->ep_is_in;
++	hcchar.b.lspddev = (hc->speed == DWC_OTG_EP_SPEED_LOW);
++	hcchar.b.eptype = hc->ep_type;
++	hcchar.b.mps = hc->max_packet;
++
++	DWC_WRITE_REG32(&host_if->hc_regs[hc_num]->hcchar, hcchar.d32);
++
++	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d, Dev Addr %d, EP #%d\n",
++                    __func__, hc->hc_num, hcchar.b.devaddr, hcchar.b.epnum);
++	DWC_DEBUGPL(DBG_HCDV, "	 Is In %d, Is Low Speed %d, EP Type %d, "
++                                "Max Pkt %d, Multi Cnt %d\n",
++                    hcchar.b.epdir, hcchar.b.lspddev, hcchar.b.eptype,
++                    hcchar.b.mps, hcchar.b.multicnt);
++
++	/*
++	 * Program the HCSPLIT register for SPLITs
++	 */
++	hcsplt.d32 = 0;
++	if (hc->do_split) {
++		DWC_DEBUGPL(DBG_HCDV, "Programming HC %d with split --> %s\n",
++			    hc->hc_num,
++			    hc->complete_split ? "CSPLIT" : "SSPLIT");
++		hcsplt.b.compsplt = hc->complete_split;
++		hcsplt.b.xactpos = hc->xact_pos;
++		hcsplt.b.hubaddr = hc->hub_addr;
++		hcsplt.b.prtaddr = hc->port_addr;
++		DWC_DEBUGPL(DBG_HCDV, "\t  comp split %d\n", hc->complete_split);
++		DWC_DEBUGPL(DBG_HCDV, "\t  xact pos %d\n", hc->xact_pos);
++		DWC_DEBUGPL(DBG_HCDV, "\t  hub addr %d\n", hc->hub_addr);
++		DWC_DEBUGPL(DBG_HCDV, "\t  port addr %d\n", hc->port_addr);
++		DWC_DEBUGPL(DBG_HCDV, "\t  is_in %d\n", hc->ep_is_in);
++		DWC_DEBUGPL(DBG_HCDV, "\t  Max Pkt: %d\n", hcchar.b.mps);
++		DWC_DEBUGPL(DBG_HCDV, "\t  xferlen: %d\n", hc->xfer_len);
++	}
++	DWC_WRITE_REG32(&host_if->hc_regs[hc_num]->hcsplt, hcsplt.d32);
++
++}
++
++/**
++ * Attempts to halt a host channel. This function should only be called in
++ * Slave mode or to abort a transfer in either Slave mode or DMA mode. Under
++ * normal circumstances in DMA mode, the controller halts the channel when the
++ * transfer is complete or a condition occurs that requires application
++ * intervention.
++ *
++ * In slave mode, checks for a free request queue entry, then sets the Channel
++ * Enable and Channel Disable bits of the Host Channel Characteristics
++ * register of the specified channel to intiate the halt. If there is no free
++ * request queue entry, sets only the Channel Disable bit of the HCCHARn
++ * register to flush requests for this channel. In the latter case, sets a
++ * flag to indicate that the host channel needs to be halted when a request
++ * queue slot is open.
++ *
++ * In DMA mode, always sets the Channel Enable and Channel Disable bits of the
++ * HCCHARn register. The controller ensures there is space in the request
++ * queue before submitting the halt request.
++ *
++ * Some time may elapse before the core flushes any posted requests for this
++ * host channel and halts. The Channel Halted interrupt handler completes the
++ * deactivation of the host channel.
++ *
++ * @param core_if Controller register interface.
++ * @param hc Host channel to halt.
++ * @param halt_status Reason for halting the channel.
++ */
++void dwc_otg_hc_halt(dwc_otg_core_if_t * core_if,
++		     dwc_hc_t * hc, dwc_otg_halt_status_e halt_status)
++{
++	gnptxsts_data_t nptxsts;
++	hptxsts_data_t hptxsts;
++	hcchar_data_t hcchar;
++	dwc_otg_hc_regs_t *hc_regs;
++	dwc_otg_core_global_regs_t *global_regs;
++	dwc_otg_host_global_regs_t *host_global_regs;
++
++	hc_regs = core_if->host_if->hc_regs[hc->hc_num];
++	global_regs = core_if->core_global_regs;
++	host_global_regs = core_if->host_if->host_global_regs;
++
++	DWC_ASSERT(!(halt_status == DWC_OTG_HC_XFER_NO_HALT_STATUS),
++		   "halt_status = %d\n", halt_status);
++
++	if (halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE ||
++	    halt_status == DWC_OTG_HC_XFER_AHB_ERR) {
++		/*
++		 * Disable all channel interrupts except Ch Halted. The QTD
++		 * and QH state associated with this transfer has been cleared
++		 * (in the case of URB_DEQUEUE), so the channel needs to be
++		 * shut down carefully to prevent crashes.
++		 */
++		hcintmsk_data_t hcintmsk;
++		hcintmsk.d32 = 0;
++		hcintmsk.b.chhltd = 1;
++		DWC_WRITE_REG32(&hc_regs->hcintmsk, hcintmsk.d32);
++
++		/*
++		 * Make sure no other interrupts besides halt are currently
++		 * pending. Handling another interrupt could cause a crash due
++		 * to the QTD and QH state.
++		 */
++		DWC_WRITE_REG32(&hc_regs->hcint, ~hcintmsk.d32);
++
++		/*
++		 * Make sure the halt status is set to URB_DEQUEUE or AHB_ERR
++		 * even if the channel was already halted for some other
++		 * reason.
++		 */
++		hc->halt_status = halt_status;
++
++		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++		if (hcchar.b.chen == 0) {
++			/*
++			 * The channel is either already halted or it hasn't
++			 * started yet. In DMA mode, the transfer may halt if
++			 * it finishes normally or a condition occurs that
++			 * requires driver intervention. Don't want to halt
++			 * the channel again. In either Slave or DMA mode,
++			 * it's possible that the transfer has been assigned
++			 * to a channel, but not started yet when an URB is
++			 * dequeued. Don't want to halt a channel that hasn't
++			 * started yet.
++			 */
++			return;
++		}
++	}
++	if (hc->halt_pending) {
++		/*
++		 * A halt has already been issued for this channel. This might
++		 * happen when a transfer is aborted by a higher level in
++		 * the stack.
++		 */
++#ifdef DEBUG
++		DWC_PRINTF
++		    ("*** %s: Channel %d, _hc->halt_pending already set ***\n",
++		     __func__, hc->hc_num);
++
++#endif
++		return;
++	}
++
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++
++	/* No need to set the bit in DDMA for disabling the channel */
++	//TODO check it everywhere channel is disabled
++	if (!core_if->core_params->dma_desc_enable)
++		hcchar.b.chen = 1;
++	hcchar.b.chdis = 1;
++
++	if (!core_if->dma_enable) {
++		/* Check for space in the request queue to issue the halt. */
++		if (hc->ep_type == DWC_OTG_EP_TYPE_CONTROL ||
++		    hc->ep_type == DWC_OTG_EP_TYPE_BULK) {
++			nptxsts.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
++			if (nptxsts.b.nptxqspcavail == 0) {
++				hcchar.b.chen = 0;
++			}
++		} else {
++			hptxsts.d32 =
++			    DWC_READ_REG32(&host_global_regs->hptxsts);
++			if ((hptxsts.b.ptxqspcavail == 0)
++			    || (core_if->queuing_high_bandwidth)) {
++				hcchar.b.chen = 0;
++			}
++		}
++	}
++	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++
++	hc->halt_status = halt_status;
++
++	if (hcchar.b.chen) {
++		hc->halt_pending = 1;
++		hc->halt_on_queue = 0;
++	} else {
++		hc->halt_on_queue = 1;
++	}
++
++	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d\n", __func__, hc->hc_num);
++	DWC_DEBUGPL(DBG_HCDV, "	 hcchar: 0x%08x\n", hcchar.d32);
++	DWC_DEBUGPL(DBG_HCDV, "	 halt_pending: %d\n", hc->halt_pending);
++	DWC_DEBUGPL(DBG_HCDV, "	 halt_on_queue: %d\n", hc->halt_on_queue);
++	DWC_DEBUGPL(DBG_HCDV, "	 halt_status: %d\n", hc->halt_status);
++
++	return;
++}
++
++/**
++ * Clears the transfer state for a host channel. This function is normally
++ * called after a transfer is done and the host channel is being released.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param hc Identifies the host channel to clean up.
++ */
++void dwc_otg_hc_cleanup(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
++{
++	dwc_otg_hc_regs_t *hc_regs;
++
++	hc->xfer_started = 0;
++
++	/*
++	 * Clear channel interrupt enables and any unhandled channel interrupt
++	 * conditions.
++	 */
++	hc_regs = core_if->host_if->hc_regs[hc->hc_num];
++	DWC_WRITE_REG32(&hc_regs->hcintmsk, 0);
++	DWC_WRITE_REG32(&hc_regs->hcint, 0xFFFFFFFF);
++#ifdef DEBUG
++	DWC_TIMER_CANCEL(core_if->hc_xfer_timer[hc->hc_num]);
++#endif
++}
++
++/**
++ * Sets the channel property that indicates in which frame a periodic transfer
++ * should occur. This is always set to the _next_ frame. This function has no
++ * effect on non-periodic transfers.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param hc Identifies the host channel to set up and its properties.
++ * @param hcchar Current value of the HCCHAR register for the specified host
++ * channel.
++ */
++static inline void hc_set_even_odd_frame(dwc_otg_core_if_t * core_if,
++					 dwc_hc_t * hc, hcchar_data_t * hcchar)
++{
++	if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
++	    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
++		hfnum_data_t hfnum;
++		hfnum.d32 =
++		    DWC_READ_REG32(&core_if->host_if->host_global_regs->hfnum);
++
++		/* 1 if _next_ frame is odd, 0 if it's even */
++		hcchar->b.oddfrm = (hfnum.b.frnum & 0x1) ? 0 : 1;
++#ifdef DEBUG
++		if (hc->ep_type == DWC_OTG_EP_TYPE_INTR && hc->do_split
++		    && !hc->complete_split) {
++			switch (hfnum.b.frnum & 0x7) {
++			case 7:
++				core_if->hfnum_7_samples++;
++				core_if->hfnum_7_frrem_accum += hfnum.b.frrem;
++				break;
++			case 0:
++				core_if->hfnum_0_samples++;
++				core_if->hfnum_0_frrem_accum += hfnum.b.frrem;
++				break;
++			default:
++				core_if->hfnum_other_samples++;
++				core_if->hfnum_other_frrem_accum +=
++				    hfnum.b.frrem;
++				break;
++			}
++		}
++#endif
++	}
++}
++
++#ifdef DEBUG
++void hc_xfer_timeout(void *ptr)
++{
++	hc_xfer_info_t *xfer_info = NULL;
++	int hc_num = 0;
++
++	if (ptr)
++		xfer_info = (hc_xfer_info_t *) ptr;
++
++	if (!xfer_info->hc) {
++		DWC_ERROR("xfer_info->hc = %p\n", xfer_info->hc);
++		return;
++	}
++
++	hc_num = xfer_info->hc->hc_num;
++	DWC_WARN("%s: timeout on channel %d\n", __func__, hc_num);
++	DWC_WARN("	start_hcchar_val 0x%08x\n",
++		 xfer_info->core_if->start_hcchar_val[hc_num]);
++}
++#endif
++
++void ep_xfer_timeout(void *ptr)
++{
++	ep_xfer_info_t *xfer_info = NULL;
++	int ep_num = 0;
++	dctl_data_t dctl = {.d32 = 0 };
++	gintsts_data_t gintsts = {.d32 = 0 };
++	gintmsk_data_t gintmsk = {.d32 = 0 };
++
++	if (ptr)
++		xfer_info = (ep_xfer_info_t *) ptr;
++
++	if (!xfer_info->ep) {
++		DWC_ERROR("xfer_info->ep = %p\n", xfer_info->ep);
++		return;
++	}
++
++	ep_num = xfer_info->ep->num;
++	DWC_WARN("%s: timeout on endpoit %d\n", __func__, ep_num);
++	/* Put the sate to 2 as it was time outed */
++	xfer_info->state = 2;
++
++	dctl.d32 =
++	    DWC_READ_REG32(&xfer_info->core_if->dev_if->dev_global_regs->dctl);
++	gintsts.d32 =
++	    DWC_READ_REG32(&xfer_info->core_if->core_global_regs->gintsts);
++	gintmsk.d32 =
++	    DWC_READ_REG32(&xfer_info->core_if->core_global_regs->gintmsk);
++
++	if (!gintmsk.b.goutnakeff) {
++		/* Unmask it */
++		gintmsk.b.goutnakeff = 1;
++		DWC_WRITE_REG32(&xfer_info->core_if->core_global_regs->gintmsk,
++				gintmsk.d32);
++
++	}
++
++	if (!gintsts.b.goutnakeff) {
++		dctl.b.sgoutnak = 1;
++	}
++	DWC_WRITE_REG32(&xfer_info->core_if->dev_if->dev_global_regs->dctl,
++			dctl.d32);
++
++}
++
++void set_pid_isoc(dwc_hc_t * hc)
++{
++	/* Set up the initial PID for the transfer. */
++	if (hc->speed == DWC_OTG_EP_SPEED_HIGH) {
++		if (hc->ep_is_in) {
++			if (hc->multi_count == 1) {
++				hc->data_pid_start = DWC_OTG_HC_PID_DATA0;
++			} else if (hc->multi_count == 2) {
++				hc->data_pid_start = DWC_OTG_HC_PID_DATA1;
++			} else {
++				hc->data_pid_start = DWC_OTG_HC_PID_DATA2;
++			}
++		} else {
++			if (hc->multi_count == 1) {
++				hc->data_pid_start = DWC_OTG_HC_PID_DATA0;
++			} else {
++				hc->data_pid_start = DWC_OTG_HC_PID_MDATA;
++			}
++		}
++	} else {
++		hc->data_pid_start = DWC_OTG_HC_PID_DATA0;
++	}
++}
++
++/**
++ * This function does the setup for a data transfer for a host channel and
++ * starts the transfer. May be called in either Slave mode or DMA mode. In
++ * Slave mode, the caller must ensure that there is sufficient space in the
++ * request queue and Tx Data FIFO.
++ *
++ * For an OUT transfer in Slave mode, it loads a data packet into the
++ * appropriate FIFO. If necessary, additional data packets will be loaded in
++ * the Host ISR.
++ *
++ * For an IN transfer in Slave mode, a data packet is requested. The data
++ * packets are unloaded from the Rx FIFO in the Host ISR. If necessary,
++ * additional data packets are requested in the Host ISR.
++ *
++ * For a PING transfer in Slave mode, the Do Ping bit is set in the HCTSIZ
++ * register along with a packet count of 1 and the channel is enabled. This
++ * causes a single PING transaction to occur. Other fields in HCTSIZ are
++ * simply set to 0 since no data transfer occurs in this case.
++ *
++ * For a PING transfer in DMA mode, the HCTSIZ register is initialized with
++ * all the information required to perform the subsequent data transfer. In
++ * addition, the Do Ping bit is set in the HCTSIZ register. In this case, the
++ * controller performs the entire PING protocol, then starts the data
++ * transfer.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param hc Information needed to initialize the host channel. The xfer_len
++ * value may be reduced to accommodate the max widths of the XferSize and
++ * PktCnt fields in the HCTSIZn register. The multi_count value may be changed
++ * to reflect the final xfer_len value.
++ */
++void dwc_otg_hc_start_transfer(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
++{
++	hcchar_data_t hcchar;
++	hctsiz_data_t hctsiz;
++	uint16_t num_packets;
++	uint32_t max_hc_xfer_size = core_if->core_params->max_transfer_size;
++	uint16_t max_hc_pkt_count = core_if->core_params->max_packet_count;
++	dwc_otg_hc_regs_t *hc_regs = core_if->host_if->hc_regs[hc->hc_num];
++
++	hctsiz.d32 = 0;
++
++	if (hc->do_ping) {
++		if (!core_if->dma_enable) {
++			dwc_otg_hc_do_ping(core_if, hc);
++			hc->xfer_started = 1;
++			return;
++		} else {
++			hctsiz.b.dopng = 1;
++		}
++	}
++
++	if (hc->do_split) {
++		num_packets = 1;
++
++		if (hc->complete_split && !hc->ep_is_in) {
++			/* For CSPLIT OUT Transfer, set the size to 0 so the
++			 * core doesn't expect any data written to the FIFO */
++			hc->xfer_len = 0;
++		} else if (hc->ep_is_in || (hc->xfer_len > hc->max_packet)) {
++			hc->xfer_len = hc->max_packet;
++		} else if (!hc->ep_is_in && (hc->xfer_len > 188)) {
++			hc->xfer_len = 188;
++		}
++
++		hctsiz.b.xfersize = hc->xfer_len;
++	} else {
++		/*
++		 * Ensure that the transfer length and packet count will fit
++		 * in the widths allocated for them in the HCTSIZn register.
++		 */
++		if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
++		    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
++			/*
++			 * Make sure the transfer size is no larger than one
++			 * (micro)frame's worth of data. (A check was done
++			 * when the periodic transfer was accepted to ensure
++			 * that a (micro)frame's worth of data can be
++			 * programmed into a channel.)
++			 */
++			uint32_t max_periodic_len =
++			    hc->multi_count * hc->max_packet;
++			if (hc->xfer_len > max_periodic_len) {
++				hc->xfer_len = max_periodic_len;
++			} else {
++			}
++		} else if (hc->xfer_len > max_hc_xfer_size) {
++			/* Make sure that xfer_len is a multiple of max packet size. */
++			hc->xfer_len = max_hc_xfer_size - hc->max_packet + 1;
++		}
++
++		if (hc->xfer_len > 0) {
++			num_packets =
++			    (hc->xfer_len + hc->max_packet -
++			     1) / hc->max_packet;
++			if (num_packets > max_hc_pkt_count) {
++				num_packets = max_hc_pkt_count;
++				hc->xfer_len = num_packets * hc->max_packet;
++			}
++		} else {
++			/* Need 1 packet for transfer length of 0. */
++			num_packets = 1;
++		}
++
++		if (hc->ep_is_in) {
++			/* Always program an integral # of max packets for IN transfers. */
++			hc->xfer_len = num_packets * hc->max_packet;
++		}
++
++		if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
++		    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
++			/*
++			 * Make sure that the multi_count field matches the
++			 * actual transfer length.
++			 */
++			hc->multi_count = num_packets;
++		}
++
++		if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC)
++			set_pid_isoc(hc);
++
++		hctsiz.b.xfersize = hc->xfer_len;
++	}
++
++	hc->start_pkt_count = num_packets;
++	hctsiz.b.pktcnt = num_packets;
++	hctsiz.b.pid = hc->data_pid_start;
++	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
++
++	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d\n", __func__, hc->hc_num);
++	DWC_DEBUGPL(DBG_HCDV, "	 Xfer Size: %d\n", hctsiz.b.xfersize);
++	DWC_DEBUGPL(DBG_HCDV, "	 Num Pkts: %d\n", hctsiz.b.pktcnt);
++	DWC_DEBUGPL(DBG_HCDV, "	 Start PID: %d\n", hctsiz.b.pid);
++
++	if (core_if->dma_enable) {
++		dwc_dma_t dma_addr;
++		if (hc->align_buff) {
++			dma_addr = hc->align_buff;
++		} else {
++			dma_addr = ((unsigned long)hc->xfer_buff & 0xffffffff);
++		}
++		DWC_WRITE_REG32(&hc_regs->hcdma, dma_addr);
++	}
++
++	/* Start the split */
++	if (hc->do_split) {
++		hcsplt_data_t hcsplt;
++		hcsplt.d32 = DWC_READ_REG32(&hc_regs->hcsplt);
++		hcsplt.b.spltena = 1;
++		DWC_WRITE_REG32(&hc_regs->hcsplt, hcsplt.d32);
++	}
++
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	hcchar.b.multicnt = hc->multi_count;
++	hc_set_even_odd_frame(core_if, hc, &hcchar);
++#ifdef DEBUG
++	core_if->start_hcchar_val[hc->hc_num] = hcchar.d32;
++	if (hcchar.b.chdis) {
++		DWC_WARN("%s: chdis set, channel %d, hcchar 0x%08x\n",
++			 __func__, hc->hc_num, hcchar.d32);
++	}
++#endif
++
++	/* Set host channel enable after all other setup is complete. */
++	hcchar.b.chen = 1;
++	hcchar.b.chdis = 0;
++	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++
++	hc->xfer_started = 1;
++	hc->requests++;
++
++	if (!core_if->dma_enable && !hc->ep_is_in && hc->xfer_len > 0) {
++		/* Load OUT packet into the appropriate Tx FIFO. */
++		dwc_otg_hc_write_packet(core_if, hc);
++	}
++#ifdef DEBUG
++	if (hc->ep_type != DWC_OTG_EP_TYPE_INTR) {
++                DWC_DEBUGPL(DBG_HCDV, "transfer %d from core_if %p\n",
++                            hc->hc_num, core_if);//GRAYG
++		core_if->hc_xfer_info[hc->hc_num].core_if = core_if;
++		core_if->hc_xfer_info[hc->hc_num].hc = hc;
++
++		/* Start a timer for this transfer. */
++		DWC_TIMER_SCHEDULE(core_if->hc_xfer_timer[hc->hc_num], 10000);
++	}
++#endif
++}
++
++/**
++ * This function does the setup for a data transfer for a host channel
++ * and starts the transfer in Descriptor DMA mode.
++ *
++ * Initializes HCTSIZ register. For a PING transfer the Do Ping bit is set.
++ * Sets PID and NTD values. For periodic transfers
++ * initializes SCHED_INFO field with micro-frame bitmap.
++ *
++ * Initializes HCDMA register with descriptor list address and CTD value
++ * then starts the transfer via enabling the channel.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param hc Information needed to initialize the host channel.
++ */
++void dwc_otg_hc_start_transfer_ddma(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
++{
++	dwc_otg_hc_regs_t *hc_regs = core_if->host_if->hc_regs[hc->hc_num];
++	hcchar_data_t hcchar;
++	hctsiz_data_t hctsiz;
++	hcdma_data_t hcdma;
++
++	hctsiz.d32 = 0;
++
++	if (hc->do_ping)
++		hctsiz.b_ddma.dopng = 1;
++
++	if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC)
++		set_pid_isoc(hc);
++
++	/* Packet Count and Xfer Size are not used in Descriptor DMA mode */
++	hctsiz.b_ddma.pid = hc->data_pid_start;
++	hctsiz.b_ddma.ntd = hc->ntd - 1;	/* 0 - 1 descriptor, 1 - 2 descriptors, etc. */
++	hctsiz.b_ddma.schinfo = hc->schinfo;	/* Non-zero only for high-speed interrupt endpoints */
++
++	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d\n", __func__, hc->hc_num);
++	DWC_DEBUGPL(DBG_HCDV, "	 Start PID: %d\n", hctsiz.b.pid);
++	DWC_DEBUGPL(DBG_HCDV, "	 NTD: %d\n", hctsiz.b_ddma.ntd);
++
++	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
++
++	hcdma.d32 = 0;
++	hcdma.b.dma_addr = ((uint32_t) hc->desc_list_addr) >> 11;
++
++	/* Always start from first descriptor. */
++	hcdma.b.ctd = 0;
++	DWC_WRITE_REG32(&hc_regs->hcdma, hcdma.d32);
++
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	hcchar.b.multicnt = hc->multi_count;
++
++#ifdef DEBUG
++	core_if->start_hcchar_val[hc->hc_num] = hcchar.d32;
++	if (hcchar.b.chdis) {
++		DWC_WARN("%s: chdis set, channel %d, hcchar 0x%08x\n",
++			 __func__, hc->hc_num, hcchar.d32);
++	}
++#endif
++
++	/* Set host channel enable after all other setup is complete. */
++	hcchar.b.chen = 1;
++	hcchar.b.chdis = 0;
++
++	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++
++	hc->xfer_started = 1;
++	hc->requests++;
++
++#ifdef DEBUG
++	if ((hc->ep_type != DWC_OTG_EP_TYPE_INTR)
++	    && (hc->ep_type != DWC_OTG_EP_TYPE_ISOC)) {
++                DWC_DEBUGPL(DBG_HCDV, "DMA transfer %d from core_if %p\n",
++                            hc->hc_num, core_if);//GRAYG
++		core_if->hc_xfer_info[hc->hc_num].core_if = core_if;
++		core_if->hc_xfer_info[hc->hc_num].hc = hc;
++		/* Start a timer for this transfer. */
++		DWC_TIMER_SCHEDULE(core_if->hc_xfer_timer[hc->hc_num], 10000);
++	}
++#endif
++
++}
++
++/**
++ * This function continues a data transfer that was started by previous call
++ * to <code>dwc_otg_hc_start_transfer</code>. The caller must ensure there is
++ * sufficient space in the request queue and Tx Data FIFO. This function
++ * should only be called in Slave mode. In DMA mode, the controller acts
++ * autonomously to complete transfers programmed to a host channel.
++ *
++ * For an OUT transfer, a new data packet is loaded into the appropriate FIFO
++ * if there is any data remaining to be queued. For an IN transfer, another
++ * data packet is always requested. For the SETUP phase of a control transfer,
++ * this function does nothing.
++ *
++ * @return 1 if a new request is queued, 0 if no more requests are required
++ * for this transfer.
++ */
++int dwc_otg_hc_continue_transfer(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
++{
++	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d\n", __func__, hc->hc_num);
++
++	if (hc->do_split) {
++		/* SPLITs always queue just once per channel */
++		return 0;
++	} else if (hc->data_pid_start == DWC_OTG_HC_PID_SETUP) {
++		/* SETUPs are queued only once since they can't be NAKed. */
++		return 0;
++	} else if (hc->ep_is_in) {
++		/*
++		 * Always queue another request for other IN transfers. If
++		 * back-to-back INs are issued and NAKs are received for both,
++		 * the driver may still be processing the first NAK when the
++		 * second NAK is received. When the interrupt handler clears
++		 * the NAK interrupt for the first NAK, the second NAK will
++		 * not be seen. So we can't depend on the NAK interrupt
++		 * handler to requeue a NAKed request. Instead, IN requests
++		 * are issued each time this function is called. When the
++		 * transfer completes, the extra requests for the channel will
++		 * be flushed.
++		 */
++		hcchar_data_t hcchar;
++		dwc_otg_hc_regs_t *hc_regs =
++		    core_if->host_if->hc_regs[hc->hc_num];
++
++		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++		hc_set_even_odd_frame(core_if, hc, &hcchar);
++		hcchar.b.chen = 1;
++		hcchar.b.chdis = 0;
++		DWC_DEBUGPL(DBG_HCDV, "	 IN xfer: hcchar = 0x%08x\n",
++			    hcchar.d32);
++		DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++		hc->requests++;
++		return 1;
++	} else {
++		/* OUT transfers. */
++		if (hc->xfer_count < hc->xfer_len) {
++			if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
++			    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
++				hcchar_data_t hcchar;
++				dwc_otg_hc_regs_t *hc_regs;
++				hc_regs = core_if->host_if->hc_regs[hc->hc_num];
++				hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++				hc_set_even_odd_frame(core_if, hc, &hcchar);
++			}
++
++			/* Load OUT packet into the appropriate Tx FIFO. */
++			dwc_otg_hc_write_packet(core_if, hc);
++			hc->requests++;
++			return 1;
++		} else {
++			return 0;
++		}
++	}
++}
++
++/**
++ * Starts a PING transfer. This function should only be called in Slave mode.
++ * The Do Ping bit is set in the HCTSIZ register, then the channel is enabled.
++ */
++void dwc_otg_hc_do_ping(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
++{
++	hcchar_data_t hcchar;
++	hctsiz_data_t hctsiz;
++	dwc_otg_hc_regs_t *hc_regs = core_if->host_if->hc_regs[hc->hc_num];
++
++	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d\n", __func__, hc->hc_num);
++
++	hctsiz.d32 = 0;
++	hctsiz.b.dopng = 1;
++	hctsiz.b.pktcnt = 1;
++	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
++
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	hcchar.b.chen = 1;
++	hcchar.b.chdis = 0;
++	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++}
++
++/*
++ * This function writes a packet into the Tx FIFO associated with the Host
++ * Channel. For a channel associated with a non-periodic EP, the non-periodic
++ * Tx FIFO is written. For a channel associated with a periodic EP, the
++ * periodic Tx FIFO is written. This function should only be called in Slave
++ * mode.
++ *
++ * Upon return the xfer_buff and xfer_count fields in _hc are incremented by
++ * then number of bytes written to the Tx FIFO.
++ */
++void dwc_otg_hc_write_packet(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
++{
++	uint32_t i;
++	uint32_t remaining_count;
++	uint32_t byte_count;
++	uint32_t dword_count;
++
++	uint32_t *data_buff = (uint32_t *) (hc->xfer_buff);
++	uint32_t *data_fifo = core_if->data_fifo[hc->hc_num];
++
++	remaining_count = hc->xfer_len - hc->xfer_count;
++	if (remaining_count > hc->max_packet) {
++		byte_count = hc->max_packet;
++	} else {
++		byte_count = remaining_count;
++	}
++
++	dword_count = (byte_count + 3) / 4;
++
++	if ((((unsigned long)data_buff) & 0x3) == 0) {
++		/* xfer_buff is DWORD aligned. */
++		for (i = 0; i < dword_count; i++, data_buff++) {
++			DWC_WRITE_REG32(data_fifo, *data_buff);
++		}
++	} else {
++		/* xfer_buff is not DWORD aligned. */
++		for (i = 0; i < dword_count; i++, data_buff++) {
++			uint32_t data;
++			data =
++			    (data_buff[0] | data_buff[1] << 8 | data_buff[2] <<
++			     16 | data_buff[3] << 24);
++			DWC_WRITE_REG32(data_fifo, data);
++		}
++	}
++
++	hc->xfer_count += byte_count;
++	hc->xfer_buff += byte_count;
++}
++
++/**
++ * Gets the current USB frame number. This is the frame number from the last
++ * SOF packet.
++ */
++uint32_t dwc_otg_get_frame_number(dwc_otg_core_if_t * core_if)
++{
++	dsts_data_t dsts;
++	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
++
++	/* read current frame/microframe number from DSTS register */
++	return dsts.b.soffn;
++}
++
++/**
++ * Calculates and gets the frame Interval value of HFIR register according PHY
++ * type and speed.The application can modify a value of HFIR register only after
++ * the Port Enable bit of the Host Port Control and Status register
++ * (HPRT.PrtEnaPort) has been set.
++*/
++
++uint32_t calc_frame_interval(dwc_otg_core_if_t * core_if)
++{
++	gusbcfg_data_t usbcfg;
++	hwcfg2_data_t hwcfg2;
++	hprt0_data_t hprt0;
++	int clock = 60;		// default value
++	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
++	hwcfg2.d32 = DWC_READ_REG32(&core_if->core_global_regs->ghwcfg2);
++	hprt0.d32 = DWC_READ_REG32(core_if->host_if->hprt0);
++	if (!usbcfg.b.physel && usbcfg.b.ulpi_utmi_sel && !usbcfg.b.phyif)
++		clock = 60;
++	if (usbcfg.b.physel && hwcfg2.b.fs_phy_type == 3)
++		clock = 48;
++	if (!usbcfg.b.phylpwrclksel && !usbcfg.b.physel &&
++	    !usbcfg.b.ulpi_utmi_sel && usbcfg.b.phyif)
++		clock = 30;
++	if (!usbcfg.b.phylpwrclksel && !usbcfg.b.physel &&
++	    !usbcfg.b.ulpi_utmi_sel && !usbcfg.b.phyif)
++		clock = 60;
++	if (usbcfg.b.phylpwrclksel && !usbcfg.b.physel &&
++	    !usbcfg.b.ulpi_utmi_sel && usbcfg.b.phyif)
++		clock = 48;
++	if (usbcfg.b.physel && !usbcfg.b.phyif && hwcfg2.b.fs_phy_type == 2)
++		clock = 48;
++	if (usbcfg.b.physel && hwcfg2.b.fs_phy_type == 1)
++		clock = 48;
++	if (hprt0.b.prtspd == 0)
++		/* High speed case */
++		return 125 * clock - 1;
++	else
++		/* FS/LS case */
++		return 1000 * clock - 1;
++}
++
++/**
++ * This function reads a setup packet from the Rx FIFO into the destination
++ * buffer. This function is called from the Rx Status Queue Level (RxStsQLvl)
++ * Interrupt routine when a SETUP packet has been received in Slave mode.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param dest Destination buffer for packet data.
++ */
++void dwc_otg_read_setup_packet(dwc_otg_core_if_t * core_if, uint32_t * dest)
++{
++	device_grxsts_data_t status;
++	/* Get the 8 bytes of a setup transaction data */
++
++	/* Pop 2 DWORDS off the receive data FIFO into memory */
++	dest[0] = DWC_READ_REG32(core_if->data_fifo[0]);
++	dest[1] = DWC_READ_REG32(core_if->data_fifo[0]);
++	if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
++		status.d32 =
++		    DWC_READ_REG32(&core_if->core_global_regs->grxstsp);
++		DWC_DEBUGPL(DBG_ANY,
++			    "EP:%d BCnt:%d " "pktsts:%x Frame:%d(0x%0x)\n",
++			    status.b.epnum, status.b.bcnt, status.b.pktsts,
++			    status.b.fn, status.b.fn);
++	}
++}
++
++/**
++ * This function enables EP0 OUT to receive SETUP packets and configures EP0
++ * IN for transmitting packets. It is normally called when the
++ * "Enumeration Done" interrupt occurs.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP0 data.
++ */
++void dwc_otg_ep0_activate(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	dsts_data_t dsts;
++	depctl_data_t diepctl;
++	depctl_data_t doepctl;
++	dctl_data_t dctl = {.d32 = 0 };
++
++	ep->stp_rollover = 0;
++	/* Read the Device Status and Endpoint 0 Control registers */
++	dsts.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dsts);
++	diepctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[0]->diepctl);
++	doepctl.d32 = DWC_READ_REG32(&dev_if->out_ep_regs[0]->doepctl);
++
++	/* Set the MPS of the IN EP based on the enumeration speed */
++	switch (dsts.b.enumspd) {
++	case DWC_DSTS_ENUMSPD_HS_PHY_30MHZ_OR_60MHZ:
++	case DWC_DSTS_ENUMSPD_FS_PHY_30MHZ_OR_60MHZ:
++	case DWC_DSTS_ENUMSPD_FS_PHY_48MHZ:
++		diepctl.b.mps = DWC_DEP0CTL_MPS_64;
++		break;
++	case DWC_DSTS_ENUMSPD_LS_PHY_6MHZ:
++		diepctl.b.mps = DWC_DEP0CTL_MPS_8;
++		break;
++	}
++
++	DWC_WRITE_REG32(&dev_if->in_ep_regs[0]->diepctl, diepctl.d32);
++
++	/* Enable OUT EP for receive */
++	if (core_if->snpsid <= OTG_CORE_REV_2_94a) {
++	doepctl.b.epena = 1;
++	DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doepctl, doepctl.d32);
++	}
++#ifdef VERBOSE
++	DWC_DEBUGPL(DBG_PCDV, "doepctl0=%0x\n",
++		    DWC_READ_REG32(&dev_if->out_ep_regs[0]->doepctl));
++	DWC_DEBUGPL(DBG_PCDV, "diepctl0=%0x\n",
++		    DWC_READ_REG32(&dev_if->in_ep_regs[0]->diepctl));
++#endif
++	dctl.b.cgnpinnak = 1;
++
++	DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, dctl.d32, dctl.d32);
++	DWC_DEBUGPL(DBG_PCDV, "dctl=%0x\n",
++		    DWC_READ_REG32(&dev_if->dev_global_regs->dctl));
++
++}
++
++/**
++ * This function activates an EP.  The Device EP control register for
++ * the EP is configured as defined in the ep structure. Note: This
++ * function is not used for EP0.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to activate.
++ */
++void dwc_otg_ep_activate(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	depctl_data_t depctl;
++	volatile uint32_t *addr;
++	daint_data_t daintmsk = {.d32 = 0 };
++	dcfg_data_t dcfg;
++	uint8_t i;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s() EP%d-%s\n", __func__, ep->num,
++		    (ep->is_in ? "IN" : "OUT"));
++
++#ifdef DWC_UTE_PER_IO
++	ep->xiso_frame_num = 0xFFFFFFFF;
++	ep->xiso_active_xfers = 0;
++	ep->xiso_queued_xfers = 0;
++#endif
++	/* Read DEPCTLn register */
++	if (ep->is_in == 1) {
++		addr = &dev_if->in_ep_regs[ep->num]->diepctl;
++		daintmsk.ep.in = 1 << ep->num;
++	} else {
++		addr = &dev_if->out_ep_regs[ep->num]->doepctl;
++		daintmsk.ep.out = 1 << ep->num;
++	}
++
++	/* If the EP is already active don't change the EP Control
++	 * register. */
++	depctl.d32 = DWC_READ_REG32(addr);
++	if (!depctl.b.usbactep) {
++		depctl.b.mps = ep->maxpacket;
++		depctl.b.eptype = ep->type;
++		depctl.b.txfnum = ep->tx_fifo_num;
++
++		if (ep->type == DWC_OTG_EP_TYPE_ISOC) {
++			depctl.b.setd0pid = 1;	// ???
++		} else {
++			depctl.b.setd0pid = 1;
++		}
++		depctl.b.usbactep = 1;
++
++		/* Update nextep_seq array and EPMSCNT in DCFG*/
++		if (!(depctl.b.eptype & 1) && (ep->is_in == 1)) {	// NP IN EP
++			for (i = 0; i <= core_if->dev_if->num_in_eps; i++) {
++				if (core_if->nextep_seq[i] == core_if->first_in_nextep_seq)
++				break;
++			}
++			core_if->nextep_seq[i] = ep->num;
++			core_if->nextep_seq[ep->num] = core_if->first_in_nextep_seq;
++			depctl.b.nextep = core_if->nextep_seq[ep->num];
++			dcfg.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dcfg);
++			dcfg.b.epmscnt++;
++			DWC_WRITE_REG32(&dev_if->dev_global_regs->dcfg, dcfg.d32);
++
++			DWC_DEBUGPL(DBG_PCDV,
++				    "%s first_in_nextep_seq= %2d; nextep_seq[]:\n",
++				__func__, core_if->first_in_nextep_seq);
++			for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
++				DWC_DEBUGPL(DBG_PCDV, "%2d\n",
++					    core_if->nextep_seq[i]);
++			}
++
++		}
++
++
++		DWC_WRITE_REG32(addr, depctl.d32);
++		DWC_DEBUGPL(DBG_PCDV, "DEPCTL=%08x\n", DWC_READ_REG32(addr));
++	}
++
++	/* Enable the Interrupt for this EP */
++	if (core_if->multiproc_int_enable) {
++		if (ep->is_in == 1) {
++			diepmsk_data_t diepmsk = {.d32 = 0 };
++			diepmsk.b.xfercompl = 1;
++			diepmsk.b.timeout = 1;
++			diepmsk.b.epdisabled = 1;
++			diepmsk.b.ahberr = 1;
++			diepmsk.b.intknepmis = 1;
++			if (!core_if->en_multiple_tx_fifo && core_if->dma_enable)
++				diepmsk.b.intknepmis = 0;
++			diepmsk.b.txfifoundrn = 1;	//?????
++			if (ep->type == DWC_OTG_EP_TYPE_ISOC) {
++				diepmsk.b.nak = 1;
++			}
++
++
++
++/*
++			if (core_if->dma_desc_enable) {
++				diepmsk.b.bna = 1;
++			}
++*/
++/*
++			if (core_if->dma_enable) {
++				doepmsk.b.nak = 1;
++			}
++*/
++			DWC_WRITE_REG32(&dev_if->dev_global_regs->
++					diepeachintmsk[ep->num], diepmsk.d32);
++
++		} else {
++			doepmsk_data_t doepmsk = {.d32 = 0 };
++			doepmsk.b.xfercompl = 1;
++			doepmsk.b.ahberr = 1;
++			doepmsk.b.epdisabled = 1;
++			if (ep->type == DWC_OTG_EP_TYPE_ISOC)
++				doepmsk.b.outtknepdis = 1;
++
++/*
++
++			if (core_if->dma_desc_enable) {
++				doepmsk.b.bna = 1;
++			}
++*/
++/*
++			doepmsk.b.babble = 1;
++			doepmsk.b.nyet = 1;
++			doepmsk.b.nak = 1;
++*/
++			DWC_WRITE_REG32(&dev_if->dev_global_regs->
++					doepeachintmsk[ep->num], doepmsk.d32);
++		}
++		DWC_MODIFY_REG32(&dev_if->dev_global_regs->deachintmsk,
++				 0, daintmsk.d32);
++	} else {
++		if (ep->type == DWC_OTG_EP_TYPE_ISOC) {
++			if (ep->is_in) {
++				diepmsk_data_t diepmsk = {.d32 = 0 };
++				diepmsk.b.nak = 1;
++				DWC_MODIFY_REG32(&dev_if->dev_global_regs->diepmsk, 0, diepmsk.d32);
++			} else {
++				doepmsk_data_t doepmsk = {.d32 = 0 };
++				doepmsk.b.outtknepdis = 1;
++				DWC_MODIFY_REG32(&dev_if->dev_global_regs->doepmsk, 0, doepmsk.d32);
++			}
++		}
++		DWC_MODIFY_REG32(&dev_if->dev_global_regs->daintmsk,
++				 0, daintmsk.d32);
++	}
++
++	DWC_DEBUGPL(DBG_PCDV, "DAINTMSK=%0x\n",
++		    DWC_READ_REG32(&dev_if->dev_global_regs->daintmsk));
++
++	ep->stall_clear_flag = 0;
++
++	return;
++}
++
++/**
++ * This function deactivates an EP. This is done by clearing the USB Active
++ * EP bit in the Device EP control register. Note: This function is not used
++ * for EP0. EP0 cannot be deactivated.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to deactivate.
++ */
++void dwc_otg_ep_deactivate(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	depctl_data_t depctl = {.d32 = 0 };
++	volatile uint32_t *addr;
++	daint_data_t daintmsk = {.d32 = 0 };
++	dcfg_data_t dcfg;
++	uint8_t i = 0;
++
++#ifdef DWC_UTE_PER_IO
++	ep->xiso_frame_num = 0xFFFFFFFF;
++	ep->xiso_active_xfers = 0;
++	ep->xiso_queued_xfers = 0;
++#endif
++
++	/* Read DEPCTLn register */
++	if (ep->is_in == 1) {
++		addr = &core_if->dev_if->in_ep_regs[ep->num]->diepctl;
++		daintmsk.ep.in = 1 << ep->num;
++	} else {
++		addr = &core_if->dev_if->out_ep_regs[ep->num]->doepctl;
++		daintmsk.ep.out = 1 << ep->num;
++	}
++
++	depctl.d32 = DWC_READ_REG32(addr);
++
++	depctl.b.usbactep = 0;
++
++	/* Update nextep_seq array and EPMSCNT in DCFG*/
++	if (!(depctl.b.eptype & 1) && ep->is_in == 1) {	// NP EP IN
++		for (i = 0; i <= core_if->dev_if->num_in_eps; i++) {
++			if (core_if->nextep_seq[i] == ep->num)
++			break;
++		}
++		core_if->nextep_seq[i] = core_if->nextep_seq[ep->num];
++		if (core_if->first_in_nextep_seq == ep->num)
++			core_if->first_in_nextep_seq = i;
++		core_if->nextep_seq[ep->num] = 0xff;
++		depctl.b.nextep = 0;
++		dcfg.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
++		dcfg.b.epmscnt--;
++		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg,
++				dcfg.d32);
++
++		DWC_DEBUGPL(DBG_PCDV,
++			    "%s first_in_nextep_seq= %2d; nextep_seq[]:\n",
++				__func__, core_if->first_in_nextep_seq);
++			for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
++				DWC_DEBUGPL(DBG_PCDV, "%2d\n", core_if->nextep_seq[i]);
++			}
++	}
++
++	if (ep->is_in == 1)
++		depctl.b.txfnum = 0;
++
++	if (core_if->dma_desc_enable)
++		depctl.b.epdis = 1;
++
++	DWC_WRITE_REG32(addr, depctl.d32);
++	depctl.d32 = DWC_READ_REG32(addr);
++	if (core_if->dma_enable && ep->type == DWC_OTG_EP_TYPE_ISOC
++	    && depctl.b.epena) {
++		depctl_data_t depctl = {.d32 = 0};
++		if (ep->is_in) {
++			diepint_data_t diepint = {.d32 = 0};
++
++			depctl.b.snak = 1;
++			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
++					diepctl, depctl.d32);
++			do {
++				dwc_udelay(10);
++				diepint.d32 =
++				    DWC_READ_REG32(&core_if->
++						   dev_if->in_ep_regs[ep->num]->
++						   diepint);
++			} while (!diepint.b.inepnakeff);
++			diepint.b.inepnakeff = 1;
++			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
++					diepint, diepint.d32);
++			depctl.d32 = 0;
++			depctl.b.epdis = 1;
++			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
++					diepctl, depctl.d32);
++			do {
++				dwc_udelay(10);
++				diepint.d32 =
++				    DWC_READ_REG32(&core_if->
++						   dev_if->in_ep_regs[ep->num]->
++						   diepint);
++			} while (!diepint.b.epdisabled);
++			diepint.b.epdisabled = 1;
++			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
++					diepint, diepint.d32);
++		} else {
++			dctl_data_t dctl = {.d32 = 0};
++			gintmsk_data_t gintsts = {.d32 = 0};
++			doepint_data_t doepint = {.d32 = 0};
++			dctl.b.sgoutnak = 1;
++			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
++					 dctl, 0, dctl.d32);
++			do {
++				dwc_udelay(10);
++				gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++			} while (!gintsts.b.goutnakeff);
++			gintsts.d32 = 0;
++			gintsts.b.goutnakeff = 1;
++			DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++
++			depctl.d32 = 0;
++			depctl.b.epdis = 1;
++			depctl.b.snak = 1;
++			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[ep->num]->doepctl, depctl.d32);
++			do
++			{
++				dwc_udelay(10);
++				doepint.d32 = DWC_READ_REG32(&core_if->dev_if->
++											out_ep_regs[ep->num]->doepint);
++			} while (!doepint.b.epdisabled);
++
++			doepint.b.epdisabled = 1;
++			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[ep->num]->doepint, doepint.d32);
++
++			dctl.d32 = 0;
++			dctl.b.cgoutnak = 1;
++			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
++		}
++	}
++
++	/* Disable the Interrupt for this EP */
++	if (core_if->multiproc_int_enable) {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->deachintmsk,
++				 daintmsk.d32, 0);
++
++		if (ep->is_in == 1) {
++			DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->
++					diepeachintmsk[ep->num], 0);
++		} else {
++			DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->
++					doepeachintmsk[ep->num], 0);
++		}
++	} else {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->daintmsk,
++				 daintmsk.d32, 0);
++	}
++
++}
++
++/**
++ * This function initializes dma descriptor chain.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to start the transfer on.
++ */
++static void init_dma_desc_chain(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	dwc_otg_dev_dma_desc_t *dma_desc;
++	uint32_t offset;
++	uint32_t xfer_est;
++	int i;
++	unsigned maxxfer_local, total_len;
++
++	if (!ep->is_in && ep->type == DWC_OTG_EP_TYPE_INTR &&
++					(ep->maxpacket%4)) {
++		maxxfer_local = ep->maxpacket;
++		total_len = ep->xfer_len;
++	} else {
++		maxxfer_local = ep->maxxfer;
++		total_len = ep->total_len;
++	}
++
++	ep->desc_cnt = (total_len / maxxfer_local) +
++            ((total_len % maxxfer_local) ? 1 : 0);
++
++	if (!ep->desc_cnt)
++		ep->desc_cnt = 1;
++
++	if (ep->desc_cnt > MAX_DMA_DESC_CNT)
++		ep->desc_cnt = MAX_DMA_DESC_CNT;
++
++	dma_desc = ep->desc_addr;
++	if (maxxfer_local == ep->maxpacket) {
++		if ((total_len % maxxfer_local) &&
++				(total_len/maxxfer_local < MAX_DMA_DESC_CNT)) {
++			xfer_est = (ep->desc_cnt - 1) * maxxfer_local +
++					(total_len % maxxfer_local);
++		} else
++			xfer_est = ep->desc_cnt * maxxfer_local;
++	} else
++		xfer_est = total_len;
++	offset = 0;
++	for (i = 0; i < ep->desc_cnt; ++i) {
++		/** DMA Descriptor Setup */
++		if (xfer_est > maxxfer_local) {
++			dma_desc->status.b.bs = BS_HOST_BUSY;
++			dma_desc->status.b.l = 0;
++			dma_desc->status.b.ioc = 0;
++			dma_desc->status.b.sp = 0;
++			dma_desc->status.b.bytes = maxxfer_local;
++			dma_desc->buf = ep->dma_addr + offset;
++			dma_desc->status.b.sts = 0;
++			dma_desc->status.b.bs = BS_HOST_READY;
++
++			xfer_est -= maxxfer_local;
++			offset += maxxfer_local;
++		} else {
++			dma_desc->status.b.bs = BS_HOST_BUSY;
++			dma_desc->status.b.l = 1;
++			dma_desc->status.b.ioc = 1;
++			if (ep->is_in) {
++				dma_desc->status.b.sp =
++				    (xfer_est %
++				     ep->maxpacket) ? 1 : ((ep->
++							    sent_zlp) ? 1 : 0);
++				dma_desc->status.b.bytes = xfer_est;
++			} else {
++				if (maxxfer_local == ep->maxpacket)
++					dma_desc->status.b.bytes = xfer_est;
++				else
++					dma_desc->status.b.bytes =
++						xfer_est + ((4 - (xfer_est & 0x3)) & 0x3);
++			}
++
++			dma_desc->buf = ep->dma_addr + offset;
++			dma_desc->status.b.sts = 0;
++			dma_desc->status.b.bs = BS_HOST_READY;
++		}
++		dma_desc++;
++	}
++}
++/**
++ * This function is called when to write ISOC data into appropriate dedicated
++ * periodic FIFO.
++ */
++static int32_t write_isoc_tx_fifo(dwc_otg_core_if_t * core_if, dwc_ep_t * dwc_ep)
++{
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	dwc_otg_dev_in_ep_regs_t *ep_regs;
++	dtxfsts_data_t txstatus = {.d32 = 0 };
++	uint32_t len = 0;
++	int epnum = dwc_ep->num;
++	int dwords;
++
++	DWC_DEBUGPL(DBG_PCD, "Dedicated TxFifo Empty: %d \n", epnum);
++
++	ep_regs = core_if->dev_if->in_ep_regs[epnum];
++
++	len = dwc_ep->xfer_len - dwc_ep->xfer_count;
++
++	if (len > dwc_ep->maxpacket) {
++		len = dwc_ep->maxpacket;
++	}
++
++	dwords = (len + 3) / 4;
++
++	/* While there is space in the queue and space in the FIFO and
++	 * More data to tranfer, Write packets to the Tx FIFO */
++	txstatus.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts);
++	DWC_DEBUGPL(DBG_PCDV, "b4 dtxfsts[%d]=0x%08x\n", epnum, txstatus.d32);
++
++	while (txstatus.b.txfspcavail > dwords &&
++	       dwc_ep->xfer_count < dwc_ep->xfer_len && dwc_ep->xfer_len != 0) {
++		/* Write the FIFO */
++		dwc_otg_ep_write_packet(core_if, dwc_ep, 0);
++
++		len = dwc_ep->xfer_len - dwc_ep->xfer_count;
++		if (len > dwc_ep->maxpacket) {
++			len = dwc_ep->maxpacket;
++		}
++
++		dwords = (len + 3) / 4;
++		txstatus.d32 =
++		    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts);
++		DWC_DEBUGPL(DBG_PCDV, "dtxfsts[%d]=0x%08x\n", epnum,
++			    txstatus.d32);
++	}
++
++	DWC_DEBUGPL(DBG_PCDV, "b4 dtxfsts[%d]=0x%08x\n", epnum,
++		    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts));
++
++	return 1;
++}
++/**
++ * This function does the setup for a data transfer for an EP and
++ * starts the transfer. For an IN transfer, the packets will be
++ * loaded into the appropriate Tx FIFO in the ISR. For OUT transfers,
++ * the packets are unloaded from the Rx FIFO in the ISR.  the ISR.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to start the transfer on.
++ */
++
++void dwc_otg_ep_start_transfer(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	depctl_data_t depctl;
++	deptsiz_data_t deptsiz;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	DWC_DEBUGPL((DBG_PCDV | DBG_CILV), "%s()\n", __func__);
++	DWC_DEBUGPL(DBG_PCD, "ep%d-%s xfer_len=%d xfer_cnt=%d "
++		    "xfer_buff=%p start_xfer_buff=%p, total_len = %d\n",
++		    ep->num, (ep->is_in ? "IN" : "OUT"), ep->xfer_len,
++		    ep->xfer_count, ep->xfer_buff, ep->start_xfer_buff,
++		    ep->total_len);
++	/* IN endpoint */
++	if (ep->is_in == 1) {
++		dwc_otg_dev_in_ep_regs_t *in_regs =
++		    core_if->dev_if->in_ep_regs[ep->num];
++
++		gnptxsts_data_t gtxstatus;
++
++		gtxstatus.d32 =
++		    DWC_READ_REG32(&core_if->core_global_regs->gnptxsts);
++
++		if (core_if->en_multiple_tx_fifo == 0
++		    && gtxstatus.b.nptxqspcavail == 0 && !core_if->dma_enable) {
++#ifdef DEBUG
++			DWC_PRINTF("TX Queue Full (0x%0x)\n", gtxstatus.d32);
++#endif
++			return;
++		}
++
++		depctl.d32 = DWC_READ_REG32(&(in_regs->diepctl));
++		deptsiz.d32 = DWC_READ_REG32(&(in_regs->dieptsiz));
++
++		if (ep->maxpacket > ep->maxxfer / MAX_PKT_CNT)
++			ep->xfer_len += (ep->maxxfer < (ep->total_len - ep->xfer_len)) ?
++				ep->maxxfer : (ep->total_len - ep->xfer_len);
++		else
++			ep->xfer_len += (MAX_PKT_CNT * ep->maxpacket < (ep->total_len - ep->xfer_len)) ?
++				 MAX_PKT_CNT * ep->maxpacket : (ep->total_len - ep->xfer_len);
++
++
++		/* Zero Length Packet? */
++		if ((ep->xfer_len - ep->xfer_count) == 0) {
++			deptsiz.b.xfersize = 0;
++			deptsiz.b.pktcnt = 1;
++		} else {
++			/* Program the transfer size and packet count
++			 *      as follows: xfersize = N * maxpacket +
++			 *      short_packet pktcnt = N + (short_packet
++			 *      exist ? 1 : 0)
++			 */
++			deptsiz.b.xfersize = ep->xfer_len - ep->xfer_count;
++			deptsiz.b.pktcnt =
++			    (ep->xfer_len - ep->xfer_count - 1 +
++			     ep->maxpacket) / ep->maxpacket;
++			if (deptsiz.b.pktcnt > MAX_PKT_CNT) {
++				deptsiz.b.pktcnt = MAX_PKT_CNT;
++				deptsiz.b.xfersize = deptsiz.b.pktcnt * ep->maxpacket;
++			}
++			if (ep->type == DWC_OTG_EP_TYPE_ISOC)
++				deptsiz.b.mc = deptsiz.b.pktcnt;
++		}
++
++		/* Write the DMA register */
++		if (core_if->dma_enable) {
++			if (core_if->dma_desc_enable == 0) {
++				if (ep->type != DWC_OTG_EP_TYPE_ISOC)
++					deptsiz.b.mc = 1;
++				DWC_WRITE_REG32(&in_regs->dieptsiz,
++						deptsiz.d32);
++				DWC_WRITE_REG32(&(in_regs->diepdma),
++						(uint32_t) ep->dma_addr);
++			} else {
++#ifdef DWC_UTE_CFI
++				/* The descriptor chain should be already initialized by now */
++				if (ep->buff_mode != BM_STANDARD) {
++					DWC_WRITE_REG32(&in_regs->diepdma,
++							ep->descs_dma_addr);
++				} else {
++#endif
++					init_dma_desc_chain(core_if, ep);
++				/** DIEPDMAn Register write */
++					DWC_WRITE_REG32(&in_regs->diepdma,
++							ep->dma_desc_addr);
++#ifdef DWC_UTE_CFI
++				}
++#endif
++			}
++		} else {
++			DWC_WRITE_REG32(&in_regs->dieptsiz, deptsiz.d32);
++			if (ep->type != DWC_OTG_EP_TYPE_ISOC) {
++				/**
++				 * Enable the Non-Periodic Tx FIFO empty interrupt,
++				 * or the Tx FIFO epmty interrupt in dedicated Tx FIFO mode,
++				 * the data will be written into the fifo by the ISR.
++				 */
++				if (core_if->en_multiple_tx_fifo == 0) {
++					intr_mask.b.nptxfempty = 1;
++					DWC_MODIFY_REG32
++					    (&core_if->core_global_regs->gintmsk,
++					     intr_mask.d32, intr_mask.d32);
++				} else {
++					/* Enable the Tx FIFO Empty Interrupt for this EP */
++					if (ep->xfer_len > 0) {
++						uint32_t fifoemptymsk = 0;
++						fifoemptymsk = 1 << ep->num;
++						DWC_MODIFY_REG32
++						    (&core_if->dev_if->dev_global_regs->dtknqr4_fifoemptymsk,
++						     0, fifoemptymsk);
++
++					}
++				}
++			}  else {
++					 write_isoc_tx_fifo(core_if, ep);
++			}
++		}
++		if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable)
++			depctl.b.nextep = core_if->nextep_seq[ep->num];
++
++		if (ep->type == DWC_OTG_EP_TYPE_ISOC) {
++			dsts_data_t dsts = {.d32 = 0};
++			if (ep->bInterval == 1) {
++				dsts.d32 =
++				    DWC_READ_REG32(&core_if->dev_if->
++						   dev_global_regs->dsts);
++				ep->frame_num = dsts.b.soffn + ep->bInterval;
++				if (ep->frame_num > 0x3FFF) {
++					ep->frm_overrun = 1;
++					ep->frame_num &= 0x3FFF;
++				} else
++					ep->frm_overrun = 0;
++				if (ep->frame_num & 0x1) {
++					depctl.b.setd1pid = 1;
++				} else {
++					depctl.b.setd0pid = 1;
++				}
++			}
++		}
++		/* EP enable, IN data in FIFO */
++		depctl.b.cnak = 1;
++		depctl.b.epena = 1;
++		DWC_WRITE_REG32(&in_regs->diepctl, depctl.d32);
++
++	} else {
++		/* OUT endpoint */
++		dwc_otg_dev_out_ep_regs_t *out_regs =
++		    core_if->dev_if->out_ep_regs[ep->num];
++
++		depctl.d32 = DWC_READ_REG32(&(out_regs->doepctl));
++		deptsiz.d32 = DWC_READ_REG32(&(out_regs->doeptsiz));
++
++		if (!core_if->dma_desc_enable) {
++			if (ep->maxpacket > ep->maxxfer / MAX_PKT_CNT)
++				ep->xfer_len += (ep->maxxfer < (ep->total_len - ep->xfer_len)) ?
++				ep->maxxfer : (ep->total_len - ep->xfer_len);
++                else
++					ep->xfer_len += (MAX_PKT_CNT * ep->maxpacket < (ep->total_len
++					- ep->xfer_len)) ? MAX_PKT_CNT * ep->maxpacket : (ep->total_len - ep->xfer_len);
++		}
++
++		/* Program the transfer size and packet count as follows:
++		 *
++		 *      pktcnt = N
++		 *      xfersize = N * maxpacket
++		 */
++		if ((ep->xfer_len - ep->xfer_count) == 0) {
++			/* Zero Length Packet */
++			deptsiz.b.xfersize = ep->maxpacket;
++			deptsiz.b.pktcnt = 1;
++		} else {
++			deptsiz.b.pktcnt =
++			    (ep->xfer_len - ep->xfer_count +
++			     (ep->maxpacket - 1)) / ep->maxpacket;
++			if (deptsiz.b.pktcnt > MAX_PKT_CNT) {
++				deptsiz.b.pktcnt = MAX_PKT_CNT;
++			}
++			if (!core_if->dma_desc_enable) {
++				ep->xfer_len =
++					deptsiz.b.pktcnt * ep->maxpacket + ep->xfer_count;
++			}
++			deptsiz.b.xfersize = ep->xfer_len - ep->xfer_count;
++		}
++
++		DWC_DEBUGPL(DBG_PCDV, "ep%d xfersize=%d pktcnt=%d\n",
++			    ep->num, deptsiz.b.xfersize, deptsiz.b.pktcnt);
++
++		if (core_if->dma_enable) {
++			if (!core_if->dma_desc_enable) {
++				DWC_WRITE_REG32(&out_regs->doeptsiz,
++						deptsiz.d32);
++
++				DWC_WRITE_REG32(&(out_regs->doepdma),
++						(uint32_t) ep->dma_addr);
++			} else {
++#ifdef DWC_UTE_CFI
++				/* The descriptor chain should be already initialized by now */
++				if (ep->buff_mode != BM_STANDARD) {
++					DWC_WRITE_REG32(&out_regs->doepdma,
++							ep->descs_dma_addr);
++				} else {
++#endif
++					/** This is used for interrupt out transfers*/
++					if (!ep->xfer_len)
++						ep->xfer_len = ep->total_len;
++					init_dma_desc_chain(core_if, ep);
++
++					if (core_if->core_params->dev_out_nak) {
++						if (ep->type == DWC_OTG_EP_TYPE_BULK) {
++							deptsiz.b.pktcnt = (ep->total_len +
++								(ep->maxpacket - 1)) / ep->maxpacket;
++							deptsiz.b.xfersize = ep->total_len;
++							/* Remember initial value of doeptsiz */
++							core_if->start_doeptsiz_val[ep->num] = deptsiz.d32;
++							DWC_WRITE_REG32(&out_regs->doeptsiz,
++								deptsiz.d32);
++						}
++					}
++				/** DOEPDMAn Register write */
++					DWC_WRITE_REG32(&out_regs->doepdma,
++							ep->dma_desc_addr);
++#ifdef DWC_UTE_CFI
++				}
++#endif
++			}
++		} else {
++			DWC_WRITE_REG32(&out_regs->doeptsiz, deptsiz.d32);
++		}
++
++		if (ep->type == DWC_OTG_EP_TYPE_ISOC) {
++			dsts_data_t dsts = {.d32 = 0};
++			if (ep->bInterval == 1) {
++				dsts.d32 =
++				    DWC_READ_REG32(&core_if->dev_if->
++						   dev_global_regs->dsts);
++				ep->frame_num = dsts.b.soffn + ep->bInterval;
++				if (ep->frame_num > 0x3FFF) {
++					ep->frm_overrun = 1;
++					ep->frame_num &= 0x3FFF;
++				} else
++					ep->frm_overrun = 0;
++
++				if (ep->frame_num & 0x1) {
++					depctl.b.setd1pid = 1;
++				} else {
++					depctl.b.setd0pid = 1;
++				}
++			}
++		}
++
++		/* EP enable */
++		depctl.b.cnak = 1;
++		depctl.b.epena = 1;
++
++		DWC_WRITE_REG32(&out_regs->doepctl, depctl.d32);
++
++		DWC_DEBUGPL(DBG_PCD, "DOEPCTL=%08x DOEPTSIZ=%08x\n",
++			    DWC_READ_REG32(&out_regs->doepctl),
++			    DWC_READ_REG32(&out_regs->doeptsiz));
++		DWC_DEBUGPL(DBG_PCD, "DAINTMSK=%08x GINTMSK=%08x\n",
++			    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->
++					   daintmsk),
++			    DWC_READ_REG32(&core_if->core_global_regs->
++					   gintmsk));
++
++		/* Timer is scheduling only for out bulk transfers for
++		 * "Device DDMA OUT NAK Enhancement" feature to inform user
++		 * about received data payload in case of timeout
++		 */
++		if (core_if->core_params->dev_out_nak) {
++			if (ep->type == DWC_OTG_EP_TYPE_BULK) {
++				core_if->ep_xfer_info[ep->num].core_if = core_if;
++				core_if->ep_xfer_info[ep->num].ep = ep;
++				core_if->ep_xfer_info[ep->num].state = 1;
++
++				/* Start a timer for this transfer. */
++				DWC_TIMER_SCHEDULE(core_if->ep_xfer_timer[ep->num], 10000);
++			}
++		}
++	}
++}
++
++/**
++ * This function setup a zero length transfer in Buffer DMA and
++ * Slave modes for usb requests with zero field set
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to start the transfer on.
++ *
++ */
++void dwc_otg_ep_start_zl_transfer(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++
++	depctl_data_t depctl;
++	deptsiz_data_t deptsiz;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	DWC_DEBUGPL((DBG_PCDV | DBG_CILV), "%s()\n", __func__);
++	DWC_PRINTF("zero length transfer is called\n");
++
++	/* IN endpoint */
++	if (ep->is_in == 1) {
++		dwc_otg_dev_in_ep_regs_t *in_regs =
++		    core_if->dev_if->in_ep_regs[ep->num];
++
++		depctl.d32 = DWC_READ_REG32(&(in_regs->diepctl));
++		deptsiz.d32 = DWC_READ_REG32(&(in_regs->dieptsiz));
++
++		deptsiz.b.xfersize = 0;
++		deptsiz.b.pktcnt = 1;
++
++		/* Write the DMA register */
++		if (core_if->dma_enable) {
++			if (core_if->dma_desc_enable == 0) {
++				deptsiz.b.mc = 1;
++				DWC_WRITE_REG32(&in_regs->dieptsiz,
++						deptsiz.d32);
++				DWC_WRITE_REG32(&(in_regs->diepdma),
++						(uint32_t) ep->dma_addr);
++			}
++		} else {
++			DWC_WRITE_REG32(&in_regs->dieptsiz, deptsiz.d32);
++			/**
++			 * Enable the Non-Periodic Tx FIFO empty interrupt,
++			 * or the Tx FIFO epmty interrupt in dedicated Tx FIFO mode,
++			 * the data will be written into the fifo by the ISR.
++			 */
++			if (core_if->en_multiple_tx_fifo == 0) {
++				intr_mask.b.nptxfempty = 1;
++				DWC_MODIFY_REG32(&core_if->
++						 core_global_regs->gintmsk,
++						 intr_mask.d32, intr_mask.d32);
++			} else {
++				/* Enable the Tx FIFO Empty Interrupt for this EP */
++				if (ep->xfer_len > 0) {
++					uint32_t fifoemptymsk = 0;
++					fifoemptymsk = 1 << ep->num;
++					DWC_MODIFY_REG32(&core_if->
++							 dev_if->dev_global_regs->dtknqr4_fifoemptymsk,
++							 0, fifoemptymsk);
++				}
++			}
++		}
++
++		if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable)
++			depctl.b.nextep = core_if->nextep_seq[ep->num];
++		/* EP enable, IN data in FIFO */
++		depctl.b.cnak = 1;
++		depctl.b.epena = 1;
++		DWC_WRITE_REG32(&in_regs->diepctl, depctl.d32);
++
++	} else {
++		/* OUT endpoint */
++		dwc_otg_dev_out_ep_regs_t *out_regs =
++		    core_if->dev_if->out_ep_regs[ep->num];
++
++		depctl.d32 = DWC_READ_REG32(&(out_regs->doepctl));
++		deptsiz.d32 = DWC_READ_REG32(&(out_regs->doeptsiz));
++
++		/* Zero Length Packet */
++		deptsiz.b.xfersize = ep->maxpacket;
++		deptsiz.b.pktcnt = 1;
++
++		if (core_if->dma_enable) {
++			if (!core_if->dma_desc_enable) {
++				DWC_WRITE_REG32(&out_regs->doeptsiz,
++						deptsiz.d32);
++
++				DWC_WRITE_REG32(&(out_regs->doepdma),
++						(uint32_t) ep->dma_addr);
++			}
++		} else {
++			DWC_WRITE_REG32(&out_regs->doeptsiz, deptsiz.d32);
++		}
++
++		/* EP enable */
++		depctl.b.cnak = 1;
++		depctl.b.epena = 1;
++
++		DWC_WRITE_REG32(&out_regs->doepctl, depctl.d32);
++
++	}
++}
++
++/**
++ * This function does the setup for a data transfer for EP0 and starts
++ * the transfer.  For an IN transfer, the packets will be loaded into
++ * the appropriate Tx FIFO in the ISR. For OUT transfers, the packets are
++ * unloaded from the Rx FIFO in the ISR.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP0 data.
++ */
++void dwc_otg_ep0_start_transfer(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	depctl_data_t depctl;
++	deptsiz0_data_t deptsiz;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++	dwc_otg_dev_dma_desc_t *dma_desc;
++
++	DWC_DEBUGPL(DBG_PCD, "ep%d-%s xfer_len=%d xfer_cnt=%d "
++		    "xfer_buff=%p start_xfer_buff=%p \n",
++		    ep->num, (ep->is_in ? "IN" : "OUT"), ep->xfer_len,
++		    ep->xfer_count, ep->xfer_buff, ep->start_xfer_buff);
++
++	ep->total_len = ep->xfer_len;
++
++	/* IN endpoint */
++	if (ep->is_in == 1) {
++		dwc_otg_dev_in_ep_regs_t *in_regs =
++		    core_if->dev_if->in_ep_regs[0];
++
++		gnptxsts_data_t gtxstatus;
++
++		if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
++			depctl.d32 = DWC_READ_REG32(&in_regs->diepctl);
++			if (depctl.b.epena)
++				return;
++		}
++
++		gtxstatus.d32 =
++		    DWC_READ_REG32(&core_if->core_global_regs->gnptxsts);
++
++		/* If dedicated FIFO every time flush fifo before enable ep*/
++		if (core_if->en_multiple_tx_fifo && core_if->snpsid >= OTG_CORE_REV_3_00a)
++			dwc_otg_flush_tx_fifo(core_if, ep->tx_fifo_num);
++
++		if (core_if->en_multiple_tx_fifo == 0
++		    && gtxstatus.b.nptxqspcavail == 0
++		    && !core_if->dma_enable) {
++#ifdef DEBUG
++			deptsiz.d32 = DWC_READ_REG32(&in_regs->dieptsiz);
++			DWC_DEBUGPL(DBG_PCD, "DIEPCTL0=%0x\n",
++				    DWC_READ_REG32(&in_regs->diepctl));
++			DWC_DEBUGPL(DBG_PCD, "DIEPTSIZ0=%0x (sz=%d, pcnt=%d)\n",
++				    deptsiz.d32,
++				    deptsiz.b.xfersize, deptsiz.b.pktcnt);
++			DWC_PRINTF("TX Queue or FIFO Full (0x%0x)\n",
++				   gtxstatus.d32);
++#endif
++			return;
++		}
++
++		depctl.d32 = DWC_READ_REG32(&in_regs->diepctl);
++		deptsiz.d32 = DWC_READ_REG32(&in_regs->dieptsiz);
++
++		/* Zero Length Packet? */
++		if (ep->xfer_len == 0) {
++			deptsiz.b.xfersize = 0;
++			deptsiz.b.pktcnt = 1;
++		} else {
++			/* Program the transfer size and packet count
++			 *      as follows: xfersize = N * maxpacket +
++			 *      short_packet pktcnt = N + (short_packet
++			 *      exist ? 1 : 0)
++			 */
++			if (ep->xfer_len > ep->maxpacket) {
++				ep->xfer_len = ep->maxpacket;
++				deptsiz.b.xfersize = ep->maxpacket;
++			} else {
++				deptsiz.b.xfersize = ep->xfer_len;
++			}
++			deptsiz.b.pktcnt = 1;
++
++		}
++		DWC_DEBUGPL(DBG_PCDV,
++			    "IN len=%d  xfersize=%d pktcnt=%d [%08x]\n",
++			    ep->xfer_len, deptsiz.b.xfersize, deptsiz.b.pktcnt,
++			    deptsiz.d32);
++
++		/* Write the DMA register */
++		if (core_if->dma_enable) {
++			if (core_if->dma_desc_enable == 0) {
++				DWC_WRITE_REG32(&in_regs->dieptsiz,
++						deptsiz.d32);
++
++				DWC_WRITE_REG32(&(in_regs->diepdma),
++						(uint32_t) ep->dma_addr);
++			} else {
++				dma_desc = core_if->dev_if->in_desc_addr;
++
++				/** DMA Descriptor Setup */
++				dma_desc->status.b.bs = BS_HOST_BUSY;
++				dma_desc->status.b.l = 1;
++				dma_desc->status.b.ioc = 1;
++				dma_desc->status.b.sp =
++				    (ep->xfer_len == ep->maxpacket) ? 0 : 1;
++				dma_desc->status.b.bytes = ep->xfer_len;
++				dma_desc->buf = ep->dma_addr;
++				dma_desc->status.b.sts = 0;
++				dma_desc->status.b.bs = BS_HOST_READY;
++
++				/** DIEPDMA0 Register write */
++				DWC_WRITE_REG32(&in_regs->diepdma,
++						core_if->
++						dev_if->dma_in_desc_addr);
++			}
++		} else {
++			DWC_WRITE_REG32(&in_regs->dieptsiz, deptsiz.d32);
++		}
++
++		if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable)
++			depctl.b.nextep = core_if->nextep_seq[ep->num];
++		/* EP enable, IN data in FIFO */
++		depctl.b.cnak = 1;
++		depctl.b.epena = 1;
++		DWC_WRITE_REG32(&in_regs->diepctl, depctl.d32);
++
++		/**
++		 * Enable the Non-Periodic Tx FIFO empty interrupt, the
++		 * data will be written into the fifo by the ISR.
++		 */
++		if (!core_if->dma_enable) {
++			if (core_if->en_multiple_tx_fifo == 0) {
++				intr_mask.b.nptxfempty = 1;
++				DWC_MODIFY_REG32(&core_if->
++						 core_global_regs->gintmsk,
++						 intr_mask.d32, intr_mask.d32);
++			} else {
++				/* Enable the Tx FIFO Empty Interrupt for this EP */
++				if (ep->xfer_len > 0) {
++					uint32_t fifoemptymsk = 0;
++					fifoemptymsk |= 1 << ep->num;
++					DWC_MODIFY_REG32(&core_if->
++							 dev_if->dev_global_regs->dtknqr4_fifoemptymsk,
++							 0, fifoemptymsk);
++				}
++			}
++		}
++	} else {
++		/* OUT endpoint */
++		dwc_otg_dev_out_ep_regs_t *out_regs =
++		    core_if->dev_if->out_ep_regs[0];
++
++		depctl.d32 = DWC_READ_REG32(&out_regs->doepctl);
++		deptsiz.d32 = DWC_READ_REG32(&out_regs->doeptsiz);
++
++		/* Program the transfer size and packet count as follows:
++		 *      xfersize = N * (maxpacket + 4 - (maxpacket % 4))
++		 *      pktcnt = N                                                                                      */
++		/* Zero Length Packet */
++		deptsiz.b.xfersize = ep->maxpacket;
++		deptsiz.b.pktcnt = 1;
++		if (core_if->snpsid >= OTG_CORE_REV_3_00a)
++			deptsiz.b.supcnt = 3;
++
++		DWC_DEBUGPL(DBG_PCDV, "len=%d  xfersize=%d pktcnt=%d\n",
++			    ep->xfer_len, deptsiz.b.xfersize, deptsiz.b.pktcnt);
++
++		if (core_if->dma_enable) {
++			if (!core_if->dma_desc_enable) {
++				DWC_WRITE_REG32(&out_regs->doeptsiz,
++						deptsiz.d32);
++
++				DWC_WRITE_REG32(&(out_regs->doepdma),
++						(uint32_t) ep->dma_addr);
++			} else {
++				dma_desc = core_if->dev_if->out_desc_addr;
++
++				/** DMA Descriptor Setup */
++				dma_desc->status.b.bs = BS_HOST_BUSY;
++				if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
++					dma_desc->status.b.mtrf = 0;
++					dma_desc->status.b.sr = 0;
++				}
++				dma_desc->status.b.l = 1;
++				dma_desc->status.b.ioc = 1;
++				dma_desc->status.b.bytes = ep->maxpacket;
++				dma_desc->buf = ep->dma_addr;
++				dma_desc->status.b.sts = 0;
++				dma_desc->status.b.bs = BS_HOST_READY;
++
++				/** DOEPDMA0 Register write */
++				DWC_WRITE_REG32(&out_regs->doepdma,
++						core_if->dev_if->
++						dma_out_desc_addr);
++			}
++		} else {
++			DWC_WRITE_REG32(&out_regs->doeptsiz, deptsiz.d32);
++		}
++
++		/* EP enable */
++		depctl.b.cnak = 1;
++		depctl.b.epena = 1;
++		DWC_WRITE_REG32(&(out_regs->doepctl), depctl.d32);
++	}
++}
++
++/**
++ * This function continues control IN transfers started by
++ * dwc_otg_ep0_start_transfer, when the transfer does not fit in a
++ * single packet.  NOTE: The DIEPCTL0/DOEPCTL0 registers only have one
++ * bit for the packet count.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP0 data.
++ */
++void dwc_otg_ep0_continue_transfer(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	depctl_data_t depctl;
++	deptsiz0_data_t deptsiz;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++	dwc_otg_dev_dma_desc_t *dma_desc;
++
++	if (ep->is_in == 1) {
++		dwc_otg_dev_in_ep_regs_t *in_regs =
++		    core_if->dev_if->in_ep_regs[0];
++		gnptxsts_data_t tx_status = {.d32 = 0 };
++
++		tx_status.d32 =
++		    DWC_READ_REG32(&core_if->core_global_regs->gnptxsts);
++		/** @todo Should there be check for room in the Tx
++		 * Status Queue.  If not remove the code above this comment. */
++
++		depctl.d32 = DWC_READ_REG32(&in_regs->diepctl);
++		deptsiz.d32 = DWC_READ_REG32(&in_regs->dieptsiz);
++
++		/* Program the transfer size and packet count
++		 *      as follows: xfersize = N * maxpacket +
++		 *      short_packet pktcnt = N + (short_packet
++		 *      exist ? 1 : 0)
++		 */
++
++		if (core_if->dma_desc_enable == 0) {
++			deptsiz.b.xfersize =
++			    (ep->total_len - ep->xfer_count) >
++			    ep->maxpacket ? ep->maxpacket : (ep->total_len -
++							     ep->xfer_count);
++			deptsiz.b.pktcnt = 1;
++			if (core_if->dma_enable == 0) {
++				ep->xfer_len += deptsiz.b.xfersize;
++			} else {
++				ep->xfer_len = deptsiz.b.xfersize;
++			}
++			DWC_WRITE_REG32(&in_regs->dieptsiz, deptsiz.d32);
++		} else {
++			ep->xfer_len =
++			    (ep->total_len - ep->xfer_count) >
++			    ep->maxpacket ? ep->maxpacket : (ep->total_len -
++							     ep->xfer_count);
++
++			dma_desc = core_if->dev_if->in_desc_addr;
++
++			/** DMA Descriptor Setup */
++			dma_desc->status.b.bs = BS_HOST_BUSY;
++			dma_desc->status.b.l = 1;
++			dma_desc->status.b.ioc = 1;
++			dma_desc->status.b.sp =
++			    (ep->xfer_len == ep->maxpacket) ? 0 : 1;
++			dma_desc->status.b.bytes = ep->xfer_len;
++			dma_desc->buf = ep->dma_addr;
++			dma_desc->status.b.sts = 0;
++			dma_desc->status.b.bs = BS_HOST_READY;
++
++			/** DIEPDMA0 Register write */
++			DWC_WRITE_REG32(&in_regs->diepdma,
++					core_if->dev_if->dma_in_desc_addr);
++		}
++
++		DWC_DEBUGPL(DBG_PCDV,
++			    "IN len=%d  xfersize=%d pktcnt=%d [%08x]\n",
++			    ep->xfer_len, deptsiz.b.xfersize, deptsiz.b.pktcnt,
++			    deptsiz.d32);
++
++		/* Write the DMA register */
++		if (core_if->hwcfg2.b.architecture == DWC_INT_DMA_ARCH) {
++			if (core_if->dma_desc_enable == 0)
++				DWC_WRITE_REG32(&(in_regs->diepdma),
++						(uint32_t) ep->dma_addr);
++		}
++		if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable)
++			depctl.b.nextep = core_if->nextep_seq[ep->num];
++		/* EP enable, IN data in FIFO */
++		depctl.b.cnak = 1;
++		depctl.b.epena = 1;
++		DWC_WRITE_REG32(&in_regs->diepctl, depctl.d32);
++
++		/**
++		 * Enable the Non-Periodic Tx FIFO empty interrupt, the
++		 * data will be written into the fifo by the ISR.
++		 */
++		if (!core_if->dma_enable) {
++			if (core_if->en_multiple_tx_fifo == 0) {
++				/* First clear it from GINTSTS */
++				intr_mask.b.nptxfempty = 1;
++				DWC_MODIFY_REG32(&core_if->
++						 core_global_regs->gintmsk,
++						 intr_mask.d32, intr_mask.d32);
++
++			} else {
++				/* Enable the Tx FIFO Empty Interrupt for this EP */
++				if (ep->xfer_len > 0) {
++					uint32_t fifoemptymsk = 0;
++					fifoemptymsk |= 1 << ep->num;
++					DWC_MODIFY_REG32(&core_if->
++							 dev_if->dev_global_regs->dtknqr4_fifoemptymsk,
++							 0, fifoemptymsk);
++				}
++			}
++		}
++	} else {
++		dwc_otg_dev_out_ep_regs_t *out_regs =
++		    core_if->dev_if->out_ep_regs[0];
++
++		depctl.d32 = DWC_READ_REG32(&out_regs->doepctl);
++		deptsiz.d32 = DWC_READ_REG32(&out_regs->doeptsiz);
++
++		/* Program the transfer size and packet count
++		 *      as follows: xfersize = N * maxpacket +
++		 *      short_packet pktcnt = N + (short_packet
++		 *      exist ? 1 : 0)
++		 */
++		deptsiz.b.xfersize = ep->maxpacket;
++		deptsiz.b.pktcnt = 1;
++
++		if (core_if->dma_desc_enable == 0) {
++			DWC_WRITE_REG32(&out_regs->doeptsiz, deptsiz.d32);
++		} else {
++			dma_desc = core_if->dev_if->out_desc_addr;
++
++			/** DMA Descriptor Setup */
++			dma_desc->status.b.bs = BS_HOST_BUSY;
++			dma_desc->status.b.l = 1;
++			dma_desc->status.b.ioc = 1;
++			dma_desc->status.b.bytes = ep->maxpacket;
++			dma_desc->buf = ep->dma_addr;
++			dma_desc->status.b.sts = 0;
++			dma_desc->status.b.bs = BS_HOST_READY;
++
++			/** DOEPDMA0 Register write */
++			DWC_WRITE_REG32(&out_regs->doepdma,
++					core_if->dev_if->dma_out_desc_addr);
++		}
++
++		DWC_DEBUGPL(DBG_PCDV,
++			    "IN len=%d  xfersize=%d pktcnt=%d [%08x]\n",
++			    ep->xfer_len, deptsiz.b.xfersize, deptsiz.b.pktcnt,
++			    deptsiz.d32);
++
++		/* Write the DMA register */
++		if (core_if->hwcfg2.b.architecture == DWC_INT_DMA_ARCH) {
++			if (core_if->dma_desc_enable == 0)
++				DWC_WRITE_REG32(&(out_regs->doepdma),
++						(uint32_t) ep->dma_addr);
++
++		}
++
++		/* EP enable, IN data in FIFO */
++		depctl.b.cnak = 1;
++		depctl.b.epena = 1;
++		DWC_WRITE_REG32(&out_regs->doepctl, depctl.d32);
++
++	}
++}
++
++#ifdef DEBUG
++void dump_msg(const u8 * buf, unsigned int length)
++{
++	unsigned int start, num, i;
++	char line[52], *p;
++
++	if (length >= 512)
++		return;
++	start = 0;
++	while (length > 0) {
++		num = length < 16u ? length : 16u;
++		p = line;
++		for (i = 0; i < num; ++i) {
++			if (i == 8)
++				*p++ = ' ';
++			DWC_SPRINTF(p, " %02x", buf[i]);
++			p += 3;
++		}
++		*p = 0;
++		DWC_PRINTF("%6x: %s\n", start, line);
++		buf += num;
++		start += num;
++		length -= num;
++	}
++}
++#else
++static inline void dump_msg(const u8 * buf, unsigned int length)
++{
++}
++#endif
++
++/**
++ * This function writes a packet into the Tx FIFO associated with the
++ * EP. For non-periodic EPs the non-periodic Tx FIFO is written.  For
++ * periodic EPs the periodic Tx FIFO associated with the EP is written
++ * with all packets for the next micro-frame.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to write packet for.
++ * @param dma Indicates if DMA is being used.
++ */
++void dwc_otg_ep_write_packet(dwc_otg_core_if_t * core_if, dwc_ep_t * ep,
++			     int dma)
++{
++	/**
++	 * The buffer is padded to DWORD on a per packet basis in
++	 * slave/dma mode if the MPS is not DWORD aligned. The last
++	 * packet, if short, is also padded to a multiple of DWORD.
++	 *
++	 * ep->xfer_buff always starts DWORD aligned in memory and is a
++	 * multiple of DWORD in length
++	 *
++	 * ep->xfer_len can be any number of bytes
++	 *
++	 * ep->xfer_count is a multiple of ep->maxpacket until the last
++	 *	packet
++	 *
++	 * FIFO access is DWORD */
++
++	uint32_t i;
++	uint32_t byte_count;
++	uint32_t dword_count;
++	uint32_t *fifo;
++	uint32_t *data_buff = (uint32_t *) ep->xfer_buff;
++
++	DWC_DEBUGPL((DBG_PCDV | DBG_CILV), "%s(%p,%p)\n", __func__, core_if,
++		    ep);
++	if (ep->xfer_count >= ep->xfer_len) {
++		DWC_WARN("%s() No data for EP%d!!!\n", __func__, ep->num);
++		return;
++	}
++
++	/* Find the byte length of the packet either short packet or MPS */
++	if ((ep->xfer_len - ep->xfer_count) < ep->maxpacket) {
++		byte_count = ep->xfer_len - ep->xfer_count;
++	} else {
++		byte_count = ep->maxpacket;
++	}
++
++	/* Find the DWORD length, padded by extra bytes as neccessary if MPS
++	 * is not a multiple of DWORD */
++	dword_count = (byte_count + 3) / 4;
++
++#ifdef VERBOSE
++	dump_msg(ep->xfer_buff, byte_count);
++#endif
++
++	/**@todo NGS Where are the Periodic Tx FIFO addresses
++	 * intialized?	What should this be? */
++
++	fifo = core_if->data_fifo[ep->num];
++
++	DWC_DEBUGPL((DBG_PCDV | DBG_CILV), "fifo=%p buff=%p *p=%08x bc=%d\n",
++		    fifo, data_buff, *data_buff, byte_count);
++
++	if (!dma) {
++		for (i = 0; i < dword_count; i++, data_buff++) {
++			DWC_WRITE_REG32(fifo, *data_buff);
++		}
++	}
++
++	ep->xfer_count += byte_count;
++	ep->xfer_buff += byte_count;
++	ep->dma_addr += byte_count;
++}
++
++/**
++ * Set the EP STALL.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to set the stall on.
++ */
++void dwc_otg_ep_set_stall(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	depctl_data_t depctl;
++	volatile uint32_t *depctl_addr;
++
++	DWC_DEBUGPL(DBG_PCD, "%s ep%d-%s\n", __func__, ep->num,
++		    (ep->is_in ? "IN" : "OUT"));
++
++	if (ep->is_in == 1) {
++		depctl_addr = &(core_if->dev_if->in_ep_regs[ep->num]->diepctl);
++		depctl.d32 = DWC_READ_REG32(depctl_addr);
++
++		/* set the disable and stall bits */
++		if (depctl.b.epena) {
++			depctl.b.epdis = 1;
++		}
++		depctl.b.stall = 1;
++		DWC_WRITE_REG32(depctl_addr, depctl.d32);
++	} else {
++		depctl_addr = &(core_if->dev_if->out_ep_regs[ep->num]->doepctl);
++		depctl.d32 = DWC_READ_REG32(depctl_addr);
++
++		/* set the stall bit */
++		depctl.b.stall = 1;
++		DWC_WRITE_REG32(depctl_addr, depctl.d32);
++	}
++
++	DWC_DEBUGPL(DBG_PCD, "DEPCTL=%0x\n", DWC_READ_REG32(depctl_addr));
++
++	return;
++}
++
++/**
++ * Clear the EP STALL.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to clear stall from.
++ */
++void dwc_otg_ep_clear_stall(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	depctl_data_t depctl;
++	volatile uint32_t *depctl_addr;
++
++	DWC_DEBUGPL(DBG_PCD, "%s ep%d-%s\n", __func__, ep->num,
++		    (ep->is_in ? "IN" : "OUT"));
++
++	if (ep->is_in == 1) {
++		depctl_addr = &(core_if->dev_if->in_ep_regs[ep->num]->diepctl);
++	} else {
++		depctl_addr = &(core_if->dev_if->out_ep_regs[ep->num]->doepctl);
++	}
++
++	depctl.d32 = DWC_READ_REG32(depctl_addr);
++
++	/* clear the stall bits */
++	depctl.b.stall = 0;
++
++	/*
++	 * USB Spec 9.4.5: For endpoints using data toggle, regardless
++	 * of whether an endpoint has the Halt feature set, a
++	 * ClearFeature(ENDPOINT_HALT) request always results in the
++	 * data toggle being reinitialized to DATA0.
++	 */
++	if (ep->type == DWC_OTG_EP_TYPE_INTR ||
++	    ep->type == DWC_OTG_EP_TYPE_BULK) {
++		depctl.b.setd0pid = 1;	/* DATA0 */
++	}
++
++	DWC_WRITE_REG32(depctl_addr, depctl.d32);
++	DWC_DEBUGPL(DBG_PCD, "DEPCTL=%0x\n", DWC_READ_REG32(depctl_addr));
++	return;
++}
++
++/**
++ * This function reads a packet from the Rx FIFO into the destination
++ * buffer. To read SETUP data use dwc_otg_read_setup_packet.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param dest	  Destination buffer for the packet.
++ * @param bytes  Number of bytes to copy to the destination.
++ */
++void dwc_otg_read_packet(dwc_otg_core_if_t * core_if,
++			 uint8_t * dest, uint16_t bytes)
++{
++	int i;
++	int word_count = (bytes + 3) / 4;
++
++	volatile uint32_t *fifo = core_if->data_fifo[0];
++	uint32_t *data_buff = (uint32_t *) dest;
++
++	/**
++	 * @todo Account for the case where _dest is not dword aligned. This
++	 * requires reading data from the FIFO into a uint32_t temp buffer,
++	 * then moving it into the data buffer.
++	 */
++
++	DWC_DEBUGPL((DBG_PCDV | DBG_CILV), "%s(%p,%p,%d)\n", __func__,
++		    core_if, dest, bytes);
++
++	for (i = 0; i < word_count; i++, data_buff++) {
++		*data_buff = DWC_READ_REG32(fifo);
++	}
++
++	return;
++}
++
++/**
++ * This functions reads the device registers and prints them
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++void dwc_otg_dump_dev_registers(dwc_otg_core_if_t * core_if)
++{
++	int i;
++	volatile uint32_t *addr;
++
++	DWC_PRINTF("Device Global Registers\n");
++	addr = &core_if->dev_if->dev_global_regs->dcfg;
++	DWC_PRINTF("DCFG		 @0x%08lX : 0x%08X\n",
++		   (unsigned long)addr, DWC_READ_REG32(addr));
++	addr = &core_if->dev_if->dev_global_regs->dctl;
++	DWC_PRINTF("DCTL		 @0x%08lX : 0x%08X\n",
++		   (unsigned long)addr, DWC_READ_REG32(addr));
++	addr = &core_if->dev_if->dev_global_regs->dsts;
++	DWC_PRINTF("DSTS		 @0x%08lX : 0x%08X\n",
++		   (unsigned long)addr, DWC_READ_REG32(addr));
++	addr = &core_if->dev_if->dev_global_regs->diepmsk;
++	DWC_PRINTF("DIEPMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->dev_if->dev_global_regs->doepmsk;
++	DWC_PRINTF("DOEPMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->dev_if->dev_global_regs->daint;
++	DWC_PRINTF("DAINT	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->dev_if->dev_global_regs->daintmsk;
++	DWC_PRINTF("DAINTMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->dev_if->dev_global_regs->dtknqr1;
++	DWC_PRINTF("DTKNQR1	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	if (core_if->hwcfg2.b.dev_token_q_depth > 6) {
++		addr = &core_if->dev_if->dev_global_regs->dtknqr2;
++		DWC_PRINTF("DTKNQR2	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++	}
++
++	addr = &core_if->dev_if->dev_global_regs->dvbusdis;
++	DWC_PRINTF("DVBUSID	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++
++	addr = &core_if->dev_if->dev_global_regs->dvbuspulse;
++	DWC_PRINTF("DVBUSPULSE	@0x%08lX : 0x%08X\n",
++		   (unsigned long)addr, DWC_READ_REG32(addr));
++
++	addr = &core_if->dev_if->dev_global_regs->dtknqr3_dthrctl;
++	DWC_PRINTF("DTKNQR3_DTHRCTL	 @0x%08lX : 0x%08X\n",
++		   (unsigned long)addr, DWC_READ_REG32(addr));
++
++	if (core_if->hwcfg2.b.dev_token_q_depth > 22) {
++		addr = &core_if->dev_if->dev_global_regs->dtknqr4_fifoemptymsk;
++		DWC_PRINTF("DTKNQR4	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++	}
++
++	addr = &core_if->dev_if->dev_global_regs->dtknqr4_fifoemptymsk;
++	DWC_PRINTF("FIFOEMPMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++
++	if (core_if->hwcfg2.b.multi_proc_int) {
++
++		addr = &core_if->dev_if->dev_global_regs->deachint;
++		DWC_PRINTF("DEACHINT	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->dev_if->dev_global_regs->deachintmsk;
++		DWC_PRINTF("DEACHINTMSK	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++
++		for (i = 0; i <= core_if->dev_if->num_in_eps; i++) {
++			addr =
++			    &core_if->dev_if->
++			    dev_global_regs->diepeachintmsk[i];
++			DWC_PRINTF("DIEPEACHINTMSK[%d]	 @0x%08lX : 0x%08X\n",
++				   i, (unsigned long)addr,
++				   DWC_READ_REG32(addr));
++		}
++
++		for (i = 0; i <= core_if->dev_if->num_out_eps; i++) {
++			addr =
++			    &core_if->dev_if->
++			    dev_global_regs->doepeachintmsk[i];
++			DWC_PRINTF("DOEPEACHINTMSK[%d]	 @0x%08lX : 0x%08X\n",
++				   i, (unsigned long)addr,
++				   DWC_READ_REG32(addr));
++		}
++	}
++
++	for (i = 0; i <= core_if->dev_if->num_in_eps; i++) {
++		DWC_PRINTF("Device IN EP %d Registers\n", i);
++		addr = &core_if->dev_if->in_ep_regs[i]->diepctl;
++		DWC_PRINTF("DIEPCTL	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->dev_if->in_ep_regs[i]->diepint;
++		DWC_PRINTF("DIEPINT	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->dev_if->in_ep_regs[i]->dieptsiz;
++		DWC_PRINTF("DIETSIZ	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->dev_if->in_ep_regs[i]->diepdma;
++		DWC_PRINTF("DIEPDMA	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->dev_if->in_ep_regs[i]->dtxfsts;
++		DWC_PRINTF("DTXFSTS	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->dev_if->in_ep_regs[i]->diepdmab;
++		DWC_PRINTF("DIEPDMAB	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, 0 /*DWC_READ_REG32(addr) */ );
++	}
++
++	for (i = 0; i <= core_if->dev_if->num_out_eps; i++) {
++		DWC_PRINTF("Device OUT EP %d Registers\n", i);
++		addr = &core_if->dev_if->out_ep_regs[i]->doepctl;
++		DWC_PRINTF("DOEPCTL	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->dev_if->out_ep_regs[i]->doepint;
++		DWC_PRINTF("DOEPINT	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->dev_if->out_ep_regs[i]->doeptsiz;
++		DWC_PRINTF("DOETSIZ	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->dev_if->out_ep_regs[i]->doepdma;
++		DWC_PRINTF("DOEPDMA	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		if (core_if->dma_enable) {	/* Don't access this register in SLAVE mode */
++			addr = &core_if->dev_if->out_ep_regs[i]->doepdmab;
++			DWC_PRINTF("DOEPDMAB	 @0x%08lX : 0x%08X\n",
++				   (unsigned long)addr, DWC_READ_REG32(addr));
++		}
++
++	}
++}
++
++/**
++ * This functions reads the SPRAM and prints its content
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++void dwc_otg_dump_spram(dwc_otg_core_if_t * core_if)
++{
++	volatile uint8_t *addr, *start_addr, *end_addr;
++
++	DWC_PRINTF("SPRAM Data:\n");
++	start_addr = (void *)core_if->core_global_regs;
++	DWC_PRINTF("Base Address: 0x%8lX\n", (unsigned long)start_addr);
++	start_addr += 0x00028000;
++	end_addr = (void *)core_if->core_global_regs;
++	end_addr += 0x000280e0;
++
++	for (addr = start_addr; addr < end_addr; addr += 16) {
++		DWC_PRINTF
++		    ("0x%8lX:\t%2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X\n",
++		     (unsigned long)addr, addr[0], addr[1], addr[2], addr[3],
++		     addr[4], addr[5], addr[6], addr[7], addr[8], addr[9],
++		     addr[10], addr[11], addr[12], addr[13], addr[14], addr[15]
++		    );
++	}
++
++	return;
++}
++
++/**
++ * This function reads the host registers and prints them
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++void dwc_otg_dump_host_registers(dwc_otg_core_if_t * core_if)
++{
++	int i;
++	volatile uint32_t *addr;
++
++	DWC_PRINTF("Host Global Registers\n");
++	addr = &core_if->host_if->host_global_regs->hcfg;
++	DWC_PRINTF("HCFG		 @0x%08lX : 0x%08X\n",
++		   (unsigned long)addr, DWC_READ_REG32(addr));
++	addr = &core_if->host_if->host_global_regs->hfir;
++	DWC_PRINTF("HFIR		 @0x%08lX : 0x%08X\n",
++		   (unsigned long)addr, DWC_READ_REG32(addr));
++	addr = &core_if->host_if->host_global_regs->hfnum;
++	DWC_PRINTF("HFNUM	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->host_if->host_global_regs->hptxsts;
++	DWC_PRINTF("HPTXSTS	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->host_if->host_global_regs->haint;
++	DWC_PRINTF("HAINT	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->host_if->host_global_regs->haintmsk;
++	DWC_PRINTF("HAINTMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	if (core_if->dma_desc_enable) {
++		addr = &core_if->host_if->host_global_regs->hflbaddr;
++		DWC_PRINTF("HFLBADDR	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++	}
++
++	addr = core_if->host_if->hprt0;
++	DWC_PRINTF("HPRT0	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++
++	for (i = 0; i < core_if->core_params->host_channels; i++) {
++		DWC_PRINTF("Host Channel %d Specific Registers\n", i);
++		addr = &core_if->host_if->hc_regs[i]->hcchar;
++		DWC_PRINTF("HCCHAR	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->host_if->hc_regs[i]->hcsplt;
++		DWC_PRINTF("HCSPLT	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->host_if->hc_regs[i]->hcint;
++		DWC_PRINTF("HCINT	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->host_if->hc_regs[i]->hcintmsk;
++		DWC_PRINTF("HCINTMSK	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->host_if->hc_regs[i]->hctsiz;
++		DWC_PRINTF("HCTSIZ	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->host_if->hc_regs[i]->hcdma;
++		DWC_PRINTF("HCDMA	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		if (core_if->dma_desc_enable) {
++			addr = &core_if->host_if->hc_regs[i]->hcdmab;
++			DWC_PRINTF("HCDMAB	 @0x%08lX : 0x%08X\n",
++				   (unsigned long)addr, DWC_READ_REG32(addr));
++		}
++
++	}
++	return;
++}
++
++/**
++ * This function reads the core global registers and prints them
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++void dwc_otg_dump_global_registers(dwc_otg_core_if_t * core_if)
++{
++	int i, ep_num;
++	volatile uint32_t *addr;
++	char *txfsiz;
++
++	DWC_PRINTF("Core Global Registers\n");
++	addr = &core_if->core_global_regs->gotgctl;
++	DWC_PRINTF("GOTGCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gotgint;
++	DWC_PRINTF("GOTGINT	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gahbcfg;
++	DWC_PRINTF("GAHBCFG	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gusbcfg;
++	DWC_PRINTF("GUSBCFG	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->grstctl;
++	DWC_PRINTF("GRSTCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gintsts;
++	DWC_PRINTF("GINTSTS	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gintmsk;
++	DWC_PRINTF("GINTMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->grxstsr;
++	DWC_PRINTF("GRXSTSR	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->grxfsiz;
++	DWC_PRINTF("GRXFSIZ	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gnptxfsiz;
++	DWC_PRINTF("GNPTXFSIZ @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gnptxsts;
++	DWC_PRINTF("GNPTXSTS	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gi2cctl;
++	DWC_PRINTF("GI2CCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gpvndctl;
++	DWC_PRINTF("GPVNDCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->ggpio;
++	DWC_PRINTF("GGPIO	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->guid;
++	DWC_PRINTF("GUID		 @0x%08lX : 0x%08X\n",
++		   (unsigned long)addr, DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gsnpsid;
++	DWC_PRINTF("GSNPSID	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->ghwcfg1;
++	DWC_PRINTF("GHWCFG1	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->ghwcfg2;
++	DWC_PRINTF("GHWCFG2	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->ghwcfg3;
++	DWC_PRINTF("GHWCFG3	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->ghwcfg4;
++	DWC_PRINTF("GHWCFG4	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->glpmcfg;
++	DWC_PRINTF("GLPMCFG	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gpwrdn;
++	DWC_PRINTF("GPWRDN	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gdfifocfg;
++	DWC_PRINTF("GDFIFOCFG	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->adpctl;
++	DWC_PRINTF("ADPCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   dwc_otg_adp_read_reg(core_if));
++	addr = &core_if->core_global_regs->hptxfsiz;
++	DWC_PRINTF("HPTXFSIZ	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++
++	if (core_if->en_multiple_tx_fifo == 0) {
++		ep_num = core_if->hwcfg4.b.num_dev_perio_in_ep;
++		txfsiz = "DPTXFSIZ";
++	} else {
++		ep_num = core_if->hwcfg4.b.num_in_eps;
++		txfsiz = "DIENPTXF";
++	}
++	for (i = 0; i < ep_num; i++) {
++		addr = &core_if->core_global_regs->dtxfsiz[i];
++		DWC_PRINTF("%s[%d] @0x%08lX : 0x%08X\n", txfsiz, i + 1,
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++	}
++	addr = core_if->pcgcctl;
++	DWC_PRINTF("PCGCCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++}
++
++/**
++ * Flush a Tx FIFO.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param num Tx FIFO to flush.
++ */
++void dwc_otg_flush_tx_fifo(dwc_otg_core_if_t * core_if, const int num)
++{
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	volatile grstctl_t greset = {.d32 = 0 };
++	int count = 0;
++
++	DWC_DEBUGPL((DBG_CIL | DBG_PCDV), "Flush Tx FIFO %d\n", num);
++
++	greset.b.txfflsh = 1;
++	greset.b.txfnum = num;
++	DWC_WRITE_REG32(&global_regs->grstctl, greset.d32);
++
++	do {
++		greset.d32 = DWC_READ_REG32(&global_regs->grstctl);
++		if (++count > 10000) {
++			DWC_WARN("%s() HANG! GRSTCTL=%0x GNPTXSTS=0x%08x\n",
++				 __func__, greset.d32,
++				 DWC_READ_REG32(&global_regs->gnptxsts));
++			break;
++		}
++		dwc_udelay(1);
++	} while (greset.b.txfflsh == 1);
++
++	/* Wait for 3 PHY Clocks */
++	dwc_udelay(1);
++}
++
++/**
++ * Flush Rx FIFO.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++void dwc_otg_flush_rx_fifo(dwc_otg_core_if_t * core_if)
++{
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	volatile grstctl_t greset = {.d32 = 0 };
++	int count = 0;
++
++	DWC_DEBUGPL((DBG_CIL | DBG_PCDV), "%s\n", __func__);
++	/*
++	 *
++	 */
++	greset.b.rxfflsh = 1;
++	DWC_WRITE_REG32(&global_regs->grstctl, greset.d32);
++
++	do {
++		greset.d32 = DWC_READ_REG32(&global_regs->grstctl);
++		if (++count > 10000) {
++			DWC_WARN("%s() HANG! GRSTCTL=%0x\n", __func__,
++				 greset.d32);
++			break;
++		}
++		dwc_udelay(1);
++	} while (greset.b.rxfflsh == 1);
++
++	/* Wait for 3 PHY Clocks */
++	dwc_udelay(1);
++}
++
++/**
++ * Do core a soft reset of the core.  Be careful with this because it
++ * resets all the internal state machines of the core.
++ */
++void dwc_otg_core_reset(dwc_otg_core_if_t * core_if)
++{
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	volatile grstctl_t greset = {.d32 = 0 };
++	int count = 0;
++
++	DWC_DEBUGPL(DBG_CILV, "%s\n", __func__);
++	/* Wait for AHB master IDLE state. */
++	do {
++		dwc_udelay(10);
++		greset.d32 = DWC_READ_REG32(&global_regs->grstctl);
++		if (++count > 100000) {
++			DWC_WARN("%s() HANG! AHB Idle GRSTCTL=%0x\n", __func__,
++				 greset.d32);
++			return;
++		}
++	}
++	while (greset.b.ahbidle == 0);
++
++	/* Core Soft Reset */
++	count = 0;
++	greset.b.csftrst = 1;
++	DWC_WRITE_REG32(&global_regs->grstctl, greset.d32);
++	do {
++		greset.d32 = DWC_READ_REG32(&global_regs->grstctl);
++		if (++count > 10000) {
++			DWC_WARN("%s() HANG! Soft Reset GRSTCTL=%0x\n",
++				 __func__, greset.d32);
++			break;
++		}
++		dwc_udelay(1);
++	}
++	while (greset.b.csftrst == 1);
++
++	/* Wait for 3 PHY Clocks */
++	dwc_mdelay(100);
++}
++
++uint8_t dwc_otg_is_device_mode(dwc_otg_core_if_t * _core_if)
++{
++	return (dwc_otg_mode(_core_if) != DWC_HOST_MODE);
++}
++
++uint8_t dwc_otg_is_host_mode(dwc_otg_core_if_t * _core_if)
++{
++	return (dwc_otg_mode(_core_if) == DWC_HOST_MODE);
++}
++
++/**
++ * Register HCD callbacks. The callbacks are used to start and stop
++ * the HCD for interrupt processing.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param cb the HCD callback structure.
++ * @param p pointer to be passed to callback function (usb_hcd*).
++ */
++void dwc_otg_cil_register_hcd_callbacks(dwc_otg_core_if_t * core_if,
++					dwc_otg_cil_callbacks_t * cb, void *p)
++{
++	core_if->hcd_cb = cb;
++	cb->p = p;
++}
++
++/**
++ * Register PCD callbacks. The callbacks are used to start and stop
++ * the PCD for interrupt processing.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param cb the PCD callback structure.
++ * @param p pointer to be passed to callback function (pcd*).
++ */
++void dwc_otg_cil_register_pcd_callbacks(dwc_otg_core_if_t * core_if,
++					dwc_otg_cil_callbacks_t * cb, void *p)
++{
++	core_if->pcd_cb = cb;
++	cb->p = p;
++}
++
++#ifdef DWC_EN_ISOC
++
++/**
++ * This function writes isoc data per 1 (micro)frame into tx fifo
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to start the transfer on.
++ *
++ */
++void write_isoc_frame_data(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	dwc_otg_dev_in_ep_regs_t *ep_regs;
++	dtxfsts_data_t txstatus = {.d32 = 0 };
++	uint32_t len = 0;
++	uint32_t dwords;
++
++	ep->xfer_len = ep->data_per_frame;
++	ep->xfer_count = 0;
++
++	ep_regs = core_if->dev_if->in_ep_regs[ep->num];
++
++	len = ep->xfer_len - ep->xfer_count;
++
++	if (len > ep->maxpacket) {
++		len = ep->maxpacket;
++	}
++
++	dwords = (len + 3) / 4;
++
++	/* While there is space in the queue and space in the FIFO and
++	 * More data to tranfer, Write packets to the Tx FIFO */
++	txstatus.d32 =
++	    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[ep->num]->dtxfsts);
++	DWC_DEBUGPL(DBG_PCDV, "b4 dtxfsts[%d]=0x%08x\n", ep->num, txstatus.d32);
++
++	while (txstatus.b.txfspcavail > dwords &&
++	       ep->xfer_count < ep->xfer_len && ep->xfer_len != 0) {
++		/* Write the FIFO */
++		dwc_otg_ep_write_packet(core_if, ep, 0);
++
++		len = ep->xfer_len - ep->xfer_count;
++		if (len > ep->maxpacket) {
++			len = ep->maxpacket;
++		}
++
++		dwords = (len + 3) / 4;
++		txstatus.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
++				   dtxfsts);
++		DWC_DEBUGPL(DBG_PCDV, "dtxfsts[%d]=0x%08x\n", ep->num,
++			    txstatus.d32);
++	}
++}
++
++/**
++ * This function initializes a descriptor chain for Isochronous transfer
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to start the transfer on.
++ *
++ */
++void dwc_otg_iso_ep_start_frm_transfer(dwc_otg_core_if_t * core_if,
++				       dwc_ep_t * ep)
++{
++	deptsiz_data_t deptsiz = {.d32 = 0 };
++	depctl_data_t depctl = {.d32 = 0 };
++	dsts_data_t dsts = {.d32 = 0 };
++	volatile uint32_t *addr;
++
++	if (ep->is_in) {
++		addr = &core_if->dev_if->in_ep_regs[ep->num]->diepctl;
++	} else {
++		addr = &core_if->dev_if->out_ep_regs[ep->num]->doepctl;
++	}
++
++	ep->xfer_len = ep->data_per_frame;
++	ep->xfer_count = 0;
++	ep->xfer_buff = ep->cur_pkt_addr;
++	ep->dma_addr = ep->cur_pkt_dma_addr;
++
++	if (ep->is_in) {
++		/* Program the transfer size and packet count
++		 *      as follows: xfersize = N * maxpacket +
++		 *      short_packet pktcnt = N + (short_packet
++		 *      exist ? 1 : 0)
++		 */
++		deptsiz.b.xfersize = ep->xfer_len;
++		deptsiz.b.pktcnt =
++		    (ep->xfer_len - 1 + ep->maxpacket) / ep->maxpacket;
++		deptsiz.b.mc = deptsiz.b.pktcnt;
++		DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->dieptsiz,
++				deptsiz.d32);
++
++		/* Write the DMA register */
++		if (core_if->dma_enable) {
++			DWC_WRITE_REG32(&
++					(core_if->dev_if->in_ep_regs[ep->num]->
++					 diepdma), (uint32_t) ep->dma_addr);
++		}
++	} else {
++		deptsiz.b.pktcnt =
++		    (ep->xfer_len + (ep->maxpacket - 1)) / ep->maxpacket;
++		deptsiz.b.xfersize = deptsiz.b.pktcnt * ep->maxpacket;
++
++		DWC_WRITE_REG32(&core_if->dev_if->
++				out_ep_regs[ep->num]->doeptsiz, deptsiz.d32);
++
++		if (core_if->dma_enable) {
++			DWC_WRITE_REG32(&
++					(core_if->dev_if->
++					 out_ep_regs[ep->num]->doepdma),
++					(uint32_t) ep->dma_addr);
++		}
++	}
++
++	/** Enable endpoint, clear nak  */
++
++	depctl.d32 = 0;
++	if (ep->bInterval == 1) {
++		dsts.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
++		ep->next_frame = dsts.b.soffn + ep->bInterval;
++
++		if (ep->next_frame & 0x1) {
++			depctl.b.setd1pid = 1;
++		} else {
++			depctl.b.setd0pid = 1;
++		}
++	} else {
++		ep->next_frame += ep->bInterval;
++
++		if (ep->next_frame & 0x1) {
++			depctl.b.setd1pid = 1;
++		} else {
++			depctl.b.setd0pid = 1;
++		}
++	}
++	depctl.b.epena = 1;
++	depctl.b.cnak = 1;
++
++	DWC_MODIFY_REG32(addr, 0, depctl.d32);
++	depctl.d32 = DWC_READ_REG32(addr);
++
++	if (ep->is_in && core_if->dma_enable == 0) {
++		write_isoc_frame_data(core_if, ep);
++	}
++
++}
++#endif /* DWC_EN_ISOC */
++
++static void dwc_otg_set_uninitialized(int32_t * p, int size)
++{
++	int i;
++	for (i = 0; i < size; i++) {
++		p[i] = -1;
++	}
++}
++
++static int dwc_otg_param_initialized(int32_t val)
++{
++	return val != -1;
++}
++
++static int dwc_otg_setup_params(dwc_otg_core_if_t * core_if)
++{
++	int i;
++	core_if->core_params = DWC_ALLOC(sizeof(*core_if->core_params));
++	if (!core_if->core_params) {
++		return -DWC_E_NO_MEMORY;
++	}
++	dwc_otg_set_uninitialized((int32_t *) core_if->core_params,
++				  sizeof(*core_if->core_params) /
++				  sizeof(int32_t));
++	DWC_PRINTF("Setting default values for core params\n");
++	dwc_otg_set_param_otg_cap(core_if, dwc_param_otg_cap_default);
++	dwc_otg_set_param_dma_enable(core_if, dwc_param_dma_enable_default);
++	dwc_otg_set_param_dma_desc_enable(core_if,
++					  dwc_param_dma_desc_enable_default);
++	dwc_otg_set_param_opt(core_if, dwc_param_opt_default);
++	dwc_otg_set_param_dma_burst_size(core_if,
++					 dwc_param_dma_burst_size_default);
++	dwc_otg_set_param_host_support_fs_ls_low_power(core_if,
++						       dwc_param_host_support_fs_ls_low_power_default);
++	dwc_otg_set_param_enable_dynamic_fifo(core_if,
++					      dwc_param_enable_dynamic_fifo_default);
++	dwc_otg_set_param_data_fifo_size(core_if,
++					 dwc_param_data_fifo_size_default);
++	dwc_otg_set_param_dev_rx_fifo_size(core_if,
++					   dwc_param_dev_rx_fifo_size_default);
++	dwc_otg_set_param_dev_nperio_tx_fifo_size(core_if,
++						  dwc_param_dev_nperio_tx_fifo_size_default);
++	dwc_otg_set_param_host_rx_fifo_size(core_if,
++					    dwc_param_host_rx_fifo_size_default);
++	dwc_otg_set_param_host_nperio_tx_fifo_size(core_if,
++						   dwc_param_host_nperio_tx_fifo_size_default);
++	dwc_otg_set_param_host_perio_tx_fifo_size(core_if,
++						  dwc_param_host_perio_tx_fifo_size_default);
++	dwc_otg_set_param_max_transfer_size(core_if,
++					    dwc_param_max_transfer_size_default);
++	dwc_otg_set_param_max_packet_count(core_if,
++					   dwc_param_max_packet_count_default);
++	dwc_otg_set_param_host_channels(core_if,
++					dwc_param_host_channels_default);
++	dwc_otg_set_param_dev_endpoints(core_if,
++					dwc_param_dev_endpoints_default);
++	dwc_otg_set_param_phy_type(core_if, dwc_param_phy_type_default);
++	dwc_otg_set_param_speed(core_if, dwc_param_speed_default);
++	dwc_otg_set_param_host_ls_low_power_phy_clk(core_if,
++						    dwc_param_host_ls_low_power_phy_clk_default);
++	dwc_otg_set_param_phy_ulpi_ddr(core_if, dwc_param_phy_ulpi_ddr_default);
++	dwc_otg_set_param_phy_ulpi_ext_vbus(core_if,
++					    dwc_param_phy_ulpi_ext_vbus_default);
++	dwc_otg_set_param_phy_utmi_width(core_if,
++					 dwc_param_phy_utmi_width_default);
++	dwc_otg_set_param_ts_dline(core_if, dwc_param_ts_dline_default);
++	dwc_otg_set_param_i2c_enable(core_if, dwc_param_i2c_enable_default);
++	dwc_otg_set_param_ulpi_fs_ls(core_if, dwc_param_ulpi_fs_ls_default);
++	dwc_otg_set_param_en_multiple_tx_fifo(core_if,
++					      dwc_param_en_multiple_tx_fifo_default);
++	for (i = 0; i < 15; i++) {
++		dwc_otg_set_param_dev_perio_tx_fifo_size(core_if,
++							 dwc_param_dev_perio_tx_fifo_size_default,
++							 i);
++	}
++
++	for (i = 0; i < 15; i++) {
++		dwc_otg_set_param_dev_tx_fifo_size(core_if,
++						   dwc_param_dev_tx_fifo_size_default,
++						   i);
++	}
++	dwc_otg_set_param_thr_ctl(core_if, dwc_param_thr_ctl_default);
++	dwc_otg_set_param_mpi_enable(core_if, dwc_param_mpi_enable_default);
++	dwc_otg_set_param_pti_enable(core_if, dwc_param_pti_enable_default);
++	dwc_otg_set_param_lpm_enable(core_if, dwc_param_lpm_enable_default);
++	dwc_otg_set_param_ic_usb_cap(core_if, dwc_param_ic_usb_cap_default);
++	dwc_otg_set_param_tx_thr_length(core_if,
++					dwc_param_tx_thr_length_default);
++	dwc_otg_set_param_rx_thr_length(core_if,
++					dwc_param_rx_thr_length_default);
++	dwc_otg_set_param_ahb_thr_ratio(core_if,
++					dwc_param_ahb_thr_ratio_default);
++	dwc_otg_set_param_power_down(core_if, dwc_param_power_down_default);
++	dwc_otg_set_param_reload_ctl(core_if, dwc_param_reload_ctl_default);
++	dwc_otg_set_param_dev_out_nak(core_if, dwc_param_dev_out_nak_default);
++	dwc_otg_set_param_cont_on_bna(core_if, dwc_param_cont_on_bna_default);
++	dwc_otg_set_param_ahb_single(core_if, dwc_param_ahb_single_default);
++	dwc_otg_set_param_otg_ver(core_if, dwc_param_otg_ver_default);
++	dwc_otg_set_param_adp_enable(core_if, dwc_param_adp_enable_default);
++	DWC_PRINTF("Finished setting default values for core params\n");
++
++	return 0;
++}
++
++uint8_t dwc_otg_is_dma_enable(dwc_otg_core_if_t * core_if)
++{
++	return core_if->dma_enable;
++}
++
++/* Checks if the parameter is outside of its valid range of values */
++#define DWC_OTG_PARAM_TEST(_param_, _low_, _high_) \
++		(((_param_) < (_low_)) || \
++		((_param_) > (_high_)))
++
++/* Parameter access functions */
++int dwc_otg_set_param_otg_cap(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int valid;
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 2)) {
++		DWC_WARN("Wrong value for otg_cap parameter\n");
++		DWC_WARN("otg_cap parameter must be 0,1 or 2\n");
++		retval = -DWC_E_INVALID;
++		goto out;
++	}
++
++	valid = 1;
++	switch (val) {
++	case DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE:
++		if (core_if->hwcfg2.b.op_mode !=
++		    DWC_HWCFG2_OP_MODE_HNP_SRP_CAPABLE_OTG)
++			valid = 0;
++		break;
++	case DWC_OTG_CAP_PARAM_SRP_ONLY_CAPABLE:
++		if ((core_if->hwcfg2.b.op_mode !=
++		     DWC_HWCFG2_OP_MODE_HNP_SRP_CAPABLE_OTG)
++		    && (core_if->hwcfg2.b.op_mode !=
++			DWC_HWCFG2_OP_MODE_SRP_ONLY_CAPABLE_OTG)
++		    && (core_if->hwcfg2.b.op_mode !=
++			DWC_HWCFG2_OP_MODE_SRP_CAPABLE_DEVICE)
++		    && (core_if->hwcfg2.b.op_mode !=
++			DWC_HWCFG2_OP_MODE_SRP_CAPABLE_HOST)) {
++			valid = 0;
++		}
++		break;
++	case DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE:
++		/* always valid */
++		break;
++	}
++	if (!valid) {
++		if (dwc_otg_param_initialized(core_if->core_params->otg_cap)) {
++			DWC_ERROR
++			    ("%d invalid for otg_cap paremter. Check HW configuration.\n",
++			     val);
++		}
++		val =
++		    (((core_if->hwcfg2.b.op_mode ==
++		       DWC_HWCFG2_OP_MODE_HNP_SRP_CAPABLE_OTG)
++		      || (core_if->hwcfg2.b.op_mode ==
++			  DWC_HWCFG2_OP_MODE_SRP_ONLY_CAPABLE_OTG)
++		      || (core_if->hwcfg2.b.op_mode ==
++			  DWC_HWCFG2_OP_MODE_SRP_CAPABLE_DEVICE)
++		      || (core_if->hwcfg2.b.op_mode ==
++			  DWC_HWCFG2_OP_MODE_SRP_CAPABLE_HOST)) ?
++		     DWC_OTG_CAP_PARAM_SRP_ONLY_CAPABLE :
++		     DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE);
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->otg_cap = val;
++out:
++	return retval;
++}
++
++int32_t dwc_otg_get_param_otg_cap(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->otg_cap;
++}
++
++int dwc_otg_set_param_opt(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong value for opt parameter\n");
++		return -DWC_E_INVALID;
++	}
++	core_if->core_params->opt = val;
++	return 0;
++}
++
++int32_t dwc_otg_get_param_opt(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->opt;
++}
++
++int dwc_otg_set_param_dma_enable(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong value for dma enable\n");
++		return -DWC_E_INVALID;
++	}
++
++	if ((val == 1) && (core_if->hwcfg2.b.architecture == 0)) {
++		if (dwc_otg_param_initialized(core_if->core_params->dma_enable)) {
++			DWC_ERROR
++			    ("%d invalid for dma_enable paremter. Check HW configuration.\n",
++			     val);
++		}
++		val = 0;
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->dma_enable = val;
++	if (val == 0) {
++		dwc_otg_set_param_dma_desc_enable(core_if, 0);
++	}
++	return retval;
++}
++
++int32_t dwc_otg_get_param_dma_enable(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->dma_enable;
++}
++
++int dwc_otg_set_param_dma_desc_enable(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong value for dma_enable\n");
++		DWC_WARN("dma_desc_enable must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	if ((val == 1)
++	    && ((dwc_otg_get_param_dma_enable(core_if) == 0)
++		|| (core_if->hwcfg4.b.desc_dma == 0))) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->dma_desc_enable)) {
++			DWC_ERROR
++			    ("%d invalid for dma_desc_enable paremter. Check HW configuration.\n",
++			     val);
++		}
++		val = 0;
++		retval = -DWC_E_INVALID;
++	}
++	core_if->core_params->dma_desc_enable = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_dma_desc_enable(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->dma_desc_enable;
++}
++
++int dwc_otg_set_param_host_support_fs_ls_low_power(dwc_otg_core_if_t * core_if,
++						   int32_t val)
++{
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong value for host_support_fs_low_power\n");
++		DWC_WARN("host_support_fs_low_power must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++	core_if->core_params->host_support_fs_ls_low_power = val;
++	return 0;
++}
++
++int32_t dwc_otg_get_param_host_support_fs_ls_low_power(dwc_otg_core_if_t *
++						       core_if)
++{
++	return core_if->core_params->host_support_fs_ls_low_power;
++}
++
++int dwc_otg_set_param_enable_dynamic_fifo(dwc_otg_core_if_t * core_if,
++					  int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong value for enable_dynamic_fifo\n");
++		DWC_WARN("enable_dynamic_fifo must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	if ((val == 1) && (core_if->hwcfg2.b.dynamic_fifo == 0)) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->enable_dynamic_fifo)) {
++			DWC_ERROR
++			    ("%d invalid for enable_dynamic_fifo paremter. Check HW configuration.\n",
++			     val);
++		}
++		val = 0;
++		retval = -DWC_E_INVALID;
++	}
++	core_if->core_params->enable_dynamic_fifo = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_enable_dynamic_fifo(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->enable_dynamic_fifo;
++}
++
++int dwc_otg_set_param_data_fifo_size(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 32, 32768)) {
++		DWC_WARN("Wrong value for data_fifo_size\n");
++		DWC_WARN("data_fifo_size must be 32-32768\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val > core_if->hwcfg3.b.dfifo_depth) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->data_fifo_size)) {
++			DWC_ERROR
++			    ("%d invalid for data_fifo_size parameter. Check HW configuration.\n",
++			     val);
++		}
++		val = core_if->hwcfg3.b.dfifo_depth;
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->data_fifo_size = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_data_fifo_size(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->data_fifo_size;
++}
++
++int dwc_otg_set_param_dev_rx_fifo_size(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 16, 32768)) {
++		DWC_WARN("Wrong value for dev_rx_fifo_size\n");
++		DWC_WARN("dev_rx_fifo_size must be 16-32768\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val > DWC_READ_REG32(&core_if->core_global_regs->grxfsiz)) {
++		if (dwc_otg_param_initialized(core_if->core_params->dev_rx_fifo_size)) {
++		DWC_WARN("%d invalid for dev_rx_fifo_size parameter\n", val);
++		}
++		val = DWC_READ_REG32(&core_if->core_global_regs->grxfsiz);
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->dev_rx_fifo_size = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_dev_rx_fifo_size(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->dev_rx_fifo_size;
++}
++
++int dwc_otg_set_param_dev_nperio_tx_fifo_size(dwc_otg_core_if_t * core_if,
++					      int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 16, 32768)) {
++		DWC_WARN("Wrong value for dev_nperio_tx_fifo\n");
++		DWC_WARN("dev_nperio_tx_fifo must be 16-32768\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val > (DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz) >> 16)) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->dev_nperio_tx_fifo_size)) {
++			DWC_ERROR
++			    ("%d invalid for dev_nperio_tx_fifo_size. Check HW configuration.\n",
++			     val);
++		}
++		val =
++		    (DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz) >>
++		     16);
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->dev_nperio_tx_fifo_size = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_dev_nperio_tx_fifo_size(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->dev_nperio_tx_fifo_size;
++}
++
++int dwc_otg_set_param_host_rx_fifo_size(dwc_otg_core_if_t * core_if,
++					int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 16, 32768)) {
++		DWC_WARN("Wrong value for host_rx_fifo_size\n");
++		DWC_WARN("host_rx_fifo_size must be 16-32768\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val > DWC_READ_REG32(&core_if->core_global_regs->grxfsiz)) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->host_rx_fifo_size)) {
++			DWC_ERROR
++			    ("%d invalid for host_rx_fifo_size. Check HW configuration.\n",
++			     val);
++		}
++		val = DWC_READ_REG32(&core_if->core_global_regs->grxfsiz);
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->host_rx_fifo_size = val;
++	return retval;
++
++}
++
++int32_t dwc_otg_get_param_host_rx_fifo_size(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->host_rx_fifo_size;
++}
++
++int dwc_otg_set_param_host_nperio_tx_fifo_size(dwc_otg_core_if_t * core_if,
++					       int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 16, 32768)) {
++		DWC_WARN("Wrong value for host_nperio_tx_fifo_size\n");
++		DWC_WARN("host_nperio_tx_fifo_size must be 16-32768\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val > (DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz) >> 16)) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->host_nperio_tx_fifo_size)) {
++			DWC_ERROR
++			    ("%d invalid for host_nperio_tx_fifo_size. Check HW configuration.\n",
++			     val);
++		}
++		val =
++		    (DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz) >>
++		     16);
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->host_nperio_tx_fifo_size = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_host_nperio_tx_fifo_size(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->host_nperio_tx_fifo_size;
++}
++
++int dwc_otg_set_param_host_perio_tx_fifo_size(dwc_otg_core_if_t * core_if,
++					      int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 16, 32768)) {
++		DWC_WARN("Wrong value for host_perio_tx_fifo_size\n");
++		DWC_WARN("host_perio_tx_fifo_size must be 16-32768\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val > ((core_if->hptxfsiz.d32) >> 16)) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->host_perio_tx_fifo_size)) {
++			DWC_ERROR
++			    ("%d invalid for host_perio_tx_fifo_size. Check HW configuration.\n",
++			     val);
++		}
++		val = (core_if->hptxfsiz.d32) >> 16;
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->host_perio_tx_fifo_size = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_host_perio_tx_fifo_size(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->host_perio_tx_fifo_size;
++}
++
++int dwc_otg_set_param_max_transfer_size(dwc_otg_core_if_t * core_if,
++					int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 2047, 524288)) {
++		DWC_WARN("Wrong value for max_transfer_size\n");
++		DWC_WARN("max_transfer_size must be 2047-524288\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val >= (1 << (core_if->hwcfg3.b.xfer_size_cntr_width + 11))) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->max_transfer_size)) {
++			DWC_ERROR
++			    ("%d invalid for max_transfer_size. Check HW configuration.\n",
++			     val);
++		}
++		val =
++		    ((1 << (core_if->hwcfg3.b.packet_size_cntr_width + 11)) -
++		     1);
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->max_transfer_size = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_max_transfer_size(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->max_transfer_size;
++}
++
++int dwc_otg_set_param_max_packet_count(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 15, 511)) {
++		DWC_WARN("Wrong value for max_packet_count\n");
++		DWC_WARN("max_packet_count must be 15-511\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val > (1 << (core_if->hwcfg3.b.packet_size_cntr_width + 4))) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->max_packet_count)) {
++			DWC_ERROR
++			    ("%d invalid for max_packet_count. Check HW configuration.\n",
++			     val);
++		}
++		val =
++		    ((1 << (core_if->hwcfg3.b.packet_size_cntr_width + 4)) - 1);
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->max_packet_count = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_max_packet_count(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->max_packet_count;
++}
++
++int dwc_otg_set_param_host_channels(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 1, 16)) {
++		DWC_WARN("Wrong value for host_channels\n");
++		DWC_WARN("host_channels must be 1-16\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val > (core_if->hwcfg2.b.num_host_chan + 1)) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->host_channels)) {
++			DWC_ERROR
++			    ("%d invalid for host_channels. Check HW configurations.\n",
++			     val);
++		}
++		val = (core_if->hwcfg2.b.num_host_chan + 1);
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->host_channels = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_host_channels(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->host_channels;
++}
++
++int dwc_otg_set_param_dev_endpoints(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 1, 15)) {
++		DWC_WARN("Wrong value for dev_endpoints\n");
++		DWC_WARN("dev_endpoints must be 1-15\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val > (core_if->hwcfg2.b.num_dev_ep)) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->dev_endpoints)) {
++			DWC_ERROR
++			    ("%d invalid for dev_endpoints. Check HW configurations.\n",
++			     val);
++		}
++		val = core_if->hwcfg2.b.num_dev_ep;
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->dev_endpoints = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_dev_endpoints(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->dev_endpoints;
++}
++
++int dwc_otg_set_param_phy_type(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	int valid = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 2)) {
++		DWC_WARN("Wrong value for phy_type\n");
++		DWC_WARN("phy_type must be 0,1 or 2\n");
++		return -DWC_E_INVALID;
++	}
++#ifndef NO_FS_PHY_HW_CHECKS
++	if ((val == DWC_PHY_TYPE_PARAM_UTMI) &&
++	    ((core_if->hwcfg2.b.hs_phy_type == 1) ||
++	     (core_if->hwcfg2.b.hs_phy_type == 3))) {
++		valid = 1;
++	} else if ((val == DWC_PHY_TYPE_PARAM_ULPI) &&
++		   ((core_if->hwcfg2.b.hs_phy_type == 2) ||
++		    (core_if->hwcfg2.b.hs_phy_type == 3))) {
++		valid = 1;
++	} else if ((val == DWC_PHY_TYPE_PARAM_FS) &&
++		   (core_if->hwcfg2.b.fs_phy_type == 1)) {
++		valid = 1;
++	}
++	if (!valid) {
++		if (dwc_otg_param_initialized(core_if->core_params->phy_type)) {
++			DWC_ERROR
++			    ("%d invalid for phy_type. Check HW configurations.\n",
++			     val);
++		}
++		if (core_if->hwcfg2.b.hs_phy_type) {
++			if ((core_if->hwcfg2.b.hs_phy_type == 3) ||
++			    (core_if->hwcfg2.b.hs_phy_type == 1)) {
++				val = DWC_PHY_TYPE_PARAM_UTMI;
++			} else {
++				val = DWC_PHY_TYPE_PARAM_ULPI;
++			}
++		}
++		retval = -DWC_E_INVALID;
++	}
++#endif
++	core_if->core_params->phy_type = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_phy_type(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->phy_type;
++}
++
++int dwc_otg_set_param_speed(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong value for speed parameter\n");
++		DWC_WARN("max_speed parameter must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++	if ((val == 0)
++	    && dwc_otg_get_param_phy_type(core_if) == DWC_PHY_TYPE_PARAM_FS) {
++		if (dwc_otg_param_initialized(core_if->core_params->speed)) {
++			DWC_ERROR
++			    ("%d invalid for speed paremter. Check HW configuration.\n",
++			     val);
++		}
++		val =
++		    (dwc_otg_get_param_phy_type(core_if) ==
++		     DWC_PHY_TYPE_PARAM_FS ? 1 : 0);
++		retval = -DWC_E_INVALID;
++	}
++	core_if->core_params->speed = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_speed(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->speed;
++}
++
++int dwc_otg_set_param_host_ls_low_power_phy_clk(dwc_otg_core_if_t * core_if,
++						int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN
++		    ("Wrong value for host_ls_low_power_phy_clk parameter\n");
++		DWC_WARN("host_ls_low_power_phy_clk must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	if ((val == DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_48MHZ)
++	    && (dwc_otg_get_param_phy_type(core_if) == DWC_PHY_TYPE_PARAM_FS)) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->host_ls_low_power_phy_clk)) {
++			DWC_ERROR
++			    ("%d invalid for host_ls_low_power_phy_clk. Check HW configuration.\n",
++			     val);
++		}
++		val =
++		    (dwc_otg_get_param_phy_type(core_if) ==
++		     DWC_PHY_TYPE_PARAM_FS) ?
++		    DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_6MHZ :
++		    DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_48MHZ;
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->host_ls_low_power_phy_clk = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_host_ls_low_power_phy_clk(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->host_ls_low_power_phy_clk;
++}
++
++int dwc_otg_set_param_phy_ulpi_ddr(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong value for phy_ulpi_ddr\n");
++		DWC_WARN("phy_upli_ddr must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	core_if->core_params->phy_ulpi_ddr = val;
++	return 0;
++}
++
++int32_t dwc_otg_get_param_phy_ulpi_ddr(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->phy_ulpi_ddr;
++}
++
++int dwc_otg_set_param_phy_ulpi_ext_vbus(dwc_otg_core_if_t * core_if,
++					int32_t val)
++{
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong valaue for phy_ulpi_ext_vbus\n");
++		DWC_WARN("phy_ulpi_ext_vbus must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	core_if->core_params->phy_ulpi_ext_vbus = val;
++	return 0;
++}
++
++int32_t dwc_otg_get_param_phy_ulpi_ext_vbus(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->phy_ulpi_ext_vbus;
++}
++
++int dwc_otg_set_param_phy_utmi_width(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	if (DWC_OTG_PARAM_TEST(val, 8, 8) && DWC_OTG_PARAM_TEST(val, 16, 16)) {
++		DWC_WARN("Wrong valaue for phy_utmi_width\n");
++		DWC_WARN("phy_utmi_width must be 8 or 16\n");
++		return -DWC_E_INVALID;
++	}
++
++	core_if->core_params->phy_utmi_width = val;
++	return 0;
++}
++
++int32_t dwc_otg_get_param_phy_utmi_width(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->phy_utmi_width;
++}
++
++int dwc_otg_set_param_ulpi_fs_ls(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong valaue for ulpi_fs_ls\n");
++		DWC_WARN("ulpi_fs_ls must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	core_if->core_params->ulpi_fs_ls = val;
++	return 0;
++}
++
++int32_t dwc_otg_get_param_ulpi_fs_ls(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->ulpi_fs_ls;
++}
++
++int dwc_otg_set_param_ts_dline(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong valaue for ts_dline\n");
++		DWC_WARN("ts_dline must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	core_if->core_params->ts_dline = val;
++	return 0;
++}
++
++int32_t dwc_otg_get_param_ts_dline(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->ts_dline;
++}
++
++int dwc_otg_set_param_i2c_enable(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong valaue for i2c_enable\n");
++		DWC_WARN("i2c_enable must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++#ifndef NO_FS_PHY_HW_CHECK
++	if (val == 1 && core_if->hwcfg3.b.i2c == 0) {
++		if (dwc_otg_param_initialized(core_if->core_params->i2c_enable)) {
++			DWC_ERROR
++			    ("%d invalid for i2c_enable. Check HW configuration.\n",
++			     val);
++		}
++		val = 0;
++		retval = -DWC_E_INVALID;
++	}
++#endif
++
++	core_if->core_params->i2c_enable = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_i2c_enable(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->i2c_enable;
++}
++
++int dwc_otg_set_param_dev_perio_tx_fifo_size(dwc_otg_core_if_t * core_if,
++					     int32_t val, int fifo_num)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 4, 768)) {
++		DWC_WARN("Wrong value for dev_perio_tx_fifo_size\n");
++		DWC_WARN("dev_perio_tx_fifo_size must be 4-768\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val >
++	    (DWC_READ_REG32(&core_if->core_global_regs->dtxfsiz[fifo_num]))) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->dev_perio_tx_fifo_size[fifo_num])) {
++			DWC_ERROR
++			    ("`%d' invalid for parameter `dev_perio_fifo_size_%d'. Check HW configuration.\n",
++			     val, fifo_num);
++		}
++		val = (DWC_READ_REG32(&core_if->core_global_regs->dtxfsiz[fifo_num]));
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->dev_perio_tx_fifo_size[fifo_num] = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_dev_perio_tx_fifo_size(dwc_otg_core_if_t * core_if,
++						 int fifo_num)
++{
++	return core_if->core_params->dev_perio_tx_fifo_size[fifo_num];
++}
++
++int dwc_otg_set_param_en_multiple_tx_fifo(dwc_otg_core_if_t * core_if,
++					  int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong valaue for en_multiple_tx_fifo,\n");
++		DWC_WARN("en_multiple_tx_fifo must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val == 1 && core_if->hwcfg4.b.ded_fifo_en == 0) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->en_multiple_tx_fifo)) {
++			DWC_ERROR
++			    ("%d invalid for parameter en_multiple_tx_fifo. Check HW configuration.\n",
++			     val);
++		}
++		val = 0;
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->en_multiple_tx_fifo = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_en_multiple_tx_fifo(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->en_multiple_tx_fifo;
++}
++
++int dwc_otg_set_param_dev_tx_fifo_size(dwc_otg_core_if_t * core_if, int32_t val,
++				       int fifo_num)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 4, 768)) {
++		DWC_WARN("Wrong value for dev_tx_fifo_size\n");
++		DWC_WARN("dev_tx_fifo_size must be 4-768\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val >
++	    (DWC_READ_REG32(&core_if->core_global_regs->dtxfsiz[fifo_num]))) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->dev_tx_fifo_size[fifo_num])) {
++			DWC_ERROR
++			    ("`%d' invalid for parameter `dev_tx_fifo_size_%d'. Check HW configuration.\n",
++			     val, fifo_num);
++		}
++		val = (DWC_READ_REG32(&core_if->core_global_regs->dtxfsiz[fifo_num]));
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->dev_tx_fifo_size[fifo_num] = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_dev_tx_fifo_size(dwc_otg_core_if_t * core_if,
++					   int fifo_num)
++{
++	return core_if->core_params->dev_tx_fifo_size[fifo_num];
++}
++
++int dwc_otg_set_param_thr_ctl(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 7)) {
++		DWC_WARN("Wrong value for thr_ctl\n");
++		DWC_WARN("thr_ctl must be 0-7\n");
++		return -DWC_E_INVALID;
++	}
++
++	if ((val != 0) &&
++	    (!dwc_otg_get_param_dma_enable(core_if) ||
++	     !core_if->hwcfg4.b.ded_fifo_en)) {
++		if (dwc_otg_param_initialized(core_if->core_params->thr_ctl)) {
++			DWC_ERROR
++			    ("%d invalid for parameter thr_ctl. Check HW configuration.\n",
++			     val);
++		}
++		val = 0;
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->thr_ctl = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_thr_ctl(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->thr_ctl;
++}
++
++int dwc_otg_set_param_lpm_enable(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong value for lpm_enable\n");
++		DWC_WARN("lpm_enable must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val && !core_if->hwcfg3.b.otg_lpm_en) {
++		if (dwc_otg_param_initialized(core_if->core_params->lpm_enable)) {
++			DWC_ERROR
++			    ("%d invalid for parameter lpm_enable. Check HW configuration.\n",
++			     val);
++		}
++		val = 0;
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->lpm_enable = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_lpm_enable(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->lpm_enable;
++}
++
++int dwc_otg_set_param_tx_thr_length(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	if (DWC_OTG_PARAM_TEST(val, 8, 128)) {
++		DWC_WARN("Wrong valaue for tx_thr_length\n");
++		DWC_WARN("tx_thr_length must be 8 - 128\n");
++		return -DWC_E_INVALID;
++	}
++
++	core_if->core_params->tx_thr_length = val;
++	return 0;
++}
++
++int32_t dwc_otg_get_param_tx_thr_length(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->tx_thr_length;
++}
++
++int dwc_otg_set_param_rx_thr_length(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	if (DWC_OTG_PARAM_TEST(val, 8, 128)) {
++		DWC_WARN("Wrong valaue for rx_thr_length\n");
++		DWC_WARN("rx_thr_length must be 8 - 128\n");
++		return -DWC_E_INVALID;
++	}
++
++	core_if->core_params->rx_thr_length = val;
++	return 0;
++}
++
++int32_t dwc_otg_get_param_rx_thr_length(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->rx_thr_length;
++}
++
++int dwc_otg_set_param_dma_burst_size(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	if (DWC_OTG_PARAM_TEST(val, 1, 1) &&
++	    DWC_OTG_PARAM_TEST(val, 4, 4) &&
++	    DWC_OTG_PARAM_TEST(val, 8, 8) &&
++	    DWC_OTG_PARAM_TEST(val, 16, 16) &&
++	    DWC_OTG_PARAM_TEST(val, 32, 32) &&
++	    DWC_OTG_PARAM_TEST(val, 64, 64) &&
++	    DWC_OTG_PARAM_TEST(val, 128, 128) &&
++	    DWC_OTG_PARAM_TEST(val, 256, 256)) {
++		DWC_WARN("`%d' invalid for parameter `dma_burst_size'\n", val);
++		return -DWC_E_INVALID;
++	}
++	core_if->core_params->dma_burst_size = val;
++	return 0;
++}
++
++int32_t dwc_otg_get_param_dma_burst_size(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->dma_burst_size;
++}
++
++int dwc_otg_set_param_pti_enable(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("`%d' invalid for parameter `pti_enable'\n", val);
++		return -DWC_E_INVALID;
++	}
++	if (val && (core_if->snpsid < OTG_CORE_REV_2_72a)) {
++		if (dwc_otg_param_initialized(core_if->core_params->pti_enable)) {
++			DWC_ERROR
++			    ("%d invalid for parameter pti_enable. Check HW configuration.\n",
++			     val);
++		}
++		retval = -DWC_E_INVALID;
++		val = 0;
++	}
++	core_if->core_params->pti_enable = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_pti_enable(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->pti_enable;
++}
++
++int dwc_otg_set_param_mpi_enable(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("`%d' invalid for parameter `mpi_enable'\n", val);
++		return -DWC_E_INVALID;
++	}
++	if (val && (core_if->hwcfg2.b.multi_proc_int == 0)) {
++		if (dwc_otg_param_initialized(core_if->core_params->mpi_enable)) {
++			DWC_ERROR
++			    ("%d invalid for parameter mpi_enable. Check HW configuration.\n",
++			     val);
++		}
++		retval = -DWC_E_INVALID;
++		val = 0;
++	}
++	core_if->core_params->mpi_enable = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_mpi_enable(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->mpi_enable;
++}
++
++int dwc_otg_set_param_adp_enable(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("`%d' invalid for parameter `adp_enable'\n", val);
++		return -DWC_E_INVALID;
++	}
++	if (val && (core_if->hwcfg3.b.adp_supp == 0)) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->adp_supp_enable)) {
++			DWC_ERROR
++			    ("%d invalid for parameter adp_enable. Check HW configuration.\n",
++			     val);
++		}
++		retval = -DWC_E_INVALID;
++		val = 0;
++	}
++	core_if->core_params->adp_supp_enable = val;
++	/*Set OTG version 2.0 in case of enabling ADP*/
++	if (val)
++		dwc_otg_set_param_otg_ver(core_if, 1);
++
++	return retval;
++}
++
++int32_t dwc_otg_get_param_adp_enable(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->adp_supp_enable;
++}
++
++int dwc_otg_set_param_ic_usb_cap(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("`%d' invalid for parameter `ic_usb_cap'\n", val);
++		DWC_WARN("ic_usb_cap must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val && (core_if->hwcfg2.b.otg_enable_ic_usb == 0)) {
++		if (dwc_otg_param_initialized(core_if->core_params->ic_usb_cap)) {
++			DWC_ERROR
++			    ("%d invalid for parameter ic_usb_cap. Check HW configuration.\n",
++			     val);
++		}
++		retval = -DWC_E_INVALID;
++		val = 0;
++	}
++	core_if->core_params->ic_usb_cap = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_ic_usb_cap(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->ic_usb_cap;
++}
++
++int dwc_otg_set_param_ahb_thr_ratio(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	int valid = 1;
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 3)) {
++		DWC_WARN("`%d' invalid for parameter `ahb_thr_ratio'\n", val);
++		DWC_WARN("ahb_thr_ratio must be 0 - 3\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val
++	    && (core_if->snpsid < OTG_CORE_REV_2_81a
++		|| !dwc_otg_get_param_thr_ctl(core_if))) {
++		valid = 0;
++	} else if (val
++		   && ((dwc_otg_get_param_tx_thr_length(core_if) / (1 << val)) <
++		       4)) {
++		valid = 0;
++	}
++	if (valid == 0) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->ahb_thr_ratio)) {
++			DWC_ERROR
++			    ("%d invalid for parameter ahb_thr_ratio. Check HW configuration.\n",
++			     val);
++		}
++		retval = -DWC_E_INVALID;
++		val = 0;
++	}
++
++	core_if->core_params->ahb_thr_ratio = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_ahb_thr_ratio(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->ahb_thr_ratio;
++}
++
++int dwc_otg_set_param_power_down(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	int valid = 1;
++	hwcfg4_data_t hwcfg4 = {.d32 = 0 };
++	hwcfg4.d32 = DWC_READ_REG32(&core_if->core_global_regs->ghwcfg4);
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 3)) {
++		DWC_WARN("`%d' invalid for parameter `power_down'\n", val);
++		DWC_WARN("power_down must be 0 - 2\n");
++		return -DWC_E_INVALID;
++	}
++
++	if ((val == 2) && (core_if->snpsid < OTG_CORE_REV_2_91a)) {
++		valid = 0;
++	}
++	if ((val == 3)
++	    && ((core_if->snpsid < OTG_CORE_REV_3_00a)
++		|| (hwcfg4.b.xhiber == 0))) {
++		valid = 0;
++	}
++	if (valid == 0) {
++		if (dwc_otg_param_initialized(core_if->core_params->power_down)) {
++			DWC_ERROR
++			    ("%d invalid for parameter power_down. Check HW configuration.\n",
++			     val);
++		}
++		retval = -DWC_E_INVALID;
++		val = 0;
++	}
++	core_if->core_params->power_down = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_power_down(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->power_down;
++}
++
++int dwc_otg_set_param_reload_ctl(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	int valid = 1;
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("`%d' invalid for parameter `reload_ctl'\n", val);
++		DWC_WARN("reload_ctl must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	if ((val == 1) && (core_if->snpsid < OTG_CORE_REV_2_92a)) {
++		valid = 0;
++	}
++	if (valid == 0) {
++		if (dwc_otg_param_initialized(core_if->core_params->reload_ctl)) {
++			DWC_ERROR("%d invalid for parameter reload_ctl."
++				  "Check HW configuration.\n", val);
++		}
++		retval = -DWC_E_INVALID;
++		val = 0;
++	}
++	core_if->core_params->reload_ctl = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_reload_ctl(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->reload_ctl;
++}
++
++int dwc_otg_set_param_dev_out_nak(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	int valid = 1;
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("`%d' invalid for parameter `dev_out_nak'\n", val);
++		DWC_WARN("dev_out_nak must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	if ((val == 1) && ((core_if->snpsid < OTG_CORE_REV_2_93a) ||
++		!(core_if->core_params->dma_desc_enable))) {
++		valid = 0;
++	}
++	if (valid == 0) {
++		if (dwc_otg_param_initialized(core_if->core_params->dev_out_nak)) {
++			DWC_ERROR("%d invalid for parameter dev_out_nak."
++				"Check HW configuration.\n", val);
++		}
++		retval = -DWC_E_INVALID;
++		val = 0;
++	}
++	core_if->core_params->dev_out_nak = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_dev_out_nak(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->dev_out_nak;
++}
++
++int dwc_otg_set_param_cont_on_bna(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	int valid = 1;
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("`%d' invalid for parameter `cont_on_bna'\n", val);
++		DWC_WARN("cont_on_bna must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	if ((val == 1) && ((core_if->snpsid < OTG_CORE_REV_2_94a) ||
++		!(core_if->core_params->dma_desc_enable))) {
++			valid = 0;
++	}
++	if (valid == 0) {
++		if (dwc_otg_param_initialized(core_if->core_params->cont_on_bna)) {
++			DWC_ERROR("%d invalid for parameter cont_on_bna."
++				"Check HW configuration.\n", val);
++		}
++		retval = -DWC_E_INVALID;
++		val = 0;
++	}
++	core_if->core_params->cont_on_bna = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_cont_on_bna(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->cont_on_bna;
++}
++
++int dwc_otg_set_param_ahb_single(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	int valid = 1;
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("`%d' invalid for parameter `ahb_single'\n", val);
++		DWC_WARN("ahb_single must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	if ((val == 1) && (core_if->snpsid < OTG_CORE_REV_2_94a)) {
++			valid = 0;
++	}
++	if (valid == 0) {
++		if (dwc_otg_param_initialized(core_if->core_params->ahb_single)) {
++			DWC_ERROR("%d invalid for parameter ahb_single."
++				"Check HW configuration.\n", val);
++		}
++		retval = -DWC_E_INVALID;
++		val = 0;
++	}
++	core_if->core_params->ahb_single = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_ahb_single(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->ahb_single;
++}
++
++int dwc_otg_set_param_otg_ver(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("`%d' invalid for parameter `otg_ver'\n", val);
++		DWC_WARN
++		    ("otg_ver must be 0(for OTG 1.3 support) or 1(for OTG 2.0 support)\n");
++		return -DWC_E_INVALID;
++	}
++
++	core_if->core_params->otg_ver = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_otg_ver(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->otg_ver;
++}
++
++uint32_t dwc_otg_get_hnpstatus(dwc_otg_core_if_t * core_if)
++{
++	gotgctl_data_t otgctl;
++	otgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
++	return otgctl.b.hstnegscs;
++}
++
++uint32_t dwc_otg_get_srpstatus(dwc_otg_core_if_t * core_if)
++{
++	gotgctl_data_t otgctl;
++	otgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
++	return otgctl.b.sesreqscs;
++}
++
++void dwc_otg_set_hnpreq(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	if(core_if->otg_ver == 0) {
++		gotgctl_data_t otgctl;
++		otgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
++		otgctl.b.hnpreq = val;
++		DWC_WRITE_REG32(&core_if->core_global_regs->gotgctl, otgctl.d32);
++	} else {
++		core_if->otg_sts = val;
++	}
++}
++
++uint32_t dwc_otg_get_gsnpsid(dwc_otg_core_if_t * core_if)
++{
++	return core_if->snpsid;
++}
++
++uint32_t dwc_otg_get_mode(dwc_otg_core_if_t * core_if)
++{
++	gintsts_data_t gintsts;
++	gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++	return gintsts.b.curmode;
++}
++
++uint32_t dwc_otg_get_hnpcapable(dwc_otg_core_if_t * core_if)
++{
++	gusbcfg_data_t usbcfg;
++	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
++	return usbcfg.b.hnpcap;
++}
++
++void dwc_otg_set_hnpcapable(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	gusbcfg_data_t usbcfg;
++	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
++	usbcfg.b.hnpcap = val;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, usbcfg.d32);
++}
++
++uint32_t dwc_otg_get_srpcapable(dwc_otg_core_if_t * core_if)
++{
++	gusbcfg_data_t usbcfg;
++	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
++	return usbcfg.b.srpcap;
++}
++
++void dwc_otg_set_srpcapable(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	gusbcfg_data_t usbcfg;
++	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
++	usbcfg.b.srpcap = val;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, usbcfg.d32);
++}
++
++uint32_t dwc_otg_get_devspeed(dwc_otg_core_if_t * core_if)
++{
++	dcfg_data_t dcfg;
++	/* originally: dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg); */
++
++        dcfg.d32 = -1; //GRAYG
++        DWC_DEBUGPL(DBG_CILV, "%s - core_if(%p)\n", __func__, core_if);
++        if (NULL == core_if)
++                DWC_ERROR("reg request with NULL core_if\n");
++        DWC_DEBUGPL(DBG_CILV, "%s - core_if(%p)->dev_if(%p)\n", __func__,
++                    core_if, core_if->dev_if);
++        if (NULL == core_if->dev_if)
++                DWC_ERROR("reg request with NULL dev_if\n");
++        DWC_DEBUGPL(DBG_CILV, "%s - core_if(%p)->dev_if(%p)->"
++                    "dev_global_regs(%p)\n", __func__,
++                    core_if, core_if->dev_if,
++                    core_if->dev_if->dev_global_regs);
++        if (NULL == core_if->dev_if->dev_global_regs)
++                DWC_ERROR("reg request with NULL dev_global_regs\n");
++        else {
++                DWC_DEBUGPL(DBG_CILV, "%s - &core_if(%p)->dev_if(%p)->"
++                            "dev_global_regs(%p)->dcfg = %p\n", __func__,
++                            core_if, core_if->dev_if,
++                            core_if->dev_if->dev_global_regs,
++                            &core_if->dev_if->dev_global_regs->dcfg);
++		dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
++        }
++	return dcfg.b.devspd;
++}
++
++void dwc_otg_set_devspeed(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	dcfg_data_t dcfg;
++	dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
++	dcfg.b.devspd = val;
++	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg, dcfg.d32);
++}
++
++uint32_t dwc_otg_get_busconnected(dwc_otg_core_if_t * core_if)
++{
++	hprt0_data_t hprt0;
++	hprt0.d32 = DWC_READ_REG32(core_if->host_if->hprt0);
++	return hprt0.b.prtconnsts;
++}
++
++uint32_t dwc_otg_get_enumspeed(dwc_otg_core_if_t * core_if)
++{
++	dsts_data_t dsts;
++	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
++	return dsts.b.enumspd;
++}
++
++uint32_t dwc_otg_get_prtpower(dwc_otg_core_if_t * core_if)
++{
++	hprt0_data_t hprt0;
++	hprt0.d32 = DWC_READ_REG32(core_if->host_if->hprt0);
++	return hprt0.b.prtpwr;
++
++}
++
++uint32_t dwc_otg_get_core_state(dwc_otg_core_if_t * core_if)
++{
++	return core_if->hibernation_suspend;
++}
++
++void dwc_otg_set_prtpower(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	hprt0_data_t hprt0;
++	hprt0.d32 = dwc_otg_read_hprt0(core_if);
++	hprt0.b.prtpwr = val;
++	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++}
++
++uint32_t dwc_otg_get_prtsuspend(dwc_otg_core_if_t * core_if)
++{
++	hprt0_data_t hprt0;
++	hprt0.d32 = DWC_READ_REG32(core_if->host_if->hprt0);
++	return hprt0.b.prtsusp;
++
++}
++
++void dwc_otg_set_prtsuspend(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	hprt0_data_t hprt0;
++	hprt0.d32 = dwc_otg_read_hprt0(core_if);
++	hprt0.b.prtsusp = val;
++	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++}
++
++uint32_t dwc_otg_get_fr_interval(dwc_otg_core_if_t * core_if)
++{
++	hfir_data_t hfir;
++	hfir.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->hfir);
++	return hfir.b.frint;
++
++}
++
++void dwc_otg_set_fr_interval(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	hfir_data_t hfir;
++	uint32_t fram_int;
++	fram_int = calc_frame_interval(core_if);
++	hfir.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->hfir);
++	if (!core_if->core_params->reload_ctl) {
++		DWC_WARN("\nCannot reload HFIR register.HFIR.HFIRRldCtrl bit is"
++			 "not set to 1.\nShould load driver with reload_ctl=1"
++			 " module parameter\n");
++		return;
++	}
++	switch (fram_int) {
++	case 3750:
++		if ((val < 3350) || (val > 4150)) {
++			DWC_WARN("HFIR interval for HS core and 30 MHz"
++				 "clock freq should be from 3350 to 4150\n");
++			return;
++		}
++		break;
++	case 30000:
++		if ((val < 26820) || (val > 33180)) {
++			DWC_WARN("HFIR interval for FS/LS core and 30 MHz"
++				 "clock freq should be from 26820 to 33180\n");
++			return;
++		}
++		break;
++	case 6000:
++		if ((val < 5360) || (val > 6640)) {
++			DWC_WARN("HFIR interval for HS core and 48 MHz"
++				 "clock freq should be from 5360 to 6640\n");
++			return;
++		}
++		break;
++	case 48000:
++		if ((val < 42912) || (val > 53088)) {
++			DWC_WARN("HFIR interval for FS/LS core and 48 MHz"
++				 "clock freq should be from 42912 to 53088\n");
++			return;
++		}
++		break;
++	case 7500:
++		if ((val < 6700) || (val > 8300)) {
++			DWC_WARN("HFIR interval for HS core and 60 MHz"
++				 "clock freq should be from 6700 to 8300\n");
++			return;
++		}
++		break;
++	case 60000:
++		if ((val < 53640) || (val > 65536)) {
++			DWC_WARN("HFIR interval for FS/LS core and 60 MHz"
++				 "clock freq should be from 53640 to 65536\n");
++			return;
++		}
++		break;
++	default:
++		DWC_WARN("Unknown frame interval\n");
++		return;
++		break;
++
++	}
++	hfir.b.frint = val;
++	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hfir, hfir.d32);
++}
++
++uint32_t dwc_otg_get_mode_ch_tim(dwc_otg_core_if_t * core_if)
++{
++	hcfg_data_t hcfg;
++	hcfg.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->hcfg);
++	return hcfg.b.modechtimen;
++
++}
++
++void dwc_otg_set_mode_ch_tim(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	hcfg_data_t hcfg;
++	hcfg.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->hcfg);
++	hcfg.b.modechtimen = val;
++	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hcfg, hcfg.d32);
++}
++
++void dwc_otg_set_prtresume(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	hprt0_data_t hprt0;
++	hprt0.d32 = dwc_otg_read_hprt0(core_if);
++	hprt0.b.prtres = val;
++	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++}
++
++uint32_t dwc_otg_get_remotewakesig(dwc_otg_core_if_t * core_if)
++{
++	dctl_data_t dctl;
++	dctl.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dctl);
++	return dctl.b.rmtwkupsig;
++}
++
++uint32_t dwc_otg_get_lpm_portsleepstatus(dwc_otg_core_if_t * core_if)
++{
++	glpmcfg_data_t lpmcfg;
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++
++	DWC_ASSERT(!
++		   ((core_if->lx_state == DWC_OTG_L1) ^ lpmcfg.b.prt_sleep_sts),
++		   "lx_state = %d, lmpcfg.prt_sleep_sts = %d\n",
++		   core_if->lx_state, lpmcfg.b.prt_sleep_sts);
++
++	return lpmcfg.b.prt_sleep_sts;
++}
++
++uint32_t dwc_otg_get_lpm_remotewakeenabled(dwc_otg_core_if_t * core_if)
++{
++	glpmcfg_data_t lpmcfg;
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++	return lpmcfg.b.rem_wkup_en;
++}
++
++uint32_t dwc_otg_get_lpmresponse(dwc_otg_core_if_t * core_if)
++{
++	glpmcfg_data_t lpmcfg;
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++	return lpmcfg.b.appl_resp;
++}
++
++void dwc_otg_set_lpmresponse(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	glpmcfg_data_t lpmcfg;
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++	lpmcfg.b.appl_resp = val;
++	DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg, lpmcfg.d32);
++}
++
++uint32_t dwc_otg_get_hsic_connect(dwc_otg_core_if_t * core_if)
++{
++	glpmcfg_data_t lpmcfg;
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++	return lpmcfg.b.hsic_connect;
++}
++
++void dwc_otg_set_hsic_connect(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	glpmcfg_data_t lpmcfg;
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++	lpmcfg.b.hsic_connect = val;
++	DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg, lpmcfg.d32);
++}
++
++uint32_t dwc_otg_get_inv_sel_hsic(dwc_otg_core_if_t * core_if)
++{
++	glpmcfg_data_t lpmcfg;
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++	return lpmcfg.b.inv_sel_hsic;
++
++}
++
++void dwc_otg_set_inv_sel_hsic(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	glpmcfg_data_t lpmcfg;
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++	lpmcfg.b.inv_sel_hsic = val;
++	DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg, lpmcfg.d32);
++}
++
++uint32_t dwc_otg_get_gotgctl(dwc_otg_core_if_t * core_if)
++{
++	return DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
++}
++
++void dwc_otg_set_gotgctl(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	DWC_WRITE_REG32(&core_if->core_global_regs->gotgctl, val);
++}
++
++uint32_t dwc_otg_get_gusbcfg(dwc_otg_core_if_t * core_if)
++{
++	return DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
++}
++
++void dwc_otg_set_gusbcfg(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, val);
++}
++
++uint32_t dwc_otg_get_grxfsiz(dwc_otg_core_if_t * core_if)
++{
++	return DWC_READ_REG32(&core_if->core_global_regs->grxfsiz);
++}
++
++void dwc_otg_set_grxfsiz(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	DWC_WRITE_REG32(&core_if->core_global_regs->grxfsiz, val);
++}
++
++uint32_t dwc_otg_get_gnptxfsiz(dwc_otg_core_if_t * core_if)
++{
++	return DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz);
++}
++
++void dwc_otg_set_gnptxfsiz(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	DWC_WRITE_REG32(&core_if->core_global_regs->gnptxfsiz, val);
++}
++
++uint32_t dwc_otg_get_gpvndctl(dwc_otg_core_if_t * core_if)
++{
++	return DWC_READ_REG32(&core_if->core_global_regs->gpvndctl);
++}
++
++void dwc_otg_set_gpvndctl(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	DWC_WRITE_REG32(&core_if->core_global_regs->gpvndctl, val);
++}
++
++uint32_t dwc_otg_get_ggpio(dwc_otg_core_if_t * core_if)
++{
++	return DWC_READ_REG32(&core_if->core_global_regs->ggpio);
++}
++
++void dwc_otg_set_ggpio(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	DWC_WRITE_REG32(&core_if->core_global_regs->ggpio, val);
++}
++
++uint32_t dwc_otg_get_hprt0(dwc_otg_core_if_t * core_if)
++{
++	return DWC_READ_REG32(core_if->host_if->hprt0);
++
++}
++
++void dwc_otg_set_hprt0(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	DWC_WRITE_REG32(core_if->host_if->hprt0, val);
++}
++
++uint32_t dwc_otg_get_guid(dwc_otg_core_if_t * core_if)
++{
++	return DWC_READ_REG32(&core_if->core_global_regs->guid);
++}
++
++void dwc_otg_set_guid(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	DWC_WRITE_REG32(&core_if->core_global_regs->guid, val);
++}
++
++uint32_t dwc_otg_get_hptxfsiz(dwc_otg_core_if_t * core_if)
++{
++	return DWC_READ_REG32(&core_if->core_global_regs->hptxfsiz);
++}
++
++uint16_t dwc_otg_get_otg_version(dwc_otg_core_if_t * core_if)
++{
++	return ((core_if->otg_ver == 1) ? (uint16_t)0x0200 : (uint16_t)0x0103);
++}
++
++/**
++ * Start the SRP timer to detect when the SRP does not complete within
++ * 6 seconds.
++ *
++ * @param core_if the pointer to core_if strucure.
++ */
++void dwc_otg_pcd_start_srp_timer(dwc_otg_core_if_t * core_if)
++{
++	core_if->srp_timer_started = 1;
++	DWC_TIMER_SCHEDULE(core_if->srp_timer, 6000 /* 6 secs */ );
++}
++
++void dwc_otg_initiate_srp(dwc_otg_core_if_t * core_if)
++{
++	uint32_t *addr = (uint32_t *) & (core_if->core_global_regs->gotgctl);
++	gotgctl_data_t mem;
++	gotgctl_data_t val;
++
++	val.d32 = DWC_READ_REG32(addr);
++	if (val.b.sesreq) {
++		DWC_ERROR("Session Request Already active!\n");
++		return;
++	}
++
++	DWC_INFO("Session Request Initated\n");	//NOTICE
++	mem.d32 = DWC_READ_REG32(addr);
++	mem.b.sesreq = 1;
++	DWC_WRITE_REG32(addr, mem.d32);
++
++	/* Start the SRP timer */
++	dwc_otg_pcd_start_srp_timer(core_if);
++	return;
++}
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_cil.h
+@@ -0,0 +1,1464 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_cil.h $
++ * $Revision: #123 $
++ * $Date: 2012/08/10 $
++ * $Change: 2047372 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++#if !defined(__DWC_CIL_H__)
++#define __DWC_CIL_H__
++
++#include "dwc_list.h"
++#include "dwc_otg_dbg.h"
++#include "dwc_otg_regs.h"
++
++#include "dwc_otg_core_if.h"
++#include "dwc_otg_adp.h"
++
++/**
++ * @file
++ * This file contains the interface to the Core Interface Layer.
++ */
++
++#ifdef DWC_UTE_CFI
++
++#define MAX_DMA_DESCS_PER_EP	256
++
++/**
++ * Enumeration for the data buffer mode
++ */
++typedef enum _data_buffer_mode {
++	BM_STANDARD = 0,	/* data buffer is in normal mode */
++	BM_SG = 1,		/* data buffer uses the scatter/gather mode */
++	BM_CONCAT = 2,		/* data buffer uses the concatenation mode */
++	BM_CIRCULAR = 3,	/* data buffer uses the circular DMA mode */
++	BM_ALIGN = 4		/* data buffer is in buffer alignment mode */
++} data_buffer_mode_e;
++#endif //DWC_UTE_CFI
++
++/** Macros defined for DWC OTG HW Release version */
++
++#define OTG_CORE_REV_2_60a	0x4F54260A
++#define OTG_CORE_REV_2_71a	0x4F54271A
++#define OTG_CORE_REV_2_72a	0x4F54272A
++#define OTG_CORE_REV_2_80a	0x4F54280A
++#define OTG_CORE_REV_2_81a	0x4F54281A
++#define OTG_CORE_REV_2_90a	0x4F54290A
++#define OTG_CORE_REV_2_91a	0x4F54291A
++#define OTG_CORE_REV_2_92a	0x4F54292A
++#define OTG_CORE_REV_2_93a	0x4F54293A
++#define OTG_CORE_REV_2_94a	0x4F54294A
++#define OTG_CORE_REV_3_00a	0x4F54300A
++
++/**
++ * Information for each ISOC packet.
++ */
++typedef struct iso_pkt_info {
++	uint32_t offset;
++	uint32_t length;
++	int32_t status;
++} iso_pkt_info_t;
++
++/**
++ * The <code>dwc_ep</code> structure represents the state of a single
++ * endpoint when acting in device mode. It contains the data items
++ * needed for an endpoint to be activated and transfer packets.
++ */
++typedef struct dwc_ep {
++	/** EP number used for register address lookup */
++	uint8_t num;
++	/** EP direction 0 = OUT */
++	unsigned is_in:1;
++	/** EP active. */
++	unsigned active:1;
++
++	/**
++	 * Periodic Tx FIFO # for IN EPs For INTR EP set to 0 to use non-periodic
++	 * Tx FIFO. If dedicated Tx FIFOs are enabled Tx FIFO # FOR IN EPs*/
++	unsigned tx_fifo_num:4;
++	/** EP type: 0 - Control, 1 - ISOC,	 2 - BULK,	3 - INTR */
++	unsigned type:2;
++#define DWC_OTG_EP_TYPE_CONTROL	   0
++#define DWC_OTG_EP_TYPE_ISOC	   1
++#define DWC_OTG_EP_TYPE_BULK	   2
++#define DWC_OTG_EP_TYPE_INTR	   3
++
++	/** DATA start PID for INTR and BULK EP */
++	unsigned data_pid_start:1;
++	/** Frame (even/odd) for ISOC EP */
++	unsigned even_odd_frame:1;
++	/** Max Packet bytes */
++	unsigned maxpacket:11;
++
++	/** Max Transfer size */
++	uint32_t maxxfer;
++
++	/** @name Transfer state */
++	/** @{ */
++
++	/**
++	 * Pointer to the beginning of the transfer buffer -- do not modify
++	 * during transfer.
++	 */
++
++	dwc_dma_t dma_addr;
++
++	dwc_dma_t dma_desc_addr;
++	dwc_otg_dev_dma_desc_t *desc_addr;
++
++	uint8_t *start_xfer_buff;
++	/** pointer to the transfer buffer */
++	uint8_t *xfer_buff;
++	/** Number of bytes to transfer */
++	unsigned xfer_len:19;
++	/** Number of bytes transferred. */
++	unsigned xfer_count:19;
++	/** Sent ZLP */
++	unsigned sent_zlp:1;
++	/** Total len for control transfer */
++	unsigned total_len:19;
++
++	/** stall clear flag */
++	unsigned stall_clear_flag:1;
++
++	/** SETUP pkt cnt rollover flag for EP0 out*/
++	unsigned stp_rollover;
++
++#ifdef DWC_UTE_CFI
++	/* The buffer mode */
++	data_buffer_mode_e buff_mode;
++
++	/* The chain of DMA descriptors.
++	 * MAX_DMA_DESCS_PER_EP will be allocated for each active EP.
++	 */
++	dwc_otg_dma_desc_t *descs;
++
++	/* The DMA address of the descriptors chain start */
++	dma_addr_t descs_dma_addr;
++	/** This variable stores the length of the last enqueued request */
++	uint32_t cfi_req_len;
++#endif				//DWC_UTE_CFI
++
++/** Max DMA Descriptor count for any EP */
++#define MAX_DMA_DESC_CNT 256
++	/** Allocated DMA Desc count */
++	uint32_t desc_cnt;
++
++	/** bInterval */
++	uint32_t bInterval;
++	/** Next frame num to setup next ISOC transfer */
++	uint32_t frame_num;
++	/** Indicates SOF number overrun in DSTS */
++	uint8_t frm_overrun;
++
++#ifdef DWC_UTE_PER_IO
++	/** Next frame num for which will be setup DMA Desc */
++	uint32_t xiso_frame_num;
++	/** bInterval */
++	uint32_t xiso_bInterval;
++	/** Count of currently active transfers - shall be either 0 or 1 */
++	int xiso_active_xfers;
++	int xiso_queued_xfers;
++#endif
++#ifdef DWC_EN_ISOC
++	/**
++	 * Variables specific for ISOC EPs
++	 *
++	 */
++	/** DMA addresses of ISOC buffers */
++	dwc_dma_t dma_addr0;
++	dwc_dma_t dma_addr1;
++
++	dwc_dma_t iso_dma_desc_addr;
++	dwc_otg_dev_dma_desc_t *iso_desc_addr;
++
++	/** pointer to the transfer buffers */
++	uint8_t *xfer_buff0;
++	uint8_t *xfer_buff1;
++
++	/** number of ISOC Buffer is processing */
++	uint32_t proc_buf_num;
++	/** Interval of ISOC Buffer processing */
++	uint32_t buf_proc_intrvl;
++	/** Data size for regular frame */
++	uint32_t data_per_frame;
++
++	/* todo - pattern data support is to be implemented in the future */
++	/** Data size for pattern frame */
++	uint32_t data_pattern_frame;
++	/** Frame number of pattern data */
++	uint32_t sync_frame;
++
++	/** bInterval */
++	uint32_t bInterval;
++	/** ISO Packet number per frame */
++	uint32_t pkt_per_frm;
++	/** Next frame num for which will be setup DMA Desc */
++	uint32_t next_frame;
++	/** Number of packets per buffer processing */
++	uint32_t pkt_cnt;
++	/** Info for all isoc packets */
++	iso_pkt_info_t *pkt_info;
++	/** current pkt number */
++	uint32_t cur_pkt;
++	/** current pkt number */
++	uint8_t *cur_pkt_addr;
++	/** current pkt number */
++	uint32_t cur_pkt_dma_addr;
++#endif				/* DWC_EN_ISOC */
++
++/** @} */
++} dwc_ep_t;
++
++/*
++ * Reasons for halting a host channel.
++ */
++typedef enum dwc_otg_halt_status {
++	DWC_OTG_HC_XFER_NO_HALT_STATUS,
++	DWC_OTG_HC_XFER_COMPLETE,
++	DWC_OTG_HC_XFER_URB_COMPLETE,
++	DWC_OTG_HC_XFER_ACK,
++	DWC_OTG_HC_XFER_NAK,
++	DWC_OTG_HC_XFER_NYET,
++	DWC_OTG_HC_XFER_STALL,
++	DWC_OTG_HC_XFER_XACT_ERR,
++	DWC_OTG_HC_XFER_FRAME_OVERRUN,
++	DWC_OTG_HC_XFER_BABBLE_ERR,
++	DWC_OTG_HC_XFER_DATA_TOGGLE_ERR,
++	DWC_OTG_HC_XFER_AHB_ERR,
++	DWC_OTG_HC_XFER_PERIODIC_INCOMPLETE,
++	DWC_OTG_HC_XFER_URB_DEQUEUE
++} dwc_otg_halt_status_e;
++
++/**
++ * Host channel descriptor. This structure represents the state of a single
++ * host channel when acting in host mode. It contains the data items needed to
++ * transfer packets to an endpoint via a host channel.
++ */
++typedef struct dwc_hc {
++	/** Host channel number used for register address lookup */
++	uint8_t hc_num;
++
++	/** Device to access */
++	unsigned dev_addr:7;
++
++	/** EP to access */
++	unsigned ep_num:4;
++
++	/** EP direction. 0: OUT, 1: IN */
++	unsigned ep_is_in:1;
++
++	/**
++	 * EP speed.
++	 * One of the following values:
++	 *	- DWC_OTG_EP_SPEED_LOW
++	 *	- DWC_OTG_EP_SPEED_FULL
++	 *	- DWC_OTG_EP_SPEED_HIGH
++	 */
++	unsigned speed:2;
++#define DWC_OTG_EP_SPEED_LOW	0
++#define DWC_OTG_EP_SPEED_FULL	1
++#define DWC_OTG_EP_SPEED_HIGH	2
++
++	/**
++	 * Endpoint type.
++	 * One of the following values:
++	 *	- DWC_OTG_EP_TYPE_CONTROL: 0
++	 *	- DWC_OTG_EP_TYPE_ISOC: 1
++	 *	- DWC_OTG_EP_TYPE_BULK: 2
++	 *	- DWC_OTG_EP_TYPE_INTR: 3
++	 */
++	unsigned ep_type:2;
++
++	/** Max packet size in bytes */
++	unsigned max_packet:11;
++
++	/**
++	 * PID for initial transaction.
++	 * 0: DATA0,<br>
++	 * 1: DATA2,<br>
++	 * 2: DATA1,<br>
++	 * 3: MDATA (non-Control EP),
++	 *	  SETUP (Control EP)
++	 */
++	unsigned data_pid_start:2;
++#define DWC_OTG_HC_PID_DATA0 0
++#define DWC_OTG_HC_PID_DATA2 1
++#define DWC_OTG_HC_PID_DATA1 2
++#define DWC_OTG_HC_PID_MDATA 3
++#define DWC_OTG_HC_PID_SETUP 3
++
++	/** Number of periodic transactions per (micro)frame */
++	unsigned multi_count:2;
++
++	/** @name Transfer State */
++	/** @{ */
++
++	/** Pointer to the current transfer buffer position. */
++	uint8_t *xfer_buff;
++	/**
++	 * In Buffer DMA mode this buffer will be used
++	 * if xfer_buff is not DWORD aligned.
++	 */
++	dwc_dma_t align_buff;
++	/** Total number of bytes to transfer. */
++	uint32_t xfer_len;
++	/** Number of bytes transferred so far. */
++	uint32_t xfer_count;
++	/** Packet count at start of transfer.*/
++	uint16_t start_pkt_count;
++
++	/**
++	 * Flag to indicate whether the transfer has been started. Set to 1 if
++	 * it has been started, 0 otherwise.
++	 */
++	uint8_t xfer_started;
++
++	/**
++	 * Set to 1 to indicate that a PING request should be issued on this
++	 * channel. If 0, process normally.
++	 */
++	uint8_t do_ping;
++
++	/**
++	 * Set to 1 to indicate that the error count for this transaction is
++	 * non-zero. Set to 0 if the error count is 0.
++	 */
++	uint8_t error_state;
++
++	/**
++	 * Set to 1 to indicate that this channel should be halted the next
++	 * time a request is queued for the channel. This is necessary in
++	 * slave mode if no request queue space is available when an attempt
++	 * is made to halt the channel.
++	 */
++	uint8_t halt_on_queue;
++
++	/**
++	 * Set to 1 if the host channel has been halted, but the core is not
++	 * finished flushing queued requests. Otherwise 0.
++	 */
++	uint8_t halt_pending;
++
++	/**
++	 * Reason for halting the host channel.
++	 */
++	dwc_otg_halt_status_e halt_status;
++
++	/*
++	 * Split settings for the host channel
++	 */
++	uint8_t do_split;		   /**< Enable split for the channel */
++	uint8_t complete_split;	   /**< Enable complete split */
++	uint8_t hub_addr;		   /**< Address of high speed hub */
++
++	uint8_t port_addr;		   /**< Port of the low/full speed device */
++	/** Split transaction position
++	 * One of the following values:
++	 *	  - DWC_HCSPLIT_XACTPOS_MID
++	 *	  - DWC_HCSPLIT_XACTPOS_BEGIN
++	 *	  - DWC_HCSPLIT_XACTPOS_END
++	 *	  - DWC_HCSPLIT_XACTPOS_ALL */
++	uint8_t xact_pos;
++
++	/** Set when the host channel does a short read. */
++	uint8_t short_read;
++
++	/**
++	 * Number of requests issued for this channel since it was assigned to
++	 * the current transfer (not counting PINGs).
++	 */
++	uint8_t requests;
++
++	/**
++	 * Queue Head for the transfer being processed by this channel.
++	 */
++	struct dwc_otg_qh *qh;
++
++	/** @} */
++
++	/** Entry in list of host channels. */
++	 DWC_CIRCLEQ_ENTRY(dwc_hc) hc_list_entry;
++
++	/** @name Descriptor DMA support */
++	/** @{ */
++
++	/** Number of Transfer Descriptors */
++	uint16_t ntd;
++
++	/** Descriptor List DMA address */
++	dwc_dma_t desc_list_addr;
++
++	/** Scheduling micro-frame bitmap. */
++	uint8_t schinfo;
++
++	/** @} */
++} dwc_hc_t;
++
++/**
++ * The following parameters may be specified when starting the module. These
++ * parameters define how the DWC_otg controller should be configured.
++ */
++typedef struct dwc_otg_core_params {
++	int32_t opt;
++
++	/**
++	 * Specifies the OTG capabilities. The driver will automatically
++	 * detect the value for this parameter if none is specified.
++	 * 0 - HNP and SRP capable (default)
++	 * 1 - SRP Only capable
++	 * 2 - No HNP/SRP capable
++	 */
++	int32_t otg_cap;
++
++	/**
++	 * Specifies whether to use slave or DMA mode for accessing the data
++	 * FIFOs. The driver will automatically detect the value for this
++	 * parameter if none is specified.
++	 * 0 - Slave
++	 * 1 - DMA (default, if available)
++	 */
++	int32_t dma_enable;
++
++	/**
++	 * When DMA mode is enabled specifies whether to use address DMA or DMA
++	 * Descriptor mode for accessing the data FIFOs in device mode. The driver
++	 * will automatically detect the value for this if none is specified.
++	 * 0 - address DMA
++	 * 1 - DMA Descriptor(default, if available)
++	 */
++	int32_t dma_desc_enable;
++	/** The DMA Burst size (applicable only for External DMA
++	 * Mode). 1, 4, 8 16, 32, 64, 128, 256 (default 32)
++	 */
++	int32_t dma_burst_size;	/* Translate this to GAHBCFG values */
++
++	/**
++	 * Specifies the maximum speed of operation in host and device mode.
++	 * The actual speed depends on the speed of the attached device and
++	 * the value of phy_type. The actual speed depends on the speed of the
++	 * attached device.
++	 * 0 - High Speed (default)
++	 * 1 - Full Speed
++	 */
++	int32_t speed;
++	/** Specifies whether low power mode is supported when attached
++	 *	to a Full Speed or Low Speed device in host mode.
++	 * 0 - Don't support low power mode (default)
++	 * 1 - Support low power mode
++	 */
++	int32_t host_support_fs_ls_low_power;
++
++	/** Specifies the PHY clock rate in low power mode when connected to a
++	 * Low Speed device in host mode. This parameter is applicable only if
++	 * HOST_SUPPORT_FS_LS_LOW_POWER is enabled. If PHY_TYPE is set to FS
++	 * then defaults to 6 MHZ otherwise 48 MHZ.
++	 *
++	 * 0 - 48 MHz
++	 * 1 - 6 MHz
++	 */
++	int32_t host_ls_low_power_phy_clk;
++
++	/**
++	 * 0 - Use cC FIFO size parameters
++	 * 1 - Allow dynamic FIFO sizing (default)
++	 */
++	int32_t enable_dynamic_fifo;
++
++	/** Total number of 4-byte words in the data FIFO memory. This
++	 * memory includes the Rx FIFO, non-periodic Tx FIFO, and periodic
++	 * Tx FIFOs.
++	 * 32 to 32768 (default 8192)
++	 * Note: The total FIFO memory depth in the FPGA configuration is 8192.
++	 */
++	int32_t data_fifo_size;
++
++	/** Number of 4-byte words in the Rx FIFO in device mode when dynamic
++	 * FIFO sizing is enabled.
++	 * 16 to 32768 (default 1064)
++	 */
++	int32_t dev_rx_fifo_size;
++
++	/** Number of 4-byte words in the non-periodic Tx FIFO in device mode
++	 * when dynamic FIFO sizing is enabled.
++	 * 16 to 32768 (default 1024)
++	 */
++	int32_t dev_nperio_tx_fifo_size;
++
++	/** Number of 4-byte words in each of the periodic Tx FIFOs in device
++	 * mode when dynamic FIFO sizing is enabled.
++	 * 4 to 768 (default 256)
++	 */
++	uint32_t dev_perio_tx_fifo_size[MAX_PERIO_FIFOS];
++
++	/** Number of 4-byte words in the Rx FIFO in host mode when dynamic
++	 * FIFO sizing is enabled.
++	 * 16 to 32768 (default 1024)
++	 */
++	int32_t host_rx_fifo_size;
++
++	/** Number of 4-byte words in the non-periodic Tx FIFO in host mode
++	 * when Dynamic FIFO sizing is enabled in the core.
++	 * 16 to 32768 (default 1024)
++	 */
++	int32_t host_nperio_tx_fifo_size;
++
++	/** Number of 4-byte words in the host periodic Tx FIFO when dynamic
++	 * FIFO sizing is enabled.
++	 * 16 to 32768 (default 1024)
++	 */
++	int32_t host_perio_tx_fifo_size;
++
++	/** The maximum transfer size supported in bytes.
++	 * 2047 to 65,535  (default 65,535)
++	 */
++	int32_t max_transfer_size;
++
++	/** The maximum number of packets in a transfer.
++	 * 15 to 511  (default 511)
++	 */
++	int32_t max_packet_count;
++
++	/** The number of host channel registers to use.
++	 * 1 to 16 (default 12)
++	 * Note: The FPGA configuration supports a maximum of 12 host channels.
++	 */
++	int32_t host_channels;
++
++	/** The number of endpoints in addition to EP0 available for device
++	 * mode operations.
++	 * 1 to 15 (default 6 IN and OUT)
++	 * Note: The FPGA configuration supports a maximum of 6 IN and OUT
++	 * endpoints in addition to EP0.
++	 */
++	int32_t dev_endpoints;
++
++		/**
++		 * Specifies the type of PHY interface to use. By default, the driver
++		 * will automatically detect the phy_type.
++		 *
++		 * 0 - Full Speed PHY
++		 * 1 - UTMI+ (default)
++		 * 2 - ULPI
++		 */
++	int32_t phy_type;
++
++	/**
++	 * Specifies the UTMI+ Data Width. This parameter is
++	 * applicable for a PHY_TYPE of UTMI+ or ULPI. (For a ULPI
++	 * PHY_TYPE, this parameter indicates the data width between
++	 * the MAC and the ULPI Wrapper.) Also, this parameter is
++	 * applicable only if the OTG_HSPHY_WIDTH cC parameter was set
++	 * to "8 and 16 bits", meaning that the core has been
++	 * configured to work at either data path width.
++	 *
++	 * 8 or 16 bits (default 16)
++	 */
++	int32_t phy_utmi_width;
++
++	/**
++	 * Specifies whether the ULPI operates at double or single
++	 * data rate. This parameter is only applicable if PHY_TYPE is
++	 * ULPI.
++	 *
++	 * 0 - single data rate ULPI interface with 8 bit wide data
++	 * bus (default)
++	 * 1 - double data rate ULPI interface with 4 bit wide data
++	 * bus
++	 */
++	int32_t phy_ulpi_ddr;
++
++	/**
++	 * Specifies whether to use the internal or external supply to
++	 * drive the vbus with a ULPI phy.
++	 */
++	int32_t phy_ulpi_ext_vbus;
++
++	/**
++	 * Specifies whether to use the I2Cinterface for full speed PHY. This
++	 * parameter is only applicable if PHY_TYPE is FS.
++	 * 0 - No (default)
++	 * 1 - Yes
++	 */
++	int32_t i2c_enable;
++
++	int32_t ulpi_fs_ls;
++
++	int32_t ts_dline;
++
++	/**
++	 * Specifies whether dedicated transmit FIFOs are
++	 * enabled for non periodic IN endpoints in device mode
++	 * 0 - No
++	 * 1 - Yes
++	 */
++	int32_t en_multiple_tx_fifo;
++
++	/** Number of 4-byte words in each of the Tx FIFOs in device
++	 * mode when dynamic FIFO sizing is enabled.
++	 * 4 to 768 (default 256)
++	 */
++	uint32_t dev_tx_fifo_size[MAX_TX_FIFOS];
++
++	/** Thresholding enable flag-
++	 * bit 0 - enable non-ISO Tx thresholding
++	 * bit 1 - enable ISO Tx thresholding
++	 * bit 2 - enable Rx thresholding
++	 */
++	uint32_t thr_ctl;
++
++	/** Thresholding length for Tx
++	 *	FIFOs in 32 bit DWORDs
++	 */
++	uint32_t tx_thr_length;
++
++	/** Thresholding length for Rx
++	 *	FIFOs in 32 bit DWORDs
++	 */
++	uint32_t rx_thr_length;
++
++	/**
++	 * Specifies whether LPM (Link Power Management) support is enabled
++	 */
++	int32_t lpm_enable;
++
++	/** Per Transfer Interrupt
++	 *	mode enable flag
++	 * 1 - Enabled
++	 * 0 - Disabled
++	 */
++	int32_t pti_enable;
++
++	/** Multi Processor Interrupt
++	 *	mode enable flag
++	 * 1 - Enabled
++	 * 0 - Disabled
++	 */
++	int32_t mpi_enable;
++
++	/** IS_USB Capability
++	 * 1 - Enabled
++	 * 0 - Disabled
++	 */
++	int32_t ic_usb_cap;
++
++	/** AHB Threshold Ratio
++	 * 2'b00 AHB Threshold = 	MAC Threshold
++	 * 2'b01 AHB Threshold = 1/2 	MAC Threshold
++	 * 2'b10 AHB Threshold = 1/4	MAC Threshold
++	 * 2'b11 AHB Threshold = 1/8	MAC Threshold
++	 */
++	int32_t ahb_thr_ratio;
++
++	/** ADP Support
++	 * 1 - Enabled
++	 * 0 - Disabled
++	 */
++	int32_t adp_supp_enable;
++
++	/** HFIR Reload Control
++	 * 0 - The HFIR cannot be reloaded dynamically.
++	 * 1 - Allow dynamic reloading of the HFIR register during runtime.
++	 */
++	int32_t reload_ctl;
++
++	/** DCFG: Enable device Out NAK
++	 * 0 - The core does not set NAK after Bulk Out transfer complete.
++	 * 1 - The core sets NAK after Bulk OUT transfer complete.
++	 */
++	int32_t dev_out_nak;
++
++	/** DCFG: Enable Continue on BNA
++	 * After receiving BNA interrupt the core disables the endpoint,when the
++	 * endpoint is re-enabled by the application the core starts processing
++	 * 0 - from the DOEPDMA descriptor
++	 * 1 - from the descriptor which received the BNA.
++	 */
++	int32_t cont_on_bna;
++
++	/** GAHBCFG: AHB Single Support
++	 * This bit when programmed supports SINGLE transfers for remainder
++	 * data in a transfer for DMA mode of operation.
++	 * 0 - in this case the remainder data will be sent using INCR burst size.
++	 * 1 - in this case the remainder data will be sent using SINGLE burst size.
++	 */
++	int32_t ahb_single;
++
++	/** Core Power down mode
++	 * 0 - No Power Down is enabled
++	 * 1 - Reserved
++	 * 2 - Complete Power Down (Hibernation)
++	 */
++	int32_t power_down;
++
++	/** OTG revision supported
++	 * 0 - OTG 1.3 revision
++	 * 1 - OTG 2.0 revision
++	 */
++	int32_t otg_ver;
++
++} dwc_otg_core_params_t;
++
++#ifdef DEBUG
++struct dwc_otg_core_if;
++typedef struct hc_xfer_info {
++	struct dwc_otg_core_if *core_if;
++	dwc_hc_t *hc;
++} hc_xfer_info_t;
++#endif
++
++typedef struct ep_xfer_info {
++	struct dwc_otg_core_if *core_if;
++	dwc_ep_t *ep;
++	uint8_t state;
++} ep_xfer_info_t;
++/*
++ * Device States
++ */
++typedef enum dwc_otg_lx_state {
++	/** On state */
++	DWC_OTG_L0,
++	/** LPM sleep state*/
++	DWC_OTG_L1,
++	/** USB suspend state*/
++	DWC_OTG_L2,
++	/** Off state*/
++	DWC_OTG_L3
++} dwc_otg_lx_state_e;
++
++struct dwc_otg_global_regs_backup {
++	uint32_t gotgctl_local;
++	uint32_t gintmsk_local;
++	uint32_t gahbcfg_local;
++	uint32_t gusbcfg_local;
++	uint32_t grxfsiz_local;
++	uint32_t gnptxfsiz_local;
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	uint32_t glpmcfg_local;
++#endif
++	uint32_t gi2cctl_local;
++	uint32_t hptxfsiz_local;
++	uint32_t pcgcctl_local;
++	uint32_t gdfifocfg_local;
++	uint32_t dtxfsiz_local[MAX_EPS_CHANNELS];
++	uint32_t gpwrdn_local;
++	uint32_t xhib_pcgcctl;
++	uint32_t xhib_gpwrdn;
++};
++
++struct dwc_otg_host_regs_backup {
++	uint32_t hcfg_local;
++	uint32_t haintmsk_local;
++	uint32_t hcintmsk_local[MAX_EPS_CHANNELS];
++	uint32_t hprt0_local;
++	uint32_t hfir_local;
++};
++
++struct dwc_otg_dev_regs_backup {
++	uint32_t dcfg;
++	uint32_t dctl;
++	uint32_t daintmsk;
++	uint32_t diepmsk;
++	uint32_t doepmsk;
++	uint32_t diepctl[MAX_EPS_CHANNELS];
++	uint32_t dieptsiz[MAX_EPS_CHANNELS];
++	uint32_t diepdma[MAX_EPS_CHANNELS];
++};
++/**
++ * The <code>dwc_otg_core_if</code> structure contains information needed to manage
++ * the DWC_otg controller acting in either host or device mode. It
++ * represents the programming view of the controller as a whole.
++ */
++struct dwc_otg_core_if {
++	/** Parameters that define how the core should be configured.*/
++	dwc_otg_core_params_t *core_params;
++
++	/** Core Global registers starting at offset 000h. */
++	dwc_otg_core_global_regs_t *core_global_regs;
++
++	/** Device-specific information */
++	dwc_otg_dev_if_t *dev_if;
++	/** Host-specific information */
++	dwc_otg_host_if_t *host_if;
++
++	/** Value from SNPSID register */
++	uint32_t snpsid;
++
++	/*
++	 * Set to 1 if the core PHY interface bits in USBCFG have been
++	 * initialized.
++	 */
++	uint8_t phy_init_done;
++
++	/*
++	 * SRP Success flag, set by srp success interrupt in FS I2C mode
++	 */
++	uint8_t srp_success;
++	uint8_t srp_timer_started;
++	/** Timer for SRP. If it expires before SRP is successful
++	 * clear the SRP. */
++	dwc_timer_t *srp_timer;
++
++#ifdef DWC_DEV_SRPCAP
++	/* This timer is needed to power on the hibernated host core if SRP is not
++	 * initiated on connected SRP capable device for limited period of time
++	 */
++	uint8_t pwron_timer_started;
++	dwc_timer_t *pwron_timer;
++#endif
++	/* Common configuration information */
++	/** Power and Clock Gating Control Register */
++	volatile uint32_t *pcgcctl;
++#define DWC_OTG_PCGCCTL_OFFSET 0xE00
++
++	/** Push/pop addresses for endpoints or host channels.*/
++	uint32_t *data_fifo[MAX_EPS_CHANNELS];
++#define DWC_OTG_DATA_FIFO_OFFSET 0x1000
++#define DWC_OTG_DATA_FIFO_SIZE 0x1000
++
++	/** Total RAM for FIFOs (Bytes) */
++	uint16_t total_fifo_size;
++	/** Size of Rx FIFO (Bytes) */
++	uint16_t rx_fifo_size;
++	/** Size of Non-periodic Tx FIFO (Bytes) */
++	uint16_t nperio_tx_fifo_size;
++
++	/** 1 if DMA is enabled, 0 otherwise. */
++	uint8_t dma_enable;
++
++	/** 1 if DMA descriptor is enabled, 0 otherwise. */
++	uint8_t dma_desc_enable;
++
++	/** 1 if PTI Enhancement mode is enabled, 0 otherwise. */
++	uint8_t pti_enh_enable;
++
++	/** 1 if MPI Enhancement mode is enabled, 0 otherwise. */
++	uint8_t multiproc_int_enable;
++
++	/** 1 if dedicated Tx FIFOs are enabled, 0 otherwise. */
++	uint8_t en_multiple_tx_fifo;
++
++	/** Set to 1 if multiple packets of a high-bandwidth transfer is in
++	 * process of being queued */
++	uint8_t queuing_high_bandwidth;
++
++	/** Hardware Configuration -- stored here for convenience.*/
++	hwcfg1_data_t hwcfg1;
++	hwcfg2_data_t hwcfg2;
++	hwcfg3_data_t hwcfg3;
++	hwcfg4_data_t hwcfg4;
++	fifosize_data_t hptxfsiz;
++
++	/** Host and Device Configuration -- stored here for convenience.*/
++	hcfg_data_t hcfg;
++	dcfg_data_t dcfg;
++
++	/** The operational State, during transations
++	 * (a_host>>a_peripherial and b_device=>b_host) this may not
++	 * match the core but allows the software to determine
++	 * transitions.
++	 */
++	uint8_t op_state;
++
++	/**
++	 * Set to 1 if the HCD needs to be restarted on a session request
++	 * interrupt. This is required if no connector ID status change has
++	 * occurred since the HCD was last disconnected.
++	 */
++	uint8_t restart_hcd_on_session_req;
++
++	/** HCD callbacks */
++	/** A-Device is a_host */
++#define A_HOST		(1)
++	/** A-Device is a_suspend */
++#define A_SUSPEND	(2)
++	/** A-Device is a_peripherial */
++#define A_PERIPHERAL	(3)
++	/** B-Device is operating as a Peripheral. */
++#define B_PERIPHERAL	(4)
++	/** B-Device is operating as a Host. */
++#define B_HOST		(5)
++
++	/** HCD callbacks */
++	struct dwc_otg_cil_callbacks *hcd_cb;
++	/** PCD callbacks */
++	struct dwc_otg_cil_callbacks *pcd_cb;
++
++	/** Device mode Periodic Tx FIFO Mask */
++	uint32_t p_tx_msk;
++	/** Device mode Periodic Tx FIFO Mask */
++	uint32_t tx_msk;
++
++	/** Workqueue object used for handling several interrupts */
++	dwc_workq_t *wq_otg;
++
++	/** Timer object used for handling "Wakeup Detected" Interrupt */
++	dwc_timer_t *wkp_timer;
++	/** This arrays used for debug purposes for DEV OUT NAK enhancement */
++	uint32_t start_doeptsiz_val[MAX_EPS_CHANNELS];
++	ep_xfer_info_t ep_xfer_info[MAX_EPS_CHANNELS];
++	dwc_timer_t *ep_xfer_timer[MAX_EPS_CHANNELS];
++#ifdef DEBUG
++	uint32_t start_hcchar_val[MAX_EPS_CHANNELS];
++
++	hc_xfer_info_t hc_xfer_info[MAX_EPS_CHANNELS];
++	dwc_timer_t *hc_xfer_timer[MAX_EPS_CHANNELS];
++
++	uint32_t hfnum_7_samples;
++	uint64_t hfnum_7_frrem_accum;
++	uint32_t hfnum_0_samples;
++	uint64_t hfnum_0_frrem_accum;
++	uint32_t hfnum_other_samples;
++	uint64_t hfnum_other_frrem_accum;
++#endif
++
++#ifdef DWC_UTE_CFI
++	uint16_t pwron_rxfsiz;
++	uint16_t pwron_gnptxfsiz;
++	uint16_t pwron_txfsiz[15];
++
++	uint16_t init_rxfsiz;
++	uint16_t init_gnptxfsiz;
++	uint16_t init_txfsiz[15];
++#endif
++
++	/** Lx state of device */
++	dwc_otg_lx_state_e lx_state;
++
++	/** Saved Core Global registers */
++	struct dwc_otg_global_regs_backup *gr_backup;
++	/** Saved Host registers */
++	struct dwc_otg_host_regs_backup *hr_backup;
++	/** Saved Device registers */
++	struct dwc_otg_dev_regs_backup *dr_backup;
++
++	/** Power Down Enable */
++	uint32_t power_down;
++
++	/** ADP support Enable */
++	uint32_t adp_enable;
++
++	/** ADP structure object */
++	dwc_otg_adp_t adp;
++
++	/** hibernation/suspend flag */
++	int hibernation_suspend;
++
++	/** Device mode extended hibernation flag */
++	int xhib;
++
++	/** OTG revision supported */
++	uint32_t otg_ver;
++
++	/** OTG status flag used for HNP polling */
++	uint8_t otg_sts;
++
++	/** Pointer to either hcd->lock or pcd->lock */
++	dwc_spinlock_t *lock;
++
++	/** Start predict NextEP based on Learning Queue if equal 1,
++	 * also used as counter of disabled NP IN EP's */
++	uint8_t start_predict;
++
++	/** NextEp sequence, including EP0: nextep_seq[] = EP if non-periodic and
++	 * active, 0xff otherwise */
++	uint8_t nextep_seq[MAX_EPS_CHANNELS];
++
++	/** Index of fisrt EP in nextep_seq array which should be re-enabled **/
++	uint8_t first_in_nextep_seq;
++
++	/** Frame number while entering to ISR - needed for ISOCs **/
++	uint32_t frame_num;
++
++};
++
++#ifdef DEBUG
++/*
++ * This function is called when transfer is timed out.
++ */
++extern void hc_xfer_timeout(void *ptr);
++#endif
++
++/*
++ * This function is called when transfer is timed out on endpoint.
++ */
++extern void ep_xfer_timeout(void *ptr);
++
++/*
++ * The following functions are functions for works
++ * using during handling some interrupts
++ */
++extern void w_conn_id_status_change(void *p);
++
++extern void w_wakeup_detected(void *p);
++
++/** Saves global register values into system memory. */
++extern int dwc_otg_save_global_regs(dwc_otg_core_if_t * core_if);
++/** Saves device register values into system memory. */
++extern int dwc_otg_save_dev_regs(dwc_otg_core_if_t * core_if);
++/** Saves host register values into system memory. */
++extern int dwc_otg_save_host_regs(dwc_otg_core_if_t * core_if);
++/** Restore global register values. */
++extern int dwc_otg_restore_global_regs(dwc_otg_core_if_t * core_if);
++/** Restore host register values. */
++extern int dwc_otg_restore_host_regs(dwc_otg_core_if_t * core_if, int reset);
++/** Restore device register values. */
++extern int dwc_otg_restore_dev_regs(dwc_otg_core_if_t * core_if,
++				    int rem_wakeup);
++extern int restore_lpm_i2c_regs(dwc_otg_core_if_t * core_if);
++extern int restore_essential_regs(dwc_otg_core_if_t * core_if, int rmode,
++				  int is_host);
++
++extern int dwc_otg_host_hibernation_restore(dwc_otg_core_if_t * core_if,
++					    int restore_mode, int reset);
++extern int dwc_otg_device_hibernation_restore(dwc_otg_core_if_t * core_if,
++					      int rem_wakeup, int reset);
++
++/*
++ * The following functions support initialization of the CIL driver component
++ * and the DWC_otg controller.
++ */
++extern void dwc_otg_core_host_init(dwc_otg_core_if_t * _core_if);
++extern void dwc_otg_core_dev_init(dwc_otg_core_if_t * _core_if);
++
++/** @name Device CIL Functions
++ * The following functions support managing the DWC_otg controller in device
++ * mode.
++ */
++/**@{*/
++extern void dwc_otg_wakeup(dwc_otg_core_if_t * _core_if);
++extern void dwc_otg_read_setup_packet(dwc_otg_core_if_t * _core_if,
++				      uint32_t * _dest);
++extern uint32_t dwc_otg_get_frame_number(dwc_otg_core_if_t * _core_if);
++extern void dwc_otg_ep0_activate(dwc_otg_core_if_t * _core_if, dwc_ep_t * _ep);
++extern void dwc_otg_ep_activate(dwc_otg_core_if_t * _core_if, dwc_ep_t * _ep);
++extern void dwc_otg_ep_deactivate(dwc_otg_core_if_t * _core_if, dwc_ep_t * _ep);
++extern void dwc_otg_ep_start_transfer(dwc_otg_core_if_t * _core_if,
++				      dwc_ep_t * _ep);
++extern void dwc_otg_ep_start_zl_transfer(dwc_otg_core_if_t * _core_if,
++					 dwc_ep_t * _ep);
++extern void dwc_otg_ep0_start_transfer(dwc_otg_core_if_t * _core_if,
++				       dwc_ep_t * _ep);
++extern void dwc_otg_ep0_continue_transfer(dwc_otg_core_if_t * _core_if,
++					  dwc_ep_t * _ep);
++extern void dwc_otg_ep_write_packet(dwc_otg_core_if_t * _core_if,
++				    dwc_ep_t * _ep, int _dma);
++extern void dwc_otg_ep_set_stall(dwc_otg_core_if_t * _core_if, dwc_ep_t * _ep);
++extern void dwc_otg_ep_clear_stall(dwc_otg_core_if_t * _core_if,
++				   dwc_ep_t * _ep);
++extern void dwc_otg_enable_device_interrupts(dwc_otg_core_if_t * _core_if);
++
++#ifdef DWC_EN_ISOC
++extern void dwc_otg_iso_ep_start_frm_transfer(dwc_otg_core_if_t * core_if,
++					      dwc_ep_t * ep);
++extern void dwc_otg_iso_ep_start_buf_transfer(dwc_otg_core_if_t * core_if,
++					      dwc_ep_t * ep);
++#endif /* DWC_EN_ISOC */
++/**@}*/
++
++/** @name Host CIL Functions
++ * The following functions support managing the DWC_otg controller in host
++ * mode.
++ */
++/**@{*/
++extern void dwc_otg_hc_init(dwc_otg_core_if_t * _core_if, dwc_hc_t * _hc);
++extern void dwc_otg_hc_halt(dwc_otg_core_if_t * _core_if,
++			    dwc_hc_t * _hc, dwc_otg_halt_status_e _halt_status);
++extern void dwc_otg_hc_cleanup(dwc_otg_core_if_t * _core_if, dwc_hc_t * _hc);
++extern void dwc_otg_hc_start_transfer(dwc_otg_core_if_t * _core_if,
++				      dwc_hc_t * _hc);
++extern int dwc_otg_hc_continue_transfer(dwc_otg_core_if_t * _core_if,
++					dwc_hc_t * _hc);
++extern void dwc_otg_hc_do_ping(dwc_otg_core_if_t * _core_if, dwc_hc_t * _hc);
++extern void dwc_otg_hc_write_packet(dwc_otg_core_if_t * _core_if,
++				    dwc_hc_t * _hc);
++extern void dwc_otg_enable_host_interrupts(dwc_otg_core_if_t * _core_if);
++extern void dwc_otg_disable_host_interrupts(dwc_otg_core_if_t * _core_if);
++
++extern void dwc_otg_hc_start_transfer_ddma(dwc_otg_core_if_t * core_if,
++					   dwc_hc_t * hc);
++
++extern uint32_t calc_frame_interval(dwc_otg_core_if_t * core_if);
++
++/* Macro used to clear one channel interrupt */
++#define clear_hc_int(_hc_regs_, _intr_) \
++do { \
++	hcint_data_t hcint_clear = {.d32 = 0}; \
++	hcint_clear.b._intr_ = 1; \
++	DWC_WRITE_REG32(&(_hc_regs_)->hcint, hcint_clear.d32); \
++} while (0)
++
++/*
++ * Macro used to disable one channel interrupt. Channel interrupts are
++ * disabled when the channel is halted or released by the interrupt handler.
++ * There is no need to handle further interrupts of that type until the
++ * channel is re-assigned. In fact, subsequent handling may cause crashes
++ * because the channel structures are cleaned up when the channel is released.
++ */
++#define disable_hc_int(_hc_regs_, _intr_) \
++do { \
++	hcintmsk_data_t hcintmsk = {.d32 = 0}; \
++	hcintmsk.b._intr_ = 1; \
++	DWC_MODIFY_REG32(&(_hc_regs_)->hcintmsk, hcintmsk.d32, 0); \
++} while (0)
++
++/**
++ * This function Reads HPRT0 in preparation to modify. It keeps the
++ * WC bits 0 so that if they are read as 1, they won't clear when you
++ * write it back
++ */
++static inline uint32_t dwc_otg_read_hprt0(dwc_otg_core_if_t * _core_if)
++{
++	hprt0_data_t hprt0;
++	hprt0.d32 = DWC_READ_REG32(_core_if->host_if->hprt0);
++	hprt0.b.prtena = 0;
++	hprt0.b.prtconndet = 0;
++	hprt0.b.prtenchng = 0;
++	hprt0.b.prtovrcurrchng = 0;
++	return hprt0.d32;
++}
++
++/**@}*/
++
++/** @name Common CIL Functions
++ * The following functions support managing the DWC_otg controller in either
++ * device or host mode.
++ */
++/**@{*/
++
++extern void dwc_otg_read_packet(dwc_otg_core_if_t * core_if,
++				uint8_t * dest, uint16_t bytes);
++
++extern void dwc_otg_flush_tx_fifo(dwc_otg_core_if_t * _core_if, const int _num);
++extern void dwc_otg_flush_rx_fifo(dwc_otg_core_if_t * _core_if);
++extern void dwc_otg_core_reset(dwc_otg_core_if_t * _core_if);
++
++/**
++ * This function returns the Core Interrupt register.
++ */
++static inline uint32_t dwc_otg_read_core_intr(dwc_otg_core_if_t * core_if)
++{
++	return (DWC_READ_REG32(&core_if->core_global_regs->gintsts) &
++		DWC_READ_REG32(&core_if->core_global_regs->gintmsk));
++}
++
++/**
++ * This function returns the OTG Interrupt register.
++ */
++static inline uint32_t dwc_otg_read_otg_intr(dwc_otg_core_if_t * core_if)
++{
++	return (DWC_READ_REG32(&core_if->core_global_regs->gotgint));
++}
++
++/**
++ * This function reads the Device All Endpoints Interrupt register and
++ * returns the IN endpoint interrupt bits.
++ */
++static inline uint32_t dwc_otg_read_dev_all_in_ep_intr(dwc_otg_core_if_t *
++						       core_if)
++{
++
++	uint32_t v;
++
++	if (core_if->multiproc_int_enable) {
++		v = DWC_READ_REG32(&core_if->dev_if->
++				   dev_global_regs->deachint) &
++		    DWC_READ_REG32(&core_if->
++				   dev_if->dev_global_regs->deachintmsk);
++	} else {
++		v = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->daint) &
++		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->daintmsk);
++	}
++	return (v & 0xffff);
++}
++
++/**
++ * This function reads the Device All Endpoints Interrupt register and
++ * returns the OUT endpoint interrupt bits.
++ */
++static inline uint32_t dwc_otg_read_dev_all_out_ep_intr(dwc_otg_core_if_t *
++							core_if)
++{
++	uint32_t v;
++
++	if (core_if->multiproc_int_enable) {
++		v = DWC_READ_REG32(&core_if->dev_if->
++				   dev_global_regs->deachint) &
++		    DWC_READ_REG32(&core_if->
++				   dev_if->dev_global_regs->deachintmsk);
++	} else {
++		v = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->daint) &
++		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->daintmsk);
++	}
++
++	return ((v & 0xffff0000) >> 16);
++}
++
++/**
++ * This function returns the Device IN EP Interrupt register
++ */
++static inline uint32_t dwc_otg_read_dev_in_ep_intr(dwc_otg_core_if_t * core_if,
++						   dwc_ep_t * ep)
++{
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	uint32_t v, msk, emp;
++
++	if (core_if->multiproc_int_enable) {
++		msk =
++		    DWC_READ_REG32(&dev_if->
++				   dev_global_regs->diepeachintmsk[ep->num]);
++		emp =
++		    DWC_READ_REG32(&dev_if->
++				   dev_global_regs->dtknqr4_fifoemptymsk);
++		msk |= ((emp >> ep->num) & 0x1) << 7;
++		v = DWC_READ_REG32(&dev_if->in_ep_regs[ep->num]->diepint) & msk;
++	} else {
++		msk = DWC_READ_REG32(&dev_if->dev_global_regs->diepmsk);
++		emp =
++		    DWC_READ_REG32(&dev_if->
++				   dev_global_regs->dtknqr4_fifoemptymsk);
++		msk |= ((emp >> ep->num) & 0x1) << 7;
++		v = DWC_READ_REG32(&dev_if->in_ep_regs[ep->num]->diepint) & msk;
++	}
++
++	return v;
++}
++
++/**
++ * This function returns the Device OUT EP Interrupt register
++ */
++static inline uint32_t dwc_otg_read_dev_out_ep_intr(dwc_otg_core_if_t *
++						    _core_if, dwc_ep_t * _ep)
++{
++	dwc_otg_dev_if_t *dev_if = _core_if->dev_if;
++	uint32_t v;
++	doepmsk_data_t msk = {.d32 = 0 };
++
++	if (_core_if->multiproc_int_enable) {
++		msk.d32 =
++		    DWC_READ_REG32(&dev_if->
++				   dev_global_regs->doepeachintmsk[_ep->num]);
++		if (_core_if->pti_enh_enable) {
++			msk.b.pktdrpsts = 1;
++		}
++		v = DWC_READ_REG32(&dev_if->
++				   out_ep_regs[_ep->num]->doepint) & msk.d32;
++	} else {
++		msk.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->doepmsk);
++		if (_core_if->pti_enh_enable) {
++			msk.b.pktdrpsts = 1;
++		}
++		v = DWC_READ_REG32(&dev_if->
++				   out_ep_regs[_ep->num]->doepint) & msk.d32;
++	}
++	return v;
++}
++
++/**
++ * This function returns the Host All Channel Interrupt register
++ */
++static inline uint32_t dwc_otg_read_host_all_channels_intr(dwc_otg_core_if_t *
++							   _core_if)
++{
++	return (DWC_READ_REG32(&_core_if->host_if->host_global_regs->haint));
++}
++
++static inline uint32_t dwc_otg_read_host_channel_intr(dwc_otg_core_if_t *
++						      _core_if, dwc_hc_t * _hc)
++{
++	return (DWC_READ_REG32
++		(&_core_if->host_if->hc_regs[_hc->hc_num]->hcint));
++}
++
++/**
++ * This function returns the mode of the operation, host or device.
++ *
++ * @return 0 - Device Mode, 1 - Host Mode
++ */
++static inline uint32_t dwc_otg_mode(dwc_otg_core_if_t * _core_if)
++{
++	return (DWC_READ_REG32(&_core_if->core_global_regs->gintsts) & 0x1);
++}
++
++/**@}*/
++
++/**
++ * DWC_otg CIL callback structure. This structure allows the HCD and
++ * PCD to register functions used for starting and stopping the PCD
++ * and HCD for role change on for a DRD.
++ */
++typedef struct dwc_otg_cil_callbacks {
++	/** Start function for role change */
++	int (*start) (void *_p);
++	/** Stop Function for role change */
++	int (*stop) (void *_p);
++	/** Disconnect Function for role change */
++	int (*disconnect) (void *_p);
++	/** Resume/Remote wakeup Function */
++	int (*resume_wakeup) (void *_p);
++	/** Suspend function */
++	int (*suspend) (void *_p);
++	/** Session Start (SRP) */
++	int (*session_start) (void *_p);
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	/** Sleep (switch to L0 state) */
++	int (*sleep) (void *_p);
++#endif
++	/** Pointer passed to start() and stop() */
++	void *p;
++} dwc_otg_cil_callbacks_t;
++
++extern void dwc_otg_cil_register_pcd_callbacks(dwc_otg_core_if_t * _core_if,
++					       dwc_otg_cil_callbacks_t * _cb,
++					       void *_p);
++extern void dwc_otg_cil_register_hcd_callbacks(dwc_otg_core_if_t * _core_if,
++					       dwc_otg_cil_callbacks_t * _cb,
++					       void *_p);
++
++void dwc_otg_initiate_srp(dwc_otg_core_if_t * core_if);
++
++//////////////////////////////////////////////////////////////////////
++/** Start the HCD.  Helper function for using the HCD callbacks.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static inline void cil_hcd_start(dwc_otg_core_if_t * core_if)
++{
++	if (core_if->hcd_cb && core_if->hcd_cb->start) {
++		core_if->hcd_cb->start(core_if->hcd_cb->p);
++	}
++}
++
++/** Stop the HCD.  Helper function for using the HCD callbacks.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static inline void cil_hcd_stop(dwc_otg_core_if_t * core_if)
++{
++	if (core_if->hcd_cb && core_if->hcd_cb->stop) {
++		core_if->hcd_cb->stop(core_if->hcd_cb->p);
++	}
++}
++
++/** Disconnect the HCD.  Helper function for using the HCD callbacks.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static inline void cil_hcd_disconnect(dwc_otg_core_if_t * core_if)
++{
++	if (core_if->hcd_cb && core_if->hcd_cb->disconnect) {
++		core_if->hcd_cb->disconnect(core_if->hcd_cb->p);
++	}
++}
++
++/** Inform the HCD the a New Session has begun.  Helper function for
++ * using the HCD callbacks.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static inline void cil_hcd_session_start(dwc_otg_core_if_t * core_if)
++{
++	if (core_if->hcd_cb && core_if->hcd_cb->session_start) {
++		core_if->hcd_cb->session_start(core_if->hcd_cb->p);
++	}
++}
++
++#ifdef CONFIG_USB_DWC_OTG_LPM
++/**
++ * Inform the HCD about LPM sleep.
++ * Helper function for using the HCD callbacks.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static inline void cil_hcd_sleep(dwc_otg_core_if_t * core_if)
++{
++	if (core_if->hcd_cb && core_if->hcd_cb->sleep) {
++		core_if->hcd_cb->sleep(core_if->hcd_cb->p);
++	}
++}
++#endif
++
++/** Resume the HCD.  Helper function for using the HCD callbacks.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static inline void cil_hcd_resume(dwc_otg_core_if_t * core_if)
++{
++	if (core_if->hcd_cb && core_if->hcd_cb->resume_wakeup) {
++		core_if->hcd_cb->resume_wakeup(core_if->hcd_cb->p);
++	}
++}
++
++/** Start the PCD.  Helper function for using the PCD callbacks.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static inline void cil_pcd_start(dwc_otg_core_if_t * core_if)
++{
++	if (core_if->pcd_cb && core_if->pcd_cb->start) {
++		core_if->pcd_cb->start(core_if->pcd_cb->p);
++	}
++}
++
++/** Stop the PCD.  Helper function for using the PCD callbacks.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static inline void cil_pcd_stop(dwc_otg_core_if_t * core_if)
++{
++	if (core_if->pcd_cb && core_if->pcd_cb->stop) {
++		core_if->pcd_cb->stop(core_if->pcd_cb->p);
++	}
++}
++
++/** Suspend the PCD.  Helper function for using the PCD callbacks.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static inline void cil_pcd_suspend(dwc_otg_core_if_t * core_if)
++{
++	if (core_if->pcd_cb && core_if->pcd_cb->suspend) {
++		core_if->pcd_cb->suspend(core_if->pcd_cb->p);
++	}
++}
++
++/** Resume the PCD.  Helper function for using the PCD callbacks.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static inline void cil_pcd_resume(dwc_otg_core_if_t * core_if)
++{
++	if (core_if->pcd_cb && core_if->pcd_cb->resume_wakeup) {
++		core_if->pcd_cb->resume_wakeup(core_if->pcd_cb->p);
++	}
++}
++
++//////////////////////////////////////////////////////////////////////
++
++#endif
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c
+@@ -0,0 +1,1601 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_cil_intr.c $
++ * $Revision: #32 $
++ * $Date: 2012/08/10 $
++ * $Change: 2047372 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++/** @file
++ *
++ * The Core Interface Layer provides basic services for accessing and
++ * managing the DWC_otg hardware. These services are used by both the
++ * Host Controller Driver and the Peripheral Controller Driver.
++ *
++ * This file contains the Common Interrupt handlers.
++ */
++#include "dwc_os.h"
++#include "dwc_otg_regs.h"
++#include "dwc_otg_cil.h"
++#include "dwc_otg_driver.h"
++#include "dwc_otg_pcd.h"
++#include "dwc_otg_hcd.h"
++
++#ifdef DEBUG
++inline const char *op_state_str(dwc_otg_core_if_t * core_if)
++{
++	return (core_if->op_state == A_HOST ? "a_host" :
++		(core_if->op_state == A_SUSPEND ? "a_suspend" :
++		 (core_if->op_state == A_PERIPHERAL ? "a_peripheral" :
++		  (core_if->op_state == B_PERIPHERAL ? "b_peripheral" :
++		   (core_if->op_state == B_HOST ? "b_host" : "unknown")))));
++}
++#endif
++
++/** This function will log a debug message
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++int32_t dwc_otg_handle_mode_mismatch_intr(dwc_otg_core_if_t * core_if)
++{
++	gintsts_data_t gintsts;
++	DWC_WARN("Mode Mismatch Interrupt: currently in %s mode\n",
++		 dwc_otg_mode(core_if) ? "Host" : "Device");
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.modemismatch = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++	return 1;
++}
++
++/**
++ * This function handles the OTG Interrupts. It reads the OTG
++ * Interrupt Register (GOTGINT) to determine what interrupt has
++ * occurred.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++int32_t dwc_otg_handle_otg_intr(dwc_otg_core_if_t * core_if)
++{
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	gotgint_data_t gotgint;
++	gotgctl_data_t gotgctl;
++	gintmsk_data_t gintmsk;
++	gpwrdn_data_t gpwrdn;
++
++	gotgint.d32 = DWC_READ_REG32(&global_regs->gotgint);
++	gotgctl.d32 = DWC_READ_REG32(&global_regs->gotgctl);
++	DWC_DEBUGPL(DBG_CIL, "++OTG Interrupt gotgint=%0x [%s]\n", gotgint.d32,
++		    op_state_str(core_if));
++
++	if (gotgint.b.sesenddet) {
++		DWC_DEBUGPL(DBG_ANY, " ++OTG Interrupt: "
++			    "Session End Detected++ (%s)\n",
++			    op_state_str(core_if));
++		gotgctl.d32 = DWC_READ_REG32(&global_regs->gotgctl);
++
++		if (core_if->op_state == B_HOST) {
++			cil_pcd_start(core_if);
++			core_if->op_state = B_PERIPHERAL;
++		} else {
++			/* If not B_HOST and Device HNP still set. HNP
++			 * Did not succeed!*/
++			if (gotgctl.b.devhnpen) {
++				DWC_DEBUGPL(DBG_ANY, "Session End Detected\n");
++				__DWC_ERROR("Device Not Connected/Responding!\n");
++			}
++
++			/* If Session End Detected the B-Cable has
++			 * been disconnected. */
++			/* Reset PCD and Gadget driver to a
++			 * clean state. */
++			core_if->lx_state = DWC_OTG_L0;
++			DWC_SPINUNLOCK(core_if->lock);
++			cil_pcd_stop(core_if);
++			DWC_SPINLOCK(core_if->lock);
++
++			if (core_if->adp_enable) {
++				if (core_if->power_down == 2) {
++					gpwrdn.d32 = 0;
++					gpwrdn.b.pwrdnswtch = 1;
++					DWC_MODIFY_REG32(&core_if->
++							 core_global_regs->
++							 gpwrdn, gpwrdn.d32, 0);
++				}
++
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pmuintsel = 1;
++				gpwrdn.b.pmuactv = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++
++				dwc_otg_adp_sense_start(core_if);
++			}
++		}
++
++		gotgctl.d32 = 0;
++		gotgctl.b.devhnpen = 1;
++		DWC_MODIFY_REG32(&global_regs->gotgctl, gotgctl.d32, 0);
++	}
++	if (gotgint.b.sesreqsucstschng) {
++		DWC_DEBUGPL(DBG_ANY, " ++OTG Interrupt: "
++			    "Session Reqeust Success Status Change++\n");
++		gotgctl.d32 = DWC_READ_REG32(&global_regs->gotgctl);
++		if (gotgctl.b.sesreqscs) {
++
++			if ((core_if->core_params->phy_type ==
++			     DWC_PHY_TYPE_PARAM_FS) && (core_if->core_params->i2c_enable)) {
++				core_if->srp_success = 1;
++			} else {
++				DWC_SPINUNLOCK(core_if->lock);
++				cil_pcd_resume(core_if);
++				DWC_SPINLOCK(core_if->lock);
++				/* Clear Session Request */
++				gotgctl.d32 = 0;
++				gotgctl.b.sesreq = 1;
++				DWC_MODIFY_REG32(&global_regs->gotgctl,
++						 gotgctl.d32, 0);
++			}
++		}
++	}
++	if (gotgint.b.hstnegsucstschng) {
++		/* Print statements during the HNP interrupt handling
++		 * can cause it to fail.*/
++		gotgctl.d32 = DWC_READ_REG32(&global_regs->gotgctl);
++		/* WA for 3.00a- HW is not setting cur_mode, even sometimes
++		 * this does not help*/
++		if (core_if->snpsid >= OTG_CORE_REV_3_00a)
++			dwc_udelay(100);
++		if (gotgctl.b.hstnegscs) {
++			if (dwc_otg_is_host_mode(core_if)) {
++				core_if->op_state = B_HOST;
++				/*
++				 * Need to disable SOF interrupt immediately.
++				 * When switching from device to host, the PCD
++				 * interrupt handler won't handle the
++				 * interrupt if host mode is already set. The
++				 * HCD interrupt handler won't get called if
++				 * the HCD state is HALT. This means that the
++				 * interrupt does not get handled and Linux
++				 * complains loudly.
++				 */
++				gintmsk.d32 = 0;
++				gintmsk.b.sofintr = 1;
++				DWC_MODIFY_REG32(&global_regs->gintmsk,
++						 gintmsk.d32, 0);
++				/* Call callback function with spin lock released */
++				DWC_SPINUNLOCK(core_if->lock);
++				cil_pcd_stop(core_if);
++				/*
++				 * Initialize the Core for Host mode.
++				 */
++				cil_hcd_start(core_if);
++				DWC_SPINLOCK(core_if->lock);
++				core_if->op_state = B_HOST;
++			}
++		} else {
++			gotgctl.d32 = 0;
++			gotgctl.b.hnpreq = 1;
++			gotgctl.b.devhnpen = 1;
++			DWC_MODIFY_REG32(&global_regs->gotgctl, gotgctl.d32, 0);
++			DWC_DEBUGPL(DBG_ANY, "HNP Failed\n");
++			__DWC_ERROR("Device Not Connected/Responding\n");
++		}
++	}
++	if (gotgint.b.hstnegdet) {
++		/* The disconnect interrupt is set at the same time as
++		 * Host Negotiation Detected.  During the mode
++		 * switch all interrupts are cleared so the disconnect
++		 * interrupt handler will not get executed.
++		 */
++		DWC_DEBUGPL(DBG_ANY, " ++OTG Interrupt: "
++			    "Host Negotiation Detected++ (%s)\n",
++			    (dwc_otg_is_host_mode(core_if) ? "Host" :
++			     "Device"));
++		if (dwc_otg_is_device_mode(core_if)) {
++			DWC_DEBUGPL(DBG_ANY, "a_suspend->a_peripheral (%d)\n",
++				    core_if->op_state);
++			DWC_SPINUNLOCK(core_if->lock);
++			cil_hcd_disconnect(core_if);
++			cil_pcd_start(core_if);
++			DWC_SPINLOCK(core_if->lock);
++			core_if->op_state = A_PERIPHERAL;
++		} else {
++			/*
++			 * Need to disable SOF interrupt immediately. When
++			 * switching from device to host, the PCD interrupt
++			 * handler won't handle the interrupt if host mode is
++			 * already set. The HCD interrupt handler won't get
++			 * called if the HCD state is HALT. This means that
++			 * the interrupt does not get handled and Linux
++			 * complains loudly.
++			 */
++			gintmsk.d32 = 0;
++			gintmsk.b.sofintr = 1;
++			DWC_MODIFY_REG32(&global_regs->gintmsk, gintmsk.d32, 0);
++			DWC_SPINUNLOCK(core_if->lock);
++			cil_pcd_stop(core_if);
++			cil_hcd_start(core_if);
++			DWC_SPINLOCK(core_if->lock);
++			core_if->op_state = A_HOST;
++		}
++	}
++	if (gotgint.b.adevtoutchng) {
++		DWC_DEBUGPL(DBG_ANY, " ++OTG Interrupt: "
++			    "A-Device Timeout Change++\n");
++	}
++	if (gotgint.b.debdone) {
++		DWC_DEBUGPL(DBG_ANY, " ++OTG Interrupt: " "Debounce Done++\n");
++	}
++
++	/* Clear GOTGINT */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gotgint, gotgint.d32);
++
++	return 1;
++}
++
++void w_conn_id_status_change(void *p)
++{
++	dwc_otg_core_if_t *core_if = p;
++	uint32_t count = 0;
++	gotgctl_data_t gotgctl = {.d32 = 0 };
++
++	gotgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
++	DWC_DEBUGPL(DBG_CIL, "gotgctl=%0x\n", gotgctl.d32);
++	DWC_DEBUGPL(DBG_CIL, "gotgctl.b.conidsts=%d\n", gotgctl.b.conidsts);
++
++	/* B-Device connector (Device Mode) */
++	if (gotgctl.b.conidsts) {
++		/* Wait for switch to device mode. */
++		while (!dwc_otg_is_device_mode(core_if)) {
++			DWC_PRINTF("Waiting for Peripheral Mode, Mode=%s\n",
++				   (dwc_otg_is_host_mode(core_if) ? "Host" :
++				    "Peripheral"));
++			dwc_mdelay(100);
++			if (++count > 10000)
++				break;
++		}
++		DWC_ASSERT(++count < 10000,
++			   "Connection id status change timed out");
++		core_if->op_state = B_PERIPHERAL;
++		dwc_otg_core_init(core_if);
++		dwc_otg_enable_global_interrupts(core_if);
++		cil_pcd_start(core_if);
++	} else {
++		/* A-Device connector (Host Mode) */
++		while (!dwc_otg_is_host_mode(core_if)) {
++			DWC_PRINTF("Waiting for Host Mode, Mode=%s\n",
++				   (dwc_otg_is_host_mode(core_if) ? "Host" :
++				    "Peripheral"));
++			dwc_mdelay(100);
++			if (++count > 10000)
++				break;
++		}
++		DWC_ASSERT(++count < 10000,
++			   "Connection id status change timed out");
++		core_if->op_state = A_HOST;
++		/*
++		 * Initialize the Core for Host mode.
++		 */
++		dwc_otg_core_init(core_if);
++		dwc_otg_enable_global_interrupts(core_if);
++		cil_hcd_start(core_if);
++	}
++}
++
++/**
++ * This function handles the Connector ID Status Change Interrupt.  It
++ * reads the OTG Interrupt Register (GOTCTL) to determine whether this
++ * is a Device to Host Mode transition or a Host Mode to Device
++ * Transition.
++ *
++ * This only occurs when the cable is connected/removed from the PHY
++ * connector.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++int32_t dwc_otg_handle_conn_id_status_change_intr(dwc_otg_core_if_t * core_if)
++{
++
++	/*
++	 * Need to disable SOF interrupt immediately. If switching from device
++	 * to host, the PCD interrupt handler won't handle the interrupt if
++	 * host mode is already set. The HCD interrupt handler won't get
++	 * called if the HCD state is HALT. This means that the interrupt does
++	 * not get handled and Linux complains loudly.
++	 */
++	gintmsk_data_t gintmsk = {.d32 = 0 };
++	gintsts_data_t gintsts = {.d32 = 0 };
++
++	gintmsk.b.sofintr = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, gintmsk.d32, 0);
++
++	DWC_DEBUGPL(DBG_CIL,
++		    " ++Connector ID Status Change Interrupt++  (%s)\n",
++		    (dwc_otg_is_host_mode(core_if) ? "Host" : "Device"));
++
++	DWC_SPINUNLOCK(core_if->lock);
++
++	/*
++	 * Need to schedule a work, as there are possible DELAY function calls
++	 * Release lock before scheduling workq as it holds spinlock during scheduling
++	 */
++
++	DWC_WORKQ_SCHEDULE(core_if->wq_otg, w_conn_id_status_change,
++			   core_if, "connection id status change");
++	DWC_SPINLOCK(core_if->lock);
++
++	/* Set flag and clear interrupt */
++	gintsts.b.conidstschng = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * This interrupt indicates that a device is initiating the Session
++ * Request Protocol to request the host to turn on bus power so a new
++ * session can begin. The handler responds by turning on bus power. If
++ * the DWC_otg controller is in low power mode, the handler brings the
++ * controller out of low power mode before turning on bus power.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++int32_t dwc_otg_handle_session_req_intr(dwc_otg_core_if_t * core_if)
++{
++	gintsts_data_t gintsts;
++
++#ifndef DWC_HOST_ONLY
++	DWC_DEBUGPL(DBG_ANY, "++Session Request Interrupt++\n");
++
++	if (dwc_otg_is_device_mode(core_if)) {
++		DWC_PRINTF("SRP: Device mode\n");
++	} else {
++		hprt0_data_t hprt0;
++		DWC_PRINTF("SRP: Host mode\n");
++
++		/* Turn on the port power bit. */
++		hprt0.d32 = dwc_otg_read_hprt0(core_if);
++		hprt0.b.prtpwr = 1;
++		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++
++		/* Start the Connection timer. So a message can be displayed
++		 * if connect does not occur within 10 seconds. */
++		cil_hcd_session_start(core_if);
++	}
++#endif
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.sessreqintr = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++
++	return 1;
++}
++
++void w_wakeup_detected(void *p)
++{
++	dwc_otg_core_if_t *core_if = (dwc_otg_core_if_t *) p;
++	/*
++	 * Clear the Resume after 70ms. (Need 20 ms minimum. Use 70 ms
++	 * so that OPT tests pass with all PHYs).
++	 */
++	hprt0_data_t hprt0 = {.d32 = 0 };
++#if 0
++	pcgcctl_data_t pcgcctl = {.d32 = 0 };
++	/* Restart the Phy Clock */
++	pcgcctl.b.stoppclk = 1;
++	DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
++	dwc_udelay(10);
++#endif //0
++	hprt0.d32 = dwc_otg_read_hprt0(core_if);
++	DWC_DEBUGPL(DBG_ANY, "Resume: HPRT0=%0x\n", hprt0.d32);
++//      dwc_mdelay(70);
++	hprt0.b.prtres = 0;	/* Resume */
++	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++	DWC_DEBUGPL(DBG_ANY, "Clear Resume: HPRT0=%0x\n",
++		    DWC_READ_REG32(core_if->host_if->hprt0));
++
++	cil_hcd_resume(core_if);
++
++	/** Change to L0 state*/
++	core_if->lx_state = DWC_OTG_L0;
++}
++
++/**
++ * This interrupt indicates that the DWC_otg controller has detected a
++ * resume or remote wakeup sequence. If the DWC_otg controller is in
++ * low power mode, the handler must brings the controller out of low
++ * power mode. The controller automatically begins resume
++ * signaling. The handler schedules a time to stop resume signaling.
++ */
++int32_t dwc_otg_handle_wakeup_detected_intr(dwc_otg_core_if_t * core_if)
++{
++	gintsts_data_t gintsts;
++
++	DWC_DEBUGPL(DBG_ANY,
++		    "++Resume and Remote Wakeup Detected Interrupt++\n");
++
++	DWC_PRINTF("%s lxstate = %d\n", __func__, core_if->lx_state);
++
++	if (dwc_otg_is_device_mode(core_if)) {
++		dctl_data_t dctl = {.d32 = 0 };
++		DWC_DEBUGPL(DBG_PCD, "DSTS=0x%0x\n",
++			    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->
++					   dsts));
++		if (core_if->lx_state == DWC_OTG_L2) {
++#ifdef PARTIAL_POWER_DOWN
++			if (core_if->hwcfg4.b.power_optimiz) {
++				pcgcctl_data_t power = {.d32 = 0 };
++
++				power.d32 = DWC_READ_REG32(core_if->pcgcctl);
++				DWC_DEBUGPL(DBG_CIL, "PCGCCTL=%0x\n",
++					    power.d32);
++
++				power.b.stoppclk = 0;
++				DWC_WRITE_REG32(core_if->pcgcctl, power.d32);
++
++				power.b.pwrclmp = 0;
++				DWC_WRITE_REG32(core_if->pcgcctl, power.d32);
++
++				power.b.rstpdwnmodule = 0;
++				DWC_WRITE_REG32(core_if->pcgcctl, power.d32);
++			}
++#endif
++			/* Clear the Remote Wakeup Signaling */
++			dctl.b.rmtwkupsig = 1;
++			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
++					 dctl, dctl.d32, 0);
++
++			DWC_SPINUNLOCK(core_if->lock);
++			if (core_if->pcd_cb && core_if->pcd_cb->resume_wakeup) {
++				core_if->pcd_cb->resume_wakeup(core_if->pcd_cb->p);
++			}
++			DWC_SPINLOCK(core_if->lock);
++		} else {
++			glpmcfg_data_t lpmcfg;
++			lpmcfg.d32 =
++			    DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++			lpmcfg.b.hird_thres &= (~(1 << 4));
++			DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg,
++					lpmcfg.d32);
++		}
++		/** Change to L0 state*/
++		core_if->lx_state = DWC_OTG_L0;
++	} else {
++		if (core_if->lx_state != DWC_OTG_L1) {
++			pcgcctl_data_t pcgcctl = {.d32 = 0 };
++
++			/* Restart the Phy Clock */
++			pcgcctl.b.stoppclk = 1;
++			DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
++			DWC_TIMER_SCHEDULE(core_if->wkp_timer, 71);
++		} else {
++			/** Change to L0 state*/
++			core_if->lx_state = DWC_OTG_L0;
++		}
++	}
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.wkupintr = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * This interrupt indicates that the Wakeup Logic has detected a
++ * Device disconnect.
++ */
++static int32_t dwc_otg_handle_pwrdn_disconnect_intr(dwc_otg_core_if_t *core_if)
++{
++	gpwrdn_data_t gpwrdn = { .d32 = 0 };
++	gpwrdn_data_t gpwrdn_temp = { .d32 = 0 };
++	gpwrdn_temp.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++
++	DWC_PRINTF("%s called\n", __FUNCTION__);
++
++	if (!core_if->hibernation_suspend) {
++		DWC_PRINTF("Already exited from Hibernation\n");
++		return 1;
++	}
++
++	/* Switch on the voltage to the core */
++	gpwrdn.b.pwrdnswtch = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Reset the core */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnrstn = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Disable power clamps*/
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnclmp = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	/* Remove reset the core signal */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnrstn = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++	dwc_udelay(10);
++
++	/* Disable PMU interrupt */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pmuintsel = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	core_if->hibernation_suspend = 0;
++
++	/* Disable PMU */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pmuactv = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	if (gpwrdn_temp.b.idsts) {
++		core_if->op_state = B_PERIPHERAL;
++		dwc_otg_core_init(core_if);
++		dwc_otg_enable_global_interrupts(core_if);
++		cil_pcd_start(core_if);
++	} else {
++		core_if->op_state = A_HOST;
++		dwc_otg_core_init(core_if);
++		dwc_otg_enable_global_interrupts(core_if);
++		cil_hcd_start(core_if);
++	}
++
++	return 1;
++}
++
++/**
++ * This interrupt indicates that the Wakeup Logic has detected a
++ * remote wakeup sequence.
++ */
++static int32_t dwc_otg_handle_pwrdn_wakeup_detected_intr(dwc_otg_core_if_t * core_if)
++{
++	gpwrdn_data_t gpwrdn = {.d32 = 0 };
++	DWC_DEBUGPL(DBG_ANY,
++		    "++Powerdown Remote Wakeup Detected Interrupt++\n");
++
++	if (!core_if->hibernation_suspend) {
++		DWC_PRINTF("Already exited from Hibernation\n");
++		return 1;
++	}
++
++	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++	if (gpwrdn.b.idsts) {	// Device Mode
++		if ((core_if->power_down == 2)
++		    && (core_if->hibernation_suspend == 1)) {
++			dwc_otg_device_hibernation_restore(core_if, 0, 0);
++		}
++	} else {
++		if ((core_if->power_down == 2)
++		    && (core_if->hibernation_suspend == 1)) {
++			dwc_otg_host_hibernation_restore(core_if, 1, 0);
++		}
++	}
++	return 1;
++}
++
++static int32_t dwc_otg_handle_pwrdn_idsts_change(dwc_otg_device_t *otg_dev)
++{
++	gpwrdn_data_t gpwrdn = {.d32 = 0 };
++	gpwrdn_data_t gpwrdn_temp = {.d32 = 0 };
++	dwc_otg_core_if_t *core_if = otg_dev->core_if;
++
++	DWC_DEBUGPL(DBG_ANY, "%s called\n", __FUNCTION__);
++	gpwrdn_temp.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++	if (core_if->power_down == 2) {
++		if (!core_if->hibernation_suspend) {
++			DWC_PRINTF("Already exited from Hibernation\n");
++			return 1;
++		}
++		DWC_DEBUGPL(DBG_ANY, "Exit from hibernation on ID sts change\n");
++		/* Switch on the voltage to the core */
++		gpwrdn.b.pwrdnswtch = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++		dwc_udelay(10);
++
++		/* Reset the core */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pwrdnrstn = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++		dwc_udelay(10);
++
++		/* Disable power clamps */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pwrdnclmp = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++		/* Remove reset the core signal */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pwrdnrstn = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++		dwc_udelay(10);
++
++		/* Disable PMU interrupt */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pmuintsel = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++		/*Indicates that we are exiting from hibernation */
++		core_if->hibernation_suspend = 0;
++
++		/* Disable PMU */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pmuactv = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++		dwc_udelay(10);
++
++		gpwrdn.d32 = core_if->gr_backup->gpwrdn_local;
++		if (gpwrdn.b.dis_vbus == 1) {
++			gpwrdn.d32 = 0;
++			gpwrdn.b.dis_vbus = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++		}
++
++		if (gpwrdn_temp.b.idsts) {
++			core_if->op_state = B_PERIPHERAL;
++			dwc_otg_core_init(core_if);
++			dwc_otg_enable_global_interrupts(core_if);
++			cil_pcd_start(core_if);
++		} else {
++			core_if->op_state = A_HOST;
++			dwc_otg_core_init(core_if);
++			dwc_otg_enable_global_interrupts(core_if);
++			cil_hcd_start(core_if);
++		}
++	}
++
++	if (core_if->adp_enable) {
++		uint8_t is_host = 0;
++		DWC_SPINUNLOCK(core_if->lock);
++		/* Change the core_if's lock to hcd/pcd lock depend on mode? */
++#ifndef DWC_HOST_ONLY
++		if (gpwrdn_temp.b.idsts)
++			core_if->lock = otg_dev->pcd->lock;
++#endif
++#ifndef DWC_DEVICE_ONLY
++		if (!gpwrdn_temp.b.idsts) {
++				core_if->lock = otg_dev->hcd->lock;
++				is_host = 1;
++		}
++#endif
++		DWC_PRINTF("RESTART ADP\n");
++		if (core_if->adp.probe_enabled)
++			dwc_otg_adp_probe_stop(core_if);
++		if (core_if->adp.sense_enabled)
++			dwc_otg_adp_sense_stop(core_if);
++		if (core_if->adp.sense_timer_started)
++			DWC_TIMER_CANCEL(core_if->adp.sense_timer);
++		if (core_if->adp.vbuson_timer_started)
++			DWC_TIMER_CANCEL(core_if->adp.vbuson_timer);
++		core_if->adp.probe_timer_values[0] = -1;
++		core_if->adp.probe_timer_values[1] = -1;
++		core_if->adp.sense_timer_started = 0;
++		core_if->adp.vbuson_timer_started = 0;
++		core_if->adp.probe_counter = 0;
++		core_if->adp.gpwrdn = 0;
++
++		/* Disable PMU and restart ADP */
++		gpwrdn_temp.d32 = 0;
++		gpwrdn_temp.b.pmuactv = 1;
++		gpwrdn_temp.b.pmuintsel = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++		DWC_PRINTF("Check point 1\n");
++		dwc_mdelay(110);
++		dwc_otg_adp_start(core_if, is_host);
++		DWC_SPINLOCK(core_if->lock);
++	}
++
++
++	return 1;
++}
++
++static int32_t dwc_otg_handle_pwrdn_session_change(dwc_otg_core_if_t * core_if)
++{
++	gpwrdn_data_t gpwrdn = {.d32 = 0 };
++	int32_t otg_cap_param = core_if->core_params->otg_cap;
++	DWC_DEBUGPL(DBG_ANY, "%s called\n", __FUNCTION__);
++
++	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++	if (core_if->power_down == 2) {
++		if (!core_if->hibernation_suspend) {
++			DWC_PRINTF("Already exited from Hibernation\n");
++			return 1;
++		}
++
++		if ((otg_cap_param != DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE ||
++			 otg_cap_param != DWC_OTG_CAP_PARAM_SRP_ONLY_CAPABLE) &&
++			gpwrdn.b.bsessvld == 0) {
++			/* Save gpwrdn register for further usage if stschng interrupt */
++			core_if->gr_backup->gpwrdn_local =
++				DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++			/*Exit from ISR and wait for stschng interrupt with bsessvld = 1 */
++			return 1;
++		}
++
++		/* Switch on the voltage to the core */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pwrdnswtch = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++		dwc_udelay(10);
++
++		/* Reset the core */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pwrdnrstn = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++		dwc_udelay(10);
++
++		/* Disable power clamps */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pwrdnclmp = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++		/* Remove reset the core signal */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pwrdnrstn = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++		dwc_udelay(10);
++
++		/* Disable PMU interrupt */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pmuintsel = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++		dwc_udelay(10);
++
++		/*Indicates that we are exiting from hibernation */
++		core_if->hibernation_suspend = 0;
++
++		/* Disable PMU */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pmuactv = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++		dwc_udelay(10);
++
++		core_if->op_state = B_PERIPHERAL;
++		dwc_otg_core_init(core_if);
++		dwc_otg_enable_global_interrupts(core_if);
++		cil_pcd_start(core_if);
++
++		if (otg_cap_param == DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE ||
++			otg_cap_param == DWC_OTG_CAP_PARAM_SRP_ONLY_CAPABLE) {
++			/*
++			 * Initiate SRP after initial ADP probe.
++			 */
++			dwc_otg_initiate_srp(core_if);
++		}
++	}
++
++	return 1;
++}
++/**
++ * This interrupt indicates that the Wakeup Logic has detected a
++ * status change either on IDDIG or BSessVld.
++ */
++static uint32_t dwc_otg_handle_pwrdn_stschng_intr(dwc_otg_device_t *otg_dev)
++{
++	uint32_t retval = 0;
++	gpwrdn_data_t gpwrdn = {.d32 = 0 };
++	gpwrdn_data_t gpwrdn_temp = {.d32 = 0 };
++	dwc_otg_core_if_t *core_if = otg_dev->core_if;
++
++	DWC_PRINTF("%s called\n", __FUNCTION__);
++
++	if (core_if->power_down == 2) {
++		if (core_if->hibernation_suspend <= 0) {
++			DWC_PRINTF("Already exited from Hibernation\n");
++			return 1;
++		} else
++			gpwrdn_temp.d32 = core_if->gr_backup->gpwrdn_local;
++
++	} else {
++		gpwrdn_temp.d32 = core_if->adp.gpwrdn;
++	}
++
++	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++
++	if (gpwrdn.b.idsts ^ gpwrdn_temp.b.idsts) {
++		retval = dwc_otg_handle_pwrdn_idsts_change(otg_dev);
++	} else if (gpwrdn.b.bsessvld ^ gpwrdn_temp.b.bsessvld) {
++		retval = dwc_otg_handle_pwrdn_session_change(core_if);
++	}
++
++	return retval;
++}
++
++/**
++ * This interrupt indicates that the Wakeup Logic has detected a
++ * SRP.
++ */
++static int32_t dwc_otg_handle_pwrdn_srp_intr(dwc_otg_core_if_t * core_if)
++{
++	gpwrdn_data_t gpwrdn = {.d32 = 0 };
++
++	DWC_PRINTF("%s called\n", __FUNCTION__);
++
++	if (!core_if->hibernation_suspend) {
++		DWC_PRINTF("Already exited from Hibernation\n");
++		return 1;
++	}
++#ifdef DWC_DEV_SRPCAP
++	if (core_if->pwron_timer_started) {
++		core_if->pwron_timer_started = 0;
++		DWC_TIMER_CANCEL(core_if->pwron_timer);
++	}
++#endif
++
++	/* Switch on the voltage to the core */
++	gpwrdn.b.pwrdnswtch = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Reset the core */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnrstn = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Disable power clamps */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnclmp = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	/* Remove reset the core signal */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnrstn = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++	dwc_udelay(10);
++
++	/* Disable PMU interrupt */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pmuintsel = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	/* Indicates that we are exiting from hibernation */
++	core_if->hibernation_suspend = 0;
++
++	/* Disable PMU */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pmuactv = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Programm Disable VBUS to 0 */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.dis_vbus = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	/*Initialize the core as Host */
++	core_if->op_state = A_HOST;
++	dwc_otg_core_init(core_if);
++	dwc_otg_enable_global_interrupts(core_if);
++	cil_hcd_start(core_if);
++
++	return 1;
++}
++
++/** This interrupt indicates that restore command after Hibernation
++ * was completed by the core. */
++int32_t dwc_otg_handle_restore_done_intr(dwc_otg_core_if_t * core_if)
++{
++	pcgcctl_data_t pcgcctl;
++	DWC_DEBUGPL(DBG_ANY, "++Restore Done Interrupt++\n");
++
++	//TODO De-assert restore signal. 8.a
++	pcgcctl.d32 = DWC_READ_REG32(core_if->pcgcctl);
++	if (pcgcctl.b.restoremode == 1) {
++		gintmsk_data_t gintmsk = {.d32 = 0 };
++		/*
++		 * If restore mode is Remote Wakeup,
++		 * unmask Remote Wakeup interrupt.
++		 */
++		gintmsk.b.wkupintr = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk,
++				 0, gintmsk.d32);
++	}
++
++	return 1;
++}
++
++/**
++ * This interrupt indicates that a device has been disconnected from
++ * the root port.
++ */
++int32_t dwc_otg_handle_disconnect_intr(dwc_otg_core_if_t * core_if)
++{
++	gintsts_data_t gintsts;
++
++	DWC_DEBUGPL(DBG_ANY, "++Disconnect Detected Interrupt++ (%s) %s\n",
++		    (dwc_otg_is_host_mode(core_if) ? "Host" : "Device"),
++		    op_state_str(core_if));
++
++/** @todo Consolidate this if statement. */
++#ifndef DWC_HOST_ONLY
++	if (core_if->op_state == B_HOST) {
++		/* If in device mode Disconnect and stop the HCD, then
++		 * start the PCD. */
++		DWC_SPINUNLOCK(core_if->lock);
++		cil_hcd_disconnect(core_if);
++		cil_pcd_start(core_if);
++		DWC_SPINLOCK(core_if->lock);
++		core_if->op_state = B_PERIPHERAL;
++	} else if (dwc_otg_is_device_mode(core_if)) {
++		gotgctl_data_t gotgctl = {.d32 = 0 };
++		gotgctl.d32 =
++		    DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
++		if (gotgctl.b.hstsethnpen == 1) {
++			/* Do nothing, if HNP in process the OTG
++			 * interrupt "Host Negotiation Detected"
++			 * interrupt will do the mode switch.
++			 */
++		} else if (gotgctl.b.devhnpen == 0) {
++			/* If in device mode Disconnect and stop the HCD, then
++			 * start the PCD. */
++			DWC_SPINUNLOCK(core_if->lock);
++			cil_hcd_disconnect(core_if);
++			cil_pcd_start(core_if);
++			DWC_SPINLOCK(core_if->lock);
++			core_if->op_state = B_PERIPHERAL;
++		} else {
++			DWC_DEBUGPL(DBG_ANY, "!a_peripheral && !devhnpen\n");
++		}
++	} else {
++		if (core_if->op_state == A_HOST) {
++			/* A-Cable still connected but device disconnected. */
++			DWC_SPINUNLOCK(core_if->lock);
++			cil_hcd_disconnect(core_if);
++			DWC_SPINLOCK(core_if->lock);
++			if (core_if->adp_enable) {
++				gpwrdn_data_t gpwrdn = { .d32 = 0 };
++				cil_hcd_stop(core_if);
++				/* Enable Power Down Logic */
++				gpwrdn.b.pmuintsel = 1;
++				gpwrdn.b.pmuactv = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++				dwc_otg_adp_probe_start(core_if);
++
++				/* Power off the core */
++				if (core_if->power_down == 2) {
++					gpwrdn.d32 = 0;
++					gpwrdn.b.pwrdnswtch = 1;
++					DWC_MODIFY_REG32
++					    (&core_if->core_global_regs->gpwrdn,
++					     gpwrdn.d32, 0);
++				}
++			}
++		}
++	}
++#endif
++	/* Change to L3(OFF) state */
++	core_if->lx_state = DWC_OTG_L3;
++
++	gintsts.d32 = 0;
++	gintsts.b.disconnect = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++	return 1;
++}
++
++/**
++ * This interrupt indicates that SUSPEND state has been detected on
++ * the USB.
++ *
++ * For HNP the USB Suspend interrupt signals the change from
++ * "a_peripheral" to "a_host".
++ *
++ * When power management is enabled the core will be put in low power
++ * mode.
++ */
++int32_t dwc_otg_handle_usb_suspend_intr(dwc_otg_core_if_t * core_if)
++{
++	dsts_data_t dsts;
++	gintsts_data_t gintsts;
++	dcfg_data_t dcfg;
++
++	DWC_DEBUGPL(DBG_ANY, "USB SUSPEND\n");
++
++	if (dwc_otg_is_device_mode(core_if)) {
++		/* Check the Device status register to determine if the Suspend
++		 * state is active. */
++		dsts.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
++		DWC_DEBUGPL(DBG_PCD, "DSTS=0x%0x\n", dsts.d32);
++		DWC_DEBUGPL(DBG_PCD, "DSTS.Suspend Status=%d "
++			    "HWCFG4.power Optimize=%d\n",
++			    dsts.b.suspsts, core_if->hwcfg4.b.power_optimiz);
++
++#ifdef PARTIAL_POWER_DOWN
++/** @todo Add a module parameter for power management. */
++
++		if (dsts.b.suspsts && core_if->hwcfg4.b.power_optimiz) {
++			pcgcctl_data_t power = {.d32 = 0 };
++			DWC_DEBUGPL(DBG_CIL, "suspend\n");
++
++			power.b.pwrclmp = 1;
++			DWC_WRITE_REG32(core_if->pcgcctl, power.d32);
++
++			power.b.rstpdwnmodule = 1;
++			DWC_MODIFY_REG32(core_if->pcgcctl, 0, power.d32);
++
++			power.b.stoppclk = 1;
++			DWC_MODIFY_REG32(core_if->pcgcctl, 0, power.d32);
++
++		} else {
++			DWC_DEBUGPL(DBG_ANY, "disconnect?\n");
++		}
++#endif
++		/* PCD callback for suspend. Release the lock inside of callback function */
++		cil_pcd_suspend(core_if);
++		if (core_if->power_down == 2)
++		{
++			dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
++			DWC_DEBUGPL(DBG_ANY,"lx_state = %08x\n",core_if->lx_state);
++			DWC_DEBUGPL(DBG_ANY," device address = %08d\n",dcfg.b.devaddr);
++
++			if (core_if->lx_state != DWC_OTG_L3 && dcfg.b.devaddr) {
++				pcgcctl_data_t pcgcctl = {.d32 = 0 };
++				gpwrdn_data_t gpwrdn = {.d32 = 0 };
++				gusbcfg_data_t gusbcfg = {.d32 = 0 };
++
++				/* Change to L2(suspend) state */
++				core_if->lx_state = DWC_OTG_L2;
++
++				/* Clear interrupt in gintsts */
++				gintsts.d32 = 0;
++				gintsts.b.usbsuspend = 1;
++				DWC_WRITE_REG32(&core_if->core_global_regs->
++						gintsts, gintsts.d32);
++				DWC_PRINTF("Start of hibernation completed\n");
++				dwc_otg_save_global_regs(core_if);
++				dwc_otg_save_dev_regs(core_if);
++
++				gusbcfg.d32 =
++				    DWC_READ_REG32(&core_if->core_global_regs->
++						   gusbcfg);
++				if (gusbcfg.b.ulpi_utmi_sel == 1) {
++					/* ULPI interface */
++					/* Suspend the Phy Clock */
++					pcgcctl.d32 = 0;
++					pcgcctl.b.stoppclk = 1;
++					DWC_MODIFY_REG32(core_if->pcgcctl, 0,
++							 pcgcctl.d32);
++					dwc_udelay(10);
++					gpwrdn.b.pmuactv = 1;
++					DWC_MODIFY_REG32(&core_if->
++							 core_global_regs->
++							 gpwrdn, 0, gpwrdn.d32);
++				} else {
++					/* UTMI+ Interface */
++					gpwrdn.b.pmuactv = 1;
++					DWC_MODIFY_REG32(&core_if->
++							 core_global_regs->
++							 gpwrdn, 0, gpwrdn.d32);
++					dwc_udelay(10);
++					pcgcctl.b.stoppclk = 1;
++					DWC_MODIFY_REG32(core_if->pcgcctl, 0,
++							 pcgcctl.d32);
++					dwc_udelay(10);
++				}
++
++				/* Set flag to indicate that we are in hibernation */
++				core_if->hibernation_suspend = 1;
++				/* Enable interrupts from wake up logic */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pmuintsel = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++				dwc_udelay(10);
++
++				/* Unmask device mode interrupts in GPWRDN */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.rst_det_msk = 1;
++				gpwrdn.b.lnstchng_msk = 1;
++				gpwrdn.b.sts_chngint_msk = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++				dwc_udelay(10);
++
++				/* Enable Power Down Clamp */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pwrdnclmp = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++				dwc_udelay(10);
++
++				/* Switch off VDD */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pwrdnswtch = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++
++				/* Save gpwrdn register for further usage if stschng interrupt */
++				core_if->gr_backup->gpwrdn_local =
++							DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++				DWC_PRINTF("Hibernation completed\n");
++
++				return 1;
++			}
++		} else if (core_if->power_down == 3) {
++			pcgcctl_data_t pcgcctl = {.d32 = 0 };
++			dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
++			DWC_DEBUGPL(DBG_ANY, "lx_state = %08x\n",core_if->lx_state);
++			DWC_DEBUGPL(DBG_ANY, " device address = %08d\n",dcfg.b.devaddr);
++
++			if (core_if->lx_state != DWC_OTG_L3 && dcfg.b.devaddr) {
++				DWC_DEBUGPL(DBG_ANY, "Start entering to extended hibernation\n");
++				core_if->xhib = 1;
++
++				/* Clear interrupt in gintsts */
++				gintsts.d32 = 0;
++				gintsts.b.usbsuspend = 1;
++				DWC_WRITE_REG32(&core_if->core_global_regs->
++					gintsts, gintsts.d32);
++
++				dwc_otg_save_global_regs(core_if);
++				dwc_otg_save_dev_regs(core_if);
++
++				/* Wait for 10 PHY clocks */
++				dwc_udelay(10);
++
++				/* Program GPIO register while entering to xHib */
++				DWC_WRITE_REG32(&core_if->core_global_regs->ggpio, 0x1);
++
++				pcgcctl.b.enbl_extnd_hiber = 1;
++				DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
++				DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
++
++				pcgcctl.d32 = 0;
++				pcgcctl.b.extnd_hiber_pwrclmp = 1;
++				DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
++
++				pcgcctl.d32 = 0;
++				pcgcctl.b.extnd_hiber_switch = 1;
++				core_if->gr_backup->xhib_gpwrdn = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++				core_if->gr_backup->xhib_pcgcctl = DWC_READ_REG32(core_if->pcgcctl) | pcgcctl.d32;
++				DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
++
++				DWC_DEBUGPL(DBG_ANY, "Finished entering to extended hibernation\n");
++
++				return 1;
++			}
++		}
++	} else {
++		if (core_if->op_state == A_PERIPHERAL) {
++			DWC_DEBUGPL(DBG_ANY, "a_peripheral->a_host\n");
++			/* Clear the a_peripheral flag, back to a_host. */
++			DWC_SPINUNLOCK(core_if->lock);
++			cil_pcd_stop(core_if);
++			cil_hcd_start(core_if);
++			DWC_SPINLOCK(core_if->lock);
++			core_if->op_state = A_HOST;
++		}
++	}
++
++	/* Change to L2(suspend) state */
++	core_if->lx_state = DWC_OTG_L2;
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.usbsuspend = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++
++	return 1;
++}
++
++static int32_t dwc_otg_handle_xhib_exit_intr(dwc_otg_core_if_t * core_if)
++{
++	gpwrdn_data_t gpwrdn = {.d32 = 0 };
++	pcgcctl_data_t pcgcctl = {.d32 = 0 };
++	gahbcfg_data_t gahbcfg = {.d32 = 0 };
++
++	dwc_udelay(10);
++
++	/* Program GPIO register while entering to xHib */
++	DWC_WRITE_REG32(&core_if->core_global_regs->ggpio, 0x0);
++
++	pcgcctl.d32 = core_if->gr_backup->xhib_pcgcctl;
++	pcgcctl.b.extnd_hiber_pwrclmp = 0;
++	DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
++	dwc_udelay(10);
++
++	gpwrdn.d32 = core_if->gr_backup->xhib_gpwrdn;
++	gpwrdn.b.restore = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32);
++	dwc_udelay(10);
++
++	restore_lpm_i2c_regs(core_if);
++
++	pcgcctl.d32 = core_if->gr_backup->pcgcctl_local & (0x3FFFF << 14);
++	pcgcctl.b.max_xcvrselect = 1;
++	pcgcctl.b.ess_reg_restored = 0;
++	pcgcctl.b.extnd_hiber_switch = 0;
++	pcgcctl.b.extnd_hiber_pwrclmp = 0;
++	pcgcctl.b.enbl_extnd_hiber = 1;
++	DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
++
++	gahbcfg.d32 = core_if->gr_backup->gahbcfg_local;
++	gahbcfg.b.glblintrmsk = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gahbcfg, gahbcfg.d32);
++
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, 0x1 << 16);
++
++	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg,
++			core_if->gr_backup->gusbcfg_local);
++	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg,
++			core_if->dr_backup->dcfg);
++
++	pcgcctl.d32 = 0;
++	pcgcctl.d32 = core_if->gr_backup->pcgcctl_local & (0x3FFFF << 14);
++	pcgcctl.b.max_xcvrselect = 1;
++	pcgcctl.d32 |= 0x608;
++	DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
++	dwc_udelay(10);
++
++	pcgcctl.d32 = 0;
++	pcgcctl.d32 = core_if->gr_backup->pcgcctl_local & (0x3FFFF << 14);
++	pcgcctl.b.max_xcvrselect = 1;
++	pcgcctl.b.ess_reg_restored = 1;
++	pcgcctl.b.enbl_extnd_hiber = 1;
++	pcgcctl.b.rstpdwnmodule = 1;
++	pcgcctl.b.restoremode = 1;
++	DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
++
++	DWC_DEBUGPL(DBG_ANY, "%s called\n", __FUNCTION__);
++
++	return 1;
++}
++
++#ifdef CONFIG_USB_DWC_OTG_LPM
++/**
++ * This function hadles LPM transaction received interrupt.
++ */
++static int32_t dwc_otg_handle_lpm_intr(dwc_otg_core_if_t * core_if)
++{
++	glpmcfg_data_t lpmcfg;
++	gintsts_data_t gintsts;
++
++	if (!core_if->core_params->lpm_enable) {
++		DWC_PRINTF("Unexpected LPM interrupt\n");
++	}
++
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++	DWC_PRINTF("LPM config register = 0x%08x\n", lpmcfg.d32);
++
++	if (dwc_otg_is_host_mode(core_if)) {
++		cil_hcd_sleep(core_if);
++	} else {
++		lpmcfg.b.hird_thres |= (1 << 4);
++		DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg,
++				lpmcfg.d32);
++	}
++
++	/* Examine prt_sleep_sts after TL1TokenTetry period max (10 us) */
++	dwc_udelay(10);
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++	if (lpmcfg.b.prt_sleep_sts) {
++		/* Save the current state */
++		core_if->lx_state = DWC_OTG_L1;
++	}
++
++	/* Clear interrupt  */
++	gintsts.d32 = 0;
++	gintsts.b.lpmtranrcvd = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++	return 1;
++}
++#endif /* CONFIG_USB_DWC_OTG_LPM */
++
++/**
++ * This function returns the Core Interrupt register.
++ */
++static inline uint32_t dwc_otg_read_common_intr(dwc_otg_core_if_t * core_if, gintmsk_data_t *reenable_gintmsk, dwc_otg_hcd_t *hcd)
++{
++	gahbcfg_data_t gahbcfg = {.d32 = 0 };
++	gintsts_data_t gintsts;
++	gintmsk_data_t gintmsk;
++	gintmsk_data_t gintmsk_common = {.d32 = 0 };
++	gintmsk_common.b.wkupintr = 1;
++	gintmsk_common.b.sessreqintr = 1;
++	gintmsk_common.b.conidstschng = 1;
++	gintmsk_common.b.otgintr = 1;
++	gintmsk_common.b.modemismatch = 1;
++	gintmsk_common.b.disconnect = 1;
++	gintmsk_common.b.usbsuspend = 1;
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	gintmsk_common.b.lpmtranrcvd = 1;
++#endif
++	gintmsk_common.b.restoredone = 1;
++	if(dwc_otg_is_device_mode(core_if))
++	{
++		/** @todo: The port interrupt occurs while in device
++		 * mode. Added code to CIL to clear the interrupt for now!
++		 */
++		gintmsk_common.b.portintr = 1;
++	}
++	if(fiq_enable) {
++		local_fiq_disable();
++		fiq_fsm_spin_lock(&hcd->fiq_state->lock);
++		gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++		gintmsk.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
++		/* Pull in the interrupts that the FIQ has masked */
++		gintmsk.d32 |= ~(hcd->fiq_state->gintmsk_saved.d32);
++		gintmsk.d32 |= gintmsk_common.d32;
++		/* for the upstairs function to reenable - have to read it here in case FIQ triggers again */
++		reenable_gintmsk->d32 = gintmsk.d32;
++		fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
++		local_fiq_enable();
++	} else {
++		gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++		gintmsk.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
++	}
++
++	gahbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gahbcfg);
++
++#ifdef DEBUG
++	/* if any common interrupts set */
++	if (gintsts.d32 & gintmsk_common.d32) {
++		DWC_DEBUGPL(DBG_ANY, "common_intr: gintsts=%08x  gintmsk=%08x\n",
++			    gintsts.d32, gintmsk.d32);
++	}
++#endif
++	if (!fiq_enable){
++		if (gahbcfg.b.glblintrmsk)
++			return ((gintsts.d32 & gintmsk.d32) & gintmsk_common.d32);
++		else
++			return 0;
++	} else {
++		/* Our IRQ kicker is no longer the USB hardware, it's the MPHI interface.
++		 * Can't trust the global interrupt mask bit in this case.
++		 */
++		return ((gintsts.d32 & gintmsk.d32) & gintmsk_common.d32);
++	}
++
++}
++
++/* MACRO for clearing interupt bits in GPWRDN register */
++#define CLEAR_GPWRDN_INTR(__core_if,__intr) \
++do { \
++		gpwrdn_data_t gpwrdn = {.d32=0}; \
++		gpwrdn.b.__intr = 1; \
++		DWC_MODIFY_REG32(&__core_if->core_global_regs->gpwrdn, \
++		0, gpwrdn.d32); \
++} while (0)
++
++/**
++ * Common interrupt handler.
++ *
++ * The common interrupts are those that occur in both Host and Device mode.
++ * This handler handles the following interrupts:
++ * - Mode Mismatch Interrupt
++ * - Disconnect Interrupt
++ * - OTG Interrupt
++ * - Connector ID Status Change Interrupt
++ * - Session Request Interrupt.
++ * - Resume / Remote Wakeup Detected Interrupt.
++ * - LPM Transaction Received Interrupt
++ * - ADP Transaction Received Interrupt
++ *
++ */
++int32_t dwc_otg_handle_common_intr(void *dev)
++{
++	int retval = 0;
++	gintsts_data_t gintsts;
++	gintmsk_data_t gintmsk_reenable = { .d32 = 0 };
++	gpwrdn_data_t gpwrdn = {.d32 = 0 };
++	dwc_otg_device_t *otg_dev = dev;
++	dwc_otg_core_if_t *core_if = otg_dev->core_if;
++	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++	if (dwc_otg_is_device_mode(core_if))
++		core_if->frame_num = dwc_otg_get_frame_number(core_if);
++
++	if (core_if->lock)
++		DWC_SPINLOCK(core_if->lock);
++
++	if (core_if->power_down == 3 && core_if->xhib == 1) {
++		DWC_DEBUGPL(DBG_ANY, "Exiting from xHIB state\n");
++		retval |= dwc_otg_handle_xhib_exit_intr(core_if);
++		core_if->xhib = 2;
++		if (core_if->lock)
++			DWC_SPINUNLOCK(core_if->lock);
++
++		return retval;
++	}
++
++	if (core_if->hibernation_suspend <= 0) {
++		/* read_common will have to poke the FIQ's saved mask. We must then clear this mask at the end
++		 * of this handler - god only knows why it's done like this
++		 */
++		gintsts.d32 = dwc_otg_read_common_intr(core_if, &gintmsk_reenable, otg_dev->hcd);
++
++		if (gintsts.b.modemismatch) {
++			retval |= dwc_otg_handle_mode_mismatch_intr(core_if);
++		}
++		if (gintsts.b.otgintr) {
++			retval |= dwc_otg_handle_otg_intr(core_if);
++		}
++		if (gintsts.b.conidstschng) {
++			retval |=
++			    dwc_otg_handle_conn_id_status_change_intr(core_if);
++		}
++		if (gintsts.b.disconnect) {
++			retval |= dwc_otg_handle_disconnect_intr(core_if);
++		}
++		if (gintsts.b.sessreqintr) {
++			retval |= dwc_otg_handle_session_req_intr(core_if);
++		}
++		if (gintsts.b.wkupintr) {
++			retval |= dwc_otg_handle_wakeup_detected_intr(core_if);
++		}
++		if (gintsts.b.usbsuspend) {
++			retval |= dwc_otg_handle_usb_suspend_intr(core_if);
++		}
++#ifdef CONFIG_USB_DWC_OTG_LPM
++		if (gintsts.b.lpmtranrcvd) {
++			retval |= dwc_otg_handle_lpm_intr(core_if);
++		}
++#endif
++		if (gintsts.b.restoredone) {
++			gintsts.d32 = 0;
++	                if (core_if->power_down == 2)
++				core_if->hibernation_suspend = -1;
++			else if (core_if->power_down == 3 && core_if->xhib == 2) {
++				gpwrdn_data_t gpwrdn = {.d32 = 0 };
++				pcgcctl_data_t pcgcctl = {.d32 = 0 };
++				dctl_data_t dctl = {.d32 = 0 };
++
++				DWC_WRITE_REG32(&core_if->core_global_regs->
++						gintsts, 0xFFFFFFFF);
++
++				DWC_DEBUGPL(DBG_ANY,
++					    "RESTORE DONE generated\n");
++
++				gpwrdn.b.restore = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++				dwc_udelay(10);
++
++				pcgcctl.b.rstpdwnmodule = 1;
++				DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
++
++				DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, core_if->gr_backup->gusbcfg_local);
++				DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg, core_if->dr_backup->dcfg);
++				DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl, core_if->dr_backup->dctl);
++				dwc_udelay(50);
++
++				dctl.b.pwronprgdone = 1;
++				DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
++				dwc_udelay(10);
++
++				dwc_otg_restore_global_regs(core_if);
++				dwc_otg_restore_dev_regs(core_if, 0);
++
++				dctl.d32 = 0;
++				dctl.b.pwronprgdone = 1;
++				DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32, 0);
++				dwc_udelay(10);
++
++				pcgcctl.d32 = 0;
++				pcgcctl.b.enbl_extnd_hiber = 1;
++				DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
++
++				/* The core will be in ON STATE */
++				core_if->lx_state = DWC_OTG_L0;
++				core_if->xhib = 0;
++
++				DWC_SPINUNLOCK(core_if->lock);
++				if (core_if->pcd_cb && core_if->pcd_cb->resume_wakeup) {
++					core_if->pcd_cb->resume_wakeup(core_if->pcd_cb->p);
++				}
++				DWC_SPINLOCK(core_if->lock);
++
++			}
++
++			gintsts.b.restoredone = 1;
++			DWC_WRITE_REG32(&core_if->core_global_regs->gintsts,gintsts.d32);
++			DWC_PRINTF(" --Restore done interrupt received-- \n");
++			retval |= 1;
++		}
++		if (gintsts.b.portintr && dwc_otg_is_device_mode(core_if)) {
++			/* The port interrupt occurs while in device mode with HPRT0
++			 * Port Enable/Disable.
++			 */
++			gintsts.d32 = 0;
++			gintsts.b.portintr = 1;
++			DWC_WRITE_REG32(&core_if->core_global_regs->gintsts,gintsts.d32);
++			retval |= 1;
++			gintmsk_reenable.b.portintr = 1;
++
++		}
++		/* Did we actually handle anything? if so, unmask the interrupt */
++//		fiq_print(FIQDBG_INT, otg_dev->hcd->fiq_state, "CILOUT %1d", retval);
++//		fiq_print(FIQDBG_INT, otg_dev->hcd->fiq_state, "%08x", gintsts.d32);
++//		fiq_print(FIQDBG_INT, otg_dev->hcd->fiq_state, "%08x", gintmsk_reenable.d32);
++		if (retval && fiq_enable) {
++			DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, gintmsk_reenable.d32);
++		}
++
++	} else {
++		DWC_DEBUGPL(DBG_ANY, "gpwrdn=%08x\n", gpwrdn.d32);
++
++		if (gpwrdn.b.disconn_det && gpwrdn.b.disconn_det_msk) {
++			CLEAR_GPWRDN_INTR(core_if, disconn_det);
++			if (gpwrdn.b.linestate == 0) {
++				dwc_otg_handle_pwrdn_disconnect_intr(core_if);
++			} else {
++				DWC_PRINTF("Disconnect detected while linestate is not 0\n");
++			}
++
++			retval |= 1;
++		}
++		if (gpwrdn.b.lnstschng && gpwrdn.b.lnstchng_msk) {
++			CLEAR_GPWRDN_INTR(core_if, lnstschng);
++			/* remote wakeup from hibernation */
++			if (gpwrdn.b.linestate == 2 || gpwrdn.b.linestate == 1) {
++				dwc_otg_handle_pwrdn_wakeup_detected_intr(core_if);
++			} else {
++				DWC_PRINTF("gpwrdn.linestate = %d\n", gpwrdn.b.linestate);
++			}
++			retval |= 1;
++		}
++		if (gpwrdn.b.rst_det && gpwrdn.b.rst_det_msk) {
++			CLEAR_GPWRDN_INTR(core_if, rst_det);
++			if (gpwrdn.b.linestate == 0) {
++				DWC_PRINTF("Reset detected\n");
++				retval |= dwc_otg_device_hibernation_restore(core_if, 0, 1);
++			}
++		}
++		if (gpwrdn.b.srp_det && gpwrdn.b.srp_det_msk) {
++			CLEAR_GPWRDN_INTR(core_if, srp_det);
++			dwc_otg_handle_pwrdn_srp_intr(core_if);
++			retval |= 1;
++		}
++	}
++	/* Handle ADP interrupt here */
++	if (gpwrdn.b.adp_int) {
++		DWC_PRINTF("ADP interrupt\n");
++		CLEAR_GPWRDN_INTR(core_if, adp_int);
++		dwc_otg_adp_handle_intr(core_if);
++		retval |= 1;
++	}
++	if (gpwrdn.b.sts_chngint && gpwrdn.b.sts_chngint_msk) {
++		DWC_PRINTF("STS CHNG interrupt asserted\n");
++		CLEAR_GPWRDN_INTR(core_if, sts_chngint);
++		dwc_otg_handle_pwrdn_stschng_intr(otg_dev);
++
++		retval |= 1;
++	}
++	if (core_if->lock)
++		DWC_SPINUNLOCK(core_if->lock);
++	return retval;
++}
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_core_if.h
+@@ -0,0 +1,705 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_core_if.h $
++ * $Revision: #13 $
++ * $Date: 2012/08/10 $
++ * $Change: 2047372 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#if !defined(__DWC_CORE_IF_H__)
++#define __DWC_CORE_IF_H__
++
++#include "dwc_os.h"
++
++/** @file
++ * This file defines DWC_OTG Core API
++ */
++
++struct dwc_otg_core_if;
++typedef struct dwc_otg_core_if dwc_otg_core_if_t;
++
++/** Maximum number of Periodic FIFOs */
++#define MAX_PERIO_FIFOS 15
++/** Maximum number of Periodic FIFOs */
++#define MAX_TX_FIFOS 15
++
++/** Maximum number of Endpoints/HostChannels */
++#define MAX_EPS_CHANNELS 16
++
++extern dwc_otg_core_if_t *dwc_otg_cil_init(const uint32_t * _reg_base_addr);
++extern void dwc_otg_core_init(dwc_otg_core_if_t * _core_if);
++extern void dwc_otg_cil_remove(dwc_otg_core_if_t * _core_if);
++
++extern void dwc_otg_enable_global_interrupts(dwc_otg_core_if_t * _core_if);
++extern void dwc_otg_disable_global_interrupts(dwc_otg_core_if_t * _core_if);
++
++extern uint8_t dwc_otg_is_device_mode(dwc_otg_core_if_t * _core_if);
++extern uint8_t dwc_otg_is_host_mode(dwc_otg_core_if_t * _core_if);
++
++extern uint8_t dwc_otg_is_dma_enable(dwc_otg_core_if_t * core_if);
++
++/** This function should be called on every hardware interrupt. */
++extern int32_t dwc_otg_handle_common_intr(void *otg_dev);
++
++/** @name OTG Core Parameters */
++/** @{ */
++
++/**
++ * Specifies the OTG capabilities. The driver will automatically
++ * detect the value for this parameter if none is specified.
++ * 0 - HNP and SRP capable (default)
++ * 1 - SRP Only capable
++ * 2 - No HNP/SRP capable
++ */
++extern int dwc_otg_set_param_otg_cap(dwc_otg_core_if_t * core_if, int32_t val);
++extern int32_t dwc_otg_get_param_otg_cap(dwc_otg_core_if_t * core_if);
++#define DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE 0
++#define DWC_OTG_CAP_PARAM_SRP_ONLY_CAPABLE 1
++#define DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE 2
++#define dwc_param_otg_cap_default DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE
++
++extern int dwc_otg_set_param_opt(dwc_otg_core_if_t * core_if, int32_t val);
++extern int32_t dwc_otg_get_param_opt(dwc_otg_core_if_t * core_if);
++#define dwc_param_opt_default 1
++
++/**
++ * Specifies whether to use slave or DMA mode for accessing the data
++ * FIFOs. The driver will automatically detect the value for this
++ * parameter if none is specified.
++ * 0 - Slave
++ * 1 - DMA (default, if available)
++ */
++extern int dwc_otg_set_param_dma_enable(dwc_otg_core_if_t * core_if,
++					int32_t val);
++extern int32_t dwc_otg_get_param_dma_enable(dwc_otg_core_if_t * core_if);
++#define dwc_param_dma_enable_default 1
++
++/**
++ * When DMA mode is enabled specifies whether to use
++ * address DMA or DMA Descritor mode for accessing the data
++ * FIFOs in device mode. The driver will automatically detect
++ * the value for this parameter if none is specified.
++ * 0 - address DMA
++ * 1 - DMA Descriptor(default, if available)
++ */
++extern int dwc_otg_set_param_dma_desc_enable(dwc_otg_core_if_t * core_if,
++					     int32_t val);
++extern int32_t dwc_otg_get_param_dma_desc_enable(dwc_otg_core_if_t * core_if);
++//#define dwc_param_dma_desc_enable_default 1
++#define dwc_param_dma_desc_enable_default 0 // Broadcom BCM2708
++
++/** The DMA Burst size (applicable only for External DMA
++ * Mode). 1, 4, 8 16, 32, 64, 128, 256 (default 32)
++ */
++extern int dwc_otg_set_param_dma_burst_size(dwc_otg_core_if_t * core_if,
++					    int32_t val);
++extern int32_t dwc_otg_get_param_dma_burst_size(dwc_otg_core_if_t * core_if);
++#define dwc_param_dma_burst_size_default 32
++
++/**
++ * Specifies the maximum speed of operation in host and device mode.
++ * The actual speed depends on the speed of the attached device and
++ * the value of phy_type. The actual speed depends on the speed of the
++ * attached device.
++ * 0 - High Speed (default)
++ * 1 - Full Speed
++ */
++extern int dwc_otg_set_param_speed(dwc_otg_core_if_t * core_if, int32_t val);
++extern int32_t dwc_otg_get_param_speed(dwc_otg_core_if_t * core_if);
++#define dwc_param_speed_default 0
++#define DWC_SPEED_PARAM_HIGH 0
++#define DWC_SPEED_PARAM_FULL 1
++
++/** Specifies whether low power mode is supported when attached
++ *	to a Full Speed or Low Speed device in host mode.
++ * 0 - Don't support low power mode (default)
++ * 1 - Support low power mode
++ */
++extern int dwc_otg_set_param_host_support_fs_ls_low_power(dwc_otg_core_if_t *
++							  core_if, int32_t val);
++extern int32_t dwc_otg_get_param_host_support_fs_ls_low_power(dwc_otg_core_if_t
++							      * core_if);
++#define dwc_param_host_support_fs_ls_low_power_default 0
++
++/** Specifies the PHY clock rate in low power mode when connected to a
++ * Low Speed device in host mode. This parameter is applicable only if
++ * HOST_SUPPORT_FS_LS_LOW_POWER is enabled. If PHY_TYPE is set to FS
++ * then defaults to 6 MHZ otherwise 48 MHZ.
++ *
++ * 0 - 48 MHz
++ * 1 - 6 MHz
++ */
++extern int dwc_otg_set_param_host_ls_low_power_phy_clk(dwc_otg_core_if_t *
++						       core_if, int32_t val);
++extern int32_t dwc_otg_get_param_host_ls_low_power_phy_clk(dwc_otg_core_if_t *
++							   core_if);
++#define dwc_param_host_ls_low_power_phy_clk_default 0
++#define DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_48MHZ 0
++#define DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_6MHZ 1
++
++/**
++ * 0 - Use cC FIFO size parameters
++ * 1 - Allow dynamic FIFO sizing (default)
++ */
++extern int dwc_otg_set_param_enable_dynamic_fifo(dwc_otg_core_if_t * core_if,
++						 int32_t val);
++extern int32_t dwc_otg_get_param_enable_dynamic_fifo(dwc_otg_core_if_t *
++						     core_if);
++#define dwc_param_enable_dynamic_fifo_default 1
++
++/** Total number of 4-byte words in the data FIFO memory. This
++ * memory includes the Rx FIFO, non-periodic Tx FIFO, and periodic
++ * Tx FIFOs.
++ * 32 to 32768 (default 8192)
++ * Note: The total FIFO memory depth in the FPGA configuration is 8192.
++ */
++extern int dwc_otg_set_param_data_fifo_size(dwc_otg_core_if_t * core_if,
++					    int32_t val);
++extern int32_t dwc_otg_get_param_data_fifo_size(dwc_otg_core_if_t * core_if);
++//#define dwc_param_data_fifo_size_default 8192
++#define dwc_param_data_fifo_size_default 0xFF0 // Broadcom BCM2708
++
++/** Number of 4-byte words in the Rx FIFO in device mode when dynamic
++ * FIFO sizing is enabled.
++ * 16 to 32768 (default 1064)
++ */
++extern int dwc_otg_set_param_dev_rx_fifo_size(dwc_otg_core_if_t * core_if,
++					      int32_t val);
++extern int32_t dwc_otg_get_param_dev_rx_fifo_size(dwc_otg_core_if_t * core_if);
++#define dwc_param_dev_rx_fifo_size_default 1064
++
++/** Number of 4-byte words in the non-periodic Tx FIFO in device mode
++ * when dynamic FIFO sizing is enabled.
++ * 16 to 32768 (default 1024)
++ */
++extern int dwc_otg_set_param_dev_nperio_tx_fifo_size(dwc_otg_core_if_t *
++						     core_if, int32_t val);
++extern int32_t dwc_otg_get_param_dev_nperio_tx_fifo_size(dwc_otg_core_if_t *
++							 core_if);
++#define dwc_param_dev_nperio_tx_fifo_size_default 1024
++
++/** Number of 4-byte words in each of the periodic Tx FIFOs in device
++ * mode when dynamic FIFO sizing is enabled.
++ * 4 to 768 (default 256)
++ */
++extern int dwc_otg_set_param_dev_perio_tx_fifo_size(dwc_otg_core_if_t * core_if,
++						    int32_t val, int fifo_num);
++extern int32_t dwc_otg_get_param_dev_perio_tx_fifo_size(dwc_otg_core_if_t *
++							core_if, int fifo_num);
++#define dwc_param_dev_perio_tx_fifo_size_default 256
++
++/** Number of 4-byte words in the Rx FIFO in host mode when dynamic
++ * FIFO sizing is enabled.
++ * 16 to 32768 (default 1024)
++ */
++extern int dwc_otg_set_param_host_rx_fifo_size(dwc_otg_core_if_t * core_if,
++					       int32_t val);
++extern int32_t dwc_otg_get_param_host_rx_fifo_size(dwc_otg_core_if_t * core_if);
++//#define dwc_param_host_rx_fifo_size_default 1024
++#define dwc_param_host_rx_fifo_size_default 774 // Broadcom BCM2708
++
++/** Number of 4-byte words in the non-periodic Tx FIFO in host mode
++ * when Dynamic FIFO sizing is enabled in the core.
++ * 16 to 32768 (default 1024)
++ */
++extern int dwc_otg_set_param_host_nperio_tx_fifo_size(dwc_otg_core_if_t *
++						      core_if, int32_t val);
++extern int32_t dwc_otg_get_param_host_nperio_tx_fifo_size(dwc_otg_core_if_t *
++							  core_if);
++//#define dwc_param_host_nperio_tx_fifo_size_default 1024
++#define dwc_param_host_nperio_tx_fifo_size_default 0x100 // Broadcom BCM2708
++
++/** Number of 4-byte words in the host periodic Tx FIFO when dynamic
++ * FIFO sizing is enabled.
++ * 16 to 32768 (default 1024)
++ */
++extern int dwc_otg_set_param_host_perio_tx_fifo_size(dwc_otg_core_if_t *
++						     core_if, int32_t val);
++extern int32_t dwc_otg_get_param_host_perio_tx_fifo_size(dwc_otg_core_if_t *
++							 core_if);
++//#define dwc_param_host_perio_tx_fifo_size_default 1024
++#define dwc_param_host_perio_tx_fifo_size_default 0x200 // Broadcom BCM2708
++
++/** The maximum transfer size supported in bytes.
++ * 2047 to 65,535  (default 65,535)
++ */
++extern int dwc_otg_set_param_max_transfer_size(dwc_otg_core_if_t * core_if,
++					       int32_t val);
++extern int32_t dwc_otg_get_param_max_transfer_size(dwc_otg_core_if_t * core_if);
++#define dwc_param_max_transfer_size_default 65535
++
++/** The maximum number of packets in a transfer.
++ * 15 to 511  (default 511)
++ */
++extern int dwc_otg_set_param_max_packet_count(dwc_otg_core_if_t * core_if,
++					      int32_t val);
++extern int32_t dwc_otg_get_param_max_packet_count(dwc_otg_core_if_t * core_if);
++#define dwc_param_max_packet_count_default 511
++
++/** The number of host channel registers to use.
++ * 1 to 16 (default 12)
++ * Note: The FPGA configuration supports a maximum of 12 host channels.
++ */
++extern int dwc_otg_set_param_host_channels(dwc_otg_core_if_t * core_if,
++					   int32_t val);
++extern int32_t dwc_otg_get_param_host_channels(dwc_otg_core_if_t * core_if);
++//#define dwc_param_host_channels_default 12
++#define dwc_param_host_channels_default 8 // Broadcom BCM2708
++
++/** The number of endpoints in addition to EP0 available for device
++ * mode operations.
++ * 1 to 15 (default 6 IN and OUT)
++ * Note: The FPGA configuration supports a maximum of 6 IN and OUT
++ * endpoints in addition to EP0.
++ */
++extern int dwc_otg_set_param_dev_endpoints(dwc_otg_core_if_t * core_if,
++					   int32_t val);
++extern int32_t dwc_otg_get_param_dev_endpoints(dwc_otg_core_if_t * core_if);
++#define dwc_param_dev_endpoints_default 6
++
++/**
++ * Specifies the type of PHY interface to use. By default, the driver
++ * will automatically detect the phy_type.
++ *
++ * 0 - Full Speed PHY
++ * 1 - UTMI+ (default)
++ * 2 - ULPI
++ */
++extern int dwc_otg_set_param_phy_type(dwc_otg_core_if_t * core_if, int32_t val);
++extern int32_t dwc_otg_get_param_phy_type(dwc_otg_core_if_t * core_if);
++#define DWC_PHY_TYPE_PARAM_FS 0
++#define DWC_PHY_TYPE_PARAM_UTMI 1
++#define DWC_PHY_TYPE_PARAM_ULPI 2
++#define dwc_param_phy_type_default DWC_PHY_TYPE_PARAM_UTMI
++
++/**
++ * Specifies the UTMI+ Data Width. This parameter is
++ * applicable for a PHY_TYPE of UTMI+ or ULPI. (For a ULPI
++ * PHY_TYPE, this parameter indicates the data width between
++ * the MAC and the ULPI Wrapper.) Also, this parameter is
++ * applicable only if the OTG_HSPHY_WIDTH cC parameter was set
++ * to "8 and 16 bits", meaning that the core has been
++ * configured to work at either data path width.
++ *
++ * 8 or 16 bits (default 16)
++ */
++extern int dwc_otg_set_param_phy_utmi_width(dwc_otg_core_if_t * core_if,
++					    int32_t val);
++extern int32_t dwc_otg_get_param_phy_utmi_width(dwc_otg_core_if_t * core_if);
++//#define dwc_param_phy_utmi_width_default 16
++#define dwc_param_phy_utmi_width_default 8 // Broadcom BCM2708
++
++/**
++ * Specifies whether the ULPI operates at double or single
++ * data rate. This parameter is only applicable if PHY_TYPE is
++ * ULPI.
++ *
++ * 0 - single data rate ULPI interface with 8 bit wide data
++ * bus (default)
++ * 1 - double data rate ULPI interface with 4 bit wide data
++ * bus
++ */
++extern int dwc_otg_set_param_phy_ulpi_ddr(dwc_otg_core_if_t * core_if,
++					  int32_t val);
++extern int32_t dwc_otg_get_param_phy_ulpi_ddr(dwc_otg_core_if_t * core_if);
++#define dwc_param_phy_ulpi_ddr_default 0
++
++/**
++ * Specifies whether to use the internal or external supply to
++ * drive the vbus with a ULPI phy.
++ */
++extern int dwc_otg_set_param_phy_ulpi_ext_vbus(dwc_otg_core_if_t * core_if,
++					       int32_t val);
++extern int32_t dwc_otg_get_param_phy_ulpi_ext_vbus(dwc_otg_core_if_t * core_if);
++#define DWC_PHY_ULPI_INTERNAL_VBUS 0
++#define DWC_PHY_ULPI_EXTERNAL_VBUS 1
++#define dwc_param_phy_ulpi_ext_vbus_default DWC_PHY_ULPI_INTERNAL_VBUS
++
++/**
++ * Specifies whether to use the I2Cinterface for full speed PHY. This
++ * parameter is only applicable if PHY_TYPE is FS.
++ * 0 - No (default)
++ * 1 - Yes
++ */
++extern int dwc_otg_set_param_i2c_enable(dwc_otg_core_if_t * core_if,
++					int32_t val);
++extern int32_t dwc_otg_get_param_i2c_enable(dwc_otg_core_if_t * core_if);
++#define dwc_param_i2c_enable_default 0
++
++extern int dwc_otg_set_param_ulpi_fs_ls(dwc_otg_core_if_t * core_if,
++					int32_t val);
++extern int32_t dwc_otg_get_param_ulpi_fs_ls(dwc_otg_core_if_t * core_if);
++#define dwc_param_ulpi_fs_ls_default 0
++
++extern int dwc_otg_set_param_ts_dline(dwc_otg_core_if_t * core_if, int32_t val);
++extern int32_t dwc_otg_get_param_ts_dline(dwc_otg_core_if_t * core_if);
++#define dwc_param_ts_dline_default 0
++
++/**
++ * Specifies whether dedicated transmit FIFOs are
++ * enabled for non periodic IN endpoints in device mode
++ * 0 - No
++ * 1 - Yes
++ */
++extern int dwc_otg_set_param_en_multiple_tx_fifo(dwc_otg_core_if_t * core_if,
++						 int32_t val);
++extern int32_t dwc_otg_get_param_en_multiple_tx_fifo(dwc_otg_core_if_t *
++						     core_if);
++#define dwc_param_en_multiple_tx_fifo_default 1
++
++/** Number of 4-byte words in each of the Tx FIFOs in device
++ * mode when dynamic FIFO sizing is enabled.
++ * 4 to 768 (default 256)
++ */
++extern int dwc_otg_set_param_dev_tx_fifo_size(dwc_otg_core_if_t * core_if,
++					      int fifo_num, int32_t val);
++extern int32_t dwc_otg_get_param_dev_tx_fifo_size(dwc_otg_core_if_t * core_if,
++						  int fifo_num);
++#define dwc_param_dev_tx_fifo_size_default 768
++
++/** Thresholding enable flag-
++ * bit 0 - enable non-ISO Tx thresholding
++ * bit 1 - enable ISO Tx thresholding
++ * bit 2 - enable Rx thresholding
++ */
++extern int dwc_otg_set_param_thr_ctl(dwc_otg_core_if_t * core_if, int32_t val);
++extern int32_t dwc_otg_get_thr_ctl(dwc_otg_core_if_t * core_if, int fifo_num);
++#define dwc_param_thr_ctl_default 0
++
++/** Thresholding length for Tx
++ * FIFOs in 32 bit DWORDs
++ */
++extern int dwc_otg_set_param_tx_thr_length(dwc_otg_core_if_t * core_if,
++					   int32_t val);
++extern int32_t dwc_otg_get_tx_thr_length(dwc_otg_core_if_t * core_if);
++#define dwc_param_tx_thr_length_default 64
++
++/** Thresholding length for Rx
++ *	FIFOs in 32 bit DWORDs
++ */
++extern int dwc_otg_set_param_rx_thr_length(dwc_otg_core_if_t * core_if,
++					   int32_t val);
++extern int32_t dwc_otg_get_rx_thr_length(dwc_otg_core_if_t * core_if);
++#define dwc_param_rx_thr_length_default 64
++
++/**
++ * Specifies whether LPM (Link Power Management) support is enabled
++ */
++extern int dwc_otg_set_param_lpm_enable(dwc_otg_core_if_t * core_if,
++					int32_t val);
++extern int32_t dwc_otg_get_param_lpm_enable(dwc_otg_core_if_t * core_if);
++#define dwc_param_lpm_enable_default 1
++
++/**
++ * Specifies whether PTI enhancement is enabled
++ */
++extern int dwc_otg_set_param_pti_enable(dwc_otg_core_if_t * core_if,
++					int32_t val);
++extern int32_t dwc_otg_get_param_pti_enable(dwc_otg_core_if_t * core_if);
++#define dwc_param_pti_enable_default 0
++
++/**
++ * Specifies whether MPI enhancement is enabled
++ */
++extern int dwc_otg_set_param_mpi_enable(dwc_otg_core_if_t * core_if,
++					int32_t val);
++extern int32_t dwc_otg_get_param_mpi_enable(dwc_otg_core_if_t * core_if);
++#define dwc_param_mpi_enable_default 0
++
++/**
++ * Specifies whether ADP capability is enabled
++ */
++extern int dwc_otg_set_param_adp_enable(dwc_otg_core_if_t * core_if,
++					int32_t val);
++extern int32_t dwc_otg_get_param_adp_enable(dwc_otg_core_if_t * core_if);
++#define dwc_param_adp_enable_default 0
++
++/**
++ * Specifies whether IC_USB capability is enabled
++ */
++
++extern int dwc_otg_set_param_ic_usb_cap(dwc_otg_core_if_t * core_if,
++					int32_t val);
++extern int32_t dwc_otg_get_param_ic_usb_cap(dwc_otg_core_if_t * core_if);
++#define dwc_param_ic_usb_cap_default 0
++
++extern int dwc_otg_set_param_ahb_thr_ratio(dwc_otg_core_if_t * core_if,
++					   int32_t val);
++extern int32_t dwc_otg_get_param_ahb_thr_ratio(dwc_otg_core_if_t * core_if);
++#define dwc_param_ahb_thr_ratio_default 0
++
++extern int dwc_otg_set_param_power_down(dwc_otg_core_if_t * core_if,
++					int32_t val);
++extern int32_t dwc_otg_get_param_power_down(dwc_otg_core_if_t * core_if);
++#define dwc_param_power_down_default 0
++
++extern int dwc_otg_set_param_reload_ctl(dwc_otg_core_if_t * core_if,
++					int32_t val);
++extern int32_t dwc_otg_get_param_reload_ctl(dwc_otg_core_if_t * core_if);
++#define dwc_param_reload_ctl_default 0
++
++extern int dwc_otg_set_param_dev_out_nak(dwc_otg_core_if_t * core_if,
++										int32_t val);
++extern int32_t dwc_otg_get_param_dev_out_nak(dwc_otg_core_if_t * core_if);
++#define dwc_param_dev_out_nak_default 0
++
++extern int dwc_otg_set_param_cont_on_bna(dwc_otg_core_if_t * core_if,
++										 int32_t val);
++extern int32_t dwc_otg_get_param_cont_on_bna(dwc_otg_core_if_t * core_if);
++#define dwc_param_cont_on_bna_default 0
++
++extern int dwc_otg_set_param_ahb_single(dwc_otg_core_if_t * core_if,
++										 int32_t val);
++extern int32_t dwc_otg_get_param_ahb_single(dwc_otg_core_if_t * core_if);
++#define dwc_param_ahb_single_default 0
++
++extern int dwc_otg_set_param_otg_ver(dwc_otg_core_if_t * core_if, int32_t val);
++extern int32_t dwc_otg_get_param_otg_ver(dwc_otg_core_if_t * core_if);
++#define dwc_param_otg_ver_default 0
++
++/** @} */
++
++/** @name Access to registers and bit-fields */
++
++/**
++ * Dump core registers and SPRAM
++ */
++extern void dwc_otg_dump_dev_registers(dwc_otg_core_if_t * _core_if);
++extern void dwc_otg_dump_spram(dwc_otg_core_if_t * _core_if);
++extern void dwc_otg_dump_host_registers(dwc_otg_core_if_t * _core_if);
++extern void dwc_otg_dump_global_registers(dwc_otg_core_if_t * _core_if);
++
++/**
++ * Get host negotiation status.
++ */
++extern uint32_t dwc_otg_get_hnpstatus(dwc_otg_core_if_t * core_if);
++
++/**
++ * Get srp status
++ */
++extern uint32_t dwc_otg_get_srpstatus(dwc_otg_core_if_t * core_if);
++
++/**
++ * Set hnpreq bit in the GOTGCTL register.
++ */
++extern void dwc_otg_set_hnpreq(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Get Content of SNPSID register.
++ */
++extern uint32_t dwc_otg_get_gsnpsid(dwc_otg_core_if_t * core_if);
++
++/**
++ * Get current mode.
++ * Returns 0 if in device mode, and 1 if in host mode.
++ */
++extern uint32_t dwc_otg_get_mode(dwc_otg_core_if_t * core_if);
++
++/**
++ * Get value of hnpcapable field in the GUSBCFG register
++ */
++extern uint32_t dwc_otg_get_hnpcapable(dwc_otg_core_if_t * core_if);
++/**
++ * Set value of hnpcapable field in the GUSBCFG register
++ */
++extern void dwc_otg_set_hnpcapable(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Get value of srpcapable field in the GUSBCFG register
++ */
++extern uint32_t dwc_otg_get_srpcapable(dwc_otg_core_if_t * core_if);
++/**
++ * Set value of srpcapable field in the GUSBCFG register
++ */
++extern void dwc_otg_set_srpcapable(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Get value of devspeed field in the DCFG register
++ */
++extern uint32_t dwc_otg_get_devspeed(dwc_otg_core_if_t * core_if);
++/**
++ * Set value of devspeed field in the DCFG register
++ */
++extern void dwc_otg_set_devspeed(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Get the value of busconnected field from the HPRT0 register
++ */
++extern uint32_t dwc_otg_get_busconnected(dwc_otg_core_if_t * core_if);
++
++/**
++ * Gets the device enumeration Speed.
++ */
++extern uint32_t dwc_otg_get_enumspeed(dwc_otg_core_if_t * core_if);
++
++/**
++ * Get value of prtpwr field from the HPRT0 register
++ */
++extern uint32_t dwc_otg_get_prtpower(dwc_otg_core_if_t * core_if);
++
++/**
++ * Get value of flag indicating core state - hibernated or not
++ */
++extern uint32_t dwc_otg_get_core_state(dwc_otg_core_if_t * core_if);
++
++/**
++ * Set value of prtpwr field from the HPRT0 register
++ */
++extern void dwc_otg_set_prtpower(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Get value of prtsusp field from the HPRT0 regsiter
++ */
++extern uint32_t dwc_otg_get_prtsuspend(dwc_otg_core_if_t * core_if);
++/**
++ * Set value of prtpwr field from the HPRT0 register
++ */
++extern void dwc_otg_set_prtsuspend(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Get value of ModeChTimEn field from the HCFG regsiter
++ */
++extern uint32_t dwc_otg_get_mode_ch_tim(dwc_otg_core_if_t * core_if);
++/**
++ * Set value of ModeChTimEn field from the HCFG regsiter
++ */
++extern void dwc_otg_set_mode_ch_tim(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Get value of Fram Interval field from the HFIR regsiter
++ */
++extern uint32_t dwc_otg_get_fr_interval(dwc_otg_core_if_t * core_if);
++/**
++ * Set value of Frame Interval field from the HFIR regsiter
++ */
++extern void dwc_otg_set_fr_interval(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Set value of prtres field from the HPRT0 register
++ *FIXME Remove?
++ */
++extern void dwc_otg_set_prtresume(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Get value of rmtwkupsig bit in DCTL register
++ */
++extern uint32_t dwc_otg_get_remotewakesig(dwc_otg_core_if_t * core_if);
++
++/**
++ * Get value of prt_sleep_sts field from the GLPMCFG register
++ */
++extern uint32_t dwc_otg_get_lpm_portsleepstatus(dwc_otg_core_if_t * core_if);
++
++/**
++ * Get value of rem_wkup_en field from the GLPMCFG register
++ */
++extern uint32_t dwc_otg_get_lpm_remotewakeenabled(dwc_otg_core_if_t * core_if);
++
++/**
++ * Get value of appl_resp field from the GLPMCFG register
++ */
++extern uint32_t dwc_otg_get_lpmresponse(dwc_otg_core_if_t * core_if);
++/**
++ * Set value of appl_resp field from the GLPMCFG register
++ */
++extern void dwc_otg_set_lpmresponse(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Get value of hsic_connect field from the GLPMCFG register
++ */
++extern uint32_t dwc_otg_get_hsic_connect(dwc_otg_core_if_t * core_if);
++/**
++ * Set value of hsic_connect field from the GLPMCFG register
++ */
++extern void dwc_otg_set_hsic_connect(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Get value of inv_sel_hsic field from the GLPMCFG register.
++ */
++extern uint32_t dwc_otg_get_inv_sel_hsic(dwc_otg_core_if_t * core_if);
++/**
++ * Set value of inv_sel_hsic field from the GLPMFG register.
++ */
++extern void dwc_otg_set_inv_sel_hsic(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/*
++ * Some functions for accessing registers
++ */
++
++/**
++ *  GOTGCTL register
++ */
++extern uint32_t dwc_otg_get_gotgctl(dwc_otg_core_if_t * core_if);
++extern void dwc_otg_set_gotgctl(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * GUSBCFG register
++ */
++extern uint32_t dwc_otg_get_gusbcfg(dwc_otg_core_if_t * core_if);
++extern void dwc_otg_set_gusbcfg(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * GRXFSIZ register
++ */
++extern uint32_t dwc_otg_get_grxfsiz(dwc_otg_core_if_t * core_if);
++extern void dwc_otg_set_grxfsiz(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * GNPTXFSIZ register
++ */
++extern uint32_t dwc_otg_get_gnptxfsiz(dwc_otg_core_if_t * core_if);
++extern void dwc_otg_set_gnptxfsiz(dwc_otg_core_if_t * core_if, uint32_t val);
++
++extern uint32_t dwc_otg_get_gpvndctl(dwc_otg_core_if_t * core_if);
++extern void dwc_otg_set_gpvndctl(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * GGPIO register
++ */
++extern uint32_t dwc_otg_get_ggpio(dwc_otg_core_if_t * core_if);
++extern void dwc_otg_set_ggpio(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * GUID register
++ */
++extern uint32_t dwc_otg_get_guid(dwc_otg_core_if_t * core_if);
++extern void dwc_otg_set_guid(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * HPRT0 register
++ */
++extern uint32_t dwc_otg_get_hprt0(dwc_otg_core_if_t * core_if);
++extern void dwc_otg_set_hprt0(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * GHPTXFSIZE
++ */
++extern uint32_t dwc_otg_get_hptxfsiz(dwc_otg_core_if_t * core_if);
++
++/** @} */
++
++#endif				/* __DWC_CORE_IF_H__ */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_dbg.h
+@@ -0,0 +1,117 @@
++/* ==========================================================================
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++#ifndef __DWC_OTG_DBG_H__
++#define __DWC_OTG_DBG_H__
++
++/** @file
++ * This file defines debug levels.
++ * Debugging support vanishes in non-debug builds.
++ */
++
++/**
++ * The Debug Level bit-mask variable.
++ */
++extern uint32_t g_dbg_lvl;
++/**
++ * Set the Debug Level variable.
++ */
++static inline uint32_t SET_DEBUG_LEVEL(const uint32_t new)
++{
++	uint32_t old = g_dbg_lvl;
++	g_dbg_lvl = new;
++	return old;
++}
++
++#define DBG_USER	(0x1)
++/** When debug level has the DBG_CIL bit set, display CIL Debug messages. */
++#define DBG_CIL		(0x2)
++/** When debug level has the DBG_CILV bit set, display CIL Verbose debug
++ * messages */
++#define DBG_CILV	(0x20)
++/**  When debug level has the DBG_PCD bit set, display PCD (Device) debug
++ *  messages */
++#define DBG_PCD		(0x4)
++/** When debug level has the DBG_PCDV set, display PCD (Device) Verbose debug
++ * messages */
++#define DBG_PCDV	(0x40)
++/** When debug level has the DBG_HCD bit set, display Host debug messages */
++#define DBG_HCD		(0x8)
++/** When debug level has the DBG_HCDV bit set, display Verbose Host debug
++ * messages */
++#define DBG_HCDV	(0x80)
++/** When debug level has the DBG_HCD_URB bit set, display enqueued URBs in host
++ *  mode. */
++#define DBG_HCD_URB	(0x800)
++/** When debug level has the DBG_HCDI bit set, display host interrupt
++ *  messages. */
++#define DBG_HCDI	(0x1000)
++
++/** When debug level has any bit set, display debug messages */
++#define DBG_ANY		(0xFF)
++
++/** All debug messages off */
++#define DBG_OFF		0
++
++/** Prefix string for DWC_DEBUG print macros. */
++#define USB_DWC "DWC_otg: "
++
++/**
++ * Print a debug message when the Global debug level variable contains
++ * the bit defined in <code>lvl</code>.
++ *
++ * @param[in] lvl - Debug level, use one of the DBG_ constants above.
++ * @param[in] x - like printf
++ *
++ *    Example:<p>
++ * <code>
++ *      DWC_DEBUGPL( DBG_ANY, "%s(%p)\n", __func__, _reg_base_addr);
++ * </code>
++ * <br>
++ * results in:<br>
++ * <code>
++ * usb-DWC_otg: dwc_otg_cil_init(ca867000)
++ * </code>
++ */
++#ifdef DEBUG
++
++# define DWC_DEBUGPL(lvl, x...) do{ if ((lvl)&g_dbg_lvl)__DWC_DEBUG(USB_DWC x ); }while(0)
++# define DWC_DEBUGP(x...)	DWC_DEBUGPL(DBG_ANY, x )
++
++# define CHK_DEBUG_LEVEL(level) ((level) & g_dbg_lvl)
++
++#else
++
++# define DWC_DEBUGPL(lvl, x...) do{}while(0)
++# define DWC_DEBUGP(x...)
++
++# define CHK_DEBUG_LEVEL(level) (0)
++
++#endif /*DEBUG*/
++#endif
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_driver.c
+@@ -0,0 +1,1772 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_driver.c $
++ * $Revision: #92 $
++ * $Date: 2012/08/10 $
++ * $Change: 2047372 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++/** @file
++ * The dwc_otg_driver module provides the initialization and cleanup entry
++ * points for the DWC_otg driver. This module will be dynamically installed
++ * after Linux is booted using the insmod command. When the module is
++ * installed, the dwc_otg_driver_init function is called. When the module is
++ * removed (using rmmod), the dwc_otg_driver_cleanup function is called.
++ *
++ * This module also defines a data structure for the dwc_otg_driver, which is
++ * used in conjunction with the standard ARM lm_device structure. These
++ * structures allow the OTG driver to comply with the standard Linux driver
++ * model in which devices and drivers are registered with a bus driver. This
++ * has the benefit that Linux can expose attributes of the driver and device
++ * in its special sysfs file system. Users can then read or write files in
++ * this file system to perform diagnostics on the driver components or the
++ * device.
++ */
++
++#include "dwc_otg_os_dep.h"
++#include "dwc_os.h"
++#include "dwc_otg_dbg.h"
++#include "dwc_otg_driver.h"
++#include "dwc_otg_attr.h"
++#include "dwc_otg_core_if.h"
++#include "dwc_otg_pcd_if.h"
++#include "dwc_otg_hcd_if.h"
++#include "dwc_otg_fiq_fsm.h"
++
++#define DWC_DRIVER_VERSION	"3.00a 10-AUG-2012"
++#define DWC_DRIVER_DESC		"HS OTG USB Controller driver"
++
++bool microframe_schedule=true;
++
++static const char dwc_driver_name[] = "dwc_otg";
++
++
++extern int pcd_init(
++#ifdef LM_INTERFACE
++			   struct lm_device *_dev
++#elif  defined(PCI_INTERFACE)
++			   struct pci_dev *_dev
++#elif  defined(PLATFORM_INTERFACE)
++	struct platform_device *dev
++#endif
++    );
++extern int hcd_init(
++#ifdef LM_INTERFACE
++			   struct lm_device *_dev
++#elif  defined(PCI_INTERFACE)
++			   struct pci_dev *_dev
++#elif  defined(PLATFORM_INTERFACE)
++	struct platform_device *dev
++#endif
++    );
++
++extern int pcd_remove(
++#ifdef LM_INTERFACE
++			     struct lm_device *_dev
++#elif  defined(PCI_INTERFACE)
++			     struct pci_dev *_dev
++#elif  defined(PLATFORM_INTERFACE)
++	struct platform_device *_dev
++#endif
++    );
++
++extern void hcd_remove(
++#ifdef LM_INTERFACE
++			      struct lm_device *_dev
++#elif  defined(PCI_INTERFACE)
++			      struct pci_dev *_dev
++#elif  defined(PLATFORM_INTERFACE)
++	struct platform_device *_dev
++#endif
++    );
++
++extern void dwc_otg_adp_start(dwc_otg_core_if_t * core_if, uint8_t is_host);
++
++/*-------------------------------------------------------------------------*/
++/* Encapsulate the module parameter settings */
++
++struct dwc_otg_driver_module_params {
++	int32_t opt;
++	int32_t otg_cap;
++	int32_t dma_enable;
++	int32_t dma_desc_enable;
++	int32_t dma_burst_size;
++	int32_t speed;
++	int32_t host_support_fs_ls_low_power;
++	int32_t host_ls_low_power_phy_clk;
++	int32_t enable_dynamic_fifo;
++	int32_t data_fifo_size;
++	int32_t dev_rx_fifo_size;
++	int32_t dev_nperio_tx_fifo_size;
++	uint32_t dev_perio_tx_fifo_size[MAX_PERIO_FIFOS];
++	int32_t host_rx_fifo_size;
++	int32_t host_nperio_tx_fifo_size;
++	int32_t host_perio_tx_fifo_size;
++	int32_t max_transfer_size;
++	int32_t max_packet_count;
++	int32_t host_channels;
++	int32_t dev_endpoints;
++	int32_t phy_type;
++	int32_t phy_utmi_width;
++	int32_t phy_ulpi_ddr;
++	int32_t phy_ulpi_ext_vbus;
++	int32_t i2c_enable;
++	int32_t ulpi_fs_ls;
++	int32_t ts_dline;
++	int32_t en_multiple_tx_fifo;
++	uint32_t dev_tx_fifo_size[MAX_TX_FIFOS];
++	uint32_t thr_ctl;
++	uint32_t tx_thr_length;
++	uint32_t rx_thr_length;
++	int32_t pti_enable;
++	int32_t mpi_enable;
++	int32_t lpm_enable;
++	int32_t ic_usb_cap;
++	int32_t ahb_thr_ratio;
++	int32_t power_down;
++	int32_t reload_ctl;
++	int32_t dev_out_nak;
++	int32_t cont_on_bna;
++	int32_t ahb_single;
++	int32_t otg_ver;
++	int32_t adp_enable;
++};
++
++static struct dwc_otg_driver_module_params dwc_otg_module_params = {
++	.opt = -1,
++	.otg_cap = -1,
++	.dma_enable = -1,
++	.dma_desc_enable = -1,
++	.dma_burst_size = -1,
++	.speed = -1,
++	.host_support_fs_ls_low_power = -1,
++	.host_ls_low_power_phy_clk = -1,
++	.enable_dynamic_fifo = -1,
++	.data_fifo_size = -1,
++	.dev_rx_fifo_size = -1,
++	.dev_nperio_tx_fifo_size = -1,
++	.dev_perio_tx_fifo_size = {
++				   /* dev_perio_tx_fifo_size_1 */
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1
++				   /* 15 */
++				   },
++	.host_rx_fifo_size = -1,
++	.host_nperio_tx_fifo_size = -1,
++	.host_perio_tx_fifo_size = -1,
++	.max_transfer_size = -1,
++	.max_packet_count = -1,
++	.host_channels = -1,
++	.dev_endpoints = -1,
++	.phy_type = -1,
++	.phy_utmi_width = -1,
++	.phy_ulpi_ddr = -1,
++	.phy_ulpi_ext_vbus = -1,
++	.i2c_enable = -1,
++	.ulpi_fs_ls = -1,
++	.ts_dline = -1,
++	.en_multiple_tx_fifo = -1,
++	.dev_tx_fifo_size = {
++			     /* dev_tx_fifo_size */
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1
++			     /* 15 */
++			     },
++	.thr_ctl = -1,
++	.tx_thr_length = -1,
++	.rx_thr_length = -1,
++	.pti_enable = -1,
++	.mpi_enable = -1,
++	.lpm_enable = 0,
++	.ic_usb_cap = -1,
++	.ahb_thr_ratio = -1,
++	.power_down = -1,
++	.reload_ctl = -1,
++	.dev_out_nak = -1,
++	.cont_on_bna = -1,
++	.ahb_single = -1,
++	.otg_ver = -1,
++	.adp_enable = -1,
++};
++
++//Global variable to switch the fiq fix on or off
++bool fiq_enable = 1;
++// Global variable to enable the split transaction fix
++bool fiq_fsm_enable = true;
++//Bulk split-transaction NAK holdoff in microframes
++uint16_t nak_holdoff = 8;
++
++//Force host mode during CIL re-init
++bool cil_force_host = true;
++
++unsigned short fiq_fsm_mask = 0x0F;
++
++unsigned short int_ep_interval_min = 0;
++/**
++ * This function shows the Driver Version.
++ */
++static ssize_t version_show(struct device_driver *dev, char *buf)
++{
++	return snprintf(buf, sizeof(DWC_DRIVER_VERSION) + 2, "%s\n",
++			DWC_DRIVER_VERSION);
++}
++
++static DRIVER_ATTR_RO(version);
++
++/**
++ * Global Debug Level Mask.
++ */
++uint32_t g_dbg_lvl = 0;		/* OFF */
++
++/**
++ * This function shows the driver Debug Level.
++ */
++static ssize_t debuglevel_show(struct device_driver *drv, char *buf)
++{
++	return sprintf(buf, "0x%0x\n", g_dbg_lvl);
++}
++
++/**
++ * This function stores the driver Debug Level.
++ */
++static ssize_t debuglevel_store(struct device_driver *drv, const char *buf,
++			       size_t count)
++{
++	g_dbg_lvl = simple_strtoul(buf, NULL, 16);
++	return count;
++}
++
++static DRIVER_ATTR_RW(debuglevel);
++
++/**
++ * This function is called during module intialization
++ * to pass module parameters to the DWC_OTG CORE.
++ */
++static int set_parameters(dwc_otg_core_if_t * core_if)
++{
++	int retval = 0;
++	int i;
++
++	if (dwc_otg_module_params.otg_cap != -1) {
++		retval +=
++		    dwc_otg_set_param_otg_cap(core_if,
++					      dwc_otg_module_params.otg_cap);
++	}
++	if (dwc_otg_module_params.dma_enable != -1) {
++		retval +=
++		    dwc_otg_set_param_dma_enable(core_if,
++						 dwc_otg_module_params.
++						 dma_enable);
++	}
++	if (dwc_otg_module_params.dma_desc_enable != -1) {
++		retval +=
++		    dwc_otg_set_param_dma_desc_enable(core_if,
++						      dwc_otg_module_params.
++						      dma_desc_enable);
++	}
++	if (dwc_otg_module_params.opt != -1) {
++		retval +=
++		    dwc_otg_set_param_opt(core_if, dwc_otg_module_params.opt);
++	}
++	if (dwc_otg_module_params.dma_burst_size != -1) {
++		retval +=
++		    dwc_otg_set_param_dma_burst_size(core_if,
++						     dwc_otg_module_params.
++						     dma_burst_size);
++	}
++	if (dwc_otg_module_params.host_support_fs_ls_low_power != -1) {
++		retval +=
++		    dwc_otg_set_param_host_support_fs_ls_low_power(core_if,
++								   dwc_otg_module_params.
++								   host_support_fs_ls_low_power);
++	}
++	if (dwc_otg_module_params.enable_dynamic_fifo != -1) {
++		retval +=
++		    dwc_otg_set_param_enable_dynamic_fifo(core_if,
++							  dwc_otg_module_params.
++							  enable_dynamic_fifo);
++	}
++	if (dwc_otg_module_params.data_fifo_size != -1) {
++		retval +=
++		    dwc_otg_set_param_data_fifo_size(core_if,
++						     dwc_otg_module_params.
++						     data_fifo_size);
++	}
++	if (dwc_otg_module_params.dev_rx_fifo_size != -1) {
++		retval +=
++		    dwc_otg_set_param_dev_rx_fifo_size(core_if,
++						       dwc_otg_module_params.
++						       dev_rx_fifo_size);
++	}
++	if (dwc_otg_module_params.dev_nperio_tx_fifo_size != -1) {
++		retval +=
++		    dwc_otg_set_param_dev_nperio_tx_fifo_size(core_if,
++							      dwc_otg_module_params.
++							      dev_nperio_tx_fifo_size);
++	}
++	if (dwc_otg_module_params.host_rx_fifo_size != -1) {
++		retval +=
++		    dwc_otg_set_param_host_rx_fifo_size(core_if,
++							dwc_otg_module_params.host_rx_fifo_size);
++	}
++	if (dwc_otg_module_params.host_nperio_tx_fifo_size != -1) {
++		retval +=
++		    dwc_otg_set_param_host_nperio_tx_fifo_size(core_if,
++							       dwc_otg_module_params.
++							       host_nperio_tx_fifo_size);
++	}
++	if (dwc_otg_module_params.host_perio_tx_fifo_size != -1) {
++		retval +=
++		    dwc_otg_set_param_host_perio_tx_fifo_size(core_if,
++							      dwc_otg_module_params.
++							      host_perio_tx_fifo_size);
++	}
++	if (dwc_otg_module_params.max_transfer_size != -1) {
++		retval +=
++		    dwc_otg_set_param_max_transfer_size(core_if,
++							dwc_otg_module_params.
++							max_transfer_size);
++	}
++	if (dwc_otg_module_params.max_packet_count != -1) {
++		retval +=
++		    dwc_otg_set_param_max_packet_count(core_if,
++						       dwc_otg_module_params.
++						       max_packet_count);
++	}
++	if (dwc_otg_module_params.host_channels != -1) {
++		retval +=
++		    dwc_otg_set_param_host_channels(core_if,
++						    dwc_otg_module_params.
++						    host_channels);
++	}
++	if (dwc_otg_module_params.dev_endpoints != -1) {
++		retval +=
++		    dwc_otg_set_param_dev_endpoints(core_if,
++						    dwc_otg_module_params.
++						    dev_endpoints);
++	}
++	if (dwc_otg_module_params.phy_type != -1) {
++		retval +=
++		    dwc_otg_set_param_phy_type(core_if,
++					       dwc_otg_module_params.phy_type);
++	}
++	if (dwc_otg_module_params.speed != -1) {
++		retval +=
++		    dwc_otg_set_param_speed(core_if,
++					    dwc_otg_module_params.speed);
++	}
++	if (dwc_otg_module_params.host_ls_low_power_phy_clk != -1) {
++		retval +=
++		    dwc_otg_set_param_host_ls_low_power_phy_clk(core_if,
++								dwc_otg_module_params.
++								host_ls_low_power_phy_clk);
++	}
++	if (dwc_otg_module_params.phy_ulpi_ddr != -1) {
++		retval +=
++		    dwc_otg_set_param_phy_ulpi_ddr(core_if,
++						   dwc_otg_module_params.
++						   phy_ulpi_ddr);
++	}
++	if (dwc_otg_module_params.phy_ulpi_ext_vbus != -1) {
++		retval +=
++		    dwc_otg_set_param_phy_ulpi_ext_vbus(core_if,
++							dwc_otg_module_params.
++							phy_ulpi_ext_vbus);
++	}
++	if (dwc_otg_module_params.phy_utmi_width != -1) {
++		retval +=
++		    dwc_otg_set_param_phy_utmi_width(core_if,
++						     dwc_otg_module_params.
++						     phy_utmi_width);
++	}
++	if (dwc_otg_module_params.ulpi_fs_ls != -1) {
++		retval +=
++		    dwc_otg_set_param_ulpi_fs_ls(core_if,
++						 dwc_otg_module_params.ulpi_fs_ls);
++	}
++	if (dwc_otg_module_params.ts_dline != -1) {
++		retval +=
++		    dwc_otg_set_param_ts_dline(core_if,
++					       dwc_otg_module_params.ts_dline);
++	}
++	if (dwc_otg_module_params.i2c_enable != -1) {
++		retval +=
++		    dwc_otg_set_param_i2c_enable(core_if,
++						 dwc_otg_module_params.
++						 i2c_enable);
++	}
++	if (dwc_otg_module_params.en_multiple_tx_fifo != -1) {
++		retval +=
++		    dwc_otg_set_param_en_multiple_tx_fifo(core_if,
++							  dwc_otg_module_params.
++							  en_multiple_tx_fifo);
++	}
++	for (i = 0; i < 15; i++) {
++		if (dwc_otg_module_params.dev_perio_tx_fifo_size[i] != -1) {
++			retval +=
++			    dwc_otg_set_param_dev_perio_tx_fifo_size(core_if,
++								     dwc_otg_module_params.
++								     dev_perio_tx_fifo_size
++								     [i], i);
++		}
++	}
++
++	for (i = 0; i < 15; i++) {
++		if (dwc_otg_module_params.dev_tx_fifo_size[i] != -1) {
++			retval += dwc_otg_set_param_dev_tx_fifo_size(core_if,
++								     dwc_otg_module_params.
++								     dev_tx_fifo_size
++								     [i], i);
++		}
++	}
++	if (dwc_otg_module_params.thr_ctl != -1) {
++		retval +=
++		    dwc_otg_set_param_thr_ctl(core_if,
++					      dwc_otg_module_params.thr_ctl);
++	}
++	if (dwc_otg_module_params.mpi_enable != -1) {
++		retval +=
++		    dwc_otg_set_param_mpi_enable(core_if,
++						 dwc_otg_module_params.
++						 mpi_enable);
++	}
++	if (dwc_otg_module_params.pti_enable != -1) {
++		retval +=
++		    dwc_otg_set_param_pti_enable(core_if,
++						 dwc_otg_module_params.
++						 pti_enable);
++	}
++	if (dwc_otg_module_params.lpm_enable != -1) {
++		retval +=
++		    dwc_otg_set_param_lpm_enable(core_if,
++						 dwc_otg_module_params.
++						 lpm_enable);
++	}
++	if (dwc_otg_module_params.ic_usb_cap != -1) {
++		retval +=
++		    dwc_otg_set_param_ic_usb_cap(core_if,
++						 dwc_otg_module_params.
++						 ic_usb_cap);
++	}
++	if (dwc_otg_module_params.tx_thr_length != -1) {
++		retval +=
++		    dwc_otg_set_param_tx_thr_length(core_if,
++						    dwc_otg_module_params.tx_thr_length);
++	}
++	if (dwc_otg_module_params.rx_thr_length != -1) {
++		retval +=
++		    dwc_otg_set_param_rx_thr_length(core_if,
++						    dwc_otg_module_params.
++						    rx_thr_length);
++	}
++	if (dwc_otg_module_params.ahb_thr_ratio != -1) {
++		retval +=
++		    dwc_otg_set_param_ahb_thr_ratio(core_if,
++						    dwc_otg_module_params.ahb_thr_ratio);
++	}
++	if (dwc_otg_module_params.power_down != -1) {
++		retval +=
++		    dwc_otg_set_param_power_down(core_if,
++						 dwc_otg_module_params.power_down);
++	}
++	if (dwc_otg_module_params.reload_ctl != -1) {
++		retval +=
++		    dwc_otg_set_param_reload_ctl(core_if,
++						 dwc_otg_module_params.reload_ctl);
++	}
++
++	if (dwc_otg_module_params.dev_out_nak != -1) {
++		retval +=
++			dwc_otg_set_param_dev_out_nak(core_if,
++			dwc_otg_module_params.dev_out_nak);
++	}
++
++	if (dwc_otg_module_params.cont_on_bna != -1) {
++		retval +=
++			dwc_otg_set_param_cont_on_bna(core_if,
++			dwc_otg_module_params.cont_on_bna);
++	}
++
++	if (dwc_otg_module_params.ahb_single != -1) {
++		retval +=
++			dwc_otg_set_param_ahb_single(core_if,
++			dwc_otg_module_params.ahb_single);
++	}
++
++	if (dwc_otg_module_params.otg_ver != -1) {
++		retval +=
++		    dwc_otg_set_param_otg_ver(core_if,
++					      dwc_otg_module_params.otg_ver);
++	}
++	if (dwc_otg_module_params.adp_enable != -1) {
++		retval +=
++		    dwc_otg_set_param_adp_enable(core_if,
++						 dwc_otg_module_params.
++						 adp_enable);
++	}
++	return retval;
++}
++
++/**
++ * This function is the top level interrupt handler for the Common
++ * (Device and host modes) interrupts.
++ */
++static irqreturn_t dwc_otg_common_irq(int irq, void *dev)
++{
++	int32_t retval = IRQ_NONE;
++
++	retval = dwc_otg_handle_common_intr(dev);
++	if (retval != 0) {
++		S3C2410X_CLEAR_EINTPEND();
++	}
++	return IRQ_RETVAL(retval);
++}
++
++/**
++ * This function is called when a lm_device is unregistered with the
++ * dwc_otg_driver. This happens, for example, when the rmmod command is
++ * executed. The device may or may not be electrically present. If it is
++ * present, the driver stops device processing. Any resources used on behalf
++ * of this device are freed.
++ *
++ * @param _dev
++ */
++#ifdef LM_INTERFACE
++#define REM_RETVAL(n)
++static void dwc_otg_driver_remove(	 struct lm_device *_dev )
++{       dwc_otg_device_t *otg_dev = lm_get_drvdata(_dev);
++#elif  defined(PCI_INTERFACE)
++#define REM_RETVAL(n)
++static void dwc_otg_driver_remove(	 struct pci_dev *_dev )
++{	dwc_otg_device_t *otg_dev = pci_get_drvdata(_dev);
++#elif  defined(PLATFORM_INTERFACE)
++#define REM_RETVAL(n) n
++static int dwc_otg_driver_remove(        struct platform_device *_dev )
++{       dwc_otg_device_t *otg_dev = platform_get_drvdata(_dev);
++#endif
++
++	DWC_DEBUGPL(DBG_ANY, "%s(%p) otg_dev %p\n", __func__, _dev, otg_dev);
++
++	if (!otg_dev) {
++		/* Memory allocation for the dwc_otg_device failed. */
++		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev NULL!\n", __func__);
++                return REM_RETVAL(-ENOMEM);
++	}
++#ifndef DWC_DEVICE_ONLY
++	if (otg_dev->hcd) {
++		hcd_remove(_dev);
++	} else {
++		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev->hcd NULL!\n", __func__);
++                return REM_RETVAL(-EINVAL);
++	}
++#endif
++
++#ifndef DWC_HOST_ONLY
++	if (otg_dev->pcd) {
++		pcd_remove(_dev);
++	} else {
++		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev->pcd NULL!\n", __func__);
++                return REM_RETVAL(-EINVAL);
++	}
++#endif
++	/*
++	 * Free the IRQ
++	 */
++	if (otg_dev->common_irq_installed) {
++		free_irq(otg_dev->os_dep.irq_num, otg_dev);
++        } else {
++		DWC_DEBUGPL(DBG_ANY, "%s: There is no installed irq!\n", __func__);
++		return REM_RETVAL(-ENXIO);
++	}
++
++	if (otg_dev->core_if) {
++		dwc_otg_cil_remove(otg_dev->core_if);
++	} else {
++		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev->core_if NULL!\n", __func__);
++		return REM_RETVAL(-ENXIO);
++	}
++
++	/*
++	 * Remove the device attributes
++	 */
++	dwc_otg_attr_remove(_dev);
++
++	/*
++	 * Return the memory.
++	 */
++	if (otg_dev->os_dep.base) {
++		iounmap(otg_dev->os_dep.base);
++	}
++	DWC_FREE(otg_dev);
++
++	/*
++	 * Clear the drvdata pointer.
++	 */
++#ifdef LM_INTERFACE
++	lm_set_drvdata(_dev, 0);
++#elif defined(PCI_INTERFACE)
++        release_mem_region(otg_dev->os_dep.rsrc_start,
++                           otg_dev->os_dep.rsrc_len);
++	pci_set_drvdata(_dev, 0);
++#elif  defined(PLATFORM_INTERFACE)
++        platform_set_drvdata(_dev, 0);
++#endif
++        return REM_RETVAL(0);
++}
++
++/**
++ * This function is called when an lm_device is bound to a
++ * dwc_otg_driver. It creates the driver components required to
++ * control the device (CIL, HCD, and PCD) and it initializes the
++ * device. The driver components are stored in a dwc_otg_device
++ * structure. A reference to the dwc_otg_device is saved in the
++ * lm_device. This allows the driver to access the dwc_otg_device
++ * structure on subsequent calls to driver methods for this device.
++ *
++ * @param _dev Bus device
++ */
++static int dwc_otg_driver_probe(
++#ifdef LM_INTERFACE
++				       struct lm_device *_dev
++#elif defined(PCI_INTERFACE)
++				       struct pci_dev *_dev,
++				       const struct pci_device_id *id
++#elif  defined(PLATFORM_INTERFACE)
++                                       struct platform_device *_dev
++#endif
++    )
++{
++	int retval = 0;
++	dwc_otg_device_t *dwc_otg_device;
++        int devirq;
++
++	dev_dbg(&_dev->dev, "dwc_otg_driver_probe(%p)\n", _dev);
++#ifdef LM_INTERFACE
++	dev_dbg(&_dev->dev, "start=0x%08x\n", (unsigned)_dev->resource.start);
++#elif defined(PCI_INTERFACE)
++	if (!id) {
++		DWC_ERROR("Invalid pci_device_id %p", id);
++		return -EINVAL;
++	}
++
++	if (!_dev || (pci_enable_device(_dev) < 0)) {
++		DWC_ERROR("Invalid pci_device %p", _dev);
++		return -ENODEV;
++	}
++	dev_dbg(&_dev->dev, "start=0x%08x\n", (unsigned)pci_resource_start(_dev,0));
++	/* other stuff needed as well? */
++
++#elif  defined(PLATFORM_INTERFACE)
++	dev_dbg(&_dev->dev, "start=0x%08x (len 0x%x)\n",
++                (unsigned)_dev->resource->start,
++                (unsigned)(_dev->resource->end - _dev->resource->start));
++#endif
++
++	dwc_otg_device = DWC_ALLOC(sizeof(dwc_otg_device_t));
++
++	if (!dwc_otg_device) {
++		dev_err(&_dev->dev, "kmalloc of dwc_otg_device failed\n");
++		return -ENOMEM;
++	}
++
++	memset(dwc_otg_device, 0, sizeof(*dwc_otg_device));
++	dwc_otg_device->os_dep.reg_offset = 0xFFFFFFFF;
++	dwc_otg_device->os_dep.platformdev = _dev;
++
++	/*
++	 * Map the DWC_otg Core memory into virtual address space.
++	 */
++#ifdef LM_INTERFACE
++	dwc_otg_device->os_dep.base = ioremap(_dev->resource.start, SZ_256K);
++
++	if (!dwc_otg_device->os_dep.base) {
++		dev_err(&_dev->dev, "ioremap() failed\n");
++		DWC_FREE(dwc_otg_device);
++		return -ENOMEM;
++	}
++	dev_dbg(&_dev->dev, "base=0x%08x\n",
++		(unsigned)dwc_otg_device->os_dep.base);
++#elif defined(PCI_INTERFACE)
++	_dev->current_state = PCI_D0;
++	_dev->dev.power.power_state = PMSG_ON;
++
++	if (!_dev->irq) {
++		DWC_ERROR("Found HC with no IRQ. Check BIOS/PCI %s setup!",
++			  pci_name(_dev));
++		iounmap(dwc_otg_device->os_dep.base);
++		DWC_FREE(dwc_otg_device);
++		return -ENODEV;
++	}
++
++	dwc_otg_device->os_dep.rsrc_start = pci_resource_start(_dev, 0);
++	dwc_otg_device->os_dep.rsrc_len = pci_resource_len(_dev, 0);
++	DWC_DEBUGPL(DBG_ANY, "PCI resource: start=%08x, len=%08x\n",
++		    (unsigned)dwc_otg_device->os_dep.rsrc_start,
++		    (unsigned)dwc_otg_device->os_dep.rsrc_len);
++	if (!request_mem_region
++	    (dwc_otg_device->os_dep.rsrc_start, dwc_otg_device->os_dep.rsrc_len,
++	     "dwc_otg")) {
++		dev_dbg(&_dev->dev, "error requesting memory\n");
++		iounmap(dwc_otg_device->os_dep.base);
++		DWC_FREE(dwc_otg_device);
++		return -EFAULT;
++	}
++
++	dwc_otg_device->os_dep.base =
++	    ioremap(dwc_otg_device->os_dep.rsrc_start,
++			    dwc_otg_device->os_dep.rsrc_len);
++	if (dwc_otg_device->os_dep.base == NULL) {
++		dev_dbg(&_dev->dev, "error mapping memory\n");
++		release_mem_region(dwc_otg_device->os_dep.rsrc_start,
++				   dwc_otg_device->os_dep.rsrc_len);
++		iounmap(dwc_otg_device->os_dep.base);
++		DWC_FREE(dwc_otg_device);
++		return -EFAULT;
++	}
++	dev_dbg(&_dev->dev, "base=0x%p (before adjust) \n",
++		dwc_otg_device->os_dep.base);
++	dwc_otg_device->os_dep.base = (char *)dwc_otg_device->os_dep.base;
++	dev_dbg(&_dev->dev, "base=0x%p (after adjust) \n",
++		dwc_otg_device->os_dep.base);
++	dev_dbg(&_dev->dev, "%s: mapped PA 0x%x to VA 0x%p\n", __func__,
++		(unsigned)dwc_otg_device->os_dep.rsrc_start,
++		dwc_otg_device->os_dep.base);
++
++	pci_set_master(_dev);
++	pci_set_drvdata(_dev, dwc_otg_device);
++#elif defined(PLATFORM_INTERFACE)
++        DWC_DEBUGPL(DBG_ANY,"Platform resource: start=%08x, len=%08x\n",
++                    _dev->resource->start,
++                    _dev->resource->end - _dev->resource->start + 1);
++#if 1
++        if (!request_mem_region(_dev->resource[0].start,
++                                _dev->resource[0].end - _dev->resource[0].start + 1,
++                                "dwc_otg")) {
++          dev_dbg(&_dev->dev, "error reserving mapped memory\n");
++          retval = -EFAULT;
++          goto fail;
++        }
++
++	dwc_otg_device->os_dep.base = ioremap(_dev->resource[0].start,
++                                                      _dev->resource[0].end -
++                                                      _dev->resource[0].start+1);
++	if (fiq_enable)
++	{
++		if (!request_mem_region(_dev->resource[1].start,
++	                                _dev->resource[1].end - _dev->resource[1].start + 1,
++	                                "dwc_otg")) {
++			dev_dbg(&_dev->dev, "error reserving mapped memory\n");
++			retval = -EFAULT;
++			goto fail;
++		}
++
++		dwc_otg_device->os_dep.mphi_base = ioremap(_dev->resource[1].start,
++							    _dev->resource[1].end -
++							    _dev->resource[1].start + 1);
++		dwc_otg_device->os_dep.use_swirq = (_dev->resource[1].end - _dev->resource[1].start) == 0x200;
++	}
++
++#else
++        {
++                struct map_desc desc = {
++                    .virtual = IO_ADDRESS((unsigned)_dev->resource->start),
++                    .pfn     = __phys_to_pfn((unsigned)_dev->resource->start),
++                    .length  = SZ_128K,
++                    .type    = MT_DEVICE
++                };
++                iotable_init(&desc, 1);
++                dwc_otg_device->os_dep.base = (void *)desc.virtual;
++        }
++#endif
++	if (!dwc_otg_device->os_dep.base) {
++		dev_err(&_dev->dev, "ioremap() failed\n");
++		retval = -ENOMEM;
++		goto fail;
++	}
++#endif
++
++	/*
++	 * Initialize driver data to point to the global DWC_otg
++	 * Device structure.
++	 */
++#ifdef LM_INTERFACE
++	lm_set_drvdata(_dev, dwc_otg_device);
++#elif defined(PLATFORM_INTERFACE)
++	platform_set_drvdata(_dev, dwc_otg_device);
++#endif
++	dev_dbg(&_dev->dev, "dwc_otg_device=0x%p\n", dwc_otg_device);
++
++	dwc_otg_device->core_if = dwc_otg_cil_init(dwc_otg_device->os_dep.base);
++        DWC_DEBUGPL(DBG_HCDV, "probe of device %p given core_if %p\n",
++                    dwc_otg_device, dwc_otg_device->core_if);//GRAYG
++
++	if (!dwc_otg_device->core_if) {
++		dev_err(&_dev->dev, "CIL initialization failed!\n");
++		retval = -ENOMEM;
++		goto fail;
++	}
++
++	dev_dbg(&_dev->dev, "Calling get_gsnpsid\n");
++	/*
++	 * Attempt to ensure this device is really a DWC_otg Controller.
++	 * Read and verify the SNPSID register contents. The value should be
++	 * 0x45F42XXX or 0x45F42XXX, which corresponds to either "OT2" or "OTG3",
++	 * as in "OTG version 2.XX" or "OTG version 3.XX".
++	 */
++
++	if (((dwc_otg_get_gsnpsid(dwc_otg_device->core_if) & 0xFFFFF000) !=	0x4F542000) &&
++		((dwc_otg_get_gsnpsid(dwc_otg_device->core_if) & 0xFFFFF000) != 0x4F543000)) {
++		dev_err(&_dev->dev, "Bad value for SNPSID: 0x%08x\n",
++			dwc_otg_get_gsnpsid(dwc_otg_device->core_if));
++		retval = -EINVAL;
++		goto fail;
++	}
++
++	/*
++	 * Validate parameter values.
++	 */
++	dev_dbg(&_dev->dev, "Calling set_parameters\n");
++	if (set_parameters(dwc_otg_device->core_if)) {
++		retval = -EINVAL;
++		goto fail;
++	}
++
++	/*
++	 * Create Device Attributes in sysfs
++	 */
++	dev_dbg(&_dev->dev, "Calling attr_create\n");
++	dwc_otg_attr_create(_dev);
++
++	/*
++	 * Disable the global interrupt until all the interrupt
++	 * handlers are installed.
++	 */
++	dev_dbg(&_dev->dev, "Calling disable_global_interrupts\n");
++	dwc_otg_disable_global_interrupts(dwc_otg_device->core_if);
++
++	/*
++	 * Install the interrupt handler for the common interrupts before
++	 * enabling common interrupts in core_init below.
++	 */
++
++#if defined(PLATFORM_INTERFACE)
++	devirq = platform_get_irq_byname(_dev, fiq_enable ? "soft" : "usb");
++	if (devirq < 0)
++	    devirq = platform_get_irq(_dev, fiq_enable ? 0 : 1);
++#else
++	devirq = _dev->irq;
++#endif
++	DWC_DEBUGPL(DBG_CIL, "registering (common) handler for irq%d\n",
++		    devirq);
++	dev_dbg(&_dev->dev, "Calling request_irq(%d)\n", devirq);
++	retval = request_irq(devirq, dwc_otg_common_irq,
++                             IRQF_SHARED,
++                             "dwc_otg", dwc_otg_device);
++	if (retval) {
++		DWC_ERROR("request of irq%d failed\n", devirq);
++		retval = -EBUSY;
++		goto fail;
++	} else {
++		dwc_otg_device->common_irq_installed = 1;
++	}
++	dwc_otg_device->os_dep.irq_num = devirq;
++	dwc_otg_device->os_dep.fiq_num = -EINVAL;
++	if (fiq_enable) {
++		int devfiq = platform_get_irq_byname(_dev, "usb");
++		if (devfiq < 0)
++			devfiq = platform_get_irq(_dev, 1);
++		dwc_otg_device->os_dep.fiq_num = devfiq;
++	}
++
++#ifndef IRQF_TRIGGER_LOW
++#if defined(LM_INTERFACE) || defined(PLATFORM_INTERFACE)
++	dev_dbg(&_dev->dev, "Calling set_irq_type\n");
++	set_irq_type(devirq,
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30))
++                     IRQT_LOW
++#else
++                     IRQ_TYPE_LEVEL_LOW
++#endif
++                    );
++#endif
++#endif /*IRQF_TRIGGER_LOW*/
++
++	/*
++	 * Initialize the DWC_otg core.
++	 */
++	dev_dbg(&_dev->dev, "Calling dwc_otg_core_init\n");
++	dwc_otg_core_init(dwc_otg_device->core_if);
++
++#ifndef DWC_HOST_ONLY
++	/*
++	 * Initialize the PCD
++	 */
++	dev_dbg(&_dev->dev, "Calling pcd_init\n");
++	retval = pcd_init(_dev);
++	if (retval != 0) {
++		DWC_ERROR("pcd_init failed\n");
++		dwc_otg_device->pcd = NULL;
++		goto fail;
++	}
++#endif
++#ifndef DWC_DEVICE_ONLY
++	/*
++	 * Initialize the HCD
++	 */
++	dev_dbg(&_dev->dev, "Calling hcd_init\n");
++	retval = hcd_init(_dev);
++	if (retval != 0) {
++		DWC_ERROR("hcd_init failed\n");
++		dwc_otg_device->hcd = NULL;
++		goto fail;
++	}
++#endif
++        /* Recover from drvdata having been overwritten by hcd_init() */
++#ifdef LM_INTERFACE
++	lm_set_drvdata(_dev, dwc_otg_device);
++#elif defined(PLATFORM_INTERFACE)
++	platform_set_drvdata(_dev, dwc_otg_device);
++#elif defined(PCI_INTERFACE)
++	pci_set_drvdata(_dev, dwc_otg_device);
++	dwc_otg_device->os_dep.pcidev = _dev;
++#endif
++
++	/*
++	 * Enable the global interrupt after all the interrupt
++	 * handlers are installed if there is no ADP support else
++	 * perform initial actions required for Internal ADP logic.
++	 */
++	if (!dwc_otg_get_param_adp_enable(dwc_otg_device->core_if)) {
++	        dev_dbg(&_dev->dev, "Calling enable_global_interrupts\n");
++		dwc_otg_enable_global_interrupts(dwc_otg_device->core_if);
++	        dev_dbg(&_dev->dev, "Done\n");
++	} else
++		dwc_otg_adp_start(dwc_otg_device->core_if,
++							dwc_otg_is_host_mode(dwc_otg_device->core_if));
++
++	return 0;
++
++fail:
++	dwc_otg_driver_remove(_dev);
++	return retval;
++}
++
++/**
++ * This structure defines the methods to be called by a bus driver
++ * during the lifecycle of a device on that bus. Both drivers and
++ * devices are registered with a bus driver. The bus driver matches
++ * devices to drivers based on information in the device and driver
++ * structures.
++ *
++ * The probe function is called when the bus driver matches a device
++ * to this driver. The remove function is called when a device is
++ * unregistered with the bus driver.
++ */
++#ifdef LM_INTERFACE
++static struct lm_driver dwc_otg_driver = {
++	.drv = {.name = (char *)dwc_driver_name,},
++	.probe = dwc_otg_driver_probe,
++	.remove = dwc_otg_driver_remove,
++        // 'suspend' and 'resume' absent
++};
++#elif defined(PCI_INTERFACE)
++static const struct pci_device_id pci_ids[] = { {
++						 PCI_DEVICE(0x16c3, 0xabcd),
++						 .driver_data =
++						 (unsigned long)0xdeadbeef,
++						 }, { /* end: all zeroes */ }
++};
++
++MODULE_DEVICE_TABLE(pci, pci_ids);
++
++/* pci driver glue; this is a "new style" PCI driver module */
++static struct pci_driver dwc_otg_driver = {
++	.name = "dwc_otg",
++	.id_table = pci_ids,
++
++	.probe = dwc_otg_driver_probe,
++	.remove = dwc_otg_driver_remove,
++
++	.driver = {
++		   .name = (char *)dwc_driver_name,
++		   },
++};
++#elif defined(PLATFORM_INTERFACE)
++static struct platform_device_id platform_ids[] = {
++        {
++              .name = "bcm2708_usb",
++              .driver_data = (kernel_ulong_t) 0xdeadbeef,
++        },
++        { /* end: all zeroes */ }
++};
++MODULE_DEVICE_TABLE(platform, platform_ids);
++
++static const struct of_device_id dwc_otg_of_match_table[] = {
++	{ .compatible = "brcm,bcm2708-usb", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, dwc_otg_of_match_table);
++
++static struct platform_driver dwc_otg_driver = {
++	.driver = {
++		.name = (char *)dwc_driver_name,
++		.of_match_table = dwc_otg_of_match_table,
++		},
++        .id_table = platform_ids,
++
++	.probe = dwc_otg_driver_probe,
++	.remove = dwc_otg_driver_remove,
++        // no 'shutdown', 'suspend', 'resume', 'suspend_late' or 'resume_early'
++};
++#endif
++
++/**
++ * This function is called when the dwc_otg_driver is installed with the
++ * insmod command. It registers the dwc_otg_driver structure with the
++ * appropriate bus driver. This will cause the dwc_otg_driver_probe function
++ * to be called. In addition, the bus driver will automatically expose
++ * attributes defined for the device and driver in the special sysfs file
++ * system.
++ *
++ * @return
++ */
++static int __init dwc_otg_driver_init(void)
++{
++	int retval = 0;
++	int error;
++        struct device_driver *drv;
++
++	if(fiq_fsm_enable && !fiq_enable) {
++		printk(KERN_WARNING "dwc_otg: fiq_fsm_enable was set without fiq_enable! Correcting.\n");
++		fiq_enable = 1;
++	}
++
++	printk(KERN_INFO "%s: version %s (%s bus)\n", dwc_driver_name,
++	       DWC_DRIVER_VERSION,
++#ifdef LM_INTERFACE
++               "logicmodule");
++	retval = lm_driver_register(&dwc_otg_driver);
++        drv = &dwc_otg_driver.drv;
++#elif defined(PCI_INTERFACE)
++               "pci");
++	retval = pci_register_driver(&dwc_otg_driver);
++        drv = &dwc_otg_driver.driver;
++#elif defined(PLATFORM_INTERFACE)
++               "platform");
++	retval = platform_driver_register(&dwc_otg_driver);
++        drv = &dwc_otg_driver.driver;
++#endif
++	if (retval < 0) {
++		printk(KERN_ERR "%s retval=%d\n", __func__, retval);
++		return retval;
++	}
++	printk(KERN_DEBUG "dwc_otg: FIQ %s\n", fiq_enable ? "enabled":"disabled");
++	printk(KERN_DEBUG "dwc_otg: NAK holdoff %s\n", nak_holdoff ? "enabled":"disabled");
++	printk(KERN_DEBUG "dwc_otg: FIQ split-transaction FSM %s\n", fiq_fsm_enable ? "enabled":"disabled");
++
++	error = driver_create_file(drv, &driver_attr_version);
++#ifdef DEBUG
++	error = driver_create_file(drv, &driver_attr_debuglevel);
++#endif
++	return retval;
++}
++
++module_init(dwc_otg_driver_init);
++
++/**
++ * This function is called when the driver is removed from the kernel
++ * with the rmmod command. The driver unregisters itself with its bus
++ * driver.
++ *
++ */
++static void __exit dwc_otg_driver_cleanup(void)
++{
++	printk(KERN_DEBUG "dwc_otg_driver_cleanup()\n");
++
++#ifdef LM_INTERFACE
++	driver_remove_file(&dwc_otg_driver.drv, &driver_attr_debuglevel);
++	driver_remove_file(&dwc_otg_driver.drv, &driver_attr_version);
++	lm_driver_unregister(&dwc_otg_driver);
++#elif defined(PCI_INTERFACE)
++	driver_remove_file(&dwc_otg_driver.driver, &driver_attr_debuglevel);
++	driver_remove_file(&dwc_otg_driver.driver, &driver_attr_version);
++	pci_unregister_driver(&dwc_otg_driver);
++#elif defined(PLATFORM_INTERFACE)
++	driver_remove_file(&dwc_otg_driver.driver, &driver_attr_debuglevel);
++	driver_remove_file(&dwc_otg_driver.driver, &driver_attr_version);
++	platform_driver_unregister(&dwc_otg_driver);
++#endif
++
++	printk(KERN_INFO "%s module removed\n", dwc_driver_name);
++}
++
++module_exit(dwc_otg_driver_cleanup);
++
++MODULE_DESCRIPTION(DWC_DRIVER_DESC);
++MODULE_AUTHOR("Synopsys Inc.");
++MODULE_LICENSE("GPL");
++
++module_param_named(otg_cap, dwc_otg_module_params.otg_cap, int, 0444);
++MODULE_PARM_DESC(otg_cap, "OTG Capabilities 0=HNP&SRP 1=SRP Only 2=None");
++module_param_named(opt, dwc_otg_module_params.opt, int, 0444);
++MODULE_PARM_DESC(opt, "OPT Mode");
++module_param_named(dma_enable, dwc_otg_module_params.dma_enable, int, 0444);
++MODULE_PARM_DESC(dma_enable, "DMA Mode 0=Slave 1=DMA enabled");
++
++module_param_named(dma_desc_enable, dwc_otg_module_params.dma_desc_enable, int,
++		   0444);
++MODULE_PARM_DESC(dma_desc_enable,
++		 "DMA Desc Mode 0=Address DMA 1=DMA Descriptor enabled");
++
++module_param_named(dma_burst_size, dwc_otg_module_params.dma_burst_size, int,
++		   0444);
++MODULE_PARM_DESC(dma_burst_size,
++		 "DMA Burst Size 1, 4, 8, 16, 32, 64, 128, 256");
++module_param_named(speed, dwc_otg_module_params.speed, int, 0444);
++MODULE_PARM_DESC(speed, "Speed 0=High Speed 1=Full Speed");
++module_param_named(host_support_fs_ls_low_power,
++		   dwc_otg_module_params.host_support_fs_ls_low_power, int,
++		   0444);
++MODULE_PARM_DESC(host_support_fs_ls_low_power,
++		 "Support Low Power w/FS or LS 0=Support 1=Don't Support");
++module_param_named(host_ls_low_power_phy_clk,
++		   dwc_otg_module_params.host_ls_low_power_phy_clk, int, 0444);
++MODULE_PARM_DESC(host_ls_low_power_phy_clk,
++		 "Low Speed Low Power Clock 0=48Mhz 1=6Mhz");
++module_param_named(enable_dynamic_fifo,
++		   dwc_otg_module_params.enable_dynamic_fifo, int, 0444);
++MODULE_PARM_DESC(enable_dynamic_fifo, "0=cC Setting 1=Allow Dynamic Sizing");
++module_param_named(data_fifo_size, dwc_otg_module_params.data_fifo_size, int,
++		   0444);
++MODULE_PARM_DESC(data_fifo_size,
++		 "Total number of words in the data FIFO memory 32-32768");
++module_param_named(dev_rx_fifo_size, dwc_otg_module_params.dev_rx_fifo_size,
++		   int, 0444);
++MODULE_PARM_DESC(dev_rx_fifo_size, "Number of words in the Rx FIFO 16-32768");
++module_param_named(dev_nperio_tx_fifo_size,
++		   dwc_otg_module_params.dev_nperio_tx_fifo_size, int, 0444);
++MODULE_PARM_DESC(dev_nperio_tx_fifo_size,
++		 "Number of words in the non-periodic Tx FIFO 16-32768");
++module_param_named(dev_perio_tx_fifo_size_1,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[0], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_1,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_2,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[1], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_2,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_3,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[2], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_3,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_4,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[3], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_4,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_5,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[4], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_5,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_6,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[5], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_6,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_7,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[6], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_7,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_8,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[7], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_8,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_9,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[8], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_9,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_10,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[9], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_10,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_11,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[10], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_11,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_12,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[11], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_12,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_13,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[12], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_13,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_14,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[13], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_14,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_15,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[14], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_15,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(host_rx_fifo_size, dwc_otg_module_params.host_rx_fifo_size,
++		   int, 0444);
++MODULE_PARM_DESC(host_rx_fifo_size, "Number of words in the Rx FIFO 16-32768");
++module_param_named(host_nperio_tx_fifo_size,
++		   dwc_otg_module_params.host_nperio_tx_fifo_size, int, 0444);
++MODULE_PARM_DESC(host_nperio_tx_fifo_size,
++		 "Number of words in the non-periodic Tx FIFO 16-32768");
++module_param_named(host_perio_tx_fifo_size,
++		   dwc_otg_module_params.host_perio_tx_fifo_size, int, 0444);
++MODULE_PARM_DESC(host_perio_tx_fifo_size,
++		 "Number of words in the host periodic Tx FIFO 16-32768");
++module_param_named(max_transfer_size, dwc_otg_module_params.max_transfer_size,
++		   int, 0444);
++/** @todo Set the max to 512K, modify checks */
++MODULE_PARM_DESC(max_transfer_size,
++		 "The maximum transfer size supported in bytes 2047-65535");
++module_param_named(max_packet_count, dwc_otg_module_params.max_packet_count,
++		   int, 0444);
++MODULE_PARM_DESC(max_packet_count,
++		 "The maximum number of packets in a transfer 15-511");
++module_param_named(host_channels, dwc_otg_module_params.host_channels, int,
++		   0444);
++MODULE_PARM_DESC(host_channels,
++		 "The number of host channel registers to use 1-16");
++module_param_named(dev_endpoints, dwc_otg_module_params.dev_endpoints, int,
++		   0444);
++MODULE_PARM_DESC(dev_endpoints,
++		 "The number of endpoints in addition to EP0 available for device mode 1-15");
++module_param_named(phy_type, dwc_otg_module_params.phy_type, int, 0444);
++MODULE_PARM_DESC(phy_type, "0=Reserved 1=UTMI+ 2=ULPI");
++module_param_named(phy_utmi_width, dwc_otg_module_params.phy_utmi_width, int,
++		   0444);
++MODULE_PARM_DESC(phy_utmi_width, "Specifies the UTMI+ Data Width 8 or 16 bits");
++module_param_named(phy_ulpi_ddr, dwc_otg_module_params.phy_ulpi_ddr, int, 0444);
++MODULE_PARM_DESC(phy_ulpi_ddr,
++		 "ULPI at double or single data rate 0=Single 1=Double");
++module_param_named(phy_ulpi_ext_vbus, dwc_otg_module_params.phy_ulpi_ext_vbus,
++		   int, 0444);
++MODULE_PARM_DESC(phy_ulpi_ext_vbus,
++		 "ULPI PHY using internal or external vbus 0=Internal");
++module_param_named(i2c_enable, dwc_otg_module_params.i2c_enable, int, 0444);
++MODULE_PARM_DESC(i2c_enable, "FS PHY Interface");
++module_param_named(ulpi_fs_ls, dwc_otg_module_params.ulpi_fs_ls, int, 0444);
++MODULE_PARM_DESC(ulpi_fs_ls, "ULPI PHY FS/LS mode only");
++module_param_named(ts_dline, dwc_otg_module_params.ts_dline, int, 0444);
++MODULE_PARM_DESC(ts_dline, "Term select Dline pulsing for all PHYs");
++module_param_named(debug, g_dbg_lvl, int, 0444);
++MODULE_PARM_DESC(debug, "");
++
++module_param_named(en_multiple_tx_fifo,
++		   dwc_otg_module_params.en_multiple_tx_fifo, int, 0444);
++MODULE_PARM_DESC(en_multiple_tx_fifo,
++		 "Dedicated Non Periodic Tx FIFOs 0=disabled 1=enabled");
++module_param_named(dev_tx_fifo_size_1,
++		   dwc_otg_module_params.dev_tx_fifo_size[0], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_1, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_2,
++		   dwc_otg_module_params.dev_tx_fifo_size[1], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_2, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_3,
++		   dwc_otg_module_params.dev_tx_fifo_size[2], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_3, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_4,
++		   dwc_otg_module_params.dev_tx_fifo_size[3], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_4, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_5,
++		   dwc_otg_module_params.dev_tx_fifo_size[4], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_5, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_6,
++		   dwc_otg_module_params.dev_tx_fifo_size[5], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_6, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_7,
++		   dwc_otg_module_params.dev_tx_fifo_size[6], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_7, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_8,
++		   dwc_otg_module_params.dev_tx_fifo_size[7], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_8, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_9,
++		   dwc_otg_module_params.dev_tx_fifo_size[8], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_9, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_10,
++		   dwc_otg_module_params.dev_tx_fifo_size[9], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_10, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_11,
++		   dwc_otg_module_params.dev_tx_fifo_size[10], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_11, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_12,
++		   dwc_otg_module_params.dev_tx_fifo_size[11], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_12, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_13,
++		   dwc_otg_module_params.dev_tx_fifo_size[12], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_13, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_14,
++		   dwc_otg_module_params.dev_tx_fifo_size[13], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_14, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_15,
++		   dwc_otg_module_params.dev_tx_fifo_size[14], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_15, "Number of words in the Tx FIFO 4-768");
++
++module_param_named(thr_ctl, dwc_otg_module_params.thr_ctl, int, 0444);
++MODULE_PARM_DESC(thr_ctl,
++		 "Thresholding enable flag bit 0 - non ISO Tx thr., 1 - ISO Tx thr., 2 - Rx thr.- bit 0=disabled 1=enabled");
++module_param_named(tx_thr_length, dwc_otg_module_params.tx_thr_length, int,
++		   0444);
++MODULE_PARM_DESC(tx_thr_length, "Tx Threshold length in 32 bit DWORDs");
++module_param_named(rx_thr_length, dwc_otg_module_params.rx_thr_length, int,
++		   0444);
++MODULE_PARM_DESC(rx_thr_length, "Rx Threshold length in 32 bit DWORDs");
++
++module_param_named(pti_enable, dwc_otg_module_params.pti_enable, int, 0444);
++module_param_named(mpi_enable, dwc_otg_module_params.mpi_enable, int, 0444);
++module_param_named(lpm_enable, dwc_otg_module_params.lpm_enable, int, 0444);
++MODULE_PARM_DESC(lpm_enable, "LPM Enable 0=LPM Disabled 1=LPM Enabled");
++module_param_named(ic_usb_cap, dwc_otg_module_params.ic_usb_cap, int, 0444);
++MODULE_PARM_DESC(ic_usb_cap,
++		 "IC_USB Capability 0=IC_USB Disabled 1=IC_USB Enabled");
++module_param_named(ahb_thr_ratio, dwc_otg_module_params.ahb_thr_ratio, int,
++		   0444);
++MODULE_PARM_DESC(ahb_thr_ratio, "AHB Threshold Ratio");
++module_param_named(power_down, dwc_otg_module_params.power_down, int, 0444);
++MODULE_PARM_DESC(power_down, "Power Down Mode");
++module_param_named(reload_ctl, dwc_otg_module_params.reload_ctl, int, 0444);
++MODULE_PARM_DESC(reload_ctl, "HFIR Reload Control");
++module_param_named(dev_out_nak, dwc_otg_module_params.dev_out_nak, int, 0444);
++MODULE_PARM_DESC(dev_out_nak, "Enable Device OUT NAK");
++module_param_named(cont_on_bna, dwc_otg_module_params.cont_on_bna, int, 0444);
++MODULE_PARM_DESC(cont_on_bna, "Enable Enable Continue on BNA");
++module_param_named(ahb_single, dwc_otg_module_params.ahb_single, int, 0444);
++MODULE_PARM_DESC(ahb_single, "Enable AHB Single Support");
++module_param_named(adp_enable, dwc_otg_module_params.adp_enable, int, 0444);
++MODULE_PARM_DESC(adp_enable, "ADP Enable 0=ADP Disabled 1=ADP Enabled");
++module_param_named(otg_ver, dwc_otg_module_params.otg_ver, int, 0444);
++MODULE_PARM_DESC(otg_ver, "OTG revision supported 0=OTG 1.3 1=OTG 2.0");
++module_param(microframe_schedule, bool, 0444);
++MODULE_PARM_DESC(microframe_schedule, "Enable the microframe scheduler");
++
++module_param(fiq_enable, bool, 0444);
++MODULE_PARM_DESC(fiq_enable, "Enable the FIQ");
++module_param(nak_holdoff, ushort, 0644);
++MODULE_PARM_DESC(nak_holdoff, "Throttle duration for bulk split-transaction endpoints on a NAK. Default 8");
++module_param(fiq_fsm_enable, bool, 0444);
++MODULE_PARM_DESC(fiq_fsm_enable, "Enable the FIQ to perform split transactions as defined by fiq_fsm_mask");
++module_param(fiq_fsm_mask, ushort, 0444);
++MODULE_PARM_DESC(fiq_fsm_mask, "Bitmask of transactions to perform in the FIQ.\n"
++					"Bit 0 : Non-periodic split transactions\n"
++					"Bit 1 : Periodic split transactions\n"
++					"Bit 2 : High-speed multi-transfer isochronous\n"
++					"All other bits should be set 0.");
++module_param(int_ep_interval_min, ushort, 0644);
++MODULE_PARM_DESC(int_ep_interval_min, "Clamp high-speed Interrupt endpoints to a minimum polling interval.\n"
++					"0..1 = Use endpoint default\n"
++					"2..n = Minimum interval n microframes. Use powers of 2.\n");
++
++module_param(cil_force_host, bool, 0644);
++MODULE_PARM_DESC(cil_force_host, "On a connector-ID status change, "
++					"force Host Mode regardless of OTG state.");
++
++/** @page "Module Parameters"
++ *
++ * The following parameters may be specified when starting the module.
++ * These parameters define how the DWC_otg controller should be
++ * configured. Parameter values are passed to the CIL initialization
++ * function dwc_otg_cil_init
++ *
++ * Example: <code>modprobe dwc_otg speed=1 otg_cap=1</code>
++ *
++
++ <table>
++ <tr><td>Parameter Name</td><td>Meaning</td></tr>
++
++ <tr>
++ <td>otg_cap</td>
++ <td>Specifies the OTG capabilities. The driver will automatically detect the
++ value for this parameter if none is specified.
++ - 0: HNP and SRP capable (default, if available)
++ - 1: SRP Only capable
++ - 2: No HNP/SRP capable
++ </td></tr>
++
++ <tr>
++ <td>dma_enable</td>
++ <td>Specifies whether to use slave or DMA mode for accessing the data FIFOs.
++ The driver will automatically detect the value for this parameter if none is
++ specified.
++ - 0: Slave
++ - 1: DMA (default, if available)
++ </td></tr>
++
++ <tr>
++ <td>dma_burst_size</td>
++ <td>The DMA Burst size (applicable only for External DMA Mode).
++ - Values: 1, 4, 8 16, 32, 64, 128, 256 (default 32)
++ </td></tr>
++
++ <tr>
++ <td>speed</td>
++ <td>Specifies the maximum speed of operation in host and device mode. The
++ actual speed depends on the speed of the attached device and the value of
++ phy_type.
++ - 0: High Speed (default)
++ - 1: Full Speed
++ </td></tr>
++
++ <tr>
++ <td>host_support_fs_ls_low_power</td>
++ <td>Specifies whether low power mode is supported when attached to a Full
++ Speed or Low Speed device in host mode.
++ - 0: Don't support low power mode (default)
++ - 1: Support low power mode
++ </td></tr>
++
++ <tr>
++ <td>host_ls_low_power_phy_clk</td>
++ <td>Specifies the PHY clock rate in low power mode when connected to a Low
++ Speed device in host mode. This parameter is applicable only if
++ HOST_SUPPORT_FS_LS_LOW_POWER is enabled.
++ - 0: 48 MHz (default)
++ - 1: 6 MHz
++ </td></tr>
++
++ <tr>
++ <td>enable_dynamic_fifo</td>
++ <td> Specifies whether FIFOs may be resized by the driver software.
++ - 0: Use cC FIFO size parameters
++ - 1: Allow dynamic FIFO sizing (default)
++ </td></tr>
++
++ <tr>
++ <td>data_fifo_size</td>
++ <td>Total number of 4-byte words in the data FIFO memory. This memory
++ includes the Rx FIFO, non-periodic Tx FIFO, and periodic Tx FIFOs.
++ - Values: 32 to 32768 (default 8192)
++
++ Note: The total FIFO memory depth in the FPGA configuration is 8192.
++ </td></tr>
++
++ <tr>
++ <td>dev_rx_fifo_size</td>
++ <td>Number of 4-byte words in the Rx FIFO in device mode when dynamic
++ FIFO sizing is enabled.
++ - Values: 16 to 32768 (default 1064)
++ </td></tr>
++
++ <tr>
++ <td>dev_nperio_tx_fifo_size</td>
++ <td>Number of 4-byte words in the non-periodic Tx FIFO in device mode when
++ dynamic FIFO sizing is enabled.
++ - Values: 16 to 32768 (default 1024)
++ </td></tr>
++
++ <tr>
++ <td>dev_perio_tx_fifo_size_n (n = 1 to 15)</td>
++ <td>Number of 4-byte words in each of the periodic Tx FIFOs in device mode
++ when dynamic FIFO sizing is enabled.
++ - Values: 4 to 768 (default 256)
++ </td></tr>
++
++ <tr>
++ <td>host_rx_fifo_size</td>
++ <td>Number of 4-byte words in the Rx FIFO in host mode when dynamic FIFO
++ sizing is enabled.
++ - Values: 16 to 32768 (default 1024)
++ </td></tr>
++
++ <tr>
++ <td>host_nperio_tx_fifo_size</td>
++ <td>Number of 4-byte words in the non-periodic Tx FIFO in host mode when
++ dynamic FIFO sizing is enabled in the core.
++ - Values: 16 to 32768 (default 1024)
++ </td></tr>
++
++ <tr>
++ <td>host_perio_tx_fifo_size</td>
++ <td>Number of 4-byte words in the host periodic Tx FIFO when dynamic FIFO
++ sizing is enabled.
++ - Values: 16 to 32768 (default 1024)
++ </td></tr>
++
++ <tr>
++ <td>max_transfer_size</td>
++ <td>The maximum transfer size supported in bytes.
++ - Values: 2047 to 65,535 (default 65,535)
++ </td></tr>
++
++ <tr>
++ <td>max_packet_count</td>
++ <td>The maximum number of packets in a transfer.
++ - Values: 15 to 511 (default 511)
++ </td></tr>
++
++ <tr>
++ <td>host_channels</td>
++ <td>The number of host channel registers to use.
++ - Values: 1 to 16 (default 12)
++
++ Note: The FPGA configuration supports a maximum of 12 host channels.
++ </td></tr>
++
++ <tr>
++ <td>dev_endpoints</td>
++ <td>The number of endpoints in addition to EP0 available for device mode
++ operations.
++ - Values: 1 to 15 (default 6 IN and OUT)
++
++ Note: The FPGA configuration supports a maximum of 6 IN and OUT endpoints in
++ addition to EP0.
++ </td></tr>
++
++ <tr>
++ <td>phy_type</td>
++ <td>Specifies the type of PHY interface to use. By default, the driver will
++ automatically detect the phy_type.
++ - 0: Full Speed
++ - 1: UTMI+ (default, if available)
++ - 2: ULPI
++ </td></tr>
++
++ <tr>
++ <td>phy_utmi_width</td>
++ <td>Specifies the UTMI+ Data Width. This parameter is applicable for a
++ phy_type of UTMI+. Also, this parameter is applicable only if the
++ OTG_HSPHY_WIDTH cC parameter was set to "8 and 16 bits", meaning that the
++ core has been configured to work at either data path width.
++ - Values: 8 or 16 bits (default 16)
++ </td></tr>
++
++ <tr>
++ <td>phy_ulpi_ddr</td>
++ <td>Specifies whether the ULPI operates at double or single data rate. This
++ parameter is only applicable if phy_type is ULPI.
++ - 0: single data rate ULPI interface with 8 bit wide data bus (default)
++ - 1: double data rate ULPI interface with 4 bit wide data bus
++ </td></tr>
++
++ <tr>
++ <td>i2c_enable</td>
++ <td>Specifies whether to use the I2C interface for full speed PHY. This
++ parameter is only applicable if PHY_TYPE is FS.
++ - 0: Disabled (default)
++ - 1: Enabled
++ </td></tr>
++
++ <tr>
++ <td>ulpi_fs_ls</td>
++ <td>Specifies whether to use ULPI FS/LS mode only.
++ - 0: Disabled (default)
++ - 1: Enabled
++ </td></tr>
++
++ <tr>
++ <td>ts_dline</td>
++ <td>Specifies whether term select D-Line pulsing for all PHYs is enabled.
++ - 0: Disabled (default)
++ - 1: Enabled
++ </td></tr>
++
++ <tr>
++ <td>en_multiple_tx_fifo</td>
++ <td>Specifies whether dedicatedto tx fifos are enabled for non periodic IN EPs.
++ The driver will automatically detect the value for this parameter if none is
++ specified.
++ - 0: Disabled
++ - 1: Enabled (default, if available)
++ </td></tr>
++
++ <tr>
++ <td>dev_tx_fifo_size_n (n = 1 to 15)</td>
++ <td>Number of 4-byte words in each of the Tx FIFOs in device mode
++ when dynamic FIFO sizing is enabled.
++ - Values: 4 to 768 (default 256)
++ </td></tr>
++
++ <tr>
++ <td>tx_thr_length</td>
++ <td>Transmit Threshold length in 32 bit double words
++ - Values: 8 to 128 (default 64)
++ </td></tr>
++
++ <tr>
++ <td>rx_thr_length</td>
++ <td>Receive Threshold length in 32 bit double words
++ - Values: 8 to 128 (default 64)
++ </td></tr>
++
++<tr>
++ <td>thr_ctl</td>
++ <td>Specifies whether to enable Thresholding for Device mode. Bits 0, 1, 2 of
++ this parmater specifies if thresholding is enabled for non-Iso Tx, Iso Tx and
++ Rx transfers accordingly.
++ The driver will automatically detect the value for this parameter if none is
++ specified.
++ - Values: 0 to 7 (default 0)
++ Bit values indicate:
++ - 0: Thresholding disabled
++ - 1: Thresholding enabled
++ </td></tr>
++
++<tr>
++ <td>dma_desc_enable</td>
++ <td>Specifies whether to enable Descriptor DMA mode.
++ The driver will automatically detect the value for this parameter if none is
++ specified.
++ - 0: Descriptor DMA disabled
++ - 1: Descriptor DMA (default, if available)
++ </td></tr>
++
++<tr>
++ <td>mpi_enable</td>
++ <td>Specifies whether to enable MPI enhancement mode.
++ The driver will automatically detect the value for this parameter if none is
++ specified.
++ - 0: MPI disabled (default)
++ - 1: MPI enable
++ </td></tr>
++
++<tr>
++ <td>pti_enable</td>
++ <td>Specifies whether to enable PTI enhancement support.
++ The driver will automatically detect the value for this parameter if none is
++ specified.
++ - 0: PTI disabled (default)
++ - 1: PTI enable
++ </td></tr>
++
++<tr>
++ <td>lpm_enable</td>
++ <td>Specifies whether to enable LPM support.
++ The driver will automatically detect the value for this parameter if none is
++ specified.
++ - 0: LPM disabled
++ - 1: LPM enable (default, if available)
++ </td></tr>
++
++<tr>
++ <td>ic_usb_cap</td>
++ <td>Specifies whether to enable IC_USB capability.
++ The driver will automatically detect the value for this parameter if none is
++ specified.
++ - 0: IC_USB disabled (default, if available)
++ - 1: IC_USB enable
++ </td></tr>
++
++<tr>
++ <td>ahb_thr_ratio</td>
++ <td>Specifies AHB Threshold ratio.
++ - Values: 0 to 3 (default 0)
++ </td></tr>
++
++<tr>
++ <td>power_down</td>
++ <td>Specifies Power Down(Hibernation) Mode.
++ The driver will automatically detect the value for this parameter if none is
++ specified.
++ - 0: Power Down disabled (default)
++ - 2: Power Down enabled
++ </td></tr>
++
++ <tr>
++ <td>reload_ctl</td>
++ <td>Specifies whether dynamic reloading of the HFIR register is allowed during
++ run time. The driver will automatically detect the value for this parameter if
++ none is specified. In case the HFIR value is reloaded when HFIR.RldCtrl == 1'b0
++ the core might misbehave.
++ - 0: Reload Control disabled (default)
++ - 1: Reload Control enabled
++ </td></tr>
++
++ <tr>
++ <td>dev_out_nak</td>
++ <td>Specifies whether  Device OUT NAK enhancement enabled or no.
++ The driver will automatically detect the value for this parameter if
++ none is specified. This parameter is valid only when OTG_EN_DESC_DMA == 1b1.
++ - 0: The core does not set NAK after Bulk OUT transfer complete (default)
++ - 1: The core sets NAK after Bulk OUT transfer complete
++ </td></tr>
++
++ <tr>
++ <td>cont_on_bna</td>
++ <td>Specifies whether Enable Continue on BNA enabled or no.
++ After receiving BNA interrupt the core disables the endpoint,when the
++ endpoint is re-enabled by the application the
++ - 0: Core starts processing from the DOEPDMA descriptor (default)
++ - 1: Core starts processing from the descriptor which received the BNA.
++ This parameter is valid only when OTG_EN_DESC_DMA == 1b1.
++ </td></tr>
++
++ <tr>
++ <td>ahb_single</td>
++ <td>This bit when programmed supports SINGLE transfers for remainder data
++ in a transfer for DMA mode of operation.
++ - 0: The remainder data will be sent using INCR burst size (default)
++ - 1: The remainder data will be sent using SINGLE burst size.
++ </td></tr>
++
++<tr>
++ <td>adp_enable</td>
++ <td>Specifies whether ADP feature is enabled.
++ The driver will automatically detect the value for this parameter if none is
++ specified.
++ - 0: ADP feature disabled (default)
++ - 1: ADP feature enabled
++ </td></tr>
++
++  <tr>
++ <td>otg_ver</td>
++ <td>Specifies whether OTG is performing as USB OTG Revision 2.0 or Revision 1.3
++ USB OTG device.
++ - 0: OTG 2.0 support disabled (default)
++ - 1: OTG 2.0 support enabled
++ </td></tr>
++
++*/
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_driver.h
+@@ -0,0 +1,86 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_driver.h $
++ * $Revision: #19 $
++ * $Date: 2010/11/15 $
++ * $Change: 1627671 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++#ifndef __DWC_OTG_DRIVER_H__
++#define __DWC_OTG_DRIVER_H__
++
++/** @file
++ * This file contains the interface to the Linux driver.
++ */
++#include "dwc_otg_os_dep.h"
++#include "dwc_otg_core_if.h"
++
++/* Type declarations */
++struct dwc_otg_pcd;
++struct dwc_otg_hcd;
++
++/**
++ * This structure is a wrapper that encapsulates the driver components used to
++ * manage a single DWC_otg controller.
++ */
++typedef struct dwc_otg_device {
++	/** Structure containing OS-dependent stuff. KEEP THIS STRUCT AT THE
++	 * VERY BEGINNING OF THE DEVICE STRUCT. OSes such as FreeBSD and NetBSD
++	 * require this. */
++	struct os_dependent os_dep;
++
++	/** Pointer to the core interface structure. */
++	dwc_otg_core_if_t *core_if;
++
++	/** Pointer to the PCD structure. */
++	struct dwc_otg_pcd *pcd;
++
++	/** Pointer to the HCD structure. */
++	struct dwc_otg_hcd *hcd;
++
++	/** Flag to indicate whether the common IRQ handler is installed. */
++	uint8_t common_irq_installed;
++
++} dwc_otg_device_t;
++
++/*We must clear S3C24XX_EINTPEND external interrupt register
++ * because after clearing in this register trigerred IRQ from
++ * H/W core in kernel interrupt can be occured again before OTG
++ * handlers clear all IRQ sources of Core registers because of
++ * timing latencies and Low Level IRQ Type.
++ */
++#ifdef CONFIG_MACH_IPMATE
++#define  S3C2410X_CLEAR_EINTPEND()   \
++do { \
++	__raw_writel(1UL << 11,S3C24XX_EINTPEND); \
++} while (0)
++#else
++#define  S3C2410X_CLEAR_EINTPEND()   do { } while (0)
++#endif
++
++#endif
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
+@@ -0,0 +1,1433 @@
++/*
++ * dwc_otg_fiq_fsm.c - The finite state machine FIQ
++ *
++ * Copyright (c) 2013 Raspberry Pi Foundation
++ *
++ * Author: Jonathan Bell <jonathan@raspberrypi.org>
++ * All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions are met:
++ *	* Redistributions of source code must retain the above copyright
++ *	  notice, this list of conditions and the following disclaimer.
++ *	* Redistributions in binary form must reproduce the above copyright
++ *	  notice, this list of conditions and the following disclaimer in the
++ *	  documentation and/or other materials provided with the distribution.
++ *	* Neither the name of Raspberry Pi nor the
++ *	  names of its contributors may be used to endorse or promote products
++ *	  derived from this software without specific prior written permission.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
++ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
++ * DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
++ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
++ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ * This FIQ implements functionality that performs split transactions on
++ * the dwc_otg hardware without any outside intervention. A split transaction
++ * is "queued" by nominating a specific host channel to perform the entirety
++ * of a split transaction. This FIQ will then perform the microframe-precise
++ * scheduling required in each phase of the transaction until completion.
++ *
++ * The FIQ functionality is glued into the Synopsys driver via the entry point
++ * in the FSM enqueue function, and at the exit point in handling a HC interrupt
++ * for a FSM-enabled channel.
++ *
++ * NB: Large parts of this implementation have architecture-specific code.
++ * For porting this functionality to other ARM machines, the minimum is required:
++ * - An interrupt controller allowing the top-level dwc USB interrupt to be routed
++ *   to the FIQ
++ * - A method of forcing a software generated interrupt from FIQ mode that then
++ *   triggers an IRQ entry (with the dwc USB handler called by this IRQ number)
++ * - Guaranteed interrupt routing such that both the FIQ and SGI occur on the same
++ *   processor core - there is no locking between the FIQ and IRQ (aside from
++ *   local_fiq_disable)
++ *
++ */
++
++#include "dwc_otg_fiq_fsm.h"
++
++
++char buffer[1000*16];
++int wptr;
++void notrace _fiq_print(enum fiq_debug_level dbg_lvl, volatile struct fiq_state *state, char *fmt, ...)
++{
++	enum fiq_debug_level dbg_lvl_req = FIQDBG_ERR;
++	va_list args;
++	char text[17];
++	hfnum_data_t hfnum = { .d32 = FIQ_READ(state->dwc_regs_base + 0x408) };
++
++	if((dbg_lvl & dbg_lvl_req) || dbg_lvl == FIQDBG_ERR)
++	{
++		snprintf(text, 9, " %4d:%1u  ", hfnum.b.frnum/8, hfnum.b.frnum & 7);
++		va_start(args, fmt);
++		vsnprintf(text+8, 9, fmt, args);
++		va_end(args);
++
++		memcpy(buffer + wptr, text, 16);
++		wptr = (wptr + 16) % sizeof(buffer);
++	}
++}
++
++
++#ifdef CONFIG_ARM64
++
++inline void fiq_fsm_spin_lock(fiq_lock_t *lock)
++{
++	spin_lock((spinlock_t *)lock);
++}
++
++inline void fiq_fsm_spin_unlock(fiq_lock_t *lock)
++{
++	spin_unlock((spinlock_t *)lock);
++}
++
++#else
++
++/**
++ * fiq_fsm_spin_lock() - ARMv6+ bare bones spinlock
++ * Must be called with local interrupts and FIQ disabled.
++ */
++#if defined(CONFIG_ARCH_BCM2835) && defined(CONFIG_SMP)
++inline void fiq_fsm_spin_lock(fiq_lock_t *lock)
++{
++	unsigned long tmp;
++	uint32_t newval;
++	fiq_lock_t lockval;
++	/* Nested locking, yay. If we are on the same CPU as the fiq, then the disable
++	 * will be sufficient. If we are on a different CPU, then the lock protects us. */
++	prefetchw(&lock->slock);
++	asm volatile (
++	"1:     ldrex   %0, [%3]\n"
++	"       add     %1, %0, %4\n"
++	"       strex   %2, %1, [%3]\n"
++	"       teq     %2, #0\n"
++	"       bne     1b"
++	: "=&r" (lockval), "=&r" (newval), "=&r" (tmp)
++	: "r" (&lock->slock), "I" (1 << 16)
++	: "cc");
++
++	while (lockval.tickets.next != lockval.tickets.owner) {
++		wfe();
++		lockval.tickets.owner = READ_ONCE(lock->tickets.owner);
++	}
++	smp_mb();
++}
++#else
++inline void fiq_fsm_spin_lock(fiq_lock_t *lock) { }
++#endif
++
++/**
++ * fiq_fsm_spin_unlock() - ARMv6+ bare bones spinunlock
++ */
++#if defined(CONFIG_ARCH_BCM2835) && defined(CONFIG_SMP)
++inline void fiq_fsm_spin_unlock(fiq_lock_t *lock)
++{
++	smp_mb();
++	lock->tickets.owner++;
++	dsb_sev();
++}
++#else
++inline void fiq_fsm_spin_unlock(fiq_lock_t *lock) { }
++#endif
++
++#endif
++
++/**
++ * fiq_fsm_restart_channel() - Poke channel enable bit for a split transaction
++ * @channel: channel to re-enable
++ */
++static void fiq_fsm_restart_channel(struct fiq_state *st, int n, int force)
++{
++	hcchar_data_t hcchar = { .d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR) };
++
++	hcchar.b.chen = 0;
++	if (st->channel[n].hcchar_copy.b.eptype & 0x1) {
++		hfnum_data_t hfnum = { .d32 = FIQ_READ(st->dwc_regs_base + HFNUM) };
++		/* Hardware bug workaround: update the ssplit index */
++		if (st->channel[n].hcsplt_copy.b.spltena)
++			st->channel[n].expected_uframe = (hfnum.b.frnum + 1) & 0x3FFF;
++
++		hcchar.b.oddfrm = (hfnum.b.frnum & 0x1) ? 0	: 1;
++	}
++
++	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR, hcchar.d32);
++	hcchar.d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR);
++	hcchar.b.chen = 1;
++
++	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR, hcchar.d32);
++	fiq_print(FIQDBG_INT, st, "HCGO %01d %01d", n, force);
++}
++
++/**
++ * fiq_fsm_setup_csplit() - Prepare a host channel for a CSplit transaction stage
++ * @st: Pointer to the channel's state
++ * @n : channel number
++ *
++ * Change host channel registers to perform a complete-split transaction. Being mindful of the
++ * endpoint direction, set control regs up correctly.
++ */
++static void notrace fiq_fsm_setup_csplit(struct fiq_state *st, int n)
++{
++	hcsplt_data_t hcsplt = { .d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCSPLT) };
++	hctsiz_data_t hctsiz = { .d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ) };
++
++	hcsplt.b.compsplt = 1;
++	if (st->channel[n].hcchar_copy.b.epdir == 1) {
++		// If IN, the CSPLIT result contains the data or a hub handshake. hctsiz = maxpacket.
++		hctsiz.b.xfersize = st->channel[n].hctsiz_copy.b.xfersize;
++	} else {
++		// If OUT, the CSPLIT result contains handshake only.
++		hctsiz.b.xfersize = 0;
++	}
++	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCSPLT, hcsplt.d32);
++	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ, hctsiz.d32);
++	mb();
++}
++
++/**
++ * fiq_fsm_restart_np_pending() - Restart a single non-periodic contended transfer
++ * @st: Pointer to the channel's state
++ * @num_channels: Total number of host channels
++ * @orig_channel: Channel index of completed transfer
++ *
++ * In the case where an IN and OUT transfer are simultaneously scheduled to the
++ * same device/EP, inadequate hub implementations will misbehave. Once the first
++ * transfer is complete, a pending non-periodic split can then be issued.
++ */
++static void notrace fiq_fsm_restart_np_pending(struct fiq_state *st, int num_channels, int orig_channel)
++{
++	int i;
++	int dev_addr = st->channel[orig_channel].hcchar_copy.b.devaddr;
++	int ep_num = st->channel[orig_channel].hcchar_copy.b.epnum;
++	for (i = 0; i < num_channels; i++) {
++		if (st->channel[i].fsm == FIQ_NP_SSPLIT_PENDING &&
++			st->channel[i].hcchar_copy.b.devaddr == dev_addr &&
++			st->channel[i].hcchar_copy.b.epnum == ep_num) {
++			st->channel[i].fsm = FIQ_NP_SSPLIT_STARTED;
++			fiq_fsm_restart_channel(st, i, 0);
++			break;
++		}
++	}
++}
++
++static inline int notrace fiq_get_xfer_len(struct fiq_state *st, int n)
++{
++	/* The xfersize register is a bit wonky. For IN transfers, it decrements by the packet size. */
++	hctsiz_data_t hctsiz = { .d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ) };
++
++	if (st->channel[n].hcchar_copy.b.epdir == 0) {
++		return st->channel[n].hctsiz_copy.b.xfersize;
++	} else {
++		return st->channel[n].hctsiz_copy.b.xfersize - hctsiz.b.xfersize;
++	}
++
++}
++
++
++/**
++ * fiq_increment_dma_buf() - update DMA address for bounce buffers after a CSPLIT
++ *
++ * Of use only for IN periodic transfers.
++ */
++static int notrace fiq_increment_dma_buf(struct fiq_state *st, int num_channels, int n)
++{
++	hcdma_data_t hcdma;
++	int i = st->channel[n].dma_info.index;
++	int len;
++	struct fiq_dma_blob *blob =
++		(struct fiq_dma_blob *)(uintptr_t)st->dma_base;
++
++	len = fiq_get_xfer_len(st, n);
++	fiq_print(FIQDBG_INT, st, "LEN: %03d", len);
++	st->channel[n].dma_info.slot_len[i] = len;
++	i++;
++	if (i > 6)
++		BUG();
++
++	hcdma.d32 = (u32)(uintptr_t)&blob->channel[n].index[i].buf[0];
++	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HC_DMA, hcdma.d32);
++	st->channel[n].dma_info.index = i;
++	return 0;
++}
++
++/**
++ * fiq_reload_hctsiz() - for IN transactions, reset HCTSIZ
++ */
++static void notrace fiq_fsm_reload_hctsiz(struct fiq_state *st, int n)
++{
++	hctsiz_data_t hctsiz = { .d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ) };
++	hctsiz.b.xfersize = st->channel[n].hctsiz_copy.b.xfersize;
++	hctsiz.b.pktcnt = 1;
++	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ, hctsiz.d32);
++}
++
++/**
++ * fiq_fsm_reload_hcdma() - for OUT transactions, rewind DMA pointer
++ */
++static void notrace fiq_fsm_reload_hcdma(struct fiq_state *st, int n)
++{
++	hcdma_data_t hcdma = st->channel[n].hcdma_copy;
++	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HC_DMA, hcdma.d32);
++}
++
++/**
++ * fiq_iso_out_advance() - update DMA address and split position bits
++ * for isochronous OUT transactions.
++ *
++ * Returns 1 if this is the last packet queued, 0 otherwise. Split-ALL and
++ * Split-BEGIN states are not handled - this is done when the transaction was queued.
++ *
++ * This function must only be called from the FIQ_ISO_OUT_ACTIVE state.
++ */
++static int notrace fiq_iso_out_advance(struct fiq_state *st, int num_channels, int n)
++{
++	hcsplt_data_t hcsplt;
++	hctsiz_data_t hctsiz;
++	hcdma_data_t hcdma;
++	struct fiq_dma_blob *blob =
++		(struct fiq_dma_blob *)(uintptr_t)st->dma_base;
++	int last = 0;
++	int i = st->channel[n].dma_info.index;
++
++	fiq_print(FIQDBG_INT, st, "ADV %01d %01d ", n, i);
++	i++;
++	if (i == 4)
++		last = 1;
++	if (st->channel[n].dma_info.slot_len[i+1] == 255)
++		last = 1;
++
++	/* New DMA address - address of bounce buffer referred to in index */
++	hcdma.d32 = (u32)(uintptr_t)blob->channel[n].index[i].buf;
++	//hcdma.d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HC_DMA);
++	//hcdma.d32 += st->channel[n].dma_info.slot_len[i];
++	fiq_print(FIQDBG_INT, st, "LAST: %01d ", last);
++	fiq_print(FIQDBG_INT, st, "LEN: %03d", st->channel[n].dma_info.slot_len[i]);
++	hcsplt.d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCSPLT);
++	hctsiz.d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ);
++	hcsplt.b.xactpos = (last) ? ISOC_XACTPOS_END : ISOC_XACTPOS_MID;
++	/* Set up new packet length */
++	hctsiz.b.pktcnt = 1;
++	hctsiz.b.xfersize = st->channel[n].dma_info.slot_len[i];
++	fiq_print(FIQDBG_INT, st, "%08x", hctsiz.d32);
++
++	st->channel[n].dma_info.index++;
++	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCSPLT, hcsplt.d32);
++	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ, hctsiz.d32);
++	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HC_DMA, hcdma.d32);
++	return last;
++}
++
++/**
++ * fiq_fsm_tt_next_isoc() - queue next pending isochronous out start-split on a TT
++ *
++ * Despite the limitations of the DWC core, we can force a microframe pipeline of
++ * isochronous OUT start-split transactions while waiting for a corresponding other-type
++ * of endpoint to finish its CSPLITs. TTs have big periodic buffers therefore it
++ * is very unlikely that filling the start-split FIFO will cause data loss.
++ * This allows much better interleaving of transactions in an order-independent way-
++ * there is no requirement to prioritise isochronous, just a state-space search has
++ * to be performed on each periodic start-split complete interrupt.
++ */
++static int notrace fiq_fsm_tt_next_isoc(struct fiq_state *st, int num_channels, int n)
++{
++	int hub_addr = st->channel[n].hub_addr;
++	int port_addr = st->channel[n].port_addr;
++	int i, poked = 0;
++	for (i = 0; i < num_channels; i++) {
++		if (i == n || st->channel[i].fsm == FIQ_PASSTHROUGH)
++			continue;
++		if (st->channel[i].hub_addr == hub_addr &&
++			st->channel[i].port_addr == port_addr) {
++			switch (st->channel[i].fsm) {
++			case FIQ_PER_ISO_OUT_PENDING:
++				if (st->channel[i].nrpackets == 1) {
++					st->channel[i].fsm = FIQ_PER_ISO_OUT_LAST;
++				} else {
++					st->channel[i].fsm = FIQ_PER_ISO_OUT_ACTIVE;
++				}
++				fiq_fsm_restart_channel(st, i, 0);
++				poked = 1;
++				break;
++
++			default:
++				break;
++			}
++		}
++		if (poked)
++			break;
++	}
++	return poked;
++}
++
++/**
++ * fiq_fsm_tt_in_use() - search for host channels using this TT
++ * @n: Channel to use as reference
++ *
++ */
++int notrace noinline fiq_fsm_tt_in_use(struct fiq_state *st, int num_channels, int n)
++{
++	int hub_addr = st->channel[n].hub_addr;
++	int port_addr = st->channel[n].port_addr;
++	int i, in_use = 0;
++	for (i = 0; i < num_channels; i++) {
++		if (i == n || st->channel[i].fsm == FIQ_PASSTHROUGH)
++			continue;
++		switch (st->channel[i].fsm) {
++		/* TT is reserved for channels that are in the middle of a periodic
++		 * split transaction.
++		 */
++		case FIQ_PER_SSPLIT_STARTED:
++		case FIQ_PER_CSPLIT_WAIT:
++		case FIQ_PER_CSPLIT_NYET1:
++		//case FIQ_PER_CSPLIT_POLL:
++		case FIQ_PER_ISO_OUT_ACTIVE:
++		case FIQ_PER_ISO_OUT_LAST:
++			if (st->channel[i].hub_addr == hub_addr &&
++				st->channel[i].port_addr == port_addr) {
++				in_use = 1;
++			}
++			break;
++		default:
++			break;
++		}
++		if (in_use)
++			break;
++	}
++	return in_use;
++}
++
++/**
++ * fiq_fsm_more_csplits() - determine whether additional CSPLITs need
++ * 			to be issued for this IN transaction.
++ *
++ * We cannot tell the inbound PID of a data packet due to hardware limitations.
++ * we need to make an educated guess as to whether we need to queue another CSPLIT
++ * or not. A no-brainer is when we have received enough data to fill the endpoint
++ * size, but for endpoints that give variable-length data then we have to resort
++ * to heuristics.
++ *
++ * We also return whether this is the last CSPLIT to be queued, again based on
++ * heuristics. This is to allow a 1-uframe overlap of periodic split transactions.
++ * Note: requires at least 1 CSPLIT to have been performed prior to being called.
++ */
++
++/*
++ * We need some way of guaranteeing if a returned periodic packet of size X
++ * has a DATA0 PID.
++ * The heuristic value of 144 bytes assumes that the received data has maximal
++ * bit-stuffing and the clock frequency of the transmitting device is at the lowest
++ * permissible limit. If the transfer length results in a final packet size
++ * 144 < p <= 188, then an erroneous CSPLIT will be issued.
++ * Also used to ensure that an endpoint will nominally only return a single
++ * complete-split worth of data.
++ */
++#define DATA0_PID_HEURISTIC 144
++
++static int notrace noinline fiq_fsm_more_csplits(struct fiq_state *state, int n, int *probably_last)
++{
++
++	int i;
++	int total_len = 0;
++	int more_needed = 1;
++	struct fiq_channel_state *st = &state->channel[n];
++
++	for (i = 0; i < st->dma_info.index; i++) {
++			total_len += st->dma_info.slot_len[i];
++	}
++
++	*probably_last = 0;
++
++	if (st->hcchar_copy.b.eptype == 0x3) {
++		/*
++		 * An interrupt endpoint will take max 2 CSPLITs. if we are receiving data
++		 * then this is definitely the last CSPLIT.
++		 */
++		*probably_last = 1;
++	} else {
++		/* Isoc IN. This is a bit risky if we are the first transaction:
++		 * we may have been held off slightly. */
++		if (i > 1 && st->dma_info.slot_len[st->dma_info.index-1] <= DATA0_PID_HEURISTIC) {
++			more_needed = 0;
++		}
++		/* If in the next uframe we will receive enough data to fill the endpoint,
++		 * then only issue 1 more csplit.
++		 */
++		if (st->hctsiz_copy.b.xfersize - total_len <= DATA0_PID_HEURISTIC)
++			*probably_last = 1;
++	}
++
++	if (total_len >= st->hctsiz_copy.b.xfersize ||
++		i == 6 || total_len == 0)
++		/* Note: due to bit stuffing it is possible to have > 6 CSPLITs for
++		 * a single endpoint. Accepting more would completely break our scheduling mechanism though
++		 * - in these extreme cases we will pass through a truncated packet.
++		 */
++		more_needed = 0;
++
++	return more_needed;
++}
++
++/**
++ * fiq_fsm_too_late() - Test transaction for lateness
++ *
++ * If a SSPLIT for a large IN transaction is issued too late in a frame,
++ * the hub will disable the port to the device and respond with ERR handshakes.
++ * The hub status endpoint will not reflect this change.
++ * Returns 1 if we will issue a SSPLIT that will result in a device babble.
++ */
++int notrace fiq_fsm_too_late(struct fiq_state *st, int n)
++{
++	int uframe;
++	hfnum_data_t hfnum = { .d32 = FIQ_READ(st->dwc_regs_base + HFNUM) };
++	uframe = hfnum.b.frnum & 0x7;
++	if ((uframe < 6) && (st->channel[n].nrpackets + 1 + uframe > 7)) {
++		return 1;
++	} else {
++		return 0;
++	}
++}
++
++
++/**
++ * fiq_fsm_start_next_periodic() - A half-arsed attempt at a microframe pipeline
++ *
++ * Search pending transactions in the start-split pending state and queue them.
++ * Don't queue packets in uframe .5 (comes out in .6) (USB2.0 11.18.4).
++ * Note: we specifically don't do isochronous OUT transactions first because better
++ * use of the TT's start-split fifo can be achieved by pipelining an IN before an OUT.
++ */
++static void notrace noinline fiq_fsm_start_next_periodic(struct fiq_state *st, int num_channels)
++{
++	int n;
++	hfnum_data_t hfnum = { .d32 = FIQ_READ(st->dwc_regs_base + HFNUM) };
++	if ((hfnum.b.frnum & 0x7) == 5)
++		return;
++	for (n = 0; n < num_channels; n++) {
++		if (st->channel[n].fsm == FIQ_PER_SSPLIT_QUEUED) {
++			/* Check to see if any other transactions are using this TT */
++			if(!fiq_fsm_tt_in_use(st, num_channels, n)) {
++				if (!fiq_fsm_too_late(st, n)) {
++					st->channel[n].fsm = FIQ_PER_SSPLIT_STARTED;
++					fiq_print(FIQDBG_INT, st, "NEXTPER ");
++					fiq_fsm_restart_channel(st, n, 0);
++				} else {
++					st->channel[n].fsm = FIQ_PER_SPLIT_TIMEOUT;
++				}
++				break;
++			}
++		}
++	}
++	for (n = 0; n < num_channels; n++) {
++		if (st->channel[n].fsm == FIQ_PER_ISO_OUT_PENDING) {
++			if (!fiq_fsm_tt_in_use(st, num_channels, n)) {
++				fiq_print(FIQDBG_INT, st, "NEXTISO ");
++				if (st->channel[n].nrpackets == 1)
++					st->channel[n].fsm = FIQ_PER_ISO_OUT_LAST;
++				else
++					st->channel[n].fsm = FIQ_PER_ISO_OUT_ACTIVE;
++				fiq_fsm_restart_channel(st, n, 0);
++				break;
++			}
++		}
++	}
++}
++
++/**
++ * fiq_fsm_update_hs_isoc() - update isochronous frame and transfer data
++ * @state:	Pointer to fiq_state
++ * @n:		Channel transaction is active on
++ * @hcint:	Copy of host channel interrupt register
++ *
++ * Returns 0 if there are no more transactions for this HC to do, 1
++ * otherwise.
++ */
++static int notrace noinline fiq_fsm_update_hs_isoc(struct fiq_state *state, int n, hcint_data_t hcint)
++{
++	struct fiq_channel_state *st = &state->channel[n];
++	int xfer_len = 0, nrpackets = 0;
++	hcdma_data_t hcdma;
++	fiq_print(FIQDBG_INT, state, "HSISO %02d", n);
++
++	xfer_len = fiq_get_xfer_len(state, n);
++	st->hs_isoc_info.iso_desc[st->hs_isoc_info.index].actual_length = xfer_len;
++
++	st->hs_isoc_info.iso_desc[st->hs_isoc_info.index].status = hcint.d32;
++
++	st->hs_isoc_info.index++;
++	if (st->hs_isoc_info.index == st->hs_isoc_info.nrframes) {
++		return 0;
++	}
++
++	/* grab the next DMA address offset from the array */
++	hcdma.d32 = st->hcdma_copy.d32 + st->hs_isoc_info.iso_desc[st->hs_isoc_info.index].offset;
++	FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HC_DMA, hcdma.d32);
++
++	/* We need to set multi_count. This is a bit tricky - has to be set per-transaction as
++	 * the core needs to be told to send the correct number. Caution: for IN transfers,
++	 * this is always set to the maximum size of the endpoint. */
++	xfer_len = st->hs_isoc_info.iso_desc[st->hs_isoc_info.index].length;
++	/* Integer divide in a FIQ: fun. FIXME: make this not suck */
++	nrpackets = (xfer_len + st->hcchar_copy.b.mps - 1) / st->hcchar_copy.b.mps;
++	if (nrpackets == 0)
++		nrpackets = 1;
++	st->hcchar_copy.b.multicnt = nrpackets;
++	st->hctsiz_copy.b.pktcnt = nrpackets;
++
++	/* Initial PID also needs to be set */
++	if (st->hcchar_copy.b.epdir == 0) {
++		st->hctsiz_copy.b.xfersize = xfer_len;
++		switch (st->hcchar_copy.b.multicnt) {
++		case 1:
++			st->hctsiz_copy.b.pid = DWC_PID_DATA0;
++			break;
++		case 2:
++		case 3:
++			st->hctsiz_copy.b.pid = DWC_PID_MDATA;
++			break;
++		}
++
++	} else {
++		st->hctsiz_copy.b.xfersize = nrpackets * st->hcchar_copy.b.mps;
++		switch (st->hcchar_copy.b.multicnt) {
++		case 1:
++			st->hctsiz_copy.b.pid = DWC_PID_DATA0;
++			break;
++		case 2:
++			st->hctsiz_copy.b.pid = DWC_PID_DATA1;
++			break;
++		case 3:
++			st->hctsiz_copy.b.pid = DWC_PID_DATA2;
++			break;
++		}
++	}
++	FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ, st->hctsiz_copy.d32);
++	FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR, st->hcchar_copy.d32);
++	/* Channel is enabled on hcint handler exit */
++	fiq_print(FIQDBG_INT, state, "HSISOOUT");
++	return 1;
++}
++
++
++/**
++ * fiq_fsm_do_sof() - FSM start-of-frame interrupt handler
++ * @state:	Pointer to the state struct passed from banked FIQ mode registers.
++ * @num_channels:	set according to the DWC hardware configuration
++ *
++ * The SOF handler in FSM mode has two functions
++ * 1. Hold off SOF from causing schedule advancement in IRQ context if there's
++ *    nothing to do
++ * 2. Advance certain FSM states that require either a microframe delay, or a microframe
++ *    of holdoff.
++ *
++ * The second part is architecture-specific to mach-bcm2835 -
++ * a sane interrupt controller would have a mask register for ARM interrupt sources
++ * to be promoted to the nFIQ line, but it doesn't. Instead a single interrupt
++ * number (USB) can be enabled. This means that certain parts of the USB specification
++ * that require "wait a little while, then issue another packet" cannot be fulfilled with
++ * the timing granularity required to achieve optimal throughout. The workaround is to use
++ * the SOF "timer" (125uS) to perform this task.
++ */
++static int notrace noinline fiq_fsm_do_sof(struct fiq_state *state, int num_channels)
++{
++	hfnum_data_t hfnum = { .d32 = FIQ_READ(state->dwc_regs_base + HFNUM) };
++	int n;
++	int kick_irq = 0;
++
++	if ((hfnum.b.frnum & 0x7) == 1) {
++		/* We cannot issue csplits for transactions in the last frame past (n+1).1
++		 * Check to see if there are any transactions that are stale.
++		 * Boot them out.
++		 */
++		for (n = 0; n < num_channels; n++) {
++			switch (state->channel[n].fsm) {
++			case FIQ_PER_CSPLIT_WAIT:
++			case FIQ_PER_CSPLIT_NYET1:
++			case FIQ_PER_CSPLIT_POLL:
++			case FIQ_PER_CSPLIT_LAST:
++				/* Check if we are no longer in the same full-speed frame. */
++				if (((state->channel[n].expected_uframe & 0x3FFF) & ~0x7) <
++						(hfnum.b.frnum & ~0x7))
++					state->channel[n].fsm = FIQ_PER_SPLIT_TIMEOUT;
++				break;
++			default:
++				break;
++			}
++		}
++	}
++
++	for (n = 0; n < num_channels; n++) {
++		switch (state->channel[n].fsm) {
++
++		case FIQ_NP_SSPLIT_RETRY:
++		case FIQ_NP_IN_CSPLIT_RETRY:
++		case FIQ_NP_OUT_CSPLIT_RETRY:
++			fiq_fsm_restart_channel(state, n, 0);
++			break;
++
++		case FIQ_HS_ISOC_SLEEPING:
++			/* Is it time to wake this channel yet? */
++			if (--state->channel[n].uframe_sleeps == 0) {
++				state->channel[n].fsm = FIQ_HS_ISOC_TURBO;
++				fiq_fsm_restart_channel(state, n, 0);
++			}
++			break;
++
++		case FIQ_PER_SSPLIT_QUEUED:
++			if ((hfnum.b.frnum & 0x7) == 5)
++				break;
++			if(!fiq_fsm_tt_in_use(state, num_channels, n)) {
++				if (!fiq_fsm_too_late(state, n)) {
++					fiq_print(FIQDBG_INT, state, "SOF GO %01d", n);
++					fiq_fsm_restart_channel(state, n, 0);
++					state->channel[n].fsm = FIQ_PER_SSPLIT_STARTED;
++				} else {
++					/* Transaction cannot be started without risking a device babble error */
++					state->channel[n].fsm = FIQ_PER_SPLIT_TIMEOUT;
++					state->haintmsk_saved.b2.chint &= ~(1 << n);
++					FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINTMSK, 0);
++					kick_irq |= 1;
++				}
++			}
++			break;
++
++		case FIQ_PER_ISO_OUT_PENDING:
++			/* Ordinarily, this should be poked after the SSPLIT
++			 * complete interrupt for a competing transfer on the same
++			 * TT. Doesn't happen for aborted transactions though.
++			 */
++			if ((hfnum.b.frnum & 0x7) >= 5)
++				break;
++			if (!fiq_fsm_tt_in_use(state, num_channels, n)) {
++				/* Hardware bug. SOF can sometimes occur after the channel halt interrupt
++				 * that caused this.
++				 */
++					fiq_fsm_restart_channel(state, n, 0);
++					fiq_print(FIQDBG_INT, state, "SOF ISOC");
++					if (state->channel[n].nrpackets == 1) {
++						state->channel[n].fsm = FIQ_PER_ISO_OUT_LAST;
++					} else {
++						state->channel[n].fsm = FIQ_PER_ISO_OUT_ACTIVE;
++					}
++			}
++			break;
++
++		case FIQ_PER_CSPLIT_WAIT:
++			/* we are guaranteed to be in this state if and only if the SSPLIT interrupt
++			 * occurred when the bus transaction occurred. The SOF interrupt reversal bug
++			 * will utterly bugger this up though.
++			 */
++			if (hfnum.b.frnum != state->channel[n].expected_uframe) {
++				fiq_print(FIQDBG_INT, state, "SOFCS %d ", n);
++				state->channel[n].fsm = FIQ_PER_CSPLIT_POLL;
++				fiq_fsm_restart_channel(state, n, 0);
++				fiq_fsm_start_next_periodic(state, num_channels);
++
++			}
++			break;
++
++		case FIQ_PER_SPLIT_TIMEOUT:
++		case FIQ_DEQUEUE_ISSUED:
++			/* Ugly: we have to force a HCD interrupt.
++			 * Poke the mask for the channel in question.
++			 * We will take a fake SOF because of this, but
++			 * that's OK.
++			 */
++			state->haintmsk_saved.b2.chint &= ~(1 << n);
++			FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINTMSK, 0);
++			kick_irq |= 1;
++			break;
++
++		default:
++			break;
++		}
++	}
++
++	if (state->kick_np_queues ||
++			dwc_frame_num_le(state->next_sched_frame, hfnum.b.frnum))
++		kick_irq |= 1;
++
++	return !kick_irq;
++}
++
++
++/**
++ * fiq_fsm_do_hcintr() - FSM host channel interrupt handler
++ * @state: Pointer to the FIQ state struct
++ * @num_channels: Number of channels as per hardware config
++ * @n: channel for which HAINT(i) was raised
++ *
++ * An important property is that only the CHHLT interrupt is unmasked. Unfortunately, AHBerr is as well.
++ */
++static int notrace noinline fiq_fsm_do_hcintr(struct fiq_state *state, int num_channels, int n)
++{
++	hcint_data_t hcint;
++	hcintmsk_data_t hcintmsk;
++	hcint_data_t hcint_probe;
++	hcchar_data_t hcchar;
++	int handled = 0;
++	int restart = 0;
++	int last_csplit = 0;
++	int start_next_periodic = 0;
++	struct fiq_channel_state *st = &state->channel[n];
++	hfnum_data_t hfnum;
++
++	hcint.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINT);
++	hcintmsk.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINTMSK);
++	hcint_probe.d32 = hcint.d32 & hcintmsk.d32;
++
++	if (st->fsm != FIQ_PASSTHROUGH) {
++		fiq_print(FIQDBG_INT, state, "HC%01d ST%02d", n, st->fsm);
++		fiq_print(FIQDBG_INT, state, "%08x", hcint.d32);
++	}
++
++	switch (st->fsm) {
++
++	case FIQ_PASSTHROUGH:
++	case FIQ_DEQUEUE_ISSUED:
++		/* doesn't belong to us, kick it upstairs */
++		break;
++
++	case FIQ_PASSTHROUGH_ERRORSTATE:
++		/* We are here to emulate the error recovery mechanism of the dwc HCD.
++		 * Several interrupts are unmasked if a previous transaction failed - it's
++		 * death for the FIQ to attempt to handle them as the channel isn't halted.
++		 * Emulate what the HCD does in this situation: mask and continue.
++		 * The FSM has no other state setup so this has to be handled out-of-band.
++		 */
++		fiq_print(FIQDBG_ERR, state, "ERRST %02d", n);
++		if (hcint_probe.b.nak || hcint_probe.b.ack || hcint_probe.b.datatglerr) {
++			fiq_print(FIQDBG_ERR, state, "RESET %02d", n);
++			/* In some random cases we can get a NAK interrupt coincident with a Xacterr
++			 * interrupt, after the device has disappeared.
++			 */
++			if (!hcint.b.xacterr)
++				st->nr_errors = 0;
++			hcintmsk.b.nak = 0;
++			hcintmsk.b.ack = 0;
++			hcintmsk.b.datatglerr = 0;
++			FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINTMSK, hcintmsk.d32);
++			return 1;
++		}
++		if (hcint_probe.b.chhltd) {
++			fiq_print(FIQDBG_ERR, state, "CHHLT %02d", n);
++			fiq_print(FIQDBG_ERR, state, "%08x", hcint.d32);
++			return 0;
++		}
++		break;
++
++	/* Non-periodic state groups */
++	case FIQ_NP_SSPLIT_STARTED:
++	case FIQ_NP_SSPLIT_RETRY:
++		/* Got a HCINT for a NP SSPLIT. Expected ACK / NAK / fail */
++		if (hcint.b.ack) {
++			/* SSPLIT complete. For OUT, the data has been sent. For IN, the LS transaction
++			 * will start shortly. SOF needs to kick the transaction to prevent a NYET flood.
++			 */
++			if(st->hcchar_copy.b.epdir == 1)
++				st->fsm = FIQ_NP_IN_CSPLIT_RETRY;
++			else
++				st->fsm = FIQ_NP_OUT_CSPLIT_RETRY;
++			st->nr_errors = 0;
++			handled = 1;
++			fiq_fsm_setup_csplit(state, n);
++		} else if (hcint.b.nak) {
++			// No buffer space in TT. Retry on a uframe boundary.
++			fiq_fsm_reload_hcdma(state, n);
++			st->fsm = FIQ_NP_SSPLIT_RETRY;
++			handled = 1;
++		} else if (hcint.b.xacterr) {
++			// The only other one we care about is xacterr. This implies HS bus error - retry.
++			st->nr_errors++;
++			if(st->hcchar_copy.b.epdir == 0)
++				fiq_fsm_reload_hcdma(state, n);
++			st->fsm = FIQ_NP_SSPLIT_RETRY;
++			if (st->nr_errors >= 3) {
++				st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
++			} else {
++				handled = 1;
++				restart = 1;
++			}
++		} else {
++			st->fsm = FIQ_NP_SPLIT_LS_ABORTED;
++			handled = 0;
++			restart = 0;
++		}
++		break;
++
++	case FIQ_NP_IN_CSPLIT_RETRY:
++		/* Received a CSPLIT done interrupt.
++		 * Expected Data/NAK/STALL/NYET for IN.
++		 */
++		if (hcint.b.xfercomp) {
++			/* For IN, data is present. */
++			st->fsm = FIQ_NP_SPLIT_DONE;
++		} else if (hcint.b.nak) {
++			/* no endpoint data. Punt it upstairs */
++			st->fsm = FIQ_NP_SPLIT_DONE;
++		} else if (hcint.b.nyet) {
++			/* CSPLIT NYET - retry on a uframe boundary. */
++			handled = 1;
++			st->nr_errors = 0;
++		} else if (hcint.b.datatglerr) {
++			/* data toggle errors do not set the xfercomp bit. */
++			st->fsm = FIQ_NP_SPLIT_LS_ABORTED;
++		} else if (hcint.b.xacterr) {
++			/* HS error. Retry immediate */
++			st->fsm = FIQ_NP_IN_CSPLIT_RETRY;
++			st->nr_errors++;
++			if (st->nr_errors >= 3) {
++				st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
++			} else {
++				handled = 1;
++				restart = 1;
++			}
++		} else if (hcint.b.stall || hcint.b.bblerr) {
++			/* A STALL implies either a LS bus error or a genuine STALL. */
++			st->fsm = FIQ_NP_SPLIT_LS_ABORTED;
++		} else {
++			/*  Hardware bug. It's possible in some cases to
++			 *  get a channel halt with nothing else set when
++			 *  the response was a NYET. Treat as local 3-strikes retry.
++			 */
++			hcint_data_t hcint_test = hcint;
++			hcint_test.b.chhltd = 0;
++			if (!hcint_test.d32) {
++				st->nr_errors++;
++				if (st->nr_errors >= 3) {
++					st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
++				} else {
++					handled = 1;
++				}
++			} else {
++				/* Bail out if something unexpected happened */
++				st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
++			}
++		}
++		if (st->fsm != FIQ_NP_IN_CSPLIT_RETRY) {
++			fiq_fsm_restart_np_pending(state, num_channels, n);
++		}
++		break;
++
++	case FIQ_NP_OUT_CSPLIT_RETRY:
++		/* Received a CSPLIT done interrupt.
++		 * Expected ACK/NAK/STALL/NYET/XFERCOMP for OUT.*/
++		if (hcint.b.xfercomp) {
++			st->fsm = FIQ_NP_SPLIT_DONE;
++		} else if (hcint.b.nak) {
++			// The HCD will implement the holdoff on frame boundaries.
++			st->fsm = FIQ_NP_SPLIT_DONE;
++		} else if (hcint.b.nyet) {
++			// Hub still processing.
++			st->fsm = FIQ_NP_OUT_CSPLIT_RETRY;
++			handled = 1;
++			st->nr_errors = 0;
++			//restart = 1;
++		} else if (hcint.b.xacterr) {
++			/* HS error. retry immediate */
++			st->fsm = FIQ_NP_OUT_CSPLIT_RETRY;
++			st->nr_errors++;
++			if (st->nr_errors >= 3) {
++				st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
++			} else {
++				handled = 1;
++				restart = 1;
++			}
++		} else if (hcint.b.stall) {
++			/* LS bus error or genuine stall */
++			st->fsm = FIQ_NP_SPLIT_LS_ABORTED;
++		} else {
++			/*
++			 * Hardware bug. It's possible in some cases to get a
++			 * channel halt with nothing else set when the response was a NYET.
++			 * Treat as local 3-strikes retry.
++			 */
++			hcint_data_t hcint_test = hcint;
++			hcint_test.b.chhltd = 0;
++			if (!hcint_test.d32) {
++				st->nr_errors++;
++				if (st->nr_errors >= 3) {
++					st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
++				} else {
++					handled = 1;
++				}
++			} else {
++				// Something unexpected happened. AHBerror or babble perhaps. Let the IRQ deal with it.
++				st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
++			}
++		}
++		if (st->fsm != FIQ_NP_OUT_CSPLIT_RETRY) {
++			fiq_fsm_restart_np_pending(state, num_channels, n);
++		}
++		break;
++
++	/* Periodic split states (except isoc out) */
++	case FIQ_PER_SSPLIT_STARTED:
++		/* Expect an ACK or failure for SSPLIT */
++		if (hcint.b.ack) {
++			/*
++			 * SSPLIT transfer complete interrupt - the generation of this interrupt is fraught with bugs.
++			 * For a packet queued in microframe n-3 to appear in n-2, if the channel is enabled near the EOF1
++			 * point for microframe n-3, the packet will not appear on the bus until microframe n.
++			 * Additionally, the generation of the actual interrupt is dodgy. For a packet appearing on the bus
++			 * in microframe n, sometimes the interrupt is generated immediately. Sometimes, it appears in n+1
++			 * coincident with SOF for n+1.
++			 * SOF is also buggy. It can sometimes be raised AFTER the first bus transaction has taken place.
++			 * These appear to be caused by timing/clock crossing bugs within the core itself.
++			 * State machine workaround.
++			 */
++			hfnum.d32 = FIQ_READ(state->dwc_regs_base + HFNUM);
++			hcchar.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR);
++			fiq_fsm_setup_csplit(state, n);
++			/* Poke the oddfrm bit. If we are equivalent, we received the interrupt at the correct
++			 * time. If not, then we're in the next SOF.
++			 */
++			if ((hfnum.b.frnum & 0x1) == hcchar.b.oddfrm) {
++				fiq_print(FIQDBG_INT, state, "CSWAIT %01d", n);
++				st->expected_uframe = hfnum.b.frnum;
++				st->fsm = FIQ_PER_CSPLIT_WAIT;
++			} else {
++				fiq_print(FIQDBG_INT, state, "CSPOL  %01d", n);
++				/* For isochronous IN endpoints,
++				 * we need to hold off if we are expecting a lot of data */
++				if (st->hcchar_copy.b.mps < DATA0_PID_HEURISTIC) {
++					start_next_periodic = 1;
++				}
++				/* Danger will robinson: we are in a broken state. If our first interrupt after
++				 * this is a NYET, it will be delayed by 1 uframe and result in an unrecoverable
++				 * lag. Unmask the NYET interrupt.
++				 */
++				st->expected_uframe = (hfnum.b.frnum + 1) & 0x3FFF;
++				st->fsm = FIQ_PER_CSPLIT_BROKEN_NYET1;
++				restart = 1;
++			}
++			handled = 1;
++		} else if (hcint.b.xacterr) {
++			/* 3-strikes retry is enabled, we have hit our max nr_errors */
++			st->fsm = FIQ_PER_SPLIT_HS_ABORTED;
++			start_next_periodic = 1;
++		} else {
++			st->fsm = FIQ_PER_SPLIT_HS_ABORTED;
++			start_next_periodic = 1;
++		}
++		/* We can now queue the next isochronous OUT transaction, if one is pending. */
++		if(fiq_fsm_tt_next_isoc(state, num_channels, n)) {
++			fiq_print(FIQDBG_INT, state, "NEXTISO ");
++		}
++		break;
++
++	case FIQ_PER_CSPLIT_NYET1:
++		/* First CSPLIT attempt was a NYET. If we get a subsequent NYET,
++		 * we are too late and the TT has dropped its CSPLIT fifo.
++		 */
++		hfnum.d32 = FIQ_READ(state->dwc_regs_base + HFNUM);
++		hcchar.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR);
++		start_next_periodic = 1;
++		if (hcint.b.nak) {
++			st->fsm = FIQ_PER_SPLIT_DONE;
++		} else if (hcint.b.xfercomp) {
++			fiq_increment_dma_buf(state, num_channels, n);
++			st->fsm = FIQ_PER_CSPLIT_POLL;
++			st->nr_errors = 0;
++			if (fiq_fsm_more_csplits(state, n, &last_csplit)) {
++				handled = 1;
++				restart = 1;
++				if (!last_csplit)
++					start_next_periodic = 0;
++			} else {
++				st->fsm = FIQ_PER_SPLIT_DONE;
++			}
++		} else if (hcint.b.nyet) {
++			/* Doh. Data lost. */
++			st->fsm = FIQ_PER_SPLIT_NYET_ABORTED;
++		} else if (hcint.b.xacterr || hcint.b.stall || hcint.b.bblerr) {
++			st->fsm = FIQ_PER_SPLIT_LS_ABORTED;
++		} else {
++			st->fsm = FIQ_PER_SPLIT_HS_ABORTED;
++		}
++		break;
++
++	case FIQ_PER_CSPLIT_BROKEN_NYET1:
++		/*
++		 * we got here because our host channel is in the delayed-interrupt
++		 * state and we cannot take a NYET interrupt any later than when it
++		 * occurred. Disable then re-enable the channel if this happens to force
++		 * CSPLITs to occur at the right time.
++		 */
++		hfnum.d32 = FIQ_READ(state->dwc_regs_base + HFNUM);
++		hcchar.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR);
++		fiq_print(FIQDBG_INT, state, "BROK: %01d ", n);
++		if (hcint.b.nak) {
++			st->fsm = FIQ_PER_SPLIT_DONE;
++			start_next_periodic = 1;
++		} else if (hcint.b.xfercomp) {
++			fiq_increment_dma_buf(state, num_channels, n);
++			if (fiq_fsm_more_csplits(state, n, &last_csplit)) {
++				st->fsm = FIQ_PER_CSPLIT_POLL;
++				handled = 1;
++				restart = 1;
++				start_next_periodic = 1;
++				/* Reload HCTSIZ for the next transfer */
++				fiq_fsm_reload_hctsiz(state, n);
++				if (!last_csplit)
++					start_next_periodic = 0;
++			} else {
++				st->fsm = FIQ_PER_SPLIT_DONE;
++			}
++		} else if (hcint.b.nyet) {
++			st->fsm = FIQ_PER_SPLIT_NYET_ABORTED;
++			start_next_periodic = 1;
++		} else if (hcint.b.xacterr || hcint.b.stall || hcint.b.bblerr) {
++			/* Local 3-strikes retry is handled by the core. This is a ERR response.*/
++			st->fsm = FIQ_PER_SPLIT_LS_ABORTED;
++		} else {
++			st->fsm = FIQ_PER_SPLIT_HS_ABORTED;
++		}
++		break;
++
++	case FIQ_PER_CSPLIT_POLL:
++		hfnum.d32 = FIQ_READ(state->dwc_regs_base + HFNUM);
++		hcchar.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR);
++		start_next_periodic = 1;
++		if (hcint.b.nak) {
++			st->fsm = FIQ_PER_SPLIT_DONE;
++		} else if (hcint.b.xfercomp) {
++			fiq_increment_dma_buf(state, num_channels, n);
++			if (fiq_fsm_more_csplits(state, n, &last_csplit)) {
++				handled = 1;
++				restart = 1;
++				/* Reload HCTSIZ for the next transfer */
++				fiq_fsm_reload_hctsiz(state, n);
++				if (!last_csplit)
++					start_next_periodic = 0;
++			} else {
++				st->fsm = FIQ_PER_SPLIT_DONE;
++			}
++		} else if (hcint.b.nyet) {
++			/* Are we a NYET after the first data packet? */
++			if (st->nrpackets == 0) {
++				st->fsm = FIQ_PER_CSPLIT_NYET1;
++				handled = 1;
++				restart = 1;
++			} else {
++				/* We got a NYET when polling CSPLITs. Can happen
++				 * if our heuristic fails, or if someone disables us
++				 * for any significant length of time.
++				 */
++				if (st->nr_errors >= 3) {
++					st->fsm = FIQ_PER_SPLIT_NYET_ABORTED;
++				} else {
++					st->fsm = FIQ_PER_SPLIT_DONE;
++				}
++			}
++		} else if (hcint.b.xacterr || hcint.b.stall || hcint.b.bblerr) {
++			/* For xacterr, Local 3-strikes retry is handled by the core. This is a ERR response.*/
++			st->fsm = FIQ_PER_SPLIT_LS_ABORTED;
++		} else {
++			st->fsm = FIQ_PER_SPLIT_HS_ABORTED;
++		}
++		break;
++
++	case FIQ_HS_ISOC_TURBO:
++		if (fiq_fsm_update_hs_isoc(state, n, hcint)) {
++			/* more transactions to come */
++			handled = 1;
++			fiq_print(FIQDBG_INT, state, "HSISO M ");
++			/* For strided transfers, put ourselves to sleep */
++			if (st->hs_isoc_info.stride > 1) {
++				st->uframe_sleeps = st->hs_isoc_info.stride - 1;
++				st->fsm = FIQ_HS_ISOC_SLEEPING;
++			} else {
++				restart = 1;
++			}
++		} else {
++			st->fsm = FIQ_HS_ISOC_DONE;
++			fiq_print(FIQDBG_INT, state, "HSISO F ");
++		}
++		break;
++
++	case FIQ_HS_ISOC_ABORTED:
++		/* This abort is called by the driver rewriting the state mid-transaction
++		 * which allows the dequeue mechanism to work more effectively.
++		 */
++		break;
++
++	case FIQ_PER_ISO_OUT_ACTIVE:
++		if (hcint.b.ack) {
++			if(fiq_iso_out_advance(state, num_channels, n)) {
++				/* last OUT transfer */
++				st->fsm = FIQ_PER_ISO_OUT_LAST;
++				/*
++				 * Assuming the periodic FIFO in the dwc core
++				 * actually does its job properly, we can queue
++				 * the next ssplit now and in theory, the wire
++				 * transactions will be in-order.
++				 */
++				// No it doesn't. It appears to process requests in host channel order.
++				//start_next_periodic = 1;
++			}
++			handled = 1;
++			restart = 1;
++		} else {
++			/*
++			 * Isochronous transactions carry on regardless. Log the error
++			 * and continue.
++			 */
++			//explode += 1;
++			st->nr_errors++;
++			if(fiq_iso_out_advance(state, num_channels, n)) {
++				st->fsm = FIQ_PER_ISO_OUT_LAST;
++				//start_next_periodic = 1;
++			}
++			handled = 1;
++			restart = 1;
++		}
++		break;
++
++	case FIQ_PER_ISO_OUT_LAST:
++		if (hcint.b.ack) {
++			/* All done here */
++			st->fsm = FIQ_PER_ISO_OUT_DONE;
++		} else {
++			st->fsm = FIQ_PER_ISO_OUT_DONE;
++			st->nr_errors++;
++		}
++		start_next_periodic = 1;
++		break;
++
++	case FIQ_PER_SPLIT_TIMEOUT:
++		/* SOF kicked us because we overran. */
++		start_next_periodic = 1;
++		break;
++
++	default:
++		break;
++	}
++
++	if (handled) {
++		FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINT, hcint.d32);
++	} else {
++		/* Copy the regs into the state so the IRQ knows what to do */
++		st->hcint_copy.d32 = hcint.d32;
++	}
++
++	if (restart) {
++		/* Restart always implies handled. */
++		if (restart == 2) {
++			/* For complete-split INs, the show must go on.
++			 * Force a channel restart */
++			fiq_fsm_restart_channel(state, n, 1);
++		} else {
++			fiq_fsm_restart_channel(state, n, 0);
++		}
++	}
++	if (start_next_periodic) {
++		fiq_fsm_start_next_periodic(state, num_channels);
++	}
++	if (st->fsm != FIQ_PASSTHROUGH)
++		fiq_print(FIQDBG_INT, state, "FSMOUT%02d", st->fsm);
++
++	return handled;
++}
++
++
++/**
++ * dwc_otg_fiq_fsm() - Flying State Machine (monster) FIQ
++ * @state:		pointer to state struct passed from the banked FIQ mode registers.
++ * @num_channels:	set according to the DWC hardware configuration
++ * @dma:		pointer to DMA bounce buffers for split transaction slots
++ *
++ * The FSM FIQ performs the low-level tasks that normally would be performed by the microcode
++ * inside an EHCI or similar host controller regarding split transactions. The DWC core
++ * interrupts each and every time a split transaction packet is received or sent successfully.
++ * This results in either an interrupt storm when everything is working "properly", or
++ * the interrupt latency of the system in general breaks time-sensitive periodic split
++ * transactions. Pushing the low-level, but relatively easy state machine work into the FIQ
++ * solves these problems.
++ *
++ * Return: void
++ */
++void notrace dwc_otg_fiq_fsm(struct fiq_state *state, int num_channels)
++{
++	gintsts_data_t gintsts, gintsts_handled;
++	gintmsk_data_t gintmsk;
++	//hfnum_data_t hfnum;
++	haint_data_t haint, haint_handled;
++	haintmsk_data_t haintmsk;
++	int kick_irq = 0;
++
++	/* Ensure peripheral reads issued prior to FIQ entry are complete */
++	dsb(sy);
++
++	gintsts_handled.d32 = 0;
++	haint_handled.d32 = 0;
++
++	fiq_fsm_spin_lock(&state->lock);
++	gintsts.d32 = FIQ_READ(state->dwc_regs_base + GINTSTS);
++	gintmsk.d32 = FIQ_READ(state->dwc_regs_base + GINTMSK);
++	gintsts.d32 &= gintmsk.d32;
++
++	if (gintsts.b.sofintr) {
++		/* For FSM mode, SOF is required to keep the state machine advance for
++		 * certain stages of the periodic pipeline. It's death to mask this
++		 * interrupt in that case.
++		 */
++
++		if (!fiq_fsm_do_sof(state, num_channels)) {
++			/* Kick IRQ once. Queue advancement means that all pending transactions
++			 * will get serviced when the IRQ finally executes.
++			 */
++			if (state->gintmsk_saved.b.sofintr == 1)
++				kick_irq |= 1;
++			state->gintmsk_saved.b.sofintr = 0;
++		}
++		gintsts_handled.b.sofintr = 1;
++	}
++
++	if (gintsts.b.hcintr) {
++		int i;
++		haint.d32 = FIQ_READ(state->dwc_regs_base + HAINT);
++		haintmsk.d32 = FIQ_READ(state->dwc_regs_base + HAINTMSK);
++		haint.d32 &= haintmsk.d32;
++		haint_handled.d32 = 0;
++		for (i=0; i<num_channels; i++) {
++			if (haint.b2.chint & (1 << i)) {
++				if(!fiq_fsm_do_hcintr(state, num_channels, i)) {
++					/* HCINT was not handled in FIQ
++					 * HAINT is level-sensitive, leading to level-sensitive ginststs.b.hcint bit.
++					 * Mask HAINT(i) but keep top-level hcint unmasked.
++					 */
++					state->haintmsk_saved.b2.chint &= ~(1 << i);
++				} else {
++					/* do_hcintr cleaned up after itself, but clear haint */
++					haint_handled.b2.chint |= (1 << i);
++				}
++			}
++		}
++
++		if (haint_handled.b2.chint) {
++			FIQ_WRITE(state->dwc_regs_base + HAINT, haint_handled.d32);
++		}
++
++		if (haintmsk.d32 != (haintmsk.d32 & state->haintmsk_saved.d32)) {
++			/*
++			 * This is necessary to avoid multiple retriggers of the MPHI in the case
++			 * where interrupts are held off and HCINTs start to pile up.
++			 * Only wake up the IRQ if a new interrupt came in, was not handled and was
++			 * masked.
++			 */
++			haintmsk.d32 &= state->haintmsk_saved.d32;
++			FIQ_WRITE(state->dwc_regs_base + HAINTMSK, haintmsk.d32);
++			kick_irq |= 1;
++		}
++		/* Top-Level interrupt - always handled because it's level-sensitive */
++		gintsts_handled.b.hcintr = 1;
++	}
++
++
++	/* Clear the bits in the saved register that were not handled but were triggered. */
++	state->gintmsk_saved.d32 &= ~(gintsts.d32 & ~gintsts_handled.d32);
++
++	/* FIQ didn't handle something - mask has changed - write new mask */
++	if (gintmsk.d32 != (gintmsk.d32 & state->gintmsk_saved.d32)) {
++		gintmsk.d32 &= state->gintmsk_saved.d32;
++		gintmsk.b.sofintr = 1;
++		FIQ_WRITE(state->dwc_regs_base + GINTMSK, gintmsk.d32);
++//		fiq_print(FIQDBG_INT, state, "KICKGINT");
++//		fiq_print(FIQDBG_INT, state, "%08x", gintmsk.d32);
++//		fiq_print(FIQDBG_INT, state, "%08x", state->gintmsk_saved.d32);
++		kick_irq |= 1;
++	}
++
++	if (gintsts_handled.d32) {
++		/* Only applies to edge-sensitive bits in GINTSTS */
++		FIQ_WRITE(state->dwc_regs_base + GINTSTS, gintsts_handled.d32);
++	}
++
++	/* We got an interrupt, didn't handle it. */
++	if (kick_irq) {
++		state->mphi_int_count++;
++		if (state->mphi_regs.swirq_set) {
++			FIQ_WRITE(state->mphi_regs.swirq_set, 1);
++		} else {
++			FIQ_WRITE(state->mphi_regs.outdda, state->dummy_send_dma);
++			FIQ_WRITE(state->mphi_regs.outddb, (1<<29));
++		}
++
++	}
++	state->fiq_done++;
++	mb();
++	fiq_fsm_spin_unlock(&state->lock);
++}
++
++
++/**
++ * dwc_otg_fiq_nop() - FIQ "lite"
++ * @state:	pointer to state struct passed from the banked FIQ mode registers.
++ *
++ * The "nop" handler does not intervene on any interrupts other than SOF.
++ * It is limited in scope to deciding at each SOF if the IRQ SOF handler (which deals
++ * with non-periodic/periodic queues) needs to be kicked.
++ *
++ * This is done to hold off the SOF interrupt, which occurs at a rate of 8000 per second.
++ *
++ * Return: void
++ */
++void notrace dwc_otg_fiq_nop(struct fiq_state *state)
++{
++	gintsts_data_t gintsts, gintsts_handled;
++	gintmsk_data_t gintmsk;
++	hfnum_data_t hfnum;
++
++	/* Ensure peripheral reads issued prior to FIQ entry are complete */
++	dsb(sy);
++
++	fiq_fsm_spin_lock(&state->lock);
++	hfnum.d32 = FIQ_READ(state->dwc_regs_base + HFNUM);
++	gintsts.d32 = FIQ_READ(state->dwc_regs_base + GINTSTS);
++	gintmsk.d32 = FIQ_READ(state->dwc_regs_base + GINTMSK);
++	gintsts.d32 &= gintmsk.d32;
++	gintsts_handled.d32 = 0;
++
++	if (gintsts.b.sofintr) {
++		if (!state->kick_np_queues &&
++				dwc_frame_num_gt(state->next_sched_frame, hfnum.b.frnum)) {
++			/* SOF handled, no work to do, just ACK interrupt */
++			gintsts_handled.b.sofintr = 1;
++		} else {
++			/* Kick IRQ */
++			state->gintmsk_saved.b.sofintr = 0;
++		}
++	}
++
++	/* Reset handled interrupts */
++	if(gintsts_handled.d32) {
++		FIQ_WRITE(state->dwc_regs_base + GINTSTS, gintsts_handled.d32);
++	}
++
++	/* Clear the bits in the saved register that were not handled but were triggered. */
++	state->gintmsk_saved.d32 &= ~(gintsts.d32 & ~gintsts_handled.d32);
++
++	/* We got an interrupt, didn't handle it and want to mask it */
++	if (~(state->gintmsk_saved.d32)) {
++		state->mphi_int_count++;
++		gintmsk.d32 &= state->gintmsk_saved.d32;
++		FIQ_WRITE(state->dwc_regs_base + GINTMSK, gintmsk.d32);
++		if (state->mphi_regs.swirq_set) {
++			FIQ_WRITE(state->mphi_regs.swirq_set, 1);
++		} else {
++			/* Force a clear before another dummy send */
++			FIQ_WRITE(state->mphi_regs.intstat, (1<<29));
++			FIQ_WRITE(state->mphi_regs.outdda, state->dummy_send_dma);
++			FIQ_WRITE(state->mphi_regs.outddb, (1<<29));
++		}
++	}
++	state->fiq_done++;
++	mb();
++	fiq_fsm_spin_unlock(&state->lock);
++}
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h
+@@ -0,0 +1,399 @@
++/*
++ * dwc_otg_fiq_fsm.h - Finite state machine FIQ header definitions
++ *
++ * Copyright (c) 2013 Raspberry Pi Foundation
++ *
++ * Author: Jonathan Bell <jonathan@raspberrypi.org>
++ * All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions are met:
++ *	* Redistributions of source code must retain the above copyright
++ *	  notice, this list of conditions and the following disclaimer.
++ *	* Redistributions in binary form must reproduce the above copyright
++ *	  notice, this list of conditions and the following disclaimer in the
++ *	  documentation and/or other materials provided with the distribution.
++ *	* Neither the name of Raspberry Pi nor the
++ *	  names of its contributors may be used to endorse or promote products
++ *	  derived from this software without specific prior written permission.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
++ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
++ * DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
++ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
++ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ * This FIQ implements functionality that performs split transactions on
++ * the dwc_otg hardware without any outside intervention. A split transaction
++ * is "queued" by nominating a specific host channel to perform the entirety
++ * of a split transaction. This FIQ will then perform the microframe-precise
++ * scheduling required in each phase of the transaction until completion.
++ *
++ * The FIQ functionality has been surgically implanted into the Synopsys
++ * vendor-provided driver.
++ *
++ */
++
++#ifndef DWC_OTG_FIQ_FSM_H_
++#define DWC_OTG_FIQ_FSM_H_
++
++#include "dwc_otg_regs.h"
++#include "dwc_otg_cil.h"
++#include "dwc_otg_hcd.h"
++#include <linux/kernel.h>
++#include <linux/irqflags.h>
++#include <linux/string.h>
++#include <asm/barrier.h>
++
++#if 0
++#define FLAME_ON(x)					\
++do {							\
++	int gpioreg;                                    \
++							\
++	gpioreg = readl(__io_address(0x20200000+0x8));	\
++	gpioreg &= ~(7 << (x-20)*3);			\
++	gpioreg |= 0x1 << (x-20)*3;			\
++	writel(gpioreg, __io_address(0x20200000+0x8));	\
++							\
++	writel(1<<x, __io_address(0x20200000+(0x1C)));	\
++} while (0)
++
++#define FLAME_OFF(x)					\
++do {							\
++	writel(1<<x, __io_address(0x20200000+(0x28)));	\
++} while (0)
++#else
++#define FLAME_ON(x) do { } while (0)
++#define FLAME_OFF(X) do { } while (0)
++#endif
++
++/* This is a quick-and-dirty arch-specific register read/write. We know that
++ * writes to a peripheral on BCM2835 will always arrive in-order, also that
++ * reads and writes are executed in-order therefore the need for memory barriers
++ * is obviated if we're only talking to USB.
++ */
++#define FIQ_WRITE(_addr_,_data_) (*(volatile unsigned int *) (_addr_) = (_data_))
++#define FIQ_READ(_addr_) (*(volatile unsigned int *) (_addr_))
++
++/* FIQ-ified register definitions. Offsets are from dwc_regs_base. */
++#define GINTSTS		0x014
++#define GINTMSK		0x018
++/* Debug register. Poll the top of the received packets FIFO. */
++#define GRXSTSR		0x01C
++#define HFNUM		0x408
++#define HAINT		0x414
++#define HAINTMSK	0x418
++#define HPRT0		0x440
++
++/* HC_regs start from an offset of 0x500 */
++#define HC_START	0x500
++#define HC_OFFSET	0x020
++
++#define HC_DMA		0x14
++
++#define HCCHAR		0x00
++#define HCSPLT		0x04
++#define HCINT		0x08
++#define HCINTMSK	0x0C
++#define HCTSIZ		0x10
++
++#define ISOC_XACTPOS_ALL 	0b11
++#define ISOC_XACTPOS_BEGIN	0b10
++#define ISOC_XACTPOS_MID	0b00
++#define ISOC_XACTPOS_END	0b01
++
++#define DWC_PID_DATA2	0b01
++#define DWC_PID_MDATA	0b11
++#define DWC_PID_DATA1	0b10
++#define DWC_PID_DATA0	0b00
++
++typedef struct {
++	volatile void* base;
++	volatile void* ctrl;
++	volatile void* outdda;
++	volatile void* outddb;
++	volatile void* intstat;
++	volatile void* swirq_set;
++	volatile void* swirq_clr;
++} mphi_regs_t;
++
++enum fiq_debug_level {
++	FIQDBG_SCHED = (1 << 0),
++	FIQDBG_INT   = (1 << 1),
++	FIQDBG_ERR   = (1 << 2),
++	FIQDBG_PORTHUB = (1 << 3),
++};
++
++#ifdef CONFIG_ARM64
++
++typedef spinlock_t fiq_lock_t;
++
++#else
++
++typedef struct {
++	union {
++		uint32_t slock;
++		struct _tickets {
++			uint16_t owner;
++			uint16_t next;
++		} tickets;
++	};
++} fiq_lock_t;
++
++#endif
++
++struct fiq_state;
++
++extern void _fiq_print (enum fiq_debug_level dbg_lvl, volatile struct fiq_state *state, char *fmt, ...);
++#if 0
++#define fiq_print _fiq_print
++#else
++#define fiq_print(x, y, ...)
++#endif
++
++extern bool fiq_enable, fiq_fsm_enable;
++extern ushort nak_holdoff;
++
++/**
++ * enum fiq_fsm_state - The FIQ FSM states.
++ *
++ * This is the "core" of the FIQ FSM. Broadly, the FSM states follow the
++ * USB2.0 specification for host responses to various transaction states.
++ * There are modifications to this host state machine because of a variety of
++ * quirks and limitations in the dwc_otg hardware.
++ *
++ * The fsm state is also used to communicate back to the driver on completion of
++ * a split transaction. The end states are used in conjunction with the interrupts
++ * raised by the final transaction.
++ */
++enum fiq_fsm_state {
++	/* FIQ isn't enabled for this host channel */
++	FIQ_PASSTHROUGH = 0,
++	/* For the first interrupt received for this channel,
++	 * the FIQ has to ack any interrupts indicating success. */
++	FIQ_PASSTHROUGH_ERRORSTATE = 31,
++	/* Nonperiodic state groups */
++	FIQ_NP_SSPLIT_STARTED = 1,
++	FIQ_NP_SSPLIT_RETRY = 2,
++	/* TT contention - working around hub bugs */
++	FIQ_NP_SSPLIT_PENDING = 33,
++	FIQ_NP_OUT_CSPLIT_RETRY = 3,
++	FIQ_NP_IN_CSPLIT_RETRY = 4,
++	FIQ_NP_SPLIT_DONE = 5,
++	FIQ_NP_SPLIT_LS_ABORTED = 6,
++	/* This differentiates a HS transaction error from a LS one
++	 * (handling the hub state is different) */
++	FIQ_NP_SPLIT_HS_ABORTED = 7,
++
++	/* Periodic state groups */
++	/* Periodic transactions are either started directly by the IRQ handler
++	 * or deferred if the TT is already in use.
++	 */
++	FIQ_PER_SSPLIT_QUEUED = 8,
++	FIQ_PER_SSPLIT_STARTED = 9,
++	FIQ_PER_SSPLIT_LAST = 10,
++
++
++	FIQ_PER_ISO_OUT_PENDING = 11,
++	FIQ_PER_ISO_OUT_ACTIVE = 12,
++	FIQ_PER_ISO_OUT_LAST = 13,
++	FIQ_PER_ISO_OUT_DONE = 27,
++
++	FIQ_PER_CSPLIT_WAIT = 14,
++	FIQ_PER_CSPLIT_NYET1 = 15,
++	FIQ_PER_CSPLIT_BROKEN_NYET1 = 28,
++	FIQ_PER_CSPLIT_NYET_FAFF = 29,
++	/* For multiple CSPLITs (large isoc IN, or delayed interrupt) */
++	FIQ_PER_CSPLIT_POLL = 16,
++	/* The last CSPLIT for a transaction has been issued, differentiates
++	 * for the state machine to queue the next packet.
++	 */
++	FIQ_PER_CSPLIT_LAST = 17,
++
++	FIQ_PER_SPLIT_DONE = 18,
++	FIQ_PER_SPLIT_LS_ABORTED = 19,
++	FIQ_PER_SPLIT_HS_ABORTED = 20,
++	FIQ_PER_SPLIT_NYET_ABORTED = 21,
++	/* Frame rollover has occurred without the transaction finishing. */
++	FIQ_PER_SPLIT_TIMEOUT = 22,
++
++	/* FIQ-accelerated HS Isochronous state groups */
++	FIQ_HS_ISOC_TURBO = 23,
++	/* For interval > 1, SOF wakes up the isochronous FSM */
++	FIQ_HS_ISOC_SLEEPING = 24,
++	FIQ_HS_ISOC_DONE = 25,
++	FIQ_HS_ISOC_ABORTED = 26,
++	FIQ_DEQUEUE_ISSUED = 30,
++	FIQ_TEST = 32,
++};
++
++struct fiq_stack {
++	int magic1;
++	uint8_t stack[2048];
++	int magic2;
++};
++
++
++/**
++ * struct fiq_dma_info - DMA bounce buffer utilisation information (per-channel)
++ * @index:	Number of slots reported used for IN transactions / number of slots
++ *			transmitted for an OUT transaction
++ * @slot_len[6]: Number of actual transfer bytes in each slot (255 if unused)
++ *
++ * Split transaction transfers can have variable length depending on other bus
++ * traffic. The OTG core DMA engine requires 4-byte aligned addresses therefore
++ * each transaction needs a guaranteed aligned address. A maximum of 6 split transfers
++ * can happen per-frame.
++ */
++struct fiq_dma_info {
++	u8 index;
++	u8 slot_len[6];
++};
++
++struct fiq_split_dma_slot {
++	u8 buf[188];
++} __attribute__((packed));
++
++struct fiq_dma_channel {
++	struct fiq_split_dma_slot index[6];
++} __attribute__((packed));
++
++struct fiq_dma_blob {
++	struct fiq_dma_channel channel[0];
++} __attribute__((packed));
++
++/**
++ * struct fiq_hs_isoc_info - USB2.0 isochronous data
++ * @iso_frame:	Pointer to the array of OTG URB iso_frame_descs.
++ * @nrframes:	Total length of iso_frame_desc array
++ * @index:	Current index (FIQ-maintained)
++ * @stride:	Interval in uframes between HS isoc transactions
++ */
++struct fiq_hs_isoc_info {
++	struct dwc_otg_hcd_iso_packet_desc *iso_desc;
++	unsigned int nrframes;
++	unsigned int index;
++	unsigned int stride;
++};
++
++/**
++ * struct fiq_channel_state - FIQ state machine storage
++ * @fsm:	Current state of the channel as understood by the FIQ
++ * @nr_errors:	Number of transaction errors on this split-transaction
++ * @hub_addr:   SSPLIT/CSPLIT destination hub
++ * @port_addr:  SSPLIT/CSPLIT destination port - always 1 if single TT hub
++ * @nrpackets:  For isoc OUT, the number of split-OUT packets to transmit. For
++ * 		split-IN, number of CSPLIT data packets that were received.
++ * @hcchar_copy:
++ * @hcsplt_copy:
++ * @hcintmsk_copy:
++ * @hctsiz_copy:	Copies of the host channel registers.
++ * 			For use as scratch, or for returning state.
++ *
++ * The fiq_channel_state is state storage between interrupts for a host channel. The
++ * FSM state is stored here. Members of this structure must only be set up by the
++ * driver prior to enabling the FIQ for this host channel, and not touched until the FIQ
++ * has updated the state to either a COMPLETE state group or ABORT state group.
++ */
++
++struct fiq_channel_state {
++	enum fiq_fsm_state fsm;
++	unsigned int nr_errors;
++	unsigned int hub_addr;
++	unsigned int port_addr;
++	/* Hardware bug workaround: sometimes channel halt interrupts are
++	 * delayed until the next SOF. Keep track of when we expected to get interrupted. */
++	unsigned int expected_uframe;
++	/* number of uframes remaining (for interval > 1 HS isoc transfers) before next transfer */
++	unsigned int uframe_sleeps;
++	/* in/out for communicating number of dma buffers used, or number of ISOC to do */
++	unsigned int nrpackets;
++	struct fiq_dma_info dma_info;
++	struct fiq_hs_isoc_info hs_isoc_info;
++	/* Copies of HC registers - in/out communication from/to IRQ handler
++	 * and for ease of channel setup. A bit of mungeing is performed - for
++	 * example the hctsiz.b.maxp is _always_ the max packet size of the endpoint.
++	 */
++	hcchar_data_t hcchar_copy;
++	hcsplt_data_t hcsplt_copy;
++	hcint_data_t hcint_copy;
++	hcintmsk_data_t hcintmsk_copy;
++	hctsiz_data_t hctsiz_copy;
++	hcdma_data_t hcdma_copy;
++};
++
++/**
++ * struct fiq_state - top-level FIQ state machine storage
++ * @mphi_regs:		virtual address of the MPHI peripheral register file
++ * @dwc_regs_base:	virtual address of the base of the DWC core register file
++ * @dma_base:		physical address for the base of the DMA bounce buffers
++ * @dummy_send:		Scratch area for sending a fake message to the MPHI peripheral
++ * @gintmsk_saved:	Top-level mask of interrupts that the FIQ has not handled.
++ * 			Used for determining which interrupts fired to set off the IRQ handler.
++ * @haintmsk_saved:	Mask of interrupts from host channels that the FIQ did not handle internally.
++ * @np_count:		Non-periodic transactions in the active queue
++ * @np_sent:		Count of non-periodic transactions that have completed
++ * @next_sched_frame:	For periodic transactions handled by the driver's SOF-driven queuing mechanism,
++ * 			this is the next frame on which a SOF interrupt is required. Used to hold off
++ * 			passing SOF through to the driver until necessary.
++ * @channel[n]:		Per-channel FIQ state. Allocated during init depending on the number of host
++ * 			channels configured into the core logic.
++ *
++ * This is passed as the first argument to the dwc_otg_fiq_fsm top-level FIQ handler from the asm stub.
++ * It contains top-level state information.
++ */
++struct fiq_state {
++	fiq_lock_t lock;
++	mphi_regs_t mphi_regs;
++	void *dwc_regs_base;
++	dma_addr_t dma_base;
++	struct fiq_dma_blob *fiq_dmab;
++	void *dummy_send;
++	dma_addr_t dummy_send_dma;
++	gintmsk_data_t gintmsk_saved;
++	haintmsk_data_t haintmsk_saved;
++	int mphi_int_count;
++	unsigned int fiq_done;
++	unsigned int kick_np_queues;
++	unsigned int next_sched_frame;
++#ifdef FIQ_DEBUG
++	char * buffer;
++	unsigned int bufsiz;
++#endif
++	struct fiq_channel_state channel[0];
++};
++
++#ifdef CONFIG_ARM64
++
++#ifdef local_fiq_enable
++#undef local_fiq_enable
++#endif
++
++#ifdef local_fiq_disable
++#undef local_fiq_disable
++#endif
++
++extern void local_fiq_enable(void);
++
++extern void local_fiq_disable(void);
++
++#endif
++
++extern void fiq_fsm_spin_lock(fiq_lock_t *lock);
++
++extern void fiq_fsm_spin_unlock(fiq_lock_t *lock);
++
++extern int fiq_fsm_too_late(struct fiq_state *st, int n);
++
++extern int fiq_fsm_tt_in_use(struct fiq_state *st, int num_channels, int n);
++
++extern void dwc_otg_fiq_fsm(struct fiq_state *state, int num_channels);
++
++extern void dwc_otg_fiq_nop(struct fiq_state *state);
++
++#endif /* DWC_OTG_FIQ_FSM_H_ */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_fiq_stub.S
+@@ -0,0 +1,80 @@
++/*
++ * dwc_otg_fiq_fsm.S - assembly stub for the FSM FIQ
++ *
++ * Copyright (c) 2013 Raspberry Pi Foundation
++ *
++ * Author: Jonathan Bell <jonathan@raspberrypi.org>
++ * All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions are met:
++ *	* Redistributions of source code must retain the above copyright
++ *	  notice, this list of conditions and the following disclaimer.
++ *	* Redistributions in binary form must reproduce the above copyright
++ *	  notice, this list of conditions and the following disclaimer in the
++ *	  documentation and/or other materials provided with the distribution.
++ *	* Neither the name of Raspberry Pi nor the
++ *	  names of its contributors may be used to endorse or promote products
++ *	  derived from this software without specific prior written permission.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
++ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
++ * DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
++ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
++ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++
++#include <asm/assembler.h>
++#include <linux/linkage.h>
++
++
++.text
++
++.global _dwc_otg_fiq_stub_end;
++
++/**
++  * _dwc_otg_fiq_stub() - entry copied to the FIQ vector page to allow
++  * a C-style function call with arguments from the FIQ banked registers.
++  * r0 = &hcd->fiq_state
++  * r1 = &hcd->num_channels
++  * r2 = &hcd->dma_buffers
++  * Tramples: r0, r1, r2, r4, fp, ip
++  */
++
++ENTRY(_dwc_otg_fiq_stub)
++	/* Stash unbanked regs - SP will have been set up for us */
++	mov ip, sp;
++	stmdb sp!, {r0-r12, lr};
++#ifdef FIQ_DEBUG
++	// Cycle profiling - read cycle counter at start
++	mrc p15, 0, r5, c15, c12, 1;
++#endif
++	/* r11 = fp, don't trample it */
++	mov r4, fp;
++	/* set EABI frame size */
++	sub fp, ip, #512;
++
++	/* for fiq NOP mode - just need state */
++	mov r0, r8;
++	/* r9 = num_channels */
++	mov r1, r9;
++	/* r10 = struct *dma_bufs */
++//	mov r2, r10;
++
++	/* r4 = &fiq_c_function */
++	blx r4;
++#ifdef FIQ_DEBUG
++	mrc p15, 0, r4, c15, c12, 1;
++	subs r5, r5, r4;
++	// r5 is now the cycle count time for executing the FIQ. Store it somewhere?
++#endif
++	ldmia sp!, {r0-r12, lr};
++	subs pc, lr, #4;
++_dwc_otg_fiq_stub_end:
++END(_dwc_otg_fiq_stub)
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd.c
+@@ -0,0 +1,4363 @@
++
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd.c $
++ * $Revision: #104 $
++ * $Date: 2011/10/24 $
++ * $Change: 1871159 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_DEVICE_ONLY
++
++/** @file
++ * This file implements HCD Core. All code in this file is portable and doesn't
++ * use any OS specific functions.
++ * Interface provided by HCD Core is defined in <code><hcd_if.h></code>
++ * header file.
++ */
++
++#include <linux/usb.h>
++#include <linux/usb/hcd.h>
++
++#include "dwc_otg_hcd.h"
++#include "dwc_otg_regs.h"
++#include "dwc_otg_fiq_fsm.h"
++
++extern bool microframe_schedule;
++extern uint16_t fiq_fsm_mask, nak_holdoff;
++
++//#define DEBUG_HOST_CHANNELS
++#ifdef DEBUG_HOST_CHANNELS
++static int last_sel_trans_num_per_scheduled = 0;
++static int last_sel_trans_num_nonper_scheduled = 0;
++static int last_sel_trans_num_avail_hc_at_start = 0;
++static int last_sel_trans_num_avail_hc_at_end = 0;
++#endif /* DEBUG_HOST_CHANNELS */
++
++
++dwc_otg_hcd_t *dwc_otg_hcd_alloc_hcd(void)
++{
++	return DWC_ALLOC(sizeof(dwc_otg_hcd_t));
++}
++
++/**
++ * Connection timeout function.  An OTG host is required to display a
++ * message if the device does not connect within 10 seconds.
++ */
++void dwc_otg_hcd_connect_timeout(void *ptr)
++{
++	DWC_DEBUGPL(DBG_HCDV, "%s(%p)\n", __func__, ptr);
++	DWC_PRINTF("Connect Timeout\n");
++	__DWC_ERROR("Device Not Connected/Responding\n");
++}
++
++#if defined(DEBUG)
++static void dump_channel_info(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	if (qh->channel != NULL) {
++		dwc_hc_t *hc = qh->channel;
++		dwc_list_link_t *item;
++		dwc_otg_qh_t *qh_item;
++		int num_channels = hcd->core_if->core_params->host_channels;
++		int i;
++
++		dwc_otg_hc_regs_t *hc_regs;
++		hcchar_data_t hcchar;
++		hcsplt_data_t hcsplt;
++		hctsiz_data_t hctsiz;
++		uint32_t hcdma;
++
++		hc_regs = hcd->core_if->host_if->hc_regs[hc->hc_num];
++		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++		hcsplt.d32 = DWC_READ_REG32(&hc_regs->hcsplt);
++		hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
++		hcdma = DWC_READ_REG32(&hc_regs->hcdma);
++
++		DWC_PRINTF("  Assigned to channel %p:\n", hc);
++		DWC_PRINTF("    hcchar 0x%08x, hcsplt 0x%08x\n", hcchar.d32,
++			   hcsplt.d32);
++		DWC_PRINTF("    hctsiz 0x%08x, hcdma 0x%08x\n", hctsiz.d32,
++			   hcdma);
++		DWC_PRINTF("    dev_addr: %d, ep_num: %d, ep_is_in: %d\n",
++			   hc->dev_addr, hc->ep_num, hc->ep_is_in);
++		DWC_PRINTF("    ep_type: %d\n", hc->ep_type);
++		DWC_PRINTF("    max_packet: %d\n", hc->max_packet);
++		DWC_PRINTF("    data_pid_start: %d\n", hc->data_pid_start);
++		DWC_PRINTF("    xfer_started: %d\n", hc->xfer_started);
++		DWC_PRINTF("    halt_status: %d\n", hc->halt_status);
++		DWC_PRINTF("    xfer_buff: %p\n", hc->xfer_buff);
++		DWC_PRINTF("    xfer_len: %d\n", hc->xfer_len);
++		DWC_PRINTF("    qh: %p\n", hc->qh);
++		DWC_PRINTF("  NP inactive sched:\n");
++		DWC_LIST_FOREACH(item, &hcd->non_periodic_sched_inactive) {
++			qh_item =
++			    DWC_LIST_ENTRY(item, dwc_otg_qh_t, qh_list_entry);
++			DWC_PRINTF("    %p\n", qh_item);
++		}
++		DWC_PRINTF("  NP active sched:\n");
++		DWC_LIST_FOREACH(item, &hcd->non_periodic_sched_active) {
++			qh_item =
++			    DWC_LIST_ENTRY(item, dwc_otg_qh_t, qh_list_entry);
++			DWC_PRINTF("    %p\n", qh_item);
++		}
++		DWC_PRINTF("  Channels: \n");
++		for (i = 0; i < num_channels; i++) {
++			dwc_hc_t *hc = hcd->hc_ptr_array[i];
++			DWC_PRINTF("    %2d: %p\n", i, hc);
++		}
++	}
++}
++#else
++#define dump_channel_info(hcd, qh)
++#endif /* DEBUG */
++
++/**
++ * Work queue function for starting the HCD when A-Cable is connected.
++ * The hcd_start() must be called in a process context.
++ */
++static void hcd_start_func(void *_vp)
++{
++	dwc_otg_hcd_t *hcd = (dwc_otg_hcd_t *) _vp;
++
++	DWC_DEBUGPL(DBG_HCDV, "%s() %p\n", __func__, hcd);
++	if (hcd) {
++		hcd->fops->start(hcd);
++	}
++}
++
++static void del_xfer_timers(dwc_otg_hcd_t * hcd)
++{
++#ifdef DEBUG
++	int i;
++	int num_channels = hcd->core_if->core_params->host_channels;
++	for (i = 0; i < num_channels; i++) {
++		DWC_TIMER_CANCEL(hcd->core_if->hc_xfer_timer[i]);
++	}
++#endif
++}
++
++static void del_timers(dwc_otg_hcd_t * hcd)
++{
++	del_xfer_timers(hcd);
++	DWC_TIMER_CANCEL(hcd->conn_timer);
++}
++
++/**
++ * Processes all the URBs in a single list of QHs. Completes them with
++ * -ESHUTDOWN and frees the QTD.
++ */
++static void kill_urbs_in_qh_list(dwc_otg_hcd_t * hcd, dwc_list_link_t * qh_list)
++{
++	dwc_list_link_t *qh_item, *qh_tmp;
++	dwc_otg_qh_t *qh;
++	dwc_otg_qtd_t *qtd, *qtd_tmp;
++	int quiesced = 0;
++
++	DWC_LIST_FOREACH_SAFE(qh_item, qh_tmp, qh_list) {
++		qh = DWC_LIST_ENTRY(qh_item, dwc_otg_qh_t, qh_list_entry);
++		DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp,
++					 &qh->qtd_list, qtd_list_entry) {
++			qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
++			if (qtd->urb != NULL) {
++				hcd->fops->complete(hcd, qtd->urb->priv,
++						    qtd->urb, -DWC_E_SHUTDOWN);
++				dwc_otg_hcd_qtd_remove_and_free(hcd, qtd, qh);
++			}
++
++		}
++		if(qh->channel) {
++			int n = qh->channel->hc_num;
++			/* Using hcchar.chen == 1 is not a reliable test.
++			 * It is possible that the channel has already halted
++			 * but not yet been through the IRQ handler.
++			 */
++			if (fiq_fsm_enable && (hcd->fiq_state->channel[qh->channel->hc_num].fsm != FIQ_PASSTHROUGH)) {
++				qh->channel->halt_status = DWC_OTG_HC_XFER_URB_DEQUEUE;
++				qh->channel->halt_pending = 1;
++				if (hcd->fiq_state->channel[n].fsm == FIQ_HS_ISOC_TURBO ||
++				    hcd->fiq_state->channel[n].fsm == FIQ_HS_ISOC_SLEEPING)
++					hcd->fiq_state->channel[n].fsm = FIQ_HS_ISOC_ABORTED;
++				/* We're called from disconnect callback or in the middle of freeing the HCD here,
++				 * so FIQ is disabled, top-level interrupts masked and we're holding the spinlock.
++				 * No further URBs will be submitted, but wait 1 microframe for any previously
++				 * submitted periodic DMA to finish.
++				 */
++				if (!quiesced) {
++					udelay(125);
++					quiesced = 1;
++				}
++			} else {
++				dwc_otg_hc_halt(hcd->core_if, qh->channel,
++						DWC_OTG_HC_XFER_URB_DEQUEUE);
++			}
++			qh->channel = NULL;
++		}
++		dwc_otg_hcd_qh_remove(hcd, qh);
++	}
++}
++
++/**
++ * Responds with an error status of ESHUTDOWN to all URBs in the non-periodic
++ * and periodic schedules. The QTD associated with each URB is removed from
++ * the schedule and freed. This function may be called when a disconnect is
++ * detected or when the HCD is being stopped.
++ */
++static void kill_all_urbs(dwc_otg_hcd_t * hcd)
++{
++	kill_urbs_in_qh_list(hcd, &hcd->non_periodic_sched_inactive);
++	kill_urbs_in_qh_list(hcd, &hcd->non_periodic_sched_active);
++	kill_urbs_in_qh_list(hcd, &hcd->periodic_sched_inactive);
++	kill_urbs_in_qh_list(hcd, &hcd->periodic_sched_ready);
++	kill_urbs_in_qh_list(hcd, &hcd->periodic_sched_assigned);
++	kill_urbs_in_qh_list(hcd, &hcd->periodic_sched_queued);
++}
++
++/**
++ * Start the connection timer.  An OTG host is required to display a
++ * message if the device does not connect within 10 seconds.  The
++ * timer is deleted if a port connect interrupt occurs before the
++ * timer expires.
++ */
++static void dwc_otg_hcd_start_connect_timer(dwc_otg_hcd_t * hcd)
++{
++	DWC_TIMER_SCHEDULE(hcd->conn_timer, 10000 /* 10 secs */ );
++}
++
++/**
++ * HCD Callback function for disconnect of the HCD.
++ *
++ * @param p void pointer to the <code>struct usb_hcd</code>
++ */
++static int32_t dwc_otg_hcd_session_start_cb(void *p)
++{
++	dwc_otg_hcd_t *dwc_otg_hcd;
++	DWC_DEBUGPL(DBG_HCDV, "%s(%p)\n", __func__, p);
++	dwc_otg_hcd = p;
++	dwc_otg_hcd_start_connect_timer(dwc_otg_hcd);
++	return 1;
++}
++
++/**
++ * HCD Callback function for starting the HCD when A-Cable is
++ * connected.
++ *
++ * @param p void pointer to the <code>struct usb_hcd</code>
++ */
++static int32_t dwc_otg_hcd_start_cb(void *p)
++{
++	dwc_otg_hcd_t *dwc_otg_hcd = p;
++	dwc_otg_core_if_t *core_if;
++	hprt0_data_t hprt0;
++
++	core_if = dwc_otg_hcd->core_if;
++
++	if (core_if->op_state == B_HOST) {
++		/*
++		 * Reset the port.  During a HNP mode switch the reset
++		 * needs to occur within 1ms and have a duration of at
++		 * least 50ms.
++		 */
++		hprt0.d32 = dwc_otg_read_hprt0(core_if);
++		hprt0.b.prtrst = 1;
++		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++	}
++	DWC_WORKQ_SCHEDULE_DELAYED(core_if->wq_otg,
++				   hcd_start_func, dwc_otg_hcd, 50,
++				   "start hcd");
++
++	return 1;
++}
++
++/**
++ * HCD Callback function for disconnect of the HCD.
++ *
++ * @param p void pointer to the <code>struct usb_hcd</code>
++ */
++static int32_t dwc_otg_hcd_disconnect_cb(void *p)
++{
++	gintsts_data_t intr;
++	dwc_otg_hcd_t *dwc_otg_hcd = p;
++
++	DWC_SPINLOCK(dwc_otg_hcd->lock);
++	/*
++	 * Set status flags for the hub driver.
++	 */
++	dwc_otg_hcd->flags.b.port_connect_status_change = 1;
++	dwc_otg_hcd->flags.b.port_connect_status = 0;
++	if(fiq_enable) {
++		local_fiq_disable();
++		fiq_fsm_spin_lock(&dwc_otg_hcd->fiq_state->lock);
++	}
++	/*
++	 * Shutdown any transfers in process by clearing the Tx FIFO Empty
++	 * interrupt mask and status bits and disabling subsequent host
++	 * channel interrupts.
++	 */
++	intr.d32 = 0;
++	intr.b.nptxfempty = 1;
++	intr.b.ptxfempty = 1;
++	intr.b.hcintr = 1;
++	DWC_MODIFY_REG32(&dwc_otg_hcd->core_if->core_global_regs->gintmsk,
++			 intr.d32, 0);
++	DWC_MODIFY_REG32(&dwc_otg_hcd->core_if->core_global_regs->gintsts,
++			 intr.d32, 0);
++
++	del_timers(dwc_otg_hcd);
++
++	/*
++	 * Turn off the vbus power only if the core has transitioned to device
++	 * mode. If still in host mode, need to keep power on to detect a
++	 * reconnection.
++	 */
++	if (dwc_otg_is_device_mode(dwc_otg_hcd->core_if)) {
++		if (dwc_otg_hcd->core_if->op_state != A_SUSPEND) {
++			hprt0_data_t hprt0 = {.d32 = 0 };
++			DWC_PRINTF("Disconnect: PortPower off\n");
++			hprt0.b.prtpwr = 0;
++			DWC_WRITE_REG32(dwc_otg_hcd->core_if->host_if->hprt0,
++					hprt0.d32);
++		}
++
++		dwc_otg_disable_host_interrupts(dwc_otg_hcd->core_if);
++	}
++
++	/* Respond with an error status to all URBs in the schedule. */
++	kill_all_urbs(dwc_otg_hcd);
++
++	if (dwc_otg_is_host_mode(dwc_otg_hcd->core_if)) {
++		/* Clean up any host channels that were in use. */
++		int num_channels;
++		int i;
++		dwc_hc_t *channel;
++		dwc_otg_hc_regs_t *hc_regs;
++		hcchar_data_t hcchar;
++
++		num_channels = dwc_otg_hcd->core_if->core_params->host_channels;
++
++		if (!dwc_otg_hcd->core_if->dma_enable) {
++			/* Flush out any channel requests in slave mode. */
++			for (i = 0; i < num_channels; i++) {
++				channel = dwc_otg_hcd->hc_ptr_array[i];
++				if (DWC_CIRCLEQ_EMPTY_ENTRY
++				    (channel, hc_list_entry)) {
++					hc_regs =
++					    dwc_otg_hcd->core_if->
++					    host_if->hc_regs[i];
++					hcchar.d32 =
++					    DWC_READ_REG32(&hc_regs->hcchar);
++					if (hcchar.b.chen) {
++						hcchar.b.chen = 0;
++						hcchar.b.chdis = 1;
++						hcchar.b.epdir = 0;
++						DWC_WRITE_REG32
++						    (&hc_regs->hcchar,
++						     hcchar.d32);
++					}
++				}
++			}
++		}
++
++		if(fiq_fsm_enable) {
++			for(i=0; i < 128; i++) {
++				dwc_otg_hcd->hub_port[i] = 0;
++			}
++		}
++	}
++
++	if(fiq_enable) {
++		fiq_fsm_spin_unlock(&dwc_otg_hcd->fiq_state->lock);
++		local_fiq_enable();
++	}
++
++	if (dwc_otg_hcd->fops->disconnect) {
++		dwc_otg_hcd->fops->disconnect(dwc_otg_hcd);
++	}
++
++	DWC_SPINUNLOCK(dwc_otg_hcd->lock);
++	return 1;
++}
++
++/**
++ * HCD Callback function for stopping the HCD.
++ *
++ * @param p void pointer to the <code>struct usb_hcd</code>
++ */
++static int32_t dwc_otg_hcd_stop_cb(void *p)
++{
++	dwc_otg_hcd_t *dwc_otg_hcd = p;
++
++	DWC_DEBUGPL(DBG_HCDV, "%s(%p)\n", __func__, p);
++	dwc_otg_hcd_stop(dwc_otg_hcd);
++	return 1;
++}
++
++#ifdef CONFIG_USB_DWC_OTG_LPM
++/**
++ * HCD Callback function for sleep of HCD.
++ *
++ * @param p void pointer to the <code>struct usb_hcd</code>
++ */
++static int dwc_otg_hcd_sleep_cb(void *p)
++{
++	dwc_otg_hcd_t *hcd = p;
++
++	dwc_otg_hcd_free_hc_from_lpm(hcd);
++
++	return 0;
++}
++#endif
++
++
++/**
++ * HCD Callback function for Remote Wakeup.
++ *
++ * @param p void pointer to the <code>struct usb_hcd</code>
++ */
++static int dwc_otg_hcd_rem_wakeup_cb(void *p)
++{
++	dwc_otg_hcd_t *hcd = p;
++
++	if (hcd->core_if->lx_state == DWC_OTG_L2) {
++		hcd->flags.b.port_suspend_change = 1;
++	}
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	else {
++		hcd->flags.b.port_l1_change = 1;
++	}
++#endif
++	return 0;
++}
++
++/**
++ * Halts the DWC_otg host mode operations in a clean manner. USB transfers are
++ * stopped.
++ */
++void dwc_otg_hcd_stop(dwc_otg_hcd_t * hcd)
++{
++	hprt0_data_t hprt0 = {.d32 = 0 };
++
++	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD STOP\n");
++
++	/*
++	 * The root hub should be disconnected before this function is called.
++	 * The disconnect will clear the QTD lists (via ..._hcd_urb_dequeue)
++	 * and the QH lists (via ..._hcd_endpoint_disable).
++	 */
++
++	/* Turn off all host-specific interrupts. */
++	dwc_otg_disable_host_interrupts(hcd->core_if);
++
++	/* Turn off the vbus power */
++	DWC_PRINTF("PortPower off\n");
++	hprt0.b.prtpwr = 0;
++	DWC_WRITE_REG32(hcd->core_if->host_if->hprt0, hprt0.d32);
++	dwc_mdelay(1);
++}
++
++int dwc_otg_hcd_urb_enqueue(dwc_otg_hcd_t * hcd,
++			    dwc_otg_hcd_urb_t * dwc_otg_urb, void **ep_handle,
++			    int atomic_alloc)
++{
++	int retval = 0;
++	uint8_t needs_scheduling = 0;
++	dwc_otg_transaction_type_e tr_type;
++	dwc_otg_qtd_t *qtd;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++	hprt0_data_t hprt0 = { .d32 = 0 };
++
++#ifdef DEBUG /* integrity checks (Broadcom) */
++	if (NULL == hcd->core_if) {
++		DWC_ERROR("**** DWC OTG HCD URB Enqueue - HCD has NULL core_if\n");
++		/* No longer connected. */
++		return -DWC_E_INVALID;
++	}
++#endif
++	if (!hcd->flags.b.port_connect_status) {
++		/* No longer connected. */
++		DWC_ERROR("Not connected\n");
++		return -DWC_E_NO_DEVICE;
++	}
++
++	/* Some core configurations cannot support LS traffic on a FS root port */
++	if ((hcd->fops->speed(hcd, dwc_otg_urb->priv) == USB_SPEED_LOW) &&
++		(hcd->core_if->hwcfg2.b.fs_phy_type == 1) &&
++		(hcd->core_if->hwcfg2.b.hs_phy_type == 1)) {
++			hprt0.d32 = DWC_READ_REG32(hcd->core_if->host_if->hprt0);
++			if (hprt0.b.prtspd == DWC_HPRT0_PRTSPD_FULL_SPEED) {
++				return -DWC_E_NO_DEVICE;
++			}
++	}
++
++	qtd = dwc_otg_hcd_qtd_create(dwc_otg_urb, atomic_alloc);
++	if (qtd == NULL) {
++		DWC_ERROR("DWC OTG HCD URB Enqueue failed creating QTD\n");
++		return -DWC_E_NO_MEMORY;
++	}
++#ifdef DEBUG /* integrity checks (Broadcom) */
++	if (qtd->urb == NULL) {
++		DWC_ERROR("**** DWC OTG HCD URB Enqueue created QTD with no URBs\n");
++		return -DWC_E_NO_MEMORY;
++	}
++	if (qtd->urb->priv == NULL) {
++		DWC_ERROR("**** DWC OTG HCD URB Enqueue created QTD URB with no URB handle\n");
++		return -DWC_E_NO_MEMORY;
++	}
++#endif
++	intr_mask.d32 = DWC_READ_REG32(&hcd->core_if->core_global_regs->gintmsk);
++	if(!intr_mask.b.sofintr || fiq_enable) needs_scheduling = 1;
++	if((((dwc_otg_qh_t *)ep_handle)->ep_type == UE_BULK) && !(qtd->urb->flags & URB_GIVEBACK_ASAP))
++		/* Do not schedule SG transactions until qtd has URB_GIVEBACK_ASAP set */
++		needs_scheduling = 0;
++
++	retval = dwc_otg_hcd_qtd_add(qtd, hcd, (dwc_otg_qh_t **) ep_handle, atomic_alloc);
++            // creates a new queue in ep_handle if it doesn't exist already
++	if (retval < 0) {
++		DWC_ERROR("DWC OTG HCD URB Enqueue failed adding QTD. "
++			  "Error status %d\n", retval);
++		dwc_otg_hcd_qtd_free(qtd);
++		return retval;
++	}
++
++	if(needs_scheduling) {
++		tr_type = dwc_otg_hcd_select_transactions(hcd);
++		if (tr_type != DWC_OTG_TRANSACTION_NONE) {
++			dwc_otg_hcd_queue_transactions(hcd, tr_type);
++		}
++	}
++	return retval;
++}
++
++int dwc_otg_hcd_urb_dequeue(dwc_otg_hcd_t * hcd,
++			    dwc_otg_hcd_urb_t * dwc_otg_urb)
++{
++	dwc_otg_qh_t *qh;
++	dwc_otg_qtd_t *urb_qtd;
++	BUG_ON(!hcd);
++	BUG_ON(!dwc_otg_urb);
++
++#ifdef DEBUG /* integrity checks (Broadcom) */
++
++	if (hcd == NULL) {
++		DWC_ERROR("**** DWC OTG HCD URB Dequeue has NULL HCD\n");
++		return -DWC_E_INVALID;
++	}
++	if (dwc_otg_urb == NULL) {
++		DWC_ERROR("**** DWC OTG HCD URB Dequeue has NULL URB\n");
++		return -DWC_E_INVALID;
++	}
++	if (dwc_otg_urb->qtd == NULL) {
++		DWC_ERROR("**** DWC OTG HCD URB Dequeue with NULL QTD\n");
++		return -DWC_E_INVALID;
++	}
++	urb_qtd = dwc_otg_urb->qtd;
++	BUG_ON(!urb_qtd);
++	if (urb_qtd->qh == NULL) {
++		DWC_ERROR("**** DWC OTG HCD URB Dequeue with QTD with NULL Q handler\n");
++		return -DWC_E_INVALID;
++	}
++#else
++	urb_qtd = dwc_otg_urb->qtd;
++	BUG_ON(!urb_qtd);
++#endif
++	qh = urb_qtd->qh;
++	BUG_ON(!qh);
++	if (CHK_DEBUG_LEVEL(DBG_HCDV | DBG_HCD_URB)) {
++		if (urb_qtd->in_process) {
++			dump_channel_info(hcd, qh);
++		}
++	}
++#ifdef DEBUG /* integrity checks (Broadcom) */
++	if (hcd->core_if == NULL) {
++		DWC_ERROR("**** DWC OTG HCD URB Dequeue HCD has NULL core_if\n");
++		return -DWC_E_INVALID;
++	}
++#endif
++	if (urb_qtd->in_process && qh->channel) {
++		/* The QTD is in process (it has been assigned to a channel). */
++		if (hcd->flags.b.port_connect_status) {
++			int n = qh->channel->hc_num;
++			/*
++			 * If still connected (i.e. in host mode), halt the
++			 * channel so it can be used for other transfers. If
++			 * no longer connected, the host registers can't be
++			 * written to halt the channel since the core is in
++			 * device mode.
++			 */
++			/* In FIQ FSM mode, we need to shut down carefully.
++			 * The FIQ may attempt to restart a disabled channel */
++			if (fiq_fsm_enable && (hcd->fiq_state->channel[n].fsm != FIQ_PASSTHROUGH)) {
++				int retries = 3;
++				int running = 0;
++				enum fiq_fsm_state state;
++
++				local_fiq_disable();
++				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
++				qh->channel->halt_status = DWC_OTG_HC_XFER_URB_DEQUEUE;
++				qh->channel->halt_pending = 1;
++				if (hcd->fiq_state->channel[n].fsm == FIQ_HS_ISOC_TURBO ||
++				    hcd->fiq_state->channel[n].fsm == FIQ_HS_ISOC_SLEEPING)
++					hcd->fiq_state->channel[n].fsm = FIQ_HS_ISOC_ABORTED;
++				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
++				local_fiq_enable();
++
++				if (dwc_qh_is_non_per(qh)) {
++					do {
++						state = READ_ONCE(hcd->fiq_state->channel[n].fsm);
++						running = (state != FIQ_NP_SPLIT_DONE) &&
++							  (state != FIQ_NP_SPLIT_LS_ABORTED) &&
++							  (state != FIQ_NP_SPLIT_HS_ABORTED);
++						if (!running)
++							break;
++						udelay(125);
++					} while(--retries);
++					if (!retries)
++						DWC_WARN("Timed out waiting for FSM NP transfer to complete on %d",
++							 qh->channel->hc_num);
++				}
++			} else {
++				dwc_otg_hc_halt(hcd->core_if, qh->channel,
++						DWC_OTG_HC_XFER_URB_DEQUEUE);
++			}
++		}
++	}
++
++	/*
++	 * Free the QTD and clean up the associated QH. Leave the QH in the
++	 * schedule if it has any remaining QTDs.
++	 */
++
++	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD URB Dequeue - "
++                    "delete %sQueue handler\n",
++                    hcd->core_if->dma_desc_enable?"DMA ":"");
++	if (!hcd->core_if->dma_desc_enable) {
++		uint8_t b = urb_qtd->in_process;
++		if (nak_holdoff && qh->do_split && dwc_qh_is_non_per(qh))
++			qh->nak_frame = 0xFFFF;
++		dwc_otg_hcd_qtd_remove_and_free(hcd, urb_qtd, qh);
++		if (b) {
++			dwc_otg_hcd_qh_deactivate(hcd, qh, 0);
++			qh->channel = NULL;
++		} else if (DWC_CIRCLEQ_EMPTY(&qh->qtd_list)) {
++			dwc_otg_hcd_qh_remove(hcd, qh);
++		}
++	} else {
++		dwc_otg_hcd_qtd_remove_and_free(hcd, urb_qtd, qh);
++	}
++	return 0;
++}
++
++int dwc_otg_hcd_endpoint_disable(dwc_otg_hcd_t * hcd, void *ep_handle,
++				 int retry)
++{
++	dwc_otg_qh_t *qh = (dwc_otg_qh_t *) ep_handle;
++	int retval = 0;
++	dwc_irqflags_t flags;
++
++	if (retry < 0) {
++		retval = -DWC_E_INVALID;
++		goto done;
++	}
++
++	if (!qh) {
++		retval = -DWC_E_INVALID;
++		goto done;
++	}
++
++	DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
++
++	while (!DWC_CIRCLEQ_EMPTY(&qh->qtd_list) && retry) {
++		DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
++		retry--;
++		dwc_msleep(5);
++		DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
++	}
++
++	dwc_otg_hcd_qh_remove(hcd, qh);
++
++	DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
++	/*
++	 * Split dwc_otg_hcd_qh_remove_and_free() into qh_remove
++	 * and qh_free to prevent stack dump on DWC_DMA_FREE() with
++	 * irq_disabled (spinlock_irqsave) in dwc_otg_hcd_desc_list_free()
++	 * and dwc_otg_hcd_frame_list_alloc().
++	 */
++	dwc_otg_hcd_qh_free(hcd, qh);
++
++done:
++	return retval;
++}
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30)
++int dwc_otg_hcd_endpoint_reset(dwc_otg_hcd_t * hcd, void *ep_handle)
++{
++	int retval = 0;
++	dwc_otg_qh_t *qh = (dwc_otg_qh_t *) ep_handle;
++	if (!qh)
++		return -DWC_E_INVALID;
++
++	qh->data_toggle = DWC_OTG_HC_PID_DATA0;
++	return retval;
++}
++#endif
++
++/**
++ * HCD Callback structure for handling mode switching.
++ */
++static dwc_otg_cil_callbacks_t hcd_cil_callbacks = {
++	.start = dwc_otg_hcd_start_cb,
++	.stop = dwc_otg_hcd_stop_cb,
++	.disconnect = dwc_otg_hcd_disconnect_cb,
++	.session_start = dwc_otg_hcd_session_start_cb,
++	.resume_wakeup = dwc_otg_hcd_rem_wakeup_cb,
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	.sleep = dwc_otg_hcd_sleep_cb,
++#endif
++	.p = 0,
++};
++
++/**
++ * Reset tasklet function
++ */
++static void reset_tasklet_func(void *data)
++{
++	dwc_otg_hcd_t *dwc_otg_hcd = (dwc_otg_hcd_t *) data;
++	dwc_otg_core_if_t *core_if = dwc_otg_hcd->core_if;
++	hprt0_data_t hprt0;
++
++	DWC_DEBUGPL(DBG_HCDV, "USB RESET tasklet called\n");
++
++	hprt0.d32 = dwc_otg_read_hprt0(core_if);
++	hprt0.b.prtrst = 1;
++	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++	dwc_mdelay(60);
++
++	hprt0.b.prtrst = 0;
++	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++	dwc_otg_hcd->flags.b.port_reset_change = 1;
++}
++
++static void completion_tasklet_func(void *ptr)
++{
++	dwc_otg_hcd_t *hcd = (dwc_otg_hcd_t *) ptr;
++	struct urb *urb;
++	urb_tq_entry_t *item;
++	dwc_irqflags_t flags;
++
++	/* This could just be spin_lock_irq */
++	DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
++	while (!DWC_TAILQ_EMPTY(&hcd->completed_urb_list)) {
++		item = DWC_TAILQ_FIRST(&hcd->completed_urb_list);
++		urb = item->urb;
++		DWC_TAILQ_REMOVE(&hcd->completed_urb_list, item,
++				urb_tq_entries);
++		DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
++		DWC_FREE(item);
++
++		usb_hcd_giveback_urb(hcd->priv, urb, urb->status);
++
++
++		DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
++	}
++	DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
++	return;
++}
++
++static void qh_list_free(dwc_otg_hcd_t * hcd, dwc_list_link_t * qh_list)
++{
++	dwc_list_link_t *item;
++	dwc_otg_qh_t *qh;
++	dwc_irqflags_t flags;
++
++	if (!qh_list->next) {
++		/* The list hasn't been initialized yet. */
++		return;
++	}
++	/*
++	 * Hold spinlock here. Not needed in that case if bellow
++	 * function is being called from ISR
++	 */
++	DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
++	/* Ensure there are no QTDs or URBs left. */
++	kill_urbs_in_qh_list(hcd, qh_list);
++	DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
++
++	DWC_LIST_FOREACH(item, qh_list) {
++		qh = DWC_LIST_ENTRY(item, dwc_otg_qh_t, qh_list_entry);
++		dwc_otg_hcd_qh_remove_and_free(hcd, qh);
++	}
++}
++
++/**
++ * Exit from Hibernation if Host did not detect SRP from connected SRP capable
++ * Device during SRP time by host power up.
++ */
++void dwc_otg_hcd_power_up(void *ptr)
++{
++	gpwrdn_data_t gpwrdn = {.d32 = 0 };
++	dwc_otg_core_if_t *core_if = (dwc_otg_core_if_t *) ptr;
++
++	DWC_PRINTF("%s called\n", __FUNCTION__);
++
++	if (!core_if->hibernation_suspend) {
++		DWC_PRINTF("Already exited from Hibernation\n");
++		return;
++	}
++
++	/* Switch on the voltage to the core */
++	gpwrdn.b.pwrdnswtch = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Reset the core */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnrstn = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Disable power clamps */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnclmp = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	/* Remove reset the core signal */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnrstn = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++	dwc_udelay(10);
++
++	/* Disable PMU interrupt */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pmuintsel = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	core_if->hibernation_suspend = 0;
++
++	/* Disable PMU */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pmuactv = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Enable VBUS */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.dis_vbus = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	core_if->op_state = A_HOST;
++	dwc_otg_core_init(core_if);
++	dwc_otg_enable_global_interrupts(core_if);
++	cil_hcd_start(core_if);
++}
++
++void dwc_otg_cleanup_fiq_channel(dwc_otg_hcd_t *hcd, uint32_t num)
++{
++	struct fiq_channel_state *st = &hcd->fiq_state->channel[num];
++	struct fiq_dma_blob *blob = hcd->fiq_dmab;
++	int i;
++
++	st->fsm = FIQ_PASSTHROUGH;
++	st->hcchar_copy.d32 = 0;
++	st->hcsplt_copy.d32 = 0;
++	st->hcint_copy.d32 = 0;
++	st->hcintmsk_copy.d32 = 0;
++	st->hctsiz_copy.d32 = 0;
++	st->hcdma_copy.d32 = 0;
++	st->nr_errors = 0;
++	st->hub_addr = 0;
++	st->port_addr = 0;
++	st->expected_uframe = 0;
++	st->nrpackets = 0;
++	st->dma_info.index = 0;
++	for (i = 0; i < 6; i++)
++		st->dma_info.slot_len[i] = 255;
++	st->hs_isoc_info.index = 0;
++	st->hs_isoc_info.iso_desc = NULL;
++	st->hs_isoc_info.nrframes = 0;
++
++	DWC_MEMSET(&blob->channel[num].index[0], 0x6b, 1128);
++}
++
++/**
++ * Frees secondary storage associated with the dwc_otg_hcd structure contained
++ * in the struct usb_hcd field.
++ */
++static void dwc_otg_hcd_free(dwc_otg_hcd_t * dwc_otg_hcd)
++{
++	struct device *dev = dwc_otg_hcd_to_dev(dwc_otg_hcd);
++	int i;
++
++	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD FREE\n");
++
++	del_timers(dwc_otg_hcd);
++
++	/* Free memory for QH/QTD lists */
++	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->non_periodic_sched_inactive);
++	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->non_periodic_sched_active);
++	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->periodic_sched_inactive);
++	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->periodic_sched_ready);
++	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->periodic_sched_assigned);
++	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->periodic_sched_queued);
++
++	/* Free memory for the host channels. */
++	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
++		dwc_hc_t *hc = dwc_otg_hcd->hc_ptr_array[i];
++
++#ifdef DEBUG
++		if (dwc_otg_hcd->core_if->hc_xfer_timer[i]) {
++			DWC_TIMER_FREE(dwc_otg_hcd->core_if->hc_xfer_timer[i]);
++		}
++#endif
++		if (hc != NULL) {
++			DWC_DEBUGPL(DBG_HCDV, "HCD Free channel #%i, hc=%p\n",
++				    i, hc);
++			DWC_FREE(hc);
++		}
++	}
++
++	if (dwc_otg_hcd->core_if->dma_enable) {
++		if (dwc_otg_hcd->status_buf_dma) {
++			DWC_DMA_FREE(dev, DWC_OTG_HCD_STATUS_BUF_SIZE,
++				     dwc_otg_hcd->status_buf,
++				     dwc_otg_hcd->status_buf_dma);
++		}
++	} else if (dwc_otg_hcd->status_buf != NULL) {
++		DWC_FREE(dwc_otg_hcd->status_buf);
++	}
++	DWC_SPINLOCK_FREE(dwc_otg_hcd->lock);
++	/* Set core_if's lock pointer to NULL */
++	dwc_otg_hcd->core_if->lock = NULL;
++
++	DWC_TIMER_FREE(dwc_otg_hcd->conn_timer);
++	DWC_TASK_FREE(dwc_otg_hcd->reset_tasklet);
++	DWC_TASK_FREE(dwc_otg_hcd->completion_tasklet);
++	DWC_DMA_FREE(dev, 16, dwc_otg_hcd->fiq_state->dummy_send,
++		     dwc_otg_hcd->fiq_state->dummy_send_dma);
++	DWC_FREE(dwc_otg_hcd->fiq_state);
++
++#ifdef DWC_DEV_SRPCAP
++	if (dwc_otg_hcd->core_if->power_down == 2 &&
++	    dwc_otg_hcd->core_if->pwron_timer) {
++		DWC_TIMER_FREE(dwc_otg_hcd->core_if->pwron_timer);
++	}
++#endif
++	DWC_FREE(dwc_otg_hcd);
++}
++
++int dwc_otg_hcd_init(dwc_otg_hcd_t * hcd, dwc_otg_core_if_t * core_if)
++{
++	struct device *dev = dwc_otg_hcd_to_dev(hcd);
++	int retval = 0;
++	int num_channels;
++	int i;
++	dwc_hc_t *channel;
++
++#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_SPINLOCK))
++	DWC_SPINLOCK_ALLOC_LINUX_DEBUG(hcd->lock);
++#else
++	hcd->lock = DWC_SPINLOCK_ALLOC();
++#endif
++        DWC_DEBUGPL(DBG_HCDV, "init of HCD %p given core_if %p\n",
++                    hcd, core_if);
++	if (!hcd->lock) {
++		DWC_ERROR("Could not allocate lock for pcd");
++		DWC_FREE(hcd);
++		retval = -DWC_E_NO_MEMORY;
++		goto out;
++	}
++	hcd->core_if = core_if;
++
++	/* Register the HCD CIL Callbacks */
++	dwc_otg_cil_register_hcd_callbacks(hcd->core_if,
++					   &hcd_cil_callbacks, hcd);
++
++	/* Initialize the non-periodic schedule. */
++	DWC_LIST_INIT(&hcd->non_periodic_sched_inactive);
++	DWC_LIST_INIT(&hcd->non_periodic_sched_active);
++
++	/* Initialize the periodic schedule. */
++	DWC_LIST_INIT(&hcd->periodic_sched_inactive);
++	DWC_LIST_INIT(&hcd->periodic_sched_ready);
++	DWC_LIST_INIT(&hcd->periodic_sched_assigned);
++	DWC_LIST_INIT(&hcd->periodic_sched_queued);
++	DWC_TAILQ_INIT(&hcd->completed_urb_list);
++	/*
++	 * Create a host channel descriptor for each host channel implemented
++	 * in the controller. Initialize the channel descriptor array.
++	 */
++	DWC_CIRCLEQ_INIT(&hcd->free_hc_list);
++	num_channels = hcd->core_if->core_params->host_channels;
++	DWC_MEMSET(hcd->hc_ptr_array, 0, sizeof(hcd->hc_ptr_array));
++	for (i = 0; i < num_channels; i++) {
++		channel = DWC_ALLOC(sizeof(dwc_hc_t));
++		if (channel == NULL) {
++			retval = -DWC_E_NO_MEMORY;
++			DWC_ERROR("%s: host channel allocation failed\n",
++				  __func__);
++			dwc_otg_hcd_free(hcd);
++			goto out;
++		}
++		channel->hc_num = i;
++		hcd->hc_ptr_array[i] = channel;
++#ifdef DEBUG
++		hcd->core_if->hc_xfer_timer[i] =
++		    DWC_TIMER_ALLOC("hc timer", hc_xfer_timeout,
++				    &hcd->core_if->hc_xfer_info[i]);
++#endif
++		DWC_DEBUGPL(DBG_HCDV, "HCD Added channel #%d, hc=%p\n", i,
++			    channel);
++	}
++
++	if (fiq_enable) {
++		hcd->fiq_state = DWC_ALLOC(sizeof(struct fiq_state) + (sizeof(struct fiq_channel_state) * num_channels));
++		if (!hcd->fiq_state) {
++			retval = -DWC_E_NO_MEMORY;
++			DWC_ERROR("%s: cannot allocate fiq_state structure\n", __func__);
++			dwc_otg_hcd_free(hcd);
++			goto out;
++		}
++		DWC_MEMSET(hcd->fiq_state, 0, (sizeof(struct fiq_state) + (sizeof(struct fiq_channel_state) * num_channels)));
++
++#ifdef CONFIG_ARM64
++		spin_lock_init(&hcd->fiq_state->lock);
++#endif
++
++		for (i = 0; i < num_channels; i++) {
++			hcd->fiq_state->channel[i].fsm = FIQ_PASSTHROUGH;
++		}
++		hcd->fiq_state->dummy_send = DWC_DMA_ALLOC_ATOMIC(dev, 16,
++							 &hcd->fiq_state->dummy_send_dma);
++
++		hcd->fiq_stack = DWC_ALLOC(sizeof(struct fiq_stack));
++		if (!hcd->fiq_stack) {
++			retval = -DWC_E_NO_MEMORY;
++			DWC_ERROR("%s: cannot allocate fiq_stack structure\n", __func__);
++			dwc_otg_hcd_free(hcd);
++			goto out;
++		}
++		hcd->fiq_stack->magic1 = 0xDEADBEEF;
++		hcd->fiq_stack->magic2 = 0xD00DFEED;
++		hcd->fiq_state->gintmsk_saved.d32 = ~0;
++		hcd->fiq_state->haintmsk_saved.b2.chint = ~0;
++
++		/* This bit is terrible and uses no API, but necessary. The FIQ has no concept of DMA pools
++		 * (and if it did, would be a lot slower). This allocates a chunk of memory (~9kiB for 8 host channels)
++		 * for use as transaction bounce buffers in a 2-D array. Our access into this chunk is done by some
++		 * moderately readable array casts.
++		 */
++		hcd->fiq_dmab = DWC_DMA_ALLOC(dev, (sizeof(struct fiq_dma_channel) * num_channels), &hcd->fiq_state->dma_base);
++		DWC_WARN("FIQ DMA bounce buffers: virt = %px dma = %pad len=%zu",
++				hcd->fiq_dmab, &hcd->fiq_state->dma_base,
++				sizeof(struct fiq_dma_channel) * num_channels);
++
++		DWC_MEMSET(hcd->fiq_dmab, 0x6b, 9024);
++
++		/* pointer for debug in fiq_print */
++		hcd->fiq_state->fiq_dmab = hcd->fiq_dmab;
++		if (fiq_fsm_enable) {
++			int i;
++			for (i=0; i < hcd->core_if->core_params->host_channels; i++) {
++				dwc_otg_cleanup_fiq_channel(hcd, i);
++			}
++			DWC_PRINTF("FIQ FSM acceleration enabled for :\n%s%s%s%s",
++				(fiq_fsm_mask & 0x1) ? "Non-periodic Split Transactions\n" : "",
++				(fiq_fsm_mask & 0x2) ? "Periodic Split Transactions\n" : "",
++				(fiq_fsm_mask & 0x4) ? "High-Speed Isochronous Endpoints\n" : "",
++				(fiq_fsm_mask & 0x8) ? "Interrupt/Control Split Transaction hack enabled\n" : "");
++		}
++	}
++
++	/* Initialize the Connection timeout timer. */
++	hcd->conn_timer = DWC_TIMER_ALLOC("Connection timer",
++					  dwc_otg_hcd_connect_timeout, 0);
++
++	printk(KERN_DEBUG "dwc_otg: Microframe scheduler %s\n", microframe_schedule ? "enabled":"disabled");
++	if (microframe_schedule)
++		init_hcd_usecs(hcd);
++
++	/* Initialize reset tasklet. */
++	hcd->reset_tasklet = DWC_TASK_ALLOC("reset_tasklet", reset_tasklet_func, hcd);
++
++	hcd->completion_tasklet = DWC_TASK_ALLOC("completion_tasklet",
++						completion_tasklet_func, hcd);
++#ifdef DWC_DEV_SRPCAP
++	if (hcd->core_if->power_down == 2) {
++		/* Initialize Power on timer for Host power up in case hibernation */
++		hcd->core_if->pwron_timer = DWC_TIMER_ALLOC("PWRON TIMER",
++									dwc_otg_hcd_power_up, core_if);
++	}
++#endif
++
++	/*
++	 * Allocate space for storing data on status transactions. Normally no
++	 * data is sent, but this space acts as a bit bucket. This must be
++	 * done after usb_add_hcd since that function allocates the DMA buffer
++	 * pool.
++	 */
++	if (hcd->core_if->dma_enable) {
++		hcd->status_buf =
++		    DWC_DMA_ALLOC(dev, DWC_OTG_HCD_STATUS_BUF_SIZE,
++				  &hcd->status_buf_dma);
++	} else {
++		hcd->status_buf = DWC_ALLOC(DWC_OTG_HCD_STATUS_BUF_SIZE);
++	}
++	if (!hcd->status_buf) {
++		retval = -DWC_E_NO_MEMORY;
++		DWC_ERROR("%s: status_buf allocation failed\n", __func__);
++		dwc_otg_hcd_free(hcd);
++		goto out;
++	}
++
++	hcd->otg_port = 1;
++	hcd->frame_list = NULL;
++	hcd->frame_list_dma = 0;
++	hcd->periodic_qh_count = 0;
++
++	DWC_MEMSET(hcd->hub_port, 0, sizeof(hcd->hub_port));
++#ifdef FIQ_DEBUG
++	DWC_MEMSET(hcd->hub_port_alloc, -1, sizeof(hcd->hub_port_alloc));
++#endif
++
++out:
++	return retval;
++}
++
++void dwc_otg_hcd_remove(dwc_otg_hcd_t * hcd)
++{
++	/* Turn off all host-specific interrupts. */
++	dwc_otg_disable_host_interrupts(hcd->core_if);
++
++	dwc_otg_hcd_free(hcd);
++}
++
++/**
++ * Initializes dynamic portions of the DWC_otg HCD state.
++ */
++static void dwc_otg_hcd_reinit(dwc_otg_hcd_t * hcd)
++{
++	int num_channels;
++	int i;
++	dwc_hc_t *channel;
++	dwc_hc_t *channel_tmp;
++
++	hcd->flags.d32 = 0;
++
++	hcd->non_periodic_qh_ptr = &hcd->non_periodic_sched_active;
++	if (!microframe_schedule) {
++		hcd->non_periodic_channels = 0;
++		hcd->periodic_channels = 0;
++	} else {
++		hcd->available_host_channels = hcd->core_if->core_params->host_channels;
++	}
++	/*
++	 * Put all channels in the free channel list and clean up channel
++	 * states.
++	 */
++	DWC_CIRCLEQ_FOREACH_SAFE(channel, channel_tmp,
++				 &hcd->free_hc_list, hc_list_entry) {
++		DWC_CIRCLEQ_REMOVE(&hcd->free_hc_list, channel, hc_list_entry);
++	}
++
++	num_channels = hcd->core_if->core_params->host_channels;
++	for (i = 0; i < num_channels; i++) {
++		channel = hcd->hc_ptr_array[i];
++		DWC_CIRCLEQ_INSERT_TAIL(&hcd->free_hc_list, channel,
++					hc_list_entry);
++		dwc_otg_hc_cleanup(hcd->core_if, channel);
++	}
++
++	/* Initialize the DWC core for host mode operation. */
++	dwc_otg_core_host_init(hcd->core_if);
++
++	/* Set core_if's lock pointer to the hcd->lock */
++	hcd->core_if->lock = hcd->lock;
++}
++
++/**
++ * Assigns transactions from a QTD to a free host channel and initializes the
++ * host channel to perform the transactions. The host channel is removed from
++ * the free list.
++ *
++ * @param hcd The HCD state structure.
++ * @param qh Transactions from the first QTD for this QH are selected and
++ * assigned to a free host channel.
++ */
++static void assign_and_init_hc(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	dwc_hc_t *hc;
++	dwc_otg_qtd_t *qtd;
++	dwc_otg_hcd_urb_t *urb;
++	void* ptr = NULL;
++	uint16_t wLength;
++	uint32_t intr_enable;
++	unsigned long flags;
++	gintmsk_data_t gintmsk = { .d32 = 0, };
++	struct device *dev = dwc_otg_hcd_to_dev(hcd);
++
++	qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
++
++	urb = qtd->urb;
++
++	DWC_DEBUGPL(DBG_HCDV, "%s(%p,%p) - urb %x, actual_length %d\n", __func__, hcd, qh, (unsigned int)urb, urb->actual_length);
++
++	if (((urb->actual_length < 0) || (urb->actual_length > urb->length)) && !dwc_otg_hcd_is_pipe_in(&urb->pipe_info))
++		urb->actual_length = urb->length;
++
++
++	hc = DWC_CIRCLEQ_FIRST(&hcd->free_hc_list);
++
++	/* Remove the host channel from the free list. */
++	DWC_CIRCLEQ_REMOVE_INIT(&hcd->free_hc_list, hc, hc_list_entry);
++
++	qh->channel = hc;
++
++	qtd->in_process = 1;
++
++	/*
++	 * Use usb_pipedevice to determine device address. This address is
++	 * 0 before the SET_ADDRESS command and the correct address afterward.
++	 */
++	hc->dev_addr = dwc_otg_hcd_get_dev_addr(&urb->pipe_info);
++	hc->ep_num = dwc_otg_hcd_get_ep_num(&urb->pipe_info);
++	hc->speed = qh->dev_speed;
++	hc->max_packet = dwc_max_packet(qh->maxp);
++
++	hc->xfer_started = 0;
++	hc->halt_status = DWC_OTG_HC_XFER_NO_HALT_STATUS;
++	hc->error_state = (qtd->error_count > 0);
++	hc->halt_on_queue = 0;
++	hc->halt_pending = 0;
++	hc->requests = 0;
++
++	/*
++	 * The following values may be modified in the transfer type section
++	 * below. The xfer_len value may be reduced when the transfer is
++	 * started to accommodate the max widths of the XferSize and PktCnt
++	 * fields in the HCTSIZn register.
++	 */
++
++	hc->ep_is_in = (dwc_otg_hcd_is_pipe_in(&urb->pipe_info) != 0);
++	if (hc->ep_is_in) {
++		hc->do_ping = 0;
++	} else {
++		hc->do_ping = qh->ping_state;
++	}
++
++	hc->data_pid_start = qh->data_toggle;
++	hc->multi_count = 1;
++
++	if (hcd->core_if->dma_enable) {
++		hc->xfer_buff =
++		    (uint8_t *)(uintptr_t)urb->dma + urb->actual_length;
++
++		/* For non-dword aligned case */
++		if (((unsigned long)hc->xfer_buff & 0x3)
++		    && !hcd->core_if->dma_desc_enable) {
++			ptr = (uint8_t *) urb->buf + urb->actual_length;
++		}
++	} else {
++		hc->xfer_buff = (uint8_t *) urb->buf + urb->actual_length;
++	}
++	hc->xfer_len = urb->length - urb->actual_length;
++	hc->xfer_count = 0;
++
++	/*
++	 * Set the split attributes
++	 */
++	hc->do_split = 0;
++	if (qh->do_split) {
++		uint32_t hub_addr, port_addr;
++		hc->do_split = 1;
++		hc->start_pkt_count = 1;
++		hc->xact_pos = qtd->isoc_split_pos;
++		/* We don't need to do complete splits anymore */
++//		if(fiq_fsm_enable)
++		if (0)
++			hc->complete_split = qtd->complete_split = 0;
++		else
++			hc->complete_split = qtd->complete_split;
++
++		hcd->fops->hub_info(hcd, urb->priv, &hub_addr, &port_addr);
++		hc->hub_addr = (uint8_t) hub_addr;
++		hc->port_addr = (uint8_t) port_addr;
++	}
++
++	switch (dwc_otg_hcd_get_pipe_type(&urb->pipe_info)) {
++	case UE_CONTROL:
++		hc->ep_type = DWC_OTG_EP_TYPE_CONTROL;
++		switch (qtd->control_phase) {
++		case DWC_OTG_CONTROL_SETUP:
++			DWC_DEBUGPL(DBG_HCDV, "  Control setup transaction\n");
++			hc->do_ping = 0;
++			hc->ep_is_in = 0;
++			hc->data_pid_start = DWC_OTG_HC_PID_SETUP;
++			if (hcd->core_if->dma_enable) {
++				hc->xfer_buff =
++					(uint8_t *)(uintptr_t)urb->setup_dma;
++			} else {
++				hc->xfer_buff = (uint8_t *) urb->setup_packet;
++			}
++			hc->xfer_len = 8;
++			ptr = NULL;
++			break;
++		case DWC_OTG_CONTROL_DATA:
++			DWC_DEBUGPL(DBG_HCDV, "  Control data transaction\n");
++			/*
++			 * Hardware bug: small IN packets with length < 4
++			 * cause a 4-byte write to memory. We can only catch
++			 * the case where we know a short packet is going to be
++			 * returned in a control transfer, as the length is
++			 * specified in the setup packet. This is only an issue
++			 * for drivers that insist on packing a device's various
++			 * properties into a struct and querying them one at a
++			 * time (uvcvideo).
++			 * Force the use of align_buf so that the subsequent
++			 * memcpy puts the right number of bytes in the URB's
++			 * buffer.
++			 */
++			wLength = ((uint16_t *)urb->setup_packet)[3];
++			if (hc->ep_is_in && wLength < 4)
++				ptr = hc->xfer_buff;
++
++			hc->data_pid_start = qtd->data_toggle;
++			break;
++		case DWC_OTG_CONTROL_STATUS:
++			/*
++			 * Direction is opposite of data direction or IN if no
++			 * data.
++			 */
++			DWC_DEBUGPL(DBG_HCDV, "  Control status transaction\n");
++			if (urb->length == 0) {
++				hc->ep_is_in = 1;
++			} else {
++				hc->ep_is_in =
++				    dwc_otg_hcd_is_pipe_out(&urb->pipe_info);
++			}
++			if (hc->ep_is_in) {
++				hc->do_ping = 0;
++			}
++
++			hc->data_pid_start = DWC_OTG_HC_PID_DATA1;
++
++			hc->xfer_len = 0;
++			if (hcd->core_if->dma_enable) {
++				hc->xfer_buff = (uint8_t *)
++					(uintptr_t)hcd->status_buf_dma;
++			} else {
++				hc->xfer_buff = (uint8_t *) hcd->status_buf;
++			}
++			ptr = NULL;
++			break;
++		}
++		break;
++	case UE_BULK:
++		hc->ep_type = DWC_OTG_EP_TYPE_BULK;
++		break;
++	case UE_INTERRUPT:
++		hc->ep_type = DWC_OTG_EP_TYPE_INTR;
++		break;
++	case UE_ISOCHRONOUS:
++		{
++			struct dwc_otg_hcd_iso_packet_desc *frame_desc;
++
++			hc->ep_type = DWC_OTG_EP_TYPE_ISOC;
++
++			if (hcd->core_if->dma_desc_enable)
++				break;
++
++			frame_desc = &urb->iso_descs[qtd->isoc_frame_index];
++
++			frame_desc->status = 0;
++
++			if (hcd->core_if->dma_enable) {
++				hc->xfer_buff = (uint8_t *)(uintptr_t)urb->dma;
++			} else {
++				hc->xfer_buff = (uint8_t *) urb->buf;
++			}
++			hc->xfer_buff +=
++			    frame_desc->offset + qtd->isoc_split_offset;
++			hc->xfer_len =
++			    frame_desc->length - qtd->isoc_split_offset;
++
++			/* For non-dword aligned buffers */
++			if (((unsigned long)hc->xfer_buff & 0x3)
++			    && hcd->core_if->dma_enable) {
++				ptr =
++				    (uint8_t *) urb->buf + frame_desc->offset +
++				    qtd->isoc_split_offset;
++			} else
++				ptr = NULL;
++
++			if (hc->xact_pos == DWC_HCSPLIT_XACTPOS_ALL) {
++				if (hc->xfer_len <= 188) {
++					hc->xact_pos = DWC_HCSPLIT_XACTPOS_ALL;
++				} else {
++					hc->xact_pos =
++					    DWC_HCSPLIT_XACTPOS_BEGIN;
++				}
++			}
++		}
++		break;
++	}
++	/* non DWORD-aligned buffer case */
++	if (ptr) {
++		uint32_t buf_size;
++		if (hc->ep_type != DWC_OTG_EP_TYPE_ISOC) {
++			buf_size = hcd->core_if->core_params->max_transfer_size;
++		} else {
++			buf_size = 4096;
++		}
++		if (!qh->dw_align_buf) {
++			qh->dw_align_buf = DWC_DMA_ALLOC_ATOMIC(dev, buf_size,
++							 &qh->dw_align_buf_dma);
++			if (!qh->dw_align_buf) {
++				DWC_ERROR
++				    ("%s: Failed to allocate memory to handle "
++				     "non-dword aligned buffer case\n",
++				     __func__);
++				return;
++			}
++		}
++		if (!hc->ep_is_in) {
++			dwc_memcpy(qh->dw_align_buf, ptr, hc->xfer_len);
++		}
++		hc->align_buff = qh->dw_align_buf_dma;
++	} else {
++		hc->align_buff = 0;
++	}
++
++	if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
++	    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
++		/*
++		 * This value may be modified when the transfer is started to
++		 * reflect the actual transfer length.
++		 */
++		hc->multi_count = dwc_hb_mult(qh->maxp);
++	}
++
++	if (hcd->core_if->dma_desc_enable)
++		hc->desc_list_addr = qh->desc_list_dma;
++
++	dwc_otg_hc_init(hcd->core_if, hc);
++
++	local_irq_save(flags);
++
++	if (fiq_enable) {
++		local_fiq_disable();
++		fiq_fsm_spin_lock(&hcd->fiq_state->lock);
++	}
++
++	/* Enable the top level host channel interrupt. */
++	intr_enable = (1 << hc->hc_num);
++	DWC_MODIFY_REG32(&hcd->core_if->host_if->host_global_regs->haintmsk, 0, intr_enable);
++
++	/* Make sure host channel interrupts are enabled. */
++	gintmsk.b.hcintr = 1;
++	DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, 0, gintmsk.d32);
++
++	if (fiq_enable) {
++		fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
++		local_fiq_enable();
++	}
++
++	local_irq_restore(flags);
++	hc->qh = qh;
++}
++
++
++/**
++ * fiq_fsm_transaction_suitable() - Test a QH for compatibility with the FIQ
++ * @hcd:	Pointer to the dwc_otg_hcd struct
++ * @qh:	pointer to the endpoint's queue head
++ *
++ * Transaction start/end control flow is grafted onto the existing dwc_otg
++ * mechanisms, to avoid spaghettifying the functions more than they already are.
++ * This function's eligibility check is altered by debug parameter.
++ *
++ * Returns: 0 for unsuitable, 1 implies the FIQ can be enabled for this transaction.
++ */
++
++int fiq_fsm_transaction_suitable(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh)
++{
++	if (qh->do_split) {
++		switch (qh->ep_type) {
++		case UE_CONTROL:
++		case UE_BULK:
++			if (fiq_fsm_mask & (1 << 0))
++				return 1;
++			break;
++		case UE_INTERRUPT:
++		case UE_ISOCHRONOUS:
++			if (fiq_fsm_mask & (1 << 1))
++				return 1;
++			break;
++		default:
++			break;
++		}
++	} else if (qh->ep_type == UE_ISOCHRONOUS) {
++		if (fiq_fsm_mask & (1 << 2)) {
++			/* ISOCH support. We test for compatibility:
++			 * - DWORD aligned buffers
++			 * - Must be at least 2 transfers (otherwise pointless to use the FIQ)
++			 * If yes, then the fsm enqueue function will handle the state machine setup.
++			 */
++			dwc_otg_qtd_t *qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
++			dwc_otg_hcd_urb_t *urb = qtd->urb;
++			dwc_dma_t ptr;
++			int i;
++
++			if (urb->packet_count < 2)
++				return 0;
++			for (i = 0; i < urb->packet_count; i++) {
++				ptr = urb->dma + urb->iso_descs[i].offset;
++				if (ptr & 0x3)
++					return 0;
++			}
++			return 1;
++		}
++	}
++	return 0;
++}
++
++/**
++ * fiq_fsm_setup_periodic_dma() - Set up DMA bounce buffers
++ * @hcd: Pointer to the dwc_otg_hcd struct
++ * @qh: Pointer to the endpoint's queue head
++ *
++ * Periodic split transactions are transmitted modulo 188 bytes.
++ * This necessitates slicing data up into buckets for isochronous out
++ * and fixing up the DMA address for all IN transfers.
++ *
++ * Returns 1 if the DMA bounce buffers have been used, 0 if the default
++ * HC buffer has been used.
++ */
++int fiq_fsm_setup_periodic_dma(dwc_otg_hcd_t *hcd, struct fiq_channel_state *st, dwc_otg_qh_t *qh)
++ {
++	int frame_length, i = 0;
++	uint8_t *ptr = NULL;
++	dwc_hc_t *hc = qh->channel;
++	struct fiq_dma_blob *blob;
++	struct dwc_otg_hcd_iso_packet_desc *frame_desc;
++
++	for (i = 0; i < 6; i++) {
++		st->dma_info.slot_len[i] = 255;
++	}
++	st->dma_info.index = 0;
++	i = 0;
++	if (hc->ep_is_in) {
++		/*
++		 * Set dma_regs to bounce buffer. FIQ will update the
++		 * state depending on transaction progress.
++		 * Pointer arithmetic on hcd->fiq_state->dma_base (a dma_addr_t)
++		 * to point it to the correct offset in the allocated buffers.
++		 */
++		blob = (struct fiq_dma_blob *)
++			(uintptr_t)hcd->fiq_state->dma_base;
++		st->hcdma_copy.d32 =(u32)(uintptr_t)
++			blob->channel[hc->hc_num].index[0].buf;
++
++		/* Calculate the max number of CSPLITS such that the FIQ can time out
++		 * a transaction if it fails.
++		 */
++		frame_length = st->hcchar_copy.b.mps;
++		do {
++			i++;
++			frame_length -= 188;
++		} while (frame_length >= 0);
++		st->nrpackets = i;
++		return 1;
++	} else {
++		if (qh->ep_type == UE_ISOCHRONOUS) {
++
++			dwc_otg_qtd_t *qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
++
++			frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
++			frame_length = frame_desc->length;
++
++			/* Virtual address for bounce buffers */
++			blob = hcd->fiq_dmab;
++
++			ptr = qtd->urb->buf + frame_desc->offset;
++			if (frame_length == 0) {
++				/*
++				 * for isochronous transactions, we must still transmit a packet
++				 * even if the length is zero.
++				 */
++				st->dma_info.slot_len[0] = 0;
++				st->nrpackets = 1;
++			} else {
++				do {
++					if (frame_length <= 188) {
++						dwc_memcpy(&blob->channel[hc->hc_num].index[i].buf[0], ptr, frame_length);
++						st->dma_info.slot_len[i] = frame_length;
++						ptr += frame_length;
++					} else {
++						dwc_memcpy(&blob->channel[hc->hc_num].index[i].buf[0], ptr, 188);
++						st->dma_info.slot_len[i] = 188;
++						ptr += 188;
++					}
++					i++;
++					frame_length -= 188;
++				} while (frame_length > 0);
++				st->nrpackets = i;
++			}
++			ptr = qtd->urb->buf + frame_desc->offset;
++			/*
++			 * Point the HC at the DMA address of the bounce buffers
++			 *
++			 * Pointer arithmetic on hcd->fiq_state->dma_base (a
++			 * dma_addr_t) to point it to the correct offset in the
++			 * allocated buffers.
++			 */
++			blob = (struct fiq_dma_blob *)
++				(uintptr_t)hcd->fiq_state->dma_base;
++			st->hcdma_copy.d32 = (u32)(uintptr_t)
++				blob->channel[hc->hc_num].index[0].buf;
++
++			/* fixup xfersize to the actual packet size */
++			st->hctsiz_copy.b.pid = 0;
++			st->hctsiz_copy.b.xfersize = st->dma_info.slot_len[0];
++			return 1;
++		} else {
++			/* For interrupt, single OUT packet required, goes in the SSPLIT from hc_buff. */
++			return 0;
++		}
++	}
++}
++
++/**
++ * fiq_fsm_np_tt_contended() - Avoid performing contended non-periodic transfers
++ * @hcd: Pointer to the dwc_otg_hcd struct
++ * @qh: Pointer to the endpoint's queue head
++ *
++ * Certain hub chips don't differentiate between IN and OUT non-periodic pipes
++ * with the same endpoint number. If transfers get completed out of order
++ * (disregarding the direction token) then the hub can lock up
++ * or return erroneous responses.
++ *
++ * Returns 1 if initiating the transfer would cause contention, 0 otherwise.
++ */
++int fiq_fsm_np_tt_contended(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh)
++{
++	int i;
++	struct fiq_channel_state *st;
++	int dev_addr = qh->channel->dev_addr;
++	int ep_num = qh->channel->ep_num;
++	for (i = 0; i < hcd->core_if->core_params->host_channels; i++) {
++		if (i == qh->channel->hc_num)
++			continue;
++		st = &hcd->fiq_state->channel[i];
++		switch (st->fsm) {
++		case FIQ_NP_SSPLIT_STARTED:
++		case FIQ_NP_SSPLIT_RETRY:
++		case FIQ_NP_SSPLIT_PENDING:
++		case FIQ_NP_OUT_CSPLIT_RETRY:
++		case FIQ_NP_IN_CSPLIT_RETRY:
++			if (st->hcchar_copy.b.devaddr == dev_addr &&
++				st->hcchar_copy.b.epnum == ep_num)
++				return 1;
++			break;
++		default:
++			break;
++		}
++	}
++	return 0;
++}
++
++/*
++ * Pushing a periodic request into the queue near the EOF1 point
++ * in a microframe causes erroneous behaviour (frmovrun) interrupt.
++ * Usually, the request goes out on the bus causing a transfer but
++ * the core does not transfer the data to memory.
++ * This guard interval (in number of 60MHz clocks) is required which
++ * must cater for CPU latency between reading the value and enabling
++ * the channel.
++ */
++#define PERIODIC_FRREM_BACKOFF 1000
++
++int fiq_fsm_queue_isoc_transaction(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh)
++{
++	dwc_hc_t *hc = qh->channel;
++	dwc_otg_hc_regs_t *hc_regs = hcd->core_if->host_if->hc_regs[hc->hc_num];
++	dwc_otg_qtd_t *qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
++	int frame;
++	struct fiq_channel_state *st = &hcd->fiq_state->channel[hc->hc_num];
++	int xfer_len, nrpackets;
++	hcdma_data_t hcdma;
++	hfnum_data_t hfnum;
++
++	if (st->fsm != FIQ_PASSTHROUGH)
++		return 0;
++
++	st->nr_errors = 0;
++
++	st->hcchar_copy.d32 = 0;
++	st->hcchar_copy.b.mps = hc->max_packet;
++	st->hcchar_copy.b.epdir = hc->ep_is_in;
++	st->hcchar_copy.b.devaddr = hc->dev_addr;
++	st->hcchar_copy.b.epnum = hc->ep_num;
++	st->hcchar_copy.b.eptype = hc->ep_type;
++
++	st->hcintmsk_copy.b.chhltd = 1;
++
++	frame = dwc_otg_hcd_get_frame_number(hcd);
++	st->hcchar_copy.b.oddfrm = (frame & 0x1) ? 0 : 1;
++
++	st->hcchar_copy.b.lspddev = 0;
++	/* Enable the channel later as a final register write. */
++
++	st->hcsplt_copy.d32 = 0;
++
++	st->hs_isoc_info.iso_desc = (struct dwc_otg_hcd_iso_packet_desc *) &qtd->urb->iso_descs;
++	st->hs_isoc_info.nrframes = qtd->urb->packet_count;
++	/* grab the next DMA address offset from the array */
++	st->hcdma_copy.d32 = qtd->urb->dma;
++	hcdma.d32 = st->hcdma_copy.d32 + st->hs_isoc_info.iso_desc[0].offset;
++
++	/* We need to set multi_count. This is a bit tricky - has to be set per-transaction as
++	 * the core needs to be told to send the correct number. Caution: for IN transfers,
++	 * this is always set to the maximum size of the endpoint. */
++	xfer_len = st->hs_isoc_info.iso_desc[0].length;
++	nrpackets = (xfer_len + st->hcchar_copy.b.mps - 1) / st->hcchar_copy.b.mps;
++	if (nrpackets == 0)
++		nrpackets = 1;
++	st->hcchar_copy.b.multicnt = nrpackets;
++	st->hctsiz_copy.b.pktcnt = nrpackets;
++
++	/* Initial PID also needs to be set */
++	if (st->hcchar_copy.b.epdir == 0) {
++		st->hctsiz_copy.b.xfersize = xfer_len;
++		switch (st->hcchar_copy.b.multicnt) {
++		case 1:
++			st->hctsiz_copy.b.pid = DWC_PID_DATA0;
++			break;
++		case 2:
++		case 3:
++			st->hctsiz_copy.b.pid = DWC_PID_MDATA;
++			break;
++		}
++
++	} else {
++		st->hctsiz_copy.b.xfersize = nrpackets * st->hcchar_copy.b.mps;
++		switch (st->hcchar_copy.b.multicnt) {
++		case 1:
++			st->hctsiz_copy.b.pid = DWC_PID_DATA0;
++			break;
++		case 2:
++			st->hctsiz_copy.b.pid = DWC_PID_DATA1;
++			break;
++		case 3:
++			st->hctsiz_copy.b.pid = DWC_PID_DATA2;
++			break;
++		}
++	}
++
++	st->hs_isoc_info.stride = qh->interval;
++	st->uframe_sleeps = 0;
++
++	fiq_print(FIQDBG_INT, hcd->fiq_state, "FSMQ  %01d ", hc->hc_num);
++	fiq_print(FIQDBG_INT, hcd->fiq_state, "%08x", st->hcchar_copy.d32);
++	fiq_print(FIQDBG_INT, hcd->fiq_state, "%08x", st->hctsiz_copy.d32);
++	fiq_print(FIQDBG_INT, hcd->fiq_state, "%08x", st->hcdma_copy.d32);
++	hfnum.d32 = DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hfnum);
++	local_fiq_disable();
++	fiq_fsm_spin_lock(&hcd->fiq_state->lock);
++	DWC_WRITE_REG32(&hc_regs->hctsiz, st->hctsiz_copy.d32);
++	DWC_WRITE_REG32(&hc_regs->hcsplt, st->hcsplt_copy.d32);
++	DWC_WRITE_REG32(&hc_regs->hcdma, st->hcdma_copy.d32);
++	DWC_WRITE_REG32(&hc_regs->hcchar, st->hcchar_copy.d32);
++	DWC_WRITE_REG32(&hc_regs->hcintmsk, st->hcintmsk_copy.d32);
++	if (hfnum.b.frrem < PERIODIC_FRREM_BACKOFF) {
++		/* Prevent queueing near EOF1. Bad things happen if a periodic
++		 * split transaction is queued very close to EOF. SOF interrupt handler
++		 * will wake this channel at the next interrupt.
++		 */
++		st->fsm = FIQ_HS_ISOC_SLEEPING;
++		st->uframe_sleeps = 1;
++	} else {
++		st->fsm = FIQ_HS_ISOC_TURBO;
++		st->hcchar_copy.b.chen = 1;
++		DWC_WRITE_REG32(&hc_regs->hcchar, st->hcchar_copy.d32);
++	}
++	mb();
++	st->hcchar_copy.b.chen = 0;
++	fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
++	local_fiq_enable();
++	return 0;
++}
++
++
++/**
++ * fiq_fsm_queue_split_transaction() - Set up a host channel and FIQ state
++ * @hcd: Pointer to the dwc_otg_hcd struct
++ * @qh: Pointer to the endpoint's queue head
++ *
++ * This overrides the dwc_otg driver's normal method of queueing a transaction.
++ * Called from dwc_otg_hcd_queue_transactions(), this performs specific setup
++ * for the nominated host channel.
++ *
++ * For periodic transfers, it also peeks at the FIQ state to see if an immediate
++ * start is possible. If not, then the FIQ is left to start the transfer.
++ */
++int fiq_fsm_queue_split_transaction(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh)
++{
++	int start_immediate = 1, i;
++	hfnum_data_t hfnum;
++	dwc_hc_t *hc = qh->channel;
++	dwc_otg_hc_regs_t *hc_regs = hcd->core_if->host_if->hc_regs[hc->hc_num];
++	/* Program HC registers, setup FIQ_state, examine FIQ if periodic, start transfer (not if uframe 5) */
++	int hub_addr, port_addr, frame, uframe;
++	struct fiq_channel_state *st = &hcd->fiq_state->channel[hc->hc_num];
++
++	/*
++	 * Non-periodic channel assignments stay in the non_periodic_active queue.
++	 * Therefore we get repeatedly called until the FIQ's done processing this channel.
++	 */
++	if (qh->channel->xfer_started == 1)
++		return 0;
++
++	if (st->fsm != FIQ_PASSTHROUGH) {
++		pr_warn_ratelimited("%s:%d: Queue called for an active channel\n", __func__, __LINE__);
++		return 0;
++	}
++
++	qh->channel->xfer_started = 1;
++
++	st->nr_errors = 0;
++
++	st->hcchar_copy.d32 = 0;
++	st->hcchar_copy.b.mps = min_t(uint32_t, hc->xfer_len, hc->max_packet);
++	st->hcchar_copy.b.epdir = hc->ep_is_in;
++	st->hcchar_copy.b.devaddr = hc->dev_addr;
++	st->hcchar_copy.b.epnum = hc->ep_num;
++	st->hcchar_copy.b.eptype = hc->ep_type;
++	if (hc->ep_type & 0x1) {
++		if (hc->ep_is_in)
++			st->hcchar_copy.b.multicnt = 3;
++		else
++			/* Docs say set this to 1, but driver sets to 0! */
++			st->hcchar_copy.b.multicnt = 0;
++	} else {
++		st->hcchar_copy.b.multicnt = 1;
++		st->hcchar_copy.b.oddfrm = 0;
++	}
++	st->hcchar_copy.b.lspddev = (hc->speed == DWC_OTG_EP_SPEED_LOW) ? 1 : 0;
++	/* Enable the channel later as a final register write. */
++
++	st->hcsplt_copy.d32 = 0;
++	if(qh->do_split) {
++		hcd->fops->hub_info(hcd, DWC_CIRCLEQ_FIRST(&qh->qtd_list)->urb->priv, &hub_addr, &port_addr);
++		st->hcsplt_copy.b.compsplt = 0;
++		st->hcsplt_copy.b.spltena = 1;
++		// XACTPOS is for isoc-out only but needs initialising anyway.
++		st->hcsplt_copy.b.xactpos = ISOC_XACTPOS_ALL;
++		if((qh->ep_type == DWC_OTG_EP_TYPE_ISOC) && (!qh->ep_is_in)) {
++			/* For packetsize 0 < L < 188, ISOC_XACTPOS_ALL.
++			 * for longer than this, ISOC_XACTPOS_BEGIN and the FIQ
++			 * will update as necessary.
++			 */
++			if (hc->xfer_len > 188) {
++				st->hcsplt_copy.b.xactpos = ISOC_XACTPOS_BEGIN;
++			}
++		}
++		st->hcsplt_copy.b.hubaddr = (uint8_t) hub_addr;
++		st->hcsplt_copy.b.prtaddr = (uint8_t) port_addr;
++		st->hub_addr = hub_addr;
++		st->port_addr = port_addr;
++	}
++
++	st->hctsiz_copy.d32 = 0;
++	st->hctsiz_copy.b.dopng = 0;
++	st->hctsiz_copy.b.pid = hc->data_pid_start;
++
++	if (hc->ep_is_in || (hc->xfer_len > hc->max_packet)) {
++		hc->xfer_len = min_t(uint32_t, hc->xfer_len, hc->max_packet);
++	} else if (!hc->ep_is_in && (hc->xfer_len > 188)) {
++		hc->xfer_len = 188;
++	}
++	st->hctsiz_copy.b.xfersize = hc->xfer_len;
++
++	st->hctsiz_copy.b.pktcnt = 1;
++
++	if (hc->ep_type & 0x1) {
++		/*
++		 * For potentially multi-packet transfers, must use the DMA bounce buffers. For IN transfers,
++		 * the DMA address is the address of the first 188byte slot buffer in the bounce buffer array.
++		 * For multi-packet OUT transfers, we need to copy the data into the bounce buffer array so the FIQ can punt
++		 * the right address out as necessary. hc->xfer_buff and hc->xfer_len have already been set
++		 * in assign_and_init_hc(), but this is for the eventual transaction completion only. The FIQ
++		 * must not touch internal driver state.
++		 */
++		if(!fiq_fsm_setup_periodic_dma(hcd, st, qh)) {
++			if (hc->align_buff) {
++				st->hcdma_copy.d32 = hc->align_buff;
++			} else {
++				st->hcdma_copy.d32 = ((unsigned long) hc->xfer_buff & 0xFFFFFFFF);
++			}
++		}
++	} else {
++		if (hc->align_buff) {
++			st->hcdma_copy.d32 = hc->align_buff;
++		} else {
++			st->hcdma_copy.d32 = ((unsigned long) hc->xfer_buff & 0xFFFFFFFF);
++		}
++	}
++	/* The FIQ depends upon no other interrupts being enabled except channel halt.
++	 * Fixup channel interrupt mask. */
++	st->hcintmsk_copy.d32 = 0;
++	st->hcintmsk_copy.b.chhltd = 1;
++	st->hcintmsk_copy.b.ahberr = 1;
++
++	/* Hack courtesy of FreeBSD: apparently forcing Interrupt Split transactions
++	 * as Control puts the transfer into the non-periodic request queue and the
++	 * non-periodic handler in the hub. Makes things lots easier.
++	 */
++	if ((fiq_fsm_mask & 0x8) && hc->ep_type == UE_INTERRUPT) {
++		st->hcchar_copy.b.multicnt = 0;
++		st->hcchar_copy.b.oddfrm = 0;
++		st->hcchar_copy.b.eptype = UE_CONTROL;
++		if (hc->align_buff) {
++			st->hcdma_copy.d32 = hc->align_buff;
++		} else {
++			st->hcdma_copy.d32 = ((unsigned long) hc->xfer_buff & 0xFFFFFFFF);
++		}
++	}
++	DWC_WRITE_REG32(&hc_regs->hcdma, st->hcdma_copy.d32);
++	DWC_WRITE_REG32(&hc_regs->hctsiz, st->hctsiz_copy.d32);
++	DWC_WRITE_REG32(&hc_regs->hcsplt, st->hcsplt_copy.d32);
++	DWC_WRITE_REG32(&hc_regs->hcchar, st->hcchar_copy.d32);
++	DWC_WRITE_REG32(&hc_regs->hcintmsk, st->hcintmsk_copy.d32);
++
++	local_fiq_disable();
++	fiq_fsm_spin_lock(&hcd->fiq_state->lock);
++
++	if (hc->ep_type & 0x1) {
++		hfnum.d32 = DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hfnum);
++		frame = (hfnum.b.frnum & ~0x7) >> 3;
++		uframe = hfnum.b.frnum & 0x7;
++		if (hfnum.b.frrem < PERIODIC_FRREM_BACKOFF) {
++			/* Prevent queueing near EOF1. Bad things happen if a periodic
++			 * split transaction is queued very close to EOF.
++			 */
++			start_immediate = 0;
++		} else if (uframe == 5) {
++			start_immediate = 0;
++		} else if (hc->ep_type == UE_ISOCHRONOUS && !hc->ep_is_in) {
++			start_immediate = 0;
++		} else if (hc->ep_is_in && fiq_fsm_too_late(hcd->fiq_state, hc->hc_num)) {
++			start_immediate = 0;
++		} else {
++			/* Search through all host channels to determine if a transaction
++			 * is currently in progress */
++			for (i = 0; i < hcd->core_if->core_params->host_channels; i++) {
++				if (i == hc->hc_num || hcd->fiq_state->channel[i].fsm == FIQ_PASSTHROUGH)
++					continue;
++				switch (hcd->fiq_state->channel[i].fsm) {
++				/* TT is reserved for channels that are in the middle of a periodic
++				 * split transaction.
++				 */
++				case FIQ_PER_SSPLIT_STARTED:
++				case FIQ_PER_CSPLIT_WAIT:
++				case FIQ_PER_CSPLIT_NYET1:
++				case FIQ_PER_CSPLIT_POLL:
++				case FIQ_PER_ISO_OUT_ACTIVE:
++				case FIQ_PER_ISO_OUT_LAST:
++					if (hcd->fiq_state->channel[i].hub_addr == hub_addr &&
++							hcd->fiq_state->channel[i].port_addr == port_addr) {
++						start_immediate = 0;
++					}
++					break;
++				default:
++					break;
++				}
++				if (!start_immediate)
++					break;
++			}
++		}
++	}
++	if ((fiq_fsm_mask & 0x8) && hc->ep_type == UE_INTERRUPT)
++		start_immediate = 1;
++
++	fiq_print(FIQDBG_INT, hcd->fiq_state, "FSMQ %01d %01d", hc->hc_num, start_immediate);
++	fiq_print(FIQDBG_INT, hcd->fiq_state, "%08d", hfnum.b.frrem);
++	//fiq_print(FIQDBG_INT, hcd->fiq_state, "H:%02dP:%02d", hub_addr, port_addr);
++	//fiq_print(FIQDBG_INT, hcd->fiq_state, "%08x", st->hctsiz_copy.d32);
++	//fiq_print(FIQDBG_INT, hcd->fiq_state, "%08x", st->hcdma_copy.d32);
++	switch (hc->ep_type) {
++		case UE_CONTROL:
++		case UE_BULK:
++			if (fiq_fsm_np_tt_contended(hcd, qh)) {
++				st->fsm = FIQ_NP_SSPLIT_PENDING;
++				start_immediate = 0;
++			} else {
++				st->fsm = FIQ_NP_SSPLIT_STARTED;
++			}
++			break;
++		case UE_ISOCHRONOUS:
++			if (hc->ep_is_in) {
++				if (start_immediate) {
++					st->fsm = FIQ_PER_SSPLIT_STARTED;
++				} else {
++					st->fsm = FIQ_PER_SSPLIT_QUEUED;
++				}
++			} else {
++				if (start_immediate) {
++					/* Single-isoc OUT packets don't require FIQ involvement */
++					if (st->nrpackets == 1) {
++						st->fsm = FIQ_PER_ISO_OUT_LAST;
++					} else {
++						st->fsm = FIQ_PER_ISO_OUT_ACTIVE;
++					}
++				} else {
++					st->fsm = FIQ_PER_ISO_OUT_PENDING;
++				}
++			}
++			break;
++		case UE_INTERRUPT:
++			if (fiq_fsm_mask & 0x8) {
++				if (fiq_fsm_np_tt_contended(hcd, qh)) {
++					st->fsm = FIQ_NP_SSPLIT_PENDING;
++					start_immediate = 0;
++				} else {
++					st->fsm = FIQ_NP_SSPLIT_STARTED;
++				}
++			} else if (start_immediate) {
++					st->fsm = FIQ_PER_SSPLIT_STARTED;
++			} else {
++				st->fsm = FIQ_PER_SSPLIT_QUEUED;
++			}
++		default:
++			break;
++	}
++	if (start_immediate) {
++		/* Set the oddfrm bit as close as possible to actual queueing */
++		frame = dwc_otg_hcd_get_frame_number(hcd);
++		st->expected_uframe = (frame + 1) & 0x3FFF;
++		st->hcchar_copy.b.oddfrm = (frame & 0x1) ? 0 : 1;
++		st->hcchar_copy.b.chen = 1;
++		DWC_WRITE_REG32(&hc_regs->hcchar, st->hcchar_copy.d32);
++	}
++	mb();
++	fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
++	local_fiq_enable();
++	return 0;
++}
++
++
++/**
++ * This function selects transactions from the HCD transfer schedule and
++ * assigns them to available host channels. It is called from HCD interrupt
++ * handler functions.
++ *
++ * @param hcd The HCD state structure.
++ *
++ * @return The types of new transactions that were assigned to host channels.
++ */
++dwc_otg_transaction_type_e dwc_otg_hcd_select_transactions(dwc_otg_hcd_t * hcd)
++{
++	dwc_list_link_t *qh_ptr;
++	dwc_otg_qh_t *qh;
++	int num_channels;
++	dwc_otg_transaction_type_e ret_val = DWC_OTG_TRANSACTION_NONE;
++
++#ifdef DEBUG_HOST_CHANNELS
++	last_sel_trans_num_per_scheduled = 0;
++	last_sel_trans_num_nonper_scheduled = 0;
++	last_sel_trans_num_avail_hc_at_start = hcd->available_host_channels;
++#endif /* DEBUG_HOST_CHANNELS */
++
++	/* Process entries in the periodic ready list. */
++	qh_ptr = DWC_LIST_FIRST(&hcd->periodic_sched_ready);
++
++	while (qh_ptr != &hcd->periodic_sched_ready &&
++	       !DWC_CIRCLEQ_EMPTY(&hcd->free_hc_list)) {
++
++		qh = DWC_LIST_ENTRY(qh_ptr, dwc_otg_qh_t, qh_list_entry);
++
++		if (microframe_schedule) {
++			// Make sure we leave one channel for non periodic transactions.
++			if (hcd->available_host_channels <= 1) {
++				break;
++			}
++			hcd->available_host_channels--;
++#ifdef DEBUG_HOST_CHANNELS
++			last_sel_trans_num_per_scheduled++;
++#endif /* DEBUG_HOST_CHANNELS */
++		}
++		qh = DWC_LIST_ENTRY(qh_ptr, dwc_otg_qh_t, qh_list_entry);
++		assign_and_init_hc(hcd, qh);
++
++		/*
++		 * Move the QH from the periodic ready schedule to the
++		 * periodic assigned schedule.
++		 */
++		qh_ptr = DWC_LIST_NEXT(qh_ptr);
++		DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_assigned,
++				   &qh->qh_list_entry);
++	}
++
++	/*
++	 * Process entries in the inactive portion of the non-periodic
++	 * schedule. Some free host channels may not be used if they are
++	 * reserved for periodic transfers.
++	 */
++	qh_ptr = hcd->non_periodic_sched_inactive.next;
++	num_channels = hcd->core_if->core_params->host_channels;
++	while (qh_ptr != &hcd->non_periodic_sched_inactive &&
++	       (microframe_schedule || hcd->non_periodic_channels <
++		num_channels - hcd->periodic_channels) &&
++	       !DWC_CIRCLEQ_EMPTY(&hcd->free_hc_list)) {
++
++		qh = DWC_LIST_ENTRY(qh_ptr, dwc_otg_qh_t, qh_list_entry);
++		/*
++		 * Check to see if this is a NAK'd retransmit, in which case ignore for retransmission
++		 * we hold off on bulk retransmissions to reduce NAK interrupt overhead for full-speed
++		 * cheeky devices that just hold off using NAKs
++		 */
++		if (fiq_enable && nak_holdoff && qh->do_split) {
++			if (qh->nak_frame != 0xffff) {
++				uint16_t next_frame = dwc_frame_num_inc(qh->nak_frame, (qh->ep_type == UE_BULK) ? nak_holdoff : 8);
++				uint16_t frame = dwc_otg_hcd_get_frame_number(hcd);
++				if (dwc_frame_num_le(frame, next_frame)) {
++					if(dwc_frame_num_le(next_frame, hcd->fiq_state->next_sched_frame)) {
++						hcd->fiq_state->next_sched_frame = next_frame;
++					}
++					qh_ptr = DWC_LIST_NEXT(qh_ptr);
++					continue;
++				} else {
++					qh->nak_frame = 0xFFFF;
++				}
++			}
++		}
++
++		if (microframe_schedule) {
++				if (hcd->available_host_channels < 1) {
++					break;
++				}
++				hcd->available_host_channels--;
++#ifdef DEBUG_HOST_CHANNELS
++				last_sel_trans_num_nonper_scheduled++;
++#endif /* DEBUG_HOST_CHANNELS */
++		}
++
++		assign_and_init_hc(hcd, qh);
++
++		/*
++		 * Move the QH from the non-periodic inactive schedule to the
++		 * non-periodic active schedule.
++		 */
++		qh_ptr = DWC_LIST_NEXT(qh_ptr);
++		DWC_LIST_MOVE_HEAD(&hcd->non_periodic_sched_active,
++				   &qh->qh_list_entry);
++
++		if (!microframe_schedule)
++			hcd->non_periodic_channels++;
++	}
++	/* we moved a non-periodic QH to the active schedule. If the inactive queue is empty,
++	 * stop the FIQ from kicking us. We could potentially still have elements here if we
++	 * ran out of host channels.
++	 */
++	if (fiq_enable) {
++		if (DWC_LIST_EMPTY(&hcd->non_periodic_sched_inactive)) {
++			hcd->fiq_state->kick_np_queues = 0;
++		} else {
++			/* For each entry remaining in the NP inactive queue,
++			* if this a NAK'd retransmit then don't set the kick flag.
++			*/
++			if(nak_holdoff) {
++				DWC_LIST_FOREACH(qh_ptr, &hcd->non_periodic_sched_inactive) {
++					qh = DWC_LIST_ENTRY(qh_ptr, dwc_otg_qh_t, qh_list_entry);
++					if (qh->nak_frame == 0xFFFF) {
++						hcd->fiq_state->kick_np_queues = 1;
++					}
++				}
++			}
++		}
++	}
++	if(!DWC_LIST_EMPTY(&hcd->periodic_sched_assigned))
++		ret_val |= DWC_OTG_TRANSACTION_PERIODIC;
++
++	if(!DWC_LIST_EMPTY(&hcd->non_periodic_sched_active))
++		ret_val |= DWC_OTG_TRANSACTION_NON_PERIODIC;
++
++
++#ifdef DEBUG_HOST_CHANNELS
++	last_sel_trans_num_avail_hc_at_end = hcd->available_host_channels;
++#endif /* DEBUG_HOST_CHANNELS */
++	return ret_val;
++}
++
++/**
++ * Attempts to queue a single transaction request for a host channel
++ * associated with either a periodic or non-periodic transfer. This function
++ * assumes that there is space available in the appropriate request queue. For
++ * an OUT transfer or SETUP transaction in Slave mode, it checks whether space
++ * is available in the appropriate Tx FIFO.
++ *
++ * @param hcd The HCD state structure.
++ * @param hc Host channel descriptor associated with either a periodic or
++ * non-periodic transfer.
++ * @param fifo_dwords_avail Number of DWORDs available in the periodic Tx
++ * FIFO for periodic transfers or the non-periodic Tx FIFO for non-periodic
++ * transfers.
++ *
++ * @return 1 if a request is queued and more requests may be needed to
++ * complete the transfer, 0 if no more requests are required for this
++ * transfer, -1 if there is insufficient space in the Tx FIFO.
++ */
++static int queue_transaction(dwc_otg_hcd_t * hcd,
++			     dwc_hc_t * hc, uint16_t fifo_dwords_avail)
++{
++	int retval;
++
++	if (hcd->core_if->dma_enable) {
++		if (hcd->core_if->dma_desc_enable) {
++			if (!hc->xfer_started
++			    || (hc->ep_type == DWC_OTG_EP_TYPE_ISOC)) {
++				dwc_otg_hcd_start_xfer_ddma(hcd, hc->qh);
++				hc->qh->ping_state = 0;
++			}
++		} else if (!hc->xfer_started) {
++			if (fiq_fsm_enable && hc->error_state) {
++				hcd->fiq_state->channel[hc->hc_num].nr_errors =
++					DWC_CIRCLEQ_FIRST(&hc->qh->qtd_list)->error_count;
++				hcd->fiq_state->channel[hc->hc_num].fsm =
++					FIQ_PASSTHROUGH_ERRORSTATE;
++			}
++			dwc_otg_hc_start_transfer(hcd->core_if, hc);
++			hc->qh->ping_state = 0;
++		}
++		retval = 0;
++	} else if (hc->halt_pending) {
++		/* Don't queue a request if the channel has been halted. */
++		retval = 0;
++	} else if (hc->halt_on_queue) {
++		dwc_otg_hc_halt(hcd->core_if, hc, hc->halt_status);
++		retval = 0;
++	} else if (hc->do_ping) {
++		if (!hc->xfer_started) {
++			dwc_otg_hc_start_transfer(hcd->core_if, hc);
++		}
++		retval = 0;
++	} else if (!hc->ep_is_in || hc->data_pid_start == DWC_OTG_HC_PID_SETUP) {
++		if ((fifo_dwords_avail * 4) >= hc->max_packet) {
++			if (!hc->xfer_started) {
++				dwc_otg_hc_start_transfer(hcd->core_if, hc);
++				retval = 1;
++			} else {
++				retval =
++				    dwc_otg_hc_continue_transfer(hcd->core_if,
++								 hc);
++			}
++		} else {
++			retval = -1;
++		}
++	} else {
++		if (!hc->xfer_started) {
++			dwc_otg_hc_start_transfer(hcd->core_if, hc);
++			retval = 1;
++		} else {
++			retval = dwc_otg_hc_continue_transfer(hcd->core_if, hc);
++		}
++	}
++
++	return retval;
++}
++
++/**
++ * Processes periodic channels for the next frame and queues transactions for
++ * these channels to the DWC_otg controller. After queueing transactions, the
++ * Periodic Tx FIFO Empty interrupt is enabled if there are more transactions
++ * to queue as Periodic Tx FIFO or request queue space becomes available.
++ * Otherwise, the Periodic Tx FIFO Empty interrupt is disabled.
++ */
++static void process_periodic_channels(dwc_otg_hcd_t * hcd)
++{
++	hptxsts_data_t tx_status;
++	dwc_list_link_t *qh_ptr;
++	dwc_otg_qh_t *qh;
++	int status = 0;
++	int no_queue_space = 0;
++	int no_fifo_space = 0;
++
++	dwc_otg_host_global_regs_t *host_regs;
++	host_regs = hcd->core_if->host_if->host_global_regs;
++
++	DWC_DEBUGPL(DBG_HCDV, "Queue periodic transactions\n");
++#ifdef DEBUG
++	tx_status.d32 = DWC_READ_REG32(&host_regs->hptxsts);
++	DWC_DEBUGPL(DBG_HCDV,
++		    "  P Tx Req Queue Space Avail (before queue): %d\n",
++		    tx_status.b.ptxqspcavail);
++	DWC_DEBUGPL(DBG_HCDV, "  P Tx FIFO Space Avail (before queue): %d\n",
++		    tx_status.b.ptxfspcavail);
++#endif
++
++	qh_ptr = hcd->periodic_sched_assigned.next;
++	while (qh_ptr != &hcd->periodic_sched_assigned) {
++		tx_status.d32 = DWC_READ_REG32(&host_regs->hptxsts);
++		if (tx_status.b.ptxqspcavail == 0) {
++			no_queue_space = 1;
++			break;
++		}
++
++		qh = DWC_LIST_ENTRY(qh_ptr, dwc_otg_qh_t, qh_list_entry);
++
++		// Do not send a split start transaction any later than frame .6
++		// Note, we have to schedule a periodic in .5 to make it go in .6
++		if(fiq_fsm_enable && qh->do_split && ((dwc_otg_hcd_get_frame_number(hcd) + 1) & 7) > 6)
++		{
++			qh_ptr = qh_ptr->next;
++			hcd->fiq_state->next_sched_frame = dwc_otg_hcd_get_frame_number(hcd) | 7;
++			continue;
++		}
++
++		if (fiq_fsm_enable && fiq_fsm_transaction_suitable(hcd, qh)) {
++			if (qh->do_split)
++				fiq_fsm_queue_split_transaction(hcd, qh);
++			else
++				fiq_fsm_queue_isoc_transaction(hcd, qh);
++		} else {
++
++			/*
++			 * Set a flag if we're queueing high-bandwidth in slave mode.
++			 * The flag prevents any halts to get into the request queue in
++			 * the middle of multiple high-bandwidth packets getting queued.
++			 */
++			if (!hcd->core_if->dma_enable && qh->channel->multi_count > 1) {
++				hcd->core_if->queuing_high_bandwidth = 1;
++			}
++			status = queue_transaction(hcd, qh->channel,
++							tx_status.b.ptxfspcavail);
++			if (status < 0) {
++				no_fifo_space = 1;
++				break;
++			}
++		}
++
++		/*
++		 * In Slave mode, stay on the current transfer until there is
++		 * nothing more to do or the high-bandwidth request count is
++		 * reached. In DMA mode, only need to queue one request. The
++		 * controller automatically handles multiple packets for
++		 * high-bandwidth transfers.
++		 */
++		if (hcd->core_if->dma_enable || status == 0 ||
++		    qh->channel->requests == qh->channel->multi_count) {
++			qh_ptr = qh_ptr->next;
++			/*
++			 * Move the QH from the periodic assigned schedule to
++			 * the periodic queued schedule.
++			 */
++			DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_queued,
++					   &qh->qh_list_entry);
++
++			/* done queuing high bandwidth */
++			hcd->core_if->queuing_high_bandwidth = 0;
++		}
++	}
++
++	if (!hcd->core_if->dma_enable) {
++		dwc_otg_core_global_regs_t *global_regs;
++		gintmsk_data_t intr_mask = {.d32 = 0 };
++
++		global_regs = hcd->core_if->core_global_regs;
++		intr_mask.b.ptxfempty = 1;
++#ifdef DEBUG
++		tx_status.d32 = DWC_READ_REG32(&host_regs->hptxsts);
++		DWC_DEBUGPL(DBG_HCDV,
++			    "  P Tx Req Queue Space Avail (after queue): %d\n",
++			    tx_status.b.ptxqspcavail);
++		DWC_DEBUGPL(DBG_HCDV,
++			    "  P Tx FIFO Space Avail (after queue): %d\n",
++			    tx_status.b.ptxfspcavail);
++#endif
++		if (!DWC_LIST_EMPTY(&hcd->periodic_sched_assigned) ||
++		    no_queue_space || no_fifo_space) {
++			/*
++			 * May need to queue more transactions as the request
++			 * queue or Tx FIFO empties. Enable the periodic Tx
++			 * FIFO empty interrupt. (Always use the half-empty
++			 * level to ensure that new requests are loaded as
++			 * soon as possible.)
++			 */
++			DWC_MODIFY_REG32(&global_regs->gintmsk, 0,
++					 intr_mask.d32);
++		} else {
++			/*
++			 * Disable the Tx FIFO empty interrupt since there are
++			 * no more transactions that need to be queued right
++			 * now. This function is called from interrupt
++			 * handlers to queue more transactions as transfer
++			 * states change.
++			 */
++			DWC_MODIFY_REG32(&global_regs->gintmsk, intr_mask.d32,
++					 0);
++		}
++	}
++}
++
++/**
++ * Processes active non-periodic channels and queues transactions for these
++ * channels to the DWC_otg controller. After queueing transactions, the NP Tx
++ * FIFO Empty interrupt is enabled if there are more transactions to queue as
++ * NP Tx FIFO or request queue space becomes available. Otherwise, the NP Tx
++ * FIFO Empty interrupt is disabled.
++ */
++static void process_non_periodic_channels(dwc_otg_hcd_t * hcd)
++{
++	gnptxsts_data_t tx_status;
++	dwc_list_link_t *orig_qh_ptr;
++	dwc_otg_qh_t *qh;
++	int status;
++	int no_queue_space = 0;
++	int no_fifo_space = 0;
++	int more_to_do = 0;
++
++	dwc_otg_core_global_regs_t *global_regs =
++	    hcd->core_if->core_global_regs;
++
++	DWC_DEBUGPL(DBG_HCDV, "Queue non-periodic transactions\n");
++#ifdef DEBUG
++	tx_status.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
++	DWC_DEBUGPL(DBG_HCDV,
++		    "  NP Tx Req Queue Space Avail (before queue): %d\n",
++		    tx_status.b.nptxqspcavail);
++	DWC_DEBUGPL(DBG_HCDV, "  NP Tx FIFO Space Avail (before queue): %d\n",
++		    tx_status.b.nptxfspcavail);
++#endif
++	/*
++	 * Keep track of the starting point. Skip over the start-of-list
++	 * entry.
++	 */
++	if (hcd->non_periodic_qh_ptr == &hcd->non_periodic_sched_active) {
++		hcd->non_periodic_qh_ptr = hcd->non_periodic_qh_ptr->next;
++	}
++	orig_qh_ptr = hcd->non_periodic_qh_ptr;
++
++	/*
++	 * Process once through the active list or until no more space is
++	 * available in the request queue or the Tx FIFO.
++	 */
++	do {
++		tx_status.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
++		if (!hcd->core_if->dma_enable && tx_status.b.nptxqspcavail == 0) {
++			no_queue_space = 1;
++			break;
++		}
++
++		qh = DWC_LIST_ENTRY(hcd->non_periodic_qh_ptr, dwc_otg_qh_t,
++				    qh_list_entry);
++
++		if(fiq_fsm_enable && fiq_fsm_transaction_suitable(hcd, qh)) {
++			fiq_fsm_queue_split_transaction(hcd, qh);
++		} else {
++			status = queue_transaction(hcd, qh->channel,
++						tx_status.b.nptxfspcavail);
++
++			if (status > 0) {
++				more_to_do = 1;
++			} else if (status < 0) {
++				no_fifo_space = 1;
++				break;
++			}
++		}
++		/* Advance to next QH, skipping start-of-list entry. */
++		hcd->non_periodic_qh_ptr = hcd->non_periodic_qh_ptr->next;
++		if (hcd->non_periodic_qh_ptr == &hcd->non_periodic_sched_active) {
++			hcd->non_periodic_qh_ptr =
++			    hcd->non_periodic_qh_ptr->next;
++		}
++
++	} while (hcd->non_periodic_qh_ptr != orig_qh_ptr);
++
++	if (!hcd->core_if->dma_enable) {
++		gintmsk_data_t intr_mask = {.d32 = 0 };
++		intr_mask.b.nptxfempty = 1;
++
++#ifdef DEBUG
++		tx_status.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
++		DWC_DEBUGPL(DBG_HCDV,
++			    "  NP Tx Req Queue Space Avail (after queue): %d\n",
++			    tx_status.b.nptxqspcavail);
++		DWC_DEBUGPL(DBG_HCDV,
++			    "  NP Tx FIFO Space Avail (after queue): %d\n",
++			    tx_status.b.nptxfspcavail);
++#endif
++		if (more_to_do || no_queue_space || no_fifo_space) {
++			/*
++			 * May need to queue more transactions as the request
++			 * queue or Tx FIFO empties. Enable the non-periodic
++			 * Tx FIFO empty interrupt. (Always use the half-empty
++			 * level to ensure that new requests are loaded as
++			 * soon as possible.)
++			 */
++			DWC_MODIFY_REG32(&global_regs->gintmsk, 0,
++					 intr_mask.d32);
++		} else {
++			/*
++			 * Disable the Tx FIFO empty interrupt since there are
++			 * no more transactions that need to be queued right
++			 * now. This function is called from interrupt
++			 * handlers to queue more transactions as transfer
++			 * states change.
++			 */
++			DWC_MODIFY_REG32(&global_regs->gintmsk, intr_mask.d32,
++					 0);
++		}
++	}
++}
++
++/**
++ * This function processes the currently active host channels and queues
++ * transactions for these channels to the DWC_otg controller. It is called
++ * from HCD interrupt handler functions.
++ *
++ * @param hcd The HCD state structure.
++ * @param tr_type The type(s) of transactions to queue (non-periodic,
++ * periodic, or both).
++ */
++void dwc_otg_hcd_queue_transactions(dwc_otg_hcd_t * hcd,
++				    dwc_otg_transaction_type_e tr_type)
++{
++#ifdef DEBUG_SOF
++	DWC_DEBUGPL(DBG_HCD, "Queue Transactions\n");
++#endif
++	/* Process host channels associated with periodic transfers. */
++	if ((tr_type == DWC_OTG_TRANSACTION_PERIODIC ||
++	     tr_type == DWC_OTG_TRANSACTION_ALL) &&
++	    !DWC_LIST_EMPTY(&hcd->periodic_sched_assigned)) {
++
++		process_periodic_channels(hcd);
++	}
++
++	/* Process host channels associated with non-periodic transfers. */
++	if (tr_type == DWC_OTG_TRANSACTION_NON_PERIODIC ||
++	    tr_type == DWC_OTG_TRANSACTION_ALL) {
++		if (!DWC_LIST_EMPTY(&hcd->non_periodic_sched_active)) {
++			process_non_periodic_channels(hcd);
++		} else {
++			/*
++			 * Ensure NP Tx FIFO empty interrupt is disabled when
++			 * there are no non-periodic transfers to process.
++			 */
++			gintmsk_data_t gintmsk = {.d32 = 0 };
++			gintmsk.b.nptxfempty = 1;
++
++			if (fiq_enable) {
++				local_fiq_disable();
++				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
++				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, gintmsk.d32, 0);
++				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
++				local_fiq_enable();
++			} else {
++				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, gintmsk.d32, 0);
++			}
++		}
++	}
++}
++
++#ifdef DWC_HS_ELECT_TST
++/*
++ * Quick and dirty hack to implement the HS Electrical Test
++ * SINGLE_STEP_GET_DEVICE_DESCRIPTOR feature.
++ *
++ * This code was copied from our userspace app "hset". It sends a
++ * Get Device Descriptor control sequence in two parts, first the
++ * Setup packet by itself, followed some time later by the In and
++ * Ack packets. Rather than trying to figure out how to add this
++ * functionality to the normal driver code, we just hijack the
++ * hardware, using these two function to drive the hardware
++ * directly.
++ */
++
++static dwc_otg_core_global_regs_t *global_regs;
++static dwc_otg_host_global_regs_t *hc_global_regs;
++static dwc_otg_hc_regs_t *hc_regs;
++static uint32_t *data_fifo;
++
++static void do_setup(void)
++{
++	gintsts_data_t gintsts;
++	hctsiz_data_t hctsiz;
++	hcchar_data_t hcchar;
++	haint_data_t haint;
++	hcint_data_t hcint;
++
++	/* Enable HAINTs */
++	DWC_WRITE_REG32(&hc_global_regs->haintmsk, 0x0001);
++
++	/* Enable HCINTs */
++	DWC_WRITE_REG32(&hc_regs->hcintmsk, 0x04a3);
++
++	/* Read GINTSTS */
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++	/* Read HAINT */
++	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
++
++	/* Read HCINT */
++	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++
++	/* Read HCCHAR */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++
++	/* Clear HCINT */
++	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
++
++	/* Clear HAINT */
++	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
++
++	/* Clear GINTSTS */
++	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++	/* Read GINTSTS */
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++	/*
++	 * Send Setup packet (Get Device Descriptor)
++	 */
++
++	/* Make sure channel is disabled */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	if (hcchar.b.chen) {
++		hcchar.b.chdis = 1;
++//              hcchar.b.chen = 1;
++		DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++		//sleep(1);
++		dwc_mdelay(1000);
++
++		/* Read GINTSTS */
++		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++		/* Read HAINT */
++		haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
++
++		/* Read HCINT */
++		hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++
++		/* Read HCCHAR */
++		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++
++		/* Clear HCINT */
++		DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
++
++		/* Clear HAINT */
++		DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
++
++		/* Clear GINTSTS */
++		DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	}
++
++	/* Set HCTSIZ */
++	hctsiz.d32 = 0;
++	hctsiz.b.xfersize = 8;
++	hctsiz.b.pktcnt = 1;
++	hctsiz.b.pid = DWC_OTG_HC_PID_SETUP;
++	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
++
++	/* Set HCCHAR */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	hcchar.b.eptype = DWC_OTG_EP_TYPE_CONTROL;
++	hcchar.b.epdir = 0;
++	hcchar.b.epnum = 0;
++	hcchar.b.mps = 8;
++	hcchar.b.chen = 1;
++	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++
++	/* Fill FIFO with Setup data for Get Device Descriptor */
++	data_fifo = (uint32_t *) ((char *)global_regs + 0x1000);
++	DWC_WRITE_REG32(data_fifo++, 0x01000680);
++	DWC_WRITE_REG32(data_fifo++, 0x00080000);
++
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++	/* Wait for host channel interrupt */
++	do {
++		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++	} while (gintsts.b.hcintr == 0);
++
++	/* Disable HCINTs */
++	DWC_WRITE_REG32(&hc_regs->hcintmsk, 0x0000);
++
++	/* Disable HAINTs */
++	DWC_WRITE_REG32(&hc_global_regs->haintmsk, 0x0000);
++
++	/* Read HAINT */
++	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
++
++	/* Read HCINT */
++	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++
++	/* Read HCCHAR */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++
++	/* Clear HCINT */
++	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
++
++	/* Clear HAINT */
++	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
++
++	/* Clear GINTSTS */
++	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++	/* Read GINTSTS */
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++}
++
++static void do_in_ack(void)
++{
++	gintsts_data_t gintsts;
++	hctsiz_data_t hctsiz;
++	hcchar_data_t hcchar;
++	haint_data_t haint;
++	hcint_data_t hcint;
++	host_grxsts_data_t grxsts;
++
++	/* Enable HAINTs */
++	DWC_WRITE_REG32(&hc_global_regs->haintmsk, 0x0001);
++
++	/* Enable HCINTs */
++	DWC_WRITE_REG32(&hc_regs->hcintmsk, 0x04a3);
++
++	/* Read GINTSTS */
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++	/* Read HAINT */
++	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
++
++	/* Read HCINT */
++	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++
++	/* Read HCCHAR */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++
++	/* Clear HCINT */
++	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
++
++	/* Clear HAINT */
++	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
++
++	/* Clear GINTSTS */
++	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++	/* Read GINTSTS */
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++	/*
++	 * Receive Control In packet
++	 */
++
++	/* Make sure channel is disabled */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	if (hcchar.b.chen) {
++		hcchar.b.chdis = 1;
++		hcchar.b.chen = 1;
++		DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++		//sleep(1);
++		dwc_mdelay(1000);
++
++		/* Read GINTSTS */
++		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++		/* Read HAINT */
++		haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
++
++		/* Read HCINT */
++		hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++
++		/* Read HCCHAR */
++		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++
++		/* Clear HCINT */
++		DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
++
++		/* Clear HAINT */
++		DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
++
++		/* Clear GINTSTS */
++		DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	}
++
++	/* Set HCTSIZ */
++	hctsiz.d32 = 0;
++	hctsiz.b.xfersize = 8;
++	hctsiz.b.pktcnt = 1;
++	hctsiz.b.pid = DWC_OTG_HC_PID_DATA1;
++	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
++
++	/* Set HCCHAR */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	hcchar.b.eptype = DWC_OTG_EP_TYPE_CONTROL;
++	hcchar.b.epdir = 1;
++	hcchar.b.epnum = 0;
++	hcchar.b.mps = 8;
++	hcchar.b.chen = 1;
++	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++	/* Wait for receive status queue interrupt */
++	do {
++		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++	} while (gintsts.b.rxstsqlvl == 0);
++
++	/* Read RXSTS */
++	grxsts.d32 = DWC_READ_REG32(&global_regs->grxstsp);
++
++	/* Clear RXSTSQLVL in GINTSTS */
++	gintsts.d32 = 0;
++	gintsts.b.rxstsqlvl = 1;
++	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++	switch (grxsts.b.pktsts) {
++	case DWC_GRXSTS_PKTSTS_IN:
++		/* Read the data into the host buffer */
++		if (grxsts.b.bcnt > 0) {
++			int i;
++			int word_count = (grxsts.b.bcnt + 3) / 4;
++
++			data_fifo = (uint32_t *) ((char *)global_regs + 0x1000);
++
++			for (i = 0; i < word_count; i++) {
++				(void)DWC_READ_REG32(data_fifo++);
++			}
++		}
++		break;
++
++	default:
++		break;
++	}
++
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++	/* Wait for receive status queue interrupt */
++	do {
++		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++	} while (gintsts.b.rxstsqlvl == 0);
++
++	/* Read RXSTS */
++	grxsts.d32 = DWC_READ_REG32(&global_regs->grxstsp);
++
++	/* Clear RXSTSQLVL in GINTSTS */
++	gintsts.d32 = 0;
++	gintsts.b.rxstsqlvl = 1;
++	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++	switch (grxsts.b.pktsts) {
++	case DWC_GRXSTS_PKTSTS_IN_XFER_COMP:
++		break;
++
++	default:
++		break;
++	}
++
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++	/* Wait for host channel interrupt */
++	do {
++		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++	} while (gintsts.b.hcintr == 0);
++
++	/* Read HAINT */
++	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
++
++	/* Read HCINT */
++	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++
++	/* Read HCCHAR */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++
++	/* Clear HCINT */
++	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
++
++	/* Clear HAINT */
++	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
++
++	/* Clear GINTSTS */
++	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++	/* Read GINTSTS */
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++//      usleep(100000);
++//      mdelay(100);
++	dwc_mdelay(1);
++
++	/*
++	 * Send handshake packet
++	 */
++
++	/* Read HAINT */
++	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
++
++	/* Read HCINT */
++	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++
++	/* Read HCCHAR */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++
++	/* Clear HCINT */
++	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
++
++	/* Clear HAINT */
++	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
++
++	/* Clear GINTSTS */
++	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++	/* Read GINTSTS */
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++	/* Make sure channel is disabled */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	if (hcchar.b.chen) {
++		hcchar.b.chdis = 1;
++		hcchar.b.chen = 1;
++		DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++		//sleep(1);
++		dwc_mdelay(1000);
++
++		/* Read GINTSTS */
++		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++		/* Read HAINT */
++		haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
++
++		/* Read HCINT */
++		hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++
++		/* Read HCCHAR */
++		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++
++		/* Clear HCINT */
++		DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
++
++		/* Clear HAINT */
++		DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
++
++		/* Clear GINTSTS */
++		DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	}
++
++	/* Set HCTSIZ */
++	hctsiz.d32 = 0;
++	hctsiz.b.xfersize = 0;
++	hctsiz.b.pktcnt = 1;
++	hctsiz.b.pid = DWC_OTG_HC_PID_DATA1;
++	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
++
++	/* Set HCCHAR */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	hcchar.b.eptype = DWC_OTG_EP_TYPE_CONTROL;
++	hcchar.b.epdir = 0;
++	hcchar.b.epnum = 0;
++	hcchar.b.mps = 8;
++	hcchar.b.chen = 1;
++	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++	/* Wait for host channel interrupt */
++	do {
++		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++	} while (gintsts.b.hcintr == 0);
++
++	/* Disable HCINTs */
++	DWC_WRITE_REG32(&hc_regs->hcintmsk, 0x0000);
++
++	/* Disable HAINTs */
++	DWC_WRITE_REG32(&hc_global_regs->haintmsk, 0x0000);
++
++	/* Read HAINT */
++	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
++
++	/* Read HCINT */
++	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++
++	/* Read HCCHAR */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++
++	/* Clear HCINT */
++	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
++
++	/* Clear HAINT */
++	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
++
++	/* Clear GINTSTS */
++	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++	/* Read GINTSTS */
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++}
++#endif
++
++/** Handles hub class-specific requests. */
++int dwc_otg_hcd_hub_control(dwc_otg_hcd_t * dwc_otg_hcd,
++			    uint16_t typeReq,
++			    uint16_t wValue,
++			    uint16_t wIndex, uint8_t * buf, uint16_t wLength)
++{
++	int retval = 0;
++
++	dwc_otg_core_if_t *core_if = dwc_otg_hcd->core_if;
++	usb_hub_descriptor_t *hub_desc;
++	hprt0_data_t hprt0 = {.d32 = 0 };
++
++	uint32_t port_status;
++
++	switch (typeReq) {
++	case UCR_CLEAR_HUB_FEATURE:
++		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++			    "ClearHubFeature 0x%x\n", wValue);
++		switch (wValue) {
++		case UHF_C_HUB_LOCAL_POWER:
++		case UHF_C_HUB_OVER_CURRENT:
++			/* Nothing required here */
++			break;
++		default:
++			retval = -DWC_E_INVALID;
++			DWC_ERROR("DWC OTG HCD - "
++				  "ClearHubFeature request %xh unknown\n",
++				  wValue);
++		}
++		break;
++	case UCR_CLEAR_PORT_FEATURE:
++#ifdef CONFIG_USB_DWC_OTG_LPM
++		if (wValue != UHF_PORT_L1)
++#endif
++			if (!wIndex || wIndex > 1)
++				goto error;
++
++		switch (wValue) {
++		case UHF_PORT_ENABLE:
++			DWC_DEBUGPL(DBG_ANY, "DWC OTG HCD HUB CONTROL - "
++				    "ClearPortFeature USB_PORT_FEAT_ENABLE\n");
++			hprt0.d32 = dwc_otg_read_hprt0(core_if);
++			hprt0.b.prtena = 1;
++			DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++			break;
++		case UHF_PORT_SUSPEND:
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "ClearPortFeature USB_PORT_FEAT_SUSPEND\n");
++
++			if (core_if->power_down == 2) {
++				dwc_otg_host_hibernation_restore(core_if, 0, 0);
++			} else {
++				DWC_WRITE_REG32(core_if->pcgcctl, 0);
++				dwc_mdelay(5);
++
++				hprt0.d32 = dwc_otg_read_hprt0(core_if);
++				hprt0.b.prtres = 1;
++				DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++				hprt0.b.prtsusp = 0;
++				/* Clear Resume bit */
++				dwc_mdelay(100);
++				hprt0.b.prtres = 0;
++				DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++			}
++			break;
++#ifdef CONFIG_USB_DWC_OTG_LPM
++		case UHF_PORT_L1:
++			{
++				pcgcctl_data_t pcgcctl = {.d32 = 0 };
++				glpmcfg_data_t lpmcfg = {.d32 = 0 };
++
++				lpmcfg.d32 =
++				    DWC_READ_REG32(&core_if->
++						   core_global_regs->glpmcfg);
++				lpmcfg.b.en_utmi_sleep = 0;
++				lpmcfg.b.hird_thres &= (~(1 << 4));
++				lpmcfg.b.prt_sleep_sts = 1;
++				DWC_WRITE_REG32(&core_if->
++						core_global_regs->glpmcfg,
++						lpmcfg.d32);
++
++				/* Clear Enbl_L1Gating bit. */
++				pcgcctl.b.enbl_sleep_gating = 1;
++				DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32,
++						 0);
++
++				dwc_mdelay(5);
++
++				hprt0.d32 = dwc_otg_read_hprt0(core_if);
++				hprt0.b.prtres = 1;
++				DWC_WRITE_REG32(core_if->host_if->hprt0,
++						hprt0.d32);
++				/* This bit will be cleared in wakeup interrupt handle */
++				break;
++			}
++#endif
++		case UHF_PORT_POWER:
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "ClearPortFeature USB_PORT_FEAT_POWER\n");
++			hprt0.d32 = dwc_otg_read_hprt0(core_if);
++			hprt0.b.prtpwr = 0;
++			DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++			break;
++		case UHF_PORT_INDICATOR:
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "ClearPortFeature USB_PORT_FEAT_INDICATOR\n");
++			/* Port inidicator not supported */
++			break;
++		case UHF_C_PORT_CONNECTION:
++			/* Clears drivers internal connect status change
++			 * flag */
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "ClearPortFeature USB_PORT_FEAT_C_CONNECTION\n");
++			dwc_otg_hcd->flags.b.port_connect_status_change = 0;
++			break;
++		case UHF_C_PORT_RESET:
++			/* Clears the driver's internal Port Reset Change
++			 * flag */
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "ClearPortFeature USB_PORT_FEAT_C_RESET\n");
++			dwc_otg_hcd->flags.b.port_reset_change = 0;
++			break;
++		case UHF_C_PORT_ENABLE:
++			/* Clears the driver's internal Port
++			 * Enable/Disable Change flag */
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "ClearPortFeature USB_PORT_FEAT_C_ENABLE\n");
++			dwc_otg_hcd->flags.b.port_enable_change = 0;
++			break;
++		case UHF_C_PORT_SUSPEND:
++			/* Clears the driver's internal Port Suspend
++			 * Change flag, which is set when resume signaling on
++			 * the host port is complete */
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "ClearPortFeature USB_PORT_FEAT_C_SUSPEND\n");
++			dwc_otg_hcd->flags.b.port_suspend_change = 0;
++			break;
++#ifdef CONFIG_USB_DWC_OTG_LPM
++		case UHF_C_PORT_L1:
++			dwc_otg_hcd->flags.b.port_l1_change = 0;
++			break;
++#endif
++		case UHF_C_PORT_OVER_CURRENT:
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "ClearPortFeature USB_PORT_FEAT_C_OVER_CURRENT\n");
++			dwc_otg_hcd->flags.b.port_over_current_change = 0;
++			break;
++		default:
++			retval = -DWC_E_INVALID;
++			DWC_ERROR("DWC OTG HCD - "
++				  "ClearPortFeature request %xh "
++				  "unknown or unsupported\n", wValue);
++		}
++		break;
++	case UCR_GET_HUB_DESCRIPTOR:
++		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++			    "GetHubDescriptor\n");
++		hub_desc = (usb_hub_descriptor_t *) buf;
++		hub_desc->bDescLength = 9;
++		hub_desc->bDescriptorType = 0x29;
++		hub_desc->bNbrPorts = 1;
++		USETW(hub_desc->wHubCharacteristics, 0x08);
++		hub_desc->bPwrOn2PwrGood = 1;
++		hub_desc->bHubContrCurrent = 0;
++		hub_desc->DeviceRemovable[0] = 0;
++		hub_desc->DeviceRemovable[1] = 0xff;
++		break;
++	case UCR_GET_HUB_STATUS:
++		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++			    "GetHubStatus\n");
++		DWC_MEMSET(buf, 0, 4);
++		break;
++	case UCR_GET_PORT_STATUS:
++		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++			    "GetPortStatus wIndex = 0x%04x FLAGS=0x%08x\n",
++			    wIndex, dwc_otg_hcd->flags.d32);
++		if (!wIndex || wIndex > 1)
++			goto error;
++
++		port_status = 0;
++
++		if (dwc_otg_hcd->flags.b.port_connect_status_change)
++			port_status |= (1 << UHF_C_PORT_CONNECTION);
++
++		if (dwc_otg_hcd->flags.b.port_enable_change)
++			port_status |= (1 << UHF_C_PORT_ENABLE);
++
++		if (dwc_otg_hcd->flags.b.port_suspend_change)
++			port_status |= (1 << UHF_C_PORT_SUSPEND);
++
++		if (dwc_otg_hcd->flags.b.port_l1_change)
++			port_status |= (1 << UHF_C_PORT_L1);
++
++		if (dwc_otg_hcd->flags.b.port_reset_change) {
++			port_status |= (1 << UHF_C_PORT_RESET);
++		}
++
++		if (dwc_otg_hcd->flags.b.port_over_current_change) {
++			DWC_WARN("Overcurrent change detected\n");
++			port_status |= (1 << UHF_C_PORT_OVER_CURRENT);
++		}
++
++		if (!dwc_otg_hcd->flags.b.port_connect_status) {
++			/*
++			 * The port is disconnected, which means the core is
++			 * either in device mode or it soon will be. Just
++			 * return 0's for the remainder of the port status
++			 * since the port register can't be read if the core
++			 * is in device mode.
++			 */
++			*((__le32 *) buf) = dwc_cpu_to_le32(&port_status);
++			break;
++		}
++
++		hprt0.d32 = DWC_READ_REG32(core_if->host_if->hprt0);
++		DWC_DEBUGPL(DBG_HCDV, "  HPRT0: 0x%08x\n", hprt0.d32);
++
++		if (hprt0.b.prtconnsts)
++			port_status |= (1 << UHF_PORT_CONNECTION);
++
++		if (hprt0.b.prtena)
++			port_status |= (1 << UHF_PORT_ENABLE);
++
++		if (hprt0.b.prtsusp)
++			port_status |= (1 << UHF_PORT_SUSPEND);
++
++		if (hprt0.b.prtovrcurract)
++			port_status |= (1 << UHF_PORT_OVER_CURRENT);
++
++		if (hprt0.b.prtrst)
++			port_status |= (1 << UHF_PORT_RESET);
++
++		if (hprt0.b.prtpwr)
++			port_status |= (1 << UHF_PORT_POWER);
++
++		if (hprt0.b.prtspd == DWC_HPRT0_PRTSPD_HIGH_SPEED)
++			port_status |= (1 << UHF_PORT_HIGH_SPEED);
++		else if (hprt0.b.prtspd == DWC_HPRT0_PRTSPD_LOW_SPEED)
++			port_status |= (1 << UHF_PORT_LOW_SPEED);
++
++		if (hprt0.b.prttstctl)
++			port_status |= (1 << UHF_PORT_TEST);
++		if (dwc_otg_get_lpm_portsleepstatus(dwc_otg_hcd->core_if)) {
++			port_status |= (1 << UHF_PORT_L1);
++		}
++		/*
++		   For Synopsys HW emulation of Power down wkup_control asserts the
++		   hreset_n and prst_n on suspned. This causes the HPRT0 to be zero.
++		   We intentionally tell the software that port is in L2Suspend state.
++		   Only for STE.
++		*/
++		if ((core_if->power_down == 2)
++		    && (core_if->hibernation_suspend == 1)) {
++			port_status |= (1 << UHF_PORT_SUSPEND);
++		}
++		/* USB_PORT_FEAT_INDICATOR unsupported always 0 */
++
++		*((__le32 *) buf) = dwc_cpu_to_le32(&port_status);
++
++		break;
++	case UCR_SET_HUB_FEATURE:
++		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++			    "SetHubFeature\n");
++		/* No HUB features supported */
++		break;
++	case UCR_SET_PORT_FEATURE:
++		if (wValue != UHF_PORT_TEST && (!wIndex || wIndex > 1))
++			goto error;
++
++		if (!dwc_otg_hcd->flags.b.port_connect_status) {
++			/*
++			 * The port is disconnected, which means the core is
++			 * either in device mode or it soon will be. Just
++			 * return without doing anything since the port
++			 * register can't be written if the core is in device
++			 * mode.
++			 */
++			break;
++		}
++
++		switch (wValue) {
++		case UHF_PORT_SUSPEND:
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "SetPortFeature - USB_PORT_FEAT_SUSPEND\n");
++			if (dwc_otg_hcd_otg_port(dwc_otg_hcd) != wIndex) {
++				goto error;
++			}
++			if (core_if->power_down == 2) {
++				int timeout = 300;
++				dwc_irqflags_t flags;
++				pcgcctl_data_t pcgcctl = {.d32 = 0 };
++				gpwrdn_data_t gpwrdn = {.d32 = 0 };
++				gusbcfg_data_t gusbcfg = {.d32 = 0 };
++#ifdef DWC_DEV_SRPCAP
++				int32_t otg_cap_param = core_if->core_params->otg_cap;
++#endif
++				DWC_PRINTF("Preparing for complete power-off\n");
++
++				/* Save registers before hibernation */
++				dwc_otg_save_global_regs(core_if);
++				dwc_otg_save_host_regs(core_if);
++
++				hprt0.d32 = dwc_otg_read_hprt0(core_if);
++				hprt0.b.prtsusp = 1;
++				hprt0.b.prtena = 0;
++				DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++				/* Spin hprt0.b.prtsusp to became 1 */
++				do {
++					hprt0.d32 = dwc_otg_read_hprt0(core_if);
++					if (hprt0.b.prtsusp) {
++						break;
++					}
++					dwc_mdelay(1);
++				} while (--timeout);
++				if (!timeout) {
++					DWC_WARN("Suspend wasn't genereted\n");
++				}
++				dwc_udelay(10);
++
++				/*
++				 * We need to disable interrupts to prevent servicing of any IRQ
++				 * during going to hibernation
++				 */
++				DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &flags);
++				core_if->lx_state = DWC_OTG_L2;
++#ifdef DWC_DEV_SRPCAP
++				hprt0.d32 = dwc_otg_read_hprt0(core_if);
++				hprt0.b.prtpwr = 0;
++				hprt0.b.prtena = 0;
++				DWC_WRITE_REG32(core_if->host_if->hprt0,
++						hprt0.d32);
++#endif
++				gusbcfg.d32 =
++				    DWC_READ_REG32(&core_if->core_global_regs->
++						   gusbcfg);
++				if (gusbcfg.b.ulpi_utmi_sel == 1) {
++					/* ULPI interface */
++					/* Suspend the Phy Clock */
++					pcgcctl.d32 = 0;
++					pcgcctl.b.stoppclk = 1;
++					DWC_MODIFY_REG32(core_if->pcgcctl, 0,
++							 pcgcctl.d32);
++					dwc_udelay(10);
++					gpwrdn.b.pmuactv = 1;
++					DWC_MODIFY_REG32(&core_if->
++							 core_global_regs->
++							 gpwrdn, 0, gpwrdn.d32);
++				} else {
++					/* UTMI+ Interface */
++					gpwrdn.b.pmuactv = 1;
++					DWC_MODIFY_REG32(&core_if->
++							 core_global_regs->
++							 gpwrdn, 0, gpwrdn.d32);
++					dwc_udelay(10);
++					pcgcctl.b.stoppclk = 1;
++					DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
++					dwc_udelay(10);
++				}
++#ifdef DWC_DEV_SRPCAP
++				gpwrdn.d32 = 0;
++				gpwrdn.b.dis_vbus = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++#endif
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pmuintsel = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++				dwc_udelay(10);
++
++				gpwrdn.d32 = 0;
++#ifdef DWC_DEV_SRPCAP
++				gpwrdn.b.srp_det_msk = 1;
++#endif
++				gpwrdn.b.disconn_det_msk = 1;
++				gpwrdn.b.lnstchng_msk = 1;
++				gpwrdn.b.sts_chngint_msk = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++				dwc_udelay(10);
++
++				/* Enable Power Down Clamp and all interrupts in GPWRDN */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pwrdnclmp = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++				dwc_udelay(10);
++
++				/* Switch off VDD */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pwrdnswtch = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++
++#ifdef DWC_DEV_SRPCAP
++				if (otg_cap_param == DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE)
++				{
++					core_if->pwron_timer_started = 1;
++					DWC_TIMER_SCHEDULE(core_if->pwron_timer, 6000 /* 6 secs */ );
++				}
++#endif
++				/* Save gpwrdn register for further usage if stschng interrupt */
++				core_if->gr_backup->gpwrdn_local =
++						DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++
++				/* Set flag to indicate that we are in hibernation */
++				core_if->hibernation_suspend = 1;
++				DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock,flags);
++
++				DWC_PRINTF("Host hibernation completed\n");
++				// Exit from case statement
++				break;
++
++			}
++			if (dwc_otg_hcd_otg_port(dwc_otg_hcd) == wIndex &&
++			    dwc_otg_hcd->fops->get_b_hnp_enable(dwc_otg_hcd)) {
++				gotgctl_data_t gotgctl = {.d32 = 0 };
++				gotgctl.b.hstsethnpen = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gotgctl, 0, gotgctl.d32);
++				core_if->op_state = A_SUSPEND;
++			}
++			hprt0.d32 = dwc_otg_read_hprt0(core_if);
++			hprt0.b.prtsusp = 1;
++			DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++			{
++				dwc_irqflags_t flags;
++				/* Update lx_state */
++				DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &flags);
++				core_if->lx_state = DWC_OTG_L2;
++				DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock, flags);
++			}
++			/* Suspend the Phy Clock */
++			{
++				pcgcctl_data_t pcgcctl = {.d32 = 0 };
++				pcgcctl.b.stoppclk = 1;
++				DWC_MODIFY_REG32(core_if->pcgcctl, 0,
++						 pcgcctl.d32);
++				dwc_udelay(10);
++			}
++
++			/* For HNP the bus must be suspended for at least 200ms. */
++			if (dwc_otg_hcd->fops->get_b_hnp_enable(dwc_otg_hcd)) {
++				pcgcctl_data_t pcgcctl = {.d32 = 0 };
++				pcgcctl.b.stoppclk = 1;
++                DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
++				dwc_mdelay(200);
++			}
++
++			/** @todo - check how sw can wait for 1 sec to check asesvld??? */
++#if 0 //vahrama !!!!!!!!!!!!!!!!!!
++			if (core_if->adp_enable) {
++				gotgctl_data_t gotgctl = {.d32 = 0 };
++				gpwrdn_data_t gpwrdn;
++
++				while (gotgctl.b.asesvld == 1) {
++					gotgctl.d32 =
++					    DWC_READ_REG32(&core_if->
++							   core_global_regs->
++							   gotgctl);
++					dwc_mdelay(100);
++				}
++
++				/* Enable Power Down Logic */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pmuactv = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++
++				/* Unmask SRP detected interrupt from Power Down Logic */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.srp_det_msk = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++
++				dwc_otg_adp_probe_start(core_if);
++			}
++#endif
++			break;
++		case UHF_PORT_POWER:
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "SetPortFeature - USB_PORT_FEAT_POWER\n");
++			hprt0.d32 = dwc_otg_read_hprt0(core_if);
++			hprt0.b.prtpwr = 1;
++			DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++			break;
++		case UHF_PORT_RESET:
++			if ((core_if->power_down == 2)
++			    && (core_if->hibernation_suspend == 1)) {
++				/* If we are going to exit from Hibernated
++				 * state via USB RESET.
++				 */
++				dwc_otg_host_hibernation_restore(core_if, 0, 1);
++			} else {
++				hprt0.d32 = dwc_otg_read_hprt0(core_if);
++
++				DWC_DEBUGPL(DBG_HCD,
++					    "DWC OTG HCD HUB CONTROL - "
++					    "SetPortFeature - USB_PORT_FEAT_RESET\n");
++				{
++					pcgcctl_data_t pcgcctl = {.d32 = 0 };
++					pcgcctl.b.enbl_sleep_gating = 1;
++					pcgcctl.b.stoppclk = 1;
++					DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
++					DWC_WRITE_REG32(core_if->pcgcctl, 0);
++				}
++#ifdef CONFIG_USB_DWC_OTG_LPM
++				{
++					glpmcfg_data_t lpmcfg;
++					lpmcfg.d32 =
++						DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++					if (lpmcfg.b.prt_sleep_sts) {
++						lpmcfg.b.en_utmi_sleep = 0;
++						lpmcfg.b.hird_thres &= (~(1 << 4));
++						DWC_WRITE_REG32
++						    (&core_if->core_global_regs->glpmcfg,
++						     lpmcfg.d32);
++						dwc_mdelay(1);
++					}
++				}
++#endif
++				hprt0.d32 = dwc_otg_read_hprt0(core_if);
++				/* Clear suspend bit if resetting from suspended state. */
++				hprt0.b.prtsusp = 0;
++				/* When B-Host the Port reset bit is set in
++				 * the Start HCD Callback function, so that
++				 * the reset is started within 1ms of the HNP
++				 * success interrupt. */
++				if (!dwc_otg_hcd_is_b_host(dwc_otg_hcd)) {
++					hprt0.b.prtpwr = 1;
++					hprt0.b.prtrst = 1;
++					DWC_PRINTF("Indeed it is in host mode hprt0 = %08x\n",hprt0.d32);
++					DWC_WRITE_REG32(core_if->host_if->hprt0,
++							hprt0.d32);
++				}
++				/* Clear reset bit in 10ms (FS/LS) or 50ms (HS) */
++				dwc_mdelay(60);
++				hprt0.b.prtrst = 0;
++				DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++				core_if->lx_state = DWC_OTG_L0;	/* Now back to the on state */
++			}
++			break;
++#ifdef DWC_HS_ELECT_TST
++		case UHF_PORT_TEST:
++			{
++				uint32_t t;
++				gintmsk_data_t gintmsk;
++
++				t = (wIndex >> 8);	/* MSB wIndex USB */
++				DWC_DEBUGPL(DBG_HCD,
++					    "DWC OTG HCD HUB CONTROL - "
++					    "SetPortFeature - USB_PORT_FEAT_TEST %d\n",
++					    t);
++				DWC_WARN("USB_PORT_FEAT_TEST %d\n", t);
++				if (t < 6) {
++					hprt0.d32 = dwc_otg_read_hprt0(core_if);
++					hprt0.b.prttstctl = t;
++					DWC_WRITE_REG32(core_if->host_if->hprt0,
++							hprt0.d32);
++				} else {
++					/* Setup global vars with reg addresses (quick and
++					 * dirty hack, should be cleaned up)
++					 */
++					global_regs = core_if->core_global_regs;
++					hc_global_regs =
++					    core_if->host_if->host_global_regs;
++					hc_regs =
++					    (dwc_otg_hc_regs_t *) ((char *)
++								   global_regs +
++								   0x500);
++					data_fifo =
++					    (uint32_t *) ((char *)global_regs +
++							  0x1000);
++
++					if (t == 6) {	/* HS_HOST_PORT_SUSPEND_RESUME */
++						/* Save current interrupt mask */
++						gintmsk.d32 =
++						    DWC_READ_REG32
++						    (&global_regs->gintmsk);
++
++						/* Disable all interrupts while we muck with
++						 * the hardware directly
++						 */
++						DWC_WRITE_REG32(&global_regs->gintmsk, 0);
++
++						/* 15 second delay per the test spec */
++						dwc_mdelay(15000);
++
++						/* Drive suspend on the root port */
++						hprt0.d32 =
++						    dwc_otg_read_hprt0(core_if);
++						hprt0.b.prtsusp = 1;
++						hprt0.b.prtres = 0;
++						DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++
++						/* 15 second delay per the test spec */
++						dwc_mdelay(15000);
++
++						/* Drive resume on the root port */
++						hprt0.d32 =
++						    dwc_otg_read_hprt0(core_if);
++						hprt0.b.prtsusp = 0;
++						hprt0.b.prtres = 1;
++						DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++						dwc_mdelay(100);
++
++						/* Clear the resume bit */
++						hprt0.b.prtres = 0;
++						DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++
++						/* Restore interrupts */
++						DWC_WRITE_REG32(&global_regs->gintmsk, gintmsk.d32);
++					} else if (t == 7) {	/* SINGLE_STEP_GET_DEVICE_DESCRIPTOR setup */
++						/* Save current interrupt mask */
++						gintmsk.d32 =
++						    DWC_READ_REG32
++						    (&global_regs->gintmsk);
++
++						/* Disable all interrupts while we muck with
++						 * the hardware directly
++						 */
++						DWC_WRITE_REG32(&global_regs->gintmsk, 0);
++
++						/* 15 second delay per the test spec */
++						dwc_mdelay(15000);
++
++						/* Send the Setup packet */
++						do_setup();
++
++						/* 15 second delay so nothing else happens for awhile */
++						dwc_mdelay(15000);
++
++						/* Restore interrupts */
++						DWC_WRITE_REG32(&global_regs->gintmsk, gintmsk.d32);
++					} else if (t == 8) {	/* SINGLE_STEP_GET_DEVICE_DESCRIPTOR execute */
++						/* Save current interrupt mask */
++						gintmsk.d32 =
++						    DWC_READ_REG32
++						    (&global_regs->gintmsk);
++
++						/* Disable all interrupts while we muck with
++						 * the hardware directly
++						 */
++						DWC_WRITE_REG32(&global_regs->gintmsk, 0);
++
++						/* Send the Setup packet */
++						do_setup();
++
++						/* 15 second delay so nothing else happens for awhile */
++						dwc_mdelay(15000);
++
++						/* Send the In and Ack packets */
++						do_in_ack();
++
++						/* 15 second delay so nothing else happens for awhile */
++						dwc_mdelay(15000);
++
++						/* Restore interrupts */
++						DWC_WRITE_REG32(&global_regs->gintmsk, gintmsk.d32);
++					}
++				}
++				break;
++			}
++#endif /* DWC_HS_ELECT_TST */
++
++		case UHF_PORT_INDICATOR:
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "SetPortFeature - USB_PORT_FEAT_INDICATOR\n");
++			/* Not supported */
++			break;
++		default:
++			retval = -DWC_E_INVALID;
++			DWC_ERROR("DWC OTG HCD - "
++				  "SetPortFeature request %xh "
++				  "unknown or unsupported\n", wValue);
++			break;
++		}
++		break;
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	case UCR_SET_AND_TEST_PORT_FEATURE:
++		if (wValue != UHF_PORT_L1) {
++			goto error;
++		}
++		{
++			int portnum, hird, devaddr, remwake;
++			glpmcfg_data_t lpmcfg;
++			uint32_t time_usecs;
++			gintsts_data_t gintsts;
++			gintmsk_data_t gintmsk;
++
++			if (!dwc_otg_get_param_lpm_enable(core_if)) {
++				goto error;
++			}
++			if (wValue != UHF_PORT_L1 || wLength != 1) {
++				goto error;
++			}
++			/* Check if the port currently is in SLEEP state */
++			lpmcfg.d32 =
++			    DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++			if (lpmcfg.b.prt_sleep_sts) {
++				DWC_INFO("Port is already in sleep mode\n");
++				buf[0] = 0;	/* Return success */
++				break;
++			}
++
++			portnum = wIndex & 0xf;
++			hird = (wIndex >> 4) & 0xf;
++			devaddr = (wIndex >> 8) & 0x7f;
++			remwake = (wIndex >> 15);
++
++			if (portnum != 1) {
++				retval = -DWC_E_INVALID;
++				DWC_WARN
++				    ("Wrong port number(%d) in SetandTestPortFeature request\n",
++				     portnum);
++				break;
++			}
++
++			DWC_PRINTF
++			    ("SetandTestPortFeature request: portnum = %d, hird = %d, devaddr = %d, rewake = %d\n",
++			     portnum, hird, devaddr, remwake);
++			/* Disable LPM interrupt */
++			gintmsk.d32 = 0;
++			gintmsk.b.lpmtranrcvd = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk,
++					 gintmsk.d32, 0);
++
++			if (dwc_otg_hcd_send_lpm
++			    (dwc_otg_hcd, devaddr, hird, remwake)) {
++				retval = -DWC_E_INVALID;
++				break;
++			}
++
++			time_usecs = 10 * (lpmcfg.b.retry_count + 1);
++			/* We will consider timeout if time_usecs microseconds pass,
++			 * and we don't receive LPM transaction status.
++			 * After receiving non-error responce(ACK/NYET/STALL) from device,
++			 *  core will set lpmtranrcvd bit.
++			 */
++			do {
++				gintsts.d32 =
++				    DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++				if (gintsts.b.lpmtranrcvd) {
++					break;
++				}
++				dwc_udelay(1);
++			} while (--time_usecs);
++			/* lpm_int bit will be cleared in LPM interrupt handler */
++
++			/* Now fill status
++			 * 0x00 - Success
++			 * 0x10 - NYET
++			 * 0x11 - Timeout
++			 */
++			if (!gintsts.b.lpmtranrcvd) {
++				buf[0] = 0x3;	/* Completion code is Timeout */
++				dwc_otg_hcd_free_hc_from_lpm(dwc_otg_hcd);
++			} else {
++				lpmcfg.d32 =
++				    DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++				if (lpmcfg.b.lpm_resp == 0x3) {
++					/* ACK responce from the device */
++					buf[0] = 0x00;	/* Success */
++				} else if (lpmcfg.b.lpm_resp == 0x2) {
++					/* NYET responce from the device */
++					buf[0] = 0x2;
++				} else {
++					/* Otherwise responce with Timeout */
++					buf[0] = 0x3;
++				}
++			}
++			DWC_PRINTF("Device responce to LPM trans is %x\n",
++				   lpmcfg.b.lpm_resp);
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, 0,
++					 gintmsk.d32);
++
++			break;
++		}
++#endif /* CONFIG_USB_DWC_OTG_LPM */
++	default:
++error:
++		retval = -DWC_E_INVALID;
++		DWC_WARN("DWC OTG HCD - "
++			 "Unknown hub control request type or invalid typeReq: %xh wIndex: %xh wValue: %xh\n",
++			 typeReq, wIndex, wValue);
++		break;
++	}
++
++	return retval;
++}
++
++#ifdef CONFIG_USB_DWC_OTG_LPM
++/** Returns index of host channel to perform LPM transaction. */
++int dwc_otg_hcd_get_hc_for_lpm_tran(dwc_otg_hcd_t * hcd, uint8_t devaddr)
++{
++	dwc_otg_core_if_t *core_if = hcd->core_if;
++	dwc_hc_t *hc;
++	hcchar_data_t hcchar;
++	gintmsk_data_t gintmsk = {.d32 = 0 };
++
++	if (DWC_CIRCLEQ_EMPTY(&hcd->free_hc_list)) {
++		DWC_PRINTF("No free channel to select for LPM transaction\n");
++		return -1;
++	}
++
++	hc = DWC_CIRCLEQ_FIRST(&hcd->free_hc_list);
++
++	/* Mask host channel interrupts. */
++	gintmsk.b.hcintr = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, gintmsk.d32, 0);
++
++	/* Fill fields that core needs for LPM transaction */
++	hcchar.b.devaddr = devaddr;
++	hcchar.b.epnum = 0;
++	hcchar.b.eptype = DWC_OTG_EP_TYPE_CONTROL;
++	hcchar.b.mps = 64;
++	hcchar.b.lspddev = (hc->speed == DWC_OTG_EP_SPEED_LOW);
++	hcchar.b.epdir = 0;	/* OUT */
++	DWC_WRITE_REG32(&core_if->host_if->hc_regs[hc->hc_num]->hcchar,
++			hcchar.d32);
++
++	/* Remove the host channel from the free list. */
++	DWC_CIRCLEQ_REMOVE_INIT(&hcd->free_hc_list, hc, hc_list_entry);
++
++	DWC_PRINTF("hcnum = %d devaddr = %d\n", hc->hc_num, devaddr);
++
++	return hc->hc_num;
++}
++
++/** Release hc after performing LPM transaction */
++void dwc_otg_hcd_free_hc_from_lpm(dwc_otg_hcd_t * hcd)
++{
++	dwc_hc_t *hc;
++	glpmcfg_data_t lpmcfg;
++	uint8_t hc_num;
++
++	lpmcfg.d32 = DWC_READ_REG32(&hcd->core_if->core_global_regs->glpmcfg);
++	hc_num = lpmcfg.b.lpm_chan_index;
++
++	hc = hcd->hc_ptr_array[hc_num];
++
++	DWC_PRINTF("Freeing channel %d after LPM\n", hc_num);
++	/* Return host channel to free list */
++	DWC_CIRCLEQ_INSERT_TAIL(&hcd->free_hc_list, hc, hc_list_entry);
++}
++
++int dwc_otg_hcd_send_lpm(dwc_otg_hcd_t * hcd, uint8_t devaddr, uint8_t hird,
++			 uint8_t bRemoteWake)
++{
++	glpmcfg_data_t lpmcfg;
++	pcgcctl_data_t pcgcctl = {.d32 = 0 };
++	int channel;
++
++	channel = dwc_otg_hcd_get_hc_for_lpm_tran(hcd, devaddr);
++	if (channel < 0) {
++		return channel;
++	}
++
++	pcgcctl.b.enbl_sleep_gating = 1;
++	DWC_MODIFY_REG32(hcd->core_if->pcgcctl, 0, pcgcctl.d32);
++
++	/* Read LPM config register */
++	lpmcfg.d32 = DWC_READ_REG32(&hcd->core_if->core_global_regs->glpmcfg);
++
++	/* Program LPM transaction fields */
++	lpmcfg.b.rem_wkup_en = bRemoteWake;
++	lpmcfg.b.hird = hird;
++	lpmcfg.b.hird_thres = 0x1c;
++	lpmcfg.b.lpm_chan_index = channel;
++	lpmcfg.b.en_utmi_sleep = 1;
++	/* Program LPM config register */
++	DWC_WRITE_REG32(&hcd->core_if->core_global_regs->glpmcfg, lpmcfg.d32);
++
++	/* Send LPM transaction */
++	lpmcfg.b.send_lpm = 1;
++	DWC_WRITE_REG32(&hcd->core_if->core_global_regs->glpmcfg, lpmcfg.d32);
++
++	return 0;
++}
++
++#endif /* CONFIG_USB_DWC_OTG_LPM */
++
++int dwc_otg_hcd_is_status_changed(dwc_otg_hcd_t * hcd, int port)
++{
++	int retval;
++
++	if (port != 1) {
++		return -DWC_E_INVALID;
++	}
++
++	retval = (hcd->flags.b.port_connect_status_change ||
++		  hcd->flags.b.port_reset_change ||
++		  hcd->flags.b.port_enable_change ||
++		  hcd->flags.b.port_suspend_change ||
++		  hcd->flags.b.port_over_current_change);
++#ifdef DEBUG
++	if (retval) {
++		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB STATUS DATA:"
++			    " Root port status changed\n");
++		DWC_DEBUGPL(DBG_HCDV, "  port_connect_status_change: %d\n",
++			    hcd->flags.b.port_connect_status_change);
++		DWC_DEBUGPL(DBG_HCDV, "  port_reset_change: %d\n",
++			    hcd->flags.b.port_reset_change);
++		DWC_DEBUGPL(DBG_HCDV, "  port_enable_change: %d\n",
++			    hcd->flags.b.port_enable_change);
++		DWC_DEBUGPL(DBG_HCDV, "  port_suspend_change: %d\n",
++			    hcd->flags.b.port_suspend_change);
++		DWC_DEBUGPL(DBG_HCDV, "  port_over_current_change: %d\n",
++			    hcd->flags.b.port_over_current_change);
++	}
++#endif
++	return retval;
++}
++
++int dwc_otg_hcd_get_frame_number(dwc_otg_hcd_t * dwc_otg_hcd)
++{
++	hfnum_data_t hfnum;
++	hfnum.d32 =
++	    DWC_READ_REG32(&dwc_otg_hcd->core_if->host_if->host_global_regs->
++			   hfnum);
++
++#ifdef DEBUG_SOF
++	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD GET FRAME NUMBER %d\n",
++		    hfnum.b.frnum);
++#endif
++	return hfnum.b.frnum;
++}
++
++int dwc_otg_hcd_start(dwc_otg_hcd_t * hcd,
++		      struct dwc_otg_hcd_function_ops *fops)
++{
++	int retval = 0;
++
++	hcd->fops = fops;
++	if (!dwc_otg_is_device_mode(hcd->core_if) &&
++		(!hcd->core_if->adp_enable || hcd->core_if->adp.adp_started)) {
++		dwc_otg_hcd_reinit(hcd);
++	} else {
++		retval = -DWC_E_NO_DEVICE;
++	}
++
++	return retval;
++}
++
++void *dwc_otg_hcd_get_priv_data(dwc_otg_hcd_t * hcd)
++{
++	return hcd->priv;
++}
++
++void dwc_otg_hcd_set_priv_data(dwc_otg_hcd_t * hcd, void *priv_data)
++{
++	hcd->priv = priv_data;
++}
++
++uint32_t dwc_otg_hcd_otg_port(dwc_otg_hcd_t * hcd)
++{
++	return hcd->otg_port;
++}
++
++uint32_t dwc_otg_hcd_is_b_host(dwc_otg_hcd_t * hcd)
++{
++	uint32_t is_b_host;
++	if (hcd->core_if->op_state == B_HOST) {
++		is_b_host = 1;
++	} else {
++		is_b_host = 0;
++	}
++
++	return is_b_host;
++}
++
++dwc_otg_hcd_urb_t *dwc_otg_hcd_urb_alloc(dwc_otg_hcd_t * hcd,
++					 int iso_desc_count, int atomic_alloc)
++{
++	dwc_otg_hcd_urb_t *dwc_otg_urb;
++	uint32_t size;
++
++	size =
++	    sizeof(*dwc_otg_urb) +
++	    iso_desc_count * sizeof(struct dwc_otg_hcd_iso_packet_desc);
++	if (atomic_alloc)
++		dwc_otg_urb = DWC_ALLOC_ATOMIC(size);
++	else
++		dwc_otg_urb = DWC_ALLOC(size);
++
++        if (dwc_otg_urb)
++		dwc_otg_urb->packet_count = iso_desc_count;
++        else {
++		DWC_ERROR("**** DWC OTG HCD URB alloc - "
++			"%salloc of %db failed\n",
++			atomic_alloc?"atomic ":"", size);
++	}
++	return dwc_otg_urb;
++}
++
++void dwc_otg_hcd_urb_set_pipeinfo(dwc_otg_hcd_urb_t * dwc_otg_urb,
++				  uint8_t dev_addr, uint8_t ep_num,
++				  uint8_t ep_type, uint8_t ep_dir, uint16_t mps)
++{
++	dwc_otg_hcd_fill_pipe(&dwc_otg_urb->pipe_info, dev_addr, ep_num,
++			      ep_type, ep_dir, mps);
++#if 0
++	DWC_PRINTF
++	    ("addr = %d, ep_num = %d, ep_dir = 0x%x, ep_type = 0x%x, mps = %d\n",
++	     dev_addr, ep_num, ep_dir, ep_type, mps);
++#endif
++}
++
++void dwc_otg_hcd_urb_set_params(dwc_otg_hcd_urb_t * dwc_otg_urb,
++				void *urb_handle, void *buf, dwc_dma_t dma,
++				uint32_t buflen, void *setup_packet,
++				dwc_dma_t setup_dma, uint32_t flags,
++				uint16_t interval)
++{
++	dwc_otg_urb->priv = urb_handle;
++	dwc_otg_urb->buf = buf;
++	dwc_otg_urb->dma = dma;
++	dwc_otg_urb->length = buflen;
++	dwc_otg_urb->setup_packet = setup_packet;
++	dwc_otg_urb->setup_dma = setup_dma;
++	dwc_otg_urb->flags = flags;
++	dwc_otg_urb->interval = interval;
++	dwc_otg_urb->status = -DWC_E_IN_PROGRESS;
++}
++
++uint32_t dwc_otg_hcd_urb_get_status(dwc_otg_hcd_urb_t * dwc_otg_urb)
++{
++	return dwc_otg_urb->status;
++}
++
++uint32_t dwc_otg_hcd_urb_get_actual_length(dwc_otg_hcd_urb_t * dwc_otg_urb)
++{
++	return dwc_otg_urb->actual_length;
++}
++
++uint32_t dwc_otg_hcd_urb_get_error_count(dwc_otg_hcd_urb_t * dwc_otg_urb)
++{
++	return dwc_otg_urb->error_count;
++}
++
++void dwc_otg_hcd_urb_set_iso_desc_params(dwc_otg_hcd_urb_t * dwc_otg_urb,
++					 int desc_num, uint32_t offset,
++					 uint32_t length)
++{
++	dwc_otg_urb->iso_descs[desc_num].offset = offset;
++	dwc_otg_urb->iso_descs[desc_num].length = length;
++}
++
++uint32_t dwc_otg_hcd_urb_get_iso_desc_status(dwc_otg_hcd_urb_t * dwc_otg_urb,
++					     int desc_num)
++{
++	return dwc_otg_urb->iso_descs[desc_num].status;
++}
++
++uint32_t dwc_otg_hcd_urb_get_iso_desc_actual_length(dwc_otg_hcd_urb_t *
++						    dwc_otg_urb, int desc_num)
++{
++	return dwc_otg_urb->iso_descs[desc_num].actual_length;
++}
++
++int dwc_otg_hcd_is_bandwidth_allocated(dwc_otg_hcd_t * hcd, void *ep_handle)
++{
++	int allocated = 0;
++	dwc_otg_qh_t *qh = (dwc_otg_qh_t *) ep_handle;
++
++	if (qh) {
++		if (!DWC_LIST_EMPTY(&qh->qh_list_entry)) {
++			allocated = 1;
++		}
++	}
++	return allocated;
++}
++
++int dwc_otg_hcd_is_bandwidth_freed(dwc_otg_hcd_t * hcd, void *ep_handle)
++{
++	dwc_otg_qh_t *qh = (dwc_otg_qh_t *) ep_handle;
++	int freed = 0;
++	DWC_ASSERT(qh, "qh is not allocated\n");
++
++	if (DWC_LIST_EMPTY(&qh->qh_list_entry)) {
++		freed = 1;
++	}
++
++	return freed;
++}
++
++uint8_t dwc_otg_hcd_get_ep_bandwidth(dwc_otg_hcd_t * hcd, void *ep_handle)
++{
++	dwc_otg_qh_t *qh = (dwc_otg_qh_t *) ep_handle;
++	DWC_ASSERT(qh, "qh is not allocated\n");
++	return qh->usecs;
++}
++
++void dwc_otg_hcd_dump_state(dwc_otg_hcd_t * hcd)
++{
++#ifdef DEBUG
++	int num_channels;
++	int i;
++	gnptxsts_data_t np_tx_status;
++	hptxsts_data_t p_tx_status;
++
++	num_channels = hcd->core_if->core_params->host_channels;
++	DWC_PRINTF("\n");
++	DWC_PRINTF
++	    ("************************************************************\n");
++	DWC_PRINTF("HCD State:\n");
++	DWC_PRINTF("  Num channels: %d\n", num_channels);
++	for (i = 0; i < num_channels; i++) {
++		dwc_hc_t *hc = hcd->hc_ptr_array[i];
++		DWC_PRINTF("  Channel %d:\n", i);
++		DWC_PRINTF("    dev_addr: %d, ep_num: %d, ep_is_in: %d\n",
++			   hc->dev_addr, hc->ep_num, hc->ep_is_in);
++		DWC_PRINTF("    speed: %d\n", hc->speed);
++		DWC_PRINTF("    ep_type: %d\n", hc->ep_type);
++		DWC_PRINTF("    max_packet: %d\n", hc->max_packet);
++		DWC_PRINTF("    data_pid_start: %d\n", hc->data_pid_start);
++		DWC_PRINTF("    multi_count: %d\n", hc->multi_count);
++		DWC_PRINTF("    xfer_started: %d\n", hc->xfer_started);
++		DWC_PRINTF("    xfer_buff: %p\n", hc->xfer_buff);
++		DWC_PRINTF("    xfer_len: %d\n", hc->xfer_len);
++		DWC_PRINTF("    xfer_count: %d\n", hc->xfer_count);
++		DWC_PRINTF("    halt_on_queue: %d\n", hc->halt_on_queue);
++		DWC_PRINTF("    halt_pending: %d\n", hc->halt_pending);
++		DWC_PRINTF("    halt_status: %d\n", hc->halt_status);
++		DWC_PRINTF("    do_split: %d\n", hc->do_split);
++		DWC_PRINTF("    complete_split: %d\n", hc->complete_split);
++		DWC_PRINTF("    hub_addr: %d\n", hc->hub_addr);
++		DWC_PRINTF("    port_addr: %d\n", hc->port_addr);
++		DWC_PRINTF("    xact_pos: %d\n", hc->xact_pos);
++		DWC_PRINTF("    requests: %d\n", hc->requests);
++		DWC_PRINTF("    qh: %p\n", hc->qh);
++		if (hc->xfer_started) {
++			hfnum_data_t hfnum;
++			hcchar_data_t hcchar;
++			hctsiz_data_t hctsiz;
++			hcint_data_t hcint;
++			hcintmsk_data_t hcintmsk;
++			hfnum.d32 =
++			    DWC_READ_REG32(&hcd->core_if->
++					   host_if->host_global_regs->hfnum);
++			hcchar.d32 =
++			    DWC_READ_REG32(&hcd->core_if->host_if->
++					   hc_regs[i]->hcchar);
++			hctsiz.d32 =
++			    DWC_READ_REG32(&hcd->core_if->host_if->
++					   hc_regs[i]->hctsiz);
++			hcint.d32 =
++			    DWC_READ_REG32(&hcd->core_if->host_if->
++					   hc_regs[i]->hcint);
++			hcintmsk.d32 =
++			    DWC_READ_REG32(&hcd->core_if->host_if->
++					   hc_regs[i]->hcintmsk);
++			DWC_PRINTF("    hfnum: 0x%08x\n", hfnum.d32);
++			DWC_PRINTF("    hcchar: 0x%08x\n", hcchar.d32);
++			DWC_PRINTF("    hctsiz: 0x%08x\n", hctsiz.d32);
++			DWC_PRINTF("    hcint: 0x%08x\n", hcint.d32);
++			DWC_PRINTF("    hcintmsk: 0x%08x\n", hcintmsk.d32);
++		}
++		if (hc->xfer_started && hc->qh) {
++			dwc_otg_qtd_t *qtd;
++			dwc_otg_hcd_urb_t *urb;
++
++			DWC_CIRCLEQ_FOREACH(qtd, &hc->qh->qtd_list, qtd_list_entry) {
++				if (!qtd->in_process)
++					break;
++
++				urb = qtd->urb;
++			DWC_PRINTF("    URB Info:\n");
++			DWC_PRINTF("      qtd: %p, urb: %p\n", qtd, urb);
++			if (urb) {
++				DWC_PRINTF("      Dev: %d, EP: %d %s\n",
++					   dwc_otg_hcd_get_dev_addr(&urb->
++								    pipe_info),
++					   dwc_otg_hcd_get_ep_num(&urb->
++								  pipe_info),
++					   dwc_otg_hcd_is_pipe_in(&urb->
++								  pipe_info) ?
++					   "IN" : "OUT");
++				DWC_PRINTF("      Max packet size: %d\n",
++					   dwc_otg_hcd_get_mps(&urb->
++							       pipe_info));
++				DWC_PRINTF("      transfer_buffer: %p\n",
++					   urb->buf);
++				DWC_PRINTF("      transfer_dma: %p\n",
++					   (void *)urb->dma);
++				DWC_PRINTF("      transfer_buffer_length: %d\n",
++					   urb->length);
++					DWC_PRINTF("      actual_length: %d\n",
++						   urb->actual_length);
++				}
++			}
++		}
++	}
++	DWC_PRINTF("  non_periodic_channels: %d\n", hcd->non_periodic_channels);
++	DWC_PRINTF("  periodic_channels: %d\n", hcd->periodic_channels);
++	DWC_PRINTF("  periodic_usecs: %d\n", hcd->periodic_usecs);
++	np_tx_status.d32 =
++	    DWC_READ_REG32(&hcd->core_if->core_global_regs->gnptxsts);
++	DWC_PRINTF("  NP Tx Req Queue Space Avail: %d\n",
++		   np_tx_status.b.nptxqspcavail);
++	DWC_PRINTF("  NP Tx FIFO Space Avail: %d\n",
++		   np_tx_status.b.nptxfspcavail);
++	p_tx_status.d32 =
++	    DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hptxsts);
++	DWC_PRINTF("  P Tx Req Queue Space Avail: %d\n",
++		   p_tx_status.b.ptxqspcavail);
++	DWC_PRINTF("  P Tx FIFO Space Avail: %d\n", p_tx_status.b.ptxfspcavail);
++	dwc_otg_hcd_dump_frrem(hcd);
++	dwc_otg_dump_global_registers(hcd->core_if);
++	dwc_otg_dump_host_registers(hcd->core_if);
++	DWC_PRINTF
++	    ("************************************************************\n");
++	DWC_PRINTF("\n");
++#endif
++}
++
++#ifdef DEBUG
++void dwc_print_setup_data(uint8_t * setup)
++{
++	int i;
++	if (CHK_DEBUG_LEVEL(DBG_HCD)) {
++		DWC_PRINTF("Setup Data = MSB ");
++		for (i = 7; i >= 0; i--)
++			DWC_PRINTF("%02x ", setup[i]);
++		DWC_PRINTF("\n");
++		DWC_PRINTF("  bmRequestType Tranfer = %s\n",
++			   (setup[0] & 0x80) ? "Device-to-Host" :
++			   "Host-to-Device");
++		DWC_PRINTF("  bmRequestType Type = ");
++		switch ((setup[0] & 0x60) >> 5) {
++		case 0:
++			DWC_PRINTF("Standard\n");
++			break;
++		case 1:
++			DWC_PRINTF("Class\n");
++			break;
++		case 2:
++			DWC_PRINTF("Vendor\n");
++			break;
++		case 3:
++			DWC_PRINTF("Reserved\n");
++			break;
++		}
++		DWC_PRINTF("  bmRequestType Recipient = ");
++		switch (setup[0] & 0x1f) {
++		case 0:
++			DWC_PRINTF("Device\n");
++			break;
++		case 1:
++			DWC_PRINTF("Interface\n");
++			break;
++		case 2:
++			DWC_PRINTF("Endpoint\n");
++			break;
++		case 3:
++			DWC_PRINTF("Other\n");
++			break;
++		default:
++			DWC_PRINTF("Reserved\n");
++			break;
++		}
++		DWC_PRINTF("  bRequest = 0x%0x\n", setup[1]);
++		DWC_PRINTF("  wValue = 0x%0x\n", *((uint16_t *) & setup[2]));
++		DWC_PRINTF("  wIndex = 0x%0x\n", *((uint16_t *) & setup[4]));
++		DWC_PRINTF("  wLength = 0x%0x\n\n", *((uint16_t *) & setup[6]));
++	}
++}
++#endif
++
++void dwc_otg_hcd_dump_frrem(dwc_otg_hcd_t * hcd)
++{
++#if 0
++	DWC_PRINTF("Frame remaining at SOF:\n");
++	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
++		   hcd->frrem_samples, hcd->frrem_accum,
++		   (hcd->frrem_samples > 0) ?
++		   hcd->frrem_accum / hcd->frrem_samples : 0);
++
++	DWC_PRINTF("\n");
++	DWC_PRINTF("Frame remaining at start_transfer (uframe 7):\n");
++	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
++		   hcd->core_if->hfnum_7_samples,
++		   hcd->core_if->hfnum_7_frrem_accum,
++		   (hcd->core_if->hfnum_7_samples >
++		    0) ? hcd->core_if->hfnum_7_frrem_accum /
++		   hcd->core_if->hfnum_7_samples : 0);
++	DWC_PRINTF("Frame remaining at start_transfer (uframe 0):\n");
++	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
++		   hcd->core_if->hfnum_0_samples,
++		   hcd->core_if->hfnum_0_frrem_accum,
++		   (hcd->core_if->hfnum_0_samples >
++		    0) ? hcd->core_if->hfnum_0_frrem_accum /
++		   hcd->core_if->hfnum_0_samples : 0);
++	DWC_PRINTF("Frame remaining at start_transfer (uframe 1-6):\n");
++	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
++		   hcd->core_if->hfnum_other_samples,
++		   hcd->core_if->hfnum_other_frrem_accum,
++		   (hcd->core_if->hfnum_other_samples >
++		    0) ? hcd->core_if->hfnum_other_frrem_accum /
++		   hcd->core_if->hfnum_other_samples : 0);
++
++	DWC_PRINTF("\n");
++	DWC_PRINTF("Frame remaining at sample point A (uframe 7):\n");
++	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
++		   hcd->hfnum_7_samples_a, hcd->hfnum_7_frrem_accum_a,
++		   (hcd->hfnum_7_samples_a > 0) ?
++		   hcd->hfnum_7_frrem_accum_a / hcd->hfnum_7_samples_a : 0);
++	DWC_PRINTF("Frame remaining at sample point A (uframe 0):\n");
++	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
++		   hcd->hfnum_0_samples_a, hcd->hfnum_0_frrem_accum_a,
++		   (hcd->hfnum_0_samples_a > 0) ?
++		   hcd->hfnum_0_frrem_accum_a / hcd->hfnum_0_samples_a : 0);
++	DWC_PRINTF("Frame remaining at sample point A (uframe 1-6):\n");
++	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
++		   hcd->hfnum_other_samples_a, hcd->hfnum_other_frrem_accum_a,
++		   (hcd->hfnum_other_samples_a > 0) ?
++		   hcd->hfnum_other_frrem_accum_a /
++		   hcd->hfnum_other_samples_a : 0);
++
++	DWC_PRINTF("\n");
++	DWC_PRINTF("Frame remaining at sample point B (uframe 7):\n");
++	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
++		   hcd->hfnum_7_samples_b, hcd->hfnum_7_frrem_accum_b,
++		   (hcd->hfnum_7_samples_b > 0) ?
++		   hcd->hfnum_7_frrem_accum_b / hcd->hfnum_7_samples_b : 0);
++	DWC_PRINTF("Frame remaining at sample point B (uframe 0):\n");
++	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
++		   hcd->hfnum_0_samples_b, hcd->hfnum_0_frrem_accum_b,
++		   (hcd->hfnum_0_samples_b > 0) ?
++		   hcd->hfnum_0_frrem_accum_b / hcd->hfnum_0_samples_b : 0);
++	DWC_PRINTF("Frame remaining at sample point B (uframe 1-6):\n");
++	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
++		   hcd->hfnum_other_samples_b, hcd->hfnum_other_frrem_accum_b,
++		   (hcd->hfnum_other_samples_b > 0) ?
++		   hcd->hfnum_other_frrem_accum_b /
++		   hcd->hfnum_other_samples_b : 0);
++#endif
++}
++
++#endif /* DWC_DEVICE_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd.h
+@@ -0,0 +1,870 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd.h $
++ * $Revision: #58 $
++ * $Date: 2011/09/15 $
++ * $Change: 1846647 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_DEVICE_ONLY
++#ifndef __DWC_HCD_H__
++#define __DWC_HCD_H__
++
++#include "dwc_otg_os_dep.h"
++#include "usb.h"
++#include "dwc_otg_hcd_if.h"
++#include "dwc_otg_core_if.h"
++#include "dwc_list.h"
++#include "dwc_otg_cil.h"
++#include "dwc_otg_fiq_fsm.h"
++#include "dwc_otg_driver.h"
++
++
++/**
++ * @file
++ *
++ * This file contains the structures, constants, and interfaces for
++ * the Host Contoller Driver (HCD).
++ *
++ * The Host Controller Driver (HCD) is responsible for translating requests
++ * from the USB Driver into the appropriate actions on the DWC_otg controller.
++ * It isolates the USBD from the specifics of the controller by providing an
++ * API to the USBD.
++ */
++
++struct dwc_otg_hcd_pipe_info {
++	uint8_t dev_addr;
++	uint8_t ep_num;
++	uint8_t pipe_type;
++	uint8_t pipe_dir;
++	uint16_t mps;
++};
++
++struct dwc_otg_hcd_iso_packet_desc {
++	uint32_t offset;
++	uint32_t length;
++	uint32_t actual_length;
++	uint32_t status;
++};
++
++struct dwc_otg_qtd;
++
++struct dwc_otg_hcd_urb {
++	void *priv;
++	struct dwc_otg_qtd *qtd;
++	void *buf;
++	dwc_dma_t dma;
++	void *setup_packet;
++	dwc_dma_t setup_dma;
++	uint32_t length;
++	uint32_t actual_length;
++	uint32_t status;
++	uint32_t error_count;
++	uint32_t packet_count;
++	uint32_t flags;
++	uint16_t interval;
++	struct dwc_otg_hcd_pipe_info pipe_info;
++	struct dwc_otg_hcd_iso_packet_desc iso_descs[0];
++};
++
++static inline uint8_t dwc_otg_hcd_get_ep_num(struct dwc_otg_hcd_pipe_info *pipe)
++{
++	return pipe->ep_num;
++}
++
++static inline uint8_t dwc_otg_hcd_get_pipe_type(struct dwc_otg_hcd_pipe_info
++						*pipe)
++{
++	return pipe->pipe_type;
++}
++
++static inline uint16_t dwc_otg_hcd_get_mps(struct dwc_otg_hcd_pipe_info *pipe)
++{
++	return pipe->mps;
++}
++
++static inline uint8_t dwc_otg_hcd_get_dev_addr(struct dwc_otg_hcd_pipe_info
++					       *pipe)
++{
++	return pipe->dev_addr;
++}
++
++static inline uint8_t dwc_otg_hcd_is_pipe_isoc(struct dwc_otg_hcd_pipe_info
++					       *pipe)
++{
++	return (pipe->pipe_type == UE_ISOCHRONOUS);
++}
++
++static inline uint8_t dwc_otg_hcd_is_pipe_int(struct dwc_otg_hcd_pipe_info
++					      *pipe)
++{
++	return (pipe->pipe_type == UE_INTERRUPT);
++}
++
++static inline uint8_t dwc_otg_hcd_is_pipe_bulk(struct dwc_otg_hcd_pipe_info
++					       *pipe)
++{
++	return (pipe->pipe_type == UE_BULK);
++}
++
++static inline uint8_t dwc_otg_hcd_is_pipe_control(struct dwc_otg_hcd_pipe_info
++						  *pipe)
++{
++	return (pipe->pipe_type == UE_CONTROL);
++}
++
++static inline uint8_t dwc_otg_hcd_is_pipe_in(struct dwc_otg_hcd_pipe_info *pipe)
++{
++	return (pipe->pipe_dir == UE_DIR_IN);
++}
++
++static inline uint8_t dwc_otg_hcd_is_pipe_out(struct dwc_otg_hcd_pipe_info
++					      *pipe)
++{
++	return (!dwc_otg_hcd_is_pipe_in(pipe));
++}
++
++static inline void dwc_otg_hcd_fill_pipe(struct dwc_otg_hcd_pipe_info *pipe,
++					 uint8_t devaddr, uint8_t ep_num,
++					 uint8_t pipe_type, uint8_t pipe_dir,
++					 uint16_t mps)
++{
++	pipe->dev_addr = devaddr;
++	pipe->ep_num = ep_num;
++	pipe->pipe_type = pipe_type;
++	pipe->pipe_dir = pipe_dir;
++	pipe->mps = mps;
++}
++
++/**
++ * Phases for control transfers.
++ */
++typedef enum dwc_otg_control_phase {
++	DWC_OTG_CONTROL_SETUP,
++	DWC_OTG_CONTROL_DATA,
++	DWC_OTG_CONTROL_STATUS
++} dwc_otg_control_phase_e;
++
++/** Transaction types. */
++typedef enum dwc_otg_transaction_type {
++	DWC_OTG_TRANSACTION_NONE          = 0,
++	DWC_OTG_TRANSACTION_PERIODIC      = 1,
++	DWC_OTG_TRANSACTION_NON_PERIODIC  = 2,
++	DWC_OTG_TRANSACTION_ALL           = DWC_OTG_TRANSACTION_PERIODIC + DWC_OTG_TRANSACTION_NON_PERIODIC
++} dwc_otg_transaction_type_e;
++
++struct dwc_otg_qh;
++
++/**
++ * A Queue Transfer Descriptor (QTD) holds the state of a bulk, control,
++ * interrupt, or isochronous transfer. A single QTD is created for each URB
++ * (of one of these types) submitted to the HCD. The transfer associated with
++ * a QTD may require one or multiple transactions.
++ *
++ * A QTD is linked to a Queue Head, which is entered in either the
++ * non-periodic or periodic schedule for execution. When a QTD is chosen for
++ * execution, some or all of its transactions may be executed. After
++ * execution, the state of the QTD is updated. The QTD may be retired if all
++ * its transactions are complete or if an error occurred. Otherwise, it
++ * remains in the schedule so more transactions can be executed later.
++ */
++typedef struct dwc_otg_qtd {
++	/**
++	 * Determines the PID of the next data packet for the data phase of
++	 * control transfers. Ignored for other transfer types.<br>
++	 * One of the following values:
++	 *	- DWC_OTG_HC_PID_DATA0
++	 *	- DWC_OTG_HC_PID_DATA1
++	 */
++	uint8_t data_toggle;
++
++	/** Current phase for control transfers (Setup, Data, or Status). */
++	dwc_otg_control_phase_e control_phase;
++
++	/** Keep track of the current split type
++	 * for FS/LS endpoints on a HS Hub */
++	uint8_t complete_split;
++
++	/** How many bytes transferred during SSPLIT OUT */
++	uint32_t ssplit_out_xfer_count;
++
++	/**
++	 * Holds the number of bus errors that have occurred for a transaction
++	 * within this transfer.
++	 */
++	uint8_t error_count;
++
++	/**
++	 * Index of the next frame descriptor for an isochronous transfer. A
++	 * frame descriptor describes the buffer position and length of the
++	 * data to be transferred in the next scheduled (micro)frame of an
++	 * isochronous transfer. It also holds status for that transaction.
++	 * The frame index starts at 0.
++	 */
++	uint16_t isoc_frame_index;
++
++	/** Position of the ISOC split on full/low speed */
++	uint8_t isoc_split_pos;
++
++	/** Position of the ISOC split in the buffer for the current frame */
++	uint16_t isoc_split_offset;
++
++	/** URB for this transfer */
++	struct dwc_otg_hcd_urb *urb;
++
++	struct dwc_otg_qh *qh;
++
++	/** This list of QTDs */
++	 DWC_CIRCLEQ_ENTRY(dwc_otg_qtd) qtd_list_entry;
++
++	/** Indicates if this QTD is currently processed by HW. */
++	uint8_t in_process;
++
++	/** Number of DMA descriptors for this QTD */
++	uint8_t n_desc;
++
++	/**
++	 * Last activated frame(packet) index.
++	 * Used in Descriptor DMA mode only.
++	 */
++	uint16_t isoc_frame_index_last;
++
++} dwc_otg_qtd_t;
++
++DWC_CIRCLEQ_HEAD(dwc_otg_qtd_list, dwc_otg_qtd);
++
++/**
++ * A Queue Head (QH) holds the static characteristics of an endpoint and
++ * maintains a list of transfers (QTDs) for that endpoint. A QH structure may
++ * be entered in either the non-periodic or periodic schedule.
++ */
++typedef struct dwc_otg_qh {
++	/**
++	 * Endpoint type.
++	 * One of the following values:
++	 *	- UE_CONTROL
++	 *	- UE_BULK
++	 *	- UE_INTERRUPT
++	 *	- UE_ISOCHRONOUS
++	 */
++	uint8_t ep_type;
++	uint8_t ep_is_in;
++
++	/** wMaxPacketSize Field of Endpoint Descriptor. */
++	uint16_t maxp;
++
++	/**
++	 * Device speed.
++	 * One of the following values:
++	 *	- DWC_OTG_EP_SPEED_LOW
++	 *	- DWC_OTG_EP_SPEED_FULL
++	 *	- DWC_OTG_EP_SPEED_HIGH
++	 */
++	uint8_t dev_speed;
++
++	/**
++	 * Determines the PID of the next data packet for non-control
++	 * transfers. Ignored for control transfers.<br>
++	 * One of the following values:
++	 *	- DWC_OTG_HC_PID_DATA0
++	 *	- DWC_OTG_HC_PID_DATA1
++	 */
++	uint8_t data_toggle;
++
++	/** Ping state if 1. */
++	uint8_t ping_state;
++
++	/**
++	 * List of QTDs for this QH.
++	 */
++	struct dwc_otg_qtd_list qtd_list;
++
++	/** Host channel currently processing transfers for this QH. */
++	struct dwc_hc *channel;
++
++	/** Full/low speed endpoint on high-speed hub requires split. */
++	uint8_t do_split;
++
++	/** @name Periodic schedule information */
++	/** @{ */
++
++	/** Bandwidth in microseconds per (micro)frame. */
++	uint16_t usecs;
++
++	/** Interval between transfers in (micro)frames. */
++	uint16_t interval;
++
++	/**
++	 * (micro)frame to initialize a periodic transfer. The transfer
++	 * executes in the following (micro)frame.
++	 */
++	uint16_t sched_frame;
++
++	/*
++	** Frame a NAK was received on this queue head, used to minimise NAK retransmission
++	*/
++	uint16_t nak_frame;
++
++	/** (micro)frame at which last start split was initialized. */
++	uint16_t start_split_frame;
++
++	/** @} */
++
++	/**
++	 * Used instead of original buffer if
++	 * it(physical address) is not dword-aligned.
++	 */
++	uint8_t *dw_align_buf;
++	dwc_dma_t dw_align_buf_dma;
++
++	/** Entry for QH in either the periodic or non-periodic schedule. */
++	dwc_list_link_t qh_list_entry;
++
++	/** @name Descriptor DMA support */
++	/** @{ */
++
++	/** Descriptor List. */
++	dwc_otg_host_dma_desc_t *desc_list;
++
++	/** Descriptor List physical address. */
++	dwc_dma_t desc_list_dma;
++
++	/**
++	 * Xfer Bytes array.
++	 * Each element corresponds to a descriptor and indicates
++	 * original XferSize size value for the descriptor.
++	 */
++	uint32_t *n_bytes;
++
++	/** Actual number of transfer descriptors in a list. */
++	uint16_t ntd;
++
++	/** First activated isochronous transfer descriptor index. */
++	uint8_t td_first;
++	/** Last activated isochronous transfer descriptor index. */
++	uint8_t td_last;
++
++	/** @} */
++
++
++	uint16_t speed;
++	uint16_t frame_usecs[8];
++
++	uint32_t skip_count;
++} dwc_otg_qh_t;
++
++DWC_CIRCLEQ_HEAD(hc_list, dwc_hc);
++
++typedef struct urb_tq_entry {
++	struct urb *urb;
++	DWC_TAILQ_ENTRY(urb_tq_entry) urb_tq_entries;
++} urb_tq_entry_t;
++
++DWC_TAILQ_HEAD(urb_list, urb_tq_entry);
++
++/**
++ * This structure holds the state of the HCD, including the non-periodic and
++ * periodic schedules.
++ */
++struct dwc_otg_hcd {
++	/** The DWC otg device pointer */
++	struct dwc_otg_device *otg_dev;
++	/** DWC OTG Core Interface Layer */
++	dwc_otg_core_if_t *core_if;
++
++	/** Function HCD driver callbacks */
++	struct dwc_otg_hcd_function_ops *fops;
++
++	/** Internal DWC HCD Flags */
++	volatile union dwc_otg_hcd_internal_flags {
++		uint32_t d32;
++		struct {
++			unsigned port_connect_status_change:1;
++			unsigned port_connect_status:1;
++			unsigned port_reset_change:1;
++			unsigned port_enable_change:1;
++			unsigned port_suspend_change:1;
++			unsigned port_over_current_change:1;
++			unsigned port_l1_change:1;
++			unsigned port_speed:2;
++			unsigned reserved:24;
++		} b;
++	} flags;
++
++	/**
++	 * Inactive items in the non-periodic schedule. This is a list of
++	 * Queue Heads. Transfers associated with these Queue Heads are not
++	 * currently assigned to a host channel.
++	 */
++	dwc_list_link_t non_periodic_sched_inactive;
++
++	/**
++	 * Active items in the non-periodic schedule. This is a list of
++	 * Queue Heads. Transfers associated with these Queue Heads are
++	 * currently assigned to a host channel.
++	 */
++	dwc_list_link_t non_periodic_sched_active;
++
++	/**
++	 * Pointer to the next Queue Head to process in the active
++	 * non-periodic schedule.
++	 */
++	dwc_list_link_t *non_periodic_qh_ptr;
++
++	/**
++	 * Inactive items in the periodic schedule. This is a list of QHs for
++	 * periodic transfers that are _not_ scheduled for the next frame.
++	 * Each QH in the list has an interval counter that determines when it
++	 * needs to be scheduled for execution. This scheduling mechanism
++	 * allows only a simple calculation for periodic bandwidth used (i.e.
++	 * must assume that all periodic transfers may need to execute in the
++	 * same frame). However, it greatly simplifies scheduling and should
++	 * be sufficient for the vast majority of OTG hosts, which need to
++	 * connect to a small number of peripherals at one time.
++	 *
++	 * Items move from this list to periodic_sched_ready when the QH
++	 * interval counter is 0 at SOF.
++	 */
++	dwc_list_link_t periodic_sched_inactive;
++
++	/**
++	 * List of periodic QHs that are ready for execution in the next
++	 * frame, but have not yet been assigned to host channels.
++	 *
++	 * Items move from this list to periodic_sched_assigned as host
++	 * channels become available during the current frame.
++	 */
++	dwc_list_link_t periodic_sched_ready;
++
++	/**
++	 * List of periodic QHs to be executed in the next frame that are
++	 * assigned to host channels.
++	 *
++	 * Items move from this list to periodic_sched_queued as the
++	 * transactions for the QH are queued to the DWC_otg controller.
++	 */
++	dwc_list_link_t periodic_sched_assigned;
++
++	/**
++	 * List of periodic QHs that have been queued for execution.
++	 *
++	 * Items move from this list to either periodic_sched_inactive or
++	 * periodic_sched_ready when the channel associated with the transfer
++	 * is released. If the interval for the QH is 1, the item moves to
++	 * periodic_sched_ready because it must be rescheduled for the next
++	 * frame. Otherwise, the item moves to periodic_sched_inactive.
++	 */
++	dwc_list_link_t periodic_sched_queued;
++
++	/**
++	 * Total bandwidth claimed so far for periodic transfers. This value
++	 * is in microseconds per (micro)frame. The assumption is that all
++	 * periodic transfers may occur in the same (micro)frame.
++	 */
++	uint16_t periodic_usecs;
++
++	/**
++	 * Total bandwidth claimed so far for all periodic transfers
++	 * in a frame.
++	 * This will include a mixture of HS and FS transfers.
++	 * Units are microseconds per (micro)frame.
++	 * We have a budget per frame and have to schedule
++	 * transactions accordingly.
++	 * Watch out for the fact that things are actually scheduled for the
++	 * "next frame".
++	 */
++	uint16_t                frame_usecs[8];
++
++
++	/**
++	 * Frame number read from the core at SOF. The value ranges from 0 to
++	 * DWC_HFNUM_MAX_FRNUM.
++	 */
++	uint16_t frame_number;
++
++	/**
++	 * Count of periodic QHs, if using several eps. For SOF enable/disable.
++	 */
++	uint16_t periodic_qh_count;
++
++	/**
++	 * Free host channels in the controller. This is a list of
++	 * dwc_hc_t items.
++	 */
++	struct hc_list free_hc_list;
++	/**
++	 * Number of host channels assigned to periodic transfers. Currently
++	 * assuming that there is a dedicated host channel for each periodic
++	 * transaction and at least one host channel available for
++	 * non-periodic transactions.
++	 */
++	int periodic_channels; /* microframe_schedule==0 */
++
++	/**
++	 * Number of host channels assigned to non-periodic transfers.
++	 */
++	int non_periodic_channels; /* microframe_schedule==0 */
++
++	/**
++	 * Number of host channels assigned to non-periodic transfers.
++	 */
++	int available_host_channels;
++
++	/**
++	 * Array of pointers to the host channel descriptors. Allows accessing
++	 * a host channel descriptor given the host channel number. This is
++	 * useful in interrupt handlers.
++	 */
++	struct dwc_hc *hc_ptr_array[MAX_EPS_CHANNELS];
++
++	/**
++	 * Buffer to use for any data received during the status phase of a
++	 * control transfer. Normally no data is transferred during the status
++	 * phase. This buffer is used as a bit bucket.
++	 */
++	uint8_t *status_buf;
++
++	/**
++	 * DMA address for status_buf.
++	 */
++	dma_addr_t status_buf_dma;
++#define DWC_OTG_HCD_STATUS_BUF_SIZE 64
++
++	/**
++	 * Connection timer. An OTG host must display a message if the device
++	 * does not connect. Started when the VBus power is turned on via
++	 * sysfs attribute "buspower".
++	 */
++	dwc_timer_t *conn_timer;
++
++	/* Tasket to do a reset */
++	dwc_tasklet_t *reset_tasklet;
++
++	dwc_tasklet_t *completion_tasklet;
++	struct urb_list completed_urb_list;
++
++	/*  */
++	dwc_spinlock_t *lock;
++	/**
++	 * Private data that could be used by OS wrapper.
++	 */
++	void *priv;
++
++	uint8_t otg_port;
++
++	/** Frame List */
++	uint32_t *frame_list;
++
++	/** Hub - Port assignment */
++	int hub_port[128];
++#ifdef FIQ_DEBUG
++	int hub_port_alloc[2048];
++#endif
++
++	/** Frame List DMA address */
++	dma_addr_t frame_list_dma;
++
++	struct fiq_stack *fiq_stack;
++	struct fiq_state *fiq_state;
++
++	/** Virtual address for split transaction DMA bounce buffers */
++	struct fiq_dma_blob *fiq_dmab;
++
++#ifdef DEBUG
++	uint32_t frrem_samples;
++	uint64_t frrem_accum;
++
++	uint32_t hfnum_7_samples_a;
++	uint64_t hfnum_7_frrem_accum_a;
++	uint32_t hfnum_0_samples_a;
++	uint64_t hfnum_0_frrem_accum_a;
++	uint32_t hfnum_other_samples_a;
++	uint64_t hfnum_other_frrem_accum_a;
++
++	uint32_t hfnum_7_samples_b;
++	uint64_t hfnum_7_frrem_accum_b;
++	uint32_t hfnum_0_samples_b;
++	uint64_t hfnum_0_frrem_accum_b;
++	uint32_t hfnum_other_samples_b;
++	uint64_t hfnum_other_frrem_accum_b;
++#endif
++};
++
++static inline struct device *dwc_otg_hcd_to_dev(struct dwc_otg_hcd *hcd)
++{
++	return &hcd->otg_dev->os_dep.platformdev->dev;
++}
++
++/** @name Transaction Execution Functions */
++/** @{ */
++extern dwc_otg_transaction_type_e dwc_otg_hcd_select_transactions(dwc_otg_hcd_t
++								  * hcd);
++extern void dwc_otg_hcd_queue_transactions(dwc_otg_hcd_t * hcd,
++					   dwc_otg_transaction_type_e tr_type);
++
++int dwc_otg_hcd_allocate_port(dwc_otg_hcd_t * hcd, dwc_otg_qh_t *qh);
++void dwc_otg_hcd_release_port(dwc_otg_hcd_t * dwc_otg_hcd, dwc_otg_qh_t *qh);
++
++extern int fiq_fsm_queue_transaction(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh);
++extern int fiq_fsm_transaction_suitable(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh);
++extern void dwc_otg_cleanup_fiq_channel(dwc_otg_hcd_t *hcd, uint32_t num);
++
++/** @} */
++
++/** @name Interrupt Handler Functions */
++/** @{ */
++extern int32_t dwc_otg_hcd_handle_intr(dwc_otg_hcd_t * dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_sof_intr(dwc_otg_hcd_t * dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_rx_status_q_level_intr(dwc_otg_hcd_t *
++							 dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_np_tx_fifo_empty_intr(dwc_otg_hcd_t *
++							dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_perio_tx_fifo_empty_intr(dwc_otg_hcd_t *
++							   dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_incomplete_periodic_intr(dwc_otg_hcd_t *
++							   dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_port_intr(dwc_otg_hcd_t * dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_conn_id_status_change_intr(dwc_otg_hcd_t *
++							     dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_disconnect_intr(dwc_otg_hcd_t * dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_hc_intr(dwc_otg_hcd_t * dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_hc_n_intr(dwc_otg_hcd_t * dwc_otg_hcd,
++					    uint32_t num);
++extern int32_t dwc_otg_hcd_handle_session_req_intr(dwc_otg_hcd_t * dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_wakeup_detected_intr(dwc_otg_hcd_t *
++						       dwc_otg_hcd);
++/** @} */
++
++/** @name Schedule Queue Functions */
++/** @{ */
++
++/* Implemented in dwc_otg_hcd_queue.c */
++extern dwc_otg_qh_t *dwc_otg_hcd_qh_create(dwc_otg_hcd_t * hcd,
++					   dwc_otg_hcd_urb_t * urb, int atomic_alloc);
++extern void dwc_otg_hcd_qh_free(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
++extern int dwc_otg_hcd_qh_add(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
++extern void dwc_otg_hcd_qh_remove(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
++extern void dwc_otg_hcd_qh_deactivate(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh,
++				      int sched_csplit);
++
++/** Remove and free a QH */
++static inline void dwc_otg_hcd_qh_remove_and_free(dwc_otg_hcd_t * hcd,
++						  dwc_otg_qh_t * qh)
++{
++	dwc_irqflags_t flags;
++	DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
++	dwc_otg_hcd_qh_remove(hcd, qh);
++	DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
++	dwc_otg_hcd_qh_free(hcd, qh);
++}
++
++/** Allocates memory for a QH structure.
++ * @return Returns the memory allocate or NULL on error. */
++static inline dwc_otg_qh_t *dwc_otg_hcd_qh_alloc(int atomic_alloc)
++{
++	if (atomic_alloc)
++		return (dwc_otg_qh_t *) DWC_ALLOC_ATOMIC(sizeof(dwc_otg_qh_t));
++	else
++		return (dwc_otg_qh_t *) DWC_ALLOC(sizeof(dwc_otg_qh_t));
++}
++
++extern dwc_otg_qtd_t *dwc_otg_hcd_qtd_create(dwc_otg_hcd_urb_t * urb,
++					     int atomic_alloc);
++extern void dwc_otg_hcd_qtd_init(dwc_otg_qtd_t * qtd, dwc_otg_hcd_urb_t * urb);
++extern int dwc_otg_hcd_qtd_add(dwc_otg_qtd_t * qtd, dwc_otg_hcd_t * dwc_otg_hcd,
++			       dwc_otg_qh_t ** qh, int atomic_alloc);
++
++/** Allocates memory for a QTD structure.
++ * @return Returns the memory allocate or NULL on error. */
++static inline dwc_otg_qtd_t *dwc_otg_hcd_qtd_alloc(int atomic_alloc)
++{
++	if (atomic_alloc)
++		return (dwc_otg_qtd_t *) DWC_ALLOC_ATOMIC(sizeof(dwc_otg_qtd_t));
++	else
++		return (dwc_otg_qtd_t *) DWC_ALLOC(sizeof(dwc_otg_qtd_t));
++}
++
++/** Frees the memory for a QTD structure.  QTD should already be removed from
++ * list.
++ * @param qtd QTD to free.*/
++static inline void dwc_otg_hcd_qtd_free(dwc_otg_qtd_t * qtd)
++{
++	DWC_FREE(qtd);
++}
++
++/** Removes a QTD from list.
++ * @param hcd HCD instance.
++ * @param qtd QTD to remove from list.
++ * @param qh QTD belongs to.
++ */
++static inline void dwc_otg_hcd_qtd_remove(dwc_otg_hcd_t * hcd,
++					  dwc_otg_qtd_t * qtd,
++					  dwc_otg_qh_t * qh)
++{
++	DWC_CIRCLEQ_REMOVE(&qh->qtd_list, qtd, qtd_list_entry);
++}
++
++/** Remove and free a QTD
++  * Need to disable IRQ and hold hcd lock while calling this function out of
++  * interrupt servicing chain */
++static inline void dwc_otg_hcd_qtd_remove_and_free(dwc_otg_hcd_t * hcd,
++						   dwc_otg_qtd_t * qtd,
++						   dwc_otg_qh_t * qh)
++{
++	dwc_otg_hcd_qtd_remove(hcd, qtd, qh);
++	dwc_otg_hcd_qtd_free(qtd);
++}
++
++/** @} */
++
++/** @name Descriptor DMA Supporting Functions */
++/** @{ */
++
++extern void dwc_otg_hcd_start_xfer_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
++extern void dwc_otg_hcd_complete_xfer_ddma(dwc_otg_hcd_t * hcd,
++					   dwc_hc_t * hc,
++					   dwc_otg_hc_regs_t * hc_regs,
++					   dwc_otg_halt_status_e halt_status);
++
++extern int dwc_otg_hcd_qh_init_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
++extern void dwc_otg_hcd_qh_free_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
++
++/** @} */
++
++/** @name Internal Functions */
++/** @{ */
++dwc_otg_qh_t *dwc_urb_to_qh(dwc_otg_hcd_urb_t * urb);
++/** @} */
++
++#ifdef CONFIG_USB_DWC_OTG_LPM
++extern int dwc_otg_hcd_get_hc_for_lpm_tran(dwc_otg_hcd_t * hcd,
++					   uint8_t devaddr);
++extern void dwc_otg_hcd_free_hc_from_lpm(dwc_otg_hcd_t * hcd);
++#endif
++
++/** Gets the QH that contains the list_head */
++#define dwc_list_to_qh(_list_head_ptr_) container_of(_list_head_ptr_, dwc_otg_qh_t, qh_list_entry)
++
++/** Gets the QTD that contains the list_head */
++#define dwc_list_to_qtd(_list_head_ptr_) container_of(_list_head_ptr_, dwc_otg_qtd_t, qtd_list_entry)
++
++/** Check if QH is non-periodic  */
++#define dwc_qh_is_non_per(_qh_ptr_) ((_qh_ptr_->ep_type == UE_BULK) || \
++				     (_qh_ptr_->ep_type == UE_CONTROL))
++
++/** High bandwidth multiplier as encoded in highspeed endpoint descriptors */
++#define dwc_hb_mult(wMaxPacketSize) (1 + (((wMaxPacketSize) >> 11) & 0x03))
++
++/** Packet size for any kind of endpoint descriptor */
++#define dwc_max_packet(wMaxPacketSize) ((wMaxPacketSize) & 0x07ff)
++
++/**
++ * Returns true if _frame1 is less than or equal to _frame2. The comparison is
++ * done modulo DWC_HFNUM_MAX_FRNUM. This accounts for the rollover of the
++ * frame number when the max frame number is reached.
++ */
++static inline int dwc_frame_num_le(uint16_t frame1, uint16_t frame2)
++{
++	return ((frame2 - frame1) & DWC_HFNUM_MAX_FRNUM) <=
++	    (DWC_HFNUM_MAX_FRNUM >> 1);
++}
++
++/**
++ * Returns true if _frame1 is greater than _frame2. The comparison is done
++ * modulo DWC_HFNUM_MAX_FRNUM. This accounts for the rollover of the frame
++ * number when the max frame number is reached.
++ */
++static inline int dwc_frame_num_gt(uint16_t frame1, uint16_t frame2)
++{
++	return (frame1 != frame2) &&
++	    (((frame1 - frame2) & DWC_HFNUM_MAX_FRNUM) <
++	     (DWC_HFNUM_MAX_FRNUM >> 1));
++}
++
++/**
++ * Increments _frame by the amount specified by _inc. The addition is done
++ * modulo DWC_HFNUM_MAX_FRNUM. Returns the incremented value.
++ */
++static inline uint16_t dwc_frame_num_inc(uint16_t frame, uint16_t inc)
++{
++	return (frame + inc) & DWC_HFNUM_MAX_FRNUM;
++}
++
++static inline uint16_t dwc_full_frame_num(uint16_t frame)
++{
++	return (frame & DWC_HFNUM_MAX_FRNUM) >> 3;
++}
++
++static inline uint16_t dwc_micro_frame_num(uint16_t frame)
++{
++	return frame & 0x7;
++}
++
++extern void init_hcd_usecs(dwc_otg_hcd_t *_hcd);
++
++void dwc_otg_hcd_save_data_toggle(dwc_hc_t * hc,
++				  dwc_otg_hc_regs_t * hc_regs,
++				  dwc_otg_qtd_t * qtd);
++
++#ifdef DEBUG
++/**
++ * Macro to sample the remaining PHY clocks left in the current frame. This
++ * may be used during debugging to determine the average time it takes to
++ * execute sections of code. There are two possible sample points, "a" and
++ * "b", so the _letter argument must be one of these values.
++ *
++ * To dump the average sample times, read the "hcd_frrem" sysfs attribute. For
++ * example, "cat /sys/devices/lm0/hcd_frrem".
++ */
++#define dwc_sample_frrem(_hcd, _qh, _letter) \
++{ \
++	hfnum_data_t hfnum; \
++	dwc_otg_qtd_t *qtd; \
++	qtd = list_entry(_qh->qtd_list.next, dwc_otg_qtd_t, qtd_list_entry); \
++	if (usb_pipeint(qtd->urb->pipe) && _qh->start_split_frame != 0 && !qtd->complete_split) { \
++		hfnum.d32 = DWC_READ_REG32(&_hcd->core_if->host_if->host_global_regs->hfnum); \
++		switch (hfnum.b.frnum & 0x7) { \
++		case 7: \
++			_hcd->hfnum_7_samples_##_letter++; \
++			_hcd->hfnum_7_frrem_accum_##_letter += hfnum.b.frrem; \
++			break; \
++		case 0: \
++			_hcd->hfnum_0_samples_##_letter++; \
++			_hcd->hfnum_0_frrem_accum_##_letter += hfnum.b.frrem; \
++			break; \
++		default: \
++			_hcd->hfnum_other_samples_##_letter++; \
++			_hcd->hfnum_other_frrem_accum_##_letter += hfnum.b.frrem; \
++			break; \
++		} \
++	} \
++}
++#else
++#define dwc_sample_frrem(_hcd, _qh, _letter)
++#endif
++#endif
++#endif /* DWC_DEVICE_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_ddma.c
+@@ -0,0 +1,1135 @@
++/*==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd_ddma.c $
++ * $Revision: #10 $
++ * $Date: 2011/10/20 $
++ * $Change: 1869464 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_DEVICE_ONLY
++
++/** @file
++ * This file contains Descriptor DMA support implementation for host mode.
++ */
++
++#include "dwc_otg_hcd.h"
++#include "dwc_otg_regs.h"
++
++extern bool microframe_schedule;
++
++static inline uint8_t frame_list_idx(uint16_t frame)
++{
++	return (frame & (MAX_FRLIST_EN_NUM - 1));
++}
++
++static inline uint16_t desclist_idx_inc(uint16_t idx, uint16_t inc, uint8_t speed)
++{
++	return (idx + inc) &
++	    (((speed ==
++	       DWC_OTG_EP_SPEED_HIGH) ? MAX_DMA_DESC_NUM_HS_ISOC :
++	      MAX_DMA_DESC_NUM_GENERIC) - 1);
++}
++
++static inline uint16_t desclist_idx_dec(uint16_t idx, uint16_t inc, uint8_t speed)
++{
++	return (idx - inc) &
++	    (((speed ==
++	       DWC_OTG_EP_SPEED_HIGH) ? MAX_DMA_DESC_NUM_HS_ISOC :
++	      MAX_DMA_DESC_NUM_GENERIC) - 1);
++}
++
++static inline uint16_t max_desc_num(dwc_otg_qh_t * qh)
++{
++	return (((qh->ep_type == UE_ISOCHRONOUS)
++		 && (qh->dev_speed == DWC_OTG_EP_SPEED_HIGH))
++		? MAX_DMA_DESC_NUM_HS_ISOC : MAX_DMA_DESC_NUM_GENERIC);
++}
++static inline uint16_t frame_incr_val(dwc_otg_qh_t * qh)
++{
++	return ((qh->dev_speed == DWC_OTG_EP_SPEED_HIGH)
++		? ((qh->interval + 8 - 1) / 8)
++		: qh->interval);
++}
++
++static int desc_list_alloc(struct device *dev, dwc_otg_qh_t * qh)
++{
++	int retval = 0;
++
++	qh->desc_list = (dwc_otg_host_dma_desc_t *)
++	    DWC_DMA_ALLOC(dev, sizeof(dwc_otg_host_dma_desc_t) * max_desc_num(qh),
++			  &qh->desc_list_dma);
++
++	if (!qh->desc_list) {
++		retval = -DWC_E_NO_MEMORY;
++		DWC_ERROR("%s: DMA descriptor list allocation failed\n", __func__);
++
++	}
++
++	dwc_memset(qh->desc_list, 0x00,
++		   sizeof(dwc_otg_host_dma_desc_t) * max_desc_num(qh));
++
++	qh->n_bytes =
++	    (uint32_t *) DWC_ALLOC(sizeof(uint32_t) * max_desc_num(qh));
++
++	if (!qh->n_bytes) {
++		retval = -DWC_E_NO_MEMORY;
++		DWC_ERROR
++		    ("%s: Failed to allocate array for descriptors' size actual values\n",
++		     __func__);
++
++	}
++	return retval;
++
++}
++
++static void desc_list_free(struct device *dev, dwc_otg_qh_t * qh)
++{
++	if (qh->desc_list) {
++		DWC_DMA_FREE(dev, max_desc_num(qh), qh->desc_list,
++			     qh->desc_list_dma);
++		qh->desc_list = NULL;
++	}
++
++	if (qh->n_bytes) {
++		DWC_FREE(qh->n_bytes);
++		qh->n_bytes = NULL;
++	}
++}
++
++static int frame_list_alloc(dwc_otg_hcd_t * hcd)
++{
++	struct device *dev = dwc_otg_hcd_to_dev(hcd);
++	int retval = 0;
++
++	if (hcd->frame_list)
++		return 0;
++
++	hcd->frame_list = DWC_DMA_ALLOC(dev, 4 * MAX_FRLIST_EN_NUM,
++					&hcd->frame_list_dma);
++	if (!hcd->frame_list) {
++		retval = -DWC_E_NO_MEMORY;
++		DWC_ERROR("%s: Frame List allocation failed\n", __func__);
++	}
++
++	dwc_memset(hcd->frame_list, 0x00, 4 * MAX_FRLIST_EN_NUM);
++
++	return retval;
++}
++
++static void frame_list_free(dwc_otg_hcd_t * hcd)
++{
++	struct device *dev = dwc_otg_hcd_to_dev(hcd);
++
++	if (!hcd->frame_list)
++		return;
++
++	DWC_DMA_FREE(dev, 4 * MAX_FRLIST_EN_NUM, hcd->frame_list, hcd->frame_list_dma);
++	hcd->frame_list = NULL;
++}
++
++static void per_sched_enable(dwc_otg_hcd_t * hcd, uint16_t fr_list_en)
++{
++
++	hcfg_data_t hcfg;
++
++	hcfg.d32 = DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hcfg);
++
++	if (hcfg.b.perschedena) {
++		/* already enabled */
++		return;
++	}
++
++	DWC_WRITE_REG32(&hcd->core_if->host_if->host_global_regs->hflbaddr,
++			hcd->frame_list_dma);
++
++	switch (fr_list_en) {
++	case 64:
++		hcfg.b.frlisten = 3;
++		break;
++	case 32:
++		hcfg.b.frlisten = 2;
++		break;
++	case 16:
++		hcfg.b.frlisten = 1;
++		break;
++	case 8:
++		hcfg.b.frlisten = 0;
++		break;
++	default:
++		break;
++	}
++
++	hcfg.b.perschedena = 1;
++
++	DWC_DEBUGPL(DBG_HCD, "Enabling Periodic schedule\n");
++	DWC_WRITE_REG32(&hcd->core_if->host_if->host_global_regs->hcfg, hcfg.d32);
++
++}
++
++static void per_sched_disable(dwc_otg_hcd_t * hcd)
++{
++	hcfg_data_t hcfg;
++
++	hcfg.d32 = DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hcfg);
++
++	if (!hcfg.b.perschedena) {
++		/* already disabled */
++		return;
++	}
++	hcfg.b.perschedena = 0;
++
++	DWC_DEBUGPL(DBG_HCD, "Disabling Periodic schedule\n");
++	DWC_WRITE_REG32(&hcd->core_if->host_if->host_global_regs->hcfg, hcfg.d32);
++}
++
++/*
++ * Activates/Deactivates FrameList entries for the channel
++ * based on endpoint servicing period.
++ */
++void update_frame_list(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh, uint8_t enable)
++{
++	uint16_t i, j, inc;
++	dwc_hc_t *hc = NULL;
++
++	if (!qh->channel) {
++		DWC_ERROR("qh->channel = %p", qh->channel);
++		return;
++	}
++
++	if (!hcd) {
++		DWC_ERROR("------hcd = %p", hcd);
++		return;
++	}
++
++	if (!hcd->frame_list) {
++		DWC_ERROR("-------hcd->frame_list = %p", hcd->frame_list);
++		return;
++	}
++
++	hc = qh->channel;
++	inc = frame_incr_val(qh);
++	if (qh->ep_type == UE_ISOCHRONOUS)
++		i = frame_list_idx(qh->sched_frame);
++	else
++		i = 0;
++
++	j = i;
++	do {
++		if (enable)
++			hcd->frame_list[j] |= (1 << hc->hc_num);
++		else
++			hcd->frame_list[j] &= ~(1 << hc->hc_num);
++		j = (j + inc) & (MAX_FRLIST_EN_NUM - 1);
++	}
++	while (j != i);
++	if (!enable)
++		return;
++	hc->schinfo = 0;
++	if (qh->channel->speed == DWC_OTG_EP_SPEED_HIGH) {
++		j = 1;
++		/* TODO - check this */
++		inc = (8 + qh->interval - 1) / qh->interval;
++		for (i = 0; i < inc; i++) {
++			hc->schinfo |= j;
++			j = j << qh->interval;
++		}
++	} else {
++		hc->schinfo = 0xff;
++	}
++}
++
++#if 1
++void dump_frame_list(dwc_otg_hcd_t * hcd)
++{
++	int i = 0;
++	DWC_PRINTF("--FRAME LIST (hex) --\n");
++	for (i = 0; i < MAX_FRLIST_EN_NUM; i++) {
++		DWC_PRINTF("%x\t", hcd->frame_list[i]);
++		if (!(i % 8) && i)
++			DWC_PRINTF("\n");
++	}
++	DWC_PRINTF("\n----\n");
++
++}
++#endif
++
++static void release_channel_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	dwc_hc_t *hc = qh->channel;
++	if (dwc_qh_is_non_per(qh)) {
++		if (!microframe_schedule)
++			hcd->non_periodic_channels--;
++		else
++			hcd->available_host_channels++;
++	} else
++		update_frame_list(hcd, qh, 0);
++
++	/*
++	 * The condition is added to prevent double cleanup try in case of device
++	 * disconnect. See channel cleanup in dwc_otg_hcd_disconnect_cb().
++	 */
++	if (hc->qh) {
++		dwc_otg_hc_cleanup(hcd->core_if, hc);
++		DWC_CIRCLEQ_INSERT_TAIL(&hcd->free_hc_list, hc, hc_list_entry);
++		hc->qh = NULL;
++	}
++
++	qh->channel = NULL;
++	qh->ntd = 0;
++
++	if (qh->desc_list) {
++		dwc_memset(qh->desc_list, 0x00,
++			   sizeof(dwc_otg_host_dma_desc_t) * max_desc_num(qh));
++	}
++}
++
++/**
++ * Initializes a QH structure's Descriptor DMA related members.
++ * Allocates memory for descriptor list.
++ * On first periodic QH, allocates memory for FrameList
++ * and enables periodic scheduling.
++ *
++ * @param hcd The HCD state structure for the DWC OTG controller.
++ * @param qh The QH to init.
++ *
++ * @return 0 if successful, negative error code otherwise.
++ */
++int dwc_otg_hcd_qh_init_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	struct device *dev = dwc_otg_hcd_to_dev(hcd);
++	int retval = 0;
++
++	if (qh->do_split) {
++		DWC_ERROR("SPLIT Transfers are not supported in Descriptor DMA.\n");
++		return -1;
++	}
++
++	retval = desc_list_alloc(dev, qh);
++
++	if ((retval == 0)
++	    && (qh->ep_type == UE_ISOCHRONOUS || qh->ep_type == UE_INTERRUPT)) {
++		if (!hcd->frame_list) {
++			retval = frame_list_alloc(hcd);
++			/* Enable periodic schedule on first periodic QH */
++			if (retval == 0)
++				per_sched_enable(hcd, MAX_FRLIST_EN_NUM);
++		}
++	}
++
++	qh->ntd = 0;
++
++	return retval;
++}
++
++/**
++ * Frees descriptor list memory associated with the QH.
++ * If QH is periodic and the last, frees FrameList memory
++ * and disables periodic scheduling.
++ *
++ * @param hcd The HCD state structure for the DWC OTG controller.
++ * @param qh The QH to init.
++ */
++void dwc_otg_hcd_qh_free_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	struct device *dev = dwc_otg_hcd_to_dev(hcd);
++
++	desc_list_free(dev, qh);
++
++	/*
++	 * Channel still assigned due to some reasons.
++	 * Seen on Isoc URB dequeue. Channel halted but no subsequent
++	 * ChHalted interrupt to release the channel. Afterwards
++	 * when it comes here from endpoint disable routine
++	 * channel remains assigned.
++	 */
++	if (qh->channel)
++		release_channel_ddma(hcd, qh);
++
++	if ((qh->ep_type == UE_ISOCHRONOUS || qh->ep_type == UE_INTERRUPT)
++	    && (microframe_schedule || !hcd->periodic_channels) && hcd->frame_list) {
++
++		per_sched_disable(hcd);
++		frame_list_free(hcd);
++	}
++}
++
++static uint8_t frame_to_desc_idx(dwc_otg_qh_t * qh, uint16_t frame_idx)
++{
++	if (qh->dev_speed == DWC_OTG_EP_SPEED_HIGH) {
++		/*
++		 * Descriptor set(8 descriptors) index
++		 * which is 8-aligned.
++		 */
++		return (frame_idx & ((MAX_DMA_DESC_NUM_HS_ISOC / 8) - 1)) * 8;
++	} else {
++		return (frame_idx & (MAX_DMA_DESC_NUM_GENERIC - 1));
++	}
++}
++
++/*
++ * Determine starting frame for Isochronous transfer.
++ * Few frames skipped to prevent race condition with HC.
++ */
++static uint8_t calc_starting_frame(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh,
++				   uint8_t * skip_frames)
++{
++	uint16_t frame = 0;
++	hcd->frame_number = dwc_otg_hcd_get_frame_number(hcd);
++
++	/* sched_frame is always frame number(not uFrame) both in FS and HS !! */
++
++	/*
++	 * skip_frames is used to limit activated descriptors number
++	 * to avoid the situation when HC services the last activated
++	 * descriptor firstly.
++	 * Example for FS:
++	 * Current frame is 1, scheduled frame is 3. Since HC always fetches the descriptor
++	 * corresponding to curr_frame+1, the descriptor corresponding to frame 2
++	 * will be fetched. If the number of descriptors is max=64 (or greather) the
++	 * list will be fully programmed with Active descriptors and it is possible
++	 * case(rare) that the latest descriptor(considering rollback) corresponding
++	 * to frame 2 will be serviced first. HS case is more probable because, in fact,
++	 * up to 11 uframes(16 in the code) may be skipped.
++	 */
++	if (qh->dev_speed == DWC_OTG_EP_SPEED_HIGH) {
++		/*
++		 * Consider uframe counter also, to start xfer asap.
++		 * If half of the frame elapsed skip 2 frames otherwise
++		 * just 1 frame.
++		 * Starting descriptor index must be 8-aligned, so
++		 * if the current frame is near to complete the next one
++		 * is skipped as well.
++		 */
++
++		if (dwc_micro_frame_num(hcd->frame_number) >= 5) {
++			*skip_frames = 2 * 8;
++			frame = dwc_frame_num_inc(hcd->frame_number, *skip_frames);
++		} else {
++			*skip_frames = 1 * 8;
++			frame = dwc_frame_num_inc(hcd->frame_number, *skip_frames);
++		}
++
++		frame = dwc_full_frame_num(frame);
++	} else {
++		/*
++		 * Two frames are skipped for FS - the current and the next.
++		 * But for descriptor programming, 1 frame(descriptor) is enough,
++		 * see example above.
++		 */
++		*skip_frames = 1;
++		frame = dwc_frame_num_inc(hcd->frame_number, 2);
++	}
++
++	return frame;
++}
++
++/*
++ * Calculate initial descriptor index for isochronous transfer
++ * based on scheduled frame.
++ */
++static uint8_t recalc_initial_desc_idx(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	uint16_t frame = 0, fr_idx, fr_idx_tmp;
++	uint8_t skip_frames = 0;
++	/*
++	 * With current ISOC processing algorithm the channel is being
++	 * released when no more QTDs in the list(qh->ntd == 0).
++	 * Thus this function is called only when qh->ntd == 0 and qh->channel == 0.
++	 *
++	 * So qh->channel != NULL branch is not used and just not removed from the
++	 * source file. It is required for another possible approach which is,
++	 * do not disable and release the channel when ISOC session completed,
++	 * just move QH to inactive schedule until new QTD arrives.
++	 * On new QTD, the QH moved back to 'ready' schedule,
++	 * starting frame and therefore starting desc_index are recalculated.
++	 * In this case channel is released only on ep_disable.
++	 */
++
++	/* Calculate starting descriptor index. For INTERRUPT endpoint it is always 0. */
++	if (qh->channel) {
++		frame = calc_starting_frame(hcd, qh, &skip_frames);
++		/*
++		 * Calculate initial descriptor index based on FrameList current bitmap
++		 * and servicing period.
++		 */
++		fr_idx_tmp = frame_list_idx(frame);
++		fr_idx =
++		    (MAX_FRLIST_EN_NUM + frame_list_idx(qh->sched_frame) -
++		     fr_idx_tmp)
++		    % frame_incr_val(qh);
++		fr_idx = (fr_idx + fr_idx_tmp) % MAX_FRLIST_EN_NUM;
++	} else {
++		qh->sched_frame = calc_starting_frame(hcd, qh, &skip_frames);
++		fr_idx = frame_list_idx(qh->sched_frame);
++	}
++
++	qh->td_first = qh->td_last = frame_to_desc_idx(qh, fr_idx);
++
++	return skip_frames;
++}
++
++#define	ISOC_URB_GIVEBACK_ASAP
++
++#define MAX_ISOC_XFER_SIZE_FS 1023
++#define MAX_ISOC_XFER_SIZE_HS 3072
++#define DESCNUM_THRESHOLD 4
++
++static void init_isoc_dma_desc(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh,
++			       uint8_t skip_frames)
++{
++	struct dwc_otg_hcd_iso_packet_desc *frame_desc;
++	dwc_otg_qtd_t *qtd;
++	dwc_otg_host_dma_desc_t *dma_desc;
++	uint16_t idx, inc, n_desc, ntd_max, max_xfer_size;
++
++	idx = qh->td_last;
++	inc = qh->interval;
++	n_desc = 0;
++
++	ntd_max = (max_desc_num(qh) + qh->interval - 1) / qh->interval;
++	if (skip_frames && !qh->channel)
++		ntd_max = ntd_max - skip_frames / qh->interval;
++
++	max_xfer_size =
++	    (qh->dev_speed ==
++	     DWC_OTG_EP_SPEED_HIGH) ? MAX_ISOC_XFER_SIZE_HS :
++	    MAX_ISOC_XFER_SIZE_FS;
++
++	DWC_CIRCLEQ_FOREACH(qtd, &qh->qtd_list, qtd_list_entry) {
++		while ((qh->ntd < ntd_max)
++		       && (qtd->isoc_frame_index_last <
++			   qtd->urb->packet_count)) {
++
++			dma_desc = &qh->desc_list[idx];
++			dwc_memset(dma_desc, 0x00, sizeof(dwc_otg_host_dma_desc_t));
++
++			frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index_last];
++
++			if (frame_desc->length > max_xfer_size)
++				qh->n_bytes[idx] = max_xfer_size;
++			else
++				qh->n_bytes[idx] = frame_desc->length;
++			dma_desc->status.b_isoc.n_bytes = qh->n_bytes[idx];
++			dma_desc->status.b_isoc.a = 1;
++			dma_desc->status.b_isoc.sts = 0;
++
++			dma_desc->buf = qtd->urb->dma + frame_desc->offset;
++
++			qh->ntd++;
++
++			qtd->isoc_frame_index_last++;
++
++#ifdef	ISOC_URB_GIVEBACK_ASAP
++			/*
++			 * Set IOC for each descriptor corresponding to the
++			 * last frame of the URB.
++			 */
++			if (qtd->isoc_frame_index_last ==
++			    qtd->urb->packet_count)
++				dma_desc->status.b_isoc.ioc = 1;
++
++#endif
++			idx = desclist_idx_inc(idx, inc, qh->dev_speed);
++			n_desc++;
++
++		}
++		qtd->in_process = 1;
++	}
++
++	qh->td_last = idx;
++
++#ifdef	ISOC_URB_GIVEBACK_ASAP
++	/* Set IOC for the last descriptor if descriptor list is full */
++	if (qh->ntd == ntd_max) {
++		idx = desclist_idx_dec(qh->td_last, inc, qh->dev_speed);
++		qh->desc_list[idx].status.b_isoc.ioc = 1;
++	}
++#else
++	/*
++	 * Set IOC bit only for one descriptor.
++	 * Always try to be ahead of HW processing,
++	 * i.e. on IOC generation driver activates next descriptors but
++	 * core continues to process descriptors followed the one with IOC set.
++	 */
++
++	if (n_desc > DESCNUM_THRESHOLD) {
++		/*
++		 * Move IOC "up". Required even if there is only one QTD
++		 * in the list, cause QTDs migth continue to be queued,
++		 * but during the activation it was only one queued.
++		 * Actually more than one QTD might be in the list if this function called
++		 * from XferCompletion - QTDs was queued during HW processing of the previous
++		 * descriptor chunk.
++		 */
++		idx = dwc_desclist_idx_dec(idx, inc * ((qh->ntd + 1) / 2), qh->dev_speed);
++	} else {
++		/*
++		 * Set the IOC for the latest descriptor
++		 * if either number of descriptor is not greather than threshold
++		 * or no more new descriptors activated.
++		 */
++		idx = dwc_desclist_idx_dec(qh->td_last, inc, qh->dev_speed);
++	}
++
++	qh->desc_list[idx].status.b_isoc.ioc = 1;
++#endif
++}
++
++static void init_non_isoc_dma_desc(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++
++	dwc_hc_t *hc;
++	dwc_otg_host_dma_desc_t *dma_desc;
++	dwc_otg_qtd_t *qtd;
++	int num_packets, len, n_desc = 0;
++
++	hc = qh->channel;
++
++	/*
++	 * Start with hc->xfer_buff initialized in
++	 * assign_and_init_hc(), then if SG transfer consists of multiple URBs,
++	 * this pointer re-assigned to the buffer of the currently processed QTD.
++	 * For non-SG request there is always one QTD active.
++	 */
++
++	DWC_CIRCLEQ_FOREACH(qtd, &qh->qtd_list, qtd_list_entry) {
++
++		if (n_desc) {
++			/* SG request - more than 1 QTDs */
++			hc->xfer_buff = (uint8_t *)(uintptr_t)qtd->urb->dma +
++					qtd->urb->actual_length;
++			hc->xfer_len = qtd->urb->length - qtd->urb->actual_length;
++		}
++
++		qtd->n_desc = 0;
++
++		do {
++			dma_desc = &qh->desc_list[n_desc];
++			len = hc->xfer_len;
++
++			if (len > MAX_DMA_DESC_SIZE)
++				len = MAX_DMA_DESC_SIZE - hc->max_packet + 1;
++
++			if (hc->ep_is_in) {
++				if (len > 0) {
++					num_packets = (len + hc->max_packet - 1) / hc->max_packet;
++				} else {
++					/* Need 1 packet for transfer length of 0. */
++					num_packets = 1;
++				}
++				/* Always program an integral # of max packets for IN transfers. */
++				len = num_packets * hc->max_packet;
++			}
++
++			dma_desc->status.b.n_bytes = len;
++
++			qh->n_bytes[n_desc] = len;
++
++			if ((qh->ep_type == UE_CONTROL)
++			    && (qtd->control_phase == DWC_OTG_CONTROL_SETUP))
++				dma_desc->status.b.sup = 1;	/* Setup Packet */
++
++			dma_desc->status.b.a = 1;	/* Active descriptor */
++			dma_desc->status.b.sts = 0;
++
++			dma_desc->buf =
++			    ((unsigned long)hc->xfer_buff & 0xffffffff);
++
++			/*
++			 * Last descriptor(or single) of IN transfer
++			 * with actual size less than MaxPacket.
++			 */
++			if (len > hc->xfer_len) {
++				hc->xfer_len = 0;
++			} else {
++				hc->xfer_buff += len;
++				hc->xfer_len -= len;
++			}
++
++			qtd->n_desc++;
++			n_desc++;
++		}
++		while ((hc->xfer_len > 0) && (n_desc != MAX_DMA_DESC_NUM_GENERIC));
++
++
++		qtd->in_process = 1;
++
++		if (qh->ep_type == UE_CONTROL)
++			break;
++
++		if (n_desc == MAX_DMA_DESC_NUM_GENERIC)
++			break;
++	}
++
++	if (n_desc) {
++		/* Request Transfer Complete interrupt for the last descriptor */
++		qh->desc_list[n_desc - 1].status.b.ioc = 1;
++		/* End of List indicator */
++		qh->desc_list[n_desc - 1].status.b.eol = 1;
++
++		hc->ntd = n_desc;
++	}
++}
++
++/**
++ * For Control and Bulk endpoints initializes descriptor list
++ * and starts the transfer.
++ *
++ * For Interrupt and Isochronous endpoints initializes descriptor list
++ * then updates FrameList, marking appropriate entries as active.
++ * In case of Isochronous, the starting descriptor index is calculated based
++ * on the scheduled frame, but only on the first transfer descriptor within a session.
++ * Then starts the transfer via enabling the channel.
++ * For Isochronous endpoint the channel is not halted on XferComplete
++ * interrupt so remains assigned to the endpoint(QH) until session is done.
++ *
++ * @param hcd The HCD state structure for the DWC OTG controller.
++ * @param qh The QH to init.
++ *
++ * @return 0 if successful, negative error code otherwise.
++ */
++void dwc_otg_hcd_start_xfer_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	/* Channel is already assigned */
++	dwc_hc_t *hc = qh->channel;
++	uint8_t skip_frames = 0;
++
++	switch (hc->ep_type) {
++	case DWC_OTG_EP_TYPE_CONTROL:
++	case DWC_OTG_EP_TYPE_BULK:
++		init_non_isoc_dma_desc(hcd, qh);
++
++		dwc_otg_hc_start_transfer_ddma(hcd->core_if, hc);
++		break;
++	case DWC_OTG_EP_TYPE_INTR:
++		init_non_isoc_dma_desc(hcd, qh);
++
++		update_frame_list(hcd, qh, 1);
++
++		dwc_otg_hc_start_transfer_ddma(hcd->core_if, hc);
++		break;
++	case DWC_OTG_EP_TYPE_ISOC:
++
++		if (!qh->ntd)
++			skip_frames = recalc_initial_desc_idx(hcd, qh);
++
++		init_isoc_dma_desc(hcd, qh, skip_frames);
++
++		if (!hc->xfer_started) {
++
++			update_frame_list(hcd, qh, 1);
++
++			/*
++			 * Always set to max, instead of actual size.
++			 * Otherwise ntd will be changed with
++			 * channel being enabled. Not recommended.
++			 *
++			 */
++			hc->ntd = max_desc_num(qh);
++			/* Enable channel only once for ISOC */
++			dwc_otg_hc_start_transfer_ddma(hcd->core_if, hc);
++		}
++
++		break;
++	default:
++
++		break;
++	}
++}
++
++static void complete_isoc_xfer_ddma(dwc_otg_hcd_t * hcd,
++				    dwc_hc_t * hc,
++				    dwc_otg_hc_regs_t * hc_regs,
++				    dwc_otg_halt_status_e halt_status)
++{
++	struct dwc_otg_hcd_iso_packet_desc *frame_desc;
++	dwc_otg_qtd_t *qtd, *qtd_tmp;
++	dwc_otg_qh_t *qh;
++	dwc_otg_host_dma_desc_t *dma_desc;
++	uint16_t idx, remain;
++	uint8_t urb_compl;
++
++	qh = hc->qh;
++	idx = qh->td_first;
++
++	if (hc->halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE) {
++		DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &hc->qh->qtd_list, qtd_list_entry)
++		    qtd->in_process = 0;
++		return;
++	} else if ((halt_status == DWC_OTG_HC_XFER_AHB_ERR) ||
++		   (halt_status == DWC_OTG_HC_XFER_BABBLE_ERR)) {
++		/*
++		 * Channel is halted in these error cases.
++		 * Considered as serious issues.
++		 * Complete all URBs marking all frames as failed,
++		 * irrespective whether some of the descriptors(frames) succeeded or no.
++		 * Pass error code to completion routine as well, to
++		 * update urb->status, some of class drivers might use it to stop
++		 * queing transfer requests.
++		 */
++		int err = (halt_status == DWC_OTG_HC_XFER_AHB_ERR)
++		    ? (-DWC_E_IO)
++		    : (-DWC_E_OVERFLOW);
++
++		DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &hc->qh->qtd_list, qtd_list_entry) {
++			for (idx = 0; idx < qtd->urb->packet_count; idx++) {
++				frame_desc = &qtd->urb->iso_descs[idx];
++				frame_desc->status = err;
++			}
++			hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, err);
++			dwc_otg_hcd_qtd_remove_and_free(hcd, qtd, qh);
++		}
++		return;
++	}
++
++	DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &hc->qh->qtd_list, qtd_list_entry) {
++
++		if (!qtd->in_process)
++			break;
++
++		urb_compl = 0;
++
++		do {
++
++			dma_desc = &qh->desc_list[idx];
++
++			frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
++			remain = hc->ep_is_in ? dma_desc->status.b_isoc.n_bytes : 0;
++
++			if (dma_desc->status.b_isoc.sts == DMA_DESC_STS_PKTERR) {
++				/*
++				 * XactError or, unable to complete all the transactions
++				 * in the scheduled micro-frame/frame,
++				 * both indicated by DMA_DESC_STS_PKTERR.
++				 */
++				qtd->urb->error_count++;
++				frame_desc->actual_length = qh->n_bytes[idx] - remain;
++				frame_desc->status = -DWC_E_PROTOCOL;
++			} else {
++				/* Success */
++
++				frame_desc->actual_length = qh->n_bytes[idx] - remain;
++				frame_desc->status = 0;
++			}
++
++			if (++qtd->isoc_frame_index == qtd->urb->packet_count) {
++				/*
++				 * urb->status is not used for isoc transfers here.
++				 * The individual frame_desc status are used instead.
++				 */
++
++				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
++				dwc_otg_hcd_qtd_remove_and_free(hcd, qtd, qh);
++
++				/*
++				 * This check is necessary because urb_dequeue can be called
++				 * from urb complete callback(sound driver example).
++				 * All pending URBs are dequeued there, so no need for
++				 * further processing.
++				 */
++				if (hc->halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE) {
++					return;
++				}
++
++				urb_compl = 1;
++
++			}
++
++			qh->ntd--;
++
++			/* Stop if IOC requested descriptor reached */
++			if (dma_desc->status.b_isoc.ioc) {
++				idx = desclist_idx_inc(idx, qh->interval, hc->speed);
++				goto stop_scan;
++			}
++
++			idx = desclist_idx_inc(idx, qh->interval, hc->speed);
++
++			if (urb_compl)
++				break;
++		}
++		while (idx != qh->td_first);
++	}
++stop_scan:
++	qh->td_first = idx;
++}
++
++uint8_t update_non_isoc_urb_state_ddma(dwc_otg_hcd_t * hcd,
++				       dwc_hc_t * hc,
++				       dwc_otg_qtd_t * qtd,
++				       dwc_otg_host_dma_desc_t * dma_desc,
++				       dwc_otg_halt_status_e halt_status,
++				       uint32_t n_bytes, uint8_t * xfer_done)
++{
++
++	uint16_t remain = hc->ep_is_in ? dma_desc->status.b.n_bytes : 0;
++	dwc_otg_hcd_urb_t *urb = qtd->urb;
++
++	if (halt_status == DWC_OTG_HC_XFER_AHB_ERR) {
++		urb->status = -DWC_E_IO;
++		return 1;
++	}
++	if (dma_desc->status.b.sts == DMA_DESC_STS_PKTERR) {
++		switch (halt_status) {
++		case DWC_OTG_HC_XFER_STALL:
++			urb->status = -DWC_E_PIPE;
++			break;
++		case DWC_OTG_HC_XFER_BABBLE_ERR:
++			urb->status = -DWC_E_OVERFLOW;
++			break;
++		case DWC_OTG_HC_XFER_XACT_ERR:
++			urb->status = -DWC_E_PROTOCOL;
++			break;
++		default:
++			DWC_ERROR("%s: Unhandled descriptor error status (%d)\n", __func__,
++				  halt_status);
++			break;
++		}
++		return 1;
++	}
++
++	if (dma_desc->status.b.a == 1) {
++		DWC_DEBUGPL(DBG_HCDV,
++			    "Active descriptor encountered on channel %d\n",
++			    hc->hc_num);
++		return 0;
++	}
++
++	if (hc->ep_type == DWC_OTG_EP_TYPE_CONTROL) {
++		if (qtd->control_phase == DWC_OTG_CONTROL_DATA) {
++			urb->actual_length += n_bytes - remain;
++			if (remain || urb->actual_length == urb->length) {
++				/*
++				 * For Control Data stage do not set urb->status=0 to prevent
++				 * URB callback. Set it when Status phase done. See below.
++				 */
++				*xfer_done = 1;
++			}
++
++		} else if (qtd->control_phase == DWC_OTG_CONTROL_STATUS) {
++			urb->status = 0;
++			*xfer_done = 1;
++		}
++		/* No handling for SETUP stage */
++	} else {
++		/* BULK and INTR */
++		urb->actual_length += n_bytes - remain;
++		if (remain || urb->actual_length == urb->length) {
++			urb->status = 0;
++			*xfer_done = 1;
++		}
++	}
++
++	return 0;
++}
++
++static void complete_non_isoc_xfer_ddma(dwc_otg_hcd_t * hcd,
++					dwc_hc_t * hc,
++					dwc_otg_hc_regs_t * hc_regs,
++					dwc_otg_halt_status_e halt_status)
++{
++	dwc_otg_hcd_urb_t *urb = NULL;
++	dwc_otg_qtd_t *qtd, *qtd_tmp;
++	dwc_otg_qh_t *qh;
++	dwc_otg_host_dma_desc_t *dma_desc;
++	uint32_t n_bytes, n_desc, i;
++	uint8_t failed = 0, xfer_done;
++
++	n_desc = 0;
++
++	qh = hc->qh;
++
++	if (hc->halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE) {
++		DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &hc->qh->qtd_list, qtd_list_entry) {
++			qtd->in_process = 0;
++		}
++		return;
++	}
++
++	DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &qh->qtd_list, qtd_list_entry) {
++
++		urb = qtd->urb;
++
++		n_bytes = 0;
++		xfer_done = 0;
++
++		for (i = 0; i < qtd->n_desc; i++) {
++			dma_desc = &qh->desc_list[n_desc];
++
++			n_bytes = qh->n_bytes[n_desc];
++
++			failed =
++			    update_non_isoc_urb_state_ddma(hcd, hc, qtd,
++							   dma_desc,
++							   halt_status, n_bytes,
++							   &xfer_done);
++
++			if (failed
++			    || (xfer_done
++				&& (urb->status != -DWC_E_IN_PROGRESS))) {
++
++				hcd->fops->complete(hcd, urb->priv, urb,
++						    urb->status);
++				dwc_otg_hcd_qtd_remove_and_free(hcd, qtd, qh);
++
++				if (failed)
++					goto stop_scan;
++			} else if (qh->ep_type == UE_CONTROL) {
++				if (qtd->control_phase == DWC_OTG_CONTROL_SETUP) {
++					if (urb->length > 0) {
++						qtd->control_phase = DWC_OTG_CONTROL_DATA;
++					} else {
++						qtd->control_phase = DWC_OTG_CONTROL_STATUS;
++					}
++					DWC_DEBUGPL(DBG_HCDV, "  Control setup transaction done\n");
++				} else if (qtd->control_phase == DWC_OTG_CONTROL_DATA) {
++					if (xfer_done) {
++						qtd->control_phase = DWC_OTG_CONTROL_STATUS;
++						DWC_DEBUGPL(DBG_HCDV, "  Control data transfer done\n");
++					} else if (i + 1 == qtd->n_desc) {
++						/*
++						 * Last descriptor for Control data stage which is
++						 * not completed yet.
++						 */
++						dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++					}
++				}
++			}
++
++			n_desc++;
++		}
++
++	}
++
++stop_scan:
++
++	if (qh->ep_type != UE_CONTROL) {
++		/*
++		 * Resetting the data toggle for bulk
++		 * and interrupt endpoints in case of stall. See handle_hc_stall_intr()
++		 */
++		if (halt_status == DWC_OTG_HC_XFER_STALL)
++			qh->data_toggle = DWC_OTG_HC_PID_DATA0;
++		else
++			dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++	}
++
++	if (halt_status == DWC_OTG_HC_XFER_COMPLETE) {
++		hcint_data_t hcint;
++		hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++		if (hcint.b.nyet) {
++			/*
++			 * Got a NYET on the last transaction of the transfer. It
++			 * means that the endpoint should be in the PING state at the
++			 * beginning of the next transfer.
++			 */
++			qh->ping_state = 1;
++			clear_hc_int(hc_regs, nyet);
++		}
++
++	}
++
++}
++
++/**
++ * This function is called from interrupt handlers.
++ * Scans the descriptor list, updates URB's status and
++ * calls completion routine for the URB if it's done.
++ * Releases the channel to be used by other transfers.
++ * In case of Isochronous endpoint the channel is not halted until
++ * the end of the session, i.e. QTD list is empty.
++ * If periodic channel released the FrameList is updated accordingly.
++ *
++ * Calls transaction selection routines to activate pending transfers.
++ *
++ * @param hcd The HCD state structure for the DWC OTG controller.
++ * @param hc Host channel, the transfer is completed on.
++ * @param hc_regs Host channel registers.
++ * @param halt_status Reason the channel is being halted,
++ *		      or just XferComplete for isochronous transfer
++ */
++void dwc_otg_hcd_complete_xfer_ddma(dwc_otg_hcd_t * hcd,
++				    dwc_hc_t * hc,
++				    dwc_otg_hc_regs_t * hc_regs,
++				    dwc_otg_halt_status_e halt_status)
++{
++	uint8_t continue_isoc_xfer = 0;
++	dwc_otg_transaction_type_e tr_type;
++	dwc_otg_qh_t *qh = hc->qh;
++
++	if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
++
++		complete_isoc_xfer_ddma(hcd, hc, hc_regs, halt_status);
++
++		/* Release the channel if halted or session completed */
++		if (halt_status != DWC_OTG_HC_XFER_COMPLETE ||
++		    DWC_CIRCLEQ_EMPTY(&qh->qtd_list)) {
++
++			/* Halt the channel if session completed */
++			if (halt_status == DWC_OTG_HC_XFER_COMPLETE) {
++				dwc_otg_hc_halt(hcd->core_if, hc, halt_status);
++			}
++
++			release_channel_ddma(hcd, qh);
++			dwc_otg_hcd_qh_remove(hcd, qh);
++		} else {
++			/* Keep in assigned schedule to continue transfer */
++			DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_assigned,
++					   &qh->qh_list_entry);
++			continue_isoc_xfer = 1;
++
++		}
++		/** @todo Consider the case when period exceeds FrameList size.
++		 *  Frame Rollover interrupt should be used.
++		 */
++	} else {
++		/* Scan descriptor list to complete the URB(s), then release the channel */
++		complete_non_isoc_xfer_ddma(hcd, hc, hc_regs, halt_status);
++
++		release_channel_ddma(hcd, qh);
++		dwc_otg_hcd_qh_remove(hcd, qh);
++
++		if (!DWC_CIRCLEQ_EMPTY(&qh->qtd_list)) {
++			/* Add back to inactive non-periodic schedule on normal completion */
++			dwc_otg_hcd_qh_add(hcd, qh);
++		}
++
++	}
++	tr_type = dwc_otg_hcd_select_transactions(hcd);
++	if (tr_type != DWC_OTG_TRANSACTION_NONE || continue_isoc_xfer) {
++		if (continue_isoc_xfer) {
++			if (tr_type == DWC_OTG_TRANSACTION_NONE) {
++				tr_type = DWC_OTG_TRANSACTION_PERIODIC;
++			} else if (tr_type == DWC_OTG_TRANSACTION_NON_PERIODIC) {
++				tr_type = DWC_OTG_TRANSACTION_ALL;
++			}
++		}
++		dwc_otg_hcd_queue_transactions(hcd, tr_type);
++	}
++}
++
++#endif /* DWC_DEVICE_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h
+@@ -0,0 +1,421 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd_if.h $
++ * $Revision: #12 $
++ * $Date: 2011/10/26 $
++ * $Change: 1873028 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_DEVICE_ONLY
++#ifndef __DWC_HCD_IF_H__
++#define __DWC_HCD_IF_H__
++
++#include "dwc_otg_core_if.h"
++
++/** @file
++ * This file defines DWC_OTG HCD Core API.
++ */
++
++struct dwc_otg_hcd;
++typedef struct dwc_otg_hcd dwc_otg_hcd_t;
++
++struct dwc_otg_hcd_urb;
++typedef struct dwc_otg_hcd_urb dwc_otg_hcd_urb_t;
++
++/** @name HCD Function Driver Callbacks */
++/** @{ */
++
++/** This function is called whenever core switches to host mode. */
++typedef int (*dwc_otg_hcd_start_cb_t) (dwc_otg_hcd_t * hcd);
++
++/** This function is called when device has been disconnected */
++typedef int (*dwc_otg_hcd_disconnect_cb_t) (dwc_otg_hcd_t * hcd);
++
++/** Wrapper provides this function to HCD to core, so it can get hub information to which device is connected */
++typedef int (*dwc_otg_hcd_hub_info_from_urb_cb_t) (dwc_otg_hcd_t * hcd,
++						   void *urb_handle,
++						   uint32_t * hub_addr,
++						   uint32_t * port_addr);
++/** Via this function HCD core gets device speed */
++typedef int (*dwc_otg_hcd_speed_from_urb_cb_t) (dwc_otg_hcd_t * hcd,
++						void *urb_handle);
++
++/** This function is called when urb is completed */
++typedef int (*dwc_otg_hcd_complete_urb_cb_t) (dwc_otg_hcd_t * hcd,
++					      void *urb_handle,
++					      dwc_otg_hcd_urb_t * dwc_otg_urb,
++					      int32_t status);
++
++/** Via this function HCD core gets b_hnp_enable parameter */
++typedef int (*dwc_otg_hcd_get_b_hnp_enable) (dwc_otg_hcd_t * hcd);
++
++struct dwc_otg_hcd_function_ops {
++	dwc_otg_hcd_start_cb_t start;
++	dwc_otg_hcd_disconnect_cb_t disconnect;
++	dwc_otg_hcd_hub_info_from_urb_cb_t hub_info;
++	dwc_otg_hcd_speed_from_urb_cb_t speed;
++	dwc_otg_hcd_complete_urb_cb_t complete;
++	dwc_otg_hcd_get_b_hnp_enable get_b_hnp_enable;
++};
++/** @} */
++
++/** @name HCD Core API */
++/** @{ */
++/** This function allocates dwc_otg_hcd structure and returns pointer on it. */
++extern dwc_otg_hcd_t *dwc_otg_hcd_alloc_hcd(void);
++
++/** This function should be called to initiate HCD Core.
++ *
++ * @param hcd The HCD
++ * @param core_if The DWC_OTG Core
++ *
++ * Returns -DWC_E_NO_MEMORY if no enough memory.
++ * Returns 0 on success
++ */
++extern int dwc_otg_hcd_init(dwc_otg_hcd_t * hcd, dwc_otg_core_if_t * core_if);
++
++/** Frees HCD
++ *
++ * @param hcd The HCD
++ */
++extern void dwc_otg_hcd_remove(dwc_otg_hcd_t * hcd);
++
++/** This function should be called on every hardware interrupt.
++ *
++ * @param dwc_otg_hcd The HCD
++ *
++ * Returns non zero if interrupt is handled
++ * Return 0 if interrupt is not handled
++ */
++extern int32_t dwc_otg_hcd_handle_intr(dwc_otg_hcd_t * dwc_otg_hcd);
++
++/** This function is used to handle the fast interrupt
++ *
++ */
++#ifdef CONFIG_ARM64
++extern void dwc_otg_hcd_handle_fiq(void);
++#else
++extern void __attribute__ ((naked)) dwc_otg_hcd_handle_fiq(void);
++#endif
++
++/**
++ * Returns private data set by
++ * dwc_otg_hcd_set_priv_data function.
++ *
++ * @param hcd The HCD
++ */
++extern void *dwc_otg_hcd_get_priv_data(dwc_otg_hcd_t * hcd);
++
++/**
++ * Set private data.
++ *
++ * @param hcd The HCD
++ * @param priv_data pointer to be stored in private data
++ */
++extern void dwc_otg_hcd_set_priv_data(dwc_otg_hcd_t * hcd, void *priv_data);
++
++/**
++ * This function initializes the HCD Core.
++ *
++ * @param hcd The HCD
++ * @param fops The Function Driver Operations data structure containing pointers to all callbacks.
++ *
++ * Returns -DWC_E_NO_DEVICE if Core is currently is in device mode.
++ * Returns 0 on success
++ */
++extern int dwc_otg_hcd_start(dwc_otg_hcd_t * hcd,
++			     struct dwc_otg_hcd_function_ops *fops);
++
++/**
++ * Halts the DWC_otg host mode operations in a clean manner. USB transfers are
++ * stopped.
++ *
++ * @param hcd The HCD
++ */
++extern void dwc_otg_hcd_stop(dwc_otg_hcd_t * hcd);
++
++/**
++ * Handles hub class-specific requests.
++ *
++ * @param dwc_otg_hcd The HCD
++ * @param typeReq Request Type
++ * @param wValue wValue from control request
++ * @param wIndex wIndex from control request
++ * @param buf data buffer
++ * @param wLength data buffer length
++ *
++ * Returns -DWC_E_INVALID if invalid argument is passed
++ * Returns 0 on success
++ */
++extern int dwc_otg_hcd_hub_control(dwc_otg_hcd_t * dwc_otg_hcd,
++				   uint16_t typeReq, uint16_t wValue,
++				   uint16_t wIndex, uint8_t * buf,
++				   uint16_t wLength);
++
++/**
++ * Returns otg port number.
++ *
++ * @param hcd The HCD
++ */
++extern uint32_t dwc_otg_hcd_otg_port(dwc_otg_hcd_t * hcd);
++
++/**
++ * Returns OTG version - either 1.3 or 2.0.
++ *
++ * @param core_if The core_if structure pointer
++ */
++extern uint16_t dwc_otg_get_otg_version(dwc_otg_core_if_t * core_if);
++
++/**
++ * Returns 1 if currently core is acting as B host, and 0 otherwise.
++ *
++ * @param hcd The HCD
++ */
++extern uint32_t dwc_otg_hcd_is_b_host(dwc_otg_hcd_t * hcd);
++
++/**
++ * Returns current frame number.
++ *
++ * @param hcd The HCD
++ */
++extern int dwc_otg_hcd_get_frame_number(dwc_otg_hcd_t * hcd);
++
++/**
++ * Dumps hcd state.
++ *
++ * @param hcd The HCD
++ */
++extern void dwc_otg_hcd_dump_state(dwc_otg_hcd_t * hcd);
++
++/**
++ * Dump the average frame remaining at SOF. This can be used to
++ * determine average interrupt latency. Frame remaining is also shown for
++ * start transfer and two additional sample points.
++ * Currently this function is not implemented.
++ *
++ * @param hcd The HCD
++ */
++extern void dwc_otg_hcd_dump_frrem(dwc_otg_hcd_t * hcd);
++
++/**
++ * Sends LPM transaction to the local device.
++ *
++ * @param hcd The HCD
++ * @param devaddr Device Address
++ * @param hird Host initiated resume duration
++ * @param bRemoteWake Value of bRemoteWake field in LPM transaction
++ *
++ * Returns negative value if sending LPM transaction was not succeeded.
++ * Returns 0 on success.
++ */
++extern int dwc_otg_hcd_send_lpm(dwc_otg_hcd_t * hcd, uint8_t devaddr,
++				uint8_t hird, uint8_t bRemoteWake);
++
++/* URB interface */
++
++/**
++ * Allocates memory for dwc_otg_hcd_urb structure.
++ * Allocated memory should be freed by call of DWC_FREE.
++ *
++ * @param hcd The HCD
++ * @param iso_desc_count Count of ISOC descriptors
++ * @param atomic_alloc Specefies whether to perform atomic allocation.
++ */
++extern dwc_otg_hcd_urb_t *dwc_otg_hcd_urb_alloc(dwc_otg_hcd_t * hcd,
++						int iso_desc_count,
++						int atomic_alloc);
++
++/**
++ * Set pipe information in URB.
++ *
++ * @param hcd_urb DWC_OTG URB
++ * @param devaddr Device Address
++ * @param ep_num Endpoint Number
++ * @param ep_type Endpoint Type
++ * @param ep_dir Endpoint Direction
++ * @param mps Max Packet Size
++ */
++extern void dwc_otg_hcd_urb_set_pipeinfo(dwc_otg_hcd_urb_t * hcd_urb,
++					 uint8_t devaddr, uint8_t ep_num,
++					 uint8_t ep_type, uint8_t ep_dir,
++					 uint16_t mps);
++
++/* Transfer flags */
++#define URB_GIVEBACK_ASAP 0x1
++#define URB_SEND_ZERO_PACKET 0x2
++
++/**
++ * Sets dwc_otg_hcd_urb parameters.
++ *
++ * @param urb DWC_OTG URB allocated by dwc_otg_hcd_urb_alloc function.
++ * @param urb_handle Unique handle for request, this will be passed back
++ * to function driver in completion callback.
++ * @param buf The buffer for the data
++ * @param dma The DMA buffer for the data
++ * @param buflen Transfer length
++ * @param sp Buffer for setup data
++ * @param sp_dma DMA address of setup data buffer
++ * @param flags Transfer flags
++ * @param interval Polling interval for interrupt or isochronous transfers.
++ */
++extern void dwc_otg_hcd_urb_set_params(dwc_otg_hcd_urb_t * urb,
++				       void *urb_handle, void *buf,
++				       dwc_dma_t dma, uint32_t buflen, void *sp,
++				       dwc_dma_t sp_dma, uint32_t flags,
++				       uint16_t interval);
++
++/** Gets status from dwc_otg_hcd_urb
++ *
++ * @param dwc_otg_urb DWC_OTG URB
++ */
++extern uint32_t dwc_otg_hcd_urb_get_status(dwc_otg_hcd_urb_t * dwc_otg_urb);
++
++/** Gets actual length from dwc_otg_hcd_urb
++ *
++ * @param dwc_otg_urb DWC_OTG URB
++ */
++extern uint32_t dwc_otg_hcd_urb_get_actual_length(dwc_otg_hcd_urb_t *
++						  dwc_otg_urb);
++
++/** Gets error count from dwc_otg_hcd_urb. Only for ISOC URBs
++ *
++ * @param dwc_otg_urb DWC_OTG URB
++ */
++extern uint32_t dwc_otg_hcd_urb_get_error_count(dwc_otg_hcd_urb_t *
++						dwc_otg_urb);
++
++/** Set ISOC descriptor offset and length
++ *
++ * @param dwc_otg_urb DWC_OTG URB
++ * @param desc_num ISOC descriptor number
++ * @param offset Offset from beginig of buffer.
++ * @param length Transaction length
++ */
++extern void dwc_otg_hcd_urb_set_iso_desc_params(dwc_otg_hcd_urb_t * dwc_otg_urb,
++						int desc_num, uint32_t offset,
++						uint32_t length);
++
++/** Get status of ISOC descriptor, specified by desc_num
++ *
++ * @param dwc_otg_urb DWC_OTG URB
++ * @param desc_num ISOC descriptor number
++ */
++extern uint32_t dwc_otg_hcd_urb_get_iso_desc_status(dwc_otg_hcd_urb_t *
++						    dwc_otg_urb, int desc_num);
++
++/** Get actual length of ISOC descriptor, specified by desc_num
++ *
++ * @param dwc_otg_urb DWC_OTG URB
++ * @param desc_num ISOC descriptor number
++ */
++extern uint32_t dwc_otg_hcd_urb_get_iso_desc_actual_length(dwc_otg_hcd_urb_t *
++							   dwc_otg_urb,
++							   int desc_num);
++
++/** Queue URB. After transfer is completes, the complete callback will be called with the URB status
++ *
++ * @param dwc_otg_hcd The HCD
++ * @param dwc_otg_urb DWC_OTG URB
++ * @param ep_handle Out parameter for returning endpoint handle
++ * @param atomic_alloc Flag to do atomic allocation if needed
++ *
++ * Returns -DWC_E_NO_DEVICE if no device is connected.
++ * Returns -DWC_E_NO_MEMORY if there is no enough memory.
++ * Returns 0 on success.
++ */
++extern int dwc_otg_hcd_urb_enqueue(dwc_otg_hcd_t * dwc_otg_hcd,
++				   dwc_otg_hcd_urb_t * dwc_otg_urb,
++				   void **ep_handle, int atomic_alloc);
++
++/** De-queue the specified URB
++ *
++ * @param dwc_otg_hcd The HCD
++ * @param dwc_otg_urb DWC_OTG URB
++ */
++extern int dwc_otg_hcd_urb_dequeue(dwc_otg_hcd_t * dwc_otg_hcd,
++				   dwc_otg_hcd_urb_t * dwc_otg_urb);
++
++/** Frees resources in the DWC_otg controller related to a given endpoint.
++ * Any URBs for the endpoint must already be dequeued.
++ *
++ * @param hcd The HCD
++ * @param ep_handle Endpoint handle, returned by dwc_otg_hcd_urb_enqueue function
++ * @param retry Number of retries if there are queued transfers.
++ *
++ * Returns -DWC_E_INVALID if invalid arguments are passed.
++ * Returns 0 on success
++ */
++extern int dwc_otg_hcd_endpoint_disable(dwc_otg_hcd_t * hcd, void *ep_handle,
++					int retry);
++
++/* Resets the data toggle in qh structure. This function can be called from
++ * usb_clear_halt routine.
++ *
++ * @param hcd The HCD
++ * @param ep_handle Endpoint handle, returned by dwc_otg_hcd_urb_enqueue function
++ *
++ * Returns -DWC_E_INVALID if invalid arguments are passed.
++ * Returns 0 on success
++ */
++extern int dwc_otg_hcd_endpoint_reset(dwc_otg_hcd_t * hcd, void *ep_handle);
++
++/** Returns 1 if status of specified port is changed and 0 otherwise.
++ *
++ * @param hcd The HCD
++ * @param port Port number
++ */
++extern int dwc_otg_hcd_is_status_changed(dwc_otg_hcd_t * hcd, int port);
++
++/** Call this function to check if bandwidth was allocated for specified endpoint.
++ * Only for ISOC and INTERRUPT endpoints.
++ *
++ * @param hcd The HCD
++ * @param ep_handle Endpoint handle
++ */
++extern int dwc_otg_hcd_is_bandwidth_allocated(dwc_otg_hcd_t * hcd,
++					      void *ep_handle);
++
++/** Call this function to check if bandwidth was freed for specified endpoint.
++ *
++ * @param hcd The HCD
++ * @param ep_handle Endpoint handle
++ */
++extern int dwc_otg_hcd_is_bandwidth_freed(dwc_otg_hcd_t * hcd, void *ep_handle);
++
++/** Returns bandwidth allocated for specified endpoint in microseconds.
++ * Only for ISOC and INTERRUPT endpoints.
++ *
++ * @param hcd The HCD
++ * @param ep_handle Endpoint handle
++ */
++extern uint8_t dwc_otg_hcd_get_ep_bandwidth(dwc_otg_hcd_t * hcd,
++					    void *ep_handle);
++
++/** @} */
++
++#endif /* __DWC_HCD_IF_H__ */
++#endif /* DWC_DEVICE_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c
+@@ -0,0 +1,2757 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd_intr.c $
++ * $Revision: #89 $
++ * $Date: 2011/10/20 $
++ * $Change: 1869487 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_DEVICE_ONLY
++
++#include "dwc_otg_hcd.h"
++#include "dwc_otg_regs.h"
++
++#include <linux/jiffies.h>
++#ifdef CONFIG_ARM
++#include <asm/fiq.h>
++#endif
++
++extern bool microframe_schedule;
++
++/** @file
++ * This file contains the implementation of the HCD Interrupt handlers.
++ */
++
++int fiq_done, int_done;
++
++#ifdef FIQ_DEBUG
++char buffer[1000*16];
++int wptr;
++void notrace _fiq_print(FIQDBG_T dbg_lvl, char *fmt, ...)
++{
++	FIQDBG_T dbg_lvl_req = FIQDBG_PORTHUB;
++	va_list args;
++	char text[17];
++	hfnum_data_t hfnum = { .d32 = FIQ_READ(dwc_regs_base + 0x408) };
++
++	if(dbg_lvl & dbg_lvl_req || dbg_lvl == FIQDBG_ERR)
++	{
++		local_fiq_disable();
++		snprintf(text, 9, "%4d%d:%d ", hfnum.b.frnum/8, hfnum.b.frnum%8, 8 - hfnum.b.frrem/937);
++		va_start(args, fmt);
++		vsnprintf(text+8, 9, fmt, args);
++		va_end(args);
++
++		memcpy(buffer + wptr, text, 16);
++		wptr = (wptr + 16) % sizeof(buffer);
++		local_fiq_enable();
++	}
++}
++#endif
++
++/** This function handles interrupts for the HCD. */
++int32_t dwc_otg_hcd_handle_intr(dwc_otg_hcd_t * dwc_otg_hcd)
++{
++	int retval = 0;
++	static int last_time;
++	dwc_otg_core_if_t *core_if = dwc_otg_hcd->core_if;
++	gintsts_data_t gintsts;
++	gintmsk_data_t gintmsk;
++	hfnum_data_t hfnum;
++	haintmsk_data_t haintmsk;
++
++#ifdef DEBUG
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++
++#endif
++
++	gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++	gintmsk.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
++
++	/* Exit from ISR if core is hibernated */
++	if (core_if->hibernation_suspend == 1) {
++		goto exit_handler_routine;
++	}
++	DWC_SPINLOCK(dwc_otg_hcd->lock);
++	/* Check if HOST Mode */
++	if (dwc_otg_is_host_mode(core_if)) {
++		if (fiq_enable) {
++			local_fiq_disable();
++			fiq_fsm_spin_lock(&dwc_otg_hcd->fiq_state->lock);
++			/* Pull in from the FIQ's disabled mask */
++			gintmsk.d32 = gintmsk.d32 | ~(dwc_otg_hcd->fiq_state->gintmsk_saved.d32);
++			dwc_otg_hcd->fiq_state->gintmsk_saved.d32 = ~0;
++		}
++
++		if (fiq_fsm_enable && ( 0x0000FFFF & ~(dwc_otg_hcd->fiq_state->haintmsk_saved.b2.chint))) {
++			gintsts.b.hcintr = 1;
++		}
++
++		/* Danger will robinson: fake a SOF if necessary */
++		if (fiq_fsm_enable && (dwc_otg_hcd->fiq_state->gintmsk_saved.b.sofintr == 1)) {
++			gintsts.b.sofintr = 1;
++		}
++		gintsts.d32 &= gintmsk.d32;
++
++		if (fiq_enable) {
++			fiq_fsm_spin_unlock(&dwc_otg_hcd->fiq_state->lock);
++			local_fiq_enable();
++		}
++
++		if (!gintsts.d32) {
++			goto exit_handler_routine;
++		}
++
++#ifdef DEBUG
++		// We should be OK doing this because the common interrupts should already have been serviced
++		/* Don't print debug message in the interrupt handler on SOF */
++#ifndef DEBUG_SOF
++		if (gintsts.d32 != DWC_SOF_INTR_MASK)
++#endif
++			DWC_DEBUGPL(DBG_HCDI, "\n");
++#endif
++
++#ifdef DEBUG
++#ifndef DEBUG_SOF
++		if (gintsts.d32 != DWC_SOF_INTR_MASK)
++#endif
++			DWC_DEBUGPL(DBG_HCDI,
++				    "DWC OTG HCD Interrupt Detected gintsts&gintmsk=0x%08x core_if=%p\n",
++				    gintsts.d32, core_if);
++#endif
++		hfnum.d32 = DWC_READ_REG32(&dwc_otg_hcd->core_if->host_if->host_global_regs->hfnum);
++		if (gintsts.b.sofintr) {
++			retval |= dwc_otg_hcd_handle_sof_intr(dwc_otg_hcd);
++		}
++
++		if (gintsts.b.rxstsqlvl) {
++			retval |=
++			    dwc_otg_hcd_handle_rx_status_q_level_intr
++			    (dwc_otg_hcd);
++		}
++		if (gintsts.b.nptxfempty) {
++			retval |=
++			    dwc_otg_hcd_handle_np_tx_fifo_empty_intr
++			    (dwc_otg_hcd);
++		}
++		if (gintsts.b.i2cintr) {
++			/** @todo Implement i2cintr handler. */
++		}
++		if (gintsts.b.portintr) {
++
++			gintmsk_data_t gintmsk = { .b.portintr = 1};
++			retval |= dwc_otg_hcd_handle_port_intr(dwc_otg_hcd);
++			if (fiq_enable) {
++				local_fiq_disable();
++				fiq_fsm_spin_lock(&dwc_otg_hcd->fiq_state->lock);
++				DWC_MODIFY_REG32(&dwc_otg_hcd->core_if->core_global_regs->gintmsk, 0, gintmsk.d32);
++				fiq_fsm_spin_unlock(&dwc_otg_hcd->fiq_state->lock);
++				local_fiq_enable();
++			} else {
++				DWC_MODIFY_REG32(&dwc_otg_hcd->core_if->core_global_regs->gintmsk, 0, gintmsk.d32);
++			}
++		}
++		if (gintsts.b.hcintr) {
++			retval |= dwc_otg_hcd_handle_hc_intr(dwc_otg_hcd);
++		}
++		if (gintsts.b.ptxfempty) {
++			retval |=
++			    dwc_otg_hcd_handle_perio_tx_fifo_empty_intr
++			    (dwc_otg_hcd);
++		}
++#ifdef DEBUG
++#ifndef DEBUG_SOF
++		if (gintsts.d32 != DWC_SOF_INTR_MASK)
++#endif
++		{
++			DWC_DEBUGPL(DBG_HCDI,
++				    "DWC OTG HCD Finished Servicing Interrupts\n");
++			DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD gintsts=0x%08x\n",
++				    DWC_READ_REG32(&global_regs->gintsts));
++			DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD gintmsk=0x%08x\n",
++				    DWC_READ_REG32(&global_regs->gintmsk));
++		}
++#endif
++
++#ifdef DEBUG
++#ifndef DEBUG_SOF
++		if (gintsts.d32 != DWC_SOF_INTR_MASK)
++#endif
++			DWC_DEBUGPL(DBG_HCDI, "\n");
++#endif
++
++	}
++
++exit_handler_routine:
++	if (fiq_enable)	{
++		gintmsk_data_t gintmsk_new;
++		haintmsk_data_t haintmsk_new;
++		local_fiq_disable();
++		fiq_fsm_spin_lock(&dwc_otg_hcd->fiq_state->lock);
++		gintmsk_new.d32 = *(volatile uint32_t *)&dwc_otg_hcd->fiq_state->gintmsk_saved.d32;
++		if(fiq_fsm_enable)
++			haintmsk_new.d32 = *(volatile uint32_t *)&dwc_otg_hcd->fiq_state->haintmsk_saved.d32;
++		else
++			haintmsk_new.d32 = 0x0000FFFF;
++
++		/* The FIQ could have sneaked another interrupt in. If so, don't clear MPHI */
++		if ((gintmsk_new.d32 == ~0) && (haintmsk_new.d32 == 0x0000FFFF)) {
++			if (dwc_otg_hcd->fiq_state->mphi_regs.swirq_clr) {
++				DWC_WRITE_REG32(dwc_otg_hcd->fiq_state->mphi_regs.swirq_clr, 1);
++			} else {
++				DWC_WRITE_REG32(dwc_otg_hcd->fiq_state->mphi_regs.intstat, (1<<16));
++			}
++			if (dwc_otg_hcd->fiq_state->mphi_int_count >= 50) {
++				fiq_print(FIQDBG_INT, dwc_otg_hcd->fiq_state, "MPHI CLR");
++					DWC_WRITE_REG32(dwc_otg_hcd->fiq_state->mphi_regs.ctrl, ((1<<31) + (1<<16)));
++					while (!(DWC_READ_REG32(dwc_otg_hcd->fiq_state->mphi_regs.ctrl) & (1 << 17)))
++						;
++					DWC_WRITE_REG32(dwc_otg_hcd->fiq_state->mphi_regs.ctrl, (1<<31));
++					dwc_otg_hcd->fiq_state->mphi_int_count = 0;
++			}
++			int_done++;
++		}
++		haintmsk.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->haintmsk);
++		/* Re-enable interrupts that the FIQ masked (first time round) */
++		FIQ_WRITE(dwc_otg_hcd->fiq_state->dwc_regs_base + GINTMSK, gintmsk.d32);
++		fiq_fsm_spin_unlock(&dwc_otg_hcd->fiq_state->lock);
++		local_fiq_enable();
++
++		if ((jiffies / HZ) > last_time) {
++			//dwc_otg_qh_t *qh;
++			//dwc_list_link_t *cur;
++			/* Once a second output the fiq and irq numbers, useful for debug */
++			last_time = jiffies / HZ;
++		//	 DWC_WARN("np_kick=%d AHC=%d sched_frame=%d cur_frame=%d int_done=%d fiq_done=%d",
++		//	dwc_otg_hcd->fiq_state->kick_np_queues, dwc_otg_hcd->available_host_channels,
++		//	dwc_otg_hcd->fiq_state->next_sched_frame, hfnum.b.frnum, int_done, dwc_otg_hcd->fiq_state->fiq_done);
++			 //printk(KERN_WARNING "Periodic queues:\n");
++		}
++	}
++
++	DWC_SPINUNLOCK(dwc_otg_hcd->lock);
++	return retval;
++}
++
++#ifdef DWC_TRACK_MISSED_SOFS
++
++#warning Compiling code to track missed SOFs
++#define FRAME_NUM_ARRAY_SIZE 1000
++/**
++ * This function is for debug only.
++ */
++static inline void track_missed_sofs(uint16_t curr_frame_number)
++{
++	static uint16_t frame_num_array[FRAME_NUM_ARRAY_SIZE];
++	static uint16_t last_frame_num_array[FRAME_NUM_ARRAY_SIZE];
++	static int frame_num_idx = 0;
++	static uint16_t last_frame_num = DWC_HFNUM_MAX_FRNUM;
++	static int dumped_frame_num_array = 0;
++
++	if (frame_num_idx < FRAME_NUM_ARRAY_SIZE) {
++		if (((last_frame_num + 1) & DWC_HFNUM_MAX_FRNUM) !=
++		    curr_frame_number) {
++			frame_num_array[frame_num_idx] = curr_frame_number;
++			last_frame_num_array[frame_num_idx++] = last_frame_num;
++		}
++	} else if (!dumped_frame_num_array) {
++		int i;
++		DWC_PRINTF("Frame     Last Frame\n");
++		DWC_PRINTF("-----     ----------\n");
++		for (i = 0; i < FRAME_NUM_ARRAY_SIZE; i++) {
++			DWC_PRINTF("0x%04x    0x%04x\n",
++				   frame_num_array[i], last_frame_num_array[i]);
++		}
++		dumped_frame_num_array = 1;
++	}
++	last_frame_num = curr_frame_number;
++}
++#endif
++
++/**
++ * Handles the start-of-frame interrupt in host mode. Non-periodic
++ * transactions may be queued to the DWC_otg controller for the current
++ * (micro)frame. Periodic transactions may be queued to the controller for the
++ * next (micro)frame.
++ */
++int32_t dwc_otg_hcd_handle_sof_intr(dwc_otg_hcd_t * hcd)
++{
++	hfnum_data_t hfnum;
++	gintsts_data_t gintsts = { .d32 = 0 };
++	dwc_list_link_t *qh_entry;
++	dwc_otg_qh_t *qh;
++	dwc_otg_transaction_type_e tr_type;
++	int did_something = 0;
++	int32_t next_sched_frame = -1;
++
++	hfnum.d32 =
++	    DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hfnum);
++
++#ifdef DEBUG_SOF
++	DWC_DEBUGPL(DBG_HCD, "--Start of Frame Interrupt--\n");
++#endif
++	hcd->frame_number = hfnum.b.frnum;
++
++#ifdef DEBUG
++	hcd->frrem_accum += hfnum.b.frrem;
++	hcd->frrem_samples++;
++#endif
++
++#ifdef DWC_TRACK_MISSED_SOFS
++	track_missed_sofs(hcd->frame_number);
++#endif
++	/* Determine whether any periodic QHs should be executed. */
++	qh_entry = DWC_LIST_FIRST(&hcd->periodic_sched_inactive);
++	while (qh_entry != &hcd->periodic_sched_inactive) {
++		qh = DWC_LIST_ENTRY(qh_entry, dwc_otg_qh_t, qh_list_entry);
++		qh_entry = qh_entry->next;
++		if (dwc_frame_num_le(qh->sched_frame, hcd->frame_number)) {
++
++			/*
++			 * Move QH to the ready list to be executed next
++			 * (micro)frame.
++			 */
++			DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_ready,
++					   &qh->qh_list_entry);
++
++			did_something = 1;
++		}
++		else
++		{
++			if(next_sched_frame < 0 || dwc_frame_num_le(qh->sched_frame, next_sched_frame))
++			{
++				next_sched_frame = qh->sched_frame;
++			}
++		}
++	}
++	if (fiq_enable)
++		hcd->fiq_state->next_sched_frame = next_sched_frame;
++
++	tr_type = dwc_otg_hcd_select_transactions(hcd);
++	if (tr_type != DWC_OTG_TRANSACTION_NONE) {
++		dwc_otg_hcd_queue_transactions(hcd, tr_type);
++		did_something = 1;
++	}
++
++	/* Clear interrupt - but do not trample on the FIQ sof */
++	if (!fiq_fsm_enable) {
++		gintsts.b.sofintr = 1;
++		DWC_WRITE_REG32(&hcd->core_if->core_global_regs->gintsts, gintsts.d32);
++	}
++	return 1;
++}
++
++/** Handles the Rx Status Queue Level Interrupt, which indicates that there is at
++ * least one packet in the Rx FIFO.  The packets are moved from the FIFO to
++ * memory if the DWC_otg controller is operating in Slave mode. */
++int32_t dwc_otg_hcd_handle_rx_status_q_level_intr(dwc_otg_hcd_t * dwc_otg_hcd)
++{
++	host_grxsts_data_t grxsts;
++	dwc_hc_t *hc = NULL;
++
++	DWC_DEBUGPL(DBG_HCD, "--RxStsQ Level Interrupt--\n");
++
++	grxsts.d32 =
++	    DWC_READ_REG32(&dwc_otg_hcd->core_if->core_global_regs->grxstsp);
++
++	hc = dwc_otg_hcd->hc_ptr_array[grxsts.b.chnum];
++	if (!hc) {
++		DWC_ERROR("Unable to get corresponding channel\n");
++		return 0;
++	}
++
++	/* Packet Status */
++	DWC_DEBUGPL(DBG_HCDV, "    Ch num = %d\n", grxsts.b.chnum);
++	DWC_DEBUGPL(DBG_HCDV, "    Count = %d\n", grxsts.b.bcnt);
++	DWC_DEBUGPL(DBG_HCDV, "    DPID = %d, hc.dpid = %d\n", grxsts.b.dpid,
++		    hc->data_pid_start);
++	DWC_DEBUGPL(DBG_HCDV, "    PStatus = %d\n", grxsts.b.pktsts);
++
++	switch (grxsts.b.pktsts) {
++	case DWC_GRXSTS_PKTSTS_IN:
++		/* Read the data into the host buffer. */
++		if (grxsts.b.bcnt > 0) {
++			dwc_otg_read_packet(dwc_otg_hcd->core_if,
++					    hc->xfer_buff, grxsts.b.bcnt);
++
++			/* Update the HC fields for the next packet received. */
++			hc->xfer_count += grxsts.b.bcnt;
++			hc->xfer_buff += grxsts.b.bcnt;
++		}
++
++	case DWC_GRXSTS_PKTSTS_IN_XFER_COMP:
++	case DWC_GRXSTS_PKTSTS_DATA_TOGGLE_ERR:
++	case DWC_GRXSTS_PKTSTS_CH_HALTED:
++		/* Handled in interrupt, just ignore data */
++		break;
++	default:
++		DWC_ERROR("RX_STS_Q Interrupt: Unknown status %d\n",
++			  grxsts.b.pktsts);
++		break;
++	}
++
++	return 1;
++}
++
++/** This interrupt occurs when the non-periodic Tx FIFO is half-empty. More
++ * data packets may be written to the FIFO for OUT transfers. More requests
++ * may be written to the non-periodic request queue for IN transfers. This
++ * interrupt is enabled only in Slave mode. */
++int32_t dwc_otg_hcd_handle_np_tx_fifo_empty_intr(dwc_otg_hcd_t * dwc_otg_hcd)
++{
++	DWC_DEBUGPL(DBG_HCD, "--Non-Periodic TxFIFO Empty Interrupt--\n");
++	dwc_otg_hcd_queue_transactions(dwc_otg_hcd,
++				       DWC_OTG_TRANSACTION_NON_PERIODIC);
++	return 1;
++}
++
++/** This interrupt occurs when the periodic Tx FIFO is half-empty. More data
++ * packets may be written to the FIFO for OUT transfers. More requests may be
++ * written to the periodic request queue for IN transfers. This interrupt is
++ * enabled only in Slave mode. */
++int32_t dwc_otg_hcd_handle_perio_tx_fifo_empty_intr(dwc_otg_hcd_t * dwc_otg_hcd)
++{
++	DWC_DEBUGPL(DBG_HCD, "--Periodic TxFIFO Empty Interrupt--\n");
++	dwc_otg_hcd_queue_transactions(dwc_otg_hcd,
++				       DWC_OTG_TRANSACTION_PERIODIC);
++	return 1;
++}
++
++/** There are multiple conditions that can cause a port interrupt. This function
++ * determines which interrupt conditions have occurred and handles them
++ * appropriately. */
++int32_t dwc_otg_hcd_handle_port_intr(dwc_otg_hcd_t * dwc_otg_hcd)
++{
++	int retval = 0;
++	hprt0_data_t hprt0;
++	hprt0_data_t hprt0_modify;
++
++	hprt0.d32 = DWC_READ_REG32(dwc_otg_hcd->core_if->host_if->hprt0);
++	hprt0_modify.d32 = DWC_READ_REG32(dwc_otg_hcd->core_if->host_if->hprt0);
++
++	/* Clear appropriate bits in HPRT0 to clear the interrupt bit in
++	 * GINTSTS */
++
++	hprt0_modify.b.prtena = 0;
++	hprt0_modify.b.prtconndet = 0;
++	hprt0_modify.b.prtenchng = 0;
++	hprt0_modify.b.prtovrcurrchng = 0;
++
++	/* Port Connect Detected
++	 * Set flag and clear if detected */
++	if (dwc_otg_hcd->core_if->hibernation_suspend == 1) {
++		// Dont modify port status if we are in hibernation state
++		hprt0_modify.b.prtconndet = 1;
++		hprt0_modify.b.prtenchng = 1;
++		DWC_WRITE_REG32(dwc_otg_hcd->core_if->host_if->hprt0, hprt0_modify.d32);
++		hprt0.d32 = DWC_READ_REG32(dwc_otg_hcd->core_if->host_if->hprt0);
++		return retval;
++	}
++
++	if (hprt0.b.prtconndet) {
++		/** @todo - check if steps performed in 'else' block should be perfromed regardles adp */
++		if (dwc_otg_hcd->core_if->adp_enable &&
++				dwc_otg_hcd->core_if->adp.vbuson_timer_started == 1) {
++			DWC_PRINTF("PORT CONNECT DETECTED ----------------\n");
++			DWC_TIMER_CANCEL(dwc_otg_hcd->core_if->adp.vbuson_timer);
++			dwc_otg_hcd->core_if->adp.vbuson_timer_started = 0;
++			/* TODO - check if this is required, as
++			 * host initialization was already performed
++			 * after initial ADP probing
++			 */
++			/*dwc_otg_hcd->core_if->adp.vbuson_timer_started = 0;
++			dwc_otg_core_init(dwc_otg_hcd->core_if);
++			dwc_otg_enable_global_interrupts(dwc_otg_hcd->core_if);
++			cil_hcd_start(dwc_otg_hcd->core_if);*/
++		} else {
++
++			DWC_DEBUGPL(DBG_HCD, "--Port Interrupt HPRT0=0x%08x "
++				    "Port Connect Detected--\n", hprt0.d32);
++			dwc_otg_hcd->flags.b.port_connect_status_change = 1;
++			dwc_otg_hcd->flags.b.port_connect_status = 1;
++			hprt0_modify.b.prtconndet = 1;
++
++			/* B-Device has connected, Delete the connection timer. */
++			DWC_TIMER_CANCEL(dwc_otg_hcd->conn_timer);
++		}
++		/* The Hub driver asserts a reset when it sees port connect
++		 * status change flag */
++		retval |= 1;
++	}
++
++	/* Port Enable Changed
++	 * Clear if detected - Set internal flag if disabled */
++	if (hprt0.b.prtenchng) {
++		DWC_DEBUGPL(DBG_HCD, "  --Port Interrupt HPRT0=0x%08x "
++			    "Port Enable Changed--\n", hprt0.d32);
++		hprt0_modify.b.prtenchng = 1;
++		if (hprt0.b.prtena == 1) {
++			hfir_data_t hfir;
++			int do_reset = 0;
++			dwc_otg_core_params_t *params =
++			    dwc_otg_hcd->core_if->core_params;
++			dwc_otg_core_global_regs_t *global_regs =
++			    dwc_otg_hcd->core_if->core_global_regs;
++			dwc_otg_host_if_t *host_if =
++			    dwc_otg_hcd->core_if->host_if;
++
++			dwc_otg_hcd->flags.b.port_speed = hprt0.b.prtspd;
++			if (microframe_schedule)
++				init_hcd_usecs(dwc_otg_hcd);
++
++			/* Every time when port enables calculate
++			 * HFIR.FrInterval
++			 */
++			hfir.d32 = DWC_READ_REG32(&host_if->host_global_regs->hfir);
++			hfir.b.frint = calc_frame_interval(dwc_otg_hcd->core_if);
++			DWC_WRITE_REG32(&host_if->host_global_regs->hfir, hfir.d32);
++
++			/* Check if we need to adjust the PHY clock speed for
++			 * low power and adjust it */
++			if (params->host_support_fs_ls_low_power) {
++				gusbcfg_data_t usbcfg;
++
++				usbcfg.d32 =
++				    DWC_READ_REG32(&global_regs->gusbcfg);
++
++				if (hprt0.b.prtspd == DWC_HPRT0_PRTSPD_LOW_SPEED
++				    || hprt0.b.prtspd ==
++				    DWC_HPRT0_PRTSPD_FULL_SPEED) {
++					/*
++					 * Low power
++					 */
++					hcfg_data_t hcfg;
++					if (usbcfg.b.phylpwrclksel == 0) {
++						/* Set PHY low power clock select for FS/LS devices */
++						usbcfg.b.phylpwrclksel = 1;
++						DWC_WRITE_REG32
++						    (&global_regs->gusbcfg,
++						     usbcfg.d32);
++						do_reset = 1;
++					}
++
++					hcfg.d32 =
++					    DWC_READ_REG32
++					    (&host_if->host_global_regs->hcfg);
++
++					if (hprt0.b.prtspd ==
++					    DWC_HPRT0_PRTSPD_LOW_SPEED
++					    && params->host_ls_low_power_phy_clk
++					    ==
++					    DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_6MHZ)
++					{
++						/* 6 MHZ */
++						DWC_DEBUGPL(DBG_CIL,
++							    "FS_PHY programming HCFG to 6 MHz (Low Power)\n");
++						if (hcfg.b.fslspclksel !=
++						    DWC_HCFG_6_MHZ) {
++							hcfg.b.fslspclksel =
++							    DWC_HCFG_6_MHZ;
++							DWC_WRITE_REG32
++							    (&host_if->host_global_regs->hcfg,
++							     hcfg.d32);
++							do_reset = 1;
++						}
++					} else {
++						/* 48 MHZ */
++						DWC_DEBUGPL(DBG_CIL,
++							    "FS_PHY programming HCFG to 48 MHz ()\n");
++						if (hcfg.b.fslspclksel !=
++						    DWC_HCFG_48_MHZ) {
++							hcfg.b.fslspclksel =
++							    DWC_HCFG_48_MHZ;
++							DWC_WRITE_REG32
++							    (&host_if->host_global_regs->hcfg,
++							     hcfg.d32);
++							do_reset = 1;
++						}
++					}
++				} else {
++					/*
++					 * Not low power
++					 */
++					if (usbcfg.b.phylpwrclksel == 1) {
++						usbcfg.b.phylpwrclksel = 0;
++						DWC_WRITE_REG32
++						    (&global_regs->gusbcfg,
++						     usbcfg.d32);
++						do_reset = 1;
++					}
++				}
++
++				if (do_reset) {
++					DWC_TASK_SCHEDULE(dwc_otg_hcd->reset_tasklet);
++				}
++			}
++
++			if (!do_reset) {
++				/* Port has been enabled set the reset change flag */
++				dwc_otg_hcd->flags.b.port_reset_change = 1;
++			}
++		} else {
++			dwc_otg_hcd->flags.b.port_enable_change = 1;
++		}
++		retval |= 1;
++	}
++
++	/** Overcurrent Change Interrupt */
++	if (hprt0.b.prtovrcurrchng) {
++		DWC_DEBUGPL(DBG_HCD, "  --Port Interrupt HPRT0=0x%08x "
++			    "Port Overcurrent Changed--\n", hprt0.d32);
++		dwc_otg_hcd->flags.b.port_over_current_change = 1;
++		hprt0_modify.b.prtovrcurrchng = 1;
++		retval |= 1;
++	}
++
++	/* Clear Port Interrupts */
++	DWC_WRITE_REG32(dwc_otg_hcd->core_if->host_if->hprt0, hprt0_modify.d32);
++
++	return retval;
++}
++
++/** This interrupt indicates that one or more host channels has a pending
++ * interrupt. There are multiple conditions that can cause each host channel
++ * interrupt. This function determines which conditions have occurred for each
++ * host channel interrupt and handles them appropriately. */
++int32_t dwc_otg_hcd_handle_hc_intr(dwc_otg_hcd_t * dwc_otg_hcd)
++{
++	int i;
++	int retval = 0;
++	haint_data_t haint = { .d32 = 0 } ;
++
++	/* Clear appropriate bits in HCINTn to clear the interrupt bit in
++	 * GINTSTS */
++
++	if (!fiq_fsm_enable)
++		haint.d32 = dwc_otg_read_host_all_channels_intr(dwc_otg_hcd->core_if);
++
++	// Overwrite with saved interrupts from fiq handler
++	if(fiq_fsm_enable)
++	{
++		/* check the mask? */
++		local_fiq_disable();
++		fiq_fsm_spin_lock(&dwc_otg_hcd->fiq_state->lock);
++		haint.b2.chint |= ~(dwc_otg_hcd->fiq_state->haintmsk_saved.b2.chint);
++		dwc_otg_hcd->fiq_state->haintmsk_saved.b2.chint = ~0;
++		fiq_fsm_spin_unlock(&dwc_otg_hcd->fiq_state->lock);
++		local_fiq_enable();
++	}
++
++	for (i = 0; i < dwc_otg_hcd->core_if->core_params->host_channels; i++) {
++		if (haint.b2.chint & (1 << i)) {
++			retval |= dwc_otg_hcd_handle_hc_n_intr(dwc_otg_hcd, i);
++		}
++	}
++
++	return retval;
++}
++
++/**
++ * Gets the actual length of a transfer after the transfer halts. _halt_status
++ * holds the reason for the halt.
++ *
++ * For IN transfers where halt_status is DWC_OTG_HC_XFER_COMPLETE,
++ * *short_read is set to 1 upon return if less than the requested
++ * number of bytes were transferred. Otherwise, *short_read is set to 0 upon
++ * return. short_read may also be NULL on entry, in which case it remains
++ * unchanged.
++ */
++static uint32_t get_actual_xfer_length(dwc_hc_t * hc,
++				       dwc_otg_hc_regs_t * hc_regs,
++				       dwc_otg_qtd_t * qtd,
++				       dwc_otg_halt_status_e halt_status,
++				       int *short_read)
++{
++	hctsiz_data_t hctsiz;
++	uint32_t length;
++
++	if (short_read != NULL) {
++		*short_read = 0;
++	}
++	hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
++
++	if (halt_status == DWC_OTG_HC_XFER_COMPLETE) {
++		if (hc->ep_is_in) {
++			length = hc->xfer_len - hctsiz.b.xfersize;
++			if (short_read != NULL) {
++				*short_read = (hctsiz.b.xfersize != 0);
++			}
++		} else if (hc->qh->do_split) {
++				//length = split_out_xfersize[hc->hc_num];
++				length = qtd->ssplit_out_xfer_count;
++		} else {
++			length = hc->xfer_len;
++		}
++	} else {
++		/*
++		 * Must use the hctsiz.pktcnt field to determine how much data
++		 * has been transferred. This field reflects the number of
++		 * packets that have been transferred via the USB. This is
++		 * always an integral number of packets if the transfer was
++		 * halted before its normal completion. (Can't use the
++		 * hctsiz.xfersize field because that reflects the number of
++		 * bytes transferred via the AHB, not the USB).
++		 */
++		length =
++		    (hc->start_pkt_count - hctsiz.b.pktcnt) * hc->max_packet;
++	}
++
++	return length;
++}
++
++/**
++ * Updates the state of the URB after a Transfer Complete interrupt on the
++ * host channel. Updates the actual_length field of the URB based on the
++ * number of bytes transferred via the host channel. Sets the URB status
++ * if the data transfer is finished.
++ *
++ * @return 1 if the data transfer specified by the URB is completely finished,
++ * 0 otherwise.
++ */
++static int update_urb_state_xfer_comp(dwc_hc_t * hc,
++				      dwc_otg_hc_regs_t * hc_regs,
++				      dwc_otg_hcd_urb_t * urb,
++				      dwc_otg_qtd_t * qtd)
++{
++	int xfer_done = 0;
++	int short_read = 0;
++
++	int xfer_length;
++
++	xfer_length = get_actual_xfer_length(hc, hc_regs, qtd,
++					     DWC_OTG_HC_XFER_COMPLETE,
++					     &short_read);
++
++	if (urb->actual_length + xfer_length > urb->length) {
++		printk_once(KERN_DEBUG "dwc_otg: DEVICE:%03d : %s:%d:trimming xfer length\n",
++			hc->dev_addr, __func__, __LINE__);
++		xfer_length = urb->length - urb->actual_length;
++	}
++
++	/* non DWORD-aligned buffer case handling. */
++	if (hc->align_buff && xfer_length && hc->ep_is_in) {
++		dwc_memcpy(urb->buf + urb->actual_length, hc->qh->dw_align_buf,
++			   xfer_length);
++	}
++
++	urb->actual_length += xfer_length;
++
++	if (xfer_length && (hc->ep_type == DWC_OTG_EP_TYPE_BULK) &&
++	    (urb->flags & URB_SEND_ZERO_PACKET)
++	    && (urb->actual_length == urb->length)
++	    && !(urb->length % hc->max_packet)) {
++		xfer_done = 0;
++	} else if (short_read || urb->actual_length >= urb->length) {
++		xfer_done = 1;
++		urb->status = 0;
++	}
++
++#ifdef DEBUG
++	{
++		hctsiz_data_t hctsiz;
++		hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
++		DWC_DEBUGPL(DBG_HCDV, "DWC_otg: %s: %s, channel %d\n",
++			    __func__, (hc->ep_is_in ? "IN" : "OUT"),
++			    hc->hc_num);
++		DWC_DEBUGPL(DBG_HCDV, "  hc->xfer_len %d\n", hc->xfer_len);
++		DWC_DEBUGPL(DBG_HCDV, "  hctsiz.xfersize %d\n",
++			    hctsiz.b.xfersize);
++		DWC_DEBUGPL(DBG_HCDV, "  urb->transfer_buffer_length %d\n",
++			    urb->length);
++		DWC_DEBUGPL(DBG_HCDV, "  urb->actual_length %d\n",
++			    urb->actual_length);
++		DWC_DEBUGPL(DBG_HCDV, "  short_read %d, xfer_done %d\n",
++			    short_read, xfer_done);
++	}
++#endif
++
++	return xfer_done;
++}
++
++/*
++ * Save the starting data toggle for the next transfer. The data toggle is
++ * saved in the QH for non-control transfers and it's saved in the QTD for
++ * control transfers.
++ */
++void dwc_otg_hcd_save_data_toggle(dwc_hc_t * hc,
++			     dwc_otg_hc_regs_t * hc_regs, dwc_otg_qtd_t * qtd)
++{
++	hctsiz_data_t hctsiz;
++	hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
++
++	if (hc->ep_type != DWC_OTG_EP_TYPE_CONTROL) {
++		dwc_otg_qh_t *qh = hc->qh;
++		if (hctsiz.b.pid == DWC_HCTSIZ_DATA0) {
++			qh->data_toggle = DWC_OTG_HC_PID_DATA0;
++		} else {
++			qh->data_toggle = DWC_OTG_HC_PID_DATA1;
++		}
++	} else {
++		if (hctsiz.b.pid == DWC_HCTSIZ_DATA0) {
++			qtd->data_toggle = DWC_OTG_HC_PID_DATA0;
++		} else {
++			qtd->data_toggle = DWC_OTG_HC_PID_DATA1;
++		}
++	}
++}
++
++/**
++ * Updates the state of an Isochronous URB when the transfer is stopped for
++ * any reason. The fields of the current entry in the frame descriptor array
++ * are set based on the transfer state and the input _halt_status. Completes
++ * the Isochronous URB if all the URB frames have been completed.
++ *
++ * @return DWC_OTG_HC_XFER_COMPLETE if there are more frames remaining to be
++ * transferred in the URB. Otherwise return DWC_OTG_HC_XFER_URB_COMPLETE.
++ */
++static dwc_otg_halt_status_e
++update_isoc_urb_state(dwc_otg_hcd_t * hcd,
++		      dwc_hc_t * hc,
++		      dwc_otg_hc_regs_t * hc_regs,
++		      dwc_otg_qtd_t * qtd, dwc_otg_halt_status_e halt_status)
++{
++	dwc_otg_hcd_urb_t *urb = qtd->urb;
++	dwc_otg_halt_status_e ret_val = halt_status;
++	struct dwc_otg_hcd_iso_packet_desc *frame_desc;
++
++	frame_desc = &urb->iso_descs[qtd->isoc_frame_index];
++	switch (halt_status) {
++	case DWC_OTG_HC_XFER_COMPLETE:
++		frame_desc->status = 0;
++		frame_desc->actual_length =
++		    get_actual_xfer_length(hc, hc_regs, qtd, halt_status, NULL);
++
++		/* non DWORD-aligned buffer case handling. */
++		if (hc->align_buff && frame_desc->actual_length && hc->ep_is_in) {
++			dwc_memcpy(urb->buf + frame_desc->offset + qtd->isoc_split_offset,
++				   hc->qh->dw_align_buf, frame_desc->actual_length);
++		}
++
++		break;
++	case DWC_OTG_HC_XFER_FRAME_OVERRUN:
++		urb->error_count++;
++		if (hc->ep_is_in) {
++			frame_desc->status = -DWC_E_NO_STREAM_RES;
++		} else {
++			frame_desc->status = -DWC_E_COMMUNICATION;
++		}
++		frame_desc->actual_length = 0;
++		break;
++	case DWC_OTG_HC_XFER_BABBLE_ERR:
++		urb->error_count++;
++		frame_desc->status = -DWC_E_OVERFLOW;
++		/* Don't need to update actual_length in this case. */
++		break;
++	case DWC_OTG_HC_XFER_XACT_ERR:
++		urb->error_count++;
++		frame_desc->status = -DWC_E_PROTOCOL;
++		frame_desc->actual_length =
++		    get_actual_xfer_length(hc, hc_regs, qtd, halt_status, NULL);
++
++		/* non DWORD-aligned buffer case handling. */
++		if (hc->align_buff && frame_desc->actual_length && hc->ep_is_in) {
++			dwc_memcpy(urb->buf + frame_desc->offset + qtd->isoc_split_offset,
++				   hc->qh->dw_align_buf, frame_desc->actual_length);
++		}
++		/* Skip whole frame */
++		if (hc->qh->do_split && (hc->ep_type == DWC_OTG_EP_TYPE_ISOC) &&
++		    hc->ep_is_in && hcd->core_if->dma_enable) {
++			qtd->complete_split = 0;
++			qtd->isoc_split_offset = 0;
++		}
++
++		break;
++	default:
++		DWC_ASSERT(1, "Unhandled _halt_status (%d)\n", halt_status);
++		break;
++	}
++	if (++qtd->isoc_frame_index == urb->packet_count) {
++		/*
++		 * urb->status is not used for isoc transfers.
++		 * The individual frame_desc statuses are used instead.
++		 */
++		hcd->fops->complete(hcd, urb->priv, urb, 0);
++		ret_val = DWC_OTG_HC_XFER_URB_COMPLETE;
++	} else {
++		ret_val = DWC_OTG_HC_XFER_COMPLETE;
++	}
++	return ret_val;
++}
++
++/**
++ * Frees the first QTD in the QH's list if free_qtd is 1. For non-periodic
++ * QHs, removes the QH from the active non-periodic schedule. If any QTDs are
++ * still linked to the QH, the QH is added to the end of the inactive
++ * non-periodic schedule. For periodic QHs, removes the QH from the periodic
++ * schedule if no more QTDs are linked to the QH.
++ */
++static void deactivate_qh(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh, int free_qtd)
++{
++	int continue_split = 0;
++	dwc_otg_qtd_t *qtd;
++
++	DWC_DEBUGPL(DBG_HCDV, "  %s(%p,%p,%d)\n", __func__, hcd, qh, free_qtd);
++
++	qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
++
++	if (qtd->complete_split) {
++		continue_split = 1;
++	} else if (qtd->isoc_split_pos == DWC_HCSPLIT_XACTPOS_MID ||
++		   qtd->isoc_split_pos == DWC_HCSPLIT_XACTPOS_END) {
++		continue_split = 1;
++	}
++
++	if (free_qtd) {
++		dwc_otg_hcd_qtd_remove_and_free(hcd, qtd, qh);
++		continue_split = 0;
++	}
++
++	qh->channel = NULL;
++	dwc_otg_hcd_qh_deactivate(hcd, qh, continue_split);
++}
++
++/**
++ * Releases a host channel for use by other transfers. Attempts to select and
++ * queue more transactions since at least one host channel is available.
++ *
++ * @param hcd The HCD state structure.
++ * @param hc The host channel to release.
++ * @param qtd The QTD associated with the host channel. This QTD may be freed
++ * if the transfer is complete or an error has occurred.
++ * @param halt_status Reason the channel is being released. This status
++ * determines the actions taken by this function.
++ */
++static void release_channel(dwc_otg_hcd_t * hcd,
++			    dwc_hc_t * hc,
++			    dwc_otg_qtd_t * qtd,
++			    dwc_otg_halt_status_e halt_status)
++{
++	dwc_otg_transaction_type_e tr_type;
++	int free_qtd;
++
++	int hog_port = 0;
++
++	DWC_DEBUGPL(DBG_HCDV, "  %s: channel %d, halt_status %d, xfer_len %d\n",
++		    __func__, hc->hc_num, halt_status, hc->xfer_len);
++
++	if(fiq_fsm_enable && hc->do_split) {
++		if(!hc->ep_is_in && hc->ep_type == UE_ISOCHRONOUS) {
++			if(hc->xact_pos == DWC_HCSPLIT_XACTPOS_MID ||
++					hc->xact_pos == DWC_HCSPLIT_XACTPOS_BEGIN) {
++				hog_port = 0;
++			}
++		}
++	}
++
++	switch (halt_status) {
++	case DWC_OTG_HC_XFER_URB_COMPLETE:
++		free_qtd = 1;
++		break;
++	case DWC_OTG_HC_XFER_AHB_ERR:
++	case DWC_OTG_HC_XFER_STALL:
++	case DWC_OTG_HC_XFER_BABBLE_ERR:
++		free_qtd = 1;
++		break;
++	case DWC_OTG_HC_XFER_XACT_ERR:
++		if (qtd->error_count >= 3) {
++			DWC_DEBUGPL(DBG_HCDV,
++				    "  Complete URB with transaction error\n");
++			free_qtd = 1;
++			qtd->urb->status = -DWC_E_PROTOCOL;
++			hcd->fops->complete(hcd, qtd->urb->priv,
++					    qtd->urb, -DWC_E_PROTOCOL);
++		} else {
++			free_qtd = 0;
++		}
++		break;
++	case DWC_OTG_HC_XFER_URB_DEQUEUE:
++		/*
++		 * The QTD has already been removed and the QH has been
++		 * deactivated. Don't want to do anything except release the
++		 * host channel and try to queue more transfers.
++		 */
++		goto cleanup;
++	case DWC_OTG_HC_XFER_NO_HALT_STATUS:
++		free_qtd = 0;
++		break;
++	case DWC_OTG_HC_XFER_PERIODIC_INCOMPLETE:
++		DWC_DEBUGPL(DBG_HCDV,
++			"  Complete URB with I/O error\n");
++		free_qtd = 1;
++		qtd->urb->status = -DWC_E_IO;
++		hcd->fops->complete(hcd, qtd->urb->priv,
++			qtd->urb, -DWC_E_IO);
++		break;
++	default:
++		free_qtd = 0;
++		break;
++	}
++
++	deactivate_qh(hcd, hc->qh, free_qtd);
++
++cleanup:
++	/*
++	 * Release the host channel for use by other transfers. The cleanup
++	 * function clears the channel interrupt enables and conditions, so
++	 * there's no need to clear the Channel Halted interrupt separately.
++	 */
++	if (fiq_fsm_enable && hcd->fiq_state->channel[hc->hc_num].fsm != FIQ_PASSTHROUGH)
++		dwc_otg_cleanup_fiq_channel(hcd, hc->hc_num);
++	dwc_otg_hc_cleanup(hcd->core_if, hc);
++	DWC_CIRCLEQ_INSERT_TAIL(&hcd->free_hc_list, hc, hc_list_entry);
++
++	if (!microframe_schedule) {
++		switch (hc->ep_type) {
++		case DWC_OTG_EP_TYPE_CONTROL:
++		case DWC_OTG_EP_TYPE_BULK:
++			hcd->non_periodic_channels--;
++			break;
++
++		default:
++			/*
++			 * Don't release reservations for periodic channels here.
++			 * That's done when a periodic transfer is descheduled (i.e.
++			 * when the QH is removed from the periodic schedule).
++			 */
++			break;
++		}
++	} else {
++		hcd->available_host_channels++;
++		fiq_print(FIQDBG_INT, hcd->fiq_state, "AHC = %d ", hcd->available_host_channels);
++	}
++
++	/* Try to queue more transfers now that there's a free channel. */
++	tr_type = dwc_otg_hcd_select_transactions(hcd);
++	if (tr_type != DWC_OTG_TRANSACTION_NONE) {
++		dwc_otg_hcd_queue_transactions(hcd, tr_type);
++	}
++}
++
++/**
++ * Halts a host channel. If the channel cannot be halted immediately because
++ * the request queue is full, this function ensures that the FIFO empty
++ * interrupt for the appropriate queue is enabled so that the halt request can
++ * be queued when there is space in the request queue.
++ *
++ * This function may also be called in DMA mode. In that case, the channel is
++ * simply released since the core always halts the channel automatically in
++ * DMA mode.
++ */
++static void halt_channel(dwc_otg_hcd_t * hcd,
++			 dwc_hc_t * hc,
++			 dwc_otg_qtd_t * qtd, dwc_otg_halt_status_e halt_status)
++{
++	if (hcd->core_if->dma_enable) {
++		release_channel(hcd, hc, qtd, halt_status);
++		return;
++	}
++
++	/* Slave mode processing... */
++	dwc_otg_hc_halt(hcd->core_if, hc, halt_status);
++
++	if (hc->halt_on_queue) {
++		gintmsk_data_t gintmsk = {.d32 = 0 };
++		dwc_otg_core_global_regs_t *global_regs;
++		global_regs = hcd->core_if->core_global_regs;
++
++		if (hc->ep_type == DWC_OTG_EP_TYPE_CONTROL ||
++		    hc->ep_type == DWC_OTG_EP_TYPE_BULK) {
++			/*
++			 * Make sure the Non-periodic Tx FIFO empty interrupt
++			 * is enabled so that the non-periodic schedule will
++			 * be processed.
++			 */
++			gintmsk.b.nptxfempty = 1;
++			if (fiq_enable) {
++				local_fiq_disable();
++				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
++				DWC_MODIFY_REG32(&global_regs->gintmsk, 0, gintmsk.d32);
++				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
++				local_fiq_enable();
++			} else {
++				DWC_MODIFY_REG32(&global_regs->gintmsk, 0, gintmsk.d32);
++			}
++		} else {
++			/*
++			 * Move the QH from the periodic queued schedule to
++			 * the periodic assigned schedule. This allows the
++			 * halt to be queued when the periodic schedule is
++			 * processed.
++			 */
++			DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_assigned,
++					   &hc->qh->qh_list_entry);
++
++			/*
++			 * Make sure the Periodic Tx FIFO Empty interrupt is
++			 * enabled so that the periodic schedule will be
++			 * processed.
++			 */
++			gintmsk.b.ptxfempty = 1;
++			if (fiq_enable) {
++				local_fiq_disable();
++				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
++				DWC_MODIFY_REG32(&global_regs->gintmsk, 0, gintmsk.d32);
++				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
++				local_fiq_enable();
++			} else {
++				DWC_MODIFY_REG32(&global_regs->gintmsk, 0, gintmsk.d32);
++			}
++		}
++	}
++}
++
++/**
++ * Performs common cleanup for non-periodic transfers after a Transfer
++ * Complete interrupt. This function should be called after any endpoint type
++ * specific handling is finished to release the host channel.
++ */
++static void complete_non_periodic_xfer(dwc_otg_hcd_t * hcd,
++				       dwc_hc_t * hc,
++				       dwc_otg_hc_regs_t * hc_regs,
++				       dwc_otg_qtd_t * qtd,
++				       dwc_otg_halt_status_e halt_status)
++{
++	hcint_data_t hcint;
++
++	qtd->error_count = 0;
++
++	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++	if (hcint.b.nyet) {
++		/*
++		 * Got a NYET on the last transaction of the transfer. This
++		 * means that the endpoint should be in the PING state at the
++		 * beginning of the next transfer.
++		 */
++		hc->qh->ping_state = 1;
++		clear_hc_int(hc_regs, nyet);
++	}
++
++	/*
++	 * Always halt and release the host channel to make it available for
++	 * more transfers. There may still be more phases for a control
++	 * transfer or more data packets for a bulk transfer at this point,
++	 * but the host channel is still halted. A channel will be reassigned
++	 * to the transfer when the non-periodic schedule is processed after
++	 * the channel is released. This allows transactions to be queued
++	 * properly via dwc_otg_hcd_queue_transactions, which also enables the
++	 * Tx FIFO Empty interrupt if necessary.
++	 */
++	if (hc->ep_is_in) {
++		/*
++		 * IN transfers in Slave mode require an explicit disable to
++		 * halt the channel. (In DMA mode, this call simply releases
++		 * the channel.)
++		 */
++		halt_channel(hcd, hc, qtd, halt_status);
++	} else {
++		/*
++		 * The channel is automatically disabled by the core for OUT
++		 * transfers in Slave mode.
++		 */
++		release_channel(hcd, hc, qtd, halt_status);
++	}
++}
++
++/**
++ * Performs common cleanup for periodic transfers after a Transfer Complete
++ * interrupt. This function should be called after any endpoint type specific
++ * handling is finished to release the host channel.
++ */
++static void complete_periodic_xfer(dwc_otg_hcd_t * hcd,
++				   dwc_hc_t * hc,
++				   dwc_otg_hc_regs_t * hc_regs,
++				   dwc_otg_qtd_t * qtd,
++				   dwc_otg_halt_status_e halt_status)
++{
++	hctsiz_data_t hctsiz;
++	qtd->error_count = 0;
++
++	hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
++	if (!hc->ep_is_in || hctsiz.b.pktcnt == 0) {
++		/* Core halts channel in these cases. */
++		release_channel(hcd, hc, qtd, halt_status);
++	} else {
++		/* Flush any outstanding requests from the Tx queue. */
++		halt_channel(hcd, hc, qtd, halt_status);
++	}
++}
++
++static int32_t handle_xfercomp_isoc_split_in(dwc_otg_hcd_t * hcd,
++					     dwc_hc_t * hc,
++					     dwc_otg_hc_regs_t * hc_regs,
++					     dwc_otg_qtd_t * qtd)
++{
++	uint32_t len;
++	struct dwc_otg_hcd_iso_packet_desc *frame_desc;
++	frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
++
++	len = get_actual_xfer_length(hc, hc_regs, qtd,
++				     DWC_OTG_HC_XFER_COMPLETE, NULL);
++
++	if (!len) {
++		qtd->complete_split = 0;
++		qtd->isoc_split_offset = 0;
++		return 0;
++	}
++	frame_desc->actual_length += len;
++
++	if (hc->align_buff && len)
++		dwc_memcpy(qtd->urb->buf + frame_desc->offset +
++			   qtd->isoc_split_offset, hc->qh->dw_align_buf, len);
++	qtd->isoc_split_offset += len;
++
++	if (frame_desc->length == frame_desc->actual_length) {
++		frame_desc->status = 0;
++		qtd->isoc_frame_index++;
++		qtd->complete_split = 0;
++		qtd->isoc_split_offset = 0;
++	}
++
++	if (qtd->isoc_frame_index == qtd->urb->packet_count) {
++		hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
++		release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
++	} else {
++		release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
++	}
++
++	return 1;		/* Indicates that channel released */
++}
++
++/**
++ * Handles a host channel Transfer Complete interrupt. This handler may be
++ * called in either DMA mode or Slave mode.
++ */
++static int32_t handle_hc_xfercomp_intr(dwc_otg_hcd_t * hcd,
++				       dwc_hc_t * hc,
++				       dwc_otg_hc_regs_t * hc_regs,
++				       dwc_otg_qtd_t * qtd)
++{
++	int urb_xfer_done;
++	dwc_otg_halt_status_e halt_status = DWC_OTG_HC_XFER_COMPLETE;
++	dwc_otg_hcd_urb_t *urb = qtd->urb;
++	int pipe_type = dwc_otg_hcd_get_pipe_type(&urb->pipe_info);
++
++	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
++		    "Transfer Complete--\n", hc->hc_num);
++
++	if (hcd->core_if->dma_desc_enable) {
++		dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs, halt_status);
++		if (pipe_type == UE_ISOCHRONOUS) {
++			/* Do not disable the interrupt, just clear it */
++			clear_hc_int(hc_regs, xfercomp);
++			return 1;
++		}
++		goto handle_xfercomp_done;
++	}
++
++	/*
++	 * Handle xfer complete on CSPLIT.
++	 */
++
++	if (hc->qh->do_split) {
++		if ((hc->ep_type == DWC_OTG_EP_TYPE_ISOC) && hc->ep_is_in
++		    && hcd->core_if->dma_enable) {
++			if (qtd->complete_split
++			    && handle_xfercomp_isoc_split_in(hcd, hc, hc_regs,
++							     qtd))
++				goto handle_xfercomp_done;
++		} else {
++			qtd->complete_split = 0;
++		}
++	}
++
++	/* Update the QTD and URB states. */
++	switch (pipe_type) {
++	case UE_CONTROL:
++		switch (qtd->control_phase) {
++		case DWC_OTG_CONTROL_SETUP:
++			if (urb->length > 0) {
++				qtd->control_phase = DWC_OTG_CONTROL_DATA;
++			} else {
++				qtd->control_phase = DWC_OTG_CONTROL_STATUS;
++			}
++			DWC_DEBUGPL(DBG_HCDV,
++				    "  Control setup transaction done\n");
++			halt_status = DWC_OTG_HC_XFER_COMPLETE;
++			break;
++		case DWC_OTG_CONTROL_DATA:{
++				urb_xfer_done =
++				    update_urb_state_xfer_comp(hc, hc_regs, urb,
++							       qtd);
++				if (urb_xfer_done) {
++					qtd->control_phase =
++					    DWC_OTG_CONTROL_STATUS;
++					DWC_DEBUGPL(DBG_HCDV,
++						    "  Control data transfer done\n");
++				} else {
++					dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++				}
++				halt_status = DWC_OTG_HC_XFER_COMPLETE;
++				break;
++			}
++		case DWC_OTG_CONTROL_STATUS:
++			DWC_DEBUGPL(DBG_HCDV, "  Control transfer complete\n");
++			if (urb->status == -DWC_E_IN_PROGRESS) {
++				urb->status = 0;
++			}
++			hcd->fops->complete(hcd, urb->priv, urb, urb->status);
++			halt_status = DWC_OTG_HC_XFER_URB_COMPLETE;
++			break;
++		}
++
++		complete_non_periodic_xfer(hcd, hc, hc_regs, qtd, halt_status);
++		break;
++	case UE_BULK:
++		DWC_DEBUGPL(DBG_HCDV, "  Bulk transfer complete\n");
++		urb_xfer_done =
++		    update_urb_state_xfer_comp(hc, hc_regs, urb, qtd);
++		if (urb_xfer_done) {
++			hcd->fops->complete(hcd, urb->priv, urb, urb->status);
++			halt_status = DWC_OTG_HC_XFER_URB_COMPLETE;
++		} else {
++			halt_status = DWC_OTG_HC_XFER_COMPLETE;
++		}
++
++		dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++		complete_non_periodic_xfer(hcd, hc, hc_regs, qtd, halt_status);
++		break;
++	case UE_INTERRUPT:
++		DWC_DEBUGPL(DBG_HCDV, "  Interrupt transfer complete\n");
++		urb_xfer_done =
++			update_urb_state_xfer_comp(hc, hc_regs, urb, qtd);
++
++		/*
++		 * Interrupt URB is done on the first transfer complete
++		 * interrupt.
++		 */
++		if (urb_xfer_done) {
++				hcd->fops->complete(hcd, urb->priv, urb, urb->status);
++				halt_status = DWC_OTG_HC_XFER_URB_COMPLETE;
++		} else {
++				halt_status = DWC_OTG_HC_XFER_COMPLETE;
++		}
++
++		dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++		complete_periodic_xfer(hcd, hc, hc_regs, qtd, halt_status);
++		break;
++	case UE_ISOCHRONOUS:
++		DWC_DEBUGPL(DBG_HCDV, "  Isochronous transfer complete\n");
++		if (qtd->isoc_split_pos == DWC_HCSPLIT_XACTPOS_ALL) {
++			halt_status =
++			    update_isoc_urb_state(hcd, hc, hc_regs, qtd,
++						  DWC_OTG_HC_XFER_COMPLETE);
++		}
++		complete_periodic_xfer(hcd, hc, hc_regs, qtd, halt_status);
++		break;
++	}
++
++handle_xfercomp_done:
++	disable_hc_int(hc_regs, xfercompl);
++
++	return 1;
++}
++
++/**
++ * Handles a host channel STALL interrupt. This handler may be called in
++ * either DMA mode or Slave mode.
++ */
++static int32_t handle_hc_stall_intr(dwc_otg_hcd_t * hcd,
++				    dwc_hc_t * hc,
++				    dwc_otg_hc_regs_t * hc_regs,
++				    dwc_otg_qtd_t * qtd)
++{
++	dwc_otg_hcd_urb_t *urb = qtd->urb;
++	int pipe_type = dwc_otg_hcd_get_pipe_type(&urb->pipe_info);
++
++	DWC_DEBUGPL(DBG_HCD, "--Host Channel %d Interrupt: "
++		    "STALL Received--\n", hc->hc_num);
++
++	if (hcd->core_if->dma_desc_enable) {
++		dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs, DWC_OTG_HC_XFER_STALL);
++		goto handle_stall_done;
++	}
++
++	if (pipe_type == UE_CONTROL) {
++		hcd->fops->complete(hcd, urb->priv, urb, -DWC_E_PIPE);
++	}
++
++	if (pipe_type == UE_BULK || pipe_type == UE_INTERRUPT) {
++		hcd->fops->complete(hcd, urb->priv, urb, -DWC_E_PIPE);
++		/*
++		 * USB protocol requires resetting the data toggle for bulk
++		 * and interrupt endpoints when a CLEAR_FEATURE(ENDPOINT_HALT)
++		 * setup command is issued to the endpoint. Anticipate the
++		 * CLEAR_FEATURE command since a STALL has occurred and reset
++		 * the data toggle now.
++		 */
++		hc->qh->data_toggle = 0;
++	}
++
++	halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_STALL);
++
++handle_stall_done:
++	disable_hc_int(hc_regs, stall);
++
++	return 1;
++}
++
++/*
++ * Updates the state of the URB when a transfer has been stopped due to an
++ * abnormal condition before the transfer completes. Modifies the
++ * actual_length field of the URB to reflect the number of bytes that have
++ * actually been transferred via the host channel.
++ */
++static void update_urb_state_xfer_intr(dwc_hc_t * hc,
++				       dwc_otg_hc_regs_t * hc_regs,
++				       dwc_otg_hcd_urb_t * urb,
++				       dwc_otg_qtd_t * qtd,
++				       dwc_otg_halt_status_e halt_status)
++{
++	uint32_t bytes_transferred = get_actual_xfer_length(hc, hc_regs, qtd,
++							    halt_status, NULL);
++
++	if (urb->actual_length + bytes_transferred > urb->length) {
++		printk_once(KERN_DEBUG "dwc_otg: DEVICE:%03d : %s:%d:trimming xfer length\n",
++			hc->dev_addr, __func__, __LINE__);
++		bytes_transferred = urb->length - urb->actual_length;
++	}
++
++	/* non DWORD-aligned buffer case handling. */
++	if (hc->align_buff && bytes_transferred && hc->ep_is_in) {
++		dwc_memcpy(urb->buf + urb->actual_length, hc->qh->dw_align_buf,
++			   bytes_transferred);
++	}
++
++	urb->actual_length += bytes_transferred;
++
++#ifdef DEBUG
++	{
++		hctsiz_data_t hctsiz;
++		hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
++		DWC_DEBUGPL(DBG_HCDV, "DWC_otg: %s: %s, channel %d\n",
++			    __func__, (hc->ep_is_in ? "IN" : "OUT"),
++			    hc->hc_num);
++		DWC_DEBUGPL(DBG_HCDV, "  hc->start_pkt_count %d\n",
++			    hc->start_pkt_count);
++		DWC_DEBUGPL(DBG_HCDV, "  hctsiz.pktcnt %d\n", hctsiz.b.pktcnt);
++		DWC_DEBUGPL(DBG_HCDV, "  hc->max_packet %d\n", hc->max_packet);
++		DWC_DEBUGPL(DBG_HCDV, "  bytes_transferred %d\n",
++			    bytes_transferred);
++		DWC_DEBUGPL(DBG_HCDV, "  urb->actual_length %d\n",
++			    urb->actual_length);
++		DWC_DEBUGPL(DBG_HCDV, "  urb->transfer_buffer_length %d\n",
++			    urb->length);
++	}
++#endif
++}
++
++/**
++ * Handles a host channel NAK interrupt. This handler may be called in either
++ * DMA mode or Slave mode.
++ */
++static int32_t handle_hc_nak_intr(dwc_otg_hcd_t * hcd,
++				  dwc_hc_t * hc,
++				  dwc_otg_hc_regs_t * hc_regs,
++				  dwc_otg_qtd_t * qtd)
++{
++	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
++		    "NAK Received--\n", hc->hc_num);
++
++	/*
++	 * When we get bulk NAKs then remember this so we holdoff on this qh until
++	 * the beginning of the next frame
++	 */
++	switch(dwc_otg_hcd_get_pipe_type(&qtd->urb->pipe_info)) {
++		case UE_BULK:
++		case UE_CONTROL:
++		if (nak_holdoff && qtd->qh->do_split)
++			hc->qh->nak_frame = dwc_otg_hcd_get_frame_number(hcd);
++	}
++
++	/*
++	 * Handle NAK for IN/OUT SSPLIT/CSPLIT transfers, bulk, control, and
++	 * interrupt.  Re-start the SSPLIT transfer.
++	 */
++	if (hc->do_split) {
++		if (hc->complete_split) {
++			qtd->error_count = 0;
++		}
++		qtd->complete_split = 0;
++		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NAK);
++		goto handle_nak_done;
++	}
++
++	switch (dwc_otg_hcd_get_pipe_type(&qtd->urb->pipe_info)) {
++	case UE_CONTROL:
++	case UE_BULK:
++		if (hcd->core_if->dma_enable && hc->ep_is_in) {
++			/*
++			 * NAK interrupts are enabled on bulk/control IN
++			 * transfers in DMA mode for the sole purpose of
++			 * resetting the error count after a transaction error
++			 * occurs. The core will continue transferring data.
++			 * Disable other interrupts unmasked for the same
++			 * reason.
++			 */
++			disable_hc_int(hc_regs, datatglerr);
++			disable_hc_int(hc_regs, ack);
++			qtd->error_count = 0;
++			goto handle_nak_done;
++		}
++
++		/*
++		 * NAK interrupts normally occur during OUT transfers in DMA
++		 * or Slave mode. For IN transfers, more requests will be
++		 * queued as request queue space is available.
++		 */
++		qtd->error_count = 0;
++
++		if (!hc->qh->ping_state) {
++			update_urb_state_xfer_intr(hc, hc_regs,
++						   qtd->urb, qtd,
++						   DWC_OTG_HC_XFER_NAK);
++			dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++
++			if (hc->speed == DWC_OTG_EP_SPEED_HIGH)
++				hc->qh->ping_state = 1;
++		}
++
++		/*
++		 * Halt the channel so the transfer can be re-started from
++		 * the appropriate point or the PING protocol will
++		 * start/continue.
++		 */
++		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NAK);
++		break;
++	case UE_INTERRUPT:
++		qtd->error_count = 0;
++		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NAK);
++		break;
++	case UE_ISOCHRONOUS:
++		/* Should never get called for isochronous transfers. */
++		DWC_ASSERT(1, "NACK interrupt for ISOC transfer\n");
++		break;
++	}
++
++handle_nak_done:
++	disable_hc_int(hc_regs, nak);
++
++	return 1;
++}
++
++/**
++ * Handles a host channel ACK interrupt. This interrupt is enabled when
++ * performing the PING protocol in Slave mode, when errors occur during
++ * either Slave mode or DMA mode, and during Start Split transactions.
++ */
++static int32_t handle_hc_ack_intr(dwc_otg_hcd_t * hcd,
++				  dwc_hc_t * hc,
++				  dwc_otg_hc_regs_t * hc_regs,
++				  dwc_otg_qtd_t * qtd)
++{
++	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
++		    "ACK Received--\n", hc->hc_num);
++
++	if (hc->do_split) {
++		/*
++		 * Handle ACK on SSPLIT.
++		 * ACK should not occur in CSPLIT.
++		 */
++		if (!hc->ep_is_in && hc->data_pid_start != DWC_OTG_HC_PID_SETUP) {
++			qtd->ssplit_out_xfer_count = hc->xfer_len;
++		}
++		if (!(hc->ep_type == DWC_OTG_EP_TYPE_ISOC && !hc->ep_is_in)) {
++			/* Don't need complete for isochronous out transfers. */
++			qtd->complete_split = 1;
++		}
++
++		/* ISOC OUT */
++		if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC && !hc->ep_is_in) {
++			switch (hc->xact_pos) {
++			case DWC_HCSPLIT_XACTPOS_ALL:
++				break;
++			case DWC_HCSPLIT_XACTPOS_END:
++				qtd->isoc_split_pos = DWC_HCSPLIT_XACTPOS_ALL;
++				qtd->isoc_split_offset = 0;
++				break;
++			case DWC_HCSPLIT_XACTPOS_BEGIN:
++			case DWC_HCSPLIT_XACTPOS_MID:
++				/*
++				 * For BEGIN or MID, calculate the length for
++				 * the next microframe to determine the correct
++				 * SSPLIT token, either MID or END.
++				 */
++				{
++					struct dwc_otg_hcd_iso_packet_desc
++					*frame_desc;
++
++					frame_desc =
++					    &qtd->urb->
++					    iso_descs[qtd->isoc_frame_index];
++					qtd->isoc_split_offset += 188;
++
++					if ((frame_desc->length -
++					     qtd->isoc_split_offset) <= 188) {
++						qtd->isoc_split_pos =
++						    DWC_HCSPLIT_XACTPOS_END;
++					} else {
++						qtd->isoc_split_pos =
++						    DWC_HCSPLIT_XACTPOS_MID;
++					}
++
++				}
++				break;
++			}
++		} else {
++			halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_ACK);
++		}
++	} else {
++		/*
++		 * An unmasked ACK on a non-split DMA transaction is
++		 * for the sole purpose of resetting error counts. Disable other
++		 * interrupts unmasked for the same reason.
++		 */
++		if(hcd->core_if->dma_enable) {
++			disable_hc_int(hc_regs, datatglerr);
++			disable_hc_int(hc_regs, nak);
++		}
++		qtd->error_count = 0;
++
++		if (hc->qh->ping_state) {
++			hc->qh->ping_state = 0;
++			/*
++			 * Halt the channel so the transfer can be re-started
++			 * from the appropriate point. This only happens in
++			 * Slave mode. In DMA mode, the ping_state is cleared
++			 * when the transfer is started because the core
++			 * automatically executes the PING, then the transfer.
++			 */
++			halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_ACK);
++		}
++	}
++
++	/*
++	 * If the ACK occurred when _not_ in the PING state, let the channel
++	 * continue transferring data after clearing the error count.
++	 */
++
++	disable_hc_int(hc_regs, ack);
++
++	return 1;
++}
++
++/**
++ * Handles a host channel NYET interrupt. This interrupt should only occur on
++ * Bulk and Control OUT endpoints and for complete split transactions. If a
++ * NYET occurs at the same time as a Transfer Complete interrupt, it is
++ * handled in the xfercomp interrupt handler, not here. This handler may be
++ * called in either DMA mode or Slave mode.
++ */
++static int32_t handle_hc_nyet_intr(dwc_otg_hcd_t * hcd,
++				   dwc_hc_t * hc,
++				   dwc_otg_hc_regs_t * hc_regs,
++				   dwc_otg_qtd_t * qtd)
++{
++	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
++		    "NYET Received--\n", hc->hc_num);
++
++	/*
++	 * NYET on CSPLIT
++	 * re-do the CSPLIT immediately on non-periodic
++	 */
++	if (hc->do_split && hc->complete_split) {
++		if (hc->ep_is_in && (hc->ep_type == DWC_OTG_EP_TYPE_ISOC)
++		    && hcd->core_if->dma_enable) {
++			qtd->complete_split = 0;
++			qtd->isoc_split_offset = 0;
++			if (++qtd->isoc_frame_index == qtd->urb->packet_count) {
++				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
++				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
++			}
++			else
++				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
++			goto handle_nyet_done;
++		}
++
++		if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
++		    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
++			int frnum = dwc_otg_hcd_get_frame_number(hcd);
++
++			// With the FIQ running we only ever see the failed NYET
++			if (dwc_full_frame_num(frnum) !=
++			    dwc_full_frame_num(hc->qh->sched_frame) ||
++			    fiq_fsm_enable) {
++				/*
++				 * No longer in the same full speed frame.
++				 * Treat this as a transaction error.
++				 */
++#if 0
++				/** @todo Fix system performance so this can
++				 * be treated as an error. Right now complete
++				 * splits cannot be scheduled precisely enough
++				 * due to other system activity, so this error
++				 * occurs regularly in Slave mode.
++				 */
++				qtd->error_count++;
++#endif
++				qtd->complete_split = 0;
++				halt_channel(hcd, hc, qtd,
++					     DWC_OTG_HC_XFER_XACT_ERR);
++				/** @todo add support for isoc release */
++				goto handle_nyet_done;
++			}
++		}
++
++		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NYET);
++		goto handle_nyet_done;
++	}
++
++	hc->qh->ping_state = 1;
++	qtd->error_count = 0;
++
++	update_urb_state_xfer_intr(hc, hc_regs, qtd->urb, qtd,
++				   DWC_OTG_HC_XFER_NYET);
++	dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++
++	/*
++	 * Halt the channel and re-start the transfer so the PING
++	 * protocol will start.
++	 */
++	halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NYET);
++
++handle_nyet_done:
++	disable_hc_int(hc_regs, nyet);
++	return 1;
++}
++
++/**
++ * Handles a host channel babble interrupt. This handler may be called in
++ * either DMA mode or Slave mode.
++ */
++static int32_t handle_hc_babble_intr(dwc_otg_hcd_t * hcd,
++				     dwc_hc_t * hc,
++				     dwc_otg_hc_regs_t * hc_regs,
++				     dwc_otg_qtd_t * qtd)
++{
++	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
++		    "Babble Error--\n", hc->hc_num);
++
++	if (hcd->core_if->dma_desc_enable) {
++		dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs,
++					       DWC_OTG_HC_XFER_BABBLE_ERR);
++		goto handle_babble_done;
++	}
++
++	if (hc->ep_type != DWC_OTG_EP_TYPE_ISOC) {
++		hcd->fops->complete(hcd, qtd->urb->priv,
++				    qtd->urb, -DWC_E_OVERFLOW);
++		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_BABBLE_ERR);
++	} else {
++		dwc_otg_halt_status_e halt_status;
++		halt_status = update_isoc_urb_state(hcd, hc, hc_regs, qtd,
++						    DWC_OTG_HC_XFER_BABBLE_ERR);
++		halt_channel(hcd, hc, qtd, halt_status);
++	}
++
++handle_babble_done:
++	disable_hc_int(hc_regs, bblerr);
++	return 1;
++}
++
++/**
++ * Handles a host channel AHB error interrupt. This handler is only called in
++ * DMA mode.
++ */
++static int32_t handle_hc_ahberr_intr(dwc_otg_hcd_t * hcd,
++				     dwc_hc_t * hc,
++				     dwc_otg_hc_regs_t * hc_regs,
++				     dwc_otg_qtd_t * qtd)
++{
++	hcchar_data_t hcchar;
++	hcsplt_data_t hcsplt;
++	hctsiz_data_t hctsiz;
++	uint32_t hcdma;
++	char *pipetype, *speed;
++
++	dwc_otg_hcd_urb_t *urb = qtd->urb;
++
++	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
++		    "AHB Error--\n", hc->hc_num);
++
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	hcsplt.d32 = DWC_READ_REG32(&hc_regs->hcsplt);
++	hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
++	hcdma = DWC_READ_REG32(&hc_regs->hcdma);
++
++	DWC_ERROR("AHB ERROR, Channel %d\n", hc->hc_num);
++	DWC_ERROR("  hcchar 0x%08x, hcsplt 0x%08x\n", hcchar.d32, hcsplt.d32);
++	DWC_ERROR("  hctsiz 0x%08x, hcdma 0x%08x\n", hctsiz.d32, hcdma);
++	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD URB Enqueue\n");
++	DWC_ERROR("  Device address: %d\n",
++		  dwc_otg_hcd_get_dev_addr(&urb->pipe_info));
++	DWC_ERROR("  Endpoint: %d, %s\n",
++		  dwc_otg_hcd_get_ep_num(&urb->pipe_info),
++		  (dwc_otg_hcd_is_pipe_in(&urb->pipe_info) ? "IN" : "OUT"));
++
++	switch (dwc_otg_hcd_get_pipe_type(&urb->pipe_info)) {
++	case UE_CONTROL:
++		pipetype = "CONTROL";
++		break;
++	case UE_BULK:
++		pipetype = "BULK";
++		break;
++	case UE_INTERRUPT:
++		pipetype = "INTERRUPT";
++		break;
++	case UE_ISOCHRONOUS:
++		pipetype = "ISOCHRONOUS";
++		break;
++	default:
++		pipetype = "UNKNOWN";
++		break;
++	}
++
++	DWC_ERROR("  Endpoint type: %s\n", pipetype);
++
++	switch (hc->speed) {
++	case DWC_OTG_EP_SPEED_HIGH:
++		speed = "HIGH";
++		break;
++	case DWC_OTG_EP_SPEED_FULL:
++		speed = "FULL";
++		break;
++	case DWC_OTG_EP_SPEED_LOW:
++		speed = "LOW";
++		break;
++	default:
++		speed = "UNKNOWN";
++		break;
++	};
++
++	DWC_ERROR("  Speed: %s\n", speed);
++
++	DWC_ERROR("  Max packet size: %d\n",
++		  dwc_otg_hcd_get_mps(&urb->pipe_info));
++	DWC_ERROR("  Data buffer length: %d\n", urb->length);
++	DWC_ERROR("  Transfer buffer: %p, Transfer DMA: %pad\n",
++		  urb->buf, &urb->dma);
++	DWC_ERROR("  Setup buffer: %p, Setup DMA: %pad\n",
++		  urb->setup_packet, &urb->setup_dma);
++	DWC_ERROR("  Interval: %d\n", urb->interval);
++
++	/* Core haltes the channel for Descriptor DMA mode */
++	if (hcd->core_if->dma_desc_enable) {
++		dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs,
++					       DWC_OTG_HC_XFER_AHB_ERR);
++		goto handle_ahberr_done;
++	}
++
++	hcd->fops->complete(hcd, urb->priv, urb, -DWC_E_IO);
++
++	/*
++	 * Force a channel halt. Don't call halt_channel because that won't
++	 * write to the HCCHARn register in DMA mode to force the halt.
++	 */
++	dwc_otg_hc_halt(hcd->core_if, hc, DWC_OTG_HC_XFER_AHB_ERR);
++handle_ahberr_done:
++	disable_hc_int(hc_regs, ahberr);
++	return 1;
++}
++
++/**
++ * Handles a host channel transaction error interrupt. This handler may be
++ * called in either DMA mode or Slave mode.
++ */
++static int32_t handle_hc_xacterr_intr(dwc_otg_hcd_t * hcd,
++				      dwc_hc_t * hc,
++				      dwc_otg_hc_regs_t * hc_regs,
++				      dwc_otg_qtd_t * qtd)
++{
++	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
++		    "Transaction Error--\n", hc->hc_num);
++
++	if (hcd->core_if->dma_desc_enable) {
++		dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs,
++					       DWC_OTG_HC_XFER_XACT_ERR);
++		goto handle_xacterr_done;
++	}
++
++	switch (dwc_otg_hcd_get_pipe_type(&qtd->urb->pipe_info)) {
++	case UE_CONTROL:
++	case UE_BULK:
++		qtd->error_count++;
++		if (!hc->qh->ping_state) {
++
++			update_urb_state_xfer_intr(hc, hc_regs,
++						   qtd->urb, qtd,
++						   DWC_OTG_HC_XFER_XACT_ERR);
++			dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++			if (!hc->ep_is_in && hc->speed == DWC_OTG_EP_SPEED_HIGH) {
++				hc->qh->ping_state = 1;
++			}
++		}
++
++		/*
++		 * Halt the channel so the transfer can be re-started from
++		 * the appropriate point or the PING protocol will start.
++		 */
++		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_XACT_ERR);
++		break;
++	case UE_INTERRUPT:
++		qtd->error_count++;
++		if (hc->do_split && hc->complete_split) {
++			qtd->complete_split = 0;
++		}
++		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_XACT_ERR);
++		break;
++	case UE_ISOCHRONOUS:
++		{
++			dwc_otg_halt_status_e halt_status;
++			halt_status =
++			    update_isoc_urb_state(hcd, hc, hc_regs, qtd,
++						  DWC_OTG_HC_XFER_XACT_ERR);
++
++			halt_channel(hcd, hc, qtd, halt_status);
++		}
++		break;
++	}
++handle_xacterr_done:
++	disable_hc_int(hc_regs, xacterr);
++
++	return 1;
++}
++
++/**
++ * Handles a host channel frame overrun interrupt. This handler may be called
++ * in either DMA mode or Slave mode.
++ */
++static int32_t handle_hc_frmovrun_intr(dwc_otg_hcd_t * hcd,
++				       dwc_hc_t * hc,
++				       dwc_otg_hc_regs_t * hc_regs,
++				       dwc_otg_qtd_t * qtd)
++{
++	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
++		    "Frame Overrun--\n", hc->hc_num);
++
++	switch (dwc_otg_hcd_get_pipe_type(&qtd->urb->pipe_info)) {
++	case UE_CONTROL:
++	case UE_BULK:
++		break;
++	case UE_INTERRUPT:
++		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_FRAME_OVERRUN);
++		break;
++	case UE_ISOCHRONOUS:
++		{
++			dwc_otg_halt_status_e halt_status;
++			halt_status =
++			    update_isoc_urb_state(hcd, hc, hc_regs, qtd,
++						  DWC_OTG_HC_XFER_FRAME_OVERRUN);
++
++			halt_channel(hcd, hc, qtd, halt_status);
++		}
++		break;
++	}
++
++	disable_hc_int(hc_regs, frmovrun);
++
++	return 1;
++}
++
++/**
++ * Handles a host channel data toggle error interrupt. This handler may be
++ * called in either DMA mode or Slave mode.
++ */
++static int32_t handle_hc_datatglerr_intr(dwc_otg_hcd_t * hcd,
++					 dwc_hc_t * hc,
++					 dwc_otg_hc_regs_t * hc_regs,
++					 dwc_otg_qtd_t * qtd)
++{
++	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
++		"Data Toggle Error on %s transfer--\n",
++		hc->hc_num, (hc->ep_is_in ? "IN" : "OUT"));
++
++	/* Data toggles on split transactions cause the hc to halt.
++	 * restart transfer */
++	if(hc->qh->do_split)
++	{
++		qtd->error_count++;
++		dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++		update_urb_state_xfer_intr(hc, hc_regs,
++			qtd->urb, qtd, DWC_OTG_HC_XFER_XACT_ERR);
++		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_XACT_ERR);
++	} else if (hc->ep_is_in) {
++		/* An unmasked data toggle error on a non-split DMA transaction is
++		 * for the sole purpose of resetting error counts. Disable other
++		 * interrupts unmasked for the same reason.
++		 */
++		if(hcd->core_if->dma_enable) {
++			disable_hc_int(hc_regs, ack);
++			disable_hc_int(hc_regs, nak);
++		}
++		qtd->error_count = 0;
++	}
++
++	disable_hc_int(hc_regs, datatglerr);
++
++	return 1;
++}
++
++#ifdef DEBUG
++/**
++ * This function is for debug only. It checks that a valid halt status is set
++ * and that HCCHARn.chdis is clear. If there's a problem, corrective action is
++ * taken and a warning is issued.
++ * @return 1 if halt status is ok, 0 otherwise.
++ */
++static inline int halt_status_ok(dwc_otg_hcd_t * hcd,
++				 dwc_hc_t * hc,
++				 dwc_otg_hc_regs_t * hc_regs,
++				 dwc_otg_qtd_t * qtd)
++{
++	hcchar_data_t hcchar;
++	hctsiz_data_t hctsiz;
++	hcint_data_t hcint;
++	hcintmsk_data_t hcintmsk;
++	hcsplt_data_t hcsplt;
++
++	if (hc->halt_status == DWC_OTG_HC_XFER_NO_HALT_STATUS) {
++		/*
++		 * This code is here only as a check. This condition should
++		 * never happen. Ignore the halt if it does occur.
++		 */
++		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++		hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
++		hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++		hcintmsk.d32 = DWC_READ_REG32(&hc_regs->hcintmsk);
++		hcsplt.d32 = DWC_READ_REG32(&hc_regs->hcsplt);
++		DWC_WARN
++		    ("%s: hc->halt_status == DWC_OTG_HC_XFER_NO_HALT_STATUS, "
++		     "channel %d, hcchar 0x%08x, hctsiz 0x%08x, "
++		     "hcint 0x%08x, hcintmsk 0x%08x, "
++		     "hcsplt 0x%08x, qtd->complete_split %d\n", __func__,
++		     hc->hc_num, hcchar.d32, hctsiz.d32, hcint.d32,
++		     hcintmsk.d32, hcsplt.d32, qtd->complete_split);
++
++		DWC_WARN("%s: no halt status, channel %d, ignoring interrupt\n",
++			 __func__, hc->hc_num);
++		DWC_WARN("\n");
++		clear_hc_int(hc_regs, chhltd);
++		return 0;
++	}
++
++	/*
++	 * This code is here only as a check. hcchar.chdis should
++	 * never be set when the halt interrupt occurs. Halt the
++	 * channel again if it does occur.
++	 */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	if (hcchar.b.chdis) {
++		DWC_WARN("%s: hcchar.chdis set unexpectedly, "
++			 "hcchar 0x%08x, trying to halt again\n",
++			 __func__, hcchar.d32);
++		clear_hc_int(hc_regs, chhltd);
++		hc->halt_pending = 0;
++		halt_channel(hcd, hc, qtd, hc->halt_status);
++		return 0;
++	}
++
++	return 1;
++}
++#endif
++
++/**
++ * Handles a host Channel Halted interrupt in DMA mode. This handler
++ * determines the reason the channel halted and proceeds accordingly.
++ */
++static void handle_hc_chhltd_intr_dma(dwc_otg_hcd_t * hcd,
++				      dwc_hc_t * hc,
++				      dwc_otg_hc_regs_t * hc_regs,
++				      dwc_otg_qtd_t * qtd)
++{
++	int out_nak_enh = 0;
++	hcint_data_t hcint;
++	hcintmsk_data_t hcintmsk;
++	/* For core with OUT NAK enhancement, the flow for high-
++	 * speed CONTROL/BULK OUT is handled a little differently.
++	 */
++	if (hcd->core_if->snpsid >= OTG_CORE_REV_2_71a) {
++		if (hc->speed == DWC_OTG_EP_SPEED_HIGH && !hc->ep_is_in &&
++		    (hc->ep_type == DWC_OTG_EP_TYPE_CONTROL ||
++		     hc->ep_type == DWC_OTG_EP_TYPE_BULK)) {
++			out_nak_enh = 1;
++		}
++	}
++
++	if (hc->halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE ||
++	    (hc->halt_status == DWC_OTG_HC_XFER_AHB_ERR
++	     && !hcd->core_if->dma_desc_enable)) {
++		/*
++		 * Just release the channel. A dequeue can happen on a
++		 * transfer timeout. In the case of an AHB Error, the channel
++		 * was forced to halt because there's no way to gracefully
++		 * recover.
++		 */
++		if (hcd->core_if->dma_desc_enable)
++			dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs,
++						       hc->halt_status);
++		else
++			release_channel(hcd, hc, qtd, hc->halt_status);
++		return;
++	}
++
++	/* Read the HCINTn register to determine the cause for the halt. */
++
++	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++	hcintmsk.d32 = DWC_READ_REG32(&hc_regs->hcintmsk);
++
++	if (hcint.b.xfercomp) {
++		/** @todo This is here because of a possible hardware bug.  Spec
++		 * says that on SPLIT-ISOC OUT transfers in DMA mode that a HALT
++		 * interrupt w/ACK bit set should occur, but I only see the
++		 * XFERCOMP bit, even with it masked out.  This is a workaround
++		 * for that behavior.  Should fix this when hardware is fixed.
++		 */
++		if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC && !hc->ep_is_in) {
++			handle_hc_ack_intr(hcd, hc, hc_regs, qtd);
++		}
++		handle_hc_xfercomp_intr(hcd, hc, hc_regs, qtd);
++	} else if (hcint.b.stall) {
++		handle_hc_stall_intr(hcd, hc, hc_regs, qtd);
++	} else if (hcint.b.xacterr && !hcd->core_if->dma_desc_enable) {
++		if (out_nak_enh) {
++			if (hcint.b.nyet || hcint.b.nak || hcint.b.ack) {
++				DWC_DEBUGPL(DBG_HCD, "XactErr with NYET/NAK/ACK\n");
++				qtd->error_count = 0;
++			} else {
++				DWC_DEBUGPL(DBG_HCD, "XactErr without NYET/NAK/ACK\n");
++			}
++		}
++
++		/*
++		 * Must handle xacterr before nak or ack. Could get a xacterr
++		 * at the same time as either of these on a BULK/CONTROL OUT
++		 * that started with a PING. The xacterr takes precedence.
++		 */
++		handle_hc_xacterr_intr(hcd, hc, hc_regs, qtd);
++	} else if (hcint.b.xcs_xact && hcd->core_if->dma_desc_enable) {
++		handle_hc_xacterr_intr(hcd, hc, hc_regs, qtd);
++	} else if (hcint.b.ahberr && hcd->core_if->dma_desc_enable) {
++		handle_hc_ahberr_intr(hcd, hc, hc_regs, qtd);
++	} else if (hcint.b.bblerr) {
++		handle_hc_babble_intr(hcd, hc, hc_regs, qtd);
++	} else if (hcint.b.frmovrun) {
++		handle_hc_frmovrun_intr(hcd, hc, hc_regs, qtd);
++	} else if (hcint.b.datatglerr) {
++		handle_hc_datatglerr_intr(hcd, hc, hc_regs, qtd);
++	} else if (!out_nak_enh) {
++		if (hcint.b.nyet) {
++			/*
++			 * Must handle nyet before nak or ack. Could get a nyet at the
++			 * same time as either of those on a BULK/CONTROL OUT that
++			 * started with a PING. The nyet takes precedence.
++			 */
++			handle_hc_nyet_intr(hcd, hc, hc_regs, qtd);
++		} else if (hcint.b.nak && !hcintmsk.b.nak) {
++			/*
++			 * If nak is not masked, it's because a non-split IN transfer
++			 * is in an error state. In that case, the nak is handled by
++			 * the nak interrupt handler, not here. Handle nak here for
++			 * BULK/CONTROL OUT transfers, which halt on a NAK to allow
++			 * rewinding the buffer pointer.
++			 */
++			handle_hc_nak_intr(hcd, hc, hc_regs, qtd);
++		} else if (hcint.b.ack && !hcintmsk.b.ack) {
++			/*
++			 * If ack is not masked, it's because a non-split IN transfer
++			 * is in an error state. In that case, the ack is handled by
++			 * the ack interrupt handler, not here. Handle ack here for
++			 * split transfers. Start splits halt on ACK.
++			 */
++			handle_hc_ack_intr(hcd, hc, hc_regs, qtd);
++		} else {
++			if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
++			    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
++				/*
++				 * A periodic transfer halted with no other channel
++				 * interrupts set. Assume it was halted by the core
++				 * because it could not be completed in its scheduled
++				 * (micro)frame.
++				 */
++#ifdef DEBUG
++				DWC_PRINTF
++				    ("%s: Halt channel %d (assume incomplete periodic transfer)\n",
++				     __func__, hc->hc_num);
++#endif
++				halt_channel(hcd, hc, qtd,
++					     DWC_OTG_HC_XFER_PERIODIC_INCOMPLETE);
++			} else {
++				DWC_ERROR
++				    ("%s: Channel %d, DMA Mode -- ChHltd set, but reason "
++				     "for halting is unknown, hcint 0x%08x, intsts 0x%08x\n",
++				     __func__, hc->hc_num, hcint.d32,
++				     DWC_READ_REG32(&hcd->
++						    core_if->core_global_regs->
++						    gintsts));
++				/* Failthrough: use 3-strikes rule */
++				qtd->error_count++;
++				dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++				update_urb_state_xfer_intr(hc, hc_regs,
++					   qtd->urb, qtd, DWC_OTG_HC_XFER_XACT_ERR);
++				halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_XACT_ERR);
++			}
++
++		}
++	} else {
++		DWC_PRINTF("NYET/NAK/ACK/other in non-error case, 0x%08x\n",
++			   hcint.d32);
++		/* Failthrough: use 3-strikes rule */
++		qtd->error_count++;
++		dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++		update_urb_state_xfer_intr(hc, hc_regs,
++			   qtd->urb, qtd, DWC_OTG_HC_XFER_XACT_ERR);
++		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_XACT_ERR);
++	}
++}
++
++/**
++ * Handles a host channel Channel Halted interrupt.
++ *
++ * In slave mode, this handler is called only when the driver specifically
++ * requests a halt. This occurs during handling other host channel interrupts
++ * (e.g. nak, xacterr, stall, nyet, etc.).
++ *
++ * In DMA mode, this is the interrupt that occurs when the core has finished
++ * processing a transfer on a channel. Other host channel interrupts (except
++ * ahberr) are disabled in DMA mode.
++ */
++static int32_t handle_hc_chhltd_intr(dwc_otg_hcd_t * hcd,
++				     dwc_hc_t * hc,
++				     dwc_otg_hc_regs_t * hc_regs,
++				     dwc_otg_qtd_t * qtd)
++{
++	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
++		    "Channel Halted--\n", hc->hc_num);
++
++	if (hcd->core_if->dma_enable) {
++		handle_hc_chhltd_intr_dma(hcd, hc, hc_regs, qtd);
++	} else {
++#ifdef DEBUG
++		if (!halt_status_ok(hcd, hc, hc_regs, qtd)) {
++			return 1;
++		}
++#endif
++		release_channel(hcd, hc, qtd, hc->halt_status);
++	}
++
++	return 1;
++}
++
++
++/**
++ * dwc_otg_fiq_unmangle_isoc() - Update the iso_frame_desc structure on
++ * FIQ transfer completion
++ * @hcd:	Pointer to dwc_otg_hcd struct
++ * @num:	Host channel number
++ *
++ * 1. Un-mangle the status as recorded in each iso_frame_desc status
++ * 2. Copy it from the dwc_otg_urb into the real URB
++ */
++void dwc_otg_fiq_unmangle_isoc(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh, dwc_otg_qtd_t *qtd, uint32_t num)
++{
++	struct dwc_otg_hcd_urb *dwc_urb = qtd->urb;
++	int nr_frames = dwc_urb->packet_count;
++	int i;
++	hcint_data_t frame_hcint;
++
++	for (i = 0; i < nr_frames; i++) {
++		frame_hcint.d32 = dwc_urb->iso_descs[i].status;
++		if (frame_hcint.b.xfercomp) {
++			dwc_urb->iso_descs[i].status = 0;
++			dwc_urb->actual_length += dwc_urb->iso_descs[i].actual_length;
++		} else if (frame_hcint.b.frmovrun) {
++			if (qh->ep_is_in)
++				dwc_urb->iso_descs[i].status = -DWC_E_NO_STREAM_RES;
++			else
++				dwc_urb->iso_descs[i].status = -DWC_E_COMMUNICATION;
++			dwc_urb->error_count++;
++			dwc_urb->iso_descs[i].actual_length = 0;
++		} else if (frame_hcint.b.xacterr) {
++			dwc_urb->iso_descs[i].status = -DWC_E_PROTOCOL;
++			dwc_urb->error_count++;
++			dwc_urb->iso_descs[i].actual_length = 0;
++		} else if (frame_hcint.b.bblerr) {
++			dwc_urb->iso_descs[i].status = -DWC_E_OVERFLOW;
++			dwc_urb->error_count++;
++			dwc_urb->iso_descs[i].actual_length = 0;
++		} else {
++			/* Something went wrong */
++			dwc_urb->iso_descs[i].status = -1;
++			dwc_urb->iso_descs[i].actual_length = 0;
++			dwc_urb->error_count++;
++		}
++	}
++	qh->sched_frame = dwc_frame_num_inc(qh->sched_frame, qh->interval * (nr_frames - 1));
++
++	//printk_ratelimited(KERN_INFO "%s: HS isochronous of %d/%d frames with %d errors complete\n",
++	//			__FUNCTION__, i, dwc_urb->packet_count, dwc_urb->error_count);
++}
++
++/**
++ * dwc_otg_fiq_unsetup_per_dma() - Remove data from bounce buffers for split transactions
++ * @hcd:	Pointer to dwc_otg_hcd struct
++ * @num:	Host channel number
++ *
++ * Copies data from the FIQ bounce buffers into the URB's transfer buffer. Does not modify URB state.
++ * Returns total length of data or -1 if the buffers were not used.
++ *
++ */
++int dwc_otg_fiq_unsetup_per_dma(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh, dwc_otg_qtd_t *qtd, uint32_t num)
++{
++	dwc_hc_t *hc = qh->channel;
++	struct fiq_dma_blob *blob = hcd->fiq_dmab;
++	struct fiq_channel_state *st = &hcd->fiq_state->channel[num];
++	uint8_t *ptr = NULL;
++	int index = 0, len = 0;
++	int i = 0;
++	if (hc->ep_is_in) {
++		/* Copy data out of the DMA bounce buffers to the URB's buffer.
++		 * The align_buf is ignored as this is ignored on FSM enqueue. */
++		ptr = qtd->urb->buf;
++		if (qh->ep_type == UE_ISOCHRONOUS) {
++			/* Isoc IN transactions - grab the offset of the iso_frame_desc into the URB transfer buffer */
++			index = qtd->isoc_frame_index;
++			ptr += qtd->urb->iso_descs[index].offset;
++		} else {
++			/* Need to increment by actual_length for interrupt IN */
++			ptr += qtd->urb->actual_length;
++		}
++
++		for (i = 0; i < st->dma_info.index; i++) {
++			len += st->dma_info.slot_len[i];
++			dwc_memcpy(ptr, &blob->channel[num].index[i].buf[0], st->dma_info.slot_len[i]);
++			ptr += st->dma_info.slot_len[i];
++		}
++		return len;
++	} else {
++		/* OUT endpoints - nothing to do. */
++		return -1;
++	}
++
++}
++/**
++ * dwc_otg_hcd_handle_hc_fsm() - handle an unmasked channel interrupt
++ * 				 from a channel handled in the FIQ
++ * @hcd:	Pointer to dwc_otg_hcd struct
++ * @num:	Host channel number
++ *
++ * If a host channel interrupt was received by the IRQ and this was a channel
++ * used by the FIQ, the execution flow for transfer completion is substantially
++ * different from the normal (messy) path. This function and its friends handles
++ * channel cleanup and transaction completion from a FIQ transaction.
++ */
++void dwc_otg_hcd_handle_hc_fsm(dwc_otg_hcd_t *hcd, uint32_t num)
++{
++	struct fiq_channel_state *st = &hcd->fiq_state->channel[num];
++	dwc_hc_t *hc = hcd->hc_ptr_array[num];
++	dwc_otg_qtd_t *qtd;
++	dwc_otg_hc_regs_t *hc_regs = hcd->core_if->host_if->hc_regs[num];
++	hcint_data_t hcint = hcd->fiq_state->channel[num].hcint_copy;
++	hctsiz_data_t hctsiz = hcd->fiq_state->channel[num].hctsiz_copy;
++	int hostchannels  = 0;
++	fiq_print(FIQDBG_INT, hcd->fiq_state, "OUT %01d %01d ", num , st->fsm);
++
++	hostchannels = hcd->available_host_channels;
++	if (hc->halt_pending) {
++		/* Dequeue: The FIQ was allowed to complete the transfer but state has been cleared. */
++		if (hc->qh && st->fsm == FIQ_NP_SPLIT_DONE &&
++				hcint.b.xfercomp && hc->qh->ep_type == UE_BULK) {
++			if (hctsiz.b.pid == DWC_HCTSIZ_DATA0) {
++				hc->qh->data_toggle = DWC_OTG_HC_PID_DATA1;
++			} else {
++				hc->qh->data_toggle = DWC_OTG_HC_PID_DATA0;
++			}
++		}
++		release_channel(hcd, hc, NULL, hc->halt_status);
++		return;
++	}
++
++	qtd = DWC_CIRCLEQ_FIRST(&hc->qh->qtd_list);
++	switch (st->fsm) {
++	case FIQ_TEST:
++		break;
++
++	case FIQ_DEQUEUE_ISSUED:
++		/* Handled above, but keep for posterity */
++		release_channel(hcd, hc, NULL, hc->halt_status);
++		break;
++
++	case FIQ_NP_SPLIT_DONE:
++		/* Nonperiodic transaction complete. */
++		if (!hc->ep_is_in) {
++			qtd->ssplit_out_xfer_count = hc->xfer_len;
++		}
++		if (hcint.b.xfercomp) {
++			handle_hc_xfercomp_intr(hcd, hc, hc_regs, qtd);
++		} else if (hcint.b.nak) {
++			handle_hc_nak_intr(hcd, hc, hc_regs, qtd);
++		} else {
++			DWC_WARN("Unexpected IRQ state on FSM transaction:"
++					"dev_addr=%d ep=%d fsm=%d, hcint=0x%08x\n",
++				hc->dev_addr, hc->ep_num, st->fsm, hcint.d32);
++			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
++		}
++		break;
++
++	case FIQ_NP_SPLIT_HS_ABORTED:
++		/* A HS abort is a 3-strikes on the HS bus at any point in the transaction.
++		 * Normally a CLEAR_TT_BUFFER hub command would be required: we can't do that
++		 * because there's no guarantee which order a non-periodic split happened in.
++		 * We could end up clearing a perfectly good transaction out of the buffer.
++		 */
++		if (hcint.b.xacterr) {
++			qtd->error_count += st->nr_errors;
++			handle_hc_xacterr_intr(hcd, hc, hc_regs, qtd);
++		} else if (hcint.b.ahberr) {
++			handle_hc_ahberr_intr(hcd, hc, hc_regs, qtd);
++		} else {
++			DWC_WARN("Unexpected IRQ state on FSM transaction:"
++					"dev_addr=%d ep=%d fsm=%d, hcint=0x%08x\n",
++				hc->dev_addr, hc->ep_num, st->fsm, hcint.d32);
++			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
++		}
++		break;
++
++	case FIQ_NP_SPLIT_LS_ABORTED:
++		/* A few cases can cause this - either an unknown state on a SSPLIT or
++		 * STALL/data toggle error response on a CSPLIT */
++		if (hcint.b.stall) {
++			handle_hc_stall_intr(hcd, hc, hc_regs, qtd);
++		} else if (hcint.b.datatglerr) {
++			handle_hc_datatglerr_intr(hcd, hc, hc_regs, qtd);
++		} else if (hcint.b.bblerr) {
++			handle_hc_babble_intr(hcd, hc, hc_regs, qtd);
++		} else if (hcint.b.ahberr) {
++			handle_hc_ahberr_intr(hcd, hc, hc_regs, qtd);
++		} else {
++			DWC_WARN("Unexpected IRQ state on FSM transaction:"
++					"dev_addr=%d ep=%d fsm=%d, hcint=0x%08x\n",
++				hc->dev_addr, hc->ep_num, st->fsm, hcint.d32);
++			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
++		}
++		break;
++
++	case FIQ_PER_SPLIT_DONE:
++		/* Isoc IN or Interrupt IN/OUT */
++
++		/* Flow control here is different from the normal execution by the driver.
++		* We need to completely ignore most of the driver's method of handling
++		* split transactions and do it ourselves.
++		*/
++		if (hc->ep_type == UE_INTERRUPT) {
++			if (hcint.b.nak) {
++					handle_hc_nak_intr(hcd, hc, hc_regs, qtd);
++			} else if (hc->ep_is_in) {
++				int len;
++				len = dwc_otg_fiq_unsetup_per_dma(hcd, hc->qh, qtd, num);
++				//printk(KERN_NOTICE "FIQ Transaction: hc=%d len=%d urb_len = %d\n", num, len, qtd->urb->length);
++				qtd->urb->actual_length += len;
++				if (qtd->urb->actual_length >= qtd->urb->length) {
++					qtd->urb->status = 0;
++					hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, qtd->urb->status);
++					release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
++				} else {
++					/* Interrupt transfer not complete yet - is it a short read? */
++					if (len < hc->max_packet) {
++						/* Interrupt transaction complete */
++						qtd->urb->status = 0;
++						hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, qtd->urb->status);
++						release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
++					} else {
++						/* Further transactions required */
++						release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
++					}
++				}
++			} else {
++				/* Interrupt OUT complete. */
++				dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++				qtd->urb->actual_length += hc->xfer_len;
++				if (qtd->urb->actual_length >= qtd->urb->length) {
++					qtd->urb->status = 0;
++					hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, qtd->urb->status);
++					release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
++				} else {
++					release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
++				}
++			}
++		} else {
++			/* ISOC IN complete. */
++			struct dwc_otg_hcd_iso_packet_desc *frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
++			int len = 0;
++			/* Record errors, update qtd. */
++			if (st->nr_errors) {
++				frame_desc->actual_length = 0;
++				frame_desc->status = -DWC_E_PROTOCOL;
++			} else {
++				frame_desc->status = 0;
++				/* Unswizzle dma */
++				len = dwc_otg_fiq_unsetup_per_dma(hcd, hc->qh, qtd, num);
++				frame_desc->actual_length = len;
++			}
++			qtd->isoc_frame_index++;
++			if (qtd->isoc_frame_index == qtd->urb->packet_count) {
++				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
++				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
++			} else {
++				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
++			}
++		}
++		break;
++
++	case FIQ_PER_ISO_OUT_DONE: {
++			struct dwc_otg_hcd_iso_packet_desc *frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
++			/* Record errors, update qtd. */
++			if (st->nr_errors) {
++				frame_desc->actual_length = 0;
++				frame_desc->status = -DWC_E_PROTOCOL;
++			} else {
++				frame_desc->status = 0;
++				frame_desc->actual_length = frame_desc->length;
++			}
++			qtd->isoc_frame_index++;
++			qtd->isoc_split_offset = 0;
++			if (qtd->isoc_frame_index == qtd->urb->packet_count) {
++				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
++				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
++			} else {
++				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
++			}
++		}
++		break;
++
++	case FIQ_PER_SPLIT_NYET_ABORTED:
++		/* Doh. lost the data. */
++		printk_ratelimited(KERN_INFO "Transfer to device %d endpoint 0x%x frame %d failed "
++				"- FIQ reported NYET. Data may have been lost.\n",
++				hc->dev_addr, hc->ep_num, dwc_otg_hcd_get_frame_number(hcd) >> 3);
++		if (hc->ep_type == UE_ISOCHRONOUS) {
++			struct dwc_otg_hcd_iso_packet_desc *frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
++			/* Record errors, update qtd. */
++			frame_desc->actual_length = 0;
++			frame_desc->status = -DWC_E_PROTOCOL;
++			qtd->isoc_frame_index++;
++			qtd->isoc_split_offset = 0;
++			if (qtd->isoc_frame_index == qtd->urb->packet_count) {
++				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
++				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
++			} else {
++				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
++			}
++		} else {
++			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
++		}
++		break;
++
++	case FIQ_HS_ISOC_DONE:
++		/* The FIQ has performed a whole pile of isochronous transactions.
++		 * The status is recorded as the interrupt state should the transaction
++		 * fail.
++		 */
++		dwc_otg_fiq_unmangle_isoc(hcd, hc->qh, qtd, num);
++		hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
++		release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
++		break;
++
++	case FIQ_PER_SPLIT_LS_ABORTED:
++		if (hcint.b.xacterr) {
++			/* Hub has responded with an ERR packet. Device
++			 * has been unplugged or the port has been disabled.
++			 * TODO: need to issue a reset to the hub port. */
++			qtd->error_count += 3;
++			handle_hc_xacterr_intr(hcd, hc, hc_regs, qtd);
++		} else if (hcint.b.stall) {
++			handle_hc_stall_intr(hcd, hc, hc_regs, qtd);
++		} else if (hcint.b.bblerr) {
++			handle_hc_babble_intr(hcd, hc, hc_regs, qtd);
++		} else {
++			printk_ratelimited(KERN_INFO "Transfer to device %d endpoint 0x%x failed "
++				"- FIQ reported FSM=%d. Data may have been lost.\n",
++				st->fsm, hc->dev_addr, hc->ep_num);
++			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
++		}
++		break;
++
++	case FIQ_PER_SPLIT_HS_ABORTED:
++		/* Either the SSPLIT phase suffered transaction errors or something
++		 * unexpected happened.
++		 */
++		qtd->error_count += 3;
++		handle_hc_xacterr_intr(hcd, hc, hc_regs, qtd);
++		release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
++		break;
++
++	case FIQ_PER_SPLIT_TIMEOUT:
++		/* Couldn't complete in the nominated frame */
++		printk(KERN_INFO "Transfer to device %d endpoint 0x%x frame %d failed "
++				"- FIQ timed out. Data may have been lost.\n",
++				hc->dev_addr, hc->ep_num, dwc_otg_hcd_get_frame_number(hcd) >> 3);
++		if (hc->ep_type == UE_ISOCHRONOUS) {
++			struct dwc_otg_hcd_iso_packet_desc *frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
++			/* Record errors, update qtd. */
++			frame_desc->actual_length = 0;
++			if (hc->ep_is_in) {
++				frame_desc->status = -DWC_E_NO_STREAM_RES;
++			} else {
++				frame_desc->status = -DWC_E_COMMUNICATION;
++			}
++			qtd->isoc_frame_index++;
++			if (qtd->isoc_frame_index == qtd->urb->packet_count) {
++				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
++				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
++			} else {
++				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
++			}
++		} else {
++			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
++		}
++		break;
++
++	default:
++		DWC_WARN("Unexpected state received on hc=%d fsm=%d on transfer to device %d ep 0x%x", 
++					hc->hc_num, st->fsm, hc->dev_addr, hc->ep_num);
++		qtd->error_count++;
++		release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
++	}
++	return;
++}
++
++/** Handles interrupt for a specific Host Channel */
++int32_t dwc_otg_hcd_handle_hc_n_intr(dwc_otg_hcd_t * dwc_otg_hcd, uint32_t num)
++{
++	int retval = 0;
++	hcint_data_t hcint;
++	hcintmsk_data_t hcintmsk;
++	dwc_hc_t *hc;
++	dwc_otg_hc_regs_t *hc_regs;
++	dwc_otg_qtd_t *qtd;
++
++	DWC_DEBUGPL(DBG_HCDV, "--Host Channel Interrupt--, Channel %d\n", num);
++
++	hc = dwc_otg_hcd->hc_ptr_array[num];
++	hc_regs = dwc_otg_hcd->core_if->host_if->hc_regs[num];
++	if(hc->halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE) {
++		/* A dequeue was issued for this transfer. Our QTD has gone away
++		 * but in the case of a FIQ transfer, the transfer would have run
++		 * to completion.
++		 */
++		if (fiq_fsm_enable && dwc_otg_hcd->fiq_state->channel[num].fsm != FIQ_PASSTHROUGH) {
++			dwc_otg_hcd_handle_hc_fsm(dwc_otg_hcd, num);
++		} else {
++			release_channel(dwc_otg_hcd, hc, NULL, hc->halt_status);
++		}
++		return 1;
++	}
++	qtd = DWC_CIRCLEQ_FIRST(&hc->qh->qtd_list);
++
++	/*
++	 * FSM mode: Check to see if this is a HC interrupt from a channel handled by the FIQ.
++	 * Execution path is fundamentally different for the channels after a FIQ has completed
++	 * a split transaction.
++	 */
++	if (fiq_fsm_enable) {
++		switch (dwc_otg_hcd->fiq_state->channel[num].fsm) {
++			case FIQ_PASSTHROUGH:
++				break;
++			case FIQ_PASSTHROUGH_ERRORSTATE:
++				/* Hook into the error count */
++				fiq_print(FIQDBG_ERR, dwc_otg_hcd->fiq_state, "HCDERR%02d", num);
++				if (!dwc_otg_hcd->fiq_state->channel[num].nr_errors) {
++					qtd->error_count = 0;
++					fiq_print(FIQDBG_ERR, dwc_otg_hcd->fiq_state, "RESET   ");
++				}
++				break;
++			default:
++				dwc_otg_hcd_handle_hc_fsm(dwc_otg_hcd, num);
++				return 1;
++		}
++	}
++
++	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++	hcintmsk.d32 = DWC_READ_REG32(&hc_regs->hcintmsk);
++	hcint.d32 = hcint.d32 & hcintmsk.d32;
++	if (!dwc_otg_hcd->core_if->dma_enable) {
++		if (hcint.b.chhltd && hcint.d32 != 0x2) {
++			hcint.b.chhltd = 0;
++		}
++	}
++
++	if (hcint.b.xfercomp) {
++		retval |=
++		    handle_hc_xfercomp_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++		/*
++		 * If NYET occurred at same time as Xfer Complete, the NYET is
++		 * handled by the Xfer Complete interrupt handler. Don't want
++		 * to call the NYET interrupt handler in this case.
++		 */
++		hcint.b.nyet = 0;
++	}
++	if (hcint.b.chhltd) {
++		retval |= handle_hc_chhltd_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++	}
++	if (hcint.b.ahberr) {
++		retval |= handle_hc_ahberr_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++	}
++	if (hcint.b.stall) {
++		retval |= handle_hc_stall_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++	}
++	if (hcint.b.nak) {
++		retval |= handle_hc_nak_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++	}
++	if (hcint.b.ack) {
++		if(!hcint.b.chhltd)
++			retval |= handle_hc_ack_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++	}
++	if (hcint.b.nyet) {
++		retval |= handle_hc_nyet_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++	}
++	if (hcint.b.xacterr) {
++		retval |= handle_hc_xacterr_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++	}
++	if (hcint.b.bblerr) {
++		retval |= handle_hc_babble_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++	}
++	if (hcint.b.frmovrun) {
++		retval |=
++		    handle_hc_frmovrun_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++	}
++	if (hcint.b.datatglerr) {
++		retval |=
++		    handle_hc_datatglerr_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++	}
++
++	return retval;
++}
++#endif /* DWC_DEVICE_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
+@@ -0,0 +1,1086 @@
++
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd_linux.c $
++ * $Revision: #20 $
++ * $Date: 2011/10/26 $
++ * $Change: 1872981 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_DEVICE_ONLY
++
++/**
++ * @file
++ *
++ * This file contains the implementation of the HCD. In Linux, the HCD
++ * implements the hc_driver API.
++ */
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/moduleparam.h>
++#include <linux/init.h>
++#include <linux/device.h>
++#include <linux/errno.h>
++#include <linux/list.h>
++#include <linux/interrupt.h>
++#include <linux/string.h>
++#include <linux/dma-mapping.h>
++#include <linux/version.h>
++#include <asm/io.h>
++#ifdef CONFIG_ARM
++#include <asm/fiq.h>
++#endif
++#include <linux/usb.h>
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35)
++#include <../drivers/usb/core/hcd.h>
++#else
++#include <linux/usb/hcd.h>
++#endif
++#include <asm/bug.h>
++
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30))
++#define USB_URB_EP_LINKING 1
++#else
++#define USB_URB_EP_LINKING 0
++#endif
++
++#include "dwc_otg_hcd_if.h"
++#include "dwc_otg_dbg.h"
++#include "dwc_otg_driver.h"
++#include "dwc_otg_hcd.h"
++
++#ifndef __virt_to_bus
++#define __virt_to_bus	__virt_to_phys
++#define __bus_to_virt	__phys_to_virt
++#define __pfn_to_bus(x)	__pfn_to_phys(x)
++#define __bus_to_pfn(x)	__phys_to_pfn(x)
++#endif
++
++extern unsigned char  _dwc_otg_fiq_stub, _dwc_otg_fiq_stub_end;
++
++/**
++ * Gets the endpoint number from a _bEndpointAddress argument. The endpoint is
++ * qualified with its direction (possible 32 endpoints per device).
++ */
++#define dwc_ep_addr_to_endpoint(_bEndpointAddress_) ((_bEndpointAddress_ & USB_ENDPOINT_NUMBER_MASK) | \
++						     ((_bEndpointAddress_ & USB_DIR_IN) != 0) << 4)
++
++static const char dwc_otg_hcd_name[] = "dwc_otg_hcd";
++
++extern bool fiq_enable;
++
++/** @name Linux HC Driver API Functions */
++/** @{ */
++/* manage i/o requests, device state */
++static int dwc_otg_urb_enqueue(struct usb_hcd *hcd,
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
++		       struct usb_host_endpoint *ep,
++#endif
++		       struct urb *urb, gfp_t mem_flags);
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30)
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
++static int dwc_otg_urb_dequeue(struct usb_hcd *hcd, struct urb *urb);
++#endif
++#else /* kernels at or post 2.6.30 */
++static int dwc_otg_urb_dequeue(struct usb_hcd *hcd,
++                               struct urb *urb, int status);
++#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30) */
++
++static void endpoint_disable(struct usb_hcd *hcd, struct usb_host_endpoint *ep);
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30)
++static void endpoint_reset(struct usb_hcd *hcd, struct usb_host_endpoint *ep);
++#endif
++static irqreturn_t dwc_otg_hcd_irq(struct usb_hcd *hcd);
++extern int hcd_start(struct usb_hcd *hcd);
++extern void hcd_stop(struct usb_hcd *hcd);
++static int get_frame_number(struct usb_hcd *hcd);
++extern int hub_status_data(struct usb_hcd *hcd, char *buf);
++extern int hub_control(struct usb_hcd *hcd,
++		       u16 typeReq,
++		       u16 wValue, u16 wIndex, char *buf, u16 wLength);
++
++struct wrapper_priv_data {
++	dwc_otg_hcd_t *dwc_otg_hcd;
++};
++
++/** @} */
++
++static struct hc_driver dwc_otg_hc_driver = {
++
++	.description = dwc_otg_hcd_name,
++	.product_desc = "DWC OTG Controller",
++	.hcd_priv_size = sizeof(struct wrapper_priv_data),
++
++	.irq = dwc_otg_hcd_irq,
++
++	.flags = HCD_MEMORY | HCD_DMA | HCD_USB2,
++
++	//.reset =
++	.start = hcd_start,
++	//.suspend =
++	//.resume =
++	.stop = hcd_stop,
++
++	.urb_enqueue = dwc_otg_urb_enqueue,
++	.urb_dequeue = dwc_otg_urb_dequeue,
++	.endpoint_disable = endpoint_disable,
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30)
++	.endpoint_reset = endpoint_reset,
++#endif
++	.get_frame_number = get_frame_number,
++
++	.hub_status_data = hub_status_data,
++	.hub_control = hub_control,
++	//.bus_suspend =
++	//.bus_resume =
++};
++
++/** Gets the dwc_otg_hcd from a struct usb_hcd */
++static inline dwc_otg_hcd_t *hcd_to_dwc_otg_hcd(struct usb_hcd *hcd)
++{
++	struct wrapper_priv_data *p;
++	p = (struct wrapper_priv_data *)(hcd->hcd_priv);
++	return p->dwc_otg_hcd;
++}
++
++/** Gets the struct usb_hcd that contains a dwc_otg_hcd_t. */
++static inline struct usb_hcd *dwc_otg_hcd_to_hcd(dwc_otg_hcd_t * dwc_otg_hcd)
++{
++	return dwc_otg_hcd_get_priv_data(dwc_otg_hcd);
++}
++
++/** Gets the usb_host_endpoint associated with an URB. */
++inline struct usb_host_endpoint *dwc_urb_to_endpoint(struct urb *urb)
++{
++	struct usb_device *dev = urb->dev;
++	int ep_num = usb_pipeendpoint(urb->pipe);
++
++	if (usb_pipein(urb->pipe))
++		return dev->ep_in[ep_num];
++	else
++		return dev->ep_out[ep_num];
++}
++
++static int _disconnect(dwc_otg_hcd_t * hcd)
++{
++	struct usb_hcd *usb_hcd = dwc_otg_hcd_to_hcd(hcd);
++
++	usb_hcd->self.is_b_host = 0;
++	return 0;
++}
++
++static int _start(dwc_otg_hcd_t * hcd)
++{
++	struct usb_hcd *usb_hcd = dwc_otg_hcd_to_hcd(hcd);
++
++	usb_hcd->self.is_b_host = dwc_otg_hcd_is_b_host(hcd);
++	hcd_start(usb_hcd);
++
++	return 0;
++}
++
++static int _hub_info(dwc_otg_hcd_t * hcd, void *urb_handle, uint32_t * hub_addr,
++		     uint32_t * port_addr)
++{
++   struct urb *urb = (struct urb *)urb_handle;
++   struct usb_bus *bus;
++#if 1 //GRAYG - temporary
++   if (NULL == urb_handle)
++      DWC_ERROR("**** %s - NULL URB handle\n", __func__);//GRAYG
++   if (NULL == urb->dev)
++      DWC_ERROR("**** %s - URB has no device\n", __func__);//GRAYG
++   if (NULL == port_addr)
++      DWC_ERROR("**** %s - NULL port_address\n", __func__);//GRAYG
++#endif
++   if (urb->dev->tt) {
++        if (NULL == urb->dev->tt->hub) {
++                DWC_ERROR("**** %s - (URB's transactor has no TT - giving no hub)\n",
++                           __func__); //GRAYG
++                //*hub_addr = (u8)usb_pipedevice(urb->pipe); //GRAYG
++                *hub_addr = 0; //GRAYG
++                // we probably shouldn't have a transaction translator if
++                // there's no associated hub?
++        } else {
++		bus = hcd_to_bus(dwc_otg_hcd_to_hcd(hcd));
++		if (urb->dev->tt->hub == bus->root_hub)
++			*hub_addr = 0;
++		else
++			*hub_addr = urb->dev->tt->hub->devnum;
++	}
++	*port_addr = urb->dev->ttport;
++   } else {
++        *hub_addr = 0;
++	*port_addr = urb->dev->ttport;
++   }
++   return 0;
++}
++
++static int _speed(dwc_otg_hcd_t * hcd, void *urb_handle)
++{
++	struct urb *urb = (struct urb *)urb_handle;
++	return urb->dev->speed;
++}
++
++static int _get_b_hnp_enable(dwc_otg_hcd_t * hcd)
++{
++	struct usb_hcd *usb_hcd = dwc_otg_hcd_to_hcd(hcd);
++	return usb_hcd->self.b_hnp_enable;
++}
++
++static void allocate_bus_bandwidth(struct usb_hcd *hcd, uint32_t bw,
++				   struct urb *urb)
++{
++	hcd_to_bus(hcd)->bandwidth_allocated += bw / urb->interval;
++	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
++		hcd_to_bus(hcd)->bandwidth_isoc_reqs++;
++	} else {
++		hcd_to_bus(hcd)->bandwidth_int_reqs++;
++	}
++}
++
++static void free_bus_bandwidth(struct usb_hcd *hcd, uint32_t bw,
++			       struct urb *urb)
++{
++	hcd_to_bus(hcd)->bandwidth_allocated -= bw / urb->interval;
++	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
++		hcd_to_bus(hcd)->bandwidth_isoc_reqs--;
++	} else {
++		hcd_to_bus(hcd)->bandwidth_int_reqs--;
++	}
++}
++
++/**
++ * Sets the final status of an URB and returns it to the device driver. Any
++ * required cleanup of the URB is performed.  The HCD lock should be held on
++ * entry.
++ */
++static int _complete(dwc_otg_hcd_t * hcd, void *urb_handle,
++		     dwc_otg_hcd_urb_t * dwc_otg_urb, int32_t status)
++{
++	struct urb *urb = (struct urb *)urb_handle;
++	urb_tq_entry_t *new_entry;
++	int rc = 0;
++	if (CHK_DEBUG_LEVEL(DBG_HCDV | DBG_HCD_URB)) {
++		DWC_PRINTF("%s: urb %p, device %d, ep %d %s, status=%d\n",
++			   __func__, urb, usb_pipedevice(urb->pipe),
++			   usb_pipeendpoint(urb->pipe),
++			   usb_pipein(urb->pipe) ? "IN" : "OUT", status);
++		if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
++			int i;
++			for (i = 0; i < urb->number_of_packets; i++) {
++				DWC_PRINTF("  ISO Desc %d status: %d\n",
++					   i, urb->iso_frame_desc[i].status);
++			}
++		}
++	}
++	new_entry = DWC_ALLOC_ATOMIC(sizeof(urb_tq_entry_t));
++	urb->actual_length = dwc_otg_hcd_urb_get_actual_length(dwc_otg_urb);
++	/* Convert status value. */
++	switch (status) {
++	case -DWC_E_PROTOCOL:
++		status = -EPROTO;
++		break;
++	case -DWC_E_IN_PROGRESS:
++		status = -EINPROGRESS;
++		break;
++	case -DWC_E_PIPE:
++		status = -EPIPE;
++		break;
++	case -DWC_E_IO:
++		status = -EIO;
++		break;
++	case -DWC_E_TIMEOUT:
++		status = -ETIMEDOUT;
++		break;
++	case -DWC_E_OVERFLOW:
++		status = -EOVERFLOW;
++		break;
++	case -DWC_E_SHUTDOWN:
++		status = -ESHUTDOWN;
++		break;
++	default:
++		if (status) {
++			DWC_PRINTF("Uknown urb status %d\n", status);
++
++		}
++	}
++
++	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
++		int i;
++
++		urb->error_count = dwc_otg_hcd_urb_get_error_count(dwc_otg_urb);
++		urb->actual_length = 0;
++		for (i = 0; i < urb->number_of_packets; ++i) {
++			urb->iso_frame_desc[i].actual_length =
++			    dwc_otg_hcd_urb_get_iso_desc_actual_length
++			    (dwc_otg_urb, i);
++			urb->actual_length += urb->iso_frame_desc[i].actual_length;
++			urb->iso_frame_desc[i].status =
++			    dwc_otg_hcd_urb_get_iso_desc_status(dwc_otg_urb, i);
++		}
++	}
++
++	urb->status = status;
++	urb->hcpriv = NULL;
++	if (!status) {
++		if ((urb->transfer_flags & URB_SHORT_NOT_OK) &&
++		    (urb->actual_length < urb->transfer_buffer_length)) {
++			urb->status = -EREMOTEIO;
++		}
++	}
++
++	if ((usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) ||
++	    (usb_pipetype(urb->pipe) == PIPE_INTERRUPT)) {
++		struct usb_host_endpoint *ep = dwc_urb_to_endpoint(urb);
++		if (ep) {
++			free_bus_bandwidth(dwc_otg_hcd_to_hcd(hcd),
++					   dwc_otg_hcd_get_ep_bandwidth(hcd,
++									ep->hcpriv),
++					   urb);
++		}
++	}
++	DWC_FREE(dwc_otg_urb);
++	if (!new_entry) {
++		DWC_ERROR("dwc_otg_hcd: complete: cannot allocate URB TQ entry\n");
++		urb->status = -EPROTO;
++		/* don't schedule the tasklet -
++		 * directly return the packet here with error. */
++#if USB_URB_EP_LINKING
++		usb_hcd_unlink_urb_from_ep(dwc_otg_hcd_to_hcd(hcd), urb);
++#endif
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
++		usb_hcd_giveback_urb(dwc_otg_hcd_to_hcd(hcd), urb);
++#else
++		usb_hcd_giveback_urb(dwc_otg_hcd_to_hcd(hcd), urb, urb->status);
++#endif
++	} else {
++		new_entry->urb = urb;
++#if USB_URB_EP_LINKING
++		rc = usb_hcd_check_unlink_urb(dwc_otg_hcd_to_hcd(hcd), urb, urb->status);
++		if(0 == rc) {
++			usb_hcd_unlink_urb_from_ep(dwc_otg_hcd_to_hcd(hcd), urb);
++		}
++#endif
++		if(0 == rc) {
++			DWC_TAILQ_INSERT_TAIL(&hcd->completed_urb_list, new_entry,
++						urb_tq_entries);
++			DWC_TASK_HI_SCHEDULE(hcd->completion_tasklet);
++		}
++	}
++	return 0;
++}
++
++static struct dwc_otg_hcd_function_ops hcd_fops = {
++	.start = _start,
++	.disconnect = _disconnect,
++	.hub_info = _hub_info,
++	.speed = _speed,
++	.complete = _complete,
++	.get_b_hnp_enable = _get_b_hnp_enable,
++};
++
++#ifdef CONFIG_ARM64
++
++static int simfiq_irq = -1;
++
++void local_fiq_enable(void)
++{
++	if (simfiq_irq >= 0)
++		enable_irq(simfiq_irq);
++}
++
++void local_fiq_disable(void)
++{
++	if (simfiq_irq >= 0)
++		disable_irq(simfiq_irq);
++}
++
++irqreturn_t fiq_irq_handler(int irq, void *dev_id)
++{
++	dwc_otg_hcd_t *dwc_otg_hcd = (dwc_otg_hcd_t *)dev_id;
++
++	if (fiq_fsm_enable)
++		dwc_otg_fiq_fsm(dwc_otg_hcd->fiq_state, dwc_otg_hcd->core_if->core_params->host_channels);
++	else
++		dwc_otg_fiq_nop(dwc_otg_hcd->fiq_state);
++
++	return IRQ_HANDLED;
++}
++
++#else
++static struct fiq_handler fh = {
++  .name = "usb_fiq",
++};
++
++#endif
++
++static void hcd_init_fiq(void *cookie)
++{
++	dwc_otg_device_t *otg_dev = cookie;
++	dwc_otg_hcd_t *dwc_otg_hcd = otg_dev->hcd;
++#ifdef CONFIG_ARM64
++	int retval = 0;
++	int irq;
++#else
++	struct pt_regs regs;
++	int irq;
++
++	if (claim_fiq(&fh)) {
++		DWC_ERROR("Can't claim FIQ");
++		BUG();
++	}
++	DWC_WARN("FIQ on core %d", smp_processor_id());
++	DWC_WARN("FIQ ASM at %px length %d", &_dwc_otg_fiq_stub, (int)(&_dwc_otg_fiq_stub_end - &_dwc_otg_fiq_stub));
++	set_fiq_handler((void *) &_dwc_otg_fiq_stub, &_dwc_otg_fiq_stub_end - &_dwc_otg_fiq_stub);
++	memset(&regs,0,sizeof(regs));
++
++	regs.ARM_r8 = (long) dwc_otg_hcd->fiq_state;
++	if (fiq_fsm_enable) {
++		regs.ARM_r9 = dwc_otg_hcd->core_if->core_params->host_channels;
++		//regs.ARM_r10 = dwc_otg_hcd->dma;
++		regs.ARM_fp = (long) dwc_otg_fiq_fsm;
++	} else {
++		regs.ARM_fp = (long) dwc_otg_fiq_nop;
++	}
++
++	regs.ARM_sp = (long) dwc_otg_hcd->fiq_stack + (sizeof(struct fiq_stack) - 4);
++
++//		__show_regs(&regs);
++	set_fiq_regs(&regs);
++#endif
++
++	dwc_otg_hcd->fiq_state->dwc_regs_base = otg_dev->os_dep.base;
++	//Set the mphi periph to the required registers
++	dwc_otg_hcd->fiq_state->mphi_regs.base    = otg_dev->os_dep.mphi_base;
++	if (otg_dev->os_dep.use_swirq) {
++		dwc_otg_hcd->fiq_state->mphi_regs.swirq_set =
++			otg_dev->os_dep.mphi_base + 0x1f0;
++		dwc_otg_hcd->fiq_state->mphi_regs.swirq_clr =
++			otg_dev->os_dep.mphi_base + 0x1f4;
++		DWC_WARN("Fake MPHI regs_base at %px",
++			 dwc_otg_hcd->fiq_state->mphi_regs.base);
++	} else {
++		dwc_otg_hcd->fiq_state->mphi_regs.ctrl =
++			otg_dev->os_dep.mphi_base + 0x4c;
++		dwc_otg_hcd->fiq_state->mphi_regs.outdda
++			= otg_dev->os_dep.mphi_base + 0x28;
++		dwc_otg_hcd->fiq_state->mphi_regs.outddb
++			= otg_dev->os_dep.mphi_base + 0x2c;
++		dwc_otg_hcd->fiq_state->mphi_regs.intstat
++			= otg_dev->os_dep.mphi_base + 0x50;
++		DWC_WARN("MPHI regs_base at %px",
++			 dwc_otg_hcd->fiq_state->mphi_regs.base);
++
++		//Enable mphi peripheral
++		writel((1<<31),dwc_otg_hcd->fiq_state->mphi_regs.ctrl);
++#ifdef DEBUG
++		if (readl(dwc_otg_hcd->fiq_state->mphi_regs.ctrl) & 0x80000000)
++			DWC_WARN("MPHI periph has been enabled");
++		else
++			DWC_WARN("MPHI periph has NOT been enabled");
++#endif
++	}
++	// Enable FIQ interrupt from USB peripheral
++#ifdef CONFIG_ARM64
++	irq = otg_dev->os_dep.fiq_num;
++
++	if (irq < 0) {
++		DWC_ERROR("Can't get SIM-FIQ irq");
++		return;
++	}
++
++	retval = request_irq(irq, fiq_irq_handler, 0, "dwc_otg_sim-fiq", dwc_otg_hcd);
++
++	if (retval < 0) {
++		DWC_ERROR("Unable to request SIM-FIQ irq\n");
++		return;
++	}
++
++	simfiq_irq = irq;
++#else
++#ifdef CONFIG_GENERIC_IRQ_MULTI_HANDLER
++	irq = otg_dev->os_dep.fiq_num;
++#else
++	irq = INTERRUPT_VC_USB;
++#endif
++	if (irq < 0) {
++		DWC_ERROR("Can't get FIQ irq");
++		return;
++	}
++	/*
++	 * We could take an interrupt immediately after enabling the FIQ.
++	 * Ensure coherency of hcd->fiq_state.
++	 */
++	smp_mb();
++	enable_fiq(irq);
++	local_fiq_enable();
++#endif
++
++}
++
++/**
++ * Initializes the HCD. This function allocates memory for and initializes the
++ * static parts of the usb_hcd and dwc_otg_hcd structures. It also registers the
++ * USB bus with the core and calls the hc_driver->start() function. It returns
++ * a negative error on failure.
++ */
++int hcd_init(dwc_bus_dev_t *_dev)
++{
++	struct usb_hcd *hcd = NULL;
++	dwc_otg_hcd_t *dwc_otg_hcd = NULL;
++	dwc_otg_device_t *otg_dev = DWC_OTG_BUSDRVDATA(_dev);
++	int retval = 0;
++        u64 dmamask;
++
++	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD INIT otg_dev=%p\n", otg_dev);
++
++	/* Set device flags indicating whether the HCD supports DMA. */
++	if (dwc_otg_is_dma_enable(otg_dev->core_if))
++                dmamask = DMA_BIT_MASK(32);
++        else
++                dmamask = 0;
++
++#if    defined(LM_INTERFACE) || defined(PLATFORM_INTERFACE)
++        dma_set_mask(&_dev->dev, dmamask);
++        dma_set_coherent_mask(&_dev->dev, dmamask);
++#elif  defined(PCI_INTERFACE)
++        pci_set_dma_mask(_dev, dmamask);
++        pci_set_consistent_dma_mask(_dev, dmamask);
++#endif
++
++	/*
++	 * Allocate memory for the base HCD plus the DWC OTG HCD.
++	 * Initialize the base HCD.
++	 */
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30)
++	hcd = usb_create_hcd(&dwc_otg_hc_driver, &_dev->dev, _dev->dev.bus_id);
++#else
++	hcd = usb_create_hcd(&dwc_otg_hc_driver, &_dev->dev, dev_name(&_dev->dev));
++	hcd->has_tt = 1;
++//      hcd->uses_new_polling = 1;
++//      hcd->poll_rh = 0;
++#endif
++	if (!hcd) {
++		retval = -ENOMEM;
++		goto error1;
++	}
++
++	hcd->regs = otg_dev->os_dep.base;
++
++
++	/* Initialize the DWC OTG HCD. */
++	dwc_otg_hcd = dwc_otg_hcd_alloc_hcd();
++	if (!dwc_otg_hcd) {
++		goto error2;
++	}
++	((struct wrapper_priv_data *)(hcd->hcd_priv))->dwc_otg_hcd =
++	    dwc_otg_hcd;
++	otg_dev->hcd = dwc_otg_hcd;
++	otg_dev->hcd->otg_dev = otg_dev;
++
++#ifdef CONFIG_ARM64
++	if (dwc_otg_hcd_init(dwc_otg_hcd, otg_dev->core_if))
++		goto error2;
++
++	if (fiq_enable)
++		hcd_init_fiq(otg_dev);
++#else
++	if (dwc_otg_hcd_init(dwc_otg_hcd, otg_dev->core_if)) {
++		goto error2;
++	}
++
++	if (fiq_enable) {
++		if (num_online_cpus() > 1) {
++			/*
++			 * bcm2709: can run the FIQ on a separate core to IRQs.
++			 * Ensure driver state is visible to other cores before setting up the FIQ.
++			 */
++			smp_mb();
++			smp_call_function_single(1, hcd_init_fiq, otg_dev, 1);
++		} else {
++			smp_call_function_single(0, hcd_init_fiq, otg_dev, 1);
++		}
++	}
++#endif
++
++	hcd->self.otg_port = dwc_otg_hcd_otg_port(dwc_otg_hcd);
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,33) //don't support for LM(with 2.6.20.1 kernel)
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35) //version field absent later
++	hcd->self.otg_version = dwc_otg_get_otg_version(otg_dev->core_if);
++#endif
++	/* Don't support SG list at this point */
++	hcd->self.sg_tablesize = 0;
++#endif
++	/*
++	 * Finish generic HCD initialization and start the HCD. This function
++	 * allocates the DMA buffer pool, registers the USB bus, requests the
++	 * IRQ line, and calls hcd_start method.
++	 */
++	retval = usb_add_hcd(hcd, otg_dev->os_dep.irq_num, IRQF_SHARED);
++	if (retval < 0) {
++		goto error2;
++	}
++
++	dwc_otg_hcd_set_priv_data(dwc_otg_hcd, hcd);
++	return 0;
++
++error2:
++	usb_put_hcd(hcd);
++error1:
++	return retval;
++}
++
++/**
++ * Removes the HCD.
++ * Frees memory and resources associated with the HCD and deregisters the bus.
++ */
++void hcd_remove(dwc_bus_dev_t *_dev)
++{
++	dwc_otg_device_t *otg_dev = DWC_OTG_BUSDRVDATA(_dev);
++	dwc_otg_hcd_t *dwc_otg_hcd;
++	struct usb_hcd *hcd;
++
++	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD REMOVE otg_dev=%p\n", otg_dev);
++
++	if (!otg_dev) {
++		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev NULL!\n", __func__);
++		return;
++	}
++
++	dwc_otg_hcd = otg_dev->hcd;
++
++	if (!dwc_otg_hcd) {
++		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev->hcd NULL!\n", __func__);
++		return;
++	}
++
++	hcd = dwc_otg_hcd_to_hcd(dwc_otg_hcd);
++
++	if (!hcd) {
++		DWC_DEBUGPL(DBG_ANY,
++			    "%s: dwc_otg_hcd_to_hcd(dwc_otg_hcd) NULL!\n",
++			    __func__);
++		return;
++	}
++	usb_remove_hcd(hcd);
++	dwc_otg_hcd_set_priv_data(dwc_otg_hcd, NULL);
++	dwc_otg_hcd_remove(dwc_otg_hcd);
++	usb_put_hcd(hcd);
++}
++
++/* =========================================================================
++ *  Linux HC Driver Functions
++ * ========================================================================= */
++
++/** Initializes the DWC_otg controller and its root hub and prepares it for host
++ * mode operation. Activates the root port. Returns 0 on success and a negative
++ * error code on failure. */
++int hcd_start(struct usb_hcd *hcd)
++{
++	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
++	struct usb_bus *bus;
++
++	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD START\n");
++	bus = hcd_to_bus(hcd);
++
++	hcd->state = HC_STATE_RUNNING;
++	if (dwc_otg_hcd_start(dwc_otg_hcd, &hcd_fops)) {
++		return 0;
++	}
++
++	/* Initialize and connect root hub if one is not already attached */
++	if (bus->root_hub) {
++		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD Has Root Hub\n");
++		/* Inform the HUB driver to resume. */
++		usb_hcd_resume_root_hub(hcd);
++	}
++
++	return 0;
++}
++
++/**
++ * Halts the DWC_otg host mode operations in a clean manner. USB transfers are
++ * stopped.
++ */
++void hcd_stop(struct usb_hcd *hcd)
++{
++	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
++
++	dwc_otg_hcd_stop(dwc_otg_hcd);
++}
++
++/** Returns the current frame number. */
++static int get_frame_number(struct usb_hcd *hcd)
++{
++	hprt0_data_t hprt0;
++	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
++	hprt0.d32 = DWC_READ_REG32(dwc_otg_hcd->core_if->host_if->hprt0);
++	if (hprt0.b.prtspd == DWC_HPRT0_PRTSPD_HIGH_SPEED)
++		return dwc_otg_hcd_get_frame_number(dwc_otg_hcd) >> 3;
++	else
++		return dwc_otg_hcd_get_frame_number(dwc_otg_hcd);
++}
++
++#ifdef DEBUG
++static void dump_urb_info(struct urb *urb, char *fn_name)
++{
++	DWC_PRINTF("%s, urb %p\n", fn_name, urb);
++	DWC_PRINTF("  Device address: %d\n", usb_pipedevice(urb->pipe));
++	DWC_PRINTF("  Endpoint: %d, %s\n", usb_pipeendpoint(urb->pipe),
++		   (usb_pipein(urb->pipe) ? "IN" : "OUT"));
++	DWC_PRINTF("  Endpoint type: %s\n", ( {
++					     char *pipetype;
++					     switch (usb_pipetype(urb->pipe)) {
++case PIPE_CONTROL:
++pipetype = "CONTROL"; break; case PIPE_BULK:
++pipetype = "BULK"; break; case PIPE_INTERRUPT:
++pipetype = "INTERRUPT"; break; case PIPE_ISOCHRONOUS:
++pipetype = "ISOCHRONOUS"; break; default:
++					     pipetype = "UNKNOWN"; break;};
++					     pipetype;}
++		   )) ;
++	DWC_PRINTF("  Speed: %s\n", ( {
++				     char *speed; switch (urb->dev->speed) {
++case USB_SPEED_HIGH:
++speed = "HIGH"; break; case USB_SPEED_FULL:
++speed = "FULL"; break; case USB_SPEED_LOW:
++speed = "LOW"; break; default:
++				     speed = "UNKNOWN"; break;};
++				     speed;}
++		   )) ;
++	DWC_PRINTF("  Max packet size: %d\n",
++		   usb_maxpacket(urb->dev, urb->pipe);
++	DWC_PRINTF("  Data buffer length: %d\n", urb->transfer_buffer_length);
++	DWC_PRINTF("  Transfer buffer: %p, Transfer DMA: %p\n",
++		   urb->transfer_buffer, (void *)urb->transfer_dma);
++	DWC_PRINTF("  Setup buffer: %p, Setup DMA: %p\n",
++		   urb->setup_packet, (void *)urb->setup_dma);
++	DWC_PRINTF("  Interval: %d\n", urb->interval);
++	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
++		int i;
++		for (i = 0; i < urb->number_of_packets; i++) {
++			DWC_PRINTF("  ISO Desc %d:\n", i);
++			DWC_PRINTF("    offset: %d, length %d\n",
++				   urb->iso_frame_desc[i].offset,
++				   urb->iso_frame_desc[i].length);
++		}
++	}
++}
++#endif
++
++/** Starts processing a USB transfer request specified by a USB Request Block
++ * (URB). mem_flags indicates the type of memory allocation to use while
++ * processing this URB. */
++static int dwc_otg_urb_enqueue(struct usb_hcd *hcd,
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
++		       struct usb_host_endpoint *ep,
++#endif
++		       struct urb *urb, gfp_t mem_flags)
++{
++	int retval = 0;
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28)
++	struct usb_host_endpoint *ep = urb->ep;
++#endif
++	dwc_irqflags_t irqflags;
++        void **ref_ep_hcpriv = &ep->hcpriv;
++	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
++	dwc_otg_hcd_urb_t *dwc_otg_urb;
++	int i;
++	int alloc_bandwidth = 0;
++	uint8_t ep_type = 0;
++	uint32_t flags = 0;
++	void *buf;
++
++#ifdef DEBUG
++	if (CHK_DEBUG_LEVEL(DBG_HCDV | DBG_HCD_URB)) {
++		dump_urb_info(urb, "dwc_otg_urb_enqueue");
++	}
++#endif
++	if ((usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
++	    || (usb_pipetype(urb->pipe) == PIPE_INTERRUPT)) {
++		if (!dwc_otg_hcd_is_bandwidth_allocated
++		    (dwc_otg_hcd, ref_ep_hcpriv)) {
++			alloc_bandwidth = 1;
++		}
++	}
++
++	switch (usb_pipetype(urb->pipe)) {
++	case PIPE_CONTROL:
++		ep_type = USB_ENDPOINT_XFER_CONTROL;
++		break;
++	case PIPE_ISOCHRONOUS:
++		ep_type = USB_ENDPOINT_XFER_ISOC;
++		break;
++	case PIPE_BULK:
++		ep_type = USB_ENDPOINT_XFER_BULK;
++		break;
++	case PIPE_INTERRUPT:
++		ep_type = USB_ENDPOINT_XFER_INT;
++		break;
++	default:
++                DWC_WARN("Wrong EP type - %d\n", usb_pipetype(urb->pipe));
++	}
++
++        /* # of packets is often 0 - do we really need to call this then? */
++	dwc_otg_urb = dwc_otg_hcd_urb_alloc(dwc_otg_hcd,
++					    urb->number_of_packets,
++					    mem_flags == GFP_ATOMIC ? 1 : 0);
++
++	if(dwc_otg_urb == NULL)
++		return -ENOMEM;
++
++	if (!dwc_otg_urb && urb->number_of_packets)
++		return -ENOMEM;
++
++	dwc_otg_hcd_urb_set_pipeinfo(dwc_otg_urb, usb_pipedevice(urb->pipe),
++				     usb_pipeendpoint(urb->pipe), ep_type,
++				     usb_pipein(urb->pipe),
++				     usb_maxpacket(urb->dev, urb->pipe));
++
++	buf = urb->transfer_buffer;
++	if (hcd_uses_dma(hcd) && !buf && urb->transfer_buffer_length) {
++		/*
++		 * Calculate virtual address from physical address,
++		 * because some class driver may not fill transfer_buffer.
++		 * In Buffer DMA mode virual address is used,
++		 * when handling non DWORD aligned buffers.
++		 */
++		buf = (void *)__bus_to_virt((unsigned long)urb->transfer_dma);
++		dev_warn_once(&urb->dev->dev,
++			      "USB transfer_buffer was NULL, will use __bus_to_virt(%pad)=%p\n",
++			      &urb->transfer_dma, buf);
++	}
++
++	if (!buf && urb->transfer_buffer_length) {
++		DWC_FREE(dwc_otg_urb);
++		DWC_ERROR("transfer_buffer is NULL in PIO mode or both "
++			   "transfer_buffer and transfer_dma are NULL in DMA mode\n");
++		return -EINVAL;
++	}
++
++	if (!(urb->transfer_flags & URB_NO_INTERRUPT))
++		flags |= URB_GIVEBACK_ASAP;
++	if (urb->transfer_flags & URB_ZERO_PACKET)
++		flags |= URB_SEND_ZERO_PACKET;
++
++	dwc_otg_hcd_urb_set_params(dwc_otg_urb, urb, buf,
++				   urb->transfer_dma,
++				   urb->transfer_buffer_length,
++				   urb->setup_packet,
++				   urb->setup_dma, flags, urb->interval);
++
++	for (i = 0; i < urb->number_of_packets; ++i) {
++		dwc_otg_hcd_urb_set_iso_desc_params(dwc_otg_urb, i,
++						    urb->
++						    iso_frame_desc[i].offset,
++						    urb->
++						    iso_frame_desc[i].length);
++	}
++
++	DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &irqflags);
++	urb->hcpriv = dwc_otg_urb;
++#if USB_URB_EP_LINKING
++	retval = usb_hcd_link_urb_to_ep(hcd, urb);
++	if (0 == retval)
++#endif
++	{
++		retval = dwc_otg_hcd_urb_enqueue(dwc_otg_hcd, dwc_otg_urb,
++						/*(dwc_otg_qh_t **)*/
++						ref_ep_hcpriv, 1);
++		if (0 == retval) {
++			if (alloc_bandwidth) {
++				allocate_bus_bandwidth(hcd,
++						dwc_otg_hcd_get_ep_bandwidth(
++							dwc_otg_hcd, *ref_ep_hcpriv),
++						urb);
++			}
++		} else {
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG dwc_otg_hcd_urb_enqueue failed rc %d\n", retval);
++#if USB_URB_EP_LINKING
++			usb_hcd_unlink_urb_from_ep(hcd, urb);
++#endif
++			DWC_FREE(dwc_otg_urb);
++			urb->hcpriv = NULL;
++			if (retval == -DWC_E_NO_DEVICE)
++				retval = -ENODEV;
++		}
++	}
++#if USB_URB_EP_LINKING
++	else
++	{
++		DWC_FREE(dwc_otg_urb);
++		urb->hcpriv = NULL;
++	}
++#endif
++	DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock, irqflags);
++	return retval;
++}
++
++/** Aborts/cancels a USB transfer request. Always returns 0 to indicate
++ * success.  */
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
++static int dwc_otg_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
++#else
++static int dwc_otg_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
++#endif
++{
++	dwc_irqflags_t flags;
++	dwc_otg_hcd_t *dwc_otg_hcd;
++        int rc;
++
++	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD URB Dequeue\n");
++
++	dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
++
++#ifdef DEBUG
++	if (CHK_DEBUG_LEVEL(DBG_HCDV | DBG_HCD_URB)) {
++		dump_urb_info(urb, "dwc_otg_urb_dequeue");
++	}
++#endif
++
++	DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &flags);
++	rc = usb_hcd_check_unlink_urb(hcd, urb, status);
++	if (0 == rc) {
++		if(urb->hcpriv != NULL) {
++	                dwc_otg_hcd_urb_dequeue(dwc_otg_hcd,
++	                                    (dwc_otg_hcd_urb_t *)urb->hcpriv);
++
++		        DWC_FREE(urb->hcpriv);
++			urb->hcpriv = NULL;
++		}
++        }
++
++        if (0 == rc) {
++		/* Higher layer software sets URB status. */
++#if USB_URB_EP_LINKING
++                usb_hcd_unlink_urb_from_ep(hcd, urb);
++#endif
++		DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock, flags);
++
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
++                usb_hcd_giveback_urb(hcd, urb);
++#else
++                usb_hcd_giveback_urb(hcd, urb, status);
++#endif
++                if (CHK_DEBUG_LEVEL(DBG_HCDV | DBG_HCD_URB)) {
++                        DWC_PRINTF("Called usb_hcd_giveback_urb() \n");
++                        DWC_PRINTF("  1urb->status = %d\n", urb->status);
++                }
++                DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD URB Dequeue OK\n");
++        } else {
++		DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock, flags);
++                DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD URB Dequeue failed - rc %d\n",
++                            rc);
++        }
++
++	return rc;
++}
++
++/* Frees resources in the DWC_otg controller related to a given endpoint. Also
++ * clears state in the HCD related to the endpoint. Any URBs for the endpoint
++ * must already be dequeued. */
++static void endpoint_disable(struct usb_hcd *hcd, struct usb_host_endpoint *ep)
++{
++	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
++
++	DWC_DEBUGPL(DBG_HCD,
++		    "DWC OTG HCD EP DISABLE: _bEndpointAddress=0x%02x, "
++		    "endpoint=%d\n", ep->desc.bEndpointAddress,
++		    dwc_ep_addr_to_endpoint(ep->desc.bEndpointAddress));
++	dwc_otg_hcd_endpoint_disable(dwc_otg_hcd, ep->hcpriv, 250);
++	ep->hcpriv = NULL;
++}
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30)
++/* Resets endpoint specific parameter values, in current version used to reset
++ * the data toggle(as a WA). This function can be called from usb_clear_halt routine */
++static void endpoint_reset(struct usb_hcd *hcd, struct usb_host_endpoint *ep)
++{
++	dwc_irqflags_t flags;
++	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
++
++	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD EP RESET: Endpoint Num=0x%02d\n",
++		    ep->desc.bEndpointAddress);
++
++	DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &flags);
++	if (ep->hcpriv) {
++		dwc_otg_hcd_endpoint_reset(dwc_otg_hcd, ep->hcpriv);
++	}
++	DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock, flags);
++}
++#endif
++
++/** Handles host mode interrupts for the DWC_otg controller. Returns IRQ_NONE if
++ * there was no interrupt to handle. Returns IRQ_HANDLED if there was a valid
++ * interrupt.
++ *
++ * This function is called by the USB core when an interrupt occurs */
++static irqreturn_t dwc_otg_hcd_irq(struct usb_hcd *hcd)
++{
++	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
++	int32_t retval = dwc_otg_hcd_handle_intr(dwc_otg_hcd);
++	if (retval != 0) {
++		S3C2410X_CLEAR_EINTPEND();
++	}
++	return IRQ_RETVAL(retval);
++}
++
++/** Creates Status Change bitmap for the root hub and root port. The bitmap is
++ * returned in buf. Bit 0 is the status change indicator for the root hub. Bit 1
++ * is the status change indicator for the single root port. Returns 1 if either
++ * change indicator is 1, otherwise returns 0. */
++int hub_status_data(struct usb_hcd *hcd, char *buf)
++{
++	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
++
++	buf[0] = 0;
++	buf[0] |= (dwc_otg_hcd_is_status_changed(dwc_otg_hcd, 1)) << 1;
++
++	return (buf[0] != 0);
++}
++
++/** Handles hub class-specific requests. */
++int hub_control(struct usb_hcd *hcd,
++		u16 typeReq, u16 wValue, u16 wIndex, char *buf, u16 wLength)
++{
++	int retval;
++
++	retval = dwc_otg_hcd_hub_control(hcd_to_dwc_otg_hcd(hcd),
++					 typeReq, wValue, wIndex, buf, wLength);
++
++	switch (retval) {
++	case -DWC_E_INVALID:
++		retval = -EINVAL;
++		break;
++	}
++
++	return retval;
++}
++
++#endif /* DWC_DEVICE_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c
+@@ -0,0 +1,974 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd_queue.c $
++ * $Revision: #44 $
++ * $Date: 2011/10/26 $
++ * $Change: 1873028 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_DEVICE_ONLY
++
++/**
++ * @file
++ *
++ * This file contains the functions to manage Queue Heads and Queue
++ * Transfer Descriptors.
++ */
++
++#include "dwc_otg_hcd.h"
++#include "dwc_otg_regs.h"
++
++extern bool microframe_schedule;
++extern unsigned short int_ep_interval_min;
++
++/**
++ * Free each QTD in the QH's QTD-list then free the QH.  QH should already be
++ * removed from a list.  QTD list should already be empty if called from URB
++ * Dequeue.
++ *
++ * @param hcd HCD instance.
++ * @param qh The QH to free.
++ */
++void dwc_otg_hcd_qh_free(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	dwc_otg_qtd_t *qtd, *qtd_tmp;
++	dwc_irqflags_t flags;
++	uint32_t buf_size = 0;
++	uint8_t *align_buf_virt = NULL;
++	dwc_dma_t align_buf_dma;
++	struct device *dev = dwc_otg_hcd_to_dev(hcd);
++
++	/* Free each QTD in the QTD list */
++	DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
++	DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &qh->qtd_list, qtd_list_entry) {
++		DWC_CIRCLEQ_REMOVE(&qh->qtd_list, qtd, qtd_list_entry);
++		dwc_otg_hcd_qtd_free(qtd);
++	}
++
++	if (hcd->core_if->dma_desc_enable) {
++		dwc_otg_hcd_qh_free_ddma(hcd, qh);
++	} else if (qh->dw_align_buf) {
++		if (qh->ep_type == UE_ISOCHRONOUS) {
++			buf_size = 4096;
++		} else {
++			buf_size = hcd->core_if->core_params->max_transfer_size;
++		}
++		align_buf_virt = qh->dw_align_buf;
++		align_buf_dma = qh->dw_align_buf_dma;
++	}
++
++	DWC_FREE(qh);
++	DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
++	if (align_buf_virt)
++		DWC_DMA_FREE(dev, buf_size, align_buf_virt, align_buf_dma);
++	return;
++}
++
++#define BitStuffTime(bytecount)  ((8 * 7* bytecount) / 6)
++#define HS_HOST_DELAY		5	/* nanoseconds */
++#define FS_LS_HOST_DELAY	1000	/* nanoseconds */
++#define HUB_LS_SETUP		333	/* nanoseconds */
++#define NS_TO_US(ns)		((ns + 500) / 1000)
++				/* convert & round nanoseconds to microseconds */
++
++static uint32_t calc_bus_time(int speed, int is_in, int is_isoc, int bytecount)
++{
++	unsigned long retval;
++
++	switch (speed) {
++	case USB_SPEED_HIGH:
++		if (is_isoc) {
++			retval =
++			    ((38 * 8 * 2083) +
++			     (2083 * (3 + BitStuffTime(bytecount)))) / 1000 +
++			    HS_HOST_DELAY;
++		} else {
++			retval =
++			    ((55 * 8 * 2083) +
++			     (2083 * (3 + BitStuffTime(bytecount)))) / 1000 +
++			    HS_HOST_DELAY;
++		}
++		break;
++	case USB_SPEED_FULL:
++		if (is_isoc) {
++			retval =
++			    (8354 * (31 + 10 * BitStuffTime(bytecount))) / 1000;
++			if (is_in) {
++				retval = 7268 + FS_LS_HOST_DELAY + retval;
++			} else {
++				retval = 6265 + FS_LS_HOST_DELAY + retval;
++			}
++		} else {
++			retval =
++			    (8354 * (31 + 10 * BitStuffTime(bytecount))) / 1000;
++			retval = 9107 + FS_LS_HOST_DELAY + retval;
++		}
++		break;
++	case USB_SPEED_LOW:
++		if (is_in) {
++			retval =
++			    (67667 * (31 + 10 * BitStuffTime(bytecount))) /
++			    1000;
++			retval =
++			    64060 + (2 * HUB_LS_SETUP) + FS_LS_HOST_DELAY +
++			    retval;
++		} else {
++			retval =
++			    (66700 * (31 + 10 * BitStuffTime(bytecount))) /
++			    1000;
++			retval =
++			    64107 + (2 * HUB_LS_SETUP) + FS_LS_HOST_DELAY +
++			    retval;
++		}
++		break;
++	default:
++		DWC_WARN("Unknown device speed\n");
++		retval = -1;
++	}
++
++	return NS_TO_US(retval);
++}
++
++/**
++ * Initializes a QH structure.
++ *
++ * @param hcd The HCD state structure for the DWC OTG controller.
++ * @param qh  The QH to init.
++ * @param urb Holds the information about the device/endpoint that we need
++ * 	      to initialize the QH.
++ */
++#define SCHEDULE_SLOP 10
++void qh_init(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh, dwc_otg_hcd_urb_t * urb)
++{
++	char *speed, *type;
++	int dev_speed;
++	uint32_t hub_addr, hub_port;
++	hprt0_data_t hprt;
++
++	dwc_memset(qh, 0, sizeof(dwc_otg_qh_t));
++	hprt.d32 = DWC_READ_REG32(hcd->core_if->host_if->hprt0);
++
++	/* Initialize QH */
++	qh->ep_type = dwc_otg_hcd_get_pipe_type(&urb->pipe_info);
++	qh->ep_is_in = dwc_otg_hcd_is_pipe_in(&urb->pipe_info) ? 1 : 0;
++
++	qh->data_toggle = DWC_OTG_HC_PID_DATA0;
++	qh->maxp = dwc_otg_hcd_get_mps(&urb->pipe_info);
++	DWC_CIRCLEQ_INIT(&qh->qtd_list);
++	DWC_LIST_INIT(&qh->qh_list_entry);
++	qh->channel = NULL;
++
++	/* FS/LS Enpoint on HS Hub
++	 * NOT virtual root hub */
++	dev_speed = hcd->fops->speed(hcd, urb->priv);
++
++	hcd->fops->hub_info(hcd, urb->priv, &hub_addr, &hub_port);
++	qh->do_split = 0;
++	if (microframe_schedule)
++		qh->speed = dev_speed;
++
++	qh->nak_frame = 0xffff;
++
++	if (hprt.b.prtspd == DWC_HPRT0_PRTSPD_HIGH_SPEED &&
++			dev_speed != USB_SPEED_HIGH) {
++		DWC_DEBUGPL(DBG_HCD,
++			    "QH init: EP %d: TT found at hub addr %d, for port %d\n",
++			    dwc_otg_hcd_get_ep_num(&urb->pipe_info), hub_addr,
++			    hub_port);
++		qh->do_split = 1;
++		qh->skip_count = 0;
++	}
++
++	if (qh->ep_type == UE_INTERRUPT || qh->ep_type == UE_ISOCHRONOUS) {
++		/* Compute scheduling parameters once and save them. */
++
++		/** @todo Account for split transfers in the bus time. */
++		int bytecount =
++		    dwc_hb_mult(qh->maxp) * dwc_max_packet(qh->maxp);
++
++		qh->usecs =
++		    calc_bus_time((qh->do_split ? USB_SPEED_HIGH : dev_speed),
++				  qh->ep_is_in, (qh->ep_type == UE_ISOCHRONOUS),
++				  bytecount);
++		/* Start in a slightly future (micro)frame. */
++		qh->sched_frame = dwc_frame_num_inc(hcd->frame_number,
++						    SCHEDULE_SLOP);
++		qh->interval = urb->interval;
++
++		if (hprt.b.prtspd == DWC_HPRT0_PRTSPD_HIGH_SPEED) {
++			if (dev_speed == USB_SPEED_LOW ||
++					dev_speed == USB_SPEED_FULL) {
++				qh->interval *= 8;
++				qh->sched_frame |= 0x7;
++				qh->start_split_frame = qh->sched_frame;
++			} else if (int_ep_interval_min >= 2 &&
++					qh->interval < int_ep_interval_min &&
++					qh->ep_type == UE_INTERRUPT) {
++				qh->interval = int_ep_interval_min;
++			}
++		}
++	}
++
++	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD QH Initialized\n");
++	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH  - qh = %p\n", qh);
++	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH  - Device Address = %d\n",
++		    dwc_otg_hcd_get_dev_addr(&urb->pipe_info));
++	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH  - Endpoint %d, %s\n",
++		    dwc_otg_hcd_get_ep_num(&urb->pipe_info),
++		    dwc_otg_hcd_is_pipe_in(&urb->pipe_info) ? "IN" : "OUT");
++	switch (dev_speed) {
++	case USB_SPEED_LOW:
++		qh->dev_speed = DWC_OTG_EP_SPEED_LOW;
++		speed = "low";
++		break;
++	case USB_SPEED_FULL:
++		qh->dev_speed = DWC_OTG_EP_SPEED_FULL;
++		speed = "full";
++		break;
++	case USB_SPEED_HIGH:
++		qh->dev_speed = DWC_OTG_EP_SPEED_HIGH;
++		speed = "high";
++		break;
++	default:
++		speed = "?";
++		break;
++	}
++	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH  - Speed = %s\n", speed);
++
++	switch (qh->ep_type) {
++	case UE_ISOCHRONOUS:
++		type = "isochronous";
++		break;
++	case UE_INTERRUPT:
++		type = "interrupt";
++		break;
++	case UE_CONTROL:
++		type = "control";
++		break;
++	case UE_BULK:
++		type = "bulk";
++		break;
++	default:
++		type = "?";
++		break;
++	}
++
++	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH  - Type = %s\n", type);
++
++#ifdef DEBUG
++	if (qh->ep_type == UE_INTERRUPT) {
++		DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH - usecs = %d\n",
++			    qh->usecs);
++		DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH - interval = %d\n",
++			    qh->interval);
++	}
++#endif
++
++}
++
++/**
++ * This function allocates and initializes a QH.
++ *
++ * @param hcd The HCD state structure for the DWC OTG controller.
++ * @param urb Holds the information about the device/endpoint that we need
++ * 	      to initialize the QH.
++ * @param atomic_alloc Flag to do atomic allocation if needed
++ *
++ * @return Returns pointer to the newly allocated QH, or NULL on error. */
++dwc_otg_qh_t *dwc_otg_hcd_qh_create(dwc_otg_hcd_t * hcd,
++				    dwc_otg_hcd_urb_t * urb, int atomic_alloc)
++{
++	dwc_otg_qh_t *qh;
++
++	/* Allocate memory */
++	/** @todo add memflags argument */
++	qh = dwc_otg_hcd_qh_alloc(atomic_alloc);
++	if (qh == NULL) {
++		DWC_ERROR("qh allocation failed");
++		return NULL;
++	}
++
++	qh_init(hcd, qh, urb);
++
++	if (hcd->core_if->dma_desc_enable
++	    && (dwc_otg_hcd_qh_init_ddma(hcd, qh) < 0)) {
++		dwc_otg_hcd_qh_free(hcd, qh);
++		return NULL;
++	}
++
++	return qh;
++}
++
++/* microframe_schedule=0 start */
++
++/**
++ * Checks that a channel is available for a periodic transfer.
++ *
++ * @return 0 if successful, negative error code otherise.
++ */
++static int periodic_channel_available(dwc_otg_hcd_t * hcd)
++{
++	/*
++	 * Currently assuming that there is a dedicated host channnel for each
++	 * periodic transaction plus at least one host channel for
++	 * non-periodic transactions.
++	 */
++	int status;
++	int num_channels;
++
++	num_channels = hcd->core_if->core_params->host_channels;
++	if ((hcd->periodic_channels + hcd->non_periodic_channels < num_channels)
++	    && (hcd->periodic_channels < num_channels - 1)) {
++		status = 0;
++	} else {
++		DWC_INFO("%s: Total channels: %d, Periodic: %d, Non-periodic: %d\n",
++			__func__, num_channels, hcd->periodic_channels, hcd->non_periodic_channels);	//NOTICE
++		status = -DWC_E_NO_SPACE;
++	}
++
++	return status;
++}
++
++/**
++ * Checks that there is sufficient bandwidth for the specified QH in the
++ * periodic schedule. For simplicity, this calculation assumes that all the
++ * transfers in the periodic schedule may occur in the same (micro)frame.
++ *
++ * @param hcd The HCD state structure for the DWC OTG controller.
++ * @param qh QH containing periodic bandwidth required.
++ *
++ * @return 0 if successful, negative error code otherwise.
++ */
++static int check_periodic_bandwidth(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	int status;
++	int16_t max_claimed_usecs;
++
++	status = 0;
++
++	if ((qh->dev_speed == DWC_OTG_EP_SPEED_HIGH) || qh->do_split) {
++		/*
++		 * High speed mode.
++		 * Max periodic usecs is 80% x 125 usec = 100 usec.
++		 */
++
++		max_claimed_usecs = 100 - qh->usecs;
++	} else {
++		/*
++		 * Full speed mode.
++		 * Max periodic usecs is 90% x 1000 usec = 900 usec.
++		 */
++		max_claimed_usecs = 900 - qh->usecs;
++	}
++
++	if (hcd->periodic_usecs > max_claimed_usecs) {
++		DWC_INFO("%s: already claimed usecs %d, required usecs %d\n", __func__, hcd->periodic_usecs, qh->usecs);	//NOTICE
++		status = -DWC_E_NO_SPACE;
++	}
++
++	return status;
++}
++
++/* microframe_schedule=0 end */
++
++/**
++ * Microframe scheduler
++ * track the total use in hcd->frame_usecs
++ * keep each qh use in qh->frame_usecs
++ * when surrendering the qh then donate the time back
++ */
++const unsigned short max_uframe_usecs[]={ 100, 100, 100, 100, 100, 100, 30, 0 };
++
++/*
++ * called from dwc_otg_hcd.c:dwc_otg_hcd_init
++ */
++void init_hcd_usecs(dwc_otg_hcd_t *_hcd)
++{
++	int i;
++	if (_hcd->flags.b.port_speed == DWC_HPRT0_PRTSPD_FULL_SPEED) {
++		_hcd->frame_usecs[0] = 900;
++		for (i = 1; i < 8; i++)
++			_hcd->frame_usecs[i] = 0;
++	} else {
++		for (i = 0; i < 8; i++)
++			_hcd->frame_usecs[i] = max_uframe_usecs[i];
++	}
++}
++
++static int find_single_uframe(dwc_otg_hcd_t * _hcd, dwc_otg_qh_t * _qh)
++{
++	int i;
++	unsigned short utime;
++	int t_left;
++	int ret;
++	int done;
++
++	ret = -1;
++	utime = _qh->usecs;
++	t_left = utime;
++	i = 0;
++	done = 0;
++	while (done == 0) {
++		/* At the start _hcd->frame_usecs[i] = max_uframe_usecs[i]; */
++		if (utime <= _hcd->frame_usecs[i]) {
++			_hcd->frame_usecs[i] -= utime;
++			_qh->frame_usecs[i] += utime;
++			t_left -= utime;
++			ret = i;
++			done = 1;
++			return ret;
++		} else {
++			i++;
++			if (i == 8) {
++				done = 1;
++				ret = -1;
++			}
++		}
++	}
++	return ret;
++ }
++
++/*
++ * use this for FS apps that can span multiple uframes
++  */
++static int find_multi_uframe(dwc_otg_hcd_t * _hcd, dwc_otg_qh_t * _qh)
++{
++	int i;
++	int j;
++	unsigned short utime;
++	int t_left;
++	int ret;
++	int done;
++	unsigned short xtime;
++
++	ret = -1;
++	utime = _qh->usecs;
++	t_left = utime;
++	i = 0;
++	done = 0;
++loop:
++	while (done == 0) {
++		if(_hcd->frame_usecs[i] <= 0) {
++			i++;
++			if (i == 8) {
++				done = 1;
++				ret = -1;
++			}
++			goto loop;
++		}
++
++		/*
++		 * we need n consecutive slots
++		 * so use j as a start slot j plus j+1 must be enough time (for now)
++		 */
++		xtime= _hcd->frame_usecs[i];
++		for (j = i+1 ; j < 8 ; j++ ) {
++                       /*
++                        * if we add this frame remaining time to xtime we may
++                        * be OK, if not we need to test j for a complete frame
++                        */
++                       if ((xtime+_hcd->frame_usecs[j]) < utime) {
++                               if (_hcd->frame_usecs[j] < max_uframe_usecs[j]) {
++                                       j = 8;
++                                       ret = -1;
++                                       continue;
++                               }
++                       }
++                       if (xtime >= utime) {
++                               ret = i;
++                               j = 8;  /* stop loop with a good value ret */
++                               continue;
++                       }
++                       /* add the frame time to x time */
++                       xtime += _hcd->frame_usecs[j];
++		       /* we must have a fully available next frame or break */
++		       if ((xtime < utime)
++				       && (_hcd->frame_usecs[j] == max_uframe_usecs[j])) {
++			       ret = -1;
++			       j = 8;  /* stop loop with a bad value ret */
++			       continue;
++		       }
++		}
++		if (ret >= 0) {
++			t_left = utime;
++			for (j = i; (t_left>0) && (j < 8); j++ ) {
++				t_left -= _hcd->frame_usecs[j];
++				if ( t_left <= 0 ) {
++					_qh->frame_usecs[j] += _hcd->frame_usecs[j] + t_left;
++					_hcd->frame_usecs[j]= -t_left;
++					ret = i;
++					done = 1;
++				} else {
++					_qh->frame_usecs[j] += _hcd->frame_usecs[j];
++					_hcd->frame_usecs[j] = 0;
++				}
++			}
++		} else {
++			i++;
++			if (i == 8) {
++				done = 1;
++				ret = -1;
++			}
++		}
++	}
++	return ret;
++}
++
++static int find_uframe(dwc_otg_hcd_t * _hcd, dwc_otg_qh_t * _qh)
++{
++	int ret;
++	ret = -1;
++
++	if (_qh->speed == USB_SPEED_HIGH ||
++		_hcd->flags.b.port_speed == DWC_HPRT0_PRTSPD_FULL_SPEED) {
++		/* if this is a hs transaction we need a full frame - or account for FS usecs */
++		ret = find_single_uframe(_hcd, _qh);
++	} else {
++		/* if this is a fs transaction we may need a sequence of frames */
++		ret = find_multi_uframe(_hcd, _qh);
++	}
++	return ret;
++}
++
++/**
++ * Checks that the max transfer size allowed in a host channel is large enough
++ * to handle the maximum data transfer in a single (micro)frame for a periodic
++ * transfer.
++ *
++ * @param hcd The HCD state structure for the DWC OTG controller.
++ * @param qh QH for a periodic endpoint.
++ *
++ * @return 0 if successful, negative error code otherwise.
++ */
++static int check_max_xfer_size(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	int status;
++	uint32_t max_xfer_size;
++	uint32_t max_channel_xfer_size;
++
++	status = 0;
++
++	max_xfer_size = dwc_max_packet(qh->maxp) * dwc_hb_mult(qh->maxp);
++	max_channel_xfer_size = hcd->core_if->core_params->max_transfer_size;
++
++	if (max_xfer_size > max_channel_xfer_size) {
++		DWC_INFO("%s: Periodic xfer length %d > " "max xfer length for channel %d\n",
++				__func__, max_xfer_size, max_channel_xfer_size);	//NOTICE
++		status = -DWC_E_NO_SPACE;
++	}
++
++	return status;
++}
++
++
++
++/**
++ * Schedules an interrupt or isochronous transfer in the periodic schedule.
++ *
++ * @param hcd The HCD state structure for the DWC OTG controller.
++ * @param qh QH for the periodic transfer. The QH should already contain the
++ * scheduling information.
++ *
++ * @return 0 if successful, negative error code otherwise.
++ */
++static int schedule_periodic(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	int status = 0;
++
++	if (microframe_schedule) {
++		int frame;
++		status = find_uframe(hcd, qh);
++		frame = -1;
++		if (status == 0) {
++			frame = 7;
++		} else {
++			if (status > 0 )
++				frame = status-1;
++		}
++
++		/* Set the new frame up */
++		if (frame > -1) {
++			qh->sched_frame &= ~0x7;
++			qh->sched_frame |= (frame & 7);
++		}
++
++		if (status != -1)
++			status = 0;
++	} else {
++		status = periodic_channel_available(hcd);
++		if (status) {
++			DWC_INFO("%s: No host channel available for periodic " "transfer.\n", __func__);	//NOTICE
++			return status;
++		}
++
++		status = check_periodic_bandwidth(hcd, qh);
++	}
++	if (status) {
++		DWC_INFO("%s: Insufficient periodic bandwidth for "
++			    "periodic transfer.\n", __func__);
++		return -DWC_E_NO_SPACE;
++	}
++	status = check_max_xfer_size(hcd, qh);
++	if (status) {
++		DWC_INFO("%s: Channel max transfer size too small "
++			    "for periodic transfer.\n", __func__);
++		return status;
++	}
++
++	if (hcd->core_if->dma_desc_enable) {
++		/* Don't rely on SOF and start in ready schedule */
++		DWC_LIST_INSERT_TAIL(&hcd->periodic_sched_ready, &qh->qh_list_entry);
++	}
++	else {
++		if(fiq_enable && (DWC_LIST_EMPTY(&hcd->periodic_sched_inactive) || dwc_frame_num_le(qh->sched_frame, hcd->fiq_state->next_sched_frame)))
++		{
++			hcd->fiq_state->next_sched_frame = qh->sched_frame;
++
++		}
++		/* Always start in the inactive schedule. */
++		DWC_LIST_INSERT_TAIL(&hcd->periodic_sched_inactive, &qh->qh_list_entry);
++	}
++
++	if (!microframe_schedule) {
++		/* Reserve the periodic channel. */
++		hcd->periodic_channels++;
++	}
++
++	/* Update claimed usecs per (micro)frame. */
++	hcd->periodic_usecs += qh->usecs;
++
++	return status;
++}
++
++
++/**
++ * This function adds a QH to either the non periodic or periodic schedule if
++ * it is not already in the schedule. If the QH is already in the schedule, no
++ * action is taken.
++ *
++ * @return 0 if successful, negative error code otherwise.
++ */
++int dwc_otg_hcd_qh_add(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	int status = 0;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	if (!DWC_LIST_EMPTY(&qh->qh_list_entry)) {
++		/* QH already in a schedule. */
++		return status;
++	}
++
++	/* Add the new QH to the appropriate schedule */
++	if (dwc_qh_is_non_per(qh)) {
++		/* Always start in the inactive schedule. */
++		DWC_LIST_INSERT_TAIL(&hcd->non_periodic_sched_inactive,
++				     &qh->qh_list_entry);
++		//hcd->fiq_state->kick_np_queues = 1;
++	} else {
++		/* If the QH wasn't in a schedule, then sched_frame is stale. */
++		qh->sched_frame = dwc_frame_num_inc(dwc_otg_hcd_get_frame_number(hcd),
++						    max_t(uint32_t, qh->interval, SCHEDULE_SLOP));
++		status = schedule_periodic(hcd, qh);
++		qh->start_split_frame = qh->sched_frame;
++		if ( !hcd->periodic_qh_count ) {
++			intr_mask.b.sofintr = 1;
++			if (fiq_enable) {
++				local_fiq_disable();
++				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
++				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, intr_mask.d32, intr_mask.d32);
++				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
++				local_fiq_enable();
++			} else {
++				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, intr_mask.d32, intr_mask.d32);
++			}
++		}
++		hcd->periodic_qh_count++;
++	}
++
++	return status;
++}
++
++/**
++ * Removes an interrupt or isochronous transfer from the periodic schedule.
++ *
++ * @param hcd The HCD state structure for the DWC OTG controller.
++ * @param qh QH for the periodic transfer.
++ */
++static void deschedule_periodic(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	int i;
++	DWC_LIST_REMOVE_INIT(&qh->qh_list_entry);
++
++	/* Update claimed usecs per (micro)frame. */
++	hcd->periodic_usecs -= qh->usecs;
++
++	if (!microframe_schedule) {
++		/* Release the periodic channel reservation. */
++		hcd->periodic_channels--;
++	} else {
++		for (i = 0; i < 8; i++) {
++			hcd->frame_usecs[i] += qh->frame_usecs[i];
++			qh->frame_usecs[i] = 0;
++		}
++	}
++}
++
++/**
++ * Removes a QH from either the non-periodic or periodic schedule.  Memory is
++ * not freed.
++ *
++ * @param hcd The HCD state structure.
++ * @param qh QH to remove from schedule. */
++void dwc_otg_hcd_qh_remove(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	if (DWC_LIST_EMPTY(&qh->qh_list_entry)) {
++		/* QH is not in a schedule. */
++		return;
++	}
++
++	if (dwc_qh_is_non_per(qh)) {
++		if (hcd->non_periodic_qh_ptr == &qh->qh_list_entry) {
++			hcd->non_periodic_qh_ptr =
++			    hcd->non_periodic_qh_ptr->next;
++		}
++		DWC_LIST_REMOVE_INIT(&qh->qh_list_entry);
++		//if (!DWC_LIST_EMPTY(&hcd->non_periodic_sched_inactive))
++		//	hcd->fiq_state->kick_np_queues = 1;
++	} else {
++		deschedule_periodic(hcd, qh);
++		hcd->periodic_qh_count--;
++		if( !hcd->periodic_qh_count && !fiq_fsm_enable ) {
++			intr_mask.b.sofintr = 1;
++			if (fiq_enable) {
++				local_fiq_disable();
++				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
++				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, intr_mask.d32, 0);
++				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
++				local_fiq_enable();
++			} else {
++				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, intr_mask.d32, 0);
++			}
++		}
++	}
++}
++
++/**
++ * Deactivates a QH. For non-periodic QHs, removes the QH from the active
++ * non-periodic schedule. The QH is added to the inactive non-periodic
++ * schedule if any QTDs are still attached to the QH.
++ *
++ * For periodic QHs, the QH is removed from the periodic queued schedule. If
++ * there are any QTDs still attached to the QH, the QH is added to either the
++ * periodic inactive schedule or the periodic ready schedule and its next
++ * scheduled frame is calculated. The QH is placed in the ready schedule if
++ * the scheduled frame has been reached already. Otherwise it's placed in the
++ * inactive schedule. If there are no QTDs attached to the QH, the QH is
++ * completely removed from the periodic schedule.
++ */
++void dwc_otg_hcd_qh_deactivate(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh,
++			       int sched_next_periodic_split)
++{
++	if (dwc_qh_is_non_per(qh)) {
++		dwc_otg_hcd_qh_remove(hcd, qh);
++		if (!DWC_CIRCLEQ_EMPTY(&qh->qtd_list)) {
++			/* Add back to inactive non-periodic schedule. */
++			dwc_otg_hcd_qh_add(hcd, qh);
++			//hcd->fiq_state->kick_np_queues = 1;
++		} else {
++			if(nak_holdoff && qh->do_split) {
++				qh->nak_frame = 0xFFFF;
++			}
++		}
++	} else {
++		uint16_t frame_number = dwc_otg_hcd_get_frame_number(hcd);
++
++		if (qh->do_split) {
++			/* Schedule the next continuing periodic split transfer */
++			if (sched_next_periodic_split) {
++
++				qh->sched_frame = frame_number;
++
++				if (dwc_frame_num_le(frame_number,
++						     dwc_frame_num_inc
++						     (qh->start_split_frame,
++						      1))) {
++					/*
++					 * Allow one frame to elapse after start
++					 * split microframe before scheduling
++					 * complete split, but DONT if we are
++					 * doing the next start split in the
++					 * same frame for an ISOC out.
++					 */
++					if ((qh->ep_type != UE_ISOCHRONOUS) ||
++					    (qh->ep_is_in != 0)) {
++						qh->sched_frame =
++						    dwc_frame_num_inc(qh->sched_frame, 1);
++					}
++				}
++			} else {
++				qh->sched_frame =
++				    dwc_frame_num_inc(qh->start_split_frame,
++						      qh->interval);
++				if (dwc_frame_num_le
++				    (qh->sched_frame, frame_number)) {
++					qh->sched_frame = frame_number;
++				}
++				qh->sched_frame |= 0x7;
++				qh->start_split_frame = qh->sched_frame;
++			}
++		} else {
++			qh->sched_frame =
++			    dwc_frame_num_inc(qh->sched_frame, qh->interval);
++			if (dwc_frame_num_le(qh->sched_frame, frame_number)) {
++				qh->sched_frame = frame_number;
++			}
++		}
++
++		if (DWC_CIRCLEQ_EMPTY(&qh->qtd_list)) {
++			dwc_otg_hcd_qh_remove(hcd, qh);
++		} else {
++			/*
++			 * Remove from periodic_sched_queued and move to
++			 * appropriate queue.
++			 */
++			if ((microframe_schedule && dwc_frame_num_le(qh->sched_frame, frame_number)) ||
++			(!microframe_schedule && qh->sched_frame == frame_number)) {
++				DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_ready,
++						   &qh->qh_list_entry);
++			} else {
++				if(fiq_enable && !dwc_frame_num_le(hcd->fiq_state->next_sched_frame, qh->sched_frame))
++				{
++					hcd->fiq_state->next_sched_frame = qh->sched_frame;
++				}
++
++				DWC_LIST_MOVE_HEAD
++				    (&hcd->periodic_sched_inactive,
++				     &qh->qh_list_entry);
++			}
++		}
++	}
++}
++
++/**
++ * This function allocates and initializes a QTD.
++ *
++ * @param urb The URB to create a QTD from.  Each URB-QTD pair will end up
++ * 	      pointing to each other so each pair should have a unique correlation.
++ * @param atomic_alloc Flag to do atomic alloc if needed
++ *
++ * @return Returns pointer to the newly allocated QTD, or NULL on error. */
++dwc_otg_qtd_t *dwc_otg_hcd_qtd_create(dwc_otg_hcd_urb_t * urb, int atomic_alloc)
++{
++	dwc_otg_qtd_t *qtd;
++
++	qtd = dwc_otg_hcd_qtd_alloc(atomic_alloc);
++	if (qtd == NULL) {
++		return NULL;
++	}
++
++	dwc_otg_hcd_qtd_init(qtd, urb);
++	return qtd;
++}
++
++/**
++ * Initializes a QTD structure.
++ *
++ * @param qtd The QTD to initialize.
++ * @param urb The URB to use for initialization.  */
++void dwc_otg_hcd_qtd_init(dwc_otg_qtd_t * qtd, dwc_otg_hcd_urb_t * urb)
++{
++	dwc_memset(qtd, 0, sizeof(dwc_otg_qtd_t));
++	qtd->urb = urb;
++	if (dwc_otg_hcd_get_pipe_type(&urb->pipe_info) == UE_CONTROL) {
++		/*
++		 * The only time the QTD data toggle is used is on the data
++		 * phase of control transfers. This phase always starts with
++		 * DATA1.
++		 */
++		qtd->data_toggle = DWC_OTG_HC_PID_DATA1;
++		qtd->control_phase = DWC_OTG_CONTROL_SETUP;
++	}
++
++	/* start split */
++	qtd->complete_split = 0;
++	qtd->isoc_split_pos = DWC_HCSPLIT_XACTPOS_ALL;
++	qtd->isoc_split_offset = 0;
++	qtd->in_process = 0;
++
++	/* Store the qtd ptr in the urb to reference what QTD. */
++	urb->qtd = qtd;
++	return;
++}
++
++/**
++ * This function adds a QTD to the QTD-list of a QH.  It will find the correct
++ * QH to place the QTD into.  If it does not find a QH, then it will create a
++ * new QH. If the QH to which the QTD is added is not currently scheduled, it
++ * is placed into the proper schedule based on its EP type.
++ * HCD lock must be held and interrupts must be disabled on entry
++ *
++ * @param[in] qtd The QTD to add
++ * @param[in] hcd The DWC HCD structure
++ * @param[out] qh out parameter to return queue head
++ * @param atomic_alloc Flag to do atomic alloc if needed
++ *
++ * @return 0 if successful, negative error code otherwise.
++ */
++int dwc_otg_hcd_qtd_add(dwc_otg_qtd_t * qtd,
++			dwc_otg_hcd_t * hcd, dwc_otg_qh_t ** qh, int atomic_alloc)
++{
++	int retval = 0;
++	dwc_otg_hcd_urb_t *urb = qtd->urb;
++
++	/*
++	 * Get the QH which holds the QTD-list to insert to. Create QH if it
++	 * doesn't exist.
++	 */
++	if (*qh == NULL) {
++		*qh = dwc_otg_hcd_qh_create(hcd, urb, atomic_alloc);
++		if (*qh == NULL) {
++			retval = -DWC_E_NO_MEMORY;
++			goto done;
++		} else {
++			if (fiq_enable)
++				hcd->fiq_state->kick_np_queues = 1;
++		}
++	}
++	retval = dwc_otg_hcd_qh_add(hcd, *qh);
++	if (retval == 0) {
++		DWC_CIRCLEQ_INSERT_TAIL(&((*qh)->qtd_list), qtd,
++					qtd_list_entry);
++		qtd->qh = *qh;
++	}
++done:
++
++	return retval;
++}
++
++#endif /* DWC_DEVICE_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_os_dep.h
+@@ -0,0 +1,200 @@
++#ifndef _DWC_OS_DEP_H_
++#define _DWC_OS_DEP_H_
++
++/**
++ * @file
++ *
++ * This file contains OS dependent structures.
++ *
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/moduleparam.h>
++#include <linux/init.h>
++#include <linux/device.h>
++#include <linux/errno.h>
++#include <linux/types.h>
++#include <linux/slab.h>
++#include <linux/list.h>
++#include <linux/interrupt.h>
++#include <linux/ctype.h>
++#include <linux/string.h>
++#include <linux/dma-mapping.h>
++#include <linux/jiffies.h>
++#include <linux/delay.h>
++#include <linux/timer.h>
++#include <linux/workqueue.h>
++#include <linux/stat.h>
++#include <linux/pci.h>
++#include <linux/compiler.h>
++
++#include <linux/version.h>
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,20)
++# include <linux/irq.h>
++#endif
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
++# include <linux/usb/ch9.h>
++#else
++# include <linux/usb_ch9.h>
++#endif
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24)
++# include <linux/usb/gadget.h>
++#else
++# include <linux/usb_gadget.h>
++#endif
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)
++# include <asm/irq.h>
++#endif
++
++#ifdef PCI_INTERFACE
++# include <asm/io.h>
++#endif
++
++#ifdef LM_INTERFACE
++# include <asm/unaligned.h>
++# include <asm/sizes.h>
++# include <asm/param.h>
++# include <asm/io.h>
++# if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30))
++#  include <asm/arch/hardware.h>
++#  include <asm/arch/lm.h>
++#  include <asm/arch/irqs.h>
++#  include <asm/arch/regs-irq.h>
++# else
++/* in 2.6.31, at least, we seem to have lost the generic LM infrastructure -
++   here we assume that the machine architecture provides definitions
++   in its own header
++*/
++#  include <mach/lm.h>
++#  include <mach/hardware.h>
++# endif
++#endif
++
++#ifdef PLATFORM_INTERFACE
++#include <linux/platform_device.h>
++#ifdef CONFIG_ARM
++#include <asm/mach/map.h>
++#endif
++#endif
++
++/** The OS page size */
++#define DWC_OS_PAGE_SIZE	PAGE_SIZE
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,14)
++typedef int gfp_t;
++#endif
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,18)
++# define IRQF_SHARED SA_SHIRQ
++#endif
++
++typedef struct os_dependent {
++	/** Base address returned from ioremap() */
++	void *base;
++
++	/** Register offset for Diagnostic API */
++	uint32_t reg_offset;
++
++	/** Base address for MPHI peripheral */
++	void *mphi_base;
++
++	/** mphi_base actually points to the SWIRQ block */
++	bool use_swirq;
++
++	/** IRQ number (<0 if not valid) */
++	int irq_num;
++
++	/** FIQ number (<0 if not valid) */
++	int fiq_num;
++
++#ifdef LM_INTERFACE
++	struct lm_device *lmdev;
++#elif  defined(PCI_INTERFACE)
++	struct pci_dev *pcidev;
++
++	/** Start address of a PCI region */
++	resource_size_t rsrc_start;
++
++	/** Length address of a PCI region */
++	resource_size_t rsrc_len;
++#elif  defined(PLATFORM_INTERFACE)
++	struct platform_device *platformdev;
++#endif
++
++} os_dependent_t;
++
++#ifdef __cplusplus
++}
++#endif
++
++
++
++/* Type for the our device on the chosen bus */
++#if   defined(LM_INTERFACE)
++typedef struct lm_device       dwc_bus_dev_t;
++#elif defined(PCI_INTERFACE)
++typedef struct pci_dev         dwc_bus_dev_t;
++#elif defined(PLATFORM_INTERFACE)
++typedef struct platform_device dwc_bus_dev_t;
++#endif
++
++/* Helper macro to retrieve drvdata from the device on the chosen bus */
++#if    defined(LM_INTERFACE)
++#define DWC_OTG_BUSDRVDATA(_dev) lm_get_drvdata(_dev)
++#elif  defined(PCI_INTERFACE)
++#define DWC_OTG_BUSDRVDATA(_dev) pci_get_drvdata(_dev)
++#elif  defined(PLATFORM_INTERFACE)
++#define DWC_OTG_BUSDRVDATA(_dev) platform_get_drvdata(_dev)
++#endif
++
++/**
++ * Helper macro returning the otg_device structure of a given struct device
++ *
++ * c.f. static dwc_otg_device_t *dwc_otg_drvdev(struct device *_dev)
++ */
++#ifdef LM_INTERFACE
++#define DWC_OTG_GETDRVDEV(_var, _dev) do { \
++                struct lm_device *lm_dev = \
++                        container_of(_dev, struct lm_device, dev); \
++                _var = lm_get_drvdata(lm_dev); \
++        } while (0)
++
++#elif defined(PCI_INTERFACE)
++#define DWC_OTG_GETDRVDEV(_var, _dev) do { \
++                _var = dev_get_drvdata(_dev); \
++        } while (0)
++
++#elif defined(PLATFORM_INTERFACE)
++#define DWC_OTG_GETDRVDEV(_var, _dev) do { \
++                struct platform_device *platform_dev = \
++                        container_of(_dev, struct platform_device, dev); \
++                _var = platform_get_drvdata(platform_dev); \
++        } while (0)
++#endif
++
++
++/**
++ * Helper macro returning the struct dev of the given struct os_dependent
++ *
++ * c.f. static struct device *dwc_otg_getdev(struct os_dependent *osdep)
++ */
++#ifdef LM_INTERFACE
++#define DWC_OTG_OS_GETDEV(_osdep) \
++        ((_osdep).lmdev == NULL? NULL: &(_osdep).lmdev->dev)
++#elif defined(PCI_INTERFACE)
++#define DWC_OTG_OS_GETDEV(_osdep) \
++        ((_osdep).pci_dev == NULL? NULL: &(_osdep).pci_dev->dev)
++#elif defined(PLATFORM_INTERFACE)
++#define DWC_OTG_OS_GETDEV(_osdep) \
++        ((_osdep).platformdev == NULL? NULL: &(_osdep).platformdev->dev)
++#endif
++
++
++
++
++#endif /* _DWC_OS_DEP_H_ */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_pcd.c
+@@ -0,0 +1,2725 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_pcd.c $
++ * $Revision: #101 $
++ * $Date: 2012/08/10 $
++ * $Change: 2047372 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_HOST_ONLY
++
++/** @file
++ * This file implements PCD Core. All code in this file is portable and doesn't
++ * use any OS specific functions.
++ * PCD Core provides Interface, defined in <code><dwc_otg_pcd_if.h></code>
++ * header file, which can be used to implement OS specific PCD interface.
++ *
++ * An important function of the PCD is managing interrupts generated
++ * by the DWC_otg controller. The implementation of the DWC_otg device
++ * mode interrupt service routines is in dwc_otg_pcd_intr.c.
++ *
++ * @todo Add Device Mode test modes (Test J mode, Test K mode, etc).
++ * @todo Does it work when the request size is greater than DEPTSIZ
++ * transfer size
++ *
++ */
++
++#include "dwc_otg_pcd.h"
++
++#ifdef DWC_UTE_CFI
++#include "dwc_otg_cfi.h"
++
++extern int init_cfi(cfiobject_t * cfiobj);
++#endif
++
++/**
++ * Choose endpoint from ep arrays using usb_ep structure.
++ */
++static dwc_otg_pcd_ep_t *get_ep_from_handle(dwc_otg_pcd_t * pcd, void *handle)
++{
++	int i;
++	if (pcd->ep0.priv == handle) {
++		return &pcd->ep0;
++	}
++	for (i = 0; i < MAX_EPS_CHANNELS - 1; i++) {
++		if (pcd->in_ep[i].priv == handle)
++			return &pcd->in_ep[i];
++		if (pcd->out_ep[i].priv == handle)
++			return &pcd->out_ep[i];
++	}
++
++	return NULL;
++}
++
++/**
++ * This function completes a request.  It call's the request call back.
++ */
++void dwc_otg_request_done(dwc_otg_pcd_ep_t * ep, dwc_otg_pcd_request_t * req,
++			  int32_t status)
++{
++	unsigned stopped = ep->stopped;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(ep %p req %p)\n", __func__, ep, req);
++	DWC_CIRCLEQ_REMOVE_INIT(&ep->queue, req, queue_entry);
++
++	/* don't modify queue heads during completion callback */
++	ep->stopped = 1;
++	/* spin_unlock/spin_lock now done in fops->complete() */
++	ep->pcd->fops->complete(ep->pcd, ep->priv, req->priv, status,
++				req->actual);
++
++	if (ep->pcd->request_pending > 0) {
++		--ep->pcd->request_pending;
++	}
++
++	ep->stopped = stopped;
++	DWC_FREE(req);
++}
++
++/**
++ * This function terminates all the requsts in the EP request queue.
++ */
++void dwc_otg_request_nuke(dwc_otg_pcd_ep_t * ep)
++{
++	dwc_otg_pcd_request_t *req;
++
++	ep->stopped = 1;
++
++	/* called with irqs blocked?? */
++	while (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++		req = DWC_CIRCLEQ_FIRST(&ep->queue);
++		dwc_otg_request_done(ep, req, -DWC_E_SHUTDOWN);
++	}
++}
++
++void dwc_otg_pcd_start(dwc_otg_pcd_t * pcd,
++		       const struct dwc_otg_pcd_function_ops *fops)
++{
++	pcd->fops = fops;
++}
++
++/**
++ * PCD Callback function for initializing the PCD when switching to
++ * device mode.
++ *
++ * @param p void pointer to the <code>dwc_otg_pcd_t</code>
++ */
++static int32_t dwc_otg_pcd_start_cb(void *p)
++{
++	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) p;
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++
++	/*
++	 * Initialized the Core for Device mode.
++	 */
++	if (dwc_otg_is_device_mode(core_if)) {
++		dwc_otg_core_dev_init(core_if);
++		/* Set core_if's lock pointer to the pcd->lock */
++		core_if->lock = pcd->lock;
++	}
++	return 1;
++}
++
++/** CFI-specific buffer allocation function for EP */
++#ifdef DWC_UTE_CFI
++uint8_t *cfiw_ep_alloc_buffer(dwc_otg_pcd_t * pcd, void *pep, dwc_dma_t * addr,
++			      size_t buflen, int flags)
++{
++	dwc_otg_pcd_ep_t *ep;
++	ep = get_ep_from_handle(pcd, pep);
++	if (!ep) {
++		DWC_WARN("bad ep\n");
++		return -DWC_E_INVALID;
++	}
++
++	return pcd->cfi->ops.ep_alloc_buf(pcd->cfi, pcd, ep, addr, buflen,
++					  flags);
++}
++#else
++uint8_t *cfiw_ep_alloc_buffer(dwc_otg_pcd_t * pcd, void *pep, dwc_dma_t * addr,
++			      size_t buflen, int flags);
++#endif
++
++/**
++ * PCD Callback function for notifying the PCD when resuming from
++ * suspend.
++ *
++ * @param p void pointer to the <code>dwc_otg_pcd_t</code>
++ */
++static int32_t dwc_otg_pcd_resume_cb(void *p)
++{
++	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) p;
++
++	if (pcd->fops->resume) {
++		pcd->fops->resume(pcd);
++	}
++
++	/* Stop the SRP timeout timer. */
++	if ((GET_CORE_IF(pcd)->core_params->phy_type != DWC_PHY_TYPE_PARAM_FS)
++	    || (!GET_CORE_IF(pcd)->core_params->i2c_enable)) {
++		if (GET_CORE_IF(pcd)->srp_timer_started) {
++			GET_CORE_IF(pcd)->srp_timer_started = 0;
++			DWC_TIMER_CANCEL(GET_CORE_IF(pcd)->srp_timer);
++		}
++	}
++	return 1;
++}
++
++/**
++ * PCD Callback function for notifying the PCD device is suspended.
++ *
++ * @param p void pointer to the <code>dwc_otg_pcd_t</code>
++ */
++static int32_t dwc_otg_pcd_suspend_cb(void *p)
++{
++	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) p;
++
++	if (pcd->fops->suspend) {
++		DWC_SPINUNLOCK(pcd->lock);
++		pcd->fops->suspend(pcd);
++		DWC_SPINLOCK(pcd->lock);
++	}
++
++	return 1;
++}
++
++/**
++ * PCD Callback function for stopping the PCD when switching to Host
++ * mode.
++ *
++ * @param p void pointer to the <code>dwc_otg_pcd_t</code>
++ */
++static int32_t dwc_otg_pcd_stop_cb(void *p)
++{
++	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) p;
++	extern void dwc_otg_pcd_stop(dwc_otg_pcd_t * _pcd);
++
++	dwc_otg_pcd_stop(pcd);
++	return 1;
++}
++
++/**
++ * PCD Callback structure for handling mode switching.
++ */
++static dwc_otg_cil_callbacks_t pcd_callbacks = {
++	.start = dwc_otg_pcd_start_cb,
++	.stop = dwc_otg_pcd_stop_cb,
++	.suspend = dwc_otg_pcd_suspend_cb,
++	.resume_wakeup = dwc_otg_pcd_resume_cb,
++	.p = 0,			/* Set at registration */
++};
++
++/**
++ * This function allocates a DMA Descriptor chain for the Endpoint
++ * buffer to be used for a transfer to/from the specified endpoint.
++ */
++dwc_otg_dev_dma_desc_t *dwc_otg_ep_alloc_desc_chain(struct device *dev,
++						    dwc_dma_t * dma_desc_addr,
++						    uint32_t count)
++{
++	return DWC_DMA_ALLOC_ATOMIC(dev, count * sizeof(dwc_otg_dev_dma_desc_t),
++							dma_desc_addr);
++}
++
++/**
++ * This function frees a DMA Descriptor chain that was allocated by ep_alloc_desc.
++ */
++void dwc_otg_ep_free_desc_chain(struct device *dev,
++				dwc_otg_dev_dma_desc_t * desc_addr,
++				uint32_t dma_desc_addr, uint32_t count)
++{
++	DWC_DMA_FREE(dev, count * sizeof(dwc_otg_dev_dma_desc_t), desc_addr,
++		     dma_desc_addr);
++}
++
++#ifdef DWC_EN_ISOC
++
++/**
++ * This function initializes a descriptor chain for Isochronous transfer
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param dwc_ep The EP to start the transfer on.
++ *
++ */
++void dwc_otg_iso_ep_start_ddma_transfer(dwc_otg_core_if_t * core_if,
++					dwc_ep_t * dwc_ep)
++{
++
++	dsts_data_t dsts = {.d32 = 0 };
++	depctl_data_t depctl = {.d32 = 0 };
++	volatile uint32_t *addr;
++	int i, j;
++	uint32_t len;
++
++	if (dwc_ep->is_in)
++		dwc_ep->desc_cnt = dwc_ep->buf_proc_intrvl / dwc_ep->bInterval;
++	else
++		dwc_ep->desc_cnt =
++		    dwc_ep->buf_proc_intrvl * dwc_ep->pkt_per_frm /
++		    dwc_ep->bInterval;
++
++	/** Allocate descriptors for double buffering */
++	dwc_ep->iso_desc_addr =
++	    dwc_otg_ep_alloc_desc_chain(&dwc_ep->iso_dma_desc_addr,
++					dwc_ep->desc_cnt * 2);
++	if (dwc_ep->desc_addr) {
++		DWC_WARN("%s, can't allocate DMA descriptor chain\n", __func__);
++		return;
++	}
++
++	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
++
++	/** ISO OUT EP */
++	if (dwc_ep->is_in == 0) {
++		dev_dma_desc_sts_t sts = {.d32 = 0 };
++		dwc_otg_dev_dma_desc_t *dma_desc = dwc_ep->iso_desc_addr;
++		dma_addr_t dma_ad;
++		uint32_t data_per_desc;
++		dwc_otg_dev_out_ep_regs_t *out_regs =
++		    core_if->dev_if->out_ep_regs[dwc_ep->num];
++		int offset;
++
++		addr = &core_if->dev_if->out_ep_regs[dwc_ep->num]->doepctl;
++		dma_ad = (dma_addr_t) DWC_READ_REG32(&(out_regs->doepdma));
++
++		/** Buffer 0 descriptors setup */
++		dma_ad = dwc_ep->dma_addr0;
++
++		sts.b_iso_out.bs = BS_HOST_READY;
++		sts.b_iso_out.rxsts = 0;
++		sts.b_iso_out.l = 0;
++		sts.b_iso_out.sp = 0;
++		sts.b_iso_out.ioc = 0;
++		sts.b_iso_out.pid = 0;
++		sts.b_iso_out.framenum = 0;
++
++		offset = 0;
++		for (i = 0; i < dwc_ep->desc_cnt - dwc_ep->pkt_per_frm;
++		     i += dwc_ep->pkt_per_frm) {
++
++			for (j = 0; j < dwc_ep->pkt_per_frm; ++j) {
++				uint32_t len = (j + 1) * dwc_ep->maxpacket;
++				if (len > dwc_ep->data_per_frame)
++					data_per_desc =
++					    dwc_ep->data_per_frame -
++					    j * dwc_ep->maxpacket;
++				else
++					data_per_desc = dwc_ep->maxpacket;
++				len = data_per_desc % 4;
++				if (len)
++					data_per_desc += 4 - len;
++
++				sts.b_iso_out.rxbytes = data_per_desc;
++				dma_desc->buf = dma_ad;
++				dma_desc->status.d32 = sts.d32;
++
++				offset += data_per_desc;
++				dma_desc++;
++				dma_ad += data_per_desc;
++			}
++		}
++
++		for (j = 0; j < dwc_ep->pkt_per_frm - 1; ++j) {
++			uint32_t len = (j + 1) * dwc_ep->maxpacket;
++			if (len > dwc_ep->data_per_frame)
++				data_per_desc =
++				    dwc_ep->data_per_frame -
++				    j * dwc_ep->maxpacket;
++			else
++				data_per_desc = dwc_ep->maxpacket;
++			len = data_per_desc % 4;
++			if (len)
++				data_per_desc += 4 - len;
++			sts.b_iso_out.rxbytes = data_per_desc;
++			dma_desc->buf = dma_ad;
++			dma_desc->status.d32 = sts.d32;
++
++			offset += data_per_desc;
++			dma_desc++;
++			dma_ad += data_per_desc;
++		}
++
++		sts.b_iso_out.ioc = 1;
++		len = (j + 1) * dwc_ep->maxpacket;
++		if (len > dwc_ep->data_per_frame)
++			data_per_desc =
++			    dwc_ep->data_per_frame - j * dwc_ep->maxpacket;
++		else
++			data_per_desc = dwc_ep->maxpacket;
++		len = data_per_desc % 4;
++		if (len)
++			data_per_desc += 4 - len;
++		sts.b_iso_out.rxbytes = data_per_desc;
++
++		dma_desc->buf = dma_ad;
++		dma_desc->status.d32 = sts.d32;
++		dma_desc++;
++
++		/** Buffer 1 descriptors setup */
++		sts.b_iso_out.ioc = 0;
++		dma_ad = dwc_ep->dma_addr1;
++
++		offset = 0;
++		for (i = 0; i < dwc_ep->desc_cnt - dwc_ep->pkt_per_frm;
++		     i += dwc_ep->pkt_per_frm) {
++			for (j = 0; j < dwc_ep->pkt_per_frm; ++j) {
++				uint32_t len = (j + 1) * dwc_ep->maxpacket;
++				if (len > dwc_ep->data_per_frame)
++					data_per_desc =
++					    dwc_ep->data_per_frame -
++					    j * dwc_ep->maxpacket;
++				else
++					data_per_desc = dwc_ep->maxpacket;
++				len = data_per_desc % 4;
++				if (len)
++					data_per_desc += 4 - len;
++
++				data_per_desc =
++				    sts.b_iso_out.rxbytes = data_per_desc;
++				dma_desc->buf = dma_ad;
++				dma_desc->status.d32 = sts.d32;
++
++				offset += data_per_desc;
++				dma_desc++;
++				dma_ad += data_per_desc;
++			}
++		}
++		for (j = 0; j < dwc_ep->pkt_per_frm - 1; ++j) {
++			data_per_desc =
++			    ((j + 1) * dwc_ep->maxpacket >
++			     dwc_ep->data_per_frame) ? dwc_ep->data_per_frame -
++			    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
++			data_per_desc +=
++			    (data_per_desc % 4) ? (4 - data_per_desc % 4) : 0;
++			sts.b_iso_out.rxbytes = data_per_desc;
++			dma_desc->buf = dma_ad;
++			dma_desc->status.d32 = sts.d32;
++
++			offset += data_per_desc;
++			dma_desc++;
++			dma_ad += data_per_desc;
++		}
++
++		sts.b_iso_out.ioc = 1;
++		sts.b_iso_out.l = 1;
++		data_per_desc =
++		    ((j + 1) * dwc_ep->maxpacket >
++		     dwc_ep->data_per_frame) ? dwc_ep->data_per_frame -
++		    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
++		data_per_desc +=
++		    (data_per_desc % 4) ? (4 - data_per_desc % 4) : 0;
++		sts.b_iso_out.rxbytes = data_per_desc;
++
++		dma_desc->buf = dma_ad;
++		dma_desc->status.d32 = sts.d32;
++
++		dwc_ep->next_frame = 0;
++
++		/** Write dma_ad into DOEPDMA register */
++		DWC_WRITE_REG32(&(out_regs->doepdma),
++				(uint32_t) dwc_ep->iso_dma_desc_addr);
++
++	}
++	/** ISO IN EP */
++	else {
++		dev_dma_desc_sts_t sts = {.d32 = 0 };
++		dwc_otg_dev_dma_desc_t *dma_desc = dwc_ep->iso_desc_addr;
++		dma_addr_t dma_ad;
++		dwc_otg_dev_in_ep_regs_t *in_regs =
++		    core_if->dev_if->in_ep_regs[dwc_ep->num];
++		unsigned int frmnumber;
++		fifosize_data_t txfifosize, rxfifosize;
++
++		txfifosize.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[dwc_ep->num]->
++				   dtxfsts);
++		rxfifosize.d32 =
++		    DWC_READ_REG32(&core_if->core_global_regs->grxfsiz);
++
++		addr = &core_if->dev_if->in_ep_regs[dwc_ep->num]->diepctl;
++
++		dma_ad = dwc_ep->dma_addr0;
++
++		dsts.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
++
++		sts.b_iso_in.bs = BS_HOST_READY;
++		sts.b_iso_in.txsts = 0;
++		sts.b_iso_in.sp =
++		    (dwc_ep->data_per_frame % dwc_ep->maxpacket) ? 1 : 0;
++		sts.b_iso_in.ioc = 0;
++		sts.b_iso_in.pid = dwc_ep->pkt_per_frm;
++
++		frmnumber = dwc_ep->next_frame;
++
++		sts.b_iso_in.framenum = frmnumber;
++		sts.b_iso_in.txbytes = dwc_ep->data_per_frame;
++		sts.b_iso_in.l = 0;
++
++		/** Buffer 0 descriptors setup */
++		for (i = 0; i < dwc_ep->desc_cnt - 1; i++) {
++			dma_desc->buf = dma_ad;
++			dma_desc->status.d32 = sts.d32;
++			dma_desc++;
++
++			dma_ad += dwc_ep->data_per_frame;
++			sts.b_iso_in.framenum += dwc_ep->bInterval;
++		}
++
++		sts.b_iso_in.ioc = 1;
++		dma_desc->buf = dma_ad;
++		dma_desc->status.d32 = sts.d32;
++		++dma_desc;
++
++		/** Buffer 1 descriptors setup */
++		sts.b_iso_in.ioc = 0;
++		dma_ad = dwc_ep->dma_addr1;
++
++		for (i = 0; i < dwc_ep->desc_cnt - dwc_ep->pkt_per_frm;
++		     i += dwc_ep->pkt_per_frm) {
++			dma_desc->buf = dma_ad;
++			dma_desc->status.d32 = sts.d32;
++			dma_desc++;
++
++			dma_ad += dwc_ep->data_per_frame;
++			sts.b_iso_in.framenum += dwc_ep->bInterval;
++
++			sts.b_iso_in.ioc = 0;
++		}
++		sts.b_iso_in.ioc = 1;
++		sts.b_iso_in.l = 1;
++
++		dma_desc->buf = dma_ad;
++		dma_desc->status.d32 = sts.d32;
++
++		dwc_ep->next_frame = sts.b_iso_in.framenum + dwc_ep->bInterval;
++
++		/** Write dma_ad into diepdma register */
++		DWC_WRITE_REG32(&(in_regs->diepdma),
++				(uint32_t) dwc_ep->iso_dma_desc_addr);
++	}
++	/** Enable endpoint, clear nak  */
++	depctl.d32 = 0;
++	depctl.b.epena = 1;
++	depctl.b.usbactep = 1;
++	depctl.b.cnak = 1;
++
++	DWC_MODIFY_REG32(addr, depctl.d32, depctl.d32);
++	depctl.d32 = DWC_READ_REG32(addr);
++}
++
++/**
++ * This function initializes a descriptor chain for Isochronous transfer
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to start the transfer on.
++ *
++ */
++void dwc_otg_iso_ep_start_buf_transfer(dwc_otg_core_if_t * core_if,
++				       dwc_ep_t * ep)
++{
++	depctl_data_t depctl = {.d32 = 0 };
++	volatile uint32_t *addr;
++
++	if (ep->is_in) {
++		addr = &core_if->dev_if->in_ep_regs[ep->num]->diepctl;
++	} else {
++		addr = &core_if->dev_if->out_ep_regs[ep->num]->doepctl;
++	}
++
++	if (core_if->dma_enable == 0 || core_if->dma_desc_enable != 0) {
++		return;
++	} else {
++		deptsiz_data_t deptsiz = {.d32 = 0 };
++
++		ep->xfer_len =
++		    ep->data_per_frame * ep->buf_proc_intrvl / ep->bInterval;
++		ep->pkt_cnt =
++		    (ep->xfer_len - 1 + ep->maxpacket) / ep->maxpacket;
++		ep->xfer_count = 0;
++		ep->xfer_buff =
++		    (ep->proc_buf_num) ? ep->xfer_buff1 : ep->xfer_buff0;
++		ep->dma_addr =
++		    (ep->proc_buf_num) ? ep->dma_addr1 : ep->dma_addr0;
++
++		if (ep->is_in) {
++			/* Program the transfer size and packet count
++			 *      as follows: xfersize = N * maxpacket +
++			 *      short_packet pktcnt = N + (short_packet
++			 *      exist ? 1 : 0)
++			 */
++			deptsiz.b.mc = ep->pkt_per_frm;
++			deptsiz.b.xfersize = ep->xfer_len;
++			deptsiz.b.pktcnt =
++			    (ep->xfer_len - 1 + ep->maxpacket) / ep->maxpacket;
++			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
++					dieptsiz, deptsiz.d32);
++
++			/* Write the DMA register */
++			DWC_WRITE_REG32(&
++					(core_if->dev_if->in_ep_regs[ep->num]->
++					 diepdma), (uint32_t) ep->dma_addr);
++
++		} else {
++			deptsiz.b.pktcnt =
++			    (ep->xfer_len + (ep->maxpacket - 1)) /
++			    ep->maxpacket;
++			deptsiz.b.xfersize = deptsiz.b.pktcnt * ep->maxpacket;
++
++			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[ep->num]->
++					doeptsiz, deptsiz.d32);
++
++			/* Write the DMA register */
++			DWC_WRITE_REG32(&
++					(core_if->dev_if->out_ep_regs[ep->num]->
++					 doepdma), (uint32_t) ep->dma_addr);
++
++		}
++		/** Enable endpoint, clear nak  */
++		depctl.d32 = 0;
++		depctl.b.epena = 1;
++		depctl.b.cnak = 1;
++
++		DWC_MODIFY_REG32(addr, depctl.d32, depctl.d32);
++	}
++}
++
++/**
++ * This function does the setup for a data transfer for an EP and
++ * starts the transfer. For an IN transfer, the packets will be
++ * loaded into the appropriate Tx FIFO in the ISR. For OUT transfers,
++ * the packets are unloaded from the Rx FIFO in the ISR.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to start the transfer on.
++ */
++
++static void dwc_otg_iso_ep_start_transfer(dwc_otg_core_if_t * core_if,
++					  dwc_ep_t * ep)
++{
++	if (core_if->dma_enable) {
++		if (core_if->dma_desc_enable) {
++			if (ep->is_in) {
++				ep->desc_cnt = ep->pkt_cnt / ep->pkt_per_frm;
++			} else {
++				ep->desc_cnt = ep->pkt_cnt;
++			}
++			dwc_otg_iso_ep_start_ddma_transfer(core_if, ep);
++		} else {
++			if (core_if->pti_enh_enable) {
++				dwc_otg_iso_ep_start_buf_transfer(core_if, ep);
++			} else {
++				ep->cur_pkt_addr =
++				    (ep->proc_buf_num) ? ep->xfer_buff1 : ep->
++				    xfer_buff0;
++				ep->cur_pkt_dma_addr =
++				    (ep->proc_buf_num) ? ep->dma_addr1 : ep->
++				    dma_addr0;
++				dwc_otg_iso_ep_start_frm_transfer(core_if, ep);
++			}
++		}
++	} else {
++		ep->cur_pkt_addr =
++		    (ep->proc_buf_num) ? ep->xfer_buff1 : ep->xfer_buff0;
++		ep->cur_pkt_dma_addr =
++		    (ep->proc_buf_num) ? ep->dma_addr1 : ep->dma_addr0;
++		dwc_otg_iso_ep_start_frm_transfer(core_if, ep);
++	}
++}
++
++/**
++ * This function stops transfer for an EP and
++ * resets the ep's variables.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to start the transfer on.
++ */
++
++void dwc_otg_iso_ep_stop_transfer(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	depctl_data_t depctl = {.d32 = 0 };
++	volatile uint32_t *addr;
++
++	if (ep->is_in == 1) {
++		addr = &core_if->dev_if->in_ep_regs[ep->num]->diepctl;
++	} else {
++		addr = &core_if->dev_if->out_ep_regs[ep->num]->doepctl;
++	}
++
++	/* disable the ep */
++	depctl.d32 = DWC_READ_REG32(addr);
++
++	depctl.b.epdis = 1;
++	depctl.b.snak = 1;
++
++	DWC_WRITE_REG32(addr, depctl.d32);
++
++	if (core_if->dma_desc_enable &&
++	    ep->iso_desc_addr && ep->iso_dma_desc_addr) {
++		dwc_otg_ep_free_desc_chain(ep->iso_desc_addr,
++					   ep->iso_dma_desc_addr,
++					   ep->desc_cnt * 2);
++	}
++
++	/* reset varibales */
++	ep->dma_addr0 = 0;
++	ep->dma_addr1 = 0;
++	ep->xfer_buff0 = 0;
++	ep->xfer_buff1 = 0;
++	ep->data_per_frame = 0;
++	ep->data_pattern_frame = 0;
++	ep->sync_frame = 0;
++	ep->buf_proc_intrvl = 0;
++	ep->bInterval = 0;
++	ep->proc_buf_num = 0;
++	ep->pkt_per_frm = 0;
++	ep->pkt_per_frm = 0;
++	ep->desc_cnt = 0;
++	ep->iso_desc_addr = 0;
++	ep->iso_dma_desc_addr = 0;
++}
++
++int dwc_otg_pcd_iso_ep_start(dwc_otg_pcd_t * pcd, void *ep_handle,
++			     uint8_t * buf0, uint8_t * buf1, dwc_dma_t dma0,
++			     dwc_dma_t dma1, int sync_frame, int dp_frame,
++			     int data_per_frame, int start_frame,
++			     int buf_proc_intrvl, void *req_handle,
++			     int atomic_alloc)
++{
++	dwc_otg_pcd_ep_t *ep;
++	dwc_irqflags_t flags = 0;
++	dwc_ep_t *dwc_ep;
++	int32_t frm_data;
++	dsts_data_t dsts;
++	dwc_otg_core_if_t *core_if;
++
++	ep = get_ep_from_handle(pcd, ep_handle);
++
++	if (!ep || !ep->desc || ep->dwc_ep.num == 0) {
++		DWC_WARN("bad ep\n");
++		return -DWC_E_INVALID;
++	}
++
++	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++	core_if = GET_CORE_IF(pcd);
++	dwc_ep = &ep->dwc_ep;
++
++	if (ep->iso_req_handle) {
++		DWC_WARN("ISO request in progress\n");
++	}
++
++	dwc_ep->dma_addr0 = dma0;
++	dwc_ep->dma_addr1 = dma1;
++
++	dwc_ep->xfer_buff0 = buf0;
++	dwc_ep->xfer_buff1 = buf1;
++
++	dwc_ep->data_per_frame = data_per_frame;
++
++	/** @todo - pattern data support is to be implemented in the future */
++	dwc_ep->data_pattern_frame = dp_frame;
++	dwc_ep->sync_frame = sync_frame;
++
++	dwc_ep->buf_proc_intrvl = buf_proc_intrvl;
++
++	dwc_ep->bInterval = 1 << (ep->desc->bInterval - 1);
++
++	dwc_ep->proc_buf_num = 0;
++
++	dwc_ep->pkt_per_frm = 0;
++	frm_data = ep->dwc_ep.data_per_frame;
++	while (frm_data > 0) {
++		dwc_ep->pkt_per_frm++;
++		frm_data -= ep->dwc_ep.maxpacket;
++	}
++
++	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
++
++	if (start_frame == -1) {
++		dwc_ep->next_frame = dsts.b.soffn + 1;
++		if (dwc_ep->bInterval != 1) {
++			dwc_ep->next_frame =
++			    dwc_ep->next_frame + (dwc_ep->bInterval - 1 -
++						  dwc_ep->next_frame %
++						  dwc_ep->bInterval);
++		}
++	} else {
++		dwc_ep->next_frame = start_frame;
++	}
++
++	if (!core_if->pti_enh_enable) {
++		dwc_ep->pkt_cnt =
++		    dwc_ep->buf_proc_intrvl * dwc_ep->pkt_per_frm /
++		    dwc_ep->bInterval;
++	} else {
++		dwc_ep->pkt_cnt =
++		    (dwc_ep->data_per_frame *
++		     (dwc_ep->buf_proc_intrvl / dwc_ep->bInterval)
++		     - 1 + dwc_ep->maxpacket) / dwc_ep->maxpacket;
++	}
++
++	if (core_if->dma_desc_enable) {
++		dwc_ep->desc_cnt =
++		    dwc_ep->buf_proc_intrvl * dwc_ep->pkt_per_frm /
++		    dwc_ep->bInterval;
++	}
++
++	if (atomic_alloc) {
++		dwc_ep->pkt_info =
++		    DWC_ALLOC_ATOMIC(sizeof(iso_pkt_info_t) * dwc_ep->pkt_cnt);
++	} else {
++		dwc_ep->pkt_info =
++		    DWC_ALLOC(sizeof(iso_pkt_info_t) * dwc_ep->pkt_cnt);
++	}
++	if (!dwc_ep->pkt_info) {
++		DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++		return -DWC_E_NO_MEMORY;
++	}
++	if (core_if->pti_enh_enable) {
++		dwc_memset(dwc_ep->pkt_info, 0,
++			   sizeof(iso_pkt_info_t) * dwc_ep->pkt_cnt);
++	}
++
++	dwc_ep->cur_pkt = 0;
++	ep->iso_req_handle = req_handle;
++
++	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++	dwc_otg_iso_ep_start_transfer(core_if, dwc_ep);
++	return 0;
++}
++
++int dwc_otg_pcd_iso_ep_stop(dwc_otg_pcd_t * pcd, void *ep_handle,
++			    void *req_handle)
++{
++	dwc_irqflags_t flags = 0;
++	dwc_otg_pcd_ep_t *ep;
++	dwc_ep_t *dwc_ep;
++
++	ep = get_ep_from_handle(pcd, ep_handle);
++	if (!ep || !ep->desc || ep->dwc_ep.num == 0) {
++		DWC_WARN("bad ep\n");
++		return -DWC_E_INVALID;
++	}
++	dwc_ep = &ep->dwc_ep;
++
++	dwc_otg_iso_ep_stop_transfer(GET_CORE_IF(pcd), dwc_ep);
++
++	DWC_FREE(dwc_ep->pkt_info);
++	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++	if (ep->iso_req_handle != req_handle) {
++		DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++		return -DWC_E_INVALID;
++	}
++
++	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++
++	ep->iso_req_handle = 0;
++	return 0;
++}
++
++/**
++ * This function is used for perodical data exchnage between PCD and gadget drivers.
++ * for Isochronous EPs
++ *
++ *	- Every time a sync period completes this function is called to
++ *	  perform data exchange between PCD and gadget
++ */
++void dwc_otg_iso_buffer_done(dwc_otg_pcd_t * pcd, dwc_otg_pcd_ep_t * ep,
++			     void *req_handle)
++{
++	int i;
++	dwc_ep_t *dwc_ep;
++
++	dwc_ep = &ep->dwc_ep;
++
++	DWC_SPINUNLOCK(ep->pcd->lock);
++	pcd->fops->isoc_complete(pcd, ep->priv, ep->iso_req_handle,
++				 dwc_ep->proc_buf_num ^ 0x1);
++	DWC_SPINLOCK(ep->pcd->lock);
++
++	for (i = 0; i < dwc_ep->pkt_cnt; ++i) {
++		dwc_ep->pkt_info[i].status = 0;
++		dwc_ep->pkt_info[i].offset = 0;
++		dwc_ep->pkt_info[i].length = 0;
++	}
++}
++
++int dwc_otg_pcd_get_iso_packet_count(dwc_otg_pcd_t * pcd, void *ep_handle,
++				     void *iso_req_handle)
++{
++	dwc_otg_pcd_ep_t *ep;
++	dwc_ep_t *dwc_ep;
++
++	ep = get_ep_from_handle(pcd, ep_handle);
++	if (!ep->desc || ep->dwc_ep.num == 0) {
++		DWC_WARN("bad ep\n");
++		return -DWC_E_INVALID;
++	}
++	dwc_ep = &ep->dwc_ep;
++
++	return dwc_ep->pkt_cnt;
++}
++
++void dwc_otg_pcd_get_iso_packet_params(dwc_otg_pcd_t * pcd, void *ep_handle,
++				       void *iso_req_handle, int packet,
++				       int *status, int *actual, int *offset)
++{
++	dwc_otg_pcd_ep_t *ep;
++	dwc_ep_t *dwc_ep;
++
++	ep = get_ep_from_handle(pcd, ep_handle);
++	if (!ep)
++		DWC_WARN("bad ep\n");
++
++	dwc_ep = &ep->dwc_ep;
++
++	*status = dwc_ep->pkt_info[packet].status;
++	*actual = dwc_ep->pkt_info[packet].length;
++	*offset = dwc_ep->pkt_info[packet].offset;
++}
++
++#endif /* DWC_EN_ISOC */
++
++static void dwc_otg_pcd_init_ep(dwc_otg_pcd_t * pcd, dwc_otg_pcd_ep_t * pcd_ep,
++				uint32_t is_in, uint32_t ep_num)
++{
++	/* Init EP structure */
++	pcd_ep->desc = 0;
++	pcd_ep->pcd = pcd;
++	pcd_ep->stopped = 1;
++	pcd_ep->queue_sof = 0;
++
++	/* Init DWC ep structure */
++	pcd_ep->dwc_ep.is_in = is_in;
++	pcd_ep->dwc_ep.num = ep_num;
++	pcd_ep->dwc_ep.active = 0;
++	pcd_ep->dwc_ep.tx_fifo_num = 0;
++	/* Control until ep is actvated */
++	pcd_ep->dwc_ep.type = DWC_OTG_EP_TYPE_CONTROL;
++	pcd_ep->dwc_ep.maxpacket = MAX_PACKET_SIZE;
++	pcd_ep->dwc_ep.dma_addr = 0;
++	pcd_ep->dwc_ep.start_xfer_buff = 0;
++	pcd_ep->dwc_ep.xfer_buff = 0;
++	pcd_ep->dwc_ep.xfer_len = 0;
++	pcd_ep->dwc_ep.xfer_count = 0;
++	pcd_ep->dwc_ep.sent_zlp = 0;
++	pcd_ep->dwc_ep.total_len = 0;
++	pcd_ep->dwc_ep.desc_addr = 0;
++	pcd_ep->dwc_ep.dma_desc_addr = 0;
++	DWC_CIRCLEQ_INIT(&pcd_ep->queue);
++}
++
++/**
++ * Initialize ep's
++ */
++static void dwc_otg_pcd_reinit(dwc_otg_pcd_t * pcd)
++{
++	int i;
++	uint32_t hwcfg1;
++	dwc_otg_pcd_ep_t *ep;
++	int in_ep_cntr, out_ep_cntr;
++	uint32_t num_in_eps = (GET_CORE_IF(pcd))->dev_if->num_in_eps;
++	uint32_t num_out_eps = (GET_CORE_IF(pcd))->dev_if->num_out_eps;
++
++	/**
++	 * Initialize the EP0 structure.
++	 */
++	ep = &pcd->ep0;
++	dwc_otg_pcd_init_ep(pcd, ep, 0, 0);
++
++	in_ep_cntr = 0;
++	hwcfg1 = (GET_CORE_IF(pcd))->hwcfg1.d32 >> 3;
++	for (i = 1; in_ep_cntr < num_in_eps; i++) {
++		if ((hwcfg1 & 0x1) == 0) {
++			dwc_otg_pcd_ep_t *ep = &pcd->in_ep[in_ep_cntr];
++			in_ep_cntr++;
++			/**
++			 * @todo NGS: Add direction to EP, based on contents
++			 * of HWCFG1.  Need a copy of HWCFG1 in pcd structure?
++			 * sprintf(";r
++			 */
++			dwc_otg_pcd_init_ep(pcd, ep, 1 /* IN */ , i);
++
++			DWC_CIRCLEQ_INIT(&ep->queue);
++		}
++		hwcfg1 >>= 2;
++	}
++
++	out_ep_cntr = 0;
++	hwcfg1 = (GET_CORE_IF(pcd))->hwcfg1.d32 >> 2;
++	for (i = 1; out_ep_cntr < num_out_eps; i++) {
++		if ((hwcfg1 & 0x1) == 0) {
++			dwc_otg_pcd_ep_t *ep = &pcd->out_ep[out_ep_cntr];
++			out_ep_cntr++;
++			/**
++			 * @todo NGS: Add direction to EP, based on contents
++			 * of HWCFG1.  Need a copy of HWCFG1 in pcd structure?
++			 * sprintf(";r
++			 */
++			dwc_otg_pcd_init_ep(pcd, ep, 0 /* OUT */ , i);
++			DWC_CIRCLEQ_INIT(&ep->queue);
++		}
++		hwcfg1 >>= 2;
++	}
++
++	pcd->ep0state = EP0_DISCONNECT;
++	pcd->ep0.dwc_ep.maxpacket = MAX_EP0_SIZE;
++	pcd->ep0.dwc_ep.type = DWC_OTG_EP_TYPE_CONTROL;
++}
++
++/**
++ * This function is called when the SRP timer expires. The SRP should
++ * complete within 6 seconds.
++ */
++static void srp_timeout(void *ptr)
++{
++	gotgctl_data_t gotgctl;
++	dwc_otg_core_if_t *core_if = (dwc_otg_core_if_t *) ptr;
++	volatile uint32_t *addr = &core_if->core_global_regs->gotgctl;
++
++	gotgctl.d32 = DWC_READ_REG32(addr);
++
++	core_if->srp_timer_started = 0;
++
++	if (core_if->adp_enable) {
++		if (gotgctl.b.bsesvld == 0) {
++			gpwrdn_data_t gpwrdn = {.d32 = 0 };
++			DWC_PRINTF("SRP Timeout BSESSVLD = 0\n");
++			/* Power off the core */
++			if (core_if->power_down == 2) {
++				gpwrdn.b.pwrdnswtch = 1;
++				DWC_MODIFY_REG32(&core_if->
++						 core_global_regs->gpwrdn,
++						 gpwrdn.d32, 0);
++			}
++
++			gpwrdn.d32 = 0;
++			gpwrdn.b.pmuintsel = 1;
++			gpwrdn.b.pmuactv = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0,
++					 gpwrdn.d32);
++			dwc_otg_adp_probe_start(core_if);
++		} else {
++			DWC_PRINTF("SRP Timeout BSESSVLD = 1\n");
++			core_if->op_state = B_PERIPHERAL;
++			dwc_otg_core_init(core_if);
++			dwc_otg_enable_global_interrupts(core_if);
++			cil_pcd_start(core_if);
++		}
++	}
++
++	if ((core_if->core_params->phy_type == DWC_PHY_TYPE_PARAM_FS) &&
++	    (core_if->core_params->i2c_enable)) {
++		DWC_PRINTF("SRP Timeout\n");
++
++		if ((core_if->srp_success) && (gotgctl.b.bsesvld)) {
++			if (core_if->pcd_cb && core_if->pcd_cb->resume_wakeup) {
++				core_if->pcd_cb->resume_wakeup(core_if->pcd_cb->p);
++			}
++
++			/* Clear Session Request */
++			gotgctl.d32 = 0;
++			gotgctl.b.sesreq = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gotgctl,
++					 gotgctl.d32, 0);
++
++			core_if->srp_success = 0;
++		} else {
++			__DWC_ERROR("Device not connected/responding\n");
++			gotgctl.b.sesreq = 0;
++			DWC_WRITE_REG32(addr, gotgctl.d32);
++		}
++	} else if (gotgctl.b.sesreq) {
++		DWC_PRINTF("SRP Timeout\n");
++
++		__DWC_ERROR("Device not connected/responding\n");
++		gotgctl.b.sesreq = 0;
++		DWC_WRITE_REG32(addr, gotgctl.d32);
++	} else {
++		DWC_PRINTF(" SRP GOTGCTL=%0x\n", gotgctl.d32);
++	}
++}
++
++/**
++ * Tasklet
++ *
++ */
++extern void start_next_request(dwc_otg_pcd_ep_t * ep);
++
++static void start_xfer_tasklet_func(void *data)
++{
++	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) data;
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++
++	int i;
++	depctl_data_t diepctl;
++
++	DWC_DEBUGPL(DBG_PCDV, "Start xfer tasklet\n");
++
++	diepctl.d32 = DWC_READ_REG32(&core_if->dev_if->in_ep_regs[0]->diepctl);
++
++	if (pcd->ep0.queue_sof) {
++		pcd->ep0.queue_sof = 0;
++		start_next_request(&pcd->ep0);
++		// break;
++	}
++
++	for (i = 0; i < core_if->dev_if->num_in_eps; i++) {
++		depctl_data_t diepctl;
++		diepctl.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[i]->diepctl);
++
++		if (pcd->in_ep[i].queue_sof) {
++			pcd->in_ep[i].queue_sof = 0;
++			start_next_request(&pcd->in_ep[i]);
++			// break;
++		}
++	}
++
++	return;
++}
++
++/**
++ * This function initialized the PCD portion of the driver.
++ *
++ */
++dwc_otg_pcd_t *dwc_otg_pcd_init(dwc_otg_device_t *otg_dev)
++{
++	struct device *dev = &otg_dev->os_dep.platformdev->dev;
++	dwc_otg_core_if_t *core_if = otg_dev->core_if;
++	dwc_otg_pcd_t *pcd = NULL;
++	dwc_otg_dev_if_t *dev_if;
++	int i;
++
++	/*
++	 * Allocate PCD structure
++	 */
++	pcd = DWC_ALLOC(sizeof(dwc_otg_pcd_t));
++
++	if (pcd == NULL) {
++		return NULL;
++	}
++
++#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_SPINLOCK))
++	DWC_SPINLOCK_ALLOC_LINUX_DEBUG(pcd->lock);
++#else
++	pcd->lock = DWC_SPINLOCK_ALLOC();
++#endif
++        DWC_DEBUGPL(DBG_HCDV, "Init of PCD %p given core_if %p\n",
++                    pcd, core_if);//GRAYG
++	if (!pcd->lock) {
++		DWC_ERROR("Could not allocate lock for pcd");
++		DWC_FREE(pcd);
++		return NULL;
++	}
++	/* Set core_if's lock pointer to hcd->lock */
++	core_if->lock = pcd->lock;
++	pcd->core_if = core_if;
++
++	dev_if = core_if->dev_if;
++	dev_if->isoc_ep = NULL;
++
++	if (core_if->hwcfg4.b.ded_fifo_en) {
++		DWC_PRINTF("Dedicated Tx FIFOs mode\n");
++	} else {
++		DWC_PRINTF("Shared Tx FIFO mode\n");
++	}
++
++	/*
++	 * Initialized the Core for Device mode here if there is nod ADP support.
++	 * Otherwise it will be done later in dwc_otg_adp_start routine.
++	 */
++	if (dwc_otg_is_device_mode(core_if) /*&& !core_if->adp_enable*/) {
++		dwc_otg_core_dev_init(core_if);
++	}
++
++	/*
++	 * Register the PCD Callbacks.
++	 */
++	dwc_otg_cil_register_pcd_callbacks(core_if, &pcd_callbacks, pcd);
++
++	/*
++	 * Initialize the DMA buffer for SETUP packets
++	 */
++	if (GET_CORE_IF(pcd)->dma_enable) {
++		pcd->setup_pkt =
++		    DWC_DMA_ALLOC(dev, sizeof(*pcd->setup_pkt) * 5,
++				  &pcd->setup_pkt_dma_handle);
++		if (pcd->setup_pkt == NULL) {
++			DWC_FREE(pcd);
++			return NULL;
++		}
++
++		pcd->status_buf =
++		    DWC_DMA_ALLOC(dev, sizeof(uint16_t),
++				  &pcd->status_buf_dma_handle);
++		if (pcd->status_buf == NULL) {
++			DWC_DMA_FREE(dev, sizeof(*pcd->setup_pkt) * 5,
++				     pcd->setup_pkt, pcd->setup_pkt_dma_handle);
++			DWC_FREE(pcd);
++			return NULL;
++		}
++
++		if (GET_CORE_IF(pcd)->dma_desc_enable) {
++			dev_if->setup_desc_addr[0] =
++			    dwc_otg_ep_alloc_desc_chain(dev,
++				&dev_if->dma_setup_desc_addr[0], 1);
++			dev_if->setup_desc_addr[1] =
++			    dwc_otg_ep_alloc_desc_chain(dev,
++				&dev_if->dma_setup_desc_addr[1], 1);
++			dev_if->in_desc_addr =
++			    dwc_otg_ep_alloc_desc_chain(dev,
++				&dev_if->dma_in_desc_addr, 1);
++			dev_if->out_desc_addr =
++			    dwc_otg_ep_alloc_desc_chain(dev,
++				&dev_if->dma_out_desc_addr, 1);
++			pcd->data_terminated = 0;
++
++			if (dev_if->setup_desc_addr[0] == 0
++			    || dev_if->setup_desc_addr[1] == 0
++			    || dev_if->in_desc_addr == 0
++			    || dev_if->out_desc_addr == 0) {
++
++				if (dev_if->out_desc_addr)
++					dwc_otg_ep_free_desc_chain(dev,
++					     dev_if->out_desc_addr,
++					     dev_if->dma_out_desc_addr, 1);
++				if (dev_if->in_desc_addr)
++					dwc_otg_ep_free_desc_chain(dev,
++					     dev_if->in_desc_addr,
++					     dev_if->dma_in_desc_addr, 1);
++				if (dev_if->setup_desc_addr[1])
++					dwc_otg_ep_free_desc_chain(dev,
++					     dev_if->setup_desc_addr[1],
++					     dev_if->dma_setup_desc_addr[1], 1);
++				if (dev_if->setup_desc_addr[0])
++					dwc_otg_ep_free_desc_chain(dev,
++					     dev_if->setup_desc_addr[0],
++					     dev_if->dma_setup_desc_addr[0], 1);
++
++				DWC_DMA_FREE(dev, sizeof(*pcd->setup_pkt) * 5,
++					     pcd->setup_pkt,
++					     pcd->setup_pkt_dma_handle);
++				DWC_DMA_FREE(dev, sizeof(*pcd->status_buf),
++					     pcd->status_buf,
++					     pcd->status_buf_dma_handle);
++
++				DWC_FREE(pcd);
++
++				return NULL;
++			}
++		}
++	} else {
++		pcd->setup_pkt = DWC_ALLOC(sizeof(*pcd->setup_pkt) * 5);
++		if (pcd->setup_pkt == NULL) {
++			DWC_FREE(pcd);
++			return NULL;
++		}
++
++		pcd->status_buf = DWC_ALLOC(sizeof(uint16_t));
++		if (pcd->status_buf == NULL) {
++			DWC_FREE(pcd->setup_pkt);
++			DWC_FREE(pcd);
++			return NULL;
++		}
++	}
++
++	dwc_otg_pcd_reinit(pcd);
++
++	/* Allocate the cfi object for the PCD */
++#ifdef DWC_UTE_CFI
++	pcd->cfi = DWC_ALLOC(sizeof(cfiobject_t));
++	if (NULL == pcd->cfi)
++		goto fail;
++	if (init_cfi(pcd->cfi)) {
++		CFI_INFO("%s: Failed to init the CFI object\n", __func__);
++		goto fail;
++	}
++#endif
++
++	/* Initialize tasklets */
++	pcd->start_xfer_tasklet = DWC_TASK_ALLOC("xfer_tasklet",
++						 start_xfer_tasklet_func, pcd);
++	pcd->test_mode_tasklet = DWC_TASK_ALLOC("test_mode_tasklet",
++						do_test_mode, pcd);
++
++	/* Initialize SRP timer */
++	core_if->srp_timer = DWC_TIMER_ALLOC("SRP TIMER", srp_timeout, core_if);
++
++	if (core_if->core_params->dev_out_nak) {
++		/**
++		* Initialize xfer timeout timer. Implemented for
++		* 2.93a feature "Device DDMA OUT NAK Enhancement"
++		*/
++		for(i = 0; i < MAX_EPS_CHANNELS; i++) {
++			pcd->core_if->ep_xfer_timer[i] =
++				DWC_TIMER_ALLOC("ep timer", ep_xfer_timeout,
++				&pcd->core_if->ep_xfer_info[i]);
++		}
++	}
++
++	return pcd;
++#ifdef DWC_UTE_CFI
++fail:
++#endif
++	if (pcd->setup_pkt)
++		DWC_FREE(pcd->setup_pkt);
++	if (pcd->status_buf)
++		DWC_FREE(pcd->status_buf);
++#ifdef DWC_UTE_CFI
++	if (pcd->cfi)
++		DWC_FREE(pcd->cfi);
++#endif
++	if (pcd)
++		DWC_FREE(pcd);
++	return NULL;
++
++}
++
++/**
++ * Remove PCD specific data
++ */
++void dwc_otg_pcd_remove(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_dev_if_t *dev_if = GET_CORE_IF(pcd)->dev_if;
++	struct device *dev = dwc_otg_pcd_to_dev(pcd);
++	int i;
++
++	if (pcd->core_if->core_params->dev_out_nak) {
++		for (i = 0; i < MAX_EPS_CHANNELS; i++) {
++			DWC_TIMER_CANCEL(pcd->core_if->ep_xfer_timer[i]);
++			pcd->core_if->ep_xfer_info[i].state = 0;
++		}
++	}
++
++	if (GET_CORE_IF(pcd)->dma_enable) {
++		DWC_DMA_FREE(dev, sizeof(*pcd->setup_pkt) * 5, pcd->setup_pkt,
++			     pcd->setup_pkt_dma_handle);
++		DWC_DMA_FREE(dev, sizeof(uint16_t), pcd->status_buf,
++			     pcd->status_buf_dma_handle);
++		if (GET_CORE_IF(pcd)->dma_desc_enable) {
++			dwc_otg_ep_free_desc_chain(dev,
++						   dev_if->setup_desc_addr[0],
++						   dev_if->dma_setup_desc_addr
++						   [0], 1);
++			dwc_otg_ep_free_desc_chain(dev,
++						   dev_if->setup_desc_addr[1],
++						   dev_if->dma_setup_desc_addr
++						   [1], 1);
++			dwc_otg_ep_free_desc_chain(dev,
++						   dev_if->in_desc_addr,
++						   dev_if->dma_in_desc_addr, 1);
++			dwc_otg_ep_free_desc_chain(dev,
++						   dev_if->out_desc_addr,
++						   dev_if->dma_out_desc_addr,
++						   1);
++		}
++	} else {
++		DWC_FREE(pcd->setup_pkt);
++		DWC_FREE(pcd->status_buf);
++	}
++	DWC_SPINLOCK_FREE(pcd->lock);
++	/* Set core_if's lock pointer to NULL */
++	pcd->core_if->lock = NULL;
++
++	DWC_TASK_FREE(pcd->start_xfer_tasklet);
++	DWC_TASK_FREE(pcd->test_mode_tasklet);
++	if (pcd->core_if->core_params->dev_out_nak) {
++		for (i = 0; i < MAX_EPS_CHANNELS; i++) {
++			if (pcd->core_if->ep_xfer_timer[i]) {
++					DWC_TIMER_FREE(pcd->core_if->ep_xfer_timer[i]);
++			}
++		}
++	}
++
++/* Release the CFI object's dynamic memory */
++#ifdef DWC_UTE_CFI
++	if (pcd->cfi->ops.release) {
++		pcd->cfi->ops.release(pcd->cfi);
++	}
++#endif
++
++	DWC_FREE(pcd);
++}
++
++/**
++ * Returns whether registered pcd is dual speed or not
++ */
++uint32_t dwc_otg_pcd_is_dualspeed(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++
++	if ((core_if->core_params->speed == DWC_SPEED_PARAM_FULL) ||
++	    ((core_if->hwcfg2.b.hs_phy_type == 2) &&
++	     (core_if->hwcfg2.b.fs_phy_type == 1) &&
++	     (core_if->core_params->ulpi_fs_ls))) {
++		return 0;
++	}
++
++	return 1;
++}
++
++/**
++ * Returns whether registered pcd is OTG capable or not
++ */
++uint32_t dwc_otg_pcd_is_otg(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	gusbcfg_data_t usbcfg = {.d32 = 0 };
++
++	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
++	if (!usbcfg.b.srpcap || !usbcfg.b.hnpcap) {
++		return 0;
++	}
++
++	return 1;
++}
++
++/**
++ * This function assigns periodic Tx FIFO to an periodic EP
++ * in shared Tx FIFO mode
++ */
++static uint32_t assign_tx_fifo(dwc_otg_core_if_t * core_if)
++{
++	uint32_t TxMsk = 1;
++	int i;
++
++	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; ++i) {
++		if ((TxMsk & core_if->tx_msk) == 0) {
++			core_if->tx_msk |= TxMsk;
++			return i + 1;
++		}
++		TxMsk <<= 1;
++	}
++	return 0;
++}
++
++/**
++ * This function assigns periodic Tx FIFO to an periodic EP
++ * in shared Tx FIFO mode
++ */
++static uint32_t assign_perio_tx_fifo(dwc_otg_core_if_t * core_if)
++{
++	uint32_t PerTxMsk = 1;
++	int i;
++	for (i = 0; i < core_if->hwcfg4.b.num_dev_perio_in_ep; ++i) {
++		if ((PerTxMsk & core_if->p_tx_msk) == 0) {
++			core_if->p_tx_msk |= PerTxMsk;
++			return i + 1;
++		}
++		PerTxMsk <<= 1;
++	}
++	return 0;
++}
++
++/**
++ * This function releases periodic Tx FIFO
++ * in shared Tx FIFO mode
++ */
++static void release_perio_tx_fifo(dwc_otg_core_if_t * core_if,
++				  uint32_t fifo_num)
++{
++	core_if->p_tx_msk =
++	    (core_if->p_tx_msk & (1 << (fifo_num - 1))) ^ core_if->p_tx_msk;
++}
++
++/**
++ * This function releases periodic Tx FIFO
++ * in shared Tx FIFO mode
++ */
++static void release_tx_fifo(dwc_otg_core_if_t * core_if, uint32_t fifo_num)
++{
++	core_if->tx_msk =
++	    (core_if->tx_msk & (1 << (fifo_num - 1))) ^ core_if->tx_msk;
++}
++
++/**
++ * This function is being called from gadget
++ * to enable PCD endpoint.
++ */
++int dwc_otg_pcd_ep_enable(dwc_otg_pcd_t * pcd,
++			  const uint8_t * ep_desc, void *usb_ep)
++{
++	int num, dir;
++	dwc_otg_pcd_ep_t *ep = NULL;
++	const usb_endpoint_descriptor_t *desc;
++	dwc_irqflags_t flags;
++	fifosize_data_t dptxfsiz = {.d32 = 0 };
++	gdfifocfg_data_t gdfifocfg = {.d32 = 0 };
++	gdfifocfg_data_t gdfifocfgbase = {.d32 = 0 };
++	int retval = 0;
++	int i, epcount;
++	struct device *dev = dwc_otg_pcd_to_dev(pcd);
++
++	desc = (const usb_endpoint_descriptor_t *)ep_desc;
++
++	if (!desc) {
++		pcd->ep0.priv = usb_ep;
++		ep = &pcd->ep0;
++		retval = -DWC_E_INVALID;
++		goto out;
++	}
++
++	num = UE_GET_ADDR(desc->bEndpointAddress);
++	dir = UE_GET_DIR(desc->bEndpointAddress);
++
++	if (!UGETW(desc->wMaxPacketSize)) {
++		DWC_WARN("bad maxpacketsize\n");
++		retval = -DWC_E_INVALID;
++		goto out;
++	}
++
++	if (dir == UE_DIR_IN) {
++		epcount = pcd->core_if->dev_if->num_in_eps;
++		for (i = 0; i < epcount; i++) {
++			if (num == pcd->in_ep[i].dwc_ep.num) {
++				ep = &pcd->in_ep[i];
++				break;
++			}
++		}
++	} else {
++		epcount = pcd->core_if->dev_if->num_out_eps;
++		for (i = 0; i < epcount; i++) {
++			if (num == pcd->out_ep[i].dwc_ep.num) {
++				ep = &pcd->out_ep[i];
++				break;
++			}
++		}
++	}
++
++	if (!ep) {
++		DWC_WARN("bad address\n");
++		retval = -DWC_E_INVALID;
++		goto out;
++	}
++
++	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++
++	ep->desc = desc;
++	ep->priv = usb_ep;
++
++	/*
++	 * Activate the EP
++	 */
++	ep->stopped = 0;
++
++	ep->dwc_ep.is_in = (dir == UE_DIR_IN);
++	ep->dwc_ep.maxpacket = UGETW(desc->wMaxPacketSize);
++
++	ep->dwc_ep.type = desc->bmAttributes & UE_XFERTYPE;
++
++	if (ep->dwc_ep.is_in) {
++		if (!GET_CORE_IF(pcd)->en_multiple_tx_fifo) {
++			ep->dwc_ep.tx_fifo_num = 0;
++
++			if (ep->dwc_ep.type == UE_ISOCHRONOUS) {
++				/*
++				 * if ISOC EP then assign a Periodic Tx FIFO.
++				 */
++				ep->dwc_ep.tx_fifo_num =
++				    assign_perio_tx_fifo(GET_CORE_IF(pcd));
++			}
++		} else {
++			/*
++			 * if Dedicated FIFOs mode is on then assign a Tx FIFO.
++			 */
++			ep->dwc_ep.tx_fifo_num =
++			    assign_tx_fifo(GET_CORE_IF(pcd));
++		}
++
++		/* Calculating EP info controller base address */
++		if (ep->dwc_ep.tx_fifo_num
++		    && GET_CORE_IF(pcd)->en_multiple_tx_fifo) {
++			gdfifocfg.d32 =
++			    DWC_READ_REG32(&GET_CORE_IF(pcd)->
++					   core_global_regs->gdfifocfg);
++			gdfifocfgbase.d32 = gdfifocfg.d32 >> 16;
++			dptxfsiz.d32 =
++			    (DWC_READ_REG32
++			     (&GET_CORE_IF(pcd)->core_global_regs->
++			      dtxfsiz[ep->dwc_ep.tx_fifo_num - 1]) >> 16);
++			gdfifocfg.b.epinfobase =
++			    gdfifocfgbase.d32 + dptxfsiz.d32;
++			if (GET_CORE_IF(pcd)->snpsid <= OTG_CORE_REV_2_94a) {
++				DWC_WRITE_REG32(&GET_CORE_IF(pcd)->
++						core_global_regs->gdfifocfg,
++						gdfifocfg.d32);
++			}
++		}
++	}
++	/* Set initial data PID. */
++	if (ep->dwc_ep.type == UE_BULK) {
++		ep->dwc_ep.data_pid_start = 0;
++	}
++
++	/* Alloc DMA Descriptors */
++	if (GET_CORE_IF(pcd)->dma_desc_enable) {
++#ifndef DWC_UTE_PER_IO
++		if (ep->dwc_ep.type != UE_ISOCHRONOUS) {
++#endif
++			ep->dwc_ep.desc_addr =
++			    dwc_otg_ep_alloc_desc_chain(dev,
++						&ep->dwc_ep.dma_desc_addr,
++						MAX_DMA_DESC_CNT);
++			if (!ep->dwc_ep.desc_addr) {
++				DWC_WARN("%s, can't allocate DMA descriptor\n",
++					 __func__);
++				retval = -DWC_E_SHUTDOWN;
++				DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++				goto out;
++			}
++#ifndef DWC_UTE_PER_IO
++		}
++#endif
++	}
++
++	DWC_DEBUGPL(DBG_PCD, "Activate %s: type=%d, mps=%d desc=%p\n",
++		    (ep->dwc_ep.is_in ? "IN" : "OUT"),
++		    ep->dwc_ep.type, ep->dwc_ep.maxpacket, ep->desc);
++#ifdef DWC_UTE_PER_IO
++	ep->dwc_ep.xiso_bInterval = 1 << (ep->desc->bInterval - 1);
++#endif
++	if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
++		ep->dwc_ep.bInterval = 1 << (ep->desc->bInterval - 1);
++		ep->dwc_ep.frame_num = 0xFFFFFFFF;
++	}
++
++	dwc_otg_ep_activate(GET_CORE_IF(pcd), &ep->dwc_ep);
++
++#ifdef DWC_UTE_CFI
++	if (pcd->cfi->ops.ep_enable) {
++		pcd->cfi->ops.ep_enable(pcd->cfi, pcd, ep);
++	}
++#endif
++
++	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++
++out:
++	return retval;
++}
++
++/**
++ * This function is being called from gadget
++ * to disable PCD endpoint.
++ */
++int dwc_otg_pcd_ep_disable(dwc_otg_pcd_t * pcd, void *ep_handle)
++{
++	dwc_otg_pcd_ep_t *ep;
++	dwc_irqflags_t flags;
++	dwc_otg_dev_dma_desc_t *desc_addr;
++	dwc_dma_t dma_desc_addr;
++	gdfifocfg_data_t gdfifocfgbase = {.d32 = 0 };
++	gdfifocfg_data_t gdfifocfg = {.d32 = 0 };
++	fifosize_data_t dptxfsiz = {.d32 = 0 };
++	struct device *dev = dwc_otg_pcd_to_dev(pcd);
++
++	ep = get_ep_from_handle(pcd, ep_handle);
++
++	if (!ep || !ep->desc) {
++		DWC_DEBUGPL(DBG_PCD, "bad ep address\n");
++		return -DWC_E_INVALID;
++	}
++
++	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++
++	dwc_otg_request_nuke(ep);
++
++	dwc_otg_ep_deactivate(GET_CORE_IF(pcd), &ep->dwc_ep);
++	if (pcd->core_if->core_params->dev_out_nak) {
++		DWC_TIMER_CANCEL(pcd->core_if->ep_xfer_timer[ep->dwc_ep.num]);
++		pcd->core_if->ep_xfer_info[ep->dwc_ep.num].state = 0;
++	}
++	ep->desc = NULL;
++	ep->stopped = 1;
++
++	gdfifocfg.d32 =
++	    DWC_READ_REG32(&GET_CORE_IF(pcd)->core_global_regs->gdfifocfg);
++	gdfifocfgbase.d32 = gdfifocfg.d32 >> 16;
++
++	if (ep->dwc_ep.is_in) {
++		if (GET_CORE_IF(pcd)->en_multiple_tx_fifo) {
++			/* Flush the Tx FIFO */
++			dwc_otg_flush_tx_fifo(GET_CORE_IF(pcd),
++					      ep->dwc_ep.tx_fifo_num);
++		}
++		release_perio_tx_fifo(GET_CORE_IF(pcd), ep->dwc_ep.tx_fifo_num);
++		release_tx_fifo(GET_CORE_IF(pcd), ep->dwc_ep.tx_fifo_num);
++		if (GET_CORE_IF(pcd)->en_multiple_tx_fifo) {
++			/* Decreasing EPinfo Base Addr */
++			dptxfsiz.d32 =
++			    (DWC_READ_REG32
++			     (&GET_CORE_IF(pcd)->
++				core_global_regs->dtxfsiz[ep->dwc_ep.tx_fifo_num-1]) >> 16);
++			gdfifocfg.b.epinfobase = gdfifocfgbase.d32 - dptxfsiz.d32;
++			if (GET_CORE_IF(pcd)->snpsid <= OTG_CORE_REV_2_94a) {
++				DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gdfifocfg,
++					gdfifocfg.d32);
++			}
++		}
++	}
++
++	/* Free DMA Descriptors */
++	if (GET_CORE_IF(pcd)->dma_desc_enable) {
++		if (ep->dwc_ep.type != UE_ISOCHRONOUS) {
++			desc_addr = ep->dwc_ep.desc_addr;
++			dma_desc_addr = ep->dwc_ep.dma_desc_addr;
++
++			/* Cannot call dma_free_coherent() with IRQs disabled */
++			DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++			dwc_otg_ep_free_desc_chain(dev, desc_addr, dma_desc_addr,
++						   MAX_DMA_DESC_CNT);
++
++			goto out_unlocked;
++		}
++	}
++	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++
++out_unlocked:
++	DWC_DEBUGPL(DBG_PCD, "%d %s disabled\n", ep->dwc_ep.num,
++		    ep->dwc_ep.is_in ? "IN" : "OUT");
++	return 0;
++
++}
++
++/******************************************************************************/
++#ifdef DWC_UTE_PER_IO
++
++/**
++ * Free the request and its extended parts
++ *
++ */
++void dwc_pcd_xiso_ereq_free(dwc_otg_pcd_ep_t * ep, dwc_otg_pcd_request_t * req)
++{
++	DWC_FREE(req->ext_req.per_io_frame_descs);
++	DWC_FREE(req);
++}
++
++/**
++ * Start the next request in the endpoint's queue.
++ *
++ */
++int dwc_otg_pcd_xiso_start_next_request(dwc_otg_pcd_t * pcd,
++					dwc_otg_pcd_ep_t * ep)
++{
++	int i;
++	dwc_otg_pcd_request_t *req = NULL;
++	dwc_ep_t *dwcep = NULL;
++	struct dwc_iso_xreq_port *ereq = NULL;
++	struct dwc_iso_pkt_desc_port *ddesc_iso;
++	uint16_t nat;
++	depctl_data_t diepctl;
++
++	dwcep = &ep->dwc_ep;
++
++	if (dwcep->xiso_active_xfers > 0) {
++#if 0	//Disable this to decrease s/w overhead that is crucial for Isoc transfers
++		DWC_WARN("There are currently active transfers for EP%d \
++				(active=%d; queued=%d)", dwcep->num, dwcep->xiso_active_xfers,
++				dwcep->xiso_queued_xfers);
++#endif
++		return 0;
++	}
++
++	nat = UGETW(ep->desc->wMaxPacketSize);
++	nat = (nat >> 11) & 0x03;
++
++	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++		req = DWC_CIRCLEQ_FIRST(&ep->queue);
++		ereq = &req->ext_req;
++		ep->stopped = 0;
++
++		/* Get the frame number */
++		dwcep->xiso_frame_num =
++		    dwc_otg_get_frame_number(GET_CORE_IF(pcd));
++		DWC_DEBUG("FRM_NUM=%d", dwcep->xiso_frame_num);
++
++		ddesc_iso = ereq->per_io_frame_descs;
++
++		if (dwcep->is_in) {
++			/* Setup DMA Descriptor chain for IN Isoc request */
++			for (i = 0; i < ereq->pio_pkt_count; i++) {
++				//if ((i % (nat + 1)) == 0)
++				if ( i > 0 )
++					dwcep->xiso_frame_num =
++					    (dwcep->xiso_bInterval +
++										dwcep->xiso_frame_num) & 0x3FFF;
++				dwcep->desc_addr[i].buf =
++				    req->dma + ddesc_iso[i].offset;
++				dwcep->desc_addr[i].status.b_iso_in.txbytes =
++				    ddesc_iso[i].length;
++				dwcep->desc_addr[i].status.b_iso_in.framenum =
++				    dwcep->xiso_frame_num;
++				dwcep->desc_addr[i].status.b_iso_in.bs =
++				    BS_HOST_READY;
++				dwcep->desc_addr[i].status.b_iso_in.txsts = 0;
++				dwcep->desc_addr[i].status.b_iso_in.sp =
++				    (ddesc_iso[i].length %
++				     dwcep->maxpacket) ? 1 : 0;
++				dwcep->desc_addr[i].status.b_iso_in.ioc = 0;
++				dwcep->desc_addr[i].status.b_iso_in.pid = nat + 1;
++				dwcep->desc_addr[i].status.b_iso_in.l = 0;
++
++				/* Process the last descriptor */
++				if (i == ereq->pio_pkt_count - 1) {
++					dwcep->desc_addr[i].status.b_iso_in.ioc = 1;
++					dwcep->desc_addr[i].status.b_iso_in.l = 1;
++				}
++			}
++
++			/* Setup and start the transfer for this endpoint */
++			dwcep->xiso_active_xfers++;
++			DWC_WRITE_REG32(&GET_CORE_IF(pcd)->dev_if->
++					in_ep_regs[dwcep->num]->diepdma,
++					dwcep->dma_desc_addr);
++			diepctl.d32 = 0;
++			diepctl.b.epena = 1;
++			diepctl.b.cnak = 1;
++			DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->dev_if->
++					 in_ep_regs[dwcep->num]->diepctl, 0,
++					 diepctl.d32);
++		} else {
++			/* Setup DMA Descriptor chain for OUT Isoc request */
++			for (i = 0; i < ereq->pio_pkt_count; i++) {
++				//if ((i % (nat + 1)) == 0)
++				dwcep->xiso_frame_num = (dwcep->xiso_bInterval +
++										dwcep->xiso_frame_num) & 0x3FFF;
++				dwcep->desc_addr[i].buf =
++				    req->dma + ddesc_iso[i].offset;
++				dwcep->desc_addr[i].status.b_iso_out.rxbytes =
++				    ddesc_iso[i].length;
++				dwcep->desc_addr[i].status.b_iso_out.framenum =
++				    dwcep->xiso_frame_num;
++				dwcep->desc_addr[i].status.b_iso_out.bs =
++				    BS_HOST_READY;
++				dwcep->desc_addr[i].status.b_iso_out.rxsts = 0;
++				dwcep->desc_addr[i].status.b_iso_out.sp =
++				    (ddesc_iso[i].length %
++				     dwcep->maxpacket) ? 1 : 0;
++				dwcep->desc_addr[i].status.b_iso_out.ioc = 0;
++				dwcep->desc_addr[i].status.b_iso_out.pid = nat + 1;
++				dwcep->desc_addr[i].status.b_iso_out.l = 0;
++
++				/* Process the last descriptor */
++				if (i == ereq->pio_pkt_count - 1) {
++					dwcep->desc_addr[i].status.b_iso_out.ioc = 1;
++					dwcep->desc_addr[i].status.b_iso_out.l = 1;
++				}
++			}
++
++			/* Setup and start the transfer for this endpoint */
++			dwcep->xiso_active_xfers++;
++			DWC_WRITE_REG32(&GET_CORE_IF(pcd)->
++					dev_if->out_ep_regs[dwcep->num]->
++					doepdma, dwcep->dma_desc_addr);
++			diepctl.d32 = 0;
++			diepctl.b.epena = 1;
++			diepctl.b.cnak = 1;
++			DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->
++					 dev_if->out_ep_regs[dwcep->num]->
++					 doepctl, 0, diepctl.d32);
++		}
++
++	} else {
++		ep->stopped = 1;
++	}
++
++	return 0;
++}
++
++/**
++ *	- Remove the request from the queue
++ */
++void complete_xiso_ep(dwc_otg_pcd_ep_t * ep)
++{
++	dwc_otg_pcd_request_t *req = NULL;
++	struct dwc_iso_xreq_port *ereq = NULL;
++	struct dwc_iso_pkt_desc_port *ddesc_iso = NULL;
++	dwc_ep_t *dwcep = NULL;
++	int i;
++
++	//DWC_DEBUG();
++	dwcep = &ep->dwc_ep;
++
++	/* Get the first pending request from the queue */
++	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++		req = DWC_CIRCLEQ_FIRST(&ep->queue);
++		if (!req) {
++			DWC_PRINTF("complete_ep 0x%p, req = NULL!\n", ep);
++			return;
++		}
++		dwcep->xiso_active_xfers--;
++		dwcep->xiso_queued_xfers--;
++		/* Remove this request from the queue */
++		DWC_CIRCLEQ_REMOVE_INIT(&ep->queue, req, queue_entry);
++	} else {
++		DWC_PRINTF("complete_ep 0x%p, ep->queue empty!\n", ep);
++		return;
++	}
++
++	ep->stopped = 1;
++	ereq = &req->ext_req;
++	ddesc_iso = ereq->per_io_frame_descs;
++
++	if (dwcep->xiso_active_xfers < 0) {
++		DWC_WARN("EP#%d (xiso_active_xfers=%d)", dwcep->num,
++			 dwcep->xiso_active_xfers);
++	}
++
++	/* Fill the Isoc descs of portable extended req from dma descriptors */
++	for (i = 0; i < ereq->pio_pkt_count; i++) {
++		if (dwcep->is_in) {	/* IN endpoints */
++			ddesc_iso[i].actual_length = ddesc_iso[i].length -
++			    dwcep->desc_addr[i].status.b_iso_in.txbytes;
++			ddesc_iso[i].status =
++			    dwcep->desc_addr[i].status.b_iso_in.txsts;
++		} else {	/* OUT endpoints */
++			ddesc_iso[i].actual_length = ddesc_iso[i].length -
++			    dwcep->desc_addr[i].status.b_iso_out.rxbytes;
++			ddesc_iso[i].status =
++			    dwcep->desc_addr[i].status.b_iso_out.rxsts;
++		}
++	}
++
++	DWC_SPINUNLOCK(ep->pcd->lock);
++
++	/* Call the completion function in the non-portable logic */
++	ep->pcd->fops->xisoc_complete(ep->pcd, ep->priv, req->priv, 0,
++				      &req->ext_req);
++
++	DWC_SPINLOCK(ep->pcd->lock);
++
++	/* Free the request - specific freeing needed for extended request object */
++	dwc_pcd_xiso_ereq_free(ep, req);
++
++	/* Start the next request */
++	dwc_otg_pcd_xiso_start_next_request(ep->pcd, ep);
++
++	return;
++}
++
++/**
++ * Create and initialize the Isoc pkt descriptors of the extended request.
++ *
++ */
++static int dwc_otg_pcd_xiso_create_pkt_descs(dwc_otg_pcd_request_t * req,
++					     void *ereq_nonport,
++					     int atomic_alloc)
++{
++	struct dwc_iso_xreq_port *ereq = NULL;
++	struct dwc_iso_xreq_port *req_mapped = NULL;
++	struct dwc_iso_pkt_desc_port *ipds = NULL;	/* To be created in this function */
++	uint32_t pkt_count;
++	int i;
++
++	ereq = &req->ext_req;
++	req_mapped = (struct dwc_iso_xreq_port *)ereq_nonport;
++	pkt_count = req_mapped->pio_pkt_count;
++
++	/* Create the isoc descs */
++	if (atomic_alloc) {
++		ipds = DWC_ALLOC_ATOMIC(sizeof(*ipds) * pkt_count);
++	} else {
++		ipds = DWC_ALLOC(sizeof(*ipds) * pkt_count);
++	}
++
++	if (!ipds) {
++		DWC_ERROR("Failed to allocate isoc descriptors");
++		return -DWC_E_NO_MEMORY;
++	}
++
++	/* Initialize the extended request fields */
++	ereq->per_io_frame_descs = ipds;
++	ereq->error_count = 0;
++	ereq->pio_alloc_pkt_count = pkt_count;
++	ereq->pio_pkt_count = pkt_count;
++	ereq->tr_sub_flags = req_mapped->tr_sub_flags;
++
++	/* Init the Isoc descriptors */
++	for (i = 0; i < pkt_count; i++) {
++		ipds[i].length = req_mapped->per_io_frame_descs[i].length;
++		ipds[i].offset = req_mapped->per_io_frame_descs[i].offset;
++		ipds[i].status = req_mapped->per_io_frame_descs[i].status;	/* 0 */
++		ipds[i].actual_length =
++		    req_mapped->per_io_frame_descs[i].actual_length;
++	}
++
++	return 0;
++}
++
++static void prn_ext_request(struct dwc_iso_xreq_port *ereq)
++{
++	struct dwc_iso_pkt_desc_port *xfd = NULL;
++	int i;
++
++	DWC_DEBUG("per_io_frame_descs=%p", ereq->per_io_frame_descs);
++	DWC_DEBUG("tr_sub_flags=%d", ereq->tr_sub_flags);
++	DWC_DEBUG("error_count=%d", ereq->error_count);
++	DWC_DEBUG("pio_alloc_pkt_count=%d", ereq->pio_alloc_pkt_count);
++	DWC_DEBUG("pio_pkt_count=%d", ereq->pio_pkt_count);
++	DWC_DEBUG("res=%d", ereq->res);
++
++	for (i = 0; i < ereq->pio_pkt_count; i++) {
++		xfd = &ereq->per_io_frame_descs[0];
++		DWC_DEBUG("FD #%d", i);
++
++		DWC_DEBUG("xfd->actual_length=%d", xfd->actual_length);
++		DWC_DEBUG("xfd->length=%d", xfd->length);
++		DWC_DEBUG("xfd->offset=%d", xfd->offset);
++		DWC_DEBUG("xfd->status=%d", xfd->status);
++	}
++}
++
++/**
++ *
++ */
++int dwc_otg_pcd_xiso_ep_queue(dwc_otg_pcd_t * pcd, void *ep_handle,
++			      uint8_t * buf, dwc_dma_t dma_buf, uint32_t buflen,
++			      int zero, void *req_handle, int atomic_alloc,
++			      void *ereq_nonport)
++{
++	dwc_otg_pcd_request_t *req = NULL;
++	dwc_otg_pcd_ep_t *ep;
++	dwc_irqflags_t flags;
++	int res;
++
++	ep = get_ep_from_handle(pcd, ep_handle);
++	if (!ep) {
++		DWC_WARN("bad ep\n");
++		return -DWC_E_INVALID;
++	}
++
++	/* We support this extension only for DDMA mode */
++	if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC)
++		if (!GET_CORE_IF(pcd)->dma_desc_enable)
++			return -DWC_E_INVALID;
++
++	/* Create a dwc_otg_pcd_request_t object */
++	if (atomic_alloc) {
++		req = DWC_ALLOC_ATOMIC(sizeof(*req));
++	} else {
++		req = DWC_ALLOC(sizeof(*req));
++	}
++
++	if (!req) {
++		return -DWC_E_NO_MEMORY;
++	}
++
++	/* Create the Isoc descs for this request which shall be the exact match
++	 * of the structure sent to us from the non-portable logic */
++	res =
++	    dwc_otg_pcd_xiso_create_pkt_descs(req, ereq_nonport, atomic_alloc);
++	if (res) {
++		DWC_WARN("Failed to init the Isoc descriptors");
++		DWC_FREE(req);
++		return res;
++	}
++
++	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++
++	DWC_CIRCLEQ_INIT_ENTRY(req, queue_entry);
++	req->buf = buf;
++	req->dma = dma_buf;
++	req->length = buflen;
++	req->sent_zlp = zero;
++	req->priv = req_handle;
++
++	//DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++	ep->dwc_ep.dma_addr = dma_buf;
++	ep->dwc_ep.start_xfer_buff = buf;
++	ep->dwc_ep.xfer_buff = buf;
++	ep->dwc_ep.xfer_len = 0;
++	ep->dwc_ep.xfer_count = 0;
++	ep->dwc_ep.sent_zlp = 0;
++	ep->dwc_ep.total_len = buflen;
++
++	/* Add this request to the tail */
++	DWC_CIRCLEQ_INSERT_TAIL(&ep->queue, req, queue_entry);
++	ep->dwc_ep.xiso_queued_xfers++;
++
++//DWC_DEBUG("CP_0");
++//DWC_DEBUG("req->ext_req.tr_sub_flags=%d", req->ext_req.tr_sub_flags);
++//prn_ext_request((struct dwc_iso_xreq_port *) ereq_nonport);
++//prn_ext_request(&req->ext_req);
++
++	//DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++
++	/* If the req->status == ASAP  then check if there is any active transfer
++	 * for this endpoint. If no active transfers, then get the first entry
++	 * from the queue and start that transfer
++	 */
++	if (req->ext_req.tr_sub_flags == DWC_EREQ_TF_ASAP) {
++		res = dwc_otg_pcd_xiso_start_next_request(pcd, ep);
++		if (res) {
++			DWC_WARN("Failed to start the next Isoc transfer");
++			DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++			DWC_FREE(req);
++			return res;
++		}
++	}
++
++	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++	return 0;
++}
++
++#endif
++/* END ifdef DWC_UTE_PER_IO ***************************************************/
++int dwc_otg_pcd_ep_queue(dwc_otg_pcd_t * pcd, void *ep_handle,
++			 uint8_t * buf, dwc_dma_t dma_buf, uint32_t buflen,
++			 int zero, void *req_handle, int atomic_alloc)
++{
++	struct device *dev = dwc_otg_pcd_to_dev(pcd);
++	dwc_irqflags_t flags;
++	dwc_otg_pcd_request_t *req;
++	dwc_otg_pcd_ep_t *ep;
++	uint32_t max_transfer;
++
++	ep = get_ep_from_handle(pcd, ep_handle);
++	if (!ep || (!ep->desc && ep->dwc_ep.num != 0)) {
++		DWC_WARN("bad ep\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (atomic_alloc) {
++		req = DWC_ALLOC_ATOMIC(sizeof(*req));
++	} else {
++		req = DWC_ALLOC(sizeof(*req));
++	}
++
++	if (!req) {
++		return -DWC_E_NO_MEMORY;
++	}
++	DWC_CIRCLEQ_INIT_ENTRY(req, queue_entry);
++	if (!GET_CORE_IF(pcd)->core_params->opt) {
++		if (ep->dwc_ep.num != 0) {
++			DWC_ERROR("queue req %p, len %d buf %p\n",
++				  req_handle, buflen, buf);
++		}
++	}
++
++	req->buf = buf;
++	req->dma = dma_buf;
++	req->length = buflen;
++	req->sent_zlp = zero;
++	req->priv = req_handle;
++	req->dw_align_buf = NULL;
++	if ((dma_buf & 0x3) && GET_CORE_IF(pcd)->dma_enable
++			&& !GET_CORE_IF(pcd)->dma_desc_enable)
++		req->dw_align_buf = DWC_DMA_ALLOC(dev, buflen,
++				 &req->dw_align_buf_dma);
++	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++
++	/*
++	 * After adding request to the queue for IN ISOC wait for In Token Received
++	 * when TX FIFO is empty interrupt and for OUT ISOC wait for OUT Token
++	 * Received when EP is disabled interrupt to obtain starting microframe
++	 * (odd/even) start transfer
++	 */
++	if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
++		if (req != 0) {
++			depctl_data_t depctl = {.d32 =
++				    DWC_READ_REG32(&pcd->core_if->dev_if->
++						   in_ep_regs[ep->dwc_ep.num]->
++						   diepctl) };
++			++pcd->request_pending;
++
++			DWC_CIRCLEQ_INSERT_TAIL(&ep->queue, req, queue_entry);
++			if (ep->dwc_ep.is_in) {
++				depctl.b.cnak = 1;
++				DWC_WRITE_REG32(&pcd->core_if->dev_if->
++						in_ep_regs[ep->dwc_ep.num]->
++						diepctl, depctl.d32);
++			}
++
++			DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++		}
++		return 0;
++	}
++
++	/*
++	 * For EP0 IN without premature status, zlp is required?
++	 */
++	if (ep->dwc_ep.num == 0 && ep->dwc_ep.is_in) {
++		DWC_DEBUGPL(DBG_PCDV, "%d-OUT ZLP\n", ep->dwc_ep.num);
++		//_req->zero = 1;
++	}
++
++	/* Start the transfer */
++	if (DWC_CIRCLEQ_EMPTY(&ep->queue) && !ep->stopped) {
++		/* EP0 Transfer? */
++		if (ep->dwc_ep.num == 0) {
++			switch (pcd->ep0state) {
++			case EP0_IN_DATA_PHASE:
++				DWC_DEBUGPL(DBG_PCD,
++					    "%s ep0: EP0_IN_DATA_PHASE\n",
++					    __func__);
++				break;
++
++			case EP0_OUT_DATA_PHASE:
++				DWC_DEBUGPL(DBG_PCD,
++					    "%s ep0: EP0_OUT_DATA_PHASE\n",
++					    __func__);
++				if (pcd->request_config) {
++					/* Complete STATUS PHASE */
++					ep->dwc_ep.is_in = 1;
++					pcd->ep0state = EP0_IN_STATUS_PHASE;
++				}
++				break;
++
++			case EP0_IN_STATUS_PHASE:
++				DWC_DEBUGPL(DBG_PCD,
++					    "%s ep0: EP0_IN_STATUS_PHASE\n",
++					    __func__);
++				break;
++
++			default:
++				DWC_DEBUGPL(DBG_ANY, "ep0: odd state %d\n",
++					    pcd->ep0state);
++				DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++				return -DWC_E_SHUTDOWN;
++			}
++
++			ep->dwc_ep.dma_addr = dma_buf;
++			ep->dwc_ep.start_xfer_buff = buf;
++			ep->dwc_ep.xfer_buff = buf;
++			ep->dwc_ep.xfer_len = buflen;
++			ep->dwc_ep.xfer_count = 0;
++			ep->dwc_ep.sent_zlp = 0;
++			ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
++
++			if (zero) {
++				if ((ep->dwc_ep.xfer_len %
++				     ep->dwc_ep.maxpacket == 0)
++				    && (ep->dwc_ep.xfer_len != 0)) {
++					ep->dwc_ep.sent_zlp = 1;
++				}
++
++			}
++
++			dwc_otg_ep0_start_transfer(GET_CORE_IF(pcd),
++						   &ep->dwc_ep);
++		}		// non-ep0 endpoints
++		else {
++#ifdef DWC_UTE_CFI
++			if (ep->dwc_ep.buff_mode != BM_STANDARD) {
++				/* store the request length */
++				ep->dwc_ep.cfi_req_len = buflen;
++				pcd->cfi->ops.build_descriptors(pcd->cfi, pcd,
++								ep, req);
++			} else {
++#endif
++				max_transfer =
++				    GET_CORE_IF(ep->pcd)->core_params->
++				    max_transfer_size;
++
++				/* Setup and start the Transfer */
++				if (req->dw_align_buf){
++					if (ep->dwc_ep.is_in)
++						dwc_memcpy(req->dw_align_buf,
++							   buf, buflen);
++					ep->dwc_ep.dma_addr =
++					    req->dw_align_buf_dma;
++					ep->dwc_ep.start_xfer_buff =
++					    req->dw_align_buf;
++					ep->dwc_ep.xfer_buff =
++					    req->dw_align_buf;
++				} else {
++					ep->dwc_ep.dma_addr = dma_buf;
++					ep->dwc_ep.start_xfer_buff = buf;
++                                        ep->dwc_ep.xfer_buff = buf;
++				}
++				ep->dwc_ep.xfer_len = 0;
++				ep->dwc_ep.xfer_count = 0;
++				ep->dwc_ep.sent_zlp = 0;
++				ep->dwc_ep.total_len = buflen;
++
++				ep->dwc_ep.maxxfer = max_transfer;
++				if (GET_CORE_IF(pcd)->dma_desc_enable) {
++					uint32_t out_max_xfer =
++					    DDMA_MAX_TRANSFER_SIZE -
++					    (DDMA_MAX_TRANSFER_SIZE % 4);
++					if (ep->dwc_ep.is_in) {
++						if (ep->dwc_ep.maxxfer >
++						    DDMA_MAX_TRANSFER_SIZE) {
++							ep->dwc_ep.maxxfer =
++							    DDMA_MAX_TRANSFER_SIZE;
++						}
++					} else {
++						if (ep->dwc_ep.maxxfer >
++						    out_max_xfer) {
++							ep->dwc_ep.maxxfer =
++							    out_max_xfer;
++						}
++					}
++				}
++				if (ep->dwc_ep.maxxfer < ep->dwc_ep.total_len) {
++					ep->dwc_ep.maxxfer -=
++					    (ep->dwc_ep.maxxfer %
++					     ep->dwc_ep.maxpacket);
++				}
++
++				if (zero) {
++					if ((ep->dwc_ep.total_len %
++					     ep->dwc_ep.maxpacket == 0)
++					    && (ep->dwc_ep.total_len != 0)) {
++						ep->dwc_ep.sent_zlp = 1;
++					}
++				}
++#ifdef DWC_UTE_CFI
++			}
++#endif
++			dwc_otg_ep_start_transfer(GET_CORE_IF(pcd),
++						  &ep->dwc_ep);
++		}
++	}
++
++	if (req != 0) {
++		++pcd->request_pending;
++		DWC_CIRCLEQ_INSERT_TAIL(&ep->queue, req, queue_entry);
++		if (ep->dwc_ep.is_in && ep->stopped
++		    && !(GET_CORE_IF(pcd)->dma_enable)) {
++			/** @todo NGS Create a function for this. */
++			diepmsk_data_t diepmsk = {.d32 = 0 };
++			diepmsk.b.intktxfemp = 1;
++			if (GET_CORE_IF(pcd)->multiproc_int_enable) {
++				DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->
++						 dev_if->dev_global_regs->diepeachintmsk
++						 [ep->dwc_ep.num], 0,
++						 diepmsk.d32);
++			} else {
++				DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->
++						 dev_if->dev_global_regs->
++						 diepmsk, 0, diepmsk.d32);
++			}
++
++		}
++	}
++	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++
++	return 0;
++}
++
++int dwc_otg_pcd_ep_dequeue(dwc_otg_pcd_t * pcd, void *ep_handle,
++			   void *req_handle)
++{
++	dwc_irqflags_t flags;
++	dwc_otg_pcd_request_t *req;
++	dwc_otg_pcd_ep_t *ep;
++
++	ep = get_ep_from_handle(pcd, ep_handle);
++	if (!ep || (!ep->desc && ep->dwc_ep.num != 0)) {
++		DWC_WARN("bad argument\n");
++		return -DWC_E_INVALID;
++	}
++
++	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++
++	/* make sure it's actually queued on this endpoint */
++	DWC_CIRCLEQ_FOREACH(req, &ep->queue, queue_entry) {
++		if (req->priv == (void *)req_handle) {
++			break;
++		}
++	}
++
++	if (req->priv != (void *)req_handle) {
++		DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++		return -DWC_E_INVALID;
++	}
++
++	if (!DWC_CIRCLEQ_EMPTY_ENTRY(req, queue_entry)) {
++		dwc_otg_request_done(ep, req, -DWC_E_RESTART);
++	} else {
++		req = NULL;
++	}
++
++	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++
++	return req ? 0 : -DWC_E_SHUTDOWN;
++
++}
++
++/**
++ * dwc_otg_pcd_ep_wedge - sets the halt feature and ignores clear requests
++ *
++ * Use this to stall an endpoint and ignore CLEAR_FEATURE(HALT_ENDPOINT)
++ * requests. If the gadget driver clears the halt status, it will
++ * automatically unwedge the endpoint.
++ *
++ * Returns zero on success, else negative DWC error code.
++ */
++int dwc_otg_pcd_ep_wedge(dwc_otg_pcd_t * pcd, void *ep_handle)
++{
++	dwc_otg_pcd_ep_t *ep;
++	dwc_irqflags_t flags;
++	int retval = 0;
++
++	ep = get_ep_from_handle(pcd, ep_handle);
++
++	if ((!ep->desc && ep != &pcd->ep0) ||
++	    (ep->desc && (ep->desc->bmAttributes == UE_ISOCHRONOUS))) {
++		DWC_WARN("%s, bad ep\n", __func__);
++		return -DWC_E_INVALID;
++	}
++
++	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++		DWC_WARN("%d %s XFer In process\n", ep->dwc_ep.num,
++			 ep->dwc_ep.is_in ? "IN" : "OUT");
++		retval = -DWC_E_AGAIN;
++	} else {
++                /* This code needs to be reviewed */
++		if (ep->dwc_ep.is_in == 1 && GET_CORE_IF(pcd)->dma_desc_enable) {
++			dtxfsts_data_t txstatus;
++			fifosize_data_t txfifosize;
++
++			txfifosize.d32 =
++			    DWC_READ_REG32(&GET_CORE_IF(pcd)->
++					   core_global_regs->dtxfsiz[ep->dwc_ep.
++								     tx_fifo_num]);
++			txstatus.d32 =
++			    DWC_READ_REG32(&GET_CORE_IF(pcd)->
++					   dev_if->in_ep_regs[ep->dwc_ep.num]->
++					   dtxfsts);
++
++			if (txstatus.b.txfspcavail < txfifosize.b.depth) {
++				DWC_WARN("%s() Data In Tx Fifo\n", __func__);
++				retval = -DWC_E_AGAIN;
++			} else {
++				if (ep->dwc_ep.num == 0) {
++					pcd->ep0state = EP0_STALL;
++				}
++
++				ep->stopped = 1;
++				dwc_otg_ep_set_stall(GET_CORE_IF(pcd),
++						     &ep->dwc_ep);
++			}
++		} else {
++			if (ep->dwc_ep.num == 0) {
++				pcd->ep0state = EP0_STALL;
++			}
++
++			ep->stopped = 1;
++			dwc_otg_ep_set_stall(GET_CORE_IF(pcd), &ep->dwc_ep);
++		}
++	}
++
++	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++
++	return retval;
++}
++
++int dwc_otg_pcd_ep_halt(dwc_otg_pcd_t * pcd, void *ep_handle, int value)
++{
++	dwc_otg_pcd_ep_t *ep;
++	dwc_irqflags_t flags;
++	int retval = 0;
++
++	ep = get_ep_from_handle(pcd, ep_handle);
++
++	if (!ep || (!ep->desc && ep != &pcd->ep0) ||
++	    (ep->desc && (ep->desc->bmAttributes == UE_ISOCHRONOUS))) {
++		DWC_WARN("%s, bad ep\n", __func__);
++		return -DWC_E_INVALID;
++	}
++
++	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++		DWC_WARN("%d %s XFer In process\n", ep->dwc_ep.num,
++			 ep->dwc_ep.is_in ? "IN" : "OUT");
++		retval = -DWC_E_AGAIN;
++	} else if (value == 0) {
++		dwc_otg_ep_clear_stall(GET_CORE_IF(pcd), &ep->dwc_ep);
++	} else if (value == 1) {
++		if (ep->dwc_ep.is_in == 1 && GET_CORE_IF(pcd)->dma_desc_enable) {
++			dtxfsts_data_t txstatus;
++			fifosize_data_t txfifosize;
++
++			txfifosize.d32 =
++			    DWC_READ_REG32(&GET_CORE_IF(pcd)->core_global_regs->
++					   dtxfsiz[ep->dwc_ep.tx_fifo_num]);
++			txstatus.d32 =
++			    DWC_READ_REG32(&GET_CORE_IF(pcd)->dev_if->
++					   in_ep_regs[ep->dwc_ep.num]->dtxfsts);
++
++			if (txstatus.b.txfspcavail < txfifosize.b.depth) {
++				DWC_WARN("%s() Data In Tx Fifo\n", __func__);
++				retval = -DWC_E_AGAIN;
++			} else {
++				if (ep->dwc_ep.num == 0) {
++					pcd->ep0state = EP0_STALL;
++				}
++
++				ep->stopped = 1;
++				dwc_otg_ep_set_stall(GET_CORE_IF(pcd),
++						     &ep->dwc_ep);
++			}
++		} else {
++			if (ep->dwc_ep.num == 0) {
++				pcd->ep0state = EP0_STALL;
++			}
++
++			ep->stopped = 1;
++			dwc_otg_ep_set_stall(GET_CORE_IF(pcd), &ep->dwc_ep);
++		}
++	} else if (value == 2) {
++		ep->dwc_ep.stall_clear_flag = 0;
++	} else if (value == 3) {
++		ep->dwc_ep.stall_clear_flag = 1;
++	}
++
++	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++
++	return retval;
++}
++
++/**
++ * This function initiates remote wakeup of the host from suspend state.
++ */
++void dwc_otg_pcd_rem_wkup_from_suspend(dwc_otg_pcd_t * pcd, int set)
++{
++	dctl_data_t dctl = { 0 };
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dsts_data_t dsts;
++
++	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
++	if (!dsts.b.suspsts) {
++		DWC_WARN("Remote wakeup while is not in suspend state\n");
++	}
++	/* Check if DEVICE_REMOTE_WAKEUP feature enabled */
++	if (pcd->remote_wakeup_enable) {
++		if (set) {
++
++			if (core_if->adp_enable) {
++				gpwrdn_data_t gpwrdn;
++
++				dwc_otg_adp_probe_stop(core_if);
++
++				/* Mask SRP detected interrupt from Power Down Logic */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.srp_det_msk = 1;
++				DWC_MODIFY_REG32(&core_if->
++						 core_global_regs->gpwrdn,
++						 gpwrdn.d32, 0);
++
++				/* Disable Power Down Logic */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pmuactv = 1;
++				DWC_MODIFY_REG32(&core_if->
++						 core_global_regs->gpwrdn,
++						 gpwrdn.d32, 0);
++
++				/*
++				 * Initialize the Core for Device mode.
++				 */
++				core_if->op_state = B_PERIPHERAL;
++				dwc_otg_core_init(core_if);
++				dwc_otg_enable_global_interrupts(core_if);
++				cil_pcd_start(core_if);
++
++				dwc_otg_initiate_srp(core_if);
++			}
++
++			dctl.b.rmtwkupsig = 1;
++			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
++					 dctl, 0, dctl.d32);
++			DWC_DEBUGPL(DBG_PCD, "Set Remote Wakeup\n");
++
++			dwc_mdelay(2);
++			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
++					 dctl, dctl.d32, 0);
++			DWC_DEBUGPL(DBG_PCD, "Clear Remote Wakeup\n");
++		}
++	} else {
++		DWC_DEBUGPL(DBG_PCD, "Remote Wakeup is disabled\n");
++	}
++}
++
++#ifdef CONFIG_USB_DWC_OTG_LPM
++/**
++ * This function initiates remote wakeup of the host from L1 sleep state.
++ */
++void dwc_otg_pcd_rem_wkup_from_sleep(dwc_otg_pcd_t * pcd, int set)
++{
++	glpmcfg_data_t lpmcfg;
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++
++	/* Check if we are in L1 state */
++	if (!lpmcfg.b.prt_sleep_sts) {
++		DWC_DEBUGPL(DBG_PCD, "Device is not in sleep state\n");
++		return;
++	}
++
++	/* Check if host allows remote wakeup */
++	if (!lpmcfg.b.rem_wkup_en) {
++		DWC_DEBUGPL(DBG_PCD, "Host does not allow remote wakeup\n");
++		return;
++	}
++
++	/* Check if Resume OK */
++	if (!lpmcfg.b.sleep_state_resumeok) {
++		DWC_DEBUGPL(DBG_PCD, "Sleep state resume is not OK\n");
++		return;
++	}
++
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++	lpmcfg.b.en_utmi_sleep = 0;
++	lpmcfg.b.hird_thres &= (~(1 << 4));
++	DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg, lpmcfg.d32);
++
++	if (set) {
++		dctl_data_t dctl = {.d32 = 0 };
++		dctl.b.rmtwkupsig = 1;
++		/* Set RmtWkUpSig bit to start remote wakup signaling.
++		 * Hardware will automatically clear this bit.
++		 */
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl,
++				 0, dctl.d32);
++		DWC_DEBUGPL(DBG_PCD, "Set Remote Wakeup\n");
++	}
++
++}
++#endif
++
++/**
++ * Performs remote wakeup.
++ */
++void dwc_otg_pcd_remote_wakeup(dwc_otg_pcd_t * pcd, int set)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_irqflags_t flags;
++	if (dwc_otg_is_device_mode(core_if)) {
++		DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++#ifdef CONFIG_USB_DWC_OTG_LPM
++		if (core_if->lx_state == DWC_OTG_L1) {
++			dwc_otg_pcd_rem_wkup_from_sleep(pcd, set);
++		} else {
++#endif
++			dwc_otg_pcd_rem_wkup_from_suspend(pcd, set);
++#ifdef CONFIG_USB_DWC_OTG_LPM
++		}
++#endif
++		DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++	}
++	return;
++}
++
++void dwc_otg_pcd_disconnect_us(dwc_otg_pcd_t * pcd, int no_of_usecs)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dctl_data_t dctl = { 0 };
++
++	if (dwc_otg_is_device_mode(core_if)) {
++		dctl.b.sftdiscon = 1;
++		DWC_PRINTF("Soft disconnect for %d useconds\n",no_of_usecs);
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
++		dwc_udelay(no_of_usecs);
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32,0);
++
++	} else{
++		DWC_PRINTF("NOT SUPPORTED IN HOST MODE\n");
++	}
++	return;
++
++}
++
++int dwc_otg_pcd_wakeup(dwc_otg_pcd_t * pcd)
++{
++	dsts_data_t dsts;
++	gotgctl_data_t gotgctl;
++
++	/*
++	 * This function starts the Protocol if no session is in progress. If
++	 * a session is already in progress, but the device is suspended,
++	 * remote wakeup signaling is started.
++	 */
++
++	/* Check if valid session */
++	gotgctl.d32 =
++	    DWC_READ_REG32(&(GET_CORE_IF(pcd)->core_global_regs->gotgctl));
++	if (gotgctl.b.bsesvld) {
++		/* Check if suspend state */
++		dsts.d32 =
++		    DWC_READ_REG32(&
++				   (GET_CORE_IF(pcd)->dev_if->
++				    dev_global_regs->dsts));
++		if (dsts.b.suspsts) {
++			dwc_otg_pcd_remote_wakeup(pcd, 1);
++		}
++	} else {
++		dwc_otg_pcd_initiate_srp(pcd);
++	}
++
++	return 0;
++
++}
++
++/**
++ * Start the SRP timer to detect when the SRP does not complete within
++ * 6 seconds.
++ *
++ * @param pcd the pcd structure.
++ */
++void dwc_otg_pcd_initiate_srp(dwc_otg_pcd_t * pcd)
++{
++	dwc_irqflags_t flags;
++	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++	dwc_otg_initiate_srp(GET_CORE_IF(pcd));
++	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++}
++
++int dwc_otg_pcd_get_frame_number(dwc_otg_pcd_t * pcd)
++{
++	return dwc_otg_get_frame_number(GET_CORE_IF(pcd));
++}
++
++int dwc_otg_pcd_is_lpm_enabled(dwc_otg_pcd_t * pcd)
++{
++	return GET_CORE_IF(pcd)->core_params->lpm_enable;
++}
++
++uint32_t get_b_hnp_enable(dwc_otg_pcd_t * pcd)
++{
++	return pcd->b_hnp_enable;
++}
++
++uint32_t get_a_hnp_support(dwc_otg_pcd_t * pcd)
++{
++	return pcd->a_hnp_support;
++}
++
++uint32_t get_a_alt_hnp_support(dwc_otg_pcd_t * pcd)
++{
++	return pcd->a_alt_hnp_support;
++}
++
++int dwc_otg_pcd_get_rmwkup_enable(dwc_otg_pcd_t * pcd)
++{
++	return pcd->remote_wakeup_enable;
++}
++
++#endif /* DWC_HOST_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_pcd.h
+@@ -0,0 +1,273 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_pcd.h $
++ * $Revision: #48 $
++ * $Date: 2012/08/10 $
++ * $Change: 2047372 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_HOST_ONLY
++#if !defined(__DWC_PCD_H__)
++#define __DWC_PCD_H__
++
++#include "dwc_otg_os_dep.h"
++#include "usb.h"
++#include "dwc_otg_cil.h"
++#include "dwc_otg_pcd_if.h"
++#include "dwc_otg_driver.h"
++
++struct cfiobject;
++
++/**
++ * @file
++ *
++ * This file contains the structures, constants, and interfaces for
++ * the Perpherial Contoller Driver (PCD).
++ *
++ * The Peripheral Controller Driver (PCD) for Linux will implement the
++ * Gadget API, so that the existing Gadget drivers can be used. For
++ * the Mass Storage Function driver the File-backed USB Storage Gadget
++ * (FBS) driver will be used.  The FBS driver supports the
++ * Control-Bulk (CB), Control-Bulk-Interrupt (CBI), and Bulk-Only
++ * transports.
++ *
++ */
++
++/** Invalid DMA Address */
++#define DWC_DMA_ADDR_INVALID	(~(dwc_dma_t)0)
++
++/** Max Transfer size for any EP */
++#define DDMA_MAX_TRANSFER_SIZE 65535
++
++/**
++ * Get the pointer to the core_if from the pcd pointer.
++ */
++#define GET_CORE_IF( _pcd ) (_pcd->core_if)
++
++/**
++ * States of EP0.
++ */
++typedef enum ep0_state {
++	EP0_DISCONNECT,		/* no host */
++	EP0_IDLE,
++	EP0_IN_DATA_PHASE,
++	EP0_OUT_DATA_PHASE,
++	EP0_IN_STATUS_PHASE,
++	EP0_OUT_STATUS_PHASE,
++	EP0_STALL,
++} ep0state_e;
++
++/** Fordward declaration.*/
++struct dwc_otg_pcd;
++
++/** DWC_otg iso request structure.
++ *
++ */
++typedef struct usb_iso_request dwc_otg_pcd_iso_request_t;
++
++#ifdef DWC_UTE_PER_IO
++
++/**
++ * This shall be the exact analogy of the same type structure defined in the
++ * usb_gadget.h. Each descriptor contains
++ */
++struct dwc_iso_pkt_desc_port {
++	uint32_t offset;
++	uint32_t length;	/* expected length */
++	uint32_t actual_length;
++	uint32_t status;
++};
++
++struct dwc_iso_xreq_port {
++	/** transfer/submission flag */
++	uint32_t tr_sub_flags;
++	/** Start the request ASAP */
++#define DWC_EREQ_TF_ASAP		0x00000002
++	/** Just enqueue the request w/o initiating a transfer */
++#define DWC_EREQ_TF_ENQUEUE		0x00000004
++
++	/**
++	* count of ISO packets attached to this request - shall
++	* not exceed the pio_alloc_pkt_count
++	*/
++	uint32_t pio_pkt_count;
++	/** count of ISO packets allocated for this request */
++	uint32_t pio_alloc_pkt_count;
++	/** number of ISO packet errors */
++	uint32_t error_count;
++	/** reserved for future extension */
++	uint32_t res;
++	/** Will be allocated and freed in the UTE gadget and based on the CFC value */
++	struct dwc_iso_pkt_desc_port *per_io_frame_descs;
++};
++#endif
++/** DWC_otg request structure.
++ * This structure is a list of requests.
++ */
++typedef struct dwc_otg_pcd_request {
++	void *priv;
++	void *buf;
++	dwc_dma_t dma;
++	uint32_t length;
++	uint32_t actual;
++	unsigned sent_zlp:1;
++    /**
++     * Used instead of original buffer if
++     * it(physical address) is not dword-aligned.
++     **/
++     uint8_t *dw_align_buf;
++     dwc_dma_t dw_align_buf_dma;
++
++	 DWC_CIRCLEQ_ENTRY(dwc_otg_pcd_request) queue_entry;
++#ifdef DWC_UTE_PER_IO
++	struct dwc_iso_xreq_port ext_req;
++	//void *priv_ereq_nport; /*  */
++#endif
++} dwc_otg_pcd_request_t;
++
++DWC_CIRCLEQ_HEAD(req_list, dwc_otg_pcd_request);
++
++/**	  PCD EP structure.
++ * This structure describes an EP, there is an array of EPs in the PCD
++ * structure.
++ */
++typedef struct dwc_otg_pcd_ep {
++	/** USB EP Descriptor */
++	const usb_endpoint_descriptor_t *desc;
++
++	/** queue of dwc_otg_pcd_requests. */
++	struct req_list queue;
++	unsigned stopped:1;
++	unsigned disabling:1;
++	unsigned dma:1;
++	unsigned queue_sof:1;
++
++#ifdef DWC_EN_ISOC
++	/** ISOC req handle passed */
++	void *iso_req_handle;
++#endif				//_EN_ISOC_
++
++	/** DWC_otg ep data. */
++	dwc_ep_t dwc_ep;
++
++	/** Pointer to PCD */
++	struct dwc_otg_pcd *pcd;
++
++	void *priv;
++} dwc_otg_pcd_ep_t;
++
++/** DWC_otg PCD Structure.
++ * This structure encapsulates the data for the dwc_otg PCD.
++ */
++struct dwc_otg_pcd {
++	const struct dwc_otg_pcd_function_ops *fops;
++	/** The DWC otg device pointer */
++	struct dwc_otg_device *otg_dev;
++	/** Core Interface */
++	dwc_otg_core_if_t *core_if;
++	/** State of EP0 */
++	ep0state_e ep0state;
++	/** EP0 Request is pending */
++	unsigned ep0_pending:1;
++	/** Indicates when SET CONFIGURATION Request is in process */
++	unsigned request_config:1;
++	/** The state of the Remote Wakeup Enable. */
++	unsigned remote_wakeup_enable:1;
++	/** The state of the B-Device HNP Enable. */
++	unsigned b_hnp_enable:1;
++	/** The state of A-Device HNP Support. */
++	unsigned a_hnp_support:1;
++	/** The state of the A-Device Alt HNP support. */
++	unsigned a_alt_hnp_support:1;
++	/** Count of pending Requests */
++	unsigned request_pending;
++
++	/** SETUP packet for EP0
++	 * This structure is allocated as a DMA buffer on PCD initialization
++	 * with enough space for up to 3 setup packets.
++	 */
++	union {
++		usb_device_request_t req;
++		uint32_t d32[2];
++	} *setup_pkt;
++
++	dwc_dma_t setup_pkt_dma_handle;
++
++	/* Additional buffer and flag for CTRL_WR premature case */
++	uint8_t *backup_buf;
++	unsigned data_terminated;
++
++	/** 2-byte dma buffer used to return status from GET_STATUS */
++	uint16_t *status_buf;
++	dwc_dma_t status_buf_dma_handle;
++
++	/** EP0 */
++	dwc_otg_pcd_ep_t ep0;
++
++	/** Array of IN EPs. */
++	dwc_otg_pcd_ep_t in_ep[MAX_EPS_CHANNELS - 1];
++	/** Array of OUT EPs. */
++	dwc_otg_pcd_ep_t out_ep[MAX_EPS_CHANNELS - 1];
++	/** number of valid EPs in the above array. */
++//        unsigned      num_eps : 4;
++	dwc_spinlock_t *lock;
++
++	/** Tasklet to defer starting of TEST mode transmissions until
++	 *	Status Phase has been completed.
++	 */
++	dwc_tasklet_t *test_mode_tasklet;
++
++	/** Tasklet to delay starting of xfer in DMA mode */
++	dwc_tasklet_t *start_xfer_tasklet;
++
++	/** The test mode to enter when the tasklet is executed. */
++	unsigned test_mode;
++	/** The cfi_api structure that implements most of the CFI API
++	 * and OTG specific core configuration functionality
++	 */
++#ifdef DWC_UTE_CFI
++	struct cfiobject *cfi;
++#endif
++
++};
++
++static inline struct device *dwc_otg_pcd_to_dev(struct dwc_otg_pcd *pcd)
++{
++	return &pcd->otg_dev->os_dep.platformdev->dev;
++}
++
++//FIXME this functions should be static, and this prototypes should be removed
++extern void dwc_otg_request_nuke(dwc_otg_pcd_ep_t * ep);
++extern void dwc_otg_request_done(dwc_otg_pcd_ep_t * ep,
++				 dwc_otg_pcd_request_t * req, int32_t status);
++
++void dwc_otg_iso_buffer_done(dwc_otg_pcd_t * pcd, dwc_otg_pcd_ep_t * ep,
++			     void *req_handle);
++
++extern void do_test_mode(void *data);
++#endif
++#endif /* DWC_HOST_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_pcd_if.h
+@@ -0,0 +1,361 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_pcd_if.h $
++ * $Revision: #11 $
++ * $Date: 2011/10/26 $
++ * $Change: 1873028 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_HOST_ONLY
++
++#if !defined(__DWC_PCD_IF_H__)
++#define __DWC_PCD_IF_H__
++
++//#include "dwc_os.h"
++#include "dwc_otg_core_if.h"
++#include "dwc_otg_driver.h"
++
++/** @file
++ * This file defines DWC_OTG PCD Core API.
++ */
++
++struct dwc_otg_pcd;
++typedef struct dwc_otg_pcd dwc_otg_pcd_t;
++
++/** Maxpacket size for EP0 */
++#define MAX_EP0_SIZE	64
++/** Maxpacket size for any EP */
++#define MAX_PACKET_SIZE 1024
++
++/** @name Function Driver Callbacks */
++/** @{ */
++
++/** This function will be called whenever a previously queued request has
++ * completed.  The status value will be set to -DWC_E_SHUTDOWN to indicated a
++ * failed or aborted transfer, or -DWC_E_RESTART to indicate the device was reset,
++ * or -DWC_E_TIMEOUT to indicate it timed out, or -DWC_E_INVALID to indicate invalid
++ * parameters. */
++typedef int (*dwc_completion_cb_t) (dwc_otg_pcd_t * pcd, void *ep_handle,
++				    void *req_handle, int32_t status,
++				    uint32_t actual);
++/**
++ * This function will be called whenever a previousle queued ISOC request has
++ * completed. Count of ISOC packets could be read using dwc_otg_pcd_get_iso_packet_count
++ * function.
++ * The status of each ISOC packet could be read using dwc_otg_pcd_get_iso_packet_*
++ * functions.
++ */
++typedef int (*dwc_isoc_completion_cb_t) (dwc_otg_pcd_t * pcd, void *ep_handle,
++					 void *req_handle, int proc_buf_num);
++/** This function should handle any SETUP request that cannot be handled by the
++ * PCD Core.  This includes most GET_DESCRIPTORs, SET_CONFIGS, Any
++ * class-specific requests, etc.  The function must non-blocking.
++ *
++ * Returns 0 on success.
++ * Returns -DWC_E_NOT_SUPPORTED if the request is not supported.
++ * Returns -DWC_E_INVALID if the setup request had invalid parameters or bytes.
++ * Returns -DWC_E_SHUTDOWN on any other error. */
++typedef int (*dwc_setup_cb_t) (dwc_otg_pcd_t * pcd, uint8_t * bytes);
++/** This is called whenever the device has been disconnected.  The function
++ * driver should take appropriate action to clean up all pending requests in the
++ * PCD Core, remove all endpoints (except ep0), and initialize back to reset
++ * state. */
++typedef int (*dwc_disconnect_cb_t) (dwc_otg_pcd_t * pcd);
++/** This function is called when device has been connected. */
++typedef int (*dwc_connect_cb_t) (dwc_otg_pcd_t * pcd, int speed);
++/** This function is called when device has been suspended */
++typedef int (*dwc_suspend_cb_t) (dwc_otg_pcd_t * pcd);
++/** This function is called when device has received LPM tokens, i.e.
++ * device has been sent to sleep state. */
++typedef int (*dwc_sleep_cb_t) (dwc_otg_pcd_t * pcd);
++/** This function is called when device has been resumed
++ * from suspend(L2) or L1 sleep state. */
++typedef int (*dwc_resume_cb_t) (dwc_otg_pcd_t * pcd);
++/** This function is called whenever hnp params has been changed.
++ * User can call get_b_hnp_enable, get_a_hnp_support, get_a_alt_hnp_support functions
++ * to get hnp parameters. */
++typedef int (*dwc_hnp_params_changed_cb_t) (dwc_otg_pcd_t * pcd);
++/** This function is called whenever USB RESET is detected. */
++typedef int (*dwc_reset_cb_t) (dwc_otg_pcd_t * pcd);
++
++typedef int (*cfi_setup_cb_t) (dwc_otg_pcd_t * pcd, void *ctrl_req_bytes);
++
++/**
++ *
++ * @param ep_handle	Void pointer to the usb_ep structure
++ * @param ereq_port Pointer to the extended request structure created in the
++ *					portable part.
++ */
++typedef int (*xiso_completion_cb_t) (dwc_otg_pcd_t * pcd, void *ep_handle,
++				     void *req_handle, int32_t status,
++				     void *ereq_port);
++/** Function Driver Ops Data Structure */
++struct dwc_otg_pcd_function_ops {
++	dwc_connect_cb_t connect;
++	dwc_disconnect_cb_t disconnect;
++	dwc_setup_cb_t setup;
++	dwc_completion_cb_t complete;
++	dwc_isoc_completion_cb_t isoc_complete;
++	dwc_suspend_cb_t suspend;
++	dwc_sleep_cb_t sleep;
++	dwc_resume_cb_t resume;
++	dwc_reset_cb_t reset;
++	dwc_hnp_params_changed_cb_t hnp_changed;
++	cfi_setup_cb_t cfi_setup;
++#ifdef DWC_UTE_PER_IO
++	xiso_completion_cb_t xisoc_complete;
++#endif
++};
++/** @} */
++
++/** @name Function Driver Functions */
++/** @{ */
++
++/** Call this function to get pointer on dwc_otg_pcd_t,
++ * this pointer will be used for all PCD API functions.
++ *
++ * @param core_if The DWC_OTG Core
++ */
++extern dwc_otg_pcd_t *dwc_otg_pcd_init(dwc_otg_device_t *otg_dev);
++
++/** Frees PCD allocated by dwc_otg_pcd_init
++ *
++ * @param pcd The PCD
++ */
++extern void dwc_otg_pcd_remove(dwc_otg_pcd_t * pcd);
++
++/** Call this to bind the function driver to the PCD Core.
++ *
++ * @param pcd Pointer on dwc_otg_pcd_t returned by dwc_otg_pcd_init function.
++ * @param fops The Function Driver Ops data structure containing pointers to all callbacks.
++ */
++extern void dwc_otg_pcd_start(dwc_otg_pcd_t * pcd,
++			      const struct dwc_otg_pcd_function_ops *fops);
++
++/** Enables an endpoint for use.  This function enables an endpoint in
++ * the PCD.  The endpoint is described by the ep_desc which has the
++ * same format as a USB ep descriptor.  The ep_handle parameter is used to refer
++ * to the endpoint from other API functions and in callbacks.  Normally this
++ * should be called after a SET_CONFIGURATION/SET_INTERFACE to configure the
++ * core for that interface.
++ *
++ * Returns -DWC_E_INVALID if invalid parameters were passed.
++ * Returns -DWC_E_SHUTDOWN if any other error ocurred.
++ * Returns 0 on success.
++ *
++ * @param pcd The PCD
++ * @param ep_desc Endpoint descriptor
++ * @param usb_ep Handle on endpoint, that will be used to identify endpoint.
++ */
++extern int dwc_otg_pcd_ep_enable(dwc_otg_pcd_t * pcd,
++				 const uint8_t * ep_desc, void *usb_ep);
++
++/** Disable the endpoint referenced by ep_handle.
++ *
++ * Returns -DWC_E_INVALID if invalid parameters were passed.
++ * Returns -DWC_E_SHUTDOWN if any other error occurred.
++ * Returns 0 on success. */
++extern int dwc_otg_pcd_ep_disable(dwc_otg_pcd_t * pcd, void *ep_handle);
++
++/** Queue a data transfer request on the endpoint referenced by ep_handle.
++ * After the transfer is completes, the complete callback will be called with
++ * the request status.
++ *
++ * @param pcd The PCD
++ * @param ep_handle The handle of the endpoint
++ * @param buf The buffer for the data
++ * @param dma_buf The DMA buffer for the data
++ * @param buflen The length of the data transfer
++ * @param zero Specifies whether to send zero length last packet.
++ * @param req_handle Set this handle to any value to use to reference this
++ * request in the ep_dequeue function or from the complete callback
++ * @param atomic_alloc If driver need to perform atomic allocations
++ * for internal data structures.
++ *
++ * Returns -DWC_E_INVALID if invalid parameters were passed.
++ * Returns -DWC_E_SHUTDOWN if any other error ocurred.
++ * Returns 0 on success. */
++extern int dwc_otg_pcd_ep_queue(dwc_otg_pcd_t * pcd, void *ep_handle,
++				uint8_t * buf, dwc_dma_t dma_buf,
++				uint32_t buflen, int zero, void *req_handle,
++				int atomic_alloc);
++#ifdef DWC_UTE_PER_IO
++/**
++ *
++ * @param ereq_nonport	Pointer to the extended request part of the
++ *						usb_request structure defined in usb_gadget.h file.
++ */
++extern int dwc_otg_pcd_xiso_ep_queue(dwc_otg_pcd_t * pcd, void *ep_handle,
++				     uint8_t * buf, dwc_dma_t dma_buf,
++				     uint32_t buflen, int zero,
++				     void *req_handle, int atomic_alloc,
++				     void *ereq_nonport);
++
++#endif
++
++/** De-queue the specified data transfer that has not yet completed.
++ *
++ * Returns -DWC_E_INVALID if invalid parameters were passed.
++ * Returns -DWC_E_SHUTDOWN if any other error ocurred.
++ * Returns 0 on success. */
++extern int dwc_otg_pcd_ep_dequeue(dwc_otg_pcd_t * pcd, void *ep_handle,
++				  void *req_handle);
++
++/** Halt (STALL) an endpoint or clear it.
++ *
++ * Returns -DWC_E_INVALID if invalid parameters were passed.
++ * Returns -DWC_E_SHUTDOWN if any other error ocurred.
++ * Returns -DWC_E_AGAIN if the STALL cannot be sent and must be tried again later
++ * Returns 0 on success. */
++extern int dwc_otg_pcd_ep_halt(dwc_otg_pcd_t * pcd, void *ep_handle, int value);
++
++/** This function */
++extern int dwc_otg_pcd_ep_wedge(dwc_otg_pcd_t * pcd, void *ep_handle);
++
++/** This function should be called on every hardware interrupt */
++extern int32_t dwc_otg_pcd_handle_intr(dwc_otg_pcd_t * pcd);
++
++/** This function returns current frame number */
++extern int dwc_otg_pcd_get_frame_number(dwc_otg_pcd_t * pcd);
++
++/**
++ * Start isochronous transfers on the endpoint referenced by ep_handle.
++ * For isochronous transfers duble buffering is used.
++ * After processing each of buffers comlete callback will be called with
++ * status for each transaction.
++ *
++ * @param pcd The PCD
++ * @param ep_handle The handle of the endpoint
++ * @param buf0 The virtual address of first data buffer
++ * @param buf1 The virtual address of second data buffer
++ * @param dma0 The DMA address of first data buffer
++ * @param dma1 The DMA address of second data buffer
++ * @param sync_frame Data pattern frame number
++ * @param dp_frame Data size for pattern frame
++ * @param data_per_frame Data size for regular frame
++ * @param start_frame Frame number to start transfers, if -1 then start transfers ASAP.
++ * @param buf_proc_intrvl Interval of ISOC Buffer processing
++ * @param req_handle Handle of ISOC request
++ * @param atomic_alloc Specefies whether to perform atomic allocation for
++ * 			internal data structures.
++ *
++ * Returns -DWC_E_NO_MEMORY if there is no enough memory.
++ * Returns -DWC_E_INVALID if incorrect arguments are passed to the function.
++ * Returns -DW_E_SHUTDOWN for any other error.
++ * Returns 0 on success
++ */
++extern int dwc_otg_pcd_iso_ep_start(dwc_otg_pcd_t * pcd, void *ep_handle,
++				    uint8_t * buf0, uint8_t * buf1,
++				    dwc_dma_t dma0, dwc_dma_t dma1,
++				    int sync_frame, int dp_frame,
++				    int data_per_frame, int start_frame,
++				    int buf_proc_intrvl, void *req_handle,
++				    int atomic_alloc);
++
++/** Stop ISOC transfers on endpoint referenced by ep_handle.
++ *
++ * @param pcd The PCD
++ * @param ep_handle The handle of the endpoint
++ * @param req_handle Handle of ISOC request
++ *
++ * Returns -DWC_E_INVALID if incorrect arguments are passed to the function
++ * Returns 0 on success
++ */
++int dwc_otg_pcd_iso_ep_stop(dwc_otg_pcd_t * pcd, void *ep_handle,
++			    void *req_handle);
++
++/** Get ISOC packet status.
++ *
++ * @param pcd The PCD
++ * @param ep_handle The handle of the endpoint
++ * @param iso_req_handle Isochronoush request handle
++ * @param packet Number of packet
++ * @param status Out parameter for returning status
++ * @param actual Out parameter for returning actual length
++ * @param offset Out parameter for returning offset
++ *
++ */
++extern void dwc_otg_pcd_get_iso_packet_params(dwc_otg_pcd_t * pcd,
++					      void *ep_handle,
++					      void *iso_req_handle, int packet,
++					      int *status, int *actual,
++					      int *offset);
++
++/** Get ISOC packet count.
++ *
++ * @param pcd The PCD
++ * @param ep_handle The handle of the endpoint
++ * @param iso_req_handle
++ */
++extern int dwc_otg_pcd_get_iso_packet_count(dwc_otg_pcd_t * pcd,
++					    void *ep_handle,
++					    void *iso_req_handle);
++
++/** This function starts the SRP Protocol if no session is in progress. If
++ * a session is already in progress, but the device is suspended,
++ * remote wakeup signaling is started.
++ */
++extern int dwc_otg_pcd_wakeup(dwc_otg_pcd_t * pcd);
++
++/** This function returns 1 if LPM support is enabled, and 0 otherwise. */
++extern int dwc_otg_pcd_is_lpm_enabled(dwc_otg_pcd_t * pcd);
++
++/** This function returns 1 if remote wakeup is allowed and 0, otherwise. */
++extern int dwc_otg_pcd_get_rmwkup_enable(dwc_otg_pcd_t * pcd);
++
++/** Initiate SRP */
++extern void dwc_otg_pcd_initiate_srp(dwc_otg_pcd_t * pcd);
++
++/** Starts remote wakeup signaling. */
++extern void dwc_otg_pcd_remote_wakeup(dwc_otg_pcd_t * pcd, int set);
++
++/** Starts micorsecond soft disconnect. */
++extern void dwc_otg_pcd_disconnect_us(dwc_otg_pcd_t * pcd, int no_of_usecs);
++/** This function returns whether device is dualspeed.*/
++extern uint32_t dwc_otg_pcd_is_dualspeed(dwc_otg_pcd_t * pcd);
++
++/** This function returns whether device is otg. */
++extern uint32_t dwc_otg_pcd_is_otg(dwc_otg_pcd_t * pcd);
++
++/** These functions allow to get hnp parameters */
++extern uint32_t get_b_hnp_enable(dwc_otg_pcd_t * pcd);
++extern uint32_t get_a_hnp_support(dwc_otg_pcd_t * pcd);
++extern uint32_t get_a_alt_hnp_support(dwc_otg_pcd_t * pcd);
++
++/** CFI specific Interface functions */
++/** Allocate a cfi buffer */
++extern uint8_t *cfiw_ep_alloc_buffer(dwc_otg_pcd_t * pcd, void *pep,
++				     dwc_dma_t * addr, size_t buflen,
++				     int flags);
++
++/******************************************************************************/
++
++/** @} */
++
++#endif				/* __DWC_PCD_IF_H__ */
++
++#endif				/* DWC_HOST_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_pcd_intr.c
+@@ -0,0 +1,5148 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_pcd_intr.c $
++ * $Revision: #116 $
++ * $Date: 2012/08/10 $
++ * $Change: 2047372 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_HOST_ONLY
++
++#include "dwc_otg_pcd.h"
++
++#ifdef DWC_UTE_CFI
++#include "dwc_otg_cfi.h"
++#endif
++
++#ifdef DWC_UTE_PER_IO
++extern void complete_xiso_ep(dwc_otg_pcd_ep_t * ep);
++#endif
++//#define PRINT_CFI_DMA_DESCS
++
++#define DEBUG_EP0
++
++/**
++ * This function updates OTG.
++ */
++static void dwc_otg_pcd_update_otg(dwc_otg_pcd_t * pcd, const unsigned reset)
++{
++
++	if (reset) {
++		pcd->b_hnp_enable = 0;
++		pcd->a_hnp_support = 0;
++		pcd->a_alt_hnp_support = 0;
++	}
++
++	if (pcd->fops->hnp_changed) {
++		pcd->fops->hnp_changed(pcd);
++	}
++}
++
++/** @file
++ * This file contains the implementation of the PCD Interrupt handlers.
++ *
++ * The PCD handles the device interrupts.  Many conditions can cause a
++ * device interrupt. When an interrupt occurs, the device interrupt
++ * service routine determines the cause of the interrupt and
++ * dispatches handling to the appropriate function. These interrupt
++ * handling functions are described below.
++ * All interrupt registers are processed from LSB to MSB.
++ */
++
++/**
++ * This function prints the ep0 state for debug purposes.
++ */
++static inline void print_ep0_state(dwc_otg_pcd_t * pcd)
++{
++#ifdef DEBUG
++	char str[40];
++
++	switch (pcd->ep0state) {
++	case EP0_DISCONNECT:
++		dwc_strcpy(str, "EP0_DISCONNECT");
++		break;
++	case EP0_IDLE:
++		dwc_strcpy(str, "EP0_IDLE");
++		break;
++	case EP0_IN_DATA_PHASE:
++		dwc_strcpy(str, "EP0_IN_DATA_PHASE");
++		break;
++	case EP0_OUT_DATA_PHASE:
++		dwc_strcpy(str, "EP0_OUT_DATA_PHASE");
++		break;
++	case EP0_IN_STATUS_PHASE:
++		dwc_strcpy(str, "EP0_IN_STATUS_PHASE");
++		break;
++	case EP0_OUT_STATUS_PHASE:
++		dwc_strcpy(str, "EP0_OUT_STATUS_PHASE");
++		break;
++	case EP0_STALL:
++		dwc_strcpy(str, "EP0_STALL");
++		break;
++	default:
++		dwc_strcpy(str, "EP0_INVALID");
++	}
++
++	DWC_DEBUGPL(DBG_ANY, "%s(%d)\n", str, pcd->ep0state);
++#endif
++}
++
++/**
++ * This function calculate the size of the payload in the memory
++ * for out endpoints and prints size for debug purposes(used in
++ * 2.93a DevOutNak feature).
++ */
++static inline void print_memory_payload(dwc_otg_pcd_t * pcd,  dwc_ep_t * ep)
++{
++#ifdef DEBUG
++	deptsiz_data_t deptsiz_init = {.d32 = 0 };
++	deptsiz_data_t deptsiz_updt = {.d32 = 0 };
++	int pack_num;
++	unsigned payload;
++
++	deptsiz_init.d32 = pcd->core_if->start_doeptsiz_val[ep->num];
++	deptsiz_updt.d32 =
++		DWC_READ_REG32(&pcd->core_if->dev_if->
++						out_ep_regs[ep->num]->doeptsiz);
++	/* Payload will be */
++	payload = deptsiz_init.b.xfersize - deptsiz_updt.b.xfersize;
++	/* Packet count is decremented every time a packet
++	 * is written to the RxFIFO not in to the external memory
++	 * So, if payload == 0, then it means no packet was sent to ext memory*/
++	pack_num = (!payload) ? 0 : (deptsiz_init.b.pktcnt - deptsiz_updt.b.pktcnt);
++	DWC_DEBUGPL(DBG_PCDV,
++		"Payload for EP%d-%s\n",
++		ep->num, (ep->is_in ? "IN" : "OUT"));
++	DWC_DEBUGPL(DBG_PCDV,
++		"Number of transfered bytes = 0x%08x\n", payload);
++	DWC_DEBUGPL(DBG_PCDV,
++		"Number of transfered packets = %d\n", pack_num);
++#endif
++}
++
++
++#ifdef DWC_UTE_CFI
++static inline void print_desc(struct dwc_otg_dma_desc *ddesc,
++			      const uint8_t * epname, int descnum)
++{
++	CFI_INFO
++	    ("%s DMA_DESC(%d) buf=0x%08x bytes=0x%04x; sp=0x%x; l=0x%x; sts=0x%02x; bs=0x%02x\n",
++	     epname, descnum, ddesc->buf, ddesc->status.b.bytes,
++	     ddesc->status.b.sp, ddesc->status.b.l, ddesc->status.b.sts,
++	     ddesc->status.b.bs);
++}
++#endif
++
++/**
++ * This function returns pointer to in ep struct with number ep_num
++ */
++static inline dwc_otg_pcd_ep_t *get_in_ep(dwc_otg_pcd_t * pcd, uint32_t ep_num)
++{
++	int i;
++	int num_in_eps = GET_CORE_IF(pcd)->dev_if->num_in_eps;
++	if (ep_num == 0) {
++		return &pcd->ep0;
++	} else {
++		for (i = 0; i < num_in_eps; ++i) {
++			if (pcd->in_ep[i].dwc_ep.num == ep_num)
++				return &pcd->in_ep[i];
++		}
++		return 0;
++	}
++}
++
++/**
++ * This function returns pointer to out ep struct with number ep_num
++ */
++static inline dwc_otg_pcd_ep_t *get_out_ep(dwc_otg_pcd_t * pcd, uint32_t ep_num)
++{
++	int i;
++	int num_out_eps = GET_CORE_IF(pcd)->dev_if->num_out_eps;
++	if (ep_num == 0) {
++		return &pcd->ep0;
++	} else {
++		for (i = 0; i < num_out_eps; ++i) {
++			if (pcd->out_ep[i].dwc_ep.num == ep_num)
++				return &pcd->out_ep[i];
++		}
++		return 0;
++	}
++}
++
++/**
++ * This functions gets a pointer to an EP from the wIndex address
++ * value of the control request.
++ */
++dwc_otg_pcd_ep_t *get_ep_by_addr(dwc_otg_pcd_t * pcd, u16 wIndex)
++{
++	dwc_otg_pcd_ep_t *ep;
++	uint32_t ep_num = UE_GET_ADDR(wIndex);
++
++	if (ep_num == 0) {
++		ep = &pcd->ep0;
++	} else if (UE_GET_DIR(wIndex) == UE_DIR_IN) {	/* in ep */
++		ep = &pcd->in_ep[ep_num - 1];
++	} else {
++		ep = &pcd->out_ep[ep_num - 1];
++	}
++
++	return ep;
++}
++
++/**
++ * This function checks the EP request queue, if the queue is not
++ * empty the next request is started.
++ */
++void start_next_request(dwc_otg_pcd_ep_t * ep)
++{
++	dwc_otg_pcd_request_t *req = 0;
++	uint32_t max_transfer =
++	    GET_CORE_IF(ep->pcd)->core_params->max_transfer_size;
++
++#ifdef DWC_UTE_CFI
++	struct dwc_otg_pcd *pcd;
++	pcd = ep->pcd;
++#endif
++
++	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++		req = DWC_CIRCLEQ_FIRST(&ep->queue);
++
++#ifdef DWC_UTE_CFI
++		if (ep->dwc_ep.buff_mode != BM_STANDARD) {
++			ep->dwc_ep.cfi_req_len = req->length;
++			pcd->cfi->ops.build_descriptors(pcd->cfi, pcd, ep, req);
++		} else {
++#endif
++			/* Setup and start the Transfer */
++			if (req->dw_align_buf) {
++				ep->dwc_ep.dma_addr = req->dw_align_buf_dma;
++				ep->dwc_ep.start_xfer_buff = req->dw_align_buf;
++				ep->dwc_ep.xfer_buff = req->dw_align_buf;
++			} else {
++				ep->dwc_ep.dma_addr = req->dma;
++				ep->dwc_ep.start_xfer_buff = req->buf;
++				ep->dwc_ep.xfer_buff = req->buf;
++			}
++			ep->dwc_ep.sent_zlp = 0;
++			ep->dwc_ep.total_len = req->length;
++			ep->dwc_ep.xfer_len = 0;
++			ep->dwc_ep.xfer_count = 0;
++
++			ep->dwc_ep.maxxfer = max_transfer;
++			if (GET_CORE_IF(ep->pcd)->dma_desc_enable) {
++				uint32_t out_max_xfer = DDMA_MAX_TRANSFER_SIZE
++				    - (DDMA_MAX_TRANSFER_SIZE % 4);
++				if (ep->dwc_ep.is_in) {
++					if (ep->dwc_ep.maxxfer >
++					    DDMA_MAX_TRANSFER_SIZE) {
++						ep->dwc_ep.maxxfer =
++						    DDMA_MAX_TRANSFER_SIZE;
++					}
++				} else {
++					if (ep->dwc_ep.maxxfer > out_max_xfer) {
++						ep->dwc_ep.maxxfer =
++						    out_max_xfer;
++					}
++				}
++			}
++			if (ep->dwc_ep.maxxfer < ep->dwc_ep.total_len) {
++				ep->dwc_ep.maxxfer -=
++				    (ep->dwc_ep.maxxfer % ep->dwc_ep.maxpacket);
++			}
++			if (req->sent_zlp) {
++				if ((ep->dwc_ep.total_len %
++				     ep->dwc_ep.maxpacket == 0)
++				    && (ep->dwc_ep.total_len != 0)) {
++					ep->dwc_ep.sent_zlp = 1;
++				}
++
++			}
++#ifdef DWC_UTE_CFI
++		}
++#endif
++		dwc_otg_ep_start_transfer(GET_CORE_IF(ep->pcd), &ep->dwc_ep);
++	} else if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
++		DWC_PRINTF("There are no more ISOC requests \n");
++		ep->dwc_ep.frame_num = 0xFFFFFFFF;
++	}
++}
++
++/**
++ * This function handles the SOF Interrupts. At this time the SOF
++ * Interrupt is disabled.
++ */
++int32_t dwc_otg_pcd_handle_sof_intr(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++
++	gintsts_data_t gintsts;
++
++	DWC_DEBUGPL(DBG_PCD, "SOF\n");
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.sofintr = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * This function handles the Rx Status Queue Level Interrupt, which
++ * indicates that there is a least one packet in the Rx FIFO.  The
++ * packets are moved from the FIFO to memory, where they will be
++ * processed when the Endpoint Interrupt Register indicates Transfer
++ * Complete or SETUP Phase Done.
++ *
++ * Repeat the following until the Rx Status Queue is empty:
++ *	 -# Read the Receive Status Pop Register (GRXSTSP) to get Packet
++ *		info
++ *	 -# If Receive FIFO is empty then skip to step Clear the interrupt
++ *		and exit
++ *	 -# If SETUP Packet call dwc_otg_read_setup_packet to copy the
++ *		SETUP data to the buffer
++ *	 -# If OUT Data Packet call dwc_otg_read_packet to copy the data
++ *		to the destination buffer
++ */
++int32_t dwc_otg_pcd_handle_rx_status_q_level_intr(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	gintmsk_data_t gintmask = {.d32 = 0 };
++	device_grxsts_data_t status;
++	dwc_otg_pcd_ep_t *ep;
++	gintsts_data_t gintsts;
++#ifdef DEBUG
++	static char *dpid_str[] = { "D0", "D2", "D1", "MDATA" };
++#endif
++
++	//DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, _pcd);
++	/* Disable the Rx Status Queue Level interrupt */
++	gintmask.b.rxstsqlvl = 1;
++	DWC_MODIFY_REG32(&global_regs->gintmsk, gintmask.d32, 0);
++
++	/* Get the Status from the top of the FIFO */
++	status.d32 = DWC_READ_REG32(&global_regs->grxstsp);
++
++	DWC_DEBUGPL(DBG_PCD, "EP:%d BCnt:%d DPID:%s "
++		    "pktsts:%x Frame:%d(0x%0x)\n",
++		    status.b.epnum, status.b.bcnt,
++		    dpid_str[status.b.dpid],
++		    status.b.pktsts, status.b.fn, status.b.fn);
++	/* Get pointer to EP structure */
++	ep = get_out_ep(pcd, status.b.epnum);
++
++	switch (status.b.pktsts) {
++	case DWC_DSTS_GOUT_NAK:
++		DWC_DEBUGPL(DBG_PCDV, "Global OUT NAK\n");
++		break;
++	case DWC_STS_DATA_UPDT:
++		DWC_DEBUGPL(DBG_PCDV, "OUT Data Packet\n");
++		if (status.b.bcnt && ep->dwc_ep.xfer_buff) {
++			/** @todo NGS Check for buffer overflow? */
++			dwc_otg_read_packet(core_if,
++					    ep->dwc_ep.xfer_buff,
++					    status.b.bcnt);
++			ep->dwc_ep.xfer_count += status.b.bcnt;
++			ep->dwc_ep.xfer_buff += status.b.bcnt;
++		}
++		break;
++	case DWC_STS_XFER_COMP:
++		DWC_DEBUGPL(DBG_PCDV, "OUT Complete\n");
++		break;
++	case DWC_DSTS_SETUP_COMP:
++#ifdef DEBUG_EP0
++		DWC_DEBUGPL(DBG_PCDV, "Setup Complete\n");
++#endif
++		break;
++	case DWC_DSTS_SETUP_UPDT:
++		dwc_otg_read_setup_packet(core_if, pcd->setup_pkt->d32);
++#ifdef DEBUG_EP0
++		DWC_DEBUGPL(DBG_PCD,
++			    "SETUP PKT: %02x.%02x v%04x i%04x l%04x\n",
++			    pcd->setup_pkt->req.bmRequestType,
++			    pcd->setup_pkt->req.bRequest,
++			    UGETW(pcd->setup_pkt->req.wValue),
++			    UGETW(pcd->setup_pkt->req.wIndex),
++			    UGETW(pcd->setup_pkt->req.wLength));
++#endif
++		ep->dwc_ep.xfer_count += status.b.bcnt;
++		break;
++	default:
++		DWC_DEBUGPL(DBG_PCDV, "Invalid Packet Status (0x%0x)\n",
++			    status.b.pktsts);
++		break;
++	}
++
++	/* Enable the Rx Status Queue Level interrupt */
++	DWC_MODIFY_REG32(&global_regs->gintmsk, 0, gintmask.d32);
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.rxstsqlvl = 1;
++	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++	//DWC_DEBUGPL(DBG_PCDV, "EXIT: %s\n", __func__);
++	return 1;
++}
++
++/**
++ * This function examines the Device IN Token Learning Queue to
++ * determine the EP number of the last IN token received.  This
++ * implementation is for the Mass Storage device where there are only
++ * 2 IN EPs (Control-IN and BULK-IN).
++ *
++ * The EP numbers for the first six IN Tokens are in DTKNQR1 and there
++ * are 8 EP Numbers in each of the other possible DTKNQ Registers.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ *
++ */
++static inline int get_ep_of_last_in_token(dwc_otg_core_if_t * core_if)
++{
++	dwc_otg_device_global_regs_t *dev_global_regs =
++	    core_if->dev_if->dev_global_regs;
++	const uint32_t TOKEN_Q_DEPTH = core_if->hwcfg2.b.dev_token_q_depth;
++	/* Number of Token Queue Registers */
++	const int DTKNQ_REG_CNT = (TOKEN_Q_DEPTH + 7) / 8;
++	dtknq1_data_t dtknqr1;
++	uint32_t in_tkn_epnums[4];
++	int ndx = 0;
++	int i = 0;
++	volatile uint32_t *addr = &dev_global_regs->dtknqr1;
++	int epnum = 0;
++
++	//DWC_DEBUGPL(DBG_PCD,"dev_token_q_depth=%d\n",TOKEN_Q_DEPTH);
++
++	/* Read the DTKNQ Registers */
++	for (i = 0; i < DTKNQ_REG_CNT; i++) {
++		in_tkn_epnums[i] = DWC_READ_REG32(addr);
++		DWC_DEBUGPL(DBG_PCDV, "DTKNQR%d=0x%08x\n", i + 1,
++			    in_tkn_epnums[i]);
++		if (addr == &dev_global_regs->dvbusdis) {
++			addr = &dev_global_regs->dtknqr3_dthrctl;
++		} else {
++			++addr;
++		}
++
++	}
++
++	/* Copy the DTKNQR1 data to the bit field. */
++	dtknqr1.d32 = in_tkn_epnums[0];
++	/* Get the EP numbers */
++	in_tkn_epnums[0] = dtknqr1.b.epnums0_5;
++	ndx = dtknqr1.b.intknwptr - 1;
++
++	//DWC_DEBUGPL(DBG_PCDV,"ndx=%d\n",ndx);
++	if (ndx == -1) {
++		/** @todo Find a simpler way to calculate the max
++		 * queue position.*/
++		int cnt = TOKEN_Q_DEPTH;
++		if (TOKEN_Q_DEPTH <= 6) {
++			cnt = TOKEN_Q_DEPTH - 1;
++		} else if (TOKEN_Q_DEPTH <= 14) {
++			cnt = TOKEN_Q_DEPTH - 7;
++		} else if (TOKEN_Q_DEPTH <= 22) {
++			cnt = TOKEN_Q_DEPTH - 15;
++		} else {
++			cnt = TOKEN_Q_DEPTH - 23;
++		}
++		epnum = (in_tkn_epnums[DTKNQ_REG_CNT - 1] >> (cnt * 4)) & 0xF;
++	} else {
++		if (ndx <= 5) {
++			epnum = (in_tkn_epnums[0] >> (ndx * 4)) & 0xF;
++		} else if (ndx <= 13) {
++			ndx -= 6;
++			epnum = (in_tkn_epnums[1] >> (ndx * 4)) & 0xF;
++		} else if (ndx <= 21) {
++			ndx -= 14;
++			epnum = (in_tkn_epnums[2] >> (ndx * 4)) & 0xF;
++		} else if (ndx <= 29) {
++			ndx -= 22;
++			epnum = (in_tkn_epnums[3] >> (ndx * 4)) & 0xF;
++		}
++	}
++	//DWC_DEBUGPL(DBG_PCD,"epnum=%d\n",epnum);
++	return epnum;
++}
++
++/**
++ * This interrupt occurs when the non-periodic Tx FIFO is half-empty.
++ * The active request is checked for the next packet to be loaded into
++ * the non-periodic Tx FIFO.
++ */
++int32_t dwc_otg_pcd_handle_np_tx_fifo_empty_intr(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	dwc_otg_dev_in_ep_regs_t *ep_regs;
++	gnptxsts_data_t txstatus = {.d32 = 0 };
++	gintsts_data_t gintsts;
++
++	int epnum = 0;
++	dwc_otg_pcd_ep_t *ep = 0;
++	uint32_t len = 0;
++	int dwords;
++
++	/* Get the epnum from the IN Token Learning Queue. */
++	epnum = get_ep_of_last_in_token(core_if);
++	ep = get_in_ep(pcd, epnum);
++
++	DWC_DEBUGPL(DBG_PCD, "NP TxFifo Empty: %d \n", epnum);
++
++	ep_regs = core_if->dev_if->in_ep_regs[epnum];
++
++	len = ep->dwc_ep.xfer_len - ep->dwc_ep.xfer_count;
++	if (len > ep->dwc_ep.maxpacket) {
++		len = ep->dwc_ep.maxpacket;
++	}
++	dwords = (len + 3) / 4;
++
++	/* While there is space in the queue and space in the FIFO and
++	 * More data to tranfer, Write packets to the Tx FIFO */
++	txstatus.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
++	DWC_DEBUGPL(DBG_PCDV, "b4 GNPTXSTS=0x%08x\n", txstatus.d32);
++
++	while (txstatus.b.nptxqspcavail > 0 &&
++	       txstatus.b.nptxfspcavail > dwords &&
++	       ep->dwc_ep.xfer_count < ep->dwc_ep.xfer_len) {
++		/* Write the FIFO */
++		dwc_otg_ep_write_packet(core_if, &ep->dwc_ep, 0);
++		len = ep->dwc_ep.xfer_len - ep->dwc_ep.xfer_count;
++
++		if (len > ep->dwc_ep.maxpacket) {
++			len = ep->dwc_ep.maxpacket;
++		}
++
++		dwords = (len + 3) / 4;
++		txstatus.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
++		DWC_DEBUGPL(DBG_PCDV, "GNPTXSTS=0x%08x\n", txstatus.d32);
++	}
++
++	DWC_DEBUGPL(DBG_PCDV, "GNPTXSTS=0x%08x\n",
++		    DWC_READ_REG32(&global_regs->gnptxsts));
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.nptxfempty = 1;
++	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * This function is called when dedicated Tx FIFO Empty interrupt occurs.
++ * The active request is checked for the next packet to be loaded into
++ * apropriate Tx FIFO.
++ */
++static int32_t write_empty_tx_fifo(dwc_otg_pcd_t * pcd, uint32_t epnum)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	dwc_otg_dev_in_ep_regs_t *ep_regs;
++	dtxfsts_data_t txstatus = {.d32 = 0 };
++	dwc_otg_pcd_ep_t *ep = 0;
++	uint32_t len = 0;
++	int dwords;
++
++	ep = get_in_ep(pcd, epnum);
++
++	DWC_DEBUGPL(DBG_PCD, "Dedicated TxFifo Empty: %d \n", epnum);
++
++	ep_regs = core_if->dev_if->in_ep_regs[epnum];
++
++	len = ep->dwc_ep.xfer_len - ep->dwc_ep.xfer_count;
++
++	if (len > ep->dwc_ep.maxpacket) {
++		len = ep->dwc_ep.maxpacket;
++	}
++
++	dwords = (len + 3) / 4;
++
++	/* While there is space in the queue and space in the FIFO and
++	 * More data to tranfer, Write packets to the Tx FIFO */
++	txstatus.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts);
++	DWC_DEBUGPL(DBG_PCDV, "b4 dtxfsts[%d]=0x%08x\n", epnum, txstatus.d32);
++
++	while (txstatus.b.txfspcavail > dwords &&
++	       ep->dwc_ep.xfer_count < ep->dwc_ep.xfer_len &&
++	       ep->dwc_ep.xfer_len != 0) {
++		/* Write the FIFO */
++		dwc_otg_ep_write_packet(core_if, &ep->dwc_ep, 0);
++
++		len = ep->dwc_ep.xfer_len - ep->dwc_ep.xfer_count;
++		if (len > ep->dwc_ep.maxpacket) {
++			len = ep->dwc_ep.maxpacket;
++		}
++
++		dwords = (len + 3) / 4;
++		txstatus.d32 =
++		    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts);
++		DWC_DEBUGPL(DBG_PCDV, "dtxfsts[%d]=0x%08x\n", epnum,
++			    txstatus.d32);
++	}
++
++	DWC_DEBUGPL(DBG_PCDV, "b4 dtxfsts[%d]=0x%08x\n", epnum,
++		    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts));
++
++	return 1;
++}
++
++/**
++ * This function is called when the Device is disconnected. It stops
++ * any active requests and informs the Gadget driver of the
++ * disconnect.
++ */
++void dwc_otg_pcd_stop(dwc_otg_pcd_t * pcd)
++{
++	int i, num_in_eps, num_out_eps;
++	dwc_otg_pcd_ep_t *ep;
++
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	DWC_SPINLOCK(pcd->lock);
++
++	num_in_eps = GET_CORE_IF(pcd)->dev_if->num_in_eps;
++	num_out_eps = GET_CORE_IF(pcd)->dev_if->num_out_eps;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s() \n", __func__);
++	/* don't disconnect drivers more than once */
++	if (pcd->ep0state == EP0_DISCONNECT) {
++		DWC_DEBUGPL(DBG_ANY, "%s() Already Disconnected\n", __func__);
++		DWC_SPINUNLOCK(pcd->lock);
++		return;
++	}
++	pcd->ep0state = EP0_DISCONNECT;
++
++	/* Reset the OTG state. */
++	dwc_otg_pcd_update_otg(pcd, 1);
++
++	/* Disable the NP Tx Fifo Empty Interrupt. */
++	intr_mask.b.nptxfempty = 1;
++	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
++			 intr_mask.d32, 0);
++
++	/* Flush the FIFOs */
++	/**@todo NGS Flush Periodic FIFOs */
++	dwc_otg_flush_tx_fifo(GET_CORE_IF(pcd), 0x10);
++	dwc_otg_flush_rx_fifo(GET_CORE_IF(pcd));
++
++	/* prevent new request submissions, kill any outstanding requests  */
++	ep = &pcd->ep0;
++	dwc_otg_request_nuke(ep);
++	/* prevent new request submissions, kill any outstanding requests  */
++	for (i = 0; i < num_in_eps; i++) {
++		dwc_otg_pcd_ep_t *ep = &pcd->in_ep[i];
++		dwc_otg_request_nuke(ep);
++	}
++	/* prevent new request submissions, kill any outstanding requests  */
++	for (i = 0; i < num_out_eps; i++) {
++		dwc_otg_pcd_ep_t *ep = &pcd->out_ep[i];
++		dwc_otg_request_nuke(ep);
++	}
++
++	/* report disconnect; the driver is already quiesced */
++	if (pcd->fops->disconnect) {
++		DWC_SPINUNLOCK(pcd->lock);
++		pcd->fops->disconnect(pcd);
++		DWC_SPINLOCK(pcd->lock);
++	}
++	DWC_SPINUNLOCK(pcd->lock);
++}
++
++/**
++ * This interrupt indicates that ...
++ */
++int32_t dwc_otg_pcd_handle_i2c_intr(dwc_otg_pcd_t * pcd)
++{
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++	gintsts_data_t gintsts;
++
++	DWC_PRINTF("INTERRUPT Handler not implemented for %s\n", "i2cintr");
++	intr_mask.b.i2cintr = 1;
++	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
++			 intr_mask.d32, 0);
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.i2cintr = 1;
++	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
++			gintsts.d32);
++	return 1;
++}
++
++/**
++ * This interrupt indicates that ...
++ */
++int32_t dwc_otg_pcd_handle_early_suspend_intr(dwc_otg_pcd_t * pcd)
++{
++	gintsts_data_t gintsts;
++#if defined(VERBOSE)
++	DWC_PRINTF("Early Suspend Detected\n");
++#endif
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.erlysuspend = 1;
++	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
++			gintsts.d32);
++	return 1;
++}
++
++/**
++ * This function configures EPO to receive SETUP packets.
++ *
++ * @todo NGS: Update the comments from the HW FS.
++ *
++ *	-# Program the following fields in the endpoint specific registers
++ *	for Control OUT EP 0, in order to receive a setup packet
++ *	- DOEPTSIZ0.Packet Count = 3 (To receive up to 3 back to back
++ *	  setup packets)
++ *	- DOEPTSIZE0.Transfer Size = 24 Bytes (To receive up to 3 back
++ *	  to back setup packets)
++ *		- In DMA mode, DOEPDMA0 Register with a memory address to
++ *		  store any setup packets received
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param pcd	  Programming view of the PCD.
++ */
++static inline void ep0_out_start(dwc_otg_core_if_t * core_if,
++				 dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	deptsiz0_data_t doeptsize0 = {.d32 = 0 };
++	dwc_otg_dev_dma_desc_t *dma_desc;
++	depctl_data_t doepctl = {.d32 = 0 };
++
++#ifdef VERBOSE
++	DWC_DEBUGPL(DBG_PCDV, "%s() doepctl0=%0x\n", __func__,
++		    DWC_READ_REG32(&dev_if->out_ep_regs[0]->doepctl));
++#endif
++	if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
++		doepctl.d32 = DWC_READ_REG32(&dev_if->out_ep_regs[0]->doepctl);
++		if (doepctl.b.epena) {
++			return;
++		}
++	}
++
++	doeptsize0.b.supcnt = 3;
++	doeptsize0.b.pktcnt = 1;
++	doeptsize0.b.xfersize = 8 * 3;
++
++	if (core_if->dma_enable) {
++		if (!core_if->dma_desc_enable) {
++			/** put here as for Hermes mode deptisz register should not be written */
++			DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doeptsiz,
++					doeptsize0.d32);
++
++			/** @todo dma needs to handle multiple setup packets (up to 3) */
++			DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doepdma,
++					pcd->setup_pkt_dma_handle);
++		} else {
++			dev_if->setup_desc_index =
++			    (dev_if->setup_desc_index + 1) & 1;
++			dma_desc =
++			    dev_if->setup_desc_addr[dev_if->setup_desc_index];
++
++			/** DMA Descriptor Setup */
++			dma_desc->status.b.bs = BS_HOST_BUSY;
++			if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
++				dma_desc->status.b.sr = 0;
++				dma_desc->status.b.mtrf = 0;
++			}
++			dma_desc->status.b.l = 1;
++			dma_desc->status.b.ioc = 1;
++			dma_desc->status.b.bytes = pcd->ep0.dwc_ep.maxpacket;
++			dma_desc->buf = pcd->setup_pkt_dma_handle;
++			dma_desc->status.b.sts = 0;
++			dma_desc->status.b.bs = BS_HOST_READY;
++
++			/** DOEPDMA0 Register write */
++			DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doepdma,
++					dev_if->dma_setup_desc_addr
++					[dev_if->setup_desc_index]);
++		}
++
++	} else {
++		/** put here as for Hermes mode deptisz register should not be written */
++		DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doeptsiz,
++				doeptsize0.d32);
++	}
++
++	/** DOEPCTL0 Register write cnak will be set after setup interrupt */
++	doepctl.d32 = 0;
++	doepctl.b.epena = 1;
++	if (core_if->snpsid <= OTG_CORE_REV_2_94a) {
++	doepctl.b.cnak = 1;
++	DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doepctl, doepctl.d32);
++	} else {
++		DWC_MODIFY_REG32(&dev_if->out_ep_regs[0]->doepctl, 0, doepctl.d32);
++	}
++
++#ifdef VERBOSE
++	DWC_DEBUGPL(DBG_PCDV, "doepctl0=%0x\n",
++		    DWC_READ_REG32(&dev_if->out_ep_regs[0]->doepctl));
++	DWC_DEBUGPL(DBG_PCDV, "diepctl0=%0x\n",
++		    DWC_READ_REG32(&dev_if->in_ep_regs[0]->diepctl));
++#endif
++}
++
++/**
++ * This interrupt occurs when a USB Reset is detected. When the USB
++ * Reset Interrupt occurs the device state is set to DEFAULT and the
++ * EP0 state is set to IDLE.
++ *	-#	Set the NAK bit for all OUT endpoints (DOEPCTLn.SNAK = 1)
++ *	-#	Unmask the following interrupt bits
++ *		- DAINTMSK.INEP0 = 1 (Control 0 IN endpoint)
++ *	- DAINTMSK.OUTEP0 = 1 (Control 0 OUT endpoint)
++ *	- DOEPMSK.SETUP = 1
++ *	- DOEPMSK.XferCompl = 1
++ *	- DIEPMSK.XferCompl = 1
++ *	- DIEPMSK.TimeOut = 1
++ *	-# Program the following fields in the endpoint specific registers
++ *	for Control OUT EP 0, in order to receive a setup packet
++ *	- DOEPTSIZ0.Packet Count = 3 (To receive up to 3 back to back
++ *	  setup packets)
++ *	- DOEPTSIZE0.Transfer Size = 24 Bytes (To receive up to 3 back
++ *	  to back setup packets)
++ *		- In DMA mode, DOEPDMA0 Register with a memory address to
++ *		  store any setup packets received
++ * At this point, all the required initialization, except for enabling
++ * the control 0 OUT endpoint is done, for receiving SETUP packets.
++ */
++int32_t dwc_otg_pcd_handle_usb_reset_intr(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	depctl_data_t doepctl = {.d32 = 0 };
++	depctl_data_t diepctl = {.d32 = 0 };
++	daint_data_t daintmsk = {.d32 = 0 };
++	doepmsk_data_t doepmsk = {.d32 = 0 };
++	diepmsk_data_t diepmsk = {.d32 = 0 };
++	dcfg_data_t dcfg = {.d32 = 0 };
++	grstctl_t resetctl = {.d32 = 0 };
++	dctl_data_t dctl = {.d32 = 0 };
++	int i = 0;
++	gintsts_data_t gintsts;
++	pcgcctl_data_t power = {.d32 = 0 };
++
++	power.d32 = DWC_READ_REG32(core_if->pcgcctl);
++	if (power.b.stoppclk) {
++		power.d32 = 0;
++		power.b.stoppclk = 1;
++		DWC_MODIFY_REG32(core_if->pcgcctl, power.d32, 0);
++
++		power.b.pwrclmp = 1;
++		DWC_MODIFY_REG32(core_if->pcgcctl, power.d32, 0);
++
++		power.b.rstpdwnmodule = 1;
++		DWC_MODIFY_REG32(core_if->pcgcctl, power.d32, 0);
++	}
++
++	core_if->lx_state = DWC_OTG_L0;
++
++	DWC_PRINTF("USB RESET\n");
++#ifdef DWC_EN_ISOC
++	for (i = 1; i < 16; ++i) {
++		dwc_otg_pcd_ep_t *ep;
++		dwc_ep_t *dwc_ep;
++		ep = get_in_ep(pcd, i);
++		if (ep != 0) {
++			dwc_ep = &ep->dwc_ep;
++			dwc_ep->next_frame = 0xffffffff;
++		}
++	}
++#endif /* DWC_EN_ISOC */
++
++	/* reset the HNP settings */
++	dwc_otg_pcd_update_otg(pcd, 1);
++
++	/* Clear the Remote Wakeup Signalling */
++	dctl.b.rmtwkupsig = 1;
++	DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32, 0);
++
++	/* Set NAK for all OUT EPs */
++	doepctl.b.snak = 1;
++	for (i = 0; i <= dev_if->num_out_eps; i++) {
++		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doepctl, doepctl.d32);
++	}
++
++	/* Flush the NP Tx FIFO */
++	dwc_otg_flush_tx_fifo(core_if, 0x10);
++	/* Flush the Learning Queue */
++	resetctl.b.intknqflsh = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->grstctl, resetctl.d32);
++
++	if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable) {
++		core_if->start_predict = 0;
++		for (i = 0; i<= core_if->dev_if->num_in_eps; ++i) {
++			core_if->nextep_seq[i] = 0xff;	// 0xff - EP not active
++		}
++		core_if->nextep_seq[0] = 0;
++		core_if->first_in_nextep_seq = 0;
++		diepctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[0]->diepctl);
++		diepctl.b.nextep = 0;
++		DWC_WRITE_REG32(&dev_if->in_ep_regs[0]->diepctl, diepctl.d32);
++
++		/* Update IN Endpoint Mismatch Count by active IN NP EP count + 1 */
++		dcfg.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dcfg);
++		dcfg.b.epmscnt = 2;
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->dcfg, dcfg.d32);
++
++		DWC_DEBUGPL(DBG_PCDV,
++			    "%s first_in_nextep_seq= %2d; nextep_seq[]:\n",
++			__func__, core_if->first_in_nextep_seq);
++		for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
++			DWC_DEBUGPL(DBG_PCDV, "%2d\n", core_if->nextep_seq[i]);
++		}
++	}
++
++	if (core_if->multiproc_int_enable) {
++		daintmsk.b.inep0 = 1;
++		daintmsk.b.outep0 = 1;
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->deachintmsk,
++				daintmsk.d32);
++
++		doepmsk.b.setup = 1;
++		doepmsk.b.xfercompl = 1;
++		doepmsk.b.ahberr = 1;
++		doepmsk.b.epdisabled = 1;
++
++		if ((core_if->dma_desc_enable) ||
++		    (core_if->dma_enable
++		     && core_if->snpsid >= OTG_CORE_REV_3_00a)) {
++			doepmsk.b.stsphsercvd = 1;
++		}
++		if (core_if->dma_desc_enable)
++			doepmsk.b.bna = 1;
++/*
++		doepmsk.b.babble = 1;
++		doepmsk.b.nyet = 1;
++
++		if (core_if->dma_enable) {
++			doepmsk.b.nak = 1;
++		}
++*/
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->doepeachintmsk[0],
++				doepmsk.d32);
++
++		diepmsk.b.xfercompl = 1;
++		diepmsk.b.timeout = 1;
++		diepmsk.b.epdisabled = 1;
++		diepmsk.b.ahberr = 1;
++		diepmsk.b.intknepmis = 1;
++		if (!core_if->en_multiple_tx_fifo && core_if->dma_enable)
++			diepmsk.b.intknepmis = 0;
++
++/*		if (core_if->dma_desc_enable) {
++			diepmsk.b.bna = 1;
++		}
++*/
++/*
++		if (core_if->dma_enable) {
++			diepmsk.b.nak = 1;
++		}
++*/
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->diepeachintmsk[0],
++				diepmsk.d32);
++	} else {
++		daintmsk.b.inep0 = 1;
++		daintmsk.b.outep0 = 1;
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->daintmsk,
++				daintmsk.d32);
++
++		doepmsk.b.setup = 1;
++		doepmsk.b.xfercompl = 1;
++		doepmsk.b.ahberr = 1;
++		doepmsk.b.epdisabled = 1;
++
++		if ((core_if->dma_desc_enable) ||
++		    (core_if->dma_enable
++		     && core_if->snpsid >= OTG_CORE_REV_3_00a)) {
++			doepmsk.b.stsphsercvd = 1;
++		}
++		if (core_if->dma_desc_enable)
++			doepmsk.b.bna = 1;
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->doepmsk, doepmsk.d32);
++
++		diepmsk.b.xfercompl = 1;
++		diepmsk.b.timeout = 1;
++		diepmsk.b.epdisabled = 1;
++		diepmsk.b.ahberr = 1;
++		if (!core_if->en_multiple_tx_fifo && core_if->dma_enable)
++			diepmsk.b.intknepmis = 0;
++/*
++		if (core_if->dma_desc_enable) {
++			diepmsk.b.bna = 1;
++		}
++*/
++
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->diepmsk, diepmsk.d32);
++	}
++
++	/* Reset Device Address */
++	dcfg.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dcfg);
++	dcfg.b.devaddr = 0;
++	DWC_WRITE_REG32(&dev_if->dev_global_regs->dcfg, dcfg.d32);
++
++	/* setup EP0 to receive SETUP packets */
++	if (core_if->snpsid <= OTG_CORE_REV_2_94a)
++		ep0_out_start(core_if, pcd);
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.usbreset = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * Get the device speed from the device status register and convert it
++ * to USB speed constant.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static int get_device_speed(dwc_otg_core_if_t * core_if)
++{
++	dsts_data_t dsts;
++	int speed = 0;
++	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
++
++	switch (dsts.b.enumspd) {
++	case DWC_DSTS_ENUMSPD_HS_PHY_30MHZ_OR_60MHZ:
++		speed = USB_SPEED_HIGH;
++		break;
++	case DWC_DSTS_ENUMSPD_FS_PHY_30MHZ_OR_60MHZ:
++	case DWC_DSTS_ENUMSPD_FS_PHY_48MHZ:
++		speed = USB_SPEED_FULL;
++		break;
++
++	case DWC_DSTS_ENUMSPD_LS_PHY_6MHZ:
++		speed = USB_SPEED_LOW;
++		break;
++	}
++
++	return speed;
++}
++
++/**
++ * Read the device status register and set the device speed in the
++ * data structure.
++ * Set up EP0 to receive SETUP packets by calling dwc_ep0_activate.
++ */
++int32_t dwc_otg_pcd_handle_enum_done_intr(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
++	gintsts_data_t gintsts;
++	gusbcfg_data_t gusbcfg;
++	dwc_otg_core_global_regs_t *global_regs =
++	    GET_CORE_IF(pcd)->core_global_regs;
++	uint8_t utmi16b, utmi8b;
++	int speed;
++	DWC_DEBUGPL(DBG_PCD, "SPEED ENUM\n");
++
++	if (GET_CORE_IF(pcd)->snpsid >= OTG_CORE_REV_2_60a) {
++		utmi16b = 6;	//vahrama old value was 6;
++		utmi8b = 9;
++	} else {
++		utmi16b = 4;
++		utmi8b = 8;
++	}
++	dwc_otg_ep0_activate(GET_CORE_IF(pcd), &ep0->dwc_ep);
++	if (GET_CORE_IF(pcd)->snpsid >= OTG_CORE_REV_3_00a) {
++		ep0_out_start(GET_CORE_IF(pcd), pcd);
++	}
++
++#ifdef DEBUG_EP0
++	print_ep0_state(pcd);
++#endif
++
++	if (pcd->ep0state == EP0_DISCONNECT) {
++		pcd->ep0state = EP0_IDLE;
++	} else if (pcd->ep0state == EP0_STALL) {
++		pcd->ep0state = EP0_IDLE;
++	}
++
++	pcd->ep0state = EP0_IDLE;
++
++	ep0->stopped = 0;
++
++	speed = get_device_speed(GET_CORE_IF(pcd));
++	pcd->fops->connect(pcd, speed);
++
++	/* Set USB turnaround time based on device speed and PHY interface. */
++	gusbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
++	if (speed == USB_SPEED_HIGH) {
++		if (GET_CORE_IF(pcd)->hwcfg2.b.hs_phy_type ==
++		    DWC_HWCFG2_HS_PHY_TYPE_ULPI) {
++			/* ULPI interface */
++			gusbcfg.b.usbtrdtim = 9;
++		}
++		if (GET_CORE_IF(pcd)->hwcfg2.b.hs_phy_type ==
++		    DWC_HWCFG2_HS_PHY_TYPE_UTMI) {
++			/* UTMI+ interface */
++			if (GET_CORE_IF(pcd)->hwcfg4.b.utmi_phy_data_width == 0) {
++				gusbcfg.b.usbtrdtim = utmi8b;
++			} else if (GET_CORE_IF(pcd)->hwcfg4.
++				   b.utmi_phy_data_width == 1) {
++				gusbcfg.b.usbtrdtim = utmi16b;
++			} else if (GET_CORE_IF(pcd)->
++				   core_params->phy_utmi_width == 8) {
++				gusbcfg.b.usbtrdtim = utmi8b;
++			} else {
++				gusbcfg.b.usbtrdtim = utmi16b;
++			}
++		}
++		if (GET_CORE_IF(pcd)->hwcfg2.b.hs_phy_type ==
++		    DWC_HWCFG2_HS_PHY_TYPE_UTMI_ULPI) {
++			/* UTMI+  OR  ULPI interface */
++			if (gusbcfg.b.ulpi_utmi_sel == 1) {
++				/* ULPI interface */
++				gusbcfg.b.usbtrdtim = 9;
++			} else {
++				/* UTMI+ interface */
++				if (GET_CORE_IF(pcd)->
++				    core_params->phy_utmi_width == 16) {
++					gusbcfg.b.usbtrdtim = utmi16b;
++				} else {
++					gusbcfg.b.usbtrdtim = utmi8b;
++				}
++			}
++		}
++	} else {
++		/* Full or low speed */
++		gusbcfg.b.usbtrdtim = 9;
++	}
++	DWC_WRITE_REG32(&global_regs->gusbcfg, gusbcfg.d32);
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.enumdone = 1;
++	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
++			gintsts.d32);
++	return 1;
++}
++
++/**
++ * This interrupt indicates that the ISO OUT Packet was dropped due to
++ * Rx FIFO full or Rx Status Queue Full.  If this interrupt occurs
++ * read all the data from the Rx FIFO.
++ */
++int32_t dwc_otg_pcd_handle_isoc_out_packet_dropped_intr(dwc_otg_pcd_t * pcd)
++{
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++	gintsts_data_t gintsts;
++
++	DWC_WARN("INTERRUPT Handler not implemented for %s\n",
++		 "ISOC Out Dropped");
++
++	intr_mask.b.isooutdrop = 1;
++	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
++			 intr_mask.d32, 0);
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.isooutdrop = 1;
++	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
++			gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * This interrupt indicates the end of the portion of the micro-frame
++ * for periodic transactions.  If there is a periodic transaction for
++ * the next frame, load the packets into the EP periodic Tx FIFO.
++ */
++int32_t dwc_otg_pcd_handle_end_periodic_frame_intr(dwc_otg_pcd_t * pcd)
++{
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++	gintsts_data_t gintsts;
++	DWC_PRINTF("INTERRUPT Handler not implemented for %s\n", "EOP");
++
++	intr_mask.b.eopframe = 1;
++	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
++			 intr_mask.d32, 0);
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.eopframe = 1;
++	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
++			gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * This interrupt indicates that EP of the packet on the top of the
++ * non-periodic Tx FIFO does not match EP of the IN Token received.
++ *
++ * The "Device IN Token Queue" Registers are read to determine the
++ * order the IN Tokens have been received. The non-periodic Tx FIFO
++ * is flushed, so it can be reloaded in the order seen in the IN Token
++ * Queue.
++ */
++int32_t dwc_otg_pcd_handle_ep_mismatch_intr(dwc_otg_pcd_t * pcd)
++{
++	gintsts_data_t gintsts;
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dctl_data_t dctl;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	if (!core_if->en_multiple_tx_fifo && core_if->dma_enable) {
++		core_if->start_predict = 1;
++
++		DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, core_if);
++
++		gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++		if (!gintsts.b.ginnakeff) {
++			/* Disable EP Mismatch interrupt */
++			intr_mask.d32 = 0;
++			intr_mask.b.epmismatch = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, intr_mask.d32, 0);
++			/* Enable the Global IN NAK Effective Interrupt */
++			intr_mask.d32 = 0;
++			intr_mask.b.ginnakeff = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, 0, intr_mask.d32);
++			/* Set the global non-periodic IN NAK handshake */
++			dctl.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dctl);
++			dctl.b.sgnpinnak = 1;
++			DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32);
++		} else {
++			DWC_PRINTF("gintsts.b.ginnakeff = 1! dctl.b.sgnpinnak not set\n");
++		}
++		/* Disabling of all EP's will be done in dwc_otg_pcd_handle_in_nak_effective()
++		 * handler after Global IN NAK Effective interrupt will be asserted */
++	}
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.epmismatch = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * This interrupt is valid only in DMA mode. This interrupt indicates that the
++ * core has stopped fetching data for IN endpoints due to the unavailability of
++ * TxFIFO space or Request Queue space. This interrupt is used by the
++ * application for an endpoint mismatch algorithm.
++ *
++ * @param pcd The PCD
++ */
++int32_t dwc_otg_pcd_handle_ep_fetsusp_intr(dwc_otg_pcd_t * pcd)
++{
++	gintsts_data_t gintsts;
++	gintmsk_data_t gintmsk_data;
++	dctl_data_t dctl;
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, core_if);
++
++	/* Clear the global non-periodic IN NAK handshake */
++	dctl.d32 = 0;
++	dctl.b.cgnpinnak = 1;
++	DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32, dctl.d32);
++
++	/* Mask GINTSTS.FETSUSP interrupt */
++	gintmsk_data.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
++	gintmsk_data.b.fetsusp = 0;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, gintmsk_data.d32);
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.fetsusp = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++
++	return 1;
++}
++/**
++ * This funcion stalls EP0.
++ */
++static inline void ep0_do_stall(dwc_otg_pcd_t * pcd, const int err_val)
++{
++	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
++	usb_device_request_t *ctrl = &pcd->setup_pkt->req;
++	DWC_WARN("req %02x.%02x protocol STALL; err %d\n",
++		 ctrl->bmRequestType, ctrl->bRequest, err_val);
++
++	ep0->dwc_ep.is_in = 1;
++	dwc_otg_ep_set_stall(GET_CORE_IF(pcd), &ep0->dwc_ep);
++	pcd->ep0.stopped = 1;
++	pcd->ep0state = EP0_IDLE;
++	ep0_out_start(GET_CORE_IF(pcd), pcd);
++}
++
++/**
++ * This functions delegates the setup command to the gadget driver.
++ */
++static inline void do_gadget_setup(dwc_otg_pcd_t * pcd,
++				   usb_device_request_t * ctrl)
++{
++	int ret = 0;
++	DWC_SPINUNLOCK(pcd->lock);
++	ret = pcd->fops->setup(pcd, (uint8_t *) ctrl);
++	DWC_SPINLOCK(pcd->lock);
++	if (ret < 0) {
++		ep0_do_stall(pcd, ret);
++	}
++
++	/** @todo This is a g_file_storage gadget driver specific
++	 * workaround: a DELAYED_STATUS result from the fsg_setup
++	 * routine will result in the gadget queueing a EP0 IN status
++	 * phase for a two-stage control transfer. Exactly the same as
++	 * a SET_CONFIGURATION/SET_INTERFACE except that this is a class
++	 * specific request.  Need a generic way to know when the gadget
++	 * driver will queue the status phase. Can we assume when we
++	 * call the gadget driver setup() function that it will always
++	 * queue and require the following flag? Need to look into
++	 * this.
++	 */
++
++	if (ret == 256 + 999) {
++		pcd->request_config = 1;
++	}
++}
++
++#ifdef DWC_UTE_CFI
++/**
++ * This functions delegates the CFI setup commands to the gadget driver.
++ * This function will return a negative value to indicate a failure.
++ */
++static inline int cfi_gadget_setup(dwc_otg_pcd_t * pcd,
++				   struct cfi_usb_ctrlrequest *ctrl_req)
++{
++	int ret = 0;
++
++	if (pcd->fops && pcd->fops->cfi_setup) {
++		DWC_SPINUNLOCK(pcd->lock);
++		ret = pcd->fops->cfi_setup(pcd, ctrl_req);
++		DWC_SPINLOCK(pcd->lock);
++		if (ret < 0) {
++			ep0_do_stall(pcd, ret);
++			return ret;
++		}
++	}
++
++	return ret;
++}
++#endif
++
++/**
++ * This function starts the Zero-Length Packet for the IN status phase
++ * of a 2 stage control transfer.
++ */
++static inline void do_setup_in_status_phase(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
++	if (pcd->ep0state == EP0_STALL) {
++		return;
++	}
++
++	pcd->ep0state = EP0_IN_STATUS_PHASE;
++
++	/* Prepare for more SETUP Packets */
++	DWC_DEBUGPL(DBG_PCD, "EP0 IN ZLP\n");
++	if ((GET_CORE_IF(pcd)->snpsid >= OTG_CORE_REV_3_00a)
++	    && (pcd->core_if->dma_desc_enable)
++	    && (ep0->dwc_ep.xfer_count < ep0->dwc_ep.total_len)) {
++		DWC_DEBUGPL(DBG_PCDV,
++			    "Data terminated wait next packet in out_desc_addr\n");
++		pcd->backup_buf = phys_to_virt(ep0->dwc_ep.dma_addr);
++		pcd->data_terminated = 1;
++	}
++	ep0->dwc_ep.xfer_len = 0;
++	ep0->dwc_ep.xfer_count = 0;
++	ep0->dwc_ep.is_in = 1;
++	ep0->dwc_ep.dma_addr = pcd->setup_pkt_dma_handle;
++	dwc_otg_ep0_start_transfer(GET_CORE_IF(pcd), &ep0->dwc_ep);
++
++	/* Prepare for more SETUP Packets */
++	//ep0_out_start(GET_CORE_IF(pcd), pcd);
++}
++
++/**
++ * This function starts the Zero-Length Packet for the OUT status phase
++ * of a 2 stage control transfer.
++ */
++static inline void do_setup_out_status_phase(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
++	if (pcd->ep0state == EP0_STALL) {
++		DWC_DEBUGPL(DBG_PCD, "EP0 STALLED\n");
++		return;
++	}
++	pcd->ep0state = EP0_OUT_STATUS_PHASE;
++
++	DWC_DEBUGPL(DBG_PCD, "EP0 OUT ZLP\n");
++	ep0->dwc_ep.xfer_len = 0;
++	ep0->dwc_ep.xfer_count = 0;
++	ep0->dwc_ep.is_in = 0;
++	ep0->dwc_ep.dma_addr = pcd->setup_pkt_dma_handle;
++	dwc_otg_ep0_start_transfer(GET_CORE_IF(pcd), &ep0->dwc_ep);
++
++	/* Prepare for more SETUP Packets */
++	if (GET_CORE_IF(pcd)->dma_enable == 0) {
++		ep0_out_start(GET_CORE_IF(pcd), pcd);
++	}
++}
++
++/**
++ * Clear the EP halt (STALL) and if pending requests start the
++ * transfer.
++ */
++static inline void pcd_clear_halt(dwc_otg_pcd_t * pcd, dwc_otg_pcd_ep_t * ep)
++{
++	if (ep->dwc_ep.stall_clear_flag == 0)
++		dwc_otg_ep_clear_stall(GET_CORE_IF(pcd), &ep->dwc_ep);
++
++	/* Reactive the EP */
++	dwc_otg_ep_activate(GET_CORE_IF(pcd), &ep->dwc_ep);
++	if (ep->stopped) {
++		ep->stopped = 0;
++		/* If there is a request in the EP queue start it */
++
++		/** @todo FIXME: this causes an EP mismatch in DMA mode.
++		 * epmismatch not yet implemented. */
++
++		/*
++		 * Above fixme is solved by implmenting a tasklet to call the
++		 * start_next_request(), outside of interrupt context at some
++		 * time after the current time, after a clear-halt setup packet.
++		 * Still need to implement ep mismatch in the future if a gadget
++		 * ever uses more than one endpoint at once
++		 */
++		ep->queue_sof = 1;
++		DWC_TASK_SCHEDULE(pcd->start_xfer_tasklet);
++	}
++	/* Start Control Status Phase */
++	do_setup_in_status_phase(pcd);
++}
++
++/**
++ * This function is called when the SET_FEATURE TEST_MODE Setup packet
++ * is sent from the host.  The Device Control register is written with
++ * the Test Mode bits set to the specified Test Mode.  This is done as
++ * a tasklet so that the "Status" phase of the control transfer
++ * completes before transmitting the TEST packets.
++ *
++ * @todo This has not been tested since the tasklet struct was put
++ * into the PCD struct!
++ *
++ */
++void do_test_mode(void *data)
++{
++	dctl_data_t dctl;
++	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) data;
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	int test_mode = pcd->test_mode;
++
++//        DWC_WARN("%s() has not been tested since being rewritten!\n", __func__);
++
++	dctl.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dctl);
++	switch (test_mode) {
++	case 1:		// TEST_J
++		dctl.b.tstctl = 1;
++		break;
++
++	case 2:		// TEST_K
++		dctl.b.tstctl = 2;
++		break;
++
++	case 3:		// TEST_SE0_NAK
++		dctl.b.tstctl = 3;
++		break;
++
++	case 4:		// TEST_PACKET
++		dctl.b.tstctl = 4;
++		break;
++
++	case 5:		// TEST_FORCE_ENABLE
++		dctl.b.tstctl = 5;
++		break;
++	}
++	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32);
++}
++
++/**
++ * This function process the GET_STATUS Setup Commands.
++ */
++static inline void do_get_status(dwc_otg_pcd_t * pcd)
++{
++	usb_device_request_t ctrl = pcd->setup_pkt->req;
++	dwc_otg_pcd_ep_t *ep;
++	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
++	uint16_t *status = pcd->status_buf;
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++
++#ifdef DEBUG_EP0
++	DWC_DEBUGPL(DBG_PCD,
++		    "GET_STATUS %02x.%02x v%04x i%04x l%04x\n",
++		    ctrl.bmRequestType, ctrl.bRequest,
++		    UGETW(ctrl.wValue), UGETW(ctrl.wIndex),
++		    UGETW(ctrl.wLength));
++#endif
++
++	switch (UT_GET_RECIPIENT(ctrl.bmRequestType)) {
++	case UT_DEVICE:
++		if(UGETW(ctrl.wIndex) == 0xF000) { /* OTG Status selector */
++			DWC_PRINTF("wIndex - %d\n", UGETW(ctrl.wIndex));
++			DWC_PRINTF("OTG VERSION - %d\n", core_if->otg_ver);
++			DWC_PRINTF("OTG CAP - %d, %d\n",
++				   core_if->core_params->otg_cap,
++						DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE);
++			if (core_if->otg_ver == 1
++			    && core_if->core_params->otg_cap ==
++			    DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE) {
++				uint8_t *otgsts = (uint8_t*)pcd->status_buf;
++				*otgsts = (core_if->otg_sts & 0x1);
++				pcd->ep0_pending = 1;
++				ep0->dwc_ep.start_xfer_buff =
++				    (uint8_t *) otgsts;
++				ep0->dwc_ep.xfer_buff = (uint8_t *) otgsts;
++				ep0->dwc_ep.dma_addr =
++				    pcd->status_buf_dma_handle;
++				ep0->dwc_ep.xfer_len = 1;
++				ep0->dwc_ep.xfer_count = 0;
++				ep0->dwc_ep.total_len = ep0->dwc_ep.xfer_len;
++				dwc_otg_ep0_start_transfer(GET_CORE_IF(pcd),
++							   &ep0->dwc_ep);
++				return;
++			} else {
++				ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
++				return;
++			}
++			break;
++		} else {
++			*status = 0x1;	/* Self powered */
++			*status |= pcd->remote_wakeup_enable << 1;
++			break;
++		}
++	case UT_INTERFACE:
++		*status = 0;
++		break;
++
++	case UT_ENDPOINT:
++		ep = get_ep_by_addr(pcd, UGETW(ctrl.wIndex));
++		if (ep == 0 || UGETW(ctrl.wLength) > 2) {
++			ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
++			return;
++		}
++		/** @todo check for EP stall */
++		*status = ep->stopped;
++		break;
++	}
++	pcd->ep0_pending = 1;
++	ep0->dwc_ep.start_xfer_buff = (uint8_t *) status;
++	ep0->dwc_ep.xfer_buff = (uint8_t *) status;
++	ep0->dwc_ep.dma_addr = pcd->status_buf_dma_handle;
++	ep0->dwc_ep.xfer_len = 2;
++	ep0->dwc_ep.xfer_count = 0;
++	ep0->dwc_ep.total_len = ep0->dwc_ep.xfer_len;
++	dwc_otg_ep0_start_transfer(GET_CORE_IF(pcd), &ep0->dwc_ep);
++}
++
++/**
++ * This function process the SET_FEATURE Setup Commands.
++ */
++static inline void do_set_feature(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	usb_device_request_t ctrl = pcd->setup_pkt->req;
++	dwc_otg_pcd_ep_t *ep = 0;
++	int32_t otg_cap_param = core_if->core_params->otg_cap;
++	gotgctl_data_t gotgctl = {.d32 = 0 };
++
++	DWC_DEBUGPL(DBG_PCD, "SET_FEATURE:%02x.%02x v%04x i%04x l%04x\n",
++		    ctrl.bmRequestType, ctrl.bRequest,
++		    UGETW(ctrl.wValue), UGETW(ctrl.wIndex),
++		    UGETW(ctrl.wLength));
++	DWC_DEBUGPL(DBG_PCD, "otg_cap=%d\n", otg_cap_param);
++
++	switch (UT_GET_RECIPIENT(ctrl.bmRequestType)) {
++	case UT_DEVICE:
++		switch (UGETW(ctrl.wValue)) {
++		case UF_DEVICE_REMOTE_WAKEUP:
++			pcd->remote_wakeup_enable = 1;
++			break;
++
++		case UF_TEST_MODE:
++			/* Setup the Test Mode tasklet to do the Test
++			 * Packet generation after the SETUP Status
++			 * phase has completed. */
++
++			/** @todo This has not been tested since the
++			 * tasklet struct was put into the PCD
++			 * struct! */
++			pcd->test_mode = UGETW(ctrl.wIndex) >> 8;
++			DWC_TASK_SCHEDULE(pcd->test_mode_tasklet);
++			break;
++
++		case UF_DEVICE_B_HNP_ENABLE:
++			DWC_DEBUGPL(DBG_PCDV,
++				    "SET_FEATURE: USB_DEVICE_B_HNP_ENABLE\n");
++
++			/* dev may initiate HNP */
++			if (otg_cap_param == DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE) {
++				pcd->b_hnp_enable = 1;
++				dwc_otg_pcd_update_otg(pcd, 0);
++				DWC_DEBUGPL(DBG_PCD, "Request B HNP\n");
++				/**@todo Is the gotgctl.devhnpen cleared
++				 * by a USB Reset? */
++				gotgctl.b.devhnpen = 1;
++				gotgctl.b.hnpreq = 1;
++				DWC_WRITE_REG32(&global_regs->gotgctl,
++						gotgctl.d32);
++			} else {
++				ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
++				return;
++			}
++			break;
++
++		case UF_DEVICE_A_HNP_SUPPORT:
++			/* RH port supports HNP */
++			DWC_DEBUGPL(DBG_PCDV,
++				    "SET_FEATURE: USB_DEVICE_A_HNP_SUPPORT\n");
++			if (otg_cap_param == DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE) {
++				pcd->a_hnp_support = 1;
++				dwc_otg_pcd_update_otg(pcd, 0);
++			} else {
++				ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
++				return;
++			}
++			break;
++
++		case UF_DEVICE_A_ALT_HNP_SUPPORT:
++			/* other RH port does */
++			DWC_DEBUGPL(DBG_PCDV,
++				    "SET_FEATURE: USB_DEVICE_A_ALT_HNP_SUPPORT\n");
++			if (otg_cap_param == DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE) {
++				pcd->a_alt_hnp_support = 1;
++				dwc_otg_pcd_update_otg(pcd, 0);
++			} else {
++				ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
++				return;
++			}
++			break;
++
++		default:
++			ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
++			return;
++
++		}
++		do_setup_in_status_phase(pcd);
++		break;
++
++	case UT_INTERFACE:
++		do_gadget_setup(pcd, &ctrl);
++		break;
++
++	case UT_ENDPOINT:
++		if (UGETW(ctrl.wValue) == UF_ENDPOINT_HALT) {
++			ep = get_ep_by_addr(pcd, UGETW(ctrl.wIndex));
++			if (ep == 0) {
++				ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
++				return;
++			}
++			ep->stopped = 1;
++			dwc_otg_ep_set_stall(core_if, &ep->dwc_ep);
++		}
++		do_setup_in_status_phase(pcd);
++		break;
++	}
++}
++
++/**
++ * This function process the CLEAR_FEATURE Setup Commands.
++ */
++static inline void do_clear_feature(dwc_otg_pcd_t * pcd)
++{
++	usb_device_request_t ctrl = pcd->setup_pkt->req;
++	dwc_otg_pcd_ep_t *ep = 0;
++
++	DWC_DEBUGPL(DBG_PCD,
++		    "CLEAR_FEATURE:%02x.%02x v%04x i%04x l%04x\n",
++		    ctrl.bmRequestType, ctrl.bRequest,
++		    UGETW(ctrl.wValue), UGETW(ctrl.wIndex),
++		    UGETW(ctrl.wLength));
++
++	switch (UT_GET_RECIPIENT(ctrl.bmRequestType)) {
++	case UT_DEVICE:
++		switch (UGETW(ctrl.wValue)) {
++		case UF_DEVICE_REMOTE_WAKEUP:
++			pcd->remote_wakeup_enable = 0;
++			break;
++
++		case UF_TEST_MODE:
++			/** @todo Add CLEAR_FEATURE for TEST modes. */
++			break;
++
++		default:
++			ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
++			return;
++		}
++		do_setup_in_status_phase(pcd);
++		break;
++
++	case UT_ENDPOINT:
++		ep = get_ep_by_addr(pcd, UGETW(ctrl.wIndex));
++		if (ep == 0) {
++			ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
++			return;
++		}
++
++		pcd_clear_halt(pcd, ep);
++
++		break;
++	}
++}
++
++/**
++ * This function process the SET_ADDRESS Setup Commands.
++ */
++static inline void do_set_address(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_dev_if_t *dev_if = GET_CORE_IF(pcd)->dev_if;
++	usb_device_request_t ctrl = pcd->setup_pkt->req;
++
++	if (ctrl.bmRequestType == UT_DEVICE) {
++		dcfg_data_t dcfg = {.d32 = 0 };
++
++#ifdef DEBUG_EP0
++//                      DWC_DEBUGPL(DBG_PCDV, "SET_ADDRESS:%d\n", ctrl.wValue);
++#endif
++		dcfg.b.devaddr = UGETW(ctrl.wValue);
++		DWC_MODIFY_REG32(&dev_if->dev_global_regs->dcfg, 0, dcfg.d32);
++		do_setup_in_status_phase(pcd);
++	}
++}
++
++/**
++ *	This function processes SETUP commands. In Linux, the USB Command
++ *	processing is done in two places - the first being the PCD and the
++ *	second in the Gadget Driver (for example, the File-Backed Storage
++ *	Gadget Driver).
++ *
++ * <table>
++ * <tr><td>Command	</td><td>Driver </td><td>Description</td></tr>
++ *
++ * <tr><td>GET_STATUS </td><td>PCD </td><td>Command is processed as
++ * defined in chapter 9 of the USB 2.0 Specification chapter 9
++ * </td></tr>
++ *
++ * <tr><td>CLEAR_FEATURE </td><td>PCD </td><td>The Device and Endpoint
++ * requests are the ENDPOINT_HALT feature is procesed, all others the
++ * interface requests are ignored.</td></tr>
++ *
++ * <tr><td>SET_FEATURE </td><td>PCD </td><td>The Device and Endpoint
++ * requests are processed by the PCD.  Interface requests are passed
++ * to the Gadget Driver.</td></tr>
++ *
++ * <tr><td>SET_ADDRESS </td><td>PCD </td><td>Program the DCFG reg,
++ * with device address received </td></tr>
++ *
++ * <tr><td>GET_DESCRIPTOR </td><td>Gadget Driver </td><td>Return the
++ * requested descriptor</td></tr>
++ *
++ * <tr><td>SET_DESCRIPTOR </td><td>Gadget Driver </td><td>Optional -
++ * not implemented by any of the existing Gadget Drivers.</td></tr>
++ *
++ * <tr><td>SET_CONFIGURATION </td><td>Gadget Driver </td><td>Disable
++ * all EPs and enable EPs for new configuration.</td></tr>
++ *
++ * <tr><td>GET_CONFIGURATION </td><td>Gadget Driver </td><td>Return
++ * the current configuration</td></tr>
++ *
++ * <tr><td>SET_INTERFACE </td><td>Gadget Driver </td><td>Disable all
++ * EPs and enable EPs for new configuration.</td></tr>
++ *
++ * <tr><td>GET_INTERFACE </td><td>Gadget Driver </td><td>Return the
++ * current interface.</td></tr>
++ *
++ * <tr><td>SYNC_FRAME </td><td>PCD </td><td>Display debug
++ * message.</td></tr>
++ * </table>
++ *
++ * When the SETUP Phase Done interrupt occurs, the PCD SETUP commands are
++ * processed by pcd_setup. Calling the Function Driver's setup function from
++ * pcd_setup processes the gadget SETUP commands.
++ */
++static inline void pcd_setup(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	usb_device_request_t ctrl = pcd->setup_pkt->req;
++	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
++
++	deptsiz0_data_t doeptsize0 = {.d32 = 0 };
++
++#ifdef DWC_UTE_CFI
++	int retval = 0;
++	struct cfi_usb_ctrlrequest cfi_req;
++#endif
++
++	doeptsize0.d32 = DWC_READ_REG32(&dev_if->out_ep_regs[0]->doeptsiz);
++
++	/** In BDMA more then 1 setup packet is not supported till 3.00a */
++	if (core_if->dma_enable && core_if->dma_desc_enable == 0
++	    && (doeptsize0.b.supcnt < 2)
++	    && (core_if->snpsid < OTG_CORE_REV_2_94a)) {
++		DWC_ERROR
++		    ("\n\n-----------	 CANNOT handle > 1 setup packet in DMA mode\n\n");
++	}
++	if ((core_if->snpsid >= OTG_CORE_REV_3_00a)
++	    && (core_if->dma_enable == 1) && (core_if->dma_desc_enable == 0)) {
++		ctrl =
++		    (pcd->setup_pkt +
++		     (3 - doeptsize0.b.supcnt - 1 +
++		      ep0->dwc_ep.stp_rollover))->req;
++	}
++#ifdef DEBUG_EP0
++	DWC_DEBUGPL(DBG_PCD, "SETUP %02x.%02x v%04x i%04x l%04x\n",
++		    ctrl.bmRequestType, ctrl.bRequest,
++		    UGETW(ctrl.wValue), UGETW(ctrl.wIndex),
++		    UGETW(ctrl.wLength));
++#endif
++
++	/* Clean up the request queue */
++	dwc_otg_request_nuke(ep0);
++	ep0->stopped = 0;
++
++	if (ctrl.bmRequestType & UE_DIR_IN) {
++		ep0->dwc_ep.is_in = 1;
++		pcd->ep0state = EP0_IN_DATA_PHASE;
++	} else {
++		ep0->dwc_ep.is_in = 0;
++		pcd->ep0state = EP0_OUT_DATA_PHASE;
++	}
++
++	if (UGETW(ctrl.wLength) == 0) {
++		ep0->dwc_ep.is_in = 1;
++		pcd->ep0state = EP0_IN_STATUS_PHASE;
++	}
++
++	if (UT_GET_TYPE(ctrl.bmRequestType) != UT_STANDARD) {
++
++#ifdef DWC_UTE_CFI
++		DWC_MEMCPY(&cfi_req, &ctrl, sizeof(usb_device_request_t));
++
++		//printk(KERN_ALERT "CFI: req_type=0x%02x; req=0x%02x\n",
++				ctrl.bRequestType, ctrl.bRequest);
++		if (UT_GET_TYPE(cfi_req.bRequestType) == UT_VENDOR) {
++			if (cfi_req.bRequest > 0xB0 && cfi_req.bRequest < 0xBF) {
++				retval = cfi_setup(pcd, &cfi_req);
++				if (retval < 0) {
++					ep0_do_stall(pcd, retval);
++					pcd->ep0_pending = 0;
++					return;
++				}
++
++				/* if need gadget setup then call it and check the retval */
++				if (pcd->cfi->need_gadget_att) {
++					retval =
++					    cfi_gadget_setup(pcd,
++							     &pcd->
++							     cfi->ctrl_req);
++					if (retval < 0) {
++						pcd->ep0_pending = 0;
++						return;
++					}
++				}
++
++				if (pcd->cfi->need_status_in_complete) {
++					do_setup_in_status_phase(pcd);
++				}
++				return;
++			}
++		}
++#endif
++
++		/* handle non-standard (class/vendor) requests in the gadget driver */
++		do_gadget_setup(pcd, &ctrl);
++		return;
++	}
++
++	/** @todo NGS: Handle bad setup packet? */
++
++///////////////////////////////////////////
++//// --- Standard Request handling --- ////
++
++	switch (ctrl.bRequest) {
++	case UR_GET_STATUS:
++		do_get_status(pcd);
++		break;
++
++	case UR_CLEAR_FEATURE:
++		do_clear_feature(pcd);
++		break;
++
++	case UR_SET_FEATURE:
++		do_set_feature(pcd);
++		break;
++
++	case UR_SET_ADDRESS:
++		do_set_address(pcd);
++		break;
++
++	case UR_SET_INTERFACE:
++	case UR_SET_CONFIG:
++//              _pcd->request_config = 1;       /* Configuration changed */
++		do_gadget_setup(pcd, &ctrl);
++		break;
++
++	case UR_SYNCH_FRAME:
++		do_gadget_setup(pcd, &ctrl);
++		break;
++
++	default:
++		/* Call the Gadget Driver's setup functions */
++		do_gadget_setup(pcd, &ctrl);
++		break;
++	}
++}
++
++/**
++ * This function completes the ep0 control transfer.
++ */
++static int32_t ep0_complete_request(dwc_otg_pcd_ep_t * ep)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(ep->pcd);
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	dwc_otg_dev_in_ep_regs_t *in_ep_regs =
++	    dev_if->in_ep_regs[ep->dwc_ep.num];
++#ifdef DEBUG_EP0
++	dwc_otg_dev_out_ep_regs_t *out_ep_regs =
++	    dev_if->out_ep_regs[ep->dwc_ep.num];
++#endif
++	deptsiz0_data_t deptsiz;
++	dev_dma_desc_sts_t desc_sts;
++	dwc_otg_pcd_request_t *req;
++	int is_last = 0;
++	dwc_otg_pcd_t *pcd = ep->pcd;
++
++#ifdef DWC_UTE_CFI
++	struct cfi_usb_ctrlrequest *ctrlreq;
++	int retval = -DWC_E_NOT_SUPPORTED;
++#endif
++
++        desc_sts.b.bytes = 0;
++
++	if (pcd->ep0_pending && DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++		if (ep->dwc_ep.is_in) {
++#ifdef DEBUG_EP0
++			DWC_DEBUGPL(DBG_PCDV, "Do setup OUT status phase\n");
++#endif
++			do_setup_out_status_phase(pcd);
++		} else {
++#ifdef DEBUG_EP0
++			DWC_DEBUGPL(DBG_PCDV, "Do setup IN status phase\n");
++#endif
++
++#ifdef DWC_UTE_CFI
++			ctrlreq = &pcd->cfi->ctrl_req;
++
++			if (UT_GET_TYPE(ctrlreq->bRequestType) == UT_VENDOR) {
++				if (ctrlreq->bRequest > 0xB0
++				    && ctrlreq->bRequest < 0xBF) {
++
++					/* Return if the PCD failed to handle the request */
++					if ((retval =
++					     pcd->cfi->ops.
++					     ctrl_write_complete(pcd->cfi,
++								 pcd)) < 0) {
++						CFI_INFO
++						    ("ERROR setting a new value in the PCD(%d)\n",
++						     retval);
++						ep0_do_stall(pcd, retval);
++						pcd->ep0_pending = 0;
++						return 0;
++					}
++
++					/* If the gadget needs to be notified on the request */
++					if (pcd->cfi->need_gadget_att == 1) {
++						//retval = do_gadget_setup(pcd, &pcd->cfi->ctrl_req);
++						retval =
++						    cfi_gadget_setup(pcd,
++								     &pcd->cfi->
++								     ctrl_req);
++
++						/* Return from the function if the gadget failed to process
++						 * the request properly - this should never happen !!!
++						 */
++						if (retval < 0) {
++							CFI_INFO
++							    ("ERROR setting a new value in the gadget(%d)\n",
++							     retval);
++							pcd->ep0_pending = 0;
++							return 0;
++						}
++					}
++
++					CFI_INFO("%s: RETVAL=%d\n", __func__,
++						 retval);
++					/* If we hit here then the PCD and the gadget has properly
++					 * handled the request - so send the ZLP IN to the host.
++					 */
++					/* @todo: MAS - decide whether we need to start the setup
++					 * stage based on the need_setup value of the cfi object
++					 */
++					do_setup_in_status_phase(pcd);
++					pcd->ep0_pending = 0;
++					return 1;
++				}
++			}
++#endif
++
++			do_setup_in_status_phase(pcd);
++		}
++		pcd->ep0_pending = 0;
++		return 1;
++	}
++
++	if (DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++		return 0;
++	}
++	req = DWC_CIRCLEQ_FIRST(&ep->queue);
++
++	if (pcd->ep0state == EP0_OUT_STATUS_PHASE
++	    || pcd->ep0state == EP0_IN_STATUS_PHASE) {
++		is_last = 1;
++	} else if (ep->dwc_ep.is_in) {
++		deptsiz.d32 = DWC_READ_REG32(&in_ep_regs->dieptsiz);
++		if (core_if->dma_desc_enable != 0)
++			desc_sts = dev_if->in_desc_addr->status;
++#ifdef DEBUG_EP0
++		DWC_DEBUGPL(DBG_PCDV, "%d len=%d  xfersize=%d pktcnt=%d\n",
++			    ep->dwc_ep.num, ep->dwc_ep.xfer_len,
++			    deptsiz.b.xfersize, deptsiz.b.pktcnt);
++#endif
++
++		if (((core_if->dma_desc_enable == 0)
++		     && (deptsiz.b.xfersize == 0))
++		    || ((core_if->dma_desc_enable != 0)
++			&& (desc_sts.b.bytes == 0))) {
++			req->actual = ep->dwc_ep.xfer_count;
++			/* Is a Zero Len Packet needed? */
++			if (req->sent_zlp) {
++#ifdef DEBUG_EP0
++				DWC_DEBUGPL(DBG_PCD, "Setup Rx ZLP\n");
++#endif
++				req->sent_zlp = 0;
++			}
++			do_setup_out_status_phase(pcd);
++		}
++	} else {
++		/* ep0-OUT */
++#ifdef DEBUG_EP0
++		deptsiz.d32 = DWC_READ_REG32(&out_ep_regs->doeptsiz);
++		DWC_DEBUGPL(DBG_PCDV, "%d len=%d xsize=%d pktcnt=%d\n",
++			    ep->dwc_ep.num, ep->dwc_ep.xfer_len,
++			    deptsiz.b.xfersize, deptsiz.b.pktcnt);
++#endif
++		req->actual = ep->dwc_ep.xfer_count;
++
++		/* Is a Zero Len Packet needed? */
++		if (req->sent_zlp) {
++#ifdef DEBUG_EP0
++			DWC_DEBUGPL(DBG_PCDV, "Setup Tx ZLP\n");
++#endif
++			req->sent_zlp = 0;
++		}
++		/* For older cores do setup in status phase in Slave/BDMA modes,
++		 * starting from 3.00 do that only in slave, and for DMA modes
++		 * just re-enable ep 0 OUT here*/
++		if (core_if->dma_enable == 0
++		    || (core_if->dma_desc_enable == 0
++			&& core_if->snpsid <= OTG_CORE_REV_2_94a)) {
++			do_setup_in_status_phase(pcd);
++		} else if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
++			DWC_DEBUGPL(DBG_PCDV,
++				    "Enable out ep before in status phase\n");
++			ep0_out_start(core_if, pcd);
++		}
++	}
++
++	/* Complete the request */
++	if (is_last) {
++		dwc_otg_request_done(ep, req, 0);
++		ep->dwc_ep.start_xfer_buff = 0;
++		ep->dwc_ep.xfer_buff = 0;
++		ep->dwc_ep.xfer_len = 0;
++		return 1;
++	}
++	return 0;
++}
++
++#ifdef DWC_UTE_CFI
++/**
++ * This function calculates traverses all the CFI DMA descriptors and
++ * and accumulates the bytes that are left to be transfered.
++ *
++ * @return The total bytes left to transfered, or a negative value as failure
++ */
++static inline int cfi_calc_desc_residue(dwc_otg_pcd_ep_t * ep)
++{
++	int32_t ret = 0;
++	int i;
++	struct dwc_otg_dma_desc *ddesc = NULL;
++	struct cfi_ep *cfiep;
++
++	/* See if the pcd_ep has its respective cfi_ep mapped */
++	cfiep = get_cfi_ep_by_pcd_ep(ep->pcd->cfi, ep);
++	if (!cfiep) {
++		CFI_INFO("%s: Failed to find ep\n", __func__);
++		return -1;
++	}
++
++	ddesc = ep->dwc_ep.descs;
++
++	for (i = 0; (i < cfiep->desc_count) && (i < MAX_DMA_DESCS_PER_EP); i++) {
++
++#if defined(PRINT_CFI_DMA_DESCS)
++		print_desc(ddesc, ep->ep.name, i);
++#endif
++		ret += ddesc->status.b.bytes;
++		ddesc++;
++	}
++
++	if (ret)
++		CFI_INFO("!!!!!!!!!! WARNING (%s) - residue=%d\n", __func__,
++			 ret);
++
++	return ret;
++}
++#endif
++
++/**
++ * This function completes the request for the EP. If there are
++ * additional requests for the EP in the queue they will be started.
++ */
++static void complete_ep(dwc_otg_pcd_ep_t * ep)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(ep->pcd);
++	struct device *dev = dwc_otg_pcd_to_dev(ep->pcd);
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	dwc_otg_dev_in_ep_regs_t *in_ep_regs =
++	    dev_if->in_ep_regs[ep->dwc_ep.num];
++	deptsiz_data_t deptsiz;
++	dev_dma_desc_sts_t desc_sts;
++	dwc_otg_pcd_request_t *req = 0;
++	dwc_otg_dev_dma_desc_t *dma_desc;
++	uint32_t byte_count = 0;
++	int is_last = 0;
++	int i;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s() %d-%s\n", __func__, ep->dwc_ep.num,
++		    (ep->dwc_ep.is_in ? "IN" : "OUT"));
++
++	/* Get any pending requests */
++	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++		req = DWC_CIRCLEQ_FIRST(&ep->queue);
++		if (!req) {
++			DWC_PRINTF("complete_ep 0x%p, req = NULL!\n", ep);
++			return;
++		}
++	} else {
++		DWC_PRINTF("complete_ep 0x%p, ep->queue empty!\n", ep);
++		return;
++	}
++
++	DWC_DEBUGPL(DBG_PCD, "Requests %d\n", ep->pcd->request_pending);
++
++	if (ep->dwc_ep.is_in) {
++		deptsiz.d32 = DWC_READ_REG32(&in_ep_regs->dieptsiz);
++
++		if (core_if->dma_enable) {
++			if (core_if->dma_desc_enable == 0) {
++				if (deptsiz.b.xfersize == 0
++				    && deptsiz.b.pktcnt == 0) {
++					byte_count =
++					    ep->dwc_ep.xfer_len -
++					    ep->dwc_ep.xfer_count;
++
++					ep->dwc_ep.xfer_buff += byte_count;
++					ep->dwc_ep.dma_addr += byte_count;
++					ep->dwc_ep.xfer_count += byte_count;
++
++					DWC_DEBUGPL(DBG_PCDV,
++						    "%d-%s len=%d  xfersize=%d pktcnt=%d\n",
++						    ep->dwc_ep.num,
++						    (ep->dwc_ep.
++						     is_in ? "IN" : "OUT"),
++						    ep->dwc_ep.xfer_len,
++						    deptsiz.b.xfersize,
++						    deptsiz.b.pktcnt);
++
++					if (ep->dwc_ep.xfer_len <
++					    ep->dwc_ep.total_len) {
++						dwc_otg_ep_start_transfer
++						    (core_if, &ep->dwc_ep);
++					} else if (ep->dwc_ep.sent_zlp) {
++						/*
++						 * This fragment of code should initiate 0
++						 * length transfer in case if it is queued
++						 * a transfer with size divisible to EPs max
++						 * packet size and with usb_request zero field
++						 * is set, which means that after data is transfered,
++						 * it is also should be transfered
++						 * a 0 length packet at the end. For Slave and
++						 * Buffer DMA modes in this case SW has
++						 * to initiate 2 transfers one with transfer size,
++						 * and the second with 0 size. For Descriptor
++						 * DMA mode SW is able to initiate a transfer,
++						 * which will handle all the packets including
++						 * the last  0 length.
++						 */
++						ep->dwc_ep.sent_zlp = 0;
++						dwc_otg_ep_start_zl_transfer
++						    (core_if, &ep->dwc_ep);
++					} else {
++						is_last = 1;
++					}
++				} else {
++					if (ep->dwc_ep.type ==
++					    DWC_OTG_EP_TYPE_ISOC) {
++						req->actual = 0;
++						dwc_otg_request_done(ep, req, 0);
++
++						ep->dwc_ep.start_xfer_buff = 0;
++						ep->dwc_ep.xfer_buff = 0;
++						ep->dwc_ep.xfer_len = 0;
++
++						/* If there is a request in the queue start it. */
++						start_next_request(ep);
++					} else
++						DWC_WARN
++						("Incomplete transfer (%d - %s [siz=%d pkt=%d])\n",
++						ep->dwc_ep.num,
++						(ep->dwc_ep.is_in ? "IN" : "OUT"),
++						deptsiz.b.xfersize,
++						deptsiz.b.pktcnt);
++				}
++			} else {
++				dma_desc = ep->dwc_ep.desc_addr;
++				byte_count = 0;
++				ep->dwc_ep.sent_zlp = 0;
++
++#ifdef DWC_UTE_CFI
++				CFI_INFO("%s: BUFFER_MODE=%d\n", __func__,
++					 ep->dwc_ep.buff_mode);
++				if (ep->dwc_ep.buff_mode != BM_STANDARD) {
++					int residue;
++
++					residue = cfi_calc_desc_residue(ep);
++					if (residue < 0)
++						return;
++
++					byte_count = residue;
++				} else {
++#endif
++					for (i = 0; i < ep->dwc_ep.desc_cnt;
++					     ++i) {
++					desc_sts = dma_desc->status;
++					byte_count += desc_sts.b.bytes;
++					dma_desc++;
++				}
++#ifdef DWC_UTE_CFI
++				}
++#endif
++				if (byte_count == 0) {
++					ep->dwc_ep.xfer_count =
++					    ep->dwc_ep.total_len;
++					is_last = 1;
++				} else {
++					DWC_WARN("Incomplete transfer\n");
++				}
++			}
++		} else {
++			if (deptsiz.b.xfersize == 0 && deptsiz.b.pktcnt == 0) {
++				DWC_DEBUGPL(DBG_PCDV,
++					    "%d-%s len=%d  xfersize=%d pktcnt=%d\n",
++					    ep->dwc_ep.num,
++					    ep->dwc_ep.is_in ? "IN" : "OUT",
++					    ep->dwc_ep.xfer_len,
++					    deptsiz.b.xfersize,
++					    deptsiz.b.pktcnt);
++
++				/*      Check if the whole transfer was completed,
++				 *      if no, setup transfer for next portion of data
++				 */
++				if (ep->dwc_ep.xfer_len < ep->dwc_ep.total_len) {
++					dwc_otg_ep_start_transfer(core_if,
++								  &ep->dwc_ep);
++				} else if (ep->dwc_ep.sent_zlp) {
++					/*
++					 * This fragment of code should initiate 0
++					 * length trasfer in case if it is queued
++					 * a trasfer with size divisible to EPs max
++					 * packet size and with usb_request zero field
++					 * is set, which means that after data is transfered,
++					 * it is also should be transfered
++					 * a 0 length packet at the end. For Slave and
++					 * Buffer DMA modes in this case SW has
++					 * to initiate 2 transfers one with transfer size,
++					 * and the second with 0 size. For Desriptor
++					 * DMA mode SW is able to initiate a transfer,
++					 * which will handle all the packets including
++					 * the last  0 legth.
++					 */
++					ep->dwc_ep.sent_zlp = 0;
++					dwc_otg_ep_start_zl_transfer(core_if,
++								     &ep->dwc_ep);
++				} else {
++					is_last = 1;
++				}
++			} else {
++				DWC_WARN
++				    ("Incomplete transfer (%d-%s [siz=%d pkt=%d])\n",
++				     ep->dwc_ep.num,
++				     (ep->dwc_ep.is_in ? "IN" : "OUT"),
++				     deptsiz.b.xfersize, deptsiz.b.pktcnt);
++			}
++		}
++	} else {
++		dwc_otg_dev_out_ep_regs_t *out_ep_regs =
++		    dev_if->out_ep_regs[ep->dwc_ep.num];
++		desc_sts.d32 = 0;
++		if (core_if->dma_enable) {
++			if (core_if->dma_desc_enable) {
++				dma_desc = ep->dwc_ep.desc_addr;
++				byte_count = 0;
++				ep->dwc_ep.sent_zlp = 0;
++
++#ifdef DWC_UTE_CFI
++				CFI_INFO("%s: BUFFER_MODE=%d\n", __func__,
++					 ep->dwc_ep.buff_mode);
++				if (ep->dwc_ep.buff_mode != BM_STANDARD) {
++					int residue;
++					residue = cfi_calc_desc_residue(ep);
++					if (residue < 0)
++						return;
++					byte_count = residue;
++				} else {
++#endif
++
++					for (i = 0; i < ep->dwc_ep.desc_cnt;
++					     ++i) {
++						desc_sts = dma_desc->status;
++						byte_count += desc_sts.b.bytes;
++						dma_desc++;
++					}
++
++#ifdef DWC_UTE_CFI
++				}
++#endif
++				/* Checking for interrupt Out transfers with not
++				 * dword aligned mps sizes
++				 */
++				if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_INTR &&
++							(ep->dwc_ep.maxpacket%4)) {
++					ep->dwc_ep.xfer_count =
++					    ep->dwc_ep.total_len - byte_count;
++					if ((ep->dwc_ep.xfer_len %
++					     ep->dwc_ep.maxpacket)
++					    && (ep->dwc_ep.xfer_len /
++						ep->dwc_ep.maxpacket <
++						MAX_DMA_DESC_CNT))
++						ep->dwc_ep.xfer_len -=
++						    (ep->dwc_ep.desc_cnt -
++						     1) * ep->dwc_ep.maxpacket +
++						    ep->dwc_ep.xfer_len %
++						    ep->dwc_ep.maxpacket;
++					else
++						ep->dwc_ep.xfer_len -=
++						    ep->dwc_ep.desc_cnt *
++						    ep->dwc_ep.maxpacket;
++					if (ep->dwc_ep.xfer_len > 0) {
++						dwc_otg_ep_start_transfer
++						    (core_if, &ep->dwc_ep);
++					} else {
++						is_last = 1;
++					}
++				} else {
++					ep->dwc_ep.xfer_count =
++					    ep->dwc_ep.total_len - byte_count +
++					    ((4 -
++					      (ep->dwc_ep.
++					       total_len & 0x3)) & 0x3);
++					is_last = 1;
++				}
++			} else {
++				deptsiz.d32 = 0;
++				deptsiz.d32 =
++				    DWC_READ_REG32(&out_ep_regs->doeptsiz);
++
++				byte_count = (ep->dwc_ep.xfer_len -
++					      ep->dwc_ep.xfer_count -
++					      deptsiz.b.xfersize);
++				ep->dwc_ep.xfer_buff += byte_count;
++				ep->dwc_ep.dma_addr += byte_count;
++				ep->dwc_ep.xfer_count += byte_count;
++
++				/*      Check if the whole transfer was completed,
++				 *      if no, setup transfer for next portion of data
++				 */
++				if (ep->dwc_ep.xfer_len < ep->dwc_ep.total_len) {
++					dwc_otg_ep_start_transfer(core_if,
++								  &ep->dwc_ep);
++				} else if (ep->dwc_ep.sent_zlp) {
++					/*
++					 * This fragment of code should initiate 0
++					 * length trasfer in case if it is queued
++					 * a trasfer with size divisible to EPs max
++					 * packet size and with usb_request zero field
++					 * is set, which means that after data is transfered,
++					 * it is also should be transfered
++					 * a 0 length packet at the end. For Slave and
++					 * Buffer DMA modes in this case SW has
++					 * to initiate 2 transfers one with transfer size,
++					 * and the second with 0 size. For Desriptor
++					 * DMA mode SW is able to initiate a transfer,
++					 * which will handle all the packets including
++					 * the last  0 legth.
++					 */
++					ep->dwc_ep.sent_zlp = 0;
++					dwc_otg_ep_start_zl_transfer(core_if,
++								     &ep->dwc_ep);
++				} else {
++					is_last = 1;
++				}
++			}
++		} else {
++			/*      Check if the whole transfer was completed,
++			 *      if no, setup transfer for next portion of data
++			 */
++			if (ep->dwc_ep.xfer_len < ep->dwc_ep.total_len) {
++				dwc_otg_ep_start_transfer(core_if, &ep->dwc_ep);
++			} else if (ep->dwc_ep.sent_zlp) {
++				/*
++				 * This fragment of code should initiate 0
++				 * length transfer in case if it is queued
++				 * a transfer with size divisible to EPs max
++				 * packet size and with usb_request zero field
++				 * is set, which means that after data is transfered,
++				 * it is also should be transfered
++				 * a 0 length packet at the end. For Slave and
++				 * Buffer DMA modes in this case SW has
++				 * to initiate 2 transfers one with transfer size,
++				 * and the second with 0 size. For Descriptor
++				 * DMA mode SW is able to initiate a transfer,
++				 * which will handle all the packets including
++				 * the last  0 length.
++				 */
++				ep->dwc_ep.sent_zlp = 0;
++				dwc_otg_ep_start_zl_transfer(core_if,
++							     &ep->dwc_ep);
++			} else {
++				is_last = 1;
++			}
++		}
++
++		DWC_DEBUGPL(DBG_PCDV,
++			    "addr %p,	 %d-%s len=%d cnt=%d xsize=%d pktcnt=%d\n",
++			    &out_ep_regs->doeptsiz, ep->dwc_ep.num,
++			    ep->dwc_ep.is_in ? "IN" : "OUT",
++			    ep->dwc_ep.xfer_len, ep->dwc_ep.xfer_count,
++			    deptsiz.b.xfersize, deptsiz.b.pktcnt);
++	}
++
++	/* Complete the request */
++	if (is_last) {
++#ifdef DWC_UTE_CFI
++		if (ep->dwc_ep.buff_mode != BM_STANDARD) {
++			req->actual = ep->dwc_ep.cfi_req_len - byte_count;
++		} else {
++#endif
++			req->actual = ep->dwc_ep.xfer_count;
++#ifdef DWC_UTE_CFI
++		}
++#endif
++		if (req->dw_align_buf) {
++			if (!ep->dwc_ep.is_in) {
++				dwc_memcpy(req->buf, req->dw_align_buf, req->length);
++			}
++			DWC_DMA_FREE(dev, req->length, req->dw_align_buf,
++				     req->dw_align_buf_dma);
++		}
++
++		dwc_otg_request_done(ep, req, 0);
++
++		ep->dwc_ep.start_xfer_buff = 0;
++		ep->dwc_ep.xfer_buff = 0;
++		ep->dwc_ep.xfer_len = 0;
++
++		/* If there is a request in the queue start it. */
++		start_next_request(ep);
++	}
++}
++
++#ifdef DWC_EN_ISOC
++
++/**
++ * This function BNA interrupt for Isochronous EPs
++ *
++ */
++static void dwc_otg_pcd_handle_iso_bna(dwc_otg_pcd_ep_t * ep)
++{
++	dwc_ep_t *dwc_ep = &ep->dwc_ep;
++	volatile uint32_t *addr;
++	depctl_data_t depctl = {.d32 = 0 };
++	dwc_otg_pcd_t *pcd = ep->pcd;
++	dwc_otg_dev_dma_desc_t *dma_desc;
++	int i;
++
++	dma_desc =
++	    dwc_ep->iso_desc_addr + dwc_ep->desc_cnt * (dwc_ep->proc_buf_num);
++
++	if (dwc_ep->is_in) {
++		dev_dma_desc_sts_t sts = {.d32 = 0 };
++		for (i = 0; i < dwc_ep->desc_cnt; ++i, ++dma_desc) {
++			sts.d32 = dma_desc->status.d32;
++			sts.b_iso_in.bs = BS_HOST_READY;
++			dma_desc->status.d32 = sts.d32;
++		}
++	} else {
++		dev_dma_desc_sts_t sts = {.d32 = 0 };
++		for (i = 0; i < dwc_ep->desc_cnt; ++i, ++dma_desc) {
++			sts.d32 = dma_desc->status.d32;
++			sts.b_iso_out.bs = BS_HOST_READY;
++			dma_desc->status.d32 = sts.d32;
++		}
++	}
++
++	if (dwc_ep->is_in == 0) {
++		addr =
++		    &GET_CORE_IF(pcd)->dev_if->out_ep_regs[dwc_ep->
++							   num]->doepctl;
++	} else {
++		addr =
++		    &GET_CORE_IF(pcd)->dev_if->in_ep_regs[dwc_ep->num]->diepctl;
++	}
++	depctl.b.epena = 1;
++	DWC_MODIFY_REG32(addr, depctl.d32, depctl.d32);
++}
++
++/**
++ * This function sets latest iso packet information(non-PTI mode)
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to start the transfer on.
++ *
++ */
++void set_current_pkt_info(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	deptsiz_data_t deptsiz = {.d32 = 0 };
++	dma_addr_t dma_addr;
++	uint32_t offset;
++
++	if (ep->proc_buf_num)
++		dma_addr = ep->dma_addr1;
++	else
++		dma_addr = ep->dma_addr0;
++
++	if (ep->is_in) {
++		deptsiz.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->
++				   in_ep_regs[ep->num]->dieptsiz);
++		offset = ep->data_per_frame;
++	} else {
++		deptsiz.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->
++				   out_ep_regs[ep->num]->doeptsiz);
++		offset =
++		    ep->data_per_frame +
++		    (0x4 & (0x4 - (ep->data_per_frame & 0x3)));
++	}
++
++	if (!deptsiz.b.xfersize) {
++		ep->pkt_info[ep->cur_pkt].length = ep->data_per_frame;
++		ep->pkt_info[ep->cur_pkt].offset =
++		    ep->cur_pkt_dma_addr - dma_addr;
++		ep->pkt_info[ep->cur_pkt].status = 0;
++	} else {
++		ep->pkt_info[ep->cur_pkt].length = ep->data_per_frame;
++		ep->pkt_info[ep->cur_pkt].offset =
++		    ep->cur_pkt_dma_addr - dma_addr;
++		ep->pkt_info[ep->cur_pkt].status = -DWC_E_NO_DATA;
++	}
++	ep->cur_pkt_addr += offset;
++	ep->cur_pkt_dma_addr += offset;
++	ep->cur_pkt++;
++}
++
++/**
++ * This function sets latest iso packet information(DDMA mode)
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param dwc_ep The EP to start the transfer on.
++ *
++ */
++static void set_ddma_iso_pkts_info(dwc_otg_core_if_t * core_if,
++				   dwc_ep_t * dwc_ep)
++{
++	dwc_otg_dev_dma_desc_t *dma_desc;
++	dev_dma_desc_sts_t sts = {.d32 = 0 };
++	iso_pkt_info_t *iso_packet;
++	uint32_t data_per_desc;
++	uint32_t offset;
++	int i, j;
++
++	iso_packet = dwc_ep->pkt_info;
++
++	/** Reinit closed DMA Descriptors*/
++	/** ISO OUT EP */
++	if (dwc_ep->is_in == 0) {
++		dma_desc =
++		    dwc_ep->iso_desc_addr +
++		    dwc_ep->desc_cnt * dwc_ep->proc_buf_num;
++		offset = 0;
++
++		for (i = 0; i < dwc_ep->desc_cnt - dwc_ep->pkt_per_frm;
++		     i += dwc_ep->pkt_per_frm) {
++			for (j = 0; j < dwc_ep->pkt_per_frm; ++j) {
++				data_per_desc =
++				    ((j + 1) * dwc_ep->maxpacket >
++				     dwc_ep->
++				     data_per_frame) ? dwc_ep->data_per_frame -
++				    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
++				data_per_desc +=
++				    (data_per_desc % 4) ? (4 -
++							   data_per_desc %
++							   4) : 0;
++
++				sts.d32 = dma_desc->status.d32;
++
++				/* Write status in iso_packet_decsriptor  */
++				iso_packet->status =
++				    sts.b_iso_out.rxsts +
++				    (sts.b_iso_out.bs ^ BS_DMA_DONE);
++				if (iso_packet->status) {
++					iso_packet->status = -DWC_E_NO_DATA;
++				}
++
++				/* Received data length */
++				if (!sts.b_iso_out.rxbytes) {
++					iso_packet->length =
++					    data_per_desc -
++					    sts.b_iso_out.rxbytes;
++				} else {
++					iso_packet->length =
++					    data_per_desc -
++					    sts.b_iso_out.rxbytes + (4 -
++								     dwc_ep->data_per_frame
++								     % 4);
++				}
++
++				iso_packet->offset = offset;
++
++				offset += data_per_desc;
++				dma_desc++;
++				iso_packet++;
++			}
++		}
++
++		for (j = 0; j < dwc_ep->pkt_per_frm - 1; ++j) {
++			data_per_desc =
++			    ((j + 1) * dwc_ep->maxpacket >
++			     dwc_ep->data_per_frame) ? dwc_ep->data_per_frame -
++			    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
++			data_per_desc +=
++			    (data_per_desc % 4) ? (4 - data_per_desc % 4) : 0;
++
++			sts.d32 = dma_desc->status.d32;
++
++			/* Write status in iso_packet_decsriptor  */
++			iso_packet->status =
++			    sts.b_iso_out.rxsts +
++			    (sts.b_iso_out.bs ^ BS_DMA_DONE);
++			if (iso_packet->status) {
++				iso_packet->status = -DWC_E_NO_DATA;
++			}
++
++			/* Received data length */
++			iso_packet->length =
++			    dwc_ep->data_per_frame - sts.b_iso_out.rxbytes;
++
++			iso_packet->offset = offset;
++
++			offset += data_per_desc;
++			iso_packet++;
++			dma_desc++;
++		}
++
++		sts.d32 = dma_desc->status.d32;
++
++		/* Write status in iso_packet_decsriptor  */
++		iso_packet->status =
++		    sts.b_iso_out.rxsts + (sts.b_iso_out.bs ^ BS_DMA_DONE);
++		if (iso_packet->status) {
++			iso_packet->status = -DWC_E_NO_DATA;
++		}
++		/* Received data length */
++		if (!sts.b_iso_out.rxbytes) {
++			iso_packet->length =
++			    dwc_ep->data_per_frame - sts.b_iso_out.rxbytes;
++		} else {
++			iso_packet->length =
++			    dwc_ep->data_per_frame - sts.b_iso_out.rxbytes +
++			    (4 - dwc_ep->data_per_frame % 4);
++		}
++
++		iso_packet->offset = offset;
++	} else {
++/** ISO IN EP */
++
++		dma_desc =
++		    dwc_ep->iso_desc_addr +
++		    dwc_ep->desc_cnt * dwc_ep->proc_buf_num;
++
++		for (i = 0; i < dwc_ep->desc_cnt - 1; i++) {
++			sts.d32 = dma_desc->status.d32;
++
++			/* Write status in iso packet descriptor */
++			iso_packet->status =
++			    sts.b_iso_in.txsts +
++			    (sts.b_iso_in.bs ^ BS_DMA_DONE);
++			if (iso_packet->status != 0) {
++				iso_packet->status = -DWC_E_NO_DATA;
++
++			}
++			/* Bytes has been transfered */
++			iso_packet->length =
++			    dwc_ep->data_per_frame - sts.b_iso_in.txbytes;
++
++			dma_desc++;
++			iso_packet++;
++		}
++
++		sts.d32 = dma_desc->status.d32;
++		while (sts.b_iso_in.bs == BS_DMA_BUSY) {
++			sts.d32 = dma_desc->status.d32;
++		}
++
++		/* Write status in iso packet descriptor ??? do be done with ERROR codes */
++		iso_packet->status =
++		    sts.b_iso_in.txsts + (sts.b_iso_in.bs ^ BS_DMA_DONE);
++		if (iso_packet->status != 0) {
++			iso_packet->status = -DWC_E_NO_DATA;
++		}
++
++		/* Bytes has been transfered */
++		iso_packet->length =
++		    dwc_ep->data_per_frame - sts.b_iso_in.txbytes;
++	}
++}
++
++/**
++ * This function reinitialize DMA Descriptors for Isochronous transfer
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param dwc_ep The EP to start the transfer on.
++ *
++ */
++static void reinit_ddma_iso_xfer(dwc_otg_core_if_t * core_if, dwc_ep_t * dwc_ep)
++{
++	int i, j;
++	dwc_otg_dev_dma_desc_t *dma_desc;
++	dma_addr_t dma_ad;
++	volatile uint32_t *addr;
++	dev_dma_desc_sts_t sts = {.d32 = 0 };
++	uint32_t data_per_desc;
++
++	if (dwc_ep->is_in == 0) {
++		addr = &core_if->dev_if->out_ep_regs[dwc_ep->num]->doepctl;
++	} else {
++		addr = &core_if->dev_if->in_ep_regs[dwc_ep->num]->diepctl;
++	}
++
++	if (dwc_ep->proc_buf_num == 0) {
++		/** Buffer 0 descriptors setup */
++		dma_ad = dwc_ep->dma_addr0;
++	} else {
++		/** Buffer 1 descriptors setup */
++		dma_ad = dwc_ep->dma_addr1;
++	}
++
++	/** Reinit closed DMA Descriptors*/
++	/** ISO OUT EP */
++	if (dwc_ep->is_in == 0) {
++		dma_desc =
++		    dwc_ep->iso_desc_addr +
++		    dwc_ep->desc_cnt * dwc_ep->proc_buf_num;
++
++		sts.b_iso_out.bs = BS_HOST_READY;
++		sts.b_iso_out.rxsts = 0;
++		sts.b_iso_out.l = 0;
++		sts.b_iso_out.sp = 0;
++		sts.b_iso_out.ioc = 0;
++		sts.b_iso_out.pid = 0;
++		sts.b_iso_out.framenum = 0;
++
++		for (i = 0; i < dwc_ep->desc_cnt - dwc_ep->pkt_per_frm;
++		     i += dwc_ep->pkt_per_frm) {
++			for (j = 0; j < dwc_ep->pkt_per_frm; ++j) {
++				data_per_desc =
++				    ((j + 1) * dwc_ep->maxpacket >
++				     dwc_ep->
++				     data_per_frame) ? dwc_ep->data_per_frame -
++				    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
++				data_per_desc +=
++				    (data_per_desc % 4) ? (4 -
++							   data_per_desc %
++							   4) : 0;
++				sts.b_iso_out.rxbytes = data_per_desc;
++				dma_desc->buf = dma_ad;
++				dma_desc->status.d32 = sts.d32;
++
++				dma_ad += data_per_desc;
++				dma_desc++;
++			}
++		}
++
++		for (j = 0; j < dwc_ep->pkt_per_frm - 1; ++j) {
++
++			data_per_desc =
++			    ((j + 1) * dwc_ep->maxpacket >
++			     dwc_ep->data_per_frame) ? dwc_ep->data_per_frame -
++			    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
++			data_per_desc +=
++			    (data_per_desc % 4) ? (4 - data_per_desc % 4) : 0;
++			sts.b_iso_out.rxbytes = data_per_desc;
++
++			dma_desc->buf = dma_ad;
++			dma_desc->status.d32 = sts.d32;
++
++			dma_desc++;
++			dma_ad += data_per_desc;
++		}
++
++		sts.b_iso_out.ioc = 1;
++		sts.b_iso_out.l = dwc_ep->proc_buf_num;
++
++		data_per_desc =
++		    ((j + 1) * dwc_ep->maxpacket >
++		     dwc_ep->data_per_frame) ? dwc_ep->data_per_frame -
++		    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
++		data_per_desc +=
++		    (data_per_desc % 4) ? (4 - data_per_desc % 4) : 0;
++		sts.b_iso_out.rxbytes = data_per_desc;
++
++		dma_desc->buf = dma_ad;
++		dma_desc->status.d32 = sts.d32;
++	} else {
++/** ISO IN EP */
++
++		dma_desc =
++		    dwc_ep->iso_desc_addr +
++		    dwc_ep->desc_cnt * dwc_ep->proc_buf_num;
++
++		sts.b_iso_in.bs = BS_HOST_READY;
++		sts.b_iso_in.txsts = 0;
++		sts.b_iso_in.sp = 0;
++		sts.b_iso_in.ioc = 0;
++		sts.b_iso_in.pid = dwc_ep->pkt_per_frm;
++		sts.b_iso_in.framenum = dwc_ep->next_frame;
++		sts.b_iso_in.txbytes = dwc_ep->data_per_frame;
++		sts.b_iso_in.l = 0;
++
++		for (i = 0; i < dwc_ep->desc_cnt - 1; i++) {
++			dma_desc->buf = dma_ad;
++			dma_desc->status.d32 = sts.d32;
++
++			sts.b_iso_in.framenum += dwc_ep->bInterval;
++			dma_ad += dwc_ep->data_per_frame;
++			dma_desc++;
++		}
++
++		sts.b_iso_in.ioc = 1;
++		sts.b_iso_in.l = dwc_ep->proc_buf_num;
++
++		dma_desc->buf = dma_ad;
++		dma_desc->status.d32 = sts.d32;
++
++		dwc_ep->next_frame =
++		    sts.b_iso_in.framenum + dwc_ep->bInterval * 1;
++	}
++	dwc_ep->proc_buf_num = (dwc_ep->proc_buf_num ^ 1) & 0x1;
++}
++
++/**
++ * This function is to handle Iso EP transfer complete interrupt
++ * in case Iso out packet was dropped
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param dwc_ep The EP for wihich transfer complete was asserted
++ *
++ */
++static uint32_t handle_iso_out_pkt_dropped(dwc_otg_core_if_t * core_if,
++					   dwc_ep_t * dwc_ep)
++{
++	uint32_t dma_addr;
++	uint32_t drp_pkt;
++	uint32_t drp_pkt_cnt;
++	deptsiz_data_t deptsiz = {.d32 = 0 };
++	depctl_data_t depctl = {.d32 = 0 };
++	int i;
++
++	deptsiz.d32 =
++	    DWC_READ_REG32(&core_if->dev_if->
++			   out_ep_regs[dwc_ep->num]->doeptsiz);
++
++	drp_pkt = dwc_ep->pkt_cnt - deptsiz.b.pktcnt;
++	drp_pkt_cnt = dwc_ep->pkt_per_frm - (drp_pkt % dwc_ep->pkt_per_frm);
++
++	/* Setting dropped packets status */
++	for (i = 0; i < drp_pkt_cnt; ++i) {
++		dwc_ep->pkt_info[drp_pkt].status = -DWC_E_NO_DATA;
++		drp_pkt++;
++		deptsiz.b.pktcnt--;
++	}
++
++	if (deptsiz.b.pktcnt > 0) {
++		deptsiz.b.xfersize =
++		    dwc_ep->xfer_len - (dwc_ep->pkt_cnt -
++					deptsiz.b.pktcnt) * dwc_ep->maxpacket;
++	} else {
++		deptsiz.b.xfersize = 0;
++		deptsiz.b.pktcnt = 0;
++	}
++
++	DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[dwc_ep->num]->doeptsiz,
++			deptsiz.d32);
++
++	if (deptsiz.b.pktcnt > 0) {
++		if (dwc_ep->proc_buf_num) {
++			dma_addr =
++			    dwc_ep->dma_addr1 + dwc_ep->xfer_len -
++			    deptsiz.b.xfersize;
++		} else {
++			dma_addr =
++			    dwc_ep->dma_addr0 + dwc_ep->xfer_len -
++			    deptsiz.b.xfersize;;
++		}
++
++		DWC_WRITE_REG32(&core_if->dev_if->
++				out_ep_regs[dwc_ep->num]->doepdma, dma_addr);
++
++		/** Re-enable endpoint, clear nak  */
++		depctl.d32 = 0;
++		depctl.b.epena = 1;
++		depctl.b.cnak = 1;
++
++		DWC_MODIFY_REG32(&core_if->dev_if->
++				 out_ep_regs[dwc_ep->num]->doepctl, depctl.d32,
++				 depctl.d32);
++		return 0;
++	} else {
++		return 1;
++	}
++}
++
++/**
++ * This function sets iso packets information(PTI mode)
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to start the transfer on.
++ *
++ */
++static uint32_t set_iso_pkts_info(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	int i, j;
++	dma_addr_t dma_ad;
++	iso_pkt_info_t *packet_info = ep->pkt_info;
++	uint32_t offset;
++	uint32_t frame_data;
++	deptsiz_data_t deptsiz;
++
++	if (ep->proc_buf_num == 0) {
++		/** Buffer 0 descriptors setup */
++		dma_ad = ep->dma_addr0;
++	} else {
++		/** Buffer 1 descriptors setup */
++		dma_ad = ep->dma_addr1;
++	}
++
++	if (ep->is_in) {
++		deptsiz.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
++				   dieptsiz);
++	} else {
++		deptsiz.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->out_ep_regs[ep->num]->
++				   doeptsiz);
++	}
++
++	if (!deptsiz.b.xfersize) {
++		offset = 0;
++		for (i = 0; i < ep->pkt_cnt; i += ep->pkt_per_frm) {
++			frame_data = ep->data_per_frame;
++			for (j = 0; j < ep->pkt_per_frm; ++j) {
++
++				/* Packet status - is not set as initially
++				 * it is set to 0 and if packet was sent
++				 successfully, status field will remain 0*/
++
++				/* Bytes has been transfered */
++				packet_info->length =
++				    (ep->maxpacket <
++				     frame_data) ? ep->maxpacket : frame_data;
++
++				/* Received packet offset */
++				packet_info->offset = offset;
++				offset += packet_info->length;
++				frame_data -= packet_info->length;
++
++				packet_info++;
++			}
++		}
++		return 1;
++	} else {
++		/* This is a workaround for in case of Transfer Complete with
++		 * PktDrpSts interrupts merging - in this case Transfer complete
++		 * interrupt for Isoc Out Endpoint is asserted without PktDrpSts
++		 * set and with DOEPTSIZ register non zero. Investigations showed,
++		 * that this happens when Out packet is dropped, but because of
++		 * interrupts merging during first interrupt handling PktDrpSts
++		 * bit is cleared and for next merged interrupts it is not reset.
++		 * In this case SW hadles the interrupt as if PktDrpSts bit is set.
++		 */
++		if (ep->is_in) {
++			return 1;
++		} else {
++			return handle_iso_out_pkt_dropped(core_if, ep);
++		}
++	}
++}
++
++/**
++ * This function is to handle Iso EP transfer complete interrupt
++ *
++ * @param pcd The PCD
++ * @param ep The EP for which transfer complete was asserted
++ *
++ */
++static void complete_iso_ep(dwc_otg_pcd_t * pcd, dwc_otg_pcd_ep_t * ep)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(ep->pcd);
++	dwc_ep_t *dwc_ep = &ep->dwc_ep;
++	uint8_t is_last = 0;
++
++	if (ep->dwc_ep.next_frame == 0xffffffff) {
++		DWC_WARN("Next frame is not set!\n");
++		return;
++	}
++
++	if (core_if->dma_enable) {
++		if (core_if->dma_desc_enable) {
++			set_ddma_iso_pkts_info(core_if, dwc_ep);
++			reinit_ddma_iso_xfer(core_if, dwc_ep);
++			is_last = 1;
++		} else {
++			if (core_if->pti_enh_enable) {
++				if (set_iso_pkts_info(core_if, dwc_ep)) {
++					dwc_ep->proc_buf_num =
++					    (dwc_ep->proc_buf_num ^ 1) & 0x1;
++					dwc_otg_iso_ep_start_buf_transfer
++					    (core_if, dwc_ep);
++					is_last = 1;
++				}
++			} else {
++				set_current_pkt_info(core_if, dwc_ep);
++				if (dwc_ep->cur_pkt >= dwc_ep->pkt_cnt) {
++					is_last = 1;
++					dwc_ep->cur_pkt = 0;
++					dwc_ep->proc_buf_num =
++					    (dwc_ep->proc_buf_num ^ 1) & 0x1;
++					if (dwc_ep->proc_buf_num) {
++						dwc_ep->cur_pkt_addr =
++						    dwc_ep->xfer_buff1;
++						dwc_ep->cur_pkt_dma_addr =
++						    dwc_ep->dma_addr1;
++					} else {
++						dwc_ep->cur_pkt_addr =
++						    dwc_ep->xfer_buff0;
++						dwc_ep->cur_pkt_dma_addr =
++						    dwc_ep->dma_addr0;
++					}
++
++				}
++				dwc_otg_iso_ep_start_frm_transfer(core_if,
++								  dwc_ep);
++			}
++		}
++	} else {
++		set_current_pkt_info(core_if, dwc_ep);
++		if (dwc_ep->cur_pkt >= dwc_ep->pkt_cnt) {
++			is_last = 1;
++			dwc_ep->cur_pkt = 0;
++			dwc_ep->proc_buf_num = (dwc_ep->proc_buf_num ^ 1) & 0x1;
++			if (dwc_ep->proc_buf_num) {
++				dwc_ep->cur_pkt_addr = dwc_ep->xfer_buff1;
++				dwc_ep->cur_pkt_dma_addr = dwc_ep->dma_addr1;
++			} else {
++				dwc_ep->cur_pkt_addr = dwc_ep->xfer_buff0;
++				dwc_ep->cur_pkt_dma_addr = dwc_ep->dma_addr0;
++			}
++
++		}
++		dwc_otg_iso_ep_start_frm_transfer(core_if, dwc_ep);
++	}
++	if (is_last)
++		dwc_otg_iso_buffer_done(pcd, ep, ep->iso_req_handle);
++}
++#endif /* DWC_EN_ISOC */
++
++/**
++ * This function handle BNA interrupt for Non Isochronous EPs
++ *
++ */
++static void dwc_otg_pcd_handle_noniso_bna(dwc_otg_pcd_ep_t * ep)
++{
++	dwc_ep_t *dwc_ep = &ep->dwc_ep;
++	volatile uint32_t *addr;
++	depctl_data_t depctl = {.d32 = 0 };
++	dwc_otg_pcd_t *pcd = ep->pcd;
++	dwc_otg_dev_dma_desc_t *dma_desc;
++	dev_dma_desc_sts_t sts = {.d32 = 0 };
++	dwc_otg_core_if_t *core_if = ep->pcd->core_if;
++	int i, start;
++
++	if (!dwc_ep->desc_cnt)
++		DWC_WARN("Ep%d %s Descriptor count = %d \n", dwc_ep->num,
++			 (dwc_ep->is_in ? "IN" : "OUT"), dwc_ep->desc_cnt);
++
++	if (core_if->core_params->cont_on_bna && !dwc_ep->is_in
++							&& dwc_ep->type != DWC_OTG_EP_TYPE_CONTROL) {
++		uint32_t doepdma;
++		dwc_otg_dev_out_ep_regs_t *out_regs =
++			core_if->dev_if->out_ep_regs[dwc_ep->num];
++		doepdma = DWC_READ_REG32(&(out_regs->doepdma));
++		start = (doepdma - dwc_ep->dma_desc_addr)/sizeof(dwc_otg_dev_dma_desc_t);
++		dma_desc = &(dwc_ep->desc_addr[start]);
++	} else {
++		start = 0;
++		dma_desc = dwc_ep->desc_addr;
++	}
++
++
++	for (i = start; i < dwc_ep->desc_cnt; ++i, ++dma_desc) {
++		sts.d32 = dma_desc->status.d32;
++		sts.b.bs = BS_HOST_READY;
++		dma_desc->status.d32 = sts.d32;
++	}
++
++	if (dwc_ep->is_in == 0) {
++		addr =
++		    &GET_CORE_IF(pcd)->dev_if->out_ep_regs[dwc_ep->num]->
++		    doepctl;
++	} else {
++		addr =
++		    &GET_CORE_IF(pcd)->dev_if->in_ep_regs[dwc_ep->num]->diepctl;
++	}
++	depctl.b.epena = 1;
++	depctl.b.cnak = 1;
++	DWC_MODIFY_REG32(addr, 0, depctl.d32);
++}
++
++/**
++ * This function handles EP0 Control transfers.
++ *
++ * The state of the control transfers are tracked in
++ * <code>ep0state</code>.
++ */
++static void handle_ep0(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
++	dev_dma_desc_sts_t desc_sts;
++	deptsiz0_data_t deptsiz;
++	uint32_t byte_count;
++
++#ifdef DEBUG_EP0
++	DWC_DEBUGPL(DBG_PCDV, "%s()\n", __func__);
++	print_ep0_state(pcd);
++#endif
++
++//      DWC_PRINTF("HANDLE EP0\n");
++
++	switch (pcd->ep0state) {
++	case EP0_DISCONNECT:
++		break;
++
++	case EP0_IDLE:
++		pcd->request_config = 0;
++
++		pcd_setup(pcd);
++		break;
++
++	case EP0_IN_DATA_PHASE:
++#ifdef DEBUG_EP0
++		DWC_DEBUGPL(DBG_PCD, "DATA_IN EP%d-%s: type=%d, mps=%d\n",
++			    ep0->dwc_ep.num, (ep0->dwc_ep.is_in ? "IN" : "OUT"),
++			    ep0->dwc_ep.type, ep0->dwc_ep.maxpacket);
++#endif
++
++		if (core_if->dma_enable != 0) {
++			/*
++			 * For EP0 we can only program 1 packet at a time so we
++			 * need to do the make calculations after each complete.
++			 * Call write_packet to make the calculations, as in
++			 * slave mode, and use those values to determine if we
++			 * can complete.
++			 */
++			if (core_if->dma_desc_enable == 0) {
++				deptsiz.d32 =
++				    DWC_READ_REG32(&core_if->
++						   dev_if->in_ep_regs[0]->
++						   dieptsiz);
++				byte_count =
++				    ep0->dwc_ep.xfer_len - deptsiz.b.xfersize;
++			} else {
++				desc_sts =
++				    core_if->dev_if->in_desc_addr->status;
++				byte_count =
++				    ep0->dwc_ep.xfer_len - desc_sts.b.bytes;
++			}
++			ep0->dwc_ep.xfer_count += byte_count;
++			ep0->dwc_ep.xfer_buff += byte_count;
++			ep0->dwc_ep.dma_addr += byte_count;
++		}
++		if (ep0->dwc_ep.xfer_count < ep0->dwc_ep.total_len) {
++			dwc_otg_ep0_continue_transfer(GET_CORE_IF(pcd),
++						      &ep0->dwc_ep);
++			DWC_DEBUGPL(DBG_PCD, "CONTINUE TRANSFER\n");
++		} else if (ep0->dwc_ep.sent_zlp) {
++			dwc_otg_ep0_continue_transfer(GET_CORE_IF(pcd),
++						      &ep0->dwc_ep);
++			ep0->dwc_ep.sent_zlp = 0;
++			DWC_DEBUGPL(DBG_PCD, "CONTINUE TRANSFER sent zlp\n");
++		} else {
++			ep0_complete_request(ep0);
++			DWC_DEBUGPL(DBG_PCD, "COMPLETE TRANSFER\n");
++		}
++		break;
++	case EP0_OUT_DATA_PHASE:
++#ifdef DEBUG_EP0
++		DWC_DEBUGPL(DBG_PCD, "DATA_OUT EP%d-%s: type=%d, mps=%d\n",
++			    ep0->dwc_ep.num, (ep0->dwc_ep.is_in ? "IN" : "OUT"),
++			    ep0->dwc_ep.type, ep0->dwc_ep.maxpacket);
++#endif
++		if (core_if->dma_enable != 0) {
++			if (core_if->dma_desc_enable == 0) {
++				deptsiz.d32 =
++				    DWC_READ_REG32(&core_if->
++						   dev_if->out_ep_regs[0]->
++						   doeptsiz);
++				byte_count =
++				    ep0->dwc_ep.maxpacket - deptsiz.b.xfersize;
++			} else {
++				desc_sts =
++				    core_if->dev_if->out_desc_addr->status;
++				byte_count =
++				    ep0->dwc_ep.maxpacket - desc_sts.b.bytes;
++			}
++			ep0->dwc_ep.xfer_count += byte_count;
++			ep0->dwc_ep.xfer_buff += byte_count;
++			ep0->dwc_ep.dma_addr += byte_count;
++		}
++		if (ep0->dwc_ep.xfer_count < ep0->dwc_ep.total_len) {
++			dwc_otg_ep0_continue_transfer(GET_CORE_IF(pcd),
++						      &ep0->dwc_ep);
++			DWC_DEBUGPL(DBG_PCD, "CONTINUE TRANSFER\n");
++		} else if (ep0->dwc_ep.sent_zlp) {
++			dwc_otg_ep0_continue_transfer(GET_CORE_IF(pcd),
++						      &ep0->dwc_ep);
++			ep0->dwc_ep.sent_zlp = 0;
++			DWC_DEBUGPL(DBG_PCD, "CONTINUE TRANSFER sent zlp\n");
++		} else {
++			ep0_complete_request(ep0);
++			DWC_DEBUGPL(DBG_PCD, "COMPLETE TRANSFER\n");
++		}
++		break;
++
++	case EP0_IN_STATUS_PHASE:
++	case EP0_OUT_STATUS_PHASE:
++		DWC_DEBUGPL(DBG_PCD, "CASE: EP0_STATUS\n");
++		ep0_complete_request(ep0);
++		pcd->ep0state = EP0_IDLE;
++		ep0->stopped = 1;
++		ep0->dwc_ep.is_in = 0;	/* OUT for next SETUP */
++
++		/* Prepare for more SETUP Packets */
++		if (core_if->dma_enable) {
++			ep0_out_start(core_if, pcd);
++		}
++		break;
++
++	case EP0_STALL:
++		DWC_ERROR("EP0 STALLed, should not get here pcd_setup()\n");
++		break;
++	}
++#ifdef DEBUG_EP0
++	print_ep0_state(pcd);
++#endif
++}
++
++/**
++ * Restart transfer
++ */
++static void restart_transfer(dwc_otg_pcd_t * pcd, const uint32_t epnum)
++{
++	dwc_otg_core_if_t *core_if;
++	dwc_otg_dev_if_t *dev_if;
++	deptsiz_data_t dieptsiz = {.d32 = 0 };
++	dwc_otg_pcd_ep_t *ep;
++
++	ep = get_in_ep(pcd, epnum);
++
++#ifdef DWC_EN_ISOC
++	if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
++		return;
++	}
++#endif /* DWC_EN_ISOC  */
++
++	core_if = GET_CORE_IF(pcd);
++	dev_if = core_if->dev_if;
++
++	dieptsiz.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dieptsiz);
++
++	DWC_DEBUGPL(DBG_PCD, "xfer_buff=%p xfer_count=%0x xfer_len=%0x"
++		    " stopped=%d\n", ep->dwc_ep.xfer_buff,
++		    ep->dwc_ep.xfer_count, ep->dwc_ep.xfer_len, ep->stopped);
++	/*
++	 * If xfersize is 0 and pktcnt in not 0, resend the last packet.
++	 */
++	if (dieptsiz.b.pktcnt && dieptsiz.b.xfersize == 0 &&
++	    ep->dwc_ep.start_xfer_buff != 0) {
++		if (ep->dwc_ep.total_len <= ep->dwc_ep.maxpacket) {
++			ep->dwc_ep.xfer_count = 0;
++			ep->dwc_ep.xfer_buff = ep->dwc_ep.start_xfer_buff;
++			ep->dwc_ep.xfer_len = ep->dwc_ep.xfer_count;
++		} else {
++			ep->dwc_ep.xfer_count -= ep->dwc_ep.maxpacket;
++			/* convert packet size to dwords. */
++			ep->dwc_ep.xfer_buff -= ep->dwc_ep.maxpacket;
++			ep->dwc_ep.xfer_len = ep->dwc_ep.xfer_count;
++		}
++		ep->stopped = 0;
++		DWC_DEBUGPL(DBG_PCD, "xfer_buff=%p xfer_count=%0x "
++			    "xfer_len=%0x stopped=%d\n",
++			    ep->dwc_ep.xfer_buff,
++			    ep->dwc_ep.xfer_count, ep->dwc_ep.xfer_len,
++			    ep->stopped);
++		if (epnum == 0) {
++			dwc_otg_ep0_start_transfer(core_if, &ep->dwc_ep);
++		} else {
++			dwc_otg_ep_start_transfer(core_if, &ep->dwc_ep);
++		}
++	}
++}
++
++/*
++ * This function create new nextep sequnce based on Learn Queue.
++ *
++ * @param core_if Programming view of DWC_otg controller
++ */
++void predict_nextep_seq( dwc_otg_core_if_t * core_if)
++{
++	dwc_otg_device_global_regs_t *dev_global_regs =
++	    core_if->dev_if->dev_global_regs;
++	const uint32_t TOKEN_Q_DEPTH = core_if->hwcfg2.b.dev_token_q_depth;
++	/* Number of Token Queue Registers */
++	const int DTKNQ_REG_CNT = (TOKEN_Q_DEPTH + 7) / 8;
++	dtknq1_data_t dtknqr1;
++	uint32_t in_tkn_epnums[4];
++	uint8_t seqnum[MAX_EPS_CHANNELS];
++	uint8_t intkn_seq[1 << 5];
++	grstctl_t resetctl = {.d32 = 0 };
++	uint8_t temp;
++	int ndx = 0;
++	int start = 0;
++	int end = 0;
++	int sort_done = 0;
++	int i = 0;
++	volatile uint32_t *addr = &dev_global_regs->dtknqr1;
++
++
++	DWC_DEBUGPL(DBG_PCD,"dev_token_q_depth=%d\n",TOKEN_Q_DEPTH);
++
++	/* Read the DTKNQ Registers */
++	for (i = 0; i < DTKNQ_REG_CNT; i++) {
++		in_tkn_epnums[i] = DWC_READ_REG32(addr);
++		DWC_DEBUGPL(DBG_PCDV, "DTKNQR%d=0x%08x\n", i + 1,
++			    in_tkn_epnums[i]);
++		if (addr == &dev_global_regs->dvbusdis) {
++			addr = &dev_global_regs->dtknqr3_dthrctl;
++		} else {
++			++addr;
++		}
++
++	}
++
++	/* Copy the DTKNQR1 data to the bit field. */
++	dtknqr1.d32 = in_tkn_epnums[0];
++	if (dtknqr1.b.wrap_bit) {
++		ndx = dtknqr1.b.intknwptr;
++		end = ndx -1;
++		if (end < 0)
++			end = TOKEN_Q_DEPTH -1;
++	} else {
++		ndx = 0;
++		end = dtknqr1.b.intknwptr -1;
++		if (end < 0)
++			end = 0;
++	}
++	start = ndx;
++
++	/* Fill seqnum[] by initial values: EP number + 31 */
++	for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
++		seqnum[i] = i +31;
++	}
++
++	/* Fill intkn_seq[] from in_tkn_epnums[0] */
++	for (i=0; i < 6; i++)
++		intkn_seq[i] = (in_tkn_epnums[0] >> ((7-i) * 4)) & 0xf;
++
++	if (TOKEN_Q_DEPTH > 6) {
++		/* Fill intkn_seq[] from in_tkn_epnums[1] */
++		for (i=6; i < 14; i++)
++			intkn_seq[i] =
++			    (in_tkn_epnums[1] >> ((7 - (i - 6)) * 4)) & 0xf;
++	}
++
++	if (TOKEN_Q_DEPTH > 14) {
++		/* Fill intkn_seq[] from in_tkn_epnums[1] */
++		for (i=14; i < 22; i++)
++			intkn_seq[i] =
++			    (in_tkn_epnums[2] >> ((7 - (i - 14)) * 4)) & 0xf;
++	}
++
++	if (TOKEN_Q_DEPTH > 22) {
++		/* Fill intkn_seq[] from in_tkn_epnums[1] */
++		for (i=22; i < 30; i++)
++			intkn_seq[i] =
++			    (in_tkn_epnums[3] >> ((7 - (i - 22)) * 4)) & 0xf;
++	}
++
++	DWC_DEBUGPL(DBG_PCDV, "%s start=%d end=%d intkn_seq[]:\n", __func__,
++		    start, end);
++	for (i=0; i<TOKEN_Q_DEPTH; i++)
++		DWC_DEBUGPL(DBG_PCDV,"%d\n", intkn_seq[i]);
++
++	/* Update seqnum based on intkn_seq[] */
++	i = 0;
++	do {
++		seqnum[intkn_seq[ndx]] = i;
++		ndx++;
++		i++;
++		if (ndx == TOKEN_Q_DEPTH)
++			ndx = 0;
++	} while ( i < TOKEN_Q_DEPTH );
++
++	/* Mark non active EP's in seqnum[] by 0xff */
++	for (i=0; i<=core_if->dev_if->num_in_eps; i++) {
++		if (core_if->nextep_seq[i] == 0xff )
++			seqnum[i] = 0xff;
++	}
++
++	/* Sort seqnum[] */
++	sort_done = 0;
++	while (!sort_done) {
++		sort_done = 1;
++		for (i=0; i<core_if->dev_if->num_in_eps; i++) {
++			if (seqnum[i] > seqnum[i+1]) {
++				temp = seqnum[i];
++				seqnum[i] = seqnum[i+1];
++				seqnum[i+1] = temp;
++				sort_done = 0;
++			}
++		}
++	}
++
++	ndx = start + seqnum[0];
++	if (ndx >= TOKEN_Q_DEPTH)
++		ndx = ndx % TOKEN_Q_DEPTH;
++	core_if->first_in_nextep_seq = intkn_seq[ndx];
++
++	/* Update seqnum[] by EP numbers  */
++	for (i=0; i<=core_if->dev_if->num_in_eps; i++) {
++		ndx = start + i;
++		if (seqnum[i] < 31) {
++			ndx = start + seqnum[i];
++			if (ndx >= TOKEN_Q_DEPTH)
++				ndx = ndx % TOKEN_Q_DEPTH;
++			seqnum[i] = intkn_seq[ndx];
++		} else {
++			if (seqnum[i] < 0xff) {
++				seqnum[i] = seqnum[i] - 31;
++			} else {
++				break;
++			}
++		}
++	}
++
++	/* Update nextep_seq[] based on seqnum[] */
++	for (i=0; i<core_if->dev_if->num_in_eps; i++) {
++		if (seqnum[i] != 0xff) {
++			if (seqnum[i+1] != 0xff) {
++				core_if->nextep_seq[seqnum[i]] = seqnum[i+1];
++			} else {
++				core_if->nextep_seq[seqnum[i]] = core_if->first_in_nextep_seq;
++				break;
++			}
++		} else {
++			break;
++		}
++	}
++
++	DWC_DEBUGPL(DBG_PCDV, "%s first_in_nextep_seq= %2d; nextep_seq[]:\n",
++		__func__, core_if->first_in_nextep_seq);
++	for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
++		DWC_DEBUGPL(DBG_PCDV,"%2d\n", core_if->nextep_seq[i]);
++	}
++
++	/* Flush the Learning Queue */
++	resetctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->grstctl);
++	resetctl.b.intknqflsh = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->grstctl, resetctl.d32);
++
++
++}
++
++/**
++ * handle the IN EP disable interrupt.
++ */
++static inline void handle_in_ep_disable_intr(dwc_otg_pcd_t * pcd,
++					     const uint32_t epnum)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	deptsiz_data_t dieptsiz = {.d32 = 0 };
++	dctl_data_t dctl = {.d32 = 0 };
++	dwc_otg_pcd_ep_t *ep;
++	dwc_ep_t *dwc_ep;
++	gintmsk_data_t gintmsk_data;
++	depctl_data_t depctl;
++	uint32_t diepdma;
++	uint32_t remain_to_transfer = 0;
++	uint8_t i;
++	uint32_t xfer_size;
++
++	ep = get_in_ep(pcd, epnum);
++	dwc_ep = &ep->dwc_ep;
++
++	if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
++		dwc_otg_flush_tx_fifo(core_if, dwc_ep->tx_fifo_num);
++		complete_ep(ep);
++		return;
++	}
++
++	DWC_DEBUGPL(DBG_PCD, "diepctl%d=%0x\n", epnum,
++		    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->diepctl));
++	dieptsiz.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dieptsiz);
++	depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->diepctl);
++
++	DWC_DEBUGPL(DBG_ANY, "pktcnt=%d size=%d\n",
++		    dieptsiz.b.pktcnt, dieptsiz.b.xfersize);
++
++	if ((core_if->start_predict == 0) || (depctl.b.eptype & 1)) {
++		if (ep->stopped) {
++			if (core_if->en_multiple_tx_fifo)
++				/* Flush the Tx FIFO */
++				dwc_otg_flush_tx_fifo(core_if, dwc_ep->tx_fifo_num);
++			/* Clear the Global IN NP NAK */
++			dctl.d32 = 0;
++			dctl.b.cgnpinnak = 1;
++			DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, dctl.d32, dctl.d32);
++			/* Restart the transaction */
++			if (dieptsiz.b.pktcnt != 0 || dieptsiz.b.xfersize != 0) {
++				restart_transfer(pcd, epnum);
++			}
++		} else {
++			/* Restart the transaction */
++			if (dieptsiz.b.pktcnt != 0 || dieptsiz.b.xfersize != 0) {
++				restart_transfer(pcd, epnum);
++			}
++			DWC_DEBUGPL(DBG_ANY, "STOPPED!!!\n");
++		}
++		return;
++	}
++
++	if (core_if->start_predict > 2) {	// NP IN EP
++		core_if->start_predict--;
++		return;
++	}
++
++	core_if->start_predict--;
++
++	if (core_if->start_predict == 1) {	// All NP IN Ep's disabled now
++
++		predict_nextep_seq(core_if);
++
++		/* Update all active IN EP's NextEP field based of nextep_seq[] */
++		for ( i = 0; i <= core_if->dev_if->num_in_eps; i++) {
++			depctl.d32 =
++			    DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
++			if (core_if->nextep_seq[i] != 0xff) {	// Active NP IN EP
++				depctl.b.nextep = core_if->nextep_seq[i];
++				DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepctl, depctl.d32);
++			}
++		}
++		/* Flush Shared NP TxFIFO */
++		dwc_otg_flush_tx_fifo(core_if, 0);
++		/* Rewind buffers */
++		if (!core_if->dma_desc_enable) {
++			i = core_if->first_in_nextep_seq;
++			do {
++				ep = get_in_ep(pcd, i);
++				dieptsiz.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->dieptsiz);
++				xfer_size = ep->dwc_ep.total_len - ep->dwc_ep.xfer_count;
++				if (xfer_size > ep->dwc_ep.maxxfer)
++					xfer_size = ep->dwc_ep.maxxfer;
++				depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
++				if (dieptsiz.b.pktcnt != 0) {
++					if (xfer_size == 0) {
++						remain_to_transfer = 0;
++					} else {
++						if ((xfer_size % ep->dwc_ep.maxpacket) == 0) {
++							remain_to_transfer =
++								dieptsiz.b.pktcnt * ep->dwc_ep.maxpacket;
++						} else {
++							remain_to_transfer = ((dieptsiz.b.pktcnt -1) * ep->dwc_ep.maxpacket)
++								+ (xfer_size % ep->dwc_ep.maxpacket);
++						}
++					}
++					diepdma = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepdma);
++					dieptsiz.b.xfersize = remain_to_transfer;
++					DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->dieptsiz, dieptsiz.d32);
++					diepdma = ep->dwc_ep.dma_addr + (xfer_size - remain_to_transfer);
++					DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepdma, diepdma);
++				}
++				i = core_if->nextep_seq[i];
++			} while (i != core_if->first_in_nextep_seq);
++		} else { // dma_desc_enable
++				DWC_PRINTF("%s Learning Queue not supported in DDMA\n", __func__);
++		}
++
++		/* Restart transfers in predicted sequences */
++		i = core_if->first_in_nextep_seq;
++		do {
++			dieptsiz.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->dieptsiz);
++			depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
++			if (dieptsiz.b.pktcnt != 0) {
++				depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
++				depctl.b.epena = 1;
++				depctl.b.cnak = 1;
++				DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepctl, depctl.d32);
++			}
++			i = core_if->nextep_seq[i];
++		} while (i != core_if->first_in_nextep_seq);
++
++		/* Clear the global non-periodic IN NAK handshake */
++		dctl.d32 = 0;
++		dctl.b.cgnpinnak = 1;
++		DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, dctl.d32, dctl.d32);
++
++		/* Unmask EP Mismatch interrupt */
++		gintmsk_data.d32 = 0;
++		gintmsk_data.b.epmismatch = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, 0, gintmsk_data.d32);
++
++		core_if->start_predict = 0;
++
++	}
++}
++
++/**
++ * Handler for the IN EP timeout handshake interrupt.
++ */
++static inline void handle_in_ep_timeout_intr(dwc_otg_pcd_t * pcd,
++					     const uint32_t epnum)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++
++#ifdef DEBUG
++	deptsiz_data_t dieptsiz = {.d32 = 0 };
++	uint32_t num = 0;
++#endif
++	dctl_data_t dctl = {.d32 = 0 };
++	dwc_otg_pcd_ep_t *ep;
++
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	ep = get_in_ep(pcd, epnum);
++
++	/* Disable the NP Tx Fifo Empty Interrrupt */
++	if (!core_if->dma_enable) {
++		intr_mask.b.nptxfempty = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk,
++				 intr_mask.d32, 0);
++	}
++	/** @todo NGS Check EP type.
++	 * Implement for Periodic EPs */
++	/*
++	 * Non-periodic EP
++	 */
++	/* Enable the Global IN NAK Effective Interrupt */
++	intr_mask.b.ginnakeff = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, 0, intr_mask.d32);
++
++	/* Set Global IN NAK */
++	dctl.b.sgnpinnak = 1;
++	DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, dctl.d32, dctl.d32);
++
++	ep->stopped = 1;
++
++#ifdef DEBUG
++	dieptsiz.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[num]->dieptsiz);
++	DWC_DEBUGPL(DBG_ANY, "pktcnt=%d size=%d\n",
++		    dieptsiz.b.pktcnt, dieptsiz.b.xfersize);
++#endif
++
++#ifdef DISABLE_PERIODIC_EP
++	/*
++	 * Set the NAK bit for this EP to
++	 * start the disable process.
++	 */
++	diepctl.d32 = 0;
++	diepctl.b.snak = 1;
++	DWC_MODIFY_REG32(&dev_if->in_ep_regs[num]->diepctl, diepctl.d32,
++			 diepctl.d32);
++	ep->disabling = 1;
++	ep->stopped = 1;
++#endif
++}
++
++/**
++ * Handler for the IN EP NAK interrupt.
++ */
++static inline int32_t handle_in_ep_nak_intr(dwc_otg_pcd_t * pcd,
++					    const uint32_t epnum)
++{
++	/** @todo implement ISR */
++	dwc_otg_core_if_t *core_if;
++	diepmsk_data_t intr_mask = {.d32 = 0 };
++
++	DWC_PRINTF("INTERRUPT Handler not implemented for %s\n", "IN EP NAK");
++	core_if = GET_CORE_IF(pcd);
++	intr_mask.b.nak = 1;
++
++	if (core_if->multiproc_int_enable) {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
++				 diepeachintmsk[epnum], intr_mask.d32, 0);
++	} else {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->diepmsk,
++				 intr_mask.d32, 0);
++	}
++
++	return 1;
++}
++
++/**
++ * Handler for the OUT EP Babble interrupt.
++ */
++static inline int32_t handle_out_ep_babble_intr(dwc_otg_pcd_t * pcd,
++						const uint32_t epnum)
++{
++	/** @todo implement ISR */
++	dwc_otg_core_if_t *core_if;
++	doepmsk_data_t intr_mask = {.d32 = 0 };
++
++	DWC_PRINTF("INTERRUPT Handler not implemented for %s\n",
++		   "OUT EP Babble");
++	core_if = GET_CORE_IF(pcd);
++	intr_mask.b.babble = 1;
++
++	if (core_if->multiproc_int_enable) {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
++				 doepeachintmsk[epnum], intr_mask.d32, 0);
++	} else {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->doepmsk,
++				 intr_mask.d32, 0);
++	}
++
++	return 1;
++}
++
++/**
++ * Handler for the OUT EP NAK interrupt.
++ */
++static inline int32_t handle_out_ep_nak_intr(dwc_otg_pcd_t * pcd,
++					     const uint32_t epnum)
++{
++	/** @todo implement ISR */
++	dwc_otg_core_if_t *core_if;
++	doepmsk_data_t intr_mask = {.d32 = 0 };
++
++	DWC_DEBUGPL(DBG_ANY, "INTERRUPT Handler not implemented for %s\n", "OUT EP NAK");
++	core_if = GET_CORE_IF(pcd);
++	intr_mask.b.nak = 1;
++
++	if (core_if->multiproc_int_enable) {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
++				 doepeachintmsk[epnum], intr_mask.d32, 0);
++	} else {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->doepmsk,
++				 intr_mask.d32, 0);
++	}
++
++	return 1;
++}
++
++/**
++ * Handler for the OUT EP NYET interrupt.
++ */
++static inline int32_t handle_out_ep_nyet_intr(dwc_otg_pcd_t * pcd,
++					      const uint32_t epnum)
++{
++	/** @todo implement ISR */
++	dwc_otg_core_if_t *core_if;
++	doepmsk_data_t intr_mask = {.d32 = 0 };
++
++	DWC_PRINTF("INTERRUPT Handler not implemented for %s\n", "OUT EP NYET");
++	core_if = GET_CORE_IF(pcd);
++	intr_mask.b.nyet = 1;
++
++	if (core_if->multiproc_int_enable) {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
++				 doepeachintmsk[epnum], intr_mask.d32, 0);
++	} else {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->doepmsk,
++				 intr_mask.d32, 0);
++	}
++
++	return 1;
++}
++
++/**
++ * This interrupt indicates that an IN EP has a pending Interrupt.
++ * The sequence for handling the IN EP interrupt is shown below:
++ * -#	Read the Device All Endpoint Interrupt register
++ * -#	Repeat the following for each IN EP interrupt bit set (from
++ *		LSB to MSB).
++ * -#	Read the Device Endpoint Interrupt (DIEPINTn) register
++ * -#	If "Transfer Complete" call the request complete function
++ * -#	If "Endpoint Disabled" complete the EP disable procedure.
++ * -#	If "AHB Error Interrupt" log error
++ * -#	If "Time-out Handshake" log error
++ * -#	If "IN Token Received when TxFIFO Empty" write packet to Tx
++ *		FIFO.
++ * -#	If "IN Token EP Mismatch" (disable, this is handled by EP
++ *		Mismatch Interrupt)
++ */
++static int32_t dwc_otg_pcd_handle_in_ep_intr(dwc_otg_pcd_t * pcd)
++{
++#define CLEAR_IN_EP_INTR(__core_if,__epnum,__intr) \
++do { \
++		diepint_data_t diepint = {.d32=0}; \
++		diepint.b.__intr = 1; \
++		DWC_WRITE_REG32(&__core_if->dev_if->in_ep_regs[__epnum]->diepint, \
++		diepint.d32); \
++} while (0)
++
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	diepint_data_t diepint = {.d32 = 0 };
++	depctl_data_t depctl = {.d32 = 0 };
++	uint32_t ep_intr;
++	uint32_t epnum = 0;
++	dwc_otg_pcd_ep_t *ep;
++	dwc_ep_t *dwc_ep;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, pcd);
++
++	/* Read in the device interrupt bits */
++	ep_intr = dwc_otg_read_dev_all_in_ep_intr(core_if);
++
++	/* Service the Device IN interrupts for each endpoint */
++	while (ep_intr) {
++		if (ep_intr & 0x1) {
++			uint32_t empty_msk;
++			/* Get EP pointer */
++			ep = get_in_ep(pcd, epnum);
++			dwc_ep = &ep->dwc_ep;
++
++			depctl.d32 =
++			    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->diepctl);
++			empty_msk =
++			    DWC_READ_REG32(&dev_if->
++					   dev_global_regs->dtknqr4_fifoemptymsk);
++
++			DWC_DEBUGPL(DBG_PCDV,
++				    "IN EP INTERRUPT - %d\nepmty_msk - %8x  diepctl - %8x\n",
++				    epnum, empty_msk, depctl.d32);
++
++			DWC_DEBUGPL(DBG_PCD,
++				    "EP%d-%s: type=%d, mps=%d\n",
++				    dwc_ep->num, (dwc_ep->is_in ? "IN" : "OUT"),
++				    dwc_ep->type, dwc_ep->maxpacket);
++
++			diepint.d32 =
++			    dwc_otg_read_dev_in_ep_intr(core_if, dwc_ep);
++
++			DWC_DEBUGPL(DBG_PCDV,
++				    "EP %d Interrupt Register - 0x%x\n", epnum,
++				    diepint.d32);
++			/* Transfer complete */
++			if (diepint.b.xfercompl) {
++				/* Disable the NP Tx FIFO Empty
++				 * Interrupt */
++				if (core_if->en_multiple_tx_fifo == 0) {
++					intr_mask.b.nptxfempty = 1;
++					DWC_MODIFY_REG32
++					    (&core_if->core_global_regs->gintmsk,
++					     intr_mask.d32, 0);
++				} else {
++					/* Disable the Tx FIFO Empty Interrupt for this EP */
++					uint32_t fifoemptymsk =
++					    0x1 << dwc_ep->num;
++					DWC_MODIFY_REG32(&core_if->
++							 dev_if->dev_global_regs->dtknqr4_fifoemptymsk,
++							 fifoemptymsk, 0);
++				}
++				/* Clear the bit in DIEPINTn for this interrupt */
++				CLEAR_IN_EP_INTR(core_if, epnum, xfercompl);
++
++				/* Complete the transfer */
++				if (epnum == 0) {
++					handle_ep0(pcd);
++				}
++#ifdef DWC_EN_ISOC
++				else if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
++					if (!ep->stopped)
++						complete_iso_ep(pcd, ep);
++				}
++#endif /* DWC_EN_ISOC */
++#ifdef DWC_UTE_PER_IO
++				else if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
++					if (!ep->stopped)
++						complete_xiso_ep(ep);
++				}
++#endif /* DWC_UTE_PER_IO */
++				else {
++					if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC &&
++							dwc_ep->bInterval > 1) {
++						dwc_ep->frame_num += dwc_ep->bInterval;
++						if (dwc_ep->frame_num > 0x3FFF)
++						{
++							dwc_ep->frm_overrun = 1;
++							dwc_ep->frame_num &= 0x3FFF;
++						} else
++							dwc_ep->frm_overrun = 0;
++					}
++					complete_ep(ep);
++					if(diepint.b.nak)
++						CLEAR_IN_EP_INTR(core_if, epnum, nak);
++				}
++			}
++			/* Endpoint disable      */
++			if (diepint.b.epdisabled) {
++				DWC_DEBUGPL(DBG_ANY, "EP%d IN disabled\n",
++					    epnum);
++				handle_in_ep_disable_intr(pcd, epnum);
++
++				/* Clear the bit in DIEPINTn for this interrupt */
++				CLEAR_IN_EP_INTR(core_if, epnum, epdisabled);
++			}
++			/* AHB Error */
++			if (diepint.b.ahberr) {
++				DWC_ERROR("EP%d IN AHB Error\n", epnum);
++				/* Clear the bit in DIEPINTn for this interrupt */
++				CLEAR_IN_EP_INTR(core_if, epnum, ahberr);
++			}
++			/* TimeOUT Handshake (non-ISOC IN EPs) */
++			if (diepint.b.timeout) {
++				DWC_ERROR("EP%d IN Time-out\n", epnum);
++				handle_in_ep_timeout_intr(pcd, epnum);
++
++				CLEAR_IN_EP_INTR(core_if, epnum, timeout);
++			}
++			/** IN Token received with TxF Empty */
++			if (diepint.b.intktxfemp) {
++				DWC_DEBUGPL(DBG_ANY,
++					    "EP%d IN TKN TxFifo Empty\n",
++					    epnum);
++				if (!ep->stopped && epnum != 0) {
++
++					diepmsk_data_t diepmsk = {.d32 = 0 };
++					diepmsk.b.intktxfemp = 1;
++
++					if (core_if->multiproc_int_enable) {
++						DWC_MODIFY_REG32
++						    (&dev_if->dev_global_regs->diepeachintmsk
++						     [epnum], diepmsk.d32, 0);
++					} else {
++						DWC_MODIFY_REG32
++						    (&dev_if->dev_global_regs->diepmsk,
++						     diepmsk.d32, 0);
++					}
++				} else if (core_if->dma_desc_enable
++					   && epnum == 0
++					   && pcd->ep0state ==
++					   EP0_OUT_STATUS_PHASE) {
++					// EP0 IN set STALL
++					depctl.d32 =
++					    DWC_READ_REG32(&dev_if->in_ep_regs
++							   [epnum]->diepctl);
++
++					/* set the disable and stall bits */
++					if (depctl.b.epena) {
++						depctl.b.epdis = 1;
++					}
++					depctl.b.stall = 1;
++					DWC_WRITE_REG32(&dev_if->in_ep_regs
++							[epnum]->diepctl,
++							depctl.d32);
++				}
++				CLEAR_IN_EP_INTR(core_if, epnum, intktxfemp);
++			}
++			/** IN Token Received with EP mismatch */
++			if (diepint.b.intknepmis) {
++				DWC_DEBUGPL(DBG_ANY,
++					    "EP%d IN TKN EP Mismatch\n", epnum);
++				CLEAR_IN_EP_INTR(core_if, epnum, intknepmis);
++			}
++			/** IN Endpoint NAK Effective */
++			if (diepint.b.inepnakeff) {
++				DWC_DEBUGPL(DBG_ANY,
++					    "EP%d IN EP NAK Effective\n",
++					    epnum);
++				/* Periodic EP */
++				if (ep->disabling) {
++					depctl.d32 = 0;
++					depctl.b.snak = 1;
++					depctl.b.epdis = 1;
++					DWC_MODIFY_REG32(&dev_if->in_ep_regs
++							 [epnum]->diepctl,
++							 depctl.d32,
++							 depctl.d32);
++				}
++				CLEAR_IN_EP_INTR(core_if, epnum, inepnakeff);
++
++			}
++
++			/** IN EP Tx FIFO Empty Intr */
++			if (diepint.b.emptyintr) {
++				DWC_DEBUGPL(DBG_ANY,
++					    "EP%d Tx FIFO Empty Intr \n",
++					    epnum);
++				write_empty_tx_fifo(pcd, epnum);
++
++				CLEAR_IN_EP_INTR(core_if, epnum, emptyintr);
++
++			}
++
++			/** IN EP BNA Intr */
++			if (diepint.b.bna) {
++				CLEAR_IN_EP_INTR(core_if, epnum, bna);
++				if (core_if->dma_desc_enable) {
++#ifdef DWC_EN_ISOC
++					if (dwc_ep->type ==
++					    DWC_OTG_EP_TYPE_ISOC) {
++						/*
++						 * This checking is performed to prevent first "false" BNA
++						 * handling occuring right after reconnect
++						 */
++						if (dwc_ep->next_frame !=
++						    0xffffffff)
++							dwc_otg_pcd_handle_iso_bna(ep);
++					} else
++#endif				/* DWC_EN_ISOC */
++					{
++						dwc_otg_pcd_handle_noniso_bna(ep);
++					}
++				}
++			}
++			/* NAK Interrutp */
++			if (diepint.b.nak) {
++				DWC_DEBUGPL(DBG_ANY, "EP%d IN NAK Interrupt\n",
++					    epnum);
++				if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
++					depctl_data_t depctl;
++					if (ep->dwc_ep.frame_num == 0xFFFFFFFF) {
++						ep->dwc_ep.frame_num = core_if->frame_num;
++						if (ep->dwc_ep.bInterval > 1) {
++							depctl.d32 = 0;
++							depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->diepctl);
++							if (ep->dwc_ep.frame_num & 0x1) {
++								depctl.b.setd1pid = 1;
++								depctl.b.setd0pid = 0;
++							} else {
++								depctl.b.setd0pid = 1;
++								depctl.b.setd1pid = 0;
++							}
++							DWC_WRITE_REG32(&dev_if->in_ep_regs[epnum]->diepctl, depctl.d32);
++						}
++						start_next_request(ep);
++					}
++					ep->dwc_ep.frame_num += ep->dwc_ep.bInterval;
++					if (dwc_ep->frame_num > 0x3FFF)	{
++						dwc_ep->frm_overrun = 1;
++						dwc_ep->frame_num &= 0x3FFF;
++					} else
++						dwc_ep->frm_overrun = 0;
++				}
++
++				CLEAR_IN_EP_INTR(core_if, epnum, nak);
++			}
++		}
++		epnum++;
++		ep_intr >>= 1;
++	}
++
++	return 1;
++#undef CLEAR_IN_EP_INTR
++}
++
++/**
++ * This interrupt indicates that an OUT EP has a pending Interrupt.
++ * The sequence for handling the OUT EP interrupt is shown below:
++ * -#	Read the Device All Endpoint Interrupt register
++ * -#	Repeat the following for each OUT EP interrupt bit set (from
++ *		LSB to MSB).
++ * -#	Read the Device Endpoint Interrupt (DOEPINTn) register
++ * -#	If "Transfer Complete" call the request complete function
++ * -#	If "Endpoint Disabled" complete the EP disable procedure.
++ * -#	If "AHB Error Interrupt" log error
++ * -#	If "Setup Phase Done" process Setup Packet (See Standard USB
++ *		Command Processing)
++ */
++static int32_t dwc_otg_pcd_handle_out_ep_intr(dwc_otg_pcd_t * pcd)
++{
++#define CLEAR_OUT_EP_INTR(__core_if,__epnum,__intr) \
++do { \
++		doepint_data_t doepint = {.d32=0}; \
++		doepint.b.__intr = 1; \
++		DWC_WRITE_REG32(&__core_if->dev_if->out_ep_regs[__epnum]->doepint, \
++		doepint.d32); \
++} while (0)
++
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	uint32_t ep_intr;
++	doepint_data_t doepint = {.d32 = 0 };
++	uint32_t epnum = 0;
++	dwc_otg_pcd_ep_t *ep;
++	dwc_ep_t *dwc_ep;
++	dctl_data_t dctl = {.d32 = 0 };
++	gintmsk_data_t gintmsk = {.d32 = 0 };
++
++
++	DWC_DEBUGPL(DBG_PCDV, "%s()\n", __func__);
++
++	/* Read in the device interrupt bits */
++	ep_intr = dwc_otg_read_dev_all_out_ep_intr(core_if);
++
++	while (ep_intr) {
++		if (ep_intr & 0x1) {
++			/* Get EP pointer */
++			ep = get_out_ep(pcd, epnum);
++			dwc_ep = &ep->dwc_ep;
++
++#ifdef VERBOSE
++			DWC_DEBUGPL(DBG_PCDV,
++				    "EP%d-%s: type=%d, mps=%d\n",
++				    dwc_ep->num, (dwc_ep->is_in ? "IN" : "OUT"),
++				    dwc_ep->type, dwc_ep->maxpacket);
++#endif
++			doepint.d32 =
++			    dwc_otg_read_dev_out_ep_intr(core_if, dwc_ep);
++			/* Moved this interrupt upper due to core deffect of asserting
++			 * OUT EP 0 xfercompl along with stsphsrcvd in BDMA */
++			if (doepint.b.stsphsercvd) {
++				deptsiz0_data_t deptsiz;
++				CLEAR_OUT_EP_INTR(core_if, epnum, stsphsercvd);
++				deptsiz.d32 =
++				    DWC_READ_REG32(&core_if->dev_if->
++						   out_ep_regs[0]->doeptsiz);
++				if (core_if->snpsid >= OTG_CORE_REV_3_00a
++				    && core_if->dma_enable
++				    && core_if->dma_desc_enable == 0
++				    && doepint.b.xfercompl
++				    && deptsiz.b.xfersize == 24) {
++					CLEAR_OUT_EP_INTR(core_if, epnum,
++							  xfercompl);
++					doepint.b.xfercompl = 0;
++					ep0_out_start(core_if, pcd);
++				}
++				if ((core_if->dma_desc_enable) ||
++				    (core_if->dma_enable
++				     && core_if->snpsid >=
++				     OTG_CORE_REV_3_00a)) {
++					do_setup_in_status_phase(pcd);
++				}
++			}
++			/* Transfer complete */
++			if (doepint.b.xfercompl) {
++
++				if (epnum == 0) {
++					/* Clear the bit in DOEPINTn for this interrupt */
++					CLEAR_OUT_EP_INTR(core_if, epnum, xfercompl);
++					if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
++						DWC_DEBUGPL(DBG_PCDV, "DOEPINT=%x doepint=%x\n",
++							DWC_READ_REG32(&core_if->dev_if->out_ep_regs[0]->doepint),
++							doepint.d32);
++						DWC_DEBUGPL(DBG_PCDV, "DOEPCTL=%x \n",
++							DWC_READ_REG32(&core_if->dev_if->out_ep_regs[0]->doepctl));
++
++						if (core_if->snpsid >= OTG_CORE_REV_3_00a
++							&& core_if->dma_enable == 0) {
++							doepint_data_t doepint;
++							doepint.d32 = DWC_READ_REG32(&core_if->dev_if->
++														out_ep_regs[0]->doepint);
++							if (pcd->ep0state == EP0_IDLE && doepint.b.sr) {
++								CLEAR_OUT_EP_INTR(core_if, epnum, sr);
++								goto exit_xfercompl;
++							}
++						}
++						/* In case of DDMA  look at SR bit to go to the Data Stage */
++						if (core_if->dma_desc_enable) {
++							dev_dma_desc_sts_t status = {.d32 = 0};
++							if (pcd->ep0state == EP0_IDLE) {
++								status.d32 = core_if->dev_if->setup_desc_addr[core_if->
++											dev_if->setup_desc_index]->status.d32;
++								if(pcd->data_terminated) {
++									 pcd->data_terminated = 0;
++									 status.d32 = core_if->dev_if->out_desc_addr->status.d32;
++									 dwc_memcpy(&pcd->setup_pkt->req, pcd->backup_buf, 8);
++								}
++								if (status.b.sr) {
++									if (doepint.b.setup) {
++										DWC_DEBUGPL(DBG_PCDV, "DMA DESC EP0_IDLE SR=1 setup=1\n");
++										/* Already started data stage, clear setup */
++										CLEAR_OUT_EP_INTR(core_if, epnum, setup);
++										doepint.b.setup = 0;
++										handle_ep0(pcd);
++										/* Prepare for more setup packets */
++										if (pcd->ep0state == EP0_IN_STATUS_PHASE ||
++											pcd->ep0state == EP0_IN_DATA_PHASE) {
++											ep0_out_start(core_if, pcd);
++										}
++
++										goto exit_xfercompl;
++									} else {
++										/* Prepare for more setup packets */
++										DWC_DEBUGPL(DBG_PCDV,
++											"EP0_IDLE SR=1 setup=0 new setup comes\n");
++										ep0_out_start(core_if, pcd);
++									}
++								}
++							} else {
++								dwc_otg_pcd_request_t *req;
++								dev_dma_desc_sts_t status = {.d32 = 0};
++								diepint_data_t diepint0;
++								diepint0.d32 = DWC_READ_REG32(&core_if->dev_if->
++															in_ep_regs[0]->diepint);
++
++								if (pcd->ep0state == EP0_STALL || pcd->ep0state == EP0_DISCONNECT) {
++									DWC_ERROR("EP0 is stalled/disconnected\n");
++								}
++
++								/* Clear IN xfercompl if set */
++								if (diepint0.b.xfercompl && (pcd->ep0state == EP0_IN_STATUS_PHASE
++									|| pcd->ep0state == EP0_IN_DATA_PHASE)) {
++									DWC_WRITE_REG32(&core_if->dev_if->
++										in_ep_regs[0]->diepint, diepint0.d32);
++								}
++
++								status.d32 = core_if->dev_if->setup_desc_addr[core_if->
++									dev_if->setup_desc_index]->status.d32;
++
++								if (ep->dwc_ep.xfer_count != ep->dwc_ep.total_len
++									&& (pcd->ep0state == EP0_OUT_DATA_PHASE))
++									status.d32 = core_if->dev_if->out_desc_addr->status.d32;
++								if (pcd->ep0state == EP0_OUT_STATUS_PHASE)
++									status.d32 = core_if->dev_if->
++									out_desc_addr->status.d32;
++
++								if (status.b.sr) {
++									if (DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++										DWC_DEBUGPL(DBG_PCDV, "Request queue empty!!\n");
++									} else {
++										DWC_DEBUGPL(DBG_PCDV, "complete req!!\n");
++										req = DWC_CIRCLEQ_FIRST(&ep->queue);
++										if (ep->dwc_ep.xfer_count != ep->dwc_ep.total_len &&
++											pcd->ep0state == EP0_OUT_DATA_PHASE) {
++												/* Read arrived setup packet from req->buf */
++												dwc_memcpy(&pcd->setup_pkt->req,
++													req->buf + ep->dwc_ep.xfer_count, 8);
++										}
++										req->actual = ep->dwc_ep.xfer_count;
++										dwc_otg_request_done(ep, req, -ECONNRESET);
++										ep->dwc_ep.start_xfer_buff = 0;
++										ep->dwc_ep.xfer_buff = 0;
++										ep->dwc_ep.xfer_len = 0;
++									}
++									pcd->ep0state = EP0_IDLE;
++									if (doepint.b.setup) {
++										DWC_DEBUGPL(DBG_PCDV, "EP0_IDLE SR=1 setup=1\n");
++										/* Data stage started, clear setup */
++										CLEAR_OUT_EP_INTR(core_if, epnum, setup);
++										doepint.b.setup = 0;
++										handle_ep0(pcd);
++										/* Prepare for setup packets if ep0in was enabled*/
++										if (pcd->ep0state == EP0_IN_STATUS_PHASE) {
++											ep0_out_start(core_if, pcd);
++										}
++
++										goto exit_xfercompl;
++									} else {
++										/* Prepare for more setup packets */
++										DWC_DEBUGPL(DBG_PCDV,
++											"EP0_IDLE SR=1 setup=0 new setup comes 2\n");
++										ep0_out_start(core_if, pcd);
++									}
++								}
++							}
++						}
++						if (core_if->snpsid >= OTG_CORE_REV_2_94a && core_if->dma_enable
++							&& core_if->dma_desc_enable == 0) {
++							doepint_data_t doepint_temp = {.d32 = 0};
++							deptsiz0_data_t doeptsize0 = {.d32 = 0 };
++							doepint_temp.d32 = DWC_READ_REG32(&core_if->dev_if->
++															out_ep_regs[ep->dwc_ep.num]->doepint);
++							doeptsize0.d32 = DWC_READ_REG32(&core_if->dev_if->
++															out_ep_regs[ep->dwc_ep.num]->doeptsiz);
++							if (pcd->ep0state == EP0_IDLE) {
++								if (doepint_temp.b.sr) {
++									CLEAR_OUT_EP_INTR(core_if, epnum, sr);
++								}
++									doepint.d32 = DWC_READ_REG32(&core_if->dev_if->
++																	out_ep_regs[0]->doepint);
++									if (doeptsize0.b.supcnt == 3) {
++										DWC_DEBUGPL(DBG_ANY, "Rolling over!!!!!!!\n");
++										ep->dwc_ep.stp_rollover = 1;
++									}
++									if (doepint.b.setup) {
++retry:
++										/* Already started data stage, clear setup */
++										CLEAR_OUT_EP_INTR(core_if, epnum, setup);
++										doepint.b.setup = 0;
++										handle_ep0(pcd);
++										ep->dwc_ep.stp_rollover = 0;
++										/* Prepare for more setup packets */
++										if (pcd->ep0state == EP0_IN_STATUS_PHASE ||
++											pcd->ep0state == EP0_IN_DATA_PHASE) {
++											ep0_out_start(core_if, pcd);
++										}
++										goto exit_xfercompl;
++									} else {
++										/* Prepare for more setup packets */
++										DWC_DEBUGPL(DBG_ANY,
++											"EP0_IDLE SR=1 setup=0 new setup comes\n");
++										doepint.d32 = DWC_READ_REG32(&core_if->dev_if->
++																	out_ep_regs[0]->doepint);
++										if(doepint.b.setup)
++											goto retry;
++										ep0_out_start(core_if, pcd);
++									}
++							} else {
++								dwc_otg_pcd_request_t *req;
++								diepint_data_t diepint0 = {.d32 = 0};
++								doepint_data_t doepint_temp = {.d32 = 0};
++								depctl_data_t diepctl0;
++								diepint0.d32 = DWC_READ_REG32(&core_if->dev_if->
++																in_ep_regs[0]->diepint);
++								diepctl0.d32 = DWC_READ_REG32(&core_if->dev_if->
++																in_ep_regs[0]->diepctl);
++
++								if (pcd->ep0state == EP0_IN_DATA_PHASE
++									|| pcd->ep0state == EP0_IN_STATUS_PHASE) {
++									if (diepint0.b.xfercompl) {
++										DWC_WRITE_REG32(&core_if->dev_if->
++											in_ep_regs[0]->diepint, diepint0.d32);
++									}
++									if (diepctl0.b.epena) {
++										diepint_data_t diepint = {.d32 = 0};
++										diepctl0.b.snak = 1;
++										DWC_WRITE_REG32(&core_if->dev_if->
++														in_ep_regs[0]->diepctl, diepctl0.d32);
++										do {
++											dwc_udelay(10);
++											diepint.d32 = DWC_READ_REG32(&core_if->dev_if->
++												in_ep_regs[0]->diepint);
++										} while (!diepint.b.inepnakeff);
++										diepint.b.inepnakeff = 1;
++										DWC_WRITE_REG32(&core_if->dev_if->
++											in_ep_regs[0]->diepint, diepint.d32);
++										diepctl0.d32 = 0;
++										diepctl0.b.epdis = 1;
++										DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[0]->diepctl,
++														diepctl0.d32);
++										do {
++											dwc_udelay(10);
++											diepint.d32 = DWC_READ_REG32(&core_if->dev_if->
++												in_ep_regs[0]->diepint);
++										} while (!diepint.b.epdisabled);
++										diepint.b.epdisabled = 1;
++										DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[0]->diepint,
++															diepint.d32);
++									}
++								}
++								doepint_temp.d32 = DWC_READ_REG32(&core_if->dev_if->
++																out_ep_regs[ep->dwc_ep.num]->doepint);
++								if (doepint_temp.b.sr) {
++									CLEAR_OUT_EP_INTR(core_if, epnum, sr);
++									if (DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++										DWC_DEBUGPL(DBG_PCDV, "Request queue empty!!\n");
++									} else {
++										DWC_DEBUGPL(DBG_PCDV, "complete req!!\n");
++										req = DWC_CIRCLEQ_FIRST(&ep->queue);
++										if (ep->dwc_ep.xfer_count != ep->dwc_ep.total_len &&
++											pcd->ep0state == EP0_OUT_DATA_PHASE) {
++												/* Read arrived setup packet from req->buf */
++												dwc_memcpy(&pcd->setup_pkt->req,
++													req->buf + ep->dwc_ep.xfer_count, 8);
++										}
++										req->actual = ep->dwc_ep.xfer_count;
++										dwc_otg_request_done(ep, req, -ECONNRESET);
++										ep->dwc_ep.start_xfer_buff = 0;
++										ep->dwc_ep.xfer_buff = 0;
++										ep->dwc_ep.xfer_len = 0;
++									}
++									pcd->ep0state = EP0_IDLE;
++									if (doepint.b.setup) {
++										DWC_DEBUGPL(DBG_PCDV, "EP0_IDLE SR=1 setup=1\n");
++										/* Data stage started, clear setup */
++										CLEAR_OUT_EP_INTR(core_if, epnum, setup);
++										doepint.b.setup = 0;
++										handle_ep0(pcd);
++										/* Prepare for setup packets if ep0in was enabled*/
++										if (pcd->ep0state == EP0_IN_STATUS_PHASE) {
++											ep0_out_start(core_if, pcd);
++										}
++										goto exit_xfercompl;
++									} else {
++										/* Prepare for more setup packets */
++										DWC_DEBUGPL(DBG_PCDV,
++											"EP0_IDLE SR=1 setup=0 new setup comes 2\n");
++										ep0_out_start(core_if, pcd);
++									}
++								}
++							}
++						}
++						if (core_if->dma_enable == 0 || pcd->ep0state != EP0_IDLE)
++							handle_ep0(pcd);
++exit_xfercompl:
++						DWC_DEBUGPL(DBG_PCDV, "DOEPINT=%x doepint=%x\n",
++							dwc_otg_read_dev_out_ep_intr(core_if, dwc_ep), doepint.d32);
++					} else {
++					if (core_if->dma_desc_enable == 0
++					    || pcd->ep0state != EP0_IDLE)
++						handle_ep0(pcd);
++					}
++#ifdef DWC_EN_ISOC
++				} else if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
++					if (doepint.b.pktdrpsts == 0) {
++						/* Clear the bit in DOEPINTn for this interrupt */
++						CLEAR_OUT_EP_INTR(core_if,
++								  epnum,
++								  xfercompl);
++						complete_iso_ep(pcd, ep);
++					} else {
++
++						doepint_data_t doepint = {.d32 = 0 };
++						doepint.b.xfercompl = 1;
++						doepint.b.pktdrpsts = 1;
++						DWC_WRITE_REG32
++						    (&core_if->dev_if->out_ep_regs
++						     [epnum]->doepint,
++						     doepint.d32);
++						if (handle_iso_out_pkt_dropped
++						    (core_if, dwc_ep)) {
++							complete_iso_ep(pcd,
++									ep);
++						}
++					}
++#endif /* DWC_EN_ISOC */
++#ifdef DWC_UTE_PER_IO
++				} else if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
++					CLEAR_OUT_EP_INTR(core_if, epnum, xfercompl);
++					if (!ep->stopped)
++						complete_xiso_ep(ep);
++#endif /* DWC_UTE_PER_IO */
++				} else {
++					/* Clear the bit in DOEPINTn for this interrupt */
++					CLEAR_OUT_EP_INTR(core_if, epnum,
++							  xfercompl);
++
++					if (core_if->core_params->dev_out_nak) {
++						DWC_TIMER_CANCEL(pcd->core_if->ep_xfer_timer[epnum]);
++						pcd->core_if->ep_xfer_info[epnum].state = 0;
++#ifdef DEBUG
++						print_memory_payload(pcd, dwc_ep);
++#endif
++					}
++					complete_ep(ep);
++				}
++
++			}
++
++			/* Endpoint disable      */
++			if (doepint.b.epdisabled) {
++
++				/* Clear the bit in DOEPINTn for this interrupt */
++				CLEAR_OUT_EP_INTR(core_if, epnum, epdisabled);
++				if (core_if->core_params->dev_out_nak) {
++#ifdef DEBUG
++					print_memory_payload(pcd, dwc_ep);
++#endif
++					/* In case of timeout condition */
++					if (core_if->ep_xfer_info[epnum].state == 2) {
++						dctl.d32 = DWC_READ_REG32(&core_if->dev_if->
++										dev_global_regs->dctl);
++						dctl.b.cgoutnak = 1;
++						DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl,
++																dctl.d32);
++						/* Unmask goutnakeff interrupt which was masked
++						 * during handle nak out interrupt */
++						gintmsk.b.goutnakeff = 1;
++						DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk,
++																0, gintmsk.d32);
++
++						complete_ep(ep);
++					}
++				}
++				if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC)
++				{
++					dctl_data_t dctl;
++					gintmsk_data_t intr_mask = {.d32 = 0};
++					dwc_otg_pcd_request_t *req = 0;
++
++					dctl.d32 = DWC_READ_REG32(&core_if->dev_if->
++						dev_global_regs->dctl);
++					dctl.b.cgoutnak = 1;
++					DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl,
++						dctl.d32);
++
++					intr_mask.d32 = 0;
++					intr_mask.b.incomplisoout = 1;
++
++					/* Get any pending requests */
++					if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++						req = DWC_CIRCLEQ_FIRST(&ep->queue);
++						if (!req) {
++							DWC_PRINTF("complete_ep 0x%p, req = NULL!\n", ep);
++						} else {
++							dwc_otg_request_done(ep, req, 0);
++							start_next_request(ep);
++						}
++					} else {
++						DWC_PRINTF("complete_ep 0x%p, ep->queue empty!\n", ep);
++					}
++				}
++			}
++			/* AHB Error */
++			if (doepint.b.ahberr) {
++				DWC_ERROR("EP%d OUT AHB Error\n", epnum);
++				DWC_ERROR("EP%d DEPDMA=0x%08x \n",
++					  epnum, core_if->dev_if->out_ep_regs[epnum]->doepdma);
++				CLEAR_OUT_EP_INTR(core_if, epnum, ahberr);
++			}
++			/* Setup Phase Done (contorl EPs) */
++			if (doepint.b.setup) {
++#ifdef DEBUG_EP0
++				DWC_DEBUGPL(DBG_PCD, "EP%d SETUP Done\n", epnum);
++#endif
++				CLEAR_OUT_EP_INTR(core_if, epnum, setup);
++
++				handle_ep0(pcd);
++			}
++
++			/** OUT EP BNA Intr */
++			if (doepint.b.bna) {
++				CLEAR_OUT_EP_INTR(core_if, epnum, bna);
++				if (core_if->dma_desc_enable) {
++#ifdef DWC_EN_ISOC
++					if (dwc_ep->type ==
++					    DWC_OTG_EP_TYPE_ISOC) {
++						/*
++						 * This checking is performed to prevent first "false" BNA
++						 * handling occuring right after reconnect
++						 */
++						if (dwc_ep->next_frame !=
++						    0xffffffff)
++							dwc_otg_pcd_handle_iso_bna(ep);
++					} else
++#endif				/* DWC_EN_ISOC */
++					{
++						dwc_otg_pcd_handle_noniso_bna(ep);
++					}
++				}
++			}
++			/* Babble Interrupt */
++			if (doepint.b.babble) {
++				DWC_DEBUGPL(DBG_ANY, "EP%d OUT Babble\n",
++					    epnum);
++				handle_out_ep_babble_intr(pcd, epnum);
++
++				CLEAR_OUT_EP_INTR(core_if, epnum, babble);
++			}
++			if (doepint.b.outtknepdis) {
++				DWC_DEBUGPL(DBG_ANY, "EP%d OUT Token received when EP is \
++					disabled\n",epnum);
++				if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
++					doepmsk_data_t doepmsk = {.d32 = 0};
++					ep->dwc_ep.frame_num = core_if->frame_num;
++					if (ep->dwc_ep.bInterval > 1) {
++						depctl_data_t depctl;
++						depctl.d32 = DWC_READ_REG32(&core_if->dev_if->
++													out_ep_regs[epnum]->doepctl);
++						if (ep->dwc_ep.frame_num & 0x1) {
++							depctl.b.setd1pid = 1;
++							depctl.b.setd0pid = 0;
++						} else {
++							depctl.b.setd0pid = 1;
++							depctl.b.setd1pid = 0;
++						}
++						DWC_WRITE_REG32(&core_if->dev_if->
++										out_ep_regs[epnum]->doepctl, depctl.d32);
++					}
++					start_next_request(ep);
++					doepmsk.b.outtknepdis = 1;
++					DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->doepmsk,
++								 doepmsk.d32, 0);
++				}
++				CLEAR_OUT_EP_INTR(core_if, epnum, outtknepdis);
++			}
++
++			/* NAK Interrutp */
++			if (doepint.b.nak) {
++				DWC_DEBUGPL(DBG_ANY, "EP%d OUT NAK\n", epnum);
++				handle_out_ep_nak_intr(pcd, epnum);
++
++				CLEAR_OUT_EP_INTR(core_if, epnum, nak);
++			}
++			/* NYET Interrutp */
++			if (doepint.b.nyet) {
++				DWC_DEBUGPL(DBG_ANY, "EP%d OUT NYET\n", epnum);
++				handle_out_ep_nyet_intr(pcd, epnum);
++
++				CLEAR_OUT_EP_INTR(core_if, epnum, nyet);
++			}
++		}
++
++		epnum++;
++		ep_intr >>= 1;
++	}
++
++	return 1;
++
++#undef CLEAR_OUT_EP_INTR
++}
++static int drop_transfer(uint32_t trgt_fr, uint32_t curr_fr, uint8_t frm_overrun)
++{
++	int retval = 0;
++	if(!frm_overrun && curr_fr >= trgt_fr)
++		retval = 1;
++	else if (frm_overrun
++		 && (curr_fr >= trgt_fr && ((curr_fr - trgt_fr) < 0x3FFF / 2)))
++		retval = 1;
++	return retval;
++}
++/**
++ * Incomplete ISO IN Transfer Interrupt.
++ * This interrupt indicates one of the following conditions occurred
++ * while transmitting an ISOC transaction.
++ * - Corrupted IN Token for ISOC EP.
++ * - Packet not complete in FIFO.
++ * The follow actions will be taken:
++ *	-#	Determine the EP
++ *	-#	Set incomplete flag in dwc_ep structure
++ *	-#	Disable EP; when "Endpoint Disabled" interrupt is received
++ *		Flush FIFO
++ */
++int32_t dwc_otg_pcd_handle_incomplete_isoc_in_intr(dwc_otg_pcd_t * pcd)
++{
++	gintsts_data_t gintsts;
++
++#ifdef DWC_EN_ISOC
++	dwc_otg_dev_if_t *dev_if;
++	deptsiz_data_t deptsiz = {.d32 = 0 };
++	depctl_data_t depctl = {.d32 = 0 };
++	dsts_data_t dsts = {.d32 = 0 };
++	dwc_ep_t *dwc_ep;
++	int i;
++
++	dev_if = GET_CORE_IF(pcd)->dev_if;
++
++	for (i = 1; i <= dev_if->num_in_eps; ++i) {
++		dwc_ep = &pcd->in_ep[i].dwc_ep;
++		if (dwc_ep->active && dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
++			deptsiz.d32 =
++			    DWC_READ_REG32(&dev_if->in_ep_regs[i]->dieptsiz);
++			depctl.d32 =
++			    DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
++
++			if (depctl.b.epdis && deptsiz.d32) {
++				set_current_pkt_info(GET_CORE_IF(pcd), dwc_ep);
++				if (dwc_ep->cur_pkt >= dwc_ep->pkt_cnt) {
++					dwc_ep->cur_pkt = 0;
++					dwc_ep->proc_buf_num =
++					    (dwc_ep->proc_buf_num ^ 1) & 0x1;
++
++					if (dwc_ep->proc_buf_num) {
++						dwc_ep->cur_pkt_addr =
++						    dwc_ep->xfer_buff1;
++						dwc_ep->cur_pkt_dma_addr =
++						    dwc_ep->dma_addr1;
++					} else {
++						dwc_ep->cur_pkt_addr =
++						    dwc_ep->xfer_buff0;
++						dwc_ep->cur_pkt_dma_addr =
++						    dwc_ep->dma_addr0;
++					}
++
++				}
++
++				dsts.d32 =
++				    DWC_READ_REG32(&GET_CORE_IF(pcd)->dev_if->
++						   dev_global_regs->dsts);
++				dwc_ep->next_frame = dsts.b.soffn;
++
++				dwc_otg_iso_ep_start_frm_transfer(GET_CORE_IF
++								  (pcd),
++								  dwc_ep);
++			}
++		}
++	}
++
++#else
++	depctl_data_t depctl = {.d32 = 0 };
++	dwc_ep_t *dwc_ep;
++	dwc_otg_dev_if_t *dev_if;
++	int i;
++	dev_if = GET_CORE_IF(pcd)->dev_if;
++
++	DWC_DEBUGPL(DBG_PCD,"Incomplete ISO IN \n");
++
++	for (i = 1; i <= dev_if->num_in_eps; ++i) {
++		dwc_ep = &pcd->in_ep[i-1].dwc_ep;
++		depctl.d32 =
++			DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
++		if (depctl.b.epena && dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
++			if (drop_transfer(dwc_ep->frame_num, GET_CORE_IF(pcd)->frame_num,
++							dwc_ep->frm_overrun))
++			{
++				depctl.d32 =
++					DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
++				depctl.b.snak = 1;
++				depctl.b.epdis = 1;
++				DWC_MODIFY_REG32(&dev_if->in_ep_regs[i]->diepctl, depctl.d32, depctl.d32);
++			}
++		}
++	}
++
++	/*intr_mask.b.incomplisoin = 1;
++	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
++			 intr_mask.d32, 0);	 */
++#endif				//DWC_EN_ISOC
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.incomplisoin = 1;
++	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
++			gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * Incomplete ISO OUT Transfer Interrupt.
++ *
++ * This interrupt indicates that the core has dropped an ISO OUT
++ * packet. The following conditions can be the cause:
++ * - FIFO Full, the entire packet would not fit in the FIFO.
++ * - CRC Error
++ * - Corrupted Token
++ * The follow actions will be taken:
++ *	-#	Determine the EP
++ *	-#	Set incomplete flag in dwc_ep structure
++ *	-#	Read any data from the FIFO
++ *	-#	Disable EP. When "Endpoint Disabled" interrupt is received
++ *		re-enable EP.
++ */
++int32_t dwc_otg_pcd_handle_incomplete_isoc_out_intr(dwc_otg_pcd_t * pcd)
++{
++
++	gintsts_data_t gintsts;
++
++#ifdef DWC_EN_ISOC
++	dwc_otg_dev_if_t *dev_if;
++	deptsiz_data_t deptsiz = {.d32 = 0 };
++	depctl_data_t depctl = {.d32 = 0 };
++	dsts_data_t dsts = {.d32 = 0 };
++	dwc_ep_t *dwc_ep;
++	int i;
++
++	dev_if = GET_CORE_IF(pcd)->dev_if;
++
++	for (i = 1; i <= dev_if->num_out_eps; ++i) {
++		dwc_ep = &pcd->in_ep[i].dwc_ep;
++		if (pcd->out_ep[i].dwc_ep.active &&
++		    pcd->out_ep[i].dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
++			deptsiz.d32 =
++			    DWC_READ_REG32(&dev_if->out_ep_regs[i]->doeptsiz);
++			depctl.d32 =
++			    DWC_READ_REG32(&dev_if->out_ep_regs[i]->doepctl);
++
++			if (depctl.b.epdis && deptsiz.d32) {
++				set_current_pkt_info(GET_CORE_IF(pcd),
++						     &pcd->out_ep[i].dwc_ep);
++				if (dwc_ep->cur_pkt >= dwc_ep->pkt_cnt) {
++					dwc_ep->cur_pkt = 0;
++					dwc_ep->proc_buf_num =
++					    (dwc_ep->proc_buf_num ^ 1) & 0x1;
++
++					if (dwc_ep->proc_buf_num) {
++						dwc_ep->cur_pkt_addr =
++						    dwc_ep->xfer_buff1;
++						dwc_ep->cur_pkt_dma_addr =
++						    dwc_ep->dma_addr1;
++					} else {
++						dwc_ep->cur_pkt_addr =
++						    dwc_ep->xfer_buff0;
++						dwc_ep->cur_pkt_dma_addr =
++						    dwc_ep->dma_addr0;
++					}
++
++				}
++
++				dsts.d32 =
++				    DWC_READ_REG32(&GET_CORE_IF(pcd)->dev_if->
++						   dev_global_regs->dsts);
++				dwc_ep->next_frame = dsts.b.soffn;
++
++				dwc_otg_iso_ep_start_frm_transfer(GET_CORE_IF
++								  (pcd),
++								  dwc_ep);
++			}
++		}
++	}
++#else
++	/** @todo implement ISR */
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++	dwc_otg_core_if_t *core_if;
++	deptsiz_data_t deptsiz = {.d32 = 0 };
++	depctl_data_t depctl = {.d32 = 0 };
++	dctl_data_t dctl = {.d32 = 0 };
++	dwc_ep_t *dwc_ep = NULL;
++	int i;
++	core_if = GET_CORE_IF(pcd);
++
++	for (i = 0; i < core_if->dev_if->num_out_eps; ++i) {
++		dwc_ep = &pcd->out_ep[i].dwc_ep;
++		depctl.d32 =
++			DWC_READ_REG32(&core_if->dev_if->out_ep_regs[dwc_ep->num]->doepctl);
++		if (depctl.b.epena && depctl.b.dpid == (core_if->frame_num & 0x1)) {
++			core_if->dev_if->isoc_ep = dwc_ep;
++			deptsiz.d32 =
++					DWC_READ_REG32(&core_if->dev_if->out_ep_regs[dwc_ep->num]->doeptsiz);
++				break;
++		}
++	}
++	dctl.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dctl);
++	gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++	intr_mask.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
++
++	if (!intr_mask.b.goutnakeff) {
++		/* Unmask it */
++		intr_mask.b.goutnakeff = 1;
++		DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, intr_mask.d32);
++	}
++	if (!gintsts.b.goutnakeff) {
++		dctl.b.sgoutnak = 1;
++	}
++	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32);
++
++	depctl.d32 = DWC_READ_REG32(&core_if->dev_if->out_ep_regs[dwc_ep->num]->doepctl);
++	if (depctl.b.epena) {
++		depctl.b.epdis = 1;
++		depctl.b.snak = 1;
++	}
++	DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[dwc_ep->num]->doepctl, depctl.d32);
++
++	intr_mask.d32 = 0;
++	intr_mask.b.incomplisoout = 1;
++
++#endif /* DWC_EN_ISOC */
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.incomplisoout = 1;
++	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
++			gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * This function handles the Global IN NAK Effective interrupt.
++ *
++ */
++int32_t dwc_otg_pcd_handle_in_nak_effective(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_dev_if_t *dev_if = GET_CORE_IF(pcd)->dev_if;
++	depctl_data_t diepctl = {.d32 = 0 };
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++	gintsts_data_t gintsts;
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	int i;
++
++	DWC_DEBUGPL(DBG_PCD, "Global IN NAK Effective\n");
++
++	/* Disable all active IN EPs */
++	for (i = 0; i <= dev_if->num_in_eps; i++) {
++		diepctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
++		if (!(diepctl.b.eptype & 1) && diepctl.b.epena) {
++			if (core_if->start_predict > 0)
++				core_if->start_predict++;
++			diepctl.b.epdis = 1;
++			diepctl.b.snak = 1;
++			DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepctl, diepctl.d32);
++		}
++	}
++
++
++	/* Disable the Global IN NAK Effective Interrupt */
++	intr_mask.b.ginnakeff = 1;
++	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
++			 intr_mask.d32, 0);
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.ginnakeff = 1;
++	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
++			gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * OUT NAK Effective.
++ *
++ */
++int32_t dwc_otg_pcd_handle_out_nak_effective(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_dev_if_t *dev_if = GET_CORE_IF(pcd)->dev_if;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++	gintsts_data_t gintsts;
++	depctl_data_t doepctl;
++	int i;
++
++	/* Disable the Global OUT NAK Effective Interrupt */
++	intr_mask.b.goutnakeff = 1;
++	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
++		intr_mask.d32, 0);
++
++	/* If DEV OUT NAK enabled*/
++	if (pcd->core_if->core_params->dev_out_nak) {
++		/* Run over all out endpoints to determine the ep number on
++		 * which the timeout has happened
++		 */
++		for (i = 0; i <= dev_if->num_out_eps; i++) {
++			if ( pcd->core_if->ep_xfer_info[i].state == 2 )
++				break;
++		}
++		if (i > dev_if->num_out_eps) {
++			dctl_data_t dctl;
++			dctl.d32 =
++			    DWC_READ_REG32(&dev_if->dev_global_regs->dctl);
++			dctl.b.cgoutnak = 1;
++			DWC_WRITE_REG32(&dev_if->dev_global_regs->dctl,
++				dctl.d32);
++			goto out;
++		}
++
++		/* Disable the endpoint */
++		doepctl.d32 = DWC_READ_REG32(&dev_if->out_ep_regs[i]->doepctl);
++		if (doepctl.b.epena) {
++			doepctl.b.epdis = 1;
++			doepctl.b.snak = 1;
++		}
++		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doepctl, doepctl.d32);
++		return 1;
++	}
++	/* We come here from Incomplete ISO OUT handler */
++	if (dev_if->isoc_ep) {
++		dwc_ep_t *dwc_ep = (dwc_ep_t *)dev_if->isoc_ep;
++		uint32_t epnum = dwc_ep->num;
++		doepint_data_t doepint;
++		doepint.d32 =
++		    DWC_READ_REG32(&dev_if->out_ep_regs[dwc_ep->num]->doepint);
++		dev_if->isoc_ep = NULL;
++		doepctl.d32 =
++		    DWC_READ_REG32(&dev_if->out_ep_regs[epnum]->doepctl);
++		DWC_PRINTF("Before disable DOEPCTL = %08x\n", doepctl.d32);
++		if (doepctl.b.epena) {
++			doepctl.b.epdis = 1;
++			doepctl.b.snak = 1;
++		}
++		DWC_WRITE_REG32(&dev_if->out_ep_regs[epnum]->doepctl,
++				doepctl.d32);
++		return 1;
++	} else
++		DWC_PRINTF("INTERRUPT Handler not implemented for %s\n",
++			   "Global OUT NAK Effective\n");
++
++out:
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.goutnakeff = 1;
++	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
++			gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * PCD interrupt handler.
++ *
++ * The PCD handles the device interrupts.  Many conditions can cause a
++ * device interrupt. When an interrupt occurs, the device interrupt
++ * service routine determines the cause of the interrupt and
++ * dispatches handling to the appropriate function. These interrupt
++ * handling functions are described below.
++ *
++ * All interrupt registers are processed from LSB to MSB.
++ *
++ */
++int32_t dwc_otg_pcd_handle_intr(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++#ifdef VERBOSE
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++#endif
++	gintsts_data_t gintr_status;
++	int32_t retval = 0;
++
++	/* Exit from ISR if core is hibernated */
++	if (core_if->hibernation_suspend == 1) {
++		return retval;
++	}
++#ifdef VERBOSE
++	DWC_DEBUGPL(DBG_ANY, "%s() gintsts=%08x	 gintmsk=%08x\n",
++		    __func__,
++		    DWC_READ_REG32(&global_regs->gintsts),
++		    DWC_READ_REG32(&global_regs->gintmsk));
++#endif
++
++	if (dwc_otg_is_device_mode(core_if)) {
++		DWC_SPINLOCK(pcd->lock);
++#ifdef VERBOSE
++		DWC_DEBUGPL(DBG_PCDV, "%s() gintsts=%08x  gintmsk=%08x\n",
++			    __func__,
++			    DWC_READ_REG32(&global_regs->gintsts),
++			    DWC_READ_REG32(&global_regs->gintmsk));
++#endif
++
++		gintr_status.d32 = dwc_otg_read_core_intr(core_if);
++
++		DWC_DEBUGPL(DBG_PCDV, "%s: gintsts&gintmsk=%08x\n",
++			    __func__, gintr_status.d32);
++
++		if (gintr_status.b.sofintr) {
++			retval |= dwc_otg_pcd_handle_sof_intr(pcd);
++		}
++		if (gintr_status.b.rxstsqlvl) {
++			retval |=
++			    dwc_otg_pcd_handle_rx_status_q_level_intr(pcd);
++		}
++		if (gintr_status.b.nptxfempty) {
++			retval |= dwc_otg_pcd_handle_np_tx_fifo_empty_intr(pcd);
++		}
++		if (gintr_status.b.goutnakeff) {
++			retval |= dwc_otg_pcd_handle_out_nak_effective(pcd);
++		}
++		if (gintr_status.b.i2cintr) {
++			retval |= dwc_otg_pcd_handle_i2c_intr(pcd);
++		}
++		if (gintr_status.b.erlysuspend) {
++			retval |= dwc_otg_pcd_handle_early_suspend_intr(pcd);
++		}
++		if (gintr_status.b.usbreset) {
++			retval |= dwc_otg_pcd_handle_usb_reset_intr(pcd);
++		}
++		if (gintr_status.b.enumdone) {
++			retval |= dwc_otg_pcd_handle_enum_done_intr(pcd);
++		}
++		if (gintr_status.b.isooutdrop) {
++			retval |=
++			    dwc_otg_pcd_handle_isoc_out_packet_dropped_intr
++			    (pcd);
++		}
++		if (gintr_status.b.eopframe) {
++			retval |=
++			    dwc_otg_pcd_handle_end_periodic_frame_intr(pcd);
++		}
++		if (gintr_status.b.inepint) {
++			if (!core_if->multiproc_int_enable) {
++				retval |= dwc_otg_pcd_handle_in_ep_intr(pcd);
++			}
++		}
++		if (gintr_status.b.outepintr) {
++			if (!core_if->multiproc_int_enable) {
++				retval |= dwc_otg_pcd_handle_out_ep_intr(pcd);
++			}
++		}
++		if (gintr_status.b.epmismatch) {
++			retval |= dwc_otg_pcd_handle_ep_mismatch_intr(pcd);
++		}
++		if (gintr_status.b.fetsusp) {
++			retval |= dwc_otg_pcd_handle_ep_fetsusp_intr(pcd);
++		}
++		if (gintr_status.b.ginnakeff) {
++			retval |= dwc_otg_pcd_handle_in_nak_effective(pcd);
++		}
++		if (gintr_status.b.incomplisoin) {
++			retval |=
++			    dwc_otg_pcd_handle_incomplete_isoc_in_intr(pcd);
++		}
++		if (gintr_status.b.incomplisoout) {
++			retval |=
++			    dwc_otg_pcd_handle_incomplete_isoc_out_intr(pcd);
++		}
++
++		/* In MPI mode Device Endpoints interrupts are asserted
++		 * without setting outepintr and inepint bits set, so these
++		 * Interrupt handlers are called without checking these bit-fields
++		 */
++		if (core_if->multiproc_int_enable) {
++			retval |= dwc_otg_pcd_handle_in_ep_intr(pcd);
++			retval |= dwc_otg_pcd_handle_out_ep_intr(pcd);
++		}
++#ifdef VERBOSE
++		DWC_DEBUGPL(DBG_PCDV, "%s() gintsts=%0x\n", __func__,
++			    DWC_READ_REG32(&global_regs->gintsts));
++#endif
++		DWC_SPINUNLOCK(pcd->lock);
++	}
++	return retval;
++}
++
++#endif /* DWC_HOST_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c
+@@ -0,0 +1,1262 @@
++ /* ==========================================================================
++  * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_pcd_linux.c $
++  * $Revision: #21 $
++  * $Date: 2012/08/10 $
++  * $Change: 2047372 $
++  *
++  * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++  * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++  * otherwise expressly agreed to in writing between Synopsys and you.
++  *
++  * The Software IS NOT an item of Licensed Software or Licensed Product under
++  * any End User Software License Agreement or Agreement for Licensed Product
++  * with Synopsys or any supplement thereto. You are permitted to use and
++  * redistribute this Software in source and binary forms, with or without
++  * modification, provided that redistributions of source code must retain this
++  * notice. You may not view, use, disclose, copy or distribute this file or
++  * any information contained herein except pursuant to this license grant from
++  * Synopsys. If you do not agree with this notice, including the disclaimer
++  * below, then you are not authorized to use the Software.
++  *
++  * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++  * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++  * DAMAGE.
++  * ========================================================================== */
++#ifndef DWC_HOST_ONLY
++
++/** @file
++ * This file implements the Peripheral Controller Driver.
++ *
++ * The Peripheral Controller Driver (PCD) is responsible for
++ * translating requests from the Function Driver into the appropriate
++ * actions on the DWC_otg controller. It isolates the Function Driver
++ * from the specifics of the controller by providing an API to the
++ * Function Driver.
++ *
++ * The Peripheral Controller Driver for Linux will implement the
++ * Gadget API, so that the existing Gadget drivers can be used.
++ * (Gadget Driver is the Linux terminology for a Function Driver.)
++ *
++ * The Linux Gadget API is defined in the header file
++ * <code><linux/usb_gadget.h></code>.  The USB EP operations API is
++ * defined in the structure <code>usb_ep_ops</code> and the USB
++ * Controller API is defined in the structure
++ * <code>usb_gadget_ops</code>.
++ *
++ */
++
++#include "dwc_otg_os_dep.h"
++#include "dwc_otg_pcd_if.h"
++#include "dwc_otg_pcd.h"
++#include "dwc_otg_driver.h"
++#include "dwc_otg_dbg.h"
++
++extern bool fiq_enable;
++
++static struct gadget_wrapper {
++	dwc_otg_pcd_t *pcd;
++
++	struct usb_gadget gadget;
++	struct usb_gadget_driver *driver;
++
++	struct usb_ep ep0;
++	struct usb_ep in_ep[16];
++	struct usb_ep out_ep[16];
++
++} *gadget_wrapper;
++
++/* Display the contents of the buffer */
++extern void dump_msg(const u8 * buf, unsigned int length);
++/**
++ * Get the dwc_otg_pcd_ep_t* from usb_ep* pointer - NULL in case
++ * if the endpoint is not found
++ */
++static struct dwc_otg_pcd_ep *ep_from_handle(dwc_otg_pcd_t * pcd, void *handle)
++{
++	int i;
++	if (pcd->ep0.priv == handle) {
++		return &pcd->ep0;
++	}
++
++	for (i = 0; i < MAX_EPS_CHANNELS - 1; i++) {
++		if (pcd->in_ep[i].priv == handle)
++			return &pcd->in_ep[i];
++		if (pcd->out_ep[i].priv == handle)
++			return &pcd->out_ep[i];
++	}
++
++	return NULL;
++}
++
++/* USB Endpoint Operations */
++/*
++ * The following sections briefly describe the behavior of the Gadget
++ * API endpoint operations implemented in the DWC_otg driver
++ * software. Detailed descriptions of the generic behavior of each of
++ * these functions can be found in the Linux header file
++ * include/linux/usb_gadget.h.
++ *
++ * The Gadget API provides wrapper functions for each of the function
++ * pointers defined in usb_ep_ops. The Gadget Driver calls the wrapper
++ * function, which then calls the underlying PCD function. The
++ * following sections are named according to the wrapper
++ * functions. Within each section, the corresponding DWC_otg PCD
++ * function name is specified.
++ *
++ */
++
++/**
++ * This function is called by the Gadget Driver for each EP to be
++ * configured for the current configuration (SET_CONFIGURATION).
++ *
++ * This function initializes the dwc_otg_ep_t data structure, and then
++ * calls dwc_otg_ep_activate.
++ */
++static int ep_enable(struct usb_ep *usb_ep,
++		     const struct usb_endpoint_descriptor *ep_desc)
++{
++	int retval;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%p)\n", __func__, usb_ep, ep_desc);
++
++	if (!usb_ep || !ep_desc || ep_desc->bDescriptorType != USB_DT_ENDPOINT) {
++		DWC_WARN("%s, bad ep or descriptor\n", __func__);
++		return -EINVAL;
++	}
++	if (usb_ep == &gadget_wrapper->ep0) {
++		DWC_WARN("%s, bad ep(0)\n", __func__);
++		return -EINVAL;
++	}
++
++	/* Check FIFO size? */
++	if (!ep_desc->wMaxPacketSize) {
++		DWC_WARN("%s, bad %s maxpacket\n", __func__, usb_ep->name);
++		return -ERANGE;
++	}
++
++	if (!gadget_wrapper->driver ||
++	    gadget_wrapper->gadget.speed == USB_SPEED_UNKNOWN) {
++		DWC_WARN("%s, bogus device state\n", __func__);
++		return -ESHUTDOWN;
++	}
++
++	/* Delete after check - MAS */
++#if 0
++	nat = (uint32_t) ep_desc->wMaxPacketSize;
++	printk(KERN_ALERT "%s: nat (before) =%d\n", __func__, nat);
++	nat = (nat >> 11) & 0x03;
++	printk(KERN_ALERT "%s: nat (after) =%d\n", __func__, nat);
++#endif
++	retval = dwc_otg_pcd_ep_enable(gadget_wrapper->pcd,
++				       (const uint8_t *)ep_desc,
++				       (void *)usb_ep);
++	if (retval) {
++		DWC_WARN("dwc_otg_pcd_ep_enable failed\n");
++		return -EINVAL;
++	}
++
++	usb_ep->maxpacket = le16_to_cpu(ep_desc->wMaxPacketSize);
++
++	return 0;
++}
++
++/**
++ * This function is called when an EP is disabled due to disconnect or
++ * change in configuration. Any pending requests will terminate with a
++ * status of -ESHUTDOWN.
++ *
++ * This function modifies the dwc_otg_ep_t data structure for this EP,
++ * and then calls dwc_otg_ep_deactivate.
++ */
++static int ep_disable(struct usb_ep *usb_ep)
++{
++	int retval;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, usb_ep);
++	if (!usb_ep) {
++		DWC_DEBUGPL(DBG_PCD, "%s, %s not enabled\n", __func__,
++			    usb_ep ? usb_ep->name : NULL);
++		return -EINVAL;
++	}
++
++	retval = dwc_otg_pcd_ep_disable(gadget_wrapper->pcd, usb_ep);
++	if (retval) {
++		retval = -EINVAL;
++	}
++
++	return retval;
++}
++
++/**
++ * This function allocates a request object to use with the specified
++ * endpoint.
++ *
++ * @param ep The endpoint to be used with with the request
++ * @param gfp_flags the GFP_* flags to use.
++ */
++static struct usb_request *dwc_otg_pcd_alloc_request(struct usb_ep *ep,
++						     gfp_t gfp_flags)
++{
++	struct usb_request *usb_req;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%d)\n", __func__, ep, gfp_flags);
++	if (0 == ep) {
++		DWC_WARN("%s() %s\n", __func__, "Invalid EP!\n");
++		return 0;
++	}
++	usb_req = kzalloc(sizeof(*usb_req), gfp_flags);
++	if (0 == usb_req) {
++		DWC_WARN("%s() %s\n", __func__, "request allocation failed!\n");
++		return 0;
++	}
++	usb_req->dma = DWC_DMA_ADDR_INVALID;
++
++	return usb_req;
++}
++
++/**
++ * This function frees a request object.
++ *
++ * @param ep The endpoint associated with the request
++ * @param req The request being freed
++ */
++static void dwc_otg_pcd_free_request(struct usb_ep *ep, struct usb_request *req)
++{
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%p)\n", __func__, ep, req);
++
++	if (0 == ep || 0 == req) {
++		DWC_WARN("%s() %s\n", __func__,
++			 "Invalid ep or req argument!\n");
++		return;
++	}
++
++	kfree(req);
++}
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
++/**
++ * This function allocates an I/O buffer to be used for a transfer
++ * to/from the specified endpoint.
++ *
++ * @param usb_ep The endpoint to be used with with the request
++ * @param bytes The desired number of bytes for the buffer
++ * @param dma Pointer to the buffer's DMA address; must be valid
++ * @param gfp_flags the GFP_* flags to use.
++ * @return address of a new buffer or null is buffer could not be allocated.
++ */
++static void *dwc_otg_pcd_alloc_buffer(struct usb_ep *usb_ep, unsigned bytes,
++				      dma_addr_t * dma, gfp_t gfp_flags)
++{
++	void *buf;
++	dwc_otg_pcd_t *pcd = 0;
++
++	pcd = gadget_wrapper->pcd;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%d,%p,%0x)\n", __func__, usb_ep, bytes,
++		    dma, gfp_flags);
++
++	/* Check dword alignment */
++	if ((bytes & 0x3UL) != 0) {
++		DWC_WARN("%s() Buffer size is not a multiple of"
++			 "DWORD size (%d)", __func__, bytes);
++	}
++
++	buf = dma_alloc_coherent(NULL, bytes, dma, gfp_flags);
++	WARN_ON(!buf);
++
++	/* Check dword alignment */
++	if (((int)buf & 0x3UL) != 0) {
++		DWC_WARN("%s() Buffer is not DWORD aligned (%p)",
++			 __func__, buf);
++	}
++
++	return buf;
++}
++
++/**
++ * This function frees an I/O buffer that was allocated by alloc_buffer.
++ *
++ * @param usb_ep the endpoint associated with the buffer
++ * @param buf address of the buffer
++ * @param dma The buffer's DMA address
++ * @param bytes The number of bytes of the buffer
++ */
++static void dwc_otg_pcd_free_buffer(struct usb_ep *usb_ep, void *buf,
++				    dma_addr_t dma, unsigned bytes)
++{
++	dwc_otg_pcd_t *pcd = 0;
++
++	pcd = gadget_wrapper->pcd;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%0x,%d)\n", __func__, buf, dma, bytes);
++
++	dma_free_coherent(NULL, bytes, buf, dma);
++}
++#endif
++
++/**
++ * This function is used to submit an I/O Request to an EP.
++ *
++ *	- When the request completes the request's completion callback
++ *	  is called to return the request to the driver.
++ *	- An EP, except control EPs, may have multiple requests
++ *	  pending.
++ *	- Once submitted the request cannot be examined or modified.
++ *	- Each request is turned into one or more packets.
++ *	- A BULK EP can queue any amount of data; the transfer is
++ *	  packetized.
++ *	- Zero length Packets are specified with the request 'zero'
++ *	  flag.
++ */
++static int ep_queue(struct usb_ep *usb_ep, struct usb_request *usb_req,
++		    gfp_t gfp_flags)
++{
++	dwc_otg_pcd_t *pcd;
++	struct dwc_otg_pcd_ep *ep = NULL;
++	int retval = 0, is_isoc_ep = 0;
++	dma_addr_t dma_addr = DWC_DMA_ADDR_INVALID;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%p,%d)\n",
++		    __func__, usb_ep, usb_req, gfp_flags);
++
++	if (!usb_req || !usb_req->complete || !usb_req->buf) {
++		DWC_WARN("bad params\n");
++		return -EINVAL;
++	}
++
++	if (!usb_ep) {
++		DWC_WARN("bad ep\n");
++		return -EINVAL;
++	}
++
++	pcd = gadget_wrapper->pcd;
++	if (!gadget_wrapper->driver ||
++	    gadget_wrapper->gadget.speed == USB_SPEED_UNKNOWN) {
++		DWC_DEBUGPL(DBG_PCDV, "gadget.speed=%d\n",
++			    gadget_wrapper->gadget.speed);
++		DWC_WARN("bogus device state\n");
++		return -ESHUTDOWN;
++	}
++
++	DWC_DEBUGPL(DBG_PCD, "%s queue req %p, len %d buf %p\n",
++		    usb_ep->name, usb_req, usb_req->length, usb_req->buf);
++
++	usb_req->status = -EINPROGRESS;
++	usb_req->actual = 0;
++
++	ep = ep_from_handle(pcd, usb_ep);
++	if (ep == NULL)
++		is_isoc_ep = 0;
++	else
++		is_isoc_ep = (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) ? 1 : 0;
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
++	dma_addr = usb_req->dma;
++#else
++	if (GET_CORE_IF(pcd)->dma_enable) {
++                dwc_otg_device_t *otg_dev = gadget_wrapper->pcd->otg_dev;
++                struct device *dev = NULL;
++
++                if (otg_dev != NULL)
++                        dev = DWC_OTG_OS_GETDEV(otg_dev->os_dep);
++
++		if (usb_req->length != 0 &&
++                    usb_req->dma == DWC_DMA_ADDR_INVALID) {
++                        dma_addr = dma_map_single(dev, usb_req->buf,
++                                                  usb_req->length,
++                                                  ep->dwc_ep.is_in ?
++                                                        DMA_TO_DEVICE:
++                                                        DMA_FROM_DEVICE);
++		}
++	}
++#endif
++
++#ifdef DWC_UTE_PER_IO
++	if (is_isoc_ep == 1) {
++		retval = dwc_otg_pcd_xiso_ep_queue(pcd, usb_ep, usb_req->buf, dma_addr,
++			usb_req->length, usb_req->zero, usb_req,
++			gfp_flags == GFP_ATOMIC ? 1 : 0, &usb_req->ext_req);
++		if (retval)
++			return -EINVAL;
++
++		return 0;
++	}
++#endif
++	retval = dwc_otg_pcd_ep_queue(pcd, usb_ep, usb_req->buf, dma_addr,
++				      usb_req->length, usb_req->zero, usb_req,
++				      gfp_flags == GFP_ATOMIC ? 1 : 0);
++	if (retval) {
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/**
++ * This function cancels an I/O request from an EP.
++ */
++static int ep_dequeue(struct usb_ep *usb_ep, struct usb_request *usb_req)
++{
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%p)\n", __func__, usb_ep, usb_req);
++
++	if (!usb_ep || !usb_req) {
++		DWC_WARN("bad argument\n");
++		return -EINVAL;
++	}
++	if (!gadget_wrapper->driver ||
++	    gadget_wrapper->gadget.speed == USB_SPEED_UNKNOWN) {
++		DWC_WARN("bogus device state\n");
++		return -ESHUTDOWN;
++	}
++	if (dwc_otg_pcd_ep_dequeue(gadget_wrapper->pcd, usb_ep, usb_req)) {
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/**
++ * usb_ep_set_halt stalls an endpoint.
++ *
++ * usb_ep_clear_halt clears an endpoint halt and resets its data
++ * toggle.
++ *
++ * Both of these functions are implemented with the same underlying
++ * function. The behavior depends on the value argument.
++ *
++ * @param[in] usb_ep the Endpoint to halt or clear halt.
++ * @param[in] value
++ *	- 0 means clear_halt.
++ *	- 1 means set_halt,
++ *	- 2 means clear stall lock flag.
++ *	- 3 means set  stall lock flag.
++ */
++static int ep_halt(struct usb_ep *usb_ep, int value)
++{
++	int retval = 0;
++
++	DWC_DEBUGPL(DBG_PCD, "HALT %s %d\n", usb_ep->name, value);
++
++	if (!usb_ep) {
++		DWC_WARN("bad ep\n");
++		return -EINVAL;
++	}
++
++	retval = dwc_otg_pcd_ep_halt(gadget_wrapper->pcd, usb_ep, value);
++	if (retval == -DWC_E_AGAIN) {
++		return -EAGAIN;
++	} else if (retval) {
++		retval = -EINVAL;
++	}
++
++	return retval;
++}
++
++//#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30))
++#if 0
++/**
++ * ep_wedge: sets the halt feature and ignores clear requests
++ *
++ * @usb_ep: the endpoint being wedged
++ *
++ * Use this to stall an endpoint and ignore CLEAR_FEATURE(HALT_ENDPOINT)
++ * requests. If the gadget driver clears the halt status, it will
++ * automatically unwedge the endpoint.
++ *
++ * Returns zero on success, else negative errno. *
++ * Check usb_ep_set_wedge() at "usb_gadget.h" for details
++ */
++static int ep_wedge(struct usb_ep *usb_ep)
++{
++	int retval = 0;
++
++	DWC_DEBUGPL(DBG_PCD, "WEDGE %s\n", usb_ep->name);
++
++	if (!usb_ep) {
++		DWC_WARN("bad ep\n");
++		return -EINVAL;
++	}
++
++	retval = dwc_otg_pcd_ep_wedge(gadget_wrapper->pcd, usb_ep);
++	if (retval == -DWC_E_AGAIN) {
++		retval = -EAGAIN;
++	} else if (retval) {
++		retval = -EINVAL;
++	}
++
++	return retval;
++}
++#endif
++
++#ifdef DWC_EN_ISOC
++/**
++ * This function is used to submit an ISOC Transfer Request to an EP.
++ *
++ *	- Every time a sync period completes the request's completion callback
++ *	  is called to provide data to the gadget driver.
++ *	- Once submitted the request cannot be modified.
++ *	- Each request is turned into periodic data packets untill ISO
++ *	  Transfer is stopped..
++ */
++static int iso_ep_start(struct usb_ep *usb_ep, struct usb_iso_request *req,
++			gfp_t gfp_flags)
++{
++	int retval = 0;
++
++	if (!req || !req->process_buffer || !req->buf0 || !req->buf1) {
++		DWC_WARN("bad params\n");
++		return -EINVAL;
++	}
++
++	if (!usb_ep) {
++		DWC_PRINTF("bad params\n");
++		return -EINVAL;
++	}
++
++	req->status = -EINPROGRESS;
++
++	retval =
++	    dwc_otg_pcd_iso_ep_start(gadget_wrapper->pcd, usb_ep, req->buf0,
++				     req->buf1, req->dma0, req->dma1,
++				     req->sync_frame, req->data_pattern_frame,
++				     req->data_per_frame,
++				     req->
++				     flags & USB_REQ_ISO_ASAP ? -1 :
++				     req->start_frame, req->buf_proc_intrvl,
++				     req, gfp_flags == GFP_ATOMIC ? 1 : 0);
++
++	if (retval) {
++		return -EINVAL;
++	}
++
++	return retval;
++}
++
++/**
++ * This function stops ISO EP Periodic Data Transfer.
++ */
++static int iso_ep_stop(struct usb_ep *usb_ep, struct usb_iso_request *req)
++{
++	int retval = 0;
++	if (!usb_ep) {
++		DWC_WARN("bad ep\n");
++	}
++
++	if (!gadget_wrapper->driver ||
++	    gadget_wrapper->gadget.speed == USB_SPEED_UNKNOWN) {
++		DWC_DEBUGPL(DBG_PCDV, "gadget.speed=%d\n",
++			    gadget_wrapper->gadget.speed);
++		DWC_WARN("bogus device state\n");
++	}
++
++	dwc_otg_pcd_iso_ep_stop(gadget_wrapper->pcd, usb_ep, req);
++	if (retval) {
++		retval = -EINVAL;
++	}
++
++	return retval;
++}
++
++static struct usb_iso_request *alloc_iso_request(struct usb_ep *ep,
++						 int packets, gfp_t gfp_flags)
++{
++	struct usb_iso_request *pReq = NULL;
++	uint32_t req_size;
++
++	req_size = sizeof(struct usb_iso_request);
++	req_size +=
++	    (2 * packets * (sizeof(struct usb_gadget_iso_packet_descriptor)));
++
++	pReq = kmalloc(req_size, gfp_flags);
++	if (!pReq) {
++		DWC_WARN("Can't allocate Iso Request\n");
++		return 0;
++	}
++	pReq->iso_packet_desc0 = (void *)(pReq + 1);
++
++	pReq->iso_packet_desc1 = pReq->iso_packet_desc0 + packets;
++
++	return pReq;
++}
++
++static void free_iso_request(struct usb_ep *ep, struct usb_iso_request *req)
++{
++	kfree(req);
++}
++
++static struct usb_isoc_ep_ops dwc_otg_pcd_ep_ops = {
++	.ep_ops = {
++		   .enable = ep_enable,
++		   .disable = ep_disable,
++
++		   .alloc_request = dwc_otg_pcd_alloc_request,
++		   .free_request = dwc_otg_pcd_free_request,
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
++		   .alloc_buffer = dwc_otg_pcd_alloc_buffer,
++		   .free_buffer = dwc_otg_pcd_free_buffer,
++#endif
++
++		   .queue = ep_queue,
++		   .dequeue = ep_dequeue,
++
++		   .set_halt = ep_halt,
++		   .fifo_status = 0,
++		   .fifo_flush = 0,
++		   },
++	.iso_ep_start = iso_ep_start,
++	.iso_ep_stop = iso_ep_stop,
++	.alloc_iso_request = alloc_iso_request,
++	.free_iso_request = free_iso_request,
++};
++
++#else
++
++	int (*enable) (struct usb_ep *ep,
++		const struct usb_endpoint_descriptor *desc);
++	int (*disable) (struct usb_ep *ep);
++
++	struct usb_request *(*alloc_request) (struct usb_ep *ep,
++		gfp_t gfp_flags);
++	void (*free_request) (struct usb_ep *ep, struct usb_request *req);
++
++	int (*queue) (struct usb_ep *ep, struct usb_request *req,
++		gfp_t gfp_flags);
++	int (*dequeue) (struct usb_ep *ep, struct usb_request *req);
++
++	int (*set_halt) (struct usb_ep *ep, int value);
++	int (*set_wedge) (struct usb_ep *ep);
++
++	int (*fifo_status) (struct usb_ep *ep);
++	void (*fifo_flush) (struct usb_ep *ep);
++static struct usb_ep_ops dwc_otg_pcd_ep_ops = {
++	.enable = ep_enable,
++	.disable = ep_disable,
++
++	.alloc_request = dwc_otg_pcd_alloc_request,
++	.free_request = dwc_otg_pcd_free_request,
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
++	.alloc_buffer = dwc_otg_pcd_alloc_buffer,
++	.free_buffer = dwc_otg_pcd_free_buffer,
++#else
++	/* .set_wedge = ep_wedge, */
++        .set_wedge = NULL, /* uses set_halt instead */
++#endif
++
++	.queue = ep_queue,
++	.dequeue = ep_dequeue,
++
++	.set_halt = ep_halt,
++	.fifo_status = 0,
++	.fifo_flush = 0,
++
++};
++
++#endif /* _EN_ISOC_ */
++/*	Gadget Operations */
++/**
++ * The following gadget operations will be implemented in the DWC_otg
++ * PCD. Functions in the API that are not described below are not
++ * implemented.
++ *
++ * The Gadget API provides wrapper functions for each of the function
++ * pointers defined in usb_gadget_ops. The Gadget Driver calls the
++ * wrapper function, which then calls the underlying PCD function. The
++ * following sections are named according to the wrapper functions
++ * (except for ioctl, which doesn't have a wrapper function). Within
++ * each section, the corresponding DWC_otg PCD function name is
++ * specified.
++ *
++ */
++
++/**
++ *Gets the USB Frame number of the last SOF.
++ */
++static int get_frame_number(struct usb_gadget *gadget)
++{
++	struct gadget_wrapper *d;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, gadget);
++
++	if (gadget == 0) {
++		return -ENODEV;
++	}
++
++	d = container_of(gadget, struct gadget_wrapper, gadget);
++	return dwc_otg_pcd_get_frame_number(d->pcd);
++}
++
++#ifdef CONFIG_USB_DWC_OTG_LPM
++static int test_lpm_enabled(struct usb_gadget *gadget)
++{
++	struct gadget_wrapper *d;
++
++	d = container_of(gadget, struct gadget_wrapper, gadget);
++
++	return dwc_otg_pcd_is_lpm_enabled(d->pcd);
++}
++#endif
++
++/**
++ * Initiates Session Request Protocol (SRP) to wakeup the host if no
++ * session is in progress. If a session is already in progress, but
++ * the device is suspended, remote wakeup signaling is started.
++ *
++ */
++static int wakeup(struct usb_gadget *gadget)
++{
++	struct gadget_wrapper *d;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, gadget);
++
++	if (gadget == 0) {
++		return -ENODEV;
++	} else {
++		d = container_of(gadget, struct gadget_wrapper, gadget);
++	}
++	dwc_otg_pcd_wakeup(d->pcd);
++	return 0;
++}
++
++static const struct usb_gadget_ops dwc_otg_pcd_ops = {
++	.get_frame = get_frame_number,
++	.wakeup = wakeup,
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	.lpm_support = test_lpm_enabled,
++#endif
++	// current versions must always be self-powered
++};
++
++static int _setup(dwc_otg_pcd_t * pcd, uint8_t * bytes)
++{
++	int retval = -DWC_E_NOT_SUPPORTED;
++	if (gadget_wrapper->driver && gadget_wrapper->driver->setup) {
++		retval = gadget_wrapper->driver->setup(&gadget_wrapper->gadget,
++						       (struct usb_ctrlrequest
++							*)bytes);
++	}
++
++	if (retval == -ENOTSUPP) {
++		retval = -DWC_E_NOT_SUPPORTED;
++	} else if (retval < 0) {
++		retval = -DWC_E_INVALID;
++	}
++
++	return retval;
++}
++
++#ifdef DWC_EN_ISOC
++static int _isoc_complete(dwc_otg_pcd_t * pcd, void *ep_handle,
++			  void *req_handle, int proc_buf_num)
++{
++	int i, packet_count;
++	struct usb_gadget_iso_packet_descriptor *iso_packet = 0;
++	struct usb_iso_request *iso_req = req_handle;
++
++	if (proc_buf_num) {
++		iso_packet = iso_req->iso_packet_desc1;
++	} else {
++		iso_packet = iso_req->iso_packet_desc0;
++	}
++	packet_count =
++	    dwc_otg_pcd_get_iso_packet_count(pcd, ep_handle, req_handle);
++	for (i = 0; i < packet_count; ++i) {
++		int status;
++		int actual;
++		int offset;
++		dwc_otg_pcd_get_iso_packet_params(pcd, ep_handle, req_handle,
++						  i, &status, &actual, &offset);
++		switch (status) {
++		case -DWC_E_NO_DATA:
++			status = -ENODATA;
++			break;
++		default:
++			if (status) {
++				DWC_PRINTF("unknown status in isoc packet\n");
++			}
++
++		}
++		iso_packet[i].status = status;
++		iso_packet[i].offset = offset;
++		iso_packet[i].actual_length = actual;
++	}
++
++	iso_req->status = 0;
++	iso_req->process_buffer(ep_handle, iso_req);
++
++	return 0;
++}
++#endif /* DWC_EN_ISOC */
++
++#ifdef DWC_UTE_PER_IO
++/**
++ * Copy the contents of the extended request to the Linux usb_request's
++ * extended part and call the gadget's completion.
++ *
++ * @param pcd			Pointer to the pcd structure
++ * @param ep_handle		Void pointer to the usb_ep structure
++ * @param req_handle	Void pointer to the usb_request structure
++ * @param status		Request status returned from the portable logic
++ * @param ereq_port		Void pointer to the extended request structure
++ *						created in the the portable part that contains the
++ *						results of the processed iso packets.
++ */
++static int _xisoc_complete(dwc_otg_pcd_t * pcd, void *ep_handle,
++			   void *req_handle, int32_t status, void *ereq_port)
++{
++	struct dwc_ute_iso_req_ext *ereqorg = NULL;
++	struct dwc_iso_xreq_port *ereqport = NULL;
++	struct dwc_ute_iso_packet_descriptor *desc_org = NULL;
++	int i;
++	struct usb_request *req;
++	//struct dwc_ute_iso_packet_descriptor *
++	//int status = 0;
++
++	req = (struct usb_request *)req_handle;
++	ereqorg = &req->ext_req;
++	ereqport = (struct dwc_iso_xreq_port *)ereq_port;
++	desc_org = ereqorg->per_io_frame_descs;
++
++	if (req && req->complete) {
++		/* Copy the request data from the portable logic to our request */
++		for (i = 0; i < ereqport->pio_pkt_count; i++) {
++			desc_org[i].actual_length =
++			    ereqport->per_io_frame_descs[i].actual_length;
++			desc_org[i].status =
++			    ereqport->per_io_frame_descs[i].status;
++		}
++
++		switch (status) {
++		case -DWC_E_SHUTDOWN:
++			req->status = -ESHUTDOWN;
++			break;
++		case -DWC_E_RESTART:
++			req->status = -ECONNRESET;
++			break;
++		case -DWC_E_INVALID:
++			req->status = -EINVAL;
++			break;
++		case -DWC_E_TIMEOUT:
++			req->status = -ETIMEDOUT;
++			break;
++		default:
++			req->status = status;
++		}
++
++		/* And call the gadget's completion */
++		req->complete(ep_handle, req);
++	}
++
++	return 0;
++}
++#endif /* DWC_UTE_PER_IO */
++
++static int _complete(dwc_otg_pcd_t * pcd, void *ep_handle,
++		     void *req_handle, int32_t status, uint32_t actual)
++{
++	struct usb_request *req = (struct usb_request *)req_handle;
++#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,27)
++	struct dwc_otg_pcd_ep *ep = NULL;
++#endif
++
++	if (req && req->complete) {
++		switch (status) {
++		case -DWC_E_SHUTDOWN:
++			req->status = -ESHUTDOWN;
++			break;
++		case -DWC_E_RESTART:
++			req->status = -ECONNRESET;
++			break;
++		case -DWC_E_INVALID:
++			req->status = -EINVAL;
++			break;
++		case -DWC_E_TIMEOUT:
++			req->status = -ETIMEDOUT;
++			break;
++		default:
++			req->status = status;
++
++		}
++
++		req->actual = actual;
++		DWC_SPINUNLOCK(pcd->lock);
++		req->complete(ep_handle, req);
++		DWC_SPINLOCK(pcd->lock);
++	}
++#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,27)
++	ep = ep_from_handle(pcd, ep_handle);
++	if (GET_CORE_IF(pcd)->dma_enable) {
++                if (req->length != 0) {
++                        dwc_otg_device_t *otg_dev = gadget_wrapper->pcd->otg_dev;
++                        struct device *dev = NULL;
++
++                        if (otg_dev != NULL)
++                                  dev = DWC_OTG_OS_GETDEV(otg_dev->os_dep);
++
++			dma_unmap_single(dev, req->dma, req->length,
++                                         ep->dwc_ep.is_in ?
++                                                DMA_TO_DEVICE: DMA_FROM_DEVICE);
++                }
++	}
++#endif
++
++	return 0;
++}
++
++static int _connect(dwc_otg_pcd_t * pcd, int speed)
++{
++	gadget_wrapper->gadget.speed = speed;
++	return 0;
++}
++
++static int _disconnect(dwc_otg_pcd_t * pcd)
++{
++	if (gadget_wrapper->driver && gadget_wrapper->driver->disconnect) {
++		gadget_wrapper->driver->disconnect(&gadget_wrapper->gadget);
++	}
++	return 0;
++}
++
++static int _resume(dwc_otg_pcd_t * pcd)
++{
++	if (gadget_wrapper->driver && gadget_wrapper->driver->resume) {
++		gadget_wrapper->driver->resume(&gadget_wrapper->gadget);
++	}
++
++	return 0;
++}
++
++static int _suspend(dwc_otg_pcd_t * pcd)
++{
++	if (gadget_wrapper->driver && gadget_wrapper->driver->suspend) {
++		gadget_wrapper->driver->suspend(&gadget_wrapper->gadget);
++	}
++	return 0;
++}
++
++/**
++ * This function updates the otg values in the gadget structure.
++ */
++static int _hnp_changed(dwc_otg_pcd_t * pcd)
++{
++
++	if (!gadget_wrapper->gadget.is_otg)
++		return 0;
++
++	gadget_wrapper->gadget.b_hnp_enable = get_b_hnp_enable(pcd);
++	gadget_wrapper->gadget.a_hnp_support = get_a_hnp_support(pcd);
++	gadget_wrapper->gadget.a_alt_hnp_support = get_a_alt_hnp_support(pcd);
++	return 0;
++}
++
++static int _reset(dwc_otg_pcd_t * pcd)
++{
++	return 0;
++}
++
++#ifdef DWC_UTE_CFI
++static int _cfi_setup(dwc_otg_pcd_t * pcd, void *cfi_req)
++{
++	int retval = -DWC_E_INVALID;
++	if (gadget_wrapper->driver->cfi_feature_setup) {
++		retval =
++		    gadget_wrapper->driver->
++		    cfi_feature_setup(&gadget_wrapper->gadget,
++				      (struct cfi_usb_ctrlrequest *)cfi_req);
++	}
++
++	return retval;
++}
++#endif
++
++static const struct dwc_otg_pcd_function_ops fops = {
++	.complete = _complete,
++#ifdef DWC_EN_ISOC
++	.isoc_complete = _isoc_complete,
++#endif
++	.setup = _setup,
++	.disconnect = _disconnect,
++	.connect = _connect,
++	.resume = _resume,
++	.suspend = _suspend,
++	.hnp_changed = _hnp_changed,
++	.reset = _reset,
++#ifdef DWC_UTE_CFI
++	.cfi_setup = _cfi_setup,
++#endif
++#ifdef DWC_UTE_PER_IO
++	.xisoc_complete = _xisoc_complete,
++#endif
++};
++
++/**
++ * This function is the top level PCD interrupt handler.
++ */
++static irqreturn_t dwc_otg_pcd_irq(int irq, void *dev)
++{
++	dwc_otg_pcd_t *pcd = dev;
++	int32_t retval = IRQ_NONE;
++
++	retval = dwc_otg_pcd_handle_intr(pcd);
++	if (retval != 0) {
++		S3C2410X_CLEAR_EINTPEND();
++	}
++	return IRQ_RETVAL(retval);
++}
++
++/**
++ * This function initialized the usb_ep structures to there default
++ * state.
++ *
++ * @param d Pointer on gadget_wrapper.
++ */
++void gadget_add_eps(struct gadget_wrapper *d)
++{
++	static const char *names[] = {
++
++		"ep0",
++		"ep1in",
++		"ep2in",
++		"ep3in",
++		"ep4in",
++		"ep5in",
++		"ep6in",
++		"ep7in",
++		"ep8in",
++		"ep9in",
++		"ep10in",
++		"ep11in",
++		"ep12in",
++		"ep13in",
++		"ep14in",
++		"ep15in",
++		"ep1out",
++		"ep2out",
++		"ep3out",
++		"ep4out",
++		"ep5out",
++		"ep6out",
++		"ep7out",
++		"ep8out",
++		"ep9out",
++		"ep10out",
++		"ep11out",
++		"ep12out",
++		"ep13out",
++		"ep14out",
++		"ep15out"
++	};
++
++	int i;
++	struct usb_ep *ep;
++	int8_t dev_endpoints;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s\n", __func__);
++
++	INIT_LIST_HEAD(&d->gadget.ep_list);
++	d->gadget.ep0 = &d->ep0;
++	d->gadget.speed = USB_SPEED_UNKNOWN;
++
++	INIT_LIST_HEAD(&d->gadget.ep0->ep_list);
++
++	/**
++	 * Initialize the EP0 structure.
++	 */
++	ep = &d->ep0;
++
++	/* Init the usb_ep structure. */
++	ep->name = names[0];
++	ep->ops = (struct usb_ep_ops *)&dwc_otg_pcd_ep_ops;
++
++	/**
++	 * @todo NGS: What should the max packet size be set to
++	 * here?  Before EP type is set?
++	 */
++	ep->maxpacket = MAX_PACKET_SIZE;
++	dwc_otg_pcd_ep_enable(d->pcd, NULL, ep);
++
++	list_add_tail(&ep->ep_list, &d->gadget.ep_list);
++
++	/**
++	 * Initialize the EP structures.
++	 */
++	dev_endpoints = d->pcd->core_if->dev_if->num_in_eps;
++
++	for (i = 0; i < dev_endpoints; i++) {
++		ep = &d->in_ep[i];
++
++		/* Init the usb_ep structure. */
++		ep->name = names[d->pcd->in_ep[i].dwc_ep.num];
++		ep->ops = (struct usb_ep_ops *)&dwc_otg_pcd_ep_ops;
++
++		/**
++		 * @todo NGS: What should the max packet size be set to
++		 * here?  Before EP type is set?
++		 */
++		ep->maxpacket = MAX_PACKET_SIZE;
++		list_add_tail(&ep->ep_list, &d->gadget.ep_list);
++	}
++
++	dev_endpoints = d->pcd->core_if->dev_if->num_out_eps;
++
++	for (i = 0; i < dev_endpoints; i++) {
++		ep = &d->out_ep[i];
++
++		/* Init the usb_ep structure. */
++		ep->name = names[15 + d->pcd->out_ep[i].dwc_ep.num];
++		ep->ops = (struct usb_ep_ops *)&dwc_otg_pcd_ep_ops;
++
++		/**
++		 * @todo NGS: What should the max packet size be set to
++		 * here?  Before EP type is set?
++		 */
++		ep->maxpacket = MAX_PACKET_SIZE;
++
++		list_add_tail(&ep->ep_list, &d->gadget.ep_list);
++	}
++
++	/* remove ep0 from the list.  There is a ep0 pointer. */
++	list_del_init(&d->ep0.ep_list);
++
++	d->ep0.maxpacket = MAX_EP0_SIZE;
++}
++
++/**
++ * This function releases the Gadget device.
++ * required by device_unregister().
++ *
++ * @todo Should this do something?	Should it free the PCD?
++ */
++static void dwc_otg_pcd_gadget_release(struct device *dev)
++{
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, dev);
++}
++
++static struct gadget_wrapper *alloc_wrapper(dwc_bus_dev_t *_dev)
++{
++	static char pcd_name[] = "dwc_otg_pcd";
++	dwc_otg_device_t *otg_dev = DWC_OTG_BUSDRVDATA(_dev);
++	struct gadget_wrapper *d;
++	int retval;
++
++	d = DWC_ALLOC(sizeof(*d));
++	if (d == NULL) {
++		return NULL;
++	}
++
++	memset(d, 0, sizeof(*d));
++
++	d->gadget.name = pcd_name;
++	d->pcd = otg_dev->pcd;
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30)
++	strcpy(d->gadget.dev.bus_id, "gadget");
++#else
++	dev_set_name(&d->gadget.dev, "%s", "gadget");
++#endif
++
++	d->gadget.dev.parent = &_dev->dev;
++	d->gadget.dev.release = dwc_otg_pcd_gadget_release;
++	d->gadget.ops = &dwc_otg_pcd_ops;
++	d->gadget.max_speed = dwc_otg_pcd_is_dualspeed(otg_dev->pcd) ? USB_SPEED_HIGH:USB_SPEED_FULL;
++	d->gadget.is_otg = dwc_otg_pcd_is_otg(otg_dev->pcd);
++
++	d->driver = 0;
++	/* Register the gadget device */
++	retval = device_register(&d->gadget.dev);
++	if (retval != 0) {
++		DWC_ERROR("device_register failed\n");
++		DWC_FREE(d);
++		return NULL;
++	}
++
++	return d;
++}
++
++static void free_wrapper(struct gadget_wrapper *d)
++{
++	if (d->driver) {
++		/* should have been done already by driver model core */
++		DWC_WARN("driver '%s' is still registered\n",
++			 d->driver->driver.name);
++#ifdef CONFIG_USB_GADGET
++		usb_gadget_unregister_driver(d->driver);
++#endif
++	}
++
++	device_unregister(&d->gadget.dev);
++	DWC_FREE(d);
++}
++
++/**
++ * This function initialized the PCD portion of the driver.
++ *
++ */
++int pcd_init(dwc_bus_dev_t *_dev)
++{
++	dwc_otg_device_t *otg_dev = DWC_OTG_BUSDRVDATA(_dev);
++	int retval = 0;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p) otg_dev=%p\n", __func__, _dev, otg_dev);
++
++	otg_dev->pcd = dwc_otg_pcd_init(otg_dev);
++
++	if (!otg_dev->pcd) {
++		DWC_ERROR("dwc_otg_pcd_init failed\n");
++		return -ENOMEM;
++	}
++
++	otg_dev->pcd->otg_dev = otg_dev;
++	gadget_wrapper = alloc_wrapper(_dev);
++
++	/*
++	 * Initialize EP structures
++	 */
++	gadget_add_eps(gadget_wrapper);
++	/*
++	 * Setup interupt handler
++	 */
++	DWC_DEBUGPL(DBG_ANY, "registering handler for irq%d\n",
++                    otg_dev->os_dep.irq_num);
++	retval = request_irq(otg_dev->os_dep.irq_num, dwc_otg_pcd_irq,
++			     IRQF_SHARED, gadget_wrapper->gadget.name,
++			     otg_dev->pcd);
++	if (retval != 0) {
++		DWC_ERROR("request of irq%d failed\n", otg_dev->os_dep.irq_num);
++		free_wrapper(gadget_wrapper);
++		return -EBUSY;
++	}
++
++	dwc_otg_pcd_start(gadget_wrapper->pcd, &fops);
++
++	return retval;
++}
++
++/**
++ * Cleanup the PCD.
++ */
++void pcd_remove(dwc_bus_dev_t *_dev)
++{
++	dwc_otg_device_t *otg_dev = DWC_OTG_BUSDRVDATA(_dev);
++	dwc_otg_pcd_t *pcd = otg_dev->pcd;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p) otg_dev %p\n", __func__, _dev, otg_dev);
++
++	/*
++	 * Free the IRQ
++	 */
++	free_irq(otg_dev->os_dep.irq_num, pcd);
++	dwc_otg_pcd_remove(otg_dev->pcd);
++	free_wrapper(gadget_wrapper);
++	otg_dev->pcd = 0;
++}
++
++#endif /* DWC_HOST_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_regs.h
+@@ -0,0 +1,2550 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_regs.h $
++ * $Revision: #98 $
++ * $Date: 2012/08/10 $
++ * $Change: 2047372 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++#ifndef __DWC_OTG_REGS_H__
++#define __DWC_OTG_REGS_H__
++
++#include "dwc_otg_core_if.h"
++
++/**
++ * @file
++ *
++ * This file contains the data structures for accessing the DWC_otg core registers.
++ *
++ * The application interfaces with the HS OTG core by reading from and
++ * writing to the Control and Status Register (CSR) space through the
++ * AHB Slave interface. These registers are 32 bits wide, and the
++ * addresses are 32-bit-block aligned.
++ * CSRs are classified as follows:
++ * - Core Global Registers
++ * - Device Mode Registers
++ * - Device Global Registers
++ * - Device Endpoint Specific Registers
++ * - Host Mode Registers
++ * - Host Global Registers
++ * - Host Port CSRs
++ * - Host Channel Specific Registers
++ *
++ * Only the Core Global registers can be accessed in both Device and
++ * Host modes. When the HS OTG core is operating in one mode, either
++ * Device or Host, the application must not access registers from the
++ * other mode. When the core switches from one mode to another, the
++ * registers in the new mode of operation must be reprogrammed as they
++ * would be after a power-on reset.
++ */
++
++/****************************************************************************/
++/** DWC_otg Core registers .
++ * The dwc_otg_core_global_regs structure defines the size
++ * and relative field offsets for the Core Global registers.
++ */
++typedef struct dwc_otg_core_global_regs {
++	/** OTG Control and Status Register.  <i>Offset: 000h</i> */
++	volatile uint32_t gotgctl;
++	/** OTG Interrupt Register.	 <i>Offset: 004h</i> */
++	volatile uint32_t gotgint;
++	/**Core AHB Configuration Register.	 <i>Offset: 008h</i> */
++	volatile uint32_t gahbcfg;
++
++#define DWC_GLBINTRMASK		0x0001
++#define DWC_DMAENABLE		0x0020
++#define DWC_NPTXEMPTYLVL_EMPTY	0x0080
++#define DWC_NPTXEMPTYLVL_HALFEMPTY	0x0000
++#define DWC_PTXEMPTYLVL_EMPTY	0x0100
++#define DWC_PTXEMPTYLVL_HALFEMPTY	0x0000
++
++	/**Core USB Configuration Register.	 <i>Offset: 00Ch</i> */
++	volatile uint32_t gusbcfg;
++	/**Core Reset Register.	 <i>Offset: 010h</i> */
++	volatile uint32_t grstctl;
++	/**Core Interrupt Register.	 <i>Offset: 014h</i> */
++	volatile uint32_t gintsts;
++	/**Core Interrupt Mask Register.  <i>Offset: 018h</i> */
++	volatile uint32_t gintmsk;
++	/**Receive Status Queue Read Register (Read Only).	<i>Offset: 01Ch</i> */
++	volatile uint32_t grxstsr;
++	/**Receive Status Queue Read & POP Register (Read Only).  <i>Offset: 020h</i>*/
++	volatile uint32_t grxstsp;
++	/**Receive FIFO Size Register.	<i>Offset: 024h</i> */
++	volatile uint32_t grxfsiz;
++	/**Non Periodic Transmit FIFO Size Register.  <i>Offset: 028h</i> */
++	volatile uint32_t gnptxfsiz;
++	/**Non Periodic Transmit FIFO/Queue Status Register (Read
++	 * Only). <i>Offset: 02Ch</i> */
++	volatile uint32_t gnptxsts;
++	/**I2C Access Register.	 <i>Offset: 030h</i> */
++	volatile uint32_t gi2cctl;
++	/**PHY Vendor Control Register.	 <i>Offset: 034h</i> */
++	volatile uint32_t gpvndctl;
++	/**General Purpose Input/Output Register.  <i>Offset: 038h</i> */
++	volatile uint32_t ggpio;
++	/**User ID Register.  <i>Offset: 03Ch</i> */
++	volatile uint32_t guid;
++	/**Synopsys ID Register (Read Only).  <i>Offset: 040h</i> */
++	volatile uint32_t gsnpsid;
++	/**User HW Config1 Register (Read Only).  <i>Offset: 044h</i> */
++	volatile uint32_t ghwcfg1;
++	/**User HW Config2 Register (Read Only).  <i>Offset: 048h</i> */
++	volatile uint32_t ghwcfg2;
++#define DWC_SLAVE_ONLY_ARCH 0
++#define DWC_EXT_DMA_ARCH 1
++#define DWC_INT_DMA_ARCH 2
++
++#define DWC_MODE_HNP_SRP_CAPABLE	0
++#define DWC_MODE_SRP_ONLY_CAPABLE	1
++#define DWC_MODE_NO_HNP_SRP_CAPABLE		2
++#define DWC_MODE_SRP_CAPABLE_DEVICE		3
++#define DWC_MODE_NO_SRP_CAPABLE_DEVICE	4
++#define DWC_MODE_SRP_CAPABLE_HOST	5
++#define DWC_MODE_NO_SRP_CAPABLE_HOST	6
++
++	/**User HW Config3 Register (Read Only).  <i>Offset: 04Ch</i> */
++	volatile uint32_t ghwcfg3;
++	/**User HW Config4 Register (Read Only).  <i>Offset: 050h</i>*/
++	volatile uint32_t ghwcfg4;
++	/** Core LPM Configuration register <i>Offset: 054h</i>*/
++	volatile uint32_t glpmcfg;
++	/** Global PowerDn Register <i>Offset: 058h</i> */
++	volatile uint32_t gpwrdn;
++	/** Global DFIFO SW Config Register  <i>Offset: 05Ch</i> */
++	volatile uint32_t gdfifocfg;
++	/** ADP Control Register  <i>Offset: 060h</i> */
++	volatile uint32_t adpctl;
++	/** Reserved  <i>Offset: 064h-0FFh</i> */
++	volatile uint32_t reserved39[39];
++	/** Host Periodic Transmit FIFO Size Register. <i>Offset: 100h</i> */
++	volatile uint32_t hptxfsiz;
++	/** Device Periodic Transmit FIFO#n Register if dedicated fifos are disabled,
++		otherwise Device Transmit FIFO#n Register.
++	 * <i>Offset: 104h + (FIFO_Number-1)*04h, 1 <= FIFO Number <= 15 (1<=n<=15).</i> */
++	volatile uint32_t dtxfsiz[15];
++} dwc_otg_core_global_regs_t;
++
++/**
++ * This union represents the bit fields of the Core OTG Control
++ * and Status Register (GOTGCTL).  Set the bits using the bit
++ * fields then write the <i>d32</i> value to the register.
++ */
++typedef union gotgctl_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned sesreqscs:1;
++		unsigned sesreq:1;
++		unsigned vbvalidoven:1;
++		unsigned vbvalidovval:1;
++		unsigned avalidoven:1;
++		unsigned avalidovval:1;
++		unsigned bvalidoven:1;
++		unsigned bvalidovval:1;
++		unsigned hstnegscs:1;
++		unsigned hnpreq:1;
++		unsigned hstsethnpen:1;
++		unsigned devhnpen:1;
++		unsigned reserved12_15:4;
++		unsigned conidsts:1;
++		unsigned dbnctime:1;
++		unsigned asesvld:1;
++		unsigned bsesvld:1;
++		unsigned otgver:1;
++		unsigned reserved1:1;
++		unsigned multvalidbc:5;
++		unsigned chirpen:1;
++		unsigned reserved28_31:4;
++	} b;
++} gotgctl_data_t;
++
++/**
++ * This union represents the bit fields of the Core OTG Interrupt Register
++ * (GOTGINT).  Set/clear the bits using the bit fields then write the <i>d32</i>
++ * value to the register.
++ */
++typedef union gotgint_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** Current Mode */
++		unsigned reserved0_1:2;
++
++		/** Session End Detected */
++		unsigned sesenddet:1;
++
++		unsigned reserved3_7:5;
++
++		/** Session Request Success Status Change */
++		unsigned sesreqsucstschng:1;
++		/** Host Negotiation Success Status Change */
++		unsigned hstnegsucstschng:1;
++
++		unsigned reserved10_16:7;
++
++		/** Host Negotiation Detected */
++		unsigned hstnegdet:1;
++		/** A-Device Timeout Change */
++		unsigned adevtoutchng:1;
++		/** Debounce Done */
++		unsigned debdone:1;
++		/** Multi-Valued input changed */
++		unsigned mvic:1;
++
++		unsigned reserved31_21:11;
++
++	} b;
++} gotgint_data_t;
++
++/**
++ * This union represents the bit fields of the Core AHB Configuration
++ * Register (GAHBCFG). Set/clear the bits using the bit fields then
++ * write the <i>d32</i> value to the register.
++ */
++typedef union gahbcfg_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned glblintrmsk:1;
++#define DWC_GAHBCFG_GLBINT_ENABLE		1
++
++		unsigned hburstlen:4;
++#define DWC_GAHBCFG_INT_DMA_BURST_SINGLE	0
++#define DWC_GAHBCFG_INT_DMA_BURST_INCR		1
++#define DWC_GAHBCFG_INT_DMA_BURST_INCR4		3
++#define DWC_GAHBCFG_INT_DMA_BURST_INCR8		5
++#define DWC_GAHBCFG_INT_DMA_BURST_INCR16	7
++
++		unsigned dmaenable:1;
++#define DWC_GAHBCFG_DMAENABLE			1
++		unsigned reserved:1;
++		unsigned nptxfemplvl_txfemplvl:1;
++		unsigned ptxfemplvl:1;
++#define DWC_GAHBCFG_TXFEMPTYLVL_EMPTY		1
++#define DWC_GAHBCFG_TXFEMPTYLVL_HALFEMPTY	0
++		unsigned reserved9_20:12;
++		unsigned remmemsupp:1;
++		unsigned notialldmawrit:1;
++		unsigned ahbsingle:1;
++		unsigned reserved24_31:8;
++	} b;
++} gahbcfg_data_t;
++
++/**
++ * This union represents the bit fields of the Core USB Configuration
++ * Register (GUSBCFG). Set the bits using the bit fields then write
++ * the <i>d32</i> value to the register.
++ */
++typedef union gusbcfg_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned toutcal:3;
++		unsigned phyif:1;
++		unsigned ulpi_utmi_sel:1;
++		unsigned fsintf:1;
++		unsigned physel:1;
++		unsigned ddrsel:1;
++		unsigned srpcap:1;
++		unsigned hnpcap:1;
++		unsigned usbtrdtim:4;
++		unsigned reserved1:1;
++		unsigned phylpwrclksel:1;
++		unsigned otgutmifssel:1;
++		unsigned ulpi_fsls:1;
++		unsigned ulpi_auto_res:1;
++		unsigned ulpi_clk_sus_m:1;
++		unsigned ulpi_ext_vbus_drv:1;
++		unsigned ulpi_int_vbus_indicator:1;
++		unsigned term_sel_dl_pulse:1;
++		unsigned indicator_complement:1;
++		unsigned indicator_pass_through:1;
++		unsigned ulpi_int_prot_dis:1;
++		unsigned ic_usb_cap:1;
++		unsigned ic_traffic_pull_remove:1;
++		unsigned tx_end_delay:1;
++		unsigned force_host_mode:1;
++		unsigned force_dev_mode:1;
++		unsigned reserved31:1;
++	} b;
++} gusbcfg_data_t;
++
++/**
++ * This union represents the bit fields of the Core Reset Register
++ * (GRSTCTL).  Set/clear the bits using the bit fields then write the
++ * <i>d32</i> value to the register.
++ */
++typedef union grstctl_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** Core Soft Reset (CSftRst) (Device and Host)
++		 *
++		 * The application can flush the control logic in the
++		 * entire core using this bit. This bit resets the
++		 * pipelines in the AHB Clock domain as well as the
++		 * PHY Clock domain.
++		 *
++		 * The state machines are reset to an IDLE state, the
++		 * control bits in the CSRs are cleared, all the
++		 * transmit FIFOs and the receive FIFO are flushed.
++		 *
++		 * The status mask bits that control the generation of
++		 * the interrupt, are cleared, to clear the
++		 * interrupt. The interrupt status bits are not
++		 * cleared, so the application can get the status of
++		 * any events that occurred in the core after it has
++		 * set this bit.
++		 *
++		 * Any transactions on the AHB are terminated as soon
++		 * as possible following the protocol. Any
++		 * transactions on the USB are terminated immediately.
++		 *
++		 * The configuration settings in the CSRs are
++		 * unchanged, so the software doesn't have to
++		 * reprogram these registers (Device
++		 * Configuration/Host Configuration/Core System
++		 * Configuration/Core PHY Configuration).
++		 *
++		 * The application can write to this bit, any time it
++		 * wants to reset the core. This is a self clearing
++		 * bit and the core clears this bit after all the
++		 * necessary logic is reset in the core, which may
++		 * take several clocks, depending on the current state
++		 * of the core.
++		 */
++		unsigned csftrst:1;
++		/** Hclk Soft Reset
++		 *
++		 * The application uses this bit to reset the control logic in
++		 * the AHB clock domain. Only AHB clock domain pipelines are
++		 * reset.
++		 */
++		unsigned hsftrst:1;
++		/** Host Frame Counter Reset (Host Only)<br>
++		 *
++		 * The application can reset the (micro)frame number
++		 * counter inside the core, using this bit. When the
++		 * (micro)frame counter is reset, the subsequent SOF
++		 * sent out by the core, will have a (micro)frame
++		 * number of 0.
++		 */
++		unsigned hstfrm:1;
++		/** In Token Sequence Learning Queue Flush
++		 * (INTknQFlsh) (Device Only)
++		 */
++		unsigned intknqflsh:1;
++		/** RxFIFO Flush (RxFFlsh) (Device and Host)
++		 *
++		 * The application can flush the entire Receive FIFO
++		 * using this bit. The application must first
++		 * ensure that the core is not in the middle of a
++		 * transaction. The application should write into
++		 * this bit, only after making sure that neither the
++		 * DMA engine is reading from the RxFIFO nor the MAC
++		 * is writing the data in to the FIFO. The
++		 * application should wait until the bit is cleared
++		 * before performing any other operations. This bit
++		 * will takes 8 clocks (slowest of PHY or AHB clock)
++		 * to clear.
++		 */
++		unsigned rxfflsh:1;
++		/** TxFIFO Flush (TxFFlsh) (Device and Host).
++		 *
++		 * This bit is used to selectively flush a single or
++		 * all transmit FIFOs. The application must first
++		 * ensure that the core is not in the middle of a
++		 * transaction. The application should write into
++		 * this bit, only after making sure that neither the
++		 * DMA engine is writing into the TxFIFO nor the MAC
++		 * is reading the data out of the FIFO. The
++		 * application should wait until the core clears this
++		 * bit, before performing any operations. This bit
++		 * will takes 8 clocks (slowest of PHY or AHB clock)
++		 * to clear.
++		 */
++		unsigned txfflsh:1;
++
++		/** TxFIFO Number (TxFNum) (Device and Host).
++		 *
++		 * This is the FIFO number which needs to be flushed,
++		 * using the TxFIFO Flush bit. This field should not
++		 * be changed until the TxFIFO Flush bit is cleared by
++		 * the core.
++		 *	 - 0x0 : Non Periodic TxFIFO Flush
++		 *	 - 0x1 : Periodic TxFIFO #1 Flush in device mode
++		 *	   or Periodic TxFIFO in host mode
++		 *	 - 0x2 : Periodic TxFIFO #2 Flush in device mode.
++		 *	 - ...
++		 *	 - 0xF : Periodic TxFIFO #15 Flush in device mode
++		 *	 - 0x10: Flush all the Transmit NonPeriodic and
++		 *	   Transmit Periodic FIFOs in the core
++		 */
++		unsigned txfnum:5;
++		/** Reserved */
++		unsigned reserved11_29:19;
++		/** DMA Request Signal.	 Indicated DMA request is in
++		 * probress. Used for debug purpose. */
++		unsigned dmareq:1;
++		/** AHB Master Idle.  Indicates the AHB Master State
++		 * Machine is in IDLE condition. */
++		unsigned ahbidle:1;
++	} b;
++} grstctl_t;
++
++/**
++ * This union represents the bit fields of the Core Interrupt Mask
++ * Register (GINTMSK). Set/clear the bits using the bit fields then
++ * write the <i>d32</i> value to the register.
++ */
++typedef union gintmsk_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned reserved0:1;
++		unsigned modemismatch:1;
++		unsigned otgintr:1;
++		unsigned sofintr:1;
++		unsigned rxstsqlvl:1;
++		unsigned nptxfempty:1;
++		unsigned ginnakeff:1;
++		unsigned goutnakeff:1;
++		unsigned ulpickint:1;
++		unsigned i2cintr:1;
++		unsigned erlysuspend:1;
++		unsigned usbsuspend:1;
++		unsigned usbreset:1;
++		unsigned enumdone:1;
++		unsigned isooutdrop:1;
++		unsigned eopframe:1;
++		unsigned restoredone:1;
++		unsigned epmismatch:1;
++		unsigned inepintr:1;
++		unsigned outepintr:1;
++		unsigned incomplisoin:1;
++		unsigned incomplisoout:1;
++		unsigned fetsusp:1;
++		unsigned resetdet:1;
++		unsigned portintr:1;
++		unsigned hcintr:1;
++		unsigned ptxfempty:1;
++		unsigned lpmtranrcvd:1;
++		unsigned conidstschng:1;
++		unsigned disconnect:1;
++		unsigned sessreqintr:1;
++		unsigned wkupintr:1;
++	} b;
++} gintmsk_data_t;
++/**
++ * This union represents the bit fields of the Core Interrupt Register
++ * (GINTSTS).  Set/clear the bits using the bit fields then write the
++ * <i>d32</i> value to the register.
++ */
++typedef union gintsts_data {
++	/** raw register data */
++	uint32_t d32;
++#define DWC_SOF_INTR_MASK 0x0008
++	/** register bits */
++	struct {
++#define DWC_HOST_MODE 1
++		unsigned curmode:1;
++		unsigned modemismatch:1;
++		unsigned otgintr:1;
++		unsigned sofintr:1;
++		unsigned rxstsqlvl:1;
++		unsigned nptxfempty:1;
++		unsigned ginnakeff:1;
++		unsigned goutnakeff:1;
++		unsigned ulpickint:1;
++		unsigned i2cintr:1;
++		unsigned erlysuspend:1;
++		unsigned usbsuspend:1;
++		unsigned usbreset:1;
++		unsigned enumdone:1;
++		unsigned isooutdrop:1;
++		unsigned eopframe:1;
++		unsigned restoredone:1;
++		unsigned epmismatch:1;
++		unsigned inepint:1;
++		unsigned outepintr:1;
++		unsigned incomplisoin:1;
++		unsigned incomplisoout:1;
++		unsigned fetsusp:1;
++		unsigned resetdet:1;
++		unsigned portintr:1;
++		unsigned hcintr:1;
++		unsigned ptxfempty:1;
++		unsigned lpmtranrcvd:1;
++		unsigned conidstschng:1;
++		unsigned disconnect:1;
++		unsigned sessreqintr:1;
++		unsigned wkupintr:1;
++	} b;
++} gintsts_data_t;
++
++/**
++ * This union represents the bit fields in the Device Receive Status Read and
++ * Pop Registers (GRXSTSR, GRXSTSP) Read the register into the <i>d32</i>
++ * element then read out the bits using the <i>b</i>it elements.
++ */
++typedef union device_grxsts_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned epnum:4;
++		unsigned bcnt:11;
++		unsigned dpid:2;
++
++#define DWC_STS_DATA_UPDT		0x2	// OUT Data Packet
++#define DWC_STS_XFER_COMP		0x3	// OUT Data Transfer Complete
++
++#define DWC_DSTS_GOUT_NAK		0x1	// Global OUT NAK
++#define DWC_DSTS_SETUP_COMP		0x4	// Setup Phase Complete
++#define DWC_DSTS_SETUP_UPDT 0x6	// SETUP Packet
++		unsigned pktsts:4;
++		unsigned fn:4;
++		unsigned reserved25_31:7;
++	} b;
++} device_grxsts_data_t;
++
++/**
++ * This union represents the bit fields in the Host Receive Status Read and
++ * Pop Registers (GRXSTSR, GRXSTSP) Read the register into the <i>d32</i>
++ * element then read out the bits using the <i>b</i>it elements.
++ */
++typedef union host_grxsts_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned chnum:4;
++		unsigned bcnt:11;
++		unsigned dpid:2;
++
++		unsigned pktsts:4;
++#define DWC_GRXSTS_PKTSTS_IN			  0x2
++#define DWC_GRXSTS_PKTSTS_IN_XFER_COMP	  0x3
++#define DWC_GRXSTS_PKTSTS_DATA_TOGGLE_ERR 0x5
++#define DWC_GRXSTS_PKTSTS_CH_HALTED		  0x7
++
++		unsigned reserved21_31:11;
++	} b;
++} host_grxsts_data_t;
++
++/**
++ * This union represents the bit fields in the FIFO Size Registers (HPTXFSIZ,
++ * GNPTXFSIZ, DPTXFSIZn, DIEPTXFn). Read the register into the <i>d32</i> element
++ * then read out the bits using the <i>b</i>it elements.
++ */
++typedef union fifosize_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned startaddr:16;
++		unsigned depth:16;
++	} b;
++} fifosize_data_t;
++
++/**
++ * This union represents the bit fields in the Non-Periodic Transmit
++ * FIFO/Queue Status Register (GNPTXSTS). Read the register into the
++ * <i>d32</i> element then read out the bits using the <i>b</i>it
++ * elements.
++ */
++typedef union gnptxsts_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned nptxfspcavail:16;
++		unsigned nptxqspcavail:8;
++		/** Top of the Non-Periodic Transmit Request Queue
++		 *	- bit 24 - Terminate (Last entry for the selected
++		 *	  channel/EP)
++		 *	- bits 26:25 - Token Type
++		 *	  - 2'b00 - IN/OUT
++		 *	  - 2'b01 - Zero Length OUT
++		 *	  - 2'b10 - PING/Complete Split
++		 *	  - 2'b11 - Channel Halt
++		 *	- bits 30:27 - Channel/EP Number
++		 */
++		unsigned nptxqtop_terminate:1;
++		unsigned nptxqtop_token:2;
++		unsigned nptxqtop_chnep:4;
++		unsigned reserved:1;
++	} b;
++} gnptxsts_data_t;
++
++/**
++ * This union represents the bit fields in the Transmit
++ * FIFO Status Register (DTXFSTS). Read the register into the
++ * <i>d32</i> element then read out the bits using the <i>b</i>it
++ * elements.
++ */
++typedef union dtxfsts_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned txfspcavail:16;
++		unsigned reserved:16;
++	} b;
++} dtxfsts_data_t;
++
++/**
++ * This union represents the bit fields in the I2C Control Register
++ * (I2CCTL). Read the register into the <i>d32</i> element then read out the
++ * bits using the <i>b</i>it elements.
++ */
++typedef union gi2cctl_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned rwdata:8;
++		unsigned regaddr:8;
++		unsigned addr:7;
++		unsigned i2cen:1;
++		unsigned ack:1;
++		unsigned i2csuspctl:1;
++		unsigned i2cdevaddr:2;
++		unsigned i2cdatse0:1;
++		unsigned reserved:1;
++		unsigned rw:1;
++		unsigned bsydne:1;
++	} b;
++} gi2cctl_data_t;
++
++/**
++ * This union represents the bit fields in the PHY Vendor Control Register
++ * (GPVNDCTL). Read the register into the <i>d32</i> element then read out the
++ * bits using the <i>b</i>it elements.
++ */
++typedef union gpvndctl_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned regdata:8;
++		unsigned vctrl:8;
++		unsigned regaddr16_21:6;
++		unsigned regwr:1;
++		unsigned reserved23_24:2;
++		unsigned newregreq:1;
++		unsigned vstsbsy:1;
++		unsigned vstsdone:1;
++		unsigned reserved28_30:3;
++		unsigned disulpidrvr:1;
++	} b;
++} gpvndctl_data_t;
++
++/**
++ * This union represents the bit fields in the General Purpose
++ * Input/Output Register (GGPIO).
++ * Read the register into the <i>d32</i> element then read out the
++ * bits using the <i>b</i>it elements.
++ */
++typedef union ggpio_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned gpi:16;
++		unsigned gpo:16;
++	} b;
++} ggpio_data_t;
++
++/**
++ * This union represents the bit fields in the User ID Register
++ * (GUID). Read the register into the <i>d32</i> element then read out the
++ * bits using the <i>b</i>it elements.
++ */
++typedef union guid_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned rwdata:32;
++	} b;
++} guid_data_t;
++
++/**
++ * This union represents the bit fields in the Synopsys ID Register
++ * (GSNPSID). Read the register into the <i>d32</i> element then read out the
++ * bits using the <i>b</i>it elements.
++ */
++typedef union gsnpsid_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned rwdata:32;
++	} b;
++} gsnpsid_data_t;
++
++/**
++ * This union represents the bit fields in the User HW Config1
++ * Register.  Read the register into the <i>d32</i> element then read
++ * out the bits using the <i>b</i>it elements.
++ */
++typedef union hwcfg1_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned ep_dir0:2;
++		unsigned ep_dir1:2;
++		unsigned ep_dir2:2;
++		unsigned ep_dir3:2;
++		unsigned ep_dir4:2;
++		unsigned ep_dir5:2;
++		unsigned ep_dir6:2;
++		unsigned ep_dir7:2;
++		unsigned ep_dir8:2;
++		unsigned ep_dir9:2;
++		unsigned ep_dir10:2;
++		unsigned ep_dir11:2;
++		unsigned ep_dir12:2;
++		unsigned ep_dir13:2;
++		unsigned ep_dir14:2;
++		unsigned ep_dir15:2;
++	} b;
++} hwcfg1_data_t;
++
++/**
++ * This union represents the bit fields in the User HW Config2
++ * Register.  Read the register into the <i>d32</i> element then read
++ * out the bits using the <i>b</i>it elements.
++ */
++typedef union hwcfg2_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/* GHWCFG2 */
++		unsigned op_mode:3;
++#define DWC_HWCFG2_OP_MODE_HNP_SRP_CAPABLE_OTG 0
++#define DWC_HWCFG2_OP_MODE_SRP_ONLY_CAPABLE_OTG 1
++#define DWC_HWCFG2_OP_MODE_NO_HNP_SRP_CAPABLE_OTG 2
++#define DWC_HWCFG2_OP_MODE_SRP_CAPABLE_DEVICE 3
++#define DWC_HWCFG2_OP_MODE_NO_SRP_CAPABLE_DEVICE 4
++#define DWC_HWCFG2_OP_MODE_SRP_CAPABLE_HOST 5
++#define DWC_HWCFG2_OP_MODE_NO_SRP_CAPABLE_HOST 6
++
++		unsigned architecture:2;
++		unsigned point2point:1;
++		unsigned hs_phy_type:2;
++#define DWC_HWCFG2_HS_PHY_TYPE_NOT_SUPPORTED 0
++#define DWC_HWCFG2_HS_PHY_TYPE_UTMI 1
++#define DWC_HWCFG2_HS_PHY_TYPE_ULPI 2
++#define DWC_HWCFG2_HS_PHY_TYPE_UTMI_ULPI 3
++
++		unsigned fs_phy_type:2;
++		unsigned num_dev_ep:4;
++		unsigned num_host_chan:4;
++		unsigned perio_ep_supported:1;
++		unsigned dynamic_fifo:1;
++		unsigned multi_proc_int:1;
++		unsigned reserved21:1;
++		unsigned nonperio_tx_q_depth:2;
++		unsigned host_perio_tx_q_depth:2;
++		unsigned dev_token_q_depth:5;
++		unsigned otg_enable_ic_usb:1;
++	} b;
++} hwcfg2_data_t;
++
++/**
++ * This union represents the bit fields in the User HW Config3
++ * Register.  Read the register into the <i>d32</i> element then read
++ * out the bits using the <i>b</i>it elements.
++ */
++typedef union hwcfg3_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/* GHWCFG3 */
++		unsigned xfer_size_cntr_width:4;
++		unsigned packet_size_cntr_width:3;
++		unsigned otg_func:1;
++		unsigned i2c:1;
++		unsigned vendor_ctrl_if:1;
++		unsigned optional_features:1;
++		unsigned synch_reset_type:1;
++		unsigned adp_supp:1;
++		unsigned otg_enable_hsic:1;
++		unsigned bc_support:1;
++		unsigned otg_lpm_en:1;
++		unsigned dfifo_depth:16;
++	} b;
++} hwcfg3_data_t;
++
++/**
++ * This union represents the bit fields in the User HW Config4
++ * Register.  Read the register into the <i>d32</i> element then read
++ * out the bits using the <i>b</i>it elements.
++ */
++typedef union hwcfg4_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned num_dev_perio_in_ep:4;
++		unsigned power_optimiz:1;
++		unsigned min_ahb_freq:1;
++		unsigned hiber:1;
++		unsigned xhiber:1;
++		unsigned reserved:6;
++		unsigned utmi_phy_data_width:2;
++		unsigned num_dev_mode_ctrl_ep:4;
++		unsigned iddig_filt_en:1;
++		unsigned vbus_valid_filt_en:1;
++		unsigned a_valid_filt_en:1;
++		unsigned b_valid_filt_en:1;
++		unsigned session_end_filt_en:1;
++		unsigned ded_fifo_en:1;
++		unsigned num_in_eps:4;
++		unsigned desc_dma:1;
++		unsigned desc_dma_dyn:1;
++	} b;
++} hwcfg4_data_t;
++
++/**
++ * This union represents the bit fields of the Core LPM Configuration
++ * Register (GLPMCFG). Set the bits using bit fields then write
++ * the <i>d32</i> value to the register.
++ */
++typedef union glpmctl_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** LPM-Capable (LPMCap) (Device and Host)
++		 * The application uses this bit to control
++		 * the DWC_otg core LPM capabilities.
++		 */
++		unsigned lpm_cap_en:1;
++		/** LPM response programmed by application (AppL1Res) (Device)
++		 * Handshake response to LPM token pre-programmed
++		 * by device application software.
++		 */
++		unsigned appl_resp:1;
++		/** Host Initiated Resume Duration (HIRD) (Device and Host)
++		 * In Host mode this field indicates the value of HIRD
++		 * to be sent in an LPM transaction.
++		 * In Device mode this field is updated with the
++		 * Received LPM Token HIRD bmAttribute
++		 * when an ACK/NYET/STALL response is sent
++		 * to an LPM transaction.
++		 */
++		unsigned hird:4;
++		/** RemoteWakeEnable (bRemoteWake) (Device and Host)
++		 * In Host mode this bit indicates the value of remote
++		 * wake up to be sent in wIndex field of LPM transaction.
++		 * In Device mode this field is updated with the
++		 * Received LPM Token bRemoteWake bmAttribute
++		 * when an ACK/NYET/STALL response is sent
++		 * to an LPM transaction.
++		 */
++		unsigned rem_wkup_en:1;
++		/** Enable utmi_sleep_n (EnblSlpM) (Device and Host)
++		 * The application uses this bit to control
++		 * the utmi_sleep_n assertion to the PHY when in L1 state.
++		 */
++		unsigned en_utmi_sleep:1;
++		/** HIRD Threshold (HIRD_Thres) (Device and Host)
++		 */
++		unsigned hird_thres:5;
++		/** LPM Response (CoreL1Res) (Device and Host)
++		 * In Host mode this bit contains handsake response to
++		 * LPM transaction.
++		 * In Device mode the response of the core to
++		 * LPM transaction received is reflected in these two bits.
++			- 0x0 : ERROR (No handshake response)
++			- 0x1 : STALL
++			- 0x2 : NYET
++			- 0x3 : ACK
++		 */
++		unsigned lpm_resp:2;
++		/** Port Sleep Status (SlpSts) (Device and Host)
++		 * This bit is set as long as a Sleep condition
++		 * is present on the USB bus.
++		 */
++		unsigned prt_sleep_sts:1;
++		/** Sleep State Resume OK (L1ResumeOK) (Device and Host)
++		 * Indicates that the application or host
++		 * can start resume from Sleep state.
++		 */
++		unsigned sleep_state_resumeok:1;
++		/** LPM channel Index (LPM_Chnl_Indx) (Host)
++		 * The channel number on which the LPM transaction
++		 * has to be applied while sending
++		 * an LPM transaction to the local device.
++		 */
++		unsigned lpm_chan_index:4;
++		/** LPM Retry Count (LPM_Retry_Cnt) (Host)
++		 * Number host retries that would be performed
++		 * if the device response was not valid response.
++		 */
++		unsigned retry_count:3;
++		/** Send LPM Transaction (SndLPM) (Host)
++		 * When set by application software,
++		 * an LPM transaction containing two tokens
++		 * is sent.
++		 */
++		unsigned send_lpm:1;
++		/** LPM Retry status (LPM_RetryCnt_Sts) (Host)
++		 * Number of LPM Host Retries still remaining
++		 * to be transmitted for the current LPM sequence
++		 */
++		unsigned retry_count_sts:3;
++		unsigned reserved28_29:2;
++		/** In host mode once this bit is set, the host
++		 * configures to drive the HSIC Idle state on the bus.
++		 * It then waits for the  device to initiate the Connect sequence.
++		 * In device mode once this bit is set, the device waits for
++		 * the HSIC Idle line state on the bus. Upon receving the Idle
++		 * line state, it initiates the HSIC Connect sequence.
++		 */
++		unsigned hsic_connect:1;
++		/** This bit overrides and functionally inverts
++		 * the if_select_hsic input port signal.
++		 */
++		unsigned inv_sel_hsic:1;
++	} b;
++} glpmcfg_data_t;
++
++/**
++ * This union represents the bit fields of the Core ADP Timer, Control and
++ * Status Register (ADPTIMCTLSTS). Set the bits using bit fields then write
++ * the <i>d32</i> value to the register.
++ */
++typedef union adpctl_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** Probe Discharge (PRB_DSCHG)
++		 *  These bits set the times for TADP_DSCHG.
++		 *  These bits are defined as follows:
++		 *  2'b00 - 4 msec
++		 *  2'b01 - 8 msec
++		 *  2'b10 - 16 msec
++		 *  2'b11 - 32 msec
++		 */
++		unsigned prb_dschg:2;
++		/** Probe Delta (PRB_DELTA)
++		 *  These bits set the resolution for RTIM   value.
++		 *  The bits are defined in units of 32 kHz clock cycles as follows:
++		 *  2'b00  -  1 cycles
++		 *  2'b01  -  2 cycles
++		 *  2'b10 -  3 cycles
++		 *  2'b11 - 4 cycles
++		 *  For example if this value is chosen to 2'b01, it means that RTIM
++		 *  increments for every 3(three) 32Khz clock cycles.
++		 */
++		unsigned prb_delta:2;
++		/** Probe Period (PRB_PER)
++		 *  These bits sets the TADP_PRD as shown in Figure 4 as follows:
++		 *  2'b00  -  0.625 to 0.925 sec (typical 0.775 sec)
++		 *  2'b01  -  1.25 to 1.85 sec (typical 1.55 sec)
++		 *  2'b10  -  1.9 to 2.6 sec (typical 2.275 sec)
++		 *  2'b11  -  Reserved
++		 */
++		unsigned prb_per:2;
++		/** These bits capture the latest time it took for VBUS to ramp from
++		 *  VADP_SINK to VADP_PRB.
++		 *  0x000  -  1 cycles
++		 *  0x001  -  2 cycles
++		 *  0x002  -  3 cycles
++		 *  etc
++		 *  0x7FF  -  2048 cycles
++		 *  A time of 1024 cycles at 32 kHz corresponds to a time of 32 msec.
++		*/
++		unsigned rtim:11;
++		/** Enable Probe (EnaPrb)
++		 *  When programmed to 1'b1, the core performs a probe operation.
++		 *  This bit is valid only if OTG_Ver = 1'b1.
++		 */
++		unsigned enaprb:1;
++		/** Enable Sense (EnaSns)
++		 *  When programmed to 1'b1, the core performs a Sense operation.
++		 *  This bit is valid only if OTG_Ver = 1'b1.
++		 */
++		unsigned enasns:1;
++		/** ADP Reset (ADPRes)
++		 *  When set, ADP controller is reset.
++		 *  This bit is valid only if OTG_Ver = 1'b1.
++		 */
++		unsigned adpres:1;
++		/** ADP Enable (ADPEn)
++		 *  When set, the core performs either ADP probing or sensing
++		 *  based on EnaPrb or EnaSns.
++		 *  This bit is valid only if OTG_Ver = 1'b1.
++		 */
++		unsigned adpen:1;
++		/** ADP Probe Interrupt (ADP_PRB_INT)
++		 *  When this bit is set, it means that the VBUS
++		 *  voltage is greater than VADP_PRB or VADP_PRB is reached.
++		 *  This bit is valid only if OTG_Ver = 1'b1.
++		 */
++		unsigned adp_prb_int:1;
++		/**
++		 *  ADP Sense Interrupt (ADP_SNS_INT)
++		 *  When this bit is set, it means that the VBUS voltage is greater than
++		 *  VADP_SNS value or VADP_SNS is reached.
++		 *  This bit is valid only if OTG_Ver = 1'b1.
++		 */
++		unsigned adp_sns_int:1;
++		/** ADP Tomeout Interrupt (ADP_TMOUT_INT)
++		 *  This bit is relevant only for an ADP probe.
++		 *  When this bit is set, it means that the ramp time has
++		 *  completed ie ADPCTL.RTIM has reached its terminal value
++		 *  of 0x7FF.  This is a debug feature that allows software
++		 *  to read the ramp time after each cycle.
++		 *  This bit is valid only if OTG_Ver = 1'b1.
++		 */
++		unsigned adp_tmout_int:1;
++		/** ADP Probe Interrupt Mask (ADP_PRB_INT_MSK)
++		 *  When this bit is set, it unmasks the interrupt due to ADP_PRB_INT.
++		 *  This bit is valid only if OTG_Ver = 1'b1.
++		 */
++		unsigned adp_prb_int_msk:1;
++		/** ADP Sense Interrupt Mask (ADP_SNS_INT_MSK)
++		 *  When this bit is set, it unmasks the interrupt due to ADP_SNS_INT.
++		 *  This bit is valid only if OTG_Ver = 1'b1.
++		 */
++		unsigned adp_sns_int_msk:1;
++		/** ADP Timoeout Interrupt Mask (ADP_TMOUT_MSK)
++		 *  When this bit is set, it unmasks the interrupt due to ADP_TMOUT_INT.
++		 *  This bit is valid only if OTG_Ver = 1'b1.
++		 */
++		unsigned adp_tmout_int_msk:1;
++		/** Access Request
++		 * 2'b00 - Read/Write Valid (updated by the core)
++		 * 2'b01 - Read
++		 * 2'b00 - Write
++		 * 2'b00 - Reserved
++		 */
++		unsigned ar:2;
++		 /** Reserved */
++		unsigned reserved29_31:3;
++	} b;
++} adpctl_data_t;
++
++////////////////////////////////////////////
++// Device Registers
++/**
++ * Device Global Registers. <i>Offsets 800h-BFFh</i>
++ *
++ * The following structures define the size and relative field offsets
++ * for the Device Mode Registers.
++ *
++ * <i>These registers are visible only in Device mode and must not be
++ * accessed in Host mode, as the results are unknown.</i>
++ */
++typedef struct dwc_otg_dev_global_regs {
++	/** Device Configuration Register. <i>Offset 800h</i> */
++	volatile uint32_t dcfg;
++	/** Device Control Register. <i>Offset: 804h</i> */
++	volatile uint32_t dctl;
++	/** Device Status Register (Read Only). <i>Offset: 808h</i> */
++	volatile uint32_t dsts;
++	/** Reserved. <i>Offset: 80Ch</i> */
++	uint32_t unused;
++	/** Device IN Endpoint Common Interrupt Mask
++	 * Register. <i>Offset: 810h</i> */
++	volatile uint32_t diepmsk;
++	/** Device OUT Endpoint Common Interrupt Mask
++	 * Register. <i>Offset: 814h</i> */
++	volatile uint32_t doepmsk;
++	/** Device All Endpoints Interrupt Register.  <i>Offset: 818h</i> */
++	volatile uint32_t daint;
++	/** Device All Endpoints Interrupt Mask Register.  <i>Offset:
++	 * 81Ch</i> */
++	volatile uint32_t daintmsk;
++	/** Device IN Token Queue Read Register-1 (Read Only).
++	 * <i>Offset: 820h</i> */
++	volatile uint32_t dtknqr1;
++	/** Device IN Token Queue Read Register-2 (Read Only).
++	 * <i>Offset: 824h</i> */
++	volatile uint32_t dtknqr2;
++	/** Device VBUS	 discharge Register.  <i>Offset: 828h</i> */
++	volatile uint32_t dvbusdis;
++	/** Device VBUS Pulse Register.	 <i>Offset: 82Ch</i> */
++	volatile uint32_t dvbuspulse;
++	/** Device IN Token Queue Read Register-3 (Read Only). /
++	 *	Device Thresholding control register (Read/Write)
++	 * <i>Offset: 830h</i> */
++	volatile uint32_t dtknqr3_dthrctl;
++	/** Device IN Token Queue Read Register-4 (Read Only). /
++	 *	Device IN EPs empty Inr. Mask Register (Read/Write)
++	 * <i>Offset: 834h</i> */
++	volatile uint32_t dtknqr4_fifoemptymsk;
++	/** Device Each Endpoint Interrupt Register (Read Only). /
++	 * <i>Offset: 838h</i> */
++	volatile uint32_t deachint;
++	/** Device Each Endpoint Interrupt mask Register (Read/Write). /
++	 * <i>Offset: 83Ch</i> */
++	volatile uint32_t deachintmsk;
++	/** Device Each In Endpoint Interrupt mask Register (Read/Write). /
++	 * <i>Offset: 840h</i> */
++	volatile uint32_t diepeachintmsk[MAX_EPS_CHANNELS];
++	/** Device Each Out Endpoint Interrupt mask Register (Read/Write). /
++	 * <i>Offset: 880h</i> */
++	volatile uint32_t doepeachintmsk[MAX_EPS_CHANNELS];
++} dwc_otg_device_global_regs_t;
++
++/**
++ * This union represents the bit fields in the Device Configuration
++ * Register.  Read the register into the <i>d32</i> member then
++ * set/clear the bits using the <i>b</i>it elements.  Write the
++ * <i>d32</i> member to the dcfg register.
++ */
++typedef union dcfg_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** Device Speed */
++		unsigned devspd:2;
++		/** Non Zero Length Status OUT Handshake */
++		unsigned nzstsouthshk:1;
++#define DWC_DCFG_SEND_STALL 1
++
++		unsigned ena32khzs:1;
++		/** Device Addresses */
++		unsigned devaddr:7;
++		/** Periodic Frame Interval */
++		unsigned perfrint:2;
++#define DWC_DCFG_FRAME_INTERVAL_80 0
++#define DWC_DCFG_FRAME_INTERVAL_85 1
++#define DWC_DCFG_FRAME_INTERVAL_90 2
++#define DWC_DCFG_FRAME_INTERVAL_95 3
++
++		/** Enable Device OUT NAK for bulk in DDMA mode */
++		unsigned endevoutnak:1;
++
++		unsigned reserved14_17:4;
++		/** In Endpoint Mis-match count */
++		unsigned epmscnt:5;
++		/** Enable Descriptor DMA in Device mode */
++		unsigned descdma:1;
++		unsigned perschintvl:2;
++		unsigned resvalid:6;
++	} b;
++} dcfg_data_t;
++
++/**
++ * This union represents the bit fields in the Device Control
++ * Register.  Read the register into the <i>d32</i> member then
++ * set/clear the bits using the <i>b</i>it elements.
++ */
++typedef union dctl_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** Remote Wakeup */
++		unsigned rmtwkupsig:1;
++		/** Soft Disconnect */
++		unsigned sftdiscon:1;
++		/** Global Non-Periodic IN NAK Status */
++		unsigned gnpinnaksts:1;
++		/** Global OUT NAK Status */
++		unsigned goutnaksts:1;
++		/** Test Control */
++		unsigned tstctl:3;
++		/** Set Global Non-Periodic IN NAK */
++		unsigned sgnpinnak:1;
++		/** Clear Global Non-Periodic IN NAK */
++		unsigned cgnpinnak:1;
++		/** Set Global OUT NAK */
++		unsigned sgoutnak:1;
++		/** Clear Global OUT NAK */
++		unsigned cgoutnak:1;
++		/** Power-On Programming Done */
++		unsigned pwronprgdone:1;
++		/** Reserved */
++		unsigned reserved:1;
++		/** Global Multi Count */
++		unsigned gmc:2;
++		/** Ignore Frame Number for ISOC EPs */
++		unsigned ifrmnum:1;
++		/** NAK on Babble */
++		unsigned nakonbble:1;
++		/** Enable Continue on BNA */
++		unsigned encontonbna:1;
++
++		unsigned reserved18_31:14;
++	} b;
++} dctl_data_t;
++
++/**
++ * This union represents the bit fields in the Device Status
++ * Register.  Read the register into the <i>d32</i> member then
++ * set/clear the bits using the <i>b</i>it elements.
++ */
++typedef union dsts_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** Suspend Status */
++		unsigned suspsts:1;
++		/** Enumerated Speed */
++		unsigned enumspd:2;
++#define DWC_DSTS_ENUMSPD_HS_PHY_30MHZ_OR_60MHZ 0
++#define DWC_DSTS_ENUMSPD_FS_PHY_30MHZ_OR_60MHZ 1
++#define DWC_DSTS_ENUMSPD_LS_PHY_6MHZ		   2
++#define DWC_DSTS_ENUMSPD_FS_PHY_48MHZ		   3
++		/** Erratic Error */
++		unsigned errticerr:1;
++		unsigned reserved4_7:4;
++		/** Frame or Microframe Number of the received SOF */
++		unsigned soffn:14;
++		unsigned reserved22_31:10;
++	} b;
++} dsts_data_t;
++
++/**
++ * This union represents the bit fields in the Device IN EP Interrupt
++ * Register and the Device IN EP Common Mask Register.
++ *
++ * - Read the register into the <i>d32</i> member then set/clear the
++ *	 bits using the <i>b</i>it elements.
++ */
++typedef union diepint_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** Transfer complete mask */
++		unsigned xfercompl:1;
++		/** Endpoint disable mask */
++		unsigned epdisabled:1;
++		/** AHB Error mask */
++		unsigned ahberr:1;
++		/** TimeOUT Handshake mask (non-ISOC EPs) */
++		unsigned timeout:1;
++		/** IN Token received with TxF Empty mask */
++		unsigned intktxfemp:1;
++		/** IN Token Received with EP mismatch mask */
++		unsigned intknepmis:1;
++		/** IN Endpoint NAK Effective mask */
++		unsigned inepnakeff:1;
++		/** Reserved */
++		unsigned emptyintr:1;
++
++		unsigned txfifoundrn:1;
++
++		/** BNA Interrupt mask */
++		unsigned bna:1;
++
++		unsigned reserved10_12:3;
++		/** BNA Interrupt mask */
++		unsigned nak:1;
++
++		unsigned reserved14_31:18;
++	} b;
++} diepint_data_t;
++
++/**
++ * This union represents the bit fields in the Device IN EP
++ * Common/Dedicated Interrupt Mask Register.
++ */
++typedef union diepint_data diepmsk_data_t;
++
++/**
++ * This union represents the bit fields in the Device OUT EP Interrupt
++ * Registerand Device OUT EP Common Interrupt Mask Register.
++ *
++ * - Read the register into the <i>d32</i> member then set/clear the
++ *	 bits using the <i>b</i>it elements.
++ */
++typedef union doepint_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** Transfer complete */
++		unsigned xfercompl:1;
++		/** Endpoint disable  */
++		unsigned epdisabled:1;
++		/** AHB Error */
++		unsigned ahberr:1;
++		/** Setup Phase Done (contorl EPs) */
++		unsigned setup:1;
++		/** OUT Token Received when Endpoint Disabled */
++		unsigned outtknepdis:1;
++
++		unsigned stsphsercvd:1;
++		/** Back-to-Back SETUP Packets Received */
++		unsigned back2backsetup:1;
++
++		unsigned reserved7:1;
++		/** OUT packet Error */
++		unsigned outpkterr:1;
++		/** BNA Interrupt */
++		unsigned bna:1;
++
++		unsigned reserved10:1;
++		/** Packet Drop Status */
++		unsigned pktdrpsts:1;
++		/** Babble Interrupt */
++		unsigned babble:1;
++		/** NAK Interrupt */
++		unsigned nak:1;
++		/** NYET Interrupt */
++		unsigned nyet:1;
++		/** Bit indicating setup packet received */
++		unsigned sr:1;
++
++		unsigned reserved16_31:16;
++	} b;
++} doepint_data_t;
++
++/**
++ * This union represents the bit fields in the Device OUT EP
++ * Common/Dedicated Interrupt Mask Register.
++ */
++typedef union doepint_data doepmsk_data_t;
++
++/**
++ * This union represents the bit fields in the Device All EP Interrupt
++ * and Mask Registers.
++ * - Read the register into the <i>d32</i> member then set/clear the
++ *	 bits using the <i>b</i>it elements.
++ */
++typedef union daint_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** IN Endpoint bits */
++		unsigned in:16;
++		/** OUT Endpoint bits */
++		unsigned out:16;
++	} ep;
++	struct {
++		/** IN Endpoint bits */
++		unsigned inep0:1;
++		unsigned inep1:1;
++		unsigned inep2:1;
++		unsigned inep3:1;
++		unsigned inep4:1;
++		unsigned inep5:1;
++		unsigned inep6:1;
++		unsigned inep7:1;
++		unsigned inep8:1;
++		unsigned inep9:1;
++		unsigned inep10:1;
++		unsigned inep11:1;
++		unsigned inep12:1;
++		unsigned inep13:1;
++		unsigned inep14:1;
++		unsigned inep15:1;
++		/** OUT Endpoint bits */
++		unsigned outep0:1;
++		unsigned outep1:1;
++		unsigned outep2:1;
++		unsigned outep3:1;
++		unsigned outep4:1;
++		unsigned outep5:1;
++		unsigned outep6:1;
++		unsigned outep7:1;
++		unsigned outep8:1;
++		unsigned outep9:1;
++		unsigned outep10:1;
++		unsigned outep11:1;
++		unsigned outep12:1;
++		unsigned outep13:1;
++		unsigned outep14:1;
++		unsigned outep15:1;
++	} b;
++} daint_data_t;
++
++/**
++ * This union represents the bit fields in the Device IN Token Queue
++ * Read Registers.
++ * - Read the register into the <i>d32</i> member.
++ * - READ-ONLY Register
++ */
++typedef union dtknq1_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** In Token Queue Write Pointer */
++		unsigned intknwptr:5;
++		/** Reserved */
++		unsigned reserved05_06:2;
++		/** write pointer has wrapped. */
++		unsigned wrap_bit:1;
++		/** EP Numbers of IN Tokens 0 ... 4 */
++		unsigned epnums0_5:24;
++	} b;
++} dtknq1_data_t;
++
++/**
++ * This union represents Threshold control Register
++ * - Read and write the register into the <i>d32</i> member.
++ * - READ-WRITABLE Register
++ */
++typedef union dthrctl_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** non ISO Tx Thr. Enable */
++		unsigned non_iso_thr_en:1;
++		/** ISO Tx Thr. Enable */
++		unsigned iso_thr_en:1;
++		/** Tx Thr. Length */
++		unsigned tx_thr_len:9;
++		/** AHB Threshold ratio */
++		unsigned ahb_thr_ratio:2;
++		/** Reserved */
++		unsigned reserved13_15:3;
++		/** Rx Thr. Enable */
++		unsigned rx_thr_en:1;
++		/** Rx Thr. Length */
++		unsigned rx_thr_len:9;
++		unsigned reserved26:1;
++		/** Arbiter Parking Enable*/
++		unsigned arbprken:1;
++		/** Reserved */
++		unsigned reserved28_31:4;
++	} b;
++} dthrctl_data_t;
++
++/**
++ * Device Logical IN Endpoint-Specific Registers. <i>Offsets
++ * 900h-AFCh</i>
++ *
++ * There will be one set of endpoint registers per logical endpoint
++ * implemented.
++ *
++ * <i>These registers are visible only in Device mode and must not be
++ * accessed in Host mode, as the results are unknown.</i>
++ */
++typedef struct dwc_otg_dev_in_ep_regs {
++	/** Device IN Endpoint Control Register. <i>Offset:900h +
++	 * (ep_num * 20h) + 00h</i> */
++	volatile uint32_t diepctl;
++	/** Reserved. <i>Offset:900h + (ep_num * 20h) + 04h</i> */
++	uint32_t reserved04;
++	/** Device IN Endpoint Interrupt Register. <i>Offset:900h +
++	 * (ep_num * 20h) + 08h</i> */
++	volatile uint32_t diepint;
++	/** Reserved. <i>Offset:900h + (ep_num * 20h) + 0Ch</i> */
++	uint32_t reserved0C;
++	/** Device IN Endpoint Transfer Size
++	 * Register. <i>Offset:900h + (ep_num * 20h) + 10h</i> */
++	volatile uint32_t dieptsiz;
++	/** Device IN Endpoint DMA Address Register. <i>Offset:900h +
++	 * (ep_num * 20h) + 14h</i> */
++	volatile uint32_t diepdma;
++	/** Device IN Endpoint Transmit FIFO Status Register. <i>Offset:900h +
++	 * (ep_num * 20h) + 18h</i> */
++	volatile uint32_t dtxfsts;
++	/** Device IN Endpoint DMA Buffer Register. <i>Offset:900h +
++	 * (ep_num * 20h) + 1Ch</i> */
++	volatile uint32_t diepdmab;
++} dwc_otg_dev_in_ep_regs_t;
++
++/**
++ * Device Logical OUT Endpoint-Specific Registers. <i>Offsets:
++ * B00h-CFCh</i>
++ *
++ * There will be one set of endpoint registers per logical endpoint
++ * implemented.
++ *
++ * <i>These registers are visible only in Device mode and must not be
++ * accessed in Host mode, as the results are unknown.</i>
++ */
++typedef struct dwc_otg_dev_out_ep_regs {
++	/** Device OUT Endpoint Control Register. <i>Offset:B00h +
++	 * (ep_num * 20h) + 00h</i> */
++	volatile uint32_t doepctl;
++	/** Reserved. <i>Offset:B00h + (ep_num * 20h) + 04h</i> */
++	uint32_t reserved04;
++	/** Device OUT Endpoint Interrupt Register. <i>Offset:B00h +
++	 * (ep_num * 20h) + 08h</i> */
++	volatile uint32_t doepint;
++	/** Reserved. <i>Offset:B00h + (ep_num * 20h) + 0Ch</i> */
++	uint32_t reserved0C;
++	/** Device OUT Endpoint Transfer Size Register. <i>Offset:
++	 * B00h + (ep_num * 20h) + 10h</i> */
++	volatile uint32_t doeptsiz;
++	/** Device OUT Endpoint DMA Address Register. <i>Offset:B00h
++	 * + (ep_num * 20h) + 14h</i> */
++	volatile uint32_t doepdma;
++	/** Reserved. <i>Offset:B00h + 	 * (ep_num * 20h) + 18h</i> */
++	uint32_t unused;
++	/** Device OUT Endpoint DMA Buffer Register. <i>Offset:B00h
++	 * + (ep_num * 20h) + 1Ch</i> */
++	uint32_t doepdmab;
++} dwc_otg_dev_out_ep_regs_t;
++
++/**
++ * This union represents the bit fields in the Device EP Control
++ * Register.  Read the register into the <i>d32</i> member then
++ * set/clear the bits using the <i>b</i>it elements.
++ */
++typedef union depctl_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** Maximum Packet Size
++		 * IN/OUT EPn
++		 * IN/OUT EP0 - 2 bits
++		 *	 2'b00: 64 Bytes
++		 *	 2'b01: 32
++		 *	 2'b10: 16
++		 *	 2'b11: 8 */
++		unsigned mps:11;
++#define DWC_DEP0CTL_MPS_64	 0
++#define DWC_DEP0CTL_MPS_32	 1
++#define DWC_DEP0CTL_MPS_16	 2
++#define DWC_DEP0CTL_MPS_8	 3
++
++		/** Next Endpoint
++		 * IN EPn/IN EP0
++		 * OUT EPn/OUT EP0 - reserved */
++		unsigned nextep:4;
++
++		/** USB Active Endpoint */
++		unsigned usbactep:1;
++
++		/** Endpoint DPID (INTR/Bulk IN and OUT endpoints)
++		 * This field contains the PID of the packet going to
++		 * be received or transmitted on this endpoint. The
++		 * application should program the PID of the first
++		 * packet going to be received or transmitted on this
++		 * endpoint , after the endpoint is
++		 * activated. Application use the SetD1PID and
++		 * SetD0PID fields of this register to program either
++		 * D0 or D1 PID.
++		 *
++		 * The encoding for this field is
++		 *	 - 0: D0
++		 *	 - 1: D1
++		 */
++		unsigned dpid:1;
++
++		/** NAK Status */
++		unsigned naksts:1;
++
++		/** Endpoint Type
++		 *	2'b00: Control
++		 *	2'b01: Isochronous
++		 *	2'b10: Bulk
++		 *	2'b11: Interrupt */
++		unsigned eptype:2;
++
++		/** Snoop Mode
++		 * OUT EPn/OUT EP0
++		 * IN EPn/IN EP0 - reserved */
++		unsigned snp:1;
++
++		/** Stall Handshake */
++		unsigned stall:1;
++
++		/** Tx Fifo Number
++		 * IN EPn/IN EP0
++		 * OUT EPn/OUT EP0 - reserved */
++		unsigned txfnum:4;
++
++		/** Clear NAK */
++		unsigned cnak:1;
++		/** Set NAK */
++		unsigned snak:1;
++		/** Set DATA0 PID (INTR/Bulk IN and OUT endpoints)
++		 * Writing to this field sets the Endpoint DPID (DPID)
++		 * field in this register to DATA0. Set Even
++		 * (micro)frame (SetEvenFr) (ISO IN and OUT Endpoints)
++		 * Writing to this field sets the Even/Odd
++		 * (micro)frame (EO_FrNum) field to even (micro)
++		 * frame.
++		 */
++		unsigned setd0pid:1;
++		/** Set DATA1 PID (INTR/Bulk IN and OUT endpoints)
++		 * Writing to this field sets the Endpoint DPID (DPID)
++		 * field in this register to DATA1 Set Odd
++		 * (micro)frame (SetOddFr) (ISO IN and OUT Endpoints)
++		 * Writing to this field sets the Even/Odd
++		 * (micro)frame (EO_FrNum) field to odd (micro) frame.
++		 */
++		unsigned setd1pid:1;
++
++		/** Endpoint Disable */
++		unsigned epdis:1;
++		/** Endpoint Enable */
++		unsigned epena:1;
++	} b;
++} depctl_data_t;
++
++/**
++ * This union represents the bit fields in the Device EP Transfer
++ * Size Register.  Read the register into the <i>d32</i> member then
++ * set/clear the bits using the <i>b</i>it elements.
++ */
++typedef union deptsiz_data {
++		/** raw register data */
++	uint32_t d32;
++		/** register bits */
++	struct {
++		/** Transfer size */
++		unsigned xfersize:19;
++/** Max packet count for EP (pow(2,10)-1) */
++#define MAX_PKT_CNT 1023
++		/** Packet Count */
++		unsigned pktcnt:10;
++		/** Multi Count - Periodic IN endpoints */
++		unsigned mc:2;
++		unsigned reserved:1;
++	} b;
++} deptsiz_data_t;
++
++/**
++ * This union represents the bit fields in the Device EP 0 Transfer
++ * Size Register.  Read the register into the <i>d32</i> member then
++ * set/clear the bits using the <i>b</i>it elements.
++ */
++typedef union deptsiz0_data {
++		/** raw register data */
++	uint32_t d32;
++		/** register bits */
++	struct {
++		/** Transfer size */
++		unsigned xfersize:7;
++				/** Reserved */
++		unsigned reserved7_18:12;
++		/** Packet Count */
++		unsigned pktcnt:2;
++				/** Reserved */
++		unsigned reserved21_28:8;
++				/**Setup Packet Count (DOEPTSIZ0 Only) */
++		unsigned supcnt:2;
++		unsigned reserved31;
++	} b;
++} deptsiz0_data_t;
++
++/////////////////////////////////////////////////
++// DMA Descriptor Specific Structures
++//
++
++/** Buffer status definitions */
++
++#define BS_HOST_READY	0x0
++#define BS_DMA_BUSY		0x1
++#define BS_DMA_DONE		0x2
++#define BS_HOST_BUSY	0x3
++
++/** Receive/Transmit status definitions */
++
++#define RTS_SUCCESS		0x0
++#define RTS_BUFFLUSH	0x1
++#define RTS_RESERVED	0x2
++#define RTS_BUFERR		0x3
++
++/**
++ * This union represents the bit fields in the DMA Descriptor
++ * status quadlet. Read the quadlet into the <i>d32</i> member then
++ * set/clear the bits using the <i>b</i>it, <i>b_iso_out</i> and
++ * <i>b_iso_in</i> elements.
++ */
++typedef union dev_dma_desc_sts {
++		/** raw register data */
++	uint32_t d32;
++		/** quadlet bits */
++	struct {
++		/** Received number of bytes */
++		unsigned bytes:16;
++		/** NAK bit - only for OUT EPs */
++		unsigned nak:1;
++		unsigned reserved17_22:6;
++		/** Multiple Transfer - only for OUT EPs */
++		unsigned mtrf:1;
++		/** Setup Packet received - only for OUT EPs */
++		unsigned sr:1;
++		/** Interrupt On Complete */
++		unsigned ioc:1;
++		/** Short Packet */
++		unsigned sp:1;
++		/** Last */
++		unsigned l:1;
++		/** Receive Status */
++		unsigned sts:2;
++		/** Buffer Status */
++		unsigned bs:2;
++	} b;
++
++//#ifdef DWC_EN_ISOC
++		/** iso out quadlet bits */
++	struct {
++		/** Received number of bytes */
++		unsigned rxbytes:11;
++
++		unsigned reserved11:1;
++		/** Frame Number */
++		unsigned framenum:11;
++		/** Received ISO Data PID */
++		unsigned pid:2;
++		/** Interrupt On Complete */
++		unsigned ioc:1;
++		/** Short Packet */
++		unsigned sp:1;
++		/** Last */
++		unsigned l:1;
++		/** Receive Status */
++		unsigned rxsts:2;
++		/** Buffer Status */
++		unsigned bs:2;
++	} b_iso_out;
++
++		/** iso in quadlet bits */
++	struct {
++		/** Transmited number of bytes */
++		unsigned txbytes:12;
++		/** Frame Number */
++		unsigned framenum:11;
++		/** Transmited ISO Data PID */
++		unsigned pid:2;
++		/** Interrupt On Complete */
++		unsigned ioc:1;
++		/** Short Packet */
++		unsigned sp:1;
++		/** Last */
++		unsigned l:1;
++		/** Transmit Status */
++		unsigned txsts:2;
++		/** Buffer Status */
++		unsigned bs:2;
++	} b_iso_in;
++//#endif                                /* DWC_EN_ISOC */
++} dev_dma_desc_sts_t;
++
++/**
++ * DMA Descriptor structure
++ *
++ * DMA Descriptor structure contains two quadlets:
++ * Status quadlet and Data buffer pointer.
++ */
++typedef struct dwc_otg_dev_dma_desc {
++	/** DMA Descriptor status quadlet */
++	dev_dma_desc_sts_t status;
++	/** DMA Descriptor data buffer pointer */
++	uint32_t buf;
++} dwc_otg_dev_dma_desc_t;
++
++/**
++ * The dwc_otg_dev_if structure contains information needed to manage
++ * the DWC_otg controller acting in device mode. It represents the
++ * programming view of the device-specific aspects of the controller.
++ */
++typedef struct dwc_otg_dev_if {
++	/** Pointer to device Global registers.
++	 * Device Global Registers starting at offset 800h
++	 */
++	dwc_otg_device_global_regs_t *dev_global_regs;
++#define DWC_DEV_GLOBAL_REG_OFFSET 0x800
++
++	/**
++	 * Device Logical IN Endpoint-Specific Registers 900h-AFCh
++	 */
++	dwc_otg_dev_in_ep_regs_t *in_ep_regs[MAX_EPS_CHANNELS];
++#define DWC_DEV_IN_EP_REG_OFFSET 0x900
++#define DWC_EP_REG_OFFSET 0x20
++
++	/** Device Logical OUT Endpoint-Specific Registers B00h-CFCh */
++	dwc_otg_dev_out_ep_regs_t *out_ep_regs[MAX_EPS_CHANNELS];
++#define DWC_DEV_OUT_EP_REG_OFFSET 0xB00
++
++	/* Device configuration information */
++	uint8_t speed;				 /**< Device Speed	0: Unknown, 1: LS, 2:FS, 3: HS */
++	uint8_t num_in_eps;		 /**< Number # of Tx EP range: 0-15 exept ep0 */
++	uint8_t num_out_eps;		 /**< Number # of Rx EP range: 0-15 exept ep 0*/
++
++	/** Size of periodic FIFOs (Bytes) */
++	uint16_t perio_tx_fifo_size[MAX_PERIO_FIFOS];
++
++	/** Size of Tx FIFOs (Bytes) */
++	uint16_t tx_fifo_size[MAX_TX_FIFOS];
++
++	/** Thresholding enable flags and length varaiables **/
++	uint16_t rx_thr_en;
++	uint16_t iso_tx_thr_en;
++	uint16_t non_iso_tx_thr_en;
++
++	uint16_t rx_thr_length;
++	uint16_t tx_thr_length;
++
++	/**
++	 * Pointers to the DMA Descriptors for EP0 Control
++	 * transfers (virtual and physical)
++	 */
++
++	/** 2 descriptors for SETUP packets */
++	dwc_dma_t dma_setup_desc_addr[2];
++	dwc_otg_dev_dma_desc_t *setup_desc_addr[2];
++
++	/** Pointer to Descriptor with latest SETUP packet */
++	dwc_otg_dev_dma_desc_t *psetup;
++
++	/** Index of current SETUP handler descriptor */
++	uint32_t setup_desc_index;
++
++	/** Descriptor for Data In or Status In phases */
++	dwc_dma_t dma_in_desc_addr;
++	dwc_otg_dev_dma_desc_t *in_desc_addr;
++
++	/** Descriptor for Data Out or Status Out phases */
++	dwc_dma_t dma_out_desc_addr;
++	dwc_otg_dev_dma_desc_t *out_desc_addr;
++
++	/** Setup Packet Detected - if set clear NAK when queueing */
++	uint32_t spd;
++	/** Isoc ep pointer on which incomplete happens */
++	void *isoc_ep;
++
++} dwc_otg_dev_if_t;
++
++/////////////////////////////////////////////////
++// Host Mode Register Structures
++//
++/**
++ * The Host Global Registers structure defines the size and relative
++ * field offsets for the Host Mode Global Registers.  Host Global
++ * Registers offsets 400h-7FFh.
++*/
++typedef struct dwc_otg_host_global_regs {
++	/** Host Configuration Register.   <i>Offset: 400h</i> */
++	volatile uint32_t hcfg;
++	/** Host Frame Interval Register.	<i>Offset: 404h</i> */
++	volatile uint32_t hfir;
++	/** Host Frame Number / Frame Remaining Register. <i>Offset: 408h</i> */
++	volatile uint32_t hfnum;
++	/** Reserved.	<i>Offset: 40Ch</i> */
++	uint32_t reserved40C;
++	/** Host Periodic Transmit FIFO/ Queue Status Register. <i>Offset: 410h</i> */
++	volatile uint32_t hptxsts;
++	/** Host All Channels Interrupt Register. <i>Offset: 414h</i> */
++	volatile uint32_t haint;
++	/** Host All Channels Interrupt Mask Register. <i>Offset: 418h</i> */
++	volatile uint32_t haintmsk;
++	/** Host Frame List Base Address Register . <i>Offset: 41Ch</i> */
++	volatile uint32_t hflbaddr;
++} dwc_otg_host_global_regs_t;
++
++/**
++ * This union represents the bit fields in the Host Configuration Register.
++ * Read the register into the <i>d32</i> member then set/clear the bits using
++ * the <i>b</i>it elements. Write the <i>d32</i> member to the hcfg register.
++ */
++typedef union hcfg_data {
++	/** raw register data */
++	uint32_t d32;
++
++	/** register bits */
++	struct {
++		/** FS/LS Phy Clock Select */
++		unsigned fslspclksel:2;
++#define DWC_HCFG_30_60_MHZ 0
++#define DWC_HCFG_48_MHZ	   1
++#define DWC_HCFG_6_MHZ	   2
++
++		/** FS/LS Only Support */
++		unsigned fslssupp:1;
++		unsigned reserved3_6:4;
++		/** Enable 32-KHz Suspend Mode */
++		unsigned ena32khzs:1;
++		/** Resume Validation Periiod */
++		unsigned resvalid:8;
++		unsigned reserved16_22:7;
++		/** Enable Scatter/gather DMA in Host mode */
++		unsigned descdma:1;
++		/** Frame List Entries */
++		unsigned frlisten:2;
++		/** Enable Periodic Scheduling */
++		unsigned perschedena:1;
++		unsigned reserved27_30:4;
++		unsigned modechtimen:1;
++	} b;
++} hcfg_data_t;
++
++/**
++ * This union represents the bit fields in the Host Frame Remaing/Number
++ * Register.
++ */
++typedef union hfir_data {
++	/** raw register data */
++	uint32_t d32;
++
++	/** register bits */
++	struct {
++		unsigned frint:16;
++		unsigned hfirrldctrl:1;
++		unsigned reserved:15;
++	} b;
++} hfir_data_t;
++
++/**
++ * This union represents the bit fields in the Host Frame Remaing/Number
++ * Register.
++ */
++typedef union hfnum_data {
++	/** raw register data */
++	uint32_t d32;
++
++	/** register bits */
++	struct {
++		unsigned frnum:16;
++#define DWC_HFNUM_MAX_FRNUM 0x3FFF
++		unsigned frrem:16;
++	} b;
++} hfnum_data_t;
++
++typedef union hptxsts_data {
++	/** raw register data */
++	uint32_t d32;
++
++	/** register bits */
++	struct {
++		unsigned ptxfspcavail:16;
++		unsigned ptxqspcavail:8;
++		/** Top of the Periodic Transmit Request Queue
++		 *	- bit 24 - Terminate (last entry for the selected channel)
++		 *	- bits 26:25 - Token Type
++		 *	  - 2'b00 - Zero length
++		 *	  - 2'b01 - Ping
++		 *	  - 2'b10 - Disable
++		 *	- bits 30:27 - Channel Number
++		 *	- bit 31 - Odd/even microframe
++		 */
++		unsigned ptxqtop_terminate:1;
++		unsigned ptxqtop_token:2;
++		unsigned ptxqtop_chnum:4;
++		unsigned ptxqtop_odd:1;
++	} b;
++} hptxsts_data_t;
++
++/**
++ * This union represents the bit fields in the Host Port Control and Status
++ * Register. Read the register into the <i>d32</i> member then set/clear the
++ * bits using the <i>b</i>it elements. Write the <i>d32</i> member to the
++ * hprt0 register.
++ */
++typedef union hprt0_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned prtconnsts:1;
++		unsigned prtconndet:1;
++		unsigned prtena:1;
++		unsigned prtenchng:1;
++		unsigned prtovrcurract:1;
++		unsigned prtovrcurrchng:1;
++		unsigned prtres:1;
++		unsigned prtsusp:1;
++		unsigned prtrst:1;
++		unsigned reserved9:1;
++		unsigned prtlnsts:2;
++		unsigned prtpwr:1;
++		unsigned prttstctl:4;
++		unsigned prtspd:2;
++#define DWC_HPRT0_PRTSPD_HIGH_SPEED 0
++#define DWC_HPRT0_PRTSPD_FULL_SPEED 1
++#define DWC_HPRT0_PRTSPD_LOW_SPEED	2
++		unsigned reserved19_31:13;
++	} b;
++} hprt0_data_t;
++
++/**
++ * This union represents the bit fields in the Host All Interrupt
++ * Register.
++ */
++typedef union haint_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned ch0:1;
++		unsigned ch1:1;
++		unsigned ch2:1;
++		unsigned ch3:1;
++		unsigned ch4:1;
++		unsigned ch5:1;
++		unsigned ch6:1;
++		unsigned ch7:1;
++		unsigned ch8:1;
++		unsigned ch9:1;
++		unsigned ch10:1;
++		unsigned ch11:1;
++		unsigned ch12:1;
++		unsigned ch13:1;
++		unsigned ch14:1;
++		unsigned ch15:1;
++		unsigned reserved:16;
++	} b;
++
++	struct {
++		unsigned chint:16;
++		unsigned reserved:16;
++	} b2;
++} haint_data_t;
++
++/**
++ * This union represents the bit fields in the Host All Interrupt
++ * Register.
++ */
++typedef union haintmsk_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned ch0:1;
++		unsigned ch1:1;
++		unsigned ch2:1;
++		unsigned ch3:1;
++		unsigned ch4:1;
++		unsigned ch5:1;
++		unsigned ch6:1;
++		unsigned ch7:1;
++		unsigned ch8:1;
++		unsigned ch9:1;
++		unsigned ch10:1;
++		unsigned ch11:1;
++		unsigned ch12:1;
++		unsigned ch13:1;
++		unsigned ch14:1;
++		unsigned ch15:1;
++		unsigned reserved:16;
++	} b;
++
++	struct {
++		unsigned chint:16;
++		unsigned reserved:16;
++	} b2;
++} haintmsk_data_t;
++
++/**
++ * Host Channel Specific Registers. <i>500h-5FCh</i>
++ */
++typedef struct dwc_otg_hc_regs {
++	/** Host Channel 0 Characteristic Register. <i>Offset: 500h + (chan_num * 20h) + 00h</i> */
++	volatile uint32_t hcchar;
++	/** Host Channel 0 Split Control Register. <i>Offset: 500h + (chan_num * 20h) + 04h</i> */
++	volatile uint32_t hcsplt;
++	/** Host Channel 0 Interrupt Register. <i>Offset: 500h + (chan_num * 20h) + 08h</i> */
++	volatile uint32_t hcint;
++	/** Host Channel 0 Interrupt Mask Register. <i>Offset: 500h + (chan_num * 20h) + 0Ch</i> */
++	volatile uint32_t hcintmsk;
++	/** Host Channel 0 Transfer Size Register. <i>Offset: 500h + (chan_num * 20h) + 10h</i> */
++	volatile uint32_t hctsiz;
++	/** Host Channel 0 DMA Address Register. <i>Offset: 500h + (chan_num * 20h) + 14h</i> */
++	volatile uint32_t hcdma;
++	volatile uint32_t reserved;
++	/** Host Channel 0 DMA Buffer Address Register. <i>Offset: 500h + (chan_num * 20h) + 1Ch</i> */
++	volatile uint32_t hcdmab;
++} dwc_otg_hc_regs_t;
++
++/**
++ * This union represents the bit fields in the Host Channel Characteristics
++ * Register. Read the register into the <i>d32</i> member then set/clear the
++ * bits using the <i>b</i>it elements. Write the <i>d32</i> member to the
++ * hcchar register.
++ */
++typedef union hcchar_data {
++	/** raw register data */
++	uint32_t d32;
++
++	/** register bits */
++	struct {
++		/** Maximum packet size in bytes */
++		unsigned mps:11;
++
++		/** Endpoint number */
++		unsigned epnum:4;
++
++		/** 0: OUT, 1: IN */
++		unsigned epdir:1;
++
++		unsigned reserved:1;
++
++		/** 0: Full/high speed device, 1: Low speed device */
++		unsigned lspddev:1;
++
++		/** 0: Control, 1: Isoc, 2: Bulk, 3: Intr */
++		unsigned eptype:2;
++
++		/** Packets per frame for periodic transfers. 0 is reserved. */
++		unsigned multicnt:2;
++
++		/** Device address */
++		unsigned devaddr:7;
++
++		/**
++		 * Frame to transmit periodic transaction.
++		 * 0: even, 1: odd
++		 */
++		unsigned oddfrm:1;
++
++		/** Channel disable */
++		unsigned chdis:1;
++
++		/** Channel enable */
++		unsigned chen:1;
++	} b;
++} hcchar_data_t;
++
++typedef union hcsplt_data {
++	/** raw register data */
++	uint32_t d32;
++
++	/** register bits */
++	struct {
++		/** Port Address */
++		unsigned prtaddr:7;
++
++		/** Hub Address */
++		unsigned hubaddr:7;
++
++		/** Transaction Position */
++		unsigned xactpos:2;
++#define DWC_HCSPLIT_XACTPOS_MID 0
++#define DWC_HCSPLIT_XACTPOS_END 1
++#define DWC_HCSPLIT_XACTPOS_BEGIN 2
++#define DWC_HCSPLIT_XACTPOS_ALL 3
++
++		/** Do Complete Split */
++		unsigned compsplt:1;
++
++		/** Reserved */
++		unsigned reserved:14;
++
++		/** Split Enble */
++		unsigned spltena:1;
++	} b;
++} hcsplt_data_t;
++
++/**
++ * This union represents the bit fields in the Host All Interrupt
++ * Register.
++ */
++typedef union hcint_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** Transfer Complete */
++		unsigned xfercomp:1;
++		/** Channel Halted */
++		unsigned chhltd:1;
++		/** AHB Error */
++		unsigned ahberr:1;
++		/** STALL Response Received */
++		unsigned stall:1;
++		/** NAK Response Received */
++		unsigned nak:1;
++		/** ACK Response Received */
++		unsigned ack:1;
++		/** NYET Response Received */
++		unsigned nyet:1;
++		/** Transaction Err */
++		unsigned xacterr:1;
++		/** Babble Error */
++		unsigned bblerr:1;
++		/** Frame Overrun */
++		unsigned frmovrun:1;
++		/** Data Toggle Error */
++		unsigned datatglerr:1;
++		/** Buffer Not Available (only for DDMA mode) */
++		unsigned bna:1;
++		/** Exessive transaction error (only for DDMA mode) */
++		unsigned xcs_xact:1;
++		/** Frame List Rollover interrupt */
++		unsigned frm_list_roll:1;
++		/** Reserved */
++		unsigned reserved14_31:18;
++	} b;
++} hcint_data_t;
++
++/**
++ * This union represents the bit fields in the Host Channel Interrupt Mask
++ * Register. Read the register into the <i>d32</i> member then set/clear the
++ * bits using the <i>b</i>it elements. Write the <i>d32</i> member to the
++ * hcintmsk register.
++ */
++typedef union hcintmsk_data {
++	/** raw register data */
++	uint32_t d32;
++
++	/** register bits */
++	struct {
++		unsigned xfercompl:1;
++		unsigned chhltd:1;
++		unsigned ahberr:1;
++		unsigned stall:1;
++		unsigned nak:1;
++		unsigned ack:1;
++		unsigned nyet:1;
++		unsigned xacterr:1;
++		unsigned bblerr:1;
++		unsigned frmovrun:1;
++		unsigned datatglerr:1;
++		unsigned bna:1;
++		unsigned xcs_xact:1;
++		unsigned frm_list_roll:1;
++		unsigned reserved14_31:18;
++	} b;
++} hcintmsk_data_t;
++
++/**
++ * This union represents the bit fields in the Host Channel Transfer Size
++ * Register. Read the register into the <i>d32</i> member then set/clear the
++ * bits using the <i>b</i>it elements. Write the <i>d32</i> member to the
++ * hcchar register.
++ */
++
++typedef union hctsiz_data {
++	/** raw register data */
++	uint32_t d32;
++
++	/** register bits */
++	struct {
++		/** Total transfer size in bytes */
++		unsigned xfersize:19;
++
++		/** Data packets to transfer */
++		unsigned pktcnt:10;
++
++		/**
++		 * Packet ID for next data packet
++		 * 0: DATA0
++		 * 1: DATA2
++		 * 2: DATA1
++		 * 3: MDATA (non-Control), SETUP (Control)
++		 */
++		unsigned pid:2;
++#define DWC_HCTSIZ_DATA0 0
++#define DWC_HCTSIZ_DATA1 2
++#define DWC_HCTSIZ_DATA2 1
++#define DWC_HCTSIZ_MDATA 3
++#define DWC_HCTSIZ_SETUP 3
++
++		/** Do PING protocol when 1 */
++		unsigned dopng:1;
++	} b;
++
++	/** register bits */
++	struct {
++		/** Scheduling information */
++		unsigned schinfo:8;
++
++		/** Number of transfer descriptors.
++		 * Max value:
++		 * 64 in general,
++		 * 256 only for HS isochronous endpoint.
++		 */
++		unsigned ntd:8;
++
++		/** Data packets to transfer */
++		unsigned reserved16_28:13;
++
++		/**
++		 * Packet ID for next data packet
++		 * 0: DATA0
++		 * 1: DATA2
++		 * 2: DATA1
++		 * 3: MDATA (non-Control)
++		 */
++		unsigned pid:2;
++
++		/** Do PING protocol when 1 */
++		unsigned dopng:1;
++	} b_ddma;
++} hctsiz_data_t;
++
++/**
++ * This union represents the bit fields in the Host DMA Address
++ * Register used in Descriptor DMA mode.
++ */
++typedef union hcdma_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned reserved0_2:3;
++		/** Current Transfer Descriptor. Not used for ISOC */
++		unsigned ctd:8;
++		/** Start Address of Descriptor List */
++		unsigned dma_addr:21;
++	} b;
++} hcdma_data_t;
++
++/**
++ * This union represents the bit fields in the DMA Descriptor
++ * status quadlet for host mode. Read the quadlet into the <i>d32</i> member then
++ * set/clear the bits using the <i>b</i>it elements.
++ */
++typedef union host_dma_desc_sts {
++	/** raw register data */
++	uint32_t d32;
++	/** quadlet bits */
++
++	/* for non-isochronous  */
++	struct {
++		/** Number of bytes */
++		unsigned n_bytes:17;
++		/** QTD offset to jump when Short Packet received - only for IN EPs */
++		unsigned qtd_offset:6;
++		/**
++		 * Set to request the core to jump to alternate QTD if
++		 * Short Packet received - only for IN EPs
++		 */
++		unsigned a_qtd:1;
++		 /**
++		  * Setup Packet bit. When set indicates that buffer contains
++		  * setup packet.
++		  */
++		unsigned sup:1;
++		/** Interrupt On Complete */
++		unsigned ioc:1;
++		/** End of List */
++		unsigned eol:1;
++		unsigned reserved27:1;
++		/** Rx/Tx Status */
++		unsigned sts:2;
++#define DMA_DESC_STS_PKTERR	1
++		unsigned reserved30:1;
++		/** Active Bit */
++		unsigned a:1;
++	} b;
++	/* for isochronous */
++	struct {
++		/** Number of bytes */
++		unsigned n_bytes:12;
++		unsigned reserved12_24:13;
++		/** Interrupt On Complete */
++		unsigned ioc:1;
++		unsigned reserved26_27:2;
++		/** Rx/Tx Status */
++		unsigned sts:2;
++		unsigned reserved30:1;
++		/** Active Bit */
++		unsigned a:1;
++	} b_isoc;
++} host_dma_desc_sts_t;
++
++#define	MAX_DMA_DESC_SIZE		131071
++#define MAX_DMA_DESC_NUM_GENERIC	64
++#define MAX_DMA_DESC_NUM_HS_ISOC	256
++#define MAX_FRLIST_EN_NUM		64
++/**
++ * Host-mode DMA Descriptor structure
++ *
++ * DMA Descriptor structure contains two quadlets:
++ * Status quadlet and Data buffer pointer.
++ */
++typedef struct dwc_otg_host_dma_desc {
++	/** DMA Descriptor status quadlet */
++	host_dma_desc_sts_t status;
++	/** DMA Descriptor data buffer pointer */
++	uint32_t buf;
++} dwc_otg_host_dma_desc_t;
++
++/** OTG Host Interface Structure.
++ *
++ * The OTG Host Interface Structure structure contains information
++ * needed to manage the DWC_otg controller acting in host mode. It
++ * represents the programming view of the host-specific aspects of the
++ * controller.
++ */
++typedef struct dwc_otg_host_if {
++	/** Host Global Registers starting at offset 400h.*/
++	dwc_otg_host_global_regs_t *host_global_regs;
++#define DWC_OTG_HOST_GLOBAL_REG_OFFSET 0x400
++
++	/** Host Port 0 Control and Status Register */
++	volatile uint32_t *hprt0;
++#define DWC_OTG_HOST_PORT_REGS_OFFSET 0x440
++
++	/** Host Channel Specific Registers at offsets 500h-5FCh. */
++	dwc_otg_hc_regs_t *hc_regs[MAX_EPS_CHANNELS];
++#define DWC_OTG_HOST_CHAN_REGS_OFFSET 0x500
++#define DWC_OTG_CHAN_REGS_OFFSET 0x20
++
++	/* Host configuration information */
++	/** Number of Host Channels (range: 1-16) */
++	uint8_t num_host_channels;
++	/** Periodic EPs supported (0: no, 1: yes) */
++	uint8_t perio_eps_supported;
++	/** Periodic Tx FIFO Size (Only 1 host periodic Tx FIFO) */
++	uint16_t perio_tx_fifo_size;
++
++} dwc_otg_host_if_t;
++
++/**
++ * This union represents the bit fields in the Power and Clock Gating Control
++ * Register. Read the register into the <i>d32</i> member then set/clear the
++ * bits using the <i>b</i>it elements.
++ */
++typedef union pcgcctl_data {
++	/** raw register data */
++	uint32_t d32;
++
++	/** register bits */
++	struct {
++		/** Stop Pclk */
++		unsigned stoppclk:1;
++		/** Gate Hclk */
++		unsigned gatehclk:1;
++		/** Power Clamp */
++		unsigned pwrclmp:1;
++		/** Reset Power Down Modules */
++		unsigned rstpdwnmodule:1;
++		/** Reserved */
++		unsigned reserved:1;
++		/** Enable Sleep Clock Gating (Enbl_L1Gating) */
++		unsigned enbl_sleep_gating:1;
++		/** PHY In Sleep (PhySleep) */
++		unsigned phy_in_sleep:1;
++		/** Deep Sleep*/
++		unsigned deep_sleep:1;
++		unsigned resetaftsusp:1;
++		unsigned restoremode:1;
++		unsigned enbl_extnd_hiber:1;
++		unsigned extnd_hiber_pwrclmp:1;
++		unsigned extnd_hiber_switch:1;
++		unsigned ess_reg_restored:1;
++		unsigned prt_clk_sel:2;
++		unsigned port_power:1;
++		unsigned max_xcvrselect:2;
++		unsigned max_termsel:1;
++		unsigned mac_dev_addr:7;
++		unsigned p2hd_dev_enum_spd:2;
++		unsigned p2hd_prt_spd:2;
++		unsigned if_dev_mode:1;
++	} b;
++} pcgcctl_data_t;
++
++/**
++ * This union represents the bit fields in the Global Data FIFO Software
++ * Configuration Register. Read the register into the <i>d32</i> member then
++ * set/clear the bits using the <i>b</i>it elements.
++ */
++typedef union gdfifocfg_data {
++	/* raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** OTG Data FIFO depth */
++		unsigned gdfifocfg:16;
++		/** Start address of EP info controller */
++		unsigned epinfobase:16;
++	} b;
++} gdfifocfg_data_t;
++
++/**
++ * This union represents the bit fields in the Global Power Down Register
++ * Register. Read the register into the <i>d32</i> member then set/clear the
++ * bits using the <i>b</i>it elements.
++ */
++typedef union gpwrdn_data {
++	/* raw register data */
++	uint32_t d32;
++
++	/** register bits */
++	struct {
++		/** PMU Interrupt Select */
++		unsigned pmuintsel:1;
++		/** PMU Active */
++		unsigned pmuactv:1;
++		/** Restore */
++		unsigned restore:1;
++		/** Power Down Clamp */
++		unsigned pwrdnclmp:1;
++		/** Power Down Reset */
++		unsigned pwrdnrstn:1;
++		/** Power Down Switch */
++		unsigned pwrdnswtch:1;
++		/** Disable VBUS */
++		unsigned dis_vbus:1;
++		/** Line State Change */
++		unsigned lnstschng:1;
++		/** Line state change mask */
++		unsigned lnstchng_msk:1;
++		/** Reset Detected */
++		unsigned rst_det:1;
++		/** Reset Detect mask */
++		unsigned rst_det_msk:1;
++		/** Disconnect Detected */
++		unsigned disconn_det:1;
++		/** Disconnect Detect mask */
++		unsigned disconn_det_msk:1;
++		/** Connect Detected*/
++		unsigned connect_det:1;
++		/** Connect Detected Mask*/
++		unsigned connect_det_msk:1;
++		/** SRP Detected */
++		unsigned srp_det:1;
++		/** SRP Detect mask */
++		unsigned srp_det_msk:1;
++		/** Status Change Interrupt */
++		unsigned sts_chngint:1;
++		/** Status Change Interrupt Mask */
++		unsigned sts_chngint_msk:1;
++		/** Line State */
++		unsigned linestate:2;
++		/** Indicates current mode(status of IDDIG signal) */
++		unsigned idsts:1;
++		/** B Session Valid signal status*/
++		unsigned bsessvld:1;
++		/** ADP Event Detected */
++		unsigned adp_int:1;
++		/** Multi Valued ID pin */
++		unsigned mult_val_id_bc:5;
++		/** Reserved 24_31 */
++		unsigned reserved29_31:3;
++	} b;
++} gpwrdn_data_t;
++
++#endif
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/test/Makefile
+@@ -0,0 +1,16 @@
++
++PERL=/usr/bin/perl
++PL_TESTS=test_sysfs.pl test_mod_param.pl
++
++.PHONY : test
++test : perl_tests
++
++perl_tests :
++	@echo
++	@echo Running perl tests
++	@for test in $(PL_TESTS); do \
++	  if $(PERL) ./$$test ; then \
++	    echo "=======> $$test, PASSED" ; \
++	  else echo "=======> $$test, FAILED" ; \
++	  fi \
++	done
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/test/dwc_otg_test.pm
+@@ -0,0 +1,337 @@
++package dwc_otg_test;
++
++use strict;
++use Exporter ();
++
++use vars qw(@ISA @EXPORT
++$sysfsdir $paramdir $errors $params
++);
++
++@ISA = qw(Exporter);
++
++#
++# Globals
++#
++$sysfsdir = "/sys/devices/lm0";
++$paramdir = "/sys/module/dwc_otg";
++$errors = 0;
++
++$params = [
++	   {
++	    NAME => "otg_cap",
++	    DEFAULT => 0,
++	    ENUM => [],
++	    LOW => 0,
++	    HIGH => 2
++	   },
++	   {
++	    NAME => "dma_enable",
++	    DEFAULT => 0,
++	    ENUM => [],
++	    LOW => 0,
++	    HIGH => 1
++	   },
++	   {
++	    NAME => "dma_burst_size",
++	    DEFAULT => 32,
++	    ENUM => [1, 4, 8, 16, 32, 64, 128, 256],
++	    LOW => 1,
++	    HIGH => 256
++	   },
++	   {
++	    NAME => "host_speed",
++	    DEFAULT => 0,
++	    ENUM => [],
++	    LOW => 0,
++	    HIGH => 1
++	   },
++	   {
++	    NAME => "host_support_fs_ls_low_power",
++	    DEFAULT => 0,
++	    ENUM => [],
++	    LOW => 0,
++	    HIGH => 1
++	   },
++	   {
++	    NAME => "host_ls_low_power_phy_clk",
++	    DEFAULT => 0,
++	    ENUM => [],
++	    LOW => 0,
++	    HIGH => 1
++	   },
++	   {
++	    NAME => "dev_speed",
++	    DEFAULT => 0,
++	    ENUM => [],
++	    LOW => 0,
++	    HIGH => 1
++	   },
++	   {
++	    NAME => "enable_dynamic_fifo",
++	    DEFAULT => 1,
++	    ENUM => [],
++	    LOW => 0,
++	    HIGH => 1
++	   },
++	   {
++	    NAME => "data_fifo_size",
++	    DEFAULT => 8192,
++	    ENUM => [],
++	    LOW => 32,
++	    HIGH => 32768
++	   },
++	   {
++	    NAME => "dev_rx_fifo_size",
++	    DEFAULT => 1064,
++	    ENUM => [],
++	    LOW => 16,
++	    HIGH => 32768
++	   },
++	   {
++	    NAME => "dev_nperio_tx_fifo_size",
++	    DEFAULT => 1024,
++	    ENUM => [],
++	    LOW => 16,
++	    HIGH => 32768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_1",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_2",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_3",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_4",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_5",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_6",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_7",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_8",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_9",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_10",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_11",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_12",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_13",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_14",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_15",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "host_rx_fifo_size",
++	    DEFAULT => 1024,
++	    ENUM => [],
++	    LOW => 16,
++	    HIGH => 32768
++	   },
++	   {
++	    NAME => "host_nperio_tx_fifo_size",
++	    DEFAULT => 1024,
++	    ENUM => [],
++	    LOW => 16,
++	    HIGH => 32768
++	   },
++	   {
++	    NAME => "host_perio_tx_fifo_size",
++	    DEFAULT => 1024,
++	    ENUM => [],
++	    LOW => 16,
++	    HIGH => 32768
++	   },
++	   {
++	    NAME => "max_transfer_size",
++	    DEFAULT => 65535,
++	    ENUM => [],
++	    LOW => 2047,
++	    HIGH => 65535
++	   },
++	   {
++	    NAME => "max_packet_count",
++	    DEFAULT => 511,
++	    ENUM => [],
++	    LOW => 15,
++	    HIGH => 511
++	   },
++	   {
++	    NAME => "host_channels",
++	    DEFAULT => 12,
++	    ENUM => [],
++	    LOW => 1,
++	    HIGH => 16
++	   },
++	   {
++	    NAME => "dev_endpoints",
++	    DEFAULT => 6,
++	    ENUM => [],
++	    LOW => 1,
++	    HIGH => 15
++	   },
++	   {
++	    NAME => "phy_type",
++	    DEFAULT => 1,
++	    ENUM => [],
++	    LOW => 0,
++	    HIGH => 2
++	   },
++	   {
++	    NAME => "phy_utmi_width",
++	    DEFAULT => 16,
++	    ENUM => [8, 16],
++	    LOW => 8,
++	    HIGH => 16
++	   },
++	   {
++	    NAME => "phy_ulpi_ddr",
++	    DEFAULT => 0,
++	    ENUM => [],
++	    LOW => 0,
++	    HIGH => 1
++	   },
++	  ];
++
++
++#
++#
++sub check_arch {
++  $_ = `uname -m`;
++  chomp;
++  unless (m/armv4tl/) {
++    warn "# \n# Can't execute on $_.  Run on integrator platform.\n# \n";
++    return 0;
++  }
++  return 1;
++}
++
++#
++#
++sub load_module {
++  my $params = shift;
++  print "\nRemoving Module\n";
++  system "rmmod dwc_otg";
++  print "Loading Module\n";
++  if ($params ne "") {
++    print "Module Parameters: $params\n";
++  }
++  if (system("modprobe dwc_otg $params")) {
++    warn "Unable to load module\n";
++    return 0;
++  }
++  return 1;
++}
++
++#
++#
++sub test_status {
++  my $arg = shift;
++
++  print "\n";
++
++  if (defined $arg) {
++    warn "WARNING: $arg\n";
++  }
++
++  if ($errors > 0) {
++    warn "TEST FAILED with $errors errors\n";
++    return 0;
++  } else {
++    print "TEST PASSED\n";
++    return 0 if (defined $arg);
++  }
++  return 1;
++}
++
++#
++#
++@EXPORT = qw(
++$sysfsdir
++$paramdir
++$params
++$errors
++check_arch
++load_module
++test_status
++);
++
++1;
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/test/test_mod_param.pl
+@@ -0,0 +1,133 @@
++#!/usr/bin/perl -w
++#
++# Run this program on the integrator.
++#
++# - Tests module parameter default values.
++# - Tests setting of valid module parameter values via modprobe.
++# - Tests invalid module parameter values.
++# -----------------------------------------------------------------------------
++use strict;
++use dwc_otg_test;
++
++check_arch() or die;
++
++#
++#
++sub test {
++  my ($param,$expected) = @_;
++  my $value = get($param);
++
++  if ($value == $expected) {
++    print "$param = $value, okay\n";
++  }
++
++  else {
++    warn "ERROR: value of $param != $expected, $value\n";
++    $errors ++;
++  }
++}
++
++#
++#
++sub get {
++  my $param = shift;
++  my $tmp = `cat $paramdir/$param`;
++  chomp $tmp;
++  return $tmp;
++}
++
++#
++#
++sub test_main {
++
++  print "\nTesting Module Parameters\n";
++
++  load_module("") or die;
++
++  # Test initial values
++  print "\nTesting Default Values\n";
++  foreach (@{$params}) {
++    test ($_->{NAME}, $_->{DEFAULT});
++  }
++
++  # Test low value
++  print "\nTesting Low Value\n";
++  my $cmd_params = "";
++  foreach (@{$params}) {
++    $cmd_params = $cmd_params . "$_->{NAME}=$_->{LOW} ";
++  }
++  load_module($cmd_params) or die;
++
++  foreach (@{$params}) {
++    test ($_->{NAME}, $_->{LOW});
++  }
++
++  # Test high value
++  print "\nTesting High Value\n";
++  $cmd_params = "";
++  foreach (@{$params}) {
++    $cmd_params = $cmd_params . "$_->{NAME}=$_->{HIGH} ";
++  }
++  load_module($cmd_params) or die;
++
++  foreach (@{$params}) {
++    test ($_->{NAME}, $_->{HIGH});
++  }
++
++  # Test Enum
++  print "\nTesting Enumerated\n";
++  foreach (@{$params}) {
++    if (defined $_->{ENUM}) {
++      my $value;
++      foreach $value (@{$_->{ENUM}}) {
++	$cmd_params = "$_->{NAME}=$value";
++	load_module($cmd_params) or die;
++	test ($_->{NAME}, $value);
++      }
++    }
++  }
++
++  # Test Invalid Values
++  print "\nTesting Invalid Values\n";
++  $cmd_params = "";
++  foreach (@{$params}) {
++    $cmd_params = $cmd_params . sprintf "$_->{NAME}=%d ", $_->{LOW}-1;
++  }
++  load_module($cmd_params) or die;
++
++  foreach (@{$params}) {
++    test ($_->{NAME}, $_->{DEFAULT});
++  }
++
++  $cmd_params = "";
++  foreach (@{$params}) {
++    $cmd_params = $cmd_params . sprintf "$_->{NAME}=%d ", $_->{HIGH}+1;
++  }
++  load_module($cmd_params) or die;
++
++  foreach (@{$params}) {
++    test ($_->{NAME}, $_->{DEFAULT});
++  }
++
++  print "\nTesting Enumerated\n";
++  foreach (@{$params}) {
++    if (defined $_->{ENUM}) {
++      my $value;
++      foreach $value (@{$_->{ENUM}}) {
++	$value = $value + 1;
++	$cmd_params = "$_->{NAME}=$value";
++	load_module($cmd_params) or die;
++	test ($_->{NAME}, $_->{DEFAULT});
++	$value = $value - 2;
++	$cmd_params = "$_->{NAME}=$value";
++	load_module($cmd_params) or die;
++	test ($_->{NAME}, $_->{DEFAULT});
++      }
++    }
++  }
++
++  test_status() or die;
++}
++
++test_main();
++0;
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/test/test_sysfs.pl
+@@ -0,0 +1,193 @@
++#!/usr/bin/perl -w
++#
++# Run this program on the integrator
++# - Tests select sysfs attributes.
++# - Todo ... test more attributes, hnp/srp, buspower/bussuspend, etc.
++# -----------------------------------------------------------------------------
++use strict;
++use dwc_otg_test;
++
++check_arch() or die;
++
++#
++#
++sub test {
++  my ($attr,$expected) = @_;
++  my $string = get($attr);
++
++  if ($string eq $expected) {
++    printf("$attr = $string, okay\n");
++  }
++  else {
++    warn "ERROR: value of $attr != $expected, $string\n";
++    $errors ++;
++  }
++}
++
++#
++#
++sub set {
++  my ($reg, $value) = @_;
++  system "echo $value > $sysfsdir/$reg";
++}
++
++#
++#
++sub get {
++  my $attr = shift;
++  my $string = `cat $sysfsdir/$attr`;
++  chomp $string;
++  if ($string =~ m/\s\=\s/) {
++    my $tmp;
++    ($tmp, $string) = split /\s=\s/, $string;
++  }
++  return $string;
++}
++
++#
++#
++sub test_main {
++  print("\nTesting Sysfs Attributes\n");
++
++  load_module("") or die;
++
++  # Test initial values of regoffset/regvalue/guid/gsnpsid
++  print("\nTesting Default Values\n");
++
++  test("regoffset", "0xffffffff");
++  test("regvalue", "invalid offset");
++  test("guid", "0x12345678");	# this will fail if it has been changed
++  test("gsnpsid", "0x4f54200a");
++
++  # Test operation of regoffset/regvalue
++  print("\nTesting regoffset\n");
++  set('regoffset', '5a5a5a5a');
++  test("regoffset", "0xffffffff");
++
++  set('regoffset', '0');
++  test("regoffset", "0x00000000");
++
++  set('regoffset', '40000');
++  test("regoffset", "0x00000000");
++
++  set('regoffset', '3ffff');
++  test("regoffset", "0x0003ffff");
++
++  set('regoffset', '1');
++  test("regoffset", "0x00000001");
++
++  print("\nTesting regvalue\n");
++  set('regoffset', '3c');
++  test("regvalue", "0x12345678");
++  set('regvalue', '5a5a5a5a');
++  test("regvalue", "0x5a5a5a5a");
++  set('regvalue','a5a5a5a5');
++  test("regvalue", "0xa5a5a5a5");
++  set('guid','12345678');
++
++  # Test HNP Capable
++  print("\nTesting HNP Capable bit\n");
++  set('hnpcapable', '1');
++  test("hnpcapable", "0x1");
++  set('hnpcapable','0');
++  test("hnpcapable", "0x0");
++
++  set('regoffset','0c');
++
++  my $old = get('gusbcfg');
++  print("setting hnpcapable\n");
++  set('hnpcapable', '1');
++  test("hnpcapable", "0x1");
++  test('gusbcfg', sprintf "0x%08x", (oct ($old) | (1<<9)));
++  test('regvalue', sprintf "0x%08x", (oct ($old) | (1<<9)));
++
++  $old = get('gusbcfg');
++  print("clearing hnpcapable\n");
++  set('hnpcapable', '0');
++  test("hnpcapable", "0x0");
++  test ('gusbcfg', sprintf "0x%08x", oct ($old) & (~(1<<9)));
++  test ('regvalue', sprintf "0x%08x", oct ($old) & (~(1<<9)));
++
++  # Test SRP Capable
++  print("\nTesting SRP Capable bit\n");
++  set('srpcapable', '1');
++  test("srpcapable", "0x1");
++  set('srpcapable','0');
++  test("srpcapable", "0x0");
++
++  set('regoffset','0c');
++
++  $old = get('gusbcfg');
++  print("setting srpcapable\n");
++  set('srpcapable', '1');
++  test("srpcapable", "0x1");
++  test('gusbcfg', sprintf "0x%08x", (oct ($old) | (1<<8)));
++  test('regvalue', sprintf "0x%08x", (oct ($old) | (1<<8)));
++
++  $old = get('gusbcfg');
++  print("clearing srpcapable\n");
++  set('srpcapable', '0');
++  test("srpcapable", "0x0");
++  test('gusbcfg', sprintf "0x%08x", oct ($old) & (~(1<<8)));
++  test('regvalue', sprintf "0x%08x", oct ($old) & (~(1<<8)));
++
++  # Test GGPIO
++  print("\nTesting GGPIO\n");
++  set('ggpio','5a5a5a5a');
++  test('ggpio','0x5a5a0000');
++  set('ggpio','a5a5a5a5');
++  test('ggpio','0xa5a50000');
++  set('ggpio','11110000');
++  test('ggpio','0x11110000');
++  set('ggpio','00001111');
++  test('ggpio','0x00000000');
++
++  # Test DEVSPEED
++  print("\nTesting DEVSPEED\n");
++  set('regoffset','800');
++  $old = get('regvalue');
++  set('devspeed','0');
++  test('devspeed','0x0');
++  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3)));
++  set('devspeed','1');
++  test('devspeed','0x1');
++  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3) | 1));
++  set('devspeed','2');
++  test('devspeed','0x2');
++  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3) | 2));
++  set('devspeed','3');
++  test('devspeed','0x3');
++  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3) | 3));
++  set('devspeed','4');
++  test('devspeed','0x0');
++  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3)));
++  set('devspeed','5');
++  test('devspeed','0x1');
++  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3) | 1));
++
++
++  #  mode	Returns the current mode:0 for device mode1 for host mode	Read
++  #  hnp	Initiate the Host Negotiation Protocol.  Read returns the status.	Read/Write
++  #  srp	Initiate the Session Request Protocol.  Read returns the status.	Read/Write
++  #  buspower	Get or Set the Power State of the bus (0 - Off or 1 - On) 	Read/Write
++  #  bussuspend	Suspend the USB bus.	Read/Write
++  #  busconnected	Get the connection status of the bus 	Read
++
++  #  gotgctl	Get or set the Core Control Status Register.	Read/Write
++  ##  gusbcfg	Get or set the Core USB Configuration Register	Read/Write
++  #  grxfsiz	Get or set the Receive FIFO Size Register	Read/Write
++  #  gnptxfsiz	Get or set the non-periodic Transmit Size Register	Read/Write
++  #  gpvndctl	Get or set the PHY Vendor Control Register	Read/Write
++  ##  ggpio	Get the value in the lower 16-bits of the General Purpose IO Register or Set the upper 16 bits.	Read/Write
++  ##  guid	Get or set the value of the User ID Register	Read/Write
++  ##  gsnpsid	Get the value of the Synopsys ID Regester	Read
++  ##  devspeed	Get or set the device speed setting in the DCFG register	Read/Write
++  #  enumspeed	Gets the device enumeration Speed.	Read
++  #  hptxfsiz	Get the value of the Host Periodic Transmit FIFO	Read
++  #  hprt0	Get or Set the value in the Host Port Control and Status Register	Read/Write
++
++  test_status("TEST NYI") or die;
++}
++
++test_main();
++0;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0107-bcm2708-framebuffer-driver.patch b/target/linux/bcm27xx/patches-6.1/950-0107-bcm2708-framebuffer-driver.patch
new file mode 100644
index 00000000000000..a8dd53e43debe1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0107-bcm2708-framebuffer-driver.patch
@@ -0,0 +1,3548 @@
+From 640ae454312e24218849ca16c8a478aafc1e880f Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Wed, 17 Jun 2015 17:06:34 +0100
+Subject: [PATCH] bcm2708 framebuffer driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+
+bcm2708_fb : Implement blanking support using the mailbox property interface
+
+bcm2708_fb: Add pan and vsync controls
+
+bcm2708_fb: DMA acceleration for fb_copyarea
+
+Based on http://www.raspberrypi.org/phpBB3/viewtopic.php?p=62425#p62425
+Also used Simon's dmaer_master module as a reference for tweaking DMA
+settings for better performance.
+
+For now busylooping only. IRQ support might be added later.
+With non-overclocked Raspberry Pi, the performance is ~360 MB/s
+for simple copy or ~260 MB/s for two-pass copy (used when dragging
+windows to the right).
+
+In the case of using DMA channel 0, the performance improves
+to ~440 MB/s.
+
+For comparison, VFP optimized CPU copy can only do ~114 MB/s in
+the same conditions (hindered by reading uncached source buffer).
+
+Signed-off-by: Siarhei Siamashka <siarhei.siamashka@gmail.com>
+
+bcm2708_fb: report number of dma copies
+
+Add a counter (exported via debugfs) reporting the
+number of dma copies that the framebuffer driver
+has done, in order to help evaluate different
+optimization strategies.
+
+Signed-off-by: Luke Diamand <luked@broadcom.com>
+
+bcm2708_fb: use IRQ for DMA copies
+
+The copyarea ioctl() uses DMA to speed things along. This
+was busy-waiting for completion. This change supports using
+an interrupt instead for larger transfers. For small
+transfers, busy-waiting is still likely to be faster.
+
+Signed-off-by: Luke Diamand <luke@diamand.org>
+
+bcm2708: Make ioctl logging quieter
+
+video: fbdev: bcm2708_fb: Don't panic on error
+
+No need to panic the kernel if the video driver fails.
+Just print a message and return an error.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+fbdev: bcm2708_fb: Add ARCH_BCM2835 support
+
+Add Device Tree support.
+Pass the device to dma_alloc_coherent() in order to get the
+correct bus address on ARCH_BCM2835.
+Use the new DMA legacy API header file.
+Including <mach/platform.h> is not necessary.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+BCM270x_DT: Add bcm2708-fb device
+
+Add bcm2708-fb to Device Tree and don't add the
+platform device when booting in DT mode.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+Cleanup of bcm2708_fb file to kernel coding standards
+
+Some minor change to function - remove a use of
+in_atomic, plus replacing various debug messages
+that manually specify the function name with
+("%s",.__func__)
+
+Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
+
+video: bcm2708_fb: Try allocating on the ARM and passing to VPU
+
+Currently the VPU allocates the contiguous buffer for the
+framebuffer.
+Try an alternate path first where we use dma_alloc_coherent
+and pass the buffer to the VPU. Should the VPU firmware not
+support that path, then free the buffer and revert to the
+old behaviour of using the VPU allocation.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/video/fbdev/Kconfig               |   14 +
+ drivers/video/fbdev/Makefile              |    1 +
+ drivers/video/fbdev/bcm2708_fb.c          |  920 ++++++++
+ drivers/video/logo/logo_linux_clut224.ppm | 2483 ++++++++-------------
+ 4 files changed, 1816 insertions(+), 1602 deletions(-)
+ create mode 100644 drivers/video/fbdev/bcm2708_fb.c
+
+--- a/drivers/video/fbdev/Kconfig
++++ b/drivers/video/fbdev/Kconfig
+@@ -212,6 +212,20 @@ config FB_TILEBLITTING
+ comment "Frame buffer hardware drivers"
+ 	depends on FB
+ 
++config FB_BCM2708
++	tristate "BCM2708 framebuffer support"
++	depends on FB && RASPBERRYPI_FIRMWARE
++	select FB_CFB_FILLRECT
++	select FB_CFB_COPYAREA
++	select FB_CFB_IMAGEBLIT
++	help
++	  This framebuffer device driver is for the BCM2708 framebuffer.
++
++	  If you want to compile this as a module (=code which can be
++	  inserted into and removed from the running kernel), say M
++	  here and read <file:Documentation/kbuild/modules.txt>.  The module
++	  will be called bcm2708_fb.
++
+ config FB_GRVGA
+ 	tristate "Aeroflex Gaisler framebuffer support"
+ 	depends on FB && SPARC
+--- a/drivers/video/fbdev/Makefile
++++ b/drivers/video/fbdev/Makefile
+@@ -11,6 +11,7 @@ obj-$(CONFIG_FB_MACMODES)      += macmod
+ obj-$(CONFIG_FB_WMT_GE_ROPS)   += wmt_ge_rops.o
+ 
+ # Hardware specific drivers go first
++obj-$(CONFIG_FB_BCM2708)	  += bcm2708_fb.o
+ obj-$(CONFIG_FB_AMIGA)            += amifb.o c2p_planar.o
+ obj-$(CONFIG_FB_ARC)              += arcfb.o
+ obj-$(CONFIG_FB_CLPS711X)	  += clps711x-fb.o
+--- /dev/null
++++ b/drivers/video/fbdev/bcm2708_fb.c
+@@ -0,0 +1,920 @@
++/*
++ *  linux/drivers/video/bcm2708_fb.c
++ *
++ * Copyright (C) 2010 Broadcom
++ *
++ * This file is subject to the terms and conditions of the GNU General Public
++ * License.  See the file COPYING in the main directory of this archive
++ * for more details.
++ *
++ * Broadcom simple framebuffer driver
++ *
++ * This file is derived from cirrusfb.c
++ * Copyright 1999-2001 Jeff Garzik <jgarzik@pobox.com>
++ *
++ */
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/errno.h>
++#include <linux/string.h>
++#include <linux/slab.h>
++#include <linux/mm.h>
++#include <linux/fb.h>
++#include <linux/init.h>
++#include <linux/interrupt.h>
++#include <linux/ioport.h>
++#include <linux/list.h>
++#include <linux/platform_data/dma-bcm2708.h>
++#include <linux/platform_device.h>
++#include <linux/clk.h>
++#include <linux/printk.h>
++#include <linux/console.h>
++#include <linux/debugfs.h>
++#include <linux/io.h>
++#include <linux/dma-mapping.h>
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
++//#define BCM2708_FB_DEBUG
++#define MODULE_NAME "bcm2708_fb"
++
++#ifdef BCM2708_FB_DEBUG
++#define print_debug(fmt, ...) pr_debug("%s:%s:%d: " fmt, \
++			MODULE_NAME, __func__, __LINE__, ##__VA_ARGS__)
++#else
++#define print_debug(fmt, ...)
++#endif
++
++/* This is limited to 16 characters when displayed by X startup */
++static const char *bcm2708_name = "BCM2708 FB";
++
++#define DRIVER_NAME "bcm2708_fb"
++
++static int fbwidth = 800;	/* module parameter */
++static int fbheight = 480;	/* module parameter */
++static int fbdepth = 32;	/* module parameter */
++static int fbswap;		/* module parameter */
++
++static u32 dma_busy_wait_threshold = 1 << 15;
++module_param(dma_busy_wait_threshold, int, 0644);
++MODULE_PARM_DESC(dma_busy_wait_threshold, "Busy-wait for DMA completion below this area");
++
++struct fb_alloc_tags {
++	struct rpi_firmware_property_tag_header tag1;
++	u32 xres, yres;
++	struct rpi_firmware_property_tag_header tag2;
++	u32 xres_virtual, yres_virtual;
++	struct rpi_firmware_property_tag_header tag3;
++	u32 bpp;
++	struct rpi_firmware_property_tag_header tag4;
++	u32 xoffset, yoffset;
++	struct rpi_firmware_property_tag_header tag5;
++	u32 base, screen_size;
++	struct rpi_firmware_property_tag_header tag6;
++	u32 pitch;
++};
++
++struct bcm2708_fb_stats {
++	struct debugfs_regset32 regset;
++	u32 dma_copies;
++	u32 dma_irqs;
++};
++
++struct bcm2708_fb {
++	struct fb_info fb;
++	struct platform_device *dev;
++	struct rpi_firmware *fw;
++	u32 cmap[16];
++	u32 gpu_cmap[256];
++	int dma_chan;
++	int dma_irq;
++	void __iomem *dma_chan_base;
++	void *cb_base;		/* DMA control blocks */
++	dma_addr_t cb_handle;
++	struct dentry *debugfs_dir;
++	wait_queue_head_t dma_waitq;
++	struct bcm2708_fb_stats stats;
++	unsigned long fb_bus_address;
++	bool disable_arm_alloc;
++	unsigned int image_size;
++	dma_addr_t dma_addr;
++	void *cpuaddr;
++};
++
++#define to_bcm2708(info)	container_of(info, struct bcm2708_fb, fb)
++
++static void bcm2708_fb_debugfs_deinit(struct bcm2708_fb *fb)
++{
++	debugfs_remove_recursive(fb->debugfs_dir);
++	fb->debugfs_dir = NULL;
++}
++
++static int bcm2708_fb_debugfs_init(struct bcm2708_fb *fb)
++{
++	static struct debugfs_reg32 stats_registers[] = {
++		{
++			"dma_copies",
++			offsetof(struct bcm2708_fb_stats, dma_copies)
++		},
++		{
++			"dma_irqs",
++			offsetof(struct bcm2708_fb_stats, dma_irqs)
++		},
++	};
++
++	fb->debugfs_dir = debugfs_create_dir(DRIVER_NAME, NULL);
++	if (!fb->debugfs_dir) {
++		pr_warn("%s: could not create debugfs entry\n",
++			__func__);
++		return -EFAULT;
++	}
++
++	fb->stats.regset.regs = stats_registers;
++	fb->stats.regset.nregs = ARRAY_SIZE(stats_registers);
++	fb->stats.regset.base = &fb->stats;
++
++	debugfs_create_regset32("stats", 0444, fb->debugfs_dir,
++				&fb->stats.regset);
++	return 0;
++}
++
++static int bcm2708_fb_set_bitfields(struct fb_var_screeninfo *var)
++{
++	int ret = 0;
++
++	memset(&var->transp, 0, sizeof(var->transp));
++
++	var->red.msb_right = 0;
++	var->green.msb_right = 0;
++	var->blue.msb_right = 0;
++
++	switch (var->bits_per_pixel) {
++	case 1:
++	case 2:
++	case 4:
++	case 8:
++		var->red.length = var->bits_per_pixel;
++		var->red.offset = 0;
++		var->green.length = var->bits_per_pixel;
++		var->green.offset = 0;
++		var->blue.length = var->bits_per_pixel;
++		var->blue.offset = 0;
++		break;
++	case 16:
++		var->red.length = 5;
++		var->blue.length = 5;
++		/*
++		 * Green length can be 5 or 6 depending whether
++		 * we're operating in RGB555 or RGB565 mode.
++		 */
++		if (var->green.length != 5 && var->green.length != 6)
++			var->green.length = 6;
++		break;
++	case 24:
++		var->red.length = 8;
++		var->blue.length = 8;
++		var->green.length = 8;
++		break;
++	case 32:
++		var->red.length = 8;
++		var->green.length = 8;
++		var->blue.length = 8;
++		var->transp.length = 8;
++		break;
++	default:
++		ret = -EINVAL;
++		break;
++	}
++
++	/*
++	 * >= 16bpp displays have separate colour component bitfields
++	 * encoded in the pixel data.  Calculate their position from
++	 * the bitfield length defined above.
++	 */
++	if (ret == 0 && var->bits_per_pixel >= 24 && fbswap) {
++		var->blue.offset = 0;
++		var->green.offset = var->blue.offset + var->blue.length;
++		var->red.offset = var->green.offset + var->green.length;
++		var->transp.offset = var->red.offset + var->red.length;
++	} else if (ret == 0 && var->bits_per_pixel >= 24) {
++		var->red.offset = 0;
++		var->green.offset = var->red.offset + var->red.length;
++		var->blue.offset = var->green.offset + var->green.length;
++		var->transp.offset = var->blue.offset + var->blue.length;
++	} else if (ret == 0 && var->bits_per_pixel >= 16) {
++		var->blue.offset = 0;
++		var->green.offset = var->blue.offset + var->blue.length;
++		var->red.offset = var->green.offset + var->green.length;
++		var->transp.offset = var->red.offset + var->red.length;
++	}
++
++	return ret;
++}
++
++static int bcm2708_fb_check_var(struct fb_var_screeninfo *var,
++				struct fb_info *info)
++{
++	/* info input, var output */
++	print_debug("%s(%p) %dx%d (%dx%d), %d, %d\n",
++		    __func__, info, info->var.xres, info->var.yres,
++		    info->var.xres_virtual, info->var.yres_virtual,
++		    (int)info->screen_size, info->var.bits_per_pixel);
++	print_debug("%s(%p) %dx%d (%dx%d), %d\n", __func__, var, var->xres,
++		    var->yres, var->xres_virtual, var->yres_virtual,
++		    var->bits_per_pixel);
++
++	if (!var->bits_per_pixel)
++		var->bits_per_pixel = 16;
++
++	if (bcm2708_fb_set_bitfields(var) != 0) {
++		pr_err("%s: invalid bits_per_pixel %d\n", __func__,
++		       var->bits_per_pixel);
++		return -EINVAL;
++	}
++
++	if (var->xres_virtual < var->xres)
++		var->xres_virtual = var->xres;
++	/* use highest possible virtual resolution */
++	if (var->yres_virtual == -1) {
++		var->yres_virtual = 480;
++
++		pr_err("%s: virtual resolution set to maximum of %dx%d\n",
++		       __func__, var->xres_virtual, var->yres_virtual);
++	}
++	if (var->yres_virtual < var->yres)
++		var->yres_virtual = var->yres;
++
++	if (var->xoffset < 0)
++		var->xoffset = 0;
++	if (var->yoffset < 0)
++		var->yoffset = 0;
++
++	/* truncate xoffset and yoffset to maximum if too high */
++	if (var->xoffset > var->xres_virtual - var->xres)
++		var->xoffset = var->xres_virtual - var->xres - 1;
++	if (var->yoffset > var->yres_virtual - var->yres)
++		var->yoffset = var->yres_virtual - var->yres - 1;
++
++	return 0;
++}
++
++static int bcm2708_fb_set_par(struct fb_info *info)
++{
++	struct bcm2708_fb *fb = to_bcm2708(info);
++	struct fb_alloc_tags fbinfo = {
++		.tag1 = { RPI_FIRMWARE_FRAMEBUFFER_SET_PHYSICAL_WIDTH_HEIGHT,
++			  8, 0, },
++			.xres = info->var.xres,
++			.yres = info->var.yres,
++		.tag2 = { RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_WIDTH_HEIGHT,
++			  8, 0, },
++			.xres_virtual = info->var.xres_virtual,
++			.yres_virtual = info->var.yres_virtual,
++		.tag3 = { RPI_FIRMWARE_FRAMEBUFFER_SET_DEPTH, 4, 0 },
++			.bpp = info->var.bits_per_pixel,
++		.tag4 = { RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_OFFSET, 8, 0 },
++			.xoffset = info->var.xoffset,
++			.yoffset = info->var.yoffset,
++		.tag5 = { RPI_FIRMWARE_FRAMEBUFFER_ALLOCATE, 8, 0 },
++			/* base and screen_size will be initialised later */
++		.tag6 = { RPI_FIRMWARE_FRAMEBUFFER_SET_PITCH, 4, 0 },
++			/* pitch will be initialised later */
++	};
++	int ret, image_size;
++
++
++	print_debug("%s(%p) %dx%d (%dx%d), %d, %d\n", __func__, info,
++		    info->var.xres, info->var.yres, info->var.xres_virtual,
++		    info->var.yres_virtual, (int)info->screen_size,
++		    info->var.bits_per_pixel);
++
++	/* Try allocating our own buffer. We can specify all the parameters */
++	image_size = ((info->var.xres * info->var.yres) *
++		      info->var.bits_per_pixel) >> 3;
++
++	if (!fb->disable_arm_alloc &&
++	    (image_size != fb->image_size || !fb->dma_addr)) {
++		if (fb->dma_addr) {
++			dma_free_coherent(info->device, fb->image_size,
++					  fb->cpuaddr, fb->dma_addr);
++			fb->image_size = 0;
++			fb->cpuaddr = NULL;
++			fb->dma_addr = 0;
++		}
++
++		fb->cpuaddr = dma_alloc_coherent(info->device, image_size,
++						 &fb->dma_addr, GFP_KERNEL);
++
++		if (!fb->cpuaddr) {
++			fb->dma_addr = 0;
++			fb->disable_arm_alloc = true;
++		} else {
++			fb->image_size = image_size;
++		}
++	}
++
++	if (fb->cpuaddr) {
++		fbinfo.base = fb->dma_addr;
++		fbinfo.screen_size = image_size;
++		fbinfo.pitch = (info->var.xres * info->var.bits_per_pixel) >> 3;
++
++		ret = rpi_firmware_property_list(fb->fw, &fbinfo,
++						 sizeof(fbinfo));
++		if (ret || fbinfo.base != fb->dma_addr) {
++			/* Firmware either failed, or assigned a different base
++			 * address (ie it doesn't support being passed an FB
++			 * allocation).
++			 * Destroy the allocation, and don't try again.
++			 */
++			dma_free_coherent(info->device, fb->image_size,
++					  fb->cpuaddr, fb->dma_addr);
++			fb->image_size = 0;
++			fb->cpuaddr = NULL;
++			fb->dma_addr = 0;
++			fb->disable_arm_alloc = true;
++		}
++	} else {
++		/* Our allocation failed - drop into the old scheme of
++		 * allocation by the VPU.
++		 */
++		ret = -ENOMEM;
++	}
++
++	if (ret) {
++		/* Old scheme:
++		 * - FRAMEBUFFER_ALLOCATE passes 0 for base and screen_size.
++		 * - GET_PITCH instead of SET_PITCH.
++		 */
++		fbinfo.base = 0;
++		fbinfo.screen_size = 0;
++		fbinfo.tag6.tag = RPI_FIRMWARE_FRAMEBUFFER_GET_PITCH;
++		fbinfo.pitch = 0;
++
++		ret = rpi_firmware_property_list(fb->fw, &fbinfo,
++						 sizeof(fbinfo));
++		if (ret) {
++			dev_err(info->device,
++				"Failed to allocate GPU framebuffer (%d)\n",
++				ret);
++			return ret;
++		}
++	}
++
++	if (info->var.bits_per_pixel <= 8)
++		fb->fb.fix.visual = FB_VISUAL_PSEUDOCOLOR;
++	else
++		fb->fb.fix.visual = FB_VISUAL_TRUECOLOR;
++
++	fb->fb.fix.line_length = fbinfo.pitch;
++	fbinfo.base |= 0x40000000;
++	fb->fb_bus_address = fbinfo.base;
++	fbinfo.base &= ~0xc0000000;
++	fb->fb.fix.smem_start = fbinfo.base;
++	fb->fb.fix.smem_len = fbinfo.pitch * fbinfo.yres_virtual;
++	fb->fb.screen_size = fbinfo.screen_size;
++
++	if (!fb->dma_addr) {
++		if (fb->fb.screen_base)
++			iounmap(fb->fb.screen_base);
++
++		fb->fb.screen_base = ioremap_wc(fbinfo.base,
++						fb->fb.screen_size);
++	} else {
++		fb->fb.screen_base = fb->cpuaddr;
++	}
++
++	if (!fb->fb.screen_base) {
++		/* the console may currently be locked */
++		console_trylock();
++		console_unlock();
++		dev_err(info->device, "Failed to set screen_base\n");
++		return -ENOMEM;
++	}
++
++	print_debug("%s: start = %p,%p width=%d, height=%d, bpp=%d, pitch=%d size=%d\n",
++		    __func__, (void *)fb->fb.screen_base,
++		    (void *)fb->fb_bus_address, fbinfo.xres, fbinfo.yres,
++		    fbinfo.bpp, fbinfo.pitch, (int)fb->fb.screen_size);
++
++	return 0;
++}
++
++static inline u32 convert_bitfield(int val, struct fb_bitfield *bf)
++{
++	unsigned int mask = (1 << bf->length) - 1;
++
++	return (val >> (16 - bf->length) & mask) << bf->offset;
++}
++
++static int bcm2708_fb_setcolreg(unsigned int regno, unsigned int red,
++				unsigned int green, unsigned int blue,
++				unsigned int transp, struct fb_info *info)
++{
++	struct bcm2708_fb *fb = to_bcm2708(info);
++
++	if (fb->fb.var.bits_per_pixel <= 8) {
++		if (regno < 256) {
++			/* blue [23:16], green [15:8], red [7:0] */
++			fb->gpu_cmap[regno] = ((red   >> 8) & 0xff) << 0 |
++					      ((green >> 8) & 0xff) << 8 |
++					      ((blue  >> 8) & 0xff) << 16;
++		}
++		/* Hack: we need to tell GPU the palette has changed, but
++		 * currently bcm2708_fb_set_par takes noticeable time when
++		 * called for every (256) colour
++		 * So just call it for what looks like the last colour in a
++		 * list for now.
++		 */
++		if (regno == 15 || regno == 255) {
++			struct packet {
++				u32 offset;
++				u32 length;
++				u32 cmap[256];
++			} *packet;
++			int ret;
++
++			packet = kmalloc(sizeof(*packet), GFP_KERNEL);
++			if (!packet)
++				return -ENOMEM;
++			packet->offset = 0;
++			packet->length = regno + 1;
++			memcpy(packet->cmap, fb->gpu_cmap,
++			       sizeof(packet->cmap));
++			ret = rpi_firmware_property(fb->fw,
++						    RPI_FIRMWARE_FRAMEBUFFER_SET_PALETTE,
++						    packet,
++						    (2 + packet->length) * sizeof(u32));
++			if (ret || packet->offset)
++				dev_err(info->device,
++					"Failed to set palette (%d,%u)\n",
++					ret, packet->offset);
++			kfree(packet);
++		}
++	} else if (regno < 16) {
++		fb->cmap[regno] = convert_bitfield(transp, &fb->fb.var.transp) |
++				  convert_bitfield(blue, &fb->fb.var.blue) |
++				  convert_bitfield(green, &fb->fb.var.green) |
++				  convert_bitfield(red, &fb->fb.var.red);
++	}
++	return regno > 255;
++}
++
++static int bcm2708_fb_blank(int blank_mode, struct fb_info *info)
++{
++	struct bcm2708_fb *fb = to_bcm2708(info);
++	u32 value;
++	int ret;
++
++	switch (blank_mode) {
++	case FB_BLANK_UNBLANK:
++		value = 0;
++		break;
++	case FB_BLANK_NORMAL:
++	case FB_BLANK_VSYNC_SUSPEND:
++	case FB_BLANK_HSYNC_SUSPEND:
++	case FB_BLANK_POWERDOWN:
++		value = 1;
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	ret = rpi_firmware_property(fb->fw, RPI_FIRMWARE_FRAMEBUFFER_BLANK,
++				    &value, sizeof(value));
++	if (ret)
++		dev_err(info->device, "%s(%d) failed: %d\n", __func__,
++			blank_mode, ret);
++
++	return ret;
++}
++
++static int bcm2708_fb_pan_display(struct fb_var_screeninfo *var,
++				  struct fb_info *info)
++{
++	s32 result;
++
++	info->var.xoffset = var->xoffset;
++	info->var.yoffset = var->yoffset;
++	result = bcm2708_fb_set_par(info);
++	if (result != 0)
++		pr_err("%s(%d,%d) returns=%d\n", __func__, var->xoffset,
++		       var->yoffset, result);
++	return result;
++}
++
++static int bcm2708_ioctl(struct fb_info *info, unsigned int cmd, unsigned long arg)
++{
++	struct bcm2708_fb *fb = to_bcm2708(info);
++	u32 dummy = 0;
++	int ret;
++
++	switch (cmd) {
++	case FBIO_WAITFORVSYNC:
++		ret = rpi_firmware_property(fb->fw,
++					    RPI_FIRMWARE_FRAMEBUFFER_SET_VSYNC,
++					    &dummy, sizeof(dummy));
++		break;
++	default:
++		dev_dbg(info->device, "Unknown ioctl 0x%x\n", cmd);
++		return -ENOTTY;
++	}
++
++	if (ret)
++		dev_err(info->device, "ioctl 0x%x failed (%d)\n", cmd, ret);
++
++	return ret;
++}
++static void bcm2708_fb_fillrect(struct fb_info *info,
++				const struct fb_fillrect *rect)
++{
++	/* (is called) print_debug("bcm2708_fb_fillrect\n"); */
++	cfb_fillrect(info, rect);
++}
++
++/* A helper function for configuring dma control block */
++static void set_dma_cb(struct bcm2708_dma_cb *cb,
++		       int        burst_size,
++		       dma_addr_t dst,
++		       int        dst_stride,
++		       dma_addr_t src,
++		       int        src_stride,
++		       int        w,
++		       int        h)
++{
++	cb->info = BCM2708_DMA_BURST(burst_size) | BCM2708_DMA_S_WIDTH |
++		   BCM2708_DMA_S_INC | BCM2708_DMA_D_WIDTH |
++		   BCM2708_DMA_D_INC | BCM2708_DMA_TDMODE;
++	cb->dst = dst;
++	cb->src = src;
++	/*
++	 * This is not really obvious from the DMA documentation,
++	 * but the top 16 bits must be programmmed to "height -1"
++	 * and not "height" in 2D mode.
++	 */
++	cb->length = ((h - 1) << 16) | w;
++	cb->stride = ((dst_stride - w) << 16) | (u16)(src_stride - w);
++	cb->pad[0] = 0;
++	cb->pad[1] = 0;
++}
++
++static void bcm2708_fb_copyarea(struct fb_info *info,
++				const struct fb_copyarea *region)
++{
++	struct bcm2708_fb *fb = to_bcm2708(info);
++	struct bcm2708_dma_cb *cb = fb->cb_base;
++	int bytes_per_pixel = (info->var.bits_per_pixel + 7) >> 3;
++
++	/* Channel 0 supports larger bursts and is a bit faster */
++	int burst_size = (fb->dma_chan == 0) ? 8 : 2;
++	int pixels = region->width * region->height;
++
++	/* Fallback to cfb_copyarea() if we don't like something */
++	if (bytes_per_pixel > 4 ||
++	    info->var.xres * info->var.yres > 1920 * 1200 ||
++	    region->width <= 0 || region->width > info->var.xres ||
++	    region->height <= 0 || region->height > info->var.yres ||
++	    region->sx < 0 || region->sx >= info->var.xres ||
++	    region->sy < 0 || region->sy >= info->var.yres ||
++	    region->dx < 0 || region->dx >= info->var.xres ||
++	    region->dy < 0 || region->dy >= info->var.yres ||
++	    region->sx + region->width > info->var.xres ||
++	    region->dx + region->width > info->var.xres ||
++	    region->sy + region->height > info->var.yres ||
++	    region->dy + region->height > info->var.yres) {
++		cfb_copyarea(info, region);
++		return;
++	}
++
++	if (region->dy == region->sy && region->dx > region->sx) {
++		/*
++		 * A difficult case of overlapped copy. Because DMA can't
++		 * copy individual scanlines in backwards direction, we need
++		 * two-pass processing. We do it by programming a chain of dma
++		 * control blocks in the first 16K part of the buffer and use
++		 * the remaining 48K as the intermediate temporary scratch
++		 * buffer. The buffer size is sufficient to handle up to
++		 * 1920x1200 resolution at 32bpp pixel depth.
++		 */
++		int y;
++		dma_addr_t control_block_pa = fb->cb_handle;
++		dma_addr_t scratchbuf = fb->cb_handle + 16 * 1024;
++		int scanline_size = bytes_per_pixel * region->width;
++		int scanlines_per_cb = (64 * 1024 - 16 * 1024) / scanline_size;
++
++		for (y = 0; y < region->height; y += scanlines_per_cb) {
++			dma_addr_t src =
++				fb->fb_bus_address +
++				bytes_per_pixel * region->sx +
++				(region->sy + y) * fb->fb.fix.line_length;
++			dma_addr_t dst =
++				fb->fb_bus_address +
++				bytes_per_pixel * region->dx +
++				(region->dy + y) * fb->fb.fix.line_length;
++
++			if (region->height - y < scanlines_per_cb)
++				scanlines_per_cb = region->height - y;
++
++			set_dma_cb(cb, burst_size, scratchbuf, scanline_size,
++				   src, fb->fb.fix.line_length,
++				   scanline_size, scanlines_per_cb);
++			control_block_pa += sizeof(struct bcm2708_dma_cb);
++			cb->next = control_block_pa;
++			cb++;
++
++			set_dma_cb(cb, burst_size, dst, fb->fb.fix.line_length,
++				   scratchbuf, scanline_size,
++				   scanline_size, scanlines_per_cb);
++			control_block_pa += sizeof(struct bcm2708_dma_cb);
++			cb->next = control_block_pa;
++			cb++;
++		}
++		/* move the pointer back to the last dma control block */
++		cb--;
++	} else {
++		/* A single dma control block is enough. */
++		int sy, dy, stride;
++
++		if (region->dy <= region->sy) {
++			/* processing from top to bottom */
++			dy = region->dy;
++			sy = region->sy;
++			stride = fb->fb.fix.line_length;
++		} else {
++			/* processing from bottom to top */
++			dy = region->dy + region->height - 1;
++			sy = region->sy + region->height - 1;
++			stride = -fb->fb.fix.line_length;
++		}
++		set_dma_cb(cb, burst_size,
++			   fb->fb_bus_address + dy * fb->fb.fix.line_length +
++						   bytes_per_pixel * region->dx,
++			   stride,
++			   fb->fb_bus_address + sy * fb->fb.fix.line_length +
++						   bytes_per_pixel * region->sx,
++			   stride,
++			   region->width * bytes_per_pixel,
++			   region->height);
++	}
++
++	/* end of dma control blocks chain */
++	cb->next = 0;
++
++	if (pixels < dma_busy_wait_threshold) {
++		bcm_dma_start(fb->dma_chan_base, fb->cb_handle);
++		bcm_dma_wait_idle(fb->dma_chan_base);
++	} else {
++		void __iomem *dma_chan = fb->dma_chan_base;
++
++		cb->info |= BCM2708_DMA_INT_EN;
++		bcm_dma_start(fb->dma_chan_base, fb->cb_handle);
++		while (bcm_dma_is_busy(dma_chan)) {
++			wait_event_interruptible(fb->dma_waitq,
++						 !bcm_dma_is_busy(dma_chan));
++		}
++		fb->stats.dma_irqs++;
++	}
++	fb->stats.dma_copies++;
++}
++
++static void bcm2708_fb_imageblit(struct fb_info *info,
++				 const struct fb_image *image)
++{
++	/* (is called) print_debug("bcm2708_fb_imageblit\n"); */
++	cfb_imageblit(info, image);
++}
++
++static irqreturn_t bcm2708_fb_dma_irq(int irq, void *cxt)
++{
++	struct bcm2708_fb *fb = cxt;
++
++	/* FIXME: should read status register to check if this is
++	 * actually interrupting us or not, in case this interrupt
++	 * ever becomes shared amongst several DMA channels
++	 *
++	 * readl(dma_chan_base + BCM2708_DMA_CS) & BCM2708_DMA_IRQ;
++	 */
++
++	/* acknowledge the interrupt */
++	writel(BCM2708_DMA_INT, fb->dma_chan_base + BCM2708_DMA_CS);
++
++	wake_up(&fb->dma_waitq);
++	return IRQ_HANDLED;
++}
++
++static struct fb_ops bcm2708_fb_ops = {
++	.owner = THIS_MODULE,
++	.fb_check_var = bcm2708_fb_check_var,
++	.fb_set_par = bcm2708_fb_set_par,
++	.fb_setcolreg = bcm2708_fb_setcolreg,
++	.fb_blank = bcm2708_fb_blank,
++	.fb_fillrect = bcm2708_fb_fillrect,
++	.fb_copyarea = bcm2708_fb_copyarea,
++	.fb_imageblit = bcm2708_fb_imageblit,
++	.fb_pan_display = bcm2708_fb_pan_display,
++	.fb_ioctl = bcm2708_ioctl,
++};
++
++static int bcm2708_fb_register(struct bcm2708_fb *fb)
++{
++	int ret;
++
++	fb->fb.fbops = &bcm2708_fb_ops;
++	fb->fb.flags = FBINFO_FLAG_DEFAULT | FBINFO_HWACCEL_COPYAREA;
++	fb->fb.pseudo_palette = fb->cmap;
++
++	strncpy(fb->fb.fix.id, bcm2708_name, sizeof(fb->fb.fix.id));
++	fb->fb.fix.type = FB_TYPE_PACKED_PIXELS;
++	fb->fb.fix.type_aux = 0;
++	fb->fb.fix.xpanstep = 1;
++	fb->fb.fix.ypanstep = 1;
++	fb->fb.fix.ywrapstep = 0;
++	fb->fb.fix.accel = FB_ACCEL_NONE;
++
++	fb->fb.var.xres = fbwidth;
++	fb->fb.var.yres = fbheight;
++	fb->fb.var.xres_virtual = fbwidth;
++	fb->fb.var.yres_virtual = fbheight;
++	fb->fb.var.bits_per_pixel = fbdepth;
++	fb->fb.var.vmode = FB_VMODE_NONINTERLACED;
++	fb->fb.var.activate = FB_ACTIVATE_NOW;
++	fb->fb.var.nonstd = 0;
++	fb->fb.var.height = -1;		/* height of picture in mm    */
++	fb->fb.var.width = -1;		/* width of picture in mm    */
++	fb->fb.var.accel_flags = 0;
++
++	fb->fb.monspecs.hfmin = 0;
++	fb->fb.monspecs.hfmax = 100000;
++	fb->fb.monspecs.vfmin = 0;
++	fb->fb.monspecs.vfmax = 400;
++	fb->fb.monspecs.dclkmin = 1000000;
++	fb->fb.monspecs.dclkmax = 100000000;
++
++	bcm2708_fb_set_bitfields(&fb->fb.var);
++	init_waitqueue_head(&fb->dma_waitq);
++
++	/*
++	 * Allocate colourmap.
++	 */
++
++	fb_set_var(&fb->fb, &fb->fb.var);
++	ret = bcm2708_fb_set_par(&fb->fb);
++	if (ret)
++		return ret;
++
++	print_debug("BCM2708FB: registering framebuffer (%dx%d@%d) (%d)\n",
++		    fbwidth, fbheight, fbdepth, fbswap);
++
++	ret = register_framebuffer(&fb->fb);
++	print_debug("BCM2708FB: register framebuffer (%d)\n", ret);
++	if (ret == 0)
++		goto out;
++
++	print_debug("BCM2708FB: cannot register framebuffer (%d)\n", ret);
++out:
++	return ret;
++}
++
++static int bcm2708_fb_probe(struct platform_device *dev)
++{
++	struct device_node *fw_np;
++	struct rpi_firmware *fw;
++	struct bcm2708_fb *fb;
++	int ret;
++
++	fw_np = of_parse_phandle(dev->dev.of_node, "firmware", 0);
++/* Remove comment when booting without Device Tree is no longer supported
++ *	if (!fw_np) {
++ *		dev_err(&dev->dev, "Missing firmware node\n");
++ *		return -ENOENT;
++ *	}
++ */
++	fw = rpi_firmware_get(fw_np);
++	if (!fw)
++		return -EPROBE_DEFER;
++
++	fb = kzalloc(sizeof(*fb), GFP_KERNEL);
++	if (!fb) {
++		ret = -ENOMEM;
++		goto free_region;
++	}
++
++	fb->fw = fw;
++	bcm2708_fb_debugfs_init(fb);
++
++	fb->cb_base = dma_alloc_wc(&dev->dev, SZ_64K,
++					     &fb->cb_handle, GFP_KERNEL);
++	if (!fb->cb_base) {
++		dev_err(&dev->dev, "cannot allocate DMA CBs\n");
++		ret = -ENOMEM;
++		goto free_fb;
++	}
++
++	pr_info("BCM2708FB: allocated DMA memory %pad\n", &fb->cb_handle);
++
++	ret = bcm_dma_chan_alloc(BCM_DMA_FEATURE_BULK,
++				 &fb->dma_chan_base, &fb->dma_irq);
++	if (ret < 0) {
++		dev_err(&dev->dev, "couldn't allocate a DMA channel\n");
++		goto free_cb;
++	}
++	fb->dma_chan = ret;
++
++	ret = request_irq(fb->dma_irq, bcm2708_fb_dma_irq,
++			  0, "bcm2708_fb dma", fb);
++	if (ret) {
++		pr_err("%s: failed to request DMA irq\n", __func__);
++		goto free_dma_chan;
++	}
++
++	pr_info("BCM2708FB: allocated DMA channel %d\n", fb->dma_chan);
++
++	fb->dev = dev;
++	fb->fb.device = &dev->dev;
++
++	/* failure here isn't fatal, but we'll fail in vc_mem_copy if
++	 * fb->gpu is not valid
++	 */
++	rpi_firmware_property(fb->fw, RPI_FIRMWARE_GET_VC_MEMORY, &fb->gpu,
++			      sizeof(fb->gpu));
++
++	ret = bcm2708_fb_register(fb);
++	if (ret == 0) {
++		platform_set_drvdata(dev, fb);
++		goto out;
++	}
++
++free_dma_chan:
++	bcm_dma_chan_free(fb->dma_chan);
++free_cb:
++	dma_free_wc(&dev->dev, SZ_64K, fb->cb_base, fb->cb_handle);
++free_fb:
++	kfree(fb);
++free_region:
++	dev_err(&dev->dev, "probe failed, err %d\n", ret);
++out:
++	return ret;
++}
++
++static int bcm2708_fb_remove(struct platform_device *dev)
++{
++	struct bcm2708_fb *fb = platform_get_drvdata(dev);
++
++	platform_set_drvdata(dev, NULL);
++
++	if (fb->fb.screen_base)
++		iounmap(fb->fb.screen_base);
++	unregister_framebuffer(&fb->fb);
++
++	dma_free_wc(&dev->dev, SZ_64K, fb->cb_base, fb->cb_handle);
++	bcm_dma_chan_free(fb->dma_chan);
++
++	bcm2708_fb_debugfs_deinit(fb);
++
++	free_irq(fb->dma_irq, fb);
++
++	kfree(fb);
++
++	return 0;
++}
++
++static const struct of_device_id bcm2708_fb_of_match_table[] = {
++	{ .compatible = "brcm,bcm2708-fb", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, bcm2708_fb_of_match_table);
++
++static struct platform_driver bcm2708_fb_driver = {
++	.probe = bcm2708_fb_probe,
++	.remove = bcm2708_fb_remove,
++	.driver = {
++		   .name = DRIVER_NAME,
++		   .owner = THIS_MODULE,
++		   .of_match_table = bcm2708_fb_of_match_table,
++		   },
++};
++
++static int __init bcm2708_fb_init(void)
++{
++	return platform_driver_register(&bcm2708_fb_driver);
++}
++
++module_init(bcm2708_fb_init);
++
++static void __exit bcm2708_fb_exit(void)
++{
++	platform_driver_unregister(&bcm2708_fb_driver);
++}
++
++module_exit(bcm2708_fb_exit);
++
++module_param(fbwidth, int, 0644);
++module_param(fbheight, int, 0644);
++module_param(fbdepth, int, 0644);
++module_param(fbswap, int, 0644);
++
++MODULE_DESCRIPTION("BCM2708 framebuffer driver");
++MODULE_LICENSE("GPL");
++
++MODULE_PARM_DESC(fbwidth, "Width of ARM Framebuffer");
++MODULE_PARM_DESC(fbheight, "Height of ARM Framebuffer");
++MODULE_PARM_DESC(fbdepth, "Bit depth of ARM Framebuffer");
++MODULE_PARM_DESC(fbswap, "Swap order of red and blue in 24 and 32 bit modes");
+--- a/drivers/video/logo/logo_linux_clut224.ppm
++++ b/drivers/video/logo/logo_linux_clut224.ppm
+@@ -1,1604 +1,883 @@
+ P3
+-# Standard 224-color Linux logo
+-80 80
++63 80
+ 255
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  6   6   6   6   6   6  10  10  10  10  10  10
+- 10  10  10   6   6   6   6   6   6   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   6   6   6  10  10  10  14  14  14
+- 22  22  22  26  26  26  30  30  30  34  34  34
+- 30  30  30  30  30  30  26  26  26  18  18  18
+- 14  14  14  10  10  10   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   1   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  6   6   6  14  14  14  26  26  26  42  42  42
+- 54  54  54  66  66  66  78  78  78  78  78  78
+- 78  78  78  74  74  74  66  66  66  54  54  54
+- 42  42  42  26  26  26  18  18  18  10  10  10
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   1   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 22  22  22  42  42  42  66  66  66  86  86  86
+- 66  66  66  38  38  38  38  38  38  22  22  22
+- 26  26  26  34  34  34  54  54  54  66  66  66
+- 86  86  86  70  70  70  46  46  46  26  26  26
+- 14  14  14   6   6   6   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   1   0   0   1   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0  10  10  10  26  26  26
+- 50  50  50  82  82  82  58  58  58   6   6   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  6   6   6  54  54  54  86  86  86  66  66  66
+- 38  38  38  18  18  18   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   6   6   6  22  22  22  50  50  50
+- 78  78  78  34  34  34   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   6   6   6  70  70  70
+- 78  78  78  46  46  46  22  22  22   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   1   0   0   1   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  6   6   6  18  18  18  42  42  42  82  82  82
+- 26  26  26   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  14  14  14
+- 46  46  46  34  34  34   6   6   6   2   2   6
+- 42  42  42  78  78  78  42  42  42  18  18  18
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   1   0   0   0   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+- 10  10  10  30  30  30  66  66  66  58  58  58
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  26  26  26
+- 86  86  86 101 101 101  46  46  46  10  10  10
+-  2   2   6  58  58  58  70  70  70  34  34  34
+- 10  10  10   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   1   0   0   1   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+- 14  14  14  42  42  42  86  86  86  10  10  10
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  30  30  30
+- 94  94  94  94  94  94  58  58  58  26  26  26
+-  2   2   6   6   6   6  78  78  78  54  54  54
+- 22  22  22   6   6   6   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 22  22  22  62  62  62  62  62  62   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  26  26  26
+- 54  54  54  38  38  38  18  18  18  10  10  10
+-  2   2   6   2   2   6  34  34  34  82  82  82
+- 38  38  38  14  14  14   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   1   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 30  30  30  78  78  78  30  30  30   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  10  10  10
+- 10  10  10   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  78  78  78
+- 50  50  50  18  18  18   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   1   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 38  38  38  86  86  86  14  14  14   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  54  54  54
+- 66  66  66  26  26  26   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   1   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 42  42  42  82  82  82   2   2   6   2   2   6
+-  2   2   6   6   6   6  10  10  10   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   6   6   6
+- 14  14  14  10  10  10   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  18  18  18
+- 82  82  82  34  34  34  10  10  10   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   1   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 46  46  46  86  86  86   2   2   6   2   2   6
+-  6   6   6   6   6   6  22  22  22  34  34  34
+-  6   6   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6  18  18  18  34  34  34
+- 10  10  10  50  50  50  22  22  22   2   2   6
+-  2   2   6   2   2   6   2   2   6  10  10  10
+- 86  86  86  42  42  42  14  14  14   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   1   0   0   1   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 46  46  46  86  86  86   2   2   6   2   2   6
+- 38  38  38 116 116 116  94  94  94  22  22  22
+- 22  22  22   2   2   6   2   2   6   2   2   6
+- 14  14  14  86  86  86 138 138 138 162 162 162
+-154 154 154  38  38  38  26  26  26   6   6   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 86  86  86  46  46  46  14  14  14   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 46  46  46  86  86  86   2   2   6  14  14  14
+-134 134 134 198 198 198 195 195 195 116 116 116
+- 10  10  10   2   2   6   2   2   6   6   6   6
+-101  98  89 187 187 187 210 210 210 218 218 218
+-214 214 214 134 134 134  14  14  14   6   6   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 86  86  86  50  50  50  18  18  18   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   1   0   0   0
+-  0   0   1   0   0   1   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 46  46  46  86  86  86   2   2   6  54  54  54
+-218 218 218 195 195 195 226 226 226 246 246 246
+- 58  58  58   2   2   6   2   2   6  30  30  30
+-210 210 210 253 253 253 174 174 174 123 123 123
+-221 221 221 234 234 234  74  74  74   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 70  70  70  58  58  58  22  22  22   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 46  46  46  82  82  82   2   2   6 106 106 106
+-170 170 170  26  26  26  86  86  86 226 226 226
+-123 123 123  10  10  10  14  14  14  46  46  46
+-231 231 231 190 190 190   6   6   6  70  70  70
+- 90  90  90 238 238 238 158 158 158   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 70  70  70  58  58  58  22  22  22   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   1   0   0   0
+-  0   0   1   0   0   1   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 42  42  42  86  86  86   6   6   6 116 116 116
+-106 106 106   6   6   6  70  70  70 149 149 149
+-128 128 128  18  18  18  38  38  38  54  54  54
+-221 221 221 106 106 106   2   2   6  14  14  14
+- 46  46  46 190 190 190 198 198 198   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 74  74  74  62  62  62  22  22  22   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   1   0   0   0
+-  0   0   1   0   0   0   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 42  42  42  94  94  94  14  14  14 101 101 101
+-128 128 128   2   2   6  18  18  18 116 116 116
+-118  98  46 121  92   8 121  92   8  98  78  10
+-162 162 162 106 106 106   2   2   6   2   2   6
+-  2   2   6 195 195 195 195 195 195   6   6   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 74  74  74  62  62  62  22  22  22   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   1   0   0   1
+-  0   0   1   0   0   0   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 38  38  38  90  90  90  14  14  14  58  58  58
+-210 210 210  26  26  26  54  38   6 154 114  10
+-226 170  11 236 186  11 225 175  15 184 144  12
+-215 174  15 175 146  61  37  26   9   2   2   6
+- 70  70  70 246 246 246 138 138 138   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 70  70  70  66  66  66  26  26  26   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 38  38  38  86  86  86  14  14  14  10  10  10
+-195 195 195 188 164 115 192 133   9 225 175  15
+-239 182  13 234 190  10 232 195  16 232 200  30
+-245 207  45 241 208  19 232 195  16 184 144  12
+-218 194 134 211 206 186  42  42  42   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 50  50  50  74  74  74  30  30  30   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 34  34  34  86  86  86  14  14  14   2   2   6
+-121  87  25 192 133   9 219 162  10 239 182  13
+-236 186  11 232 195  16 241 208  19 244 214  54
+-246 218  60 246 218  38 246 215  20 241 208  19
+-241 208  19 226 184  13 121  87  25   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 50  50  50  82  82  82  34  34  34  10  10  10
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 34  34  34  82  82  82  30  30  30  61  42   6
+-180 123   7 206 145  10 230 174  11 239 182  13
+-234 190  10 238 202  15 241 208  19 246 218  74
+-246 218  38 246 215  20 246 215  20 246 215  20
+-226 184  13 215 174  15 184 144  12   6   6   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 26  26  26  94  94  94  42  42  42  14  14  14
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 30  30  30  78  78  78  50  50  50 104  69   6
+-192 133   9 216 158  10 236 178  12 236 186  11
+-232 195  16 241 208  19 244 214  54 245 215  43
+-246 215  20 246 215  20 241 208  19 198 155  10
+-200 144  11 216 158  10 156 118  10   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  6   6   6  90  90  90  54  54  54  18  18  18
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 30  30  30  78  78  78  46  46  46  22  22  22
+-137  92   6 210 162  10 239 182  13 238 190  10
+-238 202  15 241 208  19 246 215  20 246 215  20
+-241 208  19 203 166  17 185 133  11 210 150  10
+-216 158  10 210 150  10 102  78  10   2   2   6
+-  6   6   6  54  54  54  14  14  14   2   2   6
+-  2   2   6  62  62  62  74  74  74  30  30  30
+- 10  10  10   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 34  34  34  78  78  78  50  50  50   6   6   6
+- 94  70  30 139 102  15 190 146  13 226 184  13
+-232 200  30 232 195  16 215 174  15 190 146  13
+-168 122  10 192 133   9 210 150  10 213 154  11
+-202 150  34 182 157 106 101  98  89   2   2   6
+-  2   2   6  78  78  78 116 116 116  58  58  58
+-  2   2   6  22  22  22  90  90  90  46  46  46
+- 18  18  18   6   6   6   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 38  38  38  86  86  86  50  50  50   6   6   6
+-128 128 128 174 154 114 156 107  11 168 122  10
+-198 155  10 184 144  12 197 138  11 200 144  11
+-206 145  10 206 145  10 197 138  11 188 164 115
+-195 195 195 198 198 198 174 174 174  14  14  14
+-  2   2   6  22  22  22 116 116 116 116 116 116
+- 22  22  22   2   2   6  74  74  74  70  70  70
+- 30  30  30  10  10  10   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  18  18  18
+- 50  50  50 101 101 101  26  26  26  10  10  10
+-138 138 138 190 190 190 174 154 114 156 107  11
+-197 138  11 200 144  11 197 138  11 192 133   9
+-180 123   7 190 142  34 190 178 144 187 187 187
+-202 202 202 221 221 221 214 214 214  66  66  66
+-  2   2   6   2   2   6  50  50  50  62  62  62
+-  6   6   6   2   2   6  10  10  10  90  90  90
+- 50  50  50  18  18  18   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0  10  10  10  34  34  34
+- 74  74  74  74  74  74   2   2   6   6   6   6
+-144 144 144 198 198 198 190 190 190 178 166 146
+-154 121  60 156 107  11 156 107  11 168 124  44
+-174 154 114 187 187 187 190 190 190 210 210 210
+-246 246 246 253 253 253 253 253 253 182 182 182
+-  6   6   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  62  62  62
+- 74  74  74  34  34  34  14  14  14   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0  10  10  10  22  22  22  54  54  54
+- 94  94  94  18  18  18   2   2   6  46  46  46
+-234 234 234 221 221 221 190 190 190 190 190 190
+-190 190 190 187 187 187 187 187 187 190 190 190
+-190 190 190 195 195 195 214 214 214 242 242 242
+-253 253 253 253 253 253 253 253 253 253 253 253
+- 82  82  82   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  14  14  14
+- 86  86  86  54  54  54  22  22  22   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  6   6   6  18  18  18  46  46  46  90  90  90
+- 46  46  46  18  18  18   6   6   6 182 182 182
+-253 253 253 246 246 246 206 206 206 190 190 190
+-190 190 190 190 190 190 190 190 190 190 190 190
+-206 206 206 231 231 231 250 250 250 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-202 202 202  14  14  14   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 42  42  42  86  86  86  42  42  42  18  18  18
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 14  14  14  38  38  38  74  74  74  66  66  66
+-  2   2   6   6   6   6  90  90  90 250 250 250
+-253 253 253 253 253 253 238 238 238 198 198 198
+-190 190 190 190 190 190 195 195 195 221 221 221
+-246 246 246 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253  82  82  82   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6  78  78  78  70  70  70  34  34  34
+- 14  14  14   6   6   6   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 34  34  34  66  66  66  78  78  78   6   6   6
+-  2   2   6  18  18  18 218 218 218 253 253 253
+-253 253 253 253 253 253 253 253 253 246 246 246
+-226 226 226 231 231 231 246 246 246 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 178 178 178   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6  18  18  18  90  90  90  62  62  62
+- 30  30  30  10  10  10   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0  10  10  10  26  26  26
+- 58  58  58  90  90  90  18  18  18   2   2   6
+-  2   2   6 110 110 110 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-250 250 250 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 231 231 231  18  18  18   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6  18  18  18  94  94  94
+- 54  54  54  26  26  26  10  10  10   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   6   6   6  22  22  22  50  50  50
+- 90  90  90  26  26  26   2   2   6   2   2   6
+- 14  14  14 195 195 195 250 250 250 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-250 250 250 242 242 242  54  54  54   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  38  38  38
+- 86  86  86  50  50  50  22  22  22   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  6   6   6  14  14  14  38  38  38  82  82  82
+- 34  34  34   2   2   6   2   2   6   2   2   6
+- 42  42  42 195 195 195 246 246 246 253 253 253
+-253 253 253 253 253 253 253 253 253 250 250 250
+-242 242 242 242 242 242 250 250 250 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 250 250 250 246 246 246 238 238 238
+-226 226 226 231 231 231 101 101 101   6   6   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 38  38  38  82  82  82  42  42  42  14  14  14
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+- 10  10  10  26  26  26  62  62  62  66  66  66
+-  2   2   6   2   2   6   2   2   6   6   6   6
+- 70  70  70 170 170 170 206 206 206 234 234 234
+-246 246 246 250 250 250 250 250 250 238 238 238
+-226 226 226 231 231 231 238 238 238 250 250 250
+-250 250 250 250 250 250 246 246 246 231 231 231
+-214 214 214 206 206 206 202 202 202 202 202 202
+-198 198 198 202 202 202 182 182 182  18  18  18
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6  62  62  62  66  66  66  30  30  30
+- 10  10  10   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+- 14  14  14  42  42  42  82  82  82  18  18  18
+-  2   2   6   2   2   6   2   2   6  10  10  10
+- 94  94  94 182 182 182 218 218 218 242 242 242
+-250 250 250 253 253 253 253 253 253 250 250 250
+-234 234 234 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 246 246 246
+-238 238 238 226 226 226 210 210 210 202 202 202
+-195 195 195 195 195 195 210 210 210 158 158 158
+-  6   6   6  14  14  14  50  50  50  14  14  14
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   6   6   6  86  86  86  46  46  46
+- 18  18  18   6   6   6   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 22  22  22  54  54  54  70  70  70   2   2   6
+-  2   2   6  10  10  10   2   2   6  22  22  22
+-166 166 166 231 231 231 250 250 250 253 253 253
+-253 253 253 253 253 253 253 253 253 250 250 250
+-242 242 242 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 246 246 246
+-231 231 231 206 206 206 198 198 198 226 226 226
+- 94  94  94   2   2   6   6   6   6  38  38  38
+- 30  30  30   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6  62  62  62  66  66  66
+- 26  26  26  10  10  10   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 30  30  30  74  74  74  50  50  50   2   2   6
+- 26  26  26  26  26  26   2   2   6 106 106 106
+-238 238 238 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 246 246 246 218 218 218 202 202 202
+-210 210 210  14  14  14   2   2   6   2   2   6
+- 30  30  30  22  22  22   2   2   6   2   2   6
+-  2   2   6   2   2   6  18  18  18  86  86  86
+- 42  42  42  14  14  14   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 42  42  42  90  90  90  22  22  22   2   2   6
+- 42  42  42   2   2   6  18  18  18 218 218 218
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 250 250 250 221 221 221
+-218 218 218 101 101 101   2   2   6  14  14  14
+- 18  18  18  38  38  38  10  10  10   2   2   6
+-  2   2   6   2   2   6   2   2   6  78  78  78
+- 58  58  58  22  22  22   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  18  18  18
+- 54  54  54  82  82  82   2   2   6  26  26  26
+- 22  22  22   2   2   6 123 123 123 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 250 250 250
+-238 238 238 198 198 198   6   6   6  38  38  38
+- 58  58  58  26  26  26  38  38  38   2   2   6
+-  2   2   6   2   2   6   2   2   6  46  46  46
+- 78  78  78  30  30  30  10  10  10   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0  10  10  10  30  30  30
+- 74  74  74  58  58  58   2   2   6  42  42  42
+-  2   2   6  22  22  22 231 231 231 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 250 250 250
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 246 246 246  46  46  46  38  38  38
+- 42  42  42  14  14  14  38  38  38  14  14  14
+-  2   2   6   2   2   6   2   2   6   6   6   6
+- 86  86  86  46  46  46  14  14  14   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   6   6   6  14  14  14  42  42  42
+- 90  90  90  18  18  18  18  18  18  26  26  26
+-  2   2   6 116 116 116 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 250 250 250 238 238 238
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253  94  94  94   6   6   6
+-  2   2   6   2   2   6  10  10  10  34  34  34
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 74  74  74  58  58  58  22  22  22   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0  10  10  10  26  26  26  66  66  66
+- 82  82  82   2   2   6  38  38  38   6   6   6
+- 14  14  14 210 210 210 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 246 246 246 242 242 242
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 144 144 144   2   2   6
+-  2   2   6   2   2   6   2   2   6  46  46  46
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 42  42  42  74  74  74  30  30  30  10  10  10
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  6   6   6  14  14  14  42  42  42  90  90  90
+- 26  26  26   6   6   6  42  42  42   2   2   6
+- 74  74  74 250 250 250 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 242 242 242 242 242 242
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 182 182 182   2   2   6
+-  2   2   6   2   2   6   2   2   6  46  46  46
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 10  10  10  86  86  86  38  38  38  10  10  10
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+- 10  10  10  26  26  26  66  66  66  82  82  82
+-  2   2   6  22  22  22  18  18  18   2   2   6
+-149 149 149 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 234 234 234 242 242 242
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 206 206 206   2   2   6
+-  2   2   6   2   2   6   2   2   6  38  38  38
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  6   6   6  86  86  86  46  46  46  14  14  14
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 18  18  18  46  46  46  86  86  86  18  18  18
+-  2   2   6  34  34  34  10  10  10   6   6   6
+-210 210 210 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 234 234 234 242 242 242
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 221 221 221   6   6   6
+-  2   2   6   2   2   6   6   6   6  30  30  30
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6  82  82  82  54  54  54  18  18  18
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 26  26  26  66  66  66  62  62  62   2   2   6
+-  2   2   6  38  38  38  10  10  10  26  26  26
+-238 238 238 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 238 238 238
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231   6   6   6
+-  2   2   6   2   2   6  10  10  10  30  30  30
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6  66  66  66  58  58  58  22  22  22
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 38  38  38  78  78  78   6   6   6   2   2   6
+-  2   2   6  46  46  46  14  14  14  42  42  42
+-246 246 246 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 242 242 242
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 234 234 234  10  10  10
+-  2   2   6   2   2   6  22  22  22  14  14  14
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6  66  66  66  62  62  62  22  22  22
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  18  18  18
+- 50  50  50  74  74  74   2   2   6   2   2   6
+- 14  14  14  70  70  70  34  34  34  62  62  62
+-250 250 250 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 246 246 246
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 234 234 234  14  14  14
+-  2   2   6   2   2   6  30  30  30   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6  66  66  66  62  62  62  22  22  22
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  18  18  18
+- 54  54  54  62  62  62   2   2   6   2   2   6
+-  2   2   6  30  30  30  46  46  46  70  70  70
+-250 250 250 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 246 246 246
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 226 226 226  10  10  10
+-  2   2   6   6   6   6  30  30  30   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6  66  66  66  58  58  58  22  22  22
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  22  22  22
+- 58  58  58  62  62  62   2   2   6   2   2   6
+-  2   2   6   2   2   6  30  30  30  78  78  78
+-250 250 250 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 246 246 246
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 206 206 206   2   2   6
+- 22  22  22  34  34  34  18  14   6  22  22  22
+- 26  26  26  18  18  18   6   6   6   2   2   6
+-  2   2   6  82  82  82  54  54  54  18  18  18
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  26  26  26
+- 62  62  62 106 106 106  74  54  14 185 133  11
+-210 162  10 121  92   8   6   6   6  62  62  62
+-238 238 238 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 246 246 246
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 158 158 158  18  18  18
+- 14  14  14   2   2   6   2   2   6   2   2   6
+-  6   6   6  18  18  18  66  66  66  38  38  38
+-  6   6   6  94  94  94  50  50  50  18  18  18
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 10  10  10  10  10  10  18  18  18  38  38  38
+- 78  78  78 142 134 106 216 158  10 242 186  14
+-246 190  14 246 190  14 156 118  10  10  10  10
+- 90  90  90 238 238 238 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 250 250 250
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 246 230 190
+-238 204  91 238 204  91 181 142  44  37  26   9
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6  38  38  38  46  46  46
+- 26  26  26 106 106 106  54  54  54  18  18  18
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   6   6   6  14  14  14  22  22  22
+- 30  30  30  38  38  38  50  50  50  70  70  70
+-106 106 106 190 142  34 226 170  11 242 186  14
+-246 190  14 246 190  14 246 190  14 154 114  10
+-  6   6   6  74  74  74 226 226 226 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 250 250 250
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 228 184  62
+-241 196  14 241 208  19 232 195  16  38  30  10
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   6   6   6  30  30  30  26  26  26
+-203 166  17 154 142  90  66  66  66  26  26  26
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  6   6   6  18  18  18  38  38  38  58  58  58
+- 78  78  78  86  86  86 101 101 101 123 123 123
+-175 146  61 210 150  10 234 174  13 246 186  14
+-246 190  14 246 190  14 246 190  14 238 190  10
+-102  78  10   2   2   6  46  46  46 198 198 198
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 234 234 234 242 242 242
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 224 178  62
+-242 186  14 241 196  14 210 166  10  22  18   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   6   6   6 121  92   8
+-238 202  15 232 195  16  82  82  82  34  34  34
+- 10  10  10   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+- 14  14  14  38  38  38  70  70  70 154 122  46
+-190 142  34 200 144  11 197 138  11 197 138  11
+-213 154  11 226 170  11 242 186  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-225 175  15  46  32   6   2   2   6  22  22  22
+-158 158 158 250 250 250 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 250 250 250 242 242 242 224 178  62
+-239 182  13 236 186  11 213 154  11  46  32   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6  61  42   6 225 175  15
+-238 190  10 236 186  11 112 100  78  42  42  42
+- 14  14  14   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 22  22  22  54  54  54 154 122  46 213 154  11
+-226 170  11 230 174  11 226 170  11 226 170  11
+-236 178  12 242 186  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-241 196  14 184 144  12  10  10  10   2   2   6
+-  6   6   6 116 116 116 242 242 242 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 231 231 231 198 198 198 214 170  54
+-236 178  12 236 178  12 210 150  10 137  92   6
+- 18  14   6   2   2   6   2   2   6   2   2   6
+-  6   6   6  70  47   6 200 144  11 236 178  12
+-239 182  13 239 182  13 124 112  88  58  58  58
+- 22  22  22   6   6   6   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 30  30  30  70  70  70 180 133  36 226 170  11
+-239 182  13 242 186  14 242 186  14 246 186  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 232 195  16  98  70   6   2   2   6
+-  2   2   6   2   2   6  66  66  66 221 221 221
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 206 206 206 198 198 198 214 166  58
+-230 174  11 230 174  11 216 158  10 192 133   9
+-163 110   8 116  81   8 102  78  10 116  81   8
+-167 114   7 197 138  11 226 170  11 239 182  13
+-242 186  14 242 186  14 162 146  94  78  78  78
+- 34  34  34  14  14  14   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 30  30  30  78  78  78 190 142  34 226 170  11
+-239 182  13 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 241 196  14 203 166  17  22  18   6
+-  2   2   6   2   2   6   2   2   6  38  38  38
+-218 218 218 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-250 250 250 206 206 206 198 198 198 202 162  69
+-226 170  11 236 178  12 224 166  10 210 150  10
+-200 144  11 197 138  11 192 133   9 197 138  11
+-210 150  10 226 170  11 242 186  14 246 190  14
+-246 190  14 246 186  14 225 175  15 124 112  88
+- 62  62  62  30  30  30  14  14  14   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 30  30  30  78  78  78 174 135  50 224 166  10
+-239 182  13 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 241 196  14 139 102  15
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 78  78  78 250 250 250 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-250 250 250 214 214 214 198 198 198 190 150  46
+-219 162  10 236 178  12 234 174  13 224 166  10
+-216 158  10 213 154  11 213 154  11 216 158  10
+-226 170  11 239 182  13 246 190  14 246 190  14
+-246 190  14 246 190  14 242 186  14 206 162  42
+-101 101 101  58  58  58  30  30  30  14  14  14
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 30  30  30  74  74  74 174 135  50 216 158  10
+-236 178  12 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 241 196  14 226 184  13
+- 61  42   6   2   2   6   2   2   6   2   2   6
+- 22  22  22 238 238 238 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 226 226 226 187 187 187 180 133  36
+-216 158  10 236 178  12 239 182  13 236 178  12
+-230 174  11 226 170  11 226 170  11 230 174  11
+-236 178  12 242 186  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 186  14 239 182  13
+-206 162  42 106 106 106  66  66  66  34  34  34
+- 14  14  14   6   6   6   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 26  26  26  70  70  70 163 133  67 213 154  11
+-236 178  12 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 241 196  14
+-190 146  13  18  14   6   2   2   6   2   2   6
+- 46  46  46 246 246 246 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 221 221 221  86  86  86 156 107  11
+-216 158  10 236 178  12 242 186  14 246 186  14
+-242 186  14 239 182  13 239 182  13 242 186  14
+-242 186  14 246 186  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-242 186  14 225 175  15 142 122  72  66  66  66
+- 30  30  30  10  10  10   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 26  26  26  70  70  70 163 133  67 210 150  10
+-236 178  12 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-232 195  16 121  92   8  34  34  34 106 106 106
+-221 221 221 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-242 242 242  82  82  82  18  14   6 163 110   8
+-216 158  10 236 178  12 242 186  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 242 186  14 163 133  67
+- 46  46  46  18  18  18   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 30  30  30  78  78  78 163 133  67 210 150  10
+-236 178  12 246 186  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-241 196  14 215 174  15 190 178 144 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 218 218 218
+- 58  58  58   2   2   6  22  18   6 167 114   7
+-216 158  10 236 178  12 246 186  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 186  14 242 186  14 190 150  46
+- 54  54  54  22  22  22   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 38  38  38  86  86  86 180 133  36 213 154  11
+-236 178  12 246 186  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 232 195  16 190 146  13 214 214 214
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 250 250 250 170 170 170  26  26  26
+-  2   2   6   2   2   6  37  26   9 163 110   8
+-219 162  10 239 182  13 246 186  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 186  14 236 178  12 224 166  10 142 122  72
+- 46  46  46  18  18  18   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  18  18  18
+- 50  50  50 109 106  95 192 133   9 224 166  10
+-242 186  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-242 186  14 226 184  13 210 162  10 142 110  46
+-226 226 226 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-198 198 198  66  66  66   2   2   6   2   2   6
+-  2   2   6   2   2   6  50  34   6 156 107  11
+-219 162  10 239 182  13 246 186  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 242 186  14
+-234 174  13 213 154  11 154 122  46  66  66  66
+- 30  30  30  10  10  10   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  22  22  22
+- 58  58  58 154 121  60 206 145  10 234 174  13
+-242 186  14 246 186  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 186  14 236 178  12 210 162  10 163 110   8
+- 61  42   6 138 138 138 218 218 218 250 250 250
+-253 253 253 253 253 253 253 253 253 250 250 250
+-242 242 242 210 210 210 144 144 144  66  66  66
+-  6   6   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6  61  42   6 163 110   8
+-216 158  10 236 178  12 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 239 182  13 230 174  11 216 158  10
+-190 142  34 124 112  88  70  70  70  38  38  38
+- 18  18  18   6   6   6   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  22  22  22
+- 62  62  62 168 124  44 206 145  10 224 166  10
+-236 178  12 239 182  13 242 186  14 242 186  14
+-246 186  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 236 178  12 216 158  10 175 118   6
+- 80  54   7   2   2   6   6   6   6  30  30  30
+- 54  54  54  62  62  62  50  50  50  38  38  38
+- 14  14  14   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   6   6   6  80  54   7 167 114   7
+-213 154  11 236 178  12 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 242 186  14 239 182  13 239 182  13
+-230 174  11 210 150  10 174 135  50 124 112  88
+- 82  82  82  54  54  54  34  34  34  18  18  18
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  18  18  18
+- 50  50  50 158 118  36 192 133   9 200 144  11
+-216 158  10 219 162  10 224 166  10 226 170  11
+-230 174  11 236 178  12 239 182  13 239 182  13
+-242 186  14 246 186  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 186  14 230 174  11 210 150  10 163 110   8
+-104  69   6  10  10  10   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   6   6   6  91  60   6 167 114   7
+-206 145  10 230 174  11 242 186  14 246 190  14
+-246 190  14 246 190  14 246 186  14 242 186  14
+-239 182  13 230 174  11 224 166  10 213 154  11
+-180 133  36 124 112  88  86  86  86  58  58  58
+- 38  38  38  22  22  22  10  10  10   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 34  34  34  70  70  70 138 110  50 158 118  36
+-167 114   7 180 123   7 192 133   9 197 138  11
+-200 144  11 206 145  10 213 154  11 219 162  10
+-224 166  10 230 174  11 239 182  13 242 186  14
+-246 186  14 246 186  14 246 186  14 246 186  14
+-239 182  13 216 158  10 185 133  11 152  99   6
+-104  69   6  18  14   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   6   6   6  80  54   7 152  99   6
+-192 133   9 219 162  10 236 178  12 239 182  13
+-246 186  14 242 186  14 239 182  13 236 178  12
+-224 166  10 206 145  10 192 133   9 154 121  60
+- 94  94  94  62  62  62  42  42  42  22  22  22
+- 14  14  14   6   6   6   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 18  18  18  34  34  34  58  58  58  78  78  78
+-101  98  89 124 112  88 142 110  46 156 107  11
+-163 110   8 167 114   7 175 118   6 180 123   7
+-185 133  11 197 138  11 210 150  10 219 162  10
+-226 170  11 236 178  12 236 178  12 234 174  13
+-219 162  10 197 138  11 163 110   8 130  83   6
+- 91  60   6  10  10  10   2   2   6   2   2   6
+- 18  18  18  38  38  38  38  38  38  38  38  38
+- 38  38  38  38  38  38  38  38  38  38  38  38
+- 38  38  38  38  38  38  26  26  26   2   2   6
+-  2   2   6   6   6   6  70  47   6 137  92   6
+-175 118   6 200 144  11 219 162  10 230 174  11
+-234 174  13 230 174  11 219 162  10 210 150  10
+-192 133   9 163 110   8 124 112  88  82  82  82
+- 50  50  50  30  30  30  14  14  14   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  6   6   6  14  14  14  22  22  22  34  34  34
+- 42  42  42  58  58  58  74  74  74  86  86  86
+-101  98  89 122 102  70 130  98  46 121  87  25
+-137  92   6 152  99   6 163 110   8 180 123   7
+-185 133  11 197 138  11 206 145  10 200 144  11
+-180 123   7 156 107  11 130  83   6 104  69   6
+- 50  34   6  54  54  54 110 110 110 101  98  89
+- 86  86  86  82  82  82  78  78  78  78  78  78
+- 78  78  78  78  78  78  78  78  78  78  78  78
+- 78  78  78  82  82  82  86  86  86  94  94  94
+-106 106 106 101 101 101  86  66  34 124  80   6
+-156 107  11 180 123   7 192 133   9 200 144  11
+-206 145  10 200 144  11 192 133   9 175 118   6
+-139 102  15 109 106  95  70  70  70  42  42  42
+- 22  22  22  10  10  10   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  10  10  10
+- 14  14  14  22  22  22  30  30  30  38  38  38
+- 50  50  50  62  62  62  74  74  74  90  90  90
+-101  98  89 112 100  78 121  87  25 124  80   6
+-137  92   6 152  99   6 152  99   6 152  99   6
+-138  86   6 124  80   6  98  70   6  86  66  30
+-101  98  89  82  82  82  58  58  58  46  46  46
+- 38  38  38  34  34  34  34  34  34  34  34  34
+- 34  34  34  34  34  34  34  34  34  34  34  34
+- 34  34  34  34  34  34  38  38  38  42  42  42
+- 54  54  54  82  82  82  94  86  76  91  60   6
+-134  86   6 156 107  11 167 114   7 175 118   6
+-175 118   6 167 114   7 152  99   6 121  87  25
+-101  98  89  62  62  62  34  34  34  18  18  18
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   6   6   6   6   6   6  10  10  10
+- 18  18  18  22  22  22  30  30  30  42  42  42
+- 50  50  50  66  66  66  86  86  86 101  98  89
+-106  86  58  98  70   6 104  69   6 104  69   6
+-104  69   6  91  60   6  82  62  34  90  90  90
+- 62  62  62  38  38  38  22  22  22  14  14  14
+- 10  10  10  10  10  10  10  10  10  10  10  10
+- 10  10  10  10  10  10   6   6   6  10  10  10
+- 10  10  10  10  10  10  10  10  10  14  14  14
+- 22  22  22  42  42  42  70  70  70  89  81  66
+- 80  54   7 104  69   6 124  80   6 137  92   6
+-134  86   6 116  81   8 100  82  52  86  86  86
+- 58  58  58  30  30  30  14  14  14   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   6   6   6  10  10  10  14  14  14
+- 18  18  18  26  26  26  38  38  38  54  54  54
+- 70  70  70  86  86  86  94  86  76  89  81  66
+- 89  81  66  86  86  86  74  74  74  50  50  50
+- 30  30  30  14  14  14   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  6   6   6  18  18  18  34  34  34  58  58  58
+- 82  82  82  89  81  66  89  81  66  89  81  66
+- 94  86  66  94  86  76  74  74  74  50  50  50
+- 26  26  26  14  14  14   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  6   6   6   6   6   6  14  14  14  18  18  18
+- 30  30  30  38  38  38  46  46  46  54  54  54
+- 50  50  50  42  42  42  30  30  30  18  18  18
+- 10  10  10   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   6   6   6  14  14  14  26  26  26
+- 38  38  38  50  50  50  58  58  58  58  58  58
+- 54  54  54  42  42  42  30  30  30  18  18  18
+- 10  10  10   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+-  6   6   6  10  10  10  14  14  14  18  18  18
+- 18  18  18  14  14  14  10  10  10   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 14  14  14  18  18  18  22  22  22  22  22  22
+- 18  18  18  14  14  14  10  10  10   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 1 0  0 0 0  0 0 0  1 1 0
++0 1 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  1 1 0  0 0 0  0 0 0
++0 1 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 1 0
++10 15 3  2 3 1  12 18 4  42 61 14  19 27 6  11 16 4
++38 55 13  10 15 3  3 4 1  10 15 3  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  2 3 1
++12 18 4  1 1 0  23 34 8  31 45 11  10 15 3  32 47 11
++34 49 12  3 4 1  3 4 1  3 4 1  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  10 15 3  29 42 10  26 37 9  12 18 4
++55 80 19  81 118 28  55 80 19  92 132 31  106 153 36  69 100 23
++100 144 34  80 116 27  42 61 14  81 118 28  23 34 8  27 40 9
++15 21 5  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  1 1 0  29 42 10  15 21 5  50 72 17
++74 107 25  45 64 15  102 148 35  80 116 27  84 121 28  111 160 38
++69 100 23  65 94 22  81 118 28  29 42 10  17 25 6  29 42 10
++23 34 8  2 3 1  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  3 4 1
++15 21 5  15 21 5  34 49 12  101 146 34  111 161 38  97 141 33
++97 141 33  119 172 41  117 170 40  116 167 40  118 170 40  118 171 40
++117 169 40  118 170 40  111 160 38  118 170 40  96 138 32  89 128 30
++81 118 28  11 16 4  10 15 3  1 1 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++3 4 1  3 4 1  34 49 12  101 146 34  79 115 27  111 160 38
++114 165 39  113 163 39  118 170 40  117 169 40  118 171 40  117 169 40
++116 167 40  119 172 41  113 163 39  92 132 31  105 151 36  113 163 39
++75 109 26  19 27 6  16 23 5  11 16 4  0 1 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  10 15 3
++80 116 27  106 153 36  105 151 36  114 165 39  118 170 40  118 171 40
++118 171 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 170 40  117 169 40  118 170 40  118 170 40
++117 170 40  75 109 26  75 109 26  34 49 12  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  3 4 1
++64 92 22  65 94 22  100 144 34  118 171 40  118 170 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  118 171 41  118 170 40  117 169 40
++109 158 37  105 151 36  104 150 35  47 69 16  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++42 61 14  115 167 39  118 170 40  117 169 40  117 169 40  117 169 40
++117 170 40  117 170 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  118 170 40  96 138 32  17 25 6  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  47 69 16
++114 165 39  117 168 40  117 170 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  118 170 40  117 169 40  117 169 40  117 169 40
++117 170 40  119 172 41  96 138 32  12 18 4  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  10 15 3
++32 47 11  105 151 36  118 170 40  117 169 40  117 169 40  116 168 40
++109 157 37  111 160 38  117 169 40  118 171 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  118 171 40  69 100 23  2 3 1
++0 0 0  0 0 0  0 0 0  0 0 0  19 27 6  101 146 34
++118 171 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 170 40
++118 171 40  115 166 39  107 154 36  111 161 38  117 169 40  117 169 40
++117 169 40  118 171 40  75 109 26  19 27 6  2 3 1  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  16 23 5
++89 128 30  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++111 160 38  92 132 31  79 115 27  96 138 32  115 166 39  119 171 41
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  118 170 40  109 157 37  26 37 9
++0 0 0  0 0 0  0 0 0  0 0 0  64 92 22  118 171 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  118 170 40  118 171 40  109 157 37
++89 128 30  81 118 28  100 144 34  115 166 39  117 169 40  117 169 40
++117 169 40  117 170 40  113 163 39  60 86 20  1 1 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++27 40 9  96 138 32  118 170 40  117 169 40  117 169 40  117 169 40
++117 170 40  117 169 40  101 146 34  67 96 23  55 80 19  84 121 28
++113 163 39  119 171 41  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  119 171 41  65 94 22
++0 0 0  0 0 0  0 0 0  15 21 5  101 146 34  118 171 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  118 170 40  118 171 40  104 150 35  69 100 23  53 76 18
++81 118 28  111 160 38  118 170 40  117 169 40  117 169 40  117 169 40
++117 169 40  114 165 39  69 100 23  10 15 3  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 1 0
++31 45 11  77 111 26  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  118 170 40  116 168 40  92 132 31  47 69 16
++38 55 13  81 118 28  113 163 39  119 171 41  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  118 171 41  92 132 31
++10 15 3  0 0 0  0 0 0  36 52 12  115 166 39  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  118 170 40
++118 171 40  102 148 35  64 92 22  34 49 12  65 94 22  106 153 36
++118 171 40  117 170 40  117 169 40  117 169 40  117 169 40  117 169 40
++118 170 40  107 154 36  55 80 19  15 21 5  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++29 42 10  101 146 34  118 171 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  118 171 40  113 163 39
++75 109 26  27 40 9  36 52 12  89 128 30  116 167 40  118 171 40
++117 169 40  117 169 40  117 169 40  117 169 40  118 170 40  104 150 35
++16 23 5  0 0 0  0 0 0  53 76 18  118 171 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  119 171 41  109 157 37
++67 96 23  23 34 8  42 61 14  96 138 32  118 170 40  118 170 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  74 107 25  10 15 3  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  31 45 11  101 146 34  118 170 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++119 171 41  102 148 35  47 69 16  14 20 5  50 72 17  102 148 35
++118 171 40  117 169 40  117 169 40  117 169 40  118 170 40  102 148 35
++15 21 5  0 0 0  0 0 0  50 72 17  118 170 40  117 169 40
++117 169 40  117 169 40  118 170 40  116 167 40  84 121 28  27 40 9
++19 27 6  74 107 25  114 165 39  118 171 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  75 109 26  10 15 4  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  38 55 13  102 148 35  118 171 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  118 170 40  115 167 39  77 111 26  17 25 6  19 27 6
++77 111 26  115 166 39  118 170 40  117 169 40  119 172 41  81 118 28
++3 4 1  0 0 0  0 0 0  27 40 9  111 160 38  118 170 40
++117 169 40  118 171 40  105 151 36  50 72 17  10 15 3  38 55 13
++100 144 34  118 171 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  79 115 27  15 21 5  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  10 15 3  64 92 22  111 160 38  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  118 171 40  96 138 32  32 47 11
++3 4 1  50 72 17  107 154 36  120 173 41  105 151 36  31 45 11
++0 0 0  0 0 0  0 0 0  3 4 1  65 94 22  117 169 40
++118 170 40  89 128 30  26 37 9  3 4 1  60 86 20  111 161 38
++118 171 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++97 141 33  36 52 12  1 1 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  14 20 5  75 109 26  117 168 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  118 171 40  107 154 36
++45 64 15  2 3 1  31 45 11  75 109 26  32 47 11  0 1 0
++0 0 0  0 0 0  0 0 0  0 0 0  10 15 3  55 80 19
++65 94 22  11 16 4  11 16 4  75 109 26  116 168 40  118 170 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  118 170 40  107 154 36
++47 69 16  3 4 1  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  12 18 4  69 100 23  111 161 38  118 171 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  118 170 40
++111 160 38  50 72 17  2 3 1  2 3 1  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 1 0
++1 1 0  12 18 4  81 118 28  118 170 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 170 40  118 171 40  101 146 34
++42 61 14  2 3 1  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  3 4 1  36 52 12  89 128 30
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++118 171 41  101 146 34  14 20 5  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  47 69 16  118 170 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 170 40  111 160 38  69 100 23  19 27 6
++0 1 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  11 16 4  69 100 23
++115 167 39  119 172 41  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++119 172 41  75 109 26  3 4 1  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  23 34 8  106 153 36  118 170 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  118 170 40  119 172 41  105 151 36  42 61 14  2 3 1
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  1 1 0  15 21 5
++45 64 15  80 116 27  114 165 39  118 170 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  119 172 41
++97 141 33  20 30 7  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  1 1 0  53 76 18  114 165 39  118 171 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++118 171 40  104 150 35  64 92 22  31 45 11  10 15 3  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  36 52 12  97 141 33  109 158 37  113 163 39  116 168 40
++117 169 40  117 170 40  118 170 40  119 172 41  115 167 39  84 121 28
++23 34 8  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  3 4 1  50 72 17  102 148 35  118 171 40
++119 171 41  118 170 40  117 169 40  117 169 40  115 166 39  111 161 38
++109 157 37  79 115 27  12 18 4  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  3 4 1  15 21 5  23 34 8  45 64 15  106 153 36
++116 167 40  111 160 38  101 146 34  79 115 27  42 61 14  10 15 3
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  1 1 0  20 30 7  60 86 20
++89 128 30  106 153 36  113 163 39  117 169 40  84 121 28  29 42 10
++19 27 6  10 15 3  2 3 1  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  16 23 5  38 55 13
++36 52 12  26 37 9  12 18 4  2 3 1  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  1 0 0  19 2 7  52 5 18
++78 7 27  88 8 31  81 7 29  56 5 19  25 2 9  3 0 1
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++3 4 1  19 27 6  31 45 11  38 55 13  32 47 11  3 4 1
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  3 0 1
++9 0 3  12 1 4  9 0 3  4 0 1  0 0 0  0 0 0
++0 0 0  0 0 0  28 3 10  99 9 35  156 14 55  182 16 64
++189 17 66  190 17 67  189 17 66  184 17 65  166 15 58  118 13 41
++45 4 16  3 0 1  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  11 1 4  52 5 18  101 9 35  134 12 47
++151 14 53  154 14 54  151 14 53  113 10 40  11 1 4  0 0 0
++3 0 1  67 6 24  159 14 56  190 17 67  190 17 67  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  191 17 67
++174 16 61  101 9 35  14 1 5  0 0 0  35 3 12  108 10 38
++122 11 43  122 11 43  112 10 39  87 8 30  50 5 17  13 1 5
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++3 0 1  56 5 19  141 13 49  182 16 64  191 17 67  191 17 67
++190 17 67  190 17 67  191 17 67  113 10 40  3 0 1  1 0 0
++79 7 28  180 16 63  190 17 67  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++189 17 66  188 17 66  122 11 43  11 1 4  41 4 14  176 16 62
++191 17 67  191 17 67  191 17 67  190 17 67  181 16 63  146 13 51
++75 7 26  10 1 4  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  7 1 2
++90 8 32  178 16 62  191 17 67  188 17 66  188 17 66  188 17 66
++188 17 66  190 17 67  141 13 49  22 2 8  0 0 0  41 4 14
++173 16 61  190 17 67  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  88 8 31  1 0 0  89 8 31
++185 17 65  189 17 66  188 17 66  188 17 66  189 17 66  191 17 67
++186 17 65  124 11 43  25 2 9  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  2 0 1  89 8 31
++184 17 65  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++190 17 67  151 14 53  34 3 12  0 0 0  0 0 0  79 7 28
++190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  191 17 67  146 13 51  9 1 3  7 1 2
++108 10 38  187 17 66  189 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  190 17 67  141 13 49  22 2 8  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  52 5 18  176 16 62
++189 17 66  188 17 66  188 17 66  188 17 66  188 17 66  190 17 67
++151 14 53  38 3 13  0 0 0  0 0 0  0 0 0  50 5 17
++180 16 63  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  191 17 67  141 13 49  7 1 3  0 0 0
++11 1 4  112 10 39  187 17 66  189 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  190 17 67  113 10 40  5 0 2  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  7 1 3  132 12 46  191 17 67
++188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  146 13 51
++35 3 12  0 0 0  0 0 0  0 0 0  0 0 0  5 0 2
++101 9 35  185 17 65  190 17 67  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  190 17 67  180 16 63  67 6 24  0 0 0  0 0 0
++0 0 0  11 1 4  108 10 38  186 17 65  189 17 66  188 17 66
++188 17 66  188 17 66  189 17 66  180 16 63  56 5 19  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  44 4 15  177 16 62  189 17 66
++188 17 66  188 17 66  189 17 66  189 17 66  134 12 47  28 3 10
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++8 1 3  79 7 28  159 14 56  188 17 66  191 17 67  190 17 67
++189 17 66  189 17 66  189 17 66  189 17 66  190 17 67  191 17 67
++188 17 66  158 14 55  72 7 25  4 0 1  0 0 0  0 0 0
++0 0 0  0 0 0  8 1 3  95 9 33  182 16 64  189 17 67
++188 17 66  188 17 66  188 17 66  191 17 67  122 11 43  3 0 1
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  88 8 31  190 17 67  188 17 66
++188 17 66  189 17 66  185 17 65  113 10 40  18 2 6  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  1 0 0  24 2 8  77 7 27  124 11 43  154 14 54
++168 15 59  173 16 61  173 16 61  168 15 59  154 14 54  124 11 43
++77 7 27  22 2 8  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  5 0 2  77 7 27  173 16 61
++190 17 67  188 17 66  188 17 66  190 17 67  164 15 57  23 2 8
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  1 0 0  118 13 41  191 17 67  188 17 66
++190 17 67  174 16 61  87 8 30  8 1 3  0 0 0  0 0 0
++0 0 0  0 0 0  10 1 4  29 3 10  40 4 14  36 3 13
++18 2 6  2 0 1  0 0 0  0 0 0  3 0 1  14 1 5
++26 2 9  33 3 11  32 3 11  25 2 9  13 1 5  3 0 1
++0 0 0  14 1 5  56 5 19  95 9 33  109 10 38  101 9 35
++77 7 27  35 3 12  5 0 2  0 0 0  1 0 0  56 5 19
++156 14 55  190 17 67  188 17 66  188 17 66  182 16 64  50 5 17
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  5 0 2  134 12 47  191 17 67  189 17 66
++151 14 53  52 5 18  2 0 1  0 0 0  0 0 0  1 0 0
++28 3 10  90 8 32  146 13 51  170 15 60  178 16 62  174 16 61
++158 14 55  112 10 39  40 4 14  1 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  3 0 1
++56 5 19  146 13 51  183 17 64  191 17 67  191 17 67  191 17 67
++188 17 66  173 16 61  122 11 43  41 4 14  1 0 0  0 0 0
++30 3 10  124 11 43  185 17 65  190 17 67  187 17 66  67 6 24
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  6 1 2  134 12 47  168 15 59  99 9 35
++21 2 7  0 0 0  0 0 0  0 0 0  6 1 2  77 7 27
++162 15 57  190 17 67  191 17 67  189 17 66  189 17 66  189 17 66
++190 17 67  191 17 67  169 15 59  75 7 26  3 0 1  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  2 0 1  79 7 28
++178 16 62  191 17 67  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  189 17 66  191 17 67  170 15 60  79 7 28  5 0 2
++0 0 0  10 1 3  78 7 27  159 14 56  188 17 66  75 7 26
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  1 0 0  35 3 12  29 3 10  2 0 1
++0 0 0  0 0 0  0 0 0  9 1 3  101 9 35  183 17 64
++190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  190 17 67  178 16 63  67 6 23  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  52 5 18  174 16 61
++190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  190 17 67  182 16 64  89 8 31
++4 0 1  0 0 0  0 0 0  25 2 9  73 7 26  31 3 11
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  4 0 1  98 9 34  187 17 66  189 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  190 17 67  158 14 55  25 2 9
++0 0 0  0 0 0  0 0 0  8 1 3  134 12 47  191 17 67
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  189 17 66  180 16 63
++68 6 24  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  6 1 2  19 2 7  3 0 1  0 0 0  0 0 0
++0 0 0  0 0 0  65 6 23  180 16 63  189 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  189 17 66  83 8 29
++0 0 0  0 0 0  0 0 0  41 4 14  177 16 62  189 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  190 17 67
++159 14 56  28 3 10  0 0 0  0 0 0  0 0 0  23 2 8
++41 4 14  5 0 2  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++23 2 8  113 10 40  159 14 56  65 6 23  0 0 0  0 0 0
++0 0 0  16 1 6  146 13 51  191 17 67  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  191 17 67  132 12 46
++5 0 2  0 0 0  0 0 0  77 7 27  189 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++190 17 67  98 9 34  0 0 0  0 0 0  12 1 4  134 12 47
++178 16 63  108 10 38  16 1 6  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  30 3 10
++141 13 49  190 17 67  191 17 67  134 12 47  6 1 2  0 0 0
++0 0 0  68 6 24  186 17 65  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  156 14 55
++14 1 5  0 0 0  0 0 0  98 9 34  191 17 67  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++190 17 67  156 14 55  19 2 7  0 0 0  47 4 16  181 16 63
++190 17 67  189 17 66  126 14 44  17 2 6  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  16 1 6  134 12 47
++191 17 67  188 17 66  190 17 67  162 15 57  19 2 7  0 0 0
++3 0 1  123 11 43  191 17 67  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  163 15 57
++20 2 7  0 0 0  0 0 0  101 9 35  191 17 67  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  182 16 64  52 5 18  0 0 0  73 7 26  188 17 66
++188 17 66  188 17 66  189 17 66  109 10 38  5 0 2  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  95 9 33  189 17 66
++188 17 66  188 17 66  189 17 66  171 15 60  29 3 10  0 0 0
++16 1 6  156 14 55  190 17 67  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  158 14 55
++17 2 6  0 0 0  0 0 0  85 8 30  190 17 67  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  189 17 66  81 7 29  0 0 0  85 8 30  190 17 67
++188 17 66  188 17 66  189 17 66  180 16 63  56 5 19  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  25 2 9  162 15 57  190 17 67
++188 17 66  188 17 66  189 17 66  173 16 61  31 3 11  0 0 0
++30 3 10  171 15 60  189 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  191 17 67  141 13 49
++7 1 2  0 0 0  0 0 0  56 5 19  183 17 64  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  191 17 67  98 9 34  0 0 0  88 8 31  190 17 67
++188 17 66  188 17 66  188 17 66  191 17 67  124 11 43  5 0 2
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  68 6 24  187 17 66  188 17 66
++188 17 66  188 17 66  189 17 66  170 15 60  28 3 10  0 0 0
++34 3 12  174 16 61  189 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  191 17 67  101 9 35
++0 0 0  0 0 0  0 0 0  21 2 7  159 14 56  190 17 67
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  191 17 67  98 9 34  0 0 0  81 7 29  189 17 66
++188 17 66  188 17 66  188 17 66  189 17 66  168 15 59  28 3 10
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  109 10 38  191 17 67  188 17 66
++188 17 66  188 17 66  190 17 67  163 15 57  21 2 7  0 0 0
++26 2 9  168 15 59  189 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  189 17 66  180 16 63  47 4 16
++0 0 0  0 0 0  0 0 0  0 0 0  108 10 38  190 17 67
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  189 17 66  78 7 27  0 0 0  68 6 24  187 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  183 17 64  56 5 19
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  3 0 1  131 12 46  191 17 67  188 17 66
++188 17 66  188 17 66  190 17 67  151 14 53  12 1 4  0 0 0
++11 1 4  146 13 51  190 17 67  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  191 17 67  126 14 44  7 1 2
++0 0 0  0 0 0  0 0 0  0 0 0  32 3 11  164 15 58
++190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++189 17 66  178 16 62  44 4 15  0 0 0  50 5 17  182 16 64
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  72 7 25
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  5 0 2  134 12 47  191 17 67  188 17 66
++188 17 66  188 17 66  191 17 67  131 12 46  3 0 1  0 0 0
++0 0 0  101 9 35  190 17 67  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  190 17 67  170 15 60  44 4 15  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  77 7 27
++183 17 64  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++191 17 67  134 12 47  9 1 3  0 0 0  31 3 11  171 15 60
++189 17 66  188 17 66  188 17 66  188 17 66  188 17 66  72 7 25
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  2 0 1  124 11 43  191 17 67  188 17 66
++188 17 66  188 17 66  191 17 67  101 9 35  0 0 0  0 0 0
++0 0 0  35 3 12  168 15 59  190 17 67  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  189 17 66  182 16 64  77 7 27  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  6 1 2
++99 9 35  185 17 65  189 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  189 17 66
++177 16 62  56 5 19  0 0 0  0 0 0  13 1 5  151 14 53
++190 17 67  188 17 66  188 17 66  188 17 66  185 17 65  56 5 19
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  99 9 35  191 17 67  188 17 66
++188 17 66  188 17 66  186 17 65  65 6 23  0 0 0  0 0 0
++0 0 0  0 0 0  79 7 28  182 16 64  190 17 67  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++191 17 67  177 16 62  83 8 29  4 0 1  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++8 1 3  89 8 31  175 16 62  191 17 67  189 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  181 16 63
++85 8 30  3 0 1  0 0 0  0 0 0  1 0 0  118 13 41
++191 17 67  188 17 66  188 17 66  189 17 66  173 16 61  34 3 12
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  56 5 19  183 17 64  188 17 66
++188 17 66  189 17 66  169 15 59  30 3 10  0 0 0  0 0 0
++0 0 0  0 0 0  5 0 2  83 8 29  173 16 61  191 17 67
++190 17 67  189 17 66  189 17 66  190 17 67  191 17 67  187 17 66
++151 14 53  56 5 19  3 0 1  0 0 0  16 1 6  50 5 17
++79 7 28  95 9 33  95 9 33  75 7 26  41 4 14  10 1 4
++0 0 0  2 0 1  50 5 17  132 12 46  178 16 62  190 17 67
++191 17 67  191 17 67  191 17 67  186 17 65  154 14 54  68 6 24
++4 0 1  0 0 0  0 0 0  0 0 0  0 0 0  72 7 25
++187 17 66  188 17 66  188 17 66  191 17 67  141 13 49  9 1 3
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  14 1 5  151 14 53  190 17 67
++188 17 66  191 17 67  131 12 46  5 0 2  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  2 0 1  44 4 15  113 10 40
++156 14 55  173 16 61  174 16 61  164 15 58  134 12 47  77 7 27
++18 2 6  0 0 0  16 1 6  85 8 30  151 14 53  182 16 64
++189 17 66  191 17 67  190 17 67  188 17 66  177 16 62  141 13 49
++68 6 24  8 1 3  0 0 0  8 1 3  44 4 15  88 8 31
++113 10 40  122 11 43  108 10 38  67 6 24  20 2 7  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  28 3 10
++166 15 58  190 17 67  188 17 66  187 17 66  79 7 28  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  73 7 26  185 17 65
++189 17 66  184 17 65  65 6 23  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  2 0 1
++17 2 6  32 3 11  34 3 12  22 2 8  6 1 2  0 0 0
++0 0 0  38 3 13  141 13 49  188 17 66  190 17 67  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  189 17 66  191 17 67
++184 17 65  122 11 43  21 2 7  0 0 0  0 0 0  0 0 0
++0 0 0  1 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 0 0
++108 10 38  191 17 67  191 17 67  141 13 49  16 1 6  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  8 1 3  112 10 39
++186 17 65  124 11 43  10 1 4  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++36 3 13  156 14 55  191 17 67  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++189 17 66  190 17 67  134 12 47  18 2 6  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  7 1 2  41 4 14  75 7 26  66 5 23  19 2 7
++26 2 9  144 13 50  154 14 54  40 4 14  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  13 1 5
++56 5 19  19 2 7  0 0 0  7 1 2  29 3 10  35 3 12
++19 2 7  2 0 1  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  13 1 5
++134 12 47  191 17 67  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  189 17 67  108 10 38  3 0 1  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 0 0
++40 4 14  124 11 43  177 16 62  188 17 66  187 17 66  144 13 50
++24 2 8  17 2 6  22 2 8  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  19 2 7  122 11 43  171 15 60  175 16 62
++159 14 56  112 10 39  40 4 14  2 0 1  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  72 7 25
++186 17 65  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  189 17 66  174 16 61  41 4 14  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  3 0 1  72 7 25
++168 15 59  191 17 67  189 17 66  188 17 66  188 17 66  190 17 67
++95 9 33  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  95 9 33  191 17 67  189 17 66  189 17 66
++190 17 67  191 17 67  171 15 60  90 8 32  12 1 4  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  5 0 2  132 12 46
++191 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  190 17 67  98 9 34  0 0 0
++0 0 0  0 0 0  0 0 0  5 0 2  88 8 31  180 16 63
++190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  191 17 67
++146 13 51  11 1 4  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  9 1 3  144 13 50  191 17 67  188 17 66  188 17 66
++188 17 66  188 17 66  189 17 66  187 17 66  123 11 43  20 2 7
++0 0 0  0 0 0  0 0 0  0 0 0  21 2 7  163 15 57
++190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  191 17 67  134 12 47  5 0 2
++0 0 0  0 0 0  3 0 1  88 8 31  182 16 64  189 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  189 17 66
++171 15 60  31 3 11  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  20 2 7  162 15 57  190 17 67  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  132 12 46
++20 2 7  0 0 0  0 0 0  0 0 0  32 3 11  173 16 61
++189 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  190 17 67  151 14 53  12 1 4
++0 0 0  0 0 0  72 7 25  180 16 63  189 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++181 16 63  47 4 16  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  21 2 7  163 15 57  190 17 67  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  190 17 67
++122 11 43  9 1 3  0 0 0  0 0 0  30 3 10  171 15 60
++189 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  190 17 67  146 13 51  10 1 4
++0 0 0  38 3 13  166 15 58  190 17 67  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++183 17 64  52 5 18  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  13 1 5  154 14 54  190 17 67  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++186 17 65  79 7 28  0 0 0  0 0 0  14 1 5  156 14 54
++190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  191 17 67  124 11 43  2 0 1
++5 0 2  122 11 43  191 17 67  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++182 16 64  47 4 16  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  3 0 1  126 14 44  191 17 67  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++190 17 67  158 14 55  23 2 8  0 0 0  1 0 0  113 10 40
++191 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  78 7 27  0 0 0
++47 4 16  177 16 62  189 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  189 17 66
++173 16 61  34 3 12  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  85 8 30  189 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  79 7 28  0 0 0  0 0 0  47 4 16
++175 16 62  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  190 17 67  156 14 55  22 2 8  0 0 0
++109 10 38  191 17 67  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  190 17 67
++151 14 53  13 1 5  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  35 3 12  173 16 61  189 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  191 17 67  134 12 47  7 1 2  0 0 0  3 0 1
++99 9 35  188 17 66  189 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  189 17 66  181 16 63  68 6 24  0 0 0  18 2 6
++156 14 55  190 17 67  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  190 17 67
++101 9 35  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  3 0 1  118 13 41  191 17 67  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  189 17 66  168 15 59  28 3 10  0 0 0  0 0 0
++12 1 4  113 10 40  187 17 66  189 17 67  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++190 17 67  180 16 63  88 8 31  4 0 1  0 0 0  47 4 16
++180 16 63  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  168 15 59
++36 3 13  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  38 3 13  164 15 58  190 17 67
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  182 16 64  50 5 17  0 0 0  0 0 0
++0 0 0  11 1 4  90 8 32  169 15 59  190 17 67  190 17 67
++189 17 66  189 17 66  189 17 66  189 17 66  191 17 67  189 17 66
++158 14 55  68 6 24  4 0 1  0 0 0  0 0 0  73 7 26
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  189 17 66  185 17 65  83 8 29
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  65 6 23  174 16 61
++190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  185 17 65  56 5 19  0 0 0  0 0 0
++0 0 0  0 0 0  2 0 1  35 3 12  99 9 35  146 13 51
++170 15 60  177 16 62  177 16 62  166 15 58  141 13 49  85 8 30
++24 2 8  0 0 0  0 0 0  0 0 0  0 0 0  85 8 30
++190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  189 17 66  112 10 39  8 1 3
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  1 0 0  68 6 24
++170 15 60  191 17 67  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  182 16 64  50 5 17  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  1 0 0  11 1 4
++28 3 10  40 4 14  38 3 13  25 2 9  8 1 3  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  78 7 27
++189 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  189 17 66  187 17 66  113 10 40  14 1 5  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 0 0
++47 4 16  141 13 49  186 17 65  191 17 67  190 17 67  189 17 66
++189 17 66  191 17 67  156 14 55  20 2 7  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  44 4 15
++178 16 62  190 17 67  188 17 66  188 17 66  188 17 66  190 17 67
++191 17 67  173 16 61  90 8 32  10 1 4  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  14 1 5  68 6 24  131 12 46  162 15 57  174 16 61
++171 15 60  146 13 51  56 5 19  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  3 0 1  14 1 5  29 3 10
++41 4 14  47 4 16  50 5 17  45 4 16  34 3 12  18 2 6
++5 0 2  0 0 0  0 0 0  0 0 0  0 0 0  5 0 2
++90 8 32  169 15 59  185 17 65  187 17 66  182 16 64  163 15 57
++113 10 40  41 4 14  2 0 1  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  5 0 2  21 2 7  34 3 12
++29 3 10  11 1 4  0 0 0  0 0 0  0 0 0  0 0 0
++3 0 1  32 3 11  79 7 28  124 11 43  154 14 54  171 15 60
++180 16 63  182 16 64  182 16 64  180 16 63  174 16 61  159 14 56
++132 12 46  88 8 31  34 3 12  3 0 1  0 0 0  0 0 0
++3 0 1  29 3 10  56 5 19  65 6 23  50 5 17  23 2 8
++3 0 1  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  25 2 9
++109 10 38  169 15 59  189 17 66  191 17 67  190 17 67  189 17 66
++189 17 66  188 17 66  188 17 66  188 17 66  189 17 66  190 17 67
++191 17 67  190 17 67  171 15 60  98 9 34  10 1 3  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  14 1 5  141 13 49
++191 17 67  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  189 17 67  186 17 65  65 6 23  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  23 2 8  166 15 58
++190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  189 17 66  176 16 62  45 4 16  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  1 0 0  83 8 29
++183 17 64  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  189 17 66  185 17 65  95 9 33  3 0 1  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  5 0 2
++85 8 30  176 16 62  191 17 67  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++191 17 67  180 16 63  95 9 33  7 1 3  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++2 0 1  52 5 18  141 13 49  185 17 65  191 17 67  189 17 67
++189 17 66  188 17 66  188 17 66  189 17 66  191 17 67  187 17 66
++146 13 51  56 5 19  4 0 1  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  14 1 5  68 6 24  131 12 46  166 15 58
++180 16 63  183 17 64  180 16 63  168 15 59  134 12 47  75 7 26
++17 2 6  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  5 0 2  24 2 8
++44 4 15  52 5 18  45 4 16  26 2 9  6 1 2  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
diff --git a/target/linux/bcm27xx/patches-6.1/950-0108-Pulled-in-the-multi-frame-buffer-support-from-the-Pi.patch b/target/linux/bcm27xx/patches-6.1/950-0108-Pulled-in-the-multi-frame-buffer-support-from-the-Pi.patch
new file mode 100644
index 00000000000000..e3eece724b924e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0108-Pulled-in-the-multi-frame-buffer-support-from-the-Pi.patch
@@ -0,0 +1,778 @@
+From 4bfcd159944e7387f701cceb85b26f6d6d17fbed Mon Sep 17 00:00:00 2001
+From: James Hughes <james.hughes@raspberrypi.org>
+Date: Thu, 14 Mar 2019 13:27:54 +0000
+Subject: [PATCH] Pulled in the multi frame buffer support from the Pi3
+ repo
+
+---
+ drivers/video/fbdev/bcm2708_fb.c | 457 ++++++++++++++++++++++---------
+ 1 file changed, 324 insertions(+), 133 deletions(-)
+
+--- a/drivers/video/fbdev/bcm2708_fb.c
++++ b/drivers/video/fbdev/bcm2708_fb.c
+@@ -2,6 +2,7 @@
+  *  linux/drivers/video/bcm2708_fb.c
+  *
+  * Copyright (C) 2010 Broadcom
++ * Copyright (C) 2018 Raspberry Pi (Trading) Ltd
+  *
+  * This file is subject to the terms and conditions of the GNU General Public
+  * License.  See the file COPYING in the main directory of this archive
+@@ -13,6 +14,7 @@
+  * Copyright 1999-2001 Jeff Garzik <jgarzik@pobox.com>
+  *
+  */
++
+ #include <linux/module.h>
+ #include <linux/kernel.h>
+ #include <linux/errno.h>
+@@ -33,6 +35,7 @@
+ #include <linux/io.h>
+ #include <linux/dma-mapping.h>
+ #include <soc/bcm2835/raspberrypi-firmware.h>
++#include <linux/mutex.h>
+ 
+ //#define BCM2708_FB_DEBUG
+ #define MODULE_NAME "bcm2708_fb"
+@@ -79,64 +82,150 @@ struct bcm2708_fb_stats {
+ 	u32 dma_irqs;
+ };
+ 
++struct vc4_display_settings_t {
++	u32 display_num;
++	u32 width;
++	u32 height;
++	u32 depth;
++	u32 pitch;
++	u32 virtual_width;
++	u32 virtual_height;
++	u32 virtual_width_offset;
++	u32 virtual_height_offset;
++	unsigned long fb_bus_address;
++};
++
++struct bcm2708_fb_dev;
++
+ struct bcm2708_fb {
+ 	struct fb_info fb;
+ 	struct platform_device *dev;
+-	struct rpi_firmware *fw;
+ 	u32 cmap[16];
+ 	u32 gpu_cmap[256];
+-	int dma_chan;
+-	int dma_irq;
+-	void __iomem *dma_chan_base;
+-	void *cb_base;		/* DMA control blocks */
+-	dma_addr_t cb_handle;
+ 	struct dentry *debugfs_dir;
+-	wait_queue_head_t dma_waitq;
+-	struct bcm2708_fb_stats stats;
++	struct dentry *debugfs_subdir;
+ 	unsigned long fb_bus_address;
+-	bool disable_arm_alloc;
++	struct { u32 base, length; } gpu;
++	struct vc4_display_settings_t display_settings;
++	struct debugfs_regset32 screeninfo_regset;
++	struct bcm2708_fb_dev *fbdev;
+ 	unsigned int image_size;
+ 	dma_addr_t dma_addr;
+ 	void *cpuaddr;
+ };
+ 
++#define MAX_FRAMEBUFFERS 3
++
++struct bcm2708_fb_dev {
++	int firmware_supports_multifb;
++	/* Protects the DMA system from multiple FB access */
++	struct mutex dma_mutex;
++	int dma_chan;
++	int dma_irq;
++	void __iomem *dma_chan_base;
++	wait_queue_head_t dma_waitq;
++	bool disable_arm_alloc;
++	struct bcm2708_fb_stats dma_stats;
++	void *cb_base;	/* DMA control blocks */
++	dma_addr_t cb_handle;
++	int instance_count;
++	int num_displays;
++	struct rpi_firmware *fw;
++	struct bcm2708_fb displays[MAX_FRAMEBUFFERS];
++};
++
+ #define to_bcm2708(info)	container_of(info, struct bcm2708_fb, fb)
+ 
+ static void bcm2708_fb_debugfs_deinit(struct bcm2708_fb *fb)
+ {
+-	debugfs_remove_recursive(fb->debugfs_dir);
+-	fb->debugfs_dir = NULL;
++	debugfs_remove_recursive(fb->debugfs_subdir);
++	fb->debugfs_subdir = NULL;
++
++	fb->fbdev->instance_count--;
++
++	if (!fb->fbdev->instance_count) {
++		debugfs_remove_recursive(fb->debugfs_dir);
++		fb->debugfs_dir = NULL;
++	}
+ }
+ 
+ static int bcm2708_fb_debugfs_init(struct bcm2708_fb *fb)
+ {
++	char buf[3];
++	struct bcm2708_fb_dev *fbdev = fb->fbdev;
++
+ 	static struct debugfs_reg32 stats_registers[] = {
+-		{
+-			"dma_copies",
+-			offsetof(struct bcm2708_fb_stats, dma_copies)
+-		},
+-		{
+-			"dma_irqs",
+-			offsetof(struct bcm2708_fb_stats, dma_irqs)
+-		},
++	{"dma_copies", offsetof(struct bcm2708_fb_stats, dma_copies)},
++	{"dma_irqs",   offsetof(struct bcm2708_fb_stats, dma_irqs)},
+ 	};
+ 
+-	fb->debugfs_dir = debugfs_create_dir(DRIVER_NAME, NULL);
++	static struct debugfs_reg32 screeninfo[] = {
++	{"width",	 offsetof(struct fb_var_screeninfo, xres)},
++	{"height",	 offsetof(struct fb_var_screeninfo, yres)},
++	{"bpp",		 offsetof(struct fb_var_screeninfo, bits_per_pixel)},
++	{"xres_virtual", offsetof(struct fb_var_screeninfo, xres_virtual)},
++	{"yres_virtual", offsetof(struct fb_var_screeninfo, yres_virtual)},
++	{"xoffset",	 offsetof(struct fb_var_screeninfo, xoffset)},
++	{"yoffset",	 offsetof(struct fb_var_screeninfo, yoffset)},
++	};
++
++	fb->debugfs_dir = debugfs_lookup(DRIVER_NAME, NULL);
++
++	if (!fb->debugfs_dir)
++		fb->debugfs_dir = debugfs_create_dir(DRIVER_NAME, NULL);
++
+ 	if (!fb->debugfs_dir) {
+-		pr_warn("%s: could not create debugfs entry\n",
+-			__func__);
++		dev_warn(fb->fb.dev, "%s: could not create debugfs folder\n",
++			 __func__);
+ 		return -EFAULT;
+ 	}
+ 
+-	fb->stats.regset.regs = stats_registers;
+-	fb->stats.regset.nregs = ARRAY_SIZE(stats_registers);
+-	fb->stats.regset.base = &fb->stats;
++	snprintf(buf, sizeof(buf), "%u", fb->display_settings.display_num);
++
++	fb->debugfs_subdir = debugfs_create_dir(buf, fb->debugfs_dir);
+ 
+ 	debugfs_create_regset32("stats", 0444, fb->debugfs_dir,
+ 				&fb->stats.regset);
++
++	if (!fb->debugfs_subdir) {
++		dev_warn(fb->fb.dev, "%s: could not create debugfs entry %u\n",
++			 __func__, fb->display_settings.display_num);
++		return -EFAULT;
++	}
++
++	fbdev->dma_stats.regset.regs = stats_registers;
++	fbdev->dma_stats.regset.nregs = ARRAY_SIZE(stats_registers);
++	fbdev->dma_stats.regset.base = &fbdev->dma_stats;
++
++	debugfs_create_regset32("dma_stats", 0444, fb->debugfs_subdir,
++				&fbdev->dma_stats.regset);
++
++	fb->screeninfo_regset.regs = screeninfo;
++	fb->screeninfo_regset.nregs = ARRAY_SIZE(screeninfo);
++	fb->screeninfo_regset.base = &fb->fb.var;
++
++	debugfs_create_regset32("screeninfo", 0444, fb->debugfs_subdir,
++				&fb->screeninfo_regset);
++
++	fbdev->instance_count++;
++
+ 	return 0;
+ }
+ 
++static void set_display_num(struct bcm2708_fb *fb)
++{
++	if (fb && fb->fbdev && fb->fbdev->firmware_supports_multifb) {
++		u32 tmp = fb->display_settings.display_num;
++
++		if (rpi_firmware_property(fb->fbdev->fw,
++					  RPI_FIRMWARE_FRAMEBUFFER_SET_DISPLAY_NUM,
++					  &tmp,
++					  sizeof(tmp)))
++			dev_warn_once(fb->fb.dev,
++				      "Set display number call failed. Old GPU firmware?");
++	}
++}
++
+ static int bcm2708_fb_set_bitfields(struct fb_var_screeninfo *var)
+ {
+ 	int ret = 0;
+@@ -214,11 +303,11 @@ static int bcm2708_fb_check_var(struct f
+ 				struct fb_info *info)
+ {
+ 	/* info input, var output */
+-	print_debug("%s(%p) %dx%d (%dx%d), %d, %d\n",
++	print_debug("%s(%p) %ux%u (%ux%u), %ul, %u\n",
+ 		    __func__, info, info->var.xres, info->var.yres,
+ 		    info->var.xres_virtual, info->var.yres_virtual,
+-		    (int)info->screen_size, info->var.bits_per_pixel);
+-	print_debug("%s(%p) %dx%d (%dx%d), %d\n", __func__, var, var->xres,
++		    info->screen_size, info->var.bits_per_pixel);
++	print_debug("%s(%p) %ux%u (%ux%u), %u\n", __func__, var, var->xres,
+ 		    var->yres, var->xres_virtual, var->yres_virtual,
+ 		    var->bits_per_pixel);
+ 
+@@ -281,17 +370,24 @@ static int bcm2708_fb_set_par(struct fb_
+ 	};
+ 	int ret, image_size;
+ 
+-
+-	print_debug("%s(%p) %dx%d (%dx%d), %d, %d\n", __func__, info,
++	print_debug("%s(%p) %dx%d (%dx%d), %d, %d (display %d)\n", __func__,
++		    info,
+ 		    info->var.xres, info->var.yres, info->var.xres_virtual,
+ 		    info->var.yres_virtual, (int)info->screen_size,
+-		    info->var.bits_per_pixel);
++		    info->var.bits_per_pixel, value);
++
++	/* Need to set the display number to act on first
++	 * Cannot do it in the tag list because on older firmware the call
++	 * will fail and stop the rest of the list being executed.
++	 * We can ignore this call failing as the default at other end is 0
++	 */
++	set_display_num(fb);
+ 
+ 	/* Try allocating our own buffer. We can specify all the parameters */
+ 	image_size = ((info->var.xres * info->var.yres) *
+ 		      info->var.bits_per_pixel) >> 3;
+ 
+-	if (!fb->disable_arm_alloc &&
++	if (!fb->fbdev->disable_arm_alloc &&
+ 	    (image_size != fb->image_size || !fb->dma_addr)) {
+ 		if (fb->dma_addr) {
+ 			dma_free_coherent(info->device, fb->image_size,
+@@ -306,7 +402,7 @@ static int bcm2708_fb_set_par(struct fb_
+ 
+ 		if (!fb->cpuaddr) {
+ 			fb->dma_addr = 0;
+-			fb->disable_arm_alloc = true;
++			fb->fbdev->disable_arm_alloc = true;
+ 		} else {
+ 			fb->image_size = image_size;
+ 		}
+@@ -317,7 +413,7 @@ static int bcm2708_fb_set_par(struct fb_
+ 		fbinfo.screen_size = image_size;
+ 		fbinfo.pitch = (info->var.xres * info->var.bits_per_pixel) >> 3;
+ 
+-		ret = rpi_firmware_property_list(fb->fw, &fbinfo,
++		ret = rpi_firmware_property_list(fb->fbdev->fw, &fbinfo,
+ 						 sizeof(fbinfo));
+ 		if (ret || fbinfo.base != fb->dma_addr) {
+ 			/* Firmware either failed, or assigned a different base
+@@ -330,7 +426,7 @@ static int bcm2708_fb_set_par(struct fb_
+ 			fb->image_size = 0;
+ 			fb->cpuaddr = NULL;
+ 			fb->dma_addr = 0;
+-			fb->disable_arm_alloc = true;
++			fb->fbdev->disable_arm_alloc = true;
+ 		}
+ 	} else {
+ 		/* Our allocation failed - drop into the old scheme of
+@@ -349,7 +445,7 @@ static int bcm2708_fb_set_par(struct fb_
+ 		fbinfo.tag6.tag = RPI_FIRMWARE_FRAMEBUFFER_GET_PITCH;
+ 		fbinfo.pitch = 0;
+ 
+-		ret = rpi_firmware_property_list(fb->fw, &fbinfo,
++		ret = rpi_firmware_property_list(fb->fbdev->fw, &fbinfo,
+ 						 sizeof(fbinfo));
+ 		if (ret) {
+ 			dev_err(info->device,
+@@ -439,7 +535,10 @@ static int bcm2708_fb_setcolreg(unsigned
+ 			packet->length = regno + 1;
+ 			memcpy(packet->cmap, fb->gpu_cmap,
+ 			       sizeof(packet->cmap));
+-			ret = rpi_firmware_property(fb->fw,
++
++			set_display_num(fb);
++
++			ret = rpi_firmware_property(fb->fbdev->fw,
+ 						    RPI_FIRMWARE_FRAMEBUFFER_SET_PALETTE,
+ 						    packet,
+ 						    (2 + packet->length) * sizeof(u32));
+@@ -478,8 +577,11 @@ static int bcm2708_fb_blank(int blank_mo
+ 		return -EINVAL;
+ 	}
+ 
+-	ret = rpi_firmware_property(fb->fw, RPI_FIRMWARE_FRAMEBUFFER_BLANK,
++	set_display_num(fb);
++
++	ret = rpi_firmware_property(fb->fbdev->fw, RPI_FIRMWARE_FRAMEBUFFER_BLANK,
+ 				    &value, sizeof(value));
++
+ 	if (ret)
+ 		dev_err(info->device, "%s(%d) failed: %d\n", __func__,
+ 			blank_mode, ret);
+@@ -496,12 +598,14 @@ static int bcm2708_fb_pan_display(struct
+ 	info->var.yoffset = var->yoffset;
+ 	result = bcm2708_fb_set_par(info);
+ 	if (result != 0)
+-		pr_err("%s(%d,%d) returns=%d\n", __func__, var->xoffset,
++		pr_err("%s(%u,%u) returns=%d\n", __func__, var->xoffset,
+ 		       var->yoffset, result);
+ 	return result;
+ }
+ 
+ static int bcm2708_ioctl(struct fb_info *info, unsigned int cmd, unsigned long arg)
++static int bcm2708_ioctl(struct fb_info *info, unsigned int cmd,
++			 unsigned long arg)
+ {
+ 	struct bcm2708_fb *fb = to_bcm2708(info);
+ 	u32 dummy = 0;
+@@ -509,7 +613,9 @@ static int bcm2708_ioctl(struct fb_info
+ 
+ 	switch (cmd) {
+ 	case FBIO_WAITFORVSYNC:
+-		ret = rpi_firmware_property(fb->fw,
++		set_display_num(fb);
++
++		ret = rpi_firmware_property(fb->fbdev->fw,
+ 					    RPI_FIRMWARE_FRAMEBUFFER_SET_VSYNC,
+ 					    &dummy, sizeof(dummy));
+ 		break;
+@@ -526,23 +632,22 @@ static int bcm2708_ioctl(struct fb_info
+ static void bcm2708_fb_fillrect(struct fb_info *info,
+ 				const struct fb_fillrect *rect)
+ {
+-	/* (is called) print_debug("bcm2708_fb_fillrect\n"); */
+ 	cfb_fillrect(info, rect);
+ }
+ 
+ /* A helper function for configuring dma control block */
+ static void set_dma_cb(struct bcm2708_dma_cb *cb,
+-		       int        burst_size,
+-		       dma_addr_t dst,
+-		       int        dst_stride,
+-		       dma_addr_t src,
+-		       int        src_stride,
+-		       int        w,
+-		       int        h)
++		int        burst_size,
++		dma_addr_t dst,
++		int        dst_stride,
++		dma_addr_t src,
++		int        src_stride,
++		int        w,
++		int        h)
+ {
+ 	cb->info = BCM2708_DMA_BURST(burst_size) | BCM2708_DMA_S_WIDTH |
+-		   BCM2708_DMA_S_INC | BCM2708_DMA_D_WIDTH |
+-		   BCM2708_DMA_D_INC | BCM2708_DMA_TDMODE;
++		BCM2708_DMA_S_INC | BCM2708_DMA_D_WIDTH |
++		BCM2708_DMA_D_INC | BCM2708_DMA_TDMODE;
+ 	cb->dst = dst;
+ 	cb->src = src;
+ 	/*
+@@ -560,15 +665,19 @@ static void bcm2708_fb_copyarea(struct f
+ 				const struct fb_copyarea *region)
+ {
+ 	struct bcm2708_fb *fb = to_bcm2708(info);
+-	struct bcm2708_dma_cb *cb = fb->cb_base;
++	struct bcm2708_fb_dev *fbdev = fb->fbdev;
++	struct bcm2708_dma_cb *cb = fbdev->cb_base;
+ 	int bytes_per_pixel = (info->var.bits_per_pixel + 7) >> 3;
+ 
+ 	/* Channel 0 supports larger bursts and is a bit faster */
+-	int burst_size = (fb->dma_chan == 0) ? 8 : 2;
++	int burst_size = (fbdev->dma_chan == 0) ? 8 : 2;
+ 	int pixels = region->width * region->height;
+ 
+-	/* Fallback to cfb_copyarea() if we don't like something */
+-	if (bytes_per_pixel > 4 ||
++	/* If DMA is currently in use (ie being used on another FB), then
++	 * rather than wait for it to finish, just use the cfb_copyarea
++	 */
++	if (!mutex_trylock(&fbdev->dma_mutex) ||
++	    bytes_per_pixel > 4 ||
+ 	    info->var.xres * info->var.yres > 1920 * 1200 ||
+ 	    region->width <= 0 || region->width > info->var.xres ||
+ 	    region->height <= 0 || region->height > info->var.yres ||
+@@ -595,8 +704,8 @@ static void bcm2708_fb_copyarea(struct f
+ 		 * 1920x1200 resolution at 32bpp pixel depth.
+ 		 */
+ 		int y;
+-		dma_addr_t control_block_pa = fb->cb_handle;
+-		dma_addr_t scratchbuf = fb->cb_handle + 16 * 1024;
++		dma_addr_t control_block_pa = fbdev->cb_handle;
++		dma_addr_t scratchbuf = fbdev->cb_handle + 16 * 1024;
+ 		int scanline_size = bytes_per_pixel * region->width;
+ 		int scanlines_per_cb = (64 * 1024 - 16 * 1024) / scanline_size;
+ 
+@@ -646,10 +755,10 @@ static void bcm2708_fb_copyarea(struct f
+ 		}
+ 		set_dma_cb(cb, burst_size,
+ 			   fb->fb_bus_address + dy * fb->fb.fix.line_length +
+-						   bytes_per_pixel * region->dx,
++			   bytes_per_pixel * region->dx,
+ 			   stride,
+ 			   fb->fb_bus_address + sy * fb->fb.fix.line_length +
+-						   bytes_per_pixel * region->sx,
++			   bytes_per_pixel * region->sx,
+ 			   stride,
+ 			   region->width * bytes_per_pixel,
+ 			   region->height);
+@@ -659,32 +768,33 @@ static void bcm2708_fb_copyarea(struct f
+ 	cb->next = 0;
+ 
+ 	if (pixels < dma_busy_wait_threshold) {
+-		bcm_dma_start(fb->dma_chan_base, fb->cb_handle);
+-		bcm_dma_wait_idle(fb->dma_chan_base);
++		bcm_dma_start(fbdev->dma_chan_base, fbdev->cb_handle);
++		bcm_dma_wait_idle(fbdev->dma_chan_base);
+ 	} else {
+-		void __iomem *dma_chan = fb->dma_chan_base;
++		void __iomem *local_dma_chan = fbdev->dma_chan_base;
+ 
+ 		cb->info |= BCM2708_DMA_INT_EN;
+-		bcm_dma_start(fb->dma_chan_base, fb->cb_handle);
+-		while (bcm_dma_is_busy(dma_chan)) {
+-			wait_event_interruptible(fb->dma_waitq,
+-						 !bcm_dma_is_busy(dma_chan));
++		bcm_dma_start(fbdev->dma_chan_base, fbdev->cb_handle);
++		while (bcm_dma_is_busy(local_dma_chan)) {
++			wait_event_interruptible(fbdev->dma_waitq,
++						 !bcm_dma_is_busy(local_dma_chan));
+ 		}
+-		fb->stats.dma_irqs++;
++		fbdev->dma_stats.dma_irqs++;
+ 	}
+-	fb->stats.dma_copies++;
++	fbdev->dma_stats.dma_copies++;
++
++	mutex_unlock(&fbdev->dma_mutex);
+ }
+ 
+ static void bcm2708_fb_imageblit(struct fb_info *info,
+ 				 const struct fb_image *image)
+ {
+-	/* (is called) print_debug("bcm2708_fb_imageblit\n"); */
+ 	cfb_imageblit(info, image);
+ }
+ 
+ static irqreturn_t bcm2708_fb_dma_irq(int irq, void *cxt)
+ {
+-	struct bcm2708_fb *fb = cxt;
++	struct bcm2708_fb_dev *fbdev = cxt;
+ 
+ 	/* FIXME: should read status register to check if this is
+ 	 * actually interrupting us or not, in case this interrupt
+@@ -694,9 +804,9 @@ static irqreturn_t bcm2708_fb_dma_irq(in
+ 	 */
+ 
+ 	/* acknowledge the interrupt */
+-	writel(BCM2708_DMA_INT, fb->dma_chan_base + BCM2708_DMA_CS);
++	writel(BCM2708_DMA_INT, fbdev->dma_chan_base + BCM2708_DMA_CS);
+ 
+-	wake_up(&fb->dma_waitq);
++	wake_up(&fbdev->dma_waitq);
+ 	return IRQ_HANDLED;
+ }
+ 
+@@ -729,11 +839,23 @@ static int bcm2708_fb_register(struct bc
+ 	fb->fb.fix.ywrapstep = 0;
+ 	fb->fb.fix.accel = FB_ACCEL_NONE;
+ 
+-	fb->fb.var.xres = fbwidth;
+-	fb->fb.var.yres = fbheight;
+-	fb->fb.var.xres_virtual = fbwidth;
+-	fb->fb.var.yres_virtual = fbheight;
+-	fb->fb.var.bits_per_pixel = fbdepth;
++	/* If we have data from the VC4 on FB's, use that, otherwise use the
++	 * module parameters
++	 */
++	if (fb->display_settings.width) {
++		fb->fb.var.xres = fb->display_settings.width;
++		fb->fb.var.yres = fb->display_settings.height;
++		fb->fb.var.xres_virtual = fb->fb.var.xres;
++		fb->fb.var.yres_virtual = fb->fb.var.yres;
++		fb->fb.var.bits_per_pixel = fb->display_settings.depth;
++	} else {
++		fb->fb.var.xres = fbwidth;
++		fb->fb.var.yres = fbheight;
++		fb->fb.var.xres_virtual = fbwidth;
++		fb->fb.var.yres_virtual = fbheight;
++		fb->fb.var.bits_per_pixel = fbdepth;
++	}
++
+ 	fb->fb.var.vmode = FB_VMODE_NONINTERLACED;
+ 	fb->fb.var.activate = FB_ACTIVATE_NOW;
+ 	fb->fb.var.nonstd = 0;
+@@ -749,26 +871,23 @@ static int bcm2708_fb_register(struct bc
+ 	fb->fb.monspecs.dclkmax = 100000000;
+ 
+ 	bcm2708_fb_set_bitfields(&fb->fb.var);
+-	init_waitqueue_head(&fb->dma_waitq);
+ 
+ 	/*
+ 	 * Allocate colourmap.
+ 	 */
+-
+ 	fb_set_var(&fb->fb, &fb->fb.var);
++
+ 	ret = bcm2708_fb_set_par(&fb->fb);
++
+ 	if (ret)
+ 		return ret;
+ 
+-	print_debug("BCM2708FB: registering framebuffer (%dx%d@%d) (%d)\n",
+-		    fbwidth, fbheight, fbdepth, fbswap);
+-
+ 	ret = register_framebuffer(&fb->fb);
+-	print_debug("BCM2708FB: register framebuffer (%d)\n", ret);
++
+ 	if (ret == 0)
+ 		goto out;
+ 
+-	print_debug("BCM2708FB: cannot register framebuffer (%d)\n", ret);
++	dev_warn(fb->fb.dev, "Unable to register framebuffer (%d)\n", ret);
+ out:
+ 	return ret;
+ }
+@@ -777,10 +896,18 @@ static int bcm2708_fb_probe(struct platf
+ {
+ 	struct device_node *fw_np;
+ 	struct rpi_firmware *fw;
+-	struct bcm2708_fb *fb;
+-	int ret;
++	int ret, i;
++	u32 num_displays;
++	struct bcm2708_fb_dev *fbdev;
++	struct { u32 base, length; } gpu_mem;
++
++	fbdev = devm_kzalloc(&dev->dev, sizeof(*fbdev), GFP_KERNEL);
++
++	if (!fbdev)
++		return -ENOMEM;
+ 
+ 	fw_np = of_parse_phandle(dev->dev.of_node, "firmware", 0);
++
+ /* Remove comment when booting without Device Tree is no longer supported
+  *	if (!fw_np) {
+  *		dev_err(&dev->dev, "Missing firmware node\n");
+@@ -788,90 +915,154 @@ static int bcm2708_fb_probe(struct platf
+  *	}
+  */
+ 	fw = rpi_firmware_get(fw_np);
++	fbdev->fw = fw;
++
+ 	if (!fw)
+ 		return -EPROBE_DEFER;
+ 
+-	fb = kzalloc(sizeof(*fb), GFP_KERNEL);
+-	if (!fb) {
+-		ret = -ENOMEM;
+-		goto free_region;
++	ret = rpi_firmware_property(fw,
++				    RPI_FIRMWARE_FRAMEBUFFER_GET_NUM_DISPLAYS,
++				    &num_displays, sizeof(u32));
++
++	/* If we fail to get the number of displays, or it returns 0, then
++	 * assume old firmware that doesn't have the mailbox call, so just
++	 * set one display
++	 */
++	if (ret || num_displays == 0) {
++		num_displays = 1;
++		dev_err(&dev->dev,
++			"Unable to determine number of FB's. Assuming 1\n");
++		ret = 0;
++	} else {
++		fbdev->firmware_supports_multifb = 1;
++	}
++
++	if (num_displays > MAX_FRAMEBUFFERS) {
++		dev_warn(&dev->dev,
++			 "More displays reported from firmware than supported in driver (%u vs %u)",
++			 num_displays, MAX_FRAMEBUFFERS);
++		num_displays = MAX_FRAMEBUFFERS;
+ 	}
+ 
+-	fb->fw = fw;
+-	bcm2708_fb_debugfs_init(fb);
++	dev_info(&dev->dev, "FB found %d display(s)\n", num_displays);
++
++	/* Set up the DMA information. Note we have just one set of DMA
++	 * parameters to work with all the FB's so requires synchronising when
++	 * being used
++	 */
++
++	mutex_init(&fbdev->dma_mutex);
+ 
+-	fb->cb_base = dma_alloc_wc(&dev->dev, SZ_64K,
+-					     &fb->cb_handle, GFP_KERNEL);
+-	if (!fb->cb_base) {
++	fbdev->cb_base = dma_alloc_wc(&dev->dev, SZ_64K,
++						&fbdev->cb_handle,
++						GFP_KERNEL);
++	if (!fbdev->cb_base) {
+ 		dev_err(&dev->dev, "cannot allocate DMA CBs\n");
+ 		ret = -ENOMEM;
+ 		goto free_fb;
+ 	}
+ 
+-	pr_info("BCM2708FB: allocated DMA memory %pad\n", &fb->cb_handle);
+-
+ 	ret = bcm_dma_chan_alloc(BCM_DMA_FEATURE_BULK,
+-				 &fb->dma_chan_base, &fb->dma_irq);
++				 &fbdev->dma_chan_base,
++				 &fbdev->dma_irq);
+ 	if (ret < 0) {
+-		dev_err(&dev->dev, "couldn't allocate a DMA channel\n");
++		dev_err(&dev->dev, "Couldn't allocate a DMA channel\n");
+ 		goto free_cb;
+ 	}
+-	fb->dma_chan = ret;
++	fbdev->dma_chan = ret;
+ 
+-	ret = request_irq(fb->dma_irq, bcm2708_fb_dma_irq,
+-			  0, "bcm2708_fb dma", fb);
++	ret = request_irq(fbdev->dma_irq, bcm2708_fb_dma_irq,
++			  0, "bcm2708_fb DMA", fbdev);
+ 	if (ret) {
+-		pr_err("%s: failed to request DMA irq\n", __func__);
++		dev_err(&dev->dev,
++			"Failed to request DMA irq\n");
+ 		goto free_dma_chan;
+ 	}
+ 
+-	pr_info("BCM2708FB: allocated DMA channel %d\n", fb->dma_chan);
++	rpi_firmware_property(fbdev->fw,
++			      RPI_FIRMWARE_GET_VC_MEMORY,
++			      &gpu_mem, sizeof(gpu_mem));
++
++	for (i = 0; i < num_displays; i++) {
++		struct bcm2708_fb *fb = &fbdev->displays[i];
++
++		fb->display_settings.display_num = i;
++		fb->dev = dev;
++		fb->fb.device = &dev->dev;
++		fb->fbdev = fbdev;
++
++		fb->gpu.base = gpu_mem.base;
++		fb->gpu.length = gpu_mem.length;
++
++		if (fbdev->firmware_supports_multifb) {
++			ret = rpi_firmware_property(fw,
++						    RPI_FIRMWARE_FRAMEBUFFER_GET_DISPLAY_SETTINGS,
++						    &fb->display_settings,
++						    GET_DISPLAY_SETTINGS_PAYLOAD_SIZE);
++		} else {
++			memset(&fb->display_settings, 0,
++			       sizeof(fb->display_settings));
++		}
+ 
+-	fb->dev = dev;
+-	fb->fb.device = &dev->dev;
++		ret = bcm2708_fb_register(fb);
+ 
+-	/* failure here isn't fatal, but we'll fail in vc_mem_copy if
+-	 * fb->gpu is not valid
+-	 */
+-	rpi_firmware_property(fb->fw, RPI_FIRMWARE_GET_VC_MEMORY, &fb->gpu,
+-			      sizeof(fb->gpu));
++		if (ret == 0) {
++			bcm2708_fb_debugfs_init(fb);
+ 
+-	ret = bcm2708_fb_register(fb);
+-	if (ret == 0) {
+-		platform_set_drvdata(dev, fb);
+-		goto out;
++			fbdev->num_displays++;
++
++			dev_info(&dev->dev,
++				 "Registered framebuffer for display %u, size %ux%u\n",
++				 fb->display_settings.display_num,
++				 fb->fb.var.xres,
++				 fb->fb.var.yres);
++		} else {
++			// Use this to flag if this FB entry is in use.
++			fb->fbdev = NULL;
++		}
++	}
++
++	// Did we actually successfully create any FB's?
++	if (fbdev->num_displays) {
++		init_waitqueue_head(&fbdev->dma_waitq);
++		platform_set_drvdata(dev, fbdev);
++		return ret;
+ 	}
+ 
+ free_dma_chan:
+-	bcm_dma_chan_free(fb->dma_chan);
++	bcm_dma_chan_free(fbdev->dma_chan);
+ free_cb:
+-	dma_free_wc(&dev->dev, SZ_64K, fb->cb_base, fb->cb_handle);
++	dma_free_wc(&dev->dev, SZ_64K, fbdev->cb_base,
++			      fbdev->cb_handle);
+ free_fb:
+-	kfree(fb);
+-free_region:
+ 	dev_err(&dev->dev, "probe failed, err %d\n", ret);
+-out:
++
+ 	return ret;
+ }
+ 
+ static int bcm2708_fb_remove(struct platform_device *dev)
+ {
+-	struct bcm2708_fb *fb = platform_get_drvdata(dev);
++	struct bcm2708_fb_dev *fbdev = platform_get_drvdata(dev);
++	int i;
+ 
+ 	platform_set_drvdata(dev, NULL);
+ 
+-	if (fb->fb.screen_base)
+-		iounmap(fb->fb.screen_base);
+-	unregister_framebuffer(&fb->fb);
+-
+-	dma_free_wc(&dev->dev, SZ_64K, fb->cb_base, fb->cb_handle);
+-	bcm_dma_chan_free(fb->dma_chan);
+-
+-	bcm2708_fb_debugfs_deinit(fb);
++	for (i = 0; i < fbdev->num_displays; i++) {
++		if (fbdev->displays[i].fb.screen_base)
++			iounmap(fbdev->displays[i].fb.screen_base);
++
++		if (fbdev->displays[i].fbdev) {
++			unregister_framebuffer(&fbdev->displays[i].fb);
++			bcm2708_fb_debugfs_deinit(&fbdev->displays[i]);
++		}
++	}
+ 
+-	free_irq(fb->dma_irq, fb);
++	dma_free_wc(&dev->dev, SZ_64K, fbdev->cb_base,
++			      fbdev->cb_handle);
++	bcm_dma_chan_free(fbdev->dma_chan);
++	free_irq(fbdev->dma_irq, fbdev);
+ 
+-	kfree(fb);
++	mutex_destroy(&fbdev->dma_mutex);
+ 
+ 	return 0;
+ }
+@@ -886,10 +1077,10 @@ static struct platform_driver bcm2708_fb
+ 	.probe = bcm2708_fb_probe,
+ 	.remove = bcm2708_fb_remove,
+ 	.driver = {
+-		   .name = DRIVER_NAME,
+-		   .owner = THIS_MODULE,
+-		   .of_match_table = bcm2708_fb_of_match_table,
+-		   },
++		  .name = DRIVER_NAME,
++		  .owner = THIS_MODULE,
++		  .of_match_table = bcm2708_fb_of_match_table,
++		  },
+ };
+ 
+ static int __init bcm2708_fb_init(void)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0109-fbdev-add-FBIOCOPYAREA-ioctl.patch b/target/linux/bcm27xx/patches-6.1/950-0109-fbdev-add-FBIOCOPYAREA-ioctl.patch
new file mode 100644
index 00000000000000..ddd7c67832d896
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0109-fbdev-add-FBIOCOPYAREA-ioctl.patch
@@ -0,0 +1,337 @@
+From bfcc88c456185fbb27890c03040aa824e69634b7 Mon Sep 17 00:00:00 2001
+From: Siarhei Siamashka <siarhei.siamashka@gmail.com>
+Date: Mon, 17 Jun 2013 13:32:11 +0300
+Subject: [PATCH] fbdev: add FBIOCOPYAREA ioctl
+
+Based on the patch authored by Ali Gholami Rudi at
+    https://lkml.org/lkml/2009/7/13/153
+
+Provide an ioctl for userspace applications, but only if this operation
+is hardware accelerated (otherwide it does not make any sense).
+
+Signed-off-by: Siarhei Siamashka <siarhei.siamashka@gmail.com>
+
+bcm2708_fb: Add ioctl for reading gpu memory through dma
+
+video: bcm2708_fb: Add compat_ioctl support.
+
+When using a 64 bit kernel with 32 bit userspace we need
+compat ioctl handling for FBIODMACOPY as one of the
+parameters is a pointer.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/video/fbdev/bcm2708_fb.c | 170 ++++++++++++++++++++++++++++++-
+ drivers/video/fbdev/core/fbmem.c |  35 +++++++
+ include/uapi/linux/fb.h          |  12 +++
+ 3 files changed, 213 insertions(+), 4 deletions(-)
+
+--- a/drivers/video/fbdev/bcm2708_fb.c
++++ b/drivers/video/fbdev/bcm2708_fb.c
+@@ -32,8 +32,10 @@
+ #include <linux/printk.h>
+ #include <linux/console.h>
+ #include <linux/debugfs.h>
++#include <linux/uaccess.h>
+ #include <linux/io.h>
+ #include <linux/dma-mapping.h>
++#include <linux/cred.h>
+ #include <soc/bcm2835/raspberrypi-firmware.h>
+ #include <linux/mutex.h>
+ 
+@@ -184,9 +186,6 @@ static int bcm2708_fb_debugfs_init(struc
+ 
+ 	fb->debugfs_subdir = debugfs_create_dir(buf, fb->debugfs_dir);
+ 
+-	debugfs_create_regset32("stats", 0444, fb->debugfs_dir,
+-				&fb->stats.regset);
+-
+ 	if (!fb->debugfs_subdir) {
+ 		dev_warn(fb->fb.dev, "%s: could not create debugfs entry %u\n",
+ 			 __func__, fb->display_settings.display_num);
+@@ -603,7 +602,110 @@ static int bcm2708_fb_pan_display(struct
+ 	return result;
+ }
+ 
+-static int bcm2708_ioctl(struct fb_info *info, unsigned int cmd, unsigned long arg)
++static void dma_memcpy(struct bcm2708_fb *fb, dma_addr_t dst, dma_addr_t src,
++		       int size)
++{
++	struct bcm2708_fb_dev *fbdev = fb->fbdev;
++	struct bcm2708_dma_cb *cb = fbdev->cb_base;
++	int burst_size = (fbdev->dma_chan == 0) ? 8 : 2;
++
++	cb->info = BCM2708_DMA_BURST(burst_size) | BCM2708_DMA_S_WIDTH |
++		   BCM2708_DMA_S_INC | BCM2708_DMA_D_WIDTH |
++		   BCM2708_DMA_D_INC;
++	cb->dst = dst;
++	cb->src = src;
++	cb->length = size;
++	cb->stride = 0;
++	cb->pad[0] = 0;
++	cb->pad[1] = 0;
++	cb->next = 0;
++
++	// Not sure what to do if this gets a signal whilst waiting
++	if (mutex_lock_interruptible(&fbdev->dma_mutex))
++		return;
++
++	if (size < dma_busy_wait_threshold) {
++		bcm_dma_start(fbdev->dma_chan_base, fbdev->cb_handle);
++		bcm_dma_wait_idle(fbdev->dma_chan_base);
++	} else {
++		void __iomem *local_dma_chan = fbdev->dma_chan_base;
++
++		cb->info |= BCM2708_DMA_INT_EN;
++		bcm_dma_start(fbdev->dma_chan_base, fbdev->cb_handle);
++		while (bcm_dma_is_busy(local_dma_chan)) {
++			wait_event_interruptible(fbdev->dma_waitq,
++						 !bcm_dma_is_busy(local_dma_chan));
++		}
++		fbdev->dma_stats.dma_irqs++;
++	}
++	fbdev->dma_stats.dma_copies++;
++
++	mutex_unlock(&fbdev->dma_mutex);
++}
++
++/* address with no aliases */
++#define INTALIAS_NORMAL(x) ((x) & ~0xc0000000)
++/* cache coherent but non-allocating in L1 and L2 */
++#define INTALIAS_L1L2_NONALLOCATING(x) (((x) & ~0xc0000000) | 0x80000000)
++
++static long vc_mem_copy(struct bcm2708_fb *fb, struct fb_dmacopy *ioparam)
++{
++	size_t size = PAGE_SIZE;
++	u32 *buf = NULL;
++	dma_addr_t bus_addr;
++	long rc = 0;
++	size_t offset;
++
++	/* restrict this to root user */
++	if (!uid_eq(current_euid(), GLOBAL_ROOT_UID)) {
++		rc = -EFAULT;
++		goto out;
++	}
++
++	if (!fb->gpu.base || !fb->gpu.length) {
++		pr_err("[%s]: Unable to determine gpu memory (%x,%x)\n",
++		       __func__, fb->gpu.base, fb->gpu.length);
++		return -EFAULT;
++	}
++
++	if (INTALIAS_NORMAL(ioparam->src) < fb->gpu.base ||
++	    INTALIAS_NORMAL(ioparam->src) >= fb->gpu.base + fb->gpu.length) {
++		pr_err("[%s]: Invalid memory access %x (%x-%x)", __func__,
++		       INTALIAS_NORMAL(ioparam->src), fb->gpu.base,
++		       fb->gpu.base + fb->gpu.length);
++		return -EFAULT;
++	}
++
++	buf = dma_alloc_coherent(fb->fb.device, PAGE_ALIGN(size), &bus_addr,
++				 GFP_ATOMIC);
++	if (!buf) {
++		pr_err("[%s]: failed to dma_alloc_coherent(%zd)\n", __func__,
++		       size);
++		rc = -ENOMEM;
++		goto out;
++	}
++
++	for (offset = 0; offset < ioparam->length; offset += size) {
++		size_t remaining = ioparam->length - offset;
++		size_t s = min(size, remaining);
++		u8 *p = (u8 *)((uintptr_t)ioparam->src + offset);
++		u8 *q = (u8 *)ioparam->dst + offset;
++
++		dma_memcpy(fb, bus_addr,
++			   INTALIAS_L1L2_NONALLOCATING((dma_addr_t)p), size);
++		if (copy_to_user(q, buf, s) != 0) {
++			pr_err("[%s]: failed to copy-to-user\n", __func__);
++			rc = -EFAULT;
++			goto out;
++		}
++	}
++out:
++	if (buf)
++		dma_free_coherent(fb->fb.device, PAGE_ALIGN(size), buf,
++				  bus_addr);
++	return rc;
++}
++
+ static int bcm2708_ioctl(struct fb_info *info, unsigned int cmd,
+ 			 unsigned long arg)
+ {
+@@ -619,6 +721,21 @@ static int bcm2708_ioctl(struct fb_info
+ 					    RPI_FIRMWARE_FRAMEBUFFER_SET_VSYNC,
+ 					    &dummy, sizeof(dummy));
+ 		break;
++
++	case FBIODMACOPY:
++	{
++		struct fb_dmacopy ioparam;
++		/* Get the parameter data.
++		 */
++		if (copy_from_user
++		    (&ioparam, (void *)arg, sizeof(ioparam))) {
++			pr_err("[%s]: failed to copy-from-user\n", __func__);
++			ret = -EFAULT;
++			break;
++		}
++		ret = vc_mem_copy(fb, &ioparam);
++		break;
++	}
+ 	default:
+ 		dev_dbg(info->device, "Unknown ioctl 0x%x\n", cmd);
+ 		return -ENOTTY;
+@@ -629,6 +746,48 @@ static int bcm2708_ioctl(struct fb_info
+ 
+ 	return ret;
+ }
++
++#ifdef CONFIG_COMPAT
++struct fb_dmacopy32 {
++	compat_uptr_t dst;
++	__u32 src;
++	__u32 length;
++};
++
++#define FBIODMACOPY32		_IOW('z', 0x22, struct fb_dmacopy32)
++
++static int bcm2708_compat_ioctl(struct fb_info *info, unsigned int cmd,
++				unsigned long arg)
++{
++	struct bcm2708_fb *fb = to_bcm2708(info);
++	int ret;
++
++	switch (cmd) {
++	case FBIODMACOPY32:
++	{
++		struct fb_dmacopy32 param32;
++		struct fb_dmacopy param;
++		/* Get the parameter data.
++		 */
++		if (copy_from_user(&param32, (void *)arg, sizeof(param32))) {
++			pr_err("[%s]: failed to copy-from-user\n", __func__);
++			ret = -EFAULT;
++			break;
++		}
++		param.dst = compat_ptr(param32.dst);
++		param.src = param32.src;
++		param.length = param32.length;
++		ret = vc_mem_copy(fb, &param);
++		break;
++	}
++	default:
++		ret = bcm2708_ioctl(info, cmd, arg);
++		break;
++	}
++	return ret;
++}
++#endif
++
+ static void bcm2708_fb_fillrect(struct fb_info *info,
+ 				const struct fb_fillrect *rect)
+ {
+@@ -821,6 +980,9 @@ static struct fb_ops bcm2708_fb_ops = {
+ 	.fb_imageblit = bcm2708_fb_imageblit,
+ 	.fb_pan_display = bcm2708_fb_pan_display,
+ 	.fb_ioctl = bcm2708_ioctl,
++#ifdef CONFIG_COMPAT
++	.fb_compat_ioctl = bcm2708_compat_ioctl,
++#endif
+ };
+ 
+ static int bcm2708_fb_register(struct bcm2708_fb *fb)
+--- a/drivers/video/fbdev/core/fbmem.c
++++ b/drivers/video/fbdev/core/fbmem.c
+@@ -1094,6 +1094,30 @@ fb_blank(struct fb_info *info, int blank
+ }
+ EXPORT_SYMBOL(fb_blank);
+ 
++static int fb_copyarea_user(struct fb_info *info,
++			    struct fb_copyarea *copy)
++{
++	int ret = 0;
++	lock_fb_info(info);
++	if (copy->dx >= info->var.xres ||
++	    copy->sx >= info->var.xres ||
++	    copy->width > info->var.xres ||
++	    copy->dy >= info->var.yres ||
++	    copy->sy >= info->var.yres ||
++	    copy->height > info->var.yres ||
++	    copy->dx + copy->width > info->var.xres ||
++	    copy->sx + copy->width > info->var.xres ||
++	    copy->dy + copy->height > info->var.yres ||
++	    copy->sy + copy->height > info->var.yres) {
++		ret = -EINVAL;
++		goto out;
++	}
++	info->fbops->fb_copyarea(info, copy);
++out:
++	unlock_fb_info(info);
++	return ret;
++}
++
+ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
+ 			unsigned long arg)
+ {
+@@ -1102,6 +1126,7 @@ static long do_fb_ioctl(struct fb_info *
+ 	struct fb_fix_screeninfo fix;
+ 	struct fb_cmap cmap_from;
+ 	struct fb_cmap_user cmap;
++	struct fb_copyarea copy;
+ 	void __user *argp = (void __user *)arg;
+ 	long ret = 0;
+ 
+@@ -1183,6 +1208,15 @@ static long do_fb_ioctl(struct fb_info *
+ 		unlock_fb_info(info);
+ 		console_unlock();
+ 		break;
++	case FBIOCOPYAREA:
++		if (info->flags & FBINFO_HWACCEL_COPYAREA) {
++			/* only provide this ioctl if it is accelerated */
++			if (copy_from_user(&copy, argp, sizeof(copy)))
++				return -EFAULT;
++			ret = fb_copyarea_user(info, &copy);
++			break;
++		}
++		fallthrough;
+ 	default:
+ 		lock_fb_info(info);
+ 		fb = info->fbops;
+@@ -1322,6 +1356,7 @@ static long fb_compat_ioctl(struct file
+ 	case FBIOPAN_DISPLAY:
+ 	case FBIOGET_CON2FBMAP:
+ 	case FBIOPUT_CON2FBMAP:
++	case FBIOCOPYAREA:
+ 		arg = (unsigned long) compat_ptr(arg);
+ 		fallthrough;
+ 	case FBIOBLANK:
+--- a/include/uapi/linux/fb.h
++++ b/include/uapi/linux/fb.h
+@@ -35,6 +35,12 @@
+ #define FBIOPUT_MODEINFO        0x4617
+ #define FBIOGET_DISPINFO        0x4618
+ #define FBIO_WAITFORVSYNC	_IOW('F', 0x20, __u32)
++/*
++ * HACK: use 'z' in order not to clash with any other ioctl numbers which might
++ * be concurrently added to the mainline kernel
++ */
++#define FBIOCOPYAREA		_IOW('z', 0x21, struct fb_copyarea)
++#define FBIODMACOPY 		_IOW('z', 0x22, struct fb_dmacopy)
+ 
+ #define FB_TYPE_PACKED_PIXELS		0	/* Packed Pixels	*/
+ #define FB_TYPE_PLANES			1	/* Non interleaved planes */
+@@ -348,6 +354,12 @@ struct fb_copyarea {
+ 	__u32 sy;
+ };
+ 
++struct fb_dmacopy {
++	void *dst;
++	__u32 src;
++	__u32 length;
++};
++
+ struct fb_fillrect {
+ 	__u32 dx;	/* screen-relative */
+ 	__u32 dy;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0110-dmaengine-Add-support-for-BCM2708.patch b/target/linux/bcm27xx/patches-6.1/950-0110-dmaengine-Add-support-for-BCM2708.patch
new file mode 100644
index 00000000000000..7bf10b85ed3f53
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0110-dmaengine-Add-support-for-BCM2708.patch
@@ -0,0 +1,652 @@
+From 52f0d07b546d1fd84aace07d69f8cf751ce8a3ab Mon Sep 17 00:00:00 2001
+From: Florian Meier <florian.meier@koalo.de>
+Date: Fri, 22 Nov 2013 14:22:53 +0100
+Subject: [PATCH] dmaengine: Add support for BCM2708
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Add support for DMA controller of BCM2708 as used in the Raspberry Pi.
+Currently it only supports cyclic DMA.
+
+Signed-off-by: Florian Meier <florian.meier@koalo.de>
+
+dmaengine: expand functionality by supporting scatter/gather transfers sdhci-bcm2708 and dma.c: fix for LITE channels
+
+DMA: fix cyclic LITE length overflow bug
+
+dmaengine: bcm2708: Remove chancnt affectations
+
+Mirror bcm2835-dma.c commit 9eba5536a7434c69d8c185d4bd1c70734d92287d:
+chancnt is already filled by dma_async_device_register, which uses the channel
+list to know how much channels there is.
+
+Since it's already filled, we can safely remove it from the drivers' probe
+function.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dmaengine: bcm2708: overwrite dreq only if it is not set
+
+dreq is set when the DMA channel is fetched from Device Tree.
+slave_id is set using dmaengine_slave_config().
+Only overwrite dreq with slave_id if it is not set.
+
+dreq/slave_id in the cyclic DMA case is not touched, because I don't
+have hardware to test with.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dmaengine: bcm2708: do device registration in the board file
+
+Don't register the device in the driver. Do it in the board file.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dmaengine: bcm2708: don't restrict DT support to ARCH_BCM2835
+
+Both ARCH_BCM2835 and ARCH_BCM270x are built with OF now.
+Add Device Tree support to the non ARCH_BCM2835 case.
+Use the same driver name regardless of architecture.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+BCM270x_DT: add bcm2835-dma entry
+
+Add Device Tree entry for bcm2835-dma.
+The entry doesn't contain any resources since they are handled
+by the arch/arm/mach-bcm270x/dma.c driver.
+In non-DT mode, don't add the device in the board file.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+bcm2708-dmaengine: Add debug options
+
+BCM270x: Add memory and irq resources to dmaengine device and DT
+
+Prepare for merging of the legacy DMA API arch driver dma.c
+with bcm2708-dmaengine by adding memory and irq resources both
+to platform file device and Device Tree node.
+Don't use BCM_DMAMAN_DRIVER_NAME so we don't have to include mach/dma.h
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dmaengine: bcm2708: Merge with arch dma.c driver and disable dma.c
+
+Merge the legacy DMA API driver with bcm2708-dmaengine.
+This is done so we can use bcm2708_fb on ARCH_BCM2835 (mailbox
+driver is also needed).
+
+Changes to the dma.c code:
+- Use BIT() macro.
+- Cutdown some comments to one line.
+- Add mutex to vc_dmaman and use this, since the dev lock is locked
+  during probing of the engine part.
+- Add global g_dmaman variable since drvdata is used by the engine part.
+- Restructure for readability:
+  vc_dmaman_chan_alloc()
+  vc_dmaman_chan_free()
+  bcm_dma_chan_free()
+- Restructure bcm_dma_chan_alloc() to simplify error handling.
+- Use device irq resources instead of hardcoded bcm_dma_irqs table.
+- Remove dev_dmaman_register() and code it directly.
+- Remove dev_dmaman_deregister() and code it directly.
+- Simplify bcm_dmaman_probe() using devm_* functions.
+- Get dmachans from DT if available.
+- Keep 'dma.dmachans' module argument name for backwards compatibility.
+
+Make it available on ARCH_BCM2835 as well.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dmaengine: bcm2708: set residue_granularity field
+
+bcm2708-dmaengine supports residue reporting at burst level
+but didn't report this via the residue_granularity field.
+
+Without this field set properly we get playback issues with I2S cards.
+
+dmaengine: bcm2708-dmaengine: Fix memory leak when stopping a running transfer
+
+bcm2708-dmaengine: Use more DMA channels (but not 12)
+
+1) Only the bcm2708_fb drivers uses the legacy DMA API, and
+it requires a BULK-capable channel, so all other types
+(FAST, NORMAL and LITE) can be made available to the regular
+DMA API.
+
+2) DMA channels 11-14 share an interrupt. The driver can't
+handle this, so don't use channels 12-14 (12 was used, probably
+because it appears to have an interrupt, but in reality that
+interrupt is for activity on ANY channel). This may explain
+a lockup encountered when running out of DMA channels.
+
+The combined effect of this patch is to leave 7 DMA channels
+available + channel 0 for bcm2708_fb via the legacy API.
+
+See: https://github.com/raspberrypi/linux/issues/1110
+     https://github.com/raspberrypi/linux/issues/1108
+
+dmaengine: bcm2708: Make legacy API available for bcm2835-dma
+
+bcm2708_fb uses the legacy DMA API, so in order to start using
+bcm2835-dma, bcm2835-dma has to support the legacy API. Make this
+possible by exporting bcm_dmaman_probe() and bcm_dmaman_remove().
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dmaengine: bcm2708: Change DT compatible string
+
+Both bcm2835-dma and bcm2708-dmaengine have the same compatible string.
+So change compatible to "brcm,bcm2708-dma".
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dmaengine: bcm2708: Remove driver but keep legacy API
+
+Dropping non-DT support means we don't need this driver,
+but we still need the legacy DMA API.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+bcm2708-dmaengine - Fix arm64 portability/build issues
+
+dma-bcm2708: Fix module compilation of CONFIG_DMA_BCM2708
+
+bcm2708-dmaengine.c defines functions like bcm_dma_start which are
+defined as well in dma-bcm2708.h as inline versions when
+CONFIG_DMA_BCM2708 is not defined. This works fine when
+CONFIG_DMA_BCM2708 is built in, but when it is selected as module build
+fails with redefinition errors because in the build system when
+CONFIG_DMA_BCM2708 is selected as module, the macro becomes
+CONFIG_DMA_BCM2708_MODULE.
+
+This patch makes the header use CONFIG_DMA_BCM2708_MODULE too when
+available.
+
+Fixes https://github.com/raspberrypi/linux/issues/2056
+
+Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
+
+bcm2708-dmaengine: Use platform_get_irq
+
+The platform driver framework no longer creates IRQ resources for
+platform devices because they are expected to use platform_get_irq.
+This causes the bcm2808_fb acceleration to fail.
+
+Fix the problem by calling platform_get_irq as intended.
+
+See: https://github.com/raspberrypi/linux/issues/5131
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/dma/Kconfig                       |   6 +-
+ drivers/dma/Makefile                      |   1 +
+ drivers/dma/bcm2708-dmaengine.c           | 281 ++++++++++++++++++++++
+ include/linux/platform_data/dma-bcm2708.h | 143 +++++++++++
+ 4 files changed, 430 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/dma/bcm2708-dmaengine.c
+ create mode 100644 include/linux/platform_data/dma-bcm2708.h
+
+--- a/drivers/dma/Kconfig
++++ b/drivers/dma/Kconfig
+@@ -135,7 +135,7 @@ config BCM_SBA_RAID
+ 
+ config DMA_BCM2835
+ 	tristate "BCM2835 DMA engine support"
+-	depends on ARCH_BCM2835 || ARCH_BCM2708 || ARCH_BCM2709
++	depends on ARCH_BCM2835
+ 	select DMA_ENGINE
+ 	select DMA_VIRTUAL_CHANNELS
+ 
+@@ -703,6 +703,10 @@ config UNIPHIER_XDMAC
+ 	  UniPhier platform. This DMA controller can transfer data from
+ 	  memory to memory, memory to peripheral and peripheral to memory.
+ 
++config DMA_BCM2708
++	tristate "BCM2708 DMA legacy API support"
++	depends on DMA_BCM2835
++
+ config XGENE_DMA
+ 	tristate "APM X-Gene DMA support"
+ 	depends on ARCH_XGENE || COMPILE_TEST
+--- a/drivers/dma/Makefile
++++ b/drivers/dma/Makefile
+@@ -22,6 +22,7 @@ obj-$(CONFIG_AT_HDMAC) += at_hdmac.o
+ obj-$(CONFIG_AT_XDMAC) += at_xdmac.o
+ obj-$(CONFIG_AXI_DMAC) += dma-axi-dmac.o
+ obj-$(CONFIG_BCM_SBA_RAID) += bcm-sba-raid.o
++obj-$(CONFIG_DMA_BCM2708) += bcm2708-dmaengine.o
+ obj-$(CONFIG_DMA_BCM2835) += bcm2835-dma.o
+ obj-$(CONFIG_DMA_JZ4780) += dma-jz4780.o
+ obj-$(CONFIG_DMA_SA11X0) += sa11x0-dma.o
+--- /dev/null
++++ b/drivers/dma/bcm2708-dmaengine.c
+@@ -0,0 +1,281 @@
++/*
++ * BCM2708 legacy DMA API
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#include <linux/init.h>
++#include <linux/interrupt.h>
++#include <linux/list.h>
++#include <linux/module.h>
++#include <linux/platform_data/dma-bcm2708.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++#include <linux/io.h>
++#include <linux/spinlock.h>
++
++#include "virt-dma.h"
++
++#define CACHE_LINE_MASK 31
++#define DEFAULT_DMACHAN_BITMAP 0x10  /* channel 4 only */
++
++/* valid only for channels 0 - 14, 15 has its own base address */
++#define BCM2708_DMA_CHAN(n)	((n) << 8) /* base address */
++#define BCM2708_DMA_CHANIO(dma_base, n) \
++	((void __iomem *)((char *)(dma_base) + BCM2708_DMA_CHAN(n)))
++
++struct vc_dmaman {
++	void __iomem *dma_base;
++	u32 chan_available; /* bitmap of available channels */
++	u32 has_feature[BCM_DMA_FEATURE_COUNT]; /* bitmap of feature presence */
++	struct mutex lock;
++};
++
++static struct device *dmaman_dev;	/* we assume there's only one! */
++static struct vc_dmaman *g_dmaman;	/* DMA manager */
++
++/* DMA Auxiliary Functions */
++
++/* A DMA buffer on an arbitrary boundary may separate a cache line into a
++   section inside the DMA buffer and another section outside it.
++   Even if we flush DMA buffers from the cache there is always the chance that
++   during a DMA someone will access the part of a cache line that is outside
++   the DMA buffer - which will then bring in unwelcome data.
++   Without being able to dictate our own buffer pools we must insist that
++   DMA buffers consist of a whole number of cache lines.
++*/
++extern int bcm_sg_suitable_for_dma(struct scatterlist *sg_ptr, int sg_len)
++{
++	int i;
++
++	for (i = 0; i < sg_len; i++) {
++		if (sg_ptr[i].offset & CACHE_LINE_MASK ||
++		    sg_ptr[i].length & CACHE_LINE_MASK)
++			return 0;
++	}
++
++	return 1;
++}
++EXPORT_SYMBOL_GPL(bcm_sg_suitable_for_dma);
++
++extern void bcm_dma_start(void __iomem *dma_chan_base,
++			  dma_addr_t control_block)
++{
++	dsb(sy);	/* ARM data synchronization (push) operation */
++
++	writel(control_block, dma_chan_base + BCM2708_DMA_ADDR);
++	writel(BCM2708_DMA_ACTIVE, dma_chan_base + BCM2708_DMA_CS);
++}
++EXPORT_SYMBOL_GPL(bcm_dma_start);
++
++extern void bcm_dma_wait_idle(void __iomem *dma_chan_base)
++{
++	dsb(sy);
++
++	/* ugly busy wait only option for now */
++	while (readl(dma_chan_base + BCM2708_DMA_CS) & BCM2708_DMA_ACTIVE)
++		cpu_relax();
++}
++EXPORT_SYMBOL_GPL(bcm_dma_wait_idle);
++
++extern bool bcm_dma_is_busy(void __iomem *dma_chan_base)
++{
++	dsb(sy);
++
++	return readl(dma_chan_base + BCM2708_DMA_CS) & BCM2708_DMA_ACTIVE;
++}
++EXPORT_SYMBOL_GPL(bcm_dma_is_busy);
++
++/* Complete an ongoing DMA (assuming its results are to be ignored)
++   Does nothing if there is no DMA in progress.
++   This routine waits for the current AXI transfer to complete before
++   terminating the current DMA. If the current transfer is hung on a DREQ used
++   by an uncooperative peripheral the AXI transfer may never complete.	In this
++   case the routine times out and return a non-zero error code.
++   Use of this routine doesn't guarantee that the ongoing or aborted DMA
++   does not produce an interrupt.
++*/
++extern int bcm_dma_abort(void __iomem *dma_chan_base)
++{
++	unsigned long int cs;
++	int rc = 0;
++
++	cs = readl(dma_chan_base + BCM2708_DMA_CS);
++
++	if (BCM2708_DMA_ACTIVE & cs) {
++		long int timeout = 10000;
++
++		/* write 0 to the active bit - pause the DMA */
++		writel(0, dma_chan_base + BCM2708_DMA_CS);
++
++		/* wait for any current AXI transfer to complete */
++		while (0 != (cs & BCM2708_DMA_ISPAUSED) && --timeout >= 0)
++			cs = readl(dma_chan_base + BCM2708_DMA_CS);
++
++		if (0 != (cs & BCM2708_DMA_ISPAUSED)) {
++			/* we'll un-pause when we set of our next DMA */
++			rc = -ETIMEDOUT;
++
++		} else if (BCM2708_DMA_ACTIVE & cs) {
++			/* terminate the control block chain */
++			writel(0, dma_chan_base + BCM2708_DMA_NEXTCB);
++
++			/* abort the whole DMA */
++			writel(BCM2708_DMA_ABORT | BCM2708_DMA_ACTIVE,
++			       dma_chan_base + BCM2708_DMA_CS);
++		}
++	}
++
++	return rc;
++}
++EXPORT_SYMBOL_GPL(bcm_dma_abort);
++
++ /* DMA Manager Device Methods */
++
++static void vc_dmaman_init(struct vc_dmaman *dmaman, void __iomem *dma_base,
++			   u32 chans_available)
++{
++	dmaman->dma_base = dma_base;
++	dmaman->chan_available = chans_available;
++	dmaman->has_feature[BCM_DMA_FEATURE_FAST_ORD] = 0x0c;  /* 2 & 3 */
++	dmaman->has_feature[BCM_DMA_FEATURE_BULK_ORD] = 0x01;  /* 0 */
++	dmaman->has_feature[BCM_DMA_FEATURE_NORMAL_ORD] = 0xfe;  /* 1 to 7 */
++	dmaman->has_feature[BCM_DMA_FEATURE_LITE_ORD] = 0x7f00;  /* 8 to 14 */
++}
++
++static int vc_dmaman_chan_alloc(struct vc_dmaman *dmaman,
++				unsigned required_feature_set)
++{
++	u32 chans;
++	int chan = 0;
++	int feature;
++
++	chans = dmaman->chan_available;
++	for (feature = 0; feature < BCM_DMA_FEATURE_COUNT; feature++)
++		/* select the subset of available channels with the desired
++		   features */
++		if (required_feature_set & (1 << feature))
++			chans &= dmaman->has_feature[feature];
++
++	if (!chans)
++		return -ENOENT;
++
++	/* return the ordinal of the first channel in the bitmap */
++	while (chans != 0 && (chans & 1) == 0) {
++		chans >>= 1;
++		chan++;
++	}
++	/* claim the channel */
++	dmaman->chan_available &= ~(1 << chan);
++
++	return chan;
++}
++
++static int vc_dmaman_chan_free(struct vc_dmaman *dmaman, int chan)
++{
++	if (chan < 0)
++		return -EINVAL;
++
++	if ((1 << chan) & dmaman->chan_available)
++		return -EIDRM;
++
++	dmaman->chan_available |= (1 << chan);
++
++	return 0;
++}
++
++/* DMA Manager Monitor */
++
++extern int bcm_dma_chan_alloc(unsigned required_feature_set,
++			      void __iomem **out_dma_base, int *out_dma_irq)
++{
++	struct vc_dmaman *dmaman = g_dmaman;
++	struct platform_device *pdev = to_platform_device(dmaman_dev);
++	int chan;
++	int irq;
++
++	if (!dmaman_dev)
++		return -ENODEV;
++
++	mutex_lock(&dmaman->lock);
++	chan = vc_dmaman_chan_alloc(dmaman, required_feature_set);
++	if (chan < 0)
++		goto out;
++
++	irq = platform_get_irq(pdev, (unsigned int)chan);
++	if (irq < 0) {
++		dev_err(dmaman_dev, "failed to get irq for DMA channel %d\n",
++			chan);
++		vc_dmaman_chan_free(dmaman, chan);
++		chan = -ENOENT;
++		goto out;
++	}
++
++	*out_dma_base = BCM2708_DMA_CHANIO(dmaman->dma_base, chan);
++	*out_dma_irq = irq;
++	dev_dbg(dmaman_dev,
++		"Legacy API allocated channel=%d, base=%p, irq=%i\n",
++		chan, *out_dma_base, *out_dma_irq);
++
++out:
++	mutex_unlock(&dmaman->lock);
++
++	return chan;
++}
++EXPORT_SYMBOL_GPL(bcm_dma_chan_alloc);
++
++extern int bcm_dma_chan_free(int channel)
++{
++	struct vc_dmaman *dmaman = g_dmaman;
++	int rc;
++
++	if (!dmaman_dev)
++		return -ENODEV;
++
++	mutex_lock(&dmaman->lock);
++	rc = vc_dmaman_chan_free(dmaman, channel);
++	mutex_unlock(&dmaman->lock);
++
++	return rc;
++}
++EXPORT_SYMBOL_GPL(bcm_dma_chan_free);
++
++int bcm_dmaman_probe(struct platform_device *pdev, void __iomem *base,
++		     u32 chans_available)
++{
++	struct device *dev = &pdev->dev;
++	struct vc_dmaman *dmaman;
++
++	dmaman = devm_kzalloc(dev, sizeof(*dmaman), GFP_KERNEL);
++	if (!dmaman)
++		return -ENOMEM;
++
++	mutex_init(&dmaman->lock);
++	vc_dmaman_init(dmaman, base, chans_available);
++	g_dmaman = dmaman;
++	dmaman_dev = dev;
++
++	dev_info(dev, "DMA legacy API manager, dmachans=0x%x\n",
++		 chans_available);
++
++	return 0;
++}
++EXPORT_SYMBOL(bcm_dmaman_probe);
++
++int bcm_dmaman_remove(struct platform_device *pdev)
++{
++	dmaman_dev = NULL;
++
++	return 0;
++}
++EXPORT_SYMBOL(bcm_dmaman_remove);
++
++MODULE_LICENSE("GPL");
+--- /dev/null
++++ b/include/linux/platform_data/dma-bcm2708.h
+@@ -0,0 +1,143 @@
++/*
++ *  Copyright (C) 2010 Broadcom
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#ifndef _PLAT_BCM2708_DMA_H
++#define _PLAT_BCM2708_DMA_H
++
++/* DMA CS Control and Status bits */
++#define BCM2708_DMA_ACTIVE	BIT(0)
++#define BCM2708_DMA_INT		BIT(2)
++#define BCM2708_DMA_ISPAUSED	BIT(4)  /* Pause requested or not active */
++#define BCM2708_DMA_ISHELD	BIT(5)  /* Is held by DREQ flow control */
++#define BCM2708_DMA_ERR		BIT(8)
++#define BCM2708_DMA_ABORT	BIT(30) /* stop current CB, go to next, WO */
++#define BCM2708_DMA_RESET	BIT(31) /* WO, self clearing */
++
++/* DMA control block "info" field bits */
++#define BCM2708_DMA_INT_EN	BIT(0)
++#define BCM2708_DMA_TDMODE	BIT(1)
++#define BCM2708_DMA_WAIT_RESP	BIT(3)
++#define BCM2708_DMA_D_INC	BIT(4)
++#define BCM2708_DMA_D_WIDTH	BIT(5)
++#define BCM2708_DMA_D_DREQ	BIT(6)
++#define BCM2708_DMA_S_INC	BIT(8)
++#define BCM2708_DMA_S_WIDTH	BIT(9)
++#define BCM2708_DMA_S_DREQ	BIT(10)
++
++#define	BCM2708_DMA_BURST(x)	(((x) & 0xf) << 12)
++#define	BCM2708_DMA_PER_MAP(x)	((x) << 16)
++#define	BCM2708_DMA_WAITS(x)	(((x) & 0x1f) << 21)
++
++#define BCM2708_DMA_DREQ_EMMC	11
++#define BCM2708_DMA_DREQ_SDHOST	13
++
++#define BCM2708_DMA_CS		0x00 /* Control and Status */
++#define BCM2708_DMA_ADDR	0x04
++/* the current control block appears in the following registers - read only */
++#define BCM2708_DMA_INFO	0x08
++#define BCM2708_DMA_SOURCE_AD	0x0c
++#define BCM2708_DMA_DEST_AD	0x10
++#define BCM2708_DMA_NEXTCB	0x1C
++#define BCM2708_DMA_DEBUG	0x20
++
++#define BCM2708_DMA4_CS		(BCM2708_DMA_CHAN(4) + BCM2708_DMA_CS)
++#define BCM2708_DMA4_ADDR	(BCM2708_DMA_CHAN(4) + BCM2708_DMA_ADDR)
++
++#define BCM2708_DMA_TDMODE_LEN(w, h) ((h) << 16 | (w))
++
++/* When listing features we can ask for when allocating DMA channels give
++   those with higher priority smaller ordinal numbers */
++#define BCM_DMA_FEATURE_FAST_ORD	0
++#define BCM_DMA_FEATURE_BULK_ORD	1
++#define BCM_DMA_FEATURE_NORMAL_ORD	2
++#define BCM_DMA_FEATURE_LITE_ORD	3
++#define BCM_DMA_FEATURE_FAST		BIT(BCM_DMA_FEATURE_FAST_ORD)
++#define BCM_DMA_FEATURE_BULK		BIT(BCM_DMA_FEATURE_BULK_ORD)
++#define BCM_DMA_FEATURE_NORMAL		BIT(BCM_DMA_FEATURE_NORMAL_ORD)
++#define BCM_DMA_FEATURE_LITE		BIT(BCM_DMA_FEATURE_LITE_ORD)
++#define BCM_DMA_FEATURE_COUNT		4
++
++struct bcm2708_dma_cb {
++	u32 info;
++	u32 src;
++	u32 dst;
++	u32 length;
++	u32 stride;
++	u32 next;
++	u32 pad[2];
++};
++
++struct scatterlist;
++struct platform_device;
++
++#if defined(CONFIG_DMA_BCM2708) || defined(CONFIG_DMA_BCM2708_MODULE)
++
++int bcm_sg_suitable_for_dma(struct scatterlist *sg_ptr, int sg_len);
++void bcm_dma_start(void __iomem *dma_chan_base, dma_addr_t control_block);
++void bcm_dma_wait_idle(void __iomem *dma_chan_base);
++bool bcm_dma_is_busy(void __iomem *dma_chan_base);
++int bcm_dma_abort(void __iomem *dma_chan_base);
++
++/* return channel no or -ve error */
++int bcm_dma_chan_alloc(unsigned preferred_feature_set,
++		       void __iomem **out_dma_base, int *out_dma_irq);
++int bcm_dma_chan_free(int channel);
++
++int bcm_dmaman_probe(struct platform_device *pdev, void __iomem *base,
++		     u32 chans_available);
++int bcm_dmaman_remove(struct platform_device *pdev);
++
++#else /* CONFIG_DMA_BCM2708 */
++
++static inline int bcm_sg_suitable_for_dma(struct scatterlist *sg_ptr,
++					  int sg_len)
++{
++	return 0;
++}
++
++static inline void bcm_dma_start(void __iomem *dma_chan_base,
++				 dma_addr_t control_block) { }
++
++static inline void bcm_dma_wait_idle(void __iomem *dma_chan_base) { }
++
++static inline bool bcm_dma_is_busy(void __iomem *dma_chan_base)
++{
++	return false;
++}
++
++static inline int bcm_dma_abort(void __iomem *dma_chan_base)
++{
++	return -EINVAL;
++}
++
++static inline int bcm_dma_chan_alloc(unsigned preferred_feature_set,
++				     void __iomem **out_dma_base,
++				     int *out_dma_irq)
++{
++	return -EINVAL;
++}
++
++static inline int bcm_dma_chan_free(int channel)
++{
++	return -EINVAL;
++}
++
++static inline int bcm_dmaman_probe(struct platform_device *pdev,
++				   void __iomem *base, u32 chans_available)
++{
++	return 0;
++}
++
++static inline int bcm_dmaman_remove(struct platform_device *pdev)
++{
++	return 0;
++}
++
++#endif /* CONFIG_DMA_BCM2708 || CONFIG_DMA_BCM2708_MODULE */
++
++#endif /* _PLAT_BCM2708_DMA_H */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0111-MMC-added-alternative-MMC-driver.patch b/target/linux/bcm27xx/patches-6.1/950-0111-MMC-added-alternative-MMC-driver.patch
new file mode 100644
index 00000000000000..0e14805d5b8b2c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0111-MMC-added-alternative-MMC-driver.patch
@@ -0,0 +1,2018 @@
+From c9b2c57e7fbfbebf73f96e58fb783bba83c50bd9 Mon Sep 17 00:00:00 2001
+From: gellert <gellert@raspberrypi.org>
+Date: Fri, 15 Aug 2014 16:35:06 +0100
+Subject: [PATCH] MMC: added alternative MMC driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+mmc: Disable CMD23 transfers on all cards
+
+Pending wire-level investigation of these types of transfers
+and associated errors on bcm2835-mmc, disable for now. Fallback of
+CMD18/CMD25 transfers will be used automatically by the MMC layer.
+
+Reported/Tested-by: Gellert Weisz <gellert@raspberrypi.org>
+
+mmc: bcm2835-mmc: enable DT support for all architectures
+
+Both ARCH_BCM2835 and ARCH_BCM270x are built with OF now.
+Enable Device Tree support for all architectures.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+mmc: bcm2835-mmc: fix probe error handling
+
+Probe error handling is broken in several places.
+Simplify error handling by using device managed functions.
+Replace pr_{err,info} with dev_{err,info}.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+bcm2835-mmc: Add locks when accessing sdhost registers
+
+bcm2835-mmc: Add range of debug options for slowing things down
+
+bcm2835-mmc: Add option to disable some delays
+
+bcm2835-mmc: Add option to disable MMC_QUIRK_BLK_NO_CMD23
+
+bcm2835-mmc: Default to disabling MMC_QUIRK_BLK_NO_CMD23
+
+bcm2835-mmc: Adding overclocking option
+
+Allow a different clock speed to be substitued for a requested 50MHz.
+This option is exposed using the "overclock_50" DT parameter.
+Note that the mmc interface is restricted to EVEN integer divisions of
+250MHz, and the highest sensible option is 63 (250/4 = 62.5), the
+next being 125 (250/2) which is much too high.
+
+Use at your own risk.
+
+bcm2835-mmc: Round up the overclock, so 62 works for 62.5Mhz
+
+Also only warn once for each overclock setting.
+
+mmc: bcm2835-mmc: Make available on ARCH_BCM2835
+
+Make the bcm2835-mmc driver available for use on ARCH_BCM2835.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+BCM270x_DT: add bcm2835-mmc entry
+
+Add Device Tree entry for bcm2835-mmc.
+In non-DT mode, don't add the device in the board file.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+bcm2835-mmc: Don't overwrite MMC capabilities from DT
+
+bcm2835-mmc: Don't override bus width capabilities from devicetree
+
+Take out the force setting of the MMC_CAP_4_BIT_DATA host capability
+so that the result read from devicetree via mmc_of_parse() is
+preserved.
+
+bcm2835-mmc: Only claim one DMA channel
+
+With both MMC controllers enabled there are few DMA channels left. The
+bcm2835-mmc driver only uses DMA in one direction at a time, so it
+doesn't need to claim two channels.
+
+See: https://github.com/raspberrypi/linux/issues/1327
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-mmc: New timer API
+
+mmc: bcm2835-mmc: Support underclocking
+
+Support underclocking of the SD bus using the max-frequency DT property
+(which currently has no DT parameter). The sd_overclock parameter
+already provides another way to achieve the same thing which should be
+equivalent in end result, but it is a bug not to support max-frequency
+as well.
+
+See: https://github.com/raspberrypi/linux/issues/2350
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+mmc/bcm2835: Recover from MMC_SEND_EXT_CSD
+
+If the user issues an "mmc extcsd read", the SD controller receives
+what it thinks is a SEND_IF_COND command with an unexpected data block.
+The resulting operations leave the FSM stuck in READWAIT, a state which
+persists until the MMC framework resets the controller, by which point
+the root filesystem is likely to have been unmounted.
+
+A less heavyweight solution is to detect the condition and nudge the
+FSM by asserting the (self-clearing) FORCE_DATA_MODE bit.
+
+N.B. This workaround was essentially discovered by accident and without
+a full understanding the inner workings of the controller, so it is
+fortunate that the "fix" only modifies error paths.
+
+See: https://github.com/raspberrypi/linux/issues/2728
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-mmc: Fix DMA channel leak
+
+The BCM2835 MMC host driver requests a DMA channel on probe but neglects
+to release the channel in the probe error path and on driver unbind.
+
+I'm seeing this happen on every boot of the Compute Module 3: On first
+driver probe, DMA channel 2 is allocated and then leaked with a "could
+not get clk, deferring probe" message. On second driver probe, channel 4
+is allocated.
+
+Fix it.
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: Frank Pavlic <f.pavlic@kunbus.de>
+
+bcm2835-mmc: Fix struct mmc_host leak on probe
+
+The BCM2835 MMC host driver requests the bus address of the host's
+register map on probe.  If that fails, the driver leaks the struct
+mmc_host allocated earlier.
+
+Fix it.
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: Frank Pavlic <f.pavlic@kunbus.de>
+
+bcm2835-mmc: Fix duplicate free_irq() on remove
+
+The BCM2835 MMC host driver requests its interrupt as a device-managed
+resource, so the interrupt is automatically freed after the driver is
+unbound.
+
+However on driver unbind, bcm2835_mmc_remove() frees the interrupt
+explicitly to avoid invocation of the interrupt handler after driver
+structures have been torn down.
+
+The interrupt is thus freed twice, leading to a WARN splat in
+__free_irq().  Fix by not requesting the interrupt as a device-managed
+resource.
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: Frank Pavlic <f.pavlic@kunbus.de>
+
+bcm2835-mmc: Handle mmc_add_host() errors
+
+The BCM2835 MMC host driver calls mmc_add_host() but doesn't check its
+return value.  Errors occurring in that function are therefore not
+handled.  Fix it.
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: Frank Pavlic <f.pavlic@kunbus.de>
+
+bcm2835-mmc: Deduplicate reset of driver data on remove
+
+The BCM2835 MMC host driver sets the device's driver data pointer to
+NULL on ->remove() even though the driver core subsequently does the
+same in __device_release_driver().  Drop the duplicate assignment.
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: Frank Pavlic <f.pavlic@kunbus.de>
+
+bcm2835_mmc: Remove vestigial threaded IRQ
+
+With SDIO processing now managed by the MMC framework with a
+workqueue, the bcm2835_mmc driver no longer needs a threaded
+IRQ.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+Add missing dma_unmap_sg calls to free relevant swiotlb bounce buffers.
+This prevents DMA leaks.
+
+Signed-off-by: Yaroslav Rosomakho <yaroslavros@gmail.com>
+
+Limit max_req_size under arm64 (or any other platform that uses swiotlb) to prevent potential buffer overflow due to bouncing.
+
+Signed-off-by: Yaroslav Rosomakho <yaroslavros@gmail.com>
+
+mmc: sdhci: Silence MMC warnings
+
+When the MMC isn't plugged in, the driver will spam the console which is
+pretty annoying when using NFS.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+
+mmc: sdhci-iproc: Fix vmmc regulators on iProc
+
+The Linux support for controlling card power via regulators appears to
+be contentious. I would argue that the default behaviour is contrary to
+the SDHCI spec - turning off the power writes a reserved value to the
+SD Bus Voltage Select field of the Power Control Register, which
+seems to kill the Arasan/iProc controller - but fortunately there is a
+hook in sdhci_ops to override the behaviour. Borrow the implementation
+from sdhci_arasan_set_power.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-mmc: uninitialized_var is no more
+
+Revert "mmc: sdhci-iproc: Fix vmmc regulators on iProc"
+
+This reverts commit aed19399a01733dbad9be8bf026a4f7dd823b04f.
+
+Commit 6c92ae1e452f ("mmc: sdhci: Introduce sdhci_set_power_and_bus_voltage()")
+introduced a generic helper that does the same thing so use that instead in
+the following commit.
+
+Signed-off-by: Juerg Haefliger <juergh@canonical.com>
+
+mmc: sdhci-iproc: Fix vmmc regulators (pre-bcm2711)
+
+The Linux support for controlling card power via regulators appears to
+be contentious. I would argue that the default behaviour is contrary to
+the SDHCI spec - turning off the power writes a reserved value to the
+SD Bus Voltage Select field of the Power Control Register, which
+seems to kill the Arasan/iProc controller - but fortunately there is a
+hook in sdhci_ops to override the behaviour.
+
+Signed-off-by: Juerg Haefliger <juergh@canonical.com>
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/mmc/core/block.c       |   31 +-
+ drivers/mmc/core/core.c        |    3 +-
+ drivers/mmc/core/quirks.h      |    8 +
+ drivers/mmc/host/Kconfig       |   29 +
+ drivers/mmc/host/Makefile      |    1 +
+ drivers/mmc/host/bcm2835-mmc.c | 1575 ++++++++++++++++++++++++++++++++
+ drivers/mmc/host/sdhci-iproc.c |    1 +
+ drivers/mmc/host/sdhci.c       |    6 +-
+ include/linux/mmc/card.h       |    2 +
+ 9 files changed, 1651 insertions(+), 5 deletions(-)
+ create mode 100644 drivers/mmc/host/bcm2835-mmc.c
+
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -173,6 +173,13 @@ static DEFINE_MUTEX(open_lock);
+ module_param(perdev_minors, int, 0444);
+ MODULE_PARM_DESC(perdev_minors, "Minors numbers to allocate per device");
+ 
++/*
++ * Allow quirks to be overridden for the current card
++ */
++static char *card_quirks;
++module_param(card_quirks, charp, 0644);
++MODULE_PARM_DESC(card_quirks, "Force the use of the indicated quirks (a bitfield)");
++
+ static inline int mmc_blk_part_switch(struct mmc_card *card,
+ 				      unsigned int part_type);
+ static void mmc_blk_rw_rq_prep(struct mmc_queue_req *mqrq,
+@@ -2969,6 +2976,8 @@ static int mmc_blk_probe(struct mmc_card
+ {
+ 	struct mmc_blk_data *md;
+ 	int ret = 0;
++	char quirk_str[24];
++	char cap_str[10];
+ 
+ 	/*
+ 	 * Check that the card supports the command class(es) we need.
+@@ -2976,7 +2985,16 @@ static int mmc_blk_probe(struct mmc_card
+ 	if (!(card->csd.cmdclass & CCC_BLOCK_READ))
+ 		return -ENODEV;
+ 
+-	mmc_fixup_device(card, mmc_blk_fixups);
++	if (card_quirks) {
++		unsigned long quirks;
++		if (kstrtoul(card_quirks, 0, &quirks) == 0)
++			card->quirks = (unsigned int)quirks;
++		else
++			pr_err("mmc_block: Invalid card_quirks parameter '%s'\n",
++			       card_quirks);
++	}
++	else
++		mmc_fixup_device(card, mmc_blk_fixups);
+ 
+ 	card->complete_wq = alloc_workqueue("mmc_complete",
+ 					WQ_MEM_RECLAIM | WQ_HIGHPRI, 0);
+@@ -2991,6 +3009,17 @@ static int mmc_blk_probe(struct mmc_card
+ 		goto out_free;
+ 	}
+ 
++	string_get_size((u64)get_capacity(md->disk), 512, STRING_UNITS_2,
++			cap_str, sizeof(cap_str));
++	if (card->quirks)
++		snprintf(quirk_str, sizeof(quirk_str),
++			 " (quirks 0x%08x)", card->quirks);
++	else
++		quirk_str[0] = '\0';
++	pr_info("%s: %s %s %s%s%s\n",
++		md->disk->disk_name, mmc_card_id(card), mmc_card_name(card),
++		cap_str, md->read_only ? " (ro)" : "", quirk_str);
++
+ 	ret = mmc_blk_alloc_parts(card, md);
+ 	if (ret)
+ 		goto out;
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -1814,7 +1814,8 @@ EXPORT_SYMBOL(mmc_erase);
+ 
+ int mmc_can_erase(struct mmc_card *card)
+ {
+-	if (card->csd.cmdclass & CCC_ERASE && card->erase_size)
++	if (card->csd.cmdclass & CCC_ERASE && card->erase_size &&
++	    !(card->quirks & MMC_QUIRK_ERASE_BROKEN))
+ 		return 1;
+ 	return 0;
+ }
+--- a/drivers/mmc/core/quirks.h
++++ b/drivers/mmc/core/quirks.h
+@@ -106,6 +106,14 @@ static const struct mmc_fixup __maybe_un
+ 	MMC_FIXUP(CID_NAME_ANY, CID_MANFID_SANDISK_SD, 0x5344, add_quirk_sd,
+ 		  MMC_QUIRK_BROKEN_SD_DISCARD),
+ 
++	/*
++	 *  On some Kingston SD cards, multiple erases of less than 64
++	 *  sectors can cause corruption.
++	 */
++	MMC_FIXUP("SD16G", 0x41, 0x3432, add_quirk, MMC_QUIRK_ERASE_BROKEN),
++	MMC_FIXUP("SD32G", 0x41, 0x3432, add_quirk, MMC_QUIRK_ERASE_BROKEN),
++	MMC_FIXUP("SD64G", 0x41, 0x3432, add_quirk, MMC_QUIRK_ERASE_BROKEN),
++
+ 	END_FIXUP
+ };
+ 
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -5,6 +5,35 @@
+ 
+ comment "MMC/SD/SDIO Host Controller Drivers"
+ 
++config MMC_BCM2835_MMC
++	tristate "MMC support on BCM2835"
++	depends on MACH_BCM2708 || MACH_BCM2709 || ARCH_BCM2835
++	help
++	  This selects the MMC Interface on BCM2835.
++
++	  If you have a controller with this interface, say Y or M here.
++
++	  If unsure, say N.
++
++config MMC_BCM2835_DMA
++	bool "DMA support on BCM2835 Arasan controller"
++	depends on MMC_BCM2835_MMC
++	help
++	  Enable DMA support on the Arasan SDHCI controller in Broadcom 2708
++	  based chips.
++
++	  If unsure, say N.
++
++config MMC_BCM2835_PIO_DMA_BARRIER
++	int "Block count limit for PIO transfers"
++	depends on MMC_BCM2835_MMC && MMC_BCM2835_DMA
++	range 0 256
++	default 2
++	help
++	  The inclusive limit in bytes under which PIO will be used instead of DMA
++
++	  If unsure, say 2 here.
++
+ config MMC_DEBUG
+ 	bool "MMC host drivers debugging"
+ 	depends on MMC != n
+--- a/drivers/mmc/host/Makefile
++++ b/drivers/mmc/host/Makefile
+@@ -22,6 +22,7 @@ obj-$(CONFIG_MMC_SDHCI_F_SDH30)	+= sdhci
+ obj-$(CONFIG_MMC_SDHCI_MILBEAUT)	+= sdhci-milbeaut.o
+ obj-$(CONFIG_MMC_SDHCI_SPEAR)	+= sdhci-spear.o
+ obj-$(CONFIG_MMC_SDHCI_AM654)	+= sdhci_am654.o
++obj-$(CONFIG_MMC_BCM2835_MMC)	+= bcm2835-mmc.o
+ obj-$(CONFIG_MMC_WBSD)		+= wbsd.o
+ obj-$(CONFIG_MMC_AU1X)		+= au1xmmc.o
+ obj-$(CONFIG_MMC_ALCOR)	+= alcor.o
+--- /dev/null
++++ b/drivers/mmc/host/bcm2835-mmc.c
+@@ -0,0 +1,1575 @@
++/*
++ * BCM2835 MMC host driver.
++ *
++ * Author:      Gellert Weisz <gellert@raspberrypi.org>
++ *              Copyright 2014
++ *
++ * Based on
++ *  sdhci-bcm2708.c by Broadcom
++ *  sdhci-bcm2835.c by Stephen Warren and Oleksandr Tymoshenko
++ *  sdhci.c and sdhci-pci.c by Pierre Ossman
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms and conditions of the GNU General Public License,
++ * version 2, as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
++ * more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#include <linux/delay.h>
++#include <linux/module.h>
++#include <linux/io.h>
++#include <linux/mmc/mmc.h>
++#include <linux/mmc/host.h>
++#include <linux/mmc/sd.h>
++#include <linux/scatterlist.h>
++#include <linux/of_address.h>
++#include <linux/of_irq.h>
++#include <linux/clk.h>
++#include <linux/platform_device.h>
++#include <linux/err.h>
++#include <linux/blkdev.h>
++#include <linux/dmaengine.h>
++#include <linux/dma-mapping.h>
++#include <linux/of_dma.h>
++#include <linux/swiotlb.h>
++
++#include "sdhci.h"
++
++
++#define DRIVER_NAME "mmc-bcm2835"
++
++#define DBG(f, x...) \
++pr_debug(DRIVER_NAME " [%s()]: " f, __func__, ## x)
++
++#ifndef CONFIG_MMC_BCM2835_DMA
++ #define FORCE_PIO
++#endif
++
++
++/* the inclusive limit in bytes under which PIO will be used instead of DMA */
++#ifdef CONFIG_MMC_BCM2835_PIO_DMA_BARRIER
++#define PIO_DMA_BARRIER CONFIG_MMC_BCM2835_PIO_DMA_BARRIER
++#else
++#define PIO_DMA_BARRIER 00
++#endif
++
++#define MIN_FREQ 400000
++#define TIMEOUT_VAL 0xE
++#define BCM2835_SDHCI_WRITE_DELAY(f)	(((2 * 1000000) / f) + 1)
++
++
++unsigned mmc_debug;
++unsigned mmc_debug2;
++
++struct bcm2835_host {
++	spinlock_t				lock;
++
++	void __iomem			*ioaddr;
++	u32						bus_addr;
++
++	struct mmc_host			*mmc;
++
++	u32						timeout;
++
++	int						clock;	/* Current clock speed */
++	u8						pwr;	/* Current voltage */
++
++	unsigned int			max_clk;		/* Max possible freq */
++	unsigned int			timeout_clk;	/* Timeout freq (KHz) */
++	unsigned int			clk_mul;		/* Clock Muliplier value */
++
++	struct tasklet_struct	finish_tasklet;		/* Tasklet structures */
++
++	struct timer_list		timer;			/* Timer for timeouts */
++
++	struct sg_mapping_iter	sg_miter;		/* SG state for PIO */
++	unsigned int			blocks;			/* remaining PIO blocks */
++
++	int						irq;			/* Device IRQ */
++
++
++	u32						ier;			/* cached registers */
++
++	struct mmc_request		*mrq;			/* Current request */
++	struct mmc_command		*cmd;			/* Current command */
++	struct mmc_data			*data;			/* Current data request */
++	unsigned int			data_early:1;		/* Data finished before cmd */
++
++	wait_queue_head_t		buf_ready_int;		/* Waitqueue for Buffer Read Ready interrupt */
++
++	u32						shadow;
++
++	/*DMA part*/
++	struct dma_chan			*dma_chan_rxtx;		/* DMA channel for reads and writes */
++	struct dma_slave_config		dma_cfg_rx;
++	struct dma_slave_config		dma_cfg_tx;
++	struct dma_async_tx_descriptor	*tx_desc;	/* descriptor */
++
++	bool					have_dma;
++	bool					use_dma;
++	bool					wait_for_dma;
++	/*end of DMA part*/
++
++	int						max_delay;	/* maximum length of time spent waiting */
++
++	int						flags;				/* Host attributes */
++#define SDHCI_REQ_USE_DMA	(1<<2)	/* Use DMA for this req. */
++#define SDHCI_DEVICE_DEAD	(1<<3)	/* Device unresponsive */
++#define SDHCI_AUTO_CMD12	(1<<6)	/* Auto CMD12 support */
++#define SDHCI_AUTO_CMD23	(1<<7)	/* Auto CMD23 support */
++#define SDHCI_SDIO_IRQ_ENABLED	(1<<9)	/* SDIO irq enabled */
++
++	u32				overclock_50;	/* frequency to use when 50MHz is requested (in MHz) */
++	u32				max_overclock;	/* Highest reported */
++};
++
++
++static inline void bcm2835_mmc_writel(struct bcm2835_host *host, u32 val, int reg, int from)
++{
++	unsigned delay;
++	lockdep_assert_held_once(&host->lock);
++	writel(val, host->ioaddr + reg);
++	udelay(BCM2835_SDHCI_WRITE_DELAY(max(host->clock, MIN_FREQ)));
++
++	delay = ((mmc_debug >> 16) & 0xf) << ((mmc_debug >> 20) & 0xf);
++	if (delay && !((1<<from) & mmc_debug2))
++		udelay(delay);
++}
++
++static inline void mmc_raw_writel(struct bcm2835_host *host, u32 val, int reg)
++{
++	unsigned delay;
++	lockdep_assert_held_once(&host->lock);
++	writel(val, host->ioaddr + reg);
++
++	delay = ((mmc_debug >> 24) & 0xf) << ((mmc_debug >> 28) & 0xf);
++	if (delay)
++		udelay(delay);
++}
++
++static inline u32 bcm2835_mmc_readl(struct bcm2835_host *host, int reg)
++{
++	lockdep_assert_held_once(&host->lock);
++	return readl(host->ioaddr + reg);
++}
++
++static inline void bcm2835_mmc_writew(struct bcm2835_host *host, u16 val, int reg)
++{
++	u32 oldval = (reg == SDHCI_COMMAND) ? host->shadow :
++		bcm2835_mmc_readl(host, reg & ~3);
++	u32 word_num = (reg >> 1) & 1;
++	u32 word_shift = word_num * 16;
++	u32 mask = 0xffff << word_shift;
++	u32 newval = (oldval & ~mask) | (val << word_shift);
++
++	if (reg == SDHCI_TRANSFER_MODE)
++		host->shadow = newval;
++	else
++		bcm2835_mmc_writel(host, newval, reg & ~3, 0);
++
++}
++
++static inline void bcm2835_mmc_writeb(struct bcm2835_host *host, u8 val, int reg)
++{
++	u32 oldval = bcm2835_mmc_readl(host, reg & ~3);
++	u32 byte_num = reg & 3;
++	u32 byte_shift = byte_num * 8;
++	u32 mask = 0xff << byte_shift;
++	u32 newval = (oldval & ~mask) | (val << byte_shift);
++
++	bcm2835_mmc_writel(host, newval, reg & ~3, 1);
++}
++
++
++static inline u16 bcm2835_mmc_readw(struct bcm2835_host *host, int reg)
++{
++	u32 val = bcm2835_mmc_readl(host, (reg & ~3));
++	u32 word_num = (reg >> 1) & 1;
++	u32 word_shift = word_num * 16;
++	u32 word = (val >> word_shift) & 0xffff;
++
++	return word;
++}
++
++static inline u8 bcm2835_mmc_readb(struct bcm2835_host *host, int reg)
++{
++	u32 val = bcm2835_mmc_readl(host, (reg & ~3));
++	u32 byte_num = reg & 3;
++	u32 byte_shift = byte_num * 8;
++	u32 byte = (val >> byte_shift) & 0xff;
++
++	return byte;
++}
++
++static void bcm2835_mmc_unsignal_irqs(struct bcm2835_host *host, u32 clear)
++{
++	u32 ier;
++
++	ier = bcm2835_mmc_readl(host, SDHCI_SIGNAL_ENABLE);
++	ier &= ~clear;
++	/* change which requests generate IRQs - makes no difference to
++	   the content of SDHCI_INT_STATUS, or the need to acknowledge IRQs */
++	bcm2835_mmc_writel(host, ier, SDHCI_SIGNAL_ENABLE, 2);
++}
++
++
++static void bcm2835_mmc_dumpregs(struct bcm2835_host *host)
++{
++	pr_debug(DRIVER_NAME ": =========== REGISTER DUMP (%s)===========\n",
++		mmc_hostname(host->mmc));
++
++	pr_debug(DRIVER_NAME ": Sys addr: 0x%08x | Version:  0x%08x\n",
++		bcm2835_mmc_readl(host, SDHCI_DMA_ADDRESS),
++		bcm2835_mmc_readw(host, SDHCI_HOST_VERSION));
++	pr_debug(DRIVER_NAME ": Blk size: 0x%08x | Blk cnt:  0x%08x\n",
++		bcm2835_mmc_readw(host, SDHCI_BLOCK_SIZE),
++		bcm2835_mmc_readw(host, SDHCI_BLOCK_COUNT));
++	pr_debug(DRIVER_NAME ": Argument: 0x%08x | Trn mode: 0x%08x\n",
++		bcm2835_mmc_readl(host, SDHCI_ARGUMENT),
++		bcm2835_mmc_readw(host, SDHCI_TRANSFER_MODE));
++	pr_debug(DRIVER_NAME ": Present:  0x%08x | Host ctl: 0x%08x\n",
++		bcm2835_mmc_readl(host, SDHCI_PRESENT_STATE),
++		bcm2835_mmc_readb(host, SDHCI_HOST_CONTROL));
++	pr_debug(DRIVER_NAME ": Power:    0x%08x | Blk gap:  0x%08x\n",
++		bcm2835_mmc_readb(host, SDHCI_POWER_CONTROL),
++		bcm2835_mmc_readb(host, SDHCI_BLOCK_GAP_CONTROL));
++	pr_debug(DRIVER_NAME ": Wake-up:  0x%08x | Clock:    0x%08x\n",
++		bcm2835_mmc_readb(host, SDHCI_WAKE_UP_CONTROL),
++		bcm2835_mmc_readw(host, SDHCI_CLOCK_CONTROL));
++	pr_debug(DRIVER_NAME ": Timeout:  0x%08x | Int stat: 0x%08x\n",
++		bcm2835_mmc_readb(host, SDHCI_TIMEOUT_CONTROL),
++		bcm2835_mmc_readl(host, SDHCI_INT_STATUS));
++	pr_debug(DRIVER_NAME ": Int enab: 0x%08x | Sig enab: 0x%08x\n",
++		bcm2835_mmc_readl(host, SDHCI_INT_ENABLE),
++		bcm2835_mmc_readl(host, SDHCI_SIGNAL_ENABLE));
++	pr_debug(DRIVER_NAME ": AC12 err: 0x%08x | Slot int: 0x%08x\n",
++		bcm2835_mmc_readw(host, SDHCI_AUTO_CMD_STATUS),
++		bcm2835_mmc_readw(host, SDHCI_SLOT_INT_STATUS));
++	pr_debug(DRIVER_NAME ": Caps:     0x%08x | Caps_1:   0x%08x\n",
++		bcm2835_mmc_readl(host, SDHCI_CAPABILITIES),
++		bcm2835_mmc_readl(host, SDHCI_CAPABILITIES_1));
++	pr_debug(DRIVER_NAME ": Cmd:      0x%08x | Max curr: 0x%08x\n",
++		bcm2835_mmc_readw(host, SDHCI_COMMAND),
++		bcm2835_mmc_readl(host, SDHCI_MAX_CURRENT));
++	pr_debug(DRIVER_NAME ": Host ctl2: 0x%08x\n",
++		bcm2835_mmc_readw(host, SDHCI_HOST_CONTROL2));
++
++	pr_debug(DRIVER_NAME ": ===========================================\n");
++}
++
++
++static void bcm2835_mmc_reset(struct bcm2835_host *host, u8 mask)
++{
++	unsigned long timeout;
++	unsigned long flags;
++
++	spin_lock_irqsave(&host->lock, flags);
++	bcm2835_mmc_writeb(host, mask, SDHCI_SOFTWARE_RESET);
++
++	if (mask & SDHCI_RESET_ALL)
++		host->clock = 0;
++
++	/* Wait max 100 ms */
++	timeout = 100;
++
++	/* hw clears the bit when it's done */
++	while (bcm2835_mmc_readb(host, SDHCI_SOFTWARE_RESET) & mask) {
++		if (timeout == 0) {
++			pr_err("%s: Reset 0x%x never completed.\n",
++				mmc_hostname(host->mmc), (int)mask);
++			bcm2835_mmc_dumpregs(host);
++			return;
++		}
++		timeout--;
++		spin_unlock_irqrestore(&host->lock, flags);
++		mdelay(1);
++		spin_lock_irqsave(&host->lock, flags);
++	}
++
++	if (100-timeout > 10 && 100-timeout > host->max_delay) {
++		host->max_delay = 100-timeout;
++		pr_warn("Warning: MMC controller hung for %d ms\n", host->max_delay);
++	}
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++static void bcm2835_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios);
++
++static void bcm2835_mmc_init(struct bcm2835_host *host, int soft)
++{
++	unsigned long flags;
++	if (soft)
++		bcm2835_mmc_reset(host, SDHCI_RESET_CMD|SDHCI_RESET_DATA);
++	else
++		bcm2835_mmc_reset(host, SDHCI_RESET_ALL);
++
++	host->ier = SDHCI_INT_BUS_POWER | SDHCI_INT_DATA_END_BIT |
++		    SDHCI_INT_DATA_CRC | SDHCI_INT_DATA_TIMEOUT |
++		    SDHCI_INT_INDEX | SDHCI_INT_END_BIT | SDHCI_INT_CRC |
++		    SDHCI_INT_TIMEOUT | SDHCI_INT_DATA_END |
++		    SDHCI_INT_RESPONSE;
++
++	spin_lock_irqsave(&host->lock, flags);
++	bcm2835_mmc_writel(host, host->ier, SDHCI_INT_ENABLE, 3);
++	bcm2835_mmc_writel(host, host->ier, SDHCI_SIGNAL_ENABLE, 3);
++	spin_unlock_irqrestore(&host->lock, flags);
++
++	if (soft) {
++		/* force clock reconfiguration */
++		host->clock = 0;
++		bcm2835_mmc_set_ios(host->mmc, &host->mmc->ios);
++	}
++}
++
++
++
++static void bcm2835_mmc_finish_data(struct bcm2835_host *host);
++
++static void bcm2835_mmc_dma_complete(void *param)
++{
++	struct bcm2835_host *host = param;
++	struct dma_chan *dma_chan;
++	unsigned long flags;
++	u32 dir_data;
++
++	spin_lock_irqsave(&host->lock, flags);
++
++	host->use_dma = false;
++
++	if (host->data) {
++		dma_chan = host->dma_chan_rxtx;
++		if (host->data->flags & MMC_DATA_WRITE)
++			dir_data = DMA_TO_DEVICE;
++		else
++			dir_data = DMA_FROM_DEVICE;
++		dma_unmap_sg(dma_chan->device->dev,
++		     host->data->sg, host->data->sg_len,
++		     dir_data);
++		if (! (host->data->flags & MMC_DATA_WRITE))
++			bcm2835_mmc_finish_data(host);
++	} else if (host->wait_for_dma) {
++		host->wait_for_dma = false;
++		tasklet_schedule(&host->finish_tasklet);
++	}
++
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++static void bcm2835_bcm2835_mmc_read_block_pio(struct bcm2835_host *host)
++{
++	unsigned long flags;
++	size_t blksize, len, chunk;
++
++	u32 scratch = 0;
++	u8 *buf;
++
++	blksize = host->data->blksz;
++	chunk = 0;
++
++	local_irq_save(flags);
++
++	while (blksize) {
++		if (!sg_miter_next(&host->sg_miter))
++			BUG();
++
++		len = min(host->sg_miter.length, blksize);
++
++		blksize -= len;
++		host->sg_miter.consumed = len;
++
++		buf = host->sg_miter.addr;
++
++		while (len) {
++			if (chunk == 0) {
++				scratch = bcm2835_mmc_readl(host, SDHCI_BUFFER);
++				chunk = 4;
++			}
++
++			*buf = scratch & 0xFF;
++
++			buf++;
++			scratch >>= 8;
++			chunk--;
++			len--;
++		}
++	}
++
++	sg_miter_stop(&host->sg_miter);
++
++	local_irq_restore(flags);
++}
++
++static void bcm2835_bcm2835_mmc_write_block_pio(struct bcm2835_host *host)
++{
++	unsigned long flags;
++	size_t blksize, len, chunk;
++	u32 scratch;
++	u8 *buf;
++
++	blksize = host->data->blksz;
++	chunk = 0;
++	chunk = 0;
++	scratch = 0;
++
++	local_irq_save(flags);
++
++	while (blksize) {
++		if (!sg_miter_next(&host->sg_miter))
++			BUG();
++
++		len = min(host->sg_miter.length, blksize);
++
++		blksize -= len;
++		host->sg_miter.consumed = len;
++
++		buf = host->sg_miter.addr;
++
++		while (len) {
++			scratch |= (u32)*buf << (chunk * 8);
++
++			buf++;
++			chunk++;
++			len--;
++
++			if ((chunk == 4) || ((len == 0) && (blksize == 0))) {
++				mmc_raw_writel(host, scratch, SDHCI_BUFFER);
++				chunk = 0;
++				scratch = 0;
++			}
++		}
++	}
++
++	sg_miter_stop(&host->sg_miter);
++
++	local_irq_restore(flags);
++}
++
++
++static void bcm2835_mmc_transfer_pio(struct bcm2835_host *host)
++{
++	u32 mask;
++
++	BUG_ON(!host->data);
++
++	if (host->blocks == 0)
++		return;
++
++	if (host->data->flags & MMC_DATA_READ)
++		mask = SDHCI_DATA_AVAILABLE;
++	else
++		mask = SDHCI_SPACE_AVAILABLE;
++
++	while (bcm2835_mmc_readl(host, SDHCI_PRESENT_STATE) & mask) {
++
++		if (host->data->flags & MMC_DATA_READ)
++			bcm2835_bcm2835_mmc_read_block_pio(host);
++		else
++			bcm2835_bcm2835_mmc_write_block_pio(host);
++
++		host->blocks--;
++
++		/* QUIRK used in sdhci.c removes the 'if' */
++		/* but it seems this is unnecessary */
++		if (host->blocks == 0)
++			break;
++
++
++	}
++}
++
++
++static void bcm2835_mmc_transfer_dma(struct bcm2835_host *host)
++{
++	u32 len, dir_data, dir_slave;
++	struct dma_async_tx_descriptor *desc = NULL;
++	struct dma_chan *dma_chan;
++
++
++	WARN_ON(!host->data);
++
++	if (!host->data)
++		return;
++
++	if (host->blocks == 0)
++		return;
++
++	dma_chan = host->dma_chan_rxtx;
++	if (host->data->flags & MMC_DATA_READ) {
++		dir_data = DMA_FROM_DEVICE;
++		dir_slave = DMA_DEV_TO_MEM;
++	} else {
++		dir_data = DMA_TO_DEVICE;
++		dir_slave = DMA_MEM_TO_DEV;
++	}
++
++	/* The parameters have already been validated, so this will not fail */
++	(void)dmaengine_slave_config(dma_chan,
++				     (dir_data == DMA_FROM_DEVICE) ?
++				     &host->dma_cfg_rx :
++				     &host->dma_cfg_tx);
++
++	BUG_ON(!dma_chan->device);
++	BUG_ON(!dma_chan->device->dev);
++	BUG_ON(!host->data->sg);
++
++	len = dma_map_sg(dma_chan->device->dev, host->data->sg,
++			 host->data->sg_len, dir_data);
++	if (len > 0) {
++		desc = dmaengine_prep_slave_sg(dma_chan, host->data->sg,
++					       len, dir_slave,
++					       DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
++	} else {
++		dev_err(mmc_dev(host->mmc), "dma_map_sg returned zero length\n");
++	}
++	if (desc) {
++		unsigned long flags;
++		spin_lock_irqsave(&host->lock, flags);
++		bcm2835_mmc_unsignal_irqs(host, SDHCI_INT_DATA_AVAIL |
++						    SDHCI_INT_SPACE_AVAIL);
++		host->tx_desc = desc;
++		desc->callback = bcm2835_mmc_dma_complete;
++		desc->callback_param = host;
++		spin_unlock_irqrestore(&host->lock, flags);
++		dmaengine_submit(desc);
++		dma_async_issue_pending(dma_chan);
++	} else {
++		dma_unmap_sg(dma_chan->device->dev, host->data->sg, len, dir_data);
++	}
++
++}
++
++
++
++static void bcm2835_mmc_set_transfer_irqs(struct bcm2835_host *host)
++{
++	u32 pio_irqs = SDHCI_INT_DATA_AVAIL | SDHCI_INT_SPACE_AVAIL;
++	u32 dma_irqs = SDHCI_INT_DMA_END | SDHCI_INT_ADMA_ERROR;
++
++	if (host->use_dma)
++		host->ier = (host->ier & ~pio_irqs) | dma_irqs;
++	else
++		host->ier = (host->ier & ~dma_irqs) | pio_irqs;
++
++	bcm2835_mmc_writel(host, host->ier, SDHCI_INT_ENABLE, 4);
++	bcm2835_mmc_writel(host, host->ier, SDHCI_SIGNAL_ENABLE, 4);
++}
++
++
++static void bcm2835_mmc_prepare_data(struct bcm2835_host *host, struct mmc_command *cmd)
++{
++	u8 count;
++	struct mmc_data *data = cmd->data;
++
++	WARN_ON(host->data);
++
++	if (data || (cmd->flags & MMC_RSP_BUSY)) {
++		count = TIMEOUT_VAL;
++		bcm2835_mmc_writeb(host, count, SDHCI_TIMEOUT_CONTROL);
++	}
++
++	if (!data)
++		return;
++
++	/* Sanity checks */
++	BUG_ON(data->blksz * data->blocks > 524288);
++	BUG_ON(data->blksz > host->mmc->max_blk_size);
++	BUG_ON(data->blocks > 65535);
++
++	host->data = data;
++	host->data_early = 0;
++	host->data->bytes_xfered = 0;
++
++
++	if (!(host->flags & SDHCI_REQ_USE_DMA)) {
++		int flags;
++
++		flags = SG_MITER_ATOMIC;
++		if (host->data->flags & MMC_DATA_READ)
++			flags |= SG_MITER_TO_SG;
++		else
++			flags |= SG_MITER_FROM_SG;
++		sg_miter_start(&host->sg_miter, data->sg, data->sg_len, flags);
++		host->blocks = data->blocks;
++	}
++
++	host->use_dma = host->have_dma && data->blocks > PIO_DMA_BARRIER;
++
++	bcm2835_mmc_set_transfer_irqs(host);
++
++	/* Set the DMA boundary value and block size */
++	bcm2835_mmc_writew(host, SDHCI_MAKE_BLKSZ(SDHCI_DEFAULT_BOUNDARY_ARG,
++		data->blksz), SDHCI_BLOCK_SIZE);
++	bcm2835_mmc_writew(host, data->blocks, SDHCI_BLOCK_COUNT);
++
++	BUG_ON(!host->data);
++}
++
++static void bcm2835_mmc_set_transfer_mode(struct bcm2835_host *host,
++	struct mmc_command *cmd)
++{
++	u16 mode;
++	struct mmc_data *data = cmd->data;
++
++	if (data == NULL) {
++		/* clear Auto CMD settings for no data CMDs */
++		mode = bcm2835_mmc_readw(host, SDHCI_TRANSFER_MODE);
++		bcm2835_mmc_writew(host, mode & ~(SDHCI_TRNS_AUTO_CMD12 |
++				SDHCI_TRNS_AUTO_CMD23), SDHCI_TRANSFER_MODE);
++		return;
++	}
++
++	WARN_ON(!host->data);
++
++	mode = SDHCI_TRNS_BLK_CNT_EN;
++
++	if ((mmc_op_multi(cmd->opcode) || data->blocks > 1)) {
++		mode |= SDHCI_TRNS_MULTI;
++
++		/*
++		 * If we are sending CMD23, CMD12 never gets sent
++		 * on successful completion (so no Auto-CMD12).
++		 */
++		if (!host->mrq->sbc && (host->flags & SDHCI_AUTO_CMD12))
++			mode |= SDHCI_TRNS_AUTO_CMD12;
++		else if (host->mrq->sbc && (host->flags & SDHCI_AUTO_CMD23)) {
++			mode |= SDHCI_TRNS_AUTO_CMD23;
++			bcm2835_mmc_writel(host, host->mrq->sbc->arg, SDHCI_ARGUMENT2, 5);
++		}
++	}
++
++	if (data->flags & MMC_DATA_READ)
++		mode |= SDHCI_TRNS_READ;
++	if (host->flags & SDHCI_REQ_USE_DMA)
++		mode |= SDHCI_TRNS_DMA;
++
++	bcm2835_mmc_writew(host, mode, SDHCI_TRANSFER_MODE);
++}
++
++void bcm2835_mmc_send_command(struct bcm2835_host *host, struct mmc_command *cmd)
++{
++	int flags;
++	u32 mask;
++	unsigned long timeout;
++
++	WARN_ON(host->cmd);
++
++	/* Wait max 10 ms */
++	timeout = 1000;
++
++	mask = SDHCI_CMD_INHIBIT;
++	if ((cmd->data != NULL) || (cmd->flags & MMC_RSP_BUSY))
++		mask |= SDHCI_DATA_INHIBIT;
++
++	/* We shouldn't wait for data inihibit for stop commands, even
++	   though they might use busy signaling */
++	if (host->mrq->data && (cmd == host->mrq->data->stop))
++		mask &= ~SDHCI_DATA_INHIBIT;
++
++	while (bcm2835_mmc_readl(host, SDHCI_PRESENT_STATE) & mask) {
++		if (timeout == 0) {
++			pr_err("%s: Controller never released inhibit bit(s).\n",
++				mmc_hostname(host->mmc));
++			bcm2835_mmc_dumpregs(host);
++			cmd->error = -EIO;
++			tasklet_schedule(&host->finish_tasklet);
++			return;
++		}
++		timeout--;
++		udelay(10);
++	}
++
++	if ((1000-timeout)/100 > 1 && (1000-timeout)/100 > host->max_delay) {
++		host->max_delay = (1000-timeout)/100;
++		pr_warn("Warning: MMC controller hung for %d ms\n", host->max_delay);
++	}
++
++	timeout = jiffies;
++	if (!cmd->data && cmd->busy_timeout > 9000)
++		timeout += DIV_ROUND_UP(cmd->busy_timeout, 1000) * HZ + HZ;
++	else
++		timeout += 10 * HZ;
++	mod_timer(&host->timer, timeout);
++
++	host->cmd = cmd;
++	host->use_dma = false;
++
++	bcm2835_mmc_prepare_data(host, cmd);
++
++	bcm2835_mmc_writel(host, cmd->arg, SDHCI_ARGUMENT, 6);
++
++	bcm2835_mmc_set_transfer_mode(host, cmd);
++
++	if ((cmd->flags & MMC_RSP_136) && (cmd->flags & MMC_RSP_BUSY)) {
++		pr_err("%s: Unsupported response type!\n",
++			mmc_hostname(host->mmc));
++		cmd->error = -EINVAL;
++		tasklet_schedule(&host->finish_tasklet);
++		return;
++	}
++
++	if (!(cmd->flags & MMC_RSP_PRESENT))
++		flags = SDHCI_CMD_RESP_NONE;
++	else if (cmd->flags & MMC_RSP_136)
++		flags = SDHCI_CMD_RESP_LONG;
++	else if (cmd->flags & MMC_RSP_BUSY)
++		flags = SDHCI_CMD_RESP_SHORT_BUSY;
++	else
++		flags = SDHCI_CMD_RESP_SHORT;
++
++	if (cmd->flags & MMC_RSP_CRC)
++		flags |= SDHCI_CMD_CRC;
++	if (cmd->flags & MMC_RSP_OPCODE)
++		flags |= SDHCI_CMD_INDEX;
++
++	if (cmd->data)
++		flags |= SDHCI_CMD_DATA;
++
++	bcm2835_mmc_writew(host, SDHCI_MAKE_CMD(cmd->opcode, flags), SDHCI_COMMAND);
++}
++
++
++static void bcm2835_mmc_finish_data(struct bcm2835_host *host)
++{
++	struct mmc_data *data;
++
++	BUG_ON(!host->data);
++
++	data = host->data;
++	host->data = NULL;
++
++	if (data->error)
++		data->bytes_xfered = 0;
++	else
++		data->bytes_xfered = data->blksz * data->blocks;
++
++	/*
++	 * Need to send CMD12 if -
++	 * a) open-ended multiblock transfer (no CMD23)
++	 * b) error in multiblock transfer
++	 */
++	if (data->stop &&
++	    (data->error ||
++	     !host->mrq->sbc)) {
++
++		/*
++		 * The controller needs a reset of internal state machines
++		 * upon error conditions.
++		 */
++		if (data->error) {
++			bcm2835_mmc_reset(host, SDHCI_RESET_CMD);
++			bcm2835_mmc_reset(host, SDHCI_RESET_DATA);
++		}
++
++		bcm2835_mmc_send_command(host, data->stop);
++	} else if (host->use_dma) {
++		host->wait_for_dma = true;
++	} else {
++		tasklet_schedule(&host->finish_tasklet);
++	}
++}
++
++static void bcm2835_mmc_finish_command(struct bcm2835_host *host)
++{
++	int i;
++
++	BUG_ON(host->cmd == NULL);
++
++	if (host->cmd->flags & MMC_RSP_PRESENT) {
++		if (host->cmd->flags & MMC_RSP_136) {
++			/* CRC is stripped so we need to do some shifting. */
++			for (i = 0; i < 4; i++) {
++				host->cmd->resp[i] = bcm2835_mmc_readl(host,
++					SDHCI_RESPONSE + (3-i)*4) << 8;
++				if (i != 3)
++					host->cmd->resp[i] |=
++						bcm2835_mmc_readb(host,
++						SDHCI_RESPONSE + (3-i)*4-1);
++			}
++		} else {
++			host->cmd->resp[0] = bcm2835_mmc_readl(host, SDHCI_RESPONSE);
++		}
++	}
++
++	host->cmd->error = 0;
++
++	/* Finished CMD23, now send actual command. */
++	if (host->cmd == host->mrq->sbc) {
++		host->cmd = NULL;
++		bcm2835_mmc_send_command(host, host->mrq->cmd);
++
++		if (host->mrq->cmd->data && host->use_dma) {
++			/* DMA transfer starts now, PIO starts after interrupt */
++			bcm2835_mmc_transfer_dma(host);
++		}
++	} else {
++
++		/* Processed actual command. */
++		if (host->data && host->data_early)
++			bcm2835_mmc_finish_data(host);
++
++		if (!host->cmd->data)
++			tasklet_schedule(&host->finish_tasklet);
++
++		host->cmd = NULL;
++	}
++}
++
++
++static void bcm2835_mmc_timeout_timer(struct timer_list *t)
++{
++	struct bcm2835_host *host = from_timer(host, t, timer);
++	unsigned long flags;
++
++	spin_lock_irqsave(&host->lock, flags);
++
++	if (host->mrq) {
++		pr_err("%s: Timeout waiting for hardware interrupt.\n",
++			mmc_hostname(host->mmc));
++		bcm2835_mmc_dumpregs(host);
++
++		if (host->data) {
++			host->data->error = -ETIMEDOUT;
++			bcm2835_mmc_finish_data(host);
++		} else {
++			if (host->cmd)
++				host->cmd->error = -ETIMEDOUT;
++			else
++				host->mrq->cmd->error = -ETIMEDOUT;
++
++			tasklet_schedule(&host->finish_tasklet);
++		}
++	}
++
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++
++static void bcm2835_mmc_enable_sdio_irq_nolock(struct bcm2835_host *host, int enable)
++{
++	if (!(host->flags & SDHCI_DEVICE_DEAD)) {
++		if (enable)
++			host->ier |= SDHCI_INT_CARD_INT;
++		else
++			host->ier &= ~SDHCI_INT_CARD_INT;
++
++		bcm2835_mmc_writel(host, host->ier, SDHCI_INT_ENABLE, 7);
++		bcm2835_mmc_writel(host, host->ier, SDHCI_SIGNAL_ENABLE, 7);
++	}
++}
++
++static void bcm2835_mmc_enable_sdio_irq(struct mmc_host *mmc, int enable)
++{
++	struct bcm2835_host *host = mmc_priv(mmc);
++	unsigned long flags;
++
++	spin_lock_irqsave(&host->lock, flags);
++	if (enable)
++		host->flags |= SDHCI_SDIO_IRQ_ENABLED;
++	else
++		host->flags &= ~SDHCI_SDIO_IRQ_ENABLED;
++
++	bcm2835_mmc_enable_sdio_irq_nolock(host, enable);
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++static void bcm2835_mmc_cmd_irq(struct bcm2835_host *host, u32 intmask)
++{
++
++	BUG_ON(intmask == 0);
++
++	if (!host->cmd) {
++		pr_err("%s: Got command interrupt 0x%08x even "
++			"though no command operation was in progress.\n",
++			mmc_hostname(host->mmc), (unsigned)intmask);
++		bcm2835_mmc_dumpregs(host);
++		return;
++	}
++
++	if (intmask & SDHCI_INT_TIMEOUT)
++		host->cmd->error = -ETIMEDOUT;
++	else if (intmask & (SDHCI_INT_CRC | SDHCI_INT_END_BIT |
++			SDHCI_INT_INDEX)) {
++			host->cmd->error = -EILSEQ;
++	}
++
++	if (host->cmd->error) {
++		tasklet_schedule(&host->finish_tasklet);
++		return;
++	}
++
++	if (intmask & SDHCI_INT_RESPONSE)
++		bcm2835_mmc_finish_command(host);
++
++}
++
++static void bcm2835_mmc_data_irq(struct bcm2835_host *host, u32 intmask)
++{
++	struct dma_chan *dma_chan;
++	u32 dir_data;
++
++	BUG_ON(intmask == 0);
++
++	if (!host->data) {
++		/*
++		 * The "data complete" interrupt is also used to
++		 * indicate that a busy state has ended. See comment
++		 * above in sdhci_cmd_irq().
++		 */
++		if (host->cmd && (host->cmd->flags & MMC_RSP_BUSY)) {
++			if (intmask & SDHCI_INT_DATA_END) {
++				bcm2835_mmc_finish_command(host);
++				return;
++			}
++		}
++
++		pr_debug("%s: Got data interrupt 0x%08x even "
++			"though no data operation was in progress.\n",
++			mmc_hostname(host->mmc), (unsigned)intmask);
++		bcm2835_mmc_dumpregs(host);
++
++		return;
++	}
++
++	if (intmask & SDHCI_INT_DATA_TIMEOUT)
++		host->data->error = -ETIMEDOUT;
++	else if (intmask & SDHCI_INT_DATA_END_BIT)
++		host->data->error = -EILSEQ;
++	else if ((intmask & SDHCI_INT_DATA_CRC) &&
++		SDHCI_GET_CMD(bcm2835_mmc_readw(host, SDHCI_COMMAND))
++			!= MMC_BUS_TEST_R)
++		host->data->error = -EILSEQ;
++
++	if (host->use_dma) {
++		if  (host->data->flags & MMC_DATA_WRITE) {
++			/* IRQ handled here */
++
++			dma_chan = host->dma_chan_rxtx;
++			dir_data = DMA_TO_DEVICE;
++			dma_unmap_sg(dma_chan->device->dev,
++				 host->data->sg, host->data->sg_len,
++				 dir_data);
++
++			bcm2835_mmc_finish_data(host);
++		}
++
++	} else {
++		if (host->data->error)
++			bcm2835_mmc_finish_data(host);
++		else {
++			if (intmask & (SDHCI_INT_DATA_AVAIL | SDHCI_INT_SPACE_AVAIL))
++				bcm2835_mmc_transfer_pio(host);
++
++			if (intmask & SDHCI_INT_DATA_END) {
++				if (host->cmd) {
++					/*
++					 * Data managed to finish before the
++					 * command completed. Make sure we do
++					 * things in the proper order.
++					 */
++					host->data_early = 1;
++				} else {
++					bcm2835_mmc_finish_data(host);
++				}
++			}
++		}
++	}
++}
++
++
++static irqreturn_t bcm2835_mmc_irq(int irq, void *dev_id)
++{
++	irqreturn_t result = IRQ_NONE;
++	struct bcm2835_host *host = dev_id;
++	u32 intmask, mask, unexpected = 0;
++	int max_loops = 16;
++
++	spin_lock(&host->lock);
++
++	intmask = bcm2835_mmc_readl(host, SDHCI_INT_STATUS);
++
++	if (!intmask || intmask == 0xffffffff) {
++		result = IRQ_NONE;
++		goto out;
++	}
++
++	do {
++		/* Clear selected interrupts. */
++		mask = intmask & (SDHCI_INT_CMD_MASK | SDHCI_INT_DATA_MASK |
++				  SDHCI_INT_BUS_POWER);
++		bcm2835_mmc_writel(host, mask, SDHCI_INT_STATUS, 8);
++
++
++		if (intmask & SDHCI_INT_CMD_MASK)
++			bcm2835_mmc_cmd_irq(host, intmask & SDHCI_INT_CMD_MASK);
++
++		if (intmask & SDHCI_INT_DATA_MASK)
++			bcm2835_mmc_data_irq(host, intmask & SDHCI_INT_DATA_MASK);
++
++		if (intmask & SDHCI_INT_BUS_POWER)
++			pr_err("%s: Card is consuming too much power!\n",
++				mmc_hostname(host->mmc));
++
++		if (intmask & SDHCI_INT_CARD_INT) {
++			bcm2835_mmc_enable_sdio_irq_nolock(host, false);
++			sdio_signal_irq(host->mmc);
++		}
++
++		intmask &= ~(SDHCI_INT_CARD_INSERT | SDHCI_INT_CARD_REMOVE |
++			     SDHCI_INT_CMD_MASK | SDHCI_INT_DATA_MASK |
++			     SDHCI_INT_ERROR | SDHCI_INT_BUS_POWER |
++			     SDHCI_INT_CARD_INT);
++
++		if (intmask) {
++			unexpected |= intmask;
++			bcm2835_mmc_writel(host, intmask, SDHCI_INT_STATUS, 9);
++		}
++
++		if (result == IRQ_NONE)
++			result = IRQ_HANDLED;
++
++		intmask = bcm2835_mmc_readl(host, SDHCI_INT_STATUS);
++	} while (intmask && --max_loops);
++out:
++	spin_unlock(&host->lock);
++
++	if (unexpected) {
++		pr_err("%s: Unexpected interrupt 0x%08x.\n",
++			   mmc_hostname(host->mmc), unexpected);
++		bcm2835_mmc_dumpregs(host);
++	}
++
++	return result;
++}
++
++
++static void bcm2835_mmc_ack_sdio_irq(struct mmc_host *mmc)
++{
++	struct bcm2835_host *host = mmc_priv(mmc);
++	unsigned long flags;
++
++	spin_lock_irqsave(&host->lock, flags);
++	if (host->flags & SDHCI_SDIO_IRQ_ENABLED)
++		bcm2835_mmc_enable_sdio_irq_nolock(host, true);
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++void bcm2835_mmc_set_clock(struct bcm2835_host *host, unsigned int clock)
++{
++	int div = 0; /* Initialized for compiler warning */
++	int real_div = div, clk_mul = 1;
++	u16 clk = 0;
++	unsigned long timeout;
++	unsigned int input_clock = clock;
++
++	if (host->overclock_50 && (clock == 50000000))
++		clock = host->overclock_50 * 1000000 + 999999;
++
++	host->mmc->actual_clock = 0;
++
++	bcm2835_mmc_writew(host, 0, SDHCI_CLOCK_CONTROL);
++
++	if (clock == 0)
++		return;
++
++	/* Version 3.00 divisors must be a multiple of 2. */
++	if (host->max_clk <= clock)
++		div = 1;
++	else {
++		for (div = 2; div < SDHCI_MAX_DIV_SPEC_300;
++			 div += 2) {
++			if ((host->max_clk / div) <= clock)
++				break;
++		}
++	}
++
++	real_div = div;
++	div >>= 1;
++
++	if (real_div)
++		clock = (host->max_clk * clk_mul) / real_div;
++	host->mmc->actual_clock = clock;
++
++	if ((clock > input_clock) && (clock > host->max_overclock)) {
++		pr_warn("%s: Overclocking to %dHz\n",
++			mmc_hostname(host->mmc), clock);
++		host->max_overclock = clock;
++	}
++
++	clk |= (div & SDHCI_DIV_MASK) << SDHCI_DIVIDER_SHIFT;
++	clk |= ((div & SDHCI_DIV_HI_MASK) >> SDHCI_DIV_MASK_LEN)
++		<< SDHCI_DIVIDER_HI_SHIFT;
++	clk |= SDHCI_CLOCK_INT_EN;
++	bcm2835_mmc_writew(host, clk, SDHCI_CLOCK_CONTROL);
++
++	/* Wait max 20 ms */
++	timeout = 20;
++	while (!((clk = bcm2835_mmc_readw(host, SDHCI_CLOCK_CONTROL))
++		& SDHCI_CLOCK_INT_STABLE)) {
++		if (timeout == 0) {
++			pr_err("%s: Internal clock never "
++				"stabilised.\n", mmc_hostname(host->mmc));
++			bcm2835_mmc_dumpregs(host);
++			return;
++		}
++		timeout--;
++		mdelay(1);
++	}
++
++	if (20-timeout > 10 && 20-timeout > host->max_delay) {
++		host->max_delay = 20-timeout;
++		pr_warn("Warning: MMC controller hung for %d ms\n", host->max_delay);
++	}
++
++	clk |= SDHCI_CLOCK_CARD_EN;
++	bcm2835_mmc_writew(host, clk, SDHCI_CLOCK_CONTROL);
++}
++
++static void bcm2835_mmc_request(struct mmc_host *mmc, struct mmc_request *mrq)
++{
++	struct bcm2835_host *host;
++	unsigned long flags;
++
++	host = mmc_priv(mmc);
++
++	spin_lock_irqsave(&host->lock, flags);
++
++	WARN_ON(host->mrq != NULL);
++
++	host->mrq = mrq;
++
++	if (mrq->sbc && !(host->flags & SDHCI_AUTO_CMD23))
++		bcm2835_mmc_send_command(host, mrq->sbc);
++	else
++		bcm2835_mmc_send_command(host, mrq->cmd);
++
++	spin_unlock_irqrestore(&host->lock, flags);
++
++	if (!(mrq->sbc && !(host->flags & SDHCI_AUTO_CMD23)) && mrq->cmd->data && host->use_dma) {
++		/* DMA transfer starts now, PIO starts after interrupt */
++		bcm2835_mmc_transfer_dma(host);
++	}
++}
++
++
++static void bcm2835_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
++{
++
++	struct bcm2835_host *host = mmc_priv(mmc);
++	unsigned long flags;
++	u8 ctrl;
++	u16 clk, ctrl_2;
++
++	pr_debug("bcm2835_mmc_set_ios: clock %d, pwr %d, bus_width %d, timing %d, vdd %d, drv_type %d\n",
++		 ios->clock, ios->power_mode, ios->bus_width,
++		 ios->timing, ios->signal_voltage, ios->drv_type);
++
++	spin_lock_irqsave(&host->lock, flags);
++
++	if (!ios->clock || ios->clock != host->clock) {
++		bcm2835_mmc_set_clock(host, ios->clock);
++		host->clock = ios->clock;
++	}
++
++	if (host->pwr != SDHCI_POWER_330) {
++		host->pwr = SDHCI_POWER_330;
++		bcm2835_mmc_writeb(host, SDHCI_POWER_330 | SDHCI_POWER_ON, SDHCI_POWER_CONTROL);
++	}
++
++	ctrl = bcm2835_mmc_readb(host, SDHCI_HOST_CONTROL);
++
++	/* set bus width */
++	ctrl &= ~SDHCI_CTRL_8BITBUS;
++	if (ios->bus_width == MMC_BUS_WIDTH_4)
++		ctrl |= SDHCI_CTRL_4BITBUS;
++	else
++		ctrl &= ~SDHCI_CTRL_4BITBUS;
++
++	ctrl &= ~SDHCI_CTRL_HISPD; /* NO_HISPD_BIT */
++
++
++	bcm2835_mmc_writeb(host, ctrl, SDHCI_HOST_CONTROL);
++	/*
++	 * We only need to set Driver Strength if the
++	 * preset value enable is not set.
++	 */
++	ctrl_2 = bcm2835_mmc_readw(host, SDHCI_HOST_CONTROL2);
++	ctrl_2 &= ~SDHCI_CTRL_DRV_TYPE_MASK;
++	if (ios->drv_type == MMC_SET_DRIVER_TYPE_A)
++		ctrl_2 |= SDHCI_CTRL_DRV_TYPE_A;
++	else if (ios->drv_type == MMC_SET_DRIVER_TYPE_C)
++		ctrl_2 |= SDHCI_CTRL_DRV_TYPE_C;
++
++	bcm2835_mmc_writew(host, ctrl_2, SDHCI_HOST_CONTROL2);
++
++	/* Reset SD Clock Enable */
++	clk = bcm2835_mmc_readw(host, SDHCI_CLOCK_CONTROL);
++	clk &= ~SDHCI_CLOCK_CARD_EN;
++	bcm2835_mmc_writew(host, clk, SDHCI_CLOCK_CONTROL);
++
++	/* Re-enable SD Clock */
++	bcm2835_mmc_set_clock(host, host->clock);
++	bcm2835_mmc_writeb(host, ctrl, SDHCI_HOST_CONTROL);
++
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++
++static struct mmc_host_ops bcm2835_ops = {
++	.request = bcm2835_mmc_request,
++	.set_ios = bcm2835_mmc_set_ios,
++	.enable_sdio_irq = bcm2835_mmc_enable_sdio_irq,
++	.ack_sdio_irq = bcm2835_mmc_ack_sdio_irq,
++};
++
++
++static void bcm2835_mmc_tasklet_finish(unsigned long param)
++{
++	struct bcm2835_host *host;
++	unsigned long flags;
++	struct mmc_request *mrq;
++
++	host = (struct bcm2835_host *)param;
++
++	spin_lock_irqsave(&host->lock, flags);
++
++	/*
++	 * If this tasklet gets rescheduled while running, it will
++	 * be run again afterwards but without any active request.
++	 */
++	if (!host->mrq) {
++		spin_unlock_irqrestore(&host->lock, flags);
++		return;
++	}
++
++	del_timer(&host->timer);
++
++	mrq = host->mrq;
++
++	/*
++	 * The controller needs a reset of internal state machines
++	 * upon error conditions.
++	 */
++	if (!(host->flags & SDHCI_DEVICE_DEAD) &&
++	    ((mrq->cmd && mrq->cmd->error) ||
++		 (mrq->data && (mrq->data->error ||
++		  (mrq->data->stop && mrq->data->stop->error))))) {
++
++		spin_unlock_irqrestore(&host->lock, flags);
++		bcm2835_mmc_reset(host, SDHCI_RESET_CMD);
++		bcm2835_mmc_reset(host, SDHCI_RESET_DATA);
++		spin_lock_irqsave(&host->lock, flags);
++	}
++
++	host->mrq = NULL;
++	host->cmd = NULL;
++	host->data = NULL;
++
++	spin_unlock_irqrestore(&host->lock, flags);
++	mmc_request_done(host->mmc, mrq);
++}
++
++
++
++static int bcm2835_mmc_add_host(struct bcm2835_host *host)
++{
++	struct mmc_host *mmc = host->mmc;
++	struct device *dev = mmc->parent;
++#ifndef FORCE_PIO
++	struct dma_slave_config cfg;
++#endif
++	int ret;
++
++	bcm2835_mmc_reset(host, SDHCI_RESET_ALL);
++
++	host->clk_mul = 0;
++
++	if (!mmc->f_max || mmc->f_max > host->max_clk)
++		mmc->f_max = host->max_clk;
++	mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_300;
++
++	/* SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK */
++	host->timeout_clk = mmc->f_max / 1000;
++	mmc->max_busy_timeout = (1 << 27) / host->timeout_clk;
++
++	/* host controller capabilities */
++	mmc->caps |= MMC_CAP_CMD23 | MMC_CAP_NEEDS_POLL |
++		MMC_CAP_SDIO_IRQ | MMC_CAP_SD_HIGHSPEED |
++		MMC_CAP_MMC_HIGHSPEED;
++
++	mmc->caps2 |= MMC_CAP2_SDIO_IRQ_NOTHREAD;
++
++	host->flags = SDHCI_AUTO_CMD23;
++
++	dev_info(dev, "mmc_debug:%x mmc_debug2:%x\n", mmc_debug, mmc_debug2);
++#ifdef FORCE_PIO
++	dev_info(dev, "Forcing PIO mode\n");
++	host->have_dma = false;
++#else
++	if (IS_ERR_OR_NULL(host->dma_chan_rxtx)) {
++		dev_err(dev, "%s: Unable to initialise DMA channel. Falling back to PIO\n",
++			DRIVER_NAME);
++		host->have_dma = false;
++	} else {
++		dev_info(dev, "DMA channel allocated");
++
++		cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++		cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++
++		/* Validate the slave configurations */
++
++		cfg.direction = DMA_MEM_TO_DEV;
++		cfg.src_addr = 0;
++		cfg.dst_addr = host->bus_addr + SDHCI_BUFFER;
++
++		ret = dmaengine_slave_config(host->dma_chan_rxtx, &cfg);
++
++		if (ret == 0) {
++			host->dma_cfg_tx = cfg;
++
++			cfg.direction = DMA_DEV_TO_MEM;
++			cfg.src_addr = host->bus_addr + SDHCI_BUFFER;
++			cfg.dst_addr = 0;
++
++			ret = dmaengine_slave_config(host->dma_chan_rxtx, &cfg);
++		}
++
++		if (ret == 0) {
++			host->dma_cfg_rx = cfg;
++
++			host->have_dma = true;
++		} else {
++			pr_err("%s: unable to configure DMA channel. "
++			       "Falling back to PIO\n",
++			       mmc_hostname(mmc));
++			dma_release_channel(host->dma_chan_rxtx);
++			host->dma_chan_rxtx = NULL;
++			host->have_dma = false;
++		}
++	}
++#endif
++	mmc->max_segs = 128;
++	if (swiotlb_max_segment())
++		mmc->max_req_size = (1 << IO_TLB_SHIFT) * IO_TLB_SEGSIZE;
++	else
++		mmc->max_req_size = 524288;
++	mmc->max_seg_size = mmc->max_req_size;
++	mmc->max_blk_size = 512;
++	mmc->max_blk_count =  65535;
++
++	/* report supported voltage ranges */
++	mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
++
++	tasklet_init(&host->finish_tasklet,
++		bcm2835_mmc_tasklet_finish, (unsigned long)host);
++
++	timer_setup(&host->timer, bcm2835_mmc_timeout_timer, 0);
++	init_waitqueue_head(&host->buf_ready_int);
++
++	bcm2835_mmc_init(host, 0);
++	ret = request_irq(host->irq, bcm2835_mmc_irq, IRQF_SHARED,
++				   mmc_hostname(mmc), host);
++	if (ret) {
++		dev_err(dev, "Failed to request IRQ %d: %d\n", host->irq, ret);
++		goto untasklet;
++	}
++
++	ret = mmc_add_host(mmc);
++	if (ret) {
++		dev_err(dev, "could not add MMC host\n");
++		goto free_irq;
++	}
++
++	return 0;
++
++free_irq:
++	free_irq(host->irq, host);
++untasklet:
++	tasklet_kill(&host->finish_tasklet);
++
++	return ret;
++}
++
++static int bcm2835_mmc_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct device_node *node = dev->of_node;
++	struct clk *clk;
++	struct resource *iomem;
++	struct bcm2835_host *host;
++	struct mmc_host *mmc;
++	const __be32 *addr;
++	int ret;
++
++	mmc = mmc_alloc_host(sizeof(*host), dev);
++	if (!mmc)
++		return -ENOMEM;
++
++	mmc->ops = &bcm2835_ops;
++	host = mmc_priv(mmc);
++	host->mmc = mmc;
++	host->timeout = msecs_to_jiffies(1000);
++	spin_lock_init(&host->lock);
++
++	iomem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	host->ioaddr = devm_ioremap_resource(dev, iomem);
++	if (IS_ERR(host->ioaddr)) {
++		ret = PTR_ERR(host->ioaddr);
++		goto err;
++	}
++
++	addr = of_get_address(node, 0, NULL, NULL);
++	if (!addr) {
++		dev_err(dev, "could not get DMA-register address\n");
++		ret = -ENODEV;
++		goto err;
++	}
++	host->bus_addr = be32_to_cpup(addr);
++	pr_debug(" - ioaddr %lx, iomem->start %lx, bus_addr %lx\n",
++		 (unsigned long)host->ioaddr,
++		 (unsigned long)iomem->start,
++		 (unsigned long)host->bus_addr);
++
++#ifndef FORCE_PIO
++	if (node) {
++		host->dma_chan_rxtx = dma_request_slave_channel(dev, "rx-tx");
++		if (!host->dma_chan_rxtx)
++			host->dma_chan_rxtx =
++				dma_request_slave_channel(dev, "tx");
++		if (!host->dma_chan_rxtx)
++			host->dma_chan_rxtx =
++				dma_request_slave_channel(dev, "rx");
++	} else {
++		dma_cap_mask_t mask;
++
++		dma_cap_zero(mask);
++		/* we don't care about the channel, any would work */
++		dma_cap_set(DMA_SLAVE, mask);
++		host->dma_chan_rxtx = dma_request_channel(mask, NULL, NULL);
++	}
++#endif
++	clk = devm_clk_get(dev, NULL);
++	if (IS_ERR(clk)) {
++		ret = PTR_ERR(clk);
++		if (ret == -EPROBE_DEFER)
++			dev_info(dev, "could not get clk, deferring probe\n");
++		else
++			dev_err(dev, "could not get clk\n");
++		goto err;
++	}
++
++	host->max_clk = clk_get_rate(clk);
++
++	host->irq = platform_get_irq(pdev, 0);
++	if (host->irq <= 0) {
++		dev_err(dev, "get IRQ failed\n");
++		ret = -EINVAL;
++		goto err;
++	}
++
++	if (node) {
++		mmc_of_parse(mmc);
++
++		/* Read any custom properties */
++		of_property_read_u32(node,
++				     "brcm,overclock-50",
++				     &host->overclock_50);
++	} else {
++		mmc->caps |= MMC_CAP_4_BIT_DATA;
++	}
++
++	ret = bcm2835_mmc_add_host(host);
++	if (ret)
++		goto err;
++
++	platform_set_drvdata(pdev, host);
++
++	return 0;
++err:
++	if (host->dma_chan_rxtx)
++		dma_release_channel(host->dma_chan_rxtx);
++	mmc_free_host(mmc);
++
++	return ret;
++}
++
++static int bcm2835_mmc_remove(struct platform_device *pdev)
++{
++	struct bcm2835_host *host = platform_get_drvdata(pdev);
++	unsigned long flags;
++	int dead;
++	u32 scratch;
++
++	dead = 0;
++	scratch = bcm2835_mmc_readl(host, SDHCI_INT_STATUS);
++	if (scratch == (u32)-1)
++		dead = 1;
++
++
++	if (dead) {
++		spin_lock_irqsave(&host->lock, flags);
++
++		host->flags |= SDHCI_DEVICE_DEAD;
++
++		if (host->mrq) {
++			pr_err("%s: Controller removed during "
++				" transfer!\n", mmc_hostname(host->mmc));
++
++			host->mrq->cmd->error = -ENOMEDIUM;
++			tasklet_schedule(&host->finish_tasklet);
++		}
++
++		spin_unlock_irqrestore(&host->lock, flags);
++	}
++
++	mmc_remove_host(host->mmc);
++
++	if (!dead)
++		bcm2835_mmc_reset(host, SDHCI_RESET_ALL);
++
++	free_irq(host->irq, host);
++
++	del_timer_sync(&host->timer);
++
++	tasklet_kill(&host->finish_tasklet);
++
++	if (host->dma_chan_rxtx)
++		dma_release_channel(host->dma_chan_rxtx);
++
++	mmc_free_host(host->mmc);
++
++	return 0;
++}
++
++
++static const struct of_device_id bcm2835_mmc_match[] = {
++	{ .compatible = "brcm,bcm2835-mmc" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, bcm2835_mmc_match);
++
++
++
++static struct platform_driver bcm2835_mmc_driver = {
++	.probe      = bcm2835_mmc_probe,
++	.remove     = bcm2835_mmc_remove,
++	.driver     = {
++		.name		= DRIVER_NAME,
++		.owner		= THIS_MODULE,
++		.of_match_table	= bcm2835_mmc_match,
++	},
++};
++module_platform_driver(bcm2835_mmc_driver);
++
++module_param(mmc_debug, uint, 0644);
++module_param(mmc_debug2, uint, 0644);
++MODULE_ALIAS("platform:mmc-bcm2835");
++MODULE_DESCRIPTION("BCM2835 SDHCI driver");
++MODULE_LICENSE("GPL v2");
++MODULE_AUTHOR("Gellert Weisz");
+--- a/drivers/mmc/host/sdhci-iproc.c
++++ b/drivers/mmc/host/sdhci-iproc.c
+@@ -197,6 +197,7 @@ static const struct sdhci_ops sdhci_ipro
+ 	.write_b = sdhci_iproc_writeb,
+ 	.set_clock = sdhci_set_clock,
+ 	.get_max_clock = sdhci_iproc_get_max_clock,
++	.set_power = sdhci_set_power_and_bus_voltage,
+ 	.set_bus_width = sdhci_set_bus_width,
+ 	.reset = sdhci_reset,
+ 	.set_uhs_signaling = sdhci_set_uhs_signaling,
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -40,7 +40,7 @@
+ 	pr_debug("%s: " DRIVER_NAME ": " f, mmc_hostname(host->mmc), ## x)
+ 
+ #define SDHCI_DUMP(f, x...) \
+-	pr_err("%s: " DRIVER_NAME ": " f, mmc_hostname(host->mmc), ## x)
++	pr_debug("%s: " DRIVER_NAME ": " f, mmc_hostname(host->mmc), ## x)
+ 
+ #define MAX_TUNING_LOOP 40
+ 
+@@ -3233,7 +3233,7 @@ static void sdhci_timeout_timer(struct t
+ 	spin_lock_irqsave(&host->lock, flags);
+ 
+ 	if (host->cmd && !sdhci_data_line_cmd(host->cmd)) {
+-		pr_err("%s: Timeout waiting for hardware cmd interrupt.\n",
++		pr_debug("%s: Timeout waiting for hardware cmd interrupt.\n",
+ 		       mmc_hostname(host->mmc));
+ 		sdhci_err_stats_inc(host, REQ_TIMEOUT);
+ 		sdhci_dumpregs(host);
+@@ -3256,7 +3256,7 @@ static void sdhci_timeout_data_timer(str
+ 
+ 	if (host->data || host->data_cmd ||
+ 	    (host->cmd && sdhci_data_line_cmd(host->cmd))) {
+-		pr_err("%s: Timeout waiting for hardware interrupt.\n",
++		pr_debug("%s: Timeout waiting for hardware interrupt.\n",
+ 		       mmc_hostname(host->mmc));
+ 		sdhci_err_stats_inc(host, REQ_TIMEOUT);
+ 		sdhci_dumpregs(host);
+--- a/include/linux/mmc/card.h
++++ b/include/linux/mmc/card.h
+@@ -295,6 +295,8 @@ struct mmc_card {
+ #define MMC_QUIRK_BROKEN_HPI	(1<<13)		/* Disable broken HPI support */
+ #define MMC_QUIRK_BROKEN_SD_DISCARD	(1<<14)	/* Disable broken SD discard support */
+ 
++#define MMC_QUIRK_ERASE_BROKEN	(1<<31)		/* Skip erase */
++
+ 	bool			reenable_cmdq;	/* Re-enable Command Queue */
+ 
+ 	unsigned int		erase_size;	/* erase size in sectors */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0112-Adding-bcm2835-sdhost-driver-and-an-overlay-to-enabl.patch b/target/linux/bcm27xx/patches-6.1/950-0112-Adding-bcm2835-sdhost-driver-and-an-overlay-to-enabl.patch
new file mode 100644
index 00000000000000..6a9c39662f527d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0112-Adding-bcm2835-sdhost-driver-and-an-overlay-to-enabl.patch
@@ -0,0 +1,2502 @@
+From 0c3db37a3b78df1459c771d559a1fb577d36f5af Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Wed, 25 Mar 2015 17:49:47 +0000
+Subject: [PATCH] Adding bcm2835-sdhost driver, and an overlay to
+ enable it
+
+BCM2835 has two SD card interfaces. This driver uses the other one.
+
+bcm2835-sdhost: Error handling fix, and code clarification
+
+bcm2835-sdhost: Adding overclocking option
+
+Allow a different clock speed to be substitued for a requested 50MHz.
+This option is exposed using the "overclock_50" DT parameter.
+Note that the sdhost interface is restricted to integer divisions of
+core_freq, and the highest sensible option for a core_freq of 250MHz
+is 84 (250/3 = 83.3MHz), the next being 125 (250/2) which is much too
+high.
+
+Use at your own risk.
+
+bcm2835-sdhost: Round up the overclock, so 62 works for 62.5Mhz
+
+Also only warn once for each overclock setting.
+
+bcm2835-sdhost: Improve error handling and recovery
+
+1) Expose the hw_reset method to the MMC framework, removing many
+   internal calls by the driver.
+
+2) Reduce overclock setting on error.
+
+3) Increase timeout to cope with high capacity cards.
+
+4) Add properties and parameters to control pio_limit and debug.
+
+5) Reduce messages at probe time.
+
+bcm2835-sdhost: Further improve overclock back-off
+
+bcm2835-sdhost: Clear HBLC for PIO mode
+
+Also update pio_limit default in overlay README.
+
+bcm2835-sdhost: Add the ERASE capability
+
+See: https://github.com/raspberrypi/linux/issues/1076
+
+bcm2835-sdhost: Ignore CRC7 for MMC CMD1
+
+It seems that the sdhost interface returns CRC7 errors for CMD1,
+which is the MMC-specific SEND_OP_COND. Returning these errors to
+the MMC layer causes a downward spiral, but ignoring them seems
+to be harmless.
+
+bcm2835-mmc/sdhost: Remove ARCH_BCM2835 differences
+
+The bcm2835-mmc driver (and -sdhost driver that copied from it)
+contains code to handle SDIO interrupts in a threaded interrupt
+handler rather than waking the MMC framework thread. The change
+follows a patch from Russell King that adds the facility as the
+preferred way of working.
+
+However, the new code path is only present in ARCH_BCM2835
+builds, which I have taken to be a way of testing the waters
+rather than making the change across the board; I can't see
+any technical reason why it wouldn't be enabled for MACH_BCM270X
+builds. So this patch standardises on the ARCH_BCM2835 code,
+removing the old code paths.
+
+bcm2835-sdhost: Don't log timeout errors unless debug=1
+
+The MMC card-discovery process generates timeouts. This is
+expected behaviour, so reporting it to the user serves no purpose.
+Suppress the reporting of timeout errors unless the debug flag
+is on.
+
+bcm2835-sdhost: Add workaround for odd behaviour on some cards
+
+For reasons not understood, the sdhost driver fails when reading
+sectors very near the end of some SD cards. The problem could
+be related to the similar issue that reading the final sector
+of any card as part of a multiple read never completes, and the
+workaround is an extension of the mechanism introduced to solve
+that problem which ensures those sectors are always read singly.
+
+bcm2835-sdhost: Major revision
+
+This is a significant revision of the bcm2835-sdhost driver. It
+improves on the original in a number of ways:
+
+1) Through the use of CMD23 for reads it appears to avoid problems
+   reading some sectors on certain high speed cards.
+2) Better atomicity to prevent crashes.
+3) Higher performance.
+4) Activity logging included, for easier diagnosis in the event
+   of a problem.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-sdhost: Restore ATOMIC flag to PIO sg mapping
+
+Allocation problems have been seen in a wireless driver, and
+this is the only change which might have been responsible.
+
+SQUASH: bcm2835-sdhost: Only claim one DMA channel
+
+With both MMC controllers enabled there are few DMA channels left. The
+bcm2835-sdhost driver only uses DMA in one direction at a time, so it
+doesn't need to claim two channels.
+
+See: https://github.com/raspberrypi/linux/issues/1327
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-sdhost: Workaround for "slow" sectors
+
+Some cards have been seen to cause timeouts after certain sectors are
+read. This workaround enforces a minimum delay between the stop after
+reading one of those sectors and a subsequent data command.
+
+Using CMD23 (SET_BLOCK_COUNT) avoids this problem, so good cards will
+not be penalised by this workaround.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-sdhost: Firmware manages the clock divisor
+
+The bcm2835-sdhost driver hands control of the CDIV clock divisor
+register to matching firmware, allowing it to adjust to a changing
+core clock. This removes the need to use the performance governor or
+to enable io_is_busy on the on-demand governor in order to get the
+best SD performance.
+
+N.B. As SD clocks must be an integer divisor of the core clock, it is
+possible that the SD clock for "turbo" mode can be different (even
+lower) than "normal" mode.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-sdhost: Reset the clock in task context
+
+Since reprogramming the clock can now involve a round-trip to the
+firmware it must not be done at atomic context, and a tasklet
+is not a task.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-sdhost: Don't exit cmd wait loop on error
+
+The FAIL flag can be set in the CMD register before command processing
+is complete, leading to spurious "failed to complete" errors. This has
+the effect of promoting harmless CRC7 errors during CMD1 processing
+into errors that can delay and even prevent booting.
+
+Also:
+1) Convert the last KERN_ERROR message in the register dumping to
+   KERN_INFO.
+2) Remove an unnecessary reset call from  bcm2835_sdhost_add_host.
+
+See: https://github.com/raspberrypi/linux/pull/1492
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-sdhost: mmc_card_blockaddr fix
+
+Get the definition of mmc_card_blockaddr from drivers/mmc/core/card.h.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-sdhost: New timer API
+
+mmc: bcm2835-sdhost: Support underclocking
+
+Support underclocking of the SD bus in two ways:
+1. using the max-frequency DT property (which currently has no DT
+   parameter), and
+2. using the exiting sd_overclock parameter.
+
+The two methods differ slightly - in the former the MMC subsystem is
+aware of the underclocking, while in the latter it isn't - but the
+end results should be the same.
+
+See: https://github.com/raspberrypi/linux/issues/2350
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+mmc: bcm2835-sdhost: Add include
+
+highmem.h (needed for kmap_atomic) is pulled in by one of the other
+include files, but only with some CONFIG settings. Make the inclusion
+explicit to cater for cases where the CONFIG setting is absent.
+
+See: https://github.com/raspberrypi/linux/issues/2366
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+mmc/bcm2835-sdhost: Recover from MMC_SEND_EXT_CSD
+
+If the user issues an "mmc extcsd read", the SD controller receives
+what it thinks is a SEND_IF_COND command with an unexpected data block.
+The resulting operations leave the FSM stuck in READWAIT, a state which
+persists until the MMC framework resets the controller, by which point
+the root filesystem is likely to have been unmounted.
+
+A less heavyweight solution is to detect the condition and nudge the
+FSM by asserting the (self-clearing) FORCE_DATA_MODE bit.
+
+N.B. This workaround was essentially discovered by accident and without
+a full understanding the inner workings of the controller, so it is
+fortunate that the "fix" only modifies error paths.
+
+See: https://github.com/raspberrypi/linux/issues/2728
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+mmc: bcm2835-sdhost: Fix warnings on arm64
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-sdhost: Allow for sg entries that cross pages
+
+The dma_complete handling code calculates a virtual address for a page
+then adds an offset, but if the offset is more than a page and HIGHMEM
+is in use then the summed address could be in an unmapped (or just
+incorrect) page.
+
+The upstream SDHOST driver allows for this possibility - copy the code
+that does so.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-sdhost: Fix DMA channel leak on error/remove
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+mmc: bcm2835-sdhost: Support 64-bit physical addresses
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-sdhost: Replace obsolete struct timeval
+
+struct timeval has been retired due to the impending linux 32-bit tv_sec
+rollover (only 18 years to go) - timespec64 is the obvious replacement.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+mmc: sdhost: Pass DT pointer to rpi_firmware_get
+
+Using the rpi_firmware API as intended allows proper reference counting
+of the firmware device and means we can remove a downstream patch to
+the firmware driver.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/mmc/host/Kconfig          |   10 +
+ drivers/mmc/host/Makefile         |    1 +
+ drivers/mmc/host/bcm2835-sdhost.c | 2209 +++++++++++++++++++++++++++++
+ 3 files changed, 2220 insertions(+)
+ create mode 100644 drivers/mmc/host/bcm2835-sdhost.c
+
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -34,6 +34,16 @@ config MMC_BCM2835_PIO_DMA_BARRIER
+ 
+ 	  If unsure, say 2 here.
+ 
++config MMC_BCM2835_SDHOST
++	tristate "Support for the SDHost controller on BCM2708/9"
++	depends on ARCH_BCM2835
++	help
++	  This selects the SDHost controller on BCM2835/6.
++
++	  If you have a controller with this interface, say Y or M here.
++
++	  If unsure, say N.
++
+ config MMC_DEBUG
+ 	bool "MMC host drivers debugging"
+ 	depends on MMC != n
+--- a/drivers/mmc/host/Makefile
++++ b/drivers/mmc/host/Makefile
+@@ -23,6 +23,7 @@ obj-$(CONFIG_MMC_SDHCI_MILBEAUT)	+= sdhc
+ obj-$(CONFIG_MMC_SDHCI_SPEAR)	+= sdhci-spear.o
+ obj-$(CONFIG_MMC_SDHCI_AM654)	+= sdhci_am654.o
+ obj-$(CONFIG_MMC_BCM2835_MMC)	+= bcm2835-mmc.o
++obj-$(CONFIG_MMC_BCM2835_SDHOST)	+= bcm2835-sdhost.o
+ obj-$(CONFIG_MMC_WBSD)		+= wbsd.o
+ obj-$(CONFIG_MMC_AU1X)		+= au1xmmc.o
+ obj-$(CONFIG_MMC_ALCOR)	+= alcor.o
+--- /dev/null
++++ b/drivers/mmc/host/bcm2835-sdhost.c
+@@ -0,0 +1,2209 @@
++/*
++ * BCM2835 SD host driver.
++ *
++ * Author:      Phil Elwell <phil@raspberrypi.org>
++ *              Copyright (C) 2015-2016 Raspberry Pi (Trading) Ltd.
++ *
++ * Based on
++ *  mmc-bcm2835.c by Gellert Weisz
++ * which is, in turn, based on
++ *  sdhci-bcm2708.c by Broadcom
++ *  sdhci-bcm2835.c by Stephen Warren and Oleksandr Tymoshenko
++ *  sdhci.c and sdhci-pci.c by Pierre Ossman
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms and conditions of the GNU General Public License,
++ * version 2, as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
++ * more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#define FIFO_READ_THRESHOLD     4
++#define FIFO_WRITE_THRESHOLD    4
++#define ALLOW_CMD23_READ        1
++#define ALLOW_CMD23_WRITE       0
++#define ENABLE_LOG              1
++#define SDDATA_FIFO_PIO_BURST   8
++#define CMD_DALLY_US            1
++
++#include <linux/delay.h>
++#include <linux/module.h>
++#include <linux/io.h>
++#include <linux/mmc/mmc.h>
++#include <linux/mmc/host.h>
++#include <linux/mmc/sd.h>
++#include <linux/mmc/sdio.h>
++#include <linux/scatterlist.h>
++#include <linux/of_address.h>
++#include <linux/of_irq.h>
++#include <linux/clk.h>
++#include <linux/platform_device.h>
++#include <linux/err.h>
++#include <linux/blkdev.h>
++#include <linux/dmaengine.h>
++#include <linux/dma-mapping.h>
++#include <linux/of_dma.h>
++#include <linux/time.h>
++#include <linux/workqueue.h>
++#include <linux/interrupt.h>
++#include <linux/highmem.h>
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
++/* For mmc_card_blockaddr */
++#include "../core/card.h"
++
++#define DRIVER_NAME "sdhost-bcm2835"
++
++#define SDCMD  0x00 /* Command to SD card              - 16 R/W */
++#define SDARG  0x04 /* Argument to SD card             - 32 R/W */
++#define SDTOUT 0x08 /* Start value for timeout counter - 32 R/W */
++#define SDCDIV 0x0c /* Start value for clock divider   - 11 R/W */
++#define SDRSP0 0x10 /* SD card response (31:0)         - 32 R   */
++#define SDRSP1 0x14 /* SD card response (63:32)        - 32 R   */
++#define SDRSP2 0x18 /* SD card response (95:64)        - 32 R   */
++#define SDRSP3 0x1c /* SD card response (127:96)       - 32 R   */
++#define SDHSTS 0x20 /* SD host status                  - 11 R   */
++#define SDVDD  0x30 /* SD card power control           -  1 R/W */
++#define SDEDM  0x34 /* Emergency Debug Mode            - 13 R/W */
++#define SDHCFG 0x38 /* Host configuration              -  2 R/W */
++#define SDHBCT 0x3c /* Host byte count (debug)         - 32 R/W */
++#define SDDATA 0x40 /* Data to/from SD card            - 32 R/W */
++#define SDHBLC 0x50 /* Host block count (SDIO/SDHC)    -  9 R/W */
++
++#define SDCMD_NEW_FLAG                  0x8000
++#define SDCMD_FAIL_FLAG                 0x4000
++#define SDCMD_BUSYWAIT                  0x800
++#define SDCMD_NO_RESPONSE               0x400
++#define SDCMD_LONG_RESPONSE             0x200
++#define SDCMD_WRITE_CMD                 0x80
++#define SDCMD_READ_CMD                  0x40
++#define SDCMD_CMD_MASK                  0x3f
++
++#define SDCDIV_MAX_CDIV                 0x7ff
++
++#define SDHSTS_BUSY_IRPT                0x400
++#define SDHSTS_BLOCK_IRPT               0x200
++#define SDHSTS_SDIO_IRPT                0x100
++#define SDHSTS_REW_TIME_OUT             0x80
++#define SDHSTS_CMD_TIME_OUT             0x40
++#define SDHSTS_CRC16_ERROR              0x20
++#define SDHSTS_CRC7_ERROR               0x10
++#define SDHSTS_FIFO_ERROR               0x08
++/* Reserved */
++/* Reserved */
++#define SDHSTS_DATA_FLAG                0x01
++
++#define SDHSTS_TRANSFER_ERROR_MASK      (SDHSTS_CRC7_ERROR|SDHSTS_CRC16_ERROR|SDHSTS_REW_TIME_OUT|SDHSTS_FIFO_ERROR)
++#define SDHSTS_ERROR_MASK               (SDHSTS_CMD_TIME_OUT|SDHSTS_TRANSFER_ERROR_MASK)
++
++#define SDHCFG_BUSY_IRPT_EN     (1<<10)
++#define SDHCFG_BLOCK_IRPT_EN    (1<<8)
++#define SDHCFG_SDIO_IRPT_EN     (1<<5)
++#define SDHCFG_DATA_IRPT_EN     (1<<4)
++#define SDHCFG_SLOW_CARD        (1<<3)
++#define SDHCFG_WIDE_EXT_BUS     (1<<2)
++#define SDHCFG_WIDE_INT_BUS     (1<<1)
++#define SDHCFG_REL_CMD_LINE     (1<<0)
++
++#define SDEDM_FORCE_DATA_MODE   (1<<19)
++#define SDEDM_CLOCK_PULSE       (1<<20)
++#define SDEDM_BYPASS            (1<<21)
++
++#define SDEDM_WRITE_THRESHOLD_SHIFT 9
++#define SDEDM_READ_THRESHOLD_SHIFT 14
++#define SDEDM_THRESHOLD_MASK     0x1f
++
++#define SDEDM_FSM_MASK           0xf
++#define SDEDM_FSM_IDENTMODE      0x0
++#define SDEDM_FSM_DATAMODE       0x1
++#define SDEDM_FSM_READDATA       0x2
++#define SDEDM_FSM_WRITEDATA      0x3
++#define SDEDM_FSM_READWAIT       0x4
++#define SDEDM_FSM_READCRC        0x5
++#define SDEDM_FSM_WRITECRC       0x6
++#define SDEDM_FSM_WRITEWAIT1     0x7
++#define SDEDM_FSM_POWERDOWN      0x8
++#define SDEDM_FSM_POWERUP        0x9
++#define SDEDM_FSM_WRITESTART1    0xa
++#define SDEDM_FSM_WRITESTART2    0xb
++#define SDEDM_FSM_GENPULSES      0xc
++#define SDEDM_FSM_WRITEWAIT2     0xd
++#define SDEDM_FSM_STARTPOWDOWN   0xf
++
++#define SDDATA_FIFO_WORDS        16
++
++#define USE_CMD23_FLAGS          ((ALLOW_CMD23_READ * MMC_DATA_READ) | \
++				  (ALLOW_CMD23_WRITE * MMC_DATA_WRITE))
++
++#define MHZ 1000000
++
++
++struct bcm2835_host {
++	spinlock_t		lock;
++
++	struct rpi_firmware	*fw;
++
++	void __iomem		*ioaddr;
++	phys_addr_t		bus_addr;
++
++	struct mmc_host		*mmc;
++
++	u32			pio_timeout;	/* In jiffies */
++
++	int			clock;		/* Current clock speed */
++
++	bool			slow_card;	/* Force 11-bit divisor */
++
++	unsigned int		max_clk;	/* Max possible freq */
++
++	struct tasklet_struct	finish_tasklet;	/* Tasklet structures */
++
++	struct work_struct	cmd_wait_wq;	/* Workqueue function */
++
++	struct timer_list	timer;		/* Timer for timeouts */
++
++	struct sg_mapping_iter	sg_miter;	/* SG state for PIO */
++	unsigned int		blocks;		/* remaining PIO blocks */
++
++	int			irq;		/* Device IRQ */
++
++	u32			cmd_quick_poll_retries;
++	u32			ns_per_fifo_word;
++
++	/* cached registers */
++	u32			hcfg;
++	u32			cdiv;
++
++	struct mmc_request		*mrq;			/* Current request */
++	struct mmc_command		*cmd;			/* Current command */
++	struct mmc_data			*data;			/* Current data request */
++	unsigned int			data_complete:1;	/* Data finished before cmd */
++
++	unsigned int			flush_fifo:1;		/* Drain the fifo when finishing */
++
++	unsigned int			use_busy:1;		/* Wait for busy interrupt */
++
++	unsigned int			use_sbc:1;		/* Send CMD23 */
++
++	unsigned int			debug:1;		/* Enable debug output */
++	unsigned int			firmware_sets_cdiv:1;	/* Let the firmware manage the clock */
++	unsigned int			reset_clock:1;		/* Reset the clock fore the next request */
++
++	/*DMA part*/
++	struct dma_chan			*dma_chan_rxtx;		/* DMA channel for reads and writes */
++	struct dma_chan			*dma_chan;		/* Channel in use */
++	struct dma_slave_config		dma_cfg_rx;
++	struct dma_slave_config		dma_cfg_tx;
++	struct dma_async_tx_descriptor	*dma_desc;
++	u32				dma_dir;
++	u32				drain_words;
++	struct page 			*drain_page;
++	u32				drain_offset;
++
++	bool				allow_dma;
++	bool				use_dma;
++	/*end of DMA part*/
++
++	int				max_delay;	/* maximum length of time spent waiting */
++	struct timespec64		stop_time;	/* when the last stop was issued */
++	u32				delay_after_stop; /* minimum time between stop and subsequent data transfer */
++	u32				delay_after_this_stop; /* minimum time between this stop and subsequent data transfer */
++	u32				user_overclock_50; /* User's preferred frequency to use when 50MHz is requested (in MHz) */
++	u32				overclock_50;	/* frequency to use when 50MHz is requested (in MHz) */
++	u32				overclock;	/* Current frequency if overclocked, else zero */
++	u32				pio_limit;	/* Maximum block count for PIO (0 = always DMA) */
++
++	u32				sectors;	/* Cached card size in sectors */
++};
++
++#if ENABLE_LOG
++
++struct log_entry_struct {
++	char event[4];
++	u32 timestamp;
++	u32 param1;
++	u32 param2;
++};
++
++typedef struct log_entry_struct LOG_ENTRY_T;
++
++LOG_ENTRY_T *sdhost_log_buf;
++dma_addr_t sdhost_log_addr;
++static u32 sdhost_log_idx;
++static spinlock_t log_lock;
++static void __iomem *timer_base;
++
++#define LOG_ENTRIES (256*1)
++#define LOG_SIZE (sizeof(LOG_ENTRY_T)*LOG_ENTRIES)
++
++static void log_init(struct device *dev, u32 bus_to_phys)
++{
++	spin_lock_init(&log_lock);
++	sdhost_log_buf = dma_alloc_coherent(dev, LOG_SIZE, &sdhost_log_addr,
++					     GFP_KERNEL);
++	if (sdhost_log_buf) {
++		pr_info("sdhost: log_buf @ %p (%llx)\n",
++			sdhost_log_buf, (u64)sdhost_log_addr);
++		timer_base = ioremap(bus_to_phys + 0x7e003000, SZ_4K);
++		if (!timer_base)
++			pr_err("sdhost: failed to remap timer\n");
++	}
++	else
++		pr_err("sdhost: failed to allocate log buf\n");
++}
++
++static void log_event_impl(const char *event, u32 param1, u32 param2)
++{
++	if (sdhost_log_buf) {
++		LOG_ENTRY_T *entry;
++		unsigned long flags;
++
++		spin_lock_irqsave(&log_lock, flags);
++
++		entry = sdhost_log_buf + sdhost_log_idx;
++		memcpy(entry->event, event, 4);
++		entry->timestamp = (readl(timer_base + 4) & 0x3fffffff) +
++			(smp_processor_id()<<30);
++		entry->param1 = param1;
++		entry->param2 = param2;
++		sdhost_log_idx = (sdhost_log_idx + 1) % LOG_ENTRIES;
++
++		spin_unlock_irqrestore(&log_lock, flags);
++	}
++}
++
++static void log_dump(void)
++{
++	if (sdhost_log_buf) {
++		LOG_ENTRY_T *entry;
++		unsigned long flags;
++		int idx;
++
++		spin_lock_irqsave(&log_lock, flags);
++
++		idx = sdhost_log_idx;
++		do {
++			entry = sdhost_log_buf + idx;
++			if (entry->event[0] != '\0')
++				pr_info("[%08x] %.4s %x %x\n",
++				       entry->timestamp,
++				       entry->event,
++				       entry->param1,
++				       entry->param2);
++			idx = (idx + 1) % LOG_ENTRIES;
++		} while (idx != sdhost_log_idx);
++
++		spin_unlock_irqrestore(&log_lock, flags);
++	}
++}
++
++#define log_event(event, param1, param2) log_event_impl(event, (u32)(uintptr_t)param1, (u32)(uintptr_t)param2)
++
++#else
++
++#define log_init(x) (void)0
++#define log_event(event, param1, param2) (void)0
++#define log_dump() (void)0
++
++#endif
++
++static inline void bcm2835_sdhost_write(struct bcm2835_host *host, u32 val, int reg)
++{
++	writel(val, host->ioaddr + reg);
++}
++
++static inline u32 bcm2835_sdhost_read(struct bcm2835_host *host, int reg)
++{
++	return readl(host->ioaddr + reg);
++}
++
++static inline u32 bcm2835_sdhost_read_relaxed(struct bcm2835_host *host, int reg)
++{
++	return readl_relaxed(host->ioaddr + reg);
++}
++
++static void bcm2835_sdhost_dumpcmd(struct bcm2835_host *host,
++				   struct mmc_command *cmd,
++				   const char *label)
++{
++	if (cmd)
++		pr_info("%s:%c%s op %d arg 0x%x flags 0x%x - resp %08x %08x %08x %08x, err %d\n",
++			mmc_hostname(host->mmc),
++			(cmd == host->cmd) ? '>' : ' ',
++			label, cmd->opcode, cmd->arg, cmd->flags,
++			cmd->resp[0], cmd->resp[1], cmd->resp[2], cmd->resp[3],
++			cmd->error);
++}
++
++static void bcm2835_sdhost_dumpregs(struct bcm2835_host *host)
++{
++	if (host->mrq)
++	{
++		bcm2835_sdhost_dumpcmd(host, host->mrq->sbc, "sbc");
++		bcm2835_sdhost_dumpcmd(host, host->mrq->cmd, "cmd");
++		if (host->mrq->data)
++			pr_info("%s: data blocks %x blksz %x - err %d\n",
++			       mmc_hostname(host->mmc),
++			       host->mrq->data->blocks,
++			       host->mrq->data->blksz,
++			       host->mrq->data->error);
++		bcm2835_sdhost_dumpcmd(host, host->mrq->stop, "stop");
++	}
++
++	pr_info("%s: =========== REGISTER DUMP ===========\n",
++		mmc_hostname(host->mmc));
++
++	pr_info("%s: SDCMD  0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDCMD));
++	pr_info("%s: SDARG  0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDARG));
++	pr_info("%s: SDTOUT 0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDTOUT));
++	pr_info("%s: SDCDIV 0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDCDIV));
++	pr_info("%s: SDRSP0 0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDRSP0));
++	pr_info("%s: SDRSP1 0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDRSP1));
++	pr_info("%s: SDRSP2 0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDRSP2));
++	pr_info("%s: SDRSP3 0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDRSP3));
++	pr_info("%s: SDHSTS 0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDHSTS));
++	pr_info("%s: SDVDD  0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDVDD));
++	pr_info("%s: SDEDM  0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDEDM));
++	pr_info("%s: SDHCFG 0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDHCFG));
++	pr_info("%s: SDHBCT 0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDHBCT));
++	pr_info("%s: SDHBLC 0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDHBLC));
++
++	pr_info("%s: ===========================================\n",
++		mmc_hostname(host->mmc));
++}
++
++static void bcm2835_sdhost_set_power(struct bcm2835_host *host, bool on)
++{
++	bcm2835_sdhost_write(host, on ? 1 : 0, SDVDD);
++}
++
++static void bcm2835_sdhost_reset_internal(struct bcm2835_host *host)
++{
++	u32 temp;
++
++	if (host->debug)
++		pr_info("%s: reset\n", mmc_hostname(host->mmc));
++
++	bcm2835_sdhost_set_power(host, false);
++
++	bcm2835_sdhost_write(host, 0, SDCMD);
++	bcm2835_sdhost_write(host, 0, SDARG);
++	bcm2835_sdhost_write(host, 0xf00000, SDTOUT);
++	bcm2835_sdhost_write(host, 0, SDCDIV);
++	bcm2835_sdhost_write(host, 0x7f8, SDHSTS); /* Write 1s to clear */
++	bcm2835_sdhost_write(host, 0, SDHCFG);
++	bcm2835_sdhost_write(host, 0, SDHBCT);
++	bcm2835_sdhost_write(host, 0, SDHBLC);
++
++	/* Limit fifo usage due to silicon bug */
++	temp = bcm2835_sdhost_read(host, SDEDM);
++	temp &= ~((SDEDM_THRESHOLD_MASK<<SDEDM_READ_THRESHOLD_SHIFT) |
++		  (SDEDM_THRESHOLD_MASK<<SDEDM_WRITE_THRESHOLD_SHIFT));
++	temp |= (FIFO_READ_THRESHOLD << SDEDM_READ_THRESHOLD_SHIFT) |
++		(FIFO_WRITE_THRESHOLD << SDEDM_WRITE_THRESHOLD_SHIFT);
++	bcm2835_sdhost_write(host, temp, SDEDM);
++	mdelay(10);
++	bcm2835_sdhost_set_power(host, true);
++	mdelay(10);
++	host->clock = 0;
++	host->sectors = 0;
++	bcm2835_sdhost_write(host, host->hcfg, SDHCFG);
++	bcm2835_sdhost_write(host, SDCDIV_MAX_CDIV, SDCDIV);
++}
++
++#if 0 // todo fix
++static void bcm2835_sdhost_reset(struct mmc_host *mmc)
++{
++	struct bcm2835_host *host = mmc_priv(mmc);
++	unsigned long flags;
++	spin_lock_irqsave(&host->lock, flags);
++	log_event("RST<", 0, 0);
++
++	bcm2835_sdhost_reset_internal(host);
++
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++#endif
++
++static void bcm2835_sdhost_set_ios(struct mmc_host *mmc, struct mmc_ios *ios);
++
++static void bcm2835_sdhost_init(struct bcm2835_host *host, int soft)
++{
++	pr_debug("bcm2835_sdhost_init(%d)\n", soft);
++
++	/* Set interrupt enables */
++	host->hcfg = SDHCFG_BUSY_IRPT_EN;
++
++	bcm2835_sdhost_reset_internal(host);
++
++	if (soft) {
++		/* force clock reconfiguration */
++		host->clock = 0;
++		bcm2835_sdhost_set_ios(host->mmc, &host->mmc->ios);
++	}
++}
++
++static void bcm2835_sdhost_wait_transfer_complete(struct bcm2835_host *host)
++{
++	int timediff;
++	u32 alternate_idle;
++	u32 edm;
++
++	alternate_idle = (host->mrq->data->flags & MMC_DATA_READ) ?
++		SDEDM_FSM_READWAIT : SDEDM_FSM_WRITESTART1;
++
++	edm = bcm2835_sdhost_read(host, SDEDM);
++
++	log_event("WTC<", edm, 0);
++
++	timediff = 0;
++
++	while (1) {
++		u32 fsm = edm & SDEDM_FSM_MASK;
++		if ((fsm == SDEDM_FSM_IDENTMODE) ||
++		    (fsm == SDEDM_FSM_DATAMODE))
++			break;
++		if (fsm == alternate_idle) {
++			bcm2835_sdhost_write(host,
++					     edm | SDEDM_FORCE_DATA_MODE,
++					     SDEDM);
++			break;
++		}
++
++		timediff++;
++		if (timediff == 100000) {
++			pr_err("%s: wait_transfer_complete - still waiting after %d retries\n",
++			       mmc_hostname(host->mmc),
++			       timediff);
++			log_dump();
++			bcm2835_sdhost_dumpregs(host);
++			host->mrq->data->error = -ETIMEDOUT;
++			log_event("WTC!", edm, 0);
++			return;
++		}
++		cpu_relax();
++		edm = bcm2835_sdhost_read(host, SDEDM);
++	}
++	log_event("WTC>", edm, 0);
++}
++
++static void bcm2835_sdhost_finish_data(struct bcm2835_host *host);
++
++static void bcm2835_sdhost_dma_complete(void *param)
++{
++	struct bcm2835_host *host = param;
++	struct mmc_data *data = host->data;
++	unsigned long flags;
++
++	spin_lock_irqsave(&host->lock, flags);
++	log_event("DMA<", host->data, bcm2835_sdhost_read(host, SDHSTS));
++	log_event("DMA ", bcm2835_sdhost_read(host, SDCMD),
++		  bcm2835_sdhost_read(host, SDEDM));
++
++	if (host->dma_chan) {
++		dma_unmap_sg(host->dma_chan->device->dev,
++			     data->sg, data->sg_len,
++			     host->dma_dir);
++
++		host->dma_chan = NULL;
++	}
++
++	if (host->drain_words) {
++		void *page;
++		u32 *buf;
++
++		if (host->drain_offset & PAGE_MASK) {
++			host->drain_page += host->drain_offset >> PAGE_SHIFT;
++			host->drain_offset &= ~PAGE_MASK;
++		}
++
++		page = kmap_atomic(host->drain_page);
++		buf = page + host->drain_offset;
++
++		while (host->drain_words) {
++			u32 edm = bcm2835_sdhost_read(host, SDEDM);
++			if ((edm >> 4) & 0x1f)
++				*(buf++) = bcm2835_sdhost_read(host,
++							       SDDATA);
++			host->drain_words--;
++		}
++
++		kunmap_atomic(page);
++	}
++
++	bcm2835_sdhost_finish_data(host);
++
++	log_event("DMA>", host->data, 0);
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++static void bcm2835_sdhost_read_block_pio(struct bcm2835_host *host)
++{
++	unsigned long flags;
++	size_t blksize, len;
++	u32 *buf;
++	unsigned long wait_max;
++
++	blksize = host->data->blksz;
++
++	wait_max = jiffies + msecs_to_jiffies(host->pio_timeout);
++
++	local_irq_save(flags);
++
++	while (blksize) {
++		int copy_words;
++		u32 hsts = 0;
++
++		if (!sg_miter_next(&host->sg_miter)) {
++			host->data->error = -EINVAL;
++			break;
++		}
++
++		len = min(host->sg_miter.length, blksize);
++		if (len % 4) {
++			host->data->error = -EINVAL;
++			break;
++		}
++
++		blksize -= len;
++		host->sg_miter.consumed = len;
++
++		buf = (u32 *)host->sg_miter.addr;
++
++		copy_words = len/4;
++
++		while (copy_words) {
++			int burst_words, words;
++			u32 edm;
++
++			burst_words = SDDATA_FIFO_PIO_BURST;
++			if (burst_words > copy_words)
++				burst_words = copy_words;
++			edm = bcm2835_sdhost_read(host, SDEDM);
++			words = ((edm >> 4) & 0x1f);
++
++			if (words < burst_words) {
++				int fsm_state = (edm & SDEDM_FSM_MASK);
++				if ((fsm_state != SDEDM_FSM_READDATA) &&
++				    (fsm_state != SDEDM_FSM_READWAIT) &&
++				    (fsm_state != SDEDM_FSM_READCRC)) {
++					hsts = bcm2835_sdhost_read(host,
++								   SDHSTS);
++					pr_info("%s: fsm %x, hsts %x\n",
++					       mmc_hostname(host->mmc),
++					       fsm_state, hsts);
++					if (hsts & SDHSTS_ERROR_MASK)
++						break;
++				}
++
++				if (time_after(jiffies, wait_max)) {
++					pr_err("%s: PIO read timeout - EDM %x\n",
++					       mmc_hostname(host->mmc),
++					       edm);
++					hsts = SDHSTS_REW_TIME_OUT;
++					break;
++				}
++				ndelay((burst_words - words) *
++				       host->ns_per_fifo_word);
++				continue;
++			} else if (words > copy_words) {
++				words = copy_words;
++			}
++
++			copy_words -= words;
++
++			while (words) {
++				*(buf++) = bcm2835_sdhost_read(host, SDDATA);
++				words--;
++			}
++		}
++
++		if (hsts & SDHSTS_ERROR_MASK)
++			break;
++	}
++
++	sg_miter_stop(&host->sg_miter);
++
++	local_irq_restore(flags);
++}
++
++static void bcm2835_sdhost_write_block_pio(struct bcm2835_host *host)
++{
++	unsigned long flags;
++	size_t blksize, len;
++	u32 *buf;
++	unsigned long wait_max;
++
++	blksize = host->data->blksz;
++
++	wait_max = jiffies + msecs_to_jiffies(host->pio_timeout);
++
++	local_irq_save(flags);
++
++	while (blksize) {
++		int copy_words;
++		u32 hsts = 0;
++
++		if (!sg_miter_next(&host->sg_miter)) {
++			host->data->error = -EINVAL;
++			break;
++		}
++
++		len = min(host->sg_miter.length, blksize);
++		if (len % 4) {
++			host->data->error = -EINVAL;
++			break;
++		}
++
++		blksize -= len;
++		host->sg_miter.consumed = len;
++
++		buf = (u32 *)host->sg_miter.addr;
++
++		copy_words = len/4;
++
++		while (copy_words) {
++			int burst_words, words;
++			u32 edm;
++
++			burst_words = SDDATA_FIFO_PIO_BURST;
++			if (burst_words > copy_words)
++				burst_words = copy_words;
++			edm = bcm2835_sdhost_read(host, SDEDM);
++			words = SDDATA_FIFO_WORDS - ((edm >> 4) & 0x1f);
++
++			if (words < burst_words) {
++				int fsm_state = (edm & SDEDM_FSM_MASK);
++				if ((fsm_state != SDEDM_FSM_WRITEDATA) &&
++				    (fsm_state != SDEDM_FSM_WRITESTART1) &&
++				    (fsm_state != SDEDM_FSM_WRITESTART2)) {
++					hsts = bcm2835_sdhost_read(host,
++								   SDHSTS);
++					pr_info("%s: fsm %x, hsts %x\n",
++					       mmc_hostname(host->mmc),
++					       fsm_state, hsts);
++					if (hsts & SDHSTS_ERROR_MASK)
++						break;
++				}
++
++				if (time_after(jiffies, wait_max)) {
++					pr_err("%s: PIO write timeout - EDM %x\n",
++					       mmc_hostname(host->mmc),
++					       edm);
++					hsts = SDHSTS_REW_TIME_OUT;
++					break;
++				}
++				ndelay((burst_words - words) *
++				       host->ns_per_fifo_word);
++				continue;
++			} else if (words > copy_words) {
++				words = copy_words;
++			}
++
++			copy_words -= words;
++
++			while (words) {
++				bcm2835_sdhost_write(host, *(buf++), SDDATA);
++				words--;
++			}
++		}
++
++		if (hsts & SDHSTS_ERROR_MASK)
++			break;
++	}
++
++	sg_miter_stop(&host->sg_miter);
++
++	local_irq_restore(flags);
++}
++
++static void bcm2835_sdhost_transfer_pio(struct bcm2835_host *host)
++{
++	u32 sdhsts;
++	bool is_read;
++	BUG_ON(!host->data);
++	log_event("XFP<", host->data, host->blocks);
++
++	is_read = (host->data->flags & MMC_DATA_READ) != 0;
++	if (is_read)
++		bcm2835_sdhost_read_block_pio(host);
++	else
++		bcm2835_sdhost_write_block_pio(host);
++
++	sdhsts = bcm2835_sdhost_read(host, SDHSTS);
++	if (sdhsts & (SDHSTS_CRC16_ERROR |
++		      SDHSTS_CRC7_ERROR |
++		      SDHSTS_FIFO_ERROR)) {
++		pr_err("%s: %s transfer error - HSTS %x\n",
++		       mmc_hostname(host->mmc),
++		       is_read ? "read" : "write",
++		       sdhsts);
++		host->data->error = -EILSEQ;
++	} else if ((sdhsts & (SDHSTS_CMD_TIME_OUT |
++			      SDHSTS_REW_TIME_OUT))) {
++		pr_err("%s: %s timeout error - HSTS %x\n",
++		       mmc_hostname(host->mmc),
++		       is_read ? "read" : "write",
++		       sdhsts);
++		host->data->error = -ETIMEDOUT;
++	}
++	log_event("XFP>", host->data, host->blocks);
++}
++
++static void bcm2835_sdhost_prepare_dma(struct bcm2835_host *host,
++	struct mmc_data *data)
++{
++	int len, dir_data, dir_slave;
++	struct dma_async_tx_descriptor *desc = NULL;
++	struct dma_chan *dma_chan;
++
++	log_event("PRD<", data, 0);
++	pr_debug("bcm2835_sdhost_prepare_dma()\n");
++
++	dma_chan = host->dma_chan_rxtx;
++	if (data->flags & MMC_DATA_READ) {
++		dir_data = DMA_FROM_DEVICE;
++		dir_slave = DMA_DEV_TO_MEM;
++	} else {
++		dir_data = DMA_TO_DEVICE;
++		dir_slave = DMA_MEM_TO_DEV;
++	}
++	log_event("PRD1", dma_chan, 0);
++
++	BUG_ON(!dma_chan->device);
++	BUG_ON(!dma_chan->device->dev);
++	BUG_ON(!data->sg);
++
++	/* The block doesn't manage the FIFO DREQs properly for multi-block
++	   transfers, so don't attempt to DMA the final few words.
++	   Unfortunately this requires the final sg entry to be trimmed.
++	   N.B. This code demands that the overspill is contained in
++	   a single sg entry.
++	*/
++
++	host->drain_words = 0;
++	if ((data->blocks > 1) && (dir_data == DMA_FROM_DEVICE)) {
++		struct scatterlist *sg;
++		u32 len;
++		int i;
++
++		len = min((u32)(FIFO_READ_THRESHOLD - 1) * 4,
++			  (u32)data->blocks * data->blksz);
++
++		for_each_sg(data->sg, sg, data->sg_len, i) {
++			if (sg_is_last(sg)) {
++				BUG_ON(sg->length < len);
++				sg->length -= len;
++				host->drain_page = sg_page(sg);
++				host->drain_offset = sg->offset + sg->length;
++			}
++		}
++		host->drain_words = len/4;
++	}
++
++	/* The parameters have already been validated, so this will not fail */
++	(void)dmaengine_slave_config(dma_chan,
++				     (dir_data == DMA_FROM_DEVICE) ?
++				     &host->dma_cfg_rx :
++				     &host->dma_cfg_tx);
++
++	len = dma_map_sg(dma_chan->device->dev, data->sg, data->sg_len,
++			 dir_data);
++
++	log_event("PRD2", len, 0);
++	if (len > 0)
++		desc = dmaengine_prep_slave_sg(dma_chan, data->sg,
++					       len, dir_slave,
++					       DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
++	log_event("PRD3", desc, 0);
++
++	if (desc) {
++		desc->callback = bcm2835_sdhost_dma_complete;
++		desc->callback_param = host;
++		host->dma_desc = desc;
++		host->dma_chan = dma_chan;
++		host->dma_dir = dir_data;
++	}
++	log_event("PDM>", data, 0);
++}
++
++static void bcm2835_sdhost_start_dma(struct bcm2835_host *host)
++{
++	log_event("SDMA", host->data, host->dma_chan);
++	dmaengine_submit(host->dma_desc);
++	dma_async_issue_pending(host->dma_chan);
++}
++
++static void bcm2835_sdhost_set_transfer_irqs(struct bcm2835_host *host)
++{
++	u32 all_irqs = SDHCFG_DATA_IRPT_EN | SDHCFG_BLOCK_IRPT_EN |
++		SDHCFG_BUSY_IRPT_EN;
++	if (host->dma_desc)
++		host->hcfg = (host->hcfg & ~all_irqs) |
++			SDHCFG_BUSY_IRPT_EN;
++	else
++		host->hcfg = (host->hcfg & ~all_irqs) |
++			SDHCFG_DATA_IRPT_EN |
++			SDHCFG_BUSY_IRPT_EN;
++
++	bcm2835_sdhost_write(host, host->hcfg, SDHCFG);
++}
++
++static void bcm2835_sdhost_prepare_data(struct bcm2835_host *host, struct mmc_command *cmd)
++{
++	struct mmc_data *data = cmd->data;
++
++	WARN_ON(host->data);
++
++	host->data = data;
++	if (!data)
++		return;
++
++	/* Sanity checks */
++	BUG_ON(data->blksz * data->blocks > 524288);
++	BUG_ON(data->blksz > host->mmc->max_blk_size);
++	BUG_ON(data->blocks > 65535);
++
++	host->data_complete = 0;
++	host->flush_fifo = 0;
++	host->data->bytes_xfered = 0;
++
++	if (!host->sectors && host->mmc->card) {
++		struct mmc_card *card = host->mmc->card;
++		if (!mmc_card_sd(card) && mmc_card_blockaddr(card)) {
++			/*
++			 * The EXT_CSD sector count is in number of 512 byte
++			 * sectors.
++			 */
++			host->sectors = card->ext_csd.sectors;
++		} else {
++			/*
++			 * The CSD capacity field is in units of read_blkbits.
++			 * set_capacity takes units of 512 bytes.
++			 */
++			host->sectors = card->csd.capacity <<
++				(card->csd.read_blkbits - 9);
++		}
++	}
++
++	if (!host->dma_desc) {
++		/* Use PIO */
++		int flags = SG_MITER_ATOMIC;
++
++		if (data->flags & MMC_DATA_READ)
++			flags |= SG_MITER_TO_SG;
++		else
++			flags |= SG_MITER_FROM_SG;
++		sg_miter_start(&host->sg_miter, data->sg, data->sg_len, flags);
++		host->blocks = data->blocks;
++	}
++
++	bcm2835_sdhost_set_transfer_irqs(host);
++
++	bcm2835_sdhost_write(host, data->blksz, SDHBCT);
++	bcm2835_sdhost_write(host, data->blocks, SDHBLC);
++
++	BUG_ON(!host->data);
++}
++
++bool bcm2835_sdhost_send_command(struct bcm2835_host *host,
++				 struct mmc_command *cmd)
++{
++	u32 sdcmd, sdhsts;
++	unsigned long timeout;
++	int delay;
++
++	WARN_ON(host->cmd);
++	log_event("CMD<", cmd->opcode, cmd->arg);
++
++	if (cmd->data)
++		pr_debug("%s: send_command %d 0x%x "
++			 "(flags 0x%x) - %s %d*%d\n",
++			 mmc_hostname(host->mmc),
++			 cmd->opcode, cmd->arg, cmd->flags,
++			 (cmd->data->flags & MMC_DATA_READ) ?
++			 "read" : "write", cmd->data->blocks,
++			 cmd->data->blksz);
++	else
++		pr_debug("%s: send_command %d 0x%x (flags 0x%x)\n",
++			 mmc_hostname(host->mmc),
++			 cmd->opcode, cmd->arg, cmd->flags);
++
++	/* Wait max 100 ms */
++	timeout = 10000;
++
++	while (bcm2835_sdhost_read(host, SDCMD) & SDCMD_NEW_FLAG) {
++		if (timeout == 0) {
++			pr_warn("%s: previous command never completed.\n",
++				mmc_hostname(host->mmc));
++			if (host->debug)
++				bcm2835_sdhost_dumpregs(host);
++			cmd->error = -EILSEQ;
++			tasklet_schedule(&host->finish_tasklet);
++			return false;
++		}
++		timeout--;
++		udelay(10);
++	}
++
++	delay = (10000 - timeout)/100;
++	if (delay > host->max_delay) {
++		host->max_delay = delay;
++		pr_warn("%s: controller hung for %d ms\n",
++			   mmc_hostname(host->mmc),
++			   host->max_delay);
++	}
++
++	timeout = jiffies;
++	if (!cmd->data && cmd->busy_timeout > 9000)
++		timeout += DIV_ROUND_UP(cmd->busy_timeout, 1000) * HZ + HZ;
++	else
++		timeout += 10 * HZ;
++	mod_timer(&host->timer, timeout);
++
++	host->cmd = cmd;
++
++	/* Clear any error flags */
++	sdhsts = bcm2835_sdhost_read(host, SDHSTS);
++	if (sdhsts & SDHSTS_ERROR_MASK)
++		bcm2835_sdhost_write(host, sdhsts, SDHSTS);
++
++	if ((cmd->flags & MMC_RSP_136) && (cmd->flags & MMC_RSP_BUSY)) {
++		pr_err("%s: unsupported response type!\n",
++			mmc_hostname(host->mmc));
++		cmd->error = -EINVAL;
++		tasklet_schedule(&host->finish_tasklet);
++		return false;
++	}
++
++	bcm2835_sdhost_prepare_data(host, cmd);
++
++	bcm2835_sdhost_write(host, cmd->arg, SDARG);
++
++	sdcmd = cmd->opcode & SDCMD_CMD_MASK;
++
++	host->use_busy = 0;
++	if (!(cmd->flags & MMC_RSP_PRESENT)) {
++		sdcmd |= SDCMD_NO_RESPONSE;
++	} else {
++		if (cmd->flags & MMC_RSP_136)
++			sdcmd |= SDCMD_LONG_RESPONSE;
++		if (cmd->flags & MMC_RSP_BUSY) {
++			sdcmd |= SDCMD_BUSYWAIT;
++			host->use_busy = 1;
++		}
++	}
++
++	if (cmd->data) {
++		log_event("CMDD", cmd->data->blocks, cmd->data->blksz);
++		if (host->delay_after_this_stop) {
++			struct timespec64 now;
++			int time_since_stop;
++
++			ktime_get_real_ts64(&now);
++			time_since_stop = now.tv_sec - host->stop_time.tv_sec;
++			if (time_since_stop < 2) {
++				/* Possibly less than one second */
++				time_since_stop = time_since_stop * 1000000 +
++					(now.tv_nsec - host->stop_time.tv_nsec)/1000;
++				if (time_since_stop <
++				    host->delay_after_this_stop)
++					udelay(host->delay_after_this_stop -
++					       time_since_stop);
++			}
++		}
++
++		host->delay_after_this_stop = host->delay_after_stop;
++		if ((cmd->data->flags & MMC_DATA_READ) && !host->use_sbc) {
++			/* See if read crosses one of the hazardous sectors */
++			u32 first_blk, last_blk;
++
++			/* Intentionally include the following sector because
++			   without CMD23/SBC the read may run on. */
++			first_blk = host->mrq->cmd->arg;
++			last_blk = first_blk + cmd->data->blocks;
++
++			if (((last_blk >= (host->sectors - 64)) &&
++			     (first_blk <= (host->sectors - 64))) ||
++			    ((last_blk >= (host->sectors - 32)) &&
++			     (first_blk <= (host->sectors - 32)))) {
++				host->delay_after_this_stop =
++					max(250u, host->delay_after_stop);
++			}
++		}
++
++		if (cmd->data->flags & MMC_DATA_WRITE)
++			sdcmd |= SDCMD_WRITE_CMD;
++		if (cmd->data->flags & MMC_DATA_READ)
++			sdcmd |= SDCMD_READ_CMD;
++	}
++
++	bcm2835_sdhost_write(host, sdcmd | SDCMD_NEW_FLAG, SDCMD);
++
++	return true;
++}
++
++static void bcm2835_sdhost_finish_command(struct bcm2835_host *host,
++					  unsigned long *irq_flags);
++static void bcm2835_sdhost_transfer_complete(struct bcm2835_host *host);
++
++static void bcm2835_sdhost_finish_data(struct bcm2835_host *host)
++{
++	struct mmc_data *data;
++
++	data = host->data;
++	BUG_ON(!data);
++
++	log_event("FDA<", host->mrq, host->cmd);
++	pr_debug("finish_data(error %d, stop %d, sbc %d)\n",
++	       data->error, data->stop ? 1 : 0,
++	       host->mrq->sbc ? 1 : 0);
++
++	host->hcfg &= ~(SDHCFG_DATA_IRPT_EN | SDHCFG_BLOCK_IRPT_EN);
++	bcm2835_sdhost_write(host, host->hcfg, SDHCFG);
++
++	data->bytes_xfered = data->error ? 0 : (data->blksz * data->blocks);
++
++	host->data_complete = 1;
++
++	if (host->cmd) {
++		/*
++		 * Data managed to finish before the
++		 * command completed. Make sure we do
++		 * things in the proper order.
++		 */
++		pr_debug("Finished early - HSTS %x\n",
++			 bcm2835_sdhost_read(host, SDHSTS));
++	}
++	else
++		bcm2835_sdhost_transfer_complete(host);
++	log_event("FDA>", host->mrq, host->cmd);
++}
++
++static void bcm2835_sdhost_transfer_complete(struct bcm2835_host *host)
++{
++	struct mmc_data *data;
++
++	BUG_ON(host->cmd);
++	BUG_ON(!host->data);
++	BUG_ON(!host->data_complete);
++
++	data = host->data;
++	host->data = NULL;
++
++	log_event("TCM<", data, data->error);
++	pr_debug("transfer_complete(error %d, stop %d)\n",
++	       data->error, data->stop ? 1 : 0);
++
++	/*
++	 * Need to send CMD12 if -
++	 * a) open-ended multiblock transfer (no CMD23)
++	 * b) error in multiblock transfer
++	 */
++	if (host->mrq->stop && (data->error || !host->use_sbc)) {
++		if (bcm2835_sdhost_send_command(host, host->mrq->stop)) {
++			/* No busy, so poll for completion */
++			if (!host->use_busy)
++				bcm2835_sdhost_finish_command(host, NULL);
++
++			if (host->delay_after_this_stop)
++				ktime_get_real_ts64(&host->stop_time);
++		}
++	} else {
++		bcm2835_sdhost_wait_transfer_complete(host);
++		tasklet_schedule(&host->finish_tasklet);
++	}
++	log_event("TCM>", data, 0);
++}
++
++/* If irq_flags is valid, the caller is in a thread context and is allowed
++   to sleep */
++static void bcm2835_sdhost_finish_command(struct bcm2835_host *host,
++					  unsigned long *irq_flags)
++{
++	u32 sdcmd;
++	u32 retries;
++#ifdef DEBUG
++	struct timespec64 before, after;
++	int timediff = 0;
++#endif
++
++	log_event("FCM<", host->mrq, host->cmd);
++	pr_debug("finish_command(%x)\n", bcm2835_sdhost_read(host, SDCMD));
++
++	BUG_ON(!host->cmd || !host->mrq);
++
++	/* Poll quickly at first */
++
++	retries = host->cmd_quick_poll_retries;
++	if (!retries) {
++		/* Work out how many polls take 1us by timing 10us */
++		struct timespec64 start, now;
++		int us_diff;
++
++		retries = 1;
++		do {
++			int i;
++
++			retries *= 2;
++
++			ktime_get_real_ts64(&start);
++
++			for (i = 0; i < retries; i++) {
++				cpu_relax();
++				sdcmd = bcm2835_sdhost_read(host, SDCMD);
++			}
++
++			ktime_get_real_ts64(&now);
++			us_diff = (now.tv_sec - start.tv_sec) * 1000000 +
++				(now.tv_nsec - start.tv_nsec)/1000;
++		} while (us_diff < 10);
++
++		host->cmd_quick_poll_retries = ((retries * us_diff + 9)*CMD_DALLY_US)/10 + 1;
++		retries = 1; // We've already waited long enough this time
++	}
++
++	for (sdcmd = bcm2835_sdhost_read(host, SDCMD);
++	     (sdcmd & SDCMD_NEW_FLAG) && retries;
++	     retries--) {
++		cpu_relax();
++		sdcmd = bcm2835_sdhost_read(host, SDCMD);
++	}
++
++	if (!retries) {
++		unsigned long wait_max;
++
++		if (!irq_flags) {
++			/* Schedule the work */
++			log_event("CWWQ", 0, 0);
++			schedule_work(&host->cmd_wait_wq);
++			return;
++		}
++
++		/* Wait max 100 ms */
++		wait_max = jiffies + msecs_to_jiffies(100);
++		while (time_before(jiffies, wait_max)) {
++			spin_unlock_irqrestore(&host->lock, *irq_flags);
++			usleep_range(1, 10);
++			spin_lock_irqsave(&host->lock, *irq_flags);
++			sdcmd = bcm2835_sdhost_read(host, SDCMD);
++			if (!(sdcmd & SDCMD_NEW_FLAG))
++				break;
++		}
++	}
++
++	/* Check for errors */
++	if (sdcmd & SDCMD_NEW_FLAG) {
++		if (host->debug) {
++			pr_err("%s: command %d never completed.\n",
++			       mmc_hostname(host->mmc), host->cmd->opcode);
++			bcm2835_sdhost_dumpregs(host);
++		}
++		host->cmd->error = -EILSEQ;
++		tasklet_schedule(&host->finish_tasklet);
++		return;
++	} else if (sdcmd & SDCMD_FAIL_FLAG) {
++		u32 sdhsts = bcm2835_sdhost_read(host, SDHSTS);
++
++		/* Clear the errors */
++		bcm2835_sdhost_write(host, SDHSTS_ERROR_MASK, SDHSTS);
++
++		if (host->debug)
++			pr_info("%s: error detected - CMD %x, HSTS %03x, EDM %x\n",
++				mmc_hostname(host->mmc), sdcmd, sdhsts,
++				bcm2835_sdhost_read(host, SDEDM));
++
++		if ((sdhsts & SDHSTS_CRC7_ERROR) &&
++		    (host->cmd->opcode == 1)) {
++			if (host->debug)
++				pr_info("%s: ignoring CRC7 error for CMD1\n",
++					mmc_hostname(host->mmc));
++		} else {
++			u32 edm, fsm;
++
++			if (sdhsts & SDHSTS_CMD_TIME_OUT) {
++				if (host->debug)
++					pr_warn("%s: command %d timeout\n",
++					       mmc_hostname(host->mmc),
++					       host->cmd->opcode);
++				host->cmd->error = -ETIMEDOUT;
++			} else {
++				pr_warn("%s: unexpected command %d error\n",
++				       mmc_hostname(host->mmc),
++				       host->cmd->opcode);
++				host->cmd->error = -EILSEQ;
++			}
++
++			edm = readl(host->ioaddr + SDEDM);
++			fsm = edm & SDEDM_FSM_MASK;
++			if (fsm == SDEDM_FSM_READWAIT ||
++			    fsm == SDEDM_FSM_WRITESTART1)
++				writel(edm | SDEDM_FORCE_DATA_MODE,
++				       host->ioaddr + SDEDM);
++			tasklet_schedule(&host->finish_tasklet);
++			return;
++		}
++	}
++
++	if (host->cmd->flags & MMC_RSP_PRESENT) {
++		if (host->cmd->flags & MMC_RSP_136) {
++			int i;
++			for (i = 0; i < 4; i++)
++				host->cmd->resp[3 - i] = bcm2835_sdhost_read(host, SDRSP0 + i*4);
++			pr_debug("%s: finish_command %08x %08x %08x %08x\n",
++				 mmc_hostname(host->mmc),
++				 host->cmd->resp[0], host->cmd->resp[1], host->cmd->resp[2], host->cmd->resp[3]);
++			log_event("RSP ", host->cmd->resp[0], host->cmd->resp[1]);
++		} else {
++			host->cmd->resp[0] = bcm2835_sdhost_read(host, SDRSP0);
++			pr_debug("%s: finish_command %08x\n",
++				 mmc_hostname(host->mmc),
++				 host->cmd->resp[0]);
++			log_event("RSP ", host->cmd->resp[0], 0);
++		}
++	}
++
++	if (host->cmd == host->mrq->sbc) {
++		/* Finished CMD23, now send actual command. */
++		host->cmd = NULL;
++		if (bcm2835_sdhost_send_command(host, host->mrq->cmd)) {
++			if (host->data && host->dma_desc)
++				/* DMA transfer starts now, PIO starts after irq */
++				bcm2835_sdhost_start_dma(host);
++
++			if (!host->use_busy)
++				bcm2835_sdhost_finish_command(host, NULL);
++		}
++	} else if (host->cmd == host->mrq->stop) {
++		/* Finished CMD12 */
++		tasklet_schedule(&host->finish_tasklet);
++	} else {
++		/* Processed actual command. */
++		host->cmd = NULL;
++		if (!host->data)
++			tasklet_schedule(&host->finish_tasklet);
++		else if (host->data_complete)
++			bcm2835_sdhost_transfer_complete(host);
++	}
++	log_event("FCM>", host->mrq, host->cmd);
++}
++
++static void bcm2835_sdhost_timeout(struct timer_list *t)
++{
++	struct bcm2835_host *host = from_timer(host, t, timer);
++	unsigned long flags;
++
++	spin_lock_irqsave(&host->lock, flags);
++	log_event("TIM<", 0, 0);
++
++	if (host->mrq) {
++		pr_err("%s: timeout waiting for hardware interrupt.\n",
++			mmc_hostname(host->mmc));
++		log_dump();
++		bcm2835_sdhost_dumpregs(host);
++
++		if (host->data) {
++			host->data->error = -ETIMEDOUT;
++			bcm2835_sdhost_finish_data(host);
++		} else {
++			if (host->cmd)
++				host->cmd->error = -ETIMEDOUT;
++			else
++				host->mrq->cmd->error = -ETIMEDOUT;
++
++			pr_debug("timeout_timer tasklet_schedule\n");
++			tasklet_schedule(&host->finish_tasklet);
++		}
++	}
++
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++static void bcm2835_sdhost_busy_irq(struct bcm2835_host *host, u32 intmask)
++{
++	log_event("IRQB", host->cmd, intmask);
++	if (!host->cmd) {
++		pr_err("%s: got command busy interrupt 0x%08x even "
++			"though no command operation was in progress.\n",
++			mmc_hostname(host->mmc), (unsigned)intmask);
++		bcm2835_sdhost_dumpregs(host);
++		return;
++	}
++
++	if (!host->use_busy) {
++		pr_err("%s: got command busy interrupt 0x%08x even "
++			"though not expecting one.\n",
++			mmc_hostname(host->mmc), (unsigned)intmask);
++		bcm2835_sdhost_dumpregs(host);
++		return;
++	}
++	host->use_busy = 0;
++
++	if (intmask & SDHSTS_ERROR_MASK)
++	{
++		pr_err("sdhost_busy_irq: intmask %x, data %p\n", intmask, host->mrq->data);
++		if (intmask & SDHSTS_CRC7_ERROR)
++			host->cmd->error = -EILSEQ;
++		else if (intmask & (SDHSTS_CRC16_ERROR |
++				    SDHSTS_FIFO_ERROR)) {
++			if (host->mrq->data)
++				host->mrq->data->error = -EILSEQ;
++			else
++				host->cmd->error = -EILSEQ;
++		} else if (intmask & SDHSTS_REW_TIME_OUT) {
++			if (host->mrq->data)
++				host->mrq->data->error = -ETIMEDOUT;
++			else
++				host->cmd->error = -ETIMEDOUT;
++		} else if (intmask & SDHSTS_CMD_TIME_OUT)
++			host->cmd->error = -ETIMEDOUT;
++
++		if (host->debug) {
++			log_dump();
++			bcm2835_sdhost_dumpregs(host);
++		}
++	}
++	else
++		bcm2835_sdhost_finish_command(host, NULL);
++}
++
++static void bcm2835_sdhost_data_irq(struct bcm2835_host *host, u32 intmask)
++{
++	/* There are no dedicated data/space available interrupt
++	   status bits, so it is necessary to use the single shared
++	   data/space available FIFO status bits. It is therefore not
++	   an error to get here when there is no data transfer in
++	   progress. */
++	log_event("IRQD", host->data, intmask);
++	if (!host->data)
++		return;
++
++	if (intmask & (SDHSTS_CRC16_ERROR |
++		       SDHSTS_FIFO_ERROR |
++		       SDHSTS_REW_TIME_OUT)) {
++		if (intmask & (SDHSTS_CRC16_ERROR |
++			       SDHSTS_FIFO_ERROR))
++			host->data->error = -EILSEQ;
++		else
++			host->data->error = -ETIMEDOUT;
++
++		if (host->debug) {
++			log_dump();
++			bcm2835_sdhost_dumpregs(host);
++		}
++	}
++
++	if (host->data->error) {
++		bcm2835_sdhost_finish_data(host);
++	} else if (host->data->flags & MMC_DATA_WRITE) {
++		/* Use the block interrupt for writes after the first block */
++		host->hcfg &= ~(SDHCFG_DATA_IRPT_EN);
++		host->hcfg |= SDHCFG_BLOCK_IRPT_EN;
++		bcm2835_sdhost_write(host, host->hcfg, SDHCFG);
++		bcm2835_sdhost_transfer_pio(host);
++	} else {
++		bcm2835_sdhost_transfer_pio(host);
++		host->blocks--;
++		if ((host->blocks == 0) || host->data->error)
++			bcm2835_sdhost_finish_data(host);
++	}
++}
++
++static void bcm2835_sdhost_block_irq(struct bcm2835_host *host, u32 intmask)
++{
++	log_event("IRQK", host->data, intmask);
++	if (!host->data) {
++		pr_err("%s: got block interrupt 0x%08x even "
++			"though no data operation was in progress.\n",
++			mmc_hostname(host->mmc), (unsigned)intmask);
++		bcm2835_sdhost_dumpregs(host);
++		return;
++	}
++
++	if (intmask & (SDHSTS_CRC16_ERROR |
++		       SDHSTS_FIFO_ERROR |
++		       SDHSTS_REW_TIME_OUT)) {
++		if (intmask & (SDHSTS_CRC16_ERROR |
++			       SDHSTS_FIFO_ERROR))
++			host->data->error = -EILSEQ;
++		else
++			host->data->error = -ETIMEDOUT;
++
++		if (host->debug) {
++			log_dump();
++			bcm2835_sdhost_dumpregs(host);
++		}
++	}
++
++	if (!host->dma_desc) {
++		BUG_ON(!host->blocks);
++		if (host->data->error || (--host->blocks == 0)) {
++			bcm2835_sdhost_finish_data(host);
++		} else {
++			bcm2835_sdhost_transfer_pio(host);
++		}
++	} else if (host->data->flags & MMC_DATA_WRITE) {
++		bcm2835_sdhost_finish_data(host);
++	}
++}
++
++static irqreturn_t bcm2835_sdhost_irq(int irq, void *dev_id)
++{
++	irqreturn_t result = IRQ_NONE;
++	struct bcm2835_host *host = dev_id;
++	u32 intmask;
++
++	spin_lock(&host->lock);
++
++	intmask = bcm2835_sdhost_read(host, SDHSTS);
++	log_event("IRQ<", intmask, 0);
++
++	bcm2835_sdhost_write(host,
++			     SDHSTS_BUSY_IRPT |
++			     SDHSTS_BLOCK_IRPT |
++			     SDHSTS_SDIO_IRPT |
++			     SDHSTS_DATA_FLAG,
++			     SDHSTS);
++
++	if (intmask & SDHSTS_BLOCK_IRPT) {
++		bcm2835_sdhost_block_irq(host, intmask);
++		result = IRQ_HANDLED;
++	}
++
++	if (intmask & SDHSTS_BUSY_IRPT) {
++		bcm2835_sdhost_busy_irq(host, intmask);
++		result = IRQ_HANDLED;
++	}
++
++	/* There is no true data interrupt status bit, so it is
++	   necessary to qualify the data flag with the interrupt
++	   enable bit */
++	if ((intmask & SDHSTS_DATA_FLAG) &&
++	    (host->hcfg & SDHCFG_DATA_IRPT_EN)) {
++		bcm2835_sdhost_data_irq(host, intmask);
++		result = IRQ_HANDLED;
++	}
++
++	log_event("IRQ>", bcm2835_sdhost_read(host, SDHSTS), 0);
++	spin_unlock(&host->lock);
++
++	return result;
++}
++
++void bcm2835_sdhost_set_clock(struct bcm2835_host *host, unsigned int clock)
++{
++	int div = 0; /* Initialized for compiler warning */
++	unsigned int input_clock = clock;
++	unsigned long flags;
++
++	if (host->debug)
++		pr_info("%s: set_clock(%d)\n", mmc_hostname(host->mmc), clock);
++
++	if (host->overclock_50 && (clock == 50*MHZ))
++		clock = host->overclock_50 * MHZ + (MHZ - 1);
++
++	/* The SDCDIV register has 11 bits, and holds (div - 2).
++	   But in data mode the max is 50MHz wihout a minimum, and only the
++	   bottom 3 bits are used. Since the switch over is automatic (unless
++	   we have marked the card as slow...), chosen values have to make
++	   sense in both modes.
++	   Ident mode must be 100-400KHz, so can range check the requested
++	   clock. CMD15 must be used to return to data mode, so this can be
++	   monitored.
++
++	   clock 250MHz -> 0->125MHz, 1->83.3MHz, 2->62.5MHz, 3->50.0MHz
++                           4->41.7MHz, 5->35.7MHz, 6->31.3MHz, 7->27.8MHz
++
++			 623->400KHz/27.8MHz
++			 reset value (507)->491159/50MHz
++
++	   BUT, the 3-bit clock divisor in data mode is too small if the
++	   core clock is higher than 250MHz, so instead use the SLOW_CARD
++	   configuration bit to force the use of the ident clock divisor
++	   at all times.
++	*/
++
++	host->mmc->actual_clock = 0;
++
++	if (host->firmware_sets_cdiv) {
++		u32 msg[3] = { clock, 0, 0 };
++
++		rpi_firmware_property(host->fw,
++				      RPI_FIRMWARE_SET_SDHOST_CLOCK,
++				      &msg, sizeof(msg));
++
++		clock = max(msg[1], msg[2]);
++		spin_lock_irqsave(&host->lock, flags);
++	} else {
++		spin_lock_irqsave(&host->lock, flags);
++		if (clock < 100000) {
++			/* Can't stop the clock, but make it as slow as
++			 * possible to show willing
++			 */
++			host->cdiv = SDCDIV_MAX_CDIV;
++			bcm2835_sdhost_write(host, host->cdiv, SDCDIV);
++			spin_unlock_irqrestore(&host->lock, flags);
++			return;
++		}
++
++		div = host->max_clk / clock;
++		if (div < 2)
++			div = 2;
++		if ((host->max_clk / div) > clock)
++			div++;
++		div -= 2;
++
++		if (div > SDCDIV_MAX_CDIV)
++			div = SDCDIV_MAX_CDIV;
++
++		clock = host->max_clk / (div + 2);
++
++		host->cdiv = div;
++		bcm2835_sdhost_write(host, host->cdiv, SDCDIV);
++
++		if (host->debug)
++			pr_info("%s: clock=%d -> max_clk=%d, cdiv=%x "
++				"(actual clock %d)\n",
++				mmc_hostname(host->mmc), input_clock,
++				host->max_clk, host->cdiv,
++				clock);
++	}
++
++	/* Calibrate some delays */
++
++	host->ns_per_fifo_word = (1000000000/clock) *
++		((host->mmc->caps & MMC_CAP_4_BIT_DATA) ? 8 : 32);
++
++	if (input_clock == 50 * MHZ) {
++		if (clock > input_clock) {
++			/* Save the closest value, to make it easier
++			   to reduce in the event of error */
++			host->overclock_50 = (clock/MHZ);
++
++			if (clock != host->overclock) {
++				pr_info("%s: overclocking to %dHz\n",
++					mmc_hostname(host->mmc), clock);
++				host->overclock = clock;
++			}
++		} else if (host->overclock) {
++			host->overclock = 0;
++			if (clock == 50 * MHZ)
++				pr_warn("%s: cancelling overclock\n",
++					mmc_hostname(host->mmc));
++		}
++	} else if (input_clock == 0) {
++		/* Reset the preferred overclock when the clock is stopped.
++		 * This always happens during initialisation. */
++		host->overclock_50 = host->user_overclock_50;
++		host->overclock = 0;
++	}
++
++	/* Set the timeout to 500ms */
++	bcm2835_sdhost_write(host, clock/2, SDTOUT);
++
++	host->mmc->actual_clock = clock;
++	host->clock = input_clock;
++	host->reset_clock = 0;
++
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++static void bcm2835_sdhost_request(struct mmc_host *mmc, struct mmc_request *mrq)
++{
++	struct bcm2835_host *host;
++	unsigned long flags;
++	u32 edm, fsm;
++
++	host = mmc_priv(mmc);
++
++	if (host->debug) {
++		struct mmc_command *cmd = mrq->cmd;
++		BUG_ON(!cmd);
++		if (cmd->data)
++			pr_info("%s: cmd %d 0x%x (flags 0x%x) - %s %d*%d\n",
++				mmc_hostname(mmc),
++				cmd->opcode, cmd->arg, cmd->flags,
++				(cmd->data->flags & MMC_DATA_READ) ?
++				"read" : "write", cmd->data->blocks,
++				cmd->data->blksz);
++		else
++			pr_info("%s: cmd %d 0x%x (flags 0x%x)\n",
++				mmc_hostname(mmc),
++				cmd->opcode, cmd->arg, cmd->flags);
++	}
++
++	/* Reset the error statuses in case this is a retry */
++	if (mrq->sbc)
++		mrq->sbc->error = 0;
++	if (mrq->cmd)
++		mrq->cmd->error = 0;
++	if (mrq->data)
++		mrq->data->error = 0;
++	if (mrq->stop)
++		mrq->stop->error = 0;
++
++	if (mrq->data && !is_power_of_2(mrq->data->blksz)) {
++		pr_err("%s: unsupported block size (%d bytes)\n",
++		       mmc_hostname(mmc), mrq->data->blksz);
++		mrq->cmd->error = -EINVAL;
++		mmc_request_done(mmc, mrq);
++		return;
++	}
++
++	if (host->use_dma && mrq->data &&
++	    (mrq->data->blocks > host->pio_limit))
++		bcm2835_sdhost_prepare_dma(host, mrq->data);
++
++	if (host->reset_clock)
++	    bcm2835_sdhost_set_clock(host, host->clock);
++
++	spin_lock_irqsave(&host->lock, flags);
++
++	WARN_ON(host->mrq != NULL);
++	host->mrq = mrq;
++
++	edm = bcm2835_sdhost_read(host, SDEDM);
++	fsm = edm & SDEDM_FSM_MASK;
++
++	log_event("REQ<", mrq, edm);
++	if ((fsm != SDEDM_FSM_IDENTMODE) &&
++	    (fsm != SDEDM_FSM_DATAMODE)) {
++		log_event("REQ!", mrq, edm);
++		if (host->debug) {
++			pr_warn("%s: previous command (%d) not complete (EDM %x)\n",
++			       mmc_hostname(host->mmc),
++			       bcm2835_sdhost_read(host, SDCMD) & SDCMD_CMD_MASK,
++			       edm);
++			log_dump();
++			bcm2835_sdhost_dumpregs(host);
++		}
++		mrq->cmd->error = -EILSEQ;
++		tasklet_schedule(&host->finish_tasklet);
++		spin_unlock_irqrestore(&host->lock, flags);
++		return;
++	}
++
++	host->use_sbc = !!mrq->sbc &&
++		(host->mrq->data->flags & USE_CMD23_FLAGS);
++	if (host->use_sbc) {
++		if (bcm2835_sdhost_send_command(host, mrq->sbc)) {
++			if (!host->use_busy)
++				bcm2835_sdhost_finish_command(host, &flags);
++		}
++	} else if (bcm2835_sdhost_send_command(host, mrq->cmd)) {
++		if (host->data && host->dma_desc)
++			/* DMA transfer starts now, PIO starts after irq */
++			bcm2835_sdhost_start_dma(host);
++
++		if (!host->use_busy)
++			bcm2835_sdhost_finish_command(host, &flags);
++	}
++
++	log_event("CMD ", mrq->cmd->opcode,
++		   mrq->data ? (u32)mrq->data->blksz : 0);
++
++	log_event("REQ>", mrq, 0);
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++static void bcm2835_sdhost_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
++{
++
++	struct bcm2835_host *host = mmc_priv(mmc);
++	unsigned long flags;
++
++	if (host->debug)
++		pr_info("%s: ios clock %d, pwr %d, bus_width %d, "
++			"timing %d, vdd %d, drv_type %d\n",
++			mmc_hostname(mmc),
++			ios->clock, ios->power_mode, ios->bus_width,
++			ios->timing, ios->signal_voltage, ios->drv_type);
++
++	spin_lock_irqsave(&host->lock, flags);
++
++	log_event("IOS<", ios->clock, 0);
++
++	/* set bus width */
++	host->hcfg &= ~SDHCFG_WIDE_EXT_BUS;
++	if (ios->bus_width == MMC_BUS_WIDTH_4)
++		host->hcfg |= SDHCFG_WIDE_EXT_BUS;
++
++	host->hcfg |= SDHCFG_WIDE_INT_BUS;
++
++	/* Disable clever clock switching, to cope with fast core clocks */
++	host->hcfg |= SDHCFG_SLOW_CARD;
++
++	bcm2835_sdhost_write(host, host->hcfg, SDHCFG);
++
++	spin_unlock_irqrestore(&host->lock, flags);
++
++	if (!ios->clock || ios->clock != host->clock)
++		bcm2835_sdhost_set_clock(host, ios->clock);
++}
++
++static struct mmc_host_ops bcm2835_sdhost_ops = {
++	.request = bcm2835_sdhost_request,
++	.set_ios = bcm2835_sdhost_set_ios,
++// todo:fix	.hw_reset = bcm2835_sdhost_reset,
++};
++
++static void bcm2835_sdhost_cmd_wait_work(struct work_struct *work)
++{
++	struct bcm2835_host *host;
++	unsigned long flags;
++
++	host = container_of(work, struct bcm2835_host, cmd_wait_wq);
++
++	spin_lock_irqsave(&host->lock, flags);
++
++	log_event("CWK<", host->cmd, host->mrq);
++
++	/*
++	 * If this tasklet gets rescheduled while running, it will
++	 * be run again afterwards but without any active request.
++	 */
++	if (!host->mrq) {
++		spin_unlock_irqrestore(&host->lock, flags);
++		return;
++	}
++
++	bcm2835_sdhost_finish_command(host, &flags);
++
++	log_event("CWK>", host->cmd, 0);
++
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++static void bcm2835_sdhost_tasklet_finish(unsigned long param)
++{
++	struct bcm2835_host *host;
++	unsigned long flags;
++	struct mmc_request *mrq;
++	struct dma_chan *terminate_chan = NULL;
++
++	host = (struct bcm2835_host *)param;
++
++	spin_lock_irqsave(&host->lock, flags);
++
++	log_event("TSK<", host->mrq, 0);
++	/*
++	 * If this tasklet gets rescheduled while running, it will
++	 * be run again afterwards but without any active request.
++	 */
++	if (!host->mrq) {
++		spin_unlock_irqrestore(&host->lock, flags);
++		return;
++	}
++
++	del_timer(&host->timer);
++
++	mrq = host->mrq;
++
++	/* Drop the overclock after any data corruption, or after any
++	 * error while overclocked. Ignore errors for status commands,
++	 * as they are likely when a card is ejected. */
++	if (host->overclock) {
++		if ((mrq->cmd && mrq->cmd->error &&
++		     (mrq->cmd->opcode != MMC_SEND_STATUS)) ||
++		    (mrq->data && mrq->data->error) ||
++		    (mrq->stop && mrq->stop->error) ||
++		    (mrq->sbc && mrq->sbc->error)) {
++			host->overclock_50--;
++			pr_warn("%s: reducing overclock due to errors\n",
++				mmc_hostname(host->mmc));
++			host->reset_clock = 1;
++			mrq->cmd->error = -ETIMEDOUT;
++			mrq->cmd->retries = 1;
++		}
++	}
++
++	host->mrq = NULL;
++	host->cmd = NULL;
++	host->data = NULL;
++
++	host->dma_desc = NULL;
++	terminate_chan = host->dma_chan;
++	host->dma_chan = NULL;
++
++	spin_unlock_irqrestore(&host->lock, flags);
++
++	if (terminate_chan)
++	{
++		int err = dmaengine_terminate_all(terminate_chan);
++		if (err)
++			pr_err("%s: failed to terminate DMA (%d)\n",
++			       mmc_hostname(host->mmc), err);
++	}
++
++	/* The SDHOST block doesn't report any errors for a disconnected
++	   interface. All cards and SDIO devices should report some supported
++	   voltage range, so a zero response to SEND_OP_COND, IO_SEND_OP_COND
++	   or APP_SEND_OP_COND can be treated as an error. */
++	if (((mrq->cmd->opcode == MMC_SEND_OP_COND) ||
++	     (mrq->cmd->opcode == SD_IO_SEND_OP_COND) ||
++	     (mrq->cmd->opcode == SD_APP_OP_COND)) &&
++	    (mrq->cmd->error == 0) &&
++	    (mrq->cmd->resp[0] == 0)) {
++		mrq->cmd->error = -ETIMEDOUT;
++		if (host->debug)
++			pr_info("%s: faking timeout due to zero OCR\n",
++				mmc_hostname(host->mmc));
++	}
++
++	mmc_request_done(host->mmc, mrq);
++	log_event("TSK>", mrq, 0);
++}
++
++int bcm2835_sdhost_add_host(struct bcm2835_host *host)
++{
++	struct mmc_host *mmc;
++	struct dma_slave_config cfg;
++	char pio_limit_string[20];
++	int ret;
++
++	mmc = host->mmc;
++
++	if (!mmc->f_max || mmc->f_max > host->max_clk)
++		mmc->f_max = host->max_clk;
++	mmc->f_min = host->max_clk / SDCDIV_MAX_CDIV;
++
++	mmc->max_busy_timeout =  (~(unsigned int)0)/(mmc->f_max/1000);
++
++	pr_debug("f_max %d, f_min %d, max_busy_timeout %d\n",
++		 mmc->f_max, mmc->f_min, mmc->max_busy_timeout);
++
++	/* host controller capabilities */
++	mmc->caps |=
++		MMC_CAP_SD_HIGHSPEED | MMC_CAP_MMC_HIGHSPEED |
++		MMC_CAP_NEEDS_POLL | MMC_CAP_HW_RESET |
++		((ALLOW_CMD23_READ|ALLOW_CMD23_WRITE) * MMC_CAP_CMD23);
++
++	spin_lock_init(&host->lock);
++
++	if (host->allow_dma) {
++		if (IS_ERR_OR_NULL(host->dma_chan_rxtx)) {
++			pr_err("%s: unable to initialise DMA channel. "
++			       "Falling back to PIO\n",
++			       mmc_hostname(mmc));
++			host->use_dma = false;
++		} else {
++			cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++			cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++
++			/* Validate the slave configurations */
++
++			cfg.direction = DMA_MEM_TO_DEV;
++			cfg.src_addr = 0;
++			cfg.dst_addr = host->bus_addr + SDDATA;
++
++			ret = dmaengine_slave_config(host->dma_chan_rxtx, &cfg);
++
++			if (ret == 0) {
++				host->dma_cfg_tx = cfg;
++
++				cfg.direction = DMA_DEV_TO_MEM;
++				cfg.src_addr = host->bus_addr + SDDATA;
++				cfg.dst_addr = 0;
++
++				ret = dmaengine_slave_config(host->dma_chan_rxtx, &cfg);
++			}
++
++			if (ret == 0) {
++				host->dma_cfg_rx = cfg;
++
++				host->use_dma = true;
++			} else {
++				pr_err("%s: unable to configure DMA channel. "
++				       "Falling back to PIO\n",
++				       mmc_hostname(mmc));
++				dma_release_channel(host->dma_chan_rxtx);
++				host->dma_chan_rxtx = NULL;
++				host->use_dma = false;
++			}
++		}
++	} else {
++		host->use_dma = false;
++	}
++
++	mmc->max_segs = 128;
++	mmc->max_req_size = 524288;
++	mmc->max_seg_size = mmc->max_req_size;
++	mmc->max_blk_size = 512;
++	mmc->max_blk_count =  65535;
++
++	/* report supported voltage ranges */
++	mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
++
++	tasklet_init(&host->finish_tasklet,
++		bcm2835_sdhost_tasklet_finish, (unsigned long)host);
++
++	INIT_WORK(&host->cmd_wait_wq, bcm2835_sdhost_cmd_wait_work);
++
++	timer_setup(&host->timer, bcm2835_sdhost_timeout, 0);
++
++	bcm2835_sdhost_init(host, 0);
++
++	ret = request_irq(host->irq, bcm2835_sdhost_irq, 0 /*IRQF_SHARED*/,
++				  mmc_hostname(mmc), host);
++	if (ret) {
++		pr_err("%s: failed to request IRQ %d: %d\n",
++		       mmc_hostname(mmc), host->irq, ret);
++		goto untasklet;
++	}
++
++	mmc_add_host(mmc);
++
++	pio_limit_string[0] = '\0';
++	if (host->use_dma && (host->pio_limit > 0))
++		sprintf(pio_limit_string, " (>%d)", host->pio_limit);
++	pr_info("%s: %s loaded - DMA %s%s\n",
++		mmc_hostname(mmc), DRIVER_NAME,
++		host->use_dma ? "enabled" : "disabled",
++		pio_limit_string);
++
++	return 0;
++
++untasklet:
++	tasklet_kill(&host->finish_tasklet);
++
++	return ret;
++}
++
++static int bcm2835_sdhost_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct device_node *node = dev->of_node;
++	struct clk *clk;
++	struct resource *iomem;
++	struct bcm2835_host *host;
++	struct mmc_host *mmc;
++	const __be32 *addr;
++	u32 msg[3];
++	int na;
++	int ret;
++
++	pr_debug("bcm2835_sdhost_probe\n");
++	mmc = mmc_alloc_host(sizeof(*host), dev);
++	if (!mmc)
++		return -ENOMEM;
++
++	mmc->ops = &bcm2835_sdhost_ops;
++	host = mmc_priv(mmc);
++	host->mmc = mmc;
++	host->pio_timeout = msecs_to_jiffies(500);
++	host->pio_limit = 1;
++	host->max_delay = 1; /* Warn if over 1ms */
++	host->allow_dma = 1;
++	spin_lock_init(&host->lock);
++
++	iomem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	host->ioaddr = devm_ioremap_resource(dev, iomem);
++	if (IS_ERR(host->ioaddr)) {
++		ret = PTR_ERR(host->ioaddr);
++		goto err;
++	}
++
++	na = of_n_addr_cells(node);
++	addr = of_get_address(node, 0, NULL, NULL);
++	if (!addr) {
++		dev_err(dev, "could not get DMA-register address\n");
++		return -ENODEV;
++	}
++	host->bus_addr = (phys_addr_t)of_read_number(addr, na);
++	pr_debug(" - ioaddr %lx, iomem->start %lx, bus_addr %lx\n",
++		 (unsigned long)host->ioaddr,
++		 (unsigned long)iomem->start,
++		 (unsigned long)host->bus_addr);
++
++	if (node) {
++		/* Read any custom properties */
++		of_property_read_u32(node,
++				     "brcm,delay-after-stop",
++				     &host->delay_after_stop);
++		of_property_read_u32(node,
++				     "brcm,overclock-50",
++				     &host->user_overclock_50);
++		of_property_read_u32(node,
++				     "brcm,pio-limit",
++				     &host->pio_limit);
++		host->allow_dma =
++			!of_property_read_bool(node, "brcm,force-pio");
++		host->debug = of_property_read_bool(node, "brcm,debug");
++	}
++
++	host->dma_chan = NULL;
++	host->dma_desc = NULL;
++
++	/* Formally recognise the other way of disabling DMA */
++	if (host->pio_limit == 0x7fffffff)
++		host->allow_dma = false;
++
++	if (host->allow_dma) {
++		if (node) {
++			host->dma_chan_rxtx =
++				dma_request_slave_channel(dev, "rx-tx");
++			if (!host->dma_chan_rxtx)
++				host->dma_chan_rxtx =
++					dma_request_slave_channel(dev, "tx");
++			if (!host->dma_chan_rxtx)
++				host->dma_chan_rxtx =
++					dma_request_slave_channel(dev, "rx");
++		} else {
++			dma_cap_mask_t mask;
++
++			dma_cap_zero(mask);
++			/* we don't care about the channel, any would work */
++			dma_cap_set(DMA_SLAVE, mask);
++			host->dma_chan_rxtx =
++				dma_request_channel(mask, NULL, NULL);
++		}
++	}
++
++	clk = devm_clk_get(dev, NULL);
++	if (IS_ERR(clk)) {
++		ret = PTR_ERR(clk);
++		if (ret == -EPROBE_DEFER)
++			dev_info(dev, "could not get clk, deferring probe\n");
++		else
++			dev_err(dev, "could not get clk\n");
++		goto err;
++	}
++
++	host->fw = rpi_firmware_get(
++		of_parse_phandle(dev->of_node, "firmware", 0));
++	if (!host->fw) {
++		ret = -EPROBE_DEFER;
++		goto err;
++	}
++
++	host->max_clk = clk_get_rate(clk);
++
++	host->irq = platform_get_irq(pdev, 0);
++	if (host->irq <= 0) {
++		dev_err(dev, "get IRQ failed\n");
++		ret = -EINVAL;
++		goto err;
++	}
++
++	pr_debug(" - max_clk %lx, irq %d\n",
++		 (unsigned long)host->max_clk,
++		 (int)host->irq);
++
++	log_init(dev, iomem->start - host->bus_addr);
++
++	if (node)
++		mmc_of_parse(mmc);
++	else
++		mmc->caps |= MMC_CAP_4_BIT_DATA;
++
++	msg[0] = 0;
++	msg[1] = ~0;
++	msg[2] = ~0;
++
++	rpi_firmware_property(host->fw,
++			      RPI_FIRMWARE_SET_SDHOST_CLOCK,
++			      &msg, sizeof(msg));
++
++	host->firmware_sets_cdiv = (msg[1] != ~0);
++
++	ret = bcm2835_sdhost_add_host(host);
++	if (ret)
++		goto err;
++
++	platform_set_drvdata(pdev, host);
++
++	pr_debug("bcm2835_sdhost_probe -> OK\n");
++
++	return 0;
++
++err:
++	pr_debug("bcm2835_sdhost_probe -> err %d\n", ret);
++	if (host->fw)
++		rpi_firmware_put(host->fw);
++	if (host->dma_chan_rxtx)
++		dma_release_channel(host->dma_chan_rxtx);
++	mmc_free_host(mmc);
++
++	return ret;
++}
++
++static int bcm2835_sdhost_remove(struct platform_device *pdev)
++{
++	struct bcm2835_host *host = platform_get_drvdata(pdev);
++
++	pr_debug("bcm2835_sdhost_remove\n");
++
++	mmc_remove_host(host->mmc);
++
++	bcm2835_sdhost_set_power(host, false);
++
++	free_irq(host->irq, host);
++
++	del_timer_sync(&host->timer);
++
++	tasklet_kill(&host->finish_tasklet);
++	rpi_firmware_put(host->fw);
++	if (host->dma_chan_rxtx)
++		dma_release_channel(host->dma_chan_rxtx);
++	mmc_free_host(host->mmc);
++	platform_set_drvdata(pdev, NULL);
++
++	pr_debug("bcm2835_sdhost_remove - OK\n");
++	return 0;
++}
++
++static const struct of_device_id bcm2835_sdhost_match[] = {
++	{ .compatible = "brcm,bcm2835-sdhost" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, bcm2835_sdhost_match);
++
++static struct platform_driver bcm2835_sdhost_driver = {
++	.probe      = bcm2835_sdhost_probe,
++	.remove     = bcm2835_sdhost_remove,
++	.driver     = {
++		.name		= DRIVER_NAME,
++		.owner		= THIS_MODULE,
++		.of_match_table	= bcm2835_sdhost_match,
++	},
++};
++module_platform_driver(bcm2835_sdhost_driver);
++
++MODULE_ALIAS("platform:sdhost-bcm2835");
++MODULE_DESCRIPTION("BCM2835 SDHost driver");
++MODULE_LICENSE("GPL v2");
++MODULE_AUTHOR("Phil Elwell");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0113-vc_mem-Add-vc_mem-driver-for-querying-firmware-memor.patch b/target/linux/bcm27xx/patches-6.1/950-0113-vc_mem-Add-vc_mem-driver-for-querying-firmware-memor.patch
new file mode 100644
index 00000000000000..8fe7df77f44a40
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0113-vc_mem-Add-vc_mem-driver-for-querying-firmware-memor.patch
@@ -0,0 +1,493 @@
+From 217c196114a066a44cf9b61f31731d49fd0900eb Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Fri, 28 Oct 2016 15:36:43 +0100
+Subject: [PATCH] vc_mem: Add vc_mem driver for querying firmware
+ memory addresses
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+
+BCM270x: Move vc_mem
+
+Make the vc_mem module available for ARCH_BCM2835 by moving it.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+char: vc_mem: Fix up compat ioctls for 64bit kernel
+
+compat_ioctl wasn't defined, so 32bit user/64bit kernel
+always failed.
+VC_MEM_IOC_MEM_PHYS_ADDR was defined with parameter size
+unsigned long, so the ioctl cmd changes between sizes.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+char: vc_mem: Fix all coding style issues.
+
+Cleans up all checkpatch errors in vc_mem.c and vc_mem.h
+No functional change to the code.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+char: vc_mem: Delete dead code
+
+There are no error exists once device_create has succeeded, and
+therefore no need to call device_destroy from vc_mem_init.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/char/broadcom/Kconfig   |  18 ++
+ drivers/char/broadcom/Makefile  |   1 +
+ drivers/char/broadcom/vc_mem.c  | 373 ++++++++++++++++++++++++++++++++
+ include/linux/broadcom/vc_mem.h |  39 ++++
+ 4 files changed, 431 insertions(+)
+ create mode 100644 drivers/char/broadcom/Kconfig
+ create mode 100644 drivers/char/broadcom/Makefile
+ create mode 100644 drivers/char/broadcom/vc_mem.c
+ create mode 100644 include/linux/broadcom/vc_mem.h
+
+--- /dev/null
++++ b/drivers/char/broadcom/Kconfig
+@@ -0,0 +1,18 @@
++#
++# Broadcom char driver config
++#
++
++menuconfig BRCM_CHAR_DRIVERS
++	bool "Broadcom Char Drivers"
++	help
++	  Broadcom's char drivers
++
++if BRCM_CHAR_DRIVERS
++
++config BCM2708_VCMEM
++	bool "Videocore Memory"
++        default y
++        help
++          Helper for videocore memory access and total size allocation.
++
++endif
+--- /dev/null
++++ b/drivers/char/broadcom/Makefile
+@@ -0,0 +1 @@
++obj-$(CONFIG_BCM2708_VCMEM)	+= vc_mem.o
+--- /dev/null
++++ b/drivers/char/broadcom/vc_mem.c
+@@ -0,0 +1,373 @@
++/*
++ * Copyright 2010 - 2011 Broadcom Corporation.  All rights reserved.
++ *
++ * Unless you and Broadcom execute a separate written software license
++ * agreement governing use of this software, this software is licensed to you
++ * under the terms of the GNU General Public License version 2, available at
++ * http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
++ *
++ * Notwithstanding the above, under no circumstances may you combine this
++ * software in any way with any other Broadcom software provided under a
++ * license other than the GPL, without Broadcom's express prior written
++ * consent.
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/fs.h>
++#include <linux/device.h>
++#include <linux/cdev.h>
++#include <linux/mm.h>
++#include <linux/slab.h>
++#include <linux/debugfs.h>
++#include <linux/uaccess.h>
++#include <linux/dma-mapping.h>
++#include <linux/broadcom/vc_mem.h>
++
++#define DRIVER_NAME  "vc-mem"
++
++/* Device (/dev) related variables */
++static dev_t vc_mem_devnum;
++static struct class *vc_mem_class;
++static struct cdev vc_mem_cdev;
++static int vc_mem_inited;
++
++#ifdef CONFIG_DEBUG_FS
++static struct dentry *vc_mem_debugfs_entry;
++#endif
++
++/*
++ * Videocore memory addresses and size
++ *
++ * Drivers that wish to know the videocore memory addresses and sizes should
++ * use these variables instead of the MM_IO_BASE and MM_ADDR_IO defines in
++ * headers. This allows the other drivers to not be tied down to a a certain
++ * address/size at compile time.
++ *
++ * In the future, the goal is to have the videocore memory virtual address and
++ * size be calculated at boot time rather than at compile time. The decision of
++ * where the videocore memory resides and its size would be in the hands of the
++ * bootloader (and/or kernel). When that happens, the values of these variables
++ * would be calculated and assigned in the init function.
++ */
++/* In the 2835 VC in mapped above ARM, but ARM has full access to VC space */
++unsigned long mm_vc_mem_phys_addr;
++EXPORT_SYMBOL(mm_vc_mem_phys_addr);
++unsigned int mm_vc_mem_size;
++EXPORT_SYMBOL(mm_vc_mem_size);
++unsigned int mm_vc_mem_base;
++EXPORT_SYMBOL(mm_vc_mem_base);
++
++static uint phys_addr;
++static uint mem_size;
++static uint mem_base;
++
++static int
++vc_mem_open(struct inode *inode, struct file *file)
++{
++	(void)inode;
++
++	pr_debug("%s: called file = 0x%p\n", __func__, file);
++
++	return 0;
++}
++
++static int
++vc_mem_release(struct inode *inode, struct file *file)
++{
++	(void)inode;
++
++	pr_debug("%s: called file = 0x%p\n", __func__, file);
++
++	return 0;
++}
++
++static void
++vc_mem_get_size(void)
++{
++}
++
++static void
++vc_mem_get_base(void)
++{
++}
++
++int
++vc_mem_get_current_size(void)
++{
++	return mm_vc_mem_size;
++}
++EXPORT_SYMBOL_GPL(vc_mem_get_current_size);
++
++static long
++vc_mem_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
++{
++	int rc = 0;
++
++	(void) cmd;
++	(void) arg;
++
++	pr_debug("%s: called file = 0x%p, cmd %08x\n", __func__, file, cmd);
++
++	switch (cmd) {
++	case VC_MEM_IOC_MEM_PHYS_ADDR:
++		{
++			pr_debug("%s: VC_MEM_IOC_MEM_PHYS_ADDR=0x%p\n",
++				__func__, (void *)mm_vc_mem_phys_addr);
++
++			if (copy_to_user((void *)arg, &mm_vc_mem_phys_addr,
++					 sizeof(mm_vc_mem_phys_addr))) {
++				rc = -EFAULT;
++			}
++			break;
++		}
++	case VC_MEM_IOC_MEM_SIZE:
++		{
++			/* Get the videocore memory size first */
++			vc_mem_get_size();
++
++			pr_debug("%s: VC_MEM_IOC_MEM_SIZE=%x\n", __func__,
++				 mm_vc_mem_size);
++
++			if (copy_to_user((void *)arg, &mm_vc_mem_size,
++					 sizeof(mm_vc_mem_size))) {
++				rc = -EFAULT;
++			}
++			break;
++		}
++	case VC_MEM_IOC_MEM_BASE:
++		{
++			/* Get the videocore memory base */
++			vc_mem_get_base();
++
++			pr_debug("%s: VC_MEM_IOC_MEM_BASE=%x\n", __func__,
++				 mm_vc_mem_base);
++
++			if (copy_to_user((void *)arg, &mm_vc_mem_base,
++					 sizeof(mm_vc_mem_base))) {
++				rc = -EFAULT;
++			}
++			break;
++		}
++	case VC_MEM_IOC_MEM_LOAD:
++		{
++			/* Get the videocore memory base */
++			vc_mem_get_base();
++
++			pr_debug("%s: VC_MEM_IOC_MEM_LOAD=%x\n", __func__,
++				mm_vc_mem_base);
++
++			if (copy_to_user((void *)arg, &mm_vc_mem_base,
++					 sizeof(mm_vc_mem_base))) {
++				rc = -EFAULT;
++			}
++			break;
++		}
++	default:
++		{
++			return -ENOTTY;
++		}
++	}
++	pr_debug("%s: file = 0x%p returning %d\n", __func__, file, rc);
++
++	return rc;
++}
++
++#ifdef CONFIG_COMPAT
++static long
++vc_mem_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
++{
++	int rc = 0;
++
++	switch (cmd) {
++	case VC_MEM_IOC_MEM_PHYS_ADDR32:
++		pr_debug("%s: VC_MEM_IOC_MEM_PHYS_ADDR32=0x%p\n",
++			 __func__, (void *)mm_vc_mem_phys_addr);
++
++		/* This isn't correct, but will cover us for now as
++		 * VideoCore is 32bit only.
++		 */
++		if (copy_to_user((void *)arg, &mm_vc_mem_phys_addr,
++				 sizeof(compat_ulong_t)))
++			rc = -EFAULT;
++
++		break;
++
++	default:
++		rc = vc_mem_ioctl(file, cmd, arg);
++		break;
++	}
++
++	return rc;
++}
++#endif
++
++static int
++vc_mem_mmap(struct file *filp, struct vm_area_struct *vma)
++{
++	int rc = 0;
++	unsigned long length = vma->vm_end - vma->vm_start;
++	unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
++
++	pr_debug("%s: vm_start = 0x%08lx vm_end = 0x%08lx vm_pgoff = 0x%08lx\n",
++		 __func__, (long)vma->vm_start, (long)vma->vm_end,
++		 (long)vma->vm_pgoff);
++
++	if (offset + length > mm_vc_mem_size) {
++		pr_err("%s: length %ld is too big\n", __func__, length);
++		return -EINVAL;
++	}
++	/* Do not cache the memory map */
++	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
++
++	rc = remap_pfn_range(vma, vma->vm_start,
++			     (mm_vc_mem_phys_addr >> PAGE_SHIFT) +
++			     vma->vm_pgoff, length, vma->vm_page_prot);
++	if (rc)
++		pr_err("%s: remap_pfn_range failed (rc=%d)\n", __func__, rc);
++
++	return rc;
++}
++
++/* File Operations for the driver. */
++static const struct file_operations vc_mem_fops = {
++	.owner = THIS_MODULE,
++	.open = vc_mem_open,
++	.release = vc_mem_release,
++	.unlocked_ioctl = vc_mem_ioctl,
++#ifdef CONFIG_COMPAT
++	.compat_ioctl = vc_mem_compat_ioctl,
++#endif
++	.mmap = vc_mem_mmap,
++};
++
++#ifdef CONFIG_DEBUG_FS
++static void vc_mem_debugfs_deinit(void)
++{
++	debugfs_remove_recursive(vc_mem_debugfs_entry);
++	vc_mem_debugfs_entry = NULL;
++}
++
++
++static int vc_mem_debugfs_init(
++	struct device *dev)
++{
++	vc_mem_debugfs_entry = debugfs_create_dir(DRIVER_NAME, NULL);
++	if (!vc_mem_debugfs_entry) {
++		dev_warn(dev, "could not create debugfs entry\n");
++		return -EFAULT;
++	}
++
++	debugfs_create_x32("vc_mem_phys_addr",
++				0444,
++				vc_mem_debugfs_entry,
++				(u32 *)&mm_vc_mem_phys_addr);
++	debugfs_create_x32("vc_mem_size",
++				0444,
++				vc_mem_debugfs_entry,
++				(u32 *)&mm_vc_mem_size);
++	debugfs_create_x32("vc_mem_base",
++				0444,
++				vc_mem_debugfs_entry,
++				(u32 *)&mm_vc_mem_base);
++
++	return 0;
++}
++
++#endif /* CONFIG_DEBUG_FS */
++
++/* Module load/unload functions */
++
++static int __init
++vc_mem_init(void)
++{
++	int rc = -EFAULT;
++	struct device *dev;
++
++	pr_debug("%s: called\n", __func__);
++
++	mm_vc_mem_phys_addr = phys_addr;
++	mm_vc_mem_size = mem_size;
++	mm_vc_mem_base = mem_base;
++
++	vc_mem_get_size();
++
++	pr_info("vc-mem: phys_addr:0x%08lx mem_base=0x%08x mem_size:0x%08x(%u MiB)\n",
++		mm_vc_mem_phys_addr, mm_vc_mem_base, mm_vc_mem_size,
++		mm_vc_mem_size / (1024 * 1024));
++
++	rc = alloc_chrdev_region(&vc_mem_devnum, 0, 1, DRIVER_NAME);
++	if (rc < 0) {
++		pr_err("%s: alloc_chrdev_region failed (rc=%d)\n",
++		       __func__, rc);
++		goto out_err;
++	}
++
++	cdev_init(&vc_mem_cdev, &vc_mem_fops);
++	rc = cdev_add(&vc_mem_cdev, vc_mem_devnum, 1);
++	if (rc) {
++		pr_err("%s: cdev_add failed (rc=%d)\n", __func__, rc);
++		goto out_unregister;
++	}
++
++	vc_mem_class = class_create(THIS_MODULE, DRIVER_NAME);
++	if (IS_ERR(vc_mem_class)) {
++		rc = PTR_ERR(vc_mem_class);
++		pr_err("%s: class_create failed (rc=%d)\n", __func__, rc);
++		goto out_cdev_del;
++	}
++
++	dev = device_create(vc_mem_class, NULL, vc_mem_devnum, NULL,
++			    DRIVER_NAME);
++	if (IS_ERR(dev)) {
++		rc = PTR_ERR(dev);
++		pr_err("%s: device_create failed (rc=%d)\n", __func__, rc);
++		goto out_class_destroy;
++	}
++
++#ifdef CONFIG_DEBUG_FS
++	/* don't fail if the debug entries cannot be created */
++	vc_mem_debugfs_init(dev);
++#endif
++
++	vc_mem_inited = 1;
++	return 0;
++
++out_class_destroy:
++	class_destroy(vc_mem_class);
++	vc_mem_class = NULL;
++
++out_cdev_del:
++	cdev_del(&vc_mem_cdev);
++
++out_unregister:
++	unregister_chrdev_region(vc_mem_devnum, 1);
++
++out_err:
++	return -1;
++}
++
++static void __exit
++vc_mem_exit(void)
++{
++	pr_debug("%s: called\n", __func__);
++
++	if (vc_mem_inited) {
++#if CONFIG_DEBUG_FS
++		vc_mem_debugfs_deinit();
++#endif
++		device_destroy(vc_mem_class, vc_mem_devnum);
++		class_destroy(vc_mem_class);
++		cdev_del(&vc_mem_cdev);
++		unregister_chrdev_region(vc_mem_devnum, 1);
++	}
++}
++
++module_init(vc_mem_init);
++module_exit(vc_mem_exit);
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Broadcom Corporation");
++
++module_param(phys_addr, uint, 0644);
++module_param(mem_size, uint, 0644);
++module_param(mem_base, uint, 0644);
+--- /dev/null
++++ b/include/linux/broadcom/vc_mem.h
+@@ -0,0 +1,39 @@
++/*
++ * Copyright 2010 - 2011 Broadcom Corporation.  All rights reserved.
++ *
++ * Unless you and Broadcom execute a separate written software license
++ * agreement governing use of this software, this software is licensed to you
++ * under the terms of the GNU General Public License version 2, available at
++ * http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
++ *
++ * Notwithstanding the above, under no circumstances may you combine this
++ * software in any way with any other Broadcom software provided under a
++ * license other than the GPL, without Broadcom's express prior written
++ * consent.
++ */
++
++#ifndef _VC_MEM_H
++#define _VC_MEM_H
++
++#include <linux/ioctl.h>
++
++#define VC_MEM_IOC_MAGIC  'v'
++
++#define VC_MEM_IOC_MEM_PHYS_ADDR    _IOR(VC_MEM_IOC_MAGIC, 0, unsigned long)
++#define VC_MEM_IOC_MEM_SIZE         _IOR(VC_MEM_IOC_MAGIC, 1, unsigned int)
++#define VC_MEM_IOC_MEM_BASE         _IOR(VC_MEM_IOC_MAGIC, 2, unsigned int)
++#define VC_MEM_IOC_MEM_LOAD         _IOR(VC_MEM_IOC_MAGIC, 3, unsigned int)
++
++#ifdef __KERNEL__
++#define VC_MEM_TO_ARM_ADDR_MASK 0x3FFFFFFF
++
++extern unsigned long mm_vc_mem_phys_addr;
++extern unsigned int  mm_vc_mem_size;
++extern int vc_mem_get_current_size(void);
++#endif
++
++#ifdef CONFIG_COMPAT
++#define VC_MEM_IOC_MEM_PHYS_ADDR32  _IOR(VC_MEM_IOC_MAGIC, 0, compat_ulong_t)
++#endif
++
++#endif  /* _VC_MEM_H */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0114-Add-dev-gpiomem-device-for-rootless-user-GPIO-access.patch b/target/linux/bcm27xx/patches-6.1/950-0114-Add-dev-gpiomem-device-for-rootless-user-GPIO-access.patch
new file mode 100644
index 00000000000000..b5ca061a572742
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0114-Add-dev-gpiomem-device-for-rootless-user-GPIO-access.patch
@@ -0,0 +1,299 @@
+From 31b66b686ef574df45dc09e84d84e70db32beb17 Mon Sep 17 00:00:00 2001
+From: Luke Wren <luke@raspberrypi.org>
+Date: Fri, 21 Aug 2015 23:14:48 +0100
+Subject: [PATCH] Add /dev/gpiomem device for rootless user GPIO access
+
+Signed-off-by: Luke Wren <luke@raspberrypi.org>
+
+bcm2835-gpiomem: Fix for ARCH_BCM2835 builds
+
+Build on ARCH_BCM2835, and fail to probe if no IO resource.
+
+See: https://github.com/raspberrypi/linux/issues/1154
+---
+ drivers/char/broadcom/Kconfig           |   8 +
+ drivers/char/broadcom/Makefile          |   1 +
+ drivers/char/broadcom/bcm2835-gpiomem.c | 258 ++++++++++++++++++++++++
+ 3 files changed, 267 insertions(+)
+ create mode 100644 drivers/char/broadcom/bcm2835-gpiomem.c
+
+--- a/drivers/char/broadcom/Kconfig
++++ b/drivers/char/broadcom/Kconfig
+@@ -16,3 +16,11 @@ config BCM2708_VCMEM
+           Helper for videocore memory access and total size allocation.
+ 
+ endif
++
++config BCM2835_DEVGPIOMEM
++	tristate "/dev/gpiomem rootless GPIO access via mmap() on the BCM2835"
++	default m
++	help
++		Provides users with root-free access to the GPIO registers
++		on the 2835. Calling mmap(/dev/gpiomem) will map the GPIO
++		register page to the user's pointer.
+--- a/drivers/char/broadcom/Makefile
++++ b/drivers/char/broadcom/Makefile
+@@ -1 +1,2 @@
+ obj-$(CONFIG_BCM2708_VCMEM)	+= vc_mem.o
++obj-$(CONFIG_BCM2835_DEVGPIOMEM)+= bcm2835-gpiomem.o
+--- /dev/null
++++ b/drivers/char/broadcom/bcm2835-gpiomem.c
+@@ -0,0 +1,258 @@
++/**
++ * GPIO memory device driver
++ *
++ * Creates a chardev /dev/gpiomem which will provide user access to
++ * the BCM2835's GPIO registers when it is mmap()'d.
++ * No longer need root for user GPIO access, but without relaxing permissions
++ * on /dev/mem.
++ *
++ * Written by Luke Wren <luke@raspberrypi.org>
++ * Copyright (c) 2015, Raspberry Pi (Trading) Ltd.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions, and the following disclaimer,
++ *    without modification.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. The names of the above-listed copyright holders may not be used
++ *    to endorse or promote products derived from this software without
++ *    specific prior written permission.
++ *
++ * ALTERNATIVELY, this software may be distributed under the terms of the
++ * GNU General Public License ("GPL") version 2, as published by the Free
++ * Software Foundation.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
++ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
++ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
++ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
++ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
++ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/mm.h>
++#include <linux/slab.h>
++#include <linux/cdev.h>
++#include <linux/pagemap.h>
++#include <linux/io.h>
++
++#define DEVICE_NAME "bcm2835-gpiomem"
++#define DRIVER_NAME "gpiomem-bcm2835"
++#define DEVICE_MINOR 0
++
++struct bcm2835_gpiomem_instance {
++	unsigned long gpio_regs_phys;
++	struct device *dev;
++};
++
++static struct cdev bcm2835_gpiomem_cdev;
++static dev_t bcm2835_gpiomem_devid;
++static struct class *bcm2835_gpiomem_class;
++static struct device *bcm2835_gpiomem_dev;
++static struct bcm2835_gpiomem_instance *inst;
++
++
++/****************************************************************************
++*
++*   GPIO mem chardev file ops
++*
++***************************************************************************/
++
++static int bcm2835_gpiomem_open(struct inode *inode, struct file *file)
++{
++	int dev = iminor(inode);
++	int ret = 0;
++
++	if (dev != DEVICE_MINOR) {
++		dev_err(inst->dev, "Unknown minor device: %d", dev);
++		ret = -ENXIO;
++	}
++	return ret;
++}
++
++static int bcm2835_gpiomem_release(struct inode *inode, struct file *file)
++{
++	int dev = iminor(inode);
++	int ret = 0;
++
++	if (dev != DEVICE_MINOR) {
++		dev_err(inst->dev, "Unknown minor device %d", dev);
++		ret = -ENXIO;
++	}
++	return ret;
++}
++
++static const struct vm_operations_struct bcm2835_gpiomem_vm_ops = {
++#ifdef CONFIG_HAVE_IOREMAP_PROT
++	.access = generic_access_phys
++#endif
++};
++
++static int bcm2835_gpiomem_mmap(struct file *file, struct vm_area_struct *vma)
++{
++	/* Ignore what the user says - they're getting the GPIO regs
++	   whether they like it or not! */
++	unsigned long gpio_page = inst->gpio_regs_phys >> PAGE_SHIFT;
++
++	vma->vm_page_prot = phys_mem_access_prot(file, gpio_page,
++						 PAGE_SIZE,
++						 vma->vm_page_prot);
++	vma->vm_ops = &bcm2835_gpiomem_vm_ops;
++	if (remap_pfn_range(vma, vma->vm_start,
++			gpio_page,
++			PAGE_SIZE,
++			vma->vm_page_prot)) {
++		return -EAGAIN;
++	}
++	return 0;
++}
++
++static const struct file_operations
++bcm2835_gpiomem_fops = {
++	.owner = THIS_MODULE,
++	.open = bcm2835_gpiomem_open,
++	.release = bcm2835_gpiomem_release,
++	.mmap = bcm2835_gpiomem_mmap,
++};
++
++
++ /****************************************************************************
++*
++*   Probe and remove functions
++*
++***************************************************************************/
++
++
++static int bcm2835_gpiomem_probe(struct platform_device *pdev)
++{
++	int err;
++	void *ptr_err;
++	struct device *dev = &pdev->dev;
++	struct resource *ioresource;
++
++	/* Allocate buffers and instance data */
++
++	inst = kzalloc(sizeof(struct bcm2835_gpiomem_instance), GFP_KERNEL);
++
++	if (!inst) {
++		err = -ENOMEM;
++		goto failed_inst_alloc;
++	}
++
++	inst->dev = dev;
++
++	ioresource = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if (ioresource) {
++		inst->gpio_regs_phys = ioresource->start;
++	} else {
++		dev_err(inst->dev, "failed to get IO resource");
++		err = -ENOENT;
++		goto failed_get_resource;
++	}
++
++	/* Create character device entries */
++
++	err = alloc_chrdev_region(&bcm2835_gpiomem_devid,
++				  DEVICE_MINOR, 1, DEVICE_NAME);
++	if (err != 0) {
++		dev_err(inst->dev, "unable to allocate device number");
++		goto failed_alloc_chrdev;
++	}
++	cdev_init(&bcm2835_gpiomem_cdev, &bcm2835_gpiomem_fops);
++	bcm2835_gpiomem_cdev.owner = THIS_MODULE;
++	err = cdev_add(&bcm2835_gpiomem_cdev, bcm2835_gpiomem_devid, 1);
++	if (err != 0) {
++		dev_err(inst->dev, "unable to register device");
++		goto failed_cdev_add;
++	}
++
++	/* Create sysfs entries */
++
++	bcm2835_gpiomem_class = class_create(THIS_MODULE, DEVICE_NAME);
++	ptr_err = bcm2835_gpiomem_class;
++	if (IS_ERR(ptr_err))
++		goto failed_class_create;
++
++	bcm2835_gpiomem_dev = device_create(bcm2835_gpiomem_class, NULL,
++					bcm2835_gpiomem_devid, NULL,
++					"gpiomem");
++	ptr_err = bcm2835_gpiomem_dev;
++	if (IS_ERR(ptr_err))
++		goto failed_device_create;
++
++	dev_info(inst->dev, "Initialised: Registers at 0x%08lx",
++		inst->gpio_regs_phys);
++
++	return 0;
++
++failed_device_create:
++	class_destroy(bcm2835_gpiomem_class);
++failed_class_create:
++	cdev_del(&bcm2835_gpiomem_cdev);
++	err = PTR_ERR(ptr_err);
++failed_cdev_add:
++	unregister_chrdev_region(bcm2835_gpiomem_devid, 1);
++failed_alloc_chrdev:
++failed_get_resource:
++	kfree(inst);
++failed_inst_alloc:
++	dev_err(inst->dev, "could not load bcm2835_gpiomem");
++	return err;
++}
++
++static int bcm2835_gpiomem_remove(struct platform_device *pdev)
++{
++	struct device *dev = inst->dev;
++
++	kfree(inst);
++	device_destroy(bcm2835_gpiomem_class, bcm2835_gpiomem_devid);
++	class_destroy(bcm2835_gpiomem_class);
++	cdev_del(&bcm2835_gpiomem_cdev);
++	unregister_chrdev_region(bcm2835_gpiomem_devid, 1);
++
++	dev_info(dev, "GPIO mem driver removed - OK");
++	return 0;
++}
++
++ /****************************************************************************
++*
++*   Register the driver with device tree
++*
++***************************************************************************/
++
++static const struct of_device_id bcm2835_gpiomem_of_match[] = {
++	{.compatible = "brcm,bcm2835-gpiomem",},
++	{ /* sentinel */ },
++};
++
++MODULE_DEVICE_TABLE(of, bcm2835_gpiomem_of_match);
++
++static struct platform_driver bcm2835_gpiomem_driver = {
++	.probe = bcm2835_gpiomem_probe,
++	.remove = bcm2835_gpiomem_remove,
++	.driver = {
++		   .name = DRIVER_NAME,
++		   .owner = THIS_MODULE,
++		   .of_match_table = bcm2835_gpiomem_of_match,
++		   },
++};
++
++module_platform_driver(bcm2835_gpiomem_driver);
++
++MODULE_ALIAS("platform:gpiomem-bcm2835");
++MODULE_LICENSE("GPL");
++MODULE_DESCRIPTION("gpiomem driver for accessing GPIO from userspace");
++MODULE_AUTHOR("Luke Wren <luke@raspberrypi.org>");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0115-Add-SMI-driver.patch b/target/linux/bcm27xx/patches-6.1/950-0115-Add-SMI-driver.patch
new file mode 100644
index 00000000000000..674f3f53b0b773
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0115-Add-SMI-driver.patch
@@ -0,0 +1,1967 @@
+From b3077fb9ac2668fde05478fa0ef6197fecda87b6 Mon Sep 17 00:00:00 2001
+From: Luke Wren <wren6991@gmail.com>
+Date: Sat, 5 Sep 2015 01:14:45 +0100
+Subject: [PATCH] Add SMI driver
+
+Signed-off-by: Luke Wren <wren6991@gmail.com>
+
+MISC: bcm2835: smi: use clock manager and fix reload issues
+
+Use clock manager instead of self-made clockmanager.
+
+Also fix some error paths that showd up during development
+(especially missing release of dma resources on rmmod)
+
+Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
+
+bcm2835_smi: re-add dereference to fix DMA transfers
+
+bcm2835_smi_dev: Fix handling of word-odd lengths
+
+The read and write functions did not use the correct pointer offset
+when dealing with an odd number of bytes after a DMA transfer. Also,
+only handle the remaining odd bytes if the DMA transfer completed
+successfully.
+
+Submitted-by: @madimario (GitHub)
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+misc: bcm2835_smi: Use proper enum types for dma_{,un}map_single()
+
+Clang warns:
+
+  drivers/misc/bcm2835_smi.c:692:4: warning: implicit conversion from enumeration type 'enum dma_transfer_direction' to different enumeration type 'enum dma_data_direction' [-Wenum-conversion]
+                          DMA_MEM_TO_DEV);
+                          ^~~~~~~~~~~~~~~
+  ./include/linux/dma-mapping.h:406:66: note: expanded from macro 'dma_map_single'
+  #define dma_map_single(d, a, s, r) dma_map_single_attrs(d, a, s, r, 0)
+                                     ~~~~~~~~~~~~~~~~~~~~          ^
+  drivers/misc/bcm2835_smi.c:705:35: warning: implicit conversion from enumeration type 'enum dma_transfer_direction' to different enumeration type 'enum dma_data_direction' [-Wenum-conversion]
+                          (inst->dev, phy_addr, n_bytes, DMA_MEM_TO_DEV);
+                          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~
+  ./include/linux/dma-mapping.h:407:70: note: expanded from macro 'dma_unmap_single'
+  #define dma_unmap_single(d, a, s, r) dma_unmap_single_attrs(d, a, s, r, 0)
+                                       ~~~~~~~~~~~~~~~~~~~~~~          ^
+  drivers/misc/bcm2835_smi.c:751:12: warning: implicit conversion from enumeration type 'enum dma_transfer_direction' to different enumeration type 'enum dma_data_direction' [-Wenum-conversion]
+                                                       DMA_DEV_TO_MEM);
+                                                       ^~~~~~~~~~~~~~~
+  ./include/linux/dma-mapping.h:406:66: note: expanded from macro 'dma_map_single'
+  #define dma_map_single(d, a, s, r) dma_map_single_attrs(d, a, s, r, 0)
+                                     ~~~~~~~~~~~~~~~~~~~~          ^
+  drivers/misc/bcm2835_smi.c:761:50: warning: implicit conversion from enumeration type 'enum dma_transfer_direction' to different enumeration type 'enum dma_data_direction' [-Wenum-conversion]
+                  dma_unmap_single(inst->dev, phy_addr, n_bytes, DMA_DEV_TO_MEM);
+                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~
+  ./include/linux/dma-mapping.h:407:70: note: expanded from macro 'dma_unmap_single'
+  #define dma_unmap_single(d, a, s, r) dma_unmap_single_attrs(d, a, s, r, 0)
+                                       ~~~~~~~~~~~~~~~~~~~~~~          ^
+  4 warnings generated.
+
+Use the proper enumerated type to clear up the warning. There is not
+actually a bug here because the enumerated types have the same integer
+value:
+
+DMA_MEM_TO_DEV = DMA_TO_DEVICE = 1
+DMA_DEV_TO_MEM = DMA_FROM_DEVICE = 2
+
+Fixes: 93254d0f7bc8 ("Add SMI driver")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+---
+ .../bindings/misc/brcm,bcm2835-smi-dev.txt    |  17 +
+ .../bindings/misc/brcm,bcm2835-smi.txt        |  48 +
+ drivers/char/broadcom/Kconfig                 |   9 +
+ drivers/char/broadcom/Makefile                |   1 +
+ drivers/char/broadcom/bcm2835_smi_dev.c       | 409 ++++++++
+ drivers/misc/Kconfig                          |   8 +
+ drivers/misc/Makefile                         |   1 +
+ drivers/misc/bcm2835_smi.c                    | 955 ++++++++++++++++++
+ include/linux/broadcom/bcm2835_smi.h          | 391 +++++++
+ 9 files changed, 1839 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/misc/brcm,bcm2835-smi-dev.txt
+ create mode 100644 Documentation/devicetree/bindings/misc/brcm,bcm2835-smi.txt
+ create mode 100644 drivers/char/broadcom/bcm2835_smi_dev.c
+ create mode 100644 drivers/misc/bcm2835_smi.c
+ create mode 100644 include/linux/broadcom/bcm2835_smi.h
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/misc/brcm,bcm2835-smi-dev.txt
+@@ -0,0 +1,17 @@
++* Broadcom BCM2835 SMI character device driver.
++
++SMI or secondary memory interface is a peripheral specific to certain Broadcom
++SOCs, and is helpful for talking to things like parallel-interface displays
++and NAND flashes (in fact, most things with a parallel register interface).
++
++This driver adds a character device which provides a user-space interface to
++an instance of the SMI driver.
++
++Required properties:
++- compatible: "brcm,bcm2835-smi-dev"
++- smi_handle: a phandle to the smi node.
++
++Optional properties:
++- None.
++
++
+--- /dev/null
++++ b/Documentation/devicetree/bindings/misc/brcm,bcm2835-smi.txt
+@@ -0,0 +1,48 @@
++* Broadcom BCM2835 SMI driver.
++
++SMI or secondary memory interface is a peripheral specific to certain Broadcom
++SOCs, and is helpful for talking to things like parallel-interface displays
++and NAND flashes (in fact, most things with a parallel register interface).
++
++Required properties:
++- compatible: "brcm,bcm2835-smi"
++- reg: Should contain location and length of SMI registers and SMI clkman regs
++- interrupts: *the* SMI interrupt.
++- pinctrl-names: should be "default".
++- pinctrl-0: the phandle of the gpio pin node.
++- brcm,smi-clock-source: the clock source for clkman
++- brcm,smi-clock-divisor: the integer clock divisor for clkman
++- dmas: the dma controller phandle and the DREQ number (4 on a 2835)
++- dma-names: the name used by the driver to request its channel.
++  Should be "rx-tx".
++
++Optional properties:
++- None.
++
++Examples:
++
++8 data pin configuration:
++
++smi: smi@7e600000 {
++	compatible = "brcm,bcm2835-smi";
++	reg = <0x7e600000 0x44>, <0x7e1010b0 0x8>;
++	interrupts = <2 16>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&smi_pins>;
++	brcm,smi-clock-source = <6>;
++	brcm,smi-clock-divisor = <4>;
++	dmas = <&dma 4>;
++	dma-names = "rx-tx";
++
++	status = "okay";
++};
++
++smi_pins: smi_pins {
++	brcm,pins = <2 3 4 5 6 7 8 9 10 11 12 13 14 15>;
++	/* Alt 1: SMI */
++	brcm,function = <5 5 5 5 5 5 5 5 5 5 5 5 5 5>;
++	/* /CS, /WE and /OE are pulled high, as they are
++	   generally active low signals */
++	brcm,pull = <2 2 2 2 2 2 0 0 0 0 0 0 0 0>;
++};
++
+--- a/drivers/char/broadcom/Kconfig
++++ b/drivers/char/broadcom/Kconfig
+@@ -24,3 +24,12 @@ config BCM2835_DEVGPIOMEM
+ 		Provides users with root-free access to the GPIO registers
+ 		on the 2835. Calling mmap(/dev/gpiomem) will map the GPIO
+ 		register page to the user's pointer.
++
++config BCM2835_SMI_DEV
++	tristate "Character device driver for BCM2835 Secondary Memory Interface"
++	depends on BCM2835_SMI
++	default m
++	help
++		This driver provides a character device interface (ioctl + read/write) to
++		Broadcom's Secondary Memory interface. The low-level functionality is provided
++		by the SMI driver itself.
+--- a/drivers/char/broadcom/Makefile
++++ b/drivers/char/broadcom/Makefile
+@@ -1,2 +1,3 @@
+ obj-$(CONFIG_BCM2708_VCMEM)	+= vc_mem.o
+ obj-$(CONFIG_BCM2835_DEVGPIOMEM)+= bcm2835-gpiomem.o
++obj-$(CONFIG_BCM2835_SMI_DEV)	+= bcm2835_smi_dev.o
+--- /dev/null
++++ b/drivers/char/broadcom/bcm2835_smi_dev.c
+@@ -0,0 +1,409 @@
++/**
++ * Character device driver for Broadcom Secondary Memory Interface
++ *
++ * Written by Luke Wren <luke@raspberrypi.org>
++ * Copyright (c) 2015, Raspberry Pi (Trading) Ltd.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions, and the following disclaimer,
++ *    without modification.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. The names of the above-listed copyright holders may not be used
++ *    to endorse or promote products derived from this software without
++ *    specific prior written permission.
++ *
++ * ALTERNATIVELY, this software may be distributed under the terms of the
++ * GNU General Public License ("GPL") version 2, as published by the Free
++ * Software Foundation.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
++ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
++ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
++ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
++ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
++ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++#include <linux/mm.h>
++#include <linux/pagemap.h>
++#include <linux/fs.h>
++#include <linux/cdev.h>
++#include <linux/fs.h>
++
++#include <linux/broadcom/bcm2835_smi.h>
++
++#define DEVICE_NAME "bcm2835-smi-dev"
++#define DRIVER_NAME "smi-dev-bcm2835"
++#define DEVICE_MINOR 0
++
++static struct cdev bcm2835_smi_cdev;
++static dev_t bcm2835_smi_devid;
++static struct class *bcm2835_smi_class;
++static struct device *bcm2835_smi_dev;
++
++struct bcm2835_smi_dev_instance {
++	struct device *dev;
++};
++
++static struct bcm2835_smi_instance *smi_inst;
++static struct bcm2835_smi_dev_instance *inst;
++
++static const char *const ioctl_names[] = {
++	"READ_SETTINGS",
++	"WRITE_SETTINGS",
++	"ADDRESS"
++};
++
++/****************************************************************************
++*
++*   SMI chardev file ops
++*
++***************************************************************************/
++static long
++bcm2835_smi_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
++{
++	long ret = 0;
++
++	dev_info(inst->dev, "serving ioctl...");
++
++	switch (cmd) {
++	case BCM2835_SMI_IOC_GET_SETTINGS:{
++		struct smi_settings *settings;
++
++		dev_info(inst->dev, "Reading SMI settings to user.");
++		settings = bcm2835_smi_get_settings_from_regs(smi_inst);
++		if (copy_to_user((void *)arg, settings,
++				 sizeof(struct smi_settings)))
++			dev_err(inst->dev, "settings copy failed.");
++		break;
++	}
++	case BCM2835_SMI_IOC_WRITE_SETTINGS:{
++		struct smi_settings *settings;
++
++		dev_info(inst->dev, "Setting user's SMI settings.");
++		settings = bcm2835_smi_get_settings_from_regs(smi_inst);
++		if (copy_from_user(settings, (void *)arg,
++				   sizeof(struct smi_settings)))
++			dev_err(inst->dev, "settings copy failed.");
++		else
++			bcm2835_smi_set_regs_from_settings(smi_inst);
++		break;
++	}
++	case BCM2835_SMI_IOC_ADDRESS:
++		dev_info(inst->dev, "SMI address set: 0x%02x", (int)arg);
++		bcm2835_smi_set_address(smi_inst, arg);
++		break;
++	default:
++		dev_err(inst->dev, "invalid ioctl cmd: %d", cmd);
++		ret = -ENOTTY;
++		break;
++	}
++
++	return ret;
++}
++
++static int bcm2835_smi_open(struct inode *inode, struct file *file)
++{
++	int dev = iminor(inode);
++
++	dev_dbg(inst->dev, "SMI device opened.");
++
++	if (dev != DEVICE_MINOR) {
++		dev_err(inst->dev,
++			"bcm2835_smi_release: Unknown minor device: %d",
++			dev);
++		return -ENXIO;
++	}
++
++	return 0;
++}
++
++static int bcm2835_smi_release(struct inode *inode, struct file *file)
++{
++	int dev = iminor(inode);
++
++	if (dev != DEVICE_MINOR) {
++		dev_err(inst->dev,
++			"bcm2835_smi_release: Unknown minor device %d", dev);
++		return -ENXIO;
++	}
++
++	return 0;
++}
++
++static ssize_t dma_bounce_user(
++	enum dma_transfer_direction dma_dir,
++	char __user *user_ptr,
++	size_t count,
++	struct bcm2835_smi_bounce_info *bounce)
++{
++	int chunk_size;
++	int chunk_no = 0;
++	int count_left = count;
++
++	while (count_left) {
++		int rv;
++		void *buf;
++
++		/* Wait for current chunk to complete: */
++		if (down_timeout(&bounce->callback_sem,
++			msecs_to_jiffies(1000))) {
++			dev_err(inst->dev, "DMA bounce timed out");
++			count -= (count_left);
++			break;
++		}
++
++		if (bounce->callback_sem.count >= DMA_BOUNCE_BUFFER_COUNT - 1)
++			dev_err(inst->dev, "WARNING: Ring buffer overflow");
++		chunk_size = count_left > DMA_BOUNCE_BUFFER_SIZE ?
++			DMA_BOUNCE_BUFFER_SIZE : count_left;
++		buf = bounce->buffer[chunk_no % DMA_BOUNCE_BUFFER_COUNT];
++		if (dma_dir == DMA_DEV_TO_MEM)
++			rv = copy_to_user(user_ptr, buf, chunk_size);
++		else
++			rv = copy_from_user(buf, user_ptr, chunk_size);
++		if (rv)
++			dev_err(inst->dev, "copy_*_user() failed!: %d", rv);
++		user_ptr += chunk_size;
++		count_left -= chunk_size;
++		chunk_no++;
++	}
++	return count;
++}
++
++static ssize_t
++bcm2835_read_file(struct file *f, char __user *user_ptr,
++		  size_t count, loff_t *offs)
++{
++	int odd_bytes;
++	size_t count_check;
++
++	dev_dbg(inst->dev, "User reading %zu bytes from SMI.", count);
++	/* We don't want to DMA a number of bytes % 4 != 0 (32 bit FIFO) */
++	if (count > DMA_THRESHOLD_BYTES)
++		odd_bytes = count & 0x3;
++	else
++		odd_bytes = count;
++	count -= odd_bytes;
++	count_check = count;
++	if (count) {
++		struct bcm2835_smi_bounce_info *bounce;
++
++		count = bcm2835_smi_user_dma(smi_inst,
++			DMA_DEV_TO_MEM, user_ptr, count,
++			&bounce);
++		if (count)
++			count = dma_bounce_user(DMA_DEV_TO_MEM, user_ptr,
++				count, bounce);
++	}
++	if (odd_bytes && (count == count_check)) {
++		/* Read from FIFO directly if not using DMA */
++		uint8_t buf[DMA_THRESHOLD_BYTES];
++		unsigned long bytes_not_transferred;
++
++		bcm2835_smi_read_buf(smi_inst, buf, odd_bytes);
++		bytes_not_transferred = copy_to_user(user_ptr + count, buf, odd_bytes);
++		if (bytes_not_transferred)
++			dev_err(inst->dev, "copy_to_user() failed.");
++		count += odd_bytes - bytes_not_transferred;
++	}
++	return count;
++}
++
++static ssize_t
++bcm2835_write_file(struct file *f, const char __user *user_ptr,
++		   size_t count, loff_t *offs)
++{
++	int odd_bytes;
++	size_t count_check;
++
++	dev_dbg(inst->dev, "User writing %zu bytes to SMI.", count);
++	if (count > DMA_THRESHOLD_BYTES)
++		odd_bytes = count & 0x3;
++	else
++		odd_bytes = count;
++	count -= odd_bytes;
++	count_check = count;
++	if (count) {
++		struct bcm2835_smi_bounce_info *bounce;
++
++		count = bcm2835_smi_user_dma(smi_inst,
++			DMA_MEM_TO_DEV, (char __user *)user_ptr, count,
++			&bounce);
++		if (count)
++			count = dma_bounce_user(DMA_MEM_TO_DEV,
++				(char __user *)user_ptr,
++				count, bounce);
++	}
++	if (odd_bytes && (count == count_check)) {
++		uint8_t buf[DMA_THRESHOLD_BYTES];
++		unsigned long bytes_not_transferred;
++
++		bytes_not_transferred = copy_from_user(buf, user_ptr + count, odd_bytes);
++		if (bytes_not_transferred)
++			dev_err(inst->dev, "copy_from_user() failed.");
++		else
++			bcm2835_smi_write_buf(smi_inst, buf, odd_bytes);
++		count += odd_bytes - bytes_not_transferred;
++	}
++	return count;
++}
++
++static const struct file_operations
++bcm2835_smi_fops = {
++	.owner = THIS_MODULE,
++	.unlocked_ioctl = bcm2835_smi_ioctl,
++	.open = bcm2835_smi_open,
++	.release = bcm2835_smi_release,
++	.read = bcm2835_read_file,
++	.write = bcm2835_write_file,
++};
++
++
++/****************************************************************************
++*
++*   bcm2835_smi_probe - called when the driver is loaded.
++*
++***************************************************************************/
++
++static int bcm2835_smi_dev_probe(struct platform_device *pdev)
++{
++	int err;
++	void *ptr_err;
++	struct device *dev = &pdev->dev;
++	struct device_node *node = dev->of_node, *smi_node;
++
++	if (!node) {
++		dev_err(dev, "No device tree node supplied!");
++		return -EINVAL;
++	}
++
++	smi_node = of_parse_phandle(node, "smi_handle", 0);
++
++	if (!smi_node) {
++		dev_err(dev, "No such property: smi_handle");
++		return -ENXIO;
++	}
++
++	smi_inst = bcm2835_smi_get(smi_node);
++
++	if (!smi_inst)
++		return -EPROBE_DEFER;
++
++	/* Allocate buffers and instance data */
++
++	inst = devm_kzalloc(dev, sizeof(*inst), GFP_KERNEL);
++
++	if (!inst)
++		return -ENOMEM;
++
++	inst->dev = dev;
++
++	/* Create character device entries */
++
++	err = alloc_chrdev_region(&bcm2835_smi_devid,
++				  DEVICE_MINOR, 1, DEVICE_NAME);
++	if (err != 0) {
++		dev_err(inst->dev, "unable to allocate device number");
++		return -ENOMEM;
++	}
++	cdev_init(&bcm2835_smi_cdev, &bcm2835_smi_fops);
++	bcm2835_smi_cdev.owner = THIS_MODULE;
++	err = cdev_add(&bcm2835_smi_cdev, bcm2835_smi_devid, 1);
++	if (err != 0) {
++		dev_err(inst->dev, "unable to register device");
++		err = -ENOMEM;
++		goto failed_cdev_add;
++	}
++
++	/* Create sysfs entries */
++
++	bcm2835_smi_class = class_create(THIS_MODULE, DEVICE_NAME);
++	ptr_err = bcm2835_smi_class;
++	if (IS_ERR(ptr_err))
++		goto failed_class_create;
++
++	bcm2835_smi_dev = device_create(bcm2835_smi_class, NULL,
++					bcm2835_smi_devid, NULL,
++					"smi");
++	ptr_err = bcm2835_smi_dev;
++	if (IS_ERR(ptr_err))
++		goto failed_device_create;
++
++	dev_info(inst->dev, "initialised");
++
++	return 0;
++
++failed_device_create:
++	class_destroy(bcm2835_smi_class);
++failed_class_create:
++	cdev_del(&bcm2835_smi_cdev);
++	err = PTR_ERR(ptr_err);
++failed_cdev_add:
++	unregister_chrdev_region(bcm2835_smi_devid, 1);
++	dev_err(dev, "could not load bcm2835_smi_dev");
++	return err;
++}
++
++/****************************************************************************
++*
++*   bcm2835_smi_remove - called when the driver is unloaded.
++*
++***************************************************************************/
++
++static int bcm2835_smi_dev_remove(struct platform_device *pdev)
++{
++	device_destroy(bcm2835_smi_class, bcm2835_smi_devid);
++	class_destroy(bcm2835_smi_class);
++	cdev_del(&bcm2835_smi_cdev);
++	unregister_chrdev_region(bcm2835_smi_devid, 1);
++
++	dev_info(inst->dev, "SMI character dev removed - OK");
++	return 0;
++}
++
++/****************************************************************************
++*
++*   Register the driver with device tree
++*
++***************************************************************************/
++
++static const struct of_device_id bcm2835_smi_dev_of_match[] = {
++	{.compatible = "brcm,bcm2835-smi-dev",},
++	{ /* sentinel */ },
++};
++
++MODULE_DEVICE_TABLE(of, bcm2835_smi_dev_of_match);
++
++static struct platform_driver bcm2835_smi_dev_driver = {
++	.probe = bcm2835_smi_dev_probe,
++	.remove = bcm2835_smi_dev_remove,
++	.driver = {
++		   .name = DRIVER_NAME,
++		   .owner = THIS_MODULE,
++		   .of_match_table = bcm2835_smi_dev_of_match,
++		   },
++};
++
++module_platform_driver(bcm2835_smi_dev_driver);
++
++MODULE_ALIAS("platform:smi-dev-bcm2835");
++MODULE_LICENSE("GPL");
++MODULE_DESCRIPTION(
++	"Character device driver for BCM2835's secondary memory interface");
++MODULE_AUTHOR("Luke Wren <luke@raspberrypi.org>");
+--- a/drivers/misc/Kconfig
++++ b/drivers/misc/Kconfig
+@@ -9,6 +9,14 @@ config SENSORS_LIS3LV02D
+ 	tristate
+ 	depends on INPUT
+ 
++config BCM2835_SMI
++	tristate "Broadcom 283x Secondary Memory Interface driver"
++	depends on ARCH_BCM2835
++	default m
++	help
++		Driver for enabling and using Broadcom's Secondary/Slow Memory Interface.
++		Appears as /dev/bcm2835_smi. For ioctl interface see drivers/misc/bcm2835_smi.h
++
+ config AD525X_DPOT
+ 	tristate "Analog Devices Digital Potentiometers"
+ 	depends on (I2C || SPI) && SYSFS
+--- a/drivers/misc/Makefile
++++ b/drivers/misc/Makefile
+@@ -9,6 +9,7 @@ obj-$(CONFIG_AD525X_DPOT)	+= ad525x_dpot
+ obj-$(CONFIG_AD525X_DPOT_I2C)	+= ad525x_dpot-i2c.o
+ obj-$(CONFIG_AD525X_DPOT_SPI)	+= ad525x_dpot-spi.o
+ obj-$(CONFIG_ATMEL_SSC)		+= atmel-ssc.o
++obj-$(CONFIG_BCM2835_SMI)	+= bcm2835_smi.o
+ obj-$(CONFIG_DUMMY_IRQ)		+= dummy-irq.o
+ obj-$(CONFIG_ICS932S401)	+= ics932s401.o
+ obj-$(CONFIG_LKDTM)		+= lkdtm/
+--- /dev/null
++++ b/drivers/misc/bcm2835_smi.c
+@@ -0,0 +1,955 @@
++/**
++ * Broadcom Secondary Memory Interface driver
++ *
++ * Written by Luke Wren <luke@raspberrypi.org>
++ * Copyright (c) 2015, Raspberry Pi (Trading) Ltd.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions, and the following disclaimer,
++ *    without modification.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. The names of the above-listed copyright holders may not be used
++ *    to endorse or promote products derived from this software without
++ *    specific prior written permission.
++ *
++ * ALTERNATIVELY, this software may be distributed under the terms of the
++ * GNU General Public License ("GPL") version 2, as published by the Free
++ * Software Foundation.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
++ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
++ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
++ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
++ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
++ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++#include <linux/clk.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/of_address.h>
++#include <linux/of_platform.h>
++#include <linux/mm.h>
++#include <linux/slab.h>
++#include <linux/pagemap.h>
++#include <linux/dma-mapping.h>
++#include <linux/dmaengine.h>
++#include <linux/semaphore.h>
++#include <linux/spinlock.h>
++#include <linux/io.h>
++
++#define BCM2835_SMI_IMPLEMENTATION
++#include <linux/broadcom/bcm2835_smi.h>
++
++#define DRIVER_NAME "smi-bcm2835"
++
++#define N_PAGES_FROM_BYTES(n) ((n + PAGE_SIZE-1) / PAGE_SIZE)
++
++#define DMA_WRITE_TO_MEM true
++#define DMA_READ_FROM_MEM false
++
++struct bcm2835_smi_instance {
++	struct device *dev;
++	struct smi_settings settings;
++	__iomem void *smi_regs_ptr;
++	dma_addr_t smi_regs_busaddr;
++
++	struct dma_chan *dma_chan;
++	struct dma_slave_config dma_config;
++
++	struct bcm2835_smi_bounce_info bounce;
++
++	struct scatterlist buffer_sgl;
++
++	struct clk *clk;
++
++	/* Sometimes we are called into in an atomic context (e.g. by
++	   JFFS2 + MTD) so we can't use a mutex */
++	spinlock_t transaction_lock;
++};
++
++/****************************************************************************
++*
++*   SMI peripheral setup
++*
++***************************************************************************/
++
++static inline void write_smi_reg(struct bcm2835_smi_instance *inst,
++	u32 val, unsigned reg)
++{
++	writel(val, inst->smi_regs_ptr + reg);
++}
++
++static inline u32 read_smi_reg(struct bcm2835_smi_instance *inst, unsigned reg)
++{
++	return readl(inst->smi_regs_ptr + reg);
++}
++
++/* Token-paste macro for e.g SMIDSR_RSTROBE ->  value of SMIDSR_RSTROBE_MASK */
++#define _CONCAT(x, y) x##y
++#define CONCAT(x, y) _CONCAT(x, y)
++
++#define SET_BIT_FIELD(dest, field, bits) ((dest) = \
++	((dest) & ~CONCAT(field, _MASK)) | (((bits) << CONCAT(field, _OFFS))& \
++	 CONCAT(field, _MASK)))
++#define GET_BIT_FIELD(src, field) (((src) & \
++	CONCAT(field, _MASK)) >> CONCAT(field, _OFFS))
++
++static void smi_dump_context_labelled(struct bcm2835_smi_instance *inst,
++	const char *label)
++{
++	dev_err(inst->dev, "SMI context dump: %s", label);
++	dev_err(inst->dev, "SMICS:  0x%08x", read_smi_reg(inst, SMICS));
++	dev_err(inst->dev, "SMIL:   0x%08x", read_smi_reg(inst, SMIL));
++	dev_err(inst->dev, "SMIDSR: 0x%08x", read_smi_reg(inst, SMIDSR0));
++	dev_err(inst->dev, "SMIDSW: 0x%08x", read_smi_reg(inst, SMIDSW0));
++	dev_err(inst->dev, "SMIDC:  0x%08x", read_smi_reg(inst, SMIDC));
++	dev_err(inst->dev, "SMIFD:  0x%08x", read_smi_reg(inst, SMIFD));
++	dev_err(inst->dev, " ");
++}
++
++static inline void smi_dump_context(struct bcm2835_smi_instance *inst)
++{
++	smi_dump_context_labelled(inst, "");
++}
++
++static void smi_get_default_settings(struct bcm2835_smi_instance *inst)
++{
++	struct smi_settings *settings = &inst->settings;
++
++	settings->data_width = SMI_WIDTH_16BIT;
++	settings->pack_data = true;
++
++	settings->read_setup_time = 1;
++	settings->read_hold_time = 1;
++	settings->read_pace_time = 1;
++	settings->read_strobe_time = 3;
++
++	settings->write_setup_time = settings->read_setup_time;
++	settings->write_hold_time = settings->read_hold_time;
++	settings->write_pace_time = settings->read_pace_time;
++	settings->write_strobe_time = settings->read_strobe_time;
++
++	settings->dma_enable = true;
++	settings->dma_passthrough_enable = false;
++	settings->dma_read_thresh = 0x01;
++	settings->dma_write_thresh = 0x3f;
++	settings->dma_panic_read_thresh = 0x20;
++	settings->dma_panic_write_thresh = 0x20;
++}
++
++void bcm2835_smi_set_regs_from_settings(struct bcm2835_smi_instance *inst)
++{
++	struct smi_settings *settings = &inst->settings;
++	int smidsr_temp = 0, smidsw_temp = 0, smics_temp,
++	    smidcs_temp, smidc_temp = 0;
++
++	spin_lock(&inst->transaction_lock);
++
++	/* temporarily disable the peripheral: */
++	smics_temp = read_smi_reg(inst, SMICS);
++	write_smi_reg(inst, 0, SMICS);
++	smidcs_temp = read_smi_reg(inst, SMIDCS);
++	write_smi_reg(inst, 0, SMIDCS);
++
++	if (settings->pack_data)
++		smics_temp |= SMICS_PXLDAT;
++	else
++		smics_temp &= ~SMICS_PXLDAT;
++
++	SET_BIT_FIELD(smidsr_temp, SMIDSR_RWIDTH, settings->data_width);
++	SET_BIT_FIELD(smidsr_temp, SMIDSR_RSETUP, settings->read_setup_time);
++	SET_BIT_FIELD(smidsr_temp, SMIDSR_RHOLD, settings->read_hold_time);
++	SET_BIT_FIELD(smidsr_temp, SMIDSR_RPACE, settings->read_pace_time);
++	SET_BIT_FIELD(smidsr_temp, SMIDSR_RSTROBE, settings->read_strobe_time);
++	write_smi_reg(inst, smidsr_temp, SMIDSR0);
++
++	SET_BIT_FIELD(smidsw_temp, SMIDSW_WWIDTH, settings->data_width);
++	if (settings->data_width == SMI_WIDTH_8BIT)
++		smidsw_temp |= SMIDSW_WSWAP;
++	else
++		smidsw_temp &= ~SMIDSW_WSWAP;
++	SET_BIT_FIELD(smidsw_temp, SMIDSW_WSETUP, settings->write_setup_time);
++	SET_BIT_FIELD(smidsw_temp, SMIDSW_WHOLD, settings->write_hold_time);
++	SET_BIT_FIELD(smidsw_temp, SMIDSW_WPACE, settings->write_pace_time);
++	SET_BIT_FIELD(smidsw_temp, SMIDSW_WSTROBE,
++			settings->write_strobe_time);
++	write_smi_reg(inst, smidsw_temp, SMIDSW0);
++
++	SET_BIT_FIELD(smidc_temp, SMIDC_REQR, settings->dma_read_thresh);
++	SET_BIT_FIELD(smidc_temp, SMIDC_REQW, settings->dma_write_thresh);
++	SET_BIT_FIELD(smidc_temp, SMIDC_PANICR,
++		      settings->dma_panic_read_thresh);
++	SET_BIT_FIELD(smidc_temp, SMIDC_PANICW,
++		      settings->dma_panic_write_thresh);
++	if (settings->dma_passthrough_enable) {
++		smidc_temp |= SMIDC_DMAP;
++		smidsr_temp |= SMIDSR_RDREQ;
++		write_smi_reg(inst, smidsr_temp, SMIDSR0);
++		smidsw_temp |= SMIDSW_WDREQ;
++		write_smi_reg(inst, smidsw_temp, SMIDSW0);
++	} else
++		smidc_temp &= ~SMIDC_DMAP;
++	if (settings->dma_enable)
++		smidc_temp |= SMIDC_DMAEN;
++	else
++		smidc_temp &= ~SMIDC_DMAEN;
++
++	write_smi_reg(inst, smidc_temp, SMIDC);
++
++	/* re-enable (if was previously enabled) */
++	write_smi_reg(inst, smics_temp, SMICS);
++	write_smi_reg(inst, smidcs_temp, SMIDCS);
++
++	spin_unlock(&inst->transaction_lock);
++}
++EXPORT_SYMBOL(bcm2835_smi_set_regs_from_settings);
++
++struct smi_settings *bcm2835_smi_get_settings_from_regs
++	(struct bcm2835_smi_instance *inst)
++{
++	struct smi_settings *settings = &inst->settings;
++	int smidsr, smidsw, smidc;
++
++	spin_lock(&inst->transaction_lock);
++
++	smidsr = read_smi_reg(inst, SMIDSR0);
++	smidsw = read_smi_reg(inst, SMIDSW0);
++	smidc = read_smi_reg(inst, SMIDC);
++
++	settings->pack_data = (read_smi_reg(inst, SMICS) & SMICS_PXLDAT) ?
++	    true : false;
++
++	settings->data_width = GET_BIT_FIELD(smidsr, SMIDSR_RWIDTH);
++	settings->read_setup_time = GET_BIT_FIELD(smidsr, SMIDSR_RSETUP);
++	settings->read_hold_time = GET_BIT_FIELD(smidsr, SMIDSR_RHOLD);
++	settings->read_pace_time = GET_BIT_FIELD(smidsr, SMIDSR_RPACE);
++	settings->read_strobe_time = GET_BIT_FIELD(smidsr, SMIDSR_RSTROBE);
++
++	settings->write_setup_time = GET_BIT_FIELD(smidsw, SMIDSW_WSETUP);
++	settings->write_hold_time = GET_BIT_FIELD(smidsw, SMIDSW_WHOLD);
++	settings->write_pace_time = GET_BIT_FIELD(smidsw, SMIDSW_WPACE);
++	settings->write_strobe_time = GET_BIT_FIELD(smidsw, SMIDSW_WSTROBE);
++
++	settings->dma_read_thresh = GET_BIT_FIELD(smidc, SMIDC_REQR);
++	settings->dma_write_thresh = GET_BIT_FIELD(smidc, SMIDC_REQW);
++	settings->dma_panic_read_thresh = GET_BIT_FIELD(smidc, SMIDC_PANICR);
++	settings->dma_panic_write_thresh = GET_BIT_FIELD(smidc, SMIDC_PANICW);
++	settings->dma_passthrough_enable = (smidc & SMIDC_DMAP) ? true : false;
++	settings->dma_enable = (smidc & SMIDC_DMAEN) ? true : false;
++
++	spin_unlock(&inst->transaction_lock);
++
++	return settings;
++}
++EXPORT_SYMBOL(bcm2835_smi_get_settings_from_regs);
++
++static inline void smi_set_address(struct bcm2835_smi_instance *inst,
++	unsigned int address)
++{
++	int smia_temp = 0, smida_temp = 0;
++
++	SET_BIT_FIELD(smia_temp, SMIA_ADDR, address);
++	SET_BIT_FIELD(smida_temp, SMIDA_ADDR, address);
++
++	/* Write to both address registers - user doesn't care whether we're
++	   doing programmed or direct transfers. */
++	write_smi_reg(inst, smia_temp, SMIA);
++	write_smi_reg(inst, smida_temp, SMIDA);
++}
++
++static void smi_setup_regs(struct bcm2835_smi_instance *inst)
++{
++
++	dev_dbg(inst->dev, "Initialising SMI registers...");
++	/* Disable the peripheral if already enabled */
++	write_smi_reg(inst, 0, SMICS);
++	write_smi_reg(inst, 0, SMIDCS);
++
++	smi_get_default_settings(inst);
++	bcm2835_smi_set_regs_from_settings(inst);
++	smi_set_address(inst, 0);
++
++	write_smi_reg(inst, read_smi_reg(inst, SMICS) | SMICS_ENABLE, SMICS);
++	write_smi_reg(inst, read_smi_reg(inst, SMIDCS) | SMIDCS_ENABLE,
++		SMIDCS);
++}
++
++/****************************************************************************
++*
++*   Low-level SMI access functions
++*   Other modules should use the exported higher-level functions e.g.
++*   bcm2835_smi_write_buf() unless they have a good reason to use these
++*
++***************************************************************************/
++
++static inline uint32_t smi_read_single_word(struct bcm2835_smi_instance *inst)
++{
++	int timeout = 0;
++
++	write_smi_reg(inst, SMIDCS_ENABLE, SMIDCS);
++	write_smi_reg(inst, SMIDCS_ENABLE | SMIDCS_START, SMIDCS);
++	/* Make sure things happen in the right order...*/
++	mb();
++	while (!(read_smi_reg(inst, SMIDCS) & SMIDCS_DONE) &&
++		++timeout < 10000)
++		;
++	if (timeout < 10000)
++		return read_smi_reg(inst, SMIDD);
++
++	dev_err(inst->dev,
++		"SMI direct read timed out (is the clock set up correctly?)");
++	return 0;
++}
++
++static inline void smi_write_single_word(struct bcm2835_smi_instance *inst,
++	uint32_t data)
++{
++	int timeout = 0;
++
++	write_smi_reg(inst, SMIDCS_ENABLE | SMIDCS_WRITE, SMIDCS);
++	write_smi_reg(inst, data, SMIDD);
++	write_smi_reg(inst, SMIDCS_ENABLE | SMIDCS_WRITE | SMIDCS_START,
++		SMIDCS);
++
++	while (!(read_smi_reg(inst, SMIDCS) & SMIDCS_DONE) &&
++		++timeout < 10000)
++		;
++	if (timeout >= 10000)
++		dev_err(inst->dev,
++		"SMI direct write timed out (is the clock set up correctly?)");
++}
++
++/* Initiates a programmed read into the read FIFO. It is up to the caller to
++ * read data from the FIFO -  either via paced DMA transfer,
++ * or polling SMICS_RXD to check whether data is available.
++ * SMICS_ACTIVE will go low upon completion. */
++static void smi_init_programmed_read(struct bcm2835_smi_instance *inst,
++	int num_transfers)
++{
++	int smics_temp;
++
++	/* Disable the peripheral: */
++	smics_temp = read_smi_reg(inst, SMICS) & ~(SMICS_ENABLE | SMICS_WRITE);
++	write_smi_reg(inst, smics_temp, SMICS);
++	while (read_smi_reg(inst, SMICS) & SMICS_ENABLE)
++		;
++
++	/* Program the transfer count: */
++	write_smi_reg(inst, num_transfers, SMIL);
++
++	/* re-enable and start: */
++	smics_temp |= SMICS_ENABLE;
++	write_smi_reg(inst, smics_temp, SMICS);
++	smics_temp |= SMICS_CLEAR;
++	/* Just to be certain: */
++	mb();
++	while (read_smi_reg(inst, SMICS) & SMICS_ACTIVE)
++		;
++	write_smi_reg(inst, smics_temp, SMICS);
++	smics_temp |= SMICS_START;
++	write_smi_reg(inst, smics_temp, SMICS);
++}
++
++/* Initiates a programmed write sequence, using data from the write FIFO.
++ * It is up to the caller to initiate a DMA transfer before calling,
++ * or use another method to keep the write FIFO topped up.
++ * SMICS_ACTIVE will go low upon completion.
++ */
++static void smi_init_programmed_write(struct bcm2835_smi_instance *inst,
++	int num_transfers)
++{
++	int smics_temp;
++
++	/* Disable the peripheral: */
++	smics_temp = read_smi_reg(inst, SMICS) & ~SMICS_ENABLE;
++	write_smi_reg(inst, smics_temp, SMICS);
++	while (read_smi_reg(inst, SMICS) & SMICS_ENABLE)
++		;
++
++	/* Program the transfer count: */
++	write_smi_reg(inst, num_transfers, SMIL);
++
++	/* setup, re-enable and start: */
++	smics_temp |= SMICS_WRITE | SMICS_ENABLE;
++	write_smi_reg(inst, smics_temp, SMICS);
++	smics_temp |= SMICS_START;
++	write_smi_reg(inst, smics_temp, SMICS);
++}
++
++/* Initiate a read and then poll FIFO for data, reading out as it appears. */
++static void smi_read_fifo(struct bcm2835_smi_instance *inst,
++	uint32_t *dest, int n_bytes)
++{
++	if (read_smi_reg(inst, SMICS) & SMICS_RXD) {
++		smi_dump_context_labelled(inst,
++			"WARNING: read FIFO not empty at start of read call.");
++		while (read_smi_reg(inst, SMICS))
++			;
++	}
++
++	/* Dispatch the read: */
++	if (inst->settings.data_width == SMI_WIDTH_8BIT)
++		smi_init_programmed_read(inst, n_bytes);
++	else if (inst->settings.data_width == SMI_WIDTH_16BIT)
++		smi_init_programmed_read(inst, n_bytes / 2);
++	else {
++		dev_err(inst->dev, "Unsupported data width for read.");
++		return;
++	}
++
++	/* Poll FIFO to keep it empty */
++	while (!(read_smi_reg(inst, SMICS) & SMICS_DONE))
++		if (read_smi_reg(inst, SMICS) & SMICS_RXD)
++			*dest++ = read_smi_reg(inst, SMID);
++
++	/* Ensure that the FIFO is emptied */
++	if (read_smi_reg(inst, SMICS) & SMICS_RXD) {
++		int fifo_count;
++
++		fifo_count = GET_BIT_FIELD(read_smi_reg(inst, SMIFD),
++			SMIFD_FCNT);
++		while (fifo_count--)
++			*dest++ = read_smi_reg(inst, SMID);
++	}
++
++	if (!(read_smi_reg(inst, SMICS) & SMICS_DONE))
++		smi_dump_context_labelled(inst,
++			"WARNING: transaction finished but done bit not set.");
++
++	if (read_smi_reg(inst, SMICS) & SMICS_RXD)
++		smi_dump_context_labelled(inst,
++			"WARNING: read FIFO not empty at end of read call.");
++
++}
++
++/* Initiate a write, and then keep the FIFO topped up. */
++static void smi_write_fifo(struct bcm2835_smi_instance *inst,
++	uint32_t *src, int n_bytes)
++{
++	int i, timeout = 0;
++
++	/* Empty FIFOs if not already so */
++	if (!(read_smi_reg(inst, SMICS) & SMICS_TXE)) {
++		smi_dump_context_labelled(inst,
++		    "WARNING: write fifo not empty at start of write call.");
++		write_smi_reg(inst, read_smi_reg(inst, SMICS) | SMICS_CLEAR,
++			SMICS);
++	}
++
++	/* Initiate the transfer */
++	if (inst->settings.data_width == SMI_WIDTH_8BIT)
++		smi_init_programmed_write(inst, n_bytes);
++	else if (inst->settings.data_width == SMI_WIDTH_16BIT)
++		smi_init_programmed_write(inst, n_bytes / 2);
++	else {
++		dev_err(inst->dev, "Unsupported data width for write.");
++		return;
++	}
++	/* Fill the FIFO: */
++	for (i = 0; i < (n_bytes - 1) / 4 + 1; ++i) {
++		while (!(read_smi_reg(inst, SMICS) & SMICS_TXD))
++			;
++		write_smi_reg(inst, *src++, SMID);
++	}
++	/* Busy wait... */
++	while (!(read_smi_reg(inst, SMICS) & SMICS_DONE) && ++timeout <
++		1000000)
++		;
++	if (timeout >= 1000000)
++		smi_dump_context_labelled(inst,
++			"Timed out on write operation!");
++	if (!(read_smi_reg(inst, SMICS) & SMICS_TXE))
++		smi_dump_context_labelled(inst,
++			"WARNING: FIFO not empty at end of write operation.");
++}
++
++/****************************************************************************
++*
++*   SMI DMA operations
++*
++***************************************************************************/
++
++/* Disable SMI and put it into the correct direction before doing DMA setup.
++   Stops spurious DREQs during setup. Peripheral is re-enabled by init_*() */
++static void smi_disable(struct bcm2835_smi_instance *inst,
++	enum dma_transfer_direction direction)
++{
++	int smics_temp = read_smi_reg(inst, SMICS) & ~SMICS_ENABLE;
++
++	if (direction == DMA_DEV_TO_MEM)
++		smics_temp &= ~SMICS_WRITE;
++	else
++		smics_temp |= SMICS_WRITE;
++	write_smi_reg(inst, smics_temp, SMICS);
++	while (read_smi_reg(inst, SMICS) & SMICS_ACTIVE)
++		;
++}
++
++static struct scatterlist *smi_scatterlist_from_buffer(
++	struct bcm2835_smi_instance *inst,
++	dma_addr_t buf,
++	size_t len,
++	struct scatterlist *sg)
++{
++	sg_init_table(sg, 1);
++	sg_dma_address(sg) = buf;
++	sg_dma_len(sg) = len;
++	return sg;
++}
++
++static void smi_dma_callback_user_copy(void *param)
++{
++	/* Notify the bottom half that a chunk is ready for user copy */
++	struct bcm2835_smi_instance *inst =
++		(struct bcm2835_smi_instance *)param;
++
++	up(&inst->bounce.callback_sem);
++}
++
++/* Creates a descriptor, assigns the given callback, and submits the
++   descriptor to dmaengine. Does not block - can queue up multiple
++   descriptors and then wait for them all to complete.
++   sg_len is the number of control blocks, NOT the number of bytes.
++   dir can be DMA_MEM_TO_DEV or DMA_DEV_TO_MEM.
++   callback can be NULL - in this case it is not called. */
++static inline struct dma_async_tx_descriptor *smi_dma_submit_sgl(
++	struct bcm2835_smi_instance *inst,
++	struct scatterlist *sgl,
++	size_t sg_len,
++	enum dma_transfer_direction dir,
++	dma_async_tx_callback callback)
++{
++	struct dma_async_tx_descriptor *desc;
++
++	desc = dmaengine_prep_slave_sg(inst->dma_chan,
++				       sgl,
++				       sg_len,
++				       dir,
++				       DMA_PREP_INTERRUPT | DMA_CTRL_ACK |
++				       DMA_PREP_FENCE);
++	if (!desc) {
++		dev_err(inst->dev, "read_sgl: dma slave preparation failed!");
++		write_smi_reg(inst, read_smi_reg(inst, SMICS) & ~SMICS_ACTIVE,
++			SMICS);
++		while (read_smi_reg(inst, SMICS) & SMICS_ACTIVE)
++			cpu_relax();
++		write_smi_reg(inst, read_smi_reg(inst, SMICS) | SMICS_ACTIVE,
++			SMICS);
++		return NULL;
++	}
++	desc->callback = callback;
++	desc->callback_param = inst;
++	if (dmaengine_submit(desc) < 0)
++		return NULL;
++	return desc;
++}
++
++/* NB this function blocks until the transfer is complete */
++static void
++smi_dma_read_sgl(struct bcm2835_smi_instance *inst,
++	struct scatterlist *sgl, size_t sg_len, size_t n_bytes)
++{
++	struct dma_async_tx_descriptor *desc;
++
++	/* Disable SMI and set to read before dispatching DMA - if SMI is in
++	 * write mode and TX fifo is empty, it will generate a DREQ which may
++	 * cause the read DMA to complete before the SMI read command is even
++	 * dispatched! We want to dispatch DMA before SMI read so that reading
++	 * is gapless, for logic analyser.
++	 */
++
++	smi_disable(inst, DMA_DEV_TO_MEM);
++
++	desc = smi_dma_submit_sgl(inst, sgl, sg_len, DMA_DEV_TO_MEM, NULL);
++	dma_async_issue_pending(inst->dma_chan);
++
++	if (inst->settings.data_width == SMI_WIDTH_8BIT)
++		smi_init_programmed_read(inst, n_bytes);
++	else
++		smi_init_programmed_read(inst, n_bytes / 2);
++
++	if (dma_wait_for_async_tx(desc) == DMA_ERROR)
++		smi_dump_context_labelled(inst, "DMA timeout!");
++}
++
++static void
++smi_dma_write_sgl(struct bcm2835_smi_instance *inst,
++	struct scatterlist *sgl, size_t sg_len, size_t n_bytes)
++{
++	struct dma_async_tx_descriptor *desc;
++
++	if (inst->settings.data_width == SMI_WIDTH_8BIT)
++		smi_init_programmed_write(inst, n_bytes);
++	else
++		smi_init_programmed_write(inst, n_bytes / 2);
++
++	desc = smi_dma_submit_sgl(inst, sgl, sg_len, DMA_MEM_TO_DEV, NULL);
++	dma_async_issue_pending(inst->dma_chan);
++
++	if (dma_wait_for_async_tx(desc) == DMA_ERROR)
++		smi_dump_context_labelled(inst, "DMA timeout!");
++	else
++		/* Wait for SMI to finish our writes */
++		while (!(read_smi_reg(inst, SMICS) & SMICS_DONE))
++			cpu_relax();
++}
++
++ssize_t bcm2835_smi_user_dma(
++	struct bcm2835_smi_instance *inst,
++	enum dma_transfer_direction dma_dir,
++	char __user *user_ptr, size_t count,
++	struct bcm2835_smi_bounce_info **bounce)
++{
++	int chunk_no = 0, chunk_size, count_left = count;
++	struct scatterlist *sgl;
++	void (*init_trans_func)(struct bcm2835_smi_instance *, int);
++
++	spin_lock(&inst->transaction_lock);
++
++	if (dma_dir == DMA_DEV_TO_MEM)
++		init_trans_func = smi_init_programmed_read;
++	else
++		init_trans_func = smi_init_programmed_write;
++
++	smi_disable(inst, dma_dir);
++
++	sema_init(&inst->bounce.callback_sem, 0);
++	if (bounce)
++		*bounce = &inst->bounce;
++	while (count_left) {
++		chunk_size = count_left > DMA_BOUNCE_BUFFER_SIZE ?
++			DMA_BOUNCE_BUFFER_SIZE : count_left;
++		if (chunk_size == DMA_BOUNCE_BUFFER_SIZE) {
++			sgl =
++			&inst->bounce.sgl[chunk_no % DMA_BOUNCE_BUFFER_COUNT];
++		} else {
++			sgl = smi_scatterlist_from_buffer(
++				inst,
++				inst->bounce.phys[
++					chunk_no % DMA_BOUNCE_BUFFER_COUNT],
++				chunk_size,
++				&inst->buffer_sgl);
++		}
++
++		if (!smi_dma_submit_sgl(inst, sgl, 1, dma_dir,
++			smi_dma_callback_user_copy
++		)) {
++			dev_err(inst->dev, "sgl submit failed");
++			count = 0;
++			goto out;
++		}
++		count_left -= chunk_size;
++		chunk_no++;
++	}
++	dma_async_issue_pending(inst->dma_chan);
++
++	if (inst->settings.data_width == SMI_WIDTH_8BIT)
++		init_trans_func(inst, count);
++	else if (inst->settings.data_width == SMI_WIDTH_16BIT)
++		init_trans_func(inst, count / 2);
++out:
++	spin_unlock(&inst->transaction_lock);
++	return count;
++}
++EXPORT_SYMBOL(bcm2835_smi_user_dma);
++
++
++/****************************************************************************
++*
++*   High level buffer transfer functions - for use by other drivers
++*
++***************************************************************************/
++
++/* Buffer must be physically contiguous - i.e. kmalloc, not vmalloc! */
++void bcm2835_smi_write_buf(
++	struct bcm2835_smi_instance *inst,
++	const void *buf, size_t n_bytes)
++{
++	int odd_bytes = n_bytes & 0x3;
++
++	n_bytes -= odd_bytes;
++
++	spin_lock(&inst->transaction_lock);
++
++	if (n_bytes > DMA_THRESHOLD_BYTES) {
++		dma_addr_t phy_addr = dma_map_single(
++			inst->dev,
++			(void *)buf,
++			n_bytes,
++			DMA_TO_DEVICE);
++		struct scatterlist *sgl =
++			smi_scatterlist_from_buffer(inst, phy_addr, n_bytes,
++				&inst->buffer_sgl);
++
++		if (!sgl) {
++			smi_dump_context_labelled(inst,
++			"Error: could not create scatterlist for write!");
++			goto out;
++		}
++		smi_dma_write_sgl(inst, sgl, 1, n_bytes);
++
++		dma_unmap_single
++			(inst->dev, phy_addr, n_bytes, DMA_TO_DEVICE);
++	} else if (n_bytes) {
++		smi_write_fifo(inst, (uint32_t *) buf, n_bytes);
++	}
++	buf += n_bytes;
++
++	if (inst->settings.data_width == SMI_WIDTH_8BIT) {
++		while (odd_bytes--)
++			smi_write_single_word(inst, *(uint8_t *) (buf++));
++	} else {
++		while (odd_bytes >= 2) {
++			smi_write_single_word(inst, *(uint16_t *)buf);
++			buf += 2;
++			odd_bytes -= 2;
++		}
++		if (odd_bytes) {
++			/* Reading an odd number of bytes on a 16 bit bus is
++			   a user bug. It's kinder to fail early and tell them
++			   than to e.g. transparently give them the bottom byte
++			   of a 16 bit transfer. */
++			dev_err(inst->dev,
++		"WARNING: odd number of bytes specified for wide transfer.");
++			dev_err(inst->dev,
++		"At least one byte dropped as a result.");
++			dump_stack();
++		}
++	}
++out:
++	spin_unlock(&inst->transaction_lock);
++}
++EXPORT_SYMBOL(bcm2835_smi_write_buf);
++
++void bcm2835_smi_read_buf(struct bcm2835_smi_instance *inst,
++	void *buf, size_t n_bytes)
++{
++
++	/* SMI is inherently 32-bit, which causes surprising amounts of mess
++	   for bytes % 4 != 0. Easiest to avoid this mess altogether
++	   by handling remainder separately. */
++	int odd_bytes = n_bytes & 0x3;
++
++	spin_lock(&inst->transaction_lock);
++	n_bytes -= odd_bytes;
++	if (n_bytes > DMA_THRESHOLD_BYTES) {
++		dma_addr_t phy_addr = dma_map_single(inst->dev,
++						     buf, n_bytes,
++						     DMA_FROM_DEVICE);
++		struct scatterlist *sgl = smi_scatterlist_from_buffer(
++			inst, phy_addr, n_bytes,
++			&inst->buffer_sgl);
++		if (!sgl) {
++			smi_dump_context_labelled(inst,
++			"Error: could not create scatterlist for read!");
++			goto out;
++		}
++		smi_dma_read_sgl(inst, sgl, 1, n_bytes);
++		dma_unmap_single(inst->dev, phy_addr, n_bytes, DMA_FROM_DEVICE);
++	} else if (n_bytes) {
++		smi_read_fifo(inst, (uint32_t *)buf, n_bytes);
++	}
++	buf += n_bytes;
++
++	if (inst->settings.data_width == SMI_WIDTH_8BIT) {
++		while (odd_bytes--)
++			*((uint8_t *) (buf++)) = smi_read_single_word(inst);
++	} else {
++		while (odd_bytes >= 2) {
++			*(uint16_t *) buf = smi_read_single_word(inst);
++			buf += 2;
++			odd_bytes -= 2;
++		}
++		if (odd_bytes) {
++			dev_err(inst->dev,
++		"WARNING: odd number of bytes specified for wide transfer.");
++			dev_err(inst->dev,
++		"At least one byte dropped as a result.");
++			dump_stack();
++		}
++	}
++out:
++	spin_unlock(&inst->transaction_lock);
++}
++EXPORT_SYMBOL(bcm2835_smi_read_buf);
++
++void bcm2835_smi_set_address(struct bcm2835_smi_instance *inst,
++	unsigned int address)
++{
++	spin_lock(&inst->transaction_lock);
++	smi_set_address(inst, address);
++	spin_unlock(&inst->transaction_lock);
++}
++EXPORT_SYMBOL(bcm2835_smi_set_address);
++
++struct bcm2835_smi_instance *bcm2835_smi_get(struct device_node *node)
++{
++	struct platform_device *pdev;
++
++	if (!node)
++		return NULL;
++
++	pdev = of_find_device_by_node(node);
++	if (!pdev)
++		return NULL;
++
++	return platform_get_drvdata(pdev);
++}
++EXPORT_SYMBOL(bcm2835_smi_get);
++
++/****************************************************************************
++*
++*   bcm2835_smi_probe - called when the driver is loaded.
++*
++***************************************************************************/
++
++static int bcm2835_smi_dma_setup(struct bcm2835_smi_instance *inst)
++{
++	int i, rv = 0;
++
++	inst->dma_chan = dma_request_slave_channel(inst->dev, "rx-tx");
++
++	inst->dma_config.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++	inst->dma_config.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++	inst->dma_config.src_addr = inst->smi_regs_busaddr + SMID;
++	inst->dma_config.dst_addr = inst->dma_config.src_addr;
++	/* Direction unimportant - always overridden by prep_slave_sg */
++	inst->dma_config.direction = DMA_DEV_TO_MEM;
++	dmaengine_slave_config(inst->dma_chan, &inst->dma_config);
++	/* Alloc and map bounce buffers */
++	for (i = 0; i < DMA_BOUNCE_BUFFER_COUNT; ++i) {
++		inst->bounce.buffer[i] =
++		dmam_alloc_coherent(inst->dev, DMA_BOUNCE_BUFFER_SIZE,
++				&inst->bounce.phys[i],
++				GFP_KERNEL);
++		if (!inst->bounce.buffer[i]) {
++			dev_err(inst->dev, "Could not allocate buffer!");
++			rv = -ENOMEM;
++			break;
++		}
++		smi_scatterlist_from_buffer(
++			inst,
++			inst->bounce.phys[i],
++			DMA_BOUNCE_BUFFER_SIZE,
++			&inst->bounce.sgl[i]
++		);
++	}
++
++	return rv;
++}
++
++static int bcm2835_smi_probe(struct platform_device *pdev)
++{
++	int err;
++	struct device *dev = &pdev->dev;
++	struct device_node *node = dev->of_node;
++	struct resource *ioresource;
++	struct bcm2835_smi_instance *inst;
++	const __be32 *addr;
++
++	/* We require device tree support */
++	if (!node)
++		return -EINVAL;
++	/* Allocate buffers and instance data */
++	inst = devm_kzalloc(dev, sizeof(struct bcm2835_smi_instance),
++		GFP_KERNEL);
++	if (!inst)
++		return -ENOMEM;
++
++	inst->dev = dev;
++	spin_lock_init(&inst->transaction_lock);
++
++	ioresource = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	inst->smi_regs_ptr = devm_ioremap_resource(dev, ioresource);
++	if (IS_ERR(inst->smi_regs_ptr)) {
++		err = PTR_ERR(inst->smi_regs_ptr);
++		goto err;
++	}
++	addr = of_get_address(node, 0, NULL, NULL);
++	inst->smi_regs_busaddr = be32_to_cpu(*addr);
++
++	err = bcm2835_smi_dma_setup(inst);
++	if (err)
++		goto err;
++
++	/* request clock */
++	inst->clk = devm_clk_get(dev, NULL);
++	if (!inst->clk)
++		goto err;
++	clk_prepare_enable(inst->clk);
++
++	/* Finally, do peripheral setup */
++	smi_setup_regs(inst);
++
++	platform_set_drvdata(pdev, inst);
++
++	dev_info(inst->dev, "initialised");
++
++	return 0;
++err:
++	kfree(inst);
++	return err;
++}
++
++/****************************************************************************
++*
++*   bcm2835_smi_remove - called when the driver is unloaded.
++*
++***************************************************************************/
++
++static int bcm2835_smi_remove(struct platform_device *pdev)
++{
++	struct bcm2835_smi_instance *inst = platform_get_drvdata(pdev);
++	struct device *dev = inst->dev;
++
++	dmaengine_terminate_all(inst->dma_chan);
++	dma_release_channel(inst->dma_chan);
++
++	clk_disable_unprepare(inst->clk);
++
++	dev_info(dev, "SMI device removed - OK");
++	return 0;
++}
++
++/****************************************************************************
++*
++*   Register the driver with device tree
++*
++***************************************************************************/
++
++static const struct of_device_id bcm2835_smi_of_match[] = {
++	{.compatible = "brcm,bcm2835-smi",},
++	{ /* sentinel */ },
++};
++
++MODULE_DEVICE_TABLE(of, bcm2835_smi_of_match);
++
++static struct platform_driver bcm2835_smi_driver = {
++	.probe = bcm2835_smi_probe,
++	.remove = bcm2835_smi_remove,
++	.driver = {
++		   .name = DRIVER_NAME,
++		   .owner = THIS_MODULE,
++		   .of_match_table = bcm2835_smi_of_match,
++		   },
++};
++
++module_platform_driver(bcm2835_smi_driver);
++
++MODULE_ALIAS("platform:smi-bcm2835");
++MODULE_LICENSE("GPL");
++MODULE_DESCRIPTION("Device driver for BCM2835's secondary memory interface");
++MODULE_AUTHOR("Luke Wren <luke@raspberrypi.org>");
+--- /dev/null
++++ b/include/linux/broadcom/bcm2835_smi.h
+@@ -0,0 +1,391 @@
++/**
++ * Declarations and definitions for Broadcom's Secondary Memory Interface
++ *
++ * Written by Luke Wren <luke@raspberrypi.org>
++ * Copyright (c) 2015, Raspberry Pi (Trading) Ltd.
++ * Copyright (c) 2010-2012 Broadcom. All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions, and the following disclaimer,
++ *    without modification.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. The names of the above-listed copyright holders may not be used
++ *    to endorse or promote products derived from this software without
++ *    specific prior written permission.
++ *
++ * ALTERNATIVELY, this software may be distributed under the terms of the
++ * GNU General Public License ("GPL") version 2, as published by the Free
++ * Software Foundation.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
++ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
++ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
++ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
++ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
++ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++#ifndef BCM2835_SMI_H
++#define BCM2835_SMI_H
++
++#include <linux/ioctl.h>
++
++#ifndef __KERNEL__
++#include <stdint.h>
++#include <stdbool.h>
++#endif
++
++#define BCM2835_SMI_IOC_MAGIC 0x1
++#define BCM2835_SMI_INVALID_HANDLE (~0)
++
++/* IOCTLs 0x100...0x1ff are not device-specific - we can use them */
++#define BCM2835_SMI_IOC_GET_SETTINGS    _IO(BCM2835_SMI_IOC_MAGIC, 0)
++#define BCM2835_SMI_IOC_WRITE_SETTINGS  _IO(BCM2835_SMI_IOC_MAGIC, 1)
++#define BCM2835_SMI_IOC_ADDRESS	 _IO(BCM2835_SMI_IOC_MAGIC, 2)
++#define BCM2835_SMI_IOC_MAX	     2
++
++#define SMI_WIDTH_8BIT 0
++#define SMI_WIDTH_16BIT 1
++#define SMI_WIDTH_9BIT 2
++#define SMI_WIDTH_18BIT 3
++
++/* max number of bytes where DMA will not be used */
++#define DMA_THRESHOLD_BYTES 128
++#define DMA_BOUNCE_BUFFER_SIZE (1024 * 1024 / 2)
++#define DMA_BOUNCE_BUFFER_COUNT 3
++
++
++struct smi_settings {
++	int data_width;
++	/* Whether or not to pack multiple SMI transfers into a
++	   single 32 bit FIFO word */
++	bool pack_data;
++
++	/* Timing for reads (writes the same but for WE)
++	 *
++	 * OE ----------+	   +--------------------
++	 *		|	   |
++	 *		+----------+
++	 * SD -<==============================>-----------
++	 * SA -<=========================================>-
++	 *    <-setup->  <-strobe ->  <-hold ->  <- pace ->
++	 */
++
++	int read_setup_time;
++	int read_hold_time;
++	int read_pace_time;
++	int read_strobe_time;
++
++	int write_setup_time;
++	int write_hold_time;
++	int write_pace_time;
++	int write_strobe_time;
++
++	bool dma_enable;		/* DREQs */
++	bool dma_passthrough_enable;	/* External DREQs */
++	int dma_read_thresh;
++	int dma_write_thresh;
++	int dma_panic_read_thresh;
++	int dma_panic_write_thresh;
++};
++
++/****************************************************************************
++*
++*   Declare exported SMI functions
++*
++***************************************************************************/
++
++#ifdef __KERNEL__
++
++#include <linux/dmaengine.h> /* for enum dma_transfer_direction */
++#include <linux/of.h>
++#include <linux/semaphore.h>
++
++struct bcm2835_smi_instance;
++
++struct bcm2835_smi_bounce_info {
++	struct semaphore callback_sem;
++	void *buffer[DMA_BOUNCE_BUFFER_COUNT];
++	dma_addr_t phys[DMA_BOUNCE_BUFFER_COUNT];
++	struct scatterlist sgl[DMA_BOUNCE_BUFFER_COUNT];
++};
++
++
++void bcm2835_smi_set_regs_from_settings(struct bcm2835_smi_instance *);
++
++struct smi_settings *bcm2835_smi_get_settings_from_regs(
++	struct bcm2835_smi_instance *inst);
++
++void bcm2835_smi_write_buf(
++	struct bcm2835_smi_instance *inst,
++	const void *buf,
++	size_t n_bytes);
++
++void bcm2835_smi_read_buf(
++	struct bcm2835_smi_instance *inst,
++	void *buf,
++	size_t n_bytes);
++
++void bcm2835_smi_set_address(struct bcm2835_smi_instance *inst,
++	unsigned int address);
++
++ssize_t bcm2835_smi_user_dma(
++	struct bcm2835_smi_instance *inst,
++	enum dma_transfer_direction dma_dir,
++	char __user *user_ptr,
++	size_t count,
++	struct bcm2835_smi_bounce_info **bounce);
++
++struct bcm2835_smi_instance *bcm2835_smi_get(struct device_node *node);
++
++#endif /* __KERNEL__ */
++
++/****************************************************************
++*
++*	Implementation-only declarations
++*
++****************************************************************/
++
++#ifdef BCM2835_SMI_IMPLEMENTATION
++
++/* Clock manager registers for SMI clock: */
++#define CM_SMI_BASE_ADDRESS ((BCM2708_PERI_BASE) + 0x1010b0)
++/* Clock manager "password" to protect registers from spurious writes */
++#define CM_PWD (0x5a << 24)
++
++#define CM_SMI_CTL	0x00
++#define CM_SMI_DIV	0x04
++
++#define CM_SMI_CTL_FLIP (1 << 8)
++#define CM_SMI_CTL_BUSY (1 << 7)
++#define CM_SMI_CTL_KILL (1 << 5)
++#define CM_SMI_CTL_ENAB (1 << 4)
++#define CM_SMI_CTL_SRC_MASK (0xf)
++#define CM_SMI_CTL_SRC_OFFS (0)
++
++#define CM_SMI_DIV_DIVI_MASK (0xf <<  12)
++#define CM_SMI_DIV_DIVI_OFFS (12)
++#define CM_SMI_DIV_DIVF_MASK (0xff << 4)
++#define CM_SMI_DIV_DIVF_OFFS (4)
++
++/* SMI register mapping:*/
++#define SMI_BASE_ADDRESS ((BCM2708_PERI_BASE) + 0x600000)
++
++#define SMICS	0x00	/* control + status register		*/
++#define SMIL	0x04	/* length/count (n external txfers)	*/
++#define SMIA	0x08	/* address register			*/
++#define SMID	0x0c	/* data register			*/
++#define SMIDSR0	0x10	/* device 0 read settings		*/
++#define SMIDSW0	0x14	/* device 0 write settings		*/
++#define SMIDSR1	0x18	/* device 1 read settings		*/
++#define SMIDSW1	0x1c	/* device 1 write settings		*/
++#define SMIDSR2	0x20	/* device 2 read settings		*/
++#define SMIDSW2	0x24	/* device 2 write settings		*/
++#define SMIDSR3	0x28	/* device 3 read settings		*/
++#define SMIDSW3	0x2c	/* device 3 write settings		*/
++#define SMIDC	0x30	/* DMA control registers		*/
++#define SMIDCS	0x34	/* direct control/status register	*/
++#define SMIDA	0x38	/* direct address register		*/
++#define SMIDD	0x3c	/* direct data registers		*/
++#define SMIFD	0x40	/* FIFO debug register			*/
++
++
++
++/* Control and Status register bits:
++ * SMICS_RXF	: RX fifo full: 1 when RX fifo is full
++ * SMICS_TXE	: TX fifo empty: 1 when empty.
++ * SMICS_RXD	: RX fifo contains data: 1 when there is data.
++ * SMICS_TXD	: TX fifo can accept data: 1 when true.
++ * SMICS_RXR	: RX fifo needs reading: 1 when fifo more than 3/4 full, or
++ *		  when "DONE" and fifo not emptied.
++ * SMICS_TXW	: TX fifo needs writing: 1 when less than 1/4 full.
++ * SMICS_AFERR	: AXI FIFO error: 1 when fifo read when empty or written
++ *		  when full. Write 1 to clear.
++ * SMICS_EDREQ	: 1 when external DREQ received.
++ * SMICS_PXLDAT	:  Pixel data:	write 1 to enable pixel transfer modes.
++ * SMICS_SETERR	: 1 if there was an error writing to setup regs (e.g.
++ *		  tx was in progress). Write 1 to clear.
++ * SMICS_PVMODE	: Set to 1 to enable pixel valve mode.
++ * SMICS_INTR	: Set to 1 to enable interrupt on RX.
++ * SMICS_INTT	: Set to 1 to enable interrupt on TX.
++ * SMICS_INTD	: Set to 1 to enable interrupt on DONE condition.
++ * SMICS_TEEN	: Tear effect mode enabled: Programmed transfers will wait
++ *		  for a TE trigger before writing.
++ * SMICS_PAD1	: Padding settings for external transfers. For writes: the
++ *		  number of bytes initially written to  the TX fifo that
++ * SMICS_PAD0	: should be ignored. For reads: the number of bytes that will
++ *		  be read before the data, and should be dropped.
++ * SMICS_WRITE	: Transfer direction: 1 = write to external device, 0 = read
++ * SMICS_CLEAR	: Write 1 to clear the FIFOs.
++ * SMICS_START	: Write 1 to start the programmed transfer.
++ * SMICS_ACTIVE	: Reads as 1 when a programmed transfer is underway.
++ * SMICS_DONE	: Reads as 1 when transfer finished. For RX, not set until
++ *		  FIFO emptied.
++ * SMICS_ENABLE	: Set to 1 to enable the SMI peripheral, 0 to disable.
++ */
++
++#define SMICS_RXF	(1 << 31)
++#define SMICS_TXE	(1 << 30)
++#define SMICS_RXD	(1 << 29)
++#define SMICS_TXD	(1 << 28)
++#define SMICS_RXR	(1 << 27)
++#define SMICS_TXW	(1 << 26)
++#define SMICS_AFERR	(1 << 25)
++#define SMICS_EDREQ	(1 << 15)
++#define SMICS_PXLDAT	(1 << 14)
++#define SMICS_SETERR	(1 << 13)
++#define SMICS_PVMODE	(1 << 12)
++#define SMICS_INTR	(1 << 11)
++#define SMICS_INTT	(1 << 10)
++#define SMICS_INTD	(1 << 9)
++#define SMICS_TEEN	(1 << 8)
++#define SMICS_PAD1	(1 << 7)
++#define SMICS_PAD0	(1 << 6)
++#define SMICS_WRITE	(1 << 5)
++#define SMICS_CLEAR	(1 << 4)
++#define SMICS_START	(1 << 3)
++#define SMICS_ACTIVE	(1 << 2)
++#define SMICS_DONE	(1 << 1)
++#define SMICS_ENABLE	(1 << 0)
++
++/* Address register bits: */
++
++#define SMIA_DEVICE_MASK ((1 << 9) | (1 << 8))
++#define SMIA_DEVICE_OFFS (8)
++#define SMIA_ADDR_MASK (0x3f)	/* bits 5 -> 0 */
++#define SMIA_ADDR_OFFS (0)
++
++/* DMA control register bits:
++ * SMIDC_DMAEN	: DMA enable: set 1: DMA requests will be issued.
++ * SMIDC_DMAP	: DMA passthrough: when set to 0, top two data pins are used by
++ *		  SMI as usual. When set to 1, the top two pins are used for
++ *		  external DREQs: pin 16 read request, 17 write.
++ * SMIDC_PANIC*	: Threshold at which DMA will panic during read/write.
++ * SMIDC_REQ*	: Threshold at which DMA will generate a DREQ.
++ */
++
++#define SMIDC_DMAEN		(1 << 28)
++#define SMIDC_DMAP		(1 << 24)
++#define SMIDC_PANICR_MASK	(0x3f << 18)
++#define SMIDC_PANICR_OFFS	(18)
++#define SMIDC_PANICW_MASK	(0x3f << 12)
++#define SMIDC_PANICW_OFFS	(12)
++#define SMIDC_REQR_MASK		(0x3f << 6)
++#define SMIDC_REQR_OFFS		(6)
++#define SMIDC_REQW_MASK		(0x3f)
++#define SMIDC_REQW_OFFS		(0)
++
++/* Device settings register bits: same for all 4 (or 3?) device register sets.
++ * Device read settings:
++ * SMIDSR_RWIDTH	: Read transfer width. 00 = 8bit, 01 = 16bit,
++ *			  10 = 18bit, 11 = 9bit.
++ * SMIDSR_RSETUP	: Read setup time: number of core cycles between chip
++ *			  select/address and read strobe. Min 1, max 64.
++ * SMIDSR_MODE68	: 1 for System 68 mode (i.e. enable + direction pins,
++ *			  rather than OE + WE pin)
++ * SMIDSR_FSETUP	: If set to 1, setup time only applies to first
++ *			  transfer after address change.
++ * SMIDSR_RHOLD		: Number of core cycles between read strobe going
++ *			  inactive and CS/address going inactive. Min 1, max 64
++ * SMIDSR_RPACEALL	: When set to 1, this device's RPACE value will always
++ *			  be used for the next transaction, even if it is not
++ *			  to this device.
++ * SMIDSR_RPACE		: Number of core cycles spent waiting between CS
++ *			  deassert and start of next transfer. Min 1, max 128
++ * SMIDSR_RDREQ		: 1 = use external DMA request on SD16 to pace reads
++ *			  from device. Must also set DMAP in SMICS.
++ * SMIDSR_RSTROBE	: Number of cycles to assert the read strobe.
++ *			  min 1, max 128.
++ */
++#define SMIDSR_RWIDTH_MASK	((1<<31)|(1<<30))
++#define SMIDSR_RWIDTH_OFFS	(30)
++#define SMIDSR_RSETUP_MASK	(0x3f << 24)
++#define SMIDSR_RSETUP_OFFS	(24)
++#define SMIDSR_MODE68		(1 << 23)
++#define SMIDSR_FSETUP		(1 << 22)
++#define SMIDSR_RHOLD_MASK	(0x3f << 16)
++#define SMIDSR_RHOLD_OFFS	(16)
++#define SMIDSR_RPACEALL		(1 << 15)
++#define SMIDSR_RPACE_MASK	(0x7f << 8)
++#define SMIDSR_RPACE_OFFS	(8)
++#define SMIDSR_RDREQ		(1 << 7)
++#define SMIDSR_RSTROBE_MASK	(0x7f)
++#define SMIDSR_RSTROBE_OFFS	(0)
++
++/* Device write settings:
++ * SMIDSW_WWIDTH	: Write transfer width. 00 = 8bit, 01 = 16bit,
++ *			  10= 18bit, 11 = 9bit.
++ * SMIDSW_WSETUP	: Number of cycles between CS assert and write strobe.
++ *			  Min 1, max 64.
++ * SMIDSW_WFORMAT	: Pixel format of input. 0 = 16bit RGB 565,
++ *			  1 = 32bit RGBA 8888
++ * SMIDSW_WSWAP		: 1 = swap pixel data bits. (Use with SMICS_PXLDAT)
++ * SMIDSW_WHOLD		: Time between WE deassert and CS deassert. 1 to 64
++ * SMIDSW_WPACEALL	: 1: this device's WPACE will be used for the next
++ *			  transfer, regardless of that transfer's device.
++ * SMIDSW_WPACE		: Cycles between CS deassert and next CS assert.
++ *			  Min 1, max 128
++ * SMIDSW_WDREQ		: Use external DREQ on pin 17 to pace writes. DMAP must
++ *			  be set in SMICS.
++ * SMIDSW_WSTROBE	: Number of cycles to assert the write strobe.
++ *			  Min 1, max 128
++ */
++#define SMIDSW_WWIDTH_MASK	 ((1<<31)|(1<<30))
++#define SMIDSW_WWIDTH_OFFS	(30)
++#define SMIDSW_WSETUP_MASK	(0x3f << 24)
++#define SMIDSW_WSETUP_OFFS	(24)
++#define SMIDSW_WFORMAT		(1 << 23)
++#define SMIDSW_WSWAP		(1 << 22)
++#define SMIDSW_WHOLD_MASK	(0x3f << 16)
++#define SMIDSW_WHOLD_OFFS	(16)
++#define SMIDSW_WPACEALL		(1 << 15)
++#define SMIDSW_WPACE_MASK	(0x7f << 8)
++#define SMIDSW_WPACE_OFFS	(8)
++#define SMIDSW_WDREQ		(1 << 7)
++#define SMIDSW_WSTROBE_MASK	 (0x7f)
++#define SMIDSW_WSTROBE_OFFS	 (0)
++
++/* Direct transfer control + status register
++ * SMIDCS_WRITE	: Direction of transfer: 1 -> write, 0 -> read
++ * SMIDCS_DONE	: 1 when a transfer has finished. Write 1 to clear.
++ * SMIDCS_START	: Write 1 to start a transfer, if one is not already underway.
++ * SMIDCE_ENABLE: Write 1 to enable SMI in direct mode.
++ */
++
++#define SMIDCS_WRITE		(1 << 3)
++#define SMIDCS_DONE		(1 << 2)
++#define SMIDCS_START		(1 << 1)
++#define SMIDCS_ENABLE		(1 << 0)
++
++/* Direct transfer address register
++ * SMIDA_DEVICE	: Indicates which of the device settings banks should be used.
++ * SMIDA_ADDR	: The value to be asserted on the address pins.
++ */
++
++#define SMIDA_DEVICE_MASK	((1<<9)|(1<<8))
++#define SMIDA_DEVICE_OFFS	(8)
++#define SMIDA_ADDR_MASK		(0x3f)
++#define SMIDA_ADDR_OFFS		(0)
++
++/* FIFO debug register
++ * SMIFD_FLVL	: The high-tide mark of FIFO count during the most recent txfer
++ * SMIFD_FCNT	: The current FIFO count.
++ */
++#define SMIFD_FLVL_MASK		(0x3f << 8)
++#define SMIFD_FLVL_OFFS		(8)
++#define SMIFD_FCNT_MASK		(0x3f)
++#define SMIFD_FCNT_OFFS		(0)
++
++#endif /* BCM2835_SMI_IMPLEMENTATION */
++
++#endif /* BCM2835_SMI_H */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0116-Add-Chris-Boot-s-i2c-driver.patch b/target/linux/bcm27xx/patches-6.1/950-0116-Add-Chris-Boot-s-i2c-driver.patch
new file mode 100644
index 00000000000000..d5078f21600abe
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0116-Add-Chris-Boot-s-i2c-driver.patch
@@ -0,0 +1,660 @@
+From caf678b0d6d14257f9b8584ee0a417cbc174f385 Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Wed, 17 Jun 2015 15:44:08 +0100
+Subject: [PATCH] Add Chris Boot's i2c driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+i2c-bcm2708: fixed baudrate
+
+Fixed issue where the wrong CDIV value was set for baudrates below 3815 Hz (for 250MHz bus clock).
+In that case the computed CDIV value was more than 0xffff. However the CDIV register width is only 16 bits.
+This resulted in incorrect setting of CDIV and higher baudrate than intended.
+Example: 3500Hz -> CDIV=0x11704 -> CDIV(16bit)=0x1704 -> 42430Hz
+After correction: 3500Hz -> CDIV=0x11704 -> CDIV(16bit)=0xffff -> 3815Hz
+The correct baudrate is shown in the log after the cdiv > 0xffff correction.
+
+Perform I2C combined transactions when possible
+
+Perform I2C combined transactions whenever possible, within the
+restrictions of the Broadcomm Serial Controller.
+
+Disable DONE interrupt during TA poll
+
+Prevent interrupt from being triggered if poll is missed and transfer
+starts and finishes.
+
+i2c: Make combined transactions optional and disabled by default
+
+i2c: bcm2708: add device tree support
+
+Add DT support to driver and add to .dtsi file.
+Setup pins in .dts file.
+i2c is disabled by default.
+
+Signed-off-by: Noralf Tronnes <notro@tronnes.org>
+
+bcm2708: don't register i2c controllers when using DT
+
+The devices for the i2c controllers are in the Device Tree.
+Only register devices when not using DT.
+
+Signed-off-by: Noralf Tronnes <notro@tronnes.org>
+
+I2C: Only register the I2C device for the current board revision
+
+i2c_bcm2708: Fix clock reference counting
+
+Fix grabbing lock from atomic context in i2c driver
+
+2 main changes:
+- check for timeouts in the bcm2708_bsc_setup function as indicated by this comment:
+      /* poll for transfer start bit (should only take 1-20 polls) */
+  This implies that the setup function can now fail so account for this everywhere it's called
+- Removed the clk_get_rate call from inside the setup function as it locks a mutex and that's not ok since we call it from under a spin lock.
+
+i2c-bcm2708: When using DT, leave the GPIO setup to pinctrl
+
+i2c-bcm2708: Increase timeouts to allow larger transfers
+
+Use the timeout value provided by the I2C_TIMEOUT ioctl when waiting
+for completion. The default timeout is 1 second.
+
+See: https://github.com/raspberrypi/linux/issues/260
+
+i2c-bcm2708/BCM270X_DT: Add support for I2C2
+
+The third I2C bus (I2C2) is normally reserved for HDMI use. Careless
+use of this bus can break an attached display - use with caution.
+
+It is recommended to disable accesses by VideoCore by setting
+hdmi_ignore_edid=1 or hdmi_edid_file=1 in config.txt.
+
+The interface is disabled by default - enable using the
+i2c2_iknowwhatimdoing DT parameter.
+
+bcm2708-spi: Don't use static pin configuration with DT
+
+Also remove superfluous error checking - the SPI framework ensures the
+validity of the chip_select value.
+
+i2c-bcm2708: Remove non-DT support
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+Set the BSC_CLKT clock streching timeout to 35ms as per SMBus specs.
+
+Fixes i2c_bcm2708: Write to FIFO correctly - v2 (#1574)
+
+* i2c: fix i2c_bcm2708: Clear FIFO before sending data
+
+Make sure FIFO gets cleared before trying to send
+data in case of a repeated start (COMBINED=Y).
+
+* i2c: fix i2c_bcm2708: Only write to FIFO when not full
+
+Check if FIFO can accept data before writing.
+To avoid a peripheral read on the last iteration of a loop,
+both bcm2708_bsc_fifo_fill and ~drain are changed as well.
+---
+ drivers/i2c/busses/Kconfig       |  19 ++
+ drivers/i2c/busses/Makefile      |   2 +
+ drivers/i2c/busses/i2c-bcm2708.c | 512 +++++++++++++++++++++++++++++++
+ 3 files changed, 533 insertions(+)
+ create mode 100644 drivers/i2c/busses/i2c-bcm2708.c
+
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -16,6 +16,25 @@ config I2C_CCGX_UCSI
+ 	  for Cypress CCGx Type-C controller. Individual bus drivers
+ 	  need to select this one on demand.
+ 
++config I2C_BCM2708
++	tristate "BCM2708 BSC"
++	depends on ARCH_BCM2835
++	help
++	  Enabling this option will add BSC (Broadcom Serial Controller)
++	  support for the BCM2708. BSC is a Broadcom proprietary bus compatible
++	  with I2C/TWI/SMBus.
++
++config I2C_BCM2708_BAUDRATE
++	prompt "BCM2708 I2C baudrate"
++	depends on I2C_BCM2708
++	int
++	default 100000
++	help
++	  Set the I2C baudrate. This will alter the default value. A
++	  different baudrate can be set by using a module parameter as well. If
++	  no parameter is provided when loading, this is the value that will be
++	  used.
++
+ config I2C_ALI1535
+ 	tristate "ALI 1535"
+ 	depends on PCI
+--- a/drivers/i2c/busses/Makefile
++++ b/drivers/i2c/busses/Makefile
+@@ -3,6 +3,8 @@
+ # Makefile for the i2c bus drivers.
+ #
+ 
++obj-$(CONFIG_I2C_BCM2708)	+= i2c-bcm2708.o
++
+ # ACPI drivers
+ obj-$(CONFIG_I2C_SCMI)		+= i2c-scmi.o
+ 
+--- /dev/null
++++ b/drivers/i2c/busses/i2c-bcm2708.c
+@@ -0,0 +1,512 @@
++/*
++ * Driver for Broadcom BCM2708 BSC Controllers
++ *
++ * Copyright (C) 2012 Chris Boot & Frank Buss
++ *
++ * This driver is inspired by:
++ * i2c-ocores.c, by Peter Korsgaard <jacmet@sunsite.dk>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/spinlock.h>
++#include <linux/clk.h>
++#include <linux/err.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/io.h>
++#include <linux/slab.h>
++#include <linux/i2c.h>
++#include <linux/interrupt.h>
++#include <linux/sched.h>
++#include <linux/wait.h>
++
++/* BSC register offsets */
++#define BSC_C			0x00
++#define BSC_S			0x04
++#define BSC_DLEN		0x08
++#define BSC_A			0x0c
++#define BSC_FIFO		0x10
++#define BSC_DIV			0x14
++#define BSC_DEL			0x18
++#define BSC_CLKT		0x1c
++
++/* Bitfields in BSC_C */
++#define BSC_C_I2CEN		0x00008000
++#define BSC_C_INTR		0x00000400
++#define BSC_C_INTT		0x00000200
++#define BSC_C_INTD		0x00000100
++#define BSC_C_ST		0x00000080
++#define BSC_C_CLEAR_1		0x00000020
++#define BSC_C_CLEAR_2		0x00000010
++#define BSC_C_READ		0x00000001
++
++/* Bitfields in BSC_S */
++#define BSC_S_CLKT		0x00000200
++#define BSC_S_ERR		0x00000100
++#define BSC_S_RXF		0x00000080
++#define BSC_S_TXE		0x00000040
++#define BSC_S_RXD		0x00000020
++#define BSC_S_TXD		0x00000010
++#define BSC_S_RXR		0x00000008
++#define BSC_S_TXW		0x00000004
++#define BSC_S_DONE		0x00000002
++#define BSC_S_TA		0x00000001
++
++#define I2C_WAIT_LOOP_COUNT	200
++
++#define DRV_NAME		"bcm2708_i2c"
++
++static unsigned int baudrate;
++module_param(baudrate, uint, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
++MODULE_PARM_DESC(baudrate, "The I2C baudrate");
++
++static bool combined = false;
++module_param(combined, bool, 0644);
++MODULE_PARM_DESC(combined, "Use combined transactions");
++
++struct bcm2708_i2c {
++	struct i2c_adapter adapter;
++
++	spinlock_t lock;
++	void __iomem *base;
++	int irq;
++	struct clk *clk;
++	u32 cdiv;
++	u32 clk_tout;
++
++	struct completion done;
++
++	struct i2c_msg *msg;
++	int pos;
++	int nmsgs;
++	bool error;
++};
++
++static inline u32 bcm2708_rd(struct bcm2708_i2c *bi, unsigned reg)
++{
++	return readl(bi->base + reg);
++}
++
++static inline void bcm2708_wr(struct bcm2708_i2c *bi, unsigned reg, u32 val)
++{
++	writel(val, bi->base + reg);
++}
++
++static inline void bcm2708_bsc_reset(struct bcm2708_i2c *bi)
++{
++	bcm2708_wr(bi, BSC_C, 0);
++	bcm2708_wr(bi, BSC_S, BSC_S_CLKT | BSC_S_ERR | BSC_S_DONE);
++}
++
++static inline void bcm2708_bsc_fifo_drain(struct bcm2708_i2c *bi)
++{
++	while ((bi->pos < bi->msg->len) && (bcm2708_rd(bi, BSC_S) & BSC_S_RXD))
++		bi->msg->buf[bi->pos++] = bcm2708_rd(bi, BSC_FIFO);
++}
++
++static inline void bcm2708_bsc_fifo_fill(struct bcm2708_i2c *bi)
++{
++	while ((bi->pos < bi->msg->len) && (bcm2708_rd(bi, BSC_S) & BSC_S_TXD))
++		bcm2708_wr(bi, BSC_FIFO, bi->msg->buf[bi->pos++]);
++}
++
++static inline int bcm2708_bsc_setup(struct bcm2708_i2c *bi)
++{
++	u32 cdiv, s, clk_tout;
++	u32 c = BSC_C_I2CEN | BSC_C_INTD | BSC_C_ST | BSC_C_CLEAR_1;
++	int wait_loops = I2C_WAIT_LOOP_COUNT;
++
++	/* Can't call clk_get_rate as it locks a mutex and here we are spinlocked.
++	 * Use the value that we cached in the probe.
++	 */
++	cdiv = bi->cdiv;
++	clk_tout = bi->clk_tout;
++
++	if (bi->msg->flags & I2C_M_RD)
++		c |= BSC_C_INTR | BSC_C_READ;
++	else
++		c |= BSC_C_INTT;
++
++	bcm2708_wr(bi, BSC_CLKT, clk_tout);
++	bcm2708_wr(bi, BSC_DIV, cdiv);
++	bcm2708_wr(bi, BSC_A, bi->msg->addr);
++	bcm2708_wr(bi, BSC_DLEN, bi->msg->len);
++	if (combined)
++	{
++		/* Do the next two messages meet combined transaction criteria?
++		   - Current message is a write, next message is a read
++		   - Both messages to same slave address
++		   - Write message can fit inside FIFO (16 bytes or less) */
++		if ( (bi->nmsgs > 1) &&
++			!(bi->msg[0].flags & I2C_M_RD) && (bi->msg[1].flags & I2C_M_RD) &&
++			 (bi->msg[0].addr == bi->msg[1].addr) && (bi->msg[0].len <= 16)) {
++
++			/* Clear FIFO */
++			bcm2708_wr(bi, BSC_C, BSC_C_CLEAR_1);
++
++			/* Fill FIFO with entire write message (16 byte FIFO) */
++			while (bi->pos < bi->msg->len) {
++				bcm2708_wr(bi, BSC_FIFO, bi->msg->buf[bi->pos++]);
++			}
++			/* Start write transfer (no interrupts, don't clear FIFO) */
++			bcm2708_wr(bi, BSC_C, BSC_C_I2CEN | BSC_C_ST);
++
++			/* poll for transfer start bit (should only take 1-20 polls) */
++			do {
++				s = bcm2708_rd(bi, BSC_S);
++			} while (!(s & (BSC_S_TA | BSC_S_ERR | BSC_S_CLKT | BSC_S_DONE)) && --wait_loops >= 0);
++
++			/* did we time out or some error occured? */
++			if (wait_loops < 0 || (s & (BSC_S_ERR | BSC_S_CLKT))) {
++				return -1;
++			}
++
++			/* Send next read message before the write transfer finishes. */
++			bi->nmsgs--;
++			bi->msg++;
++			bi->pos = 0;
++			bcm2708_wr(bi, BSC_DLEN, bi->msg->len);
++			c = BSC_C_I2CEN | BSC_C_INTD | BSC_C_INTR | BSC_C_ST | BSC_C_READ;
++		}
++	}
++	bcm2708_wr(bi, BSC_C, c);
++
++	return 0;
++}
++
++static irqreturn_t bcm2708_i2c_interrupt(int irq, void *dev_id)
++{
++	struct bcm2708_i2c *bi = dev_id;
++	bool handled = true;
++	u32 s;
++	int ret;
++
++	spin_lock(&bi->lock);
++
++	/* we may see camera interrupts on the "other" I2C channel
++		   Just return if we've not sent anything */
++	if (!bi->nmsgs || !bi->msg) {
++		goto early_exit;
++	}
++
++	s = bcm2708_rd(bi, BSC_S);
++
++	if (s & (BSC_S_CLKT | BSC_S_ERR)) {
++		bcm2708_bsc_reset(bi);
++		bi->error = true;
++
++		bi->msg = 0; /* to inform the that all work is done */
++		bi->nmsgs = 0;
++		/* wake up our bh */
++		complete(&bi->done);
++	} else if (s & BSC_S_DONE) {
++		bi->nmsgs--;
++
++		if (bi->msg->flags & I2C_M_RD) {
++			bcm2708_bsc_fifo_drain(bi);
++		}
++
++		bcm2708_bsc_reset(bi);
++
++		if (bi->nmsgs) {
++			/* advance to next message */
++			bi->msg++;
++			bi->pos = 0;
++			ret = bcm2708_bsc_setup(bi);
++			if (ret < 0) {
++				bcm2708_bsc_reset(bi);
++				bi->error = true;
++				bi->msg = 0; /* to inform the that all work is done */
++				bi->nmsgs = 0;
++				/* wake up our bh */
++				complete(&bi->done);
++				goto early_exit;
++			}
++		} else {
++			bi->msg = 0; /* to inform the that all work is done */
++			bi->nmsgs = 0;
++			/* wake up our bh */
++			complete(&bi->done);
++		}
++	} else if (s & BSC_S_TXW) {
++		bcm2708_bsc_fifo_fill(bi);
++	} else if (s & BSC_S_RXR) {
++		bcm2708_bsc_fifo_drain(bi);
++	} else {
++		handled = false;
++	}
++
++early_exit:
++	spin_unlock(&bi->lock);
++
++	return handled ? IRQ_HANDLED : IRQ_NONE;
++}
++
++static int bcm2708_i2c_master_xfer(struct i2c_adapter *adap,
++	struct i2c_msg *msgs, int num)
++{
++	struct bcm2708_i2c *bi = adap->algo_data;
++	unsigned long flags;
++	int ret;
++
++	spin_lock_irqsave(&bi->lock, flags);
++
++	reinit_completion(&bi->done);
++	bi->msg = msgs;
++	bi->pos = 0;
++	bi->nmsgs = num;
++	bi->error = false;
++
++	ret = bcm2708_bsc_setup(bi);
++
++	spin_unlock_irqrestore(&bi->lock, flags);
++
++	/* check the result of the setup */
++	if (ret < 0)
++	{
++		dev_err(&adap->dev, "transfer setup timed out\n");
++		goto error_timeout;
++	}
++
++	ret = wait_for_completion_timeout(&bi->done, adap->timeout);
++	if (ret == 0) {
++		dev_err(&adap->dev, "transfer timed out\n");
++		goto error_timeout;
++	}
++
++	ret = bi->error ? -EIO : num;
++	return ret;
++
++error_timeout:
++	spin_lock_irqsave(&bi->lock, flags);
++	bcm2708_bsc_reset(bi);
++	bi->msg = 0; /* to inform the interrupt handler that there's nothing else to be done */
++	bi->nmsgs = 0;
++	spin_unlock_irqrestore(&bi->lock, flags);
++	return -ETIMEDOUT;
++}
++
++static u32 bcm2708_i2c_functionality(struct i2c_adapter *adap)
++{
++	return I2C_FUNC_I2C | /*I2C_FUNC_10BIT_ADDR |*/ I2C_FUNC_SMBUS_EMUL;
++}
++
++static struct i2c_algorithm bcm2708_i2c_algorithm = {
++	.master_xfer = bcm2708_i2c_master_xfer,
++	.functionality = bcm2708_i2c_functionality,
++};
++
++static int bcm2708_i2c_probe(struct platform_device *pdev)
++{
++	struct resource *regs;
++	int irq, err = -ENOMEM;
++	struct clk *clk;
++	struct bcm2708_i2c *bi;
++	struct i2c_adapter *adap;
++	unsigned long bus_hz;
++	u32 cdiv, clk_tout;
++	u32 baud;
++
++	baud = CONFIG_I2C_BCM2708_BAUDRATE;
++
++	if (pdev->dev.of_node) {
++		u32 bus_clk_rate;
++		pdev->id = of_alias_get_id(pdev->dev.of_node, "i2c");
++		if (pdev->id < 0) {
++			dev_err(&pdev->dev, "alias is missing\n");
++			return -EINVAL;
++		}
++		if (!of_property_read_u32(pdev->dev.of_node,
++					"clock-frequency", &bus_clk_rate))
++			baud = bus_clk_rate;
++		else
++			dev_warn(&pdev->dev,
++				"Could not read clock-frequency property\n");
++	}
++
++	if (baudrate)
++		baud = baudrate;
++
++	regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if (!regs) {
++		dev_err(&pdev->dev, "could not get IO memory\n");
++		return -ENXIO;
++	}
++
++	irq = platform_get_irq(pdev, 0);
++	if (irq < 0) {
++		dev_err(&pdev->dev, "could not get IRQ\n");
++		return irq;
++	}
++
++	clk = clk_get(&pdev->dev, NULL);
++	if (IS_ERR(clk)) {
++		dev_err(&pdev->dev, "could not find clk: %ld\n", PTR_ERR(clk));
++		return PTR_ERR(clk);
++	}
++
++	err = clk_prepare_enable(clk);
++	if (err) {
++		dev_err(&pdev->dev, "could not enable clk: %d\n", err);
++		goto out_clk_put;
++	}
++
++	bi = kzalloc(sizeof(*bi), GFP_KERNEL);
++	if (!bi)
++		goto out_clk_disable;
++
++	platform_set_drvdata(pdev, bi);
++
++	adap = &bi->adapter;
++	adap->class = I2C_CLASS_HWMON | I2C_CLASS_DDC;
++	adap->algo = &bcm2708_i2c_algorithm;
++	adap->algo_data = bi;
++	adap->dev.parent = &pdev->dev;
++	adap->nr = pdev->id;
++	strlcpy(adap->name, dev_name(&pdev->dev), sizeof(adap->name));
++	adap->dev.of_node = pdev->dev.of_node;
++
++	switch (pdev->id) {
++	case 0:
++		adap->class = I2C_CLASS_HWMON;
++		break;
++	case 1:
++		adap->class = I2C_CLASS_DDC;
++		break;
++	case 2:
++		adap->class = I2C_CLASS_DDC;
++		break;
++	default:
++		dev_err(&pdev->dev, "can only bind to BSC 0, 1 or 2\n");
++		err = -ENXIO;
++		goto out_free_bi;
++	}
++
++	spin_lock_init(&bi->lock);
++	init_completion(&bi->done);
++
++	bi->base = ioremap(regs->start, resource_size(regs));
++	if (!bi->base) {
++		dev_err(&pdev->dev, "could not remap memory\n");
++		goto out_free_bi;
++	}
++
++	bi->irq = irq;
++	bi->clk = clk;
++
++	err = request_irq(irq, bcm2708_i2c_interrupt, IRQF_SHARED,
++			dev_name(&pdev->dev), bi);
++	if (err) {
++		dev_err(&pdev->dev, "could not request IRQ: %d\n", err);
++		goto out_iounmap;
++	}
++
++	bcm2708_bsc_reset(bi);
++
++	err = i2c_add_numbered_adapter(adap);
++	if (err < 0) {
++		dev_err(&pdev->dev, "could not add I2C adapter: %d\n", err);
++		goto out_free_irq;
++	}
++
++	bus_hz = clk_get_rate(bi->clk);
++	cdiv = bus_hz / baud;
++	if (cdiv > 0xffff) {
++		cdiv = 0xffff;
++		baud = bus_hz / cdiv;
++	}
++
++	clk_tout = 35/1000*baud; //35ms timeout as per SMBus specs.
++	if (clk_tout > 0xffff)
++		clk_tout = 0xffff;
++	
++	bi->cdiv = cdiv;
++	bi->clk_tout = clk_tout;
++
++	dev_info(&pdev->dev, "BSC%d Controller at 0x%08lx (irq %d) (baudrate %d)\n",
++		pdev->id, (unsigned long)regs->start, irq, baud);
++
++	return 0;
++
++out_free_irq:
++	free_irq(bi->irq, bi);
++out_iounmap:
++	iounmap(bi->base);
++out_free_bi:
++	kfree(bi);
++out_clk_disable:
++	clk_disable_unprepare(clk);
++out_clk_put:
++	clk_put(clk);
++	return err;
++}
++
++static int bcm2708_i2c_remove(struct platform_device *pdev)
++{
++	struct bcm2708_i2c *bi = platform_get_drvdata(pdev);
++
++	platform_set_drvdata(pdev, NULL);
++
++	i2c_del_adapter(&bi->adapter);
++	free_irq(bi->irq, bi);
++	iounmap(bi->base);
++	clk_disable_unprepare(bi->clk);
++	clk_put(bi->clk);
++	kfree(bi);
++
++	return 0;
++}
++
++static const struct of_device_id bcm2708_i2c_of_match[] = {
++        { .compatible = "brcm,bcm2708-i2c" },
++        {},
++};
++MODULE_DEVICE_TABLE(of, bcm2708_i2c_of_match);
++
++static struct platform_driver bcm2708_i2c_driver = {
++	.driver		= {
++		.name	= DRV_NAME,
++		.owner	= THIS_MODULE,
++		.of_match_table = bcm2708_i2c_of_match,
++	},
++	.probe		= bcm2708_i2c_probe,
++	.remove		= bcm2708_i2c_remove,
++};
++
++// module_platform_driver(bcm2708_i2c_driver);
++
++
++static int __init bcm2708_i2c_init(void)
++{
++	return platform_driver_register(&bcm2708_i2c_driver);
++}
++
++static void __exit bcm2708_i2c_exit(void)
++{
++	platform_driver_unregister(&bcm2708_i2c_driver);
++}
++
++module_init(bcm2708_i2c_init);
++module_exit(bcm2708_i2c_exit);
++
++
++
++MODULE_DESCRIPTION("BSC controller driver for Broadcom BCM2708");
++MODULE_AUTHOR("Chris Boot <bootc@bootc.net>");
++MODULE_LICENSE("GPL v2");
++MODULE_ALIAS("platform:" DRV_NAME);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0117-char-broadcom-Add-vcio-module.patch b/target/linux/bcm27xx/patches-6.1/950-0117-char-broadcom-Add-vcio-module.patch
new file mode 100644
index 00000000000000..b8d5209d76755d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0117-char-broadcom-Add-vcio-module.patch
@@ -0,0 +1,273 @@
+From fe0a40031a72b2cb1b36a491d71f6bc0bdb8afed Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Fri, 26 Jun 2015 14:27:06 +0200
+Subject: [PATCH] char: broadcom: Add vcio module
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Add module for accessing the mailbox property channel through
+/dev/vcio. Was previously in bcm2708-vcio.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+char: vcio: Add compat ioctl handling
+
+There was no compat ioctl handler, so 32 bit userspace on a
+64 bit kernel failed as IOCTL_MBOX_PROPERTY used the size
+of char*.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+char: vcio: Fail probe if rpi_firmware is not found.
+
+Device Tree is now the only supported config mechanism, therefore
+uncomment the block of code that fails the probe if the
+firmware node can't be found.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+drivers: char: vcio: Use common compat header
+
+The definition of compat_ptr is now common for most platforms, but
+requires the inclusion of <linux/compat.h>.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+char: vcio: Rewrite as a firmware node child
+
+The old vcio driver is a simple character device that manually locates
+the firmware driver. Initialising it before the firmware driver causes
+a failure, and no retries are attempted.
+
+Rewrite vcio as a platform driver that depends on a DT node for its
+instantiation and the location of the firmware driver, making use of
+the miscdevice framework to reduce the code size.
+
+N.B. Using miscdevice changes the udev SUBSYSTEM string, so a change
+to the companion udev rule is required in order to continue to set
+the correct device permissions, e.g.:
+
+    KERNEL="vcio", GROUP="video", MODE="0660"
+
+See: https://github.com/raspberrypi/linux/issues/4620
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/char/broadcom/Kconfig  |   6 ++
+ drivers/char/broadcom/Makefile |   1 +
+ drivers/char/broadcom/vcio.c   | 186 +++++++++++++++++++++++++++++++++
+ 3 files changed, 193 insertions(+)
+ create mode 100644 drivers/char/broadcom/vcio.c
+
+--- a/drivers/char/broadcom/Kconfig
++++ b/drivers/char/broadcom/Kconfig
+@@ -15,6 +15,12 @@ config BCM2708_VCMEM
+         help
+           Helper for videocore memory access and total size allocation.
+ 
++config BCM_VCIO
++	tristate "Mailbox userspace access"
++	depends on BCM2835_MBOX
++	help
++	  Gives access to the mailbox property channel from userspace.
++
+ endif
+ 
+ config BCM2835_DEVGPIOMEM
+--- a/drivers/char/broadcom/Makefile
++++ b/drivers/char/broadcom/Makefile
+@@ -1,3 +1,4 @@
+ obj-$(CONFIG_BCM2708_VCMEM)	+= vc_mem.o
++obj-$(CONFIG_BCM_VCIO)		+= vcio.o
+ obj-$(CONFIG_BCM2835_DEVGPIOMEM)+= bcm2835-gpiomem.o
+ obj-$(CONFIG_BCM2835_SMI_DEV)	+= bcm2835_smi_dev.o
+--- /dev/null
++++ b/drivers/char/broadcom/vcio.c
+@@ -0,0 +1,186 @@
++/*
++ *  Copyright (C) 2010 Broadcom
++ *  Copyright (C) 2015 Noralf Trønnes
++ *  Copyright (C) 2021 Raspberry Pi (Trading) Ltd.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ */
++
++#include <linux/cdev.h>
++#include <linux/device.h>
++#include <linux/fs.h>
++#include <linux/init.h>
++#include <linux/ioctl.h>
++#include <linux/module.h>
++#include <linux/slab.h>
++#include <linux/uaccess.h>
++#include <linux/compat.h>
++#include <linux/miscdevice.h>
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
++#define MODULE_NAME "vcio"
++#define VCIO_IOC_MAGIC 100
++#define IOCTL_MBOX_PROPERTY _IOWR(VCIO_IOC_MAGIC, 0, char *)
++#ifdef CONFIG_COMPAT
++#define IOCTL_MBOX_PROPERTY32 _IOWR(VCIO_IOC_MAGIC, 0, compat_uptr_t)
++#endif
++
++struct vcio_data {
++	struct rpi_firmware *fw;
++	struct miscdevice misc_dev;
++};
++
++static int vcio_user_property_list(struct vcio_data *vcio, void *user)
++{
++	u32 *buf, size;
++	int ret;
++
++	/* The first 32-bit is the size of the buffer */
++	if (copy_from_user(&size, user, sizeof(size)))
++		return -EFAULT;
++
++	buf = kmalloc(size, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	if (copy_from_user(buf, user, size)) {
++		kfree(buf);
++		return -EFAULT;
++	}
++
++	/* Strip off protocol encapsulation */
++	ret = rpi_firmware_property_list(vcio->fw, &buf[2], size - 12);
++	if (ret) {
++		kfree(buf);
++		return ret;
++	}
++
++	buf[1] = RPI_FIRMWARE_STATUS_SUCCESS;
++	if (copy_to_user(user, buf, size))
++		ret = -EFAULT;
++
++	kfree(buf);
++
++	return ret;
++}
++
++static int vcio_device_open(struct inode *inode, struct file *file)
++{
++	try_module_get(THIS_MODULE);
++
++	return 0;
++}
++
++static int vcio_device_release(struct inode *inode, struct file *file)
++{
++	module_put(THIS_MODULE);
++
++	return 0;
++}
++
++static long vcio_device_ioctl(struct file *file, unsigned int ioctl_num,
++			      unsigned long ioctl_param)
++{
++	struct vcio_data *vcio = container_of(file->private_data,
++					      struct vcio_data, misc_dev);
++
++	switch (ioctl_num) {
++	case IOCTL_MBOX_PROPERTY:
++		return vcio_user_property_list(vcio, (void *)ioctl_param);
++	default:
++		pr_err("unknown ioctl: %x\n", ioctl_num);
++		return -EINVAL;
++	}
++}
++
++#ifdef CONFIG_COMPAT
++static long vcio_device_compat_ioctl(struct file *file, unsigned int ioctl_num,
++				     unsigned long ioctl_param)
++{
++	struct vcio_data *vcio = container_of(file->private_data,
++					      struct vcio_data, misc_dev);
++
++	switch (ioctl_num) {
++	case IOCTL_MBOX_PROPERTY32:
++		return vcio_user_property_list(vcio, compat_ptr(ioctl_param));
++	default:
++		pr_err("unknown ioctl: %x\n", ioctl_num);
++		return -EINVAL;
++	}
++}
++#endif
++
++const struct file_operations vcio_fops = {
++	.unlocked_ioctl = vcio_device_ioctl,
++#ifdef CONFIG_COMPAT
++	.compat_ioctl = vcio_device_compat_ioctl,
++#endif
++	.open = vcio_device_open,
++	.release = vcio_device_release,
++};
++
++static int vcio_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct device_node *np = dev->of_node;
++	struct device_node *fw_node;
++	struct rpi_firmware *fw;
++	struct vcio_data *vcio;
++
++	fw_node = of_get_parent(np);
++	if (!fw_node) {
++		dev_err(dev, "Missing firmware node\n");
++		return -ENOENT;
++	}
++
++	fw = rpi_firmware_get(fw_node);
++	of_node_put(fw_node);
++	if (!fw)
++		return -EPROBE_DEFER;
++
++	vcio = devm_kzalloc(dev, sizeof(struct vcio_data), GFP_KERNEL);
++	if (!vcio)
++		return -ENOMEM;
++
++	vcio->fw = fw;
++	vcio->misc_dev.fops = &vcio_fops;
++	vcio->misc_dev.minor = MISC_DYNAMIC_MINOR;
++	vcio->misc_dev.name = "vcio";
++	vcio->misc_dev.parent = dev;
++
++	return misc_register(&vcio->misc_dev);
++}
++
++static int vcio_remove(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++
++	misc_deregister(dev_get_drvdata(dev));
++	return 0;
++}
++
++static const struct of_device_id vcio_ids[] = {
++	{ .compatible = "raspberrypi,vcio" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, vcio_ids);
++
++static struct platform_driver vcio_driver = {
++	.driver	= {
++		.name		= MODULE_NAME,
++		.of_match_table	= of_match_ptr(vcio_ids),
++	},
++	.probe	= vcio_probe,
++	.remove = vcio_remove,
++};
++
++module_platform_driver(vcio_driver);
++
++MODULE_AUTHOR("Gray Girling");
++MODULE_AUTHOR("Noralf Trønnes");
++MODULE_DESCRIPTION("Mailbox userspace access");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:rpi-vcio");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0118-firmware-bcm2835-Support-ARCH_BCM270x.patch b/target/linux/bcm27xx/patches-6.1/950-0118-firmware-bcm2835-Support-ARCH_BCM270x.patch
new file mode 100644
index 00000000000000..3b847b561d81b8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0118-firmware-bcm2835-Support-ARCH_BCM270x.patch
@@ -0,0 +1,74 @@
+From ed67c30eca94141343fa1c617578fe48b234c1fd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Fri, 26 Jun 2015 14:25:01 +0200
+Subject: [PATCH] firmware: bcm2835: Support ARCH_BCM270x
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Support booting without Device Tree.
+Turn on USB power.
+Load driver early because of lacking support for deferred probing
+in many drivers.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+firmware: bcm2835: Don't turn on USB power
+
+The raspberrypi-power driver is now used to turn on USB power.
+
+This partly reverts commit:
+firmware: bcm2835: Support ARCH_BCM270x
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+---
+ drivers/firmware/raspberrypi.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/drivers/firmware/raspberrypi.c
++++ b/drivers/firmware/raspberrypi.c
+@@ -32,6 +32,8 @@ struct rpi_firmware {
+ 	struct kref consumers;
+ };
+ 
++static struct platform_device *g_pdev;
++
+ static DEFINE_MUTEX(transaction_lock);
+ 
+ static void response_callback(struct mbox_client *cl, void *msg)
+@@ -280,6 +282,7 @@ static int rpi_firmware_probe(struct pla
+ 	kref_init(&fw->consumers);
+ 
+ 	platform_set_drvdata(pdev, fw);
++	g_pdev = pdev;
+ 
+ 	rpi_firmware_print_firmware_revision(fw);
+ 	rpi_register_hwmon_driver(dev, fw);
+@@ -308,6 +311,7 @@ static int rpi_firmware_remove(struct pl
+ 	rpi_clk = NULL;
+ 
+ 	rpi_firmware_put(fw);
++	g_pdev = NULL;
+ 
+ 	return 0;
+ }
+@@ -382,7 +386,18 @@ static struct platform_driver rpi_firmwa
+ 	.shutdown	= rpi_firmware_shutdown,
+ 	.remove		= rpi_firmware_remove,
+ };
+-module_platform_driver(rpi_firmware_driver);
++
++static int __init rpi_firmware_init(void)
++{
++	return platform_driver_register(&rpi_firmware_driver);
++}
++subsys_initcall(rpi_firmware_init);
++
++static void __init rpi_firmware_exit(void)
++{
++	platform_driver_unregister(&rpi_firmware_driver);
++}
++module_exit(rpi_firmware_exit);
+ 
+ MODULE_AUTHOR("Eric Anholt <eric@anholt.net>");
+ MODULE_DESCRIPTION("Raspberry Pi firmware driver");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0119-leds-Add-the-input-trigger-for-pwr_led.patch b/target/linux/bcm27xx/patches-6.1/950-0119-leds-Add-the-input-trigger-for-pwr_led.patch
new file mode 100644
index 00000000000000..4d30fab65466a1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0119-leds-Add-the-input-trigger-for-pwr_led.patch
@@ -0,0 +1,168 @@
+From 95a128d3e27f80940acd7f5d657405a50b2bc830 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Fri, 6 Feb 2015 13:50:57 +0000
+Subject: [PATCH] leds: Add the "input" trigger, for pwr_led
+
+The "input" trigger makes the associated GPIO an input.  This is to support
+the Raspberry Pi PWR LED, which is driven by external hardware in normal use.
+
+N.B. pwr_led is not available on Model A or B boards.
+
+leds-gpio: Implement the brightness_get method
+
+The power LED uses some clever logic that means it is driven
+by a voltage measuring circuit when configured as input, otherwise
+it is driven by the GPIO output value. This patch wires up the
+brightness_get method for leds-gpio so that user-space can monitor
+the LED value via /sys/class/gpio/led1/brightness. Using the input
+trigger this returns an indication of the system power health,
+otherwise it is just whatever value the trigger has written most
+recently.
+
+See: https://github.com/raspberrypi/linux/issues/1064
+---
+ drivers/leds/leds-gpio.c             | 17 ++++++++-
+ drivers/leds/trigger/Kconfig         |  7 ++++
+ drivers/leds/trigger/Makefile        |  1 +
+ drivers/leds/trigger/ledtrig-input.c | 55 ++++++++++++++++++++++++++++
+ include/linux/leds.h                 |  3 ++
+ 5 files changed, 82 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/leds/trigger/ledtrig-input.c
+
+--- a/drivers/leds/leds-gpio.c
++++ b/drivers/leds/leds-gpio.c
+@@ -47,8 +47,15 @@ static void gpio_led_set(struct led_clas
+ 		led_dat->platform_gpio_blink_set(led_dat->gpiod, level,
+ 						 NULL, NULL);
+ 		led_dat->blinking = 0;
++	} else if (led_dat->cdev.flags & SET_GPIO_INPUT) {
++		gpiod_direction_input(led_dat->gpiod);
++		led_dat->cdev.flags &= ~SET_GPIO_INPUT;
++	} else if (led_dat->cdev.flags & SET_GPIO_OUTPUT) {
++		gpiod_direction_output(led_dat->gpiod, level);
++		led_dat->cdev.flags &= ~SET_GPIO_OUTPUT;
+ 	} else {
+-		if (led_dat->can_sleep)
++		if (led_dat->can_sleep ||
++			(led_dat->cdev.flags & (SET_GPIO_INPUT | SET_GPIO_OUTPUT) ))
+ 			gpiod_set_value_cansleep(led_dat->gpiod, level);
+ 		else
+ 			gpiod_set_value(led_dat->gpiod, level);
+@@ -62,6 +69,13 @@ static int gpio_led_set_blocking(struct
+ 	return 0;
+ }
+ 
++static enum led_brightness gpio_led_get(struct led_classdev *led_cdev)
++{
++	struct gpio_led_data *led_dat =
++		container_of(led_cdev, struct gpio_led_data, cdev);
++	return gpiod_get_value_cansleep(led_dat->gpiod) ? LED_FULL : LED_OFF;
++}
++
+ static int gpio_blink_set(struct led_classdev *led_cdev,
+ 	unsigned long *delay_on, unsigned long *delay_off)
+ {
+@@ -90,6 +104,7 @@ static int create_gpio_led(const struct
+ 		led_dat->platform_gpio_blink_set = blink_set;
+ 		led_dat->cdev.blink_set = gpio_blink_set;
+ 	}
++	led_dat->cdev.brightness_get = gpio_led_get;
+ 	if (template->default_state == LEDS_GPIO_DEFSTATE_KEEP) {
+ 		state = gpiod_get_value_cansleep(led_dat->gpiod);
+ 		if (state < 0)
+--- a/drivers/leds/trigger/Kconfig
++++ b/drivers/leds/trigger/Kconfig
+@@ -115,6 +115,13 @@ config LEDS_TRIGGER_CAMERA
+ 	  This enables direct flash/torch on/off by the driver, kernel space.
+ 	  If unsure, say Y.
+ 
++config LEDS_TRIGGER_INPUT
++	tristate "LED Input Trigger"
++	depends on LEDS_TRIGGERS
++	help
++	  This allows the GPIOs assigned to be LEDs to be initialised to inputs.
++	  If unsure, say Y.
++
+ config LEDS_TRIGGER_PANIC
+ 	bool "LED Panic Trigger"
+ 	help
+--- a/drivers/leds/trigger/Makefile
++++ b/drivers/leds/trigger/Makefile
+@@ -11,6 +11,7 @@ obj-$(CONFIG_LEDS_TRIGGER_ACTIVITY)	+= l
+ obj-$(CONFIG_LEDS_TRIGGER_DEFAULT_ON)	+= ledtrig-default-on.o
+ obj-$(CONFIG_LEDS_TRIGGER_TRANSIENT)	+= ledtrig-transient.o
+ obj-$(CONFIG_LEDS_TRIGGER_CAMERA)	+= ledtrig-camera.o
++obj-$(CONFIG_LEDS_TRIGGER_INPUT)	+= ledtrig-input.o
+ obj-$(CONFIG_LEDS_TRIGGER_PANIC)	+= ledtrig-panic.o
+ obj-$(CONFIG_LEDS_TRIGGER_NETDEV)	+= ledtrig-netdev.o
+ obj-$(CONFIG_LEDS_TRIGGER_PATTERN)	+= ledtrig-pattern.o
+--- /dev/null
++++ b/drivers/leds/trigger/ledtrig-input.c
+@@ -0,0 +1,55 @@
++/*
++ * Set LED GPIO to Input "Trigger"
++ *
++ * Copyright 2015 Phil Elwell <phil@raspberrypi.org>
++ *
++ * Based on Nick Forbes's ledtrig-default-on.c.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ */
++
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/leds.h>
++#include <linux/gpio.h>
++#include "../leds.h"
++
++static int input_trig_activate(struct led_classdev *led_cdev)
++{
++	led_cdev->flags |= SET_GPIO_INPUT;
++	led_set_brightness(led_cdev, 0);
++	return 0;
++}
++
++static void input_trig_deactivate(struct led_classdev *led_cdev)
++{
++	led_cdev->flags |= SET_GPIO_OUTPUT;
++	led_set_brightness(led_cdev, 0);
++}
++
++static struct led_trigger input_led_trigger = {
++	.name     = "input",
++	.activate = input_trig_activate,
++	.deactivate = input_trig_deactivate,
++};
++
++static int __init input_trig_init(void)
++{
++	return led_trigger_register(&input_led_trigger);
++}
++
++static void __exit input_trig_exit(void)
++{
++	led_trigger_unregister(&input_led_trigger);
++}
++
++module_init(input_trig_init);
++module_exit(input_trig_exit);
++
++MODULE_AUTHOR("Phil Elwell <phil@raspberrypi.org>");
++MODULE_DESCRIPTION("Set LED GPIO to Input \"trigger\"");
++MODULE_LICENSE("GPL");
+--- a/include/linux/leds.h
++++ b/include/linux/leds.h
+@@ -95,6 +95,9 @@ struct led_classdev {
+ #define LED_BRIGHT_HW_CHANGED	BIT(21)
+ #define LED_RETAIN_AT_SHUTDOWN	BIT(22)
+ #define LED_INIT_DEFAULT_TRIGGER BIT(23)
++	/* Additions for Raspberry Pi PWR LED */
++#define SET_GPIO_INPUT		BIT(30)
++#define SET_GPIO_OUTPUT		BIT(31)
+ 
+ 	/* set_brightness_work / blink_timer flags, atomic, private. */
+ 	unsigned long		work_flags;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0120-Added-Device-IDs-for-August-DVB-T-205.patch b/target/linux/bcm27xx/patches-6.1/950-0120-Added-Device-IDs-for-August-DVB-T-205.patch
new file mode 100644
index 00000000000000..a77f3f75b1e798
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0120-Added-Device-IDs-for-August-DVB-T-205.patch
@@ -0,0 +1,22 @@
+From 8e66f283a3b983e960bc6c28a71ad9eb63d2b4aa Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Wed, 3 Jul 2013 00:54:08 +0100
+Subject: [PATCH] Added Device IDs for August DVB-T 205
+
+---
+ drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
++++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+@@ -1964,6 +1964,10 @@ static const struct usb_device_id rtl28x
+ 		&rtl28xxu_props, "Compro VideoMate U650F", NULL) },
+ 	{ DVB_USB_DEVICE(USB_VID_KWORLD_2, 0xd394,
+ 		&rtl28xxu_props, "MaxMedia HU394-T", NULL) },
++	{ DVB_USB_DEVICE(USB_VID_GTEK, 0xb803 /*USB_PID_AUGUST_DVBT205*/,
++		&rtl28xxu_props, "August DVB-T 205", NULL) },
++	{ DVB_USB_DEVICE(USB_VID_GTEK, 0xa803 /*USB_PID_AUGUST_DVBT205*/,
++		&rtl28xxu_props, "August DVB-T 205", NULL) },
+ 	{ DVB_USB_DEVICE(USB_VID_LEADTEK, 0x6a03,
+ 		&rtl28xxu_props, "Leadtek WinFast DTV Dongle mini", NULL) },
+ 	{ DVB_USB_DEVICE(USB_VID_GTEK, USB_PID_CPYTO_REDI_PC50A,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0121-Improve-__copy_to_user-and-__copy_from_user-performa.patch b/target/linux/bcm27xx/patches-6.1/950-0121-Improve-__copy_to_user-and-__copy_from_user-performa.patch
new file mode 100644
index 00000000000000..0c2ff35ed391fa
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0121-Improve-__copy_to_user-and-__copy_from_user-performa.patch
@@ -0,0 +1,1611 @@
+From 9a10ffd029c81a694db6666c1dedfa687396093b Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Mon, 28 Nov 2016 16:50:04 +0000
+Subject: [PATCH] Improve __copy_to_user and __copy_from_user
+ performance
+
+Provide a __copy_from_user that uses memcpy. On BCM2708, use
+optimised memcpy/memmove/memcmp/memset implementations.
+
+arch/arm: Add mmiocpy/set aliases for memcpy/set
+
+See: https://github.com/raspberrypi/linux/issues/1082
+
+copy_from_user: CPU_SW_DOMAIN_PAN compatibility
+
+The downstream copy_from_user acceleration must also play nice with
+CONFIG_CPU_SW_DOMAIN_PAN.
+
+See: https://github.com/raspberrypi/linux/issues/1381
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+Fix copy_from_user if BCM2835_FAST_MEMCPY=n
+
+The change which introduced CONFIG_BCM2835_FAST_MEMCPY unconditionally
+changed the behaviour of arm_copy_from_user. The page pinning code
+is not safe on ARMv7 if LPAE & high memory is enabled and causes
+crashes which look like PTE corruption.
+
+Make __copy_from_user_memcpy conditional on CONFIG_2835_FAST_MEMCPY=y
+which is really an ARMv6 / Pi1 optimization and not necessary on newer
+ARM processors.
+
+arm: fix mmap unlocks in uaccess_with_memcpy.c
+
+This is a regression that was added with the commit 192a4e923ef092924dd013e7326f2ec520ee4783 as of rpi-5.8.y, since that is when the move to the mmap locking API was introduced - d8ed45c5dcd455fc5848d47f86883a1b872ac0d0
+
+The issue is that when the patch to improve performance for the __copy_to_user and __copy_from_user functions were added for the Raspberry Pi, some of the mmaps were incorrectly mapped to write instead of read. This would cause a verity of issues, and in my case, prevent the booting of a squashfs filesystem on rpi-5.8-y and above. An example of the panic you would see from this can be seen at https://pastebin.com/raw/jBz5xCzL
+
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Christopher Blake <chrisrblake93@gmail.com>
+
+arch/arm: Add __memset alias to memset_rpi.S
+
+memset_rpi.S is an optimised memset implementation, but doesn't define
+__memset (which was just added to memset.S). As a result, building
+for the BCM2835 platform causes a link failure.
+
+Add __memset as yet another alias to our common implementation.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+arm: Fix custom rpi __memset32 and __memset64
+
+See: https://github.com/raspberrypi/linux/issues/4798
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+arm: Fix annoying .eh_frame section warnings
+
+Replace the cfi directives with the UNWIND equivalents. This prevents
+the .eh_frame section from being created, eliminating the warnings.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/include/asm/string.h      |   5 +
+ arch/arm/include/asm/uaccess.h     |   3 +
+ arch/arm/lib/Makefile              |  14 +-
+ arch/arm/lib/arm-mem.h             | 159 ++++++++++
+ arch/arm/lib/copy_from_user.S      |   4 +-
+ arch/arm/lib/exports_rpi.c         |  37 +++
+ arch/arm/lib/memcmp_rpi.S          | 285 +++++++++++++++++
+ arch/arm/lib/memcpy_rpi.S          |  63 ++++
+ arch/arm/lib/memcpymove.h          | 488 +++++++++++++++++++++++++++++
+ arch/arm/lib/memmove_rpi.S         |  63 ++++
+ arch/arm/lib/memset_rpi.S          | 132 ++++++++
+ arch/arm/lib/uaccess_with_memcpy.c | 125 +++++++-
+ arch/arm/mach-bcm/Kconfig          |  24 ++
+ 13 files changed, 1396 insertions(+), 6 deletions(-)
+ create mode 100644 arch/arm/lib/arm-mem.h
+ create mode 100644 arch/arm/lib/exports_rpi.c
+ create mode 100644 arch/arm/lib/memcmp_rpi.S
+ create mode 100644 arch/arm/lib/memcpy_rpi.S
+ create mode 100644 arch/arm/lib/memcpymove.h
+ create mode 100644 arch/arm/lib/memmove_rpi.S
+ create mode 100644 arch/arm/lib/memset_rpi.S
+
+--- a/arch/arm/include/asm/string.h
++++ b/arch/arm/include/asm/string.h
+@@ -65,4 +65,9 @@ static inline void *memset64(uint64_t *p
+ 
+ #endif
+ 
++#ifdef CONFIG_BCM2835_FAST_MEMCPY
++#define __HAVE_ARCH_MEMCMP
++extern int memcmp(const void *, const void *, size_t);
++#endif
++
+ #endif
+--- a/arch/arm/include/asm/uaccess.h
++++ b/arch/arm/include/asm/uaccess.h
+@@ -509,6 +509,9 @@ do {									\
+ extern unsigned long __must_check
+ arm_copy_from_user(void *to, const void __user *from, unsigned long n);
+ 
++extern unsigned long __must_check
++__copy_from_user_std(void *to, const void __user *from, unsigned long n);
++
+ static inline unsigned long __must_check
+ raw_copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
+--- a/arch/arm/lib/Makefile
++++ b/arch/arm/lib/Makefile
+@@ -7,8 +7,8 @@
+ 
+ lib-y		:= changebit.o csumipv6.o csumpartial.o               \
+ 		   csumpartialcopy.o csumpartialcopyuser.o clearbit.o \
+-		   delay.o delay-loop.o findbit.o memchr.o memcpy.o   \
+-		   memmove.o memset.o setbit.o                        \
++		   delay.o delay-loop.o findbit.o memchr.o            \
++		   setbit.o                                           \
+ 		   strchr.o strrchr.o                                 \
+ 		   testchangebit.o testclearbit.o testsetbit.o        \
+ 		   ashldi3.o ashrdi3.o lshrdi3.o muldi3.o             \
+@@ -25,6 +25,16 @@ else
+   lib-y	+= backtrace.o
+ endif
+ 
++# Choose optimised implementations for Raspberry Pi
++ifeq ($(CONFIG_BCM2835_FAST_MEMCPY),y)
++  CFLAGS_uaccess_with_memcpy.o += -DCOPY_FROM_USER_THRESHOLD=1600
++  CFLAGS_uaccess_with_memcpy.o += -DCOPY_TO_USER_THRESHOLD=672
++  obj-$(CONFIG_MODULES) += exports_rpi.o
++  lib-y        += memcpy_rpi.o memmove_rpi.o memset_rpi.o memcmp_rpi.o
++else
++  lib-y        += memcpy.o memmove.o memset.o
++endif
++
+ # using lib_ here won't override already available weak symbols
+ obj-$(CONFIG_UACCESS_WITH_MEMCPY) += uaccess_with_memcpy.o
+ 
+--- /dev/null
++++ b/arch/arm/lib/arm-mem.h
+@@ -0,0 +1,159 @@
++/*
++Copyright (c) 2013, Raspberry Pi Foundation
++Copyright (c) 2013, RISC OS Open Ltd
++All rights reserved.
++
++Redistribution and use in source and binary forms, with or without
++modification, are permitted provided that the following conditions are met:
++    * Redistributions of source code must retain the above copyright
++      notice, this list of conditions and the following disclaimer.
++    * Redistributions in binary form must reproduce the above copyright
++      notice, this list of conditions and the following disclaimer in the
++      documentation and/or other materials provided with the distribution.
++    * Neither the name of the copyright holder nor the
++      names of its contributors may be used to endorse or promote products
++      derived from this software without specific prior written permission.
++
++THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
++ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
++WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
++DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
++DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
++ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++*/
++
++.macro myfunc fname
++ .func fname
++ .global fname
++fname:
++.endm
++
++.macro preload_leading_step1  backwards, ptr, base
++/* If the destination is already 16-byte aligned, then we need to preload
++ * between 0 and prefetch_distance (inclusive) cache lines ahead so there
++ * are no gaps when the inner loop starts.
++ */
++ .if backwards
++        sub     ptr, base, #1
++        bic     ptr, ptr, #31
++ .else
++        bic     ptr, base, #31
++ .endif
++ .set OFFSET, 0
++ .rept prefetch_distance+1
++        pld     [ptr, #OFFSET]
++  .if backwards
++   .set OFFSET, OFFSET-32
++  .else
++   .set OFFSET, OFFSET+32
++  .endif
++ .endr
++.endm
++
++.macro preload_leading_step2  backwards, ptr, base, leading_bytes, tmp
++/* However, if the destination is not 16-byte aligned, we may need to
++ * preload one more cache line than that. The question we need to ask is:
++ * are the leading bytes more than the amount by which the source
++ * pointer will be rounded down for preloading, and if so, by how many
++ * cache lines?
++ */
++ .if backwards
++/* Here we compare against how many bytes we are into the
++ * cache line, counting down from the highest such address.
++ * Effectively, we want to calculate
++ *     leading_bytes = dst&15
++ *     cacheline_offset = 31-((src-leading_bytes-1)&31)
++ *     extra_needed = leading_bytes - cacheline_offset
++ * and test if extra_needed is <= 0, or rearranging:
++ *     leading_bytes + (src-leading_bytes-1)&31 <= 31
++ */
++        mov     tmp, base, lsl #32-5
++        sbc     tmp, tmp, leading_bytes, lsl #32-5
++        adds    tmp, tmp, leading_bytes, lsl #32-5
++        bcc     61f
++        pld     [ptr, #-32*(prefetch_distance+1)]
++ .else
++/* Effectively, we want to calculate
++ *     leading_bytes = (-dst)&15
++ *     cacheline_offset = (src+leading_bytes)&31
++ *     extra_needed = leading_bytes - cacheline_offset
++ * and test if extra_needed is <= 0.
++ */
++        mov     tmp, base, lsl #32-5
++        add     tmp, tmp, leading_bytes, lsl #32-5
++        rsbs    tmp, tmp, leading_bytes, lsl #32-5
++        bls     61f
++        pld     [ptr, #32*(prefetch_distance+1)]
++ .endif
++61:
++.endm
++
++.macro preload_trailing  backwards, base, remain, tmp
++        /* We need either 0, 1 or 2 extra preloads */
++ .if backwards
++        rsb     tmp, base, #0
++        mov     tmp, tmp, lsl #32-5
++ .else
++        mov     tmp, base, lsl #32-5
++ .endif
++        adds    tmp, tmp, remain, lsl #32-5
++        adceqs  tmp, tmp, #0
++        /* The instruction above has two effects: ensures Z is only
++         * set if C was clear (so Z indicates that both shifted quantities
++         * were 0), and clears C if Z was set (so C indicates that the sum
++         * of the shifted quantities was greater and not equal to 32) */
++        beq     82f
++ .if backwards
++        sub     tmp, base, #1
++        bic     tmp, tmp, #31
++ .else
++        bic     tmp, base, #31
++ .endif
++        bcc     81f
++ .if backwards
++        pld     [tmp, #-32*(prefetch_distance+1)]
++81:
++        pld     [tmp, #-32*prefetch_distance]
++ .else
++        pld     [tmp, #32*(prefetch_distance+2)]
++81:
++        pld     [tmp, #32*(prefetch_distance+1)]
++ .endif
++82:
++.endm
++
++.macro preload_all    backwards, narrow_case, shift, base, remain, tmp0, tmp1
++ .if backwards
++        sub     tmp0, base, #1
++        bic     tmp0, tmp0, #31
++        pld     [tmp0]
++        sub     tmp1, base, remain, lsl #shift
++ .else
++        bic     tmp0, base, #31
++        pld     [tmp0]
++        add     tmp1, base, remain, lsl #shift
++        sub     tmp1, tmp1, #1
++ .endif
++        bic     tmp1, tmp1, #31
++        cmp     tmp1, tmp0
++        beq     92f
++ .if narrow_case
++        /* In this case, all the data fits in either 1 or 2 cache lines */
++        pld     [tmp1]
++ .else
++91:
++  .if backwards
++        sub     tmp0, tmp0, #32
++  .else
++        add     tmp0, tmp0, #32
++  .endif
++        cmp     tmp0, tmp1
++        pld     [tmp0]
++        bne     91b
++ .endif
++92:
++.endm
+--- a/arch/arm/lib/copy_from_user.S
++++ b/arch/arm/lib/copy_from_user.S
+@@ -104,7 +104,8 @@ UNWIND( .save	{r0, r2, r3, \regs}		)
+ 
+ 	.text
+ 
+-ENTRY(arm_copy_from_user)
++ENTRY(__copy_from_user_std)
++WEAK(arm_copy_from_user)
+ #ifdef CONFIG_CPU_SPECTRE
+ 	ldr	r3, =TASK_SIZE
+ 	uaccess_mask_range_ptr r1, r2, r3, ip
+@@ -113,6 +114,7 @@ ENTRY(arm_copy_from_user)
+ #include "copy_template.S"
+ 
+ ENDPROC(arm_copy_from_user)
++ENDPROC(__copy_from_user_std)
+ 
+ 	.pushsection .text.fixup,"ax"
+ 	.align 0
+--- /dev/null
++++ b/arch/arm/lib/exports_rpi.c
+@@ -0,0 +1,37 @@
++/**
++ * Copyright (c) 2014, Raspberry Pi (Trading) Ltd.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions, and the following disclaimer,
++ *    without modification.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. The names of the above-listed copyright holders may not be used
++ *    to endorse or promote products derived from this software without
++ *    specific prior written permission.
++ *
++ * ALTERNATIVELY, this software may be distributed under the terms of the
++ * GNU General Public License ("GPL") version 2, as published by the Free
++ * Software Foundation.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
++ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
++ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
++ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
++ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
++ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++
++EXPORT_SYMBOL(memcmp);
+--- /dev/null
++++ b/arch/arm/lib/memcmp_rpi.S
+@@ -0,0 +1,285 @@
++/*
++Copyright (c) 2013, Raspberry Pi Foundation
++Copyright (c) 2013, RISC OS Open Ltd
++All rights reserved.
++
++Redistribution and use in source and binary forms, with or without
++modification, are permitted provided that the following conditions are met:
++    * Redistributions of source code must retain the above copyright
++      notice, this list of conditions and the following disclaimer.
++    * Redistributions in binary form must reproduce the above copyright
++      notice, this list of conditions and the following disclaimer in the
++      documentation and/or other materials provided with the distribution.
++    * Neither the name of the copyright holder nor the
++      names of its contributors may be used to endorse or promote products
++      derived from this software without specific prior written permission.
++
++THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
++ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
++WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
++DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
++DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
++ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++*/
++
++#include <linux/linkage.h>
++#include "arm-mem.h"
++
++/* Prevent the stack from becoming executable */
++#if defined(__linux__) && defined(__ELF__)
++.section .note.GNU-stack,"",%progbits
++#endif
++
++    .text
++    .arch armv6
++    .object_arch armv4
++    .arm
++    .altmacro
++    .p2align 2
++
++.macro memcmp_process_head  unaligned
++ .if unaligned
++        ldr     DAT0, [S_1], #4
++        ldr     DAT1, [S_1], #4
++        ldr     DAT2, [S_1], #4
++        ldr     DAT3, [S_1], #4
++ .else
++        ldmia   S_1!, {DAT0, DAT1, DAT2, DAT3}
++ .endif
++        ldmia   S_2!, {DAT4, DAT5, DAT6, DAT7}
++.endm
++
++.macro memcmp_process_tail
++        cmp     DAT0, DAT4
++        cmpeq   DAT1, DAT5
++        cmpeq   DAT2, DAT6
++        cmpeq   DAT3, DAT7
++        bne     200f
++.endm
++
++.macro memcmp_leading_31bytes
++        movs    DAT0, OFF, lsl #31
++        ldrmib  DAT0, [S_1], #1
++        ldrcsh  DAT1, [S_1], #2
++        ldrmib  DAT4, [S_2], #1
++        ldrcsh  DAT5, [S_2], #2
++        movpl   DAT0, #0
++        movcc   DAT1, #0
++        movpl   DAT4, #0
++        movcc   DAT5, #0
++        submi   N, N, #1
++        subcs   N, N, #2
++        cmp     DAT0, DAT4
++        cmpeq   DAT1, DAT5
++        bne     200f
++        movs    DAT0, OFF, lsl #29
++        ldrmi   DAT0, [S_1], #4
++        ldrcs   DAT1, [S_1], #4
++        ldrcs   DAT2, [S_1], #4
++        ldrmi   DAT4, [S_2], #4
++        ldmcsia S_2!, {DAT5, DAT6}
++        movpl   DAT0, #0
++        movcc   DAT1, #0
++        movcc   DAT2, #0
++        movpl   DAT4, #0
++        movcc   DAT5, #0
++        movcc   DAT6, #0
++        submi   N, N, #4
++        subcs   N, N, #8
++        cmp     DAT0, DAT4
++        cmpeq   DAT1, DAT5
++        cmpeq   DAT2, DAT6
++        bne     200f
++        tst     OFF, #16
++        beq     105f
++        memcmp_process_head  1
++        sub     N, N, #16
++        memcmp_process_tail
++105:
++.endm
++
++.macro memcmp_trailing_15bytes  unaligned
++        movs    N, N, lsl #29
++ .if unaligned
++        ldrcs   DAT0, [S_1], #4
++        ldrcs   DAT1, [S_1], #4
++ .else
++        ldmcsia S_1!, {DAT0, DAT1}
++ .endif
++        ldrmi   DAT2, [S_1], #4
++        ldmcsia S_2!, {DAT4, DAT5}
++        ldrmi   DAT6, [S_2], #4
++        movcc   DAT0, #0
++        movcc   DAT1, #0
++        movpl   DAT2, #0
++        movcc   DAT4, #0
++        movcc   DAT5, #0
++        movpl   DAT6, #0
++        cmp     DAT0, DAT4
++        cmpeq   DAT1, DAT5
++        cmpeq   DAT2, DAT6
++        bne     200f
++        movs    N, N, lsl #2
++        ldrcsh  DAT0, [S_1], #2
++        ldrmib  DAT1, [S_1]
++        ldrcsh  DAT4, [S_2], #2
++        ldrmib  DAT5, [S_2]
++        movcc   DAT0, #0
++        movpl   DAT1, #0
++        movcc   DAT4, #0
++        movpl   DAT5, #0
++        cmp     DAT0, DAT4
++        cmpeq   DAT1, DAT5
++        bne     200f
++.endm
++
++.macro memcmp_long_inner_loop  unaligned
++110:
++        memcmp_process_head  unaligned
++        pld     [S_2, #prefetch_distance*32 + 16]
++        memcmp_process_tail
++        memcmp_process_head  unaligned
++        pld     [S_1, OFF]
++        memcmp_process_tail
++        subs    N, N, #32
++        bhs     110b
++        /* Just before the final (prefetch_distance+1) 32-byte blocks,
++         * deal with final preloads */
++        preload_trailing  0, S_1, N, DAT0
++        preload_trailing  0, S_2, N, DAT0
++        add     N, N, #(prefetch_distance+2)*32 - 16
++120:
++        memcmp_process_head  unaligned
++        memcmp_process_tail
++        subs    N, N, #16
++        bhs     120b
++        /* Trailing words and bytes */
++        tst     N, #15
++        beq     199f
++        memcmp_trailing_15bytes  unaligned
++199:    /* Reached end without detecting a difference */
++        mov     a1, #0
++        setend  le
++        pop     {DAT1-DAT6, pc}
++.endm
++
++.macro memcmp_short_inner_loop  unaligned
++        subs    N, N, #16     /* simplifies inner loop termination */
++        blo     122f
++120:
++        memcmp_process_head  unaligned
++        memcmp_process_tail
++        subs    N, N, #16
++        bhs     120b
++122:    /* Trailing words and bytes */
++        tst     N, #15
++        beq     199f
++        memcmp_trailing_15bytes  unaligned
++199:    /* Reached end without detecting a difference */
++        mov     a1, #0
++        setend  le
++        pop     {DAT1-DAT6, pc}
++.endm
++
++/*
++ * int memcmp(const void *s1, const void *s2, size_t n);
++ * On entry:
++ * a1 = pointer to buffer 1
++ * a2 = pointer to buffer 2
++ * a3 = number of bytes to compare (as unsigned chars)
++ * On exit:
++ * a1 = >0/=0/<0 if s1 >/=/< s2
++ */
++
++.set prefetch_distance, 2
++
++ENTRY(memcmp)
++        S_1     .req    a1
++        S_2     .req    a2
++        N       .req    a3
++        DAT0    .req    a4
++        DAT1    .req    v1
++        DAT2    .req    v2
++        DAT3    .req    v3
++        DAT4    .req    v4
++        DAT5    .req    v5
++        DAT6    .req    v6
++        DAT7    .req    ip
++        OFF     .req    lr
++
++        push    {DAT1-DAT6, lr}
++        setend  be /* lowest-addressed bytes are most significant */
++
++        /* To preload ahead as we go, we need at least (prefetch_distance+2) 32-byte blocks */
++        cmp     N, #(prefetch_distance+3)*32 - 1
++        blo     170f
++
++        /* Long case */
++        /* Adjust N so that the decrement instruction can also test for
++         * inner loop termination. We want it to stop when there are
++         * (prefetch_distance+1) complete blocks to go. */
++        sub     N, N, #(prefetch_distance+2)*32
++        preload_leading_step1  0, DAT0, S_1
++        preload_leading_step1  0, DAT1, S_2
++        tst     S_2, #31
++        beq     154f
++        rsb     OFF, S_2, #0 /* no need to AND with 15 here */
++        preload_leading_step2  0, DAT0, S_1, OFF, DAT2
++        preload_leading_step2  0, DAT1, S_2, OFF, DAT2
++        memcmp_leading_31bytes
++154:    /* Second source now cacheline (32-byte) aligned; we have at
++         * least one prefetch to go. */
++        /* Prefetch offset is best selected such that it lies in the
++         * first 8 of each 32 bytes - but it's just as easy to aim for
++         * the first one */
++        and     OFF, S_1, #31
++        rsb     OFF, OFF, #32*prefetch_distance
++        tst     S_1, #3
++        bne     140f
++        memcmp_long_inner_loop  0
++140:    memcmp_long_inner_loop  1
++
++170:    /* Short case */
++        teq     N, #0
++        beq     199f
++        preload_all 0, 0, 0, S_1, N, DAT0, DAT1
++        preload_all 0, 0, 0, S_2, N, DAT0, DAT1
++        tst     S_2, #3
++        beq     174f
++172:    subs    N, N, #1
++        blo     199f
++        ldrb    DAT0, [S_1], #1
++        ldrb    DAT4, [S_2], #1
++        cmp     DAT0, DAT4
++        bne     200f
++        tst     S_2, #3
++        bne     172b
++174:    /* Second source now 4-byte aligned; we have 0 or more bytes to go */
++        tst     S_1, #3
++        bne     140f
++        memcmp_short_inner_loop  0
++140:    memcmp_short_inner_loop  1
++
++200:    /* Difference found: determine sign. */
++        movhi   a1, #1
++        movlo   a1, #-1
++        setend  le
++        pop     {DAT1-DAT6, pc}
++
++        .unreq  S_1
++        .unreq  S_2
++        .unreq  N
++        .unreq  DAT0
++        .unreq  DAT1
++        .unreq  DAT2
++        .unreq  DAT3
++        .unreq  DAT4
++        .unreq  DAT5
++        .unreq  DAT6
++        .unreq  DAT7
++        .unreq  OFF
++ENDPROC(memcmp)
+--- /dev/null
++++ b/arch/arm/lib/memcpy_rpi.S
+@@ -0,0 +1,63 @@
++/*
++Copyright (c) 2013, Raspberry Pi Foundation
++Copyright (c) 2013, RISC OS Open Ltd
++All rights reserved.
++
++Redistribution and use in source and binary forms, with or without
++modification, are permitted provided that the following conditions are met:
++    * Redistributions of source code must retain the above copyright
++      notice, this list of conditions and the following disclaimer.
++    * Redistributions in binary form must reproduce the above copyright
++      notice, this list of conditions and the following disclaimer in the
++      documentation and/or other materials provided with the distribution.
++    * Neither the name of the copyright holder nor the
++      names of its contributors may be used to endorse or promote products
++      derived from this software without specific prior written permission.
++
++THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
++ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
++WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
++DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
++DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
++ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++*/
++
++#include <linux/linkage.h>
++#include <asm/assembler.h>
++#include <asm/unwind.h>
++#include "arm-mem.h"
++#include "memcpymove.h"
++
++/* Prevent the stack from becoming executable */
++#if defined(__linux__) && defined(__ELF__)
++.section .note.GNU-stack,"",%progbits
++#endif
++
++    .text
++    .arch armv6
++    .object_arch armv4
++    .arm
++    .altmacro
++    .p2align 2
++
++/*
++ * void *memcpy(void * restrict s1, const void * restrict s2, size_t n);
++ * On entry:
++ * a1 = pointer to destination
++ * a2 = pointer to source
++ * a3 = number of bytes to copy
++ * On exit:
++ * a1 preserved
++ */
++
++.set prefetch_distance, 3
++
++ENTRY(mmiocpy)
++ENTRY(memcpy)
++        memcpy  0
++ENDPROC(memcpy)
++ENDPROC(mmiocpy)
+--- /dev/null
++++ b/arch/arm/lib/memcpymove.h
+@@ -0,0 +1,488 @@
++/*
++Copyright (c) 2013, Raspberry Pi Foundation
++Copyright (c) 2013, RISC OS Open Ltd
++All rights reserved.
++
++Redistribution and use in source and binary forms, with or without
++modification, are permitted provided that the following conditions are met:
++    * Redistributions of source code must retain the above copyright
++      notice, this list of conditions and the following disclaimer.
++    * Redistributions in binary form must reproduce the above copyright
++      notice, this list of conditions and the following disclaimer in the
++      documentation and/or other materials provided with the distribution.
++    * Neither the name of the copyright holder nor the
++      names of its contributors may be used to endorse or promote products
++      derived from this software without specific prior written permission.
++
++THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
++ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
++WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
++DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
++DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
++ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++*/
++
++.macro unaligned_words  backwards, align, use_pld, words, r0, r1, r2, r3, r4, r5, r6, r7, r8
++ .if words == 1
++  .if backwards
++        mov     r1, r0, lsl #32-align*8
++        ldr     r0, [S, #-4]!
++        orr     r1, r1, r0, lsr #align*8
++        str     r1, [D, #-4]!
++  .else
++        mov     r0, r1, lsr #align*8
++        ldr     r1, [S, #4]!
++        orr     r0, r0, r1, lsl #32-align*8
++        str     r0, [D], #4
++  .endif
++ .elseif words == 2
++  .if backwards
++        ldr     r1, [S, #-4]!
++        mov     r2, r0, lsl #32-align*8
++        ldr     r0, [S, #-4]!
++        orr     r2, r2, r1, lsr #align*8
++        mov     r1, r1, lsl #32-align*8
++        orr     r1, r1, r0, lsr #align*8
++        stmdb   D!, {r1, r2}
++  .else
++        ldr     r1, [S, #4]!
++        mov     r0, r2, lsr #align*8
++        ldr     r2, [S, #4]!
++        orr     r0, r0, r1, lsl #32-align*8
++        mov     r1, r1, lsr #align*8
++        orr     r1, r1, r2, lsl #32-align*8
++        stmia   D!, {r0, r1}
++  .endif
++ .elseif words == 4
++  .if backwards
++        ldmdb   S!, {r2, r3}
++        mov     r4, r0, lsl #32-align*8
++        ldmdb   S!, {r0, r1}
++        orr     r4, r4, r3, lsr #align*8
++        mov     r3, r3, lsl #32-align*8
++        orr     r3, r3, r2, lsr #align*8
++        mov     r2, r2, lsl #32-align*8
++        orr     r2, r2, r1, lsr #align*8
++        mov     r1, r1, lsl #32-align*8
++        orr     r1, r1, r0, lsr #align*8
++        stmdb   D!, {r1, r2, r3, r4}
++  .else
++        ldmib   S!, {r1, r2}
++        mov     r0, r4, lsr #align*8
++        ldmib   S!, {r3, r4}
++        orr     r0, r0, r1, lsl #32-align*8
++        mov     r1, r1, lsr #align*8
++        orr     r1, r1, r2, lsl #32-align*8
++        mov     r2, r2, lsr #align*8
++        orr     r2, r2, r3, lsl #32-align*8
++        mov     r3, r3, lsr #align*8
++        orr     r3, r3, r4, lsl #32-align*8
++        stmia   D!, {r0, r1, r2, r3}
++  .endif
++ .elseif words == 8
++  .if backwards
++        ldmdb   S!, {r4, r5, r6, r7}
++        mov     r8, r0, lsl #32-align*8
++        ldmdb   S!, {r0, r1, r2, r3}
++   .if use_pld
++        pld     [S, OFF]
++   .endif
++        orr     r8, r8, r7, lsr #align*8
++        mov     r7, r7, lsl #32-align*8
++        orr     r7, r7, r6, lsr #align*8
++        mov     r6, r6, lsl #32-align*8
++        orr     r6, r6, r5, lsr #align*8
++        mov     r5, r5, lsl #32-align*8
++        orr     r5, r5, r4, lsr #align*8
++        mov     r4, r4, lsl #32-align*8
++        orr     r4, r4, r3, lsr #align*8
++        mov     r3, r3, lsl #32-align*8
++        orr     r3, r3, r2, lsr #align*8
++        mov     r2, r2, lsl #32-align*8
++        orr     r2, r2, r1, lsr #align*8
++        mov     r1, r1, lsl #32-align*8
++        orr     r1, r1, r0, lsr #align*8
++        stmdb   D!, {r5, r6, r7, r8}
++        stmdb   D!, {r1, r2, r3, r4}
++  .else
++        ldmib   S!, {r1, r2, r3, r4}
++        mov     r0, r8, lsr #align*8
++        ldmib   S!, {r5, r6, r7, r8}
++   .if use_pld
++        pld     [S, OFF]
++   .endif
++        orr     r0, r0, r1, lsl #32-align*8
++        mov     r1, r1, lsr #align*8
++        orr     r1, r1, r2, lsl #32-align*8
++        mov     r2, r2, lsr #align*8
++        orr     r2, r2, r3, lsl #32-align*8
++        mov     r3, r3, lsr #align*8
++        orr     r3, r3, r4, lsl #32-align*8
++        mov     r4, r4, lsr #align*8
++        orr     r4, r4, r5, lsl #32-align*8
++        mov     r5, r5, lsr #align*8
++        orr     r5, r5, r6, lsl #32-align*8
++        mov     r6, r6, lsr #align*8
++        orr     r6, r6, r7, lsl #32-align*8
++        mov     r7, r7, lsr #align*8
++        orr     r7, r7, r8, lsl #32-align*8
++        stmia   D!, {r0, r1, r2, r3}
++        stmia   D!, {r4, r5, r6, r7}
++  .endif
++ .endif
++.endm
++
++.macro memcpy_leading_15bytes  backwards, align
++        movs    DAT1, DAT2, lsl #31
++        sub     N, N, DAT2
++ .if backwards
++        ldrmib  DAT0, [S, #-1]!
++        ldrcsh  DAT1, [S, #-2]!
++        strmib  DAT0, [D, #-1]!
++        strcsh  DAT1, [D, #-2]!
++ .else
++        ldrmib  DAT0, [S], #1
++        ldrcsh  DAT1, [S], #2
++        strmib  DAT0, [D], #1
++        strcsh  DAT1, [D], #2
++ .endif
++        movs    DAT1, DAT2, lsl #29
++ .if backwards
++        ldrmi   DAT0, [S, #-4]!
++  .if align == 0
++        ldmcsdb S!, {DAT1, DAT2}
++  .else
++        ldrcs   DAT2, [S, #-4]!
++        ldrcs   DAT1, [S, #-4]!
++  .endif
++        strmi   DAT0, [D, #-4]!
++        stmcsdb D!, {DAT1, DAT2}
++ .else
++        ldrmi   DAT0, [S], #4
++  .if align == 0
++        ldmcsia S!, {DAT1, DAT2}
++  .else
++        ldrcs   DAT1, [S], #4
++        ldrcs   DAT2, [S], #4
++  .endif
++        strmi   DAT0, [D], #4
++        stmcsia D!, {DAT1, DAT2}
++ .endif
++.endm
++
++.macro memcpy_trailing_15bytes  backwards, align
++        movs    N, N, lsl #29
++ .if backwards
++  .if align == 0
++        ldmcsdb S!, {DAT0, DAT1}
++  .else
++        ldrcs   DAT1, [S, #-4]!
++        ldrcs   DAT0, [S, #-4]!
++  .endif
++        ldrmi   DAT2, [S, #-4]!
++        stmcsdb D!, {DAT0, DAT1}
++        strmi   DAT2, [D, #-4]!
++ .else
++  .if align == 0
++        ldmcsia S!, {DAT0, DAT1}
++  .else
++        ldrcs   DAT0, [S], #4
++        ldrcs   DAT1, [S], #4
++  .endif
++        ldrmi   DAT2, [S], #4
++        stmcsia D!, {DAT0, DAT1}
++        strmi   DAT2, [D], #4
++ .endif
++        movs    N, N, lsl #2
++ .if backwards
++        ldrcsh  DAT0, [S, #-2]!
++        ldrmib  DAT1, [S, #-1]
++        strcsh  DAT0, [D, #-2]!
++        strmib  DAT1, [D, #-1]
++ .else
++        ldrcsh  DAT0, [S], #2
++        ldrmib  DAT1, [S]
++        strcsh  DAT0, [D], #2
++        strmib  DAT1, [D]
++ .endif
++.endm
++
++.macro memcpy_long_inner_loop  backwards, align
++ .if align != 0
++  .if backwards
++        ldr     DAT0, [S, #-align]!
++  .else
++        ldr     LAST, [S, #-align]!
++  .endif
++ .endif
++110:
++ .if align == 0
++  .if backwards
++        ldmdb   S!, {DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, LAST}
++        pld     [S, OFF]
++        stmdb   D!, {DAT4, DAT5, DAT6, LAST}
++        stmdb   D!, {DAT0, DAT1, DAT2, DAT3}
++  .else
++        ldmia   S!, {DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, LAST}
++        pld     [S, OFF]
++        stmia   D!, {DAT0, DAT1, DAT2, DAT3}
++        stmia   D!, {DAT4, DAT5, DAT6, LAST}
++  .endif
++ .else
++        unaligned_words  backwards, align, 1, 8, DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, DAT7, LAST
++ .endif
++        subs    N, N, #32
++        bhs     110b
++        /* Just before the final (prefetch_distance+1) 32-byte blocks, deal with final preloads */
++        preload_trailing  backwards, S, N, OFF
++        add     N, N, #(prefetch_distance+2)*32 - 32
++120:
++ .if align == 0
++  .if backwards
++        ldmdb   S!, {DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, LAST}
++        stmdb   D!, {DAT4, DAT5, DAT6, LAST}
++        stmdb   D!, {DAT0, DAT1, DAT2, DAT3}
++  .else
++        ldmia   S!, {DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, LAST}
++        stmia   D!, {DAT0, DAT1, DAT2, DAT3}
++        stmia   D!, {DAT4, DAT5, DAT6, LAST}
++  .endif
++ .else
++        unaligned_words  backwards, align, 0, 8, DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, DAT7, LAST
++ .endif
++        subs    N, N, #32
++        bhs     120b
++        tst     N, #16
++ .if align == 0
++  .if backwards
++        ldmnedb S!, {DAT0, DAT1, DAT2, LAST}
++        stmnedb D!, {DAT0, DAT1, DAT2, LAST}
++  .else
++        ldmneia S!, {DAT0, DAT1, DAT2, LAST}
++        stmneia D!, {DAT0, DAT1, DAT2, LAST}
++  .endif
++ .else
++        beq     130f
++        unaligned_words  backwards, align, 0, 4, DAT0, DAT1, DAT2, DAT3, LAST
++130:
++ .endif
++        /* Trailing words and bytes */
++        tst      N, #15
++        beq      199f
++ .if align != 0
++        add     S, S, #align
++ .endif
++        memcpy_trailing_15bytes  backwards, align
++199:
++        pop     {DAT3, DAT4, DAT5, DAT6, DAT7}
++        pop     {D, DAT1, DAT2, pc}
++.endm
++
++.macro memcpy_medium_inner_loop  backwards, align
++120:
++ .if backwards
++  .if align == 0
++        ldmdb   S!, {DAT0, DAT1, DAT2, LAST}
++  .else
++        ldr     LAST, [S, #-4]!
++        ldr     DAT2, [S, #-4]!
++        ldr     DAT1, [S, #-4]!
++        ldr     DAT0, [S, #-4]!
++  .endif
++        stmdb   D!, {DAT0, DAT1, DAT2, LAST}
++ .else
++  .if align == 0
++        ldmia   S!, {DAT0, DAT1, DAT2, LAST}
++  .else
++        ldr     DAT0, [S], #4
++        ldr     DAT1, [S], #4
++        ldr     DAT2, [S], #4
++        ldr     LAST, [S], #4
++  .endif
++        stmia   D!, {DAT0, DAT1, DAT2, LAST}
++ .endif
++        subs     N, N, #16
++        bhs      120b
++        /* Trailing words and bytes */
++        tst      N, #15
++        beq      199f
++        memcpy_trailing_15bytes  backwards, align
++199:
++        pop     {D, DAT1, DAT2, pc}
++.endm
++
++.macro memcpy_short_inner_loop  backwards, align
++        tst     N, #16
++ .if backwards
++  .if align == 0
++        ldmnedb S!, {DAT0, DAT1, DAT2, LAST}
++  .else
++        ldrne   LAST, [S, #-4]!
++        ldrne   DAT2, [S, #-4]!
++        ldrne   DAT1, [S, #-4]!
++        ldrne   DAT0, [S, #-4]!
++  .endif
++        stmnedb D!, {DAT0, DAT1, DAT2, LAST}
++ .else
++  .if align == 0
++        ldmneia S!, {DAT0, DAT1, DAT2, LAST}
++  .else
++        ldrne   DAT0, [S], #4
++        ldrne   DAT1, [S], #4
++        ldrne   DAT2, [S], #4
++        ldrne   LAST, [S], #4
++  .endif
++        stmneia D!, {DAT0, DAT1, DAT2, LAST}
++ .endif
++        memcpy_trailing_15bytes  backwards, align
++199:
++        pop     {D, DAT1, DAT2, pc}
++.endm
++
++.macro memcpy backwards
++        D       .req    a1
++        S       .req    a2
++        N       .req    a3
++        DAT0    .req    a4
++        DAT1    .req    v1
++        DAT2    .req    v2
++        DAT3    .req    v3
++        DAT4    .req    v4
++        DAT5    .req    v5
++        DAT6    .req    v6
++        DAT7    .req    sl
++        LAST    .req    ip
++        OFF     .req    lr
++
++        UNWIND( .fnstart )
++
++        push    {D, DAT1, DAT2, lr}
++        UNWIND( .fnend )
++
++        UNWIND( .fnstart )
++        UNWIND( .save {D, DAT1, DAT2, lr} )
++
++ .if backwards
++        add     D, D, N
++        add     S, S, N
++ .endif
++
++        /* See if we're guaranteed to have at least one 16-byte aligned 16-byte write */
++        cmp     N, #31
++        blo     170f
++        /* To preload ahead as we go, we need at least (prefetch_distance+2) 32-byte blocks */
++        cmp     N, #(prefetch_distance+3)*32 - 1
++        blo     160f
++
++        /* Long case */
++        push    {DAT3, DAT4, DAT5, DAT6, DAT7}
++        UNWIND( .fnend )
++
++        UNWIND( .fnstart )
++        UNWIND( .save {D, DAT1, DAT2, lr} )
++        UNWIND( .save {DAT3, DAT4, DAT5, DAT6, DAT7} )
++
++        /* Adjust N so that the decrement instruction can also test for
++         * inner loop termination. We want it to stop when there are
++         * (prefetch_distance+1) complete blocks to go. */
++        sub     N, N, #(prefetch_distance+2)*32
++        preload_leading_step1  backwards, DAT0, S
++ .if backwards
++        /* Bug in GAS: it accepts, but mis-assembles the instruction
++         * ands    DAT2, D, #60, 2
++         * which sets DAT2 to the number of leading bytes until destination is aligned and also clears C (sets borrow)
++         */
++        .word   0xE210513C
++        beq     154f
++ .else
++        ands    DAT2, D, #15
++        beq     154f
++        rsb     DAT2, DAT2, #16 /* number of leading bytes until destination aligned */
++ .endif
++        preload_leading_step2  backwards, DAT0, S, DAT2, OFF
++        memcpy_leading_15bytes backwards, 1
++154:    /* Destination now 16-byte aligned; we have at least one prefetch as well as at least one 16-byte output block */
++        /* Prefetch offset is best selected such that it lies in the first 8 of each 32 bytes - but it's just as easy to aim for the first one */
++ .if backwards
++        rsb     OFF, S, #3
++        and     OFF, OFF, #28
++        sub     OFF, OFF, #32*(prefetch_distance+1)
++ .else
++        and     OFF, S, #28
++        rsb     OFF, OFF, #32*prefetch_distance
++ .endif
++        movs    DAT0, S, lsl #31
++        bhi     157f
++        bcs     156f
++        bmi     155f
++        memcpy_long_inner_loop  backwards, 0
++155:    memcpy_long_inner_loop  backwards, 1
++156:    memcpy_long_inner_loop  backwards, 2
++157:    memcpy_long_inner_loop  backwards, 3
++
++        UNWIND( .fnend )
++
++        UNWIND( .fnstart )
++        UNWIND( .save {D, DAT1, DAT2, lr} )
++
++160:    /* Medium case */
++        preload_all  backwards, 0, 0, S, N, DAT2, OFF
++        sub     N, N, #16     /* simplifies inner loop termination */
++ .if backwards
++        ands    DAT2, D, #15
++        beq     164f
++ .else
++        ands    DAT2, D, #15
++        beq     164f
++        rsb     DAT2, DAT2, #16
++ .endif
++        memcpy_leading_15bytes backwards, align
++164:    /* Destination now 16-byte aligned; we have at least one 16-byte output block */
++        tst     S, #3
++        bne     140f
++        memcpy_medium_inner_loop  backwards, 0
++140:    memcpy_medium_inner_loop  backwards, 1
++
++170:    /* Short case, less than 31 bytes, so no guarantee of at least one 16-byte block */
++        teq     N, #0
++        beq     199f
++        preload_all  backwards, 1, 0, S, N, DAT2, LAST
++        tst     D, #3
++        beq     174f
++172:    subs    N, N, #1
++        blo     199f
++ .if backwards
++        ldrb    DAT0, [S, #-1]!
++        strb    DAT0, [D, #-1]!
++ .else
++        ldrb    DAT0, [S], #1
++        strb    DAT0, [D], #1
++ .endif
++        tst     D, #3
++        bne     172b
++174:    /* Destination now 4-byte aligned; we have 0 or more output bytes to go */
++        tst     S, #3
++        bne     140f
++        memcpy_short_inner_loop  backwards, 0
++140:    memcpy_short_inner_loop  backwards, 1
++
++        UNWIND( .fnend )
++
++        .unreq  D
++        .unreq  S
++        .unreq  N
++        .unreq  DAT0
++        .unreq  DAT1
++        .unreq  DAT2
++        .unreq  DAT3
++        .unreq  DAT4
++        .unreq  DAT5
++        .unreq  DAT6
++        .unreq  DAT7
++        .unreq  LAST
++        .unreq  OFF
++.endm
+--- /dev/null
++++ b/arch/arm/lib/memmove_rpi.S
+@@ -0,0 +1,63 @@
++/*
++Copyright (c) 2013, Raspberry Pi Foundation
++Copyright (c) 2013, RISC OS Open Ltd
++All rights reserved.
++
++Redistribution and use in source and binary forms, with or without
++modification, are permitted provided that the following conditions are met:
++    * Redistributions of source code must retain the above copyright
++      notice, this list of conditions and the following disclaimer.
++    * Redistributions in binary form must reproduce the above copyright
++      notice, this list of conditions and the following disclaimer in the
++      documentation and/or other materials provided with the distribution.
++    * Neither the name of the copyright holder nor the
++      names of its contributors may be used to endorse or promote products
++      derived from this software without specific prior written permission.
++
++THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
++ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
++WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
++DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
++DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
++ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++*/
++
++#include <linux/linkage.h>
++#include <asm/assembler.h>
++#include <asm/unwind.h>
++#include "arm-mem.h"
++#include "memcpymove.h"
++
++/* Prevent the stack from becoming executable */
++#if defined(__linux__) && defined(__ELF__)
++.section .note.GNU-stack,"",%progbits
++#endif
++
++    .text
++    .arch armv6
++    .object_arch armv4
++    .arm
++    .altmacro
++    .p2align 2
++
++/*
++ * void *memmove(void *s1, const void *s2, size_t n);
++ * On entry:
++ * a1 = pointer to destination
++ * a2 = pointer to source
++ * a3 = number of bytes to copy
++ * On exit:
++ * a1 preserved
++ */
++
++.set prefetch_distance, 3
++
++ENTRY(memmove)
++        cmp     a2, a1
++        bpl     memcpy  /* pl works even over -1 - 0 and 0x7fffffff - 0x80000000 boundaries */
++        memcpy  1
++ENDPROC(memmove)
+--- /dev/null
++++ b/arch/arm/lib/memset_rpi.S
+@@ -0,0 +1,132 @@
++/*
++Copyright (c) 2013, Raspberry Pi Foundation
++Copyright (c) 2013, RISC OS Open Ltd
++All rights reserved.
++
++Redistribution and use in source and binary forms, with or without
++modification, are permitted provided that the following conditions are met:
++    * Redistributions of source code must retain the above copyright
++      notice, this list of conditions and the following disclaimer.
++    * Redistributions in binary form must reproduce the above copyright
++      notice, this list of conditions and the following disclaimer in the
++      documentation and/or other materials provided with the distribution.
++    * Neither the name of the copyright holder nor the
++      names of its contributors may be used to endorse or promote products
++      derived from this software without specific prior written permission.
++
++THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
++ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
++WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
++DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
++DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
++ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++*/
++
++#include <linux/linkage.h>
++#include "arm-mem.h"
++
++/* Prevent the stack from becoming executable */
++#if defined(__linux__) && defined(__ELF__)
++.section .note.GNU-stack,"",%progbits
++#endif
++
++    .text
++    .arch armv6
++    .object_arch armv4
++    .arm
++    .altmacro
++    .p2align 2
++
++/*
++ *  void *memset(void *s, int c, size_t n);
++ *  On entry:
++ *  a1 = pointer to buffer to fill
++ *  a2 = byte pattern to fill with (caller-narrowed)
++ *  a3 = number of bytes to fill
++ *  On exit:
++ *  a1 preserved
++ */
++ENTRY(mmioset)
++ENTRY(memset)
++ENTRY(__memset)
++
++        S       .req    a1
++        DAT0    .req    a2
++        N       .req    a3
++        DAT1    .req    a4
++        DAT2    .req    ip
++        DAT3    .req    lr
++
++        orr     DAT0, DAT0, DAT0, lsl #8
++        orr     DAT0, DAT0, DAT0, lsl #16
++
++ENTRY(__memset32)
++        mov     DAT1, DAT0
++
++ENTRY(__memset64)
++        push    {S, lr}
++
++        /* See if we're guaranteed to have at least one 16-byte aligned 16-byte write */
++        cmp     N, #31
++        blo     170f
++
++161:    sub     N, N, #16     /* simplifies inner loop termination */
++        /* Leading words and bytes */
++        tst     S, #15
++        beq     164f
++        rsb     DAT3, S, #0   /* bits 0-3 = number of leading bytes until aligned */
++        movs    DAT2, DAT3, lsl #31
++        submi   N, N, #1
++        strmib  DAT0, [S], #1
++        subcs   N, N, #2
++        strcsh  DAT0, [S], #2
++        movs    DAT2, DAT3, lsl #29
++        submi   N, N, #4
++        strmi   DAT0, [S], #4
++        subcs   N, N, #8
++        stmcsia S!, {DAT0, DAT1}
++164:    /* Delayed set up of DAT2 and DAT3 so we could use them as scratch registers above */
++        mov     DAT2, DAT0
++        mov     DAT3, DAT1
++        /* Now the inner loop of 16-byte stores */
++165:    stmia   S!, {DAT0, DAT1, DAT2, DAT3}
++        subs    N, N, #16
++        bhs     165b
++166:    /* Trailing words and bytes */
++        movs    N, N, lsl #29
++        stmcsia S!, {DAT0, DAT1}
++        strmi   DAT0, [S], #4
++        movs    N, N, lsl #2
++        strcsh  DAT0, [S], #2
++        strmib  DAT0, [S]
++199:    pop     {S, pc}
++
++170:    /* Short case */
++        mov     DAT2, DAT0
++        mov     DAT3, DAT1
++        tst     S, #3
++        beq     174f
++172:    subs    N, N, #1
++        blo     199b
++        strb    DAT0, [S], #1
++        tst     S, #3
++        bne     172b
++174:    tst     N, #16
++        stmneia S!, {DAT0, DAT1, DAT2, DAT3}
++        b       166b
++
++        .unreq  S
++        .unreq  DAT0
++        .unreq  N
++        .unreq  DAT1
++        .unreq  DAT2
++        .unreq  DAT3
++ENDPROC(__memset64)
++ENDPROC(__memset32)
++ENDPROC(__memset)
++ENDPROC(memset)
++ENDPROC(mmioset)
+--- a/arch/arm/lib/uaccess_with_memcpy.c
++++ b/arch/arm/lib/uaccess_with_memcpy.c
+@@ -19,6 +19,14 @@
+ #include <asm/current.h>
+ #include <asm/page.h>
+ 
++#ifndef COPY_FROM_USER_THRESHOLD
++#define COPY_FROM_USER_THRESHOLD 64
++#endif
++
++#ifndef COPY_TO_USER_THRESHOLD
++#define COPY_TO_USER_THRESHOLD 64
++#endif
++
+ static int
+ pin_page_for_write(const void __user *_addr, pte_t **ptep, spinlock_t **ptlp)
+ {
+@@ -43,7 +51,7 @@ pin_page_for_write(const void __user *_a
+ 		return 0;
+ 
+ 	pmd = pmd_offset(pud, addr);
+-	if (unlikely(pmd_none(*pmd)))
++	if (unlikely(pmd_none(*pmd) || pmd_bad(*pmd)))
+ 		return 0;
+ 
+ 	/*
+@@ -86,7 +94,46 @@ pin_page_for_write(const void __user *_a
+ 	return 1;
+ }
+ 
+-static unsigned long noinline
++static int
++pin_page_for_read(const void __user *_addr, pte_t **ptep, spinlock_t **ptlp)
++{
++	unsigned long addr = (unsigned long)_addr;
++	pgd_t *pgd;
++	p4d_t *p4d;
++	pmd_t *pmd;
++	pte_t *pte;
++	pud_t *pud;
++	spinlock_t *ptl;
++
++	pgd = pgd_offset(current->mm, addr);
++	if (unlikely(pgd_none(*pgd) || pgd_bad(*pgd)))
++		return 0;
++
++	p4d = p4d_offset(pgd, addr);
++	if (unlikely(p4d_none(*p4d) || p4d_bad(*p4d)))
++		return 0;
++
++	pud = pud_offset(p4d, addr);
++	if (unlikely(pud_none(*pud) || pud_bad(*pud)))
++		return 0;
++
++	pmd = pmd_offset(pud, addr);
++	if (unlikely(pmd_none(*pmd) || pmd_bad(*pmd)))
++		return 0;
++
++	pte = pte_offset_map_lock(current->mm, pmd, addr, &ptl);
++	if (unlikely(!pte_present(*pte) || !pte_young(*pte))) {
++		pte_unmap_unlock(pte, ptl);
++		return 0;
++	}
++
++	*ptep = pte;
++	*ptlp = ptl;
++
++	return 1;
++}
++
++unsigned long noinline
+ __copy_to_user_memcpy(void __user *to, const void *from, unsigned long n)
+ {
+ 	unsigned long ua_flags;
+@@ -134,6 +181,52 @@ out:
+ 	return n;
+ }
+ 
++unsigned long noinline
++__copy_from_user_memcpy(void *to, const void __user *from, unsigned long n)
++{
++	unsigned long ua_flags;
++	int atomic;
++
++	/* the mmap semaphore is taken only if not in an atomic context */
++	atomic = in_atomic();
++
++	if (!atomic)
++		mmap_read_lock(current->mm);
++	while (n) {
++		pte_t *pte;
++		spinlock_t *ptl;
++		int tocopy;
++
++		while (!pin_page_for_read(from, &pte, &ptl)) {
++			char temp;
++			if (!atomic)
++				mmap_read_unlock(current->mm);
++			if (__get_user(temp, (char __user *)from))
++				goto out;
++			if (!atomic)
++				mmap_read_lock(current->mm);
++		}
++
++		tocopy = (~(unsigned long)from & ~PAGE_MASK) + 1;
++		if (tocopy > n)
++			tocopy = n;
++
++		ua_flags = uaccess_save_and_enable();
++		memcpy(to, (const void *)from, tocopy);
++		uaccess_restore(ua_flags);
++		to += tocopy;
++		from += tocopy;
++		n -= tocopy;
++
++		pte_unmap_unlock(pte, ptl);
++	}
++	if (!atomic)
++		mmap_read_unlock(current->mm);
++
++out:
++	return n;
++}
++
+ unsigned long
+ arm_copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
+@@ -144,7 +237,7 @@ arm_copy_to_user(void __user *to, const
+ 	 * With frame pointer disabled, tail call optimization kicks in
+ 	 * as well making this test almost invisible.
+ 	 */
+-	if (n < 64) {
++	if (n < COPY_TO_USER_THRESHOLD) {
+ 		unsigned long ua_flags = uaccess_save_and_enable();
+ 		n = __copy_to_user_std(to, from, n);
+ 		uaccess_restore(ua_flags);
+@@ -154,6 +247,32 @@ arm_copy_to_user(void __user *to, const
+ 	}
+ 	return n;
+ }
++
++unsigned long __must_check
++arm_copy_from_user(void *to, const void __user *from, unsigned long n)
++{
++#ifdef CONFIG_BCM2835_FAST_MEMCPY
++	/*
++	 * This test is stubbed out of the main function above to keep
++	 * the overhead for small copies low by avoiding a large
++	 * register dump on the stack just to reload them right away.
++	 * With frame pointer disabled, tail call optimization kicks in
++	 * as well making this test almost invisible.
++	 */
++	if (n < COPY_TO_USER_THRESHOLD) {
++		unsigned long ua_flags = uaccess_save_and_enable();
++		n = __copy_from_user_std(to, from, n);
++		uaccess_restore(ua_flags);
++	} else {
++		n = __copy_from_user_memcpy(to, from, n);
++	}
++#else
++	unsigned long ua_flags = uaccess_save_and_enable();
++	n = __copy_from_user_std(to, from, n);
++	uaccess_restore(ua_flags);
++#endif
++	return n;
++}
+ 	
+ static unsigned long noinline
+ __clear_user_memset(void __user *addr, unsigned long n)
+--- a/arch/arm/mach-bcm/Kconfig
++++ b/arch/arm/mach-bcm/Kconfig
+@@ -182,6 +182,30 @@ config ARCH_BCM_53573
+ 	  The base chip is BCM53573 and there are some packaging modifications
+ 	  like BCM47189 and BCM47452.
+ 
++config ARCH_BCM_63XX
++	bool "Broadcom BCM63xx DSL SoC"
++	depends on ARCH_MULTI_V7
++	select ARCH_HAS_RESET_CONTROLLER
++	select ARM_ERRATA_754322
++	select ARM_ERRATA_764369 if SMP
++	select ARM_GIC
++	select ARM_GLOBAL_TIMER
++	select CACHE_L2X0
++	select HAVE_ARM_ARCH_TIMER
++	select HAVE_ARM_TWD if SMP
++	select HAVE_ARM_SCU if SMP
++	help
++	  This enables support for systems based on Broadcom DSL SoCs.
++	  It currently supports the 'BCM63XX' ARM-based family, which includes
++	  the BCM63138 variant.
++
++config BCM2835_FAST_MEMCPY
++	bool "Enable optimized __copy_to_user and __copy_from_user"
++	depends on ARCH_BCM2835 && ARCH_MULTI_V6
++	default y
++	help
++	  Optimized versions of __copy_to_user and __copy_from_user for Pi1.
++
+ config ARCH_BRCMSTB
+ 	bool "Broadcom BCM7XXX based boards"
+ 	depends on ARCH_MULTI_V7
diff --git a/target/linux/bcm27xx/patches-6.1/950-0122-gpio-poweroff-Allow-it-to-work-on-Raspberry-Pi.patch b/target/linux/bcm27xx/patches-6.1/950-0122-gpio-poweroff-Allow-it-to-work-on-Raspberry-Pi.patch
new file mode 100644
index 00000000000000..1cbb7c4f873e03
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0122-gpio-poweroff-Allow-it-to-work-on-Raspberry-Pi.patch
@@ -0,0 +1,35 @@
+From dcd9a1f800c875433064c98113549920f3b11601 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Thu, 25 Jun 2015 12:16:11 +0100
+Subject: [PATCH] gpio-poweroff: Allow it to work on Raspberry Pi
+
+The Raspberry Pi firmware manages the power-down and reboot
+process. To do this it installs a pm_power_off handler, causing
+the gpio-poweroff module to abort the probe function.
+
+This patch introduces a "force" DT property that overrides that
+behaviour, and also adds a DT overlay to enable and control it.
+
+Note that running in an active-low configuration (DT parameter
+"active_low") requires a custom dt-blob.bin and probably won't
+allow a reboot without switching off, so an external inversion
+of the trigger signal may be preferable.
+---
+ drivers/power/reset/gpio-poweroff.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/power/reset/gpio-poweroff.c
++++ b/drivers/power/reset/gpio-poweroff.c
+@@ -50,9 +50,11 @@ static int gpio_poweroff_probe(struct pl
+ {
+ 	bool input = false;
+ 	enum gpiod_flags flags;
++	bool force = false;
+ 
+ 	/* If a pm_power_off function has already been added, leave it alone */
+-	if (pm_power_off != NULL) {
++	force = of_property_read_bool(pdev->dev.of_node, "force");
++	if (!force && (pm_power_off != NULL)) {
+ 		dev_err(&pdev->dev,
+ 			"%s: pm_power_off function already registered\n",
+ 		       __func__);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0123-mfd-Add-Raspberry-Pi-Sense-HAT-core-driver.patch b/target/linux/bcm27xx/patches-6.1/950-0123-mfd-Add-Raspberry-Pi-Sense-HAT-core-driver.patch
new file mode 100644
index 00000000000000..aa962fd40117ec
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0123-mfd-Add-Raspberry-Pi-Sense-HAT-core-driver.patch
@@ -0,0 +1,850 @@
+From 935848f5e265a5e7aaca9a3e9c724fe1a6778e78 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <pelwell@users.noreply.github.com>
+Date: Tue, 14 Jul 2015 14:32:47 +0100
+Subject: [PATCH] mfd: Add Raspberry Pi Sense HAT core driver
+
+mfd: Add rpi_sense_core of compatible string
+---
+ drivers/input/joystick/Kconfig           |   8 +
+ drivers/input/joystick/Makefile          |   1 +
+ drivers/input/joystick/rpisense-js.c     | 153 ++++++++++++
+ drivers/mfd/Kconfig                      |   8 +
+ drivers/mfd/Makefile                     |   1 +
+ drivers/mfd/rpisense-core.c              | 164 +++++++++++++
+ drivers/video/fbdev/Kconfig              |  13 +
+ drivers/video/fbdev/Makefile             |   1 +
+ drivers/video/fbdev/rpisense-fb.c        | 293 +++++++++++++++++++++++
+ include/linux/mfd/rpisense/core.h        |  47 ++++
+ include/linux/mfd/rpisense/framebuffer.h |  32 +++
+ include/linux/mfd/rpisense/joystick.h    |  35 +++
+ 12 files changed, 756 insertions(+)
+ create mode 100644 drivers/input/joystick/rpisense-js.c
+ create mode 100644 drivers/mfd/rpisense-core.c
+ create mode 100644 drivers/video/fbdev/rpisense-fb.c
+ create mode 100644 include/linux/mfd/rpisense/core.h
+ create mode 100644 include/linux/mfd/rpisense/framebuffer.h
+ create mode 100644 include/linux/mfd/rpisense/joystick.h
+
+--- a/drivers/input/joystick/Kconfig
++++ b/drivers/input/joystick/Kconfig
+@@ -412,4 +412,12 @@ config JOYSTICK_SENSEHAT
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called sensehat_joystick.
+ 
++config JOYSTICK_RPISENSE
++	tristate "Raspberry Pi Sense HAT joystick"
++	depends on GPIOLIB && INPUT
++	select MFD_RPISENSE_CORE
++
++	help
++	  This is the joystick driver for the Raspberry Pi Sense HAT
++
+ endif
+--- a/drivers/input/joystick/Makefile
++++ b/drivers/input/joystick/Makefile
+@@ -40,3 +40,4 @@ obj-$(CONFIG_JOYSTICK_WARRIOR)		+= warri
+ obj-$(CONFIG_JOYSTICK_WALKERA0701)	+= walkera0701.o
+ obj-$(CONFIG_JOYSTICK_XPAD)		+= xpad.o
+ obj-$(CONFIG_JOYSTICK_ZHENHUA)		+= zhenhua.o
++obj-$(CONFIG_JOYSTICK_RPISENSE)		+= rpisense-js.o
+--- /dev/null
++++ b/drivers/input/joystick/rpisense-js.c
+@@ -0,0 +1,153 @@
++/*
++ * Raspberry Pi Sense HAT joystick driver
++ * http://raspberrypi.org
++ *
++ * Copyright (C) 2015 Raspberry Pi
++ *
++ * Author: Serge Schneider
++ *
++ *  This program is free software; you can redistribute  it and/or modify it
++ *  under  the terms of  the GNU General  Public License as published by the
++ *  Free Software Foundation;  either version 2 of the  License, or (at your
++ *  option) any later version.
++ *
++ */
++
++#include <linux/module.h>
++
++#include <linux/mfd/rpisense/joystick.h>
++#include <linux/mfd/rpisense/core.h>
++
++static struct rpisense *rpisense;
++static unsigned char keymap[5] = {KEY_DOWN, KEY_RIGHT, KEY_UP, KEY_ENTER, KEY_LEFT,};
++
++static void keys_work_fn(struct work_struct *work)
++{
++	int i;
++	static s32 prev_keys;
++	struct rpisense_js *rpisense_js = &rpisense->joystick;
++	s32 keys = rpisense_reg_read(rpisense, RPISENSE_KEYS);
++	s32 changes = keys ^ prev_keys;
++
++	prev_keys = keys;
++	for (i = 0; i < 5; i++) {
++		if (changes & 1) {
++			input_report_key(rpisense_js->keys_dev,
++					 keymap[i], keys & 1);
++		}
++		changes >>= 1;
++		keys >>= 1;
++	}
++	input_sync(rpisense_js->keys_dev);
++}
++
++static irqreturn_t keys_irq_handler(int irq, void *pdev)
++{
++	struct rpisense_js *rpisense_js = &rpisense->joystick;
++
++	schedule_work(&rpisense_js->keys_work_s);
++	return IRQ_HANDLED;
++}
++
++static int rpisense_js_probe(struct platform_device *pdev)
++{
++	int ret;
++	int i;
++	struct rpisense_js *rpisense_js;
++
++	rpisense = rpisense_get_dev();
++	rpisense_js = &rpisense->joystick;
++
++	INIT_WORK(&rpisense_js->keys_work_s, keys_work_fn);
++
++	rpisense_js->keys_dev = input_allocate_device();
++	if (!rpisense_js->keys_dev) {
++		dev_err(&pdev->dev, "Could not allocate input device.\n");
++		return -ENOMEM;
++	}
++
++	rpisense_js->keys_dev->evbit[0] = BIT_MASK(EV_KEY);
++	for (i = 0; i < ARRAY_SIZE(keymap); i++) {
++		set_bit(keymap[i],
++			rpisense_js->keys_dev->keybit);
++	}
++
++	rpisense_js->keys_dev->name = "Raspberry Pi Sense HAT Joystick";
++	rpisense_js->keys_dev->phys = "rpi-sense-joy/input0";
++	rpisense_js->keys_dev->id.bustype = BUS_I2C;
++	rpisense_js->keys_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP);
++	rpisense_js->keys_dev->keycode = keymap;
++	rpisense_js->keys_dev->keycodesize = sizeof(unsigned char);
++	rpisense_js->keys_dev->keycodemax = ARRAY_SIZE(keymap);
++
++	ret = input_register_device(rpisense_js->keys_dev);
++	if (ret) {
++		dev_err(&pdev->dev, "Could not register input device.\n");
++		goto err_keys_alloc;
++	}
++
++	ret = gpiod_direction_input(rpisense_js->keys_desc);
++	if (ret) {
++		dev_err(&pdev->dev, "Could not set keys-int direction.\n");
++		goto err_keys_reg;
++	}
++
++	rpisense_js->keys_irq = gpiod_to_irq(rpisense_js->keys_desc);
++	if (rpisense_js->keys_irq < 0) {
++		dev_err(&pdev->dev, "Could not determine keys-int IRQ.\n");
++		ret = rpisense_js->keys_irq;
++		goto err_keys_reg;
++	}
++
++	ret = devm_request_irq(&pdev->dev, rpisense_js->keys_irq,
++			       keys_irq_handler, IRQF_TRIGGER_RISING,
++			       "keys", &pdev->dev);
++	if (ret) {
++		dev_err(&pdev->dev, "IRQ request failed.\n");
++		goto err_keys_reg;
++	}
++	return 0;
++err_keys_reg:
++	input_unregister_device(rpisense_js->keys_dev);
++err_keys_alloc:
++	input_free_device(rpisense_js->keys_dev);
++	return ret;
++}
++
++static int rpisense_js_remove(struct platform_device *pdev)
++{
++	struct rpisense_js *rpisense_js = &rpisense->joystick;
++
++	input_unregister_device(rpisense_js->keys_dev);
++	input_free_device(rpisense_js->keys_dev);
++	return 0;
++}
++
++#ifdef CONFIG_OF
++static const struct of_device_id rpisense_js_id[] = {
++	{ .compatible = "rpi,rpi-sense-js" },
++	{ },
++};
++MODULE_DEVICE_TABLE(of, rpisense_js_id);
++#endif
++
++static struct platform_device_id rpisense_js_device_id[] = {
++	{ .name = "rpi-sense-js" },
++	{ },
++};
++MODULE_DEVICE_TABLE(platform, rpisense_js_device_id);
++
++static struct platform_driver rpisense_js_driver = {
++	.probe = rpisense_js_probe,
++	.remove = rpisense_js_remove,
++	.driver = {
++		.name = "rpi-sense-js",
++		.owner = THIS_MODULE,
++	},
++};
++
++module_platform_driver(rpisense_js_driver);
++
++MODULE_DESCRIPTION("Raspberry Pi Sense HAT joystick driver");
++MODULE_AUTHOR("Serge Schneider <serge@raspberrypi.org>");
++MODULE_LICENSE("GPL");
+--- a/drivers/mfd/Kconfig
++++ b/drivers/mfd/Kconfig
+@@ -11,6 +11,14 @@ config MFD_CORE
+ 	select IRQ_DOMAIN
+ 	default n
+ 
++config MFD_RPISENSE_CORE
++	tristate "Raspberry Pi Sense HAT core functions"
++	depends on I2C
++	select MFD_CORE
++	help
++	  This is the core driver for the Raspberry Pi Sense HAT. This provides
++	  the necessary functions to communicate with the hardware.
++
+ config MFD_CS5535
+ 	tristate "AMD CS5535 and CS5536 southbridge core functions"
+ 	select MFD_CORE
+--- a/drivers/mfd/Makefile
++++ b/drivers/mfd/Makefile
+@@ -268,6 +268,7 @@ obj-$(CONFIG_MFD_STMFX) 	+= stmfx.o
+ obj-$(CONFIG_MFD_KHADAS_MCU) 	+= khadas-mcu.o
+ obj-$(CONFIG_MFD_ACER_A500_EC)	+= acer-ec-a500.o
+ obj-$(CONFIG_MFD_QCOM_PM8008)	+= qcom-pm8008.o
++obj-$(CONFIG_MFD_RPISENSE_CORE)	+= rpisense-core.o
+ 
+ obj-$(CONFIG_SGI_MFD_IOC3)	+= ioc3.o
+ obj-$(CONFIG_MFD_SIMPLE_MFD_I2C)	+= simple-mfd-i2c.o
+--- /dev/null
++++ b/drivers/mfd/rpisense-core.c
+@@ -0,0 +1,164 @@
++/*
++ * Raspberry Pi Sense HAT core driver
++ * http://raspberrypi.org
++ *
++ * Copyright (C) 2015 Raspberry Pi
++ *
++ * Author: Serge Schneider
++ *
++ *  This program is free software; you can redistribute  it and/or modify it
++ *  under  the terms of  the GNU General  Public License as published by the
++ *  Free Software Foundation;  either version 2 of the  License, or (at your
++ *  option) any later version.
++ *
++ *  This driver is based on wm8350 implementation.
++ */
++
++#include <linux/module.h>
++#include <linux/moduleparam.h>
++#include <linux/err.h>
++#include <linux/init.h>
++#include <linux/i2c.h>
++#include <linux/platform_device.h>
++#include <linux/mfd/rpisense/core.h>
++#include <linux/slab.h>
++
++static struct rpisense *rpisense;
++
++static void rpisense_client_dev_register(struct rpisense *rpisense,
++					 const char *name,
++					 struct platform_device **pdev)
++{
++	int ret;
++
++	*pdev = platform_device_alloc(name, -1);
++	if (*pdev == NULL) {
++		dev_err(rpisense->dev, "Failed to allocate %s\n", name);
++		return;
++	}
++
++	(*pdev)->dev.parent = rpisense->dev;
++	platform_set_drvdata(*pdev, rpisense);
++	ret = platform_device_add(*pdev);
++	if (ret != 0) {
++		dev_err(rpisense->dev, "Failed to register %s: %d\n",
++			name, ret);
++		platform_device_put(*pdev);
++		*pdev = NULL;
++	}
++}
++
++static int rpisense_probe(struct i2c_client *i2c,
++			       const struct i2c_device_id *id)
++{
++	int ret;
++	struct rpisense_js *rpisense_js;
++
++	rpisense = devm_kzalloc(&i2c->dev, sizeof(struct rpisense), GFP_KERNEL);
++	if (rpisense == NULL)
++		return -ENOMEM;
++
++	i2c_set_clientdata(i2c, rpisense);
++	rpisense->dev = &i2c->dev;
++	rpisense->i2c_client = i2c;
++
++	ret = rpisense_reg_read(rpisense, RPISENSE_WAI);
++	if (ret > 0) {
++		if (ret != 's')
++			return -EINVAL;
++	} else {
++		return ret;
++	}
++	ret = rpisense_reg_read(rpisense, RPISENSE_VER);
++	if (ret < 0)
++		return ret;
++
++	dev_info(rpisense->dev,
++		 "Raspberry Pi Sense HAT firmware version %i\n", ret);
++
++	rpisense_js = &rpisense->joystick;
++	rpisense_js->keys_desc = devm_gpiod_get(&i2c->dev,
++						"keys-int", GPIOD_IN);
++	if (IS_ERR(rpisense_js->keys_desc)) {
++		dev_warn(&i2c->dev, "Failed to get keys-int descriptor.\n");
++		rpisense_js->keys_desc = gpio_to_desc(23);
++		if (rpisense_js->keys_desc == NULL) {
++			dev_err(&i2c->dev, "GPIO23 fallback failed.\n");
++			return PTR_ERR(rpisense_js->keys_desc);
++		}
++	}
++	rpisense_client_dev_register(rpisense, "rpi-sense-js",
++				     &(rpisense->joystick.pdev));
++	rpisense_client_dev_register(rpisense, "rpi-sense-fb",
++				     &(rpisense->framebuffer.pdev));
++
++	return 0;
++}
++
++static void rpisense_remove(struct i2c_client *i2c)
++{
++	struct rpisense *rpisense = i2c_get_clientdata(i2c);
++
++	platform_device_unregister(rpisense->joystick.pdev);
++}
++
++struct rpisense *rpisense_get_dev(void)
++{
++	return rpisense;
++}
++EXPORT_SYMBOL_GPL(rpisense_get_dev);
++
++s32 rpisense_reg_read(struct rpisense *rpisense, int reg)
++{
++	int ret = i2c_smbus_read_byte_data(rpisense->i2c_client, reg);
++
++	if (ret < 0)
++		dev_err(rpisense->dev, "Read from reg %d failed\n", reg);
++	/* Due to the BCM270x I2C clock stretching bug, some values
++	 * may have MSB set. Clear it to avoid incorrect values.
++	 * */
++	return ret & 0x7F;
++}
++EXPORT_SYMBOL_GPL(rpisense_reg_read);
++
++int rpisense_block_write(struct rpisense *rpisense, const char *buf, int count)
++{
++	int ret = i2c_master_send(rpisense->i2c_client, buf, count);
++
++	if (ret < 0)
++		dev_err(rpisense->dev, "Block write failed\n");
++	return ret;
++}
++EXPORT_SYMBOL_GPL(rpisense_block_write);
++
++static const struct i2c_device_id rpisense_i2c_id[] = {
++	{ "rpi-sense", 0 },
++	{ }
++};
++MODULE_DEVICE_TABLE(i2c, rpisense_i2c_id);
++
++#ifdef CONFIG_OF
++static const struct of_device_id rpisense_core_id[] = {
++	{ .compatible = "rpi,rpi-sense" },
++	{ },
++};
++MODULE_DEVICE_TABLE(of, rpisense_core_id);
++#endif
++
++
++static struct i2c_driver rpisense_driver = {
++	.driver = {
++		   .name = "rpi-sense",
++		   .owner = THIS_MODULE,
++	},
++	.probe = rpisense_probe,
++	.remove = rpisense_remove,
++	.id_table = rpisense_i2c_id,
++};
++
++module_i2c_driver(rpisense_driver);
++
++MODULE_DESCRIPTION("Raspberry Pi Sense HAT core driver");
++MODULE_AUTHOR("Serge Schneider <serge@raspberrypi.org>");
++MODULE_LICENSE("GPL");
++
+--- a/drivers/video/fbdev/Kconfig
++++ b/drivers/video/fbdev/Kconfig
+@@ -2251,6 +2251,19 @@ config FB_SM712
+ 	  called sm712fb. If you want to compile it as a module, say M
+ 	  here and read <file:Documentation/kbuild/modules.rst>.
+ 
++config FB_RPISENSE
++	tristate "Raspberry Pi Sense HAT framebuffer"
++	depends on FB
++	select MFD_RPISENSE_CORE
++	select FB_SYS_FOPS
++	select FB_SYS_FILLRECT
++	select FB_SYS_COPYAREA
++	select FB_SYS_IMAGEBLIT
++	select FB_DEFERRED_IO
++
++	help
++	  This is the framebuffer driver for the Raspberry Pi Sense HAT
++
+ source "drivers/video/fbdev/omap/Kconfig"
+ source "drivers/video/fbdev/omap2/Kconfig"
+ source "drivers/video/fbdev/mmp/Kconfig"
+--- a/drivers/video/fbdev/Makefile
++++ b/drivers/video/fbdev/Makefile
+@@ -130,6 +130,7 @@ obj-$(CONFIG_FB_MX3)		  += mx3fb.o
+ obj-$(CONFIG_FB_DA8XX)		  += da8xx-fb.o
+ obj-$(CONFIG_FB_SSD1307)	  += ssd1307fb.o
+ obj-$(CONFIG_FB_SIMPLE)           += simplefb.o
++obj-$(CONFIG_FB_RPISENSE)	  += rpisense-fb.o
+ 
+ # the test framebuffer is last
+ obj-$(CONFIG_FB_VIRTUAL)          += vfb.o
+--- /dev/null
++++ b/drivers/video/fbdev/rpisense-fb.c
+@@ -0,0 +1,293 @@
++/*
++ * Raspberry Pi Sense HAT framebuffer driver
++ * http://raspberrypi.org
++ *
++ * Copyright (C) 2015 Raspberry Pi
++ *
++ * Author: Serge Schneider
++ *
++ *  This program is free software; you can redistribute  it and/or modify it
++ *  under  the terms of  the GNU General  Public License as published by the
++ *  Free Software Foundation;  either version 2 of the  License, or (at your
++ *  option) any later version.
++ *
++ */
++
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/errno.h>
++#include <linux/string.h>
++#include <linux/mm.h>
++#include <linux/slab.h>
++#include <linux/uaccess.h>
++#include <linux/delay.h>
++#include <linux/fb.h>
++#include <linux/init.h>
++
++#include <linux/mfd/rpisense/framebuffer.h>
++#include <linux/mfd/rpisense/core.h>
++
++static bool lowlight;
++module_param(lowlight, bool, 0);
++MODULE_PARM_DESC(lowlight, "Reduce LED matrix brightness to one third");
++
++static struct rpisense *rpisense;
++
++struct rpisense_fb_param {
++	char __iomem *vmem;
++	u8 *vmem_work;
++	u32 vmemsize;
++	u8 *gamma;
++};
++
++static u8 gamma_default[32] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01,
++			       0x02, 0x02, 0x03, 0x03, 0x04, 0x05, 0x06, 0x07,
++			       0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0E, 0x0F, 0x11,
++			       0x12, 0x14, 0x15, 0x17, 0x19, 0x1B, 0x1D, 0x1F,};
++
++static u8 gamma_low[32] = {0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
++			   0x01, 0x01, 0x01, 0x01, 0x01, 0x02, 0x02, 0x02,
++			   0x03, 0x03, 0x03, 0x04, 0x04, 0x05, 0x05, 0x06,
++			   0x06, 0x07, 0x07, 0x08, 0x08, 0x09, 0x0A, 0x0A,};
++
++static u8 gamma_user[32];
++
++static struct rpisense_fb_param rpisense_fb_param = {
++	.vmem = NULL,
++	.vmemsize = 128,
++	.gamma = gamma_default,
++};
++
++static struct fb_deferred_io rpisense_fb_defio;
++
++static struct fb_fix_screeninfo rpisense_fb_fix = {
++	.id =		"RPi-Sense FB",
++	.type =		FB_TYPE_PACKED_PIXELS,
++	.visual =	FB_VISUAL_TRUECOLOR,
++	.xpanstep =	0,
++	.ypanstep =	0,
++	.ywrapstep =	0,
++	.accel =	FB_ACCEL_NONE,
++	.line_length =	16,
++};
++
++static struct fb_var_screeninfo rpisense_fb_var = {
++	.xres		= 8,
++	.yres		= 8,
++	.xres_virtual	= 8,
++	.yres_virtual	= 8,
++	.bits_per_pixel = 16,
++	.red		= {11, 5, 0},
++	.green		= {5, 6, 0},
++	.blue		= {0, 5, 0},
++};
++
++static ssize_t rpisense_fb_write(struct fb_info *info,
++				 const char __user *buf, size_t count,
++				 loff_t *ppos)
++{
++	ssize_t res = fb_sys_write(info, buf, count, ppos);
++
++	schedule_delayed_work(&info->deferred_work, rpisense_fb_defio.delay);
++	return res;
++}
++
++static void rpisense_fb_fillrect(struct fb_info *info,
++				 const struct fb_fillrect *rect)
++{
++	sys_fillrect(info, rect);
++	schedule_delayed_work(&info->deferred_work, rpisense_fb_defio.delay);
++}
++
++static void rpisense_fb_copyarea(struct fb_info *info,
++				 const struct fb_copyarea *area)
++{
++	sys_copyarea(info, area);
++	schedule_delayed_work(&info->deferred_work, rpisense_fb_defio.delay);
++}
++
++static void rpisense_fb_imageblit(struct fb_info *info,
++				  const struct fb_image *image)
++{
++	sys_imageblit(info, image);
++	schedule_delayed_work(&info->deferred_work, rpisense_fb_defio.delay);
++}
++
++static void rpisense_fb_deferred_io(struct fb_info *info,
++				struct list_head *pagelist)
++{
++	int i;
++	int j;
++	u8 *vmem_work = rpisense_fb_param.vmem_work;
++	u16 *mem = (u16 *)rpisense_fb_param.vmem;
++	u8 *gamma = rpisense_fb_param.gamma;
++
++	vmem_work[0] = 0;
++	for (j = 0; j < 8; j++) {
++		for (i = 0; i < 8; i++) {
++			vmem_work[(j * 24) + i + 1] =
++				gamma[(mem[(j * 8) + i] >> 11) & 0x1F];
++			vmem_work[(j * 24) + (i + 8) + 1] =
++				gamma[(mem[(j * 8) + i] >> 6) & 0x1F];
++			vmem_work[(j * 24) + (i + 16) + 1] =
++				gamma[(mem[(j * 8) + i]) & 0x1F];
++		}
++	}
++	rpisense_block_write(rpisense, vmem_work, 193);
++}
++
++static struct fb_deferred_io rpisense_fb_defio = {
++	.delay		= HZ/100,
++	.deferred_io	= rpisense_fb_deferred_io,
++};
++
++static int rpisense_fb_ioctl(struct fb_info *info, unsigned int cmd,
++			     unsigned long arg)
++{
++	switch (cmd) {
++	case SENSEFB_FBIOGET_GAMMA:
++		if (copy_to_user((void __user *) arg, rpisense_fb_param.gamma,
++				 sizeof(u8[32])))
++			return -EFAULT;
++		return 0;
++	case SENSEFB_FBIOSET_GAMMA:
++		if (copy_from_user(gamma_user, (void __user *)arg,
++				   sizeof(u8[32])))
++			return -EFAULT;
++		rpisense_fb_param.gamma = gamma_user;
++		schedule_delayed_work(&info->deferred_work,
++				      rpisense_fb_defio.delay);
++		return 0;
++	case SENSEFB_FBIORESET_GAMMA:
++		switch (arg) {
++		case 0:
++			rpisense_fb_param.gamma = gamma_default;
++			break;
++		case 1:
++			rpisense_fb_param.gamma = gamma_low;
++			break;
++		case 2:
++			rpisense_fb_param.gamma = gamma_user;
++			break;
++		default:
++			return -EINVAL;
++		}
++		schedule_delayed_work(&info->deferred_work,
++				      rpisense_fb_defio.delay);
++		break;
++	default:
++		return -EINVAL;
++	}
++	return 0;
++}
++
++static struct fb_ops rpisense_fb_ops = {
++	.owner		= THIS_MODULE,
++	.fb_read	= fb_sys_read,
++	.fb_write	= rpisense_fb_write,
++	.fb_fillrect	= rpisense_fb_fillrect,
++	.fb_copyarea	= rpisense_fb_copyarea,
++	.fb_imageblit	= rpisense_fb_imageblit,
++	.fb_ioctl	= rpisense_fb_ioctl,
++};
++
++static int rpisense_fb_probe(struct platform_device *pdev)
++{
++	struct fb_info *info;
++	int ret = -ENOMEM;
++	struct rpisense_fb *rpisense_fb;
++
++	rpisense = rpisense_get_dev();
++	rpisense_fb = &rpisense->framebuffer;
++
++	rpisense_fb_param.vmem = vzalloc(rpisense_fb_param.vmemsize);
++	if (!rpisense_fb_param.vmem)
++		return ret;
++
++	rpisense_fb_param.vmem_work = devm_kmalloc(&pdev->dev, 193, GFP_KERNEL);
++	if (!rpisense_fb_param.vmem_work)
++		goto err_malloc;
++
++	info = framebuffer_alloc(0, &pdev->dev);
++	if (!info) {
++		dev_err(&pdev->dev, "Could not allocate framebuffer.\n");
++		goto err_malloc;
++	}
++	rpisense_fb->info = info;
++
++	rpisense_fb_fix.smem_start = (unsigned long)rpisense_fb_param.vmem;
++	rpisense_fb_fix.smem_len = rpisense_fb_param.vmemsize;
++
++	info->fbops = &rpisense_fb_ops;
++	info->fix = rpisense_fb_fix;
++	info->var = rpisense_fb_var;
++	info->fbdefio = &rpisense_fb_defio;
++	info->flags = FBINFO_FLAG_DEFAULT | FBINFO_VIRTFB;
++	info->screen_base = rpisense_fb_param.vmem;
++	info->screen_size = rpisense_fb_param.vmemsize;
++
++	if (lowlight)
++		rpisense_fb_param.gamma = gamma_low;
++
++	fb_deferred_io_init(info);
++
++	ret = register_framebuffer(info);
++	if (ret < 0) {
++		dev_err(&pdev->dev, "Could not register framebuffer.\n");
++		goto err_fballoc;
++	}
++
++	fb_info(info, "%s frame buffer device\n", info->fix.id);
++	schedule_delayed_work(&info->deferred_work, rpisense_fb_defio.delay);
++	return 0;
++err_fballoc:
++	framebuffer_release(info);
++err_malloc:
++	vfree(rpisense_fb_param.vmem);
++	return ret;
++}
++
++static int rpisense_fb_remove(struct platform_device *pdev)
++{
++	struct rpisense_fb *rpisense_fb = &rpisense->framebuffer;
++	struct fb_info *info = rpisense_fb->info;
++
++	if (info) {
++		unregister_framebuffer(info);
++		fb_deferred_io_cleanup(info);
++		framebuffer_release(info);
++		vfree(rpisense_fb_param.vmem);
++	}
++
++	return 0;
++}
++
++#ifdef CONFIG_OF
++static const struct of_device_id rpisense_fb_id[] = {
++	{ .compatible = "rpi,rpi-sense-fb" },
++	{ },
++};
++MODULE_DEVICE_TABLE(of, rpisense_fb_id);
++#endif
++
++static struct platform_device_id rpisense_fb_device_id[] = {
++	{ .name = "rpi-sense-fb" },
++	{ },
++};
++MODULE_DEVICE_TABLE(platform, rpisense_fb_device_id);
++
++static struct platform_driver rpisense_fb_driver = {
++	.probe = rpisense_fb_probe,
++	.remove = rpisense_fb_remove,
++	.driver = {
++		.name = "rpi-sense-fb",
++		.owner = THIS_MODULE,
++	},
++};
++
++module_platform_driver(rpisense_fb_driver);
++
++MODULE_DESCRIPTION("Raspberry Pi Sense HAT framebuffer driver");
++MODULE_AUTHOR("Serge Schneider <serge@raspberrypi.org>");
++MODULE_LICENSE("GPL");
++
+--- /dev/null
++++ b/include/linux/mfd/rpisense/core.h
+@@ -0,0 +1,47 @@
++/*
++ * Raspberry Pi Sense HAT core driver
++ * http://raspberrypi.org
++ *
++ * Copyright (C) 2015 Raspberry Pi
++ *
++ * Author: Serge Schneider
++ *
++ *  This program is free software; you can redistribute  it and/or modify it
++ *  under  the terms of  the GNU General  Public License as published by the
++ *  Free Software Foundation;  either version 2 of the  License, or (at your
++ *  option) any later version.
++ *
++ */
++
++#ifndef __LINUX_MFD_RPISENSE_CORE_H_
++#define __LINUX_MFD_RPISENSE_CORE_H_
++
++#include <linux/mfd/rpisense/joystick.h>
++#include <linux/mfd/rpisense/framebuffer.h>
++
++/*
++ * Register values.
++ */
++#define RPISENSE_FB			0x00
++#define RPISENSE_WAI			0xF0
++#define RPISENSE_VER			0xF1
++#define RPISENSE_KEYS			0xF2
++#define RPISENSE_EE_WP			0xF3
++
++#define RPISENSE_ID			's'
++
++struct rpisense {
++	struct device *dev;
++	struct i2c_client *i2c_client;
++
++	/* Client devices */
++	struct rpisense_js joystick;
++	struct rpisense_fb framebuffer;
++};
++
++struct rpisense *rpisense_get_dev(void);
++s32 rpisense_reg_read(struct rpisense *rpisense, int reg);
++int rpisense_reg_write(struct rpisense *rpisense, int reg, u16 val);
++int rpisense_block_write(struct rpisense *rpisense, const char *buf, int count);
++
++#endif
+--- /dev/null
++++ b/include/linux/mfd/rpisense/framebuffer.h
+@@ -0,0 +1,32 @@
++/*
++ * Raspberry Pi Sense HAT framebuffer driver
++ * http://raspberrypi.org
++ *
++ * Copyright (C) 2015 Raspberry Pi
++ *
++ * Author: Serge Schneider
++ *
++ *  This program is free software; you can redistribute  it and/or modify it
++ *  under  the terms of  the GNU General  Public License as published by the
++ *  Free Software Foundation;  either version 2 of the  License, or (at your
++ *  option) any later version.
++ *
++ */
++
++#ifndef __LINUX_RPISENSE_FB_H_
++#define __LINUX_RPISENSE_FB_H_
++
++#define SENSEFB_FBIO_IOC_MAGIC 0xF1
++
++#define SENSEFB_FBIOGET_GAMMA _IO(SENSEFB_FBIO_IOC_MAGIC, 0)
++#define SENSEFB_FBIOSET_GAMMA _IO(SENSEFB_FBIO_IOC_MAGIC, 1)
++#define SENSEFB_FBIORESET_GAMMA _IO(SENSEFB_FBIO_IOC_MAGIC, 2)
++
++struct rpisense;
++
++struct rpisense_fb {
++	struct platform_device *pdev;
++	struct fb_info *info;
++};
++
++#endif
+--- /dev/null
++++ b/include/linux/mfd/rpisense/joystick.h
+@@ -0,0 +1,35 @@
++/*
++ * Raspberry Pi Sense HAT joystick driver
++ * http://raspberrypi.org
++ *
++ * Copyright (C) 2015 Raspberry Pi
++ *
++ * Author: Serge Schneider
++ *
++ *  This program is free software; you can redistribute  it and/or modify it
++ *  under  the terms of  the GNU General  Public License as published by the
++ *  Free Software Foundation;  either version 2 of the  License, or (at your
++ *  option) any later version.
++ *
++ */
++
++#ifndef __LINUX_RPISENSE_JOYSTICK_H_
++#define __LINUX_RPISENSE_JOYSTICK_H_
++
++#include <linux/input.h>
++#include <linux/interrupt.h>
++#include <linux/gpio/consumer.h>
++#include <linux/platform_device.h>
++
++struct rpisense;
++
++struct rpisense_js {
++	struct platform_device *pdev;
++	struct input_dev *keys_dev;
++	struct gpio_desc *keys_desc;
++	struct work_struct keys_work_s;
++	int keys_irq;
++};
++
++
++#endif
diff --git a/target/linux/bcm27xx/patches-6.1/950-0124-Add-support-for-all-the-downstream-rpi-sound-card-dr.patch b/target/linux/bcm27xx/patches-6.1/950-0124-Add-support-for-all-the-downstream-rpi-sound-card-dr.patch
new file mode 100644
index 00000000000000..72ab99d62e5e7b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0124-Add-support-for-all-the-downstream-rpi-sound-card-dr.patch
@@ -0,0 +1,17626 @@
+From c30c73263981026201fc45fcc54d6e58d061b61e Mon Sep 17 00:00:00 2001
+From: Florian Meier <florian.meier@koalo.de>
+Date: Mon, 25 Jan 2016 15:48:59 +0000
+Subject: [PATCH] Add support for all the downstream rpi sound card
+ drivers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+ASoC: Add support for Rpi-DAC
+
+ASoC: Add prompt for ICS43432 codec
+
+Without a prompt string, a config setting can't be included in a
+defconfig. Give CONFIG_SND_SOC_ICS43432 a prompt so that Pi soundcards
+can use the driver.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+Add IQaudIO Sound Card support for Raspberry Pi
+
+Set a limit of 0dB on Digital Volume Control
+
+The main volume control in the PCM512x DAC has a range up to
++24dB. This is dangerously loud and can potentially cause massive
+clipping in the output stages. Therefore this sets a sensible
+limit of 0dB for this control.
+
+Allow up to 24dB digital gain to be applied when using IQAudIO DAC+
+
+24db_digital_gain DT param can be used to specify that PCM512x
+codec "Digital" volume control should not be limited to 0dB gain,
+and if specified will allow the full 24dB gain.
+
+Modify IQAudIO DAC+ ASoC driver to set card/dai config from dt
+
+Add the ability to set the card name, dai name and dai stream name, from
+dt config.
+
+Signed-off-by: DigitalDreamtime <clive.messer@digitaldreamtime.co.uk>
+
+IQaudIO: auto-mute for AMP+ and DigiAMP+
+
+IQAudIO amplifier mute via GPIO22. Add dt params for "one-shot" unmute
+and auto mute.
+
+Revision 2, auto mute implementing HiassofT suggestion to mute/unmute
+using set_bias_level, rather than startup/shutdown....
+"By default DAPM waits 5 seconds (pmdown_time) before shutting down
+playback streams so a close/stop immediately followed by open/start
+doesn't trigger an amp mute+unmute."
+
+Tested on both AMP+ (via DAC+) and DigiAMP+, with both options...
+
+dtoverlay=iqaudio-dacplus,unmute_amp
+ "one-shot" unmute when kernel module loads.
+
+dtoverlay=iqaudio-dacplus,auto_mute_amp
+ Unmute amp when ALSA device opened by a client. Mute, with 5 second delay
+ when ALSA device closed. (Re-opening the device within the 5 second close
+ window, will cancel mute.)
+
+Revision 4, using gpiod.
+
+Revision 5, clean-up formatting before adding mute code.
+ - Convert tab plus 4 space formatting to 2x tab
+ - Remove '// NOT USED' commented code
+
+Revision 6, don't attempt to "one-shot" unmute amp, unless card is
+successfully registered.
+
+Signed-off-by: DigitalDreamtime <clive.messer@digitaldreamtime.co.uk>
+
+ASoC: iqaudio-dac: fix S24_LE format
+
+Remove set_bclk_ratio call so 24-bit data is transmitted in
+24 bclk cycles.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: iqaudio-dac: use modern dai_link style
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+Added support for HiFiBerry DAC+
+
+The driver is based on the HiFiBerry DAC driver. However HiFiBerry DAC+ uses
+a different codec chip (PCM5122), therefore a new driver is necessary.
+
+Add support for the HiFiBerry DAC+ Pro.
+
+The HiFiBerry DAC+ and DAC+ Pro products both use the existing bcm sound driver with the DAC+ Pro having a special clock device driver representing the two high precision oscillators.
+
+An addition bug fix is included for the PCM512x codec where by the physical size of the sample frame is used in the calculation of the LRCK divisor as it was found to be wrong when using 24-bit depth sample contained in a little endian 4-byte sample frame.
+
+Limit PCM512x "Digital" gain to 0dB by default with HiFiBerry DAC+
+
+24db_digital_gain DT param can be used to specify that PCM512x
+codec "Digital" volume control should not be limited to 0dB gain,
+and if specified will allow the full 24dB gain.
+
+Add dt param to force HiFiBerry DAC+ Pro into slave mode
+
+"dtoverlay=hifiberry-dacplus,slave"
+
+Add 'slave' param to use HiFiBerry DAC+ Pro in slave mode,
+with Pi as master for bit and frame clock.
+
+Signed-off-by: DigitalDreamtime <clive.messer@digitaldreamtime.co.uk>
+
+Fixed a bug when using 352.8kHz sample rate
+
+Signed-off-by: Daniel Matuschek <daniel@hifiberry.com>
+
+ASoC: pcm512x: revert downstream changes
+
+This partially reverts commit 185ea05465aac8bf02a0d2b2f4289d42c72870b7
+which was added by https://github.com/raspberrypi/linux/pull/1152
+
+The downstream pcm512x changes caused a regression, it broke normal
+use of the 24bit format with the codec, eg when using simple-audio-card.
+
+The actual bug with 24bit playback is the incorrect usage
+of physical_width in various drivers in the downstream tree
+which causes 24bit data to be transmitted with 32 clock
+cycles. So it's not the pcm512x that needs fixing, it's the
+soundcard drivers.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: hifiberry_dacplus: fix S24_LE format
+
+Remove set_bclk_ratio call so 24-bit data is transmitted in
+24 bclk cycles.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: hifiberry_dacplus: transmit S24_LE with 64 BCLK cycles
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+hifiberry_dacplus: switch to snd_soc_dai_set_bclk_ratio
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: hifiberry_dacplus: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Add driver for rpi-proto
+
+Forward port of 3.10.x driver from https://github.com/koalo
+We are using a custom board and would like to use rpi 3.18.x
+kernel. Patch works fine for our embedded system.
+
+URL to the audio chip:
+http://www.mikroe.com/add-on-boards/audio-voice/audio-codec-proto/
+
+Playback tested with devicetree enabled.
+
+Signed-off-by: Waldemar Brodkorb <wbrodkorb@conet.de>
+
+ASoC: rpi-proto: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Add Support for JustBoom Audio boards
+
+justboom-dac: Adjust for ALSA API change
+
+As of 4.4, snd_soc_limit_volume now takes a struct snd_soc_card *
+rather than a struct snd_soc_codec *.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+ASoC: justboom-dac: fix S24_LE format
+
+Remove set_bclk_ratio call so 24-bit data is transmitted in
+24 bclk cycles.
+
+Also remove hw_params as it's no longer needed.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: justboom-dac: use modern dai_link style
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+New AudioInjector.net Pi soundcard with low jitter audio in and out.
+
+Contains the sound/soc/bcm ALSA machine driver and necessary alterations to the Kconfig and Makefile.
+Adds the dts overlay and updates the Makefile and README.
+Updates the relevant defconfig files to enable building for the Raspberry Pi.
+Thanks to Phil Elwell (pelwell) for the review, simple-card concepts and discussion. Thanks to Clive Messer for overlay naming suggestions.
+
+Added support for headphones, microphone and bclk_ratio settings.
+
+This patch adds headphone and microphone capability to the Audio Injector sound card. The patch also sets the bit clock ratio for use in the bcm2835-i2s driver. The bcm2835-i2s can't handle an 8 kHz sample rate when the bit clock is at 12 MHz because its register is only 10 bits wide which can't represent the ch2 offset of 1508. For that reason, the rate constraint is added.
+
+ASoC: audioinjector-pi-soundcard: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+New driver for RRA DigiDAC1 soundcard using WM8741 + WM8804
+
+ASoC: digidac1-soundcard: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Add support for Dion Audio LOCO DAC-AMP HAT
+
+Using dedicated machine driver and pcm5102a codec driver.
+
+Signed-off-by: DigitalDreamtime <clive.messer@digitaldreamtime.co.uk>
+
+ASoC: dionaudio_loco: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Allo Piano DAC boards: Initial 2 channel (stereo) support (#1645)
+
+Add initial 2 channel (stereo) support for Allo Piano DAC (2.0/2.1) boards,
+using allo-piano-dac-pcm512x-audio overlay and allo-piano-dac ALSA ASoC
+machine driver.
+
+NB. The initial support is 2 channel (stereo) ONLY!
+(The Piano DAC 2.1 will only support 2 channel (stereo) left/right output,
+ pending an update to the upstream pcm512x codec driver, which will have
+ to be submitted via upstream. With the initial downstream support,
+ provided by this patch, the Piano DAC 2.1 subwoofer outputs will
+ not function.)
+
+Signed-off-by: Baswaraj K <jaikumar@cem-solutions.net>
+Signed-off-by: Clive Messer <clive.messer@digitaldreamtime.co.uk>
+Tested-by: Clive Messer <clive.messer@digitaldreamtime.co.uk>
+
+ASoC: allo-piano-dac: fix S24_LE format
+
+Remove set_bclk_ratio call so 24-bit data is transmitted in
+24 bclk cycles.
+
+Also remove hw_params and ops as they are no longer needed.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: allo-piano-dac: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Add support for Allo Piano DAC 2.1 plus add-on board for Raspberry Pi.
+
+The Piano DAC 2.1 has support for 4 channels with subwoofer.
+
+Signed-off-by: Baswaraj K <jaikumar@cem-solutions.net>
+Reviewed-by: Vijay Kumar B. <vijaykumar@zilogic.com>
+Reviewed-by: Raashid Muhammed <raashidmuhammed@zilogic.com>
+
+Add clock changes and mute gpios (#1938)
+
+Also improve code style and adhere to ALSA coding conventions.
+
+Signed-off-by: Baswaraj K <jaikumar@cem-solutions.net>
+Reviewed-by: Vijay Kumar B. <vijaykumar@zilogic.com>
+Reviewed-by: Raashid Muhammed <raashidmuhammed@zilogic.com>
+
+PianoPlus: Dual Mono & Dual Stereo features added (#2069)
+
+allo-piano-dac-plus: Master volume added + fixes
+
+Master volume added, which controls both DACs volumes.
+
+See: https://github.com/raspberrypi/linux/pull/2149
+
+Also fix initial max volume, default mode value, and unmute.
+
+Signed-off-by: allocom <sparky-dev@allo.com>
+
+ASoC: allo-piano-dac-plus: fix S24_LE format
+
+Remove set_bclk_ratio call so 24-bit data is transmitted in
+24 bclk cycles.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+sound: bcm: Fix memset dereference warning
+
+This warning appears with GCC 6.4.0 from toolchains.bootlin.com:
+
+../sound/soc/bcm/allo-piano-dac-plus.c: In function ‘snd_allo_piano_dac_init’:
+../sound/soc/bcm/allo-piano-dac-plus.c:711:30: warning: argument to ‘sizeof’ in ‘memset’ call is the same expression as the destination; did you mean to dereference it? [-Wsizeof-pointer-memaccess]
+  memset(glb_ptr, 0x00, sizeof(glb_ptr));
+                              ^
+
+Suggested-by: Phil Elwell <phil@raspberrypi.org>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+
+ASoC: allo-piano-dac-plus: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Add support for Allo Boss DAC add-on board for Raspberry Pi. (#1924)
+
+Signed-off-by: Baswaraj K <jaikumar@cem-solutions.net>
+Reviewed-by: Deepak <deepak@zilogic.com>
+Reviewed-by: BabuSubashChandar <babusubashchandar@zilogic.com>
+
+Add support for new clock rate and mute gpios.
+
+Signed-off-by: Baswaraj K <jaikumar@cem-solutions.net>
+Reviewed-by: Deepak <deepak@zilogic.com>
+Reviewed-by: BabuSubashChandar <babusubashchandar@zilogic.com>
+
+ASoC: allo-boss-dac: fix S24_LE format
+
+Remove set_bclk_ratio call so 24-bit data is transmitted in
+24 bclk cycles.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: allo-boss-dac: transmit S24_LE with 64 BCLK cycles
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+allo-boss-dac: switch to snd_soc_dai_set_bclk_ratio
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: allo-boss-dac: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Support for Blokas Labs pisound board
+
+Pisound dynamic overlay (#1760)
+
+Restructuring pisound-overlay.dts, so it can be loaded and unloaded dynamically using dtoverlay.
+
+Print a logline when the kernel module is removed.
+
+pisound improvements:
+
+* Added a writable sysfs object to enable scripts / user space software
+to blink MIDI activity LEDs for variable duration.
+* Improved hw_param constraints setting.
+* Added compatibility with S16_LE sample format.
+* Exposed some simple placeholder volume controls, so the card appears
+in volumealsa widget.
+
+Add missing SND_PISOUND selects dependency to SND_RAWMIDI
+
+Without it the Pisound module fails to compile.
+See https://github.com/raspberrypi/linux/issues/2366
+
+Updates for Pisound module code:
+
+	* Merged 'Fix a warning in DEBUG builds' (1c8b82b).
+	* Updating some strings and copyright information.
+	* Fix for handling high load of MIDI input and output.
+	* Use dual rate oversampling ratio for 96kHz instead of single
+	  rate one.
+
+Signed-off-by: Giedrius Trainavicius <giedrius@blokas.io>
+
+Fixing memset call in pisound.c
+
+Signed-off-by: Giedrius Trainavicius <giedrius@blokas.io>
+
+Fix for Pisound's MIDI Input getting blocked for a while in rare cases.
+
+There was a possible race condition which could lead to Input's FIFO queue
+to be underflown, causing high amount of processing in the worker thread for
+some period of time.
+
+Signed-off-by: Giedrius Trainavicius <giedrius@blokas.io>
+
+Fix for Pisound kernel module in Real Time kernel configuration.
+
+When handler of data_available interrupt is fired, queue_work ends up
+getting called and it can block on a spin lock which is not allowed in
+interrupt context. The fix was to run the handler from a thread context
+instead.
+
+Pisound: Remove spinlock usage around spi_sync
+
+ASoC: pisound: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+ASoC: pisound: fix the parameter for spi_device_match
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+ASoC: Add driver for Cirrus Logic Audio Card
+
+Note: due to problems with deferred probing of regulators
+the following softdep should be added to a modprobe.d file
+
+softdep arizona-spi pre: arizona-ldo1
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: rpi-cirrus: use modern dai_link style
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+sound: Support for Dion Audio LOCO-V2 DAC-AMP HAT
+
+Signed-off-by: Miquel Blauw <info@dionaudio.nl>
+
+ASoC: dionaudio_loco-v2: fix S24_LE format
+
+Remove set_bclk_ratio call so 24-bit data is transmitted in
+24 bclk cycles.
+
+Also remove hw_params and ops as they are no longer needed.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: dionaudio_loco-v2: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Add support for Fe-Pi audio sound card. (#1867)
+
+Fe-Pi Audio Sound Card is based on NXP SGTL5000 codec.
+Mechanical specification of the board is the same the Raspberry Pi Zero.
+3.5mm jacks for Headphone/Mic, Line In, and Line Out.
+
+Signed-off-by: Henry Kupis <fe-pi@cox.net>
+
+ASoC: fe-pi-audio: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Add support for the AudioInjector.net Octo sound card
+
+AudioInjector Octo: sample rates, regulators, reset
+
+This patch adds new sample rates to the Audioinjector Octo sound card. The
+new supported rates are (in kHz) :
+96, 48, 32, 24, 16, 8, 88.2, 44.1, 29.4, 22.05, 14.7
+
+Reference the bcm270x DT regulators in the overlay.
+
+This patch adds a reset GPIO for the AudioInjector.net octo sound card.
+
+Audioinjector octo : Make the playback and capture symmetric
+
+This patch ensures that the sample rate and channel count of the audioinjector
+octo sound card are symmetric.
+
+audioinjector-octo: Add continuous clock feature
+
+By user request, add a switch to prevent the clocks being stopped when
+the stream is paused, stopped or shutdown. Provide access to the switch
+by adding a 'non-stop-clocks' parameter to the audioinjector-addons
+overlay.
+
+See: https://github.com/raspberrypi/linux/issues/2409
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+sound: Fixes for audioinjector-octo under 4.19
+
+1. Move the DT alias declaration to the I2C shim in the cases
+where the shim is enabled. This works around a problem caused by a
+4.19 commit [1] that generates DT/OF uevents for I2C drivers.
+
+2. Fix the diagnostics in an error path of the soundcard driver to
+correctly identify the reason for the failure to load.
+
+3. Move the declaration of the clock node in the overlay outside
+the I2C node to avoid warnings.
+
+4. Sort the overlay nodes so that dependencies are only to earlier
+fragments, in an attempt to get runtime dtoverlay application to
+work (it still doesn't...)
+
+See: https://github.com/Audio-Injector/Octo/issues/14
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+[1] af503716ac14 ("i2c: core: report OF style module alias for devices registered via OF")
+
+ASoC: audioinjector-octo-soundcard: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Driver support for Google voiceHAT soundcard.
+
+ASoC: googlevoicehat-codec: Use correct device when grabbing GPIO
+
+The fixup for the VoiceHAT in 4.18 incorrectly tried to find the
+sdmode GPIO pin under the card device, not the codec device.
+This failed, and therefore caused the device probe to fail.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+ASoC: googlevoicehat-codec: Reformat for kernel coding standards
+
+Fix all whitespace, indentation, and bracing errors.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+ASoC: googlevoicehat-codec: Make driver function structure const
+
+Make voicehat_component_driver a const structure.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+ASoC: googlevoicehat-codec: Only convert from ms to jiffies once
+
+Minor optimisation and allows to become checkpatch clean.
+A msec value is read out of DT or from a define, and convert once to
+jiffies, rather than every time that it is used.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+Driver and overlay for Allo Katana DAC
+
+Allo Katana DAC: Updated default values
+
+Signed-off-by: Jaikumar <jaikumar@cem-solutions.com>
+
+Added mute stream func
+
+Signed-off-by: Jaikumar <jaikumar@cem-solutions.net>
+
+codecs: Correct Katana minimum volume
+
+Update Katana minimum volume to get the exact 0.5 dB value in each step.
+
+Signed-off-by: Sudeep Kumar <sudeepkumar@cem-solutions.net>
+
+ASoC: Add generic RPI driver for simple soundcards.
+
+The RPI simple sound card driver provides a generic ALSA SOC card driver
+supporting a variety of Pi HAT soundcards. The intention is to avoid
+the duplication of code for cards that can't be fully supported by
+the soc simple/graph cards but are otherwise almost identical.
+
+This initial commit adds support for the ADAU1977 ADC, Google VoiceHat,
+HifiBerry AMP, HifiBerry DAC and RPI DAC.
+
+Signed-off-by: Tim Gover <tim.gover@raspberrypi.org>
+
+ASoC: Use correct card name in rpi-simple driver
+
+Use the specific card name from drvdata instead of the snd_rpi_simple
+
+rpi-simple-soundcard: Use nicer driver name "RPi-simple"
+
+Rename the driver from "RPI simple soundcard" to "RPi-simple" so that
+the driver name won't be mangled allowing to be used unaltered as the
+card conf filename.
+
+ASoC: rpi-simple-soundcard: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+ASoC: Add Kconfig and Makefile for sound/soc/bcm
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+
+ASoC: Create a generic Pi Hat WM8804 driver
+
+Reduce the amount of duplicated code by creating a generic driver for
+Pi Hat digi cards using the WM8804 codec.
+
+This replaces the
+Allo DigiOne, Hifiberry Digi/Pro, JustBoom Digi and IQAudIO Digi
+dedicate soundcard drivers with a generic driver.
+
+There are no significant changes to the runtime behavior of the drivers
+and end users should not have to change any configuration settings
+after upgrading.
+
+Minor changes
+* Check the return value of snd_soc_component_update_bits
+* Added some pr_debug tracing
+* Various checkpatch tidyups
+* Updated allodigi-one to use use 128FS at > 96 Khz. This appears to
+  be an omission in the original driver code so followed the Hifiberry
+  DAC driver approach.
+
+ASoC: rpi-wm8804-soundcard: use modern dai_link style
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+rpi-wm8804-soundcard: drop PWRDN register writes
+
+Since kernel 4.0 the PWRDN register bits are under DAPM
+control from the wm8804 driver.
+
+Drop code that modifies that register to avoid interfering
+with DAPM.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+rpi-wm8804-soundcard: configure wm8804 clocks only on rate change
+
+This should avoid clicks when stopping and immediately afterwards
+starting a stream with the same samplerate as before.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+rpi-wm8804-soundcard: Fixed MCLKDIV for Allo Digione
+
+The Allo Digione board wants a fixed MCLKDIV of 256.
+
+See: https://github.com/raspberrypi/linux/issues/3296
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+ASoC: Add support for AudioSense-Pi add-on soundcard
+
+AudioSense-Pi is a RPi HAT based on a TI's TLV320AIC32x4 stereo codec
+
+This hardware provides multiple audio I/O capabilities to the RPi.
+The codec connects to the RPi's SoC through the I2S Bus.
+
+The following devices can be connected through a 3.5mm jack
+	1. Line-In: Plain old audio in from mobile phones, PCs, etc.,
+	2. Mic-In: Connect a microphone
+	3. Line-Out: Connect the output to a speaker
+	4. Headphones: Connect a Headphone w or w/o microphones
+
+Multiple Inputs:
+	It supports the following combinations
+	1. Two stereo Line-Inputs and a microphone
+	2. One stereo Line-Input and two microphones
+	3. Two stereo Line-Inputs, a microphone and
+		one mono line-input (with h/w hack)
+	4. One stereo Line-Input, two microphones and
+		one mono line-input (with h/w hack)
+
+Multiple Outputs:
+	Audio output can be routed to the headphones or
+		speakers (with additional hardware)
+
+Signed-off-by: b-ak <anur.bhargav@gmail.com>
+
+ASoC: audiosense-pi: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Added driver for the HiFiBerry DAC+ ADC (#2694)
+
+Signed-off-by: Daniel Matuschek <daniel@hifiberry.com>
+
+hifiberry_dacplusadc: switch to snd_soc_dai_set_bclk_ratio
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: hifiberry_dacplusadc: fix DAI link setup
+
+The driver only defines a single DAI link and the code that tries
+to setup the second (non-existent) DAI link looks wrong - using dmic
+as a CPU/platform driver doesn't make any sense.
+
+The DT overlay doesn't define a dmic property, so the code was never
+executed (otherwise it would have resulted in a memory corruption).
+
+So drop the offending code to prevent issues if a dmic property
+should be added to the DT overlay.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: hifiberry_dacplusadc: use modern dai_link style
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+Audiophonics I-Sabre 9038Q2M DAC driver
+
+Signed-off-by: Audiophonics <contact@audiophonics.fr>
+
+ASoC: i-sabre-q2m: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Added IQaudIO Pi-Codec board support (#2969)
+
+Add support for the IQaudIO Pi-Codec board.
+
+Signed-off-by: Gordon <gordon@iqaudio.com>
+
+Fixed 48k timing issue
+
+ASoC: iqaudio-codec: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+adds the Hifiberry DAC+ADC PRO version
+
+This adds the driver for the DAC+ADC PRO version of the Hifiberry soundcard with software controlled PCM1863 ADC
+Signed-off-by: Joerg Schambacher joerg@i2audio.com
+
+Add Hifiberry DAC+DSP soundcard driver (#3224)
+
+Adds the driver for the Hifiberry DAC+DSP. It supports capture and
+playback depending on the DSP firmware.
+
+Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
+
+Allow simultaneous use of JustBoom DAC and Digi
+
+Signed-off-by: Johannes Krude <johannes@krude.de>
+
+Pisound: MIDI communication fixes for scaled down CPU.
+
+* Increased maximum SPI communication speed to avoid running too slow
+  when the CPU is scaled down and losing MIDI data.
+
+* Keep track of buffer usage in millibytes for higher precision.
+
+Signed-off-by: Giedrius Trainavičius <giedrius@blokas.io>
+
+sound: Add the HiFiBerry DAC+HD version
+
+This adds the driver for the DAC+HD version supporting HiFiBerry's
+PCM179x based DACs. It also adds PLL control for clock generation.
+
+Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
+
+Fix master mode settings of HiFiBerry DAC+ADC PRO card (#3424)
+
+This patch fixes the board DAI setting when in master-mode.
+Wrong setting could have caused random pop noise.
+
+Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
+
+adds LED OFF feature to HiFiBerry DAC+ADC PRO sound card
+
+This adds a DT overlay parameter 'leds_off' which allows
+to switch off the onboard activity LEDs at all times
+which has been requested by some users.
+
+Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
+
+adds LED OFF feature to HiFiBerry DAC+ADC sound card
+
+This adds a DT overlay parameter 'leds_off' which allows
+to switch off the onboard activity LEDs at all times
+which has been requested by some users.
+
+Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
+
+adds LED OFF feature to HiFiBerry DAC+/DAC+PRO sound cards
+
+This adds a DT overlay parameter 'leds_off' which allows
+to switch off the onboard activity LEDs at all times
+which has been requested by some users.
+
+Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
+
+pisound: Added reading Pisound board hardware revision and exposing it (#3425)
+
+pisound: Added reading Pisound board hardware revision and exposing it in kernel log and sysfs file:
+
+/sys/kernel/pisound/hw_version
+
+Signed-off-by: Giedrius <giedrius@blokas.io>
+
+Added driver for HiFiBerry Amp amplifier add-on board
+
+The driver contains a low-level hardware driver for the TAS5713 and the
+drivers for the Raspberry Pi I2S subsystem.
+
+TAS5713: return error if initialisation fails
+
+Existing TAS5713 driver logs errors during initialisation, but does not return
+an error code. Therefore even if initialisation fails, the driver will still be
+loaded, but won't work. This patch fixes this. I2C communication error will now
+reported correctly by a non-zero return code.
+
+HiFiBerry Amp: fix device-tree problems
+
+Some code to load the driver based on device-tree-overlays was missing. This is added by this patch.
+
+According to 5713 pdf doc CLOCK_CTRL is a readonly status register, and it behaves so. Remove useless setting
+
+sound: pcm512x-codec: Adding 352.8kHz samplerate support
+
+sound/soc: only first codec is master in multicodec setup
+
+When using multiple codecs, at most one codec should generate the master
+clock. All codecs except the first are therefore configured for slave
+mode.
+
+Signed-off-by: Johannes Krude <johannes@krude.de>
+
+ASoC: Fix snd_soc_get_pcm_runtime usage
+
+Commit [1] changed the snd_soc_get_pcm_runtime to take a dai_link
+pointer instead of a string. Patch up the downstream drivers to use
+the modified API.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+[1] 4468189ff307 ("ASoC: soc-core: find rtd via dai_link pointer at snd_soc_get_pcm_runtime()")
+
+Add support for the AudioInjector.net Isolated sound card
+
+This patch adds support for the Audio Injector Isolated sound card.
+
+Signed-off-by: Matt Flax <flatmax@flatmax.org>
+
+Add support for merus-amp soundcard and ma120x0p codec
+
+Add 96KHz rate support to MA120X0P codec and make enable and mute gpio
+pins optional.
+
+Signed-off-by: AMuszkat <ariel.muszkat@gmail.com>
+
+Fixes a problem with clock settings of HiFiBerry DAC+ADC PRO (#3545)
+
+This patch fixes a problem of the re-calculation of
+i2s-clock and -parameter settings when only the ADC is activated.
+
+Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
+
+configs: Enable the AD193x codecs
+
+See: https://github.com/raspberrypi/linux/issues/2850
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+Switch to snd_soc_dai_set_bclk_ratio
+Replaces obsolete function snd_soc_dai_set_tdm_slot
+
+Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
+
+Enhances the DAC+ driver to control the optional headphone amplifier
+
+Probes on the I2C bus for TPA6130A2, if successful, it sets DT-parameter
+'status' from 'disabled' to 'okay' using change_sets to enable
+the headphone control.
+
+Signed-off-by: Joerg Schambacher joerg@i2audio.com
+
+Update Allo Piano Dac Driver
+
+Add unique names to the individual dac coded drivers
+Remove some of the codec controls that are not used.
+
+Signed-off-by: Paul Hermann <paul@picoreplayer.org>
+
+Fixes an onboard clock detection problem of the PRO versions
+
+Increasing the sleep time after clock selection to 3-4ms
+allows the correct detection of all combinations of DAC+ Pro
+and DAC+ADC Pro sound cards and the various PI revisions.
+
+Signed-off-by: Joerg Schambacher <joerg@hifiberry.com>
+
+ASoC:ma120x0p: Increase maximum sample rate to 192KHz
+
+Change the maximum sample rate for the amplifier to
+192KHz as given in the Infineon specification.
+
+Signed-off-by: Joerg Schambacher <joerg@hifiberry.com>
+
+ASoC: ma120x0p: Remove unnecessary const specifier
+
+Clang warns:
+
+  sound/soc/codecs/ma120x0p.c:891:14: warning: duplicate 'const' declaration specifier [-Wduplicate-decl-specifier]
+  static const SOC_VALUE_ENUM_SINGLE_DECL(pwr_mode_ctrl,
+               ^
+  ./include/sound/soc.h:362:2: note: expanded from macro 'SOC_VALUE_ENUM_SINGLE_DECL'
+          SOC_VALUE_ENUM_DOUBLE_DECL(name, xreg, xshift, xshift, xmask, xtexts, xvalues)
+          ^
+  ./include/sound/soc.h:359:2: note: expanded from macro 'SOC_VALUE_ENUM_DOUBLE_DECL'
+          const struct soc_enum name = SOC_VALUE_ENUM_DOUBLE(xreg, xshift_l, xshift_r, xmask, \
+          ^
+  1 warning generated.
+
+SOC_VALUE_ENUM_DOUBLE_DECL already has a const specifier. Remove the duplicate
+const to clean up the warning.
+
+Fixes: 42444979e710 ("Add support for all the downstream rpi sound card drivers")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+
+ASoC: bcm: allo-piano-dac-plus: Remove unnecessary const specifiers
+
+Clang warns:
+
+  sound/soc/bcm/allo-piano-dac-plus.c:66:14: warning: duplicate 'const' declaration specifier [-Wduplicate-decl-specifier]
+  static const SOC_ENUM_SINGLE_DECL(allo_piano_mode_enum,
+               ^
+  ./include/sound/soc.h:355:2: note: expanded from macro 'SOC_ENUM_SINGLE_DECL'
+          SOC_ENUM_DOUBLE_DECL(name, xreg, xshift, xshift, xtexts)
+          ^
+  ./include/sound/soc.h:352:2: note: expanded from macro 'SOC_ENUM_DOUBLE_DECL'
+          const struct soc_enum name = SOC_ENUM_DOUBLE(xreg, xshift_l, xshift_r, \
+          ^
+  sound/soc/bcm/allo-piano-dac-plus.c:75:14: warning: duplicate 'const' declaration specifier [-Wduplicate-decl-specifier]
+  static const SOC_ENUM_SINGLE_DECL(allo_piano_dual_mode_enum,
+               ^
+  ./include/sound/soc.h:355:2: note: expanded from macro 'SOC_ENUM_SINGLE_DECL'
+          SOC_ENUM_DOUBLE_DECL(name, xreg, xshift, xshift, xtexts)
+          ^
+  ./include/sound/soc.h:352:2: note: expanded from macro 'SOC_ENUM_DOUBLE_DECL'
+          const struct soc_enum name = SOC_ENUM_DOUBLE(xreg, xshift_l, xshift_r, \
+          ^
+  sound/soc/bcm/allo-piano-dac-plus.c:96:14: warning: duplicate 'const' declaration specifier [-Wduplicate-decl-specifier]
+  static const SOC_ENUM_SINGLE_DECL(allo_piano_enum,
+               ^
+  ./include/sound/soc.h:355:2: note: expanded from macro 'SOC_ENUM_SINGLE_DECL'
+          SOC_ENUM_DOUBLE_DECL(name, xreg, xshift, xshift, xtexts)
+          ^
+  ./include/sound/soc.h:352:2: note: expanded from macro 'SOC_ENUM_DOUBLE_DECL'
+          const struct soc_enum name = SOC_ENUM_DOUBLE(xreg, xshift_l, xshift_r, \
+          ^
+  3 warnings generated.
+
+SOC_VALUE_ENUM_DOUBLE_DECL already has a const specifier. Remove the duplicate
+const specifiers to clean up the warnings.
+
+Fixes: 42444979e710 ("Add support for all the downstream rpi sound card drivers")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+
+rpi-simple-soundcard: Add Dion Audio KIWI streamer
+
+Signed-off-by: Miquel Blauw <miquelblauw@hotmail.com>
+
+rpi-simple-soundcard: adds definitions for the HiFiBerry AMP3 card
+
+Uses Infineon MA120x0 amplifier and supports full sample rate of 192ksps.
+
+Signed-off-by: Joerg Schambacher <joerg@hifiberry.com>
+
+sound: soc: bcm: Added Sound card driver for Dacberry400 Audio card for Raspberry Pi 400
+
+Added Sound card driver for DACberry400 Audio card.
+
+Signed-off-by: Ashish Vara <ashishhvara@gmail.com>
+---
+ .../devicetree/bindings/vendor-prefixes.txt   |  463 ++++++
+ .../devicetree/bindings/vendor-prefixes.yaml  |    2 +
+ drivers/clk/Kconfig                           |    6 +
+ drivers/clk/Makefile                          |    3 +
+ drivers/clk/clk-allo-dac.c                    |  161 ++
+ drivers/clk/clk-hifiberry-dachd.c             |  332 ++++
+ drivers/clk/clk-hifiberry-dacpro.c            |  160 ++
+ sound/soc/bcm/Kconfig                         |  305 ++++
+ sound/soc/bcm/Makefile                        |   71 +-
+ sound/soc/bcm/allo-boss-dac.c                 |  457 ++++++
+ sound/soc/bcm/allo-boss2-dac.c                | 1131 ++++++++++++++
+ sound/soc/bcm/allo-katana-codec.c             |  387 +++++
+ sound/soc/bcm/allo-piano-dac-plus.c           | 1064 +++++++++++++
+ sound/soc/bcm/allo-piano-dac.c                |  122 ++
+ .../bcm/audioinjector-isolated-soundcard.c    |  183 +++
+ sound/soc/bcm/audioinjector-octo-soundcard.c  |  346 +++++
+ sound/soc/bcm/audioinjector-pi-soundcard.c    |  189 +++
+ sound/soc/bcm/audiosense-pi.c                 |  248 +++
+ sound/soc/bcm/chipdip-dac.c                   |  275 ++++
+ sound/soc/bcm/dacberry400.c                   |  259 ++++
+ sound/soc/bcm/digidac1-soundcard.c            |  421 +++++
+ sound/soc/bcm/dionaudio_loco-v2.c             |  117 ++
+ sound/soc/bcm/dionaudio_loco.c                |  117 ++
+ sound/soc/bcm/fe-pi-audio.c                   |  154 ++
+ sound/soc/bcm/googlevoicehat-codec.c          |  214 +++
+ sound/soc/bcm/hifiberry_dacplus.c             |  527 +++++++
+ sound/soc/bcm/hifiberry_dacplusadc.c          |  398 +++++
+ sound/soc/bcm/hifiberry_dacplusadcpro.c       |  605 ++++++++
+ sound/soc/bcm/hifiberry_dacplusdsp.c          |   90 ++
+ sound/soc/bcm/hifiberry_dacplushd.c           |  238 +++
+ sound/soc/bcm/i-sabre-q2m.c                   |  159 ++
+ sound/soc/bcm/iqaudio-codec.c                 |  275 ++++
+ sound/soc/bcm/iqaudio-dac.c                   |  224 +++
+ sound/soc/bcm/justboom-both.c                 |  267 ++++
+ sound/soc/bcm/justboom-dac.c                  |  147 ++
+ sound/soc/bcm/pifi-40.c                       |  284 ++++
+ sound/soc/bcm/pisound.c                       | 1241 +++++++++++++++
+ sound/soc/bcm/rpi-cirrus.c                    | 1025 ++++++++++++
+ sound/soc/bcm/rpi-proto.c                     |  147 ++
+ sound/soc/bcm/rpi-simple-soundcard.c          |  487 ++++++
+ sound/soc/bcm/rpi-wm8804-soundcard.c          |  410 +++++
+ sound/soc/codecs/Kconfig                      |   26 +-
+ sound/soc/codecs/Makefile                     |    8 +
+ sound/soc/codecs/cs42xx8-i2c.c                |    9 +-
+ sound/soc/codecs/cs42xx8.c                    |    2 +
+ sound/soc/codecs/i-sabre-codec.c              |  390 +++++
+ sound/soc/codecs/i-sabre-codec.h              |   42 +
+ sound/soc/codecs/ma120x0p.c                   | 1381 +++++++++++++++++
+ sound/soc/codecs/pcm1794a.c                   |   69 +
+ sound/soc/codecs/pcm512x.c                    |    2 +-
+ sound/soc/codecs/tas5713.c                    |  361 +++++
+ sound/soc/codecs/tas5713.h                    |  210 +++
+ sound/soc/soc-core.c                          |   10 +-
+ sound/usb/card.c                              |    8 +-
+ sound/usb/quirks.c                            |    2 +
+ 55 files changed, 16224 insertions(+), 7 deletions(-)
+ create mode 100644 Documentation/devicetree/bindings/vendor-prefixes.txt
+ create mode 100644 drivers/clk/clk-allo-dac.c
+ create mode 100644 drivers/clk/clk-hifiberry-dachd.c
+ create mode 100644 drivers/clk/clk-hifiberry-dacpro.c
+ create mode 100644 sound/soc/bcm/allo-boss-dac.c
+ create mode 100644 sound/soc/bcm/allo-boss2-dac.c
+ create mode 100644 sound/soc/bcm/allo-katana-codec.c
+ create mode 100644 sound/soc/bcm/allo-piano-dac-plus.c
+ create mode 100644 sound/soc/bcm/allo-piano-dac.c
+ create mode 100644 sound/soc/bcm/audioinjector-isolated-soundcard.c
+ create mode 100644 sound/soc/bcm/audioinjector-octo-soundcard.c
+ create mode 100644 sound/soc/bcm/audioinjector-pi-soundcard.c
+ create mode 100644 sound/soc/bcm/audiosense-pi.c
+ create mode 100644 sound/soc/bcm/chipdip-dac.c
+ create mode 100644 sound/soc/bcm/dacberry400.c
+ create mode 100644 sound/soc/bcm/digidac1-soundcard.c
+ create mode 100644 sound/soc/bcm/dionaudio_loco-v2.c
+ create mode 100644 sound/soc/bcm/dionaudio_loco.c
+ create mode 100644 sound/soc/bcm/fe-pi-audio.c
+ create mode 100644 sound/soc/bcm/googlevoicehat-codec.c
+ create mode 100644 sound/soc/bcm/hifiberry_dacplus.c
+ create mode 100644 sound/soc/bcm/hifiberry_dacplusadc.c
+ create mode 100644 sound/soc/bcm/hifiberry_dacplusadcpro.c
+ create mode 100644 sound/soc/bcm/hifiberry_dacplusdsp.c
+ create mode 100644 sound/soc/bcm/hifiberry_dacplushd.c
+ create mode 100644 sound/soc/bcm/i-sabre-q2m.c
+ create mode 100644 sound/soc/bcm/iqaudio-codec.c
+ create mode 100644 sound/soc/bcm/iqaudio-dac.c
+ create mode 100644 sound/soc/bcm/justboom-both.c
+ create mode 100644 sound/soc/bcm/justboom-dac.c
+ create mode 100644 sound/soc/bcm/pifi-40.c
+ create mode 100644 sound/soc/bcm/pisound.c
+ create mode 100644 sound/soc/bcm/rpi-cirrus.c
+ create mode 100644 sound/soc/bcm/rpi-proto.c
+ create mode 100644 sound/soc/bcm/rpi-simple-soundcard.c
+ create mode 100644 sound/soc/bcm/rpi-wm8804-soundcard.c
+ create mode 100644 sound/soc/codecs/i-sabre-codec.c
+ create mode 100644 sound/soc/codecs/i-sabre-codec.h
+ create mode 100644 sound/soc/codecs/ma120x0p.c
+ create mode 100644 sound/soc/codecs/pcm1794a.c
+ create mode 100644 sound/soc/codecs/tas5713.c
+ create mode 100644 sound/soc/codecs/tas5713.h
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
+@@ -0,0 +1,463 @@
++Device tree binding vendor prefix registry.  Keep list in alphabetical order.
++
++This isn't an exhaustive list, but you should add new prefixes to it before
++using them to avoid name-space collisions.
++
++abilis	Abilis Systems
++abracon	Abracon Corporation
++actions	Actions Semiconductor Co., Ltd.
++active-semi	Active-Semi International Inc
++ad	Avionic Design GmbH
++adafruit	Adafruit Industries, LLC
++adapteva	Adapteva, Inc.
++adaptrum	Adaptrum, Inc.
++adh	AD Holdings Plc.
++adi	Analog Devices, Inc.
++advantech	Advantech Corporation
++aeroflexgaisler	Aeroflex Gaisler AB
++al	Annapurna Labs
++allo	Allo.com
++allwinner	Allwinner Technology Co., Ltd.
++alphascale	AlphaScale Integrated Circuits Systems, Inc.
++altr	Altera Corp.
++amarula	Amarula Solutions
++amazon	Amazon.com, Inc.
++amcc	Applied Micro Circuits Corporation (APM, formally AMCC)
++amd	Advanced Micro Devices (AMD), Inc.
++amediatech	Shenzhen Amediatech Technology Co., Ltd
++amlogic	Amlogic, Inc.
++ampire	Ampire Co., Ltd.
++ams	AMS AG
++amstaos	AMS-Taos Inc.
++analogix	Analogix Semiconductor, Inc.
++andestech	Andes Technology Corporation
++apm	Applied Micro Circuits Corporation (APM)
++aptina	Aptina Imaging
++arasan	Arasan Chip Systems
++archermind ArcherMind Technology (Nanjing) Co., Ltd.
++arctic	Arctic Sand
++aries	Aries Embedded GmbH
++arm	ARM Ltd.
++armadeus	ARMadeus Systems SARL
++arrow	Arrow Electronics
++artesyn	Artesyn Embedded Technologies Inc.
++asahi-kasei	Asahi Kasei Corp.
++aspeed	ASPEED Technology Inc.
++asus	AsusTek Computer Inc.
++atlas	Atlas Scientific LLC
++atmel	Atmel Corporation
++auo	AU Optronics Corporation
++auvidea Auvidea GmbH
++avago	Avago Technologies
++avia	avia semiconductor
++avic	Shanghai AVIC Optoelectronics Co., Ltd.
++avnet	Avnet, Inc.
++axentia	Axentia Technologies AB
++axis	Axis Communications AB
++bananapi BIPAI KEJI LIMITED
++bhf	Beckhoff Automation GmbH & Co. KG
++bitmain	Bitmain Technologies
++blokaslabs	Vilniaus Blokas UAB
++boe	BOE Technology Group Co., Ltd.
++bosch	Bosch Sensortec GmbH
++boundary	Boundary Devices Inc.
++brcm	Broadcom Corporation
++buffalo	Buffalo, Inc.
++bticino Bticino International
++calxeda	Calxeda
++capella	Capella Microsystems, Inc
++cascoda	Cascoda, Ltd.
++catalyst	Catalyst Semiconductor, Inc.
++cavium	Cavium, Inc.
++cdns	Cadence Design Systems Inc.
++cdtech	CDTech(H.K.) Electronics Limited
++ceva	Ceva, Inc.
++chipidea	Chipidea, Inc
++chipone		ChipOne
++chipspark	ChipSPARK
++chrp	Common Hardware Reference Platform
++chunghwa	Chunghwa Picture Tubes Ltd.
++ciaa	Computadora Industrial Abierta Argentina
++cirrus	Cirrus Logic, Inc.
++cloudengines	Cloud Engines, Inc.
++cnm	Chips&Media, Inc.
++cnxt	Conexant Systems, Inc.
++compulab	CompuLab Ltd.
++cortina	Cortina Systems, Inc.
++cosmic	Cosmic Circuits
++crane	Crane Connectivity Solutions
++creative	Creative Technology Ltd
++crystalfontz	Crystalfontz America, Inc.
++csky	Hangzhou C-SKY Microsystems Co., Ltd
++cubietech	Cubietech, Ltd.
++cypress	Cypress Semiconductor Corporation
++cznic	CZ.NIC, z.s.p.o.
++dallas	Maxim Integrated Products (formerly Dallas Semiconductor)
++dataimage	DataImage, Inc.
++davicom	DAVICOM Semiconductor, Inc.
++delta	Delta Electronics, Inc.
++denx	Denx Software Engineering
++devantech	Devantech, Ltd.
++dh	DH electronics GmbH
++digi	Digi International Inc.
++digilent	Diglent, Inc.
++dioo	Dioo Microcircuit Co., Ltd
++dlc	DLC Display Co., Ltd.
++dlg	Dialog Semiconductor
++dlink	D-Link Corporation
++dmo	Data Modul AG
++domintech	Domintech Co., Ltd.
++dongwoon	Dongwoon Anatech
++dptechnics	DPTechnics
++dragino	Dragino Technology Co., Limited
++ea	Embedded Artists AB
++ebs-systart EBS-SYSTART GmbH
++ebv	EBV Elektronik
++eckelmann	Eckelmann AG
++edt	Emerging Display Technologies
++eeti	eGalax_eMPIA Technology Inc
++elan	Elan Microelectronic Corp.
++elgin	Elgin S/A.
++embest	Shenzhen Embest Technology Co., Ltd.
++emlid	Emlid, Ltd.
++emmicro	EM Microelectronic
++emtrion	emtrion GmbH
++endless	Endless Mobile, Inc.
++energymicro	Silicon Laboratories (formerly Energy Micro AS)
++engicam	Engicam S.r.l.
++epcos	EPCOS AG
++epfl	Ecole Polytechnique Fédérale de Lausanne
++epson	Seiko Epson Corp.
++est	ESTeem Wireless Modems
++ettus	NI Ettus Research
++eukrea  Eukréa Electromatique
++everest	Everest Semiconductor Co. Ltd.
++everspin	Everspin Technologies, Inc.
++exar	Exar Corporation
++excito	Excito
++ezchip	EZchip Semiconductor
++facebook	Facebook
++fairphone	Fairphone B.V.
++faraday	Faraday Technology Corporation
++fastrax	Fastrax Oy
++fcs	Fairchild Semiconductor
++feiyang	Shenzhen Fly Young Technology Co.,LTD.
++firefly	Firefly
++focaltech	FocalTech Systems Co.,Ltd
++friendlyarm	Guangzhou FriendlyARM Computer Tech Co., Ltd
++fsl	Freescale Semiconductor
++fujitsu	Fujitsu Ltd.
++gateworks	Gateworks Corporation
++gcw Game Consoles Worldwide
++ge	General Electric Company
++geekbuying	GeekBuying
++gef	GE Fanuc Intelligent Platforms Embedded Systems, Inc.
++GEFanuc	GE Fanuc Intelligent Platforms Embedded Systems, Inc.
++geniatech	Geniatech, Inc.
++giantec	Giantec Semiconductor, Inc.
++giantplus	Giantplus Technology Co., Ltd.
++globalscale	Globalscale Technologies, Inc.
++globaltop	GlobalTop Technology, Inc.
++gmt	Global Mixed-mode Technology, Inc.
++goodix	Shenzhen Huiding Technology Co., Ltd.
++google	Google, Inc.
++grinn	Grinn
++grmn	Garmin Limited
++gumstix	Gumstix, Inc.
++gw	Gateworks Corporation
++hannstar	HannStar Display Corporation
++haoyu	Haoyu Microelectronic Co. Ltd.
++hardkernel	Hardkernel Co., Ltd
++hideep	HiDeep Inc.
++himax	Himax Technologies, Inc.
++hisilicon	Hisilicon Limited.
++hit	Hitachi Ltd.
++hitex	Hitex Development Tools
++holt	Holt Integrated Circuits, Inc.
++honeywell	Honeywell
++hp	Hewlett Packard
++holtek	Holtek Semiconductor, Inc.
++hwacom	HwaCom Systems Inc.
++i2se	I2SE GmbH
++ibm	International Business Machines (IBM)
++icplus	IC Plus Corp.
++idt	Integrated Device Technologies, Inc.
++ifi	Ingenieurburo Fur Ic-Technologie (I/F/I)
++ilitek	ILI Technology Corporation (ILITEK)
++img	Imagination Technologies Ltd.
++infineon Infineon Technologies
++inforce	Inforce Computing
++ingenic	Ingenic Semiconductor
++innolux	Innolux Corporation
++inside-secure	INSIDE Secure
++intel	Intel Corporation
++intercontrol	Inter Control Group
++invensense	InvenSense Inc.
++inversepath	Inverse Path
++iom	Iomega Corporation
++isee	ISEE 2007 S.L.
++isil	Intersil
++issi	Integrated Silicon Solutions Inc.
++itead	ITEAD Intelligent Systems Co.Ltd
++iwave  iWave Systems Technologies Pvt. Ltd.
++jdi	Japan Display Inc.
++jedec	JEDEC Solid State Technology Association
++jianda	Jiandangjing Technology Co., Ltd.
++karo	Ka-Ro electronics GmbH
++keithkoep	Keith & Koep GmbH
++keymile	Keymile GmbH
++khadas	Khadas
++kiebackpeter    Kieback & Peter GmbH
++kinetic Kinetic Technologies
++kingdisplay	King & Display Technology Co., Ltd.
++kingnovel	Kingnovel Technology Co., Ltd.
++koe	Kaohsiung Opto-Electronics Inc.
++kosagi	Sutajio Ko-Usagi PTE Ltd.
++kyo	Kyocera Corporation
++lacie	LaCie
++laird	Laird PLC
++lantiq	Lantiq Semiconductor
++lattice	Lattice Semiconductor
++lego	LEGO Systems A/S
++lemaker	Shenzhen LeMaker Technology Co., Ltd.
++lenovo	Lenovo Group Ltd.
++lg	LG Corporation
++libretech	Shenzhen Libre Technology Co., Ltd
++licheepi	Lichee Pi
++linaro	Linaro Limited
++linksys	Belkin International, Inc. (Linksys)
++linux	Linux-specific binding
++linx	Linx Technologies
++lltc	Linear Technology Corporation
++logicpd	Logic PD, Inc.
++lsi	LSI Corp. (LSI Logic)
++lwn	Liebherr-Werk Nenzing GmbH
++macnica	Macnica Americas
++marvell	Marvell Technology Group Ltd.
++maxim	Maxim Integrated Products
++mbvl	Mobiveil Inc.
++mcube	mCube
++meas	Measurement Specialties
++mediatek	MediaTek Inc.
++megachips	MegaChips
++mele	Shenzhen MeLE Digital Technology Ltd.
++melexis	Melexis N.V.
++melfas	MELFAS Inc.
++mellanox	Mellanox Technologies
++memsic	MEMSIC Inc.
++merrii	Merrii Technology Co., Ltd.
++micrel	Micrel Inc.
++microchip	Microchip Technology Inc.
++microcrystal	Micro Crystal AG
++micron	Micron Technology Inc.
++mikroe		MikroElektronika d.o.o.
++minix	MINIX Technology Ltd.
++miramems	MiraMEMS Sensing Technology Co., Ltd.
++mitsubishi	Mitsubishi Electric Corporation
++mosaixtech	Mosaix Technologies, Inc.
++motorola	Motorola, Inc.
++moxa	Moxa Inc.
++mpl	MPL AG
++mqmaker	mqmaker Inc.
++mscc	Microsemi Corporation
++msi	Micro-Star International Co. Ltd.
++mti	Imagination Technologies Ltd. (formerly MIPS Technologies Inc.)
++multi-inno	Multi-Inno Technology Co.,Ltd
++mundoreader	Mundo Reader S.L.
++murata	Murata Manufacturing Co., Ltd.
++mxicy	Macronix International Co., Ltd.
++myir	MYIR Tech Limited
++national	National Semiconductor
++nec	NEC LCD Technologies, Ltd.
++neonode		Neonode Inc.
++netgear	NETGEAR
++netlogic	Broadcom Corporation (formerly NetLogic Microsystems)
++netron-dy	Netron DY
++netxeon		Shenzhen Netxeon Technology CO., LTD
++nexbox	Nexbox
++nextthing	Next Thing Co.
++newhaven	Newhaven Display International
++ni	National Instruments
++nintendo	Nintendo
++nlt	NLT Technologies, Ltd.
++nokia	Nokia
++nordic	Nordic Semiconductor
++novtech NovTech, Inc.
++nutsboard	NutsBoard
++nuvoton	Nuvoton Technology Corporation
++nvd	New Vision Display
++nvidia	NVIDIA
++nxp	NXP Semiconductors
++okaya	Okaya Electric America, Inc.
++oki	Oki Electric Industry Co., Ltd.
++olimex	OLIMEX Ltd.
++olpc	One Laptop Per Child
++onion	Onion Corporation
++onnn	ON Semiconductor Corp.
++ontat	On Tat Industrial Company
++opalkelly	Opal Kelly Incorporated
++opencores	OpenCores.org
++openrisc	OpenRISC.io
++option	Option NV
++oranth	Shenzhen Oranth Technology Co., Ltd.
++ORCL	Oracle Corporation
++orisetech	Orise Technology
++ortustech	Ortus Technology Co., Ltd.
++ovti	OmniVision Technologies
++oxsemi	Oxford Semiconductor, Ltd.
++panasonic	Panasonic Corporation
++parade	Parade Technologies Inc.
++pda	Precision Design Associates, Inc.
++pericom	Pericom Technology Inc.
++pervasive	Pervasive Displays, Inc.
++phicomm PHICOMM Co., Ltd.
++phytec	PHYTEC Messtechnik GmbH
++picochip	Picochip Ltd
++pine64	Pine64
++pixcir  PIXCIR MICROELECTRONICS Co., Ltd
++plantower Plantower Co., Ltd
++plathome	Plat'Home Co., Ltd.
++plda	PLDA
++plx	Broadcom Corporation (formerly PLX Technology)
++pni	PNI Sensor Corporation
++portwell	Portwell Inc.
++poslab	Poslab Technology Co., Ltd.
++powervr	PowerVR (deprecated, use img)
++probox2	PROBOX2 (by W2COMP Co., Ltd.)
++pulsedlight	PulsedLight, Inc
++qca	Qualcomm Atheros, Inc.
++qcom	Qualcomm Technologies, Inc
++qemu	QEMU, a generic and open source machine emulator and virtualizer
++qi	Qi Hardware
++qiaodian	QiaoDian XianShi Corporation
++qnap	QNAP Systems, Inc.
++radxa	Radxa
++raidsonic	RaidSonic Technology GmbH
++ralink	Mediatek/Ralink Technology Corp.
++ramtron	Ramtron International
++raspberrypi	Raspberry Pi Foundation
++raydium	Raydium Semiconductor Corp.
++rda	Unisoc Communications, Inc.
++realtek Realtek Semiconductor Corp.
++renesas	Renesas Electronics Corporation
++richtek	Richtek Technology Corporation
++ricoh	Ricoh Co. Ltd.
++rikomagic	Rikomagic Tech Corp. Ltd
++riscv	RISC-V Foundation
++rockchip	Fuzhou Rockchip Electronics Co., Ltd
++rohm	ROHM Semiconductor Co., Ltd
++roofull	Shenzhen Roofull Technology Co, Ltd
++samsung	Samsung Semiconductor
++samtec	Samtec/Softing company
++sancloud	Sancloud Ltd
++sandisk	Sandisk Corporation
++sbs	Smart Battery System
++schindler	Schindler
++seagate	Seagate Technology PLC
++semtech	Semtech Corporation
++sensirion	Sensirion AG
++sff	Small Form Factor Committee
++sgd	Solomon Goldentek Display Corporation
++sgx	SGX Sensortech
++sharp	Sharp Corporation
++shimafuji	Shimafuji Electric, Inc.
++si-en	Si-En Technology Ltd.
++sifive	SiFive, Inc.
++sigma	Sigma Designs, Inc.
++sii	Seiko Instruments, Inc.
++sil	Silicon Image
++silabs	Silicon Laboratories
++silead	Silead Inc.
++silergy	Silergy Corp.
++siliconmitus	Silicon Mitus, Inc.
++simtek
++sirf	SiRF Technology, Inc.
++sis	Silicon Integrated Systems Corp.
++sitronix	Sitronix Technology Corporation
++skyworks	Skyworks Solutions, Inc.
++smsc	Standard Microsystems Corporation
++snps	Synopsys, Inc.
++socionext	Socionext Inc.
++solidrun	SolidRun
++solomon        Solomon Systech Limited
++sony	Sony Corporation
++spansion	Spansion Inc.
++sprd	Spreadtrum Communications Inc.
++sst	Silicon Storage Technology, Inc.
++st	STMicroelectronics
++starry	Starry Electronic Technology (ShenZhen) Co., LTD
++startek	Startek
++ste	ST-Ericsson
++stericsson	ST-Ericsson
++summit	Summit microelectronics
++sunchip	Shenzhen Sunchip Technology Co., Ltd
++SUNW	Sun Microsystems, Inc
++swir	Sierra Wireless
++syna	Synaptics Inc.
++synology	Synology, Inc.
++tbs	TBS Technologies
++tbs-biometrics	Touchless Biometric Systems AG
++tcg	Trusted Computing Group
++tcl	Toby Churchill Ltd.
++technexion	TechNexion
++technologic	Technologic Systems
++tempo	Tempo Semiconductor
++techstar	Shenzhen Techstar Electronics Co., Ltd.
++terasic	Terasic Inc.
++thine	THine Electronics, Inc.
++ti	Texas Instruments
++tianma	Tianma Micro-electronics Co., Ltd.
++tlm	Trusted Logic Mobility
++tmt	Tecon Microprocessor Technologies, LLC.
++topeet  Topeet
++toradex	Toradex AG
++toshiba	Toshiba Corporation
++toumaz	Toumaz
++tpk	TPK U.S.A. LLC
++tplink	TP-LINK Technologies Co., Ltd.
++tpo	TPO
++tronfy	Tronfy
++tronsmart	Tronsmart
++truly	Truly Semiconductors Limited
++tsd	Theobroma Systems Design und Consulting GmbH
++tyan	Tyan Computer Corporation
++u-blox	u-blox
++ucrobotics	uCRobotics
++ubnt	Ubiquiti Networks
++udoo	Udoo
++uniwest	United Western Technologies Corp (UniWest)
++upisemi	uPI Semiconductor Corp.
++urt	United Radiant Technology Corporation
++usi	Universal Scientific Industrial Co., Ltd.
++v3	V3 Semiconductor
++vamrs	Vamrs Ltd.
++variscite	Variscite Ltd.
++via	VIA Technologies, Inc.
++virtio	Virtual I/O Device Specification, developed by the OASIS consortium
++vishay	Vishay Intertechnology, Inc
++vitesse	Vitesse Semiconductor Corporation
++vivante	Vivante Corporation
++vocore VoCore Studio
++voipac	Voipac Technologies s.r.o.
++vot	Vision Optical Technology Co., Ltd.
++wd	Western Digital Corp.
++wetek	WeTek Electronics, limited.
++wexler	Wexler
++whwave  Shenzhen whwave Electronics, Inc.
++wi2wi	Wi2Wi, Inc.
++winbond Winbond Electronics corp.
++winstar	Winstar Display Corp.
++wlf	Wolfson Microelectronics
++wm	Wondermedia Technologies, Inc.
++x-powers	X-Powers
++xes	Extreme Engineering Solutions (X-ES)
++xillybus	Xillybus Ltd.
++xlnx	Xilinx
++xunlong	Shenzhen Xunlong Software CO.,Limited
++ysoft	Y Soft Corporation a.s.
++zarlink	Zarlink Semiconductor
++zeitec	ZEITEC Semiconductor Co., LTD.
++zidoo	Shenzhen Zidoo Technology Co., Ltd.
++zii	Zodiac Inflight Innovations
++zte	ZTE Corp.
++zyxel	ZyXEL Communications Corp.
+--- a/Documentation/devicetree/bindings/vendor-prefixes.yaml
++++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml
+@@ -188,6 +188,8 @@ patternProperties:
+     description: Beckhoff Automation GmbH & Co. KG
+   "^bitmain,.*":
+     description: Bitmain Technologies
++  "^blokaslabs,.*":
++    description: Vilniaus Blokas UAB
+   "^blutek,.*":
+     description: BluTek Power
+   "^boe,.*":
+--- a/drivers/clk/Kconfig
++++ b/drivers/clk/Kconfig
+@@ -99,6 +99,12 @@ config COMMON_CLK_HI655X
+ 	  multi-function device has one fixed-rate oscillator, clocked
+ 	  at 32KHz.
+ 
++config COMMON_CLK_HIFIBERRY_DACPLUSHD
++	tristate
++
++config COMMON_CLK_HIFIBERRY_DACPRO
++	tristate
++
+ config COMMON_CLK_SCMI
+ 	tristate "Clock driver controlled via SCMI interface"
+ 	depends on ARM_SCMI_PROTOCOL || COMPILE_TEST
+--- a/drivers/clk/Makefile
++++ b/drivers/clk/Makefile
+@@ -19,6 +19,7 @@ endif
+ 
+ # hardware specific clock types
+ # please keep this section sorted lexicographically by file path name
++obj-$(CONFIG_SND_BCM2708_SOC_ALLO_BOSS_DAC)	+= clk-allo-dac.o
+ obj-$(CONFIG_COMMON_CLK_APPLE_NCO)  	+= clk-apple-nco.o
+ obj-$(CONFIG_MACH_ASM9260)		+= clk-asm9260.o
+ obj-$(CONFIG_COMMON_CLK_AXI_CLKGEN)	+= clk-axi-clkgen.o
+@@ -43,6 +44,8 @@ obj-$(CONFIG_COMMON_CLK_K210)		+= clk-k2
+ obj-$(CONFIG_LMK04832)			+= clk-lmk04832.o
+ obj-$(CONFIG_COMMON_CLK_LAN966X)	+= clk-lan966x.o
+ obj-$(CONFIG_COMMON_CLK_LOCHNAGAR)	+= clk-lochnagar.o
++obj-$(CONFIG_COMMON_CLK_HIFIBERRY_DACPRO)	+= clk-hifiberry-dacpro.o
++obj-$(CONFIG_COMMON_CLK_HIFIBERRY_DACPLUSHD)	+= clk-hifiberry-dachd.o
+ obj-$(CONFIG_COMMON_CLK_MAX77686)	+= clk-max77686.o
+ obj-$(CONFIG_COMMON_CLK_MAX9485)	+= clk-max9485.o
+ obj-$(CONFIG_ARCH_MILBEAUT_M10V)	+= clk-milbeaut.o
+--- /dev/null
++++ b/drivers/clk/clk-allo-dac.c
+@@ -0,0 +1,161 @@
++/*
++ * Clock Driver for Allo DAC
++ *
++ * Author:	Baswaraj K <jaikumar@cem-solutions.net>
++ *		Copyright 2016
++ *		based on code by Stuart MacLean
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/clk-provider.h>
++#include <linux/clkdev.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/slab.h>
++#include <linux/platform_device.h>
++
++/* Clock rate of CLK44EN attached to GPIO6 pin */
++#define CLK_44EN_RATE 45158400UL
++/* Clock rate of CLK48EN attached to GPIO3 pin */
++#define CLK_48EN_RATE 49152000UL
++
++/**
++ * struct allo_dac_clk - Common struct to the Allo DAC
++ * @hw: clk_hw for the common clk framework
++ * @mode: 0 => CLK44EN, 1 => CLK48EN
++ */
++struct clk_allo_hw {
++	struct clk_hw hw;
++	uint8_t mode;
++};
++
++#define to_allo_clk(_hw) container_of(_hw, struct clk_allo_hw, hw)
++
++static const struct of_device_id clk_allo_dac_dt_ids[] = {
++	{ .compatible = "allo,dac-clk",},
++	{ }
++};
++MODULE_DEVICE_TABLE(of, clk_allo_dac_dt_ids);
++
++static unsigned long clk_allo_dac_recalc_rate(struct clk_hw *hw,
++	unsigned long parent_rate)
++{
++	return (to_allo_clk(hw)->mode == 0) ? CLK_44EN_RATE :
++		CLK_48EN_RATE;
++}
++
++static long clk_allo_dac_round_rate(struct clk_hw *hw,
++	unsigned long rate, unsigned long *parent_rate)
++{
++	long actual_rate;
++
++	if (rate <= CLK_44EN_RATE) {
++		actual_rate = (long)CLK_44EN_RATE;
++	} else if (rate >= CLK_48EN_RATE) {
++		actual_rate = (long)CLK_48EN_RATE;
++	} else {
++		long diff44Rate = (long)(rate - CLK_44EN_RATE);
++		long diff48Rate = (long)(CLK_48EN_RATE - rate);
++
++		if (diff44Rate < diff48Rate)
++			actual_rate = (long)CLK_44EN_RATE;
++		else
++			actual_rate = (long)CLK_48EN_RATE;
++	}
++	return actual_rate;
++}
++
++
++static int clk_allo_dac_set_rate(struct clk_hw *hw,
++	unsigned long rate, unsigned long parent_rate)
++{
++	unsigned long actual_rate;
++	struct clk_allo_hw *clk = to_allo_clk(hw);
++
++	actual_rate = (unsigned long)clk_allo_dac_round_rate(hw, rate,
++		&parent_rate);
++	clk->mode = (actual_rate == CLK_44EN_RATE) ? 0 : 1;
++	return 0;
++}
++
++
++const struct clk_ops clk_allo_dac_rate_ops = {
++	.recalc_rate = clk_allo_dac_recalc_rate,
++	.round_rate = clk_allo_dac_round_rate,
++	.set_rate = clk_allo_dac_set_rate,
++};
++
++static int clk_allo_dac_probe(struct platform_device *pdev)
++{
++	int ret;
++	struct clk_allo_hw *proclk;
++	struct clk *clk;
++	struct device *dev;
++	struct clk_init_data init;
++
++	dev = &pdev->dev;
++
++	proclk = kzalloc(sizeof(struct clk_allo_hw), GFP_KERNEL);
++	if (!proclk)
++		return -ENOMEM;
++
++	init.name = "clk-allo-dac";
++	init.ops = &clk_allo_dac_rate_ops;
++	init.flags = 0;
++	init.parent_names = NULL;
++	init.num_parents = 0;
++
++	proclk->mode = 0;
++	proclk->hw.init = &init;
++
++	clk = devm_clk_register(dev, &proclk->hw);
++	if (!IS_ERR(clk)) {
++		ret = of_clk_add_provider(dev->of_node, of_clk_src_simple_get,
++			clk);
++	} else {
++		dev_err(dev, "Fail to register clock driver\n");
++		kfree(proclk);
++		ret = PTR_ERR(clk);
++	}
++	return ret;
++}
++
++static int clk_allo_dac_remove(struct platform_device *pdev)
++{
++	of_clk_del_provider(pdev->dev.of_node);
++	return 0;
++}
++
++static struct platform_driver clk_allo_dac_driver = {
++	.probe = clk_allo_dac_probe,
++	.remove = clk_allo_dac_remove,
++	.driver = {
++		.name = "clk-allo-dac",
++		.of_match_table = clk_allo_dac_dt_ids,
++	},
++};
++
++static int __init clk_allo_dac_init(void)
++{
++	return platform_driver_register(&clk_allo_dac_driver);
++}
++core_initcall(clk_allo_dac_init);
++
++static void __exit clk_allo_dac_exit(void)
++{
++	platform_driver_unregister(&clk_allo_dac_driver);
++}
++module_exit(clk_allo_dac_exit);
++
++MODULE_DESCRIPTION("Allo DAC clock driver");
++MODULE_LICENSE("GPL v2");
++MODULE_ALIAS("platform:clk-allo-dac");
+--- /dev/null
++++ b/drivers/clk/clk-hifiberry-dachd.c
+@@ -0,0 +1,332 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Clock Driver for HiFiBerry DAC+ HD
++ *
++ * Author: Joerg Schambacher, i2Audio GmbH for HiFiBerry
++ *         Copyright 2020
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/clk-provider.h>
++#include <linux/clk.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/slab.h>
++#include <linux/platform_device.h>
++#include <linux/i2c.h>
++#include <linux/regmap.h>
++
++#define NO_PLL_RESET			0
++#define PLL_RESET			1
++#define HIFIBERRY_PLL_MAX_REGISTER	256
++#define DEFAULT_RATE			44100
++
++static struct reg_default hifiberry_pll_reg_defaults[] = {
++	{0x02, 0x53}, {0x03, 0x00}, {0x07, 0x20}, {0x0F, 0x00},
++	{0x10, 0x0D}, {0x11, 0x1D}, {0x12, 0x0D}, {0x13, 0x8C},
++	{0x14, 0x8C}, {0x15, 0x8C}, {0x16, 0x8C}, {0x17, 0x8C},
++	{0x18, 0x2A}, {0x1C, 0x00}, {0x1D, 0x0F}, {0x1F, 0x00},
++	{0x2A, 0x00}, {0x2C, 0x00}, {0x2F, 0x00}, {0x30, 0x00},
++	{0x31, 0x00}, {0x32, 0x00}, {0x34, 0x00}, {0x37, 0x00},
++	{0x38, 0x00}, {0x39, 0x00}, {0x3A, 0x00}, {0x3B, 0x01},
++	{0x3E, 0x00}, {0x3F, 0x00}, {0x40, 0x00}, {0x41, 0x00},
++	{0x5A, 0x00}, {0x5B, 0x00}, {0x95, 0x00}, {0x96, 0x00},
++	{0x97, 0x00}, {0x98, 0x00}, {0x99, 0x00}, {0x9A, 0x00},
++	{0x9B, 0x00}, {0xA2, 0x00}, {0xA3, 0x00}, {0xA4, 0x00},
++	{0xB7, 0x92},
++	{0x1A, 0x3D}, {0x1B, 0x09}, {0x1E, 0xF3}, {0x20, 0x13},
++	{0x21, 0x75}, {0x2B, 0x04}, {0x2D, 0x11}, {0x2E, 0xE0},
++	{0x3D, 0x7A},
++	{0x35, 0x9D}, {0x36, 0x00}, {0x3C, 0x42},
++	{ 177, 0xAC},
++};
++static struct reg_default common_pll_regs[HIFIBERRY_PLL_MAX_REGISTER];
++static int num_common_pll_regs;
++static struct reg_default dedicated_192k_pll_regs[HIFIBERRY_PLL_MAX_REGISTER];
++static int num_dedicated_192k_pll_regs;
++static struct reg_default dedicated_96k_pll_regs[HIFIBERRY_PLL_MAX_REGISTER];
++static int num_dedicated_96k_pll_regs;
++static struct reg_default dedicated_48k_pll_regs[HIFIBERRY_PLL_MAX_REGISTER];
++static int num_dedicated_48k_pll_regs;
++static struct reg_default dedicated_176k4_pll_regs[HIFIBERRY_PLL_MAX_REGISTER];
++static int num_dedicated_176k4_pll_regs;
++static struct reg_default dedicated_88k2_pll_regs[HIFIBERRY_PLL_MAX_REGISTER];
++static int num_dedicated_88k2_pll_regs;
++static struct reg_default dedicated_44k1_pll_regs[HIFIBERRY_PLL_MAX_REGISTER];
++static int num_dedicated_44k1_pll_regs;
++
++/**
++ * struct clk_hifiberry_drvdata - Common struct to the HiFiBerry DAC HD Clk
++ * @hw: clk_hw for the common clk framework
++ */
++struct clk_hifiberry_drvdata {
++	struct regmap *regmap;
++	struct clk *clk;
++	struct clk_hw hw;
++	unsigned long rate;
++};
++
++#define to_hifiberry_clk(_hw) \
++	container_of(_hw, struct clk_hifiberry_drvdata, hw)
++
++static int clk_hifiberry_dachd_write_pll_regs(struct regmap *regmap,
++				struct reg_default *regs,
++				int num, int do_pll_reset)
++{
++	int i;
++	int ret = 0;
++	char pll_soft_reset[] = { 177, 0xAC, };
++
++	for (i = 0; i < num; i++) {
++		ret |= regmap_write(regmap, regs[i].reg, regs[i].def);
++		if (ret)
++			return ret;
++	}
++	if (do_pll_reset) {
++		ret |= regmap_write(regmap, pll_soft_reset[0],
++						pll_soft_reset[1]);
++		mdelay(10);
++	}
++	return ret;
++}
++
++static unsigned long clk_hifiberry_dachd_recalc_rate(struct clk_hw *hw,
++	unsigned long parent_rate)
++{
++	return to_hifiberry_clk(hw)->rate;
++}
++
++static long clk_hifiberry_dachd_round_rate(struct clk_hw *hw,
++	unsigned long rate, unsigned long *parent_rate)
++{
++	return rate;
++}
++
++static int clk_hifiberry_dachd_set_rate(struct clk_hw *hw,
++	unsigned long rate, unsigned long parent_rate)
++{
++	int ret;
++	struct clk_hifiberry_drvdata *drvdata = to_hifiberry_clk(hw);
++
++	switch (rate) {
++	case 44100:
++		ret = clk_hifiberry_dachd_write_pll_regs(drvdata->regmap,
++			dedicated_44k1_pll_regs, num_dedicated_44k1_pll_regs,
++			PLL_RESET);
++		break;
++	case 88200:
++		ret = clk_hifiberry_dachd_write_pll_regs(drvdata->regmap,
++			dedicated_88k2_pll_regs, num_dedicated_88k2_pll_regs,
++			PLL_RESET);
++		break;
++	case 176400:
++		ret = clk_hifiberry_dachd_write_pll_regs(drvdata->regmap,
++			dedicated_176k4_pll_regs, num_dedicated_176k4_pll_regs,
++			PLL_RESET);
++		break;
++	case 48000:
++		ret = clk_hifiberry_dachd_write_pll_regs(drvdata->regmap,
++			dedicated_48k_pll_regs,	num_dedicated_48k_pll_regs,
++			PLL_RESET);
++		break;
++	case 96000:
++		ret = clk_hifiberry_dachd_write_pll_regs(drvdata->regmap,
++			dedicated_96k_pll_regs,	num_dedicated_96k_pll_regs,
++			PLL_RESET);
++		break;
++	case 192000:
++		ret = clk_hifiberry_dachd_write_pll_regs(drvdata->regmap,
++			dedicated_192k_pll_regs, num_dedicated_192k_pll_regs,
++			PLL_RESET);
++		break;
++	default:
++		ret = -EINVAL;
++		break;
++	}
++	to_hifiberry_clk(hw)->rate = rate;
++
++	return ret;
++}
++
++const struct clk_ops clk_hifiberry_dachd_rate_ops = {
++	.recalc_rate = clk_hifiberry_dachd_recalc_rate,
++	.round_rate = clk_hifiberry_dachd_round_rate,
++	.set_rate = clk_hifiberry_dachd_set_rate,
++};
++
++static int clk_hifiberry_get_prop_values(struct device *dev,
++					char *prop_name,
++					struct reg_default *regs)
++{
++	int ret;
++	int i;
++	u8 tmp[2 * HIFIBERRY_PLL_MAX_REGISTER];
++
++	ret = of_property_read_variable_u8_array(dev->of_node, prop_name,
++			tmp, 0, 2 * HIFIBERRY_PLL_MAX_REGISTER);
++	if (ret < 0)
++		return ret;
++	if (ret & 1) {
++		dev_err(dev,
++			"%s <%s> -> #%i odd number of bytes for reg/val pairs!",
++			__func__,
++			prop_name,
++			ret);
++		return -EINVAL;
++	}
++	ret /= 2;
++	for (i = 0; i < ret; i++) {
++		regs[i].reg = (u32)tmp[2 * i];
++		regs[i].def = (u32)tmp[2 * i + 1];
++	}
++	return ret;
++}
++
++
++static int clk_hifiberry_dachd_dt_parse(struct device *dev)
++{
++	num_common_pll_regs = clk_hifiberry_get_prop_values(dev,
++				"common_pll_regs", common_pll_regs);
++	num_dedicated_44k1_pll_regs = clk_hifiberry_get_prop_values(dev,
++				"44k1_pll_regs", dedicated_44k1_pll_regs);
++	num_dedicated_88k2_pll_regs = clk_hifiberry_get_prop_values(dev,
++				"88k2_pll_regs", dedicated_88k2_pll_regs);
++	num_dedicated_176k4_pll_regs = clk_hifiberry_get_prop_values(dev,
++				"176k4_pll_regs", dedicated_176k4_pll_regs);
++	num_dedicated_48k_pll_regs = clk_hifiberry_get_prop_values(dev,
++				"48k_pll_regs", dedicated_48k_pll_regs);
++	num_dedicated_96k_pll_regs = clk_hifiberry_get_prop_values(dev,
++				"96k_pll_regs", dedicated_96k_pll_regs);
++	num_dedicated_192k_pll_regs = clk_hifiberry_get_prop_values(dev,
++				"192k_pll_regs", dedicated_192k_pll_regs);
++	return 0;
++}
++
++
++static int clk_hifiberry_dachd_remove(struct device *dev)
++{
++	of_clk_del_provider(dev->of_node);
++	return 0;
++}
++
++const struct regmap_config hifiberry_pll_regmap = {
++	.reg_bits = 8,
++	.val_bits = 8,
++	.max_register = HIFIBERRY_PLL_MAX_REGISTER,
++	.reg_defaults = hifiberry_pll_reg_defaults,
++	.num_reg_defaults = ARRAY_SIZE(hifiberry_pll_reg_defaults),
++	.cache_type = REGCACHE_RBTREE,
++};
++EXPORT_SYMBOL_GPL(hifiberry_pll_regmap);
++
++
++static int clk_hifiberry_dachd_i2c_probe(struct i2c_client *i2c,
++			     const struct i2c_device_id *id)
++{
++	struct clk_hifiberry_drvdata *hdclk;
++	int ret = 0;
++	struct clk_init_data init;
++	struct device *dev = &i2c->dev;
++	struct device_node *dev_node = dev->of_node;
++	struct regmap_config config = hifiberry_pll_regmap;
++
++	hdclk = devm_kzalloc(&i2c->dev,
++			sizeof(struct clk_hifiberry_drvdata), GFP_KERNEL);
++	if (!hdclk)
++		return -ENOMEM;
++
++	i2c_set_clientdata(i2c, hdclk);
++
++	hdclk->regmap = devm_regmap_init_i2c(i2c, &config);
++
++	if (IS_ERR(hdclk->regmap))
++		return PTR_ERR(hdclk->regmap);
++
++	/* start PLL to allow detection of DAC */
++	ret = clk_hifiberry_dachd_write_pll_regs(hdclk->regmap,
++				hifiberry_pll_reg_defaults,
++				ARRAY_SIZE(hifiberry_pll_reg_defaults),
++				PLL_RESET);
++	if (ret)
++		return ret;
++
++	clk_hifiberry_dachd_dt_parse(dev);
++
++	/* restart PLL with configs from DTB */
++	ret = clk_hifiberry_dachd_write_pll_regs(hdclk->regmap, common_pll_regs,
++					num_common_pll_regs, PLL_RESET);
++	if (ret)
++		return ret;
++
++	init.name = "clk-hifiberry-dachd";
++	init.ops = &clk_hifiberry_dachd_rate_ops;
++	init.flags = 0;
++	init.parent_names = NULL;
++	init.num_parents = 0;
++
++	hdclk->hw.init = &init;
++
++	hdclk->clk = devm_clk_register(dev, &hdclk->hw);
++	if (IS_ERR(hdclk->clk)) {
++		dev_err(dev, "unable to register %s\n",	init.name);
++		return PTR_ERR(hdclk->clk);
++	}
++
++	ret = of_clk_add_provider(dev_node, of_clk_src_simple_get, hdclk->clk);
++	if (ret != 0) {
++		dev_err(dev, "Cannot of_clk_add_provider");
++		return ret;
++	}
++
++	ret = clk_set_rate(hdclk->hw.clk, DEFAULT_RATE);
++	if (ret != 0) {
++		dev_err(dev, "Cannot set rate : %d\n",	ret);
++		return -EINVAL;
++	}
++
++	return ret;
++}
++
++static void clk_hifiberry_dachd_i2c_remove(struct i2c_client *i2c)
++{
++	clk_hifiberry_dachd_remove(&i2c->dev);
++}
++
++static const struct i2c_device_id clk_hifiberry_dachd_i2c_id[] = {
++	{ "dachd-clk", },
++	{ }
++};
++MODULE_DEVICE_TABLE(i2c, clk_hifiberry_dachd_i2c_id);
++
++static const struct of_device_id clk_hifiberry_dachd_of_match[] = {
++	{ .compatible = "hifiberry,dachd-clk", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, clk_hifiberry_dachd_of_match);
++
++static struct i2c_driver clk_hifiberry_dachd_i2c_driver = {
++	.probe		= clk_hifiberry_dachd_i2c_probe,
++	.remove		= clk_hifiberry_dachd_i2c_remove,
++	.id_table	= clk_hifiberry_dachd_i2c_id,
++	.driver		= {
++		.name	= "dachd-clk",
++		.of_match_table = of_match_ptr(clk_hifiberry_dachd_of_match),
++	},
++};
++
++module_i2c_driver(clk_hifiberry_dachd_i2c_driver);
++
++
++MODULE_DESCRIPTION("HiFiBerry DAC+ HD clock driver");
++MODULE_AUTHOR("Joerg Schambacher <joerg@i2audio.com>");
++MODULE_LICENSE("GPL v2");
++MODULE_ALIAS("platform:clk-hifiberry-dachd");
+--- /dev/null
++++ b/drivers/clk/clk-hifiberry-dacpro.c
+@@ -0,0 +1,160 @@
++/*
++ * Clock Driver for HiFiBerry DAC Pro
++ *
++ * Author: Stuart MacLean
++ *         Copyright 2015
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/clk-provider.h>
++#include <linux/clkdev.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/slab.h>
++#include <linux/platform_device.h>
++
++/* Clock rate of CLK44EN attached to GPIO6 pin */
++#define CLK_44EN_RATE 22579200UL
++/* Clock rate of CLK48EN attached to GPIO3 pin */
++#define CLK_48EN_RATE 24576000UL
++
++/**
++ * struct hifiberry_dacpro_clk - Common struct to the HiFiBerry DAC Pro
++ * @hw: clk_hw for the common clk framework
++ * @mode: 0 => CLK44EN, 1 => CLK48EN
++ */
++struct clk_hifiberry_hw {
++	struct clk_hw hw;
++	uint8_t mode;
++};
++
++#define to_hifiberry_clk(_hw) container_of(_hw, struct clk_hifiberry_hw, hw)
++
++static const struct of_device_id clk_hifiberry_dacpro_dt_ids[] = {
++	{ .compatible = "hifiberry,dacpro-clk",},
++	{ }
++};
++MODULE_DEVICE_TABLE(of, clk_hifiberry_dacpro_dt_ids);
++
++static unsigned long clk_hifiberry_dacpro_recalc_rate(struct clk_hw *hw,
++	unsigned long parent_rate)
++{
++	return (to_hifiberry_clk(hw)->mode == 0) ? CLK_44EN_RATE :
++		CLK_48EN_RATE;
++}
++
++static long clk_hifiberry_dacpro_round_rate(struct clk_hw *hw,
++	unsigned long rate, unsigned long *parent_rate)
++{
++	long actual_rate;
++
++	if (rate <= CLK_44EN_RATE) {
++		actual_rate = (long)CLK_44EN_RATE;
++	} else if (rate >= CLK_48EN_RATE) {
++		actual_rate = (long)CLK_48EN_RATE;
++	} else {
++		long diff44Rate = (long)(rate - CLK_44EN_RATE);
++		long diff48Rate = (long)(CLK_48EN_RATE - rate);
++
++		if (diff44Rate < diff48Rate)
++			actual_rate = (long)CLK_44EN_RATE;
++		else
++			actual_rate = (long)CLK_48EN_RATE;
++	}
++	return actual_rate;
++}
++
++
++static int clk_hifiberry_dacpro_set_rate(struct clk_hw *hw,
++	unsigned long rate, unsigned long parent_rate)
++{
++	unsigned long actual_rate;
++	struct clk_hifiberry_hw *clk = to_hifiberry_clk(hw);
++
++	actual_rate = (unsigned long)clk_hifiberry_dacpro_round_rate(hw, rate,
++		&parent_rate);
++	clk->mode = (actual_rate == CLK_44EN_RATE) ? 0 : 1;
++	return 0;
++}
++
++
++const struct clk_ops clk_hifiberry_dacpro_rate_ops = {
++	.recalc_rate = clk_hifiberry_dacpro_recalc_rate,
++	.round_rate = clk_hifiberry_dacpro_round_rate,
++	.set_rate = clk_hifiberry_dacpro_set_rate,
++};
++
++static int clk_hifiberry_dacpro_probe(struct platform_device *pdev)
++{
++	int ret;
++	struct clk_hifiberry_hw *proclk;
++	struct clk *clk;
++	struct device *dev;
++	struct clk_init_data init;
++
++	dev = &pdev->dev;
++
++	proclk = kzalloc(sizeof(struct clk_hifiberry_hw), GFP_KERNEL);
++	if (!proclk)
++		return -ENOMEM;
++
++	init.name = "clk-hifiberry-dacpro";
++	init.ops = &clk_hifiberry_dacpro_rate_ops;
++	init.flags = 0;
++	init.parent_names = NULL;
++	init.num_parents = 0;
++
++	proclk->mode = 0;
++	proclk->hw.init = &init;
++
++	clk = devm_clk_register(dev, &proclk->hw);
++	if (!IS_ERR(clk)) {
++		ret = of_clk_add_provider(dev->of_node, of_clk_src_simple_get,
++			clk);
++	} else {
++		dev_err(dev, "Fail to register clock driver\n");
++		kfree(proclk);
++		ret = PTR_ERR(clk);
++	}
++	return ret;
++}
++
++static int clk_hifiberry_dacpro_remove(struct platform_device *pdev)
++{
++	of_clk_del_provider(pdev->dev.of_node);
++	return 0;
++}
++
++static struct platform_driver clk_hifiberry_dacpro_driver = {
++	.probe = clk_hifiberry_dacpro_probe,
++	.remove = clk_hifiberry_dacpro_remove,
++	.driver = {
++		.name = "clk-hifiberry-dacpro",
++		.of_match_table = clk_hifiberry_dacpro_dt_ids,
++	},
++};
++
++static int __init clk_hifiberry_dacpro_init(void)
++{
++	return platform_driver_register(&clk_hifiberry_dacpro_driver);
++}
++core_initcall(clk_hifiberry_dacpro_init);
++
++static void __exit clk_hifiberry_dacpro_exit(void)
++{
++	platform_driver_unregister(&clk_hifiberry_dacpro_driver);
++}
++module_exit(clk_hifiberry_dacpro_exit);
++
++MODULE_DESCRIPTION("HiFiBerry DAC Pro clock driver");
++MODULE_LICENSE("GPL v2");
++MODULE_ALIAS("platform:clk-hifiberry-dacpro");
+--- a/sound/soc/bcm/Kconfig
++++ b/sound/soc/bcm/Kconfig
+@@ -26,3 +26,308 @@ config SND_BCM63XX_I2S_WHISTLER
+ 	  DSL/PON chips (bcm63158, bcm63178)
+ 
+ 	  If you don't know what to do here, say N
++
++config SND_BCM2708_SOC_CHIPDIP_DAC
++         tristate "Support for the ChipDip DAC"
++         depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++         help
++          Say Y or M if you want to add support for the ChipDip DAC soundcard
++
++config SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD
++	tristate "Support for Google voiceHAT soundcard"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_SOC_VOICEHAT
++	select SND_RPI_SIMPLE_SOUNDCARD
++	help
++          Say Y or M if you want to add support for voiceHAT soundcard.
++
++config SND_BCM2708_SOC_HIFIBERRY_DAC
++        tristate "Support for HifiBerry DAC"
++        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++        select SND_SOC_PCM5102A
++        select SND_RPI_SIMPLE_SOUNDCARD
++        help
++         Say Y or M if you want to add support for HifiBerry DAC.
++
++config SND_BCM2708_SOC_HIFIBERRY_DACPLUS
++        tristate "Support for HifiBerry DAC+"
++        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++        select SND_SOC_PCM512x
++        select SND_SOC_TPA6130A2
++        select COMMON_CLK_HIFIBERRY_DACPRO
++        help
++         Say Y or M if you want to add support for HifiBerry DAC+.
++
++config SND_BCM2708_SOC_HIFIBERRY_DACPLUSHD
++        tristate "Support for HifiBerry DAC+ HD"
++        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++        select SND_SOC_PCM179X_I2C
++        select COMMON_CLK_HIFIBERRY_DACPLUSHD
++        help
++         Say Y or M if you want to add support for HifiBerry DAC+ HD.
++
++config SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC
++        tristate "Support for HifiBerry DAC+ADC"
++        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++        select SND_SOC_PCM512x_I2C
++	select SND_SOC_DMIC
++        select COMMON_CLK_HIFIBERRY_DACPRO
++        help
++         Say Y or M if you want to add support for HifiBerry DAC+ADC.
++
++config SND_BCM2708_SOC_HIFIBERRY_DACPLUSADCPRO
++        tristate "Support for HifiBerry DAC+ADC PRO"
++        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++        select SND_SOC_PCM512x_I2C
++        select SND_SOC_PCM186X_I2C
++        select SND_SOC_TPA6130A2
++        select COMMON_CLK_HIFIBERRY_DACPRO
++        help
++         Say Y or M if you want to add support for HifiBerry DAC+ADC PRO.
++
++config SND_BCM2708_SOC_HIFIBERRY_DACPLUSDSP
++        tristate "Support for HifiBerry DAC+DSP"
++        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_RPI_SIMPLE_SOUNDCARD
++        help
++         Say Y or M if you want to add support for HifiBerry DSP-DAC.
++
++config SND_BCM2708_SOC_HIFIBERRY_DIGI
++        tristate "Support for HifiBerry Digi"
++        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++        select SND_SOC_WM8804
++        help
++         Say Y or M if you want to add support for HifiBerry Digi S/PDIF output board.
++
++config SND_BCM2708_SOC_HIFIBERRY_AMP
++        tristate "Support for the HifiBerry Amp"
++        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++        select SND_SOC_TAS5713
++        select SND_RPI_SIMPLE_SOUNDCARD
++        help
++         Say Y or M if you want to add support for the HifiBerry Amp amplifier board.
++
++ config SND_BCM2708_SOC_PIFI_40
++         tristate "Support for the PiFi-40 amp"
++         depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++         select SND_SOC_TAS571X
++         select SND_PIFI_40
++         help
++          Say Y or M if you want to add support for the PiFi40 amp board
++
++config SND_BCM2708_SOC_RPI_CIRRUS
++        tristate "Support for Cirrus Logic Audio Card"
++        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++        select SND_SOC_WM5102
++        select SND_SOC_WM8804
++        help
++         Say Y or M if you want to add support for the Wolfson and
++         Cirrus Logic audio cards.
++
++config SND_BCM2708_SOC_RPI_DAC
++        tristate "Support for RPi-DAC"
++        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++        select SND_SOC_PCM1794A
++        select SND_RPI_SIMPLE_SOUNDCARD
++        help
++         Say Y or M if you want to add support for RPi-DAC.
++
++config SND_BCM2708_SOC_RPI_PROTO
++	tristate "Support for Rpi-PROTO"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_SOC_WM8731
++	help
++	  Say Y or M if you want to add support for Audio Codec Board PROTO (WM8731).
++
++config SND_BCM2708_SOC_JUSTBOOM_BOTH
++	tristate "Support for simultaneous JustBoom Digi and JustBoom DAC"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_SOC_WM8804
++	select SND_SOC_PCM512x
++	help
++		Say Y or M if you want to add support for simultaneous
++		JustBoom Digi and JustBoom DAC.
++
++		This is not the right choice if you only have one but both of
++		these cards.
++
++config SND_BCM2708_SOC_JUSTBOOM_DAC
++	tristate "Support for JustBoom DAC"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_SOC_PCM512x
++	help
++	  Say Y or M if you want to add support for JustBoom DAC.
++
++config SND_BCM2708_SOC_JUSTBOOM_DIGI
++	tristate "Support for JustBoom Digi"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_SOC_WM8804
++        select SND_RPI_WM8804_SOUNDCARD
++	help
++	  Say Y or M if you want to add support for JustBoom Digi.
++
++config SND_BCM2708_SOC_IQAUDIO_CODEC
++	tristate "Support for IQaudIO-CODEC"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_SOC_DA7213
++	help
++	  Say Y or M if you want to add support for IQaudIO-CODEC.
++
++config SND_BCM2708_SOC_IQAUDIO_DAC
++	tristate "Support for IQaudIO-DAC"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_SOC_PCM512x_I2C
++	help
++	  Say Y or M if you want to add support for IQaudIO-DAC.
++
++config SND_BCM2708_SOC_IQAUDIO_DIGI
++	tristate "Support for IQAudIO Digi"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_SOC_WM8804
++	select SND_RPI_WM8804_SOUNDCARD
++	help
++	  Say Y or M if you want to add support for IQAudIO Digital IO board.
++
++config SND_BCM2708_SOC_I_SABRE_Q2M
++        tristate "Support for Audiophonics I-Sabre Q2M DAC"
++        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++        select SND_SOC_I_SABRE_CODEC
++        help
++        Say Y or M if you want to add support for Audiophonics I-SABRE Q2M DAC
++
++config SND_BCM2708_SOC_ADAU1977_ADC
++	tristate "Support for ADAU1977 ADC"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_SOC_ADAU1977_I2C
++	select SND_RPI_SIMPLE_SOUNDCARD
++	help
++	  Say Y or M if you want to add support for ADAU1977 ADC.
++
++config SND_AUDIOINJECTOR_PI_SOUNDCARD
++	tristate "Support for audioinjector.net Pi add on soundcard"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_SOC_WM8731
++	help
++	  Say Y or M if you want to add support for audioinjector.net Pi Hat
++
++config SND_AUDIOINJECTOR_OCTO_SOUNDCARD
++	tristate "Support for audioinjector.net Octo channel (Hat) soundcard"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_SOC_CS42XX8_I2C
++	help
++	  Say Y or M if you want to add support for audioinjector.net octo add on
++
++config SND_AUDIOINJECTOR_ISOLATED_SOUNDCARD
++	tristate "Support for audioinjector.net isolated DAC and ADC soundcard"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_SOC_CS4271_I2C
++	help
++	  Say Y or M if you want to add support for audioinjector.net isolated soundcard
++
++config SND_AUDIOSENSE_PI
++	tristate "Support for AudioSense Add-On Soundcard"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_SOC_TLV320AIC32X4_I2C
++	help
++	  Say Y or M if you want to add support for tlv320aic32x4 add-on
++
++config SND_DIGIDAC1_SOUNDCARD
++        tristate "Support for Red Rocks Audio DigiDAC1"
++        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++        select SND_SOC_WM8804
++        select SND_SOC_WM8741
++        help
++         Say Y or M if you want to add support for Red Rocks Audio DigiDAC1 board.
++
++config SND_BCM2708_SOC_DIONAUDIO_LOCO
++	tristate "Support for Dion Audio LOCO DAC-AMP"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_SOC_PCM5102a
++	help
++	  Say Y or M if you want to add support for Dion Audio LOCO.
++
++config SND_BCM2708_SOC_DIONAUDIO_LOCO_V2
++	tristate "Support for Dion Audio LOCO-V2 DAC-AMP"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_SOC_PCM5122
++	help
++	  Say Y or M if you want to add support for Dion Audio LOCO-V2.
++
++config SND_BCM2708_SOC_ALLO_PIANO_DAC
++	tristate "Support for Allo Piano DAC"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_SOC_PCM512x_I2C
++	help
++	  Say Y or M if you want to add support for Allo Piano DAC.
++
++config SND_BCM2708_SOC_ALLO_PIANO_DAC_PLUS
++	tristate "Support for Allo Piano DAC Plus"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_SOC_PCM512x_I2C
++	help
++	  Say Y or M if you want to add support for Allo Piano DAC Plus.
++
++config SND_BCM2708_SOC_ALLO_BOSS_DAC
++	tristate "Support for Allo Boss DAC"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_SOC_PCM512x_I2C
++	help
++	  Say Y or M if you want to add support for Allo Boss DAC.
++
++config SND_BCM2708_SOC_ALLO_BOSS2_DAC
++	tristate "Support for Allo Boss2 DAC"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	depends on I2C
++	select REGMAP_I2C
++	select SND_AUDIO_GRAPH_CARD
++	help
++	  Say Y or M if you want to add support for Allo Boss2 DAC.
++
++config SND_BCM2708_SOC_ALLO_DIGIONE
++	tristate "Support for Allo DigiOne"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_SOC_WM8804
++	select SND_RPI_WM8804_SOUNDCARD
++	help
++	  Say Y or M if you want to add support for Allo DigiOne.
++
++config SND_BCM2708_SOC_ALLO_KATANA_DAC
++	tristate "Support for Allo Katana DAC"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	depends on I2C
++	select REGMAP_I2C
++	select SND_AUDIO_GRAPH_CARD
++	help
++	  Say Y or M if you want to add support for Allo Katana DAC.
++
++config SND_BCM2708_SOC_FE_PI_AUDIO
++	tristate "Support for Fe-Pi-Audio"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_SOC_SGTL5000
++	help
++	  Say Y or M if you want to add support for Fe-Pi-Audio.
++
++config SND_PISOUND
++	tristate "Support for Blokas Labs pisound"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_RAWMIDI
++	help
++	  Say Y or M if you want to add support for Blokas Labs pisound.
++
++config SND_RPI_SIMPLE_SOUNDCARD
++	tristate "Support for Raspberry Pi simple soundcards"
++	help
++	  Say Y or M if you want to add support Raspbery Pi simple soundcards
++
++config SND_RPI_WM8804_SOUNDCARD
++	tristate "Support for Raspberry Pi generic WM8804 soundcards"
++	help
++	  Say Y or M if you want to add support for the Raspberry Pi
++          generic driver for WM8804 based soundcards.
++
++config SND_DACBERRY400
++	tristate "Support for DACBERRY400 Soundcard"
++	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
++	select SND_SOC_TLV320AIC3X_I2C
++	help
++	  Say Y or M if you want to add support for tlv320aic3x add-on
+--- a/sound/soc/bcm/Makefile
++++ b/sound/soc/bcm/Makefile
+@@ -12,4 +12,73 @@ obj-$(CONFIG_SND_SOC_CYGNUS) += snd-soc-
+ # BCM63XX Platform Support
+ snd-soc-63xx-objs := bcm63xx-i2s-whistler.o bcm63xx-pcm-whistler.o
+ 
+-obj-$(CONFIG_SND_BCM63XX_I2S_WHISTLER) += snd-soc-63xx.o
+\ No newline at end of file
++obj-$(CONFIG_SND_BCM63XX_I2S_WHISTLER) += snd-soc-63xx.o
++
++# Google voiceHAT custom codec support
++snd-soc-googlevoicehat-codec-objs := googlevoicehat-codec.o
++
++# BCM2708 Machine Support
++snd-soc-hifiberry-dacplus-objs := hifiberry_dacplus.o
++snd-soc-hifiberry-dacplushd-objs := hifiberry_dacplushd.o
++snd-soc-hifiberry-dacplusadc-objs := hifiberry_dacplusadc.o
++snd-soc-hifiberry-dacplusadcpro-objs := hifiberry_dacplusadcpro.o
++snd-soc-hifiberry-dacplusdsp-objs := hifiberry_dacplusdsp.o
++snd-soc-justboom-both-objs := justboom-both.o
++snd-soc-justboom-dac-objs := justboom-dac.o
++snd-soc-rpi-cirrus-objs := rpi-cirrus.o
++snd-soc-rpi-proto-objs := rpi-proto.o
++snd-soc-iqaudio-codec-objs := iqaudio-codec.o
++snd-soc-iqaudio-dac-objs := iqaudio-dac.o
++ snd-soc-i-sabre-q2m-objs := i-sabre-q2m.o
++snd-soc-audioinjector-pi-soundcard-objs := audioinjector-pi-soundcard.o
++snd-soc-audioinjector-octo-soundcard-objs := audioinjector-octo-soundcard.o
++snd-soc-audioinjector-isolated-soundcard-objs := audioinjector-isolated-soundcard.o
++snd-soc-audiosense-pi-objs := audiosense-pi.o
++snd-soc-digidac1-soundcard-objs := digidac1-soundcard.o
++snd-soc-dionaudio-loco-objs := dionaudio_loco.o
++snd-soc-dionaudio-loco-v2-objs := dionaudio_loco-v2.o
++snd-soc-allo-boss-dac-objs := allo-boss-dac.o
++snd-soc-allo-boss2-dac-objs := allo-boss2-dac.o
++snd-soc-allo-piano-dac-objs := allo-piano-dac.o
++snd-soc-allo-piano-dac-plus-objs := allo-piano-dac-plus.o
++snd-soc-allo-katana-codec-objs := allo-katana-codec.o
++snd-soc-pisound-objs := pisound.o
++snd-soc-fe-pi-audio-objs := fe-pi-audio.o
++snd-soc-rpi-simple-soundcard-objs := rpi-simple-soundcard.o
++snd-soc-rpi-wm8804-soundcard-objs := rpi-wm8804-soundcard.o
++snd-soc-pifi-40-objs := pifi-40.o
++snd-soc-chipdip-dac-objs := chipdip-dac.o
++snd-soc-dacberry400-objs := dacberry400.o
++
++obj-$(CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD)  += snd-soc-googlevoicehat-codec.o
++obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS) += snd-soc-hifiberry-dacplus.o
++obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSHD) += snd-soc-hifiberry-dacplushd.o
++obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC) += snd-soc-hifiberry-dacplusadc.o
++obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADCPRO) += snd-soc-hifiberry-dacplusadcpro.o
++obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSDSP) += snd-soc-hifiberry-dacplusdsp.o
++obj-$(CONFIG_SND_BCM2708_SOC_JUSTBOOM_BOTH) += snd-soc-justboom-both.o
++obj-$(CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC) += snd-soc-justboom-dac.o
++obj-$(CONFIG_SND_BCM2708_SOC_RPI_CIRRUS) += snd-soc-rpi-cirrus.o
++obj-$(CONFIG_SND_BCM2708_SOC_RPI_PROTO) += snd-soc-rpi-proto.o
++obj-$(CONFIG_SND_BCM2708_SOC_IQAUDIO_CODEC) += snd-soc-iqaudio-codec.o
++obj-$(CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC) += snd-soc-iqaudio-dac.o
++obj-$(CONFIG_SND_BCM2708_SOC_I_SABRE_Q2M) += snd-soc-i-sabre-q2m.o
++obj-$(CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD) += snd-soc-audioinjector-pi-soundcard.o
++obj-$(CONFIG_SND_AUDIOINJECTOR_OCTO_SOUNDCARD) += snd-soc-audioinjector-octo-soundcard.o
++obj-$(CONFIG_SND_AUDIOINJECTOR_ISOLATED_SOUNDCARD) += snd-soc-audioinjector-isolated-soundcard.o
++obj-$(CONFIG_SND_AUDIOSENSE_PI) += snd-soc-audiosense-pi.o
++obj-$(CONFIG_SND_DIGIDAC1_SOUNDCARD) += snd-soc-digidac1-soundcard.o
++obj-$(CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO) += snd-soc-dionaudio-loco.o
++obj-$(CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO_V2) += snd-soc-dionaudio-loco-v2.o
++obj-$(CONFIG_SND_BCM2708_SOC_ALLO_BOSS_DAC) += snd-soc-allo-boss-dac.o
++obj-$(CONFIG_SND_BCM2708_SOC_ALLO_BOSS2_DAC) += snd-soc-allo-boss2-dac.o
++obj-$(CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC) += snd-soc-allo-piano-dac.o
++obj-$(CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC_PLUS) += snd-soc-allo-piano-dac-plus.o
++obj-$(CONFIG_SND_BCM2708_SOC_ALLO_KATANA_DAC) += snd-soc-allo-katana-codec.o
++obj-$(CONFIG_SND_PISOUND) += snd-soc-pisound.o
++obj-$(CONFIG_SND_BCM2708_SOC_FE_PI_AUDIO) += snd-soc-fe-pi-audio.o
++obj-$(CONFIG_SND_RPI_SIMPLE_SOUNDCARD) += snd-soc-rpi-simple-soundcard.o
++obj-$(CONFIG_SND_RPI_WM8804_SOUNDCARD) += snd-soc-rpi-wm8804-soundcard.o
++obj-$(CONFIG_SND_BCM2708_SOC_PIFI_40) += snd-soc-pifi-40.o
++obj-$(CONFIG_SND_BCM2708_SOC_CHIPDIP_DAC) += snd-soc-chipdip-dac.o
++obj-$(CONFIG_SND_DACBERRY400) += snd-soc-dacberry400.o
+--- /dev/null
++++ b/sound/soc/bcm/allo-boss-dac.c
+@@ -0,0 +1,457 @@
++/*
++ * ALSA ASoC Machine Driver for Allo Boss DAC
++ *
++ * Author:	Baswaraj K <jaikumar@cem-solutions.net>
++ *		Copyright 2017
++ *		based on code by Daniel Matuschek,
++ *				 Stuart MacLean <stuart@hifiberry.com>
++ *		based on code by Florian Meier <florian.meier@koalo.de>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/gpio/consumer.h>
++#include <linux/platform_device.h>
++#include <linux/clk.h>
++#include <linux/delay.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include "../codecs/pcm512x.h"
++
++#define ALLO_BOSS_NOCLOCK 0
++#define ALLO_BOSS_CLK44EN 1
++#define ALLO_BOSS_CLK48EN 2
++
++struct pcm512x_priv {
++	struct regmap *regmap;
++	struct clk *sclk;
++};
++
++static struct gpio_desc *mute_gpio;
++
++/* Clock rate of CLK44EN attached to GPIO6 pin */
++#define CLK_44EN_RATE 45158400UL
++/* Clock rate of CLK48EN attached to GPIO3 pin */
++#define CLK_48EN_RATE 49152000UL
++
++static bool slave;
++static bool snd_soc_allo_boss_master;
++static bool digital_gain_0db_limit = true;
++
++static void snd_allo_boss_select_clk(struct snd_soc_component *component,
++	int clk_id)
++{
++	switch (clk_id) {
++	case ALLO_BOSS_NOCLOCK:
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x00);
++		break;
++	case ALLO_BOSS_CLK44EN:
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x20);
++		break;
++	case ALLO_BOSS_CLK48EN:
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x04);
++		break;
++	}
++}
++
++static void snd_allo_boss_clk_gpio(struct snd_soc_component *component)
++{
++	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x24, 0x24);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_3, 0x0f, 0x02);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_6, 0x0f, 0x02);
++}
++
++static bool snd_allo_boss_is_sclk(struct snd_soc_component *component)
++{
++	unsigned int sck;
++
++	sck = snd_soc_component_read(component, PCM512x_RATE_DET_4);
++	return (!(sck & 0x40));
++}
++
++static bool snd_allo_boss_is_sclk_sleep(
++	struct snd_soc_component *component)
++{
++	msleep(2);
++	return snd_allo_boss_is_sclk(component);
++}
++
++static bool snd_allo_boss_is_master_card(struct snd_soc_component *component)
++{
++	bool isClk44EN, isClk48En, isNoClk;
++
++	snd_allo_boss_clk_gpio(component);
++
++	snd_allo_boss_select_clk(component, ALLO_BOSS_CLK44EN);
++	isClk44EN = snd_allo_boss_is_sclk_sleep(component);
++
++	snd_allo_boss_select_clk(component, ALLO_BOSS_NOCLOCK);
++	isNoClk = snd_allo_boss_is_sclk_sleep(component);
++
++	snd_allo_boss_select_clk(component, ALLO_BOSS_CLK48EN);
++	isClk48En = snd_allo_boss_is_sclk_sleep(component);
++
++	return (isClk44EN && isClk48En && !isNoClk);
++}
++
++static int snd_allo_boss_clk_for_rate(int sample_rate)
++{
++	int type;
++
++	switch (sample_rate) {
++	case 11025:
++	case 22050:
++	case 44100:
++	case 88200:
++	case 176400:
++	case 352800:
++		type = ALLO_BOSS_CLK44EN;
++		break;
++	default:
++		type = ALLO_BOSS_CLK48EN;
++		break;
++	}
++	return type;
++}
++
++static void snd_allo_boss_set_sclk(struct snd_soc_component *component,
++	int sample_rate)
++{
++	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
++
++	if (!IS_ERR(pcm512x->sclk)) {
++		int ctype;
++
++		ctype =	snd_allo_boss_clk_for_rate(sample_rate);
++		clk_set_rate(pcm512x->sclk, (ctype == ALLO_BOSS_CLK44EN)
++				? CLK_44EN_RATE : CLK_48EN_RATE);
++		snd_allo_boss_select_clk(component, ctype);
++	}
++}
++
++static int snd_allo_boss_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++	struct pcm512x_priv *priv = snd_soc_component_get_drvdata(component);
++
++	if (slave)
++		snd_soc_allo_boss_master = false;
++	else
++		snd_soc_allo_boss_master =
++			snd_allo_boss_is_master_card(component);
++
++	if (snd_soc_allo_boss_master) {
++		struct snd_soc_dai_link *dai = rtd->dai_link;
++
++		dai->name = "BossDAC";
++		dai->stream_name = "Boss DAC HiFi [Master]";
++		dai->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
++			| SND_SOC_DAIFMT_CBM_CFM;
++
++		snd_soc_component_update_bits(component, PCM512x_BCLK_LRCLK_CFG, 0x31, 0x11);
++		snd_soc_component_update_bits(component, PCM512x_MASTER_MODE, 0x03, 0x03);
++		snd_soc_component_update_bits(component, PCM512x_MASTER_CLKDIV_2, 0x7f, 63);
++		/*
++		* Default sclk to CLK_48EN_RATE, otherwise codec
++		*  pcm512x_dai_startup_master method could call
++		*  snd_pcm_hw_constraint_ratnums using CLK_44EN/64
++		*  which will mask 384k sample rate.
++		*/
++		if (!IS_ERR(priv->sclk))
++			clk_set_rate(priv->sclk, CLK_48EN_RATE);
++	} else {
++		priv->sclk = ERR_PTR(-ENOENT);
++	}
++
++	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x08, 0x08);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_4, 0x0f, 0x02);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
++
++	if (digital_gain_0db_limit) {
++		int ret;
++		struct snd_soc_card *card = rtd->card;
++
++		ret = snd_soc_limit_volume(card, "Digital Playback Volume",
++				207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n",
++					ret);
++	}
++
++	return 0;
++}
++
++static int snd_allo_boss_update_rate_den(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
++	struct snd_ratnum *rats_no_pll;
++	unsigned int num = 0, den = 0;
++	int err;
++
++	rats_no_pll = devm_kzalloc(rtd->dev, sizeof(*rats_no_pll), GFP_KERNEL);
++	if (!rats_no_pll)
++		return -ENOMEM;
++
++	rats_no_pll->num = clk_get_rate(pcm512x->sclk) / 64;
++	rats_no_pll->den_min = 1;
++	rats_no_pll->den_max = 128;
++	rats_no_pll->den_step = 1;
++
++	err = snd_interval_ratnum(hw_param_interval(params,
++		SNDRV_PCM_HW_PARAM_RATE), 1, rats_no_pll, &num, &den);
++	if (err >= 0 && den) {
++		params->rate_num = num;
++		params->rate_den = den;
++	}
++
++	devm_kfree(rtd->dev, rats_no_pll);
++	return 0;
++}
++
++static void snd_allo_boss_gpio_mute(struct snd_soc_card *card)
++{
++	if (mute_gpio)
++		gpiod_set_value_cansleep(mute_gpio, 1);
++}
++
++static void snd_allo_boss_gpio_unmute(struct snd_soc_card *card)
++{
++	if (mute_gpio)
++		gpiod_set_value_cansleep(mute_gpio, 0);
++}
++
++static int snd_allo_boss_set_bias_level(struct snd_soc_card *card,
++	struct snd_soc_dapm_context *dapm, enum snd_soc_bias_level level)
++{
++	struct snd_soc_pcm_runtime *rtd;
++	struct snd_soc_dai *codec_dai;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++	codec_dai = asoc_rtd_to_codec(rtd, 0);
++
++	if (dapm->dev != codec_dai->dev)
++		return 0;
++
++	switch (level) {
++	case SND_SOC_BIAS_PREPARE:
++		if (dapm->bias_level != SND_SOC_BIAS_STANDBY)
++			break;
++		/* UNMUTE DAC */
++		snd_allo_boss_gpio_unmute(card);
++		break;
++
++	case SND_SOC_BIAS_STANDBY:
++		if (dapm->bias_level != SND_SOC_BIAS_PREPARE)
++			break;
++		/* MUTE DAC */
++		snd_allo_boss_gpio_mute(card);
++		break;
++
++	default:
++		break;
++	}
++
++	return 0;
++}
++
++static int snd_allo_boss_hw_params(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	int ret = 0;
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	int channels = params_channels(params);
++	int width = snd_pcm_format_physical_width(params_format(params));
++
++	if (snd_soc_allo_boss_master) {
++		struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++
++		snd_allo_boss_set_sclk(component,
++			params_rate(params));
++
++		ret = snd_allo_boss_update_rate_den(
++			substream, params);
++		if (ret)
++			return ret;
++	}
++
++	ret = snd_soc_dai_set_bclk_ratio(asoc_rtd_to_cpu(rtd, 0), channels * width);
++	if (ret)
++		return ret;
++	ret = snd_soc_dai_set_bclk_ratio(asoc_rtd_to_codec(rtd, 0), channels * width);
++	return ret;
++}
++
++static int snd_allo_boss_startup(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_card *card = rtd->card;
++
++	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
++	snd_allo_boss_gpio_mute(card);
++
++	if (snd_soc_allo_boss_master) {
++		struct pcm512x_priv *priv = snd_soc_component_get_drvdata(component);
++		/*
++		 * Default sclk to CLK_48EN_RATE, otherwise codec
++		 * pcm512x_dai_startup_master method could call
++		 * snd_pcm_hw_constraint_ratnums using CLK_44EN/64
++		 * which will mask 384k sample rate.
++		 */
++		if (!IS_ERR(priv->sclk))
++			clk_set_rate(priv->sclk, CLK_48EN_RATE);
++	}
++
++	return 0;
++}
++
++static void snd_allo_boss_shutdown(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++
++	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x00);
++}
++
++static int snd_allo_boss_prepare(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_card *card = rtd->card;
++
++	snd_allo_boss_gpio_unmute(card);
++	return 0;
++}
++/* machine stream operations */
++static struct snd_soc_ops snd_allo_boss_ops = {
++	.hw_params = snd_allo_boss_hw_params,
++	.startup = snd_allo_boss_startup,
++	.shutdown = snd_allo_boss_shutdown,
++	.prepare = snd_allo_boss_prepare,
++};
++
++SND_SOC_DAILINK_DEFS(allo_boss,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm512x.1-004d", "pcm512x-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_allo_boss_dai[] = {
++{
++	.name		= "Boss DAC",
++	.stream_name	= "Boss DAC HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S |
++			  SND_SOC_DAIFMT_NB_NF |
++			  SND_SOC_DAIFMT_CBS_CFS,
++	.ops		= &snd_allo_boss_ops,
++	.init		= snd_allo_boss_init,
++	SND_SOC_DAILINK_REG(allo_boss),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_allo_boss = {
++	.name         = "BossDAC",
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_allo_boss_dai,
++	.num_links    = ARRAY_SIZE(snd_allo_boss_dai),
++};
++
++static int snd_allo_boss_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++
++	snd_allo_boss.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai;
++
++		dai = &snd_allo_boss_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++					    "i2s-controller", 0);
++
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		}
++
++		digital_gain_0db_limit = !of_property_read_bool(
++			pdev->dev.of_node, "allo,24db_digital_gain");
++		slave = of_property_read_bool(pdev->dev.of_node,
++						"allo,slave");
++
++		mute_gpio = devm_gpiod_get_optional(&pdev->dev, "mute",
++							GPIOD_OUT_LOW);
++		if (IS_ERR(mute_gpio)) {
++			ret = PTR_ERR(mute_gpio);
++			dev_err(&pdev->dev,
++				"failed to get mute gpio: %d\n", ret);
++			return ret;
++		}
++
++		if (mute_gpio)
++			snd_allo_boss.set_bias_level =
++				snd_allo_boss_set_bias_level;
++
++		ret = snd_soc_register_card(&snd_allo_boss);
++		if (ret) {
++			dev_err(&pdev->dev,
++				"snd_soc_register_card() failed: %d\n", ret);
++			return ret;
++		}
++
++		if (mute_gpio)
++			snd_allo_boss_gpio_mute(&snd_allo_boss);
++
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++static int snd_allo_boss_remove(struct platform_device *pdev)
++{
++	snd_allo_boss_gpio_mute(&snd_allo_boss);
++	snd_soc_unregister_card(&snd_allo_boss);
++	return 0;
++}
++
++static const struct of_device_id snd_allo_boss_of_match[] = {
++	{ .compatible = "allo,boss-dac", },
++	{ /* sentinel */ },
++};
++MODULE_DEVICE_TABLE(of, snd_allo_boss_of_match);
++
++static struct platform_driver snd_allo_boss_driver = {
++	.driver = {
++		.name   = "snd-allo-boss-dac",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_allo_boss_of_match,
++	},
++	.probe          = snd_allo_boss_probe,
++	.remove         = snd_allo_boss_remove,
++};
++
++module_platform_driver(snd_allo_boss_driver);
++
++MODULE_AUTHOR("Baswaraj K <jaikumar@cem-solutions.net>");
++MODULE_DESCRIPTION("ALSA ASoC Machine Driver for Allo Boss DAC");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/allo-boss2-dac.c
+@@ -0,0 +1,1131 @@
++/*
++ * Driver for the ALLO KATANA CODEC
++ *
++ * Author: Jaikumar <sudeepkumar@cem-solutions.net>
++ *		Copyright 2018
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/moduleparam.h>
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/delay.h>
++#include <linux/gpio.h>
++#include <linux/gpio/consumer.h>
++#include <linux/platform_device.h>
++#include <linux/pm.h>
++#include <linux/i2c.h>
++#include <linux/of_device.h>
++#include <linux/regmap.h>
++#include <linux/slab.h>
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/soc-dapm.h>
++#include <sound/initval.h>
++#include <sound/tlv.h>
++#include <linux/of_gpio.h>
++#include <linux/regulator/consumer.h>
++#include <linux/pm_runtime.h>
++#include <linux/of_irq.h>
++#include <linux/completion.h>
++#include <linux/mutex.h>
++#include <linux/workqueue.h>
++#include <sound/jack.h>
++
++#include "../codecs/cs43130.h"
++
++#include <linux/clk.h>
++#include <linux/gcd.h>
++#define DEBUG
++
++#define CS43130_DSD_EN_MASK             0x10
++#define CS43130_PDN_DONE_INT_MASK        0x00
++
++static struct gpio_desc *snd_allo_clk44gpio;
++static struct gpio_desc *snd_allo_clk48gpio;
++
++struct  cs43130_priv {
++	struct snd_soc_component        *component;
++	struct regmap                   *regmap;
++	struct regulator_bulk_data      supplies[CS43130_NUM_SUPPLIES];
++	struct gpio_desc                *reset_gpio;
++	unsigned int                    dev_id; /* codec device ID */
++	int                             xtal_ibias;
++	/* shared by both DAIs */
++	struct mutex                    clk_mutex;
++	int                             clk_req;
++	bool                            pll_bypass;
++	struct completion               xtal_rdy;
++	struct completion               pll_rdy;
++	unsigned int                    mclk;
++	unsigned int                    mclk_int;
++	int                             mclk_int_src;
++
++	/* DAI specific */
++	struct cs43130_dai              dais[CS43130_DAI_ID_MAX];
++
++	/* HP load specific */
++	bool                            dc_meas;
++	bool                            ac_meas;
++	bool                            hpload_done;
++	struct completion               hpload_evt;
++	unsigned int                    hpload_stat;
++	u16                             hpload_dc[2];
++	u16                             dc_threshold[CS43130_DC_THRESHOLD];
++	u16                             ac_freq[CS43130_AC_FREQ];
++	u16                             hpload_ac[CS43130_AC_FREQ][2];
++	struct workqueue_struct         *wq;
++	struct work_struct              work;
++	struct snd_soc_jack             jack;
++};
++
++static const struct reg_default cs43130_reg_defaults[] = {
++	{CS43130_SYS_CLK_CTL_1, 0x06},
++	{CS43130_SP_SRATE, 0x01},
++	{CS43130_SP_BITSIZE, 0x05},
++	{CS43130_PAD_INT_CFG, 0x03},
++	{CS43130_PWDN_CTL, 0xFE},
++	{CS43130_CRYSTAL_SET, 0x04},
++	{CS43130_PLL_SET_1, 0x00},
++	{CS43130_PLL_SET_2, 0x00},
++	{CS43130_PLL_SET_3, 0x00},
++	{CS43130_PLL_SET_4, 0x00},
++	{CS43130_PLL_SET_5, 0x40},
++	{CS43130_PLL_SET_6, 0x10},
++	{CS43130_PLL_SET_7, 0x80},
++	{CS43130_PLL_SET_8, 0x03},
++	{CS43130_PLL_SET_9, 0x02},
++	{CS43130_PLL_SET_10, 0x02},
++	{CS43130_CLKOUT_CTL, 0x00},
++	{CS43130_ASP_NUM_1, 0x01},
++	{CS43130_ASP_NUM_2, 0x00},
++	{CS43130_ASP_DEN_1, 0x08},
++	{CS43130_ASP_DEN_2, 0x00},
++	{CS43130_ASP_LRCK_HI_TIME_1, 0x1F},
++	{CS43130_ASP_LRCK_HI_TIME_2, 0x00},
++	{CS43130_ASP_LRCK_PERIOD_1, 0x3F},
++	{CS43130_ASP_LRCK_PERIOD_2, 0x00},
++	{CS43130_ASP_CLOCK_CONF, 0x0C},
++	{CS43130_ASP_FRAME_CONF, 0x0A},
++	{CS43130_XSP_NUM_1, 0x01},
++	{CS43130_XSP_NUM_2, 0x00},
++	{CS43130_XSP_DEN_1, 0x02},
++	{CS43130_XSP_DEN_2, 0x00},
++	{CS43130_XSP_LRCK_HI_TIME_1, 0x1F},
++	{CS43130_XSP_LRCK_HI_TIME_2, 0x00},
++	{CS43130_XSP_LRCK_PERIOD_1, 0x3F},
++	{CS43130_XSP_LRCK_PERIOD_2, 0x00},
++	{CS43130_XSP_CLOCK_CONF, 0x0C},
++	{CS43130_XSP_FRAME_CONF, 0x0A},
++	{CS43130_ASP_CH_1_LOC, 0x00},
++	{CS43130_ASP_CH_2_LOC, 0x00},
++	{CS43130_ASP_CH_1_SZ_EN, 0x06},
++	{CS43130_ASP_CH_2_SZ_EN, 0x0E},
++	{CS43130_XSP_CH_1_LOC, 0x00},
++	{CS43130_XSP_CH_2_LOC, 0x00},
++	{CS43130_XSP_CH_1_SZ_EN, 0x06},
++	{CS43130_XSP_CH_2_SZ_EN, 0x0E},
++	{CS43130_DSD_VOL_B, 0x78},
++	{CS43130_DSD_VOL_A, 0x78},
++	{CS43130_DSD_PATH_CTL_1, 0xA8},
++	{CS43130_DSD_INT_CFG, 0x00},
++	{CS43130_DSD_PATH_CTL_2, 0x02},
++	{CS43130_DSD_PCM_MIX_CTL, 0x00},
++	{CS43130_DSD_PATH_CTL_3, 0x40},
++	{CS43130_HP_OUT_CTL_1, 0x30},
++	{CS43130_PCM_FILT_OPT, 0x02},
++	{CS43130_PCM_VOL_B, 0x78},
++	{CS43130_PCM_VOL_A, 0x78},
++	{CS43130_PCM_PATH_CTL_1, 0xA8},
++	{CS43130_PCM_PATH_CTL_2, 0x00},
++	{CS43130_CLASS_H_CTL, 0x1E},
++	{CS43130_HP_DETECT, 0x04},
++	{CS43130_HP_LOAD_1, 0x00},
++	{CS43130_HP_MEAS_LOAD_1, 0x00},
++	{CS43130_HP_MEAS_LOAD_2, 0x00},
++	{CS43130_INT_MASK_1, 0xFF},
++	{CS43130_INT_MASK_2, 0xFF},
++	{CS43130_INT_MASK_3, 0xFF},
++	{CS43130_INT_MASK_4, 0xFF},
++	{CS43130_INT_MASK_5, 0xFF},
++};
++static bool cs43130_volatile_register(struct device *dev, unsigned int reg)
++{
++	switch (reg) {
++	case CS43130_INT_STATUS_1 ... CS43130_INT_STATUS_5:
++	case CS43130_HP_DC_STAT_1 ... CS43130_HP_DC_STAT_2:
++	case CS43130_HP_AC_STAT_1 ... CS43130_HP_AC_STAT_2:
++		return true;
++	default:
++		return false;
++	}
++}
++
++static const char * const pcm_spd_texts[] = {
++	"Fast",
++	"Slow",
++};
++
++static SOC_ENUM_SINGLE_DECL(pcm_spd_enum, CS43130_PCM_FILT_OPT, 7,
++			pcm_spd_texts);
++
++static const SNDRV_CTL_TLVD_DECLARE_DB_MINMAX(master_tlv, -12750, 0);
++
++static const struct snd_kcontrol_new cs43130_controls[] = {
++	SOC_DOUBLE_R_TLV("Master Playback Volume", CS43130_PCM_VOL_B,
++			CS43130_PCM_VOL_A, 0, 255, 1, master_tlv),
++	SOC_DOUBLE("Master Playback Switch", CS43130_PCM_PATH_CTL_1,
++			0, 1, 1, 1),
++	SOC_DOUBLE_R_TLV("Digital Playback Volume", CS43130_DSD_VOL_B,
++			CS43130_DSD_VOL_A, 0, 255, 1, master_tlv),
++	SOC_DOUBLE("Digital Playback Switch", CS43130_DSD_PATH_CTL_1,
++			0, 1, 1, 1),
++	SOC_SINGLE("HV_Enable", CS43130_HP_OUT_CTL_1, 0, 1, 0),
++	SOC_ENUM("PCM Filter Speed", pcm_spd_enum),
++	SOC_SINGLE("PCM Phase Compensation", CS43130_PCM_FILT_OPT, 6, 1, 0),
++	SOC_SINGLE("PCM Nonoversample Emulate", CS43130_PCM_FILT_OPT, 5, 1, 0),
++	SOC_SINGLE("PCM High-pass Filter", CS43130_PCM_FILT_OPT, 1, 1, 0),
++	SOC_SINGLE("PCM De-emphasis Filter", CS43130_PCM_FILT_OPT, 0, 1, 0),
++};
++
++static bool cs43130_readable_register(struct device *dev, unsigned int reg)
++{
++	switch (reg) {
++	case CS43130_DEVID_AB ... CS43130_SYS_CLK_CTL_1:
++	case CS43130_SP_SRATE ... CS43130_PAD_INT_CFG:
++	case CS43130_PWDN_CTL:
++	case CS43130_CRYSTAL_SET:
++	case CS43130_PLL_SET_1 ... CS43130_PLL_SET_5:
++	case CS43130_PLL_SET_6:
++	case CS43130_PLL_SET_7:
++	case CS43130_PLL_SET_8:
++	case CS43130_PLL_SET_9:
++	case CS43130_PLL_SET_10:
++	case CS43130_CLKOUT_CTL:
++	case CS43130_ASP_NUM_1 ... CS43130_ASP_FRAME_CONF:
++	case CS43130_XSP_NUM_1 ... CS43130_XSP_FRAME_CONF:
++	case CS43130_ASP_CH_1_LOC:
++	case CS43130_ASP_CH_2_LOC:
++	case CS43130_ASP_CH_1_SZ_EN:
++	case CS43130_ASP_CH_2_SZ_EN:
++	case CS43130_XSP_CH_1_LOC:
++	case CS43130_XSP_CH_2_LOC:
++	case CS43130_XSP_CH_1_SZ_EN:
++	case CS43130_XSP_CH_2_SZ_EN:
++	case CS43130_DSD_VOL_B ... CS43130_DSD_PATH_CTL_3:
++	case CS43130_HP_OUT_CTL_1:
++	case CS43130_PCM_FILT_OPT ... CS43130_PCM_PATH_CTL_2:
++	case CS43130_CLASS_H_CTL:
++	case CS43130_HP_DETECT:
++	case CS43130_HP_STATUS:
++	case CS43130_HP_LOAD_1:
++	case CS43130_HP_MEAS_LOAD_1:
++	case CS43130_HP_MEAS_LOAD_2:
++	case CS43130_HP_DC_STAT_1:
++	case CS43130_HP_DC_STAT_2:
++	case CS43130_HP_AC_STAT_1:
++	case CS43130_HP_AC_STAT_2:
++	case CS43130_HP_LOAD_STAT:
++	case CS43130_INT_STATUS_1 ... CS43130_INT_STATUS_5:
++	case CS43130_INT_MASK_1 ... CS43130_INT_MASK_5:
++		return true;
++	default:
++		return false;
++	}
++}
++static bool cs43130_precious_register(struct device *dev, unsigned int reg)
++{
++	switch (reg) {
++	case CS43130_INT_STATUS_1 ... CS43130_INT_STATUS_5:
++		return true;
++	default:
++		return false;
++	}
++}
++static int cs43130_pcm_pdn(struct snd_soc_component *component)
++{
++	struct cs43130_priv *cs43130 =
++				snd_soc_component_get_drvdata(component);
++	int ret;
++	unsigned int reg, pdn_int;
++
++	regmap_write(cs43130->regmap, CS43130_DSD_PATH_CTL_2, 0x02);
++	regmap_update_bits(cs43130->regmap, CS43130_INT_MASK_1,
++			CS43130_PDN_DONE_INT_MASK, 0);
++	regmap_update_bits(cs43130->regmap, CS43130_PWDN_CTL,
++			CS43130_PDN_HP_MASK, 1 << CS43130_PDN_HP_SHIFT);
++	usleep_range(10, 50);
++	ret = regmap_read(cs43130->regmap, CS43130_INT_STATUS_1, &reg);
++	pdn_int = reg & 0xFE;
++	regmap_update_bits(cs43130->regmap, CS43130_PWDN_CTL,
++			CS43130_PDN_ASP_MASK, 1 << CS43130_PDN_ASP_SHIFT);
++	return 0;
++
++}
++static int cs43130_pwr_up_asp_dac(struct snd_soc_component *component)
++{
++	struct cs43130_priv *cs43130 =
++				snd_soc_component_get_drvdata(component);
++
++	regmap_update_bits(cs43130->regmap, CS43130_PAD_INT_CFG,
++			CS43130_ASP_3ST_MASK, 0);
++	regmap_write(cs43130->regmap, CS43130_DXD1, 0x99);
++	regmap_write(cs43130->regmap, CS43130_DXD13, 0x20);
++	regmap_update_bits(cs43130->regmap, CS43130_PWDN_CTL,
++			CS43130_PDN_ASP_MASK, 0);
++	regmap_update_bits(cs43130->regmap, CS43130_PWDN_CTL,
++			CS43130_PDN_HP_MASK, 0);
++	usleep_range(10000, 12000);
++	regmap_write(cs43130->regmap, CS43130_DXD1, 0x00);
++	regmap_write(cs43130->regmap, CS43130_DXD13, 0x00);
++	return 0;
++}
++static int cs43130_change_clksrc(struct snd_soc_component *component,
++				enum cs43130_mclk_src_sel src)
++{
++	int ret;
++	struct cs43130_priv *cs43130 =
++				snd_soc_component_get_drvdata(component);
++	int mclk_int_decoded;
++
++	if (src == cs43130->mclk_int_src) {
++		/* clk source has not changed */
++		return 0;
++	}
++	switch (cs43130->mclk_int) {
++	case CS43130_MCLK_22M:
++		mclk_int_decoded = CS43130_MCLK_22P5;
++		break;
++	case CS43130_MCLK_24M:
++		mclk_int_decoded = CS43130_MCLK_24P5;
++		break;
++	default:
++		dev_err(component->dev, "Invalid MCLK INT freq: %u\n",
++			cs43130->mclk_int);
++		return -EINVAL;
++	}
++
++	switch (src) {
++	case CS43130_MCLK_SRC_EXT:
++		cs43130->pll_bypass = true;
++		cs43130->mclk_int_src = CS43130_MCLK_SRC_EXT;
++		if (cs43130->xtal_ibias == CS43130_XTAL_UNUSED) {
++			regmap_update_bits(cs43130->regmap, CS43130_PWDN_CTL,
++					CS43130_PDN_XTAL_MASK,
++					1 << CS43130_PDN_XTAL_SHIFT);
++		} else {
++			reinit_completion(&cs43130->xtal_rdy);
++			regmap_update_bits(cs43130->regmap, CS43130_INT_MASK_1,
++					CS43130_XTAL_RDY_INT_MASK, 0);
++			regmap_update_bits(cs43130->regmap, CS43130_PWDN_CTL,
++					CS43130_PDN_XTAL_MASK, 0);
++			ret = wait_for_completion_timeout(&cs43130->xtal_rdy,
++					msecs_to_jiffies(100));
++			regmap_update_bits(cs43130->regmap, CS43130_INT_MASK_1,
++					CS43130_XTAL_RDY_INT_MASK,
++					1 << CS43130_XTAL_RDY_INT_SHIFT);
++			if (ret == 0) {
++				dev_err(component->dev, "Timeout waiting for XTAL_READY interrupt\n");
++				return -ETIMEDOUT;
++			}
++		}
++	regmap_update_bits(cs43130->regmap, CS43130_SYS_CLK_CTL_1,
++				CS43130_MCLK_SRC_SEL_MASK,
++				src << CS43130_MCLK_SRC_SEL_SHIFT);
++	regmap_update_bits(cs43130->regmap, CS43130_SYS_CLK_CTL_1,
++				CS43130_MCLK_INT_MASK,
++				mclk_int_decoded << CS43130_MCLK_INT_SHIFT);
++	usleep_range(150, 200);
++	regmap_update_bits(cs43130->regmap, CS43130_PWDN_CTL,
++				CS43130_PDN_PLL_MASK,
++				1 << CS43130_PDN_PLL_SHIFT);
++	break;
++	case CS43130_MCLK_SRC_RCO:
++		cs43130->mclk_int_src = CS43130_MCLK_SRC_RCO;
++
++		regmap_update_bits(cs43130->regmap, CS43130_SYS_CLK_CTL_1,
++				CS43130_MCLK_SRC_SEL_MASK,
++				src << CS43130_MCLK_SRC_SEL_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_SYS_CLK_CTL_1,
++				CS43130_MCLK_INT_MASK,
++				CS43130_MCLK_22P5 << CS43130_MCLK_INT_SHIFT);
++		usleep_range(150, 200);
++		regmap_update_bits(cs43130->regmap, CS43130_PWDN_CTL,
++				CS43130_PDN_XTAL_MASK,
++				1 << CS43130_PDN_XTAL_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_PWDN_CTL,
++				CS43130_PDN_PLL_MASK,
++				1 << CS43130_PDN_PLL_SHIFT);
++	break;
++	default:
++		dev_err(component->dev, "Invalid MCLK source value\n");
++		return -EINVAL;
++	}
++
++	return 0;
++}
++static const struct cs43130_bitwidth_map cs43130_bitwidth_table[] = {
++	{8,     CS43130_SP_BIT_SIZE_8,  CS43130_CH_BIT_SIZE_8},
++	{16,    CS43130_SP_BIT_SIZE_16, CS43130_CH_BIT_SIZE_16},
++	{24,    CS43130_SP_BIT_SIZE_24, CS43130_CH_BIT_SIZE_24},
++	{32,    CS43130_SP_BIT_SIZE_32, CS43130_CH_BIT_SIZE_32},
++};
++
++static const struct cs43130_bitwidth_map *cs43130_get_bitwidth_table(
++					unsigned int bitwidth)
++{
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(cs43130_bitwidth_table); i++) {
++		if (cs43130_bitwidth_table[i].bitwidth == bitwidth)
++			return &cs43130_bitwidth_table[i];
++	}
++
++	return NULL;
++}
++static int cs43130_set_bitwidth(int dai_id, unsigned int bitwidth_dai,
++				struct regmap *regmap)
++{
++	const struct cs43130_bitwidth_map *bw_map;
++
++	bw_map = cs43130_get_bitwidth_table(bitwidth_dai);
++	if (!bw_map)
++		return -EINVAL;
++
++	switch (dai_id) {
++	case CS43130_ASP_PCM_DAI:
++	case CS43130_ASP_DOP_DAI:
++		regmap_update_bits(regmap, CS43130_ASP_CH_1_SZ_EN,
++				CS43130_CH_BITSIZE_MASK, bw_map->ch_bit);
++		regmap_update_bits(regmap, CS43130_ASP_CH_2_SZ_EN,
++				CS43130_CH_BITSIZE_MASK, bw_map->ch_bit);
++		regmap_update_bits(regmap, CS43130_SP_BITSIZE,
++				CS43130_ASP_BITSIZE_MASK, bw_map->sp_bit);
++		break;
++	case CS43130_XSP_DOP_DAI:
++		regmap_update_bits(regmap, CS43130_XSP_CH_1_SZ_EN,
++				CS43130_CH_BITSIZE_MASK, bw_map->ch_bit);
++		regmap_update_bits(regmap, CS43130_XSP_CH_2_SZ_EN,
++				CS43130_CH_BITSIZE_MASK, bw_map->ch_bit);
++		regmap_update_bits(regmap, CS43130_SP_BITSIZE,
++				CS43130_XSP_BITSIZE_MASK, bw_map->sp_bit <<
++				CS43130_XSP_BITSIZE_SHIFT);
++	break;
++	default:
++		return -EINVAL;
++	}
++
++	return 0;
++}
++static const struct cs43130_rate_map cs43130_rate_table[] = {
++	{32000,         CS43130_ASP_SPRATE_32K},
++	{44100,         CS43130_ASP_SPRATE_44_1K},
++	{48000,         CS43130_ASP_SPRATE_48K},
++	{88200,         CS43130_ASP_SPRATE_88_2K},
++	{96000,         CS43130_ASP_SPRATE_96K},
++	{176400,        CS43130_ASP_SPRATE_176_4K},
++	{192000,        CS43130_ASP_SPRATE_192K},
++	{352800,        CS43130_ASP_SPRATE_352_8K},
++	{384000,        CS43130_ASP_SPRATE_384K},
++};
++
++static const struct cs43130_rate_map *cs43130_get_rate_table(int fs)
++{
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(cs43130_rate_table); i++) {
++		if (cs43130_rate_table[i].fs == fs)
++			return &cs43130_rate_table[i];
++	}
++
++	return NULL;
++}
++
++static const struct cs43130_clk_gen *cs43130_get_clk_gen(int mclk_int, int fs,
++	const struct cs43130_clk_gen *clk_gen_table, int len_clk_gen_table)
++{
++	int i;
++
++	for (i = 0; i < len_clk_gen_table; i++) {
++		if (clk_gen_table[i].mclk_int == mclk_int &&
++					clk_gen_table[i].fs == fs)
++			return &clk_gen_table[i];
++	}
++	return NULL;
++}
++
++static int cs43130_set_sp_fmt(int dai_id, unsigned int bitwidth_sclk,
++				struct snd_pcm_hw_params *params,
++				struct cs43130_priv *cs43130)
++{
++	u16 frm_size;
++	u16 hi_size;
++	u8 frm_delay;
++	u8 frm_phase;
++	u8 frm_data;
++	u8 sclk_edge;
++	u8 lrck_edge;
++	u8 clk_data;
++	u8 loc_ch1;
++	u8 loc_ch2;
++	u8 dai_mode_val;
++	const struct cs43130_clk_gen *clk_gen;
++
++	switch (cs43130->dais[dai_id].dai_format) {
++	case SND_SOC_DAIFMT_I2S:
++		hi_size = bitwidth_sclk;
++		frm_delay = 2;
++		frm_phase = 0;
++		break;
++	case SND_SOC_DAIFMT_LEFT_J:
++		hi_size = bitwidth_sclk;
++		frm_delay = 2;
++		frm_phase = 1;
++		break;
++	case SND_SOC_DAIFMT_DSP_A:
++		hi_size = 1;
++		frm_delay = 2;
++		frm_phase = 1;
++		break;
++	case SND_SOC_DAIFMT_DSP_B:
++		hi_size = 1;
++		frm_delay = 0;
++		frm_phase = 1;
++		break;
++	default:
++		return -EINVAL;
++	}
++	switch (cs43130->dais[dai_id].dai_mode) {
++	case SND_SOC_DAIFMT_CBS_CFS:
++		dai_mode_val = 0;
++		break;
++	case SND_SOC_DAIFMT_CBM_CFM:
++		dai_mode_val = 1;
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	frm_size = bitwidth_sclk * params_channels(params);
++	sclk_edge = 1;
++	lrck_edge = 0;
++	loc_ch1 = 0;
++	loc_ch2 = bitwidth_sclk * (params_channels(params) - 1);
++
++	frm_data = frm_delay & CS43130_SP_FSD_MASK;
++	frm_data |= (frm_phase << CS43130_SP_STP_SHIFT) & CS43130_SP_STP_MASK;
++
++	clk_data = lrck_edge & CS43130_SP_LCPOL_IN_MASK;
++	clk_data |= (lrck_edge << CS43130_SP_LCPOL_OUT_SHIFT) &
++			CS43130_SP_LCPOL_OUT_MASK;
++	clk_data |= (sclk_edge << CS43130_SP_SCPOL_IN_SHIFT) &
++			CS43130_SP_SCPOL_IN_MASK;
++	clk_data |= (sclk_edge << CS43130_SP_SCPOL_OUT_SHIFT) &
++			CS43130_SP_SCPOL_OUT_MASK;
++	clk_data |= (dai_mode_val << CS43130_SP_MODE_SHIFT) &
++			CS43130_SP_MODE_MASK;
++	switch (dai_id) {
++	case CS43130_ASP_PCM_DAI:
++	case CS43130_ASP_DOP_DAI:
++		regmap_update_bits(cs43130->regmap, CS43130_ASP_LRCK_PERIOD_1,
++			CS43130_SP_LCPR_DATA_MASK, (frm_size - 1) >>
++			CS43130_SP_LCPR_LSB_DATA_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_ASP_LRCK_PERIOD_2,
++			CS43130_SP_LCPR_DATA_MASK, (frm_size - 1) >>
++			CS43130_SP_LCPR_MSB_DATA_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_ASP_LRCK_HI_TIME_1,
++			CS43130_SP_LCHI_DATA_MASK, (hi_size - 1) >>
++			CS43130_SP_LCHI_LSB_DATA_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_ASP_LRCK_HI_TIME_2,
++			CS43130_SP_LCHI_DATA_MASK, (hi_size - 1) >>
++			CS43130_SP_LCHI_MSB_DATA_SHIFT);
++		regmap_write(cs43130->regmap, CS43130_ASP_FRAME_CONF, frm_data);
++		regmap_write(cs43130->regmap, CS43130_ASP_CH_1_LOC, loc_ch1);
++		regmap_write(cs43130->regmap, CS43130_ASP_CH_2_LOC, loc_ch2);
++		regmap_update_bits(cs43130->regmap, CS43130_ASP_CH_1_SZ_EN,
++			CS43130_CH_EN_MASK, 1 << CS43130_CH_EN_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_ASP_CH_2_SZ_EN,
++			CS43130_CH_EN_MASK, 1 << CS43130_CH_EN_SHIFT);
++		regmap_write(cs43130->regmap, CS43130_ASP_CLOCK_CONF, clk_data);
++		break;
++	case CS43130_XSP_DOP_DAI:
++		regmap_update_bits(cs43130->regmap, CS43130_XSP_LRCK_PERIOD_1,
++			CS43130_SP_LCPR_DATA_MASK, (frm_size - 1) >>
++			CS43130_SP_LCPR_LSB_DATA_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_XSP_LRCK_PERIOD_2,
++			CS43130_SP_LCPR_DATA_MASK, (frm_size - 1) >>
++			CS43130_SP_LCPR_MSB_DATA_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_XSP_LRCK_HI_TIME_1,
++			CS43130_SP_LCHI_DATA_MASK, (hi_size - 1) >>
++			CS43130_SP_LCHI_LSB_DATA_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_XSP_LRCK_HI_TIME_2,
++			CS43130_SP_LCHI_DATA_MASK, (hi_size - 1) >>
++			CS43130_SP_LCHI_MSB_DATA_SHIFT);
++		regmap_write(cs43130->regmap, CS43130_XSP_FRAME_CONF, frm_data);
++		regmap_write(cs43130->regmap, CS43130_XSP_CH_1_LOC, loc_ch1);
++		regmap_write(cs43130->regmap, CS43130_XSP_CH_2_LOC, loc_ch2);
++		regmap_update_bits(cs43130->regmap, CS43130_XSP_CH_1_SZ_EN,
++			CS43130_CH_EN_MASK, 1 << CS43130_CH_EN_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_XSP_CH_2_SZ_EN,
++			CS43130_CH_EN_MASK, 1 << CS43130_CH_EN_SHIFT);
++		regmap_write(cs43130->regmap, CS43130_XSP_CLOCK_CONF, clk_data);
++		break;
++	default:
++		return -EINVAL;
++	}
++	switch (frm_size) {
++	case 16:
++		clk_gen = cs43130_get_clk_gen(cs43130->mclk_int,
++						params_rate(params),
++						cs43130_16_clk_gen,
++						ARRAY_SIZE(cs43130_16_clk_gen));
++		break;
++	case 32:
++		clk_gen = cs43130_get_clk_gen(cs43130->mclk_int,
++						params_rate(params),
++						cs43130_32_clk_gen,
++						ARRAY_SIZE(cs43130_32_clk_gen));
++		break;
++	case 48:
++		clk_gen = cs43130_get_clk_gen(cs43130->mclk_int,
++						params_rate(params),
++						cs43130_48_clk_gen,
++						ARRAY_SIZE(cs43130_48_clk_gen));
++		break;
++	case 64:
++		clk_gen = cs43130_get_clk_gen(cs43130->mclk_int,
++						params_rate(params),
++						cs43130_64_clk_gen,
++						ARRAY_SIZE(cs43130_64_clk_gen));
++		break;
++	default:
++		return -EINVAL;
++	}
++	if (!clk_gen)
++		return -EINVAL;
++	switch (dai_id) {
++	case CS43130_ASP_PCM_DAI:
++	case CS43130_ASP_DOP_DAI:
++		regmap_write(cs43130->regmap, CS43130_ASP_DEN_1,
++				(clk_gen->v.denominator & CS43130_SP_M_LSB_DATA_MASK) >>
++				CS43130_SP_M_LSB_DATA_SHIFT);
++		regmap_write(cs43130->regmap, CS43130_ASP_DEN_2,
++				(clk_gen->v.denominator & CS43130_SP_M_MSB_DATA_MASK) >>
++				CS43130_SP_M_MSB_DATA_SHIFT);
++		regmap_write(cs43130->regmap, CS43130_ASP_NUM_1,
++				(clk_gen->v.numerator & CS43130_SP_N_LSB_DATA_MASK) >>
++				CS43130_SP_N_LSB_DATA_SHIFT);
++		regmap_write(cs43130->regmap, CS43130_ASP_NUM_2,
++				(clk_gen->v.numerator & CS43130_SP_N_MSB_DATA_MASK) >>
++				CS43130_SP_N_MSB_DATA_SHIFT);
++		break;
++	case CS43130_XSP_DOP_DAI:
++		regmap_write(cs43130->regmap, CS43130_XSP_DEN_1,
++				(clk_gen->v.denominator & CS43130_SP_M_LSB_DATA_MASK) >>
++				CS43130_SP_M_LSB_DATA_SHIFT);
++		regmap_write(cs43130->regmap, CS43130_XSP_DEN_2,
++				(clk_gen->v.denominator & CS43130_SP_M_MSB_DATA_MASK) >>
++				CS43130_SP_M_MSB_DATA_SHIFT);
++		regmap_write(cs43130->regmap, CS43130_XSP_NUM_1,
++				(clk_gen->v.numerator & CS43130_SP_N_LSB_DATA_MASK) >>
++				CS43130_SP_N_LSB_DATA_SHIFT);
++		regmap_write(cs43130->regmap, CS43130_XSP_NUM_2,
++				(clk_gen->v.numerator & CS43130_SP_N_MSB_DATA_MASK) >>
++				CS43130_SP_N_MSB_DATA_SHIFT);
++		break;
++	default:
++		return -EINVAL;
++	}
++	return 0;
++}
++
++static int cs43130_hw_params(struct snd_pcm_substream *substream,
++				struct snd_pcm_hw_params *params,
++				struct snd_soc_dai *dai)
++{
++	struct snd_soc_component *component = dai->component;
++	struct cs43130_priv *cs43130 =
++				snd_soc_component_get_drvdata(component);
++	const struct cs43130_rate_map *rate_map;
++	unsigned int sclk = cs43130->dais[dai->id].sclk;
++	unsigned int bitwidth_sclk;
++	unsigned int bitwidth_dai = (unsigned int)(params_width(params));
++	unsigned int dop_rate = (unsigned int)(params_rate(params));
++	unsigned int required_clk, ret;
++	u8 dsd_speed;
++
++	cs43130->pll_bypass = true;
++	cs43130_pcm_pdn(component);
++	mutex_lock(&cs43130->clk_mutex);
++	if (!cs43130->clk_req) {
++		/* no DAI is currently using clk */
++		if (!(CS43130_MCLK_22M % params_rate(params))) {
++			required_clk = CS43130_MCLK_22M;
++			cs43130->mclk_int =  CS43130_MCLK_22M;
++			gpiod_set_value_cansleep(snd_allo_clk44gpio, 1);
++			gpiod_set_value_cansleep(snd_allo_clk48gpio, 0);
++			usleep_range(13500, 14000);
++		} else {
++			required_clk = CS43130_MCLK_24M;
++			cs43130->mclk_int =  CS43130_MCLK_24M;
++			gpiod_set_value_cansleep(snd_allo_clk48gpio, 1);
++			gpiod_set_value_cansleep(snd_allo_clk44gpio, 0);
++			usleep_range(13500, 14000);
++		}
++		if (cs43130->pll_bypass)
++			cs43130_change_clksrc(component, CS43130_MCLK_SRC_EXT);
++		else
++			cs43130_change_clksrc(component, CS43130_MCLK_SRC_PLL);
++	}
++
++	cs43130->clk_req++;
++	mutex_unlock(&cs43130->clk_mutex);
++
++	switch (dai->id) {
++	case CS43130_ASP_DOP_DAI:
++	case CS43130_XSP_DOP_DAI:
++		/* DoP bitwidth is always 24-bit */
++		bitwidth_dai = 24;
++		sclk = params_rate(params) * bitwidth_dai *
++				params_channels(params);
++
++		switch (params_rate(params)) {
++		case 176400:
++			dsd_speed = 0;
++			break;
++		case 352800:
++			dsd_speed = 1;
++			break;
++		default:
++			dev_err(component->dev, "Rate(%u) not supported\n",
++				params_rate(params));
++			return -EINVAL;
++		}
++
++		regmap_update_bits(cs43130->regmap, CS43130_DSD_PATH_CTL_2,
++					CS43130_DSD_SPEED_MASK,
++					dsd_speed << CS43130_DSD_SPEED_SHIFT);
++		break;
++	case CS43130_ASP_PCM_DAI:
++		rate_map = cs43130_get_rate_table(params_rate(params));
++		if (!rate_map)
++			return -EINVAL;
++
++		regmap_write(cs43130->regmap, CS43130_SP_SRATE, rate_map->val);
++		if ((dop_rate == 176400) && (bitwidth_dai == 24)) {
++			dsd_speed = 0;
++			regmap_update_bits(cs43130->regmap,
++					CS43130_DSD_PATH_CTL_2,
++					CS43130_DSD_SPEED_MASK,
++					dsd_speed << CS43130_DSD_SPEED_SHIFT);
++			regmap_update_bits(cs43130->regmap,
++					CS43130_DSD_PATH_CTL_2,
++					CS43130_DSD_SRC_MASK,
++					CS43130_DSD_SRC_ASP <<
++					CS43130_DSD_SRC_SHIFT);
++			regmap_update_bits(cs43130->regmap,
++					CS43130_DSD_PATH_CTL_2,
++					CS43130_DSD_EN_MASK, 0x01 <<
++					CS43130_DSD_EN_SHIFT);
++		}
++		break;
++	default:
++		dev_err(component->dev, "Invalid DAI (%d)\n", dai->id);
++		return -EINVAL;
++	}
++
++	switch (dai->id) {
++	case CS43130_ASP_DOP_DAI:
++		regmap_update_bits(cs43130->regmap, CS43130_DSD_PATH_CTL_2,
++				CS43130_DSD_SRC_MASK, CS43130_DSD_SRC_ASP <<
++				CS43130_DSD_SRC_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_DSD_PATH_CTL_2,
++				CS43130_DSD_EN_MASK, 0x01 <<
++				CS43130_DSD_EN_SHIFT);
++		break;
++	case CS43130_XSP_DOP_DAI:
++		regmap_update_bits(cs43130->regmap, CS43130_DSD_PATH_CTL_2,
++				CS43130_DSD_SRC_MASK, CS43130_DSD_SRC_XSP <<
++				CS43130_DSD_SRC_SHIFT);
++		break;
++	}
++	if (!sclk && cs43130->dais[dai->id].dai_mode ==
++						SND_SOC_DAIFMT_CBM_CFM) {
++		/* Calculate SCLK in master mode if unassigned */
++		sclk = params_rate(params) * bitwidth_dai *
++				params_channels(params);
++	}
++	if (!sclk) {
++		/* at this point, SCLK must be set */
++		dev_err(component->dev, "SCLK freq is not set\n");
++		return -EINVAL;
++	}
++
++	bitwidth_sclk = (sclk / params_rate(params)) / params_channels(params);
++	if (bitwidth_sclk < bitwidth_dai) {
++		dev_err(component->dev, "Format not supported: SCLK freq is too low\n");
++		return -EINVAL;
++	}
++
++	dev_dbg(component->dev,
++		"sclk = %u, fs = %d, bitwidth_dai = %u\n",
++		sclk, params_rate(params), bitwidth_dai);
++
++	dev_dbg(component->dev,
++		"bitwidth_sclk = %u, num_ch = %u\n",
++		bitwidth_sclk, params_channels(params));
++
++	cs43130_set_bitwidth(dai->id, bitwidth_dai, cs43130->regmap);
++	cs43130_set_sp_fmt(dai->id, bitwidth_sclk, params, cs43130);
++	ret = cs43130_pwr_up_asp_dac(component);
++	return 0;
++}
++
++static int cs43130_hw_free(struct snd_pcm_substream *substream,
++					struct snd_soc_dai *dai)
++{
++	struct snd_soc_component *component = dai->component;
++	struct cs43130_priv *cs43130 =
++				snd_soc_component_get_drvdata(component);
++
++	mutex_lock(&cs43130->clk_mutex);
++	cs43130->clk_req--;
++	if (!cs43130->clk_req) {
++		/* no DAI is currently using clk */
++		cs43130_change_clksrc(component, CS43130_MCLK_SRC_RCO);
++		cs43130_pcm_pdn(component);
++	}
++	mutex_unlock(&cs43130->clk_mutex);
++
++	return 0;
++}
++
++static const unsigned int cs43130_asp_src_rates[] = {
++	32000, 44100, 48000, 88200, 96000, 176400, 192000
++};
++
++static const struct snd_pcm_hw_constraint_list cs43130_asp_constraints = {
++	.count  = ARRAY_SIZE(cs43130_asp_src_rates),
++	.list   = cs43130_asp_src_rates,
++};
++
++static int cs43130_pcm_startup(struct snd_pcm_substream *substream,
++					struct snd_soc_dai *dai)
++{
++	return snd_pcm_hw_constraint_list(substream->runtime, 0,
++					SNDRV_PCM_HW_PARAM_RATE,
++					&cs43130_asp_constraints);
++}
++
++static int cs43130_pcm_set_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
++{
++	struct snd_soc_component *component = codec_dai->component;
++	struct cs43130_priv *cs43130 =
++				snd_soc_component_get_drvdata(component);
++
++	switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
++	case SND_SOC_DAIFMT_CBS_CFS:
++		cs43130->dais[codec_dai->id].dai_mode = SND_SOC_DAIFMT_CBS_CFS;
++		break;
++	case SND_SOC_DAIFMT_CBM_CFM:
++		cs43130->dais[codec_dai->id].dai_mode = SND_SOC_DAIFMT_CBM_CFM;
++		break;
++	default:
++		dev_err(component->dev, "unsupported mode\n");
++		return -EINVAL;
++	}
++
++	switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
++	case SND_SOC_DAIFMT_I2S:
++		cs43130->dais[codec_dai->id].dai_format = SND_SOC_DAIFMT_I2S;
++		break;
++	case SND_SOC_DAIFMT_LEFT_J:
++		cs43130->dais[codec_dai->id].dai_format = SND_SOC_DAIFMT_LEFT_J;
++		break;
++	default:
++		dev_err(component->dev,
++			"unsupported audio format\n");
++		return -EINVAL;
++	}
++
++	dev_dbg(component->dev, "dai_id = %d,  dai_mode = %u, dai_format = %u\n",
++			codec_dai->id,
++			cs43130->dais[codec_dai->id].dai_mode,
++			cs43130->dais[codec_dai->id].dai_format);
++
++	return 0;
++}
++
++static int cs43130_set_sysclk(struct snd_soc_dai *codec_dai,
++					int clk_id, unsigned int freq, int dir)
++{
++	struct snd_soc_component *component = codec_dai->component;
++	struct cs43130_priv *cs43130 =
++				snd_soc_component_get_drvdata(component);
++
++	cs43130->dais[codec_dai->id].sclk = freq;
++	dev_dbg(component->dev, "dai_id = %d,  sclk = %u\n", codec_dai->id,
++				cs43130->dais[codec_dai->id].sclk);
++
++	return 0;
++}
++
++static int cs43130_component_set_sysclk(struct snd_soc_component *component,
++					int clk_id, int source,
++					unsigned int freq, int dir)
++{
++	struct cs43130_priv *cs43130 =
++				snd_soc_component_get_drvdata(component);
++
++	dev_dbg(component->dev, "clk_id = %d, source = %d, freq = %d, dir = %d\n",
++		clk_id, source, freq, dir);
++
++	switch (freq) {
++	case CS43130_MCLK_22M:
++	case CS43130_MCLK_24M:
++		cs43130->mclk = freq;
++		break;
++	default:
++		dev_err(component->dev, "Invalid MCLK INT freq: %u\n", freq);
++		return -EINVAL;
++	}
++
++	if (source == CS43130_MCLK_SRC_EXT) {
++		cs43130->pll_bypass = true;
++	} else {
++		dev_err(component->dev, "Invalid MCLK source\n");
++		return -EINVAL;
++	}
++
++	return 0;
++}
++static u16 const cs43130_ac_freq[CS43130_AC_FREQ] = {
++	24,
++	43,
++	93,
++	200,
++	431,
++	928,
++	2000,
++	4309,
++	9283,
++	20000,
++};
++static const struct snd_soc_dai_ops cs43130_dai_ops = {
++	.startup        = cs43130_pcm_startup,
++	.hw_params	= cs43130_hw_params,
++	.hw_free        = cs43130_hw_free,
++	.set_sysclk     = cs43130_set_sysclk,
++	.set_fmt        = cs43130_pcm_set_fmt,
++};
++
++static struct snd_soc_dai_driver cs43130_codec_dai = {
++	.name = "allo-cs43130",
++	.playback = {
++		.stream_name = "Playback",
++		.channels_min = 2,
++		.channels_max = 2,
++		.rates = SNDRV_PCM_RATE_CONTINUOUS,
++		.rate_min = 44100,
++		.rate_max = 192000,
++		.formats = SNDRV_PCM_FMTBIT_S16_LE |
++			SNDRV_PCM_FMTBIT_S24_LE |
++			SNDRV_PCM_FMTBIT_S32_LE
++
++	},
++	.ops = &cs43130_dai_ops,
++};
++
++static struct snd_soc_component_driver cs43130_component_driver = {
++	.idle_bias_on           = true,
++	.controls		= cs43130_controls,
++	.num_controls		= ARRAY_SIZE(cs43130_controls),
++	.set_sysclk             = cs43130_component_set_sysclk,
++	.idle_bias_on           = 1,
++	.use_pmdown_time        = 1,
++	.endianness             = 1,
++};
++
++static const struct regmap_config cs43130_regmap = {
++	.reg_bits               = 24,
++	.pad_bits               = 8,
++	.val_bits               = 8,
++
++	.max_register           = CS43130_LASTREG,
++	.reg_defaults           = cs43130_reg_defaults,
++	.num_reg_defaults       = ARRAY_SIZE(cs43130_reg_defaults),
++	.readable_reg           = cs43130_readable_register,
++	.precious_reg           = cs43130_precious_register,
++	.volatile_reg           = cs43130_volatile_register,
++	.cache_type             = REGCACHE_RBTREE,
++	/* needed for regcache_sync */
++	.use_single_read        = true,
++	.use_single_write       = true,
++};
++
++static u16 const cs43130_dc_threshold[CS43130_DC_THRESHOLD] = {
++	50,
++	120,
++};
++
++static int cs43130_handle_device_data(struct i2c_client *i2c_client,
++					struct cs43130_priv *cs43130)
++{
++	struct device_node *np = i2c_client->dev.of_node;
++	unsigned int val;
++	int i;
++
++	if (of_property_read_u32(np, "cirrus,xtal-ibias", &val) < 0) {
++	/* Crystal is unused. System clock is used for external MCLK */
++		cs43130->xtal_ibias = CS43130_XTAL_UNUSED;
++		return 0;
++	}
++
++	switch (val) {
++	case 1:
++		cs43130->xtal_ibias = CS43130_XTAL_IBIAS_7_5UA;
++		break;
++	case 2:
++		cs43130->xtal_ibias = CS43130_XTAL_IBIAS_12_5UA;
++		break;
++	case 3:
++		cs43130->xtal_ibias = CS43130_XTAL_IBIAS_15UA;
++		break;
++	default:
++		dev_err(&i2c_client->dev,
++			"Invalid cirrus,xtal-ibias value: %d\n", val);
++		return -EINVAL;
++	}
++
++	cs43130->dc_meas = of_property_read_bool(np, "cirrus,dc-measure");
++	cs43130->ac_meas = of_property_read_bool(np, "cirrus,ac-measure");
++
++	if (of_property_read_u16_array(np, "cirrus,ac-freq", cs43130->ac_freq,
++					CS43130_AC_FREQ) < 0) {
++		for (i = 0; i < CS43130_AC_FREQ; i++)
++			cs43130->ac_freq[i] = cs43130_ac_freq[i];
++	}
++
++	if (of_property_read_u16_array(np, "cirrus,dc-threshold",
++					cs43130->dc_threshold,
++					CS43130_DC_THRESHOLD) < 0) {
++		for (i = 0; i < CS43130_DC_THRESHOLD; i++)
++			cs43130->dc_threshold[i] = cs43130_dc_threshold[i];
++	}
++
++	return 0;
++}
++
++
++static int allo_cs43130_component_probe(struct i2c_client *i2c,
++			     const struct i2c_device_id *id)
++{
++	struct regmap *regmap;
++	struct regmap_config config = cs43130_regmap;
++	struct device *dev = &i2c->dev;
++	struct cs43130_priv *cs43130;
++	unsigned int devid = 0;
++	unsigned int reg;
++	int ret;
++
++	regmap = devm_regmap_init_i2c(i2c, &config);
++	if (IS_ERR(regmap))
++		return PTR_ERR(regmap);
++
++	cs43130 = devm_kzalloc(dev, sizeof(struct cs43130_priv),
++					GFP_KERNEL);
++	if (!cs43130)
++		return -ENOMEM;
++
++	dev_set_drvdata(dev, cs43130);
++	cs43130->regmap = regmap;
++
++	if (i2c->dev.of_node) {
++		ret = cs43130_handle_device_data(i2c, cs43130);
++		if (ret != 0)
++			return ret;
++	}
++	usleep_range(2000, 2050);
++
++	ret = regmap_read(cs43130->regmap, CS43130_DEVID_AB, &reg);
++	devid = (reg & 0xFF) << 12;
++	ret = regmap_read(cs43130->regmap, CS43130_DEVID_CD, &reg);
++	devid |= (reg & 0xFF) << 4;
++	ret = regmap_read(cs43130->regmap, CS43130_DEVID_E, &reg);
++	devid |= (reg & 0xF0) >> 4;
++	if (devid != CS43198_CHIP_ID) {
++		dev_err(dev, "Failed to read Chip or wrong Chip id: %d\n", ret);
++		return ret;
++	}
++
++	cs43130->mclk_int_src = CS43130_MCLK_SRC_RCO;
++	msleep(20);
++
++	ret = snd_soc_register_component(dev, &cs43130_component_driver,
++				    &cs43130_codec_dai, 1);
++	if (ret != 0) {
++		dev_err(dev, "failed to register codec: %d\n", ret);
++		return ret;
++	}
++	regmap_update_bits(cs43130->regmap, CS43130_PAD_INT_CFG,
++			CS43130_ASP_3ST_MASK, 0);
++	regmap_update_bits(cs43130->regmap, CS43130_PAD_INT_CFG,
++			CS43130_XSP_3ST_MASK, 1);
++	regmap_update_bits(cs43130->regmap, CS43130_PWDN_CTL,
++			CS43130_PDN_HP_MASK, 1 << CS43130_PDN_HP_SHIFT);
++	msleep(20);
++	regmap_write(cs43130->regmap, CS43130_CLASS_H_CTL, 0x06);
++	snd_allo_clk44gpio = devm_gpiod_get(dev, "clock44", GPIOD_OUT_HIGH);
++	if (IS_ERR(snd_allo_clk44gpio))
++		dev_err(dev, "devm_gpiod_get() failed\n");
++
++	snd_allo_clk48gpio = devm_gpiod_get(dev, "clock48", GPIOD_OUT_LOW);
++	if (IS_ERR(snd_allo_clk48gpio))
++		dev_err(dev, "devm_gpiod_get() failed\n");
++
++	return 0;
++}
++
++static void allo_cs43130_component_remove(struct i2c_client *i2c)
++{
++	snd_soc_unregister_component(&i2c->dev);
++}
++
++static const struct i2c_device_id allo_cs43130_component_id[] = {
++	{ "allo-cs43198", },
++	{ }
++};
++MODULE_DEVICE_TABLE(i2c, allo_cs43130_component_id);
++
++static const struct of_device_id allo_cs43130_codec_of_match[] = {
++	{ .compatible = "allo,allo-cs43198", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, allo_cs43130_codec_of_match);
++
++static struct i2c_driver allo_cs43130_component_driver = {
++	.probe		= allo_cs43130_component_probe,
++	.remove		= allo_cs43130_component_remove,
++	.id_table	= allo_cs43130_component_id,
++	.driver		= {
++	.name		= "allo-cs43198",
++	.of_match_table = allo_cs43130_codec_of_match,
++	},
++};
++
++module_i2c_driver(allo_cs43130_component_driver);
++
++MODULE_DESCRIPTION("ASoC Allo Boss2 Codec Driver");
++MODULE_AUTHOR("Sudeepkumar <sudeepkumar@cem-solutions.net>");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/allo-katana-codec.c
+@@ -0,0 +1,387 @@
++/*
++ * Driver for the ALLO KATANA CODEC
++ *
++ * Author: Jaikumar <jaikumar@cem-solutions.net>
++ *		Copyright 2018
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/clk.h>
++#include <linux/kernel.h>
++#include <linux/regmap.h>
++#include <linux/regulator/consumer.h>
++#include <linux/gcd.h>
++#include <sound/soc.h>
++#include <sound/soc-dapm.h>
++#include <sound/pcm_params.h>
++#include <sound/tlv.h>
++#include <linux/i2c.h>
++
++
++#define KATANA_CODEC_CHIP_ID		0x30
++#define KATANA_CODEC_VIRT_BASE		0x100
++#define KATANA_CODEC_PAGE		0
++
++#define KATANA_CODEC_CHIP_ID_REG	(KATANA_CODEC_VIRT_BASE + 0)
++#define KATANA_CODEC_RESET		(KATANA_CODEC_VIRT_BASE + 1)
++#define KATANA_CODEC_VOLUME_1		(KATANA_CODEC_VIRT_BASE + 2)
++#define KATANA_CODEC_VOLUME_2		(KATANA_CODEC_VIRT_BASE + 3)
++#define KATANA_CODEC_MUTE		(KATANA_CODEC_VIRT_BASE + 4)
++#define KATANA_CODEC_DSP_PROGRAM	(KATANA_CODEC_VIRT_BASE + 5)
++#define KATANA_CODEC_DEEMPHASIS		(KATANA_CODEC_VIRT_BASE + 6)
++#define KATANA_CODEC_DOP		(KATANA_CODEC_VIRT_BASE + 7)
++#define KATANA_CODEC_FORMAT		(KATANA_CODEC_VIRT_BASE + 8)
++#define KATANA_CODEC_COMMAND		(KATANA_CODEC_VIRT_BASE + 9)
++#define KATANA_CODEC_MUTE_STREAM	(KATANA_CODEC_VIRT_BASE + 10)
++
++#define KATANA_CODEC_MAX_REGISTER	(KATANA_CODEC_VIRT_BASE + 10)
++
++#define KATANA_CODEC_FMT		0xff
++#define KATANA_CODEC_CHAN_MONO		0x00
++#define KATANA_CODEC_CHAN_STEREO	0x80
++#define KATANA_CODEC_ALEN_16		0x10
++#define KATANA_CODEC_ALEN_24		0x20
++#define KATANA_CODEC_ALEN_32		0x30
++#define KATANA_CODEC_RATE_11025		0x01
++#define KATANA_CODEC_RATE_22050		0x02
++#define KATANA_CODEC_RATE_32000		0x03
++#define KATANA_CODEC_RATE_44100		0x04
++#define KATANA_CODEC_RATE_48000		0x05
++#define KATANA_CODEC_RATE_88200		0x06
++#define KATANA_CODEC_RATE_96000		0x07
++#define KATANA_CODEC_RATE_176400	0x08
++#define KATANA_CODEC_RATE_192000	0x09
++#define KATANA_CODEC_RATE_352800	0x0a
++#define KATANA_CODEC_RATE_384000	0x0b
++
++
++struct katana_codec_priv {
++	struct regmap *regmap;
++	int fmt;
++};
++
++static const struct reg_default katana_codec_reg_defaults[] = {
++	{ KATANA_CODEC_RESET,		0x00 },
++	{ KATANA_CODEC_VOLUME_1,	0xF0 },
++	{ KATANA_CODEC_VOLUME_2,	0xF0 },
++	{ KATANA_CODEC_MUTE,		0x00 },
++	{ KATANA_CODEC_DSP_PROGRAM,	0x04 },
++	{ KATANA_CODEC_DEEMPHASIS,	0x00 },
++	{ KATANA_CODEC_DOP,		0x00 },
++	{ KATANA_CODEC_FORMAT,		0xb4 },
++};
++
++static const char * const katana_codec_dsp_program_texts[] = {
++	"Linear Phase Fast Roll-off Filter",
++	"Linear Phase Slow Roll-off Filter",
++	"Minimum Phase Fast Roll-off Filter",
++	"Minimum Phase Slow Roll-off Filter",
++	"Apodizing Fast Roll-off Filter",
++	"Corrected Minimum Phase Fast Roll-off Filter",
++	"Brick Wall Filter",
++};
++
++static const unsigned int katana_codec_dsp_program_values[] = {
++	0,
++	1,
++	2,
++	3,
++	4,
++	6,
++	7,
++};
++
++static SOC_VALUE_ENUM_SINGLE_DECL(katana_codec_dsp_program,
++				  KATANA_CODEC_DSP_PROGRAM, 0, 0x07,
++				  katana_codec_dsp_program_texts,
++				  katana_codec_dsp_program_values);
++
++static const char * const katana_codec_deemphasis_texts[] = {
++	"Bypass",
++	"32kHz",
++	"44.1kHz",
++	"48kHz",
++};
++
++static const unsigned int katana_codec_deemphasis_values[] = {
++	0,
++	1,
++	2,
++	3,
++};
++
++static SOC_VALUE_ENUM_SINGLE_DECL(katana_codec_deemphasis,
++				  KATANA_CODEC_DEEMPHASIS, 0, 0x03,
++				  katana_codec_deemphasis_texts,
++				  katana_codec_deemphasis_values);
++
++static const SNDRV_CTL_TLVD_DECLARE_DB_MINMAX(master_tlv, -12750, 0);
++
++static const struct snd_kcontrol_new katana_codec_controls[] = {
++	SOC_DOUBLE_R_TLV("Master Playback Volume", KATANA_CODEC_VOLUME_1,
++			KATANA_CODEC_VOLUME_2, 0, 255, 1, master_tlv),
++	SOC_DOUBLE("Master Playback Switch", KATANA_CODEC_MUTE, 0, 0, 1, 1),
++	SOC_ENUM("DSP Program Route", katana_codec_dsp_program),
++	SOC_ENUM("Deemphasis Route", katana_codec_deemphasis),
++	SOC_SINGLE("DoP Playback Switch", KATANA_CODEC_DOP, 0, 1, 1)
++};
++
++static bool katana_codec_readable_register(struct device *dev,
++				unsigned int reg)
++{
++	switch (reg) {
++	case KATANA_CODEC_CHIP_ID_REG:
++		return true;
++	default:
++		return reg < 0xff;
++	}
++}
++
++static int katana_codec_hw_params(struct snd_pcm_substream *substream,
++			     struct snd_pcm_hw_params *params,
++			     struct snd_soc_dai *dai)
++{
++	struct snd_soc_component *component = dai->component;
++	struct katana_codec_priv *katana_codec =
++		snd_soc_component_get_drvdata(component);
++	int fmt = 0;
++	int ret;
++
++	dev_dbg(component->card->dev, "hw_params %u Hz, %u channels, %u bits\n",
++			params_rate(params),
++			params_channels(params),
++			params_width(params));
++
++	switch (katana_codec->fmt & SND_SOC_DAIFMT_MASTER_MASK) {
++	case SND_SOC_DAIFMT_CBM_CFM: // master
++		if (params_channels(params) == 2)
++			fmt = KATANA_CODEC_CHAN_STEREO;
++		else
++			fmt = KATANA_CODEC_CHAN_MONO;
++
++		switch (params_width(params)) {
++		case 16:
++			fmt |= KATANA_CODEC_ALEN_16;
++			break;
++		case 24:
++			fmt |= KATANA_CODEC_ALEN_24;
++			break;
++		case 32:
++			fmt |= KATANA_CODEC_ALEN_32;
++			break;
++		default:
++			dev_err(component->card->dev, "Bad frame size: %d\n",
++					params_width(params));
++			return -EINVAL;
++		}
++
++		switch (params_rate(params)) {
++		case 44100:
++			fmt |= KATANA_CODEC_RATE_44100;
++			break;
++		case 48000:
++			fmt |= KATANA_CODEC_RATE_48000;
++			break;
++		case 88200:
++			fmt |= KATANA_CODEC_RATE_88200;
++			break;
++		case 96000:
++			fmt |= KATANA_CODEC_RATE_96000;
++			break;
++		case 176400:
++			fmt |= KATANA_CODEC_RATE_176400;
++			break;
++		case 192000:
++			fmt |= KATANA_CODEC_RATE_192000;
++			break;
++		case 352800:
++			fmt |= KATANA_CODEC_RATE_352800;
++			break;
++		case 384000:
++			fmt |= KATANA_CODEC_RATE_384000;
++			break;
++		default:
++			dev_err(component->card->dev, "Bad sample rate: %d\n",
++					params_rate(params));
++			return -EINVAL;
++		}
++
++		ret = regmap_write(katana_codec->regmap, KATANA_CODEC_FORMAT,
++					fmt);
++		if (ret != 0) {
++			dev_err(component->card->dev, "Failed to set format: %d\n", ret);
++			return ret;
++		}
++		break;
++
++	case SND_SOC_DAIFMT_CBS_CFS:
++		break;
++
++	default:
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static int katana_codec_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
++{
++	struct snd_soc_component *component = dai->component;
++	struct katana_codec_priv *katana_codec =
++		snd_soc_component_get_drvdata(component);
++
++	katana_codec->fmt = fmt;
++
++	return 0;
++}
++
++int katana_codec_dai_mute_stream(struct snd_soc_dai *dai, int mute,
++						int stream)
++{
++	struct snd_soc_component *component = dai->component;
++	struct katana_codec_priv *katana_codec =
++		snd_soc_component_get_drvdata(component);
++	int ret = 0;
++
++	ret = regmap_write(katana_codec->regmap, KATANA_CODEC_MUTE_STREAM,
++				mute);
++	if (ret != 0) {
++		dev_err(component->card->dev, "Failed to set mute: %d\n", ret);
++		return ret;
++	}
++	return ret;
++}
++
++static const struct snd_soc_dai_ops katana_codec_dai_ops = {
++	.mute_stream = katana_codec_dai_mute_stream,
++	.hw_params = katana_codec_hw_params,
++	.set_fmt = katana_codec_set_fmt,
++};
++
++static struct snd_soc_dai_driver katana_codec_dai = {
++	.name = "allo-katana-codec",
++	.playback = {
++		.stream_name = "Playback",
++		.channels_min = 2,
++		.channels_max = 2,
++		.rates = SNDRV_PCM_RATE_CONTINUOUS,
++		.rate_min = 44100,
++		.rate_max = 384000,
++		.formats = SNDRV_PCM_FMTBIT_S16_LE |
++			SNDRV_PCM_FMTBIT_S32_LE
++	},
++	.ops = &katana_codec_dai_ops,
++};
++
++static struct snd_soc_component_driver katana_codec_component_driver = {
++	.idle_bias_on = true,
++
++	.controls		= katana_codec_controls,
++	.num_controls	= ARRAY_SIZE(katana_codec_controls),
++};
++
++static const struct regmap_range_cfg katana_codec_range = {
++	.name = "Pages", .range_min = KATANA_CODEC_VIRT_BASE,
++	.range_max = KATANA_CODEC_MAX_REGISTER,
++	.selector_reg = KATANA_CODEC_PAGE,
++	.selector_mask = 0xff,
++	.window_start = 0, .window_len = 0x100,
++};
++
++const struct regmap_config katana_codec_regmap = {
++	.reg_bits = 8,
++	.val_bits = 8,
++
++	.ranges = &katana_codec_range,
++	.num_ranges = 1,
++
++	.max_register = KATANA_CODEC_MAX_REGISTER,
++	.readable_reg = katana_codec_readable_register,
++	.reg_defaults = katana_codec_reg_defaults,
++	.num_reg_defaults = ARRAY_SIZE(katana_codec_reg_defaults),
++	.cache_type = REGCACHE_RBTREE,
++};
++
++static int allo_katana_component_probe(struct i2c_client *i2c,
++			     const struct i2c_device_id *id)
++{
++	struct regmap *regmap;
++	struct regmap_config config = katana_codec_regmap;
++	struct device *dev = &i2c->dev;
++	struct katana_codec_priv *katana_codec;
++	unsigned int chip_id = 0;
++	int ret;
++
++	regmap = devm_regmap_init_i2c(i2c, &config);
++	if (IS_ERR(regmap))
++		return PTR_ERR(regmap);
++
++	katana_codec = devm_kzalloc(dev, sizeof(struct katana_codec_priv),
++					GFP_KERNEL);
++	if (!katana_codec)
++		return -ENOMEM;
++
++	dev_set_drvdata(dev, katana_codec);
++	katana_codec->regmap = regmap;
++
++	ret = regmap_read(regmap, KATANA_CODEC_CHIP_ID_REG, &chip_id);
++	if ((ret != 0) || (chip_id != KATANA_CODEC_CHIP_ID)) {
++		dev_err(dev, "Failed to read Chip or wrong Chip id: %d\n", ret);
++		return ret;
++	}
++	regmap_update_bits(regmap, KATANA_CODEC_RESET, 0x01, 0x01);
++	msleep(10);
++
++	ret = snd_soc_register_component(dev, &katana_codec_component_driver,
++				    &katana_codec_dai, 1);
++	if (ret != 0) {
++		dev_err(dev, "failed to register codec: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++static void allo_katana_component_remove(struct i2c_client *i2c)
++{
++	snd_soc_unregister_component(&i2c->dev);
++}
++
++static const struct i2c_device_id allo_katana_component_id[] = {
++	{ "allo-katana-codec", },
++	{ }
++};
++MODULE_DEVICE_TABLE(i2c, allo_katana_component_id);
++
++static const struct of_device_id allo_katana_codec_of_match[] = {
++	{ .compatible = "allo,allo-katana-codec", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, allo_katana_codec_of_match);
++
++static struct i2c_driver allo_katana_component_driver = {
++	.probe		= allo_katana_component_probe,
++	.remove		= allo_katana_component_remove,
++	.id_table	= allo_katana_component_id,
++	.driver		= {
++	.name		= "allo-katana-codec",
++	.of_match_table = allo_katana_codec_of_match,
++	},
++};
++
++module_i2c_driver(allo_katana_component_driver);
++
++MODULE_DESCRIPTION("ASoC Allo Katana Codec Driver");
++MODULE_AUTHOR("Jaikumar <jaikumar@cem-solutions.net>");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/allo-piano-dac-plus.c
+@@ -0,0 +1,1064 @@
++/*
++ * ALSA ASoC Machine Driver for Allo Piano DAC Plus Subwoofer
++ *
++ * Author:	Baswaraj K <jaikumar@cem-solutions.net>
++ *		Copyright 2020
++ *		based on code by David Knell <david.knell@gmail.com)
++ *		based on code by Daniel Matuschek <info@crazy-audio.com>
++ *		based on code by Florian Meier <florian.meier@koalo.de>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/gpio/consumer.h>
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <linux/firmware.h>
++#include <linux/delay.h>
++#include <sound/tlv.h>
++#include "../codecs/pcm512x.h"
++
++#define P_DAC_LEFT_MUTE		0x10
++#define P_DAC_RIGHT_MUTE	0x01
++#define P_DAC_MUTE		0x11
++#define P_DAC_UNMUTE		0x00
++#define P_MUTE			1
++#define P_UNMUTE		0
++
++struct dsp_code {
++	char i2c_addr;
++	char offset;
++	char val;
++};
++
++struct glb_pool {
++	struct mutex lock;
++	unsigned int dual_mode;
++	unsigned int set_lowpass;
++	unsigned int set_mode;
++	unsigned int set_rate;
++	unsigned int dsp_page_number;
++};
++
++static bool digital_gain_0db_limit = true;
++bool glb_mclk;
++
++static struct gpio_desc *mute_gpio[2];
++
++static const char * const allo_piano_mode_texts[] = {
++	"None",
++	"2.0",
++	"2.1",
++	"2.2",
++};
++
++static SOC_ENUM_SINGLE_DECL(allo_piano_mode_enum,
++		0, 0, allo_piano_mode_texts);
++
++static const char * const allo_piano_dual_mode_texts[] = {
++	"None",
++	"Dual-Mono",
++	"Dual-Stereo",
++};
++
++static SOC_ENUM_SINGLE_DECL(allo_piano_dual_mode_enum,
++		0, 0, allo_piano_dual_mode_texts);
++
++static const char * const allo_piano_dsp_low_pass_texts[] = {
++	"60",
++	"70",
++	"80",
++	"90",
++	"100",
++	"110",
++	"120",
++	"130",
++	"140",
++	"150",
++	"160",
++	"170",
++	"180",
++	"190",
++	"200",
++};
++
++static SOC_ENUM_SINGLE_DECL(allo_piano_enum,
++		0, 0, allo_piano_dsp_low_pass_texts);
++
++static int __snd_allo_piano_dsp_program(struct snd_soc_pcm_runtime *rtd,
++		unsigned int mode, unsigned int rate, unsigned int lowpass)
++{
++	const struct firmware *fw;
++	struct snd_soc_card *card = rtd->card;
++	struct glb_pool *glb_ptr = card->drvdata;
++	char firmware_name[60];
++	int ret = 0, dac = 0;
++
++	if (rate <= 46000)
++		rate = 44100;
++	else if (rate <= 68000)
++		rate = 48000;
++	else if (rate <= 92000)
++		rate = 88200;
++	else if (rate <= 136000)
++		rate = 96000;
++	else if (rate <= 184000)
++		rate = 176400;
++	else
++		rate = 192000;
++
++	if (lowpass > 14)
++		glb_ptr->set_lowpass = lowpass = 0;
++
++	if (mode > 3)
++		glb_ptr->set_mode = mode = 0;
++
++	if (mode > 0)
++		glb_ptr->dual_mode = 0;
++
++	/* same configuration loaded */
++	if ((rate == glb_ptr->set_rate) && (lowpass == glb_ptr->set_lowpass)
++			&& (mode == glb_ptr->set_mode))
++		return 0;
++
++	switch (mode) {
++	case 0: /* None */
++		return 1;
++
++	case 1: /* 2.0 */
++		snd_soc_component_write(asoc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_MUTE, P_DAC_UNMUTE);
++		snd_soc_component_write(asoc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_MUTE, P_DAC_MUTE);
++		glb_ptr->set_rate = rate;
++		glb_ptr->set_mode = mode;
++		glb_ptr->set_lowpass = lowpass;
++		return 1;
++
++	default:
++		snd_soc_component_write(asoc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_MUTE, P_DAC_UNMUTE);
++		snd_soc_component_write(asoc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_MUTE, P_DAC_UNMUTE);
++	}
++
++	for (dac = 0; dac < rtd->dai_link->num_codecs; dac++) {
++		struct dsp_code *dsp_code_read;
++		int i = 1;
++
++		if (dac == 0) { /* high */
++			snprintf(firmware_name, sizeof(firmware_name),
++				"allo/piano/2.2/allo-piano-dsp-%d-%d-%d.bin",
++				rate, ((lowpass * 10) + 60), dac);
++		} else { /* low */
++			snprintf(firmware_name, sizeof(firmware_name),
++				"allo/piano/2.%d/allo-piano-dsp-%d-%d-%d.bin",
++				(mode - 1), rate, ((lowpass * 10) + 60), dac);
++		}
++
++		dev_info(rtd->card->dev, "Dsp Firmware File Name: %s\n",
++				firmware_name);
++
++		ret = request_firmware(&fw, firmware_name, rtd->card->dev);
++		if (ret < 0) {
++			dev_err(rtd->card->dev,
++				"Error: Allo Piano Firmware %s missing. %d\n",
++				firmware_name, ret);
++			goto err;
++		}
++
++		while (i < (fw->size - 1)) {
++			dsp_code_read = (struct dsp_code *)&fw->data[i];
++
++			if (dsp_code_read->offset == 0) {
++				glb_ptr->dsp_page_number = dsp_code_read->val;
++				ret = snd_soc_component_write(asoc_rtd_to_codec(rtd, dac)->component,
++						PCM512x_PAGE_BASE(0),
++						dsp_code_read->val);
++
++			} else if (dsp_code_read->offset != 0) {
++				ret = snd_soc_component_write(asoc_rtd_to_codec(rtd, dac)->component,
++					(PCM512x_PAGE_BASE(
++						glb_ptr->dsp_page_number) +
++					dsp_code_read->offset),
++					dsp_code_read->val);
++			}
++			if (ret < 0) {
++				dev_err(rtd->card->dev,
++					"Failed to write Register: %d\n", ret);
++				release_firmware(fw);
++				goto err;
++			}
++			i = i + 3;
++		}
++		release_firmware(fw);
++	}
++	glb_ptr->set_rate = rate;
++	glb_ptr->set_mode = mode;
++	glb_ptr->set_lowpass = lowpass;
++	return 1;
++
++err:
++	return ret;
++}
++
++static int snd_allo_piano_dsp_program(struct snd_soc_pcm_runtime *rtd,
++		unsigned int mode, unsigned int rate, unsigned int lowpass)
++{
++	struct snd_soc_card *card = rtd->card;
++	struct glb_pool *glb_ptr = card->drvdata;
++	int ret = 0;
++
++	mutex_lock(&glb_ptr->lock);
++
++	ret = __snd_allo_piano_dsp_program(rtd, mode, rate, lowpass);
++
++	mutex_unlock(&glb_ptr->lock);
++
++	return ret;
++}
++
++static int snd_allo_piano_dual_mode_get(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct glb_pool *glb_ptr = card->drvdata;
++
++	ucontrol->value.integer.value[0] = glb_ptr->dual_mode;
++
++	return 0;
++}
++
++static int snd_allo_piano_dual_mode_put(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct glb_pool *glb_ptr = card->drvdata;
++	struct snd_soc_pcm_runtime *rtd;
++	struct snd_card *snd_card_ptr = card->snd_card;
++	struct snd_kcontrol *kctl;
++	struct soc_mixer_control *mc;
++	unsigned int left_val = 0, right_val = 0;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++
++	if (ucontrol->value.integer.value[0] > 0) {
++		glb_ptr->dual_mode = ucontrol->value.integer.value[0];
++		glb_ptr->set_mode = 0;
++	} else {
++		if (glb_ptr->set_mode <= 0) {
++			glb_ptr->dual_mode = 1;
++			glb_ptr->set_mode = 0;
++		} else {
++			glb_ptr->dual_mode = 0;
++			return 0;
++		}
++	}
++
++	if (glb_ptr->dual_mode == 1) { // Dual Mono
++		snd_soc_component_write(asoc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_MUTE, P_DAC_RIGHT_MUTE);
++		snd_soc_component_write(asoc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_MUTE, P_DAC_LEFT_MUTE);
++		snd_soc_component_write(asoc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_DIGITAL_VOLUME_3, 0xff);
++		snd_soc_component_write(asoc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_DIGITAL_VOLUME_2, 0xff);
++
++		list_for_each_entry(kctl, &snd_card_ptr->controls, list) {
++			if (!strncmp(kctl->id.name, "Main Digital Playback Volume",
++				sizeof(kctl->id.name))) {
++				mc = (struct soc_mixer_control *)
++					kctl->private_value;
++				mc->rreg = mc->reg;
++				break;
++			}
++			if (!strncmp(kctl->id.name, "Sub Digital Playback Volume",
++				sizeof(kctl->id.name))) {
++				mc = (struct soc_mixer_control *)
++					kctl->private_value;
++				mc->rreg = mc->reg;
++				break;
++			}
++		}
++	} else {
++		left_val = snd_soc_component_read(asoc_rtd_to_codec(rtd, 0)->component,
++						PCM512x_DIGITAL_VOLUME_2);
++		right_val = snd_soc_component_read(asoc_rtd_to_codec(rtd, 1)->component,
++						PCM512x_DIGITAL_VOLUME_3);
++
++		list_for_each_entry(kctl, &snd_card_ptr->controls, list) {
++			if (!strncmp(kctl->id.name, "Main Digital Playback Volume",
++				sizeof(kctl->id.name))) {
++				mc = (struct soc_mixer_control *)
++					kctl->private_value;
++				mc->rreg = PCM512x_DIGITAL_VOLUME_3;
++				break;
++			}
++			if (!strncmp(kctl->id.name, "Sub Digital Playback Volume",
++				sizeof(kctl->id.name))) {
++				mc = (struct soc_mixer_control *)
++					kctl->private_value;
++				mc->rreg = PCM512x_DIGITAL_VOLUME_2;
++				break;
++			}
++		}
++
++		snd_soc_component_write(asoc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_DIGITAL_VOLUME_3, left_val);
++		snd_soc_component_write(asoc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_DIGITAL_VOLUME_2, right_val);
++		snd_soc_component_write(asoc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_MUTE, P_DAC_UNMUTE);
++		snd_soc_component_write(asoc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_MUTE, P_DAC_UNMUTE);
++	}
++
++	return 0;
++}
++
++static int snd_allo_piano_mode_get(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct glb_pool *glb_ptr = card->drvdata;
++
++	ucontrol->value.integer.value[0] = glb_ptr->set_mode;
++	return 0;
++}
++
++static int snd_allo_piano_mode_put(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct snd_soc_pcm_runtime *rtd;
++	struct glb_pool *glb_ptr = card->drvdata;
++	struct snd_card *snd_card_ptr = card->snd_card;
++	struct snd_kcontrol *kctl;
++	struct soc_mixer_control *mc;
++	unsigned int left_val = 0, right_val = 0;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++
++	if ((glb_ptr->dual_mode == 1) &&
++			(ucontrol->value.integer.value[0] > 0)) {
++		left_val = snd_soc_component_read(asoc_rtd_to_codec(rtd, 0)->component,
++						PCM512x_DIGITAL_VOLUME_2);
++		right_val = snd_soc_component_read(asoc_rtd_to_codec(rtd, 1)->component,
++						PCM512x_DIGITAL_VOLUME_2);
++
++		list_for_each_entry(kctl, &snd_card_ptr->controls, list) {
++			if (!strncmp(kctl->id.name, "Main Digital Playback Volume",
++				sizeof(kctl->id.name))) {
++				mc = (struct soc_mixer_control *)
++					kctl->private_value;
++				mc->rreg = PCM512x_DIGITAL_VOLUME_3;
++				break;
++			}
++			if (!strncmp(kctl->id.name, "Sub Digital Playback Volume",
++				sizeof(kctl->id.name))) {
++				mc = (struct soc_mixer_control *)
++					kctl->private_value;
++				mc->rreg = PCM512x_DIGITAL_VOLUME_2;
++				break;
++			}
++		}
++		snd_soc_component_write(asoc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_DIGITAL_VOLUME_3, left_val);
++		snd_soc_component_write(asoc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_DIGITAL_VOLUME_3, right_val);
++	}
++
++	return(snd_allo_piano_dsp_program(rtd,
++				ucontrol->value.integer.value[0],
++				glb_ptr->set_rate, glb_ptr->set_lowpass));
++}
++
++static int snd_allo_piano_lowpass_get(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct glb_pool *glb_ptr = card->drvdata;
++
++	ucontrol->value.integer.value[0] = glb_ptr->set_lowpass;
++	return 0;
++}
++
++static int snd_allo_piano_lowpass_put(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct snd_soc_pcm_runtime *rtd;
++	struct glb_pool *glb_ptr = card->drvdata;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++	return(snd_allo_piano_dsp_program(rtd,
++				glb_ptr->set_mode, glb_ptr->set_rate,
++				ucontrol->value.integer.value[0]));
++}
++
++static int pcm512x_get_reg_sub(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct soc_mixer_control *mc =
++		(struct soc_mixer_control *)kcontrol->private_value;
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct glb_pool *glb_ptr = card->drvdata;
++	struct snd_soc_pcm_runtime *rtd;
++	unsigned int left_val = 0;
++	unsigned int right_val = 0;
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++
++	right_val = snd_soc_component_read(asoc_rtd_to_codec(rtd, 1)->component,
++			PCM512x_DIGITAL_VOLUME_3);
++	if (glb_ptr->dual_mode != 1) {
++		left_val = snd_soc_component_read(asoc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_DIGITAL_VOLUME_2);
++
++	} else {
++		left_val = right_val;
++	}
++
++	ucontrol->value.integer.value[0] =
++				(~(left_val >> mc->shift)) & mc->max;
++	ucontrol->value.integer.value[1] =
++				(~(right_val >> mc->shift)) & mc->max;
++
++	return 0;
++}
++
++static int pcm512x_set_reg_sub(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct soc_mixer_control *mc =
++		(struct soc_mixer_control *)kcontrol->private_value;
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct glb_pool *glb_ptr = card->drvdata;
++	struct snd_soc_pcm_runtime *rtd;
++	unsigned int left_val = (ucontrol->value.integer.value[0] & mc->max);
++	unsigned int right_val = (ucontrol->value.integer.value[1] & mc->max);
++	int ret = 0;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++
++	if (digital_gain_0db_limit) {
++		ret = snd_soc_limit_volume(card, "Subwoofer Playback Volume",
++					207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n",
++				ret);
++	}
++
++	// When in Dual Mono, Sub vol control should not set anything.
++	if (glb_ptr->dual_mode != 1) { //Not in Dual Mono mode
++
++		ret = snd_soc_component_write(asoc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_DIGITAL_VOLUME_2, (~left_val));
++		if (ret < 0)
++			return ret;
++
++		ret = snd_soc_component_write(asoc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_DIGITAL_VOLUME_3, (~right_val));
++		if (ret < 0)
++			return ret;
++
++	}
++
++	return 1;
++}
++
++static int pcm512x_get_reg_sub_switch(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct snd_soc_pcm_runtime *rtd;
++	int val = 0;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++	val = snd_soc_component_read(asoc_rtd_to_codec(rtd, 1)->component, PCM512x_MUTE);
++
++	ucontrol->value.integer.value[0] =
++			(val & P_DAC_LEFT_MUTE) ? P_UNMUTE : P_MUTE;
++	ucontrol->value.integer.value[1] =
++			(val & P_DAC_RIGHT_MUTE) ? P_UNMUTE : P_MUTE;
++
++	return val;
++}
++
++static int pcm512x_set_reg_sub_switch(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct snd_soc_pcm_runtime *rtd;
++	struct glb_pool *glb_ptr = card->drvdata;
++	unsigned int left_val = (ucontrol->value.integer.value[0]);
++	unsigned int right_val = (ucontrol->value.integer.value[1]);
++	int ret = 0;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++	if (glb_ptr->set_mode != 1) {
++		ret = snd_soc_component_write(asoc_rtd_to_codec(rtd, 1)->component, PCM512x_MUTE,
++				~((left_val & 0x01)<<4 | (right_val & 0x01)));
++		if (ret < 0)
++			return ret;
++	}
++	return 1;
++
++}
++
++static int pcm512x_get_reg_master(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct soc_mixer_control *mc =
++		(struct soc_mixer_control *)kcontrol->private_value;
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct glb_pool *glb_ptr = card->drvdata;
++	struct snd_soc_pcm_runtime *rtd;
++	unsigned int left_val = 0, right_val = 0;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++
++	left_val = snd_soc_component_read(asoc_rtd_to_codec(rtd, 0)->component,
++			PCM512x_DIGITAL_VOLUME_2);
++
++	if (glb_ptr->dual_mode == 1) {  // in Dual Mono mode
++		right_val = snd_soc_component_read(asoc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_DIGITAL_VOLUME_3);
++	} else {
++		right_val = snd_soc_component_read(asoc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_DIGITAL_VOLUME_3);
++	}
++
++	ucontrol->value.integer.value[0] =
++		(~(left_val  >> mc->shift)) & mc->max;
++	ucontrol->value.integer.value[1] =
++		(~(right_val >> mc->shift)) & mc->max;
++
++	return 0;
++}
++
++static int pcm512x_set_reg_master(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct soc_mixer_control *mc =
++		(struct soc_mixer_control *)kcontrol->private_value;
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct glb_pool *glb_ptr = card->drvdata;
++	struct snd_soc_pcm_runtime *rtd;
++	unsigned int left_val = (ucontrol->value.integer.value[0] & mc->max);
++	unsigned int right_val = (ucontrol->value.integer.value[1] & mc->max);
++	int ret = 0;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++
++	if (digital_gain_0db_limit) {
++		ret = snd_soc_limit_volume(card, "Master Playback Volume",
++					207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n",
++				ret);
++	}
++
++	if (glb_ptr->dual_mode == 1) { //in Dual Mono Mode
++
++		ret = snd_soc_component_write(asoc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_DIGITAL_VOLUME_2, (~left_val));
++		if (ret < 0)
++			return ret;
++
++		ret = snd_soc_component_write(asoc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_DIGITAL_VOLUME_3, (~right_val));
++		if (ret < 0)
++			return ret;
++
++	} else {
++
++		ret = snd_soc_component_write(asoc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_DIGITAL_VOLUME_2, (~left_val));
++		if (ret < 0)
++			return ret;
++
++		ret = snd_soc_component_write(asoc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_DIGITAL_VOLUME_3, (~right_val));
++		if (ret < 0)
++			return ret;
++
++	}
++	return 1;
++}
++
++static int pcm512x_get_reg_master_switch(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct glb_pool *glb_ptr = card->drvdata;
++	struct snd_soc_pcm_runtime *rtd;
++	int val = 0;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++
++	val = snd_soc_component_read(asoc_rtd_to_codec(rtd, 0)->component, PCM512x_MUTE);
++
++	ucontrol->value.integer.value[0] =
++			(val & P_DAC_LEFT_MUTE) ? P_UNMUTE : P_MUTE;
++
++	if (glb_ptr->dual_mode == 1) {
++		val = snd_soc_component_read(asoc_rtd_to_codec(rtd, 1)->component, PCM512x_MUTE);
++	}
++	ucontrol->value.integer.value[1] =
++			(val & P_DAC_RIGHT_MUTE) ? P_UNMUTE : P_MUTE;
++
++	return val;
++}
++
++static int pcm512x_set_reg_master_switch(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct snd_soc_pcm_runtime *rtd;
++	struct glb_pool *glb_ptr = card->drvdata;
++	unsigned int left_val = (ucontrol->value.integer.value[0]);
++	unsigned int right_val = (ucontrol->value.integer.value[1]);
++	int ret = 0;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++	if (glb_ptr->dual_mode == 1) {
++		ret = snd_soc_component_write(asoc_rtd_to_codec(rtd, 0)->component, PCM512x_MUTE,
++				~((left_val & 0x01)<<4));
++		if (ret < 0)
++			return ret;
++		ret = snd_soc_component_write(asoc_rtd_to_codec(rtd, 1)->component, PCM512x_MUTE,
++				~((right_val & 0x01)));
++		if (ret < 0)
++			return ret;
++
++	} else if (glb_ptr->set_mode == 1) {
++		ret = snd_soc_component_write(asoc_rtd_to_codec(rtd, 0)->component, PCM512x_MUTE,
++				~((left_val & 0x01)<<4 | (right_val & 0x01)));
++		if (ret < 0)
++			return ret;
++
++	} else {
++		ret = snd_soc_component_write(asoc_rtd_to_codec(rtd, 0)->component, PCM512x_MUTE,
++				~((left_val & 0x01)<<4 | (right_val & 0x01)));
++		if (ret < 0)
++			return ret;
++
++		ret = snd_soc_component_write(asoc_rtd_to_codec(rtd, 1)->component, PCM512x_MUTE,
++				~((left_val & 0x01)<<4 | (right_val & 0x01)));
++		if (ret < 0)
++			return ret;
++	}
++	return 1;
++}
++
++static const DECLARE_TLV_DB_SCALE(digital_tlv_sub, -10350, 50, 1);
++static const DECLARE_TLV_DB_SCALE(digital_tlv_master, -10350, 50, 1);
++
++static const struct snd_kcontrol_new allo_piano_controls[] = {
++	SOC_ENUM_EXT("Subwoofer mode Route",
++			allo_piano_mode_enum,
++			snd_allo_piano_mode_get,
++			snd_allo_piano_mode_put),
++
++	SOC_ENUM_EXT("Dual Mode Route",
++			allo_piano_dual_mode_enum,
++			snd_allo_piano_dual_mode_get,
++			snd_allo_piano_dual_mode_put),
++
++	SOC_ENUM_EXT("Lowpass Route", allo_piano_enum,
++			snd_allo_piano_lowpass_get,
++			snd_allo_piano_lowpass_put),
++
++	SOC_DOUBLE_R_EXT_TLV("Subwoofer Playback Volume",
++			PCM512x_DIGITAL_VOLUME_2,
++			PCM512x_DIGITAL_VOLUME_3, 0, 255, 1,
++			pcm512x_get_reg_sub,
++			pcm512x_set_reg_sub,
++			digital_tlv_sub),
++
++	SOC_DOUBLE_EXT("Subwoofer Playback Switch",
++			PCM512x_MUTE,
++			PCM512x_RQML_SHIFT,
++			PCM512x_RQMR_SHIFT, 1, 1,
++			pcm512x_get_reg_sub_switch,
++			pcm512x_set_reg_sub_switch),
++
++	SOC_DOUBLE_R_EXT_TLV("Master Playback Volume",
++			PCM512x_DIGITAL_VOLUME_2,
++			PCM512x_DIGITAL_VOLUME_3, 0, 255, 1,
++			pcm512x_get_reg_master,
++			pcm512x_set_reg_master,
++			digital_tlv_master),
++
++	SOC_DOUBLE_EXT("Master Playback Switch",
++			PCM512x_MUTE,
++			PCM512x_RQML_SHIFT,
++			PCM512x_RQMR_SHIFT, 1, 1,
++			pcm512x_get_reg_master_switch,
++			pcm512x_set_reg_master_switch),
++};
++
++static const char * const codec_ctl_pfx[] = { "Main", "Sub" };
++static const char * const codec_ctl_name[] = {
++	"Digital Playback Volume",
++	"Digital Playback Switch",
++	"Auto Mute Mono Switch",
++	"Auto Mute Switch",
++	"Auto Mute Time Left",
++	"Auto Mute Time Right",
++	"Clock Missing Period",
++	"Max Overclock DAC",
++	"Max Overclock DSP",
++	"Max Overclock PLL",
++	"Volume Ramp Down Emergency Rate",
++	"Volume Ramp Down Emergency Step",
++	"Volume Ramp Up Rate",
++	"Volume Ramp Down Rate",
++	"Volume Ramp Up Step",
++	"Volume Ramp Down Step"
++};
++
++static int snd_allo_piano_dac_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_card *card = rtd->card;
++	struct glb_pool *glb_ptr;
++	struct snd_kcontrol *kctl;
++	int i, j;
++
++	glb_ptr = kzalloc(sizeof(struct glb_pool), GFP_KERNEL);
++	if (!glb_ptr)
++		return -ENOMEM;
++
++	card->drvdata = glb_ptr;
++	glb_ptr->dual_mode = 2;
++	glb_ptr->set_mode = 0;
++
++	mutex_init(&glb_ptr->lock);
++
++	if (digital_gain_0db_limit) {
++		int ret;
++
++		//Set volume limit on both dacs
++		for (i = 0; i < ARRAY_SIZE(codec_ctl_pfx); i++) {
++			char cname[256];
++
++			sprintf(cname, "%s %s", codec_ctl_pfx[i], codec_ctl_name[0]);
++			ret = snd_soc_limit_volume(card, cname, 207);
++			if (ret < 0)
++				dev_warn(card->dev, "Failed to set volume limit: %d\n",
++					ret);
++		}
++	}
++
++	// Remove codec controls
++	for (i = 0; i < ARRAY_SIZE(codec_ctl_pfx); i++) {
++		for (j = 0; j < ARRAY_SIZE(codec_ctl_name); j++) {
++			char cname[256];
++
++			sprintf(cname, "%s %s", codec_ctl_pfx[i], codec_ctl_name[j]);
++			kctl = snd_soc_card_get_kcontrol(card, cname);
++			if (!kctl) {
++				dev_err(rtd->card->dev, "Control %s not found\n",
++				       cname);
++			} else {
++				kctl->vd[0].access =
++					SNDRV_CTL_ELEM_ACCESS_READWRITE;
++				snd_ctl_remove(card->snd_card, kctl);
++			}
++		}
++	}
++
++	return 0;
++}
++
++static void snd_allo_piano_gpio_mute(struct snd_soc_card *card)
++{
++	if (mute_gpio[0])
++		gpiod_set_value_cansleep(mute_gpio[0], P_MUTE);
++
++	if (mute_gpio[1])
++		gpiod_set_value_cansleep(mute_gpio[1], P_MUTE);
++}
++
++static void snd_allo_piano_gpio_unmute(struct snd_soc_card *card)
++{
++	if (mute_gpio[0])
++		gpiod_set_value_cansleep(mute_gpio[0], P_UNMUTE);
++
++	if (mute_gpio[1])
++		gpiod_set_value_cansleep(mute_gpio[1], P_UNMUTE);
++}
++
++static int snd_allo_piano_set_bias_level(struct snd_soc_card *card,
++	struct snd_soc_dapm_context *dapm, enum snd_soc_bias_level level)
++{
++	struct snd_soc_pcm_runtime *rtd;
++	struct snd_soc_dai *codec_dai;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++	codec_dai = asoc_rtd_to_codec(rtd, 0);
++
++	if (dapm->dev != codec_dai->dev)
++		return 0;
++
++	switch (level) {
++	case SND_SOC_BIAS_PREPARE:
++		if (dapm->bias_level != SND_SOC_BIAS_STANDBY)
++			break;
++		/* UNMUTE DAC */
++		snd_allo_piano_gpio_unmute(card);
++		break;
++
++	case SND_SOC_BIAS_STANDBY:
++		if (dapm->bias_level != SND_SOC_BIAS_PREPARE)
++			break;
++		/* MUTE DAC */
++		snd_allo_piano_gpio_mute(card);
++		break;
++
++	default:
++		break;
++	}
++
++	return 0;
++}
++
++static int snd_allo_piano_dac_startup(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_card *card = rtd->card;
++
++	snd_allo_piano_gpio_mute(card);
++
++	return 0;
++}
++
++static int snd_allo_piano_dac_hw_params(
++		struct snd_pcm_substream *substream,
++		struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	unsigned int rate = params_rate(params);
++	struct snd_soc_card *card = rtd->card;
++	struct glb_pool *glb_ptr = card->drvdata;
++	int ret = 0, val = 0, dac;
++
++	for (dac = 0; (glb_mclk && dac < 2); dac++) {
++		/* Configure the PLL clock reference for both the Codecs */
++		val = snd_soc_component_read(asoc_rtd_to_codec(rtd, dac)->component,
++					PCM512x_RATE_DET_4);
++
++		if (val & 0x40) {
++			snd_soc_component_write(asoc_rtd_to_codec(rtd, dac)->component,
++					PCM512x_PLL_REF,
++					PCM512x_SREF_BCK);
++
++			dev_info(asoc_rtd_to_codec(rtd, dac)->component->dev,
++				"Setting BCLK as input clock & Enable PLL\n");
++		} else {
++			snd_soc_component_write(asoc_rtd_to_codec(rtd, dac)->component,
++					PCM512x_PLL_EN,
++					0x00);
++
++			snd_soc_component_write(asoc_rtd_to_codec(rtd, dac)->component,
++					PCM512x_PLL_REF,
++					PCM512x_SREF_SCK);
++
++			dev_info(asoc_rtd_to_codec(rtd, dac)->component->dev,
++				"Setting SCLK as input clock & disabled PLL\n");
++		}
++	}
++
++	ret = snd_allo_piano_dsp_program(rtd, glb_ptr->set_mode, rate,
++						glb_ptr->set_lowpass);
++	if (ret < 0)
++		return ret;
++
++	return ret;
++}
++
++static int snd_allo_piano_dac_prepare(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_card *card = rtd->card;
++
++	snd_allo_piano_gpio_unmute(card);
++
++	return 0;
++}
++
++/* machine stream operations */
++static struct snd_soc_ops snd_allo_piano_dac_ops = {
++	.startup = snd_allo_piano_dac_startup,
++	.hw_params = snd_allo_piano_dac_hw_params,
++	.prepare = snd_allo_piano_dac_prepare,
++};
++
++static struct snd_soc_dai_link_component allo_piano_2_1_codecs[] = {
++	{
++		.dai_name = "pcm512x-hifi",
++	},
++	{
++		.dai_name = "pcm512x-hifi",
++	},
++};
++
++SND_SOC_DAILINK_DEFS(allo_piano_dai_plus,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm512x.1-004c", "pcm512x-hifi"),
++			   COMP_CODEC("pcm512x.1-004d", "pcm512x-hifi")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_allo_piano_dac_dai[] = {
++	{
++		.name		= "PianoDACPlus",
++		.stream_name	= "PianoDACPlus",
++		.dai_fmt	= SND_SOC_DAIFMT_I2S |
++				SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBS_CFS,
++		.ops		= &snd_allo_piano_dac_ops,
++		.init		= snd_allo_piano_dac_init,
++		SND_SOC_DAILINK_REG(allo_piano_dai_plus),
++	},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_allo_piano_dac = {
++	.name = "PianoDACPlus",
++	.owner = THIS_MODULE,
++	.dai_link = snd_allo_piano_dac_dai,
++	.num_links = ARRAY_SIZE(snd_allo_piano_dac_dai),
++	.controls = allo_piano_controls,
++	.num_controls = ARRAY_SIZE(allo_piano_controls),
++};
++
++static int snd_allo_piano_dac_probe(struct platform_device *pdev)
++{
++	struct snd_soc_card *card = &snd_allo_piano_dac;
++	int ret = 0, i = 0;
++
++	card->dev = &pdev->dev;
++	platform_set_drvdata(pdev, &snd_allo_piano_dac);
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai;
++
++		dai = &snd_allo_piano_dac_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++						"i2s-controller", 0);
++		if (i2s_node) {
++			for (i = 0; i < card->num_links; i++) {
++				dai->cpus->dai_name = NULL;
++				dai->cpus->of_node = i2s_node;
++				dai->platforms->name = NULL;
++				dai->platforms->of_node = i2s_node;
++			}
++		}
++		digital_gain_0db_limit =
++			!of_property_read_bool(pdev->dev.of_node,
++						"allo,24db_digital_gain");
++
++		glb_mclk = of_property_read_bool(pdev->dev.of_node,
++						"allo,glb_mclk");
++
++		allo_piano_2_1_codecs[0].of_node =
++			of_parse_phandle(pdev->dev.of_node, "audio-codec", 0);
++		if (!allo_piano_2_1_codecs[0].of_node) {
++			dev_err(&pdev->dev,
++				"Property 'audio-codec' missing or invalid\n");
++			return -EINVAL;
++		}
++
++		allo_piano_2_1_codecs[1].of_node =
++			of_parse_phandle(pdev->dev.of_node, "audio-codec", 1);
++		if (!allo_piano_2_1_codecs[1].of_node) {
++			dev_err(&pdev->dev,
++				"Property 'audio-codec' missing or invalid\n");
++			return -EINVAL;
++		}
++
++		mute_gpio[0] = devm_gpiod_get_optional(&pdev->dev, "mute1",
++							GPIOD_OUT_LOW);
++		if (IS_ERR(mute_gpio[0])) {
++			ret = PTR_ERR(mute_gpio[0]);
++			dev_err(&pdev->dev,
++				"failed to get mute1 gpio6: %d\n", ret);
++			return ret;
++		}
++
++		mute_gpio[1] = devm_gpiod_get_optional(&pdev->dev, "mute2",
++							GPIOD_OUT_LOW);
++		if (IS_ERR(mute_gpio[1])) {
++			ret = PTR_ERR(mute_gpio[1]);
++			dev_err(&pdev->dev,
++				"failed to get mute2 gpio25: %d\n", ret);
++			return ret;
++		}
++
++		if (mute_gpio[0] && mute_gpio[1])
++			snd_allo_piano_dac.set_bias_level =
++				snd_allo_piano_set_bias_level;
++
++		ret = snd_soc_register_card(&snd_allo_piano_dac);
++		if (ret < 0) {
++			dev_err(&pdev->dev,
++				"snd_soc_register_card() failed: %d\n", ret);
++			return ret;
++		}
++
++		if ((mute_gpio[0]) && (mute_gpio[1]))
++			snd_allo_piano_gpio_mute(&snd_allo_piano_dac);
++
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++static int snd_allo_piano_dac_remove(struct platform_device *pdev)
++{
++	struct snd_soc_card *card = platform_get_drvdata(pdev);
++
++	kfree(&card->drvdata);
++	snd_allo_piano_gpio_mute(&snd_allo_piano_dac);
++	snd_soc_unregister_card(&snd_allo_piano_dac);
++	return 0;
++}
++
++static const struct of_device_id snd_allo_piano_dac_of_match[] = {
++	{ .compatible = "allo,piano-dac-plus", },
++	{ /* sentinel */ },
++};
++
++MODULE_DEVICE_TABLE(of, snd_allo_piano_dac_of_match);
++
++static struct platform_driver snd_allo_piano_dac_driver = {
++	.driver = {
++		.name = "snd-allo-piano-dac-plus",
++		.owner = THIS_MODULE,
++		.of_match_table = snd_allo_piano_dac_of_match,
++	},
++	.probe = snd_allo_piano_dac_probe,
++	.remove = snd_allo_piano_dac_remove,
++};
++
++module_platform_driver(snd_allo_piano_dac_driver);
++
++MODULE_AUTHOR("Baswaraj K <jaikumar@cem-solutions.net>");
++MODULE_DESCRIPTION("ALSA ASoC Machine Driver for Allo Piano DAC Plus");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/allo-piano-dac.c
+@@ -0,0 +1,122 @@
++/*
++ * ALSA ASoC Machine Driver for Allo Piano DAC
++ *
++ * Author:	Baswaraj K <jaikumar@cem-solutions.net>
++ *		Copyright 2016
++ *		based on code by Daniel Matuschek <info@crazy-audio.com>
++ *		based on code by Florian Meier <florian.meier@koalo.de>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++
++static bool digital_gain_0db_limit = true;
++
++static int snd_allo_piano_dac_init(struct snd_soc_pcm_runtime *rtd)
++{
++	if (digital_gain_0db_limit) {
++		int ret;
++		struct snd_soc_card *card = rtd->card;
++
++		ret = snd_soc_limit_volume(card, "Digital Playback Volume",
++					   207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n",
++				 ret);
++	}
++
++	return 0;
++}
++
++SND_SOC_DAILINK_DEFS(allo_piano_dai,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm512x.1-004c", "pcm512x-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_allo_piano_dac_dai[] = {
++{
++	.name		= "Piano DAC",
++	.stream_name	= "Piano DAC HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S |
++			  SND_SOC_DAIFMT_NB_NF |
++			  SND_SOC_DAIFMT_CBS_CFS,
++	.init		= snd_allo_piano_dac_init,
++	SND_SOC_DAILINK_REG(allo_piano_dai),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_allo_piano_dac = {
++	.name         = "PianoDAC",
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_allo_piano_dac_dai,
++	.num_links    = ARRAY_SIZE(snd_allo_piano_dac_dai),
++};
++
++static int snd_allo_piano_dac_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++
++	snd_allo_piano_dac.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai;
++
++		dai = &snd_allo_piano_dac_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++					    "i2s-controller", 0);
++
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		}
++
++		digital_gain_0db_limit = !of_property_read_bool(
++			pdev->dev.of_node, "allo,24db_digital_gain");
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev, &snd_allo_piano_dac);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev,
++			"snd_soc_register_card() failed: %d\n", ret);
++
++	return ret;
++}
++
++static const struct of_device_id snd_allo_piano_dac_of_match[] = {
++	{ .compatible = "allo,piano-dac", },
++	{ /* sentinel */ },
++};
++MODULE_DEVICE_TABLE(of, snd_allo_piano_dac_of_match);
++
++static struct platform_driver snd_allo_piano_dac_driver = {
++	.driver = {
++		.name   = "snd-allo-piano-dac",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_allo_piano_dac_of_match,
++	},
++	.probe          = snd_allo_piano_dac_probe,
++};
++
++module_platform_driver(snd_allo_piano_dac_driver);
++
++MODULE_AUTHOR("Baswaraj K <jaikumar@cem-solutions.net>");
++MODULE_DESCRIPTION("ALSA ASoC Machine Driver for Allo Piano DAC");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/audioinjector-isolated-soundcard.c
+@@ -0,0 +1,183 @@
++/*
++ * ASoC Driver for AudioInjector.net isolated soundcard
++ *
++ *  Created on: 20-February-2020
++ *      Author: flatmax@flatmax.org
++ *              based on audioinjector-octo-soundcard.c
++ *
++ * Copyright (C) 2020 Flatmax Pty. Ltd.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/types.h>
++#include <linux/gpio/consumer.h>
++
++#include <sound/core.h>
++#include <sound/soc.h>
++#include <sound/pcm_params.h>
++#include <sound/control.h>
++
++static struct gpio_desc *mute_gpio;
++
++static const unsigned int audioinjector_isolated_rates[] = {
++	192000, 96000, 48000, 32000, 24000, 16000, 8000
++};
++
++static struct snd_pcm_hw_constraint_list audioinjector_isolated_constraints = {
++	.list = audioinjector_isolated_rates,
++	.count = ARRAY_SIZE(audioinjector_isolated_rates),
++};
++
++static int audioinjector_isolated_dai_init(struct snd_soc_pcm_runtime *rtd)
++{
++	int ret=snd_soc_dai_set_sysclk(asoc_rtd_to_codec(rtd, 0), 0, 24576000, 0);
++	if (ret)
++		return ret;
++
++	return snd_soc_dai_set_bclk_ratio(asoc_rtd_to_cpu(rtd, 0), 64);
++}
++
++static int audioinjector_isolated_startup(struct snd_pcm_substream *substream)
++{
++	snd_pcm_hw_constraint_list(substream->runtime, 0,
++				SNDRV_PCM_HW_PARAM_RATE, &audioinjector_isolated_constraints);
++
++	return 0;
++}
++
++static int audioinjector_isolated_trigger(struct snd_pcm_substream *substream,
++								int cmd){
++
++	switch (cmd) {
++	case SNDRV_PCM_TRIGGER_STOP:
++	case SNDRV_PCM_TRIGGER_SUSPEND:
++	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
++		gpiod_set_value(mute_gpio, 0);
++		break;
++	case SNDRV_PCM_TRIGGER_START:
++	case SNDRV_PCM_TRIGGER_RESUME:
++	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
++		gpiod_set_value(mute_gpio, 1);
++		break;
++	default:
++		return -EINVAL;
++	}
++	return 0;
++}
++
++static struct snd_soc_ops audioinjector_isolated_ops = {
++	.startup	= audioinjector_isolated_startup,
++	.trigger = audioinjector_isolated_trigger,
++};
++
++SND_SOC_DAILINK_DEFS(audioinjector_isolated,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("cs4271.1-0010", "cs4271-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link audioinjector_isolated_dai[] = {
++	{
++		.name = "AudioInjector ISO",
++		.stream_name = "AI-HIFI",
++		.ops = &audioinjector_isolated_ops,
++		.init = audioinjector_isolated_dai_init,
++		.symmetric_rate = 1,
++		.symmetric_channels = 1,
++		.dai_fmt = SND_SOC_DAIFMT_CBM_CFM|SND_SOC_DAIFMT_I2S|SND_SOC_DAIFMT_NB_NF,
++		SND_SOC_DAILINK_REG(audioinjector_isolated),
++	}
++};
++
++static const struct snd_soc_dapm_widget audioinjector_isolated_widgets[] = {
++	SND_SOC_DAPM_OUTPUT("OUTPUTS"),
++	SND_SOC_DAPM_INPUT("INPUTS"),
++};
++
++static const struct snd_soc_dapm_route audioinjector_isolated_route[] = {
++	/* Balanced outputs */
++	{"OUTPUTS", NULL, "AOUTA+"},
++	{"OUTPUTS", NULL, "AOUTA-"},
++	{"OUTPUTS", NULL, "AOUTB+"},
++	{"OUTPUTS", NULL, "AOUTB-"},
++
++	/* Balanced inputs */
++	{"AINA", NULL, "INPUTS"},
++	{"AINB", NULL, "INPUTS"},
++};
++
++static struct snd_soc_card snd_soc_audioinjector_isolated = {
++	.name = "audioinjector-isolated-soundcard",
++	.dai_link = audioinjector_isolated_dai,
++	.num_links = ARRAY_SIZE(audioinjector_isolated_dai),
++
++	.dapm_widgets = audioinjector_isolated_widgets,
++	.num_dapm_widgets = ARRAY_SIZE(audioinjector_isolated_widgets),
++	.dapm_routes = audioinjector_isolated_route,
++	.num_dapm_routes = ARRAY_SIZE(audioinjector_isolated_route),
++};
++
++static int audioinjector_isolated_probe(struct platform_device *pdev)
++{
++	struct snd_soc_card *card = &snd_soc_audioinjector_isolated;
++	int ret;
++
++	card->dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct snd_soc_dai_link *dai = &audioinjector_isolated_dai[0];
++		struct device_node *i2s_node =
++					of_parse_phandle(pdev->dev.of_node, "i2s-controller", 0);
++
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		} else {
++				dev_err(&pdev->dev,
++				"i2s-controller missing or invalid in DT\n");
++				return -EINVAL;
++		}
++
++		mute_gpio = devm_gpiod_get_optional(&pdev->dev, "mute", GPIOD_OUT_LOW);
++		if (IS_ERR(mute_gpio)){
++			dev_err(&pdev->dev, "mute gpio not found in dt overlay\n");
++			return PTR_ERR(mute_gpio);
++		}
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev, card);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", ret);
++	return ret;
++}
++
++static const struct of_device_id audioinjector_isolated_of_match[] = {
++	{ .compatible = "ai,audioinjector-isolated-soundcard", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, audioinjector_isolated_of_match);
++
++static struct platform_driver audioinjector_isolated_driver = {
++	.driver	= {
++		.name			= "audioinjector-isolated",
++		.owner			= THIS_MODULE,
++		.of_match_table = audioinjector_isolated_of_match,
++	},
++	.probe	= audioinjector_isolated_probe,
++};
++
++module_platform_driver(audioinjector_isolated_driver);
++MODULE_AUTHOR("Matt Flax <flatmax@flatmax.org>");
++MODULE_DESCRIPTION("AudioInjector.net isolated Soundcard");
++MODULE_LICENSE("GPL v2");
++MODULE_ALIAS("platform:audioinjector-isolated-soundcard");
+--- /dev/null
++++ b/sound/soc/bcm/audioinjector-octo-soundcard.c
+@@ -0,0 +1,346 @@
++/*
++ * ASoC Driver for AudioInjector Pi octo channel soundcard (hat)
++ *
++ *  Created on: 27-October-2016
++ *      Author: flatmax@flatmax.org
++ *              based on audioinjector-pi-soundcard.c
++ *
++ * Copyright (C) 2016 Flatmax Pty. Ltd.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/types.h>
++#include <linux/gpio/consumer.h>
++
++#include <sound/core.h>
++#include <sound/soc.h>
++#include <sound/pcm_params.h>
++#include <sound/control.h>
++
++static struct gpio_descs *mult_gpios;
++static struct gpio_desc *codec_rst_gpio;
++static unsigned int audioinjector_octo_rate;
++static bool non_stop_clocks;
++
++static const unsigned int audioinjector_octo_rates[] = {
++	96000, 48000, 32000, 24000, 16000, 8000, 88200, 44100, 29400, 22050, 14700,
++};
++
++static struct snd_pcm_hw_constraint_list audioinjector_octo_constraints = {
++	.list = audioinjector_octo_rates,
++	.count = ARRAY_SIZE(audioinjector_octo_rates),
++};
++
++static int audioinjector_octo_dai_init(struct snd_soc_pcm_runtime *rtd)
++{
++	return snd_soc_dai_set_bclk_ratio(asoc_rtd_to_cpu(rtd, 0), 64);
++}
++
++static int audioinjector_octo_startup(struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	asoc_rtd_to_cpu(rtd, 0)->driver->playback.channels_min = 8;
++	asoc_rtd_to_cpu(rtd, 0)->driver->playback.channels_max = 8;
++	asoc_rtd_to_cpu(rtd, 0)->driver->capture.channels_min = 8;
++	asoc_rtd_to_cpu(rtd, 0)->driver->capture.channels_max = 8;
++	asoc_rtd_to_codec(rtd, 0)->driver->capture.channels_max = 8;
++
++	snd_pcm_hw_constraint_list(substream->runtime, 0,
++				SNDRV_PCM_HW_PARAM_RATE,
++				&audioinjector_octo_constraints);
++
++	return 0;
++}
++
++static void audioinjector_octo_shutdown(struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	asoc_rtd_to_cpu(rtd, 0)->driver->playback.channels_min = 2;
++	asoc_rtd_to_cpu(rtd, 0)->driver->playback.channels_max = 2;
++	asoc_rtd_to_cpu(rtd, 0)->driver->capture.channels_min = 2;
++	asoc_rtd_to_cpu(rtd, 0)->driver->capture.channels_max = 2;
++	asoc_rtd_to_codec(rtd, 0)->driver->capture.channels_max = 6;
++}
++
++static int audioinjector_octo_hw_params(struct snd_pcm_substream *substream,
++	struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++
++	// set codec DAI configuration
++	int ret = snd_soc_dai_set_fmt(asoc_rtd_to_codec(rtd, 0),
++			SND_SOC_DAIFMT_CBS_CFS|SND_SOC_DAIFMT_DSP_A|
++			SND_SOC_DAIFMT_NB_NF);
++	if (ret < 0)
++		return ret;
++
++	// set cpu DAI configuration
++	ret = snd_soc_dai_set_fmt(asoc_rtd_to_cpu(rtd, 0),
++			SND_SOC_DAIFMT_CBM_CFM|SND_SOC_DAIFMT_I2S|
++			SND_SOC_DAIFMT_NB_NF);
++	if (ret < 0)
++		return ret;
++
++	audioinjector_octo_rate = params_rate(params);
++
++	// Set the correct sysclock for the codec
++	switch (audioinjector_octo_rate) {
++	case 96000:
++	case 48000:
++		return snd_soc_dai_set_sysclk(asoc_rtd_to_codec(rtd, 0), 0, 49152000,
++									0);
++		break;
++	case 24000:
++		return snd_soc_dai_set_sysclk(asoc_rtd_to_codec(rtd, 0), 0, 49152000/2,
++									0);
++		break;
++	case 32000:
++	case 16000:
++		return snd_soc_dai_set_sysclk(asoc_rtd_to_codec(rtd, 0), 0, 49152000/3,
++									0);
++		break;
++	case 8000:
++		return snd_soc_dai_set_sysclk(asoc_rtd_to_codec(rtd, 0), 0, 49152000/6,
++									0);
++		break;
++	case 88200:
++	case 44100:
++		return snd_soc_dai_set_sysclk(asoc_rtd_to_codec(rtd, 0), 0, 45185400,
++									0);
++		break;
++	case 22050:
++		return snd_soc_dai_set_sysclk(asoc_rtd_to_codec(rtd, 0), 0, 45185400/2,
++									0);
++		break;
++	case 29400:
++	case 14700:
++		return snd_soc_dai_set_sysclk(asoc_rtd_to_codec(rtd, 0), 0, 45185400/3,
++									0);
++		break;
++	default:
++		return -EINVAL;
++	}
++}
++
++static int audioinjector_octo_trigger(struct snd_pcm_substream *substream,
++								int cmd){
++	DECLARE_BITMAP(mult, 4);
++
++	memset(mult, 0, sizeof(mult));
++
++	switch (cmd) {
++	case SNDRV_PCM_TRIGGER_STOP:
++	case SNDRV_PCM_TRIGGER_SUSPEND:
++	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
++		if (!non_stop_clocks)
++			break;
++		fallthrough;
++	case SNDRV_PCM_TRIGGER_START:
++	case SNDRV_PCM_TRIGGER_RESUME:
++	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
++		switch (audioinjector_octo_rate) {
++		case 96000:
++			__assign_bit(3, mult, 1);
++			fallthrough;
++		case 88200:
++			__assign_bit(1, mult, 1);
++			__assign_bit(2, mult, 1);
++			break;
++		case 48000:
++			__assign_bit(3, mult, 1);
++			fallthrough;
++		case 44100:
++			__assign_bit(2, mult, 1);
++			break;
++		case 32000:
++			__assign_bit(3, mult, 1);
++			fallthrough;
++		case 29400:
++			__assign_bit(0, mult, 1);
++			__assign_bit(1, mult, 1);
++			break;
++		case 24000:
++			__assign_bit(3, mult, 1);
++			fallthrough;
++		case 22050:
++			__assign_bit(1, mult, 1);
++			break;
++		case 16000:
++			__assign_bit(3, mult, 1);
++			fallthrough;
++		case 14700:
++			__assign_bit(0, mult, 1);
++			break;
++		case 8000:
++			__assign_bit(3, mult, 1);
++			break;
++		default:
++			return -EINVAL;
++		}
++		break;
++	default:
++		return -EINVAL;
++	}
++	gpiod_set_array_value_cansleep(mult_gpios->ndescs, mult_gpios->desc,
++				       NULL, mult);
++
++	return 0;
++}
++
++static struct snd_soc_ops audioinjector_octo_ops = {
++	.startup	= audioinjector_octo_startup,
++	.shutdown	= audioinjector_octo_shutdown,
++	.hw_params = audioinjector_octo_hw_params,
++	.trigger = audioinjector_octo_trigger,
++};
++
++SND_SOC_DAILINK_DEFS(audioinjector_octo,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC(NULL, "cs42448")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link audioinjector_octo_dai[] = {
++	{
++		.name = "AudioInjector Octo",
++		.stream_name = "AudioInject-HIFI",
++		.ops = &audioinjector_octo_ops,
++		.init = audioinjector_octo_dai_init,
++		.symmetric_rate = 1,
++		.symmetric_channels = 1,
++		SND_SOC_DAILINK_REG(audioinjector_octo),
++	},
++};
++
++static const struct snd_soc_dapm_widget audioinjector_octo_widgets[] = {
++	SND_SOC_DAPM_OUTPUT("OUTPUTS0"),
++	SND_SOC_DAPM_OUTPUT("OUTPUTS1"),
++	SND_SOC_DAPM_OUTPUT("OUTPUTS2"),
++	SND_SOC_DAPM_OUTPUT("OUTPUTS3"),
++	SND_SOC_DAPM_INPUT("INPUTS0"),
++	SND_SOC_DAPM_INPUT("INPUTS1"),
++	SND_SOC_DAPM_INPUT("INPUTS2"),
++};
++
++static const struct snd_soc_dapm_route audioinjector_octo_route[] = {
++	/* Balanced outputs */
++	{"OUTPUTS0", NULL, "AOUT1L"},
++	{"OUTPUTS0", NULL, "AOUT1R"},
++	{"OUTPUTS1", NULL, "AOUT2L"},
++	{"OUTPUTS1", NULL, "AOUT2R"},
++	{"OUTPUTS2", NULL, "AOUT3L"},
++	{"OUTPUTS2", NULL, "AOUT3R"},
++	{"OUTPUTS3", NULL, "AOUT4L"},
++	{"OUTPUTS3", NULL, "AOUT4R"},
++
++	/* Balanced inputs */
++	{"AIN1L", NULL, "INPUTS0"},
++	{"AIN1R", NULL, "INPUTS0"},
++	{"AIN2L", NULL, "INPUTS1"},
++	{"AIN2R", NULL, "INPUTS1"},
++	{"AIN3L", NULL, "INPUTS2"},
++	{"AIN3R", NULL, "INPUTS2"},
++};
++
++static struct snd_soc_card snd_soc_audioinjector_octo = {
++	.name = "audioinjector-octo-soundcard",
++	.dai_link = audioinjector_octo_dai,
++	.num_links = ARRAY_SIZE(audioinjector_octo_dai),
++
++	.dapm_widgets = audioinjector_octo_widgets,
++	.num_dapm_widgets = ARRAY_SIZE(audioinjector_octo_widgets),
++	.dapm_routes = audioinjector_octo_route,
++	.num_dapm_routes = ARRAY_SIZE(audioinjector_octo_route),
++};
++
++static int audioinjector_octo_probe(struct platform_device *pdev)
++{
++	struct snd_soc_card *card = &snd_soc_audioinjector_octo;
++	int ret;
++
++	card->dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct snd_soc_dai_link *dai = &audioinjector_octo_dai[0];
++		struct device_node *i2s_node =
++					of_parse_phandle(pdev->dev.of_node,
++							"i2s-controller", 0);
++		struct device_node *codec_node =
++					of_parse_phandle(pdev->dev.of_node,
++								"codec", 0);
++
++		mult_gpios = devm_gpiod_get_array_optional(&pdev->dev, "mult",
++								GPIOD_OUT_LOW);
++		if (IS_ERR(mult_gpios))
++			return PTR_ERR(mult_gpios);
++
++		codec_rst_gpio = devm_gpiod_get_optional(&pdev->dev, "reset",
++								GPIOD_OUT_LOW);
++		if (IS_ERR(codec_rst_gpio))
++			return PTR_ERR(codec_rst_gpio);
++
++		non_stop_clocks = of_property_read_bool(pdev->dev.of_node, "non-stop-clocks");
++
++		if (codec_rst_gpio)
++			gpiod_set_value(codec_rst_gpio, 1);
++		msleep(500);
++		if (codec_rst_gpio)
++			gpiod_set_value(codec_rst_gpio, 0);
++		msleep(500);
++		if (codec_rst_gpio)
++			gpiod_set_value(codec_rst_gpio, 1);
++		msleep(500);
++
++		if (i2s_node && codec_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++			dai->codecs->name = NULL;
++			dai->codecs->of_node = codec_node;
++		} else
++			if (!i2s_node) {
++				dev_err(&pdev->dev,
++				"i2s-controller missing or invalid in DT\n");
++				return -EINVAL;
++			} else {
++				dev_err(&pdev->dev,
++				"Property 'codec' missing or invalid\n");
++				return -EINVAL;
++			}
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev, card);
++	if (ret != 0)
++		dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", ret);
++	return ret;
++}
++
++static const struct of_device_id audioinjector_octo_of_match[] = {
++	{ .compatible = "ai,audioinjector-octo-soundcard", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, audioinjector_octo_of_match);
++
++static struct platform_driver audioinjector_octo_driver = {
++	.driver	= {
++		.name			= "audioinjector-octo",
++		.owner			= THIS_MODULE,
++		.of_match_table = audioinjector_octo_of_match,
++	},
++	.probe	= audioinjector_octo_probe,
++};
++
++module_platform_driver(audioinjector_octo_driver);
++MODULE_AUTHOR("Matt Flax <flatmax@flatmax.org>");
++MODULE_DESCRIPTION("AudioInjector.net octo Soundcard");
++MODULE_LICENSE("GPL v2");
++MODULE_ALIAS("platform:audioinjector-octo-soundcard");
+--- /dev/null
++++ b/sound/soc/bcm/audioinjector-pi-soundcard.c
+@@ -0,0 +1,189 @@
++/*
++ * ASoC Driver for AudioInjector Pi add on soundcard
++ *
++ *  Created on: 13-May-2016
++ *      Author: flatmax@flatmax.org
++ *              based on code by  Cliff Cai <Cliff.Cai@analog.com> for the ssm2602 machine blackfin.
++ *              with help from Lars-Peter Clausen for simplifying the original code to use the dai_fmt field.
++ *		i2s_node code taken from the other sound/soc/bcm machine drivers.
++ *
++ * Copyright (C) 2016 Flatmax Pty. Ltd.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/types.h>
++
++#include <sound/core.h>
++#include <sound/soc.h>
++#include <sound/pcm_params.h>
++#include <sound/control.h>
++
++#include "../codecs/wm8731.h"
++
++static const unsigned int bcm2835_rates_12000000[] = {
++	8000, 16000, 32000, 44100, 48000, 96000, 88200,
++};
++
++static struct snd_pcm_hw_constraint_list bcm2835_constraints_12000000 = {
++	.list = bcm2835_rates_12000000,
++	.count = ARRAY_SIZE(bcm2835_rates_12000000),
++};
++
++static int snd_audioinjector_pi_soundcard_startup(struct snd_pcm_substream *substream)
++{
++	/* Setup constraints, because there is a 12 MHz XTAL on the board */
++	snd_pcm_hw_constraint_list(substream->runtime, 0,
++				SNDRV_PCM_HW_PARAM_RATE,
++				&bcm2835_constraints_12000000);
++	return 0;
++}
++
++static int snd_audioinjector_pi_soundcard_hw_params(struct snd_pcm_substream *substream,
++				       struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *cpu_dai = asoc_rtd_to_cpu(rtd, 0);
++
++	switch (params_rate(params)){
++		case 8000:
++			return snd_soc_dai_set_bclk_ratio(cpu_dai, 1);
++		case 16000:
++			return snd_soc_dai_set_bclk_ratio(cpu_dai, 750);
++		case 32000:
++			return snd_soc_dai_set_bclk_ratio(cpu_dai, 375);
++		case 44100:
++			return snd_soc_dai_set_bclk_ratio(cpu_dai, 272);
++		case 48000:
++			return snd_soc_dai_set_bclk_ratio(cpu_dai, 250);
++		case 88200:
++			return snd_soc_dai_set_bclk_ratio(cpu_dai, 136);
++		case 96000:
++			return snd_soc_dai_set_bclk_ratio(cpu_dai, 125);
++		default:
++			return snd_soc_dai_set_bclk_ratio(cpu_dai, 125);
++	}
++}
++
++/* machine stream operations */
++static struct snd_soc_ops snd_audioinjector_pi_soundcard_ops = {
++	.startup = snd_audioinjector_pi_soundcard_startup,
++	.hw_params = snd_audioinjector_pi_soundcard_hw_params,
++};
++
++static int audioinjector_pi_soundcard_dai_init(struct snd_soc_pcm_runtime *rtd)
++{
++	return snd_soc_dai_set_sysclk(asoc_rtd_to_codec(rtd, 0), WM8731_SYSCLK_XTAL, 12000000, SND_SOC_CLOCK_IN);
++}
++
++SND_SOC_DAILINK_DEFS(audioinjector_pi,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("wm8731.1-001a", "wm8731-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2835-i2s.0")));
++
++static struct snd_soc_dai_link audioinjector_pi_soundcard_dai[] = {
++	{
++		.name = "AudioInjector audio",
++		.stream_name = "AudioInjector audio",
++		.ops = &snd_audioinjector_pi_soundcard_ops,
++		.init = audioinjector_pi_soundcard_dai_init,
++		.dai_fmt = SND_SOC_DAIFMT_CBM_CFM|SND_SOC_DAIFMT_I2S|SND_SOC_DAIFMT_NB_NF,
++		SND_SOC_DAILINK_REG(audioinjector_pi),
++	},
++};
++
++static const struct snd_soc_dapm_widget wm8731_dapm_widgets[] = {
++	SND_SOC_DAPM_HP("Headphone Jack", NULL),
++	SND_SOC_DAPM_SPK("Ext Spk", NULL),
++	SND_SOC_DAPM_LINE("Line In Jacks", NULL),
++	SND_SOC_DAPM_MIC("Microphone", NULL),
++};
++
++static const struct snd_soc_dapm_route audioinjector_audio_map[] = {
++	/* headphone connected to LHPOUT, RHPOUT */
++	{"Headphone Jack", NULL, "LHPOUT"},
++	{"Headphone Jack", NULL, "RHPOUT"},
++
++	/* speaker connected to LOUT, ROUT */
++	{"Ext Spk", NULL, "ROUT"},
++	{"Ext Spk", NULL, "LOUT"},
++
++	/* line inputs */
++	{"Line In Jacks", NULL, "Line Input"},
++
++	/* mic is connected to Mic Jack, with WM8731 Mic Bias */
++	{"Microphone", NULL, "Mic Bias"},
++};
++
++static struct snd_soc_card snd_soc_audioinjector = {
++	.name = "audioinjector-pi-soundcard",
++	.dai_link = audioinjector_pi_soundcard_dai,
++	.num_links = ARRAY_SIZE(audioinjector_pi_soundcard_dai),
++
++	.dapm_widgets = wm8731_dapm_widgets,
++	.num_dapm_widgets = ARRAY_SIZE(wm8731_dapm_widgets),
++	.dapm_routes = audioinjector_audio_map,
++	.num_dapm_routes = ARRAY_SIZE(audioinjector_audio_map),
++};
++
++static int audioinjector_pi_soundcard_probe(struct platform_device *pdev)
++{
++	struct snd_soc_card *card = &snd_soc_audioinjector;
++	int ret;
++	
++	card->dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct snd_soc_dai_link *dai = &audioinjector_pi_soundcard_dai[0];
++		struct device_node *i2s_node = of_parse_phandle(pdev->dev.of_node,
++								"i2s-controller", 0);
++
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		} else
++			if (!dai->cpus->of_node) {
++				dev_err(&pdev->dev, "Property 'i2s-controller' missing or invalid\n");
++				return -EINVAL;
++			}
++	}
++
++	if ((ret = devm_snd_soc_register_card(&pdev->dev, card)))
++		return dev_err_probe(&pdev->dev, ret, "%s\n", __func__);
++
++	dev_info(&pdev->dev, "successfully loaded\n");
++
++	return ret;
++}
++
++static const struct of_device_id audioinjector_pi_soundcard_of_match[] = {
++	{ .compatible = "ai,audioinjector-pi-soundcard", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, audioinjector_pi_soundcard_of_match);
++
++static struct platform_driver audioinjector_pi_soundcard_driver = {
++       .driver         = {
++		.name   = "audioinjector-stereo",
++		.owner  = THIS_MODULE,
++		.of_match_table = audioinjector_pi_soundcard_of_match,
++       },
++       .probe          = audioinjector_pi_soundcard_probe,
++};
++
++module_platform_driver(audioinjector_pi_soundcard_driver);
++MODULE_AUTHOR("Matt Flax <flatmax@flatmax.org>");
++MODULE_DESCRIPTION("AudioInjector.net Pi Soundcard");
++MODULE_LICENSE("GPL v2");
++MODULE_ALIAS("platform:audioinjector-pi-soundcard");
++
+--- /dev/null
++++ b/sound/soc/bcm/audiosense-pi.c
+@@ -0,0 +1,248 @@
++/*
++ * ASoC Driver for AudioSense add on soundcard
++ * Author:
++ *	Bhargav A K <anur.bhargav@gmail.com>
++ *	Copyright 2017
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/clk.h>
++#include <linux/i2c.h>
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++#include <sound/control.h>
++
++#include <sound/tlv320aic32x4.h>
++#include "../codecs/tlv320aic32x4.h"
++
++#define AIC32X4_SYSCLK_XTAL	0x00
++
++/*
++ * Setup Codec Sample Rates and Channels
++ * Supported Rates:
++ *	8000, 11025, 16000, 22050, 32000, 44100, 48000, 64000, 88200, 96000,
++ */
++static const unsigned int audiosense_pi_rate[] = {
++	48000,
++};
++
++static struct snd_pcm_hw_constraint_list audiosense_constraints_rates = {
++	.list = audiosense_pi_rate,
++	.count = ARRAY_SIZE(audiosense_pi_rate),
++};
++
++static const unsigned int audiosense_pi_channels[] = {
++	2,
++};
++
++static struct snd_pcm_hw_constraint_list audiosense_constraints_ch = {
++	.count = ARRAY_SIZE(audiosense_pi_channels),
++	.list = audiosense_pi_channels,
++	.mask = 0,
++};
++
++/* Setup DAPM widgets and paths */
++static const struct snd_soc_dapm_widget audiosense_pi_dapm_widgets[] = {
++	SND_SOC_DAPM_HP("Headphone Jack", NULL),
++	SND_SOC_DAPM_LINE("Line Out", NULL),
++	SND_SOC_DAPM_LINE("Line In", NULL),
++	SND_SOC_DAPM_INPUT("CM_L"),
++	SND_SOC_DAPM_INPUT("CM_R"),
++};
++
++static const struct snd_soc_dapm_route audiosense_pi_audio_map[] = {
++	/* Line Inputs are connected to
++	 * (IN1_L | IN1_R)
++	 * (IN2_L | IN2_R)
++	 * (IN3_L | IN3_R)
++	 */
++	{"IN1_L", NULL, "Line In"},
++	{"IN1_R", NULL, "Line In"},
++	{"IN2_L", NULL, "Line In"},
++	{"IN2_R", NULL, "Line In"},
++	{"IN3_L", NULL, "Line In"},
++	{"IN3_R", NULL, "Line In"},
++
++	/* Mic is connected to IN2_L and IN2_R */
++	{"Left ADC", NULL, "Mic Bias"},
++	{"Right ADC", NULL, "Mic Bias"},
++
++	/* Headphone connected to HPL, HPR */
++	{"Headphone Jack", NULL, "HPL"},
++	{"Headphone Jack", NULL, "HPR"},
++
++	/* Speakers connected to LOL and LOR */
++	{"Line Out", NULL, "LOL"},
++	{"Line Out", NULL, "LOR"},
++};
++
++static int audiosense_pi_card_init(struct snd_soc_pcm_runtime *rtd)
++{
++	/* TODO: init of the codec specific dapm data, ignore suspend/resume */
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++
++	snd_soc_component_update_bits(component, AIC32X4_MICBIAS, 0x78,
++				      AIC32X4_MICBIAS_LDOIN |
++				      AIC32X4_MICBIAS_2075V);
++	snd_soc_component_update_bits(component, AIC32X4_PWRCFG, 0x08,
++				      AIC32X4_AVDDWEAKDISABLE);
++	snd_soc_component_update_bits(component, AIC32X4_LDOCTL, 0x01,
++				      AIC32X4_LDOCTLEN);
++
++	return 0;
++}
++
++static int audiosense_pi_card_hw_params(
++		struct snd_pcm_substream *substream,
++		struct snd_pcm_hw_params *params)
++{
++	int ret = 0;
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *codec_dai = asoc_rtd_to_codec(rtd, 0);
++
++	/* Set the codec system clock, there is a 12 MHz XTAL on the board */
++	ret = snd_soc_dai_set_sysclk(codec_dai, AIC32X4_SYSCLK_XTAL,
++				     12000000, SND_SOC_CLOCK_IN);
++	if (ret) {
++		dev_err(rtd->card->dev,
++			"could not set codec driver clock params\n");
++		return ret;
++	}
++	return 0;
++}
++
++static int audiosense_pi_card_startup(struct snd_pcm_substream *substream)
++{
++	struct snd_pcm_runtime *runtime = substream->runtime;
++
++	/*
++	 * Set codec to 48Khz Sampling, Stereo I/O and 16 bit audio
++	 */
++	runtime->hw.channels_max = 2;
++	snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS,
++				   &audiosense_constraints_ch);
++
++	runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE;
++	snd_pcm_hw_constraint_msbits(runtime, 0, 16, 16);
++
++
++	snd_pcm_hw_constraint_list(substream->runtime, 0,
++				   SNDRV_PCM_HW_PARAM_RATE,
++				   &audiosense_constraints_rates);
++	return 0;
++}
++
++static struct snd_soc_ops audiosense_pi_card_ops = {
++	.startup = audiosense_pi_card_startup,
++	.hw_params = audiosense_pi_card_hw_params,
++};
++
++SND_SOC_DAILINK_DEFS(audiosense_pi,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("tlv320aic32x4.1-0018", "tlv320aic32x4-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link audiosense_pi_card_dai[] = {
++	{
++		.name           = "TLV320AIC3204 Audio",
++		.stream_name    = "TLV320AIC3204 Hifi Audio",
++		.dai_fmt        = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++			SND_SOC_DAIFMT_CBM_CFM,
++		.ops            = &audiosense_pi_card_ops,
++		.init           = audiosense_pi_card_init,
++		SND_SOC_DAILINK_REG(audiosense_pi),
++	},
++};
++
++static struct snd_soc_card audiosense_pi_card = {
++	.name		= "audiosense-pi",
++	.driver_name	= "audiosense-pi",
++	.dai_link	= audiosense_pi_card_dai,
++	.owner		= THIS_MODULE,
++	.num_links	= ARRAY_SIZE(audiosense_pi_card_dai),
++	.dapm_widgets	= audiosense_pi_dapm_widgets,
++	.num_dapm_widgets = ARRAY_SIZE(audiosense_pi_dapm_widgets),
++	.dapm_routes	= audiosense_pi_audio_map,
++	.num_dapm_routes = ARRAY_SIZE(audiosense_pi_audio_map),
++};
++
++static int audiosense_pi_card_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	struct snd_soc_card *card = &audiosense_pi_card;
++	struct snd_soc_dai_link *dai = &audiosense_pi_card_dai[0];
++	struct device_node *i2s_node = pdev->dev.of_node;
++
++	card->dev = &pdev->dev;
++
++	if (!dai) {
++		dev_err(&pdev->dev, "DAI not found. Missing or Invalid\n");
++		return -EINVAL;
++	}
++
++	i2s_node = of_parse_phandle(pdev->dev.of_node, "i2s-controller", 0);
++	if (!i2s_node) {
++		dev_err(&pdev->dev,
++			"Property 'i2s-controller' missing or invalid\n");
++		return -EINVAL;
++	}
++
++	dai->cpus->dai_name = NULL;
++	dai->cpus->of_node = i2s_node;
++	dai->platforms->name = NULL;
++	dai->platforms->of_node = i2s_node;
++
++	of_node_put(i2s_node);
++
++	ret = snd_soc_register_card(card);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev,
++			"snd_soc_register_card() failed: %d\n", ret);
++
++	return ret;
++}
++
++static int audiosense_pi_card_remove(struct platform_device *pdev)
++{
++	struct snd_soc_card *card = platform_get_drvdata(pdev);
++
++	snd_soc_unregister_card(card);
++	return 0;
++}
++
++static const struct of_device_id audiosense_pi_card_of_match[] = {
++	{ .compatible = "as,audiosense-pi", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, audiosense_pi_card_of_match);
++
++static struct platform_driver audiosense_pi_card_driver = {
++	.driver = {
++		.name = "audiosense-snd-card",
++		.owner = THIS_MODULE,
++		.of_match_table = audiosense_pi_card_of_match,
++	},
++	.probe = audiosense_pi_card_probe,
++	.remove = audiosense_pi_card_remove,
++};
++
++module_platform_driver(audiosense_pi_card_driver);
++
++MODULE_AUTHOR("Bhargav AK <anur.bhargav@gmail.com>");
++MODULE_DESCRIPTION("ASoC Driver for TLV320AIC3204 Audio");
++MODULE_LICENSE("GPL v2");
++MODULE_ALIAS("platform:audiosense-pi");
++
+--- /dev/null
++++ b/sound/soc/bcm/chipdip-dac.c
+@@ -0,0 +1,275 @@
++/*
++ * ASoC Driver for ChipDip DAC
++ *
++ * Author:	Evgenij Sapunov
++ *		Copyright 2021
++ *		based on code by Milan Neskovic <info@justboom.co>
++ *		based on code by Jaikumar <jaikumar@cem-solutions.net>
++ *
++ * Thanks to Phil Elwell (pelwell) for help.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/gpio/consumer.h>
++#include <linux/platform_device.h>
++#include <linux/delay.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++#define SR_BIT_0                  0 //sample rate bits
++#define SR_BIT_1                  1
++#define SR_BIT_2                  2
++#define BD_BIT_0                  3 //bit depth bits
++#define BD_BIT_1                  4
++
++#define SAMPLE_RATE_MASK_44_1     0
++#define SAMPLE_RATE_MASK_48       (1 << SR_BIT_0)
++#define SAMPLE_RATE_MASK_88_2     ((1 << SR_BIT_2) | (1 << SR_BIT_1))
++#define SAMPLE_RATE_MASK_96       (1 << SR_BIT_1)
++#define SAMPLE_RATE_MASK_176_4    ((1 << SR_BIT_2) | (1 << SR_BIT_1) | (1 << SR_BIT_0))
++#define SAMPLE_RATE_MASK_192      ((1 << SR_BIT_1) | (1 << SR_BIT_0))
++#define SAMPLE_RATE_MASK          ((1 << SR_BIT_2) | (1 << SR_BIT_1) | (1 << SR_BIT_0))
++
++#define BIT_DEPTH_MASK_16         0
++#define BIT_DEPTH_MASK_24         (1 << BD_BIT_0)
++#define BIT_DEPTH_MASK_32         (1 << BD_BIT_1)
++#define BIT_DEPTH_MASK            ((1 << BD_BIT_1) | (1 << BD_BIT_0))
++
++#define MUTE_ACTIVE               0
++#define MUTE_NOT_ACTIVE           1
++
++#define HW_PARAMS_GPIO_COUNT      5
++
++static struct gpio_desc *mute_gpio;
++static struct gpio_desc *sdwn_gpio;
++static struct gpio_desc *hw_params_gpios[HW_PARAMS_GPIO_COUNT];
++static int current_width;
++static int current_rate;
++
++static void snd_rpi_chipdip_dac_gpio_array_set(int value);
++static void snd_rpi_chipdip_dac_gpio_set(struct gpio_desc *gpio_item, int value);
++
++static void snd_rpi_chipdip_dac_gpio_array_set(int value)
++{
++	int i = 0;
++
++	for (i = 0; i < HW_PARAMS_GPIO_COUNT; i++)
++		snd_rpi_chipdip_dac_gpio_set(hw_params_gpios[i], ((value >> i) & 1));
++}
++
++static void snd_rpi_chipdip_dac_gpio_set(struct gpio_desc *gpio_item, int value)
++{
++	if (gpio_item)
++		gpiod_set_value_cansleep(gpio_item, value);
++}
++
++static int snd_rpi_chipdip_dac_init(struct snd_soc_pcm_runtime *rtd)
++{
++	return 0;
++}
++
++static int snd_rpi_chipdip_dac_hw_params(struct snd_pcm_substream *substream,
++					 struct snd_pcm_hw_params *params)
++{
++	int ret = 0;
++	int gpio_change_pending = 0;
++	int sample_rate_state = 0;
++	int bit_depth_state = 0;
++	int param_value = params_width(params);
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++
++	ret = snd_soc_dai_set_bclk_ratio(asoc_rtd_to_cpu(rtd, 0), 2 * 32);
++
++	if (current_width != param_value) {
++		current_width = param_value;
++		gpio_change_pending = 1;
++
++		switch (param_value) {
++		case 16:
++			bit_depth_state = BIT_DEPTH_MASK_16;
++			break;
++		case 24:
++			bit_depth_state = BIT_DEPTH_MASK_24;
++			break;
++		case 32:
++			bit_depth_state = BIT_DEPTH_MASK_32;
++			break;
++		default:
++			return -EINVAL;
++		}
++	}
++
++	param_value = params_rate(params);
++	if (current_rate != param_value) {
++		current_rate = param_value;
++		gpio_change_pending = 1;
++
++		switch (param_value) {
++		case 44100:
++			sample_rate_state = SAMPLE_RATE_MASK_44_1;
++			break;
++		case 48000:
++			sample_rate_state = SAMPLE_RATE_MASK_48;
++			break;
++		case 88200:
++			sample_rate_state = SAMPLE_RATE_MASK_88_2;
++			break;
++		case 96000:
++			sample_rate_state = SAMPLE_RATE_MASK_96;
++			break;
++		case 176400:
++			sample_rate_state = SAMPLE_RATE_MASK_176_4;
++			break;
++		case 192000:
++			sample_rate_state = SAMPLE_RATE_MASK_192;
++			break;
++		default:
++			return -EINVAL;
++		}
++	}
++
++	if (gpio_change_pending) {
++		snd_rpi_chipdip_dac_gpio_set(mute_gpio, MUTE_ACTIVE);
++		snd_rpi_chipdip_dac_gpio_array_set(bit_depth_state | sample_rate_state);
++		msleep(300);
++		snd_rpi_chipdip_dac_gpio_set(mute_gpio, MUTE_NOT_ACTIVE);
++	}
++
++	return ret;
++}
++
++static int snd_rpi_chipdip_dac_startup(struct snd_pcm_substream *substream)
++{
++	return 0;
++}
++
++static void snd_rpi_chipdip_dac_shutdown(struct snd_pcm_substream *substream)
++{
++
++}
++
++/* machine stream operations */
++static struct snd_soc_ops snd_rpi_chipdip_dac_ops = {
++	.hw_params = snd_rpi_chipdip_dac_hw_params,
++	.startup = snd_rpi_chipdip_dac_startup,
++	.shutdown = snd_rpi_chipdip_dac_shutdown,
++};
++
++SND_SOC_DAILINK_DEFS(hifi,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("spdif-transmitter", "dit-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_chipdip_dac_dai[] = {
++{
++	.name		= "ChipDip DAC",
++	.stream_name	= "ChipDip DAC HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBM_CFM,
++	.ops		= &snd_rpi_chipdip_dac_ops,
++	.init		= snd_rpi_chipdip_dac_init,
++	SND_SOC_DAILINK_REG(hifi),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_chipdip_dac = {
++	.name         = "ChipDipDAC",
++	.driver_name  = "ChipdipDac",
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_rpi_chipdip_dac_dai,
++	.num_links    = ARRAY_SIZE(snd_rpi_chipdip_dac_dai),
++};
++
++static int snd_rpi_chipdip_dac_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	int i = 0;
++
++	snd_rpi_chipdip_dac.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai = &snd_rpi_chipdip_dac_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++					"i2s-controller", 0);
++
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		}
++	}
++
++	hw_params_gpios[SR_BIT_0] = devm_gpiod_get_optional(&pdev->dev, "sr0", GPIOD_OUT_LOW);
++	hw_params_gpios[SR_BIT_1] = devm_gpiod_get_optional(&pdev->dev, "sr1", GPIOD_OUT_LOW);
++	hw_params_gpios[SR_BIT_2] = devm_gpiod_get_optional(&pdev->dev, "sr2", GPIOD_OUT_LOW);
++	hw_params_gpios[BD_BIT_0] = devm_gpiod_get_optional(&pdev->dev, "res0", GPIOD_OUT_LOW);
++	hw_params_gpios[BD_BIT_1] = devm_gpiod_get_optional(&pdev->dev, "res1", GPIOD_OUT_LOW);
++	mute_gpio = devm_gpiod_get_optional(&pdev->dev, "mute", GPIOD_OUT_LOW);
++	sdwn_gpio = devm_gpiod_get_optional(&pdev->dev, "sdwn", GPIOD_OUT_HIGH);
++
++	for (i = 0; i < HW_PARAMS_GPIO_COUNT; i++) {
++		if (IS_ERR(hw_params_gpios[i])) {
++			ret = PTR_ERR(hw_params_gpios[i]);
++			dev_err(&pdev->dev, "failed to get hw_params gpio: %d\n", ret);
++			return ret;
++		}
++	}
++
++	if (IS_ERR(mute_gpio)) {
++		ret = PTR_ERR(mute_gpio);
++		dev_err(&pdev->dev, "failed to get mute gpio: %d\n", ret);
++		return ret;
++	}
++
++	if (IS_ERR(sdwn_gpio)) {
++		ret = PTR_ERR(sdwn_gpio);
++		dev_err(&pdev->dev, "failed to get sdwn gpio: %d\n", ret);
++		return ret;
++	}
++
++	snd_rpi_chipdip_dac_gpio_set(sdwn_gpio, 1);
++
++	ret = devm_snd_soc_register_card(&pdev->dev, &snd_rpi_chipdip_dac);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev,
++			"snd_soc_register_card() failed: %d\n", ret);
++
++	return ret;
++}
++
++static const struct of_device_id snd_rpi_chipdip_dac_of_match[] = {
++	{ .compatible = "chipdip,chipdip-dac", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, snd_rpi_chipdip_dac_of_match);
++
++static struct platform_driver snd_rpi_chipdip_dac_driver = {
++	.driver = {
++		.name   = "snd-rpi-chipdip-dac",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_rpi_chipdip_dac_of_match,
++	},
++	.probe          = snd_rpi_chipdip_dac_probe,
++};
++
++module_platform_driver(snd_rpi_chipdip_dac_driver);
++
++MODULE_AUTHOR("Evgenij Sapunov <evgenij.sapunov@chipdip.ru>");
++MODULE_DESCRIPTION("ASoC Driver for ChipDip DAC");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/dacberry400.c
+@@ -0,0 +1,259 @@
++/*
++ * ASoC Driver for Dacberry400 soundcard
++ * Author:
++ *      Ashish Vara<ashishhvara@gmail.com>
++ *      Copyright 2022
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/gpio/consumer.h>
++#include <linux/platform_device.h>
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++#include <linux/i2c.h>
++#include <linux/acpi.h>
++#include <linux/slab.h>
++#include "../sound/soc/codecs/tlv320aic3x.h"
++
++static const struct snd_kcontrol_new dacberry400_controls[] = {
++	SOC_DAPM_PIN_SWITCH("MIC Jack"),
++	SOC_DAPM_PIN_SWITCH("Line In"),
++	SOC_DAPM_PIN_SWITCH("Line Out"),
++	SOC_DAPM_PIN_SWITCH("Headphone Jack"),
++};
++
++static const struct snd_soc_dapm_widget dacberry400_widgets[] = {
++	SND_SOC_DAPM_HP("Headphone Jack", NULL),
++	SND_SOC_DAPM_MIC("MIC Jack", NULL),
++	SND_SOC_DAPM_LINE("Line In", NULL),
++	SND_SOC_DAPM_LINE("Line Out", NULL),
++};
++
++static const struct snd_soc_dapm_route dacberry400_audio_map[] = {
++	{"Headphone Jack", NULL, "HPLOUT"},
++	{"Headphone Jack", NULL, "HPROUT"},
++
++	{"LINE1L", NULL, "Line In"},
++	{"LINE1R", NULL, "Line In"},
++
++	{"Line Out", NULL, "LLOUT"},
++	{"Line Out", NULL, "RLOUT"},
++
++	{"MIC3L", NULL, "MIC Jack"},
++	{"MIC3R", NULL, "MIC Jack"},
++};
++
++static int snd_rpi_dacberry400_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_dai *codec_dai = asoc_rtd_to_codec(rtd, 0);
++	struct snd_soc_component *component = codec_dai->component;
++	int ret;
++
++	ret = snd_soc_dai_set_sysclk(codec_dai, 2, 12000000,
++					SND_SOC_CLOCK_OUT);
++
++	if (ret && ret != -ENOTSUPP)
++		goto err;
++
++	snd_soc_component_write(component, HPRCOM_CFG, 0x20);
++	snd_soc_component_write(component, DACL1_2_HPLOUT_VOL, 0x80);
++	snd_soc_component_write(component, DACR1_2_HPROUT_VOL, 0x80);
++err:
++	return ret;
++}
++
++static int snd_rpi_dacberry400_set_bias_level(struct snd_soc_card *card,
++	struct snd_soc_dapm_context *dapm, enum snd_soc_bias_level level)
++{
++	struct snd_soc_pcm_runtime *rtd;
++	struct snd_soc_dai *codec_dai;
++	struct snd_soc_component *component;
++	struct dacberry_priv *aic3x;
++	u8 hpcom_reg = 0;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++	codec_dai = asoc_rtd_to_codec(rtd, 0);
++	component = codec_dai->component;
++	aic3x = snd_soc_component_get_drvdata(component);
++	if (dapm->dev != codec_dai->dev)
++		return 0;
++
++	switch (level) {
++	case SND_SOC_BIAS_PREPARE:
++		if (dapm->bias_level != SND_SOC_BIAS_STANDBY)
++			break;
++		/* UNMUTE ADC/DAC */
++		hpcom_reg = snd_soc_component_read(component, HPLCOM_CFG);
++		snd_soc_component_write(component, HPLCOM_CFG, hpcom_reg | 0x20);
++		snd_soc_component_write(component, LINE1R_2_RADC_CTRL, 0x04);
++		snd_soc_component_write(component, LINE1L_2_LADC_CTRL, 0x04);
++		snd_soc_component_write(component, LADC_VOL, 0x00);
++		snd_soc_component_write(component, RADC_VOL, 0x00);
++		pr_info("%s: unmute ADC/DAC\n", __func__);
++		break;
++
++	case SND_SOC_BIAS_STANDBY:
++		if (dapm->bias_level != SND_SOC_BIAS_PREPARE)
++			break;
++		/* MUTE ADC/DAC */
++		snd_soc_component_write(component, LDAC_VOL, 0x80);
++		snd_soc_component_write(component, RDAC_VOL, 0x80);
++		snd_soc_component_write(component, LADC_VOL, 0x80);
++		snd_soc_component_write(component, RADC_VOL, 0x80);
++		snd_soc_component_write(component, LINE1R_2_RADC_CTRL, 0x00);
++		snd_soc_component_write(component, LINE1L_2_LADC_CTRL, 0x00);
++		snd_soc_component_write(component, HPLCOM_CFG, 0x00);
++		pr_info("%s: mute ADC/DAC\n", __func__);
++		break;
++	default:
++		break;
++	}
++
++	return 0;
++}
++
++static int snd_rpi_dacberry400_hw_params(struct snd_pcm_substream *substream,
++					   struct snd_pcm_hw_params *params)
++{
++	int ret = 0;
++	u8 data;
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *codec_dai = asoc_rtd_to_codec(rtd, 0);
++	struct snd_soc_dai *cpu_dai = asoc_rtd_to_cpu(rtd, 0);
++	struct snd_soc_component *component = codec_dai->component;
++	int fsref = (params_rate(params) % 11025 == 0) ? 44100 : 48000;
++	int channels = params_channels(params);
++	int width = 32;
++	u8 clock = 0;
++
++	data = (LDAC2LCH | RDAC2RCH);
++	data |= (fsref == 44100) ? FSREF_44100 : FSREF_48000;
++	if (params_rate(params) >= 64000)
++		data |= DUAL_RATE_MODE;
++	ret = snd_soc_component_write(component, 0x7, data);
++	width = params_width(params);
++
++	clock = snd_soc_component_read(component, 2);
++
++	ret = snd_soc_dai_set_bclk_ratio(cpu_dai, channels*width);
++
++	return ret;
++}
++
++static const struct snd_soc_ops snd_rpi_dacberry400_ops = {
++	.hw_params = snd_rpi_dacberry400_hw_params,
++};
++
++
++SND_SOC_DAILINK_DEFS(rpi_dacberry400,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2835-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("tlv320aic3x.1-0018", "tlv320aic3x-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2835-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_dacberry400_dai[] = {
++{
++	.dai_fmt		= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++					SND_SOC_DAIFMT_CBS_CFS,
++	.init			= snd_rpi_dacberry400_init,
++	.ops			= &snd_rpi_dacberry400_ops,
++	.symmetric_rate		= 1,
++	SND_SOC_DAILINK_REG(rpi_dacberry400),
++},
++};
++
++static struct snd_soc_card snd_rpi_dacberry400 = {
++	.owner			= THIS_MODULE,
++	.dai_link		= snd_rpi_dacberry400_dai,
++	.num_links		= ARRAY_SIZE(snd_rpi_dacberry400_dai),
++	.controls		= dacberry400_controls,
++	.num_controls		= ARRAY_SIZE(dacberry400_controls),
++	.dapm_widgets		= dacberry400_widgets,
++	.num_dapm_widgets	= ARRAY_SIZE(dacberry400_widgets),
++	.dapm_routes		= dacberry400_audio_map,
++	.num_dapm_routes	= ARRAY_SIZE(dacberry400_audio_map),
++	.set_bias_level		= snd_rpi_dacberry400_set_bias_level,
++};
++
++static int snd_rpi_dacberry400_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++
++	snd_rpi_dacberry400.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_card *card = &snd_rpi_dacberry400;
++		struct snd_soc_dai_link *dai = &snd_rpi_dacberry400_dai[0];
++
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++					    "i2s-controller", 0);
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++			of_node_put(i2s_node);
++		}
++
++		if (of_property_read_string(pdev->dev.of_node, "card_name",
++					    &card->name))
++			card->name = "tlvaudioCODEC";
++
++		if (of_property_read_string(pdev->dev.of_node, "dai_name",
++					    &dai->name))
++			dai->name = "tlvaudio CODEC";
++
++	}
++
++	ret = snd_soc_register_card(&snd_rpi_dacberry400);
++	if (ret) {
++		if (ret != -EPROBE_DEFER)
++			dev_err(&pdev->dev,
++				"snd_soc_register_card() failed: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++static int snd_rpi_dacberry400_remove(struct platform_device *pdev)
++{
++	snd_soc_unregister_card(&snd_rpi_dacberry400);
++	return 0;
++}
++
++static const struct of_device_id dacberry400_match_id[] = {
++	{ .compatible = "osaelectronics,dacberry400",},
++	{},
++};
++MODULE_DEVICE_TABLE(of, dacberry400_match_id);
++
++static struct platform_driver snd_rpi_dacberry400_driver = {
++	.driver = {
++		.name = "snd-rpi-dacberry400",
++		.owner = THIS_MODULE,
++		.of_match_table = dacberry400_match_id,
++	},
++	.probe = snd_rpi_dacberry400_probe,
++	.remove = snd_rpi_dacberry400_remove,
++};
++
++module_platform_driver(snd_rpi_dacberry400_driver);
++
++MODULE_AUTHOR("Ashish Vara");
++MODULE_DESCRIPTION("Dacberry400 sound card driver");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:dacberry400");
++MODULE_SOFTDEP("pre: snd-soc-tlv320aic3x");
+--- /dev/null
++++ b/sound/soc/bcm/digidac1-soundcard.c
+@@ -0,0 +1,421 @@
++/*
++ * ASoC Driver for RRA DigiDAC1
++ * Copyright 2016
++ * Author: José M. Tasende <vintage@redrocksaudio.es>
++ * based on the HifiBerry DAC driver by Florian Meier <florian.meier@koalo.de>
++ * and the Wolfson card driver by Nikesh Oswal, <Nikesh.Oswal@wolfsonmicro.com>
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/i2c.h>
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++#include <sound/soc-dapm.h>
++#include <sound/tlv.h>
++#include <linux/regulator/consumer.h>
++
++#include "../codecs/wm8804.h"
++#include "../codecs/wm8741.h"
++
++#define WM8741_NUM_SUPPLIES 2
++
++/* codec private data */
++struct wm8741_priv {
++	struct wm8741_platform_data pdata;
++	struct regmap *regmap;
++	struct regulator_bulk_data supplies[WM8741_NUM_SUPPLIES];
++	unsigned int sysclk;
++	const struct snd_pcm_hw_constraint_list *sysclk_constraints;
++};
++
++static int samplerate = 44100;
++
++/* New Alsa Controls not exposed by original wm8741 codec driver	*/
++/* in actual driver the att. adjustment is wrong because		*/
++/* this DAC has a coarse attenuation register with 4dB steps		*/
++/* and a fine level register with 0.125dB steps				*/
++/* each register has 32 steps so combining both we have	1024 steps	*/
++/* of 0.125 dB.								*/
++/* The original level controls from driver are removed at startup	*/
++/* and replaced by the corrected ones.					*/
++/* The same wm8741 driver can be used for wm8741 and wm8742 devices	*/
++
++static const DECLARE_TLV_DB_SCALE(dac_tlv_fine, 0, 13, 0);
++static const DECLARE_TLV_DB_SCALE(dac_tlv_coarse, -12700, 400, 1);
++static const char *w8741_dither[4] = {"Off", "RPDF", "TPDF", "HPDF"};
++static const char *w8741_filter[5] = {
++		"Type 1", "Type 2", "Type 3", "Type 4", "Type 5"};
++static const char *w8741_switch[2] = {"Off", "On"};
++static const struct soc_enum w8741_enum[] = {
++SOC_ENUM_SINGLE(WM8741_MODE_CONTROL_2, 0, 4, w8741_dither),/* dithering type */
++SOC_ENUM_SINGLE(WM8741_FILTER_CONTROL, 0, 5, w8741_filter),/* filter type */
++SOC_ENUM_SINGLE(WM8741_FORMAT_CONTROL, 6, 2, w8741_switch),/* phase invert */
++SOC_ENUM_SINGLE(WM8741_VOLUME_CONTROL, 0, 2, w8741_switch),/* volume ramp */
++SOC_ENUM_SINGLE(WM8741_VOLUME_CONTROL, 3, 2, w8741_switch),/* soft mute */
++};
++
++static const struct snd_kcontrol_new w8741_snd_controls_stereo[] = {
++SOC_DOUBLE_R_TLV("DAC Fine Playback Volume", WM8741_DACLLSB_ATTENUATION,
++		WM8741_DACRLSB_ATTENUATION, 0, 31, 1, dac_tlv_fine),
++SOC_DOUBLE_R_TLV("Digital Playback Volume", WM8741_DACLMSB_ATTENUATION,
++		WM8741_DACRMSB_ATTENUATION, 0, 31, 1, dac_tlv_coarse),
++SOC_ENUM("DAC Dither", w8741_enum[0]),
++SOC_ENUM("DAC Digital Filter", w8741_enum[1]),
++SOC_ENUM("DAC Phase Invert", w8741_enum[2]),
++SOC_ENUM("DAC Volume Ramp", w8741_enum[3]),
++SOC_ENUM("DAC Soft Mute", w8741_enum[4]),
++};
++
++static const struct snd_kcontrol_new w8741_snd_controls_mono_left[] = {
++SOC_SINGLE_TLV("DAC Fine Playback Volume", WM8741_DACLLSB_ATTENUATION,
++		0, 31, 0, dac_tlv_fine),
++SOC_SINGLE_TLV("Digital Playback Volume", WM8741_DACLMSB_ATTENUATION,
++		0, 31, 1, dac_tlv_coarse),
++SOC_ENUM("DAC Dither", w8741_enum[0]),
++SOC_ENUM("DAC Digital Filter", w8741_enum[1]),
++SOC_ENUM("DAC Phase Invert", w8741_enum[2]),
++SOC_ENUM("DAC Volume Ramp", w8741_enum[3]),
++SOC_ENUM("DAC Soft Mute", w8741_enum[4]),
++};
++
++static const struct snd_kcontrol_new w8741_snd_controls_mono_right[] = {
++SOC_SINGLE_TLV("DAC Fine Playback Volume", WM8741_DACRLSB_ATTENUATION,
++	0, 31, 0, dac_tlv_fine),
++SOC_SINGLE_TLV("Digital Playback Volume", WM8741_DACRMSB_ATTENUATION,
++	0, 31, 1, dac_tlv_coarse),
++SOC_ENUM("DAC Dither", w8741_enum[0]),
++SOC_ENUM("DAC Digital Filter", w8741_enum[1]),
++SOC_ENUM("DAC Phase Invert", w8741_enum[2]),
++SOC_ENUM("DAC Volume Ramp", w8741_enum[3]),
++SOC_ENUM("DAC Soft Mute", w8741_enum[4]),
++};
++
++static int w8741_add_controls(struct snd_soc_component *component)
++{
++	struct wm8741_priv *wm8741 = snd_soc_component_get_drvdata(component);
++
++	switch (wm8741->pdata.diff_mode) {
++	case WM8741_DIFF_MODE_STEREO:
++	case WM8741_DIFF_MODE_STEREO_REVERSED:
++		snd_soc_add_component_controls(component,
++				w8741_snd_controls_stereo,
++				ARRAY_SIZE(w8741_snd_controls_stereo));
++		break;
++	case WM8741_DIFF_MODE_MONO_LEFT:
++		snd_soc_add_component_controls(component,
++				w8741_snd_controls_mono_left,
++				ARRAY_SIZE(w8741_snd_controls_mono_left));
++		break;
++	case WM8741_DIFF_MODE_MONO_RIGHT:
++		snd_soc_add_component_controls(component,
++				w8741_snd_controls_mono_right,
++				ARRAY_SIZE(w8741_snd_controls_mono_right));
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static int digidac1_soundcard_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_card *card = rtd->card;
++	struct snd_soc_pcm_runtime *wm8741_rtd;
++	struct snd_soc_component *wm8741_component;
++	struct snd_card *sound_card = card->snd_card;
++	struct snd_kcontrol *kctl;
++	int ret;
++
++	wm8741_rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[1]);
++	if (!wm8741_rtd) {
++		dev_warn(card->dev, "digidac1_soundcard_init: couldn't get wm8741 rtd\n");
++		return -EFAULT;
++	}
++	wm8741_component = asoc_rtd_to_codec(wm8741_rtd, 0)->component;
++	ret = w8741_add_controls(wm8741_component);
++	if (ret < 0)
++		dev_warn(card->dev, "Failed to add new wm8741 controls: %d\n",
++		ret);
++
++	/* enable TX output */
++	snd_soc_component_update_bits(component, WM8804_PWRDN, 0x4, 0x0);
++
++	kctl = snd_soc_card_get_kcontrol(card,
++		"Playback Volume");
++	if (kctl) {
++		kctl->vd[0].access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
++		snd_ctl_remove(sound_card, kctl);
++		}
++	kctl = snd_soc_card_get_kcontrol(card,
++		"Fine Playback Volume");
++	if (kctl) {
++		kctl->vd[0].access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
++		snd_ctl_remove(sound_card, kctl);
++		}
++	return 0;
++}
++
++static int digidac1_soundcard_startup(struct snd_pcm_substream *substream)
++{
++	/* turn on wm8804 digital output */
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_card *card = rtd->card;
++	struct snd_soc_pcm_runtime *wm8741_rtd;
++	struct snd_soc_component *wm8741_component;
++
++	snd_soc_component_update_bits(component, WM8804_PWRDN, 0x3c, 0x00);
++	wm8741_rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[1]);
++	if (!wm8741_rtd) {
++		dev_warn(card->dev, "digidac1_soundcard_startup: couldn't get WM8741 rtd\n");
++		return -EFAULT;
++	}
++	wm8741_component = asoc_rtd_to_codec(wm8741_rtd, 0)->component;
++
++	/* latch wm8741 level */
++	snd_soc_component_update_bits(wm8741_component, WM8741_DACLLSB_ATTENUATION,
++		WM8741_UPDATELL, WM8741_UPDATELL);
++	snd_soc_component_update_bits(wm8741_component, WM8741_DACLMSB_ATTENUATION,
++		WM8741_UPDATELM, WM8741_UPDATELM);
++	snd_soc_component_update_bits(wm8741_component, WM8741_DACRLSB_ATTENUATION,
++		WM8741_UPDATERL, WM8741_UPDATERL);
++	snd_soc_component_update_bits(wm8741_component, WM8741_DACRMSB_ATTENUATION,
++		WM8741_UPDATERM, WM8741_UPDATERM);
++
++	return 0;
++}
++
++static void digidac1_soundcard_shutdown(struct snd_pcm_substream *substream)
++{
++	/* turn off wm8804 digital output */
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++
++	snd_soc_component_update_bits(component, WM8804_PWRDN, 0x3c, 0x3c);
++}
++
++static int digidac1_soundcard_hw_params(struct snd_pcm_substream *substream,
++				       struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *codec_dai = asoc_rtd_to_codec(rtd, 0);
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_dai *cpu_dai = asoc_rtd_to_cpu(rtd, 0);
++	struct snd_soc_card *card = rtd->card;
++	struct snd_soc_pcm_runtime *wm8741_rtd;
++	struct snd_soc_component *wm8741_component;
++
++	int sysclk = 27000000;
++	long mclk_freq = 0;
++	int mclk_div = 1;
++	int sampling_freq = 1;
++	int ret;
++
++	wm8741_rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[1]);
++	if (!wm8741_rtd) {
++		dev_warn(card->dev, "digidac1_soundcard_hw_params: couldn't get WM8741 rtd\n");
++		return -EFAULT;
++	}
++	wm8741_component = asoc_rtd_to_codec(wm8741_rtd, 0)->component;
++	samplerate = params_rate(params);
++
++	if (samplerate <= 96000) {
++		mclk_freq = samplerate*256;
++		mclk_div = WM8804_MCLKDIV_256FS;
++	} else {
++		mclk_freq = samplerate*128;
++		mclk_div = WM8804_MCLKDIV_128FS;
++		}
++
++	switch (samplerate) {
++	case 32000:
++		sampling_freq = 0x03;
++		break;
++	case 44100:
++		sampling_freq = 0x00;
++		break;
++	case 48000:
++		sampling_freq = 0x02;
++		break;
++	case 88200:
++		sampling_freq = 0x08;
++		break;
++	case 96000:
++		sampling_freq = 0x0a;
++		break;
++	case 176400:
++		sampling_freq = 0x0c;
++		break;
++	case 192000:
++		sampling_freq = 0x0e;
++		break;
++	default:
++		dev_err(card->dev,
++		"Failed to set WM8804 SYSCLK, unsupported samplerate %d\n",
++		samplerate);
++	}
++
++	snd_soc_dai_set_clkdiv(codec_dai, WM8804_MCLK_DIV, mclk_div);
++	snd_soc_dai_set_pll(codec_dai, 0, 0, sysclk, mclk_freq);
++
++	ret = snd_soc_dai_set_sysclk(codec_dai, WM8804_TX_CLKSRC_PLL,
++		sysclk, SND_SOC_CLOCK_OUT);
++	if (ret < 0) {
++		dev_err(card->dev,
++		"Failed to set WM8804 SYSCLK: %d\n", ret);
++		return ret;
++	}
++	/* Enable wm8804 TX output */
++	snd_soc_component_update_bits(component, WM8804_PWRDN, 0x4, 0x0);
++
++	/* wm8804 Power on */
++	snd_soc_component_update_bits(component, WM8804_PWRDN, 0x9, 0);
++
++	/* wm8804 set sampling frequency status bits */
++	snd_soc_component_update_bits(component, WM8804_SPDTX4, 0x0f, sampling_freq);
++
++	/* Now update wm8741 registers for the correct oversampling */
++	if (samplerate <= 48000)
++		snd_soc_component_update_bits(wm8741_component, WM8741_MODE_CONTROL_1,
++		 WM8741_OSR_MASK, 0x00);
++	else if (samplerate <= 96000)
++		snd_soc_component_update_bits(wm8741_component, WM8741_MODE_CONTROL_1,
++		 WM8741_OSR_MASK, 0x20);
++	else
++		snd_soc_component_update_bits(wm8741_component, WM8741_MODE_CONTROL_1,
++		 WM8741_OSR_MASK, 0x40);
++
++	/* wm8741 bit size */
++	switch (params_width(params)) {
++	case 16:
++		snd_soc_component_update_bits(wm8741_component, WM8741_FORMAT_CONTROL,
++		 WM8741_IWL_MASK, 0x00);
++		break;
++	case 20:
++		snd_soc_component_update_bits(wm8741_component, WM8741_FORMAT_CONTROL,
++		 WM8741_IWL_MASK, 0x01);
++		break;
++	case 24:
++		snd_soc_component_update_bits(wm8741_component, WM8741_FORMAT_CONTROL,
++		 WM8741_IWL_MASK, 0x02);
++		break;
++	case 32:
++		snd_soc_component_update_bits(wm8741_component, WM8741_FORMAT_CONTROL,
++		 WM8741_IWL_MASK, 0x03);
++		break;
++	default:
++		dev_dbg(card->dev, "wm8741_hw_params:    Unsupported bit size param = %d",
++			params_width(params));
++		return -EINVAL;
++	}
++
++	return snd_soc_dai_set_bclk_ratio(cpu_dai, 64);
++}
++/* machine stream operations */
++static struct snd_soc_ops digidac1_soundcard_ops = {
++	.hw_params	= digidac1_soundcard_hw_params,
++	.startup	= digidac1_soundcard_startup,
++	.shutdown	= digidac1_soundcard_shutdown,
++};
++
++SND_SOC_DAILINK_DEFS(digidac1,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("wm8804.1-003b", "wm8804-spdif")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2835-i2s.0")));
++
++SND_SOC_DAILINK_DEFS(digidac11,
++	DAILINK_COMP_ARRAY(COMP_CPU("wm8804-spdif")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("wm8741.1-001a", "wm8741")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link digidac1_soundcard_dai[] = {
++	{
++	.name		= "RRA DigiDAC1",
++	.stream_name	= "RRA DigiDAC1 HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBM_CFM,
++	.ops		= &digidac1_soundcard_ops,
++	.init		= digidac1_soundcard_init,
++	SND_SOC_DAILINK_REG(digidac1),
++	},
++	{
++	.name		= "RRA DigiDAC11",
++	.stream_name	= "RRA DigiDAC11 HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S
++			| SND_SOC_DAIFMT_NB_NF
++			| SND_SOC_DAIFMT_CBS_CFS,
++	SND_SOC_DAILINK_REG(digidac11),
++	},
++};
++
++/* audio machine driver */
++static struct snd_soc_card digidac1_soundcard = {
++	.name		= "digidac1-soundcard",
++	.owner		= THIS_MODULE,
++	.dai_link	= digidac1_soundcard_dai,
++	.num_links	= ARRAY_SIZE(digidac1_soundcard_dai),
++};
++
++static int digidac1_soundcard_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++
++	digidac1_soundcard.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai = &digidac1_soundcard_dai[0];
++
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++					"i2s-controller", 0);
++
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		}
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev, &digidac1_soundcard);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n",
++			ret);
++
++	return ret;
++}
++
++static const struct of_device_id digidac1_soundcard_of_match[] = {
++	{ .compatible = "rra,digidac1-soundcard", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, digidac1_soundcard_of_match);
++
++static struct platform_driver digidac1_soundcard_driver = {
++	.driver = {
++			.name		= "digidac1-audio",
++			.owner		= THIS_MODULE,
++			.of_match_table	= digidac1_soundcard_of_match,
++	},
++	.probe		= digidac1_soundcard_probe,
++};
++
++module_platform_driver(digidac1_soundcard_driver);
++
++MODULE_AUTHOR("José M. Tasende <vintage@redrocksaudio.es>");
++MODULE_DESCRIPTION("ASoC Driver for RRA DigiDAC1");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/dionaudio_loco-v2.c
+@@ -0,0 +1,117 @@
++/*
++ * ASoC Driver for Dion Audio LOCO-V2 DAC-AMP
++ *
++ * Author:      Miquel Blauw <info@dionaudio.nl>
++ *              Copyright 2017
++ *
++ * Based on the software of the RPi-DAC writen by Florian Meier
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++static bool digital_gain_0db_limit = true;
++
++static int snd_rpi_dionaudio_loco_v2_init(struct snd_soc_pcm_runtime *rtd)
++{
++	if (digital_gain_0db_limit) {
++		int ret;
++		struct snd_soc_card *card = rtd->card;
++
++		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
++	}
++
++	return 0;
++}
++
++SND_SOC_DAILINK_DEFS(dionaudio_loco_v2,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm512x.1-004d", "pcm512x-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_dionaudio_loco_v2_dai[] = {
++{
++	.name		= "DionAudio LOCO-V2",
++	.stream_name	= "DionAudio LOCO-V2 DAC-AMP",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++			  SND_SOC_DAIFMT_CBS_CFS,
++	.init		= snd_rpi_dionaudio_loco_v2_init,
++	SND_SOC_DAILINK_REG(dionaudio_loco_v2),
++},};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_dionaudio_loco_v2 = {
++	.name         = "Dion Audio LOCO-V2",
++	.dai_link     = snd_rpi_dionaudio_loco_v2_dai,
++	.num_links    = ARRAY_SIZE(snd_rpi_dionaudio_loco_v2_dai),
++};
++
++static int snd_rpi_dionaudio_loco_v2_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++
++	snd_rpi_dionaudio_loco_v2.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai =
++					&snd_rpi_dionaudio_loco_v2_dai[0];
++
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++					    "i2s-controller", 0);
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		}
++
++		digital_gain_0db_limit = !of_property_read_bool(
++			pdev->dev.of_node, "dionaudio,24db_digital_gain");
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev, &snd_rpi_dionaudio_loco_v2);
++	if (ret)
++		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n",
++			ret);
++
++	return ret;
++}
++
++static const struct of_device_id dionaudio_of_match[] = {
++	{ .compatible = "dionaudio,dionaudio-loco-v2", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, dionaudio_of_match);
++
++static struct platform_driver snd_rpi_dionaudio_loco_v2_driver = {
++	.driver = {
++		.name   = "snd-rpi-dionaudio-loco-v2",
++		.owner  = THIS_MODULE,
++		.of_match_table = dionaudio_of_match,
++	},
++	.probe          = snd_rpi_dionaudio_loco_v2_probe,
++};
++
++module_platform_driver(snd_rpi_dionaudio_loco_v2_driver);
++
++MODULE_AUTHOR("Miquel Blauw <info@dionaudio.nl>");
++MODULE_DESCRIPTION("ASoC Driver for DionAudio LOCO-V2");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/dionaudio_loco.c
+@@ -0,0 +1,117 @@
++/*
++ * ASoC Driver for Dion Audio LOCO DAC-AMP
++ *
++ * Author:      Miquel Blauw <info@dionaudio.nl>
++ *              Copyright 2016
++ *
++ * Based on the software of the RPi-DAC writen by Florian Meier
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++static int snd_rpi_dionaudio_loco_hw_params(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *cpu_dai = asoc_rtd_to_cpu(rtd, 0);
++
++	unsigned int sample_bits =
++		snd_pcm_format_physical_width(params_format(params));
++
++	return snd_soc_dai_set_bclk_ratio(cpu_dai, sample_bits * 2);
++}
++
++/* machine stream operations */
++static struct snd_soc_ops snd_rpi_dionaudio_loco_ops = {
++	.hw_params = snd_rpi_dionaudio_loco_hw_params,
++};
++
++SND_SOC_DAILINK_DEFS(dionaudio_loco,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm5102a-codec", "pcm5102a-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_dionaudio_loco_dai[] = {
++{
++	.name		= "DionAudio LOCO",
++	.stream_name	= "DionAudio LOCO DAC-AMP",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S |
++			  SND_SOC_DAIFMT_NB_NF |
++			  SND_SOC_DAIFMT_CBS_CFS,
++	.ops		= &snd_rpi_dionaudio_loco_ops,
++	SND_SOC_DAILINK_REG(dionaudio_loco),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_dionaudio_loco = {
++	.name		= "snd_rpi_dionaudio_loco",
++	.dai_link	= snd_rpi_dionaudio_loco_dai,
++	.num_links	= ARRAY_SIZE(snd_rpi_dionaudio_loco_dai),
++};
++
++static int snd_rpi_dionaudio_loco_probe(struct platform_device *pdev)
++{
++	struct device_node *np;
++	int ret = 0;
++
++	snd_rpi_dionaudio_loco.dev = &pdev->dev;
++
++	np = pdev->dev.of_node;
++	if (np) {
++		struct snd_soc_dai_link *dai = &snd_rpi_dionaudio_loco_dai[0];
++		struct device_node *i2s_np;
++
++		i2s_np = of_parse_phandle(np, "i2s-controller", 0);
++		if (i2s_np) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_np;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_np;
++		}
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev, &snd_rpi_dionaudio_loco);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n",
++			ret);
++
++	return ret;
++}
++
++static const struct of_device_id snd_rpi_dionaudio_loco_of_match[] = {
++	{ .compatible = "dionaudio,loco-pcm5242-tpa3118", },
++	{ /* sentinel */ },
++};
++MODULE_DEVICE_TABLE(of, snd_rpi_dionaudio_loco_of_match);
++
++static struct platform_driver snd_rpi_dionaudio_loco_driver = {
++	.driver = {
++		.name		= "snd-dionaudio-loco",
++		.owner		= THIS_MODULE,
++		.of_match_table	= snd_rpi_dionaudio_loco_of_match,
++	},
++	.probe  = snd_rpi_dionaudio_loco_probe,
++};
++
++module_platform_driver(snd_rpi_dionaudio_loco_driver);
++
++MODULE_AUTHOR("Miquel Blauw <info@dionaudio.nl>");
++MODULE_DESCRIPTION("ASoC Driver for DionAudio LOCO");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/fe-pi-audio.c
+@@ -0,0 +1,154 @@
++/*
++ * ASoC Driver for Fe-Pi Audio Sound Card
++ *
++ * Author:	Henry Kupis <kuupaz@gmail.com>
++ *		Copyright 2016
++ *		based on code by Florian Meier <florian.meier@koalo.de>
++ *		based on code by Shawn Guo <shawn.guo@linaro.org>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/io.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++#include "../codecs/sgtl5000.h"
++
++static int snd_fe_pi_audio_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_card *card = rtd->card;
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++
++	snd_soc_dapm_force_enable_pin(&card->dapm, "LO");
++	snd_soc_dapm_force_enable_pin(&card->dapm, "ADC");
++	snd_soc_dapm_force_enable_pin(&card->dapm, "DAC");
++	snd_soc_dapm_force_enable_pin(&card->dapm, "HP");
++	snd_soc_component_update_bits(component, SGTL5000_CHIP_ANA_POWER,
++			SGTL5000_VAG_POWERUP, SGTL5000_VAG_POWERUP);
++
++	return 0;
++}
++
++static int snd_fe_pi_audio_hw_params(struct snd_pcm_substream *substream,
++	struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct device *dev = rtd->card->dev;
++	struct snd_soc_dai *codec_dai = asoc_rtd_to_codec(rtd, 0);
++
++	int ret;
++
++	/* Set SGTL5000's SYSCLK */
++	ret = snd_soc_dai_set_sysclk(codec_dai, SGTL5000_SYSCLK, 12288000, SND_SOC_CLOCK_IN);
++	if (ret) {
++		dev_err(dev, "could not set codec driver clock params\n");
++		return ret;
++	}
++
++	return 0;
++}
++
++
++static struct snd_soc_ops snd_fe_pi_audio_ops = {
++	.hw_params = snd_fe_pi_audio_hw_params,
++};
++
++SND_SOC_DAILINK_DEFS(fe_pi,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("sgtl5000.1-000a", "sgtl5000")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_fe_pi_audio_dai[] = {
++	{
++		.name		= "FE-PI",
++		.stream_name	= "Fe-Pi HiFi",
++		.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++					SND_SOC_DAIFMT_CBM_CFM,
++		.ops		= &snd_fe_pi_audio_ops,
++		.init		= snd_fe_pi_audio_init,
++		SND_SOC_DAILINK_REG(fe_pi),
++	},
++};
++
++static const struct snd_soc_dapm_route fe_pi_audio_dapm_routes[] = {
++	{"ADC", NULL, "Mic Bias"},
++};
++
++
++static struct snd_soc_card fe_pi_audio = {
++	.name         = "Fe-Pi Audio",
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_fe_pi_audio_dai,
++	.num_links    = ARRAY_SIZE(snd_fe_pi_audio_dai),
++
++	.dapm_routes = fe_pi_audio_dapm_routes,
++	.num_dapm_routes = ARRAY_SIZE(fe_pi_audio_dapm_routes),
++};
++
++static int snd_fe_pi_audio_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	struct snd_soc_card *card = &fe_pi_audio;
++	struct device_node *np = pdev->dev.of_node;
++	struct device_node *i2s_node;
++	struct snd_soc_dai_link *dai = &snd_fe_pi_audio_dai[0];
++
++	fe_pi_audio.dev = &pdev->dev;
++
++	i2s_node = of_parse_phandle(np, "i2s-controller", 0);
++	if (!i2s_node) {
++		dev_err(&pdev->dev, "i2s_node phandle missing or invalid\n");
++		return -EINVAL;
++	}
++
++	dai->cpus->dai_name = NULL;
++	dai->cpus->of_node = i2s_node;
++	dai->platforms->name = NULL;
++	dai->platforms->of_node = i2s_node;
++
++	of_node_put(i2s_node);
++
++	card->dev = &pdev->dev;
++	platform_set_drvdata(pdev, card);
++
++	ret = devm_snd_soc_register_card(&pdev->dev, card);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n", ret);
++
++	return ret;
++}
++
++static const struct of_device_id snd_fe_pi_audio_of_match[] = {
++	{ .compatible = "fe-pi,fe-pi-audio", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, snd_fe_pi_audio_of_match);
++
++static struct platform_driver snd_fe_pi_audio_driver = {
++        .driver = {
++                .name   = "snd-fe-pi-audio",
++                .owner  = THIS_MODULE,
++                .of_match_table = snd_fe_pi_audio_of_match,
++        },
++        .probe          = snd_fe_pi_audio_probe,
++};
++
++module_platform_driver(snd_fe_pi_audio_driver);
++
++MODULE_AUTHOR("Henry Kupis <fe-pi@cox.net>");
++MODULE_DESCRIPTION("ASoC Driver for Fe-Pi Audio");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/googlevoicehat-codec.c
+@@ -0,0 +1,214 @@
++/*
++ * Driver for the Google voiceHAT audio codec for Raspberry Pi.
++ *
++ * Author:	Peter Malkin <petermalkin@google.com>
++ *		Copyright 2016
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/device.h>
++#include <linux/err.h>
++#include <linux/gpio.h>
++#include <linux/gpio/consumer.h>
++#include <linux/init.h>
++#include <linux/kernel.h>
++#include <linux/mod_devicetable.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/version.h>
++#include <sound/pcm.h>
++#include <sound/soc.h>
++#include <sound/soc-dai.h>
++#include <sound/soc-dapm.h>
++
++#define ICS43432_RATE_MIN_HZ	7190  /* from data sheet */
++#define ICS43432_RATE_MAX_HZ	52800 /* from data sheet */
++/* Delay in enabling SDMODE after clock settles to remove pop */
++#define SDMODE_DELAY_MS		5
++
++struct voicehat_priv {
++	struct delayed_work enable_sdmode_work;
++	struct gpio_desc *sdmode_gpio;
++	unsigned long sdmode_delay_jiffies;
++};
++
++static void voicehat_enable_sdmode_work(struct work_struct *work)
++{
++	struct voicehat_priv *voicehat = container_of(work,
++						      struct voicehat_priv,
++						      enable_sdmode_work.work);
++	gpiod_set_value(voicehat->sdmode_gpio, 1);
++}
++
++static int voicehat_component_probe(struct snd_soc_component *component)
++{
++	struct voicehat_priv *voicehat =
++				snd_soc_component_get_drvdata(component);
++
++	voicehat->sdmode_gpio = devm_gpiod_get(component->dev, "sdmode",
++					       GPIOD_OUT_LOW);
++	if (IS_ERR(voicehat->sdmode_gpio)) {
++		dev_err(component->dev, "Unable to allocate GPIO pin\n");
++		return PTR_ERR(voicehat->sdmode_gpio);
++	}
++
++	INIT_DELAYED_WORK(&voicehat->enable_sdmode_work,
++			  voicehat_enable_sdmode_work);
++	return 0;
++}
++
++static void voicehat_component_remove(struct snd_soc_component *component)
++{
++	struct voicehat_priv *voicehat =
++				snd_soc_component_get_drvdata(component);
++
++	cancel_delayed_work_sync(&voicehat->enable_sdmode_work);
++}
++
++static const struct snd_soc_dapm_widget voicehat_dapm_widgets[] = {
++	SND_SOC_DAPM_OUTPUT("Speaker"),
++};
++
++static const struct snd_soc_dapm_route voicehat_dapm_routes[] = {
++	{"Speaker", NULL, "HiFi Playback"},
++};
++
++static const struct snd_soc_component_driver voicehat_component_driver = {
++	.probe = voicehat_component_probe,
++	.remove = voicehat_component_remove,
++	.dapm_widgets = voicehat_dapm_widgets,
++	.num_dapm_widgets = ARRAY_SIZE(voicehat_dapm_widgets),
++	.dapm_routes = voicehat_dapm_routes,
++	.num_dapm_routes = ARRAY_SIZE(voicehat_dapm_routes),
++};
++
++static int voicehat_daiops_trigger(struct snd_pcm_substream *substream, int cmd,
++				   struct snd_soc_dai *dai)
++{
++	struct snd_soc_component *component = dai->component;
++	struct voicehat_priv *voicehat =
++				snd_soc_component_get_drvdata(component);
++
++	if (voicehat->sdmode_delay_jiffies == 0)
++		return 0;
++
++	dev_dbg(dai->dev, "CMD             %d", cmd);
++	dev_dbg(dai->dev, "Playback Active %d", dai->stream_active[SNDRV_PCM_STREAM_PLAYBACK]);
++	dev_dbg(dai->dev, "Capture Active  %d", dai->stream_active[SNDRV_PCM_STREAM_CAPTURE]);
++
++	switch (cmd) {
++	case SNDRV_PCM_TRIGGER_START:
++	case SNDRV_PCM_TRIGGER_RESUME:
++	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
++		if (dai->stream_active[SNDRV_PCM_STREAM_PLAYBACK]) {
++			dev_info(dai->dev, "Enabling audio amp...\n");
++			queue_delayed_work(
++				system_power_efficient_wq,
++				&voicehat->enable_sdmode_work,
++				voicehat->sdmode_delay_jiffies);
++		}
++		break;
++	case SNDRV_PCM_TRIGGER_STOP:
++	case SNDRV_PCM_TRIGGER_SUSPEND:
++	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
++		if (dai->stream_active[SNDRV_PCM_STREAM_PLAYBACK]) {
++			cancel_delayed_work(&voicehat->enable_sdmode_work);
++			dev_info(dai->dev, "Disabling audio amp...\n");
++			gpiod_set_value(voicehat->sdmode_gpio, 0);
++		}
++		break;
++	}
++	return 0;
++}
++
++static const struct snd_soc_dai_ops voicehat_dai_ops = {
++	.trigger = voicehat_daiops_trigger,
++};
++
++static struct snd_soc_dai_driver voicehat_dai = {
++	.name = "voicehat-hifi",
++	.capture = {
++		.stream_name = "HiFi Capture",
++		.channels_min = 2,
++		.channels_max = 2,
++		.rates = SNDRV_PCM_RATE_48000,
++		.formats = SNDRV_PCM_FMTBIT_S32_LE
++	},
++	.playback = {
++		.stream_name = "HiFi Playback",
++		.channels_min = 2,
++		.channels_max = 2,
++		.rates = SNDRV_PCM_RATE_48000,
++		.formats = SNDRV_PCM_FMTBIT_S32_LE
++	},
++	.ops = &voicehat_dai_ops,
++	.symmetric_rate = 1
++};
++
++#ifdef CONFIG_OF
++static const struct of_device_id voicehat_ids[] = {
++		{ .compatible = "google,voicehat", }, {}
++	};
++	MODULE_DEVICE_TABLE(of, voicehat_ids);
++#endif
++
++static int voicehat_platform_probe(struct platform_device *pdev)
++{
++	struct voicehat_priv *voicehat;
++	unsigned int sdmode_delay;
++	int ret;
++
++	voicehat = devm_kzalloc(&pdev->dev, sizeof(*voicehat), GFP_KERNEL);
++	if (!voicehat)
++		return -ENOMEM;
++
++	ret = device_property_read_u32(&pdev->dev, "voicehat_sdmode_delay",
++				       &sdmode_delay);
++
++	if (ret) {
++		sdmode_delay = SDMODE_DELAY_MS;
++		dev_info(&pdev->dev,
++			 "property 'voicehat_sdmode_delay' not found default 5 mS");
++	} else {
++		dev_info(&pdev->dev, "property 'voicehat_sdmode_delay' found delay= %d mS",
++			 sdmode_delay);
++	}
++	voicehat->sdmode_delay_jiffies = msecs_to_jiffies(sdmode_delay);
++
++	dev_set_drvdata(&pdev->dev, voicehat);
++
++	return snd_soc_register_component(&pdev->dev,
++					  &voicehat_component_driver,
++					  &voicehat_dai,
++					  1);
++}
++
++static int voicehat_platform_remove(struct platform_device *pdev)
++{
++	snd_soc_unregister_component(&pdev->dev);
++	return 0;
++}
++
++static struct platform_driver voicehat_driver = {
++	.driver = {
++		.name = "voicehat-codec",
++		.of_match_table = of_match_ptr(voicehat_ids),
++	},
++	.probe = voicehat_platform_probe,
++	.remove = voicehat_platform_remove,
++};
++
++module_platform_driver(voicehat_driver);
++
++MODULE_DESCRIPTION("Google voiceHAT Codec driver");
++MODULE_AUTHOR("Peter Malkin <petermalkin@google.com>");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/hifiberry_dacplus.c
+@@ -0,0 +1,527 @@
++/*
++ * ASoC Driver for HiFiBerry DAC+ / DAC Pro / AMP100
++ *
++ * Author:	Daniel Matuschek, Stuart MacLean <stuart@hifiberry.com>
++ *		Copyright 2014-2015
++ *		based on code by Florian Meier <florian.meier@koalo.de>
++ *		Headphone/AMP100 Joerg Schambacher <joerg@hifiberry.com>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/gpio/consumer.h>
++#include <../drivers/gpio/gpiolib.h>
++#include <linux/platform_device.h>
++#include <linux/kernel.h>
++#include <linux/clk.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/slab.h>
++#include <linux/delay.h>
++#include <linux/i2c.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++#include "../codecs/pcm512x.h"
++
++#define HIFIBERRY_DACPRO_NOCLOCK 0
++#define HIFIBERRY_DACPRO_CLK44EN 1
++#define HIFIBERRY_DACPRO_CLK48EN 2
++
++struct pcm512x_priv {
++	struct regmap *regmap;
++	struct clk *sclk;
++};
++
++/* Clock rate of CLK44EN attached to GPIO6 pin */
++#define CLK_44EN_RATE 22579200UL
++/* Clock rate of CLK48EN attached to GPIO3 pin */
++#define CLK_48EN_RATE 24576000UL
++
++static bool slave;
++static bool snd_rpi_hifiberry_is_dacpro;
++static bool digital_gain_0db_limit = true;
++static bool leds_off;
++static bool auto_mute;
++static int mute_ext_ctl;
++static int mute_ext;
++static struct gpio_desc *snd_mute_gpio;
++static struct gpio_desc *snd_reset_gpio;
++static struct snd_soc_card snd_rpi_hifiberry_dacplus;
++
++static int snd_rpi_hifiberry_dacplus_mute_set(int mute)
++{
++	gpiod_set_value_cansleep(snd_mute_gpio, mute);
++	return 1;
++}
++
++static int snd_rpi_hifiberry_dacplus_mute_get(struct snd_kcontrol *kcontrol,
++				struct snd_ctl_elem_value *ucontrol)
++{
++	ucontrol->value.integer.value[0] = mute_ext;
++
++	return 0;
++}
++
++static int snd_rpi_hifiberry_dacplus_mute_put(struct snd_kcontrol *kcontrol,
++				struct snd_ctl_elem_value *ucontrol)
++{
++	if (mute_ext == ucontrol->value.integer.value[0])
++		return 0;
++
++	mute_ext = ucontrol->value.integer.value[0];
++
++	return snd_rpi_hifiberry_dacplus_mute_set(mute_ext);
++}
++
++static const char * const mute_text[] = {"Play", "Mute"};
++static const struct soc_enum hb_dacplus_opt_mute_enum =
++	SOC_ENUM_SINGLE_EXT(2, mute_text);
++
++static const struct snd_kcontrol_new hb_dacplus_opt_mute_controls[] = {
++	SOC_ENUM_EXT("Mute(ext)", hb_dacplus_opt_mute_enum,
++			      snd_rpi_hifiberry_dacplus_mute_get,
++			      snd_rpi_hifiberry_dacplus_mute_put),
++};
++
++static void snd_rpi_hifiberry_dacplus_select_clk(struct snd_soc_component *component,
++	int clk_id)
++{
++	switch (clk_id) {
++	case HIFIBERRY_DACPRO_NOCLOCK:
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x00);
++		break;
++	case HIFIBERRY_DACPRO_CLK44EN:
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x20);
++		break;
++	case HIFIBERRY_DACPRO_CLK48EN:
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x04);
++		break;
++	}
++	usleep_range(3000, 4000);
++}
++
++static void snd_rpi_hifiberry_dacplus_clk_gpio(struct snd_soc_component *component)
++{
++	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x24, 0x24);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_3, 0x0f, 0x02);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_6, 0x0f, 0x02);
++}
++
++static bool snd_rpi_hifiberry_dacplus_is_sclk(struct snd_soc_component *component)
++{
++	unsigned int sck;
++
++	sck = snd_soc_component_read(component, PCM512x_RATE_DET_4);
++	return (!(sck & 0x40));
++}
++
++static bool snd_rpi_hifiberry_dacplus_is_pro_card(struct snd_soc_component *component)
++{
++	bool isClk44EN, isClk48En, isNoClk;
++
++	snd_rpi_hifiberry_dacplus_clk_gpio(component);
++
++	snd_rpi_hifiberry_dacplus_select_clk(component, HIFIBERRY_DACPRO_CLK44EN);
++	isClk44EN = snd_rpi_hifiberry_dacplus_is_sclk(component);
++
++	snd_rpi_hifiberry_dacplus_select_clk(component, HIFIBERRY_DACPRO_NOCLOCK);
++	isNoClk = snd_rpi_hifiberry_dacplus_is_sclk(component);
++
++	snd_rpi_hifiberry_dacplus_select_clk(component, HIFIBERRY_DACPRO_CLK48EN);
++	isClk48En = snd_rpi_hifiberry_dacplus_is_sclk(component);
++
++	return (isClk44EN && isClk48En && !isNoClk);
++}
++
++static int snd_rpi_hifiberry_dacplus_clk_for_rate(int sample_rate)
++{
++	int type;
++
++	switch (sample_rate) {
++	case 11025:
++	case 22050:
++	case 44100:
++	case 88200:
++	case 176400:
++	case 352800:
++		type = HIFIBERRY_DACPRO_CLK44EN;
++		break;
++	default:
++		type = HIFIBERRY_DACPRO_CLK48EN;
++		break;
++	}
++	return type;
++}
++
++static void snd_rpi_hifiberry_dacplus_set_sclk(struct snd_soc_component *component,
++	int sample_rate)
++{
++	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
++
++	if (!IS_ERR(pcm512x->sclk)) {
++		int ctype;
++
++		ctype = snd_rpi_hifiberry_dacplus_clk_for_rate(sample_rate);
++		clk_set_rate(pcm512x->sclk, (ctype == HIFIBERRY_DACPRO_CLK44EN)
++			? CLK_44EN_RATE : CLK_48EN_RATE);
++		snd_rpi_hifiberry_dacplus_select_clk(component, ctype);
++	}
++}
++
++static int snd_rpi_hifiberry_dacplus_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++	struct pcm512x_priv *priv;
++	struct snd_soc_card *card = &snd_rpi_hifiberry_dacplus;
++
++	if (slave)
++		snd_rpi_hifiberry_is_dacpro = false;
++	else
++		snd_rpi_hifiberry_is_dacpro =
++				snd_rpi_hifiberry_dacplus_is_pro_card(component);
++
++	if (snd_rpi_hifiberry_is_dacpro) {
++		struct snd_soc_dai_link *dai = rtd->dai_link;
++
++		dai->name = "HiFiBerry DAC+ Pro";
++		dai->stream_name = "HiFiBerry DAC+ Pro HiFi";
++		dai->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
++			| SND_SOC_DAIFMT_CBM_CFM;
++
++		snd_soc_component_update_bits(component, PCM512x_BCLK_LRCLK_CFG, 0x31, 0x11);
++		snd_soc_component_update_bits(component, PCM512x_MASTER_MODE, 0x03, 0x03);
++		snd_soc_component_update_bits(component, PCM512x_MASTER_CLKDIV_2, 0x7f, 63);
++	} else {
++		priv = snd_soc_component_get_drvdata(component);
++		priv->sclk = ERR_PTR(-ENOENT);
++	}
++
++	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x08, 0x08);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_4, 0x0f, 0x02);
++	if (leds_off)
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x00);
++	else
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
++
++	if (digital_gain_0db_limit) {
++		int ret;
++		struct snd_soc_card *card = rtd->card;
++
++		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
++	}
++	if (snd_reset_gpio) {
++		gpiod_set_value_cansleep(snd_reset_gpio, 0);
++		msleep(1);
++		gpiod_set_value_cansleep(snd_reset_gpio, 1);
++		msleep(1);
++		gpiod_set_value_cansleep(snd_reset_gpio, 0);
++	}
++
++	if (mute_ext_ctl)
++		snd_soc_add_card_controls(card,	hb_dacplus_opt_mute_controls,
++				ARRAY_SIZE(hb_dacplus_opt_mute_controls));
++
++	if (snd_mute_gpio)
++		gpiod_set_value_cansleep(snd_mute_gpio,	mute_ext);
++
++	return 0;
++}
++
++static int snd_rpi_hifiberry_dacplus_update_rate_den(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
++	struct snd_ratnum *rats_no_pll;
++	unsigned int num = 0, den = 0;
++	int err;
++
++	rats_no_pll = devm_kzalloc(rtd->dev, sizeof(*rats_no_pll), GFP_KERNEL);
++	if (!rats_no_pll)
++		return -ENOMEM;
++
++	rats_no_pll->num = clk_get_rate(pcm512x->sclk) / 64;
++	rats_no_pll->den_min = 1;
++	rats_no_pll->den_max = 128;
++	rats_no_pll->den_step = 1;
++
++	err = snd_interval_ratnum(hw_param_interval(params,
++		SNDRV_PCM_HW_PARAM_RATE), 1, rats_no_pll, &num, &den);
++	if (err >= 0 && den) {
++		params->rate_num = num;
++		params->rate_den = den;
++	}
++
++	devm_kfree(rtd->dev, rats_no_pll);
++	return 0;
++}
++
++static int snd_rpi_hifiberry_dacplus_hw_params(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	int ret = 0;
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	int channels = params_channels(params);
++	int width = 32;
++
++	if (snd_rpi_hifiberry_is_dacpro) {
++		struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++
++		width = snd_pcm_format_physical_width(params_format(params));
++
++		snd_rpi_hifiberry_dacplus_set_sclk(component,
++			params_rate(params));
++
++		ret = snd_rpi_hifiberry_dacplus_update_rate_den(
++			substream, params);
++	}
++
++	ret = snd_soc_dai_set_bclk_ratio(asoc_rtd_to_cpu(rtd, 0), channels * width);
++	if (ret)
++		return ret;
++	ret = snd_soc_dai_set_bclk_ratio(asoc_rtd_to_codec(rtd, 0), channels * width);
++	return ret;
++}
++
++static int snd_rpi_hifiberry_dacplus_startup(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++
++	if (auto_mute)
++		gpiod_set_value_cansleep(snd_mute_gpio, 0);
++	if (leds_off)
++		return 0;
++	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
++	return 0;
++}
++
++static void snd_rpi_hifiberry_dacplus_shutdown(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++
++	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x00);
++	if (auto_mute)
++		gpiod_set_value_cansleep(snd_mute_gpio, 1);
++}
++
++/* machine stream operations */
++static struct snd_soc_ops snd_rpi_hifiberry_dacplus_ops = {
++	.hw_params = snd_rpi_hifiberry_dacplus_hw_params,
++	.startup = snd_rpi_hifiberry_dacplus_startup,
++	.shutdown = snd_rpi_hifiberry_dacplus_shutdown,
++};
++
++SND_SOC_DAILINK_DEFS(rpi_hifiberry_dacplus,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm512x.1-004d", "pcm512x-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_hifiberry_dacplus_dai[] = {
++{
++	.name		= "HiFiBerry DAC+",
++	.stream_name	= "HiFiBerry DAC+ HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBS_CFS,
++	.ops		= &snd_rpi_hifiberry_dacplus_ops,
++	.init		= snd_rpi_hifiberry_dacplus_init,
++	SND_SOC_DAILINK_REG(rpi_hifiberry_dacplus),
++},
++};
++
++/* aux device for optional headphone amp */
++static struct snd_soc_aux_dev hifiberry_dacplus_aux_devs[] = {
++	{
++		.dlc = {
++			.name = "tpa6130a2.1-0060",
++		},
++	},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_hifiberry_dacplus = {
++	.name         = "snd_rpi_hifiberry_dacplus",
++	.driver_name  = "HifiberryDacp",
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_rpi_hifiberry_dacplus_dai,
++	.num_links    = ARRAY_SIZE(snd_rpi_hifiberry_dacplus_dai),
++};
++
++static int hb_hp_detect(void)
++{
++	struct i2c_adapter *adap = i2c_get_adapter(1);
++	int ret;
++	struct i2c_client tpa_i2c_client = {
++		.addr = 0x60,
++		.adapter = adap,
++	};
++
++	if (!adap)
++		return -EPROBE_DEFER;	/* I2C module not yet available */
++
++	ret = i2c_smbus_read_byte(&tpa_i2c_client) >= 0;
++	i2c_put_adapter(adap);
++	return ret;
++};
++
++static struct property tpa_enable_prop = {
++	       .name = "status",
++	       .length = 4 + 1, /* length 'okay' + 1 */
++	       .value = "okay",
++	};
++
++static int snd_rpi_hifiberry_dacplus_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	struct snd_soc_card *card = &snd_rpi_hifiberry_dacplus;
++	int len;
++	struct device_node *tpa_node;
++	struct property *tpa_prop;
++	struct of_changeset ocs;
++	struct property *pp;
++	int tmp;
++
++	/* probe for head phone amp */
++	ret = hb_hp_detect();
++	if (ret < 0)
++		return ret;
++	if (ret) {
++		card->aux_dev = hifiberry_dacplus_aux_devs;
++		card->num_aux_devs =
++				ARRAY_SIZE(hifiberry_dacplus_aux_devs);
++		tpa_node = of_find_compatible_node(NULL, NULL, "ti,tpa6130a2");
++		tpa_prop = of_find_property(tpa_node, "status", &len);
++
++		if (strcmp((char *)tpa_prop->value, "okay")) {
++			/* and activate headphone using change_sets */
++			dev_info(&pdev->dev, "activating headphone amplifier");
++			of_changeset_init(&ocs);
++			ret = of_changeset_update_property(&ocs, tpa_node,
++							&tpa_enable_prop);
++			if (ret) {
++				dev_err(&pdev->dev,
++				"cannot activate headphone amplifier\n");
++				return -ENODEV;
++			}
++			ret = of_changeset_apply(&ocs);
++			if (ret) {
++				dev_err(&pdev->dev,
++				"cannot activate headphone amplifier\n");
++				return -ENODEV;
++			}
++		}
++	}
++
++	snd_rpi_hifiberry_dacplus.dev = &pdev->dev;
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai;
++
++		dai = &snd_rpi_hifiberry_dacplus_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++			"i2s-controller", 0);
++
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		}
++
++		digital_gain_0db_limit = !of_property_read_bool(
++			pdev->dev.of_node, "hifiberry,24db_digital_gain");
++		slave = of_property_read_bool(pdev->dev.of_node,
++						"hifiberry-dacplus,slave");
++		leds_off = of_property_read_bool(pdev->dev.of_node,
++						"hifiberry-dacplus,leds_off");
++		auto_mute = of_property_read_bool(pdev->dev.of_node,
++						"hifiberry-dacplus,auto_mute");
++
++		/*
++		 * check for HW MUTE as defined in DT-overlay
++		 * active high, therefore default to HIGH to MUTE
++		 */
++		snd_mute_gpio =	devm_gpiod_get_optional(&pdev->dev,
++						 "mute", GPIOD_OUT_HIGH);
++		if (IS_ERR(snd_mute_gpio)) {
++			dev_err(&pdev->dev, "Can't allocate GPIO (HW-MUTE)");
++			return PTR_ERR(snd_mute_gpio);
++		}
++
++		/* add ALSA control if requested in DT-overlay (AMP100) */
++		pp = of_find_property(pdev->dev.of_node,
++				"hifiberry-dacplus,mute_ext_ctl", &tmp);
++		if (pp) {
++			if (!of_property_read_u32(pdev->dev.of_node,
++				"hifiberry-dacplus,mute_ext_ctl", &mute_ext)) {
++				/* ALSA control will be used */
++				mute_ext_ctl = 1;
++			}
++		}
++
++		/* check for HW RESET (AMP100) */
++		snd_reset_gpio = devm_gpiod_get_optional(&pdev->dev,
++						"reset", GPIOD_OUT_HIGH);
++		if (IS_ERR(snd_reset_gpio)) {
++			dev_err(&pdev->dev, "Can't allocate GPIO (HW-RESET)");
++			return PTR_ERR(snd_reset_gpio);
++		}
++
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev,
++			&snd_rpi_hifiberry_dacplus);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev,
++			"snd_soc_register_card() failed: %d\n", ret);
++	if (!ret) {
++		if (snd_mute_gpio)
++			dev_info(&pdev->dev, "GPIO%i for HW-MUTE selected",
++					gpio_chip_hwgpio(snd_mute_gpio));
++		if (snd_reset_gpio)
++			dev_info(&pdev->dev, "GPIO%i for HW-RESET selected",
++					gpio_chip_hwgpio(snd_reset_gpio));
++	}
++	return ret;
++}
++
++static const struct of_device_id snd_rpi_hifiberry_dacplus_of_match[] = {
++	{ .compatible = "hifiberry,hifiberry-dacplus", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, snd_rpi_hifiberry_dacplus_of_match);
++
++static struct platform_driver snd_rpi_hifiberry_dacplus_driver = {
++	.driver = {
++		.name   = "snd-rpi-hifiberry-dacplus",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_rpi_hifiberry_dacplus_of_match,
++	},
++	.probe          = snd_rpi_hifiberry_dacplus_probe,
++};
++
++module_platform_driver(snd_rpi_hifiberry_dacplus_driver);
++
++MODULE_AUTHOR("Daniel Matuschek <daniel@hifiberry.com>");
++MODULE_DESCRIPTION("ASoC Driver for HiFiBerry DAC+");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/hifiberry_dacplusadc.c
+@@ -0,0 +1,398 @@
++/*
++ * ASoC Driver for HiFiBerry DAC+ / DAC Pro with ADC
++ *
++ * Author:	Daniel Matuschek, Stuart MacLean <stuart@hifiberry.com>
++ *		Copyright 2014-2015
++ *		based on code by Florian Meier <florian.meier@koalo.de>
++ *		ADC added by Joerg Schambacher <joscha@schambacher.com>
++ *		Copyright 2018
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/kernel.h>
++#include <linux/clk.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/slab.h>
++#include <linux/delay.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++#include "../codecs/pcm512x.h"
++
++#define HIFIBERRY_DACPRO_NOCLOCK 0
++#define HIFIBERRY_DACPRO_CLK44EN 1
++#define HIFIBERRY_DACPRO_CLK48EN 2
++
++struct platform_device *dmic_codec_dev;
++
++struct pcm512x_priv {
++	struct regmap *regmap;
++	struct clk *sclk;
++};
++
++/* Clock rate of CLK44EN attached to GPIO6 pin */
++#define CLK_44EN_RATE 22579200UL
++/* Clock rate of CLK48EN attached to GPIO3 pin */
++#define CLK_48EN_RATE 24576000UL
++
++static bool slave;
++static bool snd_rpi_hifiberry_is_dacpro;
++static bool digital_gain_0db_limit = true;
++static bool leds_off;
++
++static void snd_rpi_hifiberry_dacplusadc_select_clk(struct snd_soc_component *component,
++	int clk_id)
++{
++	switch (clk_id) {
++	case HIFIBERRY_DACPRO_NOCLOCK:
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x00);
++		break;
++	case HIFIBERRY_DACPRO_CLK44EN:
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x20);
++		break;
++	case HIFIBERRY_DACPRO_CLK48EN:
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x04);
++		break;
++	}
++}
++
++static void snd_rpi_hifiberry_dacplusadc_clk_gpio(struct snd_soc_component *component)
++{
++	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x24, 0x24);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_3, 0x0f, 0x02);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_6, 0x0f, 0x02);
++}
++
++static bool snd_rpi_hifiberry_dacplusadc_is_sclk(struct snd_soc_component *component)
++{
++	unsigned int sck;
++
++	sck = snd_soc_component_read(component, PCM512x_RATE_DET_4);
++	return (!(sck & 0x40));
++}
++
++static bool snd_rpi_hifiberry_dacplusadc_is_sclk_sleep(
++	struct snd_soc_component *component)
++{
++	msleep(2);
++	return snd_rpi_hifiberry_dacplusadc_is_sclk(component);
++}
++
++static bool snd_rpi_hifiberry_dacplusadc_is_pro_card(struct snd_soc_component *component)
++{
++	bool isClk44EN, isClk48En, isNoClk;
++
++	snd_rpi_hifiberry_dacplusadc_clk_gpio(component);
++
++	snd_rpi_hifiberry_dacplusadc_select_clk(component, HIFIBERRY_DACPRO_CLK44EN);
++	isClk44EN = snd_rpi_hifiberry_dacplusadc_is_sclk_sleep(component);
++
++	snd_rpi_hifiberry_dacplusadc_select_clk(component, HIFIBERRY_DACPRO_NOCLOCK);
++	isNoClk = snd_rpi_hifiberry_dacplusadc_is_sclk_sleep(component);
++
++	snd_rpi_hifiberry_dacplusadc_select_clk(component, HIFIBERRY_DACPRO_CLK48EN);
++	isClk48En = snd_rpi_hifiberry_dacplusadc_is_sclk_sleep(component);
++
++	return (isClk44EN && isClk48En && !isNoClk);
++}
++
++static int snd_rpi_hifiberry_dacplusadc_clk_for_rate(int sample_rate)
++{
++	int type;
++
++	switch (sample_rate) {
++	case 11025:
++	case 22050:
++	case 44100:
++	case 88200:
++	case 176400:
++	case 352800:
++		type = HIFIBERRY_DACPRO_CLK44EN;
++		break;
++	default:
++		type = HIFIBERRY_DACPRO_CLK48EN;
++		break;
++	}
++	return type;
++}
++
++static void snd_rpi_hifiberry_dacplusadc_set_sclk(struct snd_soc_component *component,
++	int sample_rate)
++{
++	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
++
++	if (!IS_ERR(pcm512x->sclk)) {
++		int ctype;
++
++		ctype = snd_rpi_hifiberry_dacplusadc_clk_for_rate(sample_rate);
++		clk_set_rate(pcm512x->sclk, (ctype == HIFIBERRY_DACPRO_CLK44EN)
++			? CLK_44EN_RATE : CLK_48EN_RATE);
++		snd_rpi_hifiberry_dacplusadc_select_clk(component, ctype);
++	}
++}
++
++static int snd_rpi_hifiberry_dacplusadc_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++	struct pcm512x_priv *priv;
++
++	if (slave)
++		snd_rpi_hifiberry_is_dacpro = false;
++	else
++		snd_rpi_hifiberry_is_dacpro =
++				snd_rpi_hifiberry_dacplusadc_is_pro_card(component);
++
++	if (snd_rpi_hifiberry_is_dacpro) {
++		struct snd_soc_dai_link *dai = rtd->dai_link;
++
++		dai->name = "HiFiBerry ADCDAC+ Pro";
++		dai->stream_name = "HiFiBerry ADCDAC+ Pro HiFi";
++		dai->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
++			| SND_SOC_DAIFMT_CBM_CFM;
++
++		snd_soc_component_update_bits(component, PCM512x_BCLK_LRCLK_CFG, 0x31, 0x11);
++		snd_soc_component_update_bits(component, PCM512x_MASTER_MODE, 0x03, 0x03);
++		snd_soc_component_update_bits(component, PCM512x_MASTER_CLKDIV_2, 0x7f, 63);
++	} else {
++		priv = snd_soc_component_get_drvdata(component);
++		priv->sclk = ERR_PTR(-ENOENT);
++	}
++
++	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x08, 0x08);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_4, 0x0f, 0x02);
++	if (leds_off)
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x00);
++	else
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
++
++	if (digital_gain_0db_limit) {
++		int ret;
++		struct snd_soc_card *card = rtd->card;
++
++		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
++	}
++
++	return 0;
++}
++
++static int snd_rpi_hifiberry_dacplusadc_update_rate_den(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
++	struct snd_ratnum *rats_no_pll;
++	unsigned int num = 0, den = 0;
++	int err;
++
++	rats_no_pll = devm_kzalloc(rtd->dev, sizeof(*rats_no_pll), GFP_KERNEL);
++	if (!rats_no_pll)
++		return -ENOMEM;
++
++	rats_no_pll->num = clk_get_rate(pcm512x->sclk) / 64;
++	rats_no_pll->den_min = 1;
++	rats_no_pll->den_max = 128;
++	rats_no_pll->den_step = 1;
++
++	err = snd_interval_ratnum(hw_param_interval(params,
++		SNDRV_PCM_HW_PARAM_RATE), 1, rats_no_pll, &num, &den);
++	if (err >= 0 && den) {
++		params->rate_num = num;
++		params->rate_den = den;
++	}
++
++	devm_kfree(rtd->dev, rats_no_pll);
++	return 0;
++}
++
++static int snd_rpi_hifiberry_dacplusadc_hw_params(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	int ret = 0;
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	int channels = params_channels(params);
++	int width = 32;
++
++	if (snd_rpi_hifiberry_is_dacpro) {
++		struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++
++		width = snd_pcm_format_physical_width(params_format(params));
++
++		snd_rpi_hifiberry_dacplusadc_set_sclk(component,
++			params_rate(params));
++
++		ret = snd_rpi_hifiberry_dacplusadc_update_rate_den(
++			substream, params);
++	}
++
++	ret = snd_soc_dai_set_bclk_ratio(asoc_rtd_to_cpu(rtd, 0), channels * width);
++	if (ret)
++		return ret;
++	ret = snd_soc_dai_set_bclk_ratio(asoc_rtd_to_codec(rtd, 0), channels * width);
++	return ret;
++}
++
++static int hifiberry_dacplusadc_LED_cnt;
++
++static int snd_rpi_hifiberry_dacplusadc_startup(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++
++	if (leds_off)
++		return 0;
++	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1,
++					 0x08, 0x08);
++	hifiberry_dacplusadc_LED_cnt++;
++	return 0;
++}
++
++static void snd_rpi_hifiberry_dacplusadc_shutdown(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++
++	hifiberry_dacplusadc_LED_cnt--;
++	if (!hifiberry_dacplusadc_LED_cnt)
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1,
++						 0x08, 0x00);
++}
++
++/* machine stream operations */
++static struct snd_soc_ops snd_rpi_hifiberry_dacplusadc_ops = {
++	.hw_params = snd_rpi_hifiberry_dacplusadc_hw_params,
++	.startup = snd_rpi_hifiberry_dacplusadc_startup,
++	.shutdown = snd_rpi_hifiberry_dacplusadc_shutdown,
++};
++
++SND_SOC_DAILINK_DEFS(hifi,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm512x.1-004d", "pcm512x-hifi"),
++			   COMP_CODEC("dmic-codec", "dmic-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_hifiberry_dacplusadc_dai[] = {
++{
++	.name		= "HiFiBerry DAC+ADC",
++	.stream_name	= "HiFiBerry DAC+ADC HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBS_CFS,
++	.ops		= &snd_rpi_hifiberry_dacplusadc_ops,
++	.init		= snd_rpi_hifiberry_dacplusadc_init,
++	SND_SOC_DAILINK_REG(hifi),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_hifiberry_dacplusadc = {
++	.name         = "snd_rpi_hifiberry_dacplusadc",
++	.driver_name  = "HifiberryDacpAdc",
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_rpi_hifiberry_dacplusadc_dai,
++	.num_links    = ARRAY_SIZE(snd_rpi_hifiberry_dacplusadc_dai),
++};
++
++
++static int snd_rpi_hifiberry_dacplusadc_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++
++	snd_rpi_hifiberry_dacplusadc.dev = &pdev->dev;
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai;
++
++		dai = &snd_rpi_hifiberry_dacplusadc_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++			"i2s-controller", 0);
++		if (i2s_node) {
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->of_node = i2s_node;
++			dai->cpus->dai_name = NULL;
++			dai->platforms->name = NULL;
++		}
++	}
++	digital_gain_0db_limit = !of_property_read_bool(
++		pdev->dev.of_node, "hifiberry,24db_digital_gain");
++	slave = of_property_read_bool(pdev->dev.of_node,
++					"hifiberry-dacplusadc,slave");
++	leds_off = of_property_read_bool(pdev->dev.of_node,
++					"hifiberry-dacplusadc,leds_off");
++
++	ret = devm_snd_soc_register_card(&pdev->dev,
++						 &snd_rpi_hifiberry_dacplusadc);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev,
++			"snd_soc_register_card() failed: %d\n", ret);
++
++	return ret;
++}
++
++static const struct of_device_id snd_rpi_hifiberry_dacplusadc_of_match[] = {
++	{ .compatible = "hifiberry,hifiberry-dacplusadc", },
++	{},
++};
++
++MODULE_DEVICE_TABLE(of, snd_rpi_hifiberry_dacplusadc_of_match);
++
++static struct platform_driver snd_rpi_hifiberry_dacplusadc_driver = {
++	.driver = {
++		.name   = "snd-rpi-hifiberry-dacplusadc",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_rpi_hifiberry_dacplusadc_of_match,
++	},
++	.probe          = snd_rpi_hifiberry_dacplusadc_probe,
++};
++
++static int __init hifiberry_dacplusadc_init(void)
++{
++	int ret;
++
++	dmic_codec_dev = platform_device_register_simple("dmic-codec", -1, NULL,
++							 0);
++	if (IS_ERR(dmic_codec_dev)) {
++		pr_err("%s: dmic-codec device registration failed\n", __func__);
++		return PTR_ERR(dmic_codec_dev);
++	}
++
++	ret = platform_driver_register(&snd_rpi_hifiberry_dacplusadc_driver);
++	if (ret) {
++		pr_err("%s: platform driver registration failed\n", __func__);
++		platform_device_unregister(dmic_codec_dev);
++	}
++
++	return ret;
++}
++module_init(hifiberry_dacplusadc_init);
++
++static void __exit hifiberry_dacplusadc_exit(void)
++{
++	platform_driver_unregister(&snd_rpi_hifiberry_dacplusadc_driver);
++	platform_device_unregister(dmic_codec_dev);
++}
++module_exit(hifiberry_dacplusadc_exit);
++
++MODULE_AUTHOR("Joerg Schambacher <joscha@schambacher.com>");
++MODULE_AUTHOR("Daniel Matuschek <daniel@hifiberry.com>");
++MODULE_DESCRIPTION("ASoC Driver for HiFiBerry DAC+ADC");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/hifiberry_dacplusadcpro.c
+@@ -0,0 +1,605 @@
++/*
++ * ASoC Driver for HiFiBerry DAC+ / DAC Pro with ADC PRO Version (SW control)
++ *
++ * Author:	Daniel Matuschek, Stuart MacLean <stuart@hifiberry.com>
++ *		Copyright 2014-2015
++ *		based on code by Florian Meier <florian.meier@koalo.de>
++ *		ADC, HP added by Joerg Schambacher <joerg@hifiberry.com>
++ *		Copyright 2018-21
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/kernel.h>
++#include <linux/clk.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/slab.h>
++#include <linux/delay.h>
++#include <linux/i2c.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++#include <sound/tlv.h>
++
++#include "../codecs/pcm512x.h"
++#include "../codecs/pcm186x.h"
++
++#define HIFIBERRY_DACPRO_NOCLOCK 0
++#define HIFIBERRY_DACPRO_CLK44EN 1
++#define HIFIBERRY_DACPRO_CLK48EN 2
++
++struct pcm512x_priv {
++	struct regmap *regmap;
++	struct clk *sclk;
++};
++
++/* Clock rate of CLK44EN attached to GPIO6 pin */
++#define CLK_44EN_RATE 22579200UL
++/* Clock rate of CLK48EN attached to GPIO3 pin */
++#define CLK_48EN_RATE 24576000UL
++
++static bool slave;
++static bool snd_rpi_hifiberry_is_dacpro;
++static bool digital_gain_0db_limit = true;
++static bool leds_off;
++
++static const unsigned int pcm186x_adc_input_channel_sel_value[] = {
++	0x00, 0x01, 0x02, 0x03, 0x10
++};
++
++static const char * const pcm186x_adcl_input_channel_sel_text[] = {
++	"No Select",
++	"VINL1[SE]",					/* Default for ADCL */
++	"VINL2[SE]",
++	"VINL2[SE] + VINL1[SE]",
++	"{VIN1P, VIN1M}[DIFF]"
++};
++
++static const char * const pcm186x_adcr_input_channel_sel_text[] = {
++	"No Select",
++	"VINR1[SE]",					/* Default for ADCR */
++	"VINR2[SE]",
++	"VINR2[SE] + VINR1[SE]",
++	"{VIN2P, VIN2M}[DIFF]"
++};
++
++static const struct soc_enum pcm186x_adc_input_channel_sel[] = {
++	SOC_VALUE_ENUM_SINGLE(PCM186X_ADC1_INPUT_SEL_L, 0,
++			      PCM186X_ADC_INPUT_SEL_MASK,
++			      ARRAY_SIZE(pcm186x_adcl_input_channel_sel_text),
++			      pcm186x_adcl_input_channel_sel_text,
++			      pcm186x_adc_input_channel_sel_value),
++	SOC_VALUE_ENUM_SINGLE(PCM186X_ADC1_INPUT_SEL_R, 0,
++			      PCM186X_ADC_INPUT_SEL_MASK,
++			      ARRAY_SIZE(pcm186x_adcr_input_channel_sel_text),
++			      pcm186x_adcr_input_channel_sel_text,
++			      pcm186x_adc_input_channel_sel_value),
++};
++
++static const unsigned int pcm186x_mic_bias_sel_value[] = {
++	0x00, 0x01, 0x11
++};
++
++static const char * const pcm186x_mic_bias_sel_text[] = {
++	"Mic Bias off",
++	"Mic Bias on",
++	"Mic Bias with Bypass Resistor"
++};
++
++static const struct soc_enum pcm186x_mic_bias_sel[] = {
++	SOC_VALUE_ENUM_SINGLE(PCM186X_MIC_BIAS_CTRL, 0,
++			      GENMASK(4, 0),
++			      ARRAY_SIZE(pcm186x_mic_bias_sel_text),
++			      pcm186x_mic_bias_sel_text,
++			      pcm186x_mic_bias_sel_value),
++};
++
++static const unsigned int pcm186x_gain_sel_value[] = {
++	0xe8, 0xe9, 0xea, 0xeb, 0xec, 0xed, 0xee, 0xef,
++	0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
++	0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff,
++	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
++	0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
++	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
++	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
++	0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
++	0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
++	0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
++	0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
++	0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
++	0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f,
++	0x50
++};
++
++static const char * const pcm186x_gain_sel_text[] = {
++	"-12.0dB", "-11.5dB", "-11.0dB", "-10.5dB", "-10.0dB", "-9.5dB",
++	"-9.0dB", "-8.5dB", "-8.0dB", "-7.5dB", "-7.0dB", "-6.5dB",
++	"-6.0dB", "-5.5dB", "-5.0dB", "-4.5dB", "-4.0dB", "-3.5dB",
++	"-3.0dB", "-2.5dB", "-2.0dB", "-1.5dB", "-1.0dB", "-0.5dB",
++	"0.0dB", "0.5dB", "1.0dB", "1.5dB", "2.0dB", "2.5dB",
++	"3.0dB", "3.5dB", "4.0dB", "4.5dB", "5.0dB", "5.5dB",
++	"6.0dB", "6.5dB", "7.0dB", "7.5dB", "8.0dB", "8.5dB",
++	"9.0dB", "9.5dB", "10.0dB", "10.5dB", "11.0dB", "11.5dB",
++	"12.0dB", "12.5dB", "13.0dB", "13.5dB", "14.0dB", "14.5dB",
++	"15.0dB", "15.5dB", "16.0dB", "16.5dB", "17.0dB", "17.5dB",
++	"18.0dB", "18.5dB", "19.0dB", "19.5dB", "20.0dB", "20.5dB",
++	"21.0dB", "21.5dB", "22.0dB", "22.5dB", "23.0dB", "23.5dB",
++	"24.0dB", "24.5dB", "25.0dB", "25.5dB", "26.0dB", "26.5dB",
++	"27.0dB", "27.5dB", "28.0dB", "28.5dB", "29.0dB", "29.5dB",
++	"30.0dB", "30.5dB", "31.0dB", "31.5dB", "32.0dB", "32.5dB",
++	"33.0dB", "33.5dB", "34.0dB", "34.5dB", "35.0dB", "35.5dB",
++	"36.0dB", "36.5dB", "37.0dB", "37.5dB", "38.0dB", "38.5dB",
++	"39.0dB", "39.5dB", "40.0dB"};
++
++static const struct soc_enum pcm186x_gain_sel[] = {
++	SOC_VALUE_ENUM_SINGLE(PCM186X_PGA_VAL_CH1_L, 0,
++			      0xff,
++			      ARRAY_SIZE(pcm186x_gain_sel_text),
++			      pcm186x_gain_sel_text,
++			      pcm186x_gain_sel_value),
++	SOC_VALUE_ENUM_SINGLE(PCM186X_PGA_VAL_CH1_R, 0,
++			      0xff,
++			      ARRAY_SIZE(pcm186x_gain_sel_text),
++			      pcm186x_gain_sel_text,
++			      pcm186x_gain_sel_value),
++};
++
++static const struct snd_kcontrol_new pcm1863_snd_controls_card[] = {
++	SOC_ENUM("ADC Left Input", pcm186x_adc_input_channel_sel[0]),
++	SOC_ENUM("ADC Right Input", pcm186x_adc_input_channel_sel[1]),
++	SOC_ENUM("ADC Mic Bias", pcm186x_mic_bias_sel),
++	SOC_ENUM("PGA Gain Left", pcm186x_gain_sel[0]),
++	SOC_ENUM("PGA Gain Right", pcm186x_gain_sel[1]),
++};
++
++static int pcm1863_add_controls(struct snd_soc_component *component)
++{
++	snd_soc_add_component_controls(component,
++			pcm1863_snd_controls_card,
++			ARRAY_SIZE(pcm1863_snd_controls_card));
++	return 0;
++}
++
++static void snd_rpi_hifiberry_dacplusadcpro_select_clk(
++					struct snd_soc_component *component, int clk_id)
++{
++	switch (clk_id) {
++	case HIFIBERRY_DACPRO_NOCLOCK:
++		snd_soc_component_update_bits(component,
++				PCM512x_GPIO_CONTROL_1, 0x24, 0x00);
++		break;
++	case HIFIBERRY_DACPRO_CLK44EN:
++		snd_soc_component_update_bits(component,
++				PCM512x_GPIO_CONTROL_1, 0x24, 0x20);
++		break;
++	case HIFIBERRY_DACPRO_CLK48EN:
++		snd_soc_component_update_bits(component,
++				PCM512x_GPIO_CONTROL_1, 0x24, 0x04);
++		break;
++	}
++	usleep_range(3000, 4000);
++}
++
++static void snd_rpi_hifiberry_dacplusadcpro_clk_gpio(struct snd_soc_component *component)
++{
++	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x24, 0x24);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_3, 0x0f, 0x02);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_6, 0x0f, 0x02);
++}
++
++static bool snd_rpi_hifiberry_dacplusadcpro_is_sclk(struct snd_soc_component *component)
++{
++	unsigned int sck;
++
++	sck = snd_soc_component_read(component, PCM512x_RATE_DET_4);
++	return (!(sck & 0x40));
++}
++
++static bool snd_rpi_hifiberry_dacplusadcpro_is_pro_card(struct snd_soc_component *component)
++{
++	bool isClk44EN, isClk48En, isNoClk;
++
++	snd_rpi_hifiberry_dacplusadcpro_clk_gpio(component);
++
++	snd_rpi_hifiberry_dacplusadcpro_select_clk(component, HIFIBERRY_DACPRO_CLK44EN);
++	isClk44EN = snd_rpi_hifiberry_dacplusadcpro_is_sclk(component);
++
++	snd_rpi_hifiberry_dacplusadcpro_select_clk(component, HIFIBERRY_DACPRO_NOCLOCK);
++	isNoClk = snd_rpi_hifiberry_dacplusadcpro_is_sclk(component);
++
++	snd_rpi_hifiberry_dacplusadcpro_select_clk(component, HIFIBERRY_DACPRO_CLK48EN);
++	isClk48En = snd_rpi_hifiberry_dacplusadcpro_is_sclk(component);
++
++	return (isClk44EN && isClk48En && !isNoClk);
++}
++
++static int snd_rpi_hifiberry_dacplusadcpro_clk_for_rate(int sample_rate)
++{
++	int type;
++
++	switch (sample_rate) {
++	case 11025:
++	case 22050:
++	case 44100:
++	case 88200:
++	case 176400:
++	case 352800:
++		type = HIFIBERRY_DACPRO_CLK44EN;
++		break;
++	default:
++		type = HIFIBERRY_DACPRO_CLK48EN;
++		break;
++	}
++	return type;
++}
++
++static void snd_rpi_hifiberry_dacplusadcpro_set_sclk(struct snd_soc_component *component,
++	int sample_rate)
++{
++	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
++
++	if (!IS_ERR(pcm512x->sclk)) {
++		int ctype;
++
++		ctype = snd_rpi_hifiberry_dacplusadcpro_clk_for_rate(sample_rate);
++		clk_set_rate(pcm512x->sclk, (ctype == HIFIBERRY_DACPRO_CLK44EN)
++			? CLK_44EN_RATE : CLK_48EN_RATE);
++		snd_rpi_hifiberry_dacplusadcpro_select_clk(component, ctype);
++	}
++}
++
++static int snd_rpi_hifiberry_dacplusadcpro_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_component *dac = asoc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_component *adc = asoc_rtd_to_codec(rtd, 1)->component;
++	struct snd_soc_dai_driver *adc_driver = asoc_rtd_to_codec(rtd, 1)->driver;
++	struct pcm512x_priv *priv;
++	int ret;
++
++	if (slave)
++		snd_rpi_hifiberry_is_dacpro = false;
++	else
++		snd_rpi_hifiberry_is_dacpro =
++				snd_rpi_hifiberry_dacplusadcpro_is_pro_card(dac);
++
++	if (snd_rpi_hifiberry_is_dacpro) {
++		struct snd_soc_dai_link *dai = rtd->dai_link;
++
++		dai->name = "HiFiBerry DAC+ADC Pro";
++		dai->stream_name = "HiFiBerry DAC+ADC Pro HiFi";
++		dai->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
++			| SND_SOC_DAIFMT_CBM_CFM;
++
++		// set DAC DAI configuration
++		ret = snd_soc_dai_set_fmt(asoc_rtd_to_codec(rtd, 0),
++				SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
++			| SND_SOC_DAIFMT_CBM_CFM);
++		if (ret < 0)
++			return ret;
++
++		// set ADC DAI configuration
++		ret = snd_soc_dai_set_fmt(asoc_rtd_to_codec(rtd, 1),
++				SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
++			| SND_SOC_DAIFMT_CBS_CFS);
++		if (ret < 0)
++			return ret;
++
++		// set CPU DAI configuration
++		ret = snd_soc_dai_set_fmt(asoc_rtd_to_cpu(rtd, 0),
++			SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF | SND_SOC_DAIFMT_CBS_CFS);
++		if (ret < 0)
++			return ret;
++
++		snd_soc_component_update_bits(dac, PCM512x_BCLK_LRCLK_CFG, 0x31, 0x11);
++		snd_soc_component_update_bits(dac, PCM512x_MASTER_MODE, 0x03, 0x03);
++		snd_soc_component_update_bits(dac, PCM512x_MASTER_CLKDIV_2, 0x7f, 63);
++	} else {
++		priv = snd_soc_component_get_drvdata(dac);
++		priv->sclk = ERR_PTR(-ENOENT);
++	}
++
++	/* disable 24bit mode as long as I2S module does not have sign extension fixed */
++	adc_driver->capture.formats = SNDRV_PCM_FMTBIT_S32_LE | SNDRV_PCM_FMTBIT_S16_LE;
++
++	snd_soc_component_update_bits(dac, PCM512x_GPIO_EN, 0x08, 0x08);
++	snd_soc_component_update_bits(dac, PCM512x_GPIO_OUTPUT_4, 0x0f, 0x02);
++	if (leds_off)
++		snd_soc_component_update_bits(dac, PCM512x_GPIO_CONTROL_1, 0x08, 0x00);
++	else
++		snd_soc_component_update_bits(dac, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
++
++	ret = pcm1863_add_controls(adc);
++	if (ret < 0)
++		dev_warn(rtd->dev, "Failed to add pcm1863 controls: %d\n",
++		ret);
++
++	/* set GPIO2 to output, GPIO3 input */
++	snd_soc_component_write(adc, PCM186X_GPIO3_2_CTRL, 0x00);
++	snd_soc_component_write(adc, PCM186X_GPIO3_2_DIR_CTRL, 0x04);
++	if (leds_off)
++		snd_soc_component_update_bits(adc, PCM186X_GPIO_IN_OUT, 0x40, 0x00);
++	else
++		snd_soc_component_update_bits(adc, PCM186X_GPIO_IN_OUT, 0x40, 0x40);
++
++	if (digital_gain_0db_limit) {
++		int ret;
++		struct snd_soc_card *card = rtd->card;
++
++		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
++	}
++
++	return 0;
++}
++
++static int snd_rpi_hifiberry_dacplusadcpro_update_rate_den(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component; /* only use DAC */
++	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
++	struct snd_ratnum *rats_no_pll;
++	unsigned int num = 0, den = 0;
++	int err;
++
++	rats_no_pll = devm_kzalloc(rtd->dev, sizeof(*rats_no_pll), GFP_KERNEL);
++	if (!rats_no_pll)
++		return -ENOMEM;
++
++	rats_no_pll->num = clk_get_rate(pcm512x->sclk) / 64;
++	rats_no_pll->den_min = 1;
++	rats_no_pll->den_max = 128;
++	rats_no_pll->den_step = 1;
++
++	err = snd_interval_ratnum(hw_param_interval(params,
++		SNDRV_PCM_HW_PARAM_RATE), 1, rats_no_pll, &num, &den);
++	if (err >= 0 && den) {
++		params->rate_num = num;
++		params->rate_den = den;
++	}
++
++	devm_kfree(rtd->dev, rats_no_pll);
++	return 0;
++}
++
++static int snd_rpi_hifiberry_dacplusadcpro_hw_params(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	int ret = 0;
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	int channels = params_channels(params);
++	int width = 32;
++	struct snd_soc_component *dac = asoc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_dai *dai = asoc_rtd_to_codec(rtd, 0);
++	struct snd_soc_dai_driver *drv = dai->driver;
++	const struct snd_soc_dai_ops *ops = drv->ops;
++
++	if (snd_rpi_hifiberry_is_dacpro) {
++		width = snd_pcm_format_physical_width(params_format(params));
++
++		snd_rpi_hifiberry_dacplusadcpro_set_sclk(dac,
++			params_rate(params));
++
++		ret = snd_rpi_hifiberry_dacplusadcpro_update_rate_den(
++			substream, params);
++		if (ret)
++			return ret;
++	}
++
++	ret = snd_soc_dai_set_bclk_ratio(asoc_rtd_to_cpu(rtd, 0), channels * width);
++	if (ret)
++		return ret;
++	ret = snd_soc_dai_set_bclk_ratio(asoc_rtd_to_codec(rtd, 0), channels * width);
++	if (ret)
++		return ret;
++	if (snd_rpi_hifiberry_is_dacpro && ops->hw_params)
++		ret = ops->hw_params(substream, params, dai);
++	return ret;
++}
++
++static int snd_rpi_hifiberry_dacplusadcpro_startup(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *dac = asoc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_component *adc = asoc_rtd_to_codec(rtd, 1)->component;
++
++	if (leds_off)
++		return 0;
++	/* switch on respective LED */
++	if (!substream->stream)
++		snd_soc_component_update_bits(dac, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
++	else
++		snd_soc_component_update_bits(adc, PCM186X_GPIO_IN_OUT, 0x40, 0x40);
++	return 0;
++}
++
++static void snd_rpi_hifiberry_dacplusadcpro_shutdown(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *dac = asoc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_component *adc = asoc_rtd_to_codec(rtd, 1)->component;
++
++	/* switch off respective LED */
++	if (!substream->stream)
++		snd_soc_component_update_bits(dac, PCM512x_GPIO_CONTROL_1, 0x08, 0x00);
++	else
++		snd_soc_component_update_bits(adc, PCM186X_GPIO_IN_OUT, 0x40, 0x00);
++}
++
++
++/* machine stream operations */
++static struct snd_soc_ops snd_rpi_hifiberry_dacplusadcpro_ops = {
++	.hw_params = snd_rpi_hifiberry_dacplusadcpro_hw_params,
++	.startup = snd_rpi_hifiberry_dacplusadcpro_startup,
++	.shutdown = snd_rpi_hifiberry_dacplusadcpro_shutdown,
++};
++
++SND_SOC_DAILINK_DEFS(hifi,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm512x.1-004d", "pcm512x-hifi"),
++			   COMP_CODEC("pcm186x.1-004a", "pcm1863-aif")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_hifiberry_dacplusadcpro_dai[] = {
++{
++	.name		= "HiFiBerry DAC+ADC PRO",
++	.stream_name	= "HiFiBerry DAC+ADC PRO HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBS_CFS,
++	.ops		= &snd_rpi_hifiberry_dacplusadcpro_ops,
++	.init		= snd_rpi_hifiberry_dacplusadcpro_init,
++	SND_SOC_DAILINK_REG(hifi),
++},
++};
++
++/* aux device for optional headphone amp */
++static struct snd_soc_aux_dev hifiberry_dacplusadcpro_aux_devs[] = {
++	{
++		.dlc = {
++			.name = "tpa6130a2.1-0060",
++		},
++	},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_hifiberry_dacplusadcpro = {
++	.name         = "snd_rpi_hifiberry_dacplusadcpro",
++	.driver_name  = "HifiberryDacpAdcPro",
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_rpi_hifiberry_dacplusadcpro_dai,
++	.num_links    = ARRAY_SIZE(snd_rpi_hifiberry_dacplusadcpro_dai),
++};
++
++static int hb_hp_detect(void)
++{
++	struct i2c_adapter *adap = i2c_get_adapter(1);
++	int ret;
++	struct i2c_client tpa_i2c_client = {
++		.addr = 0x60,
++		.adapter = adap,
++	};
++
++	if (!adap)
++		return -EPROBE_DEFER;	/* I2C module not yet available */
++
++	ret = i2c_smbus_read_byte(&tpa_i2c_client) >= 0;
++	i2c_put_adapter(adap);
++	return ret;
++};
++
++static struct property tpa_enable_prop = {
++	       .name = "status",
++	       .length = 4 + 1, /* length 'okay' + 1 */
++	       .value = "okay",
++	};
++
++static int snd_rpi_hifiberry_dacplusadcpro_probe(struct platform_device *pdev)
++{
++	int ret = 0, i = 0;
++	struct snd_soc_card *card = &snd_rpi_hifiberry_dacplusadcpro;
++	struct device_node *tpa_node;
++	struct property *tpa_prop;
++	struct of_changeset ocs;
++	int len;
++
++	/* probe for head phone amp */
++	ret = hb_hp_detect();
++	if (ret < 0)
++		return ret;
++	if (ret) {
++		card->aux_dev = hifiberry_dacplusadcpro_aux_devs;
++		card->num_aux_devs =
++				ARRAY_SIZE(hifiberry_dacplusadcpro_aux_devs);
++		tpa_node = of_find_compatible_node(NULL, NULL, "ti,tpa6130a2");
++		tpa_prop = of_find_property(tpa_node, "status", &len);
++
++		if (strcmp((char *)tpa_prop->value, "okay")) {
++			/* and activate headphone using change_sets */
++			dev_info(&pdev->dev, "activating headphone amplifier");
++			of_changeset_init(&ocs);
++			ret = of_changeset_update_property(&ocs, tpa_node,
++							&tpa_enable_prop);
++			if (ret) {
++				dev_err(&pdev->dev,
++				"cannot activate headphone amplifier\n");
++				return -ENODEV;
++			}
++			ret = of_changeset_apply(&ocs);
++			if (ret) {
++				dev_err(&pdev->dev,
++				"cannot activate headphone amplifier\n");
++				return -ENODEV;
++			}
++		}
++	}
++
++	snd_rpi_hifiberry_dacplusadcpro.dev = &pdev->dev;
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai;
++
++		dai = &snd_rpi_hifiberry_dacplusadcpro_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++			"i2s-controller", 0);
++		if (i2s_node) {
++			for (i = 0; i < card->num_links; i++) {
++				dai->cpus->dai_name = NULL;
++				dai->cpus->of_node = i2s_node;
++				dai->platforms->name = NULL;
++				dai->platforms->of_node = i2s_node;
++			}
++		}
++	}
++	digital_gain_0db_limit = !of_property_read_bool(
++		pdev->dev.of_node, "hifiberry-dacplusadcpro,24db_digital_gain");
++	slave = of_property_read_bool(pdev->dev.of_node,
++					"hifiberry-dacplusadcpro,slave");
++	leds_off = of_property_read_bool(pdev->dev.of_node,
++					"hifiberry-dacplusadcpro,leds_off");
++	ret = snd_soc_register_card(&snd_rpi_hifiberry_dacplusadcpro);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev,
++			"snd_soc_register_card() failed: %d\n", ret);
++
++	return ret;
++}
++
++static const struct of_device_id snd_rpi_hifiberry_dacplusadcpro_of_match[] = {
++	{ .compatible = "hifiberry,hifiberry-dacplusadcpro", },
++	{},
++};
++
++MODULE_DEVICE_TABLE(of, snd_rpi_hifiberry_dacplusadcpro_of_match);
++
++static struct platform_driver snd_rpi_hifiberry_dacplusadcpro_driver = {
++	.driver = {
++		.name   = "snd-rpi-hifiberry-dacplusadcpro",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_rpi_hifiberry_dacplusadcpro_of_match,
++	},
++	.probe          = snd_rpi_hifiberry_dacplusadcpro_probe,
++};
++
++module_platform_driver(snd_rpi_hifiberry_dacplusadcpro_driver);
++
++MODULE_AUTHOR("Joerg Schambacher <joerg@hifiberry.com>");
++MODULE_AUTHOR("Daniel Matuschek <daniel@hifiberry.com>");
++MODULE_DESCRIPTION("ASoC Driver for HiFiBerry DAC+ADC");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/hifiberry_dacplusdsp.c
+@@ -0,0 +1,90 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * ASoC Driver for HiFiBerry DAC + DSP
++ *
++ * Author:	Joerg Schambacher <joscha@schambacher.com>
++ *		Copyright 2018
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <sound/soc.h>
++
++static struct snd_soc_component_driver dacplusdsp_component_driver;
++
++static struct snd_soc_dai_driver dacplusdsp_dai = {
++	.name = "dacplusdsp-hifi",
++	.capture = {
++		.stream_name = "DAC+DSP Capture",
++		.channels_min = 2,
++		.channels_max = 2,
++		.rates = SNDRV_PCM_RATE_CONTINUOUS,
++		.formats = SNDRV_PCM_FMTBIT_S16_LE |
++			   SNDRV_PCM_FMTBIT_S24_LE |
++			   SNDRV_PCM_FMTBIT_S32_LE,
++	},
++	.playback = {
++		.stream_name = "DACP+DSP Playback",
++		.channels_min = 2,
++		.channels_max = 2,
++		.rates = SNDRV_PCM_RATE_CONTINUOUS,
++		.formats = SNDRV_PCM_FMTBIT_S16_LE |
++			   SNDRV_PCM_FMTBIT_S24_LE |
++			   SNDRV_PCM_FMTBIT_S32_LE,
++	},
++	.symmetric_rate = 1};
++
++#ifdef CONFIG_OF
++static const struct of_device_id dacplusdsp_ids[] = {
++	{
++		.compatible = "hifiberry,dacplusdsp",
++	},
++	{} };
++MODULE_DEVICE_TABLE(of, dacplusdsp_ids);
++#endif
++
++static int dacplusdsp_platform_probe(struct platform_device *pdev)
++{
++	int ret;
++
++	ret = snd_soc_register_component(&pdev->dev,
++			&dacplusdsp_component_driver, &dacplusdsp_dai, 1);
++	if (ret) {
++		pr_alert("snd_soc_register_component failed\n");
++		return ret;
++	}
++
++	return 0;
++}
++
++static int dacplusdsp_platform_remove(struct platform_device *pdev)
++{
++	snd_soc_unregister_component(&pdev->dev);
++	return 0;
++}
++
++static struct platform_driver dacplusdsp_driver = {
++	.driver = {
++		.name = "hifiberry-dacplusdsp-codec",
++		.of_match_table = of_match_ptr(dacplusdsp_ids),
++		},
++		.probe = dacplusdsp_platform_probe,
++		.remove = dacplusdsp_platform_remove,
++};
++
++module_platform_driver(dacplusdsp_driver);
++
++MODULE_AUTHOR("Joerg Schambacher <joerg@i2audio.com>");
++MODULE_DESCRIPTION("ASoC Driver for HiFiBerry DAC+DSP");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/hifiberry_dacplushd.c
+@@ -0,0 +1,238 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * ASoC Driver for HiFiBerry DAC+ HD
++ *
++ * Author:	Joerg Schambacher, i2Audio GmbH for HiFiBerry
++ *		Copyright 2020
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/kernel.h>
++#include <linux/delay.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/delay.h>
++#include <linux/gpio.h>
++#include <linux/gpio/consumer.h>
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <linux/i2c.h>
++#include <linux/clk.h>
++
++#include "../codecs/pcm179x.h"
++
++#define DEFAULT_RATE		44100
++
++struct brd_drv_data {
++	struct regmap *regmap;
++	struct clk *sclk;
++};
++
++static struct brd_drv_data drvdata;
++static struct gpio_desc *reset_gpio;
++static const unsigned int hb_dacplushd_rates[] = {
++	192000, 96000, 48000, 176400, 88200, 44100,
++};
++
++static struct snd_pcm_hw_constraint_list hb_dacplushd_constraints = {
++	.list = hb_dacplushd_rates,
++	.count = ARRAY_SIZE(hb_dacplushd_rates),
++};
++
++static int snd_rpi_hb_dacplushd_startup(struct snd_pcm_substream *substream)
++{
++	/* constraints for standard sample rates */
++	snd_pcm_hw_constraint_list(substream->runtime, 0,
++				SNDRV_PCM_HW_PARAM_RATE,
++				&hb_dacplushd_constraints);
++	return 0;
++}
++
++static void snd_rpi_hifiberry_dacplushd_set_sclk(
++		struct snd_soc_component *component,
++		int sample_rate)
++{
++	if (!IS_ERR(drvdata.sclk))
++		clk_set_rate(drvdata.sclk, sample_rate);
++}
++
++static int snd_rpi_hifiberry_dacplushd_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_dai_link *dai = rtd->dai_link;
++	struct snd_soc_dai *cpu_dai = asoc_rtd_to_cpu(rtd, 0);
++
++	dai->name = "HiFiBerry DAC+ HD";
++	dai->stream_name = "HiFiBerry DAC+ HD HiFi";
++	dai->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
++		| SND_SOC_DAIFMT_CBM_CFM;
++
++	/* allow only fixed 32 clock counts per channel */
++	snd_soc_dai_set_bclk_ratio(cpu_dai, 32*2);
++
++	return 0;
++}
++
++static int snd_rpi_hifiberry_dacplushd_hw_params(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	int ret = 0;
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++
++	snd_rpi_hifiberry_dacplushd_set_sclk(component, params_rate(params));
++	return ret;
++}
++
++/* machine stream operations */
++static struct snd_soc_ops snd_rpi_hifiberry_dacplushd_ops = {
++	.startup = snd_rpi_hb_dacplushd_startup,
++	.hw_params = snd_rpi_hifiberry_dacplushd_hw_params,
++};
++
++SND_SOC_DAILINK_DEFS(hifi,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm179x.1-004c", "pcm179x-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++
++static struct snd_soc_dai_link snd_rpi_hifiberry_dacplushd_dai[] = {
++{
++	.name		= "HiFiBerry DAC+ HD",
++	.stream_name	= "HiFiBerry DAC+ HD HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBS_CFS,
++	.ops		= &snd_rpi_hifiberry_dacplushd_ops,
++	.init		= snd_rpi_hifiberry_dacplushd_init,
++	SND_SOC_DAILINK_REG(hifi),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_hifiberry_dacplushd = {
++	.name         = "snd_rpi_hifiberry_dacplushd",
++	.driver_name  = "HifiberryDacplusHD",
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_rpi_hifiberry_dacplushd_dai,
++	.num_links    = ARRAY_SIZE(snd_rpi_hifiberry_dacplushd_dai),
++};
++
++static int snd_rpi_hifiberry_dacplushd_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	static int dac_reset_done;
++	struct device *dev = &pdev->dev;
++	struct device_node *dev_node = dev->of_node;
++
++	snd_rpi_hifiberry_dacplushd.dev = &pdev->dev;
++
++	/* get GPIO and release DAC from RESET */
++	if (!dac_reset_done) {
++		reset_gpio = gpiod_get(&pdev->dev, "reset", GPIOD_OUT_LOW);
++		if (IS_ERR(reset_gpio)) {
++			dev_err(&pdev->dev, "gpiod_get() failed\n");
++			return -EINVAL;
++		}
++		dac_reset_done = 1;
++	}
++	if (!IS_ERR(reset_gpio))
++		gpiod_set_value(reset_gpio, 0);
++	msleep(1);
++	if (!IS_ERR(reset_gpio))
++		gpiod_set_value(reset_gpio, 1);
++	msleep(1);
++	if (!IS_ERR(reset_gpio))
++		gpiod_set_value(reset_gpio, 0);
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai;
++
++		dai = &snd_rpi_hifiberry_dacplushd_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++			"i2s-controller", 0);
++
++		if (i2s_node) {
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->of_node = i2s_node;
++			dai->cpus->dai_name = NULL;
++			dai->platforms->name = NULL;
++		} else {
++			return -EPROBE_DEFER;
++		}
++
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev,
++			&snd_rpi_hifiberry_dacplushd);
++	if (ret && ret != -EPROBE_DEFER) {
++		dev_err(&pdev->dev,
++			"snd_soc_register_card() failed: %d\n", ret);
++		return ret;
++	}
++	if (ret == -EPROBE_DEFER)
++		return ret;
++
++	dev_set_drvdata(dev, &drvdata);
++	if (dev_node == NULL) {
++		dev_err(&pdev->dev, "Device tree node not found\n");
++		return -ENODEV;
++	}
++
++	drvdata.sclk = devm_clk_get(dev, NULL);
++	if (IS_ERR(drvdata.sclk)) {
++		drvdata.sclk = ERR_PTR(-ENOENT);
++		return -ENODEV;
++	}
++
++	clk_set_rate(drvdata.sclk, DEFAULT_RATE);
++
++	return ret;
++}
++
++static int snd_rpi_hifiberry_dacplushd_remove(struct platform_device *pdev)
++{
++	if (IS_ERR(reset_gpio))
++		return -EINVAL;
++
++	/* put DAC into RESET and release GPIO */
++	gpiod_set_value(reset_gpio, 0);
++	gpiod_put(reset_gpio);
++
++	return 0;
++}
++
++static const struct of_device_id snd_rpi_hifiberry_dacplushd_of_match[] = {
++	{ .compatible = "hifiberry,hifiberry-dacplushd", },
++	{},
++};
++
++MODULE_DEVICE_TABLE(of, snd_rpi_hifiberry_dacplushd_of_match);
++
++static struct platform_driver snd_rpi_hifiberry_dacplushd_driver = {
++	.driver = {
++		.name   = "snd-rpi-hifiberry-dacplushd",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_rpi_hifiberry_dacplushd_of_match,
++	},
++	.probe          = snd_rpi_hifiberry_dacplushd_probe,
++	.remove		= snd_rpi_hifiberry_dacplushd_remove,
++};
++
++module_platform_driver(snd_rpi_hifiberry_dacplushd_driver);
++
++MODULE_AUTHOR("Joerg Schambacher <joerg@i2audio.com>");
++MODULE_DESCRIPTION("ASoC Driver for HiFiBerry DAC+ HD");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/i-sabre-q2m.c
+@@ -0,0 +1,159 @@
++/*
++ * ASoC Driver for I-Sabre Q2M
++ *
++ * Author: Satoru Kawase
++ * Modified by: Xiao Qingyong
++ * Update kernel v4.18+ by : Audiophonics
++ * 		Copyright 2018 Audiophonics
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/delay.h>
++#include <linux/fs.h>
++#include <asm/uaccess.h>
++#include <sound/core.h>
++#include <sound/soc.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++
++#include "../codecs/i-sabre-codec.h"
++
++
++static int snd_rpi_i_sabre_q2m_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++	unsigned int value;
++
++	/* Device ID */
++	value = snd_soc_component_read(component, ISABRECODEC_REG_01);
++	dev_info(component->card->dev, "Audiophonics Device ID : %02X\n", value);
++
++	/* API revision */
++	value = snd_soc_component_read(component, ISABRECODEC_REG_02);
++	dev_info(component->card->dev, "Audiophonics API revision : %02X\n", value);
++
++	return 0;
++}
++
++static int snd_rpi_i_sabre_q2m_hw_params(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd     = substream->private_data;
++	struct snd_soc_dai         *cpu_dai = asoc_rtd_to_cpu(rtd, 0);
++	int bclk_ratio;
++
++	bclk_ratio = snd_pcm_format_physical_width(
++			params_format(params)) * params_channels(params);
++	return snd_soc_dai_set_bclk_ratio(cpu_dai, bclk_ratio);
++}
++
++/* machine stream operations */
++static struct snd_soc_ops snd_rpi_i_sabre_q2m_ops = {
++	.hw_params = snd_rpi_i_sabre_q2m_hw_params,
++};
++
++SND_SOC_DAILINK_DEFS(rpi_i_sabre_q2m,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("i-sabre-codec-i2c.1-0048", "i-sabre-codec-dai")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_i_sabre_q2m_dai[] = {
++	{
++		.name           = "I-Sabre Q2M",
++		.stream_name    = "I-Sabre Q2M DAC",
++		.dai_fmt        = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
++						| SND_SOC_DAIFMT_CBS_CFS,
++		.init           = snd_rpi_i_sabre_q2m_init,
++		.ops            = &snd_rpi_i_sabre_q2m_ops,
++		SND_SOC_DAILINK_REG(rpi_i_sabre_q2m),
++	}
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_i_sabre_q2m = {
++	.name      = "I-Sabre Q2M DAC",
++	.owner     = THIS_MODULE,
++	.dai_link  = snd_rpi_i_sabre_q2m_dai,
++	.num_links = ARRAY_SIZE(snd_rpi_i_sabre_q2m_dai)
++};
++
++
++static int snd_rpi_i_sabre_q2m_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++
++	snd_rpi_i_sabre_q2m.dev = &pdev->dev;
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai;
++
++		dai = &snd_rpi_i_sabre_q2m_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++							"i2s-controller", 0);
++		if (i2s_node) {
++			dai->cpus->dai_name     = NULL;
++			dai->cpus->of_node      = i2s_node;
++			dai->platforms->name    = NULL;
++			dai->platforms->of_node = i2s_node;
++		} else {
++			dev_err(&pdev->dev,
++			    "Property 'i2s-controller' missing or invalid\n");
++			return (-EINVAL);
++		}
++
++		dai->name        = "I-Sabre Q2M";
++		dai->stream_name = "I-Sabre Q2M DAC";
++		dai->dai_fmt     = SND_SOC_DAIFMT_I2S
++					| SND_SOC_DAIFMT_NB_NF
++					| SND_SOC_DAIFMT_CBS_CFS;
++	}
++
++	/* Wait for registering codec driver */
++	mdelay(50);
++
++	ret = snd_soc_register_card(&snd_rpi_i_sabre_q2m);
++	if (ret) {
++		dev_err(&pdev->dev,
++			"snd_soc_register_card() failed: %d\n", ret);
++	}
++
++	return ret;
++}
++
++static int snd_rpi_i_sabre_q2m_remove(struct platform_device *pdev)
++{
++	snd_soc_unregister_card(&snd_rpi_i_sabre_q2m);
++	return 0;
++}
++
++static const struct of_device_id snd_rpi_i_sabre_q2m_of_match[] = {
++	{ .compatible = "audiophonics,i-sabre-q2m", },
++	{}
++};
++MODULE_DEVICE_TABLE(of, snd_rpi_i_sabre_q2m_of_match);
++
++static struct platform_driver snd_rpi_i_sabre_q2m_driver = {
++	.driver = {
++		.name           = "snd-rpi-i-sabre-q2m",
++		.owner          = THIS_MODULE,
++		.of_match_table = snd_rpi_i_sabre_q2m_of_match,
++	},
++	.probe  = snd_rpi_i_sabre_q2m_probe,
++	.remove = snd_rpi_i_sabre_q2m_remove,
++};
++module_platform_driver(snd_rpi_i_sabre_q2m_driver);
++
++MODULE_DESCRIPTION("ASoC Driver for I-Sabre Q2M");
++MODULE_AUTHOR("Audiophonics <http://www.audiophonics.fr>");
++MODULE_LICENSE("GPL");
+--- /dev/null
++++ b/sound/soc/bcm/iqaudio-codec.c
+@@ -0,0 +1,275 @@
++/*
++ * ASoC Driver for IQaudIO Raspberry Pi Codec board
++ *
++ * Author:	Gordon Garrity <gordon@iqaudio.com>
++ *		(C) Copyright IQaudio Limited, 2017-2019
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/gpio/consumer.h>
++#include <linux/platform_device.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++#include <linux/acpi.h>
++#include <linux/slab.h>
++#include "../codecs/da7213.h"
++
++static int pll_out = DA7213_PLL_FREQ_OUT_90316800;
++
++static int snd_rpi_iqaudio_pll_control(struct snd_soc_dapm_widget *w,
++				       struct snd_kcontrol *k, int  event)
++{
++	int ret = 0;
++	struct snd_soc_dapm_context *dapm = w->dapm;
++	struct snd_soc_card *card = dapm->card;
++	struct snd_soc_pcm_runtime *rtd =
++		snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++	struct snd_soc_dai *codec_dai = asoc_rtd_to_codec(rtd, 0);
++
++	if (SND_SOC_DAPM_EVENT_OFF(event)) {
++		ret = snd_soc_dai_set_pll(codec_dai, 0, DA7213_SYSCLK_MCLK, 0,
++					  0);
++		if (ret)
++			dev_err(card->dev, "Failed to bypass PLL: %d\n", ret);
++		/* Allow PLL time to bypass */
++		msleep(100);
++	} else if (SND_SOC_DAPM_EVENT_ON(event)) {
++		ret = snd_soc_dai_set_pll(codec_dai, 0, DA7213_SYSCLK_PLL, 0,
++					  pll_out);
++		if (ret)
++			dev_err(card->dev, "Failed to enable PLL: %d\n", ret);
++		/* Allow PLL time to lock */
++		msleep(100);
++	}
++
++	return ret;
++}
++
++static int snd_rpi_iqaudio_post_dapm_event(struct snd_soc_dapm_widget *w,
++                              struct snd_kcontrol *kcontrol,
++                              int event)
++{
++     switch (event) {
++     case SND_SOC_DAPM_POST_PMU:
++           /* Delay for mic bias ramp */
++           msleep(1000);
++           break;
++     default:
++           break;
++     }
++
++     return 0;
++}
++
++static const struct snd_kcontrol_new dapm_controls[] = {
++	SOC_DAPM_PIN_SWITCH("HP Jack"),
++	SOC_DAPM_PIN_SWITCH("MIC Jack"),
++	SOC_DAPM_PIN_SWITCH("Onboard MIC"),
++	SOC_DAPM_PIN_SWITCH("AUX Jack"),
++};
++
++static const struct snd_soc_dapm_widget dapm_widgets[] = {
++	SND_SOC_DAPM_HP("HP Jack", NULL),
++	SND_SOC_DAPM_MIC("MIC Jack", NULL),
++	SND_SOC_DAPM_MIC("Onboard MIC", NULL),
++	SND_SOC_DAPM_LINE("AUX Jack", NULL),
++	SND_SOC_DAPM_SUPPLY("PLL Control", SND_SOC_NOPM, 0, 0,
++			    snd_rpi_iqaudio_pll_control,
++			    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
++	SND_SOC_DAPM_POST("Post Power Up Event", snd_rpi_iqaudio_post_dapm_event),
++};
++
++static const struct snd_soc_dapm_route audio_map[] = {
++	{"HP Jack", NULL, "HPL"},
++	{"HP Jack", NULL, "HPR"},
++	{"HP Jack", NULL, "PLL Control"},
++
++	{"AUXR", NULL, "AUX Jack"},
++	{"AUXL", NULL, "AUX Jack"},
++	{"AUX Jack", NULL, "PLL Control"},
++
++	/* Assume Mic1 is linked to Headset and Mic2 to on-board mic */
++	{"MIC1", NULL, "MIC Jack"},
++	{"MIC Jack", NULL, "PLL Control"},
++	{"MIC2", NULL, "Onboard MIC"},
++	{"Onboard MIC", NULL, "PLL Control"},
++};
++
++/* machine stream operations */
++
++static int snd_rpi_iqaudio_codec_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_dai *codec_dai = asoc_rtd_to_codec(rtd, 0);
++	struct snd_soc_dai *cpu_dai = asoc_rtd_to_cpu(rtd, 0);
++	int ret;
++
++	/*
++	 * Disable AUX Jack Pin by default to prevent PLL being enabled at
++	 * startup. This avoids holding the PLL to a fixed SR config for
++	 * subsequent streams.
++	 *
++	 * This pin can still be enabled later, as required by user-space.
++	 */
++	snd_soc_dapm_disable_pin(&rtd->card->dapm, "AUX Jack");
++	snd_soc_dapm_sync(&rtd->card->dapm);
++
++	/* Set bclk ratio to align with codec's BCLK rate */
++	ret = snd_soc_dai_set_bclk_ratio(cpu_dai, 64);
++	if (ret) {
++		dev_err(rtd->dev, "Failed to set CPU BLCK ratio\n");
++		return ret;
++	}
++
++	/* Set MCLK frequency to codec, onboard 11.2896MHz clock */
++	return snd_soc_dai_set_sysclk(codec_dai, DA7213_CLKSRC_MCLK, 11289600,
++				      SND_SOC_CLOCK_OUT);
++}
++
++static int snd_rpi_iqaudio_codec_hw_params(struct snd_pcm_substream *substream,
++					   struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	unsigned int samplerate = params_rate(params);
++
++	switch (samplerate) {
++	case  8000:
++	case 16000:
++	case 32000:
++	case 48000:
++	case 96000:
++		pll_out = DA7213_PLL_FREQ_OUT_98304000;
++		return 0;
++	case 44100:
++	case 88200:
++		pll_out = DA7213_PLL_FREQ_OUT_90316800;
++		return 0;
++	default:
++		dev_err(rtd->dev,"Unsupported samplerate %d\n", samplerate);
++		return -EINVAL;
++	}
++}
++
++static const struct snd_soc_ops snd_rpi_iqaudio_codec_ops = {
++	.hw_params = snd_rpi_iqaudio_codec_hw_params,
++};
++
++SND_SOC_DAILINK_DEFS(rpi_iqaudio,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("da7213.1-001a", "da7213-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2835-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_iqaudio_codec_dai[] = {
++{
++	.dai_fmt 		= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				  SND_SOC_DAIFMT_CBM_CFM,
++	.init			= snd_rpi_iqaudio_codec_init,
++	.ops			= &snd_rpi_iqaudio_codec_ops,
++	.symmetric_rate	= 1,
++	.symmetric_channels	= 1,
++	.symmetric_sample_bits	= 1,
++	SND_SOC_DAILINK_REG(rpi_iqaudio),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_iqaudio_codec = {
++	.owner			= THIS_MODULE,
++	.dai_link		= snd_rpi_iqaudio_codec_dai,
++	.num_links		= ARRAY_SIZE(snd_rpi_iqaudio_codec_dai),
++	.controls		= dapm_controls,
++	.num_controls		= ARRAY_SIZE(dapm_controls),
++	.dapm_widgets		= dapm_widgets,
++	.num_dapm_widgets	= ARRAY_SIZE(dapm_widgets),
++	.dapm_routes		= audio_map,
++	.num_dapm_routes	= ARRAY_SIZE(audio_map),
++};
++
++static int snd_rpi_iqaudio_codec_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++
++	snd_rpi_iqaudio_codec.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_card *card = &snd_rpi_iqaudio_codec;
++		struct snd_soc_dai_link *dai = &snd_rpi_iqaudio_codec_dai[0];
++
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++					    "i2s-controller", 0);
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		}
++
++		if (of_property_read_string(pdev->dev.of_node, "card_name",
++					    &card->name))
++			card->name = "IQaudIOCODEC";
++
++		if (of_property_read_string(pdev->dev.of_node, "dai_name",
++					    &dai->name))
++			dai->name = "IQaudIO CODEC";
++
++		if (of_property_read_string(pdev->dev.of_node,
++					"dai_stream_name", &dai->stream_name))
++			dai->stream_name = "IQaudIO CODEC HiFi v1.2";
++
++	}
++
++	ret = snd_soc_register_card(&snd_rpi_iqaudio_codec);
++	if (ret) {
++		if (ret != -EPROBE_DEFER)
++			dev_err(&pdev->dev,
++				"snd_soc_register_card() failed: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++static int snd_rpi_iqaudio_codec_remove(struct platform_device *pdev)
++{
++	snd_soc_unregister_card(&snd_rpi_iqaudio_codec);
++	return 0;
++}
++
++static const struct of_device_id iqaudio_of_match[] = {
++	{ .compatible = "iqaudio,iqaudio-codec", },
++	{},
++};
++
++MODULE_DEVICE_TABLE(of, iqaudio_of_match);
++
++static struct platform_driver snd_rpi_iqaudio_codec_driver = {
++	.driver = {
++		.name   = "snd-rpi-iqaudio-codec",
++		.owner  = THIS_MODULE,
++		.of_match_table = iqaudio_of_match,
++	},
++	.probe          = snd_rpi_iqaudio_codec_probe,
++	.remove         = snd_rpi_iqaudio_codec_remove,
++};
++
++
++
++module_platform_driver(snd_rpi_iqaudio_codec_driver);
++
++MODULE_AUTHOR("Gordon Garrity <gordon@iqaudio.com>");
++MODULE_DESCRIPTION("ASoC Driver for IQaudIO CODEC");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/iqaudio-dac.c
+@@ -0,0 +1,224 @@
++/*
++ * ASoC Driver for IQaudIO DAC
++ *
++ * Author:	Florian Meier <florian.meier@koalo.de>
++ *		Copyright 2013
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/gpio/consumer.h>
++#include <linux/platform_device.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++static bool digital_gain_0db_limit = true;
++
++static struct gpio_desc *mute_gpio;
++
++static int snd_rpi_iqaudio_dac_init(struct snd_soc_pcm_runtime *rtd)
++{
++	if (digital_gain_0db_limit)
++	{
++		int ret;
++		struct snd_soc_card *card = rtd->card;
++
++		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
++	}
++
++	return 0;
++}
++
++static void snd_rpi_iqaudio_gpio_mute(struct snd_soc_card *card)
++{
++	if (mute_gpio) {
++		dev_info(card->dev, "%s: muting amp using GPIO22\n",
++			 __func__);
++		gpiod_set_value_cansleep(mute_gpio, 0);
++	}
++}
++
++static void snd_rpi_iqaudio_gpio_unmute(struct snd_soc_card *card)
++{
++	if (mute_gpio) {
++		dev_info(card->dev, "%s: un-muting amp using GPIO22\n",
++			 __func__);
++		gpiod_set_value_cansleep(mute_gpio, 1);
++	}
++}
++
++static int snd_rpi_iqaudio_set_bias_level(struct snd_soc_card *card,
++	struct snd_soc_dapm_context *dapm, enum snd_soc_bias_level level)
++{
++	struct snd_soc_pcm_runtime *rtd;
++	struct snd_soc_dai *codec_dai;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++	codec_dai = asoc_rtd_to_codec(rtd, 0);
++
++	if (dapm->dev != codec_dai->dev)
++		return 0;
++
++	switch (level) {
++	case SND_SOC_BIAS_PREPARE:
++		if (dapm->bias_level != SND_SOC_BIAS_STANDBY)
++			break;
++
++		/* UNMUTE AMP */
++		snd_rpi_iqaudio_gpio_unmute(card);
++
++		break;
++	case SND_SOC_BIAS_STANDBY:
++		if (dapm->bias_level != SND_SOC_BIAS_PREPARE)
++			break;
++
++		/* MUTE AMP */
++		snd_rpi_iqaudio_gpio_mute(card);
++
++		break;
++	default:
++		break;
++	}
++
++	return 0;
++}
++
++SND_SOC_DAILINK_DEFS(hifi,
++        DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++        DAILINK_COMP_ARRAY(COMP_CODEC("pcm512x.1-004c", "pcm512x-hifi")),
++        DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_iqaudio_dac_dai[] = {
++{
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBS_CFS,
++	.init		= snd_rpi_iqaudio_dac_init,
++	SND_SOC_DAILINK_REG(hifi),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_iqaudio_dac = {
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_rpi_iqaudio_dac_dai,
++	.num_links    = ARRAY_SIZE(snd_rpi_iqaudio_dac_dai),
++};
++
++static int snd_rpi_iqaudio_dac_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	bool gpio_unmute = false;
++
++	snd_rpi_iqaudio_dac.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_card *card = &snd_rpi_iqaudio_dac;
++		struct snd_soc_dai_link *dai = &snd_rpi_iqaudio_dac_dai[0];
++		bool auto_gpio_mute = false;
++
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++					    "i2s-controller", 0);
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		}
++
++		digital_gain_0db_limit = !of_property_read_bool(
++			pdev->dev.of_node, "iqaudio,24db_digital_gain");
++
++		if (of_property_read_string(pdev->dev.of_node, "card_name",
++					    &card->name))
++			card->name = "IQaudIODAC";
++
++		if (of_property_read_string(pdev->dev.of_node, "dai_name",
++					    &dai->name))
++			dai->name = "IQaudIO DAC";
++
++		if (of_property_read_string(pdev->dev.of_node,
++					"dai_stream_name", &dai->stream_name))
++			dai->stream_name = "IQaudIO DAC HiFi";
++
++		/* gpio_unmute - one time unmute amp using GPIO */
++		gpio_unmute = of_property_read_bool(pdev->dev.of_node,
++						    "iqaudio-dac,unmute-amp");
++
++		/* auto_gpio_mute - mute/unmute amp using GPIO */
++		auto_gpio_mute = of_property_read_bool(pdev->dev.of_node,
++						"iqaudio-dac,auto-mute-amp");
++
++		if (auto_gpio_mute || gpio_unmute) {
++			mute_gpio = devm_gpiod_get_optional(&pdev->dev, "mute",
++							    GPIOD_OUT_LOW);
++			if (IS_ERR(mute_gpio)) {
++				ret = PTR_ERR(mute_gpio);
++				dev_err(&pdev->dev,
++					"Failed to get mute gpio: %d\n", ret);
++				return ret;
++			}
++
++			if (auto_gpio_mute && mute_gpio)
++				snd_rpi_iqaudio_dac.set_bias_level =
++						snd_rpi_iqaudio_set_bias_level;
++		}
++	}
++
++	ret = snd_soc_register_card(&snd_rpi_iqaudio_dac);
++	if (ret) {
++		if (ret != -EPROBE_DEFER)
++			dev_err(&pdev->dev,
++				"snd_soc_register_card() failed: %d\n", ret);
++		return ret;
++	}
++
++	if (gpio_unmute && mute_gpio)
++		snd_rpi_iqaudio_gpio_unmute(&snd_rpi_iqaudio_dac);
++
++	return 0;
++}
++
++static int snd_rpi_iqaudio_dac_remove(struct platform_device *pdev)
++{
++	snd_rpi_iqaudio_gpio_mute(&snd_rpi_iqaudio_dac);
++
++	snd_soc_unregister_card(&snd_rpi_iqaudio_dac);
++	return 0;
++}
++
++static const struct of_device_id iqaudio_of_match[] = {
++	{ .compatible = "iqaudio,iqaudio-dac", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, iqaudio_of_match);
++
++static struct platform_driver snd_rpi_iqaudio_dac_driver = {
++	.driver = {
++		.name   = "snd-rpi-iqaudio-dac",
++		.owner  = THIS_MODULE,
++		.of_match_table = iqaudio_of_match,
++	},
++	.probe          = snd_rpi_iqaudio_dac_probe,
++	.remove         = snd_rpi_iqaudio_dac_remove,
++};
++
++module_platform_driver(snd_rpi_iqaudio_dac_driver);
++
++MODULE_AUTHOR("Florian Meier <florian.meier@koalo.de>");
++MODULE_DESCRIPTION("ASoC Driver for IQAudio DAC");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/justboom-both.c
+@@ -0,0 +1,267 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * rpi--wm8804.c -- ALSA SoC Raspberry Pi soundcard.
++ *
++ * Authors: Johannes Krude <johannes@krude.de
++ *
++ * Driver for when connecting simultaneously justboom-digi and justboom-dac
++ *
++ * Based upon code from:
++ * justboom-digi.c
++ * by Milan Neskovic <info@justboom.co>
++ * justboom-dac.c
++ * by Milan Neskovic <info@justboom.co>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++#include "../codecs/wm8804.h"
++#include "../codecs/pcm512x.h"
++
++
++static bool digital_gain_0db_limit = true;
++
++static int snd_rpi_justboom_both_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_component *digi = asoc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_component *dac = asoc_rtd_to_codec(rtd, 1)->component;
++
++	/* enable  TX output */
++	snd_soc_component_update_bits(digi, WM8804_PWRDN, 0x4, 0x0);
++
++	snd_soc_component_update_bits(dac, PCM512x_GPIO_EN, 0x08, 0x08);
++	snd_soc_component_update_bits(dac, PCM512x_GPIO_OUTPUT_4, 0xf, 0x02);
++	snd_soc_component_update_bits(dac, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
++
++	if (digital_gain_0db_limit) {
++		int ret;
++		struct snd_soc_card *card = rtd->card;
++
++		ret = snd_soc_limit_volume(card, "Digital Playback Volume",
++									207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n",
++									ret);
++	}
++
++	return 0;
++}
++
++static int snd_rpi_justboom_both_hw_params(struct snd_pcm_substream *substream,
++				       struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *codec_dai = asoc_rtd_to_codec(rtd, 0);
++	struct snd_soc_component *digi = asoc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_dai *cpu_dai = asoc_rtd_to_cpu(rtd, 0);
++
++	int sysclk = 27000000; /* This is fixed on this board */
++
++	long mclk_freq    = 0;
++	int mclk_div      = 1;
++	int sampling_freq = 1;
++
++	int ret;
++
++	int samplerate = params_rate(params);
++
++	if (samplerate <= 96000) {
++		mclk_freq = samplerate*256;
++		mclk_div  = WM8804_MCLKDIV_256FS;
++	} else {
++		mclk_freq = samplerate*128;
++		mclk_div  = WM8804_MCLKDIV_128FS;
++	}
++
++	switch (samplerate) {
++	case 32000:
++		sampling_freq = 0x03;
++		break;
++	case 44100:
++		sampling_freq = 0x00;
++		break;
++	case 48000:
++		sampling_freq = 0x02;
++		break;
++	case 88200:
++		sampling_freq = 0x08;
++		break;
++	case 96000:
++		sampling_freq = 0x0a;
++		break;
++	case 176400:
++		sampling_freq = 0x0c;
++		break;
++	case 192000:
++		sampling_freq = 0x0e;
++		break;
++	default:
++		dev_err(rtd->card->dev,
++		"Failed to set WM8804 SYSCLK, unsupported samplerate %d\n",
++		samplerate);
++	}
++
++	snd_soc_dai_set_clkdiv(codec_dai, WM8804_MCLK_DIV, mclk_div);
++	snd_soc_dai_set_pll(codec_dai, 0, 0, sysclk, mclk_freq);
++
++	ret = snd_soc_dai_set_sysclk(codec_dai, WM8804_TX_CLKSRC_PLL,
++					sysclk, SND_SOC_CLOCK_OUT);
++	if (ret < 0) {
++		dev_err(rtd->card->dev,
++		"Failed to set WM8804 SYSCLK: %d\n", ret);
++		return ret;
++	}
++
++	/* Enable TX output */
++	snd_soc_component_update_bits(digi, WM8804_PWRDN, 0x4, 0x0);
++
++	/* Power on */
++	snd_soc_component_update_bits(digi, WM8804_PWRDN, 0x9, 0);
++
++	/* set sampling frequency status bits */
++	snd_soc_component_update_bits(digi, WM8804_SPDTX4, 0x0f, sampling_freq);
++
++	return snd_soc_dai_set_bclk_ratio(cpu_dai, 64);
++}
++
++static int snd_rpi_justboom_both_startup(struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *digi = asoc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_component *dac = asoc_rtd_to_codec(rtd, 1)->component;
++
++	/* turn on digital output */
++	snd_soc_component_update_bits(digi, WM8804_PWRDN, 0x3c, 0x00);
++
++	snd_soc_component_update_bits(dac, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
++
++	return 0;
++}
++
++static void snd_rpi_justboom_both_shutdown(struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *digi = asoc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_component *dac = asoc_rtd_to_codec(rtd, 1)->component;
++
++	snd_soc_component_update_bits(dac, PCM512x_GPIO_CONTROL_1, 0x08, 0x00);
++
++	/* turn off output */
++	snd_soc_component_update_bits(digi, WM8804_PWRDN, 0x3c, 0x3c);
++}
++
++/* machine stream operations */
++static struct snd_soc_ops snd_rpi_justboom_both_ops = {
++	.hw_params = snd_rpi_justboom_both_hw_params,
++	.startup   = snd_rpi_justboom_both_startup,
++	.shutdown  = snd_rpi_justboom_both_shutdown,
++};
++
++SND_SOC_DAILINK_DEFS(rpi_justboom_both,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm512x.1-004d", "pcm512x-hifi"),
++			   COMP_CODEC("wm8804.1-003b", "wm8804-spdif")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_justboom_both_dai[] = {
++{
++	.name           = "JustBoom Digi",
++	.stream_name    = "JustBoom Digi HiFi",
++	.dai_fmt        = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++					SND_SOC_DAIFMT_CBM_CFM,
++	.ops            = &snd_rpi_justboom_both_ops,
++	.init           = snd_rpi_justboom_both_init,
++	SND_SOC_DAILINK_REG(rpi_justboom_both),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_justboom_both = {
++	.name             = "snd_rpi_justboom_both",
++	.driver_name      = "JustBoomBoth",
++	.owner            = THIS_MODULE,
++	.dai_link         = snd_rpi_justboom_both_dai,
++	.num_links        = ARRAY_SIZE(snd_rpi_justboom_both_dai),
++};
++
++static int snd_rpi_justboom_both_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	struct snd_soc_card *card = &snd_rpi_justboom_both;
++
++	snd_rpi_justboom_both.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai = &snd_rpi_justboom_both_dai[0];
++
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++					    "i2s-controller", 0);
++
++		if (i2s_node) {
++			int i;
++
++			for (i = 0; i < card->num_links; i++) {
++				dai->cpus->dai_name = NULL;
++				dai->cpus->of_node = i2s_node;
++				dai->platforms->name = NULL;
++				dai->platforms->of_node = i2s_node;
++			}
++		}
++
++		digital_gain_0db_limit = !of_property_read_bool(
++			pdev->dev.of_node, "justboom,24db_digital_gain");
++	}
++
++	ret = snd_soc_register_card(card);
++	if (ret && ret != -EPROBE_DEFER) {
++		dev_err(&pdev->dev,
++			"snd_soc_register_card() failed: %d\n", ret);
++	}
++
++	return ret;
++}
++
++static int snd_rpi_justboom_both_remove(struct platform_device *pdev)
++{
++	snd_soc_unregister_card(&snd_rpi_justboom_both);
++	return 0;
++}
++
++static const struct of_device_id snd_rpi_justboom_both_of_match[] = {
++	{ .compatible = "justboom,justboom-both", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, snd_rpi_justboom_both_of_match);
++
++static struct platform_driver snd_rpi_justboom_both_driver = {
++	.driver = {
++		.name   = "snd-rpi-justboom-both",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_rpi_justboom_both_of_match,
++	},
++	.probe          = snd_rpi_justboom_both_probe,
++	.remove         = snd_rpi_justboom_both_remove,
++};
++
++module_platform_driver(snd_rpi_justboom_both_driver);
++
++MODULE_AUTHOR("Johannes Krude <johannes@krude.de>");
++MODULE_DESCRIPTION("ASoC Driver for simultaneous use of JustBoom PI Digi & DAC HAT Sound Cards");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/justboom-dac.c
+@@ -0,0 +1,147 @@
++/*
++ * ASoC Driver for JustBoom DAC Raspberry Pi HAT Sound Card
++ *
++ * Author:	Milan Neskovic
++ *		Copyright 2016
++ *		based on code by Daniel Matuschek <info@crazy-audio.com>
++ *		based on code by Florian Meier <florian.meier@koalo.de>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++#include "../codecs/pcm512x.h"
++
++static bool digital_gain_0db_limit = true;
++
++static int snd_rpi_justboom_dac_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x08, 0x08);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_4, 0xf, 0x02);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08,0x08);
++
++	if (digital_gain_0db_limit)
++	{
++		int ret;
++		struct snd_soc_card *card = rtd->card;
++
++		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
++	}
++
++	return 0;
++}
++
++static int snd_rpi_justboom_dac_startup(struct snd_pcm_substream *substream) {
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08,0x08);
++	return 0;
++}
++
++static void snd_rpi_justboom_dac_shutdown(struct snd_pcm_substream *substream) {
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08,0x00);
++}
++
++/* machine stream operations */
++static struct snd_soc_ops snd_rpi_justboom_dac_ops = {
++	.startup = snd_rpi_justboom_dac_startup,
++	.shutdown = snd_rpi_justboom_dac_shutdown,
++};
++
++SND_SOC_DAILINK_DEFS(hifi,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm512x.1-004d", "pcm512x-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_justboom_dac_dai[] = {
++{
++	.name		= "JustBoom DAC",
++	.stream_name	= "JustBoom DAC HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBS_CFS,
++	.ops		= &snd_rpi_justboom_dac_ops,
++	.init		= snd_rpi_justboom_dac_init,
++	SND_SOC_DAILINK_REG(hifi),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_justboom_dac = {
++	.name         = "snd_rpi_justboom_dac",
++	.driver_name  = "JustBoomDac",
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_rpi_justboom_dac_dai,
++	.num_links    = ARRAY_SIZE(snd_rpi_justboom_dac_dai),
++};
++
++static int snd_rpi_justboom_dac_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++
++	snd_rpi_justboom_dac.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++	    struct device_node *i2s_node;
++	    struct snd_soc_dai_link *dai = &snd_rpi_justboom_dac_dai[0];
++	    i2s_node = of_parse_phandle(pdev->dev.of_node,
++					"i2s-controller", 0);
++
++	    if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++	    }
++
++	    digital_gain_0db_limit = !of_property_read_bool(
++			pdev->dev.of_node, "justboom,24db_digital_gain");
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev, &snd_rpi_justboom_dac);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev,
++			"snd_soc_register_card() failed: %d\n", ret);
++
++	return ret;
++}
++
++static const struct of_device_id snd_rpi_justboom_dac_of_match[] = {
++	{ .compatible = "justboom,justboom-dac", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, snd_rpi_justboom_dac_of_match);
++
++static struct platform_driver snd_rpi_justboom_dac_driver = {
++	.driver = {
++		.name   = "snd-rpi-justboom-dac",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_rpi_justboom_dac_of_match,
++	},
++	.probe          = snd_rpi_justboom_dac_probe,
++};
++
++module_platform_driver(snd_rpi_justboom_dac_driver);
++
++MODULE_AUTHOR("Milan Neskovic <info@justboom.co>");
++MODULE_DESCRIPTION("ASoC Driver for JustBoom PI DAC HAT Sound Card");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/pifi-40.c
+@@ -0,0 +1,284 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * ALSA ASoC Machine Driver for PiFi-40
++ *
++ * Author:	David Knell <david.knell@gmail.com)
++ *		based on code by Daniel Matuschek <info@crazy-audio.com>
++ *		based on code by Florian Meier <florian.meier@koalo.de>
++ * Copyright (C) 2020
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/gpio/consumer.h>
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <linux/firmware.h>
++#include <linux/delay.h>
++#include <sound/tlv.h>
++
++static struct gpio_desc *pdn_gpio;
++static int vol = 0x30;
++
++// Volume control
++static int pifi_40_vol_get(struct snd_kcontrol *kcontrol,
++			   struct snd_ctl_elem_value *ucontrol)
++{
++	ucontrol->value.integer.value[0] = vol;
++	ucontrol->value.integer.value[1] = vol;
++	return 0;
++}
++
++static int pifi_40_vol_set(struct snd_kcontrol *kcontrol,
++			   struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct snd_soc_pcm_runtime *rtd;
++	unsigned int v = ucontrol->value.integer.value[0];
++	struct snd_soc_component *dac[2];
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++	dac[0] = asoc_rtd_to_codec(rtd, 0)->component;
++	dac[1] = asoc_rtd_to_codec(rtd, 1)->component;
++
++	snd_soc_component_write(dac[0], 0x07, 255 - v);
++	snd_soc_component_write(dac[1], 0x07, 255 - v);
++
++	vol = v;
++	return 1;
++}
++
++static const DECLARE_TLV_DB_SCALE(digital_tlv_master, -10350, 50, 1);
++static const struct snd_kcontrol_new pifi_40_controls[] = {
++	SOC_DOUBLE_R_EXT_TLV("Master Volume", 0x00, 0x01,
++			     0x00, // Min
++			     0xff, // Max
++			     0x01, // Invert
++			     pifi_40_vol_get, pifi_40_vol_set,
++			     digital_tlv_master)
++};
++
++static const char * const codec_ctl_pfx[] = { "Left", "Right" };
++
++static const char * const codec_ctl_name[] = { "Master Volume",
++					"Speaker Volume",
++					"Speaker Switch" };
++
++static int snd_pifi_40_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_card *card = rtd->card;
++	struct snd_soc_component *dac[2];
++	struct snd_kcontrol *kctl;
++	int i, j;
++
++	dac[0] = asoc_rtd_to_codec(rtd, 0)->component;
++	dac[1] = asoc_rtd_to_codec(rtd, 1)->component;
++
++
++	// Set up cards - pulse power down first
++	gpiod_set_value_cansleep(pdn_gpio, 1);
++	usleep_range(1000, 10000);
++	gpiod_set_value_cansleep(pdn_gpio, 0);
++	usleep_range(20000, 30000);
++
++	// Oscillator trim
++	snd_soc_component_write(dac[0], 0x1b, 0);
++	snd_soc_component_write(dac[1], 0x1b, 0);
++	usleep_range(60000, 80000);
++
++	// Common setup
++	for (i = 0; i < 2; i++) {
++		// MCLK at 64fs, sample rate 44.1 or 48kHz
++		snd_soc_component_write(dac[i], 0x00, 0x60);
++
++		// Set up for PBTL
++		snd_soc_component_write(dac[i], 0x19, 0x3A);
++		snd_soc_component_write(dac[i], 0x25, 0x01103245);
++
++		// Master vol to -10db
++		snd_soc_component_write(dac[i], 0x07, 0x44);
++	}
++	// Inputs set to L and R respectively
++	snd_soc_component_write(dac[0], 0x20, 0x00017772);
++	snd_soc_component_write(dac[1], 0x20, 0x00107772);
++
++	// Remove codec controls
++	for (i = 0; i < 2; i++) {
++		for (j = 0; j < 3; j++) {
++			char cname[256];
++
++			sprintf(cname, "%s %s", codec_ctl_pfx[i],
++				codec_ctl_name[j]);
++			kctl = snd_soc_card_get_kcontrol(card, cname);
++			if (!kctl) {
++				pr_info("Control %s not found\n",
++				       cname);
++			} else {
++				kctl->vd[0].access =
++					SNDRV_CTL_ELEM_ACCESS_READWRITE;
++				snd_ctl_remove(card->snd_card, kctl);
++			}
++		}
++	}
++
++	return 0;
++}
++
++static int snd_pifi_40_hw_params(struct snd_pcm_substream *substream,
++				 struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *cpu_dai = asoc_rtd_to_cpu(rtd, 0);
++	unsigned int sample_bits;
++
++	sample_bits = snd_pcm_format_physical_width(params_format(params));
++	return snd_soc_dai_set_bclk_ratio(cpu_dai, 64);
++}
++
++static struct snd_soc_ops snd_pifi_40_ops = { .hw_params =
++						      snd_pifi_40_hw_params };
++
++static struct snd_soc_dai_link_component pifi_40_codecs[] = {
++	{
++		.dai_name = "tas571x-hifi",
++	},
++	{
++		.dai_name = "tas571x-hifi",
++	},
++};
++
++SND_SOC_DAILINK_DEFS(
++	pifi_40_dai, DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("tas571x.1-001a", "tas571x-hifi"),
++			   COMP_CODEC("tas571x.1-001b", "tas571x-hifi")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_pifi_40_dai[] = {
++	{
++		.name = "PiFi40",
++		.stream_name = "PiFi40",
++		.dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++			   SND_SOC_DAIFMT_CBS_CFS,
++		.ops = &snd_pifi_40_ops,
++		.init = snd_pifi_40_init,
++		SND_SOC_DAILINK_REG(pifi_40_dai),
++	},
++};
++
++// Machine driver
++static struct snd_soc_card snd_pifi_40 = {
++	.name = "PiFi40",
++	.owner = THIS_MODULE,
++	.dai_link = snd_pifi_40_dai,
++	.num_links = ARRAY_SIZE(snd_pifi_40_dai),
++	.controls = pifi_40_controls,
++	.num_controls = ARRAY_SIZE(pifi_40_controls)
++};
++
++static void snd_pifi_40_pdn(struct snd_soc_card *card, int on)
++{
++	if (pdn_gpio)
++		gpiod_set_value_cansleep(pdn_gpio, on ? 0 : 1);
++}
++
++static int snd_pifi_40_probe(struct platform_device *pdev)
++{
++	struct snd_soc_card *card = &snd_pifi_40;
++	int ret = 0, i = 0;
++
++	card->dev = &pdev->dev;
++	platform_set_drvdata(pdev, &snd_pifi_40);
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai;
++
++		dai = &snd_pifi_40_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node, "i2s-controller",
++					    0);
++		if (i2s_node) {
++			for (i = 0; i < card->num_links; i++) {
++				dai->cpus->dai_name = NULL;
++				dai->cpus->of_node = i2s_node;
++				dai->platforms->name = NULL;
++				dai->platforms->of_node = i2s_node;
++			}
++		}
++
++		pifi_40_codecs[0].of_node =
++			of_parse_phandle(pdev->dev.of_node, "audio-codec", 0);
++		pifi_40_codecs[1].of_node =
++			of_parse_phandle(pdev->dev.of_node, "audio-codec", 1);
++		if (!pifi_40_codecs[0].of_node || !pifi_40_codecs[1].of_node) {
++			dev_err(&pdev->dev,
++				"Property 'audio-codec' missing or invalid\n");
++			return -EINVAL;
++		}
++
++		pdn_gpio = devm_gpiod_get_optional(&pdev->dev, "pdn",
++						   GPIOD_OUT_LOW);
++		if (IS_ERR(pdn_gpio)) {
++			ret = PTR_ERR(pdn_gpio);
++			dev_err(&pdev->dev, "failed to get pdn gpio: %d\n",
++				ret);
++			return ret;
++		}
++
++		ret = snd_soc_register_card(&snd_pifi_40);
++		if (ret < 0) {
++			dev_err(&pdev->dev,
++				"snd_soc_register_card() failed: %d\n", ret);
++			return ret;
++		}
++
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++static int snd_pifi_40_remove(struct platform_device *pdev)
++{
++	struct snd_soc_card *card = platform_get_drvdata(pdev);
++
++	kfree(&card->drvdata);
++	snd_pifi_40_pdn(&snd_pifi_40, 0);
++	snd_soc_unregister_card(&snd_pifi_40);
++	return 0;
++}
++
++static const struct of_device_id snd_pifi_40_of_match[] = {
++	{
++		.compatible = "pifi,pifi-40",
++	},
++	{ /* sentinel */ },
++};
++
++MODULE_DEVICE_TABLE(of, snd_pifi_40_of_match);
++
++static struct platform_driver snd_pifi_40_driver = {
++	.driver = {
++		.name = "snd-pifi-40",
++		.owner = THIS_MODULE,
++		.of_match_table = snd_pifi_40_of_match,
++	},
++	.probe = snd_pifi_40_probe,
++	.remove = snd_pifi_40_remove,
++};
++
++module_platform_driver(snd_pifi_40_driver);
++
++MODULE_AUTHOR("David Knell <david.knell@gmail.com>");
++MODULE_DESCRIPTION("ALSA ASoC Machine Driver for PiFi-40");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/pisound.c
+@@ -0,0 +1,1241 @@
++/*
++ * Pisound Linux kernel module.
++ * Copyright (C) 2016-2020  Vilniaus Blokas UAB, https://blokas.io/pisound
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * as published by the Free Software Foundation; version 2 of the
++ * License.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
++ * MA  02110-1301, USA.
++ */
++
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/gpio.h>
++#include <linux/kobject.h>
++#include <linux/sysfs.h>
++#include <linux/delay.h>
++#include <linux/spi/spi.h>
++#include <linux/interrupt.h>
++#include <linux/kfifo.h>
++#include <linux/jiffies.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++#include <sound/rawmidi.h>
++#include <sound/asequencer.h>
++#include <sound/control.h>
++
++static int pisnd_spi_init(struct device *dev);
++static void pisnd_spi_uninit(void);
++
++static void pisnd_spi_flush(void);
++static void pisnd_spi_start(void);
++static uint8_t pisnd_spi_recv(uint8_t *buffer, uint8_t length);
++
++typedef void (*pisnd_spi_recv_cb)(void *data);
++static void pisnd_spi_set_callback(pisnd_spi_recv_cb cb, void *data);
++
++static const char *pisnd_spi_get_serial(void);
++static const char *pisnd_spi_get_id(void);
++static const char *pisnd_spi_get_fw_version(void);
++static const char *pisnd_spi_get_hw_version(void);
++
++static int pisnd_midi_init(struct snd_card *card);
++static void pisnd_midi_uninit(void);
++
++enum task_e {
++	TASK_PROCESS = 0,
++};
++
++static void pisnd_schedule_process(enum task_e task);
++
++#define PISOUND_LOG_PREFIX "pisound: "
++
++#ifdef PISOUND_DEBUG
++#	define printd(...) pr_alert(PISOUND_LOG_PREFIX __VA_ARGS__)
++#else
++#	define printd(...) do {} while (0)
++#endif
++
++#define printe(...) pr_err(PISOUND_LOG_PREFIX __VA_ARGS__)
++#define printi(...) pr_info(PISOUND_LOG_PREFIX __VA_ARGS__)
++
++static struct snd_rawmidi *g_rmidi;
++static struct snd_rawmidi_substream *g_midi_output_substream;
++
++static int pisnd_output_open(struct snd_rawmidi_substream *substream)
++{
++	g_midi_output_substream = substream;
++	return 0;
++}
++
++static int pisnd_output_close(struct snd_rawmidi_substream *substream)
++{
++	g_midi_output_substream = NULL;
++	return 0;
++}
++
++static void pisnd_output_trigger(
++	struct snd_rawmidi_substream *substream,
++	int up
++	)
++{
++	if (substream != g_midi_output_substream) {
++		printe("MIDI output trigger called for an unexpected stream!");
++		return;
++	}
++
++	if (!up)
++		return;
++
++	pisnd_spi_start();
++}
++
++static void pisnd_output_drain(struct snd_rawmidi_substream *substream)
++{
++	pisnd_spi_flush();
++}
++
++static int pisnd_input_open(struct snd_rawmidi_substream *substream)
++{
++	return 0;
++}
++
++static int pisnd_input_close(struct snd_rawmidi_substream *substream)
++{
++	return 0;
++}
++
++static void pisnd_midi_recv_callback(void *substream)
++{
++	uint8_t data[128];
++	uint8_t n = 0;
++
++	while ((n = pisnd_spi_recv(data, sizeof(data)))) {
++		int res = snd_rawmidi_receive(substream, data, n);
++		(void)res;
++		printd("midi recv %u bytes, res = %d\n", n, res);
++	}
++}
++
++static void pisnd_input_trigger(struct snd_rawmidi_substream *substream, int up)
++{
++	if (up) {
++		pisnd_spi_set_callback(pisnd_midi_recv_callback, substream);
++		pisnd_schedule_process(TASK_PROCESS);
++	} else {
++		pisnd_spi_set_callback(NULL, NULL);
++	}
++}
++
++static struct snd_rawmidi_ops pisnd_output_ops = {
++	.open = pisnd_output_open,
++	.close = pisnd_output_close,
++	.trigger = pisnd_output_trigger,
++	.drain = pisnd_output_drain,
++};
++
++static struct snd_rawmidi_ops pisnd_input_ops = {
++	.open = pisnd_input_open,
++	.close = pisnd_input_close,
++	.trigger = pisnd_input_trigger,
++};
++
++static void pisnd_get_port_info(
++	struct snd_rawmidi *rmidi,
++	int number,
++	struct snd_seq_port_info *seq_port_info
++	)
++{
++	seq_port_info->type =
++		SNDRV_SEQ_PORT_TYPE_MIDI_GENERIC |
++		SNDRV_SEQ_PORT_TYPE_HARDWARE |
++		SNDRV_SEQ_PORT_TYPE_PORT;
++	seq_port_info->midi_voices = 0;
++}
++
++static struct snd_rawmidi_global_ops pisnd_global_ops = {
++	.get_port_info = pisnd_get_port_info,
++};
++
++static int pisnd_midi_init(struct snd_card *card)
++{
++	int err;
++
++	g_midi_output_substream = NULL;
++
++	err = snd_rawmidi_new(card, "pisound MIDI", 0, 1, 1, &g_rmidi);
++
++	if (err < 0) {
++		printe("snd_rawmidi_new failed: %d\n", err);
++		return err;
++	}
++
++	strcpy(g_rmidi->name, "pisound MIDI ");
++	strcat(g_rmidi->name, pisnd_spi_get_serial());
++
++	g_rmidi->info_flags =
++		SNDRV_RAWMIDI_INFO_OUTPUT |
++		SNDRV_RAWMIDI_INFO_INPUT |
++		SNDRV_RAWMIDI_INFO_DUPLEX;
++
++	g_rmidi->ops = &pisnd_global_ops;
++
++	g_rmidi->private_data = (void *)0;
++
++	snd_rawmidi_set_ops(
++		g_rmidi,
++		SNDRV_RAWMIDI_STREAM_OUTPUT,
++		&pisnd_output_ops
++		);
++
++	snd_rawmidi_set_ops(
++		g_rmidi,
++		SNDRV_RAWMIDI_STREAM_INPUT,
++		&pisnd_input_ops
++		);
++
++	return 0;
++}
++
++static void pisnd_midi_uninit(void)
++{
++}
++
++static void *g_recvData;
++static pisnd_spi_recv_cb g_recvCallback;
++
++#define FIFO_SIZE 4096
++
++static char g_serial_num[11];
++static char g_id[25];
++enum { MAX_VERSION_STR_LEN = 6 };
++static char g_fw_version[MAX_VERSION_STR_LEN];
++static char g_hw_version[MAX_VERSION_STR_LEN];
++
++static uint8_t g_ledFlashDuration;
++static bool    g_ledFlashDurationChanged;
++
++DEFINE_KFIFO(spi_fifo_in,  uint8_t, FIFO_SIZE);
++DEFINE_KFIFO(spi_fifo_out, uint8_t, FIFO_SIZE);
++
++static struct gpio_desc *data_available;
++static struct gpio_desc *spi_reset;
++
++static struct spi_device *pisnd_spi_device;
++
++static struct workqueue_struct *pisnd_workqueue;
++static struct work_struct pisnd_work_process;
++
++static void pisnd_work_handler(struct work_struct *work);
++
++static void spi_transfer(const uint8_t *txbuf, uint8_t *rxbuf, int len);
++static uint16_t spi_transfer16(uint16_t val);
++
++static int pisnd_init_workqueues(void)
++{
++	pisnd_workqueue = create_singlethread_workqueue("pisnd_workqueue");
++	INIT_WORK(&pisnd_work_process, pisnd_work_handler);
++
++	return 0;
++}
++
++static void pisnd_uninit_workqueues(void)
++{
++	flush_workqueue(pisnd_workqueue);
++	destroy_workqueue(pisnd_workqueue);
++
++	pisnd_workqueue = NULL;
++}
++
++static bool pisnd_spi_has_more(void)
++{
++	return gpiod_get_value(data_available);
++}
++
++static void pisnd_schedule_process(enum task_e task)
++{
++	if (pisnd_spi_device != NULL &&
++		pisnd_workqueue != NULL &&
++		!work_pending(&pisnd_work_process)
++		) {
++		printd("schedule: has more = %d\n", pisnd_spi_has_more());
++		if (task == TASK_PROCESS)
++			queue_work(pisnd_workqueue, &pisnd_work_process);
++	}
++}
++
++static irqreturn_t data_available_interrupt_handler(int irq, void *dev_id)
++{
++	if (irq == gpiod_to_irq(data_available) && pisnd_spi_has_more()) {
++		printd("schedule from irq\n");
++		pisnd_schedule_process(TASK_PROCESS);
++	}
++
++	return IRQ_HANDLED;
++}
++
++static uint16_t spi_transfer16(uint16_t val)
++{
++	uint8_t txbuf[2];
++	uint8_t rxbuf[2];
++
++	if (!pisnd_spi_device) {
++		printe("pisnd_spi_device null, returning\n");
++		return 0;
++	}
++
++	txbuf[0] = val >> 8;
++	txbuf[1] = val & 0xff;
++
++	spi_transfer(txbuf, rxbuf, sizeof(txbuf));
++
++	printd("received: %02x%02x\n", rxbuf[0], rxbuf[1]);
++
++	return (rxbuf[0] << 8) | rxbuf[1];
++}
++
++static void spi_transfer(const uint8_t *txbuf, uint8_t *rxbuf, int len)
++{
++	int err;
++	struct spi_transfer transfer;
++	struct spi_message msg;
++
++	memset(rxbuf, 0, len);
++
++	if (!pisnd_spi_device) {
++		printe("pisnd_spi_device null, returning\n");
++		return;
++	}
++
++	spi_message_init(&msg);
++
++	memset(&transfer, 0, sizeof(transfer));
++
++	transfer.tx_buf = txbuf;
++	transfer.rx_buf = rxbuf;
++	transfer.len = len;
++	transfer.speed_hz = 150000;
++	transfer.delay.value = 10;
++	transfer.delay.unit = SPI_DELAY_UNIT_USECS;
++
++	spi_message_add_tail(&transfer, &msg);
++
++	err = spi_sync(pisnd_spi_device, &msg);
++
++	if (err < 0) {
++		printe("spi_sync error %d\n", err);
++		return;
++	}
++
++	printd("hasMore %d\n", pisnd_spi_has_more());
++}
++
++static int spi_read_bytes(char *dst, size_t length, uint8_t *bytesRead)
++{
++	uint16_t rx;
++	uint8_t size;
++	uint8_t i;
++
++	memset(dst, 0, length);
++	*bytesRead = 0;
++
++	rx = spi_transfer16(0);
++	if (!(rx >> 8))
++		return -EINVAL;
++
++	size = rx & 0xff;
++
++	if (size > length)
++		return -EINVAL;
++
++	for (i = 0; i < size; ++i) {
++		rx = spi_transfer16(0);
++		if (!(rx >> 8))
++			return -EINVAL;
++
++		dst[i] = rx & 0xff;
++	}
++
++	*bytesRead = i;
++
++	return 0;
++}
++
++static int spi_device_match(struct device *dev, const void *data)
++{
++	struct spi_device *spi = container_of(dev, struct spi_device, dev);
++
++	printd("      %s %s %dkHz %d bits mode=0x%02X\n",
++		spi->modalias, dev_name(dev), spi->max_speed_hz/1000,
++		spi->bits_per_word, spi->mode);
++
++	if (strcmp("pisound-spi", spi->modalias) == 0) {
++		printi("\tFound!\n");
++		return 1;
++	}
++
++	printe("\tNot found!\n");
++	return 0;
++}
++
++static struct spi_device *pisnd_spi_find_device(void)
++{
++	struct device *dev;
++
++	printi("Searching for spi device...\n");
++	dev = bus_find_device(&spi_bus_type, NULL, NULL, spi_device_match);
++	if (dev != NULL)
++		return container_of(dev, struct spi_device, dev);
++	else
++		return NULL;
++}
++
++static void pisnd_work_handler(struct work_struct *work)
++{
++	enum { TRANSFER_SIZE = 4 };
++	enum { PISOUND_OUTPUT_BUFFER_SIZE_MILLIBYTES = 127 * 1000 };
++	enum { MIDI_MILLIBYTES_PER_JIFFIE = (3125 * 1000) / HZ };
++	int out_buffer_used_millibytes = 0;
++	unsigned long now;
++	uint8_t val;
++	uint8_t txbuf[TRANSFER_SIZE];
++	uint8_t rxbuf[TRANSFER_SIZE];
++	uint8_t midibuf[TRANSFER_SIZE];
++	int i, n;
++	bool had_data;
++
++	unsigned long last_transfer_at = jiffies;
++
++	if (work == &pisnd_work_process) {
++		if (pisnd_spi_device == NULL)
++			return;
++
++		do {
++			if (g_midi_output_substream &&
++				kfifo_avail(&spi_fifo_out) >= sizeof(midibuf)) {
++
++				n = snd_rawmidi_transmit_peek(
++					g_midi_output_substream,
++					midibuf, sizeof(midibuf)
++				);
++
++				if (n > 0) {
++					for (i = 0; i < n; ++i)
++						kfifo_put(
++							&spi_fifo_out,
++							midibuf[i]
++							);
++					snd_rawmidi_transmit_ack(
++						g_midi_output_substream,
++						i
++						);
++				}
++			}
++
++			had_data = false;
++			memset(txbuf, 0, sizeof(txbuf));
++			for (i = 0; i < sizeof(txbuf) &&
++				((out_buffer_used_millibytes+1000 <
++				PISOUND_OUTPUT_BUFFER_SIZE_MILLIBYTES) ||
++				g_ledFlashDurationChanged);
++				i += 2) {
++
++				val = 0;
++
++				if (g_ledFlashDurationChanged) {
++					txbuf[i+0] = 0xf0;
++					txbuf[i+1] = g_ledFlashDuration;
++					g_ledFlashDuration = 0;
++					g_ledFlashDurationChanged = false;
++				} else if (kfifo_get(&spi_fifo_out, &val)) {
++					txbuf[i+0] = 0x0f;
++					txbuf[i+1] = val;
++					out_buffer_used_millibytes += 1000;
++				}
++			}
++
++			spi_transfer(txbuf, rxbuf, sizeof(txbuf));
++			/* Estimate the Pisound's MIDI output buffer usage, so
++			 * that we don't overflow it. Space in the buffer should
++			 * be becoming available at the UART MIDI byte transfer
++			 * rate.
++			 */
++			now = jiffies;
++			if (now != last_transfer_at) {
++				out_buffer_used_millibytes -=
++					(now - last_transfer_at) *
++					MIDI_MILLIBYTES_PER_JIFFIE;
++				if (out_buffer_used_millibytes < 0)
++					out_buffer_used_millibytes = 0;
++				last_transfer_at = now;
++			}
++
++			for (i = 0; i < sizeof(rxbuf); i += 2) {
++				if (rxbuf[i]) {
++					kfifo_put(&spi_fifo_in, rxbuf[i+1]);
++					if (kfifo_len(&spi_fifo_in) > 16 &&
++						g_recvCallback)
++						g_recvCallback(g_recvData);
++					had_data = true;
++				}
++			}
++		} while (had_data
++			|| !kfifo_is_empty(&spi_fifo_out)
++			|| pisnd_spi_has_more()
++			|| g_ledFlashDurationChanged
++			|| out_buffer_used_millibytes != 0
++			);
++
++		if (!kfifo_is_empty(&spi_fifo_in) && g_recvCallback)
++			g_recvCallback(g_recvData);
++	}
++}
++
++static int pisnd_spi_gpio_init(struct device *dev)
++{
++	spi_reset = gpiod_get_index(dev, "reset", 1, GPIOD_ASIS);
++	data_available = gpiod_get_index(dev, "data_available", 0, GPIOD_ASIS);
++
++	gpiod_direction_output(spi_reset, 1);
++	gpiod_direction_input(data_available);
++
++	/* Reset the slave. */
++	gpiod_set_value(spi_reset, false);
++	mdelay(1);
++	gpiod_set_value(spi_reset, true);
++
++	/* Give time for spi slave to start. */
++	mdelay(64);
++
++	return 0;
++}
++
++static void pisnd_spi_gpio_uninit(void)
++{
++	gpiod_set_value(spi_reset, false);
++	gpiod_put(spi_reset);
++	spi_reset = NULL;
++
++	gpiod_put(data_available);
++	data_available = NULL;
++}
++
++static int pisnd_spi_gpio_irq_init(struct device *dev)
++{
++	return request_threaded_irq(
++		gpiod_to_irq(data_available), NULL,
++		data_available_interrupt_handler,
++		IRQF_TIMER | IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++		"data_available_int",
++		NULL
++		);
++}
++
++static void pisnd_spi_gpio_irq_uninit(void)
++{
++	free_irq(gpiod_to_irq(data_available), NULL);
++}
++
++static int spi_read_info(void)
++{
++	uint16_t tmp;
++	uint8_t count;
++	uint8_t n;
++	uint8_t i;
++	uint8_t j;
++	char buffer[257];
++	int ret;
++	char *p;
++
++	memset(g_serial_num, 0, sizeof(g_serial_num));
++	memset(g_fw_version, 0, sizeof(g_fw_version));
++	strcpy(g_hw_version, "1.0"); // Assume 1.0 hw version.
++	memset(g_id, 0, sizeof(g_id));
++
++	tmp = spi_transfer16(0);
++
++	if (!(tmp >> 8))
++		return -EINVAL;
++
++	count = tmp & 0xff;
++
++	for (i = 0; i < count; ++i) {
++		memset(buffer, 0, sizeof(buffer));
++		ret = spi_read_bytes(buffer, sizeof(buffer)-1, &n);
++
++		if (ret < 0)
++			return ret;
++
++		switch (i) {
++		case 0:
++			if (n != 2)
++				return -EINVAL;
++
++			snprintf(
++				g_fw_version,
++				MAX_VERSION_STR_LEN,
++				"%x.%02x",
++				buffer[0],
++				buffer[1]
++				);
++
++			g_fw_version[MAX_VERSION_STR_LEN-1] = '\0';
++			break;
++		case 3:
++			if (n != 2)
++				return -EINVAL;
++
++			snprintf(
++				g_hw_version,
++				MAX_VERSION_STR_LEN,
++				"%x.%x",
++				buffer[0],
++				buffer[1]
++			);
++
++			g_hw_version[MAX_VERSION_STR_LEN-1] = '\0';
++			break;
++		case 1:
++			if (n >= sizeof(g_serial_num))
++				return -EINVAL;
++
++			memcpy(g_serial_num, buffer, sizeof(g_serial_num));
++			break;
++		case 2:
++			{
++				if (n*2 >= sizeof(g_id))
++					return -EINVAL;
++
++				p = g_id;
++				for (j = 0; j < n; ++j)
++					p += sprintf(p, "%02x", buffer[j]);
++
++				*p = '\0';
++			}
++			break;
++		default:
++			break;
++		}
++	}
++
++	return 0;
++}
++
++static int pisnd_spi_init(struct device *dev)
++{
++	int ret;
++	struct spi_device *spi;
++
++	memset(g_serial_num, 0, sizeof(g_serial_num));
++	memset(g_id, 0, sizeof(g_id));
++	memset(g_fw_version, 0, sizeof(g_fw_version));
++	memset(g_hw_version, 0, sizeof(g_hw_version));
++
++	spi = pisnd_spi_find_device();
++
++	if (spi != NULL) {
++		printd("initializing spi!\n");
++		pisnd_spi_device = spi;
++		ret = spi_setup(pisnd_spi_device);
++	} else {
++		printe("SPI device not found, deferring!\n");
++		return -EPROBE_DEFER;
++	}
++
++	ret = pisnd_spi_gpio_init(dev);
++
++	if (ret < 0) {
++		printe("SPI GPIO init failed: %d\n", ret);
++		spi_dev_put(pisnd_spi_device);
++		pisnd_spi_device = NULL;
++		pisnd_spi_gpio_uninit();
++		return ret;
++	}
++
++	ret = spi_read_info();
++
++	if (ret < 0) {
++		printe("Reading card info failed: %d\n", ret);
++		spi_dev_put(pisnd_spi_device);
++		pisnd_spi_device = NULL;
++		pisnd_spi_gpio_uninit();
++		return ret;
++	}
++
++	/* Flash the LEDs. */
++	spi_transfer16(0xf008);
++
++	ret = pisnd_spi_gpio_irq_init(dev);
++	if (ret < 0) {
++		printe("SPI irq request failed: %d\n", ret);
++		spi_dev_put(pisnd_spi_device);
++		pisnd_spi_device = NULL;
++		pisnd_spi_gpio_irq_uninit();
++		pisnd_spi_gpio_uninit();
++	}
++
++	ret = pisnd_init_workqueues();
++	if (ret != 0) {
++		printe("Workqueue initialization failed: %d\n", ret);
++		spi_dev_put(pisnd_spi_device);
++		pisnd_spi_device = NULL;
++		pisnd_spi_gpio_irq_uninit();
++		pisnd_spi_gpio_uninit();
++		pisnd_uninit_workqueues();
++		return ret;
++	}
++
++	if (pisnd_spi_has_more()) {
++		printd("data is available, scheduling from init\n");
++		pisnd_schedule_process(TASK_PROCESS);
++	}
++
++	return 0;
++}
++
++static void pisnd_spi_uninit(void)
++{
++	pisnd_uninit_workqueues();
++
++	spi_dev_put(pisnd_spi_device);
++	pisnd_spi_device = NULL;
++
++	pisnd_spi_gpio_irq_uninit();
++	pisnd_spi_gpio_uninit();
++}
++
++static void pisnd_spi_flash_leds(uint8_t duration)
++{
++	g_ledFlashDuration = duration;
++	g_ledFlashDurationChanged = true;
++	printd("schedule from spi_flash_leds\n");
++	pisnd_schedule_process(TASK_PROCESS);
++}
++
++static void pisnd_spi_flush(void)
++{
++	while (!kfifo_is_empty(&spi_fifo_out)) {
++		pisnd_spi_start();
++		flush_workqueue(pisnd_workqueue);
++	}
++}
++
++static void pisnd_spi_start(void)
++{
++	printd("schedule from spi_start\n");
++	pisnd_schedule_process(TASK_PROCESS);
++}
++
++static uint8_t pisnd_spi_recv(uint8_t *buffer, uint8_t length)
++{
++	return kfifo_out(&spi_fifo_in, buffer, length);
++}
++
++static void pisnd_spi_set_callback(pisnd_spi_recv_cb cb, void *data)
++{
++	g_recvData = data;
++	g_recvCallback = cb;
++}
++
++static const char *pisnd_spi_get_serial(void)
++{
++	return g_serial_num;
++}
++
++static const char *pisnd_spi_get_id(void)
++{
++	return g_id;
++}
++
++static const char *pisnd_spi_get_fw_version(void)
++{
++	return g_fw_version;
++}
++
++static const char *pisnd_spi_get_hw_version(void)
++{
++	return g_hw_version;
++}
++
++static const struct of_device_id pisound_of_match[] = {
++	{ .compatible = "blokaslabs,pisound", },
++	{ .compatible = "blokaslabs,pisound-spi", },
++	{},
++};
++
++enum {
++	SWITCH = 0,
++	VOLUME = 1,
++};
++
++static int pisnd_ctl_info(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_info *uinfo)
++{
++	if (kcontrol->private_value == SWITCH) {
++		uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
++		uinfo->count = 1;
++		uinfo->value.integer.min = 0;
++		uinfo->value.integer.max = 1;
++		return 0;
++	} else if (kcontrol->private_value == VOLUME) {
++		uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
++		uinfo->count = 1;
++		uinfo->value.integer.min = 0;
++		uinfo->value.integer.max = 100;
++		return 0;
++	}
++	return -EINVAL;
++}
++
++static int pisnd_ctl_get(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	if (kcontrol->private_value == SWITCH) {
++		ucontrol->value.integer.value[0] = 1;
++		return 0;
++	} else if (kcontrol->private_value == VOLUME) {
++		ucontrol->value.integer.value[0] = 100;
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++static struct snd_kcontrol_new pisnd_ctl[] = {
++	{
++		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
++		.name = "PCM Playback Switch",
++		.index = 0,
++		.private_value = SWITCH,
++		.access = SNDRV_CTL_ELEM_ACCESS_READ,
++		.info = pisnd_ctl_info,
++		.get = pisnd_ctl_get,
++	},
++	{
++		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
++		.name = "PCM Playback Volume",
++		.index = 0,
++		.private_value = VOLUME,
++		.access = SNDRV_CTL_ELEM_ACCESS_READ,
++		.info = pisnd_ctl_info,
++		.get = pisnd_ctl_get,
++	},
++};
++
++static int pisnd_ctl_init(struct snd_card *card)
++{
++	int err, i;
++
++	for (i = 0; i < ARRAY_SIZE(pisnd_ctl); ++i) {
++		err = snd_ctl_add(card, snd_ctl_new1(&pisnd_ctl[i], NULL));
++		if (err < 0)
++			return err;
++	}
++
++	return 0;
++}
++
++static int pisnd_ctl_uninit(void)
++{
++	return 0;
++}
++
++static struct gpio_desc *osr0, *osr1, *osr2;
++static struct gpio_desc *reset;
++static struct gpio_desc *button;
++
++static int pisnd_hw_params(
++	struct snd_pcm_substream *substream,
++	struct snd_pcm_hw_params *params
++	)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *cpu_dai = asoc_rtd_to_cpu(rtd, 0);
++
++	/* Pisound runs on fixed 32 clock counts per channel,
++	 * as generated by the master ADC.
++	 */
++	snd_soc_dai_set_bclk_ratio(cpu_dai, 32*2);
++
++	printd("rate   = %d\n", params_rate(params));
++	printd("ch     = %d\n", params_channels(params));
++	printd("bits   = %u\n",
++		snd_pcm_format_physical_width(params_format(params)));
++	printd("format = %d\n", params_format(params));
++
++	gpiod_set_value(reset, false);
++
++	switch (params_rate(params)) {
++	case 48000:
++		gpiod_set_value(osr0, true);
++		gpiod_set_value(osr1, false);
++		gpiod_set_value(osr2, false);
++		break;
++	case 96000:
++		gpiod_set_value(osr0, true);
++		gpiod_set_value(osr1, false);
++		gpiod_set_value(osr2, true);
++		break;
++	case 192000:
++		gpiod_set_value(osr0, true);
++		gpiod_set_value(osr1, true);
++		gpiod_set_value(osr2, true);
++		break;
++	default:
++		printe("Unsupported rate %u!\n", params_rate(params));
++		return -EINVAL;
++	}
++
++	gpiod_set_value(reset, true);
++
++	return 0;
++}
++
++static unsigned int rates[3] = {
++	48000, 96000, 192000
++};
++
++static struct snd_pcm_hw_constraint_list constraints_rates = {
++	.count = ARRAY_SIZE(rates),
++	.list = rates,
++	.mask = 0,
++};
++
++static int pisnd_startup(struct snd_pcm_substream *substream)
++{
++	int err = snd_pcm_hw_constraint_list(
++		substream->runtime,
++		0,
++		SNDRV_PCM_HW_PARAM_RATE,
++		&constraints_rates
++		);
++
++	if (err < 0)
++		return err;
++
++	err = snd_pcm_hw_constraint_single(
++		substream->runtime,
++		SNDRV_PCM_HW_PARAM_CHANNELS,
++		2
++		);
++
++	if (err < 0)
++		return err;
++
++	err = snd_pcm_hw_constraint_mask64(
++		substream->runtime,
++		SNDRV_PCM_HW_PARAM_FORMAT,
++		SNDRV_PCM_FMTBIT_S16_LE |
++		SNDRV_PCM_FMTBIT_S24_LE |
++		SNDRV_PCM_FMTBIT_S32_LE
++		);
++
++	if (err < 0)
++		return err;
++
++	return 0;
++}
++
++static struct snd_soc_ops pisnd_ops = {
++	.startup = pisnd_startup,
++	.hw_params = pisnd_hw_params,
++};
++
++SND_SOC_DAILINK_DEFS(pisnd,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_DUMMY()),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link pisnd_dai[] = {
++	{
++		.name           = "pisound",
++		.stream_name    = "pisound",
++		.dai_fmt        =
++			SND_SOC_DAIFMT_I2S |
++			SND_SOC_DAIFMT_NB_NF |
++			SND_SOC_DAIFMT_CBM_CFM,
++		.ops            = &pisnd_ops,
++		SND_SOC_DAILINK_REG(pisnd),
++	},
++};
++
++static int pisnd_card_probe(struct snd_soc_card *card)
++{
++	int err = pisnd_midi_init(card->snd_card);
++
++	if (err < 0) {
++		printe("pisnd_midi_init failed: %d\n", err);
++		return err;
++	}
++
++	err = pisnd_ctl_init(card->snd_card);
++	if (err < 0) {
++		printe("pisnd_ctl_init failed: %d\n", err);
++		return err;
++	}
++
++	return 0;
++}
++
++static int pisnd_card_remove(struct snd_soc_card *card)
++{
++	pisnd_ctl_uninit();
++	pisnd_midi_uninit();
++	return 0;
++}
++
++static struct snd_soc_card pisnd_card = {
++	.name         = "pisound",
++	.owner        = THIS_MODULE,
++	.dai_link     = pisnd_dai,
++	.num_links    = ARRAY_SIZE(pisnd_dai),
++	.probe        = pisnd_card_probe,
++	.remove       = pisnd_card_remove,
++};
++
++static int pisnd_init_gpio(struct device *dev)
++{
++	osr0 = gpiod_get_index(dev, "osr", 0, GPIOD_ASIS);
++	osr1 = gpiod_get_index(dev, "osr", 1, GPIOD_ASIS);
++	osr2 = gpiod_get_index(dev, "osr", 2, GPIOD_ASIS);
++
++	reset = gpiod_get_index(dev, "reset", 0, GPIOD_ASIS);
++
++	button = gpiod_get_index(dev, "button", 0, GPIOD_ASIS);
++
++	gpiod_direction_output(osr0,  1);
++	gpiod_direction_output(osr1,  1);
++	gpiod_direction_output(osr2,  1);
++	gpiod_direction_output(reset, 1);
++
++	gpiod_set_value(reset, false);
++	gpiod_set_value(osr0,   true);
++	gpiod_set_value(osr1,  false);
++	gpiod_set_value(osr2,  false);
++	gpiod_set_value(reset,  true);
++
++	gpiod_export(button, false);
++
++	return 0;
++}
++
++static int pisnd_uninit_gpio(void)
++{
++	int i;
++
++	struct gpio_desc **gpios[] = {
++		&osr0, &osr1, &osr2, &reset, &button,
++	};
++
++	gpiod_unexport(button);
++
++	for (i = 0; i < ARRAY_SIZE(gpios); ++i) {
++		if (*gpios[i] == NULL) {
++			printd("weird, GPIO[%d] is NULL already\n", i);
++			continue;
++		}
++
++		gpiod_put(*gpios[i]);
++		*gpios[i] = NULL;
++	}
++
++	return 0;
++}
++
++static struct kobject *pisnd_kobj;
++
++static ssize_t pisnd_serial_show(
++	struct kobject *kobj,
++	struct kobj_attribute *attr,
++	char *buf
++	)
++{
++	return sprintf(buf, "%s\n", pisnd_spi_get_serial());
++}
++
++static ssize_t pisnd_id_show(
++	struct kobject *kobj,
++	struct kobj_attribute *attr,
++	char *buf
++	)
++{
++	return sprintf(buf, "%s\n", pisnd_spi_get_id());
++}
++
++static ssize_t pisnd_fw_version_show(
++	struct kobject *kobj,
++	struct kobj_attribute *attr,
++	char *buf
++	)
++{
++	return sprintf(buf, "%s\n", pisnd_spi_get_fw_version());
++}
++
++static ssize_t pisnd_hw_version_show(
++	struct kobject *kobj,
++	struct kobj_attribute *attr,
++	char *buf
++)
++{
++	return sprintf(buf, "%s\n", pisnd_spi_get_hw_version());
++}
++
++static ssize_t pisnd_led_store(
++	struct kobject *kobj,
++	struct kobj_attribute *attr,
++	const char *buf,
++	size_t length
++	)
++{
++	uint32_t timeout;
++	int err;
++
++	err = kstrtou32(buf, 10, &timeout);
++
++	if (err == 0 && timeout <= 255)
++		pisnd_spi_flash_leds(timeout);
++
++	return length;
++}
++
++static struct kobj_attribute pisnd_serial_attribute =
++	__ATTR(serial, 0444, pisnd_serial_show, NULL);
++static struct kobj_attribute pisnd_id_attribute =
++	__ATTR(id, 0444, pisnd_id_show, NULL);
++static struct kobj_attribute pisnd_fw_version_attribute =
++	__ATTR(version, 0444, pisnd_fw_version_show, NULL);
++static struct kobj_attribute pisnd_hw_version_attribute =
++__ATTR(hw_version, 0444, pisnd_hw_version_show, NULL);
++static struct kobj_attribute pisnd_led_attribute =
++	__ATTR(led, 0644, NULL, pisnd_led_store);
++
++static struct attribute *attrs[] = {
++	&pisnd_serial_attribute.attr,
++	&pisnd_id_attribute.attr,
++	&pisnd_fw_version_attribute.attr,
++	&pisnd_hw_version_attribute.attr,
++	&pisnd_led_attribute.attr,
++	NULL
++};
++
++static struct attribute_group attr_group = { .attrs = attrs };
++
++static int pisnd_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	int i;
++
++	ret = pisnd_spi_init(&pdev->dev);
++	if (ret < 0) {
++		printe("pisnd_spi_init failed: %d\n", ret);
++		return ret;
++	}
++
++	printi("Detected Pisound card:\n");
++	printi("\tSerial:           %s\n", pisnd_spi_get_serial());
++	printi("\tFirmware Version: %s\n", pisnd_spi_get_fw_version());
++	printi("\tHardware Version: %s\n", pisnd_spi_get_hw_version());
++	printi("\tId:               %s\n", pisnd_spi_get_id());
++
++	pisnd_kobj = kobject_create_and_add("pisound", kernel_kobj);
++	if (!pisnd_kobj) {
++		pisnd_spi_uninit();
++		return -ENOMEM;
++	}
++
++	ret = sysfs_create_group(pisnd_kobj, &attr_group);
++	if (ret < 0) {
++		pisnd_spi_uninit();
++		kobject_put(pisnd_kobj);
++		return -ENOMEM;
++	}
++
++	pisnd_init_gpio(&pdev->dev);
++	pisnd_card.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++
++		i2s_node = of_parse_phandle(
++			pdev->dev.of_node,
++			"i2s-controller",
++			0
++			);
++
++		for (i = 0; i < pisnd_card.num_links; ++i) {
++			struct snd_soc_dai_link *dai = &pisnd_dai[i];
++
++			if (i2s_node) {
++				dai->cpus->dai_name = NULL;
++				dai->cpus->of_node = i2s_node;
++				dai->platforms->name = NULL;
++				dai->platforms->of_node = i2s_node;
++				dai->stream_name = pisnd_spi_get_serial();
++			}
++		}
++	}
++
++	ret = snd_soc_register_card(&pisnd_card);
++
++	if (ret < 0) {
++		if (ret != -EPROBE_DEFER)
++			printe("snd_soc_register_card() failed: %d\n", ret);
++		pisnd_uninit_gpio();
++		kobject_put(pisnd_kobj);
++		pisnd_spi_uninit();
++	}
++
++	return ret;
++}
++
++static int pisnd_remove(struct platform_device *pdev)
++{
++	printi("Unloading.\n");
++
++	if (pisnd_kobj) {
++		kobject_put(pisnd_kobj);
++		pisnd_kobj = NULL;
++	}
++
++	pisnd_spi_uninit();
++
++	/* Turn off */
++	gpiod_set_value(reset, false);
++	pisnd_uninit_gpio();
++
++	snd_soc_unregister_card(&pisnd_card);
++	return 0;
++}
++
++MODULE_DEVICE_TABLE(of, pisound_of_match);
++
++static struct platform_driver pisnd_driver = {
++	.driver = {
++		.name           = "snd-rpi-pisound",
++		.owner          = THIS_MODULE,
++		.of_match_table = pisound_of_match,
++	},
++	.probe              = pisnd_probe,
++	.remove             = pisnd_remove,
++};
++
++module_platform_driver(pisnd_driver);
++
++MODULE_AUTHOR("Giedrius Trainavicius <giedrius@blokas.io>");
++MODULE_DESCRIPTION("ASoC Driver for Pisound, https://blokas.io/pisound");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/rpi-cirrus.c
+@@ -0,0 +1,1025 @@
++/*
++ * ASoC machine driver for Cirrus Logic Audio Card
++ * (with WM5102 and WM8804 codecs)
++ *
++ * Copyright 2015-2017 Matthias Reichl <hias@horus.com>
++ *
++ * Based on rpi-cirrus-sound-pi driver (c) Wolfson / Cirrus Logic Inc.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/module.h>
++#include <linux/mutex.h>
++#include <linux/slab.h>
++#include <linux/list.h>
++#include <linux/delay.h>
++#include <sound/pcm_params.h>
++
++#include <linux/mfd/arizona/registers.h>
++
++#include "../codecs/wm5102.h"
++#include "../codecs/wm8804.h"
++
++#define WM8804_CLKOUT_HZ 12000000
++
++#define RPI_CIRRUS_DEFAULT_RATE 44100
++#define WM5102_MAX_SYSCLK_1 49152000 /* max sysclk for 4K family */
++#define WM5102_MAX_SYSCLK_2 45158400 /* max sysclk for 11.025K family */
++
++static inline unsigned int calc_sysclk(unsigned int rate)
++{
++	return (rate % 4000) ? WM5102_MAX_SYSCLK_2 : WM5102_MAX_SYSCLK_1;
++}
++
++enum {
++	DAI_WM5102 = 0,
++	DAI_WM8804,
++};
++
++struct rpi_cirrus_priv {
++	/* mutex for synchronzing FLL1 access with DAPM */
++	struct mutex lock;
++	unsigned int card_rate;
++	int sync_path_enable;
++	int fll1_freq; /* negative means RefClock in spdif rx case */
++
++	/* track hw params/free for substreams */
++	unsigned int params_set;
++	unsigned int min_rate_idx, max_rate_idx;
++	unsigned char iec958_status[4];
++};
++
++/* helper functions */
++static inline struct snd_soc_pcm_runtime *get_wm5102_runtime(
++	struct snd_soc_card *card) {
++	return snd_soc_get_pcm_runtime(card, &card->dai_link[DAI_WM5102]);
++}
++
++static inline struct snd_soc_pcm_runtime *get_wm8804_runtime(
++	struct snd_soc_card *card) {
++	return snd_soc_get_pcm_runtime(card, &card->dai_link[DAI_WM8804]);
++}
++
++
++struct rate_info {
++	unsigned int value;
++	char *text;
++};
++
++static struct rate_info min_rates[] = {
++	{     0, "off"},
++	{ 32000, "32kHz"},
++	{ 44100, "44.1kHz"}
++};
++
++#define NUM_MIN_RATES ARRAY_SIZE(min_rates)
++
++static int rpi_cirrus_min_rate_info(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_info *uinfo)
++{
++	uinfo->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
++	uinfo->count = 1;
++	uinfo->value.enumerated.items = NUM_MIN_RATES;
++
++	if (uinfo->value.enumerated.item >= NUM_MIN_RATES)
++		uinfo->value.enumerated.item = NUM_MIN_RATES - 1;
++	strcpy(uinfo->value.enumerated.name,
++		min_rates[uinfo->value.enumerated.item].text);
++	return 0;
++}
++
++static int rpi_cirrus_min_rate_get(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++
++	ucontrol->value.enumerated.item[0] = priv->min_rate_idx;
++	return 0;
++}
++
++static int rpi_cirrus_min_rate_put(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	int changed = 0;
++
++	if (priv->min_rate_idx != ucontrol->value.enumerated.item[0]) {
++		changed = 1;
++		priv->min_rate_idx = ucontrol->value.enumerated.item[0];
++	}
++
++	return changed;
++}
++
++static struct rate_info max_rates[] = {
++	{     0, "off"},
++	{ 48000, "48kHz"},
++	{ 96000, "96kHz"}
++};
++
++#define NUM_MAX_RATES ARRAY_SIZE(max_rates)
++
++static int rpi_cirrus_max_rate_info(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_info *uinfo)
++{
++	uinfo->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
++	uinfo->count = 1;
++	uinfo->value.enumerated.items = NUM_MAX_RATES;
++	if (uinfo->value.enumerated.item >= NUM_MAX_RATES)
++		uinfo->value.enumerated.item = NUM_MAX_RATES - 1;
++	strcpy(uinfo->value.enumerated.name,
++		max_rates[uinfo->value.enumerated.item].text);
++	return 0;
++}
++
++static int rpi_cirrus_max_rate_get(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++
++	ucontrol->value.enumerated.item[0] = priv->max_rate_idx;
++	return 0;
++}
++
++static int rpi_cirrus_max_rate_put(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	int changed = 0;
++
++	if (priv->max_rate_idx != ucontrol->value.enumerated.item[0]) {
++		changed = 1;
++		priv->max_rate_idx = ucontrol->value.enumerated.item[0];
++	}
++
++	return changed;
++}
++
++static int rpi_cirrus_spdif_info(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_info *uinfo)
++{
++	uinfo->type = SNDRV_CTL_ELEM_TYPE_IEC958;
++	uinfo->count = 1;
++	return 0;
++}
++
++static int rpi_cirrus_spdif_playback_get(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	int i;
++
++	for (i = 0; i < 4; i++)
++		ucontrol->value.iec958.status[i] = priv->iec958_status[i];
++
++	return 0;
++}
++
++static int rpi_cirrus_spdif_playback_put(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct snd_soc_component *wm8804_component =
++		asoc_rtd_to_codec(get_wm8804_runtime(card), 0)->component;
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	unsigned char *stat = priv->iec958_status;
++	unsigned char *ctrl_stat = ucontrol->value.iec958.status;
++	unsigned int mask;
++	int i, changed = 0;
++
++	for (i = 0; i < 4; i++) {
++		mask = (i == 3) ? 0x3f : 0xff;
++		if ((ctrl_stat[i] & mask) != (stat[i] & mask)) {
++			changed = 1;
++			stat[i] = ctrl_stat[i] & mask;
++			snd_soc_component_update_bits(wm8804_component,
++				WM8804_SPDTX1 + i, mask, stat[i]);
++		}
++	}
++
++	return changed;
++}
++
++static int rpi_cirrus_spdif_mask_get(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	ucontrol->value.iec958.status[0] = 0xff;
++	ucontrol->value.iec958.status[1] = 0xff;
++	ucontrol->value.iec958.status[2] = 0xff;
++	ucontrol->value.iec958.status[3] = 0x3f;
++
++	return 0;
++}
++
++static int rpi_cirrus_spdif_capture_get(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct snd_soc_component *wm8804_component =
++		asoc_rtd_to_codec(get_wm8804_runtime(card), 0)->component;
++	unsigned int val, mask;
++	int i;
++
++	for (i = 0; i < 4; i++) {
++		val = snd_soc_component_read(wm8804_component,
++			WM8804_RXCHAN1 + i);
++		mask = (i == 3) ? 0x3f : 0xff;
++		ucontrol->value.iec958.status[i] = val & mask;
++	}
++
++	return 0;
++}
++
++#define SPDIF_FLAG_CTRL(desc, reg, bit, invert) \
++{ \
++		.access =  SNDRV_CTL_ELEM_ACCESS_READ \
++			   | SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
++		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER, \
++		.name =    SNDRV_CTL_NAME_IEC958("", CAPTURE, NONE) \
++				desc " Flag", \
++		.info =    snd_ctl_boolean_mono_info, \
++		.get =     rpi_cirrus_spdif_status_flag_get, \
++		.private_value = \
++			(bit) | ((reg) << 8) | ((invert) << 16) \
++}
++
++static int rpi_cirrus_spdif_status_flag_get(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct snd_soc_component *wm8804_component =
++		asoc_rtd_to_codec(get_wm8804_runtime(card), 0)->component;
++
++	unsigned int bit = kcontrol->private_value & 0xff;
++	unsigned int reg = (kcontrol->private_value >> 8) & 0xff;
++	unsigned int invert = (kcontrol->private_value >> 16) & 0xff;
++	unsigned int val;
++	bool flag;
++
++	val = snd_soc_component_read(wm8804_component, reg);
++
++	flag = val & (1 << bit);
++
++	ucontrol->value.integer.value[0] = invert ? !flag : flag;
++
++	return 0;
++}
++
++static const char * const recovered_frequency_texts[] = {
++	"176.4/192 kHz",
++	"88.2/96 kHz",
++	"44.1/48 kHz",
++	"32 kHz"
++};
++
++#define NUM_RECOVERED_FREQUENCIES \
++	ARRAY_SIZE(recovered_frequency_texts)
++
++static int rpi_cirrus_recovered_frequency_info(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_info *uinfo)
++{
++	uinfo->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
++	uinfo->count = 1;
++	uinfo->value.enumerated.items = NUM_RECOVERED_FREQUENCIES;
++	if (uinfo->value.enumerated.item >= NUM_RECOVERED_FREQUENCIES)
++		uinfo->value.enumerated.item = NUM_RECOVERED_FREQUENCIES - 1;
++	strcpy(uinfo->value.enumerated.name,
++		recovered_frequency_texts[uinfo->value.enumerated.item]);
++	return 0;
++}
++
++static int rpi_cirrus_recovered_frequency_get(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct snd_soc_component *wm8804_component =
++		asoc_rtd_to_codec(get_wm8804_runtime(card), 0)->component;
++	unsigned int val;
++
++	val = snd_soc_component_read(wm8804_component, WM8804_SPDSTAT);
++
++	ucontrol->value.enumerated.item[0] = (val >> 4) & 0x03;
++	return 0;
++}
++
++static const struct snd_kcontrol_new rpi_cirrus_controls[] = {
++	{
++		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
++		.name =    "Min Sample Rate",
++		.info =    rpi_cirrus_min_rate_info,
++		.get =     rpi_cirrus_min_rate_get,
++		.put =     rpi_cirrus_min_rate_put,
++	},
++	{
++		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
++		.name =    "Max Sample Rate",
++		.info =    rpi_cirrus_max_rate_info,
++		.get =     rpi_cirrus_max_rate_get,
++		.put =     rpi_cirrus_max_rate_put,
++	},
++	{
++		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
++		.name =    SNDRV_CTL_NAME_IEC958("", PLAYBACK, DEFAULT),
++		.info =    rpi_cirrus_spdif_info,
++		.get =     rpi_cirrus_spdif_playback_get,
++		.put =     rpi_cirrus_spdif_playback_put,
++	},
++	{
++		.access =  SNDRV_CTL_ELEM_ACCESS_READ
++			   | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
++		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
++		.name =    SNDRV_CTL_NAME_IEC958("", CAPTURE, DEFAULT),
++		.info =    rpi_cirrus_spdif_info,
++		.get =     rpi_cirrus_spdif_capture_get,
++	},
++	{
++		.access =  SNDRV_CTL_ELEM_ACCESS_READ,
++		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
++		.name =    SNDRV_CTL_NAME_IEC958("", PLAYBACK, MASK),
++		.info =    rpi_cirrus_spdif_info,
++		.get =     rpi_cirrus_spdif_mask_get,
++	},
++	{
++		.access =  SNDRV_CTL_ELEM_ACCESS_READ
++			   | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
++		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
++		.name =    SNDRV_CTL_NAME_IEC958("", CAPTURE, NONE)
++				"Recovered Frequency",
++		.info =    rpi_cirrus_recovered_frequency_info,
++		.get =     rpi_cirrus_recovered_frequency_get,
++	},
++	SPDIF_FLAG_CTRL("Audio", WM8804_SPDSTAT, 0, 1),
++	SPDIF_FLAG_CTRL("Non-PCM", WM8804_SPDSTAT, 1, 0),
++	SPDIF_FLAG_CTRL("Copyright", WM8804_SPDSTAT, 2, 1),
++	SPDIF_FLAG_CTRL("De-Emphasis", WM8804_SPDSTAT, 3, 0),
++	SPDIF_FLAG_CTRL("Lock", WM8804_SPDSTAT, 6, 1),
++	SPDIF_FLAG_CTRL("Invalid", WM8804_INTSTAT, 1, 0),
++	SPDIF_FLAG_CTRL("TransErr", WM8804_INTSTAT, 3, 0),
++};
++
++static const char * const linein_micbias_texts[] = {
++	"off", "on",
++};
++
++static SOC_ENUM_SINGLE_VIRT_DECL(linein_micbias_enum,
++	linein_micbias_texts);
++
++static const struct snd_kcontrol_new linein_micbias_mux =
++	SOC_DAPM_ENUM("Route", linein_micbias_enum);
++
++static int rpi_cirrus_spdif_rx_enable_event(struct snd_soc_dapm_widget *w,
++	struct snd_kcontrol *kcontrol, int event);
++
++const struct snd_soc_dapm_widget rpi_cirrus_dapm_widgets[] = {
++	SND_SOC_DAPM_MIC("DMIC", NULL),
++	SND_SOC_DAPM_MIC("Headset Mic", NULL),
++	SND_SOC_DAPM_INPUT("Line Input"),
++	SND_SOC_DAPM_MIC("Line Input with Micbias", NULL),
++	SND_SOC_DAPM_MUX("Line Input Micbias", SND_SOC_NOPM, 0, 0,
++		&linein_micbias_mux),
++	SND_SOC_DAPM_INPUT("dummy SPDIF in"),
++	SND_SOC_DAPM_PGA_E("dummy SPDIFRX", SND_SOC_NOPM, 0, 0, NULL, 0,
++		rpi_cirrus_spdif_rx_enable_event,
++		SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
++	SND_SOC_DAPM_INPUT("Dummy Input"),
++	SND_SOC_DAPM_OUTPUT("Dummy Output"),
++};
++
++const struct snd_soc_dapm_route rpi_cirrus_dapm_routes[] = {
++	{ "IN1L", NULL, "Headset Mic" },
++	{ "IN1R", NULL, "Headset Mic" },
++	{ "Headset Mic", NULL, "MICBIAS1" },
++
++	{ "IN2L", NULL, "DMIC" },
++	{ "IN2R", NULL, "DMIC" },
++	{ "DMIC", NULL, "MICBIAS2" },
++
++	{ "IN3L", NULL, "Line Input Micbias" },
++	{ "IN3R", NULL, "Line Input Micbias" },
++
++	{ "Line Input Micbias", "off", "Line Input" },
++	{ "Line Input Micbias", "on", "Line Input with Micbias" },
++
++	/* Make sure MICVDD is enabled, otherwise we get noise */
++	{ "Line Input", NULL, "MICVDD" },
++	{ "Line Input with Micbias", NULL, "MICBIAS3" },
++
++	/* Dummy routes to check whether SPDIF RX is enabled or not */
++	{"dummy SPDIFRX", NULL, "dummy SPDIF in"},
++	{"AIFTX", NULL, "dummy SPDIFRX"},
++
++	/*
++	 * Dummy routes to keep wm5102 from staying off on
++	 * playback/capture if all mixers are off.
++	 */
++	{ "Dummy Output", NULL, "AIF1RX1" },
++	{ "Dummy Output", NULL, "AIF1RX2" },
++	{ "AIF1TX1", NULL, "Dummy Input" },
++	{ "AIF1TX2", NULL, "Dummy Input" },
++};
++
++static int rpi_cirrus_clear_flls(struct snd_soc_card *card,
++	struct snd_soc_component *wm5102_component) {
++
++	int ret1, ret2;
++
++	ret1 = snd_soc_component_set_pll(wm5102_component,
++		WM5102_FLL1, ARIZONA_FLL_SRC_NONE, 0, 0);
++	ret2 = snd_soc_component_set_pll(wm5102_component,
++		WM5102_FLL1_REFCLK, ARIZONA_FLL_SRC_NONE, 0, 0);
++
++	if (ret1) {
++		dev_warn(card->dev,
++			"setting FLL1 to zero failed: %d\n", ret1);
++		return ret1;
++	}
++	if (ret2) {
++		dev_warn(card->dev,
++			"setting FLL1_REFCLK to zero failed: %d\n", ret2);
++		return ret2;
++	}
++	return 0;
++}
++
++static int rpi_cirrus_set_fll(struct snd_soc_card *card,
++	struct snd_soc_component *wm5102_component, unsigned int clk_freq)
++{
++	int ret = snd_soc_component_set_pll(wm5102_component,
++		WM5102_FLL1,
++		ARIZONA_CLK_SRC_MCLK1,
++		WM8804_CLKOUT_HZ,
++		clk_freq);
++	if (ret)
++		dev_err(card->dev, "Failed to set FLL1 to %d: %d\n",
++			clk_freq, ret);
++
++	usleep_range(1000, 2000);
++	return ret;
++}
++
++static int rpi_cirrus_set_fll_refclk(struct snd_soc_card *card,
++	struct snd_soc_component *wm5102_component,
++	unsigned int clk_freq, unsigned int aif2_freq)
++{
++	int ret = snd_soc_component_set_pll(wm5102_component,
++		WM5102_FLL1_REFCLK,
++		ARIZONA_CLK_SRC_MCLK1,
++		WM8804_CLKOUT_HZ,
++		clk_freq);
++	if (ret) {
++		dev_err(card->dev,
++			"Failed to set FLL1_REFCLK to %d: %d\n",
++			clk_freq, ret);
++		return ret;
++	}
++
++	ret = snd_soc_component_set_pll(wm5102_component,
++		WM5102_FLL1,
++		ARIZONA_CLK_SRC_AIF2BCLK,
++		aif2_freq, clk_freq);
++	if (ret)
++		dev_err(card->dev,
++			"Failed to set FLL1 with Sync Clock %d to %d: %d\n",
++			aif2_freq, clk_freq, ret);
++
++	usleep_range(1000, 2000);
++	return ret;
++}
++
++static int rpi_cirrus_spdif_rx_enable_event(struct snd_soc_dapm_widget *w,
++	struct snd_kcontrol *kcontrol, int event)
++{
++	struct snd_soc_card *card = w->dapm->card;
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	struct snd_soc_component *wm5102_component =
++		asoc_rtd_to_codec(get_wm5102_runtime(card), 0)->component;
++
++	unsigned int clk_freq, aif2_freq;
++	int ret = 0;
++
++	switch (event) {
++	case SND_SOC_DAPM_POST_PMU:
++		mutex_lock(&priv->lock);
++
++		/* Enable sync path in case of SPDIF capture use case */
++
++		clk_freq = calc_sysclk(priv->card_rate);
++		aif2_freq = 64 * priv->card_rate;
++
++		dev_dbg(card->dev,
++			"spdif_rx: changing FLL1 to use Ref Clock clk: %d spdif: %d\n",
++			clk_freq, aif2_freq);
++
++		ret = rpi_cirrus_clear_flls(card, wm5102_component);
++		if (ret) {
++			dev_err(card->dev, "spdif_rx: failed to clear FLLs\n");
++			goto out;
++		}
++
++		ret = rpi_cirrus_set_fll_refclk(card, wm5102_component,
++			clk_freq, aif2_freq);
++
++		if (ret) {
++			dev_err(card->dev, "spdif_rx: failed to set FLLs\n");
++			goto out;
++		}
++
++		/* set to negative to indicate we're doing spdif rx */
++		priv->fll1_freq = -clk_freq;
++		priv->sync_path_enable = 1;
++		break;
++
++	case SND_SOC_DAPM_POST_PMD:
++		mutex_lock(&priv->lock);
++		priv->sync_path_enable = 0;
++		break;
++
++	default:
++		return 0;
++	}
++
++out:
++	mutex_unlock(&priv->lock);
++	return ret;
++}
++
++static int rpi_cirrus_set_bias_level(struct snd_soc_card *card,
++	struct snd_soc_dapm_context *dapm,
++	enum snd_soc_bias_level level)
++{
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	struct snd_soc_pcm_runtime *wm5102_runtime = get_wm5102_runtime(card);
++	struct snd_soc_component *wm5102_component =
++		asoc_rtd_to_codec(wm5102_runtime, 0)->component;
++
++	int ret = 0;
++	unsigned int clk_freq;
++
++	if (dapm->dev != asoc_rtd_to_codec(wm5102_runtime, 0)->dev)
++		return 0;
++
++	switch (level) {
++	case SND_SOC_BIAS_PREPARE:
++		if (dapm->bias_level == SND_SOC_BIAS_ON)
++			break;
++
++		mutex_lock(&priv->lock);
++
++		if (!priv->sync_path_enable) {
++			clk_freq = calc_sysclk(priv->card_rate);
++
++			dev_dbg(card->dev,
++				"set_bias: changing FLL1 from %d to %d\n",
++				priv->fll1_freq, clk_freq);
++
++			ret = rpi_cirrus_set_fll(card,
++				wm5102_component, clk_freq);
++			if (ret)
++				dev_err(card->dev,
++					"set_bias: Failed to set FLL1\n");
++			else
++				priv->fll1_freq = clk_freq;
++		}
++		mutex_unlock(&priv->lock);
++		break;
++	default:
++		break;
++	}
++
++	return ret;
++}
++
++static int rpi_cirrus_set_bias_level_post(struct snd_soc_card *card,
++	struct snd_soc_dapm_context *dapm,
++	enum snd_soc_bias_level level)
++{
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	struct snd_soc_pcm_runtime *wm5102_runtime = get_wm5102_runtime(card);
++	struct snd_soc_component *wm5102_component =
++		asoc_rtd_to_codec(wm5102_runtime, 0)->component;
++
++	if (dapm->dev != asoc_rtd_to_codec(wm5102_runtime, 0)->dev)
++		return 0;
++
++	switch (level) {
++	case SND_SOC_BIAS_STANDBY:
++		mutex_lock(&priv->lock);
++
++		dev_dbg(card->dev,
++			"set_bias_post: changing FLL1 from %d to off\n",
++				priv->fll1_freq);
++
++		if (rpi_cirrus_clear_flls(card, wm5102_component))
++			dev_err(card->dev,
++				"set_bias_post: failed to clear FLLs\n");
++		else
++			priv->fll1_freq = 0;
++
++		mutex_unlock(&priv->lock);
++
++		break;
++	default:
++		break;
++	}
++
++	return 0;
++}
++
++static int rpi_cirrus_set_wm8804_pll(struct snd_soc_card *card,
++	struct snd_soc_dai *wm8804_dai, unsigned int rate)
++{
++	int ret;
++
++	/* use 256fs */
++	unsigned int clk_freq = rate * 256;
++
++	ret = snd_soc_dai_set_pll(wm8804_dai, 0, 0,
++		WM8804_CLKOUT_HZ, clk_freq);
++	if (ret) {
++		dev_err(card->dev,
++			"Failed to set WM8804 PLL to %d: %d\n", clk_freq, ret);
++		return ret;
++	}
++
++	/* Set MCLK as PLL Output */
++	ret = snd_soc_dai_set_sysclk(wm8804_dai,
++		WM8804_TX_CLKSRC_PLL, clk_freq, 0);
++	if (ret) {
++		dev_err(card->dev,
++			"Failed to set MCLK as PLL Output: %d\n", ret);
++		return ret;
++	}
++
++	return ret;
++}
++
++static int rpi_cirrus_startup(struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_card *card = rtd->card;
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	unsigned int min_rate = min_rates[priv->min_rate_idx].value;
++	unsigned int max_rate = max_rates[priv->max_rate_idx].value;
++
++	if (min_rate || max_rate) {
++		if (max_rate == 0)
++			max_rate = UINT_MAX;
++
++		dev_dbg(card->dev,
++			"startup: limiting rate to %u-%u\n",
++			min_rate, max_rate);
++
++		snd_pcm_hw_constraint_minmax(substream->runtime,
++			SNDRV_PCM_HW_PARAM_RATE, min_rate, max_rate);
++	}
++
++	return 0;
++}
++
++static struct snd_soc_pcm_stream rpi_cirrus_dai_link2_params = {
++	.formats = SNDRV_PCM_FMTBIT_S24_LE,
++	.channels_min = 2,
++	.channels_max = 2,
++	.rate_min = RPI_CIRRUS_DEFAULT_RATE,
++	.rate_max = RPI_CIRRUS_DEFAULT_RATE,
++};
++
++static int rpi_cirrus_hw_params(struct snd_pcm_substream *substream,
++	struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_card *card = rtd->card;
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	struct snd_soc_dai *bcm_i2s_dai = asoc_rtd_to_cpu(rtd, 0);
++	struct snd_soc_component *wm5102_component = asoc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_dai *wm8804_dai = asoc_rtd_to_codec(get_wm8804_runtime(card), 0);
++
++	int ret;
++
++	unsigned int width = snd_pcm_format_physical_width(
++		params_format(params));
++	unsigned int rate = params_rate(params);
++	unsigned int clk_freq = calc_sysclk(rate);
++
++	mutex_lock(&priv->lock);
++
++	dev_dbg(card->dev, "hw_params: setting rate to %d\n", rate);
++
++	ret = snd_soc_dai_set_bclk_ratio(bcm_i2s_dai, 2 * width);
++	if (ret) {
++		dev_err(card->dev, "set_bclk_ratio failed: %d\n", ret);
++		goto out;
++	}
++
++	ret = snd_soc_dai_set_tdm_slot(asoc_rtd_to_codec(rtd, 0), 0x03, 0x03, 2, width);
++	if (ret) {
++		dev_err(card->dev, "set_tdm_slot failed: %d\n", ret);
++		goto out;
++	}
++
++	/* WM8804 supports sample rates from 32k only */
++	if (rate >= 32000) {
++		ret = rpi_cirrus_set_wm8804_pll(card, wm8804_dai, rate);
++		if (ret)
++			goto out;
++	}
++
++	ret = snd_soc_component_set_sysclk(wm5102_component,
++		ARIZONA_CLK_SYSCLK,
++		ARIZONA_CLK_SRC_FLL1,
++		clk_freq,
++		SND_SOC_CLOCK_IN);
++	if (ret) {
++		dev_err(card->dev, "Failed to set SYSCLK: %d\n", ret);
++		goto out;
++	}
++
++	if ((priv->fll1_freq > 0) && (priv->fll1_freq != clk_freq)) {
++		dev_dbg(card->dev,
++			"hw_params: changing FLL1 from %d to %d\n",
++			priv->fll1_freq, clk_freq);
++
++		if (rpi_cirrus_clear_flls(card, wm5102_component)) {
++			dev_err(card->dev, "hw_params: failed to clear FLLs\n");
++			goto out;
++		}
++
++		if (rpi_cirrus_set_fll(card, wm5102_component, clk_freq)) {
++			dev_err(card->dev, "hw_params: failed to set FLL\n");
++			goto out;
++		}
++
++		priv->fll1_freq = clk_freq;
++	}
++
++	priv->card_rate = rate;
++	rpi_cirrus_dai_link2_params.rate_min = rate;
++	rpi_cirrus_dai_link2_params.rate_max = rate;
++
++	priv->params_set |= 1 << substream->stream;
++
++out:
++	mutex_unlock(&priv->lock);
++
++	return ret;
++}
++
++static int rpi_cirrus_hw_free(struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_card *card = rtd->card;
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	struct snd_soc_component *wm5102_component = asoc_rtd_to_codec(rtd, 0)->component;
++	int ret;
++	unsigned int old_params_set = priv->params_set;
++
++	priv->params_set &= ~(1 << substream->stream);
++
++	/* disable sysclk if this was the last open stream */
++	if (priv->params_set == 0 && old_params_set) {
++		dev_dbg(card->dev,
++			"hw_free: Setting SYSCLK to Zero\n");
++
++		ret = snd_soc_component_set_sysclk(wm5102_component,
++			ARIZONA_CLK_SYSCLK,
++			ARIZONA_CLK_SRC_FLL1,
++			0,
++			SND_SOC_CLOCK_IN);
++		if (ret)
++			dev_err(card->dev,
++				"hw_free: Failed to set SYSCLK to Zero: %d\n",
++				ret);
++	}
++	return 0;
++}
++
++static int rpi_cirrus_init_wm5102(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++	int ret;
++
++	/* no 32kHz input, derive it from sysclk if needed  */
++	snd_soc_component_update_bits(component,
++			ARIZONA_CLOCK_32K_1, ARIZONA_CLK_32K_SRC_MASK, 2);
++
++	if (rpi_cirrus_clear_flls(rtd->card, component))
++		dev_warn(rtd->card->dev,
++			"init_wm5102: failed to clear FLLs\n");
++
++	ret = snd_soc_component_set_sysclk(component,
++		ARIZONA_CLK_SYSCLK, ARIZONA_CLK_SRC_FLL1,
++		0, SND_SOC_CLOCK_IN);
++	if (ret) {
++		dev_err(rtd->card->dev,
++			"Failed to set SYSCLK to Zero: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++static int rpi_cirrus_init_wm8804(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_dai *codec_dai = asoc_rtd_to_codec(rtd, 0);
++	struct snd_soc_component *component = codec_dai->component;
++	struct snd_soc_card *card = rtd->card;
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	unsigned int val, mask;
++	int i, ret;
++
++	for (i = 0; i < 4; i++) {
++		val = snd_soc_component_read(component,
++			WM8804_SPDTX1 + i);
++		mask = (i == 3) ? 0x3f : 0xff;
++		priv->iec958_status[i] = val & mask;
++	}
++
++	/* Setup for 256fs */
++	ret = snd_soc_dai_set_clkdiv(codec_dai,
++		WM8804_MCLK_DIV, WM8804_MCLKDIV_256FS);
++	if (ret) {
++		dev_err(card->dev,
++			"init_wm8804: Failed to set MCLK_DIV to 256fs: %d\n",
++			ret);
++		return ret;
++	}
++
++	/* Output OSC on CLKOUT */
++	ret = snd_soc_dai_set_sysclk(codec_dai,
++		WM8804_CLKOUT_SRC_OSCCLK, WM8804_CLKOUT_HZ, 0);
++	if (ret)
++		dev_err(card->dev,
++			"init_wm8804: Failed to set CLKOUT as OSC Frequency: %d\n",
++			ret);
++
++	/* Init PLL with default samplerate */
++	ret = rpi_cirrus_set_wm8804_pll(card, codec_dai,
++		RPI_CIRRUS_DEFAULT_RATE);
++	if (ret)
++		dev_err(card->dev,
++			"init_wm8804: Failed to setup PLL for %dHz: %d\n",
++			RPI_CIRRUS_DEFAULT_RATE, ret);
++
++	return ret;
++}
++
++static struct snd_soc_ops rpi_cirrus_ops = {
++	.startup = rpi_cirrus_startup,
++	.hw_params = rpi_cirrus_hw_params,
++	.hw_free = rpi_cirrus_hw_free,
++};
++
++SND_SOC_DAILINK_DEFS(wm5102,
++     DAILINK_COMP_ARRAY(COMP_EMPTY()),
++     DAILINK_COMP_ARRAY(COMP_CODEC("wm5102-codec", "wm5102-aif1")),
++     DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++SND_SOC_DAILINK_DEFS(wm8804,
++     DAILINK_COMP_ARRAY(COMP_CPU("wm5102-aif2")),
++     DAILINK_COMP_ARRAY(COMP_CODEC("wm8804.1-003b", "wm8804-spdif")));
++
++static struct snd_soc_dai_link rpi_cirrus_dai[] = {
++	[DAI_WM5102] = {
++		.name		= "WM5102",
++		.stream_name	= "WM5102 AiFi",
++		.dai_fmt	=   SND_SOC_DAIFMT_I2S
++				  | SND_SOC_DAIFMT_NB_NF
++				  | SND_SOC_DAIFMT_CBM_CFM,
++		.ops		= &rpi_cirrus_ops,
++		.init		= rpi_cirrus_init_wm5102,
++		SND_SOC_DAILINK_REG(wm5102),
++	},
++	[DAI_WM8804] = {
++		.name		= "WM5102 SPDIF",
++		.stream_name	= "SPDIF Tx/Rx",
++		.dai_fmt	=   SND_SOC_DAIFMT_I2S
++				  | SND_SOC_DAIFMT_NB_NF
++				  | SND_SOC_DAIFMT_CBM_CFM,
++		.ignore_suspend = 1,
++		.params		= &rpi_cirrus_dai_link2_params,
++		.init		= rpi_cirrus_init_wm8804,
++		SND_SOC_DAILINK_REG(wm8804),
++	},
++};
++
++
++static int rpi_cirrus_late_probe(struct snd_soc_card *card)
++{
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	struct snd_soc_pcm_runtime *wm5102_runtime = get_wm5102_runtime(card);
++	struct snd_soc_pcm_runtime *wm8804_runtime = get_wm8804_runtime(card);
++	int ret;
++
++	dev_dbg(card->dev, "iec958_bits: %02x %02x %02x %02x\n",
++		priv->iec958_status[0],
++		priv->iec958_status[1],
++		priv->iec958_status[2],
++		priv->iec958_status[3]);
++
++	ret = snd_soc_dai_set_sysclk(
++		asoc_rtd_to_codec(wm5102_runtime, 0), ARIZONA_CLK_SYSCLK, 0, 0);
++	if (ret) {
++		dev_err(card->dev,
++			"Failed to set WM5102 codec dai clk domain: %d\n", ret);
++		return ret;
++	}
++
++	ret = snd_soc_dai_set_sysclk(
++		asoc_rtd_to_cpu(wm8804_runtime, 0), ARIZONA_CLK_SYSCLK, 0, 0);
++	if (ret)
++		dev_err(card->dev,
++			"Failed to set WM8804 codec dai clk domain: %d\n", ret);
++
++	return ret;
++}
++
++/* audio machine driver */
++static struct snd_soc_card rpi_cirrus_card = {
++	.name			= "RPi-Cirrus",
++	.driver_name		= "RPiCirrus",
++	.owner			= THIS_MODULE,
++	.dai_link		= rpi_cirrus_dai,
++	.num_links		= ARRAY_SIZE(rpi_cirrus_dai),
++	.late_probe		= rpi_cirrus_late_probe,
++	.controls		= rpi_cirrus_controls,
++	.num_controls		= ARRAY_SIZE(rpi_cirrus_controls),
++	.dapm_widgets		= rpi_cirrus_dapm_widgets,
++	.num_dapm_widgets	= ARRAY_SIZE(rpi_cirrus_dapm_widgets),
++	.dapm_routes		= rpi_cirrus_dapm_routes,
++	.num_dapm_routes	= ARRAY_SIZE(rpi_cirrus_dapm_routes),
++	.set_bias_level		= rpi_cirrus_set_bias_level,
++	.set_bias_level_post	= rpi_cirrus_set_bias_level_post,
++};
++
++static int rpi_cirrus_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	struct rpi_cirrus_priv *priv;
++	struct device_node *i2s_node;
++
++	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	priv->min_rate_idx = 1; /* min samplerate 32kHz */
++	priv->card_rate = RPI_CIRRUS_DEFAULT_RATE;
++
++	mutex_init(&priv->lock);
++
++	snd_soc_card_set_drvdata(&rpi_cirrus_card, priv);
++
++	if (!pdev->dev.of_node)
++		return -ENODEV;
++
++	i2s_node = of_parse_phandle(
++			pdev->dev.of_node, "i2s-controller", 0);
++	if (!i2s_node) {
++		dev_err(&pdev->dev, "i2s-controller missing in DT\n");
++		return -ENODEV;
++	}
++
++	rpi_cirrus_dai[DAI_WM5102].cpus->of_node = i2s_node;
++	rpi_cirrus_dai[DAI_WM5102].platforms->of_node = i2s_node;
++
++	rpi_cirrus_card.dev = &pdev->dev;
++
++	ret = devm_snd_soc_register_card(&pdev->dev, &rpi_cirrus_card);
++	if (ret) {
++		if (ret == -EPROBE_DEFER)
++			dev_dbg(&pdev->dev,
++				"register card requested probe deferral\n");
++		else
++			dev_err(&pdev->dev,
++				"Failed to register card: %d\n", ret);
++	}
++
++	return ret;
++}
++
++static const struct of_device_id rpi_cirrus_of_match[] = {
++	{ .compatible = "wlf,rpi-cirrus", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, rpi_cirrus_of_match);
++
++static struct platform_driver rpi_cirrus_driver = {
++	.driver	= {
++		.name   = "snd-rpi-cirrus",
++		.of_match_table = of_match_ptr(rpi_cirrus_of_match),
++	},
++	.probe	= rpi_cirrus_probe,
++};
++
++module_platform_driver(rpi_cirrus_driver);
++
++MODULE_AUTHOR("Matthias Reichl <hias@horus.com>");
++MODULE_DESCRIPTION("ASoC driver for Cirrus Logic Audio Card");
++MODULE_LICENSE("GPL");
+--- /dev/null
++++ b/sound/soc/bcm/rpi-proto.c
+@@ -0,0 +1,147 @@
++/*
++ * ASoC driver for PROTO AudioCODEC (with a WM8731)
++ * connected to a Raspberry Pi
++ *
++ * Author:      Florian Meier, <koalo@koalo.de>
++ *	      Copyright 2013
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++#include "../codecs/wm8731.h"
++
++static const unsigned int wm8731_rates_12288000[] = {
++	8000, 32000, 48000, 96000,
++};
++
++static struct snd_pcm_hw_constraint_list wm8731_constraints_12288000 = {
++	.list = wm8731_rates_12288000,
++	.count = ARRAY_SIZE(wm8731_rates_12288000),
++};
++
++static int snd_rpi_proto_startup(struct snd_pcm_substream *substream)
++{
++	/* Setup constraints, because there is a 12.288 MHz XTAL on the board */
++	snd_pcm_hw_constraint_list(substream->runtime, 0,
++				SNDRV_PCM_HW_PARAM_RATE,
++				&wm8731_constraints_12288000);
++	return 0;
++}
++
++static int snd_rpi_proto_hw_params(struct snd_pcm_substream *substream,
++				       struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *codec_dai = asoc_rtd_to_codec(rtd, 0);
++	struct snd_soc_dai *cpu_dai = asoc_rtd_to_cpu(rtd, 0);
++	int sysclk = 12288000; /* This is fixed on this board */
++
++	/* Set proto bclk */
++	int ret = snd_soc_dai_set_bclk_ratio(cpu_dai,32*2);
++	if (ret < 0){
++		dev_err(rtd->card->dev,
++				"Failed to set BCLK ratio %d\n", ret);
++		return ret;
++	}
++
++	/* Set proto sysclk */
++	ret = snd_soc_dai_set_sysclk(codec_dai, WM8731_SYSCLK_XTAL,
++			sysclk, SND_SOC_CLOCK_IN);
++	if (ret < 0) {
++		dev_err(rtd->card->dev,
++				"Failed to set WM8731 SYSCLK: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++/* machine stream operations */
++static struct snd_soc_ops snd_rpi_proto_ops = {
++	.startup = snd_rpi_proto_startup,
++	.hw_params = snd_rpi_proto_hw_params,
++};
++
++SND_SOC_DAILINK_DEFS(rpi_proto,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("wm8731.1-001a", "wm8731-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_proto_dai[] = {
++{
++	.name		= "WM8731",
++	.stream_name	= "WM8731 HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S
++				| SND_SOC_DAIFMT_NB_NF
++				| SND_SOC_DAIFMT_CBM_CFM,
++	.ops		= &snd_rpi_proto_ops,
++	SND_SOC_DAILINK_REG(rpi_proto),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_proto = {
++	.name		= "snd_rpi_proto",
++	.owner		= THIS_MODULE,
++	.dai_link	= snd_rpi_proto_dai,
++	.num_links	= ARRAY_SIZE(snd_rpi_proto_dai),
++};
++
++static int snd_rpi_proto_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++
++	snd_rpi_proto.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai = &snd_rpi_proto_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++				            "i2s-controller", 0);
++
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		}
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev, &snd_rpi_proto);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev,
++				"snd_soc_register_card() failed: %d\n", ret);
++
++	return ret;
++}
++
++static const struct of_device_id snd_rpi_proto_of_match[] = {
++	{ .compatible = "rpi,rpi-proto", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, snd_rpi_proto_of_match);
++
++static struct platform_driver snd_rpi_proto_driver = {
++	.driver = {
++		.name   = "snd-rpi-proto",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_rpi_proto_of_match,
++	},
++	.probe	  = snd_rpi_proto_probe,
++};
++
++module_platform_driver(snd_rpi_proto_driver);
++
++MODULE_AUTHOR("Florian Meier");
++MODULE_DESCRIPTION("ASoC Driver for Raspberry Pi connected to PROTO board (WM8731)");
++MODULE_LICENSE("GPL");
+--- /dev/null
++++ b/sound/soc/bcm/rpi-simple-soundcard.c
+@@ -0,0 +1,487 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * rpi-simple-soundcard.c -- ALSA SoC Raspberry Pi soundcard.
++ *
++ * Copyright (C) 2018 Raspberry Pi.
++ *
++ * Authors: Tim Gover <tim.gover@raspberrypi.org>
++ *
++ * Based on code:
++ * hifiberry_amp.c, hifiberry_dac.c, rpi-dac.c
++ * by Florian Meier <florian.meier@koalo.de>
++ *
++ * googlevoicehat-soundcard.c
++ * by Peter Malkin <petermalkin@google.com>
++ *
++ * adau1977-adc.c
++ * by Andrey Grodzovsky <andrey2805@gmail.com>
++ *
++ * merus-amp.c
++ * by Ariel Muszkat <ariel.muszkat@gmail.com>
++ *		Jorgen Kragh Jakobsen <jorgen.kraghjakobsen@infineon.com>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/gpio/consumer.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++
++/* Parameters for generic RPI functions */
++struct snd_rpi_simple_drvdata {
++	struct snd_soc_dai_link *dai;
++	const char* card_name;
++	unsigned int fixed_bclk_ratio;
++};
++
++static struct snd_soc_card snd_rpi_simple = {
++	.driver_name  = "RPi-simple",
++	.owner        = THIS_MODULE,
++	.dai_link     = NULL,
++	.num_links    = 1, /* Only a single DAI supported at the moment */
++};
++
++static int snd_rpi_simple_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_rpi_simple_drvdata *drvdata =
++		snd_soc_card_get_drvdata(rtd->card);
++	struct snd_soc_dai *cpu_dai = asoc_rtd_to_cpu(rtd, 0);
++
++	if (drvdata->fixed_bclk_ratio > 0)
++		return snd_soc_dai_set_bclk_ratio(cpu_dai,
++				drvdata->fixed_bclk_ratio);
++
++	return 0;
++}
++
++static int pifi_mini_210_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_component *dac;
++	struct gpio_desc *pdn_gpio, *rst_gpio;
++	struct snd_soc_dai *codec_dai;
++	int ret;
++
++	snd_rpi_simple_init(rtd);
++	codec_dai = asoc_rtd_to_codec(rtd, 0);
++
++	dac = codec_dai[0].component;
++
++	pdn_gpio = devm_gpiod_get_optional(snd_rpi_simple.dev, "pdn",
++						GPIOD_OUT_LOW);
++	if (IS_ERR(pdn_gpio)) {
++		ret = PTR_ERR(pdn_gpio);
++		dev_err(snd_rpi_simple.dev, "failed to get pdn gpio: %d\n", ret);
++		return ret;
++	}
++
++	rst_gpio = devm_gpiod_get_optional(snd_rpi_simple.dev, "rst",
++						GPIOD_OUT_LOW);
++	if (IS_ERR(rst_gpio)) {
++		ret = PTR_ERR(rst_gpio);
++		dev_err(snd_rpi_simple.dev, "failed to get rst gpio: %d\n", ret);
++		return ret;
++	}
++
++	// Set up cards - pulse power down and reset first, then
++	// set up according to datasheet
++	gpiod_set_value_cansleep(pdn_gpio, 1);
++	gpiod_set_value_cansleep(rst_gpio, 1);
++	usleep_range(1000, 10000);
++	gpiod_set_value_cansleep(pdn_gpio, 0);
++	usleep_range(20000, 30000);
++	gpiod_set_value_cansleep(rst_gpio, 0);
++	usleep_range(20000, 30000);
++
++	// Oscillator trim
++	snd_soc_component_write(dac, 0x1b, 0);
++	usleep_range(60000, 80000);
++
++	// MCLK at 64fs, sample rate 44.1 or 48kHz
++	snd_soc_component_write(dac, 0x00, 0x60);
++
++	// Set up for BTL - AD/BD mode - AD is 0x00107772, BD is 0x00987772
++	snd_soc_component_write(dac, 0x20, 0x00107772);
++
++	// End mute
++	snd_soc_component_write(dac, 0x05, 0x00);
++
++	return 0;
++}
++
++static int snd_rpi_simple_hw_params(struct snd_pcm_substream *substream,
++		struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *cpu_dai = asoc_rtd_to_cpu(rtd, 0);
++	struct snd_rpi_simple_drvdata *drvdata;
++	unsigned int sample_bits;
++
++	drvdata = snd_soc_card_get_drvdata(rtd->card);
++
++	if (drvdata->fixed_bclk_ratio > 0)
++		return 0; // BCLK is configured in .init
++
++	/* The simple drivers just set the bclk_ratio to sample_bits * 2 so
++	 * hard-code this for now. More complex drivers could just replace
++	 * the hw_params routine.
++	 */
++	sample_bits = snd_pcm_format_physical_width(params_format(params));
++	return snd_soc_dai_set_bclk_ratio(cpu_dai, sample_bits * 2);
++}
++
++static struct snd_soc_ops snd_rpi_simple_ops = {
++	.hw_params = snd_rpi_simple_hw_params,
++};
++
++static int snd_merus_amp_hw_params(struct snd_pcm_substream *substream,
++		struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream);
++	int rate;
++
++	rate = params_rate(params);
++	if (rate > 48000) {
++		dev_err(rtd->card->dev,
++		"Unsupported samplerate %d\n",
++		rate);
++		return -EINVAL;
++	}
++	return 0;
++}
++
++static struct snd_soc_ops snd_merus_amp_ops = {
++	.hw_params = snd_merus_amp_hw_params,
++};
++
++enum adau1977_clk_id {
++	ADAU1977_SYSCLK,
++};
++
++enum adau1977_sysclk_src {
++	ADAU1977_SYSCLK_SRC_MCLK,
++	ADAU1977_SYSCLK_SRC_LRCLK,
++};
++
++static int adau1977_init(struct snd_soc_pcm_runtime *rtd)
++{
++	int ret;
++	struct snd_soc_dai *codec_dai = asoc_rtd_to_codec(rtd, 0);
++
++	ret = snd_soc_dai_set_tdm_slot(codec_dai, 0, 0, 0, 0);
++	if (ret < 0)
++		return ret;
++
++	return snd_soc_component_set_sysclk(codec_dai->component,
++			ADAU1977_SYSCLK, ADAU1977_SYSCLK_SRC_MCLK,
++			11289600, SND_SOC_CLOCK_IN);
++}
++
++SND_SOC_DAILINK_DEFS(adau1977,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("adau1977.1-0011", "adau1977-hifi")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_rpi_adau1977_dai[] = {
++	{
++	.name           = "adau1977",
++	.stream_name    = "ADAU1977",
++	.init           = adau1977_init,
++	.dai_fmt = SND_SOC_DAIFMT_I2S |
++		SND_SOC_DAIFMT_NB_NF |
++		SND_SOC_DAIFMT_CBM_CFM,
++	SND_SOC_DAILINK_REG(adau1977),
++	},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_adau1977 = {
++	.card_name = "snd_rpi_adau1977_adc",
++	.dai       = snd_rpi_adau1977_dai,
++};
++
++SND_SOC_DAILINK_DEFS(gvchat,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("voicehat-codec", "voicehat-hifi")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_googlevoicehat_soundcard_dai[] = {
++{
++	.name           = "Google voiceHAT SoundCard",
++	.stream_name    = "Google voiceHAT SoundCard HiFi",
++	.dai_fmt        =  SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBS_CFS,
++	SND_SOC_DAILINK_REG(gvchat),
++},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_googlevoicehat = {
++	.card_name = "snd_rpi_googlevoicehat_soundcard",
++	.dai       = snd_googlevoicehat_soundcard_dai,
++};
++
++SND_SOC_DAILINK_DEFS(hifiberry_dacplusdsp,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("dacplusdsp-codec", "dacplusdsp-hifi")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_hifiberrydacplusdsp_soundcard_dai[] = {
++{
++	.name           = "Hifiberry DAC+DSP SoundCard",
++	.stream_name    = "Hifiberry DAC+DSP SoundCard HiFi",
++	.dai_fmt        =  SND_SOC_DAIFMT_I2S |
++			   SND_SOC_DAIFMT_NB_NF |
++			   SND_SOC_DAIFMT_CBS_CFS,
++	SND_SOC_DAILINK_REG(hifiberry_dacplusdsp),
++},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_hifiberrydacplusdsp = {
++	.card_name = "snd_rpi_hifiberrydacplusdsp_soundcard",
++	.dai       = snd_hifiberrydacplusdsp_soundcard_dai,
++};
++
++SND_SOC_DAILINK_DEFS(hifiberry_amp,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("tas5713.1-001b", "tas5713-hifi")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_hifiberry_amp_dai[] = {
++	{
++		.name           = "HifiBerry AMP",
++		.stream_name    = "HifiBerry AMP HiFi",
++		.dai_fmt        = SND_SOC_DAIFMT_I2S |
++					SND_SOC_DAIFMT_NB_NF |
++					SND_SOC_DAIFMT_CBS_CFS,
++		SND_SOC_DAILINK_REG(hifiberry_amp),
++	},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_hifiberry_amp = {
++	.card_name        = "snd_rpi_hifiberry_amp",
++	.dai              = snd_hifiberry_amp_dai,
++	.fixed_bclk_ratio = 64,
++};
++
++SND_SOC_DAILINK_DEFS(hifiberry_amp3,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("ma120x0p.1-0020", "ma120x0p-amp")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_hifiberry_amp3_dai[] = {
++	{
++		.name		= "HifiberryAmp3",
++		.stream_name	= "Hifiberry Amp3",
++		.dai_fmt	= SND_SOC_DAIFMT_I2S |
++					SND_SOC_DAIFMT_NB_NF |
++					SND_SOC_DAIFMT_CBS_CFS,
++		SND_SOC_DAILINK_REG(hifiberry_amp3),
++	},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_hifiberry_amp3 = {
++	.card_name	 = "snd_rpi_hifiberry_amp3",
++	.dai		 = snd_hifiberry_amp3_dai,
++	.fixed_bclk_ratio = 64,
++};
++
++SND_SOC_DAILINK_DEFS(hifiberry_dac,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm5102a-codec", "pcm5102a-hifi")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_hifiberry_dac_dai[] = {
++	{
++		.name           = "HifiBerry DAC",
++		.stream_name    = "HifiBerry DAC HiFi",
++		.dai_fmt        = SND_SOC_DAIFMT_I2S |
++					SND_SOC_DAIFMT_NB_NF |
++					SND_SOC_DAIFMT_CBS_CFS,
++		SND_SOC_DAILINK_REG(hifiberry_dac),
++	},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_hifiberry_dac = {
++	.card_name = "snd_rpi_hifiberry_dac",
++	.dai       = snd_hifiberry_dac_dai,
++};
++
++SND_SOC_DAILINK_DEFS(dionaudio_kiwi,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm1794a-codec", "pcm1794a-hifi")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_dionaudio_kiwi_dai[] = {
++{
++	.name		= "DionAudio KIWI",
++	.stream_name	= "DionAudio KIWI STREAMER",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBS_CFS,
++	SND_SOC_DAILINK_REG(dionaudio_kiwi),
++},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_dionaudio_kiwi = {
++	.card_name        = "snd_rpi_dionaudio_kiwi",
++	.dai              = snd_dionaudio_kiwi_dai,
++	.fixed_bclk_ratio = 64,
++};
++
++SND_SOC_DAILINK_DEFS(rpi_dac,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm1794a-codec", "pcm1794a-hifi")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_rpi_dac_dai[] = {
++{
++	.name		= "RPi-DAC",
++	.stream_name	= "RPi-DAC HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBS_CFS,
++	SND_SOC_DAILINK_REG(rpi_dac),
++},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_rpi_dac = {
++	.card_name        = "snd_rpi_rpi_dac",
++	.dai              = snd_rpi_dac_dai,
++	.fixed_bclk_ratio = 64,
++};
++
++SND_SOC_DAILINK_DEFS(merus_amp,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("ma120x0p.1-0020", "ma120x0p-amp")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_merus_amp_dai[] = {
++	{
++		.name           = "MerusAmp",
++		.stream_name    = "Merus Audio Amp",
++		.ops		= &snd_merus_amp_ops,
++		.dai_fmt        = SND_SOC_DAIFMT_I2S |
++					SND_SOC_DAIFMT_NB_NF |
++					SND_SOC_DAIFMT_CBS_CFS,
++		SND_SOC_DAILINK_REG(merus_amp),
++	},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_merus_amp = {
++	.card_name        = "snd_rpi_merus_amp",
++	.dai              = snd_merus_amp_dai,
++	.fixed_bclk_ratio = 64,
++};
++
++SND_SOC_DAILINK_DEFS(pifi_mini_210,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("tas571x.1-001a", "tas571x-hifi")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_pifi_mini_210_dai[] = {
++	{
++		.name           = "PiFi Mini 210",
++		.stream_name    = "PiFi Mini 210 HiFi",
++		.init			= pifi_mini_210_init,
++		.dai_fmt        = SND_SOC_DAIFMT_I2S |
++					SND_SOC_DAIFMT_NB_NF |
++					SND_SOC_DAIFMT_CBS_CFS,
++		SND_SOC_DAILINK_REG(pifi_mini_210),
++	},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_pifi_mini_210 = {
++	.card_name        = "snd_pifi_mini_210",
++	.dai              = snd_pifi_mini_210_dai,
++	.fixed_bclk_ratio = 64,
++};
++
++static const struct of_device_id snd_rpi_simple_of_match[] = {
++	{ .compatible = "adi,adau1977-adc",
++		.data = (void *) &drvdata_adau1977 },
++	{ .compatible = "googlevoicehat,googlevoicehat-soundcard",
++		.data = (void *) &drvdata_googlevoicehat },
++	{ .compatible = "hifiberrydacplusdsp,hifiberrydacplusdsp-soundcard",
++		.data = (void *) &drvdata_hifiberrydacplusdsp },
++	{ .compatible = "hifiberry,hifiberry-amp",
++		.data = (void *) &drvdata_hifiberry_amp },
++	{ .compatible = "hifiberry,hifiberry-amp3",
++		.data = (void *) &drvdata_hifiberry_amp3 },
++	{ .compatible = "hifiberry,hifiberry-dac",
++		.data = (void *) &drvdata_hifiberry_dac },
++	{ .compatible = "dionaudio,dionaudio-kiwi",
++		.data = (void *) &drvdata_dionaudio_kiwi },
++	{ .compatible = "rpi,rpi-dac", &drvdata_rpi_dac},
++	{ .compatible = "merus,merus-amp",
++		.data = (void *) &drvdata_merus_amp },
++	{ .compatible = "pifi,pifi-mini-210",
++		.data = (void *) &drvdata_pifi_mini_210 },
++	{},
++};
++
++static int snd_rpi_simple_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	const struct of_device_id *of_id;
++
++	snd_rpi_simple.dev = &pdev->dev;
++	of_id = of_match_node(snd_rpi_simple_of_match, pdev->dev.of_node);
++
++	if (pdev->dev.of_node && of_id->data) {
++		struct device_node *i2s_node;
++		struct snd_rpi_simple_drvdata *drvdata =
++			(struct snd_rpi_simple_drvdata *) of_id->data;
++		struct snd_soc_dai_link *dai = drvdata->dai;
++
++		snd_soc_card_set_drvdata(&snd_rpi_simple, drvdata);
++
++		/* More complex drivers might override individual functions */
++		if (!dai->init)
++			dai->init = snd_rpi_simple_init;
++		if (!dai->ops)
++			dai->ops = &snd_rpi_simple_ops;
++
++		snd_rpi_simple.name = drvdata->card_name;
++
++		snd_rpi_simple.dai_link = dai;
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++				"i2s-controller", 0);
++		if (!i2s_node) {
++			pr_err("Failed to find i2s-controller DT node\n");
++			return -ENODEV;
++		}
++
++		dai->cpus->of_node = i2s_node;
++		dai->platforms->of_node = i2s_node;
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev, &snd_rpi_simple);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev, "Failed to register card %d\n", ret);
++
++	return ret;
++}
++
++static struct platform_driver snd_rpi_simple_driver = {
++	.driver = {
++		.name   = "snd-rpi-simple",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_rpi_simple_of_match,
++	},
++	.probe          = snd_rpi_simple_probe,
++};
++MODULE_DEVICE_TABLE(of, snd_rpi_simple_of_match);
++
++module_platform_driver(snd_rpi_simple_driver);
++
++MODULE_AUTHOR("Tim Gover <tim.gover@raspberrypi.org>");
++MODULE_DESCRIPTION("ASoC Raspberry Pi simple soundcard driver ");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/rpi-wm8804-soundcard.c
+@@ -0,0 +1,410 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * rpi--wm8804.c -- ALSA SoC Raspberry Pi soundcard.
++ *
++ * Copyright (C) 2018 Raspberry Pi.
++ *
++ * Authors: Tim Gover <tim.gover@raspberrypi.org>
++ *
++ * Generic driver for Pi Hat WM8804 digi sounds cards
++ *
++ * Based upon code from:
++ * justboom-digi.c
++ * by Milan Neskovic <info@justboom.co>
++ *
++ * iqaudio_digi.c
++ * by Daniel Matuschek <info@crazy-audio.com>
++ *
++ * allo-digione.c
++ * by Baswaraj <jaikumar@cem-solutions.net>
++ *
++ * hifiberry-digi.c
++ * Daniel Matuschek <info@crazy-audio.com>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/gpio/consumer.h>
++#include <linux/platform_device.h>
++#include <linux/module.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++
++#include "../codecs/wm8804.h"
++
++struct wm8804_clk_cfg {
++	unsigned int sysclk_freq;
++	unsigned int mclk_freq;
++	unsigned int mclk_div;
++};
++
++/* Parameters for generic functions */
++struct snd_rpi_wm8804_drvdata {
++	/* Required - pointer to the DAI structure */
++	struct snd_soc_dai_link *dai;
++	/* Required - snd_soc_card name */
++	const char *card_name;
++	/* Optional DT node names if card info is defined in DT */
++	const char *card_name_dt;
++	const char *dai_name_dt;
++	const char *dai_stream_name_dt;
++	/* Optional probe extension - called prior to register_card */
++	int (*probe)(struct platform_device *pdev);
++};
++
++static struct gpio_desc *snd_clk44gpio;
++static struct gpio_desc *snd_clk48gpio;
++static int wm8804_samplerate = 0;
++
++/* Forward declarations */
++static struct snd_soc_dai_link snd_allo_digione_dai[];
++static struct snd_soc_card snd_rpi_wm8804;
++
++
++#define CLK_44EN_RATE 22579200UL
++#define CLK_48EN_RATE 24576000UL
++
++static unsigned int snd_rpi_wm8804_enable_clock(unsigned int samplerate)
++{
++	switch (samplerate) {
++	case 11025:
++	case 22050:
++	case 44100:
++	case 88200:
++	case 176400:
++		gpiod_set_value_cansleep(snd_clk44gpio, 1);
++		gpiod_set_value_cansleep(snd_clk48gpio, 0);
++		return CLK_44EN_RATE;
++	default:
++		gpiod_set_value_cansleep(snd_clk48gpio, 1);
++		gpiod_set_value_cansleep(snd_clk44gpio, 0);
++		return CLK_48EN_RATE;
++	}
++}
++
++static void snd_rpi_wm8804_clk_cfg(unsigned int samplerate,
++		struct wm8804_clk_cfg *clk_cfg)
++{
++	clk_cfg->sysclk_freq = 27000000;
++
++	if (samplerate <= 96000 ||
++	    snd_rpi_wm8804.dai_link == snd_allo_digione_dai) {
++		clk_cfg->mclk_freq = samplerate * 256;
++		clk_cfg->mclk_div = WM8804_MCLKDIV_256FS;
++	} else {
++		clk_cfg->mclk_freq = samplerate * 128;
++		clk_cfg->mclk_div = WM8804_MCLKDIV_128FS;
++	}
++
++	if (!(IS_ERR(snd_clk44gpio) || IS_ERR(snd_clk48gpio)))
++		clk_cfg->sysclk_freq = snd_rpi_wm8804_enable_clock(samplerate);
++}
++
++static int snd_rpi_wm8804_hw_params(struct snd_pcm_substream *substream,
++		struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *codec_dai = asoc_rtd_to_codec(rtd, 0);
++	struct snd_soc_component *component = asoc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_dai *cpu_dai = asoc_rtd_to_cpu(rtd, 0);
++	int sampling_freq = 1;
++	int ret;
++	struct wm8804_clk_cfg clk_cfg;
++	int samplerate = params_rate(params);
++
++	if (samplerate == wm8804_samplerate)
++		return 0;
++
++	/* clear until all clocks are setup properly */
++	wm8804_samplerate = 0;
++
++	snd_rpi_wm8804_clk_cfg(samplerate, &clk_cfg);
++
++	pr_debug("%s samplerate: %d mclk_freq: %u mclk_div: %u sysclk: %u\n",
++			__func__, samplerate, clk_cfg.mclk_freq,
++			clk_cfg.mclk_div, clk_cfg.sysclk_freq);
++
++	switch (samplerate) {
++	case 32000:
++		sampling_freq = 0x03;
++		break;
++	case 44100:
++		sampling_freq = 0x00;
++		break;
++	case 48000:
++		sampling_freq = 0x02;
++		break;
++	case 88200:
++		sampling_freq = 0x08;
++		break;
++	case 96000:
++		sampling_freq = 0x0a;
++		break;
++	case 176400:
++		sampling_freq = 0x0c;
++		break;
++	case 192000:
++		sampling_freq = 0x0e;
++		break;
++	default:
++		dev_err(rtd->card->dev,
++		"Failed to set WM8804 SYSCLK, unsupported samplerate %d\n",
++		samplerate);
++	}
++
++	snd_soc_dai_set_clkdiv(codec_dai, WM8804_MCLK_DIV, clk_cfg.mclk_div);
++	snd_soc_dai_set_pll(codec_dai, 0, 0,
++			clk_cfg.sysclk_freq, clk_cfg.mclk_freq);
++
++	ret = snd_soc_dai_set_sysclk(codec_dai, WM8804_TX_CLKSRC_PLL,
++			clk_cfg.sysclk_freq, SND_SOC_CLOCK_OUT);
++	if (ret < 0) {
++		dev_err(rtd->card->dev,
++		"Failed to set WM8804 SYSCLK: %d\n", ret);
++		return ret;
++	}
++
++	wm8804_samplerate = samplerate;
++
++	/* set sampling frequency status bits */
++	snd_soc_component_update_bits(component, WM8804_SPDTX4, 0x0f,
++			sampling_freq);
++
++	return snd_soc_dai_set_bclk_ratio(cpu_dai, 64);
++}
++
++static struct snd_soc_ops snd_rpi_wm8804_ops = {
++	.hw_params = snd_rpi_wm8804_hw_params,
++};
++
++SND_SOC_DAILINK_DEFS(justboom_digi,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_justboom_digi_dai[] = {
++{
++	.name        = "JustBoom Digi",
++	.stream_name = "JustBoom Digi HiFi",
++	SND_SOC_DAILINK_REG(justboom_digi),
++},
++};
++
++static struct snd_rpi_wm8804_drvdata drvdata_justboom_digi = {
++	.card_name            = "snd_rpi_justboom_digi",
++	.dai                  = snd_justboom_digi_dai,
++};
++
++SND_SOC_DAILINK_DEFS(iqaudio_digi,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_iqaudio_digi_dai[] = {
++{
++	.name        = "IQAudIO Digi",
++	.stream_name = "IQAudIO Digi HiFi",
++	SND_SOC_DAILINK_REG(iqaudio_digi),
++},
++};
++
++static struct snd_rpi_wm8804_drvdata drvdata_iqaudio_digi = {
++	.card_name          = "IQAudIODigi",
++	.dai                = snd_iqaudio_digi_dai,
++	.card_name_dt       = "wm8804-digi,card-name",
++	.dai_name_dt        = "wm8804-digi,dai-name",
++	.dai_stream_name_dt = "wm8804-digi,dai-stream-name",
++};
++
++static int snd_allo_digione_probe(struct platform_device *pdev)
++{
++	pr_debug("%s\n", __func__);
++
++	if (IS_ERR(snd_clk44gpio) || IS_ERR(snd_clk48gpio)) {
++		dev_err(&pdev->dev, "devm_gpiod_get() failed\n");
++		return -EINVAL;
++	}
++	return 0;
++}
++
++SND_SOC_DAILINK_DEFS(allo_digione,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_allo_digione_dai[] = {
++{
++	.name        = "Allo DigiOne",
++	.stream_name = "Allo DigiOne HiFi",
++	SND_SOC_DAILINK_REG(allo_digione),
++},
++};
++
++static struct snd_rpi_wm8804_drvdata drvdata_allo_digione = {
++	.card_name = "snd_allo_digione",
++	.dai       = snd_allo_digione_dai,
++	.probe     = snd_allo_digione_probe,
++};
++
++SND_SOC_DAILINK_DEFS(hifiberry_digi,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_hifiberry_digi_dai[] = {
++{
++	.name        = "HifiBerry Digi",
++	.stream_name = "HifiBerry Digi HiFi",
++	SND_SOC_DAILINK_REG(hifiberry_digi),
++},
++};
++
++static int snd_hifiberry_digi_probe(struct platform_device *pdev)
++{
++	pr_debug("%s\n", __func__);
++
++	if (IS_ERR(snd_clk44gpio) || IS_ERR(snd_clk48gpio))
++		return 0;
++
++	snd_hifiberry_digi_dai->name = "HiFiBerry Digi+ Pro";
++	snd_hifiberry_digi_dai->stream_name = "HiFiBerry Digi+ Pro HiFi";
++	return 0;
++}
++
++static struct snd_rpi_wm8804_drvdata drvdata_hifiberry_digi = {
++	.card_name = "snd_rpi_hifiberry_digi",
++	.dai       = snd_hifiberry_digi_dai,
++	.probe     = snd_hifiberry_digi_probe,
++};
++
++static const struct of_device_id snd_rpi_wm8804_of_match[] = {
++	{ .compatible = "justboom,justboom-digi",
++		.data = (void *) &drvdata_justboom_digi },
++	{ .compatible = "iqaudio,wm8804-digi",
++		.data = (void *) &drvdata_iqaudio_digi },
++	{ .compatible = "allo,allo-digione",
++		.data = (void *) &drvdata_allo_digione },
++	{ .compatible = "hifiberry,hifiberry-digi",
++		.data = (void *) &drvdata_hifiberry_digi },
++	{},
++};
++
++static struct snd_soc_card snd_rpi_wm8804 = {
++	.driver_name  = "RPi-WM8804",
++	.owner        = THIS_MODULE,
++	.dai_link     = NULL,
++	.num_links    = 1,
++};
++
++static int snd_rpi_wm8804_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	const struct of_device_id *of_id;
++
++	snd_rpi_wm8804.dev = &pdev->dev;
++	of_id = of_match_node(snd_rpi_wm8804_of_match, pdev->dev.of_node);
++
++	if (pdev->dev.of_node && of_id->data) {
++		struct device_node *i2s_node;
++		struct snd_rpi_wm8804_drvdata *drvdata =
++			(struct snd_rpi_wm8804_drvdata *) of_id->data;
++		struct snd_soc_dai_link *dai = drvdata->dai;
++
++		snd_soc_card_set_drvdata(&snd_rpi_wm8804, drvdata);
++
++		if (!dai->ops)
++			dai->ops = &snd_rpi_wm8804_ops;
++		if (!dai->codecs->dai_name)
++			dai->codecs->dai_name = "wm8804-spdif";
++		if (!dai->codecs->name)
++			dai->codecs->name = "wm8804.1-003b";
++		if (!dai->dai_fmt)
++			dai->dai_fmt = SND_SOC_DAIFMT_I2S |
++				SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBM_CFM;
++
++		snd_rpi_wm8804.dai_link = dai;
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++				"i2s-controller", 0);
++		if (!i2s_node) {
++			pr_err("Failed to find i2s-controller DT node\n");
++			return -ENODEV;
++		}
++
++		snd_rpi_wm8804.name = drvdata->card_name;
++
++		/* If requested by in drvdata get card & DAI names from DT */
++		if (drvdata->card_name_dt)
++			of_property_read_string(i2s_node,
++					drvdata->card_name_dt,
++					&snd_rpi_wm8804.name);
++
++		if (drvdata->dai_name_dt)
++			of_property_read_string(i2s_node,
++					drvdata->dai_name_dt,
++					&dai->name);
++
++		if (drvdata->dai_stream_name_dt)
++			of_property_read_string(i2s_node,
++					drvdata->dai_stream_name_dt,
++					&dai->stream_name);
++
++		dai->cpus->of_node = i2s_node;
++		dai->platforms->of_node = i2s_node;
++
++		/*
++		 * clk44gpio and clk48gpio are not required by all cards so
++		 * don't check the error status.
++		 */
++		snd_clk44gpio =
++			devm_gpiod_get(&pdev->dev, "clock44", GPIOD_OUT_LOW);
++
++		snd_clk48gpio =
++			devm_gpiod_get(&pdev->dev, "clock48", GPIOD_OUT_LOW);
++
++		if (drvdata->probe) {
++			ret = drvdata->probe(pdev);
++			if (ret < 0) {
++				dev_err(&pdev->dev, "Custom probe failed %d\n",
++						ret);
++				return ret;
++			}
++		}
++
++		pr_debug("%s card: %s dai: %s stream: %s\n", __func__,
++				snd_rpi_wm8804.name,
++				dai->name, dai->stream_name);
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev, &snd_rpi_wm8804);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev, "Failed to register card %d\n", ret);
++
++	return ret;
++}
++
++static struct platform_driver snd_rpi_wm8804_driver = {
++	.driver = {
++		.name           = "snd-rpi-wm8804",
++		.owner          = THIS_MODULE,
++		.of_match_table = snd_rpi_wm8804_of_match,
++	},
++	.probe  = snd_rpi_wm8804_probe,
++};
++MODULE_DEVICE_TABLE(of, snd_rpi_wm8804_of_match);
++
++module_platform_driver(snd_rpi_wm8804_driver);
++
++MODULE_AUTHOR("Tim Gover <tim.gover@raspberrypi.org>");
++MODULE_DESCRIPTION("ASoC Raspberry Pi Hat generic digi driver for WM8804 based cards");
++MODULE_LICENSE("GPL v2");
+--- a/sound/soc/codecs/Kconfig
++++ b/sound/soc/codecs/Kconfig
+@@ -109,6 +109,7 @@ config SND_SOC_ALL_CODECS
+ 	imply SND_SOC_ICS43432
+ 	imply SND_SOC_INNO_RK3036
+ 	imply SND_SOC_ISABELLE
++	imply SND_SOC_I_SABRE_CODEC
+ 	imply SND_SOC_JZ4740_CODEC
+ 	imply SND_SOC_JZ4725B_CODEC
+ 	imply SND_SOC_JZ4760_CODEC
+@@ -116,6 +117,7 @@ config SND_SOC_ALL_CODECS
+ 	imply SND_SOC_LM4857
+ 	imply SND_SOC_LM49453
+ 	imply SND_SOC_LOCHNAGAR_SC
++	imply SND_SOC_MA120X0P
+ 	imply SND_SOC_MAX98088
+ 	imply SND_SOC_MAX98090
+ 	imply SND_SOC_MAX98095
+@@ -156,6 +158,7 @@ config SND_SOC_ALL_CODECS
+ 	imply SND_SOC_PCM179X_SPI
+ 	imply SND_SOC_PCM186X_I2C
+ 	imply SND_SOC_PCM186X_SPI
++	imply SND_SOC_PCM1794A
+ 	imply SND_SOC_PCM3008
+ 	imply SND_SOC_PCM3060_I2C
+ 	imply SND_SOC_PCM3060_SPI
+@@ -234,6 +237,7 @@ config SND_SOC_ALL_CODECS
+ 	imply SND_SOC_TLV320ADCX140
+ 	imply SND_SOC_TLV320AIC23_I2C
+ 	imply SND_SOC_TLV320AIC23_SPI
++	imply SND_SOC_TAS5713
+ 	imply SND_SOC_TLV320AIC26
+ 	imply SND_SOC_TLV320AIC31XX
+ 	imply SND_SOC_TLV320AIC32X4_I2C
+@@ -383,12 +387,12 @@ config SND_SOC_AD193X
+ 	tristate
+ 
+ config SND_SOC_AD193X_SPI
+-	tristate
++	tristate "Analog Devices AU193X CODEC - SPI"
+ 	depends on SPI_MASTER
+ 	select SND_SOC_AD193X
+ 
+ config SND_SOC_AD193X_I2C
+-	tristate
++	tristate "Analog Devices AU193X CODEC - I2C"
+ 	depends on I2C
+ 	select SND_SOC_AD193X
+ 
+@@ -991,6 +995,13 @@ config SND_SOC_LOCHNAGAR_SC
+ 	  This driver support the sound card functionality of the Cirrus
+ 	  Logic Lochnagar audio development board.
+ 
++config SND_SOC_MA120X0P
++	tristate "Infineon Merus(TM) MA120X0P Multilevel Class-D Audio amplifiers"
++	depends on I2C
++	help
++		Enable support for Infineon MA120X0P Multilevel Class-D audio power
++		amplifiers.
++
+ config SND_SOC_MADERA
+ 	tristate
+ 	default y if SND_SOC_CS47L15=y
+@@ -1333,6 +1344,10 @@ config SND_SOC_RT5616
+ 	tristate "Realtek RT5616 CODEC"
+ 	depends on I2C
+ 
++config SND_SOC_PCM1794A
++	tristate
++	depends on I2C
++
+ config SND_SOC_RT5631
+ 	tristate "Realtek ALC5631/RT5631 CODEC"
+ 	depends on I2C
+@@ -1622,6 +1637,9 @@ config SND_SOC_TFA9879
+ 	tristate "NXP Semiconductors TFA9879 amplifier"
+ 	depends on I2C
+ 
++config SND_SOC_TAS5713
++	tristate
++
+ config SND_SOC_TFA989X
+ 	tristate "NXP/Goodix TFA989X (TFA1) amplifiers"
+ 	depends on I2C
+@@ -2168,4 +2186,8 @@ config SND_SOC_LPASS_TX_MACRO
+ 	select SND_SOC_LPASS_MACRO_COMMON
+ 	tristate "Qualcomm TX Macro in LPASS(Low Power Audio SubSystem)"
+ 
++config SND_SOC_I_SABRE_CODEC
++	tristate "Audiophonics I-SABRE Codec"
++	depends on I2C
++
+ endmenu
+--- a/sound/soc/codecs/Makefile
++++ b/sound/soc/codecs/Makefile
+@@ -113,6 +113,7 @@ snd-soc-hda-codec-objs := hda.o hda-dai.
+ snd-soc-ics43432-objs := ics43432.o
+ snd-soc-inno-rk3036-objs := inno_rk3036.o
+ snd-soc-isabelle-objs := isabelle.o
++snd-soc-i-sabre-codec-objs := i-sabre-codec.o
+ snd-soc-jz4740-codec-objs := jz4740.o
+ snd-soc-jz4725b-codec-objs := jz4725b.o
+ snd-soc-jz4760-codec-objs := jz4760.o
+@@ -126,6 +127,7 @@ snd-soc-lpass-rx-macro-objs := lpass-rx-
+ snd-soc-lpass-tx-macro-objs := lpass-tx-macro.o
+ snd-soc-lpass-wsa-macro-objs := lpass-wsa-macro.o
+ snd-soc-lpass-va-macro-objs := lpass-va-macro.o
++snd-soc-ma120x0p-objs := ma120x0p.o
+ snd-soc-madera-objs := madera.o
+ snd-soc-max9759-objs := max9759.o
+ snd-soc-max9768-objs := max9768.o
+@@ -172,6 +174,7 @@ snd-soc-pcm179x-spi-objs := pcm179x-spi.
+ snd-soc-pcm186x-objs := pcm186x.o
+ snd-soc-pcm186x-i2c-objs := pcm186x-i2c.o
+ snd-soc-pcm186x-spi-objs := pcm186x-spi.o
++snd-soc-pcm1794a-objs := pcm1794a.o
+ snd-soc-pcm3008-objs := pcm3008.o
+ snd-soc-pcm3060-objs := pcm3060.o
+ snd-soc-pcm3060-i2c-objs := pcm3060-i2c.o
+@@ -256,6 +259,7 @@ snd-soc-tas6424-objs := tas6424.o
+ snd-soc-tda7419-objs := tda7419.o
+ snd-soc-tas2770-objs := tas2770.o
+ snd-soc-tfa9879-objs := tfa9879.o
++snd-soc-tas5713-objs := tas5713.o
+ snd-soc-tfa989x-objs := tfa989x.o
+ snd-soc-tlv320adc3xxx-objs := tlv320adc3xxx.o
+ snd-soc-tlv320aic23-objs := tlv320aic23.o
+@@ -474,6 +478,7 @@ obj-$(CONFIG_SND_SOC_HDA) += snd-soc-hda
+ obj-$(CONFIG_SND_SOC_ICS43432)	+= snd-soc-ics43432.o
+ obj-$(CONFIG_SND_SOC_INNO_RK3036)	+= snd-soc-inno-rk3036.o
+ obj-$(CONFIG_SND_SOC_ISABELLE)	+= snd-soc-isabelle.o
++obj-$(CONFIG_SND_SOC_I_SABRE_CODEC)	+= snd-soc-i-sabre-codec.o
+ obj-$(CONFIG_SND_SOC_JZ4740_CODEC)	+= snd-soc-jz4740-codec.o
+ obj-$(CONFIG_SND_SOC_JZ4725B_CODEC)	+= snd-soc-jz4725b-codec.o
+ obj-$(CONFIG_SND_SOC_JZ4760_CODEC)      += snd-soc-jz4760-codec.o
+@@ -482,6 +487,7 @@ obj-$(CONFIG_SND_SOC_L3)	+= snd-soc-l3.o
+ obj-$(CONFIG_SND_SOC_LM4857)	+= snd-soc-lm4857.o
+ obj-$(CONFIG_SND_SOC_LM49453)   += snd-soc-lm49453.o
+ obj-$(CONFIG_SND_SOC_LOCHNAGAR_SC)	+= snd-soc-lochnagar-sc.o
++obj-$(CONFIG_SND_SOC_MA120X0P)   += snd-soc-ma120x0p.o
+ obj-$(CONFIG_SND_SOC_MADERA)	+= snd-soc-madera.o
+ obj-$(CONFIG_SND_SOC_MAX9759)	+= snd-soc-max9759.o
+ obj-$(CONFIG_SND_SOC_MAX9768)	+= snd-soc-max9768.o
+@@ -539,6 +545,7 @@ obj-$(CONFIG_SND_SOC_PCM5102A)	+= snd-so
+ obj-$(CONFIG_SND_SOC_PCM512x)	+= snd-soc-pcm512x.o
+ obj-$(CONFIG_SND_SOC_PCM512x_I2C)	+= snd-soc-pcm512x-i2c.o
+ obj-$(CONFIG_SND_SOC_PCM512x_SPI)	+= snd-soc-pcm512x-spi.o
++obj-$(CONFIG_SND_SOC_PCM1794A)	+= snd-soc-pcm1794a.o
+ obj-$(CONFIG_SND_SOC_RK3328)	+= snd-soc-rk3328.o
+ obj-$(CONFIG_SND_SOC_RK817)	+= snd-soc-rk817.o
+ obj-$(CONFIG_SND_SOC_RL6231)	+= snd-soc-rl6231.o
+@@ -613,6 +620,7 @@ obj-$(CONFIG_SND_SOC_TAS5805M)	+= snd-so
+ obj-$(CONFIG_SND_SOC_TAS6424)	+= snd-soc-tas6424.o
+ obj-$(CONFIG_SND_SOC_TDA7419)	+= snd-soc-tda7419.o
+ obj-$(CONFIG_SND_SOC_TAS2770) += snd-soc-tas2770.o
++obj-$(CONFIG_SND_SOC_TAS5713)	+= snd-soc-tas5713.o
+ obj-$(CONFIG_SND_SOC_TFA9879)	+= snd-soc-tfa9879.o
+ obj-$(CONFIG_SND_SOC_TFA989X)	+= snd-soc-tfa989x.o
+ obj-$(CONFIG_SND_SOC_TLV320ADC3XXX)	+= snd-soc-tlv320adc3xxx.o
+--- a/sound/soc/codecs/cs42xx8-i2c.c
++++ b/sound/soc/codecs/cs42xx8-i2c.c
+@@ -42,11 +42,18 @@ static struct i2c_device_id cs42xx8_i2c_
+ };
+ MODULE_DEVICE_TABLE(i2c, cs42xx8_i2c_id);
+ 
++const struct of_device_id cs42xx8_i2c_of_match[] = {
++	{ .compatible = "cirrus,cs42448", .data = &cs42448_data, },
++	{ .compatible = "cirrus,cs42888", .data = &cs42888_data, },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, cs42xx8_i2c_of_match);
++
+ static struct i2c_driver cs42xx8_i2c_driver = {
+ 	.driver = {
+ 		.name = "cs42xx8",
+ 		.pm = &cs42xx8_pm,
+-		.of_match_table = cs42xx8_of_match,
++		.of_match_table = cs42xx8_i2c_of_match,
+ 	},
+ 	.probe_new = cs42xx8_i2c_probe,
+ 	.remove = cs42xx8_i2c_remove,
+--- a/sound/soc/codecs/cs42xx8.c
++++ b/sound/soc/codecs/cs42xx8.c
+@@ -516,8 +516,10 @@ const struct of_device_id cs42xx8_of_mat
+ 	{ .compatible = "cirrus,cs42888", .data = &cs42888_data, },
+ 	{ /* sentinel */ }
+ };
++#if !IS_ENABLED(CONFIG_SND_SOC_CS42XX8_I2C)
+ MODULE_DEVICE_TABLE(of, cs42xx8_of_match);
+ EXPORT_SYMBOL_GPL(cs42xx8_of_match);
++#endif
+ 
+ int cs42xx8_probe(struct device *dev, struct regmap *regmap)
+ {
+--- /dev/null
++++ b/sound/soc/codecs/i-sabre-codec.c
+@@ -0,0 +1,390 @@
++/*
++ * Driver for I-Sabre Q2M
++ *
++ * Author: Satoru Kawase
++ * Modified by: Xiao Qingyong
++ * Modified by: JC BARBAUD (Mute)
++ * Update kernel v4.18+ by : Audiophonics
++ * 		Copyright 2018 Audiophonics
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/regmap.h>
++#include <linux/i2c.h>
++#include <sound/soc.h>
++#include <sound/pcm_params.h>
++#include <sound/tlv.h>
++
++#include "i-sabre-codec.h"
++
++
++/* I-Sabre Q2M Codec Private Data */
++struct i_sabre_codec_priv {
++	struct regmap *regmap;
++	unsigned int fmt;
++};
++
++
++/* I-Sabre Q2M Codec Default Register Value */
++static const struct reg_default i_sabre_codec_reg_defaults[] = {
++	{ ISABRECODEC_REG_10, 0x00 },
++	{ ISABRECODEC_REG_20, 0x00 },
++	{ ISABRECODEC_REG_21, 0x00 },
++	{ ISABRECODEC_REG_22, 0x00 },
++	{ ISABRECODEC_REG_24, 0x00 },
++};
++
++
++static bool i_sabre_codec_writeable(struct device *dev, unsigned int reg)
++{
++	switch (reg) {
++	case ISABRECODEC_REG_10:
++	case ISABRECODEC_REG_20:
++	case ISABRECODEC_REG_21:
++	case ISABRECODEC_REG_22:
++	case ISABRECODEC_REG_24:
++		return true;
++
++	default:
++		return false;
++	}
++}
++
++static bool i_sabre_codec_readable(struct device *dev, unsigned int reg)
++{
++	switch (reg) {
++	case ISABRECODEC_REG_01:
++	case ISABRECODEC_REG_02:
++	case ISABRECODEC_REG_10:
++	case ISABRECODEC_REG_20:
++	case ISABRECODEC_REG_21:
++	case ISABRECODEC_REG_22:
++	case ISABRECODEC_REG_24:
++		return true;
++
++	default:
++		return false;
++	}
++}
++
++static bool i_sabre_codec_volatile(struct device *dev, unsigned int reg)
++{
++	switch (reg) {
++	case ISABRECODEC_REG_01:
++	case ISABRECODEC_REG_02:
++		return true;
++
++	default:
++		return false;
++	}
++}
++
++
++/* Volume Scale */
++static const DECLARE_TLV_DB_SCALE(volume_tlv, -10000, 100, 0);
++
++
++/* Filter Type */
++static const char * const fir_filter_type_texts[] = {
++	"brick wall",
++	"corrected minimum phase fast",
++	"minimum phase slow",
++	"minimum phase fast",
++	"linear phase slow",
++	"linear phase fast",
++	"apodizing fast",
++};
++
++static SOC_ENUM_SINGLE_DECL(i_sabre_fir_filter_type_enum,
++				ISABRECODEC_REG_22, 0, fir_filter_type_texts);
++
++
++/* I2S / SPDIF Select */
++static const char * const iis_spdif_sel_texts[] = {
++	"I2S",
++	"SPDIF",
++};
++
++static SOC_ENUM_SINGLE_DECL(i_sabre_iis_spdif_sel_enum,
++				ISABRECODEC_REG_24, 0, iis_spdif_sel_texts);
++
++
++/* Control */
++static const struct snd_kcontrol_new i_sabre_codec_controls[] = {
++SOC_SINGLE_RANGE_TLV("Digital Playback Volume", ISABRECODEC_REG_20, 0, 0, 100, 1, volume_tlv),
++SOC_SINGLE("Digital Playback Switch", ISABRECODEC_REG_21, 0, 1, 1),
++SOC_ENUM("FIR Filter Type", i_sabre_fir_filter_type_enum),
++SOC_ENUM("I2S/SPDIF Select", i_sabre_iis_spdif_sel_enum),
++};
++
++
++static const u32 i_sabre_codec_dai_rates_slave[] = {
++	8000, 11025, 16000, 22050, 32000,
++	44100, 48000, 64000, 88200, 96000,
++	176400, 192000, 352800, 384000,
++	705600, 768000, 1411200, 1536000
++};
++
++static const struct snd_pcm_hw_constraint_list constraints_slave = {
++	.list  = i_sabre_codec_dai_rates_slave,
++	.count = ARRAY_SIZE(i_sabre_codec_dai_rates_slave),
++};
++
++static int i_sabre_codec_dai_startup_slave(
++		struct snd_pcm_substream *substream, struct snd_soc_dai *dai)
++{
++	struct snd_soc_component *component = dai->component;
++	int ret;
++
++	ret = snd_pcm_hw_constraint_list(substream->runtime,
++			0, SNDRV_PCM_HW_PARAM_RATE, &constraints_slave);
++	if (ret != 0) {
++		dev_err(component->card->dev, "Failed to setup rates constraints: %d\n", ret);
++	}
++
++	return ret;
++}
++
++static int i_sabre_codec_dai_startup(
++		struct snd_pcm_substream *substream, struct snd_soc_dai *dai)
++{
++	struct snd_soc_component      *component = dai->component;
++	struct i_sabre_codec_priv *i_sabre_codec
++					= snd_soc_component_get_drvdata(component);
++
++	switch (i_sabre_codec->fmt & SND_SOC_DAIFMT_MASTER_MASK) {
++	case SND_SOC_DAIFMT_CBS_CFS:
++		return i_sabre_codec_dai_startup_slave(substream, dai);
++
++	default:
++		return (-EINVAL);
++	}
++}
++
++static int i_sabre_codec_hw_params(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params,
++	struct snd_soc_dai *dai)
++{
++	struct snd_soc_component      *component = dai->component;
++	struct i_sabre_codec_priv *i_sabre_codec
++					= snd_soc_component_get_drvdata(component);
++	unsigned int daifmt;
++	int format_width;
++
++	dev_dbg(component->card->dev, "hw_params %u Hz, %u channels\n",
++			params_rate(params), params_channels(params));
++
++	/* Check I2S Format (Bit Size) */
++	format_width = snd_pcm_format_width(params_format(params));
++	if ((format_width != 32) && (format_width != 16)) {
++		dev_err(component->card->dev, "Bad frame size: %d\n",
++				snd_pcm_format_width(params_format(params)));
++		return (-EINVAL);
++	}
++
++	/* Check Slave Mode */
++	daifmt = i_sabre_codec->fmt & SND_SOC_DAIFMT_MASTER_MASK;
++	if (daifmt != SND_SOC_DAIFMT_CBS_CFS) {
++		return (-EINVAL);
++	}
++
++	/* Notify Sampling Frequency  */
++	switch (params_rate(params))
++	{
++	case 44100:
++	case 48000:
++	case 88200:
++	case 96000:
++	case 176400:
++	case 192000:
++		snd_soc_component_update_bits(component, ISABRECODEC_REG_10, 0x01, 0x00);
++		break;
++
++	case 352800:
++	case 384000:
++	case 705600:
++	case 768000:
++	case 1411200:
++	case 1536000:
++		snd_soc_component_update_bits(component, ISABRECODEC_REG_10, 0x01, 0x01);
++		break;
++	}
++
++	return 0;
++}
++
++static int i_sabre_codec_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
++{
++	struct snd_soc_component      *component = dai->component;
++	struct i_sabre_codec_priv *i_sabre_codec
++					= snd_soc_component_get_drvdata(component);
++
++	/* interface format */
++	switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
++	case SND_SOC_DAIFMT_I2S:
++		break;
++
++	case SND_SOC_DAIFMT_RIGHT_J:
++	case SND_SOC_DAIFMT_LEFT_J:
++	default:
++		return (-EINVAL);
++	}
++
++	/* clock inversion */
++	if ((fmt & SND_SOC_DAIFMT_INV_MASK) != SND_SOC_DAIFMT_NB_NF) {
++		return (-EINVAL);
++	}
++
++	/* Set Audio Data Format */
++	i_sabre_codec->fmt = fmt;
++
++	return 0;
++}
++
++static int i_sabre_codec_dac_mute(struct snd_soc_dai *dai, int mute, int direction)
++{
++	struct snd_soc_component *component = dai->component;
++
++	if (mute) {
++		snd_soc_component_update_bits(component, ISABRECODEC_REG_21, 0x01, 0x01);
++	} else {
++		snd_soc_component_update_bits(component, ISABRECODEC_REG_21, 0x01, 0x00);
++	}
++
++	return 0;
++}
++
++
++static const struct snd_soc_dai_ops i_sabre_codec_dai_ops = {
++	.startup      = i_sabre_codec_dai_startup,
++	.hw_params    = i_sabre_codec_hw_params,
++	.set_fmt      = i_sabre_codec_set_fmt,
++	.mute_stream  = i_sabre_codec_dac_mute,
++};
++
++static struct snd_soc_dai_driver i_sabre_codec_dai = {
++	.name = "i-sabre-codec-dai",
++	.playback = {
++		.stream_name  = "Playback",
++		.channels_min = 2,
++		.channels_max = 2,
++		.rates = SNDRV_PCM_RATE_CONTINUOUS,
++		.rate_min = 8000,
++		.rate_max = 1536000,
++		.formats      = SNDRV_PCM_FMTBIT_S16_LE
++				| SNDRV_PCM_FMTBIT_S32_LE,
++	},
++	.ops = &i_sabre_codec_dai_ops,
++};
++
++static struct snd_soc_component_driver i_sabre_codec_codec_driver = {
++		.controls         = i_sabre_codec_controls,
++		.num_controls     = ARRAY_SIZE(i_sabre_codec_controls),
++};
++
++
++static const struct regmap_config i_sabre_codec_regmap = {
++	.reg_bits         = 8,
++	.val_bits         = 8,
++	.max_register     = ISABRECODEC_MAX_REG,
++
++	.reg_defaults     = i_sabre_codec_reg_defaults,
++	.num_reg_defaults = ARRAY_SIZE(i_sabre_codec_reg_defaults),
++
++	.writeable_reg    = i_sabre_codec_writeable,
++	.readable_reg     = i_sabre_codec_readable,
++	.volatile_reg     = i_sabre_codec_volatile,
++
++	.cache_type       = REGCACHE_RBTREE,
++};
++
++
++static int i_sabre_codec_probe(struct device *dev, struct regmap *regmap)
++{
++	struct i_sabre_codec_priv *i_sabre_codec;
++	int ret;
++
++	i_sabre_codec = devm_kzalloc(dev, sizeof(*i_sabre_codec), GFP_KERNEL);
++	if (!i_sabre_codec) {
++		dev_err(dev, "devm_kzalloc");
++		return (-ENOMEM);
++	}
++
++	i_sabre_codec->regmap = regmap;
++
++	dev_set_drvdata(dev, i_sabre_codec);
++
++	ret = snd_soc_register_component(dev,
++			&i_sabre_codec_codec_driver, &i_sabre_codec_dai, 1);
++	if (ret != 0) {
++		dev_err(dev, "Failed to register CODEC: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++static void i_sabre_codec_remove(struct device *dev)
++{
++	snd_soc_unregister_component(dev);
++}
++
++
++static int i_sabre_codec_i2c_probe(
++		struct i2c_client *i2c, const struct i2c_device_id *id)
++{
++	struct regmap *regmap;
++
++	regmap = devm_regmap_init_i2c(i2c, &i_sabre_codec_regmap);
++	if (IS_ERR(regmap)) {
++		return PTR_ERR(regmap);
++	}
++
++	return i_sabre_codec_probe(&i2c->dev, regmap);
++}
++
++static void i_sabre_codec_i2c_remove(struct i2c_client *i2c)
++{
++	i_sabre_codec_remove(&i2c->dev);
++}
++
++
++static const struct i2c_device_id i_sabre_codec_i2c_id[] = {
++	{ "i-sabre-codec", },
++	{ }
++};
++MODULE_DEVICE_TABLE(i2c, i_sabre_codec_i2c_id);
++
++static const struct of_device_id i_sabre_codec_of_match[] = {
++	{ .compatible = "audiophonics,i-sabre-codec", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, i_sabre_codec_of_match);
++
++static struct i2c_driver i_sabre_codec_i2c_driver = {
++	.driver = {
++		.name           = "i-sabre-codec-i2c",
++		.owner          = THIS_MODULE,
++		.of_match_table = of_match_ptr(i_sabre_codec_of_match),
++	},
++	.probe    = i_sabre_codec_i2c_probe,
++	.remove   = i_sabre_codec_i2c_remove,
++	.id_table = i_sabre_codec_i2c_id,
++};
++module_i2c_driver(i_sabre_codec_i2c_driver);
++
++
++MODULE_DESCRIPTION("ASoC I-Sabre Q2M codec driver");
++MODULE_AUTHOR("Audiophonics <http://www.audiophonics.fr>");
++MODULE_LICENSE("GPL");
+--- /dev/null
++++ b/sound/soc/codecs/i-sabre-codec.h
+@@ -0,0 +1,42 @@
++/*
++ * Driver for I-Sabre Q2M
++ *
++ * Author: Satoru Kawase
++ * Modified by: Xiao Qingyong
++ *      Copyright 2018 Audiophonics
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#ifndef _SND_SOC_ISABRECODEC
++#define _SND_SOC_ISABRECODEC
++
++
++/* ISABRECODEC Register Address */
++#define ISABRECODEC_REG_01	0x01	/* Virtual Device ID  :  0x01 = es9038q2m */
++#define ISABRECODEC_REG_02	0x02	/* API revision       :  0x01 = Revision 01 */
++#define ISABRECODEC_REG_10	0x10	/* 0x01 = above 192kHz, 0x00 = otherwise */
++#define ISABRECODEC_REG_20	0x20	/* 0 - 100 (decimal value, 0 = min., 100 = max.) */
++#define ISABRECODEC_REG_21	0x21	/* 0x00 = Mute OFF, 0x01 = Mute ON */
++#define ISABRECODEC_REG_22	0x22	
++/*
++   0x00 = brick wall,
++   0x01 = corrected minimum phase fast,
++   0x02 = minimum phase slow,
++   0x03 = minimum phase fast,
++   0x04 = linear phase slow,
++   0x05 = linear phase fast,
++   0x06 = apodizing fast,
++*/
++//#define ISABRECODEC_REG_23	0x23	/* reserved */
++#define ISABRECODEC_REG_24	0x24	/* 0x00 = I2S, 0x01 = SPDIF */
++#define ISABRECODEC_MAX_REG	0x24	/* Maximum Register Number */
++
++#endif /* _SND_SOC_ISABRECODEC */
+--- /dev/null
++++ b/sound/soc/codecs/ma120x0p.c
+@@ -0,0 +1,1381 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * ASoC Driver for Infineon Merus(TM) ma120x0p multi-level class-D amplifier
++ *
++ * Authors:	Ariel Muszkat <ariel.muszkat@gmail.com>
++ * Jorgen Kragh Jakobsen <jorgen.kraghjakobsen@infineon.com>
++ *
++ * Copyright (C) 2019 Infineon Technologies AG
++ *
++ */
++#include <linux/module.h>
++#include <linux/moduleparam.h>
++#include <linux/init.h>
++#include <linux/delay.h>
++#include <linux/pm_runtime.h>
++#include <linux/i2c.h>
++#include <linux/of_device.h>
++#include <linux/spi/spi.h>
++#include <linux/regmap.h>
++#include <linux/regulator/consumer.h>
++#include <linux/slab.h>
++#include <linux/gpio/consumer.h>
++#include <linux/gpio.h>
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/soc-dapm.h>
++#include <sound/initval.h>
++#include <sound/tlv.h>
++#include <linux/interrupt.h>
++
++#include <linux/kernel.h>
++#include <linux/string.h>
++#include <linux/fs.h>
++#include <linux/uaccess.h>
++
++#ifndef _MA120X0P_
++#define _MA120X0P_
++//------------------------------------------------------------------manualPM---
++// Select Manual PowerMode control
++#define ma_manualpm__a 0
++#define ma_manualpm__len 1
++#define ma_manualpm__mask 0x40
++#define ma_manualpm__shift 0x06
++#define ma_manualpm__reset 0x00
++//--------------------------------------------------------------------pm_man---
++// manual selected power mode
++#define ma_pm_man__a 0
++#define ma_pm_man__len 2
++#define ma_pm_man__mask 0x30
++#define ma_pm_man__shift 0x04
++#define ma_pm_man__reset 0x03
++//------------------------------------------ ----------------------mthr_1to2---
++// mod. index threshold value for pm1=>pm2 change.
++#define ma_mthr_1to2__a 1
++#define ma_mthr_1to2__len 8
++#define ma_mthr_1to2__mask 0xff
++#define ma_mthr_1to2__shift 0x00
++#define ma_mthr_1to2__reset 0x3c
++//-----------------------------------------------------------------mthr_2to1---
++// mod. index threshold value for pm2=>pm1 change.
++#define ma_mthr_2to1__a 2
++#define ma_mthr_2to1__len 8
++#define ma_mthr_2to1__mask 0xff
++#define ma_mthr_2to1__shift 0x00
++#define ma_mthr_2to1__reset 0x32
++//-----------------------------------------------------------------mthr_2to3---
++// mod. index threshold value for pm2=>pm3 change.
++#define ma_mthr_2to3__a 3
++#define ma_mthr_2to3__len 8
++#define ma_mthr_2to3__mask 0xff
++#define ma_mthr_2to3__shift 0x00
++#define ma_mthr_2to3__reset 0x5a
++//-----------------------------------------------------------------mthr_3to2---
++// mod. index threshold value for pm3=>pm2 change.
++#define ma_mthr_3to2__a 4
++#define ma_mthr_3to2__len 8
++#define ma_mthr_3to2__mask 0xff
++#define ma_mthr_3to2__shift 0x00
++#define ma_mthr_3to2__reset 0x50
++//-------------------------------------------------------------pwmclkdiv_nom---
++// pwm default clock divider value
++#define ma_pwmclkdiv_nom__a 8
++#define ma_pwmclkdiv_nom__len 8
++#define ma_pwmclkdiv_nom__mask 0xff
++#define ma_pwmclkdiv_nom__shift 0x00
++#define ma_pwmclkdiv_nom__reset 0x26
++//--------- ----------------------------------------------------ocp_latch_en---
++// high to use permanently latching level-2 ocp
++#define ma_ocp_latch_en__a 10
++#define ma_ocp_latch_en__len 1
++#define ma_ocp_latch_en__mask 0x02
++#define ma_ocp_latch_en__shift 0x01
++#define ma_ocp_latch_en__reset 0x00
++//---------------------------------------------------------------lf_clamp_en---
++// high (default) to enable lf int2+3 clamping on clip
++#define ma_lf_clamp_en__a 10
++#define ma_lf_clamp_en__len 1
++#define ma_lf_clamp_en__mask 0x80
++#define ma_lf_clamp_en__shift 0x07
++#define ma_lf_clamp_en__reset 0x00
++//-------------------------------------------------------pmcfg_btl_b.modtype---
++//
++#define ma_pmcfg_btl_b__modtype__a 18
++#define ma_pmcfg_btl_b__modtype__len 2
++#define ma_pmcfg_btl_b__modtype__mask 0x18
++#define ma_pmcfg_btl_b__modtype__shift 0x03
++#define ma_pmcfg_btl_b__modtype__reset 0x02
++//-------------------------------------------------------pmcfg_btl_b.freqdiv---
++#define ma_pmcfg_btl_b__freqdiv__a 18
++#define ma_pmcfg_btl_b__freqdiv__len 2
++#define ma_pmcfg_btl_b__freqdiv__mask 0x06
++#define ma_pmcfg_btl_b__freqdiv__shift 0x01
++#define ma_pmcfg_btl_b__freqdiv__reset 0x01
++//----------------------------------------------------pmcfg_btl_b.lf_gain_ol---
++//
++#define ma_pmcfg_btl_b__lf_gain_ol__a 18
++#define ma_pmcfg_btl_b__lf_gain_ol__len 1
++#define ma_pmcfg_btl_b__lf_gain_ol__mask 0x01
++#define ma_pmcfg_btl_b__lf_gain_ol__shift 0x00
++#define ma_pmcfg_btl_b__lf_gain_ol__reset 0x01
++//-------------------------------------------------------pmcfg_btl_c.freqdiv---
++//
++#define ma_pmcfg_btl_c__freqdiv__a 19
++#define ma_pmcfg_btl_c__freqdiv__len 2
++#define ma_pmcfg_btl_c__freqdiv__mask 0x06
++#define ma_pmcfg_btl_c__freqdiv__shift 0x01
++#define ma_pmcfg_btl_c__freqdiv__reset 0x01
++//-------------------------------------------------------pmcfg_btl_c.modtype---
++//
++#define ma_pmcfg_btl_c__modtype__a 19
++#define ma_pmcfg_btl_c__modtype__len 2
++#define ma_pmcfg_btl_c__modtype__mask 0x18
++#define ma_pmcfg_btl_c__modtype__shift 0x03
++#define ma_pmcfg_btl_c__modtype__reset 0x01
++//----------------------------------------------------pmcfg_btl_c.lf_gain_ol---
++//
++#define ma_pmcfg_btl_c__lf_gain_ol__a 19
++#define ma_pmcfg_btl_c__lf_gain_ol__len 1
++#define ma_pmcfg_btl_c__lf_gain_ol__mask 0x01
++#define ma_pmcfg_btl_c__lf_gain_ol__shift 0x00
++#define ma_pmcfg_btl_c__lf_gain_ol__reset 0x00
++//-------------------------------------------------------pmcfg_btl_d.modtype---
++//
++#define ma_pmcfg_btl_d__modtype__a 20
++#define ma_pmcfg_btl_d__modtype__len 2
++#define ma_pmcfg_btl_d__modtype__mask 0x18
++#define ma_pmcfg_btl_d__modtype__shift 0x03
++#define ma_pmcfg_btl_d__modtype__reset 0x02
++//-------------------------------------------------------pmcfg_btl_d.freqdiv---
++//
++#define ma_pmcfg_btl_d__freqdiv__a 20
++#define ma_pmcfg_btl_d__freqdiv__len 2
++#define ma_pmcfg_btl_d__freqdiv__mask 0x06
++#define ma_pmcfg_btl_d__freqdiv__shift 0x01
++#define ma_pmcfg_btl_d__freqdiv__reset 0x02
++//----------------------------------------------------pmcfg_btl_d.lf_gain_ol---
++//
++#define ma_pmcfg_btl_d__lf_gain_ol__a 20
++#define ma_pmcfg_btl_d__lf_gain_ol__len 1
++#define ma_pmcfg_btl_d__lf_gain_ol__mask 0x01
++#define ma_pmcfg_btl_d__lf_gain_ol__shift 0x00
++#define ma_pmcfg_btl_d__lf_gain_ol__reset 0x00
++//------------ -------------------------------------------pmcfg_se_a.modtype---
++//
++#define ma_pmcfg_se_a__modtype__a 21
++#define ma_pmcfg_se_a__modtype__len 2
++#define ma_pmcfg_se_a__modtype__mask 0x18
++#define ma_pmcfg_se_a__modtype__shift 0x03
++#define ma_pmcfg_se_a__modtype__reset 0x01
++//--------------------------------------------------------pmcfg_se_a.freqdiv---
++//
++#define ma_pmcfg_se_a__freqdiv__a 21
++#define ma_pmcfg_se_a__freqdiv__len 2
++#define ma_pmcfg_se_a__freqdiv__mask 0x06
++#define ma_pmcfg_se_a__freqdiv__shift 0x01
++#define ma_pmcfg_se_a__freqdiv__reset 0x00
++//-----------------------------------------------------pmcfg_se_a.lf_gain_ol---
++//
++#define ma_pmcfg_se_a__lf_gain_ol__a 21
++#define ma_pmcfg_se_a__lf_gain_ol__len 1
++#define ma_pmcfg_se_a__lf_gain_ol__mask 0x01
++#define ma_pmcfg_se_a__lf_gain_ol__shift 0x00
++#define ma_pmcfg_se_a__lf_gain_ol__reset 0x01
++//-----------------------------------------------------pmcfg_se_b.lf_gain_ol---
++//
++#define ma_pmcfg_se_b__lf_gain_ol__a 22
++#define ma_pmcfg_se_b__lf_gain_ol__len 1
++#define ma_pmcfg_se_b__lf_gain_ol__mask 0x01
++#define ma_pmcfg_se_b__lf_gain_ol__shift 0x00
++#define ma_pmcfg_se_b__lf_gain_ol__reset 0x00
++//--------------------------------------------------------pmcfg_se_b.freqdiv---
++//
++#define ma_pmcfg_se_b__freqdiv__a 22
++#define ma_pmcfg_se_b__freqdiv__len 2
++#define ma_pmcfg_se_b__freqdiv__mask 0x06
++#define ma_pmcfg_se_b__freqdiv__shift 0x01
++#define ma_pmcfg_se_b__freqdiv__reset 0x01
++//--------------------------------------------------------pmcfg_se_b.modtype---
++//
++#define ma_pmcfg_se_b__modtype__a 22
++#define ma_pmcfg_se_b__modtype__len 2
++#define ma_pmcfg_se_b__modtype__mask 0x18
++#define ma_pmcfg_se_b__modtype__shift 0x03
++#define ma_pmcfg_se_b__modtype__reset 0x01
++//----------------------------------------------------------balwaitcount_pm1---
++// pm1 balancing period.
++#define ma_balwaitcount_pm1__a 23
++#define ma_balwaitcount_pm1__len 8
++#define ma_balwaitcount_pm1__mask 0xff
++#define ma_balwaitcount_pm1__shift 0x00
++#define ma_balwaitcount_pm1__reset 0x14
++//----------------------------------------------------------balwaitcount_pm2---
++// pm2 balancing period.
++#define ma_balwaitcount_pm2__a 24
++#define ma_balwaitcount_pm2__len 8
++#define ma_balwaitcount_pm2__mask 0xff
++#define ma_balwaitcount_pm2__shift 0x00
++#define ma_balwaitcount_pm2__reset 0x14
++//----------------------------------------------------------balwaitcount_pm3---
++// pm3 balancing period.
++#define ma_balwaitcount_pm3__a 25
++#define ma_balwaitcount_pm3__len 8
++#define ma_balwaitcount_pm3__mask 0xff
++#define ma_balwaitcount_pm3__shift 0x00
++#define ma_balwaitcount_pm3__reset 0x1a
++//-------------------------------------------------------------usespread_pm1---
++// pm1 pwm spread-spectrum mode on/off.
++#define ma_usespread_pm1__a 26
++#define ma_usespread_pm1__len 1
++#define ma_usespread_pm1__mask 0x40
++#define ma_usespread_pm1__shift 0x06
++#define ma_usespread_pm1__reset 0x00
++//---------------------------------------------------------------dtsteps_pm1---
++// pm1 dead time setting [10ns steps].
++#define ma_dtsteps_pm1__a 26
++#define ma_dtsteps_pm1__len 3
++#define ma_dtsteps_pm1__mask 0x38
++#define ma_dtsteps_pm1__shift 0x03
++#define ma_dtsteps_pm1__reset 0x04
++//---------------------------------------------------------------baltype_pm1---
++// pm1 balancing sensor scheme.
++#define ma_baltype_pm1__a 26
++#define ma_baltype_pm1__len 3
++#define ma_baltype_pm1__mask 0x07
++#define ma_baltype_pm1__shift 0x00
++#define ma_baltype_pm1__reset 0x00
++//-------------------------------------------------------------usespread_pm2---
++// pm2 pwm spread-spectrum mode on/off.
++#define ma_usespread_pm2__a 27
++#define ma_usespread_pm2__len 1
++#define ma_usespread_pm2__mask 0x40
++#define ma_usespread_pm2__shift 0x06
++#define ma_usespread_pm2__reset 0x00
++//---------------------------------------------------------------dtsteps_pm2---
++// pm2 dead time setting [10ns steps].
++#define ma_dtsteps_pm2__a 27
++#define ma_dtsteps_pm2__len 3
++#define ma_dtsteps_pm2__mask 0x38
++#define ma_dtsteps_pm2__shift 0x03
++#define ma_dtsteps_pm2__reset 0x03
++//---------------------------------------------------------------baltype_pm2---
++// pm2 balancing sensor scheme.
++#define ma_baltype_pm2__a 27
++#define ma_baltype_pm2__len 3
++#define ma_baltype_pm2__mask 0x07
++#define ma_baltype_pm2__shift 0x00
++#define ma_baltype_pm2__reset 0x01
++//-------------------------------------------------------------usespread_pm3---
++// pm3 pwm spread-spectrum mode on/off.
++#define ma_usespread_pm3__a 28
++#define ma_usespread_pm3__len 1
++#define ma_usespread_pm3__mask 0x40
++#define ma_usespread_pm3__shift 0x06
++#define ma_usespread_pm3__reset 0x00
++//---------------------------------------------------------------dtsteps_pm3---
++// pm3 dead time setting [10ns steps].
++#define ma_dtsteps_pm3__a 28
++#define ma_dtsteps_pm3__len 3
++#define ma_dtsteps_pm3__mask 0x38
++#define ma_dtsteps_pm3__shift 0x03
++#define ma_dtsteps_pm3__reset 0x01
++//---------------------------------------------------------------baltype_pm3---
++// pm3 balancing sensor scheme.
++#define ma_baltype_pm3__a 28
++#define ma_baltype_pm3__len 3
++#define ma_baltype_pm3__mask 0x07
++#define ma_baltype_pm3__shift 0x00
++#define ma_baltype_pm3__reset 0x03
++//-----------------------------------------------------------------pmprofile---
++// pm profile select. valid presets: 0-1-2-3-4. 5=> custom profile.
++#define ma_pmprofile__a 29
++#define ma_pmprofile__len 3
++#define ma_pmprofile__mask 0x07
++#define ma_pmprofile__shift 0x00
++#define ma_pmprofile__reset 0x00
++//-------------------------------------------------------------------pm3_man---
++// custom profile pm3 contents. 0=>a,  1=>b,  2=>c,  3=>d
++#define ma_pm3_man__a 30
++#define ma_pm3_man__len 2
++#define ma_pm3_man__mask 0x30
++#define ma_pm3_man__shift 0x04
++#define ma_pm3_man__reset 0x02
++//-------------------------------------------------------------------pm2_man---
++// custom profile pm2 contents. 0=>a,  1=>b,  2=>c,  3=>d
++#define ma_pm2_man__a 30
++#define ma_pm2_man__len 2
++#define ma_pm2_man__mask 0x0c
++#define ma_pm2_man__shift 0x02
++#define ma_pm2_man__reset 0x03
++//-------------------------------------------------------------------pm1_man---
++// custom profile pm1 contents. 0=>a,  1=>b,  2=>c,  3=>d
++#define ma_pm1_man__a 30
++#define ma_pm1_man__len 2
++#define ma_pm1_man__mask 0x03
++#define ma_pm1_man__shift 0x00
++#define ma_pm1_man__reset 0x03
++//-----------------------------------------------------------ocp_latch_clear---
++// low-high clears current ocp latched condition.
++#define ma_ocp_latch_clear__a 32
++#define ma_ocp_latch_clear__len 1
++#define ma_ocp_latch_clear__mask 0x80
++#define ma_ocp_latch_clear__shift 0x07
++#define ma_ocp_latch_clear__reset 0x00
++//-------------------------------------------------------------audio_in_mode---
++// audio input mode; 0-1-2-3-4-5
++#define ma_audio_in_mode__a 37
++#define ma_audio_in_mode__len 3
++#define ma_audio_in_mode__mask 0xe0
++#define ma_audio_in_mode__shift 0x05
++#define ma_audio_in_mode__reset 0x00
++//-----------------------------------------------------------------eh_dcshdn---
++// high to enable dc protection
++#define ma_eh_dcshdn__a 38
++#define ma_eh_dcshdn__len 1
++#define ma_eh_dcshdn__mask 0x04
++#define ma_eh_dcshdn__shift 0x02
++#define ma_eh_dcshdn__reset 0x01
++//---------------------------------------------------------audio_in_mode_ext---
++// if set,  audio_in_mode is controlled from audio_in_mode register. if not set
++//audio_in_mode is set from fuse bank setting
++#define ma_audio_in_mode_ext__a 39
++#define ma_audio_in_mode_ext__len 1
++#define ma_audio_in_mode_ext__mask 0x20
++#define ma_audio_in_mode_ext__shift 0x05
++#define ma_audio_in_mode_ext__reset 0x00
++//------------------------------------------------------------------eh_clear---
++// flip to clear error registers
++#define ma_eh_clear__a 45
++#define ma_eh_clear__len 1
++#define ma_eh_clear__mask 0x04
++#define ma_eh_clear__shift 0x02
++#define ma_eh_clear__reset 0x00
++//----------------------------------------------------------thermal_compr_en---
++// enable otw-contr.  input compression?
++#define ma_thermal_compr_en__a 45
++#define ma_thermal_compr_en__len 1
++#define ma_thermal_compr_en__mask 0x20
++#define ma_thermal_compr_en__shift 0x05
++#define ma_thermal_compr_en__reset 0x01
++//---------------------------------------------------------------system_mute---
++// 1 = mute system,  0 = normal operation
++#define ma_system_mute__a 45
++#define ma_system_mute__len 1
++#define ma_system_mute__mask 0x40
++#define ma_system_mute__shift 0x06
++#define ma_system_mute__reset 0x00
++//------------------------------------------------------thermal_compr_max_db---
++// audio limiter max thermal reduction
++#define ma_thermal_compr_max_db__a 46
++#define ma_thermal_compr_max_db__len 3
++#define ma_thermal_compr_max_db__mask 0x07
++#define ma_thermal_compr_max_db__shift 0x00
++#define ma_thermal_compr_max_db__reset 0x04
++//---------------------------------------------------------audio_proc_enable---
++// enable audio proc,  bypass if not enabled
++#define ma_audio_proc_enable__a 53
++#define ma_audio_proc_enable__len 1
++#define ma_audio_proc_enable__mask 0x08
++#define ma_audio_proc_enable__shift 0x03
++#define ma_audio_proc_enable__reset 0x00
++//--------------------------------------------------------audio_proc_release---
++// 00:slow,  01:normal,  10:fast
++#define ma_audio_proc_release__a 53
++#define ma_audio_proc_release__len 2
++#define ma_audio_proc_release__mask 0x30
++#define ma_audio_proc_release__shift 0x04
++#define ma_audio_proc_release__reset 0x00
++//---------------------------------------------------------audio_proc_attack---
++// 00:slow,  01:normal,  10:fast
++#define ma_audio_proc_attack__a 53
++#define ma_audio_proc_attack__len 2
++#define ma_audio_proc_attack__mask 0xc0
++#define ma_audio_proc_attack__shift 0x06
++#define ma_audio_proc_attack__reset 0x00
++//----------------------------------------------------------------i2s_format---
++// i2s basic data format,  000 = std. i2s,  001 = left justified (default)
++#define ma_i2s_format__a 53
++#define ma_i2s_format__len 3
++#define ma_i2s_format__mask 0x07
++#define ma_i2s_format__shift 0x00
++#define ma_i2s_format__reset 0x01
++//--------------------------------------------------audio_proc_limiterenable---
++// 1: enable limiter,  0: disable limiter
++#define ma_audio_proc_limiterenable__a 54
++#define ma_audio_proc_limiterenable__len 1
++#define ma_audio_proc_limiterenable__mask 0x40
++#define ma_audio_proc_limiterenable__shift 0x06
++#define ma_audio_proc_limiterenable__reset 0x00
++//-----------------------------------------------------------audio_proc_mute---
++// 1: mute,  0: unmute
++#define ma_audio_proc_mute__a 54
++#define ma_audio_proc_mute__len 1
++#define ma_audio_proc_mute__mask 0x80
++#define ma_audio_proc_mute__shift 0x07
++#define ma_audio_proc_mute__reset 0x00
++//---------------------------------------------------------------i2s_sck_pol---
++// i2s sck polarity cfg. 0 = rising edge data change
++#define ma_i2s_sck_pol__a 54
++#define ma_i2s_sck_pol__len 1
++#define ma_i2s_sck_pol__mask 0x01
++#define ma_i2s_sck_pol__shift 0x00
++#define ma_i2s_sck_pol__reset 0x01
++//-------------------------------------------------------------i2s_framesize---
++// i2s word length. 00 = 32bit,  01 = 24bit
++#define ma_i2s_framesize__a 54
++#define ma_i2s_framesize__len 2
++#define ma_i2s_framesize__mask 0x18
++#define ma_i2s_framesize__shift 0x03
++#define ma_i2s_framesize__reset 0x00
++//----------------------------------------------------------------i2s_ws_pol---
++// i2s ws polarity. 0 = low first
++#define ma_i2s_ws_pol__a 54
++#define ma_i2s_ws_pol__len 1
++#define ma_i2s_ws_pol__mask 0x02
++#define ma_i2s_ws_pol__shift 0x01
++#define ma_i2s_ws_pol__reset 0x00
++//-----------------------------------------------------------------i2s_order---
++// i2s word bit order. 0 = msb first
++#define ma_i2s_order__a 54
++#define ma_i2s_order__len 1
++#define ma_i2s_order__mask 0x04
++#define ma_i2s_order__shift 0x02
++#define ma_i2s_order__reset 0x00
++//------------------------------------------------------------i2s_rightfirst---
++// i2s l/r word order; 0 = left first
++#define ma_i2s_rightfirst__a 54
++#define ma_i2s_rightfirst__len 1
++#define ma_i2s_rightfirst__mask 0x20
++#define ma_i2s_rightfirst__shift 0x05
++#define ma_i2s_rightfirst__reset 0x00
++//-------------------------------------------------------------vol_db_master---
++// master volume db
++#define ma_vol_db_master__a 64
++#define ma_vol_db_master__len 8
++#define ma_vol_db_master__mask 0xff
++#define ma_vol_db_master__shift 0x00
++#define ma_vol_db_master__reset 0x18
++//------------------------------------------------------------vol_lsb_master---
++// master volume lsb 1/4 steps
++#define ma_vol_lsb_master__a 65
++#define ma_vol_lsb_master__len 2
++#define ma_vol_lsb_master__mask 0x03
++#define ma_vol_lsb_master__shift 0x00
++#define ma_vol_lsb_master__reset 0x00
++//----------------------------------------------------------------vol_db_ch0---
++// volume channel 0
++#define ma_vol_db_ch0__a 66
++#define ma_vol_db_ch0__len 8
++#define ma_vol_db_ch0__mask 0xff
++#define ma_vol_db_ch0__shift 0x00
++#define ma_vol_db_ch0__reset 0x18
++//----------------------------------------------------------------vol_db_ch1---
++// volume channel 1
++#define ma_vol_db_ch1__a 67
++#define ma_vol_db_ch1__len 8
++#define ma_vol_db_ch1__mask 0xff
++#define ma_vol_db_ch1__shift 0x00
++#define ma_vol_db_ch1__reset 0x18
++//----------------------------------------------------------------vol_db_ch2---
++// volume channel 2
++#define ma_vol_db_ch2__a 68
++#define ma_vol_db_ch2__len 8
++#define ma_vol_db_ch2__mask 0xff
++#define ma_vol_db_ch2__shift 0x00
++#define ma_vol_db_ch2__reset 0x18
++//----------------------------------------------------------------vol_db_ch3---
++// volume channel 3
++#define ma_vol_db_ch3__a 69
++#define ma_vol_db_ch3__len 8
++#define ma_vol_db_ch3__mask 0xff
++#define ma_vol_db_ch3__shift 0x00
++#define ma_vol_db_ch3__reset 0x18
++//---------------------------------------------------------------vol_lsb_ch0---
++// volume channel 1 - 1/4 steps
++#define ma_vol_lsb_ch0__a 70
++#define ma_vol_lsb_ch0__len 2
++#define ma_vol_lsb_ch0__mask 0x03
++#define ma_vol_lsb_ch0__shift 0x00
++#define ma_vol_lsb_ch0__reset 0x00
++//---------------------------------------------------------------vol_lsb_ch1---
++// volume channel 3 - 1/4 steps
++#define ma_vol_lsb_ch1__a 70
++#define ma_vol_lsb_ch1__len 2
++#define ma_vol_lsb_ch1__mask 0x0c
++#define ma_vol_lsb_ch1__shift 0x02
++#define ma_vol_lsb_ch1__reset 0x00
++//---------------------------------------------------------------vol_lsb_ch2---
++// volume channel 2 - 1/4 steps
++#define ma_vol_lsb_ch2__a 70
++#define ma_vol_lsb_ch2__len 2
++#define ma_vol_lsb_ch2__mask 0x30
++#define ma_vol_lsb_ch2__shift 0x04
++#define ma_vol_lsb_ch2__reset 0x00
++//---------------------------------------------------------------vol_lsb_ch3---
++// volume channel 3 - 1/4 steps
++#define ma_vol_lsb_ch3__a 70
++#define ma_vol_lsb_ch3__len 2
++#define ma_vol_lsb_ch3__mask 0xc0
++#define ma_vol_lsb_ch3__shift 0x06
++#define ma_vol_lsb_ch3__reset 0x00
++//----------------------------------------------------------------thr_db_ch0---
++// thr_db channel 0
++#define ma_thr_db_ch0__a 71
++#define ma_thr_db_ch0__len 8
++#define ma_thr_db_ch0__mask 0xff
++#define ma_thr_db_ch0__shift 0x00
++#define ma_thr_db_ch0__reset 0x18
++//----------------------------------------------------------------thr_db_ch1---
++// thr db ch1
++#define ma_thr_db_ch1__a 72
++#define ma_thr_db_ch1__len 8
++#define ma_thr_db_ch1__mask 0xff
++#define ma_thr_db_ch1__shift 0x00
++#define ma_thr_db_ch1__reset 0x18
++//----------------------------------------------------------------thr_db_ch2---
++// thr db ch2
++#define ma_thr_db_ch2__a 73
++#define ma_thr_db_ch2__len 8
++#define ma_thr_db_ch2__mask 0xff
++#define ma_thr_db_ch2__shift 0x00
++#define ma_thr_db_ch2__reset 0x18
++//----------------------------------------------------------------thr_db_ch3---
++// threshold db ch3
++#define ma_thr_db_ch3__a 74
++#define ma_thr_db_ch3__len 8
++#define ma_thr_db_ch3__mask 0xff
++#define ma_thr_db_ch3__shift 0x00
++#define ma_thr_db_ch3__reset 0x18
++//---------------------------------------------------------------thr_lsb_ch0---
++// thr lsb ch0
++#define ma_thr_lsb_ch0__a 75
++#define ma_thr_lsb_ch0__len 2
++#define ma_thr_lsb_ch0__mask 0x03
++#define ma_thr_lsb_ch0__shift 0x00
++#define ma_thr_lsb_ch0__reset 0x00
++//---------------------------------------------------------------thr_lsb_ch1---
++// thr lsb ch1
++#define ma_thr_lsb_ch1__a 75
++#define ma_thr_lsb_ch1__len 2
++#define ma_thr_lsb_ch1__mask 0x0c
++#define ma_thr_lsb_ch1__shift 0x02
++#define ma_thr_lsb_ch1__reset 0x00
++//---------------------------------------------------------------thr_lsb_ch2---
++// thr lsb ch2 1/4 db step
++#define ma_thr_lsb_ch2__a 75
++#define ma_thr_lsb_ch2__len 2
++#define ma_thr_lsb_ch2__mask 0x30
++#define ma_thr_lsb_ch2__shift 0x04
++#define ma_thr_lsb_ch2__reset 0x00
++//---------------------------------------------------------------thr_lsb_ch3---
++// threshold lsb ch3
++#define ma_thr_lsb_ch3__a 75
++#define ma_thr_lsb_ch3__len 2
++#define ma_thr_lsb_ch3__mask 0xc0
++#define ma_thr_lsb_ch3__shift 0x06
++#define ma_thr_lsb_ch3__reset 0x00
++//-----------------------------------------------------------dcu_mon0.pm_mon---
++// power mode monitor channel 0
++#define ma_dcu_mon0__pm_mon__a 96
++#define ma_dcu_mon0__pm_mon__len 2
++#define ma_dcu_mon0__pm_mon__mask 0x03
++#define ma_dcu_mon0__pm_mon__shift 0x00
++#define ma_dcu_mon0__pm_mon__reset 0x00
++//-----------------------------------------------------dcu_mon0.freqmode_mon---
++// frequence mode monitor channel 0
++#define ma_dcu_mon0__freqmode_mon__a 96
++#define ma_dcu_mon0__freqmode_mon__len 3
++#define ma_dcu_mon0__freqmode_mon__mask 0x70
++#define ma_dcu_mon0__freqmode_mon__shift 0x04
++#define ma_dcu_mon0__freqmode_mon__reset 0x00
++//-------------------------------------------------------dcu_mon0.pps_passed---
++// dcu0 pps completion indicator
++#define ma_dcu_mon0__pps_passed__a 96
++#define ma_dcu_mon0__pps_passed__len 1
++#define ma_dcu_mon0__pps_passed__mask 0x80
++#define ma_dcu_mon0__pps_passed__shift 0x07
++#define ma_dcu_mon0__pps_passed__reset 0x00
++//----------------------------------------------------------dcu_mon0.ocp_mon---
++// ocp monitor channel 0
++#define ma_dcu_mon0__ocp_mon__a 97
++#define ma_dcu_mon0__ocp_mon__len 1
++#define ma_dcu_mon0__ocp_mon__mask 0x01
++#define ma_dcu_mon0__ocp_mon__shift 0x00
++#define ma_dcu_mon0__ocp_mon__reset 0x00
++//--------------------------------------------------------dcu_mon0.vcfly1_ok---
++// cfly1 protection monitor channel 0.
++#define ma_dcu_mon0__vcfly1_ok__a 97
++#define ma_dcu_mon0__vcfly1_ok__len 1
++#define ma_dcu_mon0__vcfly1_ok__mask 0x02
++#define ma_dcu_mon0__vcfly1_ok__shift 0x01
++#define ma_dcu_mon0__vcfly1_ok__reset 0x00
++//--------------------------------------------------------dcu_mon0.vcfly2_ok---
++// cfly2 protection monitor channel 0.
++#define ma_dcu_mon0__vcfly2_ok__a 97
++#define ma_dcu_mon0__vcfly2_ok__len 1
++#define ma_dcu_mon0__vcfly2_ok__mask 0x04
++#define ma_dcu_mon0__vcfly2_ok__shift 0x02
++#define ma_dcu_mon0__vcfly2_ok__reset 0x00
++//----------------------------------------------------------dcu_mon0.pvdd_ok---
++// dcu0 pvdd monitor
++#define ma_dcu_mon0__pvdd_ok__a 97
++#define ma_dcu_mon0__pvdd_ok__len 1
++#define ma_dcu_mon0__pvdd_ok__mask 0x08
++#define ma_dcu_mon0__pvdd_ok__shift 0x03
++#define ma_dcu_mon0__pvdd_ok__reset 0x00
++//-----------------------------------------------------------dcu_mon0.vdd_ok---
++// dcu0 vdd monitor
++#define ma_dcu_mon0__vdd_ok__a 97
++#define ma_dcu_mon0__vdd_ok__len 1
++#define ma_dcu_mon0__vdd_ok__mask 0x10
++#define ma_dcu_mon0__vdd_ok__shift 0x04
++#define ma_dcu_mon0__vdd_ok__reset 0x00
++//-------------------------------------------------------------dcu_mon0.mute---
++// dcu0 mute monitor
++#define ma_dcu_mon0__mute__a 97
++#define ma_dcu_mon0__mute__len 1
++#define ma_dcu_mon0__mute__mask 0x20
++#define ma_dcu_mon0__mute__shift 0x05
++#define ma_dcu_mon0__mute__reset 0x00
++//------------------------------------------------------------dcu_mon0.m_mon---
++// m sense monitor channel 0
++#define ma_dcu_mon0__m_mon__a 98
++#define ma_dcu_mon0__m_mon__len 8
++#define ma_dcu_mon0__m_mon__mask 0xff
++#define ma_dcu_mon0__m_mon__shift 0x00
++#define ma_dcu_mon0__m_mon__reset 0x00
++//-----------------------------------------------------------dcu_mon1.pm_mon---
++// power mode monitor channel 1
++#define ma_dcu_mon1__pm_mon__a 100
++#define ma_dcu_mon1__pm_mon__len 2
++#define ma_dcu_mon1__pm_mon__mask 0x03
++#define ma_dcu_mon1__pm_mon__shift 0x00
++#define ma_dcu_mon1__pm_mon__reset 0x00
++//-----------------------------------------------------dcu_mon1.freqmode_mon---
++// frequence mode monitor channel 1
++#define ma_dcu_mon1__freqmode_mon__a 100
++#define ma_dcu_mon1__freqmode_mon__len 3
++#define ma_dcu_mon1__freqmode_mon__mask 0x70
++#define ma_dcu_mon1__freqmode_mon__shift 0x04
++#define ma_dcu_mon1__freqmode_mon__reset 0x00
++//-------------------------------------------------------dcu_mon1.pps_passed---
++// dcu1 pps completion indicator
++#define ma_dcu_mon1__pps_passed__a 100
++#define ma_dcu_mon1__pps_passed__len 1
++#define ma_dcu_mon1__pps_passed__mask 0x80
++#define ma_dcu_mon1__pps_passed__shift 0x07
++#define ma_dcu_mon1__pps_passed__reset 0x00
++//----------------------------------------------------------dcu_mon1.ocp_mon---
++// ocp monitor channel 1
++#define ma_dcu_mon1__ocp_mon__a 101
++#define ma_dcu_mon1__ocp_mon__len 1
++#define ma_dcu_mon1__ocp_mon__mask 0x01
++#define ma_dcu_mon1__ocp_mon__shift 0x00
++#define ma_dcu_mon1__ocp_mon__reset 0x00
++//--------------------------------------------------------dcu_mon1.vcfly1_ok---
++// cfly1 protcetion monitor channel 1
++#define ma_dcu_mon1__vcfly1_ok__a 101
++#define ma_dcu_mon1__vcfly1_ok__len 1
++#define ma_dcu_mon1__vcfly1_ok__mask 0x02
++#define ma_dcu_mon1__vcfly1_ok__shift 0x01
++#define ma_dcu_mon1__vcfly1_ok__reset 0x00
++//--------------------------------------------------------dcu_mon1.vcfly2_ok---
++// cfly2 protection monitor channel 1
++#define ma_dcu_mon1__vcfly2_ok__a 101
++#define ma_dcu_mon1__vcfly2_ok__len 1
++#define ma_dcu_mon1__vcfly2_ok__mask 0x04
++#define ma_dcu_mon1__vcfly2_ok__shift 0x02
++#define ma_dcu_mon1__vcfly2_ok__reset 0x00
++//----------------------------------------------------------dcu_mon1.pvdd_ok---
++// dcu1 pvdd monitor
++#define ma_dcu_mon1__pvdd_ok__a 101
++#define ma_dcu_mon1__pvdd_ok__len 1
++#define ma_dcu_mon1__pvdd_ok__mask 0x08
++#define ma_dcu_mon1__pvdd_ok__shift 0x03
++#define ma_dcu_mon1__pvdd_ok__reset 0x00
++//-----------------------------------------------------------dcu_mon1.vdd_ok---
++// dcu1 vdd monitor
++#define ma_dcu_mon1__vdd_ok__a 101
++#define ma_dcu_mon1__vdd_ok__len 1
++#define ma_dcu_mon1__vdd_ok__mask 0x10
++#define ma_dcu_mon1__vdd_ok__shift 0x04
++#define ma_dcu_mon1__vdd_ok__reset 0x00
++//-------------------------------------------------------------dcu_mon1.mute---
++// dcu1 mute monitor
++#define ma_dcu_mon1__mute__a 101
++#define ma_dcu_mon1__mute__len 1
++#define ma_dcu_mon1__mute__mask 0x20
++#define ma_dcu_mon1__mute__shift 0x05
++#define ma_dcu_mon1__mute__reset 0x00
++//------------------------------------------------------------dcu_mon1.m_mon---
++// m sense monitor channel 1
++#define ma_dcu_mon1__m_mon__a 102
++#define ma_dcu_mon1__m_mon__len 8
++#define ma_dcu_mon1__m_mon__mask 0xff
++#define ma_dcu_mon1__m_mon__shift 0x00
++#define ma_dcu_mon1__m_mon__reset 0x00
++//--------------------------------------------------------dcu_mon0.sw_enable---
++// dcu0 switch enable monitor
++#define ma_dcu_mon0__sw_enable__a 104
++#define ma_dcu_mon0__sw_enable__len 1
++#define ma_dcu_mon0__sw_enable__mask 0x40
++#define ma_dcu_mon0__sw_enable__shift 0x06
++#define ma_dcu_mon0__sw_enable__reset 0x00
++//--------------------------------------------------------dcu_mon1.sw_enable---
++// dcu1 switch enable monitor
++#define ma_dcu_mon1__sw_enable__a 104
++#define ma_dcu_mon1__sw_enable__len 1
++#define ma_dcu_mon1__sw_enable__mask 0x80
++#define ma_dcu_mon1__sw_enable__shift 0x07
++#define ma_dcu_mon1__sw_enable__reset 0x00
++//------------------------------------------------------------hvboot0_ok_mon---
++// hvboot0_ok for test/debug
++#define ma_hvboot0_ok_mon__a 105
++#define ma_hvboot0_ok_mon__len 1
++#define ma_hvboot0_ok_mon__mask 0x40
++#define ma_hvboot0_ok_mon__shift 0x06
++#define ma_hvboot0_ok_mon__reset 0x00
++//------------------------------------------------------------hvboot1_ok_mon---
++// hvboot1_ok for test/debug
++#define ma_hvboot1_ok_mon__a 105
++#define ma_hvboot1_ok_mon__len 1
++#define ma_hvboot1_ok_mon__mask 0x80
++#define ma_hvboot1_ok_mon__shift 0x07
++#define ma_hvboot1_ok_mon__reset 0x00
++//-----------------------------------------------------------------error_acc---
++// accumulated errors,  at and after triggering
++#define ma_error_acc__a 109
++#define ma_error_acc__len 8
++#define ma_error_acc__mask 0xff
++#define ma_error_acc__shift 0x00
++#define ma_error_acc__reset 0x00
++//-------------------------------------------------------------i2s_data_rate---
++// detected i2s data rate: 00/01/10 = x1/x2/x4
++#define ma_i2s_data_rate__a 116
++#define ma_i2s_data_rate__len 2
++#define ma_i2s_data_rate__mask 0x03
++#define ma_i2s_data_rate__shift 0x00
++#define ma_i2s_data_rate__reset 0x00
++//---------------------------------------------------------audio_in_mode_mon---
++// audio input mode monitor
++#define ma_audio_in_mode_mon__a 116
++#define ma_audio_in_mode_mon__len 3
++#define ma_audio_in_mode_mon__mask 0x1c
++#define ma_audio_in_mode_mon__shift 0x02
++#define ma_audio_in_mode_mon__reset 0x00
++//------------------------------------------------------------------msel_mon---
++// msel[2:0] monitor register
++#define ma_msel_mon__a 117
++#define ma_msel_mon__len 3
++#define ma_msel_mon__mask 0x07
++#define ma_msel_mon__shift 0x00
++#define ma_msel_mon__reset 0x00
++//---------------------------------------------------------------------error---
++// current error flag monitor reg - for app. ctrl.
++#define ma_error__a 124
++#define ma_error__len 8
++#define ma_error__mask 0xff
++#define ma_error__shift 0x00
++#define ma_error__reset 0x00
++//----------------------------------------------------audio_proc_limiter_mon---
++// b7-b4: channel 3-0 limiter active
++#define ma_audio_proc_limiter_mon__a 126
++#define ma_audio_proc_limiter_mon__len 4
++#define ma_audio_proc_limiter_mon__mask 0xf0
++#define ma_audio_proc_limiter_mon__shift 0x04
++#define ma_audio_proc_limiter_mon__reset 0x00
++//-------------------------------------------------------audio_proc_clip_mon---
++// b3-b0: channel 3-0 clipping monitor
++#define ma_audio_proc_clip_mon__a 126
++#define ma_audio_proc_clip_mon__len 4
++#define ma_audio_proc_clip_mon__mask 0x0f
++#define ma_audio_proc_clip_mon__shift 0x00
++#define ma_audio_proc_clip_mon__reset 0x00
++#endif
++
++#define SOC_ENUM_ERR(xname, xenum)\
++{	.iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = (xname),\
++	.access = SNDRV_CTL_ELEM_ACCESS_READ,\
++	.info = snd_soc_info_enum_double,\
++	.get = snd_soc_get_enum_double, .put = snd_soc_put_enum_double,\
++	.private_value = (unsigned long)&(xenum) }
++
++static struct i2c_client *i2c;
++
++struct ma120x0p_priv {
++	struct regmap *regmap;
++	int mclk_div;
++	struct snd_soc_component *component;
++	struct gpio_desc *enable_gpio;
++	struct gpio_desc *mute_gpio;
++	struct gpio_desc *booster_gpio;
++	struct gpio_desc *error_gpio;
++};
++
++static struct ma120x0p_priv *priv_data;
++
++//Used to share the IRQ number within this file
++static unsigned int irqNumber;
++
++// Function prototype for the custom IRQ handler function
++static irqreturn_t ma120x0p_irq_handler(int irq, void *data);
++
++//Alsa Controls
++static const char * const limenable_text[] = {"Bypassed", "Enabled"};
++static const char * const limatack_text[] = {"Slow", "Normal", "Fast"};
++static const char * const limrelease_text[] = {"Slow", "Normal", "Fast"};
++
++static const char * const err_flycap_text[] = {"Ok", "Error"};
++static const char * const err_overcurr_text[] = {"Ok", "Error"};
++static const char * const err_pllerr_text[] = {"Ok", "Error"};
++static const char * const err_pvddunder_text[] = {"Ok", "Error"};
++static const char * const err_overtempw_text[] = {"Ok", "Error"};
++static const char * const err_overtempe_text[] = {"Ok", "Error"};
++static const char * const err_pinlowimp_text[] = {"Ok", "Error"};
++static const char * const err_dcprot_text[] = {"Ok", "Error"};
++
++static const char * const pwr_mode_prof_text[] = {"PMF0", "PMF1", "PMF2",
++"PMF3", "PMF4"};
++
++static const struct soc_enum lim_enable_ctrl =
++	SOC_ENUM_SINGLE(ma_audio_proc_limiterenable__a,
++		ma_audio_proc_limiterenable__shift,
++		ma_audio_proc_limiterenable__len + 1,
++		limenable_text);
++static const struct soc_enum limatack_ctrl =
++	SOC_ENUM_SINGLE(ma_audio_proc_attack__a,
++		ma_audio_proc_attack__shift,
++		ma_audio_proc_attack__len + 1,
++		limatack_text);
++static const struct soc_enum limrelease_ctrl =
++	SOC_ENUM_SINGLE(ma_audio_proc_release__a,
++		ma_audio_proc_release__shift,
++		ma_audio_proc_release__len + 1,
++		limrelease_text);
++static const struct soc_enum err_flycap_ctrl =
++	SOC_ENUM_SINGLE(ma_error__a, 0, 3, err_flycap_text);
++static const struct soc_enum err_overcurr_ctrl =
++	SOC_ENUM_SINGLE(ma_error__a, 1, 3, err_overcurr_text);
++static const struct soc_enum err_pllerr_ctrl =
++	SOC_ENUM_SINGLE(ma_error__a, 2, 3, err_pllerr_text);
++static const struct soc_enum err_pvddunder_ctrl =
++	SOC_ENUM_SINGLE(ma_error__a, 3, 3, err_pvddunder_text);
++static const struct soc_enum err_overtempw_ctrl =
++	SOC_ENUM_SINGLE(ma_error__a, 4, 3, err_overtempw_text);
++static const struct soc_enum err_overtempe_ctrl =
++	SOC_ENUM_SINGLE(ma_error__a, 5, 3, err_overtempe_text);
++static const struct soc_enum err_pinlowimp_ctrl =
++	SOC_ENUM_SINGLE(ma_error__a, 6, 3, err_pinlowimp_text);
++static const struct soc_enum err_dcprot_ctrl =
++	SOC_ENUM_SINGLE(ma_error__a, 7, 3, err_dcprot_text);
++static const struct soc_enum pwr_mode_prof_ctrl =
++	SOC_ENUM_SINGLE(ma_pmprofile__a, ma_pmprofile__shift, 5,
++		pwr_mode_prof_text);
++
++static const char * const pwr_mode_texts[] = {
++		"Dynamic power mode",
++		"Power mode 1",
++		"Power mode 2",
++		"Power mode 3",
++	};
++
++static const int pwr_mode_values[] = {
++		0x10,
++		0x50,
++		0x60,
++		0x70,
++	};
++
++static SOC_VALUE_ENUM_SINGLE_DECL(pwr_mode_ctrl,
++	ma_pm_man__a, 0, 0x70,
++	pwr_mode_texts,
++	pwr_mode_values);
++
++static const DECLARE_TLV_DB_SCALE(ma120x0p_vol_tlv, -5000, 100,  0);
++static const DECLARE_TLV_DB_SCALE(ma120x0p_lim_tlv, -14400, 100,  0);
++static const DECLARE_TLV_DB_SCALE(ma120x0p_lr_tlv, -5000, 100,  0);
++
++static const struct snd_kcontrol_new ma120x0p_snd_controls[] = {
++	//Master Volume
++	SOC_SINGLE_RANGE_TLV("A.Mstr Vol Volume",
++		ma_vol_db_master__a, 0, 0x18, 0xa8, 1, ma120x0p_vol_tlv),
++
++	//L-R Volume ch0
++	SOC_SINGLE_RANGE_TLV("B.L Vol Volume",
++		ma_vol_db_ch0__a, 0, 0x18, 0x4a, 1, ma120x0p_lr_tlv),
++	SOC_SINGLE_RANGE_TLV("C.R Vol Volume",
++		ma_vol_db_ch1__a, 0, 0x18, 0x4a, 1, ma120x0p_lr_tlv),
++
++	//L-R Limiter Threshold ch0-ch1
++	SOC_DOUBLE_R_RANGE_TLV("D.Lim thresh Volume",
++		ma_thr_db_ch0__a, ma_thr_db_ch1__a, 0, 0x0e, 0x4a, 1,
++		ma120x0p_lim_tlv),
++
++	//Enum Switches/Selectors
++	//SOC_ENUM("E.AudioProc Mute", audioproc_mute_ctrl),
++	SOC_ENUM("F.Limiter Enable", lim_enable_ctrl),
++	SOC_ENUM("G.Limiter Attck", limatack_ctrl),
++	SOC_ENUM("H.Limiter Rls", limrelease_ctrl),
++
++	//Enum Error Monitor (read-only)
++	SOC_ENUM_ERR("I.Err flycap", err_flycap_ctrl),
++	SOC_ENUM_ERR("J.Err overcurr", err_overcurr_ctrl),
++	SOC_ENUM_ERR("K.Err pllerr", err_pllerr_ctrl),
++	SOC_ENUM_ERR("L.Err pvddunder", err_pvddunder_ctrl),
++	SOC_ENUM_ERR("M.Err overtempw", err_overtempw_ctrl),
++	SOC_ENUM_ERR("N.Err overtempe", err_overtempe_ctrl),
++	SOC_ENUM_ERR("O.Err pinlowimp", err_pinlowimp_ctrl),
++	SOC_ENUM_ERR("P.Err dcprot", err_dcprot_ctrl),
++
++	//Power modes profiles
++	SOC_ENUM("Q.PM Prof", pwr_mode_prof_ctrl),
++
++	// Power mode selection (Dynamic,1,2,3)
++	SOC_ENUM("R.Power Mode", pwr_mode_ctrl),
++};
++
++//Machine Driver
++static int ma120x0p_hw_params(struct snd_pcm_substream *substream,
++	struct snd_pcm_hw_params *params, struct snd_soc_dai *dai)
++{
++	u16 blen = 0x00;
++
++	struct snd_soc_component *component = dai->component;
++
++	priv_data->component = component;
++
++	switch (params_format(params)) {
++	case SNDRV_PCM_FORMAT_S16_LE:
++		blen = 0x10;
++		break;
++	case SNDRV_PCM_FORMAT_S24_LE:
++		blen = 0x00;
++		break;
++	case SNDRV_PCM_FORMAT_S32_LE:
++		blen = 0x00;
++		break;
++	default:
++		dev_err(dai->dev, "Unsupported word length: %u\n",
++		params_format(params));
++		return -EINVAL;
++	}
++
++	// set word length
++	snd_soc_component_update_bits(component, ma_i2s_framesize__a,
++		ma_i2s_framesize__mask, blen);
++
++	return 0;
++}
++
++static int ma120x0p_mute_stream(struct snd_soc_dai *dai, int mute, int stream)
++{
++	int val = 0;
++
++	struct ma120x0p_priv *ma120x0p;
++
++	struct snd_soc_component *component = dai->component;
++
++	ma120x0p = snd_soc_component_get_drvdata(component);
++
++	if (mute)
++		val = 0;
++	else
++		val = 1;
++
++	gpiod_set_value_cansleep(priv_data->mute_gpio, val);
++
++	return 0;
++}
++
++static const struct snd_soc_dai_ops ma120x0p_dai_ops = {
++	.hw_params		=	ma120x0p_hw_params,
++	.mute_stream	=	ma120x0p_mute_stream,
++};
++
++static struct snd_soc_dai_driver ma120x0p_dai = {
++	.name		= "ma120x0p-amp",
++	.playback	=	{
++		.stream_name	= "Playback",
++		.channels_min	= 2,
++		.channels_max	= 2,
++		.rates = SNDRV_PCM_RATE_CONTINUOUS,
++		.rate_min = 44100,
++		.rate_max = 192000,
++		.formats = SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S32_LE
++	},
++	.ops        = &ma120x0p_dai_ops,
++};
++
++//Codec Driver
++static int ma120x0p_clear_err(struct snd_soc_component *component)
++{
++	int ret = 0;
++
++	struct ma120x0p_priv *ma120x0p;
++
++	ma120x0p = snd_soc_component_get_drvdata(component);
++
++	ret = snd_soc_component_update_bits(component,
++		ma_eh_clear__a, ma_eh_clear__mask, 0x00);
++	if (ret < 0)
++		return ret;
++
++	ret = snd_soc_component_update_bits(component,
++		ma_eh_clear__a, ma_eh_clear__mask, 0x04);
++	if (ret < 0)
++		return ret;
++
++	ret = snd_soc_component_update_bits(component,
++		ma_eh_clear__a, ma_eh_clear__mask, 0x00);
++	if (ret < 0)
++		return ret;
++
++	return 0;
++}
++
++static void ma120x0p_remove(struct snd_soc_component *component)
++{
++	struct ma120x0p_priv *ma120x0p;
++
++	ma120x0p = snd_soc_component_get_drvdata(component);
++}
++
++static int ma120x0p_probe(struct snd_soc_component *component)
++{
++	struct ma120x0p_priv *ma120x0p;
++
++	int ret = 0;
++
++	i2c = container_of(component->dev, struct i2c_client, dev);
++
++	ma120x0p = snd_soc_component_get_drvdata(component);
++
++	//Reset error
++	ma120x0p_clear_err(component);
++	if (ret < 0)
++		return ret;
++
++	// set serial audio format I2S and enable audio processor
++	ret = snd_soc_component_write(component, ma_i2s_format__a, 0x08);
++	if (ret < 0)
++		return ret;
++
++	// Enable audio limiter
++	ret = snd_soc_component_update_bits(component,
++		ma_audio_proc_limiterenable__a,
++		ma_audio_proc_limiterenable__mask, 0x40);
++	if (ret < 0)
++		return ret;
++
++	// Set lim attack to fast
++	ret = snd_soc_component_update_bits(component,
++		ma_audio_proc_attack__a, ma_audio_proc_attack__mask, 0x80);
++	if (ret < 0)
++		return ret;
++
++	// Set lim attack to low
++	ret = snd_soc_component_update_bits(component,
++		ma_audio_proc_release__a, ma_audio_proc_release__mask, 0x00);
++	if (ret < 0)
++		return ret;
++
++	// set volume to 0dB
++	ret = snd_soc_component_write(component, ma_vol_db_master__a, 0x18);
++	if (ret < 0)
++		return ret;
++
++	// set ch0 lim thresh to -15dB
++	ret = snd_soc_component_write(component, ma_thr_db_ch0__a, 0x27);
++	if (ret < 0)
++		return ret;
++
++	// set ch1 lim thresh to -15dB
++	ret = snd_soc_component_write(component, ma_thr_db_ch1__a, 0x27);
++	if (ret < 0)
++		return ret;
++
++	//Check for errors
++	ret = snd_soc_component_test_bits(component, ma_error_acc__a, 0x00, 0);
++	if (ret < 0)
++		return ret;
++	ret = snd_soc_component_test_bits(component, ma_error_acc__a, 0x01, 0);
++	if (ret < 0)
++		return ret;
++	ret = snd_soc_component_test_bits(component, ma_error_acc__a, 0x02, 0);
++	if (ret < 0)
++		return ret;
++	ret = snd_soc_component_test_bits(component, ma_error_acc__a, 0x08, 0);
++	if (ret < 0)
++		return ret;
++	ret = snd_soc_component_test_bits(component, ma_error_acc__a, 0x10, 0);
++	if (ret < 0)
++		return ret;
++	ret = snd_soc_component_test_bits(component, ma_error_acc__a, 0x20, 0);
++	if (ret < 0)
++		return ret;
++	ret = snd_soc_component_test_bits(component, ma_error_acc__a, 0x40, 0);
++	if (ret < 0)
++		return ret;
++	ret = snd_soc_component_test_bits(component, ma_error_acc__a, 0x80, 0);
++	if (ret < 0)
++		return ret;
++
++	return 0;
++}
++
++static int ma120x0p_set_bias_level(struct snd_soc_component *component,
++	enum snd_soc_bias_level level)
++{
++	int ret = 0;
++
++	struct ma120x0p_priv *ma120x0p;
++
++	ma120x0p = snd_soc_component_get_drvdata(component);
++
++	switch (level) {
++	case SND_SOC_BIAS_ON:
++		break;
++
++	case SND_SOC_BIAS_PREPARE:
++		break;
++
++	case SND_SOC_BIAS_STANDBY:
++		ret = gpiod_get_value_cansleep(priv_data->enable_gpio);
++		if (ret != 0) {
++			dev_err(component->dev, "Device ma120x0p disabled in STANDBY BIAS: %d\n",
++			ret);
++			return ret;
++		}
++		break;
++
++	case SND_SOC_BIAS_OFF:
++		break;
++	}
++
++	return 0;
++}
++
++static const struct snd_soc_dapm_widget ma120x0p_dapm_widgets[] = {
++	SND_SOC_DAPM_OUTPUT("OUT_A"),
++	SND_SOC_DAPM_OUTPUT("OUT_B"),
++};
++
++static const struct snd_soc_dapm_route ma120x0p_dapm_routes[] = {
++	{ "OUT_B",  NULL, "Playback" },
++	{ "OUT_A",  NULL, "Playback" },
++};
++
++static const struct snd_soc_component_driver ma120x0p_component_driver = {
++	.probe = ma120x0p_probe,
++	.remove = ma120x0p_remove,
++	.set_bias_level = ma120x0p_set_bias_level,
++	.dapm_widgets		= ma120x0p_dapm_widgets,
++	.num_dapm_widgets	= ARRAY_SIZE(ma120x0p_dapm_widgets),
++	.dapm_routes		= ma120x0p_dapm_routes,
++	.num_dapm_routes	= ARRAY_SIZE(ma120x0p_dapm_routes),
++	.controls = ma120x0p_snd_controls,
++	.num_controls = ARRAY_SIZE(ma120x0p_snd_controls),
++	.use_pmdown_time	= 1,
++	.endianness		= 1,
++};
++
++//I2C Driver
++static const struct reg_default ma120x0p_reg_defaults[] = {
++	{	0x01,	0x3c	},
++};
++
++static bool ma120x0p_reg_volatile(struct device *dev, unsigned int reg)
++{
++	switch (reg) {
++	case ma_error__a:
++			return true;
++	default:
++			return false;
++	}
++}
++
++static const struct of_device_id ma120x0p_of_match[] = {
++	{ .compatible = "ma,ma120x0p", },
++	{ }
++};
++
++MODULE_DEVICE_TABLE(of, ma120x0p_of_match);
++
++static struct regmap_config ma120x0p_regmap_config = {
++	.reg_bits = 8,
++	.val_bits = 8,
++
++	.max_register = 255,
++	.volatile_reg = ma120x0p_reg_volatile,
++
++	.cache_type = REGCACHE_RBTREE,
++	.reg_defaults = ma120x0p_reg_defaults,
++	.num_reg_defaults = ARRAY_SIZE(ma120x0p_reg_defaults),
++};
++
++static int ma120x0p_i2c_probe(struct i2c_client *i2c,
++	const struct i2c_device_id *id)
++{
++	int ret;
++
++	priv_data = devm_kzalloc(&i2c->dev, sizeof(*priv_data), GFP_KERNEL);
++	if (!priv_data)
++		return -ENOMEM;
++	i2c_set_clientdata(i2c, priv_data);
++
++	priv_data->regmap = devm_regmap_init_i2c(i2c, &ma120x0p_regmap_config);
++	if (IS_ERR(priv_data->regmap)) {
++		ret = PTR_ERR(priv_data->regmap);
++		return ret;
++	}
++
++	//Startup sequence
++
++	//Make sure the device is muted
++	priv_data->mute_gpio = devm_gpiod_get_optional(&i2c->dev, "mute_gp",
++		GPIOD_OUT_LOW);
++	if (IS_ERR(priv_data->mute_gpio)) {
++		ret = PTR_ERR(priv_data->mute_gpio);
++		dev_err(&i2c->dev, "Failed to get mute gpio line: %d\n", ret);
++		return ret;
++	}
++	msleep(50);
++
++// MA120xx0P devices are usually powered by an integrated boost converter.
++// An option GPIO control line is provided to enable the booster properly and
++// in sync with the enable and mute GPIO lines.
++	priv_data->booster_gpio = devm_gpiod_get_optional(&i2c->dev,
++		"booster_gp", GPIOD_OUT_LOW);
++	if (IS_ERR(priv_data->booster_gpio)) {
++		ret = PTR_ERR(priv_data->booster_gpio);
++		dev_err(&i2c->dev,
++		"Failed to get booster enable gpio line: %d\n", ret);
++		return ret;
++	}
++	msleep(50);
++
++	//Enable booster and wait 200ms until stable PVDD
++	gpiod_set_value_cansleep(priv_data->booster_gpio, 1);
++	msleep(200);
++
++	//Enable ma120x0pp
++	priv_data->enable_gpio = devm_gpiod_get_optional(&i2c->dev,
++		"enable_gp", GPIOD_OUT_LOW);
++	if (IS_ERR(priv_data->enable_gpio)) {
++		ret = PTR_ERR(priv_data->enable_gpio);
++		dev_err(&i2c->dev,
++		"Failed to get ma120x0p enable gpio line: %d\n", ret);
++		return ret;
++	}
++	msleep(50);
++
++	//Optional use of ma120x0pp error line as an interrupt trigger to
++	//platform GPIO.
++	//Get error input gpio ma120x0p
++	priv_data->error_gpio = devm_gpiod_get_optional(&i2c->dev,
++		 "error_gp", GPIOD_IN);
++	if (IS_ERR(priv_data->error_gpio)) {
++		ret = PTR_ERR(priv_data->error_gpio);
++		dev_err(&i2c->dev,
++			"Failed to get ma120x0p error gpio line: %d\n", ret);
++		return ret;
++	}
++
++	if (priv_data->error_gpio != NULL) {
++		irqNumber = gpiod_to_irq(priv_data->error_gpio);
++
++		ret = devm_request_threaded_irq(&i2c->dev,
++			 irqNumber, ma120x0p_irq_handler,
++			 NULL, IRQF_TRIGGER_FALLING,
++			 "ma120x0p", priv_data);
++		if (ret != 0)
++			dev_warn(&i2c->dev, "Failed to request IRQ: %d\n",
++				ret);
++	}
++
++	ret = devm_snd_soc_register_component(&i2c->dev,
++		&ma120x0p_component_driver, &ma120x0p_dai, 1);
++
++	return ret;
++}
++
++static irqreturn_t ma120x0p_irq_handler(int irq, void *data)
++{
++	gpiod_set_value_cansleep(priv_data->mute_gpio, 0);
++	gpiod_set_value_cansleep(priv_data->enable_gpio, 1);
++	return IRQ_HANDLED;
++}
++
++static void ma120x0p_i2c_remove(struct i2c_client *i2c)
++{
++	snd_soc_unregister_component(&i2c->dev);
++	i2c_set_clientdata(i2c, NULL);
++
++	gpiod_set_value_cansleep(priv_data->mute_gpio, 0);
++	msleep(30);
++	gpiod_set_value_cansleep(priv_data->enable_gpio, 1);
++	msleep(200);
++	gpiod_set_value_cansleep(priv_data->booster_gpio, 0);
++	msleep(200);
++
++	kfree(priv_data);
++}
++
++static void ma120x0p_i2c_shutdown(struct i2c_client *i2c)
++{
++	snd_soc_unregister_component(&i2c->dev);
++	i2c_set_clientdata(i2c, NULL);
++
++	gpiod_set_value_cansleep(priv_data->mute_gpio, 0);
++	msleep(30);
++	gpiod_set_value_cansleep(priv_data->enable_gpio, 1);
++	msleep(200);
++	gpiod_set_value_cansleep(priv_data->booster_gpio, 0);
++	msleep(200);
++
++	kfree(priv_data);
++}
++
++static const struct i2c_device_id ma120x0p_i2c_id[] = {
++	{ "ma120x0p", 0 },
++	{ }
++};
++
++MODULE_DEVICE_TABLE(i2c, ma120x0p_i2c_id);
++
++static struct i2c_driver ma120x0p_i2c_driver = {
++	.driver = {
++		.name = "ma120x0p",
++		.owner = THIS_MODULE,
++		.of_match_table = ma120x0p_of_match,
++	},
++	.probe = ma120x0p_i2c_probe,
++	.remove = ma120x0p_i2c_remove,
++	.shutdown = ma120x0p_i2c_shutdown,
++	.id_table = ma120x0p_i2c_id
++};
++
++static int __init ma120x0p_modinit(void)
++{
++	int ret = 0;
++
++	ret = i2c_add_driver(&ma120x0p_i2c_driver);
++	if (ret != 0) {
++		pr_err("Failed to register MA120X0P I2C driver: %d\n", ret);
++		return ret;
++	}
++	return ret;
++}
++module_init(ma120x0p_modinit);
++
++static void __exit ma120x0p_exit(void)
++{
++	i2c_del_driver(&ma120x0p_i2c_driver);
++}
++module_exit(ma120x0p_exit);
++
++MODULE_AUTHOR("Ariel Muszkat ariel.muszkat@gmail.com>");
++MODULE_DESCRIPTION("ASoC driver for ma120x0p");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/codecs/pcm1794a.c
+@@ -0,0 +1,69 @@
++/*
++ * Driver for the PCM1794A codec
++ *
++ * Author:	Florian Meier <florian.meier@koalo.de>
++ *		Copyright 2013
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++
++#include <sound/soc.h>
++
++static struct snd_soc_dai_driver pcm1794a_dai = {
++	.name = "pcm1794a-hifi",
++	.playback = {
++		.channels_min = 2,
++		.channels_max = 2,
++		.rates = SNDRV_PCM_RATE_8000_192000,
++		.formats = SNDRV_PCM_FMTBIT_S16_LE |
++			   SNDRV_PCM_FMTBIT_S24_LE
++	},
++};
++
++static struct snd_soc_component_driver soc_component_dev_pcm1794a;
++
++static int pcm1794a_probe(struct platform_device *pdev)
++{
++	return snd_soc_register_component(&pdev->dev, &soc_component_dev_pcm1794a,
++			&pcm1794a_dai, 1);
++}
++
++static int pcm1794a_remove(struct platform_device *pdev)
++{
++	snd_soc_unregister_component(&pdev->dev);
++	return 0;
++}
++
++static const struct of_device_id pcm1794a_of_match[] = {
++	{ .compatible = "ti,pcm1794a", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, pcm1794a_of_match);
++
++static struct platform_driver pcm1794a_component_driver = {
++	.probe 		= pcm1794a_probe,
++	.remove 	= pcm1794a_remove,
++	.driver		= {
++		.name	= "pcm1794a-codec",
++		.owner	= THIS_MODULE,
++		.of_match_table = of_match_ptr(pcm1794a_of_match),
++	},
++};
++
++module_platform_driver(pcm1794a_component_driver);
++
++MODULE_DESCRIPTION("ASoC PCM1794A codec driver");
++MODULE_AUTHOR("Florian Meier <florian.meier@koalo.de>");
++MODULE_LICENSE("GPL v2");
+--- a/sound/soc/codecs/pcm512x.c
++++ b/sound/soc/codecs/pcm512x.c
+@@ -536,7 +536,7 @@ static unsigned long pcm512x_ncp_target(
+ 
+ static const u32 pcm512x_dai_rates[] = {
+ 	8000, 11025, 16000, 22050, 32000, 44100, 48000, 64000,
+-	88200, 96000, 176400, 192000, 384000,
++	88200, 96000, 176400, 192000, 352800, 384000,
+ };
+ 
+ static const struct snd_pcm_hw_constraint_list constraints_slave = {
+--- /dev/null
++++ b/sound/soc/codecs/tas5713.c
+@@ -0,0 +1,361 @@
++/*
++ * ASoC Driver for TAS5713
++ *
++ * Author:	Sebastian Eickhoff <basti.eickhoff@googlemail.com>
++ *		Copyright 2014
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/moduleparam.h>
++#include <linux/init.h>
++#include <linux/delay.h>
++#include <linux/pm.h>
++#include <linux/i2c.h>
++#include <linux/of_device.h>
++#include <linux/spi/spi.h>
++#include <linux/regmap.h>
++#include <linux/regulator/consumer.h>
++#include <linux/slab.h>
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/initval.h>
++#include <sound/tlv.h>
++
++#include <linux/kernel.h>
++#include <linux/string.h>
++#include <linux/fs.h>
++#include <asm/uaccess.h>
++
++#include "tas5713.h"
++
++
++static struct i2c_client *i2c;
++
++struct tas5713_priv {
++	struct regmap *regmap;
++	int mclk_div;
++	struct snd_soc_component *component;
++};
++
++static struct tas5713_priv *priv_data;
++
++
++
++
++/*
++ *    _   _    ___   _      ___         _           _
++ *   /_\ | |  / __| /_\    / __|___ _ _| |_ _ _ ___| |___
++ *  / _ \| |__\__ \/ _ \  | (__/ _ \ ' \  _| '_/ _ \ (_-<
++ * /_/ \_\____|___/_/ \_\  \___\___/_||_\__|_| \___/_/__/
++ *
++ */
++
++static const DECLARE_TLV_DB_SCALE(tas5713_vol_tlv, -10000, 50, 1);
++
++
++static const struct snd_kcontrol_new tas5713_snd_controls[] = {
++	SOC_SINGLE_TLV  ("Master"    , TAS5713_VOL_MASTER, 0, 248, 1, tas5713_vol_tlv),
++	SOC_DOUBLE_R_TLV("Channels"  , TAS5713_VOL_CH1, TAS5713_VOL_CH2, 0, 248, 1, tas5713_vol_tlv)
++};
++
++
++
++
++/*
++ *  __  __         _    _            ___      _
++ * |  \/  |__ _ __| |_ (_)_ _  ___  |   \ _ _(_)_ _____ _ _
++ * | |\/| / _` / _| ' \| | ' \/ -_) | |) | '_| \ V / -_) '_|
++ * |_|  |_\__,_\__|_||_|_|_||_\___| |___/|_| |_|\_/\___|_|
++ *
++ */
++
++static int tas5713_hw_params(struct snd_pcm_substream *substream,
++			    struct snd_pcm_hw_params *params,
++			    struct snd_soc_dai *dai)
++{
++	u16 blen = 0x00;
++
++	struct snd_soc_component *component = dai->component;
++	priv_data->component = component;
++
++	switch (params_format(params)) {
++	case SNDRV_PCM_FORMAT_S16_LE:
++		blen = 0x03;
++		break;
++	case SNDRV_PCM_FORMAT_S20_3LE:
++		blen = 0x1;
++		break;
++	case SNDRV_PCM_FORMAT_S24_LE:
++		blen = 0x04;
++		break;
++	case SNDRV_PCM_FORMAT_S32_LE:
++		blen = 0x05;
++		break;
++	default:
++		dev_err(dai->dev, "Unsupported word length: %u\n",
++			params_format(params));
++		return -EINVAL;
++	}
++
++	// set word length
++	snd_soc_component_update_bits(component, TAS5713_SERIAL_DATA_INTERFACE, 0x7, blen);
++
++	return 0;
++}
++
++
++static int tas5713_mute_stream(struct snd_soc_dai *dai, int mute, int stream)
++{
++	unsigned int val = 0;
++
++	struct tas5713_priv *tas5713;
++	struct snd_soc_component *component = dai->component;
++	tas5713 = snd_soc_component_get_drvdata(component);
++
++	if (mute) {
++		val = TAS5713_SOFT_MUTE_ALL;
++	}
++
++	return regmap_write(tas5713->regmap, TAS5713_SOFT_MUTE, val);
++}
++
++
++static const struct snd_soc_dai_ops tas5713_dai_ops = {
++	.hw_params 		= tas5713_hw_params,
++	.mute_stream	= tas5713_mute_stream,
++};
++
++
++static struct snd_soc_dai_driver tas5713_dai = {
++	.name		= "tas5713-hifi",
++	.playback 	= {
++		.stream_name	= "Playback",
++		.channels_min	= 2,
++		.channels_max	= 2,
++		.rates		    = SNDRV_PCM_RATE_8000_48000,
++		.formats	    = (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S32_LE ),
++	},
++	.ops        = &tas5713_dai_ops,
++};
++
++
++
++
++/*
++ *   ___         _          ___      _
++ *  / __|___  __| |___ __  |   \ _ _(_)_ _____ _ _
++ * | (__/ _ \/ _` / -_) _| | |) | '_| \ V / -_) '_|
++ *  \___\___/\__,_\___\__| |___/|_| |_|\_/\___|_|
++ *
++ */
++
++static void tas5713_remove(struct snd_soc_component *component)
++{
++	struct tas5713_priv *tas5713;
++
++	tas5713 = snd_soc_component_get_drvdata(component);
++}
++
++
++static int tas5713_probe(struct snd_soc_component *component)
++{
++	struct tas5713_priv *tas5713;
++	int i, ret;
++
++	i2c = container_of(component->dev, struct i2c_client, dev);
++
++	tas5713 = snd_soc_component_get_drvdata(component);
++
++	// Reset error
++	ret = snd_soc_component_write(component, TAS5713_ERROR_STATUS, 0x00);
++	if (ret < 0) return ret;
++
++	// Trim oscillator
++	ret = snd_soc_component_write(component, TAS5713_OSC_TRIM, 0x00);
++	if (ret < 0) return ret;
++	msleep(1000);
++
++	// Reset error
++	ret = snd_soc_component_write(component, TAS5713_ERROR_STATUS, 0x00);
++	if (ret < 0) return ret;
++
++	// I2S 24bit
++	ret = snd_soc_component_write(component, TAS5713_SERIAL_DATA_INTERFACE, 0x05);
++	if (ret < 0) return ret;
++
++	// Unmute
++	ret = snd_soc_component_write(component, TAS5713_SYSTEM_CTRL2, 0x00);
++	if (ret < 0) return ret;
++	ret = snd_soc_component_write(component, TAS5713_SOFT_MUTE, 0x00);
++	if (ret < 0) return ret;
++
++	// Set volume to 0db
++	ret = snd_soc_component_write(component, TAS5713_VOL_MASTER, 0x00);
++	if (ret < 0) return ret;
++
++	// Now start programming the default initialization sequence
++	for (i = 0; i < ARRAY_SIZE(tas5713_init_sequence); ++i) {
++		ret = i2c_master_send(i2c,
++				     tas5713_init_sequence[i].data,
++				     tas5713_init_sequence[i].size);
++		if (ret < 0) {
++			printk(KERN_INFO "TAS5713 CODEC PROBE: InitSeq returns: %d\n", ret);
++		}
++	}
++
++	// Unmute
++	ret = snd_soc_component_write(component, TAS5713_SYSTEM_CTRL2, 0x00);
++	if (ret < 0) return ret;
++
++	return 0;
++}
++
++
++static struct snd_soc_component_driver soc_codec_dev_tas5713 = {
++	.probe = tas5713_probe,
++	.remove = tas5713_remove,
++	.controls = tas5713_snd_controls,
++	.num_controls = ARRAY_SIZE(tas5713_snd_controls),
++};
++
++
++
++
++/*
++ *   ___ ___ ___   ___      _
++ *  |_ _|_  ) __| |   \ _ _(_)_ _____ _ _
++ *   | | / / (__  | |) | '_| \ V / -_) '_|
++ *  |___/___\___| |___/|_| |_|\_/\___|_|
++ *
++ */
++
++static const struct reg_default tas5713_reg_defaults[] = {
++	{ 0x07 ,0x80 },     // R7  - VOL_MASTER    - -40dB
++	{ 0x08 ,  30 },     // R8  - VOL_CH1	   -   0dB
++	{ 0x09 ,  30 },     // R9  - VOL_CH2       -   0dB
++	{ 0x0A ,0x80 },     // R10 - VOL_HEADPHONE - -40dB
++};
++
++
++static bool tas5713_reg_volatile(struct device *dev, unsigned int reg)
++{
++	switch (reg) {
++		case TAS5713_DEVICE_ID:
++		case TAS5713_ERROR_STATUS:
++		case TAS5713_CLOCK_CTRL:
++			return true;
++	default:
++			return false;
++	}
++}
++
++
++static const struct of_device_id tas5713_of_match[] = {
++	{ .compatible = "ti,tas5713", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, tas5713_of_match);
++
++
++static struct regmap_config tas5713_regmap_config = {
++	.reg_bits = 8,
++	.val_bits = 8,
++
++	.max_register = TAS5713_MAX_REGISTER,
++	.volatile_reg = tas5713_reg_volatile,
++
++	.cache_type = REGCACHE_RBTREE,
++	.reg_defaults = tas5713_reg_defaults,
++	.num_reg_defaults = ARRAY_SIZE(tas5713_reg_defaults),
++};
++
++
++static int tas5713_i2c_probe(struct i2c_client *i2c,
++			    const struct i2c_device_id *id)
++{
++	int ret;
++
++	priv_data = devm_kzalloc(&i2c->dev, sizeof *priv_data, GFP_KERNEL);
++	if (!priv_data)
++		return -ENOMEM;
++
++	priv_data->regmap = devm_regmap_init_i2c(i2c, &tas5713_regmap_config);
++	if (IS_ERR(priv_data->regmap)) {
++		ret = PTR_ERR(priv_data->regmap);
++		return ret;
++	}
++
++	i2c_set_clientdata(i2c, priv_data);
++
++	ret = snd_soc_register_component(&i2c->dev,
++				     &soc_codec_dev_tas5713, &tas5713_dai, 1);
++
++	return ret;
++}
++
++
++static void tas5713_i2c_remove(struct i2c_client *i2c)
++{
++	snd_soc_unregister_component(&i2c->dev);
++	i2c_set_clientdata(i2c, NULL);
++
++	kfree(priv_data);
++}
++
++
++static const struct i2c_device_id tas5713_i2c_id[] = {
++	{ "tas5713", 0 },
++	{ }
++};
++
++MODULE_DEVICE_TABLE(i2c, tas5713_i2c_id);
++
++
++static struct i2c_driver tas5713_i2c_driver = {
++	.driver = {
++		.name = "tas5713",
++		.owner = THIS_MODULE,
++		.of_match_table = tas5713_of_match,
++	},
++	.probe = tas5713_i2c_probe,
++	.remove = tas5713_i2c_remove,
++	.id_table = tas5713_i2c_id
++};
++
++
++static int __init tas5713_modinit(void)
++{
++	int ret = 0;
++
++	ret = i2c_add_driver(&tas5713_i2c_driver);
++	if (ret) {
++		printk(KERN_ERR "Failed to register tas5713 I2C driver: %d\n",
++		       ret);
++	}
++
++	return ret;
++}
++module_init(tas5713_modinit);
++
++
++static void __exit tas5713_exit(void)
++{
++	i2c_del_driver(&tas5713_i2c_driver);
++}
++module_exit(tas5713_exit);
++
++
++MODULE_AUTHOR("Sebastian Eickhoff <basti.eickhoff@googlemail.com>");
++MODULE_DESCRIPTION("ASoC driver for TAS5713");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/codecs/tas5713.h
+@@ -0,0 +1,210 @@
++/*
++ * ASoC Driver for TAS5713
++ *
++ * Author:      Sebastian Eickhoff <basti.eickhoff@googlemail.com>
++ *              Copyright 2014
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#ifndef _TAS5713_H
++#define _TAS5713_H
++
++
++// TAS5713 I2C-bus register addresses
++
++#define TAS5713_CLOCK_CTRL              0x00
++#define TAS5713_DEVICE_ID               0x01
++#define TAS5713_ERROR_STATUS            0x02
++#define TAS5713_SYSTEM_CTRL1            0x03
++#define TAS5713_SERIAL_DATA_INTERFACE   0x04
++#define TAS5713_SYSTEM_CTRL2            0x05
++#define TAS5713_SOFT_MUTE               0x06
++#define TAS5713_VOL_MASTER              0x07
++#define TAS5713_VOL_CH1                 0x08
++#define TAS5713_VOL_CH2                 0x09
++#define TAS5713_VOL_HEADPHONE           0x0A
++#define TAS5713_VOL_CONFIG              0x0E
++#define TAS5713_MODULATION_LIMIT        0x10
++#define TAS5713_IC_DLY_CH1              0x11
++#define TAS5713_IC_DLY_CH2              0x12
++#define TAS5713_IC_DLY_CH3              0x13
++#define TAS5713_IC_DLY_CH4              0x14
++
++#define TAS5713_START_STOP_PERIOD       0x1A
++#define TAS5713_OSC_TRIM                0x1B
++#define TAS5713_BKND_ERR                0x1C
++
++#define TAS5713_INPUT_MUX               0x20
++#define TAS5713_SRC_SELECT_CH4          0x21
++#define TAS5713_PWM_MUX                 0x25
++
++#define TAS5713_CH1_BQ0                 0x29
++#define TAS5713_CH1_BQ1                 0x2A
++#define TAS5713_CH1_BQ2                 0x2B
++#define TAS5713_CH1_BQ3                 0x2C
++#define TAS5713_CH1_BQ4                 0x2D
++#define TAS5713_CH1_BQ5                 0x2E
++#define TAS5713_CH1_BQ6                 0x2F
++#define TAS5713_CH1_BQ7                 0x58
++#define TAS5713_CH1_BQ8                 0x59
++
++#define TAS5713_CH2_BQ0                 0x30
++#define TAS5713_CH2_BQ1                 0x31
++#define TAS5713_CH2_BQ2                 0x32
++#define TAS5713_CH2_BQ3                 0x33
++#define TAS5713_CH2_BQ4                 0x34
++#define TAS5713_CH2_BQ5                 0x35
++#define TAS5713_CH2_BQ6                 0x36
++#define TAS5713_CH2_BQ7                 0x5C
++#define TAS5713_CH2_BQ8                 0x5D
++
++#define TAS5713_CH4_BQ0                 0x5A
++#define TAS5713_CH4_BQ1                 0x5B
++#define TAS5713_CH3_BQ0                 0x5E
++#define TAS5713_CH3_BQ1                 0x5F
++
++#define TAS5713_DRC1_SOFTENING_FILTER_ALPHA_OMEGA       0x3B
++#define TAS5713_DRC1_ATTACK_RELEASE_RATE                0x3C
++#define TAS5713_DRC2_SOFTENING_FILTER_ALPHA_OMEGA       0x3E
++#define TAS5713_DRC2_ATTACK_RELEASE_RATE                0x3F
++#define TAS5713_DRC1_ATTACK_RELEASE_THRES               0x40
++#define TAS5713_DRC2_ATTACK_RELEASE_THRES               0x43
++#define TAS5713_DRC_CTRL                                0x46
++
++#define TAS5713_BANK_SW_CTRL            0x50
++#define TAS5713_CH1_OUTPUT_MIXER        0x51
++#define TAS5713_CH2_OUTPUT_MIXER        0x52
++#define TAS5713_CH1_INPUT_MIXER         0x53
++#define TAS5713_CH2_INPUT_MIXER         0x54
++#define TAS5713_OUTPUT_POST_SCALE       0x56
++#define TAS5713_OUTPUT_PRESCALE         0x57
++
++#define TAS5713_IDF_POST_SCALE          0x62
++
++#define TAS5713_CH1_INLINE_MIXER        0x70
++#define TAS5713_CH1_INLINE_DRC_EN_MIXER 0x71
++#define TAS5713_CH1_R_CHANNEL_MIXER     0x72
++#define TAS5713_CH1_L_CHANNEL_MIXER     0x73
++#define TAS5713_CH2_INLINE_MIXER        0x74
++#define TAS5713_CH2_INLINE_DRC_EN_MIXER 0x75
++#define TAS5713_CH2_L_CHANNEL_MIXER     0x76
++#define TAS5713_CH2_R_CHANNEL_MIXER     0x77
++
++#define TAS5713_UPDATE_DEV_ADDR_KEY     0xF8
++#define TAS5713_UPDATE_DEV_ADDR_REG     0xF9
++
++#define TAS5713_REGISTER_COUNT          0x46
++#define TAS5713_MAX_REGISTER            0xF9
++
++
++// Bitmasks for registers
++#define TAS5713_SOFT_MUTE_ALL           0x07
++
++
++
++struct tas5713_init_command {
++        const int size;
++        const char *const data;
++};
++
++static const struct tas5713_init_command tas5713_init_sequence[] = {
++
++        // Trim oscillator
++    { .size = 2,  .data = "\x1B\x00" },
++    // System control register 1 (0x03): block DC
++    { .size = 2,  .data = "\x03\x80" },
++    // Mute everything
++    { .size = 2,  .data = "\x05\x40" },
++    // Modulation limit register (0x10): 97.7%
++    { .size = 2,  .data = "\x10\x02" },
++    // Interchannel delay registers
++    // (0x11, 0x12, 0x13, and 0x14): BD mode
++    { .size = 2,  .data = "\x11\xB8" },
++    { .size = 2,  .data = "\x12\x60" },
++    { .size = 2,  .data = "\x13\xA0" },
++    { .size = 2,  .data = "\x14\x48" },
++    // PWM shutdown group register (0x19): no shutdown
++    { .size = 2,  .data = "\x19\x00" },
++    // Input multiplexer register (0x20): BD mode
++    { .size = 2,  .data = "\x20\x00\x89\x77\x72" },
++    // PWM output mux register (0x25)
++    // Channel 1 --> OUTA, channel 1 neg --> OUTB
++    // Channel 2 --> OUTC, channel 2 neg --> OUTD
++    { .size = 5,  .data = "\x25\x01\x02\x13\x45" },
++    // DRC control (0x46): DRC off
++    { .size = 5,  .data = "\x46\x00\x00\x00\x00" },
++    // BKND_ERR register (0x1C): 299ms reset period
++    { .size = 2,  .data = "\x1C\x07" },
++    // Mute channel 3
++    { .size = 2,  .data = "\x0A\xFF" },
++    // Volume configuration register (0x0E): volume slew 512 steps
++    { .size = 2,  .data = "\x0E\x90" },
++    // Clock control register (0x00): 44/48kHz, MCLK=64xfs
++    { .size = 2,  .data = "\x00\x60" },
++    // Bank switch and eq control (0x50): no bank switching
++    { .size = 5,  .data = "\x50\x00\x00\x00\x00" },
++    // Volume registers (0x07, 0x08, 0x09, 0x0A)
++    { .size = 2,  .data = "\x07\x20" },
++    { .size = 2,  .data = "\x08\x30" },
++    { .size = 2,  .data = "\x09\x30" },
++    { .size = 2,  .data = "\x0A\xFF" },
++    // 0x72, 0x73, 0x76, 0x77 input mixer:
++    // no intermix between channels
++    { .size = 5,  .data = "\x72\x00\x00\x00\x00" },
++    { .size = 5,  .data = "\x73\x00\x80\x00\x00" },
++    { .size = 5,  .data = "\x76\x00\x00\x00\x00" },
++    { .size = 5,  .data = "\x77\x00\x80\x00\x00" },
++    // 0x70, 0x71, 0x74, 0x75 inline DRC mixer:
++    // no inline DRC inmix
++    { .size = 5,  .data = "\x70\x00\x80\x00\x00" },
++    { .size = 5,  .data = "\x71\x00\x00\x00\x00" },
++    { .size = 5,  .data = "\x74\x00\x80\x00\x00" },
++    { .size = 5,  .data = "\x75\x00\x00\x00\x00" },
++    // 0x56, 0x57 Output scale
++    { .size = 5,  .data = "\x56\x00\x80\x00\x00" },
++    { .size = 5,  .data = "\x57\x00\x02\x00\x00" },
++    // 0x3B, 0x3c
++    { .size = 9,  .data = "\x3B\x00\x08\x00\x00\x00\x78\x00\x00" },
++    { .size = 9,  .data = "\x3C\x00\x00\x01\x00\xFF\xFF\xFF\x00" },
++    { .size = 9,  .data = "\x3E\x00\x08\x00\x00\x00\x78\x00\x00" },
++    { .size = 9,  .data = "\x3F\x00\x00\x01\x00\xFF\xFF\xFF\x00" },
++    { .size = 9,  .data = "\x40\x00\x00\x01\x00\xFF\xFF\xFF\x00" },
++    { .size = 9,  .data = "\x43\x00\x00\x01\x00\xFF\xFF\xFF\x00" },
++    // 0x51, 0x52: output mixer
++    { .size = 9,  .data = "\x51\x00\x80\x00\x00\x00\x00\x00\x00" },
++    { .size = 9,  .data = "\x52\x00\x80\x00\x00\x00\x00\x00\x00" },
++    // PEQ defaults
++    { .size = 21,  .data = "\x29\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x2A\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x2B\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x2C\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x2D\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x2E\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x2F\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x30\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x31\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x32\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x33\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x34\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x35\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x36\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x58\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x59\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x5C\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x5D\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x5E\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x5F\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x5A\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x5B\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++};
++
++
++#endif  /* _TAS5713_H */
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -1220,7 +1220,15 @@ int snd_soc_runtime_set_dai_fmt(struct s
+ 		return 0;
+ 
+ 	for_each_rtd_codec_dais(rtd, i, codec_dai) {
+-		ret = snd_soc_dai_set_fmt(codec_dai, dai_fmt);
++		unsigned int codec_dai_fmt = dai_fmt;
++
++		// there can only be one master when using multiple codecs
++		if (i && (codec_dai_fmt & SND_SOC_DAIFMT_MASTER_MASK)) {
++			codec_dai_fmt &= ~SND_SOC_DAIFMT_MASTER_MASK;
++			codec_dai_fmt |= SND_SOC_DAIFMT_CBS_CFS;
++		}
++
++		ret = snd_soc_dai_set_fmt(codec_dai, codec_dai_fmt);
+ 		if (ret != 0 && ret != -ENOTSUPP)
+ 			return ret;
+ 	}
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -856,8 +856,14 @@ static int usb_audio_probe(struct usb_in
+ 	if (ignore_ctl_error)
+ 		chip->quirk_flags |= QUIRK_FLAG_IGNORE_CTL_ERROR;
+ 
+-	if (chip->quirk_flags & QUIRK_FLAG_DISABLE_AUTOSUSPEND)
++	if (chip->quirk_flags & QUIRK_FLAG_DISABLE_AUTOSUSPEND) {
++		/*
++		* Grab the interface, because on a webcam uvcvideo may race
++		* with snd-usb-audio during probe and re-enable autosuspend.
++		*/
++		usb_autopm_get_interface(intf);
+ 		usb_disable_autosuspend(interface_to_usbdev(intf));
++	}
+ 
+ 	/*
+ 	 * For devices with more than one control interface, we assume the
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -2156,6 +2156,8 @@ static const struct usb_audio_quirk_flag
+ 		   QUIRK_FLAG_FIXED_RATE),
+ 	DEVICE_FLG(0x0ecb, 0x2069, /* JBL Quantum810 Wireless */
+ 		   QUIRK_FLAG_FIXED_RATE),
++	DEVICE_FLG(0x09da, 0x2695, /* A4Tech FHD 1080p webcam */
++		   QUIRK_FLAG_DISABLE_AUTOSUSPEND | QUIRK_FLAG_GET_SAMPLE_RATE),
+ 
+ 	/* Vendor matches */
+ 	VENDOR_FLG(0x045e, /* MS Lifecam */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0125-rpi_display-add-backlight-driver-and-overlay.patch b/target/linux/bcm27xx/patches-6.1/950-0125-rpi_display-add-backlight-driver-and-overlay.patch
new file mode 100644
index 00000000000000..b8351a7475f5ac
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0125-rpi_display-add-backlight-driver-and-overlay.patch
@@ -0,0 +1,172 @@
+From 60e18013e50d1ad1307d55378f859cc8c985e5c0 Mon Sep 17 00:00:00 2001
+From: P33M <P33M@github.com>
+Date: Wed, 21 Oct 2015 14:55:21 +0100
+Subject: [PATCH] rpi_display: add backlight driver and overlay
+
+Add a mailbox-driven backlight controller for the Raspberry Pi DSI
+touchscreen display. Requires updated GPU firmware to recognise the
+mailbox request.
+
+Signed-off-by: Gordon Hollingworth <gordon@raspberrypi.org>
+
+Add Raspberry Pi firmware driver to the dependencies of backlight driver
+
+Otherwise the backlight driver fails to build if the firmware
+loading driver is not in the kernel
+
+Signed-off-by: Alex Riesen <alexander.riesen@cetitec.com>
+---
+ drivers/video/backlight/Kconfig         |   7 ++
+ drivers/video/backlight/Makefile        |   1 +
+ drivers/video/backlight/rpi_backlight.c | 119 ++++++++++++++++++++++++
+ 3 files changed, 127 insertions(+)
+ create mode 100644 drivers/video/backlight/rpi_backlight.c
+
+--- a/drivers/video/backlight/Kconfig
++++ b/drivers/video/backlight/Kconfig
+@@ -248,6 +248,13 @@ config BACKLIGHT_PWM
+ 	  If you have a LCD backlight adjustable by PWM, say Y to enable
+ 	  this driver.
+ 
++config BACKLIGHT_RPI
++	tristate "Raspberry Pi display firmware driven backlight"
++	depends on RASPBERRYPI_FIRMWARE
++	help
++	  If you have the Raspberry Pi DSI touchscreen display, say Y to
++	  enable the mailbox-controlled backlight driver.
++
+ config BACKLIGHT_DA903X
+ 	tristate "Backlight Driver for DA9030/DA9034 using WLED"
+ 	depends on PMIC_DA903X
+--- a/drivers/video/backlight/Makefile
++++ b/drivers/video/backlight/Makefile
+@@ -50,6 +50,7 @@ obj-$(CONFIG_BACKLIGHT_PANDORA)		+= pand
+ obj-$(CONFIG_BACKLIGHT_PCF50633)	+= pcf50633-backlight.o
+ obj-$(CONFIG_BACKLIGHT_PWM)		+= pwm_bl.o
+ obj-$(CONFIG_BACKLIGHT_QCOM_WLED)	+= qcom-wled.o
++obj-$(CONFIG_BACKLIGHT_RPI)			+= rpi_backlight.o
+ obj-$(CONFIG_BACKLIGHT_RT4831)		+= rt4831-backlight.o
+ obj-$(CONFIG_BACKLIGHT_SAHARA)		+= kb3886_bl.o
+ obj-$(CONFIG_BACKLIGHT_SKY81452)	+= sky81452-backlight.o
+--- /dev/null
++++ b/drivers/video/backlight/rpi_backlight.c
+@@ -0,0 +1,119 @@
++/*
++ * rpi_bl.c - Backlight controller through VPU
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/backlight.h>
++#include <linux/err.h>
++#include <linux/fb.h>
++#include <linux/gpio.h>
++#include <linux/init.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/of_gpio.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
++struct rpi_backlight {
++	struct device *dev;
++	struct device *fbdev;
++	struct rpi_firmware *fw;
++};
++
++static int rpi_backlight_update_status(struct backlight_device *bl)
++{
++	struct rpi_backlight *gbl = bl_get_data(bl);
++	int brightness = bl->props.brightness;
++	int ret;
++
++	if (bl->props.power != FB_BLANK_UNBLANK ||
++	    bl->props.fb_blank != FB_BLANK_UNBLANK ||
++	    bl->props.state & (BL_CORE_SUSPENDED | BL_CORE_FBBLANK))
++		brightness = 0;
++
++	ret = rpi_firmware_property(gbl->fw,
++			RPI_FIRMWARE_FRAMEBUFFER_SET_BACKLIGHT,
++			&brightness, sizeof(brightness));
++	if (ret) {
++		dev_err(gbl->dev, "Failed to set brightness\n");
++		return ret;
++	}
++
++	if (brightness < 0) {
++		dev_err(gbl->dev, "Backlight change failed\n");
++		return -EAGAIN;
++	}
++
++	return 0;
++}
++
++static const struct backlight_ops rpi_backlight_ops = {
++	.options	= BL_CORE_SUSPENDRESUME,
++	.update_status	= rpi_backlight_update_status,
++};
++
++static int rpi_backlight_probe(struct platform_device *pdev)
++{
++	struct backlight_properties props;
++	struct backlight_device *bl;
++	struct rpi_backlight *gbl;
++	struct device_node *fw_node;
++
++	gbl = devm_kzalloc(&pdev->dev, sizeof(*gbl), GFP_KERNEL);
++	if (gbl == NULL)
++		return -ENOMEM;
++
++	gbl->dev = &pdev->dev;
++
++	fw_node = of_parse_phandle(pdev->dev.of_node, "firmware", 0);
++	if (!fw_node) {
++		dev_err(&pdev->dev, "Missing firmware node\n");
++		return -ENOENT;
++	}
++
++	gbl->fw = rpi_firmware_get(fw_node);
++	if (!gbl->fw)
++		return -EPROBE_DEFER;
++
++	memset(&props, 0, sizeof(props));
++	props.type = BACKLIGHT_RAW;
++	props.max_brightness = 255;
++	bl = devm_backlight_device_register(&pdev->dev, dev_name(&pdev->dev),
++					&pdev->dev, gbl, &rpi_backlight_ops,
++					&props);
++	if (IS_ERR(bl)) {
++		dev_err(&pdev->dev, "failed to register backlight\n");
++		return PTR_ERR(bl);
++	}
++
++	bl->props.brightness = 255;
++	backlight_update_status(bl);
++
++	platform_set_drvdata(pdev, bl);
++	return 0;
++}
++
++static const struct of_device_id rpi_backlight_of_match[] = {
++	{ .compatible = "raspberrypi,rpi-backlight" },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, rpi_backlight_of_match);
++
++static struct platform_driver rpi_backlight_driver = {
++	.driver		= {
++		.name		= "rpi-backlight",
++		.of_match_table = of_match_ptr(rpi_backlight_of_match),
++	},
++	.probe		= rpi_backlight_probe,
++};
++
++module_platform_driver(rpi_backlight_driver);
++
++MODULE_AUTHOR("Gordon Hollingworth <gordon@raspberrypi.org>");
++MODULE_DESCRIPTION("Raspberry Pi mailbox based Backlight Driver");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0126-bcm2835-virtgpio-Virtual-GPIO-driver.patch b/target/linux/bcm27xx/patches-6.1/950-0126-bcm2835-virtgpio-Virtual-GPIO-driver.patch
new file mode 100644
index 00000000000000..e84b1dfd72aa30
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0126-bcm2835-virtgpio-Virtual-GPIO-driver.patch
@@ -0,0 +1,268 @@
+From 33810c078d48da7e628b74ef6537a589f41bee2b Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Tue, 23 Feb 2016 19:56:04 +0000
+Subject: [PATCH] bcm2835-virtgpio: Virtual GPIO driver
+
+Add a virtual GPIO driver that uses the firmware mailbox interface to
+request that the VPU toggles LEDs.
+
+gpio: bcm-virt: Fix the get() method
+
+The get() method does not understand the on-the-wire encoding of the
+remote GPIO states, thinking they are simple on/off bits when they are
+really pairs of 16-bit counts. Rewrite the get() handler to return the
+value last written, which will eventually match the actual GPIO state
+if there are no other changes.
+
+See: https://github.com/raspberrypi/linux/issues/4638
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/gpio/Kconfig         |   6 +
+ drivers/gpio/Makefile        |   1 +
+ drivers/gpio/gpio-bcm-virt.c | 214 +++++++++++++++++++++++++++++++++++
+ 3 files changed, 221 insertions(+)
+ create mode 100644 drivers/gpio/gpio-bcm-virt.c
+
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -194,6 +194,12 @@ config GPIO_BCM_XGS_IPROC
+ 	help
+ 	  Say yes here to enable GPIO support for Broadcom XGS iProc SoCs.
+ 
++config GPIO_BCM_VIRT
++	bool "Broadcom Virt GPIO"
++	depends on OF_GPIO && RASPBERRYPI_FIRMWARE && (ARCH_BCM2835 || COMPILE_TEST)
++	help
++	  Turn on virtual GPIO support for Broadcom BCM283X chips.
++
+ config GPIO_BRCMSTB
+ 	tristate "BRCMSTB GPIO support"
+ 	default y if (ARCH_BRCMSTB || BMIPS_GENERIC)
+--- a/drivers/gpio/Makefile
++++ b/drivers/gpio/Makefile
+@@ -37,6 +37,7 @@ obj-$(CONFIG_GPIO_ASPEED_SGPIO)		+= gpio
+ obj-$(CONFIG_GPIO_ATH79)		+= gpio-ath79.o
+ obj-$(CONFIG_GPIO_BCM_KONA)		+= gpio-bcm-kona.o
+ obj-$(CONFIG_GPIO_BCM_XGS_IPROC)	+= gpio-xgs-iproc.o
++obj-$(CONFIG_GPIO_BCM_VIRT)		+= gpio-bcm-virt.o
+ obj-$(CONFIG_GPIO_BD71815)		+= gpio-bd71815.o
+ obj-$(CONFIG_GPIO_BD71828)		+= gpio-bd71828.o
+ obj-$(CONFIG_GPIO_BD9571MWV)		+= gpio-bd9571mwv.o
+--- /dev/null
++++ b/drivers/gpio/gpio-bcm-virt.c
+@@ -0,0 +1,214 @@
++/*
++ *  brcmvirt GPIO driver
++ *
++ *  Copyright (C) 2012,2013 Dom Cobley <popcornmix@gmail.com>
++ *  Based on gpio-clps711x.c by Alexander Shiyan <shc_work@mail.ru>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ */
++
++#include <linux/err.h>
++#include <linux/gpio.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/dma-mapping.h>
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
++#define MODULE_NAME "brcmvirt-gpio"
++#define NUM_GPIO 2
++
++struct brcmvirt_gpio {
++	struct gpio_chip	gc;
++	u32 __iomem		*ts_base;
++	/* two packed 16-bit counts of enabled and disables
++           Allows host to detect a brief enable that was missed */
++	u32			enables_disables[NUM_GPIO];
++	dma_addr_t		bus_addr;
++};
++
++static int brcmvirt_gpio_dir_in(struct gpio_chip *gc, unsigned off)
++{
++	struct brcmvirt_gpio *gpio;
++	gpio = container_of(gc, struct brcmvirt_gpio, gc);
++	return -EINVAL;
++}
++
++static int brcmvirt_gpio_dir_out(struct gpio_chip *gc, unsigned off, int val)
++{
++	struct brcmvirt_gpio *gpio;
++	gpio = container_of(gc, struct brcmvirt_gpio, gc);
++	return 0;
++}
++
++static int brcmvirt_gpio_get(struct gpio_chip *gc, unsigned off)
++{
++	struct brcmvirt_gpio *gpio;
++	unsigned v;
++	gpio = container_of(gc, struct brcmvirt_gpio, gc);
++	v = readl(gpio->ts_base + off);
++	return (s16)((v >> 16) - v) > 0;
++}
++
++static void brcmvirt_gpio_set(struct gpio_chip *gc, unsigned off, int val)
++{
++	struct brcmvirt_gpio *gpio;
++	u16 enables, disables;
++	s16 diff;
++	bool lit;
++	gpio = container_of(gc, struct brcmvirt_gpio, gc);
++	enables  = gpio->enables_disables[off] >> 16;
++	disables = gpio->enables_disables[off] >>  0;
++	diff = (s16)(enables - disables);
++	lit = diff > 0;
++	if ((val && lit) || (!val && !lit))
++		return;
++	if (val)
++		enables++;
++	else
++		disables++;
++	diff = (s16)(enables - disables);
++	BUG_ON(diff != 0 && diff != 1);
++	gpio->enables_disables[off] = (enables << 16) | (disables << 0);
++	writel(gpio->enables_disables[off], gpio->ts_base + off);
++}
++
++static int brcmvirt_gpio_probe(struct platform_device *pdev)
++{
++	int err = 0;
++	struct device *dev = &pdev->dev;
++	struct device_node *np = dev->of_node;
++	struct device_node *fw_node;
++	struct rpi_firmware *fw;
++	struct brcmvirt_gpio *ucb;
++	u32 gpiovirtbuf;
++
++	fw_node = of_parse_phandle(np, "firmware", 0);
++	if (!fw_node) {
++		dev_err(dev, "Missing firmware node\n");
++		return -ENOENT;
++	}
++
++	fw = rpi_firmware_get(fw_node);
++	if (!fw)
++		return -EPROBE_DEFER;
++
++	ucb = devm_kzalloc(dev, sizeof *ucb, GFP_KERNEL);
++	if (!ucb) {
++		err = -EINVAL;
++		goto out;
++	}
++
++	ucb->ts_base = dma_alloc_coherent(dev, PAGE_SIZE, &ucb->bus_addr, GFP_KERNEL);
++	if (!ucb->ts_base) {
++		pr_err("[%s]: failed to dma_alloc_coherent(%ld)\n",
++				__func__, PAGE_SIZE);
++		err = -ENOMEM;
++		goto out;
++	}
++
++	gpiovirtbuf = (u32)ucb->bus_addr;
++	err = rpi_firmware_property(fw, RPI_FIRMWARE_FRAMEBUFFER_SET_GPIOVIRTBUF,
++				    &gpiovirtbuf, sizeof(gpiovirtbuf));
++
++	if (err || gpiovirtbuf != 0) {
++		dev_warn(dev, "Failed to set gpiovirtbuf, trying to get err:%x\n", err);
++		dma_free_coherent(dev, PAGE_SIZE, ucb->ts_base, ucb->bus_addr);
++		ucb->ts_base = 0;
++		ucb->bus_addr = 0;
++	}
++
++	if (!ucb->ts_base) {
++		err = rpi_firmware_property(fw, RPI_FIRMWARE_FRAMEBUFFER_GET_GPIOVIRTBUF,
++					    &gpiovirtbuf, sizeof(gpiovirtbuf));
++
++		if (err) {
++			dev_err(dev, "Failed to get gpiovirtbuf\n");
++			goto out;
++		}
++
++		if (!gpiovirtbuf) {
++			dev_err(dev, "No virtgpio buffer\n");
++			err = -ENOENT;
++			goto out;
++		}
++
++		// mmap the physical memory
++		gpiovirtbuf &= ~0xc0000000;
++		ucb->ts_base = ioremap(gpiovirtbuf, 4096);
++		if (ucb->ts_base == NULL) {
++			dev_err(dev, "Failed to map physical address\n");
++			err = -ENOENT;
++			goto out;
++		}
++		ucb->bus_addr = 0;
++	}
++	ucb->gc.label = MODULE_NAME;
++	ucb->gc.owner = THIS_MODULE;
++	//ucb->gc.dev = dev;
++	ucb->gc.of_node = np;
++	ucb->gc.base = 100;
++	ucb->gc.ngpio = NUM_GPIO;
++
++	ucb->gc.direction_input = brcmvirt_gpio_dir_in;
++	ucb->gc.direction_output = brcmvirt_gpio_dir_out;
++	ucb->gc.get = brcmvirt_gpio_get;
++	ucb->gc.set = brcmvirt_gpio_set;
++	ucb->gc.can_sleep = true;
++
++	err = gpiochip_add(&ucb->gc);
++	if (err)
++		goto out;
++
++	platform_set_drvdata(pdev, ucb);
++
++	return 0;
++out:
++	if (ucb->bus_addr) {
++		dma_free_coherent(dev, PAGE_SIZE, ucb->ts_base, ucb->bus_addr);
++		ucb->bus_addr = 0;
++		ucb->ts_base = NULL;
++	} else if (ucb->ts_base) {
++		iounmap(ucb->ts_base);
++		ucb->ts_base = NULL;
++	}
++	return err;
++}
++
++static int brcmvirt_gpio_remove(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	int err = 0;
++	struct brcmvirt_gpio *ucb = platform_get_drvdata(pdev);
++
++	gpiochip_remove(&ucb->gc);
++	if (ucb->bus_addr)
++		dma_free_coherent(dev, PAGE_SIZE, ucb->ts_base, ucb->bus_addr);
++	else if (ucb->ts_base)
++		iounmap(ucb->ts_base);
++	return err;
++}
++
++static const struct of_device_id __maybe_unused brcmvirt_gpio_ids[] = {
++	{ .compatible = "brcm,bcm2835-virtgpio" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, brcmvirt_gpio_ids);
++
++static struct platform_driver brcmvirt_gpio_driver = {
++	.driver	= {
++		.name		= MODULE_NAME,
++		.owner		= THIS_MODULE,
++		.of_match_table	= of_match_ptr(brcmvirt_gpio_ids),
++	},
++	.probe	= brcmvirt_gpio_probe,
++	.remove	= brcmvirt_gpio_remove,
++};
++module_platform_driver(brcmvirt_gpio_driver);
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Dom Cobley <popcornmix@gmail.com>");
++MODULE_DESCRIPTION("brcmvirt GPIO driver");
++MODULE_ALIAS("platform:brcmvirt-gpio");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0127-OF-DT-Overlay-configfs-interface.patch b/target/linux/bcm27xx/patches-6.1/950-0127-OF-DT-Overlay-configfs-interface.patch
new file mode 100644
index 00000000000000..c3f60badf9f346
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0127-OF-DT-Overlay-configfs-interface.patch
@@ -0,0 +1,404 @@
+From e438983899b06cf3534b773b6e19cb291456e5cb Mon Sep 17 00:00:00 2001
+From: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
+Date: Wed, 3 Dec 2014 13:23:28 +0200
+Subject: [PATCH] OF: DT-Overlay configfs interface
+
+This is a port of Pantelis Antoniou's v3 port that makes use of the
+new upstreamed configfs support for binary attributes.
+
+Original commit message:
+
+Add a runtime interface to using configfs for generic device tree overlay
+usage. With it its possible to use device tree overlays without having
+to use a per-platform overlay manager.
+
+Please see Documentation/devicetree/configfs-overlays.txt for more info.
+
+Changes since v2:
+- Removed ifdef CONFIG_OF_OVERLAY (since for now it's required)
+- Created a documentation entry
+- Slight rewording in Kconfig
+
+Changes since v1:
+- of_resolve() -> of_resolve_phandles().
+
+Originally-signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+DT configfs: Fix build errors on other platforms
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+DT configfs: fix build error
+
+There is an error when compiling rpi-4.6.y branch:
+  CC      drivers/of/configfs.o
+drivers/of/configfs.c:291:21: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types]
+   .default_groups = of_cfs_def_groups,
+                     ^
+drivers/of/configfs.c:291:21: note: (near initialization for 'of_cfs_subsys.su_group.default_groups.next')
+
+The .default_groups is linked list since commit
+1ae1602de028acaa42a0f6ff18d19756f8e825c6.
+This commit uses configfs_add_default_group to fix this problem.
+
+Signed-off-by: Slawomir Stepien <sst@poczta.fm>
+
+configfs: New of_overlay API
+
+of: configfs: Use of_overlay_fdt_apply API call
+
+The published API to the dynamic overlay application mechanism now
+takes a Flattened Device Tree blob as input so that it can manage the
+lifetime of the unflattened tree. Conveniently, the new API call -
+of_overlay_fdt_apply - is virtually a drop-in replacement for
+create_overlay, which can now be deleted.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ .../devicetree/configfs-overlays.txt          |  31 ++
+ drivers/of/Kconfig                            |   7 +
+ drivers/of/Makefile                           |   1 +
+ drivers/of/configfs.c                         | 277 ++++++++++++++++++
+ 4 files changed, 316 insertions(+)
+ create mode 100644 Documentation/devicetree/configfs-overlays.txt
+ create mode 100644 drivers/of/configfs.c
+
+--- /dev/null
++++ b/Documentation/devicetree/configfs-overlays.txt
+@@ -0,0 +1,31 @@
++Howto use the configfs overlay interface.
++
++A device-tree configfs entry is created in /config/device-tree/overlays
++and and it is manipulated using standard file system I/O.
++Note that this is a debug level interface, for use by developers and
++not necessarily something accessed by normal users due to the
++security implications of having direct access to the kernel's device tree.
++
++* To create an overlay you mkdir the directory:
++
++	# mkdir /config/device-tree/overlays/foo
++
++* Either you echo the overlay firmware file to the path property file.
++
++	# echo foo.dtbo >/config/device-tree/overlays/foo/path
++
++* Or you cat the contents of the overlay to the dtbo file
++
++	# cat foo.dtbo >/config/device-tree/overlays/foo/dtbo
++
++The overlay file will be applied, and devices will be created/destroyed
++as required.
++
++To remove it simply rmdir the directory.
++
++	# rmdir /config/device-tree/overlays/foo
++
++The rationalle of the dual interface (firmware & direct copy) is that each is
++better suited to different use patterns. The firmware interface is what's
++intended to be used by hardware managers in the kernel, while the copy interface
++make sense for developers (since it avoids problems with namespaces).
+--- a/drivers/of/Kconfig
++++ b/drivers/of/Kconfig
+@@ -94,4 +94,11 @@ config OF_DMA_DEFAULT_COHERENT
+ 	# arches should select this if DMA is coherent by default for OF devices
+ 	bool
+ 
++config OF_CONFIGFS
++	bool "Device Tree Overlay ConfigFS interface"
++	select CONFIGFS_FS
++	select OF_OVERLAY
++	help
++	  Enable a simple user-space driven DT overlay interface.
++
+ endif # OF
+--- a/drivers/of/Makefile
++++ b/drivers/of/Makefile
+@@ -1,6 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ obj-y = base.o device.o module.o platform.o property.o
+ obj-$(CONFIG_OF_KOBJ) += kobj.o
++obj-$(CONFIG_OF_CONFIGFS) += configfs.o
+ obj-$(CONFIG_OF_DYNAMIC) += dynamic.o
+ obj-$(CONFIG_OF_FLATTREE) += fdt.o
+ obj-$(CONFIG_OF_EARLY_FLATTREE) += fdt_address.o
+--- /dev/null
++++ b/drivers/of/configfs.c
+@@ -0,0 +1,277 @@
++/*
++ * Configfs entries for device-tree
++ *
++ * Copyright (C) 2013 - Pantelis Antoniou <panto@antoniou-consulting.com>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * as published by the Free Software Foundation; either version
++ * 2 of the License, or (at your option) any later version.
++ */
++#include <linux/ctype.h>
++#include <linux/cpu.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/of_fdt.h>
++#include <linux/spinlock.h>
++#include <linux/slab.h>
++#include <linux/proc_fs.h>
++#include <linux/configfs.h>
++#include <linux/types.h>
++#include <linux/stat.h>
++#include <linux/limits.h>
++#include <linux/file.h>
++#include <linux/vmalloc.h>
++#include <linux/firmware.h>
++#include <linux/sizes.h>
++
++#include "of_private.h"
++
++struct cfs_overlay_item {
++	struct config_item	item;
++
++	char			path[PATH_MAX];
++
++	const struct firmware	*fw;
++	struct device_node	*overlay;
++	int			ov_id;
++
++	void			*dtbo;
++	int			dtbo_size;
++};
++
++static inline struct cfs_overlay_item *to_cfs_overlay_item(
++		struct config_item *item)
++{
++	return item ? container_of(item, struct cfs_overlay_item, item) : NULL;
++}
++
++static ssize_t cfs_overlay_item_path_show(struct config_item *item,
++		char *page)
++{
++	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
++	return sprintf(page, "%s\n", overlay->path);
++}
++
++static ssize_t cfs_overlay_item_path_store(struct config_item *item,
++		const char *page, size_t count)
++{
++	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
++	const char *p = page;
++	char *s;
++	int err;
++
++	/* if it's set do not allow changes */
++	if (overlay->path[0] != '\0' || overlay->dtbo_size > 0)
++		return -EPERM;
++
++	/* copy to path buffer (and make sure it's always zero terminated */
++	count = snprintf(overlay->path, sizeof(overlay->path) - 1, "%s", p);
++	overlay->path[sizeof(overlay->path) - 1] = '\0';
++
++	/* strip trailing newlines */
++	s = overlay->path + strlen(overlay->path);
++	while (s > overlay->path && *--s == '\n')
++		*s = '\0';
++
++	pr_debug("%s: path is '%s'\n", __func__, overlay->path);
++
++	err = request_firmware(&overlay->fw, overlay->path, NULL);
++	if (err != 0)
++		goto out_err;
++
++	err = of_overlay_fdt_apply((void *)overlay->fw->data,
++				   (u32)overlay->fw->size, &overlay->ov_id);
++	if (err != 0)
++		goto out_err;
++
++	return count;
++
++out_err:
++
++	release_firmware(overlay->fw);
++	overlay->fw = NULL;
++
++	overlay->path[0] = '\0';
++	return err;
++}
++
++static ssize_t cfs_overlay_item_status_show(struct config_item *item,
++		char *page)
++{
++	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
++
++	return sprintf(page, "%s\n",
++			overlay->ov_id > 0 ? "applied" : "unapplied");
++}
++
++CONFIGFS_ATTR(cfs_overlay_item_, path);
++CONFIGFS_ATTR_RO(cfs_overlay_item_, status);
++
++static struct configfs_attribute *cfs_overlay_attrs[] = {
++	&cfs_overlay_item_attr_path,
++	&cfs_overlay_item_attr_status,
++	NULL,
++};
++
++ssize_t cfs_overlay_item_dtbo_read(struct config_item *item,
++		void *buf, size_t max_count)
++{
++	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
++
++	pr_debug("%s: buf=%p max_count=%zu\n", __func__,
++			buf, max_count);
++
++	if (overlay->dtbo == NULL)
++		return 0;
++
++	/* copy if buffer provided */
++	if (buf != NULL) {
++		/* the buffer must be large enough */
++		if (overlay->dtbo_size > max_count)
++			return -ENOSPC;
++
++		memcpy(buf, overlay->dtbo, overlay->dtbo_size);
++	}
++
++	return overlay->dtbo_size;
++}
++
++ssize_t cfs_overlay_item_dtbo_write(struct config_item *item,
++		const void *buf, size_t count)
++{
++	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
++	int err;
++
++	/* if it's set do not allow changes */
++	if (overlay->path[0] != '\0' || overlay->dtbo_size > 0)
++		return -EPERM;
++
++	/* copy the contents */
++	overlay->dtbo = kmemdup(buf, count, GFP_KERNEL);
++	if (overlay->dtbo == NULL)
++		return -ENOMEM;
++
++	overlay->dtbo_size = count;
++
++	err = of_overlay_fdt_apply(overlay->dtbo, overlay->dtbo_size,
++				   &overlay->ov_id);
++	if (err != 0)
++		goto out_err;
++
++	return count;
++
++out_err:
++	kfree(overlay->dtbo);
++	overlay->dtbo = NULL;
++	overlay->dtbo_size = 0;
++	overlay->ov_id = 0;
++
++	return err;
++}
++
++CONFIGFS_BIN_ATTR(cfs_overlay_item_, dtbo, NULL, SZ_1M);
++
++static struct configfs_bin_attribute *cfs_overlay_bin_attrs[] = {
++	&cfs_overlay_item_attr_dtbo,
++	NULL,
++};
++
++static void cfs_overlay_release(struct config_item *item)
++{
++	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
++
++	if (overlay->ov_id > 0)
++		of_overlay_remove(&overlay->ov_id);
++	if (overlay->fw)
++		release_firmware(overlay->fw);
++	/* kfree with NULL is safe */
++	kfree(overlay->dtbo);
++	kfree(overlay);
++}
++
++static struct configfs_item_operations cfs_overlay_item_ops = {
++	.release	= cfs_overlay_release,
++};
++
++static struct config_item_type cfs_overlay_type = {
++	.ct_item_ops	= &cfs_overlay_item_ops,
++	.ct_attrs	= cfs_overlay_attrs,
++	.ct_bin_attrs	= cfs_overlay_bin_attrs,
++	.ct_owner	= THIS_MODULE,
++};
++
++static struct config_item *cfs_overlay_group_make_item(
++		struct config_group *group, const char *name)
++{
++	struct cfs_overlay_item *overlay;
++
++	overlay = kzalloc(sizeof(*overlay), GFP_KERNEL);
++	if (!overlay)
++		return ERR_PTR(-ENOMEM);
++
++	config_item_init_type_name(&overlay->item, name, &cfs_overlay_type);
++	return &overlay->item;
++}
++
++static void cfs_overlay_group_drop_item(struct config_group *group,
++		struct config_item *item)
++{
++	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
++
++	config_item_put(&overlay->item);
++}
++
++static struct configfs_group_operations overlays_ops = {
++	.make_item	= cfs_overlay_group_make_item,
++	.drop_item	= cfs_overlay_group_drop_item,
++};
++
++static struct config_item_type overlays_type = {
++	.ct_group_ops   = &overlays_ops,
++	.ct_owner       = THIS_MODULE,
++};
++
++static struct configfs_group_operations of_cfs_ops = {
++	/* empty - we don't allow anything to be created */
++};
++
++static struct config_item_type of_cfs_type = {
++	.ct_group_ops   = &of_cfs_ops,
++	.ct_owner       = THIS_MODULE,
++};
++
++struct config_group of_cfs_overlay_group;
++
++static struct configfs_subsystem of_cfs_subsys = {
++	.su_group = {
++		.cg_item = {
++			.ci_namebuf = "device-tree",
++			.ci_type = &of_cfs_type,
++		},
++	},
++	.su_mutex = __MUTEX_INITIALIZER(of_cfs_subsys.su_mutex),
++};
++
++static int __init of_cfs_init(void)
++{
++	int ret;
++
++	pr_info("%s\n", __func__);
++
++	config_group_init(&of_cfs_subsys.su_group);
++	config_group_init_type_name(&of_cfs_overlay_group, "overlays",
++			&overlays_type);
++	configfs_add_default_group(&of_cfs_overlay_group,
++			&of_cfs_subsys.su_group);
++
++	ret = configfs_register_subsystem(&of_cfs_subsys);
++	if (ret != 0) {
++		pr_err("%s: failed to register subsys\n", __func__);
++		goto out;
++	}
++	pr_info("%s: OK\n", __func__);
++out:
++	return ret;
++}
++late_initcall(of_cfs_init);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0128-hci_h5-Don-t-send-conf_req-when-ACTIVE.patch b/target/linux/bcm27xx/patches-6.1/950-0128-hci_h5-Don-t-send-conf_req-when-ACTIVE.patch
new file mode 100644
index 00000000000000..91f4f6dba63d9d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0128-hci_h5-Don-t-send-conf_req-when-ACTIVE.patch
@@ -0,0 +1,23 @@
+From 8353daacb4848b96f96ee7c8df585045fedb2f82 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Thu, 17 Dec 2015 13:37:07 +0000
+Subject: [PATCH] hci_h5: Don't send conf_req when ACTIVE
+
+Without this patch, a modem and kernel can continuously bombard each
+other with conf_req and conf_rsp messages, in a demented game of tag.
+---
+ drivers/bluetooth/hci_h5.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/bluetooth/hci_h5.c
++++ b/drivers/bluetooth/hci_h5.c
+@@ -357,7 +357,8 @@ static void h5_handle_internal_rx(struct
+ 		h5_link_control(hu, conf_req, 3);
+ 	} else if (memcmp(data, conf_req, 2) == 0) {
+ 		h5_link_control(hu, conf_rsp, 2);
+-		h5_link_control(hu, conf_req, 3);
++		if (h5->state != H5_ACTIVE)
++		    h5_link_control(hu, conf_req, 3);
+ 	} else if (memcmp(data, conf_rsp, 2) == 0) {
+ 		if (H5_HDR_LEN(hdr) > 2)
+ 			h5->tx_win = (data[2] & 0x07);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0129-ARM64-Round-Robin-dispatch-IRQs-between-CPUs.patch b/target/linux/bcm27xx/patches-6.1/950-0129-ARM64-Round-Robin-dispatch-IRQs-between-CPUs.patch
new file mode 100644
index 00000000000000..a78d5a90ed09e0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0129-ARM64-Round-Robin-dispatch-IRQs-between-CPUs.patch
@@ -0,0 +1,72 @@
+From faa2632edba777bd250a7e18340fbafca450a28a Mon Sep 17 00:00:00 2001
+From: Michael Zoran <mzoran@crowfest.net>
+Date: Sat, 14 Jan 2017 21:43:57 -0800
+Subject: [PATCH] ARM64: Round-Robin dispatch IRQs between CPUs.
+
+IRQ-CPU mapping is round robined on ARM64 to increase
+concurrency and allow multiple interrupts to be serviced
+at a time.  This reduces the need for FIQ.
+
+Signed-off-by: Michael Zoran <mzoran@crowfest.net>
+---
+ drivers/irqchip/irq-bcm2835.c | 15 ++++++++++++++-
+ drivers/irqchip/irq-bcm2836.c | 21 +++++++++++++++++++++
+ 2 files changed, 35 insertions(+), 1 deletion(-)
+
+--- a/drivers/irqchip/irq-bcm2835.c
++++ b/drivers/irqchip/irq-bcm2835.c
+@@ -154,10 +154,23 @@ static void armctrl_unmask_irq(struct ir
+ 	}
+ }
+ 
++#ifdef CONFIG_ARM64
++void bcm2836_arm_irqchip_spin_gpu_irq(void);
++
++static void armctrl_ack_irq(struct irq_data *d)
++{
++	bcm2836_arm_irqchip_spin_gpu_irq();
++}
++
++#endif
++
+ static struct irq_chip armctrl_chip = {
+ 	.name = "ARMCTRL-level",
+ 	.irq_mask = armctrl_mask_irq,
+-	.irq_unmask = armctrl_unmask_irq
++	.irq_unmask = armctrl_unmask_irq,
++#ifdef CONFIG_ARM64
++	.irq_ack    = armctrl_ack_irq
++#endif
+ };
+ 
+ static int armctrl_xlate(struct irq_domain *d, struct device_node *ctrlr,
+--- a/drivers/irqchip/irq-bcm2836.c
++++ b/drivers/irqchip/irq-bcm2836.c
+@@ -87,6 +87,27 @@ static void bcm2836_arm_irqchip_unmask_g
+ {
+ }
+ 
++#ifdef CONFIG_ARM64
++
++void bcm2836_arm_irqchip_spin_gpu_irq(void)
++{
++	u32 i;
++	void __iomem *gpurouting = (intc.base + LOCAL_GPU_ROUTING);
++	u32 routing_val = readl(gpurouting);
++
++	for (i = 1; i <= 3; i++) {
++		u32 new_routing_val = (routing_val + i) & 3;
++
++		if (cpu_active(new_routing_val)) {
++			writel(new_routing_val, gpurouting);
++			return;
++		}
++	}
++}
++EXPORT_SYMBOL(bcm2836_arm_irqchip_spin_gpu_irq);
++
++#endif
++
+ static struct irq_chip bcm2836_arm_irqchip_gpu = {
+ 	.name		= "bcm2836-gpu",
+ 	.irq_mask	= bcm2836_arm_irqchip_mask_gpu_irq,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0130-ARM64-Force-hardware-emulation-of-deprecated-instruc.patch b/target/linux/bcm27xx/patches-6.1/950-0130-ARM64-Force-hardware-emulation-of-deprecated-instruc.patch
new file mode 100644
index 00000000000000..cbabf9983f34bf
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0130-ARM64-Force-hardware-emulation-of-deprecated-instruc.patch
@@ -0,0 +1,28 @@
+From 524cf14dafc03196173177a3f775373e9561894b Mon Sep 17 00:00:00 2001
+From: Michael Zoran <mzoran@crowfest.net>
+Date: Sat, 11 Feb 2017 01:18:31 -0800
+Subject: [PATCH] ARM64: Force hardware emulation of deprecated
+ instructions.
+
+---
+ arch/arm64/kernel/armv8_deprecated.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/arm64/kernel/armv8_deprecated.c
++++ b/arch/arm64/kernel/armv8_deprecated.c
+@@ -183,10 +183,15 @@ static void __init register_insn_emulati
+ 
+ 	switch (ops->status) {
+ 	case INSN_DEPRECATED:
++#if 0
+ 		insn->current_mode = INSN_EMULATE;
+ 		/* Disable the HW mode if it was turned on at early boot time */
+ 		run_all_cpu_set_hw_mode(insn, false);
++#else
++		insn->current_mode = INSN_HW;
++		run_all_cpu_set_hw_mode(insn, true);
+ 		insn->max = INSN_HW;
++#endif
+ 		break;
+ 	case INSN_OBSOLETE:
+ 		insn->current_mode = INSN_UNDEF;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0131-AXI-performance-monitor-driver-2222.patch b/target/linux/bcm27xx/patches-6.1/950-0131-AXI-performance-monitor-driver-2222.patch
new file mode 100644
index 00000000000000..71b1f9b78fa137
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0131-AXI-performance-monitor-driver-2222.patch
@@ -0,0 +1,691 @@
+From 81371496847b3c61033cb9a1c426a967c7b402bc Mon Sep 17 00:00:00 2001
+From: James Hughes <JamesH65@users.noreply.github.com>
+Date: Tue, 14 Nov 2017 15:13:15 +0000
+Subject: [PATCH] AXI performance monitor driver (#2222)
+
+Uses the debugfs I/F to provide access to the AXI
+bus performance monitors.
+
+Requires the new mailbox peripheral access for access
+to the VPU performance registers, system bus access
+is done using direct register reads.
+
+Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
+
+raspberrypi_axi_monitor: suppress warning
+
+Suppress the following warning by casting the pointer to and uintptr_t
+before to u32:
+
+Signed-off-by: Matteo Croce <mcroce@redhat.com>
+---
+ drivers/perf/Kconfig                   |   8 +
+ drivers/perf/Makefile                  |   1 +
+ drivers/perf/raspberrypi_axi_monitor.c | 637 +++++++++++++++++++++++++
+ 3 files changed, 646 insertions(+)
+ create mode 100644 drivers/perf/raspberrypi_axi_monitor.c
+
+--- a/drivers/perf/Kconfig
++++ b/drivers/perf/Kconfig
+@@ -190,6 +190,14 @@ config ALIBABA_UNCORE_DRW_PMU
+ 	  Support for Driveway PMU events monitoring on Yitian 710 DDR
+ 	  Sub-system.
+ 
++config RPI_AXIPERF
++        depends on ARCH_BCM2835
++        tristate "RaspberryPi AXI Performance monitors"
++        default n
++        help
++          Say y if you want to use Raspberry Pi AXI performance monitors, m if
++          you want to build it as a module.
++
+ source "drivers/perf/hisilicon/Kconfig"
+ 
+ config MARVELL_CN10K_DDR_PMU
+--- a/drivers/perf/Makefile
++++ b/drivers/perf/Makefile
+@@ -21,3 +21,4 @@ obj-$(CONFIG_MARVELL_CN10K_TAD_PMU) += m
+ obj-$(CONFIG_MARVELL_CN10K_DDR_PMU) += marvell_cn10k_ddr_pmu.o
+ obj-$(CONFIG_APPLE_M1_CPU_PMU) += apple_m1_cpu_pmu.o
+ obj-$(CONFIG_ALIBABA_UNCORE_DRW_PMU) += alibaba_uncore_drw_pmu.o
++obj-$(CONFIG_RPI_AXIPERF) += raspberrypi_axi_monitor.o
+--- /dev/null
++++ b/drivers/perf/raspberrypi_axi_monitor.c
+@@ -0,0 +1,637 @@
++/*
++ * raspberrypi_axi_monitor.c
++ *
++ * Author: james.hughes@raspberrypi.org
++ *
++ * Raspberry Pi AXI performance counters.
++ *
++ * Copyright (C) 2017 Raspberry Pi Trading Ltd.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/debugfs.h>
++#include <linux/devcoredump.h>
++#include <linux/device.h>
++#include <linux/kthread.h>
++#include <linux/module.h>
++#include <linux/netdevice.h>
++#include <linux/mutex.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
++#define NUM_MONITORS 2
++#define NUM_BUS_WATCHERS_PER_MONITOR 3
++
++#define SYSTEM_MONITOR 0
++#define VPU_MONITOR 1
++
++#define MAX_BUSES 16
++#define DEFAULT_SAMPLE_TIME 100
++
++#define NUM_BUS_WATCHER_RESULTS 9
++
++struct bus_watcher_data {
++	union	{
++		u32 results[NUM_BUS_WATCHER_RESULTS];
++		struct {
++			u32 atrans;
++			u32 atwait;
++			u32 amax;
++			u32 wtrans;
++			u32 wtwait;
++			u32 wmax;
++			u32 rtrans;
++			u32 rtwait;
++			u32 rmax;
++		};
++	};
++};
++
++
++struct rpi_axiperf {
++	struct platform_device *dev;
++	struct dentry *root_folder;
++
++	struct task_struct *monitor_thread;
++	struct mutex lock;
++
++	struct rpi_firmware *firmware;
++
++	/* Sample time spent on for each bus */
++	int sample_time;
++
++	/* Now storage for the per monitor settings and the resulting
++	 * performance figures
++	 */
++	struct {
++		/* Bit field of buses we want to monitor */
++		int bus_enabled;
++		/* Bit field of buses to filter by */
++		int bus_filter;
++		/* The current buses being monitored on this monitor */
++		int current_bus[NUM_BUS_WATCHERS_PER_MONITOR];
++		/* The last bus monitored on this monitor */
++		int last_monitored;
++
++		/* Set true if this mailbox must use the mailbox interface
++		 * rather than access registers directly.
++		 */
++		int use_mailbox_interface;
++
++		/* Current result values */
++		struct bus_watcher_data results[MAX_BUSES];
++
++		struct dentry *debugfs_entry;
++		void __iomem *base_address;
++
++	}  monitor[NUM_MONITORS];
++
++};
++
++static struct rpi_axiperf *state;
++
++/* Two monitors, System and VPU, each with the following register sets.
++ * Each monitor can only monitor one bus at a time, so we time share them,
++ * giving each bus 100ms (default, settable via debugfs) of time on its
++ * associated monitor
++ * Record results from the three Bus watchers per monitor and push to the sysfs
++ */
++
++/* general registers */
++const int GEN_CTRL;
++
++const int GEN_CTL_ENABLE_BIT	= BIT(0);
++const int GEN_CTL_RESET_BIT	= BIT(1);
++
++/* Bus watcher registers */
++const int BW_PITCH		= 0x40;
++
++const int BW0_CTRL		= 0x40;
++const int BW1_CTRL		= 0x80;
++const int BW2_CTRL		= 0xc0;
++
++const int BW_ATRANS_OFFSET	= 0x04;
++const int BW_ATWAIT_OFFSET	= 0x08;
++const int BW_AMAX_OFFSET	= 0x0c;
++const int BW_WTRANS_OFFSET	= 0x10;
++const int BW_WTWAIT_OFFSET	= 0x14;
++const int BW_WMAX_OFFSET	= 0x18;
++const int BW_RTRANS_OFFSET	= 0x1c;
++const int BW_RTWAIT_OFFSET	= 0x20;
++const int BW_RMAX_OFFSET	= 0x24;
++
++const int BW_CTRL_RESET_BIT	= BIT(31);
++const int BW_CTRL_ENABLE_BIT	= BIT(30);
++const int BW_CTRL_ENABLE_ID_FILTER_BIT	= BIT(29);
++const int BW_CTRL_LIMIT_HALT_BIT	= BIT(28);
++
++const int BW_CTRL_SOURCE_SHIFT	= 8;
++const int BW_CTRL_SOURCE_MASK	= GENMASK(12, 8); // 5 bits
++const int BW_CTRL_BUS_WATCH_SHIFT;
++const int BW_CTRL_BUS_WATCH_MASK = GENMASK(5, 0); // 6 bits
++const int BW_CTRL_BUS_FILTER_SHIFT = 8;
++
++const static char *bus_filter_strings[] = {
++	"",
++	"CORE0_V",
++	"ICACHE0",
++	"DCACHE0",
++	"CORE1_V",
++	"ICACHE1",
++	"DCACHE1",
++	"L2_MAIN",
++	"HOST_PORT",
++	"HOST_PORT2",
++	"HVS",
++	"ISP",
++	"VIDEO_DCT",
++	"VIDEO_SD2AXI",
++	"CAM0",
++	"CAM1",
++	"DMA0",
++	"DMA1",
++	"DMA2_VPU",
++	"JPEG",
++	"VIDEO_CME",
++	"TRANSPOSER",
++	"VIDEO_FME",
++	"CCP2TX",
++	"USB",
++	"V3D0",
++	"V3D1",
++	"V3D2",
++	"AVE",
++	"DEBUG",
++	"CPU",
++	"M30"
++};
++
++const int num_bus_filters = ARRAY_SIZE(bus_filter_strings);
++
++const static char *system_bus_string[] = {
++	"DMA_L2",
++	"TRANS",
++	"JPEG",
++	"SYSTEM_UC",
++	"DMA_UC",
++	"SYSTEM_L2",
++	"CCP2TX",
++	"MPHI_RX",
++	"MPHI_TX",
++	"HVS",
++	"H264",
++	"ISP",
++	"V3D",
++	"PERIPHERAL",
++	"CPU_UC",
++	"CPU_L2"
++};
++
++const int num_system_buses = ARRAY_SIZE(system_bus_string);
++
++const static char *vpu_bus_string[] = {
++	"VPU1_D_L2",
++	"VPU0_D_L2",
++	"VPU1_I_L2",
++	"VPU0_I_L2",
++	"SYSTEM_L2",
++	"L2_FLUSH",
++	"DMA_L2",
++	"VPU1_D_UC",
++	"VPU0_D_UC",
++	"VPU1_I_UC",
++	"VPU0_I_UC",
++	"SYSTEM_UC",
++	"L2_OUT",
++	"DMA_UC",
++	"SDRAM",
++	"L2_IN"
++};
++
++const int num_vpu_buses = ARRAY_SIZE(vpu_bus_string);
++
++const static char *monitor_name[] = {
++	"System",
++	"VPU"
++};
++
++static inline void write_reg(int monitor, int reg, u32 value)
++{
++	writel(value, state->monitor[monitor].base_address + reg);
++}
++
++static inline u32 read_reg(int monitor, u32 reg)
++{
++	return readl(state->monitor[monitor].base_address + reg);
++}
++
++static void read_bus_watcher(int monitor, int watcher, u32 *results)
++{
++	if (state->monitor[monitor].use_mailbox_interface) {
++		/* We have 9 results, plus the overheads of start address and
++		 * length So 11 u32 to define
++		 */
++		u32 tmp[11];
++		int err;
++
++		tmp[0] = (u32)(uintptr_t)(state->monitor[monitor].base_address + watcher
++				+ BW_ATRANS_OFFSET);
++		tmp[1] = NUM_BUS_WATCHER_RESULTS;
++
++		err = rpi_firmware_property(state->firmware,
++					    RPI_FIRMWARE_GET_PERIPH_REG,
++					    tmp, sizeof(tmp));
++
++		if (err < 0 || tmp[1] != NUM_BUS_WATCHER_RESULTS)
++			dev_err_once(&state->dev->dev,
++				     "Failed to read bus watcher");
++		else
++			memcpy(results, &tmp[2],
++			       NUM_BUS_WATCHER_RESULTS * sizeof(u32));
++	} else {
++		int i;
++		void __iomem *addr = state->monitor[monitor].base_address
++				+ watcher + BW_ATRANS_OFFSET;
++		for (i = 0; i < NUM_BUS_WATCHER_RESULTS; i++, addr += 4)
++			*results++ = readl(addr);
++	}
++}
++
++static void set_monitor_control(int monitor, u32 set)
++{
++	if (state->monitor[monitor].use_mailbox_interface) {
++		u32 tmp[3] = {(u32)(uintptr_t)(state->monitor[monitor].base_address +
++				GEN_CTRL), 1, set};
++		int err = rpi_firmware_property(state->firmware,
++						RPI_FIRMWARE_SET_PERIPH_REG,
++						tmp, sizeof(tmp));
++
++		if (err < 0 || tmp[1] != 1)
++			dev_err_once(&state->dev->dev,
++				"Failed to set monitor control");
++	} else
++		write_reg(monitor, GEN_CTRL, set);
++}
++
++static void set_bus_watcher_control(int monitor, int watcher, u32 set)
++{
++	if (state->monitor[monitor].use_mailbox_interface) {
++		u32 tmp[3] = {(u32)(uintptr_t)(state->monitor[monitor].base_address +
++				    watcher), 1, set};
++		int err = rpi_firmware_property(state->firmware,
++						RPI_FIRMWARE_SET_PERIPH_REG,
++						tmp, sizeof(tmp));
++		if (err < 0 || tmp[1] != 1)
++			dev_err_once(&state->dev->dev,
++				"Failed to set bus watcher control");
++	} else
++		write_reg(monitor, watcher, set);
++}
++
++static void monitor(struct rpi_axiperf *state)
++{
++	int monitor, num_buses[NUM_MONITORS];
++
++	mutex_lock(&state->lock);
++
++	for (monitor = 0; monitor < NUM_MONITORS; monitor++) {
++		typeof(state->monitor[0]) *mon = &(state->monitor[monitor]);
++
++		/* Anything enabled? */
++		if (mon->bus_enabled == 0) {
++			/* No, disable all monitoring for this monitor */
++			set_monitor_control(monitor, GEN_CTL_RESET_BIT);
++		} else {
++			int i;
++
++			/* Find out how many busses we want to monitor, and
++			 * spread our 3 actual monitors over them
++			 */
++			num_buses[monitor] = hweight32(mon->bus_enabled);
++			num_buses[monitor] = min(num_buses[monitor],
++						 NUM_BUS_WATCHERS_PER_MONITOR);
++
++			for (i = 0; i < num_buses[monitor]; i++) {
++				int bus_control;
++
++				do {
++					mon->last_monitored++;
++					mon->last_monitored &= 0xf;
++				} while ((mon->bus_enabled &
++					 (1 << mon->last_monitored)) == 0);
++
++				mon->current_bus[i] = mon->last_monitored;
++
++				/* Reset the counters */
++				set_bus_watcher_control(monitor,
++							BW0_CTRL +
++							i*BW_PITCH,
++							BW_CTRL_RESET_BIT);
++
++				bus_control = BW_CTRL_ENABLE_BIT |
++						mon->current_bus[i];
++
++				if (mon->bus_filter) {
++					bus_control |=
++						BW_CTRL_ENABLE_ID_FILTER_BIT;
++					bus_control |=
++						((mon->bus_filter & 0x1f)
++						<< BW_CTRL_BUS_FILTER_SHIFT);
++				}
++
++				// Start capture
++				set_bus_watcher_control(monitor,
++							BW0_CTRL + i*BW_PITCH,
++							bus_control);
++			}
++		}
++
++		/* start monitoring */
++		set_monitor_control(monitor, GEN_CTL_ENABLE_BIT);
++	}
++
++	mutex_unlock(&state->lock);
++
++	msleep(state->sample_time);
++
++	/* Now read the results */
++
++	mutex_lock(&state->lock);
++	for (monitor = 0; monitor < NUM_MONITORS; monitor++) {
++		typeof(state->monitor[0]) *mon = &(state->monitor[monitor]);
++
++		/* Anything enabled? */
++		if (mon->bus_enabled == 0) {
++			/* No, disable all monitoring for this monitor */
++			set_monitor_control(monitor, 0);
++		} else {
++			int i;
++
++			for (i = 0; i < num_buses[monitor]; i++) {
++				int bus = mon->current_bus[i];
++
++				read_bus_watcher(monitor,
++					BW0_CTRL + i*BW_PITCH,
++					(u32 *)&mon->results[bus].results);
++			}
++		}
++	}
++	mutex_unlock(&state->lock);
++}
++
++static int monitor_thread(void *data)
++{
++	struct rpi_axiperf *state  = data;
++
++	while (1) {
++		monitor(state);
++
++		if (kthread_should_stop())
++			return 0;
++	}
++	return 0;
++}
++
++static ssize_t myreader(struct file *fp, char __user *user_buffer,
++			size_t count, loff_t *position)
++{
++#define INIT_BUFF_SIZE 2048
++
++	int i;
++	int idx = (int)(uintptr_t)(fp->private_data);
++	int num_buses, cnt;
++	char *string_buffer;
++	int buff_size = INIT_BUFF_SIZE;
++	char *p;
++	typeof(state->monitor[0]) *mon = &(state->monitor[idx]);
++
++	if (idx < 0 || idx > NUM_MONITORS)
++		idx = 0;
++
++	num_buses = idx == SYSTEM_MONITOR ? num_system_buses : num_vpu_buses;
++
++	string_buffer = kmalloc(buff_size, GFP_KERNEL);
++
++	if (!string_buffer) {
++		dev_err(&state->dev->dev,
++				"Failed temporary string allocation\n");
++		return 0;
++	}
++
++	p = string_buffer;
++
++	mutex_lock(&state->lock);
++
++	if (mon->bus_filter) {
++		int filt = min(mon->bus_filter & 0x1f, num_bus_filters);
++
++		cnt = snprintf(p, buff_size,
++			       "\nMonitoring transactions from %s only\n",
++			       bus_filter_strings[filt]);
++		p += cnt;
++		buff_size -= cnt;
++	}
++
++	cnt = snprintf(p, buff_size, "     Bus   |    Atrans    Atwait      AMax    Wtrans    Wtwait      WMax    Rtrans    Rtwait      RMax\n"
++				     "======================================================================================================\n");
++
++	if (cnt >= buff_size)
++		goto done;
++
++	p += cnt;
++	buff_size -= cnt;
++
++	for (i = 0; i < num_buses; i++) {
++		if (mon->bus_enabled & (1 << i)) {
++#define DIVIDER (1024)
++			typeof(mon->results[0]) *res = &(mon->results[i]);
++
++			cnt = snprintf(p, buff_size,
++					"%10s | %8uK %8uK %8uK %8uK %8uK %8uK %8uK %8uK %8uK\n",
++					idx == SYSTEM_MONITOR ?
++						system_bus_string[i] :
++						vpu_bus_string[i],
++					res->atrans/DIVIDER,
++					res->atwait/DIVIDER,
++					res->amax/DIVIDER,
++					res->wtrans/DIVIDER,
++					res->wtwait/DIVIDER,
++					res->wmax/DIVIDER,
++					res->rtrans/DIVIDER,
++					res->rtwait/DIVIDER,
++					res->rmax/DIVIDER
++					);
++			if (cnt >= buff_size)
++				goto done;
++
++			p += cnt;
++			buff_size -= cnt;
++		}
++	}
++
++	mutex_unlock(&state->lock);
++
++done:
++
++	/* did the last string entry exceeed our buffer size? ie out of string
++	 * buffer space. Null terminate, use what we have.
++	 */
++	if (cnt >= buff_size) {
++		buff_size = 0;
++		string_buffer[INIT_BUFF_SIZE] = 0;
++	}
++
++	cnt = simple_read_from_buffer(user_buffer, count, position,
++				      string_buffer,
++				      INIT_BUFF_SIZE - buff_size);
++
++	kfree(string_buffer);
++
++	return cnt;
++}
++
++static ssize_t mywriter(struct file *fp, const char __user *user_buffer,
++			size_t count, loff_t *position)
++{
++	int idx = (int)(uintptr_t)(fp->private_data);
++
++	if (idx < 0 || idx > NUM_MONITORS)
++		idx = 0;
++
++	/* At the moment, this does nothing, but in the future it could be
++	 * used to reset counters etc
++	 */
++	return count;
++}
++
++static const struct file_operations fops_debug = {
++	.read = myreader,
++	.write = mywriter,
++	.open = simple_open
++};
++
++static int rpi_axiperf_probe(struct platform_device *pdev)
++{
++	int ret = 0, i;
++	struct device *dev = &pdev->dev;
++	struct device_node *np = dev->of_node;
++	struct device_node *fw_node;
++
++	state = kzalloc(sizeof(struct rpi_axiperf), GFP_KERNEL);
++	if (!state)
++		return -ENOMEM;
++
++	/* Get the firmware handle for future rpi-firmware-xxx calls */
++	fw_node = of_parse_phandle(np, "firmware", 0);
++	if (!fw_node) {
++		dev_err(dev, "Missing firmware node\n");
++		return -ENOENT;
++	}
++
++	state->firmware = rpi_firmware_get(fw_node);
++	if (!state->firmware)
++		return -EPROBE_DEFER;
++
++	/* Special case for the VPU monitor, we must use the mailbox interface
++	 * as it is not accessible from the ARM address space.
++	 */
++	state->monitor[VPU_MONITOR].use_mailbox_interface = 1;
++	state->monitor[SYSTEM_MONITOR].use_mailbox_interface = 0;
++
++	for (i = 0; i < NUM_MONITORS; i++) {
++		if (state->monitor[i].use_mailbox_interface) {
++			 of_property_read_u32_index(np, "reg", i*2,
++				(u32 *)(&state->monitor[i].base_address));
++		} else {
++			struct resource *resource =
++				platform_get_resource(pdev, IORESOURCE_MEM, i);
++
++			state->monitor[i].base_address =
++				devm_ioremap_resource(&pdev->dev, resource);
++		}
++
++		if (IS_ERR(state->monitor[i].base_address))
++			return PTR_ERR(state->monitor[i].base_address);
++
++		/* Enable all buses by default */
++		state->monitor[i].bus_enabled = 0xffff;
++	}
++
++	state->dev = pdev;
++	platform_set_drvdata(pdev, state);
++
++	state->sample_time = DEFAULT_SAMPLE_TIME;
++
++	/* Set up all the debugfs stuff */
++	state->root_folder = debugfs_create_dir(KBUILD_MODNAME, NULL);
++
++	for (i = 0; i < NUM_MONITORS; i++) {
++		state->monitor[i].debugfs_entry =
++			debugfs_create_dir(monitor_name[i], state->root_folder);
++		if (IS_ERR(state->monitor[i].debugfs_entry))
++			state->monitor[i].debugfs_entry = NULL;
++
++		debugfs_create_file("data", 0444,
++				    state->monitor[i].debugfs_entry,
++				    (void *)(uintptr_t)i, &fops_debug);
++		debugfs_create_u32("enable", 0644,
++				   state->monitor[i].debugfs_entry,
++				   &state->monitor[i].bus_enabled);
++		debugfs_create_u32("filter", 0644,
++				   state->monitor[i].debugfs_entry,
++				   &state->monitor[i].bus_filter);
++		debugfs_create_u32("sample_time", 0644,
++				   state->monitor[i].debugfs_entry,
++				   &state->sample_time);
++	}
++
++	mutex_init(&state->lock);
++
++	state->monitor_thread = kthread_run(monitor_thread, state,
++					    "rpi-axiperfmon");
++
++	return ret;
++
++}
++
++static int rpi_axiperf_remove(struct platform_device *dev)
++{
++	int ret = 0;
++
++	kthread_stop(state->monitor_thread);
++
++	debugfs_remove_recursive(state->root_folder);
++	state->root_folder = NULL;
++
++	return ret;
++}
++
++static const struct of_device_id rpi_axiperf_match[] = {
++	{
++		.compatible = "brcm,bcm2835-axiperf",
++	},
++	{},
++};
++MODULE_DEVICE_TABLE(of, rpi_axiperf_match);
++
++static struct platform_driver rpi_axiperf_driver  = {
++	.probe =	rpi_axiperf_probe,
++	.remove =	rpi_axiperf_remove,
++	.driver = {
++		.name   = "rpi-bcm2835-axiperf",
++		.of_match_table = of_match_ptr(rpi_axiperf_match),
++	},
++};
++
++module_platform_driver(rpi_axiperf_driver);
++
++/* Module information */
++MODULE_AUTHOR("James Hughes <james.hughes@raspberrypi.org>");
++MODULE_DESCRIPTION("RPI AXI Performance monitor driver");
++MODULE_LICENSE("GPL");
++
diff --git a/target/linux/bcm27xx/patches-6.1/950-0132-ARM-bcm2835-Set-Serial-number-and-Revision.patch b/target/linux/bcm27xx/patches-6.1/950-0132-ARM-bcm2835-Set-Serial-number-and-Revision.patch
new file mode 100644
index 00000000000000..fb17ea6391a903
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0132-ARM-bcm2835-Set-Serial-number-and-Revision.patch
@@ -0,0 +1,63 @@
+From 568eecc99c2222129da094eedb4f6751a6be05a1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Wed, 3 Jun 2015 12:26:13 +0200
+Subject: [PATCH] ARM: bcm2835: Set Serial number and Revision
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The VideoCore bootloader passes in Serial number and
+Revision number through Device Tree. Make these available to
+userspace through /proc/cpuinfo.
+
+Mainline status:
+
+There is a commit in linux-next that standardize passing the serial
+number through Device Tree (string: /serial-number):
+ARM: 8355/1: arch: Show the serial number from devicetree in cpuinfo
+
+There was an attempt to do the same with the revision number, but it
+didn't get in:
+[PATCH v2 1/2] arm: devtree: Set system_rev from DT revision
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+---
+ arch/arm/mach-bcm/board_bcm2835.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/arch/arm/mach-bcm/board_bcm2835.c
++++ b/arch/arm/mach-bcm/board_bcm2835.c
+@@ -6,12 +6,25 @@
+ #include <linux/init.h>
+ #include <linux/irqchip.h>
+ #include <linux/of_address.h>
++#include <asm/system_info.h>
+ 
+ #include <asm/mach/arch.h>
+ #include <asm/mach/map.h>
+ 
+ #include "platsmp.h"
+ 
++static void __init bcm2835_init(void)
++{
++	struct device_node *np = of_find_node_by_path("/system");
++	u32 val;
++	u64 val64;
++
++	if (!of_property_read_u32(np, "linux,revision", &val))
++		system_rev = val;
++	if (!of_property_read_u64(np, "linux,serial", &val64))
++		system_serial_low = val64;
++}
++
+ static const char * const bcm2835_compat[] = {
+ #ifdef CONFIG_ARCH_MULTI_V6
+ 	"brcm,bcm2835",
+@@ -24,6 +37,7 @@ static const char * const bcm2835_compat
+ };
+ 
+ DT_MACHINE_START(BCM2835, "BCM2835")
++	.init_machine = bcm2835_init,
+ 	.dt_compat = bcm2835_compat,
+ 	.smp = smp_ops(bcm2836_smp_ops),
+ MACHINE_END
diff --git a/target/linux/bcm27xx/patches-6.1/950-0133-dwc-otg-FIQ-Fix-bad-mode-in-data-abort-handler.patch b/target/linux/bcm27xx/patches-6.1/950-0133-dwc-otg-FIQ-Fix-bad-mode-in-data-abort-handler.patch
new file mode 100644
index 00000000000000..2d1bc17c682c52
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0133-dwc-otg-FIQ-Fix-bad-mode-in-data-abort-handler.patch
@@ -0,0 +1,116 @@
+From 6ba5048c436a690309e5f45aae95d93d5e0b9001 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 16 Jul 2018 14:40:13 +0100
+Subject: [PATCH] dwc-otg: FIQ: Fix "bad mode in data abort handler"
+
+Create a semi-static mapping for the USB registers early in the boot
+process, before additional kernel threads are started, so all threads
+will have the mappings from the start. This avoids the need for
+data aborts to lazily update them.
+
+See: https://github.com/raspberrypi/linux/issues/2450
+
+Signed-off-by: Floris Bos <bos@je-eigen-domein.nl>
+---
+ arch/arm/mach-bcm/board_bcm2835.c | 69 +++++++++++++++++++++++++++++++
+ 1 file changed, 69 insertions(+)
+
+--- a/arch/arm/mach-bcm/board_bcm2835.c
++++ b/arch/arm/mach-bcm/board_bcm2835.c
+@@ -6,6 +6,7 @@
+ #include <linux/init.h>
+ #include <linux/irqchip.h>
+ #include <linux/of_address.h>
++#include <linux/of_fdt.h>
+ #include <asm/system_info.h>
+ 
+ #include <asm/mach/arch.h>
+@@ -13,6 +14,9 @@
+ 
+ #include "platsmp.h"
+ 
++#define BCM2835_USB_VIRT_BASE   0xf0980000
++#define BCM2835_USB_VIRT_MPHI   0xf0006000
++
+ static void __init bcm2835_init(void)
+ {
+ 	struct device_node *np = of_find_node_by_path("/system");
+@@ -25,6 +29,70 @@ static void __init bcm2835_init(void)
+ 		system_serial_low = val64;
+ }
+ 
++/*
++ * We need to map registers that are going to be accessed by the FIQ
++ * very early, before any kernel threads are spawned. Because if done
++ * later, the mapping tables are not updated instantly but lazily upon
++ * first access through a data abort handler. While that is fine
++ * when executing regular kernel code, if the first access in a specific
++ * thread happens while running FIQ code this will result in a panic.
++ *
++ * For more background see the following old mailing list thread:
++ * https://www.spinics.net/lists/arm-kernel/msg325250.html
++ */
++static int __init bcm2835_map_usb(unsigned long node, const char *uname,
++					int depth, void *data)
++{
++	struct map_desc map[2];
++	const __be32 *reg;
++	int len;
++	unsigned long p2b_offset = *((unsigned long *) data);
++
++	if (!of_flat_dt_is_compatible(node, "brcm,bcm2708-usb"))
++		return 0;
++	reg = of_get_flat_dt_prop(node, "reg", &len);
++	if (!reg || len != (sizeof(unsigned long) * 4))
++		return 0;
++
++	/* Use information about the physical addresses of the
++	 * registers from the device tree, but use legacy
++	 * iotable_init() static mapping function to map them,
++	 * as ioremap() is not functional at this stage in boot.
++	 */
++	map[0].virtual = (unsigned long) BCM2835_USB_VIRT_BASE;
++	map[0].pfn = __phys_to_pfn(be32_to_cpu(reg[0]) - p2b_offset);
++	map[0].length = be32_to_cpu(reg[1]);
++	map[0].type = MT_DEVICE;
++	map[1].virtual = (unsigned long) BCM2835_USB_VIRT_MPHI;
++	map[1].pfn = __phys_to_pfn(be32_to_cpu(reg[2]) - p2b_offset);
++	map[1].length = be32_to_cpu(reg[3]);
++	map[1].type = MT_DEVICE;
++		iotable_init(map, 2);
++
++	return 1;
++}
++
++static void __init bcm2835_map_io(void)
++{
++	const __be32 *ranges;
++	int soc, len;
++	unsigned long p2b_offset;
++
++	debug_ll_io_init();
++
++	/* Find out how to map bus to physical address first from soc/ranges */
++	soc = of_get_flat_dt_subnode_by_name(of_get_flat_dt_root(), "soc");
++	if (soc < 0)
++		return;
++	ranges = of_get_flat_dt_prop(soc, "ranges", &len);
++	if (!ranges || len < (sizeof(unsigned long) * 3))
++		return;
++	p2b_offset = be32_to_cpu(ranges[0]) - be32_to_cpu(ranges[1]);
++
++	/* Now search for bcm2708-usb node in device tree */
++	of_scan_flat_dt(bcm2835_map_usb, &p2b_offset);
++}
++
+ static const char * const bcm2835_compat[] = {
+ #ifdef CONFIG_ARCH_MULTI_V6
+ 	"brcm,bcm2835",
+@@ -37,6 +105,7 @@ static const char * const bcm2835_compat
+ };
+ 
+ DT_MACHINE_START(BCM2835, "BCM2835")
++	.map_io = bcm2835_map_io,
+ 	.init_machine = bcm2835_init,
+ 	.dt_compat = bcm2835_compat,
+ 	.smp = smp_ops(bcm2836_smp_ops),
diff --git a/target/linux/bcm27xx/patches-6.1/950-0134-ARM-Activate-FIQs-to-avoid-__irq_startup-warnings.patch b/target/linux/bcm27xx/patches-6.1/950-0134-ARM-Activate-FIQs-to-avoid-__irq_startup-warnings.patch
new file mode 100644
index 00000000000000..aa581ca915df84
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0134-ARM-Activate-FIQs-to-avoid-__irq_startup-warnings.patch
@@ -0,0 +1,36 @@
+From a53c906fcc7baf69861f889cf20535bdec764ae6 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 11 Dec 2017 09:18:32 +0000
+Subject: [PATCH] ARM: Activate FIQs to avoid __irq_startup warnings
+
+There is a new test in __irq_startup that the IRQ is activated, which
+hasn't been the case for FIQs since they bypass some of the usual setup.
+
+Augment enable_fiq to include a call to irq_activate to avoid the
+warning.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ arch/arm/kernel/fiq.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm/kernel/fiq.c
++++ b/arch/arm/kernel/fiq.c
+@@ -56,6 +56,8 @@
+ static unsigned long dfl_fiq_insn;
+ static struct pt_regs dfl_fiq_regs;
+ 
++extern int irq_activate(struct irq_desc *desc);
++
+ /* Default reacquire function
+  * - we always relinquish FIQ control
+  * - we always reacquire FIQ control
+@@ -140,6 +142,8 @@ static int fiq_start;
+ 
+ void enable_fiq(int fiq)
+ {
++	struct irq_desc *desc = irq_to_desc(fiq + fiq_start);
++	irq_activate(desc);
+ 	enable_irq(fiq + fiq_start);
+ }
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0135-i2c-gpio-Also-set-bus-numbers-from-reg-property.patch b/target/linux/bcm27xx/patches-6.1/950-0135-i2c-gpio-Also-set-bus-numbers-from-reg-property.patch
new file mode 100644
index 00000000000000..5b7791f2c20710
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0135-i2c-gpio-Also-set-bus-numbers-from-reg-property.patch
@@ -0,0 +1,35 @@
+From 4a2b86ccdad120b38edadfa6cada6e0cd2cabca6 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 20 Feb 2018 10:07:27 +0000
+Subject: [PATCH] i2c-gpio: Also set bus numbers from reg property
+
+I2C busses can be assigned specific bus numbers using aliases in
+Device Tree - string properties where the name is the alias and the
+value is the path to the node. The current DT parameter mechanism
+does not allow property names to be derived from a parameter value
+in any way, so it isn't possible to generate unique or matching
+aliases for nodes from an overlay that can generate multiple
+instances, e.g. i2c-gpio.
+
+Work around this limitation (at least temporarily) by allowing
+the i2c adapter number to be initialised from the "reg" property
+if present.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/i2c/busses/i2c-gpio.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-gpio.c
++++ b/drivers/i2c/busses/i2c-gpio.c
+@@ -445,7 +445,9 @@ static int i2c_gpio_probe(struct platfor
+ 	adap->dev.parent = dev;
+ 	adap->dev.of_node = np;
+ 
+-	adap->nr = pdev->id;
++	if (pdev->id != PLATFORM_DEVID_NONE || !pdev->dev.of_node ||
++	    of_property_read_u32(pdev->dev.of_node, "reg", &adap->nr))
++		adap->nr = pdev->id;
+ 	ret = i2c_bit_add_numbered_bus(adap);
+ 	if (ret)
+ 		return ret;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0136-added-capture_clear-option-to-pps-gpio-via-dtoverlay.patch b/target/linux/bcm27xx/patches-6.1/950-0136-added-capture_clear-option-to-pps-gpio-via-dtoverlay.patch
new file mode 100644
index 00000000000000..0302e955f69b3f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0136-added-capture_clear-option-to-pps-gpio-via-dtoverlay.patch
@@ -0,0 +1,22 @@
+From ab7d6660039b5b12a6ffad0f23c10425ccfea306 Mon Sep 17 00:00:00 2001
+From: hdoverobinson <hdoverobinson@gmail.com>
+Date: Tue, 13 Mar 2018 06:58:39 -0400
+Subject: [PATCH] added capture_clear option to pps-gpio via dtoverlay
+ (#2433)
+
+---
+ drivers/pps/clients/pps-gpio.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/pps/clients/pps-gpio.c
++++ b/drivers/pps/clients/pps-gpio.c
+@@ -113,6 +113,9 @@ static int pps_gpio_setup(struct device
+ 	data->assert_falling_edge =
+ 		device_property_read_bool(dev, "assert-falling-edge");
+ 
++	data->capture_clear =
++		device_property_read_bool(dev, "capture-clear");
++
+ 	data->echo_pin = devm_gpiod_get_optional(dev, "echo", GPIOD_OUT_LOW);
+ 	if (IS_ERR(data->echo_pin))
+ 		return dev_err_probe(dev, PTR_ERR(data->echo_pin),
diff --git a/target/linux/bcm27xx/patches-6.1/950-0137-lan78xx-Read-initial-EEE-status-from-DT.patch b/target/linux/bcm27xx/patches-6.1/950-0137-lan78xx-Read-initial-EEE-status-from-DT.patch
new file mode 100644
index 00000000000000..8d097c1ea91dfd
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0137-lan78xx-Read-initial-EEE-status-from-DT.patch
@@ -0,0 +1,40 @@
+From d245af88863535487d925188a59e93f93f2e39b4 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Fri, 9 Mar 2018 12:01:00 +0000
+Subject: [PATCH] lan78xx: Read initial EEE status from DT
+
+Add two new DT properties:
+* microchip,eee-enabled  - a boolean to enable EEE
+* microchip,tx-lpi-timer - time in microseconds to wait before entering
+                           low power state
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/net/usb/lan78xx.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -3108,6 +3108,22 @@ static int lan78xx_open(struct net_devic
+ 
+ 	netif_dbg(dev, ifup, dev->net, "phy initialised successfully");
+ 
++	if (of_property_read_bool(dev->udev->dev.of_node,
++				  "microchip,eee-enabled")) {
++		struct ethtool_eee edata;
++		memset(&edata, 0, sizeof(edata));
++		edata.cmd = ETHTOOL_SEEE;
++		edata.advertised = ADVERTISED_1000baseT_Full |
++				   ADVERTISED_100baseT_Full;
++		edata.eee_enabled = true;
++		edata.tx_lpi_enabled = true;
++		if (of_property_read_u32(dev->udev->dev.of_node,
++					 "microchip,tx-lpi-timer",
++					 &edata.tx_lpi_timer))
++			edata.tx_lpi_timer = 600; /* non-aggressive */
++		(void)lan78xx_set_eee(net, &edata);
++	}
++
+ 	/* for Link Check */
+ 	if (dev->urb_intr) {
+ 		ret = usb_submit_urb(dev->urb_intr, GFP_KERNEL);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0138-hid-Reduce-default-mouse-polling-interval-to-60Hz.patch b/target/linux/bcm27xx/patches-6.1/950-0138-hid-Reduce-default-mouse-polling-interval-to-60Hz.patch
new file mode 100644
index 00000000000000..5ff523384448f3
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0138-hid-Reduce-default-mouse-polling-interval-to-60Hz.patch
@@ -0,0 +1,32 @@
+From c9dc45bb59c8db8a761c6f98970a15265610cd93 Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Mon, 14 Jul 2014 22:02:09 +0100
+Subject: [PATCH] hid: Reduce default mouse polling interval to 60Hz
+
+Reduces overhead when using X
+---
+ drivers/hid/usbhid/hid-core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/hid/usbhid/hid-core.c
++++ b/drivers/hid/usbhid/hid-core.c
+@@ -45,7 +45,7 @@
+  * Module parameters.
+  */
+ 
+-static unsigned int hid_mousepoll_interval;
++static unsigned int hid_mousepoll_interval = ~0;
+ module_param_named(mousepoll, hid_mousepoll_interval, uint, 0644);
+ MODULE_PARM_DESC(mousepoll, "Polling interval of mice");
+ 
+@@ -1112,7 +1112,9 @@ static int usbhid_start(struct hid_devic
+ 		 */
+ 		switch (hid->collection->usage) {
+ 		case HID_GD_MOUSE:
+-			if (hid_mousepoll_interval > 0)
++			if (hid_mousepoll_interval == ~0 && interval < 16)
++				interval = 16;
++			else if (hid_mousepoll_interval != ~0 && hid_mousepoll_interval != 0)
+ 				interval = hid_mousepoll_interval;
+ 			break;
+ 		case HID_GD_JOYSTICK:
diff --git a/target/linux/bcm27xx/patches-6.1/950-0139-Add-ability-to-export-gpio-used-by-gpio-poweroff.patch b/target/linux/bcm27xx/patches-6.1/950-0139-Add-ability-to-export-gpio-used-by-gpio-poweroff.patch
new file mode 100644
index 00000000000000..ebc9e2d5d270b1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0139-Add-ability-to-export-gpio-used-by-gpio-poweroff.patch
@@ -0,0 +1,93 @@
+From b67da8b7975c5e98eb222c3b47617a46acee1f89 Mon Sep 17 00:00:00 2001
+From: Nick Bulleid <nedbulleid@fastmail.com>
+Date: Thu, 10 May 2018 21:57:02 +0100
+Subject: [PATCH] Add ability to export gpio used by gpio-poweroff
+
+Signed-off-by: Nick Bulleid <nedbulleid@fastmail.com>
+
+Added export feature to gpio-poweroff documentation
+
+Signed-off-by: Nick Bulleid <nedbulleid@fastmail.com>
+---
+ .../bindings/power/reset/gpio-poweroff.txt    | 42 +++++++++++++++++++
+ drivers/power/reset/gpio-poweroff.c           |  9 ++++
+ 2 files changed, 51 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/power/reset/gpio-poweroff.txt
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/power/reset/gpio-poweroff.txt
+@@ -0,0 +1,42 @@
++Driver a GPIO line that can be used to turn the power off.
++
++The driver supports both level triggered and edge triggered power off.
++At driver load time, the driver will request the given gpio line and
++install a handler to power off the system. If the optional properties
++'input' is not found, the GPIO line will be driven in the inactive
++state. Otherwise its configured as an input.
++
++When the power-off handler is called, the gpio is configured as an
++output, and drive active, so triggering a level triggered power off
++condition. This will also cause an inactive->active edge condition, so
++triggering positive edge triggered power off. After a delay of 100ms,
++the GPIO is set to inactive, thus causing an active->inactive edge,
++triggering negative edge triggered power off. After another 100ms
++delay the GPIO is driver active again. If the power is still on and
++the CPU still running after a 3000ms delay, a WARN_ON(1) is emitted.
++
++Required properties:
++- compatible : should be "gpio-poweroff".
++- gpios : The GPIO to set high/low, see "gpios property" in
++  Documentation/devicetree/bindings/gpio/gpio.txt. If the pin should be
++  low to power down the board set it to "Active Low", otherwise set
++  gpio to "Active High".
++
++Optional properties:
++- input : Initially configure the GPIO line as an input. Only reconfigure
++  it to an output when the power-off handler is called. If this optional
++  property is not specified, the GPIO is initialized as an output in its
++  inactive state.
++- active-delay-ms: Delay (default 100) to wait after driving gpio active
++- inactive-delay-ms: Delay (default 100) to wait after driving gpio inactive
++- timeout-ms: Time to wait before asserting a WARN_ON(1). If nothing is
++              specified, 3000 ms is used.
++- export : Export the GPIO line to the sysfs system
++
++Examples:
++
++gpio-poweroff {
++	compatible = "gpio-poweroff";
++	gpios = <&gpio 4 0>;
++	timeout-ms = <3000>;
++};
+--- a/drivers/power/reset/gpio-poweroff.c
++++ b/drivers/power/reset/gpio-poweroff.c
+@@ -51,6 +51,7 @@ static int gpio_poweroff_probe(struct pl
+ 	bool input = false;
+ 	enum gpiod_flags flags;
+ 	bool force = false;
++	bool export = false;
+ 
+ 	/* If a pm_power_off function has already been added, leave it alone */
+ 	force = of_property_read_bool(pdev->dev.of_node, "force");
+@@ -76,6 +77,12 @@ static int gpio_poweroff_probe(struct pl
+ 	if (IS_ERR(reset_gpio))
+ 		return PTR_ERR(reset_gpio);
+ 
++	export = of_property_read_bool(pdev->dev.of_node, "export");
++	if (export) {
++		gpiod_export(reset_gpio, false);
++		gpiod_export_link(&pdev->dev, "poweroff-gpio", reset_gpio);
++	}
++
+ 	pm_power_off = &gpio_poweroff_do_poweroff;
+ 	return 0;
+ }
+@@ -85,6 +92,8 @@ static int gpio_poweroff_remove(struct p
+ 	if (pm_power_off == &gpio_poweroff_do_poweroff)
+ 		pm_power_off = NULL;
+ 
++	gpiod_unexport(reset_gpio);
++
+ 	return 0;
+ }
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0140-firmware-raspberrypi-Notify-firmware-of-a-reboot.patch b/target/linux/bcm27xx/patches-6.1/950-0140-firmware-raspberrypi-Notify-firmware-of-a-reboot.patch
new file mode 100644
index 00000000000000..90408f49168595
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0140-firmware-raspberrypi-Notify-firmware-of-a-reboot.patch
@@ -0,0 +1,84 @@
+From 25aeabb3d345aff27d7a07fafe4a61d331525b3f Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Sat, 12 May 2018 21:35:43 +0100
+Subject: [PATCH] firmware/raspberrypi: Notify firmware of a reboot
+
+Register for reboot notifications, sending RPI_FIRMWARE_NOTIFY_REBOOT
+over the mailbox interface on reception.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/firmware/raspberrypi.c | 40 +++++++++++++++++++++++++++++++++-
+ 1 file changed, 39 insertions(+), 1 deletion(-)
+
+--- a/drivers/firmware/raspberrypi.c
++++ b/drivers/firmware/raspberrypi.c
+@@ -12,6 +12,7 @@
+ #include <linux/module.h>
+ #include <linux/of_platform.h>
+ #include <linux/platform_device.h>
++#include <linux/reboot.h>
+ #include <linux/slab.h>
+ #include <soc/bcm2835/raspberrypi-firmware.h>
+ 
+@@ -179,6 +180,26 @@ int rpi_firmware_property(struct rpi_fir
+ }
+ EXPORT_SYMBOL_GPL(rpi_firmware_property);
+ 
++static int rpi_firmware_notify_reboot(struct notifier_block *nb,
++				      unsigned long action,
++				      void *data)
++{
++	struct rpi_firmware *fw;
++	struct platform_device *pdev = g_pdev;
++
++	if (!pdev)
++		return 0;
++
++	fw = platform_get_drvdata(pdev);
++	if (!fw)
++		return 0;
++
++	(void)rpi_firmware_property(fw, RPI_FIRMWARE_NOTIFY_REBOOT,
++				    0, 0);
++
++	return 0;
++}
++
+ static void
+ rpi_firmware_print_firmware_revision(struct rpi_firmware *fw)
+ {
+@@ -387,15 +408,32 @@ static struct platform_driver rpi_firmwa
+ 	.remove		= rpi_firmware_remove,
+ };
+ 
++static struct notifier_block rpi_firmware_reboot_notifier = {
++	.notifier_call = rpi_firmware_notify_reboot,
++};
++
+ static int __init rpi_firmware_init(void)
+ {
+-	return platform_driver_register(&rpi_firmware_driver);
++	int ret = register_reboot_notifier(&rpi_firmware_reboot_notifier);
++	if (ret)
++		goto out1;
++	ret = platform_driver_register(&rpi_firmware_driver);
++	if (ret)
++		goto out2;
++
++	return 0;
++
++out2:
++	unregister_reboot_notifier(&rpi_firmware_reboot_notifier);
++out1:
++	return ret;
+ }
+ subsys_initcall(rpi_firmware_init);
+ 
+ static void __init rpi_firmware_exit(void)
+ {
+ 	platform_driver_unregister(&rpi_firmware_driver);
++	unregister_reboot_notifier(&rpi_firmware_reboot_notifier);
+ }
+ module_exit(rpi_firmware_exit);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0141-irqchip-irq-bcm2835-Calc.-FIQ_START-at-boot-time.patch b/target/linux/bcm27xx/patches-6.1/950-0141-irqchip-irq-bcm2835-Calc.-FIQ_START-at-boot-time.patch
new file mode 100644
index 00000000000000..12f13335c80e0b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0141-irqchip-irq-bcm2835-Calc.-FIQ_START-at-boot-time.patch
@@ -0,0 +1,66 @@
+From b0dce103daac406064d7720a83bb467bd65cd53a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Thu, 14 Jun 2018 11:21:04 +0100
+Subject: [PATCH] irqchip: irq-bcm2835: Calc. FIQ_START at boot-time
+
+ad83c7cb2f37 ("irqchip/irq-bcm2836: Add support for DT interrupt polarity")
+changed the way that the BCM2836/7 local interrupts are mapped; instead
+of being pre-mapped they are now mapped on-demand. A side effect of this
+change is that the call to irq_of_parse_and_map from armctrl_of_init
+creates a new mapping, forming a gap between the IRQs and the FIQs. This
+ gap breaks the FIQ<->IRQ mapping which up to now has been done by assuming:
+
+1) that the value of FIQ_START is the same as the number of normal IRQs
+that will be mapped (still true), and
+
+2) that this value is also the offset between an IRQ and its equivalent
+FIQ (which is no longer the case).
+
+Remove both assumptions by measuring the interval between the last IRQ
+and the last FIQ, passing it as the parameter to init_FIQ().
+
+Fixes: https://github.com/raspberrypi/linux/issues/2432
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/irqchip/irq-bcm2835.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/irqchip/irq-bcm2835.c
++++ b/drivers/irqchip/irq-bcm2835.c
+@@ -74,8 +74,6 @@
+ #define NR_BANKS		3
+ #define IRQS_PER_BANK		32
+ #define NUMBER_IRQS		MAKE_HWIRQ(NR_BANKS, 0)
+-#undef FIQ_START
+-#define FIQ_START		(NR_IRQS_BANK0 + MAKE_HWIRQ(NR_BANKS - 1, 0))
+ 
+ static const int reg_pending[] __initconst = { 0x00, 0x04, 0x08 };
+ static const int reg_enable[] __initconst = { 0x18, 0x10, 0x14 };
+@@ -203,7 +201,7 @@ static int __init armctrl_of_init(struct
+ 				  bool is_2836)
+ {
+ 	void __iomem *base;
+-	int irq, b, i;
++	int irq = 0, last_irq, b, i;
+ 	u32 reg;
+ 
+ 	base = of_iomap(node, 0);
+@@ -243,6 +241,8 @@ static int __init armctrl_of_init(struct
+ 		pr_err(FW_BUG "Bootloader left fiq enabled\n");
+ 	}
+ 
++	last_irq = irq;
++
+ 	if (is_2836) {
+ 		int parent_irq = irq_of_parse_and_map(node, 0);
+ 
+@@ -273,7 +273,7 @@ static int __init armctrl_of_init(struct
+ 		}
+ 	}
+ #ifndef CONFIG_ARM64
+-	init_FIQ(FIQ_START);
++	init_FIQ(irq - last_irq);
+ #endif
+ 
+ 	return 0;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0142-net-lan78xx-Disable-TCP-Segmentation-Offload-TSO.patch b/target/linux/bcm27xx/patches-6.1/950-0142-net-lan78xx-Disable-TCP-Segmentation-Offload-TSO.patch
new file mode 100644
index 00000000000000..22a67a0eb1d10d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0142-net-lan78xx-Disable-TCP-Segmentation-Offload-TSO.patch
@@ -0,0 +1,56 @@
+From 63776a20617d4a5ffa5abd35d1d531892a347f36 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 13 Jun 2018 15:21:10 +0100
+Subject: [PATCH] net: lan78xx: Disable TCP Segmentation Offload (TSO)
+
+TSO seems to be having issues when packets are dropped and the
+remote end uses Selective Acknowledge (SACK) to denote that
+data is missing. The missing data is never resent, so the
+connection eventually stalls.
+
+There is a module parameter of enable_tso added to allow
+further debugging without forcing a rebuild of the kernel.
+
+https://github.com/raspberrypi/linux/issues/2449
+https://github.com/raspberrypi/linux/issues/2482
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/net/usb/lan78xx.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -609,6 +609,15 @@ static int lan78xx_alloc_tx_resources(st
+ 				      dev->n_tx_urbs, dev->tx_urb_size, dev);
+ }
+ 
++/* TSO seems to be having some issue with Selective Acknowledge (SACK) that
++ * results in lost data never being retransmitted.
++ * Disable it by default now, but adds a module parameter to enable it for
++ * debug purposes (the full cause is not currently understood).
++ */
++static bool enable_tso;
++module_param(enable_tso, bool, 0644);
++MODULE_PARM_DESC(enable_tso, "Enables TCP segmentation offload");
++
+ static int lan78xx_read_reg(struct lan78xx_net *dev, u32 index, u32 *data)
+ {
+ 	u32 *buf;
+@@ -3467,8 +3476,14 @@ static int lan78xx_bind(struct lan78xx_n
+ 	if (DEFAULT_RX_CSUM_ENABLE)
+ 		dev->net->features |= NETIF_F_RXCSUM;
+ 
+-	if (DEFAULT_TSO_CSUM_ENABLE)
+-		dev->net->features |= NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_SG;
++	if (DEFAULT_TSO_CSUM_ENABLE) {
++		dev->net->features |= NETIF_F_SG;
++		/* Use module parameter to control TCP segmentation offload as
++		 * it appears to cause issues.
++		 */
++		if (enable_tso)
++			dev->net->features |= NETIF_F_TSO | NETIF_F_TSO6;
++	}
+ 
+ 	if (DEFAULT_VLAN_RX_OFFLOAD)
+ 		dev->net->features |= NETIF_F_HW_VLAN_CTAG_RX;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0143-lan78xx-Move-enabling-of-EEE-into-PHY-init-code.patch b/target/linux/bcm27xx/patches-6.1/950-0143-lan78xx-Move-enabling-of-EEE-into-PHY-init-code.patch
new file mode 100644
index 00000000000000..66acf38301155d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0143-lan78xx-Move-enabling-of-EEE-into-PHY-init-code.patch
@@ -0,0 +1,64 @@
+From 972383da6a0bbf4bc0b61b61da5e1712d8d66d72 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Thu, 5 Apr 2018 14:46:11 +0100
+Subject: [PATCH] lan78xx: Move enabling of EEE into PHY init code
+
+Enable EEE mode as soon as possible after connecting to the PHY, and
+before phy_start. This avoids a second link negotiation, which speeds
+up booting and stops the interface failing to become ready.
+
+See: https://github.com/raspberrypi/linux/issues/2437
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/net/usb/lan78xx.c | 32 ++++++++++++++++----------------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2417,6 +2417,22 @@ static int lan78xx_phy_init(struct lan78
+ 	mii_adv_to_linkmode_adv_t(fc, mii_adv);
+ 	linkmode_or(phydev->advertising, fc, phydev->advertising);
+ 
++	if (of_property_read_bool(dev->udev->dev.of_node,
++				  "microchip,eee-enabled")) {
++		struct ethtool_eee edata;
++		memset(&edata, 0, sizeof(edata));
++		edata.cmd = ETHTOOL_SEEE;
++		edata.advertised = ADVERTISED_1000baseT_Full |
++				   ADVERTISED_100baseT_Full;
++		edata.eee_enabled = true;
++		edata.tx_lpi_enabled = true;
++		if (of_property_read_u32(dev->udev->dev.of_node,
++					 "microchip,tx-lpi-timer",
++					 &edata.tx_lpi_timer))
++			edata.tx_lpi_timer = 600; /* non-aggressive */
++		(void)lan78xx_set_eee(dev->net, &edata);
++	}
++
+ 	if (phydev->mdio.dev.of_node) {
+ 		u32 reg;
+ 		int len;
+@@ -3117,22 +3133,6 @@ static int lan78xx_open(struct net_devic
+ 
+ 	netif_dbg(dev, ifup, dev->net, "phy initialised successfully");
+ 
+-	if (of_property_read_bool(dev->udev->dev.of_node,
+-				  "microchip,eee-enabled")) {
+-		struct ethtool_eee edata;
+-		memset(&edata, 0, sizeof(edata));
+-		edata.cmd = ETHTOOL_SEEE;
+-		edata.advertised = ADVERTISED_1000baseT_Full |
+-				   ADVERTISED_100baseT_Full;
+-		edata.eee_enabled = true;
+-		edata.tx_lpi_enabled = true;
+-		if (of_property_read_u32(dev->udev->dev.of_node,
+-					 "microchip,tx-lpi-timer",
+-					 &edata.tx_lpi_timer))
+-			edata.tx_lpi_timer = 600; /* non-aggressive */
+-		(void)lan78xx_set_eee(net, &edata);
+-	}
+-
+ 	/* for Link Check */
+ 	if (dev->urb_intr) {
+ 		ret = usb_submit_urb(dev->urb_intr, GFP_KERNEL);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0144-cxd2880-CXD2880_SPI_DRV-should-select-DVB_CXD2880-wi.patch b/target/linux/bcm27xx/patches-6.1/950-0144-cxd2880-CXD2880_SPI_DRV-should-select-DVB_CXD2880-wi.patch
new file mode 100644
index 00000000000000..5d3b916304d8ea
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0144-cxd2880-CXD2880_SPI_DRV-should-select-DVB_CXD2880-wi.patch
@@ -0,0 +1,20 @@
+From 2c900b1e5b80c4f55e7a5812d6fc1830742d2f31 Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Mon, 17 Sep 2018 17:31:18 +0100
+Subject: [PATCH] cxd2880: CXD2880_SPI_DRV should select DVB_CXD2880
+ with MEDIA_SUBDRV_AUTOSELECT
+
+---
+ drivers/media/spi/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/spi/Kconfig
++++ b/drivers/media/spi/Kconfig
+@@ -9,6 +9,7 @@ menu "Media SPI Adapters"
+ config CXD2880_SPI_DRV
+ 	tristate "Sony CXD2880 SPI support"
+ 	depends on DVB_CORE && SPI
++	select DVB_CXD2880 if MEDIA_SUBDRV_AUTOSELECT
+ 	default m if !MEDIA_SUBDRV_AUTOSELECT
+ 	help
+ 	  Choose if you would like to have SPI interface support for Sony CXD2880.
diff --git a/target/linux/bcm27xx/patches-6.1/950-0145-firmware-raspberrypi-Add-backward-compatible-get_thr.patch b/target/linux/bcm27xx/patches-6.1/950-0145-firmware-raspberrypi-Add-backward-compatible-get_thr.patch
new file mode 100644
index 00000000000000..1f62f7f54e6fab
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0145-firmware-raspberrypi-Add-backward-compatible-get_thr.patch
@@ -0,0 +1,79 @@
+From 60d9a26453885070c6cc73ee224fd315120baa34 Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Sat, 13 Oct 2018 13:31:21 +0200
+Subject: [PATCH] firmware: raspberrypi: Add backward compatible
+ get_throttled
+
+Avoid a hard userspace ABI change by adding a compatible get_throttled
+sysfs entry. Its value is now feed by the GET_THROTTLED requests of the
+new hwmon driver. The first access to get_throttled will generate
+a warning.
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+---
+ drivers/firmware/raspberrypi.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+--- a/drivers/firmware/raspberrypi.c
++++ b/drivers/firmware/raspberrypi.c
+@@ -31,6 +31,7 @@ struct rpi_firmware {
+ 	u32 enabled;
+ 
+ 	struct kref consumers;
++	u32 get_throttled;
+ };
+ 
+ static struct platform_device *g_pdev;
+@@ -176,6 +177,12 @@ int rpi_firmware_property(struct rpi_fir
+ 
+ 	kfree(data);
+ 
++	if ((tag == RPI_FIRMWARE_GET_THROTTLED) &&
++	     memcmp(&fw->get_throttled, tag_data, sizeof(fw->get_throttled))) {
++		memcpy(&fw->get_throttled, tag_data, sizeof(fw->get_throttled));
++		sysfs_notify(&fw->cl.dev->kobj, NULL, "get_throttled");
++	}
++
+ 	return ret;
+ }
+ EXPORT_SYMBOL_GPL(rpi_firmware_property);
+@@ -200,6 +207,27 @@ static int rpi_firmware_notify_reboot(st
+ 	return 0;
+ }
+ 
++static ssize_t get_throttled_show(struct device *dev,
++				  struct device_attribute *attr, char *buf)
++{
++	struct rpi_firmware *fw = dev_get_drvdata(dev);
++
++	WARN_ONCE(1, "deprecated, use hwmon sysfs instead\n");
++
++	return sprintf(buf, "%x\n", fw->get_throttled);
++}
++
++static DEVICE_ATTR_RO(get_throttled);
++
++static struct attribute *rpi_firmware_dev_attrs[] = {
++	&dev_attr_get_throttled.attr,
++	NULL,
++};
++
++static const struct attribute_group rpi_firmware_dev_group = {
++	.attrs = rpi_firmware_dev_attrs,
++};
++
+ static void
+ rpi_firmware_print_firmware_revision(struct rpi_firmware *fw)
+ {
+@@ -229,6 +257,11 @@ rpi_register_hwmon_driver(struct device
+ 
+ 	rpi_hwmon = platform_device_register_data(dev, "raspberrypi-hwmon",
+ 						  -1, NULL, 0);
++
++	if (!IS_ERR_OR_NULL(rpi_hwmon)) {
++		if (devm_device_add_group(dev, &rpi_firmware_dev_group))
++			dev_err(dev, "Failed to create get_trottled attr\n");
++	}
+ }
+ 
+ static void rpi_register_clk_driver(struct device *dev)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0146-sc16is7xx-Don-t-spin-if-no-data-received.patch b/target/linux/bcm27xx/patches-6.1/950-0146-sc16is7xx-Don-t-spin-if-no-data-received.patch
new file mode 100644
index 00000000000000..0e9255b0f2d8ae
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0146-sc16is7xx-Don-t-spin-if-no-data-received.patch
@@ -0,0 +1,23 @@
+From 1f9195cda30b320038cf94b4d14f85e58dd69d6d Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 6 Nov 2018 12:57:48 +0000
+Subject: [PATCH] sc16is7xx: Don't spin if no data received
+
+See: https://github.com/raspberrypi/linux/issues/2676
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/tty/serial/sc16is7xx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/tty/serial/sc16is7xx.c
++++ b/drivers/tty/serial/sc16is7xx.c
+@@ -772,6 +772,8 @@ static bool sc16is7xx_port_irq(struct sc
+ 			rxlen = sc16is7xx_port_read(port, SC16IS7XX_RXLVL_REG);
+ 			if (rxlen)
+ 				sc16is7xx_handle_rx(port, rxlen, iir);
++			else
++				return false;
+ 			break;
+ 		/* CTSRTS interrupt comes only when CTS goes inactive */
+ 		case SC16IS7XX_IIR_CTSRTS_SRC:
diff --git a/target/linux/bcm27xx/patches-6.1/950-0147-drivers-thermal-step_wise-add-support-for-hysteresis.patch b/target/linux/bcm27xx/patches-6.1/950-0147-drivers-thermal-step_wise-add-support-for-hysteresis.patch
new file mode 100644
index 00000000000000..4812f543fa6bde
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0147-drivers-thermal-step_wise-add-support-for-hysteresis.patch
@@ -0,0 +1,88 @@
+From 3fc58056cba3cb56f20f98432de2c144f3d07308 Mon Sep 17 00:00:00 2001
+From: Ram Chandrasekar <rkumbako@codeaurora.org>
+Date: Mon, 7 May 2018 11:54:08 -0600
+Subject: [PATCH] drivers: thermal: step_wise: add support for
+ hysteresis
+
+Step wise governor increases the mitigation level when the temperature
+goes above a threshold and will decrease the mitigation when the
+temperature falls below the threshold. If it were a case, where the
+temperature hovers around a threshold, the mitigation will be applied
+and removed at every iteration. This reaction to the temperature is
+inefficient for performance.
+
+The use of hysteresis temperature could avoid this ping-pong of
+mitigation by relaxing the mitigation to happen only when the
+temperature goes below this lower hysteresis value.
+
+Signed-off-by: Ram Chandrasekar <rkumbako@codeaurora.org>
+Signed-off-by: Lina Iyer <ilina@codeaurora.org>
+---
+ drivers/thermal/gov_step_wise.c | 34 ++++++++++++++++++++++++---------
+ 1 file changed, 25 insertions(+), 9 deletions(-)
+
+--- a/drivers/thermal/gov_step_wise.c
++++ b/drivers/thermal/gov_step_wise.c
+@@ -25,7 +25,7 @@
+  *       for this trip point
+  *    d. if the trend is THERMAL_TREND_DROP_FULL, use lower limit
+  *       for this trip point
+- * If the temperature is lower than a trip point,
++ * If the temperature is lower than a hysteresis temperature,
+  *    a. if the trend is THERMAL_TREND_RAISING, do nothing
+  *    b. if the trend is THERMAL_TREND_DROPPING, use lower cooling
+  *       state for this trip point, if the cooling state already
+@@ -97,7 +97,7 @@ static void update_passive_instance(stru
+ 
+ static void thermal_zone_trip_update(struct thermal_zone_device *tz, int trip)
+ {
+-	int trip_temp;
++	int trip_temp, hyst_temp;
+ 	enum thermal_trip_type trip_type;
+ 	enum thermal_trend trend;
+ 	struct thermal_instance *instance;
+@@ -107,21 +107,37 @@ static void thermal_zone_trip_update(str
+ 	tz->ops->get_trip_temp(tz, trip, &trip_temp);
+ 	tz->ops->get_trip_type(tz, trip, &trip_type);
+ 
+-	trend = get_tz_trend(tz, trip);
+-
+-	if (tz->temperature >= trip_temp) {
+-		throttle = true;
+-		trace_thermal_zone_trip(tz, trip, trip_type);
++	tz->ops->get_trip_temp(tz, trip, &trip_temp);
++	hyst_temp = trip_temp;
++	if (tz->ops->get_trip_hyst) {
++		tz->ops->get_trip_hyst(tz, trip, &hyst_temp);
++		hyst_temp = trip_temp - hyst_temp;
+ 	}
++	tz->ops->get_trip_type(tz, trip, &trip_type);
+ 
+-	dev_dbg(&tz->device, "Trip%d[type=%d,temp=%d]:trend=%d,throttle=%d\n",
+-				trip, trip_type, trip_temp, trend, throttle);
++	trend = get_tz_trend(tz, trip);
++
++	dev_dbg(&tz->device,
++		"Trip%d[type=%d,temp=%d,hyst=%d]:trend=%d,throttle=%d\n",
++		trip, trip_type, trip_temp, hyst_temp, trend, throttle);
+ 
+ 	list_for_each_entry(instance, &tz->thermal_instances, tz_node) {
+ 		if (instance->trip != trip)
+ 			continue;
+ 
+ 		old_target = instance->target;
++		throttle = false;
++		/*
++		 * Lower the mitigation only if the temperature
++		 * goes below the hysteresis temperature.
++		 */
++		if (tz->temperature >= trip_temp ||
++		   (tz->temperature >= hyst_temp &&
++		   old_target != THERMAL_NO_TARGET)) {
++			throttle = true;
++			trace_thermal_zone_trip(tz, trip, trip_type);
++		}
++
+ 		instance->target = get_target_state(instance, trend, throttle);
+ 		dev_dbg(&instance->cdev->device, "old_target=%d, target=%d\n",
+ 					old_target, (int)instance->target);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0148-drivers-thermal-step_wise-avoid-throttling-at-hyster.patch b/target/linux/bcm27xx/patches-6.1/950-0148-drivers-thermal-step_wise-avoid-throttling-at-hyster.patch
new file mode 100644
index 00000000000000..b679aea8514240
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0148-drivers-thermal-step_wise-avoid-throttling-at-hyster.patch
@@ -0,0 +1,22 @@
+From 44c12b1ce29fbe79baabf40b9847a02d2330d980 Mon Sep 17 00:00:00 2001
+From: Serge Schneider <serge@raspberrypi.org>
+Date: Tue, 2 Oct 2018 11:14:15 +0100
+Subject: [PATCH] drivers: thermal: step_wise: avoid throttling at
+ hysteresis temperature after dropping below it
+
+Signed-off-by: Serge Schneider <serge@raspberrypi.org>
+---
+ drivers/thermal/gov_step_wise.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/thermal/gov_step_wise.c
++++ b/drivers/thermal/gov_step_wise.c
+@@ -133,7 +133,7 @@ static void thermal_zone_trip_update(str
+ 		 */
+ 		if (tz->temperature >= trip_temp ||
+ 		   (tz->temperature >= hyst_temp &&
+-		   old_target != THERMAL_NO_TARGET)) {
++		   old_target == instance->upper)) {
+ 			throttle = true;
+ 			trace_thermal_zone_trip(tz, trip, trip_type);
+ 		}
diff --git a/target/linux/bcm27xx/patches-6.1/950-0149-Update-issue-templates-2736.patch b/target/linux/bcm27xx/patches-6.1/950-0149-Update-issue-templates-2736.patch
new file mode 100644
index 00000000000000..c394b4898175be
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0149-Update-issue-templates-2736.patch
@@ -0,0 +1,47 @@
+From f1457e83cd211ef7c8c90e9a69d044366621c83f Mon Sep 17 00:00:00 2001
+From: James Hughes <JamesH65@users.noreply.github.com>
+Date: Fri, 2 Nov 2018 11:55:49 +0000
+Subject: [PATCH] Update issue templates (#2736)
+
+---
+ .github/ISSUE_TEMPLATE/bug_report.md | 34 ++++++++++++++++++++++++++++
+ 1 file changed, 34 insertions(+)
+ create mode 100644 .github/ISSUE_TEMPLATE/bug_report.md
+
+--- /dev/null
++++ b/.github/ISSUE_TEMPLATE/bug_report.md
+@@ -0,0 +1,34 @@
++---
++name: Bug report
++about: Create a report to help us fix your issue
++
++---
++
++**Is this the right place for my bug report?**
++This repository contains the Linux kernel used on the Raspberry Pi. If you believe that the issue you are seeing is kernel-related, this is the right place. If not, we have other repositories for the GPU firmware at [github.com/raspberrypi/firmware](https://github.com/raspberrypi/firmware) and Raspberry Pi userland applications at [github.com/raspberrypi/userland](https://github.com/raspberrypi/userland). If you have problems with the Raspbian distribution packages, report them in the [github.com/RPi-Distro/repo](https://github.com/RPi-Distro/repo). If you simply have a question, then [the Raspberry Pi forums](https://www.raspberrypi.org/forums) are the best place to ask it.
++
++**Describe the bug**
++Add a clear and concise description of what you think the bug is.
++
++**To reproduce**
++List the steps required to reproduce the issue.
++
++**Expected behaviour**
++Add a clear and concise description of what you expected to happen.
++
++**Actual behaviour**
++Add a clear and concise description of what actually happened.
++
++**System**
++ Copy and paste the results of the raspinfo command in to this section. Alternatively, copy and paste a pastebin link, or add answers to the following questions:
++
++* Which model of Raspberry Pi? e.g. Pi3B+, PiZeroW
++* Which OS and version (`cat /etc/rpi-issue`)?
++* Which firmware version (`vcgencmd version`)?
++* Which kernel version (`uname -a`)?
++
++**Logs**
++If applicable, add the relevant output from `dmesg` or similar.
++
++**Additional context**
++Add any other relevant context for the problem.
diff --git a/target/linux/bcm27xx/patches-6.1/950-0150-net-lan78xx-Support-auto-downshift-to-100Mb-s.patch b/target/linux/bcm27xx/patches-6.1/950-0150-net-lan78xx-Support-auto-downshift-to-100Mb-s.patch
new file mode 100644
index 00000000000000..2664fa16467f51
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0150-net-lan78xx-Support-auto-downshift-to-100Mb-s.patch
@@ -0,0 +1,91 @@
+From e44699fd5b2738e60e52c353f0e8f3800498659b Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 26 Nov 2018 19:46:58 +0000
+Subject: [PATCH] net: lan78xx: Support auto-downshift to 100Mb/s
+
+Ethernet cables with faulty or missing pairs (specifically pairs C and
+D) allow auto-negotiation to 1000Mbs, but do not support the successful
+establishment of a link. Add a DT property, "microchip,downshift-after",
+to configure the number of auto-negotiation failures after which it
+falls back to 100Mbs. Valid values are 2, 3, 4, 5 and 0, where 0 means
+never downshift.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ .../bindings/net/microchip,lan78xx.txt        |  3 +++
+ drivers/net/phy/microchip.c                   | 27 +++++++++++++++++++
+ include/linux/microchipphy.h                  |  8 ++++++
+ 3 files changed, 38 insertions(+)
+
+--- a/Documentation/devicetree/bindings/net/microchip,lan78xx.txt
++++ b/Documentation/devicetree/bindings/net/microchip,lan78xx.txt
+@@ -14,6 +14,9 @@ Optional properties of the embedded PHY:
+ - microchip,led-modes: a 0..4 element vector, with each element configuring
+   the operating mode of an LED. Omitted LEDs are turned off. Allowed values
+   are defined in "include/dt-bindings/net/microchip-lan78xx.h".
++- microchip,downshift-after: sets the number of failed auto-negotiation
++  attempts after which the link is downgraded from 1000BASE-T. Should be one of
++  2, 3, 4, 5 or 0, where 0 means never downshift.
+ 
+ Example:
+ 
+--- a/drivers/net/phy/microchip.c
++++ b/drivers/net/phy/microchip.c
+@@ -233,6 +233,7 @@ static int lan88xx_probe(struct phy_devi
+ 	struct device *dev = &phydev->mdio.dev;
+ 	struct lan88xx_priv *priv;
+ 	u32 led_modes[4];
++	u32 downshift_after = 0;
+ 	int len;
+ 
+ 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+@@ -262,6 +263,32 @@ static int lan88xx_probe(struct phy_devi
+ 		return -EINVAL;
+ 	}
+ 
++	if (!of_property_read_u32(dev->of_node,
++				  "microchip,downshift-after",
++				  &downshift_after)) {
++		u32 mask = LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_MASK;
++		u32 val= LAN78XX_PHY_CTRL3_AUTO_DOWNSHIFT;
++
++		switch (downshift_after) {
++		case 2:	val |= LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_2;
++			break;
++		case 3:	val |= LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_3;
++			break;
++		case 4:	val |= LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_4;
++			break;
++		case 5:	val |= LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_5;
++			break;
++		case 0: // Disable completely
++			mask = LAN78XX_PHY_CTRL3_AUTO_DOWNSHIFT;
++			val = 0;
++			break;
++		default:
++			return -EINVAL;
++		}
++		(void)phy_modify_paged(phydev, 1, LAN78XX_PHY_CTRL3,
++				       mask, val);
++	}
++
+ 	/* these values can be used to identify internal PHY */
+ 	priv->chip_id = phy_read_mmd(phydev, 3, LAN88XX_MMD3_CHIP_ID);
+ 	priv->chip_rev = phy_read_mmd(phydev, 3, LAN88XX_MMD3_CHIP_REV);
+--- a/include/linux/microchipphy.h
++++ b/include/linux/microchipphy.h
+@@ -61,6 +61,14 @@
+ /* Registers specific to the LAN7800/LAN7850 embedded phy */
+ #define LAN78XX_PHY_LED_MODE_SELECT		(0x1D)
+ 
++#define LAN78XX_PHY_CTRL3			(0x14)
++#define LAN78XX_PHY_CTRL3_AUTO_DOWNSHIFT	(0x0010)
++#define LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_MASK	(0x000c)
++#define LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_2	(0x0000)
++#define LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_3	(0x0004)
++#define LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_4	(0x0008)
++#define LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_5	(0x000c)
++
+ /* DSP registers */
+ #define PHY_ARDENNES_MMD_DEV_3_PHY_CFG		(0x806A)
+ #define PHY_ARDENNES_MMD_DEV_3_PHY_CFG_ZD_DLY_EN_	(0x2000)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0151-firmware-raspberrypi-Report-the-fw-variant-during-pr.patch b/target/linux/bcm27xx/patches-6.1/950-0151-firmware-raspberrypi-Report-the-fw-variant-during-pr.patch
new file mode 100644
index 00000000000000..7a4b26ebda1ea9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0151-firmware-raspberrypi-Report-the-fw-variant-during-pr.patch
@@ -0,0 +1,89 @@
+From 311b5d4d00862995b7cf916139384defdb6e2d85 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Thu, 10 Jan 2019 17:58:06 +0000
+Subject: [PATCH] firmware: raspberrypi: Report the fw variant during
+ probe
+
+The driver already reported the firmware build date during probe.
+The mailbox calls have been extended to also report the variant
+ 1 = standard start.elf
+ 2 = start_x.elf (includes camera stack)
+ 3 = start_db.elf (includes assert logging)
+ 4 = start_cd.elf (cutdown version for smallest memory footprint).
+Log the variant during probe.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+firmware: raspberrypi: Report the fw git hash during probe
+
+The firmware can now report the git hash from which it was built
+via the mailbox, so report it during probe.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/firmware/raspberrypi.c | 40 +++++++++++++++++++++++++++++++++-
+ 1 file changed, 39 insertions(+), 1 deletion(-)
+
+--- a/drivers/firmware/raspberrypi.c
++++ b/drivers/firmware/raspberrypi.c
+@@ -233,6 +233,15 @@ rpi_firmware_print_firmware_revision(str
+ {
+ 	time64_t date_and_time;
+ 	u32 packet;
++	static const char * const variant_strs[] = {
++		"unknown",
++		"start",
++		"start_x",
++		"start_db",
++		"start_cd",
++	};
++	const char *variant_str = "cmd unsupported";
++	u32 variant;
+ 	int ret = rpi_firmware_property(fw,
+ 					RPI_FIRMWARE_GET_FIRMWARE_REVISION,
+ 					&packet, sizeof(packet));
+@@ -242,7 +251,35 @@ rpi_firmware_print_firmware_revision(str
+ 
+ 	/* This is not compatible with y2038 */
+ 	date_and_time = packet;
+-	dev_info(fw->cl.dev, "Attached to firmware from %ptT\n", &date_and_time);
++
++	ret = rpi_firmware_property(fw, RPI_FIRMWARE_GET_FIRMWARE_VARIANT,
++				    &variant, sizeof(variant));
++
++	if (!ret) {
++		if (variant >= ARRAY_SIZE(variant_strs))
++			variant = 0;
++		variant_str = variant_strs[variant];
++	}
++
++	dev_info(fw->cl.dev,
++		 "Attached to firmware from %ptT, variant %s\n",
++		 &date_and_time, variant_str);
++}
++
++static void
++rpi_firmware_print_firmware_hash(struct rpi_firmware *fw)
++{
++	u32 hash[5];
++	int ret = rpi_firmware_property(fw,
++					RPI_FIRMWARE_GET_FIRMWARE_HASH,
++					hash, sizeof(hash));
++
++	if (ret)
++		return;
++
++	dev_info(fw->cl.dev,
++		 "Firmware hash is %08x%08x%08x%08x%08x\n",
++		 hash[0], hash[1], hash[2], hash[3], hash[4]);
+ }
+ 
+ static void
+@@ -339,6 +376,7 @@ static int rpi_firmware_probe(struct pla
+ 	g_pdev = pdev;
+ 
+ 	rpi_firmware_print_firmware_revision(fw);
++	rpi_firmware_print_firmware_hash(fw);
+ 	rpi_register_hwmon_driver(dev, fw);
+ 	rpi_register_clk_driver(dev);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0152-lan78xx-Debounce-link-events-to-minimize-poll-storm.patch b/target/linux/bcm27xx/patches-6.1/950-0152-lan78xx-Debounce-link-events-to-minimize-poll-storm.patch
new file mode 100644
index 00000000000000..127ddbc537e020
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0152-lan78xx-Debounce-link-events-to-minimize-poll-storm.patch
@@ -0,0 +1,45 @@
+From 74be3d89db12ba469eaf4ec082599b6ed1e6dc44 Mon Sep 17 00:00:00 2001
+From: Joshua Emele <jemele@acm.org>
+Date: Wed, 7 Nov 2018 16:07:40 -0800
+Subject: [PATCH] lan78xx: Debounce link events to minimize poll storm
+
+The bInterval is set to 4 (i.e. 8 microframes => 1ms) and the only bit
+that the driver pays attention to is "link was reset". If there's a
+flapping status bit in that endpoint data, (such as if PHY negotiation
+needs a few tries to get a stable link) then polling at a slower rate
+would act as a de-bounce.
+
+See: https://github.com/raspberrypi/linux/issues/2447
+---
+ drivers/net/usb/lan78xx.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -618,6 +618,11 @@ static bool enable_tso;
+ module_param(enable_tso, bool, 0644);
+ MODULE_PARM_DESC(enable_tso, "Enables TCP segmentation offload");
+ 
++#define INT_URB_MICROFRAMES_PER_MS	8
++static int int_urb_interval_ms = 8;
++module_param(int_urb_interval_ms, int, 0);
++MODULE_PARM_DESC(int_urb_interval_ms, "Override usb interrupt urb interval");
++
+ static int lan78xx_read_reg(struct lan78xx_net *dev, u32 index, u32 *data)
+ {
+ 	u32 *buf;
+@@ -4454,7 +4459,13 @@ static int lan78xx_probe(struct usb_inte
+ 	if (ret < 0)
+ 		goto out4;
+ 
+-	period = ep_intr->desc.bInterval;
++	if (int_urb_interval_ms <= 0)
++		period = ep_intr->desc.bInterval;
++	else
++		period = int_urb_interval_ms * INT_URB_MICROFRAMES_PER_MS;
++
++	netif_notice(dev, probe, netdev, "int urb period %d\n", period);
++
+ 	maxp = usb_maxpacket(dev->udev, dev->pipe_intr);
+ 	buf = kmalloc(maxp, GFP_KERNEL);
+ 	if (!buf) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0153-lan78xx-EEE-support-is-now-a-PHY-property.patch b/target/linux/bcm27xx/patches-6.1/950-0153-lan78xx-EEE-support-is-now-a-PHY-property.patch
new file mode 100644
index 00000000000000..b38c62273e4fb6
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0153-lan78xx-EEE-support-is-now-a-PHY-property.patch
@@ -0,0 +1,26 @@
+From 3b7545f2031d984fe305ff095e9df065b80c06a8 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 5 Mar 2019 09:51:22 +0000
+Subject: [PATCH] lan78xx: EEE support is now a PHY property
+
+Now that EEE support is a property of the PHY, use the PHY's DT node
+when querying the EEE-related properties.
+
+See: https://github.com/raspberrypi/linux/issues/2882
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/net/usb/lan78xx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2422,7 +2422,7 @@ static int lan78xx_phy_init(struct lan78
+ 	mii_adv_to_linkmode_adv_t(fc, mii_adv);
+ 	linkmode_or(phydev->advertising, fc, phydev->advertising);
+ 
+-	if (of_property_read_bool(dev->udev->dev.of_node,
++	if (of_property_read_bool(phydev->mdio.dev.of_node,
+ 				  "microchip,eee-enabled")) {
+ 		struct ethtool_eee edata;
+ 		memset(&edata, 0, sizeof(edata));
diff --git a/target/linux/bcm27xx/patches-6.1/950-0154-bcm2835-dma-Add-support-for-per-channel-flags.patch b/target/linux/bcm27xx/patches-6.1/950-0154-bcm2835-dma-Add-support-for-per-channel-flags.patch
new file mode 100644
index 00000000000000..5436f8f747368e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0154-bcm2835-dma-Add-support-for-per-channel-flags.patch
@@ -0,0 +1,48 @@
+From a55c9effca02c9493097c5ef2c7915adca510c28 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Fri, 20 Jul 2018 22:03:41 +0100
+Subject: [PATCH] bcm2835-dma: Add support for per-channel flags
+
+Add the ability to interpret the high bits of the dreq specifier as
+flags to be included in the DMA_CS register. The motivation for this
+change is the ability to set the DISDEBUG flag for SD card transfers
+to avoid corruption when using the VPU debugger.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/dma/bcm2835-dma.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -139,6 +139,10 @@ struct bcm2835_desc {
+ #define BCM2835_DMA_S_DREQ	BIT(10) /* enable SREQ for source */
+ #define BCM2835_DMA_S_IGNORE	BIT(11) /* ignore source reads - read 0 */
+ #define BCM2835_DMA_BURST_LENGTH(x) ((x & 15) << 12)
++#define BCM2835_DMA_CS_FLAGS(x) (x & (BCM2835_DMA_PRIORITY(15) | \
++				      BCM2835_DMA_PANIC_PRIORITY(15) | \
++				      BCM2835_DMA_WAIT_FOR_WRITES | \
++				      BCM2835_DMA_DIS_DEBUG))
+ #define BCM2835_DMA_PER_MAP(x)	((x & 31) << 16) /* REQ source */
+ #define BCM2835_DMA_WAIT(x)	((x & 31) << 21) /* add DMA-wait cycles */
+ #define BCM2835_DMA_NO_WIDE_BURSTS BIT(26) /* no 2 beat write bursts */
+@@ -452,7 +456,8 @@ static void bcm2835_dma_start_desc(struc
+ 	c->desc = d = to_bcm2835_dma_desc(&vd->tx);
+ 
+ 	writel(d->cb_list[0].paddr, c->chan_base + BCM2835_DMA_ADDR);
+-	writel(BCM2835_DMA_ACTIVE, c->chan_base + BCM2835_DMA_CS);
++	writel(BCM2835_DMA_ACTIVE | BCM2835_DMA_CS_FLAGS(c->dreq),
++	       c->chan_base + BCM2835_DMA_CS);
+ }
+ 
+ static irqreturn_t bcm2835_dma_callback(int irq, void *data)
+@@ -479,7 +484,8 @@ static irqreturn_t bcm2835_dma_callback(
+ 	 * if this IRQ handler is threaded.) If the channel is finished, it
+ 	 * will remain idle despite the ACTIVE flag being set.
+ 	 */
+-	writel(BCM2835_DMA_INT | BCM2835_DMA_ACTIVE,
++	writel(BCM2835_DMA_INT | BCM2835_DMA_ACTIVE |
++	       BCM2835_DMA_CS_FLAGS(c->dreq),
+ 	       c->chan_base + BCM2835_DMA_CS);
+ 
+ 	d = c->desc;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0155-rtc-rv3028-Add-backup-switchover-mode-support.patch b/target/linux/bcm27xx/patches-6.1/950-0155-rtc-rv3028-Add-backup-switchover-mode-support.patch
new file mode 100644
index 00000000000000..0ca1388d409612
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0155-rtc-rv3028-Add-backup-switchover-mode-support.patch
@@ -0,0 +1,82 @@
+From 83cbc83905d756a4da933af63c86ca37d6af64f9 Mon Sep 17 00:00:00 2001
+From: Phil Howard <phil@gadgetoid.com>
+Date: Fri, 29 Mar 2019 10:53:14 +0000
+Subject: [PATCH] rtc: rv3028: Add backup switchover mode support
+
+Signed-off-by: Phil Howard <phil@pimoroni.com>
+---
+ drivers/rtc/rtc-rv3028.c | 45 +++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 40 insertions(+), 5 deletions(-)
+
+--- a/drivers/rtc/rtc-rv3028.c
++++ b/drivers/rtc/rtc-rv3028.c
+@@ -860,6 +860,8 @@ static int rv3028_probe(struct i2c_clien
+ 	struct rv3028_data *rv3028;
+ 	int ret, status;
+ 	u32 ohms;
++	u32 bsm;
++	u8 backup, backup_bits, backup_mask;
+ 	struct nvmem_config nvmem_cfg = {
+ 		.name = "rv3028_nvram",
+ 		.word_size = 1,
+@@ -926,6 +928,21 @@ static int rv3028_probe(struct i2c_clien
+ 	if (ret)
+ 		return ret;
+ 
++	backup_bits = 0;
++	backup_mask = 0;
++
++	/* setup backup switchover mode */
++	if (!device_property_read_u32(&client->dev,
++				      "backup-switchover-mode",
++				      &bsm)) {
++		if (bsm <= 3) {
++			backup_bits |= (u8)(bsm << 2);
++			backup_mask |= RV3028_BACKUP_BSM;
++		} else {
++			dev_warn(&client->dev, "invalid backup switchover mode value\n");
++		}
++	}
++
+ 	/* setup trickle charger */
+ 	if (!device_property_read_u32(&client->dev, "trickle-resistor-ohms",
+ 				      &ohms)) {
+@@ -936,15 +953,33 @@ static int rv3028_probe(struct i2c_clien
+ 				break;
+ 
+ 		if (i < ARRAY_SIZE(rv3028_trickle_resistors)) {
+-			ret = rv3028_update_cfg(rv3028, RV3028_BACKUP, RV3028_BACKUP_TCE |
+-						 RV3028_BACKUP_TCR_MASK, RV3028_BACKUP_TCE | i);
+-			if (ret)
+-				return ret;
++			backup_bits |= RV3028_BACKUP_TCE | i;
++			backup_mask |= RV3028_BACKUP_TCE |
++				RV3028_BACKUP_TCR_MASK;
+ 		} else {
+-			dev_warn(&client->dev, "invalid trickle resistor value\n");
++			dev_warn(&client->dev,
++				 "invalid trickle resistor value\n");
+ 		}
+ 	}
+ 
++	if (backup_mask) {
++		ret = rv3028_eeprom_read((void *)rv3028, RV3028_BACKUP,
++					 (void *)&backup, 1);
++		/* Write register and EEPROM if needed */
++		if (!ret && (backup & backup_mask) != backup_bits) {
++			backup = (backup & ~backup_mask) | backup_bits;
++			ret = rv3028_update_cfg(rv3028, RV3028_BACKUP,
++						backup_mask, backup_bits);
++		}
++
++		/* In the event of an EEPROM failure, just update the register */
++		if (ret)
++			ret = regmap_update_bits(rv3028->regmap, RV3028_BACKUP,
++						 backup_mask, backup_bits);
++		if (ret)
++			return ret;
++	}
++
+ 	ret = rtc_add_group(rv3028->rtc, &rv3028_attr_group);
+ 	if (ret)
+ 		return ret;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0156-media-tc358743-Increase-FIFO-level-to-374.patch b/target/linux/bcm27xx/patches-6.1/950-0156-media-tc358743-Increase-FIFO-level-to-374.patch
new file mode 100644
index 00000000000000..25e08080241199
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0156-media-tc358743-Increase-FIFO-level-to-374.patch
@@ -0,0 +1,31 @@
+From 3ffb0a5df9f03fc5167f91167a16b386cbbd877e Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 31 Oct 2018 14:56:59 +0000
+Subject: [PATCH] media: tc358743: Increase FIFO level to 374.
+
+The existing fixed value of 16 worked for UYVY 720P60 over
+2 lanes at 594MHz, or UYVY 1080P60 over 4 lanes. (RGB888
+1080P60 needs 6 lanes at 594MHz).
+It doesn't allow for lower resolutions to work as the FIFO
+underflows.
+
+374 is required for 1080P24-30 UYVY over 2 lanes @ 972Mbit/s, but
+>374 means that the FIFO underflows on 1080P50 UYVY over 2 lanes
+@ 972Mbit/s.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/media/i2c/tc358743.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -1936,7 +1936,7 @@ static int tc358743_probe_of(struct tc35
+ 	state->pdata.ddc5v_delay = DDC5V_DELAY_100_MS;
+ 	state->pdata.enable_hdcp = false;
+ 	/* A FIFO level of 16 should be enough for 2-lane 720p60 at 594 MHz. */
+-	state->pdata.fifo_level = 16;
++	state->pdata.fifo_level = 374;
+ 	/*
+ 	 * The PLL input clock is obtained by dividing refclk by pll_prd.
+ 	 * It must be between 6 MHz and 40 MHz, lower frequency is better.
diff --git a/target/linux/bcm27xx/patches-6.1/950-0157-media-tc358743-Add-support-for-972Mbit-s-link-freq.patch b/target/linux/bcm27xx/patches-6.1/950-0157-media-tc358743-Add-support-for-972Mbit-s-link-freq.patch
new file mode 100644
index 00000000000000..c2d1e83dec823d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0157-media-tc358743-Add-support-for-972Mbit-s-link-freq.patch
@@ -0,0 +1,79 @@
+From 91fa89dd812557e8894f18ce9283a7f9308bae19 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 31 Oct 2018 14:57:21 +0000
+Subject: [PATCH] media: tc358743: Add support for 972Mbit/s link freq.
+
+Adds register setups for running the CSI lanes at 972Mbit/s,
+which allows 1080P50 UYVY down 2 lanes.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/media/i2c/tc358743.c | 47 +++++++++++++++++++++++++-----------
+ 1 file changed, 33 insertions(+), 14 deletions(-)
+
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -1956,6 +1956,7 @@ static int tc358743_probe_of(struct tc35
+ 	/*
+ 	 * The CSI bps per lane must be between 62.5 Mbps and 1 Gbps.
+ 	 * The default is 594 Mbps for 4-lane 1080p60 or 2-lane 720p60.
++	 * 972 Mbps allows 1080P50 UYVY over 2-lane.
+ 	 */
+ 	bps_pr_lane = 2 * endpoint.link_frequencies[0];
+ 	if (bps_pr_lane < 62500000U || bps_pr_lane > 1000000000U) {
+@@ -1969,23 +1970,41 @@ static int tc358743_probe_of(struct tc35
+ 			       state->pdata.refclk_hz * state->pdata.pll_prd;
+ 
+ 	/*
+-	 * FIXME: These timings are from REF_02 for 594 Mbps per lane (297 MHz
+-	 * link frequency). In principle it should be possible to calculate
++	 * FIXME: These timings are from REF_02 for 594 or 972 Mbps per lane
++	 * (297 MHz or 486 MHz link frequency).
++	 * In principle it should be possible to calculate
+ 	 * them based on link frequency and resolution.
+ 	 */
+-	if (bps_pr_lane != 594000000U)
++	switch (bps_pr_lane) {
++	default:
+ 		dev_warn(dev, "untested bps per lane: %u bps\n", bps_pr_lane);
+-	state->pdata.lineinitcnt = 0xe80;
+-	state->pdata.lptxtimecnt = 0x003;
+-	/* tclk-preparecnt: 3, tclk-zerocnt: 20 */
+-	state->pdata.tclk_headercnt = 0x1403;
+-	state->pdata.tclk_trailcnt = 0x00;
+-	/* ths-preparecnt: 3, ths-zerocnt: 1 */
+-	state->pdata.ths_headercnt = 0x0103;
+-	state->pdata.twakeup = 0x4882;
+-	state->pdata.tclk_postcnt = 0x008;
+-	state->pdata.ths_trailcnt = 0x2;
+-	state->pdata.hstxvregcnt = 0;
++	case 594000000U:
++		state->pdata.lineinitcnt = 0xe80;
++		state->pdata.lptxtimecnt = 0x003;
++		/* tclk-preparecnt: 3, tclk-zerocnt: 20 */
++		state->pdata.tclk_headercnt = 0x1403;
++		state->pdata.tclk_trailcnt = 0x00;
++		/* ths-preparecnt: 3, ths-zerocnt: 1 */
++		state->pdata.ths_headercnt = 0x0103;
++		state->pdata.twakeup = 0x4882;
++		state->pdata.tclk_postcnt = 0x008;
++		state->pdata.ths_trailcnt = 0x2;
++		state->pdata.hstxvregcnt = 0;
++		break;
++	case 972000000U:
++		state->pdata.lineinitcnt = 0x1b58;
++		state->pdata.lptxtimecnt = 0x007;
++		/* tclk-preparecnt: 6, tclk-zerocnt: 40 */
++		state->pdata.tclk_headercnt = 0x2806;
++		state->pdata.tclk_trailcnt = 0x00;
++		/* ths-preparecnt: 6, ths-zerocnt: 8 */
++		state->pdata.ths_headercnt = 0x0806;
++		state->pdata.twakeup = 0x4268;
++		state->pdata.tclk_postcnt = 0x008;
++		state->pdata.ths_trailcnt = 0x5;
++		state->pdata.hstxvregcnt = 0;
++		break;
++	}
+ 
+ 	state->reset_gpio = devm_gpiod_get_optional(dev, "reset",
+ 						    GPIOD_OUT_LOW);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0158-media-tc358743-Check-I2C-succeeded-during-probe.patch b/target/linux/bcm27xx/patches-6.1/950-0158-media-tc358743-Check-I2C-succeeded-during-probe.patch
new file mode 100644
index 00000000000000..4c7d724124fe5e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0158-media-tc358743-Check-I2C-succeeded-during-probe.patch
@@ -0,0 +1,98 @@
+From 7fb4eadf9ca5f960a6ef8d4b43edfe8a2fe8b48a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 31 Oct 2018 14:57:34 +0000
+Subject: [PATCH] media: tc358743: Check I2C succeeded during probe.
+
+The probe for the TC358743 reads the CHIPID register from
+the device and compares it to the expected value of 0.
+If the I2C request fails then that also returns 0, so
+the driver loads thinking that the device is there.
+
+Generally I2C communications are reliable so there is
+limited need to check the return value on every transfer,
+therefore only amend the one read during probe to check
+for I2C errors.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/media/i2c/tc358743.c | 27 +++++++++++++++++++++++----
+ 1 file changed, 23 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -110,7 +110,7 @@ static inline struct tc358743_state *to_
+ 
+ /* --------------- I2C --------------- */
+ 
+-static void i2c_rd(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
++static int i2c_rd(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
+ {
+ 	struct tc358743_state *state = to_state(sd);
+ 	struct i2c_client *client = state->i2c_client;
+@@ -136,6 +136,7 @@ static void i2c_rd(struct v4l2_subdev *s
+ 		v4l2_err(sd, "%s: reading register 0x%x from 0x%x failed\n",
+ 				__func__, reg, client->addr);
+ 	}
++	return err != ARRAY_SIZE(msgs);
+ }
+ 
+ static void i2c_wr(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
+@@ -192,15 +193,24 @@ static void i2c_wr(struct v4l2_subdev *s
+ 	}
+ }
+ 
+-static noinline u32 i2c_rdreg(struct v4l2_subdev *sd, u16 reg, u32 n)
++static noinline u32 i2c_rdreg_err(struct v4l2_subdev *sd, u16 reg, u32 n,
++				  int *err)
+ {
++	int error;
+ 	__le32 val = 0;
+ 
+-	i2c_rd(sd, reg, (u8 __force *)&val, n);
++	error = i2c_rd(sd, reg, (u8 __force *)&val, n);
++	if (err)
++		*err = error;
+ 
+ 	return le32_to_cpu(val);
+ }
+ 
++static inline u32 i2c_rdreg(struct v4l2_subdev *sd, u16 reg, u32 n)
++{
++	return i2c_rdreg_err(sd, reg, n, NULL);
++}
++
+ static noinline void i2c_wrreg(struct v4l2_subdev *sd, u16 reg, u32 val, u32 n)
+ {
+ 	__le32 raw = cpu_to_le32(val);
+@@ -229,6 +239,13 @@ static u16 i2c_rd16(struct v4l2_subdev *
+ 	return i2c_rdreg(sd, reg, 2);
+ }
+ 
++static int i2c_rd16_err(struct v4l2_subdev *sd, u16 reg, u16 *value)
++{
++	int err;
++	*value = i2c_rdreg_err(sd, reg, 2, &err);
++	return err;
++}
++
+ static void i2c_wr16(struct v4l2_subdev *sd, u16 reg, u16 val)
+ {
+ 	i2c_wrreg(sd, reg, val, 2);
+@@ -2043,6 +2060,7 @@ static int tc358743_probe(struct i2c_cli
+ 	struct tc358743_platform_data *pdata = client->dev.platform_data;
+ 	struct v4l2_subdev *sd;
+ 	u16 irq_mask = MASK_HDMI_MSK | MASK_CSI_MSK;
++	u16 chipid;
+ 	int err;
+ 
+ 	if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_BYTE_DATA))
+@@ -2074,7 +2092,8 @@ static int tc358743_probe(struct i2c_cli
+ 	sd->flags |= V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS;
+ 
+ 	/* i2c access */
+-	if ((i2c_rd16(sd, CHIPID) & MASK_CHIPID) != 0) {
++	if (i2c_rd16_err(sd, CHIPID, &chipid) ||
++	    (chipid & MASK_CHIPID) != 0) {
+ 		v4l2_info(sd, "not a TC358743 on address 0x%x\n",
+ 			  client->addr << 1);
+ 		return -ENODEV;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0159-media-adv7180-Default-to-the-first-valid-input.patch b/target/linux/bcm27xx/patches-6.1/950-0159-media-adv7180-Default-to-the-first-valid-input.patch
new file mode 100644
index 00000000000000..d028954107c2d8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0159-media-adv7180-Default-to-the-first-valid-input.patch
@@ -0,0 +1,45 @@
+From 24b0bf24790c73bb20feb62bc4b3a53b529cab26 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 31 Oct 2018 14:57:46 +0000
+Subject: [PATCH] media: adv7180: Default to the first valid input
+
+The hardware default is differential CVBS on AIN1 & 2, which
+isn't very useful.
+
+Select the first input that is defined as valid for the
+chip variant (typically CVBS_AIN1).
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/media/i2c/adv7180.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -1340,6 +1340,7 @@ static const struct adv7180_chip_info ad
+ static int init_device(struct adv7180_state *state)
+ {
+ 	int ret;
++	int i;
+ 
+ 	mutex_lock(&state->mutex);
+ 
+@@ -1387,6 +1388,18 @@ static int init_device(struct adv7180_st
+ 			goto out_unlock;
+ 	}
+ 
++	/* Select first valid input */
++	for (i = 0; i < 32; i++) {
++		if (BIT(i) & state->chip_info->valid_input_mask) {
++			ret = state->chip_info->select_input(state, i);
++
++			if (ret == 0) {
++				state->input = i;
++				break;
++			}
++		}
++	}
++
+ out_unlock:
+ 	mutex_unlock(&state->mutex);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0160-media-adv7180-Add-YPrPb-support-for-ADV7282M.patch b/target/linux/bcm27xx/patches-6.1/950-0160-media-adv7180-Add-YPrPb-support-for-ADV7282M.patch
new file mode 100644
index 00000000000000..322d56c242e43c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0160-media-adv7180-Add-YPrPb-support-for-ADV7282M.patch
@@ -0,0 +1,24 @@
+From f936abf4f8b3c3e803cf9ad22f0feec9e41e97dc Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 31 Oct 2018 14:57:56 +0000
+Subject: [PATCH] media: adv7180: Add YPrPb support for ADV7282M
+
+The ADV7282M can support YPbPr on AIN1-3, but this was
+not selectable from the driver. Add it to the list of
+supported input modes.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/media/i2c/adv7180.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -1329,6 +1329,7 @@ static const struct adv7180_chip_info ad
+ 		BIT(ADV7182_INPUT_SVIDEO_AIN1_AIN2) |
+ 		BIT(ADV7182_INPUT_SVIDEO_AIN3_AIN4) |
+ 		BIT(ADV7182_INPUT_SVIDEO_AIN7_AIN8) |
++		BIT(ADV7182_INPUT_YPRPB_AIN1_AIN2_AIN3) |
+ 		BIT(ADV7182_INPUT_DIFF_CVBS_AIN1_AIN2) |
+ 		BIT(ADV7182_INPUT_DIFF_CVBS_AIN3_AIN4) |
+ 		BIT(ADV7182_INPUT_DIFF_CVBS_AIN7_AIN8),
diff --git a/target/linux/bcm27xx/patches-6.1/950-0161-media-videodev2-Add-helper-defines-for-printing-FOUR.patch b/target/linux/bcm27xx/patches-6.1/950-0161-media-videodev2-Add-helper-defines-for-printing-FOUR.patch
new file mode 100644
index 00000000000000..cd7e15b1bee768
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0161-media-videodev2-Add-helper-defines-for-printing-FOUR.patch
@@ -0,0 +1,28 @@
+From 1222409f3aff2d4f1b9787491fa5e67602f3a352 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 31 Oct 2018 14:58:08 +0000
+Subject: [PATCH] media: videodev2: Add helper defines for printing
+ FOURCCs
+
+New helper defines that allow printing of a FOURCC using
+printf(V4L2_FOURCC_CONV, V4L2_FOURCC_CONV_ARGS(fourcc));
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ include/uapi/linux/videodev2.h | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -82,6 +82,11 @@
+ 	((__u32)(a) | ((__u32)(b) << 8) | ((__u32)(c) << 16) | ((__u32)(d) << 24))
+ #define v4l2_fourcc_be(a, b, c, d)	(v4l2_fourcc(a, b, c, d) | (1U << 31))
+ 
++#define V4L2_FOURCC_CONV "%c%c%c%c%s"
++#define V4L2_FOURCC_CONV_ARGS(fourcc) \
++	(fourcc) & 0x7f, ((fourcc) >> 8) & 0x7f, ((fourcc) >> 16) & 0x7f, \
++	((fourcc) >> 24) & 0x7f, (fourcc) & BIT(31) ? "-BE" : ""
++
+ /*
+  *	E N U M S
+  */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0162-dt-bindings-Document-BCM283x-CSI2-CCP2-receiver.patch b/target/linux/bcm27xx/patches-6.1/950-0162-dt-bindings-Document-BCM283x-CSI2-CCP2-receiver.patch
new file mode 100644
index 00000000000000..cf429ccd5ba6d0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0162-dt-bindings-Document-BCM283x-CSI2-CCP2-receiver.patch
@@ -0,0 +1,103 @@
+From fc8a052745aba2bd5a85501a2226b1332d08ebec Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 31 Oct 2018 14:59:06 +0000
+Subject: [PATCH] dt-bindings: Document BCM283x CSI2/CCP2 receiver
+
+Document the DT bindings for the CSI2/CCP2 receiver peripheral
+(known as Unicam) on BCM283x SoCs.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Acked-by: Rob Herring <robh@kernel.org>
+---
+ .../bindings/media/bcm2835-unicam.txt         | 85 +++++++++++++++++++
+ 1 file changed, 85 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/bcm2835-unicam.txt
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/bcm2835-unicam.txt
+@@ -0,0 +1,85 @@
++Broadcom BCM283x Camera Interface (Unicam)
++------------------------------------------
++
++The Unicam block on BCM283x SoCs is the receiver for either
++CSI-2 or CCP2 data from image sensors or similar devices.
++
++The main platform using this SoC is the Raspberry Pi family of boards.
++On the Pi the VideoCore firmware can also control this hardware block,
++and driving it from two different processors will cause issues.
++To avoid this, the firmware checks the device tree configuration
++during boot. If it finds device tree nodes called csi0 or csi1 then
++it will stop the firmware accessing the block, and it can then
++safely be used via the device tree binding.
++
++Required properties:
++===================
++- compatible	: must be "brcm,bcm2835-unicam".
++- reg		: physical base address and length of the register sets for the
++		  device.
++- interrupts	: should contain the IRQ line for this Unicam instance.
++- clocks	: list of clock specifiers, corresponding to entries in
++		  clock-names property.
++- clock-names	: must contain an "lp" entry, matching entries in the
++		  clocks property.
++
++Unicam supports a single port node. It should contain one 'port' child node
++with child 'endpoint' node. Please refer to the bindings defined in
++Documentation/devicetree/bindings/media/video-interfaces.txt.
++
++Within the endpoint node the "remote-endpoint" and "data-lanes" properties
++are mandatory.
++Data lane reordering is not supported so the data lanes must be in order,
++starting at 1. The number of data lanes should represent the number of
++usable lanes for the hardware block. That may be limited by either the SoC or
++how the platform presents the interface, and the lower value must be used.
++
++Lane reordering is not supported on the clock lane either, so the optional
++property "clock-lane" will implicitly be <0>.
++Similarly lane inversion is not supported, therefore "lane-polarities" will
++implicitly be <0 0 0 0 0>.
++Neither of these values will be checked.
++
++Example:
++	csi1: csi1@7e801000 {
++		compatible = "brcm,bcm2835-unicam";
++		reg = <0x7e801000 0x800>,
++		      <0x7e802004 0x4>;
++		interrupts = <2 7>;
++		clocks = <&clocks BCM2835_CLOCK_CAM1>;
++		clock-names = "lp";
++
++		port {
++			csi1_ep: endpoint {
++				remote-endpoint = <&tc358743_0>;
++				data-lanes = <1 2>;
++			};
++		};
++	};
++
++	i2c0: i2c@7e205000 {
++		tc358743: csi-hdmi-bridge@0f {
++			compatible = "toshiba,tc358743";
++			reg = <0x0f>;
++
++			clocks = <&tc358743_clk>;
++			clock-names = "refclk";
++
++			tc358743_clk: bridge-clk {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <27000000>;
++			};
++
++			port {
++				tc358743_0: endpoint {
++					remote-endpoint = <&csi1_ep>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++					link-frequencies =
++						/bits/ 64 <297000000>;
++				};
++			};
++		};
++	};
diff --git a/target/linux/bcm27xx/patches-6.1/950-0163-MAINTAINERS-Add-entry-for-BCM2835-Unicam-driver.patch b/target/linux/bcm27xx/patches-6.1/950-0163-MAINTAINERS-Add-entry-for-BCM2835-Unicam-driver.patch
new file mode 100644
index 00000000000000..a3488944190a04
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0163-MAINTAINERS-Add-entry-for-BCM2835-Unicam-driver.patch
@@ -0,0 +1,28 @@
+From a8bdb91f7d3fb93b0e4304602fba5e15d93fc4ce Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 31 Oct 2018 14:59:40 +0000
+Subject: [PATCH] MAINTAINERS: Add entry for BCM2835 Unicam driver
+
+Adds entry for the new BCM2835 Unicam (CSI-2 receiver) driver
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ MAINTAINERS | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -4030,6 +4030,13 @@ N:	bcm113*
+ N:	bcm216*
+ N:	kona
+ 
++BROADCOM BCM2835 CAMERA DRIVER
++M:	Dave Stevenson <dave.stevenson@raspberrypi.org>
++L:	linux-media@vger.kernel.org
++S:	Maintained
++F:	drivers/media/platform/bcm2835/
++F:	Documentation/devicetree/bindings/media/bcm2835-unicam.txt
++
+ BROADCOM BCM47XX MIPS ARCHITECTURE
+ M:	Hauke Mehrtens <hauke@hauke-m.de>
+ M:	Rafał Miłecki <zajec5@gmail.com>
diff --git a/target/linux/bcm27xx/patches-6.1/950-0164-media-tc358743-Return-an-appropriate-colorspace-from.patch b/target/linux/bcm27xx/patches-6.1/950-0164-media-tc358743-Return-an-appropriate-colorspace-from.patch
new file mode 100644
index 00000000000000..c0823112c6f208
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0164-media-tc358743-Return-an-appropriate-colorspace-from.patch
@@ -0,0 +1,98 @@
+From 50b669386c0315985f460d6d25d8302d3d370b2b Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Thu, 22 Nov 2018 17:31:06 +0000
+Subject: [PATCH] media: tc358743: Return an appropriate colorspace
+ from tc358743_set_fmt
+
+When calling tc358743_set_fmt, the code was calling tc358743_get_fmt
+to choose a valid format. However that sets the colorspace
+based on what was read back from the chip. When you set the format,
+then the driver would choose and program the colorspace based
+on the format code.
+
+The result was that if you called try or set format for UYVY
+when the current format was RGB3 then you would get told sRGB,
+and try RGB3 when current was UYVY and you would get told
+SMPTE170M.
+
+The value programmed into the chip is determined by this driver,
+therefore there is no need to read back the value. Return the
+colorspace based on the format set/tried instead.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/media/i2c/tc358743.c | 40 +++++++++++++-----------------------
+ 1 file changed, 14 insertions(+), 26 deletions(-)
+
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -1668,12 +1668,23 @@ static int tc358743_enum_mbus_code(struc
+ 	return 0;
+ }
+ 
++static u32 tc358743_g_colorspace(u32 code)
++{
++	switch (code) {
++	case MEDIA_BUS_FMT_RGB888_1X24:
++		return V4L2_COLORSPACE_SRGB;
++	case MEDIA_BUS_FMT_UYVY8_1X16:
++		return V4L2_COLORSPACE_SMPTE170M;
++	default:
++		return 0;
++	}
++}
++
+ static int tc358743_get_fmt(struct v4l2_subdev *sd,
+ 		struct v4l2_subdev_state *sd_state,
+ 		struct v4l2_subdev_format *format)
+ {
+ 	struct tc358743_state *state = to_state(sd);
+-	u8 vi_rep = i2c_rd8(sd, VI_REP);
+ 
+ 	if (format->pad != 0)
+ 		return -EINVAL;
+@@ -1683,23 +1694,7 @@ static int tc358743_get_fmt(struct v4l2_
+ 	format->format.height = state->timings.bt.height;
+ 	format->format.field = V4L2_FIELD_NONE;
+ 
+-	switch (vi_rep & MASK_VOUT_COLOR_SEL) {
+-	case MASK_VOUT_COLOR_RGB_FULL:
+-	case MASK_VOUT_COLOR_RGB_LIMITED:
+-		format->format.colorspace = V4L2_COLORSPACE_SRGB;
+-		break;
+-	case MASK_VOUT_COLOR_601_YCBCR_LIMITED:
+-	case MASK_VOUT_COLOR_601_YCBCR_FULL:
+-		format->format.colorspace = V4L2_COLORSPACE_SMPTE170M;
+-		break;
+-	case MASK_VOUT_COLOR_709_YCBCR_FULL:
+-	case MASK_VOUT_COLOR_709_YCBCR_LIMITED:
+-		format->format.colorspace = V4L2_COLORSPACE_REC709;
+-		break;
+-	default:
+-		format->format.colorspace = 0;
+-		break;
+-	}
++	format->format.colorspace = tc358743_g_colorspace(format->format.code);
+ 
+ 	return 0;
+ }
+@@ -1714,18 +1709,11 @@ static int tc358743_set_fmt(struct v4l2_
+ 	int ret = tc358743_get_fmt(sd, sd_state, format);
+ 
+ 	format->format.code = code;
++	format->format.colorspace = tc358743_g_colorspace(code);
+ 
+ 	if (ret)
+ 		return ret;
+ 
+-	switch (code) {
+-	case MEDIA_BUS_FMT_RGB888_1X24:
+-	case MEDIA_BUS_FMT_UYVY8_1X16:
+-		break;
+-	default:
+-		return -EINVAL;
+-	}
+-
+ 	if (format->which == V4L2_SUBDEV_FORMAT_TRY)
+ 		return 0;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0165-staging-mmal-vchiq-Avoid-use-of-bool-in-structures.patch b/target/linux/bcm27xx/patches-6.1/950-0165-staging-mmal-vchiq-Avoid-use-of-bool-in-structures.patch
new file mode 100644
index 00000000000000..ec5a217c7c78ae
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0165-staging-mmal-vchiq-Avoid-use-of-bool-in-structures.patch
@@ -0,0 +1,24 @@
+From aeb87c00a9efd574ab2a5b6018fc5aa9c97ee912 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Mon, 29 Oct 2018 16:20:46 +0000
+Subject: [PATCH] staging: mmal-vchiq: Avoid use of bool in structures
+
+Fixes up a checkpatch error "Avoid using bool structure members
+because of possible alignment issues".
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+@@ -1773,7 +1773,7 @@ int vchiq_mmal_component_enable(struct v
+ 
+ 	ret = enable_component(instance, component);
+ 	if (ret == 0)
+-		component->enabled = true;
++		component->enabled = 1;
+ 
+ 	mutex_unlock(&instance->vchiq_mutex);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0166-staging-mmal-vchiq-Add-support-for-event-callbacks.patch b/target/linux/bcm27xx/patches-6.1/950-0166-staging-mmal-vchiq-Add-support-for-event-callbacks.patch
new file mode 100644
index 00000000000000..743c757dd53ca8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0166-staging-mmal-vchiq-Add-support-for-event-callbacks.patch
@@ -0,0 +1,356 @@
+From 59b45d61ae062666cb83f4961f5329cbcf3170a3 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Mon, 24 Sep 2018 18:15:38 +0100
+Subject: [PATCH] staging: mmal-vchiq: Add support for event callbacks.
+
+(Preparation for the codec driver).
+The codec uses the event mechanism to report things such as
+resolution changes. It is signalled by the cmd field of the buffer
+being non-zero.
+
+Add support for passing this information out to the client.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ .../vc04_services/vchiq-mmal/mmal-common.h    |   1 +
+ .../vc04_services/vchiq-mmal/mmal-msg.h       |  35 ++++
+ .../vc04_services/vchiq-mmal/mmal-vchiq.c     | 170 ++++++++++++++++--
+ .../vc04_services/vchiq-mmal/mmal-vchiq.h     |   4 +
+ 4 files changed, 196 insertions(+), 14 deletions(-)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
+@@ -50,6 +50,7 @@ struct mmal_buffer {
+ 
+ 	struct mmal_msg_context *msg_context;
+ 
++	u32 cmd;		/* MMAL command. 0=data. */
+ 	unsigned long length;
+ 	u32 mmal_flags;
+ 	s64 dts;
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-msg.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-msg.h
+@@ -346,6 +346,41 @@ struct mmal_msg_port_parameter_get_reply
+ /* event messages */
+ #define MMAL_WORKER_EVENT_SPACE 256
+ 
++/* Four CC's for events */
++#define MMAL_FOURCC(a, b, c, d) ((a) | (b << 8) | (c << 16) | (d << 24))
++
++#define MMAL_EVENT_ERROR		MMAL_FOURCC('E', 'R', 'R', 'O')
++#define MMAL_EVENT_EOS			MMAL_FOURCC('E', 'E', 'O', 'S')
++#define MMAL_EVENT_FORMAT_CHANGED	MMAL_FOURCC('E', 'F', 'C', 'H')
++#define MMAL_EVENT_PARAMETER_CHANGED	MMAL_FOURCC('E', 'P', 'C', 'H')
++
++/* Structs for each of the event message payloads */
++struct mmal_msg_event_eos {
++	u32 port_type;	/**< Type of port that received the end of stream */
++	u32 port_index;	/**< Index of port that received the end of stream */
++};
++
++/** Format changed event data. */
++struct mmal_msg_event_format_changed {
++	/* Minimum size of buffers the port requires */
++	u32 buffer_size_min;
++	/* Minimum number of buffers the port requires */
++	u32 buffer_num_min;
++	/* Size of buffers the port recommends for optimal performance.
++	 * A value of zero means no special recommendation.
++	 */
++	u32 buffer_size_recommended;
++	/* Number of buffers the port recommends for optimal
++	 * performance. A value of zero means no special recommendation.
++	 */
++	u32 buffer_num_recommended;
++
++	u32 es_ptr;
++	struct mmal_es_format format;
++	union mmal_es_specific_format es;
++	u8 extradata[MMAL_FORMAT_EXTRADATA_MAX_SIZE];
++};
++
+ struct mmal_msg_event_to_host {
+ 	u32 client_component;	/* component context */
+ 
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+@@ -143,6 +143,8 @@ struct mmal_msg_context {
+ 			/* Presentation and Decode timestamps */
+ 			s64 pts;
+ 			s64 dts;
++			/* MMAL buffer command flag */
++			u32 cmd;
+ 
+ 			int status;	/* context status */
+ 
+@@ -230,18 +232,6 @@ release_msg_context(struct mmal_msg_cont
+ 	kfree(msg_context);
+ }
+ 
+-/* deals with receipt of event to host message */
+-static void event_to_host_cb(struct vchiq_mmal_instance *instance,
+-			     struct mmal_msg *msg, u32 msg_len)
+-{
+-	pr_debug("unhandled event\n");
+-	pr_debug("component:%u port type:%d num:%d cmd:0x%x length:%d\n",
+-		 msg->u.event_to_host.client_component,
+-		 msg->u.event_to_host.port_type,
+-		 msg->u.event_to_host.port_num,
+-		 msg->u.event_to_host.cmd, msg->u.event_to_host.length);
+-}
+-
+ /* workqueue scheduled callback
+  *
+  * we do this because it is important we do not call any other vchiq
+@@ -263,13 +253,18 @@ static void buffer_work_cb(struct work_s
+ 	buffer->mmal_flags = msg_context->u.bulk.mmal_flags;
+ 	buffer->dts = msg_context->u.bulk.dts;
+ 	buffer->pts = msg_context->u.bulk.pts;
++	buffer->cmd = msg_context->u.bulk.cmd;
+ 
+-	atomic_dec(&msg_context->u.bulk.port->buffers_with_vpu);
++	if (!buffer->cmd)
++		atomic_dec(&msg_context->u.bulk.port->buffers_with_vpu);
+ 
+ 	msg_context->u.bulk.port->buffer_cb(msg_context->u.bulk.instance,
+ 					    msg_context->u.bulk.port,
+ 					    msg_context->u.bulk.status,
+ 					    msg_context->u.bulk.buffer);
++
++	if (buffer->cmd)
++		mutex_unlock(&msg_context->u.bulk.port->event_context_mutex);
+ }
+ 
+ /* workqueue scheduled callback to handle receiving buffers
+@@ -347,6 +342,7 @@ static int bulk_receive(struct vchiq_mma
+ 	msg_context->u.bulk.buffer_used = rd_len;
+ 	msg_context->u.bulk.dts = msg->u.buffer_from_host.buffer_header.dts;
+ 	msg_context->u.bulk.pts = msg->u.buffer_from_host.buffer_header.pts;
++	msg_context->u.bulk.cmd = msg->u.buffer_from_host.buffer_header.cmd;
+ 
+ 	queue_work(msg_context->instance->bulk_wq,
+ 		   &msg_context->u.bulk.buffer_to_host_work);
+@@ -449,6 +445,103 @@ buffer_from_host(struct vchiq_mmal_insta
+ 	return ret;
+ }
+ 
++/* deals with receipt of event to host message */
++static void event_to_host_cb(struct vchiq_mmal_instance *instance,
++			     struct mmal_msg *msg, u32 msg_len)
++{
++	/* FIXME: Not going to work on 64 bit */
++	struct vchiq_mmal_component *component =
++		(struct vchiq_mmal_component *)msg->u.event_to_host.client_component;
++	struct vchiq_mmal_port *port = NULL;
++	struct mmal_msg_context *msg_context;
++	u32 port_num = msg->u.event_to_host.port_num;
++
++	if (msg->u.buffer_from_host.drvbuf.magic == MMAL_MAGIC) {
++		pr_err("%s: MMAL_MSG_TYPE_BUFFER_TO_HOST with bad magic\n",
++		       __func__);
++		return;
++	}
++
++	switch (msg->u.event_to_host.port_type) {
++	case MMAL_PORT_TYPE_CONTROL:
++		if (port_num) {
++			pr_err("%s: port_num of %u >= number of ports 1",
++			       __func__, port_num);
++			return;
++		}
++		port = &component->control;
++		break;
++	case MMAL_PORT_TYPE_INPUT:
++		if (port_num >= component->inputs) {
++			pr_err("%s: port_num of %u >= number of ports %u",
++			       __func__, port_num,
++			       port_num >= component->inputs);
++			return;
++		}
++		port = &component->input[port_num];
++		break;
++	case MMAL_PORT_TYPE_OUTPUT:
++		if (port_num >= component->outputs) {
++			pr_err("%s: port_num of %u >= number of ports %u",
++			       __func__, port_num,
++			       port_num >= component->outputs);
++			return;
++		}
++		port = &component->output[port_num];
++		break;
++	case MMAL_PORT_TYPE_CLOCK:
++		if (port_num >= component->clocks) {
++			pr_err("%s: port_num of %u >= number of ports %u",
++			       __func__, port_num,
++			       port_num >= component->clocks);
++			return;
++		}
++		port = &component->clock[port_num];
++		break;
++	default:
++		break;
++	}
++
++	if (!mutex_trylock(&port->event_context_mutex)) {
++		pr_err("dropping event 0x%x\n", msg->u.event_to_host.cmd);
++		return;
++	}
++	msg_context = port->event_context;
++
++	if (msg->h.status != MMAL_MSG_STATUS_SUCCESS) {
++		/* message reception had an error */
++		//pr_warn
++		pr_err("%s: error %d in reply\n", __func__, msg->h.status);
++
++		msg_context->u.bulk.status = msg->h.status;
++	} else if (msg->u.event_to_host.length > MMAL_WORKER_EVENT_SPACE) {
++		/* data is not in message, queue a bulk receive */
++		pr_err("%s: payload not in message - bulk receive??! NOT SUPPORTED\n",
++		       __func__);
++		msg_context->u.bulk.status = -1;
++	} else {
++		memcpy(msg_context->u.bulk.buffer->buffer,
++		       msg->u.event_to_host.data,
++		       msg->u.event_to_host.length);
++
++		msg_context->u.bulk.buffer_used =
++		    msg->u.event_to_host.length;
++
++		msg_context->u.bulk.mmal_flags = 0;
++		msg_context->u.bulk.dts = MMAL_TIME_UNKNOWN;
++		msg_context->u.bulk.pts = MMAL_TIME_UNKNOWN;
++		msg_context->u.bulk.cmd = msg->u.event_to_host.cmd;
++
++		pr_debug("event component:%u port type:%d num:%d cmd:0x%x length:%d\n",
++			 msg->u.event_to_host.client_component,
++			 msg->u.event_to_host.port_type,
++			 msg->u.event_to_host.port_num,
++			 msg->u.event_to_host.cmd, msg->u.event_to_host.length);
++	}
++
++	schedule_work(&msg_context->u.bulk.work);
++}
++
+ /* deals with receipt of buffer to host message */
+ static void buffer_to_host_cb(struct vchiq_mmal_instance *instance,
+ 			      struct mmal_msg *msg, u32 msg_len)
+@@ -1330,6 +1423,7 @@ static int port_disable(struct vchiq_mma
+ 				mmalbuf->mmal_flags = 0;
+ 				mmalbuf->dts = MMAL_TIME_UNKNOWN;
+ 				mmalbuf->pts = MMAL_TIME_UNKNOWN;
++				mmalbuf->cmd = 0;
+ 				port->buffer_cb(instance,
+ 						port, 0, mmalbuf);
+ 			}
+@@ -1631,6 +1725,43 @@ int mmal_vchi_buffer_cleanup(struct mmal
+ }
+ EXPORT_SYMBOL_GPL(mmal_vchi_buffer_cleanup);
+ 
++static void init_event_context(struct vchiq_mmal_instance *instance,
++			       struct vchiq_mmal_port *port)
++{
++	struct mmal_msg_context *ctx = get_msg_context(instance);
++
++	mutex_init(&port->event_context_mutex);
++
++	port->event_context = ctx;
++	ctx->u.bulk.instance = instance;
++	ctx->u.bulk.port = port;
++	ctx->u.bulk.buffer =
++		kzalloc(sizeof(*ctx->u.bulk.buffer), GFP_KERNEL);
++	if (!ctx->u.bulk.buffer)
++		goto release_msg_context;
++	ctx->u.bulk.buffer->buffer = kzalloc(MMAL_WORKER_EVENT_SPACE,
++					     GFP_KERNEL);
++	if (!ctx->u.bulk.buffer->buffer)
++		goto release_buffer;
++
++	INIT_WORK(&ctx->u.bulk.work, buffer_work_cb);
++	return;
++
++release_buffer:
++	kfree(ctx->u.bulk.buffer);
++release_msg_context:
++	release_msg_context(ctx);
++}
++
++static void free_event_context(struct vchiq_mmal_port *port)
++{
++	struct mmal_msg_context *ctx = port->event_context;
++
++	kfree(ctx->u.bulk.buffer->buffer);
++	kfree(ctx->u.bulk.buffer);
++	release_msg_context(ctx);
++}
++
+ /* Initialise a mmal component and its ports
+  *
+  */
+@@ -1680,6 +1811,7 @@ int vchiq_mmal_component_init(struct vch
+ 	ret = port_info_get(instance, &component->control);
+ 	if (ret < 0)
+ 		goto release_component;
++	init_event_context(instance, &component->control);
+ 
+ 	for (idx = 0; idx < component->inputs; idx++) {
+ 		component->input[idx].type = MMAL_PORT_TYPE_INPUT;
+@@ -1690,6 +1822,7 @@ int vchiq_mmal_component_init(struct vch
+ 		ret = port_info_get(instance, &component->input[idx]);
+ 		if (ret < 0)
+ 			goto release_component;
++		init_event_context(instance, &component->input[idx]);
+ 	}
+ 
+ 	for (idx = 0; idx < component->outputs; idx++) {
+@@ -1701,6 +1834,7 @@ int vchiq_mmal_component_init(struct vch
+ 		ret = port_info_get(instance, &component->output[idx]);
+ 		if (ret < 0)
+ 			goto release_component;
++		init_event_context(instance, &component->output[idx]);
+ 	}
+ 
+ 	for (idx = 0; idx < component->clocks; idx++) {
+@@ -1712,6 +1846,7 @@ int vchiq_mmal_component_init(struct vch
+ 		ret = port_info_get(instance, &component->clock[idx]);
+ 		if (ret < 0)
+ 			goto release_component;
++		init_event_context(instance, &component->clock[idx]);
+ 	}
+ 
+ 	*component_out = component;
+@@ -1737,7 +1872,7 @@ EXPORT_SYMBOL_GPL(vchiq_mmal_component_i
+ int vchiq_mmal_component_finalise(struct vchiq_mmal_instance *instance,
+ 				  struct vchiq_mmal_component *component)
+ {
+-	int ret;
++	int ret, idx;
+ 
+ 	if (mutex_lock_interruptible(&instance->vchiq_mutex))
+ 		return -EINTR;
+@@ -1749,6 +1884,13 @@ int vchiq_mmal_component_finalise(struct
+ 
+ 	component->in_use = 0;
+ 
++	for (idx = 0; idx < component->inputs; idx++)
++		free_event_context(&component->input[idx]);
++	for (idx = 0; idx < component->outputs; idx++)
++		free_event_context(&component->output[idx]);
++	for (idx = 0; idx < component->clocks; idx++)
++		free_event_context(&component->clock[idx]);
++
+ 	mutex_unlock(&instance->vchiq_mutex);
+ 
+ 	return ret;
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
+@@ -79,6 +79,10 @@ struct vchiq_mmal_port {
+ 	vchiq_mmal_buffer_cb buffer_cb;
+ 	/* callback context */
+ 	void *cb_ctx;
++
++	/* ensure serialised use of the one event context structure */
++	struct mutex event_context_mutex;
++	struct mmal_msg_context *event_context;
+ };
+ 
+ struct vchiq_mmal_component {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0167-staging-vc04_services-Support-sending-data-to-MMAL-p.patch b/target/linux/bcm27xx/patches-6.1/950-0167-staging-vc04_services-Support-sending-data-to-MMAL-p.patch
new file mode 100644
index 00000000000000..f8de496461cb3d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0167-staging-vc04_services-Support-sending-data-to-MMAL-p.patch
@@ -0,0 +1,42 @@
+From c2f4b644a80609291b88623dd6f9cbea144cc04f Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Mon, 24 Sep 2018 18:26:02 +0100
+Subject: [PATCH] staging: vc04_services: Support sending data to MMAL
+ ports
+
+Add the ability to send data to ports. This only supports
+zero copy mode as the required bulk transfer setup calls
+are not done.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ .../vc04_services/vchiq-mmal/mmal-vchiq.c      | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+@@ -419,11 +419,19 @@ buffer_from_host(struct vchiq_mmal_insta
+ 	m.u.buffer_from_host.buffer_header.data =
+ 		(u32)(unsigned long)buf->buffer;
+ 	m.u.buffer_from_host.buffer_header.alloc_size = buf->buffer_size;
+-	m.u.buffer_from_host.buffer_header.length = 0;	/* nothing used yet */
+-	m.u.buffer_from_host.buffer_header.offset = 0;	/* no offset */
+-	m.u.buffer_from_host.buffer_header.flags = 0;	/* no flags */
+-	m.u.buffer_from_host.buffer_header.pts = MMAL_TIME_UNKNOWN;
+-	m.u.buffer_from_host.buffer_header.dts = MMAL_TIME_UNKNOWN;
++	if (port->type == MMAL_PORT_TYPE_OUTPUT) {
++		m.u.buffer_from_host.buffer_header.length = 0;
++		m.u.buffer_from_host.buffer_header.offset = 0;
++		m.u.buffer_from_host.buffer_header.flags = 0;
++		m.u.buffer_from_host.buffer_header.pts = MMAL_TIME_UNKNOWN;
++		m.u.buffer_from_host.buffer_header.dts = MMAL_TIME_UNKNOWN;
++	} else {
++		m.u.buffer_from_host.buffer_header.length = buf->length;
++		m.u.buffer_from_host.buffer_header.offset = 0;
++		m.u.buffer_from_host.buffer_header.flags = buf->mmal_flags;
++		m.u.buffer_from_host.buffer_header.pts = buf->pts;
++		m.u.buffer_from_host.buffer_header.dts = buf->dts;
++	}
+ 
+ 	/* clear buffer type specific data */
+ 	memset(&m.u.buffer_from_host.buffer_header_type_specific, 0,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0168-media-videobuf2-Allow-exporting-of-a-struct-dmabuf.patch b/target/linux/bcm27xx/patches-6.1/950-0168-media-videobuf2-Allow-exporting-of-a-struct-dmabuf.patch
new file mode 100644
index 00000000000000..88bc3311d73802
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0168-media-videobuf2-Allow-exporting-of-a-struct-dmabuf.patch
@@ -0,0 +1,83 @@
+From c0d0da9ddae434d913a617c643434a33424002c2 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Mon, 29 Oct 2018 17:57:45 +0000
+Subject: [PATCH] media: videobuf2: Allow exporting of a struct dmabuf
+
+videobuf2 only allowed exporting a dmabuf as a file descriptor,
+but there are instances where having the struct dma_buf is
+useful within the kernel.
+
+Split the current implementation into two, one step which
+exports a struct dma_buf, and the second which converts that
+into an fd.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ .../media/common/videobuf2/videobuf2-core.c   | 21 ++++++++++++++++---
+ include/media/videobuf2-core.h                | 15 +++++++++++++
+ 2 files changed, 33 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/common/videobuf2/videobuf2-core.c
++++ b/drivers/media/common/videobuf2/videobuf2-core.c
+@@ -2235,12 +2235,12 @@ static int __find_plane_by_offset(struct
+ 	return -EINVAL;
+ }
+ 
+-int vb2_core_expbuf(struct vb2_queue *q, int *fd, unsigned int type,
+-		unsigned int index, unsigned int plane, unsigned int flags)
++int vb2_core_expbuf_dmabuf(struct vb2_queue *q, unsigned int type,
++			   unsigned int index, unsigned int plane,
++			   unsigned int flags, struct dma_buf **dmabuf)
+ {
+ 	struct vb2_buffer *vb = NULL;
+ 	struct vb2_plane *vb_plane;
+-	int ret;
+ 	struct dma_buf *dbuf;
+ 
+ 	if (q->memory != VB2_MEMORY_MMAP) {
+@@ -2292,6 +2292,21 @@ int vb2_core_expbuf(struct vb2_queue *q,
+ 		return -EINVAL;
+ 	}
+ 
++	*dmabuf = dbuf;
++	return 0;
++}
++EXPORT_SYMBOL_GPL(vb2_core_expbuf_dmabuf);
++
++int vb2_core_expbuf(struct vb2_queue *q, int *fd, unsigned int type,
++		    unsigned int index, unsigned int plane, unsigned int flags)
++{
++	struct dma_buf *dbuf;
++	int ret;
++
++	ret = vb2_core_expbuf_dmabuf(q, type, index, plane, flags, &dbuf);
++	if (ret)
++		return ret;
++
+ 	ret = dma_buf_fd(dbuf, flags & ~O_ACCMODE);
+ 	if (ret < 0) {
+ 		dprintk(q, 3, "buffer %d, plane %d failed to export (%d)\n",
+--- a/include/media/videobuf2-core.h
++++ b/include/media/videobuf2-core.h
+@@ -912,6 +912,21 @@ int vb2_core_streamon(struct vb2_queue *
+ int vb2_core_streamoff(struct vb2_queue *q, unsigned int type);
+ 
+ /**
++ * vb2_core_expbuf_dmabuf() - Export a buffer as a dma_buf structure
++ * @q:         videobuf2 queue
++ * @type:      buffer type
++ * @index:     id number of the buffer
++ * @plane:     index of the plane to be exported, 0 for single plane queues
++ * @flags:     flags for newly created file, currently only O_CLOEXEC is
++ *             supported, refer to manual of open syscall for more details
++ * @dmabuf:    Returns the dmabuf pointer
++ *
++ */
++int vb2_core_expbuf_dmabuf(struct vb2_queue *q, unsigned int type,
++			   unsigned int index, unsigned int plane,
++			   unsigned int flags, struct dma_buf **dmabuf);
++
++/**
+  * vb2_core_expbuf() - Export a buffer as a file descriptor.
+  * @q:		pointer to &struct vb2_queue with videobuf2 queue.
+  * @fd:		pointer to the file descriptor associated with DMABUF
diff --git a/target/linux/bcm27xx/patches-6.1/950-0169-staging-mmal-vchiq-Fix-client_component-for-64-bit-k.patch b/target/linux/bcm27xx/patches-6.1/950-0169-staging-mmal-vchiq-Fix-client_component-for-64-bit-k.patch
new file mode 100644
index 00000000000000..f6cea719f1a643
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0169-staging-mmal-vchiq-Fix-client_component-for-64-bit-k.patch
@@ -0,0 +1,35 @@
+From 8ab562e10d304fb88a56a748d081dbf8fb07c528 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Tue, 22 Jan 2019 12:04:09 +0000
+Subject: [PATCH] staging: mmal-vchiq: Fix client_component for 64 bit
+ kernel
+
+The MMAL client_component field is used with the event
+mechanism to allow the client to identify the component for
+which the event is generated.
+The field is only 32bits in size, therefore we can't use a
+pointer to the component in a 64 bit kernel.
+
+Component handles are already held in an array per VCHI
+instance, so use the array index as the client_component handle
+to avoid having to create a new IDR for this purpose.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+@@ -457,9 +457,9 @@ buffer_from_host(struct vchiq_mmal_insta
+ static void event_to_host_cb(struct vchiq_mmal_instance *instance,
+ 			     struct mmal_msg *msg, u32 msg_len)
+ {
+-	/* FIXME: Not going to work on 64 bit */
++	int comp_idx = msg->u.event_to_host.client_component;
+ 	struct vchiq_mmal_component *component =
+-		(struct vchiq_mmal_component *)msg->u.event_to_host.client_component;
++					&instance->component[comp_idx];
+ 	struct vchiq_mmal_port *port = NULL;
+ 	struct mmal_msg_context *msg_context;
+ 	u32 port_num = msg->u.event_to_host.port_num;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0170-staging-mmal_vchiq-Add-in-the-Bayer-encoding-formats.patch b/target/linux/bcm27xx/patches-6.1/950-0170-staging-mmal_vchiq-Add-in-the-Bayer-encoding-formats.patch
new file mode 100644
index 00000000000000..db68c541119d9a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0170-staging-mmal_vchiq-Add-in-the-Bayer-encoding-formats.patch
@@ -0,0 +1,51 @@
+From 0274e5c9aa788d3f7b38e6f6424ae7f74e2d0cfc Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 13 Feb 2019 12:33:29 +0000
+Subject: [PATCH] staging: mmal_vchiq: Add in the Bayer encoding
+ formats
+
+The list of formats was copied before Bayer support was added.
+The ISP supports Bayer and is being supported by the bcm2835_codec
+driver, so add in the encodings for them.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ .../vc04_services/vchiq-mmal/mmal-encodings.h | 27 +++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
+@@ -69,6 +69,33 @@
+  */
+ #define MMAL_ENCODING_OPAQUE           MMAL_FOURCC('O', 'P', 'Q', 'V')
+ 
++/* Bayer formats
++ * FourCC values copied from V4L2 where defined.
++ */
++/* 8 bit per pixel Bayer formats. */
++#define MMAL_ENCODING_BAYER_SBGGR8     MMAL_FOURCC('B', 'A', '8', '1')
++#define MMAL_ENCODING_BAYER_SGBRG8     MMAL_FOURCC('G', 'B', 'R', 'G')
++#define MMAL_ENCODING_BAYER_SGRBG8     MMAL_FOURCC('G', 'R', 'B', 'G')
++#define MMAL_ENCODING_BAYER_SRGGB8     MMAL_FOURCC('R', 'G', 'G', 'B')
++
++/* 10 bit per pixel packed Bayer formats. */
++#define MMAL_ENCODING_BAYER_SBGGR10P   MMAL_FOURCC('p', 'B', 'A', 'A')
++#define MMAL_ENCODING_BAYER_SGRBG10P   MMAL_FOURCC('p', 'g', 'A', 'A')
++#define MMAL_ENCODING_BAYER_SGBRG10P   MMAL_FOURCC('p', 'G', 'A', 'A')
++#define MMAL_ENCODING_BAYER_SRGGB10P   MMAL_FOURCC('p', 'R', 'A', 'A')
++
++/* 12 bit per pixel packed Bayer formats. */
++#define MMAL_ENCODING_BAYER_SBGGR12P   MMAL_FOURCC('p', 'B', '1', '2')
++#define MMAL_ENCODING_BAYER_SGRBG12P   MMAL_FOURCC('p', 'g', '1', '2')
++#define MMAL_ENCODING_BAYER_SGBRG12P   MMAL_FOURCC('p', 'G', '1', '2')
++#define MMAL_ENCODING_BAYER_SRGGB12P   MMAL_FOURCC('p', 'R', '1', '2')
++
++/* 16 bit per pixel Bayer formats. */
++#define MMAL_ENCODING_BAYER_SBGGR16    MMAL_FOURCC('B', 'G', '1', '6')
++#define MMAL_ENCODING_BAYER_SGBRG16    MMAL_FOURCC('G', 'B', '1', '6')
++#define MMAL_ENCODING_BAYER_SGRBG16    MMAL_FOURCC('G', 'R', '1', '6')
++#define MMAL_ENCODING_BAYER_SRGGB16    MMAL_FOURCC('R', 'G', '1', '6')
++
+ /** An EGL image handle
+  */
+ #define MMAL_ENCODING_EGL_IMAGE        MMAL_FOURCC('E', 'G', 'L', 'I')
diff --git a/target/linux/bcm27xx/patches-6.1/950-0171-staging-mmal-vchiq-Update-mmal_parameters.h-with-rec.patch b/target/linux/bcm27xx/patches-6.1/950-0171-staging-mmal-vchiq-Update-mmal_parameters.h-with-rec.patch
new file mode 100644
index 00000000000000..1d35dfef689196
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0171-staging-mmal-vchiq-Update-mmal_parameters.h-with-rec.patch
@@ -0,0 +1,56 @@
+From 767d43808d7fdf21896de50b38216d8884ca9f35 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Mon, 18 Feb 2019 15:52:29 +0000
+Subject: [PATCH] staging: mmal-vchiq: Update mmal_parameters.h with
+ recently defined params
+
+mmal_parameters.h hasn't been updated to reflect additions made
+over the last few years. Update it to reflect the currently
+supported parameters.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ .../vchiq-mmal/mmal-parameters.h              | 32 ++++++++++++++++++-
+ 1 file changed, 31 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
+@@ -577,7 +577,37 @@ enum mmal_parameter_video_type {
+ 	MMAL_PARAMETER_VIDEO_ENCODE_H264_LOW_DELAY_HRD_FLAG,
+ 
+ 	/**< @ref MMAL_PARAMETER_BOOLEAN_T */
+-	MMAL_PARAMETER_VIDEO_ENCODE_INLINE_HEADER
++	MMAL_PARAMETER_VIDEO_ENCODE_INLINE_HEADER,
++
++	/**< Take a @ref MMAL_PARAMETER_BOOLEAN_T. */
++	MMAL_PARAMETER_VIDEO_ENCODE_SEI_ENABLE,
++
++	/**< Take a @ref MMAL_PARAMETER_BOOLEAN_T. */
++	MMAL_PARAMETER_VIDEO_ENCODE_INLINE_VECTORS,
++
++	/**< Take a @ref MMAL_PARAMETER_VIDEO_RENDER_STATS_T. */
++	MMAL_PARAMETER_VIDEO_RENDER_STATS,
++
++	/**< Take a @ref MMAL_PARAMETER_VIDEO_INTERLACE_TYPE_T. */
++	MMAL_PARAMETER_VIDEO_INTERLACE_TYPE,
++
++	/**< Takes a @ref MMAL_PARAMETER_BOOLEAN_T */
++	MMAL_PARAMETER_VIDEO_INTERPOLATE_TIMESTAMPS,
++
++	/**< Takes a @ref MMAL_PARAMETER_BOOLEAN_T */
++	MMAL_PARAMETER_VIDEO_ENCODE_SPS_TIMING,
++
++	/**< Takes a @ref MMAL_PARAMETER_UINT32_T */
++	MMAL_PARAMETER_VIDEO_MAX_NUM_CALLBACKS,
++
++	/**< Takes a @ref MMAL_PARAMETER_SOURCE_PATTERN_T */
++	MMAL_PARAMETER_VIDEO_SOURCE_PATTERN,
++
++	/**< Takes a @ref MMAL_PARAMETER_BOOLEAN_T */
++	MMAL_PARAMETER_VIDEO_ENCODE_SEPARATE_NAL_BUFS,
++
++	/**< Takes a @ref MMAL_PARAMETER_UINT32_T */
++	MMAL_PARAMETER_VIDEO_DROPPABLE_PFRAME_LENGTH,
+ };
+ 
+ /** Valid mirror modes */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0172-staging-mmal-vchiq-Free-the-event-context-for-contro.patch b/target/linux/bcm27xx/patches-6.1/950-0172-staging-mmal-vchiq-Free-the-event-context-for-contro.patch
new file mode 100644
index 00000000000000..02b8ed94117846
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0172-staging-mmal-vchiq-Free-the-event-context-for-contro.patch
@@ -0,0 +1,28 @@
+From 65903c4bd59e980da1a54422b1aa2387a7a8e802 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 1 May 2019 13:27:23 +0100
+Subject: [PATCH] staging: mmal-vchiq: Free the event context for
+ control ports
+
+vchiq_mmal_component_init calls init_event_context for the
+control port, but vchiq_mmal_component_finalise didn't free
+it, causing a memory leak..
+
+Add the free call.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+@@ -1899,6 +1899,8 @@ int vchiq_mmal_component_finalise(struct
+ 	for (idx = 0; idx < component->clocks; idx++)
+ 		free_event_context(&component->clock[idx]);
+ 
++	free_event_context(&component->control);
++
+ 	mutex_unlock(&instance->vchiq_mutex);
+ 
+ 	return ret;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0173-staging-mmal-vchiq-Fix-memory-leak-in-error-path.patch b/target/linux/bcm27xx/patches-6.1/950-0173-staging-mmal-vchiq-Fix-memory-leak-in-error-path.patch
new file mode 100644
index 00000000000000..6582bcceba6216
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0173-staging-mmal-vchiq-Fix-memory-leak-in-error-path.patch
@@ -0,0 +1,76 @@
+From 36fa884a872037d03ea7449922665f16056ae94d Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Thu, 2 May 2019 15:50:01 +0100
+Subject: [PATCH] staging: mmal-vchiq: Fix memory leak in error path
+
+On error, vchiq_mmal_component_init could leave the
+event context allocated for ports.
+Clean them up in the error path.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ .../vc04_services/vchiq-mmal/mmal-vchiq.c     | 29 +++++++++++++------
+ 1 file changed, 20 insertions(+), 9 deletions(-)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+@@ -1765,9 +1765,26 @@ static void free_event_context(struct vc
+ {
+ 	struct mmal_msg_context *ctx = port->event_context;
+ 
++	if (!ctx)
++		return;
++
+ 	kfree(ctx->u.bulk.buffer->buffer);
+ 	kfree(ctx->u.bulk.buffer);
+ 	release_msg_context(ctx);
++	port->event_context = NULL;
++}
++
++static void release_all_event_contexts(struct vchiq_mmal_component *component)
++{
++	int idx;
++
++	for (idx = 0; idx < component->inputs; idx++)
++		free_event_context(&component->input[idx]);
++	for (idx = 0; idx < component->outputs; idx++)
++		free_event_context(&component->output[idx]);
++	for (idx = 0; idx < component->clocks; idx++)
++		free_event_context(&component->clock[idx]);
++	free_event_context(&component->control);
+ }
+ 
+ /* Initialise a mmal component and its ports
+@@ -1865,6 +1882,7 @@ int vchiq_mmal_component_init(struct vch
+ 
+ release_component:
+ 	destroy_component(instance, component);
++	release_all_event_contexts(component);
+ unlock:
+ 	if (component)
+ 		component->in_use = 0;
+@@ -1880,7 +1898,7 @@ EXPORT_SYMBOL_GPL(vchiq_mmal_component_i
+ int vchiq_mmal_component_finalise(struct vchiq_mmal_instance *instance,
+ 				  struct vchiq_mmal_component *component)
+ {
+-	int ret, idx;
++	int ret;
+ 
+ 	if (mutex_lock_interruptible(&instance->vchiq_mutex))
+ 		return -EINTR;
+@@ -1892,14 +1910,7 @@ int vchiq_mmal_component_finalise(struct
+ 
+ 	component->in_use = 0;
+ 
+-	for (idx = 0; idx < component->inputs; idx++)
+-		free_event_context(&component->input[idx]);
+-	for (idx = 0; idx < component->outputs; idx++)
+-		free_event_context(&component->output[idx]);
+-	for (idx = 0; idx < component->clocks; idx++)
+-		free_event_context(&component->clock[idx]);
+-
+-	free_event_context(&component->control);
++	release_all_event_contexts(component);
+ 
+ 	mutex_unlock(&instance->vchiq_mutex);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0174-w1-w1-gpio-Make-GPIO-an-output-for-strong-pullup.patch b/target/linux/bcm27xx/patches-6.1/950-0174-w1-w1-gpio-Make-GPIO-an-output-for-strong-pullup.patch
new file mode 100644
index 00000000000000..e45b1830df67cc
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0174-w1-w1-gpio-Make-GPIO-an-output-for-strong-pullup.patch
@@ -0,0 +1,27 @@
+From f9d94295b64a50f3268dcf6b32e45f8b899f806e Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Wed, 12 Jun 2019 17:15:05 +0100
+Subject: [PATCH] w1: w1-gpio: Make GPIO an output for strong pullup
+
+The logic to drive the data line high to implement a strong pullup
+assumed that the pin was already an output - setting a value does
+not change an input.
+
+See: https://github.com/raspberrypi/firmware/issues/1143
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/w1/masters/w1-gpio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/w1/masters/w1-gpio.c
++++ b/drivers/w1/masters/w1-gpio.c
+@@ -30,7 +30,7 @@ static u8 w1_gpio_set_pullup(void *data,
+ 			 * This will OVERRIDE open drain emulation and force-pull
+ 			 * the line high for some time.
+ 			 */
+-			gpiod_set_raw_value(pdata->gpiod, 1);
++			gpiod_direction_output_raw(pdata->gpiod, 1);
+ 			msleep(pdata->pullup_duration);
+ 			/*
+ 			 * This will simply set the line as input since we are doing
diff --git a/target/linux/bcm27xx/patches-6.1/950-0175-arm-bcm2835-Fix-FIQ-early-ioremap.patch b/target/linux/bcm27xx/patches-6.1/950-0175-arm-bcm2835-Fix-FIQ-early-ioremap.patch
new file mode 100644
index 00000000000000..0cbbbd53280bfa
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0175-arm-bcm2835-Fix-FIQ-early-ioremap.patch
@@ -0,0 +1,73 @@
+From 72d80a2d3fff7bfdab235a67b3a6e154505d789f Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Wed, 20 Feb 2019 08:49:39 +0000
+Subject: [PATCH] arm: bcm2835: Fix FIQ early ioremap
+
+The ioremapping creates mappings within the vmalloc area. The
+equivalent early function, create_mapping, now checks that the
+requested explicit virtual address is between VMALLOC_START and
+VMALLOC_END. As there is no reason to have any correlation between
+the physical and virtual addresses, put the required mappings at
+VMALLOC_START and above.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ arch/arm/mach-bcm/board_bcm2835.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+--- a/arch/arm/mach-bcm/board_bcm2835.c
++++ b/arch/arm/mach-bcm/board_bcm2835.c
+@@ -5,17 +5,20 @@
+ 
+ #include <linux/init.h>
+ #include <linux/irqchip.h>
++#include <linux/mm.h>
+ #include <linux/of_address.h>
+ #include <linux/of_fdt.h>
+ #include <asm/system_info.h>
+ 
+ #include <asm/mach/arch.h>
+ #include <asm/mach/map.h>
++#include <asm/memory.h>
++#include <asm/pgtable.h>
+ 
+ #include "platsmp.h"
+ 
+-#define BCM2835_USB_VIRT_BASE   0xf0980000
+-#define BCM2835_USB_VIRT_MPHI   0xf0006000
++#define BCM2835_USB_VIRT_BASE   (VMALLOC_START)
++#define BCM2835_USB_VIRT_MPHI   (VMALLOC_START + 0x10000)
+ 
+ static void __init bcm2835_init(void)
+ {
+@@ -74,20 +77,26 @@ static int __init bcm2835_map_usb(unsign
+ 
+ static void __init bcm2835_map_io(void)
+ {
+-	const __be32 *ranges;
++	const __be32 *ranges, *address_cells;
++	unsigned long root, addr_cells;
+ 	int soc, len;
+ 	unsigned long p2b_offset;
+ 
+ 	debug_ll_io_init();
+ 
++	root = of_get_flat_dt_root();
+ 	/* Find out how to map bus to physical address first from soc/ranges */
+-	soc = of_get_flat_dt_subnode_by_name(of_get_flat_dt_root(), "soc");
++	soc = of_get_flat_dt_subnode_by_name(root, "soc");
+ 	if (soc < 0)
+ 		return;
++	address_cells = of_get_flat_dt_prop(root, "#address-cells", &len);
++	if (!address_cells || len < (sizeof(unsigned long)))
++		return;
++	addr_cells = be32_to_cpu(address_cells[0]);
+ 	ranges = of_get_flat_dt_prop(soc, "ranges", &len);
+-	if (!ranges || len < (sizeof(unsigned long) * 3))
++	if (!ranges || len < (sizeof(unsigned long) * (2 + addr_cells)))
+ 		return;
+-	p2b_offset = be32_to_cpu(ranges[0]) - be32_to_cpu(ranges[1]);
++	p2b_offset = be32_to_cpu(ranges[0]) - be32_to_cpu(ranges[addr_cells]);
+ 
+ 	/* Now search for bcm2708-usb node in device tree */
+ 	of_scan_flat_dt(bcm2835_map_usb, &p2b_offset);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0176-arm-bcm2835-DMA-can-only-address-1GB.patch b/target/linux/bcm27xx/patches-6.1/950-0176-arm-bcm2835-DMA-can-only-address-1GB.patch
new file mode 100644
index 00000000000000..593b9a620551a9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0176-arm-bcm2835-DMA-can-only-address-1GB.patch
@@ -0,0 +1,25 @@
+From e1b03f05a0c6ab0ab1d166851cd835a5715a0cbc Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Wed, 29 May 2019 15:47:42 +0100
+Subject: [PATCH] arm: bcm2835: DMA can only address 1GB
+
+The legacy peripherals can only address the first gigabyte of RAM, so
+ensure that DMA allocations are restricted to that region.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ arch/arm/mach-bcm/board_bcm2835.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/arm/mach-bcm/board_bcm2835.c
++++ b/arch/arm/mach-bcm/board_bcm2835.c
+@@ -114,6 +114,9 @@ static const char * const bcm2835_compat
+ };
+ 
+ DT_MACHINE_START(BCM2835, "BCM2835")
++#if defined(CONFIG_ZONE_DMA) && defined(CONFIG_ARM_LPAE)
++	.dma_zone_size	= SZ_1G,
++#endif
+ 	.map_io = bcm2835_map_io,
+ 	.init_machine = bcm2835_init,
+ 	.dt_compat = bcm2835_compat,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0177-hwrng-iproc-rng200-Add-BCM2838-support.patch b/target/linux/bcm27xx/patches-6.1/950-0177-hwrng-iproc-rng200-Add-BCM2838-support.patch
new file mode 100644
index 00000000000000..89b7fabe2a700e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0177-hwrng-iproc-rng200-Add-BCM2838-support.patch
@@ -0,0 +1,153 @@
+From b642f64d629df5515f3a01fc5b2e17c3fa7b404c Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <wahrenst@gmx.net>
+Date: Sat, 4 May 2019 17:06:15 +0200
+Subject: [PATCH] hwrng: iproc-rng200: Add BCM2838 support
+
+The HWRNG on the BCM2838 is compatible to iproc-rng200, so add the
+support to this driver instead of bcm2835-rng.
+
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+
+hwrng: iproc-rng200: Correct SoC name
+
+The Pi 4 SoC is called BCM2711, not BCM2838.
+
+Fixes: "hwrng: iproc-rng200: Add BCM2838 support"
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/char/hw_random/Kconfig        |  2 +-
+ drivers/char/hw_random/iproc-rng200.c | 78 +++++++++++++++++++++++++--
+ 2 files changed, 76 insertions(+), 4 deletions(-)
+
+--- a/drivers/char/hw_random/Kconfig
++++ b/drivers/char/hw_random/Kconfig
+@@ -104,7 +104,7 @@ config HW_RANDOM_IPROC_RNG200
+ 	default HW_RANDOM
+ 	help
+ 	  This driver provides kernel-side support for the RNG200
+-	  hardware found on the Broadcom iProc and STB SoCs.
++	  hardware found on the Broadcom iProc, BCM2711 and STB SoCs.
+ 
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called iproc-rng200
+--- a/drivers/char/hw_random/iproc-rng200.c
++++ b/drivers/char/hw_random/iproc-rng200.c
+@@ -21,6 +21,7 @@
+ #define RNG_CTRL_OFFSET					0x00
+ #define RNG_CTRL_RNG_RBGEN_MASK				0x00001FFF
+ #define RNG_CTRL_RNG_RBGEN_ENABLE			0x00000001
++#define RNG_CTRL_RNG_DIV_CTRL_SHIFT			13
+ 
+ #define RNG_SOFT_RESET_OFFSET				0x04
+ #define RNG_SOFT_RESET					0x00000001
+@@ -28,16 +29,23 @@
+ #define RBG_SOFT_RESET_OFFSET				0x08
+ #define RBG_SOFT_RESET					0x00000001
+ 
++#define RNG_TOTAL_BIT_COUNT_OFFSET			0x0C
++
++#define RNG_TOTAL_BIT_COUNT_THRESHOLD_OFFSET		0x10
++
+ #define RNG_INT_STATUS_OFFSET				0x18
+ #define RNG_INT_STATUS_MASTER_FAIL_LOCKOUT_IRQ_MASK	0x80000000
+ #define RNG_INT_STATUS_STARTUP_TRANSITIONS_MET_IRQ_MASK	0x00020000
+ #define RNG_INT_STATUS_NIST_FAIL_IRQ_MASK		0x00000020
+ #define RNG_INT_STATUS_TOTAL_BITS_COUNT_IRQ_MASK	0x00000001
+ 
++#define RNG_INT_ENABLE_OFFSET				0x1C
++
+ #define RNG_FIFO_DATA_OFFSET				0x20
+ 
+ #define RNG_FIFO_COUNT_OFFSET				0x24
+ #define RNG_FIFO_COUNT_RNG_FIFO_COUNT_MASK		0x000000FF
++#define RNG_FIFO_COUNT_RNG_FIFO_THRESHOLD_SHIFT		8
+ 
+ struct iproc_rng200_dev {
+ 	struct hwrng rng;
+@@ -158,6 +166,64 @@ static int iproc_rng200_init(struct hwrn
+ 	return 0;
+ }
+ 
++static int bcm2711_rng200_read(struct hwrng *rng, void *buf, size_t max,
++			       bool wait)
++{
++	struct iproc_rng200_dev *priv = to_rng_priv(rng);
++	u32 max_words = max / sizeof(u32);
++	u32 num_words, count, val;
++
++	/* ensure warm up period has elapsed */
++	while (1) {
++		val = ioread32(priv->base + RNG_TOTAL_BIT_COUNT_OFFSET);
++		if (val > 16)
++			break;
++		cpu_relax();
++	}
++
++	/* ensure fifo is not empty */
++	while (1) {
++		num_words = ioread32(priv->base + RNG_FIFO_COUNT_OFFSET) &
++			    RNG_FIFO_COUNT_RNG_FIFO_COUNT_MASK;
++		if (num_words)
++			break;
++		if (!wait)
++			return 0;
++		cpu_relax();
++	}
++
++	if (num_words > max_words)
++		num_words = max_words;
++
++	for (count = 0; count < num_words; count++) {
++		((u32 *)buf)[count] = ioread32(priv->base +
++					       RNG_FIFO_DATA_OFFSET);
++	}
++
++	return num_words * sizeof(u32);
++}
++
++static int bcm2711_rng200_init(struct hwrng *rng)
++{
++	struct iproc_rng200_dev *priv = to_rng_priv(rng);
++	uint32_t val;
++
++	if (ioread32(priv->base + RNG_CTRL_OFFSET) & RNG_CTRL_RNG_RBGEN_MASK)
++		return 0;
++
++	/* initial numbers generated are "less random" so will be discarded */
++	val = 0x40000;
++	iowrite32(val, priv->base + RNG_TOTAL_BIT_COUNT_THRESHOLD_OFFSET);
++	/* min fifo count to generate full interrupt */
++	val = 2 << RNG_FIFO_COUNT_RNG_FIFO_THRESHOLD_SHIFT;
++	iowrite32(val, priv->base + RNG_FIFO_COUNT_OFFSET);
++	/* enable the rng - 1Mhz sample rate */
++	val = (0x3 << RNG_CTRL_RNG_DIV_CTRL_SHIFT) | RNG_CTRL_RNG_RBGEN_MASK;
++	iowrite32(val, priv->base + RNG_CTRL_OFFSET);
++
++	return 0;
++}
++
+ static void iproc_rng200_cleanup(struct hwrng *rng)
+ {
+ 	struct iproc_rng200_dev *priv = to_rng_priv(rng);
+@@ -182,11 +248,17 @@ static int iproc_rng200_probe(struct pla
+ 		return PTR_ERR(priv->base);
+ 	}
+ 
+-	priv->rng.name = "iproc-rng200";
+-	priv->rng.read = iproc_rng200_read;
+-	priv->rng.init = iproc_rng200_init;
++	priv->rng.name = pdev->name;
+ 	priv->rng.cleanup = iproc_rng200_cleanup;
+ 
++	if (of_device_is_compatible(dev->of_node, "brcm,bcm2711-rng200")) {
++		priv->rng.init = bcm2711_rng200_init;
++		priv->rng.read = bcm2711_rng200_read;
++	} else {
++		priv->rng.init = iproc_rng200_init;
++		priv->rng.read = iproc_rng200_read;
++	}
++
+ 	/* Register driver */
+ 	ret = devm_hwrng_register(dev, &priv->rng);
+ 	if (ret) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0178-bcmgenet-constrain-max-DMA-burst-length.patch b/target/linux/bcm27xx/patches-6.1/950-0178-bcmgenet-constrain-max-DMA-burst-length.patch
new file mode 100644
index 00000000000000..a31c73ca06259e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0178-bcmgenet-constrain-max-DMA-burst-length.patch
@@ -0,0 +1,20 @@
+From 0c8e8bcb652acd3ddafda7f77564c5eb19ff0ccc Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.org>
+Date: Wed, 12 Sep 2018 14:44:53 +0100
+Subject: [PATCH] bcmgenet: constrain max DMA burst length
+
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+@@ -31,7 +31,7 @@
+ #define ENET_PAD		8
+ #define ENET_MAX_MTU_SIZE	(ETH_DATA_LEN + ETH_HLEN + VLAN_HLEN + \
+ 				 ENET_BRCM_TAG_LEN + ETH_FCS_LEN + ENET_PAD)
+-#define DMA_MAX_BURST_LENGTH    0x10
++#define DMA_MAX_BURST_LENGTH    0x08
+ 
+ /* misc. configuration */
+ #define MAX_NUM_OF_FS_RULES		16
diff --git a/target/linux/bcm27xx/patches-6.1/950-0179-bcmgenet-Better-coalescing-parameter-defaults.patch b/target/linux/bcm27xx/patches-6.1/950-0179-bcmgenet-Better-coalescing-parameter-defaults.patch
new file mode 100644
index 00000000000000..4fc97de5446034
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0179-bcmgenet-Better-coalescing-parameter-defaults.patch
@@ -0,0 +1,43 @@
+From 8673f9820e4fad1c54f9e46f6a275170544c1963 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Wed, 27 Mar 2019 13:45:46 +0000
+Subject: [PATCH] bcmgenet: Better coalescing parameter defaults
+
+Set defaults for TX and RX packet coalescing to be equivalent to:
+
+  # ethtool -C eth0 tx-frames 10
+  # ethtool -C eth0 rx-usecs 50
+
+This may be something we want to set via DT parameters in the
+future.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -2657,7 +2657,7 @@ static void bcmgenet_init_tx_ring(struct
+ 
+ 	bcmgenet_tdma_ring_writel(priv, index, 0, TDMA_PROD_INDEX);
+ 	bcmgenet_tdma_ring_writel(priv, index, 0, TDMA_CONS_INDEX);
+-	bcmgenet_tdma_ring_writel(priv, index, 1, DMA_MBUF_DONE_THRESH);
++	bcmgenet_tdma_ring_writel(priv, index, 10, DMA_MBUF_DONE_THRESH);
+ 	/* Disable rate control for now */
+ 	bcmgenet_tdma_ring_writel(priv, index, flow_period_val,
+ 				  TDMA_FLOW_PERIOD);
+@@ -4138,9 +4138,12 @@ static int bcmgenet_probe(struct platfor
+ 	netif_set_real_num_rx_queues(priv->dev, priv->hw_params->rx_queues + 1);
+ 
+ 	/* Set default coalescing parameters */
+-	for (i = 0; i < priv->hw_params->rx_queues; i++)
++	for (i = 0; i < priv->hw_params->rx_queues; i++) {
+ 		priv->rx_rings[i].rx_max_coalesced_frames = 1;
++		priv->rx_rings[i].rx_coalesce_usecs = 50;
++	}
+ 	priv->rx_rings[DESC_INDEX].rx_max_coalesced_frames = 1;
++	priv->rx_rings[DESC_INDEX].rx_coalesce_usecs = 50;
+ 
+ 	/* libphy will determine the link state */
+ 	netif_carrier_off(dev);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0180-net-genet-enable-link-energy-detect-powerdown-for-ex.patch b/target/linux/bcm27xx/patches-6.1/950-0180-net-genet-enable-link-energy-detect-powerdown-for-ex.patch
new file mode 100644
index 00000000000000..cc76ba5db92a20
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0180-net-genet-enable-link-energy-detect-powerdown-for-ex.patch
@@ -0,0 +1,31 @@
+From 5a4c1a747f378723154f2c0cc563aaff3d4d43f8 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.org>
+Date: Tue, 14 May 2019 17:17:59 +0100
+Subject: [PATCH] net: genet: enable link energy detect powerdown for
+ external PHYs
+
+There are several warts surrounding bcmgenet_mii_probe() as this
+function is called from ndo_open, but it's calling registration-type
+functions. The probe should be called at probe time and refactored
+such that the PHY device data can be extracted to limit the scope
+of this flag to Broadcom PHYs.
+
+For now, pass this flag in as it puts our attached PHY into a low-power
+state when disconnected.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmmii.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+@@ -296,6 +296,8 @@ int bcmgenet_mii_probe(struct net_device
+ 	/* Communicate the integrated PHY revision */
+ 	if (priv->internal_phy)
+ 		phy_flags = priv->gphy_rev;
++	else
++		phy_flags = PHY_BRCM_AUTO_PWRDWN_ENABLE;
+ 
+ 	/* This is an ugly quirk but we have not been correctly interpreting
+ 	 * the phy_interface values and we have done that across different
diff --git a/target/linux/bcm27xx/patches-6.1/950-0181-usb-add-plumbing-for-updating-interrupt-endpoint-int.patch b/target/linux/bcm27xx/patches-6.1/950-0181-usb-add-plumbing-for-updating-interrupt-endpoint-int.patch
new file mode 100644
index 00000000000000..8f302fda045a35
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0181-usb-add-plumbing-for-updating-interrupt-endpoint-int.patch
@@ -0,0 +1,104 @@
+From 7492e29b5535ca9694e45d6ca600a35169b690ec Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.org>
+Date: Tue, 11 Jun 2019 10:55:00 +0100
+Subject: [PATCH] usb: add plumbing for updating interrupt endpoint
+ interval state
+
+xHCI caches device and endpoint data after the interface is configured,
+so an explicit command needs to be issued for any device driver wanting
+to alter the polling interval of an endpoint.
+
+Add usb_fixup_endpoint() to allow drivers to do this. The fixup must be
+called after calculating endpoint bandwidth requirements but before any
+URBs are submitted.
+
+If polling intervals are shortened, any bandwidth reservations are no
+longer valid but in practice polling intervals are only ever relaxed.
+
+Limit the scope to interrupt transfers for now.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+---
+ drivers/usb/core/hcd.c     | 10 ++++++++++
+ drivers/usb/core/message.c | 15 +++++++++++++++
+ include/linux/usb.h        |  2 ++
+ include/linux/usb/hcd.h    |  7 +++++++
+ 4 files changed, 34 insertions(+)
+
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1973,6 +1973,16 @@ reset:
+ 	return ret;
+ }
+ 
++void usb_hcd_fixup_endpoint(struct usb_device *udev,
++			    struct usb_host_endpoint *ep, int interval)
++{
++	struct usb_hcd *hcd;
++
++	hcd = bus_to_hcd(udev->bus);
++	if (hcd->driver->fixup_endpoint)
++		hcd->driver->fixup_endpoint(hcd, udev, ep, interval);
++}
++
+ /* Disables the endpoint: synchronizes with the hcd to make sure all
+  * endpoint state is gone from hardware.  usb_hcd_flush_endpoint() must
+  * have been called previously.  Use for set_configuration, set_interface,
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1268,6 +1268,21 @@ static void remove_intf_ep_devs(struct u
+ 	intf->ep_devs_created = 0;
+ }
+ 
++void usb_fixup_endpoint(struct usb_device *dev, int epaddr, int interval)
++{
++	unsigned int epnum = epaddr & USB_ENDPOINT_NUMBER_MASK;
++	struct usb_host_endpoint *ep;
++
++	if (usb_endpoint_out(epaddr))
++		ep = dev->ep_out[epnum];
++	else
++		ep = dev->ep_in[epnum];
++
++	if (ep && usb_endpoint_xfer_int(&ep->desc))
++		usb_hcd_fixup_endpoint(dev, ep, interval);
++}
++EXPORT_SYMBOL_GPL(usb_fixup_endpoint);
++
+ /**
+  * usb_disable_endpoint -- Disable an endpoint by address
+  * @dev: the device whose endpoint is being disabled
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -1843,6 +1843,8 @@ extern int usb_clear_halt(struct usb_dev
+ extern int usb_reset_configuration(struct usb_device *dev);
+ extern int usb_set_interface(struct usb_device *dev, int ifnum, int alternate);
+ extern void usb_reset_endpoint(struct usb_device *dev, unsigned int epaddr);
++extern void usb_fixup_endpoint(struct usb_device *dev, int epaddr,
++			       int interval);
+ 
+ /* this request isn't really synchronous, but it belongs with the others */
+ extern int usb_driver_set_configuration(struct usb_device *udev, int config);
+--- a/include/linux/usb/hcd.h
++++ b/include/linux/usb/hcd.h
+@@ -371,6 +371,11 @@ struct hc_driver {
+ 		 * or bandwidth constraints.
+ 		 */
+ 	void	(*reset_bandwidth)(struct usb_hcd *, struct usb_device *);
++		/* Override the endpoint-derived interval
++		 * (if there is any cached hardware state).
++		 */
++	void	(*fixup_endpoint)(struct usb_hcd *hcd, struct usb_device *udev,
++				  struct usb_host_endpoint *ep, int interval);
+ 		/* Returns the hardware-chosen device address */
+ 	int	(*address_device)(struct usb_hcd *, struct usb_device *udev);
+ 		/* prepares the hardware to send commands to the device */
+@@ -435,6 +440,8 @@ extern void usb_hcd_unmap_urb_setup_for_
+ extern void usb_hcd_unmap_urb_for_dma(struct usb_hcd *, struct urb *);
+ extern void usb_hcd_flush_endpoint(struct usb_device *udev,
+ 		struct usb_host_endpoint *ep);
++extern void usb_hcd_fixup_endpoint(struct usb_device *udev,
++		struct usb_host_endpoint *ep, int interval);
+ extern void usb_hcd_disable_endpoint(struct usb_device *udev,
+ 		struct usb_host_endpoint *ep);
+ extern void usb_hcd_reset_endpoint(struct usb_device *udev,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0182-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch b/target/linux/bcm27xx/patches-6.1/950-0182-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch
new file mode 100644
index 00000000000000..4809951129eb21
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0182-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch
@@ -0,0 +1,135 @@
+From 4094f6f14c8f72583b8f255797be87e304cfd729 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.org>
+Date: Tue, 11 Jun 2019 11:33:39 +0100
+Subject: [PATCH] xhci: implement xhci_fixup_endpoint for interval
+ adjustments
+
+Must be called in a non-atomic context, after the endpoint
+has been registered with the hardware via xhci_add_endpoint
+and before the first URB is submitted for the endpoint.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+---
+ drivers/usb/host/xhci.c | 104 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 104 insertions(+)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1641,6 +1641,109 @@ command_cleanup:
+ }
+ 
+ /*
++ * RPI: Fixup endpoint intervals when requested
++ * - Check interval versus the (cached) endpoint context
++ * - set the endpoint interval to the new value
++ * - force an endpoint configure command
++ * XXX: bandwidth is not recalculated. We should probably do that.
++ */
++
++static unsigned int xhci_get_endpoint_flag_from_index(unsigned int ep_index)
++{
++	return 1 << (ep_index + 1);
++}
++
++static void xhci_fixup_endpoint(struct usb_hcd *hcd, struct usb_device *udev,
++				struct usb_host_endpoint *ep, int interval)
++{
++	struct xhci_hcd *xhci;
++	struct xhci_ep_ctx *ep_ctx_out, *ep_ctx_in;
++	struct xhci_command *command;
++	struct xhci_input_control_ctx *ctrl_ctx;
++	struct xhci_virt_device *vdev;
++	int xhci_interval;
++	int ret;
++	int ep_index;
++	unsigned long flags;
++	u32 ep_info_tmp;
++
++	xhci = hcd_to_xhci(hcd);
++	ep_index = xhci_get_endpoint_index(&ep->desc);
++
++	/* FS/LS interval translations */
++	if ((udev->speed == USB_SPEED_FULL ||
++	     udev->speed == USB_SPEED_LOW))
++		interval *= 8;
++
++	mutex_lock(&xhci->mutex);
++
++	spin_lock_irqsave(&xhci->lock, flags);
++
++	vdev = xhci->devs[udev->slot_id];
++	/* Get context-derived endpoint interval */
++	ep_ctx_out = xhci_get_ep_ctx(xhci, vdev->out_ctx, ep_index);
++	ep_ctx_in = xhci_get_ep_ctx(xhci, vdev->in_ctx, ep_index);
++	xhci_interval = EP_INTERVAL_TO_UFRAMES(le32_to_cpu(ep_ctx_out->ep_info));
++
++	if (interval == xhci_interval) {
++		spin_unlock_irqrestore(&xhci->lock, flags);
++		mutex_unlock(&xhci->mutex);
++		return;
++	}
++
++	xhci_dbg(xhci, "Fixup interval=%d xhci_interval=%d\n",
++		 interval, xhci_interval);
++	command = xhci_alloc_command_with_ctx(xhci, true, GFP_ATOMIC);
++	if (!command) {
++		/* Failure here is benign, poll at the original rate */
++		spin_unlock_irqrestore(&xhci->lock, flags);
++		mutex_unlock(&xhci->mutex);
++		return;
++	}
++
++	/* xHCI uses exponents for intervals... */
++	xhci_interval = fls(interval) - 1;
++	xhci_interval = clamp_val(xhci_interval, 3, 10);
++	ep_info_tmp = le32_to_cpu(ep_ctx_out->ep_info);
++	ep_info_tmp &= ~EP_INTERVAL(255);
++	ep_info_tmp |= EP_INTERVAL(xhci_interval);
++
++	/* Keep the endpoint context up-to-date while issuing the command. */
++	xhci_endpoint_copy(xhci, vdev->in_ctx,
++			   vdev->out_ctx, ep_index);
++	ep_ctx_in->ep_info = cpu_to_le32(ep_info_tmp);
++
++	/*
++	 * We need to drop the lock, so take an explicit copy
++	 * of the ep context.
++	 */
++	xhci_endpoint_copy(xhci, command->in_ctx, vdev->in_ctx, ep_index);
++
++	ctrl_ctx = xhci_get_input_control_ctx(command->in_ctx);
++	if (!ctrl_ctx) {
++		xhci_warn(xhci,
++			  "%s: Could not get input context, bad type.\n",
++			  __func__);
++		spin_unlock_irqrestore(&xhci->lock, flags);
++		xhci_free_command(xhci, command);
++		mutex_unlock(&xhci->mutex);
++		return;
++	}
++	ctrl_ctx->add_flags = xhci_get_endpoint_flag_from_index(ep_index);
++	ctrl_ctx->drop_flags = 0;
++
++	spin_unlock_irqrestore(&xhci->lock, flags);
++
++	ret = xhci_configure_endpoint(xhci, udev, command,
++				      false, false);
++	if (ret)
++		xhci_warn(xhci, "%s: Configure endpoint failed: %d\n",
++			  __func__, ret);
++	xhci_free_command(xhci, command);
++	mutex_unlock(&xhci->mutex);
++}
++
++/*
+  * non-error returns are a promise to giveback() the urb later
+  * we drop ownership so next owner (or urb unlink) can get it
+  */
+@@ -5469,6 +5572,7 @@ static const struct hc_driver xhci_hc_dr
+ 	.endpoint_reset =	xhci_endpoint_reset,
+ 	.check_bandwidth =	xhci_check_bandwidth,
+ 	.reset_bandwidth =	xhci_reset_bandwidth,
++	.fixup_endpoint =	xhci_fixup_endpoint,
+ 	.address_device =	xhci_address_device,
+ 	.enable_device =	xhci_enable_device,
+ 	.update_hub_device =	xhci_update_hub_device,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0183-usbhid-call-usb_fixup_endpoint-after-mangling-interv.patch b/target/linux/bcm27xx/patches-6.1/950-0183-usbhid-call-usb_fixup_endpoint-after-mangling-interv.patch
new file mode 100644
index 00000000000000..b9bf485304b94f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0183-usbhid-call-usb_fixup_endpoint-after-mangling-interv.patch
@@ -0,0 +1,23 @@
+From 1217fa70ee62e150a9c98c72ed1da30ec9c6789b Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.org>
+Date: Tue, 11 Jun 2019 11:42:03 +0100
+Subject: [PATCH] usbhid: call usb_fixup_endpoint after mangling
+ intervals
+
+Lets the mousepoll override mechanism work with xhci.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+---
+ drivers/hid/usbhid/hid-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hid/usbhid/hid-core.c
++++ b/drivers/hid/usbhid/hid-core.c
+@@ -1126,6 +1126,7 @@ static int usbhid_start(struct hid_devic
+ 				interval = hid_kbpoll_interval;
+ 			break;
+ 		}
++		usb_fixup_endpoint(dev, endpoint->bEndpointAddress, interval);
+ 
+ 		ret = -ENOMEM;
+ 		if (usb_endpoint_dir_in(endpoint)) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0184-arm-bcm2835-Add-bcm2838-compatible-string.patch b/target/linux/bcm27xx/patches-6.1/950-0184-arm-bcm2835-Add-bcm2838-compatible-string.patch
new file mode 100644
index 00000000000000..7b2024ba4568a2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0184-arm-bcm2835-Add-bcm2838-compatible-string.patch
@@ -0,0 +1,20 @@
+From a1adfe40993c0ce5e5d569ea434fe29c3ab034f6 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 11 Jun 2019 17:38:28 +0100
+Subject: [PATCH] arm: bcm2835: Add bcm2838 compatible string.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ arch/arm/mach-bcm/board_bcm2835.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/mach-bcm/board_bcm2835.c
++++ b/arch/arm/mach-bcm/board_bcm2835.c
+@@ -109,6 +109,7 @@ static const char * const bcm2835_compat
+ #ifdef CONFIG_ARCH_MULTI_V7
+ 	"brcm,bcm2836",
+ 	"brcm,bcm2837",
++	"brcm,bcm2838",
+ #endif
+ 	NULL
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0185-i2c-bcm2835-Set-clock-stretch-timeout-to-35ms.patch b/target/linux/bcm27xx/patches-6.1/950-0185-i2c-bcm2835-Set-clock-stretch-timeout-to-35ms.patch
new file mode 100644
index 00000000000000..ca7fe637333b75
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0185-i2c-bcm2835-Set-clock-stretch-timeout-to-35ms.patch
@@ -0,0 +1,47 @@
+From c34a59e122ecc5b135fe202bdc2f3f8b551b7523 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Fri, 12 Jul 2019 15:38:35 +0100
+Subject: [PATCH] i2c: bcm2835: Set clock-stretch timeout to 35ms
+
+The BCM2835 I2C blocks have a register to set the clock-stretch
+timeout - how long the device is allowed to hold SCL low - in bus
+cycles. The current driver doesn't write to the register, therefore
+the default value of 64 cycles is being used for all devices.
+
+Set the timeout to the value recommended for SMBus - 35ms.
+
+See: https://github.com/raspberrypi/linux/issues/3064
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/i2c/busses/i2c-bcm2835.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-bcm2835.c
++++ b/drivers/i2c/busses/i2c-bcm2835.c
+@@ -193,6 +193,7 @@ static int clk_bcm2835_i2c_set_rate(stru
+ {
+ 	struct clk_bcm2835_i2c *div = to_clk_bcm2835_i2c(hw);
+ 	u32 redl, fedl;
++	u32 clk_tout;
+ 	u32 divider = clk_bcm2835_i2c_calc_divider(rate, parent_rate);
+ 
+ 	if (divider == -EINVAL)
+@@ -216,6 +217,17 @@ static int clk_bcm2835_i2c_set_rate(stru
+ 	bcm2835_i2c_writel(div->i2c_dev, BCM2835_I2C_DEL,
+ 			   (fedl << BCM2835_I2C_FEDL_SHIFT) |
+ 			   (redl << BCM2835_I2C_REDL_SHIFT));
++
++	/*
++	 * Set the clock stretch timeout to the SMBUs-recommended 35ms.
++	 */
++	if (rate > 0xffff*1000/35)
++	    clk_tout = 0xffff;
++	else
++	    clk_tout = 35*rate/1000;
++
++	bcm2835_i2c_writel(div->i2c_dev, BCM2835_I2C_CLKT, clk_tout);
++
+ 	return 0;
+ }
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0186-drm-v3d-Clock-V3D-down-when-not-in-use.patch b/target/linux/bcm27xx/patches-6.1/950-0186-drm-v3d-Clock-V3D-down-when-not-in-use.patch
new file mode 100644
index 00000000000000..d93055f72e50a2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0186-drm-v3d-Clock-V3D-down-when-not-in-use.patch
@@ -0,0 +1,158 @@
+From 62b02a4ede83d3c54a55e1c5ef0043ab13c34ad4 Mon Sep 17 00:00:00 2001
+From: Eric Anholt <eric@anholt.net>
+Date: Thu, 2 May 2019 13:22:53 -0700
+Subject: [PATCH] drm/v3d: Clock V3D down when not in use.
+
+My various attempts at re-enabling runtime PM have failed, so just
+crank the clock down when V3D is idle to reduce power consumption.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+---
+ drivers/gpu/drm/v3d/v3d_drv.c | 18 +++++++++++++
+ drivers/gpu/drm/v3d/v3d_drv.h |  6 +++++
+ drivers/gpu/drm/v3d/v3d_gem.c | 50 +++++++++++++++++++++++++++++++++--
+ 3 files changed, 72 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/v3d/v3d_drv.c
++++ b/drivers/gpu/drm/v3d/v3d_drv.c
+@@ -260,6 +260,21 @@ static int v3d_platform_drm_probe(struct
+ 		}
+ 	}
+ 
++	v3d->clk = devm_clk_get(dev, NULL);
++	if (IS_ERR(v3d->clk)) {
++		if (ret != -EPROBE_DEFER)
++			dev_err(dev, "Failed to get clock\n");
++		goto dev_free;
++	}
++	v3d->clk_up_rate = clk_get_rate(v3d->clk);
++	/* For downclocking, drop it to the minimum frequency we can get from
++	 * the CPRMAN clock generator dividing off our parent.  The divider is
++	 * 4 bits, but ask for just higher than that so that rounding doesn't
++	 * make cprman reject our rate.
++	 */
++	v3d->clk_down_rate =
++		(clk_get_rate(clk_get_parent(v3d->clk)) / (1 << 4)) + 10000;
++
+ 	if (v3d->ver < 41) {
+ 		ret = map_regs(v3d, &v3d->gca_regs, "gca");
+ 		if (ret)
+@@ -285,6 +300,9 @@ static int v3d_platform_drm_probe(struct
+ 	if (ret)
+ 		goto irq_disable;
+ 
++	ret = clk_set_rate(v3d->clk, v3d->clk_down_rate);
++	WARN_ON_ONCE(ret != 0);
++
+ 	return 0;
+ 
+ irq_disable:
+--- a/drivers/gpu/drm/v3d/v3d_drv.h
++++ b/drivers/gpu/drm/v3d/v3d_drv.h
+@@ -76,6 +76,12 @@ struct v3d_dev {
+ 	void __iomem *bridge_regs;
+ 	void __iomem *gca_regs;
+ 	struct clk *clk;
++	struct delayed_work clk_down_work;
++	unsigned long clk_up_rate, clk_down_rate;
++	struct mutex clk_lock;
++	u32 clk_refcount;
++	bool clk_up;
++
+ 	struct reset_control *reset;
+ 
+ 	/* Virtual and DMA addresses of the single shared page table. */
+--- a/drivers/gpu/drm/v3d/v3d_gem.c
++++ b/drivers/gpu/drm/v3d/v3d_gem.c
+@@ -4,6 +4,7 @@
+ #include <linux/device.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/io.h>
++#include <linux/clk.h>
+ #include <linux/module.h>
+ #include <linux/platform_device.h>
+ #include <linux/reset.h>
+@@ -18,6 +19,47 @@
+ #include "v3d_trace.h"
+ 
+ static void
++v3d_clock_down_work(struct work_struct *work)
++{
++	struct v3d_dev *v3d =
++		container_of(work, struct v3d_dev, clk_down_work.work);
++	int ret;
++
++	ret = clk_set_rate(v3d->clk, v3d->clk_down_rate);
++	v3d->clk_up = false;
++	WARN_ON_ONCE(ret != 0);
++}
++
++static void
++v3d_clock_up_get(struct v3d_dev *v3d)
++{
++	mutex_lock(&v3d->clk_lock);
++	if (v3d->clk_refcount++ == 0) {
++		cancel_delayed_work_sync(&v3d->clk_down_work);
++		if (!v3d->clk_up)  {
++			int ret;
++
++			ret = clk_set_rate(v3d->clk, v3d->clk_up_rate);
++			WARN_ON_ONCE(ret != 0);
++			v3d->clk_up = true;
++		}
++	}
++	mutex_unlock(&v3d->clk_lock);
++}
++
++static void
++v3d_clock_up_put(struct v3d_dev *v3d)
++{
++	mutex_lock(&v3d->clk_lock);
++	if (--v3d->clk_refcount == 0) {
++		schedule_delayed_work(&v3d->clk_down_work,
++				      msecs_to_jiffies(100));
++	}
++	mutex_unlock(&v3d->clk_lock);
++}
++
++
++static void
+ v3d_init_core(struct v3d_dev *v3d, int core)
+ {
+ 	/* Set OVRTMUOUT, which means that the texture sampler uniform
+@@ -360,6 +402,7 @@ static void
+ v3d_job_free(struct kref *ref)
+ {
+ 	struct v3d_job *job = container_of(ref, struct v3d_job, refcount);
++	struct v3d_dev *v3d = job->v3d;
+ 	int i;
+ 
+ 	for (i = 0; i < job->bo_count; i++) {
+@@ -368,8 +411,7 @@ v3d_job_free(struct kref *ref)
+ 	}
+ 	kvfree(job->bo);
+ 
+-	dma_fence_put(job->irq_fence);
+-	dma_fence_put(job->done_fence);
++	v3d_clock_up_put(v3d);
+ 
+ 	if (job->perfmon)
+ 		v3d_perfmon_put(job->perfmon);
+@@ -500,6 +542,7 @@ v3d_job_init(struct v3d_dev *v3d, struct
+ 			goto fail_deps;
+ 	}
+ 
++	v3d_clock_up_get(v3d);
+ 	kref_init(&job->refcount);
+ 
+ 	return 0;
+@@ -1080,6 +1123,9 @@ v3d_gem_init(struct drm_device *dev)
+ 	mutex_init(&v3d->sched_lock);
+ 	mutex_init(&v3d->cache_clean_lock);
+ 
++	mutex_init(&v3d->clk_lock);
++	INIT_DELAYED_WORK(&v3d->clk_down_work, v3d_clock_down_work);
++
+ 	/* Note: We don't allocate address 0.  Various bits of HW
+ 	 * treat 0 as special, such as the occlusion query counters
+ 	 * where 0 means "disabled".
diff --git a/target/linux/bcm27xx/patches-6.1/950-0187-drivers-char-add-chardev-for-mmap-ing-the-RPiVid-con.patch b/target/linux/bcm27xx/patches-6.1/950-0187-drivers-char-add-chardev-for-mmap-ing-the-RPiVid-con.patch
new file mode 100644
index 00000000000000..571ec80cc46ed3
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0187-drivers-char-add-chardev-for-mmap-ing-the-RPiVid-con.patch
@@ -0,0 +1,372 @@
+From 7fc828638fd97e3fc077ccf777351dab909afd04 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.org>
+Date: Thu, 9 May 2019 14:30:37 +0100
+Subject: [PATCH] drivers: char: add chardev for mmap'ing the RPiVid
+ control registers
+
+Based on the gpiomem driver, allow mapping of the decoder register
+spaces such that userspace can access control/status registers.
+This driver is intended for use with a custom ffmpeg backend accelerator
+prior to a v4l2 driver being written.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+
+driver: char: rpivid: Destroy the legacy device on remove
+
+The legacy name support created a new device that was never destroyed.
+If the driver was unloaded and reloaded, it failed due to the
+device already existing.
+
+Fixes: "75f1d14 driver: char: rpivid - also support legacy name"
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+driver: char: rpivid: Clean up error handling use of ERR_PTR/IS_ERR
+
+The driver used an unnecessary intermediate void* variable so it
+only called ERR_PTR once to convert to the error value.
+
+Switch to converting as the error arises to remove these intermediate
+variables.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+driver: char: rpivid: Add error handling to the legacy device load
+
+The return value from device_create for the legacy device was never
+checked or handled. Add the required error handling.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+driver: char: rpivid: Fix coding style whitespace issues.
+
+Makes checkpatch happier.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+driver: char: rpimem: Add SPDX licence header.
+
+Stops checkpatch complaining.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+driver: char: rpivid: Fix access to freed memory
+
+The error path during probe frees the private memory block, and
+then promptly dereferences it to log an error message.
+
+Use the base device instead of the pointer to it in the private
+structure.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+driver: char: rpivid: Remove legacy name support
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+driver: char: rpivid: Don't map more than wanted
+
+Limit mappings to the permitted range, but don't map more than asked
+for otherwise we walk off the end of the allocated VMA.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/char/broadcom/Kconfig      |   8 +
+ drivers/char/broadcom/Makefile     |   1 +
+ drivers/char/broadcom/rpivid-mem.c | 270 +++++++++++++++++++++++++++++
+ 3 files changed, 279 insertions(+)
+ create mode 100644 drivers/char/broadcom/rpivid-mem.c
+
+--- a/drivers/char/broadcom/Kconfig
++++ b/drivers/char/broadcom/Kconfig
+@@ -39,3 +39,11 @@ config BCM2835_SMI_DEV
+ 		This driver provides a character device interface (ioctl + read/write) to
+ 		Broadcom's Secondary Memory interface. The low-level functionality is provided
+ 		by the SMI driver itself.
++
++config RPIVID_MEM
++	tristate "Character device driver for the Raspberry Pi RPIVid video decoder hardware"
++	default n
++	help
++		This driver provides a character device interface for memory-map operations
++		so userspace tools can access the control and status registers of the
++		Raspberry Pi RPiVid video decoder hardware.
+--- a/drivers/char/broadcom/Makefile
++++ b/drivers/char/broadcom/Makefile
+@@ -2,3 +2,4 @@ obj-$(CONFIG_BCM2708_VCMEM)	+= vc_mem.o
+ obj-$(CONFIG_BCM_VCIO)		+= vcio.o
+ obj-$(CONFIG_BCM2835_DEVGPIOMEM)+= bcm2835-gpiomem.o
+ obj-$(CONFIG_BCM2835_SMI_DEV)	+= bcm2835_smi_dev.o
++obj-$(CONFIG_RPIVID_MEM)	+= rpivid-mem.o
+--- /dev/null
++++ b/drivers/char/broadcom/rpivid-mem.c
+@@ -0,0 +1,270 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
++/**
++ * rpivid-mem.c - character device access to the RPiVid decoder registers
++ *
++ * Based on bcm2835-gpiomem.c. Provides IO memory access to the decoder
++ * register blocks such that ffmpeg plugins can access the hardware.
++ *
++ * Jonathan Bell <jonathan@raspberrypi.org>
++ * Copyright (c) 2019, Raspberry Pi (Trading) Ltd.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions, and the following disclaimer,
++ *    without modification.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. The names of the above-listed copyright holders may not be used
++ *    to endorse or promote products derived from this software without
++ *    specific prior written permission.
++ *
++ * ALTERNATIVELY, this software may be distributed under the terms of the
++ * GNU General Public License ("GPL") version 2, as published by the Free
++ * Software Foundation.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
++ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
++ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
++ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
++ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
++ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
++#include <linux/platform_device.h>
++#include <linux/mm.h>
++#include <linux/slab.h>
++#include <linux/cdev.h>
++#include <linux/pagemap.h>
++#include <linux/io.h>
++
++#define DRIVER_NAME "rpivid-mem"
++#define DEVICE_MINOR 0
++
++struct rpivid_mem_priv {
++	dev_t devid;
++	struct class *class;
++	struct cdev rpivid_mem_cdev;
++	unsigned long regs_phys;
++	unsigned long mem_window_len;
++	struct device *dev;
++	const char *name;
++};
++
++static int rpivid_mem_open(struct inode *inode, struct file *file)
++{
++	int dev = iminor(inode);
++	int ret = 0;
++	struct rpivid_mem_priv *priv;
++
++	if (dev != DEVICE_MINOR && dev != DEVICE_MINOR + 1)
++		ret = -ENXIO;
++
++	priv = container_of(inode->i_cdev, struct rpivid_mem_priv,
++				rpivid_mem_cdev);
++	if (!priv)
++		return -EINVAL;
++	file->private_data = priv;
++	return ret;
++}
++
++static int rpivid_mem_release(struct inode *inode, struct file *file)
++{
++	int dev = iminor(inode);
++	int ret = 0;
++
++	if (dev != DEVICE_MINOR && dev != DEVICE_MINOR + 1)
++		ret = -ENXIO;
++
++	return ret;
++}
++
++static const struct vm_operations_struct rpivid_mem_vm_ops = {
++#ifdef CONFIG_HAVE_IOREMAP_PROT
++	.access = generic_access_phys
++#endif
++};
++
++static int rpivid_mem_mmap(struct file *file, struct vm_area_struct *vma)
++{
++	struct rpivid_mem_priv *priv;
++	unsigned long pages;
++	unsigned long len;
++
++	priv = file->private_data;
++	pages = priv->regs_phys >> PAGE_SHIFT;
++	/*
++	 * The address decode is far larger than the actual number of registers.
++	 * Just map the whole lot in.
++	 */
++	len = min(vma->vm_end - vma->vm_start, priv->mem_window_len);
++	vma->vm_page_prot = phys_mem_access_prot(file, pages, len,
++						 vma->vm_page_prot);
++	vma->vm_ops = &rpivid_mem_vm_ops;
++	if (remap_pfn_range(vma, vma->vm_start,
++			    pages, len,
++			    vma->vm_page_prot)) {
++		return -EAGAIN;
++	}
++	return 0;
++}
++
++static const struct file_operations
++rpivid_mem_fops = {
++	.owner = THIS_MODULE,
++	.open = rpivid_mem_open,
++	.release = rpivid_mem_release,
++	.mmap = rpivid_mem_mmap,
++};
++
++static const struct of_device_id rpivid_mem_of_match[];
++static int rpivid_mem_probe(struct platform_device *pdev)
++{
++	int err;
++	const struct of_device_id *id;
++	struct device *dev = &pdev->dev;
++	struct resource *ioresource;
++	struct rpivid_mem_priv *priv;
++
++	/* Allocate buffers and instance data */
++
++	priv = kzalloc(sizeof(struct rpivid_mem_priv), GFP_KERNEL);
++
++	if (!priv) {
++		err = -ENOMEM;
++		goto failed_inst_alloc;
++	}
++	platform_set_drvdata(pdev, priv);
++
++	priv->dev = dev;
++	id = of_match_device(rpivid_mem_of_match, dev);
++	if (!id)
++		return -EINVAL;
++	priv->name = id->data;
++
++	ioresource = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if (ioresource) {
++		priv->regs_phys = ioresource->start;
++		priv->mem_window_len = (ioresource->end + 1) - ioresource->start;
++	} else {
++		dev_err(priv->dev, "failed to get IO resource");
++		err = -ENOENT;
++		goto failed_get_resource;
++	}
++
++	/* Create character device entries */
++
++	err = alloc_chrdev_region(&priv->devid,
++				  DEVICE_MINOR, 2, priv->name);
++	if (err != 0) {
++		dev_err(priv->dev, "unable to allocate device number");
++		goto failed_alloc_chrdev;
++	}
++	cdev_init(&priv->rpivid_mem_cdev, &rpivid_mem_fops);
++	priv->rpivid_mem_cdev.owner = THIS_MODULE;
++	err = cdev_add(&priv->rpivid_mem_cdev, priv->devid, 2);
++	if (err != 0) {
++		dev_err(priv->dev, "unable to register device");
++		goto failed_cdev_add;
++	}
++
++	/* Create sysfs entries */
++
++	priv->class = class_create(THIS_MODULE, priv->name);
++	if (IS_ERR(priv->class)) {
++		err = PTR_ERR(priv->class);
++		goto failed_class_create;
++	}
++
++	dev = device_create(priv->class, NULL, priv->devid, NULL, priv->name);
++	if (IS_ERR(dev)) {
++		err = PTR_ERR(dev);
++		goto failed_device_create;
++	}
++
++	dev_info(priv->dev, "%s initialised: Registers at 0x%08lx length 0x%08lx",
++		priv->name, priv->regs_phys, priv->mem_window_len);
++
++	return 0;
++
++failed_device_create:
++	class_destroy(priv->class);
++failed_class_create:
++	cdev_del(&priv->rpivid_mem_cdev);
++failed_cdev_add:
++	unregister_chrdev_region(priv->devid, 1);
++failed_alloc_chrdev:
++failed_get_resource:
++	kfree(priv);
++failed_inst_alloc:
++	dev_err(&pdev->dev, "could not load rpivid_mem");
++	return err;
++}
++
++static int rpivid_mem_remove(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct rpivid_mem_priv *priv = platform_get_drvdata(pdev);
++
++	device_destroy(priv->class, priv->devid);
++	class_destroy(priv->class);
++	cdev_del(&priv->rpivid_mem_cdev);
++	unregister_chrdev_region(priv->devid, 1);
++	kfree(priv);
++
++	dev_info(dev, "%s driver removed - OK", priv->name);
++	return 0;
++}
++
++static const struct of_device_id rpivid_mem_of_match[] = {
++	{
++		.compatible = "raspberrypi,rpivid-hevc-decoder",
++		.data = "rpivid-hevcmem",
++	},
++	{
++		.compatible = "raspberrypi,rpivid-h264-decoder",
++		.data = "rpivid-h264mem",
++	},
++	{
++		.compatible = "raspberrypi,rpivid-vp9-decoder",
++		.data = "rpivid-vp9mem",
++	},
++	/* The "intc" is included as this block of hardware contains the
++	 * "frame done" status flags.
++	 */
++	{
++		.compatible = "raspberrypi,rpivid-local-intc",
++		.data = "rpivid-intcmem",
++	},
++	{ /* sentinel */ },
++};
++
++MODULE_DEVICE_TABLE(of, rpivid_mem_of_match);
++
++static struct platform_driver rpivid_mem_driver = {
++	.probe = rpivid_mem_probe,
++	.remove = rpivid_mem_remove,
++	.driver = {
++		   .name = DRIVER_NAME,
++		   .owner = THIS_MODULE,
++		   .of_match_table = rpivid_mem_of_match,
++		   },
++};
++
++module_platform_driver(rpivid_mem_driver);
++
++MODULE_ALIAS("platform:rpivid-mem");
++MODULE_LICENSE("GPL");
++MODULE_DESCRIPTION("Driver for accessing RPiVid decoder registers from userspace");
++MODULE_AUTHOR("Jonathan Bell <jonathan@raspberrypi.org>");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0188-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch b/target/linux/bcm27xx/patches-6.1/950-0188-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch
new file mode 100644
index 00000000000000..2426a39ac37aba
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0188-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch
@@ -0,0 +1,63 @@
+From f66c4ef49f4d559a5b702fdd5df6259392389723 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.org>
+Date: Thu, 1 Aug 2019 16:41:20 +0100
+Subject: [PATCH] hid: usb: Add device quirks for Freeway Airmouse T3
+ and MX3
+
+These wireless mouse/keyboard combo remote control devices specify
+multiple "wheel" events in their report descriptors. The wheel events
+are incorrectly defined and apparently map to accelerometer data, leading
+to spurious mouse scroll events being generated at an extreme rate when
+the device is moved.
+
+As a workaround, use HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE to mask
+feeding the extra wheel events to the input subsystem.
+
+See: https://github.com/raspberrypi/firmware/issues/1189
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+---
+ drivers/hid/hid-ids.h    | 6 ++++++
+ drivers/hid/hid-quirks.c | 2 ++
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -238,6 +238,9 @@
+ #define USB_VENDOR_ID_BAANTO		0x2453
+ #define USB_DEVICE_ID_BAANTO_MT_190W2	0x0100
+ 
++#define USB_VENDOR_ID_BEKEN		0x25a7
++#define USB_DEVICE_ID_AIRMOUSE_T3	0x2402
++
+ #define USB_VENDOR_ID_BELKIN		0x050d
+ #define USB_DEVICE_ID_FLIP_KVM		0x3201
+ 
+@@ -1367,6 +1370,9 @@
+ #define USB_VENDOR_ID_XIAOMI		0x2717
+ #define USB_DEVICE_ID_MI_SILENT_MOUSE	0x5014
+ 
++#define USB_VENDOR_ID_XENTA			0x1d57
++#define USB_DEVICE_ID_AIRMOUSE_MX3		0xad03
++
+ #define USB_VENDOR_ID_XIN_MO			0x16c0
+ #define USB_DEVICE_ID_XIN_MO_DUAL_ARCADE	0x05e1
+ #define USB_DEVICE_ID_THT_2P_ARCADE		0x75e1
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -41,6 +41,7 @@ static const struct hid_device_id hid_qu
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS682), HID_QUIRK_NOGET },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS692), HID_QUIRK_NOGET },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM), HID_QUIRK_NOGET },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_BEKEN, USB_DEVICE_ID_AIRMOUSE_T3), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_MULTI_TOUCH), HID_QUIRK_MULTI_INPUT },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE2), HID_QUIRK_ALWAYS_POLL },
+@@ -197,6 +198,7 @@ static const struct hid_device_id hid_qu
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_QUAD_USB_JOYPAD), HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE), HID_QUIRK_MULTI_INPUT },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_GROUP_AUDIO), HID_QUIRK_NOGET },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_XENTA, USB_DEVICE_ID_AIRMOUSE_MX3), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ 
+ 	{ 0 }
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0189-net-bcmgenet-Workaround-2-for-Pi4-Ethernet-fail.patch b/target/linux/bcm27xx/patches-6.1/950-0189-net-bcmgenet-Workaround-2-for-Pi4-Ethernet-fail.patch
new file mode 100644
index 00000000000000..ba1baac7d0c41d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0189-net-bcmgenet-Workaround-2-for-Pi4-Ethernet-fail.patch
@@ -0,0 +1,51 @@
+From 3c252c9745794d454391f378e7b99a4b4ea4b1c3 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Fri, 9 Aug 2019 08:51:43 +0100
+Subject: [PATCH] net: bcmgenet: Workaround #2 for Pi4 Ethernet fail
+
+Some combinations of Pi 4Bs and Ethernet switches don't reliably get a
+DCHP-assigned IP address, leaving the unit with a self=assigned 169.254
+address. In the failure case, the Pi is left able to receive packets
+but not send them, suggesting that the MAC<->PHY link is getting into
+a bad state.
+
+It has been found empirically that skipping a reset step by the genet
+driver prevents the failures. No downsides have been discovered yet,
+and unlike the forced renegotiation it doesn't increase the time to
+get an IP address, so the workaround is enabled by default; add
+
+  genet.skip_umac_reset=n
+
+to the command line to disable it.
+
+See: https://github.com/raspberrypi/linux/issues/3108
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -67,6 +67,9 @@
+ 
+ /* Forward declarations */
+ static void bcmgenet_set_rx_mode(struct net_device *dev);
++static bool skip_umac_reset = true;
++module_param(skip_umac_reset, bool, 0444);
++MODULE_PARM_DESC(skip_umac_reset, "Skip UMAC reset step");
+ 
+ static inline void bcmgenet_writel(u32 value, void __iomem *offset)
+ {
+@@ -2488,6 +2491,11 @@ static void reset_umac(struct bcmgenet_p
+ 	bcmgenet_rbuf_ctrl_set(priv, 0);
+ 	udelay(10);
+ 
++	if (skip_umac_reset) {
++		pr_warn("Skipping UMAC reset\n");
++		return;
++	}
++
+ 	/* issue soft reset and disable MAC while updating its registers */
+ 	bcmgenet_umac_writel(priv, CMD_SW_RESET, UMAC_CMD);
+ 	udelay(2);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0190-xhci-Use-more-event-ring-segment-table-entries.patch b/target/linux/bcm27xx/patches-6.1/950-0190-xhci-Use-more-event-ring-segment-table-entries.patch
new file mode 100644
index 00000000000000..c624dfb8da9ca5
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0190-xhci-Use-more-event-ring-segment-table-entries.patch
@@ -0,0 +1,60 @@
+From 44bfc1e281e081d9ddd0e633ed2dd73c969333f4 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.org>
+Date: Tue, 13 Aug 2019 15:53:29 +0100
+Subject: [PATCH] xhci: Use more event ring segment table entries
+
+Users have reported log spam created by "Event Ring Full" xHC event
+TRBs. These are caused by interrupt latency in conjunction with a very
+busy set of devices on the bus. The errors are benign, but throughput
+will suffer as the xHC will pause processing of transfers until the
+event ring is drained by the kernel. Expand the number of event TRB slots
+available by increasing the number of event ring segments in the ERST.
+
+Controllers have a hardware-defined limit as to the number of ERST
+entries they can process, so make the actual number in use
+min(ERST_MAX_SEGS, hw_max).
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+---
+ drivers/usb/host/xhci-mem.c | 8 +++++---
+ drivers/usb/host/xhci.h     | 4 ++--
+ 2 files changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -2501,9 +2501,11 @@ int xhci_mem_init(struct xhci_hcd *xhci,
+ 	 * Event ring setup: Allocate a normal ring, but also setup
+ 	 * the event ring segment table (ERST).  Section 4.9.3.
+ 	 */
++	val2 = 1 << HCS_ERST_MAX(xhci->hcs_params2);
++	val2 = min_t(unsigned int, ERST_MAX_SEGS, val2);
+ 	xhci_dbg_trace(xhci, trace_xhci_dbg_init, "// Allocating event ring");
+-	xhci->event_ring = xhci_ring_alloc(xhci, ERST_NUM_SEGS, 1, TYPE_EVENT,
+-					0, flags);
++	xhci->event_ring = xhci_ring_alloc(xhci, val2, 1, TYPE_EVENT,
++					   0, flags);
+ 	if (!xhci->event_ring)
+ 		goto fail;
+ 	if (xhci_check_trb_in_td_math(xhci) < 0)
+@@ -2516,7 +2518,7 @@ int xhci_mem_init(struct xhci_hcd *xhci,
+ 	/* set ERST count with the number of entries in the segment table */
+ 	val = readl(&xhci->ir_set->erst_size);
+ 	val &= ERST_SIZE_MASK;
+-	val |= ERST_NUM_SEGS;
++	val |= val2;
+ 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
+ 			"// Write ERST size = %i to ir_set 0 (some bits preserved)",
+ 			val);
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1671,8 +1671,8 @@ struct urb_priv {
+  * Each segment table entry is 4*32bits long.  1K seems like an ok size:
+  * (1K bytes * 8bytes/bit) / (4*32 bits) = 64 segment entries in the table,
+  * meaning 64 ring segments.
+- * Initial allocated size of the ERST, in number of entries */
+-#define	ERST_NUM_SEGS	1
++ * Maximum number of segments in the ERST */
++#define	ERST_MAX_SEGS	8
+ /* Poll every 60 seconds */
+ #define	POLL_TIMEOUT	60
+ /* Stop endpoint command timeout (secs) for URB cancellation watchdog timer */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0191-arch-arm-Add-model-string-to-cpuinfo.patch b/target/linux/bcm27xx/patches-6.1/950-0191-arch-arm-Add-model-string-to-cpuinfo.patch
new file mode 100644
index 00000000000000..f09060d20c4bff
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0191-arch-arm-Add-model-string-to-cpuinfo.patch
@@ -0,0 +1,36 @@
+From 08cb5799f6c6ba9168d9ce32a480a3b94d897f59 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 3 Sep 2019 18:16:56 +0100
+Subject: [PATCH] arch/arm: Add model string to cpuinfo
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ arch/arm/kernel/setup.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/arch/arm/kernel/setup.c
++++ b/arch/arm/kernel/setup.c
+@@ -1265,6 +1265,8 @@ static int c_show(struct seq_file *m, vo
+ {
+ 	int i, j;
+ 	u32 cpuid;
++	struct device_node *np;
++	const char *model;
+ 
+ 	for_each_online_cpu(i) {
+ 		/*
+@@ -1324,6 +1326,14 @@ static int c_show(struct seq_file *m, vo
+ 	seq_printf(m, "Revision\t: %04x\n", system_rev);
+ 	seq_printf(m, "Serial\t\t: %s\n", system_serial);
+ 
++	np = of_find_node_by_path("/");
++	if (np) {
++		if (!of_property_read_string(np, "model",
++					     &model))
++			seq_printf(m, "Model\t\t: %s\n", model);
++		of_node_put(np);
++	}
++
+ 	return 0;
+ }
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0192-arch-arm64-Add-Revision-Serial-Model-to-cpuinfo.patch b/target/linux/bcm27xx/patches-6.1/950-0192-arch-arm64-Add-Revision-Serial-Model-to-cpuinfo.patch
new file mode 100644
index 00000000000000..513be5ee6d45f6
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0192-arch-arm64-Add-Revision-Serial-Model-to-cpuinfo.patch
@@ -0,0 +1,58 @@
+From adc8ba1677d4848cb02877ba7682419ce9b83647 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 3 Sep 2019 18:17:25 +0100
+Subject: [PATCH] arch/arm64: Add Revision, Serial, Model to cpuinfo
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ arch/arm64/kernel/cpuinfo.c | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+--- a/arch/arm64/kernel/cpuinfo.c
++++ b/arch/arm64/kernel/cpuinfo.c
+@@ -17,6 +17,7 @@
+ #include <linux/elf.h>
+ #include <linux/init.h>
+ #include <linux/kernel.h>
++#include <linux/of_platform.h>
+ #include <linux/personality.h>
+ #include <linux/preempt.h>
+ #include <linux/printk.h>
+@@ -159,6 +160,10 @@ static int c_show(struct seq_file *m, vo
+ {
+ 	int i, j;
+ 	bool compat = personality(current->personality) == PER_LINUX32;
++	struct device_node *np;
++	const char *model;
++	const char *serial;
++	u32 revision;
+ 
+ 	for_each_online_cpu(i) {
+ 		struct cpuinfo_arm64 *cpuinfo = &per_cpu(cpu_data, i);
+@@ -219,6 +224,26 @@ static int c_show(struct seq_file *m, vo
+ 		seq_printf(m, "CPU revision\t: %d\n\n", MIDR_REVISION(midr));
+ 	}
+ 
++	seq_printf(m, "Hardware\t: BCM2835\n");
++
++	np = of_find_node_by_path("/system");
++	if (np) {
++		if (!of_property_read_u32(np, "linux,revision", &revision))
++			seq_printf(m, "Revision\t: %04x\n", revision);
++		of_node_put(np);
++	}
++
++	np = of_find_node_by_path("/");
++	if (np) {
++		if (!of_property_read_string(np, "serial-number",
++					     &serial))
++			seq_printf(m, "Serial\t\t: %s\n", serial);
++		if (!of_property_read_string(np, "model",
++					     &model))
++			seq_printf(m, "Model\t\t: %s\n", model);
++		of_node_put(np);
++	}
++
+ 	return 0;
+ }
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0193-media-i2c-imx258-Support-for-the-Sony-IMX258-sensor.patch b/target/linux/bcm27xx/patches-6.1/950-0193-media-i2c-imx258-Support-for-the-Sony-IMX258-sensor.patch
new file mode 100644
index 00000000000000..88625ed88e9532
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0193-media-i2c-imx258-Support-for-the-Sony-IMX258-sensor.patch
@@ -0,0 +1,1621 @@
+From f0fa50f3ed5ff5089cb8ff3e204d12db576d6c05 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 15 Jun 2021 18:18:42 +0100
+Subject: [PATCH] media: i2c: imx258: Support for the Sony IMX258
+ sensor
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+media: i2c: imx258: Remove unused defines
+
+The IMX258_FLL_* defines are unused. Remove them.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx258: Make image geometry meet sensor requirements
+
+The output image is defined as being 4208x3118 pixels in size.
+Y_ADD_STA register was set to 0, and Y_ADD_END to 3118, giving
+3119 lines total.
+
+The datasheet lists a requirement for Y_ADD_STA to be a multiple
+of a power of 2 depending on binning/scaling mode (2 for full pixel,
+4 for x2-bin/scale, 8 for (x2-bin)+(x2-subsample) or x4-bin, or 16
+for (x4-bin)+(x2-subsample)).
+(Y_ADD_END – Y_ADD_STA + 1) also has to be a similar power of 2.
+
+The current configuration for the full res modes breaks that second
+requirement, and we can't increase Y_ADD_STA to 1 to retain exactly
+the same field of view as that then breaks the first requirement.
+For the binned modes, they are worse off as 3118 is not a multiple of
+4.
+
+Increase the main mode to 4208x3120 so that it is the same FOV as the
+binned modes, with Y_ADD_STA at 0.
+Fix Y_ADD_STA and Y_ADD_END for the binned modes so that they meet the
+sensor requirements.
+
+This does change the Bayer order as the default configuration is for
+H&V flips to be enabled, so readout is from Y_STA_END to Y_ADD_STA,
+and this patch has changed Y_STA_END.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx258: Disable digital cropping on binned modes
+
+The binned modes set DIG_CROP_X_OFFSET and DIG_CROP_IMAGE_WIDTH
+to less than the full image, even though the image being captured
+is meant to be a scaled version of the full array size.
+
+Reduce X_OFFSET to 0, and increase IMAGE_WIDTH to the full array.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx258: Implement HFLIP and VFLIP controls.
+
+The sensor supports H & V flips, so implement the relevant controls.
+Note that the Bayer order changes with these flips, therefore
+they set the V4L2_CTRL_FLAG_MODIFY_LAYOUT property.
+
+As we now support flips, remove the restriction of the sensor only
+probing if rotated 180 degrees, but do take that value and initialise
+VFLIP and HFLIP based on it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx258: Remove redundant I2C writes.
+
+Registers 0x0202 and 0x0203 are written via the control handler
+for V4L2_CID_EXPOSURE, so are not needed from the mode lists.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx258: Add regulator control
+
+The device tree bindings define the relevant regulators for the
+sensor, so update the driver to request the regulators and control
+them at the appropriate times.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx258: Make V4L2_CID_VBLANK configurable.
+
+The values and ranges of V4L2_CID_VBLANK are all computed,
+so there is no reason for it to be a read only control.
+Remove the register values from the mode lists, add the
+handler, and remove the read only flag.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx258: Register the ctrls from fwnode properties
+
+Use v4l2_ctrl_new_fwnode_properties to register the standard
+fwnode properties for the driver.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx258: Add support for 24MHz clock
+
+There's no reason why the clock must be 19.2MHz and nothing
+else (indeed this isn't even a frequency listed in the datasheet),
+so add support for 24MHz as well.
+The PLL settings result in slightly different link frequencies,
+so parameterise those.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx258: Add support for running on 2 CSI data lanes
+
+Extends the driver to also support 2 data lanes.
+Frame rates are obviously more restricted on 2 lanes, but some
+hardware simply hasn't wired more up.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx258: Follow normal V4L2 behaviours for clipping exposure
+
+V4L2 sensor drivers are expected are expected to clip the supported
+exposure range based on the VBLANK configured.
+IMX258 wasn't doing that as register 0x350 (FRM_LENGTH_CTL)
+switches it to a mode where frame length tracks coarse exposure time.
+
+Disable this mode and clip the range for V4L2_CID_EXPOSURE appropriately
+based on V4L2_CID_VBLANK.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx258: Add get_selection for pixel array information
+
+Libcamera requires the cropping information for each mode, so
+add this information to the driver.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx258: Allow configuration of clock lane behaviour
+
+The sensor supports the clock lane either remaining in HS mode
+during frame blanking, or dropping to LP11.
+
+Add configuration of the mode via V4L2_MBUS_CSI2_NONCONTINUOUS_CLOCK.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx258: Correct max FRM_LENGTH_LINES value
+
+The data sheet states that the maximum value for registers
+0x0340/0x0341 FRM_LENGTH_LINES is 65525(decimal), not the
+0xFFFF defined in this driver. Correct this limit.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx258: Add support for long exposure modes
+
+The sensor has a register CIT_LSHIFT which extends the exposure
+and frame times by the specified power of 2 for longer
+exposure times.
+
+Add support for this by configuring this register via V4L2_CID_VBLANK
+and extending the V4L2_CID_EXPOSURE range accordingly.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx258: Issue reset before starting streaming
+
+Whilst not documented, register 0x0103 bit 0 is the soft
+reset for the sensor, so send it before trying to configure
+the sensor.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx258: Set pixel_rate range to the same as the value
+
+With a read only control there is limited point in advertising
+a minimum and maximum for the control, so change to set the
+value, min, and max all to the selected pixel rate.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx258: Support faster pixel rate on binned modes
+
+With the binned modes, there is little point in faithfully
+reproducing the horizontal line length of 5352 pixels on the CSI2
+bus, and the FIFO between the pixel array and MIPI serialiser
+allows us to remove that dependency.
+
+Allow the pixel array to run with the normal settings, with the MIPI
+serialiser at half the rate. This requires some additional
+information for the link frequency to pixel rate function that
+needs to be added to the configuration tables.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: dt-bindings: imx258: Add alternate compatible strings
+
+There are a number of variants of the imx258 modules that can not
+be differentiated at runtime, so add compatible strings for them.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx258: Change register settings for variants of the sensor
+
+Sony have advised that there are variants of the IMX258 sensor which
+require slightly different register configuration to the mainline
+imx258 driver defaults.
+
+There is no available run-time detection for the variant, so add
+configuration via the DT compatible string.
+
+The Vision Components imx258 module supports PDAF, so add the
+register differences for that variant
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../devicetree/bindings/media/i2c/imx258.yaml |   3 +
+ drivers/media/i2c/imx258.c                    | 807 +++++++++++++++---
+ 2 files changed, 676 insertions(+), 134 deletions(-)
+
+--- a/Documentation/devicetree/bindings/media/i2c/imx258.yaml
++++ b/Documentation/devicetree/bindings/media/i2c/imx258.yaml
+@@ -14,10 +14,13 @@ description: |-
+   type stacked image sensor with a square pixel array of size 4208 x 3120. It
+   is programmable through I2C interface.  Image data is sent through MIPI
+   CSI-2.
++  There are a number of variants of the sensor which cannot be detected at
++  runtime, so multiple compatible strings are required to differentiate these.
+ 
+ properties:
+   compatible:
+     const: sony,imx258
++    const: sony,imx258-pdaf
+ 
+   assigned-clocks: true
+   assigned-clock-parents: true
+--- a/drivers/media/i2c/imx258.c
++++ b/drivers/media/i2c/imx258.c
+@@ -7,8 +7,10 @@
+ #include <linux/i2c.h>
+ #include <linux/module.h>
+ #include <linux/pm_runtime.h>
++#include <linux/regulator/consumer.h>
+ #include <media/v4l2-ctrls.h>
+ #include <media/v4l2-device.h>
++#include <media/v4l2-fwnode.h>
+ #include <asm/unaligned.h>
+ 
+ #define IMX258_REG_VALUE_08BIT		1
+@@ -18,6 +20,8 @@
+ #define IMX258_MODE_STANDBY		0x00
+ #define IMX258_MODE_STREAMING		0x01
+ 
++#define IMX258_REG_RESET		0x0103
++
+ /* Chip ID */
+ #define IMX258_REG_CHIP_ID		0x0016
+ #define IMX258_CHIP_ID			0x0258
+@@ -26,23 +30,20 @@
+ #define IMX258_VTS_30FPS		0x0c50
+ #define IMX258_VTS_30FPS_2K		0x0638
+ #define IMX258_VTS_30FPS_VGA		0x034c
+-#define IMX258_VTS_MAX			0xffff
++#define IMX258_VTS_MAX			65525
+ 
+-/*Frame Length Line*/
+-#define IMX258_FLL_MIN			0x08a6
+-#define IMX258_FLL_MAX			0xffff
+-#define IMX258_FLL_STEP			1
+-#define IMX258_FLL_DEFAULT		0x0c98
+-
+-/* HBLANK control - read only */
+-#define IMX258_PPL_DEFAULT		5352
++#define IMX258_REG_VTS			0x0340
+ 
+ /* Exposure control */
+ #define IMX258_REG_EXPOSURE		0x0202
++#define IMX258_EXPOSURE_OFFSET		10
+ #define IMX258_EXPOSURE_MIN		4
+ #define IMX258_EXPOSURE_STEP		1
+ #define IMX258_EXPOSURE_DEFAULT		0x640
+-#define IMX258_EXPOSURE_MAX		65535
++#define IMX258_EXPOSURE_MAX		(IMX258_VTS_MAX - IMX258_EXPOSURE_OFFSET)
++
++/* HBLANK control - read only */
++#define IMX258_PPL_DEFAULT		5352
+ 
+ /* Analog gain control */
+ #define IMX258_REG_ANALOG_GAIN		0x0204
+@@ -70,16 +71,28 @@
+ #define IMX258_HDR_RATIO_STEP		1
+ #define IMX258_HDR_RATIO_DEFAULT	0x0
+ 
++/* Long exposure multiplier */
++#define IMX258_LONG_EXP_SHIFT_MAX	7
++#define IMX258_LONG_EXP_SHIFT_REG	0x3002
++
+ /* Test Pattern Control */
+ #define IMX258_REG_TEST_PATTERN		0x0600
+ 
++#define IMX258_CLK_BLANK_STOP		0x4040
++
+ /* Orientation */
+ #define REG_MIRROR_FLIP_CONTROL		0x0101
+-#define REG_CONFIG_MIRROR_FLIP		0x03
++#define REG_CONFIG_MIRROR_HFLIP		0x01
++#define REG_CONFIG_MIRROR_VFLIP		0x02
+ #define REG_CONFIG_FLIP_TEST_PATTERN	0x02
+ 
+-/* Input clock frequency in Hz */
+-#define IMX258_INPUT_CLOCK_FREQ		19200000
++/* IMX258 native and active pixel array size. */
++#define IMX258_NATIVE_WIDTH		4224U
++#define IMX258_NATIVE_HEIGHT		3192U
++#define IMX258_PIXEL_ARRAY_LEFT		8U
++#define IMX258_PIXEL_ARRAY_TOP		16U
++#define IMX258_PIXEL_ARRAY_WIDTH	4208U
++#define IMX258_PIXEL_ARRAY_HEIGHT	3120U
+ 
+ struct imx258_reg {
+ 	u16 address;
+@@ -91,12 +104,22 @@ struct imx258_reg_list {
+ 	const struct imx258_reg *regs;
+ };
+ 
++struct imx258_link_cfg {
++	unsigned int lf_to_pix_rate_factor;
++	struct imx258_reg_list reg_list;
++};
++
++#define IMX258_LANE_CONFIGS	2
++#define IMX258_2_LANE_MODE	0
++#define IMX258_4_LANE_MODE	1
++
+ /* Link frequency config */
+ struct imx258_link_freq_config {
++	u64 link_frequency;
+ 	u32 pixels_per_line;
+ 
+-	/* PLL registers for this link frequency */
+-	struct imx258_reg_list reg_list;
++	/* Configuration for this link frequency / num lanes selection */
++	struct imx258_link_cfg link_cfg[IMX258_LANE_CONFIGS];
+ };
+ 
+ /* Mode : resolution and related config&values */
+@@ -114,10 +137,37 @@ struct imx258_mode {
+ 	u32 link_freq_index;
+ 	/* Default register values */
+ 	struct imx258_reg_list reg_list;
++
++	/* Analog crop rectangle. */
++	struct v4l2_rect crop;
++};
++
++/* 4208x3120 needs 1267Mbps/lane, 4 lanes. Use that rate on 2 lanes as well */
++static const struct imx258_reg mipi_1267mbps_19_2mhz_2l[] = {
++	{ 0x0136, 0x13 },
++	{ 0x0137, 0x33 },
++	{ 0x0301, 0x0A },
++	{ 0x0303, 0x02 },
++	{ 0x0305, 0x03 },
++	{ 0x0306, 0x00 },
++	{ 0x0307, 0xC6 },
++	{ 0x0309, 0x0A },
++	{ 0x030B, 0x01 },
++	{ 0x030D, 0x02 },
++	{ 0x030E, 0x00 },
++	{ 0x030F, 0xD8 },
++	{ 0x0310, 0x00 },
++
++	{ 0x0114, 0x01 },
++	{ 0x0820, 0x09 },
++	{ 0x0821, 0xa6 },
++	{ 0x0822, 0x66 },
++	{ 0x0823, 0x66 },
+ };
+ 
+-/* 4208x3118 needs 1267Mbps/lane, 4 lanes */
+-static const struct imx258_reg mipi_data_rate_1267mbps[] = {
++static const struct imx258_reg mipi_1267mbps_19_2mhz_4l[] = {
++	{ 0x0136, 0x13 },
++	{ 0x0137, 0x33 },
+ 	{ 0x0301, 0x05 },
+ 	{ 0x0303, 0x02 },
+ 	{ 0x0305, 0x03 },
+@@ -129,13 +179,61 @@ static const struct imx258_reg mipi_data
+ 	{ 0x030E, 0x00 },
+ 	{ 0x030F, 0xD8 },
+ 	{ 0x0310, 0x00 },
++
++	{ 0x0114, 0x03 },
++	{ 0x0820, 0x13 },
++	{ 0x0821, 0x4C },
++	{ 0x0822, 0xCC },
++	{ 0x0823, 0xCC },
++};
++
++static const struct imx258_reg mipi_1272mbps_24mhz_2l[] = {
++	{ 0x0136, 0x18 },
++	{ 0x0137, 0x00 },
++	{ 0x0301, 0x0a },
++	{ 0x0303, 0x02 },
++	{ 0x0305, 0x04 },
++	{ 0x0306, 0x00 },
++	{ 0x0307, 0xD4 },
++	{ 0x0309, 0x0A },
++	{ 0x030B, 0x01 },
++	{ 0x030D, 0x02 },
++	{ 0x030E, 0x00 },
++	{ 0x030F, 0xD8 },
++	{ 0x0310, 0x00 },
++
++	{ 0x0114, 0x01 },
+ 	{ 0x0820, 0x13 },
+ 	{ 0x0821, 0x4C },
+ 	{ 0x0822, 0xCC },
+ 	{ 0x0823, 0xCC },
+ };
+ 
+-static const struct imx258_reg mipi_data_rate_640mbps[] = {
++static const struct imx258_reg mipi_1272mbps_24mhz_4l[] = {
++	{ 0x0136, 0x18 },
++	{ 0x0137, 0x00 },
++	{ 0x0301, 0x05 },
++	{ 0x0303, 0x02 },
++	{ 0x0305, 0x04 },
++	{ 0x0306, 0x00 },
++	{ 0x0307, 0xD4 },
++	{ 0x0309, 0x0A },
++	{ 0x030B, 0x01 },
++	{ 0x030D, 0x02 },
++	{ 0x030E, 0x00 },
++	{ 0x030F, 0xD8 },
++	{ 0x0310, 0x00 },
++
++	{ 0x0114, 0x03 },
++	{ 0x0820, 0x13 },
++	{ 0x0821, 0xE0 },
++	{ 0x0822, 0x00 },
++	{ 0x0823, 0x00 },
++};
++
++static const struct imx258_reg mipi_640mbps_19_2mhz_2l[] = {
++	{ 0x0136, 0x13 },
++	{ 0x0137, 0x33 },
+ 	{ 0x0301, 0x05 },
+ 	{ 0x0303, 0x02 },
+ 	{ 0x0305, 0x03 },
+@@ -147,18 +245,82 @@ static const struct imx258_reg mipi_data
+ 	{ 0x030E, 0x00 },
+ 	{ 0x030F, 0xD8 },
+ 	{ 0x0310, 0x00 },
+-	{ 0x0820, 0x0A },
++
++	{ 0x0114, 0x01 },
++	{ 0x0820, 0x05 },
+ 	{ 0x0821, 0x00 },
+ 	{ 0x0822, 0x00 },
+ 	{ 0x0823, 0x00 },
+ };
+ 
+-static const struct imx258_reg mode_4208x3118_regs[] = {
++static const struct imx258_reg mipi_640mbps_19_2mhz_4l[] = {
+ 	{ 0x0136, 0x13 },
+ 	{ 0x0137, 0x33 },
++	{ 0x0301, 0x05 },
++	{ 0x0303, 0x02 },
++	{ 0x0305, 0x03 },
++	{ 0x0306, 0x00 },
++	{ 0x0307, 0x64 },
++	{ 0x0309, 0x0A },
++	{ 0x030B, 0x01 },
++	{ 0x030D, 0x02 },
++	{ 0x030E, 0x00 },
++	{ 0x030F, 0xD8 },
++	{ 0x0310, 0x00 },
++
++	{ 0x0114, 0x03 },
++	{ 0x0820, 0x0A },
++	{ 0x0821, 0x00 },
++	{ 0x0822, 0x00 },
++	{ 0x0823, 0x00 },
++};
++
++static const struct imx258_reg mipi_642mbps_24mhz_2l[] = {
++	{ 0x0136, 0x18 },
++	{ 0x0137, 0x00 },
++	{ 0x0301, 0x05 },
++	{ 0x0303, 0x02 },
++	{ 0x0305, 0x04 },
++	{ 0x0306, 0x00 },
++	{ 0x0307, 0x6B },
++	{ 0x0309, 0x0A },
++	{ 0x030B, 0x01 },
++	{ 0x030D, 0x02 },
++	{ 0x030E, 0x00 },
++	{ 0x030F, 0xD8 },
++	{ 0x0310, 0x00 },
++
++	{ 0x0114, 0x01 },
++	{ 0x0820, 0x0A },
++	{ 0x0821, 0x00 },
++	{ 0x0822, 0x00 },
++	{ 0x0823, 0x00 },
++};
++
++static const struct imx258_reg mipi_642mbps_24mhz_4l[] = {
++	{ 0x0136, 0x18 },
++	{ 0x0137, 0x00 },
++	{ 0x0301, 0x05 },
++	{ 0x0303, 0x02 },
++	{ 0x0305, 0x04 },
++	{ 0x0306, 0x00 },
++	{ 0x0307, 0x6B },
++	{ 0x0309, 0x0A },
++	{ 0x030B, 0x01 },
++	{ 0x030D, 0x02 },
++	{ 0x030E, 0x00 },
++	{ 0x030F, 0xD8 },
++	{ 0x0310, 0x00 },
++
++	{ 0x0114, 0x03 },
++	{ 0x0820, 0x0A },
++	{ 0x0821, 0x00 },
++	{ 0x0822, 0x00 },
++	{ 0x0823, 0x00 },
++};
++
++static const struct imx258_reg mode_4208x3120_regs[] = {
+ 	{ 0x3051, 0x00 },
+-	{ 0x3052, 0x00 },
+-	{ 0x4E21, 0x14 },
+ 	{ 0x6B11, 0xCF },
+ 	{ 0x7FF0, 0x08 },
+ 	{ 0x7FF1, 0x0F },
+@@ -181,7 +343,6 @@ static const struct imx258_reg mode_4208
+ 	{ 0x7FA8, 0x03 },
+ 	{ 0x7FA9, 0xFE },
+ 	{ 0x7B24, 0x81 },
+-	{ 0x7B25, 0x00 },
+ 	{ 0x6564, 0x07 },
+ 	{ 0x6B0D, 0x41 },
+ 	{ 0x653D, 0x04 },
+@@ -203,11 +364,8 @@ static const struct imx258_reg mode_4208
+ 	{ 0x5F05, 0xED },
+ 	{ 0x0112, 0x0A },
+ 	{ 0x0113, 0x0A },
+-	{ 0x0114, 0x03 },
+ 	{ 0x0342, 0x14 },
+ 	{ 0x0343, 0xE8 },
+-	{ 0x0340, 0x0C },
+-	{ 0x0341, 0x50 },
+ 	{ 0x0344, 0x00 },
+ 	{ 0x0345, 0x00 },
+ 	{ 0x0346, 0x00 },
+@@ -215,7 +373,7 @@ static const struct imx258_reg mode_4208
+ 	{ 0x0348, 0x10 },
+ 	{ 0x0349, 0x6F },
+ 	{ 0x034A, 0x0C },
+-	{ 0x034B, 0x2E },
++	{ 0x034B, 0x2F },
+ 	{ 0x0381, 0x01 },
+ 	{ 0x0383, 0x01 },
+ 	{ 0x0385, 0x01 },
+@@ -241,9 +399,7 @@ static const struct imx258_reg mode_4208
+ 	{ 0x034D, 0x70 },
+ 	{ 0x034E, 0x0C },
+ 	{ 0x034F, 0x30 },
+-	{ 0x0350, 0x01 },
+-	{ 0x0202, 0x0C },
+-	{ 0x0203, 0x46 },
++	{ 0x0350, 0x00 },
+ 	{ 0x0204, 0x00 },
+ 	{ 0x0205, 0x00 },
+ 	{ 0x020E, 0x01 },
+@@ -273,11 +429,7 @@ static const struct imx258_reg mode_4208
+ };
+ 
+ static const struct imx258_reg mode_2104_1560_regs[] = {
+-	{ 0x0136, 0x13 },
+-	{ 0x0137, 0x33 },
+ 	{ 0x3051, 0x00 },
+-	{ 0x3052, 0x00 },
+-	{ 0x4E21, 0x14 },
+ 	{ 0x6B11, 0xCF },
+ 	{ 0x7FF0, 0x08 },
+ 	{ 0x7FF1, 0x0F },
+@@ -300,7 +452,6 @@ static const struct imx258_reg mode_2104
+ 	{ 0x7FA8, 0x03 },
+ 	{ 0x7FA9, 0xFE },
+ 	{ 0x7B24, 0x81 },
+-	{ 0x7B25, 0x00 },
+ 	{ 0x6564, 0x07 },
+ 	{ 0x6B0D, 0x41 },
+ 	{ 0x653D, 0x04 },
+@@ -322,11 +473,8 @@ static const struct imx258_reg mode_2104
+ 	{ 0x5F05, 0xED },
+ 	{ 0x0112, 0x0A },
+ 	{ 0x0113, 0x0A },
+-	{ 0x0114, 0x03 },
+ 	{ 0x0342, 0x14 },
+ 	{ 0x0343, 0xE8 },
+-	{ 0x0340, 0x06 },
+-	{ 0x0341, 0x38 },
+ 	{ 0x0344, 0x00 },
+ 	{ 0x0345, 0x00 },
+ 	{ 0x0346, 0x00 },
+@@ -334,7 +482,7 @@ static const struct imx258_reg mode_2104
+ 	{ 0x0348, 0x10 },
+ 	{ 0x0349, 0x6F },
+ 	{ 0x034A, 0x0C },
+-	{ 0x034B, 0x2E },
++	{ 0x034B, 0x2F },
+ 	{ 0x0381, 0x01 },
+ 	{ 0x0383, 0x01 },
+ 	{ 0x0385, 0x01 },
+@@ -345,11 +493,11 @@ static const struct imx258_reg mode_2104
+ 	{ 0x0404, 0x00 },
+ 	{ 0x0405, 0x20 },
+ 	{ 0x0408, 0x00 },
+-	{ 0x0409, 0x02 },
++	{ 0x0409, 0x00 },
+ 	{ 0x040A, 0x00 },
+ 	{ 0x040B, 0x00 },
+ 	{ 0x040C, 0x10 },
+-	{ 0x040D, 0x6A },
++	{ 0x040D, 0x70 },
+ 	{ 0x040E, 0x06 },
+ 	{ 0x040F, 0x18 },
+ 	{ 0x3038, 0x00 },
+@@ -360,9 +508,7 @@ static const struct imx258_reg mode_2104
+ 	{ 0x034D, 0x38 },
+ 	{ 0x034E, 0x06 },
+ 	{ 0x034F, 0x18 },
+-	{ 0x0350, 0x01 },
+-	{ 0x0202, 0x06 },
+-	{ 0x0203, 0x2E },
++	{ 0x0350, 0x00 },
+ 	{ 0x0204, 0x00 },
+ 	{ 0x0205, 0x00 },
+ 	{ 0x020E, 0x01 },
+@@ -392,11 +538,7 @@ static const struct imx258_reg mode_2104
+ };
+ 
+ static const struct imx258_reg mode_1048_780_regs[] = {
+-	{ 0x0136, 0x13 },
+-	{ 0x0137, 0x33 },
+ 	{ 0x3051, 0x00 },
+-	{ 0x3052, 0x00 },
+-	{ 0x4E21, 0x14 },
+ 	{ 0x6B11, 0xCF },
+ 	{ 0x7FF0, 0x08 },
+ 	{ 0x7FF1, 0x0F },
+@@ -419,7 +561,6 @@ static const struct imx258_reg mode_1048
+ 	{ 0x7FA8, 0x03 },
+ 	{ 0x7FA9, 0xFE },
+ 	{ 0x7B24, 0x81 },
+-	{ 0x7B25, 0x00 },
+ 	{ 0x6564, 0x07 },
+ 	{ 0x6B0D, 0x41 },
+ 	{ 0x653D, 0x04 },
+@@ -441,11 +582,8 @@ static const struct imx258_reg mode_1048
+ 	{ 0x5F05, 0xED },
+ 	{ 0x0112, 0x0A },
+ 	{ 0x0113, 0x0A },
+-	{ 0x0114, 0x03 },
+ 	{ 0x0342, 0x14 },
+ 	{ 0x0343, 0xE8 },
+-	{ 0x0340, 0x03 },
+-	{ 0x0341, 0x4C },
+ 	{ 0x0344, 0x00 },
+ 	{ 0x0345, 0x00 },
+ 	{ 0x0346, 0x00 },
+@@ -453,7 +591,7 @@ static const struct imx258_reg mode_1048
+ 	{ 0x0348, 0x10 },
+ 	{ 0x0349, 0x6F },
+ 	{ 0x034A, 0x0C },
+-	{ 0x034B, 0x2E },
++	{ 0x034B, 0x2F },
+ 	{ 0x0381, 0x01 },
+ 	{ 0x0383, 0x01 },
+ 	{ 0x0385, 0x01 },
+@@ -464,11 +602,11 @@ static const struct imx258_reg mode_1048
+ 	{ 0x0404, 0x00 },
+ 	{ 0x0405, 0x40 },
+ 	{ 0x0408, 0x00 },
+-	{ 0x0409, 0x06 },
++	{ 0x0409, 0x00 },
+ 	{ 0x040A, 0x00 },
+ 	{ 0x040B, 0x00 },
+ 	{ 0x040C, 0x10 },
+-	{ 0x040D, 0x64 },
++	{ 0x040D, 0x70 },
+ 	{ 0x040E, 0x03 },
+ 	{ 0x040F, 0x0C },
+ 	{ 0x3038, 0x00 },
+@@ -479,9 +617,7 @@ static const struct imx258_reg mode_1048
+ 	{ 0x034D, 0x18 },
+ 	{ 0x034E, 0x03 },
+ 	{ 0x034F, 0x0C },
+-	{ 0x0350, 0x01 },
+-	{ 0x0202, 0x03 },
+-	{ 0x0203, 0x42 },
++	{ 0x0350, 0x00 },
+ 	{ 0x0204, 0x00 },
+ 	{ 0x0205, 0x00 },
+ 	{ 0x020E, 0x01 },
+@@ -510,6 +646,49 @@ static const struct imx258_reg mode_1048
+ 	{ 0x0220, 0x00 },
+ };
+ 
++struct imx258_variant_cfg {
++	const struct imx258_reg *regs;
++	unsigned int num_regs;
++};
++
++static const struct imx258_reg imx258_cfg_regs[] = {
++	{ 0x3052, 0x00 },
++	{ 0x4E21, 0x14 },
++	{ 0x7B25, 0x00 },
++};
++
++static const struct imx258_variant_cfg imx258_cfg = {
++	.regs = imx258_cfg_regs,
++	.num_regs = ARRAY_SIZE(imx258_cfg_regs),
++};
++
++static const struct imx258_reg imx258_pdaf_cfg_regs[] = {
++	{ 0x3052, 0x01 },
++	{ 0x4E21, 0x10 },
++	{ 0x7B25, 0x01 },
++};
++
++static const struct imx258_variant_cfg imx258_pdaf_cfg = {
++	.regs = imx258_pdaf_cfg_regs,
++	.num_regs = ARRAY_SIZE(imx258_pdaf_cfg_regs),
++};
++
++/*
++ * The supported formats.
++ * This table MUST contain 4 entries per format, to cover the various flip
++ * combinations in the order
++ * - no flip
++ * - h flip
++ * - v flip
++ * - h&v flips
++ */
++static const u32 codes[] = {
++	/* 10-bit modes. */
++	MEDIA_BUS_FMT_SRGGB10_1X10,
++	MEDIA_BUS_FMT_SGRBG10_1X10,
++	MEDIA_BUS_FMT_SGBRG10_1X10,
++	MEDIA_BUS_FMT_SBGGR10_1X10
++};
+ static const char * const imx258_test_pattern_menu[] = {
+ 	"Disabled",
+ 	"Solid Colour",
+@@ -518,9 +697,15 @@ static const char * const imx258_test_pa
+ 	"Pseudorandom Sequence (PN9)",
+ };
+ 
+-/* Configurations for supported link frequencies */
+-#define IMX258_LINK_FREQ_634MHZ	633600000ULL
+-#define IMX258_LINK_FREQ_320MHZ	320000000ULL
++/* regulator supplies */
++static const char * const imx258_supply_name[] = {
++	/* Supplies can be enabled in any order */
++	"vana",  /* Analog (2.8V) supply */
++	"vdig",  /* Digital Core (1.05V) supply */
++	"vif",  /* IF (1.8V) supply */
++};
++
++#define IMX258_NUM_SUPPLIES ARRAY_SIZE(imx258_supply_name)
+ 
+ enum {
+ 	IMX258_LINK_FREQ_1267MBPS,
+@@ -528,37 +713,103 @@ enum {
+ };
+ 
+ /*
+- * pixel_rate = link_freq * data-rate * nr_of_lanes / bits_per_sample
+- * data rate => double data rate; number of lanes => 4; bits per pixel => 10
++ * Pixel rate does not necessarily relate to link frequency on this sensor as
++ * there is a FIFO between the pixel array pipeline and the MIPI serializer.
++ * The recommendation from Sony is that the pixel array is always run with a
++ * line length of 5352 pixels, which means that there is a large amount of
++ * blanking time for the 1048x780 mode. There is no need to replicate this
++ * blanking on the CSI2 bus, and the configuration of register 0x0301 allows the
++ * divider to be altered.
++ *
++ * The actual factor between link frequency and pixel rate is in the
++ * imx258_link_cfg, so use this to convert between the two.
++ * bits per pixel being 10, and D-PHY being DDR is assumed by this function, so
++ * the value is only the combination of number of lanes and pixel clock divider.
+  */
+-static u64 link_freq_to_pixel_rate(u64 f)
++static u64 link_freq_to_pixel_rate(u64 f, const struct imx258_link_cfg *link_cfg)
+ {
+-	f *= 2 * 4;
++	f *= 2 * link_cfg->lf_to_pix_rate_factor;
+ 	do_div(f, 10);
+ 
+ 	return f;
+ }
+ 
+ /* Menu items for LINK_FREQ V4L2 control */
+-static const s64 link_freq_menu_items[] = {
++/* Configurations for supported link frequencies */
++#define IMX258_LINK_FREQ_634MHZ	633600000ULL
++#define IMX258_LINK_FREQ_320MHZ	320000000ULL
++
++static const s64 link_freq_menu_items_19_2[] = {
+ 	IMX258_LINK_FREQ_634MHZ,
+ 	IMX258_LINK_FREQ_320MHZ,
+ };
+ 
++/* Configurations for supported link frequencies */
++#define IMX258_LINK_FREQ_636MHZ	636000000ULL
++#define IMX258_LINK_FREQ_321MHZ	321000000ULL
++
++static const s64 link_freq_menu_items_24[] = {
++	IMX258_LINK_FREQ_636MHZ,
++	IMX258_LINK_FREQ_321MHZ,
++};
++
++#define REGS(_list) { .num_of_regs = ARRAY_SIZE(_list), .regs = _list, }
++
+ /* Link frequency configs */
+-static const struct imx258_link_freq_config link_freq_configs[] = {
++static const struct imx258_link_freq_config link_freq_configs_19_2[] = {
+ 	[IMX258_LINK_FREQ_1267MBPS] = {
+ 		.pixels_per_line = IMX258_PPL_DEFAULT,
+-		.reg_list = {
+-			.num_of_regs = ARRAY_SIZE(mipi_data_rate_1267mbps),
+-			.regs = mipi_data_rate_1267mbps,
++		.link_cfg = {
++			[IMX258_2_LANE_MODE] = {
++				.lf_to_pix_rate_factor = 2 * 2,
++				.reg_list = REGS(mipi_1267mbps_19_2mhz_2l),
++			},
++			[IMX258_4_LANE_MODE] = {
++				.lf_to_pix_rate_factor = 4,
++				.reg_list = REGS(mipi_1267mbps_19_2mhz_4l),
++			},
+ 		}
+ 	},
+ 	[IMX258_LINK_FREQ_640MBPS] = {
+ 		.pixels_per_line = IMX258_PPL_DEFAULT,
+-		.reg_list = {
+-			.num_of_regs = ARRAY_SIZE(mipi_data_rate_640mbps),
+-			.regs = mipi_data_rate_640mbps,
++		.link_cfg = {
++			[IMX258_2_LANE_MODE] = {
++				.lf_to_pix_rate_factor = 2,
++				.reg_list = REGS(mipi_640mbps_19_2mhz_2l),
++			},
++			[IMX258_4_LANE_MODE] = {
++				.lf_to_pix_rate_factor = 4,
++				.reg_list = REGS(mipi_640mbps_19_2mhz_4l),
++			},
++		}
++	},
++};
++
++static const struct imx258_link_freq_config link_freq_configs_24[] = {
++	[IMX258_LINK_FREQ_1267MBPS] = {
++		.pixels_per_line = IMX258_PPL_DEFAULT,
++		.link_cfg = {
++			[IMX258_2_LANE_MODE] = {
++				.lf_to_pix_rate_factor = 2,
++				.reg_list = REGS(mipi_1272mbps_24mhz_2l),
++			},
++			[IMX258_4_LANE_MODE] = {
++				.lf_to_pix_rate_factor = 4,
++				.reg_list = REGS(mipi_1272mbps_24mhz_4l),
++			},
++		}
++	},
++	[IMX258_LINK_FREQ_640MBPS] = {
++		.pixels_per_line = IMX258_PPL_DEFAULT,
++		.link_cfg = {
++			[IMX258_2_LANE_MODE] = {
++				.lf_to_pix_rate_factor = 2 * 2,
++				.reg_list = REGS(mipi_642mbps_24mhz_2l),
++			},
++			[IMX258_4_LANE_MODE] = {
++				.lf_to_pix_rate_factor = 4,
++				.reg_list = REGS(mipi_642mbps_24mhz_4l),
++			},
+ 		}
+ 	},
+ };
+@@ -567,14 +818,20 @@ static const struct imx258_link_freq_con
+ static const struct imx258_mode supported_modes[] = {
+ 	{
+ 		.width = 4208,
+-		.height = 3118,
++		.height = 3120,
+ 		.vts_def = IMX258_VTS_30FPS,
+ 		.vts_min = IMX258_VTS_30FPS,
+ 		.reg_list = {
+-			.num_of_regs = ARRAY_SIZE(mode_4208x3118_regs),
+-			.regs = mode_4208x3118_regs,
++			.num_of_regs = ARRAY_SIZE(mode_4208x3120_regs),
++			.regs = mode_4208x3120_regs,
+ 		},
+ 		.link_freq_index = IMX258_LINK_FREQ_1267MBPS,
++		.crop = {
++			.left = IMX258_PIXEL_ARRAY_LEFT,
++			.top = IMX258_PIXEL_ARRAY_TOP,
++			.width = 4208,
++			.height = 3120,
++		},
+ 	},
+ 	{
+ 		.width = 2104,
+@@ -586,6 +843,12 @@ static const struct imx258_mode supporte
+ 			.regs = mode_2104_1560_regs,
+ 		},
+ 		.link_freq_index = IMX258_LINK_FREQ_640MBPS,
++		.crop = {
++			.left = IMX258_PIXEL_ARRAY_LEFT,
++			.top = IMX258_PIXEL_ARRAY_TOP,
++			.width = 4208,
++			.height = 3120,
++		},
+ 	},
+ 	{
+ 		.width = 1048,
+@@ -597,6 +860,12 @@ static const struct imx258_mode supporte
+ 			.regs = mode_1048_780_regs,
+ 		},
+ 		.link_freq_index = IMX258_LINK_FREQ_640MBPS,
++		.crop = {
++			.left = IMX258_PIXEL_ARRAY_LEFT,
++			.top = IMX258_PIXEL_ARRAY_TOP,
++			.width = 4208,
++			.height = 3120,
++		},
+ 	},
+ };
+ 
+@@ -604,6 +873,8 @@ struct imx258 {
+ 	struct v4l2_subdev sd;
+ 	struct media_pad pad;
+ 
++	const struct imx258_variant_cfg *variant_cfg;
++
+ 	struct v4l2_ctrl_handler ctrl_handler;
+ 	/* V4L2 Controls */
+ 	struct v4l2_ctrl *link_freq;
+@@ -611,10 +882,19 @@ struct imx258 {
+ 	struct v4l2_ctrl *vblank;
+ 	struct v4l2_ctrl *hblank;
+ 	struct v4l2_ctrl *exposure;
++	struct v4l2_ctrl *hflip;
++	struct v4l2_ctrl *vflip;
++	/* Current long exposure factor in use. Set through V4L2_CID_VBLANK */
++	unsigned int long_exp_shift;
+ 
+ 	/* Current mode */
+ 	const struct imx258_mode *cur_mode;
+ 
++	const struct imx258_link_freq_config *link_freq_configs;
++	const s64 *link_freq_menu_items;
++	unsigned int lane_mode_idx;
++	unsigned int csi2_flags;
++
+ 	/*
+ 	 * Mutex for serialized access:
+ 	 * Protect sensor module set pad format and start/stop streaming safely.
+@@ -625,6 +905,7 @@ struct imx258 {
+ 	bool streaming;
+ 
+ 	struct clk *clk;
++	struct regulator_bulk_data supplies[IMX258_NUM_SUPPLIES];
+ };
+ 
+ static inline struct imx258 *to_imx258(struct v4l2_subdev *_sd)
+@@ -706,18 +987,39 @@ static int imx258_write_regs(struct imx2
+ 	return 0;
+ }
+ 
++/* Get bayer order based on flip setting. */
++static u32 imx258_get_format_code(struct imx258 *imx258)
++{
++	unsigned int i;
++
++	lockdep_assert_held(&imx258->mutex);
++
++	i = (imx258->vflip->val ? 2 : 0) |
++	    (imx258->hflip->val ? 1 : 0);
++
++	return codes[i];
++}
+ /* Open sub-device */
+ static int imx258_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
+ {
++	struct imx258 *imx258 = to_imx258(sd);
+ 	struct v4l2_mbus_framefmt *try_fmt =
+ 		v4l2_subdev_get_try_format(sd, fh->state, 0);
++	struct v4l2_rect *try_crop;
+ 
+ 	/* Initialize try_fmt */
+ 	try_fmt->width = supported_modes[0].width;
+ 	try_fmt->height = supported_modes[0].height;
+-	try_fmt->code = MEDIA_BUS_FMT_SGRBG10_1X10;
++	try_fmt->code = imx258_get_format_code(imx258);
+ 	try_fmt->field = V4L2_FIELD_NONE;
+ 
++	/* Initialize try_crop */
++	try_crop = v4l2_subdev_get_try_crop(sd, fh->state, 0);
++	try_crop->left = IMX258_PIXEL_ARRAY_LEFT;
++	try_crop->top = IMX258_PIXEL_ARRAY_TOP;
++	try_crop->width = IMX258_PIXEL_ARRAY_WIDTH;
++	try_crop->height = IMX258_PIXEL_ARRAY_HEIGHT;
++
+ 	return 0;
+ }
+ 
+@@ -748,6 +1050,39 @@ static int imx258_update_digital_gain(st
+ 	return 0;
+ }
+ 
++static void imx258_adjust_exposure_range(struct imx258 *imx258)
++{
++	int exposure_max, exposure_def;
++
++	/* Honour the VBLANK limits when setting exposure. */
++	exposure_max = imx258->cur_mode->height + imx258->vblank->val -
++		       IMX258_EXPOSURE_OFFSET;
++	exposure_def = min(exposure_max, imx258->exposure->val);
++	__v4l2_ctrl_modify_range(imx258->exposure, imx258->exposure->minimum,
++				 exposure_max, imx258->exposure->step,
++				 exposure_def);
++}
++
++static int imx258_set_frame_length(struct imx258 *imx258, unsigned int val)
++{
++	int ret;
++
++	imx258->long_exp_shift = 0;
++
++	while (val > IMX258_VTS_MAX) {
++		imx258->long_exp_shift++;
++		val >>= 1;
++	}
++
++	ret = imx258_write_reg(imx258, IMX258_REG_VTS,
++			       IMX258_REG_VALUE_16BIT, val);
++	if (ret)
++		return ret;
++
++	return imx258_write_reg(imx258, IMX258_LONG_EXP_SHIFT_REG,
++				IMX258_REG_VALUE_08BIT, imx258->long_exp_shift);
++}
++
+ static int imx258_set_ctrl(struct v4l2_ctrl *ctrl)
+ {
+ 	struct imx258 *imx258 =
+@@ -756,6 +1091,13 @@ static int imx258_set_ctrl(struct v4l2_c
+ 	int ret = 0;
+ 
+ 	/*
++	 * The VBLANK control may change the limits of usable exposure, so check
++	 * and adjust if necessary.
++	 */
++	if (ctrl->id == V4L2_CID_VBLANK)
++		imx258_adjust_exposure_range(imx258);
++
++	/*
+ 	 * Applying V4L2 control value only happens
+ 	 * when power is up for streaming
+ 	 */
+@@ -771,7 +1113,7 @@ static int imx258_set_ctrl(struct v4l2_c
+ 	case V4L2_CID_EXPOSURE:
+ 		ret = imx258_write_reg(imx258, IMX258_REG_EXPOSURE,
+ 				IMX258_REG_VALUE_16BIT,
+-				ctrl->val);
++				ctrl->val >> imx258->long_exp_shift);
+ 		break;
+ 	case V4L2_CID_DIGITAL_GAIN:
+ 		ret = imx258_update_digital_gain(imx258, IMX258_REG_VALUE_16BIT,
+@@ -781,10 +1123,6 @@ static int imx258_set_ctrl(struct v4l2_c
+ 		ret = imx258_write_reg(imx258, IMX258_REG_TEST_PATTERN,
+ 				IMX258_REG_VALUE_16BIT,
+ 				ctrl->val);
+-		ret = imx258_write_reg(imx258, REG_MIRROR_FLIP_CONTROL,
+-				IMX258_REG_VALUE_08BIT,
+-				!ctrl->val ? REG_CONFIG_MIRROR_FLIP :
+-				REG_CONFIG_FLIP_TEST_PATTERN);
+ 		break;
+ 	case V4L2_CID_WIDE_DYNAMIC_RANGE:
+ 		if (!ctrl->val) {
+@@ -802,6 +1140,19 @@ static int imx258_set_ctrl(struct v4l2_c
+ 					       BIT(IMX258_HDR_RATIO_MAX));
+ 		}
+ 		break;
++	case V4L2_CID_VBLANK:
++		ret = imx258_set_frame_length(imx258,
++					      imx258->cur_mode->height + ctrl->val);
++		break;
++	case V4L2_CID_VFLIP:
++	case V4L2_CID_HFLIP:
++		ret = imx258_write_reg(imx258, REG_MIRROR_FLIP_CONTROL,
++				       IMX258_REG_VALUE_08BIT,
++				       (imx258->hflip->val ?
++					REG_CONFIG_MIRROR_HFLIP : 0) |
++				       (imx258->vflip->val ?
++					REG_CONFIG_MIRROR_VFLIP : 0));
++		break;
+ 	default:
+ 		dev_info(&client->dev,
+ 			 "ctrl(id:0x%x,val:0x%x) is not handled\n",
+@@ -823,11 +1174,13 @@ static int imx258_enum_mbus_code(struct
+ 				  struct v4l2_subdev_state *sd_state,
+ 				  struct v4l2_subdev_mbus_code_enum *code)
+ {
+-	/* Only one bayer order(GRBG) is supported */
++	struct imx258 *imx258 = to_imx258(sd);
++
++	/* Only one bayer format (10 bit) is supported */
+ 	if (code->index > 0)
+ 		return -EINVAL;
+ 
+-	code->code = MEDIA_BUS_FMT_SGRBG10_1X10;
++	code->code = imx258_get_format_code(imx258);
+ 
+ 	return 0;
+ }
+@@ -836,10 +1189,11 @@ static int imx258_enum_frame_size(struct
+ 				  struct v4l2_subdev_state *sd_state,
+ 				  struct v4l2_subdev_frame_size_enum *fse)
+ {
++	struct imx258 *imx258 = to_imx258(sd);
+ 	if (fse->index >= ARRAY_SIZE(supported_modes))
+ 		return -EINVAL;
+ 
+-	if (fse->code != MEDIA_BUS_FMT_SGRBG10_1X10)
++	if (fse->code != imx258_get_format_code(imx258))
+ 		return -EINVAL;
+ 
+ 	fse->min_width = supported_modes[fse->index].width;
+@@ -850,12 +1204,13 @@ static int imx258_enum_frame_size(struct
+ 	return 0;
+ }
+ 
+-static void imx258_update_pad_format(const struct imx258_mode *mode,
++static void imx258_update_pad_format(struct imx258 *imx258,
++				     const struct imx258_mode *mode,
+ 				     struct v4l2_subdev_format *fmt)
+ {
+ 	fmt->format.width = mode->width;
+ 	fmt->format.height = mode->height;
+-	fmt->format.code = MEDIA_BUS_FMT_SGRBG10_1X10;
++	fmt->format.code = imx258_get_format_code(imx258);
+ 	fmt->format.field = V4L2_FIELD_NONE;
+ }
+ 
+@@ -868,7 +1223,7 @@ static int __imx258_get_pad_format(struc
+ 							  sd_state,
+ 							  fmt->pad);
+ 	else
+-		imx258_update_pad_format(imx258->cur_mode, fmt);
++		imx258_update_pad_format(imx258, imx258->cur_mode, fmt);
+ 
+ 	return 0;
+ }
+@@ -892,8 +1247,10 @@ static int imx258_set_pad_format(struct
+ 				 struct v4l2_subdev_format *fmt)
+ {
+ 	struct imx258 *imx258 = to_imx258(sd);
+-	const struct imx258_mode *mode;
++	const struct imx258_link_freq_config *link_freq_cfgs;
++	const struct imx258_link_cfg *link_cfg;
+ 	struct v4l2_mbus_framefmt *framefmt;
++	const struct imx258_mode *mode;
+ 	s32 vblank_def;
+ 	s32 vblank_min;
+ 	s64 h_blank;
+@@ -902,13 +1259,12 @@ static int imx258_set_pad_format(struct
+ 
+ 	mutex_lock(&imx258->mutex);
+ 
+-	/* Only one raw bayer(GBRG) order is supported */
+-	fmt->format.code = MEDIA_BUS_FMT_SGRBG10_1X10;
++	fmt->format.code = imx258_get_format_code(imx258);
+ 
+ 	mode = v4l2_find_nearest_size(supported_modes,
+ 		ARRAY_SIZE(supported_modes), width, height,
+ 		fmt->format.width, fmt->format.height);
+-	imx258_update_pad_format(mode, fmt);
++	imx258_update_pad_format(imx258, mode, fmt);
+ 	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
+ 		framefmt = v4l2_subdev_get_try_format(sd, sd_state, fmt->pad);
+ 		*framefmt = fmt->format;
+@@ -916,9 +1272,14 @@ static int imx258_set_pad_format(struct
+ 		imx258->cur_mode = mode;
+ 		__v4l2_ctrl_s_ctrl(imx258->link_freq, mode->link_freq_index);
+ 
+-		link_freq = link_freq_menu_items[mode->link_freq_index];
+-		pixel_rate = link_freq_to_pixel_rate(link_freq);
+-		__v4l2_ctrl_s_ctrl_int64(imx258->pixel_rate, pixel_rate);
++		link_freq = imx258->link_freq_menu_items[mode->link_freq_index];
++		link_freq_cfgs =
++			&imx258->link_freq_configs[mode->link_freq_index];
++
++		link_cfg = &link_freq_cfgs->link_cfg[imx258->lane_mode_idx];
++		pixel_rate = link_freq_to_pixel_rate(link_freq, link_cfg);
++		__v4l2_ctrl_modify_range(imx258->pixel_rate, pixel_rate,
++					 pixel_rate, 1, pixel_rate);
+ 		/* Update limits and set FPS to default */
+ 		vblank_def = imx258->cur_mode->vts_def -
+ 			     imx258->cur_mode->height;
+@@ -926,11 +1287,12 @@ static int imx258_set_pad_format(struct
+ 			     imx258->cur_mode->height;
+ 		__v4l2_ctrl_modify_range(
+ 			imx258->vblank, vblank_min,
+-			IMX258_VTS_MAX - imx258->cur_mode->height, 1,
+-			vblank_def);
++			((1 << IMX258_LONG_EXP_SHIFT_MAX) * IMX258_VTS_MAX) -
++						imx258->cur_mode->height,
++			1, vblank_def);
+ 		__v4l2_ctrl_s_ctrl(imx258->vblank, vblank_def);
+ 		h_blank =
+-			link_freq_configs[mode->link_freq_index].pixels_per_line
++			imx258->link_freq_configs[mode->link_freq_index].pixels_per_line
+ 			 - imx258->cur_mode->width;
+ 		__v4l2_ctrl_modify_range(imx258->hblank, h_blank,
+ 					 h_blank, 1, h_blank);
+@@ -941,36 +1303,107 @@ static int imx258_set_pad_format(struct
+ 	return 0;
+ }
+ 
++static const struct v4l2_rect *
++__imx258_get_pad_crop(struct imx258 *imx258,
++		      struct v4l2_subdev_state *sd_state,
++		      unsigned int pad, enum v4l2_subdev_format_whence which)
++{
++	switch (which) {
++	case V4L2_SUBDEV_FORMAT_TRY:
++		return v4l2_subdev_get_try_crop(&imx258->sd, sd_state, pad);
++	case V4L2_SUBDEV_FORMAT_ACTIVE:
++		return &imx258->cur_mode->crop;
++	}
++
++	return NULL;
++}
++
++static int imx258_get_selection(struct v4l2_subdev *sd,
++				struct v4l2_subdev_state *sd_state,
++				struct v4l2_subdev_selection *sel)
++{
++	switch (sel->target) {
++	case V4L2_SEL_TGT_CROP: {
++		struct imx258 *imx258 = to_imx258(sd);
++
++		mutex_lock(&imx258->mutex);
++		sel->r = *__imx258_get_pad_crop(imx258, sd_state, sel->pad,
++						sel->which);
++		mutex_unlock(&imx258->mutex);
++
++		return 0;
++	}
++
++	case V4L2_SEL_TGT_NATIVE_SIZE:
++		sel->r.left = 0;
++		sel->r.top = 0;
++		sel->r.width = IMX258_NATIVE_WIDTH;
++		sel->r.height = IMX258_NATIVE_HEIGHT;
++
++		return 0;
++
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++	case V4L2_SEL_TGT_CROP_BOUNDS:
++		sel->r.left = IMX258_PIXEL_ARRAY_LEFT;
++		sel->r.top = IMX258_PIXEL_ARRAY_TOP;
++		sel->r.width = IMX258_PIXEL_ARRAY_WIDTH;
++		sel->r.height = IMX258_PIXEL_ARRAY_HEIGHT;
++
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
+ /* Start streaming */
+ static int imx258_start_streaming(struct imx258 *imx258)
+ {
+ 	struct i2c_client *client = v4l2_get_subdevdata(&imx258->sd);
+ 	const struct imx258_reg_list *reg_list;
++	const struct imx258_link_freq_config *link_freq_cfg;
+ 	int ret, link_freq_index;
+ 
++	ret = imx258_write_reg(imx258, IMX258_REG_RESET, IMX258_REG_VALUE_08BIT,
++			       0x01);
++	if (ret) {
++		dev_err(&client->dev, "%s failed to reset sensor\n", __func__);
++		return ret;
++	}
++	usleep_range(10000, 15000);
++
+ 	/* Setup PLL */
+ 	link_freq_index = imx258->cur_mode->link_freq_index;
+-	reg_list = &link_freq_configs[link_freq_index].reg_list;
++	link_freq_cfg = &imx258->link_freq_configs[link_freq_index];
++
++	reg_list = &link_freq_cfg->link_cfg[imx258->lane_mode_idx].reg_list;
+ 	ret = imx258_write_regs(imx258, reg_list->regs, reg_list->num_of_regs);
+ 	if (ret) {
+ 		dev_err(&client->dev, "%s failed to set plls\n", __func__);
+ 		return ret;
+ 	}
+ 
+-	/* Apply default values of current mode */
+-	reg_list = &imx258->cur_mode->reg_list;
+-	ret = imx258_write_regs(imx258, reg_list->regs, reg_list->num_of_regs);
++	ret = imx258_write_regs(imx258, imx258->variant_cfg->regs,
++				imx258->variant_cfg->num_regs);
+ 	if (ret) {
+-		dev_err(&client->dev, "%s failed to set mode\n", __func__);
++		dev_err(&client->dev, "%s failed to set variant config\n",
++			__func__);
+ 		return ret;
+ 	}
+ 
+-	/* Set Orientation be 180 degree */
+-	ret = imx258_write_reg(imx258, REG_MIRROR_FLIP_CONTROL,
+-			       IMX258_REG_VALUE_08BIT, REG_CONFIG_MIRROR_FLIP);
++	ret = imx258_write_reg(imx258, IMX258_CLK_BLANK_STOP,
++			       IMX258_REG_VALUE_08BIT,
++			       imx258->csi2_flags & V4L2_MBUS_CSI2_NONCONTINUOUS_CLOCK ?
++			       1 : 0);
+ 	if (ret) {
+-		dev_err(&client->dev, "%s failed to set orientation\n",
+-			__func__);
++		dev_err(&client->dev, "%s failed to set clock lane mode\n", __func__);
++		return ret;
++	}
++
++	/* Apply default values of current mode */
++	reg_list = &imx258->cur_mode->reg_list;
++	ret = imx258_write_regs(imx258, reg_list->regs, reg_list->num_of_regs);
++	if (ret) {
++		dev_err(&client->dev, "%s failed to set mode\n", __func__);
+ 		return ret;
+ 	}
+ 
+@@ -1010,9 +1443,19 @@ static int imx258_power_on(struct device
+ 	struct imx258 *imx258 = to_imx258(sd);
+ 	int ret;
+ 
++	ret = regulator_bulk_enable(IMX258_NUM_SUPPLIES,
++				    imx258->supplies);
++	if (ret) {
++		dev_err(dev, "%s: failed to enable regulators\n",
++			__func__);
++		return ret;
++	}
++
+ 	ret = clk_prepare_enable(imx258->clk);
+-	if (ret)
++	if (ret) {
+ 		dev_err(dev, "failed to enable clock\n");
++		regulator_bulk_disable(IMX258_NUM_SUPPLIES, imx258->supplies);
++	}
+ 
+ 	return ret;
+ }
+@@ -1023,6 +1466,7 @@ static int imx258_power_off(struct devic
+ 	struct imx258 *imx258 = to_imx258(sd);
+ 
+ 	clk_disable_unprepare(imx258->clk);
++	regulator_bulk_disable(IMX258_NUM_SUPPLIES, imx258->supplies);
+ 
+ 	return 0;
+ }
+@@ -1133,6 +1577,7 @@ static const struct v4l2_subdev_pad_ops
+ 	.get_fmt = imx258_get_pad_format,
+ 	.set_fmt = imx258_set_pad_format,
+ 	.enum_frame_size = imx258_enum_frame_size,
++	.get_selection = imx258_get_selection,
+ };
+ 
+ static const struct v4l2_subdev_ops imx258_subdev_ops = {
+@@ -1148,15 +1593,17 @@ static const struct v4l2_subdev_internal
+ static int imx258_init_controls(struct imx258 *imx258)
+ {
+ 	struct i2c_client *client = v4l2_get_subdevdata(&imx258->sd);
++	const struct imx258_link_freq_config *link_freq_cfgs;
++	struct v4l2_fwnode_device_properties props;
+ 	struct v4l2_ctrl_handler *ctrl_hdlr;
++	const struct imx258_link_cfg *link_cfg;
+ 	s64 vblank_def;
+ 	s64 vblank_min;
+-	s64 pixel_rate_min;
+-	s64 pixel_rate_max;
++	s64 pixel_rate;
+ 	int ret;
+ 
+ 	ctrl_hdlr = &imx258->ctrl_handler;
+-	ret = v4l2_ctrl_handler_init(ctrl_hdlr, 8);
++	ret = v4l2_ctrl_handler_init(ctrl_hdlr, 12);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -1165,20 +1612,23 @@ static int imx258_init_controls(struct i
+ 	imx258->link_freq = v4l2_ctrl_new_int_menu(ctrl_hdlr,
+ 				&imx258_ctrl_ops,
+ 				V4L2_CID_LINK_FREQ,
+-				ARRAY_SIZE(link_freq_menu_items) - 1,
++				ARRAY_SIZE(link_freq_menu_items_19_2) - 1,
+ 				0,
+-				link_freq_menu_items);
++				imx258->link_freq_menu_items);
+ 
+ 	if (imx258->link_freq)
+ 		imx258->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+ 
+-	pixel_rate_max = link_freq_to_pixel_rate(link_freq_menu_items[0]);
+-	pixel_rate_min = link_freq_to_pixel_rate(link_freq_menu_items[1]);
++	link_freq_cfgs = &imx258->link_freq_configs[0];
++	link_cfg = link_freq_cfgs[imx258->lane_mode_idx].link_cfg;
++	pixel_rate = link_freq_to_pixel_rate(imx258->link_freq_menu_items[0],
++					     link_cfg);
++
+ 	/* By default, PIXEL_RATE is read only */
+ 	imx258->pixel_rate = v4l2_ctrl_new_std(ctrl_hdlr, &imx258_ctrl_ops,
+ 				V4L2_CID_PIXEL_RATE,
+-				pixel_rate_min, pixel_rate_max,
+-				1, pixel_rate_max);
++				pixel_rate, pixel_rate,
++				1, pixel_rate);
+ 
+ 
+ 	vblank_def = imx258->cur_mode->vts_def - imx258->cur_mode->height;
+@@ -1189,9 +1639,6 @@ static int imx258_init_controls(struct i
+ 				IMX258_VTS_MAX - imx258->cur_mode->height, 1,
+ 				vblank_def);
+ 
+-	if (imx258->vblank)
+-		imx258->vblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+-
+ 	imx258->hblank = v4l2_ctrl_new_std(
+ 				ctrl_hdlr, &imx258_ctrl_ops, V4L2_CID_HBLANK,
+ 				IMX258_PPL_DEFAULT - imx258->cur_mode->width,
+@@ -1225,6 +1672,25 @@ static int imx258_init_controls(struct i
+ 				ARRAY_SIZE(imx258_test_pattern_menu) - 1,
+ 				0, 0, imx258_test_pattern_menu);
+ 
++	ret = v4l2_fwnode_device_parse(&client->dev, &props);
++	if (ret)
++		goto error;
++	ret = v4l2_ctrl_new_fwnode_properties(ctrl_hdlr, &imx258_ctrl_ops,
++					      &props);
++	if (ret)
++		goto error;
++
++	imx258->hflip = v4l2_ctrl_new_std(ctrl_hdlr, &imx258_ctrl_ops,
++					  V4L2_CID_HFLIP, 0, 1, 1,
++					  props.rotation == 180 ? 1 : 0);
++	if (imx258->hflip)
++		imx258->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
++	imx258->vflip = v4l2_ctrl_new_std(ctrl_hdlr, &imx258_ctrl_ops,
++					  V4L2_CID_VFLIP, 0, 1, 1,
++					  props.rotation == 180 ? 1 : 0);
++	if (imx258->vflip)
++		imx258->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
+ 	if (ctrl_hdlr->error) {
+ 		ret = ctrl_hdlr->error;
+ 		dev_err(&client->dev, "%s control init failed (%d)\n",
+@@ -1249,9 +1715,33 @@ static void imx258_free_controls(struct
+ 	mutex_destroy(&imx258->mutex);
+ }
+ 
++static int imx258_get_regulators(struct imx258 *imx258,
++				 struct i2c_client *client)
++{
++	unsigned int i;
++
++	for (i = 0; i < IMX258_NUM_SUPPLIES; i++)
++		imx258->supplies[i].supply = imx258_supply_name[i];
++
++	return devm_regulator_bulk_get(&client->dev,
++				       IMX258_NUM_SUPPLIES,
++				       imx258->supplies);
++}
++
++static const struct of_device_id imx258_dt_ids[] = {
++	{ .compatible = "sony,imx258", .data = &imx258_cfg },
++	{ .compatible = "sony,imx258-pdaf", .data = &imx258_pdaf_cfg },
++	{ /* sentinel */ }
++};
++
+ static int imx258_probe(struct i2c_client *client)
+ {
+ 	struct imx258 *imx258;
++	struct fwnode_handle *endpoint;
++	struct v4l2_fwnode_endpoint ep = {
++		.bus_type = V4L2_MBUS_CSI2_DPHY
++	};
++	const struct of_device_id *match;
+ 	int ret;
+ 	u32 val = 0;
+ 
+@@ -1259,6 +1749,10 @@ static int imx258_probe(struct i2c_clien
+ 	if (!imx258)
+ 		return -ENOMEM;
+ 
++	ret = imx258_get_regulators(imx258, client);
++	if (ret)
++		return ret;
++
+ 	imx258->clk = devm_clk_get_optional(&client->dev, NULL);
+ 	if (IS_ERR(imx258->clk))
+ 		return dev_err_probe(&client->dev, PTR_ERR(imx258->clk),
+@@ -1268,21 +1762,67 @@ static int imx258_probe(struct i2c_clien
+ 			"no clock provided, using clock-frequency property\n");
+ 
+ 		device_property_read_u32(&client->dev, "clock-frequency", &val);
++	} else if (IS_ERR(imx258->clk)) {
++		return dev_err_probe(&client->dev, PTR_ERR(imx258->clk),
++				     "error getting clock\n");
+ 	} else {
+ 		val = clk_get_rate(imx258->clk);
+ 	}
+-	if (val != IMX258_INPUT_CLOCK_FREQ) {
+-		dev_err(&client->dev, "input clock frequency not supported\n");
++
++	switch (val) {
++	case 19200000:
++		imx258->link_freq_configs = link_freq_configs_19_2;
++		imx258->link_freq_menu_items = link_freq_menu_items_19_2;
++		break;
++	case 24000000:
++		imx258->link_freq_configs = link_freq_configs_24;
++		imx258->link_freq_menu_items = link_freq_menu_items_24;
++		break;
++	default:
++		dev_err(&client->dev, "input clock frequency of %u not supported\n",
++			val);
+ 		return -EINVAL;
+ 	}
+ 
+-	/*
+-	 * Check that the device is mounted upside down. The driver only
+-	 * supports a single pixel order right now.
+-	 */
+-	ret = device_property_read_u32(&client->dev, "rotation", &val);
+-	if (ret || val != 180)
++	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(&client->dev), NULL);
++	if (!endpoint) {
++		dev_err(&client->dev, "Endpoint node not found\n");
+ 		return -EINVAL;
++	}
++
++	ret = v4l2_fwnode_endpoint_alloc_parse(endpoint, &ep);
++	fwnode_handle_put(endpoint);
++	if (ret == -ENXIO) {
++		dev_err(&client->dev, "Unsupported bus type, should be CSI2\n");
++		goto error_endpoint_poweron;
++	} else if (ret) {
++		dev_err(&client->dev, "Parsing endpoint node failed\n");
++		goto error_endpoint_poweron;
++	}
++
++	/* Get number of data lanes */
++	switch (ep.bus.mipi_csi2.num_data_lanes) {
++	case 2:
++		imx258->lane_mode_idx = IMX258_2_LANE_MODE;
++		break;
++	case 4:
++		imx258->lane_mode_idx = IMX258_4_LANE_MODE;
++		break;
++	default:
++		dev_err(&client->dev, "Invalid data lanes: %u\n",
++			ep.bus.mipi_csi2.num_data_lanes);
++		ret = -EINVAL;
++		goto error_endpoint_poweron;
++	}
++
++	imx258->csi2_flags = ep.bus.mipi_csi2.flags;
++
++	match = i2c_of_match_device(imx258_dt_ids, client);
++	if (!match || !match->data)
++		imx258->variant_cfg = &imx258_cfg;
++	else
++		imx258->variant_cfg =
++			(const struct imx258_variant_cfg *)match->data;
+ 
+ 	/* Initialize subdev */
+ 	v4l2_i2c_subdev_init(&imx258->sd, client, &imx258_subdev_ops);
+@@ -1290,7 +1830,7 @@ static int imx258_probe(struct i2c_clien
+ 	/* Will be powered off via pm_runtime_idle */
+ 	ret = imx258_power_on(&client->dev);
+ 	if (ret)
+-		return ret;
++		goto error_endpoint_poweron;
+ 
+ 	/* Check module identity */
+ 	ret = imx258_identify_module(imx258);
+@@ -1335,6 +1875,9 @@ error_handler_free:
+ error_identify:
+ 	imx258_power_off(&client->dev);
+ 
++error_endpoint_poweron:
++	v4l2_fwnode_endpoint_free(&ep);
++
+ 	return ret;
+ }
+ 
+@@ -1367,10 +1910,6 @@ static const struct acpi_device_id imx25
+ MODULE_DEVICE_TABLE(acpi, imx258_acpi_ids);
+ #endif
+ 
+-static const struct of_device_id imx258_dt_ids[] = {
+-	{ .compatible = "sony,imx258" },
+-	{ /* sentinel */ }
+-};
+ MODULE_DEVICE_TABLE(of, imx258_dt_ids);
+ 
+ static struct i2c_driver imx258_i2c_driver = {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0194-media-i2c-imx290-Support-for-the-Sony-IMX290-sensor.patch b/target/linux/bcm27xx/patches-6.1/950-0194-media-i2c-imx290-Support-for-the-Sony-IMX290-sensor.patch
new file mode 100644
index 00000000000000..a516243c70c512
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0194-media-i2c-imx290-Support-for-the-Sony-IMX290-sensor.patch
@@ -0,0 +1,1291 @@
+From 9b20808b904563590556e0a86e5d6186047ef54f Mon Sep 17 00:00:00 2001
+From: Andrey Konovalov <andrey.konovalov@linaro.org>
+Date: Fri, 12 Jun 2020 15:53:46 +0200
+Subject: [PATCH] media: i2c: imx290: Support for the Sony IMX290
+ sensor
+
+media: i2c: imx290: set the format before VIDIOC_SUBDEV_G_FMT is called
+
+Commit d46cfdc86c30d5ec768924f0b1e2683c8d20b671 upstream.
+
+With the current driver 'media-ctl -p' issued right after the imx290 driver
+is loaded prints:
+pad0: Source
+             [fmt:unknown/0x0]
+
+The format value of zero is due to the current_format field of the imx290
+struct not being initialized yet.
+
+As imx290_entity_init_cfg() calls imx290_set_fmt(), the current_mode field
+is also initialized, so the line which set current_mode to a default value
+in driver's probe() function is no longer needed.
+
+Signed-off-by: Andrey Konovalov <andrey.konovalov@linaro.org>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+media: i2c: imx290: Add support for 74.25MHz clock
+
+The existing driver only supported a clock of 37.125MHz, but the
+sensor also supports 74.25MHz.
+
+Add the relevant register modifications to support this alternate
+clock frequency.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx290: Correct range for V4L2_CID_GAIN to 0-238
+
+The datasheet lists the gain as being 0.0 to 72.0dB in 0.3dB steps, which
+makes 238 steps total.
+Correct the 0-72 range defined in the driver.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx290: Convert HMAX setting into V4L2_CID_HBLANK
+
+Userspace needs to know HBLANK if it is to work out exposure times
+and frame rates, therefore convert it to map onto V4L2_CID_HBLANK
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx290: Add support for V4L2_CID_VBLANK
+
+In order to calculate framerate and durations userspace needs
+the vertical blanking information. This can be configurable,
+and indeed the datasheet lists different values for VBLANK for
+the 1080p and 720p modes.
+
+Add the new control, and adopt the datasheet values for each mode.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx290: Add exposure control to the driver.
+
+Adds support for V4L2_CID_EXPOSURE so that userspace can control
+the sensor exposure time.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx290: Add H and V flip controls
+
+The sensor supports horizontal and vertical flips, so support them
+through V4L2_CID_HFLIP and V4L2_CID_VFLIP.
+
+This sensor does NOT change the Bayer order when changing the
+direction of readout, therefore no special handling is required for
+that.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: dt-bindings: media: i2c: Add mono version to IMX290 bindings
+
+The IMX290 module is available as either monochrome or colour and
+the variant is not detectable at runtime.
+
+Add a new compatible string for the monochrome version.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media : i2c: imx290: Add support for the mono sensor variant.
+
+The IMX290 module is available as either mono or colour (Bayer).
+
+Update the driver so that it can advertise the correct mono
+formats instead of the colour ones.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx290: Switch set_hmax to use imx290_write_buffered_reg
+
+imx290_set_hmax was using two independent writes to set up hmax,
+when all other multi-register writes were using imx290_write_buffered_reg
+which claims the group hold first.
+
+Switch imx290_set_hmax to using imx290_write_buffered_reg too.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx290: Add support for g_selection to report cropping
+
+Userspace needs to know the cropping arrangements for each mode,
+so expose this through g_selection.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx290: Set the colorspace fields in the format
+
+The colorspace fields were left untouched in imx290_set_fmt
+which lead to a v4l2-compliance failure.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx290: Replace V4L2_CID_GAIN with V4L2_CID_ANALOGUE_GAIN
+
+Most software (including libcamera) requires V4L2_CID_ANALOGUE_GAIN,
+not V4L2_CID_GAIN.
+
+The range for the control is 0 to 100 for which the sensor uses only
+analogue gain; higher values would involve digital gain which this
+control should not apply.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+media: i2c: imx290: Fix number of controls in v4l2_ctrl_handler_init
+
+The number is only a hint, but may as well be correct.
+
+Fixes: 471e0029e98aa ("media: i2c: imx290: Convert HMAX setting into V4L2_CID_HBLANK")
+Fixes: be0b9b7ad1c27 ("media: i2c: imx290: Add support for V4L2_CID_VBLANK")
+Fixes: 8483f0d7599aa ("media: i2c: imx290: Add exposure control to the driver.")
+Fixes: 9764f3459c401 ("media: i2c: imx290: Add H and V flip controls")
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+media: i2c: imx290: Fix up exposure calcuations and ranges
+
+Should now correspond exactly to the datasheet.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+media: i2c: imx290: Handle exposure correctly when vblank changes
+
+When vblank changes we must modify the exposure range. Also, with this
+sensor, the effective exposure time implicitly changes when vblank
+does, so we have to reset it after every vblank update.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+media: i2c: imx290: Support 60fps in 2 lane operation
+
+Commit "97589ad61c73 media: i2c: imx290: Add support for 2 data lanes"
+added support for running in two lane mode (instead of 4), but
+without changing the link frequency that resulted in a max of 30fps.
+
+Commit "98e0500eadb7 media: i2c: imx290: Add configurable link frequency
+and pixel rate" then doubled the link frequency when in 2 lane mode,
+but didn't undo the correction for running at only 30fps, just extending
+horizontal blanking instead.
+It also didn't update the CSI timing registers in accordance with the
+datasheet.
+
+Remove the 30fps limit on 2 lane by correcting the register config
+in accordance with the datasheet for 60fps operation over 2 lanes.
+Frame rate control (via V4L2_CID_VBLANK or HBLANK) can still reduce
+the frame rate on 2 lanes back to 30fps.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx290: Fix the pixel rate at 148.5Mpix/s
+
+Whilst the datasheet lists the link frequency changing between
+1080p and 720p modes, reality is that with the default blanking
+we have
+(1920 + 280) * (1080 + 45) * 60fps = 148.5MPix/s
+and
+(1280 + 2020) * (720 + 30) * 60fps = 148.5MPix/s
+and this reflects reality whether in 10 or 12 bit readout modes.
+
+How this relates to link frequency is unclear as it differs
+from the datasheet, but all exposure and frame rate calcs need
+the pixel rate to be correct, so make it so.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx290: Fix clock setup register assignments
+
+When the clock setups were added for the alternate external clocks,
+the settings for 2 lane 720p and 4 lane 1080p were transposed.
+2 lane 720p still worked, but 4 lane 1080p didn't.
+
+Correct the assignments.
+
+Fixes: 6b0c094a5b58 (media: i2c: imx290: Add support for 74.25MHz clock")
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx290: Add fwnode properties controls
+
+Add call to v4l2_ctrl_new_fwnode_properties to read and
+create the fwnode based controls.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx290: Sensor should report RAW color space
+
+Tested on Raspberry Pi running libcamera.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+media: i2c: imx290: Add compatible strings for IMX327 and IMX462
+
+IMX327 is the previous generation to IMX290, and supports up to 1080p60
+as 10 or 12 bit.
+IMX290 adds 1080p120 in 10 bit mode.
+IMX462 adds 1080p120 in both 10 and 12 bit modes.
+
+Add compatible strings for all variants.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx290: Updating VBLANK should update exposure in all states
+
+The code to update the range of the exposure control was after a
+check that the sensor was powered up. This is incorrect as the
+range should be updated under all conditions.
+
+Move the range update code to the correct place.
+
+Fixes: 52d076ea221e "media: i2c: imx290: Handle exposure correctly when vblank changes"
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx290: Drop incorrect comment about pixelrate
+
+commit b5eca6fd4284 ("media: i2c: imx290: Fix the pixel rate at 148.5Mpix/s")
+corrected imx290_calc_pixel_rate to always return the correct
+pixle rate of 148.5Mpix/s, but didn't remove the comment that said
+it relied on some other parameters.
+
+Drop that comment.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx290: Do not reset exposure time from set_fmt
+
+V4L2 controls are meant to be persistent, and only altered if
+the values break hardware constraints.
+
+In imx290_set_fmt the CID_VBLANK parameter was being reset to
+the mode default, and therefore the maximum exposure value
+potentially also changed.
+
+VBLANK is no longer reset, and even if it is, then the set_ctrl
+that will be called will alter the range for the exposure
+control. Therefore there is no need to reset the exposure time
+from set_fmt.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: imx290: Correct min HBLANK.
+
+In the 720p mode the CSI link is run at a lower frequency, and
+the minimum HBLANK value has to be increased to avoid generating
+more data from the sensor than the link can carry.
+
+Set the minimum based on the mode.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../devicetree/bindings/media/i2c/imx290.txt  |   7 +-
+ drivers/media/i2c/imx290.c                    | 620 ++++++++++++++----
+ 2 files changed, 491 insertions(+), 136 deletions(-)
+
+--- a/Documentation/devicetree/bindings/media/i2c/imx290.txt
++++ b/Documentation/devicetree/bindings/media/i2c/imx290.txt
+@@ -1,13 +1,14 @@
+ * Sony IMX290 1/2.8-Inch CMOS Image Sensor
+ 
+ The Sony IMX290 is a 1/2.8-Inch CMOS Solid-state image sensor with
+-Square Pixel for Color Cameras. It is programmable through I2C and 4-wire
+-interfaces. The sensor output is available via CMOS logic parallel SDR output,
++Square Pixel for Color or Monochrome Cameras. It is programmable through I2C
++and 4-wire interfaces.
++The sensor output is available via CMOS logic parallel SDR output,
+ Low voltage LVDS DDR output and CSI-2 serial data output. The CSI-2 bus is the
+ default. No bindings have been defined for the other busses.
+ 
+ Required Properties:
+-- compatible: Should be "sony,imx290"
++- compatible: Should be "sony,imx290", or "sony,imx290-mono"
+ - reg: I2C bus address of the device
+ - clocks: Reference to the xclk clock.
+ - clock-names: Should be "xclk".
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -1,6 +1,16 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /*
+- * Sony IMX290 CMOS Image Sensor Driver
++ * Sony IMX462 / IMX290 / IMX327 CMOS Image Sensor Driver
++ *
++ * The IMX462, IMX290,and IMX327 are very similar 1920x1080 1/2.8 CMOS image
++ * sensors.
++ * IMX327 can support up to 60fps with 10 or 12bit readout.
++ * IMX290 adds support for 120fps, but only 10bit and when connected over 4
++ * CSI-2 lanes.
++ * IMX462 adds support for 120fps in both 10 and 12bit readout modes.
++ *
++ * The modules don't appear to have a mechanism to identify whether the mono or
++ * colour variant is connected, therefore it is done via compatible string.
+  *
+  * Copyright (C) 2019 FRAMOS GmbH.
+  *
+@@ -13,6 +23,7 @@
+ #include <linux/gpio/consumer.h>
+ #include <linux/i2c.h>
+ #include <linux/module.h>
++#include <linux/of_device.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/regmap.h>
+ #include <linux/regulator/consumer.h>
+@@ -22,15 +33,28 @@
+ #include <media/v4l2-fwnode.h>
+ #include <media/v4l2-subdev.h>
+ 
++enum imx290_clk_index {
++	CLK_37_125,
++	CLK_74_25,
++};
++
+ #define IMX290_STANDBY 0x3000
+ #define IMX290_REGHOLD 0x3001
+ #define IMX290_XMSTA 0x3002
++#define IMX290_FLIP_WINMODE 0x3007
+ #define IMX290_FR_FDG_SEL 0x3009
+ #define IMX290_BLKLEVEL_LOW 0x300a
+ #define IMX290_BLKLEVEL_HIGH 0x300b
+ #define IMX290_GAIN 0x3014
++#define IMX290_VMAX_LOW 0x3018
++#define IMX290_VMAX_MAX 0x3fff
+ #define IMX290_HMAX_LOW 0x301c
+ #define IMX290_HMAX_HIGH 0x301d
++#define IMX290_HMAX_MAX 0xffff
++
++#define IMX290_EXPOSURE_MIN 1
++#define IMX290_EXPOSURE_STEP 1
++#define IMX290_EXPOSURE_LOW 0x3020
+ #define IMX290_PGCTRL 0x308c
+ #define IMX290_PHY_LANE_NUM 0x3407
+ #define IMX290_CSI_LANE_MODE 0x3443
+@@ -39,6 +63,13 @@
+ #define IMX290_PGCTRL_THRU BIT(1)
+ #define IMX290_PGCTRL_MODE(n) ((n) << 4)
+ 
++#define IMX290_NATIVE_WIDTH		1945U
++#define IMX290_NATIVE_HEIGHT		1109U
++#define IMX290_PIXEL_ARRAY_LEFT		4U
++#define IMX290_PIXEL_ARRAY_TOP		12U
++#define IMX290_PIXEL_ARRAY_WIDTH	1937U
++#define IMX290_PIXEL_ARRAY_HEIGHT	1097U
++
+ static const char * const imx290_supply_name[] = {
+ 	"vdda",
+ 	"vddd",
+@@ -56,19 +87,31 @@ struct imx290_mode {
+ 	u32 width;
+ 	u32 height;
+ 	u32 hmax;
++	u32 vmax;
+ 	u8 link_freq_index;
++	struct v4l2_rect crop;
++
++	const struct imx290_regval *mode_data;
++	u32 mode_data_size;
++	const struct imx290_regval *lane_data;
++	u32 lane_data_size;
+ 
+-	const struct imx290_regval *data;
+-	u32 data_size;
++
++	/* Clock setup can vary. Index as enum imx290_clk_index */
++	const struct imx290_regval *clk_data[2];
++	u32 clk_size;
+ };
+ 
+ struct imx290 {
+ 	struct device *dev;
+ 	struct clk *xclk;
++	u32 xclk_freq;
+ 	struct regmap *regmap;
+ 	u8 nlanes;
+ 	u8 bpp;
+ 
++	const struct imx290_pixfmt *formats;
++
+ 	struct v4l2_subdev sd;
+ 	struct media_pad pad;
+ 	struct v4l2_mbus_framefmt current_format;
+@@ -80,6 +123,11 @@ struct imx290 {
+ 	struct v4l2_ctrl_handler ctrls;
+ 	struct v4l2_ctrl *link_freq;
+ 	struct v4l2_ctrl *pixel_rate;
++	struct v4l2_ctrl *hblank;
++	struct v4l2_ctrl *vblank;
++	struct v4l2_ctrl *hflip;
++	struct v4l2_ctrl *vflip;
++	struct v4l2_ctrl *exposure;
+ 
+ 	struct mutex lock;
+ };
+@@ -89,11 +137,18 @@ struct imx290_pixfmt {
+ 	u8 bpp;
+ };
+ 
+-static const struct imx290_pixfmt imx290_formats[] = {
++#define IMX290_NUM_FORMATS 2
++
++static const struct imx290_pixfmt imx290_colour_formats[IMX290_NUM_FORMATS] = {
+ 	{ MEDIA_BUS_FMT_SRGGB10_1X10, 10 },
+ 	{ MEDIA_BUS_FMT_SRGGB12_1X12, 12 },
+ };
+ 
++static const struct imx290_pixfmt imx290_mono_formats[IMX290_NUM_FORMATS] = {
++	{ MEDIA_BUS_FMT_Y10_1X10, 10 },
++	{ MEDIA_BUS_FMT_Y12_1X12, 12 },
++};
++
+ static const struct regmap_config imx290_regmap_config = {
+ 	.reg_bits = 16,
+ 	.val_bits = 8,
+@@ -113,11 +168,7 @@ static const char * const imx290_test_pa
+ 
+ static const struct imx290_regval imx290_global_init_settings[] = {
+ 	{ 0x3007, 0x00 },
+-	{ 0x3018, 0x65 },
+-	{ 0x3019, 0x04 },
+ 	{ 0x301a, 0x00 },
+-	{ 0x3444, 0x20 },
+-	{ 0x3445, 0x25 },
+ 	{ 0x303a, 0x0c },
+ 	{ 0x3040, 0x00 },
+ 	{ 0x3041, 0x00 },
+@@ -171,8 +222,33 @@ static const struct imx290_regval imx290
+ 	{ 0x33b3, 0x04 },
+ };
+ 
+-static const struct imx290_regval imx290_1080p_settings[] = {
++static const struct imx290_regval imx290_37_125mhz_clock_1080p[] = {
++	{ 0x305c, 0x18 },
++	{ 0x305d, 0x03 },
++	{ 0x305e, 0x20 },
++	{ 0x305f, 0x01 },
++	{ 0x315e, 0x1a },
++	{ 0x3164, 0x1a },
++	{ 0x3444, 0x20 },
++	{ 0x3445, 0x25 },
++	{ 0x3480, 0x49 },
++};
++
++static const struct imx290_regval imx290_74_250mhz_clock_1080p[] = {
++	{ 0x305c, 0x0c },
++	{ 0x305d, 0x03 },
++	{ 0x305e, 0x10 },
++	{ 0x305f, 0x01 },
++	{ 0x315e, 0x1b },
++	{ 0x3164, 0x1b },
++	{ 0x3444, 0x40 },
++	{ 0x3445, 0x4a },
++	{ 0x3480, 0x92 },
++};
++
++static const struct imx290_regval imx290_1080p_common_settings[] = {
+ 	/* mode settings */
++	{ IMX290_FR_FDG_SEL, 0x01 },
+ 	{ 0x3007, 0x00 },
+ 	{ 0x303a, 0x0c },
+ 	{ 0x3414, 0x0a },
+@@ -182,15 +258,36 @@ static const struct imx290_regval imx290
+ 	{ 0x3419, 0x04 },
+ 	{ 0x3012, 0x64 },
+ 	{ 0x3013, 0x00 },
+-	{ 0x305c, 0x18 },
+-	{ 0x305d, 0x03 },
+-	{ 0x305e, 0x20 },
+-	{ 0x305f, 0x01 },
+-	{ 0x315e, 0x1a },
+-	{ 0x3164, 0x1a },
+-	{ 0x3480, 0x49 },
++};
++
++static const struct imx290_regval imx290_1080p_2lane_settings[] = {
++	{ 0x3405, 0x00 },
+ 	/* data rate settings */
++	{ IMX290_PHY_LANE_NUM, 0x01 },
++	{ IMX290_CSI_LANE_MODE, 0x01 },
++	{ 0x3446, 0x77 },
++	{ 0x3447, 0x00 },
++	{ 0x3448, 0x67 },
++	{ 0x3449, 0x00 },
++	{ 0x344a, 0x47 },
++	{ 0x344b, 0x00 },
++	{ 0x344c, 0x37 },
++	{ 0x344d, 0x00 },
++	{ 0x344e, 0x3f },
++	{ 0x344f, 0x00 },
++	{ 0x3450, 0xff },
++	{ 0x3451, 0x00 },
++	{ 0x3452, 0x3f },
++	{ 0x3453, 0x00 },
++	{ 0x3454, 0x37 },
++	{ 0x3455, 0x00 },
++};
++
++static const struct imx290_regval imx290_1080p_4lane_settings[] = {
+ 	{ 0x3405, 0x10 },
++	/* data rate settings */
++	{ IMX290_PHY_LANE_NUM, 0x03 },
++	{ IMX290_CSI_LANE_MODE, 0x03 },
+ 	{ 0x3446, 0x57 },
+ 	{ 0x3447, 0x00 },
+ 	{ 0x3448, 0x37 },
+@@ -209,8 +306,33 @@ static const struct imx290_regval imx290
+ 	{ 0x3455, 0x00 },
+ };
+ 
+-static const struct imx290_regval imx290_720p_settings[] = {
++static const struct imx290_regval imx290_37_125mhz_clock_720p[] = {
++	{ 0x305c, 0x20 },
++	{ 0x305d, 0x00 },
++	{ 0x305e, 0x20 },
++	{ 0x305f, 0x01 },
++	{ 0x315e, 0x1a },
++	{ 0x3164, 0x1a },
++	{ 0x3444, 0x20 },
++	{ 0x3445, 0x25 },
++	{ 0x3480, 0x49 },
++};
++
++static const struct imx290_regval imx290_74_250mhz_clock_720p[] = {
++	{ 0x305c, 0x10 },
++	{ 0x305d, 0x00 },
++	{ 0x305e, 0x10 },
++	{ 0x305f, 0x01 },
++	{ 0x315e, 0x1b },
++	{ 0x3164, 0x1b },
++	{ 0x3444, 0x40 },
++	{ 0x3445, 0x4a },
++	{ 0x3480, 0x92 },
++};
++
++static const struct imx290_regval imx290_720p_common_settings[] = {
+ 	/* mode settings */
++	{ IMX290_FR_FDG_SEL, 0x01 },
+ 	{ 0x3007, 0x10 },
+ 	{ 0x303a, 0x06 },
+ 	{ 0x3414, 0x04 },
+@@ -220,15 +342,36 @@ static const struct imx290_regval imx290
+ 	{ 0x3419, 0x02 },
+ 	{ 0x3012, 0x64 },
+ 	{ 0x3013, 0x00 },
+-	{ 0x305c, 0x20 },
+-	{ 0x305d, 0x00 },
+-	{ 0x305e, 0x20 },
+-	{ 0x305f, 0x01 },
+-	{ 0x315e, 0x1a },
+-	{ 0x3164, 0x1a },
+-	{ 0x3480, 0x49 },
++};
++
++static const struct imx290_regval imx290_720p_2lane_settings[] = {
++	{ 0x3405, 0x00 },
++	{ IMX290_PHY_LANE_NUM, 0x01 },
++	{ IMX290_CSI_LANE_MODE, 0x01 },
+ 	/* data rate settings */
++	{ 0x3446, 0x67 },
++	{ 0x3447, 0x00 },
++	{ 0x3448, 0x57 },
++	{ 0x3449, 0x00 },
++	{ 0x344a, 0x2f },
++	{ 0x344b, 0x00 },
++	{ 0x344c, 0x27 },
++	{ 0x344d, 0x00 },
++	{ 0x344e, 0x2f },
++	{ 0x344f, 0x00 },
++	{ 0x3450, 0xbf },
++	{ 0x3451, 0x00 },
++	{ 0x3452, 0x2f },
++	{ 0x3453, 0x00 },
++	{ 0x3454, 0x27 },
++	{ 0x3455, 0x00 },
++};
++
++static const struct imx290_regval imx290_720p_4lane_settings[] = {
+ 	{ 0x3405, 0x10 },
++	{ IMX290_PHY_LANE_NUM, 0x03 },
++	{ IMX290_CSI_LANE_MODE, 0x03 },
++	/* data rate settings */
+ 	{ 0x3446, 0x4f },
+ 	{ 0x3447, 0x00 },
+ 	{ 0x3448, 0x2f },
+@@ -308,18 +451,46 @@ static const struct imx290_mode imx290_m
+ 	{
+ 		.width = 1920,
+ 		.height = 1080,
+-		.hmax = 0x1130,
++		.hmax = 0x0898,
++		.vmax = 0x0465,
+ 		.link_freq_index = FREQ_INDEX_1080P,
+-		.data = imx290_1080p_settings,
+-		.data_size = ARRAY_SIZE(imx290_1080p_settings),
++		.crop = {
++			.left = 4 + 8,
++			.top = 12 + 8,
++			.width = 1920,
++			.height = 1080,
++		},
++		.mode_data = imx290_1080p_common_settings,
++		.mode_data_size = ARRAY_SIZE(imx290_1080p_common_settings),
++		.lane_data = imx290_1080p_2lane_settings,
++		.lane_data_size = ARRAY_SIZE(imx290_1080p_2lane_settings),
++		.clk_data = {
++			[CLK_37_125] = imx290_37_125mhz_clock_1080p,
++			[CLK_74_25] = imx290_74_250mhz_clock_1080p,
++		},
++		.clk_size = ARRAY_SIZE(imx290_37_125mhz_clock_1080p),
+ 	},
+ 	{
+ 		.width = 1280,
+ 		.height = 720,
+-		.hmax = 0x19c8,
++		.hmax = 0x0ce4,
++		.vmax = 0x02ee,
+ 		.link_freq_index = FREQ_INDEX_720P,
+-		.data = imx290_720p_settings,
+-		.data_size = ARRAY_SIZE(imx290_720p_settings),
++		.crop = {
++			.left = 4 + 8 + 320,
++			.top = 12 + 8 + 180,
++			.width = 1280,
++			.height = 720,
++		},
++		.mode_data = imx290_720p_common_settings,
++		.mode_data_size = ARRAY_SIZE(imx290_720p_common_settings),
++		.lane_data = imx290_720p_2lane_settings,
++		.lane_data_size = ARRAY_SIZE(imx290_720p_2lane_settings),
++		.clk_data = {
++			[CLK_37_125] = imx290_37_125mhz_clock_720p,
++			[CLK_74_25] = imx290_74_250mhz_clock_720p,
++		},
++		.clk_size = ARRAY_SIZE(imx290_37_125mhz_clock_720p),
+ 	},
+ };
+ 
+@@ -328,17 +499,45 @@ static const struct imx290_mode imx290_m
+ 		.width = 1920,
+ 		.height = 1080,
+ 		.hmax = 0x0898,
++		.vmax = 0x0465,
+ 		.link_freq_index = FREQ_INDEX_1080P,
+-		.data = imx290_1080p_settings,
+-		.data_size = ARRAY_SIZE(imx290_1080p_settings),
++		.crop = {
++			.left = 4 + 8,
++			.top = 12 + 8,
++			.width = 1920,
++			.height = 1080,
++		},
++		.mode_data = imx290_1080p_common_settings,
++		.mode_data_size = ARRAY_SIZE(imx290_1080p_common_settings),
++		.lane_data = imx290_1080p_4lane_settings,
++		.lane_data_size = ARRAY_SIZE(imx290_1080p_4lane_settings),
++		.clk_data = {
++			[CLK_37_125] = imx290_37_125mhz_clock_1080p,
++			[CLK_74_25] = imx290_74_250mhz_clock_1080p,
++		},
++		.clk_size = ARRAY_SIZE(imx290_37_125mhz_clock_1080p),
+ 	},
+ 	{
+ 		.width = 1280,
+ 		.height = 720,
+ 		.hmax = 0x0ce4,
++		.vmax = 0x02ee,
+ 		.link_freq_index = FREQ_INDEX_720P,
+-		.data = imx290_720p_settings,
+-		.data_size = ARRAY_SIZE(imx290_720p_settings),
++		.crop = {
++			.left = 4 + 8 + 320,
++			.top = 12 + 8 + 180,
++			.width = 1280,
++			.height = 720,
++		},
++		.mode_data = imx290_720p_common_settings,
++		.mode_data_size = ARRAY_SIZE(imx290_720p_common_settings),
++		.lane_data = imx290_720p_4lane_settings,
++		.lane_data_size = ARRAY_SIZE(imx290_720p_4lane_settings),
++		.clk_data = {
++			[CLK_37_125] = imx290_37_125mhz_clock_720p,
++			[CLK_74_25] = imx290_74_250mhz_clock_720p,
++		},
++		.clk_size = ARRAY_SIZE(imx290_37_125mhz_clock_720p),
+ 	},
+ };
+ 
+@@ -452,6 +651,53 @@ static int imx290_set_gain(struct imx290
+ 	return ret;
+ }
+ 
++static int imx290_set_exposure(struct imx290 *imx290, u32 value)
++{
++	u32 exposure = (imx290->current_mode->height + imx290->vblank->val) -
++						value - 1;
++	int ret;
++
++	ret = imx290_write_buffered_reg(imx290, IMX290_EXPOSURE_LOW, 3,
++					exposure);
++	if (ret)
++		dev_err(imx290->dev, "Unable to write exposure\n");
++
++	return ret;
++}
++
++static int imx290_set_hmax(struct imx290 *imx290, u32 val)
++{
++	u32 hmax = val + imx290->current_mode->width;
++	int ret;
++
++	ret = imx290_write_buffered_reg(imx290, IMX290_HMAX_LOW, 2,
++					hmax);
++	if (ret)
++		dev_err(imx290->dev, "Error setting HMAX register\n");
++
++	return ret;
++}
++
++static int imx290_set_vmax(struct imx290 *imx290, u32 val)
++{
++	u32 vmax = val + imx290->current_mode->height;
++	int ret;
++
++	ret = imx290_write_buffered_reg(imx290, IMX290_VMAX_LOW, 3,
++					vmax);
++	if (ret)
++		dev_err(imx290->dev, "Unable to write vmax\n");
++
++	/*
++	 * Becuse of the way exposure works for this sensor, updating
++	 * vblank causes the effective exposure to change, so we must
++	 * set it back to the "new" correct value.
++	 */
++	imx290_set_exposure(imx290, imx290->exposure->val);
++
++	return ret;
++}
++
+ /* Stop streaming */
+ static int imx290_stop_streaming(struct imx290 *imx290)
+ {
+@@ -471,15 +717,50 @@ static int imx290_set_ctrl(struct v4l2_c
+ 	struct imx290 *imx290 = container_of(ctrl->handler,
+ 					     struct imx290, ctrls);
+ 	int ret = 0;
++	u8 val;
++
++	if (ctrl->id == V4L2_CID_VBLANK) {
++		u32 vmax = ctrl->val + imx290->current_mode->height;
++
++		/*
++		 * Changing vblank changes the allowed range for exposure.
++		 * We don't supply the current exposure as default here as it
++		 * may lie outside the new range. We will reset it just below.
++		 */
++		__v4l2_ctrl_modify_range(imx290->exposure,
++					 IMX290_EXPOSURE_MIN,
++					 vmax - 2,
++					 IMX290_EXPOSURE_STEP,
++					 vmax - 2);
++	}
+ 
+ 	/* V4L2 controls values will be applied only when power is already up */
+ 	if (!pm_runtime_get_if_in_use(imx290->dev))
+ 		return 0;
+ 
+ 	switch (ctrl->id) {
+-	case V4L2_CID_GAIN:
++	case V4L2_CID_ANALOGUE_GAIN:
+ 		ret = imx290_set_gain(imx290, ctrl->val);
+ 		break;
++	case V4L2_CID_EXPOSURE:
++		ret = imx290_set_exposure(imx290, ctrl->val);
++		break;
++	case V4L2_CID_HBLANK:
++		ret = imx290_set_hmax(imx290, ctrl->val);
++		break;
++	case V4L2_CID_VBLANK:
++		ret = imx290_set_vmax(imx290, ctrl->val);
++		break;
++	case V4L2_CID_HFLIP:
++	case V4L2_CID_VFLIP:
++		/* WINMODE is in bits [6:4], so need to read-modify-write */
++		ret = imx290_read_reg(imx290, IMX290_FLIP_WINMODE, &val);
++		if (ret)
++			break;
++		val &= ~0x03;
++		val |= imx290->vflip->val | (imx290->hflip->val << 1);
++		ret = imx290_write_reg(imx290, IMX290_FLIP_WINMODE, val);
++		break;
+ 	case V4L2_CID_TEST_PATTERN:
+ 		if (ctrl->val) {
+ 			imx290_write_reg(imx290, IMX290_BLKLEVEL_LOW, 0x00);
+@@ -519,10 +800,12 @@ static int imx290_enum_mbus_code(struct
+ 				 struct v4l2_subdev_state *sd_state,
+ 				 struct v4l2_subdev_mbus_code_enum *code)
+ {
+-	if (code->index >= ARRAY_SIZE(imx290_formats))
++	const struct imx290 *imx290 = to_imx290(sd);
++
++	if (code->index >= IMX290_NUM_FORMATS)
+ 		return -EINVAL;
+ 
+-	code->code = imx290_formats[code->index].code;
++	code->code = imx290->formats[code->index].code;
+ 
+ 	return 0;
+ }
+@@ -534,8 +817,8 @@ static int imx290_enum_frame_size(struct
+ 	const struct imx290 *imx290 = to_imx290(sd);
+ 	const struct imx290_mode *imx290_modes = imx290_modes_ptr(imx290);
+ 
+-	if ((fse->code != imx290_formats[0].code) &&
+-	    (fse->code != imx290_formats[1].code))
++	if (fse->code != imx290->formats[0].code &&
++	    fse->code != imx290->formats[1].code)
+ 		return -EINVAL;
+ 
+ 	if (fse->index >= imx290_modes_num(imx290))
+@@ -576,23 +859,9 @@ static inline u8 imx290_get_link_freq_in
+ 	return imx290->current_mode->link_freq_index;
+ }
+ 
+-static s64 imx290_get_link_freq(struct imx290 *imx290)
+-{
+-	u8 index = imx290_get_link_freq_index(imx290);
+-
+-	return *(imx290_link_freqs_ptr(imx290) + index);
+-}
+-
+ static u64 imx290_calc_pixel_rate(struct imx290 *imx290)
+ {
+-	s64 link_freq = imx290_get_link_freq(imx290);
+-	u8 nlanes = imx290->nlanes;
+-	u64 pixel_rate;
+-
+-	/* pixel rate = link_freq * 2 * nr_of_lanes / bits_per_sample */
+-	pixel_rate = link_freq * 2 * nlanes;
+-	do_div(pixel_rate, imx290->bpp);
+-	return pixel_rate;
++	return 148500000;
+ }
+ 
+ static int imx290_set_fmt(struct v4l2_subdev *sd,
+@@ -613,22 +882,30 @@ static int imx290_set_fmt(struct v4l2_su
+ 	fmt->format.width = mode->width;
+ 	fmt->format.height = mode->height;
+ 
+-	for (i = 0; i < ARRAY_SIZE(imx290_formats); i++)
+-		if (imx290_formats[i].code == fmt->format.code)
++	for (i = 0; i < IMX290_NUM_FORMATS; i++)
++		if (imx290->formats[i].code == fmt->format.code)
+ 			break;
+ 
+-	if (i >= ARRAY_SIZE(imx290_formats))
++	if (i >= IMX290_NUM_FORMATS)
+ 		i = 0;
+ 
+-	fmt->format.code = imx290_formats[i].code;
++	fmt->format.code = imx290->formats[i].code;
+ 	fmt->format.field = V4L2_FIELD_NONE;
++	fmt->format.colorspace = V4L2_COLORSPACE_RAW;
++	fmt->format.ycbcr_enc =
++			V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->format.colorspace);
++	fmt->format.quantization =
++		V4L2_MAP_QUANTIZATION_DEFAULT(true, fmt->format.colorspace,
++					      fmt->format.ycbcr_enc);
++	fmt->format.xfer_func =
++		V4L2_MAP_XFER_FUNC_DEFAULT(fmt->format.colorspace);
+ 
+ 	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
+ 		format = v4l2_subdev_get_try_format(sd, sd_state, fmt->pad);
+ 	} else {
+ 		format = &imx290->current_format;
+ 		imx290->current_mode = mode;
+-		imx290->bpp = imx290_formats[i].bpp;
++		imx290->bpp = imx290->formats[i].bpp;
+ 
+ 		if (imx290->link_freq)
+ 			__v4l2_ctrl_s_ctrl(imx290->link_freq,
+@@ -636,6 +913,18 @@ static int imx290_set_fmt(struct v4l2_su
+ 		if (imx290->pixel_rate)
+ 			__v4l2_ctrl_s_ctrl_int64(imx290->pixel_rate,
+ 						 imx290_calc_pixel_rate(imx290));
++
++		if (imx290->hblank)
++			__v4l2_ctrl_modify_range(imx290->hblank,
++						 mode->hmax - mode->width,
++						 IMX290_HMAX_MAX - mode->width,
++						 1, mode->hmax - mode->width);
++		if (imx290->vblank)
++			__v4l2_ctrl_modify_range(imx290->vblank,
++						 mode->vmax - mode->height,
++						 IMX290_VMAX_MAX - mode->height,
++						 1,
++						 mode->vmax - mode->height);
+ 	}
+ 
+ 	*format = fmt->format;
+@@ -665,6 +954,7 @@ static int imx290_write_current_format(s
+ 
+ 	switch (imx290->current_format.code) {
+ 	case MEDIA_BUS_FMT_SRGGB10_1X10:
++	case MEDIA_BUS_FMT_Y10_1X10:
+ 		ret = imx290_set_register_array(imx290, imx290_10bit_settings,
+ 						ARRAY_SIZE(
+ 							imx290_10bit_settings));
+@@ -674,6 +964,7 @@ static int imx290_write_current_format(s
+ 		}
+ 		break;
+ 	case MEDIA_BUS_FMT_SRGGB12_1X12:
++	case MEDIA_BUS_FMT_Y12_1X12:
+ 		ret = imx290_set_register_array(imx290, imx290_12bit_settings,
+ 						ARRAY_SIZE(
+ 							imx290_12bit_settings));
+@@ -690,28 +981,62 @@ static int imx290_write_current_format(s
+ 	return 0;
+ }
+ 
+-static int imx290_set_hmax(struct imx290 *imx290, u32 val)
++static const struct v4l2_rect *
++__imx290_get_pad_crop(struct imx290 *imx290, struct v4l2_subdev_pad_config *cfg,
++		      unsigned int pad, enum v4l2_subdev_format_whence which)
+ {
+-	int ret;
++	switch (which) {
++	case V4L2_SUBDEV_FORMAT_TRY:
++		return v4l2_subdev_get_try_crop(&imx290->sd, cfg, pad);
++	case V4L2_SUBDEV_FORMAT_ACTIVE:
++		return &imx290->current_mode->crop;
++	}
+ 
+-	ret = imx290_write_reg(imx290, IMX290_HMAX_LOW, (val & 0xff));
+-	if (ret) {
+-		dev_err(imx290->dev, "Error setting HMAX register\n");
+-		return ret;
++	return NULL;
++}
++
++static int imx290_get_selection(struct v4l2_subdev *sd,
++				struct v4l2_subdev_pad_config *cfg,
++				struct v4l2_subdev_selection *sel)
++{
++	switch (sel->target) {
++	case V4L2_SEL_TGT_CROP: {
++		struct imx290 *imx290 = to_imx290(sd);
++
++		mutex_lock(&imx290->lock);
++		sel->r = *__imx290_get_pad_crop(imx290, cfg, sel->pad,
++						sel->which);
++		mutex_unlock(&imx290->lock);
++
++		return 0;
+ 	}
+ 
+-	ret = imx290_write_reg(imx290, IMX290_HMAX_HIGH, ((val >> 8) & 0xff));
+-	if (ret) {
+-		dev_err(imx290->dev, "Error setting HMAX register\n");
+-		return ret;
++	case V4L2_SEL_TGT_NATIVE_SIZE:
++		sel->r.top = 0;
++		sel->r.left = 0;
++		sel->r.width = IMX290_NATIVE_WIDTH;
++		sel->r.height = IMX290_NATIVE_HEIGHT;
++
++		return 0;
++
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++	case V4L2_SEL_TGT_CROP_BOUNDS:
++		sel->r.top = IMX290_PIXEL_ARRAY_TOP;
++		sel->r.left = IMX290_PIXEL_ARRAY_LEFT;
++		sel->r.width = IMX290_PIXEL_ARRAY_WIDTH;
++		sel->r.height = IMX290_PIXEL_ARRAY_HEIGHT;
++
++		return 0;
+ 	}
+ 
+-	return 0;
++	return -EINVAL;
+ }
+ 
+ /* Start streaming */
+ static int imx290_start_streaming(struct imx290 *imx290)
+ {
++	enum imx290_clk_index clk_idx = imx290->xclk_freq == 37125000 ?
++					CLK_37_125 : CLK_74_25;
+ 	int ret;
+ 
+ 	/* Set init register settings */
+@@ -723,6 +1048,14 @@ static int imx290_start_streaming(struct
+ 		return ret;
+ 	}
+ 
++	ret = imx290_set_register_array(imx290,
++					imx290->current_mode->clk_data[clk_idx],
++					imx290->current_mode->clk_size);
++	if (ret < 0) {
++		dev_err(imx290->dev, "Could not set clock registers\n");
++		return ret;
++	}
++
+ 	/* Apply the register values related to current frame format */
+ 	ret = imx290_write_current_format(imx290);
+ 	if (ret < 0) {
+@@ -731,15 +1064,22 @@ static int imx290_start_streaming(struct
+ 	}
+ 
+ 	/* Apply default values of current mode */
+-	ret = imx290_set_register_array(imx290, imx290->current_mode->data,
+-					imx290->current_mode->data_size);
++	ret = imx290_set_register_array(imx290,
++					imx290->current_mode->mode_data,
++					imx290->current_mode->mode_data_size);
+ 	if (ret < 0) {
+ 		dev_err(imx290->dev, "Could not set current mode\n");
+ 		return ret;
+ 	}
+-	ret = imx290_set_hmax(imx290, imx290->current_mode->hmax);
+-	if (ret < 0)
++
++	/* Apply lane config registers of current mode */
++	ret = imx290_set_register_array(imx290,
++					imx290->current_mode->lane_data,
++					imx290->current_mode->lane_data_size);
++	if (ret < 0) {
++		dev_err(imx290->dev, "Could not set current mode\n");
+ 		return ret;
++	}
+ 
+ 	/* Apply customized values from user */
+ 	ret = v4l2_ctrl_handler_setup(imx290->sd.ctrl_handler);
+@@ -778,6 +1118,9 @@ static int imx290_set_stream(struct v4l2
+ 		imx290_stop_streaming(imx290);
+ 		pm_runtime_put(imx290->dev);
+ 	}
++	/* vflip and hflip cannot change during streaming */
++	__v4l2_ctrl_grab(imx290->vflip, enable);
++	__v4l2_ctrl_grab(imx290->hflip, enable);
+ 
+ unlock_and_return:
+ 
+@@ -795,49 +1138,6 @@ static int imx290_get_regulators(struct
+ 				       imx290->supplies);
+ }
+ 
+-static int imx290_set_data_lanes(struct imx290 *imx290)
+-{
+-	int ret = 0, laneval, frsel;
+-
+-	switch (imx290->nlanes) {
+-	case 2:
+-		laneval = 0x01;
+-		frsel = 0x02;
+-		break;
+-	case 4:
+-		laneval = 0x03;
+-		frsel = 0x01;
+-		break;
+-	default:
+-		/*
+-		 * We should never hit this since the data lane count is
+-		 * validated in probe itself
+-		 */
+-		dev_err(imx290->dev, "Lane configuration not supported\n");
+-		ret = -EINVAL;
+-		goto exit;
+-	}
+-
+-	ret = imx290_write_reg(imx290, IMX290_PHY_LANE_NUM, laneval);
+-	if (ret) {
+-		dev_err(imx290->dev, "Error setting Physical Lane number register\n");
+-		goto exit;
+-	}
+-
+-	ret = imx290_write_reg(imx290, IMX290_CSI_LANE_MODE, laneval);
+-	if (ret) {
+-		dev_err(imx290->dev, "Error setting CSI Lane mode register\n");
+-		goto exit;
+-	}
+-
+-	ret = imx290_write_reg(imx290, IMX290_FR_FDG_SEL, frsel);
+-	if (ret)
+-		dev_err(imx290->dev, "Error setting FR/FDG SEL register\n");
+-
+-exit:
+-	return ret;
+-}
+-
+ static int imx290_power_on(struct device *dev)
+ {
+ 	struct v4l2_subdev *sd = dev_get_drvdata(dev);
+@@ -861,9 +1161,6 @@ static int imx290_power_on(struct device
+ 	gpiod_set_value_cansleep(imx290->rst_gpio, 0);
+ 	usleep_range(30000, 31000);
+ 
+-	/* Set data lane count */
+-	imx290_set_data_lanes(imx290);
+-
+ 	return 0;
+ }
+ 
+@@ -893,6 +1190,7 @@ static const struct v4l2_subdev_pad_ops
+ 	.enum_frame_size = imx290_enum_frame_size,
+ 	.get_fmt = imx290_get_fmt,
+ 	.set_fmt = imx290_set_fmt,
++	.get_selection = imx290_get_selection,
+ };
+ 
+ static const struct v4l2_subdev_ops imx290_subdev_ops = {
+@@ -926,16 +1224,35 @@ static s64 imx290_check_link_freqs(const
+ 	return 0;
+ }
+ 
++static const struct of_device_id imx290_of_match[] = {
++	/*
++	 * imx327 supports 1080p60 at 10 and 12bit.
++	 * imx290 adds 10bit 1080p120.
++	 * imx462 adds 10 and 12bit 1080p120.
++	 * This driver currently maxes out at 1080p60, which is supported by all
++	 * of them, but add the compatible strings for future implementation.
++	 */
++	{ .compatible = "sony,imx327", .data = imx290_colour_formats },
++	{ .compatible = "sony,imx327-mono", .data = imx290_mono_formats },
++	{ .compatible = "sony,imx290", .data = imx290_colour_formats },
++	{ .compatible = "sony,imx290-mono", .data = imx290_mono_formats },
++	{ .compatible = "sony,imx462", .data = imx290_colour_formats },
++	{ .compatible = "sony,imx462-mono", .data = imx290_mono_formats },
++	{ /* sentinel */ }
++};
++
+ static int imx290_probe(struct i2c_client *client)
+ {
++	struct v4l2_fwnode_device_properties props;
+ 	struct device *dev = &client->dev;
+ 	struct fwnode_handle *endpoint;
+ 	/* Only CSI2 is supported for now: */
+ 	struct v4l2_fwnode_endpoint ep = {
+ 		.bus_type = V4L2_MBUS_CSI2_DPHY
+ 	};
++	const struct of_device_id *match;
++	const struct imx290_mode *mode;
+ 	struct imx290 *imx290;
+-	u32 xclk_freq;
+ 	s64 fq;
+ 	int ret;
+ 
+@@ -950,6 +1267,11 @@ static int imx290_probe(struct i2c_clien
+ 		return -ENODEV;
+ 	}
+ 
++	match = of_match_device(imx290_of_match, dev);
++	if (!match)
++		return -ENODEV;
++	imx290->formats = (const struct imx290_pixfmt *)match->data;
++
+ 	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
+ 	if (!endpoint) {
+ 		dev_err(dev, "Endpoint node not found\n");
+@@ -999,21 +1321,21 @@ static int imx290_probe(struct i2c_clien
+ 	}
+ 
+ 	ret = fwnode_property_read_u32(dev_fwnode(dev), "clock-frequency",
+-				       &xclk_freq);
++				       &imx290->xclk_freq);
+ 	if (ret) {
+ 		dev_err(dev, "Could not get xclk frequency\n");
+ 		goto free_err;
+ 	}
+ 
+ 	/* external clock must be 37.125 MHz */
+-	if (xclk_freq != 37125000) {
++	if (imx290->xclk_freq != 37125000 && imx290->xclk_freq != 74250000) {
+ 		dev_err(dev, "External clock frequency %u is not supported\n",
+-			xclk_freq);
++			imx290->xclk_freq);
+ 		ret = -EINVAL;
+ 		goto free_err;
+ 	}
+ 
+-	ret = clk_set_rate(imx290->xclk, xclk_freq);
++	ret = clk_set_rate(imx290->xclk, imx290->xclk_freq);
+ 	if (ret) {
+ 		dev_err(dev, "Could not set xclk frequency\n");
+ 		goto free_err;
+@@ -1037,15 +1359,39 @@ static int imx290_probe(struct i2c_clien
+ 
+ 	/*
+ 	 * Initialize the frame format. In particular, imx290->current_mode
+-	 * and imx290->bpp are set to defaults: imx290_calc_pixel_rate() call
+-	 * below relies on these fields.
++	 * and imx290->bpp are set to defaults.
+ 	 */
+ 	imx290_entity_init_cfg(&imx290->sd, NULL);
+ 
+-	v4l2_ctrl_handler_init(&imx290->ctrls, 4);
++	v4l2_ctrl_handler_init(&imx290->ctrls, 11);
+ 
+ 	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-			  V4L2_CID_GAIN, 0, 72, 1, 0);
++			  V4L2_CID_ANALOGUE_GAIN, 0, 100, 1, 0);
++
++	mode = imx290->current_mode;
++	imx290->hblank = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
++					   V4L2_CID_HBLANK,
++					   mode->hmax - mode->width,
++					   IMX290_HMAX_MAX - mode->width, 1,
++					   mode->hmax - mode->width);
++
++	imx290->vblank = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
++					   V4L2_CID_VBLANK,
++					   mode->vmax - mode->height,
++					   IMX290_VMAX_MAX - mode->height, 1,
++					   mode->vmax - mode->height);
++
++	imx290->exposure = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
++					     V4L2_CID_EXPOSURE,
++					     IMX290_EXPOSURE_MIN,
++					     mode->vmax - 2,
++					     IMX290_EXPOSURE_STEP,
++					     mode->vmax - 2);
++
++	imx290->hflip = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
++					  V4L2_CID_HFLIP, 0, 1, 1, 0);
++	imx290->vflip = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
++					  V4L2_CID_VFLIP, 0, 1, 1, 0);
+ 
+ 	imx290->link_freq =
+ 		v4l2_ctrl_new_int_menu(&imx290->ctrls, &imx290_ctrl_ops,
+@@ -1065,6 +1411,15 @@ static int imx290_probe(struct i2c_clien
+ 				     ARRAY_SIZE(imx290_test_pattern_menu) - 1,
+ 				     0, 0, imx290_test_pattern_menu);
+ 
++	ret = v4l2_fwnode_device_parse(&client->dev, &props);
++	if (ret)
++		goto free_ctrl;
++
++	ret = v4l2_ctrl_new_fwnode_properties(&imx290->ctrls, &imx290_ctrl_ops,
++					      &props);
++	if (ret)
++		goto free_ctrl;
++
+ 	imx290->sd.ctrl_handler = &imx290->ctrls;
+ 
+ 	if (imx290->ctrls.error) {
+@@ -1087,6 +1442,9 @@ static int imx290_probe(struct i2c_clien
+ 		goto free_ctrl;
+ 	}
+ 
++	/* Initialize the frame format (this also sets imx290->current_mode) */
++	imx290_entity_init_cfg(&imx290->sd, NULL);
++
+ 	ret = v4l2_async_register_subdev(&imx290->sd);
+ 	if (ret < 0) {
+ 		dev_err(dev, "Could not register v4l2 device\n");
+@@ -1136,10 +1494,6 @@ static void imx290_remove(struct i2c_cli
+ 	pm_runtime_set_suspended(imx290->dev);
+ }
+ 
+-static const struct of_device_id imx290_of_match[] = {
+-	{ .compatible = "sony,imx290" },
+-	{ /* sentinel */ }
+-};
+ MODULE_DEVICE_TABLE(of, imx290_of_match);
+ 
+ static struct i2c_driver imx290_i2c_driver = {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0195-media-i2c-imx477-Support-for-the-Sony-IMX477-sensor.patch b/target/linux/bcm27xx/patches-6.1/950-0195-media-i2c-imx477-Support-for-the-Sony-IMX477-sensor.patch
new file mode 100644
index 00000000000000..91d8f295a2c072
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0195-media-i2c-imx477-Support-for-the-Sony-IMX477-sensor.patch
@@ -0,0 +1,2701 @@
+From 227eddefe9cb07dd1d160f0015b0d17d66cd3cf8 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Thu, 7 May 2020 15:50:54 +0100
+Subject: [PATCH] media: i2c: imx477: Support for the Sony IMX477
+ sensor
+
+dt-bindings: media: i2c: Add IMX477 CMOS sensor binding
+
+Add YAML device tree binding for IMX477 CMOS image sensor.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: Add driver for Sony IMX477 sensor
+
+Adds a driver for the 12MPix Sony IMX477 CSI2 sensor.
+Whilst the sensor supports 2 or 4 CSI2 data lanes, this driver
+currently only supports 2 lanes.
+
+The following Bayer modes are currently available:
+
+4056x3040 12-bit @ 10fps
+2028x1520 12-bit (binned) @ 40fps
+2028x1050 12-bit (cropped/binned) @ 50fps
+1012x760 10-bit (scaled) @ 120 fps
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Add support for adaptive frame control
+
+Use V4L2_CID_EXPOSURE_AUTO_PRIORITY to control if the driver should
+automatically adjust the sensor frame length based on exposure time,
+allowing variable frame rates and longer exposures.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Return correct result on sensor id verification
+
+The test should return -EIO if the register read id does not match
+the expected sensor id.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Parse and register properties
+
+Parse device properties and register controls for them using the V4L2
+fwnode properties helpers.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+media: i2c: imx477: Selection compliance fixes
+
+To comply with the intended usage of the V4L2 selection target when
+used to retrieve a sensor image properties, adjust the rectangles
+returned by the imx477 driver.
+
+The top/left crop coordinates of the TGT_CROP rectangle were set to
+(0, 0) instead of (8, 16) which is the offset from the larger physical
+pixel array rectangle. This was also a mismatch with the default values
+crop rectangle value, so this is corrected. Found with v4l2-compliance.
+
+While at it, add V4L2_SEL_TGT_CROP_BOUNDS support: CROP_DEFAULT and
+CROP_BOUNDS have the same size as the non-active pixels are not readable
+using the selection API. Found with v4l2-compliance.
+
+This commit mirrors 543790f777ba1b3264c168c653db6d415e7c983f done for
+the imx219 sensor.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Remove auto frame length adjusting
+
+The V4L2_CID_EXPOSURE_AUTO_PRIORITY was used to let the sensor control
+frame length (effectively framerate) based on the requested exposure
+time requested. Remove this feature as it is never used, and goes
+against how V4L2 likes to handle exposure and vblank controls.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Add very long exposure control to the driver
+
+Add support for very long exposures by using the exposure multiplier
+register. Userland does not need to pass any additional controls to
+enable long exposures, it simply requests a larger vblank to extend the
+exposure control range appropriately.
+
+Currently, since hblank is fixed, a maximum of approximately 124 seconds
+of exposure time can be used. In a future change, hblank could also be
+controlled in userland to give over 200 seconds of exposure time.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Fix crop height for 2028x1080 mode
+
+The crop height for this mode was set at 2600 lines, it should be 2160
+lines instead.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Replace existing 1012x760 mode
+
+The existing 1012x760 120 fps mode has significant IQ problem using
+the internal sensor scaler. Replace this mode with a 1332x990 120 fps
+mode instead. This new mode has a smaller field of view, but does not
+suffer from the bad IQ of the original mode.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Remove internal v4l2_mbus_framefmt from the state
+
+The only field in this struct that is used is the format code, so
+replace the struct with this single field.
+
+Save the format code in imx477_set_pad_format() when setting up a new
+mode so that imx477_get_pad_format() performs the right lookup.
+Otherwise, this caused a bug where the mode lookup occurred on the
+12-bit table rather than the 10-bit table.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Remove unused function parameter
+
+The struct imx477 *ctrl parameter is not used in the function
+imx477_adjust_exposure_range(), so remove it.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Fix for long exposure limit calculations
+
+Do not scale IMX477_EXPOSURE_OFFSET with the long exposure factor during
+the limit calculations. This allows larger exposure times, and does seem to be
+what the sensor is doing internally.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Extend driver to support imx378 sensor
+
+The imx378 sensor is almost identical to the imx477 and can be
+supported as a "compatible" sensor with just a few extra register
+writes.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+media: i2c: imx477: Fix framerates for 1332x990 mode
+
+The imx477 driver's line length for this mode had not been updated to
+the value supplied to us by the sensor manufacturer. With this
+correction the sensor delivers the framerates that are expected.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+media: i2c: imx477: Allow control of on-sensor DPC
+
+A module parameter "dpc_enable" is added to allow the control of the
+sensor's on-board DPC (Defective Pixel Correction) function.
+
+This is a global setting to be configured before using the sensor;
+there is no intention that this would ever be changed on-the-fly.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+media: i2c: imx477: Sensor should report RAW color space
+
+Tested on Raspberry Pi running libcamera.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+media: i2c: imx477: Add vsync trigger_mode parameter
+
+trigger_mode == 0 (default) => no effect / no registers written
+trigger_mode == 1           => source
+trigger_mode == 2           => sink
+
+This can be set e.g. in /boot/cmdline.txt as imx477.trigger_mode=N
+
+Signed-off-by: Jonas Jacob <jonas.jacob@neocortexvision.com>
+
+media: i2c: Update imx477 Kconfig entry
+
+Bring the IMX477 Kconfig declaration in line with upstream entries.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+media: i2c: imx477: Correct minimum exposure lines
+
+The minimum number of exposure lines value (IMX477_EXPOSURE_MIN) was
+previously 20 but this is not correct. The datasheet is not completely
+explicit, however the new value of 4 has been tested with all the
+sensor modes supported by this driver, and matches the lowest exposure
+value of 114us that could be achieved wtih Raspberry Pi's legacy
+firmware driver.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+media: i2c: imx477: Allow dynamic horizontal blanking control
+
+Currently, the V4L2_CID_HBLANK control is marked as read-only. Remove this
+restriction and allow userland to modify the control if needed.
+
+Set the maximum limit of the line length to 0xfff0.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Reset hblank on mode switch
+
+Reset the hblank control to the minimum value on every mode switch. This is to
+account for userland instances that do not yet control hblank, otherwise it
+gets set to a non-optimal value.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Do not unconditionally adjust hblank and vblank limits
+
+On a mode change, only call imx477_set_framing_limits() to adjust the hblank
+and vblank limits if the new mode is different from the existing mode. This
+preserves any manual control values the user might have set.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../devicetree/bindings/media/i2c/imx477.yaml |  113 +
+ MAINTAINERS                                   |    8 +
+ drivers/media/i2c/Kconfig                     |   11 +
+ drivers/media/i2c/Makefile                    |    1 +
+ drivers/media/i2c/imx477.c                    | 2308 +++++++++++++++++
+ 5 files changed, 2441 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/imx477.yaml
+ create mode 100644 drivers/media/i2c/imx477.c
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/imx477.yaml
+@@ -0,0 +1,113 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/media/i2c/imx477.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Sony 1/2.3-Inch 12Mpixel CMOS Digital Image Sensor
++
++maintainers:
++  - Naushir Patuck <naush@raspberypi.com>
++
++description: |-
++  The Sony IMX477 is a 1/2.3-inch CMOS active pixel digital image sensor
++  with an active array size of 4056H x 3040V. It is programmable through
++  I2C interface. The I2C address is fixed to 0x1A as per sensor data sheet.
++  Image data is sent through MIPI CSI-2, which is configured as either 2 or
++  4 data lanes.
++
++properties:
++  compatible:
++    const: sony,imx477
++
++  reg:
++    description: I2C device address
++    maxItems: 1
++
++  clocks:
++    maxItems: 1
++
++  VDIG-supply:
++    description:
++      Digital I/O voltage supply, 1.05 volts
++
++  VANA-supply:
++    description:
++      Analog voltage supply, 2.8 volts
++
++  VDDL-supply:
++    description:
++      Digital core voltage supply, 1.8 volts
++
++  reset-gpios:
++    description: |-
++      Reference to the GPIO connected to the xclr pin, if any.
++      Must be released (set high) after all all supplies and INCK are applied.
++
++  # See ../video-interfaces.txt for more details
++  port:
++    type: object
++    properties:
++      endpoint:
++        type: object
++        properties:
++          data-lanes:
++            description: |-
++              The sensor supports either two-lane, or four-lane operation.
++              For two-lane operation the property must be set to <1 2>.
++            items:
++              - const: 1
++              - const: 2
++
++          clock-noncontinuous:
++            type: boolean
++            description: |-
++              MIPI CSI-2 clock is non-continuous if this property is present,
++              otherwise it's continuous.
++
++          link-frequencies:
++            allOf:
++              - $ref: /schemas/types.yaml#/definitions/uint64-array
++            description:
++              Allowed data bus frequencies.
++
++        required:
++          - link-frequencies
++
++required:
++  - compatible
++  - reg
++  - clocks
++  - VANA-supply
++  - VDIG-supply
++  - VDDL-supply
++  - port
++
++additionalProperties: false
++
++examples:
++  - |
++    i2c0 {
++        #address-cells = <1>;
++        #size-cells = <0>;
++
++        imx477: sensor@10 {
++            compatible = "sony,imx477";
++            reg = <0x1a>;
++            clocks = <&imx477_clk>;
++            VANA-supply = <&imx477_vana>;   /* 2.8v */
++            VDIG-supply = <&imx477_vdig>;   /* 1.05v */
++            VDDL-supply = <&imx477_vddl>;   /* 1.8v */
++
++            port {
++                imx477_0: endpoint {
++                    remote-endpoint = <&csi1_ep>;
++                    data-lanes = <1 2>;
++                    clock-noncontinuous;
++                    link-frequencies = /bits/ 64 <450000000>;
++                };
++            };
++        };
++    };
++
++...
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -19279,6 +19279,14 @@ T:	git git://linuxtv.org/media_tree.git
+ F:	Documentation/devicetree/bindings/media/i2c/sony,imx412.yaml
+ F:	drivers/media/i2c/imx412.c
+ 
++SONY IMX477 SENSOR DRIVER
++M:	Raspberry Pi Kernel Maintenance <kernel-list@raspberrypi.com>
++L:	linux-media@vger.kernel.org
++S:	Maintained
++T:	git git://linuxtv.org/media_tree.git
++F:	Documentation/devicetree/bindings/media/i2c/imx477.yaml
++F:	drivers/media/i2c/imx477.c
++
+ SONY MEMORYSTICK SUBSYSTEM
+ M:	Maxim Levitsky <maximlevitsky@gmail.com>
+ M:	Alex Dubov <oakad@yahoo.com>
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -1023,6 +1023,17 @@ config VIDEO_UDA1342
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called uda1342.
+ 
++config VIDEO_IMX477
++	tristate "Sony IMX477 sensor support"
++	depends on I2C && VIDEO_DEV
++	select VIDEO_V4L2_SUBDEV_API
++	help
++	  This is a Video4Linux2 sensor driver for the Sony
++	  IMX477 camera. Also supports the Sony IMX378.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called imx477.
++
+ config VIDEO_VP27SMPX
+ 	tristate "Panasonic VP27's internal MPX"
+ 	depends on VIDEO_DEV && I2C
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -48,6 +48,7 @@ obj-$(CONFIG_VIDEO_IMX334) += imx334.o
+ obj-$(CONFIG_VIDEO_IMX335) += imx335.o
+ obj-$(CONFIG_VIDEO_IMX355) += imx355.o
+ obj-$(CONFIG_VIDEO_IMX412) += imx412.o
++obj-$(CONFIG_VIDEO_IMX477) += imx477.o
+ obj-$(CONFIG_VIDEO_IR_I2C) += ir-kbd-i2c.o
+ obj-$(CONFIG_VIDEO_ISL7998X) += isl7998x.o
+ obj-$(CONFIG_VIDEO_KS0127) += ks0127.o
+--- /dev/null
++++ b/drivers/media/i2c/imx477.c
+@@ -0,0 +1,2308 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * A V4L2 driver for Sony IMX477 cameras.
++ * Copyright (C) 2020, Raspberry Pi (Trading) Ltd
++ *
++ * Based on Sony imx219 camera driver
++ * Copyright (C) 2019-2020 Raspberry Pi (Trading) Ltd
++ */
++#include <asm/unaligned.h>
++#include <linux/clk.h>
++#include <linux/delay.h>
++#include <linux/gpio/consumer.h>
++#include <linux/i2c.h>
++#include <linux/module.h>
++#include <linux/of_device.h>
++#include <linux/pm_runtime.h>
++#include <linux/regulator/consumer.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-fwnode.h>
++#include <media/v4l2-mediabus.h>
++
++static int dpc_enable = 1;
++module_param(dpc_enable, int, 0644);
++MODULE_PARM_DESC(dpc_enable, "Enable on-sensor DPC");
++
++static int trigger_mode;
++module_param(trigger_mode, int, 0644);
++MODULE_PARM_DESC(trigger_mode, "Set vsync trigger mode: 1=source, 2=sink");
++
++#define IMX477_REG_VALUE_08BIT		1
++#define IMX477_REG_VALUE_16BIT		2
++
++/* Chip ID */
++#define IMX477_REG_CHIP_ID		0x0016
++#define IMX477_CHIP_ID			0x0477
++#define IMX378_CHIP_ID			0x0378
++
++#define IMX477_REG_MODE_SELECT		0x0100
++#define IMX477_MODE_STANDBY		0x00
++#define IMX477_MODE_STREAMING		0x01
++
++#define IMX477_REG_ORIENTATION		0x101
++
++#define IMX477_XCLK_FREQ		24000000
++
++#define IMX477_DEFAULT_LINK_FREQ	450000000
++
++/* Pixel rate is fixed at 840MHz for all the modes */
++#define IMX477_PIXEL_RATE		840000000
++
++/* V_TIMING internal */
++#define IMX477_REG_FRAME_LENGTH		0x0340
++#define IMX477_FRAME_LENGTH_MAX		0xffdc
++
++/* H_TIMING internal */
++#define IMX477_REG_LINE_LENGTH		0x0342
++#define IMX477_LINE_LENGTH_MAX		0xfff0
++
++/* Long exposure multiplier */
++#define IMX477_LONG_EXP_SHIFT_MAX	7
++#define IMX477_LONG_EXP_SHIFT_REG	0x3100
++
++/* Exposure control */
++#define IMX477_REG_EXPOSURE		0x0202
++#define IMX477_EXPOSURE_OFFSET		22
++#define IMX477_EXPOSURE_MIN		4
++#define IMX477_EXPOSURE_STEP		1
++#define IMX477_EXPOSURE_DEFAULT		0x640
++#define IMX477_EXPOSURE_MAX		(IMX477_FRAME_LENGTH_MAX - \
++					 IMX477_EXPOSURE_OFFSET)
++
++/* Analog gain control */
++#define IMX477_REG_ANALOG_GAIN		0x0204
++#define IMX477_ANA_GAIN_MIN		0
++#define IMX477_ANA_GAIN_MAX		978
++#define IMX477_ANA_GAIN_STEP		1
++#define IMX477_ANA_GAIN_DEFAULT		0x0
++
++/* Digital gain control */
++#define IMX477_REG_DIGITAL_GAIN		0x020e
++#define IMX477_DGTL_GAIN_MIN		0x0100
++#define IMX477_DGTL_GAIN_MAX		0xffff
++#define IMX477_DGTL_GAIN_DEFAULT	0x0100
++#define IMX477_DGTL_GAIN_STEP		1
++
++/* Test Pattern Control */
++#define IMX477_REG_TEST_PATTERN		0x0600
++#define IMX477_TEST_PATTERN_DISABLE	0
++#define IMX477_TEST_PATTERN_SOLID_COLOR	1
++#define IMX477_TEST_PATTERN_COLOR_BARS	2
++#define IMX477_TEST_PATTERN_GREY_COLOR	3
++#define IMX477_TEST_PATTERN_PN9		4
++
++/* Test pattern colour components */
++#define IMX477_REG_TEST_PATTERN_R	0x0602
++#define IMX477_REG_TEST_PATTERN_GR	0x0604
++#define IMX477_REG_TEST_PATTERN_B	0x0606
++#define IMX477_REG_TEST_PATTERN_GB	0x0608
++#define IMX477_TEST_PATTERN_COLOUR_MIN	0
++#define IMX477_TEST_PATTERN_COLOUR_MAX	0x0fff
++#define IMX477_TEST_PATTERN_COLOUR_STEP	1
++#define IMX477_TEST_PATTERN_R_DEFAULT	IMX477_TEST_PATTERN_COLOUR_MAX
++#define IMX477_TEST_PATTERN_GR_DEFAULT	0
++#define IMX477_TEST_PATTERN_B_DEFAULT	0
++#define IMX477_TEST_PATTERN_GB_DEFAULT	0
++
++/* Trigger mode */
++#define IMX477_REG_MC_MODE		0x3f0b
++#define IMX477_REG_MS_SEL		0x3041
++#define IMX477_REG_XVS_IO_CTRL		0x3040
++#define IMX477_REG_EXTOUT_EN		0x4b81
++
++/* Embedded metadata stream structure */
++#define IMX477_EMBEDDED_LINE_WIDTH 16384
++#define IMX477_NUM_EMBEDDED_LINES 1
++
++enum pad_types {
++	IMAGE_PAD,
++	METADATA_PAD,
++	NUM_PADS
++};
++
++/* IMX477 native and active pixel array size. */
++#define IMX477_NATIVE_WIDTH		4072U
++#define IMX477_NATIVE_HEIGHT		3176U
++#define IMX477_PIXEL_ARRAY_LEFT		8U
++#define IMX477_PIXEL_ARRAY_TOP		16U
++#define IMX477_PIXEL_ARRAY_WIDTH	4056U
++#define IMX477_PIXEL_ARRAY_HEIGHT	3040U
++
++struct imx477_reg {
++	u16 address;
++	u8 val;
++};
++
++struct imx477_reg_list {
++	unsigned int num_of_regs;
++	const struct imx477_reg *regs;
++};
++
++/* Mode : resolution and related config&values */
++struct imx477_mode {
++	/* Frame width */
++	unsigned int width;
++
++	/* Frame height */
++	unsigned int height;
++
++	/* H-timing in pixels */
++	unsigned int line_length_pix;
++
++	/* Analog crop rectangle. */
++	struct v4l2_rect crop;
++
++	/* Highest possible framerate. */
++	struct v4l2_fract timeperframe_min;
++
++	/* Default framerate. */
++	struct v4l2_fract timeperframe_default;
++
++	/* Default register values */
++	struct imx477_reg_list reg_list;
++};
++
++static const struct imx477_reg mode_common_regs[] = {
++	{0x0136, 0x18},
++	{0x0137, 0x00},
++	{0xe000, 0x00},
++	{0xe07a, 0x01},
++	{0x0808, 0x02},
++	{0x4ae9, 0x18},
++	{0x4aea, 0x08},
++	{0xf61c, 0x04},
++	{0xf61e, 0x04},
++	{0x4ae9, 0x21},
++	{0x4aea, 0x80},
++	{0x38a8, 0x1f},
++	{0x38a9, 0xff},
++	{0x38aa, 0x1f},
++	{0x38ab, 0xff},
++	{0x55d4, 0x00},
++	{0x55d5, 0x00},
++	{0x55d6, 0x07},
++	{0x55d7, 0xff},
++	{0x55e8, 0x07},
++	{0x55e9, 0xff},
++	{0x55ea, 0x00},
++	{0x55eb, 0x00},
++	{0x574c, 0x07},
++	{0x574d, 0xff},
++	{0x574e, 0x00},
++	{0x574f, 0x00},
++	{0x5754, 0x00},
++	{0x5755, 0x00},
++	{0x5756, 0x07},
++	{0x5757, 0xff},
++	{0x5973, 0x04},
++	{0x5974, 0x01},
++	{0x5d13, 0xc3},
++	{0x5d14, 0x58},
++	{0x5d15, 0xa3},
++	{0x5d16, 0x1d},
++	{0x5d17, 0x65},
++	{0x5d18, 0x8c},
++	{0x5d1a, 0x06},
++	{0x5d1b, 0xa9},
++	{0x5d1c, 0x45},
++	{0x5d1d, 0x3a},
++	{0x5d1e, 0xab},
++	{0x5d1f, 0x15},
++	{0x5d21, 0x0e},
++	{0x5d22, 0x52},
++	{0x5d23, 0xaa},
++	{0x5d24, 0x7d},
++	{0x5d25, 0x57},
++	{0x5d26, 0xa8},
++	{0x5d37, 0x5a},
++	{0x5d38, 0x5a},
++	{0x5d77, 0x7f},
++	{0x7b75, 0x0e},
++	{0x7b76, 0x0b},
++	{0x7b77, 0x08},
++	{0x7b78, 0x0a},
++	{0x7b79, 0x47},
++	{0x7b7c, 0x00},
++	{0x7b7d, 0x00},
++	{0x8d1f, 0x00},
++	{0x8d27, 0x00},
++	{0x9004, 0x03},
++	{0x9200, 0x50},
++	{0x9201, 0x6c},
++	{0x9202, 0x71},
++	{0x9203, 0x00},
++	{0x9204, 0x71},
++	{0x9205, 0x01},
++	{0x9371, 0x6a},
++	{0x9373, 0x6a},
++	{0x9375, 0x64},
++	{0x991a, 0x00},
++	{0x996b, 0x8c},
++	{0x996c, 0x64},
++	{0x996d, 0x50},
++	{0x9a4c, 0x0d},
++	{0x9a4d, 0x0d},
++	{0xa001, 0x0a},
++	{0xa003, 0x0a},
++	{0xa005, 0x0a},
++	{0xa006, 0x01},
++	{0xa007, 0xc0},
++	{0xa009, 0xc0},
++	{0x3d8a, 0x01},
++	{0x4421, 0x04},
++	{0x7b3b, 0x01},
++	{0x7b4c, 0x00},
++	{0x9905, 0x00},
++	{0x9907, 0x00},
++	{0x9909, 0x00},
++	{0x990b, 0x00},
++	{0x9944, 0x3c},
++	{0x9947, 0x3c},
++	{0x994a, 0x8c},
++	{0x994b, 0x50},
++	{0x994c, 0x1b},
++	{0x994d, 0x8c},
++	{0x994e, 0x50},
++	{0x994f, 0x1b},
++	{0x9950, 0x8c},
++	{0x9951, 0x1b},
++	{0x9952, 0x0a},
++	{0x9953, 0x8c},
++	{0x9954, 0x1b},
++	{0x9955, 0x0a},
++	{0x9a13, 0x04},
++	{0x9a14, 0x04},
++	{0x9a19, 0x00},
++	{0x9a1c, 0x04},
++	{0x9a1d, 0x04},
++	{0x9a26, 0x05},
++	{0x9a27, 0x05},
++	{0x9a2c, 0x01},
++	{0x9a2d, 0x03},
++	{0x9a2f, 0x05},
++	{0x9a30, 0x05},
++	{0x9a41, 0x00},
++	{0x9a46, 0x00},
++	{0x9a47, 0x00},
++	{0x9c17, 0x35},
++	{0x9c1d, 0x31},
++	{0x9c29, 0x50},
++	{0x9c3b, 0x2f},
++	{0x9c41, 0x6b},
++	{0x9c47, 0x2d},
++	{0x9c4d, 0x40},
++	{0x9c6b, 0x00},
++	{0x9c71, 0xc8},
++	{0x9c73, 0x32},
++	{0x9c75, 0x04},
++	{0x9c7d, 0x2d},
++	{0x9c83, 0x40},
++	{0x9c94, 0x3f},
++	{0x9c95, 0x3f},
++	{0x9c96, 0x3f},
++	{0x9c97, 0x00},
++	{0x9c98, 0x00},
++	{0x9c99, 0x00},
++	{0x9c9a, 0x3f},
++	{0x9c9b, 0x3f},
++	{0x9c9c, 0x3f},
++	{0x9ca0, 0x0f},
++	{0x9ca1, 0x0f},
++	{0x9ca2, 0x0f},
++	{0x9ca3, 0x00},
++	{0x9ca4, 0x00},
++	{0x9ca5, 0x00},
++	{0x9ca6, 0x1e},
++	{0x9ca7, 0x1e},
++	{0x9ca8, 0x1e},
++	{0x9ca9, 0x00},
++	{0x9caa, 0x00},
++	{0x9cab, 0x00},
++	{0x9cac, 0x09},
++	{0x9cad, 0x09},
++	{0x9cae, 0x09},
++	{0x9cbd, 0x50},
++	{0x9cbf, 0x50},
++	{0x9cc1, 0x50},
++	{0x9cc3, 0x40},
++	{0x9cc5, 0x40},
++	{0x9cc7, 0x40},
++	{0x9cc9, 0x0a},
++	{0x9ccb, 0x0a},
++	{0x9ccd, 0x0a},
++	{0x9d17, 0x35},
++	{0x9d1d, 0x31},
++	{0x9d29, 0x50},
++	{0x9d3b, 0x2f},
++	{0x9d41, 0x6b},
++	{0x9d47, 0x42},
++	{0x9d4d, 0x5a},
++	{0x9d6b, 0x00},
++	{0x9d71, 0xc8},
++	{0x9d73, 0x32},
++	{0x9d75, 0x04},
++	{0x9d7d, 0x42},
++	{0x9d83, 0x5a},
++	{0x9d94, 0x3f},
++	{0x9d95, 0x3f},
++	{0x9d96, 0x3f},
++	{0x9d97, 0x00},
++	{0x9d98, 0x00},
++	{0x9d99, 0x00},
++	{0x9d9a, 0x3f},
++	{0x9d9b, 0x3f},
++	{0x9d9c, 0x3f},
++	{0x9d9d, 0x1f},
++	{0x9d9e, 0x1f},
++	{0x9d9f, 0x1f},
++	{0x9da0, 0x0f},
++	{0x9da1, 0x0f},
++	{0x9da2, 0x0f},
++	{0x9da3, 0x00},
++	{0x9da4, 0x00},
++	{0x9da5, 0x00},
++	{0x9da6, 0x1e},
++	{0x9da7, 0x1e},
++	{0x9da8, 0x1e},
++	{0x9da9, 0x00},
++	{0x9daa, 0x00},
++	{0x9dab, 0x00},
++	{0x9dac, 0x09},
++	{0x9dad, 0x09},
++	{0x9dae, 0x09},
++	{0x9dc9, 0x0a},
++	{0x9dcb, 0x0a},
++	{0x9dcd, 0x0a},
++	{0x9e17, 0x35},
++	{0x9e1d, 0x31},
++	{0x9e29, 0x50},
++	{0x9e3b, 0x2f},
++	{0x9e41, 0x6b},
++	{0x9e47, 0x2d},
++	{0x9e4d, 0x40},
++	{0x9e6b, 0x00},
++	{0x9e71, 0xc8},
++	{0x9e73, 0x32},
++	{0x9e75, 0x04},
++	{0x9e94, 0x0f},
++	{0x9e95, 0x0f},
++	{0x9e96, 0x0f},
++	{0x9e97, 0x00},
++	{0x9e98, 0x00},
++	{0x9e99, 0x00},
++	{0x9ea0, 0x0f},
++	{0x9ea1, 0x0f},
++	{0x9ea2, 0x0f},
++	{0x9ea3, 0x00},
++	{0x9ea4, 0x00},
++	{0x9ea5, 0x00},
++	{0x9ea6, 0x3f},
++	{0x9ea7, 0x3f},
++	{0x9ea8, 0x3f},
++	{0x9ea9, 0x00},
++	{0x9eaa, 0x00},
++	{0x9eab, 0x00},
++	{0x9eac, 0x09},
++	{0x9ead, 0x09},
++	{0x9eae, 0x09},
++	{0x9ec9, 0x0a},
++	{0x9ecb, 0x0a},
++	{0x9ecd, 0x0a},
++	{0x9f17, 0x35},
++	{0x9f1d, 0x31},
++	{0x9f29, 0x50},
++	{0x9f3b, 0x2f},
++	{0x9f41, 0x6b},
++	{0x9f47, 0x42},
++	{0x9f4d, 0x5a},
++	{0x9f6b, 0x00},
++	{0x9f71, 0xc8},
++	{0x9f73, 0x32},
++	{0x9f75, 0x04},
++	{0x9f94, 0x0f},
++	{0x9f95, 0x0f},
++	{0x9f96, 0x0f},
++	{0x9f97, 0x00},
++	{0x9f98, 0x00},
++	{0x9f99, 0x00},
++	{0x9f9a, 0x2f},
++	{0x9f9b, 0x2f},
++	{0x9f9c, 0x2f},
++	{0x9f9d, 0x00},
++	{0x9f9e, 0x00},
++	{0x9f9f, 0x00},
++	{0x9fa0, 0x0f},
++	{0x9fa1, 0x0f},
++	{0x9fa2, 0x0f},
++	{0x9fa3, 0x00},
++	{0x9fa4, 0x00},
++	{0x9fa5, 0x00},
++	{0x9fa6, 0x1e},
++	{0x9fa7, 0x1e},
++	{0x9fa8, 0x1e},
++	{0x9fa9, 0x00},
++	{0x9faa, 0x00},
++	{0x9fab, 0x00},
++	{0x9fac, 0x09},
++	{0x9fad, 0x09},
++	{0x9fae, 0x09},
++	{0x9fc9, 0x0a},
++	{0x9fcb, 0x0a},
++	{0x9fcd, 0x0a},
++	{0xa14b, 0xff},
++	{0xa151, 0x0c},
++	{0xa153, 0x50},
++	{0xa155, 0x02},
++	{0xa157, 0x00},
++	{0xa1ad, 0xff},
++	{0xa1b3, 0x0c},
++	{0xa1b5, 0x50},
++	{0xa1b9, 0x00},
++	{0xa24b, 0xff},
++	{0xa257, 0x00},
++	{0xa2ad, 0xff},
++	{0xa2b9, 0x00},
++	{0xb21f, 0x04},
++	{0xb35c, 0x00},
++	{0xb35e, 0x08},
++	{0x0112, 0x0c},
++	{0x0113, 0x0c},
++	{0x0114, 0x01},
++	{0x0350, 0x00},
++	{0xbcf1, 0x02},
++	{0x3ff9, 0x01},
++};
++
++/* 12 mpix 10fps */
++static const struct imx477_reg mode_4056x3040_regs[] = {
++	{0x0342, 0x5d},
++	{0x0343, 0xc0},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x00},
++	{0x0347, 0x00},
++	{0x0348, 0x0f},
++	{0x0349, 0xd7},
++	{0x034a, 0x0b},
++	{0x034b, 0xdf},
++	{0x00e3, 0x00},
++	{0x00e4, 0x00},
++	{0x00fc, 0x0a},
++	{0x00fd, 0x0a},
++	{0x00fe, 0x0a},
++	{0x00ff, 0x0a},
++	{0x0220, 0x00},
++	{0x0221, 0x11},
++	{0x0381, 0x01},
++	{0x0383, 0x01},
++	{0x0385, 0x01},
++	{0x0387, 0x01},
++	{0x0900, 0x00},
++	{0x0901, 0x11},
++	{0x0902, 0x02},
++	{0x3140, 0x02},
++	{0x3c00, 0x00},
++	{0x3c01, 0x03},
++	{0x3c02, 0xa2},
++	{0x3f0d, 0x01},
++	{0x5748, 0x07},
++	{0x5749, 0xff},
++	{0x574a, 0x00},
++	{0x574b, 0x00},
++	{0x7b75, 0x0a},
++	{0x7b76, 0x0c},
++	{0x7b77, 0x07},
++	{0x7b78, 0x06},
++	{0x7b79, 0x3c},
++	{0x7b53, 0x01},
++	{0x9369, 0x5a},
++	{0x936b, 0x55},
++	{0x936d, 0x28},
++	{0x9304, 0x00},
++	{0x9305, 0x00},
++	{0x9e9a, 0x2f},
++	{0x9e9b, 0x2f},
++	{0x9e9c, 0x2f},
++	{0x9e9d, 0x00},
++	{0x9e9e, 0x00},
++	{0x9e9f, 0x00},
++	{0xa2a9, 0x60},
++	{0xa2b7, 0x00},
++	{0x0401, 0x00},
++	{0x0404, 0x00},
++	{0x0405, 0x10},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x0f},
++	{0x040d, 0xd8},
++	{0x040e, 0x0b},
++	{0x040f, 0xe0},
++	{0x034c, 0x0f},
++	{0x034d, 0xd8},
++	{0x034e, 0x0b},
++	{0x034f, 0xe0},
++	{0x0301, 0x05},
++	{0x0303, 0x02},
++	{0x0305, 0x04},
++	{0x0306, 0x01},
++	{0x0307, 0x5e},
++	{0x0309, 0x0c},
++	{0x030b, 0x02},
++	{0x030d, 0x02},
++	{0x030e, 0x00},
++	{0x030f, 0x96},
++	{0x0310, 0x01},
++	{0x0820, 0x07},
++	{0x0821, 0x08},
++	{0x0822, 0x00},
++	{0x0823, 0x00},
++	{0x080a, 0x00},
++	{0x080b, 0x7f},
++	{0x080c, 0x00},
++	{0x080d, 0x4f},
++	{0x080e, 0x00},
++	{0x080f, 0x77},
++	{0x0810, 0x00},
++	{0x0811, 0x5f},
++	{0x0812, 0x00},
++	{0x0813, 0x57},
++	{0x0814, 0x00},
++	{0x0815, 0x4f},
++	{0x0816, 0x01},
++	{0x0817, 0x27},
++	{0x0818, 0x00},
++	{0x0819, 0x3f},
++	{0xe04c, 0x00},
++	{0xe04d, 0x7f},
++	{0xe04e, 0x00},
++	{0xe04f, 0x1f},
++	{0x3e20, 0x01},
++	{0x3e37, 0x00},
++	{0x3f50, 0x00},
++	{0x3f56, 0x02},
++	{0x3f57, 0xae},
++};
++
++/* 2x2 binned. 40fps */
++static const struct imx477_reg mode_2028x1520_regs[] = {
++	{0x0342, 0x31},
++	{0x0343, 0xc4},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x00},
++	{0x0347, 0x00},
++	{0x0348, 0x0f},
++	{0x0349, 0xd7},
++	{0x034a, 0x0b},
++	{0x034b, 0xdf},
++	{0x0220, 0x00},
++	{0x0221, 0x11},
++	{0x0381, 0x01},
++	{0x0383, 0x01},
++	{0x0385, 0x01},
++	{0x0387, 0x01},
++	{0x0900, 0x01},
++	{0x0901, 0x12},
++	{0x0902, 0x02},
++	{0x3140, 0x02},
++	{0x3c00, 0x00},
++	{0x3c01, 0x03},
++	{0x3c02, 0xa2},
++	{0x3f0d, 0x01},
++	{0x5748, 0x07},
++	{0x5749, 0xff},
++	{0x574a, 0x00},
++	{0x574b, 0x00},
++	{0x7b53, 0x01},
++	{0x9369, 0x73},
++	{0x936b, 0x64},
++	{0x936d, 0x5f},
++	{0x9304, 0x00},
++	{0x9305, 0x00},
++	{0x9e9a, 0x2f},
++	{0x9e9b, 0x2f},
++	{0x9e9c, 0x2f},
++	{0x9e9d, 0x00},
++	{0x9e9e, 0x00},
++	{0x9e9f, 0x00},
++	{0xa2a9, 0x60},
++	{0xa2b7, 0x00},
++	{0x0401, 0x01},
++	{0x0404, 0x00},
++	{0x0405, 0x20},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x0f},
++	{0x040d, 0xd8},
++	{0x040e, 0x0b},
++	{0x040f, 0xe0},
++	{0x034c, 0x07},
++	{0x034d, 0xec},
++	{0x034e, 0x05},
++	{0x034f, 0xf0},
++	{0x0301, 0x05},
++	{0x0303, 0x02},
++	{0x0305, 0x04},
++	{0x0306, 0x01},
++	{0x0307, 0x5e},
++	{0x0309, 0x0c},
++	{0x030b, 0x02},
++	{0x030d, 0x02},
++	{0x030e, 0x00},
++	{0x030f, 0x96},
++	{0x0310, 0x01},
++	{0x0820, 0x07},
++	{0x0821, 0x08},
++	{0x0822, 0x00},
++	{0x0823, 0x00},
++	{0x080a, 0x00},
++	{0x080b, 0x7f},
++	{0x080c, 0x00},
++	{0x080d, 0x4f},
++	{0x080e, 0x00},
++	{0x080f, 0x77},
++	{0x0810, 0x00},
++	{0x0811, 0x5f},
++	{0x0812, 0x00},
++	{0x0813, 0x57},
++	{0x0814, 0x00},
++	{0x0815, 0x4f},
++	{0x0816, 0x01},
++	{0x0817, 0x27},
++	{0x0818, 0x00},
++	{0x0819, 0x3f},
++	{0xe04c, 0x00},
++	{0xe04d, 0x7f},
++	{0xe04e, 0x00},
++	{0xe04f, 0x1f},
++	{0x3e20, 0x01},
++	{0x3e37, 0x00},
++	{0x3f50, 0x00},
++	{0x3f56, 0x01},
++	{0x3f57, 0x6c},
++};
++
++/* 1080p cropped mode */
++static const struct imx477_reg mode_2028x1080_regs[] = {
++	{0x0342, 0x31},
++	{0x0343, 0xc4},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x01},
++	{0x0347, 0xb8},
++	{0x0348, 0x0f},
++	{0x0349, 0xd7},
++	{0x034a, 0x0a},
++	{0x034b, 0x27},
++	{0x0220, 0x00},
++	{0x0221, 0x11},
++	{0x0381, 0x01},
++	{0x0383, 0x01},
++	{0x0385, 0x01},
++	{0x0387, 0x01},
++	{0x0900, 0x01},
++	{0x0901, 0x12},
++	{0x0902, 0x02},
++	{0x3140, 0x02},
++	{0x3c00, 0x00},
++	{0x3c01, 0x03},
++	{0x3c02, 0xa2},
++	{0x3f0d, 0x01},
++	{0x5748, 0x07},
++	{0x5749, 0xff},
++	{0x574a, 0x00},
++	{0x574b, 0x00},
++	{0x7b53, 0x01},
++	{0x9369, 0x73},
++	{0x936b, 0x64},
++	{0x936d, 0x5f},
++	{0x9304, 0x00},
++	{0x9305, 0x00},
++	{0x9e9a, 0x2f},
++	{0x9e9b, 0x2f},
++	{0x9e9c, 0x2f},
++	{0x9e9d, 0x00},
++	{0x9e9e, 0x00},
++	{0x9e9f, 0x00},
++	{0xa2a9, 0x60},
++	{0xa2b7, 0x00},
++	{0x0401, 0x01},
++	{0x0404, 0x00},
++	{0x0405, 0x20},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x0f},
++	{0x040d, 0xd8},
++	{0x040e, 0x04},
++	{0x040f, 0x38},
++	{0x034c, 0x07},
++	{0x034d, 0xec},
++	{0x034e, 0x04},
++	{0x034f, 0x38},
++	{0x0301, 0x05},
++	{0x0303, 0x02},
++	{0x0305, 0x04},
++	{0x0306, 0x01},
++	{0x0307, 0x5e},
++	{0x0309, 0x0c},
++	{0x030b, 0x02},
++	{0x030d, 0x02},
++	{0x030e, 0x00},
++	{0x030f, 0x96},
++	{0x0310, 0x01},
++	{0x0820, 0x07},
++	{0x0821, 0x08},
++	{0x0822, 0x00},
++	{0x0823, 0x00},
++	{0x080a, 0x00},
++	{0x080b, 0x7f},
++	{0x080c, 0x00},
++	{0x080d, 0x4f},
++	{0x080e, 0x00},
++	{0x080f, 0x77},
++	{0x0810, 0x00},
++	{0x0811, 0x5f},
++	{0x0812, 0x00},
++	{0x0813, 0x57},
++	{0x0814, 0x00},
++	{0x0815, 0x4f},
++	{0x0816, 0x01},
++	{0x0817, 0x27},
++	{0x0818, 0x00},
++	{0x0819, 0x3f},
++	{0xe04c, 0x00},
++	{0xe04d, 0x7f},
++	{0xe04e, 0x00},
++	{0xe04f, 0x1f},
++	{0x3e20, 0x01},
++	{0x3e37, 0x00},
++	{0x3f50, 0x00},
++	{0x3f56, 0x01},
++	{0x3f57, 0x6c},
++};
++
++/* 4x4 binned. 120fps */
++static const struct imx477_reg mode_1332x990_regs[] = {
++	{0x420b, 0x01},
++	{0x990c, 0x00},
++	{0x990d, 0x08},
++	{0x9956, 0x8c},
++	{0x9957, 0x64},
++	{0x9958, 0x50},
++	{0x9a48, 0x06},
++	{0x9a49, 0x06},
++	{0x9a4a, 0x06},
++	{0x9a4b, 0x06},
++	{0x9a4c, 0x06},
++	{0x9a4d, 0x06},
++	{0x0112, 0x0a},
++	{0x0113, 0x0a},
++	{0x0114, 0x01},
++	{0x0342, 0x1a},
++	{0x0343, 0x08},
++	{0x0340, 0x04},
++	{0x0341, 0x1a},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x02},
++	{0x0347, 0x10},
++	{0x0348, 0x0f},
++	{0x0349, 0xd7},
++	{0x034a, 0x09},
++	{0x034b, 0xcf},
++	{0x00e3, 0x00},
++	{0x00e4, 0x00},
++	{0x00fc, 0x0a},
++	{0x00fd, 0x0a},
++	{0x00fe, 0x0a},
++	{0x00ff, 0x0a},
++	{0xe013, 0x00},
++	{0x0220, 0x00},
++	{0x0221, 0x11},
++	{0x0381, 0x01},
++	{0x0383, 0x01},
++	{0x0385, 0x01},
++	{0x0387, 0x01},
++	{0x0900, 0x01},
++	{0x0901, 0x22},
++	{0x0902, 0x02},
++	{0x3140, 0x02},
++	{0x3c00, 0x00},
++	{0x3c01, 0x01},
++	{0x3c02, 0x9c},
++	{0x3f0d, 0x00},
++	{0x5748, 0x00},
++	{0x5749, 0x00},
++	{0x574a, 0x00},
++	{0x574b, 0xa4},
++	{0x7b75, 0x0e},
++	{0x7b76, 0x09},
++	{0x7b77, 0x08},
++	{0x7b78, 0x06},
++	{0x7b79, 0x34},
++	{0x7b53, 0x00},
++	{0x9369, 0x73},
++	{0x936b, 0x64},
++	{0x936d, 0x5f},
++	{0x9304, 0x03},
++	{0x9305, 0x80},
++	{0x9e9a, 0x2f},
++	{0x9e9b, 0x2f},
++	{0x9e9c, 0x2f},
++	{0x9e9d, 0x00},
++	{0x9e9e, 0x00},
++	{0x9e9f, 0x00},
++	{0xa2a9, 0x27},
++	{0xa2b7, 0x03},
++	{0x0401, 0x00},
++	{0x0404, 0x00},
++	{0x0405, 0x10},
++	{0x0408, 0x01},
++	{0x0409, 0x5c},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x05},
++	{0x040d, 0x34},
++	{0x040e, 0x03},
++	{0x040f, 0xde},
++	{0x034c, 0x05},
++	{0x034d, 0x34},
++	{0x034e, 0x03},
++	{0x034f, 0xde},
++	{0x0301, 0x05},
++	{0x0303, 0x02},
++	{0x0305, 0x02},
++	{0x0306, 0x00},
++	{0x0307, 0xaf},
++	{0x0309, 0x0a},
++	{0x030b, 0x02},
++	{0x030d, 0x02},
++	{0x030e, 0x00},
++	{0x030f, 0x96},
++	{0x0310, 0x01},
++	{0x0820, 0x07},
++	{0x0821, 0x08},
++	{0x0822, 0x00},
++	{0x0823, 0x00},
++	{0x080a, 0x00},
++	{0x080b, 0x7f},
++	{0x080c, 0x00},
++	{0x080d, 0x4f},
++	{0x080e, 0x00},
++	{0x080f, 0x77},
++	{0x0810, 0x00},
++	{0x0811, 0x5f},
++	{0x0812, 0x00},
++	{0x0813, 0x57},
++	{0x0814, 0x00},
++	{0x0815, 0x4f},
++	{0x0816, 0x01},
++	{0x0817, 0x27},
++	{0x0818, 0x00},
++	{0x0819, 0x3f},
++	{0xe04c, 0x00},
++	{0xe04d, 0x5f},
++	{0xe04e, 0x00},
++	{0xe04f, 0x1f},
++	{0x3e20, 0x01},
++	{0x3e37, 0x00},
++	{0x3f50, 0x00},
++	{0x3f56, 0x00},
++	{0x3f57, 0xbf},
++};
++
++/* Mode configs */
++static const struct imx477_mode supported_modes_12bit[] = {
++	{
++		/* 12MPix 10fps mode */
++		.width = 4056,
++		.height = 3040,
++		.line_length_pix = 0x5dc0,
++		.crop = {
++			.left = IMX477_PIXEL_ARRAY_LEFT,
++			.top = IMX477_PIXEL_ARRAY_TOP,
++			.width = 4056,
++			.height = 3040,
++		},
++		.timeperframe_min = {
++			.numerator = 100,
++			.denominator = 1000
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 1000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_4056x3040_regs),
++			.regs = mode_4056x3040_regs,
++		},
++	},
++	{
++		/* 2x2 binned 40fps mode */
++		.width = 2028,
++		.height = 1520,
++		.line_length_pix = 0x31c4,
++		.crop = {
++			.left = IMX477_PIXEL_ARRAY_LEFT,
++			.top = IMX477_PIXEL_ARRAY_TOP,
++			.width = 4056,
++			.height = 3040,
++		},
++		.timeperframe_min = {
++			.numerator = 100,
++			.denominator = 4000
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 3000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_2028x1520_regs),
++			.regs = mode_2028x1520_regs,
++		},
++	},
++	{
++		/* 1080p 50fps cropped mode */
++		.width = 2028,
++		.height = 1080,
++		.line_length_pix = 0x31c4,
++		.crop = {
++			.left = IMX477_PIXEL_ARRAY_LEFT,
++			.top = IMX477_PIXEL_ARRAY_TOP + 440,
++			.width = 4056,
++			.height = 2160,
++		},
++		.timeperframe_min = {
++			.numerator = 100,
++			.denominator = 5000
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 3000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_2028x1080_regs),
++			.regs = mode_2028x1080_regs,
++		},
++	}
++};
++
++static const struct imx477_mode supported_modes_10bit[] = {
++	{
++		/* 120fps. 2x2 binned and cropped */
++		.width = 1332,
++		.height = 990,
++		.line_length_pix = 6664,
++		.crop = {
++			/*
++			 * FIXME: the analog crop rectangle is actually
++			 * programmed with a horizontal displacement of 0
++			 * pixels, not 4. It gets shrunk after going through
++			 * the scaler. Move this information to the compose
++			 * rectangle once the driver is expanded to represent
++			 * its processing blocks with multiple subdevs.
++			 */
++			.left = IMX477_PIXEL_ARRAY_LEFT + 696,
++			.top = IMX477_PIXEL_ARRAY_TOP + 528,
++			.width = 2664,
++			.height = 1980,
++		},
++		.timeperframe_min = {
++			.numerator = 100,
++			.denominator = 12000
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 12000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_1332x990_regs),
++			.regs = mode_1332x990_regs,
++		}
++	}
++};
++
++/*
++ * The supported formats.
++ * This table MUST contain 4 entries per format, to cover the various flip
++ * combinations in the order
++ * - no flip
++ * - h flip
++ * - v flip
++ * - h&v flips
++ */
++static const u32 codes[] = {
++	/* 12-bit modes. */
++	MEDIA_BUS_FMT_SRGGB12_1X12,
++	MEDIA_BUS_FMT_SGRBG12_1X12,
++	MEDIA_BUS_FMT_SGBRG12_1X12,
++	MEDIA_BUS_FMT_SBGGR12_1X12,
++	/* 10-bit modes. */
++	MEDIA_BUS_FMT_SRGGB10_1X10,
++	MEDIA_BUS_FMT_SGRBG10_1X10,
++	MEDIA_BUS_FMT_SGBRG10_1X10,
++	MEDIA_BUS_FMT_SBGGR10_1X10,
++};
++
++static const char * const imx477_test_pattern_menu[] = {
++	"Disabled",
++	"Color Bars",
++	"Solid Color",
++	"Grey Color Bars",
++	"PN9"
++};
++
++static const int imx477_test_pattern_val[] = {
++	IMX477_TEST_PATTERN_DISABLE,
++	IMX477_TEST_PATTERN_COLOR_BARS,
++	IMX477_TEST_PATTERN_SOLID_COLOR,
++	IMX477_TEST_PATTERN_GREY_COLOR,
++	IMX477_TEST_PATTERN_PN9,
++};
++
++/* regulator supplies */
++static const char * const imx477_supply_name[] = {
++	/* Supplies can be enabled in any order */
++	"VANA",  /* Analog (2.8V) supply */
++	"VDIG",  /* Digital Core (1.05V) supply */
++	"VDDL",  /* IF (1.8V) supply */
++};
++
++#define IMX477_NUM_SUPPLIES ARRAY_SIZE(imx477_supply_name)
++
++/*
++ * Initialisation delay between XCLR low->high and the moment when the sensor
++ * can start capture (i.e. can leave software standby), given by T7 in the
++ * datasheet is 8ms.  This does include I2C setup time as well.
++ *
++ * Note, that delay between XCLR low->high and reading the CCI ID register (T6
++ * in the datasheet) is much smaller - 600us.
++ */
++#define IMX477_XCLR_MIN_DELAY_US	8000
++#define IMX477_XCLR_DELAY_RANGE_US	1000
++
++struct imx477_compatible_data {
++	unsigned int chip_id;
++	struct imx477_reg_list extra_regs;
++};
++
++struct imx477 {
++	struct v4l2_subdev sd;
++	struct media_pad pad[NUM_PADS];
++
++	unsigned int fmt_code;
++
++	struct clk *xclk;
++	u32 xclk_freq;
++
++	struct gpio_desc *reset_gpio;
++	struct regulator_bulk_data supplies[IMX477_NUM_SUPPLIES];
++
++	struct v4l2_ctrl_handler ctrl_handler;
++	/* V4L2 Controls */
++	struct v4l2_ctrl *pixel_rate;
++	struct v4l2_ctrl *exposure;
++	struct v4l2_ctrl *vflip;
++	struct v4l2_ctrl *hflip;
++	struct v4l2_ctrl *vblank;
++	struct v4l2_ctrl *hblank;
++
++	/* Current mode */
++	const struct imx477_mode *mode;
++
++	/*
++	 * Mutex for serialized access:
++	 * Protect sensor module set pad format and start/stop streaming safely.
++	 */
++	struct mutex mutex;
++
++	/* Streaming on/off */
++	bool streaming;
++
++	/* Rewrite common registers on stream on? */
++	bool common_regs_written;
++
++	/* Current long exposure factor in use. Set through V4L2_CID_VBLANK */
++	unsigned int long_exp_shift;
++
++	/* Any extra information related to different compatible sensors */
++	const struct imx477_compatible_data *compatible_data;
++};
++
++static inline struct imx477 *to_imx477(struct v4l2_subdev *_sd)
++{
++	return container_of(_sd, struct imx477, sd);
++}
++
++static inline void get_mode_table(unsigned int code,
++				  const struct imx477_mode **mode_list,
++				  unsigned int *num_modes)
++{
++	switch (code) {
++	/* 12-bit */
++	case MEDIA_BUS_FMT_SRGGB12_1X12:
++	case MEDIA_BUS_FMT_SGRBG12_1X12:
++	case MEDIA_BUS_FMT_SGBRG12_1X12:
++	case MEDIA_BUS_FMT_SBGGR12_1X12:
++		*mode_list = supported_modes_12bit;
++		*num_modes = ARRAY_SIZE(supported_modes_12bit);
++		break;
++	/* 10-bit */
++	case MEDIA_BUS_FMT_SRGGB10_1X10:
++	case MEDIA_BUS_FMT_SGRBG10_1X10:
++	case MEDIA_BUS_FMT_SGBRG10_1X10:
++	case MEDIA_BUS_FMT_SBGGR10_1X10:
++		*mode_list = supported_modes_10bit;
++		*num_modes = ARRAY_SIZE(supported_modes_10bit);
++		break;
++	default:
++		*mode_list = NULL;
++		*num_modes = 0;
++	}
++}
++
++/* Read registers up to 2 at a time */
++static int imx477_read_reg(struct imx477 *imx477, u16 reg, u32 len, u32 *val)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx477->sd);
++	struct i2c_msg msgs[2];
++	u8 addr_buf[2] = { reg >> 8, reg & 0xff };
++	u8 data_buf[4] = { 0, };
++	int ret;
++
++	if (len > 4)
++		return -EINVAL;
++
++	/* Write register address */
++	msgs[0].addr = client->addr;
++	msgs[0].flags = 0;
++	msgs[0].len = ARRAY_SIZE(addr_buf);
++	msgs[0].buf = addr_buf;
++
++	/* Read data from register */
++	msgs[1].addr = client->addr;
++	msgs[1].flags = I2C_M_RD;
++	msgs[1].len = len;
++	msgs[1].buf = &data_buf[4 - len];
++
++	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++	if (ret != ARRAY_SIZE(msgs))
++		return -EIO;
++
++	*val = get_unaligned_be32(data_buf);
++
++	return 0;
++}
++
++/* Write registers up to 2 at a time */
++static int imx477_write_reg(struct imx477 *imx477, u16 reg, u32 len, u32 val)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx477->sd);
++	u8 buf[6];
++
++	if (len > 4)
++		return -EINVAL;
++
++	put_unaligned_be16(reg, buf);
++	put_unaligned_be32(val << (8 * (4 - len)), buf + 2);
++	if (i2c_master_send(client, buf, len + 2) != len + 2)
++		return -EIO;
++
++	return 0;
++}
++
++/* Write a list of registers */
++static int imx477_write_regs(struct imx477 *imx477,
++			     const struct imx477_reg *regs, u32 len)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx477->sd);
++	unsigned int i;
++	int ret;
++
++	for (i = 0; i < len; i++) {
++		ret = imx477_write_reg(imx477, regs[i].address, 1, regs[i].val);
++		if (ret) {
++			dev_err_ratelimited(&client->dev,
++					    "Failed to write reg 0x%4.4x. error = %d\n",
++					    regs[i].address, ret);
++
++			return ret;
++		}
++	}
++
++	return 0;
++}
++
++/* Get bayer order based on flip setting. */
++static u32 imx477_get_format_code(struct imx477 *imx477, u32 code)
++{
++	unsigned int i;
++
++	lockdep_assert_held(&imx477->mutex);
++
++	for (i = 0; i < ARRAY_SIZE(codes); i++)
++		if (codes[i] == code)
++			break;
++
++	if (i >= ARRAY_SIZE(codes))
++		i = 0;
++
++	i = (i & ~3) | (imx477->vflip->val ? 2 : 0) |
++	    (imx477->hflip->val ? 1 : 0);
++
++	return codes[i];
++}
++
++static void imx477_set_default_format(struct imx477 *imx477)
++{
++	/* Set default mode to max resolution */
++	imx477->mode = &supported_modes_12bit[0];
++	imx477->fmt_code = MEDIA_BUS_FMT_SRGGB12_1X12;
++}
++
++static int imx477_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	struct imx477 *imx477 = to_imx477(sd);
++	struct v4l2_mbus_framefmt *try_fmt_img =
++		v4l2_subdev_get_try_format(sd, fh->pad, IMAGE_PAD);
++	struct v4l2_mbus_framefmt *try_fmt_meta =
++		v4l2_subdev_get_try_format(sd, fh->pad, METADATA_PAD);
++	struct v4l2_rect *try_crop;
++
++	mutex_lock(&imx477->mutex);
++
++	/* Initialize try_fmt for the image pad */
++	try_fmt_img->width = supported_modes_12bit[0].width;
++	try_fmt_img->height = supported_modes_12bit[0].height;
++	try_fmt_img->code = imx477_get_format_code(imx477,
++						   MEDIA_BUS_FMT_SRGGB12_1X12);
++	try_fmt_img->field = V4L2_FIELD_NONE;
++
++	/* Initialize try_fmt for the embedded metadata pad */
++	try_fmt_meta->width = IMX477_EMBEDDED_LINE_WIDTH;
++	try_fmt_meta->height = IMX477_NUM_EMBEDDED_LINES;
++	try_fmt_meta->code = MEDIA_BUS_FMT_SENSOR_DATA;
++	try_fmt_meta->field = V4L2_FIELD_NONE;
++
++	/* Initialize try_crop */
++	try_crop = v4l2_subdev_get_try_crop(sd, fh->pad, IMAGE_PAD);
++	try_crop->left = IMX477_PIXEL_ARRAY_LEFT;
++	try_crop->top = IMX477_PIXEL_ARRAY_TOP;
++	try_crop->width = IMX477_PIXEL_ARRAY_WIDTH;
++	try_crop->height = IMX477_PIXEL_ARRAY_HEIGHT;
++
++	mutex_unlock(&imx477->mutex);
++
++	return 0;
++}
++
++static void imx477_adjust_exposure_range(struct imx477 *imx477)
++{
++	int exposure_max, exposure_def;
++
++	/* Honour the VBLANK limits when setting exposure. */
++	exposure_max = imx477->mode->height + imx477->vblank->val -
++		       IMX477_EXPOSURE_OFFSET;
++	exposure_def = min(exposure_max, imx477->exposure->val);
++	__v4l2_ctrl_modify_range(imx477->exposure, imx477->exposure->minimum,
++				 exposure_max, imx477->exposure->step,
++				 exposure_def);
++}
++
++static int imx477_set_frame_length(struct imx477 *imx477, unsigned int val)
++{
++	int ret = 0;
++
++	imx477->long_exp_shift = 0;
++
++	while (val > IMX477_FRAME_LENGTH_MAX) {
++		imx477->long_exp_shift++;
++		val >>= 1;
++	}
++
++	ret = imx477_write_reg(imx477, IMX477_REG_FRAME_LENGTH,
++			       IMX477_REG_VALUE_16BIT, val);
++	if (ret)
++		return ret;
++
++	return imx477_write_reg(imx477, IMX477_LONG_EXP_SHIFT_REG,
++				IMX477_REG_VALUE_08BIT, imx477->long_exp_shift);
++}
++
++static int imx477_set_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct imx477 *imx477 =
++		container_of(ctrl->handler, struct imx477, ctrl_handler);
++	struct i2c_client *client = v4l2_get_subdevdata(&imx477->sd);
++	int ret = 0;
++
++	/*
++	 * The VBLANK control may change the limits of usable exposure, so check
++	 * and adjust if necessary.
++	 */
++	if (ctrl->id == V4L2_CID_VBLANK)
++		imx477_adjust_exposure_range(imx477);
++
++	/*
++	 * Applying V4L2 control value only happens
++	 * when power is up for streaming
++	 */
++	if (pm_runtime_get_if_in_use(&client->dev) == 0)
++		return 0;
++
++	switch (ctrl->id) {
++	case V4L2_CID_ANALOGUE_GAIN:
++		ret = imx477_write_reg(imx477, IMX477_REG_ANALOG_GAIN,
++				       IMX477_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_EXPOSURE:
++		ret = imx477_write_reg(imx477, IMX477_REG_EXPOSURE,
++				       IMX477_REG_VALUE_16BIT, ctrl->val >>
++							imx477->long_exp_shift);
++		break;
++	case V4L2_CID_DIGITAL_GAIN:
++		ret = imx477_write_reg(imx477, IMX477_REG_DIGITAL_GAIN,
++				       IMX477_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN:
++		ret = imx477_write_reg(imx477, IMX477_REG_TEST_PATTERN,
++				       IMX477_REG_VALUE_16BIT,
++				       imx477_test_pattern_val[ctrl->val]);
++		break;
++	case V4L2_CID_TEST_PATTERN_RED:
++		ret = imx477_write_reg(imx477, IMX477_REG_TEST_PATTERN_R,
++				       IMX477_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_GREENR:
++		ret = imx477_write_reg(imx477, IMX477_REG_TEST_PATTERN_GR,
++				       IMX477_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_BLUE:
++		ret = imx477_write_reg(imx477, IMX477_REG_TEST_PATTERN_B,
++				       IMX477_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_GREENB:
++		ret = imx477_write_reg(imx477, IMX477_REG_TEST_PATTERN_GB,
++				       IMX477_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_HFLIP:
++	case V4L2_CID_VFLIP:
++		ret = imx477_write_reg(imx477, IMX477_REG_ORIENTATION, 1,
++				       imx477->hflip->val |
++				       imx477->vflip->val << 1);
++		break;
++	case V4L2_CID_VBLANK:
++		ret = imx477_set_frame_length(imx477,
++					      imx477->mode->height + ctrl->val);
++		break;
++	case V4L2_CID_HBLANK:
++		ret = imx477_write_reg(imx477, IMX477_REG_LINE_LENGTH, 2,
++				       imx477->mode->width + ctrl->val);
++		break;
++	default:
++		dev_info(&client->dev,
++			 "ctrl(id:0x%x,val:0x%x) is not handled\n",
++			 ctrl->id, ctrl->val);
++		ret = -EINVAL;
++		break;
++	}
++
++	pm_runtime_put(&client->dev);
++
++	return ret;
++}
++
++static const struct v4l2_ctrl_ops imx477_ctrl_ops = {
++	.s_ctrl = imx477_set_ctrl,
++};
++
++static int imx477_enum_mbus_code(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_pad_config *cfg,
++				 struct v4l2_subdev_mbus_code_enum *code)
++{
++	struct imx477 *imx477 = to_imx477(sd);
++
++	if (code->pad >= NUM_PADS)
++		return -EINVAL;
++
++	if (code->pad == IMAGE_PAD) {
++		if (code->index >= (ARRAY_SIZE(codes) / 4))
++			return -EINVAL;
++
++		code->code = imx477_get_format_code(imx477,
++						    codes[code->index * 4]);
++	} else {
++		if (code->index > 0)
++			return -EINVAL;
++
++		code->code = MEDIA_BUS_FMT_SENSOR_DATA;
++	}
++
++	return 0;
++}
++
++static int imx477_enum_frame_size(struct v4l2_subdev *sd,
++				  struct v4l2_subdev_pad_config *cfg,
++				  struct v4l2_subdev_frame_size_enum *fse)
++{
++	struct imx477 *imx477 = to_imx477(sd);
++
++	if (fse->pad >= NUM_PADS)
++		return -EINVAL;
++
++	if (fse->pad == IMAGE_PAD) {
++		const struct imx477_mode *mode_list;
++		unsigned int num_modes;
++
++		get_mode_table(fse->code, &mode_list, &num_modes);
++
++		if (fse->index >= num_modes)
++			return -EINVAL;
++
++		if (fse->code != imx477_get_format_code(imx477, fse->code))
++			return -EINVAL;
++
++		fse->min_width = mode_list[fse->index].width;
++		fse->max_width = fse->min_width;
++		fse->min_height = mode_list[fse->index].height;
++		fse->max_height = fse->min_height;
++	} else {
++		if (fse->code != MEDIA_BUS_FMT_SENSOR_DATA || fse->index > 0)
++			return -EINVAL;
++
++		fse->min_width = IMX477_EMBEDDED_LINE_WIDTH;
++		fse->max_width = fse->min_width;
++		fse->min_height = IMX477_NUM_EMBEDDED_LINES;
++		fse->max_height = fse->min_height;
++	}
++
++	return 0;
++}
++
++static void imx477_reset_colorspace(struct v4l2_mbus_framefmt *fmt)
++{
++	fmt->colorspace = V4L2_COLORSPACE_RAW;
++	fmt->ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->colorspace);
++	fmt->quantization = V4L2_MAP_QUANTIZATION_DEFAULT(true,
++							  fmt->colorspace,
++							  fmt->ycbcr_enc);
++	fmt->xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(fmt->colorspace);
++}
++
++static void imx477_update_image_pad_format(struct imx477 *imx477,
++					   const struct imx477_mode *mode,
++					   struct v4l2_subdev_format *fmt)
++{
++	fmt->format.width = mode->width;
++	fmt->format.height = mode->height;
++	fmt->format.field = V4L2_FIELD_NONE;
++	imx477_reset_colorspace(&fmt->format);
++}
++
++static void imx477_update_metadata_pad_format(struct v4l2_subdev_format *fmt)
++{
++	fmt->format.width = IMX477_EMBEDDED_LINE_WIDTH;
++	fmt->format.height = IMX477_NUM_EMBEDDED_LINES;
++	fmt->format.code = MEDIA_BUS_FMT_SENSOR_DATA;
++	fmt->format.field = V4L2_FIELD_NONE;
++}
++
++static int imx477_get_pad_format(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_pad_config *cfg,
++				 struct v4l2_subdev_format *fmt)
++{
++	struct imx477 *imx477 = to_imx477(sd);
++
++	if (fmt->pad >= NUM_PADS)
++		return -EINVAL;
++
++	mutex_lock(&imx477->mutex);
++
++	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++		struct v4l2_mbus_framefmt *try_fmt =
++			v4l2_subdev_get_try_format(&imx477->sd, cfg, fmt->pad);
++		/* update the code which could change due to vflip or hflip: */
++		try_fmt->code = fmt->pad == IMAGE_PAD ?
++				imx477_get_format_code(imx477, try_fmt->code) :
++				MEDIA_BUS_FMT_SENSOR_DATA;
++		fmt->format = *try_fmt;
++	} else {
++		if (fmt->pad == IMAGE_PAD) {
++			imx477_update_image_pad_format(imx477, imx477->mode,
++						       fmt);
++			fmt->format.code =
++			       imx477_get_format_code(imx477, imx477->fmt_code);
++		} else {
++			imx477_update_metadata_pad_format(fmt);
++		}
++	}
++
++	mutex_unlock(&imx477->mutex);
++	return 0;
++}
++
++static
++unsigned int imx477_get_frame_length(const struct imx477_mode *mode,
++				     const struct v4l2_fract *timeperframe)
++{
++	u64 frame_length;
++
++	frame_length = (u64)timeperframe->numerator * IMX477_PIXEL_RATE;
++	do_div(frame_length,
++	       (u64)timeperframe->denominator * mode->line_length_pix);
++
++	if (WARN_ON(frame_length > IMX477_FRAME_LENGTH_MAX))
++		frame_length = IMX477_FRAME_LENGTH_MAX;
++
++	return max_t(unsigned int, frame_length, mode->height);
++}
++
++static void imx477_set_framing_limits(struct imx477 *imx477)
++{
++	unsigned int frm_length_min, frm_length_default, hblank_min;
++	const struct imx477_mode *mode = imx477->mode;
++
++	frm_length_min = imx477_get_frame_length(mode, &mode->timeperframe_min);
++	frm_length_default =
++		     imx477_get_frame_length(mode, &mode->timeperframe_default);
++
++	/* Default to no long exposure multiplier. */
++	imx477->long_exp_shift = 0;
++
++	/* Update limits and set FPS to default */
++	__v4l2_ctrl_modify_range(imx477->vblank, frm_length_min - mode->height,
++				 ((1 << IMX477_LONG_EXP_SHIFT_MAX) *
++					IMX477_FRAME_LENGTH_MAX) - mode->height,
++				 1, frm_length_default - mode->height);
++
++	/* Setting this will adjust the exposure limits as well. */
++	__v4l2_ctrl_s_ctrl(imx477->vblank, frm_length_default - mode->height);
++
++	hblank_min = mode->line_length_pix - mode->width;
++	__v4l2_ctrl_modify_range(imx477->hblank, hblank_min,
++				 IMX477_LINE_LENGTH_MAX, 1, hblank_min);
++	__v4l2_ctrl_s_ctrl(imx477->hblank, hblank_min);
++}
++
++static int imx477_set_pad_format(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_pad_config *cfg,
++				 struct v4l2_subdev_format *fmt)
++{
++	struct v4l2_mbus_framefmt *framefmt;
++	const struct imx477_mode *mode;
++	struct imx477 *imx477 = to_imx477(sd);
++
++	if (fmt->pad >= NUM_PADS)
++		return -EINVAL;
++
++	mutex_lock(&imx477->mutex);
++
++	if (fmt->pad == IMAGE_PAD) {
++		const struct imx477_mode *mode_list;
++		unsigned int num_modes;
++
++		/* Bayer order varies with flips */
++		fmt->format.code = imx477_get_format_code(imx477,
++							  fmt->format.code);
++
++		get_mode_table(fmt->format.code, &mode_list, &num_modes);
++
++		mode = v4l2_find_nearest_size(mode_list,
++					      num_modes,
++					      width, height,
++					      fmt->format.width,
++					      fmt->format.height);
++		imx477_update_image_pad_format(imx477, mode, fmt);
++		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++			framefmt = v4l2_subdev_get_try_format(sd, cfg,
++							      fmt->pad);
++			*framefmt = fmt->format;
++		} else if (imx477->mode != mode) {
++			imx477->mode = mode;
++			imx477->fmt_code = fmt->format.code;
++			imx477_set_framing_limits(imx477);
++		}
++	} else {
++		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++			framefmt = v4l2_subdev_get_try_format(sd, cfg,
++							      fmt->pad);
++			*framefmt = fmt->format;
++		} else {
++			/* Only one embedded data mode is supported */
++			imx477_update_metadata_pad_format(fmt);
++		}
++	}
++
++	mutex_unlock(&imx477->mutex);
++
++	return 0;
++}
++
++static const struct v4l2_rect *
++__imx477_get_pad_crop(struct imx477 *imx477, struct v4l2_subdev_pad_config *cfg,
++		      unsigned int pad, enum v4l2_subdev_format_whence which)
++{
++	switch (which) {
++	case V4L2_SUBDEV_FORMAT_TRY:
++		return v4l2_subdev_get_try_crop(&imx477->sd, cfg, pad);
++	case V4L2_SUBDEV_FORMAT_ACTIVE:
++		return &imx477->mode->crop;
++	}
++
++	return NULL;
++}
++
++static int imx477_get_selection(struct v4l2_subdev *sd,
++				struct v4l2_subdev_pad_config *cfg,
++				struct v4l2_subdev_selection *sel)
++{
++	switch (sel->target) {
++	case V4L2_SEL_TGT_CROP: {
++		struct imx477 *imx477 = to_imx477(sd);
++
++		mutex_lock(&imx477->mutex);
++		sel->r = *__imx477_get_pad_crop(imx477, cfg, sel->pad,
++						sel->which);
++		mutex_unlock(&imx477->mutex);
++
++		return 0;
++	}
++
++	case V4L2_SEL_TGT_NATIVE_SIZE:
++		sel->r.left = 0;
++		sel->r.top = 0;
++		sel->r.width = IMX477_NATIVE_WIDTH;
++		sel->r.height = IMX477_NATIVE_HEIGHT;
++
++		return 0;
++
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++	case V4L2_SEL_TGT_CROP_BOUNDS:
++		sel->r.left = IMX477_PIXEL_ARRAY_LEFT;
++		sel->r.top = IMX477_PIXEL_ARRAY_TOP;
++		sel->r.width = IMX477_PIXEL_ARRAY_WIDTH;
++		sel->r.height = IMX477_PIXEL_ARRAY_HEIGHT;
++
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++/* Start streaming */
++static int imx477_start_streaming(struct imx477 *imx477)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx477->sd);
++	const struct imx477_reg_list *reg_list;
++	const struct imx477_reg_list *extra_regs;
++	int ret;
++
++	if (!imx477->common_regs_written) {
++		ret = imx477_write_regs(imx477, mode_common_regs,
++					ARRAY_SIZE(mode_common_regs));
++		if (!ret) {
++			extra_regs = &imx477->compatible_data->extra_regs;
++			ret = imx477_write_regs(imx477,	extra_regs->regs,
++						extra_regs->num_of_regs);
++		}
++
++		if (ret) {
++			dev_err(&client->dev, "%s failed to set common settings\n",
++				__func__);
++			return ret;
++		}
++		imx477->common_regs_written = true;
++	}
++
++	/* Apply default values of current mode */
++	reg_list = &imx477->mode->reg_list;
++	ret = imx477_write_regs(imx477, reg_list->regs, reg_list->num_of_regs);
++	if (ret) {
++		dev_err(&client->dev, "%s failed to set mode\n", __func__);
++		return ret;
++	}
++
++	/* Set on-sensor DPC. */
++	imx477_write_reg(imx477, 0x0b05, IMX477_REG_VALUE_08BIT, !!dpc_enable);
++	imx477_write_reg(imx477, 0x0b06, IMX477_REG_VALUE_08BIT, !!dpc_enable);
++
++	/* Set vsync trigger mode */
++	if (trigger_mode != 0) {
++		/* trigger_mode == 1 for source, 2 for sink */
++		const u32 val = (trigger_mode == 1) ? 1 : 0;
++
++		imx477_write_reg(imx477, IMX477_REG_MC_MODE,
++				 IMX477_REG_VALUE_08BIT, 1);
++		imx477_write_reg(imx477, IMX477_REG_MS_SEL,
++				 IMX477_REG_VALUE_08BIT, val);
++		imx477_write_reg(imx477, IMX477_REG_XVS_IO_CTRL,
++				 IMX477_REG_VALUE_08BIT, val);
++		imx477_write_reg(imx477, IMX477_REG_EXTOUT_EN,
++				 IMX477_REG_VALUE_08BIT, val);
++	}
++
++	/* Apply customized values from user */
++	ret =  __v4l2_ctrl_handler_setup(imx477->sd.ctrl_handler);
++	if (ret)
++		return ret;
++
++	/* set stream on register */
++	return imx477_write_reg(imx477, IMX477_REG_MODE_SELECT,
++				IMX477_REG_VALUE_08BIT, IMX477_MODE_STREAMING);
++}
++
++/* Stop streaming */
++static void imx477_stop_streaming(struct imx477 *imx477)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx477->sd);
++	int ret;
++
++	/* set stream off register */
++	ret = imx477_write_reg(imx477, IMX477_REG_MODE_SELECT,
++			       IMX477_REG_VALUE_08BIT, IMX477_MODE_STANDBY);
++	if (ret)
++		dev_err(&client->dev, "%s failed to set stream\n", __func__);
++}
++
++static int imx477_set_stream(struct v4l2_subdev *sd, int enable)
++{
++	struct imx477 *imx477 = to_imx477(sd);
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	int ret = 0;
++
++	mutex_lock(&imx477->mutex);
++	if (imx477->streaming == enable) {
++		mutex_unlock(&imx477->mutex);
++		return 0;
++	}
++
++	if (enable) {
++		ret = pm_runtime_get_sync(&client->dev);
++		if (ret < 0) {
++			pm_runtime_put_noidle(&client->dev);
++			goto err_unlock;
++		}
++
++		/*
++		 * Apply default & customized values
++		 * and then start streaming.
++		 */
++		ret = imx477_start_streaming(imx477);
++		if (ret)
++			goto err_rpm_put;
++	} else {
++		imx477_stop_streaming(imx477);
++		pm_runtime_put(&client->dev);
++	}
++
++	imx477->streaming = enable;
++
++	/* vflip and hflip cannot change during streaming */
++	__v4l2_ctrl_grab(imx477->vflip, enable);
++	__v4l2_ctrl_grab(imx477->hflip, enable);
++
++	mutex_unlock(&imx477->mutex);
++
++	return ret;
++
++err_rpm_put:
++	pm_runtime_put(&client->dev);
++err_unlock:
++	mutex_unlock(&imx477->mutex);
++
++	return ret;
++}
++
++/* Power/clock management functions */
++static int imx477_power_on(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx477 *imx477 = to_imx477(sd);
++	int ret;
++
++	ret = regulator_bulk_enable(IMX477_NUM_SUPPLIES,
++				    imx477->supplies);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to enable regulators\n",
++			__func__);
++		return ret;
++	}
++
++	ret = clk_prepare_enable(imx477->xclk);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to enable clock\n",
++			__func__);
++		goto reg_off;
++	}
++
++	gpiod_set_value_cansleep(imx477->reset_gpio, 1);
++	usleep_range(IMX477_XCLR_MIN_DELAY_US,
++		     IMX477_XCLR_MIN_DELAY_US + IMX477_XCLR_DELAY_RANGE_US);
++
++	return 0;
++
++reg_off:
++	regulator_bulk_disable(IMX477_NUM_SUPPLIES, imx477->supplies);
++	return ret;
++}
++
++static int imx477_power_off(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx477 *imx477 = to_imx477(sd);
++
++	gpiod_set_value_cansleep(imx477->reset_gpio, 0);
++	regulator_bulk_disable(IMX477_NUM_SUPPLIES, imx477->supplies);
++	clk_disable_unprepare(imx477->xclk);
++
++	/* Force reprogramming of the common registers when powered up again. */
++	imx477->common_regs_written = false;
++
++	return 0;
++}
++
++static int __maybe_unused imx477_suspend(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx477 *imx477 = to_imx477(sd);
++
++	if (imx477->streaming)
++		imx477_stop_streaming(imx477);
++
++	return 0;
++}
++
++static int __maybe_unused imx477_resume(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx477 *imx477 = to_imx477(sd);
++	int ret;
++
++	if (imx477->streaming) {
++		ret = imx477_start_streaming(imx477);
++		if (ret)
++			goto error;
++	}
++
++	return 0;
++
++error:
++	imx477_stop_streaming(imx477);
++	imx477->streaming = 0;
++	return ret;
++}
++
++static int imx477_get_regulators(struct imx477 *imx477)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx477->sd);
++	unsigned int i;
++
++	for (i = 0; i < IMX477_NUM_SUPPLIES; i++)
++		imx477->supplies[i].supply = imx477_supply_name[i];
++
++	return devm_regulator_bulk_get(&client->dev,
++				       IMX477_NUM_SUPPLIES,
++				       imx477->supplies);
++}
++
++/* Verify chip ID */
++static int imx477_identify_module(struct imx477 *imx477, u32 expected_id)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx477->sd);
++	int ret;
++	u32 val;
++
++	ret = imx477_read_reg(imx477, IMX477_REG_CHIP_ID,
++			      IMX477_REG_VALUE_16BIT, &val);
++	if (ret) {
++		dev_err(&client->dev, "failed to read chip id %x, with error %d\n",
++			expected_id, ret);
++		return ret;
++	}
++
++	if (val != expected_id) {
++		dev_err(&client->dev, "chip id mismatch: %x!=%x\n",
++			expected_id, val);
++		return -EIO;
++	}
++
++	dev_info(&client->dev, "Device found is imx%x\n", val);
++
++	return 0;
++}
++
++static const struct v4l2_subdev_core_ops imx477_core_ops = {
++	.subscribe_event = v4l2_ctrl_subdev_subscribe_event,
++	.unsubscribe_event = v4l2_event_subdev_unsubscribe,
++};
++
++static const struct v4l2_subdev_video_ops imx477_video_ops = {
++	.s_stream = imx477_set_stream,
++};
++
++static const struct v4l2_subdev_pad_ops imx477_pad_ops = {
++	.enum_mbus_code = imx477_enum_mbus_code,
++	.get_fmt = imx477_get_pad_format,
++	.set_fmt = imx477_set_pad_format,
++	.get_selection = imx477_get_selection,
++	.enum_frame_size = imx477_enum_frame_size,
++};
++
++static const struct v4l2_subdev_ops imx477_subdev_ops = {
++	.core = &imx477_core_ops,
++	.video = &imx477_video_ops,
++	.pad = &imx477_pad_ops,
++};
++
++static const struct v4l2_subdev_internal_ops imx477_internal_ops = {
++	.open = imx477_open,
++};
++
++/* Initialize control handlers */
++static int imx477_init_controls(struct imx477 *imx477)
++{
++	struct v4l2_ctrl_handler *ctrl_hdlr;
++	struct i2c_client *client = v4l2_get_subdevdata(&imx477->sd);
++	struct v4l2_fwnode_device_properties props;
++	unsigned int i;
++	int ret;
++
++	ctrl_hdlr = &imx477->ctrl_handler;
++	ret = v4l2_ctrl_handler_init(ctrl_hdlr, 16);
++	if (ret)
++		return ret;
++
++	mutex_init(&imx477->mutex);
++	ctrl_hdlr->lock = &imx477->mutex;
++
++	/* By default, PIXEL_RATE is read only */
++	imx477->pixel_rate = v4l2_ctrl_new_std(ctrl_hdlr, &imx477_ctrl_ops,
++					       V4L2_CID_PIXEL_RATE,
++					       IMX477_PIXEL_RATE,
++					       IMX477_PIXEL_RATE, 1,
++					       IMX477_PIXEL_RATE);
++
++	/*
++	 * Create the controls here, but mode specific limits are setup
++	 * in the imx477_set_framing_limits() call below.
++	 */
++	imx477->vblank = v4l2_ctrl_new_std(ctrl_hdlr, &imx477_ctrl_ops,
++					   V4L2_CID_VBLANK, 0, 0xffff, 1, 0);
++	imx477->hblank = v4l2_ctrl_new_std(ctrl_hdlr, &imx477_ctrl_ops,
++					   V4L2_CID_HBLANK, 0, 0xffff, 1, 0);
++
++	imx477->exposure = v4l2_ctrl_new_std(ctrl_hdlr, &imx477_ctrl_ops,
++					     V4L2_CID_EXPOSURE,
++					     IMX477_EXPOSURE_MIN,
++					     IMX477_EXPOSURE_MAX,
++					     IMX477_EXPOSURE_STEP,
++					     IMX477_EXPOSURE_DEFAULT);
++
++	v4l2_ctrl_new_std(ctrl_hdlr, &imx477_ctrl_ops, V4L2_CID_ANALOGUE_GAIN,
++			  IMX477_ANA_GAIN_MIN, IMX477_ANA_GAIN_MAX,
++			  IMX477_ANA_GAIN_STEP, IMX477_ANA_GAIN_DEFAULT);
++
++	v4l2_ctrl_new_std(ctrl_hdlr, &imx477_ctrl_ops, V4L2_CID_DIGITAL_GAIN,
++			  IMX477_DGTL_GAIN_MIN, IMX477_DGTL_GAIN_MAX,
++			  IMX477_DGTL_GAIN_STEP, IMX477_DGTL_GAIN_DEFAULT);
++
++	imx477->hflip = v4l2_ctrl_new_std(ctrl_hdlr, &imx477_ctrl_ops,
++					  V4L2_CID_HFLIP, 0, 1, 1, 0);
++	if (imx477->hflip)
++		imx477->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
++	imx477->vflip = v4l2_ctrl_new_std(ctrl_hdlr, &imx477_ctrl_ops,
++					  V4L2_CID_VFLIP, 0, 1, 1, 0);
++	if (imx477->vflip)
++		imx477->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
++	v4l2_ctrl_new_std_menu_items(ctrl_hdlr, &imx477_ctrl_ops,
++				     V4L2_CID_TEST_PATTERN,
++				     ARRAY_SIZE(imx477_test_pattern_menu) - 1,
++				     0, 0, imx477_test_pattern_menu);
++	for (i = 0; i < 4; i++) {
++		/*
++		 * The assumption is that
++		 * V4L2_CID_TEST_PATTERN_GREENR == V4L2_CID_TEST_PATTERN_RED + 1
++		 * V4L2_CID_TEST_PATTERN_BLUE   == V4L2_CID_TEST_PATTERN_RED + 2
++		 * V4L2_CID_TEST_PATTERN_GREENB == V4L2_CID_TEST_PATTERN_RED + 3
++		 */
++		v4l2_ctrl_new_std(ctrl_hdlr, &imx477_ctrl_ops,
++				  V4L2_CID_TEST_PATTERN_RED + i,
++				  IMX477_TEST_PATTERN_COLOUR_MIN,
++				  IMX477_TEST_PATTERN_COLOUR_MAX,
++				  IMX477_TEST_PATTERN_COLOUR_STEP,
++				  IMX477_TEST_PATTERN_COLOUR_MAX);
++		/* The "Solid color" pattern is white by default */
++	}
++
++	if (ctrl_hdlr->error) {
++		ret = ctrl_hdlr->error;
++		dev_err(&client->dev, "%s control init failed (%d)\n",
++			__func__, ret);
++		goto error;
++	}
++
++	ret = v4l2_fwnode_device_parse(&client->dev, &props);
++	if (ret)
++		goto error;
++
++	ret = v4l2_ctrl_new_fwnode_properties(ctrl_hdlr, &imx477_ctrl_ops,
++					      &props);
++	if (ret)
++		goto error;
++
++	imx477->sd.ctrl_handler = ctrl_hdlr;
++
++	/* Setup exposure and frame/line length limits. */
++	imx477_set_framing_limits(imx477);
++
++	return 0;
++
++error:
++	v4l2_ctrl_handler_free(ctrl_hdlr);
++	mutex_destroy(&imx477->mutex);
++
++	return ret;
++}
++
++static void imx477_free_controls(struct imx477 *imx477)
++{
++	v4l2_ctrl_handler_free(imx477->sd.ctrl_handler);
++	mutex_destroy(&imx477->mutex);
++}
++
++static int imx477_check_hwcfg(struct device *dev)
++{
++	struct fwnode_handle *endpoint;
++	struct v4l2_fwnode_endpoint ep_cfg = {
++		.bus_type = V4L2_MBUS_CSI2_DPHY
++	};
++	int ret = -EINVAL;
++
++	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
++	if (!endpoint) {
++		dev_err(dev, "endpoint node not found\n");
++		return -EINVAL;
++	}
++
++	if (v4l2_fwnode_endpoint_alloc_parse(endpoint, &ep_cfg)) {
++		dev_err(dev, "could not parse endpoint\n");
++		goto error_out;
++	}
++
++	/* Check the number of MIPI CSI2 data lanes */
++	if (ep_cfg.bus.mipi_csi2.num_data_lanes != 2) {
++		dev_err(dev, "only 2 data lanes are currently supported\n");
++		goto error_out;
++	}
++
++	/* Check the link frequency set in device tree */
++	if (!ep_cfg.nr_of_link_frequencies) {
++		dev_err(dev, "link-frequency property not found in DT\n");
++		goto error_out;
++	}
++
++	if (ep_cfg.nr_of_link_frequencies != 1 ||
++	    ep_cfg.link_frequencies[0] != IMX477_DEFAULT_LINK_FREQ) {
++		dev_err(dev, "Link frequency not supported: %lld\n",
++			ep_cfg.link_frequencies[0]);
++		goto error_out;
++	}
++
++	ret = 0;
++
++error_out:
++	v4l2_fwnode_endpoint_free(&ep_cfg);
++	fwnode_handle_put(endpoint);
++
++	return ret;
++}
++
++static const struct imx477_compatible_data imx477_compatible = {
++	.chip_id = IMX477_CHIP_ID,
++	.extra_regs = {
++		.num_of_regs = 0,
++		.regs = NULL
++	}
++};
++
++static const struct imx477_reg imx378_regs[] = {
++	{0x3e35, 0x01},
++	{0x4421, 0x08},
++	{0x3ff9, 0x00},
++};
++
++static const struct imx477_compatible_data imx378_compatible = {
++	.chip_id = IMX378_CHIP_ID,
++	.extra_regs = {
++		.num_of_regs = ARRAY_SIZE(imx378_regs),
++		.regs = imx378_regs
++	}
++};
++
++static const struct of_device_id imx477_dt_ids[] = {
++	{ .compatible = "sony,imx477", .data = &imx477_compatible },
++	{ .compatible = "sony,imx378", .data = &imx378_compatible },
++	{ /* sentinel */ }
++};
++
++static int imx477_probe(struct i2c_client *client)
++{
++	struct device *dev = &client->dev;
++	struct imx477 *imx477;
++	const struct of_device_id *match;
++	int ret;
++
++	imx477 = devm_kzalloc(&client->dev, sizeof(*imx477), GFP_KERNEL);
++	if (!imx477)
++		return -ENOMEM;
++
++	v4l2_i2c_subdev_init(&imx477->sd, client, &imx477_subdev_ops);
++
++	match = of_match_device(imx477_dt_ids, dev);
++	if (!match)
++		return -ENODEV;
++	imx477->compatible_data =
++		(const struct imx477_compatible_data *)match->data;
++
++	/* Check the hardware configuration in device tree */
++	if (imx477_check_hwcfg(dev))
++		return -EINVAL;
++
++	/* Get system clock (xclk) */
++	imx477->xclk = devm_clk_get(dev, NULL);
++	if (IS_ERR(imx477->xclk)) {
++		dev_err(dev, "failed to get xclk\n");
++		return PTR_ERR(imx477->xclk);
++	}
++
++	imx477->xclk_freq = clk_get_rate(imx477->xclk);
++	if (imx477->xclk_freq != IMX477_XCLK_FREQ) {
++		dev_err(dev, "xclk frequency not supported: %d Hz\n",
++			imx477->xclk_freq);
++		return -EINVAL;
++	}
++
++	ret = imx477_get_regulators(imx477);
++	if (ret) {
++		dev_err(dev, "failed to get regulators\n");
++		return ret;
++	}
++
++	/* Request optional enable pin */
++	imx477->reset_gpio = devm_gpiod_get_optional(dev, "reset",
++						     GPIOD_OUT_HIGH);
++
++	/*
++	 * The sensor must be powered for imx477_identify_module()
++	 * to be able to read the CHIP_ID register
++	 */
++	ret = imx477_power_on(dev);
++	if (ret)
++		return ret;
++
++	ret = imx477_identify_module(imx477, imx477->compatible_data->chip_id);
++	if (ret)
++		goto error_power_off;
++
++	/* Initialize default format */
++	imx477_set_default_format(imx477);
++
++	/* Enable runtime PM and turn off the device */
++	pm_runtime_set_active(dev);
++	pm_runtime_enable(dev);
++	pm_runtime_idle(dev);
++
++	/* This needs the pm runtime to be registered. */
++	ret = imx477_init_controls(imx477);
++	if (ret)
++		goto error_power_off;
++
++	/* Initialize subdev */
++	imx477->sd.internal_ops = &imx477_internal_ops;
++	imx477->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE |
++			    V4L2_SUBDEV_FL_HAS_EVENTS;
++	imx477->sd.entity.function = MEDIA_ENT_F_CAM_SENSOR;
++
++	/* Initialize source pads */
++	imx477->pad[IMAGE_PAD].flags = MEDIA_PAD_FL_SOURCE;
++	imx477->pad[METADATA_PAD].flags = MEDIA_PAD_FL_SOURCE;
++
++	ret = media_entity_pads_init(&imx477->sd.entity, NUM_PADS, imx477->pad);
++	if (ret) {
++		dev_err(dev, "failed to init entity pads: %d\n", ret);
++		goto error_handler_free;
++	}
++
++	ret = v4l2_async_register_subdev_sensor(&imx477->sd);
++	if (ret < 0) {
++		dev_err(dev, "failed to register sensor sub-device: %d\n", ret);
++		goto error_media_entity;
++	}
++
++	return 0;
++
++error_media_entity:
++	media_entity_cleanup(&imx477->sd.entity);
++
++error_handler_free:
++	imx477_free_controls(imx477);
++
++error_power_off:
++	pm_runtime_disable(&client->dev);
++	pm_runtime_set_suspended(&client->dev);
++	imx477_power_off(&client->dev);
++
++	return ret;
++}
++
++static void imx477_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx477 *imx477 = to_imx477(sd);
++
++	v4l2_async_unregister_subdev(sd);
++	media_entity_cleanup(&sd->entity);
++	imx477_free_controls(imx477);
++
++	pm_runtime_disable(&client->dev);
++	if (!pm_runtime_status_suspended(&client->dev))
++		imx477_power_off(&client->dev);
++	pm_runtime_set_suspended(&client->dev);
++}
++
++MODULE_DEVICE_TABLE(of, imx477_dt_ids);
++
++static const struct dev_pm_ops imx477_pm_ops = {
++	SET_SYSTEM_SLEEP_PM_OPS(imx477_suspend, imx477_resume)
++	SET_RUNTIME_PM_OPS(imx477_power_off, imx477_power_on, NULL)
++};
++
++static struct i2c_driver imx477_i2c_driver = {
++	.driver = {
++		.name = "imx477",
++		.of_match_table	= imx477_dt_ids,
++		.pm = &imx477_pm_ops,
++	},
++	.probe_new = imx477_probe,
++	.remove = imx477_remove,
++};
++
++module_i2c_driver(imx477_i2c_driver);
++
++MODULE_AUTHOR("Naushir Patuck <naush@raspberrypi.com>");
++MODULE_DESCRIPTION("Sony IMX477 sensor driver");
++MODULE_LICENSE("GPL v2");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0196-media-i2c-imx519-Support-for-the-Sony-IMX519-sensor.patch b/target/linux/bcm27xx/patches-6.1/950-0196-media-i2c-imx519-Support-for-the-Sony-IMX519-sensor.patch
new file mode 100644
index 00000000000000..3aecaa17576bca
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0196-media-i2c-imx519-Support-for-the-Sony-IMX519-sensor.patch
@@ -0,0 +1,2317 @@
+From 9b5a7e22d42b137d7ced182ded00337c6f819795 Mon Sep 17 00:00:00 2001
+From: Lee Jackson <info@arducam.com>
+Date: Fri, 27 Aug 2021 14:36:55 +0800
+Subject: [PATCH] media: i2c: imx519: Support for the Sony IMX519
+ sensor
+
+dt-bindings: media: i2c: Add IMX519 CMOS sensor binding
+
+Add YAML device tree binding for IMX519 CMOS image sensor, and
+the relevant MAINTAINERS entries.
+
+Signed-off-by: Lee Jackson <info@arducam.com>
+
+media: i2c: Add driver for IMX519 sensor
+
+Adds a driver for the 16MPix IMX519 CSI2 sensor.
+Whilst the sensor supports 2 or 4 CSI2 data lanes, this driver
+currently only supports 2 lanes.
+
+The following Bayer modes are currently available:
+
+4656x3496 10-bit @ 10fps
+3840x2160 10-bit (cropped) @ 21fps
+2328x1748 10-bit (binned) @ 30fps
+1920x1080 10-bit (cropped/binned) @ 60fps
+1280x720 10-bit (cropped/binned) @ 120fps
+
+Signed-off-by: Lee Jackson <info@arducam.com>
+
+media: i2c: imx519: Advertise embedded data node on media pad 1
+
+This commit updates the imx519 driver to adverise support for embedded
+data streams.
+
+The imx519 sensor subdevice overloads the media pad to differentiate
+between image stream (pad 0) and embedded data stream (pad 1) when
+performing the v4l2_subdev_pad_ops functions.
+
+Signed-off-by: Lee Jackson <info@arducam.com>
+
+media: i2c: imx519: Sensor should report RAW color space
+
+Tested on Raspberry Pi running libcamera.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+media: i2c: Update imx519 Kconfig entry
+
+Bring the IMX519 Kconfig declaration in line with the upstream entries.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .../devicetree/bindings/media/i2c/imx519.yaml |  113 +
+ MAINTAINERS                                   |    8 +
+ drivers/media/i2c/Kconfig                     |   11 +
+ drivers/media/i2c/Makefile                    |    1 +
+ drivers/media/i2c/imx519.c                    | 2090 +++++++++++++++++
+ 5 files changed, 2223 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/imx519.yaml
+ create mode 100644 drivers/media/i2c/imx519.c
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/imx519.yaml
+@@ -0,0 +1,113 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/media/i2c/imx519.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Sony 1/2.5-Inch 16Mpixel CMOS Digital Image Sensor
++
++maintainers:
++  - Lee Jackson <info@arducam.com>
++
++description: |-
++  The Sony IMX519 is a 1/2.5-inch CMOS active pixel digital image sensor
++  with an active array size of 4656H x 3496V. It is programmable through
++  I2C interface. The I2C address is fixed to 0x1A as per sensor data sheet.
++  Image data is sent through MIPI CSI-2, which is configured as either 2 or
++  4 data lanes.
++
++properties:
++  compatible:
++    const: sony,imx519
++
++  reg:
++    description: I2C device address
++    maxItems: 1
++
++  clocks:
++    maxItems: 1
++
++  VDIG-supply:
++    description:
++      Digital I/O voltage supply, 1.05 volts
++
++  VANA-supply:
++    description:
++      Analog voltage supply, 2.8 volts
++
++  VDDL-supply:
++    description:
++      Digital core voltage supply, 1.8 volts
++
++  reset-gpios:
++    description: |-
++      Reference to the GPIO connected to the xclr pin, if any.
++      Must be released (set high) after all supplies and INCK are applied.
++
++  # See ../video-interfaces.txt for more details
++  port:
++    type: object
++    properties:
++      endpoint:
++        type: object
++        properties:
++          data-lanes:
++            description: |-
++              The sensor supports either two-lane, or four-lane operation.
++              For two-lane operation the property must be set to <1 2>.
++            items:
++              - const: 1
++              - const: 2
++
++          clock-noncontinuous:
++            type: boolean
++            description: |-
++              MIPI CSI-2 clock is non-continuous if this property is present,
++              otherwise it's continuous.
++
++          link-frequencies:
++            allOf:
++              - $ref: /schemas/types.yaml#/definitions/uint64-array
++            description:
++              Allowed data bus frequencies.
++
++        required:
++          - link-frequencies
++
++required:
++  - compatible
++  - reg
++  - clocks
++  - VANA-supply
++  - VDIG-supply
++  - VDDL-supply
++  - port
++
++additionalProperties: false
++
++examples:
++  - |
++    i2c0 {
++        #address-cells = <1>;
++        #size-cells = <0>;
++
++        imx519: sensor@1a {
++            compatible = "sony,imx519";
++            reg = <0x1a>;
++            clocks = <&imx519_clk>;
++            VANA-supply = <&imx519_vana>;   /* 2.8v */
++            VDIG-supply = <&imx519_vdig>;   /* 1.05v */
++            VDDL-supply = <&imx519_vddl>;   /* 1.8v */
++
++            port {
++                imx519_0: endpoint {
++                    remote-endpoint = <&csi1_ep>;
++                    data-lanes = <1 2>;
++                    clock-noncontinuous;
++                    link-frequencies = /bits/ 64 <493500000>;
++                };
++            };
++        };
++    };
++
++...
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -19287,6 +19287,14 @@ T:	git git://linuxtv.org/media_tree.git
+ F:	Documentation/devicetree/bindings/media/i2c/imx477.yaml
+ F:	drivers/media/i2c/imx477.c
+ 
++SONY IMX519 SENSOR DRIVER
++M:	Arducam Kernel Maintenance <info@arducam.com>
++L:	linux-media@vger.kernel.org
++S:	Maintained
++T:	git git://linuxtv.org/media_tree.git
++F:	Documentation/devicetree/bindings/media/i2c/imx519.yaml
++F:	drivers/media/i2c/imx519.c
++
+ SONY MEMORYSTICK SUBSYSTEM
+ M:	Maxim Levitsky <maximlevitsky@gmail.com>
+ M:	Alex Dubov <oakad@yahoo.com>
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -228,6 +228,17 @@ config VIDEO_IMX412
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called imx412.
+ 
++config VIDEO_IMX519
++	tristate "Arducam IMX519 sensor support"
++	depends on I2C && VIDEO_DEV
++	select VIDEO_V4L2_SUBDEV_API
++	help
++	  This is a Video4Linux2 sensor driver for the Arducam
++	  IMX519 camera.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called IMX519.
++
+ config VIDEO_MAX9271_LIB
+ 	tristate
+ 
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -49,6 +49,7 @@ obj-$(CONFIG_VIDEO_IMX335) += imx335.o
+ obj-$(CONFIG_VIDEO_IMX355) += imx355.o
+ obj-$(CONFIG_VIDEO_IMX412) += imx412.o
+ obj-$(CONFIG_VIDEO_IMX477) += imx477.o
++obj-$(CONFIG_VIDEO_IMX519) += imx519.o
+ obj-$(CONFIG_VIDEO_IR_I2C) += ir-kbd-i2c.o
+ obj-$(CONFIG_VIDEO_ISL7998X) += isl7998x.o
+ obj-$(CONFIG_VIDEO_KS0127) += ks0127.o
+--- /dev/null
++++ b/drivers/media/i2c/imx519.c
+@@ -0,0 +1,2090 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * A V4L2 driver for Sony IMX519 cameras.
++ * Copyright (C) 2021 Arducam Technology co., Ltd.
++ *
++ * Based on Sony IMX477 camera driver
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ */
++#include <asm/unaligned.h>
++#include <linux/clk.h>
++#include <linux/delay.h>
++#include <linux/gpio/consumer.h>
++#include <linux/i2c.h>
++#include <linux/module.h>
++#include <linux/of_device.h>
++#include <linux/pm_runtime.h>
++#include <linux/regulator/consumer.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-fwnode.h>
++#include <media/v4l2-mediabus.h>
++
++#define IMX519_REG_VALUE_08BIT		1
++#define IMX519_REG_VALUE_16BIT		2
++
++/* Chip ID */
++#define IMX519_REG_CHIP_ID		0x0016
++#define IMX519_CHIP_ID			0x0519
++
++#define IMX519_REG_MODE_SELECT		0x0100
++#define IMX519_MODE_STANDBY		0x00
++#define IMX519_MODE_STREAMING		0x01
++
++#define IMX519_REG_ORIENTATION		0x101
++
++#define IMX519_XCLK_FREQ		24000000
++
++#define IMX519_DEFAULT_LINK_FREQ	493500000
++
++/* Pixel rate is fixed at 686MHz for all the modes */
++#define IMX519_PIXEL_RATE		686000000
++
++/* V_TIMING internal */
++#define IMX519_REG_FRAME_LENGTH		0x0340
++#define IMX519_FRAME_LENGTH_MAX		0xffdc
++
++/* Long exposure multiplier */
++#define IMX519_LONG_EXP_SHIFT_MAX	7
++#define IMX519_LONG_EXP_SHIFT_REG	0x3100
++
++/* Exposure control */
++#define IMX519_REG_EXPOSURE		0x0202
++#define IMX519_EXPOSURE_OFFSET		32
++#define IMX519_EXPOSURE_MIN		1
++#define IMX519_EXPOSURE_STEP		1
++#define IMX519_EXPOSURE_DEFAULT		0x3e8
++#define IMX519_EXPOSURE_MAX		(IMX519_FRAME_LENGTH_MAX - \
++					 IMX519_EXPOSURE_OFFSET)
++
++/* Analog gain control */
++#define IMX519_REG_ANALOG_GAIN		0x0204
++#define IMX519_ANA_GAIN_MIN		0
++#define IMX519_ANA_GAIN_MAX		960
++#define IMX519_ANA_GAIN_STEP		1
++#define IMX519_ANA_GAIN_DEFAULT		0x0
++
++/* Digital gain control */
++#define IMX519_REG_DIGITAL_GAIN		0x020e
++#define IMX519_DGTL_GAIN_MIN		0x0100
++#define IMX519_DGTL_GAIN_MAX		0xffff
++#define IMX519_DGTL_GAIN_DEFAULT	0x0100
++#define IMX519_DGTL_GAIN_STEP		1
++
++/* Test Pattern Control */
++#define IMX519_REG_TEST_PATTERN		0x0600
++#define IMX519_TEST_PATTERN_DISABLE	0
++#define IMX519_TEST_PATTERN_SOLID_COLOR	1
++#define IMX519_TEST_PATTERN_COLOR_BARS	2
++#define IMX519_TEST_PATTERN_GREY_COLOR	3
++#define IMX519_TEST_PATTERN_PN9		4
++
++/* Test pattern colour components */
++#define IMX519_REG_TEST_PATTERN_R	0x0602
++#define IMX519_REG_TEST_PATTERN_GR	0x0604
++#define IMX519_REG_TEST_PATTERN_B	0x0606
++#define IMX519_REG_TEST_PATTERN_GB	0x0608
++#define IMX519_TEST_PATTERN_COLOUR_MIN	0
++#define IMX519_TEST_PATTERN_COLOUR_MAX	0x0fff
++#define IMX519_TEST_PATTERN_COLOUR_STEP	1
++#define IMX519_TEST_PATTERN_R_DEFAULT	IMX519_TEST_PATTERN_COLOUR_MAX
++#define IMX519_TEST_PATTERN_GR_DEFAULT	0
++#define IMX519_TEST_PATTERN_B_DEFAULT	0
++#define IMX519_TEST_PATTERN_GB_DEFAULT	0
++
++/* Embedded metadata stream structure */
++#define IMX519_EMBEDDED_LINE_WIDTH 16384
++#define IMX519_NUM_EMBEDDED_LINES 1
++
++enum pad_types {
++	IMAGE_PAD,
++	METADATA_PAD,
++	NUM_PADS
++};
++
++/* IMX519 native and active pixel array size. */
++#define IMX519_NATIVE_WIDTH		4672U
++#define IMX519_NATIVE_HEIGHT		3648U
++#define IMX519_PIXEL_ARRAY_LEFT		8U
++#define IMX519_PIXEL_ARRAY_TOP		48U
++#define IMX519_PIXEL_ARRAY_WIDTH	4656U
++#define IMX519_PIXEL_ARRAY_HEIGHT	3496U
++
++struct imx519_reg {
++	u16 address;
++	u8 val;
++};
++
++struct imx519_reg_list {
++	unsigned int num_of_regs;
++	const struct imx519_reg *regs;
++};
++
++/* Mode : resolution and related config&values */
++struct imx519_mode {
++	/* Frame width */
++	unsigned int width;
++
++	/* Frame height */
++	unsigned int height;
++
++	/* H-timing in pixels */
++	unsigned int line_length_pix;
++
++	/* Analog crop rectangle. */
++	struct v4l2_rect crop;
++
++	/* Highest possible framerate. */
++	struct v4l2_fract timeperframe_min;
++
++	/* Default framerate. */
++	struct v4l2_fract timeperframe_default;
++
++	/* Default register values */
++	struct imx519_reg_list reg_list;
++};
++
++static const struct imx519_reg mode_common_regs[] = {
++	{0x0136, 0x18},
++	{0x0137, 0x00},
++	{0x3c7e, 0x01},
++	{0x3c7f, 0x07},
++	{0x3020, 0x00},
++	{0x3e35, 0x01},
++	{0x3f7f, 0x01},
++	{0x5609, 0x57},
++	{0x5613, 0x51},
++	{0x561f, 0x5e},
++	{0x5623, 0xd2},
++	{0x5637, 0x11},
++	{0x5657, 0x11},
++	{0x5659, 0x12},
++	{0x5733, 0x60},
++	{0x5905, 0x57},
++	{0x590f, 0x51},
++	{0x591b, 0x5e},
++	{0x591f, 0xd2},
++	{0x5933, 0x11},
++	{0x5953, 0x11},
++	{0x5955, 0x12},
++	{0x5a2f, 0x60},
++	{0x5a85, 0x57},
++	{0x5a8f, 0x51},
++	{0x5a9b, 0x5e},
++	{0x5a9f, 0xd2},
++	{0x5ab3, 0x11},
++	{0x5ad3, 0x11},
++	{0x5ad5, 0x12},
++	{0x5baf, 0x60},
++	{0x5c15, 0x2a},
++	{0x5c17, 0x80},
++	{0x5c19, 0x31},
++	{0x5c1b, 0x87},
++	{0x5c25, 0x25},
++	{0x5c27, 0x7b},
++	{0x5c29, 0x2a},
++	{0x5c2b, 0x80},
++	{0x5c2d, 0x31},
++	{0x5c2f, 0x87},
++	{0x5c35, 0x2b},
++	{0x5c37, 0x81},
++	{0x5c39, 0x31},
++	{0x5c3b, 0x87},
++	{0x5c45, 0x25},
++	{0x5c47, 0x7b},
++	{0x5c49, 0x2a},
++	{0x5c4b, 0x80},
++	{0x5c4d, 0x31},
++	{0x5c4f, 0x87},
++	{0x5c55, 0x2d},
++	{0x5c57, 0x83},
++	{0x5c59, 0x32},
++	{0x5c5b, 0x88},
++	{0x5c65, 0x29},
++	{0x5c67, 0x7f},
++	{0x5c69, 0x2e},
++	{0x5c6b, 0x84},
++	{0x5c6d, 0x32},
++	{0x5c6f, 0x88},
++	{0x5e69, 0x04},
++	{0x5e9d, 0x00},
++	{0x5f18, 0x10},
++	{0x5f1a, 0x0e},
++	{0x5f20, 0x12},
++	{0x5f22, 0x10},
++	{0x5f24, 0x0e},
++	{0x5f28, 0x10},
++	{0x5f2a, 0x0e},
++	{0x5f30, 0x12},
++	{0x5f32, 0x10},
++	{0x5f34, 0x0e},
++	{0x5f38, 0x0f},
++	{0x5f39, 0x0d},
++	{0x5f3c, 0x11},
++	{0x5f3d, 0x0f},
++	{0x5f3e, 0x0d},
++	{0x5f61, 0x07},
++	{0x5f64, 0x05},
++	{0x5f67, 0x03},
++	{0x5f6a, 0x03},
++	{0x5f6d, 0x07},
++	{0x5f70, 0x07},
++	{0x5f73, 0x05},
++	{0x5f76, 0x02},
++	{0x5f79, 0x07},
++	{0x5f7c, 0x07},
++	{0x5f7f, 0x07},
++	{0x5f82, 0x07},
++	{0x5f85, 0x03},
++	{0x5f88, 0x02},
++	{0x5f8b, 0x01},
++	{0x5f8e, 0x01},
++	{0x5f91, 0x04},
++	{0x5f94, 0x05},
++	{0x5f97, 0x02},
++	{0x5f9d, 0x07},
++	{0x5fa0, 0x07},
++	{0x5fa3, 0x07},
++	{0x5fa6, 0x07},
++	{0x5fa9, 0x03},
++	{0x5fac, 0x01},
++	{0x5faf, 0x01},
++	{0x5fb5, 0x03},
++	{0x5fb8, 0x02},
++	{0x5fbb, 0x01},
++	{0x5fc1, 0x07},
++	{0x5fc4, 0x07},
++	{0x5fc7, 0x07},
++	{0x5fd1, 0x00},
++	{0x6302, 0x79},
++	{0x6305, 0x78},
++	{0x6306, 0xa5},
++	{0x6308, 0x03},
++	{0x6309, 0x20},
++	{0x630b, 0x0a},
++	{0x630d, 0x48},
++	{0x630f, 0x06},
++	{0x6311, 0xa4},
++	{0x6313, 0x03},
++	{0x6314, 0x20},
++	{0x6316, 0x0a},
++	{0x6317, 0x31},
++	{0x6318, 0x4a},
++	{0x631a, 0x06},
++	{0x631b, 0x40},
++	{0x631c, 0xa4},
++	{0x631e, 0x03},
++	{0x631f, 0x20},
++	{0x6321, 0x0a},
++	{0x6323, 0x4a},
++	{0x6328, 0x80},
++	{0x6329, 0x01},
++	{0x632a, 0x30},
++	{0x632b, 0x02},
++	{0x632c, 0x20},
++	{0x632d, 0x02},
++	{0x632e, 0x30},
++	{0x6330, 0x60},
++	{0x6332, 0x90},
++	{0x6333, 0x01},
++	{0x6334, 0x30},
++	{0x6335, 0x02},
++	{0x6336, 0x20},
++	{0x6338, 0x80},
++	{0x633a, 0xa0},
++	{0x633b, 0x01},
++	{0x633c, 0x60},
++	{0x633d, 0x02},
++	{0x633e, 0x60},
++	{0x633f, 0x01},
++	{0x6340, 0x30},
++	{0x6341, 0x02},
++	{0x6342, 0x20},
++	{0x6343, 0x03},
++	{0x6344, 0x80},
++	{0x6345, 0x03},
++	{0x6346, 0x90},
++	{0x6348, 0xf0},
++	{0x6349, 0x01},
++	{0x634a, 0x20},
++	{0x634b, 0x02},
++	{0x634c, 0x10},
++	{0x634d, 0x03},
++	{0x634e, 0x60},
++	{0x6350, 0xa0},
++	{0x6351, 0x01},
++	{0x6352, 0x60},
++	{0x6353, 0x02},
++	{0x6354, 0x50},
++	{0x6355, 0x02},
++	{0x6356, 0x60},
++	{0x6357, 0x01},
++	{0x6358, 0x30},
++	{0x6359, 0x02},
++	{0x635a, 0x30},
++	{0x635b, 0x03},
++	{0x635c, 0x90},
++	{0x635f, 0x01},
++	{0x6360, 0x10},
++	{0x6361, 0x01},
++	{0x6362, 0x40},
++	{0x6363, 0x02},
++	{0x6364, 0x50},
++	{0x6368, 0x70},
++	{0x636a, 0xa0},
++	{0x636b, 0x01},
++	{0x636c, 0x50},
++	{0x637d, 0xe4},
++	{0x637e, 0xb4},
++	{0x638c, 0x8e},
++	{0x638d, 0x38},
++	{0x638e, 0xe3},
++	{0x638f, 0x4c},
++	{0x6390, 0x30},
++	{0x6391, 0xc3},
++	{0x6392, 0xae},
++	{0x6393, 0xba},
++	{0x6394, 0xeb},
++	{0x6395, 0x6e},
++	{0x6396, 0x34},
++	{0x6397, 0xe3},
++	{0x6398, 0xcf},
++	{0x6399, 0x3c},
++	{0x639a, 0xf3},
++	{0x639b, 0x0c},
++	{0x639c, 0x30},
++	{0x639d, 0xc1},
++	{0x63b9, 0xa3},
++	{0x63ba, 0xfe},
++	{0x7600, 0x01},
++	{0x79a0, 0x01},
++	{0x79a1, 0x01},
++	{0x79a2, 0x01},
++	{0x79a3, 0x01},
++	{0x79a4, 0x01},
++	{0x79a5, 0x20},
++	{0x79a9, 0x00},
++	{0x79aa, 0x01},
++	{0x79ad, 0x00},
++	{0x79af, 0x00},
++	{0x8173, 0x01},
++	{0x835c, 0x01},
++	{0x8a74, 0x01},
++	{0x8c1f, 0x00},
++	{0x8c27, 0x00},
++	{0x8c3b, 0x03},
++	{0x9004, 0x0b},
++	{0x920c, 0x6a},
++	{0x920d, 0x22},
++	{0x920e, 0x6a},
++	{0x920f, 0x23},
++	{0x9214, 0x6a},
++	{0x9215, 0x20},
++	{0x9216, 0x6a},
++	{0x9217, 0x21},
++	{0x9385, 0x3e},
++	{0x9387, 0x1b},
++	{0x938d, 0x4d},
++	{0x938f, 0x43},
++	{0x9391, 0x1b},
++	{0x9395, 0x4d},
++	{0x9397, 0x43},
++	{0x9399, 0x1b},
++	{0x939d, 0x3e},
++	{0x939f, 0x2f},
++	{0x93a5, 0x43},
++	{0x93a7, 0x2f},
++	{0x93a9, 0x2f},
++	{0x93ad, 0x34},
++	{0x93af, 0x2f},
++	{0x93b5, 0x3e},
++	{0x93b7, 0x2f},
++	{0x93bd, 0x4d},
++	{0x93bf, 0x43},
++	{0x93c1, 0x2f},
++	{0x93c5, 0x4d},
++	{0x93c7, 0x43},
++	{0x93c9, 0x2f},
++	{0x974b, 0x02},
++	{0x995c, 0x8c},
++	{0x995d, 0x00},
++	{0x995e, 0x00},
++	{0x9963, 0x64},
++	{0x9964, 0x50},
++	{0xaa0a, 0x26},
++	{0xae03, 0x04},
++	{0xae04, 0x03},
++	{0xae05, 0x03},
++	{0xbc1c, 0x08},
++	{0xbcf1, 0x02},
++};
++
++/* 16 mpix 10fps */
++static const struct imx519_reg mode_4656x3496_regs[] = {
++	{0x0111, 0x02},
++	{0x0112, 0x0a},
++	{0x0113, 0x0a},
++	{0x0114, 0x01},
++	{0x0342, 0x42},
++	{0x0343, 0x00},
++	{0x0340, 0x0d},
++	{0x0341, 0xf4},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x00},
++	{0x0347, 0x00},
++	{0x0348, 0x12},
++	{0x0349, 0x2f},
++	{0x034a, 0x0d},
++	{0x034b, 0xa7},
++	{0x0220, 0x00},
++	{0x0221, 0x11},
++	{0x0222, 0x01},
++	{0x0900, 0x00},
++	{0x0901, 0x11},
++	{0x0902, 0x0a},
++	{0x3f4c, 0x01},
++	{0x3f4d, 0x01},
++	{0x4254, 0x7f},
++	{0x0401, 0x00},
++	{0x0404, 0x00},
++	{0x0405, 0x10},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x12},
++	{0x040d, 0x30},
++	{0x040e, 0x0d},
++	{0x040f, 0xa8},
++	{0x034c, 0x12},
++	{0x034d, 0x30},
++	{0x034e, 0x0d},
++	{0x034f, 0xa8},
++	{0x0301, 0x06},
++	{0x0303, 0x04},
++	{0x0305, 0x04},
++	{0x0306, 0x01},
++	{0x0307, 0x57},
++	{0x0309, 0x0a},
++	{0x030b, 0x02},
++	{0x030d, 0x04},
++	{0x030e, 0x01},
++	{0x030f, 0x49},
++	{0x0310, 0x01},
++	{0x0820, 0x07},
++	{0x0821, 0xb6},
++	{0x0822, 0x00},
++	{0x0823, 0x00},
++	{0x3e20, 0x01},
++	{0x3e37, 0x00},
++	{0x3e3b, 0x00},
++	{0x0106, 0x00},
++	{0x0b00, 0x00},
++	{0x3230, 0x00},
++	{0x3f14, 0x01},
++	{0x3f3c, 0x01},
++	{0x3f0d, 0x0a},
++	{0x3fbc, 0x00},
++	{0x3c06, 0x00},
++	{0x3c07, 0x48},
++	{0x3c0a, 0x00},
++	{0x3c0b, 0x00},
++	{0x3f78, 0x00},
++	{0x3f79, 0x40},
++	{0x3f7c, 0x00},
++	{0x3f7d, 0x00},
++};
++
++/* 4k 21fps mode */
++static const struct imx519_reg mode_3840x2160_regs[] = {
++	{0x0111, 0x02},
++	{0x0112, 0x0a},
++	{0x0113, 0x0a},
++	{0x0114, 0x01},
++	{0x0342, 0x38},
++	{0x0343, 0x70},
++	{0x0340, 0x08},
++	{0x0341, 0xd4},
++	{0x0344, 0x01},
++	{0x0345, 0x98},
++	{0x0346, 0x02},
++	{0x0347, 0xa0},
++	{0x0348, 0x10},
++	{0x0349, 0x97},
++	{0x034a, 0x0b},
++	{0x034b, 0x17},
++	{0x0220, 0x00},
++	{0x0221, 0x11},
++	{0x0222, 0x01},
++	{0x0900, 0x00},
++	{0x0901, 0x11},
++	{0x0902, 0x0a},
++	{0x3f4c, 0x01},
++	{0x3f4d, 0x01},
++	{0x4254, 0x7f},
++	{0x0401, 0x00},
++	{0x0404, 0x00},
++	{0x0405, 0x10},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x0f},
++	{0x040d, 0x00},
++	{0x040e, 0x08},
++	{0x040f, 0x70},
++	{0x034c, 0x0f},
++	{0x034d, 0x00},
++	{0x034e, 0x08},
++	{0x034f, 0x70},
++	{0x0301, 0x06},
++	{0x0303, 0x04},
++	{0x0305, 0x04},
++	{0x0306, 0x01},
++	{0x0307, 0x57},
++	{0x0309, 0x0a},
++	{0x030b, 0x02},
++	{0x030d, 0x04},
++	{0x030e, 0x01},
++	{0x030f, 0x49},
++	{0x0310, 0x01},
++	{0x0820, 0x07},
++	{0x0821, 0xb6},
++	{0x0822, 0x00},
++	{0x0823, 0x00},
++	{0x3e20, 0x01},
++	{0x3e37, 0x00},
++	{0x3e3b, 0x00},
++	{0x0106, 0x00},
++	{0x0b00, 0x00},
++	{0x3230, 0x00},
++	{0x3f14, 0x01},
++	{0x3f3c, 0x01},
++	{0x3f0d, 0x0a},
++	{0x3fbc, 0x00},
++	{0x3c06, 0x00},
++	{0x3c07, 0x48},
++	{0x3c0a, 0x00},
++	{0x3c0b, 0x00},
++	{0x3f78, 0x00},
++	{0x3f79, 0x40},
++	{0x3f7c, 0x00},
++	{0x3f7d, 0x00},
++};
++
++/* 2x2 binned 30fps mode */
++static const struct imx519_reg mode_2328x1748_regs[] = {
++	{0x0111, 0x02},
++	{0x0112, 0x0a},
++	{0x0113, 0x0a},
++	{0x0114, 0x01},
++	{0x0342, 0x24},
++	{0x0343, 0x12},
++	{0x0340, 0x09},
++	{0x0341, 0xac},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x00},
++	{0x0347, 0x00},
++	{0x0348, 0x12},
++	{0x0349, 0x2f},
++	{0x034a, 0x0d},
++	{0x034b, 0xa7},
++	{0x0220, 0x00},
++	{0x0221, 0x11},
++	{0x0222, 0x01},
++	{0x0900, 0x01},
++	{0x0901, 0x22},
++	{0x0902, 0x0a},
++	{0x3f4c, 0x01},
++	{0x3f4d, 0x01},
++	{0x4254, 0x7f},
++	{0x0401, 0x00},
++	{0x0404, 0x00},
++	{0x0405, 0x10},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x09},
++	{0x040d, 0x18},
++	{0x040e, 0x06},
++	{0x040f, 0xd4},
++	{0x034c, 0x09},
++	{0x034d, 0x18},
++	{0x034e, 0x06},
++	{0x034f, 0xd4},
++	{0x0301, 0x06},
++	{0x0303, 0x04},
++	{0x0305, 0x04},
++	{0x0306, 0x01},
++	{0x0307, 0x57},
++	{0x0309, 0x0a},
++	{0x030b, 0x02},
++	{0x030d, 0x04},
++	{0x030e, 0x01},
++	{0x030f, 0x49},
++	{0x0310, 0x01},
++	{0x0820, 0x07},
++	{0x0821, 0xb6},
++	{0x0822, 0x00},
++	{0x0823, 0x00},
++	{0x3e20, 0x01},
++	{0x3e37, 0x00},
++	{0x3e3b, 0x00},
++	{0x0106, 0x00},
++	{0x0b00, 0x00},
++	{0x3230, 0x00},
++	{0x3f14, 0x01},
++	{0x3f3c, 0x01},
++	{0x3f0d, 0x0a},
++	{0x3fbc, 0x00},
++	{0x3c06, 0x00},
++	{0x3c07, 0x48},
++	{0x3c0a, 0x00},
++	{0x3c0b, 0x00},
++	{0x3f78, 0x00},
++	{0x3f79, 0x40},
++	{0x3f7c, 0x00},
++	{0x3f7d, 0x00},
++};
++
++/* 1080p 60fps mode */
++static const struct imx519_reg mode_1920x1080_regs[] = {
++	{0x0111, 0x02},
++	{0x0112, 0x0a},
++	{0x0113, 0x0a},
++	{0x0114, 0x01},
++	{0x0342, 0x25},
++	{0x0343, 0xd9},
++	{0x0340, 0x04},
++	{0x0341, 0x9c},
++	{0x0344, 0x01},
++	{0x0345, 0x98},
++	{0x0346, 0x02},
++	{0x0347, 0xa2},
++	{0x0348, 0x10},
++	{0x0349, 0x97},
++	{0x034a, 0x0b},
++	{0x034b, 0x15},
++	{0x0220, 0x00},
++	{0x0221, 0x11},
++	{0x0222, 0x01},
++	{0x0900, 0x01},
++	{0x0901, 0x22},
++	{0x0902, 0x0a},
++	{0x3f4c, 0x01},
++	{0x3f4d, 0x01},
++	{0x4254, 0x7f},
++	{0x0401, 0x00},
++	{0x0404, 0x00},
++	{0x0405, 0x10},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x07},
++	{0x040d, 0x80},
++	{0x040e, 0x04},
++	{0x040f, 0x38},
++	{0x034c, 0x07},
++	{0x034d, 0x80},
++	{0x034e, 0x04},
++	{0x034f, 0x38},
++	{0x0301, 0x06},
++	{0x0303, 0x04},
++	{0x0305, 0x04},
++	{0x0306, 0x01},
++	{0x0307, 0x57},
++	{0x0309, 0x0a},
++	{0x030b, 0x02},
++	{0x030d, 0x04},
++	{0x030e, 0x01},
++	{0x030f, 0x49},
++	{0x0310, 0x01},
++	{0x0820, 0x07},
++	{0x0821, 0xb6},
++	{0x0822, 0x00},
++	{0x0823, 0x00},
++	{0x3e20, 0x01},
++	{0x3e37, 0x00},
++	{0x3e3b, 0x00},
++	{0x0106, 0x00},
++	{0x0b00, 0x00},
++	{0x3230, 0x00},
++	{0x3f14, 0x01},
++	{0x3f3c, 0x01},
++	{0x3f0d, 0x0a},
++	{0x3fbc, 0x00},
++	{0x3c06, 0x00},
++	{0x3c07, 0x48},
++	{0x3c0a, 0x00},
++	{0x3c0b, 0x00},
++	{0x3f78, 0x00},
++	{0x3f79, 0x40},
++	{0x3f7c, 0x00},
++	{0x3f7d, 0x00},
++};
++
++/* 720p 120fps mode */
++static const struct imx519_reg mode_1280x720_regs[] = {
++	{0x0111, 0x02},
++	{0x0112, 0x0a},
++	{0x0113, 0x0a},
++	{0x0114, 0x01},
++	{0x0342, 0x1b},
++	{0x0343, 0x3b},
++	{0x0340, 0x03},
++	{0x0341, 0x34},
++	{0x0344, 0x04},
++	{0x0345, 0x18},
++	{0x0346, 0x04},
++	{0x0347, 0x12},
++	{0x0348, 0x0e},
++	{0x0349, 0x17},
++	{0x034a, 0x09},
++	{0x034b, 0xb6},
++	{0x0220, 0x00},
++	{0x0221, 0x11},
++	{0x0222, 0x01},
++	{0x0900, 0x01},
++	{0x0901, 0x22},
++	{0x0902, 0x0a},
++	{0x3f4c, 0x01},
++	{0x3f4d, 0x01},
++	{0x4254, 0x7f},
++	{0x0401, 0x00},
++	{0x0404, 0x00},
++	{0x0405, 0x10},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x05},
++	{0x040d, 0x00},
++	{0x040e, 0x02},
++	{0x040f, 0xd0},
++	{0x034c, 0x05},
++	{0x034d, 0x00},
++	{0x034e, 0x02},
++	{0x034f, 0xd0},
++	{0x0301, 0x06},
++	{0x0303, 0x04},
++	{0x0305, 0x04},
++	{0x0306, 0x01},
++	{0x0307, 0x57},
++	{0x0309, 0x0a},
++	{0x030b, 0x02},
++	{0x030d, 0x04},
++	{0x030e, 0x01},
++	{0x030f, 0x49},
++	{0x0310, 0x01},
++	{0x0820, 0x07},
++	{0x0821, 0xb6},
++	{0x0822, 0x00},
++	{0x0823, 0x00},
++	{0x3e20, 0x01},
++	{0x3e37, 0x00},
++	{0x3e3b, 0x00},
++	{0x0106, 0x00},
++	{0x0b00, 0x00},
++	{0x3230, 0x00},
++	{0x3f14, 0x01},
++	{0x3f3c, 0x01},
++	{0x3f0d, 0x0a},
++	{0x3fbc, 0x00},
++	{0x3c06, 0x00},
++	{0x3c07, 0x48},
++	{0x3c0a, 0x00},
++	{0x3c0b, 0x00},
++	{0x3f78, 0x00},
++	{0x3f79, 0x40},
++	{0x3f7c, 0x00},
++	{0x3f7d, 0x00},
++};
++
++/* Mode configs */
++static const struct imx519_mode supported_modes_10bit[] = {
++	{
++		.width = 4656,
++		.height = 3496,
++		.line_length_pix = 0x4200,
++		.crop = {
++			.left = IMX519_PIXEL_ARRAY_LEFT,
++			.top = IMX519_PIXEL_ARRAY_TOP,
++			.width = 4656,
++			.height = 3496,
++		},
++		.timeperframe_min = {
++			.numerator = 100,
++			.denominator = 1000
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 1000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_4656x3496_regs),
++			.regs = mode_4656x3496_regs,
++		}
++	},
++	{
++		.width = 3840,
++		.height = 2160,
++		.line_length_pix = 0x3870,
++		.crop = {
++			.left = IMX519_PIXEL_ARRAY_LEFT + 408,
++			.top = IMX519_PIXEL_ARRAY_TOP + 672,
++			.width = 3840,
++			.height = 2160,
++		},
++		.timeperframe_min = {
++			.numerator = 100,
++			.denominator = 2100
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 2100
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_3840x2160_regs),
++			.regs = mode_3840x2160_regs,
++		}
++	},
++	{
++		.width = 2328,
++		.height = 1748,
++		.line_length_pix = 0x2412,
++		.crop = {
++			.left = IMX519_PIXEL_ARRAY_LEFT,
++			.top = IMX519_PIXEL_ARRAY_TOP,
++			.width = 4656,
++			.height = 3496,
++		},
++		.timeperframe_min = {
++			.numerator = 100,
++			.denominator = 3000
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 3000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_2328x1748_regs),
++			.regs = mode_2328x1748_regs,
++		}
++	},
++	{
++		.width = 1920,
++		.height = 1080,
++		.line_length_pix = 0x25D9,
++		.crop = {
++			.left = IMX519_PIXEL_ARRAY_LEFT + 408,
++			.top = IMX519_PIXEL_ARRAY_TOP + 674,
++			.width = 3840,
++			.height = 2160,
++		},
++		.timeperframe_min = {
++			.numerator = 100,
++			.denominator = 6000
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 6000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_1920x1080_regs),
++			.regs = mode_1920x1080_regs,
++		}
++	},
++	{
++		.width = 1280,
++		.height = 720,
++		.line_length_pix = 0x1B3B,
++		.crop = {
++			.left = IMX519_PIXEL_ARRAY_LEFT + 1048,
++			.top = IMX519_PIXEL_ARRAY_TOP + 1042,
++			.width = 2560,
++			.height = 1440,
++		},
++		.timeperframe_min = {
++			.numerator = 100,
++			.denominator = 12000
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 12000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_1280x720_regs),
++			.regs = mode_1280x720_regs,
++		}
++	}
++};
++
++/*
++ * The supported formats.
++ * This table MUST contain 4 entries per format, to cover the various flip
++ * combinations in the order
++ * - no flip
++ * - h flip
++ * - v flip
++ * - h&v flips
++ */
++static const u32 codes[] = {
++	/* 10-bit modes. */
++	MEDIA_BUS_FMT_SRGGB10_1X10,
++	MEDIA_BUS_FMT_SGRBG10_1X10,
++	MEDIA_BUS_FMT_SGBRG10_1X10,
++	MEDIA_BUS_FMT_SBGGR10_1X10,
++};
++
++static const char * const imx519_test_pattern_menu[] = {
++	"Disabled",
++	"Color Bars",
++	"Solid Color",
++	"Grey Color Bars",
++	"PN9"
++};
++
++static const int imx519_test_pattern_val[] = {
++	IMX519_TEST_PATTERN_DISABLE,
++	IMX519_TEST_PATTERN_COLOR_BARS,
++	IMX519_TEST_PATTERN_SOLID_COLOR,
++	IMX519_TEST_PATTERN_GREY_COLOR,
++	IMX519_TEST_PATTERN_PN9,
++};
++
++/* regulator supplies */
++static const char * const imx519_supply_name[] = {
++	/* Supplies can be enabled in any order */
++	"VANA",  /* Analog (2.8V) supply */
++	"VDIG",  /* Digital Core (1.05V) supply */
++	"VDDL",  /* IF (1.8V) supply */
++};
++
++#define IMX519_NUM_SUPPLIES ARRAY_SIZE(imx519_supply_name)
++
++/*
++ * Initialisation delay between XCLR low->high and the moment when the sensor
++ * can start capture (i.e. can leave software standby), given by T7 in the
++ * datasheet is 8ms.  This does include I2C setup time as well.
++ *
++ * Note, that delay between XCLR low->high and reading the CCI ID register (T6
++ * in the datasheet) is much smaller - 600us.
++ */
++#define IMX519_XCLR_MIN_DELAY_US	8000
++#define IMX519_XCLR_DELAY_RANGE_US	1000
++
++struct imx519 {
++	struct v4l2_subdev sd;
++	struct media_pad pad[NUM_PADS];
++
++	unsigned int fmt_code;
++
++	struct clk *xclk;
++
++	struct gpio_desc *reset_gpio;
++	struct regulator_bulk_data supplies[IMX519_NUM_SUPPLIES];
++
++	struct v4l2_ctrl_handler ctrl_handler;
++	/* V4L2 Controls */
++	struct v4l2_ctrl *pixel_rate;
++	struct v4l2_ctrl *exposure;
++	struct v4l2_ctrl *vflip;
++	struct v4l2_ctrl *hflip;
++	struct v4l2_ctrl *vblank;
++	struct v4l2_ctrl *hblank;
++
++	/* Current mode */
++	const struct imx519_mode *mode;
++
++	/*
++	 * Mutex for serialized access:
++	 * Protect sensor module set pad format and start/stop streaming safely.
++	 */
++	struct mutex mutex;
++
++	/* Streaming on/off */
++	bool streaming;
++
++	/* Rewrite common registers on stream on? */
++	bool common_regs_written;
++
++	/* Current long exposure factor in use. Set through V4L2_CID_VBLANK */
++	unsigned int long_exp_shift;
++};
++
++static inline struct imx519 *to_imx519(struct v4l2_subdev *_sd)
++{
++	return container_of(_sd, struct imx519, sd);
++}
++
++/* Read registers up to 2 at a time */
++static int imx519_read_reg(struct imx519 *imx519, u16 reg, u32 len, u32 *val)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx519->sd);
++	struct i2c_msg msgs[2];
++	u8 addr_buf[2] = { reg >> 8, reg & 0xff };
++	u8 data_buf[4] = { 0, };
++	int ret;
++
++	if (len > 4)
++		return -EINVAL;
++
++	/* Write register address */
++	msgs[0].addr = client->addr;
++	msgs[0].flags = 0;
++	msgs[0].len = ARRAY_SIZE(addr_buf);
++	msgs[0].buf = addr_buf;
++
++	/* Read data from register */
++	msgs[1].addr = client->addr;
++	msgs[1].flags = I2C_M_RD;
++	msgs[1].len = len;
++	msgs[1].buf = &data_buf[4 - len];
++
++	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++	if (ret != ARRAY_SIZE(msgs))
++		return -EIO;
++
++	*val = get_unaligned_be32(data_buf);
++
++	return 0;
++}
++
++/* Write registers up to 2 at a time */
++static int imx519_write_reg(struct imx519 *imx519, u16 reg, u32 len, u32 val)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx519->sd);
++	u8 buf[6];
++
++	if (len > 4)
++		return -EINVAL;
++
++	put_unaligned_be16(reg, buf);
++	put_unaligned_be32(val << (8 * (4 - len)), buf + 2);
++	if (i2c_master_send(client, buf, len + 2) != len + 2)
++		return -EIO;
++
++	return 0;
++}
++
++/* Write a list of registers */
++static int imx519_write_regs(struct imx519 *imx519,
++			     const struct imx519_reg *regs, u32 len)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx519->sd);
++	unsigned int i;
++	int ret;
++
++	for (i = 0; i < len; i++) {
++		ret = imx519_write_reg(imx519, regs[i].address, 1, regs[i].val);
++		if (ret) {
++			dev_err_ratelimited(&client->dev,
++					    "Failed to write reg 0x%4.4x. error = %d\n",
++					    regs[i].address, ret);
++
++			return ret;
++		}
++	}
++
++	return 0;
++}
++
++/* Get bayer order based on flip setting. */
++static u32 imx519_get_format_code(struct imx519 *imx519)
++{
++	unsigned int i;
++
++	lockdep_assert_held(&imx519->mutex);
++
++	i = (imx519->vflip->val ? 2 : 0) |
++	    (imx519->hflip->val ? 1 : 0);
++
++	return codes[i];
++}
++
++static int imx519_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	struct imx519 *imx519 = to_imx519(sd);
++	struct v4l2_mbus_framefmt *try_fmt_img =
++		v4l2_subdev_get_try_format(sd, fh->state, IMAGE_PAD);
++	struct v4l2_mbus_framefmt *try_fmt_meta =
++		v4l2_subdev_get_try_format(sd, fh->state, METADATA_PAD);
++	struct v4l2_rect *try_crop;
++
++	mutex_lock(&imx519->mutex);
++
++	/* Initialize try_fmt for the image pad */
++	try_fmt_img->width = supported_modes_10bit[0].width;
++	try_fmt_img->height = supported_modes_10bit[0].height;
++	try_fmt_img->code = imx519_get_format_code(imx519);
++	try_fmt_img->field = V4L2_FIELD_NONE;
++
++	/* Initialize try_fmt for the embedded metadata pad */
++	try_fmt_meta->width = IMX519_EMBEDDED_LINE_WIDTH;
++	try_fmt_meta->height = IMX519_NUM_EMBEDDED_LINES;
++	try_fmt_meta->code = MEDIA_BUS_FMT_SENSOR_DATA;
++	try_fmt_meta->field = V4L2_FIELD_NONE;
++
++	/* Initialize try_crop */
++	try_crop = v4l2_subdev_get_try_crop(sd, fh->state, IMAGE_PAD);
++	try_crop->left = IMX519_PIXEL_ARRAY_LEFT;
++	try_crop->top = IMX519_PIXEL_ARRAY_TOP;
++	try_crop->width = IMX519_PIXEL_ARRAY_WIDTH;
++	try_crop->height = IMX519_PIXEL_ARRAY_HEIGHT;
++
++	mutex_unlock(&imx519->mutex);
++
++	return 0;
++}
++
++static void imx519_adjust_exposure_range(struct imx519 *imx519)
++{
++	int exposure_max, exposure_def;
++
++	/* Honour the VBLANK limits when setting exposure. */
++	exposure_max = imx519->mode->height + imx519->vblank->val -
++		       IMX519_EXPOSURE_OFFSET;
++	exposure_def = min(exposure_max, imx519->exposure->val);
++	__v4l2_ctrl_modify_range(imx519->exposure, imx519->exposure->minimum,
++				 exposure_max, imx519->exposure->step,
++				 exposure_def);
++}
++
++static int imx519_set_frame_length(struct imx519 *imx519, unsigned int val)
++{
++	int ret = 0;
++
++	imx519->long_exp_shift = 0;
++
++	while (val > IMX519_FRAME_LENGTH_MAX) {
++		imx519->long_exp_shift++;
++		val >>= 1;
++	}
++
++	ret = imx519_write_reg(imx519, IMX519_REG_FRAME_LENGTH,
++			       IMX519_REG_VALUE_16BIT, val);
++	if (ret)
++		return ret;
++
++	return imx519_write_reg(imx519, IMX519_LONG_EXP_SHIFT_REG,
++				IMX519_REG_VALUE_08BIT, imx519->long_exp_shift);
++}
++
++static int imx519_set_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct imx519 *imx519 =
++		container_of(ctrl->handler, struct imx519, ctrl_handler);
++	struct i2c_client *client = v4l2_get_subdevdata(&imx519->sd);
++	int ret = 0;
++
++	/*
++	 * The VBLANK control may change the limits of usable exposure, so check
++	 * and adjust if necessary.
++	 */
++	if (ctrl->id == V4L2_CID_VBLANK)
++		imx519_adjust_exposure_range(imx519);
++
++	/*
++	 * Applying V4L2 control value only happens
++	 * when power is up for streaming
++	 */
++	if (pm_runtime_get_if_in_use(&client->dev) == 0)
++		return 0;
++
++	switch (ctrl->id) {
++	case V4L2_CID_ANALOGUE_GAIN:
++		ret = imx519_write_reg(imx519, IMX519_REG_ANALOG_GAIN,
++				       IMX519_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_EXPOSURE:
++		ret = imx519_write_reg(imx519, IMX519_REG_EXPOSURE,
++				       IMX519_REG_VALUE_16BIT, ctrl->val >>
++							imx519->long_exp_shift);
++		break;
++	case V4L2_CID_DIGITAL_GAIN:
++		ret = imx519_write_reg(imx519, IMX519_REG_DIGITAL_GAIN,
++				       IMX519_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN:
++		ret = imx519_write_reg(imx519, IMX519_REG_TEST_PATTERN,
++				       IMX519_REG_VALUE_16BIT,
++				       imx519_test_pattern_val[ctrl->val]);
++		break;
++	case V4L2_CID_TEST_PATTERN_RED:
++		ret = imx519_write_reg(imx519, IMX519_REG_TEST_PATTERN_R,
++				       IMX519_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_GREENR:
++		ret = imx519_write_reg(imx519, IMX519_REG_TEST_PATTERN_GR,
++				       IMX519_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_BLUE:
++		ret = imx519_write_reg(imx519, IMX519_REG_TEST_PATTERN_B,
++				       IMX519_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_GREENB:
++		ret = imx519_write_reg(imx519, IMX519_REG_TEST_PATTERN_GB,
++				       IMX519_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_HFLIP:
++	case V4L2_CID_VFLIP:
++		ret = imx519_write_reg(imx519, IMX519_REG_ORIENTATION, 1,
++				       imx519->hflip->val |
++				       imx519->vflip->val << 1);
++		break;
++	case V4L2_CID_VBLANK:
++		ret = imx519_set_frame_length(imx519,
++					      imx519->mode->height + ctrl->val);
++		break;
++	default:
++		dev_info(&client->dev,
++			 "ctrl(id:0x%x,val:0x%x) is not handled\n",
++			 ctrl->id, ctrl->val);
++		ret = -EINVAL;
++		break;
++	}
++
++	pm_runtime_put(&client->dev);
++
++	return ret;
++}
++
++static const struct v4l2_ctrl_ops imx519_ctrl_ops = {
++	.s_ctrl = imx519_set_ctrl,
++};
++
++static int imx519_enum_mbus_code(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *sd_state,
++				 struct v4l2_subdev_mbus_code_enum *code)
++{
++	struct imx519 *imx519 = to_imx519(sd);
++
++	if (code->pad >= NUM_PADS)
++		return -EINVAL;
++
++	if (code->pad == IMAGE_PAD) {
++		if (code->index > 0)
++			return -EINVAL;
++
++		code->code = imx519_get_format_code(imx519);
++	} else {
++		if (code->index > 0)
++			return -EINVAL;
++
++		code->code = MEDIA_BUS_FMT_SENSOR_DATA;
++	}
++
++	return 0;
++}
++
++static int imx519_enum_frame_size(struct v4l2_subdev *sd,
++				  struct v4l2_subdev_state *sd_state,
++				  struct v4l2_subdev_frame_size_enum *fse)
++{
++	struct imx519 *imx519 = to_imx519(sd);
++
++	if (fse->pad >= NUM_PADS)
++		return -EINVAL;
++
++	if (fse->pad == IMAGE_PAD) {
++		if (fse->index >= ARRAY_SIZE(supported_modes_10bit))
++			return -EINVAL;
++
++		if (fse->code != imx519_get_format_code(imx519))
++			return -EINVAL;
++
++		fse->min_width = supported_modes_10bit[fse->index].width;
++		fse->max_width = fse->min_width;
++		fse->min_height = supported_modes_10bit[fse->index].height;
++		fse->max_height = fse->min_height;
++	} else {
++		if (fse->code != MEDIA_BUS_FMT_SENSOR_DATA || fse->index > 0)
++			return -EINVAL;
++
++		fse->min_width = IMX519_EMBEDDED_LINE_WIDTH;
++		fse->max_width = fse->min_width;
++		fse->min_height = IMX519_NUM_EMBEDDED_LINES;
++		fse->max_height = fse->min_height;
++	}
++
++	return 0;
++}
++
++static void imx519_reset_colorspace(struct v4l2_mbus_framefmt *fmt)
++{
++	fmt->colorspace = V4L2_COLORSPACE_RAW;
++	fmt->ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->colorspace);
++	fmt->quantization = V4L2_MAP_QUANTIZATION_DEFAULT(true,
++							  fmt->colorspace,
++							  fmt->ycbcr_enc);
++	fmt->xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(fmt->colorspace);
++}
++
++static void imx519_update_image_pad_format(struct imx519 *imx519,
++					   const struct imx519_mode *mode,
++					   struct v4l2_subdev_format *fmt)
++{
++	fmt->format.width = mode->width;
++	fmt->format.height = mode->height;
++	fmt->format.field = V4L2_FIELD_NONE;
++	imx519_reset_colorspace(&fmt->format);
++}
++
++static void imx519_update_metadata_pad_format(struct v4l2_subdev_format *fmt)
++{
++	fmt->format.width = IMX519_EMBEDDED_LINE_WIDTH;
++	fmt->format.height = IMX519_NUM_EMBEDDED_LINES;
++	fmt->format.code = MEDIA_BUS_FMT_SENSOR_DATA;
++	fmt->format.field = V4L2_FIELD_NONE;
++}
++
++static int imx519_get_pad_format(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *sd_state,
++				 struct v4l2_subdev_format *fmt)
++{
++	struct imx519 *imx519 = to_imx519(sd);
++
++	if (fmt->pad >= NUM_PADS)
++		return -EINVAL;
++
++	mutex_lock(&imx519->mutex);
++
++	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++		struct v4l2_mbus_framefmt *try_fmt =
++			v4l2_subdev_get_try_format(&imx519->sd, sd_state,
++						   fmt->pad);
++		/* update the code which could change due to vflip or hflip: */
++		try_fmt->code = fmt->pad == IMAGE_PAD ?
++				imx519_get_format_code(imx519) :
++				MEDIA_BUS_FMT_SENSOR_DATA;
++		fmt->format = *try_fmt;
++	} else {
++		if (fmt->pad == IMAGE_PAD) {
++			imx519_update_image_pad_format(imx519, imx519->mode,
++						       fmt);
++			fmt->format.code =
++			       imx519_get_format_code(imx519);
++		} else {
++			imx519_update_metadata_pad_format(fmt);
++		}
++	}
++
++	mutex_unlock(&imx519->mutex);
++	return 0;
++}
++
++static
++unsigned int imx519_get_frame_length(const struct imx519_mode *mode,
++				     const struct v4l2_fract *timeperframe)
++{
++	u64 frame_length;
++
++	frame_length = (u64)timeperframe->numerator * IMX519_PIXEL_RATE;
++	do_div(frame_length,
++	       (u64)timeperframe->denominator * mode->line_length_pix);
++
++	if (WARN_ON(frame_length > IMX519_FRAME_LENGTH_MAX))
++		frame_length = IMX519_FRAME_LENGTH_MAX;
++
++	return max_t(unsigned int, frame_length, mode->height);
++}
++
++static void imx519_set_framing_limits(struct imx519 *imx519)
++{
++	unsigned int frm_length_min, frm_length_default, hblank;
++	const struct imx519_mode *mode = imx519->mode;
++
++	frm_length_min = imx519_get_frame_length(mode, &mode->timeperframe_min);
++	frm_length_default =
++		     imx519_get_frame_length(mode, &mode->timeperframe_default);
++
++	/* Default to no long exposure multiplier. */
++	imx519->long_exp_shift = 0;
++
++	/* Update limits and set FPS to default */
++	__v4l2_ctrl_modify_range(imx519->vblank, frm_length_min - mode->height,
++				 ((1 << IMX519_LONG_EXP_SHIFT_MAX) *
++					IMX519_FRAME_LENGTH_MAX) - mode->height,
++				 1, frm_length_default - mode->height);
++
++	/* Setting this will adjust the exposure limits as well. */
++	__v4l2_ctrl_s_ctrl(imx519->vblank, frm_length_default - mode->height);
++
++	/*
++	 * Currently PPL is fixed to the mode specified value, so hblank
++	 * depends on mode->width only, and is not changeable in any
++	 * way other than changing the mode.
++	 */
++	hblank = mode->line_length_pix - mode->width;
++	__v4l2_ctrl_modify_range(imx519->hblank, hblank, hblank, 1, hblank);
++}
++
++static int imx519_set_pad_format(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *sd_state,
++				 struct v4l2_subdev_format *fmt)
++{
++	struct v4l2_mbus_framefmt *framefmt;
++	const struct imx519_mode *mode;
++	struct imx519 *imx519 = to_imx519(sd);
++
++	if (fmt->pad >= NUM_PADS)
++		return -EINVAL;
++
++	mutex_lock(&imx519->mutex);
++
++	if (fmt->pad == IMAGE_PAD) {
++		/* Bayer order varies with flips */
++		fmt->format.code = imx519_get_format_code(imx519);
++
++		mode = v4l2_find_nearest_size(supported_modes_10bit,
++					      ARRAY_SIZE(supported_modes_10bit),
++					      width, height,
++					      fmt->format.width,
++					      fmt->format.height);
++		imx519_update_image_pad_format(imx519, mode, fmt);
++		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++			framefmt = v4l2_subdev_get_try_format(sd, sd_state,
++							      fmt->pad);
++			*framefmt = fmt->format;
++		} else {
++			imx519->mode = mode;
++			imx519->fmt_code = fmt->format.code;
++			imx519_set_framing_limits(imx519);
++		}
++	} else {
++		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++			framefmt = v4l2_subdev_get_try_format(sd, sd_state,
++							      fmt->pad);
++			*framefmt = fmt->format;
++		} else {
++			/* Only one embedded data mode is supported */
++			imx519_update_metadata_pad_format(fmt);
++		}
++	}
++
++	mutex_unlock(&imx519->mutex);
++
++	return 0;
++}
++
++static const struct v4l2_rect *
++__imx519_get_pad_crop(struct imx519 *imx519, struct v4l2_subdev_state *sd_state,
++		      unsigned int pad, enum v4l2_subdev_format_whence which)
++{
++	switch (which) {
++	case V4L2_SUBDEV_FORMAT_TRY:
++		return v4l2_subdev_get_try_crop(&imx519->sd, sd_state, pad);
++	case V4L2_SUBDEV_FORMAT_ACTIVE:
++		return &imx519->mode->crop;
++	}
++
++	return NULL;
++}
++
++static int imx519_get_selection(struct v4l2_subdev *sd,
++				struct v4l2_subdev_state *sd_state,
++				struct v4l2_subdev_selection *sel)
++{
++	switch (sel->target) {
++	case V4L2_SEL_TGT_CROP: {
++		struct imx519 *imx519 = to_imx519(sd);
++
++		mutex_lock(&imx519->mutex);
++		sel->r = *__imx519_get_pad_crop(imx519, sd_state, sel->pad,
++						sel->which);
++		mutex_unlock(&imx519->mutex);
++
++		return 0;
++	}
++
++	case V4L2_SEL_TGT_NATIVE_SIZE:
++		sel->r.left = 0;
++		sel->r.top = 0;
++		sel->r.width = IMX519_NATIVE_WIDTH;
++		sel->r.height = IMX519_NATIVE_HEIGHT;
++
++		return 0;
++
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++	case V4L2_SEL_TGT_CROP_BOUNDS:
++		sel->r.left = IMX519_PIXEL_ARRAY_LEFT;
++		sel->r.top = IMX519_PIXEL_ARRAY_TOP;
++		sel->r.width = IMX519_PIXEL_ARRAY_WIDTH;
++		sel->r.height = IMX519_PIXEL_ARRAY_HEIGHT;
++
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++/* Start streaming */
++static int imx519_start_streaming(struct imx519 *imx519)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx519->sd);
++	const struct imx519_reg_list *reg_list;
++	int ret;
++
++	if (!imx519->common_regs_written) {
++		ret = imx519_write_regs(imx519, mode_common_regs,
++					ARRAY_SIZE(mode_common_regs));
++
++		if (ret) {
++			dev_err(&client->dev, "%s failed to set common settings\n",
++				__func__);
++			return ret;
++		}
++		imx519->common_regs_written = true;
++	}
++
++	/* Apply default values of current mode */
++	reg_list = &imx519->mode->reg_list;
++	ret = imx519_write_regs(imx519, reg_list->regs, reg_list->num_of_regs);
++	if (ret) {
++		dev_err(&client->dev, "%s failed to set mode\n", __func__);
++		return ret;
++	}
++
++	/* Apply customized values from user */
++	ret =  __v4l2_ctrl_handler_setup(imx519->sd.ctrl_handler);
++	if (ret)
++		return ret;
++
++	/* set stream on register */
++	return imx519_write_reg(imx519, IMX519_REG_MODE_SELECT,
++				IMX519_REG_VALUE_08BIT, IMX519_MODE_STREAMING);
++}
++
++/* Stop streaming */
++static void imx519_stop_streaming(struct imx519 *imx519)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx519->sd);
++	int ret;
++
++	/* set stream off register */
++	ret = imx519_write_reg(imx519, IMX519_REG_MODE_SELECT,
++			       IMX519_REG_VALUE_08BIT, IMX519_MODE_STANDBY);
++	if (ret)
++		dev_err(&client->dev, "%s failed to set stream\n", __func__);
++}
++
++static int imx519_set_stream(struct v4l2_subdev *sd, int enable)
++{
++	struct imx519 *imx519 = to_imx519(sd);
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	int ret = 0;
++
++	mutex_lock(&imx519->mutex);
++	if (imx519->streaming == enable) {
++		mutex_unlock(&imx519->mutex);
++		return 0;
++	}
++
++	if (enable) {
++		ret = pm_runtime_get_sync(&client->dev);
++		if (ret < 0) {
++			pm_runtime_put_noidle(&client->dev);
++			goto err_unlock;
++		}
++
++		/*
++		 * Apply default & customized values
++		 * and then start streaming.
++		 */
++		ret = imx519_start_streaming(imx519);
++		if (ret)
++			goto err_rpm_put;
++	} else {
++		imx519_stop_streaming(imx519);
++		pm_runtime_put(&client->dev);
++	}
++
++	imx519->streaming = enable;
++
++	/* vflip and hflip cannot change during streaming */
++	__v4l2_ctrl_grab(imx519->vflip, enable);
++	__v4l2_ctrl_grab(imx519->hflip, enable);
++
++	mutex_unlock(&imx519->mutex);
++
++	return ret;
++
++err_rpm_put:
++	pm_runtime_put(&client->dev);
++err_unlock:
++	mutex_unlock(&imx519->mutex);
++
++	return ret;
++}
++
++/* Power/clock management functions */
++static int imx519_power_on(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx519 *imx519 = to_imx519(sd);
++	int ret;
++
++	ret = regulator_bulk_enable(IMX519_NUM_SUPPLIES,
++				    imx519->supplies);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to enable regulators\n",
++			__func__);
++		return ret;
++	}
++
++	ret = clk_prepare_enable(imx519->xclk);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to enable clock\n",
++			__func__);
++		goto reg_off;
++	}
++
++	gpiod_set_value_cansleep(imx519->reset_gpio, 1);
++	usleep_range(IMX519_XCLR_MIN_DELAY_US,
++		     IMX519_XCLR_MIN_DELAY_US + IMX519_XCLR_DELAY_RANGE_US);
++
++	return 0;
++
++reg_off:
++	regulator_bulk_disable(IMX519_NUM_SUPPLIES, imx519->supplies);
++	return ret;
++}
++
++static int imx519_power_off(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx519 *imx519 = to_imx519(sd);
++
++	gpiod_set_value_cansleep(imx519->reset_gpio, 0);
++	regulator_bulk_disable(IMX519_NUM_SUPPLIES, imx519->supplies);
++	clk_disable_unprepare(imx519->xclk);
++
++	/* Force reprogramming of the common registers when powered up again. */
++	imx519->common_regs_written = false;
++
++	return 0;
++}
++
++static int __maybe_unused imx519_suspend(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx519 *imx519 = to_imx519(sd);
++
++	if (imx519->streaming)
++		imx519_stop_streaming(imx519);
++
++	return 0;
++}
++
++static int __maybe_unused imx519_resume(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx519 *imx519 = to_imx519(sd);
++	int ret;
++
++	if (imx519->streaming) {
++		ret = imx519_start_streaming(imx519);
++		if (ret)
++			goto error;
++	}
++
++	return 0;
++
++error:
++	imx519_stop_streaming(imx519);
++	imx519->streaming = 0;
++	return ret;
++}
++
++static int imx519_get_regulators(struct imx519 *imx519)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx519->sd);
++	unsigned int i;
++
++	for (i = 0; i < IMX519_NUM_SUPPLIES; i++)
++		imx519->supplies[i].supply = imx519_supply_name[i];
++
++	return devm_regulator_bulk_get(&client->dev,
++				       IMX519_NUM_SUPPLIES,
++				       imx519->supplies);
++}
++
++/* Verify chip ID */
++static int imx519_identify_module(struct imx519 *imx519, u32 expected_id)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx519->sd);
++	int ret;
++	u32 val;
++
++	ret = imx519_read_reg(imx519, IMX519_REG_CHIP_ID,
++			      IMX519_REG_VALUE_16BIT, &val);
++	if (ret) {
++		dev_err(&client->dev, "failed to read chip id %x, with error %d\n",
++			expected_id, ret);
++		return ret;
++	}
++
++	if (val != expected_id) {
++		dev_err(&client->dev, "chip id mismatch: %x!=%x\n",
++			expected_id, val);
++		return -EIO;
++	}
++
++	dev_info(&client->dev, "Device found is imx%x\n", val);
++
++	return 0;
++}
++
++static const struct v4l2_subdev_core_ops imx519_core_ops = {
++	.subscribe_event = v4l2_ctrl_subdev_subscribe_event,
++	.unsubscribe_event = v4l2_event_subdev_unsubscribe,
++};
++
++static const struct v4l2_subdev_video_ops imx519_video_ops = {
++	.s_stream = imx519_set_stream,
++};
++
++static const struct v4l2_subdev_pad_ops imx519_pad_ops = {
++	.enum_mbus_code = imx519_enum_mbus_code,
++	.get_fmt = imx519_get_pad_format,
++	.set_fmt = imx519_set_pad_format,
++	.get_selection = imx519_get_selection,
++	.enum_frame_size = imx519_enum_frame_size,
++};
++
++static const struct v4l2_subdev_ops imx519_subdev_ops = {
++	.core = &imx519_core_ops,
++	.video = &imx519_video_ops,
++	.pad = &imx519_pad_ops,
++};
++
++static const struct v4l2_subdev_internal_ops imx519_internal_ops = {
++	.open = imx519_open,
++};
++
++/* Initialize control handlers */
++static int imx519_init_controls(struct imx519 *imx519)
++{
++	struct v4l2_ctrl_handler *ctrl_hdlr;
++	struct i2c_client *client = v4l2_get_subdevdata(&imx519->sd);
++	struct v4l2_fwnode_device_properties props;
++	unsigned int i;
++	int ret;
++
++	ctrl_hdlr = &imx519->ctrl_handler;
++	ret = v4l2_ctrl_handler_init(ctrl_hdlr, 16);
++	if (ret)
++		return ret;
++
++	mutex_init(&imx519->mutex);
++	ctrl_hdlr->lock = &imx519->mutex;
++
++	/* By default, PIXEL_RATE is read only */
++	imx519->pixel_rate = v4l2_ctrl_new_std(ctrl_hdlr, &imx519_ctrl_ops,
++					       V4L2_CID_PIXEL_RATE,
++					       IMX519_PIXEL_RATE,
++					       IMX519_PIXEL_RATE, 1,
++					       IMX519_PIXEL_RATE);
++
++	/*
++	 * Create the controls here, but mode specific limits are setup
++	 * in the imx519_set_framing_limits() call below.
++	 */
++	imx519->vblank = v4l2_ctrl_new_std(ctrl_hdlr, &imx519_ctrl_ops,
++					   V4L2_CID_VBLANK, 0, 0xffff, 1, 0);
++	imx519->hblank = v4l2_ctrl_new_std(ctrl_hdlr, &imx519_ctrl_ops,
++					   V4L2_CID_HBLANK, 0, 0xffff, 1, 0);
++
++	/* HBLANK is read-only for now, but does change with mode. */
++	if (imx519->hblank)
++		imx519->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	imx519->exposure = v4l2_ctrl_new_std(ctrl_hdlr, &imx519_ctrl_ops,
++					     V4L2_CID_EXPOSURE,
++					     IMX519_EXPOSURE_MIN,
++					     IMX519_EXPOSURE_MAX,
++					     IMX519_EXPOSURE_STEP,
++					     IMX519_EXPOSURE_DEFAULT);
++
++	v4l2_ctrl_new_std(ctrl_hdlr, &imx519_ctrl_ops, V4L2_CID_ANALOGUE_GAIN,
++			  IMX519_ANA_GAIN_MIN, IMX519_ANA_GAIN_MAX,
++			  IMX519_ANA_GAIN_STEP, IMX519_ANA_GAIN_DEFAULT);
++
++	v4l2_ctrl_new_std(ctrl_hdlr, &imx519_ctrl_ops, V4L2_CID_DIGITAL_GAIN,
++			  IMX519_DGTL_GAIN_MIN, IMX519_DGTL_GAIN_MAX,
++			  IMX519_DGTL_GAIN_STEP, IMX519_DGTL_GAIN_DEFAULT);
++
++	imx519->hflip = v4l2_ctrl_new_std(ctrl_hdlr, &imx519_ctrl_ops,
++					  V4L2_CID_HFLIP, 0, 1, 1, 0);
++	if (imx519->hflip)
++		imx519->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
++	imx519->vflip = v4l2_ctrl_new_std(ctrl_hdlr, &imx519_ctrl_ops,
++					  V4L2_CID_VFLIP, 0, 1, 1, 0);
++	if (imx519->vflip)
++		imx519->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
++	v4l2_ctrl_new_std_menu_items(ctrl_hdlr, &imx519_ctrl_ops,
++				     V4L2_CID_TEST_PATTERN,
++				     ARRAY_SIZE(imx519_test_pattern_menu) - 1,
++				     0, 0, imx519_test_pattern_menu);
++	for (i = 0; i < 4; i++) {
++		/*
++		 * The assumption is that
++		 * V4L2_CID_TEST_PATTERN_GREENR == V4L2_CID_TEST_PATTERN_RED + 1
++		 * V4L2_CID_TEST_PATTERN_BLUE   == V4L2_CID_TEST_PATTERN_RED + 2
++		 * V4L2_CID_TEST_PATTERN_GREENB == V4L2_CID_TEST_PATTERN_RED + 3
++		 */
++		v4l2_ctrl_new_std(ctrl_hdlr, &imx519_ctrl_ops,
++				  V4L2_CID_TEST_PATTERN_RED + i,
++				  IMX519_TEST_PATTERN_COLOUR_MIN,
++				  IMX519_TEST_PATTERN_COLOUR_MAX,
++				  IMX519_TEST_PATTERN_COLOUR_STEP,
++				  IMX519_TEST_PATTERN_COLOUR_MAX);
++		/* The "Solid color" pattern is white by default */
++	}
++
++	if (ctrl_hdlr->error) {
++		ret = ctrl_hdlr->error;
++		dev_err(&client->dev, "%s control init failed (%d)\n",
++			__func__, ret);
++		goto error;
++	}
++
++	ret = v4l2_fwnode_device_parse(&client->dev, &props);
++	if (ret)
++		goto error;
++
++	ret = v4l2_ctrl_new_fwnode_properties(ctrl_hdlr, &imx519_ctrl_ops,
++					      &props);
++	if (ret)
++		goto error;
++
++	imx519->sd.ctrl_handler = ctrl_hdlr;
++
++	/* Setup exposure and frame/line length limits. */
++	imx519_set_framing_limits(imx519);
++
++	return 0;
++
++error:
++	v4l2_ctrl_handler_free(ctrl_hdlr);
++	mutex_destroy(&imx519->mutex);
++
++	return ret;
++}
++
++static void imx519_free_controls(struct imx519 *imx519)
++{
++	v4l2_ctrl_handler_free(imx519->sd.ctrl_handler);
++	mutex_destroy(&imx519->mutex);
++}
++
++static int imx519_check_hwcfg(struct device *dev)
++{
++	struct fwnode_handle *endpoint;
++	struct v4l2_fwnode_endpoint ep_cfg = {
++		.bus_type = V4L2_MBUS_CSI2_DPHY
++	};
++	int ret = -EINVAL;
++
++	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
++	if (!endpoint) {
++		dev_err(dev, "endpoint node not found\n");
++		return -EINVAL;
++	}
++
++	if (v4l2_fwnode_endpoint_alloc_parse(endpoint, &ep_cfg)) {
++		dev_err(dev, "could not parse endpoint\n");
++		goto error_out;
++	}
++
++	/* Check the number of MIPI CSI2 data lanes */
++	if (ep_cfg.bus.mipi_csi2.num_data_lanes != 2) {
++		dev_err(dev, "only 2 data lanes are currently supported\n");
++		goto error_out;
++	}
++
++	/* Check the link frequency set in device tree */
++	if (!ep_cfg.nr_of_link_frequencies) {
++		dev_err(dev, "link-frequency property not found in DT\n");
++		goto error_out;
++	}
++
++	if (ep_cfg.nr_of_link_frequencies != 1 ||
++	    ep_cfg.link_frequencies[0] != IMX519_DEFAULT_LINK_FREQ) {
++		dev_err(dev, "Link frequency not supported: %lld\n",
++			ep_cfg.link_frequencies[0]);
++		goto error_out;
++	}
++
++	ret = 0;
++
++error_out:
++	v4l2_fwnode_endpoint_free(&ep_cfg);
++	fwnode_handle_put(endpoint);
++
++	return ret;
++}
++
++static const struct of_device_id imx519_dt_ids[] = {
++	{ .compatible = "sony,imx519"},
++	{ /* sentinel */ }
++};
++
++static int imx519_probe(struct i2c_client *client)
++{
++	struct device *dev = &client->dev;
++	struct imx519 *imx519;
++	const struct of_device_id *match;
++	u32 xclk_freq;
++	int ret;
++
++	imx519 = devm_kzalloc(&client->dev, sizeof(*imx519), GFP_KERNEL);
++	if (!imx519)
++		return -ENOMEM;
++
++	v4l2_i2c_subdev_init(&imx519->sd, client, &imx519_subdev_ops);
++
++	match = of_match_device(imx519_dt_ids, dev);
++	if (!match)
++		return -ENODEV;
++
++	/* Check the hardware configuration in device tree */
++	if (imx519_check_hwcfg(dev))
++		return -EINVAL;
++
++	/* Get system clock (xclk) */
++	imx519->xclk = devm_clk_get(dev, NULL);
++	if (IS_ERR(imx519->xclk)) {
++		dev_err(dev, "failed to get xclk\n");
++		return PTR_ERR(imx519->xclk);
++	}
++
++	xclk_freq = clk_get_rate(imx519->xclk);
++	if (xclk_freq != IMX519_XCLK_FREQ) {
++		dev_err(dev, "xclk frequency not supported: %d Hz\n",
++			xclk_freq);
++		return -EINVAL;
++	}
++
++	ret = imx519_get_regulators(imx519);
++	if (ret) {
++		dev_err(dev, "failed to get regulators\n");
++		return ret;
++	}
++
++	/* Request optional enable pin */
++	imx519->reset_gpio = devm_gpiod_get_optional(dev, "reset",
++						     GPIOD_OUT_HIGH);
++
++	/*
++	 * The sensor must be powered for imx519_identify_module()
++	 * to be able to read the CHIP_ID register
++	 */
++	ret = imx519_power_on(dev);
++	if (ret)
++		return ret;
++
++	ret = imx519_identify_module(imx519, IMX519_CHIP_ID);
++	if (ret)
++		goto error_power_off;
++
++	/* Set default mode to max resolution */
++	imx519->mode = &supported_modes_10bit[0];
++	imx519->fmt_code = MEDIA_BUS_FMT_SRGGB10_1X10;
++
++	/* Enable runtime PM and turn off the device */
++	pm_runtime_set_active(dev);
++	pm_runtime_enable(dev);
++	pm_runtime_idle(dev);
++
++	/* This needs the pm runtime to be registered. */
++	ret = imx519_init_controls(imx519);
++	if (ret)
++		goto error_power_off;
++
++	/* Initialize subdev */
++	imx519->sd.internal_ops = &imx519_internal_ops;
++	imx519->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE |
++			    V4L2_SUBDEV_FL_HAS_EVENTS;
++	imx519->sd.entity.function = MEDIA_ENT_F_CAM_SENSOR;
++
++	/* Initialize source pads */
++	imx519->pad[IMAGE_PAD].flags = MEDIA_PAD_FL_SOURCE;
++	imx519->pad[METADATA_PAD].flags = MEDIA_PAD_FL_SOURCE;
++
++	ret = media_entity_pads_init(&imx519->sd.entity, NUM_PADS, imx519->pad);
++	if (ret) {
++		dev_err(dev, "failed to init entity pads: %d\n", ret);
++		goto error_handler_free;
++	}
++
++	ret = v4l2_async_register_subdev_sensor(&imx519->sd);
++	if (ret < 0) {
++		dev_err(dev, "failed to register sensor sub-device: %d\n", ret);
++		goto error_media_entity;
++	}
++
++	return 0;
++
++error_media_entity:
++	media_entity_cleanup(&imx519->sd.entity);
++
++error_handler_free:
++	imx519_free_controls(imx519);
++
++error_power_off:
++	pm_runtime_disable(&client->dev);
++	pm_runtime_set_suspended(&client->dev);
++	imx519_power_off(&client->dev);
++
++	return ret;
++}
++
++static void imx519_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx519 *imx519 = to_imx519(sd);
++
++	v4l2_async_unregister_subdev(sd);
++	media_entity_cleanup(&sd->entity);
++	imx519_free_controls(imx519);
++
++	pm_runtime_disable(&client->dev);
++	if (!pm_runtime_status_suspended(&client->dev))
++		imx519_power_off(&client->dev);
++	pm_runtime_set_suspended(&client->dev);
++}
++
++MODULE_DEVICE_TABLE(of, imx519_dt_ids);
++
++static const struct dev_pm_ops imx519_pm_ops = {
++	SET_SYSTEM_SLEEP_PM_OPS(imx519_suspend, imx519_resume)
++	SET_RUNTIME_PM_OPS(imx519_power_off, imx519_power_on, NULL)
++};
++
++static struct i2c_driver imx519_i2c_driver = {
++	.driver = {
++		.name = "imx519",
++		.of_match_table	= imx519_dt_ids,
++		.pm = &imx519_pm_ops,
++	},
++	.probe_new = imx519_probe,
++	.remove = imx519_remove,
++};
++
++module_i2c_driver(imx519_i2c_driver);
++
++MODULE_AUTHOR("Lee Jackson <info@arducam.com>");
++MODULE_DESCRIPTION("Sony IMX519 sensor driver");
++MODULE_LICENSE("GPL v2");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0197-Documentation-devicetree-Add-documentation-for-imx37.patch b/target/linux/bcm27xx/patches-6.1/950-0197-Documentation-devicetree-Add-documentation-for-imx37.patch
new file mode 100644
index 00000000000000..e564af578ee974
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0197-Documentation-devicetree-Add-documentation-for-imx37.patch
@@ -0,0 +1,142 @@
+From a7cff56023c618f064a7b50998e0ce871f6c5797 Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Tue, 29 Jun 2021 14:38:23 +0100
+Subject: [PATCH] Documentation: devicetree: Add documentation for
+ imx378 sensor
+
+The imx378 sensor is compatible with the imx477 and shares common
+device tree settings.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ .../devicetree/bindings/media/i2c/imx378.yaml | 113 ++++++++++++++++++
+ MAINTAINERS                                   |   1 +
+ 2 files changed, 114 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/imx378.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/imx378.yaml
+@@ -0,0 +1,113 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/media/i2c/imx378.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Sony 1/2.3-Inch 12Mpixel CMOS Digital Image Sensor
++
++maintainers:
++  - Naushir Patuck <naush@raspberypi.com>
++
++description: |-
++  The Sony IMX378 is a 1/2.3-inch CMOS active pixel digital image sensor
++  with an active array size of 4056H x 3040V. It is programmable through
++  I2C interface. The I2C address is fixed to 0x1A as per sensor data sheet.
++  Image data is sent through MIPI CSI-2, which is configured as either 2 or
++  4 data lanes.
++
++properties:
++  compatible:
++    const: sony,imx378
++
++  reg:
++    description: I2C device address
++    maxItems: 1
++
++  clocks:
++    maxItems: 1
++
++  VDIG-supply:
++    description:
++      Digital I/O voltage supply, 1.05 volts
++
++  VANA-supply:
++    description:
++      Analog voltage supply, 2.8 volts
++
++  VDDL-supply:
++    description:
++      Digital core voltage supply, 1.8 volts
++
++  reset-gpios:
++    description: |-
++      Reference to the GPIO connected to the xclr pin, if any.
++      Must be released (set high) after all supplies and INCK are applied.
++
++  # See ../video-interfaces.txt for more details
++  port:
++    type: object
++    properties:
++      endpoint:
++        type: object
++        properties:
++          data-lanes:
++            description: |-
++              The sensor supports either two-lane, or four-lane operation.
++              For two-lane operation the property must be set to <1 2>.
++            items:
++              - const: 1
++              - const: 2
++
++          clock-noncontinuous:
++            type: boolean
++            description: |-
++              MIPI CSI-2 clock is non-continuous if this property is present,
++              otherwise it's continuous.
++
++          link-frequencies:
++            allOf:
++              - $ref: /schemas/types.yaml#/definitions/uint64-array
++            description:
++              Allowed data bus frequencies.
++
++        required:
++          - link-frequencies
++
++required:
++  - compatible
++  - reg
++  - clocks
++  - VANA-supply
++  - VDIG-supply
++  - VDDL-supply
++  - port
++
++additionalProperties: false
++
++examples:
++  - |
++    i2c0 {
++        #address-cells = <1>;
++        #size-cells = <0>;
++
++        imx378: sensor@10 {
++            compatible = "sony,imx378";
++            reg = <0x1a>;
++            clocks = <&imx378_clk>;
++            VANA-supply = <&imx378_vana>;   /* 2.8v */
++            VDIG-supply = <&imx378_vdig>;   /* 1.05v */
++            VDDL-supply = <&imx378_vddl>;   /* 1.8v */
++
++            port {
++                imx378_0: endpoint {
++                    remote-endpoint = <&csi1_ep>;
++                    data-lanes = <1 2>;
++                    clock-noncontinuous;
++                    link-frequencies = /bits/ 64 <450000000>;
++                };
++            };
++        };
++    };
++
++...
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -19284,6 +19284,7 @@ M:	Raspberry Pi Kernel Maintenance <kern
+ L:	linux-media@vger.kernel.org
+ S:	Maintained
+ T:	git git://linuxtv.org/media_tree.git
++F:	Documentation/devicetree/bindings/media/i2c/imx378.yaml
+ F:	Documentation/devicetree/bindings/media/i2c/imx477.yaml
+ F:	drivers/media/i2c/imx477.c
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0198-v4l2-Add-a-Greyworld-AWB-mode.patch b/target/linux/bcm27xx/patches-6.1/950-0198-v4l2-Add-a-Greyworld-AWB-mode.patch
new file mode 100644
index 00000000000000..3e54ebf4b3d650
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0198-v4l2-Add-a-Greyworld-AWB-mode.patch
@@ -0,0 +1,23 @@
+From cf1ae4345b4d7ef4bb8f60f98cc26633f8a18a6d Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Fri, 6 Sep 2019 15:04:51 +0100
+Subject: [PATCH] v4l2: Add a Greyworld AWB mode.
+
+Adds a simple greyworld white balance preset, mainly for use
+with cameras without an IR filter (eg Raspberry Pi NoIR)
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ include/uapi/linux/v4l2-controls.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/uapi/linux/v4l2-controls.h
++++ b/include/uapi/linux/v4l2-controls.h
+@@ -950,6 +950,7 @@ enum v4l2_auto_n_preset_white_balance {
+ 	V4L2_WHITE_BALANCE_FLASH		= 7,
+ 	V4L2_WHITE_BALANCE_CLOUDY		= 8,
+ 	V4L2_WHITE_BALANCE_SHADE		= 9,
++	V4L2_WHITE_BALANCE_GREYWORLD		= 10,
+ };
+ 
+ #define V4L2_CID_WIDE_DYNAMIC_RANGE		(V4L2_CID_CAMERA_CLASS_BASE+21)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0199-staging-bcm2835-camera-Add-greyworld-AWB-mode.patch b/target/linux/bcm27xx/patches-6.1/950-0199-staging-bcm2835-camera-Add-greyworld-AWB-mode.patch
new file mode 100644
index 00000000000000..60ed0300ec7d62
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0199-staging-bcm2835-camera-Add-greyworld-AWB-mode.patch
@@ -0,0 +1,37 @@
+From 823f5a2811ec0e45e4392f40c363714fc12d4d98 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Fri, 6 Sep 2019 15:13:06 +0100
+Subject: [PATCH] staging: bcm2835-camera: Add greyworld AWB mode
+
+This is mainly used for the NoIR camera which has no IR
+filter and can completely confuse normal AWB presets.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/staging/vc04_services/bcm2835-camera/controls.c    | 4 ++++
+ drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h | 1 +
+ 2 files changed, 5 insertions(+)
+
+--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
+@@ -468,6 +468,10 @@ static int ctrl_set_awb_mode(struct bcm2
+ 	case V4L2_WHITE_BALANCE_SHADE:
+ 		u32_value = MMAL_PARAM_AWBMODE_SHADE;
+ 		break;
++
++	case V4L2_WHITE_BALANCE_GREYWORLD:
++		u32_value = MMAL_PARAM_AWBMODE_GREYWORLD;
++		break;
+ 	}
+ 
+ 	return vchiq_mmal_port_parameter_set(dev->instance, control,
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
+@@ -310,6 +310,7 @@ enum mmal_parameter_awbmode {
+ 	MMAL_PARAM_AWBMODE_INCANDESCENT,
+ 	MMAL_PARAM_AWBMODE_FLASH,
+ 	MMAL_PARAM_AWBMODE_HORIZON,
++	MMAL_PARAM_AWBMODE_GREYWORLD,
+ };
+ 
+ enum mmal_parameter_imagefx {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0200-media-v4l2-Add-Greyworld-AWB-control-name.patch b/target/linux/bcm27xx/patches-6.1/950-0200-media-v4l2-Add-Greyworld-AWB-control-name.patch
new file mode 100644
index 00000000000000..8d116fffe1363b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0200-media-v4l2-Add-Greyworld-AWB-control-name.patch
@@ -0,0 +1,24 @@
+From 2256c396e731aabb7085a4e87bf796b90df0fdbe Mon Sep 17 00:00:00 2001
+From: John Cox <jc@kynesim.co.uk>
+Date: Fri, 6 Aug 2021 14:32:44 +0100
+Subject: [PATCH] media: v4l2: Add Greyworld AWB control name
+
+Add name for greyworld to white_balance preset names.
+This patch previously applied to v4l2-ctrl.c but that was split
+and deleted.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+---
+ drivers/media/v4l2-core/v4l2-ctrls-defs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/v4l2-core/v4l2-ctrls-defs.c
++++ b/drivers/media/v4l2-core/v4l2-ctrls-defs.c
+@@ -228,6 +228,7 @@ const char * const *v4l2_ctrl_get_menu(u
+ 		"Flash",
+ 		"Cloudy",
+ 		"Shade",
++		"Greyworld",
+ 		NULL,
+ 	};
+ 	static const char * const camera_iso_sensitivity_auto[] = {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0201-staging-bcm2835-camera-Fix-the-cherry-pick-of-AWB-Gr.patch b/target/linux/bcm27xx/patches-6.1/950-0201-staging-bcm2835-camera-Fix-the-cherry-pick-of-AWB-Gr.patch
new file mode 100644
index 00000000000000..5cf94f12b22bdb
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0201-staging-bcm2835-camera-Fix-the-cherry-pick-of-AWB-Gr.patch
@@ -0,0 +1,28 @@
+From 8d5fe5f8e6d877811ae270e087f19496b98ea1ca Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 8 Feb 2021 11:48:35 +0000
+Subject: [PATCH] staging:bcm2835-camera: Fix the cherry-pick of AWB
+ Greyworld
+
+The cherry-pick of the patch that added the greyworld AWB mode
+was incomplete. Fix it up.
+
+Fixes: b3ef481fe243 "staging: bcm2835-camera: Add greyworld AWB mode"
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/bcm2835-camera/controls.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
+@@ -1050,8 +1050,8 @@ static const struct bcm2835_mmal_v4l2_ct
+ 	{
+ 		.id = V4L2_CID_AUTO_N_PRESET_WHITE_BALANCE,
+ 		.type = MMAL_CONTROL_TYPE_STD_MENU,
+-		.min = ~0x3ff,
+-		.max = V4L2_WHITE_BALANCE_SHADE,
++		.min = ~0x7ff,
++		.max = V4L2_WHITE_BALANCE_GREYWORLD,
+ 		.def = V4L2_WHITE_BALANCE_AUTO,
+ 		.step = 0,
+ 		.imenu = NULL,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0202-ARM-bcm-Switch-board-clk-and-pinctrl-to-bcm2711-comp.patch b/target/linux/bcm27xx/patches-6.1/950-0202-ARM-bcm-Switch-board-clk-and-pinctrl-to-bcm2711-comp.patch
new file mode 100644
index 00000000000000..7b5e3ba0b42b74
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0202-ARM-bcm-Switch-board-clk-and-pinctrl-to-bcm2711-comp.patch
@@ -0,0 +1,26 @@
+From 17d91d37a51790a4d96e9e1030814ae05543f41f Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <wahrenst@gmx.net>
+Date: Thu, 19 Sep 2019 20:45:30 +0200
+Subject: [PATCH] ARM: bcm: Switch board, clk and pinctrl to bcm2711
+ compatible
+
+After the decision to use bcm2711 compatible for upstream, we should
+switch all accepted compatibles to bcm2711. So we can boot with
+one DTB the down- and the upstream kernel.
+
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+---
+ arch/arm/mach-bcm/board_bcm2835.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-bcm/board_bcm2835.c
++++ b/arch/arm/mach-bcm/board_bcm2835.c
+@@ -109,7 +109,7 @@ static const char * const bcm2835_compat
+ #ifdef CONFIG_ARCH_MULTI_V7
+ 	"brcm,bcm2836",
+ 	"brcm,bcm2837",
+-	"brcm,bcm2838",
++	"brcm,bcm2711",
+ #endif
+ 	NULL
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0203-dt-bindings-Add-binding-for-the-Infineon-IRS1125-sen.patch b/target/linux/bcm27xx/patches-6.1/950-0203-dt-bindings-Add-binding-for-the-Infineon-IRS1125-sen.patch
new file mode 100644
index 00000000000000..3f3ad060849549
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0203-dt-bindings-Add-binding-for-the-Infineon-IRS1125-sen.patch
@@ -0,0 +1,66 @@
+From 4e0a7c5bf0071a59df64eebe9efe0588c153c100 Mon Sep 17 00:00:00 2001
+From: Markus Proeller <markus.proeller@pieye.org>
+Date: Thu, 10 Oct 2019 19:12:08 +0200
+Subject: [PATCH] dt-bindings: Add binding for the Infineon IRS1125
+ sensor
+
+Adds a binding for the Infineon IRS1125 time-of-flight depth
+sensor.
+
+Signed-off-by: Markus Proeller <markus.proeller@pieye.org>
+---
+ .../devicetree/bindings/media/i2c/irs1125.txt | 48 +++++++++++++++++++
+ 1 file changed, 48 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/irs1125.txt
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/irs1125.txt
+@@ -0,0 +1,48 @@
++* Infineon irs1125 time of flight sensor
++
++The Infineon irs1125 is a time of flight digital image sensor with
++an active array size of 352H x 286V. It is programmable through I2C
++interface. The I2C address defaults to 0x3D, but can be reconfigured
++to address 0x3C or 0x41 via I2C commands. Image data is sent through
++MIPI CSI-2, which is configured as either 1 or 2 data lanes.
++
++Required Properties:
++- compatible: value should be "infineon,irs1125" for irs1125 sensor
++- reg: I2C bus address of the device
++- clocks: reference to the xclk input clock.
++- pwdn-gpios: reference to the GPIO connected to the reset pin.
++	      This is an active low signal to the iirs1125.
++
++The irs1125 device node should contain one 'port' child node with
++an 'endpoint' subnode. For further reading on port node refer to
++Documentation/devicetree/bindings/media/video-interfaces.txt.
++
++Endpoint node required properties for CSI-2 connection are:
++- remote-endpoint: a phandle to the bus receiver's endpoint node.
++- clock-lanes: should be set to <0> (clock lane on hardware lane 0)
++- data-lanes: should be set to <1> or <1 2> (one or two lane CSI-2
++  supported)
++
++Example:
++	sensor@10 {
++		compatible = "infineon,irs1125";
++		reg = <0x3D>;
++		#address-cells = <1>;
++		#size-cells = <0>;
++		clocks = <&irs1125_clk>;
++		pwdn-gpios = <&gpio 5 0>;
++
++		irs1125_clk: camera-clk {
++			compatible = "fixed-clock";
++			#clock-cells = <0>;
++			clock-frequency = <26000000>;
++		};
++
++		port {
++			sensor_out: endpoint {
++				remote-endpoint = <&csiss_in>;
++				clock-lanes = <0>;
++				data-lanes = <1 2>;
++			};
++		};
++	};
diff --git a/target/linux/bcm27xx/patches-6.1/950-0204-media-i2c-Add-a-driver-for-the-Infineon-IRS1125-dept.patch b/target/linux/bcm27xx/patches-6.1/950-0204-media-i2c-Add-a-driver-for-the-Infineon-IRS1125-dept.patch
new file mode 100644
index 00000000000000..ea1df61b7d83de
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0204-media-i2c-Add-a-driver-for-the-Infineon-IRS1125-dept.patch
@@ -0,0 +1,1231 @@
+From 9b1cd7fac64f53d070154fd6440ace60f6cfeab0 Mon Sep 17 00:00:00 2001
+From: Markus Proeller <markus.proeller@pieye.org>
+Date: Thu, 10 Oct 2019 19:12:36 +0200
+Subject: [PATCH] media: i2c: Add a driver for the Infineon IRS1125
+ depth sensor
+
+The Infineon IRS1125 is a time of flight depth sensor that
+has a CSI-2 interface.
+
+Add a V4L2 subdevice driver for this device.
+
+Signed-off-by: Markus Proeller <markus.proeller@pieye.org>
+---
+ drivers/media/i2c/Kconfig   |   12 +
+ drivers/media/i2c/Makefile  |    1 +
+ drivers/media/i2c/irs1125.c | 1112 +++++++++++++++++++++++++++++++++++
+ drivers/media/i2c/irs1125.h |   61 ++
+ 4 files changed, 1186 insertions(+)
+ create mode 100644 drivers/media/i2c/irs1125.c
+ create mode 100644 drivers/media/i2c/irs1125.h
+
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -1366,6 +1366,18 @@ config VIDEO_TW9910
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called tw9910.
+ 
++config VIDEO_IRS1125
++	tristate "Infineon IRS1125 sensor support"
++	depends on I2C && VIDEO_DEV && VIDEO_V4L2_SUBDEV_API
++	depends on MEDIA_CAMERA_SUPPORT
++	select V4L2_FWNODE
++	help
++	  This is a Video4Linux2 sensor-level driver for the Infineon
++	  IRS1125 camera.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called irs1125.
++
+ config VIDEO_VPX3220
+ 	tristate "vpx3220a, vpx3216b & vpx3214c video decoders"
+ 	depends on VIDEO_DEV && I2C
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -51,6 +51,7 @@ obj-$(CONFIG_VIDEO_IMX412) += imx412.o
+ obj-$(CONFIG_VIDEO_IMX477) += imx477.o
+ obj-$(CONFIG_VIDEO_IMX519) += imx519.o
+ obj-$(CONFIG_VIDEO_IR_I2C) += ir-kbd-i2c.o
++obj-$(CONFIG_VIDEO_IRS1125) += irs1125.o
+ obj-$(CONFIG_VIDEO_ISL7998X) += isl7998x.o
+ obj-$(CONFIG_VIDEO_KS0127) += ks0127.o
+ obj-$(CONFIG_VIDEO_LM3560) += lm3560.o
+--- /dev/null
++++ b/drivers/media/i2c/irs1125.c
+@@ -0,0 +1,1112 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * A V4L2 driver for Infineon IRS1125 TOF cameras.
++ * Copyright (C) 2018, pieye GmbH
++ *
++ * Based on V4L2 OmniVision OV5647 Image Sensor driver
++ * Copyright (C) 2016 Ramiro Oliveira <roliveir@synopsys.com>
++ *
++ * DT / fwnode changes, and GPIO control taken from ov5640.c
++ * Copyright (C) 2011-2013 Freescale Semiconductor, Inc. All Rights Reserved.
++ * Copyright (C) 2014-2017 Mentor Graphics Inc.
++ *
++ */
++
++#include "irs1125.h"
++#include <linux/clk.h>
++#include <linux/delay.h>
++#include <linux/gpio/consumer.h>
++#include <linux/i2c.h>
++#include <linux/init.h>
++#include <linux/io.h>
++#include <linux/module.h>
++#include <linux/of_graph.h>
++#include <linux/slab.h>
++#include <linux/videodev2.h>
++#include <linux/firmware.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-fwnode.h>
++#include <media/v4l2-image-sizes.h>
++#include <media/v4l2-mediabus.h>
++#include <media/v4l2-ctrls.h>
++
++#define CHECK_BIT(val, pos) ((val) & BIT(pos))
++
++#define SENSOR_NAME "irs1125"
++
++#define RESET_ACTIVE_DELAY_MS	 20
++
++#define IRS1125_ALTERNATE_FW "irs1125_af.bin"
++
++#define IRS1125_REG_CSICFG       0xA882
++#define IRS1125_REG_DESIGN_STEP	 0xB0AD
++#define IRS1125_REG_EFUSEVAL2	 0xB09F
++#define IRS1125_REG_EFUSEVAL3	 0xB0A0
++#define IRS1125_REG_EFUSEVAL4	 0xB0A1
++#define IRS1125_REG_DMEM_SHADOW	 0xC320
++
++#define IRS1125_DESIGN_STEP_EXPECTED 0x0a12
++
++#define IRS1125_ROW_START_DEF		0
++#define IRS1125_COLUMN_START_DEF	0
++#define IRS1125_WINDOW_HEIGHT_DEF	 288
++#define IRS1125_WINDOW_WIDTH_DEF	352
++
++struct regval_list {
++	u16 addr;
++	u16 data;
++};
++
++struct irs1125 {
++	struct v4l2_subdev sd;
++	struct media_pad pad;
++	/* the parsed DT endpoint info */
++	struct v4l2_fwnode_endpoint ep;
++
++	struct clk *xclk;
++	struct v4l2_ctrl_handler ctrl_handler;
++
++	/* To serialize asynchronus callbacks */
++	struct mutex lock;
++
++	/* image data layout */
++	unsigned int num_seq;
++
++	/* reset pin */
++	struct gpio_desc *reset;
++
++	/* V4l2 Controls to grab */
++	struct v4l2_ctrl *ctrl_modplls;
++	struct v4l2_ctrl *ctrl_numseq;
++
++	int power_count;
++};
++
++static inline struct irs1125 *to_state(struct v4l2_subdev *sd)
++{
++	return container_of(sd, struct irs1125, sd);
++}
++
++static struct regval_list irs1125_26MHz[] = {
++	{0xB017, 0x0413},
++	{0xB086, 0x3535},
++	{0xB0AE, 0xEF02},
++	{0xA000, 0x0004},
++	{0xFFFF, 100},
++
++	{0xB062, 0x6383},
++	{0xB063, 0x55A8},
++	{0xB068, 0x7628},
++	{0xB069, 0x03E2},
++
++	{0xFFFF, 100},
++	{0xB05A, 0x01C5},
++	{0xB05C, 0x0206},
++	{0xB05D, 0x01C5},
++	{0xB05F, 0x0206},
++	{0xB016, 0x1335},
++	{0xFFFF, 100},
++	{0xA893, 0x8261},
++	{0xA894, 0x89d8},
++	{0xA895, 0x131d},
++	{0xA896, 0x4251},
++	{0xA897, 0x9D8A},
++	{0xA898, 0x0BD8},
++	{0xA899, 0x2245},
++	{0xA89A, 0xAB9B},
++	{0xA89B, 0x03B9},
++	{0xA89C, 0x8041},
++	{0xA89D, 0xE07E},
++	{0xA89E, 0x0307},
++	{0xFFFF, 100},
++	{0xA88D, 0x0004},
++	{0xA800, 0x0E68},
++	{0xA801, 0x0000},
++	{0xA802, 0x000C},
++	{0xA803, 0x0000},
++	{0xA804, 0x0E68},
++	{0xA805, 0x0000},
++	{0xA806, 0x0440},
++	{0xA807, 0x0000},
++	{0xA808, 0x0E68},
++	{0xA809, 0x0000},
++	{0xA80A, 0x0884},
++	{0xA80B, 0x0000},
++	{0xA80C, 0x0E68},
++	{0xA80D, 0x0000},
++	{0xA80E, 0x0CC8},
++	{0xA80F, 0x0000},
++	{0xA810, 0x0E68},
++	{0xA811, 0x0000},
++	{0xA812, 0x2000},
++	{0xA813, 0x0000},
++	{0xA882, 0x0081},
++	{0xA88C, 0x403A},
++	{0xA88F, 0x031E},
++	{0xA892, 0x0351},
++	{0x9813, 0x13FF},
++	{0x981B, 0x7608},
++
++	{0xB008, 0x0000},
++	{0xB015, 0x1513},
++
++	{0xFFFF, 100}
++};
++
++static struct regval_list irs1125_seq_cfg[] = {
++	{0xC3A0, 0x823D},
++	{0xC3A1, 0xB13B},
++	{0xC3A2, 0x0313},
++	{0xC3A3, 0x4659},
++	{0xC3A4, 0xC4EC},
++	{0xC3A5, 0x03CE},
++	{0xC3A6, 0x4259},
++	{0xC3A7, 0xC4EC},
++	{0xC3A8, 0x03CE},
++	{0xC3A9, 0x8839},
++	{0xC3AA, 0x89D8},
++	{0xC3AB, 0x031D},
++
++	{0xC24C, 0x5529},
++	{0xC24D, 0x0000},
++	{0xC24E, 0x1200},
++	{0xC24F, 0x6CB2},
++	{0xC250, 0x0000},
++	{0xC251, 0x5529},
++	{0xC252, 0x42F4},
++	{0xC253, 0xD1AF},
++	{0xC254, 0x8A18},
++	{0xC255, 0x0002},
++	{0xC256, 0x5529},
++	{0xC257, 0x6276},
++	{0xC258, 0x11A7},
++	{0xC259, 0xD907},
++	{0xC25A, 0x0000},
++	{0xC25B, 0x5529},
++	{0xC25C, 0x07E0},
++	{0xC25D, 0x7BFE},
++	{0xC25E, 0x6402},
++	{0xC25F, 0x0019},
++
++	{0xC3AC, 0x0007},
++	{0xC3AD, 0xED88},
++	{0xC320, 0x003E},
++	{0xC321, 0x0000},
++	{0xC322, 0x2000},
++	{0xC323, 0x0000},
++	{0xC324, 0x0271},
++	{0xC325, 0x0000},
++	{0xC326, 0x000C},
++	{0xC327, 0x0000},
++	{0xC328, 0x0271},
++	{0xC329, 0x0000},
++	{0xC32A, 0x0440},
++	{0xC32B, 0x0000},
++	{0xC32C, 0x0271},
++	{0xC32D, 0x0000},
++	{0xC32E, 0x0884},
++	{0xC32F, 0x0000},
++	{0xC330, 0x0271},
++	{0xC331, 0x0000},
++	{0xC332, 0x0CC8},
++	{0xC333, 0x0000},
++	{0xA88D, 0x0004},
++
++	{0xA890, 0x0000},
++	{0xC219, 0x0002},
++	{0xC21A, 0x0000},
++	{0xC21B, 0x0000},
++	{0xC21C, 0x00CD},
++	{0xC21D, 0x0009},
++	{0xC21E, 0x00CD},
++	{0xC21F, 0x0009},
++
++	{0xA87C, 0x0000},
++	{0xC032, 0x0001},
++	{0xC034, 0x0000},
++	{0xC035, 0x0001},
++	{0xC039, 0x0000},
++	{0xC401, 0x0002},
++
++	{0xFFFF, 1},
++	{0xA87C, 0x0001}
++};
++
++static int irs1125_write(struct v4l2_subdev *sd, u16 reg, u16 val)
++{
++	int ret;
++	unsigned char data[4] = { reg >> 8, reg & 0xff, val >> 8, val & 0xff};
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++
++	ret = i2c_master_send(client, data, 4);
++	if (ret < 0)
++		dev_err(&client->dev, "%s: i2c write error, reg: %x\n",
++			__func__, reg);
++
++	return ret;
++}
++
++static int irs1125_read(struct v4l2_subdev *sd, u16 reg, u16 *val)
++{
++	int ret;
++	unsigned char data_w[2] = { reg >> 8, reg & 0xff };
++	char rdval[2];
++
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++
++	ret = i2c_master_send(client, data_w, 2);
++	if (ret < 0) {
++		dev_dbg(&client->dev, "%s: i2c write error, reg: %x\n",
++			__func__, reg);
++		return ret;
++	}
++
++	ret = i2c_master_recv(client, rdval, 2);
++	if (ret < 0)
++		dev_err(&client->dev, "%s: i2c read error, reg: %x\n",
++			__func__, reg);
++
++	*val = rdval[1] | (rdval[0] << 8);
++
++	return ret;
++}
++
++static int irs1125_write_array(struct v4l2_subdev *sd,
++			       struct regval_list *regs, int array_size)
++{
++	int i, ret;
++
++	for (i = 0; i < array_size; i++) {
++		if (regs[i].addr == 0xFFFF) {
++			msleep(regs[i].data);
++		} else {
++			ret = irs1125_write(sd, regs[i].addr, regs[i].data);
++			if (ret < 0)
++				return ret;
++		}
++	}
++
++	return 0;
++}
++
++static int irs1125_stream_on(struct v4l2_subdev *sd)
++{
++	int ret;
++	struct irs1125 *irs1125 = to_state(sd);
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++
++	v4l2_ctrl_grab(irs1125->ctrl_numseq, 1);
++	v4l2_ctrl_grab(irs1125->ctrl_modplls, 1);
++
++	ret = irs1125_write(sd, 0xC400, 0x0001);
++	if (ret < 0) {
++		dev_err(&client->dev, "error enabling firmware: %d", ret);
++		return ret;
++	}
++
++	msleep(100);
++
++	return irs1125_write(sd, 0xA87C, 0x0001);
++}
++
++static int irs1125_stream_off(struct v4l2_subdev *sd)
++{
++	int ret;
++	struct irs1125 *irs1125 = to_state(sd);
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++
++	v4l2_ctrl_grab(irs1125->ctrl_numseq, 0);
++	v4l2_ctrl_grab(irs1125->ctrl_modplls, 0);
++
++	ret = irs1125_write(sd, 0xA87C, 0x0000);
++	if (ret < 0) {
++		dev_err(&client->dev, "error disabling trigger: %d", ret);
++		return ret;
++	}
++
++	msleep(100);
++
++	return irs1125_write(sd, 0xC400, 0x0002);
++}
++
++static int __sensor_init(struct v4l2_subdev *sd)
++{
++	unsigned int cnt, idx;
++	int ret;
++	u16 val;
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	struct irs1125 *irs1125 = to_state(sd);
++	const struct firmware *fw;
++	struct regval_list *reg_data;
++
++	cnt = 0;
++	while (1) {
++		ret = irs1125_read(sd, 0xC40F, &val);
++		if (ret < 0) {
++			dev_err(&client->dev, "read register 0xC40F failed\n");
++			return ret;
++		}
++		if (CHECK_BIT(val, 14) == 0)
++			break;
++
++		if (cnt >= 5) {
++			dev_err(&client->dev, "timeout waiting for 0xC40F\n");
++			return -EAGAIN;
++		}
++
++		cnt++;
++	}
++
++	ret = irs1125_write_array(sd, irs1125_26MHz,
++				  ARRAY_SIZE(irs1125_26MHz));
++	if (ret < 0) {
++		dev_err(&client->dev, "write sensor default regs error\n");
++		return ret;
++	}
++
++	/* set CSI-2 number of data lanes */
++	if (irs1125->ep.bus.mipi_csi2.num_data_lanes == 1) {
++		val = 0x0001;
++	} else if (irs1125->ep.bus.mipi_csi2.num_data_lanes == 2) {
++		val = 0x0081;
++	} else {
++		dev_err(&client->dev, "invalid number of data lanes %d\n",
++			irs1125->ep.bus.mipi_csi2.num_data_lanes);
++		return -EINVAL;
++	}
++
++	ret = irs1125_write(sd, IRS1125_REG_CSICFG, val);
++	if (ret < 0) {
++		dev_err(&client->dev, "write sensor csi2 config error\n");
++		return ret;
++	}
++
++	/* request the firmware, this will block and timeout */
++	ret = request_firmware(&fw, IRS1125_ALTERNATE_FW, &client->dev);
++	if (ret) {
++		dev_err(&client->dev,
++			"did not find the firmware file '%s' (status %d)\n",
++			IRS1125_ALTERNATE_FW, ret);
++		return ret;
++	}
++
++	if (fw->size % 4) {
++		dev_err(&client->dev, "firmware file '%s' invalid\n",
++			IRS1125_ALTERNATE_FW);
++		release_firmware(fw);
++		return -EINVAL;
++	}
++
++	for (idx = 0; idx < fw->size; idx += 4)	{
++		reg_data = (struct regval_list *)&fw->data[idx];
++		ret = irs1125_write(sd, reg_data->addr, reg_data->data);
++		if (ret < 0) {
++			dev_err(&client->dev, "firmware write error\n");
++			release_firmware(fw);
++			return ret;
++		}
++	}
++	release_firmware(fw);
++
++	ret = irs1125_write_array(sd, irs1125_seq_cfg,
++				  ARRAY_SIZE(irs1125_seq_cfg));
++	if (ret < 0) {
++		dev_err(&client->dev, "write default sequence failed\n");
++		return ret;
++	}
++
++	return 0;
++}
++
++static int irs1125_sensor_power(struct v4l2_subdev *sd, int on)
++{
++	int ret = 0;
++	struct irs1125 *irs1125 = to_state(sd);
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++
++	mutex_lock(&irs1125->lock);
++
++	if (on && !irs1125->power_count) {
++		gpiod_set_value_cansleep(irs1125->reset, 1);
++		msleep(RESET_ACTIVE_DELAY_MS);
++
++		ret = clk_prepare_enable(irs1125->xclk);
++		if (ret < 0) {
++			dev_err(&client->dev, "clk prepare enable failed\n");
++			goto out;
++		}
++
++		ret = __sensor_init(sd);
++		if (ret < 0) {
++			clk_disable_unprepare(irs1125->xclk);
++			dev_err(&client->dev,
++				"Camera not available, check Power\n");
++			goto out;
++		}
++	} else if (!on && irs1125->power_count == 1) {
++		gpiod_set_value_cansleep(irs1125->reset, 0);
++	}
++
++	/* Update the power count. */
++	irs1125->power_count += on ? 1 : -1;
++	WARN_ON(irs1125->power_count < 0);
++
++out:
++	mutex_unlock(&irs1125->lock);
++
++	return ret;
++}
++
++#ifdef CONFIG_VIDEO_ADV_DEBUG
++static int irs1125_sensor_get_register(struct v4l2_subdev *sd,
++				       struct v4l2_dbg_register *reg)
++{
++	u16 val;
++	int ret;
++
++	ret = irs1125_read(sd, reg->reg & 0xffff, &val);
++	if (ret < 0)
++		return ret;
++
++	reg->val = val;
++	reg->size = 1;
++
++	return 0;
++}
++
++static int irs1125_sensor_set_register(struct v4l2_subdev *sd,
++				       const struct v4l2_dbg_register *reg)
++{
++	return irs1125_write(sd, reg->reg & 0xffff, reg->val & 0xffff);
++}
++#endif
++
++static const struct v4l2_subdev_core_ops irs1125_subdev_core_ops = {
++	.s_power = irs1125_sensor_power,
++#ifdef CONFIG_VIDEO_ADV_DEBUG
++	.g_register = irs1125_sensor_get_register,
++	.s_register = irs1125_sensor_set_register,
++#endif
++};
++
++static int irs1125_s_stream(struct v4l2_subdev *sd, int enable)
++{
++	if (enable)
++		return irs1125_stream_on(sd);
++	else
++		return irs1125_stream_off(sd);
++}
++
++static const struct v4l2_subdev_video_ops irs1125_subdev_video_ops = {
++	.s_stream = irs1125_s_stream,
++};
++
++static int irs1125_enum_mbus_code(struct v4l2_subdev *sd,
++				  struct v4l2_subdev_pad_config *cfg,
++	struct v4l2_subdev_mbus_code_enum *code)
++{
++	if (code->index > 0)
++		return -EINVAL;
++
++	code->code = MEDIA_BUS_FMT_Y12_1X12;
++
++	return 0;
++}
++
++static int irs1125_set_get_fmt(struct v4l2_subdev *sd,
++			       struct v4l2_subdev_pad_config *cfg,
++			       struct v4l2_subdev_format *format)
++{
++	struct v4l2_mbus_framefmt *fmt = &format->format;
++	struct irs1125 *irs1125 = to_state(sd);
++
++	if (format->pad != 0)
++		return -EINVAL;
++
++	/* Only one format is supported, so return that */
++	memset(fmt, 0, sizeof(*fmt));
++	fmt->code = MEDIA_BUS_FMT_Y12_1X12;
++	fmt->colorspace = V4L2_COLORSPACE_RAW;
++	fmt->field = V4L2_FIELD_NONE;
++	fmt->width = IRS1125_WINDOW_WIDTH_DEF;
++	fmt->height = IRS1125_WINDOW_HEIGHT_DEF * irs1125->num_seq;
++
++	return 0;
++}
++
++static const struct v4l2_subdev_pad_ops irs1125_subdev_pad_ops = {
++	.enum_mbus_code = irs1125_enum_mbus_code,
++	.set_fmt = irs1125_set_get_fmt,
++	.get_fmt = irs1125_set_get_fmt,
++};
++
++static const struct v4l2_subdev_ops irs1125_subdev_ops = {
++	.core = &irs1125_subdev_core_ops,
++	.video = &irs1125_subdev_video_ops,
++	.pad = &irs1125_subdev_pad_ops,
++};
++
++static int irs1125_s_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct irs1125 *dev = container_of(ctrl->handler,
++					struct irs1125, ctrl_handler);
++	struct i2c_client *client = v4l2_get_subdevdata(&dev->sd);
++	int err, i;
++	struct irs1125_mod_pll *mod_cur, *mod_new;
++	struct irs1125_seq_cfg *cfg_cur, *cfg_new;
++	u16 addr, val;
++
++	err = 0;
++
++	switch (ctrl->id) {
++	case IRS1125_CID_SAFE_RECONFIG:
++	{
++		struct irs1125_illu *illu_cur, *illu_new;
++
++		illu_new = (struct irs1125_illu *)ctrl->p_new.p;
++		illu_cur = (struct irs1125_illu *)ctrl->p_cur.p;
++		for (i = 0; i < IRS1125_NUM_SEQ_ENTRIES; i++) {
++			if (illu_cur[i].exposure != illu_new[i].exposure) {
++				addr = 0xA850 + i * 2;
++				val = illu_new[i].exposure;
++				err = irs1125_write(&dev->sd, addr, val);
++				if (err < 0)
++					break;
++			}
++			if (illu_cur[i].framerate != illu_new[i].framerate) {
++				addr = 0xA851 + i * 2;
++				val = illu_new[i].framerate;
++				err = irs1125_write(&dev->sd, addr, val);
++				if (err < 0)
++					break;
++			}
++		}
++		break;
++	}
++	case IRS1125_CID_MOD_PLL:
++		mod_new = (struct irs1125_mod_pll *)ctrl->p_new.p;
++		mod_cur = (struct irs1125_mod_pll *)ctrl->p_cur.p;
++		for (i = 0; i < IRS1125_NUM_MOD_PLLS; i++) {
++			if (mod_cur[i].pllcfg1 != mod_new[i].pllcfg1) {
++				addr = 0xC3A0 + i * 3;
++				val = mod_new[i].pllcfg1;
++				err = irs1125_write(&dev->sd, addr, val);
++				if (err < 0)
++					break;
++			}
++			if (mod_cur[i].pllcfg2 != mod_new[i].pllcfg2) {
++				addr = 0xC3A1 + i * 3;
++				val = mod_new[i].pllcfg2;
++				err = irs1125_write(&dev->sd, addr, val);
++				if (err < 0)
++					break;
++			}
++			if (mod_cur[i].pllcfg3 != mod_new[i].pllcfg3) {
++				addr = 0xC3A2 + i * 3;
++				val = mod_new[i].pllcfg3;
++				err = irs1125_write(&dev->sd, addr, val);
++				if (err < 0)
++					break;
++			}
++			if (mod_cur[i].pllcfg4 != mod_new[i].pllcfg4) {
++				addr = 0xC24C + i * 5;
++				val = mod_new[i].pllcfg4;
++				err = irs1125_write(&dev->sd, addr, val);
++				if (err < 0)
++					break;
++			}
++			if (mod_cur[i].pllcfg5 != mod_new[i].pllcfg5) {
++				addr = 0xC24D + i * 5;
++				val = mod_new[i].pllcfg5;
++				err = irs1125_write(&dev->sd, addr, val);
++				if (err < 0)
++					break;
++			}
++			if (mod_cur[i].pllcfg6 != mod_new[i].pllcfg6) {
++				addr = 0xC24E + i * 5;
++				val = mod_new[i].pllcfg6;
++				err = irs1125_write(&dev->sd, addr, val);
++				if (err < 0)
++					break;
++			}
++			if (mod_cur[i].pllcfg7 != mod_new[i].pllcfg7) {
++				addr = 0xC24F + i * 5;
++				val = mod_new[i].pllcfg7;
++				err = irs1125_write(&dev->sd, addr, val);
++				if (err < 0)
++					break;
++			}
++			if (mod_cur[i].pllcfg8 != mod_new[i].pllcfg8) {
++				addr = 0xC250 + i * 5;
++				val = mod_new[i].pllcfg8;
++				err = irs1125_write(&dev->sd, addr, val);
++				if (err < 0)
++					break;
++			}
++		}
++		break;
++	case IRS1125_CID_SEQ_CONFIG:
++		cfg_new = (struct irs1125_seq_cfg *)ctrl->p_new.p;
++		cfg_cur = (struct irs1125_seq_cfg *)ctrl->p_cur.p;
++		for (i = 0; i < IRS1125_NUM_SEQ_ENTRIES; i++) {
++			if (cfg_cur[i].exposure != cfg_new[i].exposure)	{
++				addr = IRS1125_REG_DMEM_SHADOW + i * 4;
++				val = cfg_new[i].exposure;
++				err = irs1125_write(&dev->sd, addr, val);
++				if (err < 0)
++					break;
++			}
++			if (cfg_cur[i].framerate != cfg_new[i].framerate) {
++				addr = IRS1125_REG_DMEM_SHADOW + 1 + i * 4;
++				val = cfg_new[i].framerate;
++				err = irs1125_write(&dev->sd, addr, val);
++				if (err < 0)
++					break;
++			}
++			if (cfg_cur[i].ps != cfg_new[i].ps) {
++				addr = IRS1125_REG_DMEM_SHADOW + 2 + i * 4;
++				val = cfg_new[i].ps;
++				err = irs1125_write(&dev->sd, addr, val);
++				if (err < 0)
++					break;
++			}
++			if (cfg_cur[i].pll != cfg_new[i].pll) {
++				addr = IRS1125_REG_DMEM_SHADOW + 3 + i * 4;
++				val = cfg_new[i].pll;
++				err = irs1125_write(&dev->sd, addr, val);
++				if (err < 0)
++					break;
++			}
++		}
++		break;
++	case IRS1125_CID_NUM_SEQS:
++		err = irs1125_write(&dev->sd, 0xA88D, ctrl->val - 1);
++		if (err >= 0)
++			dev->num_seq = ctrl->val;
++		break;
++	case IRS1125_CID_CONTINUOUS_TRIG:
++		if (ctrl->val == 0)
++			err = irs1125_write(&dev->sd, 0xA87C, 0);
++		else
++			err = irs1125_write(&dev->sd, 0xA87C, 1);
++		break;
++	case IRS1125_CID_TRIGGER:
++		if (ctrl->val != 0) {
++			err = irs1125_write(&dev->sd, 0xA87C, 1);
++			if (err >= 0)
++				err = irs1125_write(&dev->sd, 0xA87C, 0);
++		}
++		break;
++	case IRS1125_CID_RECONFIG:
++		if (ctrl->val != 0)
++			err = irs1125_write(&dev->sd, 0xA87A, 1);
++		break;
++	case IRS1125_CID_ILLU_ON:
++		if (ctrl->val == 0)
++			err = irs1125_write(&dev->sd, 0xA892, 0x377);
++		else
++			err = irs1125_write(&dev->sd, 0xA892, 0x355);
++		break;
++	default:
++		break;
++	}
++
++	if (err < 0)
++		dev_err(&client->dev, "Error executing control ID: %d, val %d, err %d",
++			ctrl->id, ctrl->val, err);
++	else
++		err = 0;
++
++	return err;
++}
++
++static const struct v4l2_ctrl_ops irs1125_ctrl_ops = {
++	.s_ctrl = irs1125_s_ctrl,
++};
++
++static const struct v4l2_ctrl_config irs1125_custom_ctrls[] = {
++	{
++		.ops = &irs1125_ctrl_ops,
++		.id = IRS1125_CID_NUM_SEQS,
++		.name = "Change number of sequences",
++		.type = V4L2_CTRL_TYPE_INTEGER,
++		.flags = V4L2_CTRL_FLAG_MODIFY_LAYOUT,
++		.min = 1,
++		.max = 20,
++		.step = 1,
++		.def = 5,
++	}, {
++		.ops = &irs1125_ctrl_ops,
++		.id = IRS1125_CID_MOD_PLL,
++		.name = "Reconfigure modulation PLLs",
++		.type = V4L2_CTRL_TYPE_U16,
++		.flags = V4L2_CTRL_FLAG_HAS_PAYLOAD,
++		.min = 0,
++		.max = U16_MAX,
++		.step = 1,
++		.def = 0,
++		.elem_size = sizeof(u16),
++		.dims = {sizeof(struct irs1125_mod_pll) / sizeof(u16),
++			IRS1125_NUM_MOD_PLLS}
++	}, {
++		.ops = &irs1125_ctrl_ops,
++		.id = IRS1125_CID_SAFE_RECONFIG,
++		.name = "Change exposure and pause of single seq",
++		.type = V4L2_CTRL_TYPE_U16,
++		.flags = V4L2_CTRL_FLAG_HAS_PAYLOAD,
++		.min = 0,
++		.max = U16_MAX,
++		.step = 1,
++		.def = 0,
++		.elem_size = sizeof(u16),
++		.dims = {sizeof(struct irs1125_illu) / sizeof(u16),
++			IRS1125_NUM_SEQ_ENTRIES}
++	}, {
++		.ops = &irs1125_ctrl_ops,
++		.id = IRS1125_CID_SEQ_CONFIG,
++		.name = "Change sequence settings",
++		.type = V4L2_CTRL_TYPE_U16,
++		.flags = V4L2_CTRL_FLAG_HAS_PAYLOAD,
++		.min = 0,
++		.max = U16_MAX,
++		.step = 1,
++		.def = 0,
++		.elem_size = sizeof(u16),
++		.dims = {sizeof(struct irs1125_seq_cfg) / sizeof(u16),
++			IRS1125_NUM_SEQ_ENTRIES}
++	}, {
++		.ops = &irs1125_ctrl_ops,
++		.id = IRS1125_CID_CONTINUOUS_TRIG,
++		.name = "Enable/disable continuous trigger",
++		.type = V4L2_CTRL_TYPE_BOOLEAN,
++		.flags = V4L2_CTRL_FLAG_EXECUTE_ON_WRITE,
++		.min = 0,
++		.max = 1,
++		.step = 1,
++		.def = 0
++	}, {
++		.ops = &irs1125_ctrl_ops,
++		.id = IRS1125_CID_TRIGGER,
++		.name = "Capture a single sequence",
++		.type = V4L2_CTRL_TYPE_BOOLEAN,
++		.flags = V4L2_CTRL_FLAG_EXECUTE_ON_WRITE,
++		.min = 0,
++		.max = 1,
++		.step = 1,
++		.def = 0
++	}, {
++		.ops = &irs1125_ctrl_ops,
++		.id = IRS1125_CID_RECONFIG,
++		.name = "Trigger imager reconfiguration",
++		.type = V4L2_CTRL_TYPE_BOOLEAN,
++		.flags = V4L2_CTRL_FLAG_EXECUTE_ON_WRITE,
++		.min = 0,
++		.max = 1,
++		.step = 1,
++		.def = 0
++	}, {
++		.ops = &irs1125_ctrl_ops,
++		.id = IRS1125_CID_ILLU_ON,
++		.name = "Turn illu on or off",
++		.type = V4L2_CTRL_TYPE_BOOLEAN,
++		.flags = V4L2_CTRL_FLAG_EXECUTE_ON_WRITE,
++		.min = 0,
++		.max = 1,
++		.step = 1,
++		.def = 1
++	}, {
++		.ops = &irs1125_ctrl_ops,
++		.id = IRS1125_CID_IDENT0,
++		.name = "Get ident 0 information",
++		.type = V4L2_CTRL_TYPE_INTEGER,
++		.flags = V4L2_CTRL_FLAG_READ_ONLY,
++		.min = S32_MIN,
++		.max = S32_MAX,
++		.step = 1,
++		.def = 0
++	}, {
++		.ops = &irs1125_ctrl_ops,
++		.id = IRS1125_CID_IDENT1,
++		.name = "Get ident 1 information",
++		.type = V4L2_CTRL_TYPE_INTEGER,
++		.flags = V4L2_CTRL_FLAG_READ_ONLY,
++		.min = S32_MIN,
++		.max = S32_MAX,
++		.step = 1,
++		.def = 0
++	}, {
++		.ops = &irs1125_ctrl_ops,
++		.id = IRS1125_CID_IDENT2,
++		.name = "Get ident 2 information",
++		.type = V4L2_CTRL_TYPE_INTEGER,
++		.flags = V4L2_CTRL_FLAG_READ_ONLY,
++		.min = S32_MIN,
++		.max = S32_MAX,
++		.step = 1,
++		.def = 0
++	}
++};
++
++static int irs1125_detect(struct v4l2_subdev *sd)
++{
++	u16 read;
++	int ret;
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++
++	ret = irs1125_read(sd, IRS1125_REG_DESIGN_STEP, &read);
++	if (ret < 0) {
++		dev_err(&client->dev, "error reading from i2c\n");
++		return ret;
++	}
++
++	if (read != IRS1125_DESIGN_STEP_EXPECTED) {
++		dev_err(&client->dev, "Design step expected 0x%x got 0x%x",
++			IRS1125_DESIGN_STEP_EXPECTED, read);
++		return -ENODEV;
++	}
++
++	return 0;
++}
++
++static int irs1125_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	struct v4l2_mbus_framefmt *format =
++	v4l2_subdev_get_try_format(sd, fh->pad, 0);
++
++	format->code = MEDIA_BUS_FMT_Y12_1X12;
++	format->width = IRS1125_WINDOW_WIDTH_DEF;
++	format->height = IRS1125_WINDOW_HEIGHT_DEF;
++	format->field = V4L2_FIELD_NONE;
++	format->colorspace = V4L2_COLORSPACE_RAW;
++
++	return 0;
++}
++
++static const struct v4l2_subdev_internal_ops irs1125_subdev_internal_ops = {
++	.open = irs1125_open,
++};
++
++static int irs1125_ctrls_init(struct irs1125 *sensor, struct device *dev)
++{
++	struct v4l2_ctrl *ctrl;
++	int err, i;
++	struct v4l2_ctrl_handler *hdl;
++
++	hdl = &sensor->ctrl_handler;
++	v4l2_ctrl_handler_init(hdl, ARRAY_SIZE(irs1125_custom_ctrls));
++
++	for (i = 0; i < ARRAY_SIZE(irs1125_custom_ctrls); i++)	{
++		ctrl = v4l2_ctrl_new_custom(hdl, &irs1125_custom_ctrls[i],
++					    NULL);
++		if (!ctrl)
++			dev_err(dev, "Failed to init custom control %s\n",
++				irs1125_custom_ctrls[i].name);
++		else if (irs1125_custom_ctrls[i].id == IRS1125_CID_NUM_SEQS)
++			sensor->ctrl_numseq = ctrl;
++		else if (irs1125_custom_ctrls[i].id == IRS1125_CID_MOD_PLL)
++			sensor->ctrl_modplls = ctrl;
++	}
++
++	if (hdl->error)	{
++		dev_err(dev, "Error %d adding controls\n", hdl->error);
++		err = hdl->error;
++		goto error_ctrls;
++	}
++
++	sensor->sd.ctrl_handler = hdl;
++	return 0;
++
++error_ctrls:
++	v4l2_ctrl_handler_free(&sensor->ctrl_handler);
++	return -err;
++}
++
++static int irs1125_ident_setup(struct irs1125 *sensor, struct device *dev)
++{
++	int ret;
++	struct v4l2_ctrl *ctrl;
++	struct v4l2_subdev *sd;
++	u16 read;
++
++	sd = &sensor->sd;
++
++	ctrl = v4l2_ctrl_find(&sensor->ctrl_handler, IRS1125_CID_IDENT0);
++	if (!ctrl) {
++		dev_err(dev, "could not find device ctrl.\n");
++		return -EINVAL;
++	}
++
++	ret = irs1125_read(sd, IRS1125_REG_EFUSEVAL2, &read);
++	if (ret < 0) {
++		dev_err(dev, "error reading from i2c\n");
++		return -EIO;
++	}
++
++	v4l2_ctrl_s_ctrl(ctrl, read);
++
++	ctrl = v4l2_ctrl_find(&sensor->ctrl_handler, IRS1125_CID_IDENT1);
++	if (!ctrl) {
++		dev_err(dev, "could not find device ctrl.\n");
++		return -EINVAL;
++	}
++
++	ret = irs1125_read(sd, IRS1125_REG_EFUSEVAL3, &read);
++	if (ret < 0) {
++		dev_err(dev, "error reading from i2c\n");
++		return -EIO;
++	}
++
++	v4l2_ctrl_s_ctrl(ctrl, read);
++
++	ctrl = v4l2_ctrl_find(&sensor->ctrl_handler, IRS1125_CID_IDENT2);
++	if (!ctrl) {
++		dev_err(dev, "could not find device ctrl.\n");
++		return -EINVAL;
++	}
++
++	ret = irs1125_read(sd, IRS1125_REG_EFUSEVAL4, &read);
++	if (ret < 0) {
++		dev_err(dev, "error reading from i2c\n");
++		return -EIO;
++	}
++	v4l2_ctrl_s_ctrl(ctrl, read & 0xFFFC);
++
++	return 0;
++}
++
++static int irs1125_probe(struct i2c_client *client,
++			 const struct i2c_device_id *id)
++{
++	struct device *dev = &client->dev;
++	struct irs1125 *sensor;
++	int ret;
++	struct fwnode_handle *endpoint;
++	u32 xclk_freq;
++	int gpio_num;
++
++	sensor = devm_kzalloc(dev, sizeof(*sensor), GFP_KERNEL);
++	if (!sensor)
++		return -ENOMEM;
++
++	v4l2_i2c_subdev_init(&sensor->sd, client, &irs1125_subdev_ops);
++
++	/* Get CSI2 bus config */
++	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(dev),
++						  NULL);
++	if (!endpoint) {
++		dev_err(dev, "endpoint node not found\n");
++		return -EINVAL;
++	}
++
++	ret = v4l2_fwnode_endpoint_parse(endpoint, &sensor->ep);
++	fwnode_handle_put(endpoint);
++	if (ret) {
++		dev_err(dev, "Could not parse endpoint\n");
++		return ret;
++	}
++
++	/* get system clock (xclk) */
++	sensor->xclk = devm_clk_get(dev, NULL);
++	if (IS_ERR(sensor->xclk)) {
++		dev_err(dev, "could not get xclk");
++		return PTR_ERR(sensor->xclk);
++	}
++
++	xclk_freq = clk_get_rate(sensor->xclk);
++	if (xclk_freq != 26000000) {
++		dev_err(dev, "Unsupported clock frequency: %u\n", xclk_freq);
++		return -EINVAL;
++	}
++
++	sensor->num_seq = 5;
++
++	/* Request the power down GPIO */
++	sensor->reset = devm_gpiod_get(&client->dev, "pwdn",
++				       GPIOD_OUT_LOW);
++
++	if (IS_ERR(sensor->reset)) {
++		dev_err(dev, "could not get reset");
++		return PTR_ERR(sensor->reset);
++	}
++
++	gpio_num = desc_to_gpio(sensor->reset);
++
++	mutex_init(&sensor->lock);
++
++	ret = irs1125_ctrls_init(sensor, dev);
++	if (ret < 0)
++		goto mutex_remove;
++
++	sensor->sd.internal_ops = &irs1125_subdev_internal_ops;
++	sensor->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
++	sensor->sd.entity.function = MEDIA_ENT_F_CAM_SENSOR;
++	sensor->pad.flags = MEDIA_PAD_FL_SOURCE;
++	ret = media_entity_pads_init(&sensor->sd.entity, 1, &sensor->pad);
++	if (ret < 0)
++		goto mutex_remove;
++
++	gpiod_set_value_cansleep(sensor->reset, 1);
++	msleep(RESET_ACTIVE_DELAY_MS);
++
++	ret = irs1125_detect(&sensor->sd);
++	if (ret < 0)
++		goto error;
++
++	ret = irs1125_ident_setup(sensor, dev);
++	if (ret < 0)
++		goto error;
++
++	gpiod_set_value_cansleep(sensor->reset, 0);
++
++	ret = v4l2_async_register_subdev(&sensor->sd);
++	if (ret < 0)
++		goto error;
++
++	dev_dbg(dev, "Infineon IRS1125 camera driver probed\n");
++
++	return 0;
++
++error:
++	media_entity_cleanup(&sensor->sd.entity);
++mutex_remove:
++	mutex_destroy(&sensor->lock);
++	return ret;
++}
++
++static int irs1125_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct irs1125 *irs1125 = to_state(sd);
++
++	v4l2_async_unregister_subdev(&irs1125->sd);
++	media_entity_cleanup(&irs1125->sd.entity);
++	v4l2_device_unregister_subdev(sd);
++	mutex_destroy(&irs1125->lock);
++	v4l2_ctrl_handler_free(&irs1125->ctrl_handler);
++
++	return 0;
++}
++
++#if IS_ENABLED(CONFIG_OF)
++static const struct of_device_id irs1125_of_match[] = {
++	{ .compatible = "infineon,irs1125" },
++	{ /* sentinel */ },
++};
++MODULE_DEVICE_TABLE(of, irs1125_of_match);
++#endif
++
++static struct i2c_driver irs1125_driver = {
++	.driver = {
++		.of_match_table = of_match_ptr(irs1125_of_match),
++		.name	 = SENSOR_NAME,
++	},
++	.probe		= irs1125_probe,
++	.remove		= irs1125_remove,
++};
++
++module_i2c_driver(irs1125_driver);
++
++MODULE_AUTHOR("Markus Proeller <markus.proeller@pieye.org>");
++MODULE_DESCRIPTION("Infineon irs1125 sensor driver");
++MODULE_LICENSE("GPL v2");
++
+--- /dev/null
++++ b/drivers/media/i2c/irs1125.h
+@@ -0,0 +1,61 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * A V4L2 driver for Infineon IRS1125 TOF cameras.
++ * Copyright (C) 2018, pieye GmbH
++ *
++ * Based on V4L2 OmniVision OV5647 Image Sensor driver
++ * Copyright (C) 2016 Ramiro Oliveira <roliveir@synopsys.com>
++ *
++ * DT / fwnode changes, and GPIO control taken from ov5640.c
++ * Copyright (C) 2011-2013 Freescale Semiconductor, Inc. All Rights Reserved.
++ * Copyright (C) 2014-2017 Mentor Graphics Inc.
++ *
++ */
++
++#ifndef IRS1125_H
++#define IRS1125_H
++
++#include <linux/v4l2-controls.h>
++#include <linux/types.h>
++
++#define IRS1125_NUM_SEQ_ENTRIES 20
++#define IRS1125_NUM_MOD_PLLS 4
++
++#define IRS1125_CID_CUSTOM_BASE        (V4L2_CID_USER_BASE | 0xf000)
++#define IRS1125_CID_SAFE_RECONFIG      (IRS1125_CID_CUSTOM_BASE + 0)
++#define IRS1125_CID_CONTINUOUS_TRIG    (IRS1125_CID_CUSTOM_BASE + 1)
++#define IRS1125_CID_TRIGGER            (IRS1125_CID_CUSTOM_BASE + 2)
++#define IRS1125_CID_RECONFIG           (IRS1125_CID_CUSTOM_BASE + 3)
++#define IRS1125_CID_ILLU_ON            (IRS1125_CID_CUSTOM_BASE + 4)
++#define IRS1125_CID_NUM_SEQS           (IRS1125_CID_CUSTOM_BASE + 5)
++#define IRS1125_CID_MOD_PLL            (IRS1125_CID_CUSTOM_BASE + 6)
++#define IRS1125_CID_SEQ_CONFIG         (IRS1125_CID_CUSTOM_BASE + 7)
++#define IRS1125_CID_IDENT0             (IRS1125_CID_CUSTOM_BASE + 8)
++#define IRS1125_CID_IDENT1             (IRS1125_CID_CUSTOM_BASE + 9)
++#define IRS1125_CID_IDENT2             (IRS1125_CID_CUSTOM_BASE + 10)
++
++struct irs1125_seq_cfg {
++	__u16 exposure;
++	__u16 framerate;
++	__u16 ps;
++	__u16 pll;
++};
++
++struct irs1125_illu {
++	__u16 exposure;
++	__u16 framerate;
++};
++
++struct irs1125_mod_pll {
++	__u16 pllcfg1;
++	__u16 pllcfg2;
++	__u16 pllcfg3;
++	__u16 pllcfg4;
++	__u16 pllcfg5;
++	__u16 pllcfg6;
++	__u16 pllcfg7;
++	__u16 pllcfg8;
++};
++
++#endif /* IRS1125 */
++
diff --git a/target/linux/bcm27xx/patches-6.1/950-0205-drm-v3d-Suppress-all-but-the-first-MMU-error.patch b/target/linux/bcm27xx/patches-6.1/950-0205-drm-v3d-Suppress-all-but-the-first-MMU-error.patch
new file mode 100644
index 00000000000000..ef061c9d29fbf7
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0205-drm-v3d-Suppress-all-but-the-first-MMU-error.patch
@@ -0,0 +1,39 @@
+From a2bd77e0c5e69ebfbacd3fef2e586305bb2733ff Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 11 Nov 2019 20:18:08 +0000
+Subject: [PATCH] drm/v3d: Suppress all but the first MMU error
+
+The v3d driver currently encounters a lot of MMU PTE exceptions, so
+only log the first to avoid swamping the kernel log.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/gpu/drm/v3d/v3d_irq.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/v3d/v3d_irq.c
++++ b/drivers/gpu/drm/v3d/v3d_irq.c
+@@ -177,6 +177,7 @@ v3d_hub_irq(int irq, void *arg)
+ 			"GMP",
+ 		};
+ 		const char *client = "?";
++		static int logged_error;
+ 
+ 		V3D_WRITE(V3D_MMU_CTL, V3D_READ(V3D_MMU_CTL));
+ 
+@@ -186,6 +187,7 @@ v3d_hub_irq(int irq, void *arg)
+ 				client = v3d41_axi_ids[axi_id];
+ 		}
+ 
++		if (!logged_error)
+ 		dev_err(v3d->drm.dev, "MMU error from client %s (%d) at 0x%llx%s%s%s\n",
+ 			client, axi_id, (long long)vio_addr,
+ 			((intsts & V3D_HUB_INT_MMU_WRV) ?
+@@ -194,6 +196,7 @@ v3d_hub_irq(int irq, void *arg)
+ 			 ", pte invalid" : ""),
+ 			((intsts & V3D_HUB_INT_MMU_CAP) ?
+ 			 ", cap exceeded" : ""));
++		logged_error = 1;
+ 		status = IRQ_HANDLED;
+ 	}
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0206-drm-v3d-Plug-dma_fence-leak.patch b/target/linux/bcm27xx/patches-6.1/950-0206-drm-v3d-Plug-dma_fence-leak.patch
new file mode 100644
index 00000000000000..022a33fb284afc
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0206-drm-v3d-Plug-dma_fence-leak.patch
@@ -0,0 +1,28 @@
+From acdf673ee14bdb44493855c53d80d0d0f3a1b48c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 12 Nov 2019 16:41:21 +0000
+Subject: [PATCH] drm/v3d: Plug dma_fence leak
+
+The irq_fence and done_fence are given a reference that is never
+released. The necessary dma_fence_put()s seem to have been
+deleted in error in an earlier commit.
+
+Fixes: 0b73676836b2 ("drm/v3d: Clock V3D down when not in use.")
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/gpu/drm/v3d/v3d_gem.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/v3d/v3d_gem.c
++++ b/drivers/gpu/drm/v3d/v3d_gem.c
+@@ -411,6 +411,9 @@ v3d_job_free(struct kref *ref)
+ 	}
+ 	kvfree(job->bo);
+ 
++	dma_fence_put(job->irq_fence);
++	dma_fence_put(job->done_fence);
++
+ 	v3d_clock_up_put(v3d);
+ 
+ 	if (job->perfmon)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0207-staging-vchiq_arm-Register-vcsm-cma-as-a-platform-dr.patch b/target/linux/bcm27xx/patches-6.1/950-0207-staging-vchiq_arm-Register-vcsm-cma-as-a-platform-dr.patch
new file mode 100644
index 00000000000000..30fd36a5f63815
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0207-staging-vchiq_arm-Register-vcsm-cma-as-a-platform-dr.patch
@@ -0,0 +1,40 @@
+From a0a388aaf2199d592e4a787af1e4d18b18950269 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 6 Nov 2019 13:57:48 +0000
+Subject: [PATCH] staging: vchiq_arm: Register vcsm-cma as a platform
+ driver
+
+Following the same pattern as bcm2835-camera and bcm2835-audio,
+register the vcsm-cma driver as a platform driver
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -67,6 +67,7 @@ struct vchiq_state g_state;
+ 
+ static struct platform_device *bcm2835_camera;
+ static struct platform_device *bcm2835_audio;
++static struct platform_device *vcsm_cma;
+ 
+ struct vchiq_drvdata {
+ 	const unsigned int cache_line_size;
+@@ -1832,6 +1833,7 @@ static int vchiq_probe(struct platform_d
+ 		goto error_exit;
+ 	}
+ 
++	vcsm_cma = vchiq_register_child(pdev, "vcsm-cma");
+ 	bcm2835_camera = vchiq_register_child(pdev, "bcm2835-camera");
+ 	bcm2835_audio = vchiq_register_child(pdev, "bcm2835_audio");
+ 
+@@ -1847,6 +1849,7 @@ static int vchiq_remove(struct platform_
+ {
+ 	platform_device_unregister(bcm2835_audio);
+ 	platform_device_unregister(bcm2835_camera);
++	platform_device_unregister(vcsm_cma);
+ 	vchiq_debugfs_deinit();
+ 	vchiq_deregister_chrdev();
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0208-staging-vchiq_arm-Register-bcm2835-codec-as-a-platfo.patch b/target/linux/bcm27xx/patches-6.1/950-0208-staging-vchiq_arm-Register-bcm2835-codec-as-a-platfo.patch
new file mode 100644
index 00000000000000..8cacee0b47b1d9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0208-staging-vchiq_arm-Register-bcm2835-codec-as-a-platfo.patch
@@ -0,0 +1,40 @@
+From c1cc213d717cce44bef144855662fb9256862d01 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 6 Nov 2019 13:57:58 +0000
+Subject: [PATCH] staging: vchiq_arm: Register bcm2835-codec as a
+ platform driver
+
+Following the same pattern as bcm2835-camera and bcm2835-audio,
+register the V4L2 codec driver as a platform driver
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -67,6 +67,7 @@ struct vchiq_state g_state;
+ 
+ static struct platform_device *bcm2835_camera;
+ static struct platform_device *bcm2835_audio;
++static struct platform_device *bcm2835_codec;
+ static struct platform_device *vcsm_cma;
+ 
+ struct vchiq_drvdata {
+@@ -1834,6 +1835,7 @@ static int vchiq_probe(struct platform_d
+ 	}
+ 
+ 	vcsm_cma = vchiq_register_child(pdev, "vcsm-cma");
++	bcm2835_codec = vchiq_register_child(pdev, "bcm2835-codec");
+ 	bcm2835_camera = vchiq_register_child(pdev, "bcm2835-camera");
+ 	bcm2835_audio = vchiq_register_child(pdev, "bcm2835_audio");
+ 
+@@ -1849,6 +1851,7 @@ static int vchiq_remove(struct platform_
+ {
+ 	platform_device_unregister(bcm2835_audio);
+ 	platform_device_unregister(bcm2835_camera);
++	platform_device_unregister(bcm2835_codec);
+ 	platform_device_unregister(vcsm_cma);
+ 	vchiq_debugfs_deinit();
+ 	vchiq_deregister_chrdev();
diff --git a/target/linux/bcm27xx/patches-6.1/950-0209-net-phy-2711-Allow-ethernet-LED-mode-to-be-set-via-d.patch b/target/linux/bcm27xx/patches-6.1/950-0209-net-phy-2711-Allow-ethernet-LED-mode-to-be-set-via-d.patch
new file mode 100644
index 00000000000000..9f9e61989a2e31
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0209-net-phy-2711-Allow-ethernet-LED-mode-to-be-set-via-d.patch
@@ -0,0 +1,55 @@
+From 2c7d2adefa34858208435e771690d2808eaf809d Mon Sep 17 00:00:00 2001
+From: James Hughes <james.hughes@raspberrypi.org>
+Date: Thu, 31 Oct 2019 14:39:44 +0000
+Subject: [PATCH] net:phy:2711 Allow ethernet LED mode to be set via
+ device tree
+
+Add device tree entries and code to allow the specification of
+the lighting modes for the LED's on the ethernet connector.
+
+Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
+
+net:phy:2711 Change the default ethernet LED actions
+
+This should return default behaviour back to that of previous
+releases.
+---
+ drivers/net/phy/broadcom.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -337,6 +337,9 @@ static void bcm54xx_ptp_config_init(stru
+ static int bcm54xx_config_init(struct phy_device *phydev)
+ {
+ 	int reg, err, val;
++	u32 led_modes[] = {BCM_LED_MULTICOLOR_LINK_ACT,
++			   BCM_LED_MULTICOLOR_LINK};
++	struct device_node *np = phydev->mdio.dev.of_node;
+ 
+ 	reg = phy_read(phydev, MII_BCM54XX_ECR);
+ 	if (reg < 0)
+@@ -392,10 +395,10 @@ static int bcm54xx_config_init(struct ph
+ 
+ 	bcm54xx_phydsp_config(phydev);
+ 
++	of_property_read_u32_array(np, "led-modes", led_modes, 2);
++
+ 	/* For non-SFP setups, encode link speed into LED1 and LED3 pair
+ 	 * (green/amber).
+-	 * Also flash these two LEDs on activity. This means configuring
+-	 * them for MULTICOLOR and encoding link/activity into them.
+ 	 * Don't do this for devices on an SFP module, since some of these
+ 	 * use the LED outputs to control the SFP LOS signal, and changing
+ 	 * these settings will cause LOS to malfunction.
+@@ -406,8 +409,8 @@ static int bcm54xx_config_init(struct ph
+ 		bcm_phy_write_shadow(phydev, BCM5482_SHD_LEDS1, val);
+ 
+ 		val = BCM_LED_MULTICOLOR_IN_PHASE |
+-			BCM5482_SHD_LEDS1_LED1(BCM_LED_MULTICOLOR_LINK_ACT) |
+-			BCM5482_SHD_LEDS1_LED3(BCM_LED_MULTICOLOR_LINK_ACT);
++			BCM5482_SHD_LEDS1_LED1(led_modes[0]) |
++			BCM5482_SHD_LEDS1_LED3(led_modes[1]);
+ 		bcm_phy_write_exp(phydev, BCM_EXP_MULTICOLOR, val);
+ 	}
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0210-v3d_drv-Handle-missing-clock-more-gracefully.patch b/target/linux/bcm27xx/patches-6.1/950-0210-v3d_drv-Handle-missing-clock-more-gracefully.patch
new file mode 100644
index 00000000000000..646aa56d631743
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0210-v3d_drv-Handle-missing-clock-more-gracefully.patch
@@ -0,0 +1,27 @@
+From 09e8617d7c6f61e412ab4ec53749f2c46f089482 Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Fri, 23 Aug 2019 16:34:38 +0100
+Subject: [PATCH] v3d_drv: Handle missing clock more gracefully
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/v3d/v3d_drv.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/v3d/v3d_drv.c
++++ b/drivers/gpu/drm/v3d/v3d_drv.c
+@@ -261,10 +261,10 @@ static int v3d_platform_drm_probe(struct
+ 	}
+ 
+ 	v3d->clk = devm_clk_get(dev, NULL);
+-	if (IS_ERR(v3d->clk)) {
+-		if (ret != -EPROBE_DEFER)
+-			dev_err(dev, "Failed to get clock\n");
+-		goto dev_free;
++	if (IS_ERR_OR_NULL(v3d->clk)) {
++		if (PTR_ERR(v3d->clk) != -EPROBE_DEFER)
++			dev_err(dev, "Failed to get clock (%ld)\n", PTR_ERR(v3d->clk));
++		return PTR_ERR(v3d->clk);
+ 	}
+ 	v3d->clk_up_rate = clk_get_rate(v3d->clk);
+ 	/* For downclocking, drop it to the minimum frequency we can get from
diff --git a/target/linux/bcm27xx/patches-6.1/950-0211-v3d_gem-Kick-the-clock-so-firmware-knows-we-are-usin.patch b/target/linux/bcm27xx/patches-6.1/950-0211-v3d_gem-Kick-the-clock-so-firmware-knows-we-are-usin.patch
new file mode 100644
index 00000000000000..36bb5f0754f859
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0211-v3d_gem-Kick-the-clock-so-firmware-knows-we-are-usin.patch
@@ -0,0 +1,27 @@
+From b469cfe9fa518d3cea8d21a0416f68db8ea1388d Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Thu, 5 Sep 2019 17:59:14 +0100
+Subject: [PATCH] v3d_gem: Kick the clock so firmware knows we are
+ using firmware clock interface
+
+Setting the v3d clock to low value allows firmware to handle dvfs in case
+where v3d hardware is not being actively used (e.g. console use).
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/v3d/v3d_gem.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/v3d/v3d_gem.c
++++ b/drivers/gpu/drm/v3d/v3d_gem.c
+@@ -1129,6 +1129,10 @@ v3d_gem_init(struct drm_device *dev)
+ 	mutex_init(&v3d->clk_lock);
+ 	INIT_DELAYED_WORK(&v3d->clk_down_work, v3d_clock_down_work);
+ 
++	/* kick the clock so firmware knows we are using firmware clock interface */
++	v3d_clock_up_get(v3d);
++	v3d_clock_up_put(v3d);
++
+ 	/* Note: We don't allocate address 0.  Various bits of HW
+ 	 * treat 0 as special, such as the occlusion query counters
+ 	 * where 0 means "disabled".
diff --git a/target/linux/bcm27xx/patches-6.1/950-0212-clk-raspberrypi-Allow-cpufreq-driver-to-also-adjust-.patch b/target/linux/bcm27xx/patches-6.1/950-0212-clk-raspberrypi-Allow-cpufreq-driver-to-also-adjust-.patch
new file mode 100644
index 00000000000000..fa43d127e49b46
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0212-clk-raspberrypi-Allow-cpufreq-driver-to-also-adjust-.patch
@@ -0,0 +1,25 @@
+From 78e91a068539705806b8456edcc2a6f6a5f79020 Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Mon, 9 Sep 2019 15:49:56 +0100
+Subject: [PATCH] clk-raspberrypi: Allow cpufreq driver to also adjust
+ gpu clocks
+
+For performance/power it is beneficial to adjust gpu clocks with arm clock.
+This is how the downstream cpufreq driver works
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+---
+ drivers/clk/bcm/clk-raspberrypi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/bcm/clk-raspberrypi.c
++++ b/drivers/clk/bcm/clk-raspberrypi.c
+@@ -181,7 +181,7 @@ static int raspberrypi_clock_property(st
+ 	struct raspberrypi_firmware_prop msg = {
+ 		.id = cpu_to_le32(data->id),
+ 		.val = cpu_to_le32(*val),
+-		.disable_turbo = cpu_to_le32(1),
++		.disable_turbo = cpu_to_le32(0),
+ 	};
+ 	int ret;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0213-staging-vchiq_arm-Set-up-dma-ranges-on-child-devices.patch b/target/linux/bcm27xx/patches-6.1/950-0213-staging-vchiq_arm-Set-up-dma-ranges-on-child-devices.patch
new file mode 100644
index 00000000000000..af7a819c19fe2a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0213-staging-vchiq_arm-Set-up-dma-ranges-on-child-devices.patch
@@ -0,0 +1,33 @@
+From a43ba5c6c8751eeb7daf5d6f83caf5a83656721f Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Tue, 29 Jan 2019 16:13:25 +0000
+Subject: [PATCH] staging: vchiq_arm: Set up dma ranges on child
+ devices
+
+The VCHIQ driver now loads the audio, camera, codec, and vc-sm
+drivers as platform drivers. However they were not being given
+the correct DMA configuration.
+
+Call of_dma_configure with the parent (VCHIQ) parameters to be
+inherited by the child.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ .../staging/vc04_services/interface/vchiq_arm/vchiq_arm.c   | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -1784,6 +1784,12 @@ vchiq_register_child(struct platform_dev
+ 		child = NULL;
+ 	}
+ 
++	/*
++	 * We want the dma-ranges etc to be copied from the parent VCHIQ device
++	 * to be passed on to the children too.
++	 */
++	of_dma_configure(&new_dev->dev, pdev->dev.of_node, true);
++
+ 	return child;
+ }
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0214-staging-vchiq-Use-the-old-dma-controller-for-OF-conf.patch b/target/linux/bcm27xx/patches-6.1/950-0214-staging-vchiq-Use-the-old-dma-controller-for-OF-conf.patch
new file mode 100644
index 00000000000000..da049542505cb0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0214-staging-vchiq-Use-the-old-dma-controller-for-OF-conf.patch
@@ -0,0 +1,51 @@
+From d2f86c7e4c8c0e743389f9009e592a8fe03c2f47 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Tue, 18 Jun 2019 12:15:50 +0100
+Subject: [PATCH] staging: vchiq: Use the old dma controller for OF
+ config on platform devices
+
+vchiq on Pi4 is no longer under the soc node, therefore it
+doesn't get the dma-ranges for the VPU.
+
+Switch to using the configuration of the old dma controller as
+that will set the dma-ranges correctly.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ .../interface/vchiq_arm/vchiq_arm.c             | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -1770,6 +1770,7 @@ vchiq_register_child(struct platform_dev
+ {
+ 	struct platform_device_info pdevinfo;
+ 	struct platform_device *child;
++	struct device_node *np;
+ 
+ 	memset(&pdevinfo, 0, sizeof(pdevinfo));
+ 
+@@ -1785,10 +1786,20 @@ vchiq_register_child(struct platform_dev
+ 	}
+ 
+ 	/*
+-	 * We want the dma-ranges etc to be copied from the parent VCHIQ device
+-	 * to be passed on to the children too.
++	 * We want the dma-ranges etc to be copied from a device with the
++	 * correct dma-ranges for the VPU.
++	 * VCHIQ on Pi4 is now under scb which doesn't get those dma-ranges.
++	 * Take the "dma" node as going to be suitable as it sees the world
++	 * through the same eyes as the VPU.
+ 	 */
+-	of_dma_configure(&new_dev->dev, pdev->dev.of_node, true);
++	np = of_find_node_by_path("dma");
++	if (!np)
++		np = pdev->dev.of_node;
++
++	of_dma_configure(&child->dev, np, true);
++
++	if (np != pdev->dev.of_node)
++		of_node_put(np);
+ 
+ 	return child;
+ }
diff --git a/target/linux/bcm27xx/patches-6.1/950-0215-ARM-bcm-Backport-BCM2711-support-from-upstream.patch b/target/linux/bcm27xx/patches-6.1/950-0215-ARM-bcm-Backport-BCM2711-support-from-upstream.patch
new file mode 100644
index 00000000000000..a94071db2289a3
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0215-ARM-bcm-Backport-BCM2711-support-from-upstream.patch
@@ -0,0 +1,47 @@
+From 31344f0801c2b5761ca34fbbd01cde3df947ce45 Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <wahrenst@gmx.net>
+Date: Fri, 27 Dec 2019 11:40:56 +0100
+Subject: [PATCH] ARM: bcm: Backport BCM2711 support from upstream
+
+Make the BCM2711 a different machine, but keep it in board_bcm2835.
+
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+---
+ arch/arm/mach-bcm/board_bcm2835.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mach-bcm/board_bcm2835.c
++++ b/arch/arm/mach-bcm/board_bcm2835.c
+@@ -109,17 +109,30 @@ static const char * const bcm2835_compat
+ #ifdef CONFIG_ARCH_MULTI_V7
+ 	"brcm,bcm2836",
+ 	"brcm,bcm2837",
+-	"brcm,bcm2711",
+ #endif
+ 	NULL
+ };
+ 
+ DT_MACHINE_START(BCM2835, "BCM2835")
++	.map_io = bcm2835_map_io,
++	.init_machine = bcm2835_init,
++	.dt_compat = bcm2835_compat,
++	.smp = smp_ops(bcm2836_smp_ops),
++MACHINE_END
++
++static const char * const bcm2711_compat[] = {
++#ifdef CONFIG_ARCH_MULTI_V7
++	"brcm,bcm2711",
++#endif
++	NULL
++};
++
++DT_MACHINE_START(BCM2711, "BCM2711")
+ #if defined(CONFIG_ZONE_DMA) && defined(CONFIG_ARM_LPAE)
+ 	.dma_zone_size	= SZ_1G,
+ #endif
+ 	.map_io = bcm2835_map_io,
+ 	.init_machine = bcm2835_init,
+-	.dt_compat = bcm2835_compat,
++	.dt_compat = bcm2711_compat,
+ 	.smp = smp_ops(bcm2836_smp_ops),
+ MACHINE_END
diff --git a/target/linux/bcm27xx/patches-6.1/950-0216-Initialise-rpi-firmware-before-clk-bcm2835.patch b/target/linux/bcm27xx/patches-6.1/950-0216-Initialise-rpi-firmware-before-clk-bcm2835.patch
new file mode 100644
index 00000000000000..43781f1256fbb7
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0216-Initialise-rpi-firmware-before-clk-bcm2835.patch
@@ -0,0 +1,47 @@
+From 108084a36931cddaf0227a1771202c73f3411c0b Mon Sep 17 00:00:00 2001
+From: Luke Hinds <7058938+lukehinds@users.noreply.github.com>
+Date: Wed, 22 Jan 2020 16:03:00 +0000
+Subject: [PATCH] Initialise rpi-firmware before clk-bcm2835
+
+The IMA (Integrity Measurement Architecture) looks for a TPM (Trusted
+Platform Module) having been registered when it initialises; otherwise
+it assumes there is no TPM. It has been observed on BCM2835 that IMA
+is initialised before TPM, and that initialising the BCM2835 clock
+driver before the firmware driver has the effect of reversing this
+order.
+
+Change the firmware driver to initialise at core_initcall, delaying the
+BCM2835 clock driver to postcore_initcall.
+
+See: https://github.com/raspberrypi/linux/issues/3291
+     https://github.com/raspberrypi/linux/pull/3297
+
+Signed-off-by: Luke Hinds <lhinds@redhat.com>
+Co-authored-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/clk/bcm/clk-bcm2835.c  | 2 +-
+ drivers/firmware/raspberrypi.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -2438,7 +2438,7 @@ static int __init __bcm2835_clk_driver_i
+ {
+ 	return platform_driver_register(&bcm2835_clk_driver);
+ }
+-core_initcall(__bcm2835_clk_driver_init);
++postcore_initcall(__bcm2835_clk_driver_init);
+ 
+ MODULE_AUTHOR("Eric Anholt <eric@anholt.net>");
+ MODULE_DESCRIPTION("BCM2835 clock driver");
+--- a/drivers/firmware/raspberrypi.c
++++ b/drivers/firmware/raspberrypi.c
+@@ -499,7 +499,7 @@ out2:
+ out1:
+ 	return ret;
+ }
+-subsys_initcall(rpi_firmware_init);
++core_initcall(rpi_firmware_init);
+ 
+ static void __init rpi_firmware_exit(void)
+ {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0217-staging-vchiq_arm-Give-vchiq-children-DT-nodes.patch b/target/linux/bcm27xx/patches-6.1/950-0217-staging-vchiq_arm-Give-vchiq-children-DT-nodes.patch
new file mode 100644
index 00000000000000..7c04307773c161
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0217-staging-vchiq_arm-Give-vchiq-children-DT-nodes.patch
@@ -0,0 +1,39 @@
+From 000b19401cbe6570cde94111ca62212d28c8ef18 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 3 Feb 2020 17:30:46 +0000
+Subject: [PATCH] staging: vchiq_arm: Give vchiq children DT nodes
+
+vchiq kernel clients are now instantiated as platform drivers rather
+than using DT, but the children of the vchiq interface may still
+benefit from access to DT properties. Give them the option of a
+a sub-node of the vchiq parent for configuration and to allow
+them to be disabled.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .../staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -1779,12 +1779,20 @@ vchiq_register_child(struct platform_dev
+ 	pdevinfo.id = PLATFORM_DEVID_NONE;
+ 	pdevinfo.dma_mask = DMA_BIT_MASK(32);
+ 
++	np = of_get_child_by_name(pdev->dev.of_node, name);
++
++	/* Skip the child if it is explicitly disabled */
++	if (np && !of_device_is_available(np))
++		return NULL;
++
+ 	child = platform_device_register_full(&pdevinfo);
+ 	if (IS_ERR(child)) {
+ 		dev_warn(&pdev->dev, "%s not registered\n", name);
+ 		child = NULL;
+ 	}
+ 
++	child->dev.of_node = np;
++
+ 	/*
+ 	 * We want the dma-ranges etc to be copied from a device with the
+ 	 * correct dma-ranges for the VPU.
diff --git a/target/linux/bcm27xx/patches-6.1/950-0218-pinctrl-bcm2835-Remove-gpiochip-on-error.patch b/target/linux/bcm27xx/patches-6.1/950-0218-pinctrl-bcm2835-Remove-gpiochip-on-error.patch
new file mode 100644
index 00000000000000..1c4dd2240298b8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0218-pinctrl-bcm2835-Remove-gpiochip-on-error.patch
@@ -0,0 +1,25 @@
+From ba087b1093294e064be1ac522995a6064c97bb48 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 6 Jan 2020 16:04:30 +0000
+Subject: [PATCH] pinctrl: bcm2835: Remove gpiochip on error
+
+A failure in gpiochip_irqchip_add leads to a leak of a gpiochip. Fix
+the leak with the use of devm_gpiochip_add_data.
+
+Fixes: 85ae9e512f43 ("pinctrl: bcm2835: switch to GPIOLIB_IRQCHIP")
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/pinctrl/bcm/pinctrl-bcm2835.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+@@ -1357,7 +1357,7 @@ static int bcm2835_pinctrl_probe(struct
+ 	girq->default_type = IRQ_TYPE_NONE;
+ 	girq->handler = handle_level_irq;
+ 
+-	err = gpiochip_add_data(&pc->gpio_chip, pc);
++	err = devm_gpiochip_add_data(dev, &pc->gpio_chip, pc);
+ 	if (err) {
+ 		dev_err(dev, "could not add GPIO chip\n");
+ 		goto out_remove;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0219-video-fbdev-bcm2708_fb-Use-common-compat-header.patch b/target/linux/bcm27xx/patches-6.1/950-0219-video-fbdev-bcm2708_fb-Use-common-compat-header.patch
new file mode 100644
index 00000000000000..245977e5147518
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0219-video-fbdev-bcm2708_fb-Use-common-compat-header.patch
@@ -0,0 +1,23 @@
+From b38ff55882fa7a834728238ba040e577e6cfb73a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 2 Mar 2020 14:42:23 +0000
+Subject: [PATCH] video: fbdev: bcm2708_fb: Use common compat header
+
+The definition of compat_ptr is now common for most platforms, but
+requires the inclusion of <linux/compat.h>.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/video/fbdev/bcm2708_fb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/video/fbdev/bcm2708_fb.c
++++ b/drivers/video/fbdev/bcm2708_fb.c
+@@ -38,6 +38,7 @@
+ #include <linux/cred.h>
+ #include <soc/bcm2835/raspberrypi-firmware.h>
+ #include <linux/mutex.h>
++#include <linux/compat.h>
+ 
+ //#define BCM2708_FB_DEBUG
+ #define MODULE_NAME "bcm2708_fb"
diff --git a/target/linux/bcm27xx/patches-6.1/950-0220-of-overlay-Correct-symbol-path-fixups.patch b/target/linux/bcm27xx/patches-6.1/950-0220-of-overlay-Correct-symbol-path-fixups.patch
new file mode 100644
index 00000000000000..c468361349ccde
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0220-of-overlay-Correct-symbol-path-fixups.patch
@@ -0,0 +1,37 @@
+From 70392105bcca68b03649b895bf2d08d409aa9cb0 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 6 Feb 2020 12:23:15 +0000
+Subject: [PATCH] of: overlay: Correct symbol path fixups
+
+When symbols from overlays are added to the live tree their paths must
+be rebased. The translated symbol is normally the result of joining
+the fragment-relative path (with a leading "/") to the target path
+(either copied directly from the "target-path" property or resolved
+from the phandle). This translation fails when the target is the root
+node (a common case for Raspberry Pi overlays) because the resulting
+path starts with a double slash. For example, if target-path is "/" and
+the fragment adds a node called "newnode", the label associated with
+that node will be assigned the path "//newnode", which can't be found
+in the tree.
+
+Fix the failure case by explicitly replacing a target path of "/" with
+an empty string.
+
+Fixes: d1651b03c2df ("of: overlay: add overlay symbols to live device tree")
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/of/overlay.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/of/overlay.c
++++ b/drivers/of/overlay.c
+@@ -241,6 +241,8 @@ static struct property *dup_and_fixup_sy
+ 	if (!target_path)
+ 		return NULL;
+ 	target_path_len = strlen(target_path);
++	if (!strcmp(target_path, "/"))
++		target_path_len = 0;
+ 
+ 	new_prop = kzalloc(sizeof(*new_prop), GFP_KERNEL);
+ 	if (!new_prop)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0221-dt-bindings-pci-Add-DT-docs-for-Brcmstb-PCIe-device.patch b/target/linux/bcm27xx/patches-6.1/950-0221-dt-bindings-pci-Add-DT-docs-for-Brcmstb-PCIe-device.patch
new file mode 100644
index 00000000000000..15380d321ba8ed
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0221-dt-bindings-pci-Add-DT-docs-for-Brcmstb-PCIe-device.patch
@@ -0,0 +1,77 @@
+From a15724a3caab94292cc702a80c386c38e4ce5a25 Mon Sep 17 00:00:00 2001
+From: Jim Quinlan <jim2101024@gmail.com>
+Date: Mon, 15 Jan 2018 18:28:39 -0500
+Subject: [PATCH] dt-bindings: pci: Add DT docs for Brcmstb PCIe device
+
+The DT bindings description of the Brcmstb PCIe device is described.  This
+node can be used by almost all Broadcom settop box chips, using
+ARM, ARM64, or MIPS CPU architectures.
+
+Signed-off-by: Jim Quinlan <jim2101024@gmail.com>
+---
+ .../devicetree/bindings/pci/brcmstb-pcie.txt  | 59 +++++++++++++++++++
+ 1 file changed, 59 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/pci/brcmstb-pcie.txt
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/pci/brcmstb-pcie.txt
+@@ -0,0 +1,59 @@
++Brcmstb PCIe Host Controller Device Tree Bindings
++
++Required Properties:
++- compatible
++  "brcm,bcm7425-pcie" -- for 7425 family MIPS-based SOCs.
++  "brcm,bcm7435-pcie" -- for 7435 family MIPS-based SOCs.
++  "brcm,bcm7445-pcie" -- for 7445 and later ARM based SOCs (not including
++      the 7278).
++  "brcm,bcm7278-pcie"  -- for 7278 family ARM-based SOCs.
++
++- reg -- the register start address and length for the PCIe reg block.
++- interrupts -- two interrupts are specified; the first interrupt is for
++     the PCI host controller and the second is for MSI if the built-in
++     MSI controller is to be used.
++- interrupt-names -- names of the interrupts (above): "pcie" and "msi".
++- #address-cells -- set to <3>.
++- #size-cells -- set to <2>.
++- #interrupt-cells: set to <1>.
++- interrupt-map-mask and interrupt-map, standard PCI properties to define the
++     mapping of the PCIe interface to interrupt numbers.
++- ranges: ranges for the PCI memory and I/O regions.
++- linux,pci-domain -- should be unique per host controller.
++
++Optional Properties:
++- clocks -- phandle of pcie clock.
++- clock-names -- set to "sw_pcie" if clocks is used.
++- dma-ranges -- Specifies the inbound memory mapping regions when
++     an "identity map" is not possible.
++- msi-controller -- this property is typically specified to have the
++     PCIe controller use its internal MSI controller.
++- msi-parent -- set to use an external MSI interrupt controller.
++- brcm,enable-ssc -- (boolean) indicates usage of spread-spectrum clocking.
++- max-link-speed --  (integer) indicates desired generation of link:
++     1 => 2.5 Gbps (gen1), 2 => 5.0 Gbps (gen2), 3 => 8.0 Gbps (gen3).
++
++Example Node:
++
++pcie0: pcie@f0460000 {
++		reg = <0x0 0xf0460000 0x0 0x9310>;
++		interrupts = <0x0 0x0 0x4>;
++		compatible = "brcm,bcm7445-pcie";
++		#address-cells = <3>;
++		#size-cells = <2>;
++		ranges = <0x02000000 0x00000000 0x00000000 0x00000000 0xc0000000 0x00000000 0x08000000
++			  0x02000000 0x00000000 0x08000000 0x00000000 0xc8000000 0x00000000 0x08000000>;
++		#interrupt-cells = <1>;
++		interrupt-map-mask = <0 0 0 7>;
++		interrupt-map = <0 0 0 1 &intc 0 47 3
++				 0 0 0 2 &intc 0 48 3
++				 0 0 0 3 &intc 0 49 3
++				 0 0 0 4 &intc 0 50 3>;
++		clocks = <&sw_pcie0>;
++		clock-names = "sw_pcie";
++		msi-parent = <&pcie0>;  /* use PCIe's internal MSI controller */
++		msi-controller;         /* use PCIe's internal MSI controller */
++		brcm,ssc;
++		max-link-speed = <1>;
++		linux,pci-domain = <0>;
++	};
diff --git a/target/linux/bcm27xx/patches-6.1/950-0222-bcmgenet-Disable-skip_umac_reset-by-default.patch b/target/linux/bcm27xx/patches-6.1/950-0222-bcmgenet-Disable-skip_umac_reset-by-default.patch
new file mode 100644
index 00000000000000..c6090d6d308307
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0222-bcmgenet-Disable-skip_umac_reset-by-default.patch
@@ -0,0 +1,23 @@
+From e7e5f31918f21c512578e3961ebaa786c847fd9e Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Wed, 1 Apr 2020 11:22:44 +0100
+Subject: [PATCH] bcmgenet: Disable skip_umac_reset by default
+
+Possible fixed upstream by 'net: bcmgenet: keep MAC in reset until PHY is up'
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -67,7 +67,7 @@
+ 
+ /* Forward declarations */
+ static void bcmgenet_set_rx_mode(struct net_device *dev);
+-static bool skip_umac_reset = true;
++static bool skip_umac_reset = false;
+ module_param(skip_umac_reset, bool, 0444);
+ MODULE_PARM_DESC(skip_umac_reset, "Skip UMAC reset step");
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0223-media-videodev2.h-Add-a-format-for-column-YUV4-2-0-m.patch b/target/linux/bcm27xx/patches-6.1/950-0223-media-videodev2.h-Add-a-format-for-column-YUV4-2-0-m.patch
new file mode 100644
index 00000000000000..d11d89cde70b1d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0223-media-videodev2.h-Add-a-format-for-column-YUV4-2-0-m.patch
@@ -0,0 +1,309 @@
+From ab5dc4b4c5b36da38adae79ebbc2b9d8e997f49a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 24 Jan 2020 14:28:21 +0000
+Subject: [PATCH] media: videodev2.h: Add a format for column YUV4:2:0
+ modes
+
+Some of the Broadcom codec blocks use a column based YUV4:2:0 image
+format, so add the documentation and defines for both 8 and 10 bit
+versions.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../media/v4l/pixfmt-nv12-col128.rst          | 215 ++++++++++++++++++
+ .../media/v4l/pixfmt-yuv-planar.rst           |  12 +
+ .../userspace-api/media/v4l/yuv-formats.rst   |  19 ++
+ drivers/media/v4l2-core/v4l2-ioctl.c          |   2 +
+ include/uapi/linux/videodev2.h                |   4 +
+ 5 files changed, 252 insertions(+)
+ create mode 100644 Documentation/userspace-api/media/v4l/pixfmt-nv12-col128.rst
+
+--- /dev/null
++++ b/Documentation/userspace-api/media/v4l/pixfmt-nv12-col128.rst
+@@ -0,0 +1,215 @@
++.. Permission is granted to copy, distribute and/or modify this
++.. document under the terms of the GNU Free Documentation License,
++.. Version 1.1 or any later version published by the Free Software
++.. Foundation, with no Invariant Sections, no Front-Cover Texts
++.. and no Back-Cover Texts. A copy of the license is included at
++.. Documentation/media/uapi/fdl-appendix.rst.
++..
++.. TODO: replace it to GFDL-1.1-or-later WITH no-invariant-sections
++
++.. _V4L2_PIX_FMT_NV12_COL128:
++.. _V4L2_PIX_FMT_NV12_10_COL128:
++
++********************************************************************************
++V4L2_PIX_FMT_NV12_COL128, V4L2_PIX_FMT_NV12_10_COL128
++********************************************************************************
++
++
++V4L2_PIX_FMT_NV21_COL128
++Formats with ½ horizontal and vertical chroma resolution. This format
++has two planes - one for luminance and one for chrominance. Chroma
++samples are interleaved. The difference to ``V4L2_PIX_FMT_NV12`` is the
++memory layout. The image is split into columns of 128 bytes wide rather than
++being in raster order.
++
++V4L2_PIX_FMT_NV12_10_COL128
++Follows the same pattern as ``V4L2_PIX_FMT_NV21_COL128`` with 128 byte, but is
++a 10bit format with 3 10-bit samples being packed into 4 bytes. Each 128 byte
++wide column therefore contains 96 samples.
++
++
++Description
++===========
++
++This is the two-plane versions of the YUV 4:2:0 format where data is
++grouped into 128 byte wide columns. The three components are separated into
++two sub-images or planes. The Y plane has one byte per pixel and pixels
++are grouped into 128 byte wide columns. The CbCr plane has the same width,
++in bytes, as the Y plane (and the image), but is half as tall in pixels.
++The chroma plane is also in 128 byte columns, reflecting 64 Cb and 64 Cr
++samples.
++
++The chroma samples for a column follow the luma samples. If there is any
++paddding, then that will be reflected via the selection API.
++The luma height must be a multiple of 2 lines.
++
++The normal bytesperline is effectively fixed at 128. However the format
++requires knowledge of the stride between columns, therefore the bytesperline
++value has been repurposed to denote the number of 128 byte long lines between
++the start of each column.
++
++**Byte Order.**
++
++
++.. flat-table::
++    :header-rows:  0
++    :stub-columns: 0
++    :widths: 12 12 12 12 12 4 12 12 12 12
++
++    * - start + 0:
++      - Y'\ :sub:`0,0`
++      - Y'\ :sub:`0,1`
++      - Y'\ :sub:`0,2`
++      - Y'\ :sub:`0,3`
++      - ...
++      - Y'\ :sub:`0,124`
++      - Y'\ :sub:`0,125`
++      - Y'\ :sub:`0,126`
++      - Y'\ :sub:`0,127`
++    * - start + 128:
++      - Y'\ :sub:`1,0`
++      - Y'\ :sub:`1,1`
++      - Y'\ :sub:`1,2`
++      - Y'\ :sub:`1,3`
++      - ...
++      - Y'\ :sub:`1,124`
++      - Y'\ :sub:`1,125`
++      - Y'\ :sub:`1,126`
++      - Y'\ :sub:`1,127`
++    * - start + 256:
++      - Y'\ :sub:`2,0`
++      - Y'\ :sub:`2,1`
++      - Y'\ :sub:`2,2`
++      - Y'\ :sub:`2,3`
++      - ...
++      - Y'\ :sub:`2,124`
++      - Y'\ :sub:`2,125`
++      - Y'\ :sub:`2,126`
++      - Y'\ :sub:`2,127`
++    * - ...
++      - ...
++      - ...
++      - ...
++      - ...
++      - ...
++      - ...
++      - ...
++    * - start + ((height-1) * 128):
++      - Y'\ :sub:`height-1,0`
++      - Y'\ :sub:`height-1,1`
++      - Y'\ :sub:`height-1,2`
++      - Y'\ :sub:`height-1,3`
++      - ...
++      - Y'\ :sub:`height-1,124`
++      - Y'\ :sub:`height-1,125`
++      - Y'\ :sub:`height-1,126`
++      - Y'\ :sub:`height-1,127`
++    * - start + ((height) * 128):
++      - Cb\ :sub:`0,0`
++      - Cr\ :sub:`0,0`
++      - Cb\ :sub:`0,1`
++      - Cr\ :sub:`0,1`
++      - ...
++      - Cb\ :sub:`0,62`
++      - Cr\ :sub:`0,62`
++      - Cb\ :sub:`0,63`
++      - Cr\ :sub:`0,63`
++    * - start + ((height+1) * 128):
++      - Cb\ :sub:`1,0`
++      - Cr\ :sub:`1,0`
++      - Cb\ :sub:`1,1`
++      - Cr\ :sub:`1,1`
++      - ...
++      - Cb\ :sub:`1,62`
++      - Cr\ :sub:`1,62`
++      - Cb\ :sub:`1,63`
++      - Cr\ :sub:`1,63`
++    * - ...
++      - ...
++      - ...
++      - ...
++      - ...
++      - ...
++      - ...
++      - ...
++    * - start + ((height+(height/2)-1) * 128):
++      - Cb\ :sub:`(height/2)-1,0`
++      - Cr\ :sub:`(height/2)-1,0`
++      - Cb\ :sub:`(height/2)-1,1`
++      - Cr\ :sub:`(height/2)-1,1`
++      - ...
++      - Cb\ :sub:`(height/2)-1,62`
++      - Cr\ :sub:`(height/2)-1,62`
++      - Cb\ :sub:`(height/2)-1,63`
++      - Cr\ :sub:`(height/2)-1,63`
++    * - start + (bytesperline * 128):
++      - Y'\ :sub:`0,128`
++      - Y'\ :sub:`0,129`
++      - Y'\ :sub:`0,130`
++      - Y'\ :sub:`0,131`
++      - ...
++      - Y'\ :sub:`0,252`
++      - Y'\ :sub:`0,253`
++      - Y'\ :sub:`0,254`
++      - Y'\ :sub:`0,255`
++    * - ...
++      - ...
++      - ...
++      - ...
++      - ...
++      - ...
++      - ...
++      - ...
++
++V4L2_PIX_FMT_NV12_10_COL128 uses the same 128 byte column structure, but
++encodes 10-bit YUV.
++3 10-bit values are packed into 4 bytes as bits 9:0, 19:10, and 29:20, with
++bits 30 & 31 unused. For the luma plane, bits 9:0 are Y0, 19:10 are Y1, and
++29:20 are Y2. For the chroma plane the samples always come in pairs of Cr
++and Cb, so it needs to be considered 6 values packed in 8 bytes.
++
++Bit-packed representation.
++
++.. raw:: latex
++
++    \small
++
++.. tabularcolumns:: |p{1.2cm}||p{1.2cm}||p{1.2cm}||p{1.2cm}|p{3.2cm}|p{3.2cm}|
++
++.. flat-table::
++    :header-rows:  0
++    :stub-columns: 0
++    :widths: 8 8 8 8
++
++    * - Y'\ :sub:`00[7:0]`
++      - Y'\ :sub:`01[5:0] (bits 7--2)` Y'\ :sub:`00[9:8]`\ (bits 1--0)
++      - Y'\ :sub:`02[3:0] (bits 7--4)` Y'\ :sub:`01[9:6]`\ (bits 3--0)
++      - unused (bits 7--6)` Y'\ :sub:`02[9:4]`\ (bits 5--0)
++
++.. raw:: latex
++
++    \small
++
++.. tabularcolumns:: |p{1.2cm}||p{1.2cm}||p{1.2cm}||p{1.2cm}|p{3.2cm}|p{3.2cm}|
++
++.. flat-table::
++    :header-rows:  0
++    :stub-columns: 0
++    :widths: 12 12 12 12 12 12 12 12
++
++    * - Cb\ :sub:`00[7:0]`
++      - Cr\ :sub:`00[5:0]`\ (bits 7--2) Cb\ :sub:`00[9:8]`\ (bits 1--0)
++      - Cb\ :sub:`01[3:0]`\ (bits 7--4) Cr\ :sub:`00[9:6]`\ (bits 3--0)
++      - unused (bits 7--6) Cb\ :sub:`02[9:4]`\ (bits 5--0)
++      - Cr\ :sub:`01[7:0]`
++      - Cb\ :sub:`02[5:0]`\ (bits 7--2) Cr\ :sub:`01[9:8]`\ (bits 1--0)
++      - Cr\ :sub:`02[3:0]`\ (bits 7--4) Cb\ :sub:`02[9:6]`\ (bits 3--0)
++      - unused (bits 7--6) Cr\ :sub:`02[9:4]`\ (bits 5--0)
++
++.. raw:: latex
++
++    \normalsize
++
++
++
++
+--- a/Documentation/userspace-api/media/v4l/pixfmt-yuv-planar.rst
++++ b/Documentation/userspace-api/media/v4l/pixfmt-yuv-planar.rst
+@@ -579,6 +579,18 @@ Data in the 10 high bits, zeros in the 6
+       - Cr\ :sub:`11`
+ 
+ 
++V4L2_PIX_FMT_NV12_COL128
++------------------------
++
++``V4L2_PIX_FMT_NV12_COL128`` is the tiled version of
++``V4L2_PIX_FMT_NV12`` with the image broken down into 128 pixel wide columns of
++Y followed by the associated combined CbCr plane.
++The normal bytesperline is effectively fixed at 128. However the format
++requires knowledge of the stride between columns, therefore the bytesperline
++value has been repurposed to denote the number of 128 byte long lines between
++the start of each column.
++
++
+ Fully Planar YUV Formats
+ ========================
+ 
+--- a/Documentation/userspace-api/media/v4l/yuv-formats.rst
++++ b/Documentation/userspace-api/media/v4l/yuv-formats.rst
+@@ -270,4 +270,23 @@ image.
+     pixfmt-y8i
+     pixfmt-y12i
+     pixfmt-uv8
++    pixfmt-yuyv
++    pixfmt-uyvy
++    pixfmt-yvyu
++    pixfmt-vyuy
++    pixfmt-y41p
++    pixfmt-yuv420
++    pixfmt-yuv420m
++    pixfmt-yuv422m
++    pixfmt-yuv444m
++    pixfmt-yuv410
++    pixfmt-yuv422p
++    pixfmt-yuv411p
++    pixfmt-nv12
++    pixfmt-nv12m
++    pixfmt-nv12mt
++    pixfmt-nv12-col128
++    pixfmt-nv16
++    pixfmt-nv16m
++    pixfmt-nv24
+     pixfmt-m420
+--- a/drivers/media/v4l2-core/v4l2-ioctl.c
++++ b/drivers/media/v4l2-core/v4l2-ioctl.c
+@@ -1364,6 +1364,8 @@ static void v4l_fill_fmtdesc(struct v4l2
+ 	case V4L2_PIX_FMT_NV61M:	descr = "Y/VU 4:2:2 (N-C)"; break;
+ 	case V4L2_PIX_FMT_NV12MT:	descr = "Y/UV 4:2:0 (64x32 MB, N-C)"; break;
+ 	case V4L2_PIX_FMT_NV12MT_16X16:	descr = "Y/UV 4:2:0 (16x16 MB, N-C)"; break;
++	case V4L2_PIX_FMT_NV12_COL128:  descr = "Y/CbCr 4:2:0 (128b cols)"; break;
++	case V4L2_PIX_FMT_NV12_10_COL128: descr = "10-bit Y/CbCr 4:2:0 (128b cols)"; break;
+ 	case V4L2_PIX_FMT_YUV420M:	descr = "Planar YUV 4:2:0 (N-C)"; break;
+ 	case V4L2_PIX_FMT_YVU420M:	descr = "Planar YVU 4:2:0 (N-C)"; break;
+ 	case V4L2_PIX_FMT_YUV422M:	descr = "Planar YUV 4:2:2 (N-C)"; break;
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -780,6 +780,10 @@ struct v4l2_pix_format {
+ #define V4L2_PIX_FMT_HI240    v4l2_fourcc('H', 'I', '2', '4') /* BTTV 8-bit dithered RGB */
+ #define V4L2_PIX_FMT_QC08C    v4l2_fourcc('Q', '0', '8', 'C') /* Qualcomm 8-bit compressed */
+ #define V4L2_PIX_FMT_QC10C    v4l2_fourcc('Q', '1', '0', 'C') /* Qualcomm 10-bit compressed */
++#define V4L2_PIX_FMT_NV12_COL128 v4l2_fourcc('N', 'C', '1', '2') /* 12  Y/CbCr 4:2:0 128 pixel wide column */
++#define V4L2_PIX_FMT_NV12_10_COL128 v4l2_fourcc('N', 'C', '3', '0')
++								/* Y/CbCr 4:2:0 10bpc, 3x10 packed as 4 bytes in
++								 * a 128 bytes / 96 pixel wide column */
+ 
+ /* 10bit raw packed, 32 bytes for every 25 pixels, last LSB 6 bits unused */
+ #define V4L2_PIX_FMT_IPU3_SBGGR10	v4l2_fourcc('i', 'p', '3', 'b') /* IPU3 packed 10-bit BGGR bayer */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0224-media-dt-bindings-media-Add-binding-for-the-Raspberr.patch b/target/linux/bcm27xx/patches-6.1/950-0224-media-dt-bindings-media-Add-binding-for-the-Raspberr.patch
new file mode 100644
index 00000000000000..d6f55c970370c1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0224-media-dt-bindings-media-Add-binding-for-the-Raspberr.patch
@@ -0,0 +1,106 @@
+From bdca460ca8b307202f3942df5c8c45e37a6e20df Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 17 Mar 2020 10:53:16 +0000
+Subject: [PATCH] media: dt-bindings: media: Add binding for the
+ Raspberry PI HEVC decoder
+
+Adds a binding for the HEVC decoder found on the BCM2711 / Raspberry Pi 4.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../bindings/media/rpivid_hevc.yaml           | 72 +++++++++++++++++++
+ MAINTAINERS                                   |  7 ++
+ 2 files changed, 79 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/rpivid_hevc.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/rpivid_hevc.yaml
+@@ -0,0 +1,72 @@
++# SPDX-License-Identifier: GPL-2.0-only
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/media/rpivid_hevc.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Raspberry Pi HEVC Decoder
++
++maintainers:
++  - Raspberry Pi <kernel-list@raspberrypi.com>
++
++description: |-
++  The Camera Adaptation Layer (CAL) is a key component for image capture
++  applications. The capture module provides the system interface and the
++  processing capability to connect CSI2 image-sensor modules to the
++  DRA72x device.
++
++properties:
++  compatible:
++    enum:
++      - raspberrypi,rpivid-vid-decoder
++
++  reg:
++    minItems: 2
++    items:
++      - description: The HEVC main register region
++      - description: The Interrupt controller register region
++
++  reg-names:
++    minItems: 2
++    items:
++      - const: hevc
++      - const: intc
++
++  interrupts:
++    maxItems: 1
++
++  clocks:
++    items:
++      - description: The HEVC block clock
++
++  clock-names:
++    items:
++      - const: hevc
++
++required:
++  - compatible
++  - reg
++  - reg-names
++  - interrupts
++  - clocks
++
++additionalProperties: false
++
++examples:
++  - |
++    #include <dt-bindings/interrupt-controller/arm-gic.h>
++
++    video-codec@7eb10000 {
++        compatible = "raspberrypi,rpivid-vid-decoder";
++        reg = <0x0 0x7eb10000 0x1000>,	/* INTC */
++              <0x0 0x7eb00000 0x10000>; /* HEVC */
++        reg-names = "intc",
++                    "hevc";
++
++        interrupts = <GIC_SPI 98 IRQ_TYPE_LEVEL_HIGH>;
++
++        clocks = <&clk 0>;
++        clock-names = "hevc";
++    };
++
++...
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -4030,6 +4030,13 @@ N:	bcm113*
+ N:	bcm216*
+ N:	kona
+ 
++BROADCOM BCM2711 HEVC DECODER
++M:	Raspberry Pi Kernel Maintenance <kernel-list@raspberrypi.com>
++L:	linux-media@vger.kernel.org
++S:	Maintained
++F:	Documentation/devicetree/bindings/media/rpivid_hevc.jaml
++F:	drivers/staging/media/rpivid
++
+ BROADCOM BCM2835 CAMERA DRIVER
+ M:	Dave Stevenson <dave.stevenson@raspberrypi.org>
+ L:	linux-media@vger.kernel.org
diff --git a/target/linux/bcm27xx/patches-6.1/950-0225-RFC-media-Add-media_request_-pin-unpin-API.patch b/target/linux/bcm27xx/patches-6.1/950-0225-RFC-media-Add-media_request_-pin-unpin-API.patch
new file mode 100644
index 00000000000000..85b07eb5df2b67
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0225-RFC-media-Add-media_request_-pin-unpin-API.patch
@@ -0,0 +1,94 @@
+From 88aca1377f55f0cf1eab46731a77a459724a920d Mon Sep 17 00:00:00 2001
+From: Ezequiel Garcia <ezequiel@collabora.com>
+Date: Sun, 21 Mar 2021 16:38:54 -0300
+Subject: [PATCH] RFC: media: Add media_request_{pin,unpin} API
+
+This is probably not the API we will want to add, but it
+should show what semantics are needed by drivers.
+
+The goal is to allow the OUTPUT (aka source) buffer and the
+controls associated to a request to be released from the request,
+and in particular return the OUTPUT buffer back to userspace,
+without signalling the media request fd.
+
+This is useful for devices that are able to pre-process
+the OUTPUT buffer, therefore able to release it before
+the decoding is finished. These drivers should signal
+the media request fd only after the CAPTURE buffer is done.
+
+Tested-by: John Cox <jc@kynesim.co.uk>
+Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
+---
+ drivers/media/mc/mc-request.c | 35 +++++++++++++++++++++++++++++++++++
+ include/media/media-request.h | 12 ++++++++++++
+ 2 files changed, 47 insertions(+)
+
+--- a/drivers/media/mc/mc-request.c
++++ b/drivers/media/mc/mc-request.c
+@@ -505,3 +505,38 @@ unlock:
+ 		media_request_put(req);
+ }
+ EXPORT_SYMBOL_GPL(media_request_object_complete);
++
++void media_request_pin(struct media_request *req)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&req->lock, flags);
++	if (WARN_ON(req->state != MEDIA_REQUEST_STATE_QUEUED))
++		goto unlock;
++	req->num_incomplete_objects++;
++unlock:
++	spin_unlock_irqrestore(&req->lock, flags);
++}
++EXPORT_SYMBOL_GPL(media_request_pin);
++
++void media_request_unpin(struct media_request *req)
++{
++	unsigned long flags;
++	bool completed = false;
++
++	spin_lock_irqsave(&req->lock, flags);
++	if (WARN_ON(!req->num_incomplete_objects) ||
++	    WARN_ON(req->state != MEDIA_REQUEST_STATE_QUEUED))
++		goto unlock;
++
++	if (!--req->num_incomplete_objects) {
++		req->state = MEDIA_REQUEST_STATE_COMPLETE;
++		wake_up_interruptible_all(&req->poll_wait);
++		completed = true;
++	}
++unlock:
++	spin_unlock_irqrestore(&req->lock, flags);
++	if (completed)
++		media_request_put(req);
++}
++EXPORT_SYMBOL_GPL(media_request_unpin);
+--- a/include/media/media-request.h
++++ b/include/media/media-request.h
+@@ -189,6 +189,10 @@ static inline void media_request_get(str
+  */
+ void media_request_put(struct media_request *req);
+ 
++void media_request_pin(struct media_request *req);
++
++void media_request_unpin(struct media_request *req);
++
+ /**
+  * media_request_get_by_fd - Get a media request by fd
+  *
+@@ -228,6 +232,14 @@ static inline void media_request_put(str
+ {
+ }
+ 
++static inline void media_request_pin(struct media_request *req)
++{
++}
++
++static inline void media_request_unpin(struct media_request *req)
++{
++}
++
+ static inline struct media_request *
+ media_request_get_by_fd(struct media_device *mdev, int request_fd)
+ {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0226-staging-media-rpivid-Add-Raspberry-Pi-V4L2-H265-deco.patch b/target/linux/bcm27xx/patches-6.1/950-0226-staging-media-rpivid-Add-Raspberry-Pi-V4L2-H265-deco.patch
new file mode 100644
index 00000000000000..d556b19fad4ab0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0226-staging-media-rpivid-Add-Raspberry-Pi-V4L2-H265-deco.patch
@@ -0,0 +1,5238 @@
+From 359a25fe7208803d997488a96714c19e84b74f96 Mon Sep 17 00:00:00 2001
+From: John Cox <jc@kynesim.co.uk>
+Date: Thu, 5 Mar 2020 18:30:41 +0000
+Subject: [PATCH] staging: media: rpivid: Add Raspberry Pi V4L2 H265
+ decoder
+
+This driver is for the HEVC/H265 decoder block on the Raspberry
+Pi 4, and conforms to the V4L2 stateless decoder API.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+staging: media: rpivid: Select MEDIA_CONTROLLER and MEDIA_CONTROLLER_REQUEST_API
+
+MEDIA_CONTROLLER_REQUEST_API is a hidden option. If rpivid depends on it,
+the user would need to first enable another driver that selects
+MEDIA_CONTROLLER_REQUEST_API, and only then rpivid would become available.
+
+By selecting it instead of depending on it, it becomes possible to enable
+rpivid without having to enable other potentially unnecessary drivers.
+
+Signed-off-by: Hristo Venev <hristo@venev.name>
+
+rpivid_h265: Fix width/height typo
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+
+rpivid_h625: Fix build warnings
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+staging: rpivid: Fix crash when CMA alloc fails
+
+If realloc to increase coeff size fails then attempt to re-allocate
+the original size.  If that also fails then flag a fatal error to abort
+all further decode.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+rpivid: Request maximum hevc clock
+
+Query maximum and minimum clock from driver
+and use those
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+rpivid: Switch to new clock api
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+rpivid: Only clk_request_done once
+
+Fixes: 25486f49bfe2e3ae13b90478d1eebd91413136ad
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+media: rpivid: Remove the need to have num_entry_points set
+
+VAAPI H265 has num entry points but never sets it. Allow a VAAPI
+shim to work without requiring rewriting the VAAPI driver.
+num_entry_points can be calculated from the slice_segment_addr
+of the next slice so delay processing until we have that.
+
+Also includes some minor cosmetics.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Convert to MPLANE
+
+Use multi-planar interface rather than single plane interface. This
+allows dmabufs holding compressed data to be resized.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Add an enable count to irq claim Qs
+
+Add an enable count to the irq Q structures to allow the irq logic to
+block further callbacks if resources associated with the irq are not
+yet available.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Add a Pass0 to accumulate slices and rework job finish
+
+Due to overheads in assembling controls and requests it is worth having
+the slice assembly phase separate from the h/w pass1 processing. Create
+a queue to service pass1 rather than have the pass1 finished callback
+trigger the next slice job.
+
+This requires a rework of the logic that splits up the buffer and
+request done events. This code contains two ways of doing that, we use
+Ezequiel Garcias <ezequiel@collabora.com> solution, but expect that
+in the future this will be handled by the framework in a cleaner manner.
+
+Fix up the handling of some of the memory exhaustion crashes uncovered
+in the process of writing this code.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Map cmd buffer directly
+
+It is unnecessary to have a separate dmabuf to hold the cmd buffer.
+Map it directly from the kmalloc.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Improve values returned when setting output format
+
+Guess a better value for the compressed bitstream buffer size
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Improve stream_on/off conformance & clock setup
+
+Fix stream on & off such that failures leave the driver in the correct
+state.  Ensure that the clock is on when we are streaming and off when
+all contexts attached to this device have stopped streaming.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Improve SPS/PPS error handling/validation
+
+Move size and width checking from bitstream processing to control
+validation
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Fix H265 aux ent reuse of the same slot
+
+It is legitimate, though unusual, for an aux ent associated with a slot
+to be selected in phase 0 before a previous selection has been used and
+released in phase 2. Fix such that if the slot is found to be in use
+that the aux ent associated with it is reused rather than an new aux
+ent being created. This fixes a problem where when the first aux ent
+was released the second was lost track of.
+
+This bug spotted in Nick's testing. It may explain some other occasional,
+unreliable decode error reports where dmesg included "Missing DPB AUX
+ent" logging.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Update to compile with new hevc decode params
+
+DPB entries have moved from slice params to the new decode params
+attribute - update to deal with this.  Also fixes fallthrough
+warnings which seem to be new in 5.14.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Make slice ctrl dynamic
+
+Allows the user to submit a whole frames worth of slice headers in
+one lump along with a single bitstream dmabuf for the whole lot.
+This saves potentially a lot of bitstream copying.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Only create aux entries for H265 if needed
+
+Only create aux entries of mv info for frames where that info might
+be used by a later frame.  This saves some memory bandwidth and
+potentially some memory.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Avoid returning EINVAL to a G_FMT ioctl
+
+V4L2 spec says that G/S/TRY_FMT IOCTLs should never return errors for
+anything other than wrong buffer types. Improve the capture format
+function such that this is so and unsupported values get converted
+to supported ones properly.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Remove unused ctx state variable and defines
+
+Remove unused ctx state tracking variable and associated defines.
+Their presence implies they might be used, but they aren't.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Ensure IRQs have completed before uniniting context
+
+Before uniniting the decode context sync with the IRQ queues to ensure
+that decode no longer has any buffers in use.  This fixes a problem that
+manifested as ffmpeg leaking CMA buffers when it did a stream off on
+OUTPUT before CAPTURE, though in reality it was probably much more
+dangerous than that.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: remove min_buffers_needed from src queue
+
+Remove min_buffers_needed=1 from src queue init. Src buffers are bound
+to media requests therefore this setting is not needed and generates
+a WARN in kernel 5.16.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+rpivid: Use clk_get_max_rate()
+
+The driver was using clk_round_rate() to figure out the maximum clock
+rate that was allowed for the HEVC clock.
+
+Since we have a function to return it directly now, let's use it.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+
+media: rpivid: Apply V4L2 stateless API changes
+
+media: rpivid: Fix fallthrough warning
+
+Replace old-style /* FALLTHRU */ with fallthrough;
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Set min value as well as max for HEVC_DECODE_MODE
+
+As only one value can be accepted set both min and max to that value.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Accept ANNEX_B start codes
+
+Allow the START_CODE control to take ANNEX_B as a value. This makes no
+difference to any part of the decode process as the added bytes are in
+data that we ignore. This helps my testing and may help userland code
+that expects to send those bytes.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+rpivid: Convert to new clock rate API
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/media/v4l2-core/v4l2-mem2mem.c      |    2 -
+ drivers/staging/media/Kconfig               |    2 +
+ drivers/staging/media/Makefile              |    2 +-
+ drivers/staging/media/rpivid/Kconfig        |   16 +
+ drivers/staging/media/rpivid/Makefile       |    5 +
+ drivers/staging/media/rpivid/rpivid.c       |  459 ++++
+ drivers/staging/media/rpivid/rpivid.h       |  203 ++
+ drivers/staging/media/rpivid/rpivid_dec.c   |   96 +
+ drivers/staging/media/rpivid/rpivid_dec.h   |   19 +
+ drivers/staging/media/rpivid/rpivid_h265.c  | 2698 +++++++++++++++++++
+ drivers/staging/media/rpivid/rpivid_hw.c    |  383 +++
+ drivers/staging/media/rpivid/rpivid_hw.h    |  303 +++
+ drivers/staging/media/rpivid/rpivid_video.c |  696 +++++
+ drivers/staging/media/rpivid/rpivid_video.h |   33 +
+ 14 files changed, 4914 insertions(+), 3 deletions(-)
+ create mode 100644 drivers/staging/media/rpivid/Kconfig
+ create mode 100644 drivers/staging/media/rpivid/Makefile
+ create mode 100644 drivers/staging/media/rpivid/rpivid.c
+ create mode 100644 drivers/staging/media/rpivid/rpivid.h
+ create mode 100644 drivers/staging/media/rpivid/rpivid_dec.c
+ create mode 100644 drivers/staging/media/rpivid/rpivid_dec.h
+ create mode 100644 drivers/staging/media/rpivid/rpivid_h265.c
+ create mode 100644 drivers/staging/media/rpivid/rpivid_hw.c
+ create mode 100644 drivers/staging/media/rpivid/rpivid_hw.h
+ create mode 100644 drivers/staging/media/rpivid/rpivid_video.c
+ create mode 100644 drivers/staging/media/rpivid/rpivid_video.h
+
+--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
++++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
+@@ -492,8 +492,6 @@ void v4l2_m2m_job_finish(struct v4l2_m2m
+ 	 * holding capture buffers. Those should use
+ 	 * v4l2_m2m_buf_done_and_job_finish() instead.
+ 	 */
+-	WARN_ON(m2m_ctx->out_q_ctx.q.subsystem_flags &
+-		VB2_V4L2_FL_SUPPORTS_M2M_HOLD_CAPTURE_BUF);
+ 	spin_lock_irqsave(&m2m_dev->job_spinlock, flags);
+ 	schedule_next = _v4l2_m2m_job_finish(m2m_dev, m2m_ctx);
+ 	spin_unlock_irqrestore(&m2m_dev->job_spinlock, flags);
+--- a/drivers/staging/media/Kconfig
++++ b/drivers/staging/media/Kconfig
+@@ -34,6 +34,8 @@ source "drivers/staging/media/omap4iss/K
+ 
+ source "drivers/staging/media/rkvdec/Kconfig"
+ 
++source "drivers/staging/media/rpivid/Kconfig"
++
+ source "drivers/staging/media/sunxi/Kconfig"
+ 
+ source "drivers/staging/media/tegra-video/Kconfig"
+--- a/drivers/staging/media/Makefile
++++ b/drivers/staging/media/Makefile
+@@ -7,7 +7,7 @@ obj-$(CONFIG_VIDEO_MESON_VDEC)	+= meson/
+ obj-$(CONFIG_VIDEO_MEYE)	+= deprecated/meye/
+ obj-$(CONFIG_VIDEO_OMAP4)	+= omap4iss/
+ obj-$(CONFIG_VIDEO_ROCKCHIP_VDEC)	+= rkvdec/
+-obj-$(CONFIG_VIDEO_STKWEBCAM)	+= deprecated/stkwebcam/
++obj-$(CONFIG_VIDEO_RPIVID)	+= rpivid/
+ obj-$(CONFIG_VIDEO_SUNXI)	+= sunxi/
+ obj-$(CONFIG_VIDEO_TEGRA)	+= tegra-video/
+ obj-$(CONFIG_VIDEO_IPU3_IMGU)	+= ipu3/
+--- /dev/null
++++ b/drivers/staging/media/rpivid/Kconfig
+@@ -0,0 +1,16 @@
++# SPDX-License-Identifier: GPL-2.0
++
++config VIDEO_RPIVID
++	tristate "Rpi H265 driver"
++	depends on VIDEO_DEV && VIDEO_DEV
++	depends on OF
++	select MEDIA_CONTROLLER
++	select MEDIA_CONTROLLER_REQUEST_API
++	select VIDEOBUF2_DMA_CONTIG
++	select V4L2_MEM2MEM_DEV
++	help
++	  Support for the Rpi H265 h/w decoder.
++
++	  To compile this driver as a module, choose M here: the module
++	  will be called rpivid-hevc.
++
+--- /dev/null
++++ b/drivers/staging/media/rpivid/Makefile
+@@ -0,0 +1,5 @@
++# SPDX-License-Identifier: GPL-2.0
++obj-$(CONFIG_VIDEO_RPIVID) += rpivid-hevc.o
++
++rpivid-hevc-y = rpivid.o rpivid_video.o rpivid_dec.o \
++		 rpivid_hw.o rpivid_h265.o
+--- /dev/null
++++ b/drivers/staging/media/rpivid/rpivid.c
+@@ -0,0 +1,459 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Raspberry Pi HEVC driver
++ *
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ *
++ * Based on the Cedrus VPU driver, that is:
++ *
++ * Copyright (C) 2016 Florent Revest <florent.revest@free-electrons.com>
++ * Copyright (C) 2018 Paul Kocialkowski <paul.kocialkowski@bootlin.com>
++ * Copyright (C) 2018 Bootlin
++ */
++
++#include <linux/platform_device.h>
++#include <linux/module.h>
++#include <linux/of.h>
++
++#include <media/v4l2-device.h>
++#include <media/v4l2-ioctl.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-mem2mem.h>
++
++#include "rpivid.h"
++#include "rpivid_video.h"
++#include "rpivid_hw.h"
++#include "rpivid_dec.h"
++
++/*
++ * Default /dev/videoN node number.
++ * Deliberately avoid the very low numbers as these are often taken by webcams
++ * etc, and simple apps tend to only go for /dev/video0.
++ */
++static int video_nr = 19;
++module_param(video_nr, int, 0644);
++MODULE_PARM_DESC(video_nr, "decoder video device number");
++
++static const struct rpivid_control rpivid_ctrls[] = {
++	{
++		.cfg = {
++			.id	= V4L2_CID_STATELESS_HEVC_SPS,
++			.ops	= &rpivid_hevc_sps_ctrl_ops,
++		},
++		.required	= true,
++	},
++	{
++		.cfg = {
++			.id	= V4L2_CID_STATELESS_HEVC_PPS,
++			.ops	= &rpivid_hevc_pps_ctrl_ops,
++		},
++		.required	= true,
++	},
++	{
++		.cfg = {
++			.id = V4L2_CID_STATELESS_HEVC_SCALING_MATRIX,
++		},
++		.required	= false,
++	},
++	{
++		.cfg = {
++			.id	= V4L2_CID_STATELESS_HEVC_DECODE_PARAMS,
++		},
++		.required	= true,
++	},
++	{
++		.cfg = {
++			.name	= "Slice param array",
++			.id	= V4L2_CID_STATELESS_HEVC_SLICE_PARAMS,
++			.type	= V4L2_CTRL_TYPE_HEVC_SLICE_PARAMS,
++			.flags	= V4L2_CTRL_FLAG_DYNAMIC_ARRAY,
++			.dims	= { 0x1000 },
++		},
++		.required	= true,
++	},
++	{
++		.cfg = {
++			.id	= V4L2_CID_STATELESS_HEVC_DECODE_MODE,
++			.min	= V4L2_STATELESS_HEVC_DECODE_MODE_SLICE_BASED,
++			.max	= V4L2_STATELESS_HEVC_DECODE_MODE_SLICE_BASED,
++			.def	= V4L2_STATELESS_HEVC_DECODE_MODE_SLICE_BASED,
++		},
++		.required	= false,
++	},
++	{
++		.cfg = {
++			.id	= V4L2_CID_STATELESS_HEVC_START_CODE,
++			.min	= V4L2_STATELESS_HEVC_START_CODE_NONE,
++			.max	= V4L2_STATELESS_HEVC_START_CODE_ANNEX_B,
++			.def	= V4L2_STATELESS_HEVC_START_CODE_NONE,
++		},
++		.required	= false,
++	},
++};
++
++#define rpivid_ctrls_COUNT	ARRAY_SIZE(rpivid_ctrls)
++
++struct v4l2_ctrl *rpivid_find_ctrl(struct rpivid_ctx *ctx, u32 id)
++{
++	unsigned int i;
++
++	for (i = 0; ctx->ctrls[i]; i++)
++		if (ctx->ctrls[i]->id == id)
++			return ctx->ctrls[i];
++
++	return NULL;
++}
++
++void *rpivid_find_control_data(struct rpivid_ctx *ctx, u32 id)
++{
++	struct v4l2_ctrl *const ctrl = rpivid_find_ctrl(ctx, id);
++
++	return !ctrl ? NULL : ctrl->p_cur.p;
++}
++
++static int rpivid_init_ctrls(struct rpivid_dev *dev, struct rpivid_ctx *ctx)
++{
++	struct v4l2_ctrl_handler *hdl = &ctx->hdl;
++	struct v4l2_ctrl *ctrl;
++	unsigned int ctrl_size;
++	unsigned int i;
++
++	v4l2_ctrl_handler_init(hdl, rpivid_ctrls_COUNT);
++	if (hdl->error) {
++		v4l2_err(&dev->v4l2_dev,
++			 "Failed to initialize control handler\n");
++		return hdl->error;
++	}
++
++	ctrl_size = sizeof(ctrl) * rpivid_ctrls_COUNT + 1;
++
++	ctx->ctrls = kzalloc(ctrl_size, GFP_KERNEL);
++	if (!ctx->ctrls)
++		return -ENOMEM;
++
++	for (i = 0; i < rpivid_ctrls_COUNT; i++) {
++		ctrl = v4l2_ctrl_new_custom(hdl, &rpivid_ctrls[i].cfg,
++					    ctx);
++		if (hdl->error) {
++			v4l2_err(&dev->v4l2_dev,
++				 "Failed to create new custom control id=%#x\n",
++				 rpivid_ctrls[i].cfg.id);
++
++			v4l2_ctrl_handler_free(hdl);
++			kfree(ctx->ctrls);
++			return hdl->error;
++		}
++
++		ctx->ctrls[i] = ctrl;
++	}
++
++	ctx->fh.ctrl_handler = hdl;
++	v4l2_ctrl_handler_setup(hdl);
++
++	return 0;
++}
++
++static int rpivid_request_validate(struct media_request *req)
++{
++	struct media_request_object *obj;
++	struct v4l2_ctrl_handler *parent_hdl, *hdl;
++	struct rpivid_ctx *ctx = NULL;
++	struct v4l2_ctrl *ctrl_test;
++	unsigned int count;
++	unsigned int i;
++
++	list_for_each_entry(obj, &req->objects, list) {
++		struct vb2_buffer *vb;
++
++		if (vb2_request_object_is_buffer(obj)) {
++			vb = container_of(obj, struct vb2_buffer, req_obj);
++			ctx = vb2_get_drv_priv(vb->vb2_queue);
++
++			break;
++		}
++	}
++
++	if (!ctx)
++		return -ENOENT;
++
++	count = vb2_request_buffer_cnt(req);
++	if (!count) {
++		v4l2_info(&ctx->dev->v4l2_dev,
++			  "No buffer was provided with the request\n");
++		return -ENOENT;
++	} else if (count > 1) {
++		v4l2_info(&ctx->dev->v4l2_dev,
++			  "More than one buffer was provided with the request\n");
++		return -EINVAL;
++	}
++
++	parent_hdl = &ctx->hdl;
++
++	hdl = v4l2_ctrl_request_hdl_find(req, parent_hdl);
++	if (!hdl) {
++		v4l2_info(&ctx->dev->v4l2_dev, "Missing codec control(s)\n");
++		return -ENOENT;
++	}
++
++	for (i = 0; i < rpivid_ctrls_COUNT; i++) {
++		if (!rpivid_ctrls[i].required)
++			continue;
++
++		ctrl_test =
++			v4l2_ctrl_request_hdl_ctrl_find(hdl,
++							rpivid_ctrls[i].cfg.id);
++		if (!ctrl_test) {
++			v4l2_info(&ctx->dev->v4l2_dev,
++				  "Missing required codec control\n");
++			v4l2_ctrl_request_hdl_put(hdl);
++			return -ENOENT;
++		}
++	}
++
++	v4l2_ctrl_request_hdl_put(hdl);
++
++	return vb2_request_validate(req);
++}
++
++static int rpivid_open(struct file *file)
++{
++	struct rpivid_dev *dev = video_drvdata(file);
++	struct rpivid_ctx *ctx = NULL;
++	int ret;
++
++	if (mutex_lock_interruptible(&dev->dev_mutex))
++		return -ERESTARTSYS;
++
++	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
++	if (!ctx) {
++		mutex_unlock(&dev->dev_mutex);
++		ret = -ENOMEM;
++		goto err_unlock;
++	}
++
++	mutex_init(&ctx->ctx_mutex);
++
++	v4l2_fh_init(&ctx->fh, video_devdata(file));
++	file->private_data = &ctx->fh;
++	ctx->dev = dev;
++
++	ret = rpivid_init_ctrls(dev, ctx);
++	if (ret)
++		goto err_free;
++
++	ctx->fh.m2m_ctx = v4l2_m2m_ctx_init(dev->m2m_dev, ctx,
++					    &rpivid_queue_init);
++	if (IS_ERR(ctx->fh.m2m_ctx)) {
++		ret = PTR_ERR(ctx->fh.m2m_ctx);
++		goto err_ctrls;
++	}
++
++	/* The only bit of format info that we can guess now is H265 src
++	 * Everything else we need more info for
++	 */
++	rpivid_prepare_src_format(&ctx->src_fmt);
++
++	v4l2_fh_add(&ctx->fh);
++
++	mutex_unlock(&dev->dev_mutex);
++
++	return 0;
++
++err_ctrls:
++	v4l2_ctrl_handler_free(&ctx->hdl);
++err_free:
++	mutex_destroy(&ctx->ctx_mutex);
++	kfree(ctx);
++err_unlock:
++	mutex_unlock(&dev->dev_mutex);
++
++	return ret;
++}
++
++static int rpivid_release(struct file *file)
++{
++	struct rpivid_dev *dev = video_drvdata(file);
++	struct rpivid_ctx *ctx = container_of(file->private_data,
++					      struct rpivid_ctx, fh);
++
++	mutex_lock(&dev->dev_mutex);
++
++	v4l2_fh_del(&ctx->fh);
++	v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
++
++	v4l2_ctrl_handler_free(&ctx->hdl);
++	kfree(ctx->ctrls);
++
++	v4l2_fh_exit(&ctx->fh);
++	mutex_destroy(&ctx->ctx_mutex);
++
++	kfree(ctx);
++
++	mutex_unlock(&dev->dev_mutex);
++
++	return 0;
++}
++
++static const struct v4l2_file_operations rpivid_fops = {
++	.owner		= THIS_MODULE,
++	.open		= rpivid_open,
++	.release	= rpivid_release,
++	.poll		= v4l2_m2m_fop_poll,
++	.unlocked_ioctl	= video_ioctl2,
++	.mmap		= v4l2_m2m_fop_mmap,
++};
++
++static const struct video_device rpivid_video_device = {
++	.name		= RPIVID_NAME,
++	.vfl_dir	= VFL_DIR_M2M,
++	.fops		= &rpivid_fops,
++	.ioctl_ops	= &rpivid_ioctl_ops,
++	.minor		= -1,
++	.release	= video_device_release_empty,
++	.device_caps	= V4L2_CAP_VIDEO_M2M_MPLANE | V4L2_CAP_STREAMING,
++};
++
++static const struct v4l2_m2m_ops rpivid_m2m_ops = {
++	.device_run	= rpivid_device_run,
++};
++
++static const struct media_device_ops rpivid_m2m_media_ops = {
++	.req_validate	= rpivid_request_validate,
++	.req_queue	= v4l2_m2m_request_queue,
++};
++
++static int rpivid_probe(struct platform_device *pdev)
++{
++	struct rpivid_dev *dev;
++	struct video_device *vfd;
++	int ret;
++
++	dev = devm_kzalloc(&pdev->dev, sizeof(*dev), GFP_KERNEL);
++	if (!dev)
++		return -ENOMEM;
++
++	dev->vfd = rpivid_video_device;
++	dev->dev = &pdev->dev;
++	dev->pdev = pdev;
++
++	ret = 0;
++	ret = rpivid_hw_probe(dev);
++	if (ret) {
++		dev_err(&pdev->dev, "Failed to probe hardware\n");
++		return ret;
++	}
++
++	dev->dec_ops = &rpivid_dec_ops_h265;
++
++	mutex_init(&dev->dev_mutex);
++
++	ret = v4l2_device_register(&pdev->dev, &dev->v4l2_dev);
++	if (ret) {
++		dev_err(&pdev->dev, "Failed to register V4L2 device\n");
++		return ret;
++	}
++
++	vfd = &dev->vfd;
++	vfd->lock = &dev->dev_mutex;
++	vfd->v4l2_dev = &dev->v4l2_dev;
++
++	snprintf(vfd->name, sizeof(vfd->name), "%s", rpivid_video_device.name);
++	video_set_drvdata(vfd, dev);
++
++	dev->m2m_dev = v4l2_m2m_init(&rpivid_m2m_ops);
++	if (IS_ERR(dev->m2m_dev)) {
++		v4l2_err(&dev->v4l2_dev,
++			 "Failed to initialize V4L2 M2M device\n");
++		ret = PTR_ERR(dev->m2m_dev);
++
++		goto err_v4l2;
++	}
++
++	dev->mdev.dev = &pdev->dev;
++	strscpy(dev->mdev.model, RPIVID_NAME, sizeof(dev->mdev.model));
++	strscpy(dev->mdev.bus_info, "platform:" RPIVID_NAME,
++		sizeof(dev->mdev.bus_info));
++
++	media_device_init(&dev->mdev);
++	dev->mdev.ops = &rpivid_m2m_media_ops;
++	dev->v4l2_dev.mdev = &dev->mdev;
++
++	ret = video_register_device(vfd, VFL_TYPE_VIDEO, video_nr);
++	if (ret) {
++		v4l2_err(&dev->v4l2_dev, "Failed to register video device\n");
++		goto err_m2m;
++	}
++
++	v4l2_info(&dev->v4l2_dev,
++		  "Device registered as /dev/video%d\n", vfd->num);
++
++	ret = v4l2_m2m_register_media_controller(dev->m2m_dev, vfd,
++						 MEDIA_ENT_F_PROC_VIDEO_DECODER);
++	if (ret) {
++		v4l2_err(&dev->v4l2_dev,
++			 "Failed to initialize V4L2 M2M media controller\n");
++		goto err_video;
++	}
++
++	ret = media_device_register(&dev->mdev);
++	if (ret) {
++		v4l2_err(&dev->v4l2_dev, "Failed to register media device\n");
++		goto err_m2m_mc;
++	}
++
++	platform_set_drvdata(pdev, dev);
++
++	return 0;
++
++err_m2m_mc:
++	v4l2_m2m_unregister_media_controller(dev->m2m_dev);
++err_video:
++	video_unregister_device(&dev->vfd);
++err_m2m:
++	v4l2_m2m_release(dev->m2m_dev);
++err_v4l2:
++	v4l2_device_unregister(&dev->v4l2_dev);
++
++	return ret;
++}
++
++static int rpivid_remove(struct platform_device *pdev)
++{
++	struct rpivid_dev *dev = platform_get_drvdata(pdev);
++
++	if (media_devnode_is_registered(dev->mdev.devnode)) {
++		media_device_unregister(&dev->mdev);
++		v4l2_m2m_unregister_media_controller(dev->m2m_dev);
++		media_device_cleanup(&dev->mdev);
++	}
++
++	v4l2_m2m_release(dev->m2m_dev);
++	video_unregister_device(&dev->vfd);
++	v4l2_device_unregister(&dev->v4l2_dev);
++
++	rpivid_hw_remove(dev);
++
++	return 0;
++}
++
++static const struct of_device_id rpivid_dt_match[] = {
++	{
++		.compatible = "raspberrypi,rpivid-vid-decoder",
++	},
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, rpivid_dt_match);
++
++static struct platform_driver rpivid_driver = {
++	.probe		= rpivid_probe,
++	.remove		= rpivid_remove,
++	.driver		= {
++		.name = RPIVID_NAME,
++		.of_match_table	= of_match_ptr(rpivid_dt_match),
++	},
++};
++module_platform_driver(rpivid_driver);
++
++MODULE_LICENSE("GPL v2");
++MODULE_AUTHOR("John Cox <jc@kynesim.co.uk>");
++MODULE_DESCRIPTION("Raspberry Pi HEVC V4L2 driver");
+--- /dev/null
++++ b/drivers/staging/media/rpivid/rpivid.h
+@@ -0,0 +1,203 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Raspberry Pi HEVC driver
++ *
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ *
++ * Based on the Cedrus VPU driver, that is:
++ *
++ * Copyright (C) 2016 Florent Revest <florent.revest@free-electrons.com>
++ * Copyright (C) 2018 Paul Kocialkowski <paul.kocialkowski@bootlin.com>
++ * Copyright (C) 2018 Bootlin
++ */
++
++#ifndef _RPIVID_H_
++#define _RPIVID_H_
++
++#include <linux/clk.h>
++#include <linux/platform_device.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-mem2mem.h>
++#include <media/videobuf2-v4l2.h>
++#include <media/videobuf2-dma-contig.h>
++
++#define OPT_DEBUG_POLL_IRQ  0
++
++#define RPIVID_DEC_ENV_COUNT 6
++#define RPIVID_P1BUF_COUNT 3
++#define RPIVID_P2BUF_COUNT 3
++
++#define RPIVID_NAME			"rpivid"
++
++#define RPIVID_CAPABILITY_UNTILED	BIT(0)
++#define RPIVID_CAPABILITY_H265_DEC	BIT(1)
++
++#define RPIVID_QUIRK_NO_DMA_OFFSET	BIT(0)
++
++enum rpivid_irq_status {
++	RPIVID_IRQ_NONE,
++	RPIVID_IRQ_ERROR,
++	RPIVID_IRQ_OK,
++};
++
++struct rpivid_control {
++	struct v4l2_ctrl_config cfg;
++	unsigned char		required:1;
++};
++
++struct rpivid_h265_run {
++	u32 slice_ents;
++	const struct v4l2_ctrl_hevc_sps			*sps;
++	const struct v4l2_ctrl_hevc_pps			*pps;
++	const struct v4l2_ctrl_hevc_decode_params      	*dec;
++	const struct v4l2_ctrl_hevc_slice_params	*slice_params;
++	const struct v4l2_ctrl_hevc_scaling_matrix	*scaling_matrix;
++};
++
++struct rpivid_run {
++	struct vb2_v4l2_buffer	*src;
++	struct vb2_v4l2_buffer	*dst;
++
++	struct rpivid_h265_run	h265;
++};
++
++struct rpivid_buffer {
++	struct v4l2_m2m_buffer          m2m_buf;
++};
++
++struct rpivid_dec_state;
++struct rpivid_dec_env;
++
++struct rpivid_gptr {
++	size_t size;
++	__u8 *ptr;
++	dma_addr_t addr;
++	unsigned long attrs;
++};
++
++struct rpivid_dev;
++typedef void (*rpivid_irq_callback)(struct rpivid_dev *dev, void *ctx);
++
++struct rpivid_q_aux;
++#define RPIVID_AUX_ENT_COUNT VB2_MAX_FRAME
++
++struct rpivid_ctx {
++	struct v4l2_fh			fh;
++	struct rpivid_dev		*dev;
++
++	struct v4l2_pix_format_mplane	src_fmt;
++	struct v4l2_pix_format_mplane	dst_fmt;
++	int dst_fmt_set;
++
++	int 				src_stream_on;
++	int 				dst_stream_on;
++
++	// fatal_err is set if an error has occurred s.t. decode cannot
++	// continue (such as running out of CMA)
++	int fatal_err;
++
++	/* Lock for queue operations */
++	struct mutex			ctx_mutex;
++
++	struct v4l2_ctrl_handler	hdl;
++	struct v4l2_ctrl		**ctrls;
++
++	/* Decode state - stateless decoder my *** */
++	/* state contains stuff that is only needed in phase0
++	 * it could be held in dec_env but that would be wasteful
++	 */
++	struct rpivid_dec_state *state;
++	struct rpivid_dec_env *dec0;
++
++	/* Spinlock protecting dec_free */
++	spinlock_t dec_lock;
++	struct rpivid_dec_env *dec_free;
++
++	struct rpivid_dec_env *dec_pool;
++
++	unsigned int p1idx;
++	atomic_t p1out;
++	struct rpivid_gptr bitbufs[RPIVID_P1BUF_COUNT];
++
++	/* *** Should be in dev *** */
++	unsigned int p2idx;
++	struct rpivid_gptr pu_bufs[RPIVID_P2BUF_COUNT];
++	struct rpivid_gptr coeff_bufs[RPIVID_P2BUF_COUNT];
++
++	/* Spinlock protecting aux_free */
++	spinlock_t aux_lock;
++	struct rpivid_q_aux *aux_free;
++
++	struct rpivid_q_aux *aux_ents[RPIVID_AUX_ENT_COUNT];
++
++	unsigned int colmv_stride;
++	unsigned int colmv_picsize;
++};
++
++struct rpivid_dec_ops {
++	void (*setup)(struct rpivid_ctx *ctx, struct rpivid_run *run);
++	int (*start)(struct rpivid_ctx *ctx);
++	void (*stop)(struct rpivid_ctx *ctx);
++	void (*trigger)(struct rpivid_ctx *ctx);
++};
++
++struct rpivid_variant {
++	unsigned int	capabilities;
++	unsigned int	quirks;
++	unsigned int	mod_rate;
++};
++
++struct rpivid_hw_irq_ent;
++
++#define RPIVID_ICTL_ENABLE_UNLIMITED (-1)
++
++struct rpivid_hw_irq_ctrl {
++	/* Spinlock protecting claim and tail */
++	spinlock_t lock;
++	struct rpivid_hw_irq_ent *claim;
++	struct rpivid_hw_irq_ent *tail;
++
++	/* Ent for pending irq - also prevents sched */
++	struct rpivid_hw_irq_ent *irq;
++	/* Non-zero => do not start a new job - outer layer sched pending */
++	int no_sched;
++	/* Enable count. -1 always OK, 0 do not sched, +ve shed & count down */
++	int enable;
++	/* Thread CB requested */
++	bool thread_reqed;
++};
++
++struct rpivid_dev {
++	struct v4l2_device	v4l2_dev;
++	struct video_device	vfd;
++	struct media_device	mdev;
++	struct media_pad	pad[2];
++	struct platform_device	*pdev;
++	struct device		*dev;
++	struct v4l2_m2m_dev	*m2m_dev;
++	const struct rpivid_dec_ops *dec_ops;
++
++	/* Device file mutex */
++	struct mutex		dev_mutex;
++
++	void __iomem		*base_irq;
++	void __iomem		*base_h265;
++
++	struct clk		*clock;
++	unsigned long		max_clock_rate;
++
++	int			cache_align;
++
++	struct rpivid_hw_irq_ctrl ic_active1;
++	struct rpivid_hw_irq_ctrl ic_active2;
++};
++
++extern const struct rpivid_dec_ops rpivid_dec_ops_h265;
++extern const struct v4l2_ctrl_ops rpivid_hevc_sps_ctrl_ops;
++extern const struct v4l2_ctrl_ops rpivid_hevc_pps_ctrl_ops;
++
++struct v4l2_ctrl *rpivid_find_ctrl(struct rpivid_ctx *ctx, u32 id);
++void *rpivid_find_control_data(struct rpivid_ctx *ctx, u32 id);
++
++#endif
+--- /dev/null
++++ b/drivers/staging/media/rpivid/rpivid_dec.c
+@@ -0,0 +1,96 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Raspberry Pi HEVC driver
++ *
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ *
++ * Based on the Cedrus VPU driver, that is:
++ *
++ * Copyright (C) 2016 Florent Revest <florent.revest@free-electrons.com>
++ * Copyright (C) 2018 Paul Kocialkowski <paul.kocialkowski@bootlin.com>
++ * Copyright (C) 2018 Bootlin
++ */
++
++#include <media/v4l2-device.h>
++#include <media/v4l2-ioctl.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-mem2mem.h>
++
++#include "rpivid.h"
++#include "rpivid_dec.h"
++
++void rpivid_device_run(void *priv)
++{
++	struct rpivid_ctx *const ctx = priv;
++	struct rpivid_dev *const dev = ctx->dev;
++	struct rpivid_run run = {};
++	struct media_request *src_req;
++
++	run.src = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
++	run.dst = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
++
++	if (!run.src || !run.dst) {
++		v4l2_err(&dev->v4l2_dev, "%s: Missing buffer: src=%p, dst=%p\n",
++			 __func__, run.src, run.dst);
++		goto fail;
++	}
++
++	/* Apply request(s) controls */
++	src_req = run.src->vb2_buf.req_obj.req;
++	if (!src_req) {
++		v4l2_err(&dev->v4l2_dev, "%s: Missing request\n", __func__);
++		goto fail;
++	}
++
++	v4l2_ctrl_request_setup(src_req, &ctx->hdl);
++
++	switch (ctx->src_fmt.pixelformat) {
++	case V4L2_PIX_FMT_HEVC_SLICE:
++	{
++		const struct v4l2_ctrl *ctrl;
++
++		run.h265.sps =
++			rpivid_find_control_data(ctx,
++						 V4L2_CID_STATELESS_HEVC_SPS);
++		run.h265.pps =
++			rpivid_find_control_data(ctx,
++						 V4L2_CID_STATELESS_HEVC_PPS);
++		run.h265.dec =
++			rpivid_find_control_data(ctx,
++						 V4L2_CID_STATELESS_HEVC_DECODE_PARAMS);
++
++		ctrl = rpivid_find_ctrl(ctx,
++					V4L2_CID_STATELESS_HEVC_SLICE_PARAMS);
++		if (!ctrl || !ctrl->elems) {
++			v4l2_err(&dev->v4l2_dev, "%s: Missing slice params\n",
++				 __func__);
++			goto fail;
++		}
++		run.h265.slice_ents = ctrl->elems;
++		run.h265.slice_params = ctrl->p_cur.p;
++
++		run.h265.scaling_matrix =
++			rpivid_find_control_data(ctx,
++						 V4L2_CID_STATELESS_HEVC_SCALING_MATRIX);
++		break;
++	}
++
++	default:
++		break;
++	}
++
++	v4l2_m2m_buf_copy_metadata(run.src, run.dst, true);
++
++	dev->dec_ops->setup(ctx, &run);
++
++	/* Complete request(s) controls */
++	v4l2_ctrl_request_complete(src_req, &ctx->hdl);
++
++	dev->dec_ops->trigger(ctx);
++	return;
++
++fail:
++	/* We really shouldn't get here but tidy up what we can */
++	v4l2_m2m_buf_done_and_job_finish(dev->m2m_dev, ctx->fh.m2m_ctx,
++					 VB2_BUF_STATE_ERROR);
++}
+--- /dev/null
++++ b/drivers/staging/media/rpivid/rpivid_dec.h
+@@ -0,0 +1,19 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Raspberry Pi HEVC driver
++ *
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ *
++ * Based on the Cedrus VPU driver, that is:
++ *
++ * Copyright (C) 2016 Florent Revest <florent.revest@free-electrons.com>
++ * Copyright (C) 2018 Paul Kocialkowski <paul.kocialkowski@bootlin.com>
++ * Copyright (C) 2018 Bootlin
++ */
++
++#ifndef _RPIVID_DEC_H_
++#define _RPIVID_DEC_H_
++
++void rpivid_device_run(void *priv);
++
++#endif
+--- /dev/null
++++ b/drivers/staging/media/rpivid/rpivid_h265.c
+@@ -0,0 +1,2698 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * Raspberry Pi HEVC driver
++ *
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ *
++ * Based on the Cedrus VPU driver, that is:
++ *
++ * Copyright (C) 2016 Florent Revest <florent.revest@free-electrons.com>
++ * Copyright (C) 2018 Paul Kocialkowski <paul.kocialkowski@bootlin.com>
++ * Copyright (C) 2018 Bootlin
++ */
++
++#include <linux/delay.h>
++#include <linux/types.h>
++
++#include <media/videobuf2-dma-contig.h>
++
++#include "rpivid.h"
++#include "rpivid_hw.h"
++#include "rpivid_video.h"
++
++#define DEBUG_TRACE_P1_CMD 0
++#define DEBUG_TRACE_EXECUTION 0
++
++#define USE_REQUEST_PIN 1
++
++#if DEBUG_TRACE_EXECUTION
++#define xtrace_in(dev_, de_)\
++	v4l2_info(&(dev_)->v4l2_dev, "%s[%d]: in\n",   __func__,\
++		  (de_) == NULL ? -1 : (de_)->decode_order)
++#define xtrace_ok(dev_, de_)\
++	v4l2_info(&(dev_)->v4l2_dev, "%s[%d]: ok\n",   __func__,\
++		  (de_) == NULL ? -1 : (de_)->decode_order)
++#define xtrace_fin(dev_, de_)\
++	v4l2_info(&(dev_)->v4l2_dev, "%s[%d]: finish\n", __func__,\
++		  (de_) == NULL ? -1 : (de_)->decode_order)
++#define xtrace_fail(dev_, de_)\
++	v4l2_info(&(dev_)->v4l2_dev, "%s[%d]: FAIL\n", __func__,\
++		  (de_) == NULL ? -1 : (de_)->decode_order)
++#else
++#define xtrace_in(dev_, de_)
++#define xtrace_ok(dev_, de_)
++#define xtrace_fin(dev_, de_)
++#define xtrace_fail(dev_, de_)
++#endif
++
++enum hevc_slice_type {
++	HEVC_SLICE_B = 0,
++	HEVC_SLICE_P = 1,
++	HEVC_SLICE_I = 2,
++};
++
++enum hevc_layer { L0 = 0, L1 = 1 };
++
++static int gptr_alloc(struct rpivid_dev *const dev, struct rpivid_gptr *gptr,
++		      size_t size, unsigned long attrs)
++{
++	gptr->size = size;
++	gptr->attrs = attrs;
++	gptr->addr = 0;
++	gptr->ptr = dma_alloc_attrs(dev->dev, gptr->size, &gptr->addr,
++				    GFP_KERNEL, gptr->attrs);
++	return !gptr->ptr ? -ENOMEM : 0;
++}
++
++static void gptr_free(struct rpivid_dev *const dev,
++		      struct rpivid_gptr *const gptr)
++{
++	if (gptr->ptr)
++		dma_free_attrs(dev->dev, gptr->size, gptr->ptr, gptr->addr,
++			       gptr->attrs);
++	gptr->size = 0;
++	gptr->ptr = NULL;
++	gptr->addr = 0;
++	gptr->attrs = 0;
++}
++
++/* Realloc but do not copy
++ *
++ * Frees then allocs.
++ * If the alloc fails then it attempts to re-allocote the old size
++ * On error then check gptr->ptr to determine if anything is currently
++ * allocated.
++ */
++static int gptr_realloc_new(struct rpivid_dev * const dev,
++			    struct rpivid_gptr * const gptr, size_t size)
++{
++	const size_t old_size = gptr->size;
++
++	if (size == gptr->size)
++		return 0;
++
++	if (gptr->ptr)
++		dma_free_attrs(dev->dev, gptr->size, gptr->ptr,
++			       gptr->addr, gptr->attrs);
++
++	gptr->addr = 0;
++	gptr->size = size;
++	gptr->ptr = dma_alloc_attrs(dev->dev, gptr->size,
++				    &gptr->addr, GFP_KERNEL, gptr->attrs);
++
++	if (!gptr->ptr) {
++		gptr->addr = 0;
++		gptr->size = old_size;
++		gptr->ptr = dma_alloc_attrs(dev->dev, gptr->size,
++					    &gptr->addr, GFP_KERNEL, gptr->attrs);
++		if (!gptr->ptr) {
++			gptr->size = 0;
++			gptr->addr = 0;
++			gptr->attrs = 0;
++		}
++		return -ENOMEM;
++	}
++
++	return 0;
++}
++
++static size_t next_size(const size_t x)
++{
++	return rpivid_round_up_size(x + 1);
++}
++
++#define NUM_SCALING_FACTORS 4064 /* Not a typo = 0xbe0 + 0x400 */
++
++#define AXI_BASE64 0
++
++#define PROB_BACKUP ((20 << 12) + (20 << 6) + (0 << 0))
++#define PROB_RELOAD ((20 << 12) + (20 << 0) + (0 << 6))
++
++#define HEVC_MAX_REFS V4L2_HEVC_DPB_ENTRIES_NUM_MAX
++
++//////////////////////////////////////////////////////////////////////////////
++
++struct rpi_cmd {
++	u32 addr;
++	u32 data;
++} __packed;
++
++struct rpivid_q_aux {
++	unsigned int refcount;
++	unsigned int q_index;
++	struct rpivid_q_aux *next;
++	struct rpivid_gptr col;
++};
++
++//////////////////////////////////////////////////////////////////////////////
++
++enum rpivid_decode_state {
++	RPIVID_DECODE_SLICE_START,
++	RPIVID_DECODE_SLICE_CONTINUE,
++	RPIVID_DECODE_ERROR_CONTINUE,
++	RPIVID_DECODE_ERROR_DONE,
++	RPIVID_DECODE_PHASE1,
++	RPIVID_DECODE_END,
++};
++
++struct rpivid_dec_env {
++	struct rpivid_ctx *ctx;
++	struct rpivid_dec_env *next;
++
++	enum rpivid_decode_state state;
++	unsigned int decode_order;
++	int p1_status;		/* P1 status - what to realloc */
++
++	struct rpi_cmd *cmd_fifo;
++	unsigned int cmd_len, cmd_max;
++	unsigned int num_slice_msgs;
++	unsigned int pic_width_in_ctbs_y;
++	unsigned int pic_height_in_ctbs_y;
++	unsigned int dpbno_col;
++	u32 reg_slicestart;
++	int collocated_from_l0_flag;
++	/*
++	 * Last CTB/Tile X,Y processed by (wpp_)entry_point
++	 * Could be in _state as P0 only but needs updating where _state
++	 * is const
++	 */
++	unsigned int entry_ctb_x;
++	unsigned int entry_ctb_y;
++	unsigned int entry_tile_x;
++	unsigned int entry_tile_y;
++	unsigned int entry_qp;
++	u32 entry_slice;
++
++	u32 rpi_config2;
++	u32 rpi_framesize;
++	u32 rpi_currpoc;
++
++	struct vb2_v4l2_buffer *frame_buf; // Detached dest buffer
++	struct vb2_v4l2_buffer *src_buf;   // Detached src buffer
++	unsigned int frame_c_offset;
++	unsigned int frame_stride;
++	dma_addr_t frame_addr;
++	dma_addr_t ref_addrs[16];
++	struct rpivid_q_aux *frame_aux;
++	struct rpivid_q_aux *col_aux;
++
++	dma_addr_t cmd_addr;
++	size_t cmd_size;
++
++	dma_addr_t pu_base_vc;
++	dma_addr_t coeff_base_vc;
++	u32 pu_stride;
++	u32 coeff_stride;
++
++	struct rpivid_gptr *bit_copy_gptr;
++	size_t bit_copy_len;
++
++#define SLICE_MSGS_MAX (2 * HEVC_MAX_REFS * 8 + 3)
++	u16 slice_msgs[SLICE_MSGS_MAX];
++	u8 scaling_factors[NUM_SCALING_FACTORS];
++
++#if USE_REQUEST_PIN
++	struct media_request *req_pin;
++#else
++	struct media_request_object *req_obj;
++#endif
++	struct rpivid_hw_irq_ent irq_ent;
++};
++
++#define member_size(type, member) sizeof(((type *)0)->member)
++
++struct rpivid_dec_state {
++	struct v4l2_ctrl_hevc_sps sps;
++	struct v4l2_ctrl_hevc_pps pps;
++
++	// Helper vars & tables derived from sps/pps
++	unsigned int log2_ctb_size;     /* log2 width of a CTB */
++	unsigned int ctb_width;         /* Width in CTBs */
++	unsigned int ctb_height;        /* Height in CTBs */
++	unsigned int ctb_size;          /* Pic area in CTBs */
++	unsigned int tile_width;        /* Width in tiles */
++	unsigned int tile_height;       /* Height in tiles */
++
++	int *col_bd;
++	int *row_bd;
++	int *ctb_addr_rs_to_ts;
++	int *ctb_addr_ts_to_rs;
++
++	// Aux starage for DPB
++	// Hold refs
++	struct rpivid_q_aux *ref_aux[HEVC_MAX_REFS];
++	struct rpivid_q_aux *frame_aux;
++
++	// Slice vars
++	unsigned int slice_idx;
++	bool slice_temporal_mvp;  /* Slice flag but constant for frame */
++	bool use_aux;
++	bool mk_aux;
++
++	// Temp vars per run - don't actually need to persist
++	u8 *src_buf;
++	dma_addr_t src_addr;
++	const struct v4l2_ctrl_hevc_slice_params *sh;
++	const struct v4l2_ctrl_hevc_decode_params *dec;
++	unsigned int nb_refs[2];
++	unsigned int slice_qp;
++	unsigned int max_num_merge_cand; // 0 if I-slice
++	bool dependent_slice_segment_flag;
++
++	unsigned int start_ts;          /* slice_segment_addr -> ts */
++	unsigned int start_ctb_x;       /* CTB X,Y of start_ts */
++	unsigned int start_ctb_y;
++	unsigned int prev_ctb_x;        /* CTB X,Y of start_ts - 1 */
++	unsigned int prev_ctb_y;
++};
++
++#if !USE_REQUEST_PIN
++static void dst_req_obj_release(struct media_request_object *object)
++{
++	kfree(object);
++}
++
++static const struct media_request_object_ops dst_req_obj_ops = {
++	.release = dst_req_obj_release,
++};
++#endif
++
++static inline int clip_int(const int x, const int lo, const int hi)
++{
++	return x < lo ? lo : x > hi ? hi : x;
++}
++
++//////////////////////////////////////////////////////////////////////////////
++// Phase 1 command and bit FIFOs
++
++#if DEBUG_TRACE_P1_CMD
++static int p1_z;
++#endif
++
++static int cmds_check_space(struct rpivid_dec_env *const de, unsigned int n)
++{
++	struct rpi_cmd *a;
++	unsigned int newmax;
++
++	if (n > 0x100000) {
++		v4l2_err(&de->ctx->dev->v4l2_dev,
++			 "%s: n %u implausible\n", __func__, n);
++		return -ENOMEM;
++	}
++
++	if (de->cmd_len + n <= de->cmd_max)
++		return 0;
++
++	newmax = roundup_pow_of_two(de->cmd_len + n);
++
++	a = krealloc(de->cmd_fifo, newmax * sizeof(struct rpi_cmd),
++		     GFP_KERNEL);
++	if (!a) {
++		v4l2_err(&de->ctx->dev->v4l2_dev,
++			 "Failed cmd buffer realloc from %u to %u\n",
++			 de->cmd_max, newmax);
++		return -ENOMEM;
++	}
++	v4l2_info(&de->ctx->dev->v4l2_dev,
++		  "cmd buffer realloc from %u to %u\n", de->cmd_max, newmax);
++
++	de->cmd_fifo = a;
++	de->cmd_max = newmax;
++	return 0;
++}
++
++// ???? u16 addr - put in u32
++static void p1_apb_write(struct rpivid_dec_env *const de, const u16 addr,
++			 const u32 data)
++{
++	if (de->cmd_len >= de->cmd_max) {
++		v4l2_err(&de->ctx->dev->v4l2_dev,
++			 "%s: Overflow @ %d\n", __func__, de->cmd_len);
++		return;
++	}
++
++	de->cmd_fifo[de->cmd_len].addr = addr;
++	de->cmd_fifo[de->cmd_len].data = data;
++
++#if DEBUG_TRACE_P1_CMD
++	if (++p1_z < 256) {
++		v4l2_info(&de->ctx->dev->v4l2_dev, "[%02x] %x %x\n",
++			  de->cmd_len, addr, data);
++	}
++#endif
++	de->cmd_len++;
++}
++
++static int ctb_to_tile(unsigned int ctb, unsigned int *bd, int num)
++{
++	int i;
++
++	for (i = 1; ctb >= bd[i]; i++)
++		; // bd[] has num+1 elements; bd[0]=0;
++	return i - 1;
++}
++
++static unsigned int ctb_to_tile_x(const struct rpivid_dec_state *const s,
++				  const unsigned int ctb_x)
++{
++	return ctb_to_tile(ctb_x, s->col_bd, s->tile_width);
++}
++
++static unsigned int ctb_to_tile_y(const struct rpivid_dec_state *const s,
++				  const unsigned int ctb_y)
++{
++	return ctb_to_tile(ctb_y, s->row_bd, s->tile_height);
++}
++
++static void aux_q_free(struct rpivid_ctx *const ctx,
++		       struct rpivid_q_aux *const aq)
++{
++	struct rpivid_dev *const dev = ctx->dev;
++
++	gptr_free(dev, &aq->col);
++	kfree(aq);
++}
++
++static struct rpivid_q_aux *aux_q_alloc(struct rpivid_ctx *const ctx,
++					const unsigned int q_index)
++{
++	struct rpivid_dev *const dev = ctx->dev;
++	struct rpivid_q_aux *const aq = kzalloc(sizeof(*aq), GFP_KERNEL);
++
++	if (!aq)
++		return NULL;
++
++	if (gptr_alloc(dev, &aq->col, ctx->colmv_picsize,
++		       DMA_ATTR_FORCE_CONTIGUOUS | DMA_ATTR_NO_KERNEL_MAPPING))
++		goto fail;
++
++	/*
++	 * Spinlock not required as called in P0 only and
++	 * aux checks done by _new
++	 */
++	aq->refcount = 1;
++	aq->q_index = q_index;
++	ctx->aux_ents[q_index] = aq;
++	return aq;
++
++fail:
++	kfree(aq);
++	return NULL;
++}
++
++static struct rpivid_q_aux *aux_q_new(struct rpivid_ctx *const ctx,
++				      const unsigned int q_index)
++{
++	struct rpivid_q_aux *aq;
++	unsigned long lockflags;
++
++	spin_lock_irqsave(&ctx->aux_lock, lockflags);
++	/*
++	 * If we already have this allocated to a slot then use that
++	 * and assume that it will all work itself out in the pipeline
++	 */
++	if ((aq = ctx->aux_ents[q_index]) != NULL) {
++		++aq->refcount;
++	} else if ((aq = ctx->aux_free) != NULL) {
++		ctx->aux_free = aq->next;
++		aq->next = NULL;
++		aq->refcount = 1;
++		aq->q_index = q_index;
++		ctx->aux_ents[q_index] = aq;
++	}
++	spin_unlock_irqrestore(&ctx->aux_lock, lockflags);
++
++	if (!aq)
++		aq = aux_q_alloc(ctx, q_index);
++
++	return aq;
++}
++
++static struct rpivid_q_aux *aux_q_ref_idx(struct rpivid_ctx *const ctx,
++					  const int q_index)
++{
++	unsigned long lockflags;
++	struct rpivid_q_aux *aq;
++
++	spin_lock_irqsave(&ctx->aux_lock, lockflags);
++	if ((aq = ctx->aux_ents[q_index]) != NULL)
++		++aq->refcount;
++	spin_unlock_irqrestore(&ctx->aux_lock, lockflags);
++
++	return aq;
++}
++
++static struct rpivid_q_aux *aux_q_ref(struct rpivid_ctx *const ctx,
++				      struct rpivid_q_aux *const aq)
++{
++	if (aq) {
++		unsigned long lockflags;
++
++		spin_lock_irqsave(&ctx->aux_lock, lockflags);
++
++		++aq->refcount;
++
++		spin_unlock_irqrestore(&ctx->aux_lock, lockflags);
++	}
++	return aq;
++}
++
++static void aux_q_release(struct rpivid_ctx *const ctx,
++			  struct rpivid_q_aux **const paq)
++{
++	struct rpivid_q_aux *const aq = *paq;
++	unsigned long lockflags;
++
++	if (!aq)
++		return;
++
++	*paq = NULL;
++
++	spin_lock_irqsave(&ctx->aux_lock, lockflags);
++	if (--aq->refcount == 0) {
++		aq->next = ctx->aux_free;
++		ctx->aux_free = aq;
++		ctx->aux_ents[aq->q_index] = NULL;
++		aq->q_index = ~0U;
++	}
++	spin_unlock_irqrestore(&ctx->aux_lock, lockflags);
++}
++
++static void aux_q_init(struct rpivid_ctx *const ctx)
++{
++	spin_lock_init(&ctx->aux_lock);
++	ctx->aux_free = NULL;
++}
++
++static void aux_q_uninit(struct rpivid_ctx *const ctx)
++{
++	struct rpivid_q_aux *aq;
++
++	ctx->colmv_picsize = 0;
++	ctx->colmv_stride = 0;
++	while ((aq = ctx->aux_free) != NULL) {
++		ctx->aux_free = aq->next;
++		aux_q_free(ctx, aq);
++	}
++}
++
++//////////////////////////////////////////////////////////////////////////////
++
++/*
++ * Initialisation process for context variables (CABAC init)
++ * see H.265 9.3.2.2
++ *
++ * N.B. If comparing with FFmpeg note that this h/w uses slightly different
++ * offsets to FFmpegs array
++ */
++
++/* Actual number of values */
++#define RPI_PROB_VALS 154U
++/* Rounded up as we copy words */
++#define RPI_PROB_ARRAY_SIZE ((154 + 3) & ~3)
++
++/* Initialiser values - see tables H.265 9-4 through 9-42 */
++static const u8 prob_init[3][156] = {
++	{
++		153, 200, 139, 141, 157, 154, 154, 154, 154, 154, 184, 154, 154,
++		154, 184, 63,  154, 154, 154, 154, 154, 154, 154, 154, 154, 154,
++		154, 154, 154, 153, 138, 138, 111, 141, 94,  138, 182, 154, 154,
++		154, 140, 92,  137, 138, 140, 152, 138, 139, 153, 74,  149, 92,
++		139, 107, 122, 152, 140, 179, 166, 182, 140, 227, 122, 197, 110,
++		110, 124, 125, 140, 153, 125, 127, 140, 109, 111, 143, 127, 111,
++		79,  108, 123, 63,  110, 110, 124, 125, 140, 153, 125, 127, 140,
++		109, 111, 143, 127, 111, 79,  108, 123, 63,  91,  171, 134, 141,
++		138, 153, 136, 167, 152, 152, 139, 139, 111, 111, 125, 110, 110,
++		94,  124, 108, 124, 107, 125, 141, 179, 153, 125, 107, 125, 141,
++		179, 153, 125, 107, 125, 141, 179, 153, 125, 140, 139, 182, 182,
++		152, 136, 152, 136, 153, 136, 139, 111, 136, 139, 111, 0,   0,
++	},
++	{
++		153, 185, 107, 139, 126, 197, 185, 201, 154, 149, 154, 139, 154,
++		154, 154, 152, 110, 122, 95,  79,  63,  31,  31,  153, 153, 168,
++		140, 198, 79,  124, 138, 94,  153, 111, 149, 107, 167, 154, 154,
++		154, 154, 196, 196, 167, 154, 152, 167, 182, 182, 134, 149, 136,
++		153, 121, 136, 137, 169, 194, 166, 167, 154, 167, 137, 182, 125,
++		110, 94,  110, 95,  79,  125, 111, 110, 78,  110, 111, 111, 95,
++		94,  108, 123, 108, 125, 110, 94,  110, 95,  79,  125, 111, 110,
++		78,  110, 111, 111, 95,  94,  108, 123, 108, 121, 140, 61,  154,
++		107, 167, 91,  122, 107, 167, 139, 139, 155, 154, 139, 153, 139,
++		123, 123, 63,  153, 166, 183, 140, 136, 153, 154, 166, 183, 140,
++		136, 153, 154, 166, 183, 140, 136, 153, 154, 170, 153, 123, 123,
++		107, 121, 107, 121, 167, 151, 183, 140, 151, 183, 140, 0,   0,
++	},
++	{
++		153, 160, 107, 139, 126, 197, 185, 201, 154, 134, 154, 139, 154,
++		154, 183, 152, 154, 137, 95,  79,  63,  31,  31,  153, 153, 168,
++		169, 198, 79,  224, 167, 122, 153, 111, 149, 92,  167, 154, 154,
++		154, 154, 196, 167, 167, 154, 152, 167, 182, 182, 134, 149, 136,
++		153, 121, 136, 122, 169, 208, 166, 167, 154, 152, 167, 182, 125,
++		110, 124, 110, 95,  94,  125, 111, 111, 79,  125, 126, 111, 111,
++		79,  108, 123, 93,  125, 110, 124, 110, 95,  94,  125, 111, 111,
++		79,  125, 126, 111, 111, 79,  108, 123, 93,  121, 140, 61,  154,
++		107, 167, 91,  107, 107, 167, 139, 139, 170, 154, 139, 153, 139,
++		123, 123, 63,  124, 166, 183, 140, 136, 153, 154, 166, 183, 140,
++		136, 153, 154, 166, 183, 140, 136, 153, 154, 170, 153, 138, 138,
++		122, 121, 122, 121, 167, 151, 183, 140, 151, 183, 140, 0,   0,
++	},
++};
++
++#define CMDS_WRITE_PROB ((RPI_PROB_ARRAY_SIZE / 4) + 1)
++static void write_prob(struct rpivid_dec_env *const de,
++		       const struct rpivid_dec_state *const s)
++{
++	u8 dst[RPI_PROB_ARRAY_SIZE];
++
++	const unsigned int init_type =
++		((s->sh->flags & V4L2_HEVC_SLICE_PARAMS_FLAG_CABAC_INIT) != 0 &&
++		 s->sh->slice_type != HEVC_SLICE_I) ?
++			s->sh->slice_type + 1 :
++			2 - s->sh->slice_type;
++	const u8 *p = prob_init[init_type];
++	const int q = clip_int(s->slice_qp, 0, 51);
++	unsigned int i;
++
++	for (i = 0; i < RPI_PROB_VALS; i++) {
++		int init_value = p[i];
++		int m = (init_value >> 4) * 5 - 45;
++		int n = ((init_value & 15) << 3) - 16;
++		int pre = 2 * (((m * q) >> 4) + n) - 127;
++
++		pre ^= pre >> 31;
++		if (pre > 124)
++			pre = 124 + (pre & 1);
++		dst[i] = pre;
++	}
++	for (i = RPI_PROB_VALS; i != RPI_PROB_ARRAY_SIZE; ++i)
++		dst[i] = 0;
++
++	for (i = 0; i < RPI_PROB_ARRAY_SIZE; i += 4)
++		p1_apb_write(de, 0x1000 + i,
++			     dst[i] + (dst[i + 1] << 8) + (dst[i + 2] << 16) +
++				     (dst[i + 3] << 24));
++
++	/*
++	 * Having written the prob array back it up
++	 * This is not always needed but is a small overhead that simplifies
++	 * (and speeds up) some multi-tile & WPP scenarios
++	 * There are no scenarios where having written a prob we ever want
++	 * a previous (non-initial) state back
++	 */
++	p1_apb_write(de, RPI_TRANSFER, PROB_BACKUP);
++}
++
++#define CMDS_WRITE_SCALING_FACTORS NUM_SCALING_FACTORS
++static void write_scaling_factors(struct rpivid_dec_env *const de)
++{
++	int i;
++	const u8 *p = (u8 *)de->scaling_factors;
++
++	for (i = 0; i < NUM_SCALING_FACTORS; i += 4, p += 4)
++		p1_apb_write(de, 0x2000 + i,
++			     p[0] + (p[1] << 8) + (p[2] << 16) + (p[3] << 24));
++}
++
++static inline __u32 dma_to_axi_addr(dma_addr_t a)
++{
++	return (__u32)(a >> 6);
++}
++
++#define CMDS_WRITE_BITSTREAM 4
++static int write_bitstream(struct rpivid_dec_env *const de,
++			   const struct rpivid_dec_state *const s)
++{
++	// Note that FFmpeg V4L2 does not remove emulation prevention bytes,
++	// so this is matched in the configuration here.
++	// Whether that is the correct behaviour or not is not clear in the
++	// spec.
++	const int rpi_use_emu = 1;
++	unsigned int offset = s->sh->data_byte_offset;
++	const unsigned int len = (s->sh->bit_size + 7) / 8 - offset;
++	dma_addr_t addr;
++
++	if (s->src_addr != 0) {
++		addr = s->src_addr + offset;
++	} else {
++		if (len + de->bit_copy_len > de->bit_copy_gptr->size) {
++			v4l2_warn(&de->ctx->dev->v4l2_dev,
++				  "Bit copy buffer overflow: size=%zu, offset=%zu, len=%u\n",
++				  de->bit_copy_gptr->size,
++				  de->bit_copy_len, len);
++			return -ENOMEM;
++		}
++		memcpy(de->bit_copy_gptr->ptr + de->bit_copy_len,
++		       s->src_buf + offset, len);
++		addr = de->bit_copy_gptr->addr + de->bit_copy_len;
++		de->bit_copy_len += (len + 63) & ~63;
++	}
++	offset = addr & 63;
++
++	p1_apb_write(de, RPI_BFBASE, dma_to_axi_addr(addr));
++	p1_apb_write(de, RPI_BFNUM, len);
++	p1_apb_write(de, RPI_BFCONTROL, offset + (1 << 7)); // Stop
++	p1_apb_write(de, RPI_BFCONTROL, offset + (rpi_use_emu << 6));
++	return 0;
++}
++
++//////////////////////////////////////////////////////////////////////////////
++
++/*
++ * The slice constant part of the slice register - width and height need to
++ * be ORed in later as they are per-tile / WPP-row
++ */
++static u32 slice_reg_const(const struct rpivid_dec_state *const s)
++{
++	u32 x = (s->max_num_merge_cand << 0) |
++		(s->nb_refs[L0] << 4) |
++		(s->nb_refs[L1] << 8) |
++		(s->sh->slice_type << 12);
++
++	if (s->sh->flags & V4L2_HEVC_SLICE_PARAMS_FLAG_SLICE_SAO_LUMA)
++		x |= BIT(14);
++	if (s->sh->flags & V4L2_HEVC_SLICE_PARAMS_FLAG_SLICE_SAO_CHROMA)
++		x |= BIT(15);
++	if (s->sh->slice_type == HEVC_SLICE_B &&
++	    (s->sh->flags & V4L2_HEVC_SLICE_PARAMS_FLAG_MVD_L1_ZERO))
++		x |= BIT(16);
++
++	return x;
++}
++
++//////////////////////////////////////////////////////////////////////////////
++
++#define CMDS_NEW_SLICE_SEGMENT (4 + CMDS_WRITE_SCALING_FACTORS)
++static void new_slice_segment(struct rpivid_dec_env *const de,
++			      const struct rpivid_dec_state *const s)
++{
++	const struct v4l2_ctrl_hevc_sps *const sps = &s->sps;
++	const struct v4l2_ctrl_hevc_pps *const pps = &s->pps;
++
++	p1_apb_write(de,
++		     RPI_SPS0,
++		     ((sps->log2_min_luma_coding_block_size_minus3 + 3) << 0) |
++		     (s->log2_ctb_size << 4) |
++		     ((sps->log2_min_luma_transform_block_size_minus2 + 2)
++							<< 8) |
++		     ((sps->log2_min_luma_transform_block_size_minus2 + 2 +
++		       sps->log2_diff_max_min_luma_transform_block_size)
++						<< 12) |
++		     ((sps->bit_depth_luma_minus8 + 8) << 16) |
++		     ((sps->bit_depth_chroma_minus8 + 8) << 20) |
++		     (sps->max_transform_hierarchy_depth_intra << 24) |
++		     (sps->max_transform_hierarchy_depth_inter << 28));
++
++	p1_apb_write(de,
++		     RPI_SPS1,
++		     ((sps->pcm_sample_bit_depth_luma_minus1 + 1) << 0) |
++		     ((sps->pcm_sample_bit_depth_chroma_minus1 + 1) << 4) |
++		     ((sps->log2_min_pcm_luma_coding_block_size_minus3 + 3)
++						<< 8) |
++		     ((sps->log2_min_pcm_luma_coding_block_size_minus3 + 3 +
++		       sps->log2_diff_max_min_pcm_luma_coding_block_size)
++						<< 12) |
++		     (((sps->flags & V4L2_HEVC_SPS_FLAG_SEPARATE_COLOUR_PLANE) ?
++				0 : sps->chroma_format_idc) << 16) |
++		     ((!!(sps->flags & V4L2_HEVC_SPS_FLAG_AMP_ENABLED)) << 18) |
++		     ((!!(sps->flags & V4L2_HEVC_SPS_FLAG_PCM_ENABLED)) << 19) |
++		     ((!!(sps->flags & V4L2_HEVC_SPS_FLAG_SCALING_LIST_ENABLED))
++						<< 20) |
++		     ((!!(sps->flags &
++			   V4L2_HEVC_SPS_FLAG_STRONG_INTRA_SMOOTHING_ENABLED))
++						<< 21));
++
++	p1_apb_write(de,
++		     RPI_PPS,
++		     ((s->log2_ctb_size - pps->diff_cu_qp_delta_depth) << 0) |
++		     ((!!(pps->flags & V4L2_HEVC_PPS_FLAG_CU_QP_DELTA_ENABLED))
++						 << 4) |
++		     ((!!(pps->flags &
++				V4L2_HEVC_PPS_FLAG_TRANSQUANT_BYPASS_ENABLED))
++						 << 5) |
++		     ((!!(pps->flags & V4L2_HEVC_PPS_FLAG_TRANSFORM_SKIP_ENABLED))
++						 << 6) |
++		     ((!!(pps->flags &
++				V4L2_HEVC_PPS_FLAG_SIGN_DATA_HIDING_ENABLED))
++						<< 7) |
++		     (((pps->pps_cb_qp_offset + s->sh->slice_cb_qp_offset) & 255)
++						<< 8) |
++		     (((pps->pps_cr_qp_offset + s->sh->slice_cr_qp_offset) & 255)
++						<< 16) |
++		     ((!!(pps->flags &
++				V4L2_HEVC_PPS_FLAG_CONSTRAINED_INTRA_PRED))
++						<< 24));
++
++	if (!s->start_ts &&
++	    (sps->flags & V4L2_HEVC_SPS_FLAG_SCALING_LIST_ENABLED) != 0)
++		write_scaling_factors(de);
++
++	if (!s->dependent_slice_segment_flag) {
++		int ctb_col = s->sh->slice_segment_addr %
++							de->pic_width_in_ctbs_y;
++		int ctb_row = s->sh->slice_segment_addr /
++							de->pic_width_in_ctbs_y;
++
++		de->reg_slicestart = (ctb_col << 0) + (ctb_row << 16);
++	}
++
++	p1_apb_write(de, RPI_SLICESTART, de->reg_slicestart);
++}
++
++//////////////////////////////////////////////////////////////////////////////
++// Slice messages
++
++static void msg_slice(struct rpivid_dec_env *const de, const u16 msg)
++{
++	de->slice_msgs[de->num_slice_msgs++] = msg;
++}
++
++#define CMDS_PROGRAM_SLICECMDS (1 + SLICE_MSGS_MAX)
++static void program_slicecmds(struct rpivid_dec_env *const de,
++			      const int sliceid)
++{
++	int i;
++
++	p1_apb_write(de, RPI_SLICECMDS, de->num_slice_msgs + (sliceid << 8));
++
++	for (i = 0; i < de->num_slice_msgs; i++)
++		p1_apb_write(de, 0x4000 + 4 * i, de->slice_msgs[i] & 0xffff);
++}
++
++// NoBackwardPredictionFlag 8.3.5
++// Simply checks POCs
++static int has_backward(const struct v4l2_hevc_dpb_entry *const dpb,
++			const __u8 *const idx, const unsigned int n,
++			const s32 cur_poc)
++{
++	unsigned int i;
++
++	for (i = 0; i < n; ++i) {
++		if (cur_poc < dpb[idx[i]].pic_order_cnt_val)
++			return 0;
++	}
++	return 1;
++}
++
++static void pre_slice_decode(struct rpivid_dec_env *const de,
++			     const struct rpivid_dec_state *const s)
++{
++	const struct v4l2_ctrl_hevc_slice_params *const sh = s->sh;
++	const struct v4l2_ctrl_hevc_decode_params *const dec = s->dec;
++	int weighted_pred_flag, idx;
++	u16 cmd_slice;
++	unsigned int collocated_from_l0_flag;
++
++	de->num_slice_msgs = 0;
++
++	cmd_slice = 0;
++	if (sh->slice_type == HEVC_SLICE_I)
++		cmd_slice = 1;
++	if (sh->slice_type == HEVC_SLICE_P)
++		cmd_slice = 2;
++	if (sh->slice_type == HEVC_SLICE_B)
++		cmd_slice = 3;
++
++	cmd_slice |= (s->nb_refs[L0] << 2) | (s->nb_refs[L1] << 6) |
++		     (s->max_num_merge_cand << 11);
++
++	collocated_from_l0_flag =
++		!s->slice_temporal_mvp ||
++		sh->slice_type != HEVC_SLICE_B ||
++		(sh->flags & V4L2_HEVC_SLICE_PARAMS_FLAG_COLLOCATED_FROM_L0);
++	cmd_slice |= collocated_from_l0_flag << 14;
++
++	if (sh->slice_type == HEVC_SLICE_P || sh->slice_type == HEVC_SLICE_B) {
++		// Flag to say all reference pictures are from the past
++		const int no_backward_pred_flag =
++			has_backward(dec->dpb, sh->ref_idx_l0, s->nb_refs[L0],
++				     sh->slice_pic_order_cnt) &&
++			has_backward(dec->dpb, sh->ref_idx_l1, s->nb_refs[L1],
++				     sh->slice_pic_order_cnt);
++		cmd_slice |= no_backward_pred_flag << 10;
++		msg_slice(de, cmd_slice);
++
++		if (s->slice_temporal_mvp) {
++			const __u8 *const rpl = collocated_from_l0_flag ?
++						sh->ref_idx_l0 : sh->ref_idx_l1;
++			de->dpbno_col = rpl[sh->collocated_ref_idx];
++			//v4l2_info(&de->ctx->dev->v4l2_dev,
++			//	    "L0=%d col_ref_idx=%d,
++			//          dpb_no=%d\n", collocated_from_l0_flag,
++			//          sh->collocated_ref_idx, de->dpbno_col);
++		}
++
++		// Write reference picture descriptions
++		weighted_pred_flag =
++			sh->slice_type == HEVC_SLICE_P ?
++				!!(s->pps.flags & V4L2_HEVC_PPS_FLAG_WEIGHTED_PRED) :
++				!!(s->pps.flags & V4L2_HEVC_PPS_FLAG_WEIGHTED_BIPRED);
++
++		for (idx = 0; idx < s->nb_refs[L0]; ++idx) {
++			unsigned int dpb_no = sh->ref_idx_l0[idx];
++			//v4l2_info(&de->ctx->dev->v4l2_dev,
++			//	  "L0[%d]=dpb[%d]\n", idx, dpb_no);
++
++			msg_slice(de,
++				  dpb_no |
++				  ((dec->dpb[dpb_no].flags &
++					V4L2_HEVC_DPB_ENTRY_LONG_TERM_REFERENCE) ?
++						 (1 << 4) : 0) |
++				  (weighted_pred_flag ? (3 << 5) : 0));
++			msg_slice(de, dec->dpb[dpb_no].pic_order_cnt_val & 0xffff);
++
++			if (weighted_pred_flag) {
++				const struct v4l2_hevc_pred_weight_table
++					*const w = &sh->pred_weight_table;
++				const int luma_weight_denom =
++					(1 << w->luma_log2_weight_denom);
++				const unsigned int chroma_log2_weight_denom =
++					(w->luma_log2_weight_denom +
++					 w->delta_chroma_log2_weight_denom);
++				const int chroma_weight_denom =
++					(1 << chroma_log2_weight_denom);
++
++				msg_slice(de,
++					  w->luma_log2_weight_denom |
++					  (((w->delta_luma_weight_l0[idx] +
++					     luma_weight_denom) & 0x1ff)
++						 << 3));
++				msg_slice(de, w->luma_offset_l0[idx] & 0xff);
++				msg_slice(de,
++					  chroma_log2_weight_denom |
++					  (((w->delta_chroma_weight_l0[idx][0] +
++					     chroma_weight_denom) & 0x1ff)
++						   << 3));
++				msg_slice(de,
++					  w->chroma_offset_l0[idx][0] & 0xff);
++				msg_slice(de,
++					  chroma_log2_weight_denom |
++					  (((w->delta_chroma_weight_l0[idx][1] +
++					     chroma_weight_denom) & 0x1ff)
++						   << 3));
++				msg_slice(de,
++					  w->chroma_offset_l0[idx][1] & 0xff);
++			}
++		}
++
++		for (idx = 0; idx < s->nb_refs[L1]; ++idx) {
++			unsigned int dpb_no = sh->ref_idx_l1[idx];
++			//v4l2_info(&de->ctx->dev->v4l2_dev,
++			//          "L1[%d]=dpb[%d]\n", idx, dpb_no);
++			msg_slice(de,
++				  dpb_no |
++				  ((dec->dpb[dpb_no].flags &
++					 V4L2_HEVC_DPB_ENTRY_LONG_TERM_REFERENCE) ?
++						 (1 << 4) : 0) |
++					(weighted_pred_flag ? (3 << 5) : 0));
++			msg_slice(de, dec->dpb[dpb_no].pic_order_cnt_val & 0xffff);
++			if (weighted_pred_flag) {
++				const struct v4l2_hevc_pred_weight_table
++					*const w = &sh->pred_weight_table;
++				const int luma_weight_denom =
++					(1 << w->luma_log2_weight_denom);
++				const unsigned int chroma_log2_weight_denom =
++					(w->luma_log2_weight_denom +
++					 w->delta_chroma_log2_weight_denom);
++				const int chroma_weight_denom =
++					(1 << chroma_log2_weight_denom);
++
++				msg_slice(de,
++					  w->luma_log2_weight_denom |
++					  (((w->delta_luma_weight_l1[idx] +
++					     luma_weight_denom) & 0x1ff) << 3));
++				msg_slice(de, w->luma_offset_l1[idx] & 0xff);
++				msg_slice(de,
++					  chroma_log2_weight_denom |
++					  (((w->delta_chroma_weight_l1[idx][0] +
++					     chroma_weight_denom) & 0x1ff)
++							<< 3));
++				msg_slice(de,
++					  w->chroma_offset_l1[idx][0] & 0xff);
++				msg_slice(de,
++					  chroma_log2_weight_denom |
++					  (((w->delta_chroma_weight_l1[idx][1] +
++					     chroma_weight_denom) & 0x1ff)
++						   << 3));
++				msg_slice(de,
++					  w->chroma_offset_l1[idx][1] & 0xff);
++			}
++		}
++	} else {
++		msg_slice(de, cmd_slice);
++	}
++
++	msg_slice(de,
++		  (sh->slice_beta_offset_div2 & 15) |
++		  ((sh->slice_tc_offset_div2 & 15) << 4) |
++		  ((sh->flags &
++		    V4L2_HEVC_SLICE_PARAMS_FLAG_SLICE_DEBLOCKING_FILTER_DISABLED) ?
++						1 << 8 : 0) |
++		  ((sh->flags &
++			  V4L2_HEVC_SLICE_PARAMS_FLAG_SLICE_LOOP_FILTER_ACROSS_SLICES_ENABLED) ?
++						1 << 9 : 0) |
++		  ((s->pps.flags &
++			  V4L2_HEVC_PPS_FLAG_LOOP_FILTER_ACROSS_TILES_ENABLED) ?
++						1 << 10 : 0));
++
++	msg_slice(de, ((sh->slice_cr_qp_offset & 31) << 5) +
++		       (sh->slice_cb_qp_offset & 31)); // CMD_QPOFF
++}
++
++#define CMDS_WRITE_SLICE 1
++static void write_slice(struct rpivid_dec_env *const de,
++			const struct rpivid_dec_state *const s,
++			const u32 slice_const,
++			const unsigned int ctb_col,
++			const unsigned int ctb_row)
++{
++	const unsigned int cs = (1 << s->log2_ctb_size);
++	const unsigned int w_last = s->sps.pic_width_in_luma_samples & (cs - 1);
++	const unsigned int h_last = s->sps.pic_height_in_luma_samples & (cs - 1);
++
++	p1_apb_write(de, RPI_SLICE,
++		     slice_const |
++		     ((ctb_col + 1 < s->ctb_width || !w_last ?
++				cs : w_last) << 17) |
++		     ((ctb_row + 1 < s->ctb_height || !h_last ?
++				cs : h_last) << 24));
++}
++
++#define PAUSE_MODE_WPP  1
++#define PAUSE_MODE_TILE 0xffff
++
++/*
++ * N.B. This can be called to fill in data from the previous slice so must not
++ * use any state data that may change from slice to slice (e.g. qp)
++ */
++#define CMDS_NEW_ENTRY_POINT (6 + CMDS_WRITE_SLICE)
++static void new_entry_point(struct rpivid_dec_env *const de,
++			    const struct rpivid_dec_state *const s,
++			    const bool do_bte,
++			    const bool reset_qp_y,
++			    const u32 pause_mode,
++			    const unsigned int tile_x,
++			    const unsigned int tile_y,
++			    const unsigned int ctb_col,
++			    const unsigned int ctb_row,
++			    const unsigned int slice_qp,
++			    const u32 slice_const)
++{
++	const unsigned int endx = s->col_bd[tile_x + 1] - 1;
++	const unsigned int endy = (pause_mode == PAUSE_MODE_WPP) ?
++		ctb_row : s->row_bd[tile_y + 1] - 1;
++
++	p1_apb_write(de, RPI_TILESTART,
++		     s->col_bd[tile_x] | (s->row_bd[tile_y] << 16));
++	p1_apb_write(de, RPI_TILEEND, endx | (endy << 16));
++
++	if (do_bte)
++		p1_apb_write(de, RPI_BEGINTILEEND, endx | (endy << 16));
++
++	write_slice(de, s, slice_const, endx, endy);
++
++	if (reset_qp_y) {
++		unsigned int sps_qp_bd_offset =
++			6 * s->sps.bit_depth_luma_minus8;
++
++		p1_apb_write(de, RPI_QP, sps_qp_bd_offset + slice_qp);
++	}
++
++	p1_apb_write(de, RPI_MODE,
++		     pause_mode |
++			((endx == s->ctb_width - 1) << 17) |
++			((endy == s->ctb_height - 1) << 18));
++
++	p1_apb_write(de, RPI_CONTROL, (ctb_col << 0) | (ctb_row << 16));
++
++	de->entry_tile_x = tile_x;
++	de->entry_tile_y = tile_y;
++	de->entry_ctb_x = ctb_col;
++	de->entry_ctb_y = ctb_row;
++	de->entry_qp = slice_qp;
++	de->entry_slice = slice_const;
++}
++
++//////////////////////////////////////////////////////////////////////////////
++// Wavefront mode
++
++#define CMDS_WPP_PAUSE 4
++static void wpp_pause(struct rpivid_dec_env *const de, int ctb_row)
++{
++	p1_apb_write(de, RPI_STATUS, (ctb_row << 18) | 0x25);
++	p1_apb_write(de, RPI_TRANSFER, PROB_BACKUP);
++	p1_apb_write(de, RPI_MODE,
++		     ctb_row == de->pic_height_in_ctbs_y - 1 ?
++							0x70000 : 0x30000);
++	p1_apb_write(de, RPI_CONTROL, (ctb_row << 16) + 2);
++}
++
++#define CMDS_WPP_ENTRY_FILL_1 (CMDS_WPP_PAUSE + 2 + CMDS_NEW_ENTRY_POINT)
++static int wpp_entry_fill(struct rpivid_dec_env *const de,
++			  const struct rpivid_dec_state *const s,
++			  const unsigned int last_y)
++{
++	int rv;
++	const unsigned int last_x = s->ctb_width - 1;
++
++	rv = cmds_check_space(de, CMDS_WPP_ENTRY_FILL_1 *
++				  (last_y - de->entry_ctb_y));
++	if (rv)
++		return rv;
++
++	while (de->entry_ctb_y < last_y) {
++		/* wpp_entry_x/y set by wpp_entry_point */
++		if (s->ctb_width > 2)
++			wpp_pause(de, de->entry_ctb_y);
++		p1_apb_write(de, RPI_STATUS,
++			     (de->entry_ctb_y << 18) | (last_x << 5) | 2);
++
++		/* if width == 1 then the saved state is the init one */
++		if (s->ctb_width == 2)
++			p1_apb_write(de, RPI_TRANSFER, PROB_BACKUP);
++		else
++			p1_apb_write(de, RPI_TRANSFER, PROB_RELOAD);
++
++		new_entry_point(de, s, false, true, PAUSE_MODE_WPP,
++				0, 0, 0, de->entry_ctb_y + 1,
++				de->entry_qp, de->entry_slice);
++	}
++	return 0;
++}
++
++static int wpp_end_previous_slice(struct rpivid_dec_env *const de,
++				  const struct rpivid_dec_state *const s)
++{
++	int rv;
++
++	rv = wpp_entry_fill(de, s, s->prev_ctb_y);
++	if (rv)
++		return rv;
++
++	rv = cmds_check_space(de, CMDS_WPP_PAUSE + 2);
++	if (rv)
++		return rv;
++
++	if (de->entry_ctb_x < 2 &&
++	    (de->entry_ctb_y < s->start_ctb_y || s->start_ctb_x > 2) &&
++	    s->ctb_width > 2)
++		wpp_pause(de, s->prev_ctb_y);
++	p1_apb_write(de, RPI_STATUS,
++		     1 | (s->prev_ctb_x << 5) | (s->prev_ctb_y << 18));
++	if (s->start_ctb_x == 2 ||
++	    (s->ctb_width == 2 && de->entry_ctb_y < s->start_ctb_y))
++		p1_apb_write(de, RPI_TRANSFER, PROB_BACKUP);
++	return 0;
++}
++
++/* Only main profile supported so WPP => !Tiles which makes some of the
++ * next chunk code simpler
++ */
++static int wpp_decode_slice(struct rpivid_dec_env *const de,
++			    const struct rpivid_dec_state *const s,
++			    bool last_slice)
++{
++	bool reset_qp_y = true;
++	const bool indep = !s->dependent_slice_segment_flag;
++	int rv;
++
++	if (s->start_ts) {
++		rv = wpp_end_previous_slice(de, s);
++		if (rv)
++			return rv;
++	}
++	pre_slice_decode(de, s);
++
++	rv = cmds_check_space(de,
++			      CMDS_WRITE_BITSTREAM +
++				CMDS_WRITE_PROB +
++				CMDS_PROGRAM_SLICECMDS +
++				CMDS_NEW_SLICE_SEGMENT +
++				CMDS_NEW_ENTRY_POINT);
++	if (rv)
++		return rv;
++
++	rv = write_bitstream(de, s);
++	if (rv)
++		return rv;
++
++	if (!s->start_ts || indep || s->ctb_width == 1)
++		write_prob(de, s);
++	else if (!s->start_ctb_x)
++		p1_apb_write(de, RPI_TRANSFER, PROB_RELOAD);
++	else
++		reset_qp_y = false;
++
++	program_slicecmds(de, s->slice_idx);
++	new_slice_segment(de, s);
++	new_entry_point(de, s, indep, reset_qp_y, PAUSE_MODE_WPP,
++			0, 0, s->start_ctb_x, s->start_ctb_y,
++			s->slice_qp, slice_reg_const(s));
++
++	if (last_slice) {
++		rv = wpp_entry_fill(de, s, s->ctb_height - 1);
++		if (rv)
++			return rv;
++
++		rv = cmds_check_space(de, CMDS_WPP_PAUSE + 1);
++		if (rv)
++			return rv;
++
++		if (de->entry_ctb_x < 2 && s->ctb_width > 2)
++			wpp_pause(de, s->ctb_height - 1);
++
++		p1_apb_write(de, RPI_STATUS,
++			     1 | ((s->ctb_width - 1) << 5) |
++				((s->ctb_height - 1) << 18));
++	}
++	return 0;
++}
++
++//////////////////////////////////////////////////////////////////////////////
++// Tiles mode
++
++// Guarantees 1 cmd entry free on exit
++static int tile_entry_fill(struct rpivid_dec_env *const de,
++			   const struct rpivid_dec_state *const s,
++			   const unsigned int last_tile_x,
++			   const unsigned int last_tile_y)
++{
++	while (de->entry_tile_y < last_tile_y ||
++	       (de->entry_tile_y == last_tile_y &&
++		de->entry_tile_x < last_tile_x)) {
++		int rv;
++		unsigned int t_x = de->entry_tile_x;
++		unsigned int t_y = de->entry_tile_y;
++		const unsigned int last_x = s->col_bd[t_x + 1] - 1;
++		const unsigned int last_y = s->row_bd[t_y + 1] - 1;
++
++		// One more than needed here
++		rv = cmds_check_space(de, CMDS_NEW_ENTRY_POINT + 3);
++		if (rv)
++			return rv;
++
++		p1_apb_write(de, RPI_STATUS,
++			     2 | (last_x << 5) | (last_y << 18));
++		p1_apb_write(de, RPI_TRANSFER, PROB_RELOAD);
++
++		// Inc tile
++		if (++t_x >= s->tile_width) {
++			t_x = 0;
++			++t_y;
++		}
++
++		new_entry_point(de, s, false, true, PAUSE_MODE_TILE,
++				t_x, t_y, s->col_bd[t_x], s->row_bd[t_y],
++				de->entry_qp, de->entry_slice);
++	}
++	return 0;
++}
++
++/*
++ * Write STATUS register with expected end CTU address of previous slice
++ */
++static int end_previous_slice(struct rpivid_dec_env *const de,
++			      const struct rpivid_dec_state *const s)
++{
++	int rv;
++
++	rv = tile_entry_fill(de, s,
++			     ctb_to_tile_x(s, s->prev_ctb_x),
++			     ctb_to_tile_y(s, s->prev_ctb_y));
++	if (rv)
++		return rv;
++
++	p1_apb_write(de, RPI_STATUS,
++		     1 | (s->prev_ctb_x << 5) | (s->prev_ctb_y << 18));
++	return 0;
++}
++
++static int decode_slice(struct rpivid_dec_env *const de,
++			const struct rpivid_dec_state *const s,
++			bool last_slice)
++{
++	bool reset_qp_y;
++	unsigned int tile_x = ctb_to_tile_x(s, s->start_ctb_x);
++	unsigned int tile_y = ctb_to_tile_y(s, s->start_ctb_y);
++	int rv;
++
++	if (s->start_ts) {
++		rv = end_previous_slice(de, s);
++		if (rv)
++			return rv;
++	}
++
++	rv = cmds_check_space(de,
++			      CMDS_WRITE_BITSTREAM +
++				CMDS_WRITE_PROB +
++				CMDS_PROGRAM_SLICECMDS +
++				CMDS_NEW_SLICE_SEGMENT +
++				CMDS_NEW_ENTRY_POINT);
++	if (rv)
++		return rv;
++
++	pre_slice_decode(de, s);
++	rv = write_bitstream(de, s);
++	if (rv)
++		return rv;
++
++	reset_qp_y = !s->start_ts ||
++		!s->dependent_slice_segment_flag ||
++		tile_x != ctb_to_tile_x(s, s->prev_ctb_x) ||
++		tile_y != ctb_to_tile_y(s, s->prev_ctb_y);
++	if (reset_qp_y)
++		write_prob(de, s);
++
++	program_slicecmds(de, s->slice_idx);
++	new_slice_segment(de, s);
++	new_entry_point(de, s, !s->dependent_slice_segment_flag, reset_qp_y,
++			PAUSE_MODE_TILE,
++			tile_x, tile_y, s->start_ctb_x, s->start_ctb_y,
++			s->slice_qp, slice_reg_const(s));
++
++	/*
++	 * If this is the last slice then fill in the other tile entries
++	 * now, otherwise this will be done at the start of the next slice
++	 * when it will be known where this slice finishes
++	 */
++	if (last_slice) {
++		rv = tile_entry_fill(de, s,
++				     s->tile_width - 1,
++				     s->tile_height - 1);
++		if (rv)
++			return rv;
++		p1_apb_write(de, RPI_STATUS,
++			     1 | ((s->ctb_width - 1) << 5) |
++				((s->ctb_height - 1) << 18));
++	}
++	return 0;
++}
++
++//////////////////////////////////////////////////////////////////////////////
++// Scaling factors
++
++static void expand_scaling_list(const unsigned int size_id,
++				u8 *const dst0,
++				const u8 *const src0, uint8_t dc)
++{
++	u8 *d;
++	unsigned int x, y;
++
++	switch (size_id) {
++	case 0:
++		memcpy(dst0, src0, 16);
++		break;
++	case 1:
++		memcpy(dst0, src0, 64);
++		break;
++	case 2:
++		d = dst0;
++
++		for (y = 0; y != 16; y++) {
++			const u8 *s = src0 + (y >> 1) * 8;
++
++			for (x = 0; x != 8; ++x) {
++				*d++ = *s;
++				*d++ = *s++;
++			}
++		}
++		dst0[0] = dc;
++		break;
++	default:
++		d = dst0;
++
++		for (y = 0; y != 32; y++) {
++			const u8 *s = src0 + (y >> 2) * 8;
++
++			for (x = 0; x != 8; ++x) {
++				*d++ = *s;
++				*d++ = *s;
++				*d++ = *s;
++				*d++ = *s++;
++			}
++		}
++		dst0[0] = dc;
++		break;
++	}
++}
++
++static void populate_scaling_factors(const struct rpivid_run *const run,
++				     struct rpivid_dec_env *const de,
++				     const struct rpivid_dec_state *const s)
++{
++	const struct v4l2_ctrl_hevc_scaling_matrix *const sl =
++		run->h265.scaling_matrix;
++	// Array of constants for scaling factors
++	static const u32 scaling_factor_offsets[4][6] = {
++		// MID0    MID1    MID2    MID3    MID4    MID5
++		// SID0 (4x4)
++		{ 0x0000, 0x0010, 0x0020, 0x0030, 0x0040, 0x0050 },
++		// SID1 (8x8)
++		{ 0x0060, 0x00A0, 0x00E0, 0x0120, 0x0160, 0x01A0 },
++		// SID2 (16x16)
++		{ 0x01E0, 0x02E0, 0x03E0, 0x04E0, 0x05E0, 0x06E0 },
++		// SID3 (32x32)
++		{ 0x07E0, 0x0BE0, 0x0000, 0x0000, 0x0000, 0x0000 }
++	};
++
++	unsigned int mid;
++
++	for (mid = 0; mid < 6; mid++)
++		expand_scaling_list(0, de->scaling_factors +
++					    scaling_factor_offsets[0][mid],
++				    sl->scaling_list_4x4[mid], 0);
++	for (mid = 0; mid < 6; mid++)
++		expand_scaling_list(1, de->scaling_factors +
++					    scaling_factor_offsets[1][mid],
++				    sl->scaling_list_8x8[mid], 0);
++	for (mid = 0; mid < 6; mid++)
++		expand_scaling_list(2, de->scaling_factors +
++					    scaling_factor_offsets[2][mid],
++				    sl->scaling_list_16x16[mid],
++				    sl->scaling_list_dc_coef_16x16[mid]);
++	for (mid = 0; mid < 2; mid++)
++		expand_scaling_list(3, de->scaling_factors +
++					    scaling_factor_offsets[3][mid],
++				    sl->scaling_list_32x32[mid],
++				    sl->scaling_list_dc_coef_32x32[mid]);
++}
++
++static void free_ps_info(struct rpivid_dec_state *const s)
++{
++	kfree(s->ctb_addr_rs_to_ts);
++	s->ctb_addr_rs_to_ts = NULL;
++	kfree(s->ctb_addr_ts_to_rs);
++	s->ctb_addr_ts_to_rs = NULL;
++
++	kfree(s->col_bd);
++	s->col_bd = NULL;
++	kfree(s->row_bd);
++	s->row_bd = NULL;
++}
++
++static unsigned int tile_width(const struct rpivid_dec_state *const s,
++			       const unsigned int t_x)
++{
++	return s->col_bd[t_x + 1] - s->col_bd[t_x];
++}
++
++static unsigned int tile_height(const struct rpivid_dec_state *const s,
++				const unsigned int t_y)
++{
++	return s->row_bd[t_y + 1] - s->row_bd[t_y];
++}
++
++static void fill_rs_to_ts(struct rpivid_dec_state *const s)
++{
++	unsigned int ts = 0;
++	unsigned int t_y;
++	unsigned int tr_rs = 0;
++
++	for (t_y = 0; t_y != s->tile_height; ++t_y) {
++		const unsigned int t_h = tile_height(s, t_y);
++		unsigned int t_x;
++		unsigned int tc_rs = tr_rs;
++
++		for (t_x = 0; t_x != s->tile_width; ++t_x) {
++			const unsigned int t_w = tile_width(s, t_x);
++			unsigned int y;
++			unsigned int rs = tc_rs;
++
++			for (y = 0; y != t_h; ++y) {
++				unsigned int x;
++
++				for (x = 0; x != t_w; ++x) {
++					s->ctb_addr_rs_to_ts[rs + x] = ts;
++					s->ctb_addr_ts_to_rs[ts] = rs + x;
++					++ts;
++				}
++				rs += s->ctb_width;
++			}
++			tc_rs += t_w;
++		}
++		tr_rs += t_h * s->ctb_width;
++	}
++}
++
++static int updated_ps(struct rpivid_dec_state *const s)
++{
++	unsigned int i;
++
++	free_ps_info(s);
++
++	// Inferred parameters
++	s->log2_ctb_size = s->sps.log2_min_luma_coding_block_size_minus3 + 3 +
++			   s->sps.log2_diff_max_min_luma_coding_block_size;
++
++	s->ctb_width = (s->sps.pic_width_in_luma_samples +
++			(1 << s->log2_ctb_size) - 1) >>
++		       s->log2_ctb_size;
++	s->ctb_height = (s->sps.pic_height_in_luma_samples +
++			 (1 << s->log2_ctb_size) - 1) >>
++			s->log2_ctb_size;
++	s->ctb_size = s->ctb_width * s->ctb_height;
++
++	// Inferred parameters
++
++	s->ctb_addr_rs_to_ts = kmalloc_array(s->ctb_size,
++					     sizeof(*s->ctb_addr_rs_to_ts),
++					     GFP_KERNEL);
++	if (!s->ctb_addr_rs_to_ts)
++		goto fail;
++	s->ctb_addr_ts_to_rs = kmalloc_array(s->ctb_size,
++					     sizeof(*s->ctb_addr_ts_to_rs),
++					     GFP_KERNEL);
++	if (!s->ctb_addr_ts_to_rs)
++		goto fail;
++
++	if (!(s->pps.flags & V4L2_HEVC_PPS_FLAG_TILES_ENABLED)) {
++		s->tile_width = 1;
++		s->tile_height = 1;
++	} else {
++		s->tile_width = s->pps.num_tile_columns_minus1 + 1;
++		s->tile_height = s->pps.num_tile_rows_minus1 + 1;
++	}
++
++	s->col_bd = kmalloc((s->tile_width + 1) * sizeof(*s->col_bd),
++			    GFP_KERNEL);
++	if (!s->col_bd)
++		goto fail;
++	s->row_bd = kmalloc((s->tile_height + 1) * sizeof(*s->row_bd),
++			    GFP_KERNEL);
++	if (!s->row_bd)
++		goto fail;
++
++	s->col_bd[0] = 0;
++	for (i = 1; i < s->tile_width; i++)
++		s->col_bd[i] = s->col_bd[i - 1] +
++			s->pps.column_width_minus1[i - 1] + 1;
++	s->col_bd[s->tile_width] = s->ctb_width;
++
++	s->row_bd[0] = 0;
++	for (i = 1; i < s->tile_height; i++)
++		s->row_bd[i] = s->row_bd[i - 1] +
++			s->pps.row_height_minus1[i - 1] + 1;
++	s->row_bd[s->tile_height] = s->ctb_height;
++
++	fill_rs_to_ts(s);
++	return 0;
++
++fail:
++	free_ps_info(s);
++	/* Set invalid to force reload */
++	s->sps.pic_width_in_luma_samples = 0;
++	return -ENOMEM;
++}
++
++static int write_cmd_buffer(struct rpivid_dev *const dev,
++			    struct rpivid_dec_env *const de,
++			    const struct rpivid_dec_state *const s)
++{
++	const size_t cmd_size = ALIGN(de->cmd_len * sizeof(de->cmd_fifo[0]),
++				      dev->cache_align);
++
++	de->cmd_addr = dma_map_single(dev->dev, de->cmd_fifo,
++				      cmd_size, DMA_TO_DEVICE);
++	if (dma_mapping_error(dev->dev, de->cmd_addr)) {
++		v4l2_err(&dev->v4l2_dev,
++			 "Map cmd buffer (%zu): FAILED\n", cmd_size);
++		return -ENOMEM;
++	}
++	de->cmd_size = cmd_size;
++	return 0;
++}
++
++static void setup_colmv(struct rpivid_ctx *const ctx, struct rpivid_run *run,
++			struct rpivid_dec_state *const s)
++{
++	ctx->colmv_stride = ALIGN(s->sps.pic_width_in_luma_samples, 64);
++	ctx->colmv_picsize = ctx->colmv_stride *
++		(ALIGN(s->sps.pic_height_in_luma_samples, 64) >> 4);
++}
++
++// Can be called from irq context
++static struct rpivid_dec_env *dec_env_new(struct rpivid_ctx *const ctx)
++{
++	struct rpivid_dec_env *de;
++	unsigned long lock_flags;
++
++	spin_lock_irqsave(&ctx->dec_lock, lock_flags);
++
++	de = ctx->dec_free;
++	if (de) {
++		ctx->dec_free = de->next;
++		de->next = NULL;
++		de->state = RPIVID_DECODE_SLICE_START;
++	}
++
++	spin_unlock_irqrestore(&ctx->dec_lock, lock_flags);
++	return de;
++}
++
++// Can be called from irq context
++static void dec_env_delete(struct rpivid_dec_env *const de)
++{
++	struct rpivid_ctx * const ctx = de->ctx;
++	unsigned long lock_flags;
++
++	if (de->cmd_size) {
++		dma_unmap_single(ctx->dev->dev, de->cmd_addr, de->cmd_size,
++				 DMA_TO_DEVICE);
++		de->cmd_size = 0;
++	}
++
++	aux_q_release(ctx, &de->frame_aux);
++	aux_q_release(ctx, &de->col_aux);
++
++	spin_lock_irqsave(&ctx->dec_lock, lock_flags);
++
++	de->state = RPIVID_DECODE_END;
++	de->next = ctx->dec_free;
++	ctx->dec_free = de;
++
++	spin_unlock_irqrestore(&ctx->dec_lock, lock_flags);
++}
++
++static void dec_env_uninit(struct rpivid_ctx *const ctx)
++{
++	unsigned int i;
++
++	if (ctx->dec_pool) {
++		for (i = 0; i != RPIVID_DEC_ENV_COUNT; ++i) {
++			struct rpivid_dec_env *const de = ctx->dec_pool + i;
++
++			kfree(de->cmd_fifo);
++		}
++
++		kfree(ctx->dec_pool);
++	}
++
++	ctx->dec_pool = NULL;
++	ctx->dec_free = NULL;
++}
++
++static int dec_env_init(struct rpivid_ctx *const ctx)
++{
++	unsigned int i;
++
++	ctx->dec_pool = kzalloc(sizeof(*ctx->dec_pool) * RPIVID_DEC_ENV_COUNT,
++				GFP_KERNEL);
++	if (!ctx->dec_pool)
++		return -1;
++
++	spin_lock_init(&ctx->dec_lock);
++
++	// Build free chain
++	ctx->dec_free = ctx->dec_pool;
++	for (i = 0; i != RPIVID_DEC_ENV_COUNT - 1; ++i)
++		ctx->dec_pool[i].next = ctx->dec_pool + i + 1;
++
++	// Fill in other bits
++	for (i = 0; i != RPIVID_DEC_ENV_COUNT; ++i) {
++		struct rpivid_dec_env *const de = ctx->dec_pool + i;
++
++		de->ctx = ctx;
++		de->decode_order = i;
++//		de->cmd_max = 1024;
++		de->cmd_max = 8096;
++		de->cmd_fifo = kmalloc_array(de->cmd_max,
++					     sizeof(struct rpi_cmd),
++					     GFP_KERNEL);
++		if (!de->cmd_fifo)
++			goto fail;
++	}
++
++	return 0;
++
++fail:
++	dec_env_uninit(ctx);
++	return -1;
++}
++
++// Assume that we get exactly the same DPB for every slice
++// it makes no real sense otherwise
++#if V4L2_HEVC_DPB_ENTRIES_NUM_MAX > 16
++#error HEVC_DPB_ENTRIES > h/w slots
++#endif
++
++static u32 mk_config2(const struct rpivid_dec_state *const s)
++{
++	const struct v4l2_ctrl_hevc_sps *const sps = &s->sps;
++	const struct v4l2_ctrl_hevc_pps *const pps = &s->pps;
++	u32 c;
++	// BitDepthY
++	c = (sps->bit_depth_luma_minus8 + 8) << 0;
++	 // BitDepthC
++	c |= (sps->bit_depth_chroma_minus8 + 8) << 4;
++	 // BitDepthY
++	if (sps->bit_depth_luma_minus8)
++		c |= BIT(8);
++	// BitDepthC
++	if (sps->bit_depth_chroma_minus8)
++		c |= BIT(9);
++	c |= s->log2_ctb_size << 10;
++	if (pps->flags & V4L2_HEVC_PPS_FLAG_CONSTRAINED_INTRA_PRED)
++		c |= BIT(13);
++	if (sps->flags & V4L2_HEVC_SPS_FLAG_STRONG_INTRA_SMOOTHING_ENABLED)
++		c |= BIT(14);
++	if (s->mk_aux)
++		c |= BIT(15); /* Write motion vectors to external memory */
++	c |= (pps->log2_parallel_merge_level_minus2 + 2) << 16;
++	if (s->slice_temporal_mvp)
++		c |= BIT(19);
++	if (sps->flags & V4L2_HEVC_SPS_FLAG_PCM_LOOP_FILTER_DISABLED)
++		c |= BIT(20);
++	c |= (pps->pps_cb_qp_offset & 31) << 21;
++	c |= (pps->pps_cr_qp_offset & 31) << 26;
++	return c;
++}
++
++static inline bool is_ref_unit_type(const unsigned int nal_unit_type)
++{
++	/* From Table 7-1
++	 * True for 1, 3, 5, 7, 9, 11, 13, 15
++	 */
++	return (nal_unit_type & ~0xe) != 0;
++}
++
++static void rpivid_h265_setup(struct rpivid_ctx *ctx, struct rpivid_run *run)
++{
++	struct rpivid_dev *const dev = ctx->dev;
++	const struct v4l2_ctrl_hevc_decode_params *const dec =
++						run->h265.dec;
++	/* sh0 used where slice header contents should be constant over all
++	 * slices, or first slice of frame
++	 */
++	const struct v4l2_ctrl_hevc_slice_params *const sh0 =
++					run->h265.slice_params;
++	struct rpivid_q_aux *dpb_q_aux[V4L2_HEVC_DPB_ENTRIES_NUM_MAX];
++	struct rpivid_dec_state *const s = ctx->state;
++	struct vb2_queue *vq;
++	struct rpivid_dec_env *de = ctx->dec0;
++	unsigned int prev_rs;
++	unsigned int i;
++	int rv;
++	bool slice_temporal_mvp;
++	bool frame_end;
++
++	xtrace_in(dev, de);
++	s->sh = NULL;  // Avoid use until in the slice loop
++
++	frame_end =
++		((run->src->flags & V4L2_BUF_FLAG_M2M_HOLD_CAPTURE_BUF) == 0);
++
++	slice_temporal_mvp = (sh0->flags &
++		   V4L2_HEVC_SLICE_PARAMS_FLAG_SLICE_TEMPORAL_MVP_ENABLED);
++
++	if (de && de->state != RPIVID_DECODE_END) {
++		switch (de->state) {
++		case RPIVID_DECODE_SLICE_CONTINUE:
++			// Expected state
++			break;
++		default:
++			v4l2_err(&dev->v4l2_dev, "%s: Unexpected state: %d\n",
++				 __func__, de->state);
++			fallthrough;
++		case RPIVID_DECODE_ERROR_CONTINUE:
++			// Uncleared error - fail now
++			goto fail;
++		}
++
++		if (s->slice_temporal_mvp != slice_temporal_mvp) {
++			v4l2_warn(&dev->v4l2_dev,
++				  "Slice Temporal MVP non-constant\n");
++			goto fail;
++		}
++	} else {
++		/* Frame start */
++		unsigned int ctb_size_y;
++		bool sps_changed = false;
++
++		if (memcmp(&s->sps, run->h265.sps, sizeof(s->sps)) != 0) {
++			/* SPS changed */
++			v4l2_info(&dev->v4l2_dev, "SPS changed\n");
++			memcpy(&s->sps, run->h265.sps, sizeof(s->sps));
++			sps_changed = true;
++		}
++		if (sps_changed ||
++		    memcmp(&s->pps, run->h265.pps, sizeof(s->pps)) != 0) {
++			/* SPS changed */
++			v4l2_info(&dev->v4l2_dev, "PPS changed\n");
++			memcpy(&s->pps, run->h265.pps, sizeof(s->pps));
++
++			/* Recalc stuff as required */
++			rv = updated_ps(s);
++			if (rv)
++				goto fail;
++		}
++
++		de = dec_env_new(ctx);
++		if (!de) {
++			v4l2_err(&dev->v4l2_dev,
++				 "Failed to find free decode env\n");
++			goto fail;
++		}
++		ctx->dec0 = de;
++
++		ctb_size_y =
++			1U << (s->sps.log2_min_luma_coding_block_size_minus3 +
++			       3 +
++			       s->sps.log2_diff_max_min_luma_coding_block_size);
++
++		de->pic_width_in_ctbs_y =
++			(s->sps.pic_width_in_luma_samples + ctb_size_y - 1) /
++				ctb_size_y; // 7-15
++		de->pic_height_in_ctbs_y =
++			(s->sps.pic_height_in_luma_samples + ctb_size_y - 1) /
++				ctb_size_y; // 7-17
++		de->cmd_len = 0;
++		de->dpbno_col = ~0U;
++
++		de->bit_copy_gptr = ctx->bitbufs + ctx->p1idx;
++		de->bit_copy_len = 0;
++
++		de->frame_c_offset = ctx->dst_fmt.height * 128;
++		de->frame_stride = ctx->dst_fmt.plane_fmt[0].bytesperline * 128;
++		de->frame_addr =
++			vb2_dma_contig_plane_dma_addr(&run->dst->vb2_buf, 0);
++		de->frame_aux = NULL;
++
++		if (s->sps.bit_depth_luma_minus8 !=
++		    s->sps.bit_depth_chroma_minus8) {
++			v4l2_warn(&dev->v4l2_dev,
++				  "Chroma depth (%d) != Luma depth (%d)\n",
++				  s->sps.bit_depth_chroma_minus8 + 8,
++				  s->sps.bit_depth_luma_minus8 + 8);
++			goto fail;
++		}
++		if (s->sps.bit_depth_luma_minus8 == 0) {
++			if (ctx->dst_fmt.pixelformat !=
++						V4L2_PIX_FMT_NV12_COL128) {
++				v4l2_err(&dev->v4l2_dev,
++					 "Pixel format %#x != NV12_COL128 for 8-bit output",
++					 ctx->dst_fmt.pixelformat);
++				goto fail;
++			}
++		} else if (s->sps.bit_depth_luma_minus8 == 2) {
++			if (ctx->dst_fmt.pixelformat !=
++						V4L2_PIX_FMT_NV12_10_COL128) {
++				v4l2_err(&dev->v4l2_dev,
++					 "Pixel format %#x != NV12_10_COL128 for 10-bit output",
++					 ctx->dst_fmt.pixelformat);
++				goto fail;
++			}
++		} else {
++			v4l2_warn(&dev->v4l2_dev,
++				  "Luma depth (%d) unsupported\n",
++				  s->sps.bit_depth_luma_minus8 + 8);
++			goto fail;
++		}
++		if (run->dst->vb2_buf.num_planes != 1) {
++			v4l2_warn(&dev->v4l2_dev, "Capture planes (%d) != 1\n",
++				  run->dst->vb2_buf.num_planes);
++			goto fail;
++		}
++		if (run->dst->planes[0].length <
++		    ctx->dst_fmt.plane_fmt[0].sizeimage) {
++			v4l2_warn(&dev->v4l2_dev,
++				  "Capture plane[0] length (%d) < sizeimage (%d)\n",
++				  run->dst->planes[0].length,
++				  ctx->dst_fmt.plane_fmt[0].sizeimage);
++			goto fail;
++		}
++
++		// Fill in ref planes with our address s.t. if we mess
++		// up refs somehow then we still have a valid address
++		// entry
++		for (i = 0; i != 16; ++i)
++			de->ref_addrs[i] = de->frame_addr;
++
++		/*
++		 * Stash initial temporal_mvp flag
++		 * This must be the same for all pic slices (7.4.7.1)
++		 */
++		s->slice_temporal_mvp = slice_temporal_mvp;
++
++		/*
++		 * Need Aux ents for all (ref) DPB ents if temporal MV could
++		 * be enabled for any pic
++		 */
++		s->use_aux = ((s->sps.flags &
++			       V4L2_HEVC_SPS_FLAG_SPS_TEMPORAL_MVP_ENABLED) != 0);
++		s->mk_aux = s->use_aux &&
++			    (s->sps.sps_max_sub_layers_minus1 >= sh0->nuh_temporal_id_plus1 ||
++			     is_ref_unit_type(sh0->nal_unit_type));
++
++		// Phase 2 reg pre-calc
++		de->rpi_config2 = mk_config2(s);
++		de->rpi_framesize = (s->sps.pic_height_in_luma_samples << 16) |
++				    s->sps.pic_width_in_luma_samples;
++		de->rpi_currpoc = sh0->slice_pic_order_cnt;
++
++		if (s->sps.flags &
++		    V4L2_HEVC_SPS_FLAG_SPS_TEMPORAL_MVP_ENABLED) {
++			setup_colmv(ctx, run, s);
++		}
++
++		s->slice_idx = 0;
++
++		if (sh0->slice_segment_addr != 0) {
++			v4l2_warn(&dev->v4l2_dev,
++				  "New frame but segment_addr=%d\n",
++				  sh0->slice_segment_addr);
++			goto fail;
++		}
++
++		/* Allocate a bitbuf if we need one - don't need one if single
++		 * slice as we can use the src buf directly
++		 */
++		if (!frame_end && !de->bit_copy_gptr->ptr) {
++			size_t bits_alloc;
++			bits_alloc = rpivid_bit_buf_size(s->sps.pic_width_in_luma_samples,
++							 s->sps.pic_height_in_luma_samples,
++							 s->sps.bit_depth_luma_minus8);
++
++			if (gptr_alloc(dev, de->bit_copy_gptr,
++				       bits_alloc,
++				       DMA_ATTR_FORCE_CONTIGUOUS) != 0) {
++				v4l2_err(&dev->v4l2_dev,
++					 "Unable to alloc buf (%zu) for bit copy\n",
++					 bits_alloc);
++				goto fail;
++			}
++			v4l2_info(&dev->v4l2_dev,
++				  "Alloc buf (%zu) for bit copy OK\n",
++				  bits_alloc);
++		}
++	}
++
++	// Either map src buffer or use directly
++	s->src_addr = 0;
++	s->src_buf = NULL;
++
++	if (frame_end)
++		s->src_addr = vb2_dma_contig_plane_dma_addr(&run->src->vb2_buf,
++							    0);
++	if (!s->src_addr)
++		s->src_buf = vb2_plane_vaddr(&run->src->vb2_buf, 0);
++	if (!s->src_addr && !s->src_buf) {
++		v4l2_err(&dev->v4l2_dev, "Failed to map src buffer\n");
++		goto fail;
++	}
++
++	// Pre calc a few things
++	s->dec = dec;
++	for (i = 0; i != run->h265.slice_ents; ++i) {
++		const struct v4l2_ctrl_hevc_slice_params *const sh = sh0 + i;
++		const bool last_slice = frame_end && i + 1 == run->h265.slice_ents;
++
++		s->sh = sh;
++
++		if (run->src->planes[0].bytesused < (sh->bit_size + 7) / 8) {
++			v4l2_warn(&dev->v4l2_dev,
++				  "Bit size %d > bytesused %d\n",
++				  sh->bit_size, run->src->planes[0].bytesused);
++			goto fail;
++		}
++		if (sh->data_byte_offset >= sh->bit_size / 8) {
++			v4l2_warn(&dev->v4l2_dev,
++				  "Bit size %u < Byte offset %u * 8\n",
++				  sh->bit_size, sh->data_byte_offset);
++			goto fail;
++		}
++
++		s->slice_qp = 26 + s->pps.init_qp_minus26 + sh->slice_qp_delta;
++		s->max_num_merge_cand = sh->slice_type == HEVC_SLICE_I ?
++						0 :
++						(5 - sh->five_minus_max_num_merge_cand);
++		s->dependent_slice_segment_flag =
++			((sh->flags &
++			  V4L2_HEVC_SLICE_PARAMS_FLAG_DEPENDENT_SLICE_SEGMENT) != 0);
++
++		s->nb_refs[0] = (sh->slice_type == HEVC_SLICE_I) ?
++					0 :
++					sh->num_ref_idx_l0_active_minus1 + 1;
++		s->nb_refs[1] = (sh->slice_type != HEVC_SLICE_B) ?
++					0 :
++					sh->num_ref_idx_l1_active_minus1 + 1;
++
++		if (s->sps.flags & V4L2_HEVC_SPS_FLAG_SCALING_LIST_ENABLED)
++			populate_scaling_factors(run, de, s);
++
++		/* Calc all the random coord info to avoid repeated conversion in/out */
++		s->start_ts = s->ctb_addr_rs_to_ts[sh->slice_segment_addr];
++		s->start_ctb_x = sh->slice_segment_addr % de->pic_width_in_ctbs_y;
++		s->start_ctb_y = sh->slice_segment_addr / de->pic_width_in_ctbs_y;
++		/* Last CTB of previous slice */
++		prev_rs = !s->start_ts ? 0 : s->ctb_addr_ts_to_rs[s->start_ts - 1];
++		s->prev_ctb_x = prev_rs % de->pic_width_in_ctbs_y;
++		s->prev_ctb_y = prev_rs / de->pic_width_in_ctbs_y;
++
++		if ((s->pps.flags & V4L2_HEVC_PPS_FLAG_ENTROPY_CODING_SYNC_ENABLED))
++			rv = wpp_decode_slice(de, s, last_slice);
++		else
++			rv = decode_slice(de, s, last_slice);
++		if (rv)
++			goto fail;
++
++		++s->slice_idx;
++	}
++
++	if (!frame_end) {
++		xtrace_ok(dev, de);
++		return;
++	}
++
++	// Frame end
++	memset(dpb_q_aux, 0,
++	       sizeof(*dpb_q_aux) * V4L2_HEVC_DPB_ENTRIES_NUM_MAX);
++
++	// Locate ref frames
++	// At least in the current implementation this is constant across all
++	// slices. If this changes we will need idx mapping code.
++	// Uses sh so here rather than trigger
++
++	vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx,
++			     V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
++
++	if (!vq) {
++		v4l2_err(&dev->v4l2_dev, "VQ gone!\n");
++		goto fail;
++	}
++
++	//        v4l2_info(&dev->v4l2_dev, "rpivid_h265_end of frame\n");
++	if (write_cmd_buffer(dev, de, s))
++		goto fail;
++
++	for (i = 0; i < dec->num_active_dpb_entries; ++i) {
++		struct vb2_buffer *buf = vb2_find_buffer(vq, dec->dpb[i].timestamp);
++		if (!buf) {
++			v4l2_warn(&dev->v4l2_dev,
++				  "Missing DPB ent %d, timestamp=%lld\n",
++				  i, (long long)dec->dpb[i].timestamp);
++			continue;
++		}
++
++		if (s->use_aux) {
++			int buffer_index = buf->index;
++			dpb_q_aux[i] = aux_q_ref_idx(ctx, buffer_index);
++			if (!dpb_q_aux[i])
++				v4l2_warn(&dev->v4l2_dev,
++					  "Missing DPB AUX ent %d, timestamp=%lld, index=%d\n",
++					  i, (long long)dec->dpb[i].timestamp,
++					  buffer_index);
++		}
++
++		de->ref_addrs[i] =
++			vb2_dma_contig_plane_dma_addr(buf, 0);
++	}
++
++	// Move DPB from temp
++	for (i = 0; i != V4L2_HEVC_DPB_ENTRIES_NUM_MAX; ++i) {
++		aux_q_release(ctx, &s->ref_aux[i]);
++		s->ref_aux[i] = dpb_q_aux[i];
++	}
++	// Unref the old frame aux too - it is either in the DPB or not
++	// now
++	aux_q_release(ctx, &s->frame_aux);
++
++	if (s->mk_aux) {
++		s->frame_aux = aux_q_new(ctx, run->dst->vb2_buf.index);
++
++		if (!s->frame_aux) {
++			v4l2_err(&dev->v4l2_dev,
++				 "Failed to obtain aux storage for frame\n");
++			goto fail;
++		}
++
++		de->frame_aux = aux_q_ref(ctx, s->frame_aux);
++	}
++
++	if (de->dpbno_col != ~0U) {
++		if (de->dpbno_col >= dec->num_active_dpb_entries) {
++			v4l2_err(&dev->v4l2_dev,
++				 "Col ref index %d >= %d\n",
++				 de->dpbno_col,
++				 dec->num_active_dpb_entries);
++		} else {
++			// Standard requires that the col pic is
++			// constant for the duration of the pic
++			// (text of collocated_ref_idx in H265-2 2018
++			// 7.4.7.1)
++
++			// Spot the collocated ref in passing
++			de->col_aux = aux_q_ref(ctx,
++						dpb_q_aux[de->dpbno_col]);
++
++			if (!de->col_aux) {
++				v4l2_warn(&dev->v4l2_dev,
++					  "Missing DPB ent for col\n");
++				// Probably need to abort if this fails
++				// as P2 may explode on bad data
++				goto fail;
++			}
++		}
++	}
++
++	de->state = RPIVID_DECODE_PHASE1;
++	xtrace_ok(dev, de);
++	return;
++
++fail:
++	if (de)
++		// Actual error reporting happens in Trigger
++		de->state = frame_end ? RPIVID_DECODE_ERROR_DONE :
++					RPIVID_DECODE_ERROR_CONTINUE;
++	xtrace_fail(dev, de);
++}
++
++//////////////////////////////////////////////////////////////////////////////
++// Handle PU and COEFF stream overflow
++
++// Returns:
++// -1  Phase 1 decode error
++//  0  OK
++// >0  Out of space (bitmask)
++
++#define STATUS_COEFF_EXHAUSTED	8
++#define STATUS_PU_EXHAUSTED	16
++
++static int check_status(const struct rpivid_dev *const dev)
++{
++	const u32 cfstatus = apb_read(dev, RPI_CFSTATUS);
++	const u32 cfnum = apb_read(dev, RPI_CFNUM);
++	u32 status = apb_read(dev, RPI_STATUS);
++
++	// Handle PU and COEFF stream overflow
++
++	// this is the definition of successful completion of phase 1
++	// it assures that status register is zero and all blocks in each tile
++	// have completed
++	if (cfstatus == cfnum)
++		return 0;	//No error
++
++	status &= (STATUS_PU_EXHAUSTED | STATUS_COEFF_EXHAUSTED);
++	if (status)
++		return status;
++
++	return -1;
++}
++
++static void phase2_cb(struct rpivid_dev *const dev, void *v)
++{
++	struct rpivid_dec_env *const de = v;
++
++	xtrace_in(dev, de);
++
++	/* Done with buffers - allow new P1 */
++	rpivid_hw_irq_active1_enable_claim(dev, 1);
++
++	v4l2_m2m_buf_done(de->frame_buf, VB2_BUF_STATE_DONE);
++	de->frame_buf = NULL;
++
++#if USE_REQUEST_PIN
++	media_request_unpin(de->req_pin);
++	de->req_pin = NULL;
++#else
++	media_request_object_complete(de->req_obj);
++	de->req_obj = NULL;
++#endif
++
++	xtrace_ok(dev, de);
++	dec_env_delete(de);
++}
++
++static void phase2_claimed(struct rpivid_dev *const dev, void *v)
++{
++	struct rpivid_dec_env *const de = v;
++	unsigned int i;
++
++	xtrace_in(dev, de);
++
++	apb_write_vc_addr(dev, RPI_PURBASE, de->pu_base_vc);
++	apb_write_vc_len(dev, RPI_PURSTRIDE, de->pu_stride);
++	apb_write_vc_addr(dev, RPI_COEFFRBASE, de->coeff_base_vc);
++	apb_write_vc_len(dev, RPI_COEFFRSTRIDE, de->coeff_stride);
++
++	apb_write_vc_addr(dev, RPI_OUTYBASE, de->frame_addr);
++	apb_write_vc_addr(dev, RPI_OUTCBASE,
++			  de->frame_addr + de->frame_c_offset);
++	apb_write_vc_len(dev, RPI_OUTYSTRIDE, de->frame_stride);
++	apb_write_vc_len(dev, RPI_OUTCSTRIDE, de->frame_stride);
++
++	//    v4l2_info(&dev->v4l2_dev, "Frame: Y=%llx, C=%llx, Stride=%x\n",
++	//              de->frame_addr, de->frame_addr + de->frame_c_offset,
++	//              de->frame_stride);
++
++	for (i = 0; i < 16; i++) {
++		// Strides are in fact unused but fill in anyway
++		apb_write_vc_addr(dev, 0x9000 + 16 * i, de->ref_addrs[i]);
++		apb_write_vc_len(dev, 0x9004 + 16 * i, de->frame_stride);
++		apb_write_vc_addr(dev, 0x9008 + 16 * i,
++				  de->ref_addrs[i] + de->frame_c_offset);
++		apb_write_vc_len(dev, 0x900C + 16 * i, de->frame_stride);
++	}
++
++	apb_write(dev, RPI_CONFIG2, de->rpi_config2);
++	apb_write(dev, RPI_FRAMESIZE, de->rpi_framesize);
++	apb_write(dev, RPI_CURRPOC, de->rpi_currpoc);
++	//    v4l2_info(&dev->v4l2_dev, "Config2=%#x, FrameSize=%#x, POC=%#x\n",
++	//    de->rpi_config2, de->rpi_framesize, de->rpi_currpoc);
++
++	// collocated reads/writes
++	apb_write_vc_len(dev, RPI_COLSTRIDE,
++			 de->ctx->colmv_stride); // Read vals
++	apb_write_vc_len(dev, RPI_MVSTRIDE,
++			 de->ctx->colmv_stride); // Write vals
++	apb_write_vc_addr(dev, RPI_MVBASE,
++			  !de->frame_aux ? 0 : de->frame_aux->col.addr);
++	apb_write_vc_addr(dev, RPI_COLBASE,
++			  !de->col_aux ? 0 : de->col_aux->col.addr);
++
++	//v4l2_info(&dev->v4l2_dev,
++	//	   "Mv=%llx, Col=%llx, Stride=%x, Buf=%llx->%llx\n",
++	//	   de->rpi_mvbase, de->rpi_colbase, de->ctx->colmv_stride,
++	//	   de->ctx->colmvbuf.addr, de->ctx->colmvbuf.addr +
++	//	   de->ctx->colmvbuf.size);
++
++	rpivid_hw_irq_active2_irq(dev, &de->irq_ent, phase2_cb, de);
++
++	apb_write_final(dev, RPI_NUMROWS, de->pic_height_in_ctbs_y);
++
++	xtrace_ok(dev, de);
++}
++
++static void phase1_claimed(struct rpivid_dev *const dev, void *v);
++
++// release any and all objects associated with de
++// and reenable phase 1 if required
++static void phase1_err_fin(struct rpivid_dev *const dev,
++			   struct rpivid_ctx *const ctx,
++			   struct rpivid_dec_env *const de)
++{
++	/* Return all detached buffers */
++	if (de->src_buf)
++		v4l2_m2m_buf_done(de->src_buf, VB2_BUF_STATE_ERROR);
++	de->src_buf = NULL;
++	if (de->frame_buf)
++		v4l2_m2m_buf_done(de->frame_buf, VB2_BUF_STATE_ERROR);
++	de->frame_buf = NULL;
++#if USE_REQUEST_PIN
++	if (de->req_pin)
++		media_request_unpin(de->req_pin);
++	de->req_pin = NULL;
++#else
++	if (de->req_obj)
++		media_request_object_complete(de->req_obj);
++	de->req_obj = NULL;
++#endif
++
++	dec_env_delete(de);
++
++	/* Reenable phase 0 if we were blocking */
++	if (atomic_add_return(-1, &ctx->p1out) >= RPIVID_P1BUF_COUNT - 1)
++		v4l2_m2m_job_finish(dev->m2m_dev, ctx->fh.m2m_ctx);
++
++	/* Done with P1-P2 buffers - allow new P1 */
++	rpivid_hw_irq_active1_enable_claim(dev, 1);
++}
++
++static void phase1_thread(struct rpivid_dev *const dev, void *v)
++{
++	struct rpivid_dec_env *const de = v;
++	struct rpivid_ctx *const ctx = de->ctx;
++
++	struct rpivid_gptr *const pu_gptr = ctx->pu_bufs + ctx->p2idx;
++	struct rpivid_gptr *const coeff_gptr = ctx->coeff_bufs + ctx->p2idx;
++
++	xtrace_in(dev, de);
++
++	if (de->p1_status & STATUS_PU_EXHAUSTED) {
++		if (gptr_realloc_new(dev, pu_gptr, next_size(pu_gptr->size))) {
++			v4l2_err(&dev->v4l2_dev,
++				 "%s: PU realloc (%zx) failed\n",
++				 __func__, pu_gptr->size);
++			goto fail;
++		}
++		v4l2_info(&dev->v4l2_dev, "%s: PU realloc (%zx) OK\n",
++			  __func__, pu_gptr->size);
++	}
++
++	if (de->p1_status & STATUS_COEFF_EXHAUSTED) {
++		if (gptr_realloc_new(dev, coeff_gptr,
++				     next_size(coeff_gptr->size))) {
++			v4l2_err(&dev->v4l2_dev,
++				 "%s: Coeff realloc (%zx) failed\n",
++				 __func__, coeff_gptr->size);
++			goto fail;
++		}
++		v4l2_info(&dev->v4l2_dev, "%s: Coeff realloc (%zx) OK\n",
++			  __func__, coeff_gptr->size);
++	}
++
++	phase1_claimed(dev, de);
++	xtrace_ok(dev, de);
++	return;
++
++fail:
++	if (!pu_gptr->addr || !coeff_gptr->addr) {
++		v4l2_err(&dev->v4l2_dev,
++			 "%s: Fatal: failed to reclaim old alloc\n",
++			 __func__);
++		ctx->fatal_err = 1;
++	}
++	xtrace_fail(dev, de);
++	phase1_err_fin(dev, ctx, de);
++}
++
++/* Always called in irq context (this is good) */
++static void phase1_cb(struct rpivid_dev *const dev, void *v)
++{
++	struct rpivid_dec_env *const de = v;
++	struct rpivid_ctx *const ctx = de->ctx;
++
++	xtrace_in(dev, de);
++
++	de->p1_status = check_status(dev);
++
++	if (de->p1_status != 0) {
++		v4l2_info(&dev->v4l2_dev, "%s: Post wait: %#x\n",
++			  __func__, de->p1_status);
++
++		if (de->p1_status < 0)
++			goto fail;
++
++		/* Need to realloc - push onto a thread rather than IRQ */
++		rpivid_hw_irq_active1_thread(dev, &de->irq_ent,
++					     phase1_thread, de);
++		return;
++	}
++
++	v4l2_m2m_buf_done(de->src_buf, VB2_BUF_STATE_DONE);
++	de->src_buf = NULL;
++
++	/* All phase1 error paths done - it is safe to inc p2idx */
++	ctx->p2idx =
++		(ctx->p2idx + 1 >= RPIVID_P2BUF_COUNT) ? 0 : ctx->p2idx + 1;
++
++	/* Renable the next setup if we were blocking */
++	if (atomic_add_return(-1, &ctx->p1out) >= RPIVID_P1BUF_COUNT - 1) {
++		xtrace_fin(dev, de);
++		v4l2_m2m_job_finish(dev->m2m_dev, ctx->fh.m2m_ctx);
++	}
++
++	rpivid_hw_irq_active2_claim(dev, &de->irq_ent, phase2_claimed, de);
++
++	xtrace_ok(dev, de);
++	return;
++
++fail:
++	xtrace_fail(dev, de);
++	phase1_err_fin(dev, ctx, de);
++}
++
++static void phase1_claimed(struct rpivid_dev *const dev, void *v)
++{
++	struct rpivid_dec_env *const de = v;
++	struct rpivid_ctx *const ctx = de->ctx;
++
++	const struct rpivid_gptr * const pu_gptr = ctx->pu_bufs + ctx->p2idx;
++	const struct rpivid_gptr * const coeff_gptr = ctx->coeff_bufs +
++						      ctx->p2idx;
++
++	xtrace_in(dev, de);
++
++	if (ctx->fatal_err)
++		goto fail;
++
++	de->pu_base_vc = pu_gptr->addr;
++	de->pu_stride =
++		ALIGN_DOWN(pu_gptr->size / de->pic_height_in_ctbs_y, 64);
++
++	de->coeff_base_vc = coeff_gptr->addr;
++	de->coeff_stride =
++		ALIGN_DOWN(coeff_gptr->size / de->pic_height_in_ctbs_y, 64);
++
++	/* phase1_claimed blocked until cb_phase1 completed so p2idx inc
++	 * in cb_phase1 after error detection
++	 */
++
++	apb_write_vc_addr(dev, RPI_PUWBASE, de->pu_base_vc);
++	apb_write_vc_len(dev, RPI_PUWSTRIDE, de->pu_stride);
++	apb_write_vc_addr(dev, RPI_COEFFWBASE, de->coeff_base_vc);
++	apb_write_vc_len(dev, RPI_COEFFWSTRIDE, de->coeff_stride);
++
++	// Trigger command FIFO
++	apb_write(dev, RPI_CFNUM, de->cmd_len);
++
++	// Claim irq
++	rpivid_hw_irq_active1_irq(dev, &de->irq_ent, phase1_cb, de);
++
++	// And start the h/w
++	apb_write_vc_addr_final(dev, RPI_CFBASE, de->cmd_addr);
++
++	xtrace_ok(dev, de);
++	return;
++
++fail:
++	xtrace_fail(dev, de);
++	phase1_err_fin(dev, ctx, de);
++}
++
++static void dec_state_delete(struct rpivid_ctx *const ctx)
++{
++	unsigned int i;
++	struct rpivid_dec_state *const s = ctx->state;
++
++	if (!s)
++		return;
++	ctx->state = NULL;
++
++	free_ps_info(s);
++
++	for (i = 0; i != HEVC_MAX_REFS; ++i)
++		aux_q_release(ctx, &s->ref_aux[i]);
++	aux_q_release(ctx, &s->frame_aux);
++
++	kfree(s);
++}
++
++struct irq_sync {
++	atomic_t done;
++	wait_queue_head_t wq;
++	struct rpivid_hw_irq_ent irq_ent;
++};
++
++static void phase2_sync_claimed(struct rpivid_dev *const dev, void *v)
++{
++	struct irq_sync *const sync = v;
++
++	atomic_set(&sync->done, 1);
++	wake_up(&sync->wq);
++}
++
++static void phase1_sync_claimed(struct rpivid_dev *const dev, void *v)
++{
++	struct irq_sync *const sync = v;
++
++	rpivid_hw_irq_active1_enable_claim(dev, 1);
++	rpivid_hw_irq_active2_claim(dev, &sync->irq_ent, phase2_sync_claimed, sync);
++}
++
++/* Sync with IRQ operations
++ *
++ * Claims phase1 and phase2 in turn and waits for the phase2 claim so any
++ * pending IRQ ops will have completed by the time this returns
++ *
++ * phase1 has counted enables so must reenable once claimed
++ * phase2 has unlimited enables
++ */
++static void irq_sync(struct rpivid_dev *const dev)
++{
++	struct irq_sync sync;
++
++	atomic_set(&sync.done, 0);
++	init_waitqueue_head(&sync.wq);
++
++	rpivid_hw_irq_active1_claim(dev, &sync.irq_ent, phase1_sync_claimed, &sync);
++	wait_event(sync.wq, atomic_read(&sync.done));
++}
++
++static void h265_ctx_uninit(struct rpivid_dev *const dev, struct rpivid_ctx *ctx)
++{
++	unsigned int i;
++
++	dec_env_uninit(ctx);
++	dec_state_delete(ctx);
++
++	// dec_env & state must be killed before this to release the buffer to
++	// the free pool
++	aux_q_uninit(ctx);
++
++	for (i = 0; i != ARRAY_SIZE(ctx->bitbufs); ++i)
++		gptr_free(dev, ctx->bitbufs + i);
++	for (i = 0; i != ARRAY_SIZE(ctx->pu_bufs); ++i)
++		gptr_free(dev, ctx->pu_bufs + i);
++	for (i = 0; i != ARRAY_SIZE(ctx->coeff_bufs); ++i)
++		gptr_free(dev, ctx->coeff_bufs + i);
++}
++
++static void rpivid_h265_stop(struct rpivid_ctx *ctx)
++{
++	struct rpivid_dev *const dev = ctx->dev;
++
++	v4l2_info(&dev->v4l2_dev, "%s\n", __func__);
++
++	irq_sync(dev);
++	h265_ctx_uninit(dev, ctx);
++}
++
++static int rpivid_h265_start(struct rpivid_ctx *ctx)
++{
++	struct rpivid_dev *const dev = ctx->dev;
++	unsigned int i;
++
++	unsigned int w = ctx->dst_fmt.width;
++	unsigned int h = ctx->dst_fmt.height;
++	unsigned int wxh;
++	size_t pu_alloc;
++	size_t coeff_alloc;
++
++#if DEBUG_TRACE_P1_CMD
++	p1_z = 0;
++#endif
++
++	// Generate a sanitised WxH for memory alloc
++	// Assume HD if unset
++	if (w == 0)
++		w = 1920;
++	if (w > 4096)
++		w = 4096;
++	if (h == 0)
++		h = 1088;
++	if (h > 4096)
++		h = 4096;
++	wxh = w * h;
++
++	v4l2_info(&dev->v4l2_dev, "%s: (%dx%d)\n", __func__,
++		  ctx->dst_fmt.width, ctx->dst_fmt.height);
++
++	ctx->fatal_err = 0;
++	ctx->dec0 = NULL;
++	ctx->state = kzalloc(sizeof(*ctx->state), GFP_KERNEL);
++	if (!ctx->state) {
++		v4l2_err(&dev->v4l2_dev, "Failed to allocate decode state\n");
++		goto fail;
++	}
++
++	if (dec_env_init(ctx) != 0) {
++		v4l2_err(&dev->v4l2_dev, "Failed to allocate decode envs\n");
++		goto fail;
++	}
++
++	// Finger in the air PU & Coeff alloc
++	// Will be realloced if too small
++	coeff_alloc = rpivid_round_up_size(wxh);
++	pu_alloc = rpivid_round_up_size(wxh / 4);
++	for (i = 0; i != ARRAY_SIZE(ctx->pu_bufs); ++i) {
++		// Don't actually need a kernel mapping here
++		if (gptr_alloc(dev, ctx->pu_bufs + i, pu_alloc,
++			       DMA_ATTR_NO_KERNEL_MAPPING))
++			goto fail;
++		if (gptr_alloc(dev, ctx->coeff_bufs + i, coeff_alloc,
++			       DMA_ATTR_NO_KERNEL_MAPPING))
++			goto fail;
++	}
++	aux_q_init(ctx);
++
++	return 0;
++
++fail:
++	h265_ctx_uninit(dev, ctx);
++	return -ENOMEM;
++}
++
++static void rpivid_h265_trigger(struct rpivid_ctx *ctx)
++{
++	struct rpivid_dev *const dev = ctx->dev;
++	struct rpivid_dec_env *const de = ctx->dec0;
++
++	xtrace_in(dev, de);
++
++	switch (!de ? RPIVID_DECODE_ERROR_CONTINUE : de->state) {
++	case RPIVID_DECODE_SLICE_START:
++		de->state = RPIVID_DECODE_SLICE_CONTINUE;
++		fallthrough;
++	case RPIVID_DECODE_SLICE_CONTINUE:
++		v4l2_m2m_buf_done_and_job_finish(dev->m2m_dev, ctx->fh.m2m_ctx,
++						 VB2_BUF_STATE_DONE);
++		xtrace_ok(dev, de);
++		break;
++
++	default:
++		v4l2_err(&dev->v4l2_dev, "%s: Unexpected state: %d\n", __func__,
++			 de->state);
++		fallthrough;
++	case RPIVID_DECODE_ERROR_DONE:
++		ctx->dec0 = NULL;
++		dec_env_delete(de);
++		fallthrough;
++	case RPIVID_DECODE_ERROR_CONTINUE:
++		xtrace_fin(dev, de);
++		v4l2_m2m_buf_done_and_job_finish(dev->m2m_dev, ctx->fh.m2m_ctx,
++						 VB2_BUF_STATE_ERROR);
++		break;
++
++	case RPIVID_DECODE_PHASE1:
++		ctx->dec0 = NULL;
++
++#if !USE_REQUEST_PIN
++		/* Alloc a new request object - needs to be alloced dynamically
++		 * as the media request will release it some random time after
++		 * it is completed
++		 */
++		de->req_obj = kmalloc(sizeof(*de->req_obj), GFP_KERNEL);
++		if (!de->req_obj) {
++			xtrace_fail(dev, de);
++			dec_env_delete(de);
++			v4l2_m2m_buf_done_and_job_finish(dev->m2m_dev,
++							 ctx->fh.m2m_ctx,
++							 VB2_BUF_STATE_ERROR);
++			break;
++		}
++		media_request_object_init(de->req_obj);
++#warning probably needs to _get the req obj too
++#endif
++		ctx->p1idx = (ctx->p1idx + 1 >= RPIVID_P1BUF_COUNT) ?
++							0 : ctx->p1idx + 1;
++
++		/* We know we have src & dst so no need to test */
++		de->src_buf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
++		de->frame_buf = v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
++
++#if USE_REQUEST_PIN
++		de->req_pin = de->src_buf->vb2_buf.req_obj.req;
++		media_request_pin(de->req_pin);
++#else
++		media_request_object_bind(de->src_buf->vb2_buf.req_obj.req,
++					  &dst_req_obj_ops, de, false,
++					  de->req_obj);
++#endif
++
++		/* We could get rid of the src buffer here if we've already
++		 * copied it, but we don't copy the last buffer unless it
++		 * didn't return a contig dma addr and that shouldn't happen
++		 */
++
++		/* Enable the next setup if our Q isn't too big */
++		if (atomic_add_return(1, &ctx->p1out) < RPIVID_P1BUF_COUNT) {
++			xtrace_fin(dev, de);
++			v4l2_m2m_job_finish(dev->m2m_dev, ctx->fh.m2m_ctx);
++		}
++
++		rpivid_hw_irq_active1_claim(dev, &de->irq_ent, phase1_claimed,
++					    de);
++		xtrace_ok(dev, de);
++		break;
++	}
++}
++
++const struct rpivid_dec_ops rpivid_dec_ops_h265 = {
++	.setup = rpivid_h265_setup,
++	.start = rpivid_h265_start,
++	.stop = rpivid_h265_stop,
++	.trigger = rpivid_h265_trigger,
++};
++
++static int try_ctrl_sps(struct v4l2_ctrl *ctrl)
++{
++	const struct v4l2_ctrl_hevc_sps *const sps = ctrl->p_new.p_hevc_sps;
++	struct rpivid_ctx *const ctx = ctrl->priv;
++	struct rpivid_dev *const dev = ctx->dev;
++
++	if (sps->chroma_format_idc != 1) {
++		v4l2_warn(&dev->v4l2_dev,
++			  "Chroma format (%d) unsupported\n",
++			  sps->chroma_format_idc);
++		return -EINVAL;
++	}
++
++	if (sps->bit_depth_luma_minus8 != 0 &&
++	    sps->bit_depth_luma_minus8 != 2) {
++		v4l2_warn(&dev->v4l2_dev,
++			  "Luma depth (%d) unsupported\n",
++			  sps->bit_depth_luma_minus8 + 8);
++		return -EINVAL;
++	}
++
++	if (sps->bit_depth_luma_minus8 != sps->bit_depth_chroma_minus8) {
++		v4l2_warn(&dev->v4l2_dev,
++			  "Chroma depth (%d) != Luma depth (%d)\n",
++			  sps->bit_depth_chroma_minus8 + 8,
++			  sps->bit_depth_luma_minus8 + 8);
++		return -EINVAL;
++	}
++
++	if (!sps->pic_width_in_luma_samples ||
++	    !sps->pic_height_in_luma_samples ||
++	    sps->pic_width_in_luma_samples > 4096 ||
++	    sps->pic_height_in_luma_samples > 4096) {
++		v4l2_warn(&dev->v4l2_dev,
++			  "Bad sps width (%u) x height (%u)\n",
++			  sps->pic_width_in_luma_samples,
++			  sps->pic_height_in_luma_samples);
++		return -EINVAL;
++	}
++
++	if (!ctx->dst_fmt_set)
++		return 0;
++
++	if ((sps->bit_depth_luma_minus8 == 0 &&
++	     ctx->dst_fmt.pixelformat != V4L2_PIX_FMT_NV12_COL128) ||
++	    (sps->bit_depth_luma_minus8 == 2 &&
++	     ctx->dst_fmt.pixelformat != V4L2_PIX_FMT_NV12_10_COL128)) {
++		v4l2_warn(&dev->v4l2_dev,
++			  "SPS luma depth %d does not match capture format\n",
++			  sps->bit_depth_luma_minus8 + 8);
++		return -EINVAL;
++	}
++
++	if (sps->pic_width_in_luma_samples > ctx->dst_fmt.width ||
++	    sps->pic_height_in_luma_samples > ctx->dst_fmt.height) {
++		v4l2_warn(&dev->v4l2_dev,
++			  "SPS size (%dx%d) > capture size (%d,%d)\n",
++			  sps->pic_width_in_luma_samples,
++			  sps->pic_height_in_luma_samples,
++			  ctx->dst_fmt.width,
++			  ctx->dst_fmt.height);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++const struct v4l2_ctrl_ops rpivid_hevc_sps_ctrl_ops = {
++	.try_ctrl = try_ctrl_sps,
++};
++
++static int try_ctrl_pps(struct v4l2_ctrl *ctrl)
++{
++	const struct v4l2_ctrl_hevc_pps *const pps = ctrl->p_new.p_hevc_pps;
++	struct rpivid_ctx *const ctx = ctrl->priv;
++	struct rpivid_dev *const dev = ctx->dev;
++
++	if ((pps->flags &
++	     V4L2_HEVC_PPS_FLAG_ENTROPY_CODING_SYNC_ENABLED) &&
++	    (pps->flags &
++	     V4L2_HEVC_PPS_FLAG_TILES_ENABLED) &&
++	    (pps->num_tile_columns_minus1 || pps->num_tile_rows_minus1)) {
++		v4l2_warn(&dev->v4l2_dev,
++			  "WPP + Tiles not supported\n");
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++const struct v4l2_ctrl_ops rpivid_hevc_pps_ctrl_ops = {
++	.try_ctrl = try_ctrl_pps,
++};
++
+--- /dev/null
++++ b/drivers/staging/media/rpivid/rpivid_hw.c
+@@ -0,0 +1,383 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Raspberry Pi HEVC driver
++ *
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ *
++ * Based on the Cedrus VPU driver, that is:
++ *
++ * Copyright (C) 2016 Florent Revest <florent.revest@free-electrons.com>
++ * Copyright (C) 2018 Paul Kocialkowski <paul.kocialkowski@bootlin.com>
++ * Copyright (C) 2018 Bootlin
++ */
++#include <linux/clk.h>
++#include <linux/component.h>
++#include <linux/dma-mapping.h>
++#include <linux/interrupt.h>
++#include <linux/io.h>
++#include <linux/of_reserved_mem.h>
++#include <linux/of_device.h>
++#include <linux/of_platform.h>
++#include <linux/platform_device.h>
++#include <linux/regmap.h>
++#include <linux/reset.h>
++
++#include <media/videobuf2-core.h>
++#include <media/v4l2-mem2mem.h>
++
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
++#include "rpivid.h"
++#include "rpivid_hw.h"
++
++static void pre_irq(struct rpivid_dev *dev, struct rpivid_hw_irq_ent *ient,
++		    rpivid_irq_callback cb, void *v,
++		    struct rpivid_hw_irq_ctrl *ictl)
++{
++	unsigned long flags;
++
++	if (ictl->irq) {
++		v4l2_err(&dev->v4l2_dev, "Attempt to claim IRQ when already claimed\n");
++		return;
++	}
++
++	ient->cb = cb;
++	ient->v = v;
++
++	spin_lock_irqsave(&ictl->lock, flags);
++	ictl->irq = ient;
++	ictl->no_sched++;
++	spin_unlock_irqrestore(&ictl->lock, flags);
++}
++
++/* Should be called from inside ictl->lock */
++static inline bool sched_enabled(const struct rpivid_hw_irq_ctrl * const ictl)
++{
++	return ictl->no_sched <= 0 && ictl->enable;
++}
++
++/* Should be called from inside ictl->lock & after checking sched_enabled() */
++static inline void set_claimed(struct rpivid_hw_irq_ctrl * const ictl)
++{
++	if (ictl->enable > 0)
++		--ictl->enable;
++	ictl->no_sched = 1;
++}
++
++/* Should be called from inside ictl->lock */
++static struct rpivid_hw_irq_ent *get_sched(struct rpivid_hw_irq_ctrl * const ictl)
++{
++	struct rpivid_hw_irq_ent *ient;
++
++	if (!sched_enabled(ictl))
++		return NULL;
++
++	ient = ictl->claim;
++	if (!ient)
++		return NULL;
++	ictl->claim = ient->next;
++
++	set_claimed(ictl);
++	return ient;
++}
++
++/* Run a callback & check to see if there is anything else to run */
++static void sched_cb(struct rpivid_dev * const dev,
++		     struct rpivid_hw_irq_ctrl * const ictl,
++		     struct rpivid_hw_irq_ent *ient)
++{
++	while (ient) {
++		unsigned long flags;
++
++		ient->cb(dev, ient->v);
++
++		spin_lock_irqsave(&ictl->lock, flags);
++
++		/* Always dec no_sched after cb exec - must have been set
++		 * on entry to cb
++		 */
++		--ictl->no_sched;
++		ient = get_sched(ictl);
++
++		spin_unlock_irqrestore(&ictl->lock, flags);
++	}
++}
++
++/* Should only ever be called from its own IRQ cb so no lock required */
++static void pre_thread(struct rpivid_dev *dev,
++		       struct rpivid_hw_irq_ent *ient,
++		       rpivid_irq_callback cb, void *v,
++		       struct rpivid_hw_irq_ctrl *ictl)
++{
++	ient->cb = cb;
++	ient->v = v;
++	ictl->irq = ient;
++	ictl->thread_reqed = true;
++	ictl->no_sched++;	/* This is unwound in do_thread */
++}
++
++// Called in irq context
++static void do_irq(struct rpivid_dev * const dev,
++		   struct rpivid_hw_irq_ctrl * const ictl)
++{
++	struct rpivid_hw_irq_ent *ient;
++	unsigned long flags;
++
++	spin_lock_irqsave(&ictl->lock, flags);
++	ient = ictl->irq;
++	ictl->irq = NULL;
++	spin_unlock_irqrestore(&ictl->lock, flags);
++
++	sched_cb(dev, ictl, ient);
++}
++
++static void do_claim(struct rpivid_dev * const dev,
++		     struct rpivid_hw_irq_ent *ient,
++		     const rpivid_irq_callback cb, void * const v,
++		     struct rpivid_hw_irq_ctrl * const ictl)
++{
++	unsigned long flags;
++
++	ient->next = NULL;
++	ient->cb = cb;
++	ient->v = v;
++
++	spin_lock_irqsave(&ictl->lock, flags);
++
++	if (ictl->claim) {
++		// If we have a Q then add to end
++		ictl->tail->next = ient;
++		ictl->tail = ient;
++		ient = NULL;
++	} else if (!sched_enabled(ictl)) {
++		// Empty Q but other activity in progress so Q
++		ictl->claim = ient;
++		ictl->tail = ient;
++		ient = NULL;
++	} else {
++		// Nothing else going on - schedule immediately and
++		// prevent anything else scheduling claims
++		set_claimed(ictl);
++	}
++
++	spin_unlock_irqrestore(&ictl->lock, flags);
++
++	sched_cb(dev, ictl, ient);
++}
++
++/* Enable n claims.
++ * n < 0   set to unlimited (default on init)
++ * n = 0   if previously unlimited then disable otherwise nop
++ * n > 0   if previously unlimited then set to n enables
++ *         otherwise add n enables
++ * The enable count is automatically decremented every time a claim is run
++ */
++static void do_enable_claim(struct rpivid_dev * const dev,
++			    int n,
++			    struct rpivid_hw_irq_ctrl * const ictl)
++{
++	unsigned long flags;
++	struct rpivid_hw_irq_ent *ient;
++
++	spin_lock_irqsave(&ictl->lock, flags);
++	ictl->enable = n < 0 ? -1 : ictl->enable <= 0 ? n : ictl->enable + n;
++	ient = get_sched(ictl);
++	spin_unlock_irqrestore(&ictl->lock, flags);
++
++	sched_cb(dev, ictl, ient);
++}
++
++static void ictl_init(struct rpivid_hw_irq_ctrl * const ictl, int enables)
++{
++	spin_lock_init(&ictl->lock);
++	ictl->claim = NULL;
++	ictl->tail = NULL;
++	ictl->irq = NULL;
++	ictl->no_sched = 0;
++	ictl->enable = enables;
++	ictl->thread_reqed = false;
++}
++
++static void ictl_uninit(struct rpivid_hw_irq_ctrl * const ictl)
++{
++	// Nothing to do
++}
++
++#if !OPT_DEBUG_POLL_IRQ
++static irqreturn_t rpivid_irq_irq(int irq, void *data)
++{
++	struct rpivid_dev * const dev = data;
++	__u32 ictrl;
++
++	ictrl = irq_read(dev, ARG_IC_ICTRL);
++	if (!(ictrl & ARG_IC_ICTRL_ALL_IRQ_MASK)) {
++		v4l2_warn(&dev->v4l2_dev, "IRQ but no IRQ bits set\n");
++		return IRQ_NONE;
++	}
++
++	// Cancel any/all irqs
++	irq_write(dev, ARG_IC_ICTRL, ictrl & ~ARG_IC_ICTRL_SET_ZERO_MASK);
++
++	// Service Active2 before Active1 so Phase 1 can transition to Phase 2
++	// without delay
++	if (ictrl & ARG_IC_ICTRL_ACTIVE2_INT_SET)
++		do_irq(dev, &dev->ic_active2);
++	if (ictrl & ARG_IC_ICTRL_ACTIVE1_INT_SET)
++		do_irq(dev, &dev->ic_active1);
++
++	return dev->ic_active1.thread_reqed || dev->ic_active2.thread_reqed ?
++		IRQ_WAKE_THREAD : IRQ_HANDLED;
++}
++
++static void do_thread(struct rpivid_dev * const dev,
++		      struct rpivid_hw_irq_ctrl *const ictl)
++{
++	unsigned long flags;
++	struct rpivid_hw_irq_ent *ient = NULL;
++
++	spin_lock_irqsave(&ictl->lock, flags);
++
++	if (ictl->thread_reqed) {
++		ient = ictl->irq;
++		ictl->thread_reqed = false;
++		ictl->irq = NULL;
++	}
++
++	spin_unlock_irqrestore(&ictl->lock, flags);
++
++	sched_cb(dev, ictl, ient);
++}
++
++static irqreturn_t rpivid_irq_thread(int irq, void *data)
++{
++	struct rpivid_dev * const dev = data;
++
++	do_thread(dev, &dev->ic_active1);
++	do_thread(dev, &dev->ic_active2);
++
++	return IRQ_HANDLED;
++}
++#endif
++
++/* May only be called from Active1 CB
++ * IRQs should not be expected until execution continues in the cb
++ */
++void rpivid_hw_irq_active1_thread(struct rpivid_dev *dev,
++				  struct rpivid_hw_irq_ent *ient,
++				  rpivid_irq_callback thread_cb, void *ctx)
++{
++	pre_thread(dev, ient, thread_cb, ctx, &dev->ic_active1);
++}
++
++void rpivid_hw_irq_active1_enable_claim(struct rpivid_dev *dev,
++					int n)
++{
++	do_enable_claim(dev, n, &dev->ic_active1);
++}
++
++void rpivid_hw_irq_active1_claim(struct rpivid_dev *dev,
++				 struct rpivid_hw_irq_ent *ient,
++				 rpivid_irq_callback ready_cb, void *ctx)
++{
++	do_claim(dev, ient, ready_cb, ctx, &dev->ic_active1);
++}
++
++void rpivid_hw_irq_active1_irq(struct rpivid_dev *dev,
++			       struct rpivid_hw_irq_ent *ient,
++			       rpivid_irq_callback irq_cb, void *ctx)
++{
++	pre_irq(dev, ient, irq_cb, ctx, &dev->ic_active1);
++}
++
++void rpivid_hw_irq_active2_claim(struct rpivid_dev *dev,
++				 struct rpivid_hw_irq_ent *ient,
++				 rpivid_irq_callback ready_cb, void *ctx)
++{
++	do_claim(dev, ient, ready_cb, ctx, &dev->ic_active2);
++}
++
++void rpivid_hw_irq_active2_irq(struct rpivid_dev *dev,
++			       struct rpivid_hw_irq_ent *ient,
++			       rpivid_irq_callback irq_cb, void *ctx)
++{
++	pre_irq(dev, ient, irq_cb, ctx, &dev->ic_active2);
++}
++
++int rpivid_hw_probe(struct rpivid_dev *dev)
++{
++	struct rpi_firmware *firmware;
++	struct device_node *node;
++	struct resource *res;
++	__u32 irq_stat;
++	int irq_dec;
++	int ret = 0;
++
++	ictl_init(&dev->ic_active1, RPIVID_P2BUF_COUNT);
++	ictl_init(&dev->ic_active2, RPIVID_ICTL_ENABLE_UNLIMITED);
++
++	res = platform_get_resource_byname(dev->pdev, IORESOURCE_MEM, "intc");
++	if (!res)
++		return -ENODEV;
++
++	dev->base_irq = devm_ioremap(dev->dev, res->start, resource_size(res));
++	if (IS_ERR(dev->base_irq))
++		return PTR_ERR(dev->base_irq);
++
++	res = platform_get_resource_byname(dev->pdev, IORESOURCE_MEM, "hevc");
++	if (!res)
++		return -ENODEV;
++
++	dev->base_h265 = devm_ioremap(dev->dev, res->start, resource_size(res));
++	if (IS_ERR(dev->base_h265))
++		return PTR_ERR(dev->base_h265);
++
++	dev->clock = devm_clk_get(&dev->pdev->dev, "hevc");
++	if (IS_ERR(dev->clock))
++		return PTR_ERR(dev->clock);
++
++	node = rpi_firmware_find_node();
++	if (!node)
++		return -EINVAL;
++
++	firmware = rpi_firmware_get(node);
++	of_node_put(node);
++	if (!firmware)
++		return -EPROBE_DEFER;
++
++	dev->max_clock_rate = rpi_firmware_clk_get_max_rate(firmware,
++							    RPI_FIRMWARE_HEVC_CLK_ID);
++	rpi_firmware_put(firmware);
++
++	dev->cache_align = dma_get_cache_alignment();
++
++	// Disable IRQs & reset anything pending
++	irq_write(dev, 0,
++		  ARG_IC_ICTRL_ACTIVE1_EN_SET | ARG_IC_ICTRL_ACTIVE2_EN_SET);
++	irq_stat = irq_read(dev, 0);
++	irq_write(dev, 0, irq_stat);
++
++#if !OPT_DEBUG_POLL_IRQ
++	irq_dec = platform_get_irq(dev->pdev, 0);
++	if (irq_dec <= 0)
++		return irq_dec;
++	ret = devm_request_threaded_irq(dev->dev, irq_dec,
++					rpivid_irq_irq,
++					rpivid_irq_thread,
++					0, dev_name(dev->dev), dev);
++	if (ret) {
++		dev_err(dev->dev, "Failed to request IRQ - %d\n", ret);
++
++		return ret;
++	}
++#endif
++	return ret;
++}
++
++void rpivid_hw_remove(struct rpivid_dev *dev)
++{
++	// IRQ auto freed on unload so no need to do it here
++	// ioremap auto freed on unload
++	ictl_uninit(&dev->ic_active1);
++	ictl_uninit(&dev->ic_active2);
++}
++
+--- /dev/null
++++ b/drivers/staging/media/rpivid/rpivid_hw.h
+@@ -0,0 +1,303 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Raspberry Pi HEVC driver
++ *
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ *
++ * Based on the Cedrus VPU driver, that is:
++ *
++ * Copyright (C) 2016 Florent Revest <florent.revest@free-electrons.com>
++ * Copyright (C) 2018 Paul Kocialkowski <paul.kocialkowski@bootlin.com>
++ * Copyright (C) 2018 Bootlin
++ */
++
++#ifndef _RPIVID_HW_H_
++#define _RPIVID_HW_H_
++
++struct rpivid_hw_irq_ent {
++	struct rpivid_hw_irq_ent *next;
++	rpivid_irq_callback cb;
++	void *v;
++};
++
++/* Phase 1 Register offsets */
++
++#define RPI_SPS0 0
++#define RPI_SPS1 4
++#define RPI_PPS 8
++#define RPI_SLICE 12
++#define RPI_TILESTART 16
++#define RPI_TILEEND 20
++#define RPI_SLICESTART 24
++#define RPI_MODE 28
++#define RPI_LEFT0 32
++#define RPI_LEFT1 36
++#define RPI_LEFT2 40
++#define RPI_LEFT3 44
++#define RPI_QP 48
++#define RPI_CONTROL 52
++#define RPI_STATUS 56
++#define RPI_VERSION 60
++#define RPI_BFBASE 64
++#define RPI_BFNUM 68
++#define RPI_BFCONTROL 72
++#define RPI_BFSTATUS 76
++#define RPI_PUWBASE 80
++#define RPI_PUWSTRIDE 84
++#define RPI_COEFFWBASE 88
++#define RPI_COEFFWSTRIDE 92
++#define RPI_SLICECMDS 96
++#define RPI_BEGINTILEEND 100
++#define RPI_TRANSFER 104
++#define RPI_CFBASE 108
++#define RPI_CFNUM 112
++#define RPI_CFSTATUS 116
++
++/* Phase 2 Register offsets */
++
++#define RPI_PURBASE 0x8000
++#define RPI_PURSTRIDE 0x8004
++#define RPI_COEFFRBASE 0x8008
++#define RPI_COEFFRSTRIDE 0x800C
++#define RPI_NUMROWS 0x8010
++#define RPI_CONFIG2 0x8014
++#define RPI_OUTYBASE 0x8018
++#define RPI_OUTYSTRIDE 0x801C
++#define RPI_OUTCBASE 0x8020
++#define RPI_OUTCSTRIDE 0x8024
++#define RPI_STATUS2 0x8028
++#define RPI_FRAMESIZE 0x802C
++#define RPI_MVBASE 0x8030
++#define RPI_MVSTRIDE 0x8034
++#define RPI_COLBASE 0x8038
++#define RPI_COLSTRIDE 0x803C
++#define RPI_CURRPOC 0x8040
++
++/*
++ * Write a general register value
++ * Order is unimportant
++ */
++static inline void apb_write(const struct rpivid_dev * const dev,
++			     const unsigned int offset, const u32 val)
++{
++	writel_relaxed(val, dev->base_h265 + offset);
++}
++
++/* Write the final register value that actually starts the phase */
++static inline void apb_write_final(const struct rpivid_dev * const dev,
++				   const unsigned int offset, const u32 val)
++{
++	writel(val, dev->base_h265 + offset);
++}
++
++static inline u32 apb_read(const struct rpivid_dev * const dev,
++			   const unsigned int offset)
++{
++	return readl(dev->base_h265 + offset);
++}
++
++static inline void irq_write(const struct rpivid_dev * const dev,
++			     const unsigned int offset, const u32 val)
++{
++	writel(val, dev->base_irq + offset);
++}
++
++static inline u32 irq_read(const struct rpivid_dev * const dev,
++			   const unsigned int offset)
++{
++	return readl(dev->base_irq + offset);
++}
++
++static inline void apb_write_vc_addr(const struct rpivid_dev * const dev,
++				     const unsigned int offset,
++				     const dma_addr_t a)
++{
++	apb_write(dev, offset, (u32)(a >> 6));
++}
++
++static inline void apb_write_vc_addr_final(const struct rpivid_dev * const dev,
++					   const unsigned int offset,
++					   const dma_addr_t a)
++{
++	apb_write_final(dev, offset, (u32)(a >> 6));
++}
++
++static inline void apb_write_vc_len(const struct rpivid_dev * const dev,
++				    const unsigned int offset,
++				    const unsigned int x)
++{
++	apb_write(dev, offset, (x + 63) >> 6);
++}
++
++/* *ARG_IC_ICTRL - Interrupt control for ARGON Core*
++ * Offset (byte space) = 40'h2b10000
++ * Physical Address (byte space) = 40'h7eb10000
++ * Verilog Macro Address = `ARG_IC_REG_START + `ARGON_INTCTRL_ICTRL
++ * Reset Value = 32'b100x100x_100xxxxx_xxxxxxx0_x100x100
++ * Access = RW (32-bit only)
++ * Interrupt control logic for ARGON Core.
++ */
++#define ARG_IC_ICTRL 0
++
++/* acc=LWC ACTIVE1_INT FIELD ACCESS: LWC
++ *
++ * Interrupt 1
++ * This is set and held when an hevc_active1 interrupt edge is detected
++ * The polarity of the edge is set by the ACTIVE1_EDGE field
++ * Write a 1 to this bit to clear down the latched interrupt
++ * The latched interrupt is only enabled out onto the interrupt line if
++ * ACTIVE1_EN is set
++ * Reset value is *0* decimal.
++ */
++#define ARG_IC_ICTRL_ACTIVE1_INT_SET		BIT(0)
++
++/* ACTIVE1_EDGE Sets the polarity of the interrupt edge detection logic
++ * This logic detects edges of the hevc_active1 line from the argon core
++ * 0 = negedge, 1 = posedge
++ * Reset value is *0* decimal.
++ */
++#define ARG_IC_ICTRL_ACTIVE1_EDGE_SET		BIT(1)
++
++/* ACTIVE1_EN Enables ACTIVE1_INT out onto the argon interrupt line.
++ * If this isn't set, the interrupt logic will work but no interrupt will be
++ * set to the interrupt controller
++ * Reset value is *1* decimal.
++ *
++ * [JC] The above appears to be a lie - if unset then b0 is never set
++ */
++#define ARG_IC_ICTRL_ACTIVE1_EN_SET		BIT(2)
++
++/* acc=RO ACTIVE1_STATUS FIELD ACCESS: RO
++ *
++ * The current status of the hevc_active1 signal
++ */
++#define ARG_IC_ICTRL_ACTIVE1_STATUS_SET		BIT(3)
++
++/* acc=LWC ACTIVE2_INT FIELD ACCESS: LWC
++ *
++ * Interrupt 2
++ * This is set and held when an hevc_active2 interrupt edge is detected
++ * The polarity of the edge is set by the ACTIVE2_EDGE field
++ * Write a 1 to this bit to clear down the latched interrupt
++ * The latched interrupt is only enabled out onto the interrupt line if
++ * ACTIVE2_EN is set
++ * Reset value is *0* decimal.
++ */
++#define ARG_IC_ICTRL_ACTIVE2_INT_SET		BIT(4)
++
++/* ACTIVE2_EDGE Sets the polarity of the interrupt edge detection logic
++ * This logic detects edges of the hevc_active2 line from the argon core
++ * 0 = negedge, 1 = posedge
++ * Reset value is *0* decimal.
++ */
++#define ARG_IC_ICTRL_ACTIVE2_EDGE_SET		BIT(5)
++
++/* ACTIVE2_EN Enables ACTIVE2_INT out onto the argon interrupt line.
++ * If this isn't set, the interrupt logic will work but no interrupt will be
++ * set to the interrupt controller
++ * Reset value is *1* decimal.
++ */
++#define ARG_IC_ICTRL_ACTIVE2_EN_SET		BIT(6)
++
++/* acc=RO ACTIVE2_STATUS FIELD ACCESS: RO
++ *
++ * The current status of the hevc_active2 signal
++ */
++#define ARG_IC_ICTRL_ACTIVE2_STATUS_SET		BIT(7)
++
++/* TEST_INT Forces the argon int high for test purposes.
++ * Reset value is *0* decimal.
++ */
++#define ARG_IC_ICTRL_TEST_INT			BIT(8)
++#define ARG_IC_ICTRL_SPARE			BIT(9)
++
++/* acc=RO VP9_INTERRUPT_STATUS FIELD ACCESS: RO
++ *
++ * The current status of the vp9_interrupt signal
++ */
++#define ARG_IC_ICTRL_VP9_INTERRUPT_STATUS	BIT(10)
++
++/* AIO_INT_ENABLE 1 = Or the AIO int in with the Argon int so the VPU can see
++ * it
++ * 0 = the AIO int is masked. (It should still be connected to the GIC though).
++ */
++#define ARG_IC_ICTRL_AIO_INT_ENABLE		BIT(20)
++#define ARG_IC_ICTRL_H264_ACTIVE_INT		BIT(21)
++#define ARG_IC_ICTRL_H264_ACTIVE_EDGE		BIT(22)
++#define ARG_IC_ICTRL_H264_ACTIVE_EN		BIT(23)
++#define ARG_IC_ICTRL_H264_ACTIVE_STATUS		BIT(24)
++#define ARG_IC_ICTRL_H264_INTERRUPT_INT		BIT(25)
++#define ARG_IC_ICTRL_H264_INTERRUPT_EDGE	BIT(26)
++#define ARG_IC_ICTRL_H264_INTERRUPT_EN		BIT(27)
++
++/* acc=RO H264_INTERRUPT_STATUS FIELD ACCESS: RO
++ *
++ * The current status of the h264_interrupt signal
++ */
++#define ARG_IC_ICTRL_H264_INTERRUPT_STATUS	BIT(28)
++
++/* acc=LWC VP9_INTERRUPT_INT FIELD ACCESS: LWC
++ *
++ * Interrupt 1
++ * This is set and held when an vp9_interrupt interrupt edge is detected
++ * The polarity of the edge is set by the VP9_INTERRUPT_EDGE field
++ * Write a 1 to this bit to clear down the latched interrupt
++ * The latched interrupt is only enabled out onto the interrupt line if
++ * VP9_INTERRUPT_EN is set
++ * Reset value is *0* decimal.
++ */
++#define ARG_IC_ICTRL_VP9_INTERRUPT_INT		BIT(29)
++
++/* VP9_INTERRUPT_EDGE Sets the polarity of the interrupt edge detection logic
++ * This logic detects edges of the vp9_interrupt line from the argon h264 core
++ * 0 = negedge, 1 = posedge
++ * Reset value is *0* decimal.
++ */
++#define ARG_IC_ICTRL_VP9_INTERRUPT_EDGE		BIT(30)
++
++/* VP9_INTERRUPT_EN Enables VP9_INTERRUPT_INT out onto the argon interrupt line.
++ * If this isn't set, the interrupt logic will work but no interrupt will be
++ * set to the interrupt controller
++ * Reset value is *1* decimal.
++ */
++#define ARG_IC_ICTRL_VP9_INTERRUPT_EN		BIT(31)
++
++/* Bits 19:12, 11 reserved - read ?, write 0 */
++#define ARG_IC_ICTRL_SET_ZERO_MASK		((0xff << 12) | BIT(11))
++
++/* All IRQ bits */
++#define ARG_IC_ICTRL_ALL_IRQ_MASK   (\
++		ARG_IC_ICTRL_VP9_INTERRUPT_INT  |\
++		ARG_IC_ICTRL_H264_INTERRUPT_INT |\
++		ARG_IC_ICTRL_ACTIVE1_INT_SET    |\
++		ARG_IC_ICTRL_ACTIVE2_INT_SET)
++
++/* Regulate claim Q */
++void rpivid_hw_irq_active1_enable_claim(struct rpivid_dev *dev,
++					int n);
++/* Auto release once all CBs called */
++void rpivid_hw_irq_active1_claim(struct rpivid_dev *dev,
++				 struct rpivid_hw_irq_ent *ient,
++				 rpivid_irq_callback ready_cb, void *ctx);
++/* May only be called in claim cb */
++void rpivid_hw_irq_active1_irq(struct rpivid_dev *dev,
++			       struct rpivid_hw_irq_ent *ient,
++			       rpivid_irq_callback irq_cb, void *ctx);
++/* May only be called in irq cb */
++void rpivid_hw_irq_active1_thread(struct rpivid_dev *dev,
++				  struct rpivid_hw_irq_ent *ient,
++				  rpivid_irq_callback thread_cb, void *ctx);
++
++/* Auto release once all CBs called */
++void rpivid_hw_irq_active2_claim(struct rpivid_dev *dev,
++				 struct rpivid_hw_irq_ent *ient,
++				 rpivid_irq_callback ready_cb, void *ctx);
++/* May only be called in claim cb */
++void rpivid_hw_irq_active2_irq(struct rpivid_dev *dev,
++			       struct rpivid_hw_irq_ent *ient,
++			       rpivid_irq_callback irq_cb, void *ctx);
++
++int rpivid_hw_probe(struct rpivid_dev *dev);
++void rpivid_hw_remove(struct rpivid_dev *dev);
++
++#endif
+--- /dev/null
++++ b/drivers/staging/media/rpivid/rpivid_video.c
+@@ -0,0 +1,696 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Raspberry Pi HEVC driver
++ *
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ *
++ * Based on the Cedrus VPU driver, that is:
++ *
++ * Copyright (C) 2016 Florent Revest <florent.revest@free-electrons.com>
++ * Copyright (C) 2018 Paul Kocialkowski <paul.kocialkowski@bootlin.com>
++ * Copyright (C) 2018 Bootlin
++ */
++
++#include <media/videobuf2-dma-contig.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-ioctl.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-mem2mem.h>
++
++#include "rpivid.h"
++#include "rpivid_hw.h"
++#include "rpivid_video.h"
++#include "rpivid_dec.h"
++
++#define RPIVID_DECODE_SRC	BIT(0)
++#define RPIVID_DECODE_DST	BIT(1)
++
++#define RPIVID_MIN_WIDTH	16U
++#define RPIVID_MIN_HEIGHT	16U
++#define RPIVID_DEFAULT_WIDTH	1920U
++#define RPIVID_DEFAULT_HEIGHT	1088U
++#define RPIVID_MAX_WIDTH	4096U
++#define RPIVID_MAX_HEIGHT	4096U
++
++static inline struct rpivid_ctx *rpivid_file2ctx(struct file *file)
++{
++	return container_of(file->private_data, struct rpivid_ctx, fh);
++}
++
++/* constrain x to y,y*2 */
++static inline unsigned int constrain2x(unsigned int x, unsigned int y)
++{
++	return (x < y) ?
++			y :
++			(x > y * 2) ? y : x;
++}
++
++size_t rpivid_round_up_size(const size_t x)
++{
++	/* Admit no size < 256 */
++	const unsigned int n = x < 256 ? 8 : ilog2(x);
++
++	return x >= (3 << n) ? 4 << n : (3 << n);
++}
++
++size_t rpivid_bit_buf_size(unsigned int w, unsigned int h, unsigned int bits_minus8)
++{
++	const size_t wxh = w * h;
++	size_t bits_alloc;
++
++	/* Annex A gives a min compression of 2 @ lvl 3.1
++	 * (wxh <= 983040) and min 4 thereafter but avoid
++	 * the odity of 983041 having a lower limit than
++	 * 983040.
++	 * Multiply by 3/2 for 4:2:0
++	 */
++	bits_alloc = wxh < 983040 ? wxh * 3 / 4 :
++		wxh < 983040 * 2 ? 983040 * 3 / 4 :
++		wxh * 3 / 8;
++	/* Allow for bit depth */
++	bits_alloc += (bits_alloc * bits_minus8) / 8;
++	return rpivid_round_up_size(bits_alloc);
++}
++
++void rpivid_prepare_src_format(struct v4l2_pix_format_mplane *pix_fmt)
++{
++	size_t size;
++	u32 w;
++	u32 h;
++
++	w = pix_fmt->width;
++	h = pix_fmt->height;
++	if (!w || !h) {
++		w = RPIVID_DEFAULT_WIDTH;
++		h = RPIVID_DEFAULT_HEIGHT;
++	}
++	if (w > RPIVID_MAX_WIDTH)
++		w = RPIVID_MAX_WIDTH;
++	if (h > RPIVID_MAX_HEIGHT)
++		h = RPIVID_MAX_HEIGHT;
++
++	if (!pix_fmt->plane_fmt[0].sizeimage ||
++	    pix_fmt->plane_fmt[0].sizeimage > SZ_32M) {
++		/* Unspecified or way too big - pick max for size */
++		size = rpivid_bit_buf_size(w, h, 2);
++	}
++	/* Set a minimum */
++	size = max_t(u32, SZ_4K, pix_fmt->plane_fmt[0].sizeimage);
++
++	pix_fmt->pixelformat = V4L2_PIX_FMT_HEVC_SLICE;
++	pix_fmt->width = w;
++	pix_fmt->height = h;
++	pix_fmt->num_planes = 1;
++	pix_fmt->field = V4L2_FIELD_NONE;
++	/* Zero bytes per line for encoded source. */
++	pix_fmt->plane_fmt[0].bytesperline = 0;
++	pix_fmt->plane_fmt[0].sizeimage = size;
++}
++
++/* Take any pix_format and make it valid */
++static void rpivid_prepare_dst_format(struct v4l2_pix_format_mplane *pix_fmt)
++{
++	unsigned int width = pix_fmt->width;
++	unsigned int height = pix_fmt->height;
++	unsigned int sizeimage = pix_fmt->plane_fmt[0].sizeimage;
++	unsigned int bytesperline = pix_fmt->plane_fmt[0].bytesperline;
++
++	if (!width)
++		width = RPIVID_DEFAULT_WIDTH;
++	if (width > RPIVID_MAX_WIDTH)
++		width = RPIVID_MAX_WIDTH;
++	if (!height)
++		height = RPIVID_DEFAULT_HEIGHT;
++	if (height > RPIVID_MAX_HEIGHT)
++		height = RPIVID_MAX_HEIGHT;
++
++	/* For column formats set bytesperline to column height (stride2) */
++	switch (pix_fmt->pixelformat) {
++	default:
++		pix_fmt->pixelformat = V4L2_PIX_FMT_NV12_COL128;
++		fallthrough;
++	case V4L2_PIX_FMT_NV12_COL128:
++		/* Width rounds up to columns */
++		width = ALIGN(width, 128);
++
++		/* 16 aligned height - not sure we even need that */
++		height = ALIGN(height, 16);
++		/* column height
++		 * Accept suggested shape if at least min & < 2 * min
++		 */
++		bytesperline = constrain2x(bytesperline, height * 3 / 2);
++
++		/* image size
++		 * Again allow plausible variation in case added padding is
++		 * required
++		 */
++		sizeimage = constrain2x(sizeimage, bytesperline * width);
++		break;
++
++	case V4L2_PIX_FMT_NV12_10_COL128:
++		/* width in pixels (3 pels = 4 bytes) rounded to 128 byte
++		 * columns
++		 */
++		width = ALIGN(((width + 2) / 3), 32) * 3;
++
++		/* 16-aligned height. */
++		height = ALIGN(height, 16);
++
++		/* column height
++		 * Accept suggested shape if at least min & < 2 * min
++		 */
++		bytesperline = constrain2x(bytesperline, height * 3 / 2);
++
++		/* image size
++		 * Again allow plausible variation in case added padding is
++		 * required
++		 */
++		sizeimage = constrain2x(sizeimage,
++					bytesperline * width * 4 / 3);
++		break;
++	}
++
++	pix_fmt->width = width;
++	pix_fmt->height = height;
++
++	pix_fmt->field = V4L2_FIELD_NONE;
++	pix_fmt->plane_fmt[0].bytesperline = bytesperline;
++	pix_fmt->plane_fmt[0].sizeimage = sizeimage;
++	pix_fmt->num_planes = 1;
++}
++
++static int rpivid_querycap(struct file *file, void *priv,
++			   struct v4l2_capability *cap)
++{
++	strscpy(cap->driver, RPIVID_NAME, sizeof(cap->driver));
++	strscpy(cap->card, RPIVID_NAME, sizeof(cap->card));
++	snprintf(cap->bus_info, sizeof(cap->bus_info),
++		 "platform:%s", RPIVID_NAME);
++
++	return 0;
++}
++
++static int rpivid_enum_fmt_vid_out(struct file *file, void *priv,
++				   struct v4l2_fmtdesc *f)
++{
++	// Input formats
++
++	// H.265 Slice only currently
++	if (f->index == 0) {
++		f->pixelformat = V4L2_PIX_FMT_HEVC_SLICE;
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++static int rpivid_hevc_validate_sps(const struct v4l2_ctrl_hevc_sps * const sps)
++{
++	const unsigned int ctb_log2_size_y =
++			sps->log2_min_luma_coding_block_size_minus3 + 3 +
++			sps->log2_diff_max_min_luma_coding_block_size;
++	const unsigned int min_tb_log2_size_y =
++			sps->log2_min_luma_transform_block_size_minus2 + 2;
++	const unsigned int max_tb_log2_size_y = min_tb_log2_size_y +
++			sps->log2_diff_max_min_luma_transform_block_size;
++
++	/* Local limitations */
++	if (sps->pic_width_in_luma_samples < 32 ||
++	    sps->pic_width_in_luma_samples > 4096)
++		return 0;
++	if (sps->pic_height_in_luma_samples < 32 ||
++	    sps->pic_height_in_luma_samples > 4096)
++		return 0;
++	if (!(sps->bit_depth_luma_minus8 == 0 ||
++	      sps->bit_depth_luma_minus8 == 2))
++		return 0;
++	if (sps->bit_depth_luma_minus8 != sps->bit_depth_chroma_minus8)
++		return 0;
++	if (sps->chroma_format_idc != 1)
++		return 0;
++
++	/*  Limits from H.265 7.4.3.2.1 */
++	if (sps->log2_max_pic_order_cnt_lsb_minus4 > 12)
++		return 0;
++	if (sps->sps_max_dec_pic_buffering_minus1 > 15)
++		return 0;
++	if (sps->sps_max_num_reorder_pics >
++				sps->sps_max_dec_pic_buffering_minus1)
++		return 0;
++	if (ctb_log2_size_y > 6)
++		return 0;
++	if (max_tb_log2_size_y > 5)
++		return 0;
++	if (max_tb_log2_size_y > ctb_log2_size_y)
++		return 0;
++	if (sps->max_transform_hierarchy_depth_inter >
++				(ctb_log2_size_y - min_tb_log2_size_y))
++		return 0;
++	if (sps->max_transform_hierarchy_depth_intra >
++				(ctb_log2_size_y - min_tb_log2_size_y))
++		return 0;
++	/* Check pcm stuff */
++	if (sps->num_short_term_ref_pic_sets > 64)
++		return 0;
++	if (sps->num_long_term_ref_pics_sps > 32)
++		return 0;
++	return 1;
++}
++
++static inline int is_sps_set(const struct v4l2_ctrl_hevc_sps * const sps)
++{
++	return sps && sps->pic_width_in_luma_samples != 0;
++}
++
++static u32 pixelformat_from_sps(const struct v4l2_ctrl_hevc_sps * const sps,
++				const int index)
++{
++	u32 pf = 0;
++
++	if (!is_sps_set(sps) || !rpivid_hevc_validate_sps(sps)) {
++		/* Treat this as an error? For now return both */
++		if (index == 0)
++			pf = V4L2_PIX_FMT_NV12_COL128;
++		else if (index == 1)
++			pf = V4L2_PIX_FMT_NV12_10_COL128;
++	} else if (index == 0) {
++		if (sps->bit_depth_luma_minus8 == 0)
++			pf = V4L2_PIX_FMT_NV12_COL128;
++		else if (sps->bit_depth_luma_minus8 == 2)
++			pf = V4L2_PIX_FMT_NV12_10_COL128;
++	}
++
++	return pf;
++}
++
++static struct v4l2_pix_format_mplane
++rpivid_hevc_default_dst_fmt(struct rpivid_ctx * const ctx)
++{
++	const struct v4l2_ctrl_hevc_sps * const sps =
++		rpivid_find_control_data(ctx, V4L2_CID_STATELESS_HEVC_SPS);
++	struct v4l2_pix_format_mplane pix_fmt;
++
++	memset(&pix_fmt, 0, sizeof(pix_fmt));
++	if (is_sps_set(sps)) {
++		pix_fmt.width = sps->pic_width_in_luma_samples;
++		pix_fmt.height = sps->pic_height_in_luma_samples;
++		pix_fmt.pixelformat = pixelformat_from_sps(sps, 0);
++	}
++
++	rpivid_prepare_dst_format(&pix_fmt);
++	return pix_fmt;
++}
++
++static u32 rpivid_hevc_get_dst_pixelformat(struct rpivid_ctx * const ctx,
++					   const int index)
++{
++	const struct v4l2_ctrl_hevc_sps * const sps =
++		rpivid_find_control_data(ctx, V4L2_CID_STATELESS_HEVC_SPS);
++
++	return pixelformat_from_sps(sps, index);
++}
++
++static int rpivid_enum_fmt_vid_cap(struct file *file, void *priv,
++				   struct v4l2_fmtdesc *f)
++{
++	struct rpivid_ctx * const ctx = rpivid_file2ctx(file);
++
++	const u32 pf = rpivid_hevc_get_dst_pixelformat(ctx, f->index);
++
++	if (pf == 0)
++		return -EINVAL;
++
++	f->pixelformat = pf;
++	return 0;
++}
++
++/*
++ * get dst format - sets it to default if otherwise unset
++ * returns a pointer to the struct as a convienience
++ */
++static struct v4l2_pix_format_mplane *get_dst_fmt(struct rpivid_ctx *const ctx)
++{
++	if (!ctx->dst_fmt_set)
++		ctx->dst_fmt = rpivid_hevc_default_dst_fmt(ctx);
++	return &ctx->dst_fmt;
++}
++
++static int rpivid_g_fmt_vid_cap(struct file *file, void *priv,
++				struct v4l2_format *f)
++{
++	struct rpivid_ctx *ctx = rpivid_file2ctx(file);
++
++	f->fmt.pix_mp = *get_dst_fmt(ctx);
++	return 0;
++}
++
++static int rpivid_g_fmt_vid_out(struct file *file, void *priv,
++				struct v4l2_format *f)
++{
++	struct rpivid_ctx *ctx = rpivid_file2ctx(file);
++
++	f->fmt.pix_mp = ctx->src_fmt;
++	return 0;
++}
++
++static inline void copy_color(struct v4l2_pix_format_mplane *d,
++			      const struct v4l2_pix_format_mplane *s)
++{
++	d->colorspace   = s->colorspace;
++	d->xfer_func    = s->xfer_func;
++	d->ycbcr_enc    = s->ycbcr_enc;
++	d->quantization = s->quantization;
++}
++
++static int rpivid_try_fmt_vid_cap(struct file *file, void *priv,
++				  struct v4l2_format *f)
++{
++	struct rpivid_ctx *ctx = rpivid_file2ctx(file);
++	const struct v4l2_ctrl_hevc_sps * const sps =
++		rpivid_find_control_data(ctx, V4L2_CID_STATELESS_HEVC_SPS);
++	u32 pixelformat;
++	int i;
++
++	for (i = 0; (pixelformat = pixelformat_from_sps(sps, i)) != 0; i++) {
++		if (f->fmt.pix_mp.pixelformat == pixelformat)
++			break;
++	}
++
++	// We don't have any way of finding out colourspace so believe
++	// anything we are told - take anything set in src as a default
++	if (f->fmt.pix_mp.colorspace == V4L2_COLORSPACE_DEFAULT)
++		copy_color(&f->fmt.pix_mp, &ctx->src_fmt);
++
++	f->fmt.pix_mp.pixelformat = pixelformat;
++	rpivid_prepare_dst_format(&f->fmt.pix_mp);
++	return 0;
++}
++
++static int rpivid_try_fmt_vid_out(struct file *file, void *priv,
++				  struct v4l2_format *f)
++{
++	rpivid_prepare_src_format(&f->fmt.pix_mp);
++	return 0;
++}
++
++static int rpivid_s_fmt_vid_cap(struct file *file, void *priv,
++				struct v4l2_format *f)
++{
++	struct rpivid_ctx *ctx = rpivid_file2ctx(file);
++	struct vb2_queue *vq;
++	int ret;
++
++	vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, f->type);
++	if (vb2_is_busy(vq))
++		return -EBUSY;
++
++	ret = rpivid_try_fmt_vid_cap(file, priv, f);
++	if (ret)
++		return ret;
++
++	ctx->dst_fmt = f->fmt.pix_mp;
++	ctx->dst_fmt_set = 1;
++
++	return 0;
++}
++
++static int rpivid_s_fmt_vid_out(struct file *file, void *priv,
++				struct v4l2_format *f)
++{
++	struct rpivid_ctx *ctx = rpivid_file2ctx(file);
++	struct vb2_queue *vq;
++	int ret;
++
++	vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, f->type);
++	if (vb2_is_busy(vq))
++		return -EBUSY;
++
++	ret = rpivid_try_fmt_vid_out(file, priv, f);
++	if (ret)
++		return ret;
++
++	ctx->src_fmt = f->fmt.pix_mp;
++	ctx->dst_fmt_set = 0;  // Setting src invalidates dst
++
++	vq->subsystem_flags |=
++		VB2_V4L2_FL_SUPPORTS_M2M_HOLD_CAPTURE_BUF;
++
++	/* Propagate colorspace information to capture. */
++	copy_color(&ctx->dst_fmt, &f->fmt.pix_mp);
++	return 0;
++}
++
++const struct v4l2_ioctl_ops rpivid_ioctl_ops = {
++	.vidioc_querycap		= rpivid_querycap,
++
++	.vidioc_enum_fmt_vid_cap	= rpivid_enum_fmt_vid_cap,
++	.vidioc_g_fmt_vid_cap_mplane	= rpivid_g_fmt_vid_cap,
++	.vidioc_try_fmt_vid_cap_mplane	= rpivid_try_fmt_vid_cap,
++	.vidioc_s_fmt_vid_cap_mplane	= rpivid_s_fmt_vid_cap,
++
++	.vidioc_enum_fmt_vid_out	= rpivid_enum_fmt_vid_out,
++	.vidioc_g_fmt_vid_out_mplane	= rpivid_g_fmt_vid_out,
++	.vidioc_try_fmt_vid_out_mplane	= rpivid_try_fmt_vid_out,
++	.vidioc_s_fmt_vid_out_mplane	= rpivid_s_fmt_vid_out,
++
++	.vidioc_reqbufs			= v4l2_m2m_ioctl_reqbufs,
++	.vidioc_querybuf		= v4l2_m2m_ioctl_querybuf,
++	.vidioc_qbuf			= v4l2_m2m_ioctl_qbuf,
++	.vidioc_dqbuf			= v4l2_m2m_ioctl_dqbuf,
++	.vidioc_prepare_buf		= v4l2_m2m_ioctl_prepare_buf,
++	.vidioc_create_bufs		= v4l2_m2m_ioctl_create_bufs,
++	.vidioc_expbuf			= v4l2_m2m_ioctl_expbuf,
++
++	.vidioc_streamon		= v4l2_m2m_ioctl_streamon,
++	.vidioc_streamoff		= v4l2_m2m_ioctl_streamoff,
++
++	.vidioc_try_decoder_cmd		= v4l2_m2m_ioctl_stateless_try_decoder_cmd,
++	.vidioc_decoder_cmd		= v4l2_m2m_ioctl_stateless_decoder_cmd,
++
++	.vidioc_subscribe_event		= v4l2_ctrl_subscribe_event,
++	.vidioc_unsubscribe_event	= v4l2_event_unsubscribe,
++};
++
++static int rpivid_queue_setup(struct vb2_queue *vq, unsigned int *nbufs,
++			      unsigned int *nplanes, unsigned int sizes[],
++			      struct device *alloc_devs[])
++{
++	struct rpivid_ctx *ctx = vb2_get_drv_priv(vq);
++	struct v4l2_pix_format_mplane *pix_fmt;
++
++	if (V4L2_TYPE_IS_OUTPUT(vq->type))
++		pix_fmt = &ctx->src_fmt;
++	else
++		pix_fmt = get_dst_fmt(ctx);
++
++	if (*nplanes) {
++		if (sizes[0] < pix_fmt->plane_fmt[0].sizeimage)
++			return -EINVAL;
++	} else {
++		sizes[0] = pix_fmt->plane_fmt[0].sizeimage;
++		*nplanes = 1;
++	}
++
++	return 0;
++}
++
++static void rpivid_queue_cleanup(struct vb2_queue *vq, u32 state)
++{
++	struct rpivid_ctx *ctx = vb2_get_drv_priv(vq);
++	struct vb2_v4l2_buffer *vbuf;
++
++	for (;;) {
++		if (V4L2_TYPE_IS_OUTPUT(vq->type))
++			vbuf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
++		else
++			vbuf = v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
++
++		if (!vbuf)
++			return;
++
++		v4l2_ctrl_request_complete(vbuf->vb2_buf.req_obj.req,
++					   &ctx->hdl);
++		v4l2_m2m_buf_done(vbuf, state);
++	}
++}
++
++static int rpivid_buf_out_validate(struct vb2_buffer *vb)
++{
++	struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
++
++	vbuf->field = V4L2_FIELD_NONE;
++	return 0;
++}
++
++static int rpivid_buf_prepare(struct vb2_buffer *vb)
++{
++	struct vb2_queue *vq = vb->vb2_queue;
++	struct rpivid_ctx *ctx = vb2_get_drv_priv(vq);
++	struct v4l2_pix_format_mplane *pix_fmt;
++
++	if (V4L2_TYPE_IS_OUTPUT(vq->type))
++		pix_fmt = &ctx->src_fmt;
++	else
++		pix_fmt = &ctx->dst_fmt;
++
++	if (vb2_plane_size(vb, 0) < pix_fmt->plane_fmt[0].sizeimage)
++		return -EINVAL;
++
++	vb2_set_plane_payload(vb, 0, pix_fmt->plane_fmt[0].sizeimage);
++
++	return 0;
++}
++
++/* Only stops the clock if streaom off on both output & capture */
++static void stop_clock(struct rpivid_dev *dev, struct rpivid_ctx *ctx)
++{
++	if (ctx->src_stream_on ||
++	    ctx->dst_stream_on)
++		return;
++
++	clk_set_min_rate(dev->clock, 0);
++	clk_disable_unprepare(dev->clock);
++}
++
++/* Always starts the clock if it isn't already on this ctx */
++static int start_clock(struct rpivid_dev *dev, struct rpivid_ctx *ctx)
++{
++	int rv;
++
++	rv = clk_set_min_rate(dev->clock, dev->max_clock_rate);
++	if (rv) {
++		dev_err(dev->dev, "Failed to set clock rate\n");
++		return rv;
++	}
++
++	rv = clk_prepare_enable(dev->clock);
++	if (rv) {
++		dev_err(dev->dev, "Failed to enable clock\n");
++		return rv;
++	}
++
++	return 0;
++}
++
++static int rpivid_start_streaming(struct vb2_queue *vq, unsigned int count)
++{
++	struct rpivid_ctx *ctx = vb2_get_drv_priv(vq);
++	struct rpivid_dev *dev = ctx->dev;
++	int ret = 0;
++
++	if (!V4L2_TYPE_IS_OUTPUT(vq->type)) {
++		ctx->dst_stream_on = 1;
++		goto ok;
++	}
++
++	if (ctx->src_fmt.pixelformat != V4L2_PIX_FMT_HEVC_SLICE) {
++		ret = -EINVAL;
++		goto fail_cleanup;
++	}
++
++	if (ctx->src_stream_on)
++		goto ok;
++
++	ret = start_clock(dev, ctx);
++	if (ret)
++		goto fail_cleanup;
++
++	if (dev->dec_ops->start)
++		ret = dev->dec_ops->start(ctx);
++	if (ret)
++		goto fail_stop_clock;
++
++	ctx->src_stream_on = 1;
++ok:
++	return 0;
++
++fail_stop_clock:
++	stop_clock(dev, ctx);
++fail_cleanup:
++	v4l2_err(&dev->v4l2_dev, "%s: qtype=%d: FAIL\n", __func__, vq->type);
++	rpivid_queue_cleanup(vq, VB2_BUF_STATE_QUEUED);
++	return ret;
++}
++
++static void rpivid_stop_streaming(struct vb2_queue *vq)
++{
++	struct rpivid_ctx *ctx = vb2_get_drv_priv(vq);
++	struct rpivid_dev *dev = ctx->dev;
++
++	if (V4L2_TYPE_IS_OUTPUT(vq->type)) {
++		ctx->src_stream_on = 0;
++		if (dev->dec_ops->stop)
++			dev->dec_ops->stop(ctx);
++	} else {
++		ctx->dst_stream_on = 0;
++	}
++
++	rpivid_queue_cleanup(vq, VB2_BUF_STATE_ERROR);
++
++	vb2_wait_for_all_buffers(vq);
++
++	stop_clock(dev, ctx);
++}
++
++static void rpivid_buf_queue(struct vb2_buffer *vb)
++{
++	struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
++	struct rpivid_ctx *ctx = vb2_get_drv_priv(vb->vb2_queue);
++
++	v4l2_m2m_buf_queue(ctx->fh.m2m_ctx, vbuf);
++}
++
++static void rpivid_buf_request_complete(struct vb2_buffer *vb)
++{
++	struct rpivid_ctx *ctx = vb2_get_drv_priv(vb->vb2_queue);
++
++	v4l2_ctrl_request_complete(vb->req_obj.req, &ctx->hdl);
++}
++
++static struct vb2_ops rpivid_qops = {
++	.queue_setup		= rpivid_queue_setup,
++	.buf_prepare		= rpivid_buf_prepare,
++	.buf_queue		= rpivid_buf_queue,
++	.buf_out_validate	= rpivid_buf_out_validate,
++	.buf_request_complete	= rpivid_buf_request_complete,
++	.start_streaming	= rpivid_start_streaming,
++	.stop_streaming		= rpivid_stop_streaming,
++	.wait_prepare		= vb2_ops_wait_prepare,
++	.wait_finish		= vb2_ops_wait_finish,
++};
++
++int rpivid_queue_init(void *priv, struct vb2_queue *src_vq,
++		      struct vb2_queue *dst_vq)
++{
++	struct rpivid_ctx *ctx = priv;
++	int ret;
++
++	src_vq->type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
++	src_vq->io_modes = VB2_MMAP | VB2_DMABUF;
++	src_vq->drv_priv = ctx;
++	src_vq->buf_struct_size = sizeof(struct rpivid_buffer);
++	src_vq->ops = &rpivid_qops;
++	src_vq->mem_ops = &vb2_dma_contig_memops;
++	src_vq->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
++	src_vq->lock = &ctx->ctx_mutex;
++	src_vq->dev = ctx->dev->dev;
++	src_vq->supports_requests = true;
++	src_vq->requires_requests = true;
++
++	ret = vb2_queue_init(src_vq);
++	if (ret)
++		return ret;
++
++	dst_vq->type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE;
++	dst_vq->io_modes = VB2_MMAP | VB2_DMABUF;
++	dst_vq->drv_priv = ctx;
++	dst_vq->buf_struct_size = sizeof(struct rpivid_buffer);
++	dst_vq->min_buffers_needed = 1;
++	dst_vq->ops = &rpivid_qops;
++	dst_vq->mem_ops = &vb2_dma_contig_memops;
++	dst_vq->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
++	dst_vq->lock = &ctx->ctx_mutex;
++	dst_vq->dev = ctx->dev->dev;
++
++	return vb2_queue_init(dst_vq);
++}
+--- /dev/null
++++ b/drivers/staging/media/rpivid/rpivid_video.h
+@@ -0,0 +1,33 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Raspberry Pi HEVC driver
++ *
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ *
++ * Based on the Cedrus VPU driver, that is:
++ *
++ * Copyright (C) 2016 Florent Revest <florent.revest@free-electrons.com>
++ * Copyright (C) 2018 Paul Kocialkowski <paul.kocialkowski@bootlin.com>
++ * Copyright (C) 2018 Bootlin
++ */
++
++#ifndef _RPIVID_VIDEO_H_
++#define _RPIVID_VIDEO_H_
++
++struct rpivid_format {
++	u32		pixelformat;
++	u32		directions;
++	unsigned int	capabilities;
++};
++
++extern const struct v4l2_ioctl_ops rpivid_ioctl_ops;
++
++int rpivid_queue_init(void *priv, struct vb2_queue *src_vq,
++		      struct vb2_queue *dst_vq);
++
++size_t rpivid_bit_buf_size(unsigned int w, unsigned int h, unsigned int bits_minus8);
++size_t rpivid_round_up_size(const size_t x);
++
++void rpivid_prepare_src_format(struct v4l2_pix_format_mplane *pix_fmt);
++
++#endif
diff --git a/target/linux/bcm27xx/patches-6.1/950-0227-spi-Force-CS_HIGH-if-GPIO-descriptors-are-used.patch b/target/linux/bcm27xx/patches-6.1/950-0227-spi-Force-CS_HIGH-if-GPIO-descriptors-are-used.patch
new file mode 100644
index 00000000000000..923c0dc3fc2c3e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0227-spi-Force-CS_HIGH-if-GPIO-descriptors-are-used.patch
@@ -0,0 +1,57 @@
+From 51a164a0654895d930acb4e3bd096f7bf54c058b Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 17 Apr 2020 10:46:19 +0100
+Subject: [PATCH] spi: Force CS_HIGH if GPIO descriptors are used
+
+Commit f3186dd87669 ("spi: Optionally use GPIO descriptors for CS GPIOs")
+amended of_spi_parse_dt() to always set SPI_CS_HIGH for SPI slaves whose
+Chip Select is defined by a "cs-gpios" devicetree property.
+
+This change breaks drivers whose probe functions set the mode field of
+the spi_device because in doing so they clear the SPI_CS_HIGH flag.
+
+Fix by setting SPI_CS_HIGH in spi_setup (under the same conditions as
+in of_spi_parse_dt()).
+
+See also: 83b2a8fe43bd ("spi: spidev: Fix CS polarity if GPIO descriptors are used")
+
+Fixes: f3186dd87669 ("spi: Optionally use GPIO descriptors for CS GPIOs")
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+SQUASH: spi: Demote SPI_CS_HIGH warning to KERN_DEBUG
+
+This warning is unavoidable from a client's perspective and
+doesn't indicate anything wrong (just surprising).
+
+SQUASH with "spi: use_gpio_descriptor fixup moved to spi_setup"
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/spi/spi.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -3614,6 +3614,7 @@ static int __spi_validate_bits_per_word(
+  */
+ int spi_setup(struct spi_device *spi)
+ {
++	struct spi_controller *ctlr = spi->controller;
+ 	unsigned	bad_bits, ugly_bits;
+ 	int		status = 0;
+ 
+@@ -3634,6 +3635,14 @@ int spi_setup(struct spi_device *spi)
+ 		(SPI_TX_DUAL | SPI_TX_QUAD | SPI_TX_OCTAL |
+ 		 SPI_RX_DUAL | SPI_RX_QUAD | SPI_RX_OCTAL)))
+ 		return -EINVAL;
++
++	if (ctlr->use_gpio_descriptors && ctlr->cs_gpiods &&
++	    ctlr->cs_gpiods[spi->chip_select] && !(spi->mode & SPI_CS_HIGH)) {
++		dev_dbg(&spi->dev,
++			"setup: forcing CS_HIGH (use_gpio_descriptors)\n");
++		spi->mode |= SPI_CS_HIGH;
++	}
++
+ 	/*
+ 	 * Help drivers fail *cleanly* when they need options
+ 	 * that aren't supported with their current controller.
diff --git a/target/linux/bcm27xx/patches-6.1/950-0228-media-uapi-v4l2-core-Add-sensor-ancillary-data-V4L2-.patch b/target/linux/bcm27xx/patches-6.1/950-0228-media-uapi-v4l2-core-Add-sensor-ancillary-data-V4L2-.patch
new file mode 100644
index 00000000000000..7f4a38df07a166
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0228-media-uapi-v4l2-core-Add-sensor-ancillary-data-V4L2-.patch
@@ -0,0 +1,85 @@
+From 7e4d1176634203cb31b6e4eb449a1b18729dc5a9 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Wed, 1 Apr 2020 08:46:29 +0100
+Subject: [PATCH] media: uapi: v4l2-core: Add sensor ancillary data
+ V4L2 foucc type.
+
+Add V4L2_META_FMT_SENSOR_DATA format 4CC.
+
+This new format will be used by the BCM2835 Unicam device to return
+out camera sensor embedded data.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../userspace-api/media/v4l/meta-formats.rst  |  1 +
+ .../media/v4l/pixfmt-meta-sensor-data.rst     | 32 +++++++++++++++++++
+ drivers/media/v4l2-core/v4l2-ioctl.c          |  1 +
+ include/uapi/linux/videodev2.h                |  1 +
+ 4 files changed, 35 insertions(+)
+ create mode 100644 Documentation/userspace-api/media/v4l/pixfmt-meta-sensor-data.rst
+
+--- a/Documentation/userspace-api/media/v4l/meta-formats.rst
++++ b/Documentation/userspace-api/media/v4l/meta-formats.rst
+@@ -15,6 +15,7 @@ These formats are used for the :ref:`met
+     pixfmt-meta-d4xx
+     pixfmt-meta-intel-ipu3
+     pixfmt-meta-rkisp1
++    pixfmt-meta-sensor-data
+     pixfmt-meta-uvc
+     pixfmt-meta-vsp1-hgo
+     pixfmt-meta-vsp1-hgt
+--- /dev/null
++++ b/Documentation/userspace-api/media/v4l/pixfmt-meta-sensor-data.rst
+@@ -0,0 +1,32 @@
++.. Permission is granted to copy, distribute and/or modify this
++.. document under the terms of the GNU Free Documentation License,
++.. Version 1.1 or any later version published by the Free Software
++.. Foundation, with no Invariant Sections, no Front-Cover Texts
++.. and no Back-Cover Texts. A copy of the license is included at
++.. Documentation/media/uapi/fdl-appendix.rst.
++..
++.. TODO: replace it to GFDL-1.1-or-later WITH no-invariant-sections
++
++.. _v4l2-meta-fmt-sensor-data:
++
++***********************************
++V4L2_META_FMT_SENSOR_DATA  ('SENS')
++***********************************
++
++Sensor Ancillary Metadata
++
++Description
++===========
++
++This format describes ancillary data generated by a camera sensor and
++transmitted over a stream on the camera bus. Sensor vendors generally have their
++own custom format for this ancillary data. Some vendors follow a generic
++CSI-2/SMIA embedded data format as described in the `CSI-2 specification.
++<https://mipi.org/specifications/csi-2>`_
++
++The size of the embedded buffer is defined as a single line with a pixel width
++width specified in bytes. This is obtained by a call to the
++:c:type:`VIDIOC_SUBDEV_G_FMT` ioctl on the sensor subdevice where the ``pad``
++field in :c:type:`v4l2_subdev_format` is set to 1.  Note that this size is fixed
++and cannot be modified with a call to :c:type:`VIDIOC_SUBDEV_S_FMT`.
++
+--- a/drivers/media/v4l2-core/v4l2-ioctl.c
++++ b/drivers/media/v4l2-core/v4l2-ioctl.c
+@@ -1448,6 +1448,7 @@ static void v4l_fill_fmtdesc(struct v4l2
+ 	case V4L2_META_FMT_RK_ISP1_STAT_3A:	descr = "Rockchip ISP1 3A Statistics"; break;
+ 	case V4L2_PIX_FMT_NV12M_8L128:	descr = "NV12M (8x128 Linear)"; break;
+ 	case V4L2_PIX_FMT_NV12M_10BE_8L128:	descr = "10-bit NV12M (8x128 Linear, BE)"; break;
++	case V4L2_META_FMT_SENSOR_DATA:	descr = "Sensor Ancillary Metadata"; break;
+ 
+ 	default:
+ 		/* Compressed formats */
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -813,6 +813,7 @@ struct v4l2_pix_format {
+ #define V4L2_META_FMT_UVC         v4l2_fourcc('U', 'V', 'C', 'H') /* UVC Payload Header metadata */
+ #define V4L2_META_FMT_D4XX        v4l2_fourcc('D', '4', 'X', 'X') /* D4XX Payload Header metadata */
+ #define V4L2_META_FMT_VIVID	  v4l2_fourcc('V', 'I', 'V', 'D') /* Vivid Metadata */
++#define V4L2_META_FMT_SENSOR_DATA v4l2_fourcc('S', 'E', 'N', 'S') /* Sensor Ancillary metadata */
+ 
+ /* Vendor specific - used for RK_ISP1 camera sub-system */
+ #define V4L2_META_FMT_RK_ISP1_PARAMS	v4l2_fourcc('R', 'K', '1', 'P') /* Rockchip ISP1 3A Parameters */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0229-media-uapi-Add-MEDIA_BUS_FMT_SENSOR_DATA-media-bus-f.patch b/target/linux/bcm27xx/patches-6.1/950-0229-media-uapi-Add-MEDIA_BUS_FMT_SENSOR_DATA-media-bus-f.patch
new file mode 100644
index 00000000000000..048aa195c8a7a8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0229-media-uapi-Add-MEDIA_BUS_FMT_SENSOR_DATA-media-bus-f.patch
@@ -0,0 +1,63 @@
+From defe535a8dd73134a798afd968195af3a0533b0d Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 21 Jan 2020 14:06:47 +0000
+Subject: [PATCH] media: uapi: Add MEDIA_BUS_FMT_SENSOR_DATA media bus
+ format
+
+This patch adds MEDIA_BUS_FMT_SENSOR_DATA used by the bcm2835-unicam
+driver to support CSI-2 embedded data streams from camera sensors.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../media/v4l/subdev-formats.rst              | 32 +++++++++++++++++++
+ include/uapi/linux/media-bus-format.h         |  3 ++
+ 2 files changed, 35 insertions(+)
+
+--- a/Documentation/userspace-api/media/v4l/subdev-formats.rst
++++ b/Documentation/userspace-api/media/v4l/subdev-formats.rst
+@@ -8086,3 +8086,35 @@ The following table lists the existing m
+ 	both sides of the link and the bus format is a fixed
+ 	metadata format that is not configurable from userspace.
+ 	Width and height will be set to 0 for this format.
++
++
++.. _v4l2-mbus-sensor-data:
++
++Sensor Ancillary Metadata Formats
++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++This section lists ancillary data generated by a camera sensor and
++transmitted over a stream on the camera bus.
++
++The following table lists the existing sensor ancillary metadata formats:
++
++
++.. _v4l2-mbus-pixelcode-sensor-metadata:
++
++.. tabularcolumns:: |p{8.0cm}|p{1.4cm}|p{7.7cm}|
++
++.. flat-table:: Sensor ancillary metadata formats
++    :header-rows:  1
++    :stub-columns: 0
++
++    * - Identifier
++      - Code
++      - Comments
++    * .. _MEDIA_BUS_FMT_SENSOR_DATA:
++
++      - MEDIA_BUS_FMT_SENSOR_DATA
++      - 0x7001
++      - Sensor vendor specific ancillary metadata. Some vendors follow a generic
++        CSI-2/SMIA embedded data format as described in the `CSI-2 specification.
++	<https://mipi.org/specifications/csi-2>`_
++
+--- a/include/uapi/linux/media-bus-format.h
++++ b/include/uapi/linux/media-bus-format.h
+@@ -172,4 +172,7 @@
+  */
+ #define MEDIA_BUS_FMT_METADATA_FIXED		0x7001
+ 
++/* Sensor ancillary metadata formats - next is 0x7002 */
++#define MEDIA_BUS_FMT_SENSOR_DATA		0x7002
++
+ #endif /* __LINUX_MEDIA_BUS_FORMAT_H */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0230-media-uapi-v4l2-core-Add-ISP-statistics-output-V4L2-.patch b/target/linux/bcm27xx/patches-6.1/950-0230-media-uapi-v4l2-core-Add-ISP-statistics-output-V4L2-.patch
new file mode 100644
index 00000000000000..818cc35cc384fe
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0230-media-uapi-v4l2-core-Add-ISP-statistics-output-V4L2-.patch
@@ -0,0 +1,94 @@
+From 635b5f7fbe0ac9e5a93cadd23b88b36ac1e79f91 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Thu, 23 Apr 2020 10:20:26 +0100
+Subject: [PATCH] media: uapi: v4l2-core: Add ISP statistics output
+ V4L2 fourcc type
+
+Add V4L2_META_FMT_BCM2835_ISP_STATS V4L2 format type.
+
+This new format will be used by the BCM2835 ISP device to return
+out ISP statistics for 3A.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../userspace-api/media/v4l/meta-formats.rst  |  1 +
+ .../v4l/pixfmt-meta-bcm2835-isp-stats.rst     | 41 +++++++++++++++++++
+ drivers/media/v4l2-core/v4l2-ioctl.c          |  1 +
+ include/uapi/linux/videodev2.h                |  1 +
+ 4 files changed, 44 insertions(+)
+ create mode 100644 Documentation/userspace-api/media/v4l/pixfmt-meta-bcm2835-isp-stats.rst
+
+--- a/Documentation/userspace-api/media/v4l/meta-formats.rst
++++ b/Documentation/userspace-api/media/v4l/meta-formats.rst
+@@ -12,6 +12,7 @@ These formats are used for the :ref:`met
+ .. toctree::
+     :maxdepth: 1
+ 
++    pixfmt-meta-bcm2835-isp-stats
+     pixfmt-meta-d4xx
+     pixfmt-meta-intel-ipu3
+     pixfmt-meta-rkisp1
+--- /dev/null
++++ b/Documentation/userspace-api/media/v4l/pixfmt-meta-bcm2835-isp-stats.rst
+@@ -0,0 +1,41 @@
++.. Permission is granted to copy, distribute and/or modify this
++.. document under the terms of the GNU Free Documentation License,
++.. Version 1.1 or any later version published by the Free Software
++.. Foundation, with no Invariant Sections, no Front-Cover Texts
++.. and no Back-Cover Texts. A copy of the license is included at
++.. Documentation/media/uapi/fdl-appendix.rst.
++..
++.. TODO: replace it to GFDL-1.1-or-later WITH no-invariant-sections
++
++.. _v4l2-meta-fmt-bcm2835-isp-stats:
++
++*****************************************
++V4L2_META_FMT_BCM2835_ISP_STATS  ('BSTA')
++*****************************************
++
++BCM2835 ISP Statistics
++
++Description
++===========
++
++The BCM2835 ISP hardware calculate image statistics for an input Bayer frame.
++These statistics are obtained from the "bcm2835-isp0-capture3" device node
++using the :c:type:`v4l2_meta_format` interface. They are formatted as described
++by the :c:type:`bcm2835_isp_stats` structure below.
++
++.. code-block:: c
++
++	#define DEFAULT_AWB_REGIONS_X 16
++	#define DEFAULT_AWB_REGIONS_Y 12
++
++	#define NUM_HISTOGRAMS 2
++	#define NUM_HISTOGRAM_BINS 128
++	#define AWB_REGIONS (DEFAULT_AWB_REGIONS_X * DEFAULT_AWB_REGIONS_Y)
++	#define FLOATING_REGIONS 16
++	#define AGC_REGIONS 16
++	#define FOCUS_REGIONS 12
++
++.. kernel-doc:: include/uapi/linux/bcm2835-isp.h
++   :functions: bcm2835_isp_stats_hist bcm2835_isp_stats_region
++	             bcm2835_isp_stats_focus bcm2835_isp_stats
++
+--- a/drivers/media/v4l2-core/v4l2-ioctl.c
++++ b/drivers/media/v4l2-core/v4l2-ioctl.c
+@@ -1449,6 +1449,7 @@ static void v4l_fill_fmtdesc(struct v4l2
+ 	case V4L2_PIX_FMT_NV12M_8L128:	descr = "NV12M (8x128 Linear)"; break;
+ 	case V4L2_PIX_FMT_NV12M_10BE_8L128:	descr = "10-bit NV12M (8x128 Linear, BE)"; break;
+ 	case V4L2_META_FMT_SENSOR_DATA:	descr = "Sensor Ancillary Metadata"; break;
++	case V4L2_META_FMT_BCM2835_ISP_STATS: descr = "BCM2835 ISP Image Statistics"; break;
+ 
+ 	default:
+ 		/* Compressed formats */
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -814,6 +814,7 @@ struct v4l2_pix_format {
+ #define V4L2_META_FMT_D4XX        v4l2_fourcc('D', '4', 'X', 'X') /* D4XX Payload Header metadata */
+ #define V4L2_META_FMT_VIVID	  v4l2_fourcc('V', 'I', 'V', 'D') /* Vivid Metadata */
+ #define V4L2_META_FMT_SENSOR_DATA v4l2_fourcc('S', 'E', 'N', 'S') /* Sensor Ancillary metadata */
++#define V4L2_META_FMT_BCM2835_ISP_STATS v4l2_fourcc('B', 'S', 'T', 'A') /* BCM2835 ISP image statistics output */
+ 
+ /* Vendor specific - used for RK_ISP1 camera sub-system */
+ #define V4L2_META_FMT_RK_ISP1_PARAMS	v4l2_fourcc('R', 'K', '1', 'P') /* Rockchip ISP1 3A Parameters */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0231-media-uapi-v4l-ctrls-Add-CID-base-for-the-bcm2835-is.patch b/target/linux/bcm27xx/patches-6.1/950-0231-media-uapi-v4l-ctrls-Add-CID-base-for-the-bcm2835-is.patch
new file mode 100644
index 00000000000000..706d6baf77a94f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0231-media-uapi-v4l-ctrls-Add-CID-base-for-the-bcm2835-is.patch
@@ -0,0 +1,169 @@
+From ec0b51689845e701cb74ab285ae97efd4dcf994a Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 21 Apr 2020 15:06:19 +0100
+Subject: [PATCH] media: uapi: v4l-ctrls: Add CID base for the
+ bcm2835-isp driver
+
+We are reserving controls for the new bcm2835-isp driver.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../admin-guide/media/bcm2835-isp.rst         | 127 ++++++++++++++++++
+ .../userspace-api/media/drivers/index.rst     |   1 +
+ include/uapi/linux/v4l2-controls.h            |   4 +
+ 3 files changed, 132 insertions(+)
+ create mode 100644 Documentation/admin-guide/media/bcm2835-isp.rst
+
+--- /dev/null
++++ b/Documentation/admin-guide/media/bcm2835-isp.rst
+@@ -0,0 +1,127 @@
++.. SPDX-License-Identifier: GPL-2.0
++
++BCM2835 ISP Driver
++==================
++
++Introduction
++------------
++
++The BCM2835 Image Sensor Pipeline (ISP) is a fixed function hardware pipeline
++for performing image processing operations.  Images are fed to the input
++of the ISP through memory frame buffers.  These images may be in various YUV,
++RGB, or Bayer formats.  A typical use case would have Bayer images obtained from
++an image sensor by the BCM2835 Unicam peripheral, written to a memory
++frame buffer, and finally fed into the input of the ISP.  Two concurrent output
++images may be generated in YUV or RGB format at different resolutions.
++Statistics output is also generated for Bayer input images.
++
++The bcm2835-isp driver exposes the following media pads as V4L2 device nodes:
++
++.. tabularcolumns:: |l|l|l|l|
++
++.. cssclass: longtable
++
++.. flat-table::
++
++    * - *Pad*
++      - *Direction*
++      - *Purpose*
++      - *Formats*
++
++    * - "bcm2835-isp0-output0"
++      - sink
++      - Accepts Bayer, RGB or YUV format frame buffers as input to the ISP HW
++        pipeline.
++      - :ref:`RAW8 <V4L2-PIX-FMT-SRGGB8>`,
++        :ref:`RAW10P <V4L2-PIX-FMT-SRGGB10P>`,
++        :ref:`RAW12P <V4L2-PIX-FMT-SRGGB12P>`,
++        :ref:`RAW14P <V4L2-PIX-FMT-SRGGB14P>`,
++        :ref:`RAW16 <V4L2-PIX-FMT-SRGGB16>`,
++        :ref:`RGB24/BGR24 <V4L2-PIX-FMT-RGB24>`,
++        :ref:`YUYV <V4L2-PIX-FMT-YUYV>`,
++        :ref:`YVYU <V4L2-PIX-FMT-YVYU>`,
++        :ref:`UYVY <V4L2-PIX-FMT-UYVY>`,
++        :ref:`VYUY <V4L2-PIX-FMT-VYUY>`,
++        :ref:`YUV420/YVU420 <V4L2-PIX-FMT-YUV420>`
++
++    * - "bcm2835-isp0-capture1"
++      - source
++      - High resolution YUV or RGB processed output from the ISP.
++      - :ref:`RGB565 <V4L2-PIX-FMT-RGB565>`,
++        :ref:`RGB24/BGR24 <V4L2-PIX-FMT-RGB24>`,
++        :ref:`ABGR32 <V4L2-PIX-FMT-ABGR32>`,
++        :ref:`YUYV <V4L2-PIX-FMT-YUYV>`,
++        :ref:`YVYU <V4L2-PIX-FMT-YVYU>`,
++        :ref:`UYVY <V4L2-PIX-FMT-UYVY>`,
++        :ref:`VYUY <V4L2-PIX-FMT-VYUY>`.
++        :ref:`YUV420/YVU420 <V4L2-PIX-FMT-YUV420>`,
++        :ref:`NV12/NV21 <V4L2-PIX-FMT-NV12>`,
++
++    * - "bcm2835-isp0-capture2"
++      - source
++      - Low resolution YUV processed output from the ISP. The output of
++        this pad cannot have a resolution larger than the "bcm2835-isp0-capture1" pad in any dimension.
++      - :ref:`YUYV <V4L2-PIX-FMT-YUYV>`,
++        :ref:`YVYU <V4L2-PIX-FMT-YVYU>`,
++        :ref:`UYVY <V4L2-PIX-FMT-UYVY>`,
++        :ref:`VYUY <V4L2-PIX-FMT-VYUY>`.
++        :ref:`YUV420/YVU420 <V4L2-PIX-FMT-YUV420>`,
++        :ref:`NV12/NV21 <V4L2-PIX-FMT-NV12>`,
++
++    * - "bcm2835-isp0-capture1"
++      - source
++      - Image statistics calculated from the input image provided on the
++        "bcm2835-isp0-output0" pad.  Statistics are only available for Bayer
++        format input images.
++      - :ref:`v4l2-meta-fmt-bcm2835-isp-stats`.
++
++Pipeline Configuration
++----------------------
++
++The ISP pipeline can be configure through user-space by calling
++:ref:`VIDIOC_S_EXT_CTRLS <VIDIOC_G_EXT_CTRLS>` on the “bcm2835-isp0-output0”
++node with the appropriate parameters as shown in the table below.
++
++.. tabularcolumns:: |p{2cm}|p{5.0cm}|
++
++.. cssclass: longtable
++
++.. flat-table::
++
++    * - *id*
++      - *Parameter*
++
++    * - ``V4L2_CID_USER_BCM2835_ISP_CC_MATRIX``
++      - struct :c:type:`bcm2835_isp_custom_ccm`
++
++    * - ``V4L2_CID_USER_BCM2835_ISP_LENS_SHADING``
++      - struct :c:type:`bcm2835_isp_lens_shading`
++
++    * - ``V4L2_CID_USER_BCM2835_ISP_BLACK_LEVEL``
++      - struct :c:type:`bcm2835_isp_black_level`
++
++    * - ``V4L2_CID_USER_BCM2835_ISP_GEQ``
++      - struct :c:type:`bcm2835_isp_geq`
++
++    * - ``V4L2_CID_USER_BCM2835_ISP_GAMMA``
++      - struct :c:type:`bcm2835_isp_gamma`
++
++    * - ``V4L2_CID_USER_BCM2835_ISP_DENOISE``
++      - struct :c:type:`bcm2835_isp_denoise`
++
++    * - ``V4L2_CID_USER_BCM2835_ISP_SHARPEN``
++      - struct :c:type:`bcm2835_isp_sharpen`
++
++    * - ``V4L2_CID_USER_BCM2835_ISP_DPC``
++      - struct :c:type:`bcm2835_isp_dpc`
++
++++++++++++++++++++++++++
++Configuration Parameters
++++++++++++++++++++++++++
++
++.. kernel-doc:: include/uapi/linux/bcm2835-isp.h
++   :functions: bcm2835_isp_rational bcm2835_isp_ccm bcm2835_isp_custom_ccm
++                bcm2835_isp_gain_format bcm2835_isp_lens_shading
++                bcm2835_isp_black_level bcm2835_isp_geq bcm2835_isp_gamma
++                bcm2835_isp_denoise bcm2835_isp_sharpen
++                bcm2835_isp_dpc_mode bcm2835_isp_dpc
+--- a/Documentation/userspace-api/media/drivers/index.rst
++++ b/Documentation/userspace-api/media/drivers/index.rst
+@@ -35,6 +35,7 @@ For more details see the file COPYING in
+ 	cx2341x-uapi
+ 	dw100
+ 	imx-uapi
++	bcm2835-isp
+ 	max2175
+ 	meye-uapi
+ 	omap3isp-uapi
+--- a/include/uapi/linux/v4l2-controls.h
++++ b/include/uapi/linux/v4l2-controls.h
+@@ -231,6 +231,10 @@ enum v4l2_colorfx {
+  */
+ #define V4L2_CID_USER_DW100_BASE		(V4L2_CID_USER_BASE + 0x1190)
+ 
++/* The base for the bcm2835-isp driver controls.
++ * We reserve 16 controls for this driver. */
++#define V4L2_CID_USER_BCM2835_ISP_BASE		(V4L2_CID_USER_BASE + 0x10f0)
++
+ /* MPEG-class control IDs */
+ /* The MPEG controls are applicable to all codec controls
+  * and the 'MPEG' part of the define is historical */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0232-staging-vchiq-Load-bcm2835_isp-driver-from-vchiq.patch b/target/linux/bcm27xx/patches-6.1/950-0232-staging-vchiq-Load-bcm2835_isp-driver-from-vchiq.patch
new file mode 100644
index 00000000000000..25f5de4429e2ab
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0232-staging-vchiq-Load-bcm2835_isp-driver-from-vchiq.patch
@@ -0,0 +1,39 @@
+From b1c396f775e962e9610db24b9942ee0c9136a13d Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Wed, 22 Apr 2020 08:32:32 +0100
+Subject: [PATCH] staging: vchiq: Load bcm2835_isp driver from vchiq
+
+bcmn2835_isp is a platform driver dependent on vchiq,
+therefore add the load/unload functions for it to vchiq.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -69,6 +69,7 @@ static struct platform_device *bcm2835_c
+ static struct platform_device *bcm2835_audio;
+ static struct platform_device *bcm2835_codec;
+ static struct platform_device *vcsm_cma;
++static struct platform_device *bcm2835_isp;
+ 
+ struct vchiq_drvdata {
+ 	const unsigned int cache_line_size;
+@@ -1863,6 +1864,7 @@ static int vchiq_probe(struct platform_d
+ 	bcm2835_codec = vchiq_register_child(pdev, "bcm2835-codec");
+ 	bcm2835_camera = vchiq_register_child(pdev, "bcm2835-camera");
+ 	bcm2835_audio = vchiq_register_child(pdev, "bcm2835_audio");
++	bcm2835_isp = vchiq_register_child(pdev, "bcm2835-isp");
+ 
+ 	return 0;
+ 
+@@ -1874,6 +1876,7 @@ error_exit:
+ 
+ static int vchiq_remove(struct platform_device *pdev)
+ {
++	platform_device_unregister(bcm2835_isp);
+ 	platform_device_unregister(bcm2835_audio);
+ 	platform_device_unregister(bcm2835_camera);
+ 	platform_device_unregister(bcm2835_codec);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0233-bcm2835-dma-Add-proper-40-bit-DMA-support.patch b/target/linux/bcm27xx/patches-6.1/950-0233-bcm2835-dma-Add-proper-40-bit-DMA-support.patch
new file mode 100644
index 00000000000000..217b29b1c3f3cb
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0233-bcm2835-dma-Add-proper-40-bit-DMA-support.patch
@@ -0,0 +1,801 @@
+From a10f61fab094b4995974496506ee0497af745d57 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Thu, 4 Apr 2019 13:33:47 +0100
+Subject: [PATCH] bcm2835-dma: Add proper 40-bit DMA support
+
+BCM2711 has 4 DMA channels with a 40-bit address range, allowing them
+to access the full 4GB of memory on a Pi 4.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/dma/bcm2835-dma.c | 485 ++++++++++++++++++++++++++++++++------
+ 1 file changed, 412 insertions(+), 73 deletions(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -38,6 +38,11 @@
+ #define BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED 14
+ #define BCM2835_DMA_CHAN_NAME_SIZE 8
+ #define BCM2835_DMA_BULK_MASK  BIT(0)
++#define BCM2711_DMA_MEMCPY_CHAN 14
++
++struct bcm2835_dma_cfg_data {
++	u32	chan_40bit_mask;
++};
+ 
+ /**
+  * struct bcm2835_dmadev - BCM2835 DMA controller
+@@ -50,6 +55,7 @@ struct bcm2835_dmadev {
+ 	struct dma_device ddev;
+ 	void __iomem *base;
+ 	dma_addr_t zero_page;
++	const struct bcm2835_dma_cfg_data *cfg_data;
+ };
+ 
+ struct bcm2835_dma_cb {
+@@ -62,6 +68,17 @@ struct bcm2835_dma_cb {
+ 	uint32_t pad[2];
+ };
+ 
++struct bcm2711_dma40_scb {
++	uint32_t ti;
++	uint32_t src;
++	uint32_t srci;
++	uint32_t dst;
++	uint32_t dsti;
++	uint32_t len;
++	uint32_t next_cb;
++	uint32_t rsvd;
++};
++
+ struct bcm2835_cb_entry {
+ 	struct bcm2835_dma_cb *cb;
+ 	dma_addr_t paddr;
+@@ -82,6 +99,7 @@ struct bcm2835_chan {
+ 	unsigned int irq_flags;
+ 
+ 	bool is_lite_channel;
++	bool is_40bit_channel;
+ };
+ 
+ struct bcm2835_desc {
+@@ -171,13 +189,118 @@ struct bcm2835_desc {
+ #define BCM2835_DMA_DATA_TYPE_S128	16
+ 
+ /* Valid only for channels 0 - 14, 15 has its own base address */
+-#define BCM2835_DMA_CHAN(n)	((n) << 8) /* Base address */
++#define BCM2835_DMA_CHAN_SIZE	0x100
++#define BCM2835_DMA_CHAN(n)	((n) * BCM2835_DMA_CHAN_SIZE) /* Base address */
+ #define BCM2835_DMA_CHANIO(base, n) ((base) + BCM2835_DMA_CHAN(n))
+ 
+ /* the max dma length for different channels */
+ #define MAX_DMA_LEN SZ_1G
+ #define MAX_LITE_DMA_LEN (SZ_64K - 4)
+ 
++/* 40-bit DMA support */
++#define BCM2711_DMA40_CS	0x00
++#define BCM2711_DMA40_CB	0x04
++#define BCM2711_DMA40_DEBUG	0x0c
++#define BCM2711_DMA40_TI	0x10
++#define BCM2711_DMA40_SRC	0x14
++#define BCM2711_DMA40_SRCI	0x18
++#define BCM2711_DMA40_DEST	0x1c
++#define BCM2711_DMA40_DESTI	0x20
++#define BCM2711_DMA40_LEN	0x24
++#define BCM2711_DMA40_NEXT_CB	0x28
++#define BCM2711_DMA40_DEBUG2	0x2c
++
++#define BCM2711_DMA40_ACTIVE		BIT(0)
++#define BCM2711_DMA40_END		BIT(1)
++#define BCM2711_DMA40_INT		BIT(2)
++#define BCM2711_DMA40_DREQ		BIT(3)  /* DREQ state */
++#define BCM2711_DMA40_RD_PAUSED		BIT(4)  /* Reading is paused */
++#define BCM2711_DMA40_WR_PAUSED		BIT(5)  /* Writing is paused */
++#define BCM2711_DMA40_DREQ_PAUSED	BIT(6)  /* Is paused by DREQ flow control */
++#define BCM2711_DMA40_WAITING_FOR_WRITES BIT(7)  /* Waiting for last write */
++#define BCM2711_DMA40_ERR		BIT(10)
++#define BCM2711_DMA40_QOS(x)		(((x) & 0x1f) << 16)
++#define BCM2711_DMA40_PANIC_QOS(x)	(((x) & 0x1f) << 20)
++#define BCM2711_DMA40_WAIT_FOR_WRITES	BIT(28)
++#define BCM2711_DMA40_DISDEBUG		BIT(29)
++#define BCM2711_DMA40_ABORT		BIT(30)
++#define BCM2711_DMA40_HALT		BIT(31)
++#define BCM2711_DMA40_CS_FLAGS(x) (x & (BCM2711_DMA40_QOS(15) | \
++					BCM2711_DMA40_PANIC_QOS(15) | \
++					BCM2711_DMA40_WAIT_FOR_WRITES |	\
++					BCM2711_DMA40_DISDEBUG))
++
++/* Transfer information bits */
++#define BCM2711_DMA40_INTEN		BIT(0)
++#define BCM2711_DMA40_TDMODE		BIT(1) /* 2D-Mode */
++#define BCM2711_DMA40_WAIT_RESP		BIT(2) /* wait for AXI write to be acked */
++#define BCM2711_DMA40_WAIT_RD_RESP	BIT(3) /* wait for AXI read to complete */
++#define BCM2711_DMA40_PER_MAP(x)	((x & 31) << 9) /* REQ source */
++#define BCM2711_DMA40_S_DREQ		BIT(14) /* enable SREQ for source */
++#define BCM2711_DMA40_D_DREQ		BIT(15) /* enable DREQ for destination */
++#define BCM2711_DMA40_S_WAIT(x)		((x & 0xff) << 16) /* add DMA read-wait cycles */
++#define BCM2711_DMA40_D_WAIT(x)		((x & 0xff) << 24) /* add DMA write-wait cycles */
++
++/* debug register bits */
++#define BCM2711_DMA40_DEBUG_WRITE_ERR		BIT(0)
++#define BCM2711_DMA40_DEBUG_FIFO_ERR		BIT(1)
++#define BCM2711_DMA40_DEBUG_READ_ERR		BIT(2)
++#define BCM2711_DMA40_DEBUG_READ_CB_ERR		BIT(3)
++#define BCM2711_DMA40_DEBUG_IN_ON_ERR		BIT(8)
++#define BCM2711_DMA40_DEBUG_ABORT_ON_ERR	BIT(9)
++#define BCM2711_DMA40_DEBUG_HALT_ON_ERR		BIT(10)
++#define BCM2711_DMA40_DEBUG_DISABLE_CLK_GATE	BIT(11)
++#define BCM2711_DMA40_DEBUG_RSTATE_SHIFT	14
++#define BCM2711_DMA40_DEBUG_RSTATE_BITS		4
++#define BCM2711_DMA40_DEBUG_WSTATE_SHIFT	18
++#define BCM2711_DMA40_DEBUG_WSTATE_BITS		4
++#define BCM2711_DMA40_DEBUG_RESET		BIT(23)
++#define BCM2711_DMA40_DEBUG_ID_SHIFT		24
++#define BCM2711_DMA40_DEBUG_ID_BITS		4
++#define BCM2711_DMA40_DEBUG_VERSION_SHIFT	28
++#define BCM2711_DMA40_DEBUG_VERSION_BITS	4
++
++/* Valid only for channels 0 - 3 (11 - 14) */
++#define BCM2711_DMA40_CHAN(n)	(((n) + 11) << 8) /* Base address */
++#define BCM2711_DMA40_CHANIO(base, n) ((base) + BCM2711_DMA_CHAN(n))
++
++/* the max dma length for different channels */
++#define MAX_DMA40_LEN SZ_1G
++
++#define BCM2711_DMA40_BURST_LEN(x)	((min(x,16) - 1) << 8)
++#define BCM2711_DMA40_INC		BIT(12)
++#define BCM2711_DMA40_SIZE_32		(0 << 13)
++#define BCM2711_DMA40_SIZE_64		(1 << 13)
++#define BCM2711_DMA40_SIZE_128		(2 << 13)
++#define BCM2711_DMA40_SIZE_256		(3 << 13)
++#define BCM2711_DMA40_IGNORE		BIT(15)
++#define BCM2711_DMA40_STRIDE(x)		((x) << 16) /* For 2D mode */
++
++#define BCM2711_DMA40_MEMCPY_FLAGS \
++	(BCM2711_DMA40_QOS(0) | \
++	 BCM2711_DMA40_PANIC_QOS(0) | \
++	 BCM2711_DMA40_WAIT_FOR_WRITES | \
++	 BCM2711_DMA40_DISDEBUG)
++
++#define BCM2711_DMA40_MEMCPY_XFER_INFO \
++	(BCM2711_DMA40_SIZE_128 | \
++	 BCM2711_DMA40_INC | \
++	 BCM2711_DMA40_BURST_LEN(16))
++
++struct bcm2835_dmadev *memcpy_parent;
++static void __iomem *memcpy_chan;
++static struct bcm2711_dma40_scb *memcpy_scb;
++static dma_addr_t memcpy_scb_dma;
++DEFINE_SPINLOCK(memcpy_lock);
++
++static const struct bcm2835_dma_cfg_data bcm2835_dma_cfg = {
++	.chan_40bit_mask = 0,
++};
++
++static const struct bcm2835_dma_cfg_data bcm2711_dma_cfg = {
++	.chan_40bit_mask = BIT(11) | BIT(12) | BIT(13) | BIT(14),
++};
++
+ static inline size_t bcm2835_dma_max_frame_length(struct bcm2835_chan *c)
+ {
+ 	/* lite and normal channels have different max frame length */
+@@ -207,6 +330,32 @@ static inline struct bcm2835_desc *to_bc
+ 	return container_of(t, struct bcm2835_desc, vd.tx);
+ }
+ 
++static inline uint32_t to_bcm2711_ti(uint32_t info)
++{
++	return ((info & BCM2835_DMA_INT_EN) ? BCM2711_DMA40_INTEN : 0) |
++		((info & BCM2835_DMA_WAIT_RESP) ? BCM2711_DMA40_WAIT_RESP : 0) |
++		((info & BCM2835_DMA_S_DREQ) ?
++		 (BCM2711_DMA40_S_DREQ | BCM2711_DMA40_WAIT_RD_RESP) : 0) |
++		((info & BCM2835_DMA_D_DREQ) ? BCM2711_DMA40_D_DREQ : 0) |
++		BCM2711_DMA40_PER_MAP((info >> 16) & 0x1f);
++}
++
++static inline uint32_t to_bcm2711_srci(uint32_t info)
++{
++	return ((info & BCM2835_DMA_S_INC) ? BCM2711_DMA40_INC : 0);
++}
++
++static inline uint32_t to_bcm2711_dsti(uint32_t info)
++{
++	return ((info & BCM2835_DMA_D_INC) ? BCM2711_DMA40_INC : 0);
++}
++
++static inline uint32_t to_bcm2711_cbaddr(dma_addr_t addr)
++{
++	BUG_ON(addr & 0x1f);
++	return (addr >> 5);
++}
++
+ static void bcm2835_dma_free_cb_chain(struct bcm2835_desc *desc)
+ {
+ 	size_t i;
+@@ -225,45 +374,53 @@ static void bcm2835_dma_desc_free(struct
+ }
+ 
+ static void bcm2835_dma_create_cb_set_length(
+-	struct bcm2835_chan *chan,
++	struct bcm2835_chan *c,
+ 	struct bcm2835_dma_cb *control_block,
+ 	size_t len,
+ 	size_t period_len,
+ 	size_t *total_len,
+ 	u32 finalextrainfo)
+ {
+-	size_t max_len = bcm2835_dma_max_frame_length(chan);
++	size_t max_len = bcm2835_dma_max_frame_length(c);
++	uint32_t cb_len;
+ 
+ 	/* set the length taking lite-channel limitations into account */
+-	control_block->length = min_t(u32, len, max_len);
++	cb_len = min_t(u32, len, max_len);
+ 
+-	/* finished if we have no period_length */
+-	if (!period_len)
+-		return;
++	if (period_len) {
++		/*
++		 * period_len means: that we need to generate
++		 * transfers that are terminating at every
++		 * multiple of period_len - this is typically
++		 * used to set the interrupt flag in info
++		 * which is required during cyclic transfers
++		 */
+ 
+-	/*
+-	 * period_len means: that we need to generate
+-	 * transfers that are terminating at every
+-	 * multiple of period_len - this is typically
+-	 * used to set the interrupt flag in info
+-	 * which is required during cyclic transfers
+-	 */
++		/* have we filled in period_length yet? */
++		if (*total_len + cb_len < period_len) {
++			/* update number of bytes in this period so far */
++			*total_len += cb_len;
++		} else {
++			/* calculate the length that remains to reach period_len */
++			cb_len = period_len - *total_len;
+ 
+-	/* have we filled in period_length yet? */
+-	if (*total_len + control_block->length < period_len) {
+-		/* update number of bytes in this period so far */
+-		*total_len += control_block->length;
+-		return;
++			/* reset total_length for next period */
++			*total_len = 0;
++		}
+ 	}
+ 
+-	/* calculate the length that remains to reach period_length */
+-	control_block->length = period_len - *total_len;
+-
+-	/* reset total_length for next period */
+-	*total_len = 0;
+-
+-	/* add extrainfo bits in info */
+-	control_block->info |= finalextrainfo;
++	if (c->is_40bit_channel) {
++		struct bcm2711_dma40_scb *scb =
++			(struct bcm2711_dma40_scb *)control_block;
++
++		scb->len = cb_len;
++		/* add extrainfo bits to ti */
++		scb->ti |= to_bcm2711_ti(finalextrainfo);
++	} else {
++		control_block->length = cb_len;
++		/* add extrainfo bits to info */
++		control_block->info |= finalextrainfo;
++	}
+ }
+ 
+ static inline size_t bcm2835_dma_count_frames_for_sg(
+@@ -286,7 +443,7 @@ static inline size_t bcm2835_dma_count_f
+ /**
+  * bcm2835_dma_create_cb_chain - create a control block and fills data in
+  *
+- * @chan:           the @dma_chan for which we run this
++ * @c:              the @bcm2835_chan for which we run this
+  * @direction:      the direction in which we transfer
+  * @cyclic:         it is a cyclic transfer
+  * @info:           the default info bits to apply per controlblock
+@@ -304,12 +461,11 @@ static inline size_t bcm2835_dma_count_f
+  * @gfp:            the GFP flag to use for allocation
+  */
+ static struct bcm2835_desc *bcm2835_dma_create_cb_chain(
+-	struct dma_chan *chan, enum dma_transfer_direction direction,
++	struct bcm2835_chan *c, enum dma_transfer_direction direction,
+ 	bool cyclic, u32 info, u32 finalextrainfo, size_t frames,
+ 	dma_addr_t src, dma_addr_t dst, size_t buf_len,
+ 	size_t period_len, gfp_t gfp)
+ {
+-	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+ 	size_t len = buf_len, total_len;
+ 	size_t frame;
+ 	struct bcm2835_desc *d;
+@@ -341,11 +497,23 @@ static struct bcm2835_desc *bcm2835_dma_
+ 
+ 		/* fill in the control block */
+ 		control_block = cb_entry->cb;
+-		control_block->info = info;
+-		control_block->src = src;
+-		control_block->dst = dst;
+-		control_block->stride = 0;
+-		control_block->next = 0;
++		if (c->is_40bit_channel) {
++			struct bcm2711_dma40_scb *scb =
++				(struct bcm2711_dma40_scb *)control_block;
++			scb->ti = to_bcm2711_ti(info);
++			scb->src = lower_32_bits(src);
++			scb->srci= upper_32_bits(src) | to_bcm2711_srci(info);
++			scb->dst = lower_32_bits(dst);
++			scb->dsti = upper_32_bits(dst) | to_bcm2711_dsti(info);
++			scb->next_cb = 0;
++		} else {
++			control_block->info = info;
++			control_block->src = src;
++			control_block->dst = dst;
++			control_block->stride = 0;
++			control_block->next = 0;
++		}
++
+ 		/* set up length in control_block if requested */
+ 		if (buf_len) {
+ 			/* calculate length honoring period_length */
+@@ -359,7 +527,11 @@ static struct bcm2835_desc *bcm2835_dma_
+ 		}
+ 
+ 		/* link this the last controlblock */
+-		if (frame)
++		if (frame && c->is_40bit_channel)
++			((struct bcm2711_dma40_scb *)
++			 d->cb_list[frame - 1].cb)->next_cb =
++				to_bcm2711_cbaddr(cb_entry->paddr);
++		if (frame && !c->is_40bit_channel)
+ 			d->cb_list[frame - 1].cb->next = cb_entry->paddr;
+ 
+ 		/* update src and dst and length */
+@@ -369,11 +541,21 @@ static struct bcm2835_desc *bcm2835_dma_
+ 			dst += control_block->length;
+ 
+ 		/* Length of total transfer */
+-		d->size += control_block->length;
++		if (c->is_40bit_channel)
++			d->size += ((struct bcm2711_dma40_scb *)control_block)->len;
++		else
++			d->size += control_block->length;
+ 	}
+ 
+ 	/* the last frame requires extra flags */
+-	d->cb_list[d->frames - 1].cb->info |= finalextrainfo;
++	if (c->is_40bit_channel) {
++		struct bcm2711_dma40_scb *scb =
++			(struct bcm2711_dma40_scb *)d->cb_list[d->frames-1].cb;
++
++		scb->ti |= to_bcm2711_ti(finalextrainfo);
++	} else {
++		d->cb_list[d->frames - 1].cb->info |= finalextrainfo;
++	}
+ 
+ 	/* detect a size missmatch */
+ 	if (buf_len && (d->size != buf_len))
+@@ -387,13 +569,12 @@ error_cb:
+ }
+ 
+ static void bcm2835_dma_fill_cb_chain_with_sg(
+-	struct dma_chan *chan,
++	struct bcm2835_chan *c,
+ 	enum dma_transfer_direction direction,
+ 	struct bcm2835_cb_entry *cb,
+ 	struct scatterlist *sgl,
+ 	unsigned int sg_len)
+ {
+-	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+ 	size_t len, max_len;
+ 	unsigned int i;
+ 	dma_addr_t addr;
+@@ -401,14 +582,35 @@ static void bcm2835_dma_fill_cb_chain_wi
+ 
+ 	max_len = bcm2835_dma_max_frame_length(c);
+ 	for_each_sg(sgl, sgent, sg_len, i) {
+-		for (addr = sg_dma_address(sgent), len = sg_dma_len(sgent);
+-		     len > 0;
+-		     addr += cb->cb->length, len -= cb->cb->length, cb++) {
+-			if (direction == DMA_DEV_TO_MEM)
+-				cb->cb->dst = addr;
+-			else
+-				cb->cb->src = addr;
+-			cb->cb->length = min(len, max_len);
++		if (c->is_40bit_channel) {
++			struct bcm2711_dma40_scb *scb;
++
++			for (addr = sg_dma_address(sgent),
++				     len = sg_dma_len(sgent);
++				     len > 0;
++			     addr += scb->len, len -= scb->len, cb++) {
++				scb = (struct bcm2711_dma40_scb *)cb->cb;
++				if (direction == DMA_DEV_TO_MEM) {
++					scb->dst = lower_32_bits(addr);
++					scb->dsti = upper_32_bits(addr) | BCM2711_DMA40_INC;
++				} else {
++					scb->src = lower_32_bits(addr);
++					scb->srci = upper_32_bits(addr) | BCM2711_DMA40_INC;
++				}
++				scb->len = min(len, max_len);
++			}
++		} else {
++			for (addr = sg_dma_address(sgent),
++				     len = sg_dma_len(sgent);
++			     len > 0;
++			     addr += cb->cb->length, len -= cb->cb->length,
++			     cb++) {
++				if (direction == DMA_DEV_TO_MEM)
++					cb->cb->dst = addr;
++				else
++					cb->cb->src = addr;
++				cb->cb->length = min(len, max_len);
++			}
+ 		}
+ 	}
+ }
+@@ -417,6 +619,10 @@ static void bcm2835_dma_abort(struct bcm
+ {
+ 	void __iomem *chan_base = c->chan_base;
+ 	long int timeout = 10000;
++	u32 wait_mask = BCM2835_DMA_WAITING_FOR_WRITES;
++
++	if (c->is_40bit_channel)
++		wait_mask = BCM2711_DMA40_WAITING_FOR_WRITES;
+ 
+ 	/*
+ 	 * A zero control block address means the channel is idle.
+@@ -429,8 +635,7 @@ static void bcm2835_dma_abort(struct bcm
+ 	writel(0, chan_base + BCM2835_DMA_CS);
+ 
+ 	/* Wait for any current AXI transfer to complete */
+-	while ((readl(chan_base + BCM2835_DMA_CS) &
+-		BCM2835_DMA_WAITING_FOR_WRITES) && --timeout)
++	while ((readl(chan_base + BCM2835_DMA_CS) & wait_mask) && --timeout)
+ 		cpu_relax();
+ 
+ 	/* Peripheral might be stuck and fail to signal AXI write responses */
+@@ -455,9 +660,16 @@ static void bcm2835_dma_start_desc(struc
+ 
+ 	c->desc = d = to_bcm2835_dma_desc(&vd->tx);
+ 
+-	writel(d->cb_list[0].paddr, c->chan_base + BCM2835_DMA_ADDR);
+-	writel(BCM2835_DMA_ACTIVE | BCM2835_DMA_CS_FLAGS(c->dreq),
+-	       c->chan_base + BCM2835_DMA_CS);
++	if (c->is_40bit_channel) {
++		writel(to_bcm2711_cbaddr(d->cb_list[0].paddr),
++		       c->chan_base + BCM2711_DMA40_CB);
++		writel(BCM2711_DMA40_ACTIVE | BCM2711_DMA40_CS_FLAGS(c->dreq),
++		       c->chan_base + BCM2711_DMA40_CS);
++	} else {
++		writel(d->cb_list[0].paddr, c->chan_base + BCM2835_DMA_ADDR);
++		writel(BCM2835_DMA_ACTIVE | BCM2835_DMA_CS_FLAGS(c->dreq),
++		       c->chan_base + BCM2835_DMA_CS);
++	}
+ }
+ 
+ static irqreturn_t bcm2835_dma_callback(int irq, void *data)
+@@ -484,8 +696,7 @@ static irqreturn_t bcm2835_dma_callback(
+ 	 * if this IRQ handler is threaded.) If the channel is finished, it
+ 	 * will remain idle despite the ACTIVE flag being set.
+ 	 */
+-	writel(BCM2835_DMA_INT | BCM2835_DMA_ACTIVE |
+-	       BCM2835_DMA_CS_FLAGS(c->dreq),
++	writel(BCM2835_DMA_INT | BCM2835_DMA_ACTIVE,
+ 	       c->chan_base + BCM2835_DMA_CS);
+ 
+ 	d = c->desc;
+@@ -588,9 +799,17 @@ static enum dma_status bcm2835_dma_tx_st
+ 		struct bcm2835_desc *d = c->desc;
+ 		dma_addr_t pos;
+ 
+-		if (d->dir == DMA_MEM_TO_DEV)
++		if (d->dir == DMA_MEM_TO_DEV && c->is_40bit_channel)
++			pos = readl(c->chan_base + BCM2711_DMA40_SRC) +
++				((readl(c->chan_base + BCM2711_DMA40_SRCI) &
++				  0xff) << 8);
++		else if (d->dir == DMA_MEM_TO_DEV && !c->is_40bit_channel)
+ 			pos = readl(c->chan_base + BCM2835_DMA_SOURCE_AD);
+-		else if (d->dir == DMA_DEV_TO_MEM)
++		else if (d->dir == DMA_DEV_TO_MEM && c->is_40bit_channel)
++			pos = readl(c->chan_base + BCM2711_DMA40_DEST) +
++				((readl(c->chan_base + BCM2711_DMA40_DESTI) &
++				  0xff) << 8);
++		else if (d->dir == DMA_DEV_TO_MEM && !c->is_40bit_channel)
+ 			pos = readl(c->chan_base + BCM2835_DMA_DEST_AD);
+ 		else
+ 			pos = 0;
+@@ -636,7 +855,7 @@ static struct dma_async_tx_descriptor *b
+ 	frames = bcm2835_dma_frames_for_length(len, max_len);
+ 
+ 	/* allocate the CB chain - this also fills in the pointers */
+-	d = bcm2835_dma_create_cb_chain(chan, DMA_MEM_TO_MEM, false,
++	d = bcm2835_dma_create_cb_chain(c, DMA_MEM_TO_MEM, false,
+ 					info, extra, frames,
+ 					src, dst, len, 0, GFP_KERNEL);
+ 	if (!d)
+@@ -671,11 +890,21 @@ static struct dma_async_tx_descriptor *b
+ 		if (c->cfg.src_addr_width != DMA_SLAVE_BUSWIDTH_4_BYTES)
+ 			return NULL;
+ 		src = c->cfg.src_addr;
++		/*
++		 * One would think it ought to be possible to get the physical
++		 * to dma address mapping information from the dma-ranges DT
++		 * property, but I've not found a way yet that doesn't involve
++		 * open-coding the whole thing.
++		 */
++		if (c->is_40bit_channel)
++		    src |= 0x400000000ull;
+ 		info |= BCM2835_DMA_S_DREQ | BCM2835_DMA_D_INC;
+ 	} else {
+ 		if (c->cfg.dst_addr_width != DMA_SLAVE_BUSWIDTH_4_BYTES)
+ 			return NULL;
+ 		dst = c->cfg.dst_addr;
++		if (c->is_40bit_channel)
++		    dst |= 0x400000000ull;
+ 		info |= BCM2835_DMA_D_DREQ | BCM2835_DMA_S_INC;
+ 	}
+ 
+@@ -683,7 +912,7 @@ static struct dma_async_tx_descriptor *b
+ 	frames = bcm2835_dma_count_frames_for_sg(c, sgl, sg_len);
+ 
+ 	/* allocate the CB chain */
+-	d = bcm2835_dma_create_cb_chain(chan, direction, false,
++	d = bcm2835_dma_create_cb_chain(c, direction, false,
+ 					info, extra,
+ 					frames, src, dst, 0, 0,
+ 					GFP_NOWAIT);
+@@ -691,7 +920,7 @@ static struct dma_async_tx_descriptor *b
+ 		return NULL;
+ 
+ 	/* fill in frames with scatterlist pointers */
+-	bcm2835_dma_fill_cb_chain_with_sg(chan, direction, d->cb_list,
++	bcm2835_dma_fill_cb_chain_with_sg(c, direction, d->cb_list,
+ 					  sgl, sg_len);
+ 
+ 	return vchan_tx_prep(&c->vc, &d->vd, flags);
+@@ -745,12 +974,16 @@ static struct dma_async_tx_descriptor *b
+ 		if (c->cfg.src_addr_width != DMA_SLAVE_BUSWIDTH_4_BYTES)
+ 			return NULL;
+ 		src = c->cfg.src_addr;
++		if (c->is_40bit_channel)
++		    src |= 0x400000000ull;
+ 		dst = buf_addr;
+ 		info |= BCM2835_DMA_S_DREQ | BCM2835_DMA_D_INC;
+ 	} else {
+ 		if (c->cfg.dst_addr_width != DMA_SLAVE_BUSWIDTH_4_BYTES)
+ 			return NULL;
+ 		dst = c->cfg.dst_addr;
++		if (c->is_40bit_channel)
++		    dst |= 0x400000000ull;
+ 		src = buf_addr;
+ 		info |= BCM2835_DMA_D_DREQ | BCM2835_DMA_S_INC;
+ 
+@@ -770,7 +1003,7 @@ static struct dma_async_tx_descriptor *b
+ 	 * note that we need to use GFP_NOWAIT, as the ALSA i2s dmaengine
+ 	 * implementation calls prep_dma_cyclic with interrupts disabled.
+ 	 */
+-	d = bcm2835_dma_create_cb_chain(chan, direction, true,
++	d = bcm2835_dma_create_cb_chain(c, direction, true,
+ 					info, extra,
+ 					frames, src, dst, buf_len,
+ 					period_len, GFP_NOWAIT);
+@@ -778,7 +1011,12 @@ static struct dma_async_tx_descriptor *b
+ 		return NULL;
+ 
+ 	/* wrap around into a loop */
+-	d->cb_list[d->frames - 1].cb->next = d->cb_list[0].paddr;
++	if (c->is_40bit_channel)
++		((struct bcm2711_dma40_scb *)
++		 d->cb_list[frames - 1].cb)->next_cb =
++			to_bcm2711_cbaddr(d->cb_list[0].paddr);
++	else
++		d->cb_list[d->frames - 1].cb->next = d->cb_list[0].paddr;
+ 
+ 	return vchan_tx_prep(&c->vc, &d->vd, flags);
+ }
+@@ -839,9 +1077,11 @@ static int bcm2835_dma_chan_init(struct
+ 	c->irq_number = irq;
+ 	c->irq_flags = irq_flags;
+ 
+-	/* check in DEBUG register if this is a LITE channel */
+-	if (readl(c->chan_base + BCM2835_DMA_DEBUG) &
+-		BCM2835_DMA_DEBUG_LITE)
++	/* check for 40bit and lite channels */
++	if (d->cfg_data->chan_40bit_mask & BIT(chan_id))
++		c->is_40bit_channel = true;
++	else if (readl(c->chan_base + BCM2835_DMA_DEBUG) &
++		 BCM2835_DMA_DEBUG_LITE)
+ 		c->is_lite_channel = true;
+ 
+ 	return 0;
+@@ -861,8 +1101,58 @@ static void bcm2835_dma_free(struct bcm2
+ 			     DMA_TO_DEVICE, DMA_ATTR_SKIP_CPU_SYNC);
+ }
+ 
++int bcm2711_dma40_memcpy_init(void)
++{
++	if (!memcpy_parent)
++		return -EPROBE_DEFER;
++
++	if (!memcpy_chan)
++		return -EINVAL;
++
++	if (!memcpy_scb)
++		return -ENOMEM;
++
++	return 0;
++}
++EXPORT_SYMBOL(bcm2711_dma40_memcpy_init);
++
++void bcm2711_dma40_memcpy(dma_addr_t dst, dma_addr_t src, size_t size)
++{
++	struct bcm2711_dma40_scb *scb = memcpy_scb;
++	unsigned long flags;
++
++	if (!scb) {
++		pr_err("bcm2711_dma40_memcpy not initialised!\n");
++		return;
++	}
++
++	spin_lock_irqsave(&memcpy_lock, flags);
++
++	scb->ti = 0;
++	scb->src = lower_32_bits(src);
++	scb->srci = upper_32_bits(src) | BCM2711_DMA40_MEMCPY_XFER_INFO;
++	scb->dst = lower_32_bits(dst);
++	scb->dsti = upper_32_bits(dst) | BCM2711_DMA40_MEMCPY_XFER_INFO;
++	scb->len = size;
++	scb->next_cb = 0;
++
++	writel((u32)(memcpy_scb_dma >> 5), memcpy_chan + BCM2711_DMA40_CB);
++	writel(BCM2711_DMA40_MEMCPY_FLAGS + BCM2711_DMA40_ACTIVE,
++	       memcpy_chan + BCM2711_DMA40_CS);
++
++	/* Poll for completion */
++	while (!(readl(memcpy_chan + BCM2711_DMA40_CS) & BCM2711_DMA40_END))
++		cpu_relax();
++
++	writel(BCM2711_DMA40_END, memcpy_chan + BCM2711_DMA40_CS);
++
++	spin_unlock_irqrestore(&memcpy_lock, flags);
++}
++EXPORT_SYMBOL(bcm2711_dma40_memcpy);
++
+ static const struct of_device_id bcm2835_dma_of_match[] = {
+-	{ .compatible = "brcm,bcm2835-dma", },
++	{ .compatible = "brcm,bcm2835-dma", .data = &bcm2835_dma_cfg },
++	{ .compatible = "brcm,bcm2711-dma", .data = &bcm2711_dma_cfg },
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(of, bcm2835_dma_of_match);
+@@ -894,6 +1184,8 @@ static int bcm2835_dma_probe(struct plat
+ 	int irq_flags;
+ 	uint32_t chans_available;
+ 	char chan_name[BCM2835_DMA_CHAN_NAME_SIZE];
++	const struct of_device_id *of_id;
++	int chan_count, chan_start, chan_end;
+ 
+ 	if (!pdev->dev.dma_mask)
+ 		pdev->dev.dma_mask = &pdev->dev.coherent_dma_mask;
+@@ -914,9 +1206,13 @@ static int bcm2835_dma_probe(struct plat
+ 	base = devm_ioremap_resource(&pdev->dev, res);
+ 	if (IS_ERR(base))
+ 		return PTR_ERR(base);
+-	rc = bcm_dmaman_probe(pdev, base, BCM2835_DMA_BULK_MASK);
+-	if (rc)
+-		dev_err(&pdev->dev, "Failed to initialize the legacy API\n");
++
++	/* The set of channels can be split across multiple instances. */
++	chan_start = ((u32)(uintptr_t)base / BCM2835_DMA_CHAN_SIZE) & 0xf;
++	base -= BCM2835_DMA_CHAN(chan_start);
++	chan_count = resource_size(res) / BCM2835_DMA_CHAN_SIZE;
++	chan_end = min(chan_start + chan_count,
++			 BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED + 1);
+ 
+ 	od->base = base;
+ 
+@@ -953,6 +1249,14 @@ static int bcm2835_dma_probe(struct plat
+ 		return -ENOMEM;
+ 	}
+ 
++	of_id = of_match_node(bcm2835_dma_of_match, pdev->dev.of_node);
++	if (!of_id) {
++		dev_err(&pdev->dev, "Failed to match compatible string\n");
++		return -EINVAL;
++	}
++
++	od->cfg_data = of_id->data;
++
+ 	/* Request DMA channel mask from device tree */
+ 	if (of_property_read_u32(pdev->dev.of_node,
+ 			"brcm,dma-channel-mask",
+@@ -962,11 +1266,34 @@ static int bcm2835_dma_probe(struct plat
+ 		goto err_no_dma;
+ 	}
+ 
+-	/* Channel 0 is used by the legacy API */
+-	chans_available &= ~BCM2835_DMA_BULK_MASK;
++	/* One channel is reserved for the legacy API */
++	if (chans_available & BCM2835_DMA_BULK_MASK) {
++		rc = bcm_dmaman_probe(pdev, base,
++				      chans_available & BCM2835_DMA_BULK_MASK);
++		if (rc)
++			dev_err(&pdev->dev,
++				"Failed to initialize the legacy API\n");
++
++		chans_available &= ~BCM2835_DMA_BULK_MASK;
++	}
++
++	/* And possibly one for the 40-bit DMA memcpy API */
++	if (chans_available & od->cfg_data->chan_40bit_mask &
++	    BIT(BCM2711_DMA_MEMCPY_CHAN)) {
++		memcpy_parent = od;
++		memcpy_chan = BCM2835_DMA_CHANIO(base, BCM2711_DMA_MEMCPY_CHAN);
++		memcpy_scb = dma_alloc_coherent(memcpy_parent->ddev.dev,
++						sizeof(*memcpy_scb),
++						&memcpy_scb_dma, GFP_KERNEL);
++		if (!memcpy_scb)
++			dev_warn(&pdev->dev,
++				 "Failed to allocated memcpy scb\n");
++
++		chans_available &= ~BIT(BCM2711_DMA_MEMCPY_CHAN);
++	}
+ 
+ 	/* get irqs for each channel that we support */
+-	for (i = 0; i <= BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED; i++) {
++	for (i = chan_start; i < chan_end; i++) {
+ 		/* skip masked out channels */
+ 		if (!(chans_available & (1 << i))) {
+ 			irq[i] = -1;
+@@ -989,13 +1316,17 @@ static int bcm2835_dma_probe(struct plat
+ 		irq[i] = platform_get_irq(pdev, i < 11 ? i : 11);
+ 	}
+ 
++	chan_count = 0;
++
+ 	/* get irqs for each channel */
+-	for (i = 0; i <= BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED; i++) {
++	for (i = chan_start; i < chan_end; i++) {
+ 		/* skip channels without irq */
+ 		if (irq[i] < 0)
+ 			continue;
+ 
+ 		/* check if there are other channels that also use this irq */
++		/* FIXME: This will fail if interrupts are shared across
++		   instances */
+ 		irq_flags = 0;
+ 		for (j = 0; j <= BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED; j++)
+ 			if ((i != j) && (irq[j] == irq[i])) {
+@@ -1007,9 +1338,10 @@ static int bcm2835_dma_probe(struct plat
+ 		rc = bcm2835_dma_chan_init(od, i, irq[i], irq_flags);
+ 		if (rc)
+ 			goto err_no_dma;
++		chan_count++;
+ 	}
+ 
+-	dev_dbg(&pdev->dev, "Initialized %i DMA channels\n", i);
++	dev_dbg(&pdev->dev, "Initialized %i DMA channels\n", chan_count);
+ 
+ 	/* Device-tree DMA controller registration */
+ 	rc = of_dma_controller_register(pdev->dev.of_node,
+@@ -1041,6 +1373,13 @@ static int bcm2835_dma_remove(struct pla
+ 
+ 	bcm_dmaman_remove(pdev);
+ 	dma_async_device_unregister(&od->ddev);
++	if (memcpy_parent == od) {
++		dma_free_coherent(&pdev->dev, sizeof(*memcpy_scb), memcpy_scb,
++				  memcpy_scb_dma);
++		memcpy_parent = NULL;
++		memcpy_scb = NULL;
++		memcpy_chan = NULL;
++	}
+ 	bcm2835_dma_free(od);
+ 
+ 	return 0;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0234-media-i2c-tc358743-Fix-fallthrough-warning.patch b/target/linux/bcm27xx/patches-6.1/950-0234-media-i2c-tc358743-Fix-fallthrough-warning.patch
new file mode 100644
index 00000000000000..824f9212f7dea9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0234-media-i2c-tc358743-Fix-fallthrough-warning.patch
@@ -0,0 +1,20 @@
+From 642eccec66b8369271bcbede9ece01be1408cf24 Mon Sep 17 00:00:00 2001
+From: Jacko Dirks <jdirks.linuxdev@gmail.com>
+Date: Tue, 5 May 2020 14:28:14 +0200
+Subject: [PATCH] media: i2c: tc358743: Fix fallthrough warning
+
+Signed-off-by: Jacko Dirks <jdirks.linuxdev@gmail.com>
+---
+ drivers/media/i2c/tc358743.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -1983,6 +1983,7 @@ static int tc358743_probe_of(struct tc35
+ 	switch (bps_pr_lane) {
+ 	default:
+ 		dev_warn(dev, "untested bps per lane: %u bps\n", bps_pr_lane);
++		fallthrough;
+ 	case 594000000U:
+ 		state->pdata.lineinitcnt = 0xe80;
+ 		state->pdata.lptxtimecnt = 0x003;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0235-video-bcm2708_fb-Disable-FB-if-no-displays-found.patch b/target/linux/bcm27xx/patches-6.1/950-0235-video-bcm2708_fb-Disable-FB-if-no-displays-found.patch
new file mode 100644
index 00000000000000..d4dd3604cf211d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0235-video-bcm2708_fb-Disable-FB-if-no-displays-found.patch
@@ -0,0 +1,34 @@
+From 766c7b1963199536393ef37101265b94932489a0 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 5 May 2020 19:45:41 +0100
+Subject: [PATCH] video: bcm2708_fb: Disable FB if no displays found
+
+If the firmware hasn't detected a display, the driver would assume
+one display was available, but because it had failed to retrieve the
+display size it would try to allocate a zero-sized buffer.
+
+Avoid the allocation failure by bailing out early if no display is
+found.
+
+See: https://github.com/raspberrypi/linux/issues/3598
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/video/fbdev/bcm2708_fb.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/video/fbdev/bcm2708_fb.c
++++ b/drivers/video/fbdev/bcm2708_fb.c
+@@ -1092,10 +1092,9 @@ static int bcm2708_fb_probe(struct platf
+ 	 * set one display
+ 	 */
+ 	if (ret || num_displays == 0) {
+-		num_displays = 1;
+ 		dev_err(&dev->dev,
+-			"Unable to determine number of FB's. Assuming 1\n");
+-		ret = 0;
++			"Unable to determine number of FBs. Disabling driver.\n");
++		return -ENOENT;
+ 	} else {
+ 		fbdev->firmware_supports_multifb = 1;
+ 	}
diff --git a/target/linux/bcm27xx/patches-6.1/950-0236-staging-vc04_services-mmal-vchiq-Update-parameters-l.patch b/target/linux/bcm27xx/patches-6.1/950-0236-staging-vc04_services-mmal-vchiq-Update-parameters-l.patch
new file mode 100644
index 00000000000000..e434281ec352bb
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0236-staging-vc04_services-mmal-vchiq-Update-parameters-l.patch
@@ -0,0 +1,28 @@
+From 3555005ad1614e1832b9c14d66dc5f2b9d7b1a11 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 15 May 2020 13:42:10 +0100
+Subject: [PATCH] staging: vc04_services: mmal-vchiq: Update parameters
+ list
+
+Adds in a couple of new MMAL parameter defines.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
+@@ -609,6 +609,12 @@ enum mmal_parameter_video_type {
+ 
+ 	/**< Takes a @ref MMAL_PARAMETER_UINT32_T */
+ 	MMAL_PARAMETER_VIDEO_DROPPABLE_PFRAME_LENGTH,
++
++	/**< Take a @ref MMAL_PARAMETER_VIDEO_STALL_T */
++	MMAL_PARAMETER_VIDEO_STALL_THRESHOLD,
++
++	/**< Take a @ref MMAL_PARAMETER_BOOLEAN_T */
++	MMAL_PARAMETER_VIDEO_ENCODE_HEADERS_WITH_FRAME,
+ };
+ 
+ /** Valid mirror modes */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0237-staging-vc04_services-bcm2835-camera-Request-headers.patch b/target/linux/bcm27xx/patches-6.1/950-0237-staging-vc04_services-bcm2835-camera-Request-headers.patch
new file mode 100644
index 00000000000000..a738b33c5e694d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0237-staging-vc04_services-bcm2835-camera-Request-headers.patch
@@ -0,0 +1,30 @@
+From 45e23b963f9bac2f83abf1c980f2269c608a12c9 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 15 May 2020 13:48:59 +0100
+Subject: [PATCH] staging:vc04_services: bcm2835-camera: Request
+ headers with I-frame
+
+V4L2 wishes to have the codec header bytes in the same buffer as the
+first encoded frame, so it does become 1-in 1-out for encoding.
+The firmware now has an option to do this, so enable it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../staging/vc04_services/bcm2835-camera/bcm2835-camera.c   | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+@@ -1730,6 +1730,12 @@ static int mmal_init(struct bcm2835_mmal
+ 					      MMAL_PARAMETER_MINIMISE_FRAGMENTATION,
+ 					      &enable,
+ 					      sizeof(enable));
++
++		/* Enable inserting headers into the first frame */
++		vchiq_mmal_port_parameter_set(dev->instance,
++					      &dev->component[COMP_VIDEO_ENCODE]->control,
++					      MMAL_PARAMETER_VIDEO_ENCODE_HEADERS_WITH_FRAME,
++					      &enable, sizeof(enable));
+ 	}
+ 	ret = bcm2835_mmal_set_all_camera_controls(dev);
+ 	if (ret < 0) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0238-zswap-Defer-zswap-initialisation.patch b/target/linux/bcm27xx/patches-6.1/950-0238-zswap-Defer-zswap-initialisation.patch
new file mode 100644
index 00000000000000..eccee8dd3607c5
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0238-zswap-Defer-zswap-initialisation.patch
@@ -0,0 +1,129 @@
+From cfe4cda49168a35df7a278e567542c2b7fa096c3 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 5 May 2020 15:23:32 +0100
+Subject: [PATCH] zswap: Defer zswap initialisation
+
+Enabling zswap support in the kernel configuration costs about 1.5MB
+of RAM, even when zswap is not enabled at runtime. This cost can be
+reduced significantly by deferring initialisation (including pool
+creation) until the "enabled" parameter is set to true. There is a
+small cost to this in that some initialisation code has to remain in
+memory after the init phase, just in case they are needed later,
+but the total size increase is negligible.
+
+See: https://github.com/raspberrypi/linux/pull/3432
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ mm/zswap.c | 53 +++++++++++++++++++++++++++++------------------------
+ 1 file changed, 29 insertions(+), 24 deletions(-)
+
+--- a/mm/zswap.c
++++ b/mm/zswap.c
+@@ -663,8 +663,9 @@ error:
+ 	return NULL;
+ }
+ 
+-static __init struct zswap_pool *__zswap_pool_create_fallback(void)
++static bool zswap_try_pool_create(void)
+ {
++	struct zswap_pool *pool;
+ 	bool has_comp, has_zpool;
+ 
+ 	has_comp = crypto_has_acomp(zswap_compressor, 0, 0);
+@@ -700,9 +701,21 @@ static __init struct zswap_pool *__zswap
+ 	}
+ 
+ 	if (!has_comp || !has_zpool)
+-		return NULL;
++		return false;
++
++	pool = zswap_pool_create(zswap_zpool_type, zswap_compressor);
+ 
+-	return zswap_pool_create(zswap_zpool_type, zswap_compressor);
++	if (pool) {
++		pr_info("loaded using pool %s/%s\n", pool->tfm_name,
++			zpool_get_type(pool->zpool));
++		list_add(&pool->list, &zswap_pools);
++		zswap_has_pool = true;
++	} else {
++		pr_err("pool creation failed\n");
++		zswap_enabled = false;
++	}
++
++	return zswap_enabled;
+ }
+ 
+ static void zswap_pool_destroy(struct zswap_pool *pool)
+@@ -875,16 +888,19 @@ static int zswap_zpool_param_set(const c
+ static int zswap_enabled_param_set(const char *val,
+ 				   const struct kernel_param *kp)
+ {
++	int ret;
++
+ 	if (zswap_init_failed) {
+ 		pr_err("can't enable, initialization failed\n");
+ 		return -ENODEV;
+ 	}
+-	if (!zswap_has_pool && zswap_init_started) {
+-		pr_err("can't enable, no pool configured\n");
+-		return -ENODEV;
+-	}
+ 
+-	return param_set_bool(val, kp);
++	ret = param_set_bool(val, kp);
++	if (!ret && zswap_enabled && zswap_init_started && !zswap_has_pool)
++		if (!zswap_try_pool_create())
++			ret = -ENODEV;
++
++	return ret;
+ }
+ 
+ /*********************************
+@@ -1489,7 +1505,6 @@ static int __init zswap_debugfs_init(voi
+ **********************************/
+ static int __init init_zswap(void)
+ {
+-	struct zswap_pool *pool;
+ 	int ret;
+ 
+ 	zswap_init_started = true;
+@@ -1513,33 +1528,23 @@ static int __init init_zswap(void)
+ 	if (ret)
+ 		goto hp_fail;
+ 
+-	pool = __zswap_pool_create_fallback();
+-	if (pool) {
+-		pr_info("loaded using pool %s/%s\n", pool->tfm_name,
+-			zpool_get_type(pool->zpool));
+-		list_add(&pool->list, &zswap_pools);
+-		zswap_has_pool = true;
+-	} else {
+-		pr_err("pool creation failed\n");
+-		zswap_enabled = false;
+-	}
+-
+ 	shrink_wq = create_workqueue("zswap-shrink");
+ 	if (!shrink_wq)
+-		goto fallback_fail;
++		goto hp_fail;
+ 
+ 	ret = frontswap_register_ops(&zswap_frontswap_ops);
+ 	if (ret)
+ 		goto destroy_wq;
+ 	if (zswap_debugfs_init())
+ 		pr_warn("debugfs initialization failed\n");
++
++	if (zswap_enabled)
++		zswap_try_pool_create();
++
+ 	return 0;
+ 
+ destroy_wq:
+ 	destroy_workqueue(shrink_wq);
+-fallback_fail:
+-	if (pool)
+-		zswap_pool_destroy(pool);
+ hp_fail:
+ 	cpuhp_remove_state(CPUHP_MM_ZSWP_MEM_PREPARE);
+ dstmem_fail:
diff --git a/target/linux/bcm27xx/patches-6.1/950-0239-gpiolib-Don-t-prevent-IRQ-usage-of-output-GPIOs.patch b/target/linux/bcm27xx/patches-6.1/950-0239-gpiolib-Don-t-prevent-IRQ-usage-of-output-GPIOs.patch
new file mode 100644
index 00000000000000..617a0025166c19
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0239-gpiolib-Don-t-prevent-IRQ-usage-of-output-GPIOs.patch
@@ -0,0 +1,50 @@
+From 14b3cf60aafc538071ad54305069763551c471af Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 24 Apr 2018 14:42:27 +0100
+Subject: [PATCH] gpiolib: Don't prevent IRQ usage of output GPIOs
+
+Upstream Linux deems using output GPIOs to generate IRQs as a bogus
+use case, even though the BCM2835 GPIO controller is capable of doing
+so. A number of users would like to make use of this facility, so
+disable the checks.
+
+See: https://github.com/raspberrypi/linux/issues/2527
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/gpio/gpiolib.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -52,6 +52,8 @@
+ #define	extra_checks	0
+ #endif
+ 
++#define dont_test_bit(b,d) (0)
++
+ /* Device and char device-related information */
+ static DEFINE_IDA(gpio_ida);
+ static dev_t gpio_devt;
+@@ -2414,8 +2416,8 @@ int gpiod_direction_output(struct gpio_d
+ 		value = !!value;
+ 
+ 	/* GPIOs used for enabled IRQs shall not be set as output */
+-	if (test_bit(FLAG_USED_AS_IRQ, &desc->flags) &&
+-	    test_bit(FLAG_IRQ_IS_ENABLED, &desc->flags)) {
++	if (dont_test_bit(FLAG_USED_AS_IRQ, &desc->flags) &&
++	    dont_test_bit(FLAG_IRQ_IS_ENABLED, &desc->flags)) {
+ 		gpiod_err(desc,
+ 			  "%s: tried to set a GPIO tied to an IRQ as output\n",
+ 			  __func__);
+@@ -3293,8 +3295,8 @@ int gpiochip_lock_as_irq(struct gpio_chi
+ 	}
+ 
+ 	/* To be valid for IRQ the line needs to be input or open drain */
+-	if (test_bit(FLAG_IS_OUT, &desc->flags) &&
+-	    !test_bit(FLAG_OPEN_DRAIN, &desc->flags)) {
++	if (dont_test_bit(FLAG_IS_OUT, &desc->flags) &&
++	    !dont_test_bit(FLAG_OPEN_DRAIN, &desc->flags)) {
+ 		chip_err(gc,
+ 			 "%s: tried to flag a GPIO set as output for IRQ\n",
+ 			 __func__);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0240-PCI-brcmstb-Add-DT-property-to-control-L1SS.patch b/target/linux/bcm27xx/patches-6.1/950-0240-PCI-brcmstb-Add-DT-property-to-control-L1SS.patch
new file mode 100644
index 00000000000000..000a96fa4d5221
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0240-PCI-brcmstb-Add-DT-property-to-control-L1SS.patch
@@ -0,0 +1,75 @@
+From ebabd0b257fd8863e8038e9fd5b3b8428b06cfe2 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 11 Jun 2020 09:57:03 +0100
+Subject: [PATCH] PCI: brcmstb: Add DT property to control L1SS
+
+The BRCM PCIe block has controls to enable control of the CLKREQ#
+signal by the L1SS, and to gate the refclk with the CLKREQ# input.
+These controls are mutually exclusive - the upstream code sets the
+latter, but some use cases require the former.
+
+Add a Device Tree property - brcm,enable-l1ss - to switch to the
+L1SS configuration.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/pci/controller/pcie-brcmstb.c | 26 +++++++++++++++++++++-----
+ 1 file changed, 21 insertions(+), 5 deletions(-)
+
+--- a/drivers/pci/controller/pcie-brcmstb.c
++++ b/drivers/pci/controller/pcie-brcmstb.c
+@@ -120,6 +120,7 @@
+ #define  PCIE_MISC_HARD_PCIE_HARD_DEBUG_CLKREQ_DEBUG_ENABLE_MASK	0x2
+ #define  PCIE_MISC_HARD_PCIE_HARD_DEBUG_SERDES_IDDQ_MASK		0x08000000
+ #define  PCIE_BMIPS_MISC_HARD_PCIE_HARD_DEBUG_SERDES_IDDQ_MASK		0x00800000
++#define  PCIE_MISC_HARD_PCIE_HARD_DEBUG_CLKREQ_L1SS_ENABLE_MASK		0x00200000
+ 
+ 
+ #define PCIE_INTR2_CPU_BASE		0x4300
+@@ -249,6 +250,7 @@ struct brcm_pcie {
+ 	struct clk		*clk;
+ 	struct device_node	*np;
+ 	bool			ssc;
++	bool			l1ss;
+ 	int			gen;
+ 	u64			msi_target_addr;
+ 	struct brcm_msi		*msi;
+@@ -1062,12 +1064,25 @@ static int brcm_pcie_start_link(struct b
+ 		 pci_speed_string(pcie_link_speed[cls]), nlw,
+ 		 ssc_good ? "(SSC)" : "(!SSC)");
+ 
+-	/*
+-	 * Refclk from RC should be gated with CLKREQ# input when ASPM L0s,L1
+-	 * is enabled => setting the CLKREQ_DEBUG_ENABLE field to 1.
+-	 */
+ 	tmp = readl(base + PCIE_MISC_HARD_PCIE_HARD_DEBUG);
+-	tmp |= PCIE_MISC_HARD_PCIE_HARD_DEBUG_CLKREQ_DEBUG_ENABLE_MASK;
++	if (pcie->l1ss) {
++		/*
++		 * Enable CLKREQ# signalling include L1 Substate control of
++		 * the CLKREQ# signal and the external reference clock buffer.
++		 * meet requirement for Endpoints that require CLKREQ#
++		 * assertion to clock active within 400ns.
++		 */
++		tmp &= ~PCIE_MISC_HARD_PCIE_HARD_DEBUG_CLKREQ_DEBUG_ENABLE_MASK;
++		tmp |= PCIE_MISC_HARD_PCIE_HARD_DEBUG_CLKREQ_L1SS_ENABLE_MASK;
++	} else {
++		/*
++		 * Refclk from RC should be gated with CLKREQ# input when
++		 * ASPM L0s,L1 is enabled => setting the CLKREQ_DEBUG_ENABLE
++		 * field to 1.
++		 */
++		tmp &= ~PCIE_MISC_HARD_PCIE_HARD_DEBUG_CLKREQ_L1SS_ENABLE_MASK;
++		tmp |= PCIE_MISC_HARD_PCIE_HARD_DEBUG_CLKREQ_DEBUG_ENABLE_MASK;
++	}
+ 	writel(tmp, base + PCIE_MISC_HARD_PCIE_HARD_DEBUG);
+ 
+ 	return 0;
+@@ -1523,6 +1538,7 @@ static int brcm_pcie_probe(struct platfo
+ 	pcie->gen = (ret < 0) ? 0 : ret;
+ 
+ 	pcie->ssc = of_property_read_bool(np, "brcm,enable-ssc");
++	pcie->l1ss = of_property_read_bool(np, "brcm,enable-l1ss");
+ 
+ 	ret = clk_prepare_enable(pcie->clk);
+ 	if (ret) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0241-media-irs1125-Using-i2c_transfer-for-ic2-reads.patch b/target/linux/bcm27xx/patches-6.1/950-0241-media-irs1125-Using-i2c_transfer-for-ic2-reads.patch
new file mode 100644
index 00000000000000..49b96ba27c5ab9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0241-media-irs1125-Using-i2c_transfer-for-ic2-reads.patch
@@ -0,0 +1,65 @@
+From 4923e1228b48e22d014f1f10b12ab0fa18d7821f Mon Sep 17 00:00:00 2001
+From: Markus Proeller <markus.proeller@pieye.org>
+Date: Tue, 16 Jun 2020 13:24:31 +0200
+Subject: [PATCH] media: irs1125: Using i2c_transfer for ic2 reads
+
+Reading data over i2c is done by using i2c_transfer to ensure that this
+operation can't be interrupted.
+
+Signed-off-by: Markus Proeller <markus.proeller@pieye.org>
+---
+ drivers/media/i2c/irs1125.c | 37 ++++++++++++++++++++++---------------
+ 1 file changed, 22 insertions(+), 15 deletions(-)
+
+--- a/drivers/media/i2c/irs1125.c
++++ b/drivers/media/i2c/irs1125.c
+@@ -248,27 +248,34 @@ static int irs1125_write(struct v4l2_sub
+ 
+ static int irs1125_read(struct v4l2_subdev *sd, u16 reg, u16 *val)
+ {
+-	int ret;
+-	unsigned char data_w[2] = { reg >> 8, reg & 0xff };
+-	char rdval[2];
+-
+ 	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	struct i2c_msg msgs[2];
++	u8 addr_buf[2] = { reg >> 8, reg & 0xff };
++	u8 data_buf[2] = { 0, };
++	int ret;
+ 
+-	ret = i2c_master_send(client, data_w, 2);
+-	if (ret < 0) {
+-		dev_dbg(&client->dev, "%s: i2c write error, reg: %x\n",
+-			__func__, reg);
++	/* Write register address */
++	msgs[0].addr = client->addr;
++	msgs[0].flags = 0;
++	msgs[0].len = ARRAY_SIZE(addr_buf);
++	msgs[0].buf = addr_buf;
++
++	/* Read data from register */
++	msgs[1].addr = client->addr;
++	msgs[1].flags = I2C_M_RD;
++	msgs[1].len = 2;
++	msgs[1].buf = data_buf;
++
++	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++	if (ret != ARRAY_SIZE(msgs)) {
++		if (ret >= 0)
++			ret = -EIO;
+ 		return ret;
+ 	}
+ 
+-	ret = i2c_master_recv(client, rdval, 2);
+-	if (ret < 0)
+-		dev_err(&client->dev, "%s: i2c read error, reg: %x\n",
+-			__func__, reg);
+-
+-	*val = rdval[1] | (rdval[0] << 8);
++	*val = data_buf[1] | (data_buf[0] << 8);
+ 
+-	return ret;
++	return 0;
+ }
+ 
+ static int irs1125_write_array(struct v4l2_subdev *sd,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0242-media-irs1125-Refactoring-and-debug-messages.patch b/target/linux/bcm27xx/patches-6.1/950-0242-media-irs1125-Refactoring-and-debug-messages.patch
new file mode 100644
index 00000000000000..24d87c849a605e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0242-media-irs1125-Refactoring-and-debug-messages.patch
@@ -0,0 +1,123 @@
+From 979c2242ce97ccc12869e60f7c1f1258c906a99c Mon Sep 17 00:00:00 2001
+From: Markus Proeller <markus.proeller@pieye.org>
+Date: Tue, 16 Jun 2020 13:27:42 +0200
+Subject: [PATCH] media: irs1125: Refactoring and debug messages
+
+Changed some variable names to comply with checkpatch --strict mode.
+Debug messages added.
+
+Signed-off-by: Markus Proeller <markus.proeller@pieye.org>
+---
+ drivers/media/i2c/irs1125.c | 36 ++++++++++++++++++++----------------
+ 1 file changed, 20 insertions(+), 16 deletions(-)
+
+--- a/drivers/media/i2c/irs1125.c
++++ b/drivers/media/i2c/irs1125.c
+@@ -15,6 +15,7 @@
+ #include "irs1125.h"
+ #include <linux/clk.h>
+ #include <linux/delay.h>
++#include <linux/firmware.h>
+ #include <linux/gpio/consumer.h>
+ #include <linux/i2c.h>
+ #include <linux/init.h>
+@@ -22,13 +23,13 @@
+ #include <linux/module.h>
+ #include <linux/of_graph.h>
+ #include <linux/slab.h>
++#include <linux/types.h>
+ #include <linux/videodev2.h>
+-#include <linux/firmware.h>
++#include <media/v4l2-ctrls.h>
+ #include <media/v4l2-device.h>
+ #include <media/v4l2-fwnode.h>
+ #include <media/v4l2-image-sizes.h>
+ #include <media/v4l2-mediabus.h>
+-#include <media/v4l2-ctrls.h>
+ 
+ #define CHECK_BIT(val, pos) ((val) & BIT(pos))
+ 
+@@ -38,18 +39,19 @@
+ 
+ #define IRS1125_ALTERNATE_FW "irs1125_af.bin"
+ 
+-#define IRS1125_REG_CSICFG       0xA882
+-#define IRS1125_REG_DESIGN_STEP	 0xB0AD
+-#define IRS1125_REG_EFUSEVAL2	 0xB09F
+-#define IRS1125_REG_EFUSEVAL3	 0xB0A0
+-#define IRS1125_REG_EFUSEVAL4	 0xB0A1
+-#define IRS1125_REG_DMEM_SHADOW	 0xC320
++#define IRS1125_REG_SAFE_RECONFIG	0xA850
++#define IRS1125_REG_CSICFG		0xA882
++#define IRS1125_REG_DESIGN_STEP		0xB0AD
++#define IRS1125_REG_EFUSEVAL2		0xB09F
++#define IRS1125_REG_EFUSEVAL3		0xB0A0
++#define IRS1125_REG_EFUSEVAL4		0xB0A1
++#define IRS1125_REG_DMEM_SHADOW		0xC320
+ 
+-#define IRS1125_DESIGN_STEP_EXPECTED 0x0a12
++#define IRS1125_DESIGN_STEP_EXPECTED	0x0a12
+ 
+ #define IRS1125_ROW_START_DEF		0
+ #define IRS1125_COLUMN_START_DEF	0
+-#define IRS1125_WINDOW_HEIGHT_DEF	 288
++#define IRS1125_WINDOW_HEIGHT_DEF	288
+ #define IRS1125_WINDOW_WIDTH_DEF	352
+ 
+ struct regval_list {
+@@ -87,7 +89,7 @@ static inline struct irs1125 *to_state(s
+ 	return container_of(sd, struct irs1125, sd);
+ }
+ 
+-static struct regval_list irs1125_26MHz[] = {
++static struct regval_list irs1125_26mhz[] = {
+ 	{0xB017, 0x0413},
+ 	{0xB086, 0x3535},
+ 	{0xB0AE, 0xEF02},
+@@ -153,7 +155,7 @@ static struct regval_list irs1125_26MHz[
+ 	{0xFFFF, 100}
+ };
+ 
+-static struct regval_list irs1125_seq_cfg[] = {
++static struct regval_list irs1125_seq_cfg_init[] = {
+ 	{0xC3A0, 0x823D},
+ 	{0xC3A1, 0xB13B},
+ 	{0xC3A2, 0x0313},
+@@ -243,6 +245,7 @@ static int irs1125_write(struct v4l2_sub
+ 		dev_err(&client->dev, "%s: i2c write error, reg: %x\n",
+ 			__func__, reg);
+ 
++	dev_dbg(&client->dev, "write addr 0x%04x, val 0x%04x\n", reg, val);
+ 	return ret;
+ }
+ 
+@@ -364,8 +367,8 @@ static int __sensor_init(struct v4l2_sub
+ 		cnt++;
+ 	}
+ 
+-	ret = irs1125_write_array(sd, irs1125_26MHz,
+-				  ARRAY_SIZE(irs1125_26MHz));
++	ret = irs1125_write_array(sd, irs1125_26mhz,
++				  ARRAY_SIZE(irs1125_26mhz));
+ 	if (ret < 0) {
+ 		dev_err(&client->dev, "write sensor default regs error\n");
+ 		return ret;
+@@ -415,8 +418,8 @@ static int __sensor_init(struct v4l2_sub
+ 	}
+ 	release_firmware(fw);
+ 
+-	ret = irs1125_write_array(sd, irs1125_seq_cfg,
+-				  ARRAY_SIZE(irs1125_seq_cfg));
++	ret = irs1125_write_array(sd, irs1125_seq_cfg_init,
++				  ARRAY_SIZE(irs1125_seq_cfg_init));
+ 	if (ret < 0) {
+ 		dev_err(&client->dev, "write default sequence failed\n");
+ 		return ret;
+@@ -1037,6 +1040,7 @@ static int irs1125_probe(struct i2c_clie
+ 	}
+ 
+ 	gpio_num = desc_to_gpio(sensor->reset);
++	dev_dbg(&client->dev, "reset on GPIO num %d\n", gpio_num);
+ 
+ 	mutex_init(&sensor->lock);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0243-media-irs1125-Atomic-access-to-imager-reconfiguratio.patch b/target/linux/bcm27xx/patches-6.1/950-0243-media-irs1125-Atomic-access-to-imager-reconfiguratio.patch
new file mode 100644
index 00000000000000..d1900e0c460ad8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0243-media-irs1125-Atomic-access-to-imager-reconfiguratio.patch
@@ -0,0 +1,381 @@
+From 05ced6416f6eade6b1bb5aea6dc03bb1132e482f Mon Sep 17 00:00:00 2001
+From: Markus Proeller <markus.proeller@pieye.org>
+Date: Tue, 16 Jun 2020 13:31:36 +0200
+Subject: [PATCH] media: irs1125: Atomic access to imager
+ reconfiguration
+
+Instead of changing the exposure and framerate settings for all sequences,
+they can be changed for every sequence individually now. Therefore the
+IRS1125_CID_SAFE_RECONFIG ctrl has been removed and replaced by
+IRS1125_CID_SAFE_RECONFIG_S<seq_num>_EXPO and *_FRAME ctrls.
+
+The consistency check in the sequence ctrl IRS1125_CID_SEQ_CONFIG
+is removed.
+
+Signed-off-by: Markus Proeller <markus.proeller@pieye.org>
+---
+ drivers/media/i2c/irs1125.c | 224 ++++++++++++++++++++++++------------
+ drivers/media/i2c/irs1125.h |  68 ++++++++---
+ 2 files changed, 204 insertions(+), 88 deletions(-)
+
+--- a/drivers/media/i2c/irs1125.c
++++ b/drivers/media/i2c/irs1125.c
+@@ -89,6 +89,52 @@ static inline struct irs1125 *to_state(s
+ 	return container_of(sd, struct irs1125, sd);
+ }
+ 
++static const char *expo_ctrl_names[IRS1125_NUM_SEQ_ENTRIES] = {
++	"safe reconfiguration of exposure of sequence 0",
++	"safe reconfiguration of exposure of sequence 1",
++	"safe reconfiguration of exposure of sequence 2",
++	"safe reconfiguration of exposure of sequence 3",
++	"safe reconfiguration of exposure of sequence 4",
++	"safe reconfiguration of exposure of sequence 5",
++	"safe reconfiguration of exposure of sequence 6",
++	"safe reconfiguration of exposure of sequence 7",
++	"safe reconfiguration of exposure of sequence 8",
++	"safe reconfiguration of exposure of sequence 9",
++	"safe reconfiguration of exposure of sequence 10",
++	"safe reconfiguration of exposure of sequence 11",
++	"safe reconfiguration of exposure of sequence 12",
++	"safe reconfiguration of exposure of sequence 13",
++	"safe reconfiguration of exposure of sequence 14",
++	"safe reconfiguration of exposure of sequence 15",
++	"safe reconfiguration of exposure of sequence 16",
++	"safe reconfiguration of exposure of sequence 17",
++	"safe reconfiguration of exposure of sequence 18",
++	"safe reconfiguration of exposure of sequence 19",
++};
++
++static const char *frame_ctrl_names[IRS1125_NUM_SEQ_ENTRIES] = {
++	"safe reconfiguration of framerate of sequence 0",
++	"safe reconfiguration of framerate of sequence 1",
++	"safe reconfiguration of framerate of sequence 2",
++	"safe reconfiguration of framerate of sequence 3",
++	"safe reconfiguration of framerate of sequence 4",
++	"safe reconfiguration of framerate of sequence 5",
++	"safe reconfiguration of framerate of sequence 6",
++	"safe reconfiguration of framerate of sequence 7",
++	"safe reconfiguration of framerate of sequence 8",
++	"safe reconfiguration of framerate of sequence 9",
++	"safe reconfiguration of framerate of sequence 10",
++	"safe reconfiguration of framerate of sequence 11",
++	"safe reconfiguration of framerate of sequence 12",
++	"safe reconfiguration of framerate of sequence 13",
++	"safe reconfiguration of framerate of sequence 14",
++	"safe reconfiguration of framerate of sequence 15",
++	"safe reconfiguration of framerate of sequence 16",
++	"safe reconfiguration of framerate of sequence 17",
++	"safe reconfiguration of framerate of sequence 18",
++	"safe reconfiguration of framerate of sequence 19",
++};
++
+ static struct regval_list irs1125_26mhz[] = {
+ 	{0xB017, 0x0413},
+ 	{0xB086, 0x3535},
+@@ -561,36 +607,57 @@ static int irs1125_s_ctrl(struct v4l2_ct
+ 	struct irs1125 *dev = container_of(ctrl->handler,
+ 					struct irs1125, ctrl_handler);
+ 	struct i2c_client *client = v4l2_get_subdevdata(&dev->sd);
+-	int err, i;
+ 	struct irs1125_mod_pll *mod_cur, *mod_new;
+-	struct irs1125_seq_cfg *cfg_cur, *cfg_new;
+ 	u16 addr, val;
+-
+-	err = 0;
++	int err = 0, i;
+ 
+ 	switch (ctrl->id) {
+-	case IRS1125_CID_SAFE_RECONFIG:
+-	{
+-		struct irs1125_illu *illu_cur, *illu_new;
+-
+-		illu_new = (struct irs1125_illu *)ctrl->p_new.p;
+-		illu_cur = (struct irs1125_illu *)ctrl->p_cur.p;
+-		for (i = 0; i < IRS1125_NUM_SEQ_ENTRIES; i++) {
+-			if (illu_cur[i].exposure != illu_new[i].exposure) {
+-				addr = 0xA850 + i * 2;
+-				val = illu_new[i].exposure;
+-				err = irs1125_write(&dev->sd, addr, val);
+-				if (err < 0)
+-					break;
+-			}
+-			if (illu_cur[i].framerate != illu_new[i].framerate) {
+-				addr = 0xA851 + i * 2;
+-				val = illu_new[i].framerate;
+-				err = irs1125_write(&dev->sd, addr, val);
+-				if (err < 0)
+-					break;
+-			}
+-		}
++	case IRS1125_CID_SAFE_RECONFIG_S0_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S0_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S1_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S1_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S2_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S2_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S3_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S3_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S4_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S4_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S5_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S5_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S6_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S6_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S7_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S7_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S8_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S8_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S9_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S9_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S10_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S10_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S11_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S11_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S12_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S12_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S13_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S13_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S14_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S14_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S15_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S15_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S16_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S16_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S17_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S17_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S18_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S18_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S19_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S19_FRAME: {
++		unsigned int offset = ctrl->id -
++			IRS1125_CID_SAFE_RECONFIG_S0_EXPO;
++
++		err = irs1125_write(&dev->sd,
++				    IRS1125_REG_SAFE_RECONFIG + offset,
++				    ctrl->val);
+ 		break;
+ 	}
+ 	case IRS1125_CID_MOD_PLL:
+@@ -655,40 +722,40 @@ static int irs1125_s_ctrl(struct v4l2_ct
+ 			}
+ 		}
+ 		break;
+-	case IRS1125_CID_SEQ_CONFIG:
++	case IRS1125_CID_SEQ_CONFIG: {
++		struct irs1125_seq_cfg *cfg_new;
++
+ 		cfg_new = (struct irs1125_seq_cfg *)ctrl->p_new.p;
+-		cfg_cur = (struct irs1125_seq_cfg *)ctrl->p_cur.p;
+ 		for (i = 0; i < IRS1125_NUM_SEQ_ENTRIES; i++) {
+-			if (cfg_cur[i].exposure != cfg_new[i].exposure)	{
+-				addr = IRS1125_REG_DMEM_SHADOW + i * 4;
+-				val = cfg_new[i].exposure;
+-				err = irs1125_write(&dev->sd, addr, val);
+-				if (err < 0)
+-					break;
+-			}
+-			if (cfg_cur[i].framerate != cfg_new[i].framerate) {
+-				addr = IRS1125_REG_DMEM_SHADOW + 1 + i * 4;
+-				val = cfg_new[i].framerate;
+-				err = irs1125_write(&dev->sd, addr, val);
+-				if (err < 0)
+-					break;
+-			}
+-			if (cfg_cur[i].ps != cfg_new[i].ps) {
+-				addr = IRS1125_REG_DMEM_SHADOW + 2 + i * 4;
+-				val = cfg_new[i].ps;
+-				err = irs1125_write(&dev->sd, addr, val);
+-				if (err < 0)
+-					break;
+-			}
+-			if (cfg_cur[i].pll != cfg_new[i].pll) {
+-				addr = IRS1125_REG_DMEM_SHADOW + 3 + i * 4;
+-				val = cfg_new[i].pll;
+-				err = irs1125_write(&dev->sd, addr, val);
+-				if (err < 0)
+-					break;
+-			}
++			unsigned int seq_offset = i * 4;
++			u16 addr, val;
++
++			addr = IRS1125_REG_DMEM_SHADOW + seq_offset;
++			val = cfg_new[i].exposure;
++			err = irs1125_write(&dev->sd, addr, val);
++			if (err < 0)
++				break;
++
++			addr = IRS1125_REG_DMEM_SHADOW + 1 + seq_offset;
++			val = cfg_new[i].framerate;
++			err = irs1125_write(&dev->sd, addr, val);
++			if (err < 0)
++				break;
++
++			addr = IRS1125_REG_DMEM_SHADOW + 2 + seq_offset;
++			val = cfg_new[i].ps;
++			err = irs1125_write(&dev->sd, addr, val);
++			if (err < 0)
++				break;
++
++			addr = IRS1125_REG_DMEM_SHADOW + 3 + seq_offset;
++			val = cfg_new[i].pll;
++			err = irs1125_write(&dev->sd, addr, val);
++			if (err < 0)
++				break;
+ 		}
+ 		break;
++	}
+ 	case IRS1125_CID_NUM_SEQS:
+ 		err = irs1125_write(&dev->sd, 0xA88D, ctrl->val - 1);
+ 		if (err >= 0)
+@@ -760,19 +827,6 @@ static const struct v4l2_ctrl_config irs
+ 			IRS1125_NUM_MOD_PLLS}
+ 	}, {
+ 		.ops = &irs1125_ctrl_ops,
+-		.id = IRS1125_CID_SAFE_RECONFIG,
+-		.name = "Change exposure and pause of single seq",
+-		.type = V4L2_CTRL_TYPE_U16,
+-		.flags = V4L2_CTRL_FLAG_HAS_PAYLOAD,
+-		.min = 0,
+-		.max = U16_MAX,
+-		.step = 1,
+-		.def = 0,
+-		.elem_size = sizeof(u16),
+-		.dims = {sizeof(struct irs1125_illu) / sizeof(u16),
+-			IRS1125_NUM_SEQ_ENTRIES}
+-	}, {
+-		.ops = &irs1125_ctrl_ops,
+ 		.id = IRS1125_CID_SEQ_CONFIG,
+ 		.name = "Change sequence settings",
+ 		.type = V4L2_CTRL_TYPE_U16,
+@@ -900,9 +954,16 @@ static int irs1125_ctrls_init(struct irs
+ {
+ 	struct v4l2_ctrl *ctrl;
+ 	int err, i;
+-	struct v4l2_ctrl_handler *hdl;
++	struct v4l2_ctrl_handler *hdl = &sensor->ctrl_handler;
++	struct v4l2_ctrl_config ctrl_cfg = {
++		.ops = &irs1125_ctrl_ops,
++		.type = V4L2_CTRL_TYPE_INTEGER,
++		.min = 0,
++		.max = U16_MAX,
++		.step = 1,
++		.def = 0x1000
++	};
+ 
+-	hdl = &sensor->ctrl_handler;
+ 	v4l2_ctrl_handler_init(hdl, ARRAY_SIZE(irs1125_custom_ctrls));
+ 
+ 	for (i = 0; i < ARRAY_SIZE(irs1125_custom_ctrls); i++)	{
+@@ -923,6 +984,27 @@ static int irs1125_ctrls_init(struct irs
+ 		goto error_ctrls;
+ 	}
+ 
++	for (i = 0; i < IRS1125_NUM_SEQ_ENTRIES; i++) {
++		ctrl_cfg.name = expo_ctrl_names[i];
++		ctrl_cfg.id = IRS1125_CID_SAFE_RECONFIG_S0_EXPO + i * 2;
++		ctrl = v4l2_ctrl_new_custom(hdl, &ctrl_cfg,
++					    NULL);
++		if (!ctrl)
++			dev_err(dev, "Failed to init exposure control %s\n",
++				ctrl_cfg.name);
++	}
++
++	ctrl_cfg.def = 0;
++	for (i = 0; i < IRS1125_NUM_SEQ_ENTRIES; i++) {
++		ctrl_cfg.name = frame_ctrl_names[i];
++		ctrl_cfg.id = IRS1125_CID_SAFE_RECONFIG_S0_FRAME + i * 2;
++		ctrl = v4l2_ctrl_new_custom(hdl, &ctrl_cfg,
++					    NULL);
++		if (!ctrl)
++			dev_err(dev, "Failed to init framerate control %s\n",
++				ctrl_cfg.name);
++	}
++
+ 	sensor->sd.ctrl_handler = hdl;
+ 	return 0;
+ 
+--- a/drivers/media/i2c/irs1125.h
++++ b/drivers/media/i2c/irs1125.h
+@@ -21,18 +21,57 @@
+ #define IRS1125_NUM_SEQ_ENTRIES 20
+ #define IRS1125_NUM_MOD_PLLS 4
+ 
+-#define IRS1125_CID_CUSTOM_BASE        (V4L2_CID_USER_BASE | 0xf000)
+-#define IRS1125_CID_SAFE_RECONFIG      (IRS1125_CID_CUSTOM_BASE + 0)
+-#define IRS1125_CID_CONTINUOUS_TRIG    (IRS1125_CID_CUSTOM_BASE + 1)
+-#define IRS1125_CID_TRIGGER            (IRS1125_CID_CUSTOM_BASE + 2)
+-#define IRS1125_CID_RECONFIG           (IRS1125_CID_CUSTOM_BASE + 3)
+-#define IRS1125_CID_ILLU_ON            (IRS1125_CID_CUSTOM_BASE + 4)
+-#define IRS1125_CID_NUM_SEQS           (IRS1125_CID_CUSTOM_BASE + 5)
+-#define IRS1125_CID_MOD_PLL            (IRS1125_CID_CUSTOM_BASE + 6)
+-#define IRS1125_CID_SEQ_CONFIG         (IRS1125_CID_CUSTOM_BASE + 7)
+-#define IRS1125_CID_IDENT0             (IRS1125_CID_CUSTOM_BASE + 8)
+-#define IRS1125_CID_IDENT1             (IRS1125_CID_CUSTOM_BASE + 9)
+-#define IRS1125_CID_IDENT2             (IRS1125_CID_CUSTOM_BASE + 10)
++#define IRS1125_CID_CUSTOM_BASE			(V4L2_CID_USER_BASE | 0xf000)
++#define IRS1125_CID_CONTINUOUS_TRIG		(IRS1125_CID_CUSTOM_BASE + 1)
++#define IRS1125_CID_TRIGGER			(IRS1125_CID_CUSTOM_BASE + 2)
++#define IRS1125_CID_RECONFIG			(IRS1125_CID_CUSTOM_BASE + 3)
++#define IRS1125_CID_ILLU_ON			(IRS1125_CID_CUSTOM_BASE + 4)
++#define IRS1125_CID_NUM_SEQS			(IRS1125_CID_CUSTOM_BASE + 5)
++#define IRS1125_CID_MOD_PLL			(IRS1125_CID_CUSTOM_BASE + 6)
++#define IRS1125_CID_SEQ_CONFIG			(IRS1125_CID_CUSTOM_BASE + 7)
++#define IRS1125_CID_IDENT0			(IRS1125_CID_CUSTOM_BASE + 8)
++#define IRS1125_CID_IDENT1			(IRS1125_CID_CUSTOM_BASE + 9)
++#define IRS1125_CID_IDENT2			(IRS1125_CID_CUSTOM_BASE + 10)
++#define IRS1125_CID_SAFE_RECONFIG_S0_EXPO	(IRS1125_CID_CUSTOM_BASE + 11)
++#define IRS1125_CID_SAFE_RECONFIG_S0_FRAME	(IRS1125_CID_CUSTOM_BASE + 12)
++#define IRS1125_CID_SAFE_RECONFIG_S1_EXPO	(IRS1125_CID_CUSTOM_BASE + 13)
++#define IRS1125_CID_SAFE_RECONFIG_S1_FRAME	(IRS1125_CID_CUSTOM_BASE + 14)
++#define IRS1125_CID_SAFE_RECONFIG_S2_EXPO	(IRS1125_CID_CUSTOM_BASE + 15)
++#define IRS1125_CID_SAFE_RECONFIG_S2_FRAME	(IRS1125_CID_CUSTOM_BASE + 16)
++#define IRS1125_CID_SAFE_RECONFIG_S3_EXPO	(IRS1125_CID_CUSTOM_BASE + 17)
++#define IRS1125_CID_SAFE_RECONFIG_S3_FRAME	(IRS1125_CID_CUSTOM_BASE + 18)
++#define IRS1125_CID_SAFE_RECONFIG_S4_EXPO	(IRS1125_CID_CUSTOM_BASE + 19)
++#define IRS1125_CID_SAFE_RECONFIG_S4_FRAME	(IRS1125_CID_CUSTOM_BASE + 20)
++#define IRS1125_CID_SAFE_RECONFIG_S5_EXPO	(IRS1125_CID_CUSTOM_BASE + 21)
++#define IRS1125_CID_SAFE_RECONFIG_S5_FRAME	(IRS1125_CID_CUSTOM_BASE + 22)
++#define IRS1125_CID_SAFE_RECONFIG_S6_EXPO	(IRS1125_CID_CUSTOM_BASE + 23)
++#define IRS1125_CID_SAFE_RECONFIG_S6_FRAME	(IRS1125_CID_CUSTOM_BASE + 24)
++#define IRS1125_CID_SAFE_RECONFIG_S7_EXPO	(IRS1125_CID_CUSTOM_BASE + 25)
++#define IRS1125_CID_SAFE_RECONFIG_S7_FRAME	(IRS1125_CID_CUSTOM_BASE + 26)
++#define IRS1125_CID_SAFE_RECONFIG_S8_EXPO	(IRS1125_CID_CUSTOM_BASE + 27)
++#define IRS1125_CID_SAFE_RECONFIG_S8_FRAME	(IRS1125_CID_CUSTOM_BASE + 28)
++#define IRS1125_CID_SAFE_RECONFIG_S9_EXPO	(IRS1125_CID_CUSTOM_BASE + 29)
++#define IRS1125_CID_SAFE_RECONFIG_S9_FRAME	(IRS1125_CID_CUSTOM_BASE + 30)
++#define IRS1125_CID_SAFE_RECONFIG_S10_EXPO	(IRS1125_CID_CUSTOM_BASE + 31)
++#define IRS1125_CID_SAFE_RECONFIG_S10_FRAME	(IRS1125_CID_CUSTOM_BASE + 32)
++#define IRS1125_CID_SAFE_RECONFIG_S11_EXPO	(IRS1125_CID_CUSTOM_BASE + 33)
++#define IRS1125_CID_SAFE_RECONFIG_S11_FRAME	(IRS1125_CID_CUSTOM_BASE + 34)
++#define IRS1125_CID_SAFE_RECONFIG_S12_EXPO	(IRS1125_CID_CUSTOM_BASE + 35)
++#define IRS1125_CID_SAFE_RECONFIG_S12_FRAME	(IRS1125_CID_CUSTOM_BASE + 36)
++#define IRS1125_CID_SAFE_RECONFIG_S13_EXPO	(IRS1125_CID_CUSTOM_BASE + 37)
++#define IRS1125_CID_SAFE_RECONFIG_S13_FRAME	(IRS1125_CID_CUSTOM_BASE + 38)
++#define IRS1125_CID_SAFE_RECONFIG_S14_EXPO	(IRS1125_CID_CUSTOM_BASE + 39)
++#define IRS1125_CID_SAFE_RECONFIG_S14_FRAME	(IRS1125_CID_CUSTOM_BASE + 40)
++#define IRS1125_CID_SAFE_RECONFIG_S15_EXPO	(IRS1125_CID_CUSTOM_BASE + 41)
++#define IRS1125_CID_SAFE_RECONFIG_S15_FRAME	(IRS1125_CID_CUSTOM_BASE + 42)
++#define IRS1125_CID_SAFE_RECONFIG_S16_EXPO	(IRS1125_CID_CUSTOM_BASE + 43)
++#define IRS1125_CID_SAFE_RECONFIG_S16_FRAME	(IRS1125_CID_CUSTOM_BASE + 44)
++#define IRS1125_CID_SAFE_RECONFIG_S17_EXPO	(IRS1125_CID_CUSTOM_BASE + 45)
++#define IRS1125_CID_SAFE_RECONFIG_S17_FRAME	(IRS1125_CID_CUSTOM_BASE + 46)
++#define IRS1125_CID_SAFE_RECONFIG_S18_EXPO	(IRS1125_CID_CUSTOM_BASE + 47)
++#define IRS1125_CID_SAFE_RECONFIG_S18_FRAME	(IRS1125_CID_CUSTOM_BASE + 48)
++#define IRS1125_CID_SAFE_RECONFIG_S19_EXPO	(IRS1125_CID_CUSTOM_BASE + 49)
++#define IRS1125_CID_SAFE_RECONFIG_S19_FRAME	(IRS1125_CID_CUSTOM_BASE + 50)
+ 
+ struct irs1125_seq_cfg {
+ 	__u16 exposure;
+@@ -41,11 +80,6 @@ struct irs1125_seq_cfg {
+ 	__u16 pll;
+ };
+ 
+-struct irs1125_illu {
+-	__u16 exposure;
+-	__u16 framerate;
+-};
+-
+ struct irs1125_mod_pll {
+ 	__u16 pllcfg1;
+ 	__u16 pllcfg2;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0244-media-irs1125-Keep-HW-in-sync-after-imager-reset.patch b/target/linux/bcm27xx/patches-6.1/950-0244-media-irs1125-Keep-HW-in-sync-after-imager-reset.patch
new file mode 100644
index 00000000000000..6975ff5b19226c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0244-media-irs1125-Keep-HW-in-sync-after-imager-reset.patch
@@ -0,0 +1,181 @@
+From 4ae4ea08f58f394a82b99417230ce63ce53e68e3 Mon Sep 17 00:00:00 2001
+From: Markus Proeller <markus.proeller@pieye.org>
+Date: Tue, 16 Jun 2020 13:33:56 +0200
+Subject: [PATCH] media: irs1125: Keep HW in sync after imager reset
+
+When closing the video device, the irs1125 is put in power down state.
+To keep V4L2 ctrls and the HW in sync, v4l2_ctrl_handler_setup is
+called after power up.
+
+The compound ctrl IRS1125_CID_MOD_PLL however has a default value
+of all zeros, which puts the imager into a non responding state.
+Thus, this ctrl is not written by the driver into HW after power up.
+The userspace has to take care to write senseful data.
+
+Signed-off-by: Markus Proeller <markus.proeller@pieye.org>
+---
+ drivers/media/i2c/irs1125.c | 121 +++++++++++++++++-------------------
+ 1 file changed, 58 insertions(+), 63 deletions(-)
+
+--- a/drivers/media/i2c/irs1125.c
++++ b/drivers/media/i2c/irs1125.c
+@@ -82,6 +82,7 @@ struct irs1125 {
+ 	struct v4l2_ctrl *ctrl_numseq;
+ 
+ 	int power_count;
++	bool mod_pll_init;
+ };
+ 
+ static inline struct irs1125 *to_state(struct v4l2_subdev *sd)
+@@ -276,8 +277,7 @@ static struct regval_list irs1125_seq_cf
+ 	{0xC039, 0x0000},
+ 	{0xC401, 0x0002},
+ 
+-	{0xFFFF, 1},
+-	{0xA87C, 0x0001}
++	{0xFFFF, 1}
+ };
+ 
+ static int irs1125_write(struct v4l2_subdev *sd, u16 reg, u16 val)
+@@ -471,7 +471,11 @@ static int __sensor_init(struct v4l2_sub
+ 		return ret;
+ 	}
+ 
+-	return 0;
++	irs1125->mod_pll_init = true;
++	v4l2_ctrl_handler_setup(&irs1125->ctrl_handler);
++	irs1125->mod_pll_init = false;
++
++	return irs1125_write(sd, 0xA87C, 0x0001);
+ }
+ 
+ static int irs1125_sensor_power(struct v4l2_subdev *sd, int on)
+@@ -607,8 +611,6 @@ static int irs1125_s_ctrl(struct v4l2_ct
+ 	struct irs1125 *dev = container_of(ctrl->handler,
+ 					struct irs1125, ctrl_handler);
+ 	struct i2c_client *client = v4l2_get_subdevdata(&dev->sd);
+-	struct irs1125_mod_pll *mod_cur, *mod_new;
+-	u16 addr, val;
+ 	int err = 0, i;
+ 
+ 	switch (ctrl->id) {
+@@ -660,68 +662,61 @@ static int irs1125_s_ctrl(struct v4l2_ct
+ 				    ctrl->val);
+ 		break;
+ 	}
+-	case IRS1125_CID_MOD_PLL:
++	case IRS1125_CID_MOD_PLL: {
++		struct irs1125_mod_pll *mod_new;
++
++		if (dev->mod_pll_init)
++			break;
++
+ 		mod_new = (struct irs1125_mod_pll *)ctrl->p_new.p;
+-		mod_cur = (struct irs1125_mod_pll *)ctrl->p_cur.p;
+ 		for (i = 0; i < IRS1125_NUM_MOD_PLLS; i++) {
+-			if (mod_cur[i].pllcfg1 != mod_new[i].pllcfg1) {
+-				addr = 0xC3A0 + i * 3;
+-				val = mod_new[i].pllcfg1;
+-				err = irs1125_write(&dev->sd, addr, val);
+-				if (err < 0)
+-					break;
+-			}
+-			if (mod_cur[i].pllcfg2 != mod_new[i].pllcfg2) {
+-				addr = 0xC3A1 + i * 3;
+-				val = mod_new[i].pllcfg2;
+-				err = irs1125_write(&dev->sd, addr, val);
+-				if (err < 0)
+-					break;
+-			}
+-			if (mod_cur[i].pllcfg3 != mod_new[i].pllcfg3) {
+-				addr = 0xC3A2 + i * 3;
+-				val = mod_new[i].pllcfg3;
+-				err = irs1125_write(&dev->sd, addr, val);
+-				if (err < 0)
+-					break;
+-			}
+-			if (mod_cur[i].pllcfg4 != mod_new[i].pllcfg4) {
+-				addr = 0xC24C + i * 5;
+-				val = mod_new[i].pllcfg4;
+-				err = irs1125_write(&dev->sd, addr, val);
+-				if (err < 0)
+-					break;
+-			}
+-			if (mod_cur[i].pllcfg5 != mod_new[i].pllcfg5) {
+-				addr = 0xC24D + i * 5;
+-				val = mod_new[i].pllcfg5;
+-				err = irs1125_write(&dev->sd, addr, val);
+-				if (err < 0)
+-					break;
+-			}
+-			if (mod_cur[i].pllcfg6 != mod_new[i].pllcfg6) {
+-				addr = 0xC24E + i * 5;
+-				val = mod_new[i].pllcfg6;
+-				err = irs1125_write(&dev->sd, addr, val);
+-				if (err < 0)
+-					break;
+-			}
+-			if (mod_cur[i].pllcfg7 != mod_new[i].pllcfg7) {
+-				addr = 0xC24F + i * 5;
+-				val = mod_new[i].pllcfg7;
+-				err = irs1125_write(&dev->sd, addr, val);
+-				if (err < 0)
+-					break;
+-			}
+-			if (mod_cur[i].pllcfg8 != mod_new[i].pllcfg8) {
+-				addr = 0xC250 + i * 5;
+-				val = mod_new[i].pllcfg8;
+-				err = irs1125_write(&dev->sd, addr, val);
+-				if (err < 0)
+-					break;
+-			}
++			unsigned int pll_offset, ssc_offset;
++
++			pll_offset = i * 3;
++			ssc_offset = i * 5;
++
++			err = irs1125_write(&dev->sd, 0xC3A0 + pll_offset,
++					    mod_new[i].pllcfg1);
++			if (err < 0)
++				break;
++
++			err = irs1125_write(&dev->sd, 0xC3A1 + pll_offset,
++					    mod_new[i].pllcfg2);
++			if (err < 0)
++				break;
++
++			err = irs1125_write(&dev->sd, 0xC3A2 + pll_offset,
++					    mod_new[i].pllcfg3);
++			if (err < 0)
++				break;
++
++			err = irs1125_write(&dev->sd, 0xC24C + ssc_offset,
++					    mod_new[i].pllcfg4);
++			if (err < 0)
++				break;
++
++			err = irs1125_write(&dev->sd, 0xC24D + ssc_offset,
++					    mod_new[i].pllcfg5);
++			if (err < 0)
++				break;
++
++			err = irs1125_write(&dev->sd, 0xC24E + ssc_offset,
++					    mod_new[i].pllcfg6);
++			if (err < 0)
++				break;
++
++			err = irs1125_write(&dev->sd, 0xC24F + ssc_offset,
++					    mod_new[i].pllcfg7);
++			if (err < 0)
++				break;
++
++			err = irs1125_write(&dev->sd, 0xC250 + ssc_offset,
++					    mod_new[i].pllcfg8);
++			if (err < 0)
++				break;
+ 		}
+ 		break;
++	}
+ 	case IRS1125_CID_SEQ_CONFIG: {
+ 		struct irs1125_seq_cfg *cfg_new;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0245-media-bcm2835-unicam-Driver-for-CCP2-CSI2-camera-int.patch b/target/linux/bcm27xx/patches-6.1/950-0245-media-bcm2835-unicam-Driver-for-CCP2-CSI2-camera-int.patch
new file mode 100644
index 00000000000000..8f383ece2b516d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0245-media-bcm2835-unicam-Driver-for-CCP2-CSI2-camera-int.patch
@@ -0,0 +1,3158 @@
+From 5f6585179d2779f98e83d1cedf780b51aef1e924 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Mon, 4 May 2020 12:25:41 +0300
+Subject: [PATCH] media: bcm2835-unicam: Driver for CCP2/CSI2 camera
+ interface
+
+Add a driver for the Unicam camera receiver block on BCM283x processors.
+Compared to the bcm2835-camera driver present in staging, this driver
+handles the Unicam block only (CSI-2 receiver), and doesn't depend on
+the VC4 firmware running on the VPU.
+
+The commit is made up of a series of changes cherry-picked from the
+rpi-5.4.y branch of https://github.com/raspberrypi/linux/ with
+additional enhancements, forward-ported to the mainline kernel.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reported-by: kbuild test robot <lkp@intel.com>
+---
+ MAINTAINERS                                   |    2 +-
+ drivers/media/platform/bcm2835/Kconfig        |   21 +
+ drivers/media/platform/bcm2835/Makefile       |    3 +
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 2827 +++++++++++++++++
+ .../media/platform/bcm2835/vc4-regs-unicam.h  |  253 ++
+ 5 files changed, 3105 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/media/platform/bcm2835/Kconfig
+ create mode 100644 drivers/media/platform/bcm2835/Makefile
+ create mode 100644 drivers/media/platform/bcm2835/bcm2835-unicam.c
+ create mode 100644 drivers/media/platform/bcm2835/vc4-regs-unicam.h
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -4042,7 +4042,7 @@ M:	Dave Stevenson <dave.stevenson@raspbe
+ L:	linux-media@vger.kernel.org
+ S:	Maintained
+ F:	drivers/media/platform/bcm2835/
+-F:	Documentation/devicetree/bindings/media/bcm2835-unicam.txt
++F:	Documentation/devicetree/bindings/media/brcm,bcm2835-unicam.yaml
+ 
+ BROADCOM BCM47XX MIPS ARCHITECTURE
+ M:	Hauke Mehrtens <hauke@hauke-m.de>
+--- /dev/null
++++ b/drivers/media/platform/bcm2835/Kconfig
+@@ -0,0 +1,21 @@
++# Broadcom VideoCore4 V4L2 camera support
++
++config VIDEO_BCM2835_UNICAM
++	tristate "Broadcom BCM283x/BCM271x Unicam video capture driver"
++	depends on VIDEO_DEV
++	depends on ARCH_BCM2835 || COMPILE_TEST
++	select VIDEO_V4L2_SUBDEV_API
++	select MEDIA_CONTROLLER
++	select VIDEOBUF2_DMA_CONTIG
++	select V4L2_FWNODE
++	help
++	  Say Y here to enable support for the BCM283x/BCM271x CSI-2 receiver.
++	  This is a V4L2 driver that controls the CSI-2 receiver directly,
++	  independently from the VC4 firmware.
++	  This driver is mutually exclusive with the use of bcm2835-camera. The
++	  firmware will disable all access to the peripheral from within the
++	  firmware if it finds a DT node using it, and bcm2835-camera will
++	  therefore fail to probe.
++
++	  To compile this driver as a module, choose M here. The module will be
++	  called bcm2835-unicam.
+--- /dev/null
++++ b/drivers/media/platform/bcm2835/Makefile
+@@ -0,0 +1,3 @@
++# Makefile for BCM2835 Unicam driver
++
++obj-$(CONFIG_VIDEO_BCM2835_UNICAM) += bcm2835-unicam.o
+--- /dev/null
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -0,0 +1,2827 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * BCM2835 Unicam Capture Driver
++ *
++ * Copyright (C) 2017-2020 - Raspberry Pi (Trading) Ltd.
++ *
++ * Dave Stevenson <dave.stevenson@raspberrypi.com>
++ *
++ * Based on TI am437x driver by
++ *   Benoit Parrot <bparrot@ti.com>
++ *   Lad, Prabhakar <prabhakar.csengg@gmail.com>
++ *
++ * and TI CAL camera interface driver by
++ *    Benoit Parrot <bparrot@ti.com>
++ *
++ *
++ * There are two camera drivers in the kernel for BCM283x - this one
++ * and bcm2835-camera (currently in staging).
++ *
++ * This driver directly controls the Unicam peripheral - there is no
++ * involvement with the VideoCore firmware. Unicam receives CSI-2 or
++ * CCP2 data and writes it into SDRAM.
++ * The only potential processing options are to repack Bayer data into an
++ * alternate format, and applying windowing.
++ * The repacking does not shift the data, so can repack V4L2_PIX_FMT_Sxxxx10P
++ * to V4L2_PIX_FMT_Sxxxx10, or V4L2_PIX_FMT_Sxxxx12P to V4L2_PIX_FMT_Sxxxx12,
++ * but not generically up to V4L2_PIX_FMT_Sxxxx16. The driver will add both
++ * formats where the relevant formats are defined, and will automatically
++ * configure the repacking as required.
++ * Support for windowing may be added later.
++ *
++ * It should be possible to connect this driver to any sensor with a
++ * suitable output interface and V4L2 subdevice driver.
++ *
++ * bcm2835-camera uses the VideoCore firmware to control the sensor,
++ * Unicam, ISP, and all tuner control loops. Fully processed frames are
++ * delivered to the driver by the firmware. It only has sensor drivers
++ * for Omnivision OV5647, and Sony IMX219 sensors.
++ *
++ * The two drivers are mutually exclusive for the same Unicam instance.
++ * The VideoCore firmware checks the device tree configuration during boot.
++ * If it finds device tree nodes called csi0 or csi1 it will block the
++ * firmware from accessing the peripheral, and bcm2835-camera will
++ * not be able to stream data.
++ */
++
++#include <linux/clk.h>
++#include <linux/delay.h>
++#include <linux/device.h>
++#include <linux/dma-mapping.h>
++#include <linux/err.h>
++#include <linux/init.h>
++#include <linux/interrupt.h>
++#include <linux/io.h>
++#include <linux/module.h>
++#include <linux/of_device.h>
++#include <linux/of_graph.h>
++#include <linux/pinctrl/consumer.h>
++#include <linux/platform_device.h>
++#include <linux/pm_runtime.h>
++#include <linux/slab.h>
++#include <linux/uaccess.h>
++#include <linux/videodev2.h>
++
++#include <media/v4l2-common.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-dev.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-dv-timings.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-ioctl.h>
++#include <media/v4l2-fwnode.h>
++#include <media/videobuf2-dma-contig.h>
++
++#include <media/v4l2-async.h>
++
++#include "vc4-regs-unicam.h"
++
++#define UNICAM_MODULE_NAME	"unicam"
++#define UNICAM_VERSION		"0.1.0"
++
++static int debug;
++module_param(debug, int, 0644);
++MODULE_PARM_DESC(debug, "Debug level 0-3");
++
++#define unicam_dbg(level, dev, fmt, arg...)	\
++		v4l2_dbg(level, debug, &(dev)->v4l2_dev, fmt, ##arg)
++#define unicam_info(dev, fmt, arg...)	\
++		v4l2_info(&(dev)->v4l2_dev, fmt, ##arg)
++#define unicam_err(dev, fmt, arg...)	\
++		v4l2_err(&(dev)->v4l2_dev, fmt, ##arg)
++
++/*
++ * To protect against a dodgy sensor driver never returning an error from
++ * enum_mbus_code, set a maximum index value to be used.
++ */
++#define MAX_ENUM_MBUS_CODE	128
++
++/*
++ * Stride is a 16 bit register, but also has to be a multiple of 32.
++ */
++#define BPL_ALIGNMENT		32
++#define MAX_BYTESPERLINE	((1 << 16) - BPL_ALIGNMENT)
++/*
++ * Max width is therefore determined by the max stride divided by
++ * the number of bits per pixel. Take 32bpp as a
++ * worst case.
++ * No imposed limit on the height, so adopt a square image for want
++ * of anything better.
++ */
++#define MAX_WIDTH		(MAX_BYTESPERLINE / 4)
++#define MAX_HEIGHT		MAX_WIDTH
++/* Define a nominal minimum image size */
++#define MIN_WIDTH		16
++#define MIN_HEIGHT		16
++/* Default size of the embedded buffer */
++#define UNICAM_EMBEDDED_SIZE	8192
++
++/*
++ * Size of the dummy buffer. Can be any size really, but the DMA
++ * allocation works in units of page sizes.
++ */
++#define DUMMY_BUF_SIZE		(PAGE_SIZE)
++
++enum pad_types {
++	IMAGE_PAD,
++	METADATA_PAD,
++	MAX_NODES
++};
++
++/*
++ * struct unicam_fmt - Unicam media bus format information
++ * @pixelformat: V4L2 pixel format FCC identifier. 0 if n/a.
++ * @repacked_fourcc: V4L2 pixel format FCC identifier if the data is expanded
++ * out to 16bpp. 0 if n/a.
++ * @code: V4L2 media bus format code.
++ * @depth: Bits per pixel as delivered from the source.
++ * @csi_dt: CSI data type.
++ * @check_variants: Flag to denote that there are multiple mediabus formats
++ *		still in the list that could match this V4L2 format.
++ */
++struct unicam_fmt {
++	u32	fourcc;
++	u32	repacked_fourcc;
++	u32	code;
++	u8	depth;
++	u8	csi_dt;
++	u8	check_variants;
++};
++
++static const struct unicam_fmt formats[] = {
++	/* YUV Formats */
++	{
++		.fourcc		= V4L2_PIX_FMT_YUYV,
++		.code		= MEDIA_BUS_FMT_YUYV8_2X8,
++		.depth		= 16,
++		.csi_dt		= 0x1e,
++		.check_variants = 1,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_UYVY,
++		.code		= MEDIA_BUS_FMT_UYVY8_2X8,
++		.depth		= 16,
++		.csi_dt		= 0x1e,
++		.check_variants = 1,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_YVYU,
++		.code		= MEDIA_BUS_FMT_YVYU8_2X8,
++		.depth		= 16,
++		.csi_dt		= 0x1e,
++		.check_variants = 1,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_VYUY,
++		.code		= MEDIA_BUS_FMT_VYUY8_2X8,
++		.depth		= 16,
++		.csi_dt		= 0x1e,
++		.check_variants = 1,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_YUYV,
++		.code		= MEDIA_BUS_FMT_YUYV8_1X16,
++		.depth		= 16,
++		.csi_dt		= 0x1e,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_UYVY,
++		.code		= MEDIA_BUS_FMT_UYVY8_1X16,
++		.depth		= 16,
++		.csi_dt		= 0x1e,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_YVYU,
++		.code		= MEDIA_BUS_FMT_YVYU8_1X16,
++		.depth		= 16,
++		.csi_dt		= 0x1e,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_VYUY,
++		.code		= MEDIA_BUS_FMT_VYUY8_1X16,
++		.depth		= 16,
++		.csi_dt		= 0x1e,
++	}, {
++	/* RGB Formats */
++		.fourcc		= V4L2_PIX_FMT_RGB565, /* gggbbbbb rrrrrggg */
++		.code		= MEDIA_BUS_FMT_RGB565_2X8_LE,
++		.depth		= 16,
++		.csi_dt		= 0x22,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_RGB565X, /* rrrrrggg gggbbbbb */
++		.code		= MEDIA_BUS_FMT_RGB565_2X8_BE,
++		.depth		= 16,
++		.csi_dt		= 0x22
++	}, {
++		.fourcc		= V4L2_PIX_FMT_RGB555, /* gggbbbbb arrrrrgg */
++		.code		= MEDIA_BUS_FMT_RGB555_2X8_PADHI_LE,
++		.depth		= 16,
++		.csi_dt		= 0x21,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_RGB555X, /* arrrrrgg gggbbbbb */
++		.code		= MEDIA_BUS_FMT_RGB555_2X8_PADHI_BE,
++		.depth		= 16,
++		.csi_dt		= 0x21,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_RGB24, /* rgb */
++		.code		= MEDIA_BUS_FMT_RGB888_1X24,
++		.depth		= 24,
++		.csi_dt		= 0x24,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_BGR24, /* bgr */
++		.code		= MEDIA_BUS_FMT_BGR888_1X24,
++		.depth		= 24,
++		.csi_dt		= 0x24,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_RGB32, /* argb */
++		.code		= MEDIA_BUS_FMT_ARGB8888_1X32,
++		.depth		= 32,
++		.csi_dt		= 0x0,
++	}, {
++	/* Bayer Formats */
++		.fourcc		= V4L2_PIX_FMT_SBGGR8,
++		.code		= MEDIA_BUS_FMT_SBGGR8_1X8,
++		.depth		= 8,
++		.csi_dt		= 0x2a,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SGBRG8,
++		.code		= MEDIA_BUS_FMT_SGBRG8_1X8,
++		.depth		= 8,
++		.csi_dt		= 0x2a,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SGRBG8,
++		.code		= MEDIA_BUS_FMT_SGRBG8_1X8,
++		.depth		= 8,
++		.csi_dt		= 0x2a,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SRGGB8,
++		.code		= MEDIA_BUS_FMT_SRGGB8_1X8,
++		.depth		= 8,
++		.csi_dt		= 0x2a,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SBGGR10P,
++		.repacked_fourcc = V4L2_PIX_FMT_SBGGR10,
++		.code		= MEDIA_BUS_FMT_SBGGR10_1X10,
++		.depth		= 10,
++		.csi_dt		= 0x2b,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SGBRG10P,
++		.repacked_fourcc = V4L2_PIX_FMT_SGBRG10,
++		.code		= MEDIA_BUS_FMT_SGBRG10_1X10,
++		.depth		= 10,
++		.csi_dt		= 0x2b,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SGRBG10P,
++		.repacked_fourcc = V4L2_PIX_FMT_SGRBG10,
++		.code		= MEDIA_BUS_FMT_SGRBG10_1X10,
++		.depth		= 10,
++		.csi_dt		= 0x2b,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SRGGB10P,
++		.repacked_fourcc = V4L2_PIX_FMT_SRGGB10,
++		.code		= MEDIA_BUS_FMT_SRGGB10_1X10,
++		.depth		= 10,
++		.csi_dt		= 0x2b,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SBGGR12P,
++		.repacked_fourcc = V4L2_PIX_FMT_SBGGR12,
++		.code		= MEDIA_BUS_FMT_SBGGR12_1X12,
++		.depth		= 12,
++		.csi_dt		= 0x2c,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SGBRG12P,
++		.repacked_fourcc = V4L2_PIX_FMT_SGBRG12,
++		.code		= MEDIA_BUS_FMT_SGBRG12_1X12,
++		.depth		= 12,
++		.csi_dt		= 0x2c,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SGRBG12P,
++		.repacked_fourcc = V4L2_PIX_FMT_SGRBG12,
++		.code		= MEDIA_BUS_FMT_SGRBG12_1X12,
++		.depth		= 12,
++		.csi_dt		= 0x2c,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SRGGB12P,
++		.repacked_fourcc = V4L2_PIX_FMT_SRGGB12,
++		.code		= MEDIA_BUS_FMT_SRGGB12_1X12,
++		.depth		= 12,
++		.csi_dt		= 0x2c,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SBGGR14P,
++		.code		= MEDIA_BUS_FMT_SBGGR14_1X14,
++		.depth		= 14,
++		.csi_dt		= 0x2d,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SGBRG14P,
++		.code		= MEDIA_BUS_FMT_SGBRG14_1X14,
++		.depth		= 14,
++		.csi_dt		= 0x2d,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SGRBG14P,
++		.code		= MEDIA_BUS_FMT_SGRBG14_1X14,
++		.depth		= 14,
++		.csi_dt		= 0x2d,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SRGGB14P,
++		.code		= MEDIA_BUS_FMT_SRGGB14_1X14,
++		.depth		= 14,
++		.csi_dt		= 0x2d,
++	}, {
++	/*
++	 * 16 bit Bayer formats could be supported, but there is no CSI2
++	 * data_type defined for raw 16, and no sensors that produce it at
++	 * present.
++	 */
++
++	/* Greyscale formats */
++		.fourcc		= V4L2_PIX_FMT_GREY,
++		.code		= MEDIA_BUS_FMT_Y8_1X8,
++		.depth		= 8,
++		.csi_dt		= 0x2a,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_Y10P,
++		.repacked_fourcc = V4L2_PIX_FMT_Y10,
++		.code		= MEDIA_BUS_FMT_Y10_1X10,
++		.depth		= 10,
++		.csi_dt		= 0x2b,
++	}, {
++		/* NB There is no packed V4L2 fourcc for this format. */
++		.repacked_fourcc = V4L2_PIX_FMT_Y12,
++		.code		= MEDIA_BUS_FMT_Y12_1X12,
++		.depth		= 12,
++		.csi_dt		= 0x2c,
++	},
++	/* Embedded data format */
++	{
++		.fourcc		= V4L2_META_FMT_SENSOR_DATA,
++		.code		= MEDIA_BUS_FMT_SENSOR_DATA,
++		.depth		= 8,
++	}
++};
++
++struct unicam_buffer {
++	struct vb2_v4l2_buffer vb;
++	struct list_head list;
++};
++
++static inline struct unicam_buffer *to_unicam_buffer(struct vb2_buffer *vb)
++{
++	return container_of(vb, struct unicam_buffer, vb.vb2_buf);
++}
++
++struct unicam_node {
++	bool registered;
++	int open;
++	bool streaming;
++	unsigned int pad_id;
++	/* Pointer pointing to current v4l2_buffer */
++	struct unicam_buffer *cur_frm;
++	/* Pointer pointing to next v4l2_buffer */
++	struct unicam_buffer *next_frm;
++	/* video capture */
++	const struct unicam_fmt *fmt;
++	/* Used to store current pixel format */
++	struct v4l2_format v_fmt;
++	/* Used to store current mbus frame format */
++	struct v4l2_mbus_framefmt m_fmt;
++	/* Buffer queue used in video-buf */
++	struct vb2_queue buffer_queue;
++	/* Queue of filled frames */
++	struct list_head dma_queue;
++	/* IRQ lock for DMA queue */
++	spinlock_t dma_queue_lock;
++	/* lock used to access this structure */
++	struct mutex lock;
++	/* Identifies video device for this channel */
++	struct video_device video_dev;
++	/* Pointer to the parent handle */
++	struct unicam_device *dev;
++	struct media_pad pad;
++	unsigned int embedded_lines;
++	/*
++	 * Dummy buffer intended to be used by unicam
++	 * if we have no other queued buffers to swap to.
++	 */
++	void *dummy_buf_cpu_addr;
++	dma_addr_t dummy_buf_dma_addr;
++};
++
++struct unicam_device {
++	struct kref kref;
++
++	/* V4l2 specific parameters */
++	struct v4l2_async_subdev asd;
++
++	/* peripheral base address */
++	void __iomem *base;
++	/* clock gating base address */
++	void __iomem *clk_gate_base;
++	/* clock handle */
++	struct clk *clock;
++	/* V4l2 device */
++	struct v4l2_device v4l2_dev;
++	struct media_device mdev;
++
++	/* parent device */
++	struct platform_device *pdev;
++	/* subdevice async Notifier */
++	struct v4l2_async_notifier notifier;
++	unsigned int sequence;
++
++	/* ptr to  sub device */
++	struct v4l2_subdev *sensor;
++	/* Pad config for the sensor */
++	struct v4l2_subdev_pad_config *sensor_config;
++
++	enum v4l2_mbus_type bus_type;
++	/*
++	 * Stores bus.mipi_csi2.flags for CSI2 sensors, or
++	 * bus.mipi_csi1.strobe for CCP2.
++	 */
++	unsigned int bus_flags;
++	unsigned int max_data_lanes;
++	unsigned int active_data_lanes;
++	bool sensor_embedded_data;
++
++	struct unicam_node node[MAX_NODES];
++	struct v4l2_ctrl_handler ctrl_handler;
++};
++
++static inline struct unicam_device *
++to_unicam_device(struct v4l2_device *v4l2_dev)
++{
++	return container_of(v4l2_dev, struct unicam_device, v4l2_dev);
++}
++
++/* Hardware access */
++static inline void clk_write(struct unicam_device *dev, u32 val)
++{
++	writel(val | 0x5a000000, dev->clk_gate_base);
++}
++
++static inline u32 reg_read(struct unicam_device *dev, u32 offset)
++{
++	return readl(dev->base + offset);
++}
++
++static inline void reg_write(struct unicam_device *dev, u32 offset, u32 val)
++{
++	writel(val, dev->base + offset);
++}
++
++static inline int get_field(u32 value, u32 mask)
++{
++	return (value & mask) >> __ffs(mask);
++}
++
++static inline void set_field(u32 *valp, u32 field, u32 mask)
++{
++	u32 val = *valp;
++
++	val &= ~mask;
++	val |= (field << __ffs(mask)) & mask;
++	*valp = val;
++}
++
++static inline u32 reg_read_field(struct unicam_device *dev, u32 offset,
++				 u32 mask)
++{
++	return get_field(reg_read(dev, offset), mask);
++}
++
++static inline void reg_write_field(struct unicam_device *dev, u32 offset,
++				   u32 field, u32 mask)
++{
++	u32 val = reg_read(dev, offset);
++
++	set_field(&val, field, mask);
++	reg_write(dev, offset, val);
++}
++
++/* Power management functions */
++static inline int unicam_runtime_get(struct unicam_device *dev)
++{
++	return pm_runtime_get_sync(&dev->pdev->dev);
++}
++
++static inline void unicam_runtime_put(struct unicam_device *dev)
++{
++	pm_runtime_put_sync(&dev->pdev->dev);
++}
++
++/* Format setup functions */
++static const struct unicam_fmt *find_format_by_code(u32 code)
++{
++	unsigned int i;
++
++	for (i = 0; i < ARRAY_SIZE(formats); i++) {
++		if (formats[i].code == code)
++			return &formats[i];
++	}
++
++	return NULL;
++}
++
++static int check_mbus_format(struct unicam_device *dev,
++			     const struct unicam_fmt *format)
++{
++	unsigned int i;
++	int ret = 0;
++
++	for (i = 0; !ret && i < MAX_ENUM_MBUS_CODE; i++) {
++		struct v4l2_subdev_mbus_code_enum mbus_code = {
++			.index = i,
++			.pad = IMAGE_PAD,
++			.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++		};
++
++		ret = v4l2_subdev_call(dev->sensor, pad, enum_mbus_code,
++				       NULL, &mbus_code);
++
++		if (!ret && mbus_code.code == format->code)
++			return 1;
++	}
++
++	return 0;
++}
++
++static const struct unicam_fmt *find_format_by_pix(struct unicam_device *dev,
++						   u32 pixelformat)
++{
++	unsigned int i;
++
++	for (i = 0; i < ARRAY_SIZE(formats); i++) {
++		if (formats[i].fourcc == pixelformat ||
++		    formats[i].repacked_fourcc == pixelformat) {
++			if (formats[i].check_variants &&
++			    !check_mbus_format(dev, &formats[i]))
++				continue;
++			return &formats[i];
++		}
++	}
++
++	return NULL;
++}
++
++static inline unsigned int bytes_per_line(u32 width,
++					  const struct unicam_fmt *fmt,
++					  u32 v4l2_fourcc)
++{
++	if (v4l2_fourcc == fmt->repacked_fourcc)
++		/* Repacking always goes to 16bpp */
++		return ALIGN(width << 1, BPL_ALIGNMENT);
++	else
++		return ALIGN((width * fmt->depth) >> 3, BPL_ALIGNMENT);
++}
++
++static int __subdev_get_format(struct unicam_device *dev,
++			       struct v4l2_mbus_framefmt *fmt, int pad_id)
++{
++	struct v4l2_subdev_format sd_fmt = {
++		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++		.pad = pad_id
++	};
++	int ret;
++
++	ret = v4l2_subdev_call(dev->sensor, pad, get_fmt, dev->sensor_config,
++			       &sd_fmt);
++	if (ret < 0)
++		return ret;
++
++	*fmt = sd_fmt.format;
++
++	unicam_dbg(1, dev, "%s %dx%d code:%04x\n", __func__,
++		   fmt->width, fmt->height, fmt->code);
++
++	return 0;
++}
++
++static int __subdev_set_format(struct unicam_device *dev,
++			       struct v4l2_mbus_framefmt *fmt, int pad_id)
++{
++	struct v4l2_subdev_format sd_fmt = {
++		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++		.pad = pad_id
++	};
++	int ret;
++
++	sd_fmt.format = *fmt;
++
++	ret = v4l2_subdev_call(dev->sensor, pad, set_fmt, dev->sensor_config,
++			       &sd_fmt);
++	if (ret < 0)
++		return ret;
++
++	*fmt = sd_fmt.format;
++
++	if (pad_id == IMAGE_PAD)
++		unicam_dbg(1, dev, "%s %dx%d code:%04x\n", __func__, fmt->width,
++			   fmt->height, fmt->code);
++	else
++		unicam_dbg(1, dev, "%s Embedded data code:%04x\n", __func__,
++			   sd_fmt.format.code);
++
++	return 0;
++}
++
++static int unicam_calc_format_size_bpl(struct unicam_device *dev,
++				       const struct unicam_fmt *fmt,
++				       struct v4l2_format *f)
++{
++	unsigned int min_bytesperline;
++
++	v4l_bound_align_image(&f->fmt.pix.width, MIN_WIDTH, MAX_WIDTH, 2,
++			      &f->fmt.pix.height, MIN_HEIGHT, MAX_HEIGHT, 0,
++			      0);
++
++	min_bytesperline = bytes_per_line(f->fmt.pix.width, fmt,
++					  f->fmt.pix.pixelformat);
++
++	if (f->fmt.pix.bytesperline > min_bytesperline &&
++	    f->fmt.pix.bytesperline <= MAX_BYTESPERLINE)
++		f->fmt.pix.bytesperline = ALIGN(f->fmt.pix.bytesperline,
++						BPL_ALIGNMENT);
++	else
++		f->fmt.pix.bytesperline = min_bytesperline;
++
++	f->fmt.pix.sizeimage = f->fmt.pix.height * f->fmt.pix.bytesperline;
++
++	unicam_dbg(3, dev, "%s: fourcc: %08X size: %dx%d bpl:%d img_size:%d\n",
++		   __func__,
++		   f->fmt.pix.pixelformat,
++		   f->fmt.pix.width, f->fmt.pix.height,
++		   f->fmt.pix.bytesperline, f->fmt.pix.sizeimage);
++
++	return 0;
++}
++
++static int unicam_reset_format(struct unicam_node *node)
++{
++	struct unicam_device *dev = node->dev;
++	struct v4l2_mbus_framefmt mbus_fmt;
++	int ret;
++
++	if (dev->sensor_embedded_data || node->pad_id != METADATA_PAD) {
++		ret = __subdev_get_format(dev, &mbus_fmt, node->pad_id);
++		if (ret) {
++			unicam_err(dev, "Failed to get_format - ret %d\n", ret);
++			return ret;
++		}
++
++		if (mbus_fmt.code != node->fmt->code) {
++			unicam_err(dev, "code mismatch - fmt->code %08x, mbus_fmt.code %08x\n",
++				   node->fmt->code, mbus_fmt.code);
++			return ret;
++		}
++	}
++
++	if (node->pad_id == IMAGE_PAD) {
++		v4l2_fill_pix_format(&node->v_fmt.fmt.pix, &mbus_fmt);
++		node->v_fmt.type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
++		unicam_calc_format_size_bpl(dev, node->fmt, &node->v_fmt);
++	} else {
++		node->v_fmt.type = V4L2_BUF_TYPE_META_CAPTURE;
++		node->v_fmt.fmt.meta.dataformat = V4L2_META_FMT_SENSOR_DATA;
++		if (dev->sensor_embedded_data) {
++			node->v_fmt.fmt.meta.buffersize =
++					mbus_fmt.width * mbus_fmt.height;
++			node->embedded_lines = mbus_fmt.height;
++		} else {
++			node->v_fmt.fmt.meta.buffersize = UNICAM_EMBEDDED_SIZE;
++			node->embedded_lines = 1;
++		}
++	}
++
++	node->m_fmt = mbus_fmt;
++	return 0;
++}
++
++static void unicam_wr_dma_addr(struct unicam_device *dev, dma_addr_t dmaaddr,
++			       unsigned int buffer_size, int pad_id)
++{
++	dma_addr_t endaddr = dmaaddr + buffer_size;
++
++	/*
++	 * dmaaddr and endaddr should be a 32-bit address with the top two bits
++	 * set to 0x3 to signify uncached access through the Videocore memory
++	 * controller.
++	 */
++	WARN_ON((dmaaddr >> 30) != 0x3 || (endaddr >> 30) != 0x3);
++
++	if (pad_id == IMAGE_PAD) {
++		reg_write(dev, UNICAM_IBSA0, dmaaddr);
++		reg_write(dev, UNICAM_IBEA0, endaddr);
++	} else {
++		reg_write(dev, UNICAM_DBSA0, dmaaddr);
++		reg_write(dev, UNICAM_DBEA0, endaddr);
++	}
++}
++
++static inline unsigned int unicam_get_lines_done(struct unicam_device *dev)
++{
++	dma_addr_t start_addr, cur_addr;
++	unsigned int stride = dev->node[IMAGE_PAD].v_fmt.fmt.pix.bytesperline;
++	struct unicam_buffer *frm = dev->node[IMAGE_PAD].cur_frm;
++
++	if (!frm)
++		return 0;
++
++	start_addr = vb2_dma_contig_plane_dma_addr(&frm->vb.vb2_buf, 0);
++	cur_addr = reg_read(dev, UNICAM_IBWP);
++	return (unsigned int)(cur_addr - start_addr) / stride;
++}
++
++static inline void unicam_schedule_next_buffer(struct unicam_node *node)
++{
++	struct unicam_device *dev = node->dev;
++	struct unicam_buffer *buf;
++	unsigned int size;
++	dma_addr_t addr;
++
++	buf = list_first_entry(&node->dma_queue, struct unicam_buffer, list);
++	node->next_frm = buf;
++	list_del(&buf->list);
++
++	addr = vb2_dma_contig_plane_dma_addr(&buf->vb.vb2_buf, 0);
++	size = (node->pad_id == IMAGE_PAD) ?
++			node->v_fmt.fmt.pix.sizeimage :
++			node->v_fmt.fmt.meta.buffersize;
++
++	unicam_wr_dma_addr(dev, addr, size, node->pad_id);
++}
++
++static inline void unicam_schedule_dummy_buffer(struct unicam_node *node)
++{
++	struct unicam_device *dev = node->dev;
++
++	unicam_dbg(3, dev, "Scheduling dummy buffer for node %d\n",
++		   node->pad_id);
++
++	unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr, DUMMY_BUF_SIZE,
++			   node->pad_id);
++	node->next_frm = NULL;
++}
++
++static inline void unicam_process_buffer_complete(struct unicam_node *node,
++						  unsigned int sequence)
++{
++	node->cur_frm->vb.field = node->m_fmt.field;
++	node->cur_frm->vb.sequence = sequence;
++
++	vb2_buffer_done(&node->cur_frm->vb.vb2_buf, VB2_BUF_STATE_DONE);
++}
++
++static bool unicam_all_nodes_streaming(struct unicam_device *dev)
++{
++	bool ret;
++
++	ret = dev->node[IMAGE_PAD].open && dev->node[IMAGE_PAD].streaming;
++	ret &= !dev->node[METADATA_PAD].open ||
++	       dev->node[METADATA_PAD].streaming;
++	return ret;
++}
++
++static bool unicam_all_nodes_disabled(struct unicam_device *dev)
++{
++	return !dev->node[IMAGE_PAD].streaming &&
++	       !dev->node[METADATA_PAD].streaming;
++}
++
++static void unicam_queue_event_sof(struct unicam_device *unicam)
++{
++	struct v4l2_event event = {
++		.type = V4L2_EVENT_FRAME_SYNC,
++		.u.frame_sync.frame_sequence = unicam->sequence,
++	};
++
++	v4l2_event_queue(&unicam->node[IMAGE_PAD].video_dev, &event);
++}
++
++/*
++ * unicam_isr : ISR handler for unicam capture
++ * @irq: irq number
++ * @dev_id: dev_id ptr
++ *
++ * It changes status of the captured buffer, takes next buffer from the queue
++ * and sets its address in unicam registers
++ */
++static irqreturn_t unicam_isr(int irq, void *dev)
++{
++	struct unicam_device *unicam = dev;
++	unsigned int lines_done = unicam_get_lines_done(dev);
++	unsigned int sequence = unicam->sequence;
++	unsigned int i;
++	u32 ista, sta;
++	u64 ts;
++
++	/*
++	 * Don't service interrupts if not streaming.
++	 * Avoids issues if the VPU should enable the
++	 * peripheral without the kernel knowing (that
++	 * shouldn't happen, but causes issues if it does).
++	 */
++	if (unicam_all_nodes_disabled(unicam))
++		return IRQ_NONE;
++
++	sta = reg_read(unicam, UNICAM_STA);
++	/* Write value back to clear the interrupts */
++	reg_write(unicam, UNICAM_STA, sta);
++
++	ista = reg_read(unicam, UNICAM_ISTA);
++	/* Write value back to clear the interrupts */
++	reg_write(unicam, UNICAM_ISTA, ista);
++
++	unicam_dbg(3, unicam, "ISR: ISTA: 0x%X, STA: 0x%X, sequence %d, lines done %d",
++		   ista, sta, sequence, lines_done);
++
++	if (!(sta & (UNICAM_IS | UNICAM_PI0)))
++		return IRQ_HANDLED;
++
++	/*
++	 * We must run the frame end handler first. If we have a valid next_frm
++	 * and we get a simultaneout FE + FS interrupt, running the FS handler
++	 * first would null out the next_frm ptr and we would have lost the
++	 * buffer forever.
++	 */
++	if (ista & UNICAM_FEI || sta & UNICAM_PI0) {
++		/*
++		 * Ensure we have swapped buffers already as we can't
++		 * stop the peripheral. If no buffer is available, use a
++		 * dummy buffer to dump out frames until we get a new buffer
++		 * to use.
++		 */
++		for (i = 0; i < ARRAY_SIZE(unicam->node); i++) {
++			if (!unicam->node[i].streaming)
++				continue;
++
++			if (unicam->node[i].cur_frm)
++				unicam_process_buffer_complete(&unicam->node[i],
++							       sequence);
++			unicam->node[i].cur_frm = unicam->node[i].next_frm;
++		}
++		unicam->sequence++;
++	}
++
++	if (ista & UNICAM_FSI) {
++		/*
++		 * Timestamp is to be when the first data byte was captured,
++		 * aka frame start.
++		 */
++		ts = ktime_get_ns();
++		for (i = 0; i < ARRAY_SIZE(unicam->node); i++) {
++			if (!unicam->node[i].streaming)
++				continue;
++
++			if (unicam->node[i].cur_frm)
++				unicam->node[i].cur_frm->vb.vb2_buf.timestamp =
++								ts;
++			/*
++			 * Set the next frame output to go to a dummy frame
++			 * if we have not managed to obtain another frame
++			 * from the queue.
++			 */
++			unicam_schedule_dummy_buffer(&unicam->node[i]);
++		}
++
++		unicam_queue_event_sof(unicam);
++	}
++
++	/*
++	 * Cannot swap buffer at frame end, there may be a race condition
++	 * where the HW does not actually swap it if the new frame has
++	 * already started.
++	 */
++	if (ista & (UNICAM_FSI | UNICAM_LCI) && !(ista & UNICAM_FEI)) {
++		for (i = 0; i < ARRAY_SIZE(unicam->node); i++) {
++			if (!unicam->node[i].streaming)
++				continue;
++
++			spin_lock(&unicam->node[i].dma_queue_lock);
++			if (!list_empty(&unicam->node[i].dma_queue) &&
++			    !unicam->node[i].next_frm)
++				unicam_schedule_next_buffer(&unicam->node[i]);
++			spin_unlock(&unicam->node[i].dma_queue_lock);
++		}
++	}
++
++	if (reg_read(unicam, UNICAM_ICTL) & UNICAM_FCM) {
++		/* Switch out of trigger mode if selected */
++		reg_write_field(unicam, UNICAM_ICTL, 1, UNICAM_TFC);
++		reg_write_field(unicam, UNICAM_ICTL, 0, UNICAM_FCM);
++	}
++	return IRQ_HANDLED;
++}
++
++static int unicam_querycap(struct file *file, void *priv,
++			   struct v4l2_capability *cap)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	strlcpy(cap->driver, UNICAM_MODULE_NAME, sizeof(cap->driver));
++	strlcpy(cap->card, UNICAM_MODULE_NAME, sizeof(cap->card));
++
++	snprintf(cap->bus_info, sizeof(cap->bus_info),
++		 "platform:%s", dev_name(&dev->pdev->dev));
++
++	cap->capabilities |= V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_META_CAPTURE;
++
++	return 0;
++}
++
++static int unicam_enum_fmt_vid_cap(struct file *file, void  *priv,
++				   struct v4l2_fmtdesc *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	unsigned int index = 0;
++	unsigned int i;
++	int ret = 0;
++
++	if (node->pad_id != IMAGE_PAD)
++		return -EINVAL;
++
++	for (i = 0; !ret && i < MAX_ENUM_MBUS_CODE; i++) {
++		struct v4l2_subdev_mbus_code_enum mbus_code = {
++			.index = i,
++			.pad = IMAGE_PAD,
++			.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++		};
++		const struct unicam_fmt *fmt;
++
++		ret = v4l2_subdev_call(dev->sensor, pad, enum_mbus_code,
++				       NULL, &mbus_code);
++		if (ret < 0) {
++			unicam_dbg(2, dev,
++				   "subdev->enum_mbus_code idx %d returned %d - index invalid\n",
++				   i, ret);
++			return -EINVAL;
++		}
++
++		fmt = find_format_by_code(mbus_code.code);
++		if (fmt) {
++			if (fmt->fourcc) {
++				if (index == f->index) {
++					f->pixelformat = fmt->fourcc;
++					break;
++				}
++				index++;
++			}
++			if (fmt->repacked_fourcc) {
++				if (index == f->index) {
++					f->pixelformat = fmt->repacked_fourcc;
++					break;
++				}
++				index++;
++			}
++		}
++	}
++
++	return 0;
++}
++
++static int unicam_g_fmt_vid_cap(struct file *file, void *priv,
++				struct v4l2_format *f)
++{
++	struct v4l2_mbus_framefmt mbus_fmt = {0};
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	const struct unicam_fmt *fmt = NULL;
++	int ret;
++
++	if (node->pad_id != IMAGE_PAD)
++		return -EINVAL;
++
++	/*
++	 * If a flip has occurred in the sensor, the fmt code might have
++	 * changed. So we will need to re-fetch the format from the subdevice.
++	 */
++	ret = __subdev_get_format(dev, &mbus_fmt, node->pad_id);
++	if (ret)
++		return -EINVAL;
++
++	/* Find the V4L2 format from mbus code. We must match a known format. */
++	fmt = find_format_by_code(mbus_fmt.code);
++	if (!fmt)
++		return -EINVAL;
++
++	node->fmt = fmt;
++	node->v_fmt.fmt.pix.pixelformat = fmt->fourcc;
++	*f = node->v_fmt;
++
++	return 0;
++}
++
++static
++const struct unicam_fmt *get_first_supported_format(struct unicam_device *dev)
++{
++	struct v4l2_subdev_mbus_code_enum mbus_code;
++	const struct unicam_fmt *fmt = NULL;
++	unsigned int i;
++	int ret;
++
++	for (i = 0; ret != -EINVAL && ret != -ENOIOCTLCMD; ++i) {
++		memset(&mbus_code, 0, sizeof(mbus_code));
++		mbus_code.index = i;
++		mbus_code.pad = IMAGE_PAD;
++		mbus_code.which = V4L2_SUBDEV_FORMAT_ACTIVE;
++
++		ret = v4l2_subdev_call(dev->sensor, pad, enum_mbus_code, NULL,
++				       &mbus_code);
++		if (ret < 0) {
++			unicam_dbg(2, dev,
++				   "subdev->enum_mbus_code idx %u returned %d - continue\n",
++				   i, ret);
++			continue;
++		}
++
++		unicam_dbg(2, dev, "subdev %s: code: 0x%08x idx: %u\n",
++			   dev->sensor->name, mbus_code.code, i);
++
++		fmt = find_format_by_code(mbus_code.code);
++		unicam_dbg(2, dev, "fmt 0x%08x returned as %p, V4L2 FOURCC 0x%08x, csi_dt 0x%02x\n",
++			   mbus_code.code, fmt, fmt ? fmt->fourcc : 0,
++			   fmt ? fmt->csi_dt : 0);
++		if (fmt)
++			return fmt;
++	}
++
++	return NULL;
++}
++
++static int unicam_try_fmt_vid_cap(struct file *file, void *priv,
++				  struct v4l2_format *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	struct v4l2_subdev_format sd_fmt = {
++		.which = V4L2_SUBDEV_FORMAT_TRY,
++		.pad = IMAGE_PAD
++	};
++	struct v4l2_mbus_framefmt *mbus_fmt = &sd_fmt.format;
++	const struct unicam_fmt *fmt;
++	int ret;
++
++	if (node->pad_id != IMAGE_PAD)
++		return -EINVAL;
++
++	fmt = find_format_by_pix(dev, f->fmt.pix.pixelformat);
++	if (!fmt) {
++		/*
++		 * Pixel format not supported by unicam. Choose the first
++		 * supported format, and let the sensor choose something else.
++		 */
++		unicam_dbg(3, dev, "Fourcc format (0x%08x) not found. Use first format.\n",
++			   f->fmt.pix.pixelformat);
++
++		fmt = &formats[0];
++		f->fmt.pix.pixelformat = fmt->fourcc;
++	}
++
++	v4l2_fill_mbus_format(mbus_fmt, &f->fmt.pix, fmt->code);
++	/*
++	 * No support for receiving interlaced video, so never
++	 * request it from the sensor subdev.
++	 */
++	mbus_fmt->field = V4L2_FIELD_NONE;
++
++	ret = v4l2_subdev_call(dev->sensor, pad, set_fmt, dev->sensor_config,
++			       &sd_fmt);
++	if (ret && ret != -ENOIOCTLCMD && ret != -ENODEV)
++		return ret;
++
++	if (mbus_fmt->field != V4L2_FIELD_NONE)
++		unicam_info(dev, "Sensor trying to send interlaced video - results may be unpredictable\n");
++
++	v4l2_fill_pix_format(&f->fmt.pix, &sd_fmt.format);
++	if (mbus_fmt->code != fmt->code) {
++		/* Sensor has returned an alternate format */
++		fmt = find_format_by_code(mbus_fmt->code);
++		if (!fmt) {
++			/*
++			 * The alternate format is one unicam can't support.
++			 * Find the first format that is supported by both, and
++			 * then set that.
++			 */
++			fmt = get_first_supported_format(dev);
++			mbus_fmt->code = fmt->code;
++
++			ret = v4l2_subdev_call(dev->sensor, pad, set_fmt,
++					       dev->sensor_config, &sd_fmt);
++			if (ret && ret != -ENOIOCTLCMD && ret != -ENODEV)
++				return ret;
++
++			if (mbus_fmt->field != V4L2_FIELD_NONE)
++				unicam_info(dev, "Sensor trying to send interlaced video - results may be unpredictable\n");
++
++			v4l2_fill_pix_format(&f->fmt.pix, &sd_fmt.format);
++
++			if (mbus_fmt->code != fmt->code) {
++				/*
++				 * We've set a format that the sensor reports
++				 * as being supported, but it refuses to set it.
++				 * Not much else we can do.
++				 * Assume that the sensor driver may accept the
++				 * format when it is set (rather than tried).
++				 */
++				unicam_err(dev, "Sensor won't accept default format, and Unicam can't support sensor default\n");
++			}
++		}
++
++		if (fmt->fourcc)
++			f->fmt.pix.pixelformat = fmt->fourcc;
++		else
++			f->fmt.pix.pixelformat = fmt->repacked_fourcc;
++	}
++
++	return unicam_calc_format_size_bpl(dev, fmt, f);
++}
++
++static int unicam_s_fmt_vid_cap(struct file *file, void *priv,
++				struct v4l2_format *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	struct vb2_queue *q = &node->buffer_queue;
++	struct v4l2_mbus_framefmt mbus_fmt = {0};
++	const struct unicam_fmt *fmt;
++	int ret;
++
++	if (vb2_is_busy(q))
++		return -EBUSY;
++
++	ret = unicam_try_fmt_vid_cap(file, priv, f);
++	if (ret < 0)
++		return ret;
++
++	fmt = find_format_by_pix(dev, f->fmt.pix.pixelformat);
++	if (!fmt) {
++		/*
++		 * Unknown pixel format - adopt a default.
++		 * This shouldn't happen as try_fmt should have resolved any
++		 * issues first.
++		 */
++		fmt = get_first_supported_format(dev);
++		if (!fmt)
++			/*
++			 * It shouldn't be possible to get here with no
++			 * supported formats
++			 */
++			return -EINVAL;
++		f->fmt.pix.pixelformat = fmt->fourcc;
++		return -EINVAL;
++	}
++
++	v4l2_fill_mbus_format(&mbus_fmt, &f->fmt.pix, fmt->code);
++
++	ret = __subdev_set_format(dev, &mbus_fmt, node->pad_id);
++	if (ret) {
++		unicam_dbg(3, dev, "%s __subdev_set_format failed %d\n",
++			   __func__, ret);
++		return ret;
++	}
++
++	/* Just double check nothing has gone wrong */
++	if (mbus_fmt.code != fmt->code) {
++		unicam_dbg(3, dev,
++			   "%s subdev changed format on us, this should not happen\n",
++			   __func__);
++		return -EINVAL;
++	}
++
++	node->fmt = fmt;
++	node->v_fmt.fmt.pix.pixelformat = f->fmt.pix.pixelformat;
++	node->v_fmt.fmt.pix.bytesperline = f->fmt.pix.bytesperline;
++	unicam_reset_format(node);
++
++	unicam_dbg(3, dev,
++		   "%s %dx%d, mbus_fmt 0x%08X, V4L2 pix 0x%08X.\n",
++		   __func__, node->v_fmt.fmt.pix.width,
++		   node->v_fmt.fmt.pix.height, mbus_fmt.code,
++		   node->v_fmt.fmt.pix.pixelformat);
++
++	*f = node->v_fmt;
++
++	return 0;
++}
++
++static int unicam_enum_fmt_meta_cap(struct file *file, void *priv,
++				    struct v4l2_fmtdesc *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	const struct unicam_fmt *fmt;
++	u32 code;
++	int ret = 0;
++
++	if (node->pad_id != METADATA_PAD || f->index != 0)
++		return -EINVAL;
++
++	if (dev->sensor_embedded_data) {
++		struct v4l2_subdev_mbus_code_enum mbus_code = {
++			.index = f->index,
++			.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++			.pad = METADATA_PAD,
++		};
++
++		ret = v4l2_subdev_call(dev->sensor, pad, enum_mbus_code, NULL,
++				       &mbus_code);
++		if (ret < 0) {
++			unicam_dbg(2, dev,
++				   "subdev->enum_mbus_code idx 0 returned %d - index invalid\n",
++				   ret);
++			return -EINVAL;
++		}
++
++		code = mbus_code.code;
++	} else {
++		code = MEDIA_BUS_FMT_SENSOR_DATA;
++	}
++
++	fmt = find_format_by_code(code);
++	if (fmt)
++		f->pixelformat = fmt->fourcc;
++
++	return 0;
++}
++
++static int unicam_g_fmt_meta_cap(struct file *file, void *priv,
++				 struct v4l2_format *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++
++	if (node->pad_id != METADATA_PAD)
++		return -EINVAL;
++
++	*f = node->v_fmt;
++
++	return 0;
++}
++
++static int unicam_queue_setup(struct vb2_queue *vq,
++			      unsigned int *nbuffers,
++			      unsigned int *nplanes,
++			      unsigned int sizes[],
++			      struct device *alloc_devs[])
++{
++	struct unicam_node *node = vb2_get_drv_priv(vq);
++	struct unicam_device *dev = node->dev;
++	unsigned int size = node->pad_id == IMAGE_PAD ?
++				    node->v_fmt.fmt.pix.sizeimage :
++				    node->v_fmt.fmt.meta.buffersize;
++
++	if (vq->num_buffers + *nbuffers < 3)
++		*nbuffers = 3 - vq->num_buffers;
++
++	if (*nplanes) {
++		if (sizes[0] < size) {
++			unicam_err(dev, "sizes[0] %i < size %u\n", sizes[0],
++				   size);
++			return -EINVAL;
++		}
++		size = sizes[0];
++	}
++
++	*nplanes = 1;
++	sizes[0] = size;
++
++	return 0;
++}
++
++static int unicam_buffer_prepare(struct vb2_buffer *vb)
++{
++	struct unicam_node *node = vb2_get_drv_priv(vb->vb2_queue);
++	struct unicam_device *dev = node->dev;
++	struct unicam_buffer *buf = to_unicam_buffer(vb);
++	unsigned long size;
++
++	if (WARN_ON(!node->fmt))
++		return -EINVAL;
++
++	size = node->pad_id == IMAGE_PAD ? node->v_fmt.fmt.pix.sizeimage :
++					   node->v_fmt.fmt.meta.buffersize;
++	if (vb2_plane_size(vb, 0) < size) {
++		unicam_err(dev, "data will not fit into plane (%lu < %lu)\n",
++			   vb2_plane_size(vb, 0), size);
++		return -EINVAL;
++	}
++
++	vb2_set_plane_payload(&buf->vb.vb2_buf, 0, size);
++	return 0;
++}
++
++static void unicam_buffer_queue(struct vb2_buffer *vb)
++{
++	struct unicam_node *node = vb2_get_drv_priv(vb->vb2_queue);
++	struct unicam_buffer *buf = to_unicam_buffer(vb);
++	unsigned long flags;
++
++	spin_lock_irqsave(&node->dma_queue_lock, flags);
++	list_add_tail(&buf->list, &node->dma_queue);
++	spin_unlock_irqrestore(&node->dma_queue_lock, flags);
++}
++
++static void unicam_set_packing_config(struct unicam_device *dev)
++{
++	u32 pack, unpack;
++	u32 val;
++
++	if (dev->node[IMAGE_PAD].v_fmt.fmt.pix.pixelformat ==
++	    dev->node[IMAGE_PAD].fmt->fourcc) {
++		unpack = UNICAM_PUM_NONE;
++		pack = UNICAM_PPM_NONE;
++	} else {
++		switch (dev->node[IMAGE_PAD].fmt->depth) {
++		case 8:
++			unpack = UNICAM_PUM_UNPACK8;
++			break;
++		case 10:
++			unpack = UNICAM_PUM_UNPACK10;
++			break;
++		case 12:
++			unpack = UNICAM_PUM_UNPACK12;
++			break;
++		case 14:
++			unpack = UNICAM_PUM_UNPACK14;
++			break;
++		case 16:
++			unpack = UNICAM_PUM_UNPACK16;
++			break;
++		default:
++			unpack = UNICAM_PUM_NONE;
++			break;
++		}
++
++		/* Repacking is always to 16bpp */
++		pack = UNICAM_PPM_PACK16;
++	}
++
++	val = 0;
++	set_field(&val, unpack, UNICAM_PUM_MASK);
++	set_field(&val, pack, UNICAM_PPM_MASK);
++	reg_write(dev, UNICAM_IPIPE, val);
++}
++
++static void unicam_cfg_image_id(struct unicam_device *dev)
++{
++	if (dev->bus_type == V4L2_MBUS_CSI2_DPHY) {
++		/* CSI2 mode, hardcode VC 0 for now. */
++		reg_write(dev, UNICAM_IDI0,
++			  (0 << 6) | dev->node[IMAGE_PAD].fmt->csi_dt);
++	} else {
++		/* CCP2 mode */
++		reg_write(dev, UNICAM_IDI0,
++			  0x80 | dev->node[IMAGE_PAD].fmt->csi_dt);
++	}
++}
++
++static void unicam_enable_ed(struct unicam_device *dev)
++{
++	u32 val = reg_read(dev, UNICAM_DCS);
++
++	set_field(&val, 2, UNICAM_EDL_MASK);
++	/* Do not wrap at the end of the embedded data buffer */
++	set_field(&val, 0, UNICAM_DBOB);
++
++	reg_write(dev, UNICAM_DCS, val);
++}
++
++static void unicam_start_rx(struct unicam_device *dev, dma_addr_t *addr)
++{
++	int line_int_freq = dev->node[IMAGE_PAD].v_fmt.fmt.pix.height >> 2;
++	unsigned int size, i;
++	u32 val;
++
++	if (line_int_freq < 128)
++		line_int_freq = 128;
++
++	/* Enable lane clocks */
++	val = 1;
++	for (i = 0; i < dev->active_data_lanes; i++)
++		val = val << 2 | 1;
++	clk_write(dev, val);
++
++	/* Basic init */
++	reg_write(dev, UNICAM_CTRL, UNICAM_MEM);
++
++	/* Enable analogue control, and leave in reset. */
++	val = UNICAM_AR;
++	set_field(&val, 7, UNICAM_CTATADJ_MASK);
++	set_field(&val, 7, UNICAM_PTATADJ_MASK);
++	reg_write(dev, UNICAM_ANA, val);
++	usleep_range(1000, 2000);
++
++	/* Come out of reset */
++	reg_write_field(dev, UNICAM_ANA, 0, UNICAM_AR);
++
++	/* Peripheral reset */
++	reg_write_field(dev, UNICAM_CTRL, 1, UNICAM_CPR);
++	reg_write_field(dev, UNICAM_CTRL, 0, UNICAM_CPR);
++
++	reg_write_field(dev, UNICAM_CTRL, 0, UNICAM_CPE);
++
++	/* Enable Rx control. */
++	val = reg_read(dev, UNICAM_CTRL);
++	if (dev->bus_type == V4L2_MBUS_CSI2_DPHY) {
++		set_field(&val, UNICAM_CPM_CSI2, UNICAM_CPM_MASK);
++		set_field(&val, UNICAM_DCM_STROBE, UNICAM_DCM_MASK);
++	} else {
++		set_field(&val, UNICAM_CPM_CCP2, UNICAM_CPM_MASK);
++		set_field(&val, dev->bus_flags, UNICAM_DCM_MASK);
++	}
++	/* Packet framer timeout */
++	set_field(&val, 0xf, UNICAM_PFT_MASK);
++	set_field(&val, 128, UNICAM_OET_MASK);
++	reg_write(dev, UNICAM_CTRL, val);
++
++	reg_write(dev, UNICAM_IHWIN, 0);
++	reg_write(dev, UNICAM_IVWIN, 0);
++
++	/* AXI bus access QoS setup */
++	val = reg_read(dev, UNICAM_PRI);
++	set_field(&val, 0, UNICAM_BL_MASK);
++	set_field(&val, 0, UNICAM_BS_MASK);
++	set_field(&val, 0xe, UNICAM_PP_MASK);
++	set_field(&val, 8, UNICAM_NP_MASK);
++	set_field(&val, 2, UNICAM_PT_MASK);
++	set_field(&val, 1, UNICAM_PE);
++	reg_write(dev, UNICAM_PRI, val);
++
++	reg_write_field(dev, UNICAM_ANA, 0, UNICAM_DDL);
++
++	/* Always start in trigger frame capture mode (UNICAM_FCM set) */
++	val = UNICAM_FSIE | UNICAM_FEIE | UNICAM_FCM | UNICAM_IBOB;
++	set_field(&val, line_int_freq, UNICAM_LCIE_MASK);
++	reg_write(dev, UNICAM_ICTL, val);
++	reg_write(dev, UNICAM_STA, UNICAM_STA_MASK_ALL);
++	reg_write(dev, UNICAM_ISTA, UNICAM_ISTA_MASK_ALL);
++
++	/* tclk_term_en */
++	reg_write_field(dev, UNICAM_CLT, 2, UNICAM_CLT1_MASK);
++	/* tclk_settle */
++	reg_write_field(dev, UNICAM_CLT, 6, UNICAM_CLT2_MASK);
++	/* td_term_en */
++	reg_write_field(dev, UNICAM_DLT, 2, UNICAM_DLT1_MASK);
++	/* ths_settle */
++	reg_write_field(dev, UNICAM_DLT, 6, UNICAM_DLT2_MASK);
++	/* trx_enable */
++	reg_write_field(dev, UNICAM_DLT, 0, UNICAM_DLT3_MASK);
++
++	reg_write_field(dev, UNICAM_CTRL, 0, UNICAM_SOE);
++
++	/* Packet compare setup - required to avoid missing frame ends */
++	val = 0;
++	set_field(&val, 1, UNICAM_PCE);
++	set_field(&val, 1, UNICAM_GI);
++	set_field(&val, 1, UNICAM_CPH);
++	set_field(&val, 0, UNICAM_PCVC_MASK);
++	set_field(&val, 1, UNICAM_PCDT_MASK);
++	reg_write(dev, UNICAM_CMP0, val);
++
++	/* Enable clock lane and set up terminations */
++	val = 0;
++	if (dev->bus_type == V4L2_MBUS_CSI2_DPHY) {
++		/* CSI2 */
++		set_field(&val, 1, UNICAM_CLE);
++		set_field(&val, 1, UNICAM_CLLPE);
++		if (dev->bus_flags & V4L2_MBUS_CSI2_CONTINUOUS_CLOCK) {
++			set_field(&val, 1, UNICAM_CLTRE);
++			set_field(&val, 1, UNICAM_CLHSE);
++		}
++	} else {
++		/* CCP2 */
++		set_field(&val, 1, UNICAM_CLE);
++		set_field(&val, 1, UNICAM_CLHSE);
++		set_field(&val, 1, UNICAM_CLTRE);
++	}
++	reg_write(dev, UNICAM_CLK, val);
++
++	/*
++	 * Enable required data lanes with appropriate terminations.
++	 * The same value needs to be written to UNICAM_DATn registers for
++	 * the active lanes, and 0 for inactive ones.
++	 */
++	val = 0;
++	if (dev->bus_type == V4L2_MBUS_CSI2_DPHY) {
++		/* CSI2 */
++		set_field(&val, 1, UNICAM_DLE);
++		set_field(&val, 1, UNICAM_DLLPE);
++		if (dev->bus_flags & V4L2_MBUS_CSI2_CONTINUOUS_CLOCK) {
++			set_field(&val, 1, UNICAM_DLTRE);
++			set_field(&val, 1, UNICAM_DLHSE);
++		}
++	} else {
++		/* CCP2 */
++		set_field(&val, 1, UNICAM_DLE);
++		set_field(&val, 1, UNICAM_DLHSE);
++		set_field(&val, 1, UNICAM_DLTRE);
++	}
++	reg_write(dev, UNICAM_DAT0, val);
++
++	if (dev->active_data_lanes == 1)
++		val = 0;
++	reg_write(dev, UNICAM_DAT1, val);
++
++	if (dev->max_data_lanes > 2) {
++		/*
++		 * Registers UNICAM_DAT2 and UNICAM_DAT3 only valid if the
++		 * instance supports more than 2 data lanes.
++		 */
++		if (dev->active_data_lanes == 2)
++			val = 0;
++		reg_write(dev, UNICAM_DAT2, val);
++
++		if (dev->active_data_lanes == 3)
++			val = 0;
++		reg_write(dev, UNICAM_DAT3, val);
++	}
++
++	reg_write(dev, UNICAM_IBLS,
++		  dev->node[IMAGE_PAD].v_fmt.fmt.pix.bytesperline);
++	size = dev->node[IMAGE_PAD].v_fmt.fmt.pix.sizeimage;
++	unicam_wr_dma_addr(dev, addr[IMAGE_PAD], size, IMAGE_PAD);
++	unicam_set_packing_config(dev);
++	unicam_cfg_image_id(dev);
++
++	val = reg_read(dev, UNICAM_MISC);
++	set_field(&val, 1, UNICAM_FL0);
++	set_field(&val, 1, UNICAM_FL1);
++	reg_write(dev, UNICAM_MISC, val);
++
++	if (dev->node[METADATA_PAD].streaming && dev->sensor_embedded_data) {
++		size = dev->node[METADATA_PAD].v_fmt.fmt.meta.buffersize;
++		unicam_enable_ed(dev);
++		unicam_wr_dma_addr(dev, addr[METADATA_PAD], size, METADATA_PAD);
++	}
++
++	/* Enable peripheral */
++	reg_write_field(dev, UNICAM_CTRL, 1, UNICAM_CPE);
++
++	/* Load image pointers */
++	reg_write_field(dev, UNICAM_ICTL, 1, UNICAM_LIP_MASK);
++
++	/* Load embedded data buffer pointers if needed */
++	if (dev->node[METADATA_PAD].streaming && dev->sensor_embedded_data)
++		reg_write_field(dev, UNICAM_DCS, 1, UNICAM_LDP);
++
++	/*
++	 * Enable trigger only for the first frame to
++	 * sync correctly to the FS from the source.
++	 */
++	reg_write_field(dev, UNICAM_ICTL, 1, UNICAM_TFC);
++}
++
++static void unicam_disable(struct unicam_device *dev)
++{
++	/* Analogue lane control disable */
++	reg_write_field(dev, UNICAM_ANA, 1, UNICAM_DDL);
++
++	/* Stop the output engine */
++	reg_write_field(dev, UNICAM_CTRL, 1, UNICAM_SOE);
++
++	/* Disable the data lanes. */
++	reg_write(dev, UNICAM_DAT0, 0);
++	reg_write(dev, UNICAM_DAT1, 0);
++
++	if (dev->max_data_lanes > 2) {
++		reg_write(dev, UNICAM_DAT2, 0);
++		reg_write(dev, UNICAM_DAT3, 0);
++	}
++
++	/* Peripheral reset */
++	reg_write_field(dev, UNICAM_CTRL, 1, UNICAM_CPR);
++	usleep_range(50, 100);
++	reg_write_field(dev, UNICAM_CTRL, 0, UNICAM_CPR);
++
++	/* Disable peripheral */
++	reg_write_field(dev, UNICAM_CTRL, 0, UNICAM_CPE);
++
++	/* Clear ED setup */
++	reg_write(dev, UNICAM_DCS, 0);
++
++	/* Disable all lane clocks */
++	clk_write(dev, 0);
++}
++
++static void unicam_return_buffers(struct unicam_node *node)
++{
++	struct unicam_buffer *buf, *tmp;
++	unsigned long flags;
++
++	spin_lock_irqsave(&node->dma_queue_lock, flags);
++	list_for_each_entry_safe(buf, tmp, &node->dma_queue, list) {
++		list_del(&buf->list);
++		vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
++	}
++
++	if (node->cur_frm)
++		vb2_buffer_done(&node->cur_frm->vb.vb2_buf,
++				VB2_BUF_STATE_ERROR);
++	if (node->next_frm && node->cur_frm != node->next_frm)
++		vb2_buffer_done(&node->next_frm->vb.vb2_buf,
++				VB2_BUF_STATE_ERROR);
++
++	node->cur_frm = NULL;
++	node->next_frm = NULL;
++	spin_unlock_irqrestore(&node->dma_queue_lock, flags);
++}
++
++static int unicam_start_streaming(struct vb2_queue *vq, unsigned int count)
++{
++	struct unicam_node *node = vb2_get_drv_priv(vq);
++	struct unicam_device *dev = node->dev;
++	dma_addr_t buffer_addr[MAX_NODES] = { 0 };
++	unsigned long flags;
++	unsigned int i;
++	int ret;
++
++	node->streaming = true;
++	if (!unicam_all_nodes_streaming(dev)) {
++		unicam_dbg(3, dev, "Not all nodes are streaming yet.");
++		return 0;
++	}
++
++	dev->sequence = 0;
++	ret = unicam_runtime_get(dev);
++	if (ret < 0) {
++		unicam_dbg(3, dev, "unicam_runtime_get failed\n");
++		goto err_streaming;
++	}
++
++	/*
++	 * TODO: Retrieve the number of active data lanes from the connected
++	 * subdevice.
++	 */
++	dev->active_data_lanes = dev->max_data_lanes;
++
++	ret = clk_set_rate(dev->clock, 100 * 1000 * 1000);
++	if (ret) {
++		unicam_err(dev, "failed to set up clock\n");
++		goto err_pm_put;
++	}
++
++	ret = clk_prepare_enable(dev->clock);
++	if (ret) {
++		unicam_err(dev, "Failed to enable CSI clock: %d\n", ret);
++		goto err_pm_put;
++	}
++
++	for (i = 0; i < ARRAY_SIZE(dev->node); i++) {
++		struct unicam_buffer *buf;
++
++		if (!dev->node[i].streaming)
++			continue;
++
++		spin_lock_irqsave(&dev->node[i].dma_queue_lock, flags);
++		buf = list_first_entry(&dev->node[i].dma_queue,
++				       struct unicam_buffer, list);
++		dev->node[i].cur_frm = buf;
++		dev->node[i].next_frm = buf;
++		list_del(&buf->list);
++		spin_unlock_irqrestore(&dev->node[i].dma_queue_lock, flags);
++
++		buffer_addr[i] =
++			vb2_dma_contig_plane_dma_addr(&buf->vb.vb2_buf, 0);
++	}
++
++	unicam_start_rx(dev, buffer_addr);
++
++	ret = v4l2_subdev_call(dev->sensor, video, s_stream, 1);
++	if (ret < 0) {
++		unicam_err(dev, "stream on failed in subdev\n");
++		goto err_disable_unicam;
++	}
++
++	return 0;
++
++err_disable_unicam:
++	unicam_disable(dev);
++	clk_disable_unprepare(dev->clock);
++err_pm_put:
++	unicam_runtime_put(dev);
++err_streaming:
++	unicam_return_buffers(node);
++	node->streaming = false;
++
++	return ret;
++}
++
++static void unicam_stop_streaming(struct vb2_queue *vq)
++{
++	struct unicam_node *node = vb2_get_drv_priv(vq);
++	struct unicam_device *dev = node->dev;
++
++	node->streaming = false;
++
++	if (node->pad_id == IMAGE_PAD) {
++		/*
++		 * Stop streaming the sensor and disable the peripheral.
++		 * We cannot continue streaming embedded data with the
++		 * image pad disabled.
++		 */
++		if (v4l2_subdev_call(dev->sensor, video, s_stream, 0) < 0)
++			unicam_err(dev, "stream off failed in subdev\n");
++
++		unicam_disable(dev);
++		clk_disable_unprepare(dev->clock);
++		unicam_runtime_put(dev);
++
++	} else if (node->pad_id == METADATA_PAD) {
++		/*
++		 * Allow the hardware to spin in the dummy buffer.
++		 * This is only really needed if the embedded data pad is
++		 * disabled before the image pad.
++		 */
++		unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr,
++				   DUMMY_BUF_SIZE, METADATA_PAD);
++	}
++
++	/* Clear all queued buffers for the node */
++	unicam_return_buffers(node);
++}
++
++static int unicam_enum_input(struct file *file, void *priv,
++			     struct v4l2_input *inp)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	if (inp->index != 0)
++		return -EINVAL;
++
++	inp->type = V4L2_INPUT_TYPE_CAMERA;
++	if (v4l2_subdev_has_op(dev->sensor, video, s_dv_timings)) {
++		inp->capabilities = V4L2_IN_CAP_DV_TIMINGS;
++		inp->std = 0;
++	} else if (v4l2_subdev_has_op(dev->sensor, video, s_std)) {
++		inp->capabilities = V4L2_IN_CAP_STD;
++		if (v4l2_subdev_call(dev->sensor, video, g_tvnorms, &inp->std)
++					< 0)
++			inp->std = V4L2_STD_ALL;
++	} else {
++		inp->capabilities = 0;
++		inp->std = 0;
++	}
++	sprintf(inp->name, "Camera 0");
++	return 0;
++}
++
++static int unicam_g_input(struct file *file, void *priv, unsigned int *i)
++{
++	*i = 0;
++
++	return 0;
++}
++
++static int unicam_s_input(struct file *file, void *priv, unsigned int i)
++{
++	/*
++	 * FIXME: Ideally we would like to be able to query the source
++	 * subdevice for information over the input connectors it supports,
++	 * and map that through in to a call to video_ops->s_routing.
++	 * There is no infrastructure support for defining that within
++	 * devicetree at present. Until that is implemented we can't
++	 * map a user physical connector number to s_routing input number.
++	 */
++	if (i > 0)
++		return -EINVAL;
++
++	return 0;
++}
++
++static int unicam_querystd(struct file *file, void *priv,
++			   v4l2_std_id *std)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, video, querystd, std);
++}
++
++static int unicam_g_std(struct file *file, void *priv, v4l2_std_id *std)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, video, g_std, std);
++}
++
++static int unicam_s_std(struct file *file, void *priv, v4l2_std_id std)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	int ret;
++	v4l2_std_id current_std;
++
++	ret = v4l2_subdev_call(dev->sensor, video, g_std, &current_std);
++	if (ret)
++		return ret;
++
++	if (std == current_std)
++		return 0;
++
++	if (vb2_is_busy(&node->buffer_queue))
++		return -EBUSY;
++
++	ret = v4l2_subdev_call(dev->sensor, video, s_std, std);
++
++	/* Force recomputation of bytesperline */
++	node->v_fmt.fmt.pix.bytesperline = 0;
++
++	unicam_reset_format(node);
++
++	return ret;
++}
++
++static int unicam_s_edid(struct file *file, void *priv, struct v4l2_edid *edid)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, pad, set_edid, edid);
++}
++
++static int unicam_g_edid(struct file *file, void *priv, struct v4l2_edid *edid)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, pad, get_edid, edid);
++}
++
++static int unicam_s_selection(struct file *file, void *priv,
++			      struct v4l2_selection *sel)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	struct v4l2_subdev_selection sdsel = {
++		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++		.target = sel->target,
++		.flags = sel->flags,
++		.r = sel->r,
++	};
++
++	return v4l2_subdev_call(dev->sensor, pad, set_selection, NULL, &sdsel);
++}
++
++static int unicam_g_selection(struct file *file, void *priv,
++			      struct v4l2_selection *sel)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	struct v4l2_subdev_selection sdsel = {
++		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++		.target = sel->target,
++	};
++	int ret;
++
++	ret = v4l2_subdev_call(dev->sensor, pad, get_selection, NULL, &sdsel);
++	if (!ret)
++		sel->r = sdsel.r;
++
++	return ret;
++}
++
++static int unicam_enum_framesizes(struct file *file, void *priv,
++				  struct v4l2_frmsizeenum *fsize)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	const struct unicam_fmt *fmt;
++	struct v4l2_subdev_frame_size_enum fse;
++	int ret;
++
++	/* check for valid format */
++	fmt = find_format_by_pix(dev, fsize->pixel_format);
++	if (!fmt) {
++		unicam_dbg(3, dev, "Invalid pixel code: %x\n",
++			   fsize->pixel_format);
++		return -EINVAL;
++	}
++	fse.code = fmt->code;
++
++	fse.which = V4L2_SUBDEV_FORMAT_ACTIVE;
++	fse.index = fsize->index;
++	fse.pad = node->pad_id;
++
++	ret = v4l2_subdev_call(dev->sensor, pad, enum_frame_size, NULL, &fse);
++	if (ret)
++		return ret;
++
++	unicam_dbg(1, dev, "%s: index: %d code: %x W:[%d,%d] H:[%d,%d]\n",
++		   __func__, fse.index, fse.code, fse.min_width, fse.max_width,
++		   fse.min_height, fse.max_height);
++
++	fsize->type = V4L2_FRMSIZE_TYPE_DISCRETE;
++	fsize->discrete.width = fse.max_width;
++	fsize->discrete.height = fse.max_height;
++
++	return 0;
++}
++
++static int unicam_enum_frameintervals(struct file *file, void *priv,
++				      struct v4l2_frmivalenum *fival)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	const struct unicam_fmt *fmt;
++	struct v4l2_subdev_frame_interval_enum fie = {
++		.index = fival->index,
++		.width = fival->width,
++		.height = fival->height,
++		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++	};
++	int ret;
++
++	fmt = find_format_by_pix(dev, fival->pixel_format);
++	if (!fmt)
++		return -EINVAL;
++
++	fie.code = fmt->code;
++	ret = v4l2_subdev_call(dev->sensor, pad, enum_frame_interval,
++			       NULL, &fie);
++	if (ret)
++		return ret;
++
++	fival->type = V4L2_FRMIVAL_TYPE_DISCRETE;
++	fival->discrete = fie.interval;
++
++	return 0;
++}
++
++static int unicam_g_parm(struct file *file, void *fh, struct v4l2_streamparm *a)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_g_parm_cap(video_devdata(file), dev->sensor, a);
++}
++
++static int unicam_s_parm(struct file *file, void *fh, struct v4l2_streamparm *a)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_s_parm_cap(video_devdata(file), dev->sensor, a);
++}
++
++static int unicam_g_dv_timings(struct file *file, void *priv,
++			       struct v4l2_dv_timings *timings)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, video, g_dv_timings, timings);
++}
++
++static int unicam_s_dv_timings(struct file *file, void *priv,
++			       struct v4l2_dv_timings *timings)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	struct v4l2_dv_timings current_timings;
++	int ret;
++
++	ret = v4l2_subdev_call(dev->sensor, video, g_dv_timings,
++			       &current_timings);
++
++	if (v4l2_match_dv_timings(timings, &current_timings, 0, false))
++		return 0;
++
++	if (vb2_is_busy(&node->buffer_queue))
++		return -EBUSY;
++
++	ret = v4l2_subdev_call(dev->sensor, video, s_dv_timings, timings);
++
++	/* Force recomputation of bytesperline */
++	node->v_fmt.fmt.pix.bytesperline = 0;
++
++	unicam_reset_format(node);
++
++	return ret;
++}
++
++static int unicam_query_dv_timings(struct file *file, void *priv,
++				   struct v4l2_dv_timings *timings)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, video, query_dv_timings, timings);
++}
++
++static int unicam_enum_dv_timings(struct file *file, void *priv,
++				  struct v4l2_enum_dv_timings *timings)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, pad, enum_dv_timings, timings);
++}
++
++static int unicam_dv_timings_cap(struct file *file, void *priv,
++				 struct v4l2_dv_timings_cap *cap)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, pad, dv_timings_cap, cap);
++}
++
++static int unicam_subscribe_event(struct v4l2_fh *fh,
++				  const struct v4l2_event_subscription *sub)
++{
++	switch (sub->type) {
++	case V4L2_EVENT_FRAME_SYNC:
++		return v4l2_event_subscribe(fh, sub, 2, NULL);
++	case V4L2_EVENT_SOURCE_CHANGE:
++		return v4l2_event_subscribe(fh, sub, 4, NULL);
++	}
++
++	return v4l2_ctrl_subscribe_event(fh, sub);
++}
++
++static int unicam_log_status(struct file *file, void *fh)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	u32 reg;
++
++	/* status for sub devices */
++	v4l2_device_call_all(&dev->v4l2_dev, 0, core, log_status);
++
++	unicam_info(dev, "-----Receiver status-----\n");
++	unicam_info(dev, "V4L2 width/height:   %ux%u\n",
++		    node->v_fmt.fmt.pix.width, node->v_fmt.fmt.pix.height);
++	unicam_info(dev, "Mediabus format:     %08x\n", node->fmt->code);
++	unicam_info(dev, "V4L2 format:         %08x\n",
++		    node->v_fmt.fmt.pix.pixelformat);
++	reg = reg_read(dev, UNICAM_IPIPE);
++	unicam_info(dev, "Unpacking/packing:   %u / %u\n",
++		    get_field(reg, UNICAM_PUM_MASK),
++		    get_field(reg, UNICAM_PPM_MASK));
++	unicam_info(dev, "----Live data----\n");
++	unicam_info(dev, "Programmed stride:   %4u\n",
++		    reg_read(dev, UNICAM_IBLS));
++	unicam_info(dev, "Detected resolution: %ux%u\n",
++		    reg_read(dev, UNICAM_IHSTA),
++		    reg_read(dev, UNICAM_IVSTA));
++	unicam_info(dev, "Write pointer:       %08x\n",
++		    reg_read(dev, UNICAM_IBWP));
++
++	return 0;
++}
++
++static void unicam_notify(struct v4l2_subdev *sd,
++			  unsigned int notification, void *arg)
++{
++	struct unicam_device *dev = to_unicam_device(sd->v4l2_dev);
++
++	switch (notification) {
++	case V4L2_DEVICE_NOTIFY_EVENT:
++		v4l2_event_queue(&dev->node[IMAGE_PAD].video_dev, arg);
++		break;
++	default:
++		break;
++	}
++}
++
++static const struct vb2_ops unicam_video_qops = {
++	.wait_prepare		= vb2_ops_wait_prepare,
++	.wait_finish		= vb2_ops_wait_finish,
++	.queue_setup		= unicam_queue_setup,
++	.buf_prepare		= unicam_buffer_prepare,
++	.buf_queue		= unicam_buffer_queue,
++	.start_streaming	= unicam_start_streaming,
++	.stop_streaming		= unicam_stop_streaming,
++};
++
++/*
++ * unicam_v4l2_open : This function is based on the v4l2_fh_open helper
++ * function. It has been augmented to handle sensor subdevice power management,
++ */
++static int unicam_v4l2_open(struct file *file)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	int ret;
++
++	mutex_lock(&node->lock);
++
++	ret = v4l2_fh_open(file);
++	if (ret) {
++		unicam_err(dev, "v4l2_fh_open failed\n");
++		goto unlock;
++	}
++
++	node->open++;
++
++	if (!v4l2_fh_is_singular_file(file))
++		goto unlock;
++
++	ret = v4l2_subdev_call(dev->sensor, core, s_power, 1);
++	if (ret < 0 && ret != -ENOIOCTLCMD) {
++		v4l2_fh_release(file);
++		node->open--;
++		goto unlock;
++	}
++
++	ret = 0;
++
++unlock:
++	mutex_unlock(&node->lock);
++	return ret;
++}
++
++static int unicam_v4l2_release(struct file *file)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	struct v4l2_subdev *sd = dev->sensor;
++	bool fh_singular;
++	int ret;
++
++	mutex_lock(&node->lock);
++
++	fh_singular = v4l2_fh_is_singular_file(file);
++
++	ret = _vb2_fop_release(file, NULL);
++
++	if (fh_singular)
++		v4l2_subdev_call(sd, core, s_power, 0);
++
++	node->open--;
++	mutex_unlock(&node->lock);
++
++	return ret;
++}
++
++/* unicam capture driver file operations */
++static const struct v4l2_file_operations unicam_fops = {
++	.owner		= THIS_MODULE,
++	.open		= unicam_v4l2_open,
++	.release	= unicam_v4l2_release,
++	.read		= vb2_fop_read,
++	.poll		= vb2_fop_poll,
++	.unlocked_ioctl	= video_ioctl2,
++	.mmap		= vb2_fop_mmap,
++};
++
++/* unicam capture ioctl operations */
++static const struct v4l2_ioctl_ops unicam_ioctl_ops = {
++	.vidioc_querycap		= unicam_querycap,
++	.vidioc_enum_fmt_vid_cap	= unicam_enum_fmt_vid_cap,
++	.vidioc_g_fmt_vid_cap		= unicam_g_fmt_vid_cap,
++	.vidioc_s_fmt_vid_cap		= unicam_s_fmt_vid_cap,
++	.vidioc_try_fmt_vid_cap		= unicam_try_fmt_vid_cap,
++
++	.vidioc_enum_fmt_meta_cap	= unicam_enum_fmt_meta_cap,
++	.vidioc_g_fmt_meta_cap		= unicam_g_fmt_meta_cap,
++	.vidioc_s_fmt_meta_cap		= unicam_g_fmt_meta_cap,
++	.vidioc_try_fmt_meta_cap	= unicam_g_fmt_meta_cap,
++
++	.vidioc_enum_input		= unicam_enum_input,
++	.vidioc_g_input			= unicam_g_input,
++	.vidioc_s_input			= unicam_s_input,
++
++	.vidioc_querystd		= unicam_querystd,
++	.vidioc_s_std			= unicam_s_std,
++	.vidioc_g_std			= unicam_g_std,
++
++	.vidioc_g_edid			= unicam_g_edid,
++	.vidioc_s_edid			= unicam_s_edid,
++
++	.vidioc_enum_framesizes		= unicam_enum_framesizes,
++	.vidioc_enum_frameintervals	= unicam_enum_frameintervals,
++
++	.vidioc_g_selection		= unicam_g_selection,
++	.vidioc_s_selection		= unicam_s_selection,
++
++	.vidioc_g_parm			= unicam_g_parm,
++	.vidioc_s_parm			= unicam_s_parm,
++
++	.vidioc_s_dv_timings		= unicam_s_dv_timings,
++	.vidioc_g_dv_timings		= unicam_g_dv_timings,
++	.vidioc_query_dv_timings	= unicam_query_dv_timings,
++	.vidioc_enum_dv_timings		= unicam_enum_dv_timings,
++	.vidioc_dv_timings_cap		= unicam_dv_timings_cap,
++
++	.vidioc_reqbufs			= vb2_ioctl_reqbufs,
++	.vidioc_create_bufs		= vb2_ioctl_create_bufs,
++	.vidioc_prepare_buf		= vb2_ioctl_prepare_buf,
++	.vidioc_querybuf		= vb2_ioctl_querybuf,
++	.vidioc_qbuf			= vb2_ioctl_qbuf,
++	.vidioc_dqbuf			= vb2_ioctl_dqbuf,
++	.vidioc_expbuf			= vb2_ioctl_expbuf,
++	.vidioc_streamon		= vb2_ioctl_streamon,
++	.vidioc_streamoff		= vb2_ioctl_streamoff,
++
++	.vidioc_log_status		= unicam_log_status,
++	.vidioc_subscribe_event		= unicam_subscribe_event,
++	.vidioc_unsubscribe_event	= v4l2_event_unsubscribe,
++};
++
++static int
++unicam_async_bound(struct v4l2_async_notifier *notifier,
++		   struct v4l2_subdev *subdev,
++		   struct v4l2_async_subdev *asd)
++{
++	struct unicam_device *unicam = to_unicam_device(notifier->v4l2_dev);
++
++	if (unicam->sensor) {
++		unicam_info(unicam, "Rejecting subdev %s (Already set!!)",
++			    subdev->name);
++		return 0;
++	}
++
++	unicam->sensor = subdev;
++	unicam_dbg(1, unicam, "Using sensor %s for capture\n", subdev->name);
++
++	return 0;
++}
++
++static void unicam_release(struct kref *kref)
++{
++	struct unicam_device *unicam =
++		container_of(kref, struct unicam_device, kref);
++
++	v4l2_ctrl_handler_free(&unicam->ctrl_handler);
++	media_device_cleanup(&unicam->mdev);
++
++	if (unicam->sensor_config)
++		v4l2_subdev_free_pad_config(unicam->sensor_config);
++
++	kfree(unicam);
++}
++
++static void unicam_put(struct unicam_device *unicam)
++{
++	kref_put(&unicam->kref, unicam_release);
++}
++
++static void unicam_get(struct unicam_device *unicam)
++{
++	kref_get(&unicam->kref);
++}
++
++static void unicam_node_release(struct video_device *vdev)
++{
++	struct unicam_node *node = video_get_drvdata(vdev);
++
++	unicam_put(node->dev);
++}
++
++static int register_node(struct unicam_device *unicam, struct unicam_node *node,
++			 enum v4l2_buf_type type, int pad_id)
++{
++	struct video_device *vdev;
++	struct vb2_queue *q;
++	struct v4l2_mbus_framefmt mbus_fmt = {0};
++	const struct unicam_fmt *fmt;
++	int ret;
++
++	if (pad_id == IMAGE_PAD) {
++		ret = __subdev_get_format(unicam, &mbus_fmt, pad_id);
++		if (ret) {
++			unicam_err(unicam, "Failed to get_format - ret %d\n",
++				   ret);
++			return ret;
++		}
++
++		fmt = find_format_by_code(mbus_fmt.code);
++		if (!fmt) {
++			/*
++			 * Find the first format that the sensor and unicam both
++			 * support
++			 */
++			fmt = get_first_supported_format(unicam);
++
++			if (!fmt)
++				/* No compatible formats */
++				return -EINVAL;
++
++			mbus_fmt.code = fmt->code;
++			ret = __subdev_set_format(unicam, &mbus_fmt, pad_id);
++			if (ret)
++				return -EINVAL;
++		}
++		if (mbus_fmt.field != V4L2_FIELD_NONE) {
++			/* Interlaced not supported - disable it now. */
++			mbus_fmt.field = V4L2_FIELD_NONE;
++			ret = __subdev_set_format(unicam, &mbus_fmt, pad_id);
++			if (ret)
++				return -EINVAL;
++		}
++
++		node->v_fmt.fmt.pix.pixelformat = fmt->fourcc ? fmt->fourcc
++						: fmt->repacked_fourcc;
++	} else {
++		/* Fix this node format as embedded data. */
++		fmt = find_format_by_code(MEDIA_BUS_FMT_SENSOR_DATA);
++		node->v_fmt.fmt.meta.dataformat = fmt->fourcc;
++	}
++
++	node->dev = unicam;
++	node->pad_id = pad_id;
++	node->fmt = fmt;
++
++	/* Read current subdev format */
++	unicam_reset_format(node);
++
++	if (v4l2_subdev_has_op(unicam->sensor, video, s_std)) {
++		v4l2_std_id tvnorms;
++
++		if (WARN_ON(!v4l2_subdev_has_op(unicam->sensor, video,
++						g_tvnorms)))
++			/*
++			 * Subdevice should not advertise s_std but not
++			 * g_tvnorms
++			 */
++			return -EINVAL;
++
++		ret = v4l2_subdev_call(unicam->sensor, video,
++				       g_tvnorms, &tvnorms);
++		if (WARN_ON(ret))
++			return -EINVAL;
++		node->video_dev.tvnorms |= tvnorms;
++	}
++
++	spin_lock_init(&node->dma_queue_lock);
++	mutex_init(&node->lock);
++
++	vdev = &node->video_dev;
++	if (pad_id == IMAGE_PAD) {
++		/* Add controls from the subdevice */
++		ret = v4l2_ctrl_add_handler(&unicam->ctrl_handler,
++					    unicam->sensor->ctrl_handler, NULL,
++					    true);
++		if (ret < 0)
++			return ret;
++
++		/*
++		 * If the sensor subdevice has any controls, associate the node
++		 *  with the ctrl handler to allow access from userland.
++		 */
++		if (!list_empty(&unicam->ctrl_handler.ctrls))
++			vdev->ctrl_handler = &unicam->ctrl_handler;
++	}
++
++	q = &node->buffer_queue;
++	q->type = type;
++	q->io_modes = VB2_MMAP | VB2_DMABUF | VB2_READ;
++	q->drv_priv = node;
++	q->ops = &unicam_video_qops;
++	q->mem_ops = &vb2_dma_contig_memops;
++	q->buf_struct_size = sizeof(struct unicam_buffer);
++	q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
++	q->lock = &node->lock;
++	q->min_buffers_needed = 2;
++	q->dev = &unicam->pdev->dev;
++
++	ret = vb2_queue_init(q);
++	if (ret) {
++		unicam_err(unicam, "vb2_queue_init() failed\n");
++		return ret;
++	}
++
++	INIT_LIST_HEAD(&node->dma_queue);
++
++	vdev->release = unicam_node_release;
++	vdev->fops = &unicam_fops;
++	vdev->ioctl_ops = &unicam_ioctl_ops;
++	vdev->v4l2_dev = &unicam->v4l2_dev;
++	vdev->vfl_dir = VFL_DIR_RX;
++	vdev->queue = q;
++	vdev->lock = &node->lock;
++	vdev->device_caps = (pad_id == IMAGE_PAD) ?
++			    (V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING) :
++			    (V4L2_CAP_META_CAPTURE | V4L2_CAP_STREAMING);
++
++	/* Define the device names */
++	snprintf(vdev->name, sizeof(vdev->name), "%s-%s", UNICAM_MODULE_NAME,
++		 pad_id == IMAGE_PAD ? "image" : "embedded");
++
++	video_set_drvdata(vdev, node);
++	if (pad_id == IMAGE_PAD)
++		vdev->entity.flags |= MEDIA_ENT_FL_DEFAULT;
++	node->pad.flags = MEDIA_PAD_FL_SINK;
++	media_entity_pads_init(&vdev->entity, 1, &node->pad);
++
++	node->dummy_buf_cpu_addr = dma_alloc_coherent(&unicam->pdev->dev,
++						      DUMMY_BUF_SIZE,
++						      &node->dummy_buf_dma_addr,
++						      GFP_KERNEL);
++	if (!node->dummy_buf_cpu_addr) {
++		unicam_err(unicam, "Unable to allocate dummy buffer.\n");
++		return -ENOMEM;
++	}
++
++	if (pad_id == METADATA_PAD) {
++		v4l2_disable_ioctl(vdev, VIDIOC_DQEVENT);
++		v4l2_disable_ioctl(vdev, VIDIOC_SUBSCRIBE_EVENT);
++		v4l2_disable_ioctl(vdev, VIDIOC_UNSUBSCRIBE_EVENT);
++	}
++	if (pad_id == METADATA_PAD ||
++	    !v4l2_subdev_has_op(unicam->sensor, video, s_std)) {
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_STD);
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_STD);
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_ENUMSTD);
++	}
++	if (pad_id == METADATA_PAD ||
++	    !v4l2_subdev_has_op(unicam->sensor, video, querystd))
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_QUERYSTD);
++	if (pad_id == METADATA_PAD ||
++	    !v4l2_subdev_has_op(unicam->sensor, video, s_dv_timings)) {
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_EDID);
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_EDID);
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_DV_TIMINGS_CAP);
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_DV_TIMINGS);
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_DV_TIMINGS);
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_ENUM_DV_TIMINGS);
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_QUERY_DV_TIMINGS);
++	}
++	if (pad_id == METADATA_PAD ||
++	    !v4l2_subdev_has_op(unicam->sensor, pad, enum_frame_interval))
++		v4l2_disable_ioctl(&node->video_dev,
++				   VIDIOC_ENUM_FRAMEINTERVALS);
++	if (pad_id == METADATA_PAD ||
++	    !v4l2_subdev_has_op(unicam->sensor, video, g_frame_interval))
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_PARM);
++	if (pad_id == METADATA_PAD ||
++	    !v4l2_subdev_has_op(unicam->sensor, video, s_frame_interval))
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_PARM);
++
++	if (pad_id == METADATA_PAD ||
++	    !v4l2_subdev_has_op(unicam->sensor, pad, enum_frame_size))
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_ENUM_FRAMESIZES);
++
++	if (node->pad_id == METADATA_PAD ||
++	    !v4l2_subdev_has_op(unicam->sensor, pad, set_selection))
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_SELECTION);
++
++	if (node->pad_id == METADATA_PAD ||
++	    !v4l2_subdev_has_op(unicam->sensor, pad, get_selection))
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_SELECTION);
++
++	ret = video_register_device(vdev, VFL_TYPE_VIDEO, -1);
++	if (ret) {
++		unicam_err(unicam, "Unable to register video device %s\n",
++			   vdev->name);
++		return ret;
++	}
++
++	/*
++	 * Acquire a reference to unicam, which will be released when the video
++	 * device will be unregistered and userspace will have closed all open
++	 * file handles.
++	 */
++	unicam_get(unicam);
++	node->registered = true;
++
++	if (pad_id != METADATA_PAD || unicam->sensor_embedded_data) {
++		ret = media_create_pad_link(&unicam->sensor->entity, pad_id,
++					    &node->video_dev.entity, 0,
++					    MEDIA_LNK_FL_ENABLED |
++					    MEDIA_LNK_FL_IMMUTABLE);
++		if (ret)
++			unicam_err(unicam, "Unable to create pad link for %s\n",
++				   vdev->name);
++	}
++
++	return ret;
++}
++
++static void unregister_nodes(struct unicam_device *unicam)
++{
++	unsigned int i;
++
++	for (i = 0; i < ARRAY_SIZE(unicam->node); i++) {
++		struct unicam_node *node = &unicam->node[i];
++
++		if (node->dummy_buf_cpu_addr) {
++			dma_free_coherent(&unicam->pdev->dev, DUMMY_BUF_SIZE,
++					  node->dummy_buf_cpu_addr,
++					  node->dummy_buf_dma_addr);
++		}
++
++		if (node->registered) {
++			node->registered = false;
++			video_unregister_device(&node->video_dev);
++		}
++	}
++}
++
++static int unicam_probe_complete(struct unicam_device *unicam)
++{
++	int ret;
++
++	unicam->v4l2_dev.notify = unicam_notify;
++
++	unicam->sensor_config = v4l2_subdev_alloc_pad_config(unicam->sensor);
++	if (!unicam->sensor_config)
++		return -ENOMEM;
++
++	unicam->sensor_embedded_data = (unicam->sensor->entity.num_pads >= 2);
++
++	ret = register_node(unicam, &unicam->node[IMAGE_PAD],
++			    V4L2_BUF_TYPE_VIDEO_CAPTURE, IMAGE_PAD);
++	if (ret) {
++		unicam_err(unicam, "Unable to register image video device.\n");
++		goto unregister;
++	}
++
++	ret = register_node(unicam, &unicam->node[METADATA_PAD],
++			    V4L2_BUF_TYPE_META_CAPTURE, METADATA_PAD);
++	if (ret) {
++		unicam_err(unicam, "Unable to register metadata video device.\n");
++		goto unregister;
++	}
++
++	ret = v4l2_device_register_ro_subdev_nodes(&unicam->v4l2_dev);
++	if (ret) {
++		unicam_err(unicam, "Unable to register subdev nodes.\n");
++		goto unregister;
++	}
++
++	/*
++	 * Release the initial reference, all references are now owned by the
++	 * video devices.
++	 */
++	unicam_put(unicam);
++	return 0;
++
++unregister:
++	unregister_nodes(unicam);
++	unicam_put(unicam);
++
++	return ret;
++}
++
++static int unicam_async_complete(struct v4l2_async_notifier *notifier)
++{
++	struct unicam_device *unicam = to_unicam_device(notifier->v4l2_dev);
++
++	return unicam_probe_complete(unicam);
++}
++
++static const struct v4l2_async_notifier_operations unicam_async_ops = {
++	.bound = unicam_async_bound,
++	.complete = unicam_async_complete,
++};
++
++static int of_unicam_connect_subdevs(struct unicam_device *dev)
++{
++	struct platform_device *pdev = dev->pdev;
++	struct v4l2_fwnode_endpoint ep = { 0 };
++	struct device_node *ep_node;
++	struct device_node *sensor_node;
++	unsigned int lane;
++	int ret = -EINVAL;
++
++	if (of_property_read_u32(pdev->dev.of_node, "brcm,num-data-lanes",
++				 &dev->max_data_lanes) < 0) {
++		unicam_err(dev, "number of data lanes not set\n");
++		return -EINVAL;
++	}
++
++	/* Get the local endpoint and remote device. */
++	ep_node = of_graph_get_next_endpoint(pdev->dev.of_node, NULL);
++	if (!ep_node) {
++		unicam_dbg(3, dev, "can't get next endpoint\n");
++		return -EINVAL;
++	}
++
++	unicam_dbg(3, dev, "ep_node is %pOF\n", ep_node);
++
++	sensor_node = of_graph_get_remote_port_parent(ep_node);
++	if (!sensor_node) {
++		unicam_dbg(3, dev, "can't get remote parent\n");
++		goto cleanup_exit;
++	}
++
++	unicam_dbg(1, dev, "found subdevice %pOF\n", sensor_node);
++
++	/* Parse the local endpoint and validate its configuration. */
++	v4l2_fwnode_endpoint_parse(of_fwnode_handle(ep_node), &ep);
++
++	unicam_dbg(3, dev, "parsed local endpoint, bus_type %u\n",
++		   ep.bus_type);
++
++	dev->bus_type = ep.bus_type;
++
++	switch (ep.bus_type) {
++	case V4L2_MBUS_CSI2_DPHY:
++		switch (ep.bus.mipi_csi2.num_data_lanes) {
++		case 1:
++		case 2:
++		case 4:
++			break;
++
++		default:
++			unicam_err(dev, "subdevice %pOF: %u data lanes not supported\n",
++				   sensor_node,
++				   ep.bus.mipi_csi2.num_data_lanes);
++			goto cleanup_exit;
++		}
++
++		for (lane = 0; lane < ep.bus.mipi_csi2.num_data_lanes; lane++) {
++			if (ep.bus.mipi_csi2.data_lanes[lane] != lane + 1) {
++				unicam_err(dev, "subdevice %pOF: data lanes reordering not supported\n",
++					   sensor_node);
++				goto cleanup_exit;
++			}
++		}
++
++		if (ep.bus.mipi_csi2.num_data_lanes > dev->max_data_lanes) {
++			unicam_err(dev, "subdevice requires %u data lanes when %u are supported\n",
++				   ep.bus.mipi_csi2.num_data_lanes,
++				   dev->max_data_lanes);
++		}
++
++		dev->max_data_lanes = ep.bus.mipi_csi2.num_data_lanes;
++		dev->bus_flags = ep.bus.mipi_csi2.flags;
++
++		break;
++
++	case V4L2_MBUS_CCP2:
++		if (ep.bus.mipi_csi1.clock_lane != 0 ||
++		    ep.bus.mipi_csi1.data_lane != 1) {
++			unicam_err(dev, "subdevice %pOF: unsupported lanes configuration\n",
++				   sensor_node);
++			goto cleanup_exit;
++		}
++
++		dev->max_data_lanes = 1;
++		dev->bus_flags = ep.bus.mipi_csi1.strobe;
++		break;
++
++	default:
++		/* Unsupported bus type */
++		unicam_err(dev, "subdevice %pOF: unsupported bus type %u\n",
++			   sensor_node, ep.bus_type);
++		goto cleanup_exit;
++	}
++
++	unicam_dbg(3, dev, "subdevice %pOF: %s bus, %u data lanes, flags=0x%08x\n",
++		   sensor_node,
++		   dev->bus_type == V4L2_MBUS_CSI2_DPHY ? "CSI-2" : "CCP2",
++		   dev->max_data_lanes, dev->bus_flags);
++
++	/* Initialize and register the async notifier. */
++	v4l2_async_nf_init(&dev->notifier);
++	dev->notifier.ops = &unicam_async_ops;
++
++	dev->asd.match_type = V4L2_ASYNC_MATCH_FWNODE;
++	dev->asd.match.fwnode = of_fwnode_handle(sensor_node);
++	ret = __v4l2_async_nf_add_subdev(&dev->notifier, &dev->asd);
++	if (ret) {
++		unicam_err(dev, "Error adding subdevice: %d\n", ret);
++		goto cleanup_exit;
++	}
++
++	ret = v4l2_async_nf_register(&dev->v4l2_dev, &dev->notifier);
++	if (ret) {
++		unicam_err(dev, "Error registering async notifier: %d\n", ret);
++		ret = -EINVAL;
++	}
++
++cleanup_exit:
++	of_node_put(sensor_node);
++	of_node_put(ep_node);
++
++	return ret;
++}
++
++static int unicam_probe(struct platform_device *pdev)
++{
++	struct unicam_device *unicam;
++	int ret;
++
++	unicam = kzalloc(sizeof(*unicam), GFP_KERNEL);
++	if (!unicam)
++		return -ENOMEM;
++
++	kref_init(&unicam->kref);
++	unicam->pdev = pdev;
++
++	unicam->base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(unicam->base)) {
++		unicam_err(unicam, "Failed to get main io block\n");
++		ret = PTR_ERR(unicam->base);
++		goto err_unicam_put;
++	}
++
++	unicam->clk_gate_base = devm_platform_ioremap_resource(pdev, 1);
++	if (IS_ERR(unicam->clk_gate_base)) {
++		unicam_err(unicam, "Failed to get 2nd io block\n");
++		ret = PTR_ERR(unicam->clk_gate_base);
++		goto err_unicam_put;
++	}
++
++	unicam->clock = devm_clk_get(&pdev->dev, "lp");
++	if (IS_ERR(unicam->clock)) {
++		unicam_err(unicam, "Failed to get clock\n");
++		ret = PTR_ERR(unicam->clock);
++		goto err_unicam_put;
++	}
++
++	ret = platform_get_irq(pdev, 0);
++	if (ret <= 0) {
++		dev_err(&pdev->dev, "No IRQ resource\n");
++		ret = -EINVAL;
++		goto err_unicam_put;
++	}
++
++	ret = devm_request_irq(&pdev->dev, ret, unicam_isr, 0,
++			       "unicam_capture0", unicam);
++	if (ret) {
++		dev_err(&pdev->dev, "Unable to request interrupt\n");
++		ret = -EINVAL;
++		goto err_unicam_put;
++	}
++
++	unicam->mdev.dev = &pdev->dev;
++	strscpy(unicam->mdev.model, UNICAM_MODULE_NAME,
++		sizeof(unicam->mdev.model));
++	strscpy(unicam->mdev.serial, "", sizeof(unicam->mdev.serial));
++	snprintf(unicam->mdev.bus_info, sizeof(unicam->mdev.bus_info),
++		 "platform:%s", dev_name(&pdev->dev));
++	unicam->mdev.hw_revision = 0;
++
++	media_device_init(&unicam->mdev);
++
++	unicam->v4l2_dev.mdev = &unicam->mdev;
++
++	ret = v4l2_device_register(&pdev->dev, &unicam->v4l2_dev);
++	if (ret) {
++		unicam_err(unicam,
++			   "Unable to register v4l2 device.\n");
++		goto err_unicam_put;
++	}
++
++	ret = media_device_register(&unicam->mdev);
++	if (ret < 0) {
++		unicam_err(unicam,
++			   "Unable to register media-controller device.\n");
++		goto err_v4l2_unregister;
++	}
++
++	/* Reserve space for the controls */
++	ret = v4l2_ctrl_handler_init(&unicam->ctrl_handler, 16);
++	if (ret < 0)
++		goto err_media_unregister;
++
++	/* set the driver data in platform device */
++	platform_set_drvdata(pdev, unicam);
++
++	ret = of_unicam_connect_subdevs(unicam);
++	if (ret) {
++		dev_err(&pdev->dev, "Failed to connect subdevs\n");
++		goto err_media_unregister;
++	}
++
++	/* Enable the block power domain */
++	pm_runtime_enable(&pdev->dev);
++
++	return 0;
++
++err_media_unregister:
++	media_device_unregister(&unicam->mdev);
++err_v4l2_unregister:
++	v4l2_device_unregister(&unicam->v4l2_dev);
++err_unicam_put:
++	unicam_put(unicam);
++
++	return ret;
++}
++
++static int unicam_remove(struct platform_device *pdev)
++{
++	struct unicam_device *unicam = platform_get_drvdata(pdev);
++
++	unicam_dbg(2, unicam, "%s\n", __func__);
++
++	v4l2_async_nf_unregister(&unicam->notifier);
++	v4l2_device_unregister(&unicam->v4l2_dev);
++	media_device_unregister(&unicam->mdev);
++	unregister_nodes(unicam);
++
++	pm_runtime_disable(&pdev->dev);
++
++	return 0;
++}
++
++static const struct of_device_id unicam_of_match[] = {
++	{ .compatible = "brcm,bcm2835-unicam", },
++	{ /* sentinel */ },
++};
++MODULE_DEVICE_TABLE(of, unicam_of_match);
++
++static struct platform_driver unicam_driver = {
++	.probe		= unicam_probe,
++	.remove		= unicam_remove,
++	.driver = {
++		.name	= UNICAM_MODULE_NAME,
++		.of_match_table = of_match_ptr(unicam_of_match),
++	},
++};
++
++module_platform_driver(unicam_driver);
++
++MODULE_AUTHOR("Dave Stevenson <dave.stevenson@raspberrypi.com>");
++MODULE_DESCRIPTION("BCM2835 Unicam driver");
++MODULE_LICENSE("GPL");
++MODULE_VERSION(UNICAM_VERSION);
+--- /dev/null
++++ b/drivers/media/platform/bcm2835/vc4-regs-unicam.h
+@@ -0,0 +1,253 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++/*
++ * Copyright (C) 2017-2020 Raspberry Pi Trading.
++ * Dave Stevenson <dave.stevenson@raspberrypi.com>
++ */
++
++#ifndef VC4_REGS_UNICAM_H
++#define VC4_REGS_UNICAM_H
++
++/*
++ * The following values are taken from files found within the code drop
++ * made by Broadcom for the BCM21553 Graphics Driver, predominantly in
++ * brcm_usrlib/dag/vmcsx/vcinclude/hardware_vc4.h.
++ * They have been modified to be only the register offset.
++ */
++#define UNICAM_CTRL	0x000
++#define UNICAM_STA	0x004
++#define UNICAM_ANA	0x008
++#define UNICAM_PRI	0x00c
++#define UNICAM_CLK	0x010
++#define UNICAM_CLT	0x014
++#define UNICAM_DAT0	0x018
++#define UNICAM_DAT1	0x01c
++#define UNICAM_DAT2	0x020
++#define UNICAM_DAT3	0x024
++#define UNICAM_DLT	0x028
++#define UNICAM_CMP0	0x02c
++#define UNICAM_CMP1	0x030
++#define UNICAM_CAP0	0x034
++#define UNICAM_CAP1	0x038
++#define UNICAM_ICTL	0x100
++#define UNICAM_ISTA	0x104
++#define UNICAM_IDI0	0x108
++#define UNICAM_IPIPE	0x10c
++#define UNICAM_IBSA0	0x110
++#define UNICAM_IBEA0	0x114
++#define UNICAM_IBLS	0x118
++#define UNICAM_IBWP	0x11c
++#define UNICAM_IHWIN	0x120
++#define UNICAM_IHSTA	0x124
++#define UNICAM_IVWIN	0x128
++#define UNICAM_IVSTA	0x12c
++#define UNICAM_ICC	0x130
++#define UNICAM_ICS	0x134
++#define UNICAM_IDC	0x138
++#define UNICAM_IDPO	0x13c
++#define UNICAM_IDCA	0x140
++#define UNICAM_IDCD	0x144
++#define UNICAM_IDS	0x148
++#define UNICAM_DCS	0x200
++#define UNICAM_DBSA0	0x204
++#define UNICAM_DBEA0	0x208
++#define UNICAM_DBWP	0x20c
++#define UNICAM_DBCTL	0x300
++#define UNICAM_IBSA1	0x304
++#define UNICAM_IBEA1	0x308
++#define UNICAM_IDI1	0x30c
++#define UNICAM_DBSA1	0x310
++#define UNICAM_DBEA1	0x314
++#define UNICAM_MISC	0x400
++
++/*
++ * The following bitmasks are from the kernel released by Broadcom
++ * for Android - https://android.googlesource.com/kernel/bcm/
++ * The Rhea, Hawaii, and Java chips all contain the same VideoCore4
++ * Unicam block as BCM2835, as defined in eg
++ * arch/arm/mach-rhea/include/mach/rdb_A0/brcm_rdb_cam.h and similar.
++ * Values reworked to use the kernel BIT and GENMASK macros.
++ *
++ * Some of the bit mnenomics have been amended to match the datasheet.
++ */
++/* UNICAM_CTRL Register */
++#define UNICAM_CPE		BIT(0)
++#define UNICAM_MEM		BIT(1)
++#define UNICAM_CPR		BIT(2)
++#define UNICAM_CPM_MASK		GENMASK(3, 3)
++#define UNICAM_CPM_CSI2		0
++#define UNICAM_CPM_CCP2		1
++#define UNICAM_SOE		BIT(4)
++#define UNICAM_DCM_MASK		GENMASK(5, 5)
++#define UNICAM_DCM_STROBE	0
++#define UNICAM_DCM_DATA		1
++#define UNICAM_SLS		BIT(6)
++#define UNICAM_PFT_MASK		GENMASK(11, 8)
++#define UNICAM_OET_MASK		GENMASK(20, 12)
++
++/* UNICAM_STA Register */
++#define UNICAM_SYN		BIT(0)
++#define UNICAM_CS		BIT(1)
++#define UNICAM_SBE		BIT(2)
++#define UNICAM_PBE		BIT(3)
++#define UNICAM_HOE		BIT(4)
++#define UNICAM_PLE		BIT(5)
++#define UNICAM_SSC		BIT(6)
++#define UNICAM_CRCE		BIT(7)
++#define UNICAM_OES		BIT(8)
++#define UNICAM_IFO		BIT(9)
++#define UNICAM_OFO		BIT(10)
++#define UNICAM_BFO		BIT(11)
++#define UNICAM_DL		BIT(12)
++#define UNICAM_PS		BIT(13)
++#define UNICAM_IS		BIT(14)
++#define UNICAM_PI0		BIT(15)
++#define UNICAM_PI1		BIT(16)
++#define UNICAM_FSI_S		BIT(17)
++#define UNICAM_FEI_S		BIT(18)
++#define UNICAM_LCI_S		BIT(19)
++#define UNICAM_BUF0_RDY		BIT(20)
++#define UNICAM_BUF0_NO		BIT(21)
++#define UNICAM_BUF1_RDY		BIT(22)
++#define UNICAM_BUF1_NO		BIT(23)
++#define UNICAM_DI		BIT(24)
++
++#define UNICAM_STA_MASK_ALL \
++		(UNICAM_DL + \
++		UNICAM_SBE + \
++		UNICAM_PBE + \
++		UNICAM_HOE + \
++		UNICAM_PLE + \
++		UNICAM_SSC + \
++		UNICAM_CRCE + \
++		UNICAM_IFO + \
++		UNICAM_OFO + \
++		UNICAM_PS + \
++		UNICAM_PI0 + \
++		UNICAM_PI1)
++
++/* UNICAM_ANA Register */
++#define UNICAM_APD		BIT(0)
++#define UNICAM_BPD		BIT(1)
++#define UNICAM_AR		BIT(2)
++#define UNICAM_DDL		BIT(3)
++#define UNICAM_CTATADJ_MASK	GENMASK(7, 4)
++#define UNICAM_PTATADJ_MASK	GENMASK(11, 8)
++
++/* UNICAM_PRI Register */
++#define UNICAM_PE		BIT(0)
++#define UNICAM_PT_MASK		GENMASK(2, 1)
++#define UNICAM_NP_MASK		GENMASK(7, 4)
++#define UNICAM_PP_MASK		GENMASK(11, 8)
++#define UNICAM_BS_MASK		GENMASK(15, 12)
++#define UNICAM_BL_MASK		GENMASK(17, 16)
++
++/* UNICAM_CLK Register */
++#define UNICAM_CLE		BIT(0)
++#define UNICAM_CLPD		BIT(1)
++#define UNICAM_CLLPE		BIT(2)
++#define UNICAM_CLHSE		BIT(3)
++#define UNICAM_CLTRE		BIT(4)
++#define UNICAM_CLAC_MASK	GENMASK(8, 5)
++#define UNICAM_CLSTE		BIT(29)
++
++/* UNICAM_CLT Register */
++#define UNICAM_CLT1_MASK	GENMASK(7, 0)
++#define UNICAM_CLT2_MASK	GENMASK(15, 8)
++
++/* UNICAM_DATn Registers */
++#define UNICAM_DLE		BIT(0)
++#define UNICAM_DLPD		BIT(1)
++#define UNICAM_DLLPE		BIT(2)
++#define UNICAM_DLHSE		BIT(3)
++#define UNICAM_DLTRE		BIT(4)
++#define UNICAM_DLSM		BIT(5)
++#define UNICAM_DLFO		BIT(28)
++#define UNICAM_DLSTE		BIT(29)
++
++#define UNICAM_DAT_MASK_ALL (UNICAM_DLSTE + UNICAM_DLFO)
++
++/* UNICAM_DLT Register */
++#define UNICAM_DLT1_MASK	GENMASK(7, 0)
++#define UNICAM_DLT2_MASK	GENMASK(15, 8)
++#define UNICAM_DLT3_MASK	GENMASK(23, 16)
++
++/* UNICAM_ICTL Register */
++#define UNICAM_FSIE		BIT(0)
++#define UNICAM_FEIE		BIT(1)
++#define UNICAM_IBOB		BIT(2)
++#define UNICAM_FCM		BIT(3)
++#define UNICAM_TFC		BIT(4)
++#define UNICAM_LIP_MASK		GENMASK(6, 5)
++#define UNICAM_LCIE_MASK	GENMASK(28, 16)
++
++/* UNICAM_IDI0/1 Register */
++#define UNICAM_ID0_MASK		GENMASK(7, 0)
++#define UNICAM_ID1_MASK		GENMASK(15, 8)
++#define UNICAM_ID2_MASK		GENMASK(23, 16)
++#define UNICAM_ID3_MASK		GENMASK(31, 24)
++
++/* UNICAM_ISTA Register */
++#define UNICAM_FSI		BIT(0)
++#define UNICAM_FEI		BIT(1)
++#define UNICAM_LCI		BIT(2)
++
++#define UNICAM_ISTA_MASK_ALL (UNICAM_FSI + UNICAM_FEI + UNICAM_LCI)
++
++/* UNICAM_IPIPE Register */
++#define UNICAM_PUM_MASK		GENMASK(2, 0)
++		/* Unpacking modes */
++		#define UNICAM_PUM_NONE		0
++		#define UNICAM_PUM_UNPACK6	1
++		#define UNICAM_PUM_UNPACK7	2
++		#define UNICAM_PUM_UNPACK8	3
++		#define UNICAM_PUM_UNPACK10	4
++		#define UNICAM_PUM_UNPACK12	5
++		#define UNICAM_PUM_UNPACK14	6
++		#define UNICAM_PUM_UNPACK16	7
++#define UNICAM_DDM_MASK		GENMASK(6, 3)
++#define UNICAM_PPM_MASK		GENMASK(9, 7)
++		/* Packing modes */
++		#define UNICAM_PPM_NONE		0
++		#define UNICAM_PPM_PACK8	1
++		#define UNICAM_PPM_PACK10	2
++		#define UNICAM_PPM_PACK12	3
++		#define UNICAM_PPM_PACK14	4
++		#define UNICAM_PPM_PACK16	5
++#define UNICAM_DEM_MASK		GENMASK(11, 10)
++#define UNICAM_DEBL_MASK	GENMASK(14, 12)
++#define UNICAM_ICM_MASK		GENMASK(16, 15)
++#define UNICAM_IDM_MASK		GENMASK(17, 17)
++
++/* UNICAM_ICC Register */
++#define UNICAM_ICFL_MASK	GENMASK(4, 0)
++#define UNICAM_ICFH_MASK	GENMASK(9, 5)
++#define UNICAM_ICST_MASK	GENMASK(12, 10)
++#define UNICAM_ICLT_MASK	GENMASK(15, 13)
++#define UNICAM_ICLL_MASK	GENMASK(31, 16)
++
++/* UNICAM_DCS Register */
++#define UNICAM_DIE		BIT(0)
++#define UNICAM_DIM		BIT(1)
++#define UNICAM_DBOB		BIT(3)
++#define UNICAM_FDE		BIT(4)
++#define UNICAM_LDP		BIT(5)
++#define UNICAM_EDL_MASK		GENMASK(15, 8)
++
++/* UNICAM_DBCTL Register */
++#define UNICAM_DBEN		BIT(0)
++#define UNICAM_BUF0_IE		BIT(1)
++#define UNICAM_BUF1_IE		BIT(2)
++
++/* UNICAM_CMP[0,1] register */
++#define UNICAM_PCE		BIT(31)
++#define UNICAM_GI		BIT(9)
++#define UNICAM_CPH		BIT(8)
++#define UNICAM_PCVC_MASK	GENMASK(7, 6)
++#define UNICAM_PCDT_MASK	GENMASK(5, 0)
++
++/* UNICAM_MISC register */
++#define UNICAM_FL0		BIT(6)
++#define UNICAM_FL1		BIT(9)
++
++#endif
diff --git a/target/linux/bcm27xx/patches-6.1/950-0246-media-bcm2835-unicam-Kconfig-Makefile-for-CCP2-CSI2-.patch b/target/linux/bcm27xx/patches-6.1/950-0246-media-bcm2835-unicam-Kconfig-Makefile-for-CCP2-CSI2-.patch
new file mode 100644
index 00000000000000..90dcf0e3fff9eb
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0246-media-bcm2835-unicam-Kconfig-Makefile-for-CCP2-CSI2-.patch
@@ -0,0 +1,45 @@
+From 481426aced8114d03e3ced044c4094299675656d Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Wed, 1 Apr 2020 08:39:49 +0100
+Subject: [PATCH] media: bcm2835-unicam: Kconfig/Makefile for CCP2/CSI2
+ camera interface
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ MAINTAINERS                     | 2 +-
+ drivers/media/platform/Kconfig  | 1 +
+ drivers/media/platform/Makefile | 1 +
+ 3 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -4038,7 +4038,7 @@ F:	Documentation/devicetree/bindings/med
+ F:	drivers/staging/media/rpivid
+ 
+ BROADCOM BCM2835 CAMERA DRIVER
+-M:	Dave Stevenson <dave.stevenson@raspberrypi.org>
++M:	Raspberry Pi Kernel Maintenance <kernel-list@raspberrypi.com>
+ L:	linux-media@vger.kernel.org
+ S:	Maintained
+ F:	drivers/media/platform/bcm2835/
+--- a/drivers/media/platform/Kconfig
++++ b/drivers/media/platform/Kconfig
+@@ -67,6 +67,7 @@ source "drivers/media/platform/amlogic/K
+ source "drivers/media/platform/amphion/Kconfig"
+ source "drivers/media/platform/aspeed/Kconfig"
+ source "drivers/media/platform/atmel/Kconfig"
++source "drivers/media/platform/bcm2835/Kconfig"
+ source "drivers/media/platform/cadence/Kconfig"
+ source "drivers/media/platform/chips-media/Kconfig"
+ source "drivers/media/platform/intel/Kconfig"
+--- a/drivers/media/platform/Makefile
++++ b/drivers/media/platform/Makefile
+@@ -10,6 +10,7 @@ obj-y += amlogic/
+ obj-y += amphion/
+ obj-y += aspeed/
+ obj-y += atmel/
++obj-y += bcm2835/
+ obj-y += cadence/
+ obj-y += chips-media/
+ obj-y += intel/
diff --git a/target/linux/bcm27xx/patches-6.1/950-0247-media-bcm2835-unicam-Add-support-for-get_mbus_config.patch b/target/linux/bcm27xx/patches-6.1/950-0247-media-bcm2835-unicam-Add-support-for-get_mbus_config.patch
new file mode 100644
index 00000000000000..79646d1012d459
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0247-media-bcm2835-unicam-Add-support-for-get_mbus_config.patch
@@ -0,0 +1,56 @@
+From 17aef1abe2ca8c01725954f7f7c7b3d7a29cb256 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 23 Jun 2020 14:32:51 +0100
+Subject: [PATCH] media: bcm2835-unicam: Add support for
+ get_mbus_config to set num lanes
+
+Use the get_mbus_config pad subdev call to allow a source to use
+fewer than the number of CSI2 lanes defined in device tree.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 31 ++++++++++++++++---
+ 1 file changed, 27 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -1641,12 +1641,35 @@ static int unicam_start_streaming(struct
+ 		goto err_streaming;
+ 	}
+ 
+-	/*
+-	 * TODO: Retrieve the number of active data lanes from the connected
+-	 * subdevice.
+-	 */
+ 	dev->active_data_lanes = dev->max_data_lanes;
+ 
++	if (dev->bus_type == V4L2_MBUS_CSI2_DPHY) {
++		struct v4l2_mbus_config mbus_config = { 0 };
++
++		ret = v4l2_subdev_call(dev->sensor, pad, get_mbus_config,
++				       0, &mbus_config);
++		if (ret < 0 && ret != -ENOIOCTLCMD) {
++			unicam_dbg(3, dev, "g_mbus_config failed\n");
++			goto err_pm_put;
++		}
++
++		dev->active_data_lanes =
++			(mbus_config.flags & V4L2_MBUS_CSI2_LANE_MASK) >>
++					__ffs(V4L2_MBUS_CSI2_LANE_MASK);
++		if (!dev->active_data_lanes)
++			dev->active_data_lanes = dev->max_data_lanes;
++		if (dev->active_data_lanes > dev->max_data_lanes) {
++			unicam_err(dev, "Device has requested %u data lanes, which is >%u configured in DT\n",
++				   dev->active_data_lanes,
++				   dev->max_data_lanes);
++			ret = -EINVAL;
++			goto err_pm_put;
++		}
++	}
++
++	unicam_dbg(1, dev, "Running with %u data lanes\n",
++		   dev->active_data_lanes);
++
+ 	ret = clk_set_rate(dev->clock, 100 * 1000 * 1000);
+ 	if (ret) {
+ 		unicam_err(dev, "failed to set up clock\n");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0248-media-bcm2835-unicam-Avoid-gcc-warning-over-0-on-end.patch b/target/linux/bcm27xx/patches-6.1/950-0248-media-bcm2835-unicam-Avoid-gcc-warning-over-0-on-end.patch
new file mode 100644
index 00000000000000..6c6e4fe6fe548b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0248-media-bcm2835-unicam-Avoid-gcc-warning-over-0-on-end.patch
@@ -0,0 +1,27 @@
+From f64b2674da1aa8d92ca6021a52faec4db4851ffb Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 26 Jun 2020 15:53:44 +0100
+Subject: [PATCH] media: bcm2835-unicam: Avoid gcc warning over {0} on
+ endpoint
+
+Older gcc versions object to = { 0 } initialisation if the first
+elemtn in the structure is a substructure.
+
+Use = { } to avoid this compiler warning.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -2588,7 +2588,7 @@ static const struct v4l2_async_notifier_
+ static int of_unicam_connect_subdevs(struct unicam_device *dev)
+ {
+ 	struct platform_device *pdev = dev->pdev;
+-	struct v4l2_fwnode_endpoint ep = { 0 };
++	struct v4l2_fwnode_endpoint ep = { };
+ 	struct device_node *ep_node;
+ 	struct device_node *sensor_node;
+ 	unsigned int lane;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0249-serial-8250-bcm2835aux-defer-if-clock-is-zero.patch b/target/linux/bcm27xx/patches-6.1/950-0249-serial-8250-bcm2835aux-defer-if-clock-is-zero.patch
new file mode 100644
index 00000000000000..50131095667069
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0249-serial-8250-bcm2835aux-defer-if-clock-is-zero.patch
@@ -0,0 +1,28 @@
+From 34fb077ceed5166f4426daf21287d2ff4c0d65ca Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 2 Jul 2020 13:53:20 +0100
+Subject: [PATCH] serial: 8250: bcm2835aux - defer if clock is zero
+
+See: https://github.com/raspberrypi/linux/issues/3700
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/tty/serial/8250/8250_bcm2835aux.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/tty/serial/8250/8250_bcm2835aux.c
++++ b/drivers/tty/serial/8250/8250_bcm2835aux.c
+@@ -180,6 +180,13 @@ static int bcm2835aux_serial_probe(struc
+ 	 */
+ 	up.port.uartclk = uartclk * 2;
+ 
++	/* The clock is only queried at probe time, which means we get one shot
++	 * at this. A zero clock is never going to work and is almost certainly
++	 * due to a parent not being ready, so prefer to defer.
++	 */
++	if (!up.port.uartclk)
++	    return -EPROBE_DEFER;
++
+ 	/* register the port */
+ 	ret = serial8250_register_8250_port(&up);
+ 	if (ret < 0) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0250-media-Add-a-pixel-format-for-MIPI-packed-12bit-luma-.patch b/target/linux/bcm27xx/patches-6.1/950-0250-media-Add-a-pixel-format-for-MIPI-packed-12bit-luma-.patch
new file mode 100644
index 00000000000000..b32f8cc5d2e766
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0250-media-Add-a-pixel-format-for-MIPI-packed-12bit-luma-.patch
@@ -0,0 +1,95 @@
+From 99209ff2c535981889eaff40660c845683a885d6 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 7 May 2020 16:59:03 +0100
+Subject: [PATCH] media: Add a pixel format for MIPI packed 12bit luma
+ only.
+
+This is the format used by monochrome 12bit image sensors.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../userspace-api/media/v4l/pixfmt-y12p.rst   | 45 +++++++++++++++++++
+ .../userspace-api/media/v4l/yuv-formats.rst   |  1 +
+ drivers/media/v4l2-core/v4l2-ioctl.c          |  1 +
+ include/uapi/linux/videodev2.h                |  1 +
+ 4 files changed, 48 insertions(+)
+ create mode 100644 Documentation/userspace-api/media/v4l/pixfmt-y12p.rst
+
+--- /dev/null
++++ b/Documentation/userspace-api/media/v4l/pixfmt-y12p.rst
+@@ -0,0 +1,45 @@
++.. Permission is granted to copy, distribute and/or modify this
++.. document under the terms of the GNU Free Documentation License,
++.. Version 1.1 or any later version published by the Free Software
++.. Foundation, with no Invariant Sections, no Front-Cover Texts
++.. and no Back-Cover Texts. A copy of the license is included at
++.. Documentation/media/uapi/fdl-appendix.rst.
++..
++.. TODO: replace it to GFDL-1.1-or-later WITH no-invariant-sections
++
++.. _V4L2-PIX-FMT-Y12P:
++
++******************************
++V4L2_PIX_FMT_Y12P ('Y12P')
++******************************
++
++Grey-scale image as a MIPI RAW12 packed array
++
++
++Description
++===========
++
++This is a packed grey-scale image format with a depth of 12 bits per
++pixel. Two consecutive pixels are packed into 3 bytes. The first 2 bytes
++contain the 8 high order bits of the pixels, and the 3rd byte contains the 4
++least significants bits of each pixel, in the same order.
++
++**Byte Order.**
++Each cell is one byte.
++
++.. tabularcolumns:: |p{2.2cm}|p{1.2cm}|p{1.2cm}|p{3.1cm}|
++
++
++.. flat-table::
++    :header-rows:  0
++    :stub-columns: 0
++    :widths:       2 1 1 1
++
++
++    -  -  start + 0:
++       -  Y'\ :sub:`00high`
++       -  Y'\ :sub:`01high`
++       -  Y'\ :sub:`01low`\ (bits 7--4)
++
++          Y'\ :sub:`00low`\ (bits 3--0)
++
+--- a/Documentation/userspace-api/media/v4l/yuv-formats.rst
++++ b/Documentation/userspace-api/media/v4l/yuv-formats.rst
+@@ -267,6 +267,7 @@ image.
+     pixfmt-packed-yuv
+     pixfmt-yuv-planar
+     pixfmt-yuv-luma
++    pixfmt-y12p
+     pixfmt-y8i
+     pixfmt-y12i
+     pixfmt-uv8
+--- a/drivers/media/v4l2-core/v4l2-ioctl.c
++++ b/drivers/media/v4l2-core/v4l2-ioctl.c
+@@ -1314,6 +1314,7 @@ static void v4l_fill_fmtdesc(struct v4l2
+ 	case V4L2_PIX_FMT_Y16_BE:	descr = "16-bit Greyscale BE"; break;
+ 	case V4L2_PIX_FMT_Y10BPACK:	descr = "10-bit Greyscale (Packed)"; break;
+ 	case V4L2_PIX_FMT_Y10P:		descr = "10-bit Greyscale (MIPI Packed)"; break;
++	case V4L2_PIX_FMT_Y12P:		descr = "12-bit Greyscale (MIPI Packed)"; break;
+ 	case V4L2_PIX_FMT_IPU3_Y10:	descr = "10-bit greyscale (IPU3 Packed)"; break;
+ 	case V4L2_PIX_FMT_Y8I:		descr = "Interleaved 8-bit Greyscale"; break;
+ 	case V4L2_PIX_FMT_Y12I:		descr = "Interleaved 12-bit Greyscale"; break;
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -595,6 +595,7 @@ struct v4l2_pix_format {
+ /* Grey bit-packed formats */
+ #define V4L2_PIX_FMT_Y10BPACK    v4l2_fourcc('Y', '1', '0', 'B') /* 10  Greyscale bit-packed */
+ #define V4L2_PIX_FMT_Y10P    v4l2_fourcc('Y', '1', '0', 'P') /* 10  Greyscale, MIPI RAW10 packed */
++#define V4L2_PIX_FMT_Y12P    v4l2_fourcc('Y', '1', '2', 'P') /* 12  Greyscale, MIPI RAW12 packed */
+ #define V4L2_PIX_FMT_IPU3_Y10		v4l2_fourcc('i', 'p', '3', 'y') /* IPU3 packed 10-bit greyscale */
+ 
+ /* Palette formats */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0251-media-Add-a-pixel-format-for-MIPI-packed-14bit-luma-.patch b/target/linux/bcm27xx/patches-6.1/950-0251-media-Add-a-pixel-format-for-MIPI-packed-14bit-luma-.patch
new file mode 100644
index 00000000000000..0ad0f3136802e2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0251-media-Add-a-pixel-format-for-MIPI-packed-14bit-luma-.patch
@@ -0,0 +1,104 @@
+From 202bd8f62e30ae4da7b591b09f21e8bcd5913846 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 25 Jun 2020 17:51:03 +0100
+Subject: [PATCH] media: Add a pixel format for MIPI packed 14bit luma
+ only.
+
+This is the format used by monochrome 14bit image sensors.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../userspace-api/media/v4l/pixfmt-y14p.rst   | 54 +++++++++++++++++++
+ .../userspace-api/media/v4l/yuv-formats.rst   |  1 +
+ drivers/media/v4l2-core/v4l2-ioctl.c          |  1 +
+ include/uapi/linux/videodev2.h                |  1 +
+ 4 files changed, 57 insertions(+)
+ create mode 100644 Documentation/userspace-api/media/v4l/pixfmt-y14p.rst
+
+--- /dev/null
++++ b/Documentation/userspace-api/media/v4l/pixfmt-y14p.rst
+@@ -0,0 +1,54 @@
++.. Permission is granted to copy, distribute and/or modify this
++.. document under the terms of the GNU Free Documentation License,
++.. Version 1.1 or any later version published by the Free Software
++.. Foundation, with no Invariant Sections, no Front-Cover Texts
++.. and no Back-Cover Texts. A copy of the license is included at
++.. Documentation/media/uapi/fdl-appendix.rst.
++..
++.. TODO: replace it to GFDL-1.1-or-later WITH no-invariant-sections
++
++.. _V4L2-PIX-FMT-Y14P:
++
++**************************
++V4L2_PIX_FMT_Y14P ('Y14P')
++**************************
++
++Grey-scale image as a MIPI RAW14 packed array
++
++
++Description
++===========
++
++This is a packed grey-scale image format with a depth of 14 bits per
++pixel. Every four consecutive samples are packed into seven bytes. Each
++of the first four bytes contain the eight high order bits of the pixels,
++and the three following bytes contains the six least significants bits of
++each pixel, in the same order.
++
++**Byte Order.**
++Each cell is one byte.
++
++.. tabularcolumns:: |p{1.8cm}|p{1.0cm}|p{1.0cm}|p{1.0cm}|p{1.1cm}|p{3.3cm}|p{3.3cm}|p{3.3cm}|
++
++.. flat-table::
++    :header-rows:  0
++    :stub-columns: 0
++    :widths:       2 1 1 1 1 3 3 3
++
++
++    -  -  start + 0:
++       -  Y'\ :sub:`00high`
++       -  Y'\ :sub:`01high`
++       -  Y'\ :sub:`02high`
++       -  Y'\ :sub:`03high`
++       -  Y'\ :sub:`01low bits 1--0`\ (bits 7--6)
++
++	  Y'\ :sub:`00low bits 5--0`\ (bits 5--0)
++
++       -  Y'\ :sub:`02low bits 3--0`\ (bits 7--4)
++
++	  Y'\ :sub:`01low bits 5--2`\ (bits 3--0)
++
++       -  Y'\ :sub:`03low bits 5--0`\ (bits 7--2)
++
++	  Y'\ :sub:`02low bits 5--4`\ (bits 1--0)
+--- a/Documentation/userspace-api/media/v4l/yuv-formats.rst
++++ b/Documentation/userspace-api/media/v4l/yuv-formats.rst
+@@ -268,6 +268,7 @@ image.
+     pixfmt-yuv-planar
+     pixfmt-yuv-luma
+     pixfmt-y12p
++    pixfmt-y14p
+     pixfmt-y8i
+     pixfmt-y12i
+     pixfmt-uv8
+--- a/drivers/media/v4l2-core/v4l2-ioctl.c
++++ b/drivers/media/v4l2-core/v4l2-ioctl.c
+@@ -1315,6 +1315,7 @@ static void v4l_fill_fmtdesc(struct v4l2
+ 	case V4L2_PIX_FMT_Y10BPACK:	descr = "10-bit Greyscale (Packed)"; break;
+ 	case V4L2_PIX_FMT_Y10P:		descr = "10-bit Greyscale (MIPI Packed)"; break;
+ 	case V4L2_PIX_FMT_Y12P:		descr = "12-bit Greyscale (MIPI Packed)"; break;
++	case V4L2_PIX_FMT_Y14P:		descr = "14-bit Greyscale (MIPI Packed)"; break;
+ 	case V4L2_PIX_FMT_IPU3_Y10:	descr = "10-bit greyscale (IPU3 Packed)"; break;
+ 	case V4L2_PIX_FMT_Y8I:		descr = "Interleaved 8-bit Greyscale"; break;
+ 	case V4L2_PIX_FMT_Y12I:		descr = "Interleaved 12-bit Greyscale"; break;
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -596,6 +596,7 @@ struct v4l2_pix_format {
+ #define V4L2_PIX_FMT_Y10BPACK    v4l2_fourcc('Y', '1', '0', 'B') /* 10  Greyscale bit-packed */
+ #define V4L2_PIX_FMT_Y10P    v4l2_fourcc('Y', '1', '0', 'P') /* 10  Greyscale, MIPI RAW10 packed */
+ #define V4L2_PIX_FMT_Y12P    v4l2_fourcc('Y', '1', '2', 'P') /* 12  Greyscale, MIPI RAW12 packed */
++#define V4L2_PIX_FMT_Y14P    v4l2_fourcc('Y', '1', '4', 'P') /* 14  Greyscale, MIPI RAW12 packed */
+ #define V4L2_PIX_FMT_IPU3_Y10		v4l2_fourcc('i', 'p', '3', 'y') /* IPU3 packed 10-bit greyscale */
+ 
+ /* Palette formats */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0252-media-bcm2835-unicam-Add-support-for-12bit-mono-pack.patch b/target/linux/bcm27xx/patches-6.1/950-0252-media-bcm2835-unicam-Add-support-for-12bit-mono-pack.patch
new file mode 100644
index 00000000000000..741b0020b4cf5b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0252-media-bcm2835-unicam-Add-support-for-12bit-mono-pack.patch
@@ -0,0 +1,25 @@
+From f7554a5aefd22a105202233c1c3b4643956258e8 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 25 Jun 2020 17:53:32 +0100
+Subject: [PATCH] media: bcm2835-unicam: Add support for 12bit mono
+ packed format
+
+Now that V4L2_PIX_FMT_Y12P is defined, allow passing raw 12bit
+mono packed data through the peripheral.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -338,7 +338,7 @@ static const struct unicam_fmt formats[]
+ 		.depth		= 10,
+ 		.csi_dt		= 0x2b,
+ 	}, {
+-		/* NB There is no packed V4L2 fourcc for this format. */
++		.fourcc		= V4L2_PIX_FMT_Y12P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_Y12,
+ 		.code		= MEDIA_BUS_FMT_Y12_1X12,
+ 		.depth		= 12,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0253-media-bcm2835-unicam-Add-support-for-14bit-mono-sour.patch b/target/linux/bcm27xx/patches-6.1/950-0253-media-bcm2835-unicam-Add-support-for-14bit-mono-sour.patch
new file mode 100644
index 00000000000000..83b5c5ac3a391d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0253-media-bcm2835-unicam-Add-support-for-14bit-mono-sour.patch
@@ -0,0 +1,29 @@
+From 44879ffefba60a72f31d79ff0124c20dc728234e Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 25 Jun 2020 18:03:47 +0100
+Subject: [PATCH] media: bcm2835-unicam: Add support for 14bit mono
+ sources
+
+Now that V4L2_PIX_FMT_Y14 and V4L2_PIX_FMT_Y14P are defined,
+allow passing 14bit mono data through the peripheral.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -343,6 +343,12 @@ static const struct unicam_fmt formats[]
+ 		.code		= MEDIA_BUS_FMT_Y12_1X12,
+ 		.depth		= 12,
+ 		.csi_dt		= 0x2c,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_Y14P,
++		.repacked_fourcc = V4L2_PIX_FMT_Y14,
++		.code		= MEDIA_BUS_FMT_Y14_1X14,
++		.depth		= 14,
++		.csi_dt		= 0x2d,
+ 	},
+ 	/* Embedded data format */
+ 	{
diff --git a/target/linux/bcm27xx/patches-6.1/950-0254-media-bcm2835-unicam-Add-support-for-unpacked-14bit-.patch b/target/linux/bcm27xx/patches-6.1/950-0254-media-bcm2835-unicam-Add-support-for-unpacked-14bit-.patch
new file mode 100644
index 00000000000000..94da72254cbb7e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0254-media-bcm2835-unicam-Add-support-for-unpacked-14bit-.patch
@@ -0,0 +1,42 @@
+From d98080a44a0355e7f4e061678a251022dfecbe08 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 1 Jul 2020 10:57:57 +0100
+Subject: [PATCH] media: bcm2835-unicam: Add support for unpacked 14bit
+ Bayer formats
+
+Now that the 14bit non-packed Bayer formats are defined, add them
+into the supported formats lookup table.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -301,21 +301,25 @@ static const struct unicam_fmt formats[]
+ 		.csi_dt		= 0x2c,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SBGGR14P,
++		.repacked_fourcc = V4L2_PIX_FMT_SBGGR14,
+ 		.code		= MEDIA_BUS_FMT_SBGGR14_1X14,
+ 		.depth		= 14,
+ 		.csi_dt		= 0x2d,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGBRG14P,
++		.repacked_fourcc = V4L2_PIX_FMT_SGBRG14,
+ 		.code		= MEDIA_BUS_FMT_SGBRG14_1X14,
+ 		.depth		= 14,
+ 		.csi_dt		= 0x2d,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGRBG14P,
++		.repacked_fourcc = V4L2_PIX_FMT_SGRBG14,
+ 		.code		= MEDIA_BUS_FMT_SGRBG14_1X14,
+ 		.depth		= 14,
+ 		.csi_dt		= 0x2d,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SRGGB14P,
++		.repacked_fourcc = V4L2_PIX_FMT_SRGGB14,
+ 		.code		= MEDIA_BUS_FMT_SRGGB14_1X14,
+ 		.depth		= 14,
+ 		.csi_dt		= 0x2d,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0255-bcm2835-dma-Add-NO_WAIT_RESP-flag.patch b/target/linux/bcm27xx/patches-6.1/950-0255-bcm2835-dma-Add-NO_WAIT_RESP-flag.patch
new file mode 100644
index 00000000000000..592065689387e8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0255-bcm2835-dma-Add-NO_WAIT_RESP-flag.patch
@@ -0,0 +1,54 @@
+From 508a7f2bd30c24122f8137a5234b6fbfc3f1506e Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 1 Jul 2020 20:28:27 +0100
+Subject: [PATCH] bcm2835-dma: Add NO_WAIT_RESP flag
+
+Use bit 27 of the dreq value (the second cell of the DT DMA descriptor)
+to request that the WAIT_RESP bit is not set.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/dma/bcm2835-dma.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -165,6 +165,11 @@ struct bcm2835_desc {
+ #define BCM2835_DMA_WAIT(x)	((x & 31) << 21) /* add DMA-wait cycles */
+ #define BCM2835_DMA_NO_WIDE_BURSTS BIT(26) /* no 2 beat write bursts */
+ 
++/* A fake bit to request that the driver doesn't set the WAIT_RESP bit. */
++#define BCM2835_DMA_NO_WAIT_RESP BIT(27)
++#define WAIT_RESP(x) ((x & BCM2835_DMA_NO_WAIT_RESP) ? \
++		      0 : BCM2835_DMA_WAIT_RESP)
++
+ /* debug register bits */
+ #define BCM2835_DMA_DEBUG_LAST_NOT_SET_ERR	BIT(0)
+ #define BCM2835_DMA_DEBUG_FIFO_ERR		BIT(1)
+@@ -843,7 +848,7 @@ static struct dma_async_tx_descriptor *b
+ 	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+ 	struct bcm2835_desc *d;
+ 	u32 info = BCM2835_DMA_D_INC | BCM2835_DMA_S_INC;
+-	u32 extra = BCM2835_DMA_INT_EN | BCM2835_DMA_WAIT_RESP;
++	u32 extra = BCM2835_DMA_INT_EN | WAIT_RESP(c->dreq);
+ 	size_t max_len = bcm2835_dma_max_frame_length(c);
+ 	size_t frames;
+ 
+@@ -873,7 +878,7 @@ static struct dma_async_tx_descriptor *b
+ 	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+ 	struct bcm2835_desc *d;
+ 	dma_addr_t src = 0, dst = 0;
+-	u32 info = BCM2835_DMA_WAIT_RESP;
++	u32 info = WAIT_RESP(c->dreq);
+ 	u32 extra = BCM2835_DMA_INT_EN;
+ 	size_t frames;
+ 
+@@ -935,7 +940,7 @@ static struct dma_async_tx_descriptor *b
+ 	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+ 	struct bcm2835_desc *d;
+ 	dma_addr_t src, dst;
+-	u32 info = BCM2835_DMA_WAIT_RESP;
++	u32 info = WAIT_RESP(c->dreq);
+ 	u32 extra = 0;
+ 	size_t max_len = bcm2835_dma_max_frame_length(c);
+ 	size_t frames;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0256-media-bcm2835-unicam-Reinstate-V4L2_CAP_READWRITE-in.patch b/target/linux/bcm27xx/patches-6.1/950-0256-media-bcm2835-unicam-Reinstate-V4L2_CAP_READWRITE-in.patch
new file mode 100644
index 00000000000000..9b1d1ce0c51fac
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0256-media-bcm2835-unicam-Reinstate-V4L2_CAP_READWRITE-in.patch
@@ -0,0 +1,28 @@
+From 2176d77634f7dc1c14a1214efe6068c785dc2b84 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 7 Jul 2020 14:23:40 +0100
+Subject: [PATCH] media: bcm2835-unicam: Reinstate V4L2_CAP_READWRITE
+ in the caps
+
+v4l2-compliance throws a failure if the device doesn't advertise
+V4L2_CAP_READWRITE but allows read or write operations.
+We do support read, so reinstate the flag.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -2420,8 +2420,8 @@ static int register_node(struct unicam_d
+ 	vdev->queue = q;
+ 	vdev->lock = &node->lock;
+ 	vdev->device_caps = (pad_id == IMAGE_PAD) ?
+-			    (V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING) :
+-			    (V4L2_CAP_META_CAPTURE | V4L2_CAP_STREAMING);
++				V4L2_CAP_VIDEO_CAPTURE : V4L2_CAP_META_CAPTURE;
++	vdev->device_caps |= V4L2_CAP_READWRITE | V4L2_CAP_STREAMING;
+ 
+ 	/* Define the device names */
+ 	snprintf(vdev->name, sizeof(vdev->name), "%s-%s", UNICAM_MODULE_NAME,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0257-media-bcm2835-unicam-Ensure-type-is-VIDEO_CAPTURE-in.patch b/target/linux/bcm27xx/patches-6.1/950-0257-media-bcm2835-unicam-Ensure-type-is-VIDEO_CAPTURE-in.patch
new file mode 100644
index 00000000000000..cb524bccaee97e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0257-media-bcm2835-unicam-Ensure-type-is-VIDEO_CAPTURE-in.patch
@@ -0,0 +1,36 @@
+From 8ce292d7cec3a7ac2443c7cfa59dfdaad75a6efa Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 7 Jul 2020 14:52:43 +0100
+Subject: [PATCH] media: bcm2835-unicam: Ensure type is VIDEO_CAPTURE
+ in [g|s]_selection
+
+[g|s]_selection pass in a buffer type that needs to be validated
+before passing on to the sensor subdev.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -1887,6 +1887,9 @@ static int unicam_s_selection(struct fil
+ 		.r = sel->r,
+ 	};
+ 
++	if (sel->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
++		return -EINVAL;
++
+ 	return v4l2_subdev_call(dev->sensor, pad, set_selection, NULL, &sdsel);
+ }
+ 
+@@ -1901,6 +1904,9 @@ static int unicam_g_selection(struct fil
+ 	};
+ 	int ret;
+ 
++	if (sel->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
++		return -EINVAL;
++
+ 	ret = v4l2_subdev_call(dev->sensor, pad, get_selection, NULL, &sdsel);
+ 	if (!ret)
+ 		sel->r = sdsel.r;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0258-media-bcm2835-unicam-Set-VPU-min-clock-freq-to-250Mh.patch b/target/linux/bcm27xx/patches-6.1/950-0258-media-bcm2835-unicam-Set-VPU-min-clock-freq-to-250Mh.patch
new file mode 100644
index 00000000000000..2f6d5f44821606
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0258-media-bcm2835-unicam-Set-VPU-min-clock-freq-to-250Mh.patch
@@ -0,0 +1,127 @@
+From a0dc48f88e494f662af2378aa9f1c6191e556487 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Mon, 11 May 2020 13:02:22 +0100
+Subject: [PATCH] media: bcm2835: unicam: Set VPU min clock freq to
+ 250Mhz.
+
+When streaming with Unicam, the VPU must have a clock frequency of at
+least 250Mhz.  Otherwise, the input fifos could overrun, causing
+image corruption.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 49 +++++++++++++++++--
+ 1 file changed, 44 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -91,6 +91,11 @@ MODULE_PARM_DESC(debug, "Debug level 0-3
+ 		v4l2_err(&(dev)->v4l2_dev, fmt, ##arg)
+ 
+ /*
++ * Unicam must request a minimum of 250Mhz from the VPU clock.
++ * Otherwise the input FIFOs overrun and cause image corruption.
++ */
++#define MIN_VPU_CLOCK_RATE (250 * 1000 * 1000)
++/*
+  * To protect against a dodgy sensor driver never returning an error from
+  * enum_mbus_code, set a maximum index value to be used.
+  */
+@@ -419,8 +424,10 @@ struct unicam_device {
+ 	void __iomem *base;
+ 	/* clock gating base address */
+ 	void __iomem *clk_gate_base;
+-	/* clock handle */
++	/* lp clock handle */
+ 	struct clk *clock;
++	/* vpu clock handle */
++	struct clk *vpu_clock;
+ 	/* V4l2 device */
+ 	struct v4l2_device v4l2_dev;
+ 	struct media_device mdev;
+@@ -1680,16 +1687,28 @@ static int unicam_start_streaming(struct
+ 	unicam_dbg(1, dev, "Running with %u data lanes\n",
+ 		   dev->active_data_lanes);
+ 
+-	ret = clk_set_rate(dev->clock, 100 * 1000 * 1000);
++	ret = clk_set_min_rate(dev->vpu_clock, MIN_VPU_CLOCK_RATE);
++	if (ret) {
++		unicam_err(dev, "failed to set up VPU clock\n");
++		goto err_pm_put;
++	}
++
++	ret = clk_prepare_enable(dev->vpu_clock);
+ 	if (ret) {
+-		unicam_err(dev, "failed to set up clock\n");
++		unicam_err(dev, "Failed to enable VPU clock: %d\n", ret);
+ 		goto err_pm_put;
+ 	}
+ 
++	ret = clk_set_rate(dev->clock, 100 * 1000 * 1000);
++	if (ret) {
++		unicam_err(dev, "failed to set up CSI clock\n");
++		goto err_vpu_clock;
++	}
++
+ 	ret = clk_prepare_enable(dev->clock);
+ 	if (ret) {
+ 		unicam_err(dev, "Failed to enable CSI clock: %d\n", ret);
+-		goto err_pm_put;
++		goto err_vpu_clock;
+ 	}
+ 
+ 	for (i = 0; i < ARRAY_SIZE(dev->node); i++) {
+@@ -1723,6 +1742,11 @@ static int unicam_start_streaming(struct
+ err_disable_unicam:
+ 	unicam_disable(dev);
+ 	clk_disable_unprepare(dev->clock);
++err_vpu_clock:
++	ret = clk_set_min_rate(dev->vpu_clock, 0);
++	if (ret)
++		unicam_err(dev, "failed to reset the VPU clock\n");
++	clk_disable_unprepare(dev->vpu_clock);
+ err_pm_put:
+ 	unicam_runtime_put(dev);
+ err_streaming:
+@@ -1740,6 +1764,8 @@ static void unicam_stop_streaming(struct
+ 	node->streaming = false;
+ 
+ 	if (node->pad_id == IMAGE_PAD) {
++		int ret;
++
+ 		/*
+ 		 * Stop streaming the sensor and disable the peripheral.
+ 		 * We cannot continue streaming embedded data with the
+@@ -1749,6 +1775,12 @@ static void unicam_stop_streaming(struct
+ 			unicam_err(dev, "stream off failed in subdev\n");
+ 
+ 		unicam_disable(dev);
++
++		ret = clk_set_min_rate(dev->vpu_clock, 0);
++		if (ret)
++			unicam_err(dev, "failed to reset the min VPU clock\n");
++
++		clk_disable_unprepare(dev->vpu_clock);
+ 		clk_disable_unprepare(dev->clock);
+ 		unicam_runtime_put(dev);
+ 
+@@ -2752,11 +2784,18 @@ static int unicam_probe(struct platform_
+ 
+ 	unicam->clock = devm_clk_get(&pdev->dev, "lp");
+ 	if (IS_ERR(unicam->clock)) {
+-		unicam_err(unicam, "Failed to get clock\n");
++		unicam_err(unicam, "Failed to get lp clock\n");
+ 		ret = PTR_ERR(unicam->clock);
+ 		goto err_unicam_put;
+ 	}
+ 
++	unicam->vpu_clock = devm_clk_get(&pdev->dev, "vpu");
++	if (IS_ERR(unicam->vpu_clock)) {
++		unicam_err(unicam, "Failed to get vpu clock\n");
++		ret = PTR_ERR(unicam->vpu_clock);
++		goto err_unicam_put;
++	}
++
+ 	ret = platform_get_irq(pdev, 0);
+ 	if (ret <= 0) {
+ 		dev_err(&pdev->dev, "No IRQ resource\n");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0259-dt-bindings-bcm2835-unicam-Update-documentation-with.patch b/target/linux/bcm27xx/patches-6.1/950-0259-dt-bindings-bcm2835-unicam-Update-documentation-with.patch
new file mode 100644
index 00000000000000..71f286cc950124
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0259-dt-bindings-bcm2835-unicam-Update-documentation-with.patch
@@ -0,0 +1,38 @@
+From 467458d2c7c81ba4af33813e40d7d7c699543232 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Mon, 11 May 2020 13:06:27 +0100
+Subject: [PATCH] dt-bindings: bcm2835-unicam: Update documentation
+ with new clock params
+
+Update the documentation to reflect the new "VPU" clock needed
+by the bcm2835-unicam driver.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../devicetree/bindings/media/bcm2835-unicam.txt          | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/Documentation/devicetree/bindings/media/bcm2835-unicam.txt
++++ b/Documentation/devicetree/bindings/media/bcm2835-unicam.txt
+@@ -20,7 +20,7 @@ Required properties:
+ - interrupts	: should contain the IRQ line for this Unicam instance.
+ - clocks	: list of clock specifiers, corresponding to entries in
+ 		  clock-names property.
+-- clock-names	: must contain an "lp" entry, matching entries in the
++- clock-names	: must contain "lp" and "vpu" entries, matching entries in the
+ 		  clocks property.
+ 
+ Unicam supports a single port node. It should contain one 'port' child node
+@@ -46,9 +46,9 @@ Example:
+ 		reg = <0x7e801000 0x800>,
+ 		      <0x7e802004 0x4>;
+ 		interrupts = <2 7>;
+-		clocks = <&clocks BCM2835_CLOCK_CAM1>;
+-		clock-names = "lp";
+-
++		clocks = <&clocks BCM2835_CLOCK_CAM1>,
++			 <&firmware_clocks 4>;
++		clock-names = "lp", "vpu";
+ 		port {
+ 			csi1_ep: endpoint {
+ 				remote-endpoint = <&tc358743_0>;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0260-leds-Add-the-actpwr-trigger.patch b/target/linux/bcm27xx/patches-6.1/950-0260-leds-Add-the-actpwr-trigger.patch
new file mode 100644
index 00000000000000..53639b4280abc0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0260-leds-Add-the-actpwr-trigger.patch
@@ -0,0 +1,235 @@
+From dd39788f30b79674173148ce099a28fb175c3c4d Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 13 Jul 2020 10:33:19 +0100
+Subject: [PATCH] leds: Add the actpwr trigger
+
+The actpwr trigger is a meta trigger that cycles between an inverted
+mmc0 and default-on. It is written in a way that could fairly easily
+be generalised to support alternative sets of source triggers.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/leds/trigger/Kconfig          |  11 ++
+ drivers/leds/trigger/Makefile         |   1 +
+ drivers/leds/trigger/ledtrig-actpwr.c | 190 ++++++++++++++++++++++++++
+ 3 files changed, 202 insertions(+)
+ create mode 100644 drivers/leds/trigger/ledtrig-actpwr.c
+
+--- a/drivers/leds/trigger/Kconfig
++++ b/drivers/leds/trigger/Kconfig
+@@ -161,4 +161,15 @@ config LEDS_TRIGGER_TTY
+ 
+ 	  When build as a module this driver will be called ledtrig-tty.
+ 
++config LEDS_TRIGGER_ACTPWR
++	tristate "ACT/PWR Input Trigger"
++	depends on LEDS_TRIGGERS
++	help
++	  This trigger is intended for platforms that have one software-
++	  controllable LED and no dedicated activity or power LEDs, hence the
++	  need to make the one LED perform both functions. It cycles between
++	  default-on and an inverted mmc0 every 500ms, guaranteeing that it is
++	  on for at least half of the time.
++	  If unsure, say N.
++
+ endif # LEDS_TRIGGERS
+--- a/drivers/leds/trigger/Makefile
++++ b/drivers/leds/trigger/Makefile
+@@ -17,3 +17,4 @@ obj-$(CONFIG_LEDS_TRIGGER_NETDEV)	+= led
+ obj-$(CONFIG_LEDS_TRIGGER_PATTERN)	+= ledtrig-pattern.o
+ obj-$(CONFIG_LEDS_TRIGGER_AUDIO)	+= ledtrig-audio.o
+ obj-$(CONFIG_LEDS_TRIGGER_TTY)		+= ledtrig-tty.o
++obj-$(CONFIG_LEDS_TRIGGER_ACTPWR)	+= ledtrig-actpwr.o
+--- /dev/null
++++ b/drivers/leds/trigger/ledtrig-actpwr.c
+@@ -0,0 +1,190 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Activity/power trigger
++ *
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd.
++ *
++ * Based on Atsushi Nemoto's ledtrig-heartbeat.c, although there may be
++ * nothing left of the original now.
++ */
++
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/timer.h>
++#include <linux/leds.h>
++#include "../leds.h"
++
++enum {
++	TRIG_ACT,
++	TRIG_PWR,
++
++	TRIG_COUNT
++};
++
++struct actpwr_trig_src {
++	const char *name;
++	int interval;
++	bool invert;
++};
++
++struct actpwr_vled {
++	struct led_classdev cdev;
++	struct actpwr_trig_data *parent;
++	enum led_brightness value;
++	unsigned int interval;
++	bool invert;
++};
++
++struct actpwr_trig_data {
++	struct led_trigger trig;
++	struct actpwr_vled virt_leds[TRIG_COUNT];
++	struct actpwr_vled *active;
++	struct timer_list timer;
++	int next_active;
++};
++
++static int actpwr_trig_activate(struct led_classdev *led_cdev);
++static void actpwr_trig_deactivate(struct led_classdev *led_cdev);
++
++static const struct actpwr_trig_src actpwr_trig_sources[TRIG_COUNT] = {
++	[TRIG_ACT] = { "mmc0", 500, true },
++	[TRIG_PWR] = { "default-on", 500, false },
++};
++
++static struct actpwr_trig_data actpwr_data = {
++	{
++		.name     = "actpwr",
++		.activate = actpwr_trig_activate,
++		.deactivate = actpwr_trig_deactivate,
++	}
++};
++
++static void actpwr_brightness_set(struct led_classdev *led_cdev,
++				  enum led_brightness value)
++{
++	struct actpwr_vled *vled = container_of(led_cdev, struct actpwr_vled,
++					       cdev);
++	struct actpwr_trig_data *trig = vled->parent;
++
++	if (vled->invert)
++		value = !value;
++	vled->value = value;
++
++	if (vled == trig->active)
++		led_trigger_event(&trig->trig, value);
++}
++
++static int actpwr_brightness_set_blocking(struct led_classdev *led_cdev,
++					  enum led_brightness value)
++{
++	actpwr_brightness_set(led_cdev, value);
++	return 0;
++}
++
++static enum led_brightness actpwr_brightness_get(struct led_classdev *led_cdev)
++{
++	struct actpwr_vled *vled = container_of(led_cdev, struct actpwr_vled,
++					      cdev);
++
++	return vled->value;
++}
++
++static void actpwr_trig_cycle(struct timer_list *t)
++{
++	struct actpwr_trig_data *trig  = &actpwr_data;
++	struct actpwr_vled *active;
++
++	active = &trig->virt_leds[trig->next_active];
++	trig->active = active;
++	trig->next_active = (trig->next_active + 1) % TRIG_COUNT;
++
++	led_trigger_event(&trig->trig, active->value);
++
++	mod_timer(&trig->timer, jiffies + msecs_to_jiffies(active->interval));
++}
++
++static int actpwr_trig_activate(struct led_classdev *led_cdev)
++{
++	struct actpwr_trig_data *trig  = &actpwr_data;
++
++	/* Start the timer if this is the first LED */
++	if (!trig->active)
++		actpwr_trig_cycle(&trig->timer);
++	else
++		led_set_brightness_nosleep(led_cdev, trig->active->value);
++
++	return 0;
++}
++
++static void actpwr_trig_deactivate(struct led_classdev *led_cdev)
++{
++	struct actpwr_trig_data *trig  = &actpwr_data;
++
++	if (list_empty(&trig->trig.led_cdevs)) {
++		del_timer_sync(&trig->timer);
++		trig->active = NULL;
++	}
++}
++
++static int __init actpwr_trig_init(void)
++{
++	struct actpwr_trig_data *trig  = &actpwr_data;
++	int ret = 0;
++	int i;
++
++	timer_setup(&trig->timer, actpwr_trig_cycle, 0);
++
++	/* Register one "LED" for each source trigger */
++	for (i = 0; i < TRIG_COUNT; i++)
++	{
++		struct actpwr_vled *vled = &trig->virt_leds[i];
++		struct led_classdev *cdev = &vled->cdev;
++		const struct actpwr_trig_src *src = &actpwr_trig_sources[i];
++
++		vled->parent = trig;
++		vled->interval = src->interval;
++		vled->invert = src->invert;
++		cdev->name = src->name;
++		cdev->brightness_set = actpwr_brightness_set;
++		cdev->brightness_set_blocking = actpwr_brightness_set_blocking;
++		cdev->brightness_get = actpwr_brightness_get;
++		cdev->default_trigger = src->name;
++		ret = led_classdev_register(NULL, cdev);
++		if (ret)
++			goto error_classdev;
++	}
++
++	ret = led_trigger_register(&trig->trig);
++	if (ret)
++		goto error_classdev;
++
++	return 0;
++
++error_classdev:
++	while (i > 0)
++	{
++		i--;
++		led_classdev_unregister(&trig->virt_leds[i].cdev);
++	}
++
++	return ret;
++}
++
++static void __exit actpwr_trig_exit(void)
++{
++	int i;
++
++	led_trigger_unregister(&actpwr_data.trig);
++	for (i = 0; i < TRIG_COUNT; i++)
++	{
++		led_classdev_unregister(&actpwr_data.virt_leds[i].cdev);
++	}
++}
++
++module_init(actpwr_trig_init);
++module_exit(actpwr_trig_exit);
++
++MODULE_AUTHOR("Phil Elwell <phil@raspberrypi.com>");
++MODULE_DESCRIPTION("ACT/PWR LED trigger");
++MODULE_LICENSE("GPL v2");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0261-bcm2835-dma-Advertise-the-full-DMA-range.patch b/target/linux/bcm27xx/patches-6.1/950-0261-bcm2835-dma-Advertise-the-full-DMA-range.patch
new file mode 100644
index 00000000000000..c5d3411d020549
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0261-bcm2835-dma-Advertise-the-full-DMA-range.patch
@@ -0,0 +1,77 @@
+From 4ad515d1220a9067833416464338e4c4e494ce3a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 22 Jul 2020 17:59:31 +0100
+Subject: [PATCH] bcm2835-dma: Advertise the full DMA range
+
+Unless the DMA mask is set wider than 32 bits, DMA mapping will use a
+bounce buffer.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/dma/bcm2835-dma.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -41,6 +41,7 @@
+ #define BCM2711_DMA_MEMCPY_CHAN 14
+ 
+ struct bcm2835_dma_cfg_data {
++	u64	dma_mask;
+ 	u32	chan_40bit_mask;
+ };
+ 
+@@ -300,10 +301,12 @@ DEFINE_SPINLOCK(memcpy_lock);
+ 
+ static const struct bcm2835_dma_cfg_data bcm2835_dma_cfg = {
+ 	.chan_40bit_mask = 0,
++	.dma_mask = DMA_BIT_MASK(32),
+ };
+ 
+ static const struct bcm2835_dma_cfg_data bcm2711_dma_cfg = {
+ 	.chan_40bit_mask = BIT(11) | BIT(12) | BIT(13) | BIT(14),
++	.dma_mask = DMA_BIT_MASK(36),
+ };
+ 
+ static inline size_t bcm2835_dma_max_frame_length(struct bcm2835_chan *c)
+@@ -1180,6 +1183,8 @@ static struct dma_chan *bcm2835_dma_xlat
+ 
+ static int bcm2835_dma_probe(struct platform_device *pdev)
+ {
++	const struct bcm2835_dma_cfg_data *cfg_data;
++	const struct of_device_id *of_id;
+ 	struct bcm2835_dmadev *od;
+ 	struct resource *res;
+ 	void __iomem *base;
+@@ -1189,13 +1194,20 @@ static int bcm2835_dma_probe(struct plat
+ 	int irq_flags;
+ 	uint32_t chans_available;
+ 	char chan_name[BCM2835_DMA_CHAN_NAME_SIZE];
+-	const struct of_device_id *of_id;
+ 	int chan_count, chan_start, chan_end;
+ 
++	of_id = of_match_node(bcm2835_dma_of_match, pdev->dev.of_node);
++	if (!of_id) {
++		dev_err(&pdev->dev, "Failed to match compatible string\n");
++		return -EINVAL;
++	}
++
++	cfg_data = of_id->data;
++
+ 	if (!pdev->dev.dma_mask)
+ 		pdev->dev.dma_mask = &pdev->dev.coherent_dma_mask;
+ 
+-	rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
++	rc = dma_set_mask_and_coherent(&pdev->dev, cfg_data->dma_mask);
+ 	if (rc) {
+ 		dev_err(&pdev->dev, "Unable to set DMA mask\n");
+ 		return rc;
+@@ -1260,7 +1272,7 @@ static int bcm2835_dma_probe(struct plat
+ 		return -EINVAL;
+ 	}
+ 
+-	od->cfg_data = of_id->data;
++	od->cfg_data = cfg_data;
+ 
+ 	/* Request DMA channel mask from device tree */
+ 	if (of_property_read_u32(pdev->dev.of_node,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0262-media-bcm2835-unicam-Drop-WARN-on-uing-direct-cache-.patch b/target/linux/bcm27xx/patches-6.1/950-0262-media-bcm2835-unicam-Drop-WARN-on-uing-direct-cache-.patch
new file mode 100644
index 00000000000000..95ad85429c3094
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0262-media-bcm2835-unicam-Drop-WARN-on-uing-direct-cache-.patch
@@ -0,0 +1,34 @@
+From 8367085242d7541f30069a8100d6adf62b7bb181 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 27 Aug 2020 16:30:26 +0100
+Subject: [PATCH] media: bcm2835-unicam: Drop WARN on uing direct cache
+ alias
+
+Pi 0&1 pass all ARM accesses through the VPU L2 cache, therefore
+the dma-ranges property sets the cache alias bits to other
+than the direct alias, hence this WARN was firing.
+
+It was overprotective coding, so assume that everything is OK
+with the dma-ranges, and remove the WARN.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -711,13 +711,6 @@ static void unicam_wr_dma_addr(struct un
+ {
+ 	dma_addr_t endaddr = dmaaddr + buffer_size;
+ 
+-	/*
+-	 * dmaaddr and endaddr should be a 32-bit address with the top two bits
+-	 * set to 0x3 to signify uncached access through the Videocore memory
+-	 * controller.
+-	 */
+-	WARN_ON((dmaaddr >> 30) != 0x3 || (endaddr >> 30) != 0x3);
+-
+ 	if (pad_id == IMAGE_PAD) {
+ 		reg_write(dev, UNICAM_IBSA0, dmaaddr);
+ 		reg_write(dev, UNICAM_IBEA0, endaddr);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0263-media-i2c-tc358743-Only-allow-supported-pixel-fmts-i.patch b/target/linux/bcm27xx/patches-6.1/950-0263-media-i2c-tc358743-Only-allow-supported-pixel-fmts-i.patch
new file mode 100644
index 00000000000000..ea1dfb28c1aba7
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0263-media-i2c-tc358743-Only-allow-supported-pixel-fmts-i.patch
@@ -0,0 +1,30 @@
+From a415eed168882c2428acb36cc639ceb7e929c276 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 10 Jul 2020 12:40:50 +0100
+Subject: [PATCH] media: i2c: tc358743: Only allow supported pixel fmts
+ in set_fmt
+
+Fix commit "media: tc358743: Return an appropriate colorspace from
+tc358743_set_fmt" to ensure that the format passed in to set_fmt
+is checked to be valid, and reset to the current format if not.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/tc358743.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -1708,8 +1708,10 @@ static int tc358743_set_fmt(struct v4l2_
+ 	u32 code = format->format.code; /* is overwritten by get_fmt */
+ 	int ret = tc358743_get_fmt(sd, sd_state, format);
+ 
+-	format->format.code = code;
+-	format->format.colorspace = tc358743_g_colorspace(code);
++	if (code == MEDIA_BUS_FMT_RGB888_1X24 ||
++	    code == MEDIA_BUS_FMT_UYVY8_1X16)
++		format->format.code = code;
++	format->format.colorspace = tc358743_g_colorspace(format->format.code);
+ 
+ 	if (ret)
+ 		return ret;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0264-media-bcm2835-unicam-Always-service-interrupts.patch b/target/linux/bcm27xx/patches-6.1/950-0264-media-bcm2835-unicam-Always-service-interrupts.patch
new file mode 100644
index 00000000000000..50f5c98dd69078
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0264-media-bcm2835-unicam-Always-service-interrupts.patch
@@ -0,0 +1,51 @@
+From 15d651ca4f29021ed3686aea6807752e47112305 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 13 May 2020 18:28:27 +0100
+Subject: [PATCH] media: bcm2835-unicam: Always service interrupts
+
+From when bringing up the driver, there was a check in the isr
+to ignore interrupts (claiming them handled) should the driver
+not be streaming.
+
+The VPU now will not register a camera driver if it finds a
+CSI2 node enabled in device tree, therefore this flawed check is
+redundant.
+
+https://github.com/raspberrypi/linux/issues/3602
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 15 ---------------
+ 1 file changed, 15 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -784,12 +784,6 @@ static bool unicam_all_nodes_streaming(s
+ 	return ret;
+ }
+ 
+-static bool unicam_all_nodes_disabled(struct unicam_device *dev)
+-{
+-	return !dev->node[IMAGE_PAD].streaming &&
+-	       !dev->node[METADATA_PAD].streaming;
+-}
+-
+ static void unicam_queue_event_sof(struct unicam_device *unicam)
+ {
+ 	struct v4l2_event event = {
+@@ -817,15 +811,6 @@ static irqreturn_t unicam_isr(int irq, v
+ 	u32 ista, sta;
+ 	u64 ts;
+ 
+-	/*
+-	 * Don't service interrupts if not streaming.
+-	 * Avoids issues if the VPU should enable the
+-	 * peripheral without the kernel knowing (that
+-	 * shouldn't happen, but causes issues if it does).
+-	 */
+-	if (unicam_all_nodes_disabled(unicam))
+-		return IRQ_NONE;
+-
+ 	sta = reg_read(unicam, UNICAM_STA);
+ 	/* Write value back to clear the interrupts */
+ 	reg_write(unicam, UNICAM_STA, sta);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0265-media-bcm2835-unicam-Fix-uninitialized-warning.patch b/target/linux/bcm27xx/patches-6.1/950-0265-media-bcm2835-unicam-Fix-uninitialized-warning.patch
new file mode 100644
index 00000000000000..4df4b10be6b850
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0265-media-bcm2835-unicam-Fix-uninitialized-warning.patch
@@ -0,0 +1,21 @@
+From 7c817c47d356e4654a73c870e6d1ec866a3566b6 Mon Sep 17 00:00:00 2001
+From: Jacko Dirks <jdirks.linuxdev@gmail.com>
+Date: Tue, 5 May 2020 14:33:31 +0200
+Subject: [PATCH] media: bcm2835: unicam: Fix uninitialized warning
+
+Signed-off-by: Jacko Dirks <jdirks.linuxdev@gmail.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -1006,7 +1006,7 @@ const struct unicam_fmt *get_first_suppo
+ 	struct v4l2_subdev_mbus_code_enum mbus_code;
+ 	const struct unicam_fmt *fmt = NULL;
+ 	unsigned int i;
+-	int ret;
++	int ret = 0;
+ 
+ 	for (i = 0; ret != -EINVAL && ret != -ENOIOCTLCMD; ++i) {
+ 		memset(&mbus_code, 0, sizeof(mbus_code));
diff --git a/target/linux/bcm27xx/patches-6.1/950-0266-media-bcm2835-unicam-Fixup-review-comments-from-Hans.patch b/target/linux/bcm27xx/patches-6.1/950-0266-media-bcm2835-unicam-Fixup-review-comments-from-Hans.patch
new file mode 100644
index 00000000000000..176a3a557f750a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0266-media-bcm2835-unicam-Fixup-review-comments-from-Hans.patch
@@ -0,0 +1,215 @@
+From b7c453de65310924a81a9fb902727a7d8f39c36b Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 23 Jun 2020 15:14:05 +0100
+Subject: [PATCH] media: bcm2835-unicam: Fixup review comments from
+ Hans.
+
+Updates the driver based on the upstream review comments from
+Hans Verkuil at https://patchwork.linuxtv.org/patch/63531/
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 70 ++++++++-----------
+ 1 file changed, 31 insertions(+), 39 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+- * BCM2835 Unicam Capture Driver
++ * BCM283x / BCM271x Unicam Capture Driver
+  *
+  * Copyright (C) 2017-2020 - Raspberry Pi (Trading) Ltd.
+  *
+@@ -573,9 +573,8 @@ static const struct unicam_fmt *find_for
+ 	return NULL;
+ }
+ 
+-static inline unsigned int bytes_per_line(u32 width,
+-					  const struct unicam_fmt *fmt,
+-					  u32 v4l2_fourcc)
++static unsigned int bytes_per_line(u32 width, const struct unicam_fmt *fmt,
++				   u32 v4l2_fourcc)
+ {
+ 	if (v4l2_fourcc == fmt->repacked_fourcc)
+ 		/* Repacking always goes to 16bpp */
+@@ -720,7 +719,7 @@ static void unicam_wr_dma_addr(struct un
+ 	}
+ }
+ 
+-static inline unsigned int unicam_get_lines_done(struct unicam_device *dev)
++static unsigned int unicam_get_lines_done(struct unicam_device *dev)
+ {
+ 	dma_addr_t start_addr, cur_addr;
+ 	unsigned int stride = dev->node[IMAGE_PAD].v_fmt.fmt.pix.bytesperline;
+@@ -734,7 +733,7 @@ static inline unsigned int unicam_get_li
+ 	return (unsigned int)(cur_addr - start_addr) / stride;
+ }
+ 
+-static inline void unicam_schedule_next_buffer(struct unicam_node *node)
++static void unicam_schedule_next_buffer(struct unicam_node *node)
+ {
+ 	struct unicam_device *dev = node->dev;
+ 	struct unicam_buffer *buf;
+@@ -753,7 +752,7 @@ static inline void unicam_schedule_next_
+ 	unicam_wr_dma_addr(dev, addr, size, node->pad_id);
+ }
+ 
+-static inline void unicam_schedule_dummy_buffer(struct unicam_node *node)
++static void unicam_schedule_dummy_buffer(struct unicam_node *node)
+ {
+ 	struct unicam_device *dev = node->dev;
+ 
+@@ -765,8 +764,8 @@ static inline void unicam_schedule_dummy
+ 	node->next_frm = NULL;
+ }
+ 
+-static inline void unicam_process_buffer_complete(struct unicam_node *node,
+-						  unsigned int sequence)
++static void unicam_process_buffer_complete(struct unicam_node *node,
++					   unsigned int sequence)
+ {
+ 	node->cur_frm->vb.field = node->m_fmt.field;
+ 	node->cur_frm->vb.sequence = sequence;
+@@ -774,16 +773,6 @@ static inline void unicam_process_buffer
+ 	vb2_buffer_done(&node->cur_frm->vb.vb2_buf, VB2_BUF_STATE_DONE);
+ }
+ 
+-static bool unicam_all_nodes_streaming(struct unicam_device *dev)
+-{
+-	bool ret;
+-
+-	ret = dev->node[IMAGE_PAD].open && dev->node[IMAGE_PAD].streaming;
+-	ret &= !dev->node[METADATA_PAD].open ||
+-	       dev->node[METADATA_PAD].streaming;
+-	return ret;
+-}
+-
+ static void unicam_queue_event_sof(struct unicam_device *unicam)
+ {
+ 	struct v4l2_event event = {
+@@ -906,8 +895,8 @@ static int unicam_querycap(struct file *
+ 	struct unicam_node *node = video_drvdata(file);
+ 	struct unicam_device *dev = node->dev;
+ 
+-	strlcpy(cap->driver, UNICAM_MODULE_NAME, sizeof(cap->driver));
+-	strlcpy(cap->card, UNICAM_MODULE_NAME, sizeof(cap->card));
++	strscpy(cap->driver, UNICAM_MODULE_NAME, sizeof(cap->driver));
++	strscpy(cap->card, UNICAM_MODULE_NAME, sizeof(cap->card));
+ 
+ 	snprintf(cap->bus_info, sizeof(cap->bus_info),
+ 		 "platform:%s", dev_name(&dev->pdev->dev));
+@@ -1000,8 +989,8 @@ static int unicam_g_fmt_vid_cap(struct f
+ 	return 0;
+ }
+ 
+-static
+-const struct unicam_fmt *get_first_supported_format(struct unicam_device *dev)
++static const struct unicam_fmt *
++get_first_supported_format(struct unicam_device *dev)
+ {
+ 	struct v4l2_subdev_mbus_code_enum mbus_code;
+ 	const struct unicam_fmt *fmt = NULL;
+@@ -1591,7 +1580,8 @@ static void unicam_disable(struct unicam
+ 	clk_write(dev, 0);
+ }
+ 
+-static void unicam_return_buffers(struct unicam_node *node)
++static void unicam_return_buffers(struct unicam_node *node,
++				  enum vb2_buffer_state state)
+ {
+ 	struct unicam_buffer *buf, *tmp;
+ 	unsigned long flags;
+@@ -1599,15 +1589,15 @@ static void unicam_return_buffers(struct
+ 	spin_lock_irqsave(&node->dma_queue_lock, flags);
+ 	list_for_each_entry_safe(buf, tmp, &node->dma_queue, list) {
+ 		list_del(&buf->list);
+-		vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
++		vb2_buffer_done(&buf->vb.vb2_buf, state);
+ 	}
+ 
+ 	if (node->cur_frm)
+ 		vb2_buffer_done(&node->cur_frm->vb.vb2_buf,
+-				VB2_BUF_STATE_ERROR);
++				state);
+ 	if (node->next_frm && node->cur_frm != node->next_frm)
+ 		vb2_buffer_done(&node->next_frm->vb.vb2_buf,
+-				VB2_BUF_STATE_ERROR);
++				state);
+ 
+ 	node->cur_frm = NULL;
+ 	node->next_frm = NULL;
+@@ -1624,7 +1614,13 @@ static int unicam_start_streaming(struct
+ 	int ret;
+ 
+ 	node->streaming = true;
+-	if (!unicam_all_nodes_streaming(dev)) {
++	if (!(dev->node[IMAGE_PAD].open && dev->node[IMAGE_PAD].streaming &&
++	      (!dev->node[METADATA_PAD].open ||
++	       dev->node[METADATA_PAD].streaming))) {
++		/*
++		 * Metadata pad must be enabled before image pad if it is
++		 * wanted.
++		 */
+ 		unicam_dbg(3, dev, "Not all nodes are streaming yet.");
+ 		return 0;
+ 	}
+@@ -1728,7 +1724,7 @@ err_vpu_clock:
+ err_pm_put:
+ 	unicam_runtime_put(dev);
+ err_streaming:
+-	unicam_return_buffers(node);
++	unicam_return_buffers(node, VB2_BUF_STATE_QUEUED);
+ 	node->streaming = false;
+ 
+ 	return ret;
+@@ -1773,7 +1769,7 @@ static void unicam_stop_streaming(struct
+ 	}
+ 
+ 	/* Clear all queued buffers for the node */
+-	unicam_return_buffers(node);
++	unicam_return_buffers(node, VB2_BUF_STATE_ERROR);
+ }
+ 
+ static int unicam_enum_input(struct file *file, void *priv,
+@@ -1791,14 +1787,13 @@ static int unicam_enum_input(struct file
+ 		inp->std = 0;
+ 	} else if (v4l2_subdev_has_op(dev->sensor, video, s_std)) {
+ 		inp->capabilities = V4L2_IN_CAP_STD;
+-		if (v4l2_subdev_call(dev->sensor, video, g_tvnorms, &inp->std)
+-					< 0)
++		if (v4l2_subdev_call(dev->sensor, video, g_tvnorms, &inp->std) < 0)
+ 			inp->std = V4L2_STD_ALL;
+ 	} else {
+ 		inp->capabilities = 0;
+ 		inp->std = 0;
+ 	}
+-	sprintf(inp->name, "Camera 0");
++	snprintf(inp->name, sizeof(inp->name), "Camera 0");
+ 	return 0;
+ }
+ 
+@@ -2027,6 +2022,9 @@ static int unicam_s_dv_timings(struct fi
+ 	ret = v4l2_subdev_call(dev->sensor, video, g_dv_timings,
+ 			       &current_timings);
+ 
++	if (ret < 0)
++		return ret;
++
+ 	if (v4l2_match_dv_timings(timings, &current_timings, 0, false))
+ 		return 0;
+ 
+@@ -2457,12 +2455,6 @@ static int register_node(struct unicam_d
+ 		unicam_err(unicam, "Unable to allocate dummy buffer.\n");
+ 		return -ENOMEM;
+ 	}
+-
+-	if (pad_id == METADATA_PAD) {
+-		v4l2_disable_ioctl(vdev, VIDIOC_DQEVENT);
+-		v4l2_disable_ioctl(vdev, VIDIOC_SUBSCRIBE_EVENT);
+-		v4l2_disable_ioctl(vdev, VIDIOC_UNSUBSCRIBE_EVENT);
+-	}
+ 	if (pad_id == METADATA_PAD ||
+ 	    !v4l2_subdev_has_op(unicam->sensor, video, s_std)) {
+ 		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_STD);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0267-media-bcm2835-unicam-Retain-packing-information-on-G.patch b/target/linux/bcm27xx/patches-6.1/950-0267-media-bcm2835-unicam-Retain-packing-information-on-G.patch
new file mode 100644
index 00000000000000..73242cbcf7f46c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0267-media-bcm2835-unicam-Retain-packing-information-on-G.patch
@@ -0,0 +1,48 @@
+From 3684d32820cdf7f9ca10a1cfd6236bfcaaf1c6bd Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 19 May 2020 11:46:47 +0100
+Subject: [PATCH] media: bcm2835-unicam: Retain packing information on
+ G_FMT
+
+The change to retrieve the pixel format always on g_fmt didn't
+check whether the native or unpacked version of the format
+had been requested, and always returned the packed one.
+Correct this so that the packing setting is retained whereever
+possible.
+
+Fixes "9d59e89 media: bcm2835-unicam: Re-fetch mbus code from subdev
+on a g_fmt call"
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -982,8 +982,23 @@ static int unicam_g_fmt_vid_cap(struct f
+ 	if (!fmt)
+ 		return -EINVAL;
+ 
+-	node->fmt = fmt;
+-	node->v_fmt.fmt.pix.pixelformat = fmt->fourcc;
++	if (node->fmt != fmt) {
++		/*
++		 * The sensor format has changed so the pixelformat needs to
++		 * be updated. Try and retain the packed/unpacked choice if
++		 * at all possible.
++		 */
++		if (node->fmt->repacked_fourcc ==
++						node->v_fmt.fmt.pix.pixelformat)
++			/* Using the repacked format */
++			node->v_fmt.fmt.pix.pixelformat = fmt->repacked_fourcc;
++		else
++			/* Using the native format */
++			node->v_fmt.fmt.pix.pixelformat = fmt->fourcc;
++
++		node->fmt = fmt;
++	}
++
+ 	*f = node->v_fmt;
+ 
+ 	return 0;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0268-media-bcm2835-unicam-change-minimum-number-of-vb2_qu.patch b/target/linux/bcm27xx/patches-6.1/950-0268-media-bcm2835-unicam-change-minimum-number-of-vb2_qu.patch
new file mode 100644
index 00000000000000..fe759d2a30c5dd
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0268-media-bcm2835-unicam-change-minimum-number-of-vb2_qu.patch
@@ -0,0 +1,28 @@
+From 44fc199145966a06d1ee06abbfb46b2a590f1b4c Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Thu, 28 May 2020 11:09:48 +0100
+Subject: [PATCH] media: bcm2835-unicam: change minimum number of
+ vb2_queue buffers to 1
+
+Since the unicam driver was modified to write to a dummy buffer when no
+user-supplied buffer is available, it can now write to and return a
+buffer even when there's only a single one. Enable this by changing the
+min_buffers_needed in the vb2_queue; it will be useful for enabling
+still captures without allocating more memory than absolutely necessary.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -2430,7 +2430,7 @@ static int register_node(struct unicam_d
+ 	q->buf_struct_size = sizeof(struct unicam_buffer);
+ 	q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
+ 	q->lock = &node->lock;
+-	q->min_buffers_needed = 2;
++	q->min_buffers_needed = 1;
+ 	q->dev = &unicam->pdev->dev;
+ 
+ 	ret = vb2_queue_init(q);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0269-staging-fbtft-Add-support-for-display-variants.patch b/target/linux/bcm27xx/patches-6.1/950-0269-staging-fbtft-Add-support-for-display-variants.patch
new file mode 100644
index 00000000000000..6ee102718b5187
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0269-staging-fbtft-Add-support-for-display-variants.patch
@@ -0,0 +1,293 @@
+From 3238d5c89f86bc368fcbbc77d0380710b0db376c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 1 Sep 2020 18:15:27 +0100
+Subject: [PATCH] staging/fbtft: Add support for display variants
+
+Display variants are intended as a replacement for the now-deleted
+fbtft_device drivers. Drivers can register additional compatible
+strings with a custom callback that can make the required changes
+to the fbtft_display structure.
+
+Start the ball rolling by adding adafruit18, adafruit18_green and
+sainsmart18 displays.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/staging/fbtft/fb_st7735r.c |  38 +++++++++-
+ drivers/staging/fbtft/fbtft-core.c |  16 ++++-
+ drivers/staging/fbtft/fbtft.h      | 112 +++++++++++++++++++----------
+ 3 files changed, 126 insertions(+), 40 deletions(-)
+
+--- a/drivers/staging/fbtft/fb_st7735r.c
++++ b/drivers/staging/fbtft/fb_st7735r.c
+@@ -16,6 +16,10 @@
+ #define DEFAULT_GAMMA   "0F 1A 0F 18 2F 28 20 22 1F 1B 23 37 00 07 02 10\n" \
+ 			"0F 1B 0F 17 33 2C 29 2E 30 30 39 3F 00 07 03 10"
+ 
++#define ADAFRUIT18_GAMMA \
++			"02 1c 07 12 37 32 29 2d 29 25 2B 39 00 01 03 10\n" \
++			"03 1d 07 06 2E 2C 29 2D 2E 2E 37 3F 00 00 02 10"
++
+ static const s16 default_init_sequence[] = {
+ 	-1, MIPI_DCS_SOFT_RESET,
+ 	-2, 150,                               /* delay */
+@@ -94,6 +98,14 @@ static void set_addr_win(struct fbtft_pa
+ 	write_reg(par, MIPI_DCS_WRITE_MEMORY_START);
+ }
+ 
++static void adafruit18_green_tab_set_addr_win(struct fbtft_par *par,
++					      int xs, int ys, int xe, int ye)
++{
++	write_reg(par, 0x2A, 0, xs + 2, 0, xe + 2);
++	write_reg(par, 0x2B, 0, ys + 1, 0, ye + 1);
++	write_reg(par, 0x2C);
++}
++
+ #define MY BIT(7)
+ #define MX BIT(6)
+ #define MV BIT(5)
+@@ -174,12 +186,36 @@ static struct fbtft_display display = {
+ 	},
+ };
+ 
+-FBTFT_REGISTER_DRIVER(DRVNAME, "sitronix,st7735r", &display);
++int variant_adafruit18(struct fbtft_display *display)
++{
++	display->gamma = ADAFRUIT18_GAMMA;
++	return 0;
++}
++
++int variant_adafruit18_green(struct fbtft_display *display)
++{
++	display->gamma = ADAFRUIT18_GAMMA;
++	display->fbtftops.set_addr_win = adafruit18_green_tab_set_addr_win;
++	return 0;
++}
++
++FBTFT_REGISTER_DRIVER_START(&display)
++FBTFT_COMPATIBLE("sitronix,st7735r")
++FBTFT_COMPATIBLE("fbtft,sainsmart18")
++FBTFT_VARIANT_COMPATIBLE("fbtft,adafruit18", variant_adafruit18)
++FBTFT_VARIANT_COMPATIBLE("fbtft,adafruit18_green", variant_adafruit18_green)
++FBTFT_REGISTER_DRIVER_END(DRVNAME, &display);
+ 
+ MODULE_ALIAS("spi:" DRVNAME);
+ MODULE_ALIAS("platform:" DRVNAME);
+ MODULE_ALIAS("spi:st7735r");
+ MODULE_ALIAS("platform:st7735r");
++MODULE_ALIAS("spi:sainsmart18");
++MODULE_ALIAS("platform:sainsmart");
++MODULE_ALIAS("spi:adafruit18");
++MODULE_ALIAS("platform:adafruit18");
++MODULE_ALIAS("spi:adafruit18_green");
++MODULE_ALIAS("platform:adafruit18_green");
+ 
+ MODULE_DESCRIPTION("FB driver for the ST7735R LCD Controller");
+ MODULE_AUTHOR("Noralf Tronnes");
+--- a/drivers/staging/fbtft/fbtft-core.c
++++ b/drivers/staging/fbtft/fbtft-core.c
+@@ -24,6 +24,8 @@
+ #include <linux/platform_device.h>
+ #include <linux/property.h>
+ #include <linux/spinlock.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
+ 
+ #include <video/mipi_display.h>
+ 
+@@ -1183,6 +1185,7 @@ static struct fbtft_platform_data *fbtft
+  * @display: Display properties
+  * @sdev: SPI device
+  * @pdev: Platform device
++ * @dt_ids: Compatible string table
+  *
+  * Allocates, initializes and registers a framebuffer
+  *
+@@ -1192,12 +1195,15 @@ static struct fbtft_platform_data *fbtft
+  */
+ int fbtft_probe_common(struct fbtft_display *display,
+ 		       struct spi_device *sdev,
+-		       struct platform_device *pdev)
++		       struct platform_device *pdev,
++		       const struct of_device_id *dt_ids)
+ {
+ 	struct device *dev;
+ 	struct fb_info *info;
+ 	struct fbtft_par *par;
+ 	struct fbtft_platform_data *pdata;
++	const struct of_device_id *match;
++	int (*variant)(struct fbtft_display *);
+ 	int ret;
+ 
+ 	if (sdev)
+@@ -1213,6 +1219,14 @@ int fbtft_probe_common(struct fbtft_disp
+ 		pdata = fbtft_properties_read(dev);
+ 		if (IS_ERR(pdata))
+ 			return PTR_ERR(pdata);
++		match = of_match_device(dt_ids, dev);
++		if (match && match->data) {
++			/* apply the variant */
++			variant = match->data;
++			ret = (*variant)(display);
++			if (ret)
++				return ret;
++		}
+ 	}
+ 
+ 	info = fbtft_framebuffer_alloc(display, dev, pdata);
+--- a/drivers/staging/fbtft/fbtft.h
++++ b/drivers/staging/fbtft/fbtft.h
+@@ -251,7 +251,8 @@ void fbtft_register_backlight(struct fbt
+ void fbtft_unregister_backlight(struct fbtft_par *par);
+ int fbtft_init_display(struct fbtft_par *par);
+ int fbtft_probe_common(struct fbtft_display *display, struct spi_device *sdev,
+-		       struct platform_device *pdev);
++		       struct platform_device *pdev,
++		       const struct of_device_id *dt_ids);
+ void fbtft_remove_common(struct device *dev, struct fb_info *info);
+ 
+ /* fbtft-io.c */
+@@ -272,42 +273,25 @@ void fbtft_write_reg8_bus9(struct fbtft_
+ void fbtft_write_reg16_bus8(struct fbtft_par *par, int len, ...);
+ void fbtft_write_reg16_bus16(struct fbtft_par *par, int len, ...);
+ 
+-#define FBTFT_DT_TABLE(_compatible)						\
+-static const struct of_device_id dt_ids[] = {					\
+-	{ .compatible = _compatible },						\
+-	{},									\
+-};										\
+-MODULE_DEVICE_TABLE(of, dt_ids);
+-
+-#define FBTFT_SPI_DRIVER(_name, _compatible, _display, _spi_ids)		\
+-										\
+-static int fbtft_driver_probe_spi(struct spi_device *spi)			\
+-{										\
+-	return fbtft_probe_common(_display, spi, NULL);				\
+-}										\
+-										\
+-static void fbtft_driver_remove_spi(struct spi_device *spi)			\
+-{										\
+-	struct fb_info *info = spi_get_drvdata(spi);				\
+-										\
+-	fbtft_remove_common(&spi->dev, info);					\
+-}										\
+-										\
+-static struct spi_driver fbtft_driver_spi_driver = {				\
+-	.driver = {								\
+-		.name = _name,							\
+-		.of_match_table = dt_ids,					\
+-	},									\
+-	.id_table = _spi_ids,							\
+-	.probe = fbtft_driver_probe_spi,					\
+-	.remove = fbtft_driver_remove_spi,					\
+-};
+-
+-#define FBTFT_REGISTER_DRIVER(_name, _compatible, _display)                \
++#define FBTFT_REGISTER_DRIVER_START(_display)                              \
++									   \
++static const struct of_device_id dt_ids[];                                 \
++									   \
++static int fbtft_driver_probe_spi(struct spi_device *spi)                  \
++{                                                                          \
++	return fbtft_probe_common(_display, spi, NULL, dt_ids);	           \
++}                                                                          \
++									   \
++static void fbtft_driver_remove_spi(struct spi_device *spi)                 \
++{                                                                          \
++	struct fb_info *info = spi_get_drvdata(spi);                       \
++									   \
++	fbtft_remove_common(&spi->dev, info);                              \
++}                                                                          \
+ 									   \
+ static int fbtft_driver_probe_pdev(struct platform_device *pdev)           \
+ {                                                                          \
+-	return fbtft_probe_common(_display, NULL, pdev);                   \
++	return fbtft_probe_common(_display, NULL, pdev, dt_ids);           \
+ }                                                                          \
+ 									   \
+ static int fbtft_driver_remove_pdev(struct platform_device *pdev)          \
+@@ -318,9 +302,30 @@ static int fbtft_driver_remove_pdev(stru
+ 	return 0;                                                          \
+ }                                                                          \
+ 									   \
+-FBTFT_DT_TABLE(_compatible)						   \
++static const struct of_device_id dt_ids[] = {
++
++#define FBTFT_COMPATIBLE(_compatible)                                      \
++	{ .compatible = _compatible },
++
++#define FBTFT_VARIANT_COMPATIBLE(_compatible, _variant)                    \
++	{ .compatible = _compatible, .data = _variant },
++
++#define FBTFT_REGISTER_DRIVER_END(_name, _display)                         \
+ 									   \
+-FBTFT_SPI_DRIVER(_name, _compatible, _display, NULL)			   \
++	{},                                                                \
++};                                                                         \
++									   \
++MODULE_DEVICE_TABLE(of, dt_ids);                                           \
++									   \
++									   \
++static struct spi_driver fbtft_driver_spi_driver = {                       \
++	.driver = {                                                        \
++		.name   = _name,                                           \
++		.of_match_table = dt_ids,                                  \
++	},                                                                 \
++	.probe  = fbtft_driver_probe_spi,                                  \
++	.remove = fbtft_driver_remove_spi,                                 \
++};                                                                         \
+ 									   \
+ static struct platform_driver fbtft_driver_platform_driver = {             \
+ 	.driver = {                                                        \
+@@ -356,18 +361,49 @@ module_exit(fbtft_driver_module_exit);
+ 
+ #define FBTFT_REGISTER_SPI_DRIVER(_name, _comp_vend, _comp_dev, _display)	\
+ 										\
+-FBTFT_DT_TABLE(_comp_vend "," _comp_dev)					\
++static const struct of_device_id dt_ids[] = {					\
++	{ .compatible = _comp_vend "," _comp_dev },				\
++	{},									\
++};										\
++										\
++static int fbtft_driver_probe_spi(struct spi_device *spi)			\
++{										\
++	return fbtft_probe_common(_display, spi, NULL, dt_ids);			\
++}										\
++										\
++static void fbtft_driver_remove_spi(struct spi_device *spi)			\
++{										\
++	struct fb_info *info = spi_get_drvdata(spi);				\
++										\
++	fbtft_remove_common(&spi->dev, info);					\
++}										\
++										\
++MODULE_DEVICE_TABLE(of, dt_ids);						\
+ 										\
+ static const struct spi_device_id spi_ids[] = {					\
+ 	{ .name = _comp_dev },							\
+ 	{},									\
+ };										\
++										\
+ MODULE_DEVICE_TABLE(spi, spi_ids);						\
+ 										\
+-FBTFT_SPI_DRIVER(_name, _comp_vend "," _comp_dev, _display, spi_ids)		\
++static struct spi_driver fbtft_driver_spi_driver = {				\
++	.driver = {								\
++		.name  = _name,							\
++		.of_match_table = dt_ids,					\
++	},									\
++	.id_table = spi_ids,							\
++	.probe  = fbtft_driver_probe_spi,					\
++	.remove = fbtft_driver_remove_spi,					\
++};										\
+ 										\
+ module_spi_driver(fbtft_driver_spi_driver);
+ 
++#define FBTFT_REGISTER_DRIVER(_name, _compatible, _display)                \
++	FBTFT_REGISTER_DRIVER_START(_display)                              \
++	FBTFT_COMPATIBLE(_compatible)                                      \
++	FBTFT_REGISTER_DRIVER_END(_name, _display)
++
+ /* Debug macros */
+ 
+ /* shorthand debug levels */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0270-net-bcmgenet-Reset-RBUF-on-first-open.patch b/target/linux/bcm27xx/patches-6.1/950-0270-net-bcmgenet-Reset-RBUF-on-first-open.patch
new file mode 100644
index 00000000000000..0c71db2d00ffb1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0270-net-bcmgenet-Reset-RBUF-on-first-open.patch
@@ -0,0 +1,70 @@
+From e857a27d5bca6269cea7a0ca0058aa8fffe90a83 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 25 Sep 2020 15:07:23 +0100
+Subject: [PATCH] net: bcmgenet: Reset RBUF on first open
+
+If the RBUF logic is not reset when the kernel starts then there
+may be some data left over from any network boot loader. If the
+64-byte packet headers are enabled then this can be fatal.
+
+Extend bcmgenet_dma_disable to do perform the reset, but not when
+called from bcmgenet_resume in order to preserve a wake packet.
+
+N.B. This different handling of resume is just based on a hunch -
+why else wouldn't one reset the RBUF as well as the TBUF? If this
+isn't the case then it's easy to change the patch to make the RBUF
+reset unconditional.
+
+See: https://github.com/raspberrypi/linux/issues/3850
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -3304,7 +3304,7 @@ static void bcmgenet_get_hw_addr(struct
+ }
+ 
+ /* Returns a reusable dma control register value */
+-static u32 bcmgenet_dma_disable(struct bcmgenet_priv *priv)
++static u32 bcmgenet_dma_disable(struct bcmgenet_priv *priv, bool flush_rx)
+ {
+ 	unsigned int i;
+ 	u32 reg;
+@@ -3329,6 +3329,14 @@ static u32 bcmgenet_dma_disable(struct b
+ 	udelay(10);
+ 	bcmgenet_umac_writel(priv, 0, UMAC_TX_FLUSH);
+ 
++	if (flush_rx) {
++	    reg = bcmgenet_rbuf_ctrl_get(priv);
++	    bcmgenet_rbuf_ctrl_set(priv, reg | BIT(0));
++	    udelay(10);
++	    bcmgenet_rbuf_ctrl_set(priv, reg);
++	    udelay(10);
++	}
++
+ 	return dma_ctrl;
+ }
+ 
+@@ -3392,8 +3400,8 @@ static int bcmgenet_open(struct net_devi
+ 
+ 	bcmgenet_set_hw_addr(priv, dev->dev_addr);
+ 
+-	/* Disable RX/TX DMA and flush TX queues */
+-	dma_ctrl = bcmgenet_dma_disable(priv);
++	/* Disable RX/TX DMA and flush TX and RX queues */
++	dma_ctrl = bcmgenet_dma_disable(priv, true);
+ 
+ 	/* Reinitialize TDMA and RDMA and SW housekeeping */
+ 	ret = bcmgenet_init_dma(priv);
+@@ -4267,7 +4275,7 @@ static int bcmgenet_resume(struct device
+ 			bcmgenet_hfb_create_rxnfc_filter(priv, rule);
+ 
+ 	/* Disable RX/TX DMA and flush TX queues */
+-	dma_ctrl = bcmgenet_dma_disable(priv);
++	dma_ctrl = bcmgenet_dma_disable(priv, false);
+ 
+ 	/* Reinitialize TDMA and RDMA and SW housekeeping */
+ 	ret = bcmgenet_init_dma(priv);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0271-char-Add-broadcom-char-drivers-back-to-build-files.patch b/target/linux/bcm27xx/patches-6.1/950-0271-char-Add-broadcom-char-drivers-back-to-build-files.patch
new file mode 100644
index 00000000000000..f936a15df90f9c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0271-char-Add-broadcom-char-drivers-back-to-build-files.patch
@@ -0,0 +1,30 @@
+From 9c796f369fc2b58287344ee4600f62e6710f937b Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Mon, 28 Sep 2020 20:23:30 +0100
+Subject: [PATCH] char: Add broadcom char drivers back to build files
+
+See: https://github.com/raspberrypi/linux/issues/3875
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+---
+ drivers/char/Kconfig  | 2 ++
+ drivers/char/Makefile | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/char/Kconfig
++++ b/drivers/char/Kconfig
+@@ -5,6 +5,8 @@
+ 
+ menu "Character devices"
+ 
++source "drivers/char/broadcom/Kconfig"
++
+ source "drivers/tty/Kconfig"
+ 
+ config TTY_PRINTK
+--- a/drivers/char/Makefile
++++ b/drivers/char/Makefile
+@@ -45,3 +45,4 @@ obj-$(CONFIG_PS3_FLASH)		+= ps3flash.o
+ obj-$(CONFIG_XILLYBUS_CLASS)	+= xillybus/
+ obj-$(CONFIG_POWERNV_OP_PANEL)	+= powernv-op-panel.o
+ obj-$(CONFIG_ADI)		+= adi.o
++obj-$(CONFIG_BRCM_CHAR_DRIVERS) += broadcom/
diff --git a/target/linux/bcm27xx/patches-6.1/950-0272-staging-bcm2835-camera-Replace-deprecated-V4L2_PIX_F.patch b/target/linux/bcm27xx/patches-6.1/950-0272-staging-bcm2835-camera-Replace-deprecated-V4L2_PIX_F.patch
new file mode 100644
index 00000000000000..482e99adae1d03
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0272-staging-bcm2835-camera-Replace-deprecated-V4L2_PIX_F.patch
@@ -0,0 +1,30 @@
+From 6201ef98a10f52c12d98a0d747154d60a305c2b9 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 8 Oct 2020 15:35:14 +0100
+Subject: [PATCH] staging: bcm2835-camera: Replace deprecated
+ V4L2_PIX_FMT_BGR32
+
+V4L2_PIX_FMT_BGR32 is deprecated as it is ambiguous over where
+the alpha byte is. Cheese/GStreamer appear to get it wrong for
+one, and qv4l2 gets red and blue swapped.
+
+Swap to the newer V4L2_PIX_FMT_BGRX32 format.
+
+https://www.raspberrypi.org/forums/viewtopic.php?f=38&t=267736&p=1738912
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+@@ -176,7 +176,7 @@ static struct mmal_fmt formats[] = {
+ 		.ybbp = 1,
+ 		.remove_padding = 1,
+ 	}, {
+-		.fourcc = V4L2_PIX_FMT_BGR32,
++		.fourcc = V4L2_PIX_FMT_BGRX32,
+ 		.mmal = MMAL_ENCODING_BGRA,
+ 		.depth = 32,
+ 		.mmal_component = COMP_CAMERA,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0273-staging-vc04_services-Add-new-vc-sm-cma-driver.patch b/target/linux/bcm27xx/patches-6.1/950-0273-staging-vc04_services-Add-new-vc-sm-cma-driver.patch
new file mode 100644
index 00000000000000..e45d69a6db84f8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0273-staging-vc04_services-Add-new-vc-sm-cma-driver.patch
@@ -0,0 +1,2961 @@
+From 152e25fc6283a130332df7908cc45d7fa3bfae19 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 8 Oct 2020 18:49:52 +0100
+Subject: [PATCH] staging: vc04_services: Add new vc-sm-cma driver
+
+Add Broadcom VideoCore Shared Memory support.
+
+This new driver allows contiguous memory blocks to be imported
+into the VideoCore VPU memory map, and manages the lifetime of
+those objects, only releasing the source dmabuf once the VPU has
+confirmed it has finished with it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: vcsm-cma: Fix memory leak from not detaching dmabuf
+
+When importing there was a missing call to detach the buffer,
+so each import leaked the sg table entry.
+
+Actually the release process for both locally allocated and
+imported buffers is identical, so fix them to both use the same
+function.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/vc-sm-cma: Avoid log spamming on Pi0/1 over cache alias.
+
+Pi 0/1 use the 0x80000000 cache alias as the ARM also sees the world
+through the VPU L2 cache.
+vc-sm-cma was trying to ensure it was in an uncached alias (0xc), and
+complaining on every allocation if it weren't. Reduce this logging.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+vc-sm-cma: Restore correct cache maintainance operations
+
+We have been using the more expensive flush operations rather than
+invalidate and clean since kernel rpi-5.9.y
+
+These are exposed with:
+52f1453513ba95084ab811a030032fe605b0cbe2 Re-expose some dmi APIs for use in VCSM
+
+But I believe that commit was dropped when (non-cma) vc-sm was dropped,
+and didn't get updated when the commit was restored
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+staging: vc04_services: Fix clang14 warning
+
+Insert a break to fix a fallthrough warning from clang14. Since the
+fallthrough was to another break, this is a cosmetic change.
+
+See: https://github.com/raspberrypi/linux/issues/5078
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/staging/vc04_services/Kconfig         |    2 +
+ drivers/staging/vc04_services/Makefile        |    1 +
+ .../include/linux/broadcom/vc_sm_cma_ioctl.h  |  114 ++
+ .../staging/vc04_services/vc-sm-cma/Kconfig   |   10 +
+ .../staging/vc04_services/vc-sm-cma/Makefile  |   12 +
+ drivers/staging/vc04_services/vc-sm-cma/TODO  |    1 +
+ .../staging/vc04_services/vc-sm-cma/vc_sm.c   | 1716 +++++++++++++++++
+ .../staging/vc04_services/vc-sm-cma/vc_sm.h   |   84 +
+ .../vc04_services/vc-sm-cma/vc_sm_cma_vchi.c  |  505 +++++
+ .../vc04_services/vc-sm-cma/vc_sm_cma_vchi.h  |   63 +
+ .../vc04_services/vc-sm-cma/vc_sm_defs.h      |  297 +++
+ .../vc04_services/vc-sm-cma/vc_sm_knl.h       |   28 +
+ 12 files changed, 2833 insertions(+)
+ create mode 100644 drivers/staging/vc04_services/include/linux/broadcom/vc_sm_cma_ioctl.h
+ create mode 100644 drivers/staging/vc04_services/vc-sm-cma/Kconfig
+ create mode 100644 drivers/staging/vc04_services/vc-sm-cma/Makefile
+ create mode 100644 drivers/staging/vc04_services/vc-sm-cma/TODO
+ create mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+ create mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm.h
+ create mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c
+ create mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.h
+ create mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm_defs.h
+ create mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm_knl.h
+
+--- a/drivers/staging/vc04_services/Kconfig
++++ b/drivers/staging/vc04_services/Kconfig
+@@ -44,6 +44,8 @@ source "drivers/staging/vc04_services/bc
+ 
+ source "drivers/staging/vc04_services/bcm2835-camera/Kconfig"
+ 
++source "drivers/staging/vc04_services/vc-sm-cma/Kconfig"
++
+ source "drivers/staging/vc04_services/vchiq-mmal/Kconfig"
+ 
+ endif
+--- a/drivers/staging/vc04_services/Makefile
++++ b/drivers/staging/vc04_services/Makefile
+@@ -14,6 +14,7 @@ endif
+ obj-$(CONFIG_SND_BCM2835)		+= bcm2835-audio/
+ obj-$(CONFIG_VIDEO_BCM2835)		+= bcm2835-camera/
+ obj-$(CONFIG_BCM2835_VCHIQ_MMAL)	+= vchiq-mmal/
++obj-$(CONFIG_BCM_VC_SM_CMA)		+= vc-sm-cma/
+ 
+ ccflags-y += -I $(srctree)/$(src)/include
+ 
+--- /dev/null
++++ b/drivers/staging/vc04_services/include/linux/broadcom/vc_sm_cma_ioctl.h
+@@ -0,0 +1,114 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++
++/*
++ * Copyright 2019 Raspberry Pi (Trading) Ltd.  All rights reserved.
++ *
++ * Based on vmcs_sm_ioctl.h Copyright Broadcom Corporation.
++ */
++
++#ifndef __VC_SM_CMA_IOCTL_H
++#define __VC_SM_CMA_IOCTL_H
++
++/* ---- Include Files ---------------------------------------------------- */
++
++#if defined(__KERNEL__)
++#include <linux/types.h>	/* Needed for standard types */
++#else
++#include <stdint.h>
++#endif
++
++#include <linux/ioctl.h>
++
++/* ---- Constants and Types ---------------------------------------------- */
++
++#define VC_SM_CMA_RESOURCE_NAME               32
++#define VC_SM_CMA_RESOURCE_NAME_DEFAULT       "sm-host-resource"
++
++/* Type define used to create unique IOCTL number */
++#define VC_SM_CMA_MAGIC_TYPE                  'J'
++
++/* IOCTL commands on /dev/vc-sm-cma */
++enum vc_sm_cma_cmd_e {
++	VC_SM_CMA_CMD_ALLOC = 0x5A,	/* Start at 0x5A arbitrarily */
++
++	VC_SM_CMA_CMD_IMPORT_DMABUF,
++
++	VC_SM_CMA_CMD_CLEAN_INVALID2,
++
++	VC_SM_CMA_CMD_LAST	/* Do not delete */
++};
++
++/* Cache type supported, conveniently matches the user space definition in
++ * user-vcsm.h.
++ */
++enum vc_sm_cma_cache_e {
++	VC_SM_CMA_CACHE_NONE,
++	VC_SM_CMA_CACHE_HOST,
++	VC_SM_CMA_CACHE_VC,
++	VC_SM_CMA_CACHE_BOTH,
++};
++
++/* IOCTL Data structures */
++struct vc_sm_cma_ioctl_alloc {
++	/* user -> kernel */
++	__u32 size;
++	__u32 num;
++	__u32 cached;		/* enum vc_sm_cma_cache_e */
++	__u32 pad;
++	__u8 name[VC_SM_CMA_RESOURCE_NAME];
++
++	/* kernel -> user */
++	__s32 handle;
++	__u32 vc_handle;
++	__u64 dma_addr;
++};
++
++struct vc_sm_cma_ioctl_import_dmabuf {
++	/* user -> kernel */
++	__s32 dmabuf_fd;
++	__u32 cached;		/* enum vc_sm_cma_cache_e */
++	__u8 name[VC_SM_CMA_RESOURCE_NAME];
++
++	/* kernel -> user */
++	__s32 handle;
++	__u32 vc_handle;
++	__u32 size;
++	__u32 pad;
++	__u64 dma_addr;
++};
++
++/*
++ * Cache functions to be set to struct vc_sm_cma_ioctl_clean_invalid2
++ * invalidate_mode.
++ */
++#define VC_SM_CACHE_OP_NOP       0x00
++#define VC_SM_CACHE_OP_INV       0x01
++#define VC_SM_CACHE_OP_CLEAN     0x02
++#define VC_SM_CACHE_OP_FLUSH     0x03
++
++struct vc_sm_cma_ioctl_clean_invalid2 {
++	__u32 op_count;
++	__u32 pad;
++	struct vc_sm_cma_ioctl_clean_invalid_block {
++		__u32 invalidate_mode;
++		__u32 block_count;
++		void *  __user start_address;
++		__u32 block_size;
++		__u32 inter_block_stride;
++	} s[0];
++};
++
++/* IOCTL numbers */
++#define VC_SM_CMA_IOCTL_MEM_ALLOC\
++	_IOR(VC_SM_CMA_MAGIC_TYPE, VC_SM_CMA_CMD_ALLOC,\
++	 struct vc_sm_cma_ioctl_alloc)
++
++#define VC_SM_CMA_IOCTL_MEM_IMPORT_DMABUF\
++	_IOR(VC_SM_CMA_MAGIC_TYPE, VC_SM_CMA_CMD_IMPORT_DMABUF,\
++	 struct vc_sm_cma_ioctl_import_dmabuf)
++
++#define VC_SM_CMA_IOCTL_MEM_CLEAN_INVALID2\
++	_IOR(VC_SM_CMA_MAGIC_TYPE, VC_SM_CMA_CMD_CLEAN_INVALID2,\
++	 struct vc_sm_cma_ioctl_clean_invalid2)
++
++#endif /* __VC_SM_CMA_IOCTL_H */
+--- /dev/null
++++ b/drivers/staging/vc04_services/vc-sm-cma/Kconfig
+@@ -0,0 +1,10 @@
++config BCM_VC_SM_CMA
++	tristate "VideoCore Shared Memory (CMA) driver"
++	select BCM2835_VCHIQ
++	select RBTREE
++	select DMA_SHARED_BUFFER
++	help
++	  Say Y here to enable the shared memory interface that
++	  supports sharing dmabufs with VideoCore.
++	  This operates over the VCHIQ interface to a service
++	  running on VideoCore.
+--- /dev/null
++++ b/drivers/staging/vc04_services/vc-sm-cma/Makefile
+@@ -0,0 +1,12 @@
++ccflags-y += \
++	-I$(srctree)/$(src)/../ \
++	-I$(srctree)/$(src)/../interface/vchiq_arm\
++	-I$(srctree)/$(src)/../include
++
++ccflags-y += \
++	-D__VCCOREVER__=0
++
++vc-sm-cma-$(CONFIG_BCM_VC_SM_CMA) := \
++	vc_sm.o vc_sm_cma_vchi.o
++
++obj-$(CONFIG_BCM_VC_SM_CMA) += vc-sm-cma.o
+--- /dev/null
++++ b/drivers/staging/vc04_services/vc-sm-cma/TODO
+@@ -0,0 +1 @@
++No currently outstanding tasks except some clean-up.
+--- /dev/null
++++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+@@ -0,0 +1,1716 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * VideoCore Shared Memory driver using CMA.
++ *
++ * Copyright: 2018, Raspberry Pi (Trading) Ltd
++ * Dave Stevenson <dave.stevenson@raspberrypi.org>
++ *
++ * Based on vmcs_sm driver from Broadcom Corporation for some API,
++ * and taking some code for buffer allocation and dmabuf handling from
++ * videobuf2.
++ *
++ *
++ * This driver has 3 main uses:
++ * 1) Allocating buffers for the kernel or userspace that can be shared with the
++ *    VPU.
++ * 2) Importing dmabufs from elsewhere for sharing with the VPU.
++ * 3) Allocating buffers for use by the VPU.
++ *
++ * In the first and second cases the native handle is a dmabuf. Releasing the
++ * resource inherently comes from releasing the dmabuf, and this will trigger
++ * unmapping on the VPU. The underlying allocation and our buffer structure are
++ * retained until the VPU has confirmed that it has finished with it.
++ *
++ * For the VPU allocations the VPU is responsible for triggering the release,
++ * and therefore the released message decrements the dma_buf refcount (with the
++ * VPU mapping having already been marked as released).
++ */
++
++/* ---- Include Files ----------------------------------------------------- */
++#include <linux/cdev.h>
++#include <linux/device.h>
++#include <linux/debugfs.h>
++#include <linux/dma-mapping.h>
++#include <linux/dma-buf.h>
++#include <linux/errno.h>
++#include <linux/fs.h>
++#include <linux/kernel.h>
++#include <linux/list.h>
++#include <linux/miscdevice.h>
++#include <linux/module.h>
++#include <linux/mm.h>
++#include <linux/of_device.h>
++#include <linux/platform_device.h>
++#include <linux/proc_fs.h>
++#include <linux/slab.h>
++#include <linux/seq_file.h>
++#include <linux/syscalls.h>
++#include <linux/types.h>
++#include <asm/cacheflush.h>
++
++#include "vchiq_connected.h"
++#include "vc_sm_cma_vchi.h"
++
++#include "vc_sm.h"
++#include "vc_sm_knl.h"
++#include <linux/broadcom/vc_sm_cma_ioctl.h>
++
++MODULE_IMPORT_NS(DMA_BUF);
++
++/* ---- Private Constants and Types --------------------------------------- */
++
++#define DEVICE_NAME		"vcsm-cma"
++#define DEVICE_MINOR		0
++
++#define VC_SM_RESOURCE_NAME_DEFAULT       "sm-host-resource"
++
++#define VC_SM_DIR_ROOT_NAME	"vcsm-cma"
++#define VC_SM_STATE		"state"
++
++/* Private file data associated with each opened device. */
++struct vc_sm_privdata_t {
++	pid_t pid;                      /* PID of creator. */
++
++	int restart_sys;		/* Tracks restart on interrupt. */
++	enum vc_sm_msg_type int_action;	/* Interrupted action. */
++	u32 int_trans_id;		/* Interrupted transaction. */
++};
++
++typedef int (*VC_SM_SHOW) (struct seq_file *s, void *v);
++struct sm_pde_t {
++	VC_SM_SHOW show;          /* Debug fs function hookup. */
++	struct dentry *dir_entry; /* Debug fs directory entry. */
++	void *priv_data;          /* Private data */
++};
++
++/* Global state information. */
++struct sm_state_t {
++	struct platform_device *pdev;
++
++	struct miscdevice misc_dev;
++
++	struct sm_instance *sm_handle;	/* Handle for videocore service. */
++
++	spinlock_t kernelid_map_lock;	/* Spinlock protecting kernelid_map */
++	struct idr kernelid_map;
++
++	struct mutex map_lock;          /* Global map lock. */
++	struct list_head buffer_list;	/* List of buffer. */
++
++	struct vc_sm_privdata_t *data_knl;  /* Kernel internal data tracking. */
++	struct vc_sm_privdata_t *vpu_allocs; /* All allocations from the VPU */
++	struct dentry *dir_root;	/* Debug fs entries root. */
++	struct sm_pde_t dir_state;	/* Debug fs entries state sub-tree. */
++
++	bool require_released_callback;	/* VPU will send a released msg when it
++					 * has finished with a resource.
++					 */
++	u32 int_trans_id;		/* Interrupted transaction. */
++};
++
++struct vc_sm_dma_buf_attachment {
++	struct device *dev;
++	struct sg_table sg_table;
++	struct list_head list;
++	enum dma_data_direction	dma_dir;
++};
++
++/* ---- Private Variables ----------------------------------------------- */
++
++static struct sm_state_t *sm_state;
++static int sm_inited;
++
++/* ---- Private Function Prototypes -------------------------------------- */
++
++/* ---- Private Functions ------------------------------------------------ */
++
++static int get_kernel_id(struct vc_sm_buffer *buffer)
++{
++	int handle;
++
++	spin_lock(&sm_state->kernelid_map_lock);
++	handle = idr_alloc(&sm_state->kernelid_map, buffer, 0, 0, GFP_KERNEL);
++	spin_unlock(&sm_state->kernelid_map_lock);
++
++	return handle;
++}
++
++static struct vc_sm_buffer *lookup_kernel_id(int handle)
++{
++	return idr_find(&sm_state->kernelid_map, handle);
++}
++
++static void free_kernel_id(int handle)
++{
++	spin_lock(&sm_state->kernelid_map_lock);
++	idr_remove(&sm_state->kernelid_map, handle);
++	spin_unlock(&sm_state->kernelid_map_lock);
++}
++
++static int vc_sm_cma_seq_file_show(struct seq_file *s, void *v)
++{
++	struct sm_pde_t *sm_pde;
++
++	sm_pde = (struct sm_pde_t *)(s->private);
++
++	if (sm_pde && sm_pde->show)
++		sm_pde->show(s, v);
++
++	return 0;
++}
++
++static int vc_sm_cma_single_open(struct inode *inode, struct file *file)
++{
++	return single_open(file, vc_sm_cma_seq_file_show, inode->i_private);
++}
++
++static const struct file_operations vc_sm_cma_debug_fs_fops = {
++	.open = vc_sm_cma_single_open,
++	.read = seq_read,
++	.llseek = seq_lseek,
++	.release = single_release,
++};
++
++static int vc_sm_cma_global_state_show(struct seq_file *s, void *v)
++{
++	struct vc_sm_buffer *resource = NULL;
++	int resource_count = 0;
++
++	if (!sm_state)
++		return 0;
++
++	seq_printf(s, "\nVC-ServiceHandle     %p\n", sm_state->sm_handle);
++
++	/* Log all applicable mapping(s). */
++
++	mutex_lock(&sm_state->map_lock);
++	seq_puts(s, "\nResources\n");
++	if (!list_empty(&sm_state->buffer_list)) {
++		list_for_each_entry(resource, &sm_state->buffer_list,
++				    global_buffer_list) {
++			resource_count++;
++
++			seq_printf(s, "\nResource                %p\n",
++				   resource);
++			seq_printf(s, "           NAME         %s\n",
++				   resource->name);
++			seq_printf(s, "           SIZE         %zu\n",
++				   resource->size);
++			seq_printf(s, "           DMABUF       %p\n",
++				   resource->dma_buf);
++			if (resource->imported) {
++				seq_printf(s, "           ATTACH       %p\n",
++					   resource->import.attach);
++				seq_printf(s, "           SGT          %p\n",
++					   resource->import.sgt);
++			} else {
++				seq_printf(s, "           SGT          %p\n",
++					   resource->alloc.sg_table);
++			}
++			seq_printf(s, "           DMA_ADDR     %pad\n",
++				   &resource->dma_addr);
++			seq_printf(s, "           VC_HANDLE     %08x\n",
++				   resource->vc_handle);
++			seq_printf(s, "           VC_MAPPING    %d\n",
++				   resource->vpu_state);
++		}
++	}
++	seq_printf(s, "\n\nTotal resource count:   %d\n\n", resource_count);
++
++	mutex_unlock(&sm_state->map_lock);
++
++	return 0;
++}
++
++/*
++ * Adds a buffer to the private data list which tracks all the allocated
++ * data.
++ */
++static void vc_sm_add_resource(struct vc_sm_privdata_t *privdata,
++			       struct vc_sm_buffer *buffer)
++{
++	mutex_lock(&sm_state->map_lock);
++	list_add(&buffer->global_buffer_list, &sm_state->buffer_list);
++	mutex_unlock(&sm_state->map_lock);
++
++	pr_debug("[%s]: added buffer %p (name %s, size %zu)\n",
++		 __func__, buffer, buffer->name, buffer->size);
++}
++
++/*
++ * Cleans up imported dmabuf.
++ * Should be called with mutex held.
++ */
++static void vc_sm_clean_up_dmabuf(struct vc_sm_buffer *buffer)
++{
++	if (!buffer->imported)
++		return;
++
++	/* Handle cleaning up imported dmabufs */
++	if (buffer->import.sgt) {
++		dma_buf_unmap_attachment(buffer->import.attach,
++					 buffer->import.sgt,
++					 DMA_BIDIRECTIONAL);
++		buffer->import.sgt = NULL;
++	}
++	if (buffer->import.attach) {
++		dma_buf_detach(buffer->dma_buf, buffer->import.attach);
++		buffer->import.attach = NULL;
++	}
++}
++
++/*
++ * Instructs VPU to decrement the refcount on a buffer.
++ */
++static void vc_sm_vpu_free(struct vc_sm_buffer *buffer)
++{
++	if (buffer->vc_handle && buffer->vpu_state == VPU_MAPPED) {
++		struct vc_sm_free_t free = { buffer->vc_handle, 0 };
++		int status = vc_sm_cma_vchi_free(sm_state->sm_handle, &free,
++					     &sm_state->int_trans_id);
++		if (status != 0 && status != -EINTR) {
++			pr_err("[%s]: failed to free memory on videocore (status: %u, trans_id: %u)\n",
++			       __func__, status, sm_state->int_trans_id);
++		}
++
++		if (sm_state->require_released_callback) {
++			/* Need to wait for the VPU to confirm the free. */
++
++			/* Retain a reference on this until the VPU has
++			 * released it
++			 */
++			buffer->vpu_state = VPU_UNMAPPING;
++		} else {
++			buffer->vpu_state = VPU_NOT_MAPPED;
++			buffer->vc_handle = 0;
++		}
++	}
++}
++
++/*
++ * Release an allocation.
++ * All refcounting is done via the dma buf object.
++ *
++ * Must be called with the mutex held. The function will either release the
++ * mutex (if defering the release) or destroy it. The caller must therefore not
++ * reuse the buffer on return.
++ */
++static void vc_sm_release_resource(struct vc_sm_buffer *buffer)
++{
++	pr_debug("[%s]: buffer %p (name %s, size %zu), imported %u\n",
++		 __func__, buffer, buffer->name, buffer->size,
++		 buffer->imported);
++
++	if (buffer->vc_handle) {
++		/* We've sent the unmap request but not had the response. */
++		pr_debug("[%s]: Waiting for VPU unmap response on %p\n",
++			 __func__, buffer);
++		goto defer;
++	}
++	if (buffer->in_use) {
++		/* dmabuf still in use - we await the release */
++		pr_debug("[%s]: buffer %p is still in use\n", __func__, buffer);
++		goto defer;
++	}
++
++	/* Release the allocation (whether imported dmabuf or CMA allocation) */
++	if (buffer->imported) {
++		if (buffer->import.dma_buf)
++			dma_buf_put(buffer->import.dma_buf);
++		else
++			pr_err("%s: Imported dmabuf already been put for buf %p\n",
++			       __func__, buffer);
++		buffer->import.dma_buf = NULL;
++	} else {
++		dma_free_coherent(&sm_state->pdev->dev, buffer->size,
++				  buffer->cookie, buffer->dma_addr);
++	}
++
++	/* Free our buffer. Start by removing it from the list */
++	mutex_lock(&sm_state->map_lock);
++	list_del(&buffer->global_buffer_list);
++	mutex_unlock(&sm_state->map_lock);
++
++	pr_debug("%s: Release our allocation - done\n", __func__);
++	mutex_unlock(&buffer->lock);
++
++	mutex_destroy(&buffer->lock);
++
++	kfree(buffer);
++	return;
++
++defer:
++	mutex_unlock(&buffer->lock);
++}
++
++/* Create support for private data tracking. */
++static struct vc_sm_privdata_t *vc_sm_cma_create_priv_data(pid_t id)
++{
++	char alloc_name[32];
++	struct vc_sm_privdata_t *file_data = NULL;
++
++	/* Allocate private structure. */
++	file_data = kzalloc(sizeof(*file_data), GFP_KERNEL);
++
++	if (!file_data)
++		return NULL;
++
++	snprintf(alloc_name, sizeof(alloc_name), "%d", id);
++
++	file_data->pid = id;
++
++	return file_data;
++}
++
++/* Dma buf operations for use with our own allocations */
++
++static int vc_sm_dma_buf_attach(struct dma_buf *dmabuf,
++				struct dma_buf_attachment *attachment)
++
++{
++	struct vc_sm_dma_buf_attachment *a;
++	struct sg_table *sgt;
++	struct vc_sm_buffer *buf = dmabuf->priv;
++	struct scatterlist *rd, *wr;
++	int ret, i;
++
++	a = kzalloc(sizeof(*a), GFP_KERNEL);
++	if (!a)
++		return -ENOMEM;
++
++	pr_debug("%s dmabuf %p attachment %p\n", __func__, dmabuf, attachment);
++
++	mutex_lock(&buf->lock);
++
++	INIT_LIST_HEAD(&a->list);
++
++	sgt = &a->sg_table;
++
++	/* Copy the buf->base_sgt scatter list to the attachment, as we can't
++	 * map the same scatter list to multiple attachments at the same time.
++	 */
++	ret = sg_alloc_table(sgt, buf->alloc.sg_table->orig_nents, GFP_KERNEL);
++	if (ret) {
++		kfree(a);
++		return -ENOMEM;
++	}
++
++	rd = buf->alloc.sg_table->sgl;
++	wr = sgt->sgl;
++	for (i = 0; i < sgt->orig_nents; ++i) {
++		sg_set_page(wr, sg_page(rd), rd->length, rd->offset);
++		rd = sg_next(rd);
++		wr = sg_next(wr);
++	}
++
++	a->dma_dir = DMA_NONE;
++	attachment->priv = a;
++
++	list_add(&a->list, &buf->attachments);
++	mutex_unlock(&buf->lock);
++
++	return 0;
++}
++
++static void vc_sm_dma_buf_detach(struct dma_buf *dmabuf,
++				 struct dma_buf_attachment *attachment)
++{
++	struct vc_sm_dma_buf_attachment *a = attachment->priv;
++	struct vc_sm_buffer *buf = dmabuf->priv;
++	struct sg_table *sgt;
++
++	pr_debug("%s dmabuf %p attachment %p\n", __func__, dmabuf, attachment);
++	if (!a)
++		return;
++
++	sgt = &a->sg_table;
++
++	/* release the scatterlist cache */
++	if (a->dma_dir != DMA_NONE)
++		dma_unmap_sg(attachment->dev, sgt->sgl, sgt->orig_nents,
++			     a->dma_dir);
++	sg_free_table(sgt);
++
++	mutex_lock(&buf->lock);
++	list_del(&a->list);
++	mutex_unlock(&buf->lock);
++
++	kfree(a);
++}
++
++static struct sg_table *vc_sm_map_dma_buf(struct dma_buf_attachment *attachment,
++					  enum dma_data_direction direction)
++{
++	struct vc_sm_dma_buf_attachment *a = attachment->priv;
++	/* stealing dmabuf mutex to serialize map/unmap operations */
++	struct mutex *lock = &attachment->dmabuf->lock;
++	struct sg_table *table;
++
++	mutex_lock(lock);
++	pr_debug("%s attachment %p\n", __func__, attachment);
++	table = &a->sg_table;
++
++	/* return previously mapped sg table */
++	if (a->dma_dir == direction) {
++		mutex_unlock(lock);
++		return table;
++	}
++
++	/* release any previous cache */
++	if (a->dma_dir != DMA_NONE) {
++		dma_unmap_sg(attachment->dev, table->sgl, table->orig_nents,
++			     a->dma_dir);
++		a->dma_dir = DMA_NONE;
++	}
++
++	/* mapping to the client with new direction */
++	table->nents = dma_map_sg(attachment->dev, table->sgl,
++				  table->orig_nents, direction);
++	if (!table->nents) {
++		pr_err("failed to map scatterlist\n");
++		mutex_unlock(lock);
++		return ERR_PTR(-EIO);
++	}
++
++	a->dma_dir = direction;
++	mutex_unlock(lock);
++
++	pr_debug("%s attachment %p\n", __func__, attachment);
++	return table;
++}
++
++static void vc_sm_unmap_dma_buf(struct dma_buf_attachment *attachment,
++				struct sg_table *table,
++				enum dma_data_direction direction)
++{
++	pr_debug("%s attachment %p\n", __func__, attachment);
++	dma_unmap_sg(attachment->dev, table->sgl, table->nents, direction);
++}
++
++static int vc_sm_dmabuf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma)
++{
++	struct vc_sm_buffer *buf = dmabuf->priv;
++	int ret;
++
++	pr_debug("%s dmabuf %p, buf %p, vm_start %08lX\n", __func__, dmabuf,
++		 buf, vma->vm_start);
++
++	mutex_lock(&buf->lock);
++
++	/* now map it to userspace */
++	vma->vm_pgoff = 0;
++
++	ret = dma_mmap_coherent(&sm_state->pdev->dev, vma, buf->cookie,
++				buf->dma_addr, buf->size);
++
++	if (ret) {
++		pr_err("Remapping memory failed, error: %d\n", ret);
++		return ret;
++	}
++
++	vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
++
++	mutex_unlock(&buf->lock);
++
++	if (ret)
++		pr_err("%s: failure mapping buffer to userspace\n",
++		       __func__);
++
++	return ret;
++}
++
++static void vc_sm_dma_buf_release(struct dma_buf *dmabuf)
++{
++	struct vc_sm_buffer *buffer;
++
++	if (!dmabuf)
++		return;
++
++	buffer = (struct vc_sm_buffer *)dmabuf->priv;
++
++	mutex_lock(&buffer->lock);
++
++	pr_debug("%s dmabuf %p, buffer %p\n", __func__, dmabuf, buffer);
++
++	buffer->in_use = 0;
++
++	/* Unmap on the VPU */
++	vc_sm_vpu_free(buffer);
++	pr_debug("%s vpu_free done\n", __func__);
++
++	/* Unmap our dma_buf object (the vc_sm_buffer remains until released
++	 * on the VPU).
++	 */
++	vc_sm_clean_up_dmabuf(buffer);
++	pr_debug("%s clean_up dmabuf done\n", __func__);
++
++	/* buffer->lock will be destroyed by vc_sm_release_resource if finished
++	 * with, otherwise unlocked. Do NOT unlock here.
++	 */
++	vc_sm_release_resource(buffer);
++	pr_debug("%s done\n", __func__);
++}
++
++static int vc_sm_dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
++					  enum dma_data_direction direction)
++{
++	struct vc_sm_buffer *buf;
++	struct vc_sm_dma_buf_attachment *a;
++
++	if (!dmabuf)
++		return -EFAULT;
++
++	buf = dmabuf->priv;
++	if (!buf)
++		return -EFAULT;
++
++	mutex_lock(&buf->lock);
++
++	list_for_each_entry(a, &buf->attachments, list) {
++		dma_sync_sg_for_cpu(a->dev, a->sg_table.sgl,
++				    a->sg_table.nents, direction);
++	}
++	mutex_unlock(&buf->lock);
++
++	return 0;
++}
++
++static int vc_sm_dma_buf_end_cpu_access(struct dma_buf *dmabuf,
++					enum dma_data_direction direction)
++{
++	struct vc_sm_buffer *buf;
++	struct vc_sm_dma_buf_attachment *a;
++
++	if (!dmabuf)
++		return -EFAULT;
++	buf = dmabuf->priv;
++	if (!buf)
++		return -EFAULT;
++
++	mutex_lock(&buf->lock);
++
++	list_for_each_entry(a, &buf->attachments, list) {
++		dma_sync_sg_for_device(a->dev, a->sg_table.sgl,
++				       a->sg_table.nents, direction);
++	}
++	mutex_unlock(&buf->lock);
++
++	return 0;
++}
++
++static const struct dma_buf_ops dma_buf_ops = {
++	.map_dma_buf = vc_sm_map_dma_buf,
++	.unmap_dma_buf = vc_sm_unmap_dma_buf,
++	.mmap = vc_sm_dmabuf_mmap,
++	.release = vc_sm_dma_buf_release,
++	.attach = vc_sm_dma_buf_attach,
++	.detach = vc_sm_dma_buf_detach,
++	.begin_cpu_access = vc_sm_dma_buf_begin_cpu_access,
++	.end_cpu_access = vc_sm_dma_buf_end_cpu_access,
++};
++
++/* Dma_buf operations for chaining through to an imported dma_buf */
++
++static
++int vc_sm_import_dma_buf_attach(struct dma_buf *dmabuf,
++				struct dma_buf_attachment *attachment)
++{
++	struct vc_sm_buffer *buf = dmabuf->priv;
++
++	if (!buf->imported)
++		return -EINVAL;
++	return buf->import.dma_buf->ops->attach(buf->import.dma_buf,
++						attachment);
++}
++
++static
++void vc_sm_import_dma_buf_detatch(struct dma_buf *dmabuf,
++				  struct dma_buf_attachment *attachment)
++{
++	struct vc_sm_buffer *buf = dmabuf->priv;
++
++	if (!buf->imported)
++		return;
++	buf->import.dma_buf->ops->detach(buf->import.dma_buf, attachment);
++}
++
++static
++struct sg_table *vc_sm_import_map_dma_buf(struct dma_buf_attachment *attachment,
++					  enum dma_data_direction direction)
++{
++	struct vc_sm_buffer *buf = attachment->dmabuf->priv;
++
++	if (!buf->imported)
++		return NULL;
++	return buf->import.dma_buf->ops->map_dma_buf(attachment,
++						     direction);
++}
++
++static
++void vc_sm_import_unmap_dma_buf(struct dma_buf_attachment *attachment,
++				struct sg_table *table,
++				enum dma_data_direction direction)
++{
++	struct vc_sm_buffer *buf = attachment->dmabuf->priv;
++
++	if (!buf->imported)
++		return;
++	buf->import.dma_buf->ops->unmap_dma_buf(attachment, table, direction);
++}
++
++static
++int vc_sm_import_dmabuf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma)
++{
++	struct vc_sm_buffer *buf = dmabuf->priv;
++
++	pr_debug("%s: mmap dma_buf %p, buf %p, imported db %p\n", __func__,
++		 dmabuf, buf, buf->import.dma_buf);
++	if (!buf->imported) {
++		pr_err("%s: mmap dma_buf %p- not an imported buffer\n",
++		       __func__, dmabuf);
++		return -EINVAL;
++	}
++	return buf->import.dma_buf->ops->mmap(buf->import.dma_buf, vma);
++}
++
++static
++int vc_sm_import_dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
++					  enum dma_data_direction direction)
++{
++	struct vc_sm_buffer *buf = dmabuf->priv;
++
++	if (!buf->imported)
++		return -EINVAL;
++	return buf->import.dma_buf->ops->begin_cpu_access(buf->import.dma_buf,
++							  direction);
++}
++
++static
++int vc_sm_import_dma_buf_end_cpu_access(struct dma_buf *dmabuf,
++					enum dma_data_direction direction)
++{
++	struct vc_sm_buffer *buf = dmabuf->priv;
++
++	if (!buf->imported)
++		return -EINVAL;
++	return buf->import.dma_buf->ops->end_cpu_access(buf->import.dma_buf,
++							  direction);
++}
++
++static const struct dma_buf_ops dma_buf_import_ops = {
++	.map_dma_buf = vc_sm_import_map_dma_buf,
++	.unmap_dma_buf = vc_sm_import_unmap_dma_buf,
++	.mmap = vc_sm_import_dmabuf_mmap,
++	.release = vc_sm_dma_buf_release,
++	.attach = vc_sm_import_dma_buf_attach,
++	.detach = vc_sm_import_dma_buf_detatch,
++	.begin_cpu_access = vc_sm_import_dma_buf_begin_cpu_access,
++	.end_cpu_access = vc_sm_import_dma_buf_end_cpu_access,
++};
++
++/* Import a dma_buf to be shared with VC. */
++int
++vc_sm_cma_import_dmabuf_internal(struct vc_sm_privdata_t *private,
++				 struct dma_buf *dma_buf,
++				 int fd,
++				 struct dma_buf **imported_buf)
++{
++	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
++	struct vc_sm_buffer *buffer = NULL;
++	struct vc_sm_import import = { };
++	struct vc_sm_import_result result = { };
++	struct dma_buf_attachment *attach = NULL;
++	struct sg_table *sgt = NULL;
++	dma_addr_t dma_addr;
++	u32 cache_alias;
++	int ret = 0;
++	int status;
++
++	/* Setup our allocation parameters */
++	pr_debug("%s: importing dma_buf %p/fd %d\n", __func__, dma_buf, fd);
++
++	if (fd < 0)
++		get_dma_buf(dma_buf);
++	else
++		dma_buf = dma_buf_get(fd);
++
++	if (!dma_buf)
++		return -EINVAL;
++
++	attach = dma_buf_attach(dma_buf, &sm_state->pdev->dev);
++	if (IS_ERR(attach)) {
++		ret = PTR_ERR(attach);
++		goto error;
++	}
++
++	sgt = dma_buf_map_attachment(attach, DMA_BIDIRECTIONAL);
++	if (IS_ERR(sgt)) {
++		ret = PTR_ERR(sgt);
++		goto error;
++	}
++
++	/* Verify that the address block is contiguous */
++	if (sgt->nents != 1) {
++		ret = -ENOMEM;
++		goto error;
++	}
++
++	/* Allocate local buffer to track this allocation. */
++	buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
++	if (!buffer) {
++		ret = -ENOMEM;
++		goto error;
++	}
++
++	import.type = VC_SM_ALLOC_NON_CACHED;
++	dma_addr = sg_dma_address(sgt->sgl);
++	import.addr = (u32)dma_addr;
++	cache_alias = import.addr & 0xC0000000;
++	if (cache_alias != 0xC0000000 && cache_alias != 0x80000000) {
++		pr_err("%s: Expecting an uncached alias for dma_addr %pad\n",
++		       __func__, &dma_addr);
++		/* Note that this assumes we're on >= Pi2, but it implies a
++		 * DT configuration error.
++		 */
++		import.addr |= 0xC0000000;
++	}
++	import.size = sg_dma_len(sgt->sgl);
++	import.allocator = current->tgid;
++	import.kernel_id = get_kernel_id(buffer);
++
++	memcpy(import.name, VC_SM_RESOURCE_NAME_DEFAULT,
++	       sizeof(VC_SM_RESOURCE_NAME_DEFAULT));
++
++	pr_debug("[%s]: attempt to import \"%s\" data - type %u, addr %pad, size %u.\n",
++		 __func__, import.name, import.type, &dma_addr, import.size);
++
++	/* Allocate the videocore buffer. */
++	status = vc_sm_cma_vchi_import(sm_state->sm_handle, &import, &result,
++				       &sm_state->int_trans_id);
++	if (status == -EINTR) {
++		pr_debug("[%s]: requesting import memory action restart (trans_id: %u)\n",
++			 __func__, sm_state->int_trans_id);
++		ret = -ERESTARTSYS;
++		private->restart_sys = -EINTR;
++		private->int_action = VC_SM_MSG_TYPE_IMPORT;
++		goto error;
++	} else if (status || !result.res_handle) {
++		pr_debug("[%s]: failed to import memory on videocore (status: %u, trans_id: %u)\n",
++			 __func__, status, sm_state->int_trans_id);
++		ret = -ENOMEM;
++		goto error;
++	}
++
++	mutex_init(&buffer->lock);
++	INIT_LIST_HEAD(&buffer->attachments);
++	memcpy(buffer->name, import.name,
++	       min(sizeof(buffer->name), sizeof(import.name) - 1));
++
++	/* Keep track of the buffer we created. */
++	buffer->private = private;
++	buffer->vc_handle = result.res_handle;
++	buffer->size = import.size;
++	buffer->vpu_state = VPU_MAPPED;
++
++	buffer->imported = 1;
++	buffer->import.dma_buf = dma_buf;
++
++	buffer->import.attach = attach;
++	buffer->import.sgt = sgt;
++	buffer->dma_addr = dma_addr;
++	buffer->in_use = 1;
++	buffer->kernel_id = import.kernel_id;
++
++	/*
++	 * We're done - we need to export a new dmabuf chaining through most
++	 * functions, but enabling us to release our own internal references
++	 * here.
++	 */
++	exp_info.ops = &dma_buf_import_ops;
++	exp_info.size = import.size;
++	exp_info.flags = O_RDWR;
++	exp_info.priv = buffer;
++
++	buffer->dma_buf = dma_buf_export(&exp_info);
++	if (IS_ERR(buffer->dma_buf)) {
++		ret = PTR_ERR(buffer->dma_buf);
++		goto error;
++	}
++
++	vc_sm_add_resource(private, buffer);
++
++	*imported_buf = buffer->dma_buf;
++
++	return 0;
++
++error:
++	if (result.res_handle) {
++		struct vc_sm_free_t free = { result.res_handle, 0 };
++
++		vc_sm_cma_vchi_free(sm_state->sm_handle, &free,
++				    &sm_state->int_trans_id);
++	}
++	free_kernel_id(import.kernel_id);
++	kfree(buffer);
++	if (sgt)
++		dma_buf_unmap_attachment(attach, sgt, DMA_BIDIRECTIONAL);
++	if (attach)
++		dma_buf_detach(dma_buf, attach);
++	dma_buf_put(dma_buf);
++	return ret;
++}
++
++static int vc_sm_cma_vpu_alloc(u32 size, u32 align, const char *name,
++			       u32 mem_handle, struct vc_sm_buffer **ret_buffer)
++{
++	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
++	struct vc_sm_buffer *buffer = NULL;
++	struct sg_table *sgt;
++	int aligned_size;
++	int ret = 0;
++
++	/* Align to the user requested align */
++	aligned_size = ALIGN(size, align);
++	/* and then to a page boundary */
++	aligned_size = PAGE_ALIGN(aligned_size);
++
++	if (!aligned_size)
++		return -EINVAL;
++
++	/* Allocate local buffer to track this allocation. */
++	buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
++	if (!buffer)
++		return -ENOMEM;
++
++	mutex_init(&buffer->lock);
++	/* Acquire the mutex as vc_sm_release_resource will release it in the
++	 * error path.
++	 */
++	mutex_lock(&buffer->lock);
++
++	buffer->cookie = dma_alloc_coherent(&sm_state->pdev->dev,
++					    aligned_size, &buffer->dma_addr,
++					    GFP_KERNEL);
++	if (!buffer->cookie) {
++		pr_err("[%s]: dma_alloc_coherent alloc of %d bytes failed\n",
++		       __func__, aligned_size);
++		ret = -ENOMEM;
++		goto error;
++	}
++
++	pr_debug("[%s]: alloc of %d bytes success\n",
++		 __func__, aligned_size);
++
++	sgt = kmalloc(sizeof(*sgt), GFP_KERNEL);
++	if (!sgt) {
++		ret = -ENOMEM;
++		goto error;
++	}
++
++	ret = dma_get_sgtable(&sm_state->pdev->dev, sgt, buffer->cookie,
++			      buffer->dma_addr, buffer->size);
++	if (ret < 0) {
++		pr_err("failed to get scatterlist from DMA API\n");
++		kfree(sgt);
++		ret = -ENOMEM;
++		goto error;
++	}
++	buffer->alloc.sg_table = sgt;
++
++	INIT_LIST_HEAD(&buffer->attachments);
++
++	memcpy(buffer->name, name,
++	       min(sizeof(buffer->name), strlen(name)));
++
++	exp_info.ops = &dma_buf_ops;
++	exp_info.size = aligned_size;
++	exp_info.flags = O_RDWR;
++	exp_info.priv = buffer;
++
++	buffer->dma_buf = dma_buf_export(&exp_info);
++	if (IS_ERR(buffer->dma_buf)) {
++		ret = PTR_ERR(buffer->dma_buf);
++		goto error;
++	}
++	buffer->dma_addr = (u32)sg_dma_address(buffer->alloc.sg_table->sgl);
++	if ((buffer->dma_addr & 0xC0000000) != 0xC0000000) {
++		pr_warn_once("%s: Expecting an uncached alias for dma_addr %pad\n",
++			     __func__, &buffer->dma_addr);
++		buffer->dma_addr |= 0xC0000000;
++	}
++	buffer->private = sm_state->vpu_allocs;
++
++	buffer->vc_handle = mem_handle;
++	buffer->vpu_state = VPU_MAPPED;
++	buffer->vpu_allocated = 1;
++	buffer->size = size;
++	/*
++	 * Create an ID that will be passed along with our message so
++	 * that when we service the release reply, we can look up which
++	 * resource is being released.
++	 */
++	buffer->kernel_id = get_kernel_id(buffer);
++
++	vc_sm_add_resource(sm_state->vpu_allocs, buffer);
++
++	mutex_unlock(&buffer->lock);
++
++	*ret_buffer = buffer;
++	return 0;
++error:
++	if (buffer)
++		vc_sm_release_resource(buffer);
++	return ret;
++}
++
++static void
++vc_sm_vpu_event(struct sm_instance *instance, struct vc_sm_result_t *reply,
++		int reply_len)
++{
++	switch (reply->trans_id & ~0x80000000) {
++	case VC_SM_MSG_TYPE_CLIENT_VERSION:
++	{
++		/* Acknowledge that the firmware supports the version command */
++		pr_debug("%s: firmware acked version msg. Require release cb\n",
++			 __func__);
++		sm_state->require_released_callback = true;
++	}
++	break;
++	case VC_SM_MSG_TYPE_RELEASED:
++	{
++		struct vc_sm_released *release = (struct vc_sm_released *)reply;
++		struct vc_sm_buffer *buffer =
++					lookup_kernel_id(release->kernel_id);
++		if (!buffer) {
++			pr_err("%s: VC released a buffer that is already released, kernel_id %d\n",
++			       __func__, release->kernel_id);
++			break;
++		}
++		mutex_lock(&buffer->lock);
++
++		pr_debug("%s: Released addr %08x, size %u, id %08x, mem_handle %08x\n",
++			 __func__, release->addr, release->size,
++			 release->kernel_id, release->vc_handle);
++
++		buffer->vc_handle = 0;
++		buffer->vpu_state = VPU_NOT_MAPPED;
++		free_kernel_id(release->kernel_id);
++
++		if (buffer->vpu_allocated) {
++			/* VPU allocation, so release the dmabuf which will
++			 * trigger the clean up.
++			 */
++			mutex_unlock(&buffer->lock);
++			dma_buf_put(buffer->dma_buf);
++		} else {
++			vc_sm_release_resource(buffer);
++		}
++	}
++	break;
++	case VC_SM_MSG_TYPE_VC_MEM_REQUEST:
++	{
++		struct vc_sm_buffer *buffer = NULL;
++		struct vc_sm_vc_mem_request *req =
++					(struct vc_sm_vc_mem_request *)reply;
++		struct vc_sm_vc_mem_request_result reply;
++		int ret;
++
++		pr_debug("%s: Request %u bytes of memory, align %d name %s, trans_id %08x\n",
++			 __func__, req->size, req->align, req->name,
++			 req->trans_id);
++		ret = vc_sm_cma_vpu_alloc(req->size, req->align, req->name,
++					  req->vc_handle, &buffer);
++
++		reply.trans_id = req->trans_id;
++		if (!ret) {
++			reply.addr = buffer->dma_addr;
++			reply.kernel_id = buffer->kernel_id;
++			pr_debug("%s: Allocated resource buffer %p, addr %pad\n",
++				 __func__, buffer, &buffer->dma_addr);
++		} else {
++			pr_err("%s: Allocation failed size %u, name %s, vc_handle %u\n",
++			       __func__, req->size, req->name, req->vc_handle);
++			reply.addr = 0;
++			reply.kernel_id = 0;
++		}
++		vc_sm_vchi_client_vc_mem_req_reply(sm_state->sm_handle, &reply,
++						   &sm_state->int_trans_id);
++		break;
++	}
++	break;
++	default:
++		pr_err("%s: Unknown vpu cmd %x\n", __func__, reply->trans_id);
++		break;
++	}
++}
++
++/* Userspace handling */
++/*
++ * Open the device.  Creates a private state to help track all allocation
++ * associated with this device.
++ */
++static int vc_sm_cma_open(struct inode *inode, struct file *file)
++{
++	/* Make sure the device was started properly. */
++	if (!sm_state) {
++		pr_err("[%s]: invalid device\n", __func__);
++		return -EPERM;
++	}
++
++	file->private_data = vc_sm_cma_create_priv_data(current->tgid);
++	if (!file->private_data) {
++		pr_err("[%s]: failed to create data tracker\n", __func__);
++
++		return -ENOMEM;
++	}
++
++	return 0;
++}
++
++/*
++ * Close the vcsm-cma device.
++ * All allocations are file descriptors to the dmabuf objects, so we will get
++ * the clean up request on those as those are cleaned up.
++ */
++static int vc_sm_cma_release(struct inode *inode, struct file *file)
++{
++	struct vc_sm_privdata_t *file_data =
++	    (struct vc_sm_privdata_t *)file->private_data;
++	int ret = 0;
++
++	/* Make sure the device was started properly. */
++	if (!sm_state || !file_data) {
++		pr_err("[%s]: invalid device\n", __func__);
++		ret = -EPERM;
++		goto out;
++	}
++
++	pr_debug("[%s]: using private data %p\n", __func__, file_data);
++
++	/* Terminate the private data. */
++	kfree(file_data);
++
++out:
++	return ret;
++}
++
++/*
++ * Allocate a shared memory handle and block.
++ * Allocation is from CMA, and then imported into the VPU mappings.
++ */
++int vc_sm_cma_ioctl_alloc(struct vc_sm_privdata_t *private,
++			  struct vc_sm_cma_ioctl_alloc *ioparam)
++{
++	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
++	struct vc_sm_buffer *buffer = NULL;
++	struct vc_sm_import import = { 0 };
++	struct vc_sm_import_result result = { 0 };
++	struct dma_buf *dmabuf = NULL;
++	struct sg_table *sgt;
++	int aligned_size;
++	int ret = 0;
++	int status;
++	int fd = -1;
++
++	aligned_size = PAGE_ALIGN(ioparam->size);
++
++	if (!aligned_size)
++		return -EINVAL;
++
++	/* Allocate local buffer to track this allocation. */
++	buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
++	if (!buffer) {
++		ret = -ENOMEM;
++		goto error;
++	}
++
++	buffer->cookie = dma_alloc_coherent(&sm_state->pdev->dev,
++					    aligned_size,
++					    &buffer->dma_addr,
++					    GFP_KERNEL);
++	if (!buffer->cookie) {
++		pr_err("[%s]: dma_alloc_coherent alloc of %d bytes failed\n",
++		       __func__, aligned_size);
++		ret = -ENOMEM;
++		goto error;
++	}
++
++	import.type = VC_SM_ALLOC_NON_CACHED;
++	import.allocator = current->tgid;
++
++	if (*ioparam->name)
++		memcpy(import.name, ioparam->name, sizeof(import.name) - 1);
++	else
++		memcpy(import.name, VC_SM_RESOURCE_NAME_DEFAULT,
++		       sizeof(VC_SM_RESOURCE_NAME_DEFAULT));
++
++	mutex_init(&buffer->lock);
++	INIT_LIST_HEAD(&buffer->attachments);
++	memcpy(buffer->name, import.name,
++	       min(sizeof(buffer->name), sizeof(import.name) - 1));
++
++	exp_info.ops = &dma_buf_ops;
++	exp_info.size = aligned_size;
++	exp_info.flags = O_RDWR;
++	exp_info.priv = buffer;
++
++	dmabuf = dma_buf_export(&exp_info);
++	if (IS_ERR(dmabuf)) {
++		ret = PTR_ERR(dmabuf);
++		goto error;
++	}
++	buffer->dma_buf = dmabuf;
++
++	import.addr = buffer->dma_addr;
++	import.size = aligned_size;
++	import.kernel_id = get_kernel_id(buffer);
++
++	/* Wrap it into a videocore buffer. */
++	status = vc_sm_cma_vchi_import(sm_state->sm_handle, &import, &result,
++				       &sm_state->int_trans_id);
++	if (status == -EINTR) {
++		pr_debug("[%s]: requesting import memory action restart (trans_id: %u)\n",
++			 __func__, sm_state->int_trans_id);
++		ret = -ERESTARTSYS;
++		private->restart_sys = -EINTR;
++		private->int_action = VC_SM_MSG_TYPE_IMPORT;
++		goto error;
++	} else if (status || !result.res_handle) {
++		pr_err("[%s]: failed to import memory on videocore (status: %u, trans_id: %u)\n",
++		       __func__, status, sm_state->int_trans_id);
++		ret = -ENOMEM;
++		goto error;
++	}
++
++	/* Keep track of the buffer we created. */
++	buffer->private = private;
++	buffer->vc_handle = result.res_handle;
++	buffer->size = import.size;
++	buffer->vpu_state = VPU_MAPPED;
++	buffer->kernel_id = import.kernel_id;
++
++	sgt = kmalloc(sizeof(*sgt), GFP_KERNEL);
++	if (!sgt) {
++		ret = -ENOMEM;
++		goto error;
++	}
++
++	ret = dma_get_sgtable(&sm_state->pdev->dev, sgt, buffer->cookie,
++			      buffer->dma_addr, buffer->size);
++	if (ret < 0) {
++		/* FIXME: error handling */
++		pr_err("failed to get scatterlist from DMA API\n");
++		kfree(sgt);
++		ret = -ENOMEM;
++		goto error;
++	}
++	buffer->alloc.sg_table = sgt;
++
++	fd = dma_buf_fd(dmabuf, O_CLOEXEC);
++	if (fd < 0)
++		goto error;
++
++	vc_sm_add_resource(private, buffer);
++
++	pr_debug("[%s]: Added resource as fd %d, buffer %p, private %p, dma_addr %pad\n",
++		 __func__, fd, buffer, private, &buffer->dma_addr);
++
++	/* We're done */
++	ioparam->handle = fd;
++	ioparam->vc_handle = buffer->vc_handle;
++	ioparam->dma_addr = buffer->dma_addr;
++	return 0;
++
++error:
++	pr_err("[%s]: something failed - cleanup. ret %d\n", __func__, ret);
++
++	if (dmabuf) {
++		/* dmabuf has been exported, therefore allow dmabuf cleanup to
++		 * deal with this
++		 */
++		dma_buf_put(dmabuf);
++	} else {
++		/* No dmabuf, therefore just free the buffer here */
++		if (buffer->cookie)
++			dma_free_coherent(&sm_state->pdev->dev, buffer->size,
++					  buffer->cookie, buffer->dma_addr);
++		kfree(buffer);
++	}
++	return ret;
++}
++
++#ifndef CONFIG_ARM64
++/* Converts VCSM_CACHE_OP_* to an operating function. */
++static void (*cache_op_to_func(const unsigned int cache_op))
++						(const void*, const void*)
++{
++	switch (cache_op) {
++	case VC_SM_CACHE_OP_NOP:
++		return NULL;
++
++	case VC_SM_CACHE_OP_INV:
++		return dmac_inv_range;
++	case VC_SM_CACHE_OP_CLEAN:
++		return dmac_clean_range;
++	case VC_SM_CACHE_OP_FLUSH:
++		return dmac_flush_range;
++
++	default:
++		pr_err("[%s]: Invalid cache_op: 0x%08x\n", __func__, cache_op);
++		return NULL;
++	}
++}
++
++/*
++ * Clean/invalid/flush cache of which buffer is already pinned (i.e. accessed).
++ */
++static int clean_invalid_contig_2d(const void __user *addr,
++				   const size_t block_count,
++				   const size_t block_size,
++				   const size_t stride,
++				   const unsigned int cache_op)
++{
++	size_t i;
++	void (*op_fn)(const void *start, const void *end);
++
++	if (!block_size) {
++		pr_err("[%s]: size cannot be 0\n", __func__);
++		return -EINVAL;
++	}
++
++	op_fn = cache_op_to_func(cache_op);
++	if (!op_fn)
++		return -EINVAL;
++
++	for (i = 0; i < block_count; i ++, addr += stride)
++		op_fn(addr, addr + block_size);
++
++	return 0;
++}
++
++static int vc_sm_cma_clean_invalid2(unsigned int cmdnr, unsigned long arg)
++{
++	struct vc_sm_cma_ioctl_clean_invalid2 ioparam;
++	struct vc_sm_cma_ioctl_clean_invalid_block *block = NULL;
++	int i, ret = 0;
++
++	/* Get parameter data. */
++	if (copy_from_user(&ioparam, (void *)arg, sizeof(ioparam))) {
++		pr_err("[%s]: failed to copy-from-user header for cmd %x\n",
++		       __func__, cmdnr);
++		return -EFAULT;
++	}
++	block = kmalloc(ioparam.op_count * sizeof(*block), GFP_KERNEL);
++	if (!block)
++		return -EFAULT;
++
++	if (copy_from_user(block, (void *)(arg + sizeof(ioparam)),
++			   ioparam.op_count * sizeof(*block)) != 0) {
++		pr_err("[%s]: failed to copy-from-user payload for cmd %x\n",
++		       __func__, cmdnr);
++		ret = -EFAULT;
++		goto out;
++	}
++
++	for (i = 0; i < ioparam.op_count; i++) {
++		const struct vc_sm_cma_ioctl_clean_invalid_block * const op =
++								block + i;
++
++		if (op->invalidate_mode == VC_SM_CACHE_OP_NOP)
++			continue;
++
++		ret = clean_invalid_contig_2d((void __user *)op->start_address,
++					      op->block_count, op->block_size,
++					      op->inter_block_stride,
++					      op->invalidate_mode);
++		if (ret)
++			break;
++	}
++out:
++	kfree(block);
++
++	return ret;
++}
++#endif
++
++static long vc_sm_cma_ioctl(struct file *file, unsigned int cmd,
++			    unsigned long arg)
++{
++	int ret = 0;
++	unsigned int cmdnr = _IOC_NR(cmd);
++	struct vc_sm_privdata_t *file_data =
++	    (struct vc_sm_privdata_t *)file->private_data;
++
++	/* Validate we can work with this device. */
++	if (!sm_state || !file_data) {
++		pr_err("[%s]: invalid device\n", __func__);
++		return -EPERM;
++	}
++
++	/* Action is a re-post of a previously interrupted action? */
++	if (file_data->restart_sys == -EINTR) {
++		pr_debug("[%s]: clean up of action %u (trans_id: %u) following EINTR\n",
++			 __func__, file_data->int_action,
++			 file_data->int_trans_id);
++
++		file_data->restart_sys = 0;
++	}
++
++	/* Now process the command. */
++	switch (cmdnr) {
++		/* New memory allocation.
++		 */
++	case VC_SM_CMA_CMD_ALLOC:
++	{
++		struct vc_sm_cma_ioctl_alloc ioparam;
++
++		/* Get the parameter data. */
++		if (copy_from_user
++		    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
++			pr_err("[%s]: failed to copy-from-user for cmd %x\n",
++			       __func__, cmdnr);
++			ret = -EFAULT;
++			break;
++		}
++
++		ret = vc_sm_cma_ioctl_alloc(file_data, &ioparam);
++		if (!ret &&
++		    (copy_to_user((void *)arg, &ioparam,
++				  sizeof(ioparam)) != 0)) {
++			/* FIXME: Release allocation */
++			pr_err("[%s]: failed to copy-to-user for cmd %x\n",
++			       __func__, cmdnr);
++			ret = -EFAULT;
++		}
++		break;
++	}
++
++	case VC_SM_CMA_CMD_IMPORT_DMABUF:
++	{
++		struct vc_sm_cma_ioctl_import_dmabuf ioparam;
++		struct dma_buf *new_dmabuf;
++
++		/* Get the parameter data. */
++		if (copy_from_user
++		    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
++			pr_err("[%s]: failed to copy-from-user for cmd %x\n",
++			       __func__, cmdnr);
++			ret = -EFAULT;
++			break;
++		}
++
++		ret = vc_sm_cma_import_dmabuf_internal(file_data,
++						       NULL,
++						       ioparam.dmabuf_fd,
++						       &new_dmabuf);
++
++		if (!ret) {
++			struct vc_sm_buffer *buf = new_dmabuf->priv;
++
++			ioparam.size = buf->size;
++			ioparam.handle = dma_buf_fd(new_dmabuf,
++						    O_CLOEXEC);
++			ioparam.vc_handle = buf->vc_handle;
++			ioparam.dma_addr = buf->dma_addr;
++
++			if (ioparam.handle < 0 ||
++			    (copy_to_user((void *)arg, &ioparam,
++					  sizeof(ioparam)) != 0)) {
++				dma_buf_put(new_dmabuf);
++				/* FIXME: Release allocation */
++				ret = -EFAULT;
++			}
++		}
++		break;
++	}
++
++#ifndef CONFIG_ARM64
++	/*
++	 * Flush/Invalidate the cache for a given mapping.
++	 * Blocks must be pinned (i.e. accessed) before this call.
++	 */
++	case VC_SM_CMA_CMD_CLEAN_INVALID2:
++		ret = vc_sm_cma_clean_invalid2(cmdnr, arg);
++		break;
++#endif
++
++	default:
++		pr_debug("[%s]: cmd %x tgid %u, owner %u\n", __func__, cmdnr,
++			 current->tgid, file_data->pid);
++
++		ret = -EINVAL;
++		break;
++	}
++
++	return ret;
++}
++
++#ifdef CONFIG_COMPAT
++struct vc_sm_cma_ioctl_clean_invalid2_32 {
++	u32 op_count;
++	struct vc_sm_cma_ioctl_clean_invalid_block_32 {
++		u16 invalidate_mode;
++		u16 block_count;
++		compat_uptr_t start_address;
++		u32 block_size;
++		u32 inter_block_stride;
++	} s[0];
++};
++
++#define VC_SM_CMA_CMD_CLEAN_INVALID2_32\
++	_IOR(VC_SM_CMA_MAGIC_TYPE, VC_SM_CMA_CMD_CLEAN_INVALID2,\
++	 struct vc_sm_cma_ioctl_clean_invalid2_32)
++
++static long vc_sm_cma_compat_ioctl(struct file *file, unsigned int cmd,
++				   unsigned long arg)
++{
++	switch (cmd) {
++	case VC_SM_CMA_CMD_CLEAN_INVALID2_32:
++		/* FIXME */
++		return -EINVAL;
++
++	default:
++		return vc_sm_cma_ioctl(file, cmd, arg);
++	}
++}
++#endif
++
++/* Device operations that we managed in this driver. */
++static const struct file_operations vc_sm_ops = {
++	.owner = THIS_MODULE,
++	.unlocked_ioctl = vc_sm_cma_ioctl,
++#ifdef CONFIG_COMPAT
++	.compat_ioctl = vc_sm_cma_compat_ioctl,
++#endif
++	.open = vc_sm_cma_open,
++	.release = vc_sm_cma_release,
++};
++
++/* Driver load/unload functions */
++/* Videocore connected.  */
++static void vc_sm_connected_init(void)
++{
++	int ret;
++	struct vchiq_instance *vchiq_instance;
++	struct vc_sm_version version;
++	struct vc_sm_result_t version_result;
++
++	pr_info("[%s]: start\n", __func__);
++
++	/*
++	 * Initialize and create a VCHI connection for the shared memory service
++	 * running on videocore.
++	 */
++	ret = vchiq_initialise(&vchiq_instance);
++	if (ret) {
++		pr_err("[%s]: failed to initialise VCHI instance (ret=%d)\n",
++		       __func__, ret);
++
++		return;
++	}
++
++	ret = vchiq_connect(vchiq_instance);
++	if (ret) {
++		pr_err("[%s]: failed to connect VCHI instance (ret=%d)\n",
++		       __func__, ret);
++
++		return;
++	}
++
++	/* Initialize an instance of the shared memory service. */
++	sm_state->sm_handle = vc_sm_cma_vchi_init(vchiq_instance, 1,
++						  vc_sm_vpu_event);
++	if (!sm_state->sm_handle) {
++		pr_err("[%s]: failed to initialize shared memory service\n",
++		       __func__);
++
++		return;
++	}
++
++	/* Create a debug fs directory entry (root). */
++	sm_state->dir_root = debugfs_create_dir(VC_SM_DIR_ROOT_NAME, NULL);
++
++	sm_state->dir_state.show = &vc_sm_cma_global_state_show;
++	sm_state->dir_state.dir_entry =
++		debugfs_create_file(VC_SM_STATE, 0444, sm_state->dir_root,
++				    &sm_state->dir_state,
++				    &vc_sm_cma_debug_fs_fops);
++
++	INIT_LIST_HEAD(&sm_state->buffer_list);
++
++	/* Create a shared memory device. */
++	sm_state->misc_dev.minor = MISC_DYNAMIC_MINOR;
++	sm_state->misc_dev.name = DEVICE_NAME;
++	sm_state->misc_dev.fops = &vc_sm_ops;
++	sm_state->misc_dev.parent = NULL;
++	/* Temporarily set as 666 until udev rules have been sorted */
++	sm_state->misc_dev.mode = 0666;
++	ret = misc_register(&sm_state->misc_dev);
++	if (ret) {
++		pr_err("vcsm-cma: failed to register misc device.\n");
++		goto err_remove_debugfs;
++	}
++
++	sm_state->data_knl = vc_sm_cma_create_priv_data(0);
++	if (!sm_state->data_knl) {
++		pr_err("[%s]: failed to create kernel private data tracker\n",
++		       __func__);
++		goto err_remove_misc_dev;
++	}
++
++	version.version = 2;
++	ret = vc_sm_cma_vchi_client_version(sm_state->sm_handle, &version,
++					    &version_result,
++					    &sm_state->int_trans_id);
++	if (ret) {
++		pr_err("[%s]: Failed to send version request %d\n", __func__,
++		       ret);
++	}
++
++	/* Done! */
++	sm_inited = 1;
++	pr_info("[%s]: installed successfully\n", __func__);
++	return;
++
++err_remove_misc_dev:
++	misc_deregister(&sm_state->misc_dev);
++err_remove_debugfs:
++	debugfs_remove_recursive(sm_state->dir_root);
++	vc_sm_cma_vchi_stop(&sm_state->sm_handle);
++}
++
++/* Driver loading. */
++static int bcm2835_vc_sm_cma_probe(struct platform_device *pdev)
++{
++	pr_info("%s: Videocore shared memory driver\n", __func__);
++
++	sm_state = devm_kzalloc(&pdev->dev, sizeof(*sm_state), GFP_KERNEL);
++	if (!sm_state)
++		return -ENOMEM;
++	sm_state->pdev = pdev;
++	mutex_init(&sm_state->map_lock);
++
++	spin_lock_init(&sm_state->kernelid_map_lock);
++	idr_init_base(&sm_state->kernelid_map, 1);
++
++	pdev->dev.dma_parms = devm_kzalloc(&pdev->dev,
++					   sizeof(*pdev->dev.dma_parms),
++					   GFP_KERNEL);
++	/* dma_set_max_seg_size checks if dma_parms is NULL. */
++	dma_set_max_seg_size(&pdev->dev, 0x3FFFFFFF);
++
++	vchiq_add_connected_callback(vc_sm_connected_init);
++	return 0;
++}
++
++/* Driver unloading. */
++static int bcm2835_vc_sm_cma_remove(struct platform_device *pdev)
++{
++	pr_debug("[%s]: start\n", __func__);
++	if (sm_inited) {
++		misc_deregister(&sm_state->misc_dev);
++
++		/* Remove all proc entries. */
++		debugfs_remove_recursive(sm_state->dir_root);
++
++		/* Stop the videocore shared memory service. */
++		vc_sm_cma_vchi_stop(&sm_state->sm_handle);
++	}
++
++	if (sm_state) {
++		idr_destroy(&sm_state->kernelid_map);
++
++		/* Free the memory for the state structure. */
++		mutex_destroy(&sm_state->map_lock);
++	}
++
++	pr_debug("[%s]: end\n", __func__);
++	return 0;
++}
++
++/* Kernel API calls */
++/* Get an internal resource handle mapped from the external one. */
++int vc_sm_cma_int_handle(void *handle)
++{
++	struct dma_buf *dma_buf = (struct dma_buf *)handle;
++	struct vc_sm_buffer *buf;
++
++	/* Validate we can work with this device. */
++	if (!sm_state || !handle) {
++		pr_err("[%s]: invalid input\n", __func__);
++		return 0;
++	}
++
++	buf = (struct vc_sm_buffer *)dma_buf->priv;
++	return buf->vc_handle;
++}
++EXPORT_SYMBOL_GPL(vc_sm_cma_int_handle);
++
++/* Free a previously allocated shared memory handle and block. */
++int vc_sm_cma_free(void *handle)
++{
++	struct dma_buf *dma_buf = (struct dma_buf *)handle;
++
++	/* Validate we can work with this device. */
++	if (!sm_state || !handle) {
++		pr_err("[%s]: invalid input\n", __func__);
++		return -EPERM;
++	}
++
++	pr_debug("%s: handle %p/dmabuf %p\n", __func__, handle, dma_buf);
++
++	dma_buf_put(dma_buf);
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(vc_sm_cma_free);
++
++/* Import a dmabuf to be shared with VC. */
++int vc_sm_cma_import_dmabuf(struct dma_buf *src_dmabuf, void **handle)
++{
++	struct dma_buf *new_dma_buf;
++	int ret;
++
++	/* Validate we can work with this device. */
++	if (!sm_state || !src_dmabuf || !handle) {
++		pr_err("[%s]: invalid input\n", __func__);
++		return -EPERM;
++	}
++
++	ret = vc_sm_cma_import_dmabuf_internal(sm_state->data_knl, src_dmabuf,
++					       -1, &new_dma_buf);
++
++	if (!ret) {
++		pr_debug("%s: imported to ptr %p\n", __func__, new_dma_buf);
++
++		/* Assign valid handle at this time.*/
++		*handle = new_dma_buf;
++	} else {
++		/*
++		 * succeeded in importing the dma_buf, but then
++		 * failed to look it up again. How?
++		 * Release the fd again.
++		 */
++		pr_err("%s: imported vc_sm_cma_get_buffer failed %d\n",
++		       __func__, ret);
++	}
++
++	return ret;
++}
++EXPORT_SYMBOL_GPL(vc_sm_cma_import_dmabuf);
++
++static struct platform_driver bcm2835_vcsm_cma_driver = {
++	.probe = bcm2835_vc_sm_cma_probe,
++	.remove = bcm2835_vc_sm_cma_remove,
++	.driver = {
++		   .name = DEVICE_NAME,
++		   .owner = THIS_MODULE,
++		   },
++};
++
++module_platform_driver(bcm2835_vcsm_cma_driver);
++
++MODULE_AUTHOR("Dave Stevenson");
++MODULE_DESCRIPTION("VideoCore CMA Shared Memory Driver");
++MODULE_LICENSE("GPL v2");
++MODULE_ALIAS("platform:vcsm-cma");
+--- /dev/null
++++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.h
+@@ -0,0 +1,84 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++
++/*
++ * VideoCore Shared Memory driver using CMA.
++ *
++ * Copyright: 2018, Raspberry Pi (Trading) Ltd
++ *
++ */
++
++#ifndef VC_SM_H
++#define VC_SM_H
++
++#include <linux/device.h>
++#include <linux/dma-direction.h>
++#include <linux/kref.h>
++#include <linux/mm_types.h>
++#include <linux/mutex.h>
++#include <linux/rbtree.h>
++#include <linux/sched.h>
++#include <linux/shrinker.h>
++#include <linux/types.h>
++#include <linux/miscdevice.h>
++
++#define VC_SM_MAX_NAME_LEN 32
++
++enum vc_sm_vpu_mapping_state {
++	VPU_NOT_MAPPED,
++	VPU_MAPPED,
++	VPU_UNMAPPING
++};
++
++struct vc_sm_alloc_data {
++	unsigned long num_pages;
++	void *priv_virt;
++	struct sg_table *sg_table;
++};
++
++struct vc_sm_imported {
++	struct dma_buf *dma_buf;
++	struct dma_buf_attachment *attach;
++	struct sg_table *sgt;
++};
++
++struct vc_sm_buffer {
++	struct list_head global_buffer_list;	/* Global list of buffers. */
++
++	/* Index in the kernel_id idr so that we can find the
++	 * mmal_msg_context again when servicing the VCHI reply.
++	 */
++	int kernel_id;
++
++	size_t size;
++
++	/* Lock over all the following state for this buffer */
++	struct mutex lock;
++	struct list_head attachments;
++
++	char name[VC_SM_MAX_NAME_LEN];
++
++	int in_use:1;	/* Kernel is still using this resource */
++	int imported:1;	/* Imported dmabuf */
++
++	enum vc_sm_vpu_mapping_state vpu_state;
++	u32 vc_handle;	/* VideoCore handle for this buffer */
++	int vpu_allocated;	/*
++				 * The VPU made this allocation. Release the
++				 * local dma_buf when the VPU releases the
++				 * resource.
++				 */
++
++	/* DMABUF related fields */
++	struct dma_buf *dma_buf;
++	dma_addr_t dma_addr;
++	void *cookie;
++
++	struct vc_sm_privdata_t *private;
++
++	union {
++		struct vc_sm_alloc_data alloc;
++		struct vc_sm_imported import;
++	};
++};
++
++#endif
+--- /dev/null
++++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c
+@@ -0,0 +1,505 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * VideoCore Shared Memory CMA allocator
++ *
++ * Copyright: 2018, Raspberry Pi (Trading) Ltd
++ * Copyright 2011-2012 Broadcom Corporation.  All rights reserved.
++ *
++ * Based on vmcs_sm driver from Broadcom Corporation.
++ *
++ */
++
++/* ---- Include Files ----------------------------------------------------- */
++#include <linux/completion.h>
++#include <linux/kernel.h>
++#include <linux/kthread.h>
++#include <linux/list.h>
++#include <linux/mutex.h>
++#include <linux/semaphore.h>
++#include <linux/slab.h>
++#include <linux/types.h>
++
++#include "vc_sm_cma_vchi.h"
++
++#define VC_SM_VER  1
++#define VC_SM_MIN_VER 0
++
++/* ---- Private Constants and Types -------------------------------------- */
++
++/* Command blocks come from a pool */
++#define SM_MAX_NUM_CMD_RSP_BLKS 32
++
++/* The number of supported connections */
++#define SM_MAX_NUM_CONNECTIONS 3
++
++struct sm_cmd_rsp_blk {
++	struct list_head head;	/* To create lists */
++	/* To be signaled when the response is there */
++	struct completion cmplt;
++
++	u32 id;
++	u16 length;
++
++	u8 msg[VC_SM_MAX_MSG_LEN];
++
++	uint32_t wait:1;
++	uint32_t sent:1;
++	uint32_t alloc:1;
++
++};
++
++struct sm_instance {
++	u32 num_connections;
++	unsigned int service_handle[SM_MAX_NUM_CONNECTIONS];
++	struct task_struct *io_thread;
++	struct completion io_cmplt;
++
++	vpu_event_cb vpu_event;
++
++	/* Mutex over the following lists */
++	struct mutex lock;
++	u32 trans_id;
++	struct list_head cmd_list;
++	struct list_head rsp_list;
++	struct list_head dead_list;
++
++	struct sm_cmd_rsp_blk free_blk[SM_MAX_NUM_CMD_RSP_BLKS];
++
++	/* Mutex over the free_list */
++	struct mutex free_lock;
++	struct list_head free_list;
++
++	struct semaphore free_sema;
++
++};
++
++/* ---- Private Variables ------------------------------------------------ */
++
++/* ---- Private Function Prototypes -------------------------------------- */
++
++/* ---- Private Functions ------------------------------------------------ */
++static int
++bcm2835_vchi_msg_queue(unsigned int handle,
++		       void *data,
++		       unsigned int size)
++{
++	return vchiq_queue_kernel_message(handle, data, size);
++}
++
++static struct
++sm_cmd_rsp_blk *vc_vchi_cmd_create(struct sm_instance *instance,
++				   enum vc_sm_msg_type id, void *msg,
++				   u32 size, int wait)
++{
++	struct sm_cmd_rsp_blk *blk;
++	struct vc_sm_msg_hdr_t *hdr;
++
++	if (down_interruptible(&instance->free_sema)) {
++		blk = kmalloc(sizeof(*blk), GFP_KERNEL);
++		if (!blk)
++			return NULL;
++
++		blk->alloc = 1;
++		init_completion(&blk->cmplt);
++	} else {
++		mutex_lock(&instance->free_lock);
++		blk =
++		    list_first_entry(&instance->free_list,
++				     struct sm_cmd_rsp_blk, head);
++		list_del(&blk->head);
++		mutex_unlock(&instance->free_lock);
++	}
++
++	blk->sent = 0;
++	blk->wait = wait;
++	blk->length = sizeof(*hdr) + size;
++
++	hdr = (struct vc_sm_msg_hdr_t *)blk->msg;
++	hdr->type = id;
++	mutex_lock(&instance->lock);
++	instance->trans_id++;
++	/*
++	 * Retain the top bit for identifying asynchronous events, or VPU cmds.
++	 */
++	instance->trans_id &= ~0x80000000;
++	hdr->trans_id = instance->trans_id;
++	blk->id = instance->trans_id;
++	mutex_unlock(&instance->lock);
++
++	if (size)
++		memcpy(hdr->body, msg, size);
++
++	return blk;
++}
++
++static void
++vc_vchi_cmd_delete(struct sm_instance *instance, struct sm_cmd_rsp_blk *blk)
++{
++	if (blk->alloc) {
++		kfree(blk);
++		return;
++	}
++
++	mutex_lock(&instance->free_lock);
++	list_add(&blk->head, &instance->free_list);
++	mutex_unlock(&instance->free_lock);
++	up(&instance->free_sema);
++}
++
++static void vc_sm_cma_vchi_rx_ack(struct sm_instance *instance,
++				  struct sm_cmd_rsp_blk *cmd,
++				  struct vc_sm_result_t *reply,
++				  u32 reply_len)
++{
++	mutex_lock(&instance->lock);
++	list_for_each_entry(cmd,
++			    &instance->rsp_list,
++			    head) {
++		if (cmd->id == reply->trans_id)
++			break;
++	}
++	mutex_unlock(&instance->lock);
++
++	if (&cmd->head == &instance->rsp_list) {
++		//pr_debug("%s: received response %u, throw away...",
++		pr_err("%s: received response %u, throw away...",
++		       __func__,
++		       reply->trans_id);
++	} else if (reply_len > sizeof(cmd->msg)) {
++		pr_err("%s: reply too big (%u) %u, throw away...",
++		       __func__, reply_len,
++		     reply->trans_id);
++	} else {
++		memcpy(cmd->msg, reply,
++		       reply_len);
++		complete(&cmd->cmplt);
++	}
++}
++
++static int vc_sm_cma_vchi_videocore_io(void *arg)
++{
++	struct sm_instance *instance = arg;
++	struct sm_cmd_rsp_blk *cmd = NULL, *cmd_tmp;
++	struct vc_sm_result_t *reply;
++	struct vchiq_header *header;
++	s32 status;
++	int svc_use = 1;
++
++	while (1) {
++		if (svc_use)
++			vchiq_release_service(instance->service_handle[0]);
++		svc_use = 0;
++
++		if (wait_for_completion_interruptible(&instance->io_cmplt))
++			continue;
++		vchiq_use_service(instance->service_handle[0]);
++		svc_use = 1;
++
++		do {
++			/*
++			 * Get new command and move it to response list
++			 */
++			mutex_lock(&instance->lock);
++			if (list_empty(&instance->cmd_list)) {
++				/* no more commands to process */
++				mutex_unlock(&instance->lock);
++				break;
++			}
++			cmd = list_first_entry(&instance->cmd_list,
++					       struct sm_cmd_rsp_blk, head);
++			list_move(&cmd->head, &instance->rsp_list);
++			cmd->sent = 1;
++			mutex_unlock(&instance->lock);
++			/* Send the command */
++			status =
++				bcm2835_vchi_msg_queue(instance->service_handle[0],
++						       cmd->msg, cmd->length);
++			if (status) {
++				pr_err("%s: failed to queue message (%d)",
++				       __func__, status);
++			}
++
++			/* If no reply is needed then we're done */
++			if (!cmd->wait) {
++				mutex_lock(&instance->lock);
++				list_del(&cmd->head);
++				mutex_unlock(&instance->lock);
++				vc_vchi_cmd_delete(instance, cmd);
++				continue;
++			}
++
++			if (status) {
++				complete(&cmd->cmplt);
++				continue;
++			}
++
++		} while (1);
++
++		while ((header = vchiq_msg_hold(instance->service_handle[0]))) {
++			reply = (struct vc_sm_result_t *)header->data;
++			if (reply->trans_id & 0x80000000) {
++				/* Async event or cmd from the VPU */
++				if (instance->vpu_event)
++					instance->vpu_event(instance, reply,
++							    header->size);
++			} else {
++				vc_sm_cma_vchi_rx_ack(instance, cmd, reply,
++						      header->size);
++			}
++
++			vchiq_release_message(instance->service_handle[0],
++					      header);
++		}
++
++		/* Go through the dead list and free them */
++		mutex_lock(&instance->lock);
++		list_for_each_entry_safe(cmd, cmd_tmp, &instance->dead_list,
++					 head) {
++			list_del(&cmd->head);
++			vc_vchi_cmd_delete(instance, cmd);
++		}
++		mutex_unlock(&instance->lock);
++	}
++
++	return 0;
++}
++
++static enum vchiq_status vc_sm_cma_vchi_callback(enum vchiq_reason reason,
++						 struct vchiq_header *header,
++						 unsigned int handle, void *userdata)
++{
++	struct sm_instance *instance = vchiq_get_service_userdata(handle);
++
++	switch (reason) {
++	case VCHIQ_MESSAGE_AVAILABLE:
++		vchiq_msg_queue_push(handle, header);
++		complete(&instance->io_cmplt);
++		break;
++
++	case VCHIQ_SERVICE_CLOSED:
++		pr_info("%s: service CLOSED!!", __func__);
++		break;
++
++	default:
++		break;
++	}
++
++	return VCHIQ_SUCCESS;
++}
++
++struct sm_instance *vc_sm_cma_vchi_init(struct vchiq_instance *vchiq_instance,
++					unsigned int num_connections,
++					vpu_event_cb vpu_event)
++{
++	u32 i;
++	struct sm_instance *instance;
++	int status;
++
++	pr_debug("%s: start", __func__);
++
++	if (num_connections > SM_MAX_NUM_CONNECTIONS) {
++		pr_err("%s: unsupported number of connections %u (max=%u)",
++		       __func__, num_connections, SM_MAX_NUM_CONNECTIONS);
++
++		goto err_null;
++	}
++	/* Allocate memory for this instance */
++	instance = kzalloc(sizeof(*instance), GFP_KERNEL);
++
++	/* Misc initialisations */
++	mutex_init(&instance->lock);
++	init_completion(&instance->io_cmplt);
++	INIT_LIST_HEAD(&instance->cmd_list);
++	INIT_LIST_HEAD(&instance->rsp_list);
++	INIT_LIST_HEAD(&instance->dead_list);
++	INIT_LIST_HEAD(&instance->free_list);
++	sema_init(&instance->free_sema, SM_MAX_NUM_CMD_RSP_BLKS);
++	mutex_init(&instance->free_lock);
++	for (i = 0; i < SM_MAX_NUM_CMD_RSP_BLKS; i++) {
++		init_completion(&instance->free_blk[i].cmplt);
++		list_add(&instance->free_blk[i].head, &instance->free_list);
++	}
++
++	/* Open the VCHI service connections */
++	instance->num_connections = num_connections;
++	for (i = 0; i < num_connections; i++) {
++		struct vchiq_service_params_kernel params = {
++			.version = VC_SM_VER,
++			.version_min = VC_SM_MIN_VER,
++			.fourcc = VCHIQ_MAKE_FOURCC('S', 'M', 'E', 'M'),
++			.callback = vc_sm_cma_vchi_callback,
++			.userdata = instance,
++		};
++
++		status = vchiq_open_service(vchiq_instance, &params,
++					    &instance->service_handle[i]);
++		if (status) {
++			pr_err("%s: failed to open VCHI service (%d)",
++			       __func__, status);
++
++			goto err_close_services;
++		}
++	}
++	/* Create the thread which takes care of all io to/from videoocore. */
++	instance->io_thread = kthread_create(&vc_sm_cma_vchi_videocore_io,
++					     (void *)instance, "SMIO");
++	if (!instance->io_thread) {
++		pr_err("%s: failed to create SMIO thread", __func__);
++
++		goto err_close_services;
++	}
++	instance->vpu_event = vpu_event;
++	set_user_nice(instance->io_thread, -10);
++	wake_up_process(instance->io_thread);
++
++	pr_debug("%s: success - instance %p", __func__, instance);
++	return instance;
++
++err_close_services:
++	for (i = 0; i < instance->num_connections; i++) {
++		if (instance->service_handle[i])
++			vchiq_close_service(instance->service_handle[i]);
++	}
++	kfree(instance);
++err_null:
++	pr_debug("%s: FAILED", __func__);
++	return NULL;
++}
++
++int vc_sm_cma_vchi_stop(struct sm_instance **handle)
++{
++	struct sm_instance *instance;
++	u32 i;
++
++	if (!handle) {
++		pr_err("%s: invalid pointer to handle %p", __func__, handle);
++		goto lock;
++	}
++
++	if (!*handle) {
++		pr_err("%s: invalid handle %p", __func__, *handle);
++		goto lock;
++	}
++
++	instance = *handle;
++
++	/* Close all VCHI service connections */
++	for (i = 0; i < instance->num_connections; i++) {
++		vchiq_use_service(instance->service_handle[i]);
++		vchiq_close_service(instance->service_handle[i]);
++	}
++
++	kfree(instance);
++
++	*handle = NULL;
++	return 0;
++
++lock:
++	return -EINVAL;
++}
++
++static int vc_sm_cma_vchi_send_msg(struct sm_instance *handle,
++				   enum vc_sm_msg_type msg_id, void *msg,
++				   u32 msg_size, void *result, u32 result_size,
++				   u32 *cur_trans_id, u8 wait_reply)
++{
++	int status = 0;
++	struct sm_instance *instance = handle;
++	struct sm_cmd_rsp_blk *cmd_blk;
++
++	if (!handle) {
++		pr_err("%s: invalid handle", __func__);
++		return -EINVAL;
++	}
++	if (!msg) {
++		pr_err("%s: invalid msg pointer", __func__);
++		return -EINVAL;
++	}
++
++	cmd_blk =
++	    vc_vchi_cmd_create(instance, msg_id, msg, msg_size, wait_reply);
++	if (!cmd_blk) {
++		pr_err("[%s]: failed to allocate global tracking resource",
++		       __func__);
++		return -ENOMEM;
++	}
++
++	if (cur_trans_id)
++		*cur_trans_id = cmd_blk->id;
++
++	mutex_lock(&instance->lock);
++	list_add_tail(&cmd_blk->head, &instance->cmd_list);
++	mutex_unlock(&instance->lock);
++	complete(&instance->io_cmplt);
++
++	if (!wait_reply)
++		/* We're done */
++		return 0;
++
++	/* Wait for the response */
++	if (wait_for_completion_interruptible(&cmd_blk->cmplt)) {
++		mutex_lock(&instance->lock);
++		if (!cmd_blk->sent) {
++			list_del(&cmd_blk->head);
++			mutex_unlock(&instance->lock);
++			vc_vchi_cmd_delete(instance, cmd_blk);
++			return -ENXIO;
++		}
++
++		list_move(&cmd_blk->head, &instance->dead_list);
++		mutex_unlock(&instance->lock);
++		complete(&instance->io_cmplt);
++		return -EINTR;	/* We're done */
++	}
++
++	if (result && result_size) {
++		memcpy(result, cmd_blk->msg, result_size);
++	} else {
++		struct vc_sm_result_t *res =
++			(struct vc_sm_result_t *)cmd_blk->msg;
++		status = (res->success == 0) ? 0 : -ENXIO;
++	}
++
++	mutex_lock(&instance->lock);
++	list_del(&cmd_blk->head);
++	mutex_unlock(&instance->lock);
++	vc_vchi_cmd_delete(instance, cmd_blk);
++	return status;
++}
++
++int vc_sm_cma_vchi_free(struct sm_instance *handle, struct vc_sm_free_t *msg,
++			u32 *cur_trans_id)
++{
++	return vc_sm_cma_vchi_send_msg(handle, VC_SM_MSG_TYPE_FREE,
++				   msg, sizeof(*msg), 0, 0, cur_trans_id, 0);
++}
++
++int vc_sm_cma_vchi_import(struct sm_instance *handle, struct vc_sm_import *msg,
++			  struct vc_sm_import_result *result, u32 *cur_trans_id)
++{
++	return vc_sm_cma_vchi_send_msg(handle, VC_SM_MSG_TYPE_IMPORT,
++				   msg, sizeof(*msg), result, sizeof(*result),
++				   cur_trans_id, 1);
++}
++
++int vc_sm_cma_vchi_client_version(struct sm_instance *handle,
++				  struct vc_sm_version *msg,
++				  struct vc_sm_result_t *result,
++				  u32 *cur_trans_id)
++{
++	return vc_sm_cma_vchi_send_msg(handle, VC_SM_MSG_TYPE_CLIENT_VERSION,
++				   //msg, sizeof(*msg), result, sizeof(*result),
++				   //cur_trans_id, 1);
++				   msg, sizeof(*msg), NULL, 0,
++				   cur_trans_id, 0);
++}
++
++int vc_sm_vchi_client_vc_mem_req_reply(struct sm_instance *handle,
++				       struct vc_sm_vc_mem_request_result *msg,
++				       uint32_t *cur_trans_id)
++{
++	return vc_sm_cma_vchi_send_msg(handle,
++				       VC_SM_MSG_TYPE_VC_MEM_REQUEST_REPLY,
++				       msg, sizeof(*msg), 0, 0, cur_trans_id,
++				       0);
++}
+--- /dev/null
++++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.h
+@@ -0,0 +1,63 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++
++/*
++ * VideoCore Shared Memory CMA allocator
++ *
++ * Copyright: 2018, Raspberry Pi (Trading) Ltd
++ * Copyright 2011-2012 Broadcom Corporation.  All rights reserved.
++ *
++ * Based on vmcs_sm driver from Broadcom Corporation.
++ *
++ */
++
++#ifndef __VC_SM_CMA_VCHI_H__INCLUDED__
++#define __VC_SM_CMA_VCHI_H__INCLUDED__
++
++#include <linux/raspberrypi/vchiq.h>
++
++#include "vc_sm_defs.h"
++
++/*
++ * Forward declare.
++ */
++struct sm_instance;
++
++typedef void (*vpu_event_cb)(struct sm_instance *instance,
++			     struct vc_sm_result_t *reply, int reply_len);
++
++/*
++ * Initialize the shared memory service, opens up vchi connection to talk to it.
++ */
++struct sm_instance *vc_sm_cma_vchi_init(struct vchiq_instance *vchi_instance,
++					unsigned int num_connections,
++					vpu_event_cb vpu_event);
++
++/*
++ * Terminates the shared memory service.
++ */
++int vc_sm_cma_vchi_stop(struct sm_instance **handle);
++
++/*
++ * Ask the shared memory service to free up some memory that was previously
++ * allocated by the vc_sm_cma_vchi_alloc function call.
++ */
++int vc_sm_cma_vchi_free(struct sm_instance *handle, struct vc_sm_free_t *msg,
++			u32 *cur_trans_id);
++
++/*
++ * Import a contiguous block of memory and wrap it in a GPU MEM_HANDLE_T.
++ */
++int vc_sm_cma_vchi_import(struct sm_instance *handle, struct vc_sm_import *msg,
++			  struct vc_sm_import_result *result,
++			  u32 *cur_trans_id);
++
++int vc_sm_cma_vchi_client_version(struct sm_instance *handle,
++				  struct vc_sm_version *msg,
++				  struct vc_sm_result_t *result,
++				  u32 *cur_trans_id);
++
++int vc_sm_vchi_client_vc_mem_req_reply(struct sm_instance *handle,
++				       struct vc_sm_vc_mem_request_result *msg,
++				       uint32_t *cur_trans_id);
++
++#endif /* __VC_SM_CMA_VCHI_H__INCLUDED__ */
+--- /dev/null
++++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_defs.h
+@@ -0,0 +1,297 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++
++/*
++ * VideoCore Shared Memory CMA allocator
++ *
++ * Copyright: 2018, Raspberry Pi (Trading) Ltd
++ *
++ * Based on vc_sm_defs.h from the vmcs_sm driver Copyright Broadcom Corporation.
++ * All IPC messages are copied across to this file, even if the vc-sm-cma
++ * driver is not currently using them.
++ *
++ ****************************************************************************
++ */
++
++#ifndef __VC_SM_DEFS_H__INCLUDED__
++#define __VC_SM_DEFS_H__INCLUDED__
++
++/* Maximum message length */
++#define VC_SM_MAX_MSG_LEN (sizeof(union vc_sm_msg_union_t) + \
++	sizeof(struct vc_sm_msg_hdr_t))
++#define VC_SM_MAX_RSP_LEN (sizeof(union vc_sm_msg_union_t))
++
++/* Resource name maximum size */
++#define VC_SM_RESOURCE_NAME 32
++
++/*
++ * Version to be reported to the VPU
++ * VPU assumes 0 (aka 1) which does not require the released callback, nor
++ * expect the client to handle VC_MEM_REQUESTS.
++ * Version 2 requires the released callback, and must support VC_MEM_REQUESTS.
++ */
++#define VC_SM_PROTOCOL_VERSION	2
++
++enum vc_sm_msg_type {
++	/* Message types supported for HOST->VC direction */
++
++	/* Allocate shared memory block */
++	VC_SM_MSG_TYPE_ALLOC,
++	/* Lock allocated shared memory block */
++	VC_SM_MSG_TYPE_LOCK,
++	/* Unlock allocated shared memory block */
++	VC_SM_MSG_TYPE_UNLOCK,
++	/* Unlock allocated shared memory block, do not answer command */
++	VC_SM_MSG_TYPE_UNLOCK_NOANS,
++	/* Free shared memory block */
++	VC_SM_MSG_TYPE_FREE,
++	/* Resize a shared memory block */
++	VC_SM_MSG_TYPE_RESIZE,
++	/* Walk the allocated shared memory block(s) */
++	VC_SM_MSG_TYPE_WALK_ALLOC,
++
++	/* A previously applied action will need to be reverted */
++	VC_SM_MSG_TYPE_ACTION_CLEAN,
++
++	/*
++	 * Import a physical address and wrap into a MEM_HANDLE_T.
++	 * Release with VC_SM_MSG_TYPE_FREE.
++	 */
++	VC_SM_MSG_TYPE_IMPORT,
++	/*
++	 *Tells VC the protocol version supported by this client.
++	 * 2 supports the async/cmd messages from the VPU for final release
++	 * of memory, and for VC allocations.
++	 */
++	VC_SM_MSG_TYPE_CLIENT_VERSION,
++	/* Response to VC request for memory */
++	VC_SM_MSG_TYPE_VC_MEM_REQUEST_REPLY,
++
++	/*
++	 * Asynchronous/cmd messages supported for VC->HOST direction.
++	 * Signalled by setting the top bit in vc_sm_result_t trans_id.
++	 */
++
++	/*
++	 * VC has finished with an imported memory allocation.
++	 * Release any Linux reference counts on the underlying block.
++	 */
++	VC_SM_MSG_TYPE_RELEASED,
++	/* VC request for memory */
++	VC_SM_MSG_TYPE_VC_MEM_REQUEST,
++
++	VC_SM_MSG_TYPE_MAX
++};
++
++/* Type of memory to be allocated */
++enum vc_sm_alloc_type_t {
++	VC_SM_ALLOC_CACHED,
++	VC_SM_ALLOC_NON_CACHED,
++};
++
++/* Message header for all messages in HOST->VC direction */
++struct vc_sm_msg_hdr_t {
++	u32 type;
++	u32 trans_id;
++	u8 body[0];
++
++};
++
++/* Request to allocate memory (HOST->VC) */
++struct vc_sm_alloc_t {
++	/* type of memory to allocate */
++	enum vc_sm_alloc_type_t type;
++	/* byte amount of data to allocate per unit */
++	u32 base_unit;
++	/* number of unit to allocate */
++	u32 num_unit;
++	/* alignment to be applied on allocation */
++	u32 alignment;
++	/* identity of who allocated this block */
++	u32 allocator;
++	/* resource name (for easier tracking on vc side) */
++	char name[VC_SM_RESOURCE_NAME];
++
++};
++
++/* Result of a requested memory allocation (VC->HOST) */
++struct vc_sm_alloc_result_t {
++	/* Transaction identifier */
++	u32 trans_id;
++
++	/* Resource handle */
++	u32 res_handle;
++	/* Pointer to resource buffer */
++	u32 res_mem;
++	/* Resource base size (bytes) */
++	u32 res_base_size;
++	/* Resource number */
++	u32 res_num;
++
++};
++
++/* Request to free a previously allocated memory (HOST->VC) */
++struct vc_sm_free_t {
++	/* Resource handle (returned from alloc) */
++	u32 res_handle;
++	/* Resource buffer (returned from alloc) */
++	u32 res_mem;
++
++};
++
++/* Request to lock a previously allocated memory (HOST->VC) */
++struct vc_sm_lock_unlock_t {
++	/* Resource handle (returned from alloc) */
++	u32 res_handle;
++	/* Resource buffer (returned from alloc) */
++	u32 res_mem;
++
++};
++
++/* Request to resize a previously allocated memory (HOST->VC) */
++struct vc_sm_resize_t {
++	/* Resource handle (returned from alloc) */
++	u32 res_handle;
++	/* Resource buffer (returned from alloc) */
++	u32 res_mem;
++	/* Resource *new* size requested (bytes) */
++	u32 res_new_size;
++
++};
++
++/* Result of a requested memory lock (VC->HOST) */
++struct vc_sm_lock_result_t {
++	/* Transaction identifier */
++	u32 trans_id;
++
++	/* Resource handle */
++	u32 res_handle;
++	/* Pointer to resource buffer */
++	u32 res_mem;
++	/*
++	 * Pointer to former resource buffer if the memory
++	 * was reallocated
++	 */
++	u32 res_old_mem;
++
++};
++
++/* Generic result for a request (VC->HOST) */
++struct vc_sm_result_t {
++	/* Transaction identifier */
++	u32 trans_id;
++
++	s32 success;
++
++};
++
++/* Request to revert a previously applied action (HOST->VC) */
++struct vc_sm_action_clean_t {
++	/* Action of interest */
++	enum vc_sm_msg_type res_action;
++	/* Transaction identifier for the action of interest */
++	u32 action_trans_id;
++
++};
++
++/* Request to remove all data associated with a given allocator (HOST->VC) */
++struct vc_sm_free_all_t {
++	/* Allocator identifier */
++	u32 allocator;
++};
++
++/* Request to import memory (HOST->VC) */
++struct vc_sm_import {
++	/* type of memory to allocate */
++	enum vc_sm_alloc_type_t type;
++	/* pointer to the VC (ie physical) address of the allocated memory */
++	u32 addr;
++	/* size of buffer */
++	u32 size;
++	/* opaque handle returned in RELEASED messages */
++	u32 kernel_id;
++	/* Allocator identifier */
++	u32 allocator;
++	/* resource name (for easier tracking on vc side) */
++	char     name[VC_SM_RESOURCE_NAME];
++};
++
++/* Result of a requested memory import (VC->HOST) */
++struct vc_sm_import_result {
++	/* Transaction identifier */
++	u32 trans_id;
++
++	/* Resource handle */
++	u32 res_handle;
++};
++
++/* Notification that VC has finished with an allocation (VC->HOST) */
++struct vc_sm_released {
++	/* cmd type / trans_id */
++	u32 cmd;
++
++	/* pointer to the VC (ie physical) address of the allocated memory */
++	u32 addr;
++	/* size of buffer */
++	u32 size;
++	/* opaque handle returned in RELEASED messages */
++	u32 kernel_id;
++	u32 vc_handle;
++};
++
++/*
++ * Client informing VC as to the protocol version it supports.
++ * >=2 requires the released callback, and supports VC asking for memory.
++ * Failure means that the firmware doesn't support this call, and therefore the
++ * client should either fail, or NOT rely on getting the released callback.
++ */
++struct vc_sm_version {
++	u32 version;
++};
++
++/* Request FROM VideoCore for some memory */
++struct vc_sm_vc_mem_request {
++	/* cmd type */
++	u32 cmd;
++
++	/* trans_id (from VPU) */
++	u32 trans_id;
++	/* size of buffer */
++	u32 size;
++	/* alignment of buffer */
++	u32 align;
++	/* resource name (for easier tracking) */
++	char     name[VC_SM_RESOURCE_NAME];
++	/* VPU handle for the resource */
++	u32 vc_handle;
++};
++
++/* Response from the kernel to provide the VPU with some memory */
++struct vc_sm_vc_mem_request_result {
++	/* Transaction identifier for the VPU */
++	u32 trans_id;
++	/* pointer to the physical address of the allocated memory */
++	u32 addr;
++	/* opaque handle returned in RELEASED messages */
++	u32 kernel_id;
++};
++
++/* Union of ALL messages */
++union vc_sm_msg_union_t {
++	struct vc_sm_alloc_t alloc;
++	struct vc_sm_alloc_result_t alloc_result;
++	struct vc_sm_free_t free;
++	struct vc_sm_lock_unlock_t lock_unlock;
++	struct vc_sm_action_clean_t action_clean;
++	struct vc_sm_resize_t resize;
++	struct vc_sm_lock_result_t lock_result;
++	struct vc_sm_result_t result;
++	struct vc_sm_free_all_t free_all;
++	struct vc_sm_import import;
++	struct vc_sm_import_result import_result;
++	struct vc_sm_version version;
++	struct vc_sm_released released;
++	struct vc_sm_vc_mem_request vc_request;
++	struct vc_sm_vc_mem_request_result vc_request_result;
++};
++
++#endif /* __VC_SM_DEFS_H__INCLUDED__ */
+--- /dev/null
++++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_knl.h
+@@ -0,0 +1,28 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++
++/*
++ * VideoCore Shared Memory CMA allocator
++ *
++ * Copyright: 2018, Raspberry Pi (Trading) Ltd
++ *
++ * Based on vc_sm_defs.h from the vmcs_sm driver Copyright Broadcom Corporation.
++ *
++ */
++
++#ifndef __VC_SM_KNL_H__INCLUDED__
++#define __VC_SM_KNL_H__INCLUDED__
++
++#if !defined(__KERNEL__)
++#error "This interface is for kernel use only..."
++#endif
++
++/* Free a previously allocated or imported shared memory handle and block. */
++int vc_sm_cma_free(void *handle);
++
++/* Get an internal resource handle mapped from the external one. */
++int vc_sm_cma_int_handle(void *handle);
++
++/* Import a block of memory into the GPU space. */
++int vc_sm_cma_import_dmabuf(struct dma_buf *dmabuf, void **handle);
++
++#endif /* __VC_SM_KNL_H__INCLUDED__ */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0274-staging-vchiq-mmal-Add-support-for-14bit-Bayer.patch b/target/linux/bcm27xx/patches-6.1/950-0274-staging-vchiq-mmal-Add-support-for-14bit-Bayer.patch
new file mode 100644
index 00000000000000..dedef4ea66a840
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0274-staging-vchiq-mmal-Add-support-for-14bit-Bayer.patch
@@ -0,0 +1,27 @@
+From 7e0330332a23b9ed956bec1636c8ade60484ad3e Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 6 May 2020 18:09:04 +0100
+Subject: [PATCH] staging: vchiq-mmal: Add support for 14bit Bayer
+
+Add in the missing defines.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
+@@ -90,6 +90,12 @@
+ #define MMAL_ENCODING_BAYER_SGBRG12P   MMAL_FOURCC('p', 'G', '1', '2')
+ #define MMAL_ENCODING_BAYER_SRGGB12P   MMAL_FOURCC('p', 'R', '1', '2')
+ 
++//14 bit per pixel Bayer formats.
++#define MMAL_ENCODING_BAYER_SBGGR14P   MMAL_FOURCC('p', 'B', 'E', 'E')
++#define MMAL_ENCODING_BAYER_SGBRG14P   MMAL_FOURCC('p', 'G', 'E', 'E')
++#define MMAL_ENCODING_BAYER_SGRBG14P   MMAL_FOURCC('p', 'g', 'E', 'E')
++#define MMAL_ENCODING_BAYER_SRGGB14P   MMAL_FOURCC('p', 'R', 'E', 'E')
++
+ /* 16 bit per pixel Bayer formats. */
+ #define MMAL_ENCODING_BAYER_SBGGR16    MMAL_FOURCC('B', 'G', '1', '6')
+ #define MMAL_ENCODING_BAYER_SGBRG16    MMAL_FOURCC('G', 'B', '1', '6')
diff --git a/target/linux/bcm27xx/patches-6.1/950-0275-staging-mmal-vchiq-Add-monochrome-image-formats.patch b/target/linux/bcm27xx/patches-6.1/950-0275-staging-mmal-vchiq-Add-monochrome-image-formats.patch
new file mode 100644
index 00000000000000..8da8b311a653bc
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0275-staging-mmal-vchiq-Add-monochrome-image-formats.patch
@@ -0,0 +1,29 @@
+From 6066374b96db2606ea740c4a45b1c59edc8762d4 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 6 May 2020 18:11:14 +0100
+Subject: [PATCH] staging: mmal-vchiq: Add monochrome image formats
+
+Adds support for monochrome image formats in the various
+MIPI packings.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
+@@ -102,6 +102,13 @@
+ #define MMAL_ENCODING_BAYER_SGRBG16    MMAL_FOURCC('G', 'R', '1', '6')
+ #define MMAL_ENCODING_BAYER_SRGGB16    MMAL_FOURCC('R', 'G', '1', '6')
+ 
++/* MIPI packed monochrome images */
++#define MMAL_ENCODING_GREY    MMAL_FOURCC('G', 'R', 'E', 'Y')
++#define MMAL_ENCODING_Y10P    MMAL_FOURCC('Y', '1', '0', 'P')
++#define MMAL_ENCODING_Y12P    MMAL_FOURCC('Y', '1', '2', 'P')
++#define MMAL_ENCODING_Y14P    MMAL_FOURCC('Y', '1', '4', 'P')
++#define MMAL_ENCODING_Y16     MMAL_FOURCC('Y', '1', '6', ' ')
++
+ /** An EGL image handle
+  */
+ #define MMAL_ENCODING_EGL_IMAGE        MMAL_FOURCC('E', 'G', 'L', 'I')
diff --git a/target/linux/bcm27xx/patches-6.1/950-0276-staging-mmal-vchiq-Use-vc-sm-cma-to-support-zero-cop.patch b/target/linux/bcm27xx/patches-6.1/950-0276-staging-mmal-vchiq-Use-vc-sm-cma-to-support-zero-cop.patch
new file mode 100644
index 00000000000000..bcb322d55aa420
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0276-staging-mmal-vchiq-Use-vc-sm-cma-to-support-zero-cop.patch
@@ -0,0 +1,162 @@
+From ea4f926ea7fd76d0eeb4825bece0e3eaf36f3b0e Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Tue, 25 Sep 2018 16:07:55 +0100
+Subject: [PATCH] staging: mmal-vchiq: Use vc-sm-cma to support zero
+ copy
+
+With the vc-sm-cma driver we can support zero copy of buffers between
+the kernel and VPU. Add this support to mmal-vchiq.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../staging/vc04_services/vchiq-mmal/Kconfig  |  1 +
+ .../vc04_services/vchiq-mmal/mmal-common.h    |  4 ++
+ .../vc04_services/vchiq-mmal/mmal-vchiq.c     | 65 ++++++++++++++++++-
+ .../vc04_services/vchiq-mmal/mmal-vchiq.h     |  1 +
+ 4 files changed, 69 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/Kconfig
++++ b/drivers/staging/vc04_services/vchiq-mmal/Kconfig
+@@ -1,6 +1,7 @@
+ config BCM2835_VCHIQ_MMAL
+ 	tristate "BCM2835 MMAL VCHIQ service"
+ 	depends on BCM2835_VCHIQ
++	select BCM_VC_SM_CMA
+ 	help
+ 	  Enables the MMAL API over VCHIQ interface as used for the
+ 	  majority of the multimedia services on VideoCore.
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
+@@ -50,6 +50,10 @@ struct mmal_buffer {
+ 
+ 	struct mmal_msg_context *msg_context;
+ 
++	struct dma_buf *dma_buf;/* Exported dmabuf fd from videobuf2 */
++	void *vcsm_handle;	/* VCSM handle having imported the dmabuf */
++	u32 vc_handle;		/* VC handle to that dmabuf */
++
+ 	u32 cmd;		/* MMAL command. 0=data. */
+ 	unsigned long length;
+ 	u32 mmal_flags;
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+@@ -27,9 +27,11 @@
+ #include <media/videobuf2-vmalloc.h>
+ 
+ #include "mmal-common.h"
++#include "mmal-parameters.h"
+ #include "mmal-vchiq.h"
+ #include "mmal-msg.h"
+ 
++#include "vc-sm-cma/vc_sm_knl.h"
+ /*
+  * maximum number of components supported.
+  * This matches the maximum permitted by default on the VPU
+@@ -416,8 +418,13 @@ buffer_from_host(struct vchiq_mmal_insta
+ 
+ 	/* buffer header */
+ 	m.u.buffer_from_host.buffer_header.cmd = 0;
+-	m.u.buffer_from_host.buffer_header.data =
+-		(u32)(unsigned long)buf->buffer;
++	if (port->zero_copy) {
++		m.u.buffer_from_host.buffer_header.data = buf->vc_handle;
++	} else {
++		m.u.buffer_from_host.buffer_header.data =
++			(u32)(unsigned long)buf->buffer;
++	}
++
+ 	m.u.buffer_from_host.buffer_header.alloc_size = buf->buffer_size;
+ 	if (port->type == MMAL_PORT_TYPE_OUTPUT) {
+ 		m.u.buffer_from_host.buffer_header.length = 0;
+@@ -583,6 +590,22 @@ static void buffer_to_host_cb(struct vch
+ 
+ 		msg_context->u.bulk.status = msg->h.status;
+ 
++	} else if (msg->u.buffer_from_host.is_zero_copy) {
++		/*
++		 * Zero copy buffer, so nothing to do.
++		 * Copy buffer info and make callback.
++		 */
++		msg_context->u.bulk.buffer_used =
++				msg->u.buffer_from_host.buffer_header.length;
++		msg_context->u.bulk.mmal_flags =
++				msg->u.buffer_from_host.buffer_header.flags;
++		msg_context->u.bulk.dts =
++				msg->u.buffer_from_host.buffer_header.dts;
++		msg_context->u.bulk.pts =
++				msg->u.buffer_from_host.buffer_header.pts;
++		msg_context->u.bulk.cmd =
++				msg->u.buffer_from_host.buffer_header.cmd;
++
+ 	} else if (msg->u.buffer_from_host.buffer_header.length == 0) {
+ 		/* empty buffer */
+ 		if (msg->u.buffer_from_host.buffer_header.flags &
+@@ -1528,6 +1551,9 @@ int vchiq_mmal_port_parameter_set(struct
+ 
+ 	mutex_unlock(&instance->vchiq_mutex);
+ 
++	if (parameter == MMAL_PARAMETER_ZERO_COPY && !ret)
++		port->zero_copy = !!(*(bool *)value);
++
+ 	return ret;
+ }
+ EXPORT_SYMBOL_GPL(vchiq_mmal_port_parameter_set);
+@@ -1696,6 +1722,31 @@ int vchiq_mmal_submit_buffer(struct vchi
+ 	unsigned long flags = 0;
+ 	int ret;
+ 
++	/*
++	 * We really want to do this in mmal_vchi_buffer_init but can't as
++	 * videobuf2 won't let us have the dmabuf there.
++	 */
++	if (port->zero_copy && buffer->dma_buf && !buffer->vcsm_handle) {
++		pr_debug("%s: import dmabuf %p\n", __func__, buffer->dma_buf);
++		ret = vc_sm_cma_import_dmabuf(buffer->dma_buf,
++					      &buffer->vcsm_handle);
++		if (ret) {
++			pr_err("%s: vc_sm_import_dmabuf_fd failed, ret %d\n",
++			       __func__, ret);
++			return ret;
++		}
++
++		buffer->vc_handle = vc_sm_cma_int_handle(buffer->vcsm_handle);
++		if (!buffer->vc_handle) {
++			pr_err("%s: vc_sm_int_handle failed %d\n",
++			       __func__, ret);
++			vc_sm_cma_free(buffer->vcsm_handle);
++			return ret;
++		}
++		pr_debug("%s: import dmabuf %p - got vc handle %08X\n",
++			 __func__, buffer->dma_buf, buffer->vc_handle);
++	}
++
+ 	ret = buffer_from_host(instance, port, buffer);
+ 	if (ret == -EINVAL) {
+ 		/* Port is disabled. Queue for when it is enabled. */
+@@ -1729,6 +1780,16 @@ int mmal_vchi_buffer_cleanup(struct mmal
+ 		release_msg_context(msg_context);
+ 	buf->msg_context = NULL;
+ 
++	if (buf->vcsm_handle) {
++		int ret;
++
++		pr_debug("%s: vc_sm_cma_free on handle %p\n", __func__,
++			 buf->vcsm_handle);
++		ret = vc_sm_cma_free(buf->vcsm_handle);
++		if (ret)
++			pr_err("%s: vcsm_free failed, ret %d\n", __func__, ret);
++		buf->vcsm_handle = 0;
++	}
+ 	return 0;
+ }
+ EXPORT_SYMBOL_GPL(mmal_vchi_buffer_cleanup);
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
+@@ -49,6 +49,7 @@ typedef void (*vchiq_mmal_buffer_cb)(
+ 
+ struct vchiq_mmal_port {
+ 	u32 enabled:1;
++	u32 zero_copy:1;
+ 	u32 handle;
+ 	u32 type; /* port type, cached to use on port info set */
+ 	u32 index; /* port index, cached to use on port info set */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0277-staging-vc04_services-Add-a-V4L2-M2M-codec-driver.patch b/target/linux/bcm27xx/patches-6.1/950-0277-staging-vc04_services-Add-a-V4L2-M2M-codec-driver.patch
new file mode 100644
index 00000000000000..e35a63d90e210b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0277-staging-vc04_services-Add-a-V4L2-M2M-codec-driver.patch
@@ -0,0 +1,4333 @@
+From 118b44fa3c1c3de2c8330324f6acfc8c921f3878 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 8 Oct 2020 20:24:12 +0100
+Subject: [PATCH] staging: vc04_services: Add a V4L2 M2M codec driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This adds a V4L2 memory to memory device that wraps the MMAL
+video decode and video_encode components for H264 and MJPEG encode
+and decode, MPEG4, H263, and VP8 decode (and MPEG2 decode
+if the appropriate licence has been purchased).
+
+This patch squashes all the work done in developing the driver
+on the Raspberry Pi rpi-5.4.y kernel branch.
+Thanks to Kieran Bingham, Aman Gupta, Chen-Yu Tsai, and
+Marek Behún for their contributions. Please refer to the
+rpi-5.4.y branch for the full history.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Ensure OUTPUT timestamps are always forwarded
+
+The firmware by default tries to ensure that decoded frame
+timestamps always increment. This is counter to the V4L2 API
+which wants exactly the OUTPUT queue timestamps passed to the
+CAPTURE queue buffers.
+
+Disable the firmware option.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/vc04_services/codec: Add support for CID MPEG_HEADER_MODE
+
+Control V4L2_CID_MPEG_VIDEO_HEADER_MODE controls whether the encoder
+is meant to emit the header bytes as a separate packet or with the
+first encoded frame.
+Add support for it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/vc04_services/codec: Clear last buf dequeued flag on START
+
+It appears that the V4L2 M2M framework requires the driver to manually
+call vb2_clear_last_buffer_dequeued on the CAPTURE queue during a
+V4L2_DEC_CMD_START.
+Add such a call.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/vc04-services/codec: Fix logical precedence issue
+
+Two issues identified with operator precedence in logical
+expressions. Fix them.
+
+https://github.com/raspberrypi/linux/issues/4040
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+vc04_services: bcm2835-codec: Switch to s32fract
+
+staging/bcm2835-codec: Add the unpacked (16bpp) raw formats
+
+Now that the firmware supports the unpacked (16bpp) variants
+of the MIPI raw formats, add the mappings.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Log the number of excess supported formats
+
+When logging that the firmware has provided more supported formats
+than we had allocated storage for, log the number allocated and
+returned.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Add support for pixel aspect ratio
+
+If the format is detected by the driver and a V4L2_EVENT_SOURCE_CHANGE
+event is generated, then pass on the pixel aspect ratio as well.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Implement additional g_selection calls for decode
+
+v4l_cropcap calls our vidioc_g_pixelaspect function to get the pixel
+aspect ratio, but also calls g_selection for V4L2_SEL_TGT_CROP_BOUNDS
+and V4L2_SEL_TGT_CROP_DEFAULT. Whilst it allows for vidioc_g_pixelaspect
+not to be implemented, it doesn't allow for either of the other two.
+
+Add in support for the additional selection targets.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Add VC-1 support.
+
+Providing the relevant licence has been purchased, then Pi0-3
+can decode VC-1.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Fix support for levels 4.1 and 4.2
+
+The driver said it supported H264 levels 4.1 and 4.2, but
+was missing the V4L2 to MMAL mappings.
+
+Add in those mappings.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Set the colourspace appropriately for RGB formats
+
+Video decode supports YUV and RGB formats. YUV needs to report SMPTE170M
+or REC709 appropriately, whilst RGB should report SRGB.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Pass corrupt frame flag.
+
+MMAL has the flag MMAL_BUFFER_HEADER_FLAG_CORRUPTED but that
+wasn't being passed through, so add it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Do not update crop from S_FMT after res change
+
+During decode, setting the CAPTURE queue format was setting the crop
+rectangle to the requested height before aligning up the format to
+cater for simple clients that weren't expecting to deal with cropping
+and the SELECTION API.
+This caused problems on some resolution change events if the client
+didn't also then use the selection API.
+
+Disable the crop update after a resolution change.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+bcm2835: Allow compressed frames to set sizeimage (#4386)
+
+Allow the user to set sizeimage in TRY_FMT and S_FMT if the format
+flags have V4L2_FMT_FLAG_COMPRESSED set
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+staging/bcm2835-codec: Change the default codec res to 32x32
+
+In order to effectively guarantee that a V4L2_EVENT_SOURCE_CHANGE
+event occurs, adopt a default resolution of 32x32 so that it
+is incredibly unlikely to be decoding a stream of that resolution
+and therefore failing to note a "change" requiring the event.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Add support for decoding interlaced streams
+
+The video decoder can support decoding interlaced streams, so add
+the required plumbing to signal this correctly.
+
+The encoder and ISP do NOT support interlaced data, so trying to
+configure an interlaced format on those nodes will be rejected.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Correct ENUM_FRAMESIZES stepsize to 2
+
+Being YUV420 formats, the step size is always 2 to avoid part
+chroma subsampling.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Return buffers to QUEUED not ERROR state
+
+Should start_streaming fail, or buffers be queued during
+stop_streaming, they should be returned to the core as QUEUED
+and not (as currently) as ERROR.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835_codec: Log MMAL flags in hex
+
+The flags is a bitmask, so it's far easier to interpret as hex
+data instead of decimal.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835-codec: Allow custom specified strides/bytesperline.
+
+If the client provides a bytesperline value in try_fmt/s_fmt then
+validate it and correct if necessary.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835_codec: Add support for image_fx to deinterlace
+
+Adds another /dev/video node wrapping image_fx doing deinterlace.
+
+Co-developed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+staging/bcm2835-v4l2_codec: Fix for encode selection API
+
+Matches correct behaviour from DECODE and DEINTERLACE
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+staging: bcm2835-codec: Allow decode res changed before STREAMON(CAPTURE)
+
+The V4L2 stateful video decoder API requires that you can STREAMON
+on only the OUTPUT queue, feed in buffers, and wait for the
+SOURCE_CHANGE event.
+This requires that we enable the MMAL output port at the same time
+as the input port, because the output port is the one that creates
+the SOURCE_CHANGED event.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Do not send buffers to the VPU unless streaming
+
+With video decode we now enable both input and output ports on
+the component. This means that buffers will get passed to the VPU
+earlier than desired if they are queued befoer STREAMON.
+
+Check that the queue is streaming before sending buffers to the VPU.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835-codec: Format changed should trigger drain
+
+When a format changed event occurs, the spec says that it
+triggers an implicit drain, and that needs to be signalled
+via -EPIPE.
+
+For BCM2835, the format changed event happens at the point
+the format change occurs, so no further buffers exist from
+before the resolution changed point. We therefore signal the
+last buffer immediately.
+We don't have a V4L2 available to us at this point, so set
+the videobuf2 queue last_buffer_dequeued flag directly.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835-codec: Signal the firmware to stop on all changes
+
+The firmware defaults to not stopping video decode if only the
+pixel aspect ratio or colourspace change. V4L2 requires us
+to stop decoding on any change, therefore tell the firmware
+of the desire for this alternate behaviour.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835-codec: Queue flushed buffers instead of completing
+
+When a buffer is returned on a port that is disabled, return it
+to the videobuf2 QUEUED state instead of DONE which returns it
+to the client.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835_codec: Correct flushing code for refcounting
+
+Completions don't reference count, so setting the completion
+on the first buffer returned and then not reinitialising it
+means that the flush function doesn't behave as intended.
+
+Signal the completion when the last buffer is returned.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835-codec: Ensure all ctrls are set on streamon
+
+Currently the code was only setting some controls from
+bcm2835_codec_set_ctrls, but it's simpler to use
+v4l2_ctrl_handler_setup to avoid forgetting to adding new
+controls to the list.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835-codec: Add support for H&V Flips to ISP
+
+The ISP can do H & V flips whilst resizing or converting
+the image, so expose that via V4L2_CID_[H|V]FLIP.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+bcm2835-v4l2-codec: Remove advertised support of VP8
+
+The support for this format by firmware is very limited
+and won't be faster than the arm.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+Pass V4L2_CID_MPEG_VIDEO_H264_MIN_QP/MAX_QP to bcm2835-v4l2-codec
+
+Following raspberrypi/linux#4704. This is necessary to set up
+quantization for variable bitrate to avoid video flickering.
+
+staging/bcm2835-codec: bytesperline for YUV420/YVU420 needs to be 64
+
+Matching https://github.com/raspberrypi/linux/pull/4419, the ISP
+block (which is also used on the input of the encoder, and output
+of the decoder) needs the base address of all planes to be aligned
+to multiples of 32. This includes the chroma planes of YUV420 and
+YVU420.
+If the height is only a multiple of 2 (not 4), then you get an odd
+number of lines in the second plane, which means the 3rd plane
+starts at a multiple of bytesperline/2.
+
+Set the minimum bytesperline alignment to 64 for those formats
+so that the plane alignment is always right.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Allow a different stride alignment per role
+
+Deinterlace and decode aren't affected in the same way as encode
+and ISP by the alignment requirement on 3 plane YUV420.
+Decode would be affected, but it always aligns the height up to
+a macroblock, and uses the selection API to reflect that.
+
+Add in the facility to set the bytesperline alignment per role.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: vc04_services: codec: Add support for V4L2_PIX_FMT_RGBA32 format
+
+We already support V4L2_PIX_FMT_BGR32 which is the same thing with red
+and blue swapped, so it makes sense to include this variant as well.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+bcm2835-codec: Return empty buffers to the VPU instead of queueing to vbuf2
+
+The encoder can skip frames totally should rate control overshoot
+the target bitrate too far. In this situation it generates an
+output buffer of length 0.
+V4L2 treats a buffer of length 0 as an end of stream flag, which is
+not appropriate in this case, therefore we can not return that buffer
+to the client.
+
+The driver was returning the buffer to videobuf2 in the QUEUED state,
+however that buffer was then not dequeued again, so the number of
+buffers was reduced each time this happened. In the pathological
+case of using GStreamer's videotestsrc in mode 1 for noise, this happens
+sufficiently frequently to totally stall the pipeline.
+
+If the port is still enabled then return the buffer straight back to
+the VPU rather than to videobuf2.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+vc04_services: bcm2835-codec: Add support for V4L2_PIX_FMT_NV12_COL128
+
+V4L2_PIX_FMT_NV12_COL128 is supported by the ISP and the input of
+video_encode, output of video_decode, and both input and output
+of the ISP.
+
+Add in the plumbing to support the format on those ports.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+vc04_services: bcm2835-codec: Set crop_height for compressed formats
+
+In particular for the encoder where the CAPTURE format dictates
+the parameters given to the codec we need to be able to set the
+value passed as the crop_height for the compressed format.
+There's no crop available for cropped modes, so always set
+crop_height to the requested height.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+vc04_services: bcm2835-codec: Set port format from s_selection
+
+s_selection allows the crop region of an uncompressed pixel
+format to be specified, but it wasn't passing the setting on to
+the firmware. Depending on call order this would potentially
+mean that the crop wasn't actioned.
+
+Set the port format on s_selection if we have a component created.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+bcm2835-codec: /dev/video31 as interface to image_encode JPEG encoder
+
+Signed-off-by: Maxim Devaev <mdevaev@gmail.com>
+
+bcm2835-v4l2-codec: support H.264 5.0 and 5.1 levels
+
+vc04_services: bcm2835-codec:  Remove redundant role check
+
+vidioc_try_encoder_cmd checks the role, but the ioctl is disabled
+for any roles in which it is invalid.
+
+Remove the redundant check.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+vc04_services: bcm2835-codec: Allow encoder_cmd on ISP and deinterlace
+
+ISP and deinterlace also need a mechanism for passing effectively
+an EOS through the pipeline to signal when all buffers have been
+processed.
+
+VIDIOC_ENCODER_CMD does exactly this for encoders, so reuse the same
+function for ISP and deinterlace.
+(VIDIOC_DECODER_CMD is slightly different in that it also passes
+details of when and how to stop, so is not as relevant).
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/Kconfig         |    1 +
+ drivers/staging/vc04_services/Makefile        |    1 +
+ .../vc04_services/bcm2835-codec/Kconfig       |   11 +
+ .../vc04_services/bcm2835-codec/Makefile      |    8 +
+ .../staging/vc04_services/bcm2835-codec/TODO  |    1 +
+ .../bcm2835-codec/bcm2835-v4l2-codec.c        | 3834 +++++++++++++++++
+ .../vchiq-mmal/mmal-parameters.h              |    8 +
+ 7 files changed, 3864 insertions(+)
+ create mode 100644 drivers/staging/vc04_services/bcm2835-codec/Kconfig
+ create mode 100644 drivers/staging/vc04_services/bcm2835-codec/Makefile
+ create mode 100644 drivers/staging/vc04_services/bcm2835-codec/TODO
+ create mode 100644 drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+
+--- a/drivers/staging/vc04_services/Kconfig
++++ b/drivers/staging/vc04_services/Kconfig
+@@ -45,6 +45,7 @@ source "drivers/staging/vc04_services/bc
+ source "drivers/staging/vc04_services/bcm2835-camera/Kconfig"
+ 
+ source "drivers/staging/vc04_services/vc-sm-cma/Kconfig"
++source "drivers/staging/vc04_services/bcm2835-codec/Kconfig"
+ 
+ source "drivers/staging/vc04_services/vchiq-mmal/Kconfig"
+ 
+--- a/drivers/staging/vc04_services/Makefile
++++ b/drivers/staging/vc04_services/Makefile
+@@ -15,6 +15,7 @@ obj-$(CONFIG_SND_BCM2835)		+= bcm2835-au
+ obj-$(CONFIG_VIDEO_BCM2835)		+= bcm2835-camera/
+ obj-$(CONFIG_BCM2835_VCHIQ_MMAL)	+= vchiq-mmal/
+ obj-$(CONFIG_BCM_VC_SM_CMA)		+= vc-sm-cma/
++obj-$(CONFIG_VIDEO_CODEC_BCM2835)	+= bcm2835-codec/
+ 
+ ccflags-y += -I $(srctree)/$(src)/include
+ 
+--- /dev/null
++++ b/drivers/staging/vc04_services/bcm2835-codec/Kconfig
+@@ -0,0 +1,11 @@
++config VIDEO_CODEC_BCM2835
++	tristate "BCM2835 Video codec support"
++	depends on MEDIA_SUPPORT && MEDIA_CONTROLLER
++	depends on VIDEO_DEV && (ARCH_BCM2835 || COMPILE_TEST)
++	select BCM2835_VCHIQ_MMAL
++	select VIDEOBUF2_DMA_CONTIG
++	select V4L2_MEM2MEM_DEV
++	help
++	  Say Y here to enable the V4L2 video codecs for
++	  Broadcom BCM2835 SoC. This operates over the VCHIQ interface
++	  to a service running on VideoCore.
+--- /dev/null
++++ b/drivers/staging/vc04_services/bcm2835-codec/Makefile
+@@ -0,0 +1,8 @@
++# SPDX-License-Identifier: GPL-2.0
++bcm2835-codec-objs := bcm2835-v4l2-codec.o
++
++obj-$(CONFIG_VIDEO_CODEC_BCM2835) += bcm2835-codec.o
++
++ccflags-y += \
++	-I$(srctree)/drivers/staging/vc04_services \
++	-D__VCCOREVER__=0x04000000
+--- /dev/null
++++ b/drivers/staging/vc04_services/bcm2835-codec/TODO
+@@ -0,0 +1 @@
++No issues. Depends on VCHIQ which is in staging.
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+@@ -0,0 +1,3834 @@
++// SPDX-License-Identifier: GPL-2.0
++
++/*
++ * A v4l2-mem2mem device that wraps the video codec MMAL component.
++ *
++ * Copyright 2018 Raspberry Pi (Trading) Ltd.
++ * Author: Dave Stevenson (dave.stevenson@raspberrypi.com)
++ *
++ * Loosely based on the vim2m virtual driver by Pawel Osciak
++ * Copyright (c) 2009-2010 Samsung Electronics Co., Ltd.
++ * Pawel Osciak, <pawel@osciak.com>
++ * Marek Szyprowski, <m.szyprowski@samsung.com>
++ *
++ * Whilst this driver uses the v4l2_mem2mem framework, it does not need the
++ * scheduling aspects, so will always take the buffers, pass them to the VPU,
++ * and then signal the job as complete.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the
++ * License, or (at your option) any later version
++ */
++#include <linux/module.h>
++#include <linux/delay.h>
++#include <linux/fs.h>
++#include <linux/timer.h>
++#include <linux/sched.h>
++#include <linux/slab.h>
++#include <linux/platform_device.h>
++#include <linux/syscalls.h>
++
++#include <media/v4l2-mem2mem.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-ioctl.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-event.h>
++#include <media/videobuf2-dma-contig.h>
++
++#include "vchiq-mmal/mmal-encodings.h"
++#include "vchiq-mmal/mmal-msg.h"
++#include "vchiq-mmal/mmal-parameters.h"
++#include "vchiq-mmal/mmal-vchiq.h"
++
++MODULE_IMPORT_NS(DMA_BUF);
++
++/*
++ * Default /dev/videoN node numbers for decode and encode.
++ * Deliberately avoid the very low numbers as these are often taken by webcams
++ * etc, and simple apps tend to only go for /dev/video0.
++ */
++static int decode_video_nr = 10;
++module_param(decode_video_nr, int, 0644);
++MODULE_PARM_DESC(decode_video_nr, "decoder video device number");
++
++static int encode_video_nr = 11;
++module_param(encode_video_nr, int, 0644);
++MODULE_PARM_DESC(encode_video_nr, "encoder video device number");
++
++static int isp_video_nr = 12;
++module_param(isp_video_nr, int, 0644);
++MODULE_PARM_DESC(isp_video_nr, "isp video device number");
++
++static int deinterlace_video_nr = 18;
++module_param(deinterlace_video_nr, int, 0644);
++MODULE_PARM_DESC(deinterlace_video_nr, "deinterlace video device number");
++
++static int encode_image_nr = 31;
++module_param(encode_image_nr, int, 0644);
++MODULE_PARM_DESC(encode_image_nr, "encoder image device number");
++
++/*
++ * Workaround for GStreamer v4l2convert component not considering Bayer formats
++ * as raw, and therefore not considering a V4L2 device that supports them as
++ * a suitable candidate.
++ */
++static bool disable_bayer;
++module_param(disable_bayer, bool, 0644);
++MODULE_PARM_DESC(disable_bayer, "Disable support for Bayer formats");
++
++static unsigned int debug;
++module_param(debug, uint, 0644);
++MODULE_PARM_DESC(debug, "activates debug info (0-3)");
++
++static bool advanced_deinterlace = true;
++module_param(advanced_deinterlace, bool, 0644);
++MODULE_PARM_DESC(advanced_deinterlace, "Use advanced deinterlace");
++
++static int field_override;
++module_param(field_override, int, 0644);
++MODULE_PARM_DESC(field_override, "force TB(8)/BT(9) field");
++
++enum bcm2835_codec_role {
++	DECODE,
++	ENCODE,
++	ISP,
++	DEINTERLACE,
++	ENCODE_IMAGE,
++	NUM_ROLES
++};
++
++static const char * const roles[] = {
++	"decode",
++	"encode",
++	"isp",
++	"image_fx",
++	"encode_image",
++};
++
++static const char * const components[] = {
++	"ril.video_decode",
++	"ril.video_encode",
++	"ril.isp",
++	"ril.image_fx",
++	"ril.image_encode",
++};
++
++/* Timeout for stop_streaming to allow all buffers to return */
++#define COMPLETE_TIMEOUT (2 * HZ)
++
++#define MIN_W		32
++#define MIN_H		32
++#define MAX_W		1920
++#define MAX_H		1920
++#define BPL_ALIGN	32
++/*
++ * The decoder spec supports the V4L2_EVENT_SOURCE_CHANGE event, but the docs
++ * seem to want it to always be generated on startup, which prevents the client
++ * from configuring the CAPTURE queue based on any parsing it has already done
++ * which may save time and allow allocation of CAPTURE buffers early. Surely
++ * SOURCE_CHANGE means something has changed, not just "always notify".
++ *
++ * For those clients that don't set the CAPTURE resolution, adopt a default
++ * resolution that is seriously unlikely to be correct, therefore almost
++ * guaranteed to get the SOURCE_CHANGE event.
++ */
++#define DEFAULT_WIDTH	32
++#define DEFAULT_HEIGHT	32
++/*
++ * The unanswered question - what is the maximum size of a compressed frame?
++ * V4L2 mandates that the encoded frame must fit in a single buffer. Sizing
++ * that buffer is a compromise between wasting memory and risking not fitting.
++ * The 1080P version of Big Buck Bunny has some frames that exceed 512kB.
++ * Adopt a moderately arbitrary split at 720P for switching between 512 and
++ * 768kB buffers.
++ */
++#define DEF_COMP_BUF_SIZE_GREATER_720P	(768 << 10)
++#define DEF_COMP_BUF_SIZE_720P_OR_LESS	(512 << 10)
++/* JPEG image can be very large. For paranoid reasons 4MB is used */
++#define DEF_COMP_BUF_SIZE_JPEG (4096 << 10)
++
++/* Flags that indicate a format can be used for capture/output */
++#define MEM2MEM_CAPTURE		BIT(0)
++#define MEM2MEM_OUTPUT		BIT(1)
++
++#define MEM2MEM_NAME		"bcm2835-codec"
++
++struct bcm2835_codec_fmt {
++	u32	fourcc;
++	int	depth;
++	u8	bytesperline_align[NUM_ROLES];
++	u32	flags;
++	u32	mmal_fmt;
++	int	size_multiplier_x2;
++	bool	is_bayer;
++};
++
++static const struct bcm2835_codec_fmt supported_formats[] = {
++	{
++		/* YUV formats */
++		.fourcc			= V4L2_PIX_FMT_YUV420,
++		.depth			= 8,
++		.bytesperline_align	= { 32, 64, 64, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_I420,
++		.size_multiplier_x2	= 3,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_YVU420,
++		.depth			= 8,
++		.bytesperline_align	= { 32, 64, 64, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_YV12,
++		.size_multiplier_x2	= 3,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_NV12,
++		.depth			= 8,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_NV12,
++		.size_multiplier_x2	= 3,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_NV21,
++		.depth			= 8,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_NV21,
++		.size_multiplier_x2	= 3,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_RGB565,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_RGB16,
++		.size_multiplier_x2	= 2,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_YUYV,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_YUYV,
++		.size_multiplier_x2	= 2,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_UYVY,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_UYVY,
++		.size_multiplier_x2	= 2,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_YVYU,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_YVYU,
++		.size_multiplier_x2	= 2,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_VYUY,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_VYUY,
++		.size_multiplier_x2	= 2,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_NV12_COL128,
++		.depth			= 8,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_YUVUV128,
++		.size_multiplier_x2	= 3,
++	}, {
++		/* RGB formats */
++		.fourcc			= V4L2_PIX_FMT_RGB24,
++		.depth			= 24,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_RGB24,
++		.size_multiplier_x2	= 2,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_BGR24,
++		.depth			= 24,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BGR24,
++		.size_multiplier_x2	= 2,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_BGR32,
++		.depth			= 32,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BGRA,
++		.size_multiplier_x2	= 2,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_RGBA32,
++		.depth			= 32,
++		.bytesperline_align	= { 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_RGBA,
++		.size_multiplier_x2	= 2,
++	}, {
++		/* Bayer formats */
++		/* 8 bit */
++		.fourcc			= V4L2_PIX_FMT_SRGGB8,
++		.depth			= 8,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB8,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SBGGR8,
++		.depth			= 8,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR8,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGRBG8,
++		.depth			= 8,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG8,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGBRG8,
++		.depth			= 8,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG8,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		/* 10 bit */
++		.fourcc			= V4L2_PIX_FMT_SRGGB10P,
++		.depth			= 10,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB10P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SBGGR10P,
++		.depth			= 10,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR10P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGRBG10P,
++		.depth			= 10,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG10P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGBRG10P,
++		.depth			= 10,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG10P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		/* 12 bit */
++		.fourcc			= V4L2_PIX_FMT_SRGGB12P,
++		.depth			= 12,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB12P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SBGGR12P,
++		.depth			= 12,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR12P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGRBG12P,
++		.depth			= 12,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG12P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGBRG12P,
++		.depth			= 12,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG12P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		/* 14 bit */
++		.fourcc			= V4L2_PIX_FMT_SRGGB14P,
++		.depth			= 14,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB14P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SBGGR14P,
++		.depth			= 14,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR14P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGRBG14P,
++		.depth			= 14,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG14P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGBRG14P,
++		.depth			= 14,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG14P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		/* 16 bit */
++		.fourcc			= V4L2_PIX_FMT_SRGGB16,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB16,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SBGGR16,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR16,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGRBG16,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG16,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGBRG16,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG16,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		/* Bayer formats unpacked to 16bpp */
++		/* 10 bit */
++		.fourcc			= V4L2_PIX_FMT_SRGGB10,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB10,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SBGGR10,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR10,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGRBG10,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG10,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGBRG10,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG10,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		/* 12 bit */
++		.fourcc			= V4L2_PIX_FMT_SRGGB12,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB12,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SBGGR12,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR12,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGRBG12,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG12,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGBRG12,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG12,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		/* 14 bit */
++		.fourcc			= V4L2_PIX_FMT_SRGGB14,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB14,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SBGGR14,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR14,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGRBG14,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG14,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGBRG14,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG14,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		/* Monochrome MIPI formats */
++		/* 8 bit */
++		.fourcc			= V4L2_PIX_FMT_GREY,
++		.depth			= 8,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_GREY,
++		.size_multiplier_x2	= 2,
++	}, {
++		/* 10 bit */
++		.fourcc			= V4L2_PIX_FMT_Y10P,
++		.depth			= 10,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_Y10P,
++		.size_multiplier_x2	= 2,
++	}, {
++		/* 12 bit */
++		.fourcc			= V4L2_PIX_FMT_Y12P,
++		.depth			= 12,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_Y12P,
++		.size_multiplier_x2	= 2,
++	}, {
++		/* 14 bit */
++		.fourcc			= V4L2_PIX_FMT_Y14P,
++		.depth			= 14,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_Y14P,
++		.size_multiplier_x2	= 2,
++	}, {
++		/* 16 bit */
++		.fourcc			= V4L2_PIX_FMT_Y16,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_Y16,
++		.size_multiplier_x2	= 2,
++	}, {
++		/* 10 bit as 16bpp */
++		.fourcc			= V4L2_PIX_FMT_Y10,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_Y10,
++		.size_multiplier_x2	= 2,
++	}, {
++		/* 12 bit as 16bpp */
++		.fourcc			= V4L2_PIX_FMT_Y12,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_Y12,
++		.size_multiplier_x2	= 2,
++	}, {
++		/* 14 bit as 16bpp */
++		.fourcc			= V4L2_PIX_FMT_Y14,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_Y14,
++		.size_multiplier_x2	= 2,
++	}, {
++		/* Compressed formats */
++		.fourcc			= V4L2_PIX_FMT_H264,
++		.depth			= 0,
++		.flags			= V4L2_FMT_FLAG_COMPRESSED,
++		.mmal_fmt		= MMAL_ENCODING_H264,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_JPEG,
++		.depth			= 0,
++		.flags			= V4L2_FMT_FLAG_COMPRESSED,
++		.mmal_fmt		= MMAL_ENCODING_JPEG,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_MJPEG,
++		.depth			= 0,
++		.flags			= V4L2_FMT_FLAG_COMPRESSED,
++		.mmal_fmt		= MMAL_ENCODING_MJPEG,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_MPEG4,
++		.depth			= 0,
++		.flags			= V4L2_FMT_FLAG_COMPRESSED,
++		.mmal_fmt		= MMAL_ENCODING_MP4V,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_H263,
++		.depth			= 0,
++		.flags			= V4L2_FMT_FLAG_COMPRESSED,
++		.mmal_fmt		= MMAL_ENCODING_H263,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_MPEG2,
++		.depth			= 0,
++		.flags			= V4L2_FMT_FLAG_COMPRESSED,
++		.mmal_fmt		= MMAL_ENCODING_MP2V,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_VC1_ANNEX_G,
++		.depth			= 0,
++		.flags			= V4L2_FMT_FLAG_COMPRESSED,
++		.mmal_fmt		= MMAL_ENCODING_WVC1,
++	}
++};
++
++struct bcm2835_codec_fmt_list {
++	struct bcm2835_codec_fmt *list;
++	unsigned int num_entries;
++};
++
++struct m2m_mmal_buffer {
++	struct v4l2_m2m_buffer	m2m;
++	struct mmal_buffer	mmal;
++};
++
++/* Per-queue, driver-specific private data */
++struct bcm2835_codec_q_data {
++	/*
++	 * These parameters should be treated as gospel, with everything else
++	 * being determined from them.
++	 */
++	/* Buffer width/height */
++	unsigned int		bytesperline;
++	unsigned int		height;
++	/* Crop size used for selection handling */
++	unsigned int		crop_width;
++	unsigned int		crop_height;
++	bool			selection_set;
++	struct v4l2_fract	aspect_ratio;
++	enum v4l2_field		field;
++
++	unsigned int		sizeimage;
++	unsigned int		sequence;
++	struct bcm2835_codec_fmt	*fmt;
++
++	/* One extra buffer header so we can send an EOS. */
++	struct m2m_mmal_buffer	eos_buffer;
++	bool			eos_buffer_in_use;	/* debug only */
++};
++
++struct bcm2835_codec_dev {
++	struct platform_device *pdev;
++
++	/* v4l2 devices */
++	struct v4l2_device	v4l2_dev;
++	struct video_device	vfd;
++	/* mutex for the v4l2 device */
++	struct mutex		dev_mutex;
++	atomic_t		num_inst;
++
++	/* allocated mmal instance and components */
++	enum bcm2835_codec_role	role;
++	/* The list of formats supported on input and output queues. */
++	struct bcm2835_codec_fmt_list	supported_fmts[2];
++
++	struct vchiq_mmal_instance	*instance;
++
++	struct v4l2_m2m_dev	*m2m_dev;
++};
++
++struct bcm2835_codec_ctx {
++	struct v4l2_fh		fh;
++	struct bcm2835_codec_dev	*dev;
++
++	struct v4l2_ctrl_handler hdl;
++
++	struct vchiq_mmal_component  *component;
++	bool component_enabled;
++
++	enum v4l2_colorspace	colorspace;
++	enum v4l2_ycbcr_encoding ycbcr_enc;
++	enum v4l2_xfer_func	xfer_func;
++	enum v4l2_quantization	quant;
++
++	int hflip;
++	int vflip;
++
++	/* Source and destination queue data */
++	struct bcm2835_codec_q_data   q_data[2];
++	s32  bitrate;
++	unsigned int	framerate_num;
++	unsigned int	framerate_denom;
++
++	bool aborting;
++	int num_ip_buffers;
++	int num_op_buffers;
++	struct completion frame_cmplt;
++};
++
++struct bcm2835_codec_driver {
++	struct platform_device *pdev;
++	struct media_device	mdev;
++
++	struct bcm2835_codec_dev *encode;
++	struct bcm2835_codec_dev *decode;
++	struct bcm2835_codec_dev *isp;
++	struct bcm2835_codec_dev *deinterlace;
++	struct bcm2835_codec_dev *encode_image;
++};
++
++enum {
++	V4L2_M2M_SRC = 0,
++	V4L2_M2M_DST = 1,
++};
++
++static const struct bcm2835_codec_fmt *get_fmt(u32 mmal_fmt)
++{
++	unsigned int i;
++
++	for (i = 0; i < ARRAY_SIZE(supported_formats); i++) {
++		if (supported_formats[i].mmal_fmt == mmal_fmt &&
++		    (!disable_bayer || !supported_formats[i].is_bayer))
++			return &supported_formats[i];
++	}
++	return NULL;
++}
++
++static inline
++struct bcm2835_codec_fmt_list *get_format_list(struct bcm2835_codec_dev *dev,
++					       bool capture)
++{
++	return &dev->supported_fmts[capture ? 1 : 0];
++}
++
++static
++struct bcm2835_codec_fmt *get_default_format(struct bcm2835_codec_dev *dev,
++					     bool capture)
++{
++	return &dev->supported_fmts[capture ? 1 : 0].list[0];
++}
++
++static
++struct bcm2835_codec_fmt *find_format_pix_fmt(u32 pix_fmt,
++					      struct bcm2835_codec_dev *dev,
++					      bool capture)
++{
++	struct bcm2835_codec_fmt *fmt;
++	unsigned int k;
++	struct bcm2835_codec_fmt_list *fmts =
++					&dev->supported_fmts[capture ? 1 : 0];
++
++	for (k = 0; k < fmts->num_entries; k++) {
++		fmt = &fmts->list[k];
++		if (fmt->fourcc == pix_fmt)
++			break;
++	}
++	if (k == fmts->num_entries)
++		return NULL;
++
++	return &fmts->list[k];
++}
++
++static inline
++struct bcm2835_codec_fmt *find_format(struct v4l2_format *f,
++				      struct bcm2835_codec_dev *dev,
++				      bool capture)
++{
++	return find_format_pix_fmt(f->fmt.pix_mp.pixelformat, dev, capture);
++}
++
++static inline struct bcm2835_codec_ctx *file2ctx(struct file *file)
++{
++	return container_of(file->private_data, struct bcm2835_codec_ctx, fh);
++}
++
++static struct bcm2835_codec_q_data *get_q_data(struct bcm2835_codec_ctx *ctx,
++					       enum v4l2_buf_type type)
++{
++	switch (type) {
++	case V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE:
++		return &ctx->q_data[V4L2_M2M_SRC];
++	case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE:
++		return &ctx->q_data[V4L2_M2M_DST];
++	default:
++		v4l2_err(&ctx->dev->v4l2_dev, "%s: Invalid queue type %u\n",
++			 __func__, type);
++		break;
++	}
++	return NULL;
++}
++
++static struct vchiq_mmal_port *get_port_data(struct bcm2835_codec_ctx *ctx,
++					     enum v4l2_buf_type type)
++{
++	if (!ctx->component)
++		return NULL;
++
++	switch (type) {
++	case V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE:
++		return &ctx->component->input[0];
++	case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE:
++		return &ctx->component->output[0];
++	default:
++		v4l2_err(&ctx->dev->v4l2_dev, "%s: Invalid queue type %u\n",
++			 __func__, type);
++		break;
++	}
++	return NULL;
++}
++
++/*
++ * mem2mem callbacks
++ */
++
++/*
++ * job_ready() - check whether an instance is ready to be scheduled to run
++ */
++static int job_ready(void *priv)
++{
++	struct bcm2835_codec_ctx *ctx = priv;
++
++	if (!v4l2_m2m_num_src_bufs_ready(ctx->fh.m2m_ctx) &&
++	    !v4l2_m2m_num_dst_bufs_ready(ctx->fh.m2m_ctx))
++		return 0;
++
++	return 1;
++}
++
++static void job_abort(void *priv)
++{
++	struct bcm2835_codec_ctx *ctx = priv;
++
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s\n", __func__);
++	/* Will cancel the transaction in the next interrupt handler */
++	ctx->aborting = 1;
++}
++
++static inline unsigned int get_sizeimage(int bpl, int width, int height,
++					 struct bcm2835_codec_fmt *fmt)
++{
++	if (fmt->flags & V4L2_FMT_FLAG_COMPRESSED) {
++		if (fmt->fourcc == V4L2_PIX_FMT_JPEG)
++			return DEF_COMP_BUF_SIZE_JPEG;
++
++		if (width * height > 1280 * 720)
++			return DEF_COMP_BUF_SIZE_GREATER_720P;
++		else
++			return DEF_COMP_BUF_SIZE_720P_OR_LESS;
++	}
++
++	if (fmt->fourcc != V4L2_PIX_FMT_NV12_COL128)
++		return (bpl * height * fmt->size_multiplier_x2) >> 1;
++
++	/*
++	 * V4L2_PIX_FMT_NV12_COL128 is 128 pixel wide columns.
++	 * bytesperline is the column stride in lines, so multiply by
++	 * the number of columns and 128.
++	 */
++	return (ALIGN(width, 128) * bpl);
++}
++
++static inline unsigned int get_bytesperline(int width, int height,
++					    struct bcm2835_codec_fmt *fmt,
++					    enum bcm2835_codec_role role)
++{
++	if (fmt->fourcc != V4L2_PIX_FMT_NV12_COL128)
++		return ALIGN((width * fmt->depth) >> 3,
++			     fmt->bytesperline_align[role]);
++
++	/*
++	 * V4L2_PIX_FMT_NV12_COL128 passes the column stride in lines via
++	 * bytesperline.
++	 * The minimum value for this is sufficient for the base luma and chroma
++	 * with no padding.
++	 */
++	return (height * 3) >> 1;
++}
++
++static void setup_mmal_port_format(struct bcm2835_codec_ctx *ctx,
++				   struct bcm2835_codec_q_data *q_data,
++				   struct vchiq_mmal_port *port)
++{
++	port->format.encoding = q_data->fmt->mmal_fmt;
++	port->format.flags = 0;
++
++	if (!(q_data->fmt->flags & V4L2_FMT_FLAG_COMPRESSED)) {
++		if (q_data->fmt->mmal_fmt != MMAL_ENCODING_YUVUV128) {
++			/* Raw image format - set width/height */
++			port->es.video.width = (q_data->bytesperline << 3) /
++							q_data->fmt->depth;
++			port->es.video.height = q_data->height;
++			port->es.video.crop.width = q_data->crop_width;
++			port->es.video.crop.height = q_data->crop_height;
++		} else {
++			/* NV12_COL128 / YUVUV128 column format */
++			/* Column stride in lines */
++			port->es.video.width = q_data->bytesperline;
++			port->es.video.height = q_data->height;
++			port->es.video.crop.width = q_data->crop_width;
++			port->es.video.crop.height = q_data->crop_height;
++			port->format.flags = MMAL_ES_FORMAT_FLAG_COL_FMTS_WIDTH_IS_COL_STRIDE;
++		}
++		port->es.video.frame_rate.numerator = ctx->framerate_num;
++		port->es.video.frame_rate.denominator = ctx->framerate_denom;
++	} else {
++		/* Compressed format - leave resolution as 0 for decode */
++		if (ctx->dev->role == DECODE) {
++			port->es.video.width = 0;
++			port->es.video.height = 0;
++			port->es.video.crop.width = 0;
++			port->es.video.crop.height = 0;
++		} else {
++			port->es.video.width = q_data->crop_width;
++			port->es.video.height = q_data->height;
++			port->es.video.crop.width = q_data->crop_width;
++			port->es.video.crop.height = q_data->crop_height;
++			port->format.bitrate = ctx->bitrate;
++			port->es.video.frame_rate.numerator = ctx->framerate_num;
++			port->es.video.frame_rate.denominator = ctx->framerate_denom;
++		}
++	}
++	port->es.video.crop.x = 0;
++	port->es.video.crop.y = 0;
++
++	port->current_buffer.size = q_data->sizeimage;
++};
++
++static void ip_buffer_cb(struct vchiq_mmal_instance *instance,
++			 struct vchiq_mmal_port *port, int status,
++			 struct mmal_buffer *mmal_buf)
++{
++	struct bcm2835_codec_ctx *ctx = port->cb_ctx/*, *curr_ctx*/;
++	struct m2m_mmal_buffer *buf =
++			container_of(mmal_buf, struct m2m_mmal_buffer, mmal);
++
++	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s: port %p buf %p length %lu, flags %x\n",
++		 __func__, port, mmal_buf, mmal_buf->length,
++		 mmal_buf->mmal_flags);
++
++	if (buf == &ctx->q_data[V4L2_M2M_SRC].eos_buffer) {
++		/* Do we need to add lcoking to prevent multiple submission of
++		 * the EOS, and therefore handle mutliple return here?
++		 */
++		v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: eos buffer returned.\n",
++			 __func__);
++		ctx->q_data[V4L2_M2M_SRC].eos_buffer_in_use = false;
++		return;
++	}
++
++	if (status) {
++		/* error in transfer */
++		if (buf)
++			/* there was a buffer with the error so return it */
++			vb2_buffer_done(&buf->m2m.vb.vb2_buf,
++					VB2_BUF_STATE_ERROR);
++		return;
++	}
++	if (mmal_buf->cmd) {
++		v4l2_err(&ctx->dev->v4l2_dev, "%s: Not expecting cmd msgs on ip callback - %08x\n",
++			 __func__, mmal_buf->cmd);
++		/*
++		 * CHECKME: Should we return here. The buffer shouldn't have a
++		 * message context or vb2 buf associated.
++		 */
++	}
++
++	v4l2_dbg(3, debug, &ctx->dev->v4l2_dev, "%s: no error. Return buffer %p\n",
++		 __func__, &buf->m2m.vb.vb2_buf);
++	vb2_buffer_done(&buf->m2m.vb.vb2_buf,
++			port->enabled ? VB2_BUF_STATE_DONE :
++					VB2_BUF_STATE_QUEUED);
++
++	ctx->num_ip_buffers++;
++	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s: done %d input buffers\n",
++		 __func__, ctx->num_ip_buffers);
++
++	if (!port->enabled && atomic_read(&port->buffers_with_vpu))
++		complete(&ctx->frame_cmplt);
++}
++
++static void queue_res_chg_event(struct bcm2835_codec_ctx *ctx)
++{
++	static const struct v4l2_event ev_src_ch = {
++		.type = V4L2_EVENT_SOURCE_CHANGE,
++		.u.src_change.changes =
++		V4L2_EVENT_SRC_CH_RESOLUTION,
++	};
++
++	v4l2_event_queue_fh(&ctx->fh, &ev_src_ch);
++}
++
++static void send_eos_event(struct bcm2835_codec_ctx *ctx)
++{
++	static const struct v4l2_event ev = {
++		.type = V4L2_EVENT_EOS,
++	};
++
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "Sending EOS event\n");
++
++	v4l2_event_queue_fh(&ctx->fh, &ev);
++}
++
++static void color_mmal2v4l(struct bcm2835_codec_ctx *ctx, u32 encoding,
++			   u32 color_space)
++{
++	int is_rgb;
++
++	switch (encoding) {
++	case MMAL_ENCODING_I420:
++	case MMAL_ENCODING_YV12:
++	case MMAL_ENCODING_NV12:
++	case MMAL_ENCODING_NV21:
++	case V4L2_PIX_FMT_YUYV:
++	case V4L2_PIX_FMT_YVYU:
++	case V4L2_PIX_FMT_UYVY:
++	case V4L2_PIX_FMT_VYUY:
++		/* YUV based colourspaces */
++		switch (color_space) {
++		case MMAL_COLOR_SPACE_ITUR_BT601:
++			ctx->colorspace = V4L2_COLORSPACE_SMPTE170M;
++			break;
++
++		case MMAL_COLOR_SPACE_ITUR_BT709:
++			ctx->colorspace = V4L2_COLORSPACE_REC709;
++			break;
++		default:
++			break;
++		}
++		break;
++	default:
++		/* RGB based colourspaces */
++		ctx->colorspace = V4L2_COLORSPACE_SRGB;
++		break;
++	}
++	ctx->xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(ctx->colorspace);
++	ctx->ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(ctx->colorspace);
++	is_rgb = ctx->colorspace == V4L2_COLORSPACE_SRGB;
++	ctx->quant = V4L2_MAP_QUANTIZATION_DEFAULT(is_rgb, ctx->colorspace,
++						   ctx->ycbcr_enc);
++}
++
++static void handle_fmt_changed(struct bcm2835_codec_ctx *ctx,
++			       struct mmal_buffer *mmal_buf)
++{
++	struct bcm2835_codec_q_data *q_data;
++	struct mmal_msg_event_format_changed *format =
++		(struct mmal_msg_event_format_changed *)mmal_buf->buffer;
++	struct mmal_parameter_video_interlace_type interlace;
++	int interlace_size = sizeof(interlace);
++	struct vb2_queue *vq;
++	int ret;
++
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: Format changed: buff size min %u, rec %u, buff num min %u, rec %u\n",
++		 __func__,
++		 format->buffer_size_min,
++		 format->buffer_size_recommended,
++		 format->buffer_num_min,
++		 format->buffer_num_recommended
++		);
++	if (format->format.type != MMAL_ES_TYPE_VIDEO) {
++		v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: Format changed but not video %u\n",
++			 __func__, format->format.type);
++		return;
++	}
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: Format changed to %ux%u, crop %ux%u, colourspace %08X\n",
++		 __func__, format->es.video.width, format->es.video.height,
++		 format->es.video.crop.width, format->es.video.crop.height,
++		 format->es.video.color_space);
++
++	q_data = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: Format was %ux%u, crop %ux%u\n",
++		 __func__, q_data->bytesperline, q_data->height,
++		 q_data->crop_width, q_data->crop_height);
++
++	q_data->crop_width = format->es.video.crop.width;
++	q_data->crop_height = format->es.video.crop.height;
++	/*
++	 * Stop S_FMT updating crop_height should it be unaligned.
++	 * Client can still update the crop region via S_SELECTION should it
++	 * really want to, but the decoder is likely to complain that the
++	 * format then doesn't match.
++	 */
++	q_data->selection_set = true;
++	q_data->bytesperline = get_bytesperline(format->es.video.width,
++						format->es.video.height,
++						q_data->fmt, ctx->dev->role);
++
++	q_data->height = format->es.video.height;
++	q_data->sizeimage = format->buffer_size_min;
++	if (format->es.video.color_space)
++		color_mmal2v4l(ctx, format->format.encoding,
++			       format->es.video.color_space);
++
++	q_data->aspect_ratio.numerator = format->es.video.par.numerator;
++	q_data->aspect_ratio.denominator = format->es.video.par.denominator;
++
++	ret = vchiq_mmal_port_parameter_get(ctx->dev->instance,
++					    &ctx->component->output[0],
++					    MMAL_PARAMETER_VIDEO_INTERLACE_TYPE,
++					    &interlace,
++					    &interlace_size);
++	if (!ret) {
++		switch (interlace.mode) {
++		case MMAL_INTERLACE_PROGRESSIVE:
++		default:
++			q_data->field = V4L2_FIELD_NONE;
++			break;
++		case MMAL_INTERLACE_FIELDS_INTERLEAVED_UPPER_FIRST:
++			q_data->field = V4L2_FIELD_INTERLACED_TB;
++			break;
++		case MMAL_INTERLACE_FIELDS_INTERLEAVED_LOWER_FIRST:
++			q_data->field = V4L2_FIELD_INTERLACED_BT;
++			break;
++		}
++		v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: interlace mode %u, v4l2 field %u\n",
++			 __func__, interlace.mode, q_data->field);
++	} else {
++		q_data->field = V4L2_FIELD_NONE;
++	}
++
++	vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
++	if (vq->streaming)
++		vq->last_buffer_dequeued = true;
++
++	queue_res_chg_event(ctx);
++}
++
++static void op_buffer_cb(struct vchiq_mmal_instance *instance,
++			 struct vchiq_mmal_port *port, int status,
++			 struct mmal_buffer *mmal_buf)
++{
++	struct bcm2835_codec_ctx *ctx = port->cb_ctx;
++	enum vb2_buffer_state buf_state = VB2_BUF_STATE_DONE;
++	struct m2m_mmal_buffer *buf;
++	struct vb2_v4l2_buffer *vb2;
++
++	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev,
++		 "%s: status:%d, buf:%p, length:%lu, flags %04x, pts %lld\n",
++		 __func__, status, mmal_buf, mmal_buf->length,
++		 mmal_buf->mmal_flags, mmal_buf->pts);
++
++	buf = container_of(mmal_buf, struct m2m_mmal_buffer, mmal);
++	vb2 = &buf->m2m.vb;
++
++	if (status) {
++		/* error in transfer */
++		if (vb2) {
++			/* there was a buffer with the error so return it */
++			vb2_buffer_done(&vb2->vb2_buf, VB2_BUF_STATE_ERROR);
++		}
++		return;
++	}
++
++	if (mmal_buf->cmd) {
++		switch (mmal_buf->cmd) {
++		case MMAL_EVENT_FORMAT_CHANGED:
++		{
++			handle_fmt_changed(ctx, mmal_buf);
++			break;
++		}
++		default:
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Unexpected event on output callback - %08x\n",
++				 __func__, mmal_buf->cmd);
++			break;
++		}
++		return;
++	}
++
++	v4l2_dbg(3, debug, &ctx->dev->v4l2_dev, "%s: length %lu, flags %x, idx %u\n",
++		 __func__, mmal_buf->length, mmal_buf->mmal_flags,
++		 vb2->vb2_buf.index);
++
++	if (mmal_buf->length == 0) {
++		/* stream ended, or buffer being returned during disable. */
++		v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s: Empty buffer - flags %04x",
++			 __func__, mmal_buf->mmal_flags);
++		if (!(mmal_buf->mmal_flags & MMAL_BUFFER_HEADER_FLAG_EOS)) {
++			if (!port->enabled) {
++				vb2_buffer_done(&vb2->vb2_buf, VB2_BUF_STATE_QUEUED);
++				if (atomic_read(&port->buffers_with_vpu))
++					complete(&ctx->frame_cmplt);
++			} else {
++				vchiq_mmal_submit_buffer(ctx->dev->instance,
++							 &ctx->component->output[0],
++							 mmal_buf);
++			}
++			return;
++		}
++	}
++	if (mmal_buf->mmal_flags & MMAL_BUFFER_HEADER_FLAG_EOS) {
++		/* EOS packet from the VPU */
++		send_eos_event(ctx);
++		vb2->flags |= V4L2_BUF_FLAG_LAST;
++	}
++
++	if (mmal_buf->mmal_flags & MMAL_BUFFER_HEADER_FLAG_CORRUPTED)
++		buf_state = VB2_BUF_STATE_ERROR;
++
++	/* vb2 timestamps in nsecs, mmal in usecs */
++	vb2->vb2_buf.timestamp = mmal_buf->pts * 1000;
++
++	vb2_set_plane_payload(&vb2->vb2_buf, 0, mmal_buf->length);
++	switch (mmal_buf->mmal_flags &
++				(MMAL_BUFFER_HEADER_VIDEO_FLAG_INTERLACED |
++				 MMAL_BUFFER_HEADER_VIDEO_FLAG_TOP_FIELD_FIRST)) {
++	case 0:
++	case MMAL_BUFFER_HEADER_VIDEO_FLAG_TOP_FIELD_FIRST: /* Bogus */
++		vb2->field = V4L2_FIELD_NONE;
++		break;
++	case MMAL_BUFFER_HEADER_VIDEO_FLAG_INTERLACED:
++		vb2->field = V4L2_FIELD_INTERLACED_BT;
++		break;
++	case (MMAL_BUFFER_HEADER_VIDEO_FLAG_INTERLACED |
++	      MMAL_BUFFER_HEADER_VIDEO_FLAG_TOP_FIELD_FIRST):
++		vb2->field = V4L2_FIELD_INTERLACED_TB;
++		break;
++	}
++
++	if (mmal_buf->mmal_flags & MMAL_BUFFER_HEADER_FLAG_KEYFRAME)
++		vb2->flags |= V4L2_BUF_FLAG_KEYFRAME;
++
++	vb2_buffer_done(&vb2->vb2_buf, buf_state);
++	ctx->num_op_buffers++;
++
++	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s: done %d output buffers\n",
++		 __func__, ctx->num_op_buffers);
++
++	if (!port->enabled && atomic_read(&port->buffers_with_vpu))
++		complete(&ctx->frame_cmplt);
++}
++
++/* vb2_to_mmal_buffer() - converts vb2 buffer header to MMAL
++ *
++ * Copies all the required fields from a VB2 buffer to the MMAL buffer header,
++ * ready for sending to the VPU.
++ */
++static void vb2_to_mmal_buffer(struct m2m_mmal_buffer *buf,
++			       struct vb2_v4l2_buffer *vb2)
++{
++	u64 pts;
++
++	buf->mmal.mmal_flags = 0;
++	if (vb2->flags & V4L2_BUF_FLAG_KEYFRAME)
++		buf->mmal.mmal_flags |= MMAL_BUFFER_HEADER_FLAG_KEYFRAME;
++
++	/*
++	 * Adding this means that the data must be framed correctly as one frame
++	 * per buffer. The underlying decoder has no such requirement, but it
++	 * will reduce latency as the bistream parser will be kicked immediately
++	 * to parse the frame, rather than relying on its own heuristics for
++	 * when to wake up.
++	 */
++	buf->mmal.mmal_flags |= MMAL_BUFFER_HEADER_FLAG_FRAME_END;
++
++	buf->mmal.length = vb2->vb2_buf.planes[0].bytesused;
++	/*
++	 * Minor ambiguity in the V4L2 spec as to whether passing in a 0 length
++	 * buffer, or one with V4L2_BUF_FLAG_LAST set denotes end of stream.
++	 * Handle either.
++	 */
++	if (!buf->mmal.length || vb2->flags & V4L2_BUF_FLAG_LAST)
++		buf->mmal.mmal_flags |= MMAL_BUFFER_HEADER_FLAG_EOS;
++
++	/* vb2 timestamps in nsecs, mmal in usecs */
++	pts = vb2->vb2_buf.timestamp;
++	do_div(pts, 1000);
++	buf->mmal.pts = pts;
++	buf->mmal.dts = MMAL_TIME_UNKNOWN;
++
++	switch (field_override ? field_override : vb2->field) {
++	default:
++	case V4L2_FIELD_NONE:
++		break;
++	case V4L2_FIELD_INTERLACED_BT:
++		buf->mmal.mmal_flags |= MMAL_BUFFER_HEADER_VIDEO_FLAG_INTERLACED;
++		break;
++	case V4L2_FIELD_INTERLACED_TB:
++		buf->mmal.mmal_flags |= MMAL_BUFFER_HEADER_VIDEO_FLAG_INTERLACED |
++					MMAL_BUFFER_HEADER_VIDEO_FLAG_TOP_FIELD_FIRST;
++		break;
++	}
++}
++
++/* device_run() - prepares and starts the device
++ *
++ * This simulates all the immediate preparations required before starting
++ * a device. This will be called by the framework when it decides to schedule
++ * a particular instance.
++ */
++static void device_run(void *priv)
++{
++	struct bcm2835_codec_ctx *ctx = priv;
++	struct bcm2835_codec_dev *dev = ctx->dev;
++	struct vb2_v4l2_buffer *src_buf, *dst_buf;
++	struct m2m_mmal_buffer *src_m2m_buf = NULL, *dst_m2m_buf = NULL;
++	struct v4l2_m2m_buffer *m2m;
++	int ret;
++
++	v4l2_dbg(3, debug, &ctx->dev->v4l2_dev, "%s: off we go\n", __func__);
++
++	if (ctx->fh.m2m_ctx->out_q_ctx.q.streaming) {
++		src_buf = v4l2_m2m_buf_remove(&ctx->fh.m2m_ctx->out_q_ctx);
++		if (src_buf) {
++			m2m = container_of(src_buf, struct v4l2_m2m_buffer, vb);
++			src_m2m_buf = container_of(m2m, struct m2m_mmal_buffer,
++						   m2m);
++			vb2_to_mmal_buffer(src_m2m_buf, src_buf);
++
++			ret = vchiq_mmal_submit_buffer(dev->instance,
++						       &ctx->component->input[0],
++						       &src_m2m_buf->mmal);
++			v4l2_dbg(3, debug, &ctx->dev->v4l2_dev,
++				 "%s: Submitted ip buffer len %lu, pts %llu, flags %04x\n",
++				 __func__, src_m2m_buf->mmal.length,
++				 src_m2m_buf->mmal.pts,
++				 src_m2m_buf->mmal.mmal_flags);
++			if (ret)
++				v4l2_err(&ctx->dev->v4l2_dev,
++					 "%s: Failed submitting ip buffer\n",
++					 __func__);
++		}
++	}
++
++	if (ctx->fh.m2m_ctx->cap_q_ctx.q.streaming) {
++		dst_buf = v4l2_m2m_buf_remove(&ctx->fh.m2m_ctx->cap_q_ctx);
++		if (dst_buf) {
++			m2m = container_of(dst_buf, struct v4l2_m2m_buffer, vb);
++			dst_m2m_buf = container_of(m2m, struct m2m_mmal_buffer,
++						   m2m);
++			vb2_to_mmal_buffer(dst_m2m_buf, dst_buf);
++
++			v4l2_dbg(3, debug, &ctx->dev->v4l2_dev,
++				 "%s: Submitted op buffer\n", __func__);
++			ret = vchiq_mmal_submit_buffer(dev->instance,
++						       &ctx->component->output[0],
++						       &dst_m2m_buf->mmal);
++			if (ret)
++				v4l2_err(&ctx->dev->v4l2_dev,
++					 "%s: Failed submitting op buffer\n",
++					 __func__);
++		}
++	}
++
++	v4l2_dbg(3, debug, &ctx->dev->v4l2_dev, "%s: Submitted src %p, dst %p\n",
++		 __func__, src_m2m_buf, dst_m2m_buf);
++
++	/* Complete the job here. */
++	v4l2_m2m_job_finish(ctx->dev->m2m_dev, ctx->fh.m2m_ctx);
++}
++
++/*
++ * video ioctls
++ */
++static int vidioc_querycap(struct file *file, void *priv,
++			   struct v4l2_capability *cap)
++{
++	struct bcm2835_codec_dev *dev = video_drvdata(file);
++
++	strncpy(cap->driver, MEM2MEM_NAME, sizeof(cap->driver) - 1);
++	strncpy(cap->card, dev->vfd.name, sizeof(cap->card) - 1);
++	snprintf(cap->bus_info, sizeof(cap->bus_info), "platform:%s",
++		 MEM2MEM_NAME);
++	return 0;
++}
++
++static int enum_fmt(struct v4l2_fmtdesc *f, struct bcm2835_codec_ctx *ctx,
++		    bool capture)
++{
++	struct bcm2835_codec_fmt *fmt;
++	struct bcm2835_codec_fmt_list *fmts =
++					get_format_list(ctx->dev, capture);
++
++	if (f->index < fmts->num_entries) {
++		/* Format found */
++		fmt = &fmts->list[f->index];
++		f->pixelformat = fmt->fourcc;
++		f->flags = fmt->flags;
++		return 0;
++	}
++
++	/* Format not found */
++	return -EINVAL;
++}
++
++static int vidioc_enum_fmt_vid_cap(struct file *file, void *priv,
++				   struct v4l2_fmtdesc *f)
++{
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++
++	return enum_fmt(f, ctx, true);
++}
++
++static int vidioc_enum_fmt_vid_out(struct file *file, void *priv,
++				   struct v4l2_fmtdesc *f)
++{
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++
++	return enum_fmt(f, ctx, false);
++}
++
++static int vidioc_g_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f)
++{
++	struct vb2_queue *vq;
++	struct bcm2835_codec_q_data *q_data;
++
++	vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, f->type);
++	if (!vq)
++		return -EINVAL;
++
++	q_data = get_q_data(ctx, f->type);
++
++	f->fmt.pix_mp.width			= q_data->crop_width;
++	f->fmt.pix_mp.height			= q_data->height;
++	f->fmt.pix_mp.pixelformat		= q_data->fmt->fourcc;
++	f->fmt.pix_mp.field			= q_data->field;
++	f->fmt.pix_mp.colorspace		= ctx->colorspace;
++	f->fmt.pix_mp.plane_fmt[0].sizeimage	= q_data->sizeimage;
++	f->fmt.pix_mp.plane_fmt[0].bytesperline	= q_data->bytesperline;
++	f->fmt.pix_mp.num_planes		= 1;
++	f->fmt.pix_mp.ycbcr_enc			= ctx->ycbcr_enc;
++	f->fmt.pix_mp.quantization		= ctx->quant;
++	f->fmt.pix_mp.xfer_func			= ctx->xfer_func;
++
++	memset(f->fmt.pix_mp.plane_fmt[0].reserved, 0,
++	       sizeof(f->fmt.pix_mp.plane_fmt[0].reserved));
++
++	return 0;
++}
++
++static int vidioc_g_fmt_vid_out(struct file *file, void *priv,
++				struct v4l2_format *f)
++{
++	return vidioc_g_fmt(file2ctx(file), f);
++}
++
++static int vidioc_g_fmt_vid_cap(struct file *file, void *priv,
++				struct v4l2_format *f)
++{
++	return vidioc_g_fmt(file2ctx(file), f);
++}
++
++static int vidioc_try_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f,
++			  struct bcm2835_codec_fmt *fmt)
++{
++	unsigned int sizeimage, min_bytesperline;
++
++	/*
++	 * The V4L2 specification requires the driver to correct the format
++	 * struct if any of the dimensions is unsupported
++	 */
++	if (f->fmt.pix_mp.width > MAX_W)
++		f->fmt.pix_mp.width = MAX_W;
++	if (f->fmt.pix_mp.height > MAX_H)
++		f->fmt.pix_mp.height = MAX_H;
++
++	if (!(fmt->flags & V4L2_FMT_FLAG_COMPRESSED)) {
++		/* Only clip min w/h on capture. Treat 0x0 as unknown. */
++		if (f->fmt.pix_mp.width < MIN_W)
++			f->fmt.pix_mp.width = MIN_W;
++		if (f->fmt.pix_mp.height < MIN_H)
++			f->fmt.pix_mp.height = MIN_H;
++
++		/*
++		 * For decoders and image encoders the buffer must have
++		 * a vertical alignment of 16 lines.
++		 * The selection will reflect any cropping rectangle when only
++		 * some of the pixels are active.
++		 */
++		if (ctx->dev->role == DECODE || ctx->dev->role == ENCODE_IMAGE)
++			f->fmt.pix_mp.height = ALIGN(f->fmt.pix_mp.height, 16);
++	}
++	f->fmt.pix_mp.num_planes = 1;
++	min_bytesperline = get_bytesperline(f->fmt.pix_mp.width,
++					    f->fmt.pix_mp.height,
++					    fmt, ctx->dev->role);
++	if (f->fmt.pix_mp.plane_fmt[0].bytesperline < min_bytesperline)
++		f->fmt.pix_mp.plane_fmt[0].bytesperline = min_bytesperline;
++	f->fmt.pix_mp.plane_fmt[0].bytesperline =
++		ALIGN(f->fmt.pix_mp.plane_fmt[0].bytesperline,
++		      fmt->bytesperline_align[ctx->dev->role]);
++
++	sizeimage = get_sizeimage(f->fmt.pix_mp.plane_fmt[0].bytesperline,
++				  f->fmt.pix_mp.width, f->fmt.pix_mp.height,
++				  fmt);
++	/*
++	 * Drivers must set sizeimage for uncompressed formats
++	 * Compressed formats allow the client to request an alternate
++	 * size for the buffer.
++	 */
++	if (!(fmt->flags & V4L2_FMT_FLAG_COMPRESSED) ||
++	    f->fmt.pix_mp.plane_fmt[0].sizeimage < sizeimage)
++		f->fmt.pix_mp.plane_fmt[0].sizeimage = sizeimage;
++
++	memset(f->fmt.pix_mp.plane_fmt[0].reserved, 0,
++	       sizeof(f->fmt.pix_mp.plane_fmt[0].reserved));
++
++	if (ctx->dev->role == DECODE || ctx->dev->role == DEINTERLACE) {
++		switch (f->fmt.pix_mp.field) {
++		/*
++		 * All of this is pretty much guesswork as we'll set the
++		 * interlace format correctly come format changed, and signal
++		 * it appropriately on each buffer.
++		 */
++		default:
++		case V4L2_FIELD_NONE:
++		case V4L2_FIELD_ANY:
++			f->fmt.pix_mp.field = V4L2_FIELD_NONE;
++			break;
++		case V4L2_FIELD_INTERLACED:
++			f->fmt.pix_mp.field = V4L2_FIELD_INTERLACED;
++			break;
++		case V4L2_FIELD_TOP:
++		case V4L2_FIELD_BOTTOM:
++		case V4L2_FIELD_INTERLACED_TB:
++			f->fmt.pix_mp.field = V4L2_FIELD_INTERLACED_TB;
++			break;
++		case V4L2_FIELD_INTERLACED_BT:
++			f->fmt.pix_mp.field = V4L2_FIELD_INTERLACED_BT;
++			break;
++		}
++	} else {
++		f->fmt.pix_mp.field = V4L2_FIELD_NONE;
++	}
++
++	return 0;
++}
++
++static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
++				  struct v4l2_format *f)
++{
++	struct bcm2835_codec_fmt *fmt;
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++
++	fmt = find_format(f, ctx->dev, true);
++	if (!fmt) {
++		f->fmt.pix_mp.pixelformat = get_default_format(ctx->dev,
++							       true)->fourcc;
++		fmt = find_format(f, ctx->dev, true);
++	}
++
++	return vidioc_try_fmt(ctx, f, fmt);
++}
++
++static int vidioc_try_fmt_vid_out(struct file *file, void *priv,
++				  struct v4l2_format *f)
++{
++	struct bcm2835_codec_fmt *fmt;
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++
++	fmt = find_format(f, ctx->dev, false);
++	if (!fmt) {
++		f->fmt.pix_mp.pixelformat = get_default_format(ctx->dev,
++							       false)->fourcc;
++		fmt = find_format(f, ctx->dev, false);
++	}
++
++	if (!f->fmt.pix_mp.colorspace)
++		f->fmt.pix_mp.colorspace = ctx->colorspace;
++
++	return vidioc_try_fmt(ctx, f, fmt);
++}
++
++static int vidioc_s_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f,
++			unsigned int requested_height)
++{
++	struct bcm2835_codec_q_data *q_data;
++	struct vb2_queue *vq;
++	struct vchiq_mmal_port *port;
++	bool update_capture_port = false;
++	bool reenable_port = false;
++	int ret;
++
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev,	"Setting format for type %d, wxh: %dx%d, fmt: %08x, size %u\n",
++		 f->type, f->fmt.pix_mp.width, f->fmt.pix_mp.height,
++		 f->fmt.pix_mp.pixelformat,
++		 f->fmt.pix_mp.plane_fmt[0].sizeimage);
++
++	vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, f->type);
++	if (!vq)
++		return -EINVAL;
++
++	q_data = get_q_data(ctx, f->type);
++	if (!q_data)
++		return -EINVAL;
++
++	if (vb2_is_busy(vq)) {
++		v4l2_err(&ctx->dev->v4l2_dev, "%s queue busy\n", __func__);
++		return -EBUSY;
++	}
++
++	q_data->fmt = find_format(f, ctx->dev,
++				  f->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
++	q_data->crop_width = f->fmt.pix_mp.width;
++	q_data->height = f->fmt.pix_mp.height;
++	if (!q_data->selection_set ||
++	    (q_data->fmt->flags & V4L2_FMT_FLAG_COMPRESSED))
++		q_data->crop_height = requested_height;
++
++	/*
++	 * Copying the behaviour of vicodec which retains a single set of
++	 * colorspace parameters for both input and output.
++	 */
++	ctx->colorspace = f->fmt.pix_mp.colorspace;
++	ctx->xfer_func = f->fmt.pix_mp.xfer_func;
++	ctx->ycbcr_enc = f->fmt.pix_mp.ycbcr_enc;
++	ctx->quant = f->fmt.pix_mp.quantization;
++
++	q_data->field = f->fmt.pix_mp.field;
++
++	/* All parameters should have been set correctly by try_fmt */
++	q_data->bytesperline = f->fmt.pix_mp.plane_fmt[0].bytesperline;
++	q_data->sizeimage = f->fmt.pix_mp.plane_fmt[0].sizeimage;
++
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev,	"Calculated bpl as %u, size %u\n",
++		 q_data->bytesperline, q_data->sizeimage);
++
++	if ((ctx->dev->role == DECODE || ctx->dev->role == ENCODE_IMAGE) &&
++	    q_data->fmt->flags & V4L2_FMT_FLAG_COMPRESSED &&
++	    q_data->crop_width && q_data->height) {
++		/*
++		 * On the decoder or image encoder, if provided with
++		 * a resolution on the input side, then replicate that
++		 * to the output side.
++		 * GStreamer appears not to support V4L2_EVENT_SOURCE_CHANGE,
++		 * nor set up a resolution on the output side, therefore
++		 * we can't decode anything at a resolution other than the
++		 * default one.
++		 */
++		struct bcm2835_codec_q_data *q_data_dst =
++						&ctx->q_data[V4L2_M2M_DST];
++
++		q_data_dst->crop_width = q_data->crop_width;
++		q_data_dst->crop_height = q_data->crop_height;
++		q_data_dst->height = ALIGN(q_data->crop_height, 16);
++
++		q_data_dst->bytesperline =
++			get_bytesperline(f->fmt.pix_mp.width,
++					 f->fmt.pix_mp.height,
++					 q_data_dst->fmt, ctx->dev->role);
++		q_data_dst->sizeimage = get_sizeimage(q_data_dst->bytesperline,
++						      q_data_dst->crop_width,
++						      q_data_dst->height,
++						      q_data_dst->fmt);
++		update_capture_port = true;
++	}
++
++	/* If we have a component then setup the port as well */
++	port = get_port_data(ctx, vq->type);
++	if (!port)
++		return 0;
++
++	if (port->enabled) {
++		unsigned int num_buffers;
++
++		/*
++		 * This should only ever happen with DECODE and the MMAL output
++		 * port that has been enabled for resolution changed events.
++		 * In this case no buffers have been allocated or sent to the
++		 * component, so warn on that.
++		 */
++		WARN_ON(ctx->dev->role != DECODE ||
++			f->type != V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE ||
++			atomic_read(&port->buffers_with_vpu));
++
++		/*
++		 * Disable will reread the port format, so retain buffer count.
++		 */
++		num_buffers = port->current_buffer.num;
++
++		ret = vchiq_mmal_port_disable(ctx->dev->instance, port);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Error disabling port update buffer count, ret %d\n",
++				 __func__, ret);
++
++		port->current_buffer.num = num_buffers;
++
++		reenable_port = true;
++	}
++
++	setup_mmal_port_format(ctx, q_data, port);
++	ret = vchiq_mmal_port_set_format(ctx->dev->instance, port);
++	if (ret) {
++		v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed vchiq_mmal_port_set_format on port, ret %d\n",
++			 __func__, ret);
++		ret = -EINVAL;
++	}
++
++	if (q_data->sizeimage < port->minimum_buffer.size) {
++		v4l2_err(&ctx->dev->v4l2_dev, "%s: Current buffer size of %u < min buf size %u - driver mismatch to MMAL\n",
++			 __func__, q_data->sizeimage,
++			 port->minimum_buffer.size);
++	}
++
++	if (reenable_port) {
++		ret = vchiq_mmal_port_enable(ctx->dev->instance,
++					     port,
++					     op_buffer_cb);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed enabling o/p port, ret %d\n",
++				 __func__, ret);
++	}
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev,	"Set format for type %d, wxh: %dx%d, fmt: %08x, size %u\n",
++		 f->type, q_data->crop_width, q_data->height,
++		 q_data->fmt->fourcc, q_data->sizeimage);
++
++	if (update_capture_port) {
++		struct vchiq_mmal_port *port_dst = &ctx->component->output[0];
++		struct bcm2835_codec_q_data *q_data_dst =
++						&ctx->q_data[V4L2_M2M_DST];
++
++		setup_mmal_port_format(ctx, q_data_dst, port_dst);
++		ret = vchiq_mmal_port_set_format(ctx->dev->instance, port_dst);
++		if (ret) {
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed vchiq_mmal_port_set_format on output port, ret %d\n",
++				 __func__, ret);
++			ret = -EINVAL;
++		}
++	}
++	return ret;
++}
++
++static int vidioc_s_fmt_vid_cap(struct file *file, void *priv,
++				struct v4l2_format *f)
++{
++	unsigned int height = f->fmt.pix_mp.height;
++	int ret;
++
++	ret = vidioc_try_fmt_vid_cap(file, priv, f);
++	if (ret)
++		return ret;
++
++	return vidioc_s_fmt(file2ctx(file), f, height);
++}
++
++static int vidioc_s_fmt_vid_out(struct file *file, void *priv,
++				struct v4l2_format *f)
++{
++	unsigned int height = f->fmt.pix_mp.height;
++	int ret;
++
++	ret = vidioc_try_fmt_vid_out(file, priv, f);
++	if (ret)
++		return ret;
++
++	ret = vidioc_s_fmt(file2ctx(file), f, height);
++	return ret;
++}
++
++static int vidioc_g_selection(struct file *file, void *priv,
++			      struct v4l2_selection *s)
++{
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++	struct bcm2835_codec_q_data *q_data;
++
++	/*
++	 * The selection API takes V4L2_BUF_TYPE_VIDEO_CAPTURE and
++	 * V4L2_BUF_TYPE_VIDEO_OUTPUT, even if the device implements the MPLANE
++	 * API. The V4L2 core will have converted the MPLANE variants to
++	 * non-MPLANE.
++	 * Open code this instead of using get_q_data in this case.
++	 */
++	switch (s->type) {
++	case V4L2_BUF_TYPE_VIDEO_CAPTURE:
++		/* CAPTURE on encoder is not valid. */
++		if (ctx->dev->role == ENCODE || ctx->dev->role == ENCODE_IMAGE)
++			return -EINVAL;
++		q_data = &ctx->q_data[V4L2_M2M_DST];
++		break;
++	case V4L2_BUF_TYPE_VIDEO_OUTPUT:
++		/* OUTPUT on deoder is not valid. */
++		if (ctx->dev->role == DECODE)
++			return -EINVAL;
++		q_data = &ctx->q_data[V4L2_M2M_SRC];
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	switch (ctx->dev->role) {
++	case DECODE:
++		switch (s->target) {
++		case V4L2_SEL_TGT_COMPOSE_DEFAULT:
++		case V4L2_SEL_TGT_COMPOSE:
++			s->r.left = 0;
++			s->r.top = 0;
++			s->r.width = q_data->crop_width;
++			s->r.height = q_data->crop_height;
++			break;
++		case V4L2_SEL_TGT_COMPOSE_BOUNDS:
++			s->r.left = 0;
++			s->r.top = 0;
++			s->r.width = q_data->crop_width;
++			s->r.height = q_data->crop_height;
++			break;
++		case V4L2_SEL_TGT_CROP_BOUNDS:
++		case V4L2_SEL_TGT_CROP_DEFAULT:
++			s->r.left = 0;
++			s->r.top = 0;
++			s->r.width = (q_data->bytesperline << 3) /
++						q_data->fmt->depth;
++			s->r.height = q_data->height;
++			break;
++		default:
++			return -EINVAL;
++		}
++		break;
++	case ENCODE:
++	case ENCODE_IMAGE:
++		switch (s->target) {
++		case V4L2_SEL_TGT_CROP_DEFAULT:
++		case V4L2_SEL_TGT_CROP_BOUNDS:
++			s->r.top = 0;
++			s->r.left = 0;
++			s->r.width = q_data->bytesperline;
++			s->r.height = q_data->height;
++			break;
++		case V4L2_SEL_TGT_CROP:
++			s->r.top = 0;
++			s->r.left = 0;
++			s->r.width = q_data->crop_width;
++			s->r.height = q_data->crop_height;
++			break;
++		default:
++			return -EINVAL;
++		}
++		break;
++	case ISP:
++		break;
++	case DEINTERLACE:
++		if (s->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) {
++			switch (s->target) {
++			case V4L2_SEL_TGT_COMPOSE_DEFAULT:
++			case V4L2_SEL_TGT_COMPOSE:
++				s->r.left = 0;
++				s->r.top = 0;
++				s->r.width = q_data->crop_width;
++				s->r.height = q_data->crop_height;
++				break;
++			case V4L2_SEL_TGT_COMPOSE_BOUNDS:
++				s->r.left = 0;
++				s->r.top = 0;
++				s->r.width = q_data->crop_width;
++				s->r.height = q_data->crop_height;
++				break;
++			default:
++				return -EINVAL;
++			}
++		} else {
++			/* must be V4L2_BUF_TYPE_VIDEO_OUTPUT */
++			switch (s->target) {
++			case V4L2_SEL_TGT_CROP_DEFAULT:
++			case V4L2_SEL_TGT_CROP_BOUNDS:
++				s->r.top = 0;
++				s->r.left = 0;
++				s->r.width = q_data->bytesperline;
++				s->r.height = q_data->height;
++				break;
++			case V4L2_SEL_TGT_CROP:
++				s->r.top = 0;
++				s->r.left = 0;
++				s->r.width = q_data->crop_width;
++				s->r.height = q_data->crop_height;
++				break;
++			default:
++				return -EINVAL;
++			}
++		}
++		break;
++	case NUM_ROLES:
++		break;
++	}
++
++	return 0;
++}
++
++static int vidioc_s_selection(struct file *file, void *priv,
++			      struct v4l2_selection *s)
++{
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++	struct bcm2835_codec_q_data *q_data = NULL;
++	struct vchiq_mmal_port *port = NULL;
++	int ret;
++
++	/*
++	 * The selection API takes V4L2_BUF_TYPE_VIDEO_CAPTURE and
++	 * V4L2_BUF_TYPE_VIDEO_OUTPUT, even if the device implements the MPLANE
++	 * API. The V4L2 core will have converted the MPLANE variants to
++	 * non-MPLANE.
++	 *
++	 * Open code this instead of using get_q_data in this case.
++	 */
++	switch (s->type) {
++	case V4L2_BUF_TYPE_VIDEO_CAPTURE:
++		/* CAPTURE on encoder is not valid. */
++		if (ctx->dev->role == ENCODE || ctx->dev->role == ENCODE_IMAGE)
++			return -EINVAL;
++		q_data = &ctx->q_data[V4L2_M2M_DST];
++		if (ctx->component)
++			port = &ctx->component->output[0];
++		break;
++	case V4L2_BUF_TYPE_VIDEO_OUTPUT:
++		/* OUTPUT on deoder is not valid. */
++		if (ctx->dev->role == DECODE)
++			return -EINVAL;
++		q_data = &ctx->q_data[V4L2_M2M_SRC];
++		if (ctx->component)
++			port = &ctx->component->input[0];
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: ctx %p, type %d, q_data %p, target %d, rect x/y %d/%d, w/h %ux%u\n",
++		 __func__, ctx, s->type, q_data, s->target, s->r.left, s->r.top,
++		 s->r.width, s->r.height);
++
++	switch (ctx->dev->role) {
++	case DECODE:
++		switch (s->target) {
++		case V4L2_SEL_TGT_COMPOSE:
++			/* Accept cropped image */
++			s->r.left = 0;
++			s->r.top = 0;
++			s->r.width = min(s->r.width, q_data->crop_width);
++			s->r.height = min(s->r.height, q_data->height);
++			q_data->crop_width = s->r.width;
++			q_data->crop_height = s->r.height;
++			q_data->selection_set = true;
++			break;
++		default:
++			return -EINVAL;
++		}
++		break;
++	case ENCODE:
++	case ENCODE_IMAGE:
++		switch (s->target) {
++		case V4L2_SEL_TGT_CROP:
++			/* Only support crop from (0,0) */
++			s->r.top = 0;
++			s->r.left = 0;
++			s->r.width = min(s->r.width, q_data->crop_width);
++			s->r.height = min(s->r.height, q_data->height);
++			q_data->crop_width = s->r.width;
++			q_data->crop_height = s->r.height;
++			q_data->selection_set = true;
++			break;
++		default:
++			return -EINVAL;
++		}
++		break;
++	case ISP:
++		break;
++	case DEINTERLACE:
++		if (s->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) {
++			switch (s->target) {
++			case V4L2_SEL_TGT_COMPOSE:
++				/* Accept cropped image */
++				s->r.left = 0;
++				s->r.top = 0;
++				s->r.width = min(s->r.width, q_data->crop_width);
++				s->r.height = min(s->r.height, q_data->height);
++				q_data->crop_width = s->r.width;
++				q_data->crop_height = s->r.height;
++				q_data->selection_set = true;
++				break;
++			default:
++				return -EINVAL;
++			}
++			break;
++		} else {
++			/* must be V4L2_BUF_TYPE_VIDEO_OUTPUT */
++			switch (s->target) {
++			case V4L2_SEL_TGT_CROP:
++				/* Only support crop from (0,0) */
++				s->r.top = 0;
++				s->r.left = 0;
++				s->r.width = min(s->r.width, q_data->crop_width);
++				s->r.height = min(s->r.height, q_data->height);
++				q_data->crop_width = s->r.width;
++				q_data->crop_height = s->r.height;
++				q_data->selection_set = true;
++				break;
++			default:
++				return -EINVAL;
++			}
++			break;
++		}
++	case NUM_ROLES:
++		break;
++	}
++
++	if (!port)
++		return 0;
++
++	setup_mmal_port_format(ctx, q_data, port);
++	ret = vchiq_mmal_port_set_format(ctx->dev->instance, port);
++	if (ret) {
++		v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed vchiq_mmal_port_set_format on port, ret %d\n",
++			 __func__, ret);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static int vidioc_s_parm(struct file *file, void *priv,
++			 struct v4l2_streamparm *parm)
++{
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++
++	if (parm->type != V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE)
++		return -EINVAL;
++
++	if (!parm->parm.output.timeperframe.denominator ||
++	    !parm->parm.output.timeperframe.numerator)
++		return -EINVAL;
++
++	ctx->framerate_num =
++			parm->parm.output.timeperframe.denominator;
++	ctx->framerate_denom =
++			parm->parm.output.timeperframe.numerator;
++
++	parm->parm.output.capability = V4L2_CAP_TIMEPERFRAME;
++
++	return 0;
++}
++
++static int vidioc_g_parm(struct file *file, void *priv,
++			 struct v4l2_streamparm *parm)
++{
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++
++	if (parm->type != V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE)
++		return -EINVAL;
++
++	parm->parm.output.capability = V4L2_CAP_TIMEPERFRAME;
++	parm->parm.output.timeperframe.denominator =
++			ctx->framerate_num;
++	parm->parm.output.timeperframe.numerator =
++			ctx->framerate_denom;
++
++	return 0;
++}
++
++static int vidioc_g_pixelaspect(struct file *file, void *fh, int type,
++				struct v4l2_fract *f)
++{
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++
++	/*
++	 * The selection API takes V4L2_BUF_TYPE_VIDEO_CAPTURE and
++	 * V4L2_BUF_TYPE_VIDEO_OUTPUT, even if the device implements the MPLANE
++	 * API. The V4L2 core will have converted the MPLANE variants to
++	 * non-MPLANE.
++	 * Open code this instead of using get_q_data in this case.
++	 */
++	if (ctx->dev->role != DECODE)
++		return -ENOIOCTLCMD;
++
++	if (type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
++		return -EINVAL;
++
++	*f = ctx->q_data[V4L2_M2M_DST].aspect_ratio;
++
++	return 0;
++}
++
++static int vidioc_subscribe_evt(struct v4l2_fh *fh,
++				const struct v4l2_event_subscription *sub)
++{
++	switch (sub->type) {
++	case V4L2_EVENT_EOS:
++		return v4l2_event_subscribe(fh, sub, 2, NULL);
++	case V4L2_EVENT_SOURCE_CHANGE:
++		return v4l2_src_change_event_subscribe(fh, sub);
++	default:
++		return v4l2_ctrl_subscribe_event(fh, sub);
++	}
++}
++
++static int bcm2835_codec_set_level_profile(struct bcm2835_codec_ctx *ctx,
++					   struct v4l2_ctrl *ctrl)
++{
++	struct mmal_parameter_video_profile param;
++	int param_size = sizeof(param);
++	int ret;
++
++	/*
++	 * Level and Profile are set via the same MMAL parameter.
++	 * Retrieve the current settings and amend the one that has changed.
++	 */
++	ret = vchiq_mmal_port_parameter_get(ctx->dev->instance,
++					    &ctx->component->output[0],
++					    MMAL_PARAMETER_PROFILE,
++					    &param,
++					    &param_size);
++	if (ret)
++		return ret;
++
++	switch (ctrl->id) {
++	case V4L2_CID_MPEG_VIDEO_H264_PROFILE:
++		switch (ctrl->val) {
++		case V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE:
++			param.profile = MMAL_VIDEO_PROFILE_H264_BASELINE;
++			break;
++		case V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE:
++			param.profile =
++				MMAL_VIDEO_PROFILE_H264_CONSTRAINED_BASELINE;
++			break;
++		case V4L2_MPEG_VIDEO_H264_PROFILE_MAIN:
++			param.profile = MMAL_VIDEO_PROFILE_H264_MAIN;
++			break;
++		case V4L2_MPEG_VIDEO_H264_PROFILE_HIGH:
++			param.profile = MMAL_VIDEO_PROFILE_H264_HIGH;
++			break;
++		default:
++			/* Should never get here */
++			break;
++		}
++		break;
++
++	case V4L2_CID_MPEG_VIDEO_H264_LEVEL:
++		switch (ctrl->val) {
++		case V4L2_MPEG_VIDEO_H264_LEVEL_1_0:
++			param.level = MMAL_VIDEO_LEVEL_H264_1;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_1B:
++			param.level = MMAL_VIDEO_LEVEL_H264_1b;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_1_1:
++			param.level = MMAL_VIDEO_LEVEL_H264_11;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_1_2:
++			param.level = MMAL_VIDEO_LEVEL_H264_12;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_1_3:
++			param.level = MMAL_VIDEO_LEVEL_H264_13;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_2_0:
++			param.level = MMAL_VIDEO_LEVEL_H264_2;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_2_1:
++			param.level = MMAL_VIDEO_LEVEL_H264_21;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_2_2:
++			param.level = MMAL_VIDEO_LEVEL_H264_22;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_3_0:
++			param.level = MMAL_VIDEO_LEVEL_H264_3;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_3_1:
++			param.level = MMAL_VIDEO_LEVEL_H264_31;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_3_2:
++			param.level = MMAL_VIDEO_LEVEL_H264_32;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_4_0:
++			param.level = MMAL_VIDEO_LEVEL_H264_4;
++			break;
++		/*
++		 * Note that the hardware spec is level 4.0. Levels above that
++		 * are there for correctly encoding the headers and may not
++		 * be able to keep up with real-time.
++		 */
++		case V4L2_MPEG_VIDEO_H264_LEVEL_4_1:
++			param.level = MMAL_VIDEO_LEVEL_H264_41;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_4_2:
++			param.level = MMAL_VIDEO_LEVEL_H264_42;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_5_0:
++			param.level = MMAL_VIDEO_LEVEL_H264_5;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_5_1:
++			param.level = MMAL_VIDEO_LEVEL_H264_51;
++			break;
++		default:
++			/* Should never get here */
++			break;
++		}
++	}
++	ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++					    &ctx->component->output[0],
++					    MMAL_PARAMETER_PROFILE,
++					    &param,
++					    param_size);
++
++	return ret;
++}
++
++static int bcm2835_codec_s_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct bcm2835_codec_ctx *ctx =
++		container_of(ctrl->handler, struct bcm2835_codec_ctx, hdl);
++	int ret = 0;
++
++	switch (ctrl->id) {
++	case V4L2_CID_MPEG_VIDEO_BITRATE:
++		ctx->bitrate = ctrl->val;
++		if (!ctx->component)
++			break;
++
++		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						    &ctx->component->output[0],
++						    MMAL_PARAMETER_VIDEO_BIT_RATE,
++						    &ctrl->val,
++						    sizeof(ctrl->val));
++		break;
++
++	case V4L2_CID_MPEG_VIDEO_BITRATE_MODE: {
++		u32 bitrate_mode;
++
++		if (!ctx->component)
++			break;
++
++		switch (ctrl->val) {
++		default:
++		case V4L2_MPEG_VIDEO_BITRATE_MODE_VBR:
++			bitrate_mode = MMAL_VIDEO_RATECONTROL_VARIABLE;
++			break;
++		case V4L2_MPEG_VIDEO_BITRATE_MODE_CBR:
++			bitrate_mode = MMAL_VIDEO_RATECONTROL_CONSTANT;
++			break;
++		}
++
++		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						    &ctx->component->output[0],
++						    MMAL_PARAMETER_RATECONTROL,
++						    &bitrate_mode,
++						    sizeof(bitrate_mode));
++		break;
++	}
++	case V4L2_CID_MPEG_VIDEO_REPEAT_SEQ_HEADER:
++		if (!ctx->component)
++			break;
++
++		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						    &ctx->component->output[0],
++						    MMAL_PARAMETER_VIDEO_ENCODE_INLINE_HEADER,
++						    &ctrl->val,
++						    sizeof(ctrl->val));
++		break;
++
++	case V4L2_CID_MPEG_VIDEO_HEADER_MODE:
++		if (!ctx->component)
++			break;
++
++		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						    &ctx->component->output[0],
++						    MMAL_PARAMETER_VIDEO_ENCODE_HEADERS_WITH_FRAME,
++						    &ctrl->val,
++						    sizeof(ctrl->val));
++		break;
++
++	case V4L2_CID_MPEG_VIDEO_H264_I_PERIOD:
++		if (!ctx->component)
++			break;
++
++		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						    &ctx->component->output[0],
++						    MMAL_PARAMETER_INTRAPERIOD,
++						    &ctrl->val,
++						    sizeof(ctrl->val));
++		break;
++
++	case V4L2_CID_MPEG_VIDEO_H264_PROFILE:
++	case V4L2_CID_MPEG_VIDEO_H264_LEVEL:
++		if (!ctx->component)
++			break;
++
++		ret = bcm2835_codec_set_level_profile(ctx, ctrl);
++		break;
++
++	case V4L2_CID_MPEG_VIDEO_H264_MIN_QP:
++		if (!ctx->component)
++			break;
++
++		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						    &ctx->component->output[0],
++						    MMAL_PARAMETER_VIDEO_ENCODE_MIN_QUANT,
++						    &ctrl->val,
++						    sizeof(ctrl->val));
++		break;
++
++	case V4L2_CID_MPEG_VIDEO_H264_MAX_QP:
++		if (!ctx->component)
++			break;
++
++		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						    &ctx->component->output[0],
++						    MMAL_PARAMETER_VIDEO_ENCODE_MAX_QUANT,
++						    &ctrl->val,
++						    sizeof(ctrl->val));
++		break;
++
++	case V4L2_CID_MPEG_VIDEO_FORCE_KEY_FRAME: {
++		u32 mmal_bool = 1;
++
++		if (!ctx->component)
++			break;
++
++		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						    &ctx->component->output[0],
++						    MMAL_PARAMETER_VIDEO_REQUEST_I_FRAME,
++						    &mmal_bool,
++						    sizeof(mmal_bool));
++		break;
++	}
++	case V4L2_CID_HFLIP:
++	case V4L2_CID_VFLIP: {
++		u32 u32_value;
++
++		if (ctrl->id == V4L2_CID_HFLIP)
++			ctx->hflip = ctrl->val;
++		else
++			ctx->vflip = ctrl->val;
++
++		if (!ctx->component)
++			break;
++
++		if (ctx->hflip && ctx->vflip)
++			u32_value = MMAL_PARAM_MIRROR_BOTH;
++		else if (ctx->hflip)
++			u32_value = MMAL_PARAM_MIRROR_HORIZONTAL;
++		else if (ctx->vflip)
++			u32_value = MMAL_PARAM_MIRROR_VERTICAL;
++		else
++			u32_value = MMAL_PARAM_MIRROR_NONE;
++
++		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						    &ctx->component->input[0],
++						    MMAL_PARAMETER_MIRROR,
++						    &u32_value,
++						    sizeof(u32_value));
++		break;
++	}
++	case V4L2_CID_JPEG_COMPRESSION_QUALITY:
++		if (!ctx->component)
++			break;
++
++		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						    &ctx->component->output[0],
++						    MMAL_PARAMETER_JPEG_Q_FACTOR,
++						    &ctrl->val,
++						    sizeof(ctrl->val));
++		break;
++
++	default:
++		v4l2_err(&ctx->dev->v4l2_dev, "Invalid control\n");
++		return -EINVAL;
++	}
++
++	if (ret)
++		v4l2_err(&ctx->dev->v4l2_dev, "Failed setting ctrl %08x, ret %d\n",
++			 ctrl->id, ret);
++	return ret ? -EINVAL : 0;
++}
++
++static const struct v4l2_ctrl_ops bcm2835_codec_ctrl_ops = {
++	.s_ctrl = bcm2835_codec_s_ctrl,
++};
++
++static int vidioc_try_decoder_cmd(struct file *file, void *priv,
++				  struct v4l2_decoder_cmd *cmd)
++{
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++
++	if (ctx->dev->role != DECODE)
++		return -EINVAL;
++
++	switch (cmd->cmd) {
++	case V4L2_DEC_CMD_STOP:
++		if (cmd->flags & V4L2_DEC_CMD_STOP_TO_BLACK) {
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: DEC cmd->flags=%u stop to black not supported",
++				 __func__, cmd->flags);
++			return -EINVAL;
++		}
++		break;
++	case V4L2_DEC_CMD_START:
++		break;
++	default:
++		return -EINVAL;
++	}
++	return 0;
++}
++
++static int vidioc_decoder_cmd(struct file *file, void *priv,
++			      struct v4l2_decoder_cmd *cmd)
++{
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++	struct bcm2835_codec_q_data *q_data = &ctx->q_data[V4L2_M2M_SRC];
++	struct vb2_queue *dst_vq;
++	int ret;
++
++	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s, cmd %u", __func__,
++		 cmd->cmd);
++	ret = vidioc_try_decoder_cmd(file, priv, cmd);
++	if (ret)
++		return ret;
++
++	switch (cmd->cmd) {
++	case V4L2_DEC_CMD_STOP:
++		if (q_data->eos_buffer_in_use)
++			v4l2_err(&ctx->dev->v4l2_dev, "EOS buffers already in use\n");
++		q_data->eos_buffer_in_use = true;
++
++		q_data->eos_buffer.mmal.buffer_size = 0;
++		q_data->eos_buffer.mmal.length = 0;
++		q_data->eos_buffer.mmal.mmal_flags =
++						MMAL_BUFFER_HEADER_FLAG_EOS;
++		q_data->eos_buffer.mmal.pts = 0;
++		q_data->eos_buffer.mmal.dts = 0;
++
++		if (!ctx->component)
++			break;
++
++		ret = vchiq_mmal_submit_buffer(ctx->dev->instance,
++					       &ctx->component->input[0],
++					       &q_data->eos_buffer.mmal);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev,
++				 "%s: EOS buffer submit failed %d\n",
++				 __func__, ret);
++
++		break;
++
++	case V4L2_DEC_CMD_START:
++		dst_vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx,
++					 V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
++		vb2_clear_last_buffer_dequeued(dst_vq);
++		break;
++
++	default:
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static int vidioc_try_encoder_cmd(struct file *file, void *priv,
++				  struct v4l2_encoder_cmd *cmd)
++{
++	switch (cmd->cmd) {
++	case V4L2_ENC_CMD_STOP:
++		break;
++
++	case V4L2_ENC_CMD_START:
++		/* Do we need to do anything here? */
++		break;
++	default:
++		return -EINVAL;
++	}
++	return 0;
++}
++
++static int vidioc_encoder_cmd(struct file *file, void *priv,
++			      struct v4l2_encoder_cmd *cmd)
++{
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++	struct bcm2835_codec_q_data *q_data = &ctx->q_data[V4L2_M2M_SRC];
++	int ret;
++
++	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s, cmd %u", __func__,
++		 cmd->cmd);
++	ret = vidioc_try_encoder_cmd(file, priv, cmd);
++	if (ret)
++		return ret;
++
++	switch (cmd->cmd) {
++	case V4L2_ENC_CMD_STOP:
++		if (q_data->eos_buffer_in_use)
++			v4l2_err(&ctx->dev->v4l2_dev, "EOS buffers already in use\n");
++		q_data->eos_buffer_in_use = true;
++
++		q_data->eos_buffer.mmal.buffer_size = 0;
++		q_data->eos_buffer.mmal.length = 0;
++		q_data->eos_buffer.mmal.mmal_flags =
++						MMAL_BUFFER_HEADER_FLAG_EOS;
++		q_data->eos_buffer.mmal.pts = 0;
++		q_data->eos_buffer.mmal.dts = 0;
++
++		if (!ctx->component)
++			break;
++
++		ret = vchiq_mmal_submit_buffer(ctx->dev->instance,
++					       &ctx->component->input[0],
++					       &q_data->eos_buffer.mmal);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev,
++				 "%s: EOS buffer submit failed %d\n",
++				 __func__, ret);
++
++		break;
++	case V4L2_ENC_CMD_START:
++		/* Do we need to do anything here? */
++		break;
++
++	default:
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static int vidioc_enum_framesizes(struct file *file, void *fh,
++				  struct v4l2_frmsizeenum *fsize)
++{
++	struct bcm2835_codec_fmt *fmt;
++
++	fmt = find_format_pix_fmt(fsize->pixel_format, file2ctx(file)->dev,
++				  true);
++	if (!fmt)
++		fmt = find_format_pix_fmt(fsize->pixel_format,
++					  file2ctx(file)->dev,
++					  false);
++
++	if (!fmt)
++		return -EINVAL;
++
++	if (fsize->index)
++		return -EINVAL;
++
++	fsize->type = V4L2_FRMSIZE_TYPE_STEPWISE;
++
++	fsize->stepwise.min_width = MIN_W;
++	fsize->stepwise.max_width = MAX_W;
++	fsize->stepwise.step_width = 2;
++	fsize->stepwise.min_height = MIN_H;
++	fsize->stepwise.max_height = MAX_H;
++	fsize->stepwise.step_height = 2;
++
++	return 0;
++}
++
++static const struct v4l2_ioctl_ops bcm2835_codec_ioctl_ops = {
++	.vidioc_querycap	= vidioc_querycap,
++
++	.vidioc_enum_fmt_vid_cap = vidioc_enum_fmt_vid_cap,
++	.vidioc_g_fmt_vid_cap_mplane	= vidioc_g_fmt_vid_cap,
++	.vidioc_try_fmt_vid_cap_mplane	= vidioc_try_fmt_vid_cap,
++	.vidioc_s_fmt_vid_cap_mplane	= vidioc_s_fmt_vid_cap,
++
++	.vidioc_enum_fmt_vid_out = vidioc_enum_fmt_vid_out,
++	.vidioc_g_fmt_vid_out_mplane	= vidioc_g_fmt_vid_out,
++	.vidioc_try_fmt_vid_out_mplane	= vidioc_try_fmt_vid_out,
++	.vidioc_s_fmt_vid_out_mplane	= vidioc_s_fmt_vid_out,
++
++	.vidioc_reqbufs		= v4l2_m2m_ioctl_reqbufs,
++	.vidioc_querybuf	= v4l2_m2m_ioctl_querybuf,
++	.vidioc_qbuf		= v4l2_m2m_ioctl_qbuf,
++	.vidioc_dqbuf		= v4l2_m2m_ioctl_dqbuf,
++	.vidioc_prepare_buf	= v4l2_m2m_ioctl_prepare_buf,
++	.vidioc_create_bufs	= v4l2_m2m_ioctl_create_bufs,
++	.vidioc_expbuf		= v4l2_m2m_ioctl_expbuf,
++
++	.vidioc_streamon	= v4l2_m2m_ioctl_streamon,
++	.vidioc_streamoff	= v4l2_m2m_ioctl_streamoff,
++
++	.vidioc_g_selection	= vidioc_g_selection,
++	.vidioc_s_selection	= vidioc_s_selection,
++
++	.vidioc_g_parm		= vidioc_g_parm,
++	.vidioc_s_parm		= vidioc_s_parm,
++
++	.vidioc_g_pixelaspect	= vidioc_g_pixelaspect,
++
++	.vidioc_subscribe_event = vidioc_subscribe_evt,
++	.vidioc_unsubscribe_event = v4l2_event_unsubscribe,
++
++	.vidioc_decoder_cmd = vidioc_decoder_cmd,
++	.vidioc_try_decoder_cmd = vidioc_try_decoder_cmd,
++	.vidioc_encoder_cmd = vidioc_encoder_cmd,
++	.vidioc_try_encoder_cmd = vidioc_try_encoder_cmd,
++	.vidioc_enum_framesizes = vidioc_enum_framesizes,
++};
++
++static int bcm2835_codec_create_component(struct bcm2835_codec_ctx *ctx)
++{
++	struct bcm2835_codec_dev *dev = ctx->dev;
++	unsigned int enable = 1;
++	int ret;
++
++	ret = vchiq_mmal_component_init(dev->instance, components[dev->role],
++					&ctx->component);
++	if (ret < 0) {
++		v4l2_err(&dev->v4l2_dev, "%s: failed to create component %s\n",
++			 __func__, components[dev->role]);
++		return -ENOMEM;
++	}
++
++	vchiq_mmal_port_parameter_set(dev->instance, &ctx->component->input[0],
++				      MMAL_PARAMETER_ZERO_COPY, &enable,
++				      sizeof(enable));
++	vchiq_mmal_port_parameter_set(dev->instance, &ctx->component->output[0],
++				      MMAL_PARAMETER_ZERO_COPY, &enable,
++				      sizeof(enable));
++
++	if (dev->role == DECODE) {
++		/*
++		 * Disable firmware option that ensures decoded timestamps
++		 * always increase.
++		 */
++		enable = 0;
++		vchiq_mmal_port_parameter_set(dev->instance,
++					      &ctx->component->output[0],
++					      MMAL_PARAMETER_VIDEO_VALIDATE_TIMESTAMPS,
++					      &enable,
++					      sizeof(enable));
++		/*
++		 * Enable firmware option to stop on colourspace and pixel
++		 * aspect ratio changed
++		 */
++		enable = 1;
++		vchiq_mmal_port_parameter_set(dev->instance,
++					      &ctx->component->control,
++					      MMAL_PARAMETER_VIDEO_STOP_ON_PAR_COLOUR_CHANGE,
++					      &enable,
++					      sizeof(enable));
++	} else if (dev->role == DEINTERLACE) {
++		/* Select the default deinterlace algorithm. */
++		int half_framerate = 0;
++		int default_frame_interval = -1; /* don't interpolate */
++		int frame_type = 5; /* 0=progressive, 3=TFF, 4=BFF, 5=see frame */
++		int use_qpus = 0;
++		enum mmal_parameter_imagefx effect =
++			advanced_deinterlace && ctx->q_data[V4L2_M2M_SRC].crop_width <= 800 ?
++			MMAL_PARAM_IMAGEFX_DEINTERLACE_ADV :
++			MMAL_PARAM_IMAGEFX_DEINTERLACE_FAST;
++		struct mmal_parameter_imagefx_parameters params = {
++			.effect = effect,
++			.num_effect_params = 4,
++			.effect_parameter = { frame_type,
++					      default_frame_interval,
++					      half_framerate,
++					      use_qpus },
++		};
++
++		vchiq_mmal_port_parameter_set(dev->instance,
++					      &ctx->component->output[0],
++					      MMAL_PARAMETER_IMAGE_EFFECT_PARAMETERS,
++					      &params,
++					      sizeof(params));
++
++	} else if (dev->role == ENCODE_IMAGE) {
++		enable = 0;
++		vchiq_mmal_port_parameter_set(dev->instance,
++					      &ctx->component->control,
++					      MMAL_PARAMETER_EXIF_DISABLE,
++					      &enable,
++					      sizeof(enable));
++		enable = 1;
++		vchiq_mmal_port_parameter_set(dev->instance,
++					      &ctx->component->output[0],
++						  MMAL_PARAMETER_JPEG_IJG_SCALING,
++					      &enable,
++					      sizeof(enable));
++	}
++
++	setup_mmal_port_format(ctx, &ctx->q_data[V4L2_M2M_SRC],
++			       &ctx->component->input[0]);
++	ctx->component->input[0].cb_ctx = ctx;
++
++	setup_mmal_port_format(ctx, &ctx->q_data[V4L2_M2M_DST],
++			       &ctx->component->output[0]);
++	ctx->component->output[0].cb_ctx = ctx;
++
++	ret = vchiq_mmal_port_set_format(dev->instance,
++					 &ctx->component->input[0]);
++	if (ret < 0) {
++		v4l2_dbg(1, debug, &dev->v4l2_dev,
++			 "%s: vchiq_mmal_port_set_format ip port failed\n",
++			 __func__);
++		goto destroy_component;
++	}
++
++	ret = vchiq_mmal_port_set_format(dev->instance,
++					 &ctx->component->output[0]);
++	if (ret < 0) {
++		v4l2_dbg(1, debug, &dev->v4l2_dev,
++			 "%s: vchiq_mmal_port_set_format op port failed\n",
++			 __func__);
++		goto destroy_component;
++	}
++
++	if (dev->role == ENCODE || dev->role == ENCODE_IMAGE) {
++		u32 param = 1;
++
++		if (ctx->q_data[V4L2_M2M_SRC].sizeimage <
++			ctx->component->output[0].minimum_buffer.size)
++			v4l2_err(&dev->v4l2_dev, "buffer size mismatch sizeimage %u < min size %u\n",
++				 ctx->q_data[V4L2_M2M_SRC].sizeimage,
++				 ctx->component->output[0].minimum_buffer.size);
++
++		if (dev->role == ENCODE) {
++			/* Enable SPS Timing header so framerate information is encoded
++			 * in the H264 header.
++			 */
++			vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						      &ctx->component->output[0],
++						      MMAL_PARAMETER_VIDEO_ENCODE_SPS_TIMING,
++						      &param, sizeof(param));
++
++			/* Enable inserting headers into the first frame */
++			vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						      &ctx->component->control,
++						      MMAL_PARAMETER_VIDEO_ENCODE_HEADERS_WITH_FRAME,
++						      &param, sizeof(param));
++			/*
++			 * Avoid fragmenting the buffers over multiple frames (unless
++			 * the frame is bigger than the whole buffer)
++			 */
++			vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						      &ctx->component->control,
++						      MMAL_PARAMETER_MINIMISE_FRAGMENTATION,
++						      &param, sizeof(param));
++		}
++	} else {
++		if (ctx->q_data[V4L2_M2M_DST].sizeimage <
++			ctx->component->output[0].minimum_buffer.size)
++			v4l2_err(&dev->v4l2_dev, "buffer size mismatch sizeimage %u < min size %u\n",
++				 ctx->q_data[V4L2_M2M_DST].sizeimage,
++				 ctx->component->output[0].minimum_buffer.size);
++	}
++
++	/* Now we have a component we can set all the ctrls */
++	ret = v4l2_ctrl_handler_setup(&ctx->hdl);
++
++	v4l2_dbg(2, debug, &dev->v4l2_dev, "%s: component created as %s\n",
++		 __func__, components[dev->role]);
++
++	return 0;
++
++destroy_component:
++	vchiq_mmal_component_finalise(ctx->dev->instance, ctx->component);
++	ctx->component = NULL;
++
++	return ret;
++}
++
++/*
++ * Queue operations
++ */
++
++static int bcm2835_codec_queue_setup(struct vb2_queue *vq,
++				     unsigned int *nbuffers,
++				     unsigned int *nplanes,
++				     unsigned int sizes[],
++				     struct device *alloc_devs[])
++{
++	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(vq);
++	struct bcm2835_codec_q_data *q_data;
++	struct vchiq_mmal_port *port;
++	unsigned int size;
++
++	q_data = get_q_data(ctx, vq->type);
++	if (!q_data)
++		return -EINVAL;
++
++	if (!ctx->component)
++		if (bcm2835_codec_create_component(ctx))
++			return -EINVAL;
++
++	port = get_port_data(ctx, vq->type);
++
++	size = q_data->sizeimage;
++
++	if (*nplanes)
++		return sizes[0] < size ? -EINVAL : 0;
++
++	*nplanes = 1;
++
++	sizes[0] = size;
++	port->current_buffer.size = size;
++
++	if (*nbuffers < port->minimum_buffer.num)
++		*nbuffers = port->minimum_buffer.num;
++	/* Add one buffer to take an EOS */
++	port->current_buffer.num = *nbuffers + 1;
++
++	return 0;
++}
++
++static int bcm2835_codec_mmal_buf_cleanup(struct mmal_buffer *mmal_buf)
++{
++	mmal_vchi_buffer_cleanup(mmal_buf);
++
++	if (mmal_buf->dma_buf) {
++		dma_buf_put(mmal_buf->dma_buf);
++		mmal_buf->dma_buf = NULL;
++	}
++
++	return 0;
++}
++
++static int bcm2835_codec_buf_init(struct vb2_buffer *vb)
++{
++	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(vb->vb2_queue);
++	struct vb2_v4l2_buffer *vb2 = to_vb2_v4l2_buffer(vb);
++	struct v4l2_m2m_buffer *m2m = container_of(vb2, struct v4l2_m2m_buffer,
++						   vb);
++	struct m2m_mmal_buffer *buf = container_of(m2m, struct m2m_mmal_buffer,
++						   m2m);
++
++	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s: ctx:%p, vb %p\n",
++		 __func__, ctx, vb);
++	buf->mmal.buffer = vb2_plane_vaddr(&buf->m2m.vb.vb2_buf, 0);
++	buf->mmal.buffer_size = vb2_plane_size(&buf->m2m.vb.vb2_buf, 0);
++
++	mmal_vchi_buffer_init(ctx->dev->instance, &buf->mmal);
++
++	return 0;
++}
++
++static int bcm2835_codec_buf_prepare(struct vb2_buffer *vb)
++{
++	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(vb->vb2_queue);
++	struct bcm2835_codec_q_data *q_data;
++	struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
++	struct v4l2_m2m_buffer *m2m = container_of(vbuf, struct v4l2_m2m_buffer,
++						   vb);
++	struct m2m_mmal_buffer *buf = container_of(m2m, struct m2m_mmal_buffer,
++						   m2m);
++	struct dma_buf *dma_buf;
++	int ret;
++
++	v4l2_dbg(4, debug, &ctx->dev->v4l2_dev, "%s: type: %d ptr %p\n",
++		 __func__, vb->vb2_queue->type, vb);
++
++	q_data = get_q_data(ctx, vb->vb2_queue->type);
++	if (V4L2_TYPE_IS_OUTPUT(vb->vb2_queue->type)) {
++		if (vbuf->field == V4L2_FIELD_ANY)
++			vbuf->field = V4L2_FIELD_NONE;
++	}
++
++	if (vb2_plane_size(vb, 0) < q_data->sizeimage) {
++		v4l2_err(&ctx->dev->v4l2_dev, "%s data will not fit into plane (%lu < %lu)\n",
++			 __func__, vb2_plane_size(vb, 0),
++			 (long)q_data->sizeimage);
++		return -EINVAL;
++	}
++
++	if (!V4L2_TYPE_IS_OUTPUT(vb->vb2_queue->type))
++		vb2_set_plane_payload(vb, 0, q_data->sizeimage);
++
++	switch (vb->memory) {
++	case VB2_MEMORY_DMABUF:
++		dma_buf = dma_buf_get(vb->planes[0].m.fd);
++
++		if (dma_buf != buf->mmal.dma_buf) {
++			/* dmabuf either hasn't already been mapped, or it has
++			 * changed.
++			 */
++			if (buf->mmal.dma_buf) {
++				v4l2_err(&ctx->dev->v4l2_dev,
++					 "%s Buffer changed - why did the core not call cleanup?\n",
++					 __func__);
++				bcm2835_codec_mmal_buf_cleanup(&buf->mmal);
++			}
++
++			buf->mmal.dma_buf = dma_buf;
++		} else {
++			/* We already have a reference count on the dmabuf, so
++			 * release the one we acquired above.
++			 */
++			dma_buf_put(dma_buf);
++		}
++		ret = 0;
++		break;
++	case VB2_MEMORY_MMAP:
++		/*
++		 * We want to do this at init, but vb2_core_expbuf checks that
++		 * the index < q->num_buffers, and q->num_buffers only gets
++		 * updated once all the buffers are allocated.
++		 */
++		if (!buf->mmal.dma_buf) {
++			ret = vb2_core_expbuf_dmabuf(vb->vb2_queue,
++						     vb->vb2_queue->type,
++						     vb->index, 0,
++						     O_CLOEXEC,
++						     &buf->mmal.dma_buf);
++			if (ret)
++				v4l2_err(&ctx->dev->v4l2_dev,
++					 "%s: Failed to expbuf idx %d, ret %d\n",
++					 __func__, vb->index, ret);
++		} else {
++			ret = 0;
++		}
++		break;
++	default:
++		ret = -EINVAL;
++		break;
++	}
++
++	return ret;
++}
++
++static void bcm2835_codec_buf_queue(struct vb2_buffer *vb)
++{
++	struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
++	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(vb->vb2_queue);
++
++	v4l2_dbg(4, debug, &ctx->dev->v4l2_dev, "%s: type: %d ptr %p vbuf->flags %u, seq %u, bytesused %u\n",
++		 __func__, vb->vb2_queue->type, vb, vbuf->flags, vbuf->sequence,
++		 vb->planes[0].bytesused);
++	v4l2_m2m_buf_queue(ctx->fh.m2m_ctx, vbuf);
++}
++
++static void bcm2835_codec_buffer_cleanup(struct vb2_buffer *vb)
++{
++	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(vb->vb2_queue);
++	struct vb2_v4l2_buffer *vb2 = to_vb2_v4l2_buffer(vb);
++	struct v4l2_m2m_buffer *m2m = container_of(vb2, struct v4l2_m2m_buffer,
++						   vb);
++	struct m2m_mmal_buffer *buf = container_of(m2m, struct m2m_mmal_buffer,
++						   m2m);
++
++	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s: ctx:%p, vb %p\n",
++		 __func__, ctx, vb);
++
++	bcm2835_codec_mmal_buf_cleanup(&buf->mmal);
++}
++
++static void bcm2835_codec_flush_buffers(struct bcm2835_codec_ctx *ctx,
++					struct vchiq_mmal_port *port)
++{
++	int ret;
++
++	if (atomic_read(&port->buffers_with_vpu)) {
++		v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: Waiting for buffers to be returned - %d outstanding\n",
++			 __func__, atomic_read(&port->buffers_with_vpu));
++		ret = wait_for_completion_timeout(&ctx->frame_cmplt,
++						  COMPLETE_TIMEOUT);
++		if (ret <= 0) {
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Timeout waiting for buffers to be returned - %d outstanding\n",
++				 __func__,
++				 atomic_read(&port->buffers_with_vpu));
++		}
++	}
++}
++static int bcm2835_codec_start_streaming(struct vb2_queue *q,
++					 unsigned int count)
++{
++	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(q);
++	struct bcm2835_codec_dev *dev = ctx->dev;
++	struct bcm2835_codec_q_data *q_data = get_q_data(ctx, q->type);
++	struct vchiq_mmal_port *port = get_port_data(ctx, q->type);
++	int ret = 0;
++
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: type: %d count %d\n",
++		 __func__, q->type, count);
++	q_data->sequence = 0;
++
++	if (!ctx->component_enabled) {
++		ret = vchiq_mmal_component_enable(dev->instance,
++						  ctx->component);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed enabling component, ret %d\n",
++				 __func__, ret);
++		ctx->component_enabled = true;
++	}
++
++	if (port->enabled) {
++		unsigned int num_buffers;
++
++		init_completion(&ctx->frame_cmplt);
++
++		/*
++		 * This should only ever happen with DECODE and the MMAL output
++		 * port that has been enabled for resolution changed events.
++		 * In this case no buffers have been allocated or sent to the
++		 * component, so warn on that.
++		 */
++		WARN_ON(ctx->dev->role != DECODE);
++		WARN_ON(q->type != V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
++		WARN_ON(atomic_read(&port->buffers_with_vpu));
++
++		/*
++		 * Disable will reread the port format, so retain buffer count.
++		 */
++		num_buffers = port->current_buffer.num;
++
++		ret = vchiq_mmal_port_disable(dev->instance, port);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Error disabling port update buffer count, ret %d\n",
++				 __func__, ret);
++		bcm2835_codec_flush_buffers(ctx, port);
++		port->current_buffer.num = num_buffers;
++	}
++
++	if (count < port->minimum_buffer.num)
++		count = port->minimum_buffer.num;
++
++	if (port->current_buffer.num < count + 1) {
++		v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s: ctx:%p, buffer count changed %u to %u\n",
++			 __func__, ctx, port->current_buffer.num, count + 1);
++
++		port->current_buffer.num = count + 1;
++		ret = vchiq_mmal_port_set_format(dev->instance, port);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Error updating buffer count, ret %d\n",
++				 __func__, ret);
++	}
++
++	if (dev->role == DECODE &&
++	    q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE &&
++	    !ctx->component->output[0].enabled) {
++		/*
++		 * Decode needs to enable the MMAL output/V4L2 CAPTURE
++		 * port at this point too so that we have everything
++		 * set up for dynamic resolution changes.
++		 */
++		ret = vchiq_mmal_port_enable(dev->instance,
++					     &ctx->component->output[0],
++					     op_buffer_cb);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed enabling o/p port, ret %d\n",
++				 __func__, ret);
++	}
++
++	if (q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
++		/*
++		 * Create the EOS buffer.
++		 * We only need the MMAL part, and want to NOT attach a memory
++		 * buffer to it as it should only take flags.
++		 */
++		memset(&q_data->eos_buffer, 0, sizeof(q_data->eos_buffer));
++		mmal_vchi_buffer_init(dev->instance,
++				      &q_data->eos_buffer.mmal);
++		q_data->eos_buffer_in_use = false;
++
++		ret = vchiq_mmal_port_enable(dev->instance,
++					     port,
++					     ip_buffer_cb);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed enabling i/p port, ret %d\n",
++				 __func__, ret);
++	} else {
++		if (!port->enabled) {
++			ret = vchiq_mmal_port_enable(dev->instance,
++						     port,
++						     op_buffer_cb);
++			if (ret)
++				v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed enabling o/p port, ret %d\n",
++					 __func__, ret);
++		}
++	}
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: Done, ret %d\n",
++		 __func__, ret);
++	return ret;
++}
++
++static void bcm2835_codec_stop_streaming(struct vb2_queue *q)
++{
++	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(q);
++	struct bcm2835_codec_dev *dev = ctx->dev;
++	struct bcm2835_codec_q_data *q_data = get_q_data(ctx, q->type);
++	struct vchiq_mmal_port *port = get_port_data(ctx, q->type);
++	struct vb2_v4l2_buffer *vbuf;
++	int ret;
++
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: type: %d - return buffers\n",
++		 __func__, q->type);
++
++	init_completion(&ctx->frame_cmplt);
++
++	/* Clear out all buffers held by m2m framework */
++	for (;;) {
++		if (V4L2_TYPE_IS_OUTPUT(q->type))
++			vbuf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
++		else
++			vbuf = v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
++		if (!vbuf)
++			break;
++		v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: return buffer %p\n",
++			 __func__, vbuf);
++
++		v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_QUEUED);
++	}
++
++	/* Disable MMAL port - this will flush buffers back */
++	ret = vchiq_mmal_port_disable(dev->instance, port);
++	if (ret)
++		v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed disabling %s port, ret %d\n",
++			 __func__, V4L2_TYPE_IS_OUTPUT(q->type) ? "i/p" : "o/p",
++			 ret);
++
++	bcm2835_codec_flush_buffers(ctx, port);
++
++	if (dev->role == DECODE &&
++	    q->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE &&
++	    ctx->component->input[0].enabled) {
++		/*
++		 * For decode we need to keep the MMAL output port enabled for
++		 * resolution changed events whenever the input is enabled.
++		 */
++		ret = vchiq_mmal_port_enable(dev->instance,
++					     &ctx->component->output[0],
++					     op_buffer_cb);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed enabling o/p port, ret %d\n",
++				 __func__, ret);
++	}
++
++	/* If both ports disabled, then disable the component */
++	if (ctx->component_enabled &&
++	    !ctx->component->input[0].enabled &&
++	    !ctx->component->output[0].enabled) {
++		ret = vchiq_mmal_component_disable(dev->instance,
++						   ctx->component);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed enabling component, ret %d\n",
++				 __func__, ret);
++		ctx->component_enabled = false;
++	}
++
++	if (V4L2_TYPE_IS_OUTPUT(q->type))
++		mmal_vchi_buffer_cleanup(&q_data->eos_buffer.mmal);
++
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: done\n", __func__);
++}
++
++static const struct vb2_ops bcm2835_codec_qops = {
++	.queue_setup	 = bcm2835_codec_queue_setup,
++	.buf_init	 = bcm2835_codec_buf_init,
++	.buf_prepare	 = bcm2835_codec_buf_prepare,
++	.buf_queue	 = bcm2835_codec_buf_queue,
++	.buf_cleanup	 = bcm2835_codec_buffer_cleanup,
++	.start_streaming = bcm2835_codec_start_streaming,
++	.stop_streaming  = bcm2835_codec_stop_streaming,
++	.wait_prepare	 = vb2_ops_wait_prepare,
++	.wait_finish	 = vb2_ops_wait_finish,
++};
++
++static int queue_init(void *priv, struct vb2_queue *src_vq,
++		      struct vb2_queue *dst_vq)
++{
++	struct bcm2835_codec_ctx *ctx = priv;
++	int ret;
++
++	src_vq->type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
++	src_vq->io_modes = VB2_MMAP | VB2_DMABUF;
++	src_vq->drv_priv = ctx;
++	src_vq->buf_struct_size = sizeof(struct m2m_mmal_buffer);
++	src_vq->ops = &bcm2835_codec_qops;
++	src_vq->mem_ops = &vb2_dma_contig_memops;
++	src_vq->dev = &ctx->dev->pdev->dev;
++	src_vq->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
++	src_vq->lock = &ctx->dev->dev_mutex;
++
++	ret = vb2_queue_init(src_vq);
++	if (ret)
++		return ret;
++
++	dst_vq->type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE;
++	dst_vq->io_modes = VB2_MMAP | VB2_DMABUF;
++	dst_vq->drv_priv = ctx;
++	dst_vq->buf_struct_size = sizeof(struct m2m_mmal_buffer);
++	dst_vq->ops = &bcm2835_codec_qops;
++	dst_vq->mem_ops = &vb2_dma_contig_memops;
++	dst_vq->dev = &ctx->dev->pdev->dev;
++	dst_vq->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
++	dst_vq->lock = &ctx->dev->dev_mutex;
++
++	return vb2_queue_init(dst_vq);
++}
++
++/*
++ * File operations
++ */
++static int bcm2835_codec_open(struct file *file)
++{
++	struct bcm2835_codec_dev *dev = video_drvdata(file);
++	struct bcm2835_codec_ctx *ctx = NULL;
++	struct v4l2_ctrl_handler *hdl;
++	int rc = 0;
++
++	if (mutex_lock_interruptible(&dev->dev_mutex)) {
++		v4l2_err(&dev->v4l2_dev, "Mutex fail\n");
++		return -ERESTARTSYS;
++	}
++	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
++	if (!ctx) {
++		rc = -ENOMEM;
++		goto open_unlock;
++	}
++
++	ctx->q_data[V4L2_M2M_SRC].fmt = get_default_format(dev, false);
++	ctx->q_data[V4L2_M2M_DST].fmt = get_default_format(dev, true);
++
++	ctx->q_data[V4L2_M2M_SRC].crop_width = DEFAULT_WIDTH;
++	ctx->q_data[V4L2_M2M_SRC].crop_height = DEFAULT_HEIGHT;
++	ctx->q_data[V4L2_M2M_SRC].height = DEFAULT_HEIGHT;
++	ctx->q_data[V4L2_M2M_SRC].bytesperline =
++			get_bytesperline(DEFAULT_WIDTH, DEFAULT_HEIGHT,
++					 ctx->q_data[V4L2_M2M_SRC].fmt,
++					 dev->role);
++	ctx->q_data[V4L2_M2M_SRC].sizeimage =
++		get_sizeimage(ctx->q_data[V4L2_M2M_SRC].bytesperline,
++			      ctx->q_data[V4L2_M2M_SRC].crop_width,
++			      ctx->q_data[V4L2_M2M_SRC].height,
++			      ctx->q_data[V4L2_M2M_SRC].fmt);
++	ctx->q_data[V4L2_M2M_SRC].field = V4L2_FIELD_NONE;
++
++	ctx->q_data[V4L2_M2M_DST].crop_width = DEFAULT_WIDTH;
++	ctx->q_data[V4L2_M2M_DST].crop_height = DEFAULT_HEIGHT;
++	ctx->q_data[V4L2_M2M_DST].height = DEFAULT_HEIGHT;
++	ctx->q_data[V4L2_M2M_DST].bytesperline =
++			get_bytesperline(DEFAULT_WIDTH, DEFAULT_HEIGHT,
++					 ctx->q_data[V4L2_M2M_DST].fmt,
++					 dev->role);
++	ctx->q_data[V4L2_M2M_DST].sizeimage =
++		get_sizeimage(ctx->q_data[V4L2_M2M_DST].bytesperline,
++			      ctx->q_data[V4L2_M2M_DST].crop_width,
++			      ctx->q_data[V4L2_M2M_DST].height,
++			      ctx->q_data[V4L2_M2M_DST].fmt);
++	ctx->q_data[V4L2_M2M_DST].aspect_ratio.numerator = 1;
++	ctx->q_data[V4L2_M2M_DST].aspect_ratio.denominator = 1;
++	ctx->q_data[V4L2_M2M_DST].field = V4L2_FIELD_NONE;
++
++	ctx->colorspace = V4L2_COLORSPACE_REC709;
++	ctx->bitrate = 10 * 1000 * 1000;
++
++	ctx->framerate_num = 30;
++	ctx->framerate_denom = 1;
++
++	/* Initialise V4L2 contexts */
++	v4l2_fh_init(&ctx->fh, video_devdata(file));
++	file->private_data = &ctx->fh;
++	ctx->dev = dev;
++	hdl = &ctx->hdl;
++	switch (dev->role) {
++	case ENCODE:
++	{
++		/* Encode controls */
++		v4l2_ctrl_handler_init(hdl, 11);
++
++		v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++				       V4L2_CID_MPEG_VIDEO_BITRATE_MODE,
++				       V4L2_MPEG_VIDEO_BITRATE_MODE_CBR, 0,
++				       V4L2_MPEG_VIDEO_BITRATE_MODE_VBR);
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_MPEG_VIDEO_BITRATE,
++				  25 * 1000, 25 * 1000 * 1000,
++				  25 * 1000, 10 * 1000 * 1000);
++		v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++				       V4L2_CID_MPEG_VIDEO_HEADER_MODE,
++				       V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME,
++				       0, V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME);
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_MPEG_VIDEO_REPEAT_SEQ_HEADER,
++				  0, 1,
++				  1, 0);
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_MPEG_VIDEO_H264_I_PERIOD,
++				  0, 0x7FFFFFFF,
++				  1, 60);
++		v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++				       V4L2_CID_MPEG_VIDEO_H264_LEVEL,
++				       V4L2_MPEG_VIDEO_H264_LEVEL_5_1,
++				       ~(BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_0) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1B) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_1) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_2) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_3) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_0) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_1) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_2) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_1) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_2) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_0) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_1)),
++				       V4L2_MPEG_VIDEO_H264_LEVEL_4_0);
++		v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++				       V4L2_CID_MPEG_VIDEO_H264_PROFILE,
++				       V4L2_MPEG_VIDEO_H264_PROFILE_HIGH,
++				       ~(BIT(V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE) |
++					 BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE) |
++					 BIT(V4L2_MPEG_VIDEO_H264_PROFILE_MAIN) |
++					 BIT(V4L2_MPEG_VIDEO_H264_PROFILE_HIGH)),
++					V4L2_MPEG_VIDEO_H264_PROFILE_HIGH);
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_MPEG_VIDEO_H264_MIN_QP,
++				  0, 51,
++				  1, 20);
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_MPEG_VIDEO_H264_MAX_QP,
++				  0, 51,
++				  1, 51);
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_MPEG_VIDEO_FORCE_KEY_FRAME,
++				  0, 0, 0, 0);
++		if (hdl->error) {
++			rc = hdl->error;
++			goto free_ctrl_handler;
++		}
++		ctx->fh.ctrl_handler = hdl;
++		v4l2_ctrl_handler_setup(hdl);
++	}
++	break;
++	case DECODE:
++	{
++		v4l2_ctrl_handler_init(hdl, 1);
++
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_MIN_BUFFERS_FOR_CAPTURE,
++				  1, 1, 1, 1);
++		if (hdl->error) {
++			rc = hdl->error;
++			goto free_ctrl_handler;
++		}
++		ctx->fh.ctrl_handler = hdl;
++		v4l2_ctrl_handler_setup(hdl);
++	}
++	break;
++	case ISP:
++	{
++		v4l2_ctrl_handler_init(hdl, 2);
++
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_HFLIP,
++				  1, 0, 1, 0);
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_VFLIP,
++				  1, 0, 1, 0);
++		if (hdl->error) {
++			rc = hdl->error;
++			goto free_ctrl_handler;
++		}
++		ctx->fh.ctrl_handler = hdl;
++		v4l2_ctrl_handler_setup(hdl);
++	}
++	break;
++	case DEINTERLACE:
++	{
++		v4l2_ctrl_handler_init(hdl, 0);
++	}
++	break;
++	case ENCODE_IMAGE:
++	{
++		/* Encode image controls */
++		v4l2_ctrl_handler_init(hdl, 1);
++
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_JPEG_COMPRESSION_QUALITY,
++				  1, 100,
++				  1, 80);
++		if (hdl->error) {
++			rc = hdl->error;
++			goto free_ctrl_handler;
++		}
++		ctx->fh.ctrl_handler = hdl;
++		v4l2_ctrl_handler_setup(hdl);
++	}
++	break;
++	case NUM_ROLES:
++	break;
++	}
++
++	ctx->fh.m2m_ctx = v4l2_m2m_ctx_init(dev->m2m_dev, ctx, &queue_init);
++
++	if (IS_ERR(ctx->fh.m2m_ctx)) {
++		rc = PTR_ERR(ctx->fh.m2m_ctx);
++
++		goto free_ctrl_handler;
++	}
++
++	/* Set both queues as buffered as we have buffering in the VPU. That
++	 * means that we will be scheduled whenever either an input or output
++	 * buffer is available (otherwise one of each are required).
++	 */
++	v4l2_m2m_set_src_buffered(ctx->fh.m2m_ctx, true);
++	v4l2_m2m_set_dst_buffered(ctx->fh.m2m_ctx, true);
++
++	v4l2_fh_add(&ctx->fh);
++	atomic_inc(&dev->num_inst);
++
++	mutex_unlock(&dev->dev_mutex);
++	return 0;
++
++free_ctrl_handler:
++	v4l2_ctrl_handler_free(hdl);
++	kfree(ctx);
++open_unlock:
++	mutex_unlock(&dev->dev_mutex);
++	return rc;
++}
++
++static int bcm2835_codec_release(struct file *file)
++{
++	struct bcm2835_codec_dev *dev = video_drvdata(file);
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++
++	v4l2_dbg(1, debug, &dev->v4l2_dev, "%s: Releasing instance %p\n",
++		 __func__, ctx);
++
++	v4l2_fh_del(&ctx->fh);
++	v4l2_fh_exit(&ctx->fh);
++	v4l2_ctrl_handler_free(&ctx->hdl);
++	mutex_lock(&dev->dev_mutex);
++	v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
++
++	if (ctx->component)
++		vchiq_mmal_component_finalise(dev->instance, ctx->component);
++
++	mutex_unlock(&dev->dev_mutex);
++	kfree(ctx);
++
++	atomic_dec(&dev->num_inst);
++
++	return 0;
++}
++
++static const struct v4l2_file_operations bcm2835_codec_fops = {
++	.owner		= THIS_MODULE,
++	.open		= bcm2835_codec_open,
++	.release	= bcm2835_codec_release,
++	.poll		= v4l2_m2m_fop_poll,
++	.unlocked_ioctl	= video_ioctl2,
++	.mmap		= v4l2_m2m_fop_mmap,
++};
++
++static const struct video_device bcm2835_codec_videodev = {
++	.name		= MEM2MEM_NAME,
++	.vfl_dir	= VFL_DIR_M2M,
++	.fops		= &bcm2835_codec_fops,
++	.ioctl_ops	= &bcm2835_codec_ioctl_ops,
++	.minor		= -1,
++	.release	= video_device_release_empty,
++};
++
++static const struct v4l2_m2m_ops m2m_ops = {
++	.device_run	= device_run,
++	.job_ready	= job_ready,
++	.job_abort	= job_abort,
++};
++
++/* Size of the array to provide to the VPU when asking for the list of supported
++ * formats.
++ * The ISP component currently advertises 62 input formats, so add a small
++ * overhead on that.
++ */
++#define MAX_SUPPORTED_ENCODINGS 70
++
++/* Populate dev->supported_fmts with the formats supported by those ports. */
++static int bcm2835_codec_get_supported_fmts(struct bcm2835_codec_dev *dev)
++{
++	struct bcm2835_codec_fmt *list;
++	struct vchiq_mmal_component *component;
++	u32 fourccs[MAX_SUPPORTED_ENCODINGS];
++	u32 param_size = sizeof(fourccs);
++	unsigned int i, j, num_encodings;
++	int ret;
++
++	ret = vchiq_mmal_component_init(dev->instance, components[dev->role],
++					&component);
++	if (ret < 0) {
++		v4l2_err(&dev->v4l2_dev, "%s: failed to create component %s\n",
++			 __func__, components[dev->role]);
++		return -ENOMEM;
++	}
++
++	ret = vchiq_mmal_port_parameter_get(dev->instance,
++					    &component->input[0],
++					    MMAL_PARAMETER_SUPPORTED_ENCODINGS,
++					    &fourccs,
++					    &param_size);
++
++	if (ret) {
++		if (ret == MMAL_MSG_STATUS_ENOSPC) {
++			v4l2_err(&dev->v4l2_dev,
++				 "%s: port has more encodings than we provided space for. Some are dropped (%zu vs %u).\n",
++				 __func__, param_size / sizeof(u32),
++				 MAX_SUPPORTED_ENCODINGS);
++			num_encodings = MAX_SUPPORTED_ENCODINGS;
++		} else {
++			v4l2_err(&dev->v4l2_dev, "%s: get_param ret %u.\n",
++				 __func__, ret);
++			ret = -EINVAL;
++			goto destroy_component;
++		}
++	} else {
++		num_encodings = param_size / sizeof(u32);
++	}
++
++	/* Assume at this stage that all encodings will be supported in V4L2.
++	 * Any that aren't supported will waste a very small amount of memory.
++	 */
++	list = devm_kzalloc(&dev->pdev->dev,
++			    sizeof(struct bcm2835_codec_fmt) * num_encodings,
++			    GFP_KERNEL);
++	if (!list) {
++		ret = -ENOMEM;
++		goto destroy_component;
++	}
++	dev->supported_fmts[0].list = list;
++
++	for (i = 0, j = 0; i < num_encodings; i++) {
++		const struct bcm2835_codec_fmt *fmt = get_fmt(fourccs[i]);
++
++		if (fmt) {
++			list[j] = *fmt;
++			j++;
++		}
++	}
++	dev->supported_fmts[0].num_entries = j;
++
++	param_size = sizeof(fourccs);
++	ret = vchiq_mmal_port_parameter_get(dev->instance,
++					    &component->output[0],
++					    MMAL_PARAMETER_SUPPORTED_ENCODINGS,
++					    &fourccs,
++					    &param_size);
++
++	if (ret) {
++		if (ret == MMAL_MSG_STATUS_ENOSPC) {
++			v4l2_err(&dev->v4l2_dev,
++				 "%s: port has more encodings than we provided space for. Some are dropped (%zu vs %u).\n",
++				 __func__, param_size / sizeof(u32),
++				 MAX_SUPPORTED_ENCODINGS);
++			num_encodings = MAX_SUPPORTED_ENCODINGS;
++		} else {
++			ret = -EINVAL;
++			goto destroy_component;
++		}
++	} else {
++		num_encodings = param_size / sizeof(u32);
++	}
++	/* Assume at this stage that all encodings will be supported in V4L2. */
++	list = devm_kzalloc(&dev->pdev->dev,
++			    sizeof(struct bcm2835_codec_fmt) * num_encodings,
++			    GFP_KERNEL);
++	if (!list) {
++		ret = -ENOMEM;
++		goto destroy_component;
++	}
++	dev->supported_fmts[1].list = list;
++
++	for (i = 0, j = 0; i < num_encodings; i++) {
++		const struct bcm2835_codec_fmt *fmt = get_fmt(fourccs[i]);
++
++		if (fmt) {
++			list[j] = *fmt;
++			j++;
++		}
++	}
++	dev->supported_fmts[1].num_entries = j;
++
++	ret = 0;
++
++destroy_component:
++	vchiq_mmal_component_finalise(dev->instance, component);
++
++	return ret;
++}
++
++static int bcm2835_codec_create(struct bcm2835_codec_driver *drv,
++				struct bcm2835_codec_dev **new_dev,
++				enum bcm2835_codec_role role)
++{
++	struct platform_device *pdev = drv->pdev;
++	struct bcm2835_codec_dev *dev;
++	struct video_device *vfd;
++	int function;
++	int video_nr;
++	int ret;
++
++	dev = devm_kzalloc(&pdev->dev, sizeof(*dev), GFP_KERNEL);
++	if (!dev)
++		return -ENOMEM;
++
++	dev->pdev = pdev;
++
++	dev->role = role;
++
++	ret = vchiq_mmal_init(&dev->instance);
++	if (ret)
++		return ret;
++
++	ret = bcm2835_codec_get_supported_fmts(dev);
++	if (ret)
++		goto vchiq_finalise;
++
++	atomic_set(&dev->num_inst, 0);
++	mutex_init(&dev->dev_mutex);
++
++	/* Initialise the video device */
++	dev->vfd = bcm2835_codec_videodev;
++
++	vfd = &dev->vfd;
++	vfd->lock = &dev->dev_mutex;
++	vfd->v4l2_dev = &dev->v4l2_dev;
++	vfd->device_caps = V4L2_CAP_VIDEO_M2M_MPLANE | V4L2_CAP_STREAMING;
++	vfd->v4l2_dev->mdev = &drv->mdev;
++
++	ret = v4l2_device_register(&pdev->dev, &dev->v4l2_dev);
++	if (ret)
++		goto vchiq_finalise;
++
++	switch (role) {
++	case DECODE:
++		v4l2_disable_ioctl(vfd, VIDIOC_ENCODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_TRY_ENCODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_S_PARM);
++		v4l2_disable_ioctl(vfd, VIDIOC_G_PARM);
++		function = MEDIA_ENT_F_PROC_VIDEO_DECODER;
++		video_nr = decode_video_nr;
++		break;
++	case ENCODE:
++		v4l2_disable_ioctl(vfd, VIDIOC_DECODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_TRY_DECODER_CMD);
++		function = MEDIA_ENT_F_PROC_VIDEO_ENCODER;
++		video_nr = encode_video_nr;
++		break;
++	case ISP:
++		v4l2_disable_ioctl(vfd, VIDIOC_DECODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_TRY_DECODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_S_PARM);
++		v4l2_disable_ioctl(vfd, VIDIOC_G_PARM);
++		function = MEDIA_ENT_F_PROC_VIDEO_SCALER;
++		video_nr = isp_video_nr;
++		break;
++	case DEINTERLACE:
++		v4l2_disable_ioctl(vfd, VIDIOC_DECODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_TRY_DECODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_S_PARM);
++		v4l2_disable_ioctl(vfd, VIDIOC_G_PARM);
++		function = MEDIA_ENT_F_PROC_VIDEO_PIXEL_FORMATTER;
++		video_nr = deinterlace_video_nr;
++		break;
++	case ENCODE_IMAGE:
++		v4l2_disable_ioctl(vfd, VIDIOC_DECODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_TRY_DECODER_CMD);
++		function = MEDIA_ENT_F_PROC_VIDEO_ENCODER;
++		video_nr = encode_image_nr;
++		break;
++	default:
++		ret = -EINVAL;
++		goto unreg_dev;
++	}
++
++	ret = video_register_device(vfd, VFL_TYPE_VIDEO, video_nr);
++	if (ret) {
++		v4l2_err(&dev->v4l2_dev, "Failed to register video device\n");
++		goto unreg_dev;
++	}
++
++	video_set_drvdata(vfd, dev);
++	snprintf(vfd->name, sizeof(vfd->name), "%s-%s",
++		 bcm2835_codec_videodev.name, roles[role]);
++	v4l2_info(&dev->v4l2_dev, "Device registered as /dev/video%d\n",
++		  vfd->num);
++
++	*new_dev = dev;
++
++	dev->m2m_dev = v4l2_m2m_init(&m2m_ops);
++	if (IS_ERR(dev->m2m_dev)) {
++		v4l2_err(&dev->v4l2_dev, "Failed to init mem2mem device\n");
++		ret = PTR_ERR(dev->m2m_dev);
++		goto err_m2m;
++	}
++
++	ret = v4l2_m2m_register_media_controller(dev->m2m_dev, vfd, function);
++	if (ret)
++		goto err_m2m;
++
++	v4l2_info(&dev->v4l2_dev, "Loaded V4L2 %s\n",
++		  roles[role]);
++	return 0;
++
++err_m2m:
++	v4l2_m2m_release(dev->m2m_dev);
++	video_unregister_device(&dev->vfd);
++unreg_dev:
++	v4l2_device_unregister(&dev->v4l2_dev);
++vchiq_finalise:
++	vchiq_mmal_finalise(dev->instance);
++	return ret;
++}
++
++static int bcm2835_codec_destroy(struct bcm2835_codec_dev *dev)
++{
++	if (!dev)
++		return -ENODEV;
++
++	v4l2_info(&dev->v4l2_dev, "Removing " MEM2MEM_NAME ", %s\n",
++		  roles[dev->role]);
++	v4l2_m2m_unregister_media_controller(dev->m2m_dev);
++	v4l2_m2m_release(dev->m2m_dev);
++	video_unregister_device(&dev->vfd);
++	v4l2_device_unregister(&dev->v4l2_dev);
++	vchiq_mmal_finalise(dev->instance);
++
++	return 0;
++}
++
++static int bcm2835_codec_probe(struct platform_device *pdev)
++{
++	struct bcm2835_codec_driver *drv;
++	struct media_device *mdev;
++	int ret = 0;
++
++	drv = devm_kzalloc(&pdev->dev, sizeof(*drv), GFP_KERNEL);
++	if (!drv)
++		return -ENOMEM;
++
++	drv->pdev = pdev;
++	mdev = &drv->mdev;
++	mdev->dev = &pdev->dev;
++
++	strscpy(mdev->model, bcm2835_codec_videodev.name, sizeof(mdev->model));
++	strscpy(mdev->serial, "0000", sizeof(mdev->serial));
++	snprintf(mdev->bus_info, sizeof(mdev->bus_info), "platform:%s",
++		 pdev->name);
++
++	/* This should return the vgencmd version information or such .. */
++	mdev->hw_revision = 1;
++	media_device_init(mdev);
++
++	ret = bcm2835_codec_create(drv, &drv->decode, DECODE);
++	if (ret)
++		goto out;
++
++	ret = bcm2835_codec_create(drv, &drv->encode, ENCODE);
++	if (ret)
++		goto out;
++
++	ret = bcm2835_codec_create(drv, &drv->isp, ISP);
++	if (ret)
++		goto out;
++
++	ret = bcm2835_codec_create(drv, &drv->deinterlace, DEINTERLACE);
++	if (ret)
++		goto out;
++
++	ret = bcm2835_codec_create(drv, &drv->encode_image, ENCODE_IMAGE);
++	if (ret)
++		goto out;
++
++	/* Register the media device node */
++	if (media_device_register(mdev) < 0)
++		goto out;
++
++	platform_set_drvdata(pdev, drv);
++
++	return 0;
++
++out:
++	if (drv->encode_image) {
++		bcm2835_codec_destroy(drv->encode_image);
++		drv->encode_image = NULL;
++	}
++	if (drv->deinterlace) {
++		bcm2835_codec_destroy(drv->deinterlace);
++		drv->deinterlace = NULL;
++	}
++	if (drv->isp) {
++		bcm2835_codec_destroy(drv->isp);
++		drv->isp = NULL;
++	}
++	if (drv->encode) {
++		bcm2835_codec_destroy(drv->encode);
++		drv->encode = NULL;
++	}
++	if (drv->decode) {
++		bcm2835_codec_destroy(drv->decode);
++		drv->decode = NULL;
++	}
++	return ret;
++}
++
++static int bcm2835_codec_remove(struct platform_device *pdev)
++{
++	struct bcm2835_codec_driver *drv = platform_get_drvdata(pdev);
++
++	media_device_unregister(&drv->mdev);
++
++	bcm2835_codec_destroy(drv->encode_image);
++
++	bcm2835_codec_destroy(drv->deinterlace);
++
++	bcm2835_codec_destroy(drv->isp);
++
++	bcm2835_codec_destroy(drv->encode);
++
++	bcm2835_codec_destroy(drv->decode);
++
++	media_device_cleanup(&drv->mdev);
++
++	return 0;
++}
++
++static struct platform_driver bcm2835_v4l2_codec_driver = {
++	.probe = bcm2835_codec_probe,
++	.remove = bcm2835_codec_remove,
++	.driver = {
++		   .name = "bcm2835-codec",
++		   .owner = THIS_MODULE,
++		   },
++};
++
++module_platform_driver(bcm2835_v4l2_codec_driver);
++
++MODULE_DESCRIPTION("BCM2835 codec V4L2 driver");
++MODULE_AUTHOR("Dave Stevenson, <dave.stevenson@raspberrypi.com>");
++MODULE_LICENSE("GPL");
++MODULE_VERSION("0.0.1");
++MODULE_ALIAS("platform:bcm2835-codec");
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
+@@ -223,6 +223,8 @@ enum mmal_parameter_camera_type {
+ 	MMAL_PARAMETER_SHUTTER_SPEED,
+ 		/**< Takes a @ref MMAL_PARAMETER_AWB_GAINS_T */
+ 	MMAL_PARAMETER_CUSTOM_AWB_GAINS,
++		/**< Takes a @ref MMAL_PARAMETER_BOOLEAN_T */
++	MMAL_PARAMETER_JPEG_IJG_SCALING,
+ };
+ 
+ enum mmal_parameter_camera_config_timestamp_mode {
+@@ -615,6 +617,12 @@ enum mmal_parameter_video_type {
+ 
+ 	/**< Take a @ref MMAL_PARAMETER_BOOLEAN_T */
+ 	MMAL_PARAMETER_VIDEO_ENCODE_HEADERS_WITH_FRAME,
++
++	/**< Take a @ref MMAL_PARAMETER_BOOLEAN_T */
++	MMAL_PARAMETER_VIDEO_VALIDATE_TIMESTAMPS,
++
++	/**< Takes a @ref MMAL_PARAMETER_BOOLEAN_T */
++	MMAL_PARAMETER_VIDEO_STOP_ON_PAR_COLOUR_CHANGE,
+ };
+ 
+ /** Valid mirror modes */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0278-bcm2835-dma-only-reserve-channel-0-if-legacy-dma-dri.patch b/target/linux/bcm27xx/patches-6.1/950-0278-bcm2835-dma-only-reserve-channel-0-if-legacy-dma-dri.patch
new file mode 100644
index 00000000000000..72064bc92d4283
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0278-bcm2835-dma-only-reserve-channel-0-if-legacy-dma-dri.patch
@@ -0,0 +1,32 @@
+From 124d503cd4c6f5a7a877226c26139ec82c7d1282 Mon Sep 17 00:00:00 2001
+From: Matthias Reichl <hias@horus.com>
+Date: Sun, 11 Oct 2020 00:48:55 +0200
+Subject: [PATCH] bcm2835-dma: only reserve channel 0 if legacy dma
+ driver is enabled
+
+If CONFIG_DMA_BCM2708 isn't enabled there's no need to mask out
+one of the already scarce DMA channels.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+---
+ drivers/dma/bcm2835-dma.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -1283,6 +1283,7 @@ static int bcm2835_dma_probe(struct plat
+ 		goto err_no_dma;
+ 	}
+ 
++#ifdef CONFIG_DMA_BCM2708
+ 	/* One channel is reserved for the legacy API */
+ 	if (chans_available & BCM2835_DMA_BULK_MASK) {
+ 		rc = bcm_dmaman_probe(pdev, base,
+@@ -1293,6 +1294,7 @@ static int bcm2835_dma_probe(struct plat
+ 
+ 		chans_available &= ~BCM2835_DMA_BULK_MASK;
+ 	}
++#endif
+ 
+ 	/* And possibly one for the 40-bit DMA memcpy API */
+ 	if (chans_available & od->cfg_data->chan_40bit_mask &
diff --git a/target/linux/bcm27xx/patches-6.1/950-0279-uapi-bcm2835-isp-Add-bcm2835-isp-uapi-header-file.patch b/target/linux/bcm27xx/patches-6.1/950-0279-uapi-bcm2835-isp-Add-bcm2835-isp-uapi-header-file.patch
new file mode 100644
index 00000000000000..8fccdbd619d6d2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0279-uapi-bcm2835-isp-Add-bcm2835-isp-uapi-header-file.patch
@@ -0,0 +1,338 @@
+From 35173cc820575b1e59d8278347a2146476e08fd1 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 12 Oct 2020 17:03:14 +0100
+Subject: [PATCH] uapi: bcm2835-isp: Add bcm2835-isp uapi header file
+
+This file defines the userland interface to the bcm2835-isp driver
+that will follow in a separate commit.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ include/uapi/linux/bcm2835-isp.h | 320 +++++++++++++++++++++++++++++++
+ 1 file changed, 320 insertions(+)
+ create mode 100644 include/uapi/linux/bcm2835-isp.h
+
+--- /dev/null
++++ b/include/uapi/linux/bcm2835-isp.h
+@@ -0,0 +1,320 @@
++/* SPDX-License-Identifier: ((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause) */
++/*
++ * bcm2835-isp.h
++ *
++ * BCM2835 ISP driver - user space header file.
++ *
++ * Copyright © 2019-2020 Raspberry Pi (Trading) Ltd.
++ *
++ * Author: Naushir Patuck (naush@raspberrypi.com)
++ *
++ */
++
++#ifndef __BCM2835_ISP_H_
++#define __BCM2835_ISP_H_
++
++#include <linux/v4l2-controls.h>
++
++#define V4L2_CID_USER_BCM2835_ISP_CC_MATRIX	\
++				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0001)
++#define V4L2_CID_USER_BCM2835_ISP_LENS_SHADING	\
++				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0002)
++#define V4L2_CID_USER_BCM2835_ISP_BLACK_LEVEL	\
++				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0003)
++#define V4L2_CID_USER_BCM2835_ISP_GEQ		\
++				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0004)
++#define V4L2_CID_USER_BCM2835_ISP_GAMMA		\
++				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0005)
++#define V4L2_CID_USER_BCM2835_ISP_DENOISE	\
++				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0006)
++#define V4L2_CID_USER_BCM2835_ISP_SHARPEN	\
++				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0007)
++#define V4L2_CID_USER_BCM2835_ISP_DPC		\
++				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0008)
++
++/*
++ * All structs below are directly mapped onto the equivalent structs in
++ * drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
++ * for convenience.
++ */
++
++/**
++ * struct bcm2835_isp_rational - Rational value type.
++ *
++ * @num:	Numerator.
++ * @den:	Denominator.
++ */
++struct bcm2835_isp_rational {
++	__s32 num;
++	__u32 den;
++};
++
++/**
++ * struct bcm2835_isp_ccm - Colour correction matrix.
++ *
++ * @ccm:	3x3 correction matrix coefficients.
++ * @offsets:	1x3 correction offsets.
++ */
++struct bcm2835_isp_ccm {
++	struct bcm2835_isp_rational ccm[3][3];
++	__s32 offsets[3];
++};
++
++/**
++ * struct bcm2835_isp_custom_ccm - Custom CCM applied with the
++ *				   V4L2_CID_USER_BCM2835_ISP_CC_MATRIX ctrl.
++ *
++ * @enabled:	Enable custom CCM.
++ * @ccm:	Custom CCM coefficients and offsets.
++ */
++struct bcm2835_isp_custom_ccm {
++	__u32 enabled;
++	struct bcm2835_isp_ccm ccm;
++};
++
++/**
++ * enum bcm2835_isp_gain_format - format of the gains in the lens shading
++ *				  tables used with the
++ *				  V4L2_CID_USER_BCM2835_ISP_LENS_SHADING ctrl.
++ *
++ * @GAIN_FORMAT_U0P8_1:		Gains are u0.8 format, starting at 1.0
++ * @GAIN_FORMAT_U1P7_0:		Gains are u1.7 format, starting at 0.0
++ * @GAIN_FORMAT_U1P7_1:		Gains are u1.7 format, starting at 1.0
++ * @GAIN_FORMAT_U2P6_0:		Gains are u2.6 format, starting at 0.0
++ * @GAIN_FORMAT_U2P6_1:		Gains are u2.6 format, starting at 1.0
++ * @GAIN_FORMAT_U3P5_0:		Gains are u3.5 format, starting at 0.0
++ * @GAIN_FORMAT_U3P5_1:		Gains are u3.5 format, starting at 1.0
++ * @GAIN_FORMAT_U4P10:		Gains are u4.10 format, starting at 0.0
++ */
++enum bcm2835_isp_gain_format {
++	GAIN_FORMAT_U0P8_1 = 0,
++	GAIN_FORMAT_U1P7_0 = 1,
++	GAIN_FORMAT_U1P7_1 = 2,
++	GAIN_FORMAT_U2P6_0 = 3,
++	GAIN_FORMAT_U2P6_1 = 4,
++	GAIN_FORMAT_U3P5_0 = 5,
++	GAIN_FORMAT_U3P5_1 = 6,
++	GAIN_FORMAT_U4P10  = 7,
++};
++
++/**
++ * struct bcm2835_isp_lens_shading - Lens shading tables supplied with the
++ *				     V4L2_CID_USER_BCM2835_ISP_LENS_SHADING
++ *				     ctrl.
++ *
++ * @enabled:		Enable lens shading.
++ * @grid_cell_size:	Size of grid cells in samples (16, 32, 64, 128 or 256).
++ * @grid_width:		Width of lens shading tables in grid cells.
++ * @grid_stride:	Row to row distance (in grid cells) between grid cells
++ *			in the same horizontal location.
++ * @grid_height:	Height of lens shading tables in grid cells.
++ * @dmabuf:		dmabuf file handle containing the table.
++ * @ref_transform:	Reference transform - unsupported, please pass zero.
++ * @corner_sampled:	Whether the gains are sampled at the corner points
++ *			of the grid cells or in the cell centres.
++ * @gain_format:	Format of the gains (see enum &bcm2835_isp_gain_format).
++ */
++struct bcm2835_isp_lens_shading {
++	__u32 enabled;
++	__u32 grid_cell_size;
++	__u32 grid_width;
++	__u32 grid_stride;
++	__u32 grid_height;
++	__s32 dmabuf;
++	__u32 ref_transform;
++	__u32 corner_sampled;
++	__u32 gain_format;
++};
++
++/**
++ * struct bcm2835_isp_black_level - Sensor black level set with the
++ *				    V4L2_CID_USER_BCM2835_ISP_BLACK_LEVEL ctrl.
++ *
++ * @enabled:		Enable black level.
++ * @black_level_r:	Black level for red channel.
++ * @black_level_g:	Black level for green channels.
++ * @black_level_b:	Black level for blue channel.
++ */
++struct bcm2835_isp_black_level {
++	__u32 enabled;
++	__u16 black_level_r;
++	__u16 black_level_g;
++	__u16 black_level_b;
++	__u8 padding[2]; /* Unused */
++};
++
++/**
++ * struct bcm2835_isp_geq - Green equalisation parameters set with the
++ *			    V4L2_CID_USER_BCM2835_ISP_GEQ ctrl.
++ *
++ * @enabled:	Enable green equalisation.
++ * @offset:	Fixed offset of the green equalisation threshold.
++ * @slope:	Slope of the green equalisation threshold.
++ */
++struct bcm2835_isp_geq {
++	__u32 enabled;
++	__u32 offset;
++	struct bcm2835_isp_rational slope;
++};
++
++#define BCM2835_NUM_GAMMA_PTS 33
++
++/**
++ * struct bcm2835_isp_gamma - Gamma parameters set with the
++ *			      V4L2_CID_USER_BCM2835_ISP_GAMMA ctrl.
++ *
++ * @enabled:	Enable gamma adjustment.
++ * @X:		X values of the points defining the gamma curve.
++ *		Values should be scaled to 16 bits.
++ * @Y:		Y values of the points defining the gamma curve.
++ *		Values should be scaled to 16 bits.
++ */
++struct bcm2835_isp_gamma {
++	__u32 enabled;
++	__u16 x[BCM2835_NUM_GAMMA_PTS];
++	__u16 y[BCM2835_NUM_GAMMA_PTS];
++};
++
++/**
++ * struct bcm2835_isp_denoise - Denoise parameters set with the
++ *				V4L2_CID_USER_BCM2835_ISP_DENOISE ctrl.
++ *
++ * @enabled:	Enable denoise.
++ * @constant:	Fixed offset of the noise threshold.
++ * @slope:	Slope of the noise threshold.
++ * @strength:	Denoise strength between 0.0 (off) and 1.0 (maximum).
++ */
++struct bcm2835_isp_denoise {
++	__u32 enabled;
++	__u32 constant;
++	struct bcm2835_isp_rational slope;
++	struct bcm2835_isp_rational strength;
++};
++
++/**
++ * struct bcm2835_isp_sharpen - Sharpen parameters set with the
++ *				V4L2_CID_USER_BCM2835_ISP_SHARPEN ctrl.
++ *
++ * @enabled:	Enable sharpening.
++ * @threshold:	Threshold at which to start sharpening pixels.
++ * @strength:	Strength with which pixel sharpening increases.
++ * @limit:	Limit to the amount of sharpening applied.
++ */
++struct bcm2835_isp_sharpen {
++	__u32 enabled;
++	struct bcm2835_isp_rational threshold;
++	struct bcm2835_isp_rational strength;
++	struct bcm2835_isp_rational limit;
++};
++
++/**
++ * enum bcm2835_isp_dpc_mode - defective pixel correction (DPC) strength.
++ *
++ * @DPC_MODE_OFF:		No DPC.
++ * @DPC_MODE_NORMAL:		Normal DPC.
++ * @DPC_MODE_STRONG:		Strong DPC.
++ */
++enum bcm2835_isp_dpc_mode {
++	DPC_MODE_OFF = 0,
++	DPC_MODE_NORMAL = 1,
++	DPC_MODE_STRONG = 2,
++};
++
++/**
++ * struct bcm2835_isp_dpc - Defective pixel correction (DPC) parameters set
++ *			    with the V4L2_CID_USER_BCM2835_ISP_DPC ctrl.
++ *
++ * @enabled:	Enable DPC.
++ * @strength:	DPC strength (see enum &bcm2835_isp_dpc_mode).
++ */
++struct bcm2835_isp_dpc {
++	__u32 enabled;
++	__u32 strength;
++};
++
++/*
++ * ISP statistics structures.
++ *
++ * The bcm2835_isp_stats structure is generated at the output of the
++ * statistics node.  Note that this does not directly map onto the statistics
++ * output of the ISP HW.  Instead, the MMAL firmware code maps the HW statistics
++ * to the bcm2835_isp_stats structure.
++ */
++#define DEFAULT_AWB_REGIONS_X 16
++#define DEFAULT_AWB_REGIONS_Y 12
++
++#define NUM_HISTOGRAMS 2
++#define NUM_HISTOGRAM_BINS 128
++#define AWB_REGIONS (DEFAULT_AWB_REGIONS_X * DEFAULT_AWB_REGIONS_Y)
++#define FLOATING_REGIONS 16
++#define AGC_REGIONS 16
++#define FOCUS_REGIONS 12
++
++/**
++ * struct bcm2835_isp_stats_hist - Histogram statistics
++ *
++ * @r_hist:	Red channel histogram.
++ * @g_hist:	Combined green channel histogram.
++ * @b_hist:	Blue channel histogram.
++ */
++struct bcm2835_isp_stats_hist {
++	__u32 r_hist[NUM_HISTOGRAM_BINS];
++	__u32 g_hist[NUM_HISTOGRAM_BINS];
++	__u32 b_hist[NUM_HISTOGRAM_BINS];
++};
++
++/**
++ * struct bcm2835_isp_stats_region - Region sums.
++ *
++ * @counted:	The number of 2x2 bayer tiles accumulated.
++ * @notcounted:	The number of 2x2 bayer tiles not accumulated.
++ * @r_sum:	Total sum of counted pixels in the red channel for a region.
++ * @g_sum:	Total sum of counted pixels in the green channel for a region.
++ * @b_sum:	Total sum of counted pixels in the blue channel for a region.
++ */
++struct bcm2835_isp_stats_region {
++	__u32 counted;
++	__u32 notcounted;
++	__u64 r_sum;
++	__u64 g_sum;
++	__u64 b_sum;
++};
++
++/**
++ * struct bcm2835_isp_stats_focus - Focus statistics.
++ *
++ * @contrast_val:	Focus measure - accumulated output of the focus filter.
++ *			In the first dimension, index [0] counts pixels below a
++ *			preset threshold, and index [1] counts pixels above the
++ *			threshold.  In the second dimension, index [0] uses the
++ *			first predefined filter, and index [1] uses the second
++ *			predefined filter.
++ * @contrast_val_num:	The number of counted pixels in the above accumulation.
++ */
++struct bcm2835_isp_stats_focus {
++	__u64 contrast_val[2][2];
++	__u32 contrast_val_num[2][2];
++};
++
++/**
++ * struct bcm2835_isp_stats - ISP statistics.
++ *
++ * @version:		Version of the bcm2835_isp_stats structure.
++ * @size:		Size of the bcm2835_isp_stats structure.
++ * @hist:		Histogram statistics for the entire image.
++ * @awb_stats:		Statistics for the regions defined for AWB calculations.
++ * @floating_stats:	Statistics for arbitrarily placed (floating) regions.
++ * @agc_stats:		Statistics for the regions defined for AGC calculations.
++ * @focus_stats:	Focus filter statistics for the focus regions.
++ */
++struct bcm2835_isp_stats {
++	__u32 version;
++	__u32 size;
++	struct bcm2835_isp_stats_hist hist[NUM_HISTOGRAMS];
++	struct bcm2835_isp_stats_region awb_stats[AWB_REGIONS];
++	struct bcm2835_isp_stats_region floating_stats[FLOATING_REGIONS];
++	struct bcm2835_isp_stats_region agc_stats[AGC_REGIONS];
++	struct bcm2835_isp_stats_focus focus_stats[FOCUS_REGIONS];
++};
++
++#endif /* __BCM2835_ISP_H_ */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0280-staging-vc04_services-ISP-Add-a-more-complex-ISP-pro.patch b/target/linux/bcm27xx/patches-6.1/950-0280-staging-vc04_services-ISP-Add-a-more-complex-ISP-pro.patch
new file mode 100644
index 00000000000000..58c055b7375d2f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0280-staging-vc04_services-ISP-Add-a-more-complex-ISP-pro.patch
@@ -0,0 +1,2408 @@
+From cfa60cc9d644b8d12886332eceb7449e7397dff2 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Thu, 23 Apr 2020 10:17:37 +0100
+Subject: [PATCH] staging: vc04_services: ISP: Add a more complex ISP
+ processing component
+
+Driver for the BCM2835 ISP hardware block.  This driver uses the MMAL
+component to program the ISP hardware through the VC firmware.
+
+The ISP component can produce two video stream outputs, and Bayer
+image statistics. This can't be encompassed in a simple V4L2
+M2M device, so create a new device that registers 4 video nodes.
+
+This patch squashes all the development patches from the earlier
+rpi-5.4.y branch into one
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ MAINTAINERS                                   |    9 +
+ drivers/staging/vc04_services/Kconfig         |    1 +
+ drivers/staging/vc04_services/Makefile        |    1 +
+ .../staging/vc04_services/bcm2835-isp/Kconfig |   14 +
+ .../vc04_services/bcm2835-isp/Makefile        |    8 +
+ .../bcm2835-isp/bcm2835-isp-ctrls.h           |   67 +
+ .../bcm2835-isp/bcm2835-isp-fmts.h            |  353 ++++
+ .../bcm2835-isp/bcm2835-v4l2-isp.c            | 1696 +++++++++++++++++
+ .../vc04_services/vchiq-mmal/mmal-encodings.h |    4 +
+ .../vchiq-mmal/mmal-parameters.h              |  153 +-
+ 10 files changed, 2305 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/staging/vc04_services/bcm2835-isp/Kconfig
+ create mode 100644 drivers/staging/vc04_services/bcm2835-isp/Makefile
+ create mode 100644 drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-ctrls.h
+ create mode 100644 drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-fmts.h
+ create mode 100644 drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -4044,6 +4044,15 @@ S:	Maintained
+ F:	drivers/media/platform/bcm2835/
+ F:	Documentation/devicetree/bindings/media/brcm,bcm2835-unicam.yaml
+ 
++BROADCOM BCM2835 ISP DRIVER
++M:	Raspberry Pi Kernel Maintenance <kernel-list@raspberrypi.com>
++L:	linux-media@vger.kernel.org
++S:	Maintained
++F:	Documentation/media/uapi/v4l/pixfmt-meta-bcm2835-isp-stats.rst
++F:	Documentation/media/v4l-drivers/bcm2835-isp.rst
++F:	drivers/staging/vc04_services/bcm2835-isp
++F:	include/uapi/linux/bcm2835-isp.h
++
+ BROADCOM BCM47XX MIPS ARCHITECTURE
+ M:	Hauke Mehrtens <hauke@hauke-m.de>
+ M:	Rafał Miłecki <zajec5@gmail.com>
+--- a/drivers/staging/vc04_services/Kconfig
++++ b/drivers/staging/vc04_services/Kconfig
+@@ -46,6 +46,7 @@ source "drivers/staging/vc04_services/bc
+ 
+ source "drivers/staging/vc04_services/vc-sm-cma/Kconfig"
+ source "drivers/staging/vc04_services/bcm2835-codec/Kconfig"
++source "drivers/staging/vc04_services/bcm2835-isp/Kconfig"
+ 
+ source "drivers/staging/vc04_services/vchiq-mmal/Kconfig"
+ 
+--- a/drivers/staging/vc04_services/Makefile
++++ b/drivers/staging/vc04_services/Makefile
+@@ -16,6 +16,7 @@ obj-$(CONFIG_VIDEO_BCM2835)		+= bcm2835-
+ obj-$(CONFIG_BCM2835_VCHIQ_MMAL)	+= vchiq-mmal/
+ obj-$(CONFIG_BCM_VC_SM_CMA)		+= vc-sm-cma/
+ obj-$(CONFIG_VIDEO_CODEC_BCM2835)	+= bcm2835-codec/
++obj-$(CONFIG_VIDEO_ISP_BCM2835)		+= bcm2835-isp/
+ 
+ ccflags-y += -I $(srctree)/$(src)/include
+ 
+--- /dev/null
++++ b/drivers/staging/vc04_services/bcm2835-isp/Kconfig
+@@ -0,0 +1,14 @@
++config VIDEO_ISP_BCM2835
++	tristate "BCM2835 ISP support"
++	depends on MEDIA_SUPPORT
++	depends on VIDEO_DEV && (ARCH_BCM2835 || COMPILE_TEST)
++	depends on MEDIA_CONTROLLER
++	select BCM2835_VCHIQ_MMAL
++	select VIDEOBUF2_DMA_CONTIG
++	help
++	  This is the V4L2 driver for the Broadcom BCM2835 ISP hardware.
++	  This operates over the VCHIQ interface to a service running on
++	  VideoCore.
++
++	  To compile this driver as a module, choose M here: the module
++	  will be called bcm2835-isp.
+--- /dev/null
++++ b/drivers/staging/vc04_services/bcm2835-isp/Makefile
+@@ -0,0 +1,8 @@
++# SPDX-License-Identifier: GPL-2.0
++bcm2835-isp-objs := bcm2835-v4l2-isp.o
++
++obj-$(CONFIG_VIDEO_ISP_BCM2835) += bcm2835-isp.o
++
++ccflags-y += \
++	-I$(srctree)/drivers/staging/vc04_services \
++	-D__VCCOREVER__=0x04000000
+--- /dev/null
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-ctrls.h
+@@ -0,0 +1,67 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Broadcom BCM2835 ISP driver
++ *
++ * Copyright © 2019-2020 Raspberry Pi (Trading) Ltd.
++ *
++ * Author: Naushir Patuck (naush@raspberrypi.com)
++ *
++ */
++
++#ifndef BCM2835_ISP_CTRLS
++#define BCM2835_ISP_CTRLS
++
++#include <linux/bcm2835-isp.h>
++
++struct bcm2835_isp_custom_ctrl {
++	const char *name;
++	u32 id;
++	u32 size;
++	u32 flags;
++};
++
++static const struct bcm2835_isp_custom_ctrl custom_ctrls[] = {
++	{
++		.name	= "Colour Correction Matrix",
++		.id	= V4L2_CID_USER_BCM2835_ISP_CC_MATRIX,
++		.size	= sizeof(struct bcm2835_isp_custom_ccm),
++		.flags  = 0
++	}, {
++		.name	= "Lens Shading",
++		.id	= V4L2_CID_USER_BCM2835_ISP_LENS_SHADING,
++		.size	= sizeof(struct bcm2835_isp_lens_shading),
++		.flags  = V4L2_CTRL_FLAG_EXECUTE_ON_WRITE
++	}, {
++		.name	= "Black Level",
++		.id	= V4L2_CID_USER_BCM2835_ISP_BLACK_LEVEL,
++		.size	= sizeof(struct bcm2835_isp_black_level),
++		.flags  = 0
++	}, {
++		.name	= "Green Equalisation",
++		.id	= V4L2_CID_USER_BCM2835_ISP_GEQ,
++		.size	= sizeof(struct bcm2835_isp_geq),
++		.flags  = 0
++	}, {
++		.name	= "Gamma",
++		.id	= V4L2_CID_USER_BCM2835_ISP_GAMMA,
++		.size	= sizeof(struct bcm2835_isp_gamma),
++		.flags  = 0
++	}, {
++		.name	= "Sharpen",
++		.id	= V4L2_CID_USER_BCM2835_ISP_SHARPEN,
++		.size	= sizeof(struct bcm2835_isp_sharpen),
++		.flags  = 0
++	}, {
++		.name	= "Denoise",
++		.id	= V4L2_CID_USER_BCM2835_ISP_DENOISE,
++		.size	= sizeof(struct bcm2835_isp_denoise),
++		.flags  = 0
++	}, {
++		.name	= "Defective Pixel Correction",
++		.id	= V4L2_CID_USER_BCM2835_ISP_DPC,
++		.size	= sizeof(struct bcm2835_isp_dpc),
++		.flags  = 0
++	}
++};
++
++#endif
+--- /dev/null
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-fmts.h
+@@ -0,0 +1,353 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Broadcom BCM2835 ISP driver
++ *
++ * Copyright © 2019-2020 Raspberry Pi (Trading) Ltd.
++ *
++ * Author: Naushir Patuck (naush@raspberrypi.com)
++ *
++ */
++
++#ifndef BCM2835_ISP_FMTS
++#define BCM2835_ISP_FMTS
++
++#include <linux/videodev2.h>
++#include "vchiq-mmal/mmal-encodings.h"
++
++struct bcm2835_isp_fmt {
++	u32 fourcc;
++	int depth;
++	int bytesperline_align;
++	u32 mmal_fmt;
++	int size_multiplier_x2;
++	enum v4l2_colorspace colorspace;
++	unsigned int step_size;
++};
++
++static const struct bcm2835_isp_fmt supported_formats[] = {
++	{
++		/* YUV formats */
++		.fourcc		    = V4L2_PIX_FMT_YUV420,
++		.depth		    = 8,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_I420,
++		.size_multiplier_x2 = 3,
++		.colorspace	    = V4L2_COLORSPACE_SMPTE170M,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_YVU420,
++		.depth		    = 8,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_YV12,
++		.size_multiplier_x2 = 3,
++		.colorspace	    = V4L2_COLORSPACE_SMPTE170M,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_NV12,
++		.depth		    = 8,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_NV12,
++		.size_multiplier_x2 = 3,
++		.colorspace	    = V4L2_COLORSPACE_SMPTE170M,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_NV21,
++		.depth		    = 8,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_NV21,
++		.size_multiplier_x2 = 3,
++		.colorspace	    = V4L2_COLORSPACE_SMPTE170M,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_YUYV,
++		.depth		    = 16,
++		.bytesperline_align = 64,
++		.mmal_fmt	    = MMAL_ENCODING_YUYV,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_SMPTE170M,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_UYVY,
++		.depth		    = 16,
++		.bytesperline_align = 64,
++		.mmal_fmt	    = MMAL_ENCODING_UYVY,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_SMPTE170M,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_YVYU,
++		.depth		    = 16,
++		.bytesperline_align = 64,
++		.mmal_fmt	    = MMAL_ENCODING_YVYU,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_SMPTE170M,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_VYUY,
++		.depth		    = 16,
++		.bytesperline_align = 64,
++		.mmal_fmt	    = MMAL_ENCODING_VYUY,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_SMPTE170M,
++		.step_size	    = 2,
++	}, {
++		/* RGB formats */
++		.fourcc		    = V4L2_PIX_FMT_RGB24,
++		.depth		    = 24,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_RGB24,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_SRGB,
++		.step_size	    = 1,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_RGB565,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_RGB16,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_SRGB,
++		.step_size	    = 1,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_BGR24,
++		.depth		    = 24,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BGR24,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_SRGB,
++		.step_size	    = 1,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_XBGR32,
++		.depth		    = 32,
++		.bytesperline_align = 64,
++		.mmal_fmt	    = MMAL_ENCODING_BGRA,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_SRGB,
++		.step_size	    = 1,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_RGBX32,
++		.depth		    = 32,
++		.bytesperline_align = 64,
++		.mmal_fmt	    = MMAL_ENCODING_RGBA,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_SRGB,
++		.step_size	    = 1,
++	}, {
++		/* Bayer formats */
++		/* 8 bit */
++		.fourcc		    = V4L2_PIX_FMT_SRGGB8,
++		.depth		    = 8,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB8,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SBGGR8,
++		.depth		    = 8,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR8,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGRBG8,
++		.depth		    = 8,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG8,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGBRG8,
++		.depth		    = 8,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG8,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 10 bit */
++		.fourcc		    = V4L2_PIX_FMT_SRGGB10P,
++		.depth		    = 10,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB10P,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SBGGR10P,
++		.depth		    = 10,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR10P,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGRBG10P,
++		.depth		    = 10,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG10P,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGBRG10P,
++		.depth		    = 10,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG10P,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 12 bit */
++		.fourcc		    = V4L2_PIX_FMT_SRGGB12P,
++		.depth		    = 12,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB12P,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SBGGR12P,
++		.depth		    = 12,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR12P,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGRBG12P,
++		.depth		    = 12,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG12P,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGBRG12P,
++		.depth		    = 12,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG12P,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 14 bit */
++		.fourcc		    = V4L2_PIX_FMT_SRGGB14P,
++		.depth		    = 14,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB14P,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SBGGR14P,
++		.depth		    = 14,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR14P,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGRBG14P,
++		.depth		    = 14,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG14P,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGBRG14P,
++		.depth		    = 14,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG14P,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 16 bit */
++		.fourcc		    = V4L2_PIX_FMT_SRGGB16,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB16,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SBGGR16,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR16,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGRBG16,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG16,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGBRG16,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG16,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* Monochrome MIPI formats */
++		/* 8 bit */
++		.fourcc		    = V4L2_PIX_FMT_GREY,
++		.depth		    = 8,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_GREY,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 10 bit */
++		.fourcc		    = V4L2_PIX_FMT_Y10P,
++		.depth		    = 10,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_Y10P,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 12 bit */
++		.fourcc		    = V4L2_PIX_FMT_Y12P,
++		.depth		    = 12,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_Y12P,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 14 bit */
++		.fourcc		    = V4L2_PIX_FMT_Y14P,
++		.depth		    = 14,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_Y14P,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 16 bit */
++		.fourcc		    = V4L2_PIX_FMT_Y16,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_Y16,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_META_FMT_BCM2835_ISP_STATS,
++		.mmal_fmt	    = MMAL_ENCODING_BRCM_STATS,
++		/* The rest are not valid fields for stats. */
++	}
++};
++
++#endif
+--- /dev/null
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
+@@ -0,0 +1,1696 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Broadcom BCM2835 ISP driver
++ *
++ * Copyright © 2019-2020 Raspberry Pi (Trading) Ltd.
++ *
++ * Author: Naushir Patuck (naush@raspberrypi.com)
++ *
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-ioctl.h>
++#include <media/videobuf2-dma-contig.h>
++
++#include "vchiq-mmal/mmal-msg.h"
++#include "vchiq-mmal/mmal-parameters.h"
++#include "vchiq-mmal/mmal-vchiq.h"
++
++#include "vc-sm-cma/vc_sm_knl.h"
++
++#include "bcm2835-isp-ctrls.h"
++#include "bcm2835-isp-fmts.h"
++
++MODULE_IMPORT_NS(DMA_BUF);
++
++static unsigned int debug;
++module_param(debug, uint, 0644);
++MODULE_PARM_DESC(debug, "activates debug info");
++
++static unsigned int video_nr = 13;
++module_param(video_nr, uint, 0644);
++MODULE_PARM_DESC(video_nr, "base video device number");
++
++#define BCM2835_ISP_NAME "bcm2835-isp"
++#define BCM2835_ISP_ENTITY_NAME_LEN 32
++
++#define BCM2835_ISP_NUM_OUTPUTS 1
++#define BCM2835_ISP_NUM_CAPTURES 2
++#define BCM2835_ISP_NUM_METADATA 1
++
++#define BCM2835_ISP_NUM_NODES						\
++		(BCM2835_ISP_NUM_OUTPUTS + BCM2835_ISP_NUM_CAPTURES +	\
++		 BCM2835_ISP_NUM_METADATA)
++
++/* Default frame dimension of 1280 pixels. */
++#define DEFAULT_DIM 1280U
++/*
++ * Maximum frame dimension of 16384 pixels.  Even though the ISP runs in tiles,
++ * have a sensible limit so that we do not create an excessive number of tiles
++ * to process.
++ */
++#define MAX_DIM 16384U
++/*
++ * Minimum frame dimension of 64 pixels.  Anything lower, and the tiling
++ * algorithm may not be able to cope when applying filter context.
++ */
++#define MIN_DIM 64U
++
++/* Timeout for stop_streaming to allow all buffers to return */
++#define COMPLETE_TIMEOUT (2 * HZ)
++
++/* Per-queue, driver-specific private data */
++struct bcm2835_isp_q_data {
++	/*
++	 * These parameters should be treated as gospel, with everything else
++	 * being determined from them.
++	 */
++	unsigned int bytesperline;
++	unsigned int width;
++	unsigned int height;
++	unsigned int sizeimage;
++	const struct bcm2835_isp_fmt *fmt;
++};
++
++/*
++ * Structure to describe a single node /dev/video<N> which represents a single
++ * input or output queue to the ISP device.
++ */
++struct bcm2835_isp_node {
++	int vfl_dir;
++	unsigned int id;
++	const char *name;
++	struct vchiq_mmal_port *port;
++	struct video_device vfd;
++	struct media_pad pad;
++	struct media_intf_devnode *intf_devnode;
++	struct media_link *intf_link;
++	struct mutex lock; /* top level device node lock */
++	struct mutex queue_lock;
++
++	struct vb2_queue queue;
++	unsigned int sequence;
++
++	/* The list of formats supported on the node. */
++	struct bcm2835_isp_fmt const **supported_fmts;
++	unsigned int num_supported_fmts;
++
++	struct bcm2835_isp_q_data q_data;
++
++	/* Parent device structure */
++	struct bcm2835_isp_dev *dev;
++
++	bool registered;
++	bool media_node_registered;
++};
++
++/*
++ * Structure representing the entire ISP device, comprising several input and
++ * output nodes /dev/video<N>.
++ */
++struct bcm2835_isp_dev {
++	struct v4l2_device v4l2_dev;
++	struct device *dev;
++	struct v4l2_ctrl_handler ctrl_handler;
++	struct media_device mdev;
++	struct media_entity entity;
++	bool media_device_registered;
++	bool media_entity_registered;
++	struct vchiq_mmal_instance *mmal_instance;
++	struct vchiq_mmal_component *component;
++	struct completion frame_cmplt;
++
++	struct bcm2835_isp_node node[BCM2835_ISP_NUM_NODES];
++	struct media_pad pad[BCM2835_ISP_NUM_NODES];
++	atomic_t num_streaming;
++
++	/* Image pipeline controls. */
++	int r_gain;
++	int b_gain;
++};
++
++struct bcm2835_isp_buffer {
++	struct vb2_v4l2_buffer vb;
++	struct mmal_buffer mmal;
++};
++
++static
++inline struct bcm2835_isp_dev *node_get_dev(struct bcm2835_isp_node *node)
++{
++	return node->dev;
++}
++
++static inline bool node_is_output(struct bcm2835_isp_node *node)
++{
++	return node->queue.type == V4L2_BUF_TYPE_VIDEO_OUTPUT;
++}
++
++static inline bool node_is_capture(struct bcm2835_isp_node *node)
++{
++	return node->queue.type == V4L2_BUF_TYPE_VIDEO_CAPTURE;
++}
++
++static inline bool node_is_stats(struct bcm2835_isp_node *node)
++{
++	return node->queue.type == V4L2_BUF_TYPE_META_CAPTURE;
++}
++
++static inline enum v4l2_buf_type index_to_queue_type(int index)
++{
++	if (index < BCM2835_ISP_NUM_OUTPUTS)
++		return V4L2_BUF_TYPE_VIDEO_OUTPUT;
++	else if (index < BCM2835_ISP_NUM_OUTPUTS + BCM2835_ISP_NUM_CAPTURES)
++		return V4L2_BUF_TYPE_VIDEO_CAPTURE;
++	else
++		return V4L2_BUF_TYPE_META_CAPTURE;
++}
++
++static int set_isp_param(struct bcm2835_isp_node *node, u32 parameter,
++			 void *value, u32 value_size)
++{
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++
++	return vchiq_mmal_port_parameter_set(dev->mmal_instance, node->port,
++					     parameter, value, value_size);
++}
++
++static int set_wb_gains(struct bcm2835_isp_node *node)
++{
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	struct mmal_parameter_awbgains gains = {
++		.r_gain = { dev->r_gain, 1000 },
++		.b_gain = { dev->b_gain, 1000 }
++	};
++
++	return set_isp_param(node, MMAL_PARAMETER_CUSTOM_AWB_GAINS,
++			     &gains, sizeof(gains));
++}
++
++static int set_digital_gain(struct bcm2835_isp_node *node, uint32_t gain)
++{
++	struct s32_fract digital_gain = {
++		.numerator = gain,
++		.denominator = 1000
++	};
++
++	return set_isp_param(node, MMAL_PARAMETER_DIGITAL_GAIN,
++			     &digital_gain, sizeof(digital_gain));
++}
++
++static const struct bcm2835_isp_fmt *get_fmt(u32 mmal_fmt)
++{
++	unsigned int i;
++
++	for (i = 0; i < ARRAY_SIZE(supported_formats); i++) {
++		if (supported_formats[i].mmal_fmt == mmal_fmt)
++			return &supported_formats[i];
++	}
++	return NULL;
++}
++
++static const
++struct bcm2835_isp_fmt *find_format_by_fourcc(unsigned int fourcc,
++					      struct bcm2835_isp_node *node)
++{
++	const struct bcm2835_isp_fmt *fmt;
++	unsigned int i;
++
++	for (i = 0; i < node->num_supported_fmts; i++) {
++		fmt = node->supported_fmts[i];
++		if (fmt->fourcc == fourcc)
++			return fmt;
++	}
++
++	return NULL;
++}
++
++static const
++struct bcm2835_isp_fmt *find_format(struct v4l2_format *f,
++				    struct bcm2835_isp_node *node)
++{
++	return find_format_by_fourcc(node_is_stats(node) ?
++				     f->fmt.meta.dataformat :
++				     f->fmt.pix.pixelformat,
++				     node);
++}
++
++/* vb2_to_mmal_buffer() - converts vb2 buffer header to MMAL
++ *
++ * Copies all the required fields from a VB2 buffer to the MMAL buffer header,
++ * ready for sending to the VPU.
++ */
++static void vb2_to_mmal_buffer(struct mmal_buffer *buf,
++			       struct vb2_v4l2_buffer *vb2)
++{
++	u64 pts;
++
++	buf->mmal_flags = 0;
++	if (vb2->flags & V4L2_BUF_FLAG_KEYFRAME)
++		buf->mmal_flags |= MMAL_BUFFER_HEADER_FLAG_KEYFRAME;
++
++	/* Data must be framed correctly as one frame per buffer. */
++	buf->mmal_flags |= MMAL_BUFFER_HEADER_FLAG_FRAME_END;
++
++	buf->length = vb2->vb2_buf.planes[0].bytesused;
++	/*
++	 * Minor ambiguity in the V4L2 spec as to whether passing in a 0 length
++	 * buffer, or one with V4L2_BUF_FLAG_LAST set denotes end of stream.
++	 * Handle either.
++	 */
++	if (!buf->length || vb2->flags & V4L2_BUF_FLAG_LAST)
++		buf->mmal_flags |= MMAL_BUFFER_HEADER_FLAG_EOS;
++
++	/* vb2 timestamps in nsecs, mmal in usecs */
++	pts = vb2->vb2_buf.timestamp;
++	do_div(pts, 1000);
++	buf->pts = pts;
++	buf->dts = MMAL_TIME_UNKNOWN;
++}
++
++static void mmal_buffer_cb(struct vchiq_mmal_instance *instance,
++			   struct vchiq_mmal_port *port, int status,
++			   struct mmal_buffer *mmal_buf)
++{
++	struct bcm2835_isp_buffer *q_buf;
++	struct bcm2835_isp_node *node = port->cb_ctx;
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	struct vb2_v4l2_buffer *vb2;
++
++	q_buf = container_of(mmal_buf, struct bcm2835_isp_buffer, mmal);
++	vb2 = &q_buf->vb;
++	v4l2_dbg(2, debug, &dev->v4l2_dev,
++		 "%s: port:%s[%d], status:%d, buf:%p, dmabuf:%p, length:%lu, flags %u, pts %lld\n",
++		 __func__, node_is_output(node) ? "input" : "output", node->id,
++		 status, mmal_buf, mmal_buf->dma_buf, mmal_buf->length,
++		 mmal_buf->mmal_flags, mmal_buf->pts);
++
++	if (mmal_buf->cmd)
++		v4l2_err(&dev->v4l2_dev,
++			 "%s: Unexpected event on output callback - %08x\n",
++			 __func__, mmal_buf->cmd);
++
++	if (status) {
++		/* error in transfer */
++		if (vb2) {
++			/* there was a buffer with the error so return it */
++			vb2_buffer_done(&vb2->vb2_buf, VB2_BUF_STATE_ERROR);
++		}
++		return;
++	}
++
++	/* vb2 timestamps in nsecs, mmal in usecs */
++	vb2->vb2_buf.timestamp = mmal_buf->pts * 1000;
++	vb2->sequence = node->sequence++;
++	vb2_set_plane_payload(&vb2->vb2_buf, 0, mmal_buf->length);
++	vb2_buffer_done(&vb2->vb2_buf, VB2_BUF_STATE_DONE);
++
++	if (!port->enabled)
++		complete(&dev->frame_cmplt);
++}
++
++static void setup_mmal_port_format(struct bcm2835_isp_node *node,
++				   struct vchiq_mmal_port *port)
++{
++	struct bcm2835_isp_q_data *q_data = &node->q_data;
++
++	port->format.encoding = q_data->fmt->mmal_fmt;
++	/* Raw image format - set width/height */
++	port->es.video.width = (q_data->bytesperline << 3) / q_data->fmt->depth;
++	port->es.video.height = q_data->height;
++	port->es.video.crop.width = q_data->width;
++	port->es.video.crop.height = q_data->height;
++	port->es.video.crop.x = 0;
++	port->es.video.crop.y = 0;
++};
++
++static int setup_mmal_port(struct bcm2835_isp_node *node)
++{
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	unsigned int enable = 1;
++	int ret;
++
++	v4l2_dbg(2, debug, &dev->v4l2_dev, "%s: setup %s[%d]\n", __func__,
++		 node->name, node->id);
++
++	vchiq_mmal_port_parameter_set(dev->mmal_instance, node->port,
++				      MMAL_PARAMETER_ZERO_COPY, &enable,
++				      sizeof(enable));
++	setup_mmal_port_format(node, node->port);
++	ret = vchiq_mmal_port_set_format(dev->mmal_instance, node->port);
++	if (ret < 0) {
++		v4l2_dbg(1, debug, &dev->v4l2_dev,
++			 "%s: vchiq_mmal_port_set_format failed\n",
++			 __func__);
++		return ret;
++	}
++
++	if (node->q_data.sizeimage < node->port->minimum_buffer.size) {
++		v4l2_err(&dev->v4l2_dev,
++			 "buffer size mismatch sizeimage %u < min size %u\n",
++			 node->q_data.sizeimage,
++			 node->port->minimum_buffer.size);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static int bcm2835_isp_mmal_buf_cleanup(struct mmal_buffer *mmal_buf)
++{
++	mmal_vchi_buffer_cleanup(mmal_buf);
++
++	if (mmal_buf->dma_buf) {
++		dma_buf_put(mmal_buf->dma_buf);
++		mmal_buf->dma_buf = NULL;
++	}
++
++	return 0;
++}
++
++static int bcm2835_isp_node_queue_setup(struct vb2_queue *q,
++					unsigned int *nbuffers,
++					unsigned int *nplanes,
++					unsigned int sizes[],
++					struct device *alloc_devs[])
++{
++	struct bcm2835_isp_node *node = vb2_get_drv_priv(q);
++	unsigned int size;
++
++	if (setup_mmal_port(node))
++		return -EINVAL;
++
++	size = node->q_data.sizeimage;
++	if (size == 0) {
++		v4l2_info(&node_get_dev(node)->v4l2_dev,
++			  "%s: Image size unset in queue_setup for node %s[%d]\n",
++			  __func__, node->name, node->id);
++		return -EINVAL;
++	}
++
++	if (*nplanes)
++		return sizes[0] < size ? -EINVAL : 0;
++
++	*nplanes = 1;
++	sizes[0] = size;
++
++	node->port->current_buffer.size = size;
++
++	if (*nbuffers < node->port->minimum_buffer.num)
++		*nbuffers = node->port->minimum_buffer.num;
++
++	node->port->current_buffer.num = *nbuffers;
++
++	v4l2_dbg(2, debug, &node_get_dev(node)->v4l2_dev,
++		 "%s: Image size %u, nbuffers %u for node %s[%d]\n",
++		 __func__, sizes[0], *nbuffers, node->name, node->id);
++	return 0;
++}
++
++static int bcm2835_isp_buf_init(struct vb2_buffer *vb)
++{
++	struct bcm2835_isp_node *node = vb2_get_drv_priv(vb->vb2_queue);
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	struct vb2_v4l2_buffer *vb2 = to_vb2_v4l2_buffer(vb);
++	struct bcm2835_isp_buffer *buf =
++		container_of(vb2, struct bcm2835_isp_buffer, vb);
++
++	v4l2_dbg(3, debug, &dev->v4l2_dev, "%s: vb %p\n", __func__, vb);
++
++	buf->mmal.buffer = vb2_plane_vaddr(&buf->vb.vb2_buf, 0);
++	buf->mmal.buffer_size = vb2_plane_size(&buf->vb.vb2_buf, 0);
++	mmal_vchi_buffer_init(dev->mmal_instance, &buf->mmal);
++	return 0;
++}
++
++static int bcm2835_isp_buf_prepare(struct vb2_buffer *vb)
++{
++	struct bcm2835_isp_node *node = vb2_get_drv_priv(vb->vb2_queue);
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	struct vb2_v4l2_buffer *vb2 = to_vb2_v4l2_buffer(vb);
++	struct bcm2835_isp_buffer *buf =
++		container_of(vb2, struct bcm2835_isp_buffer, vb);
++	struct dma_buf *dma_buf;
++	int ret;
++
++	v4l2_dbg(3, debug, &dev->v4l2_dev, "%s: type: %d ptr %p\n",
++		 __func__, vb->vb2_queue->type, vb);
++
++	if (V4L2_TYPE_IS_OUTPUT(vb->vb2_queue->type)) {
++		if (vb2->field == V4L2_FIELD_ANY)
++			vb2->field = V4L2_FIELD_NONE;
++		if (vb2->field != V4L2_FIELD_NONE) {
++			v4l2_err(&dev->v4l2_dev,
++				 "%s field isn't supported\n", __func__);
++			return -EINVAL;
++		}
++	}
++
++	if (vb2_plane_size(vb, 0) < node->q_data.sizeimage) {
++		v4l2_err(&dev->v4l2_dev,
++			 "%s data will not fit into plane (%lu < %lu)\n",
++			 __func__, vb2_plane_size(vb, 0),
++			 (long)node->q_data.sizeimage);
++		return -EINVAL;
++	}
++
++	if (!V4L2_TYPE_IS_OUTPUT(vb->vb2_queue->type))
++		vb2_set_plane_payload(vb, 0, node->q_data.sizeimage);
++
++	switch (vb->memory) {
++	case VB2_MEMORY_DMABUF:
++		dma_buf = dma_buf_get(vb->planes[0].m.fd);
++
++		if (dma_buf != buf->mmal.dma_buf) {
++			/*
++			 * dmabuf either hasn't already been mapped, or it has
++			 * changed.
++			 */
++			if (buf->mmal.dma_buf) {
++				v4l2_err(&dev->v4l2_dev,
++					 "%s Buffer changed - why did the core not call cleanup?\n",
++					 __func__);
++				bcm2835_isp_mmal_buf_cleanup(&buf->mmal);
++			}
++
++			buf->mmal.dma_buf = dma_buf;
++		} else {
++			/*
++			 * Already have a reference to the buffer, so release it
++			 * here.
++			 */
++			dma_buf_put(dma_buf);
++		}
++		ret = 0;
++		break;
++	case VB2_MEMORY_MMAP:
++		/*
++		 * We want to do this at init, but vb2_core_expbuf checks that
++		 * the index < q->num_buffers, and q->num_buffers only gets
++		 * updated once all the buffers are allocated.
++		 */
++		if (!buf->mmal.dma_buf) {
++			ret = vb2_core_expbuf_dmabuf(vb->vb2_queue,
++						     vb->vb2_queue->type,
++						     vb->index, 0, O_CLOEXEC,
++						     &buf->mmal.dma_buf);
++			v4l2_dbg(3, debug, &dev->v4l2_dev,
++				 "%s: exporting ptr %p to dmabuf %p\n",
++				 __func__, vb, buf->mmal.dma_buf);
++			if (ret)
++				v4l2_err(&dev->v4l2_dev,
++					 "%s: Failed to expbuf idx %d, ret %d\n",
++					 __func__, vb->index, ret);
++		} else {
++			ret = 0;
++		}
++		break;
++	default:
++		ret = -EINVAL;
++		break;
++	}
++
++	return ret;
++}
++
++static void bcm2835_isp_node_buffer_queue(struct vb2_buffer *buf)
++{
++	struct bcm2835_isp_node *node = vb2_get_drv_priv(buf->vb2_queue);
++	struct vb2_v4l2_buffer *vbuf =
++		container_of(buf, struct vb2_v4l2_buffer, vb2_buf);
++	struct bcm2835_isp_buffer *buffer =
++		container_of(vbuf, struct bcm2835_isp_buffer, vb);
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++
++	v4l2_dbg(3, debug, &dev->v4l2_dev, "%s: node %s[%d], buffer %p\n",
++		 __func__, node->name, node->id, buffer);
++
++	vb2_to_mmal_buffer(&buffer->mmal, &buffer->vb);
++	v4l2_dbg(3, debug, &dev->v4l2_dev,
++		 "%s: node %s[%d] - submitting  mmal dmabuf %p\n", __func__,
++		 node->name, node->id, buffer->mmal.dma_buf);
++	vchiq_mmal_submit_buffer(dev->mmal_instance, node->port, &buffer->mmal);
++}
++
++static void bcm2835_isp_buffer_cleanup(struct vb2_buffer *vb)
++{
++	struct vb2_v4l2_buffer *vb2 = to_vb2_v4l2_buffer(vb);
++	struct bcm2835_isp_buffer *buffer =
++		container_of(vb2, struct bcm2835_isp_buffer, vb);
++
++	bcm2835_isp_mmal_buf_cleanup(&buffer->mmal);
++}
++
++static int bcm2835_isp_node_start_streaming(struct vb2_queue *q,
++					    unsigned int count)
++{
++	struct bcm2835_isp_node *node = vb2_get_drv_priv(q);
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	int ret;
++
++	v4l2_dbg(1, debug, &dev->v4l2_dev, "%s: node %s[%d] (count %u)\n",
++		 __func__, node->name, node->id, count);
++
++	ret = vchiq_mmal_component_enable(dev->mmal_instance, dev->component);
++	if (ret) {
++		v4l2_err(&dev->v4l2_dev, "%s: Failed enabling component, ret %d\n",
++			 __func__, ret);
++		return -EIO;
++	}
++
++	node->sequence = 0;
++	node->port->cb_ctx = node;
++	ret = vchiq_mmal_port_enable(dev->mmal_instance, node->port,
++				     mmal_buffer_cb);
++	if (!ret)
++		atomic_inc(&dev->num_streaming);
++	else
++		v4l2_err(&dev->v4l2_dev,
++			 "%s: Failed enabling port, ret %d\n", __func__, ret);
++
++	return ret;
++}
++
++static void bcm2835_isp_node_stop_streaming(struct vb2_queue *q)
++{
++	struct bcm2835_isp_node *node = vb2_get_drv_priv(q);
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	unsigned int i;
++	int ret;
++
++	v4l2_dbg(1, debug, &dev->v4l2_dev, "%s: node %s[%d], mmal port %p\n",
++		 __func__, node->name, node->id, node->port);
++
++	init_completion(&dev->frame_cmplt);
++
++	/* Disable MMAL port - this will flush buffers back */
++	ret = vchiq_mmal_port_disable(dev->mmal_instance, node->port);
++	if (ret)
++		v4l2_err(&dev->v4l2_dev,
++			 "%s: Failed disabling %s port, ret %d\n", __func__,
++			 node_is_output(node) ? "i/p" : "o/p",
++			 ret);
++
++	while (atomic_read(&node->port->buffers_with_vpu)) {
++		v4l2_dbg(1, debug, &dev->v4l2_dev,
++			 "%s: Waiting for buffers to be returned - %d outstanding\n",
++			 __func__, atomic_read(&node->port->buffers_with_vpu));
++		ret = wait_for_completion_timeout(&dev->frame_cmplt,
++						  COMPLETE_TIMEOUT);
++		if (ret <= 0) {
++			v4l2_err(&dev->v4l2_dev,
++				 "%s: Timeout waiting for buffers to be returned - %d outstanding\n",
++				 __func__,
++				 atomic_read(&node->port->buffers_with_vpu));
++			break;
++		}
++	}
++
++	/* Release the VCSM handle here to release the associated dmabuf */
++	for (i = 0; i < q->num_buffers; i++) {
++		struct vb2_v4l2_buffer *vb2 = to_vb2_v4l2_buffer(q->bufs[i]);
++		struct bcm2835_isp_buffer *buf =
++			container_of(vb2, struct bcm2835_isp_buffer, vb);
++		bcm2835_isp_mmal_buf_cleanup(&buf->mmal);
++	}
++
++	atomic_dec(&dev->num_streaming);
++	/* If all ports disabled, then disable the component */
++	if (atomic_read(&dev->num_streaming) == 0) {
++		ret = vchiq_mmal_component_disable(dev->mmal_instance,
++						   dev->component);
++		if (ret) {
++			v4l2_err(&dev->v4l2_dev,
++				 "%s: Failed disabling component, ret %d\n",
++				 __func__, ret);
++		}
++	}
++
++	/*
++	 * Simply wait for any vb2 buffers to finish. We could take steps to
++	 * make them complete more quickly if we care, or even return them
++	 * ourselves.
++	 */
++	vb2_wait_for_all_buffers(&node->queue);
++}
++
++static const struct vb2_ops bcm2835_isp_node_queue_ops = {
++	.queue_setup		= bcm2835_isp_node_queue_setup,
++	.buf_init		= bcm2835_isp_buf_init,
++	.buf_prepare		= bcm2835_isp_buf_prepare,
++	.buf_queue		= bcm2835_isp_node_buffer_queue,
++	.buf_cleanup		= bcm2835_isp_buffer_cleanup,
++	.start_streaming	= bcm2835_isp_node_start_streaming,
++	.stop_streaming		= bcm2835_isp_node_stop_streaming,
++};
++
++static const
++struct bcm2835_isp_fmt *get_default_format(struct bcm2835_isp_node *node)
++{
++	return node->supported_fmts[0];
++}
++
++static inline unsigned int get_bytesperline(int width,
++					    const struct bcm2835_isp_fmt *fmt)
++{
++	/* GPU aligns 24bpp images to a multiple of 32 pixels (not bytes). */
++	if (fmt->depth == 24)
++		return ALIGN(width, 32) * 3;
++	else
++		return ALIGN((width * fmt->depth) >> 3, fmt->bytesperline_align);
++}
++
++static inline unsigned int get_sizeimage(int bpl, int width, int height,
++					 const struct bcm2835_isp_fmt *fmt)
++{
++	return (bpl * height * fmt->size_multiplier_x2) >> 1;
++}
++
++static int bcm2835_isp_s_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct bcm2835_isp_dev *dev =
++	      container_of(ctrl->handler, struct bcm2835_isp_dev, ctrl_handler);
++	struct bcm2835_isp_node *node = &dev->node[0];
++	int ret = 0;
++
++	/*
++	 * The ISP firmware driver will ensure these settings are applied on
++	 * a frame boundary, so we are safe to write them as they come in.
++	 *
++	 * Note that the bcm2835_isp_* param structures are identical to the
++	 * mmal-parameters.h definitions.  This avoids the need for unnecessary
++	 * field-by-field copying between structures.
++	 */
++	switch (ctrl->id) {
++	case V4L2_CID_RED_BALANCE:
++		dev->r_gain = ctrl->val;
++		ret = set_wb_gains(node);
++		break;
++	case V4L2_CID_BLUE_BALANCE:
++		dev->b_gain = ctrl->val;
++		ret = set_wb_gains(node);
++		break;
++	case V4L2_CID_DIGITAL_GAIN:
++		ret = set_digital_gain(node, ctrl->val);
++		break;
++	case V4L2_CID_USER_BCM2835_ISP_CC_MATRIX:
++		ret = set_isp_param(node, MMAL_PARAMETER_CUSTOM_CCM,
++				    ctrl->p_new.p_u8,
++				    sizeof(struct bcm2835_isp_custom_ccm));
++		break;
++	case V4L2_CID_USER_BCM2835_ISP_LENS_SHADING:
++	{
++		struct bcm2835_isp_lens_shading *v4l2_ls;
++		struct mmal_parameter_lens_shading_v2 ls;
++		struct dma_buf *dmabuf;
++		void *vcsm_handle;
++
++		v4l2_ls = (struct bcm2835_isp_lens_shading *)ctrl->p_new.p_u8;
++		/*
++		 * struct bcm2835_isp_lens_shading and struct
++		 * mmal_parameter_lens_shading_v2 match so that we can do a
++		 * simple memcpy here.
++		 * Only the dmabuf to the actual table needs any manipulation.
++		 */
++		memcpy(&ls, v4l2_ls, sizeof(ls));
++
++		dmabuf = dma_buf_get(v4l2_ls->dmabuf);
++		if (IS_ERR_OR_NULL(dmabuf))
++			return -EINVAL;
++
++		ret = vc_sm_cma_import_dmabuf(dmabuf, &vcsm_handle);
++		if (ret) {
++			dma_buf_put(dmabuf);
++			return -EINVAL;
++		}
++
++		ls.mem_handle_table = vc_sm_cma_int_handle(vcsm_handle);
++		if (ls.mem_handle_table)
++			/* The VPU will take a reference on the vcsm handle,
++			 * which in turn will retain a reference on the dmabuf.
++			 * This code can therefore safely release all
++			 * references to the buffer.
++			 */
++			ret = set_isp_param(node,
++					    MMAL_PARAMETER_LENS_SHADING_OVERRIDE,
++					    &ls,
++					    sizeof(ls));
++		else
++			ret = -EINVAL;
++
++		vc_sm_cma_free(vcsm_handle);
++		dma_buf_put(dmabuf);
++		break;
++	}
++	case V4L2_CID_USER_BCM2835_ISP_BLACK_LEVEL:
++		ret = set_isp_param(node, MMAL_PARAMETER_BLACK_LEVEL,
++				    ctrl->p_new.p_u8,
++				    sizeof(struct bcm2835_isp_black_level));
++		break;
++	case V4L2_CID_USER_BCM2835_ISP_GEQ:
++		ret = set_isp_param(node, MMAL_PARAMETER_GEQ,
++				    ctrl->p_new.p_u8,
++				    sizeof(struct bcm2835_isp_geq));
++		break;
++	case V4L2_CID_USER_BCM2835_ISP_GAMMA:
++		ret = set_isp_param(node, MMAL_PARAMETER_GAMMA,
++				    ctrl->p_new.p_u8,
++				    sizeof(struct bcm2835_isp_gamma));
++		break;
++	case V4L2_CID_USER_BCM2835_ISP_DENOISE:
++		ret = set_isp_param(node, MMAL_PARAMETER_DENOISE,
++				    ctrl->p_new.p_u8,
++				    sizeof(struct bcm2835_isp_denoise));
++		break;
++	case V4L2_CID_USER_BCM2835_ISP_SHARPEN:
++		ret = set_isp_param(node, MMAL_PARAMETER_SHARPEN,
++				    ctrl->p_new.p_u8,
++				    sizeof(struct bcm2835_isp_sharpen));
++		break;
++	case V4L2_CID_USER_BCM2835_ISP_DPC:
++		ret = set_isp_param(node, MMAL_PARAMETER_DPC,
++				    ctrl->p_new.p_u8,
++				    sizeof(struct bcm2835_isp_dpc));
++		break;
++	default:
++		v4l2_info(&dev->v4l2_dev, "Unrecognised control\n");
++		ret = -EINVAL;
++	}
++
++	if (ret) {
++		v4l2_err(&dev->v4l2_dev, "%s: Failed setting ctrl \"%s\" (%08x), err %d\n",
++			 __func__, ctrl->name, ctrl->id, ret);
++		ret = -EIO;
++	}
++
++	return ret;
++}
++
++static const struct v4l2_ctrl_ops bcm2835_isp_ctrl_ops = {
++	.s_ctrl = bcm2835_isp_s_ctrl,
++};
++
++static const struct v4l2_file_operations bcm2835_isp_fops = {
++	.owner		= THIS_MODULE,
++	.open		= v4l2_fh_open,
++	.release	= vb2_fop_release,
++	.poll		= vb2_fop_poll,
++	.unlocked_ioctl = video_ioctl2,
++	.mmap		= vb2_fop_mmap
++};
++
++static int populate_qdata_fmt(struct v4l2_format *f,
++			      struct bcm2835_isp_node *node)
++{
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	struct bcm2835_isp_q_data *q_data = &node->q_data;
++	int ret;
++
++	if (!node_is_stats(node)) {
++		v4l2_dbg(1, debug, &dev->v4l2_dev,
++			 "%s: Setting pix format for type %d, wxh: %ux%u, fmt: %08x, size %u\n",
++			 __func__, f->type, f->fmt.pix.width, f->fmt.pix.height,
++			 f->fmt.pix.pixelformat, f->fmt.pix.sizeimage);
++
++		q_data->fmt = find_format(f, node);
++		q_data->width = f->fmt.pix.width;
++		q_data->height = f->fmt.pix.height;
++		q_data->height = f->fmt.pix.height;
++
++		/* All parameters should have been set correctly by try_fmt */
++		q_data->bytesperline = f->fmt.pix.bytesperline;
++		q_data->sizeimage = f->fmt.pix.sizeimage;
++	} else {
++		v4l2_dbg(1, debug, &dev->v4l2_dev,
++			 "%s: Setting meta format for fmt: %08x, size %u\n",
++			 __func__, f->fmt.meta.dataformat,
++			 f->fmt.meta.buffersize);
++
++		q_data->fmt = find_format(f, node);
++		q_data->width = 0;
++		q_data->height = 0;
++		q_data->bytesperline = 0;
++		q_data->sizeimage = f->fmt.meta.buffersize;
++	}
++
++	v4l2_dbg(1, debug, &dev->v4l2_dev,
++		 "%s: Calculated bpl as %u, size %u\n", __func__,
++		 q_data->bytesperline, q_data->sizeimage);
++
++	setup_mmal_port_format(node, node->port);
++	ret = vchiq_mmal_port_set_format(dev->mmal_instance, node->port);
++	if (ret) {
++		v4l2_err(&dev->v4l2_dev,
++			 "%s: Failed vchiq_mmal_port_set_format on port, ret %d\n",
++			 __func__, ret);
++		ret = -EINVAL;
++	}
++
++	if (q_data->sizeimage < node->port->minimum_buffer.size) {
++		v4l2_err(&dev->v4l2_dev,
++			 "%s: Current buffer size of %u < min buf size %u - driver mismatch to MMAL\n",
++			 __func__,
++			 q_data->sizeimage,
++			 node->port->minimum_buffer.size);
++	}
++
++	v4l2_dbg(1, debug, &dev->v4l2_dev,
++		 "%s: Set format for type %d, wxh: %dx%d, fmt: %08x, size %u\n",
++		 __func__, f->type, q_data->width, q_data->height,
++		 q_data->fmt->fourcc, q_data->sizeimage);
++
++	return ret;
++}
++
++static int bcm2835_isp_node_querycap(struct file *file, void *priv,
++				     struct v4l2_capability *cap)
++{
++	strscpy(cap->driver, BCM2835_ISP_NAME, sizeof(cap->driver));
++	strscpy(cap->card, BCM2835_ISP_NAME, sizeof(cap->card));
++	snprintf(cap->bus_info, sizeof(cap->bus_info), "platform:%s",
++		 BCM2835_ISP_NAME);
++
++	return 0;
++}
++
++static int bcm2835_isp_node_g_fmt(struct file *file, void *priv,
++				  struct v4l2_format *f)
++{
++	struct bcm2835_isp_node *node = video_drvdata(file);
++
++	if (f->type != node->queue.type)
++		return -EINVAL;
++
++	if (node_is_stats(node)) {
++		f->fmt.meta.dataformat = V4L2_META_FMT_BCM2835_ISP_STATS;
++		f->fmt.meta.buffersize =
++			node->port->minimum_buffer.size;
++	} else {
++		struct bcm2835_isp_q_data *q_data = &node->q_data;
++
++		f->fmt.pix.width = q_data->width;
++		f->fmt.pix.height = q_data->height;
++		f->fmt.pix.field = V4L2_FIELD_NONE;
++		f->fmt.pix.pixelformat = q_data->fmt->fourcc;
++		f->fmt.pix.bytesperline = q_data->bytesperline;
++		f->fmt.pix.sizeimage = q_data->sizeimage;
++		f->fmt.pix.colorspace = q_data->fmt->colorspace;
++	}
++
++	return 0;
++}
++
++static int bcm2835_isp_node_enum_fmt(struct file *file, void  *priv,
++				     struct v4l2_fmtdesc *f)
++{
++	struct bcm2835_isp_node *node = video_drvdata(file);
++
++	if (f->type != node->queue.type)
++		return -EINVAL;
++
++	if (f->index < node->num_supported_fmts) {
++		/* Format found */
++		f->pixelformat = node->supported_fmts[f->index]->fourcc;
++		f->flags = 0;
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++static int bcm2835_isp_enum_framesizes(struct file *file, void *priv,
++				       struct v4l2_frmsizeenum *fsize)
++{
++	struct bcm2835_isp_node *node = video_drvdata(file);
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	const struct bcm2835_isp_fmt *fmt;
++
++	if (node_is_stats(node) || fsize->index)
++		return -EINVAL;
++
++	fmt = find_format_by_fourcc(fsize->pixel_format, node);
++	if (!fmt) {
++		v4l2_err(&dev->v4l2_dev, "Invalid pixel code: %x\n",
++			 fsize->pixel_format);
++		return -EINVAL;
++	}
++
++	fsize->type = V4L2_FRMSIZE_TYPE_STEPWISE;
++	fsize->stepwise.min_width = MIN_DIM;
++	fsize->stepwise.max_width = MAX_DIM;
++	fsize->stepwise.step_width = fmt->step_size;
++
++	fsize->stepwise.min_height = MIN_DIM;
++	fsize->stepwise.max_height = MAX_DIM;
++	fsize->stepwise.step_height = fmt->step_size;
++
++	return 0;
++}
++
++static int bcm2835_isp_node_try_fmt(struct file *file, void *priv,
++				    struct v4l2_format *f)
++{
++	struct bcm2835_isp_node *node = video_drvdata(file);
++	const struct bcm2835_isp_fmt *fmt;
++
++	if (f->type != node->queue.type)
++		return -EINVAL;
++
++	fmt = find_format(f, node);
++	if (!fmt)
++		fmt = get_default_format(node);
++
++	if (!node_is_stats(node)) {
++		f->fmt.pix.width = max(min(f->fmt.pix.width, MAX_DIM),
++				       MIN_DIM);
++		f->fmt.pix.height = max(min(f->fmt.pix.height, MAX_DIM),
++					MIN_DIM);
++
++		f->fmt.pix.pixelformat = fmt->fourcc;
++		f->fmt.pix.colorspace = fmt->colorspace;
++		f->fmt.pix.bytesperline = get_bytesperline(f->fmt.pix.width,
++							   fmt);
++		f->fmt.pix.field = V4L2_FIELD_NONE;
++		f->fmt.pix.sizeimage =
++			get_sizeimage(f->fmt.pix.bytesperline, f->fmt.pix.width,
++				      f->fmt.pix.height, fmt);
++	} else {
++		f->fmt.meta.dataformat = fmt->fourcc;
++		f->fmt.meta.buffersize = node->port->minimum_buffer.size;
++	}
++
++	return 0;
++}
++
++static int bcm2835_isp_node_s_fmt(struct file *file, void *priv,
++				  struct v4l2_format *f)
++{
++	struct bcm2835_isp_node *node = video_drvdata(file);
++	int ret;
++
++	if (f->type != node->queue.type)
++		return -EINVAL;
++
++	ret = bcm2835_isp_node_try_fmt(file, priv, f);
++	if (ret)
++		return ret;
++
++	v4l2_dbg(1, debug, &node_get_dev(node)->v4l2_dev,
++		 "%s: Set format for node %s[%d]\n",
++		 __func__, node->name, node->id);
++
++	return populate_qdata_fmt(f, node);
++}
++
++static int bcm2835_isp_node_s_selection(struct file *file, void *fh,
++					struct v4l2_selection *s)
++{
++	struct mmal_parameter_crop crop;
++	struct bcm2835_isp_node *node = video_drvdata(file);
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++
++	/* This return value is required fro V4L2 compliance. */
++	if (node_is_stats(node))
++		return -ENOTTY;
++
++	if (!s->r.width || !s->r.height)
++		return -EINVAL;
++
++	/* We can only set crop on the input. */
++	switch (s->target) {
++	case V4L2_SEL_TGT_CROP:
++		/*
++		 * Adjust the crop window if it goes outside of the frame
++		 * dimensions.
++		 */
++		s->r.left = min((unsigned int)max(s->r.left, 0),
++				node->q_data.width - MIN_DIM);
++		s->r.top = min((unsigned int)max(s->r.top, 0),
++			       node->q_data.height - MIN_DIM);
++		s->r.width = max(min(s->r.width,
++				     node->q_data.width - s->r.left), MIN_DIM);
++		s->r.height = max(min(s->r.height,
++				      node->q_data.height - s->r.top), MIN_DIM);
++		break;
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++		/* Default (i.e. no) crop window. */
++		s->r.left = 0;
++		s->r.top = 0;
++		s->r.width = node->q_data.width;
++		s->r.height = node->q_data.height;
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	crop.rect.x = s->r.left;
++	crop.rect.y = s->r.top;
++	crop.rect.width = s->r.width;
++	crop.rect.height = s->r.height;
++
++	return vchiq_mmal_port_parameter_set(dev->mmal_instance, node->port,
++					     MMAL_PARAMETER_CROP,
++					     &crop, sizeof(crop));
++}
++
++static int bcm2835_isp_node_g_selection(struct file *file, void *fh,
++					struct v4l2_selection *s)
++{
++	struct mmal_parameter_crop crop;
++	struct bcm2835_isp_node *node = video_drvdata(file);
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	u32 crop_size = sizeof(crop);
++	int ret;
++
++	/* We can only return out an input crop. */
++	switch (s->target) {
++	case V4L2_SEL_TGT_CROP:
++		ret = vchiq_mmal_port_parameter_get(dev->mmal_instance,
++						    node->port,
++						    MMAL_PARAMETER_CROP,
++						    &crop, &crop_size);
++		if (!ret) {
++			s->r.left = crop.rect.x;
++			s->r.top = crop.rect.y;
++			s->r.width = crop.rect.width;
++			s->r.height = crop.rect.height;
++		}
++		break;
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++	case V4L2_SEL_TGT_CROP_BOUNDS:
++		/* Default (i.e. no) crop window. */
++		s->r.left = 0;
++		s->r.top = 0;
++		s->r.width = node->q_data.width;
++		s->r.height = node->q_data.height;
++		ret = 0;
++		break;
++	default:
++		ret =  -EINVAL;
++	}
++
++	return ret;
++}
++
++static int bcm3285_isp_subscribe_event(struct v4l2_fh *fh,
++				       const struct v4l2_event_subscription *s)
++{
++	switch (s->type) {
++	/* Cannot change source parameters dynamically at runtime. */
++	case V4L2_EVENT_SOURCE_CHANGE:
++		return -EINVAL;
++	case V4L2_EVENT_CTRL:
++		return v4l2_ctrl_subscribe_event(fh, s);
++	default:
++		return v4l2_event_subscribe(fh, s, 4, NULL);
++	}
++}
++
++static const struct v4l2_ioctl_ops bcm2835_isp_node_ioctl_ops = {
++	.vidioc_querycap		= bcm2835_isp_node_querycap,
++	.vidioc_g_fmt_vid_cap		= bcm2835_isp_node_g_fmt,
++	.vidioc_g_fmt_vid_out		= bcm2835_isp_node_g_fmt,
++	.vidioc_g_fmt_meta_cap		= bcm2835_isp_node_g_fmt,
++	.vidioc_s_fmt_vid_cap		= bcm2835_isp_node_s_fmt,
++	.vidioc_s_fmt_vid_out		= bcm2835_isp_node_s_fmt,
++	.vidioc_s_fmt_meta_cap		= bcm2835_isp_node_s_fmt,
++	.vidioc_try_fmt_vid_cap		= bcm2835_isp_node_try_fmt,
++	.vidioc_try_fmt_vid_out		= bcm2835_isp_node_try_fmt,
++	.vidioc_try_fmt_meta_cap	= bcm2835_isp_node_try_fmt,
++	.vidioc_s_selection		= bcm2835_isp_node_s_selection,
++	.vidioc_g_selection		= bcm2835_isp_node_g_selection,
++
++	.vidioc_enum_fmt_vid_cap	= bcm2835_isp_node_enum_fmt,
++	.vidioc_enum_fmt_vid_out	= bcm2835_isp_node_enum_fmt,
++	.vidioc_enum_fmt_meta_cap	= bcm2835_isp_node_enum_fmt,
++	.vidioc_enum_framesizes		= bcm2835_isp_enum_framesizes,
++
++	.vidioc_reqbufs			= vb2_ioctl_reqbufs,
++	.vidioc_querybuf		= vb2_ioctl_querybuf,
++	.vidioc_qbuf			= vb2_ioctl_qbuf,
++	.vidioc_dqbuf			= vb2_ioctl_dqbuf,
++	.vidioc_expbuf			= vb2_ioctl_expbuf,
++	.vidioc_create_bufs		= vb2_ioctl_create_bufs,
++	.vidioc_prepare_buf		= vb2_ioctl_prepare_buf,
++
++	.vidioc_streamon		= vb2_ioctl_streamon,
++	.vidioc_streamoff		= vb2_ioctl_streamoff,
++
++	.vidioc_subscribe_event		= bcm3285_isp_subscribe_event,
++	.vidioc_unsubscribe_event	= v4l2_event_unsubscribe,
++};
++
++/*
++ * Size of the array to provide to the VPU when asking for the list of supported
++ * formats.
++ *
++ * The ISP component currently advertises 44 input formats, so add a small
++ * overhead on that. Should the component advertise more formats then the excess
++ * will be dropped and a warning logged.
++ */
++#define MAX_SUPPORTED_ENCODINGS 50
++
++/* Populate node->supported_fmts with the formats supported by those ports. */
++static int bcm2835_isp_get_supported_fmts(struct bcm2835_isp_node *node)
++{
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	struct bcm2835_isp_fmt const **list;
++	unsigned int i, j, num_encodings;
++	u32 fourccs[MAX_SUPPORTED_ENCODINGS];
++	u32 param_size = sizeof(fourccs);
++	int ret;
++
++	ret = vchiq_mmal_port_parameter_get(dev->mmal_instance, node->port,
++					    MMAL_PARAMETER_SUPPORTED_ENCODINGS,
++					    &fourccs, &param_size);
++
++	if (ret) {
++		if (ret == MMAL_MSG_STATUS_ENOSPC) {
++			v4l2_err(&dev->v4l2_dev,
++				 "%s: port has more encoding than we provided space for. Some are dropped.\n",
++				 __func__);
++			num_encodings = MAX_SUPPORTED_ENCODINGS;
++		} else {
++			v4l2_err(&dev->v4l2_dev, "%s: get_param ret %u.\n",
++				 __func__, ret);
++			return -EINVAL;
++		}
++	} else {
++		num_encodings = param_size / sizeof(u32);
++	}
++
++	/*
++	 * Assume at this stage that all encodings will be supported in V4L2.
++	 * Any that aren't supported will waste a very small amount of memory.
++	 */
++	list = devm_kzalloc(dev->dev,
++			    sizeof(struct bcm2835_isp_fmt *) * num_encodings,
++			    GFP_KERNEL);
++	if (!list)
++		return -ENOMEM;
++	node->supported_fmts = list;
++
++	for (i = 0, j = 0; i < num_encodings; i++) {
++		const struct bcm2835_isp_fmt *fmt = get_fmt(fourccs[i]);
++
++		if (fmt) {
++			list[j] = fmt;
++			j++;
++		}
++	}
++	node->num_supported_fmts = j;
++
++	return 0;
++}
++
++/*
++ * Register a device node /dev/video<N> to go along with one of the ISP's input
++ * or output nodes.
++ */
++static int register_node(struct bcm2835_isp_dev *dev,
++			 struct bcm2835_isp_node *node,
++			 int index)
++{
++	struct video_device *vfd;
++	struct vb2_queue *queue;
++	int ret;
++
++	mutex_init(&node->lock);
++
++	node->dev = dev;
++	vfd = &node->vfd;
++	queue = &node->queue;
++	queue->type = index_to_queue_type(index);
++	/*
++	 * Setup the node type-specific params.
++	 *
++	 * Only the OUTPUT node can set controls and crop windows. However,
++	 * we must allow the s/g_selection ioctl on the stats node as v4l2
++	 * compliance expects it to return a -ENOTTY, and the framework
++	 * does not handle it if the ioctl is disabled.
++	 */
++	switch (queue->type) {
++	case V4L2_BUF_TYPE_VIDEO_OUTPUT:
++		vfd->device_caps = V4L2_CAP_VIDEO_OUTPUT | V4L2_CAP_STREAMING;
++		node->id = index;
++		node->vfl_dir = VFL_DIR_TX;
++		node->name = "output";
++		node->port = &dev->component->input[node->id];
++		break;
++	case V4L2_BUF_TYPE_VIDEO_CAPTURE:
++		vfd->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING;
++		/* First Capture node starts at id 0, etc. */
++		node->id = index - BCM2835_ISP_NUM_OUTPUTS;
++		node->vfl_dir = VFL_DIR_RX;
++		node->name = "capture";
++		node->port = &dev->component->output[node->id];
++		v4l2_disable_ioctl(&node->vfd, VIDIOC_S_CTRL);
++		v4l2_disable_ioctl(&node->vfd, VIDIOC_S_SELECTION);
++		v4l2_disable_ioctl(&node->vfd, VIDIOC_G_SELECTION);
++		break;
++	case V4L2_BUF_TYPE_META_CAPTURE:
++		vfd->device_caps = V4L2_CAP_META_CAPTURE | V4L2_CAP_STREAMING;
++		node->id = index - BCM2835_ISP_NUM_OUTPUTS;
++		node->vfl_dir = VFL_DIR_RX;
++		node->name = "stats";
++		node->port = &dev->component->output[node->id];
++		v4l2_disable_ioctl(&node->vfd, VIDIOC_S_CTRL);
++		v4l2_disable_ioctl(&node->vfd, VIDIOC_S_SELECTION);
++		v4l2_disable_ioctl(&node->vfd, VIDIOC_G_SELECTION);
++		break;
++	}
++
++	/* We use the selection API instead of the old crop API. */
++	v4l2_disable_ioctl(vfd, VIDIOC_CROPCAP);
++	v4l2_disable_ioctl(vfd, VIDIOC_G_CROP);
++	v4l2_disable_ioctl(vfd, VIDIOC_S_CROP);
++
++	ret = bcm2835_isp_get_supported_fmts(node);
++	if (ret)
++		return ret;
++
++	/* Initialise the video node. */
++	vfd->vfl_type	= VFL_TYPE_VIDEO;
++	vfd->fops	= &bcm2835_isp_fops,
++	vfd->ioctl_ops	= &bcm2835_isp_node_ioctl_ops,
++	vfd->minor	= -1,
++	vfd->release	= video_device_release_empty,
++	vfd->queue	= &node->queue;
++	vfd->lock	= &node->lock;
++	vfd->v4l2_dev	= &dev->v4l2_dev;
++	vfd->vfl_dir	= node->vfl_dir;
++
++	node->q_data.fmt = get_default_format(node);
++	node->q_data.width = DEFAULT_DIM;
++	node->q_data.height = DEFAULT_DIM;
++	node->q_data.bytesperline =
++		get_bytesperline(DEFAULT_DIM, node->q_data.fmt);
++	node->q_data.sizeimage = node_is_stats(node) ?
++				 node->port->recommended_buffer.size :
++				 get_sizeimage(node->q_data.bytesperline,
++					       node->q_data.width,
++					       node->q_data.height,
++					       node->q_data.fmt);
++
++	queue->io_modes = VB2_MMAP | VB2_DMABUF;
++	queue->drv_priv = node;
++	queue->ops = &bcm2835_isp_node_queue_ops;
++	queue->mem_ops = &vb2_dma_contig_memops;
++	queue->buf_struct_size = sizeof(struct bcm2835_isp_buffer);
++	queue->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
++	queue->dev = dev->dev;
++	queue->lock = &node->queue_lock;
++
++	ret = vb2_queue_init(queue);
++	if (ret < 0) {
++		v4l2_info(&dev->v4l2_dev, "vb2_queue_init failed\n");
++		return ret;
++	}
++
++	/* Set some controls and defaults, but only on the VIDEO_OUTPUT node. */
++	if (node_is_output(node)) {
++		unsigned int i;
++
++		/* Use this ctrl template to assign custom ISP ctrls. */
++		struct v4l2_ctrl_config ctrl_template = {
++			.ops		= &bcm2835_isp_ctrl_ops,
++			.type		= V4L2_CTRL_TYPE_U8,
++			.def		= 0,
++			.min		= 0x00,
++			.max		= 0xff,
++			.step		= 1,
++		};
++
++		/* 3 standard controls, and an array of custom controls */
++		ret = v4l2_ctrl_handler_init(&dev->ctrl_handler,
++					     3 + ARRAY_SIZE(custom_ctrls));
++		if (ret) {
++			v4l2_err(&dev->v4l2_dev, "ctrl_handler init failed (%d)\n",
++				 ret);
++			goto queue_cleanup;
++		}
++
++		dev->r_gain = 1000;
++		dev->b_gain = 1000;
++
++		v4l2_ctrl_new_std(&dev->ctrl_handler,  &bcm2835_isp_ctrl_ops,
++				  V4L2_CID_RED_BALANCE, 1, 0xffff, 1,
++				  dev->r_gain);
++
++		v4l2_ctrl_new_std(&dev->ctrl_handler, &bcm2835_isp_ctrl_ops,
++				  V4L2_CID_BLUE_BALANCE, 1, 0xffff, 1,
++				  dev->b_gain);
++
++		v4l2_ctrl_new_std(&dev->ctrl_handler, &bcm2835_isp_ctrl_ops,
++				  V4L2_CID_DIGITAL_GAIN, 1, 0xffff, 1, 1000);
++
++		for (i = 0; i < ARRAY_SIZE(custom_ctrls); i++) {
++			ctrl_template.name = custom_ctrls[i].name;
++			ctrl_template.id = custom_ctrls[i].id;
++			ctrl_template.dims[0] = custom_ctrls[i].size;
++			ctrl_template.flags = custom_ctrls[i].flags;
++			v4l2_ctrl_new_custom(&dev->ctrl_handler,
++					     &ctrl_template, NULL);
++		}
++
++		node->vfd.ctrl_handler = &dev->ctrl_handler;
++		if (dev->ctrl_handler.error) {
++			ret = dev->ctrl_handler.error;
++			v4l2_err(&dev->v4l2_dev, "controls init failed (%d)\n",
++				 ret);
++			v4l2_ctrl_handler_free(&dev->ctrl_handler);
++			goto ctrl_cleanup;
++		}
++	}
++
++	/* Define the device names */
++	snprintf(vfd->name, sizeof(node->vfd.name), "%s-%s%d", BCM2835_ISP_NAME,
++		 node->name, node->id);
++
++	ret = video_register_device(vfd, VFL_TYPE_VIDEO, video_nr + index);
++	if (ret) {
++		v4l2_err(&dev->v4l2_dev,
++			 "Failed to register video %s[%d] device node\n",
++			 node->name, node->id);
++		goto ctrl_cleanup;
++	}
++
++	node->registered = true;
++	video_set_drvdata(vfd, node);
++
++	v4l2_info(&dev->v4l2_dev,
++		  "Device node %s[%d] registered as /dev/video%d\n",
++		  node->name, node->id, vfd->num);
++
++	return 0;
++
++ctrl_cleanup:
++	if (node_is_output(node))
++		v4l2_ctrl_handler_free(&dev->ctrl_handler);
++queue_cleanup:
++	vb2_queue_release(&node->queue);
++	return ret;
++}
++
++/* Unregister one of the /dev/video<N> nodes associated with the ISP. */
++static void unregister_node(struct bcm2835_isp_node *node)
++{
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++
++	v4l2_info(&dev->v4l2_dev,
++		  "Unregistering node %s[%d] device node /dev/video%d\n",
++		  node->name, node->id, node->vfd.num);
++
++	if (node->registered) {
++		video_unregister_device(&node->vfd);
++		if (node_is_output(node))
++			v4l2_ctrl_handler_free(&dev->ctrl_handler);
++		vb2_queue_release(&node->queue);
++	}
++
++	/*
++	 * node->supported_fmts.list is free'd automatically
++	 * as a managed resource.
++	 */
++	node->supported_fmts = NULL;
++	node->num_supported_fmts = 0;
++	node->vfd.ctrl_handler = NULL;
++	node->registered = false;
++}
++
++static void media_controller_unregister(struct bcm2835_isp_dev *dev)
++{
++	unsigned int i;
++
++	v4l2_info(&dev->v4l2_dev, "Unregister from media controller\n");
++
++	if (dev->media_device_registered) {
++		media_device_unregister(&dev->mdev);
++		media_device_cleanup(&dev->mdev);
++		dev->media_device_registered = false;
++	}
++
++	kfree(dev->entity.name);
++	dev->entity.name = NULL;
++
++	if (dev->media_entity_registered) {
++		media_device_unregister_entity(&dev->entity);
++		dev->media_entity_registered = false;
++	}
++
++	for (i = 0; i < BCM2835_ISP_NUM_NODES; i++) {
++		struct bcm2835_isp_node *node = &dev->node[i];
++
++		if (node->media_node_registered) {
++			media_remove_intf_links(node->intf_link->intf);
++			media_entity_remove_links(&dev->node[i].vfd.entity);
++			media_devnode_remove(node->intf_devnode);
++			media_device_unregister_entity(&node->vfd.entity);
++			kfree(node->vfd.entity.name);
++		}
++		node->media_node_registered = false;
++	}
++
++	dev->v4l2_dev.mdev = NULL;
++}
++
++static int media_controller_register_node(struct bcm2835_isp_dev *dev, int num)
++{
++	struct bcm2835_isp_node *node = &dev->node[num];
++	struct media_entity *entity = &node->vfd.entity;
++	int output = node_is_output(node);
++	char *name;
++	int ret;
++
++	v4l2_info(&dev->v4l2_dev,
++		  "Register %s node %d with media controller\n",
++		  output ? "output" : "capture", num);
++	entity->obj_type = MEDIA_ENTITY_TYPE_VIDEO_DEVICE;
++	entity->function = MEDIA_ENT_F_IO_V4L;
++	entity->info.dev.major = VIDEO_MAJOR;
++	entity->info.dev.minor = node->vfd.minor;
++	name = kmalloc(BCM2835_ISP_ENTITY_NAME_LEN, GFP_KERNEL);
++	if (!name) {
++		ret = -ENOMEM;
++		goto error_no_mem;
++	}
++	snprintf(name, BCM2835_ISP_ENTITY_NAME_LEN, "%s0-%s%d",
++		 BCM2835_ISP_NAME, output ? "output" : "capture", num);
++	entity->name = name;
++	node->pad.flags = output ? MEDIA_PAD_FL_SOURCE : MEDIA_PAD_FL_SINK;
++	ret = media_entity_pads_init(entity, 1, &node->pad);
++	if (ret)
++		goto error_pads_init;
++	ret = media_device_register_entity(&dev->mdev, entity);
++	if (ret)
++		goto error_register_entity;
++
++	node->intf_devnode = media_devnode_create(&dev->mdev,
++						  MEDIA_INTF_T_V4L_VIDEO, 0,
++						  VIDEO_MAJOR, node->vfd.minor);
++	if (!node->intf_devnode) {
++		ret = -ENOMEM;
++		goto error_devnode_create;
++	}
++
++	node->intf_link = media_create_intf_link(entity,
++						 &node->intf_devnode->intf,
++						 MEDIA_LNK_FL_IMMUTABLE |
++						 MEDIA_LNK_FL_ENABLED);
++	if (!node->intf_link) {
++		ret = -ENOMEM;
++		goto error_create_intf_link;
++	}
++
++	if (output)
++		ret = media_create_pad_link(entity, 0, &dev->entity, num,
++					    MEDIA_LNK_FL_IMMUTABLE |
++						    MEDIA_LNK_FL_ENABLED);
++	else
++		ret = media_create_pad_link(&dev->entity, num, entity, 0,
++					    MEDIA_LNK_FL_IMMUTABLE |
++					    MEDIA_LNK_FL_ENABLED);
++	if (ret)
++		goto error_create_pad_link;
++
++	dev->node[num].media_node_registered = true;
++	return 0;
++
++error_create_pad_link:
++	media_remove_intf_links(&node->intf_devnode->intf);
++error_create_intf_link:
++	media_devnode_remove(node->intf_devnode);
++error_devnode_create:
++	media_device_unregister_entity(&node->vfd.entity);
++error_register_entity:
++error_pads_init:
++	kfree(entity->name);
++	entity->name = NULL;
++error_no_mem:
++	if (ret)
++		v4l2_info(&dev->v4l2_dev, "Error registering node\n");
++
++	return ret;
++}
++
++static int media_controller_register(struct bcm2835_isp_dev *dev)
++{
++	char *name;
++	unsigned int i;
++	int ret;
++
++	v4l2_dbg(2, debug, &dev->v4l2_dev, "Registering with media controller\n");
++	dev->mdev.dev = dev->dev;
++	strscpy(dev->mdev.model, "bcm2835-isp",
++		sizeof(dev->mdev.model));
++	strscpy(dev->mdev.bus_info, "platform:bcm2835-isp",
++		sizeof(dev->mdev.bus_info));
++	media_device_init(&dev->mdev);
++	dev->v4l2_dev.mdev = &dev->mdev;
++
++	v4l2_dbg(2, debug, &dev->v4l2_dev, "Register entity for nodes\n");
++
++	name = kmalloc(BCM2835_ISP_ENTITY_NAME_LEN, GFP_KERNEL);
++	if (!name) {
++		ret = -ENOMEM;
++		goto done;
++	}
++	snprintf(name, BCM2835_ISP_ENTITY_NAME_LEN, "bcm2835_isp0");
++	dev->entity.name = name;
++	dev->entity.obj_type = MEDIA_ENTITY_TYPE_BASE;
++	dev->entity.function = MEDIA_ENT_F_PROC_VIDEO_SCALER;
++
++	for (i = 0; i < BCM2835_ISP_NUM_NODES; i++) {
++		dev->pad[i].flags = node_is_output(&dev->node[i]) ?
++					MEDIA_PAD_FL_SINK : MEDIA_PAD_FL_SOURCE;
++	}
++
++	ret = media_entity_pads_init(&dev->entity, BCM2835_ISP_NUM_NODES,
++				     dev->pad);
++	if (ret)
++		goto done;
++
++	ret = media_device_register_entity(&dev->mdev, &dev->entity);
++	if (ret)
++		goto done;
++
++	dev->media_entity_registered = true;
++	for (i = 0; i < BCM2835_ISP_NUM_NODES; i++) {
++		ret = media_controller_register_node(dev, i);
++		if (ret)
++			goto done;
++	}
++
++	ret = media_device_register(&dev->mdev);
++	if (!ret)
++		dev->media_device_registered = true;
++done:
++	return ret;
++}
++
++static int bcm2835_isp_remove(struct platform_device *pdev)
++{
++	struct bcm2835_isp_dev *dev = platform_get_drvdata(pdev);
++	unsigned int i;
++
++	media_controller_unregister(dev);
++
++	for (i = 0; i < BCM2835_ISP_NUM_NODES; i++)
++		unregister_node(&dev->node[i]);
++
++	v4l2_device_unregister(&dev->v4l2_dev);
++
++	if (dev->component)
++		vchiq_mmal_component_finalise(dev->mmal_instance,
++					      dev->component);
++
++	vchiq_mmal_finalise(dev->mmal_instance);
++
++	return 0;
++}
++
++static int bcm2835_isp_probe(struct platform_device *pdev)
++{
++	struct bcm2835_isp_dev *dev;
++	unsigned int i;
++	int ret;
++
++	dev = devm_kzalloc(&pdev->dev, sizeof(*dev), GFP_KERNEL);
++	if (!dev)
++		return -ENOMEM;
++
++	dev->dev = &pdev->dev;
++
++	ret = v4l2_device_register(&pdev->dev, &dev->v4l2_dev);
++	if (ret)
++		return ret;
++
++	ret = vchiq_mmal_init(&dev->mmal_instance);
++	if (ret) {
++		v4l2_device_unregister(&dev->v4l2_dev);
++		return ret;
++	}
++
++	ret = vchiq_mmal_component_init(dev->mmal_instance, "ril.isp",
++					&dev->component);
++	if (ret) {
++		v4l2_err(&dev->v4l2_dev,
++			 "%s: failed to create ril.isp component\n", __func__);
++		goto error;
++	}
++
++	if (dev->component->inputs < BCM2835_ISP_NUM_OUTPUTS ||
++	    dev->component->outputs < BCM2835_ISP_NUM_CAPTURES +
++					BCM2835_ISP_NUM_METADATA) {
++		v4l2_err(&dev->v4l2_dev,
++			 "%s: ril.isp returned %d i/p (%d expected), %d o/p (%d expected) ports\n",
++			  __func__, dev->component->inputs,
++			  BCM2835_ISP_NUM_OUTPUTS,
++			  dev->component->outputs,
++			  BCM2835_ISP_NUM_CAPTURES + BCM2835_ISP_NUM_METADATA);
++		goto error;
++	}
++
++	atomic_set(&dev->num_streaming, 0);
++
++	for (i = 0; i < BCM2835_ISP_NUM_NODES; i++) {
++		struct bcm2835_isp_node *node = &dev->node[i];
++
++		ret = register_node(dev, node, i);
++		if (ret)
++			goto error;
++	}
++
++	ret = media_controller_register(dev);
++	if (ret)
++		goto error;
++
++	platform_set_drvdata(pdev, dev);
++	v4l2_info(&dev->v4l2_dev, "Loaded V4L2 %s\n", BCM2835_ISP_NAME);
++	return 0;
++
++error:
++	bcm2835_isp_remove(pdev);
++
++	return ret;
++}
++
++static struct platform_driver bcm2835_isp_pdrv = {
++	.probe = bcm2835_isp_probe,
++	.remove = bcm2835_isp_remove,
++	.driver = {
++			.name = BCM2835_ISP_NAME,
++		  },
++};
++
++module_platform_driver(bcm2835_isp_pdrv);
++
++MODULE_DESCRIPTION("BCM2835 ISP driver");
++MODULE_AUTHOR("Naushir Patuck <naush@raspberrypi.com>");
++MODULE_LICENSE("GPL");
++MODULE_VERSION("1.0");
++MODULE_ALIAS("platform:bcm2835-isp");
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
+@@ -113,6 +113,10 @@
+  */
+ #define MMAL_ENCODING_EGL_IMAGE        MMAL_FOURCC('E', 'G', 'L', 'I')
+ 
++/** ISP image statistics format
++ */
++#define MMAL_ENCODING_BRCM_STATS       MMAL_FOURCC('S', 'T', 'A', 'T')
++
+ /* }@ */
+ 
+ /** \name Pre-defined audio encodings */
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
+@@ -223,6 +223,62 @@ enum mmal_parameter_camera_type {
+ 	MMAL_PARAMETER_SHUTTER_SPEED,
+ 		/**< Takes a @ref MMAL_PARAMETER_AWB_GAINS_T */
+ 	MMAL_PARAMETER_CUSTOM_AWB_GAINS,
++		/**< Takes a @ref MMAL_PARAMETER_CAMERA_SETTINGS_T */
++	MMAL_PARAMETER_CAMERA_SETTINGS,
++		/**< Takes a @ref MMAL_PARAMETER_PRIVACY_INDICATOR_T */
++	MMAL_PARAMETER_PRIVACY_INDICATOR,
++		/**< Takes a @ref MMAL_PARAMETER_BOOLEAN_T */
++	MMAL_PARAMETER_VIDEO_DENOISE,
++		/**< Takes a @ref MMAL_PARAMETER_BOOLEAN_T */
++	MMAL_PARAMETER_STILLS_DENOISE,
++		/**< Takes a @ref MMAL_PARAMETER_CAMERA_ANNOTATE_T */
++	MMAL_PARAMETER_ANNOTATE,
++		/**< Takes a @ref MMAL_PARAMETER_STEREOSCOPIC_MODE_T */
++	MMAL_PARAMETER_STEREOSCOPIC_MODE,
++		/**< Takes a @ref MMAL_PARAMETER_CAMERA_INTERFACE_T */
++	MMAL_PARAMETER_CAMERA_INTERFACE,
++		/**< Takes a @ref MMAL_PARAMETER_CAMERA_CLOCKING_MODE_T */
++	MMAL_PARAMETER_CAMERA_CLOCKING_MODE,
++		/**< Takes a @ref MMAL_PARAMETER_CAMERA_RX_CONFIG_T */
++	MMAL_PARAMETER_CAMERA_RX_CONFIG,
++		/**< Takes a @ref MMAL_PARAMETER_CAMERA_RX_TIMING_T */
++	MMAL_PARAMETER_CAMERA_RX_TIMING,
++		/**< Takes a @ref MMAL_PARAMETER_UINT32_T */
++	MMAL_PARAMETER_DPF_CONFIG,
++
++	/* 0x50 */
++		/**< Takes a @ref MMAL_PARAMETER_UINT32_T */
++	MMAL_PARAMETER_JPEG_RESTART_INTERVAL,
++		/**< Takes a @ref MMAL_PARAMETER_UINT32_T */
++	MMAL_PARAMETER_CAMERA_ISP_BLOCK_OVERRIDE,
++		/**< Takes a @ref MMAL_PARAMETER_LENS_SHADING_T */
++	MMAL_PARAMETER_LENS_SHADING_OVERRIDE,
++		/**< Takes a @ref MMAL_PARAMETER_UINT32_T */
++	MMAL_PARAMETER_BLACK_LEVEL,
++		/**< Takes a @ref MMAL_PARAMETER_RESIZE_T */
++	MMAL_PARAMETER_RESIZE_PARAMS,
++		/**< Takes a @ref MMAL_PARAMETER_CROP_T */
++	MMAL_PARAMETER_CROP,
++		/**< Takes a @ref MMAL_PARAMETER_INT32_T */
++	MMAL_PARAMETER_OUTPUT_SHIFT,
++		/**< Takes a @ref MMAL_PARAMETER_INT32_T */
++	MMAL_PARAMETER_CCM_SHIFT,
++		/**< Takes a @ref MMAL_PARAMETER_CUSTOM_CCM_T */
++	MMAL_PARAMETER_CUSTOM_CCM,
++		/**< Takes a @ref MMAL_PARAMETER_RATIONAL_T */
++	MMAL_PARAMETER_ANALOG_GAIN,
++		/**< Takes a @ref MMAL_PARAMETER_RATIONAL_T */
++	MMAL_PARAMETER_DIGITAL_GAIN,
++		/**< Takes a @ref MMAL_PARAMETER_DENOISE_T */
++	MMAL_PARAMETER_DENOISE,
++		/**< Takes a @ref MMAL_PARAMETER_SHARPEN_T */
++	MMAL_PARAMETER_SHARPEN,
++		/**< Takes a @ref MMAL_PARAMETER_GEQ_T */
++	MMAL_PARAMETER_GEQ,
++		/**< Tales a @ref MMAP_PARAMETER_DPC_T */
++	MMAL_PARAMETER_DPC,
++		/**< Tales a @ref MMAP_PARAMETER_GAMMA_T */
++	MMAL_PARAMETER_GAMMA,
+ 		/**< Takes a @ref MMAL_PARAMETER_BOOLEAN_T */
+ 	MMAL_PARAMETER_JPEG_IJG_SCALING,
+ };
+@@ -791,7 +847,102 @@ struct mmal_parameter_camera_info {
+ 	struct mmal_parameter_camera_info_camera
+ 		cameras[MMAL_PARAMETER_CAMERA_INFO_MAX_CAMERAS];
+ 	struct mmal_parameter_camera_info_flash
+-				flashes[MMAL_PARAMETER_CAMERA_INFO_MAX_FLASHES];
++		flashes[MMAL_PARAMETER_CAMERA_INFO_MAX_FLASHES];
++};
++
++struct mmal_parameter_ccm {
++	struct s32_fract ccm[3][3];
++	s32 offsets[3];
++};
++
++struct mmal_parameter_custom_ccm {
++	u32 enabled; /**< Enable the custom CCM. */
++	struct mmal_parameter_ccm ccm; /**< CCM to be used. */
++};
++
++struct mmal_parameter_lens_shading {
++	u32 enabled;
++	u32 grid_cell_size;
++	u32 grid_width;
++	u32 grid_stride;
++	u32 grid_height;
++	u32 mem_handle_table;
++	u32 ref_transform;
++};
++
++enum mmal_parameter_ls_gain_format_type {
++	MMAL_PARAMETER_LS_GAIN_FORMAT_TYPE_U0P8_1 = 0,
++	MMAL_PARAMETER_LS_GAIN_FORMAT_TYPE_U1P7_0 = 1,
++	MMAL_PARAMETER_LS_GAIN_FORMAT_TYPE_U1P7_1 = 2,
++	MMAL_PARAMETER_LS_GAIN_FORMAT_TYPE_U2P6_0 = 3,
++	MMAL_PARAMETER_LS_GAIN_FORMAT_TYPE_U2P6_1 = 4,
++	MMAL_PARAMETER_LS_GAIN_FORMAT_TYPE_U3P5_0 = 5,
++	MMAL_PARAMETER_LS_GAIN_FORMAT_TYPE_U3P5_1 = 6,
++	MMAL_PARAMETER_LS_GAIN_FORMAT_TYPE_U4P10  = 7,
++	MMAL_PARAMETER_LS_GAIN_FORMAT_TYPE_DUMMY  = 0x7FFFFFFF
++};
++
++struct mmal_parameter_lens_shading_v2 {
++	u32 enabled;
++	u32 grid_cell_size;
++	u32 grid_width;
++	u32 grid_stride;
++	u32 grid_height;
++	u32 mem_handle_table;
++	u32 ref_transform;
++	u32 corner_sampled;
++	enum mmal_parameter_ls_gain_format_type gain_format;
++};
++
++struct mmal_parameter_black_level {
++	u32 enabled;
++	u16 black_level_r;
++	u16 black_level_g;
++	u16 black_level_b;
++	u8 pad_[2]; /* Unused */
++};
++
++struct mmal_parameter_geq {
++	u32 enabled;
++	u32 offset;
++	struct s32_fract slope;
++};
++
++#define MMAL_NUM_GAMMA_PTS 33
++struct mmal_parameter_gamma {
++	u32 enabled;
++	u16 x[MMAL_NUM_GAMMA_PTS];
++	u16 y[MMAL_NUM_GAMMA_PTS];
++};
++
++struct mmal_parameter_denoise {
++	u32 enabled;
++	u32 constant;
++	struct s32_fract slope;
++	struct s32_fract strength;
++};
++
++struct mmal_parameter_sharpen {
++	u32 enabled;
++	struct s32_fract threshold;
++	struct s32_fract strength;
++	struct s32_fract limit;
++};
++
++enum mmal_dpc_mode {
++	MMAL_DPC_MODE_OFF = 0,
++	MMAL_DPC_MODE_NORMAL = 1,
++	MMAL_DPC_MODE_STRONG = 2,
++	MMAL_DPC_MODE_MAX = 0x7FFFFFFF,
++};
++
++struct mmal_parameter_dpc {
++	u32 enabled;
++	u32 strength;
++};
++
++struct mmal_parameter_crop {
++	struct vchiq_mmal_rect rect;
+ };
+ 
+ #endif
diff --git a/target/linux/bcm27xx/patches-6.1/950-0281-gpio-Add-gpio-fsm-driver.patch b/target/linux/bcm27xx/patches-6.1/950-0281-gpio-Add-gpio-fsm-driver.patch
new file mode 100644
index 00000000000000..1e0c3a0d00c41a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0281-gpio-Add-gpio-fsm-driver.patch
@@ -0,0 +1,1304 @@
+From f0b841f737e04175f295a77245508b10efd117fb Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 30 Sep 2020 12:00:54 +0100
+Subject: [PATCH] gpio: Add gpio-fsm driver
+
+The gpio-fsm driver implements simple state machines that allow GPIOs
+to be controlled in response to inputs from other GPIOs - real and
+soft/virtual - and time delays. It can:
++ create dummy GPIOs for drivers that demand them,
++ drive multiple GPIOs from a single input, with optional delays,
++ add a debounce circuit to an input,
++ drive pattern sequences onto LEDs
+etc.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+gpio-fsm: Fix a build warning
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+gpio-fsm: Rename 'num-soft-gpios' to avoid warning
+
+As of 5.10, the Device Tree parser warns about properties that look
+like references to "suppliers" of various services. "num-soft-gpios"
+resembles a declaration of a GPIO called "num-soft", causing the value
+to be interpreted as a phandle, the owner of which is checked for a
+"#gpio-cells" property.
+
+To avoid this warning, rename the gpio-fsm property to "num-swgpios".
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+gpio-fsm: Show state info in /sys/class/gpio-fsm
+
+Add gpio-fsm sysfs entries under /sys/class/gpio-fsm. For each state
+machine show the current state, which state (if any) will be entered
+after a delay, and the current value of that delay.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+gpio-fsm: Fix shutdown timeout handling
+
+The driver is intended to jump directly to a shutdown state in the
+event of a timeout during shutdown, but the sense of the test was
+inverted.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+gpio-fsm: Clamp the delay time to zero
+
+The sysfs delay_ms value is calculated live, and it is possible for
+the time left to appear to be negative briefly if the timer handling
+hasn't completed. Ensure the displayed value never goes below zero,
+for the sake of appearances.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/gpio/Kconfig    |    9 +
+ drivers/gpio/Makefile   |    1 +
+ drivers/gpio/gpio-fsm.c | 1210 +++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 1220 insertions(+)
+ create mode 100644 drivers/gpio/gpio-fsm.c
+
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -1243,6 +1243,15 @@ config HTC_EGPIO
+ 	  several HTC phones.  It provides basic support for input
+ 	  pins, output pins, and IRQs.
+ 
++config GPIO_FSM
++	tristate "GPIO FSM support"
++	help
++	  The GPIO FSM driver allows the creation of state machines for
++	  manipulating GPIOs (both real and virtual), with state transitions
++	  triggered by GPIO edges or delays.
++
++	  If unsure, say N.
++
+ config GPIO_JANZ_TTL
+ 	tristate "Janz VMOD-TTL Digital IO Module"
+ 	depends on MFD_JANZ_CMODIO
+--- a/drivers/gpio/Makefile
++++ b/drivers/gpio/Makefile
+@@ -61,6 +61,7 @@ obj-$(CONFIG_GPIO_EP93XX)		+= gpio-ep93x
+ obj-$(CONFIG_GPIO_EXAR)			+= gpio-exar.o
+ obj-$(CONFIG_GPIO_F7188X)		+= gpio-f7188x.o
+ obj-$(CONFIG_GPIO_FTGPIO010)		+= gpio-ftgpio010.o
++obj-$(CONFIG_GPIO_FSM)			+= gpio-fsm.o
+ obj-$(CONFIG_GPIO_GE_FPGA)		+= gpio-ge.o
+ obj-$(CONFIG_GPIO_GPIO_MM)		+= gpio-gpio-mm.o
+ obj-$(CONFIG_GPIO_GRGPIO)		+= gpio-grgpio.o
+--- /dev/null
++++ b/drivers/gpio/gpio-fsm.c
+@@ -0,0 +1,1210 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ *  GPIO FSM driver
++ *
++ *  This driver implements simple state machines that allow real GPIOs to be
++ *  controlled in response to inputs from other GPIOs - real and soft/virtual -
++ *  and time delays. It can:
++ *  + create dummy GPIOs for drivers that demand them
++ *  + drive multiple GPIOs from a single input,  with optional delays
++ *  + add a debounce circuit to an input
++ *  + drive pattern sequences onto LEDs
++ *  etc.
++ *
++ *  Copyright (C) 2020 Raspberry Pi (Trading) Ltd.
++ */
++
++#include <linux/err.h>
++#include <linux/gpio.h>
++#include <linux/gpio/driver.h>
++#include <linux/interrupt.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/sysfs.h>
++
++#include <dt-bindings/gpio/gpio-fsm.h>
++
++#define MODULE_NAME "gpio-fsm"
++
++#define GF_IO_TYPE(x) ((u32)(x) & 0xffff)
++#define GF_IO_INDEX(x) ((u32)(x) >> 16)
++
++enum {
++	SIGNAL_GPIO,
++	SIGNAL_SOFT
++};
++
++enum {
++	INPUT_GPIO,
++	INPUT_SOFT
++};
++
++enum {
++	SYM_UNDEFINED,
++	SYM_NAME,
++	SYM_SET,
++	SYM_START,
++	SYM_SHUTDOWN,
++
++	SYM_MAX
++};
++
++struct soft_gpio {
++	int dir;
++	int value;
++};
++
++struct input_gpio_state {
++	struct gpio_fsm *gf;
++	struct gpio_desc  *desc;
++	struct fsm_state *target;
++	int index;
++	int value;
++	int irq;
++	bool enabled;
++	bool active_low;
++};
++
++struct gpio_event {
++	int index;
++	int value;
++	struct fsm_state *target;
++};
++
++struct symtab_entry {
++	const char *name;
++	void *value;
++	struct symtab_entry *next;
++};
++
++struct output_signal {
++	u8 type;
++	u8 value;
++	u16 index;
++};
++
++struct fsm_state {
++	const char *name;
++	struct output_signal *signals;
++	struct gpio_event *gpio_events;
++	struct gpio_event *soft_events;
++	struct fsm_state *delay_target;
++	struct fsm_state *shutdown_target;
++	unsigned int num_signals;
++	unsigned int num_gpio_events;
++	unsigned int num_soft_events;
++	unsigned int delay_ms;
++	unsigned int shutdown_ms;
++};
++
++struct gpio_fsm {
++	struct gpio_chip gc;
++	struct device *dev;
++	spinlock_t spinlock;
++	struct work_struct work;
++	struct timer_list timer;
++	wait_queue_head_t shutdown_event;
++	struct fsm_state *states;
++	struct input_gpio_state *input_gpio_states;
++	struct gpio_descs *input_gpios;
++	struct gpio_descs *output_gpios;
++	struct soft_gpio *soft_gpios;
++	struct fsm_state *start_state;
++	struct fsm_state *shutdown_state;
++	unsigned int num_states;
++	unsigned int num_output_gpios;
++	unsigned int num_input_gpios;
++	unsigned int num_soft_gpios;
++	unsigned int shutdown_timeout_ms;
++	unsigned int shutdown_jiffies;
++
++	struct fsm_state *current_state;
++	struct fsm_state *next_state;
++	struct fsm_state *delay_target_state;
++	unsigned int delay_jiffies;
++	int delay_ms;
++	unsigned int debug;
++	bool shutting_down;
++	struct symtab_entry *symtab;
++};
++
++static struct symtab_entry *do_add_symbol(struct symtab_entry **symtab,
++					  const char *name, void *value)
++{
++	struct symtab_entry **p = symtab;
++
++	while (*p && strcmp((*p)->name, name))
++		p = &(*p)->next;
++
++	if (*p) {
++		/* This is an existing symbol */
++		if ((*p)->value) {
++			/* Already defined */
++			if (value) {
++				if ((uintptr_t)value < SYM_MAX)
++					return ERR_PTR(-EINVAL);
++				else
++					return ERR_PTR(-EEXIST);
++			}
++		} else {
++			/* Undefined */
++			(*p)->value = value;
++		}
++	} else {
++		/* This is a new symbol */
++		*p = kmalloc(sizeof(struct symtab_entry), GFP_KERNEL);
++		if (*p) {
++			(*p)->name = name;
++			(*p)->value = value;
++			(*p)->next = NULL;
++		}
++	}
++	return *p;
++}
++
++static int add_symbol(struct symtab_entry **symtab,
++		      const char *name, void *value)
++{
++	struct symtab_entry *sym = do_add_symbol(symtab, name, value);
++
++	return PTR_ERR_OR_ZERO(sym);
++}
++
++static struct symtab_entry *get_symbol(struct symtab_entry **symtab,
++				       const char *name)
++{
++	struct symtab_entry *sym = do_add_symbol(symtab, name, NULL);
++
++	if (IS_ERR(sym))
++		return NULL;
++	return sym;
++}
++
++static void free_symbols(struct symtab_entry **symtab)
++{
++	struct symtab_entry *sym = *symtab;
++	void *p;
++
++	*symtab = NULL;
++	while (sym) {
++		p = sym;
++		sym = sym->next;
++		kfree(p);
++	}
++}
++
++static int gpio_fsm_get_direction(struct gpio_chip *gc, unsigned int off)
++{
++	struct gpio_fsm *gf = gpiochip_get_data(gc);
++	struct soft_gpio *sg;
++
++	if (off >= gf->num_soft_gpios)
++		return -EINVAL;
++	sg = &gf->soft_gpios[off];
++
++	return sg->dir;
++}
++
++static int gpio_fsm_get(struct gpio_chip *gc, unsigned int off)
++{
++	struct gpio_fsm *gf = gpiochip_get_data(gc);
++	struct soft_gpio *sg;
++
++	if (off >= gf->num_soft_gpios)
++		return -EINVAL;
++	sg = &gf->soft_gpios[off];
++
++	return sg->value;
++}
++
++static void gpio_fsm_go_to_state(struct gpio_fsm *gf,
++				   struct fsm_state *new_state)
++{
++	struct input_gpio_state *inp_state;
++	struct gpio_event *gp_ev;
++	struct fsm_state *state;
++	int i;
++
++	dev_dbg(gf->dev, "go_to_state(%s)\n",
++		  new_state ? new_state->name : "<unset>");
++
++	spin_lock(&gf->spinlock);
++
++	if (gf->next_state) {
++		/* Something else has already requested a transition */
++		spin_unlock(&gf->spinlock);
++		return;
++	}
++
++	gf->next_state = new_state;
++	state = gf->current_state;
++	gf->delay_target_state = NULL;
++
++	if (state) {
++		/* Disarm any GPIO IRQs */
++		for (i = 0; i < state->num_gpio_events; i++) {
++			gp_ev = &state->gpio_events[i];
++			inp_state = &gf->input_gpio_states[gp_ev->index];
++			inp_state->target = NULL;
++		}
++	}
++
++	spin_unlock(&gf->spinlock);
++
++	if (new_state)
++		schedule_work(&gf->work);
++}
++
++static void gpio_fsm_set_soft(struct gpio_fsm *gf,
++				unsigned int off, int val)
++{
++	struct soft_gpio *sg = &gf->soft_gpios[off];
++	struct gpio_event *gp_ev;
++	struct fsm_state *state;
++	int i;
++
++	dev_dbg(gf->dev, "set(%d,%d)\n", off, val);
++	state = gf->current_state;
++	sg->value = val;
++	for (i = 0; i < state->num_soft_events; i++) {
++		gp_ev = &state->soft_events[i];
++		if (gp_ev->index == off && gp_ev->value == val) {
++			if (gf->debug)
++				dev_info(gf->dev,
++					 "GF_SOFT %d->%d -> %s\n", gp_ev->index,
++					 gp_ev->value, gp_ev->target->name);
++			gpio_fsm_go_to_state(gf, gp_ev->target);
++			break;
++		}
++	}
++}
++
++static int gpio_fsm_direction_input(struct gpio_chip *gc, unsigned int off)
++{
++	struct gpio_fsm *gf = gpiochip_get_data(gc);
++	struct soft_gpio *sg;
++
++	if (off >= gf->num_soft_gpios)
++		return -EINVAL;
++	sg = &gf->soft_gpios[off];
++	sg->dir = GPIOF_DIR_IN;
++
++	return 0;
++}
++
++static int gpio_fsm_direction_output(struct gpio_chip *gc, unsigned int off,
++				       int value)
++{
++	struct gpio_fsm *gf = gpiochip_get_data(gc);
++	struct soft_gpio *sg;
++
++	if (off >= gf->num_soft_gpios)
++		return -EINVAL;
++	sg = &gf->soft_gpios[off];
++	sg->dir = GPIOF_DIR_OUT;
++	gpio_fsm_set_soft(gf, off, value);
++
++	return 0;
++}
++
++static void gpio_fsm_set(struct gpio_chip *gc, unsigned int off, int val)
++{
++	struct gpio_fsm *gf;
++
++	gf = gpiochip_get_data(gc);
++	if (off < gf->num_soft_gpios)
++		gpio_fsm_set_soft(gf, off, val);
++}
++
++static void gpio_fsm_enter_state(struct gpio_fsm *gf,
++				   struct fsm_state *state)
++{
++	struct input_gpio_state *inp_state;
++	struct output_signal *signal;
++	struct gpio_event *event;
++	struct gpio_desc *gpiod;
++	struct soft_gpio *soft;
++	int value;
++	int i;
++
++	dev_dbg(gf->dev, "enter_state(%s)\n", state->name);
++
++	gf->current_state = state;
++
++	// 1. Apply any listed signals
++	for (i = 0; i < state->num_signals; i++) {
++		signal = &state->signals[i];
++
++		if (gf->debug)
++			dev_info(gf->dev, "  set %s %d->%d\n",
++				 (signal->type == SIGNAL_GPIO) ? "GF_OUT" :
++				 "GF_SOFT",
++				 signal->index, signal->value);
++		switch (signal->type) {
++		case SIGNAL_GPIO:
++			gpiod = gf->output_gpios->desc[signal->index];
++			gpiod_set_value_cansleep(gpiod, signal->value);
++			break;
++		case SIGNAL_SOFT:
++			soft = &gf->soft_gpios[signal->index];
++			gpio_fsm_set_soft(gf, signal->index, signal->value);
++			break;
++		}
++	}
++
++	// 2. Exit if successfully reached shutdown state
++	if (gf->shutting_down && state == state->shutdown_target) {
++		wake_up(&gf->shutdown_event);
++		return;
++	}
++
++	// 3. Schedule a timer callback if shutting down
++	if (state->shutdown_target) {
++		// Remember the absolute shutdown time in case remove is called
++		// at a later time.
++		gf->shutdown_jiffies =
++			jiffies + msecs_to_jiffies(state->shutdown_ms);
++
++		if (gf->shutting_down) {
++			gf->delay_jiffies = gf->shutdown_jiffies;
++			gf->delay_target_state = state->shutdown_target;
++			gf->delay_ms = state->shutdown_ms;
++			mod_timer(&gf->timer, gf->delay_jiffies);
++		}
++	}
++
++	// During shutdown, skip everything else
++	if (gf->shutting_down)
++		return;
++
++	// Otherwise record what the shutdown time would be
++	gf->shutdown_jiffies = jiffies + msecs_to_jiffies(state->shutdown_ms);
++
++	// 4. Check soft inputs for transitions to take
++	for (i = 0; i < state->num_soft_events; i++) {
++		event = &state->soft_events[i];
++		if (gf->soft_gpios[event->index].value == event->value) {
++			if (gf->debug)
++				dev_info(gf->dev,
++					 "GF_SOFT %d=%d -> %s\n", event->index,
++					 event->value, event->target->name);
++			gpio_fsm_go_to_state(gf, event->target);
++			return;
++		}
++	}
++
++	// 5. Check GPIOs for transitions to take, enabling the IRQs
++	for (i = 0; i < state->num_gpio_events; i++) {
++		event = &state->gpio_events[i];
++		inp_state = &gf->input_gpio_states[event->index];
++		inp_state->target = event->target;
++		inp_state->value = event->value;
++		inp_state->enabled = true;
++
++		value = gpiod_get_value(gf->input_gpios->desc[event->index]);
++
++		// Clear stale event state
++		disable_irq(inp_state->irq);
++
++		irq_set_irq_type(inp_state->irq,
++				 (inp_state->value ^ inp_state->active_low) ?
++				 IRQF_TRIGGER_RISING : IRQF_TRIGGER_FALLING);
++		enable_irq(inp_state->irq);
++
++		if (value == event->value && inp_state->target) {
++			if (gf->debug)
++				dev_info(gf->dev,
++					 "GF_IN %d=%d -> %s\n", event->index,
++					 event->value, event->target->name);
++			gpio_fsm_go_to_state(gf, event->target);
++			return;
++		}
++	}
++
++	// 6. Schedule a timer callback if delay_target
++	if (state->delay_target) {
++		gf->delay_target_state = state->delay_target;
++		gf->delay_jiffies = jiffies +
++			msecs_to_jiffies(state->delay_ms);
++		gf->delay_ms = state->delay_ms;
++		mod_timer(&gf->timer, gf->delay_jiffies);
++	}
++}
++
++static void gpio_fsm_work(struct work_struct *work)
++{
++	struct input_gpio_state *inp_state;
++	struct fsm_state *new_state;
++	struct fsm_state *state;
++	struct gpio_event *gp_ev;
++	struct gpio_fsm *gf;
++	int i;
++
++	gf = container_of(work, struct gpio_fsm, work);
++	spin_lock(&gf->spinlock);
++	state = gf->current_state;
++	new_state = gf->next_state;
++	if (!new_state)
++		new_state = gf->delay_target_state;
++	gf->next_state = NULL;
++	gf->delay_target_state = NULL;
++	spin_unlock(&gf->spinlock);
++
++	if (state) {
++		/* Disable any enabled GPIO IRQs */
++		for (i = 0; i < state->num_gpio_events; i++) {
++			gp_ev = &state->gpio_events[i];
++			inp_state = &gf->input_gpio_states[gp_ev->index];
++			if (inp_state->enabled) {
++				inp_state->enabled = false;
++				irq_set_irq_type(inp_state->irq,
++						 IRQF_TRIGGER_NONE);
++			}
++		}
++	}
++
++	if (new_state)
++		gpio_fsm_enter_state(gf, new_state);
++}
++
++static irqreturn_t gpio_fsm_gpio_irq_handler(int irq, void *dev_id)
++{
++	struct input_gpio_state *inp_state = dev_id;
++	struct gpio_fsm *gf = inp_state->gf;
++	struct fsm_state *target;
++
++	target = inp_state->target;
++	if (!target)
++		return IRQ_NONE;
++
++	/* If the IRQ has fired then the desired state _must_ have occurred */
++	inp_state->enabled = false;
++	irq_set_irq_type(inp_state->irq, IRQF_TRIGGER_NONE);
++	if (gf->debug)
++		dev_info(gf->dev, "GF_IN %d->%d -> %s\n",
++			 inp_state->index, inp_state->value, target->name);
++	gpio_fsm_go_to_state(gf, target);
++	return IRQ_HANDLED;
++}
++
++static void gpio_fsm_timer(struct timer_list *timer)
++{
++	struct gpio_fsm *gf = container_of(timer, struct gpio_fsm, timer);
++	struct fsm_state *target;
++
++	target = gf->delay_target_state;
++	if (!target)
++		return;
++
++	if (gf->debug)
++		dev_info(gf->dev, "GF_DELAY %d -> %s\n", gf->delay_ms,
++			 target->name);
++
++	gpio_fsm_go_to_state(gf, target);
++}
++
++int gpio_fsm_parse_signals(struct gpio_fsm *gf, struct fsm_state *state,
++			     struct property *prop)
++{
++	const __be32 *cells = prop->value;
++	struct output_signal *signal;
++	u32 io;
++	u32 type;
++	u32 index;
++	u32 value;
++	int ret = 0;
++	int i;
++
++	if (prop->length % 8) {
++		dev_err(gf->dev, "malformed set in state %s\n",
++			state->name);
++		return -EINVAL;
++	}
++
++	state->num_signals = prop->length/8;
++	state->signals = devm_kcalloc(gf->dev, state->num_signals,
++				      sizeof(struct output_signal),
++				      GFP_KERNEL);
++	for (i = 0; i < state->num_signals; i++) {
++		signal = &state->signals[i];
++		io = be32_to_cpu(cells[0]);
++		type = GF_IO_TYPE(io);
++		index = GF_IO_INDEX(io);
++		value = be32_to_cpu(cells[1]);
++
++		if (type != GF_OUT && type != GF_SOFT) {
++			dev_err(gf->dev,
++				"invalid set type %d in state %s\n",
++				type, state->name);
++			ret = -EINVAL;
++			break;
++		}
++		if (type == GF_OUT && index >= gf->num_output_gpios) {
++			dev_err(gf->dev,
++				"invalid GF_OUT number %d in state %s\n",
++				index, state->name);
++			ret = -EINVAL;
++			break;
++		}
++		if (type == GF_SOFT && index >= gf->num_soft_gpios) {
++			dev_err(gf->dev,
++				"invalid GF_SOFT number %d in state %s\n",
++				index, state->name);
++			ret = -EINVAL;
++			break;
++		}
++		if (value != 0 && value != 1) {
++			dev_err(gf->dev,
++				"invalid set value %d in state %s\n",
++				value, state->name);
++			ret = -EINVAL;
++			break;
++		}
++		signal->type = (type == GF_OUT) ? SIGNAL_GPIO : SIGNAL_SOFT;
++		signal->index = index;
++		signal->value = value;
++		cells += 2;
++	}
++
++	return ret;
++}
++
++struct gpio_event *new_event(struct gpio_event **events, int *num_events)
++{
++	int num = ++(*num_events);
++	*events = krealloc(*events, num * sizeof(struct gpio_event),
++			   GFP_KERNEL);
++	return *events ? *events + (num - 1) : NULL;
++}
++
++int gpio_fsm_parse_events(struct gpio_fsm *gf, struct fsm_state *state,
++			    struct property *prop)
++{
++	const __be32 *cells = prop->value;
++	struct symtab_entry *sym;
++	int num_cells;
++	int ret = 0;
++	int i;
++
++	if (prop->length % 8) {
++		dev_err(gf->dev,
++			"malformed transitions from state %s to state %s\n",
++			state->name, prop->name);
++		return -EINVAL;
++	}
++
++	sym = get_symbol(&gf->symtab, prop->name);
++	num_cells = prop->length / 4;
++	i = 0;
++	while (i < num_cells) {
++		struct gpio_event *gp_ev;
++		u32 event, param;
++		u32 index;
++
++		event = be32_to_cpu(cells[i++]);
++		param = be32_to_cpu(cells[i++]);
++		index = GF_IO_INDEX(event);
++
++		switch (GF_IO_TYPE(event)) {
++		case GF_IN:
++			if (index >= gf->num_input_gpios) {
++				dev_err(gf->dev,
++					"invalid GF_IN %d in transitions from state %s to state %s\n",
++					index, state->name, prop->name);
++				return -EINVAL;
++			}
++			if (param > 1) {
++				dev_err(gf->dev,
++					"invalid GF_IN value %d in transitions from state %s to state %s\n",
++					param, state->name, prop->name);
++				return -EINVAL;
++			}
++			gp_ev = new_event(&state->gpio_events,
++					  &state->num_gpio_events);
++			if (!gp_ev)
++				return -ENOMEM;
++			gp_ev->index = index;
++			gp_ev->value = param;
++			gp_ev->target = (struct fsm_state *)sym;
++			break;
++
++		case GF_SOFT:
++			if (index >= gf->num_soft_gpios) {
++				dev_err(gf->dev,
++					"invalid GF_SOFT %d in transitions from state %s to state %s\n",
++					index, state->name, prop->name);
++				return -EINVAL;
++			}
++			if (param > 1) {
++				dev_err(gf->dev,
++					"invalid GF_SOFT value %d in transitions from state %s to state %s\n",
++					param, state->name, prop->name);
++				return -EINVAL;
++			}
++			gp_ev = new_event(&state->soft_events,
++					  &state->num_soft_events);
++			if (!gp_ev)
++				return -ENOMEM;
++			gp_ev->index = index;
++			gp_ev->value = param;
++			gp_ev->target = (struct fsm_state *)sym;
++			break;
++
++		case GF_DELAY:
++			if (state->delay_target) {
++				dev_err(gf->dev,
++					"state %s has multiple GF_DELAYs\n",
++					state->name);
++				return -EINVAL;
++			}
++			state->delay_target = (struct fsm_state *)sym;
++			state->delay_ms = param;
++			break;
++
++		case GF_SHUTDOWN:
++			if (state->shutdown_target == state) {
++				dev_err(gf->dev,
++					"shutdown state %s has GF_SHUTDOWN\n",
++					state->name);
++				return -EINVAL;
++			} else if (state->shutdown_target) {
++				dev_err(gf->dev,
++					"state %s has multiple GF_SHUTDOWNs\n",
++					state->name);
++				return -EINVAL;
++			}
++			state->shutdown_target =
++				(struct fsm_state *)sym;
++			state->shutdown_ms = param;
++			break;
++
++		default:
++			dev_err(gf->dev,
++				"invalid event %08x in transitions from state %s to state %s\n",
++				event, state->name, prop->name);
++			return -EINVAL;
++		}
++	}
++	if (i != num_cells) {
++		dev_err(gf->dev,
++			"malformed transitions from state %s to state %s\n",
++			state->name, prop->name);
++		return -EINVAL;
++	}
++
++	return ret;
++}
++
++int gpio_fsm_parse_state(struct gpio_fsm *gf,
++			   struct fsm_state *state,
++			   struct device_node *np)
++{
++	struct symtab_entry *sym;
++	struct property *prop;
++	int ret;
++
++	state->name = np->name;
++	ret = add_symbol(&gf->symtab, np->name, state);
++	if (ret) {
++		switch (ret) {
++		case -EINVAL:
++			dev_err(gf->dev, "'%s' is not a valid state name\n",
++				np->name);
++			break;
++		case -EEXIST:
++			dev_err(gf->dev, "state %s already defined\n",
++				np->name);
++			break;
++		default:
++			dev_err(gf->dev, "error %d adding state %s symbol\n",
++				ret, np->name);
++			break;
++		}
++		return ret;
++	}
++
++	for_each_property_of_node(np, prop) {
++		sym = get_symbol(&gf->symtab, prop->name);
++		if (!sym) {
++			ret = -ENOMEM;
++			break;
++		}
++
++		switch ((uintptr_t)sym->value) {
++		case SYM_SET:
++			ret = gpio_fsm_parse_signals(gf, state, prop);
++			break;
++		case SYM_START:
++			if (gf->start_state) {
++				dev_err(gf->dev, "multiple start states\n");
++				ret = -EINVAL;
++			} else {
++				gf->start_state = state;
++			}
++			break;
++		case SYM_SHUTDOWN:
++			state->shutdown_target = state;
++			gf->shutdown_state = state;
++			break;
++		case SYM_NAME:
++			/* Ignore */
++			break;
++		default:
++			/* A set of transition events to this state */
++			ret = gpio_fsm_parse_events(gf, state, prop);
++			break;
++		}
++	}
++
++	return ret;
++}
++
++static void dump_all(struct gpio_fsm *gf)
++{
++	int i, j;
++
++	dev_info(gf->dev, "Input GPIOs:\n");
++	for (i = 0; i < gf->num_input_gpios; i++)
++		dev_info(gf->dev, "  %d: %p\n", i,
++			 gf->input_gpios->desc[i]);
++
++	dev_info(gf->dev, "Output GPIOs:\n");
++	for (i = 0; i < gf->num_output_gpios; i++)
++		dev_info(gf->dev, "  %d: %p\n", i,
++			 gf->output_gpios->desc[i]);
++
++	dev_info(gf->dev, "Soft GPIOs:\n");
++	for (i = 0; i < gf->num_soft_gpios; i++)
++		dev_info(gf->dev, "  %d: %s %d\n", i,
++			 (gf->soft_gpios[i].dir == GPIOF_DIR_IN) ? "IN" : "OUT",
++			 gf->soft_gpios[i].value);
++
++	dev_info(gf->dev, "Start state: %s\n",
++		 gf->start_state ? gf->start_state->name : "-");
++
++	dev_info(gf->dev, "Shutdown timeout: %d ms\n",
++		 gf->shutdown_timeout_ms);
++
++	for (i = 0; i < gf->num_states; i++) {
++		struct fsm_state *state = &gf->states[i];
++
++		dev_info(gf->dev, "State %s:\n", state->name);
++
++		if (state->shutdown_target == state)
++			dev_info(gf->dev, "  Shutdown state\n");
++
++		dev_info(gf->dev, "  Signals:\n");
++		for (j = 0; j < state->num_signals; j++) {
++			struct output_signal *signal = &state->signals[j];
++
++			dev_info(gf->dev, "    %d: %s %d=%d\n", j,
++				 (signal->type == SIGNAL_GPIO) ? "GPIO" :
++								 "SOFT",
++				 signal->index, signal->value);
++		}
++
++		dev_info(gf->dev, "  GPIO events:\n");
++		for (j = 0; j < state->num_gpio_events; j++) {
++			struct gpio_event *event = &state->gpio_events[j];
++
++			dev_info(gf->dev, "    %d: %d=%d -> %s\n", j,
++				 event->index, event->value,
++				 event->target->name);
++		}
++
++		dev_info(gf->dev, "  Soft events:\n");
++		for (j = 0; j < state->num_soft_events; j++) {
++			struct gpio_event *event = &state->soft_events[j];
++
++			dev_info(gf->dev, "    %d: %d=%d -> %s\n", j,
++				 event->index, event->value,
++				 event->target->name);
++		}
++
++		if (state->delay_target)
++			dev_info(gf->dev, "  Delay: %d ms -> %s\n",
++				 state->delay_ms, state->delay_target->name);
++
++		if (state->shutdown_target && state->shutdown_target != state)
++			dev_info(gf->dev, "  Shutdown: %d ms -> %s\n",
++				 state->shutdown_ms,
++				 state->shutdown_target->name);
++	}
++	dev_info(gf->dev, "\n");
++}
++
++static int resolve_sym_to_state(struct gpio_fsm *gf, struct fsm_state **pstate)
++{
++	struct symtab_entry *sym = (struct symtab_entry *)*pstate;
++
++	if (!sym)
++		return -ENOMEM;
++
++	*pstate = sym->value;
++
++	if (!*pstate) {
++		dev_err(gf->dev, "state %s not defined\n",
++			sym->name);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++
++/*
++ * /sys/class/gpio-fsm/<fsm-name>/
++ *   /state ... the current state
++ */
++
++static ssize_t state_show(struct device *dev,
++			  struct device_attribute *attr, char *buf)
++{
++	const struct gpio_fsm *gf = dev_get_drvdata(dev);
++
++	return sprintf(buf, "%s\n", gf->current_state->name);
++}
++static DEVICE_ATTR_RO(state);
++
++static ssize_t delay_state_show(struct device *dev,
++			  struct device_attribute *attr, char *buf)
++{
++	const struct gpio_fsm *gf = dev_get_drvdata(dev);
++
++	return sprintf(buf, "%s\n",
++		       gf->delay_target_state ? gf->delay_target_state->name :
++		       "-");
++}
++
++static DEVICE_ATTR_RO(delay_state);
++
++static ssize_t delay_ms_show(struct device *dev,
++			     struct device_attribute *attr, char *buf)
++{
++	const struct gpio_fsm *gf = dev_get_drvdata(dev);
++	int jiffies_left;
++
++	jiffies_left = max((int)(gf->delay_jiffies - jiffies), 0);
++	return sprintf(buf,
++		       gf->delay_target_state ? "%u\n" : "-\n",
++		       jiffies_to_msecs(jiffies_left));
++}
++static DEVICE_ATTR_RO(delay_ms);
++
++static struct attribute *gpio_fsm_attrs[] = {
++	&dev_attr_state.attr,
++	&dev_attr_delay_state.attr,
++	&dev_attr_delay_ms.attr,
++	NULL,
++};
++
++static const struct attribute_group gpio_fsm_group = {
++	.attrs = gpio_fsm_attrs,
++	//.is_visible = gpio_is_visible,
++};
++
++static const struct attribute_group *gpio_fsm_groups[] = {
++	&gpio_fsm_group,
++	NULL
++};
++
++static struct attribute *gpio_fsm_class_attrs[] = {
++	// There are no top-level attributes
++	NULL,
++};
++ATTRIBUTE_GROUPS(gpio_fsm_class);
++
++static struct class gpio_fsm_class = {
++	.name =		MODULE_NAME,
++	.owner =	THIS_MODULE,
++
++	.class_groups = gpio_fsm_class_groups,
++};
++
++static int gpio_fsm_probe(struct platform_device *pdev)
++{
++	struct input_gpio_state *inp_state;
++	struct device *dev = &pdev->dev;
++	struct device *sysfs_dev;
++	struct device_node *np = dev->of_node;
++	struct device_node *cp;
++	struct gpio_fsm *gf;
++	u32 debug = 0;
++	int num_states;
++	u32 num_soft_gpios;
++	int ret;
++	int i;
++	static const char *const reserved_symbols[] = {
++		[SYM_NAME] = "name",
++		[SYM_SET] = "set",
++		[SYM_START] = "start_state",
++		[SYM_SHUTDOWN] = "shutdown_state",
++	};
++
++	if (of_property_read_u32(np, "num-swgpios", &num_soft_gpios) &&
++	    of_property_read_u32(np, "num-soft-gpios", &num_soft_gpios)) {
++		dev_err(dev, "missing 'num-swgpios' property\n");
++		return -EINVAL;
++	}
++
++	of_property_read_u32(np, "debug", &debug);
++
++	gf = devm_kzalloc(dev, sizeof(*gf), GFP_KERNEL);
++	if (!gf)
++		return -ENOMEM;
++
++	gf->dev = dev;
++	gf->debug = debug;
++
++	if (of_property_read_u32(np, "shutdown-timeout-ms",
++				 &gf->shutdown_timeout_ms))
++		gf->shutdown_timeout_ms = 5000;
++
++	gf->num_soft_gpios = num_soft_gpios;
++	gf->soft_gpios = devm_kcalloc(dev, num_soft_gpios,
++				      sizeof(struct soft_gpio), GFP_KERNEL);
++	if (!gf->soft_gpios)
++		return -ENOMEM;
++	for (i = 0; i < num_soft_gpios; i++) {
++		struct soft_gpio *sg = &gf->soft_gpios[i];
++
++		sg->dir = GPIOF_DIR_IN;
++		sg->value = 0;
++	}
++
++	gf->input_gpios = devm_gpiod_get_array_optional(dev, "input", GPIOD_IN);
++	if (IS_ERR(gf->input_gpios)) {
++		ret = PTR_ERR(gf->input_gpios);
++		dev_err(dev, "failed to get input gpios from DT - %d\n", ret);
++		return ret;
++	}
++	gf->num_input_gpios = (gf->input_gpios ? gf->input_gpios->ndescs : 0);
++
++	gf->input_gpio_states = devm_kcalloc(dev, gf->num_input_gpios,
++					     sizeof(struct input_gpio_state),
++					     GFP_KERNEL);
++	if (!gf->input_gpio_states)
++		return -ENOMEM;
++	for (i = 0; i < gf->num_input_gpios; i++) {
++		inp_state = &gf->input_gpio_states[i];
++		inp_state->desc = gf->input_gpios->desc[i];
++		inp_state->gf = gf;
++		inp_state->index = i;
++		inp_state->irq = gpiod_to_irq(inp_state->desc);
++		inp_state->active_low = gpiod_is_active_low(inp_state->desc);
++		if (inp_state->irq >= 0)
++			ret = devm_request_irq(gf->dev, inp_state->irq,
++					       gpio_fsm_gpio_irq_handler,
++					       IRQF_TRIGGER_NONE,
++					       dev_name(dev),
++					       inp_state);
++		else
++			ret = inp_state->irq;
++
++		if (ret) {
++			dev_err(dev,
++				"failed to get IRQ for input gpio - %d\n",
++				ret);
++			return ret;
++		}
++	}
++
++	gf->output_gpios = devm_gpiod_get_array_optional(dev, "output",
++							 GPIOD_OUT_LOW);
++	if (IS_ERR(gf->output_gpios)) {
++		ret = PTR_ERR(gf->output_gpios);
++		dev_err(dev, "failed to get output gpios from DT - %d\n", ret);
++		return ret;
++	}
++	gf->num_output_gpios = (gf->output_gpios ? gf->output_gpios->ndescs :
++				0);
++
++	num_states = of_get_child_count(np);
++	if (!num_states) {
++		dev_err(dev, "no states declared\n");
++		return -EINVAL;
++	}
++	gf->states = devm_kcalloc(dev, num_states,
++				  sizeof(struct fsm_state), GFP_KERNEL);
++	if (!gf->states)
++		return -ENOMEM;
++
++	// add reserved words to the symbol table
++	for (i = 0; i < ARRAY_SIZE(reserved_symbols); i++) {
++		if (reserved_symbols[i])
++			add_symbol(&gf->symtab, reserved_symbols[i],
++				   (void *)(uintptr_t)i);
++	}
++
++	// parse the state
++	for_each_child_of_node(np, cp) {
++		struct fsm_state *state = &gf->states[gf->num_states];
++
++		ret = gpio_fsm_parse_state(gf, state, cp);
++		if (ret)
++			return ret;
++		gf->num_states++;
++	}
++
++	if (!gf->start_state) {
++		dev_err(gf->dev, "no start state defined\n");
++		return -EINVAL;
++	}
++
++	// resolve symbol pointers into state pointers
++	for (i = 0; !ret && i < gf->num_states; i++) {
++		struct fsm_state *state = &gf->states[i];
++		int j;
++
++		for (j = 0; !ret && j < state->num_gpio_events; j++) {
++			struct gpio_event *ev = &state->gpio_events[j];
++
++			ret = resolve_sym_to_state(gf, &ev->target);
++		}
++
++		for (j = 0; !ret && j < state->num_soft_events; j++) {
++			struct gpio_event *ev = &state->soft_events[j];
++
++			ret = resolve_sym_to_state(gf, &ev->target);
++		}
++
++		if (!ret) {
++			resolve_sym_to_state(gf, &state->delay_target);
++			if (state->shutdown_target != state)
++				resolve_sym_to_state(gf,
++						     &state->shutdown_target);
++		}
++	}
++
++	if (!ret && gf->debug > 1)
++		dump_all(gf);
++
++	free_symbols(&gf->symtab);
++
++	if (ret)
++		return ret;
++
++	gf->gc.parent = dev;
++	gf->gc.label = np->name;
++	gf->gc.owner = THIS_MODULE;
++	gf->gc.of_node = np;
++	gf->gc.base = -1;
++	gf->gc.ngpio = num_soft_gpios;
++
++	gf->gc.get_direction = gpio_fsm_get_direction;
++	gf->gc.direction_input = gpio_fsm_direction_input;
++	gf->gc.direction_output = gpio_fsm_direction_output;
++	gf->gc.get = gpio_fsm_get;
++	gf->gc.set = gpio_fsm_set;
++	gf->gc.can_sleep = true;
++	spin_lock_init(&gf->spinlock);
++	INIT_WORK(&gf->work, gpio_fsm_work);
++	timer_setup(&gf->timer, gpio_fsm_timer, 0);
++	init_waitqueue_head(&gf->shutdown_event);
++
++	platform_set_drvdata(pdev, gf);
++
++	sysfs_dev = device_create_with_groups(&gpio_fsm_class, dev,
++					      MKDEV(0, 0), gf,
++					      gpio_fsm_groups,
++					      "%s", np->name);
++	if (IS_ERR(sysfs_dev))
++		dev_err(gf->dev, "Error creating sysfs entry\n");
++
++	if (gf->debug)
++		dev_info(gf->dev, "Start -> %s\n", gf->start_state->name);
++
++	gpio_fsm_go_to_state(gf, gf->start_state);
++
++	return devm_gpiochip_add_data(dev, &gf->gc, gf);
++}
++
++static int gpio_fsm_remove(struct platform_device *pdev)
++{
++	struct gpio_fsm *gf = platform_get_drvdata(pdev);
++	int i;
++
++	if (gf->shutdown_state) {
++		if (gf->debug)
++			dev_info(gf->dev, "Shutting down...\n");
++
++		spin_lock(&gf->spinlock);
++		gf->shutting_down = true;
++		if (gf->current_state->shutdown_target &&
++		    gf->current_state->shutdown_target != gf->current_state) {
++			gf->delay_target_state =
++				gf->current_state->shutdown_target;
++			mod_timer(&gf->timer, gf->shutdown_jiffies);
++		}
++		spin_unlock(&gf->spinlock);
++
++		wait_event_timeout(gf->shutdown_event,
++				   gf->current_state->shutdown_target ==
++				   gf->current_state,
++				   msecs_to_jiffies(gf->shutdown_timeout_ms));
++		/* On failure to reach a shutdown state, jump to one */
++		if (gf->current_state->shutdown_target != gf->current_state)
++			gpio_fsm_enter_state(gf, gf->shutdown_state);
++	}
++	cancel_work_sync(&gf->work);
++	del_timer_sync(&gf->timer);
++
++	/* Events aren't allocated from managed storage */
++	for (i = 0; i < gf->num_states; i++) {
++		kfree(gf->states[i].gpio_events);
++		kfree(gf->states[i].soft_events);
++	}
++	if (gf->debug)
++		dev_info(gf->dev, "Exiting\n");
++
++	return 0;
++}
++
++static void gpio_fsm_shutdown(struct platform_device *pdev)
++{
++	gpio_fsm_remove(pdev);
++}
++
++static const struct of_device_id gpio_fsm_ids[] = {
++	{ .compatible = "rpi,gpio-fsm" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, gpio_fsm_ids);
++
++static struct platform_driver gpio_fsm_driver = {
++	.driver	= {
++		.name		= MODULE_NAME,
++		.of_match_table	= of_match_ptr(gpio_fsm_ids),
++	},
++	.probe = gpio_fsm_probe,
++	.remove = gpio_fsm_remove,
++	.shutdown = gpio_fsm_shutdown,
++};
++
++static int gpio_fsm_init(void)
++{
++	int ret;
++
++	ret = class_register(&gpio_fsm_class);
++	if (ret)
++		return ret;
++
++	ret = platform_driver_register(&gpio_fsm_driver);
++	if (ret)
++		class_unregister(&gpio_fsm_class);
++
++	return ret;
++}
++module_init(gpio_fsm_init);
++
++static void gpio_fsm_exit(void)
++{
++	platform_driver_unregister(&gpio_fsm_driver);
++	class_unregister(&gpio_fsm_class);
++}
++module_exit(gpio_fsm_exit);
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Phil Elwell <phil@raspberrypi.com>");
++MODULE_DESCRIPTION("GPIO FSM driver");
++MODULE_ALIAS("platform:gpio-fsm");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0282-rpisense-fb-Set-pseudo_pallete-to-prevent-crash-on-f.patch b/target/linux/bcm27xx/patches-6.1/950-0282-rpisense-fb-Set-pseudo_pallete-to-prevent-crash-on-f.patch
new file mode 100644
index 00000000000000..65259496e17fe0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0282-rpisense-fb-Set-pseudo_pallete-to-prevent-crash-on-f.patch
@@ -0,0 +1,30 @@
+From 8c220240e2d5a76e67f2614e61770592364d8e4f Mon Sep 17 00:00:00 2001
+From: Serge Schneider <serge@raspberrypi.com>
+Date: Mon, 26 Oct 2020 16:38:21 +0000
+Subject: [PATCH] rpisense-fb: Set pseudo_pallete to prevent crash on
+ fbcon takeover
+
+Signed-off-by: Serge Schneider <serge@raspberrypi.com>
+---
+ drivers/video/fbdev/rpisense-fb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/video/fbdev/rpisense-fb.c
++++ b/drivers/video/fbdev/rpisense-fb.c
+@@ -52,6 +52,8 @@ static u8 gamma_low[32] = {0x00, 0x01, 0
+ 
+ static u8 gamma_user[32];
+ 
++static u32 pseudo_palette[16];
++
+ static struct rpisense_fb_param rpisense_fb_param = {
+ 	.vmem = NULL,
+ 	.vmemsize = 128,
+@@ -225,6 +227,7 @@ static int rpisense_fb_probe(struct plat
+ 	info->flags = FBINFO_FLAG_DEFAULT | FBINFO_VIRTFB;
+ 	info->screen_base = rpisense_fb_param.vmem;
+ 	info->screen_size = rpisense_fb_param.vmemsize;
++	info->pseudo_palette = pseudo_palette;
+ 
+ 	if (lowlight)
+ 		rpisense_fb_param.gamma = gamma_low;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0283-bcm2708_fb-Fix-a-build-warning.patch b/target/linux/bcm27xx/patches-6.1/950-0283-bcm2708_fb-Fix-a-build-warning.patch
new file mode 100644
index 00000000000000..18cf208df70383
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0283-bcm2708_fb-Fix-a-build-warning.patch
@@ -0,0 +1,22 @@
+From 67c4dc83131e335f92a142d3511b94db4a1dc57c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 27 Oct 2020 12:12:22 +0000
+Subject: [PATCH] bcm2708_fb: Fix a build warning
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/video/fbdev/bcm2708_fb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/video/fbdev/bcm2708_fb.c
++++ b/drivers/video/fbdev/bcm2708_fb.c
+@@ -693,7 +693,8 @@ static long vc_mem_copy(struct bcm2708_f
+ 		u8 *q = (u8 *)ioparam->dst + offset;
+ 
+ 		dma_memcpy(fb, bus_addr,
+-			   INTALIAS_L1L2_NONALLOCATING((dma_addr_t)p), size);
++			   INTALIAS_L1L2_NONALLOCATING((u32)(uintptr_t)p),
++						       size);
+ 		if (copy_to_user(q, buf, s) != 0) {
+ 			pr_err("[%s]: failed to copy-to-user\n", __func__);
+ 			rc = -EFAULT;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0284-watchdog-bcm2835-Ignore-params-after-the-partition-n.patch b/target/linux/bcm27xx/patches-6.1/950-0284-watchdog-bcm2835-Ignore-params-after-the-partition-n.patch
new file mode 100644
index 00000000000000..bf3ba2153e4d78
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0284-watchdog-bcm2835-Ignore-params-after-the-partition-n.patch
@@ -0,0 +1,29 @@
+From e26bdd060e7881989a553a1087b7c1e4227f3986 Mon Sep 17 00:00:00 2001
+From: Tim Gover <tim.gover@raspberrypi.org>
+Date: Thu, 22 Oct 2020 15:30:55 +0100
+Subject: [PATCH] watchdog: bcm2835: Ignore params after the partition
+ number
+
+Use sscanf to extract the partition number and ignore extra parameters
+which are only relevant to other reboot notifiers.
+---
+ drivers/watchdog/bcm2835_wdt.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/watchdog/bcm2835_wdt.c
++++ b/drivers/watchdog/bcm2835_wdt.c
+@@ -126,10 +126,12 @@ static int bcm2835_restart(struct watchd
+ {
+ 	struct bcm2835_wdt *wdt = watchdog_get_drvdata(wdog);
+ 
+-	unsigned long long val;
++	unsigned long val;
+ 	u8 partition = 0;
+ 
+-	if (data && !kstrtoull(data, 0, &val) && val <= 63)
++	// Allow extra arguments separated by spaces after
++	// the partition number.
++	if (data && sscanf(data, "%lu", &val) && val < 63)
+ 		partition = val;
+ 
+ 	__bcm2835_restart(wdt, partition);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0285-firmware-raspberrypi-Add-support-for-tryonce-reboot-.patch b/target/linux/bcm27xx/patches-6.1/950-0285-firmware-raspberrypi-Add-support-for-tryonce-reboot-.patch
new file mode 100644
index 00000000000000..42cb682e0bed62
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0285-firmware-raspberrypi-Add-support-for-tryonce-reboot-.patch
@@ -0,0 +1,60 @@
+From b31a82051bb9d4ba1c854df645a9195d3f00216f Mon Sep 17 00:00:00 2001
+From: Tim Gover <tim.gover@raspberrypi.com>
+Date: Tue, 20 Oct 2020 11:55:37 +0100
+Subject: [PATCH] firmware: raspberrypi: Add support for tryonce reboot
+ flag
+
+Define a new mailbox (SET_REBOOT_FLAGS) which may be used to
+pass optional flags to the Raspberry Pi firmware that changes
+the behaviour of the bootloader and firmware during a reboot.
+
+Currently this just defines the 'tryboot' flag which causes
+the firmware to load tryboot.txt instead config.txt. This
+alternate configuration file can be used to specify the
+path of an alternate firmware and kernels allowing a fallback
+mechanism to be implemented for OS upgrades.
+---
+ drivers/firmware/raspberrypi.c | 25 +++++++++++++++++++++++--
+ 1 file changed, 23 insertions(+), 2 deletions(-)
+
+--- a/drivers/firmware/raspberrypi.c
++++ b/drivers/firmware/raspberrypi.c
+@@ -193,6 +193,7 @@ static int rpi_firmware_notify_reboot(st
+ {
+ 	struct rpi_firmware *fw;
+ 	struct platform_device *pdev = g_pdev;
++	u32 reboot_flags = 0;
+ 
+ 	if (!pdev)
+ 		return 0;
+@@ -201,8 +202,28 @@ static int rpi_firmware_notify_reboot(st
+ 	if (!fw)
+ 		return 0;
+ 
+-	(void)rpi_firmware_property(fw, RPI_FIRMWARE_NOTIFY_REBOOT,
+-				    0, 0);
++	// The partition id is the first parameter followed by zero or
++	// more flags separated by spaces indicating the reason for the reboot.
++	//
++	// 'tryboot': Sets a one-shot flag which is cleared upon reboot and
++	//            causes the tryboot.txt to be loaded instead of config.txt
++	//            by the bootloader and the start.elf firmware.
++	//
++	//            This is intended to allow automatic fallback to a known
++	//            good image if an OS/FW upgrade fails.
++	//
++	// N.B. The firmware mechanism for storing reboot flags may vary
++	// on different Raspberry Pi models.
++	if (data && strstr(data, " tryboot"))
++		reboot_flags |= 0x1;
++
++	// The mailbox might have been called earlier, directly via vcmailbox
++	// so only overwrite if reboot flags are passed to the reboot command.
++	if (reboot_flags)
++		(void)rpi_firmware_property(fw, RPI_FIRMWARE_SET_REBOOT_FLAGS,
++				&reboot_flags, sizeof(reboot_flags));
++
++	(void)rpi_firmware_property(fw, RPI_FIRMWARE_NOTIFY_REBOOT, NULL, 0);
+ 
+ 	return 0;
+ }
diff --git a/target/linux/bcm27xx/patches-6.1/950-0286-phy-broadcom-split-out-the-BCM54213PE-from-the-BCM54.patch b/target/linux/bcm27xx/patches-6.1/950-0286-phy-broadcom-split-out-the-BCM54213PE-from-the-BCM54.patch
new file mode 100644
index 00000000000000..98f8350c4c9994
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0286-phy-broadcom-split-out-the-BCM54213PE-from-the-BCM54.patch
@@ -0,0 +1,71 @@
+From badc33cc4a789a51ccc5ab5e9efeb94c5dc306cd Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.org>
+Date: Tue, 14 May 2019 17:00:41 +0100
+Subject: [PATCH] phy: broadcom: split out the BCM54213PE from the
+ BCM54210E IDs
+
+The last nibble is a revision ID, and the 54213pe is a later rev
+than the 54210e. Running the 54210e setup code on a 54213pe results
+in a broken RGMII interface.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+---
+ drivers/net/phy/broadcom.c | 15 ++++++++++++---
+ include/linux/brcmphy.h    |  1 +
+ 2 files changed, 13 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -259,7 +259,8 @@ static void bcm54xx_adjust_rxrefclk(stru
+ 	    BRCM_PHY_MODEL(phydev) != PHY_ID_BCM50610M &&
+ 	    BRCM_PHY_MODEL(phydev) != PHY_ID_BCM54210E &&
+ 	    BRCM_PHY_MODEL(phydev) != PHY_ID_BCM54810 &&
+-	    BRCM_PHY_MODEL(phydev) != PHY_ID_BCM54811)
++	    BRCM_PHY_MODEL(phydev) != PHY_ID_BCM54811 &&
++	    BRCM_PHY_MODEL(phydev) != PHY_ID_BCM54213PE)
+ 		return;
+ 
+ 	val = bcm_phy_read_shadow(phydev, BCM54XX_SHD_SCR3);
+@@ -894,7 +895,7 @@ static struct phy_driver broadcom_driver
+ 	.link_change_notify	= bcm54xx_link_change_notify,
+ }, {
+ 	.phy_id		= PHY_ID_BCM54210E,
+-	.phy_id_mask	= 0xfffffff0,
++	.phy_id_mask	= 0xffffffff,
+ 	.name		= "Broadcom BCM54210E",
+ 	/* PHY_GBIT_FEATURES */
+ 	.get_sset_count	= bcm_phy_get_sset_count,
+@@ -908,6 +909,13 @@ static struct phy_driver broadcom_driver
+ 	.suspend	= bcm54xx_suspend,
+ 	.resume		= bcm54xx_resume,
+ }, {
++	.phy_id		= PHY_ID_BCM54213PE,
++	.phy_id_mask	= 0xffffffff,
++	.name		= "Broadcom BCM54213PE",
++	/* PHY_GBIT_FEATURES */
++	.config_init	= bcm54xx_config_init,
++	.config_intr	= bcm_phy_config_intr,
++}, {
+ 	.phy_id		= PHY_ID_BCM5461,
+ 	.phy_id_mask	= 0xfffffff0,
+ 	.name		= "Broadcom BCM5461",
+@@ -1142,7 +1150,8 @@ module_phy_driver(broadcom_drivers);
+ static struct mdio_device_id __maybe_unused broadcom_tbl[] = {
+ 	{ PHY_ID_BCM5411, 0xfffffff0 },
+ 	{ PHY_ID_BCM5421, 0xfffffff0 },
+-	{ PHY_ID_BCM54210E, 0xfffffff0 },
++	{ PHY_ID_BCM54210E, 0xffffffff },
++	{ PHY_ID_BCM54213PE, 0xffffffff },
+ 	{ PHY_ID_BCM5461, 0xfffffff0 },
+ 	{ PHY_ID_BCM54612E, 0xfffffff0 },
+ 	{ PHY_ID_BCM54616S, 0xfffffff0 },
+--- a/include/linux/brcmphy.h
++++ b/include/linux/brcmphy.h
+@@ -23,6 +23,7 @@
+ #define PHY_ID_BCM5411			0x00206070
+ #define PHY_ID_BCM5421			0x002060e0
+ #define PHY_ID_BCM54210E		0x600d84a0
++#define PHY_ID_BCM54213PE		0x600d84a2
+ #define PHY_ID_BCM5464			0x002060b0
+ #define PHY_ID_BCM5461			0x002060c0
+ #define PHY_ID_BCM54612E		0x03625e60
diff --git a/target/linux/bcm27xx/patches-6.1/950-0287-phy-broadcom-Add-bcm54213pe-configuration.patch b/target/linux/bcm27xx/patches-6.1/950-0287-phy-broadcom-Add-bcm54213pe-configuration.patch
new file mode 100644
index 00000000000000..43b834fb2b22c6
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0287-phy-broadcom-Add-bcm54213pe-configuration.patch
@@ -0,0 +1,34 @@
+From 7fc56014c11971304af9cc33609ca88fed6f272b Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 29 Oct 2020 14:10:56 +0000
+Subject: [PATCH] phy: broadcom: Add bcm54213pe configuration
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/phy/broadcom.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -88,6 +88,11 @@ static int bcm54210e_config_init(struct
+ 	return 0;
+ }
+ 
++static int bcm54213pe_config_init(struct phy_device *phydev)
++{
++	return bcm54210e_config_init(phydev);
++}
++
+ static int bcm54612e_config_init(struct phy_device *phydev)
+ {
+ 	int reg;
+@@ -378,6 +383,9 @@ static int bcm54xx_config_init(struct ph
+ 	case PHY_ID_BCM54612E:
+ 		err = bcm54612e_config_init(phydev);
+ 		break;
++	case PHY_ID_BCM54213PE:
++		err = bcm54213pe_config_init(phydev);
++		break;
+ 	case PHY_ID_BCM54616S:
+ 		err = bcm54616s_config_init(phydev);
+ 		break;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0288-PCI-brcmstb-Restore-initial-fundamental-reset.patch b/target/linux/bcm27xx/patches-6.1/950-0288-PCI-brcmstb-Restore-initial-fundamental-reset.patch
new file mode 100644
index 00000000000000..823c3561bacdf0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0288-PCI-brcmstb-Restore-initial-fundamental-reset.patch
@@ -0,0 +1,35 @@
+From 15a3f19fc1235e656abd874575ed242a2330aa03 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 11 Nov 2020 17:08:33 +0000
+Subject: [PATCH] PCI: brcmstb: Restore initial fundamental reset
+
+[1] replaced a single reset function with a pointer to one of two
+implementations, but also removed the call asserting the reset
+at the start of brcm_pcie_setup. Doing so breaks Raspberry Pis with
+VL805 XHCI controllers lacking dedicated SPI EEPROMs, which have been
+used for USB booting but then need to be reset so that the kernel
+can reconfigure them. The lack of a reset causes the firmware's loading
+of the EEPROM image to RAM to fail, breaking USB for the kernel.
+
+See: https://www.raspberrypi.org/forums/viewtopic.php?p=1758157#p1758157
+
+Fixes: 04356ac30771 ("PCI: brcmstb: Add bcm7278 PERST# support")
+
+[1] 04356ac30771 ("PCI: brcmstb: Add bcm7278 PERST# support")
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/pci/controller/pcie-brcmstb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/pci/controller/pcie-brcmstb.c
++++ b/drivers/pci/controller/pcie-brcmstb.c
+@@ -877,6 +877,8 @@ static int brcm_pcie_setup(struct brcm_p
+ 
+ 	/* Reset the bridge */
+ 	pcie->bridge_sw_init_set(pcie, 1);
++	pcie->perst_set(pcie, 1);
++
+ 	usleep_range(100, 200);
+ 
+ 	/* Take the bridge out of reset */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0289-Input-edt-ft5x06-Poll-the-device-if-no-interrupt-is-.patch b/target/linux/bcm27xx/patches-6.1/950-0289-Input-edt-ft5x06-Poll-the-device-if-no-interrupt-is-.patch
new file mode 100644
index 00000000000000..cabd47db5148be
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0289-Input-edt-ft5x06-Poll-the-device-if-no-interrupt-is-.patch
@@ -0,0 +1,98 @@
+From fa1cfb50169f27443a7fe0d5d9ad3ec77ba6b8c8 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 6 Nov 2020 18:45:10 +0000
+Subject: [PATCH] Input: edt-ft5x06: Poll the device if no interrupt is
+ configured.
+
+Not all systems have the interrupt line wired up, so switch to
+polling the touchscreen off a timer if no interrupt line is
+configured.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/input/touchscreen/edt-ft5x06.c | 51 +++++++++++++++++++++-----
+ 1 file changed, 41 insertions(+), 10 deletions(-)
+
+--- a/drivers/input/touchscreen/edt-ft5x06.c
++++ b/drivers/input/touchscreen/edt-ft5x06.c
+@@ -75,6 +75,8 @@
+ #define EDT_DEFAULT_NUM_X		1024
+ #define EDT_DEFAULT_NUM_Y		1024
+ 
++#define POLL_INTERVAL_MS		17	/* 17ms = 60fps */
++
+ enum edt_pmode {
+ 	EDT_PMODE_NOT_SUPPORTED,
+ 	EDT_PMODE_HIBERNATE,
+@@ -136,6 +138,9 @@ struct edt_ft5x06_ts_data {
+ 	enum edt_ver version;
+ 	unsigned int crc_errors;
+ 	unsigned int header_errors;
++
++	struct timer_list timer;
++	struct work_struct work_i2c_poll;
+ };
+ 
+ struct edt_i2c_chip_data {
+@@ -287,6 +292,22 @@ out:
+ 	return IRQ_HANDLED;
+ }
+ 
++static void edt_ft5x06_ts_irq_poll_timer(struct timer_list *t)
++{
++	struct edt_ft5x06_ts_data *tsdata = from_timer(tsdata, t, timer);
++
++	schedule_work(&tsdata->work_i2c_poll);
++	mod_timer(&tsdata->timer, jiffies + msecs_to_jiffies(POLL_INTERVAL_MS));
++}
++
++static void edt_ft5x06_ts_work_i2c_poll(struct work_struct *work)
++{
++	struct edt_ft5x06_ts_data *tsdata = container_of(work,
++			struct edt_ft5x06_ts_data, work_i2c_poll);
++
++	edt_ft5x06_ts_isr(0, tsdata);
++}
++
+ static int edt_ft5x06_register_write(struct edt_ft5x06_ts_data *tsdata,
+ 				     u8 addr, u8 value)
+ {
+@@ -1314,17 +1335,27 @@ static int edt_ft5x06_ts_probe(struct i2
+ 
+ 	i2c_set_clientdata(client, tsdata);
+ 
+-	irq_flags = irq_get_trigger_type(client->irq);
+-	if (irq_flags == IRQF_TRIGGER_NONE)
+-		irq_flags = IRQF_TRIGGER_FALLING;
+-	irq_flags |= IRQF_ONESHOT;
+-
+-	error = devm_request_threaded_irq(&client->dev, client->irq,
+-					NULL, edt_ft5x06_ts_isr, irq_flags,
+-					client->name, tsdata);
+-	if (error) {
+-		dev_err(&client->dev, "Unable to request touchscreen IRQ.\n");
+-		return error;
++	if (client->irq) {
++		irq_flags = irq_get_trigger_type(client->irq);
++		if (irq_flags == IRQF_TRIGGER_NONE)
++			irq_flags = IRQF_TRIGGER_FALLING;
++		irq_flags |= IRQF_ONESHOT;
++
++		error = devm_request_threaded_irq(&client->dev, client->irq,
++						  NULL, edt_ft5x06_ts_isr,
++						  irq_flags, client->name,
++						  tsdata);
++		if (error) {
++			dev_err(&client->dev, "Unable to request touchscreen IRQ.\n");
++			return error;
++		}
++	} else {
++		INIT_WORK(&tsdata->work_i2c_poll,
++			  edt_ft5x06_ts_work_i2c_poll);
++		timer_setup(&tsdata->timer, edt_ft5x06_ts_irq_poll_timer, 0);
++		tsdata->timer.expires = jiffies +
++					msecs_to_jiffies(POLL_INTERVAL_MS);
++		add_timer(&tsdata->timer);
+ 	}
+ 
+ 	error = devm_device_add_group(&client->dev, &edt_ft5x06_attr_group);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0290-drm-panel-raspberrypi-touchscreen-Use-independent-I2.patch b/target/linux/bcm27xx/patches-6.1/950-0290-drm-panel-raspberrypi-touchscreen-Use-independent-I2.patch
new file mode 100644
index 00000000000000..9cbcd81546e598
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0290-drm-panel-raspberrypi-touchscreen-Use-independent-I2.patch
@@ -0,0 +1,58 @@
+From 7aebec709ea87dafb9776895c4c2626a659e043c Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 23 Apr 2020 10:17:18 +0100
+Subject: [PATCH] drm/panel/raspberrypi-touchscreen: Use independent
+ I2C actions with delay.
+
+We now have the hardware I2C controller pinmuxed to the drive the
+display I2C, but this controller does not support clock stretching.
+The Atmel micro-controller in the panel requires clock stretching
+to allow it to prepare any data to be read.
+
+Split the rpi_touchscreen_i2c_read into two independent transactions with
+a delay between them for the Atmel to prepare the data.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../drm/panel/panel-raspberrypi-touchscreen.c | 30 ++++++++++++++++++-
+ 1 file changed, 29 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
++++ b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
+@@ -220,7 +220,35 @@ static struct rpi_touchscreen *panel_to_
+ 
+ static int rpi_touchscreen_i2c_read(struct rpi_touchscreen *ts, u8 reg)
+ {
+-	return i2c_smbus_read_byte_data(ts->i2c, reg);
++	struct i2c_client *client = ts->i2c;
++	struct i2c_msg msgs[1];
++	u8 addr_buf[1] = { reg };
++	u8 data_buf[1] = { 0, };
++	int ret;
++
++	/* Write register address */
++	msgs[0].addr = client->addr;
++	msgs[0].flags = 0;
++	msgs[0].len = ARRAY_SIZE(addr_buf);
++	msgs[0].buf = addr_buf;
++
++	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++	if (ret != ARRAY_SIZE(msgs))
++		return -EIO;
++
++	usleep_range(100, 300);
++
++	/* Read data from register */
++	msgs[0].addr = client->addr;
++	msgs[0].flags = I2C_M_RD;
++	msgs[0].len = 1;
++	msgs[0].buf = data_buf;
++
++	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++	if (ret != ARRAY_SIZE(msgs))
++		return -EIO;
++
++	return data_buf[0];
+ }
+ 
+ static void rpi_touchscreen_i2c_write(struct rpi_touchscreen *ts,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0291-drm-panel-raspberrypi-ts-Insert-delay-before-polling.patch b/target/linux/bcm27xx/patches-6.1/950-0291-drm-panel-raspberrypi-ts-Insert-delay-before-polling.patch
new file mode 100644
index 00000000000000..60da18201e5df3
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0291-drm-panel-raspberrypi-ts-Insert-delay-before-polling.patch
@@ -0,0 +1,26 @@
+From 907a9f57cd845d274e75e44540c667bcf69819be Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 10 Nov 2020 11:21:56 +0000
+Subject: [PATCH] drm/panel/raspberrypi-ts: Insert delay before polling
+ for startup state
+
+In switching to the hardware I2C controller there is an issue
+where we seem to not get back the correct state from the Pi
+touchscreen.
+Insert a delay before polling to avoid this condition.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
++++ b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
+@@ -300,6 +300,7 @@ static int rpi_touchscreen_prepare(struc
+ 	int i;
+ 
+ 	rpi_touchscreen_i2c_write(ts, REG_POWERON, 1);
++	usleep_range(20000, 25000);
+ 	/* Wait for nPWRDWN to go low to indicate poweron is done. */
+ 	for (i = 0; i < 100; i++) {
+ 		if (rpi_touchscreen_i2c_read(ts, REG_PORTB) & 1)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0292-dt-bindings-Add-compatible-for-BCM2711-DSI1.patch b/target/linux/bcm27xx/patches-6.1/950-0292-dt-bindings-Add-compatible-for-BCM2711-DSI1.patch
new file mode 100644
index 00000000000000..88dcdc407ee71e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0292-dt-bindings-Add-compatible-for-BCM2711-DSI1.patch
@@ -0,0 +1,23 @@
+From 38a41d4c6e4103377bd3e31e068d8e06e2aa678d Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 12 Nov 2020 17:01:52 +0000
+Subject: [PATCH] dt-bindings: Add compatible for BCM2711 DSI1
+
+DSI1 on BCM2711 doesn't require the DMA workaround that is used
+on BCM2835/6/7, therefore it needs a new compatible string.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ Documentation/devicetree/bindings/display/brcm,bcm2835-dsi0.yaml | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/Documentation/devicetree/bindings/display/brcm,bcm2835-dsi0.yaml
++++ b/Documentation/devicetree/bindings/display/brcm,bcm2835-dsi0.yaml
+@@ -21,6 +21,7 @@ properties:
+       - brcm,bcm2711-dsi1
+       - brcm,bcm2835-dsi0
+       - brcm,bcm2835-dsi1
++      - brcm,bcm2711-dsi1
+ 
+   reg:
+     maxItems: 1
diff --git a/target/linux/bcm27xx/patches-6.1/950-0293-media-bcm2835-unicam-Correctly-handle-error-propagat.patch b/target/linux/bcm27xx/patches-6.1/950-0293-media-bcm2835-unicam-Correctly-handle-error-propagat.patch
new file mode 100644
index 00000000000000..bec1b9466dd5cb
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0293-media-bcm2835-unicam-Correctly-handle-error-propagat.patch
@@ -0,0 +1,27 @@
+From 29f208db181f1b557b7b55fae12a796b8669b004 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Wed, 2 Dec 2020 15:22:23 +0000
+Subject: [PATCH] media: bcm2835-unicam: Correctly handle error
+ propagation for stream on
+
+On a failure in start_streaming(), the error code would not propagate to
+the calling function on all conditions. This would cause the userland
+caller to not know of the failure.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -1732,8 +1732,7 @@ err_disable_unicam:
+ 	unicam_disable(dev);
+ 	clk_disable_unprepare(dev->clock);
+ err_vpu_clock:
+-	ret = clk_set_min_rate(dev->vpu_clock, 0);
+-	if (ret)
++	if (clk_set_min_rate(dev->vpu_clock, 0))
+ 		unicam_err(dev, "failed to reset the VPU clock\n");
+ 	clk_disable_unprepare(dev->vpu_clock);
+ err_pm_put:
diff --git a/target/linux/bcm27xx/patches-6.1/950-0294-media-bcm2835-unicam-Return-early-from-stop_streamin.patch b/target/linux/bcm27xx/patches-6.1/950-0294-media-bcm2835-unicam-Return-early-from-stop_streamin.patch
new file mode 100644
index 00000000000000..5ca99e35328536
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0294-media-bcm2835-unicam-Return-early-from-stop_streamin.patch
@@ -0,0 +1,64 @@
+From 08d1267f1a93cbb44c7a7b71ce5f448d22ea5bdc Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Wed, 2 Dec 2020 15:26:09 +0000
+Subject: [PATCH] media: bcm2835-unicam: Return early from
+ stop_streaming() if stopped
+
+clk_disable_unprepare() is called unconditionally in stop_streaming().
+This is incorrect in the cases where start_streaming() fails, and
+unprepares all clocks as part of the failure cleanup. To avoid this,
+ensure that clk_disable_unprepare() is only called in stop_streaming()
+if the clocks are in a prepared state.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -428,6 +428,8 @@ struct unicam_device {
+ 	struct clk *clock;
+ 	/* vpu clock handle */
+ 	struct clk *vpu_clock;
++	/* clock status for error handling */
++	bool clocks_enabled;
+ 	/* V4l2 device */
+ 	struct v4l2_device v4l2_dev;
+ 	struct media_device mdev;
+@@ -1726,6 +1728,7 @@ static int unicam_start_streaming(struct
+ 		goto err_disable_unicam;
+ 	}
+ 
++	dev->clocks_enabled = true;
+ 	return 0;
+ 
+ err_disable_unicam:
+@@ -1752,8 +1755,6 @@ static void unicam_stop_streaming(struct
+ 	node->streaming = false;
+ 
+ 	if (node->pad_id == IMAGE_PAD) {
+-		int ret;
+-
+ 		/*
+ 		 * Stop streaming the sensor and disable the peripheral.
+ 		 * We cannot continue streaming embedded data with the
+@@ -1764,12 +1765,13 @@ static void unicam_stop_streaming(struct
+ 
+ 		unicam_disable(dev);
+ 
+-		ret = clk_set_min_rate(dev->vpu_clock, 0);
+-		if (ret)
+-			unicam_err(dev, "failed to reset the min VPU clock\n");
++		if (dev->clocks_enabled) {
++			if (clk_set_min_rate(dev->vpu_clock, 0))
++				unicam_err(dev, "failed to reset the min VPU clock\n");
+ 
+-		clk_disable_unprepare(dev->vpu_clock);
+-		clk_disable_unprepare(dev->clock);
++			clk_disable_unprepare(dev->vpu_clock);
++			clk_disable_unprepare(dev->clock);
++		}
+ 		unicam_runtime_put(dev);
+ 
+ 	} else if (node->pad_id == METADATA_PAD) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0295-media-bcm2835-unicam-Clear-clock-state-when-stopping.patch b/target/linux/bcm27xx/patches-6.1/950-0295-media-bcm2835-unicam-Clear-clock-state-when-stopping.patch
new file mode 100644
index 00000000000000..39cff828ba5f01
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0295-media-bcm2835-unicam-Clear-clock-state-when-stopping.patch
@@ -0,0 +1,25 @@
+From baca14dab127d65b4383fb1f59289a1e470026c2 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Wed, 2 Dec 2020 16:48:41 +0000
+Subject: [PATCH] media: bcm2835-unicam: Clear clock state when
+ stopping streaming
+
+Commit 65e08c465020d4c5b51afb452efc2246d80fd66f failed to clear the
+clock state when the device stopped streaming. Fix this, as it might
+again cause the same problems when doing an unprepare.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -1771,6 +1771,7 @@ static void unicam_stop_streaming(struct
+ 
+ 			clk_disable_unprepare(dev->vpu_clock);
+ 			clk_disable_unprepare(dev->clock);
++			dev->clocks_enabled = false;
+ 		}
+ 		unicam_runtime_put(dev);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0296-PCI-brcmstb-Advertise-MSI-X-support.patch b/target/linux/bcm27xx/patches-6.1/950-0296-PCI-brcmstb-Advertise-MSI-X-support.patch
new file mode 100644
index 00000000000000..11399af894408b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0296-PCI-brcmstb-Advertise-MSI-X-support.patch
@@ -0,0 +1,27 @@
+From 1fe9084417e493060504f0d7950737bf7cae5390 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 3 Dec 2020 13:44:42 +0000
+Subject: [PATCH] PCI: brcmstb: Advertise MSI-X support
+
+Although the BRCMSTB PCIe interface doesn't technically support the
+MSI-X spec, in practise it seems to work provided no more than 32
+MSI-Xs are required. Add the required flag to the driver to allow
+experimentation with devices that demand MSI-X support.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/pci/controller/pcie-brcmstb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/controller/pcie-brcmstb.c
++++ b/drivers/pci/controller/pcie-brcmstb.c
+@@ -447,7 +447,8 @@ static struct irq_chip brcm_msi_irq_chip
+ 
+ static struct msi_domain_info brcm_msi_domain_info = {
+ 	/* Multi MSI is supported by the controller, but not by this driver */
+-	.flags	= (MSI_FLAG_USE_DEF_DOM_OPS | MSI_FLAG_USE_DEF_CHIP_OPS),
++	.flags	= (MSI_FLAG_USE_DEF_DOM_OPS | MSI_FLAG_USE_DEF_CHIP_OPS |
++		   MSI_FLAG_PCI_MSIX),
+ 	.chip	= &brcm_msi_irq_chip,
+ };
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0297-net-lan78xx-Ack-pending-PHY-ints-when-resetting.patch b/target/linux/bcm27xx/patches-6.1/950-0297-net-lan78xx-Ack-pending-PHY-ints-when-resetting.patch
new file mode 100644
index 00000000000000..f5f9cc7b59c84f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0297-net-lan78xx-Ack-pending-PHY-ints-when-resetting.patch
@@ -0,0 +1,32 @@
+From 1b226af70680dc2849aeb60d930180ad62ceb3c5 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 15 Dec 2020 16:38:37 +0000
+Subject: [PATCH] net: lan78xx: Ack pending PHY ints when resetting
+
+lan78xx_link_reset explicitly clears the MAC's view of the PHY's IRQ
+status. In doing so it potentially leaves the PHY with a pending
+interrupt that will never be acknowledged, at which point no further
+interrupts will be generated.
+
+Avoid the problem by acknowledging any pending PHY interrupt after
+clearing the MAC's status bit.
+
+See: https://github.com/raspberrypi/linux/issues/2937
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/usb/lan78xx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -1440,6 +1440,9 @@ static int lan78xx_link_reset(struct lan
+ 	if (unlikely(ret < 0))
+ 		return ret;
+ 
++	/* Acknowledge any pending PHY interrupt, lest it be the last */
++	phy_read(phydev, LAN88XX_INT_STS);
++
+ 	mutex_lock(&phydev->lock);
+ 	phy_read_status(phydev);
+ 	link = phydev->link;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0298-vc-sm-cma-fixed-kbuild-problem.patch b/target/linux/bcm27xx/patches-6.1/950-0298-vc-sm-cma-fixed-kbuild-problem.patch
new file mode 100644
index 00000000000000..f312344650635c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0298-vc-sm-cma-fixed-kbuild-problem.patch
@@ -0,0 +1,30 @@
+From 1b1b4dc2eab45b425c60c708ca98086f3584b9d0 Mon Sep 17 00:00:00 2001
+From: gesangtome <gesangtome@foxmail.com>
+Date: Fri, 1 Jan 2021 18:03:17 +0800
+Subject: [PATCH] vc-sm-cma: fixed kbuild problem
+
+error logs:
+  drivers/staging/vc04_services/vc-sm-cma/Kconfig:1:error: recursive dependency detected!
+  drivers/staging/vc04_services/vc-sm-cma/Kconfig:1:      symbol BCM_VC_SM_CMA is selected by BCM2835_VCHIQ_MMAL
+  drivers/staging/vc04_services/vchiq-mmal/Kconfig:1:     symbol BCM2835_VCHIQ_MMAL depends on BCM2835_VCHIQ
+  drivers/staging/vc04_services/Kconfig:14:       symbol BCM2835_VCHIQ is selected by BCM_VC_SM_CMA
+  For a resolution refer to Documentation/kbuild/kconfig-language.rst
+  subsection "Kconfig recursive dependency limitations"
+
+Tested-by: make ARCH=arm64 bcm2711_defconfig
+Test platform: fedora 33
+Branch: rpi-5.10.y
+---
+ drivers/staging/vc04_services/vchiq-mmal/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/Kconfig
++++ b/drivers/staging/vc04_services/vchiq-mmal/Kconfig
+@@ -1,6 +1,6 @@
+ config BCM2835_VCHIQ_MMAL
+ 	tristate "BCM2835 MMAL VCHIQ service"
+-	depends on BCM2835_VCHIQ
++	select BCM2835_VCHIQ
+ 	select BCM_VC_SM_CMA
+ 	help
+ 	  Enables the MMAL API over VCHIQ interface as used for the
diff --git a/target/linux/bcm27xx/patches-6.1/950-0299-staging-vc04_services-Add-additional-unpacked-raw-fo.patch b/target/linux/bcm27xx/patches-6.1/950-0299-staging-vc04_services-Add-additional-unpacked-raw-fo.patch
new file mode 100644
index 00000000000000..507479c1db418c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0299-staging-vc04_services-Add-additional-unpacked-raw-fo.patch
@@ -0,0 +1,51 @@
+From e2630c03cdefa8d4fedfa35aebad776b9b17946f Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 7 Jan 2021 10:43:20 +0000
+Subject: [PATCH] staging/vc04_services: Add additional unpacked raw
+ formats
+
+Support has been added for the unpacked (16bpp) versions of
+the MIPI raw 10, 12, and 14 formats, so add the 4CCs for them.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../vc04_services/vchiq-mmal/mmal-encodings.h | 22 +++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
+@@ -102,12 +102,34 @@
+ #define MMAL_ENCODING_BAYER_SGRBG16    MMAL_FOURCC('G', 'R', '1', '6')
+ #define MMAL_ENCODING_BAYER_SRGGB16    MMAL_FOURCC('R', 'G', '1', '6')
+ 
++/* 10 bit per pixel unpacked (16bit) Bayer formats. */
++#define MMAL_ENCODING_BAYER_SBGGR10    MMAL_FOURCC('B', 'G', '1', '0')
++#define MMAL_ENCODING_BAYER_SGRBG10    MMAL_FOURCC('B', 'A', '1', '0')
++#define MMAL_ENCODING_BAYER_SGBRG10    MMAL_FOURCC('G', 'B', '1', '0')
++#define MMAL_ENCODING_BAYER_SRGGB10    MMAL_FOURCC('R', 'G', '1', '0')
++
++/* 12 bit per pixel unpacked (16bit) Bayer formats */
++#define MMAL_ENCODING_BAYER_SBGGR12    MMAL_FOURCC('B', 'G', '1', '2')
++#define MMAL_ENCODING_BAYER_SGRBG12    MMAL_FOURCC('B', 'A', '1', '2')
++#define MMAL_ENCODING_BAYER_SGBRG12    MMAL_FOURCC('G', 'B', '1', '2')
++#define MMAL_ENCODING_BAYER_SRGGB12    MMAL_FOURCC('R', 'G', '1', '2')
++
++/* 14 bit per pixel unpacked (16bit) Bayer formats */
++#define MMAL_ENCODING_BAYER_SBGGR14    MMAL_FOURCC('B', 'G', '1', '4')
++#define MMAL_ENCODING_BAYER_SGBRG14    MMAL_FOURCC('G', 'B', '1', '4')
++#define MMAL_ENCODING_BAYER_SGRBG14    MMAL_FOURCC('G', 'R', '1', '4')
++#define MMAL_ENCODING_BAYER_SRGGB14    MMAL_FOURCC('R', 'G', '1', '4')
++
+ /* MIPI packed monochrome images */
+ #define MMAL_ENCODING_GREY    MMAL_FOURCC('G', 'R', 'E', 'Y')
+ #define MMAL_ENCODING_Y10P    MMAL_FOURCC('Y', '1', '0', 'P')
+ #define MMAL_ENCODING_Y12P    MMAL_FOURCC('Y', '1', '2', 'P')
+ #define MMAL_ENCODING_Y14P    MMAL_FOURCC('Y', '1', '4', 'P')
+ #define MMAL_ENCODING_Y16     MMAL_FOURCC('Y', '1', '6', ' ')
++/* Unpacked monochrome formats (16bit per sample, but only N LSBs used) */
++#define MMAL_ENCODING_Y10     MMAL_FOURCC('Y', '1', '0', ' ')
++#define MMAL_ENCODING_Y12     MMAL_FOURCC('Y', '1', '2', ' ')
++#define MMAL_ENCODING_Y14     MMAL_FOURCC('Y', '1', '4', ' ')
+ 
+ /** An EGL image handle
+  */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0300-staging-bcm2835-isp-Add-the-unpacked-16bpp-raw-forma.patch b/target/linux/bcm27xx/patches-6.1/950-0300-staging-bcm2835-isp-Add-the-unpacked-16bpp-raw-forma.patch
new file mode 100644
index 00000000000000..d0e9c75e7acb62
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0300-staging-bcm2835-isp-Add-the-unpacked-16bpp-raw-forma.patch
@@ -0,0 +1,174 @@
+From 5a6d41213c9415d999ac06f0e985ceeb4d4c1159 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 7 Jan 2021 11:37:10 +0000
+Subject: [PATCH] staging/bcm2835-isp: Add the unpacked (16bpp) raw
+ formats
+
+Now that the firmware supports the unpacked (16bpp) variants
+of the MIPI raw formats, add the mappings.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../bcm2835-isp/bcm2835-isp-fmts.h            | 127 ++++++++++++++++++
+ .../bcm2835-isp/bcm2835-v4l2-isp.c            |   4 +-
+ 2 files changed, 129 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-fmts.h
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-fmts.h
+@@ -298,6 +298,106 @@ static const struct bcm2835_isp_fmt supp
+ 		.colorspace	    = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
++		/* Bayer formats unpacked to 16bpp */
++		/* 10 bit */
++		.fourcc		    = V4L2_PIX_FMT_SRGGB10,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB10,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SBGGR10,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR10,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGRBG10,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG10,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGBRG10,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG10,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 12 bit */
++		.fourcc		    = V4L2_PIX_FMT_SRGGB12,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB12,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SBGGR12,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR12,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGRBG12,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG12,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGBRG12,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG12,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 14 bit */
++		.fourcc		    = V4L2_PIX_FMT_SRGGB14,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB14,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SBGGR14,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR14,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGRBG14,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG14,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGBRG14,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG14,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
+ 		/* Monochrome MIPI formats */
+ 		/* 8 bit */
+ 		.fourcc		    = V4L2_PIX_FMT_GREY,
+@@ -343,6 +443,33 @@ static const struct bcm2835_isp_fmt supp
+ 		.size_multiplier_x2 = 2,
+ 		.colorspace	    = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
++	}, {
++		/* 10 bit as 16bpp */
++		.fourcc		    = V4L2_PIX_FMT_Y10,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_Y10,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 12 bit as 16bpp */
++		.fourcc		    = V4L2_PIX_FMT_Y12,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_Y12,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 14 bit as 16bpp */
++		.fourcc		    = V4L2_PIX_FMT_Y14,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_Y14,
++		.size_multiplier_x2 = 2,
++		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_META_FMT_BCM2835_ISP_STATS,
+ 		.mmal_fmt	    = MMAL_ENCODING_BRCM_STATS,
+--- a/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
+@@ -1148,11 +1148,11 @@ static const struct v4l2_ioctl_ops bcm28
+  * Size of the array to provide to the VPU when asking for the list of supported
+  * formats.
+  *
+- * The ISP component currently advertises 44 input formats, so add a small
++ * The ISP component currently advertises 62 input formats, so add a small
+  * overhead on that. Should the component advertise more formats then the excess
+  * will be dropped and a warning logged.
+  */
+-#define MAX_SUPPORTED_ENCODINGS 50
++#define MAX_SUPPORTED_ENCODINGS 70
+ 
+ /* Populate node->supported_fmts with the formats supported by those ports. */
+ static int bcm2835_isp_get_supported_fmts(struct bcm2835_isp_node *node)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0301-staging-bcm2835-isp-Log-the-number-of-excess-support.patch b/target/linux/bcm27xx/patches-6.1/950-0301-staging-bcm2835-isp-Log-the-number-of-excess-support.patch
new file mode 100644
index 00000000000000..03b179debbc311
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0301-staging-bcm2835-isp-Log-the-number-of-excess-support.patch
@@ -0,0 +1,29 @@
+From 13deccb4bf26bec443f7c05001f0e4b52a5a71f7 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 7 Jan 2021 11:43:22 +0000
+Subject: [PATCH] staging/bcm2835-isp: Log the number of excess
+ supported formats
+
+When logging that the firmware has provided more supported formats
+than we had allocated storage for, log the number allocated and
+returned.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
+@@ -1171,8 +1171,9 @@ static int bcm2835_isp_get_supported_fmt
+ 	if (ret) {
+ 		if (ret == MMAL_MSG_STATUS_ENOSPC) {
+ 			v4l2_err(&dev->v4l2_dev,
+-				 "%s: port has more encoding than we provided space for. Some are dropped.\n",
+-				 __func__);
++				 "%s: port has more encodings than we provided space for. Some are dropped (%u vs %u).\n",
++				 __func__, param_size / sizeof(u32),
++				 MAX_SUPPORTED_ENCODINGS);
+ 			num_encodings = MAX_SUPPORTED_ENCODINGS;
+ 		} else {
+ 			v4l2_err(&dev->v4l2_dev, "%s: get_param ret %u.\n",
diff --git a/target/linux/bcm27xx/patches-6.1/950-0302-bcm2835-dma-Avoid-losing-CS-flags-after-interrupt.patch b/target/linux/bcm27xx/patches-6.1/950-0302-bcm2835-dma-Avoid-losing-CS-flags-after-interrupt.patch
new file mode 100644
index 00000000000000..2ad0ddf4058cb6
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0302-bcm2835-dma-Avoid-losing-CS-flags-after-interrupt.patch
@@ -0,0 +1,21 @@
+From 79cd7c76a0274395ce5db44488fcea22dfeee6d3 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Wed, 6 Jan 2021 18:16:10 +0000
+Subject: [PATCH] bcm2835-dma: Avoid losing CS flags after interrupt
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/dma/bcm2835-dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -704,7 +704,7 @@ static irqreturn_t bcm2835_dma_callback(
+ 	 * if this IRQ handler is threaded.) If the channel is finished, it
+ 	 * will remain idle despite the ACTIVE flag being set.
+ 	 */
+-	writel(BCM2835_DMA_INT | BCM2835_DMA_ACTIVE,
++	writel(BCM2835_DMA_INT | BCM2835_DMA_ACTIVE | BCM2835_DMA_CS_FLAGS(c->dreq),
+ 	       c->chan_base + BCM2835_DMA_CS);
+ 
+ 	d = c->desc;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0303-bcm2835-dma-Add-bcm2835-dma-Add-DMA_WIDE_SOURCE-and-.patch b/target/linux/bcm27xx/patches-6.1/950-0303-bcm2835-dma-Add-bcm2835-dma-Add-DMA_WIDE_SOURCE-and-.patch
new file mode 100644
index 00000000000000..33b6ace7aebee6
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0303-bcm2835-dma-Add-bcm2835-dma-Add-DMA_WIDE_SOURCE-and-.patch
@@ -0,0 +1,64 @@
+From 153c92ec4e0364c12f99e39106dc79e5b7167cac Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Wed, 30 Dec 2020 14:51:29 +0000
+Subject: [PATCH] bcm2835-dma: Add bcm2835-dma: Add DMA_WIDE_SOURCE and
+ DMA_WIDE_DEST flags
+
+Use (reserved) bits 24 and 25 of the dreq value
+(the second cell of the DT DMA descriptor) to request
+that wide source reads or wide dest writes are required
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/dma/bcm2835-dma.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -171,6 +171,17 @@ struct bcm2835_desc {
+ #define WAIT_RESP(x) ((x & BCM2835_DMA_NO_WAIT_RESP) ? \
+ 		      0 : BCM2835_DMA_WAIT_RESP)
+ 
++/* A fake bit to request that the driver requires wide reads */
++#define BCM2835_DMA_WIDE_SOURCE BIT(24)
++#define WIDE_SOURCE(x) ((x & BCM2835_DMA_WIDE_SOURCE) ? \
++		      BCM2835_DMA_S_WIDTH : 0)
++
++/* A fake bit to request that the driver requires wide writes */
++#define BCM2835_DMA_WIDE_DEST BIT(25)
++#define WIDE_DEST(x) ((x & BCM2835_DMA_WIDE_DEST) ? \
++		      BCM2835_DMA_D_WIDTH : 0)
++
++
+ /* debug register bits */
+ #define BCM2835_DMA_DEBUG_LAST_NOT_SET_ERR	BIT(0)
+ #define BCM2835_DMA_DEBUG_FIFO_ERR		BIT(1)
+@@ -850,7 +861,8 @@ static struct dma_async_tx_descriptor *b
+ {
+ 	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+ 	struct bcm2835_desc *d;
+-	u32 info = BCM2835_DMA_D_INC | BCM2835_DMA_S_INC;
++	u32 info = BCM2835_DMA_D_INC | BCM2835_DMA_S_INC |
++		   WIDE_SOURCE(c->dreq) | WIDE_DEST(c->dreq);
+ 	u32 extra = BCM2835_DMA_INT_EN | WAIT_RESP(c->dreq);
+ 	size_t max_len = bcm2835_dma_max_frame_length(c);
+ 	size_t frames;
+@@ -881,7 +893,8 @@ static struct dma_async_tx_descriptor *b
+ 	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+ 	struct bcm2835_desc *d;
+ 	dma_addr_t src = 0, dst = 0;
+-	u32 info = WAIT_RESP(c->dreq);
++	u32 info = WAIT_RESP(c->dreq) |
++		   WIDE_SOURCE(c->dreq) | WIDE_DEST(c->dreq);
+ 	u32 extra = BCM2835_DMA_INT_EN;
+ 	size_t frames;
+ 
+@@ -943,7 +956,7 @@ static struct dma_async_tx_descriptor *b
+ 	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+ 	struct bcm2835_desc *d;
+ 	dma_addr_t src, dst;
+-	u32 info = WAIT_RESP(c->dreq);
++	u32 info = WAIT_RESP(c->dreq) | WIDE_SOURCE(c->dreq) | WIDE_DEST(c->dreq);
+ 	u32 extra = 0;
+ 	size_t max_len = bcm2835_dma_max_frame_length(c);
+ 	size_t frames;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0304-uapi-bcm2835-isp-Add-colour-denoise-configuration.patch b/target/linux/bcm27xx/patches-6.1/950-0304-uapi-bcm2835-isp-Add-colour-denoise-configuration.patch
new file mode 100644
index 00000000000000..f8c7aa9eae9a9b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0304-uapi-bcm2835-isp-Add-colour-denoise-configuration.patch
@@ -0,0 +1,56 @@
+From cc176690229ef17ff456b8d6082baa3f08d65662 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Thu, 14 Jan 2021 09:18:42 +0000
+Subject: [PATCH] uapi: bcm2835-isp: Add colour denoise configuration
+
+Add a configuration structure for colour denoise to the bcm2835_isp
+driver.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ include/uapi/linux/bcm2835-isp.h | 27 +++++++++++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+--- a/include/uapi/linux/bcm2835-isp.h
++++ b/include/uapi/linux/bcm2835-isp.h
+@@ -31,6 +31,8 @@
+ 				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0007)
+ #define V4L2_CID_USER_BCM2835_ISP_DPC		\
+ 				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0008)
++#define V4L2_CID_USER_BCM2835_ISP_CDN \
++				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0009)
+ 
+ /*
+  * All structs below are directly mapped onto the equivalent structs in
+@@ -176,6 +178,31 @@ struct bcm2835_isp_gamma {
+ };
+ 
+ /**
++ * enum bcm2835_isp_cdn_mode - Mode of operation for colour denoise.
++ *
++ * @CDN_MODE_FAST:		Fast (but lower quality) colour denoise
++ *				algorithm, typically used for video recording.
++ * @CDN_HIGH_QUALITY:		High quality (but slower) colour denoise
++ *				algorithm, typically used for stills capture.
++ */
++enum bcm2835_isp_cdn_mode {
++	CDN_MODE_FAST = 0,
++	CDN_MODE_HIGH_QUALITY = 1,
++};
++
++/**
++ * struct bcm2835_isp_cdn - Colour denoise parameters set with the
++ *			    V4L2_CID_USER_BCM2835_ISP_CDN ctrl.
++ *
++ * @enabled:	Enable colour denoise.
++ * @mode:	Colour denoise operating mode (see enum &bcm2835_isp_cdn_mode)
++ */
++struct bcm2835_isp_cdn {
++	__u32 enabled;
++	__u32 mode;
++};
++
++/**
+  * struct bcm2835_isp_denoise - Denoise parameters set with the
+  *				V4L2_CID_USER_BCM2835_ISP_DENOISE ctrl.
+  *
diff --git a/target/linux/bcm27xx/patches-6.1/950-0305-staging-vc04_services-ISP-Add-colour-denoise-control.patch b/target/linux/bcm27xx/patches-6.1/950-0305-staging-vc04_services-ISP-Add-colour-denoise-control.patch
new file mode 100644
index 00000000000000..29e5f423cfd642
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0305-staging-vc04_services-ISP-Add-colour-denoise-control.patch
@@ -0,0 +1,75 @@
+From 19b66a5cc04a0f4dee17bbc862568e6c7e015963 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Thu, 14 Jan 2021 09:20:52 +0000
+Subject: [PATCH] staging: vc04_services: ISP: Add colour denoise
+ control
+
+Add colour denoise control to the bcm2835 driver through a new v4l2
+control: V4L2_CID_USER_BCM2835_ISP_CDN.
+
+Add the accompanying MMAL configuration structure definitions as well.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../vc04_services/bcm2835-isp/bcm2835-isp-ctrls.h   |  5 +++++
+ .../vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c    |  5 +++++
+ .../vc04_services/vchiq-mmal/mmal-parameters.h      | 13 +++++++++++++
+ 3 files changed, 23 insertions(+)
+
+--- a/drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-ctrls.h
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-ctrls.h
+@@ -57,6 +57,11 @@ static const struct bcm2835_isp_custom_c
+ 		.size	= sizeof(struct bcm2835_isp_denoise),
+ 		.flags  = 0
+ 	}, {
++		.name	= "Colour Denoise",
++		.id	= V4L2_CID_USER_BCM2835_ISP_CDN,
++		.size	= sizeof(struct bcm2835_isp_cdn),
++		.flags  = 0
++	}, {
+ 		.name	= "Defective Pixel Correction",
+ 		.id	= V4L2_CID_USER_BCM2835_ISP_DPC,
+ 		.size	= sizeof(struct bcm2835_isp_dpc),
+--- a/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
+@@ -766,6 +766,11 @@ static int bcm2835_isp_s_ctrl(struct v4l
+ 				    ctrl->p_new.p_u8,
+ 				    sizeof(struct bcm2835_isp_denoise));
+ 		break;
++	case V4L2_CID_USER_BCM2835_ISP_CDN:
++		ret = set_isp_param(node, MMAL_PARAMETER_CDN,
++				    ctrl->p_new.p_u8,
++				    sizeof(struct bcm2835_isp_cdn));
++		break;
+ 	case V4L2_CID_USER_BCM2835_ISP_SHARPEN:
+ 		ret = set_isp_param(node, MMAL_PARAMETER_SHARPEN,
+ 				    ctrl->p_new.p_u8,
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
+@@ -279,6 +279,8 @@ enum mmal_parameter_camera_type {
+ 	MMAL_PARAMETER_DPC,
+ 		/**< Tales a @ref MMAP_PARAMETER_GAMMA_T */
+ 	MMAL_PARAMETER_GAMMA,
++		/**< Takes a @ref MMAL_PARAMETER_CDN_T */
++	MMAL_PARAMETER_CDN,
+ 		/**< Takes a @ref MMAL_PARAMETER_BOOLEAN_T */
+ 	MMAL_PARAMETER_JPEG_IJG_SCALING,
+ };
+@@ -915,6 +917,17 @@ struct mmal_parameter_gamma {
+ 	u16 y[MMAL_NUM_GAMMA_PTS];
+ };
+ 
++enum mmal_parameter_cdn_mode {
++	MMAL_PARAM_CDN_FAST = 0,
++	MMAL_PARAM_CDN_HIGH_QUALITY = 1,
++	MMAL_PARAM_CDN_DUMMY  = 0x7FFFFFFF
++};
++
++struct mmal_parameter_colour_denoise {
++	u32 enabled;
++	enum mmal_parameter_cdn_mode mode;
++};
++
+ struct mmal_parameter_denoise {
+ 	u32 enabled;
+ 	u32 constant;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0306-spi-bcm2835-Workaround-fix-for-zero-length-transfers.patch b/target/linux/bcm27xx/patches-6.1/950-0306-spi-bcm2835-Workaround-fix-for-zero-length-transfers.patch
new file mode 100644
index 00000000000000..89f127654a8efc
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0306-spi-bcm2835-Workaround-fix-for-zero-length-transfers.patch
@@ -0,0 +1,50 @@
+From 6415a827951c2676cc2cf0188fbdbc0c994048a3 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 28 Jan 2021 11:30:04 +0000
+Subject: [PATCH] spi: bcm2835: Workaround/fix for zero-length
+ transfers
+
+A relatively recent commit ([1]) contained optimisation for the PIO
+SPI FIFO-filling functions. The commit message includes the phrase
+"[t]he blind and counted loops are always called with nonzero count".
+This is technically true, but it is still possible for count to become
+zero before the loop is entered - if tfr->len is zero. Moving the loop
+exit condition to the end of the loop saves a few cycles, but results
+in a near-infinite loop should the revised count be zero on entry.
+
+Strangely, zero-lengthed transfers aren't filtered by the SPI framework
+and, even more strangely, the Python3 spidev library is triggering them
+for no obvious reason.
+
+Avoid the problem completely by bailing out of the main transfer
+function early if trf->len is zero, although there may be a case for
+moving the mitigation into the framework.
+
+See: https://github.com/raspberrypi/linux/issues/4100
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+[1] 26751de25d25 ("spi: bcm2835: Micro-optimise FIFO loops")
+---
+ drivers/spi/spi-bcm2835.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -1055,6 +1055,16 @@ static int bcm2835_spi_transfer_one(stru
+ 	unsigned long hz_per_byte, byte_limit;
+ 	u32 cs = slv->prepare_cs;
+ 
++	if (unlikely(!tfr->len)) {
++		static int warned;
++
++		if (!warned)
++			dev_warn(&spi->dev,
++				 "zero-length SPI transfer ignored\n");
++		warned = 1;
++		return 0;
++	}
++
+ 	/* set clock */
+ 	spi_hz = tfr->speed_hz;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0307-kbuild-Silence-unavoidable-dtc-overlay-warnings.patch b/target/linux/bcm27xx/patches-6.1/950-0307-kbuild-Silence-unavoidable-dtc-overlay-warnings.patch
new file mode 100644
index 00000000000000..998d30b6f1df82
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0307-kbuild-Silence-unavoidable-dtc-overlay-warnings.patch
@@ -0,0 +1,31 @@
+From eff293169d037a716e88734182bc8d7eb0c73289 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 29 Jan 2021 10:34:11 +0000
+Subject: [PATCH] kbuild: Silence unavoidable dtc overlay warnings
+
+Much effort has been put into finding ways to avoid warnings from dtc
+about overlays, usually to do with the presence of #address-cells and
+size-cells, but not exclusively so. Since the issues being warned about
+are harmless, suppress the warnings to declutter the build output and
+to avoid alarming users.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ scripts/Makefile.lib | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/scripts/Makefile.lib
++++ b/scripts/Makefile.lib
+@@ -415,6 +415,12 @@ cmd_dtco = mkdir -p $(dir ${dtc-tmp}) ;
+ 	$(DTC) -@ -H epapr -O dtb -o $@ -b 0 \
+ 		-i $(dir $<) $(DTC_FLAGS) \
+ 		-Wno-interrupts_property \
++		-Wno-label_is_string \
++		-Wno-reg_format \
++		-Wno-pci_device_bus_num \
++		-Wno-i2c_bus_reg \
++		-Wno-spi_bus_reg \
++		-Wno-avoid_default_addr_size \
+ 		-d $(depfile).dtc.tmp $(dtc-tmp) ; \
+ 	cat $(depfile).pre.tmp $(depfile).dtc.tmp > $(depfile)
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0308-bcm2835-isp-Allow-formats-with-different-colour-spac.patch b/target/linux/bcm27xx/patches-6.1/950-0308-bcm2835-isp-Allow-formats-with-different-colour-spac.patch
new file mode 100644
index 00000000000000..f4f3218877451b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0308-bcm2835-isp-Allow-formats-with-different-colour-spac.patch
@@ -0,0 +1,712 @@
+From 35534584af58ed5b953399fa5bfb0338c68258db Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Tue, 12 Jan 2021 13:55:39 +0000
+Subject: [PATCH] bcm2835-isp: Allow formats with different colour
+ spaces.
+
+Each supported format now includes a mask showing the allowed colour
+spaces, as well as a default colour space for when one was not
+specified.
+
+Additionally we translate the colour space to mmal format and pass it
+over to the VideoCore.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ .../bcm2835-isp/bcm2835-isp-fmts.h            | 180 ++++++++++++------
+ .../bcm2835-isp/bcm2835-v4l2-isp.c            |  66 ++++++-
+ 2 files changed, 190 insertions(+), 56 deletions(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-fmts.h
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-fmts.h
+@@ -20,10 +20,29 @@ struct bcm2835_isp_fmt {
+ 	int bytesperline_align;
+ 	u32 mmal_fmt;
+ 	int size_multiplier_x2;
+-	enum v4l2_colorspace colorspace;
++	u32 colorspace_mask;
++	enum v4l2_colorspace colorspace_default;
+ 	unsigned int step_size;
+ };
+ 
++#define V4L2_COLORSPACE_MASK(colorspace) BIT(colorspace)
++
++#define V4L2_COLORSPACE_MASK_JPEG V4L2_COLORSPACE_MASK(V4L2_COLORSPACE_JPEG)
++#define V4L2_COLORSPACE_MASK_SMPTE170M V4L2_COLORSPACE_MASK(V4L2_COLORSPACE_SMPTE170M)
++#define V4L2_COLORSPACE_MASK_REC709 V4L2_COLORSPACE_MASK(V4L2_COLORSPACE_REC709)
++#define V4L2_COLORSPACE_MASK_SRGB V4L2_COLORSPACE_MASK(V4L2_COLORSPACE_SRGB)
++#define V4L2_COLORSPACE_MASK_RAW V4L2_COLORSPACE_MASK(V4L2_COLORSPACE_RAW)
++
++/*
++ * The colour spaces we support for YUV outputs. SRGB features here because,
++ * once you assign the default transfer func and so on, it and JPEG effectively
++ * mean the same.
++ */
++#define V4L2_COLORSPACE_MASK_YUV (V4L2_COLORSPACE_MASK_JPEG | \
++				  V4L2_COLORSPACE_MASK_SRGB | \
++				  V4L2_COLORSPACE_MASK_SMPTE170M | \
++				  V4L2_COLORSPACE_MASK_REC709)
++
+ static const struct bcm2835_isp_fmt supported_formats[] = {
+ 	{
+ 		/* YUV formats */
+@@ -32,7 +51,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_I420,
+ 		.size_multiplier_x2 = 3,
+-		.colorspace	    = V4L2_COLORSPACE_SMPTE170M,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_YUV,
++		.colorspace_default = V4L2_COLORSPACE_JPEG,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_YVU420,
+@@ -40,7 +60,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_YV12,
+ 		.size_multiplier_x2 = 3,
+-		.colorspace	    = V4L2_COLORSPACE_SMPTE170M,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_YUV,
++		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_NV12,
+@@ -48,7 +69,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_NV12,
+ 		.size_multiplier_x2 = 3,
+-		.colorspace	    = V4L2_COLORSPACE_SMPTE170M,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_YUV,
++		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_NV21,
+@@ -56,7 +78,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_NV21,
+ 		.size_multiplier_x2 = 3,
+-		.colorspace	    = V4L2_COLORSPACE_SMPTE170M,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_YUV,
++		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_YUYV,
+@@ -64,7 +87,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 64,
+ 		.mmal_fmt	    = MMAL_ENCODING_YUYV,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_SMPTE170M,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_YUV,
++		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_UYVY,
+@@ -72,7 +96,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 64,
+ 		.mmal_fmt	    = MMAL_ENCODING_UYVY,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_SMPTE170M,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_YUV,
++		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_YVYU,
+@@ -80,7 +105,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 64,
+ 		.mmal_fmt	    = MMAL_ENCODING_YVYU,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_SMPTE170M,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_YUV,
++		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_VYUY,
+@@ -88,7 +114,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 64,
+ 		.mmal_fmt	    = MMAL_ENCODING_VYUY,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_SMPTE170M,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_YUV,
++		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
+ 		.step_size	    = 2,
+ 	}, {
+ 		/* RGB formats */
+@@ -97,7 +124,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_RGB24,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_SRGB,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_SRGB,
++		.colorspace_default = V4L2_COLORSPACE_SRGB,
+ 		.step_size	    = 1,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_RGB565,
+@@ -105,7 +133,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_RGB16,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_SRGB,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_SRGB,
++		.colorspace_default = V4L2_COLORSPACE_SRGB,
+ 		.step_size	    = 1,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_BGR24,
+@@ -113,7 +142,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BGR24,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_SRGB,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_SRGB,
++		.colorspace_default = V4L2_COLORSPACE_SRGB,
+ 		.step_size	    = 1,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_XBGR32,
+@@ -121,7 +151,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 64,
+ 		.mmal_fmt	    = MMAL_ENCODING_BGRA,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_SRGB,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_SRGB,
++		.colorspace_default = V4L2_COLORSPACE_SRGB,
+ 		.step_size	    = 1,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_RGBX32,
+@@ -129,7 +160,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 64,
+ 		.mmal_fmt	    = MMAL_ENCODING_RGBA,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_SRGB,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_SRGB,
++		.colorspace_default = V4L2_COLORSPACE_SRGB,
+ 		.step_size	    = 1,
+ 	}, {
+ 		/* Bayer formats */
+@@ -139,7 +171,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB8,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SBGGR8,
+@@ -147,7 +180,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR8,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SGRBG8,
+@@ -155,7 +189,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG8,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SGBRG8,
+@@ -163,7 +198,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG8,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		/* 10 bit */
+@@ -172,7 +208,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB10P,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SBGGR10P,
+@@ -180,7 +217,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR10P,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SGRBG10P,
+@@ -188,7 +226,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG10P,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SGBRG10P,
+@@ -196,7 +235,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG10P,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		/* 12 bit */
+@@ -205,7 +245,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB12P,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SBGGR12P,
+@@ -213,7 +254,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR12P,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SGRBG12P,
+@@ -221,7 +263,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG12P,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SGBRG12P,
+@@ -229,7 +272,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG12P,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		/* 14 bit */
+@@ -238,7 +282,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB14P,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SBGGR14P,
+@@ -246,7 +291,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR14P,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SGRBG14P,
+@@ -254,7 +300,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG14P,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SGBRG14P,
+@@ -262,7 +309,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG14P,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		/* 16 bit */
+@@ -271,7 +319,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB16,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SBGGR16,
+@@ -279,7 +328,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR16,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SGRBG16,
+@@ -287,7 +337,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG16,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SGBRG16,
+@@ -295,7 +346,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG16,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		/* Bayer formats unpacked to 16bpp */
+@@ -305,7 +357,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB10,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SBGGR10,
+@@ -313,7 +366,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR10,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SGRBG10,
+@@ -321,7 +375,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG10,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SGBRG10,
+@@ -329,7 +384,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG10,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		/* 12 bit */
+@@ -338,7 +394,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB12,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SBGGR12,
+@@ -346,7 +403,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR12,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SGRBG12,
+@@ -354,7 +412,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG12,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SGBRG12,
+@@ -362,7 +421,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG12,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		/* 14 bit */
+@@ -371,7 +431,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB14,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SBGGR14,
+@@ -379,7 +440,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR14,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SGRBG14,
+@@ -387,7 +449,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG14,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_SGBRG14,
+@@ -395,7 +458,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG14,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		/* Monochrome MIPI formats */
+@@ -405,7 +469,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_GREY,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		/* 10 bit */
+@@ -414,7 +479,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_Y10P,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		/* 12 bit */
+@@ -423,7 +489,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_Y12P,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		/* 14 bit */
+@@ -432,7 +499,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_Y14P,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		/* 16 bit */
+@@ -441,7 +509,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_Y16,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		/* 10 bit as 16bpp */
+@@ -450,7 +519,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_Y10,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		/* 12 bit as 16bpp */
+@@ -459,7 +529,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_Y12,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		/* 14 bit as 16bpp */
+@@ -468,7 +539,8 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_Y14,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace	    = V4L2_COLORSPACE_RAW,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_META_FMT_BCM2835_ISP_STATS,
+--- a/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
+@@ -74,6 +74,7 @@ struct bcm2835_isp_q_data {
+ 	unsigned int width;
+ 	unsigned int height;
+ 	unsigned int sizeimage;
++	enum v4l2_colorspace colorspace;
+ 	const struct bcm2835_isp_fmt *fmt;
+ };
+ 
+@@ -313,6 +314,43 @@ static void mmal_buffer_cb(struct vchiq_
+ 		complete(&dev->frame_cmplt);
+ }
+ 
++struct colorspace_translation {
++	enum v4l2_colorspace v4l2_value;
++	u32 mmal_value;
++};
++
++static u32 translate_color_space(enum v4l2_colorspace color_space)
++{
++	static const struct colorspace_translation translations[] = {
++		{ V4L2_COLORSPACE_DEFAULT, MMAL_COLOR_SPACE_UNKNOWN },
++		{ V4L2_COLORSPACE_SMPTE170M, MMAL_COLOR_SPACE_ITUR_BT601 },
++		{ V4L2_COLORSPACE_SMPTE240M, MMAL_COLOR_SPACE_SMPTE240M },
++		{ V4L2_COLORSPACE_REC709, MMAL_COLOR_SPACE_ITUR_BT709 },
++		/* V4L2_COLORSPACE_BT878 unavailable */
++		{ V4L2_COLORSPACE_470_SYSTEM_M, MMAL_COLOR_SPACE_BT470_2_M },
++		{ V4L2_COLORSPACE_470_SYSTEM_BG, MMAL_COLOR_SPACE_BT470_2_BG },
++		{ V4L2_COLORSPACE_JPEG, MMAL_COLOR_SPACE_JPEG_JFIF },
++		/*
++		 * We don't have an encoding for SRGB as such, but VideoCore
++		 * will do the right thing if it gets "unknown".
++		 */
++		{ V4L2_COLORSPACE_SRGB, MMAL_COLOR_SPACE_UNKNOWN },
++		/* V4L2_COLORSPACE_OPRGB unavailable */
++		/* V4L2_COLORSPACE_BT2020 unavailable */
++		/* V4L2_COLORSPACE_RAW unavailable */
++		/* V4L2_COLORSPACE_DCI_P3 unavailable */
++	};
++
++	unsigned int i;
++
++	for (i = 0; i < ARRAY_SIZE(translations); i++) {
++		if (color_space == translations[i].v4l2_value)
++			return translations[i].mmal_value;
++	}
++
++	return MMAL_COLOR_SPACE_UNKNOWN;
++}
++
+ static void setup_mmal_port_format(struct bcm2835_isp_node *node,
+ 				   struct vchiq_mmal_port *port)
+ {
+@@ -326,6 +364,7 @@ static void setup_mmal_port_format(struc
+ 	port->es.video.crop.height = q_data->height;
+ 	port->es.video.crop.x = 0;
+ 	port->es.video.crop.y = 0;
++	port->es.video.color_space = translate_color_space(q_data->colorspace);
+ };
+ 
+ static int setup_mmal_port(struct bcm2835_isp_node *node)
+@@ -829,6 +868,9 @@ static int populate_qdata_fmt(struct v4l
+ 		/* All parameters should have been set correctly by try_fmt */
+ 		q_data->bytesperline = f->fmt.pix.bytesperline;
+ 		q_data->sizeimage = f->fmt.pix.sizeimage;
++
++		/* We must indicate which of the allowed colour spaces we have. */
++		q_data->colorspace = f->fmt.pix.colorspace;
+ 	} else {
+ 		v4l2_dbg(1, debug, &dev->v4l2_dev,
+ 			 "%s: Setting meta format for fmt: %08x, size %u\n",
+@@ -840,6 +882,9 @@ static int populate_qdata_fmt(struct v4l
+ 		q_data->height = 0;
+ 		q_data->bytesperline = 0;
+ 		q_data->sizeimage = f->fmt.meta.buffersize;
++
++		/* This won't mean anything for metadata, but may as well fill it in. */
++		q_data->colorspace = V4L2_COLORSPACE_DEFAULT;
+ 	}
+ 
+ 	v4l2_dbg(1, debug, &dev->v4l2_dev,
+@@ -903,7 +948,7 @@ static int bcm2835_isp_node_g_fmt(struct
+ 		f->fmt.pix.pixelformat = q_data->fmt->fourcc;
+ 		f->fmt.pix.bytesperline = q_data->bytesperline;
+ 		f->fmt.pix.sizeimage = q_data->sizeimage;
+-		f->fmt.pix.colorspace = q_data->fmt->colorspace;
++		f->fmt.pix.colorspace = q_data->colorspace;
+ 	}
+ 
+ 	return 0;
+@@ -970,13 +1015,29 @@ static int bcm2835_isp_node_try_fmt(stru
+ 		fmt = get_default_format(node);
+ 
+ 	if (!node_is_stats(node)) {
++		int is_rgb;
++
+ 		f->fmt.pix.width = max(min(f->fmt.pix.width, MAX_DIM),
+ 				       MIN_DIM);
+ 		f->fmt.pix.height = max(min(f->fmt.pix.height, MAX_DIM),
+ 					MIN_DIM);
+ 
+ 		f->fmt.pix.pixelformat = fmt->fourcc;
+-		f->fmt.pix.colorspace = fmt->colorspace;
++
++		/*
++		 * Fill in the actual colour space when the requested one was
++		 * not supported. This also catches the case when the "default"
++		 * colour space was requested (as that's never in the mask).
++		 */
++		if (!(V4L2_COLORSPACE_MASK(f->fmt.pix.colorspace) & fmt->colorspace_mask))
++			f->fmt.pix.colorspace = fmt->colorspace_default;
++		/* In all cases, we only support the defaults for these: */
++		f->fmt.pix.ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(f->fmt.pix.colorspace);
++		f->fmt.pix.xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(f->fmt.pix.colorspace);
++		is_rgb = f->fmt.pix.colorspace == V4L2_COLORSPACE_SRGB;
++		f->fmt.pix.quantization = V4L2_MAP_QUANTIZATION_DEFAULT(is_rgb, f->fmt.pix.colorspace,
++									f->fmt.pix.ycbcr_enc);
++
+ 		f->fmt.pix.bytesperline = get_bytesperline(f->fmt.pix.width,
+ 							   fmt);
+ 		f->fmt.pix.field = V4L2_FIELD_NONE;
+@@ -1301,6 +1362,7 @@ static int register_node(struct bcm2835_
+ 					       node->q_data.width,
+ 					       node->q_data.height,
+ 					       node->q_data.fmt);
++	node->q_data.colorspace = node->q_data.fmt->colorspace_default;
+ 
+ 	queue->io_modes = VB2_MMAP | VB2_DMABUF;
+ 	queue->drv_priv = node;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0309-media-bcm2835-unicam-Fix-bug-in-buffer-swapping-logi.patch b/target/linux/bcm27xx/patches-6.1/950-0309-media-bcm2835-unicam-Fix-bug-in-buffer-swapping-logi.patch
new file mode 100644
index 00000000000000..5d365ab1d66163
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0309-media-bcm2835-unicam-Fix-bug-in-buffer-swapping-logi.patch
@@ -0,0 +1,75 @@
+From c0863c6da514311d3db381bcc1be6e0435d9b8c9 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Fri, 5 Mar 2021 15:40:45 +0000
+Subject: [PATCH] media: bcm2835-unicam: Fix bug in buffer swapping
+ logic
+
+If multiple sets of interrupts occur simultaneously, it may be unsafe
+to swap buffers, as the hardware may already be re-using the current
+buffers. In such cases, avoid swapping buffers, and wait for the next
+opportunity at the Frame End interrupt to signal completion.
+
+Additionally, check the packet compare status when watching for frame
+end for buffers swaps, as this could also signify a frame end event.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 21 ++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -800,6 +800,7 @@ static irqreturn_t unicam_isr(int irq, v
+ 	unsigned int sequence = unicam->sequence;
+ 	unsigned int i;
+ 	u32 ista, sta;
++	bool fe;
+ 	u64 ts;
+ 
+ 	sta = reg_read(unicam, UNICAM_STA);
+@@ -817,12 +818,18 @@ static irqreturn_t unicam_isr(int irq, v
+ 		return IRQ_HANDLED;
+ 
+ 	/*
++	 * Look for either the Frame End interrupt or the Packet Capture status
++	 * to signal a frame end.
++	 */
++	fe = (ista & UNICAM_FEI || sta & UNICAM_PI0);
++
++	/*
+ 	 * We must run the frame end handler first. If we have a valid next_frm
+ 	 * and we get a simultaneout FE + FS interrupt, running the FS handler
+ 	 * first would null out the next_frm ptr and we would have lost the
+ 	 * buffer forever.
+ 	 */
+-	if (ista & UNICAM_FEI || sta & UNICAM_PI0) {
++	if (fe) {
+ 		/*
+ 		 * Ensure we have swapped buffers already as we can't
+ 		 * stop the peripheral. If no buffer is available, use a
+@@ -833,7 +840,15 @@ static irqreturn_t unicam_isr(int irq, v
+ 			if (!unicam->node[i].streaming)
+ 				continue;
+ 
+-			if (unicam->node[i].cur_frm)
++			/*
++			 * If cur_frm == next_frm, it means we have not had
++			 * a chance to swap buffers, likely due to having
++			 * multiple interrupts occurring simultaneously (like FE
++			 * + FS + LS). In this case, we cannot signal the buffer
++			 * as complete, as the HW will reuse that buffer.
++			 */
++			if (unicam->node[i].cur_frm &&
++			    unicam->node[i].cur_frm != unicam->node[i].next_frm)
+ 				unicam_process_buffer_complete(&unicam->node[i],
+ 							       sequence);
+ 			unicam->node[i].cur_frm = unicam->node[i].next_frm;
+@@ -870,7 +885,7 @@ static irqreturn_t unicam_isr(int irq, v
+ 	 * where the HW does not actually swap it if the new frame has
+ 	 * already started.
+ 	 */
+-	if (ista & (UNICAM_FSI | UNICAM_LCI) && !(ista & UNICAM_FEI)) {
++	if (ista & (UNICAM_FSI | UNICAM_LCI) && !fe) {
+ 		for (i = 0; i < ARRAY_SIZE(unicam->node); i++) {
+ 			if (!unicam->node[i].streaming)
+ 				continue;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0310-Assign-crypto-aliases-to-different-AES-implementatio.patch b/target/linux/bcm27xx/patches-6.1/950-0310-Assign-crypto-aliases-to-different-AES-implementatio.patch
new file mode 100644
index 00000000000000..dc4b64816ae00a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0310-Assign-crypto-aliases-to-different-AES-implementatio.patch
@@ -0,0 +1,107 @@
+From 457ff5f820cbee7e7d687bd7cd078dcbba4d4c4e Mon Sep 17 00:00:00 2001
+From: Ben Avison <bavison@riscosopen.org>
+Date: Mon, 8 Mar 2021 15:32:25 +0000
+Subject: [PATCH] Assign crypto aliases to different AES implementation
+ modules
+
+The kernel modules aes-neon-blk and aes-neon-bs perform poorly, at least on
+Cortex-A72 without crypto extensions. In fact, aes-arm64 outperforms them
+on benchmarks, despite it being a simpler implementation (only accelerating
+the single-block AES cipher).
+
+For modes of operation where multiple cipher blocks can be processed in
+parallel, aes-neon-bs outperforms aes-neon-blk by around 60-70% and aes-arm64
+is another 10-20% faster still. But the difference is even more marked with
+modes of operation with dependencies between neighbouring blocks, such as
+CBC encryption, which defeat parallelism: in these cases, aes-arm64 is
+typically around 250% faster than either aes-neon-blk or aes-neon-bs.
+
+The key trade-off with aes-arm64 is that the look-up tables are situated in
+RAM. This leaves them potentially open to cache timing attacks. The two other
+modules, by contrast, load the look-up tables into NEON registers and so are
+able to perform in constant time.
+
+This patch aims to load aes-arm64 more often.
+
+If none of the currently-loaded crypto modules implement a given algorithm,
+a new one is typically selected for loading using a platform-neutral alias
+describing the required algorithm. To enable users to still
+load aes-neon-blk or aes-neon-bs if they really want them, while still
+ensuring that aes-arm64 is usually selected, remove the aliases from
+aes-neonbs-glue.c and aes-glue.c and apply them to aes-cipher-glue.c, but
+still build the two NEON modules.
+
+Since aes-glue.c can also be used to build aes-ce-blk, leave them enabled
+if USE_V8_CRYPTO_EXTENSIONS is defined, to ensure they are selected if we
+in future use a CPU which has the crypto extensions enabled.
+
+Note that the algorithm priority specifiers are unchanged, so if
+aes-neon-bs is loaded at the same time as aes-arm64, the former will be
+used in preference. However, aes-neon-blk and aes-arm64 have tied priority,
+so whichever module was loaded first will be used (assuming aes-neon-bs is
+not loaded).
+
+Signed-off-by: Ben Avison <bavison@riscosopen.org>
+---
+ arch/arm64/crypto/aes-cipher-glue.c | 11 +++++++++++
+ arch/arm64/crypto/aes-glue.c        |  4 ++--
+ arch/arm64/crypto/aes-neonbs-glue.c |  5 -----
+ 3 files changed, 13 insertions(+), 7 deletions(-)
+
+--- a/arch/arm64/crypto/aes-cipher-glue.c
++++ b/arch/arm64/crypto/aes-cipher-glue.c
+@@ -9,6 +9,17 @@
+ #include <linux/crypto.h>
+ #include <linux/module.h>
+ 
++MODULE_ALIAS_CRYPTO("ecb(aes)");
++MODULE_ALIAS_CRYPTO("cbc(aes)");
++MODULE_ALIAS_CRYPTO("ctr(aes)");
++MODULE_ALIAS_CRYPTO("xts(aes)");
++MODULE_ALIAS_CRYPTO("xctr(aes)");
++MODULE_ALIAS_CRYPTO("cts(cbc(aes))");
++MODULE_ALIAS_CRYPTO("essiv(cbc(aes),sha256)");
++MODULE_ALIAS_CRYPTO("cmac(aes)");
++MODULE_ALIAS_CRYPTO("xcbc(aes)");
++MODULE_ALIAS_CRYPTO("cbcmac(aes)");
++
+ asmlinkage void __aes_arm64_encrypt(u32 *rk, u8 *out, const u8 *in, int rounds);
+ asmlinkage void __aes_arm64_decrypt(u32 *rk, u8 *out, const u8 *in, int rounds);
+ 
+--- a/arch/arm64/crypto/aes-glue.c
++++ b/arch/arm64/crypto/aes-glue.c
+@@ -57,18 +57,18 @@ MODULE_DESCRIPTION("AES-ECB/CBC/CTR/XTS/
+ #define aes_mac_update		neon_aes_mac_update
+ MODULE_DESCRIPTION("AES-ECB/CBC/CTR/XTS/XCTR using ARMv8 NEON");
+ #endif
+-#if defined(USE_V8_CRYPTO_EXTENSIONS) || !IS_ENABLED(CONFIG_CRYPTO_AES_ARM64_BS)
++#if defined(USE_V8_CRYPTO_EXTENSIONS)
+ MODULE_ALIAS_CRYPTO("ecb(aes)");
+ MODULE_ALIAS_CRYPTO("cbc(aes)");
+ MODULE_ALIAS_CRYPTO("ctr(aes)");
+ MODULE_ALIAS_CRYPTO("xts(aes)");
+ MODULE_ALIAS_CRYPTO("xctr(aes)");
+-#endif
+ MODULE_ALIAS_CRYPTO("cts(cbc(aes))");
+ MODULE_ALIAS_CRYPTO("essiv(cbc(aes),sha256)");
+ MODULE_ALIAS_CRYPTO("cmac(aes)");
+ MODULE_ALIAS_CRYPTO("xcbc(aes)");
+ MODULE_ALIAS_CRYPTO("cbcmac(aes)");
++#endif
+ 
+ MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel@linaro.org>");
+ MODULE_LICENSE("GPL v2");
+--- a/arch/arm64/crypto/aes-neonbs-glue.c
++++ b/arch/arm64/crypto/aes-neonbs-glue.c
+@@ -18,11 +18,6 @@
+ MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel@linaro.org>");
+ MODULE_LICENSE("GPL v2");
+ 
+-MODULE_ALIAS_CRYPTO("ecb(aes)");
+-MODULE_ALIAS_CRYPTO("cbc(aes)");
+-MODULE_ALIAS_CRYPTO("ctr(aes)");
+-MODULE_ALIAS_CRYPTO("xts(aes)");
+-
+ asmlinkage void aesbs_convert_key(u8 out[], u32 const rk[], int rounds);
+ 
+ asmlinkage void aesbs_ecb_encrypt(u8 out[], u8 const in[], u8 const rk[],
diff --git a/target/linux/bcm27xx/patches-6.1/950-0311-media-v4l2_m2m-In-buffered-mode-run-jobs-if-either-p.patch b/target/linux/bcm27xx/patches-6.1/950-0311-media-v4l2_m2m-In-buffered-mode-run-jobs-if-either-p.patch
new file mode 100644
index 00000000000000..6dad15807f5fbc
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0311-media-v4l2_m2m-In-buffered-mode-run-jobs-if-either-p.patch
@@ -0,0 +1,33 @@
+From f8ea9105eebec3af0fddcda3118bdd83e3130166 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 1 Feb 2021 18:48:47 +0000
+Subject: [PATCH] media/v4l2_m2m: In buffered mode run jobs if either
+ port is streaming
+
+In order to get the intended behaviour of the stateful video
+decoder API where only the OUTPUT queue needs to be enabled and fed
+buffers in order to get the SOURCE_CHANGED event that configures the
+CAPTURE queue, we want the device to run should either queue be
+streaming.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/v4l2-core/v4l2-mem2mem.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
++++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
+@@ -301,9 +301,10 @@ static void __v4l2_m2m_try_queue(struct
+ 
+ 	dprintk("Trying to schedule a job for m2m_ctx: %p\n", m2m_ctx);
+ 
+-	if (!m2m_ctx->out_q_ctx.q.streaming
+-	    || !m2m_ctx->cap_q_ctx.q.streaming) {
+-		dprintk("Streaming needs to be on for both queues\n");
++	if (!(m2m_ctx->out_q_ctx.q.streaming &&
++	      m2m_ctx->cap_q_ctx.q.streaming) &&
++	    !(m2m_ctx->out_q_ctx.buffered && m2m_ctx->out_q_ctx.q.streaming)) {
++		dprintk("Streaming needs to be on for both queues, or buffered and OUTPUT streaming\n");
+ 		return;
+ 	}
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0312-media-i2c-add-ov9281-driver.patch b/target/linux/bcm27xx/patches-6.1/950-0312-media-i2c-add-ov9281-driver.patch
new file mode 100644
index 00000000000000..e89e6a98eb11d2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0312-media-i2c-add-ov9281-driver.patch
@@ -0,0 +1,1729 @@
+From d26583e9c31d10919c8d4b965b938724fde1ba3c Mon Sep 17 00:00:00 2001
+From: Zefa Chen <zefa.chen@rock-chips.com>
+Date: Fri, 17 May 2019 18:23:03 +0800
+Subject: [PATCH] media: i2c: add ov9281 driver.
+
+Change-Id: I7b77250bbc56d2f861450cf77271ad15f9b88ab1
+Signed-off-by: Zefa Chen <zefa.chen@rock-chips.com>
+
+media: i2c: ov9281: fix mclk issue when probe multiple camera.
+
+Takes the ov9281 part only from the Rockchip's patch.
+
+Change-Id: I30e833baf2c1bb07d6d87ddb3b00759ab45a90e4
+Signed-off-by: Zefa Chen <zefa.chen@rock-chips.com>
+
+media: i2c: ov9281: add enum_frame_interval function for iq tool 2.2 and hal3
+
+Adds the ov9281 parts of the Rockchip patch adding enum_frame_interval to
+a large number of drivers.
+
+Change-Id: I03344cd6cf278dd7c18fce8e97479089ef185a5c
+Signed-off-by: Zefa Chen <zefa.chen@rock-chips.com>
+
+media: i2c: ov9281: Fixup for recent kernel releases, and remove custom code
+
+The Rockchip driver was based on a 4.4 kernel, and had several custom
+Rockchip parts.
+
+Update to 5.4 kernel APIs, with the relevant controls required by
+libcamera, and remove custom Rockchip parts.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: ov9281: Read chip ID via 2 reads
+
+Vision Components have made an OV9281 module which blocks reading
+back the majority of registers to comply with NDAs, and in doing
+so doesn't allow auto-increment register reading as used when
+reading the chip ID.
+
+Use two reads and manually combine the results.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: ov9281: Add support for 8 bit readout
+
+The sensor supports 8 bit mode as well as 10bit, so add the
+relevant code to allow selection of this.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: ov9281: Add 1280x720 and 640x480 modes
+
+Breaks out common register set and adds the different registers
+for 1280x720 (cropped) and 640x480 (skipped) modes
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+Fixed picture line bug in all ov9281 modes
+
+Signed-off-by: Mathias Anhalt <mathiasanhalt@web.de>
+
+Added hflip and vflip controls to ov9281
+
+Signed-off-by: Mathias Anhalt <mathiasanhalt@web.de>
+
+media: i2c: ov9281: Remove override of subdev name
+
+From the original Rockchip driver, the subdev was renamed
+from the default to being "mov9281 <dev_name>" whereas the
+default would have been "ov9281 <dev_name>".
+
+Remove the override to drop back to the default rather than
+a vendor custom string.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: v4l2-subdev: add subdev-wide state struct
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+media: i2c: ov9281: Add fwnode properties controls
+
+Add call to v4l2_ctrl_new_fwnode_properties to read and
+create the fwnode based controls.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: ov9281: Sensor should report RAW color space
+
+Tested on Raspberry Pi running libcamera.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ drivers/media/i2c/Kconfig                     |   11 +
+ drivers/media/i2c/Makefile                    |    1 +
+ drivers/media/i2c/imx290.c                    |    9 +-
+ drivers/media/i2c/imx477.c                    |   30 +-
+ drivers/media/i2c/irs1125.c                   |   12 +-
+ drivers/media/i2c/ov9281.c                    | 1290 +++++++++++++++++
+ .../media/platform/bcm2835/bcm2835-unicam.c   |   20 +-
+ .../bcm2835-isp/bcm2835-v4l2-isp.c            |    4 +-
+ 8 files changed, 1341 insertions(+), 36 deletions(-)
+ create mode 100644 drivers/media/i2c/ov9281.c
+
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -1336,6 +1336,17 @@ config VIDEO_TW2804
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called tw2804.
+ 
++config VIDEO_OV9281
++	tristate "OmniVision OV9281 sensor support"
++	depends on I2C && VIDEO_DEV
++	depends on MEDIA_CAMERA_SUPPORT
++	help
++	  This is a Video4Linux2 sensor-level driver for the OmniVision
++	  OV9281 camera.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called ov9281.
++
+ config VIDEO_TW9903
+ 	tristate "Techwell TW9903 video decoder"
+ 	depends on VIDEO_DEV && I2C
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -98,6 +98,7 @@ obj-$(CONFIG_VIDEO_OV772X) += ov772x.o
+ obj-$(CONFIG_VIDEO_OV7740) += ov7740.o
+ obj-$(CONFIG_VIDEO_OV8856) += ov8856.o
+ obj-$(CONFIG_VIDEO_OV8865) += ov8865.o
++obj-$(CONFIG_VIDEO_OV9281) += ov9281.o
+ obj-$(CONFIG_VIDEO_OV9282) += ov9282.o
+ obj-$(CONFIG_VIDEO_OV9640) += ov9640.o
+ obj-$(CONFIG_VIDEO_OV9650) += ov9650.o
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -982,12 +982,13 @@ static int imx290_write_current_format(s
+ }
+ 
+ static const struct v4l2_rect *
+-__imx290_get_pad_crop(struct imx290 *imx290, struct v4l2_subdev_pad_config *cfg,
++__imx290_get_pad_crop(struct imx290 *imx290,
++		      struct v4l2_subdev_state *sd_state,
+ 		      unsigned int pad, enum v4l2_subdev_format_whence which)
+ {
+ 	switch (which) {
+ 	case V4L2_SUBDEV_FORMAT_TRY:
+-		return v4l2_subdev_get_try_crop(&imx290->sd, cfg, pad);
++		return v4l2_subdev_get_try_crop(&imx290->sd, sd_state, pad);
+ 	case V4L2_SUBDEV_FORMAT_ACTIVE:
+ 		return &imx290->current_mode->crop;
+ 	}
+@@ -996,7 +997,7 @@ __imx290_get_pad_crop(struct imx290 *imx
+ }
+ 
+ static int imx290_get_selection(struct v4l2_subdev *sd,
+-				struct v4l2_subdev_pad_config *cfg,
++				struct v4l2_subdev_state *sd_state,
+ 				struct v4l2_subdev_selection *sel)
+ {
+ 	switch (sel->target) {
+@@ -1004,7 +1005,7 @@ static int imx290_get_selection(struct v
+ 		struct imx290 *imx290 = to_imx290(sd);
+ 
+ 		mutex_lock(&imx290->lock);
+-		sel->r = *__imx290_get_pad_crop(imx290, cfg, sel->pad,
++		sel->r = *__imx290_get_pad_crop(imx290, sd_state, sel->pad,
+ 						sel->which);
+ 		mutex_unlock(&imx290->lock);
+ 
+--- a/drivers/media/i2c/imx477.c
++++ b/drivers/media/i2c/imx477.c
+@@ -1272,9 +1272,9 @@ static int imx477_open(struct v4l2_subde
+ {
+ 	struct imx477 *imx477 = to_imx477(sd);
+ 	struct v4l2_mbus_framefmt *try_fmt_img =
+-		v4l2_subdev_get_try_format(sd, fh->pad, IMAGE_PAD);
++		v4l2_subdev_get_try_format(sd, fh->state, IMAGE_PAD);
+ 	struct v4l2_mbus_framefmt *try_fmt_meta =
+-		v4l2_subdev_get_try_format(sd, fh->pad, METADATA_PAD);
++		v4l2_subdev_get_try_format(sd, fh->state, METADATA_PAD);
+ 	struct v4l2_rect *try_crop;
+ 
+ 	mutex_lock(&imx477->mutex);
+@@ -1293,7 +1293,7 @@ static int imx477_open(struct v4l2_subde
+ 	try_fmt_meta->field = V4L2_FIELD_NONE;
+ 
+ 	/* Initialize try_crop */
+-	try_crop = v4l2_subdev_get_try_crop(sd, fh->pad, IMAGE_PAD);
++	try_crop = v4l2_subdev_get_try_crop(sd, fh->state, IMAGE_PAD);
+ 	try_crop->left = IMX477_PIXEL_ARRAY_LEFT;
+ 	try_crop->top = IMX477_PIXEL_ARRAY_TOP;
+ 	try_crop->width = IMX477_PIXEL_ARRAY_WIDTH;
+@@ -1425,7 +1425,7 @@ static const struct v4l2_ctrl_ops imx477
+ };
+ 
+ static int imx477_enum_mbus_code(struct v4l2_subdev *sd,
+-				 struct v4l2_subdev_pad_config *cfg,
++				 struct v4l2_subdev_state *sd_state,
+ 				 struct v4l2_subdev_mbus_code_enum *code)
+ {
+ 	struct imx477 *imx477 = to_imx477(sd);
+@@ -1450,7 +1450,7 @@ static int imx477_enum_mbus_code(struct
+ }
+ 
+ static int imx477_enum_frame_size(struct v4l2_subdev *sd,
+-				  struct v4l2_subdev_pad_config *cfg,
++				  struct v4l2_subdev_state *sd_state,
+ 				  struct v4l2_subdev_frame_size_enum *fse)
+ {
+ 	struct imx477 *imx477 = to_imx477(sd);
+@@ -1516,7 +1516,7 @@ static void imx477_update_metadata_pad_f
+ }
+ 
+ static int imx477_get_pad_format(struct v4l2_subdev *sd,
+-				 struct v4l2_subdev_pad_config *cfg,
++				 struct v4l2_subdev_state *sd_state,
+ 				 struct v4l2_subdev_format *fmt)
+ {
+ 	struct imx477 *imx477 = to_imx477(sd);
+@@ -1528,7 +1528,8 @@ static int imx477_get_pad_format(struct
+ 
+ 	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
+ 		struct v4l2_mbus_framefmt *try_fmt =
+-			v4l2_subdev_get_try_format(&imx477->sd, cfg, fmt->pad);
++			v4l2_subdev_get_try_format(&imx477->sd, sd_state,
++						   fmt->pad);
+ 		/* update the code which could change due to vflip or hflip: */
+ 		try_fmt->code = fmt->pad == IMAGE_PAD ?
+ 				imx477_get_format_code(imx477, try_fmt->code) :
+@@ -1593,7 +1594,7 @@ static void imx477_set_framing_limits(st
+ }
+ 
+ static int imx477_set_pad_format(struct v4l2_subdev *sd,
+-				 struct v4l2_subdev_pad_config *cfg,
++				 struct v4l2_subdev_state *sd_state,
+ 				 struct v4l2_subdev_format *fmt)
+ {
+ 	struct v4l2_mbus_framefmt *framefmt;
+@@ -1622,7 +1623,7 @@ static int imx477_set_pad_format(struct
+ 					      fmt->format.height);
+ 		imx477_update_image_pad_format(imx477, mode, fmt);
+ 		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
+-			framefmt = v4l2_subdev_get_try_format(sd, cfg,
++			framefmt = v4l2_subdev_get_try_format(sd, sd_state,
+ 							      fmt->pad);
+ 			*framefmt = fmt->format;
+ 		} else if (imx477->mode != mode) {
+@@ -1632,7 +1633,7 @@ static int imx477_set_pad_format(struct
+ 		}
+ 	} else {
+ 		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
+-			framefmt = v4l2_subdev_get_try_format(sd, cfg,
++			framefmt = v4l2_subdev_get_try_format(sd, sd_state,
+ 							      fmt->pad);
+ 			*framefmt = fmt->format;
+ 		} else {
+@@ -1647,12 +1648,13 @@ static int imx477_set_pad_format(struct
+ }
+ 
+ static const struct v4l2_rect *
+-__imx477_get_pad_crop(struct imx477 *imx477, struct v4l2_subdev_pad_config *cfg,
++__imx477_get_pad_crop(struct imx477 *imx477,
++		      struct v4l2_subdev_state *sd_state,
+ 		      unsigned int pad, enum v4l2_subdev_format_whence which)
+ {
+ 	switch (which) {
+ 	case V4L2_SUBDEV_FORMAT_TRY:
+-		return v4l2_subdev_get_try_crop(&imx477->sd, cfg, pad);
++		return v4l2_subdev_get_try_crop(&imx477->sd, sd_state, pad);
+ 	case V4L2_SUBDEV_FORMAT_ACTIVE:
+ 		return &imx477->mode->crop;
+ 	}
+@@ -1661,7 +1663,7 @@ __imx477_get_pad_crop(struct imx477 *imx
+ }
+ 
+ static int imx477_get_selection(struct v4l2_subdev *sd,
+-				struct v4l2_subdev_pad_config *cfg,
++				struct v4l2_subdev_state *sd_state,
+ 				struct v4l2_subdev_selection *sel)
+ {
+ 	switch (sel->target) {
+@@ -1669,7 +1671,7 @@ static int imx477_get_selection(struct v
+ 		struct imx477 *imx477 = to_imx477(sd);
+ 
+ 		mutex_lock(&imx477->mutex);
+-		sel->r = *__imx477_get_pad_crop(imx477, cfg, sel->pad,
++		sel->r = *__imx477_get_pad_crop(imx477, sd_state, sel->pad,
+ 						sel->which);
+ 		mutex_unlock(&imx477->mutex);
+ 
+--- a/drivers/media/i2c/irs1125.c
++++ b/drivers/media/i2c/irs1125.c
+@@ -562,8 +562,8 @@ static const struct v4l2_subdev_video_op
+ };
+ 
+ static int irs1125_enum_mbus_code(struct v4l2_subdev *sd,
+-				  struct v4l2_subdev_pad_config *cfg,
+-	struct v4l2_subdev_mbus_code_enum *code)
++				  struct v4l2_subdev_state *sd_state,
++				  struct v4l2_subdev_mbus_code_enum *code)
+ {
+ 	if (code->index > 0)
+ 		return -EINVAL;
+@@ -574,7 +574,7 @@ static int irs1125_enum_mbus_code(struct
+ }
+ 
+ static int irs1125_set_get_fmt(struct v4l2_subdev *sd,
+-			       struct v4l2_subdev_pad_config *cfg,
++			       struct v4l2_subdev_state *sd_state,
+ 			       struct v4l2_subdev_format *format)
+ {
+ 	struct v4l2_mbus_framefmt *fmt = &format->format;
+@@ -930,7 +930,7 @@ static int irs1125_detect(struct v4l2_su
+ static int irs1125_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
+ {
+ 	struct v4l2_mbus_framefmt *format =
+-	v4l2_subdev_get_try_format(sd, fh->pad, 0);
++	v4l2_subdev_get_try_format(sd, fh->state, 0);
+ 
+ 	format->code = MEDIA_BUS_FMT_Y12_1X12;
+ 	format->width = IRS1125_WINDOW_WIDTH_DEF;
+@@ -1161,7 +1161,7 @@ mutex_remove:
+ 	return ret;
+ }
+ 
+-static int irs1125_remove(struct i2c_client *client)
++static void irs1125_remove(struct i2c_client *client)
+ {
+ 	struct v4l2_subdev *sd = i2c_get_clientdata(client);
+ 	struct irs1125 *irs1125 = to_state(sd);
+@@ -1171,8 +1171,6 @@ static int irs1125_remove(struct i2c_cli
+ 	v4l2_device_unregister_subdev(sd);
+ 	mutex_destroy(&irs1125->lock);
+ 	v4l2_ctrl_handler_free(&irs1125->ctrl_handler);
+-
+-	return 0;
+ }
+ 
+ #if IS_ENABLED(CONFIG_OF)
+--- /dev/null
++++ b/drivers/media/i2c/ov9281.c
+@@ -0,0 +1,1290 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Omnivision OV9281 1280x800 global shutter image sensor driver
++ *
++ * This driver has been taken from
++ * https://github.com/rockchip-linux/kernel/blob/develop-4.4/drivers/media/i2c/ov9281.c
++ * cleaned up, made to compile against mainline kernels instead of the Rockchip
++ * vendor kernel, and the relevant controls added to work with libcamera.
++ *
++ * Copyright (C) 2017 Fuzhou Rockchip Electronics Co., Ltd.
++ * V0.0X01.0X02 fix mclk issue when probe multiple camera.
++ * V0.0X01.0X03 add enum_frame_interval function.
++ */
++
++#include <linux/clk.h>
++#include <linux/device.h>
++#include <linux/delay.h>
++#include <linux/gpio/consumer.h>
++#include <linux/i2c.h>
++#include <linux/module.h>
++#include <linux/pm_runtime.h>
++#include <linux/regulator/consumer.h>
++#include <linux/sysfs.h>
++#include <linux/slab.h>
++#include <media/media-entity.h>
++#include <media/v4l2-async.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-fwnode.h>
++#include <media/v4l2-subdev.h>
++
++#define OV9281_LINK_FREQ_400MHZ		400000000
++#define OV9281_LANES			2
++
++/* pixel rate = link frequency * 2 * lanes / BITS_PER_SAMPLE */
++#define OV9281_PIXEL_RATE_10BIT		(OV9281_LINK_FREQ_400MHZ * 2 * \
++					 OV9281_LANES / 10)
++#define OV9281_PIXEL_RATE_8BIT		(OV9281_LINK_FREQ_400MHZ * 2 * \
++					 OV9281_LANES / 8)
++#define OV9281_XVCLK_FREQ		24000000
++
++#define CHIP_ID				0x9281
++#define OV9281_REG_CHIP_ID		0x300a
++
++#define OV9281_REG_TIMING_FORMAT_1		0x3820
++#define OV9281_REG_TIMING_FORMAT_2		0x3821
++#define OV9281_FLIP_BIT				BIT(2)
++
++#define OV9281_REG_CTRL_MODE		0x0100
++#define OV9281_MODE_SW_STANDBY		0x0
++#define OV9281_MODE_STREAMING		BIT(0)
++
++#define OV9281_REG_EXPOSURE		0x3500
++#define	OV9281_EXPOSURE_MIN		4
++#define	OV9281_EXPOSURE_STEP		1
++#define OV9281_VTS_MAX			0x7fff
++
++#define OV9281_REG_GAIN_H		0x3508
++#define OV9281_REG_GAIN_L		0x3509
++#define OV9281_GAIN_H_MASK		0x07
++#define OV9281_GAIN_H_SHIFT		8
++#define OV9281_GAIN_L_MASK		0xff
++#define OV9281_GAIN_MIN			0x10
++#define OV9281_GAIN_MAX			0xf8
++#define OV9281_GAIN_STEP		1
++#define OV9281_GAIN_DEFAULT		0x10
++
++#define OV9281_REG_TEST_PATTERN		0x5e00
++#define OV9281_TEST_PATTERN_ENABLE	0x80
++#define OV9281_TEST_PATTERN_DISABLE	0x0
++
++#define OV9281_REG_VTS			0x380e
++
++/*
++ * OV9281 native and active pixel array size.
++ * Datasheet not available to confirm these values, so assume there are no
++ * border pixels.
++ */
++#define OV9281_NATIVE_WIDTH		1280U
++#define OV9281_NATIVE_HEIGHT		800U
++#define OV9281_PIXEL_ARRAY_LEFT		0U
++#define OV9281_PIXEL_ARRAY_TOP		0U
++#define OV9281_PIXEL_ARRAY_WIDTH	1280U
++#define OV9281_PIXEL_ARRAY_HEIGHT	800U
++
++#define REG_NULL			0xFFFF
++
++#define OV9281_REG_VALUE_08BIT		1
++#define OV9281_REG_VALUE_16BIT		2
++#define OV9281_REG_VALUE_24BIT		3
++
++#define OV9281_NAME			"ov9281"
++
++static const char * const ov9281_supply_names[] = {
++	"avdd",		/* Analog power */
++	"dovdd",	/* Digital I/O power */
++	"dvdd",		/* Digital core power */
++};
++
++#define OV9281_NUM_SUPPLIES ARRAY_SIZE(ov9281_supply_names)
++
++struct regval {
++	u16 addr;
++	u8 val;
++};
++
++struct ov9281_mode {
++	u32 width;
++	u32 height;
++	u32 hts_def;
++	u32 vts_def;
++	u32 exp_def;
++	struct v4l2_rect crop;
++	const struct regval *reg_list;
++};
++
++struct ov9281 {
++	struct i2c_client	*client;
++	struct clk		*xvclk;
++	struct gpio_desc	*reset_gpio;
++	struct gpio_desc	*pwdn_gpio;
++	struct regulator_bulk_data supplies[OV9281_NUM_SUPPLIES];
++
++	struct v4l2_subdev	subdev;
++	struct media_pad	pad;
++	struct v4l2_ctrl_handler ctrl_handler;
++	struct v4l2_ctrl	*exposure;
++	struct v4l2_ctrl	*anal_gain;
++	struct v4l2_ctrl	*digi_gain;
++	struct v4l2_ctrl	*hblank;
++	struct v4l2_ctrl	*vblank;
++	struct v4l2_ctrl	*hflip;
++	struct v4l2_ctrl	*vflip;
++	struct v4l2_ctrl	*pixel_rate;
++	struct v4l2_ctrl	*test_pattern;
++	struct mutex		mutex;
++	bool			streaming;
++	bool			power_on;
++	const struct ov9281_mode *cur_mode;
++	u32			code;
++};
++
++#define to_ov9281(sd) container_of(sd, struct ov9281, subdev)
++
++/*
++ * Xclk 24Mhz
++ * max_framerate 120fps for 10 bit, 144fps for 8 bit.
++ * mipi_datarate per lane 800Mbps
++ */
++static const struct regval ov9281_common_regs[] = {
++	{0x0103, 0x01},
++	{0x0302, 0x32},
++	{0x030e, 0x02},
++	{0x3001, 0x00},
++	{0x3004, 0x00},
++	{0x3005, 0x00},
++	{0x3006, 0x04},
++	{0x3011, 0x0a},
++	{0x3013, 0x18},
++	{0x3022, 0x01},
++	{0x3023, 0x00},
++	{0x302c, 0x00},
++	{0x302f, 0x00},
++	{0x3030, 0x04},
++	{0x3039, 0x32},
++	{0x303a, 0x00},
++	{0x303f, 0x01},
++	{0x3500, 0x00},
++	{0x3501, 0x2a},
++	{0x3502, 0x90},
++	{0x3503, 0x08},
++	{0x3505, 0x8c},
++	{0x3507, 0x03},
++	{0x3508, 0x00},
++	{0x3509, 0x10},
++	{0x3610, 0x80},
++	{0x3611, 0xa0},
++	{0x3620, 0x6f},
++	{0x3632, 0x56},
++	{0x3633, 0x78},
++	{0x3666, 0x00},
++	{0x366f, 0x5a},
++	{0x3680, 0x84},
++	{0x3712, 0x80},
++	{0x372d, 0x22},
++	{0x3731, 0x80},
++	{0x3732, 0x30},
++	{0x377d, 0x22},
++	{0x3788, 0x02},
++	{0x3789, 0xa4},
++	{0x378a, 0x00},
++	{0x378b, 0x4a},
++	{0x3799, 0x20},
++	{0x3881, 0x42},
++	{0x38b1, 0x00},
++	{0x3920, 0xff},
++	{0x4010, 0x40},
++	{0x4043, 0x40},
++	{0x4307, 0x30},
++	{0x4317, 0x00},
++	{0x4501, 0x00},
++	{0x450a, 0x08},
++	{0x4601, 0x04},
++	{0x470f, 0x00},
++	{0x4f07, 0x00},
++	{0x4800, 0x00},
++	{0x5000, 0x9f},
++	{0x5001, 0x00},
++	{0x5e00, 0x00},
++	{0x5d00, 0x07},
++	{0x5d01, 0x00},
++	{REG_NULL, 0x00},
++};
++
++static const struct regval ov9281_1280x800_regs[] = {
++	{0x3778, 0x00},
++	{0x3800, 0x00},
++	{0x3801, 0x00},
++	{0x3802, 0x00},
++	{0x3803, 0x00},
++	{0x3804, 0x05},
++	{0x3805, 0x0f},
++	{0x3806, 0x03},
++	{0x3807, 0x2f},
++	{0x3808, 0x05},
++	{0x3809, 0x00},
++	{0x380a, 0x03},
++	{0x380b, 0x20},
++	{0x380c, 0x02},
++	{0x380d, 0xd8},
++	{0x380e, 0x03},
++	{0x380f, 0x8e},
++	{0x3810, 0x00},
++	{0x3811, 0x08},
++	{0x3812, 0x00},
++	{0x3813, 0x08},
++	{0x3814, 0x11},
++	{0x3815, 0x11},
++	{0x3820, 0x40},
++	{0x3821, 0x00},
++	{0x4003, 0x40},
++	{0x4008, 0x04},
++	{0x4009, 0x0b},
++	{0x400c, 0x00},
++	{0x400d, 0x07},
++	{0x4507, 0x00},
++	{0x4509, 0x00},
++	{REG_NULL, 0x00},
++};
++
++static const struct regval ov9281_1280x720_regs[] = {
++	{0x3778, 0x00},
++	{0x3800, 0x00},
++	{0x3801, 0x00},
++	{0x3802, 0x00},
++	{0x3803, 0x28},
++	{0x3804, 0x05},
++	{0x3805, 0x0f},
++	{0x3806, 0x03},
++	{0x3807, 0x07},
++	{0x3808, 0x05},
++	{0x3809, 0x00},
++	{0x380a, 0x02},
++	{0x380b, 0xd0},
++	{0x380c, 0x02},
++	{0x380d, 0xd8},
++	{0x380e, 0x03},
++	{0x380f, 0x8e},
++	{0x3810, 0x00},
++	{0x3811, 0x08},
++	{0x3812, 0x00},
++	{0x3813, 0x08},
++	{0x3814, 0x11},
++	{0x3815, 0x11},
++	{0x3820, 0x40},
++	{0x3821, 0x00},
++	{0x4003, 0x40},
++	{0x4008, 0x04},
++	{0x4009, 0x0b},
++	{0x400c, 0x00},
++	{0x400d, 0x07},
++	{0x4507, 0x00},
++	{0x4509, 0x00},
++	{REG_NULL, 0x00},
++};
++
++static const struct regval ov9281_640x400_regs[] = {
++	{0x3778, 0x10},
++	{0x3800, 0x00},
++	{0x3801, 0x00},
++	{0x3802, 0x00},
++	{0x3803, 0x00},
++	{0x3804, 0x05},
++	{0x3805, 0x0f},
++	{0x3806, 0x03},
++	{0x3807, 0x2f},
++	{0x3808, 0x02},
++	{0x3809, 0x80},
++	{0x380a, 0x01},
++	{0x380b, 0x90},
++	{0x380c, 0x02},
++	{0x380d, 0xd8},
++	{0x380e, 0x02},
++	{0x380f, 0x08},
++	{0x3810, 0x00},
++	{0x3811, 0x04},
++	{0x3812, 0x00},
++	{0x3813, 0x04},
++	{0x3814, 0x31},
++	{0x3815, 0x22},
++	{0x3820, 0x60},
++	{0x3821, 0x01},
++	{0x4008, 0x02},
++	{0x4009, 0x05},
++	{0x400c, 0x00},
++	{0x400d, 0x03},
++	{0x4507, 0x03},
++	{0x4509, 0x80},
++	{REG_NULL, 0x00},
++};
++
++static const struct regval op_10bit[] = {
++	{0x030d, 0x50},
++	{0x3662, 0x05},
++	{REG_NULL, 0x00},
++};
++
++static const struct regval op_8bit[] = {
++	{0x030d, 0x60},
++	{0x3662, 0x07},
++	{REG_NULL, 0x00},
++};
++
++static const struct ov9281_mode supported_modes[] = {
++	{
++		.width = 1280,
++		.height = 800,
++		.exp_def = 0x0320,
++		.hts_def = 0x05b0,	/* 0x2d8*2 */
++		.vts_def = 0x038e,
++		.crop = {
++			.left = 0,
++			.top = 0,
++			.width = 1280,
++			.height = 800
++		},
++		.reg_list = ov9281_1280x800_regs,
++	},
++	{
++		.width = 1280,
++		.height = 720,
++		.exp_def = 0x0320,
++		.hts_def = 0x05b0,
++		.vts_def = 761,
++		.crop = {
++			.left = 0,
++			.top = 40,
++			.width = 1280,
++			.height = 720
++		},
++		.reg_list = ov9281_1280x720_regs,
++	},
++	{
++		.width = 640,
++		.height = 400,
++		.exp_def = 0x0320,
++		.hts_def = 0x05b0,
++		.vts_def = 421,
++		.crop = {
++			.left = 0,
++			.top = 0,
++			.width = 1280,
++			.height = 800
++		},
++		.reg_list = ov9281_640x400_regs,
++	},
++};
++
++static const s64 link_freq_menu_items[] = {
++	OV9281_LINK_FREQ_400MHZ
++};
++
++static const char * const ov9281_test_pattern_menu[] = {
++	"Disabled",
++	"Vertical Color Bar Type 1",
++	"Vertical Color Bar Type 2",
++	"Vertical Color Bar Type 3",
++	"Vertical Color Bar Type 4"
++};
++
++/* Write registers up to 4 at a time */
++static int ov9281_write_reg(struct i2c_client *client, u16 reg,
++			    u32 len, u32 val)
++{
++	u32 buf_i, val_i;
++	u8 buf[6];
++	u8 *val_p;
++	__be32 val_be;
++
++	if (len > 4)
++		return -EINVAL;
++
++	buf[0] = reg >> 8;
++	buf[1] = reg & 0xff;
++
++	val_be = cpu_to_be32(val);
++	val_p = (u8 *)&val_be;
++	buf_i = 2;
++	val_i = 4 - len;
++
++	while (val_i < 4)
++		buf[buf_i++] = val_p[val_i++];
++
++	if (i2c_master_send(client, buf, len + 2) != len + 2)
++		return -EIO;
++
++	return 0;
++}
++
++static int ov9281_write_array(struct i2c_client *client,
++			      const struct regval *regs)
++{
++	u32 i;
++	int ret = 0;
++
++	for (i = 0; ret == 0 && regs[i].addr != REG_NULL; i++)
++		ret = ov9281_write_reg(client, regs[i].addr,
++				       OV9281_REG_VALUE_08BIT, regs[i].val);
++
++	return ret;
++}
++
++/* Read registers up to 4 at a time */
++static int ov9281_read_reg(struct i2c_client *client, u16 reg, unsigned int len,
++			   u32 *val)
++{
++	struct i2c_msg msgs[2];
++	u8 *data_be_p;
++	__be32 data_be = 0;
++	__be16 reg_addr_be = cpu_to_be16(reg);
++	int ret;
++
++	if (len > 4 || !len)
++		return -EINVAL;
++
++	data_be_p = (u8 *)&data_be;
++	/* Write register address */
++	msgs[0].addr = client->addr;
++	msgs[0].flags = 0;
++	msgs[0].len = 2;
++	msgs[0].buf = (u8 *)&reg_addr_be;
++
++	/* Read data from register */
++	msgs[1].addr = client->addr;
++	msgs[1].flags = I2C_M_RD;
++	msgs[1].len = len;
++	msgs[1].buf = &data_be_p[4 - len];
++
++	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++	if (ret != ARRAY_SIZE(msgs))
++		return -EIO;
++
++	*val = be32_to_cpu(data_be);
++
++	return 0;
++}
++
++static int ov9281_get_reso_dist(const struct ov9281_mode *mode,
++				struct v4l2_mbus_framefmt *framefmt)
++{
++	return abs(mode->width - framefmt->width) +
++	       abs(mode->height - framefmt->height);
++}
++
++static const struct ov9281_mode *
++ov9281_find_best_fit(struct v4l2_subdev_format *fmt)
++{
++	struct v4l2_mbus_framefmt *framefmt = &fmt->format;
++	int dist;
++	int cur_best_fit = 0;
++	int cur_best_fit_dist = -1;
++	unsigned int i;
++
++	for (i = 0; i < ARRAY_SIZE(supported_modes); i++) {
++		dist = ov9281_get_reso_dist(&supported_modes[i], framefmt);
++		if (cur_best_fit_dist == -1 || dist < cur_best_fit_dist) {
++			cur_best_fit_dist = dist;
++			cur_best_fit = i;
++		}
++	}
++
++	return &supported_modes[cur_best_fit];
++}
++
++static int ov9281_set_fmt(struct v4l2_subdev *sd,
++			  struct v4l2_subdev_state *sd_state,
++			  struct v4l2_subdev_format *fmt)
++{
++	struct ov9281 *ov9281 = to_ov9281(sd);
++	const struct ov9281_mode *mode;
++	s64 h_blank, vblank_def, pixel_rate;
++
++	mutex_lock(&ov9281->mutex);
++
++	mode = ov9281_find_best_fit(fmt);
++	if (fmt->format.code != MEDIA_BUS_FMT_Y8_1X8)
++		fmt->format.code = MEDIA_BUS_FMT_Y10_1X10;
++	fmt->format.width = mode->width;
++	fmt->format.height = mode->height;
++	fmt->format.field = V4L2_FIELD_NONE;
++	fmt->format.colorspace = V4L2_COLORSPACE_RAW;
++	fmt->format.ycbcr_enc =
++			V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->format.colorspace);
++	fmt->format.quantization =
++		V4L2_MAP_QUANTIZATION_DEFAULT(true, fmt->format.colorspace,
++					      fmt->format.ycbcr_enc);
++	fmt->format.xfer_func =
++		V4L2_MAP_XFER_FUNC_DEFAULT(fmt->format.colorspace);
++
++	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++		*v4l2_subdev_get_try_format(sd, sd_state, fmt->pad) = fmt->format;
++	} else {
++		ov9281->cur_mode = mode;
++		ov9281->code = fmt->format.code;
++		h_blank = mode->hts_def - mode->width;
++		__v4l2_ctrl_modify_range(ov9281->hblank, h_blank,
++					 h_blank, 1, h_blank);
++		__v4l2_ctrl_s_ctrl(ov9281->hblank, h_blank);
++		vblank_def = mode->vts_def - mode->height;
++		__v4l2_ctrl_modify_range(ov9281->vblank, vblank_def,
++					 OV9281_VTS_MAX - mode->height,
++					 1, vblank_def);
++		__v4l2_ctrl_s_ctrl(ov9281->vblank, vblank_def);
++
++		pixel_rate = (fmt->format.code == MEDIA_BUS_FMT_Y10_1X10) ?
++			OV9281_PIXEL_RATE_10BIT : OV9281_PIXEL_RATE_8BIT;
++		__v4l2_ctrl_modify_range(ov9281->pixel_rate, pixel_rate,
++					 pixel_rate, 1, pixel_rate);
++	}
++
++	mutex_unlock(&ov9281->mutex);
++
++	return 0;
++}
++
++static int ov9281_get_fmt(struct v4l2_subdev *sd,
++			  struct v4l2_subdev_state *sd_state,
++			  struct v4l2_subdev_format *fmt)
++{
++	struct ov9281 *ov9281 = to_ov9281(sd);
++	const struct ov9281_mode *mode = ov9281->cur_mode;
++
++	mutex_lock(&ov9281->mutex);
++	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++		fmt->format = *v4l2_subdev_get_try_format(sd, sd_state,
++							  fmt->pad);
++	} else {
++		fmt->format.width = mode->width;
++		fmt->format.height = mode->height;
++		fmt->format.code = ov9281->code;
++		fmt->format.field = V4L2_FIELD_NONE;
++		fmt->format.colorspace = V4L2_COLORSPACE_RAW;
++		fmt->format.ycbcr_enc =
++			V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->format.colorspace);
++		fmt->format.quantization =
++			V4L2_MAP_QUANTIZATION_DEFAULT(true,
++						      fmt->format.colorspace,
++						      fmt->format.ycbcr_enc);
++		fmt->format.xfer_func =
++			V4L2_MAP_XFER_FUNC_DEFAULT(fmt->format.colorspace);
++	}
++	mutex_unlock(&ov9281->mutex);
++
++	return 0;
++}
++
++static int ov9281_enum_mbus_code(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *sd_state,
++				 struct v4l2_subdev_mbus_code_enum *code)
++{
++	switch (code->index) {
++	default:
++		return -EINVAL;
++	case 0:
++		code->code = MEDIA_BUS_FMT_Y10_1X10;
++		break;
++	case 1:
++		code->code = MEDIA_BUS_FMT_Y8_1X8;
++		break;
++	}
++
++	return 0;
++}
++
++static int ov9281_enum_frame_sizes(struct v4l2_subdev *sd,
++				   struct v4l2_subdev_state *sd_state,
++				   struct v4l2_subdev_frame_size_enum *fse)
++{
++	if (fse->index >= ARRAY_SIZE(supported_modes))
++		return -EINVAL;
++
++	if (fse->code != MEDIA_BUS_FMT_Y10_1X10 &&
++	    fse->code != MEDIA_BUS_FMT_Y8_1X8)
++		return -EINVAL;
++
++	fse->min_width  = supported_modes[fse->index].width;
++	fse->max_width  = supported_modes[fse->index].width;
++	fse->max_height = supported_modes[fse->index].height;
++	fse->min_height = supported_modes[fse->index].height;
++
++	return 0;
++}
++
++static int ov9281_enable_test_pattern(struct ov9281 *ov9281, u32 pattern)
++{
++	u32 val;
++
++	if (pattern)
++		val = (pattern - 1) | OV9281_TEST_PATTERN_ENABLE;
++	else
++		val = OV9281_TEST_PATTERN_DISABLE;
++
++	return ov9281_write_reg(ov9281->client, OV9281_REG_TEST_PATTERN,
++				OV9281_REG_VALUE_08BIT, val);
++}
++
++static int ov9281_set_ctrl_hflip(struct ov9281 *ov9281, int value)
++{
++	u32 current_val;
++	int ret = ov9281_read_reg(ov9281->client, OV9281_REG_TIMING_FORMAT_2,
++					OV9281_REG_VALUE_08BIT, &current_val);
++	if (!ret) {
++		if (value)
++			current_val |= OV9281_FLIP_BIT;
++		else
++			current_val &= ~OV9281_FLIP_BIT;
++		return ov9281_write_reg(ov9281->client,
++						OV9281_REG_TIMING_FORMAT_2,
++						OV9281_REG_VALUE_08BIT,
++						current_val);
++	}
++	return ret;
++}
++
++static int ov9281_set_ctrl_vflip(struct ov9281 *ov9281, int value)
++{
++	u32 current_val;
++	int ret = ov9281_read_reg(ov9281->client, OV9281_REG_TIMING_FORMAT_1,
++					OV9281_REG_VALUE_08BIT, &current_val);
++	if (!ret) {
++		if (value)
++			current_val |= OV9281_FLIP_BIT;
++		else
++			current_val &= ~OV9281_FLIP_BIT;
++		return ov9281_write_reg(ov9281->client,
++						OV9281_REG_TIMING_FORMAT_1,
++						OV9281_REG_VALUE_08BIT,
++						current_val);
++	}
++	return ret;
++}
++
++static const struct v4l2_rect *
++__ov9281_get_pad_crop(struct ov9281 *ov9281,
++		      struct v4l2_subdev_state *sd_state,
++		      unsigned int pad, enum v4l2_subdev_format_whence which)
++{
++	switch (which) {
++	case V4L2_SUBDEV_FORMAT_TRY:
++		return v4l2_subdev_get_try_crop(&ov9281->subdev, sd_state,
++						pad);
++	case V4L2_SUBDEV_FORMAT_ACTIVE:
++		return &ov9281->cur_mode->crop;
++	}
++
++	return NULL;
++}
++
++static int ov9281_get_selection(struct v4l2_subdev *sd,
++				struct v4l2_subdev_state *sd_state,
++				struct v4l2_subdev_selection *sel)
++{
++	switch (sel->target) {
++	case V4L2_SEL_TGT_CROP: {
++		struct ov9281 *ov9281 = to_ov9281(sd);
++
++		mutex_lock(&ov9281->mutex);
++		sel->r = *__ov9281_get_pad_crop(ov9281, sd_state, sel->pad,
++						sel->which);
++		mutex_unlock(&ov9281->mutex);
++
++		return 0;
++	}
++
++	case V4L2_SEL_TGT_NATIVE_SIZE:
++		sel->r.top = 0;
++		sel->r.left = 0;
++		sel->r.width = OV9281_NATIVE_WIDTH;
++		sel->r.height = OV9281_NATIVE_HEIGHT;
++
++		return 0;
++
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++	case V4L2_SEL_TGT_CROP_BOUNDS:
++		sel->r.top = OV9281_PIXEL_ARRAY_TOP;
++		sel->r.left = OV9281_PIXEL_ARRAY_LEFT;
++		sel->r.width = OV9281_PIXEL_ARRAY_WIDTH;
++		sel->r.height = OV9281_PIXEL_ARRAY_HEIGHT;
++
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++static int __ov9281_start_stream(struct ov9281 *ov9281)
++{
++	int ret;
++
++	ret = ov9281_write_array(ov9281->client, ov9281_common_regs);
++	if (ret)
++		return ret;
++
++	ret = ov9281_write_array(ov9281->client, ov9281->cur_mode->reg_list);
++	if (ret)
++		return ret;
++
++	if (ov9281->code == MEDIA_BUS_FMT_Y10_1X10)
++		ret = ov9281_write_array(ov9281->client, op_10bit);
++	else
++		ret = ov9281_write_array(ov9281->client, op_8bit);
++	if (ret)
++		return ret;
++
++	/* In case these controls are set before streaming */
++	mutex_unlock(&ov9281->mutex);
++	ret = v4l2_ctrl_handler_setup(&ov9281->ctrl_handler);
++	mutex_lock(&ov9281->mutex);
++	if (ret)
++		return ret;
++
++	return ov9281_write_reg(ov9281->client, OV9281_REG_CTRL_MODE,
++				OV9281_REG_VALUE_08BIT, OV9281_MODE_STREAMING);
++}
++
++static int __ov9281_stop_stream(struct ov9281 *ov9281)
++{
++	return ov9281_write_reg(ov9281->client, OV9281_REG_CTRL_MODE,
++				OV9281_REG_VALUE_08BIT, OV9281_MODE_SW_STANDBY);
++}
++
++static int ov9281_s_stream(struct v4l2_subdev *sd, int on)
++{
++	struct ov9281 *ov9281 = to_ov9281(sd);
++	struct i2c_client *client = ov9281->client;
++	int ret = 0;
++
++	mutex_lock(&ov9281->mutex);
++	on = !!on;
++	if (on == ov9281->streaming)
++		goto unlock_and_return;
++
++	if (on) {
++		ret = pm_runtime_get_sync(&client->dev);
++		if (ret < 0) {
++			pm_runtime_put_noidle(&client->dev);
++			goto unlock_and_return;
++		}
++
++		ret = __ov9281_start_stream(ov9281);
++		if (ret) {
++			v4l2_err(sd, "start stream failed while write regs\n");
++			pm_runtime_put(&client->dev);
++			goto unlock_and_return;
++		}
++	} else {
++		__ov9281_stop_stream(ov9281);
++		pm_runtime_put(&client->dev);
++	}
++
++	ov9281->streaming = on;
++
++unlock_and_return:
++	mutex_unlock(&ov9281->mutex);
++
++	return ret;
++}
++
++static int ov9281_s_power(struct v4l2_subdev *sd, int on)
++{
++	struct ov9281 *ov9281 = to_ov9281(sd);
++	struct i2c_client *client = ov9281->client;
++	int ret = 0;
++
++	mutex_lock(&ov9281->mutex);
++
++	/* If the power state is not modified - no work to do. */
++	if (ov9281->power_on == !!on)
++		goto unlock_and_return;
++
++	if (on) {
++		ret = pm_runtime_get_sync(&client->dev);
++		if (ret < 0) {
++			pm_runtime_put_noidle(&client->dev);
++			goto unlock_and_return;
++		}
++		ov9281->power_on = true;
++	} else {
++		pm_runtime_put(&client->dev);
++		ov9281->power_on = false;
++	}
++
++unlock_and_return:
++	mutex_unlock(&ov9281->mutex);
++
++	return ret;
++}
++
++/* Calculate the delay in us by clock rate and clock cycles */
++static inline u32 ov9281_cal_delay(u32 cycles)
++{
++	return DIV_ROUND_UP(cycles, OV9281_XVCLK_FREQ / 1000 / 1000);
++}
++
++static int __ov9281_power_on(struct ov9281 *ov9281)
++{
++	int ret;
++	u32 delay_us;
++	struct device *dev = &ov9281->client->dev;
++
++	ret = clk_set_rate(ov9281->xvclk, OV9281_XVCLK_FREQ);
++	if (ret < 0)
++		dev_warn(dev, "Failed to set xvclk rate (24MHz)\n");
++	if (clk_get_rate(ov9281->xvclk) != OV9281_XVCLK_FREQ)
++		dev_warn(dev, "xvclk mismatched, modes are based on 24MHz - rate is %lu\n",
++			 clk_get_rate(ov9281->xvclk));
++
++	ret = clk_prepare_enable(ov9281->xvclk);
++	if (ret < 0) {
++		dev_err(dev, "Failed to enable xvclk\n");
++		return ret;
++	}
++
++	if (!IS_ERR(ov9281->reset_gpio))
++		gpiod_set_value_cansleep(ov9281->reset_gpio, 0);
++
++	ret = regulator_bulk_enable(OV9281_NUM_SUPPLIES, ov9281->supplies);
++	if (ret < 0) {
++		dev_err(dev, "Failed to enable regulators\n");
++		goto disable_clk;
++	}
++
++	if (!IS_ERR(ov9281->reset_gpio))
++		gpiod_set_value_cansleep(ov9281->reset_gpio, 1);
++
++	usleep_range(500, 1000);
++	if (!IS_ERR(ov9281->pwdn_gpio))
++		gpiod_set_value_cansleep(ov9281->pwdn_gpio, 1);
++
++	/* 8192 cycles prior to first SCCB transaction */
++	delay_us = ov9281_cal_delay(8192);
++	usleep_range(delay_us, delay_us * 2);
++
++	return 0;
++
++disable_clk:
++	clk_disable_unprepare(ov9281->xvclk);
++
++	return ret;
++}
++
++static void __ov9281_power_off(struct ov9281 *ov9281)
++{
++	if (!IS_ERR(ov9281->pwdn_gpio))
++		gpiod_set_value_cansleep(ov9281->pwdn_gpio, 0);
++	clk_disable_unprepare(ov9281->xvclk);
++	if (!IS_ERR(ov9281->reset_gpio))
++		gpiod_set_value_cansleep(ov9281->reset_gpio, 0);
++	regulator_bulk_disable(OV9281_NUM_SUPPLIES, ov9281->supplies);
++}
++
++static int ov9281_runtime_resume(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct ov9281 *ov9281 = to_ov9281(sd);
++
++	return __ov9281_power_on(ov9281);
++}
++
++static int ov9281_runtime_suspend(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct ov9281 *ov9281 = to_ov9281(sd);
++
++	__ov9281_power_off(ov9281);
++
++	return 0;
++}
++
++static int ov9281_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	struct ov9281 *ov9281 = to_ov9281(sd);
++	struct v4l2_mbus_framefmt *try_fmt =
++				v4l2_subdev_get_try_format(sd, fh->state, 0);
++	const struct ov9281_mode *def_mode = &supported_modes[0];
++
++	mutex_lock(&ov9281->mutex);
++	/* Initialize try_fmt */
++	try_fmt->width = def_mode->width;
++	try_fmt->height = def_mode->height;
++	try_fmt->code = MEDIA_BUS_FMT_Y10_1X10;
++	try_fmt->field = V4L2_FIELD_NONE;
++	try_fmt->colorspace = V4L2_COLORSPACE_RAW;
++	try_fmt->ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(try_fmt->colorspace);
++	try_fmt->quantization =
++		V4L2_MAP_QUANTIZATION_DEFAULT(true, try_fmt->colorspace,
++					      try_fmt->ycbcr_enc);
++	try_fmt->xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(try_fmt->colorspace);
++
++	mutex_unlock(&ov9281->mutex);
++	/* No crop or compose */
++
++	return 0;
++}
++
++static const struct dev_pm_ops ov9281_pm_ops = {
++	SET_RUNTIME_PM_OPS(ov9281_runtime_suspend,
++			   ov9281_runtime_resume, NULL)
++};
++
++static const struct v4l2_subdev_internal_ops ov9281_internal_ops = {
++	.open = ov9281_open,
++};
++
++static const struct v4l2_subdev_core_ops ov9281_core_ops = {
++	.s_power = ov9281_s_power,
++};
++
++static const struct v4l2_subdev_video_ops ov9281_video_ops = {
++	.s_stream = ov9281_s_stream,
++};
++
++static const struct v4l2_subdev_pad_ops ov9281_pad_ops = {
++	.enum_mbus_code = ov9281_enum_mbus_code,
++	.enum_frame_size = ov9281_enum_frame_sizes,
++	.get_fmt = ov9281_get_fmt,
++	.set_fmt = ov9281_set_fmt,
++	.get_selection = ov9281_get_selection,
++};
++
++static const struct v4l2_subdev_ops ov9281_subdev_ops = {
++	.core	= &ov9281_core_ops,
++	.video	= &ov9281_video_ops,
++	.pad	= &ov9281_pad_ops,
++};
++
++static int ov9281_set_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct ov9281 *ov9281 = container_of(ctrl->handler,
++					     struct ov9281, ctrl_handler);
++	struct i2c_client *client = ov9281->client;
++	s64 max;
++	int ret = 0;
++
++	/* Propagate change of current control to all related controls */
++	switch (ctrl->id) {
++	case V4L2_CID_VBLANK:
++		/* Update max exposure while meeting expected vblanking */
++		max = ov9281->cur_mode->height + ctrl->val - 4;
++		__v4l2_ctrl_modify_range(ov9281->exposure,
++					 ov9281->exposure->minimum, max,
++					 ov9281->exposure->step,
++					 ov9281->exposure->default_value);
++		break;
++	}
++
++	if (pm_runtime_get(&client->dev) <= 0)
++		return 0;
++
++	switch (ctrl->id) {
++	case V4L2_CID_HFLIP:
++		ret = ov9281_set_ctrl_hflip(ov9281, ctrl->val);
++		break;
++	case V4L2_CID_VFLIP:
++		ret = ov9281_set_ctrl_vflip(ov9281, ctrl->val);
++		break;
++	case V4L2_CID_EXPOSURE:
++		/* 4 least significant bits of expsoure are fractional part */
++		ret = ov9281_write_reg(ov9281->client, OV9281_REG_EXPOSURE,
++				       OV9281_REG_VALUE_24BIT, ctrl->val << 4);
++		break;
++	case V4L2_CID_ANALOGUE_GAIN:
++		ret = ov9281_write_reg(ov9281->client, OV9281_REG_GAIN_H,
++				       OV9281_REG_VALUE_08BIT,
++				       (ctrl->val >> OV9281_GAIN_H_SHIFT) &
++							OV9281_GAIN_H_MASK);
++		ret |= ov9281_write_reg(ov9281->client, OV9281_REG_GAIN_L,
++				       OV9281_REG_VALUE_08BIT,
++				       ctrl->val & OV9281_GAIN_L_MASK);
++		break;
++	case V4L2_CID_VBLANK:
++		ret = ov9281_write_reg(ov9281->client, OV9281_REG_VTS,
++				       OV9281_REG_VALUE_16BIT,
++				       ctrl->val + ov9281->cur_mode->height);
++		break;
++	case V4L2_CID_TEST_PATTERN:
++		ret = ov9281_enable_test_pattern(ov9281, ctrl->val);
++		break;
++	default:
++		dev_warn(&client->dev, "%s Unhandled id:0x%x, val:0x%x\n",
++			 __func__, ctrl->id, ctrl->val);
++		break;
++	}
++
++	pm_runtime_put(&client->dev);
++
++	return ret;
++}
++
++static const struct v4l2_ctrl_ops ov9281_ctrl_ops = {
++	.s_ctrl = ov9281_set_ctrl,
++};
++
++static int ov9281_initialize_controls(struct ov9281 *ov9281)
++{
++	struct v4l2_fwnode_device_properties props;
++	const struct ov9281_mode *mode;
++	struct v4l2_ctrl_handler *handler;
++	struct v4l2_ctrl *ctrl;
++	s64 exposure_max, vblank_def;
++	u32 h_blank;
++	int ret;
++
++	handler = &ov9281->ctrl_handler;
++	mode = ov9281->cur_mode;
++	ret = v4l2_ctrl_handler_init(handler, 11);
++	if (ret)
++		return ret;
++	handler->lock = &ov9281->mutex;
++
++	ctrl = v4l2_ctrl_new_int_menu(handler, NULL, V4L2_CID_LINK_FREQ,
++				      0, 0, link_freq_menu_items);
++	if (ctrl)
++		ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	ov9281->pixel_rate = v4l2_ctrl_new_std(handler, NULL,
++					       V4L2_CID_PIXEL_RATE,
++					       OV9281_PIXEL_RATE_10BIT,
++					       OV9281_PIXEL_RATE_10BIT, 1,
++					       OV9281_PIXEL_RATE_10BIT);
++
++	h_blank = mode->hts_def - mode->width;
++	ov9281->hblank = v4l2_ctrl_new_std(handler, NULL, V4L2_CID_HBLANK,
++					   h_blank, h_blank, 1, h_blank);
++	if (ov9281->hblank)
++		ov9281->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	vblank_def = mode->vts_def - mode->height;
++	ov9281->vblank = v4l2_ctrl_new_std(handler, &ov9281_ctrl_ops,
++					   V4L2_CID_VBLANK, vblank_def,
++					   OV9281_VTS_MAX - mode->height, 1,
++					   vblank_def);
++
++	exposure_max = mode->vts_def - 4;
++	ov9281->exposure = v4l2_ctrl_new_std(handler, &ov9281_ctrl_ops,
++					     V4L2_CID_EXPOSURE,
++					     OV9281_EXPOSURE_MIN, exposure_max,
++					     OV9281_EXPOSURE_STEP,
++					     mode->exp_def);
++
++	ov9281->anal_gain = v4l2_ctrl_new_std(handler, &ov9281_ctrl_ops,
++					      V4L2_CID_ANALOGUE_GAIN,
++					      OV9281_GAIN_MIN, OV9281_GAIN_MAX,
++					      OV9281_GAIN_STEP,
++					      OV9281_GAIN_DEFAULT);
++
++	ov9281->vflip = v4l2_ctrl_new_std(handler, &ov9281_ctrl_ops,
++					  V4L2_CID_VFLIP,
++						0, 1, 1, 0);
++
++	ov9281->hflip = v4l2_ctrl_new_std(handler, &ov9281_ctrl_ops,
++					  V4L2_CID_HFLIP,
++						0, 1, 1, 0);
++
++	ov9281->test_pattern =
++		v4l2_ctrl_new_std_menu_items(handler, &ov9281_ctrl_ops,
++					     V4L2_CID_TEST_PATTERN,
++					     ARRAY_SIZE(ov9281_test_pattern_menu) - 1,
++					     0, 0, ov9281_test_pattern_menu);
++
++	if (handler->error) {
++		ret = handler->error;
++		dev_err(&ov9281->client->dev,
++			"Failed to init controls(%d)\n", ret);
++		goto err_free_handler;
++	}
++
++	ret = v4l2_fwnode_device_parse(&ov9281->client->dev, &props);
++	if (ret)
++		goto err_free_handler;
++
++	ret = v4l2_ctrl_new_fwnode_properties(handler, &ov9281_ctrl_ops,
++					      &props);
++	if (ret)
++		goto err_free_handler;
++
++	ov9281->subdev.ctrl_handler = handler;
++
++	return 0;
++
++err_free_handler:
++	v4l2_ctrl_handler_free(handler);
++
++	return ret;
++}
++
++static int ov9281_check_sensor_id(struct ov9281 *ov9281,
++				  struct i2c_client *client)
++{
++	struct device *dev = &ov9281->client->dev;
++	u32 id = 0, id_msb;
++	int ret;
++
++	ret = ov9281_read_reg(client, OV9281_REG_CHIP_ID + 1,
++			      OV9281_REG_VALUE_08BIT, &id);
++	if (!ret)
++		ret = ov9281_read_reg(client, OV9281_REG_CHIP_ID,
++				      OV9281_REG_VALUE_08BIT, &id_msb);
++	id |= (id_msb << 8);
++	if (ret || id != CHIP_ID) {
++		dev_err(dev, "Unexpected sensor id(%04x), ret(%d)\n", id, ret);
++		return -ENODEV;
++	}
++
++	dev_info(dev, "Detected OV%06x sensor\n", CHIP_ID);
++
++	return 0;
++}
++
++static int ov9281_configure_regulators(struct ov9281 *ov9281)
++{
++	unsigned int i;
++
++	for (i = 0; i < OV9281_NUM_SUPPLIES; i++)
++		ov9281->supplies[i].supply = ov9281_supply_names[i];
++
++	return devm_regulator_bulk_get(&ov9281->client->dev,
++				       OV9281_NUM_SUPPLIES,
++				       ov9281->supplies);
++}
++
++static int ov9281_probe(struct i2c_client *client,
++			const struct i2c_device_id *id)
++{
++	struct device *dev = &client->dev;
++	struct ov9281 *ov9281;
++	struct v4l2_subdev *sd;
++	int ret;
++
++	ov9281 = devm_kzalloc(dev, sizeof(*ov9281), GFP_KERNEL);
++	if (!ov9281)
++		return -ENOMEM;
++
++	ov9281->client = client;
++	ov9281->cur_mode = &supported_modes[0];
++
++	ov9281->xvclk = devm_clk_get(dev, "xvclk");
++	if (IS_ERR(ov9281->xvclk)) {
++		dev_err(dev, "Failed to get xvclk\n");
++		return -EINVAL;
++	}
++
++	ov9281->reset_gpio = devm_gpiod_get_optional(dev, "reset",
++						     GPIOD_OUT_LOW);
++	if (IS_ERR(ov9281->reset_gpio))
++		dev_warn(dev, "Failed to get reset-gpios\n");
++
++	ov9281->pwdn_gpio = devm_gpiod_get_optional(dev, "pwdn", GPIOD_OUT_LOW);
++	if (IS_ERR(ov9281->pwdn_gpio))
++		dev_warn(dev, "Failed to get pwdn-gpios\n");
++
++	ret = ov9281_configure_regulators(ov9281);
++	if (ret) {
++		dev_err(dev, "Failed to get power regulators\n");
++		return ret;
++	}
++
++	mutex_init(&ov9281->mutex);
++
++	sd = &ov9281->subdev;
++	v4l2_i2c_subdev_init(sd, client, &ov9281_subdev_ops);
++	ret = ov9281_initialize_controls(ov9281);
++	if (ret)
++		goto err_destroy_mutex;
++
++	ret = __ov9281_power_on(ov9281);
++	if (ret)
++		goto err_free_handler;
++
++	ret = ov9281_check_sensor_id(ov9281, client);
++	if (ret)
++		goto err_power_off;
++
++	sd->internal_ops = &ov9281_internal_ops;
++	sd->flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
++
++	ov9281->pad.flags = MEDIA_PAD_FL_SOURCE;
++	sd->entity.function = MEDIA_ENT_F_CAM_SENSOR;
++	ret = media_entity_pads_init(&sd->entity, 1, &ov9281->pad);
++	if (ret < 0)
++		goto err_power_off;
++
++	ret = v4l2_async_register_subdev_sensor(sd);
++	if (ret) {
++		dev_err(dev, "v4l2 async register subdev failed\n");
++		goto err_clean_entity;
++	}
++
++	pm_runtime_set_active(dev);
++	pm_runtime_enable(dev);
++	pm_runtime_idle(dev);
++
++	return 0;
++
++err_clean_entity:
++	media_entity_cleanup(&sd->entity);
++err_power_off:
++	__ov9281_power_off(ov9281);
++err_free_handler:
++	v4l2_ctrl_handler_free(&ov9281->ctrl_handler);
++err_destroy_mutex:
++	mutex_destroy(&ov9281->mutex);
++
++	return ret;
++}
++
++static void ov9281_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct ov9281 *ov9281 = to_ov9281(sd);
++
++	v4l2_async_unregister_subdev(sd);
++	media_entity_cleanup(&sd->entity);
++	v4l2_ctrl_handler_free(&ov9281->ctrl_handler);
++	mutex_destroy(&ov9281->mutex);
++
++	pm_runtime_disable(&client->dev);
++	if (!pm_runtime_status_suspended(&client->dev))
++		__ov9281_power_off(ov9281);
++	pm_runtime_set_suspended(&client->dev);
++}
++
++static const struct of_device_id ov9281_of_match[] = {
++	{ .compatible = "ovti,ov9281" },
++	{},
++};
++MODULE_DEVICE_TABLE(of, ov9281_of_match);
++
++static const struct i2c_device_id ov9281_match_id[] = {
++	{ "ovti,ov9281", 0 },
++	{ },
++};
++
++static struct i2c_driver ov9281_i2c_driver = {
++	.driver = {
++		.name = OV9281_NAME,
++		.pm = &ov9281_pm_ops,
++		.of_match_table = of_match_ptr(ov9281_of_match),
++	},
++	.probe		= &ov9281_probe,
++	.remove		= &ov9281_remove,
++	.id_table	= ov9281_match_id,
++};
++
++static int __init sensor_mod_init(void)
++{
++	return i2c_add_driver(&ov9281_i2c_driver);
++}
++
++static void __exit sensor_mod_exit(void)
++{
++	i2c_del_driver(&ov9281_i2c_driver);
++}
++
++device_initcall_sync(sensor_mod_init);
++module_exit(sensor_mod_exit);
++
++MODULE_DESCRIPTION("OmniVision ov9281 sensor driver");
++MODULE_LICENSE("GPL v2");
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -443,7 +443,7 @@ struct unicam_device {
+ 	/* ptr to  sub device */
+ 	struct v4l2_subdev *sensor;
+ 	/* Pad config for the sensor */
+-	struct v4l2_subdev_pad_config *sensor_config;
++	struct v4l2_subdev_state *sensor_state;
+ 
+ 	enum v4l2_mbus_type bus_type;
+ 	/*
+@@ -594,7 +594,7 @@ static int __subdev_get_format(struct un
+ 	};
+ 	int ret;
+ 
+-	ret = v4l2_subdev_call(dev->sensor, pad, get_fmt, dev->sensor_config,
++	ret = v4l2_subdev_call(dev->sensor, pad, get_fmt, dev->sensor_state,
+ 			       &sd_fmt);
+ 	if (ret < 0)
+ 		return ret;
+@@ -618,7 +618,7 @@ static int __subdev_set_format(struct un
+ 
+ 	sd_fmt.format = *fmt;
+ 
+-	ret = v4l2_subdev_call(dev->sensor, pad, set_fmt, dev->sensor_config,
++	ret = v4l2_subdev_call(dev->sensor, pad, set_fmt, dev->sensor_state,
+ 			       &sd_fmt);
+ 	if (ret < 0)
+ 		return ret;
+@@ -1094,7 +1094,7 @@ static int unicam_try_fmt_vid_cap(struct
+ 	 */
+ 	mbus_fmt->field = V4L2_FIELD_NONE;
+ 
+-	ret = v4l2_subdev_call(dev->sensor, pad, set_fmt, dev->sensor_config,
++	ret = v4l2_subdev_call(dev->sensor, pad, set_fmt, dev->sensor_state,
+ 			       &sd_fmt);
+ 	if (ret && ret != -ENOIOCTLCMD && ret != -ENODEV)
+ 		return ret;
+@@ -1116,7 +1116,7 @@ static int unicam_try_fmt_vid_cap(struct
+ 			mbus_fmt->code = fmt->code;
+ 
+ 			ret = v4l2_subdev_call(dev->sensor, pad, set_fmt,
+-					       dev->sensor_config, &sd_fmt);
++					       dev->sensor_state, &sd_fmt);
+ 			if (ret && ret != -ENOIOCTLCMD && ret != -ENODEV)
+ 				return ret;
+ 
+@@ -2320,8 +2320,8 @@ static void unicam_release(struct kref *
+ 	v4l2_ctrl_handler_free(&unicam->ctrl_handler);
+ 	media_device_cleanup(&unicam->mdev);
+ 
+-	if (unicam->sensor_config)
+-		v4l2_subdev_free_pad_config(unicam->sensor_config);
++	if (unicam->sensor_state)
++		__v4l2_subdev_state_free(unicam->sensor_state);
+ 
+ 	kfree(unicam);
+ }
+@@ -2579,12 +2579,14 @@ static void unregister_nodes(struct unic
+ 
+ static int unicam_probe_complete(struct unicam_device *unicam)
+ {
++	static struct lock_class_key key;
+ 	int ret;
+ 
+ 	unicam->v4l2_dev.notify = unicam_notify;
+ 
+-	unicam->sensor_config = v4l2_subdev_alloc_pad_config(unicam->sensor);
+-	if (!unicam->sensor_config)
++	unicam->sensor_state = __v4l2_subdev_state_alloc(unicam->sensor,
++							 "unicam:async->lock", &key);
++	if (!unicam->sensor_state)
+ 		return -ENOMEM;
+ 
+ 	unicam->sensor_embedded_data = (unicam->sensor->entity.num_pads >= 2);
+--- a/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
+@@ -1465,7 +1465,7 @@ queue_cleanup:
+ }
+ 
+ /* Unregister one of the /dev/video<N> nodes associated with the ISP. */
+-static void unregister_node(struct bcm2835_isp_node *node)
++static void bcm2835_unregister_node(struct bcm2835_isp_node *node)
+ {
+ 	struct bcm2835_isp_dev *dev = node_get_dev(node);
+ 
+@@ -1668,7 +1668,7 @@ static int bcm2835_isp_remove(struct pla
+ 	media_controller_unregister(dev);
+ 
+ 	for (i = 0; i < BCM2835_ISP_NUM_NODES; i++)
+-		unregister_node(&dev->node[i]);
++		bcm2835_unregister_node(&dev->node[i]);
+ 
+ 	v4l2_device_unregister(&dev->v4l2_dev);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0313-media-ov5647-Fix-return-codes-from-ov5647_write-ov56.patch b/target/linux/bcm27xx/patches-6.1/950-0313-media-ov5647-Fix-return-codes-from-ov5647_write-ov56.patch
new file mode 100644
index 00000000000000..0012039bc8690f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0313-media-ov5647-Fix-return-codes-from-ov5647_write-ov56.patch
@@ -0,0 +1,89 @@
+From 38aa34eae8e6aa8504f97f86ac155a0ebc6a0557 Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.org>
+Date: Wed, 15 Jan 2020 13:40:38 +0000
+Subject: [PATCH] media: ov5647: Fix return codes from
+ ov5647_write/ov5647_read functions.
+
+Previously they were returning positive non-zero codes for success,
+which were getting passed up the call stack. Since release 4.19,
+do_dentry_open (fs/open.c) has been catching these and flagging an
+error. (So this driver has been broken since that date.)
+
+Fixes: 3c2472a [media] media: i2c: Add support for OV5647 sensor
+Signed-off-by: David Plowman <david.plowman@raspberrypi.org>
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/ov5647.c | 38 ++++++++++++++++++++++++++++++++------
+ 1 file changed, 32 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -587,7 +587,13 @@ static int ov5647_write16(struct v4l2_su
+ 	int ret;
+ 
+ 	ret = i2c_master_send(client, data, 4);
+-	if (ret < 0) {
++	/*
++	 * Writing the wrong number of bytes also needs to be flagged as an
++	 * error. Success needs to produce a 0 return code.
++	 */
++	if (ret == 4) {
++		ret = 0;
++	} else {
+ 		dev_dbg(&client->dev, "%s: i2c write error, reg: %x\n",
+ 			__func__, reg);
+ 		return ret;
+@@ -603,10 +609,17 @@ static int ov5647_write(struct v4l2_subd
+ 	int ret;
+ 
+ 	ret = i2c_master_send(client, data, 3);
+-	if (ret < 0) {
++	/*
++	 * Writing the wrong number of bytes also needs to be flagged as an
++	 * error. Success needs to produce a 0 return code.
++	 */
++	if (ret == 3) {
++		ret = 0;
++	} else {
+ 		dev_dbg(&client->dev, "%s: i2c write error, reg: %x\n",
+ 				__func__, reg);
+-		return ret;
++		if (ret >= 0)
++			ret = -EINVAL;
+ 	}
+ 
+ 	return 0;
+@@ -619,17 +632,30 @@ static int ov5647_read(struct v4l2_subde
+ 	int ret;
+ 
+ 	ret = i2c_master_send(client, data_w, 2);
+-	if (ret < 0) {
++	/*
++	 * A negative return code, or sending the wrong number of bytes, both
++	 * count as an error.
++	 */
++	if (ret != 2) {
+ 		dev_dbg(&client->dev, "%s: i2c write error, reg: %x\n",
+ 			__func__, reg);
++		if (ret >= 0)
++			ret = -EINVAL;
+ 		return ret;
+ 	}
+ 
+ 	ret = i2c_master_recv(client, val, 1);
+-	if (ret < 0) {
++	/*
++	 * The only return value indicating success is 1. Anything else, even
++	 * a non-negative value, indicates something went wrong.
++	 */
++	if (ret == 1) {
++		ret = 0;
++	} else {
+ 		dev_dbg(&client->dev, "%s: i2c read error, reg: %x\n",
+ 				__func__, reg);
+-		return ret;
++		if (ret >= 0)
++			ret = -EINVAL;
+ 	}
+ 
+ 	return 0;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0314-media-i2c-ov5647-Parse-and-register-properties.patch b/target/linux/bcm27xx/patches-6.1/950-0314-media-i2c-ov5647-Parse-and-register-properties.patch
new file mode 100644
index 00000000000000..a26c6f0788bf10
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0314-media-i2c-ov5647-Parse-and-register-properties.patch
@@ -0,0 +1,49 @@
+From 1103a0bb22ef77a47a7a1ac2293b1dd4ad2cf506 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sat, 4 Jul 2020 01:45:08 +0300
+Subject: [PATCH] media: i2c: ov5647: Parse and register properties
+
+Parse device properties and register controls for them using the V4L2
+fwnode properties helpers.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+---
+ drivers/media/i2c/ov5647.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -1291,10 +1291,11 @@ static const struct v4l2_ctrl_ops ov5647
+ 	.s_ctrl = ov5647_s_ctrl,
+ };
+ 
+-static int ov5647_init_controls(struct ov5647 *sensor)
++static int ov5647_init_controls(struct ov5647 *sensor, struct device *dev)
+ {
+ 	struct i2c_client *client = v4l2_get_subdevdata(&sensor->sd);
+ 	int hblank, exposure_max, exposure_def;
++	struct v4l2_fwnode_device_properties props;
+ 
+ 	v4l2_ctrl_handler_init(&sensor->ctrls, 8);
+ 
+@@ -1340,6 +1341,11 @@ static int ov5647_init_controls(struct o
+ 					   sensor->mode->vts -
+ 					   sensor->mode->format.height);
+ 
++	v4l2_fwnode_device_parse(dev, &props);
++
++	v4l2_ctrl_new_fwnode_properties(&sensor->ctrls, &ov5647_ctrl_ops,
++					&props);
++
+ 	if (sensor->ctrls.error)
+ 		goto handler_free;
+ 
+@@ -1426,7 +1432,7 @@ static int ov5647_probe(struct i2c_clien
+ 
+ 	sensor->mode = OV5647_DEFAULT_MODE;
+ 
+-	ret = ov5647_init_controls(sensor);
++	ret = ov5647_init_controls(sensor, dev);
+ 	if (ret)
+ 		goto mutex_destroy;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0315-staging-bcm2835-camera-Add-support-for-DMABUFs.patch b/target/linux/bcm27xx/patches-6.1/950-0315-staging-bcm2835-camera-Add-support-for-DMABUFs.patch
new file mode 100644
index 00000000000000..a41791c0e23e09
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0315-staging-bcm2835-camera-Add-support-for-DMABUFs.patch
@@ -0,0 +1,37 @@
+From 62d78891ffd2cc65c2d33bedc5a9ade25dc10041 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 17 Mar 2021 12:34:57 +0000
+Subject: [PATCH] staging/bcm2835-camera: Add support for DMABUFs
+
+DMABUFs are all handled by videobuf2, so there is no reason not
+to enable support for them.
+
+Note that this driver is still using the vmalloc allocator, so
+the buffers it allocates will not be compatible with the codec
+or ISP driver that require contiguous buffers. However this
+driver should be able to import the buffers allocated by them.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+@@ -1449,6 +1449,7 @@ static const struct v4l2_ioctl_ops camer
+ 	.vidioc_querybuf = vb2_ioctl_querybuf,
+ 	.vidioc_qbuf = vb2_ioctl_qbuf,
+ 	.vidioc_dqbuf = vb2_ioctl_dqbuf,
++	.vidioc_expbuf = vb2_ioctl_expbuf,
+ 	.vidioc_enum_framesizes = vidioc_enum_framesizes,
+ 	.vidioc_enum_frameintervals = vidioc_enum_frameintervals,
+ 	.vidioc_g_parm        = vidioc_g_parm,
+@@ -1928,7 +1929,7 @@ static int bcm2835_mmal_probe(struct pla
+ 		q = &dev->capture.vb_vidq;
+ 		memset(q, 0, sizeof(*q));
+ 		q->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+-		q->io_modes = VB2_MMAP | VB2_USERPTR | VB2_READ;
++		q->io_modes = VB2_MMAP | VB2_USERPTR | VB2_READ | VB2_DMABUF;
+ 		q->drv_priv = dev;
+ 		q->buf_struct_size = sizeof(struct vb2_mmal_buffer);
+ 		q->ops = &bcm2835_mmal_video_qops;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0316-staging-fbtft-Add-minipitft13-variant.patch b/target/linux/bcm27xx/patches-6.1/950-0316-staging-fbtft-Add-minipitft13-variant.patch
new file mode 100644
index 00000000000000..80960717569d9f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0316-staging-fbtft-Add-minipitft13-variant.patch
@@ -0,0 +1,104 @@
+From b036f748f2f077e5028d57c726cacabf39465305 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 19 Feb 2021 10:25:01 +0000
+Subject: [PATCH] staging: fbtft: Add minipitft13 variant
+
+The Adafruit Mini-PiTFT13 display needs offsets applying when rotated,
+so use the "variant" mechanism to select a custom set_addr_win method
+using a dedicated compatible string of "fbtft,minipitft13".
+
+See: https://github.com/raspberrypi/firmware/issues/1524
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/staging/fbtft/fb_st7789v.c | 44 +++++++++++++++++++++++++++++-
+ 1 file changed, 43 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/fbtft/fb_st7789v.c
++++ b/drivers/staging/fbtft/fb_st7789v.c
+@@ -75,6 +75,11 @@ enum st7789v_command {
+ 
+ static struct completion panel_te; /* completion for panel TE line */
+ static int irq_te; /* Linux IRQ for LCD TE line */
++static u32 col_offset = 0;
++static u32 row_offset = 0;
++static u8 col_hack_fix_offset = 0;
++static short x_offset = 0;
++static short y_offset = 0;
+ 
+ static irqreturn_t panel_te_handler(int irq, void *data)
+ {
+@@ -261,6 +266,22 @@ static int write_vmem(struct fbtft_par *
+ 	return ret;
+ }
+ 
++static void minipitft13_set_addr_win(struct fbtft_par *par, int xs, int ys,
++				     int xe, int ye)
++{
++	xs += x_offset;
++	xe += x_offset;
++	ys += y_offset;
++	ye += y_offset;
++	write_reg(par, MIPI_DCS_SET_COLUMN_ADDRESS,
++		  xs >> 8, xs & 0xFF, xe >> 8, xe & 0xFF);
++
++	write_reg(par, MIPI_DCS_SET_PAGE_ADDRESS,
++		  ys >> 8, ys & 0xFF, ye >> 8, ye & 0xFF);
++
++	write_reg(par, MIPI_DCS_WRITE_MEMORY_START);
++}
++
+ /**
+  * set_var() - apply LCD properties like rotation and BGR mode
+  *
+@@ -271,20 +292,32 @@ static int write_vmem(struct fbtft_par *
+ static int set_var(struct fbtft_par *par)
+ {
+ 	u8 madctl_par = 0;
++	struct fbtft_display *display = &par->pdata->display;
++	u32 width = display->width;
++	u32 height = display->height;
+ 
+ 	if (par->bgr)
+ 		madctl_par |= MADCTL_BGR;
+ 	switch (par->info->var.rotate) {
+ 	case 0:
++		x_offset = 0;
++		y_offset = 0;
+ 		break;
+ 	case 90:
+ 		madctl_par |= (MADCTL_MV | MADCTL_MY);
++		x_offset = (320 - height) - row_offset;
++		y_offset = (240 - width) - col_offset;
+ 		break;
+ 	case 180:
+ 		madctl_par |= (MADCTL_MX | MADCTL_MY);
++		x_offset = (240 - width) - col_offset + col_hack_fix_offset;
++		// hack tweak to account for extra pixel width to make even
++		y_offset = (320 - height) - row_offset;
+ 		break;
+ 	case 270:
+ 		madctl_par |= (MADCTL_MV | MADCTL_MX);
++		x_offset = row_offset;
++		y_offset = col_offset;
+ 		break;
+ 	default:
+ 		return -EINVAL;
+@@ -382,7 +415,16 @@ static struct fbtft_display display = {
+ 	},
+ };
+ 
+-FBTFT_REGISTER_DRIVER(DRVNAME, "sitronix,st7789v", &display);
++int variant_minipitft13(struct fbtft_display *display)
++{
++	display->fbtftops.set_addr_win = minipitft13_set_addr_win;
++	return 0;
++}
++
++FBTFT_REGISTER_DRIVER_START(&display)
++FBTFT_COMPATIBLE("sitronix,st7789v")
++FBTFT_VARIANT_COMPATIBLE("fbtft,minipitft13", variant_minipitft13)
++FBTFT_REGISTER_DRIVER_END(DRVNAME, &display);
+ 
+ MODULE_ALIAS("spi:" DRVNAME);
+ MODULE_ALIAS("platform:" DRVNAME);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0317-drm-panel-jdi-lt070me05000-Use-gpiod_set_value_cansl.patch b/target/linux/bcm27xx/patches-6.1/950-0317-drm-panel-jdi-lt070me05000-Use-gpiod_set_value_cansl.patch
new file mode 100644
index 00000000000000..f33690c1841f68
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0317-drm-panel-jdi-lt070me05000-Use-gpiod_set_value_cansl.patch
@@ -0,0 +1,67 @@
+From 02e0cfa1a5d43db75f95db29af672947eed587ed Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 15 Apr 2021 17:30:35 +0100
+Subject: [PATCH] drm/panel: jdi-lt070me05000: Use
+ gpiod_set_value_cansleep
+
+There is no reason why the control GPIOs for the panel can not
+be connected to I2C or similar GPIO interfaces that may need to
+sleep, therefore switch from gpiod_set_value to
+gpiod_set_value_cansleep calls to configure them.
+Without that you get complaints from gpiolib every time the state
+is changed.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/panel/panel-jdi-lt070me05000.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/panel/panel-jdi-lt070me05000.c
++++ b/drivers/gpu/drm/panel/panel-jdi-lt070me05000.c
+@@ -205,11 +205,11 @@ static int jdi_panel_unprepare(struct dr
+ 	if (ret < 0)
+ 		dev_err(dev, "regulator disable failed, %d\n", ret);
+ 
+-	gpiod_set_value(jdi->enable_gpio, 0);
++	gpiod_set_value_cansleep(jdi->enable_gpio, 0);
+ 
+-	gpiod_set_value(jdi->reset_gpio, 1);
++	gpiod_set_value_cansleep(jdi->reset_gpio, 1);
+ 
+-	gpiod_set_value(jdi->dcdc_en_gpio, 0);
++	gpiod_set_value_cansleep(jdi->dcdc_en_gpio, 0);
+ 
+ 	jdi->prepared = false;
+ 
+@@ -233,13 +233,13 @@ static int jdi_panel_prepare(struct drm_
+ 
+ 	msleep(20);
+ 
+-	gpiod_set_value(jdi->dcdc_en_gpio, 1);
++	gpiod_set_value_cansleep(jdi->dcdc_en_gpio, 1);
+ 	usleep_range(10, 20);
+ 
+-	gpiod_set_value(jdi->reset_gpio, 0);
++	gpiod_set_value_cansleep(jdi->reset_gpio, 0);
+ 	usleep_range(10, 20);
+ 
+-	gpiod_set_value(jdi->enable_gpio, 1);
++	gpiod_set_value_cansleep(jdi->enable_gpio, 1);
+ 	usleep_range(10, 20);
+ 
+ 	ret = jdi_panel_init(jdi);
+@@ -263,11 +263,11 @@ poweroff:
+ 	if (ret < 0)
+ 		dev_err(dev, "regulator disable failed, %d\n", ret);
+ 
+-	gpiod_set_value(jdi->enable_gpio, 0);
++	gpiod_set_value_cansleep(jdi->enable_gpio, 0);
+ 
+-	gpiod_set_value(jdi->reset_gpio, 1);
++	gpiod_set_value_cansleep(jdi->reset_gpio, 1);
+ 
+-	gpiod_set_value(jdi->dcdc_en_gpio, 0);
++	gpiod_set_value_cansleep(jdi->dcdc_en_gpio, 0);
+ 
+ 	return ret;
+ }
diff --git a/target/linux/bcm27xx/patches-6.1/950-0318-staging-bcm2835-camera-Add-support-for-H264-levels-4.patch b/target/linux/bcm27xx/patches-6.1/950-0318-staging-bcm2835-camera-Add-support-for-H264-levels-4.patch
new file mode 100644
index 00000000000000..739fbeebda082a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0318-staging-bcm2835-camera-Add-support-for-H264-levels-4.patch
@@ -0,0 +1,58 @@
+From 6ed6d972bb37594cc54f5b1d9d78b463b30ff70d Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 25 Mar 2021 18:34:50 +0000
+Subject: [PATCH] staging/bcm2835-camera: Add support for H264 levels
+ 4.1 and 4.2
+
+Whilst the hardware can't achieve the limits of level 4.2 under
+all situations, it can exceed level 4.0.
+
+Allow selection of levels 4.1 and 4.2.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../vc04_services/bcm2835-camera/controls.c   | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
+@@ -704,6 +704,8 @@ static int ctrl_set_video_encode_profile
+ 		case V4L2_MPEG_VIDEO_H264_LEVEL_3_1:
+ 		case V4L2_MPEG_VIDEO_H264_LEVEL_3_2:
+ 		case V4L2_MPEG_VIDEO_H264_LEVEL_4_0:
++		case V4L2_MPEG_VIDEO_H264_LEVEL_4_1:
++		case V4L2_MPEG_VIDEO_H264_LEVEL_4_2:
+ 			dev->capture.enc_level = ctrl->val;
+ 			break;
+ 		default:
+@@ -769,6 +771,17 @@ static int ctrl_set_video_encode_profile
+ 		case V4L2_MPEG_VIDEO_H264_LEVEL_4_0:
+ 			param.level = MMAL_VIDEO_LEVEL_H264_4;
+ 			break;
++		/*
++		 * Note that the hardware spec is level 4.0. Achieving levels
++		 * above that depend on exactly the resolution and frame rate
++		 * being requested.
++		 */
++		case V4L2_MPEG_VIDEO_H264_LEVEL_4_1:
++			param.level = MMAL_VIDEO_LEVEL_H264_41;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_4_2:
++			param.level = MMAL_VIDEO_LEVEL_H264_42;
++			break;
+ 		default:
+ 			/* Should never get here */
+ 			break;
+@@ -1218,8 +1231,10 @@ static const struct bcm2835_mmal_v4l2_ct
+ 			 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
+ 			 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
+ 			 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
+-			 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0)),
+-		.max = V4L2_MPEG_VIDEO_H264_LEVEL_4_0,
++			 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0) |
++			 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_1) |
++			 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_2)),
++		.max = V4L2_MPEG_VIDEO_H264_LEVEL_4_2,
+ 		.def = V4L2_MPEG_VIDEO_H264_LEVEL_4_0,
+ 		.step = 1,
+ 		.imenu = NULL,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0319-staging-bcm2835-isp-Fix-compiler-warning.patch b/target/linux/bcm27xx/patches-6.1/950-0319-staging-bcm2835-isp-Fix-compiler-warning.patch
new file mode 100644
index 00000000000000..e59ffff01c6854
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0319-staging-bcm2835-isp-Fix-compiler-warning.patch
@@ -0,0 +1,25 @@
+From 951e400fb6cc92e1363016871c676d34bc649e19 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 23 Apr 2021 16:16:49 +0100
+Subject: [PATCH] staging/bcm2835-isp: Fix compiler warning
+
+The result of dividing a u32 by a size_t is an unsigned int on arm32
+and a long unsigned int on arm64. Use "%zu" (the size_t format) to
+remove the build warning for 64-bit builds.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
+@@ -1237,7 +1237,7 @@ static int bcm2835_isp_get_supported_fmt
+ 	if (ret) {
+ 		if (ret == MMAL_MSG_STATUS_ENOSPC) {
+ 			v4l2_err(&dev->v4l2_dev,
+-				 "%s: port has more encodings than we provided space for. Some are dropped (%u vs %u).\n",
++				 "%s: port has more encodings than we provided space for. Some are dropped (%zu vs %u).\n",
+ 				 __func__, param_size / sizeof(u32),
+ 				 MAX_SUPPORTED_ENCODINGS);
+ 			num_encodings = MAX_SUPPORTED_ENCODINGS;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0320-gpio-poweroff-Remember-the-old-poweroff-handler.patch b/target/linux/bcm27xx/patches-6.1/950-0320-gpio-poweroff-Remember-the-old-poweroff-handler.patch
new file mode 100644
index 00000000000000..f433037e14a150
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0320-gpio-poweroff-Remember-the-old-poweroff-handler.patch
@@ -0,0 +1,53 @@
+From 23450a1ff298fad192f6d098cc1c920473fc50f6 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 27 Apr 2021 08:59:01 +0100
+Subject: [PATCH] gpio-poweroff: Remember the old poweroff handler
+
+Keeping a copy of the old poweroff handler allows it to be restored
+should this module be unloaded, but also provides a fallback if the
+power hasn't been removed when the timeout elapses.
+
+See: https://github.com/raspberrypi/rpi-eeprom/issues/330
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/power/reset/gpio-poweroff.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/power/reset/gpio-poweroff.c
++++ b/drivers/power/reset/gpio-poweroff.c
+@@ -24,6 +24,7 @@ static struct gpio_desc *reset_gpio;
+ static u32 timeout = DEFAULT_TIMEOUT_MS;
+ static u32 active_delay = 100;
+ static u32 inactive_delay = 100;
++static void (*old_power_off)(void);
+ 
+ static void gpio_poweroff_do_poweroff(void)
+ {
+@@ -43,6 +44,9 @@ static void gpio_poweroff_do_poweroff(vo
+ 	/* give it some time */
+ 	mdelay(timeout);
+ 
++	if (old_power_off)
++		old_power_off();
++
+ 	WARN_ON(1);
+ }
+ 
+@@ -83,6 +87,7 @@ static int gpio_poweroff_probe(struct pl
+ 		gpiod_export_link(&pdev->dev, "poweroff-gpio", reset_gpio);
+ 	}
+ 
++	old_power_off = pm_power_off;
+ 	pm_power_off = &gpio_poweroff_do_poweroff;
+ 	return 0;
+ }
+@@ -90,7 +95,7 @@ static int gpio_poweroff_probe(struct pl
+ static int gpio_poweroff_remove(struct platform_device *pdev)
+ {
+ 	if (pm_power_off == &gpio_poweroff_do_poweroff)
+-		pm_power_off = NULL;
++		pm_power_off = old_power_off;
+ 
+ 	gpiod_unexport(reset_gpio);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0321-media-i2c-ov5647-Correct-pixel-array-offset.patch b/target/linux/bcm27xx/patches-6.1/950-0321-media-i2c-ov5647-Correct-pixel-array-offset.patch
new file mode 100644
index 00000000000000..4c9c7445c63892
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0321-media-i2c-ov5647-Correct-pixel-array-offset.patch
@@ -0,0 +1,25 @@
+From e048b294c24e640077d01e48fe7ef09301e53171 Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Tue, 11 May 2021 12:52:26 +0100
+Subject: [PATCH] media: i2c: ov5647: Correct pixel array offset
+
+The top offset in the pixel array is actually 6 (see page 3-1 of the
+OV5647 data sheet).
+
+Fixes: f2f7ad5ce5e52 ("media: i2c: ov5647: Selection compliance fixes")
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ drivers/media/i2c/ov5647.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -68,7 +68,7 @@
+ #define OV5647_NATIVE_HEIGHT		1956U
+ 
+ #define OV5647_PIXEL_ARRAY_LEFT		16U
+-#define OV5647_PIXEL_ARRAY_TOP		16U
++#define OV5647_PIXEL_ARRAY_TOP		6U
+ #define OV5647_PIXEL_ARRAY_WIDTH	2592U
+ #define OV5647_PIXEL_ARRAY_HEIGHT	1944U
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0322-media-i2c-ov5647-Correct-minimum-VBLANK-value.patch b/target/linux/bcm27xx/patches-6.1/950-0322-media-i2c-ov5647-Correct-minimum-VBLANK-value.patch
new file mode 100644
index 00000000000000..38431a5f22ee33
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0322-media-i2c-ov5647-Correct-minimum-VBLANK-value.patch
@@ -0,0 +1,26 @@
+From 8a6c0eb1a5e3a3e6e01c95be2bdbe21da41102f6 Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Tue, 11 May 2021 12:57:22 +0100
+Subject: [PATCH] media: i2c: ov5647: Correct minimum VBLANK value
+
+Trial and error reveals that the minimum vblank value appears to be 24
+(the OV5647 data sheet does not give any clues). This fixes streaming
+lock-ups in full resolution mode.
+
+Fixes: 9b5a5ebedc303 ("media: i2c: ov5647: Add support for V4L2_CID_VBLANK")
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ drivers/media/i2c/ov5647.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -72,7 +72,7 @@
+ #define OV5647_PIXEL_ARRAY_WIDTH	2592U
+ #define OV5647_PIXEL_ARRAY_HEIGHT	1944U
+ 
+-#define OV5647_VBLANK_MIN		4
++#define OV5647_VBLANK_MIN		24
+ #define OV5647_VTS_MAX			32767
+ 
+ #define OV5647_EXPOSURE_MIN		4
diff --git a/target/linux/bcm27xx/patches-6.1/950-0323-media-i2c-ov5647-Fix-v4l2-compliance-failure-subscri.patch b/target/linux/bcm27xx/patches-6.1/950-0323-media-i2c-ov5647-Fix-v4l2-compliance-failure-subscri.patch
new file mode 100644
index 00000000000000..e01602b090cd38
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0323-media-i2c-ov5647-Fix-v4l2-compliance-failure-subscri.patch
@@ -0,0 +1,26 @@
+From 47435f12464daa6316e5da8efe7ce110cda3d671 Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Wed, 12 May 2021 07:39:21 +0100
+Subject: [PATCH] media: i2c: ov5647: Fix v4l2-compliance failure
+ subscribing to events
+
+Fixes the following v4l2-compliance failure:
+
+fail: v4l2-test-controls.cpp(871): subscribe event for control 'User Controls' failed test
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ drivers/media/i2c/ov5647.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -879,6 +879,8 @@ static const struct v4l2_subdev_core_ops
+ 	.g_register		= ov5647_sensor_get_register,
+ 	.s_register		= ov5647_sensor_set_register,
+ #endif
++	.subscribe_event = v4l2_ctrl_subdev_subscribe_event,
++	.unsubscribe_event = v4l2_event_subdev_unsubscribe,
+ };
+ 
+ static const struct v4l2_rect *
diff --git a/target/linux/bcm27xx/patches-6.1/950-0324-staging-vc04_services-isp-Set-the-YUV420-YVU420-form.patch b/target/linux/bcm27xx/patches-6.1/950-0324-staging-vc04_services-isp-Set-the-YUV420-YVU420-form.patch
new file mode 100644
index 00000000000000..52abb3d570b268
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0324-staging-vc04_services-isp-Set-the-YUV420-YVU420-form.patch
@@ -0,0 +1,39 @@
+From 6fca4e449c1dee8eb4e8ef4717c5996dfc33507e Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 29 Jun 2021 12:50:58 +0100
+Subject: [PATCH] staging: vc04_services: isp: Set the YUV420/YVU420
+ format stride to 64 bytes
+
+The bcm2835 ISP requires the base address of all input/output planes to have 32
+byte alignment. Using a Y stride of 32 bytes would not guarantee that the V
+plane would fulfil this, e.g. a height of 650 lines would mean the V plane
+buffer is not 32 byte aligned for YUV420 formats.
+
+Having a Y stride of 64 bytes would ensure both U and V planes have a 32 byte
+alignment, as the luma height will always be an even number of lines.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-fmts.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-fmts.h
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-fmts.h
+@@ -48,7 +48,7 @@ static const struct bcm2835_isp_fmt supp
+ 		/* YUV formats */
+ 		.fourcc		    = V4L2_PIX_FMT_YUV420,
+ 		.depth		    = 8,
+-		.bytesperline_align = 32,
++		.bytesperline_align = 64,
+ 		.mmal_fmt	    = MMAL_ENCODING_I420,
+ 		.size_multiplier_x2 = 3,
+ 		.colorspace_mask    = V4L2_COLORSPACE_MASK_YUV,
+@@ -57,7 +57,7 @@ static const struct bcm2835_isp_fmt supp
+ 	}, {
+ 		.fourcc		    = V4L2_PIX_FMT_YVU420,
+ 		.depth		    = 8,
+-		.bytesperline_align = 32,
++		.bytesperline_align = 64,
+ 		.mmal_fmt	    = MMAL_ENCODING_YV12,
+ 		.size_multiplier_x2 = 3,
+ 		.colorspace_mask    = V4L2_COLORSPACE_MASK_YUV,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0325-media-bcm2835-unicam-Forward-input-status-from-subde.patch b/target/linux/bcm27xx/patches-6.1/950-0325-media-bcm2835-unicam-Forward-input-status-from-subde.patch
new file mode 100644
index 00000000000000..2cc4cff177586f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0325-media-bcm2835-unicam-Forward-input-status-from-subde.patch
@@ -0,0 +1,53 @@
+From df490e112fa3285ba73edbc33e02a41dad5e4d2e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jakub=20Van=C4=9Bk?= <linuxtardis@gmail.com>
+Date: Wed, 7 Jul 2021 22:48:20 +0200
+Subject: [PATCH] media: bcm2835-unicam: Forward input status from
+ subdevice
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The vidioc_enum_input() v4l2 ioctl is capable of returning
+sensor/input status as well. This is used in current
+GStreamer HEAD for signal detection [1].
+
+bcm2835-unicam does handle this syscall, but it didn't ask
+the subdevice driver about the input status. The input then
+appeared as always present.
+
+This commit adds the necessary query. There is a precedent for
+this - the R-Car VIN V4L2 driver does a similar call [2].
+
+[1]: https://gitlab.freedesktop.org/gstreamer/gst-plugins-good/-/blob/ce0be27caf69aa9d96b73bc2b50737451b6f6936/sys/v4l2/gstv4l2src.c#L553
+[2]: https://github.com/raspberrypi/linux/blob/7fb9d006d3ff3baf2e205e0c85c4e4fd0a64fcd0/drivers/media/platform/rcar-vin/rcar-v4l2.c#L548
+
+Signed-off-by: Jakub Vaněk <linuxtardis@gmail.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -1809,6 +1809,7 @@ static int unicam_enum_input(struct file
+ {
+ 	struct unicam_node *node = video_drvdata(file);
+ 	struct unicam_device *dev = node->dev;
++	int ret;
+ 
+ 	if (inp->index != 0)
+ 		return -EINVAL;
+@@ -1825,6 +1826,14 @@ static int unicam_enum_input(struct file
+ 		inp->capabilities = 0;
+ 		inp->std = 0;
+ 	}
++
++	if (v4l2_subdev_has_op(dev->sensor, video, g_input_status)) {
++		ret = v4l2_subdev_call(dev->sensor, video, g_input_status,
++				       &inp->status);
++		if (ret < 0)
++			return ret;
++	}
++
+ 	snprintf(inp->name, sizeof(inp->name), "Camera 0");
+ 	return 0;
+ }
diff --git a/target/linux/bcm27xx/patches-6.1/950-0326-media-i2c-ov7251-Add-fwnode-properties-controls.patch b/target/linux/bcm27xx/patches-6.1/950-0326-media-i2c-ov7251-Add-fwnode-properties-controls.patch
new file mode 100644
index 00000000000000..07ab8080909d08
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0326-media-i2c-ov7251-Add-fwnode-properties-controls.patch
@@ -0,0 +1,48 @@
+From aeacfdd4ae221a3d01cdefafbdde157bb39181fb Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 3 Aug 2021 11:33:33 +0100
+Subject: [PATCH] media: i2c: ov7251: Add fwnode properties controls
+
+Add call to v4l2_ctrl_new_fwnode_properties to read and
+create the fwnode based controls.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov7251.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/ov7251.c
++++ b/drivers/media/i2c/ov7251.c
+@@ -1541,7 +1541,7 @@ static int ov7251_init_ctrls(struct ov72
+ 	s64 pixel_rate;
+ 	int hblank;
+ 
+-	v4l2_ctrl_handler_init(&ov7251->ctrls, 7);
++	v4l2_ctrl_handler_init(&ov7251->ctrls, 9);
+ 	ov7251->ctrls.lock = &ov7251->lock;
+ 
+ 	v4l2_ctrl_new_std(&ov7251->ctrls, &ov7251_ctrl_ops,
+@@ -1600,6 +1600,7 @@ static int ov7251_init_ctrls(struct ov72
+ 
+ static int ov7251_probe(struct i2c_client *client)
+ {
++	struct v4l2_fwnode_device_properties props;
+ 	struct device *dev = &client->dev;
+ 	struct ov7251 *ov7251;
+ 	unsigned int rate = 0, clk_rate = 0;
+@@ -1690,6 +1691,15 @@ static int ov7251_probe(struct i2c_clien
+ 		goto destroy_mutex;
+ 	}
+ 
++	ret = v4l2_fwnode_device_parse(&client->dev, &props);
++	if (ret)
++		goto free_ctrl;
++
++	ret = v4l2_ctrl_new_fwnode_properties(&ov7251->ctrls, &ov7251_ctrl_ops,
++					      &props);
++	if (ret)
++		goto free_ctrl;
++
+ 	v4l2_i2c_subdev_init(&ov7251->sd, client, &ov7251_subdev_ops);
+ 	ov7251->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
+ 	ov7251->pad.flags = MEDIA_PAD_FL_SOURCE;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0327-usb-xhci-workaround-for-bogus-SET_DEQ_PENDING-endpoi.patch b/target/linux/bcm27xx/patches-6.1/950-0327-usb-xhci-workaround-for-bogus-SET_DEQ_PENDING-endpoi.patch
new file mode 100644
index 00000000000000..6b2f3a9ad13623
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0327-usb-xhci-workaround-for-bogus-SET_DEQ_PENDING-endpoi.patch
@@ -0,0 +1,41 @@
+From 55a8f65623880e02c9bc7ad6237513e0ef5f371b Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 11 Aug 2021 15:33:57 +0100
+Subject: [PATCH] usb: xhci: workaround for bogus SET_DEQ_PENDING
+ endpoint state
+
+See https://github.com/raspberrypi/linux/issues/3981
+
+An unknown unsafe memory access can result in the ep_state variable
+in xhci_virt_ep being trampled with a stuck SET_DEQ_PENDING state
+despite successful completion of a Set TR Deq Pointer command.
+
+All URB enqueue/dequeue calls for the endpoint will fail in this state
+so no transfers are possible until the device is reconnected.
+
+As a workaround, clear the flag if we see it set and issue a new Set
+TR Deq command anyway - this should be harmless, as a prior Set TR Deq
+command will only have been issued in the Stopped state, and if the
+endpoint is Running then the controller is required to ignore it and
+respond with a Context State Error event TRB.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci-ring.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -697,9 +697,9 @@ deq_found:
+ 	}
+ 
+ 	if ((ep->ep_state & SET_DEQ_PENDING)) {
+-		xhci_warn(xhci, "Set TR Deq already pending, don't submit for 0x%pad\n",
+-			  &addr);
+-		return -EBUSY;
++		xhci_warn(xhci, "WARN A Set TR Deq Ptr command is pending for slot %u ep %u\n",
++			  slot_id, ep_index);
++		ep->ep_state &= ~SET_DEQ_PENDING;
+ 	}
+ 
+ 	/* This function gets called from contexts where it cannot sleep */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0328-staging-vchiq_arm-Add-36-bit-address-support.patch b/target/linux/bcm27xx/patches-6.1/950-0328-staging-vchiq_arm-Add-36-bit-address-support.patch
new file mode 100644
index 00000000000000..5ecd2d357d911f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0328-staging-vchiq_arm-Add-36-bit-address-support.patch
@@ -0,0 +1,256 @@
+From 57584e2ea9dbcbe0ddfbbc997d938dea9798938d Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 1 Nov 2018 17:31:37 +0000
+Subject: [PATCH] staging: vchiq_arm: Add 36-bit address support
+
+Conditional on a new compatible string, change the pagelist encoding
+such that the top 24 bits are the pfn, leaving 8 bits for run length
+(-1), giving a 36-bit address range.
+
+Manage the split between addresses for the VPU and addresses for the
+40-bit DMA controller with a dedicated DMA device pointer that on non-
+BCM2711 platforms is the same as the main VCHIQ device. This allows
+the VCHIQ node to stay in the usual place in the DT.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .../interface/vchiq_arm/vchiq_arm.c           | 125 +++++++++++++-----
+ 1 file changed, 90 insertions(+), 35 deletions(-)
+
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -73,6 +73,7 @@ static struct platform_device *bcm2835_i
+ 
+ struct vchiq_drvdata {
+ 	const unsigned int cache_line_size;
++	const bool use_36bit_addrs;
+ 	struct rpi_firmware *fw;
+ };
+ 
+@@ -118,6 +119,11 @@ struct vchiq_arm_state {
+ 	int first_connect;
+ };
+ 
++static struct vchiq_drvdata bcm2711_drvdata = {
++	.cache_line_size = 64,
++	.use_36bit_addrs = true,
++};
++
+ struct vchiq_2835_state {
+ 	int inited;
+ 	struct vchiq_arm_state arm_state;
+@@ -147,10 +153,12 @@ static void __iomem *g_regs;
+  * of 32.
+  */
+ static unsigned int g_cache_line_size = 32;
++static unsigned int g_use_36bit_addrs = 0;
+ static unsigned int g_fragments_size;
+ static char *g_fragments_base;
+ static char *g_free_fragments;
+ static struct semaphore g_free_fragments_sema;
++static struct device *g_dma_dev;
+ 
+ static DEFINE_SEMAPHORE(g_free_fragments_mutex);
+ 
+@@ -180,7 +188,7 @@ static void
+ cleanup_pagelistinfo(struct vchiq_instance *instance, struct vchiq_pagelist_info *pagelistinfo)
+ {
+ 	if (pagelistinfo->scatterlist_mapped) {
+-		dma_unmap_sg(instance->state->dev, pagelistinfo->scatterlist,
++		dma_unmap_sg(g_dma_dev, pagelistinfo->scatterlist,
+ 			     pagelistinfo->num_pages, pagelistinfo->dma_dir);
+ 	}
+ 
+@@ -340,7 +348,7 @@ create_pagelist(struct vchiq_instance *i
+ 		count -= len;
+ 	}
+ 
+-	dma_buffers = dma_map_sg(instance->state->dev,
++	dma_buffers = dma_map_sg(g_dma_dev,
+ 				 scatterlist,
+ 				 num_pages,
+ 				 pagelistinfo->dma_dir);
+@@ -354,22 +362,61 @@ create_pagelist(struct vchiq_instance *i
+ 
+ 	/* Combine adjacent blocks for performance */
+ 	k = 0;
+-	for_each_sg(scatterlist, sg, dma_buffers, i) {
+-		u32 len = sg_dma_len(sg);
+-		u32 addr = sg_dma_address(sg);
+-
+-		/* Note: addrs is the address + page_count - 1
+-		 * The firmware expects blocks after the first to be page-
+-		 * aligned and a multiple of the page size
+-		 */
+-		WARN_ON(len == 0);
+-		WARN_ON(i && (i != (dma_buffers - 1)) && (len & ~PAGE_MASK));
+-		WARN_ON(i && (addr & ~PAGE_MASK));
+-		if (is_adjacent_block(addrs, addr, k))
+-			addrs[k - 1] += ((len + PAGE_SIZE - 1) >> PAGE_SHIFT);
+-		else
+-			addrs[k++] = (addr & PAGE_MASK) |
+-				(((len + PAGE_SIZE - 1) >> PAGE_SHIFT) - 1);
++	if (g_use_36bit_addrs) {
++		for_each_sg(scatterlist, sg, dma_buffers, i) {
++			u32 len = sg_dma_len(sg);
++			u64 addr = sg_dma_address(sg);
++			u32 page_id = (u32)((addr >> 4) & ~0xff);
++			u32 sg_pages = (len + PAGE_SIZE - 1) >> PAGE_SHIFT;
++
++			/* Note: addrs is the address + page_count - 1
++			 * The firmware expects blocks after the first to be page-
++			 * aligned and a multiple of the page size
++			 */
++			WARN_ON(len == 0);
++			WARN_ON(i &&
++				(i != (dma_buffers - 1)) && (len & ~PAGE_MASK));
++			WARN_ON(i && (addr & ~PAGE_MASK));
++			WARN_ON(upper_32_bits(addr) > 0xf);
++
++			if (k > 0 &&
++			    ((addrs[k - 1] & ~0xff) +
++			     (((addrs[k - 1] & 0xff) + 1) << 8)
++			     == page_id)) {
++				u32 inc_pages = min(sg_pages,
++						    0xff - (addrs[k - 1] & 0xff));
++				addrs[k - 1] += inc_pages;
++				page_id += inc_pages << 8;
++				sg_pages -= inc_pages;
++			}
++			while (sg_pages) {
++				u32 inc_pages = min(sg_pages, 0x100u);
++				addrs[k++] = page_id | (inc_pages - 1);
++				page_id += inc_pages << 8;
++				sg_pages -= inc_pages;
++			}
++		}
++	} else {
++		for_each_sg(scatterlist, sg, dma_buffers, i) {
++			u32 len = sg_dma_len(sg);
++			u32 addr = sg_dma_address(sg);
++			u32 new_pages = (len + PAGE_SIZE - 1) >> PAGE_SHIFT;
++
++			/* Note: addrs is the address + page_count - 1
++			 * The firmware expects blocks after the first to be page-
++			 * aligned and a multiple of the page size
++			 */
++			WARN_ON(len == 0);
++			WARN_ON(i && (i != (dma_buffers - 1)) && (len & ~PAGE_MASK));
++			WARN_ON(i && (addr & ~PAGE_MASK));
++			if (k > 0 &&
++			    ((addrs[k - 1] & PAGE_MASK) +
++			     (((addrs[k - 1] & ~PAGE_MASK) + 1) << PAGE_SHIFT))
++			    == (addr & PAGE_MASK))
++				addrs[k - 1] += new_pages;
++			else
++				addrs[k++] = (addr & PAGE_MASK) | (new_pages - 1);
++		}
+ 	}
+ 
+ 	/* Partial cache lines (fragments) require special measures */
+@@ -413,7 +460,7 @@ free_pagelist(struct vchiq_instance *ins
+ 	 * NOTE: dma_unmap_sg must be called before the
+ 	 * cpu can touch any of the data/pages.
+ 	 */
+-	dma_unmap_sg(instance->state->dev, pagelistinfo->scatterlist,
++	dma_unmap_sg(g_dma_dev, pagelistinfo->scatterlist,
+ 		     pagelistinfo->num_pages, pagelistinfo->dma_dir);
+ 	pagelistinfo->scatterlist_mapped = 0;
+ 
+@@ -468,6 +515,7 @@ free_pagelist(struct vchiq_instance *ins
+ int vchiq_platform_init(struct platform_device *pdev, struct vchiq_state *state)
+ {
+ 	struct device *dev = &pdev->dev;
++	struct device *dma_dev = NULL;
+ 	struct vchiq_drvdata *drvdata = platform_get_drvdata(pdev);
+ 	struct rpi_firmware *fw = drvdata->fw;
+ 	struct vchiq_slot_zero *vchiq_slot_zero;
+@@ -489,6 +537,24 @@ int vchiq_platform_init(struct platform_
+ 	g_cache_line_size = drvdata->cache_line_size;
+ 	g_fragments_size = 2 * g_cache_line_size;
+ 
++	if (drvdata->use_36bit_addrs) {
++		struct device_node *dma_node =
++			of_find_compatible_node(NULL, NULL, "brcm,bcm2711-dma");
++
++		if (dma_node) {
++			struct platform_device *pdev;
++
++			pdev = of_find_device_by_node(dma_node);
++			if (pdev)
++				dma_dev = &pdev->dev;
++			of_node_put(dma_node);
++			g_use_36bit_addrs = true;
++		} else {
++			dev_err(dev, "40-bit DMA controller not found\n");
++			return -EINVAL;
++		}
++	}
++
+ 	/* Allocate space for the channels in coherent memory */
+ 	slot_mem_size = PAGE_ALIGN(TOTAL_SLOTS * VCHIQ_SLOT_SIZE);
+ 	frag_mem_size = PAGE_ALIGN(g_fragments_size * MAX_FRAGMENTS);
+@@ -501,13 +567,14 @@ int vchiq_platform_init(struct platform_
+ 	}
+ 
+ 	WARN_ON(((unsigned long)slot_mem & (PAGE_SIZE - 1)) != 0);
++	channelbase = slot_phys;
+ 
+ 	vchiq_slot_zero = vchiq_init_slots(slot_mem, slot_mem_size);
+ 	if (!vchiq_slot_zero)
+ 		return -EINVAL;
+ 
+ 	vchiq_slot_zero->platform_data[VCHIQ_PLATFORM_FRAGMENTS_OFFSET_IDX] =
+-		(int)slot_phys + slot_mem_size;
++		channelbase + slot_mem_size;
+ 	vchiq_slot_zero->platform_data[VCHIQ_PLATFORM_FRAGMENTS_COUNT_IDX] =
+ 		MAX_FRAGMENTS;
+ 
+@@ -541,7 +608,6 @@ int vchiq_platform_init(struct platform_
+ 	}
+ 
+ 	/* Send the base address of the slots to VideoCore */
+-	channelbase = slot_phys;
+ 	err = rpi_firmware_property(fw, RPI_FIRMWARE_VCHIQ_INIT,
+ 				    &channelbase, sizeof(channelbase));
+ 	if (err || channelbase) {
+@@ -549,6 +615,8 @@ int vchiq_platform_init(struct platform_
+ 		return err ? : -ENXIO;
+ 	}
+ 
++	g_dma_dev = dma_dev ?: dev;
++
+ 	vchiq_log_info(vchiq_arm_log_level, "vchiq_init - done (slots %pK, phys %pad)",
+ 		       vchiq_slot_zero, &slot_phys);
+ 
+@@ -1762,6 +1830,7 @@ void vchiq_platform_conn_state_changed(s
+ static const struct of_device_id vchiq_of_match[] = {
+ 	{ .compatible = "brcm,bcm2835-vchiq", .data = &bcm2835_drvdata },
+ 	{ .compatible = "brcm,bcm2836-vchiq", .data = &bcm2836_drvdata },
++	{ .compatible = "brcm,bcm2711-vchiq", .data = &bcm2711_drvdata },
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(of, vchiq_of_match);
+@@ -1794,22 +1863,8 @@ vchiq_register_child(struct platform_dev
+ 
+ 	child->dev.of_node = np;
+ 
+-	/*
+-	 * We want the dma-ranges etc to be copied from a device with the
+-	 * correct dma-ranges for the VPU.
+-	 * VCHIQ on Pi4 is now under scb which doesn't get those dma-ranges.
+-	 * Take the "dma" node as going to be suitable as it sees the world
+-	 * through the same eyes as the VPU.
+-	 */
+-	np = of_find_node_by_path("dma");
+-	if (!np)
+-		np = pdev->dev.of_node;
+-
+ 	of_dma_configure(&child->dev, np, true);
+ 
+-	if (np != pdev->dev.of_node)
+-		of_node_put(np);
+-
+ 	return child;
+ }
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0329-staging-vchiq_arm-children-inherit-DMA-config.patch b/target/linux/bcm27xx/patches-6.1/950-0329-staging-vchiq_arm-children-inherit-DMA-config.patch
new file mode 100644
index 00000000000000..30b15fb03b0447
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0329-staging-vchiq_arm-children-inherit-DMA-config.patch
@@ -0,0 +1,36 @@
+From fa78b693940b9da1878353de758b2b6f69169b3a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 21 Jul 2020 17:34:09 +0100
+Subject: [PATCH] staging: vchiq_arm: children inherit DMA config
+
+Although it is no longer necessary for vchiq's children to have a
+different DMA configuration to the parent, they do still need to
+explicitly to have their DMA configuration set - to be that of the
+parent.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .../vc04_services/interface/vchiq_arm/vchiq_arm.c      | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -1863,8 +1863,18 @@ vchiq_register_child(struct platform_dev
+ 
+ 	child->dev.of_node = np;
+ 
++	/*
++	 * We want the dma-ranges etc to be copied from the parent VCHIQ device
++	 * to be passed on to the children without a node of their own.
++	 */
++	if (!np)
++		np = pdev->dev.of_node;
++
+ 	of_dma_configure(&child->dev, np, true);
+ 
++	if (np != pdev->dev.of_node)
++		of_node_put(np);
++
+ 	return child;
+ }
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0330-staging-vchiq_arm-Usa-a-DMA-pool-for-small-bulks.patch b/target/linux/bcm27xx/patches-6.1/950-0330-staging-vchiq_arm-Usa-a-DMA-pool-for-small-bulks.patch
new file mode 100644
index 00000000000000..b4f99d04ca2a8f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0330-staging-vchiq_arm-Usa-a-DMA-pool-for-small-bulks.patch
@@ -0,0 +1,118 @@
+From dfbd92cb3b27855e388e17dc5035fa0e5fb70474 Mon Sep 17 00:00:00 2001
+From: detule <ogjoneski@gmail.com>
+Date: Tue, 2 Oct 2018 04:10:08 -0400
+Subject: [PATCH] staging: vchiq_arm: Usa a DMA pool for small bulks
+
+During a bulk transfer we request a DMA allocation to hold the
+scatter-gather list.  Most of the time, this allocation is small
+(<< PAGE_SIZE), however it can be requested at a high enough frequency
+to cause fragmentation and/or stress the CMA allocator (think time
+spent in compaction here, or during allocations elsewhere).
+
+Implement a pool to serve up small DMA allocations, falling back
+to a coherent allocation if the request is greater than
+VCHIQ_DMA_POOL_SIZE.
+
+Signed-off-by: Oliver Gjoneski <ogjoneski@gmail.com>
+---
+ .../interface/vchiq_arm/vchiq_arm.c           | 33 ++++++++++++++++---
+ 1 file changed, 29 insertions(+), 4 deletions(-)
+
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -22,6 +22,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/compat.h>
+ #include <linux/dma-mapping.h>
++#include <linux/dmapool.h>
+ #include <linux/rcupdate.h>
+ #include <linux/delay.h>
+ #include <linux/slab.h>
+@@ -51,6 +52,8 @@
+ 
+ #define ARM_DS_ACTIVE	BIT(2)
+ 
++#define VCHIQ_DMA_POOL_SIZE PAGE_SIZE
++
+ /* Override the default prefix, which would be vchiq_arm (from the filename) */
+ #undef MODULE_PARAM_PREFIX
+ #define MODULE_PARAM_PREFIX DEVICE_NAME "."
+@@ -133,6 +136,7 @@ struct vchiq_pagelist_info {
+ 	struct pagelist *pagelist;
+ 	size_t pagelist_buffer_size;
+ 	dma_addr_t dma_addr;
++	bool is_from_pool;
+ 	enum dma_data_direction dma_dir;
+ 	unsigned int num_pages;
+ 	unsigned int pages_need_release;
+@@ -153,6 +157,7 @@ static void __iomem *g_regs;
+  * of 32.
+  */
+ static unsigned int g_cache_line_size = 32;
++static struct dma_pool *g_dma_pool;
+ static unsigned int g_use_36bit_addrs = 0;
+ static unsigned int g_fragments_size;
+ static char *g_fragments_base;
+@@ -195,8 +200,13 @@ cleanup_pagelistinfo(struct vchiq_instan
+ 	if (pagelistinfo->pages_need_release)
+ 		unpin_user_pages(pagelistinfo->pages, pagelistinfo->num_pages);
+ 
+-	dma_free_coherent(instance->state->dev, pagelistinfo->pagelist_buffer_size,
+-			  pagelistinfo->pagelist, pagelistinfo->dma_addr);
++	if (pagelistinfo->is_from_pool) {
++		dma_pool_free(g_dma_pool, pagelistinfo->pagelist,
++			      pagelistinfo->dma_addr);
++	} else {
++		dma_free_coherent(instance->state->dev, pagelistinfo->pagelist_buffer_size,
++				  pagelistinfo->pagelist, pagelistinfo->dma_addr);
++	}
+ }
+ 
+ static inline bool
+@@ -231,6 +241,7 @@ create_pagelist(struct vchiq_instance *i
+ 	u32 *addrs;
+ 	unsigned int num_pages, offset, i, k;
+ 	int actual_pages;
++	bool is_from_pool;
+ 	size_t pagelist_size;
+ 	struct scatterlist *scatterlist, *sg;
+ 	int dma_buffers;
+@@ -260,8 +271,14 @@ create_pagelist(struct vchiq_instance *i
+ 	/* Allocate enough storage to hold the page pointers and the page
+ 	 * list
+ 	 */
+-	pagelist = dma_alloc_coherent(instance->state->dev, pagelist_size, &dma_addr,
+-				      GFP_KERNEL);
++	if (pagelist_size > VCHIQ_DMA_POOL_SIZE) {
++		pagelist = dma_alloc_coherent(instance->state->dev, pagelist_size, &dma_addr,
++					      GFP_KERNEL);
++		is_from_pool = false;
++	} else {
++		pagelist = dma_pool_alloc(g_dma_pool, GFP_KERNEL, &dma_addr);
++		is_from_pool = true;
++	}
+ 
+ 	vchiq_log_trace(vchiq_arm_log_level, "%s - %pK", __func__, pagelist);
+ 
+@@ -282,6 +299,7 @@ create_pagelist(struct vchiq_instance *i
+ 	pagelistinfo->pagelist = pagelist;
+ 	pagelistinfo->pagelist_buffer_size = pagelist_size;
+ 	pagelistinfo->dma_addr = dma_addr;
++	pagelistinfo->is_from_pool = is_from_pool;
+ 	pagelistinfo->dma_dir =  (type == PAGELIST_WRITE) ?
+ 				  DMA_TO_DEVICE : DMA_FROM_DEVICE;
+ 	pagelistinfo->num_pages = num_pages;
+@@ -616,6 +634,13 @@ int vchiq_platform_init(struct platform_
+ 	}
+ 
+ 	g_dma_dev = dma_dev ?: dev;
++	g_dma_pool = dmam_pool_create("vchiq_scatter_pool", dev,
++				      VCHIQ_DMA_POOL_SIZE, g_cache_line_size,
++				      0);
++	if (!g_dma_pool) {
++		dev_err(dev, "failed to create dma pool");
++		return -ENOMEM;
++	}
+ 
+ 	vchiq_log_info(vchiq_arm_log_level, "vchiq_init - done (slots %pK, phys %pad)",
+ 		       vchiq_slot_zero, &slot_phys);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0331-drm-panel-raspberrypi-touchscreen-Handle-I2C-errors.patch b/target/linux/bcm27xx/patches-6.1/950-0331-drm-panel-raspberrypi-touchscreen-Handle-I2C-errors.patch
new file mode 100644
index 00000000000000..985c43c79e194f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0331-drm-panel-raspberrypi-touchscreen-Handle-I2C-errors.patch
@@ -0,0 +1,34 @@
+From 59f8ed6b3423efc893c752db80a066668b911d5f Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 8 Sep 2021 14:21:38 +0100
+Subject: [PATCH] drm/panel/raspberrypi-touchscreen: Handle I2C errors.
+
+rpi_touchscreen_i2c_read returns any errors from i2c_transfer,
+or the 8 bit received value.
+Check for error values before trying to process the data as
+valid.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
++++ b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
+@@ -297,13 +297,14 @@ static int rpi_touchscreen_noop(struct d
+ static int rpi_touchscreen_prepare(struct drm_panel *panel)
+ {
+ 	struct rpi_touchscreen *ts = panel_to_ts(panel);
+-	int i;
++	int i, data;
+ 
+ 	rpi_touchscreen_i2c_write(ts, REG_POWERON, 1);
+ 	usleep_range(20000, 25000);
+ 	/* Wait for nPWRDWN to go low to indicate poweron is done. */
+ 	for (i = 0; i < 100; i++) {
+-		if (rpi_touchscreen_i2c_read(ts, REG_PORTB) & 1)
++		data = rpi_touchscreen_i2c_read(ts, REG_PORTB);
++		if (data >= 0 && (data & 1))
+ 			break;
+ 	}
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0332-drm-panel-simple-Add-a-timing-for-the-Raspberry-Pi-7.patch b/target/linux/bcm27xx/patches-6.1/950-0332-drm-panel-simple-Add-a-timing-for-the-Raspberry-Pi-7.patch
new file mode 100644
index 00000000000000..aa7bfe130b9b4c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0332-drm-panel-simple-Add-a-timing-for-the-Raspberry-Pi-7.patch
@@ -0,0 +1,59 @@
+From 231e27c3d0f8a9dc323391fcbca5b48ca863a727 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 26 Mar 2021 17:06:36 +0000
+Subject: [PATCH] drm/panel-simple: Add a timing for the Raspberry Pi
+ 7" panel
+
+The Raspberry Pi 7" 800x480 panel uses a Toshiba TC358762 DSI
+to DPI bridge chip, so there is a requirement for the timings
+to be specified for the end panel. Add such a definition.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -3188,6 +3188,31 @@ static const struct panel_desc qishenglo
+ 	.connector_type = DRM_MODE_CONNECTOR_DPI,
+ };
+ 
++static const struct drm_display_mode raspberrypi_7inch_mode = {
++	.clock = 25979400 / 1000,
++	.hdisplay = 800,
++	.hsync_start = 800 + 2,
++	.hsync_end = 800 + 2 + 2,
++	.htotal = 800 + 2 + 2 + 46,
++	.vdisplay = 480,
++	.vsync_start = 480 + 7,
++	.vsync_end = 480 + 7 + 2,
++	.vtotal = 480 + 7 + 2 + 21,
++	.flags = DRM_MODE_FLAG_NVSYNC | DRM_MODE_FLAG_NHSYNC,
++};
++
++static const struct panel_desc raspberrypi_7inch = {
++	.modes = &raspberrypi_7inch_mode,
++	.num_modes = 1,
++	.bpc = 8,
++	.size = {
++		.width = 154,
++		.height = 86,
++	},
++	.bus_format = MEDIA_BUS_FMT_RGB888_1X24,
++	.connector_type = DRM_MODE_CONNECTOR_DSI,
++};
++
+ static const struct display_timing rocktech_rk070er9427_timing = {
+ 	.pixelclock = { 26400000, 33300000, 46800000 },
+ 	.hactive = { 800, 800, 800 },
+@@ -4219,6 +4244,9 @@ static const struct of_device_id platfor
+ 		.compatible = "qishenglong,gopher2b-lcd",
+ 		.data = &qishenglong_gopher2b_lcd,
+ 	}, {
++		.compatible = "raspberrypi,7inch-dsi",
++		.data = &raspberrypi_7inch,
++	}, {
+ 		.compatible = "rocktech,rk070er9427",
+ 		.data = &rocktech_rk070er9427,
+ 	}, {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0333-Input-edt-ft54x6-Clean-up-timer-and-workqueue-on-rem.patch b/target/linux/bcm27xx/patches-6.1/950-0333-Input-edt-ft54x6-Clean-up-timer-and-workqueue-on-rem.patch
new file mode 100644
index 00000000000000..223da15a192a87
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0333-Input-edt-ft54x6-Clean-up-timer-and-workqueue-on-rem.patch
@@ -0,0 +1,31 @@
+From 1d2ab2a7cfba5a4298b0d06d05fdc0584c63c6f4 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 8 Sep 2021 14:46:17 +0100
+Subject: [PATCH] Input: edt-ft54x6: Clean up timer and workqueue on
+ remove
+
+If no interrupt is defined then a timer and workqueue are used
+to poll the controller.
+On remove these were not being cleaned up correctly.
+
+Fixes: ca61fdaba79f "Input: edt-ft5x06: Poll the device if no interrupt is
+configured."
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/input/touchscreen/edt-ft5x06.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/input/touchscreen/edt-ft5x06.c
++++ b/drivers/input/touchscreen/edt-ft5x06.c
+@@ -1381,6 +1381,10 @@ static void edt_ft5x06_ts_remove(struct
+ {
+ 	struct edt_ft5x06_ts_data *tsdata = i2c_get_clientdata(client);
+ 
++	if (!client->irq) {
++		del_timer(&tsdata->timer);
++		cancel_work_sync(&tsdata->work_i2c_poll);
++	}
+ 	edt_ft5x06_ts_teardown_debugfs(tsdata);
+ }
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0334-staging-vchiq-mmal-Add-buffer-flags-for-interlaced-v.patch b/target/linux/bcm27xx/patches-6.1/950-0334-staging-vchiq-mmal-Add-buffer-flags-for-interlaced-v.patch
new file mode 100644
index 00000000000000..4c4c0ffa69a83b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0334-staging-vchiq-mmal-Add-buffer-flags-for-interlaced-v.patch
@@ -0,0 +1,42 @@
+From 346b7aa8f5b44101fc0c43eca615c26755c89e12 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Sun, 10 Jan 2021 19:05:17 +0000
+Subject: [PATCH] staging/vchiq-mmal: Add buffer flags for interlaced
+ video
+
+Add the buffer flags that the firmware uses to identify fields
+on interlaced video
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../vc04_services/vchiq-mmal/mmal-msg.h       | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-msg.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-msg.h
+@@ -253,6 +253,25 @@ struct mmal_msg_port_action_reply {
+ /* Signals that a buffer failed to be transmitted */
+ #define MMAL_BUFFER_HEADER_FLAG_TRANSMISSION_FAILED    BIT(10)
+ 
++/* Video buffer header flags
++ * videobufferheaderflags
++ * The following flags describe properties of a video buffer header.
++ * As there is no collision with the MMAL_BUFFER_HEADER_FLAGS_ defines, these
++ * flags will also be present in the MMAL_BUFFER_HEADER_T flags field.
++ */
++#define MMAL_BUFFER_HEADER_FLAG_FORMAT_SPECIFIC_START_BIT 16
++#define MMAL_BUFFER_HEADER_FLAG_FORMAT_SPECIFIC_START \
++			(1 << MMAL_BUFFER_HEADER_FLAG_FORMAT_SPECIFIC_START_BIT)
++/* Signals an interlaced video frame */
++#define MMAL_BUFFER_HEADER_VIDEO_FLAG_INTERLACED \
++			(MMAL_BUFFER_HEADER_FLAG_FORMAT_SPECIFIC_START << 0)
++/*
++ * Signals that the top field of the current interlaced frame should be
++ * displayed first
++ */
++#define MMAL_BUFFER_HEADER_VIDEO_FLAG_TOP_FIELD_FIRST \
++			(MMAL_BUFFER_HEADER_FLAG_FORMAT_SPECIFIC_START << 1)
++
+ struct mmal_driver_buffer {
+ 	u32 magic;
+ 	u32 component_handle;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0335-staging-vchiq-mmal-Add-parameters-for-interlaced-vid.patch b/target/linux/bcm27xx/patches-6.1/950-0335-staging-vchiq-mmal-Add-parameters-for-interlaced-vid.patch
new file mode 100644
index 00000000000000..130ce59193ad72
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0335-staging-vchiq-mmal-Add-parameters-for-interlaced-vid.patch
@@ -0,0 +1,61 @@
+From 72f32ce98a5414dd6b2b20ea4e983d7cbc6eaf8b Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 5 Aug 2021 16:38:34 +0100
+Subject: [PATCH] staging/vchiq-mmal: Add parameters for interlaced
+ video support
+
+Adds enum mmal_interlace_type and struct
+mmal_parameter_video_interlace_type to allow for querying the
+interlacing mode on decoders.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../vchiq-mmal/mmal-parameters.h              | 37 +++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
+@@ -811,6 +811,43 @@ struct mmal_parameter_displayregion {
+ 	u32 alpha;
+ };
+ 
++enum mmal_interlace_type {
++	/* The data is not interlaced, it is progressive scan */
++	MMAL_INTERLACE_PROGRESSIVE,
++	/*
++	 * The data is interlaced, fields sent separately in temporal order, with
++	 * upper field first
++	 */
++	MMAL_INTERLACE_FIELD_SINGLE_UPPER_FIRST,
++	/*
++	 * The data is interlaced, fields sent separately in temporal order, with
++	 * lower field first
++	 */
++	MMAL_INTERLACE_FIELD_SINGLE_LOWER_FIRST,
++	/*
++	 * The data is interlaced, two fields sent together line interleaved,
++	 * with the upper field temporally earlier
++	 */
++	MMAL_INTERLACE_FIELDS_INTERLEAVED_UPPER_FIRST,
++	/*
++	 * The data is interlaced, two fields sent together line interleaved,
++	 * with the lower field temporally earlier
++	 */
++	MMAL_INTERLACE_FIELDS_INTERLEAVED_LOWER_FIRST,
++	/*
++	 * The stream may contain a mixture of progressive and interlaced
++	 * frames
++	 */
++	MMAL_INTERLACE_MIXED,
++
++	MMAL_INTERLACE_DUMMY = 0x7FFFFFFF
++};
++
++struct mmal_parameter_video_interlace_type {
++	enum mmal_interlace_type mode;	/* The interlace type of the content */
++	u32 bRepeatFirstField;		/* Whether to repeat the first field */
++};
++
+ #define MMAL_MAX_IMAGEFX_PARAMETERS 5
+ 
+ struct mmal_parameter_imagefx_parameters {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0336-staging-vchiq-mmal-Add-the-deinterlace-image-effects.patch b/target/linux/bcm27xx/patches-6.1/950-0336-staging-vchiq-mmal-Add-the-deinterlace-image-effects.patch
new file mode 100644
index 00000000000000..07bc43cd130153
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0336-staging-vchiq-mmal-Add-the-deinterlace-image-effects.patch
@@ -0,0 +1,26 @@
+From 03858fd82aa88a6ae491128cd757d37ce11e85f7 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 6 Aug 2021 15:44:21 +0100
+Subject: [PATCH] staging/vchiq-mmal: Add the deinterlace image effects
+ enums
+
+As we're wanting to wrap the image_fx component for deinterlacing,
+add the deinterlace algorithm values to enum mmal_parameter_imagefx
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
+@@ -397,6 +397,9 @@ enum mmal_parameter_imagefx {
+ 	MMAL_PARAM_IMAGEFX_COLOURPOINT,
+ 	MMAL_PARAM_IMAGEFX_COLOURBALANCE,
+ 	MMAL_PARAM_IMAGEFX_CARTOON,
++	MMAL_PARAM_IMAGEFX_DEINTERLACE_DOUBLE,
++	MMAL_PARAM_IMAGEFX_DEINTERLACE_ADV,
++	MMAL_PARAM_IMAGEFX_DEINTERLACE_FAST,
+ };
+ 
+ enum MMAL_PARAM_FLICKERAVOID {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0337-Add-Raspberry-Pi-PoE-HAT-support.patch b/target/linux/bcm27xx/patches-6.1/950-0337-Add-Raspberry-Pi-PoE-HAT-support.patch
new file mode 100644
index 00000000000000..773e7b8b02ed63
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0337-Add-Raspberry-Pi-PoE-HAT-support.patch
@@ -0,0 +1,268 @@
+From 74481ea65f3ebb77c7c02040ecd3b0d4cffb8e9e Mon Sep 17 00:00:00 2001
+From: Serge Schneider <serge@raspberrypi.com>
+Date: Mon, 2 Dec 2019 14:48:05 +0000
+Subject: [PATCH] Add Raspberry Pi PoE+ HAT support
+
+Signed-off-by: Serge Schneider <serge@raspberrypi.com>
+---
+ drivers/power/supply/Kconfig         |   6 +
+ drivers/power/supply/Makefile        |   1 +
+ drivers/power/supply/rpi_poe_power.c | 227 +++++++++++++++++++++++++++
+ 3 files changed, 234 insertions(+)
+ create mode 100644 drivers/power/supply/rpi_poe_power.c
+
+--- a/drivers/power/supply/Kconfig
++++ b/drivers/power/supply/Kconfig
+@@ -28,6 +28,12 @@ config POWER_SUPPLY_HWMON
+ 	  Say 'Y' here if you want power supplies to
+ 	  have hwmon sysfs interface too.
+ 
++config RPI_POE_POWER
++	tristate "Raspberry Pi PoE+ HAT power supply driver"
++	depends on RASPBERRYPI_FIRMWARE
++	help
++	  Say Y here to enable support for Raspberry Pi PoE+ (Power over Ethernet
++	  Plus) HAT current measurement.
+ 
+ config PDA_POWER
+ 	tristate "Generic PDA/phone power driver"
+--- a/drivers/power/supply/Makefile
++++ b/drivers/power/supply/Makefile
+@@ -9,6 +9,7 @@ obj-$(CONFIG_POWER_SUPPLY)	+= power_supp
+ obj-$(CONFIG_POWER_SUPPLY_HWMON) += power_supply_hwmon.o
+ obj-$(CONFIG_GENERIC_ADC_BATTERY)	+= generic-adc-battery.o
+ 
++obj-$(CONFIG_RPI_POE_POWER)	+= rpi_poe_power.o
+ obj-$(CONFIG_PDA_POWER)		+= pda_power.o
+ obj-$(CONFIG_APM_POWER)		+= apm_power.o
+ obj-$(CONFIG_AXP20X_POWER)	+= axp20x_usb_power.o
+--- /dev/null
++++ b/drivers/power/supply/rpi_poe_power.c
+@@ -0,0 +1,227 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * rpi-poe-power.c - Raspberry Pi PoE+ HAT power supply driver.
++ *
++ * Copyright (C) 2019 Raspberry Pi (Trading) Ltd.
++ * Based on axp20x_ac_power.c by Quentin Schulz <quentin.schulz@free-electrons.com>
++ *
++ * Author: Serge Schneider <serge@raspberrypi.org>
++ */
++
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/power_supply.h>
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
++#define RPI_POE_ADC_REG			0x2
++#define RPI_POE_FLAG_REG		0x4
++
++#define RPI_POE_FLAG_AT			BIT(0)
++#define RPI_POE_FLAG_OC			BIT(1)
++
++#define RPI_POE_CURRENT_AF_MAX	(2500 * 1000)
++#define RPI_POE_CURRENT_AT_MAX	(5000 * 1000)
++
++#define DRVNAME "rpi-poe-power-supply"
++
++struct rpi_poe_power_supply_ctx {
++	struct power_supply *supply;
++	struct rpi_firmware *fw;
++};
++
++struct fw_tag_data_s {
++	u32 reg;
++	u32 val;
++	u32 ret;
++};
++
++static int write_reg(struct rpi_firmware *fw, u32 reg, u32 *val)
++{
++	struct fw_tag_data_s fw_tag_data = {
++		.reg = reg,
++		.val = *val
++	};
++	int ret;
++
++	ret = rpi_firmware_property(fw, RPI_FIRMWARE_SET_POE_HAT_VAL,
++				    &fw_tag_data, sizeof(fw_tag_data));
++	if (ret)
++		return ret;
++	else if (fw_tag_data.ret)
++		return -EIO;
++	return 0;
++}
++
++static int read_reg(struct rpi_firmware *fw, u32 reg, u32 *val)
++{
++	struct fw_tag_data_s fw_tag_data = {
++		.reg = reg,
++		.val = *val
++	};
++	int ret;
++
++	ret = rpi_firmware_property(fw, RPI_FIRMWARE_GET_POE_HAT_VAL,
++				    &fw_tag_data, sizeof(fw_tag_data));
++	if (ret)
++		return ret;
++	else if (fw_tag_data.ret)
++		return -EIO;
++
++	*val = fw_tag_data.val;
++	return 0;
++}
++
++static int rpi_poe_power_supply_get_property(struct power_supply *psy,
++					enum power_supply_property psp,
++					union power_supply_propval *r_val)
++{
++	struct rpi_poe_power_supply_ctx *ctx = power_supply_get_drvdata(psy);
++	int ret;
++	unsigned int val = 0;
++
++	switch (psp) {
++	case POWER_SUPPLY_PROP_HEALTH:
++		ret = read_reg(ctx->fw, RPI_POE_FLAG_REG, &val);
++		if (ret)
++			return ret;
++
++		if (val & RPI_POE_FLAG_OC) {
++			r_val->intval = POWER_SUPPLY_HEALTH_UNSPEC_FAILURE;
++			val = RPI_POE_FLAG_OC;
++			ret = write_reg(ctx->fw, RPI_POE_FLAG_REG, &val);
++			if (ret)
++				return ret;
++			return 0;
++		}
++
++		r_val->intval = POWER_SUPPLY_HEALTH_GOOD;
++		return 0;
++
++	case POWER_SUPPLY_PROP_ONLINE:
++		ret = read_reg(ctx->fw, RPI_POE_ADC_REG, &val);
++		if (ret)
++			return ret;
++
++		r_val->intval = (val > 5);
++		return 0;
++
++	case POWER_SUPPLY_PROP_CURRENT_AVG:
++		val = 50;
++		ret = read_reg(ctx->fw, RPI_POE_ADC_REG, &val);
++		if (ret)
++			return ret;
++		val = (val * 3300)/9821;
++		r_val->intval = val * 1000;
++		return 0;
++
++	case POWER_SUPPLY_PROP_CURRENT_NOW:
++		ret = read_reg(ctx->fw, RPI_POE_ADC_REG, &val);
++		if (ret)
++			return ret;
++		val = (val * 3300)/9821;
++		r_val->intval = val * 1000;
++		return 0;
++
++	case POWER_SUPPLY_PROP_CURRENT_MAX:
++		ret = read_reg(ctx->fw, RPI_POE_FLAG_REG, &val);
++		if (ret)
++			return ret;
++
++		if (val & RPI_POE_FLAG_AT) {
++			r_val->intval = RPI_POE_CURRENT_AT_MAX;
++			return 0;
++		}
++		r_val->intval = RPI_POE_CURRENT_AF_MAX;
++		return 0;
++
++	default:
++		return -EINVAL;
++	}
++
++	return -EINVAL;
++}
++
++static enum power_supply_property rpi_poe_power_supply_properties[] = {
++	POWER_SUPPLY_PROP_HEALTH,
++	POWER_SUPPLY_PROP_ONLINE,
++	POWER_SUPPLY_PROP_CURRENT_AVG,
++	POWER_SUPPLY_PROP_CURRENT_NOW,
++	POWER_SUPPLY_PROP_CURRENT_MAX,
++};
++
++static const struct power_supply_desc rpi_poe_power_supply_desc = {
++	.name = "rpi-poe",
++	.type = POWER_SUPPLY_TYPE_MAINS,
++	.properties = rpi_poe_power_supply_properties,
++	.num_properties = ARRAY_SIZE(rpi_poe_power_supply_properties),
++	.get_property = rpi_poe_power_supply_get_property,
++};
++
++static int rpi_poe_power_supply_probe(struct platform_device *pdev)
++{
++	struct power_supply_config psy_cfg = {};
++	struct rpi_poe_power_supply_ctx *ctx;
++	struct device_node *fw_node;
++	u32 revision;
++
++	if (!of_device_is_available(pdev->dev.of_node))
++		return -ENODEV;
++
++	fw_node = of_parse_phandle(pdev->dev.of_node, "firmware", 0);
++	if (!fw_node) {
++		dev_err(&pdev->dev, "Missing firmware node\n");
++		return -ENOENT;
++	}
++
++	ctx = devm_kzalloc(&pdev->dev, sizeof(*ctx), GFP_KERNEL);
++	if (!ctx)
++		return -ENOMEM;
++
++	ctx->fw = rpi_firmware_get(fw_node);
++	if (!ctx->fw)
++		return -EPROBE_DEFER;
++	if (rpi_firmware_property(ctx->fw,
++			RPI_FIRMWARE_GET_FIRMWARE_REVISION,
++			&revision, sizeof(revision))) {
++		dev_err(&pdev->dev, "Failed to get firmware revision\n");
++		return -ENOENT;
++	}
++	if (revision < 0x60af72e8) {
++		dev_err(&pdev->dev, "Unsupported firmware\n");
++		return -ENOENT;
++	}
++	platform_set_drvdata(pdev, ctx);
++
++	psy_cfg.of_node = pdev->dev.of_node;
++	psy_cfg.drv_data = ctx;
++
++	ctx->supply = devm_power_supply_register(&pdev->dev,
++						   &rpi_poe_power_supply_desc,
++						   &psy_cfg);
++	if (IS_ERR(ctx->supply))
++		return PTR_ERR(ctx->supply);
++
++	return 0;
++}
++
++static const struct of_device_id of_rpi_poe_power_supply_match[] = {
++	{ .compatible = "raspberrypi,rpi-poe-power-supply", },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, of_rpi_poe_power_supply_match);
++
++static struct platform_driver rpi_poe_power_supply_driver = {
++	.probe = rpi_poe_power_supply_probe,
++	.driver = {
++		.name = DRVNAME,
++		.of_match_table = of_rpi_poe_power_supply_match
++	},
++};
++
++module_platform_driver(rpi_poe_power_supply_driver);
++
++MODULE_AUTHOR("Serge Schneider <serge@raspberrypi.org>");
++MODULE_ALIAS("platform:" DRVNAME);
++MODULE_DESCRIPTION("Raspberry Pi PoE+ HAT power supply driver");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0338-staging-mmal-vchiq-Rationalise-included-headers.patch b/target/linux/bcm27xx/patches-6.1/950-0338-staging-mmal-vchiq-Rationalise-included-headers.patch
new file mode 100644
index 00000000000000..68ced6d37f954a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0338-staging-mmal-vchiq-Rationalise-included-headers.patch
@@ -0,0 +1,36 @@
+From 0313c767d00d9f2113747d0efcb7ef40ed9022b6 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 15 Sep 2021 17:49:41 +0100
+Subject: [PATCH] staging/mmal-vchiq: Rationalise included headers
+
+The list of includes was slightly over generic, and wasn't
+in alphabetical order. Clean it up.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+@@ -15,16 +15,15 @@
+ 
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+ 
++#include <linux/completion.h>
+ #include <linux/errno.h>
+ #include <linux/kernel.h>
++#include <linux/mm.h>
+ #include <linux/module.h>
+ #include <linux/mutex.h>
+-#include <linux/mm.h>
+-#include <linux/slab.h>
+-#include <linux/completion.h>
+-#include <linux/vmalloc.h>
+ #include <linux/raspberrypi/vchiq.h>
+-#include <media/videobuf2-vmalloc.h>
++#include <linux/vmalloc.h>
++#include <media/videobuf2-v4l2.h>
+ 
+ #include "mmal-common.h"
+ #include "mmal-parameters.h"
diff --git a/target/linux/bcm27xx/patches-6.1/950-0339-staging-mmal-vchiq-Add-module-parameter-to-enable-lo.patch b/target/linux/bcm27xx/patches-6.1/950-0339-staging-mmal-vchiq-Add-module-parameter-to-enable-lo.patch
new file mode 100644
index 00000000000000..31162b3ce4e3ee
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0339-staging-mmal-vchiq-Add-module-parameter-to-enable-lo.patch
@@ -0,0 +1,314 @@
+From 63d550818a9470a88fa5dbe1b05bd8839ab40ab0 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 15 Sep 2021 17:54:11 +0100
+Subject: [PATCH] staging/mmal-vchiq: Add module parameter to enable
+ logging.
+
+Adds a module parameter "debug" to enable various logging levels.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../vc04_services/vchiq-mmal/mmal-vchiq.c     | 140 ++++++++++--------
+ 1 file changed, 78 insertions(+), 62 deletions(-)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+@@ -31,6 +31,17 @@
+ #include "mmal-msg.h"
+ 
+ #include "vc-sm-cma/vc_sm_knl.h"
++
++#define pr_dbg_lvl(__level, __debug, __fmt, __arg...)		\
++	do {							\
++		if (__debug >= (__level))			\
++			printk(KERN_DEBUG __fmt, ##__arg);	\
++	} while (0)
++
++static unsigned int debug;
++module_param(debug, uint, 0644);
++MODULE_PARM_DESC(debug, "activates debug info (0-3)");
++
+ /*
+  * maximum number of components supported.
+  * This matches the maximum permitted by default on the VPU
+@@ -378,7 +389,8 @@ buffer_from_host(struct vchiq_mmal_insta
+ 	if (!port->enabled)
+ 		return -EINVAL;
+ 
+-	pr_debug("instance:%u buffer:%p\n", instance->service_handle, buf);
++	pr_dbg_lvl(3, debug, "instance:%u buffer:%p\n",
++		   instance->service_handle, buf);
+ 
+ 	/* get context */
+ 	if (!buf->msg_context) {
+@@ -546,11 +558,11 @@ static void event_to_host_cb(struct vchi
+ 		msg_context->u.bulk.pts = MMAL_TIME_UNKNOWN;
+ 		msg_context->u.bulk.cmd = msg->u.event_to_host.cmd;
+ 
+-		pr_debug("event component:%u port type:%d num:%d cmd:0x%x length:%d\n",
+-			 msg->u.event_to_host.client_component,
+-			 msg->u.event_to_host.port_type,
+-			 msg->u.event_to_host.port_num,
+-			 msg->u.event_to_host.cmd, msg->u.event_to_host.length);
++		pr_dbg_lvl(3, debug, "event component:%u port type:%d num:%d cmd:0x%x length:%d\n",
++			   msg->u.event_to_host.client_component,
++			   msg->u.event_to_host.port_type,
++			   msg->u.event_to_host.port_num,
++			   msg->u.event_to_host.cmd, msg->u.event_to_host.length);
+ 	}
+ 
+ 	schedule_work(&msg_context->u.bulk.work);
+@@ -563,8 +575,8 @@ static void buffer_to_host_cb(struct vch
+ 	struct mmal_msg_context *msg_context;
+ 	u32 handle;
+ 
+-	pr_debug("%s: instance:%p msg:%p msg_len:%d\n",
+-		 __func__, instance, msg, msg_len);
++	pr_dbg_lvl(3, debug, "%s: instance:%p msg:%p msg_len:%d\n",
++		   __func__, instance, msg, msg_len);
+ 
+ 	if (msg->u.buffer_from_host.drvbuf.magic == MMAL_MAGIC) {
+ 		handle = msg->u.buffer_from_host.drvbuf.client_context;
+@@ -835,39 +847,42 @@ static int send_synchronous_mmal_msg(str
+ 
+ static void dump_port_info(struct vchiq_mmal_port *port)
+ {
+-	pr_debug("port handle:0x%x enabled:%d\n", port->handle, port->enabled);
++	pr_dbg_lvl(3, debug, "port handle:0x%x enabled:%d\n", port->handle,
++		   port->enabled);
+ 
+-	pr_debug("buffer minimum num:%d size:%d align:%d\n",
+-		 port->minimum_buffer.num,
+-		 port->minimum_buffer.size, port->minimum_buffer.alignment);
+-
+-	pr_debug("buffer recommended num:%d size:%d align:%d\n",
+-		 port->recommended_buffer.num,
+-		 port->recommended_buffer.size,
+-		 port->recommended_buffer.alignment);
+-
+-	pr_debug("buffer current values num:%d size:%d align:%d\n",
+-		 port->current_buffer.num,
+-		 port->current_buffer.size, port->current_buffer.alignment);
+-
+-	pr_debug("elementary stream: type:%d encoding:0x%x variant:0x%x\n",
+-		 port->format.type,
+-		 port->format.encoding, port->format.encoding_variant);
++	pr_dbg_lvl(3, debug, "buffer minimum num:%d size:%d align:%d\n",
++		   port->minimum_buffer.num,
++		   port->minimum_buffer.size, port->minimum_buffer.alignment);
++
++	pr_dbg_lvl(3, debug, "buffer recommended num:%d size:%d align:%d\n",
++		   port->recommended_buffer.num,
++		   port->recommended_buffer.size,
++		   port->recommended_buffer.alignment);
++
++	pr_dbg_lvl(3, debug, "buffer current values num:%d size:%d align:%d\n",
++		   port->current_buffer.num,
++		   port->current_buffer.size, port->current_buffer.alignment);
++
++	pr_dbg_lvl(3, debug, "elementary stream: type:%d encoding:0x%x variant:0x%x\n",
++		   port->format.type,
++		   port->format.encoding, port->format.encoding_variant);
+ 
+-	pr_debug("		    bitrate:%d flags:0x%x\n",
+-		 port->format.bitrate, port->format.flags);
++	pr_dbg_lvl(3, debug, "		    bitrate:%d flags:0x%x\n",
++		   port->format.bitrate, port->format.flags);
+ 
+ 	if (port->format.type == MMAL_ES_TYPE_VIDEO) {
+-		pr_debug
+-		    ("es video format: width:%d height:%d colourspace:0x%x\n",
++		pr_dbg_lvl(3, debug,
++		    "es video format: width:%d height:%d colourspace:0x%x\n",
+ 		     port->es.video.width, port->es.video.height,
+ 		     port->es.video.color_space);
+ 
+-		pr_debug("		 : crop xywh %d,%d,%d,%d\n",
++		pr_dbg_lvl(3, debug,
++			 "		 : crop xywh %d,%d,%d,%d\n",
+ 			 port->es.video.crop.x,
+ 			 port->es.video.crop.y,
+ 			 port->es.video.crop.width, port->es.video.crop.height);
+-		pr_debug("		 : framerate %d/%d  aspect %d/%d\n",
++		pr_dbg_lvl(3, debug,
++			 "		 : framerate %d/%d  aspect %d/%d\n",
+ 			 port->es.video.frame_rate.numerator,
+ 			 port->es.video.frame_rate.denominator,
+ 			 port->es.video.par.numerator, port->es.video.par.denominator);
+@@ -901,7 +916,7 @@ static int port_info_set(struct vchiq_mm
+ 	struct mmal_msg *rmsg;
+ 	struct vchiq_header *rmsg_handle;
+ 
+-	pr_debug("setting port info port %p\n", port);
++	pr_dbg_lvl(1, debug, "setting port info port %p\n", port);
+ 	if (!port)
+ 		return -1;
+ 	dump_port_info(port);
+@@ -944,8 +959,8 @@ static int port_info_set(struct vchiq_mm
+ 	/* return operation status */
+ 	ret = -rmsg->u.port_info_get_reply.status;
+ 
+-	pr_debug("%s:result:%d component:0x%x port:%d\n", __func__, ret,
+-		 port->component->handle, port->handle);
++	pr_dbg_lvl(1, debug, "%s:result:%d component:0x%x port:%d\n", __func__,
++		   ret, port->component->handle, port->handle);
+ 
+ release_msg:
+ 	vchiq_release_message(instance->vchiq_instance, instance->service_handle, rmsg_handle);
+@@ -1035,13 +1050,13 @@ static int port_info_get(struct vchiq_mm
+ 	       rmsg->u.port_info_get_reply.extradata,
+ 	       port->format.extradata_size);
+ 
+-	pr_debug("received port info\n");
++	pr_dbg_lvl(1, debug, "received port info\n");
+ 	dump_port_info(port);
+ 
+ release_msg:
+ 
+-	pr_debug("%s:result:%d component:0x%x port:%d\n",
+-		 __func__, ret, port->component->handle, port->handle);
++	pr_dbg_lvl(1, debug, "%s:result:%d component:0x%x port:%d\n",
++		   __func__, ret, port->component->handle, port->handle);
+ 
+ 	vchiq_release_message(instance->vchiq_instance, instance->service_handle, rmsg_handle);
+ 
+@@ -1086,9 +1101,9 @@ static int create_component(struct vchiq
+ 	component->outputs = rmsg->u.component_create_reply.output_num;
+ 	component->clocks = rmsg->u.component_create_reply.clock_num;
+ 
+-	pr_debug("Component handle:0x%x in:%d out:%d clock:%d\n",
+-		 component->handle,
+-		 component->inputs, component->outputs, component->clocks);
++	pr_dbg_lvl(2, debug, "Component handle:0x%x in:%d out:%d clock:%d\n",
++		   component->handle,
++		   component->inputs, component->outputs, component->clocks);
+ 
+ release_msg:
+ 	vchiq_release_message(instance->vchiq_instance, instance->service_handle, rmsg_handle);
+@@ -1257,10 +1272,9 @@ static int port_action_port(struct vchiq
+ 
+ 	ret = -rmsg->u.port_action_reply.status;
+ 
+-	pr_debug("%s:result:%d component:0x%x port:%d action:%s(%d)\n",
+-		 __func__,
+-		 ret, port->component->handle, port->handle,
+-		 port_action_type_names[action_type], action_type);
++	pr_dbg_lvl(2, debug, "%s:result:%d component:0x%x port:%d action:%s(%d)\n",
++		   __func__, ret, port->component->handle, port->handle,
++		   port_action_type_names[action_type], action_type);
+ 
+ release_msg:
+ 	vchiq_release_message(instance->vchiq_instance, instance->service_handle, rmsg_handle);
+@@ -1304,11 +1318,11 @@ static int port_action_handle(struct vch
+ 
+ 	ret = -rmsg->u.port_action_reply.status;
+ 
+-	pr_debug("%s:result:%d component:0x%x port:%d action:%s(%d) connect component:0x%x connect port:%d\n",
+-		 __func__,
+-		 ret, port->component->handle, port->handle,
+-		 port_action_type_names[action_type],
+-		 action_type, connect_component_handle, connect_port_handle);
++	pr_dbg_lvl(2, debug,
++		   "%s:result:%d component:0x%x port:%d action:%s(%d) connect component:0x%x connect port:%d\n",
++		   __func__, ret, port->component->handle, port->handle,
++		   port_action_type_names[action_type],
++		   action_type, connect_component_handle, connect_port_handle);
+ 
+ release_msg:
+ 	vchiq_release_message(instance->vchiq_instance, instance->service_handle, rmsg_handle);
+@@ -1347,9 +1361,9 @@ static int port_parameter_set(struct vch
+ 
+ 	ret = -rmsg->u.port_parameter_set_reply.status;
+ 
+-	pr_debug("%s:result:%d component:0x%x port:%d parameter:%d\n",
+-		 __func__,
+-		 ret, port->component->handle, port->handle, parameter_id);
++	pr_dbg_lvl(1, debug, "%s:result:%d component:0x%x port:%d parameter:%d\n",
++		   __func__, ret, port->component->handle, port->handle,
++		   parameter_id);
+ 
+ release_msg:
+ 	vchiq_release_message(instance->vchiq_instance, instance->service_handle, rmsg_handle);
+@@ -1407,8 +1421,9 @@ static int port_parameter_get(struct vch
+ 	/* Always report the size of the returned parameter to the caller */
+ 	*value_size = rmsg->u.port_parameter_get_reply.size;
+ 
+-	pr_debug("%s:result:%d component:0x%x port:%d parameter:%d\n", __func__,
+-		 ret, port->component->handle, port->handle, parameter_id);
++	pr_dbg_lvl(1, debug, "%s:result:%d component:0x%x port:%d parameter:%d\n",
++		   __func__, ret, port->component->handle, port->handle,
++		   parameter_id);
+ 
+ release_msg:
+ 	vchiq_release_message(instance->vchiq_instance, instance->service_handle, rmsg_handle);
+@@ -1665,7 +1680,7 @@ int vchiq_mmal_port_connect_tunnel(struc
+ 	if (!dst) {
+ 		/* do not make new connection */
+ 		ret = 0;
+-		pr_debug("not making new connection\n");
++		pr_dbg_lvl(3, debug, "not making new connection\n");
+ 		goto release_unlock;
+ 	}
+ 
+@@ -1683,14 +1698,14 @@ int vchiq_mmal_port_connect_tunnel(struc
+ 	/* set new format */
+ 	ret = port_info_set(instance, dst);
+ 	if (ret) {
+-		pr_debug("setting port info failed\n");
++		pr_dbg_lvl(1, debug, "setting port info failed\n");
+ 		goto release_unlock;
+ 	}
+ 
+ 	/* read what has actually been set */
+ 	ret = port_info_get(instance, dst);
+ 	if (ret) {
+-		pr_debug("read back port info failed\n");
++		pr_dbg_lvl(1, debug, "read back port info failed\n");
+ 		goto release_unlock;
+ 	}
+ 
+@@ -1699,9 +1714,9 @@ int vchiq_mmal_port_connect_tunnel(struc
+ 				 MMAL_MSG_PORT_ACTION_TYPE_CONNECT,
+ 				 dst->component->handle, dst->handle);
+ 	if (ret < 0) {
+-		pr_debug("connecting port %d:%d to %d:%d failed\n",
+-			 src->component->handle, src->handle,
+-			 dst->component->handle, dst->handle);
++		pr_dbg_lvl(2, debug, "connecting port %d:%d to %d:%d failed\n",
++			   src->component->handle, src->handle,
++			   dst->component->handle, dst->handle);
+ 		goto release_unlock;
+ 	}
+ 	src->connected = dst;
+@@ -1726,7 +1741,8 @@ int vchiq_mmal_submit_buffer(struct vchi
+ 	 * videobuf2 won't let us have the dmabuf there.
+ 	 */
+ 	if (port->zero_copy && buffer->dma_buf && !buffer->vcsm_handle) {
+-		pr_debug("%s: import dmabuf %p\n", __func__, buffer->dma_buf);
++		pr_dbg_lvl(2, debug, "%s: import dmabuf %p\n",
++			   __func__, buffer->dma_buf);
+ 		ret = vc_sm_cma_import_dmabuf(buffer->dma_buf,
+ 					      &buffer->vcsm_handle);
+ 		if (ret) {
+@@ -1742,8 +1758,8 @@ int vchiq_mmal_submit_buffer(struct vchi
+ 			vc_sm_cma_free(buffer->vcsm_handle);
+ 			return ret;
+ 		}
+-		pr_debug("%s: import dmabuf %p - got vc handle %08X\n",
+-			 __func__, buffer->dma_buf, buffer->vc_handle);
++		pr_dbg_lvl(2, debug, "%s: import dmabuf %p - got vc handle %08X\n",
++			   __func__, buffer->dma_buf, buffer->vc_handle);
+ 	}
+ 
+ 	ret = buffer_from_host(instance, port, buffer);
+@@ -1782,8 +1798,8 @@ int mmal_vchi_buffer_cleanup(struct mmal
+ 	if (buf->vcsm_handle) {
+ 		int ret;
+ 
+-		pr_debug("%s: vc_sm_cma_free on handle %p\n", __func__,
+-			 buf->vcsm_handle);
++		pr_dbg_lvl(2, debug, "%s: vc_sm_cma_free on handle %p\n", __func__,
++			   buf->vcsm_handle);
+ 		ret = vc_sm_cma_free(buf->vcsm_handle);
+ 		if (ret)
+ 			pr_err("%s: vcsm_free failed, ret %d\n", __func__, ret);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0340-staging-mmal-vchiq-Reset-buffers_with_vpu-on-port_en.patch b/target/linux/bcm27xx/patches-6.1/950-0340-staging-mmal-vchiq-Reset-buffers_with_vpu-on-port_en.patch
new file mode 100644
index 00000000000000..46414dc7490d45
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0340-staging-mmal-vchiq-Reset-buffers_with_vpu-on-port_en.patch
@@ -0,0 +1,31 @@
+From 10f20f30bb2617ec138ca456b059c164c8a4b03c Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 21 Sep 2021 17:17:57 +0100
+Subject: [PATCH] staging: mmal-vchiq: Reset buffers_with_vpu on
+ port_enable
+
+Should we go through the timeout failure case with port_disable
+not returning all buffers for whatever reason, the
+buffers_with_vpu counter gets left at a non-zero value, which
+will cause reference counting issues should the instance be
+reused.
+
+Reset the count when the port is enabled again, but before
+any buffers have been sent to the VPU.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+@@ -1500,6 +1500,8 @@ static int port_enable(struct vchiq_mmal
+ 
+ 	port->enabled = 1;
+ 
++	atomic_set(&port->buffers_with_vpu, 0);
++
+ 	if (port->buffer_cb) {
+ 		/* send buffer headers to videocore */
+ 		hdr_count = 1;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0341-drivers-gpio-Add-a-driver-that-wraps-the-PWM-API-as-.patch b/target/linux/bcm27xx/patches-6.1/950-0341-drivers-gpio-Add-a-driver-that-wraps-the-PWM-API-as-.patch
new file mode 100644
index 00000000000000..f48aaff978b415
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0341-drivers-gpio-Add-a-driver-that-wraps-the-PWM-API-as-.patch
@@ -0,0 +1,192 @@
+From dbd522842d668d590dd415cc99045a9b1f05aeae Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 14 Oct 2021 11:09:18 +0100
+Subject: [PATCH] drivers/gpio: Add a driver that wraps the PWM API as
+ a GPIO controller
+
+For cases where spare PWM outputs are available, but are desired
+to be addressed a standard outputs instead.
+Wraps a PWM channel as a new GPIO chip with the one output.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpio/Kconfig    |   8 +++
+ drivers/gpio/Makefile   |   1 +
+ drivers/gpio/gpio-pwm.c | 144 ++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 153 insertions(+)
+ create mode 100644 drivers/gpio/gpio-pwm.c
+
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -500,6 +500,14 @@ config GPIO_PMIC_EIC_SPRD
+ 	help
+ 	  Say yes here to support Spreadtrum PMIC EIC device.
+ 
++config GPIO_PWM
++	tristate "PWM chip GPIO"
++	depends on OF_GPIO
++	depends on PWM
++	help
++	  Turn on support for exposing a PWM chip as a GPIO
++	  driver.
++
+ config GPIO_PXA
+ 	bool "PXA GPIO support"
+ 	depends on ARCH_PXA || ARCH_MMP || COMPILE_TEST
+--- a/drivers/gpio/Makefile
++++ b/drivers/gpio/Makefile
+@@ -123,6 +123,7 @@ obj-$(CONFIG_GPIO_PCI_IDIO_16)		+= gpio-
+ obj-$(CONFIG_GPIO_PISOSR)		+= gpio-pisosr.o
+ obj-$(CONFIG_GPIO_PL061)		+= gpio-pl061.o
+ obj-$(CONFIG_GPIO_PMIC_EIC_SPRD)	+= gpio-pmic-eic-sprd.o
++obj-$(CONFIG_GPIO_PWM)			+= gpio-pwm.o
+ obj-$(CONFIG_GPIO_PXA)			+= gpio-pxa.o
+ obj-$(CONFIG_GPIO_RASPBERRYPI_EXP)	+= gpio-raspberrypi-exp.o
+ obj-$(CONFIG_GPIO_RC5T583)		+= gpio-rc5t583.o
+--- /dev/null
++++ b/drivers/gpio/gpio-pwm.c
+@@ -0,0 +1,144 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * GPIO driver wrapping PWM API
++ *
++ * PWM 0% and PWM 100% are equivalent to digital GPIO
++ * outputs, and there are times where it is useful to use
++ * PWM outputs as straight GPIOs (eg outputs of NXP PCA9685
++ * I2C PWM chip). This driver wraps the PWM API as a GPIO
++ * controller.
++ *
++ * Copyright (C) 2021 Raspberry Pi (Trading) Ltd.
++ */
++
++#include <linux/err.h>
++#include <linux/gpio/driver.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/pwm.h>
++
++struct pwm_gpio {
++	struct gpio_chip gc;
++	struct pwm_device **pwm;
++};
++
++static int pwm_gpio_get_direction(struct gpio_chip *gc, unsigned int off)
++{
++	return GPIO_LINE_DIRECTION_OUT;
++}
++
++static void pwm_gpio_set(struct gpio_chip *gc, unsigned int off, int val)
++{
++	struct pwm_gpio *pwm_gpio = gpiochip_get_data(gc);
++	struct pwm_state state;
++
++	pwm_get_state(pwm_gpio->pwm[off], &state);
++	state.duty_cycle = val ? state.period : 0;
++	pwm_apply_state(pwm_gpio->pwm[off], &state);
++}
++
++static int pwm_gpio_parse_dt(struct pwm_gpio *pwm_gpio,
++			     struct device *dev)
++{
++	struct device_node *node = dev->of_node;
++	struct pwm_state state;
++	int ret = 0, i, num_gpios;
++	const char *pwm_name;
++
++	if (!node)
++		return -ENODEV;
++
++	num_gpios = of_property_count_strings(node, "pwm-names");
++	if (num_gpios <= 0)
++		return 0;
++
++	pwm_gpio->pwm = devm_kzalloc(dev,
++				     sizeof(*pwm_gpio->pwm) * num_gpios,
++				     GFP_KERNEL);
++	if (!pwm_gpio->pwm)
++		return -ENOMEM;
++
++	for (i = 0; i < num_gpios; i++) {
++		ret = of_property_read_string_index(node, "pwm-names", i,
++						    &pwm_name);
++		if (ret) {
++			dev_err(dev, "unable to get pwm device index %d, name %s",
++				i, pwm_name);
++			goto error;
++		}
++
++		pwm_gpio->pwm[i] = devm_pwm_get(dev, pwm_name);
++		if (IS_ERR(pwm_gpio->pwm[i])) {
++			ret = PTR_ERR(pwm_gpio->pwm[i]);
++			if (ret != -EPROBE_DEFER)
++				dev_err(dev, "unable to request PWM\n");
++			goto error;
++		}
++
++		/* Sync up PWM state. */
++		pwm_init_state(pwm_gpio->pwm[i], &state);
++
++		state.duty_cycle = 0;
++		pwm_apply_state(pwm_gpio->pwm[i], &state);
++	}
++
++	pwm_gpio->gc.ngpio = num_gpios;
++
++error:
++	return ret;
++}
++
++static int pwm_gpio_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct pwm_gpio *pwm_gpio;
++	int ret;
++
++	pwm_gpio = devm_kzalloc(dev, sizeof(*pwm_gpio), GFP_KERNEL);
++	if (!pwm_gpio)
++		return -ENOMEM;
++
++	pwm_gpio->gc.parent = dev;
++	pwm_gpio->gc.label = "pwm-gpio";
++	pwm_gpio->gc.owner = THIS_MODULE;
++	pwm_gpio->gc.of_node = dev->of_node;
++	pwm_gpio->gc.base = -1;
++
++	pwm_gpio->gc.get_direction = pwm_gpio_get_direction;
++	pwm_gpio->gc.set = pwm_gpio_set;
++	pwm_gpio->gc.can_sleep = true;
++
++	ret = pwm_gpio_parse_dt(pwm_gpio, dev);
++	if (ret)
++		return ret;
++
++	if (!pwm_gpio->gc.ngpio)
++		return 0;
++
++	return devm_gpiochip_add_data(dev, &pwm_gpio->gc, pwm_gpio);
++}
++
++static int pwm_gpio_remove(struct platform_device *pdev)
++{
++	return 0;
++}
++
++static const struct of_device_id pwm_gpio_of_match[] = {
++	{ .compatible = "pwm-gpio" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, pwm_gpio_of_match);
++
++static struct platform_driver pwm_gpio_driver = {
++	.driver	= {
++		.name		= "pwm-gpio",
++		.of_match_table	= of_match_ptr(pwm_gpio_of_match),
++	},
++	.probe	= pwm_gpio_probe,
++	.remove	= pwm_gpio_remove,
++};
++module_platform_driver(pwm_gpio_driver);
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Dave Stevenson <dave.stevenson@raspberrypi.com>");
++MODULE_DESCRIPTION("PWM GPIO driver");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0342-media-i2c-ov5647-Sensor-should-report-RAW-color-spac.patch b/target/linux/bcm27xx/patches-6.1/950-0342-media-i2c-ov5647-Sensor-should-report-RAW-color-spac.patch
new file mode 100644
index 00000000000000..68dc55ebd24647
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0342-media-i2c-ov5647-Sensor-should-report-RAW-color-spac.patch
@@ -0,0 +1,51 @@
+From 448cd18658f69e4af0e4504cd9f525e72a461e23 Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Thu, 21 Oct 2021 14:47:00 +0100
+Subject: [PATCH] media: i2c: ov5647: Sensor should report RAW color
+ space
+
+Tested on Raspberry Pi running libcamera.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ drivers/media/i2c/ov5647.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -494,7 +494,7 @@ static const struct ov5647_mode ov5647_m
+ 	{
+ 		.format = {
+ 			.code		= MEDIA_BUS_FMT_SBGGR10_1X10,
+-			.colorspace	= V4L2_COLORSPACE_SRGB,
++			.colorspace	= V4L2_COLORSPACE_RAW,
+ 			.field		= V4L2_FIELD_NONE,
+ 			.width		= 2592,
+ 			.height		= 1944
+@@ -515,7 +515,7 @@ static const struct ov5647_mode ov5647_m
+ 	{
+ 		.format = {
+ 			.code		= MEDIA_BUS_FMT_SBGGR10_1X10,
+-			.colorspace	= V4L2_COLORSPACE_SRGB,
++			.colorspace	= V4L2_COLORSPACE_RAW,
+ 			.field		= V4L2_FIELD_NONE,
+ 			.width		= 1920,
+ 			.height		= 1080
+@@ -536,7 +536,7 @@ static const struct ov5647_mode ov5647_m
+ 	{
+ 		.format = {
+ 			.code		= MEDIA_BUS_FMT_SBGGR10_1X10,
+-			.colorspace	= V4L2_COLORSPACE_SRGB,
++			.colorspace	= V4L2_COLORSPACE_RAW,
+ 			.field		= V4L2_FIELD_NONE,
+ 			.width		= 1296,
+ 			.height		= 972
+@@ -557,7 +557,7 @@ static const struct ov5647_mode ov5647_m
+ 	{
+ 		.format = {
+ 			.code		= MEDIA_BUS_FMT_SBGGR10_1X10,
+-			.colorspace	= V4L2_COLORSPACE_SRGB,
++			.colorspace	= V4L2_COLORSPACE_RAW,
+ 			.field		= V4L2_FIELD_NONE,
+ 			.width		= 640,
+ 			.height		= 480
diff --git a/target/linux/bcm27xx/patches-6.1/950-0343-vc04_services-isp-Report-input-node-as-wanting-full-.patch b/target/linux/bcm27xx/patches-6.1/950-0343-vc04_services-isp-Report-input-node-as-wanting-full-.patch
new file mode 100644
index 00000000000000..8a4c0280e7e5c1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0343-vc04_services-isp-Report-input-node-as-wanting-full-.patch
@@ -0,0 +1,29 @@
+From 069a73472178545d5b4683ba3c83eb5b16f0fb6a Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Thu, 21 Oct 2021 14:49:15 +0100
+Subject: [PATCH] vc04_services: isp: Report input node as wanting full
+ range RAW color space
+
+RAW color spaces are more usually reported as having full range
+quantization.
+
+Tested using libcamera.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
+@@ -1034,7 +1034,9 @@ static int bcm2835_isp_node_try_fmt(stru
+ 		/* In all cases, we only support the defaults for these: */
+ 		f->fmt.pix.ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(f->fmt.pix.colorspace);
+ 		f->fmt.pix.xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(f->fmt.pix.colorspace);
+-		is_rgb = f->fmt.pix.colorspace == V4L2_COLORSPACE_SRGB;
++		/* RAW counts as sRGB here so that we get full range. */
++		is_rgb = f->fmt.pix.colorspace == V4L2_COLORSPACE_SRGB ||
++			f->fmt.pix.colorspace == V4L2_COLORSPACE_RAW;
+ 		f->fmt.pix.quantization = V4L2_MAP_QUANTIZATION_DEFAULT(is_rgb, f->fmt.pix.colorspace,
+ 									f->fmt.pix.ycbcr_enc);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0344-media-bcm2835-unicam-Parse-pad-numbers-correctly.patch b/target/linux/bcm27xx/patches-6.1/950-0344-media-bcm2835-unicam-Parse-pad-numbers-correctly.patch
new file mode 100644
index 00000000000000..283591efbeb848
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0344-media-bcm2835-unicam-Parse-pad-numbers-correctly.patch
@@ -0,0 +1,232 @@
+From a335da8b55f0ade5c4488d5dddda9681f885fb45 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 23 Sep 2020 15:16:18 +0100
+Subject: [PATCH] media/bcm2835-unicam: Parse pad numbers correctly
+
+The driver was making big assumptions about the source device
+using pad 0 and 1, which doesn't follow for more complex
+devices where Unicam's source device may be a sink device for
+something else.
+
+Read the pad numbers through media controller, and reference
+them appropriately.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 89 ++++++++++++-------
+ 1 file changed, 58 insertions(+), 31 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -382,6 +382,8 @@ struct unicam_node {
+ 	int open;
+ 	bool streaming;
+ 	unsigned int pad_id;
++	/* Source pad id on the sensor for this node */
++	unsigned int src_pad_id;
+ 	/* Pointer pointing to current v4l2_buffer */
+ 	struct unicam_buffer *cur_frm;
+ 	/* Pointer pointing to next v4l2_buffer */
+@@ -590,7 +592,7 @@ static int __subdev_get_format(struct un
+ {
+ 	struct v4l2_subdev_format sd_fmt = {
+ 		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
+-		.pad = pad_id
++		.pad = dev->node[pad_id].src_pad_id,
+ 	};
+ 	int ret;
+ 
+@@ -612,7 +614,7 @@ static int __subdev_set_format(struct un
+ {
+ 	struct v4l2_subdev_format sd_fmt = {
+ 		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
+-		.pad = pad_id
++		.pad = dev->node[pad_id].src_pad_id,
+ 	};
+ 	int ret;
+ 
+@@ -1980,7 +1982,7 @@ static int unicam_enum_framesizes(struct
+ 
+ 	fse.which = V4L2_SUBDEV_FORMAT_ACTIVE;
+ 	fse.index = fsize->index;
+-	fse.pad = node->pad_id;
++	fse.pad = node->src_pad_id;
+ 
+ 	ret = v4l2_subdev_call(dev->sensor, pad, enum_frame_size, NULL, &fse);
+ 	if (ret)
+@@ -2005,6 +2007,7 @@ static int unicam_enum_frameintervals(st
+ 	const struct unicam_fmt *fmt;
+ 	struct v4l2_subdev_frame_interval_enum fie = {
+ 		.index = fival->index,
++		.pad = node->src_pad_id,
+ 		.width = fival->width,
+ 		.height = fival->height,
+ 		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
+@@ -2096,8 +2099,13 @@ static int unicam_enum_dv_timings(struct
+ {
+ 	struct unicam_node *node = video_drvdata(file);
+ 	struct unicam_device *dev = node->dev;
++	int ret;
++
++	timings->pad = node->src_pad_id;
++	ret = v4l2_subdev_call(dev->sensor, pad, enum_dv_timings, timings);
++	timings->pad = node->pad_id;
+ 
+-	return v4l2_subdev_call(dev->sensor, pad, enum_dv_timings, timings);
++	return ret;
+ }
+ 
+ static int unicam_dv_timings_cap(struct file *file, void *priv,
+@@ -2105,8 +2113,13 @@ static int unicam_dv_timings_cap(struct
+ {
+ 	struct unicam_node *node = video_drvdata(file);
+ 	struct unicam_device *dev = node->dev;
++	int ret;
++
++	cap->pad = node->src_pad_id;
++	ret = v4l2_subdev_call(dev->sensor, pad, dv_timings_cap, cap);
++	cap->pad = node->pad_id;
+ 
+-	return v4l2_subdev_call(dev->sensor, pad, dv_timings_cap, cap);
++	return ret;
+ }
+ 
+ static int unicam_subscribe_event(struct v4l2_fh *fh,
+@@ -2377,14 +2390,12 @@ static int register_node(struct unicam_d
+ 			 */
+ 			fmt = get_first_supported_format(unicam);
+ 
+-			if (!fmt)
+-				/* No compatible formats */
+-				return -EINVAL;
+-
+-			mbus_fmt.code = fmt->code;
+-			ret = __subdev_set_format(unicam, &mbus_fmt, pad_id);
+-			if (ret)
+-				return -EINVAL;
++			if (fmt) {
++				mbus_fmt.code = fmt->code;
++				ret = __subdev_set_format(unicam, &mbus_fmt, pad_id);
++				if (ret)
++					return -EINVAL;
++			}
+ 		}
+ 		if (mbus_fmt.field != V4L2_FIELD_NONE) {
+ 			/* Interlaced not supported - disable it now. */
+@@ -2394,7 +2405,8 @@ static int register_node(struct unicam_d
+ 				return -EINVAL;
+ 		}
+ 
+-		node->v_fmt.fmt.pix.pixelformat = fmt->fourcc ? fmt->fourcc
++		if (fmt)
++			node->v_fmt.fmt.pix.pixelformat = fmt->fourcc ? fmt->fourcc
+ 						: fmt->repacked_fourcc;
+ 	} else {
+ 		/* Fix this node format as embedded data. */
+@@ -2407,7 +2419,8 @@ static int register_node(struct unicam_d
+ 	node->fmt = fmt;
+ 
+ 	/* Read current subdev format */
+-	unicam_reset_format(node);
++	if (fmt)
++		unicam_reset_format(node);
+ 
+ 	if (v4l2_subdev_has_op(unicam->sensor, video, s_std)) {
+ 		v4l2_std_id tvnorms;
+@@ -2496,6 +2509,7 @@ static int register_node(struct unicam_d
+ 		unicam_err(unicam, "Unable to allocate dummy buffer.\n");
+ 		return -ENOMEM;
+ 	}
++
+ 	if (pad_id == METADATA_PAD ||
+ 	    !v4l2_subdev_has_op(unicam->sensor, video, s_std)) {
+ 		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_STD);
+@@ -2554,7 +2568,8 @@ static int register_node(struct unicam_d
+ 	node->registered = true;
+ 
+ 	if (pad_id != METADATA_PAD || unicam->sensor_embedded_data) {
+-		ret = media_create_pad_link(&unicam->sensor->entity, pad_id,
++		ret = media_create_pad_link(&unicam->sensor->entity,
++					    node->src_pad_id,
+ 					    &node->video_dev.entity, 0,
+ 					    MEDIA_LNK_FL_ENABLED |
+ 					    MEDIA_LNK_FL_IMMUTABLE);
+@@ -2586,9 +2601,11 @@ static void unregister_nodes(struct unic
+ 	}
+ }
+ 
+-static int unicam_probe_complete(struct unicam_device *unicam)
++static int unicam_async_complete(struct v4l2_async_notifier *notifier)
+ {
+ 	static struct lock_class_key key;
++	struct unicam_device *unicam = to_unicam_device(notifier->v4l2_dev);
++	unsigned int i, source_pads = 0;
+ 	int ret;
+ 
+ 	unicam->v4l2_dev.notify = unicam_notify;
+@@ -2598,7 +2615,20 @@ static int unicam_probe_complete(struct
+ 	if (!unicam->sensor_state)
+ 		return -ENOMEM;
+ 
+-	unicam->sensor_embedded_data = (unicam->sensor->entity.num_pads >= 2);
++	for (i = 0; i < unicam->sensor->entity.num_pads; i++) {
++		if (unicam->sensor->entity.pads[i].flags & MEDIA_PAD_FL_SOURCE) {
++			if (source_pads < MAX_NODES) {
++				unicam->node[source_pads].src_pad_id = i;
++				unicam_err(unicam, "source pad %u is index %u\n",
++					   source_pads, i);
++			}
++			source_pads++;
++		}
++	}
++	if (!source_pads) {
++		unicam_err(unicam, "No source pads on sensor.\n");
++		goto unregister;
++	}
+ 
+ 	ret = register_node(unicam, &unicam->node[IMAGE_PAD],
+ 			    V4L2_BUF_TYPE_VIDEO_CAPTURE, IMAGE_PAD);
+@@ -2607,11 +2637,15 @@ static int unicam_probe_complete(struct
+ 		goto unregister;
+ 	}
+ 
+-	ret = register_node(unicam, &unicam->node[METADATA_PAD],
+-			    V4L2_BUF_TYPE_META_CAPTURE, METADATA_PAD);
+-	if (ret) {
+-		unicam_err(unicam, "Unable to register metadata video device.\n");
+-		goto unregister;
++	if (source_pads >= 2) {
++		unicam->sensor_embedded_data = true;
++
++		ret = register_node(unicam, &unicam->node[METADATA_PAD],
++				    V4L2_BUF_TYPE_META_CAPTURE, METADATA_PAD);
++		if (ret) {
++			unicam_err(unicam, "Unable to register metadata video device.\n");
++			goto unregister;
++		}
+ 	}
+ 
+ 	ret = v4l2_device_register_ro_subdev_nodes(&unicam->v4l2_dev);
+@@ -2634,13 +2668,6 @@ unregister:
+ 	return ret;
+ }
+ 
+-static int unicam_async_complete(struct v4l2_async_notifier *notifier)
+-{
+-	struct unicam_device *unicam = to_unicam_device(notifier->v4l2_dev);
+-
+-	return unicam_probe_complete(unicam);
+-}
+-
+ static const struct v4l2_async_notifier_operations unicam_async_ops = {
+ 	.bound = unicam_async_bound,
+ 	.complete = unicam_async_complete,
+@@ -2749,7 +2776,7 @@ static int of_unicam_connect_subdevs(str
+ 	dev->notifier.ops = &unicam_async_ops;
+ 
+ 	dev->asd.match_type = V4L2_ASYNC_MATCH_FWNODE;
+-	dev->asd.match.fwnode = of_fwnode_handle(sensor_node);
++	dev->asd.match.fwnode = fwnode_graph_get_remote_endpoint(of_fwnode_handle(ep_node));
+ 	ret = __v4l2_async_nf_add_subdev(&dev->notifier, &dev->asd);
+ 	if (ret) {
+ 		unicam_err(dev, "Error adding subdevice: %d\n", ret);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0345-media-bcm2835-unicam-Add-support-for-configuration-v.patch b/target/linux/bcm27xx/patches-6.1/950-0345-media-bcm2835-unicam-Add-support-for-configuration-v.patch
new file mode 100644
index 00000000000000..83d40d730e4d08
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0345-media-bcm2835-unicam-Add-support-for-configuration-v.patch
@@ -0,0 +1,1952 @@
+From 9556f5777a8961dec3259f4c09c267ca5c77c90a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 15 Oct 2021 17:57:27 +0100
+Subject: [PATCH] media/bcm2835-unicam: Add support for configuration
+ via MC API
+
+Adds Media Controller API support for more complex pipelines.
+libcamera is about to switch to using this mechanism for configuring
+sensors.
+
+This can be enabled by either a module parameter, or device tree.
+
+Various functions have been moved to group video-centric and
+mc-centric functions together.
+
+Based on a similar conversion done to ti-vpe.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: bcm2835-unicam: Fixup for 5.18 and new get_mbus_config struct
+
+The number of active CSI2 data lanes has moved within the struct
+v4l2_mbus_config used by the get_mbus_config API call.
+Update the driver to match the changes in mainline.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 2111 ++++++++++-------
+ 1 file changed, 1306 insertions(+), 805 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -83,6 +83,10 @@ static int debug;
+ module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, "Debug level 0-3");
+ 
++static int media_controller;
++module_param(media_controller, int, 0644);
++MODULE_PARM_DESC(media_controller, "Use media controller API");
++
+ #define unicam_dbg(level, dev, fmt, arg...)	\
+ 		v4l2_dbg(level, debug, &(dev)->v4l2_dev, fmt, ##arg)
+ #define unicam_info(dev, fmt, arg...)	\
+@@ -119,7 +123,7 @@ MODULE_PARM_DESC(debug, "Debug level 0-3
+ #define MIN_WIDTH		16
+ #define MIN_HEIGHT		16
+ /* Default size of the embedded buffer */
+-#define UNICAM_EMBEDDED_SIZE	8192
++#define UNICAM_EMBEDDED_SIZE	16384
+ 
+ /*
+  * Size of the dummy buffer. Can be any size really, but the DMA
+@@ -133,6 +137,22 @@ enum pad_types {
+ 	MAX_NODES
+ };
+ 
++#define MASK_CS_DEFAULT		BIT(V4L2_COLORSPACE_DEFAULT)
++#define MASK_CS_SMPTE170M	BIT(V4L2_COLORSPACE_SMPTE170M)
++#define MASK_CS_SMPTE240M	BIT(V4L2_COLORSPACE_SMPTE240M)
++#define MASK_CS_REC709		BIT(V4L2_COLORSPACE_REC709)
++#define MASK_CS_BT878		BIT(V4L2_COLORSPACE_BT878)
++#define MASK_CS_470_M		BIT(V4L2_COLORSPACE_470_SYSTEM_M)
++#define MASK_CS_470_BG		BIT(V4L2_COLORSPACE_470_SYSTEM_BG)
++#define MASK_CS_JPEG		BIT(V4L2_COLORSPACE_JPEG)
++#define MASK_CS_SRGB		BIT(V4L2_COLORSPACE_SRGB)
++#define MASK_CS_OPRGB		BIT(V4L2_COLORSPACE_OPRGB)
++#define MASK_CS_BT2020		BIT(V4L2_COLORSPACE_BT2020)
++#define MASK_CS_RAW		BIT(V4L2_COLORSPACE_RAW)
++#define MASK_CS_DCI_P3		BIT(V4L2_COLORSPACE_DCI_P3)
++
++#define MAX_COLORSPACE		32
++
+ /*
+  * struct unicam_fmt - Unicam media bus format information
+  * @pixelformat: V4L2 pixel format FCC identifier. 0 if n/a.
+@@ -141,8 +161,14 @@ enum pad_types {
+  * @code: V4L2 media bus format code.
+  * @depth: Bits per pixel as delivered from the source.
+  * @csi_dt: CSI data type.
++ * @valid_colorspaces: Bitmask of valid colorspaces so that the Media Controller
++ *		centric try_fmt can validate the colorspace and pass
++ *		v4l2-compliance.
+  * @check_variants: Flag to denote that there are multiple mediabus formats
+  *		still in the list that could match this V4L2 format.
++ * @mc_skip: Media Controller shouldn't list this format via ENUM_FMT as it is
++ *		a duplicate of an earlier format.
++ * @metadata_fmt: This format only applies to the metadata pad.
+  */
+ struct unicam_fmt {
+ 	u32	fourcc;
+@@ -150,7 +176,10 @@ struct unicam_fmt {
+ 	u32	code;
+ 	u8	depth;
+ 	u8	csi_dt;
+-	u8	check_variants;
++	u32	valid_colorspaces;
++	u8	check_variants:1;
++	u8	mc_skip:1;
++	u8	metadata_fmt:1;
+ };
+ 
+ static const struct unicam_fmt formats[] = {
+@@ -161,173 +190,216 @@ static const struct unicam_fmt formats[]
+ 		.depth		= 16,
+ 		.csi_dt		= 0x1e,
+ 		.check_variants = 1,
++		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
++				     MASK_CS_JPEG,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_UYVY,
+ 		.code		= MEDIA_BUS_FMT_UYVY8_2X8,
+ 		.depth		= 16,
+ 		.csi_dt		= 0x1e,
+ 		.check_variants = 1,
++		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
++				     MASK_CS_JPEG,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_YVYU,
+ 		.code		= MEDIA_BUS_FMT_YVYU8_2X8,
+ 		.depth		= 16,
+ 		.csi_dt		= 0x1e,
+ 		.check_variants = 1,
++		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
++				     MASK_CS_JPEG,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_VYUY,
+ 		.code		= MEDIA_BUS_FMT_VYUY8_2X8,
+ 		.depth		= 16,
+ 		.csi_dt		= 0x1e,
+ 		.check_variants = 1,
++		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
++				     MASK_CS_JPEG,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_YUYV,
+ 		.code		= MEDIA_BUS_FMT_YUYV8_1X16,
+ 		.depth		= 16,
+ 		.csi_dt		= 0x1e,
++		.mc_skip	= 1,
++		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
++				     MASK_CS_JPEG,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_UYVY,
+ 		.code		= MEDIA_BUS_FMT_UYVY8_1X16,
+ 		.depth		= 16,
+ 		.csi_dt		= 0x1e,
++		.mc_skip	= 1,
++		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
++				     MASK_CS_JPEG,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_YVYU,
+ 		.code		= MEDIA_BUS_FMT_YVYU8_1X16,
+ 		.depth		= 16,
+ 		.csi_dt		= 0x1e,
++		.mc_skip	= 1,
++		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
++				     MASK_CS_JPEG,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_VYUY,
+ 		.code		= MEDIA_BUS_FMT_VYUY8_1X16,
+ 		.depth		= 16,
+ 		.csi_dt		= 0x1e,
++		.mc_skip	= 1,
++		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
++				     MASK_CS_JPEG,
+ 	}, {
+ 	/* RGB Formats */
+ 		.fourcc		= V4L2_PIX_FMT_RGB565, /* gggbbbbb rrrrrggg */
+ 		.code		= MEDIA_BUS_FMT_RGB565_2X8_LE,
+ 		.depth		= 16,
+ 		.csi_dt		= 0x22,
++		.valid_colorspaces = MASK_CS_SRGB,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_RGB565X, /* rrrrrggg gggbbbbb */
+ 		.code		= MEDIA_BUS_FMT_RGB565_2X8_BE,
+ 		.depth		= 16,
+-		.csi_dt		= 0x22
++		.csi_dt		= 0x22,
++		.valid_colorspaces = MASK_CS_SRGB,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_RGB555, /* gggbbbbb arrrrrgg */
+ 		.code		= MEDIA_BUS_FMT_RGB555_2X8_PADHI_LE,
+ 		.depth		= 16,
+ 		.csi_dt		= 0x21,
++		.valid_colorspaces = MASK_CS_SRGB,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_RGB555X, /* arrrrrgg gggbbbbb */
+ 		.code		= MEDIA_BUS_FMT_RGB555_2X8_PADHI_BE,
+ 		.depth		= 16,
+ 		.csi_dt		= 0x21,
++		.valid_colorspaces = MASK_CS_SRGB,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_RGB24, /* rgb */
+ 		.code		= MEDIA_BUS_FMT_RGB888_1X24,
+ 		.depth		= 24,
+ 		.csi_dt		= 0x24,
++		.valid_colorspaces = MASK_CS_SRGB,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_BGR24, /* bgr */
+ 		.code		= MEDIA_BUS_FMT_BGR888_1X24,
+ 		.depth		= 24,
+ 		.csi_dt		= 0x24,
++		.valid_colorspaces = MASK_CS_SRGB,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_RGB32, /* argb */
+ 		.code		= MEDIA_BUS_FMT_ARGB8888_1X32,
+ 		.depth		= 32,
+ 		.csi_dt		= 0x0,
++		.valid_colorspaces = MASK_CS_SRGB,
+ 	}, {
+ 	/* Bayer Formats */
+ 		.fourcc		= V4L2_PIX_FMT_SBGGR8,
+ 		.code		= MEDIA_BUS_FMT_SBGGR8_1X8,
+ 		.depth		= 8,
+ 		.csi_dt		= 0x2a,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGBRG8,
+ 		.code		= MEDIA_BUS_FMT_SGBRG8_1X8,
+ 		.depth		= 8,
+ 		.csi_dt		= 0x2a,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGRBG8,
+ 		.code		= MEDIA_BUS_FMT_SGRBG8_1X8,
+ 		.depth		= 8,
+ 		.csi_dt		= 0x2a,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SRGGB8,
+ 		.code		= MEDIA_BUS_FMT_SRGGB8_1X8,
+ 		.depth		= 8,
+ 		.csi_dt		= 0x2a,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SBGGR10P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SBGGR10,
+ 		.code		= MEDIA_BUS_FMT_SBGGR10_1X10,
+ 		.depth		= 10,
+ 		.csi_dt		= 0x2b,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGBRG10P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SGBRG10,
+ 		.code		= MEDIA_BUS_FMT_SGBRG10_1X10,
+ 		.depth		= 10,
+ 		.csi_dt		= 0x2b,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGRBG10P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SGRBG10,
+ 		.code		= MEDIA_BUS_FMT_SGRBG10_1X10,
+ 		.depth		= 10,
+ 		.csi_dt		= 0x2b,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SRGGB10P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SRGGB10,
+ 		.code		= MEDIA_BUS_FMT_SRGGB10_1X10,
+ 		.depth		= 10,
+ 		.csi_dt		= 0x2b,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SBGGR12P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SBGGR12,
+ 		.code		= MEDIA_BUS_FMT_SBGGR12_1X12,
+ 		.depth		= 12,
+ 		.csi_dt		= 0x2c,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGBRG12P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SGBRG12,
+ 		.code		= MEDIA_BUS_FMT_SGBRG12_1X12,
+ 		.depth		= 12,
+ 		.csi_dt		= 0x2c,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGRBG12P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SGRBG12,
+ 		.code		= MEDIA_BUS_FMT_SGRBG12_1X12,
+ 		.depth		= 12,
+ 		.csi_dt		= 0x2c,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SRGGB12P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SRGGB12,
+ 		.code		= MEDIA_BUS_FMT_SRGGB12_1X12,
+ 		.depth		= 12,
+ 		.csi_dt		= 0x2c,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SBGGR14P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SBGGR14,
+ 		.code		= MEDIA_BUS_FMT_SBGGR14_1X14,
+ 		.depth		= 14,
+ 		.csi_dt		= 0x2d,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGBRG14P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SGBRG14,
+ 		.code		= MEDIA_BUS_FMT_SGBRG14_1X14,
+ 		.depth		= 14,
+ 		.csi_dt		= 0x2d,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGRBG14P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SGRBG14,
+ 		.code		= MEDIA_BUS_FMT_SGRBG14_1X14,
+ 		.depth		= 14,
+ 		.csi_dt		= 0x2d,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SRGGB14P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SRGGB14,
+ 		.code		= MEDIA_BUS_FMT_SRGGB14_1X14,
+ 		.depth		= 14,
+ 		.csi_dt		= 0x2d,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 	/*
+ 	 * 16 bit Bayer formats could be supported, but there is no CSI2
+@@ -340,30 +412,35 @@ static const struct unicam_fmt formats[]
+ 		.code		= MEDIA_BUS_FMT_Y8_1X8,
+ 		.depth		= 8,
+ 		.csi_dt		= 0x2a,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_Y10P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_Y10,
+ 		.code		= MEDIA_BUS_FMT_Y10_1X10,
+ 		.depth		= 10,
+ 		.csi_dt		= 0x2b,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_Y12P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_Y12,
+ 		.code		= MEDIA_BUS_FMT_Y12_1X12,
+ 		.depth		= 12,
+ 		.csi_dt		= 0x2c,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_Y14P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_Y14,
+ 		.code		= MEDIA_BUS_FMT_Y14_1X14,
+ 		.depth		= 14,
+ 		.csi_dt		= 0x2d,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	},
+ 	/* Embedded data format */
+ 	{
+ 		.fourcc		= V4L2_META_FMT_SENSOR_DATA,
+ 		.code		= MEDIA_BUS_FMT_SENSOR_DATA,
+ 		.depth		= 8,
++		.metadata_fmt	= 1,
+ 	}
+ };
+ 
+@@ -408,6 +485,7 @@ struct unicam_node {
+ 	struct unicam_device *dev;
+ 	struct media_pad pad;
+ 	unsigned int embedded_lines;
++	struct media_pipeline pipe;
+ 	/*
+ 	 * Dummy buffer intended to be used by unicam
+ 	 * if we have no other queued buffers to swap to.
+@@ -459,6 +537,8 @@ struct unicam_device {
+ 
+ 	struct unicam_node node[MAX_NODES];
+ 	struct v4l2_ctrl_handler ctrl_handler;
++
++	bool mc_api;
+ };
+ 
+ static inline struct unicam_device *
+@@ -908,6 +988,7 @@ static irqreturn_t unicam_isr(int irq, v
+ 	return IRQ_HANDLED;
+ }
+ 
++/* V4L2 Common IOCTLs */
+ static int unicam_querycap(struct file *file, void *priv,
+ 			   struct v4l2_capability *cap)
+ {
+@@ -925,6 +1006,38 @@ static int unicam_querycap(struct file *
+ 	return 0;
+ }
+ 
++static int unicam_log_status(struct file *file, void *fh)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	u32 reg;
++
++	/* status for sub devices */
++	v4l2_device_call_all(&dev->v4l2_dev, 0, core, log_status);
++
++	unicam_info(dev, "-----Receiver status-----\n");
++	unicam_info(dev, "V4L2 width/height:   %ux%u\n",
++		    node->v_fmt.fmt.pix.width, node->v_fmt.fmt.pix.height);
++	unicam_info(dev, "Mediabus format:     %08x\n", node->fmt->code);
++	unicam_info(dev, "V4L2 format:         %08x\n",
++		    node->v_fmt.fmt.pix.pixelformat);
++	reg = reg_read(dev, UNICAM_IPIPE);
++	unicam_info(dev, "Unpacking/packing:   %u / %u\n",
++		    get_field(reg, UNICAM_PUM_MASK),
++		    get_field(reg, UNICAM_PPM_MASK));
++	unicam_info(dev, "----Live data----\n");
++	unicam_info(dev, "Programmed stride:   %4u\n",
++		    reg_read(dev, UNICAM_IBLS));
++	unicam_info(dev, "Detected resolution: %ux%u\n",
++		    reg_read(dev, UNICAM_IHSTA),
++		    reg_read(dev, UNICAM_IVSTA));
++	unicam_info(dev, "Write pointer:       %08x\n",
++		    reg_read(dev, UNICAM_IBWP));
++
++	return 0;
++}
++
++/* V4L2 Video Centric IOCTLs */
+ static int unicam_enum_fmt_vid_cap(struct file *file, void  *priv,
+ 				   struct v4l2_fmtdesc *f)
+ {
+@@ -1269,6 +1382,727 @@ static int unicam_g_fmt_meta_cap(struct
+ 	return 0;
+ }
+ 
++static int unicam_enum_input(struct file *file, void *priv,
++			     struct v4l2_input *inp)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	int ret;
++
++	if (inp->index != 0)
++		return -EINVAL;
++
++	inp->type = V4L2_INPUT_TYPE_CAMERA;
++	if (v4l2_subdev_has_op(dev->sensor, video, s_dv_timings)) {
++		inp->capabilities = V4L2_IN_CAP_DV_TIMINGS;
++		inp->std = 0;
++	} else if (v4l2_subdev_has_op(dev->sensor, video, s_std)) {
++		inp->capabilities = V4L2_IN_CAP_STD;
++		if (v4l2_subdev_call(dev->sensor, video, g_tvnorms, &inp->std) < 0)
++			inp->std = V4L2_STD_ALL;
++	} else {
++		inp->capabilities = 0;
++		inp->std = 0;
++	}
++
++	if (v4l2_subdev_has_op(dev->sensor, video, g_input_status)) {
++		ret = v4l2_subdev_call(dev->sensor, video, g_input_status,
++				       &inp->status);
++		if (ret < 0)
++			return ret;
++	}
++
++	snprintf(inp->name, sizeof(inp->name), "Camera 0");
++	return 0;
++}
++
++static int unicam_g_input(struct file *file, void *priv, unsigned int *i)
++{
++	*i = 0;
++
++	return 0;
++}
++
++static int unicam_s_input(struct file *file, void *priv, unsigned int i)
++{
++	/*
++	 * FIXME: Ideally we would like to be able to query the source
++	 * subdevice for information over the input connectors it supports,
++	 * and map that through in to a call to video_ops->s_routing.
++	 * There is no infrastructure support for defining that within
++	 * devicetree at present. Until that is implemented we can't
++	 * map a user physical connector number to s_routing input number.
++	 */
++	if (i > 0)
++		return -EINVAL;
++
++	return 0;
++}
++
++static int unicam_querystd(struct file *file, void *priv,
++			   v4l2_std_id *std)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, video, querystd, std);
++}
++
++static int unicam_g_std(struct file *file, void *priv, v4l2_std_id *std)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, video, g_std, std);
++}
++
++static int unicam_s_std(struct file *file, void *priv, v4l2_std_id std)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	int ret;
++	v4l2_std_id current_std;
++
++	ret = v4l2_subdev_call(dev->sensor, video, g_std, &current_std);
++	if (ret)
++		return ret;
++
++	if (std == current_std)
++		return 0;
++
++	if (vb2_is_busy(&node->buffer_queue))
++		return -EBUSY;
++
++	ret = v4l2_subdev_call(dev->sensor, video, s_std, std);
++
++	/* Force recomputation of bytesperline */
++	node->v_fmt.fmt.pix.bytesperline = 0;
++
++	unicam_reset_format(node);
++
++	return ret;
++}
++
++static int unicam_s_edid(struct file *file, void *priv, struct v4l2_edid *edid)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, pad, set_edid, edid);
++}
++
++static int unicam_g_edid(struct file *file, void *priv, struct v4l2_edid *edid)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, pad, get_edid, edid);
++}
++
++static int unicam_s_selection(struct file *file, void *priv,
++			      struct v4l2_selection *sel)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	struct v4l2_subdev_selection sdsel = {
++		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++		.target = sel->target,
++		.flags = sel->flags,
++		.r = sel->r,
++	};
++
++	if (sel->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
++		return -EINVAL;
++
++	return v4l2_subdev_call(dev->sensor, pad, set_selection, NULL, &sdsel);
++}
++
++static int unicam_g_selection(struct file *file, void *priv,
++			      struct v4l2_selection *sel)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	struct v4l2_subdev_selection sdsel = {
++		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++		.target = sel->target,
++	};
++	int ret;
++
++	if (sel->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
++		return -EINVAL;
++
++	ret = v4l2_subdev_call(dev->sensor, pad, get_selection, NULL, &sdsel);
++	if (!ret)
++		sel->r = sdsel.r;
++
++	return ret;
++}
++
++static int unicam_enum_framesizes(struct file *file, void *priv,
++				  struct v4l2_frmsizeenum *fsize)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	const struct unicam_fmt *fmt;
++	struct v4l2_subdev_frame_size_enum fse;
++	int ret;
++
++	/* check for valid format */
++	fmt = find_format_by_pix(dev, fsize->pixel_format);
++	if (!fmt) {
++		unicam_dbg(3, dev, "Invalid pixel code: %x\n",
++			   fsize->pixel_format);
++		return -EINVAL;
++	}
++	fse.code = fmt->code;
++
++	fse.which = V4L2_SUBDEV_FORMAT_ACTIVE;
++	fse.index = fsize->index;
++	fse.pad = node->src_pad_id;
++
++	ret = v4l2_subdev_call(dev->sensor, pad, enum_frame_size, NULL, &fse);
++	if (ret)
++		return ret;
++
++	unicam_dbg(1, dev, "%s: index: %d code: %x W:[%d,%d] H:[%d,%d]\n",
++		   __func__, fse.index, fse.code, fse.min_width, fse.max_width,
++		   fse.min_height, fse.max_height);
++
++	fsize->type = V4L2_FRMSIZE_TYPE_DISCRETE;
++	fsize->discrete.width = fse.max_width;
++	fsize->discrete.height = fse.max_height;
++
++	return 0;
++}
++
++static int unicam_enum_frameintervals(struct file *file, void *priv,
++				      struct v4l2_frmivalenum *fival)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	const struct unicam_fmt *fmt;
++	struct v4l2_subdev_frame_interval_enum fie = {
++		.index = fival->index,
++		.pad = node->src_pad_id,
++		.width = fival->width,
++		.height = fival->height,
++		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++	};
++	int ret;
++
++	fmt = find_format_by_pix(dev, fival->pixel_format);
++	if (!fmt)
++		return -EINVAL;
++
++	fie.code = fmt->code;
++	ret = v4l2_subdev_call(dev->sensor, pad, enum_frame_interval,
++			       NULL, &fie);
++	if (ret)
++		return ret;
++
++	fival->type = V4L2_FRMIVAL_TYPE_DISCRETE;
++	fival->discrete = fie.interval;
++
++	return 0;
++}
++
++static int unicam_g_parm(struct file *file, void *fh, struct v4l2_streamparm *a)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_g_parm_cap(video_devdata(file), dev->sensor, a);
++}
++
++static int unicam_s_parm(struct file *file, void *fh, struct v4l2_streamparm *a)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_s_parm_cap(video_devdata(file), dev->sensor, a);
++}
++
++static int unicam_g_dv_timings(struct file *file, void *priv,
++			       struct v4l2_dv_timings *timings)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, video, g_dv_timings, timings);
++}
++
++static int unicam_s_dv_timings(struct file *file, void *priv,
++			       struct v4l2_dv_timings *timings)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	struct v4l2_dv_timings current_timings;
++	int ret;
++
++	ret = v4l2_subdev_call(dev->sensor, video, g_dv_timings,
++			       &current_timings);
++
++	if (ret < 0)
++		return ret;
++
++	if (v4l2_match_dv_timings(timings, &current_timings, 0, false))
++		return 0;
++
++	if (vb2_is_busy(&node->buffer_queue))
++		return -EBUSY;
++
++	ret = v4l2_subdev_call(dev->sensor, video, s_dv_timings, timings);
++
++	/* Force recomputation of bytesperline */
++	node->v_fmt.fmt.pix.bytesperline = 0;
++
++	unicam_reset_format(node);
++
++	return ret;
++}
++
++static int unicam_query_dv_timings(struct file *file, void *priv,
++				   struct v4l2_dv_timings *timings)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, video, query_dv_timings, timings);
++}
++
++static int unicam_enum_dv_timings(struct file *file, void *priv,
++				  struct v4l2_enum_dv_timings *timings)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	int ret;
++
++	timings->pad = node->src_pad_id;
++	ret = v4l2_subdev_call(dev->sensor, pad, enum_dv_timings, timings);
++	timings->pad = node->pad_id;
++
++	return ret;
++}
++
++static int unicam_dv_timings_cap(struct file *file, void *priv,
++				 struct v4l2_dv_timings_cap *cap)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	int ret;
++
++	cap->pad = node->src_pad_id;
++	ret = v4l2_subdev_call(dev->sensor, pad, dv_timings_cap, cap);
++	cap->pad = node->pad_id;
++
++	return ret;
++}
++
++static int unicam_subscribe_event(struct v4l2_fh *fh,
++				  const struct v4l2_event_subscription *sub)
++{
++	switch (sub->type) {
++	case V4L2_EVENT_FRAME_SYNC:
++		return v4l2_event_subscribe(fh, sub, 2, NULL);
++	case V4L2_EVENT_SOURCE_CHANGE:
++		return v4l2_event_subscribe(fh, sub, 4, NULL);
++	}
++
++	return v4l2_ctrl_subscribe_event(fh, sub);
++}
++
++static void unicam_notify(struct v4l2_subdev *sd,
++			  unsigned int notification, void *arg)
++{
++	struct unicam_device *dev = to_unicam_device(sd->v4l2_dev);
++
++	switch (notification) {
++	case V4L2_DEVICE_NOTIFY_EVENT:
++		v4l2_event_queue(&dev->node[IMAGE_PAD].video_dev, arg);
++		break;
++	default:
++		break;
++	}
++}
++
++/* unicam capture ioctl operations */
++static const struct v4l2_ioctl_ops unicam_ioctl_ops = {
++	.vidioc_querycap		= unicam_querycap,
++	.vidioc_enum_fmt_vid_cap	= unicam_enum_fmt_vid_cap,
++	.vidioc_g_fmt_vid_cap		= unicam_g_fmt_vid_cap,
++	.vidioc_s_fmt_vid_cap		= unicam_s_fmt_vid_cap,
++	.vidioc_try_fmt_vid_cap		= unicam_try_fmt_vid_cap,
++
++	.vidioc_enum_fmt_meta_cap	= unicam_enum_fmt_meta_cap,
++	.vidioc_g_fmt_meta_cap		= unicam_g_fmt_meta_cap,
++	.vidioc_s_fmt_meta_cap		= unicam_g_fmt_meta_cap,
++	.vidioc_try_fmt_meta_cap	= unicam_g_fmt_meta_cap,
++
++	.vidioc_enum_input		= unicam_enum_input,
++	.vidioc_g_input			= unicam_g_input,
++	.vidioc_s_input			= unicam_s_input,
++
++	.vidioc_querystd		= unicam_querystd,
++	.vidioc_s_std			= unicam_s_std,
++	.vidioc_g_std			= unicam_g_std,
++
++	.vidioc_g_edid			= unicam_g_edid,
++	.vidioc_s_edid			= unicam_s_edid,
++
++	.vidioc_enum_framesizes		= unicam_enum_framesizes,
++	.vidioc_enum_frameintervals	= unicam_enum_frameintervals,
++
++	.vidioc_g_selection		= unicam_g_selection,
++	.vidioc_s_selection		= unicam_s_selection,
++
++	.vidioc_g_parm			= unicam_g_parm,
++	.vidioc_s_parm			= unicam_s_parm,
++
++	.vidioc_s_dv_timings		= unicam_s_dv_timings,
++	.vidioc_g_dv_timings		= unicam_g_dv_timings,
++	.vidioc_query_dv_timings	= unicam_query_dv_timings,
++	.vidioc_enum_dv_timings		= unicam_enum_dv_timings,
++	.vidioc_dv_timings_cap		= unicam_dv_timings_cap,
++
++	.vidioc_reqbufs			= vb2_ioctl_reqbufs,
++	.vidioc_create_bufs		= vb2_ioctl_create_bufs,
++	.vidioc_prepare_buf		= vb2_ioctl_prepare_buf,
++	.vidioc_querybuf		= vb2_ioctl_querybuf,
++	.vidioc_qbuf			= vb2_ioctl_qbuf,
++	.vidioc_dqbuf			= vb2_ioctl_dqbuf,
++	.vidioc_expbuf			= vb2_ioctl_expbuf,
++	.vidioc_streamon		= vb2_ioctl_streamon,
++	.vidioc_streamoff		= vb2_ioctl_streamoff,
++
++	.vidioc_log_status		= unicam_log_status,
++	.vidioc_subscribe_event		= unicam_subscribe_event,
++	.vidioc_unsubscribe_event	= v4l2_event_unsubscribe,
++};
++
++/* V4L2 Media Controller Centric IOCTLs */
++
++static int unicam_mc_enum_fmt_vid_cap(struct file *file, void  *priv,
++				      struct v4l2_fmtdesc *f)
++{
++	int i, j;
++
++	for (i = 0, j = 0; i < ARRAY_SIZE(formats); i++) {
++		if (f->mbus_code && formats[i].code != f->mbus_code)
++			continue;
++		if (formats[i].mc_skip || formats[i].metadata_fmt)
++			continue;
++
++		if (formats[i].fourcc) {
++			if (j == f->index) {
++				f->pixelformat = formats[i].fourcc;
++				f->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
++				return 0;
++			}
++			j++;
++		}
++		if (formats[i].repacked_fourcc) {
++			if (j == f->index) {
++				f->pixelformat = formats[i].repacked_fourcc;
++				f->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
++				return 0;
++			}
++			j++;
++		}
++	}
++
++	return -EINVAL;
++}
++
++static int unicam_mc_g_fmt_vid_cap(struct file *file, void *priv,
++				   struct v4l2_format *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++
++	if (node->pad_id != IMAGE_PAD)
++		return -EINVAL;
++
++	*f = node->v_fmt;
++
++	return 0;
++}
++
++static void unicam_mc_try_fmt(struct unicam_node *node, struct v4l2_format *f,
++			      const struct unicam_fmt **ret_fmt)
++{
++	struct v4l2_pix_format *v4l2_format = &f->fmt.pix;
++	struct unicam_device *dev = node->dev;
++	const struct unicam_fmt *fmt;
++	int is_rgb;
++
++	/*
++	 * Default to the first format if the requested pixel format code isn't
++	 * supported.
++	 */
++	fmt = find_format_by_pix(dev, v4l2_format->pixelformat);
++	if (!fmt) {
++		fmt = &formats[0];
++		v4l2_format->pixelformat = fmt->fourcc;
++	}
++
++	unicam_calc_format_size_bpl(dev, fmt, f);
++
++	if (v4l2_format->field == V4L2_FIELD_ANY)
++		v4l2_format->field = V4L2_FIELD_NONE;
++
++	if (ret_fmt)
++		*ret_fmt = fmt;
++
++	if (v4l2_format->colorspace >= MAX_COLORSPACE ||
++	    !(fmt->valid_colorspaces & (1 << v4l2_format->colorspace))) {
++		v4l2_format->colorspace = __ffs(fmt->valid_colorspaces);
++
++		v4l2_format->xfer_func =
++			V4L2_MAP_XFER_FUNC_DEFAULT(v4l2_format->colorspace);
++		v4l2_format->ycbcr_enc =
++			V4L2_MAP_YCBCR_ENC_DEFAULT(v4l2_format->colorspace);
++		is_rgb = v4l2_format->colorspace == V4L2_COLORSPACE_SRGB;
++		v4l2_format->quantization =
++			V4L2_MAP_QUANTIZATION_DEFAULT(is_rgb,
++						      v4l2_format->colorspace,
++						      v4l2_format->ycbcr_enc);
++	}
++
++	unicam_dbg(3, dev, "%s: %08x %ux%u (bytesperline %u sizeimage %u)\n",
++		   __func__, v4l2_format->pixelformat,
++		   v4l2_format->width, v4l2_format->height,
++		   v4l2_format->bytesperline, v4l2_format->sizeimage);
++}
++
++static int unicam_mc_try_fmt_vid_cap(struct file *file, void *priv,
++				     struct v4l2_format *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++
++	unicam_mc_try_fmt(node, f, NULL);
++	return 0;
++}
++
++static int unicam_mc_s_fmt_vid_cap(struct file *file, void *priv,
++				   struct v4l2_format *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	const struct unicam_fmt *fmt;
++
++	if (vb2_is_busy(&node->buffer_queue)) {
++		unicam_dbg(3, dev, "%s device busy\n", __func__);
++		return -EBUSY;
++	}
++
++	unicam_mc_try_fmt(node, f, &fmt);
++
++	node->v_fmt = *f;
++	node->fmt = fmt;
++
++	return 0;
++}
++
++static int unicam_mc_enum_framesizes(struct file *file, void *fh,
++				     struct v4l2_frmsizeenum *fsize)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	if (fsize->index > 0)
++		return -EINVAL;
++
++	if (!find_format_by_pix(dev, fsize->pixel_format)) {
++		unicam_dbg(3, dev, "Invalid pixel format 0x%08x\n",
++			   fsize->pixel_format);
++		return -EINVAL;
++	}
++
++	fsize->type = V4L2_FRMSIZE_TYPE_STEPWISE;
++	fsize->stepwise.min_width = MIN_WIDTH;
++	fsize->stepwise.max_width = MAX_WIDTH;
++	fsize->stepwise.step_width = 1;
++	fsize->stepwise.min_height = MIN_HEIGHT;
++	fsize->stepwise.max_height = MAX_HEIGHT;
++	fsize->stepwise.step_height = 1;
++
++	return 0;
++}
++
++static int unicam_mc_enum_fmt_meta_cap(struct file *file, void  *priv,
++				       struct v4l2_fmtdesc *f)
++{
++	int i, j;
++
++	for (i = 0, j = 0; i < ARRAY_SIZE(formats); i++) {
++		if (f->mbus_code && formats[i].code != f->mbus_code)
++			continue;
++		if (!formats[i].metadata_fmt)
++			continue;
++
++		if (formats[i].fourcc) {
++			if (j == f->index) {
++				f->pixelformat = formats[i].fourcc;
++				f->type = V4L2_BUF_TYPE_META_CAPTURE;
++				return 0;
++			}
++			j++;
++		}
++	}
++
++	return -EINVAL;
++}
++
++static int unicam_mc_g_fmt_meta_cap(struct file *file, void *priv,
++				    struct v4l2_format *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++
++	if (node->pad_id != METADATA_PAD)
++		return -EINVAL;
++
++	*f = node->v_fmt;
++
++	return 0;
++}
++
++static int unicam_mc_try_fmt_meta_cap(struct file *file, void *priv,
++				      struct v4l2_format *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++
++	if (node->pad_id != METADATA_PAD)
++		return -EINVAL;
++
++	f->fmt.meta.dataformat = V4L2_META_FMT_SENSOR_DATA;
++
++	return 0;
++}
++
++static int unicam_mc_s_fmt_meta_cap(struct file *file, void *priv,
++				    struct v4l2_format *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++
++	if (node->pad_id != METADATA_PAD)
++		return -EINVAL;
++
++	unicam_mc_try_fmt_meta_cap(file, priv, f);
++
++	node->v_fmt = *f;
++
++	return 0;
++}
++
++static const struct v4l2_ioctl_ops unicam_mc_ioctl_ops = {
++	.vidioc_querycap      = unicam_querycap,
++	.vidioc_enum_fmt_vid_cap  = unicam_mc_enum_fmt_vid_cap,
++	.vidioc_g_fmt_vid_cap     = unicam_mc_g_fmt_vid_cap,
++	.vidioc_try_fmt_vid_cap   = unicam_mc_try_fmt_vid_cap,
++	.vidioc_s_fmt_vid_cap     = unicam_mc_s_fmt_vid_cap,
++
++	.vidioc_enum_fmt_meta_cap	= unicam_mc_enum_fmt_meta_cap,
++	.vidioc_g_fmt_meta_cap		= unicam_mc_g_fmt_meta_cap,
++	.vidioc_try_fmt_meta_cap	= unicam_mc_try_fmt_meta_cap,
++	.vidioc_s_fmt_meta_cap		= unicam_mc_s_fmt_meta_cap,
++
++	.vidioc_enum_framesizes   = unicam_mc_enum_framesizes,
++	.vidioc_reqbufs       = vb2_ioctl_reqbufs,
++	.vidioc_create_bufs   = vb2_ioctl_create_bufs,
++	.vidioc_prepare_buf   = vb2_ioctl_prepare_buf,
++	.vidioc_querybuf      = vb2_ioctl_querybuf,
++	.vidioc_qbuf          = vb2_ioctl_qbuf,
++	.vidioc_dqbuf         = vb2_ioctl_dqbuf,
++	.vidioc_expbuf        = vb2_ioctl_expbuf,
++	.vidioc_streamon      = vb2_ioctl_streamon,
++	.vidioc_streamoff     = vb2_ioctl_streamoff,
++
++	.vidioc_log_status		= unicam_log_status,
++	.vidioc_subscribe_event		= unicam_subscribe_event,
++	.vidioc_unsubscribe_event	= v4l2_event_unsubscribe,
++};
++
++static int
++unicam_mc_subdev_link_validate_get_format(struct media_pad *pad,
++					  struct v4l2_subdev_format *fmt)
++{
++	if (is_media_entity_v4l2_subdev(pad->entity)) {
++		struct v4l2_subdev *sd =
++			media_entity_to_v4l2_subdev(pad->entity);
++
++		fmt->which = V4L2_SUBDEV_FORMAT_ACTIVE;
++		fmt->pad = pad->index;
++		return v4l2_subdev_call(sd, pad, get_fmt, NULL, fmt);
++	}
++
++	return -EINVAL;
++}
++
++static int unicam_mc_video_link_validate(struct media_link *link)
++{
++	struct video_device *vd = container_of(link->sink->entity,
++						struct video_device, entity);
++	struct unicam_node *node = container_of(vd, struct unicam_node,
++						video_dev);
++	struct unicam_device *unicam = node->dev;
++	struct v4l2_subdev_format source_fmt;
++	int ret;
++
++	if (!media_entity_remote_source_pad_unique(link->sink->entity)) {
++		unicam_dbg(1, unicam,
++			   "video node %s pad not connected\n", vd->name);
++		return -ENOTCONN;
++	}
++
++	ret = unicam_mc_subdev_link_validate_get_format(link->source,
++							&source_fmt);
++	if (ret < 0)
++		return 0;
++
++	if (node->pad_id == IMAGE_PAD) {
++		struct v4l2_pix_format *pix_fmt = &node->v_fmt.fmt.pix;
++		const struct unicam_fmt *fmt;
++
++		if (source_fmt.format.width != pix_fmt->width ||
++		    source_fmt.format.height != pix_fmt->height) {
++			unicam_err(unicam,
++				   "Wrong width or height %ux%u (remote pad set to %ux%u)\n",
++				   pix_fmt->width, pix_fmt->height,
++				   source_fmt.format.width,
++				   source_fmt.format.height);
++			return -EINVAL;
++		}
++
++		fmt = find_format_by_code(source_fmt.format.code);
++
++		if (!fmt || (fmt->fourcc != pix_fmt->pixelformat &&
++			     fmt->repacked_fourcc != pix_fmt->pixelformat))
++			return -EINVAL;
++	} else {
++		struct v4l2_meta_format *meta_fmt = &node->v_fmt.fmt.meta;
++
++		if (source_fmt.format.width != meta_fmt->buffersize ||
++		    source_fmt.format.height != 1 ||
++		    source_fmt.format.code != MEDIA_BUS_FMT_SENSOR_DATA) {
++			unicam_err(unicam,
++				   "Wrong metadata width/height/code %ux%u %08x (remote pad set to %ux%u %08x)\n",
++				   meta_fmt->buffersize, 1,
++				   MEDIA_BUS_FMT_SENSOR_DATA,
++				   source_fmt.format.width,
++				   source_fmt.format.height,
++				   source_fmt.format.code);
++			return -EINVAL;
++		}
++	}
++
++	return 0;
++}
++
++static const struct media_entity_operations unicam_mc_entity_ops = {
++	.link_validate = unicam_mc_video_link_validate,
++};
++
++/* videobuf2 Operations */
++
+ static int unicam_queue_setup(struct vb2_queue *vq,
+ 			      unsigned int *nbuffers,
+ 			      unsigned int *nplanes,
+@@ -1495,7 +2329,7 @@ static void unicam_start_rx(struct unica
+ 		/* CSI2 */
+ 		set_field(&val, 1, UNICAM_CLE);
+ 		set_field(&val, 1, UNICAM_CLLPE);
+-		if (dev->bus_flags & V4L2_MBUS_CSI2_CONTINUOUS_CLOCK) {
++		if (!(dev->bus_flags & V4L2_MBUS_CSI2_NONCONTINUOUS_CLOCK)) {
+ 			set_field(&val, 1, UNICAM_CLTRE);
+ 			set_field(&val, 1, UNICAM_CLHSE);
+ 		}
+@@ -1517,7 +2351,7 @@ static void unicam_start_rx(struct unica
+ 		/* CSI2 */
+ 		set_field(&val, 1, UNICAM_DLE);
+ 		set_field(&val, 1, UNICAM_DLLPE);
+-		if (dev->bus_flags & V4L2_MBUS_CSI2_CONTINUOUS_CLOCK) {
++		if (!(dev->bus_flags & V4L2_MBUS_CSI2_NONCONTINUOUS_CLOCK)) {
+ 			set_field(&val, 1, UNICAM_DLTRE);
+ 			set_field(&val, 1, UNICAM_DLHSE);
+ 		}
+@@ -1666,6 +2500,12 @@ static int unicam_start_streaming(struct
+ 		goto err_streaming;
+ 	}
+ 
++	ret = media_pipeline_start(&node->video_dev.entity, &node->pipe);
++	if (ret < 0) {
++		unicam_err(dev, "Failed to start media pipeline: %d\n", ret);
++		goto err_pm_put;
++	}
++
+ 	dev->active_data_lanes = dev->max_data_lanes;
+ 
+ 	if (dev->bus_type == V4L2_MBUS_CSI2_DPHY) {
+@@ -1675,12 +2515,10 @@ static int unicam_start_streaming(struct
+ 				       0, &mbus_config);
+ 		if (ret < 0 && ret != -ENOIOCTLCMD) {
+ 			unicam_dbg(3, dev, "g_mbus_config failed\n");
+-			goto err_pm_put;
++			goto error_pipeline;
+ 		}
+ 
+-		dev->active_data_lanes =
+-			(mbus_config.flags & V4L2_MBUS_CSI2_LANE_MASK) >>
+-					__ffs(V4L2_MBUS_CSI2_LANE_MASK);
++		dev->active_data_lanes = mbus_config.bus.mipi_csi2.num_data_lanes;
+ 		if (!dev->active_data_lanes)
+ 			dev->active_data_lanes = dev->max_data_lanes;
+ 		if (dev->active_data_lanes > dev->max_data_lanes) {
+@@ -1688,7 +2526,7 @@ static int unicam_start_streaming(struct
+ 				   dev->active_data_lanes,
+ 				   dev->max_data_lanes);
+ 			ret = -EINVAL;
+-			goto err_pm_put;
++			goto error_pipeline;
+ 		}
+ 	}
+ 
+@@ -1698,13 +2536,13 @@ static int unicam_start_streaming(struct
+ 	ret = clk_set_min_rate(dev->vpu_clock, MIN_VPU_CLOCK_RATE);
+ 	if (ret) {
+ 		unicam_err(dev, "failed to set up VPU clock\n");
+-		goto err_pm_put;
++		goto error_pipeline;
+ 	}
+ 
+ 	ret = clk_prepare_enable(dev->vpu_clock);
+ 	if (ret) {
+ 		unicam_err(dev, "Failed to enable VPU clock: %d\n", ret);
+-		goto err_pm_put;
++		goto error_pipeline;
+ 	}
+ 
+ 	ret = clk_set_rate(dev->clock, 100 * 1000 * 1000);
+@@ -1755,6 +2593,8 @@ err_vpu_clock:
+ 	if (clk_set_min_rate(dev->vpu_clock, 0))
+ 		unicam_err(dev, "failed to reset the VPU clock\n");
+ 	clk_disable_unprepare(dev->vpu_clock);
++error_pipeline:
++	media_pipeline_stop(&node->video_dev.entity);
+ err_pm_put:
+ 	unicam_runtime_put(dev);
+ err_streaming:
+@@ -1782,6 +2622,8 @@ static void unicam_stop_streaming(struct
+ 
+ 		unicam_disable(dev);
+ 
++		media_pipeline_stop(&node->video_dev.entity);
++
+ 		if (dev->clocks_enabled) {
+ 			if (clk_set_min_rate(dev->vpu_clock, 0))
+ 				unicam_err(dev, "failed to reset the min VPU clock\n");
+@@ -1806,379 +2648,6 @@ static void unicam_stop_streaming(struct
+ 	unicam_return_buffers(node, VB2_BUF_STATE_ERROR);
+ }
+ 
+-static int unicam_enum_input(struct file *file, void *priv,
+-			     struct v4l2_input *inp)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-	int ret;
+-
+-	if (inp->index != 0)
+-		return -EINVAL;
+-
+-	inp->type = V4L2_INPUT_TYPE_CAMERA;
+-	if (v4l2_subdev_has_op(dev->sensor, video, s_dv_timings)) {
+-		inp->capabilities = V4L2_IN_CAP_DV_TIMINGS;
+-		inp->std = 0;
+-	} else if (v4l2_subdev_has_op(dev->sensor, video, s_std)) {
+-		inp->capabilities = V4L2_IN_CAP_STD;
+-		if (v4l2_subdev_call(dev->sensor, video, g_tvnorms, &inp->std) < 0)
+-			inp->std = V4L2_STD_ALL;
+-	} else {
+-		inp->capabilities = 0;
+-		inp->std = 0;
+-	}
+-
+-	if (v4l2_subdev_has_op(dev->sensor, video, g_input_status)) {
+-		ret = v4l2_subdev_call(dev->sensor, video, g_input_status,
+-				       &inp->status);
+-		if (ret < 0)
+-			return ret;
+-	}
+-
+-	snprintf(inp->name, sizeof(inp->name), "Camera 0");
+-	return 0;
+-}
+-
+-static int unicam_g_input(struct file *file, void *priv, unsigned int *i)
+-{
+-	*i = 0;
+-
+-	return 0;
+-}
+-
+-static int unicam_s_input(struct file *file, void *priv, unsigned int i)
+-{
+-	/*
+-	 * FIXME: Ideally we would like to be able to query the source
+-	 * subdevice for information over the input connectors it supports,
+-	 * and map that through in to a call to video_ops->s_routing.
+-	 * There is no infrastructure support for defining that within
+-	 * devicetree at present. Until that is implemented we can't
+-	 * map a user physical connector number to s_routing input number.
+-	 */
+-	if (i > 0)
+-		return -EINVAL;
+-
+-	return 0;
+-}
+-
+-static int unicam_querystd(struct file *file, void *priv,
+-			   v4l2_std_id *std)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-
+-	return v4l2_subdev_call(dev->sensor, video, querystd, std);
+-}
+-
+-static int unicam_g_std(struct file *file, void *priv, v4l2_std_id *std)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-
+-	return v4l2_subdev_call(dev->sensor, video, g_std, std);
+-}
+-
+-static int unicam_s_std(struct file *file, void *priv, v4l2_std_id std)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-	int ret;
+-	v4l2_std_id current_std;
+-
+-	ret = v4l2_subdev_call(dev->sensor, video, g_std, &current_std);
+-	if (ret)
+-		return ret;
+-
+-	if (std == current_std)
+-		return 0;
+-
+-	if (vb2_is_busy(&node->buffer_queue))
+-		return -EBUSY;
+-
+-	ret = v4l2_subdev_call(dev->sensor, video, s_std, std);
+-
+-	/* Force recomputation of bytesperline */
+-	node->v_fmt.fmt.pix.bytesperline = 0;
+-
+-	unicam_reset_format(node);
+-
+-	return ret;
+-}
+-
+-static int unicam_s_edid(struct file *file, void *priv, struct v4l2_edid *edid)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-
+-	return v4l2_subdev_call(dev->sensor, pad, set_edid, edid);
+-}
+-
+-static int unicam_g_edid(struct file *file, void *priv, struct v4l2_edid *edid)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-
+-	return v4l2_subdev_call(dev->sensor, pad, get_edid, edid);
+-}
+-
+-static int unicam_s_selection(struct file *file, void *priv,
+-			      struct v4l2_selection *sel)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-	struct v4l2_subdev_selection sdsel = {
+-		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
+-		.target = sel->target,
+-		.flags = sel->flags,
+-		.r = sel->r,
+-	};
+-
+-	if (sel->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+-		return -EINVAL;
+-
+-	return v4l2_subdev_call(dev->sensor, pad, set_selection, NULL, &sdsel);
+-}
+-
+-static int unicam_g_selection(struct file *file, void *priv,
+-			      struct v4l2_selection *sel)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-	struct v4l2_subdev_selection sdsel = {
+-		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
+-		.target = sel->target,
+-	};
+-	int ret;
+-
+-	if (sel->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+-		return -EINVAL;
+-
+-	ret = v4l2_subdev_call(dev->sensor, pad, get_selection, NULL, &sdsel);
+-	if (!ret)
+-		sel->r = sdsel.r;
+-
+-	return ret;
+-}
+-
+-static int unicam_enum_framesizes(struct file *file, void *priv,
+-				  struct v4l2_frmsizeenum *fsize)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-	const struct unicam_fmt *fmt;
+-	struct v4l2_subdev_frame_size_enum fse;
+-	int ret;
+-
+-	/* check for valid format */
+-	fmt = find_format_by_pix(dev, fsize->pixel_format);
+-	if (!fmt) {
+-		unicam_dbg(3, dev, "Invalid pixel code: %x\n",
+-			   fsize->pixel_format);
+-		return -EINVAL;
+-	}
+-	fse.code = fmt->code;
+-
+-	fse.which = V4L2_SUBDEV_FORMAT_ACTIVE;
+-	fse.index = fsize->index;
+-	fse.pad = node->src_pad_id;
+-
+-	ret = v4l2_subdev_call(dev->sensor, pad, enum_frame_size, NULL, &fse);
+-	if (ret)
+-		return ret;
+-
+-	unicam_dbg(1, dev, "%s: index: %d code: %x W:[%d,%d] H:[%d,%d]\n",
+-		   __func__, fse.index, fse.code, fse.min_width, fse.max_width,
+-		   fse.min_height, fse.max_height);
+-
+-	fsize->type = V4L2_FRMSIZE_TYPE_DISCRETE;
+-	fsize->discrete.width = fse.max_width;
+-	fsize->discrete.height = fse.max_height;
+-
+-	return 0;
+-}
+-
+-static int unicam_enum_frameintervals(struct file *file, void *priv,
+-				      struct v4l2_frmivalenum *fival)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-	const struct unicam_fmt *fmt;
+-	struct v4l2_subdev_frame_interval_enum fie = {
+-		.index = fival->index,
+-		.pad = node->src_pad_id,
+-		.width = fival->width,
+-		.height = fival->height,
+-		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
+-	};
+-	int ret;
+-
+-	fmt = find_format_by_pix(dev, fival->pixel_format);
+-	if (!fmt)
+-		return -EINVAL;
+-
+-	fie.code = fmt->code;
+-	ret = v4l2_subdev_call(dev->sensor, pad, enum_frame_interval,
+-			       NULL, &fie);
+-	if (ret)
+-		return ret;
+-
+-	fival->type = V4L2_FRMIVAL_TYPE_DISCRETE;
+-	fival->discrete = fie.interval;
+-
+-	return 0;
+-}
+-
+-static int unicam_g_parm(struct file *file, void *fh, struct v4l2_streamparm *a)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-
+-	return v4l2_g_parm_cap(video_devdata(file), dev->sensor, a);
+-}
+-
+-static int unicam_s_parm(struct file *file, void *fh, struct v4l2_streamparm *a)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-
+-	return v4l2_s_parm_cap(video_devdata(file), dev->sensor, a);
+-}
+-
+-static int unicam_g_dv_timings(struct file *file, void *priv,
+-			       struct v4l2_dv_timings *timings)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-
+-	return v4l2_subdev_call(dev->sensor, video, g_dv_timings, timings);
+-}
+-
+-static int unicam_s_dv_timings(struct file *file, void *priv,
+-			       struct v4l2_dv_timings *timings)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-	struct v4l2_dv_timings current_timings;
+-	int ret;
+-
+-	ret = v4l2_subdev_call(dev->sensor, video, g_dv_timings,
+-			       &current_timings);
+-
+-	if (ret < 0)
+-		return ret;
+-
+-	if (v4l2_match_dv_timings(timings, &current_timings, 0, false))
+-		return 0;
+-
+-	if (vb2_is_busy(&node->buffer_queue))
+-		return -EBUSY;
+-
+-	ret = v4l2_subdev_call(dev->sensor, video, s_dv_timings, timings);
+-
+-	/* Force recomputation of bytesperline */
+-	node->v_fmt.fmt.pix.bytesperline = 0;
+-
+-	unicam_reset_format(node);
+-
+-	return ret;
+-}
+-
+-static int unicam_query_dv_timings(struct file *file, void *priv,
+-				   struct v4l2_dv_timings *timings)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-
+-	return v4l2_subdev_call(dev->sensor, video, query_dv_timings, timings);
+-}
+-
+-static int unicam_enum_dv_timings(struct file *file, void *priv,
+-				  struct v4l2_enum_dv_timings *timings)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-	int ret;
+-
+-	timings->pad = node->src_pad_id;
+-	ret = v4l2_subdev_call(dev->sensor, pad, enum_dv_timings, timings);
+-	timings->pad = node->pad_id;
+-
+-	return ret;
+-}
+-
+-static int unicam_dv_timings_cap(struct file *file, void *priv,
+-				 struct v4l2_dv_timings_cap *cap)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-	int ret;
+-
+-	cap->pad = node->src_pad_id;
+-	ret = v4l2_subdev_call(dev->sensor, pad, dv_timings_cap, cap);
+-	cap->pad = node->pad_id;
+-
+-	return ret;
+-}
+-
+-static int unicam_subscribe_event(struct v4l2_fh *fh,
+-				  const struct v4l2_event_subscription *sub)
+-{
+-	switch (sub->type) {
+-	case V4L2_EVENT_FRAME_SYNC:
+-		return v4l2_event_subscribe(fh, sub, 2, NULL);
+-	case V4L2_EVENT_SOURCE_CHANGE:
+-		return v4l2_event_subscribe(fh, sub, 4, NULL);
+-	}
+-
+-	return v4l2_ctrl_subscribe_event(fh, sub);
+-}
+-
+-static int unicam_log_status(struct file *file, void *fh)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-	u32 reg;
+-
+-	/* status for sub devices */
+-	v4l2_device_call_all(&dev->v4l2_dev, 0, core, log_status);
+-
+-	unicam_info(dev, "-----Receiver status-----\n");
+-	unicam_info(dev, "V4L2 width/height:   %ux%u\n",
+-		    node->v_fmt.fmt.pix.width, node->v_fmt.fmt.pix.height);
+-	unicam_info(dev, "Mediabus format:     %08x\n", node->fmt->code);
+-	unicam_info(dev, "V4L2 format:         %08x\n",
+-		    node->v_fmt.fmt.pix.pixelformat);
+-	reg = reg_read(dev, UNICAM_IPIPE);
+-	unicam_info(dev, "Unpacking/packing:   %u / %u\n",
+-		    get_field(reg, UNICAM_PUM_MASK),
+-		    get_field(reg, UNICAM_PPM_MASK));
+-	unicam_info(dev, "----Live data----\n");
+-	unicam_info(dev, "Programmed stride:   %4u\n",
+-		    reg_read(dev, UNICAM_IBLS));
+-	unicam_info(dev, "Detected resolution: %ux%u\n",
+-		    reg_read(dev, UNICAM_IHSTA),
+-		    reg_read(dev, UNICAM_IVSTA));
+-	unicam_info(dev, "Write pointer:       %08x\n",
+-		    reg_read(dev, UNICAM_IBWP));
+-
+-	return 0;
+-}
+-
+-static void unicam_notify(struct v4l2_subdev *sd,
+-			  unsigned int notification, void *arg)
+-{
+-	struct unicam_device *dev = to_unicam_device(sd->v4l2_dev);
+-
+-	switch (notification) {
+-	case V4L2_DEVICE_NOTIFY_EVENT:
+-		v4l2_event_queue(&dev->node[IMAGE_PAD].video_dev, arg);
+-		break;
+-	default:
+-		break;
+-	}
+-}
+ 
+ static const struct vb2_ops unicam_video_qops = {
+ 	.wait_prepare		= vb2_ops_wait_prepare,
+@@ -2261,60 +2730,6 @@ static const struct v4l2_file_operations
+ 	.mmap		= vb2_fop_mmap,
+ };
+ 
+-/* unicam capture ioctl operations */
+-static const struct v4l2_ioctl_ops unicam_ioctl_ops = {
+-	.vidioc_querycap		= unicam_querycap,
+-	.vidioc_enum_fmt_vid_cap	= unicam_enum_fmt_vid_cap,
+-	.vidioc_g_fmt_vid_cap		= unicam_g_fmt_vid_cap,
+-	.vidioc_s_fmt_vid_cap		= unicam_s_fmt_vid_cap,
+-	.vidioc_try_fmt_vid_cap		= unicam_try_fmt_vid_cap,
+-
+-	.vidioc_enum_fmt_meta_cap	= unicam_enum_fmt_meta_cap,
+-	.vidioc_g_fmt_meta_cap		= unicam_g_fmt_meta_cap,
+-	.vidioc_s_fmt_meta_cap		= unicam_g_fmt_meta_cap,
+-	.vidioc_try_fmt_meta_cap	= unicam_g_fmt_meta_cap,
+-
+-	.vidioc_enum_input		= unicam_enum_input,
+-	.vidioc_g_input			= unicam_g_input,
+-	.vidioc_s_input			= unicam_s_input,
+-
+-	.vidioc_querystd		= unicam_querystd,
+-	.vidioc_s_std			= unicam_s_std,
+-	.vidioc_g_std			= unicam_g_std,
+-
+-	.vidioc_g_edid			= unicam_g_edid,
+-	.vidioc_s_edid			= unicam_s_edid,
+-
+-	.vidioc_enum_framesizes		= unicam_enum_framesizes,
+-	.vidioc_enum_frameintervals	= unicam_enum_frameintervals,
+-
+-	.vidioc_g_selection		= unicam_g_selection,
+-	.vidioc_s_selection		= unicam_s_selection,
+-
+-	.vidioc_g_parm			= unicam_g_parm,
+-	.vidioc_s_parm			= unicam_s_parm,
+-
+-	.vidioc_s_dv_timings		= unicam_s_dv_timings,
+-	.vidioc_g_dv_timings		= unicam_g_dv_timings,
+-	.vidioc_query_dv_timings	= unicam_query_dv_timings,
+-	.vidioc_enum_dv_timings		= unicam_enum_dv_timings,
+-	.vidioc_dv_timings_cap		= unicam_dv_timings_cap,
+-
+-	.vidioc_reqbufs			= vb2_ioctl_reqbufs,
+-	.vidioc_create_bufs		= vb2_ioctl_create_bufs,
+-	.vidioc_prepare_buf		= vb2_ioctl_prepare_buf,
+-	.vidioc_querybuf		= vb2_ioctl_querybuf,
+-	.vidioc_qbuf			= vb2_ioctl_qbuf,
+-	.vidioc_dqbuf			= vb2_ioctl_dqbuf,
+-	.vidioc_expbuf			= vb2_ioctl_expbuf,
+-	.vidioc_streamon		= vb2_ioctl_streamon,
+-	.vidioc_streamoff		= vb2_ioctl_streamoff,
+-
+-	.vidioc_log_status		= unicam_log_status,
+-	.vidioc_subscribe_event		= unicam_subscribe_event,
+-	.vidioc_unsubscribe_event	= v4l2_event_unsubscribe,
+-};
+-
+ static int
+ unicam_async_bound(struct v4l2_async_notifier *notifier,
+ 		   struct v4l2_subdev *subdev,
+@@ -2365,11 +2780,11 @@ static void unicam_node_release(struct v
+ 	unicam_put(node->dev);
+ }
+ 
+-static int register_node(struct unicam_device *unicam, struct unicam_node *node,
+-			 enum v4l2_buf_type type, int pad_id)
++static int unicam_set_default_format(struct unicam_device *unicam,
++				     struct unicam_node *node,
++				     int pad_id,
++				     const struct unicam_fmt **ret_fmt)
+ {
+-	struct video_device *vdev;
+-	struct vb2_queue *q;
+ 	struct v4l2_mbus_framefmt mbus_fmt = {0};
+ 	const struct unicam_fmt *fmt;
+ 	int ret;
+@@ -2414,15 +2829,69 @@ static int register_node(struct unicam_d
+ 		node->v_fmt.fmt.meta.dataformat = fmt->fourcc;
+ 	}
+ 
++	*ret_fmt = fmt;
++
++	return 0;
++}
++
++static void unicam_mc_set_default_format(struct unicam_node *node, int pad_id)
++{
++	if (pad_id == IMAGE_PAD) {
++		struct v4l2_pix_format *pix_fmt = &node->v_fmt.fmt.pix;
++
++		pix_fmt->width = 640;
++		pix_fmt->height = 480;
++		pix_fmt->field = V4L2_FIELD_NONE;
++		pix_fmt->colorspace = V4L2_COLORSPACE_SRGB;
++		pix_fmt->ycbcr_enc = V4L2_YCBCR_ENC_601;
++		pix_fmt->quantization = V4L2_QUANTIZATION_LIM_RANGE;
++		pix_fmt->xfer_func = V4L2_XFER_FUNC_SRGB;
++		pix_fmt->pixelformat = formats[0].fourcc;
++		unicam_calc_format_size_bpl(node->dev, &formats[0],
++					    &node->v_fmt);
++		node->v_fmt.type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
++
++		node->fmt = &formats[0];
++	} else {
++		const struct unicam_fmt *fmt;
++
++		/* Fix this node format as embedded data. */
++		fmt = find_format_by_code(MEDIA_BUS_FMT_SENSOR_DATA);
++		node->v_fmt.fmt.meta.dataformat = fmt->fourcc;
++		node->fmt = fmt;
++
++		node->v_fmt.fmt.meta.buffersize = UNICAM_EMBEDDED_SIZE;
++		node->embedded_lines = 1;
++		node->v_fmt.type = V4L2_BUF_TYPE_META_CAPTURE;
++	}
++}
++
++static int register_node(struct unicam_device *unicam, struct unicam_node *node,
++			 enum v4l2_buf_type type, int pad_id)
++{
++	struct video_device *vdev;
++	struct vb2_queue *q;
++	int ret;
++
+ 	node->dev = unicam;
+ 	node->pad_id = pad_id;
+-	node->fmt = fmt;
+ 
+-	/* Read current subdev format */
+-	if (fmt)
+-		unicam_reset_format(node);
++	if (!unicam->mc_api) {
++		const struct unicam_fmt *fmt;
+ 
+-	if (v4l2_subdev_has_op(unicam->sensor, video, s_std)) {
++		ret = unicam_set_default_format(unicam, node, pad_id, &fmt);
++		if (ret)
++			return ret;
++		node->fmt = fmt;
++		/* Read current subdev format */
++		if (fmt)
++			unicam_reset_format(node);
++	} else {
++		unicam_mc_set_default_format(node, pad_id);
++	}
++
++	if (!unicam->mc_api &&
++	    v4l2_subdev_has_op(unicam->sensor, video, s_std)) {
+ 		v4l2_std_id tvnorms;
+ 
+ 		if (WARN_ON(!v4l2_subdev_has_op(unicam->sensor, video,
+@@ -2445,12 +2914,15 @@ static int register_node(struct unicam_d
+ 
+ 	vdev = &node->video_dev;
+ 	if (pad_id == IMAGE_PAD) {
+-		/* Add controls from the subdevice */
+-		ret = v4l2_ctrl_add_handler(&unicam->ctrl_handler,
+-					    unicam->sensor->ctrl_handler, NULL,
+-					    true);
+-		if (ret < 0)
+-			return ret;
++		if (!unicam->mc_api) {
++			/* Add controls from the subdevice */
++			ret = v4l2_ctrl_add_handler(&unicam->ctrl_handler,
++						    unicam->sensor->ctrl_handler,
++						    NULL,
++						    true);
++			if (ret < 0)
++				return ret;
++		}
+ 
+ 		/*
+ 		 * If the sensor subdevice has any controls, associate the node
+@@ -2482,7 +2954,8 @@ static int register_node(struct unicam_d
+ 
+ 	vdev->release = unicam_node_release;
+ 	vdev->fops = &unicam_fops;
+-	vdev->ioctl_ops = &unicam_ioctl_ops;
++	vdev->ioctl_ops = unicam->mc_api ? &unicam_mc_ioctl_ops :
++					   &unicam_ioctl_ops;
+ 	vdev->v4l2_dev = &unicam->v4l2_dev;
+ 	vdev->vfl_dir = VFL_DIR_RX;
+ 	vdev->queue = q;
+@@ -2490,6 +2963,10 @@ static int register_node(struct unicam_d
+ 	vdev->device_caps = (pad_id == IMAGE_PAD) ?
+ 				V4L2_CAP_VIDEO_CAPTURE : V4L2_CAP_META_CAPTURE;
+ 	vdev->device_caps |= V4L2_CAP_READWRITE | V4L2_CAP_STREAMING;
++	if (unicam->mc_api) {
++		vdev->device_caps |= V4L2_CAP_IO_MC;
++		vdev->entity.ops = &unicam_mc_entity_ops;
++	}
+ 
+ 	/* Define the device names */
+ 	snprintf(vdev->name, sizeof(vdev->name), "%s-%s", UNICAM_MODULE_NAME,
+@@ -2509,48 +2986,61 @@ static int register_node(struct unicam_d
+ 		unicam_err(unicam, "Unable to allocate dummy buffer.\n");
+ 		return -ENOMEM;
+ 	}
+-
+-	if (pad_id == METADATA_PAD ||
+-	    !v4l2_subdev_has_op(unicam->sensor, video, s_std)) {
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_STD);
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_STD);
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_ENUMSTD);
+-	}
+-	if (pad_id == METADATA_PAD ||
+-	    !v4l2_subdev_has_op(unicam->sensor, video, querystd))
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_QUERYSTD);
+-	if (pad_id == METADATA_PAD ||
+-	    !v4l2_subdev_has_op(unicam->sensor, video, s_dv_timings)) {
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_EDID);
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_EDID);
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_DV_TIMINGS_CAP);
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_DV_TIMINGS);
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_DV_TIMINGS);
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_ENUM_DV_TIMINGS);
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_QUERY_DV_TIMINGS);
+-	}
+-	if (pad_id == METADATA_PAD ||
+-	    !v4l2_subdev_has_op(unicam->sensor, pad, enum_frame_interval))
+-		v4l2_disable_ioctl(&node->video_dev,
+-				   VIDIOC_ENUM_FRAMEINTERVALS);
+-	if (pad_id == METADATA_PAD ||
+-	    !v4l2_subdev_has_op(unicam->sensor, video, g_frame_interval))
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_PARM);
+-	if (pad_id == METADATA_PAD ||
+-	    !v4l2_subdev_has_op(unicam->sensor, video, s_frame_interval))
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_PARM);
+-
+-	if (pad_id == METADATA_PAD ||
+-	    !v4l2_subdev_has_op(unicam->sensor, pad, enum_frame_size))
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_ENUM_FRAMESIZES);
+-
+-	if (node->pad_id == METADATA_PAD ||
+-	    !v4l2_subdev_has_op(unicam->sensor, pad, set_selection))
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_SELECTION);
+-
+-	if (node->pad_id == METADATA_PAD ||
+-	    !v4l2_subdev_has_op(unicam->sensor, pad, get_selection))
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_SELECTION);
++	if (!unicam->mc_api) {
++		if (pad_id == METADATA_PAD ||
++		    !v4l2_subdev_has_op(unicam->sensor, video, s_std)) {
++			v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_STD);
++			v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_STD);
++			v4l2_disable_ioctl(&node->video_dev, VIDIOC_ENUMSTD);
++		}
++		if (pad_id == METADATA_PAD ||
++		    !v4l2_subdev_has_op(unicam->sensor, video, querystd))
++			v4l2_disable_ioctl(&node->video_dev, VIDIOC_QUERYSTD);
++		if (pad_id == METADATA_PAD ||
++		    !v4l2_subdev_has_op(unicam->sensor, video, s_dv_timings)) {
++			v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_EDID);
++			v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_EDID);
++			v4l2_disable_ioctl(&node->video_dev,
++					   VIDIOC_DV_TIMINGS_CAP);
++			v4l2_disable_ioctl(&node->video_dev,
++					   VIDIOC_G_DV_TIMINGS);
++			v4l2_disable_ioctl(&node->video_dev,
++					   VIDIOC_S_DV_TIMINGS);
++			v4l2_disable_ioctl(&node->video_dev,
++					   VIDIOC_ENUM_DV_TIMINGS);
++			v4l2_disable_ioctl(&node->video_dev,
++					   VIDIOC_QUERY_DV_TIMINGS);
++		}
++		if (pad_id == METADATA_PAD ||
++		    !v4l2_subdev_has_op(unicam->sensor, pad,
++					enum_frame_interval))
++			v4l2_disable_ioctl(&node->video_dev,
++					   VIDIOC_ENUM_FRAMEINTERVALS);
++		if (pad_id == METADATA_PAD ||
++		    !v4l2_subdev_has_op(unicam->sensor, video,
++					g_frame_interval))
++			v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_PARM);
++		if (pad_id == METADATA_PAD ||
++		    !v4l2_subdev_has_op(unicam->sensor, video,
++					s_frame_interval))
++			v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_PARM);
++
++		if (pad_id == METADATA_PAD ||
++		    !v4l2_subdev_has_op(unicam->sensor, pad,
++					enum_frame_size))
++			v4l2_disable_ioctl(&node->video_dev,
++					   VIDIOC_ENUM_FRAMESIZES);
++
++		if (node->pad_id == METADATA_PAD ||
++		    !v4l2_subdev_has_op(unicam->sensor, pad, set_selection))
++			v4l2_disable_ioctl(&node->video_dev,
++					   VIDIOC_S_SELECTION);
++
++		if (node->pad_id == METADATA_PAD ||
++		    !v4l2_subdev_has_op(unicam->sensor, pad, get_selection))
++			v4l2_disable_ioctl(&node->video_dev,
++					   VIDIOC_G_SELECTION);
++	}
+ 
+ 	ret = video_register_device(vdev, VFL_TYPE_VIDEO, -1);
+ 	if (ret) {
+@@ -2619,7 +3109,7 @@ static int unicam_async_complete(struct
+ 		if (unicam->sensor->entity.pads[i].flags & MEDIA_PAD_FL_SOURCE) {
+ 			if (source_pads < MAX_NODES) {
+ 				unicam->node[source_pads].src_pad_id = i;
+-				unicam_err(unicam, "source pad %u is index %u\n",
++				unicam_dbg(3, unicam, "source pad %u is index %u\n",
+ 					   source_pads, i);
+ 			}
+ 			source_pads++;
+@@ -2648,7 +3138,10 @@ static int unicam_async_complete(struct
+ 		}
+ 	}
+ 
+-	ret = v4l2_device_register_ro_subdev_nodes(&unicam->v4l2_dev);
++	if (unicam->mc_api)
++		ret = v4l2_device_register_subdev_nodes(&unicam->v4l2_dev);
++	else
++		ret = v4l2_device_register_ro_subdev_nodes(&unicam->v4l2_dev);
+ 	if (ret) {
+ 		unicam_err(unicam, "Unable to register subdev nodes.\n");
+ 		goto unregister;
+@@ -2808,6 +3301,14 @@ static int unicam_probe(struct platform_
+ 	kref_init(&unicam->kref);
+ 	unicam->pdev = pdev;
+ 
++	/*
++	 * Adopt the current setting of the module parameter, and check if
++	 * device tree requests it.
++	 */
++	unicam->mc_api = media_controller;
++	if (of_property_read_bool(pdev->dev.of_node, "brcm,media-controller"))
++		unicam->mc_api = true;
++
+ 	unicam->base = devm_platform_ioremap_resource(pdev, 0);
+ 	if (IS_ERR(unicam->base)) {
+ 		unicam_err(unicam, "Failed to get main io block\n");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0346-staging-bcm2835-camera-Add-support-for-H264_MIN_QP-H.patch b/target/linux/bcm27xx/patches-6.1/950-0346-staging-bcm2835-camera-Add-support-for-H264_MIN_QP-H.patch
new file mode 100644
index 00000000000000..41210c9a7a6298
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0346-staging-bcm2835-camera-Add-support-for-H264_MIN_QP-H.patch
@@ -0,0 +1,54 @@
+From 0a62b2ce6504656b601b077f890215a56fb0dd99 Mon Sep 17 00:00:00 2001
+From: soyer <soyer@irl.hu>
+Date: Sat, 23 Oct 2021 12:23:50 +0200
+Subject: [PATCH] staging/bcm2835-camera: Add support for H264_MIN_QP,
+ H264_MAX_QP
+
+Signed-off-by: Gergo Koteles <soyer@irl.hu>
+---
+ .../bcm2835-camera/bcm2835-camera.h           |  2 +-
+ .../vc04_services/bcm2835-camera/controls.c   | 22 +++++++++++++++++++
+ 2 files changed, 23 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
+@@ -13,7 +13,7 @@
+  * core driver device
+  */
+ 
+-#define V4L2_CTRL_COUNT 29 /* number of v4l controls */
++#define V4L2_CTRL_COUNT 31 /* number of v4l controls */
+ 
+ enum {
+ 	COMP_CAMERA = 0,
+--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
+@@ -1264,6 +1264,28 @@ static const struct bcm2835_mmal_v4l2_ct
+ 		.mmal_id = MMAL_PARAMETER_INTRAPERIOD,
+ 		.setter = ctrl_set_video_encode_param_output,
+ 	},
++	{
++		.id = V4L2_CID_MPEG_VIDEO_H264_MIN_QP,
++		.type = MMAL_CONTROL_TYPE_STD,
++		.min = 0,
++		.max = 51,
++		.def = 0,
++		.step = 1,
++		.imenu = NULL,
++		.mmal_id = MMAL_PARAMETER_VIDEO_ENCODE_MIN_QUANT,
++		.setter = ctrl_set_video_encode_param_output,
++	},
++	{
++		.id = V4L2_CID_MPEG_VIDEO_H264_MAX_QP,
++		.type = MMAL_CONTROL_TYPE_STD,
++		.min = 0,
++		.max = 51,
++		.def = 0,
++		.step = 1,
++		.imenu = NULL,
++		.mmal_id = MMAL_PARAMETER_VIDEO_ENCODE_MAX_QUANT,
++		.setter = ctrl_set_video_encode_param_output,
++	},
+ };
+ 
+ int bcm2835_mmal_set_all_camera_controls(struct bcm2835_mmal_dev *dev)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0347-staging-bcm2835-camera-Add-support-for-MPEG_VIDEO_FO.patch b/target/linux/bcm27xx/patches-6.1/950-0347-staging-bcm2835-camera-Add-support-for-MPEG_VIDEO_FO.patch
new file mode 100644
index 00000000000000..7a1c39c1d065d4
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0347-staging-bcm2835-camera-Add-support-for-MPEG_VIDEO_FO.patch
@@ -0,0 +1,43 @@
+From f8733b8f8d5ffccc7ec0c03311e8494c0aa57ad3 Mon Sep 17 00:00:00 2001
+From: Gergo Koteles <soyer@irl.hu>
+Date: Sun, 24 Oct 2021 23:18:09 +0200
+Subject: [PATCH] staging/bcm2835-camera: Add support for
+ MPEG_VIDEO_FORCE_KEY_FRAME
+
+Signed-off-by: Gergo Koteles <soyer@irl.hu>
+---
+ .../vc04_services/bcm2835-camera/bcm2835-camera.h     |  2 +-
+ .../staging/vc04_services/bcm2835-camera/controls.c   | 11 +++++++++++
+ 2 files changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
+@@ -13,7 +13,7 @@
+  * core driver device
+  */
+ 
+-#define V4L2_CTRL_COUNT 31 /* number of v4l controls */
++#define V4L2_CTRL_COUNT 32 /* number of v4l controls */
+ 
+ enum {
+ 	COMP_CAMERA = 0,
+--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
+@@ -1286,6 +1286,17 @@ static const struct bcm2835_mmal_v4l2_ct
+ 		.mmal_id = MMAL_PARAMETER_VIDEO_ENCODE_MAX_QUANT,
+ 		.setter = ctrl_set_video_encode_param_output,
+ 	},
++	{
++		.id = V4L2_CID_MPEG_VIDEO_FORCE_KEY_FRAME,
++		.type = MMAL_CONTROL_TYPE_STD,
++		.min = 0,
++		.max = 0,
++		.def = 0,
++		.step = 0,
++		.imenu = NULL,
++		.mmal_id = MMAL_PARAMETER_VIDEO_REQUEST_I_FRAME,
++		.setter = ctrl_set_video_encode_param_output,
++	},
+ };
+ 
+ int bcm2835_mmal_set_all_camera_controls(struct bcm2835_mmal_dev *dev)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0348-media-i2c-ov5647-Support-HFLIP-and-VFLIP.patch b/target/linux/bcm27xx/patches-6.1/950-0348-media-i2c-ov5647-Support-HFLIP-and-VFLIP.patch
new file mode 100644
index 00000000000000..36e941773981ea
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0348-media-i2c-ov5647-Support-HFLIP-and-VFLIP.patch
@@ -0,0 +1,189 @@
+From d6ad0d9b5ccc3323cea3c193db0348eff5e3383e Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Mon, 22 Nov 2021 13:10:39 +0000
+Subject: [PATCH] media: i2c: ov5647: Support HFLIP and VFLIP
+
+Add these missing V4L2 controls. Tested binned and full resolution
+modes in all four orientations using Raspberry Pi running libcamera.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ drivers/media/i2c/ov5647.c | 76 +++++++++++++++++++++++++++++++++++---
+ 1 file changed, 70 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -54,6 +54,8 @@
+ #define OV5647_REG_GAIN_LO		0x350b
+ #define OV5647_REG_VTS_HI		0x380e
+ #define OV5647_REG_VTS_LO		0x380f
++#define OV5647_REG_VFLIP		0x3820
++#define OV5647_REG_HFLIP		0x3821
+ #define OV5647_REG_FRAME_OFF_NUMBER	0x4202
+ #define OV5647_REG_MIPI_CTRL00		0x4800
+ #define OV5647_REG_MIPI_CTRL14		0x4814
+@@ -108,6 +110,8 @@ struct ov5647 {
+ 	struct v4l2_ctrl		*hblank;
+ 	struct v4l2_ctrl		*vblank;
+ 	struct v4l2_ctrl		*exposure;
++	struct v4l2_ctrl		*hflip;
++	struct v4l2_ctrl		*vflip;
+ 	bool				streaming;
+ };
+ 
+@@ -136,7 +140,7 @@ static struct regval_list ov5647_2592x19
+ 	{0x3036, 0x69},
+ 	{0x303c, 0x11},
+ 	{0x3106, 0xf5},
+-	{0x3821, 0x06},
++	{0x3821, 0x00},
+ 	{0x3820, 0x00},
+ 	{0x3827, 0xec},
+ 	{0x370c, 0x03},
+@@ -225,7 +229,7 @@ static struct regval_list ov5647_1080p30
+ 	{0x3036, 0x62},
+ 	{0x303c, 0x11},
+ 	{0x3106, 0xf5},
+-	{0x3821, 0x06},
++	{0x3821, 0x00},
+ 	{0x3820, 0x00},
+ 	{0x3827, 0xec},
+ 	{0x370c, 0x03},
+@@ -389,7 +393,7 @@ static struct regval_list ov5647_2x2binn
+ 	{0x4800, 0x24},
+ 	{0x3503, 0x03},
+ 	{0x3820, 0x41},
+-	{0x3821, 0x07},
++	{0x3821, 0x01},
+ 	{0x350a, 0x00},
+ 	{0x350b, 0x10},
+ 	{0x3500, 0x00},
+@@ -405,7 +409,7 @@ static struct regval_list ov5647_640x480
+ 	{0x3035, 0x11},
+ 	{0x3036, 0x46},
+ 	{0x303c, 0x11},
+-	{0x3821, 0x07},
++	{0x3821, 0x01},
+ 	{0x3820, 0x41},
+ 	{0x370c, 0x03},
+ 	{0x3612, 0x59},
+@@ -946,6 +950,25 @@ static const struct v4l2_subdev_video_op
+ 	.s_stream =		ov5647_s_stream,
+ };
+ 
++/* This function returns the mbus code for the current settings of the
++   HFLIP and VFLIP controls. */
++
++static u32 ov5647_get_mbus_code(struct v4l2_subdev *sd)
++{
++	struct ov5647 *sensor = to_sensor(sd);
++	/* The control values are only 0 or 1. */
++	int index =  sensor->hflip->val | (sensor->vflip->val << 1);
++
++	static const u32 codes[4] = {
++		MEDIA_BUS_FMT_SGBRG10_1X10,
++		MEDIA_BUS_FMT_SBGGR10_1X10,
++		MEDIA_BUS_FMT_SRGGB10_1X10,
++		MEDIA_BUS_FMT_SGRBG10_1X10
++	};
++
++	return codes[index];
++}
++
+ static int ov5647_enum_mbus_code(struct v4l2_subdev *sd,
+ 				 struct v4l2_subdev_state *sd_state,
+ 				 struct v4l2_subdev_mbus_code_enum *code)
+@@ -953,7 +976,7 @@ static int ov5647_enum_mbus_code(struct
+ 	if (code->index > 0)
+ 		return -EINVAL;
+ 
+-	code->code = MEDIA_BUS_FMT_SBGGR10_1X10;
++	code->code = ov5647_get_mbus_code(sd);
+ 
+ 	return 0;
+ }
+@@ -964,7 +987,7 @@ static int ov5647_enum_frame_size(struct
+ {
+ 	const struct v4l2_mbus_framefmt *fmt;
+ 
+-	if (fse->code != MEDIA_BUS_FMT_SBGGR10_1X10 ||
++	if (fse->code != ov5647_get_mbus_code(sd) ||
+ 	    fse->index >= ARRAY_SIZE(ov5647_modes))
+ 		return -EINVAL;
+ 
+@@ -997,6 +1020,8 @@ static int ov5647_get_pad_fmt(struct v4l
+ 	}
+ 
+ 	*fmt = *sensor_format;
++	/* The code we pass back must reflect the current h/vflips. */
++	fmt->code = ov5647_get_mbus_code(sd);
+ 	mutex_unlock(&sensor->lock);
+ 
+ 	return 0;
+@@ -1044,6 +1069,8 @@ static int ov5647_set_pad_fmt(struct v4l
+ 					 exposure_def);
+ 	}
+ 	*fmt = mode->format;
++	/* The code we pass back must reflect the current h/vflips. */
++	fmt->code = ov5647_get_mbus_code(sd);
+ 	mutex_unlock(&sensor->lock);
+ 
+ 	return 0;
+@@ -1219,6 +1246,25 @@ static int ov5647_s_exposure(struct v4l2
+ 	return ov5647_write(sd, OV5647_REG_EXP_LO, (val & 0xf) << 4);
+ }
+ 
++static int ov5647_s_flip( struct v4l2_subdev *sd, u16 reg, u32 ctrl_val)
++{
++	int ret;
++	u8 reg_val;
++
++	/* Set or clear bit 1 and leave everything else alone. */
++	ret = ov5647_read(sd, reg, &reg_val);
++	if (ret == 0) {
++		if (ctrl_val)
++			reg_val |= 2;
++		else
++			reg_val &= ~2;
++
++		ret = ov5647_write(sd, reg, reg_val);
++	}
++
++	return ret;
++}
++
+ static int ov5647_s_ctrl(struct v4l2_ctrl *ctrl)
+ {
+ 	struct ov5647 *sensor = container_of(ctrl->handler,
+@@ -1277,6 +1323,14 @@ static int ov5647_s_ctrl(struct v4l2_ctr
+ 		/* Read-only, but we adjust it based on mode. */
+ 		break;
+ 
++	case V4L2_CID_HFLIP:
++		/* There's an in-built hflip in the sensor, so account for that here. */
++		ov5647_s_flip(sd, OV5647_REG_HFLIP, !ctrl->val);
++		break;
++	case V4L2_CID_VFLIP:
++		ov5647_s_flip(sd, OV5647_REG_VFLIP, ctrl->val);
++		break;
++
+ 	default:
+ 		dev_info(&client->dev,
+ 			 "Control (id:0x%x, val:0x%x) not supported\n",
+@@ -1343,6 +1397,16 @@ static int ov5647_init_controls(struct o
+ 					   sensor->mode->vts -
+ 					   sensor->mode->format.height);
+ 
++	sensor->hflip = v4l2_ctrl_new_std(&sensor->ctrls, &ov5647_ctrl_ops,
++					  V4L2_CID_HFLIP, 0, 1, 1, 0);
++	if (sensor->hflip)
++		sensor->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
++	sensor->vflip = v4l2_ctrl_new_std(&sensor->ctrls, &ov5647_ctrl_ops,
++					  V4L2_CID_VFLIP, 0, 1, 1, 0);
++	if (sensor->vflip)
++		sensor->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
+ 	v4l2_fwnode_device_parse(dev, &props);
+ 
+ 	v4l2_ctrl_new_fwnode_properties(&sensor->ctrls, &ov5647_ctrl_ops,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0349-drivers-bcm2835_isp-Allow-multiple-users-for-the-ISP.patch b/target/linux/bcm27xx/patches-6.1/950-0349-drivers-bcm2835_isp-Allow-multiple-users-for-the-ISP.patch
new file mode 100644
index 00000000000000..b2fadfb0ec8fbf
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0349-drivers-bcm2835_isp-Allow-multiple-users-for-the-ISP.patch
@@ -0,0 +1,175 @@
+From e858cd97b4301df3cc6b65f0ef16b4c1db1e1a06 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 16 Nov 2021 12:38:44 +0000
+Subject: [PATCH] drivers: bcm2835_isp: Allow multiple users for the
+ ISP driver.
+
+Add a second (identical) set of device nodes to allow concurrent use of the ISP
+hardware by another user. This change effectively creates a second state
+structure (struct bcm2835_isp_dev) to maintain independent state for the second
+user. Node and media entity names are appened with the instance index
+appropriately.
+
+Further users can be added by changing the BCM2835_ISP_NUM_INSTANCES define.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../bcm2835-isp/bcm2835-v4l2-isp.c            | 76 +++++++++++++++----
+ 1 file changed, 60 insertions(+), 16 deletions(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
+@@ -26,15 +26,21 @@
+ #include "bcm2835-isp-ctrls.h"
+ #include "bcm2835-isp-fmts.h"
+ 
++/*
++ * We want to instantiate 2 independent instances allowing 2 simultaneous users
++ * of the ISP hardware.
++ */
++#define BCM2835_ISP_NUM_INSTANCES 2
++
+ MODULE_IMPORT_NS(DMA_BUF);
+ 
+ static unsigned int debug;
+ module_param(debug, uint, 0644);
+ MODULE_PARM_DESC(debug, "activates debug info");
+ 
+-static unsigned int video_nr = 13;
+-module_param(video_nr, uint, 0644);
+-MODULE_PARM_DESC(video_nr, "base video device number");
++static unsigned int video_nr[BCM2835_ISP_NUM_INSTANCES] = { 13, 20 };
++module_param_array(video_nr, uint, NULL, 0644);
++MODULE_PARM_DESC(video_nr, "base video device numbers");
+ 
+ #define BCM2835_ISP_NAME "bcm2835-isp"
+ #define BCM2835_ISP_ENTITY_NAME_LEN 32
+@@ -1281,6 +1287,7 @@ static int bcm2835_isp_get_supported_fmt
+  * or output nodes.
+  */
+ static int register_node(struct bcm2835_isp_dev *dev,
++			 unsigned int instance,
+ 			 struct bcm2835_isp_node *node,
+ 			 int index)
+ {
+@@ -1441,7 +1448,7 @@ static int register_node(struct bcm2835_
+ 	snprintf(vfd->name, sizeof(node->vfd.name), "%s-%s%d", BCM2835_ISP_NAME,
+ 		 node->name, node->id);
+ 
+-	ret = video_register_device(vfd, VFL_TYPE_VIDEO, video_nr + index);
++	ret = video_register_device(vfd, VFL_TYPE_VIDEO, video_nr[instance]);
+ 	if (ret) {
+ 		v4l2_err(&dev->v4l2_dev,
+ 			 "Failed to register video %s[%d] device node\n",
+@@ -1662,9 +1669,8 @@ done:
+ 	return ret;
+ }
+ 
+-static int bcm2835_isp_remove(struct platform_device *pdev)
++static void bcm2835_isp_remove_instance(struct bcm2835_isp_dev *dev)
+ {
+-	struct bcm2835_isp_dev *dev = platform_get_drvdata(pdev);
+ 	unsigned int i;
+ 
+ 	media_controller_unregister(dev);
+@@ -1679,11 +1685,11 @@ static int bcm2835_isp_remove(struct pla
+ 					      dev->component);
+ 
+ 	vchiq_mmal_finalise(dev->mmal_instance);
+-
+-	return 0;
+ }
+ 
+-static int bcm2835_isp_probe(struct platform_device *pdev)
++static int bcm2835_isp_probe_instance(struct platform_device *pdev,
++				      struct bcm2835_isp_dev **dev_int,
++				      unsigned int instance)
+ {
+ 	struct bcm2835_isp_dev *dev;
+ 	unsigned int i;
+@@ -1693,6 +1699,7 @@ static int bcm2835_isp_probe(struct plat
+ 	if (!dev)
+ 		return -ENOMEM;
+ 
++	*dev_int = dev;
+ 	dev->dev = &pdev->dev;
+ 
+ 	ret = v4l2_device_register(&pdev->dev, &dev->v4l2_dev);
+@@ -1710,7 +1717,7 @@ static int bcm2835_isp_probe(struct plat
+ 	if (ret) {
+ 		v4l2_err(&dev->v4l2_dev,
+ 			 "%s: failed to create ril.isp component\n", __func__);
+-		goto error;
++		return ret;
+ 	}
+ 
+ 	if (dev->component->inputs < BCM2835_ISP_NUM_OUTPUTS ||
+@@ -1722,7 +1729,7 @@ static int bcm2835_isp_probe(struct plat
+ 			  BCM2835_ISP_NUM_OUTPUTS,
+ 			  dev->component->outputs,
+ 			  BCM2835_ISP_NUM_CAPTURES + BCM2835_ISP_NUM_METADATA);
+-		goto error;
++		return -EINVAL;
+ 	}
+ 
+ 	atomic_set(&dev->num_streaming, 0);
+@@ -1730,17 +1737,54 @@ static int bcm2835_isp_probe(struct plat
+ 	for (i = 0; i < BCM2835_ISP_NUM_NODES; i++) {
+ 		struct bcm2835_isp_node *node = &dev->node[i];
+ 
+-		ret = register_node(dev, node, i);
++		ret = register_node(dev, instance, node, i);
+ 		if (ret)
+-			goto error;
++			return ret;
+ 	}
+ 
+ 	ret = media_controller_register(dev);
+ 	if (ret)
+-		goto error;
++		return ret;
++
++	return 0;
++}
++
++static int bcm2835_isp_remove(struct platform_device *pdev)
++{
++	struct bcm2835_isp_dev **bcm2835_isp_instances;
++	unsigned int i;
++
++	bcm2835_isp_instances = platform_get_drvdata(pdev);
++	for (i = 0; i < BCM2835_ISP_NUM_INSTANCES; i++) {
++		if (bcm2835_isp_instances[i])
++			bcm2835_isp_remove_instance(bcm2835_isp_instances[i]);
++	}
++
++	return 0;
++}
++
++static int bcm2835_isp_probe(struct platform_device *pdev)
++{
++	struct bcm2835_isp_dev **bcm2835_isp_instances;
++	unsigned int i;
++	int ret;
++
++	bcm2835_isp_instances = devm_kzalloc(&pdev->dev,
++					     sizeof(bcm2835_isp_instances) *
++						      BCM2835_ISP_NUM_INSTANCES,
++					     GFP_KERNEL);
++	if (!bcm2835_isp_instances)
++		return -ENOMEM;
++
++	for (i = 0; i < BCM2835_ISP_NUM_INSTANCES; i++) {
++		ret = bcm2835_isp_probe_instance(pdev,
++						 &bcm2835_isp_instances[i], i);
++		if (ret)
++			goto error;
++	}
+ 
+-	platform_set_drvdata(pdev, dev);
+-	v4l2_info(&dev->v4l2_dev, "Loaded V4L2 %s\n", BCM2835_ISP_NAME);
++	platform_set_drvdata(pdev, bcm2835_isp_instances);
++	dev_info(&pdev->dev, "Loaded V4L2 %s\n", BCM2835_ISP_NAME);
+ 	return 0;
+ 
+ error:
diff --git a/target/linux/bcm27xx/patches-6.1/950-0350-drivers-bcm2835_isp-Fix-div-by-0-bug.patch b/target/linux/bcm27xx/patches-6.1/950-0350-drivers-bcm2835_isp-Fix-div-by-0-bug.patch
new file mode 100644
index 00000000000000..559b930fe8db46
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0350-drivers-bcm2835_isp-Fix-div-by-0-bug.patch
@@ -0,0 +1,23 @@
+From e5ae35523b1104b5de70935a865076f438f577c8 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Thu, 25 Nov 2021 08:59:58 +0000
+Subject: [PATCH] drivers: bcm2835_isp: Fix div by 0 bug.
+
+Fix a possible division by 0 bug when setting up the mmal port for the stats
+port.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-fmts.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-fmts.h
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-fmts.h
+@@ -544,6 +544,7 @@ static const struct bcm2835_isp_fmt supp
+ 		.step_size	    = 2,
+ 	}, {
+ 		.fourcc		    = V4L2_META_FMT_BCM2835_ISP_STATS,
++		.depth		    = 8,
+ 		.mmal_fmt	    = MMAL_ENCODING_BRCM_STATS,
+ 		/* The rest are not valid fields for stats. */
+ 	}
diff --git a/target/linux/bcm27xx/patches-6.1/950-0351-spi-spidev-Restore-loading-from-Device-Tree.patch b/target/linux/bcm27xx/patches-6.1/950-0351-spi-spidev-Restore-loading-from-Device-Tree.patch
new file mode 100644
index 00000000000000..72bb627cf881f9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0351-spi-spidev-Restore-loading-from-Device-Tree.patch
@@ -0,0 +1,25 @@
+From 03d0602f418f7b2b0fc18c0eb3edc91cf85824a0 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 29 Nov 2021 12:14:49 +0000
+Subject: [PATCH] spi: spidev: Restore loading from Device Tree
+
+As happens occasionally, an upstream change has once again prevented
+spidev from being loaded via Device Tree. We now need "spidev" to be
+included in the new spi_device_id list, otherwise although the
+spidev driver gets loaded no /dev/spidev*.* entries will appear.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/spi/spidev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -687,6 +687,7 @@ static const struct file_operations spid
+ static struct class *spidev_class;
+ 
+ static const struct spi_device_id spidev_spi_ids[] = {
++	{ .name = "spidev" },
+ 	{ .name = "dh2228fv" },
+ 	{ .name = "ltc2488" },
+ 	{ .name = "sx1301" },
diff --git a/target/linux/bcm27xx/patches-6.1/950-0352-input-edt-ft5x06-Handle-unreliable-TOUCH_UP-events.patch b/target/linux/bcm27xx/patches-6.1/950-0352-input-edt-ft5x06-Handle-unreliable-TOUCH_UP-events.patch
new file mode 100644
index 00000000000000..d180f67216d4e8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0352-input-edt-ft5x06-Handle-unreliable-TOUCH_UP-events.patch
@@ -0,0 +1,63 @@
+From ece2b3041c1182b41a17937d1894c58bd0b54364 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 26 Nov 2021 14:37:40 +0000
+Subject: [PATCH] input: edt-ft5x06: Handle unreliable TOUCH_UP events
+
+The ft5x06 is unreliable in sending touch up events, so some
+touch IDs can become stuck in the detected state.
+
+Ensure that IDs that are unreported by the controller are
+released.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/input/touchscreen/edt-ft5x06.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+--- a/drivers/input/touchscreen/edt-ft5x06.c
++++ b/drivers/input/touchscreen/edt-ft5x06.c
+@@ -130,6 +130,7 @@ struct edt_ft5x06_ts_data {
+ 	int offset_y;
+ 	int report_rate;
+ 	int max_support_points;
++	unsigned int known_ids;
+ 
+ 	char name[EDT_NAME_LEN];
+ 	char fw_version[EDT_NAME_LEN];
+@@ -208,6 +209,9 @@ static irqreturn_t edt_ft5x06_ts_isr(int
+ 	int i, type, x, y, id;
+ 	int offset, tplen, datalen, crclen;
+ 	int error;
++	unsigned int active_ids = 0, known_ids = tsdata->known_ids;
++	long released_ids;
++	int b = 0;
+ 
+ 	switch (tsdata->version) {
+ 	case EDT_M06:
+@@ -280,10 +284,25 @@ static irqreturn_t edt_ft5x06_ts_isr(int
+ 
+ 		input_mt_slot(tsdata->input, id);
+ 		if (input_mt_report_slot_state(tsdata->input, MT_TOOL_FINGER,
+-					       type != TOUCH_EVENT_UP))
++					       type != TOUCH_EVENT_UP)) {
+ 			touchscreen_report_pos(tsdata->input, &tsdata->prop,
+ 					       x, y, true);
++			active_ids |= BIT(id);
++		} else {
++			known_ids &= ~BIT(id);
++		}
++	}
++
++	/* One issue with the device is the TOUCH_UP message is not always
++	 * returned. Instead track which ids we know about and report when they
++	 * are no longer updated
++	 */
++	released_ids = known_ids & ~active_ids;
++	for_each_set_bit_from(b, &released_ids, tsdata->max_support_points) {
++		input_mt_slot(tsdata->input, b);
++		input_mt_report_slot_inactive(tsdata->input);
+ 	}
++	tsdata->known_ids = active_ids;
+ 
+ 	input_mt_report_pointer_emulation(tsdata->input, true);
+ 	input_sync(tsdata->input);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0353-drivers-bcm2835_unicam-Add-logging-message-when-a-fr.patch b/target/linux/bcm27xx/patches-6.1/950-0353-drivers-bcm2835_unicam-Add-logging-message-when-a-fr.patch
new file mode 100644
index 00000000000000..6914c13c865b29
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0353-drivers-bcm2835_unicam-Add-logging-message-when-a-fr.patch
@@ -0,0 +1,26 @@
+From 0050fef5616e557182a9cccbc8ff507f7a21d47d Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 30 Nov 2021 10:39:41 +0000
+Subject: [PATCH] drivers: bcm2835_unicam: Add logging message when a
+ frame is dropped.
+
+If a dummy buffer is still active on a frame start, it indicates that this frame
+will be dropped. The explicit logging helps users identify performance issues.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -951,6 +951,9 @@ static irqreturn_t unicam_isr(int irq, v
+ 			if (unicam->node[i].cur_frm)
+ 				unicam->node[i].cur_frm->vb.vb2_buf.timestamp =
+ 								ts;
++			else
++				unicam_dbg(2, unicam, "ISR: [%d] Dropping frame, buffer not available at FS\n",
++					   i);
+ 			/*
+ 			 * Set the next frame output to go to a dummy frame
+ 			 * if we have not managed to obtain another frame
diff --git a/target/linux/bcm27xx/patches-6.1/950-0354-regulator-rpi-panel-attiny-Don-t-read-the-LCD-power-.patch b/target/linux/bcm27xx/patches-6.1/950-0354-regulator-rpi-panel-attiny-Don-t-read-the-LCD-power-.patch
new file mode 100644
index 00000000000000..0196d631790f58
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0354-regulator-rpi-panel-attiny-Don-t-read-the-LCD-power-.patch
@@ -0,0 +1,46 @@
+From 59431ad65437c29a3728f31428363c83e9e4e45c Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 29 Nov 2021 18:31:37 +0000
+Subject: [PATCH] regulator/rpi-panel-attiny: Don't read the LCD power
+ status
+
+The I2C to the Atmel is very fussy, and locks up easily on
+Pi0-3 particularly on reads.
+
+The LCD power status is controlled solely by this driver, so
+rather than reading it back from the Atmel, use the cached
+status last set.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/regulator/rpi-panel-attiny-regulator.c | 18 +-----------------
+ 1 file changed, 1 insertion(+), 17 deletions(-)
+
+--- a/drivers/regulator/rpi-panel-attiny-regulator.c
++++ b/drivers/regulator/rpi-panel-attiny-regulator.c
+@@ -144,24 +144,8 @@ static int attiny_lcd_power_disable(stru
+ static int attiny_lcd_power_is_enabled(struct regulator_dev *rdev)
+ {
+ 	struct attiny_lcd *state = rdev_get_drvdata(rdev);
+-	unsigned int data;
+-	int ret, i;
+ 
+-	mutex_lock(&state->lock);
+-
+-	for (i = 0; i < 10; i++) {
+-		ret = regmap_read(rdev->regmap, REG_PORTC, &data);
+-		if (!ret)
+-			break;
+-		usleep_range(10000, 12000);
+-	}
+-
+-	mutex_unlock(&state->lock);
+-
+-	if (ret < 0)
+-		return ret;
+-
+-	return data & PC_RST_BRIDGE_N;
++	return state->port_states[REG_PORTC - REG_PORTA] & PC_RST_BRIDGE_N;
+ }
+ 
+ static const struct regulator_init_data attiny_regulator_default = {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0355-input-edt-ft5x06-Only-look-at-the-number-of-points-r.patch b/target/linux/bcm27xx/patches-6.1/950-0355-input-edt-ft5x06-Only-look-at-the-number-of-points-r.patch
new file mode 100644
index 00000000000000..c28b2b08b8270c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0355-input-edt-ft5x06-Only-look-at-the-number-of-points-r.patch
@@ -0,0 +1,44 @@
+From 037324a6b9f331943f246fdf39c4ae58a6e8f287 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 30 Nov 2021 17:28:50 +0000
+Subject: [PATCH] input: edt-ft5x06: Only look at the number of points
+ reported
+
+Register 0x02 in the FT5x06 is TD_STATUS containing the number
+of valid touch points being reported.
+
+Iterate over that number of points rather than all that are
+supported on the device.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/input/touchscreen/edt-ft5x06.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/input/touchscreen/edt-ft5x06.c
++++ b/drivers/input/touchscreen/edt-ft5x06.c
+@@ -212,6 +212,7 @@ static irqreturn_t edt_ft5x06_ts_isr(int
+ 	unsigned int active_ids = 0, known_ids = tsdata->known_ids;
+ 	long released_ids;
+ 	int b = 0;
++	unsigned int num_points;
+ 
+ 	switch (tsdata->version) {
+ 	case EDT_M06:
+@@ -260,9 +261,15 @@ static irqreturn_t edt_ft5x06_ts_isr(int
+ 
+ 		if (!edt_ft5x06_ts_check_crc(tsdata, rdbuf, datalen))
+ 			goto out;
++		num_points = tsdata->max_support_points;
++	} else {
++		/* Register 2 is TD_STATUS, containing the number of touch
++		 * points.
++		 */
++		num_points = min(rdbuf[2] & 0xf, tsdata->max_support_points);
+ 	}
+ 
+-	for (i = 0; i < tsdata->max_support_points; i++) {
++	for (i = 0; i < num_points; i++) {
+ 		u8 *buf = &rdbuf[i * tplen + offset];
+ 
+ 		type = buf[0] >> 6;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0356-rtc-pcf8523-Fix-oscillator-stop-bit-handling.patch b/target/linux/bcm27xx/patches-6.1/950-0356-rtc-pcf8523-Fix-oscillator-stop-bit-handling.patch
new file mode 100644
index 00000000000000..ab98d4ea36507c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0356-rtc-pcf8523-Fix-oscillator-stop-bit-handling.patch
@@ -0,0 +1,57 @@
+From d4caec563cc89319516a29a9b3c40ec302925d7a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 29 Oct 2018 14:45:45 +0000
+Subject: [PATCH] rtc: pcf8523: Fix oscillator stop bit handling
+
+See: https://github.com/raspberrypi/firmware/issues/1065
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/rtc/rtc-pcf8523.c | 29 +++++++++++++++++++++++++++--
+ 1 file changed, 27 insertions(+), 2 deletions(-)
+
+--- a/drivers/rtc/rtc-pcf8523.c
++++ b/drivers/rtc/rtc-pcf8523.c
+@@ -100,6 +100,7 @@ static int pcf8523_rtc_read_time(struct
+ {
+ 	struct pcf8523 *pcf8523 = dev_get_drvdata(dev);
+ 	u8 regs[7];
++	u32 value;
+ 	int err;
+ 
+ 	err = regmap_bulk_read(pcf8523->regmap, PCF8523_REG_SECONDS, regs,
+@@ -107,8 +108,32 @@ static int pcf8523_rtc_read_time(struct
+ 	if (err < 0)
+ 		return err;
+ 
+-	if (regs[0] & PCF8523_SECONDS_OS)
+-		return -EINVAL;
++	if (regs[0] & PCF8523_SECONDS_OS) {
++		/*
++		 * If the oscillator was stopped, try to clear the flag. Upon
++		 * power-up the flag is always set, but if we cannot clear it
++		 * the oscillator isn't running properly for some reason. The
++		 * sensible thing therefore is to return an error, signalling
++		 * that the clock cannot be assumed to be correct.
++		 */
++
++		regs[0] &= ~PCF8523_SECONDS_OS;
++
++		err = regmap_write(pcf8523->regmap, PCF8523_REG_SECONDS,
++				   regs[0]);
++		if (err < 0)
++			return err;
++
++		err = regmap_read(pcf8523->regmap, PCF8523_REG_SECONDS,
++				  &value);
++		if (err < 0)
++			return err;
++
++		if (value & PCF8523_SECONDS_OS)
++			return -EAGAIN;
++
++		regs[0] = value;
++	}
+ 
+ 	tm->tm_sec = bcd2bin(regs[0] & 0x7f);
+ 	tm->tm_min = bcd2bin(regs[1] & 0x7f);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0357-drm-panel-simple-Populate-bpc-when-using-panel-dpi.patch b/target/linux/bcm27xx/patches-6.1/950-0357-drm-panel-simple-Populate-bpc-when-using-panel-dpi.patch
new file mode 100644
index 00000000000000..2782caabee6873
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0357-drm-panel-simple-Populate-bpc-when-using-panel-dpi.patch
@@ -0,0 +1,24 @@
+From e1b2f1d5c797e2073e058326f492fad3e61fb403 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 2 Dec 2021 18:10:55 +0000
+Subject: [PATCH] drm/panel-simple: Populate bpc when using panel-dpi
+
+panel-dpi doesn't know the bit depth, so in the same way that
+DPI is guessed for the connector type, guess that it'll be 8bpc.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -499,6 +499,8 @@ static int panel_dpi_probe(struct device
+ 
+ 	/* We do not know the connector for the DT node, so guess it */
+ 	desc->connector_type = DRM_MODE_CONNECTOR_DPI;
++	/* Likewise for the bit depth. */
++	desc->bpc = 8;
+ 
+ 	panel->desc = desc;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0358-drm-panel-simple-Allow-the-bus-format-to-be-read-fro.patch b/target/linux/bcm27xx/patches-6.1/950-0358-drm-panel-simple-Allow-the-bus-format-to-be-read-fro.patch
new file mode 100644
index 00000000000000..d1e9158d77244a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0358-drm-panel-simple-Allow-the-bus-format-to-be-read-fro.patch
@@ -0,0 +1,28 @@
+From 74026738d66fbd32a9e7f27879168f857fba6a3c Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 2 Dec 2021 18:16:21 +0000
+Subject: [PATCH] drm/panel-simple: Allow the bus format to be read
+ from DT for panel-dpi
+
+The "panel-dpi" compatible string configures panel from device tree,
+but it doesn't provide any way of configuring the bus format (colour
+representation), nor does it populate it.
+
+Add a DT parameter "bus-format" that allows the MEDIA_BUS_FMT_xxx value
+to be specified from device tree.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -490,6 +490,7 @@ static int panel_dpi_probe(struct device
+ 
+ 	of_property_read_u32(np, "width-mm", &desc->size.width);
+ 	of_property_read_u32(np, "height-mm", &desc->size.height);
++	of_property_read_u32(np, "bus-format", &desc->bus_format);
+ 
+ 	/* Extract bus_flags from display_timing */
+ 	bus_flags = 0;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0359-xhci-quirks-add-link-TRB-quirk-for-VL805.patch b/target/linux/bcm27xx/patches-6.1/950-0359-xhci-quirks-add-link-TRB-quirk-for-VL805.patch
new file mode 100644
index 00000000000000..10a068df53a88f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0359-xhci-quirks-add-link-TRB-quirk-for-VL805.patch
@@ -0,0 +1,60 @@
+From d0375d97a100054ab79539522b458855a6127e27 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.org>
+Date: Mon, 26 Oct 2020 14:03:35 +0000
+Subject: [PATCH] xhci: quirks: add link TRB quirk for VL805
+
+The VL805 controller can't cope with the TR Dequeue Pointer for an endpoint
+being set to a Link TRB. The hardware-maintained endpoint context ends up
+stuck at the address of the Link TRB, leading to erroneous ring expansion
+events whenever the enqueue pointer wraps to the dequeue position.
+
+If the search for the end of the current TD and ring cycle state lands on
+a Link TRB, move to the next segment.
+
+See: https://github.com/raspberrypi/linux/issues/3919
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci-pci.c  | 1 +
+ drivers/usb/host/xhci-ring.c | 9 +++++++++
+ drivers/usb/host/xhci.h      | 1 +
+ 3 files changed, 11 insertions(+)
+
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -296,6 +296,7 @@ static void xhci_pci_quirks(struct devic
+ 	if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == 0x3483) {
+ 		xhci->quirks |= XHCI_LPM_SUPPORT;
+ 		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
++		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
+ 	}
+ 
+ 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -687,6 +687,15 @@ static int xhci_move_dequeue_past_td(str
+ 	} while (!cycle_found || !td_last_trb_found);
+ 
+ deq_found:
++	/*
++	 * Quirk: the xHC does not correctly parse link TRBs if the HW Dequeue
++	 * pointer is set to one. Advance to the next TRB (and next segment).
++	 */
++	if (xhci->quirks & XHCI_AVOID_DQ_ON_LINK && trb_is_link(new_deq)) {
++		if (link_trb_toggles_cycle(new_deq))
++			new_cycle ^= 0x1;
++		next_trb(xhci, ep_ring, &new_seg, &new_deq);
++	}
+ 
+ 	/* Don't update the ring cycle state for the producer (us). */
+ 	addr = xhci_trb_virt_to_dma(new_seg, new_deq);
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1899,6 +1899,7 @@ struct xhci_hcd {
+ #define XHCI_EP_CTX_BROKEN_DCS	BIT_ULL(42)
+ #define XHCI_SUSPEND_RESUME_CLKS	BIT_ULL(43)
+ #define XHCI_RESET_TO_DEFAULT	BIT_ULL(44)
++#define XHCI_AVOID_DQ_ON_LINK	BIT_ULL(45)
+ 
+ 	unsigned int		num_active_eps;
+ 	unsigned int		limit_active_eps;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0360-xhci-correct-room_on_ring-for-cases-where-there-is-a.patch b/target/linux/bcm27xx/patches-6.1/950-0360-xhci-correct-room_on_ring-for-cases-where-there-is-a.patch
new file mode 100644
index 00000000000000..6d9b38621a2f1d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0360-xhci-correct-room_on_ring-for-cases-where-there-is-a.patch
@@ -0,0 +1,29 @@
+From c45817219ac5a438c2480219460bc73a264585ba Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Fri, 3 Dec 2021 14:32:05 +0000
+Subject: [PATCH] xhci: correct room_on_ring() for cases where there is
+ a single segment
+
+Don't calculate space based on the number of TRBs in the current segment,
+as it's OK to wrap to the start (and flip the cycle state bit).
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci-ring.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -309,6 +309,12 @@ static inline int room_on_ring(struct xh
+ 		return 0;
+ 
+ 	if (ring->type != TYPE_COMMAND && ring->type != TYPE_EVENT) {
++		/*
++		 * If the ring has a single segment the dequeue segment
++		 * never changes, so don't use it as measure of free space.
++		 */
++		if (ring->num_segs == 1)
++			return ring->num_trbs_free >= num_trbs;
+ 		num_trbs_in_deq_seg = ring->dequeue - ring->deq_seg->trbs;
+ 		if (ring->num_trbs_free < num_trbs + num_trbs_in_deq_seg)
+ 			return 0;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0361-xhci-refactor-out-TRBS_PER_SEGMENT-define-in-runtime.patch b/target/linux/bcm27xx/patches-6.1/950-0361-xhci-refactor-out-TRBS_PER_SEGMENT-define-in-runtime.patch
new file mode 100644
index 00000000000000..8b78e640616272
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0361-xhci-refactor-out-TRBS_PER_SEGMENT-define-in-runtime.patch
@@ -0,0 +1,257 @@
+From 11527dad9862ba7e53654943fdacc3ffdad00ae2 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Mon, 13 Dec 2021 15:05:56 +0000
+Subject: [PATCH] xhci: refactor out TRBS_PER_SEGMENT define in runtime
+ code
+
+In anticipation of adjusting the number of utilised TRBs in a ring
+segment, add trbs_per_seg to struct xhci_ring and use this instead
+of a compile-time define.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci-mem.c  | 48 +++++++++++++++++++-----------------
+ drivers/usb/host/xhci-ring.c | 20 +++++++++------
+ drivers/usb/host/xhci.c      |  6 ++---
+ drivers/usb/host/xhci.h      |  1 +
+ 4 files changed, 42 insertions(+), 33 deletions(-)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -98,6 +98,7 @@ static void xhci_free_segments_for_ring(
+  */
+ static void xhci_link_segments(struct xhci_segment *prev,
+ 			       struct xhci_segment *next,
++			       unsigned int trbs_per_seg,
+ 			       enum xhci_ring_type type, bool chain_links)
+ {
+ 	u32 val;
+@@ -106,16 +107,16 @@ static void xhci_link_segments(struct xh
+ 		return;
+ 	prev->next = next;
+ 	if (type != TYPE_EVENT) {
+-		prev->trbs[TRBS_PER_SEGMENT-1].link.segment_ptr =
++		prev->trbs[trbs_per_seg - 1].link.segment_ptr =
+ 			cpu_to_le64(next->dma);
+ 
+ 		/* Set the last TRB in the segment to have a TRB type ID of Link TRB */
+-		val = le32_to_cpu(prev->trbs[TRBS_PER_SEGMENT-1].link.control);
++		val = le32_to_cpu(prev->trbs[trbs_per_seg - 1].link.control);
+ 		val &= ~TRB_TYPE_BITMASK;
+ 		val |= TRB_TYPE(TRB_LINK);
+ 		if (chain_links)
+ 			val |= TRB_CHAIN;
+-		prev->trbs[TRBS_PER_SEGMENT-1].link.control = cpu_to_le32(val);
++		prev->trbs[trbs_per_seg - 1].link.control = cpu_to_le32(val);
+ 	}
+ }
+ 
+@@ -139,15 +140,17 @@ static void xhci_link_rings(struct xhci_
+ 			  (xhci->quirks & XHCI_AMD_0x96_HOST)));
+ 
+ 	next = ring->enq_seg->next;
+-	xhci_link_segments(ring->enq_seg, first, ring->type, chain_links);
+-	xhci_link_segments(last, next, ring->type, chain_links);
++	xhci_link_segments(ring->enq_seg, first, ring->trbs_per_seg,
++			   ring->type, chain_links);
++	xhci_link_segments(last, next, ring->trbs_per_seg,
++			   ring->type, chain_links);
+ 	ring->num_segs += num_segs;
+-	ring->num_trbs_free += (TRBS_PER_SEGMENT - 1) * num_segs;
++	ring->num_trbs_free += (ring->trbs_per_seg - 1) * num_segs;
+ 
+ 	if (ring->type != TYPE_EVENT && ring->enq_seg == ring->last_seg) {
+-		ring->last_seg->trbs[TRBS_PER_SEGMENT-1].link.control
++		ring->last_seg->trbs[ring->trbs_per_seg - 1].link.control
+ 			&= ~cpu_to_le32(LINK_TOGGLE);
+-		last->trbs[TRBS_PER_SEGMENT-1].link.control
++		last->trbs[ring->trbs_per_seg - 1].link.control
+ 			|= cpu_to_le32(LINK_TOGGLE);
+ 		ring->last_seg = last;
+ 	}
+@@ -314,14 +317,15 @@ void xhci_initialize_ring_info(struct xh
+ 	 * Each segment has a link TRB, and leave an extra TRB for SW
+ 	 * accounting purpose
+ 	 */
+-	ring->num_trbs_free = ring->num_segs * (TRBS_PER_SEGMENT - 1) - 1;
++	ring->num_trbs_free = ring->num_segs * (ring->trbs_per_seg - 1) - 1;
+ }
+ 
+ /* Allocate segments and link them for a ring */
+ static int xhci_alloc_segments_for_ring(struct xhci_hcd *xhci,
+ 		struct xhci_segment **first, struct xhci_segment **last,
+-		unsigned int num_segs, unsigned int cycle_state,
+-		enum xhci_ring_type type, unsigned int max_packet, gfp_t flags)
++		unsigned int num_segs, unsigned int trbs_per_seg,
++		unsigned int cycle_state, enum xhci_ring_type type,
++		unsigned int max_packet, gfp_t flags)
+ {
+ 	struct xhci_segment *prev;
+ 	bool chain_links;
+@@ -350,12 +354,12 @@ static int xhci_alloc_segments_for_ring(
+ 			}
+ 			return -ENOMEM;
+ 		}
+-		xhci_link_segments(prev, next, type, chain_links);
++		xhci_link_segments(prev, next, trbs_per_seg, type, chain_links);
+ 
+ 		prev = next;
+ 		num_segs--;
+ 	}
+-	xhci_link_segments(prev, *first, type, chain_links);
++	xhci_link_segments(prev, *first, trbs_per_seg, type, chain_links);
+ 	*last = prev;
+ 
+ 	return 0;
+@@ -387,16 +391,17 @@ struct xhci_ring *xhci_ring_alloc(struct
+ 	if (num_segs == 0)
+ 		return ring;
+ 
++	ring->trbs_per_seg = TRBS_PER_SEGMENT;
+ 	ret = xhci_alloc_segments_for_ring(xhci, &ring->first_seg,
+-			&ring->last_seg, num_segs, cycle_state, type,
+-			max_packet, flags);
++			&ring->last_seg, num_segs, ring->trbs_per_seg,
++			cycle_state, type, max_packet, flags);
+ 	if (ret)
+ 		goto fail;
+ 
+ 	/* Only event ring does not use link TRB */
+ 	if (type != TYPE_EVENT) {
+ 		/* See section 4.9.2.1 and 6.4.4.1 */
+-		ring->last_seg->trbs[TRBS_PER_SEGMENT - 1].link.control |=
++		ring->last_seg->trbs[ring->trbs_per_seg - 1].link.control |=
+ 			cpu_to_le32(LINK_TOGGLE);
+ 	}
+ 	xhci_initialize_ring_info(ring, cycle_state);
+@@ -429,15 +434,14 @@ int xhci_ring_expansion(struct xhci_hcd
+ 	unsigned int		num_segs_needed;
+ 	int			ret;
+ 
+-	num_segs_needed = (num_trbs + (TRBS_PER_SEGMENT - 1) - 1) /
+-				(TRBS_PER_SEGMENT - 1);
+-
++	num_segs_needed = (num_trbs + (ring->trbs_per_seg - 1) - 1) /
++				(ring->trbs_per_seg - 1);
+ 	/* Allocate number of segments we needed, or double the ring size */
+ 	num_segs = max(ring->num_segs, num_segs_needed);
+ 
+ 	ret = xhci_alloc_segments_for_ring(xhci, &first, &last,
+-			num_segs, ring->cycle_state, ring->type,
+-			ring->bounce_buf_len, flags);
++			num_segs, ring->trbs_per_seg, ring->cycle_state,
++			ring->type, ring->bounce_buf_len, flags);
+ 	if (ret)
+ 		return -ENOMEM;
+ 
+@@ -1811,7 +1815,7 @@ int xhci_alloc_erst(struct xhci_hcd *xhc
+ 	for (val = 0; val < evt_ring->num_segs; val++) {
+ 		entry = &erst->entries[val];
+ 		entry->seg_addr = cpu_to_le64(seg->dma);
+-		entry->seg_size = cpu_to_le32(TRBS_PER_SEGMENT);
++		entry->seg_size = cpu_to_le32(evt_ring->trbs_per_seg);
+ 		entry->rsvd = 0;
+ 		seg = seg->next;
+ 	}
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -90,15 +90,16 @@ static bool trb_is_link(union xhci_trb *
+ 	return TRB_TYPE_LINK_LE32(trb->link.control);
+ }
+ 
+-static bool last_trb_on_seg(struct xhci_segment *seg, union xhci_trb *trb)
++static bool last_trb_on_seg(struct xhci_segment *seg,
++			    unsigned int trbs_per_seg, union xhci_trb *trb)
+ {
+-	return trb == &seg->trbs[TRBS_PER_SEGMENT - 1];
++	return trb == &seg->trbs[trbs_per_seg - 1];
+ }
+ 
+ static bool last_trb_on_ring(struct xhci_ring *ring,
+ 			struct xhci_segment *seg, union xhci_trb *trb)
+ {
+-	return last_trb_on_seg(seg, trb) && (seg->next == ring->first_seg);
++	return last_trb_on_seg(seg, ring->trbs_per_seg, trb) && (seg->next == ring->first_seg);
+ }
+ 
+ static bool link_trb_toggles_cycle(union xhci_trb *trb)
+@@ -161,7 +162,8 @@ void inc_deq(struct xhci_hcd *xhci, stru
+ 
+ 	/* event ring doesn't have link trbs, check for last trb */
+ 	if (ring->type == TYPE_EVENT) {
+-		if (!last_trb_on_seg(ring->deq_seg, ring->dequeue)) {
++		if (!last_trb_on_seg(ring->deq_seg, ring->trbs_per_seg,
++				     ring->dequeue)) {
+ 			ring->dequeue++;
+ 			goto out;
+ 		}
+@@ -174,7 +176,8 @@ void inc_deq(struct xhci_hcd *xhci, stru
+ 
+ 	/* All other rings have link trbs */
+ 	if (!trb_is_link(ring->dequeue)) {
+-		if (last_trb_on_seg(ring->deq_seg, ring->dequeue)) {
++		if (last_trb_on_seg(ring->deq_seg, ring->trbs_per_seg,
++		    ring->dequeue)) {
+ 			xhci_warn(xhci, "Missing link TRB at end of segment\n");
+ 		} else {
+ 			ring->dequeue++;
+@@ -225,7 +228,7 @@ static void inc_enq(struct xhci_hcd *xhc
+ 	if (!trb_is_link(ring->enqueue))
+ 		ring->num_trbs_free--;
+ 
+-	if (last_trb_on_seg(ring->enq_seg, ring->enqueue)) {
++	if (last_trb_on_seg(ring->enq_seg, ring->trbs_per_seg, ring->enqueue)) {
+ 		xhci_err(xhci, "Tried to move enqueue past ring segment\n");
+ 		return;
+ 	}
+@@ -3123,7 +3126,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd
+ 	 * that clears the EHB.
+ 	 */
+ 	while (xhci_handle_event(xhci) > 0) {
+-		if (event_loop++ < TRBS_PER_SEGMENT / 2)
++		if (event_loop++ < xhci->event_ring->trbs_per_seg / 2)
+ 			continue;
+ 		xhci_update_erst_dequeue(xhci, event_ring_deq);
+ 		event_ring_deq = xhci->event_ring->dequeue;
+@@ -3265,7 +3268,8 @@ static int prepare_ring(struct xhci_hcd
+ 		}
+ 	}
+ 
+-	if (last_trb_on_seg(ep_ring->enq_seg, ep_ring->enqueue)) {
++	if (last_trb_on_seg(ep_ring->enq_seg, ep_ring->trbs_per_seg,
++	    ep_ring->enqueue)) {
+ 		xhci_warn(xhci, "Missing link TRB at end of ring segment\n");
+ 		return -EINVAL;
+ 	}
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -895,8 +895,8 @@ static void xhci_clear_command_ring(stru
+ 	seg = ring->deq_seg;
+ 	do {
+ 		memset(seg->trbs, 0,
+-			sizeof(union xhci_trb) * (TRBS_PER_SEGMENT - 1));
+-		seg->trbs[TRBS_PER_SEGMENT - 1].link.control &=
++			sizeof(union xhci_trb) * (ring->trbs_per_seg - 1));
++		seg->trbs[ring->trbs_per_seg - 1].link.control &=
+ 			cpu_to_le32(~TRB_CYCLE);
+ 		seg = seg->next;
+ 	} while (seg != ring->deq_seg);
+@@ -907,7 +907,7 @@ static void xhci_clear_command_ring(stru
+ 	ring->enq_seg = ring->deq_seg;
+ 	ring->enqueue = ring->dequeue;
+ 
+-	ring->num_trbs_free = ring->num_segs * (TRBS_PER_SEGMENT - 1) - 1;
++	ring->num_trbs_free = ring->num_segs * (ring->trbs_per_seg - 1) - 1;
+ 	/*
+ 	 * Ring is now zeroed, so the HW should look for change of ownership
+ 	 * when the cycle bit is set to 1.
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1633,6 +1633,7 @@ struct xhci_ring {
+ 	unsigned int		num_trbs_free;
+ 	unsigned int		num_trbs_free_temp;
+ 	unsigned int		bounce_buf_len;
++	unsigned int		trbs_per_seg;
+ 	enum xhci_ring_type	type;
+ 	bool			last_td_was_short;
+ 	struct radix_tree_root	*trb_address_map;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0362-usb-xhci-add-VLI_TRB_CACHE_BUG-quirk.patch b/target/linux/bcm27xx/patches-6.1/950-0362-usb-xhci-add-VLI_TRB_CACHE_BUG-quirk.patch
new file mode 100644
index 00000000000000..22dc08ff98d344
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0362-usb-xhci-add-VLI_TRB_CACHE_BUG-quirk.patch
@@ -0,0 +1,73 @@
+From 02b78815e793d3f778b3f9b199f17cdd7f7e074d Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Mon, 13 Dec 2021 16:04:03 +0000
+Subject: [PATCH] usb: xhci: add VLI_TRB_CACHE_BUG quirk
+
+The VL805 fetches up to 4 transfer TRBs at a time. TRB reads don't cross
+a 64B boundary, and if a TRB is fetched and is not on a 64B boundary,
+the read is sized up to the next 64B boundary.
+
+However the VL805 implements a readahead prefetch for TRBs on a transfer
+ring. This fetches the next 64B after any TRB read has happened. Near
+the end of a ring segment, the prefetcher can read the first 64B of the
+next page in physical memory and this is where the behaviour causes a
+bug.
+
+The controller does not tag reads with which endpoint they are for, so
+if the start of the next page is a ring segment used by a victim
+endpoint, and the victim endpoint is about to fetch TRBs from the start
+of the segment, the victim endpoint will read from the prefetched data
+and not perform a read to main memory. If the data is stale, the ring
+cycle state bit may not be correct and the endpoint will silently halt.
+
+Adjust trbs_per_seg for transfer rings allocated for this controller.
+
+See https://github.com/raspberrypi/linux/issues/4685
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci-mem.c | 11 +++++++++++
+ drivers/usb/host/xhci-pci.c |  1 +
+ drivers/usb/host/xhci.h     |  1 +
+ 3 files changed, 13 insertions(+)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -392,6 +392,17 @@ struct xhci_ring *xhci_ring_alloc(struct
+ 		return ring;
+ 
+ 	ring->trbs_per_seg = TRBS_PER_SEGMENT;
++	/*
++	 * The Via VL805 has a bug where cache readahead will fetch off the end
++	 * of a page if the Link TRB of a transfer ring is in the last 4 slots.
++	 * Where there are consecutive physical pages containing ring segments,
++	 * this can cause a desync between the controller's view of a ring
++	 * and the host.
++	 */
++	if (xhci->quirks & XHCI_VLI_TRB_CACHE_BUG &&
++	    type != TYPE_EVENT && type != TYPE_COMMAND)
++		ring->trbs_per_seg -= 4;
++
+ 	ret = xhci_alloc_segments_for_ring(xhci, &ring->first_seg,
+ 			&ring->last_seg, num_segs, ring->trbs_per_seg,
+ 			cycle_state, type, max_packet, flags);
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -297,6 +297,7 @@ static void xhci_pci_quirks(struct devic
+ 		xhci->quirks |= XHCI_LPM_SUPPORT;
+ 		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
+ 		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
++		xhci->quirks |= XHCI_VLI_TRB_CACHE_BUG;
+ 	}
+ 
+ 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1901,6 +1901,7 @@ struct xhci_hcd {
+ #define XHCI_SUSPEND_RESUME_CLKS	BIT_ULL(43)
+ #define XHCI_RESET_TO_DEFAULT	BIT_ULL(44)
+ #define XHCI_AVOID_DQ_ON_LINK	BIT_ULL(45)
++#define XHCI_VLI_TRB_CACHE_BUG	BIT_ULL(46)
+ 
+ 	unsigned int		num_active_eps;
+ 	unsigned int		limit_active_eps;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0363-media-i2c-ov5647-Add-support-for-regulator-control.patch b/target/linux/bcm27xx/patches-6.1/950-0363-media-i2c-ov5647-Add-support-for-regulator-control.patch
new file mode 100644
index 00000000000000..c65e63970ed269
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0363-media-i2c-ov5647-Add-support-for-regulator-control.patch
@@ -0,0 +1,111 @@
+From 0f2ea90b02dff030db20b3725a4b3148c51892d8 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 22 Nov 2021 12:31:35 +0000
+Subject: [PATCH] media: i2c: ov5647: Add support for regulator
+ control.
+
+The driver supported using GPIOs to control the shutdown line,
+but no regulator control.
+
+Add regulator hooks.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov5647.c | 37 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -20,6 +20,7 @@
+ #include <linux/module.h>
+ #include <linux/of_graph.h>
+ #include <linux/pm_runtime.h>
++#include <linux/regulator/consumer.h>
+ #include <linux/slab.h>
+ #include <linux/videodev2.h>
+ #include <media/v4l2-ctrls.h>
+@@ -82,6 +83,15 @@
+ #define OV5647_EXPOSURE_DEFAULT		1000
+ #define OV5647_EXPOSURE_MAX		65535
+ 
++/* regulator supplies */
++static const char * const ov5647_supply_names[] = {
++	"avdd",		/* Analog power */
++	"dovdd",	/* Digital I/O power */
++	"dvdd",		/* Digital core power */
++};
++
++#define OV5647_NUM_SUPPLIES ARRAY_SIZE(ov5647_supply_names)
++
+ struct regval_list {
+ 	u16 addr;
+ 	u8 data;
+@@ -103,6 +113,7 @@ struct ov5647 {
+ 	struct mutex			lock;
+ 	struct clk			*xclk;
+ 	struct gpio_desc		*pwdn;
++	struct regulator_bulk_data supplies[OV5647_NUM_SUPPLIES];
+ 	bool				clock_ncont;
+ 	struct v4l2_ctrl_handler	ctrls;
+ 	const struct ov5647_mode	*mode;
+@@ -787,6 +798,12 @@ static int ov5647_power_on(struct device
+ 
+ 	dev_dbg(dev, "OV5647 power on\n");
+ 
++	ret = regulator_bulk_enable(OV5647_NUM_SUPPLIES, sensor->supplies);
++	if (ret < 0) {
++		dev_err(dev, "Failed to enable regulators\n");
++		return ret;
++	}
++
+ 	if (sensor->pwdn) {
+ 		gpiod_set_value_cansleep(sensor->pwdn, 0);
+ 		msleep(PWDN_ACTIVE_DELAY_MS);
+@@ -818,6 +835,7 @@ error_clk_disable:
+ 	clk_disable_unprepare(sensor->xclk);
+ error_pwdn:
+ 	gpiod_set_value_cansleep(sensor->pwdn, 1);
++	regulator_bulk_disable(OV5647_NUM_SUPPLIES, sensor->supplies);
+ 
+ 	return ret;
+ }
+@@ -847,6 +865,7 @@ static int ov5647_power_off(struct devic
+ 
+ 	clk_disable_unprepare(sensor->xclk);
+ 	gpiod_set_value_cansleep(sensor->pwdn, 1);
++	regulator_bulk_disable(OV5647_NUM_SUPPLIES, sensor->supplies);
+ 
+ 	return 0;
+ }
+@@ -1347,6 +1366,18 @@ static const struct v4l2_ctrl_ops ov5647
+ 	.s_ctrl = ov5647_s_ctrl,
+ };
+ 
++static int ov5647_configure_regulators(struct device *dev,
++				       struct ov5647 *sensor)
++{
++	unsigned int i;
++
++	for (i = 0; i < OV5647_NUM_SUPPLIES; i++)
++		sensor->supplies[i].supply = ov5647_supply_names[i];
++
++	return devm_regulator_bulk_get(dev, OV5647_NUM_SUPPLIES,
++				       sensor->supplies);
++}
++
+ static int ov5647_init_controls(struct ov5647 *sensor, struct device *dev)
+ {
+ 	struct i2c_client *client = v4l2_get_subdevdata(&sensor->sd);
+@@ -1494,6 +1525,12 @@ static int ov5647_probe(struct i2c_clien
+ 		return -EINVAL;
+ 	}
+ 
++	ret = ov5647_configure_regulators(dev, sensor);
++	if (ret) {
++		dev_err(dev, "Failed to get power regulators\n");
++		return ret;
++	}
++
+ 	mutex_init(&sensor->lock);
+ 
+ 	sensor->mode = OV5647_DEFAULT_MODE;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0364-media-i2c-ov7251-Make-the-enable-GPIO-optional.patch b/target/linux/bcm27xx/patches-6.1/950-0364-media-i2c-ov7251-Make-the-enable-GPIO-optional.patch
new file mode 100644
index 00000000000000..1fa99226da4f86
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0364-media-i2c-ov7251-Make-the-enable-GPIO-optional.patch
@@ -0,0 +1,26 @@
+From 8e2ed1f961359103c877cf29959895bf36960e11 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 14 Dec 2021 17:18:49 +0000
+Subject: [PATCH] media: i2c: ov7251: Make the enable GPIO optional.
+
+Not all implementations wire up the enable GPIO and may just tie
+it to a supply rail.
+Make it optional.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov7251.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/ov7251.c
++++ b/drivers/media/i2c/ov7251.c
+@@ -1676,7 +1676,8 @@ static int ov7251_probe(struct i2c_clien
+ 		return PTR_ERR(ov7251->analog_regulator);
+ 	}
+ 
+-	ov7251->enable_gpio = devm_gpiod_get(dev, "enable", GPIOD_OUT_HIGH);
++	ov7251->enable_gpio = devm_gpiod_get_optional(dev, "enable",
++						      GPIOD_OUT_HIGH);
+ 	if (IS_ERR(ov7251->enable_gpio)) {
+ 		dev_err(dev, "cannot get enable gpio\n");
+ 		return PTR_ERR(ov7251->enable_gpio);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0365-staging-bcm2835-isp-Fix-cleanup-after-init-fail.patch b/target/linux/bcm27xx/patches-6.1/950-0365-staging-bcm2835-isp-Fix-cleanup-after-init-fail.patch
new file mode 100644
index 00000000000000..786148ed1382d6
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0365-staging-bcm2835-isp-Fix-cleanup-after-init-fail.patch
@@ -0,0 +1,38 @@
+From 35a9acc89dc7f7dc2f6e080abebcc3416be420db Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 16 Dec 2021 16:25:00 +0000
+Subject: [PATCH] staging/bcm2835-isp: Fix cleanup after init fail
+
+bcm2835_isp_remove is called on an initialisation failure, but at that
+point the drvdata hasn't been set. This causes a crash when e.g. using
+the cutdown firmware (gpu_mem=16).
+
+Move platform_set_drvdata before the instance probing loop to avoid the
+problem.
+
+See: https://github.com/raspberrypi/linux/issues/4774
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
+@@ -1776,6 +1776,8 @@ static int bcm2835_isp_probe(struct plat
+ 	if (!bcm2835_isp_instances)
+ 		return -ENOMEM;
+ 
++	platform_set_drvdata(pdev, bcm2835_isp_instances);
++
+ 	for (i = 0; i < BCM2835_ISP_NUM_INSTANCES; i++) {
+ 		ret = bcm2835_isp_probe_instance(pdev,
+ 						 &bcm2835_isp_instances[i], i);
+@@ -1783,7 +1785,6 @@ static int bcm2835_isp_probe(struct plat
+ 			goto error;
+ 	}
+ 
+-	platform_set_drvdata(pdev, bcm2835_isp_instances);
+ 	dev_info(&pdev->dev, "Loaded V4L2 %s\n", BCM2835_ISP_NAME);
+ 	return 0;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0366-uapi-v4l2-controls-Reset-V4L2_CID_USER_BCM2835_ISP_B.patch b/target/linux/bcm27xx/patches-6.1/950-0366-uapi-v4l2-controls-Reset-V4L2_CID_USER_BCM2835_ISP_B.patch
new file mode 100644
index 00000000000000..8ff83761bbd731
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0366-uapi-v4l2-controls-Reset-V4L2_CID_USER_BCM2835_ISP_B.patch
@@ -0,0 +1,33 @@
+From ac4eb1ccf6e4889519548d6fbbea428997406e88 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 4 Jan 2022 13:56:42 +0000
+Subject: [PATCH] uapi/v4l2-controls: Reset
+ V4L2_CID_USER_BCM2835_ISP_BASE to same as 5.10
+
+https://github.com/raspberrypi/linux/issues/4440
+
+Upstream has added additional device specific controls, so the
+V4L2_CID_USER_BASE + 0x10e0 value that had been defined for use with
+the ISP has been taken by something else (and +0x10f0 has been used as
+well)
+
+Duplicate the use on V4L2_CID_USER_BASE + 0x10e0 so that userspace
+(libcamera) doesn't need to change. Once the driver is upstream, then
+we'll update libcamera to adopt the new value as it then won't change.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ include/uapi/linux/v4l2-controls.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/uapi/linux/v4l2-controls.h
++++ b/include/uapi/linux/v4l2-controls.h
+@@ -233,7 +233,7 @@ enum v4l2_colorfx {
+ 
+ /* The base for the bcm2835-isp driver controls.
+  * We reserve 16 controls for this driver. */
+-#define V4L2_CID_USER_BCM2835_ISP_BASE		(V4L2_CID_USER_BASE + 0x10f0)
++#define V4L2_CID_USER_BCM2835_ISP_BASE		(V4L2_CID_USER_BASE + 0x10e0)
+ 
+ /* MPEG-class control IDs */
+ /* The MPEG controls are applicable to all codec controls
diff --git a/target/linux/bcm27xx/patches-6.1/950-0367-media-i2c-ov9281-Increase-diff-between-VTS-and-max-e.patch b/target/linux/bcm27xx/patches-6.1/950-0367-media-i2c-ov9281-Increase-diff-between-VTS-and-max-e.patch
new file mode 100644
index 00000000000000..f7450cbe2c2de2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0367-media-i2c-ov9281-Increase-diff-between-VTS-and-max-e.patch
@@ -0,0 +1,60 @@
+From d66098625b057d12fcffdb07a6f2d462e0e2495d Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 4 Jan 2022 14:46:01 +0000
+Subject: [PATCH] media: i2c: ov9281: Increase diff between VTS and max
+ exposure
+
+The driver did allow the exposure to go up to VTS - 4 lines,
+but this would produce a visible line on 1280x800, and a stall of
+the sensor at 640x480.
+
+Whilst it appears to work with a difference of 5, the datasheet states
+there should be at least 25 lines difference between VTS and exposure,
+so use that value.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov9281.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/i2c/ov9281.c
++++ b/drivers/media/i2c/ov9281.c
+@@ -52,7 +52,11 @@
+ #define OV9281_REG_EXPOSURE		0x3500
+ #define	OV9281_EXPOSURE_MIN		4
+ #define	OV9281_EXPOSURE_STEP		1
+-#define OV9281_VTS_MAX			0x7fff
++/*
++ * Number of lines less than frame length (VTS) that exposure must be.
++ * Datasheet states 25, although empirically 5 appears to work.
++ */
++#define OV9281_EXPOSURE_OFFSET		25
+ 
+ #define OV9281_REG_GAIN_H		0x3508
+ #define OV9281_REG_GAIN_L		0x3509
+@@ -69,6 +73,7 @@
+ #define OV9281_TEST_PATTERN_DISABLE	0x0
+ 
+ #define OV9281_REG_VTS			0x380e
++#define OV9281_VTS_MAX			0x7fff
+ 
+ /*
+  * OV9281 native and active pixel array size.
+@@ -967,7 +972,7 @@ static int ov9281_set_ctrl(struct v4l2_c
+ 	switch (ctrl->id) {
+ 	case V4L2_CID_VBLANK:
+ 		/* Update max exposure while meeting expected vblanking */
+-		max = ov9281->cur_mode->height + ctrl->val - 4;
++		max = ov9281->cur_mode->height + ctrl->val - OV9281_EXPOSURE_OFFSET;
+ 		__v4l2_ctrl_modify_range(ov9281->exposure,
+ 					 ov9281->exposure->minimum, max,
+ 					 ov9281->exposure->step,
+@@ -1062,7 +1067,7 @@ static int ov9281_initialize_controls(st
+ 					   OV9281_VTS_MAX - mode->height, 1,
+ 					   vblank_def);
+ 
+-	exposure_max = mode->vts_def - 4;
++	exposure_max = mode->vts_def - OV9281_EXPOSURE_OFFSET;
+ 	ov9281->exposure = v4l2_ctrl_new_std(handler, &ov9281_ctrl_ops,
+ 					     V4L2_CID_EXPOSURE,
+ 					     OV9281_EXPOSURE_MIN, exposure_max,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0368-Use-GitHubs-issue-form-for-bug-reports.patch b/target/linux/bcm27xx/patches-6.1/950-0368-Use-GitHubs-issue-form-for-bug-reports.patch
new file mode 100644
index 00000000000000..7d08793af687f8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0368-Use-GitHubs-issue-form-for-bug-reports.patch
@@ -0,0 +1,163 @@
+From b9bf4e573a1e07ef999636cdb61f393df61cc447 Mon Sep 17 00:00:00 2001
+From: Andreas Blaesius <andi@unlegacy-android.org>
+Date: Wed, 5 Jan 2022 20:38:39 +0100
+Subject: [PATCH] Use GitHubs issue form for bug reports
+
+Use GitHubs issue form for bug reports.
+
+- modern look
+- user don't need to mess with given markdown parts while filling the issue template
+
+Setup config.yml for general questions and problems with the Raspbian distribution packages.
+---
+ .github/ISSUE_TEMPLATE/bug_report.md  | 34 ----------
+ .github/ISSUE_TEMPLATE/bug_report.yml | 91 +++++++++++++++++++++++++++
+ .github/ISSUE_TEMPLATE/config.yml     |  9 +++
+ 3 files changed, 100 insertions(+), 34 deletions(-)
+ delete mode 100644 .github/ISSUE_TEMPLATE/bug_report.md
+ create mode 100644 .github/ISSUE_TEMPLATE/bug_report.yml
+ create mode 100644 .github/ISSUE_TEMPLATE/config.yml
+
+--- a/.github/ISSUE_TEMPLATE/bug_report.md
++++ /dev/null
+@@ -1,34 +0,0 @@
+----
+-name: Bug report
+-about: Create a report to help us fix your issue
+-
+----
+-
+-**Is this the right place for my bug report?**
+-This repository contains the Linux kernel used on the Raspberry Pi. If you believe that the issue you are seeing is kernel-related, this is the right place. If not, we have other repositories for the GPU firmware at [github.com/raspberrypi/firmware](https://github.com/raspberrypi/firmware) and Raspberry Pi userland applications at [github.com/raspberrypi/userland](https://github.com/raspberrypi/userland). If you have problems with the Raspbian distribution packages, report them in the [github.com/RPi-Distro/repo](https://github.com/RPi-Distro/repo). If you simply have a question, then [the Raspberry Pi forums](https://www.raspberrypi.org/forums) are the best place to ask it.
+-
+-**Describe the bug**
+-Add a clear and concise description of what you think the bug is.
+-
+-**To reproduce**
+-List the steps required to reproduce the issue.
+-
+-**Expected behaviour**
+-Add a clear and concise description of what you expected to happen.
+-
+-**Actual behaviour**
+-Add a clear and concise description of what actually happened.
+-
+-**System**
+- Copy and paste the results of the raspinfo command in to this section. Alternatively, copy and paste a pastebin link, or add answers to the following questions:
+-
+-* Which model of Raspberry Pi? e.g. Pi3B+, PiZeroW
+-* Which OS and version (`cat /etc/rpi-issue`)?
+-* Which firmware version (`vcgencmd version`)?
+-* Which kernel version (`uname -a`)?
+-
+-**Logs**
+-If applicable, add the relevant output from `dmesg` or similar.
+-
+-**Additional context**
+-Add any other relevant context for the problem.
+--- /dev/null
++++ b/.github/ISSUE_TEMPLATE/bug_report.yml
+@@ -0,0 +1,91 @@
++name: "Bug report"
++description: Create a report to help us fix your issue
++body:
++- type: markdown
++  attributes:
++    value: |
++      **Is this the right place for my bug report?**
++      This repository contains the Linux kernel used on the Raspberry Pi.
++      If you believe that the issue you are seeing is kernel-related, this is the right place.
++      If not, we have other repositories for the GPU firmware at [github.com/raspberrypi/firmware](https://github.com/raspberrypi/firmware) and Raspberry Pi userland applications at [github.com/raspberrypi/userland](https://github.com/raspberrypi/userland).
++      
++      If you have problems with the Raspbian distribution packages, report them in the [github.com/RPi-Distro/repo](https://github.com/RPi-Distro/repo).
++      If you simply have a question, then [the Raspberry Pi forums](https://www.raspberrypi.org/forums) are the best place to ask it.
++
++- type: textarea
++  id: description
++  attributes:
++    label: Describe the bug
++    description: |
++      Add a clear and concise description of what you think the bug is.
++  validations:
++    required: true
++
++- type: textarea
++  id: reproduce
++  attributes:
++    label: Steps to reproduce the behaviour
++    description: |
++      List the steps required to reproduce the issue.
++  validations:
++    required: true
++
++- type: dropdown
++  id: model
++  attributes:
++    label: Device (s)
++    description: On which device you are facing the bug?
++    multiple: true
++    options:
++      - Raspberry Pi Zero
++      - Raspberry Pi Zero W / WH
++      - Raspberry Pi Zero 2 W
++      - Raspberry Pi 1 Mod. A
++      - Raspberry Pi 1 Mod. A+
++      - Raspberry Pi 1 Mod. B
++      - Raspberry Pi 1 Mod. B+
++      - Raspberry Pi 2 Mod. B
++      - Raspberry Pi 2 Mod. B v1.2
++      - Raspberry Pi 3 Mod. A+
++      - Raspberry Pi 3 Mod. B
++      - Raspberry Pi 3 Mod. B+
++      - Raspberry Pi 4 Mod. B
++      - Raspberry Pi 400
++      - Raspberry Pi CM1
++      - Raspberry Pi CM3
++      - Raspberry Pi CM3 Lite
++      - Raspberry Pi CM3+
++      - Raspberry Pi CM3+ Lite
++      - Raspberry Pi CM4
++      - Raspberry Pi CM4 Lite
++      - Other
++  validations:
++    required: true
++
++- type: textarea
++  id: system
++  attributes:
++    label: System
++    description: |
++      Copy and paste the results of the raspinfo command in to this section.
++      Alternatively, copy and paste a pastebin link, or add answers to the following questions:
++      * Which OS and version (`cat /etc/rpi-issue`)?
++      * Which firmware version (`vcgencmd version`)?
++      * Which kernel version (`uname -a`)?
++  validations:
++    required: true
++
++- type: textarea
++  id: logs
++  attributes:
++    label: Logs
++    description: |
++      If applicable, add the relevant output from `dmesg` or similar.
++
++- type: textarea
++  id: additional
++  attributes:
++    label: Additional context
++    description: |
++      Add any other relevant context for the problem.
++
+--- /dev/null
++++ b/.github/ISSUE_TEMPLATE/config.yml
+@@ -0,0 +1,9 @@
++blank_issues_enabled: false
++contact_links:
++  - name: "⛔ Question"
++    url: https://www.raspberrypi.org/forums
++    about: "Please do not use GitHub for asking questions. If you simply have a question, then the Raspberry Pi forums are the best place to ask it. Thanks in advance for helping us keep the issue tracker clean!"
++  - name: "⛔ Problems with the Raspbian distribution packages"
++    url: https://github.com/RPi-Distro/repo
++    about: "If you have problems with the Raspbian distribution packages, please report them in the github.com/RPi-Distro/repo."
++
diff --git a/target/linux/bcm27xx/patches-6.1/950-0369-bcm2835-v4l2-isp-Add-missing-lock-initialization.patch b/target/linux/bcm27xx/patches-6.1/950-0369-bcm2835-v4l2-isp-Add-missing-lock-initialization.patch
new file mode 100644
index 00000000000000..21758b4980ba59
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0369-bcm2835-v4l2-isp-Add-missing-lock-initialization.patch
@@ -0,0 +1,51 @@
+From 0c2ce359491f9eafe67c4118be10070fb8ca367d Mon Sep 17 00:00:00 2001
+From: Padmanabha Srinivasaiah <treasure4paddy@gmail.com>
+Date: Thu, 30 Dec 2021 21:45:10 +0100
+Subject: [PATCH] bcm2835-v4l2-isp: Add missing lock initialization
+
+ISP device allocation is dynamic hence the locks too.
+struct mutex queue_lock is not initialized which result in bug.
+
+Fixing same by initializing it.
+
+[   29.847138] INFO: trying to register non-static key.
+[   29.847156] The code is fine but needs lockdep annotation, or maybe
+[   29.847159] you didn't initialize this object before use?
+[   29.847161] turning off the locking correctness validator.
+[   29.847167] CPU: 1 PID: 343 Comm: v4l_id Tainted: G         C        5.15.11-rt24-v8+ #8
+[   29.847187] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT)
+[   29.847194] Call trace:
+[   29.847197]  dump_backtrace+0x0/0x1b8
+[   29.847227]  show_stack+0x20/0x30
+[   29.847240]  dump_stack_lvl+0x8c/0xb8
+[   29.847254]  dump_stack+0x18/0x34
+[   29.847263]  register_lock_class+0x494/0x4a0
+[   29.847278]  __lock_acquire+0x80/0x1680
+[   29.847289]  lock_acquire+0x214/0x3a0
+[   29.847300]  mutex_lock_nested+0x70/0xc8
+[   29.847312]  _vb2_fop_release+0x3c/0xa8 [videobuf2_v4l2]
+[   29.847346]  vb2_fop_release+0x34/0x60 [videobuf2_v4l2]
+[   29.847367]  v4l2_release+0xc8/0x108 [videodev]
+[   29.847453]  __fput+0x8c/0x258
+[   29.847476]  ____fput+0x18/0x28
+[   29.847487]  task_work_run+0x98/0x180
+[   29.847502]  do_notify_resume+0x228/0x3f8
+[   29.847515]  el0_svc+0xec/0xf0
+[   29.847523]  el0t_64_sync_handler+0x90/0xb8
+[   29.847531]  el0t_64_sync+0x180/0x184
+
+Signed-off-by: Padmanabha Srinivasaiah <treasure4paddy@gmail.com>
+---
+ drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
+@@ -1296,6 +1296,7 @@ static int register_node(struct bcm2835_
+ 	int ret;
+ 
+ 	mutex_init(&node->lock);
++	mutex_init(&node->queue_lock);
+ 
+ 	node->dev = dev;
+ 	vfd = &node->vfd;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0370-mfd-simple-mfd-i2c-Add-configuration-for-RPi-POE-HAT.patch b/target/linux/bcm27xx/patches-6.1/950-0370-mfd-simple-mfd-i2c-Add-configuration-for-RPi-POE-HAT.patch
new file mode 100644
index 00000000000000..2d66e12658b0a9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0370-mfd-simple-mfd-i2c-Add-configuration-for-RPi-POE-HAT.patch
@@ -0,0 +1,63 @@
+From aa4a0729c4e6f94fde5281d6454342bbd4fc69e1 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 19 Jan 2022 17:22:57 +0000
+Subject: [PATCH] mfd: simple-mfd-i2c: Add configuration for RPi POE
+ HAT
+
+The Raspbery Pi PoE+ HAT exposes a fan controller and power
+supply status reporting via a single I2C address.
+
+Create an MFD device that allows loading of the relevant
+sub-drivers, with a shared I2C regmap.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/mfd/Kconfig          | 10 ++++++++++
+ drivers/mfd/simple-mfd-i2c.c | 10 ++++++++++
+ 2 files changed, 20 insertions(+)
+
+--- a/drivers/mfd/Kconfig
++++ b/drivers/mfd/Kconfig
+@@ -1152,6 +1152,16 @@ config MFD_SY7636A
+ 	  To enable support for building sub-devices as modules,
+ 	  choose M here.
+ 
++config MFD_RASPBERRYPI_POE_HAT
++	tristate "Raspberry Pi PoE HAT MFD"
++	depends on I2C
++	select MFD_SIMPLE_MFD_I2C
++	help
++	  This module supports the PWM fan controller found on the Raspberry Pi
++	  POE and POE+ HAT boards, and the power supply driver on the POE+ HAT.
++	  (Functionally it relies on MFD_SIMPLE_MFD_I2C to provide the framework
++	  that loads the child drivers).
++
+ config MFD_RDC321X
+ 	tristate "RDC R-321x southbridge"
+ 	select MFD_CORE
+--- a/drivers/mfd/simple-mfd-i2c.c
++++ b/drivers/mfd/simple-mfd-i2c.c
+@@ -29,6 +29,15 @@ static const struct regmap_config regmap
+ 	.val_bits = 8,
+ };
+ 
++static const struct regmap_config regmap_config_16r_8v = {
++	.reg_bits = 16,
++	.val_bits = 8,
++};
++
++static const struct simple_mfd_data rpi_poe_core = {
++	.regmap_config = &regmap_config_16r_8v,
++};
++
+ static int simple_mfd_i2c_probe(struct i2c_client *i2c)
+ {
+ 	const struct simple_mfd_data *simple_mfd_data;
+@@ -75,6 +84,7 @@ static const struct simple_mfd_data sile
+ static const struct of_device_id simple_mfd_i2c_of_match[] = {
+ 	{ .compatible = "kontron,sl28cpld" },
+ 	{ .compatible = "silergy,sy7636a", .data = &silergy_sy7636a},
++	{ .compatible = "raspberrypi,poe-core", &rpi_poe_core },
+ 	{}
+ };
+ MODULE_DEVICE_TABLE(of, simple_mfd_i2c_of_match);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0371-pwm-raspberrypi-poe-Add-option-of-being-created-by-M.patch b/target/linux/bcm27xx/patches-6.1/950-0371-pwm-raspberrypi-poe-Add-option-of-being-created-by-M.patch
new file mode 100644
index 00000000000000..0f5d61465c586c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0371-pwm-raspberrypi-poe-Add-option-of-being-created-by-M.patch
@@ -0,0 +1,170 @@
+From 750fcf1df4414e0823100135a3ff7ea760d0fa86 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 19 Jan 2022 17:26:22 +0000
+Subject: [PATCH] pwm: raspberrypi-poe: Add option of being created by
+ MFD or FW
+
+The firmware can only use I2C0 if the kernel isn't, therefore
+with libcamera and DRM using it the PoE HAT fan control needs
+to move to the kernel.
+
+Add the option for the driver to be created by the PoE HAT core
+MFD driver, and use the I2C regmap that provides to control fan
+functions.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/pwm/pwm-raspberrypi-poe.c | 81 ++++++++++++++++++-------------
+ 1 file changed, 48 insertions(+), 33 deletions(-)
+
+--- a/drivers/pwm/pwm-raspberrypi-poe.c
++++ b/drivers/pwm/pwm-raspberrypi-poe.c
+@@ -16,6 +16,7 @@
+ #include <linux/of.h>
+ #include <linux/platform_device.h>
+ #include <linux/pwm.h>
++#include <linux/regmap.h>
+ 
+ #include <soc/bcm2835/raspberrypi-firmware.h>
+ #include <dt-bindings/pwm/raspberrypi,firmware-poe-pwm.h>
+@@ -27,6 +28,10 @@
+ 
+ struct raspberrypi_pwm {
+ 	struct rpi_firmware *firmware;
++
++	struct regmap *regmap;
++	u32 offset;
++
+ 	struct pwm_chip chip;
+ 	unsigned int duty_cycle;
+ };
+@@ -43,7 +48,7 @@ struct raspberrypi_pwm *raspberrypi_pwm_
+ 	return container_of(chip, struct raspberrypi_pwm, chip);
+ }
+ 
+-static int raspberrypi_pwm_set_property(struct rpi_firmware *firmware,
++static int raspberrypi_pwm_set_property(struct raspberrypi_pwm *pwm,
+ 					u32 reg, u32 val)
+ {
+ 	struct raspberrypi_pwm_prop msg = {
+@@ -52,17 +57,19 @@ static int raspberrypi_pwm_set_property(
+ 	};
+ 	int ret;
+ 
+-	ret = rpi_firmware_property(firmware, RPI_FIRMWARE_SET_POE_HAT_VAL,
+-				    &msg, sizeof(msg));
+-	if (ret)
+-		return ret;
+-	if (msg.ret)
+-		return -EIO;
++	if (pwm->firmware) {
++		ret = rpi_firmware_property(pwm->firmware, RPI_FIRMWARE_SET_POE_HAT_VAL,
++					    &msg, sizeof(msg));
++		if (!ret && msg.ret)
++			ret = -EIO;
++	} else {
++		ret = regmap_write(pwm->regmap, pwm->offset + reg, val);
++	}
+ 
+-	return 0;
++	return ret;
+ }
+ 
+-static int raspberrypi_pwm_get_property(struct rpi_firmware *firmware,
++static int raspberrypi_pwm_get_property(struct raspberrypi_pwm *pwm,
+ 					u32 reg, u32 *val)
+ {
+ 	struct raspberrypi_pwm_prop msg = {
+@@ -70,16 +77,17 @@ static int raspberrypi_pwm_get_property(
+ 	};
+ 	int ret;
+ 
+-	ret = rpi_firmware_property(firmware, RPI_FIRMWARE_GET_POE_HAT_VAL,
+-				    &msg, sizeof(msg));
+-	if (ret)
+-		return ret;
+-	if (msg.ret)
+-		return -EIO;
+-
+-	*val = le32_to_cpu(msg.val);
++	if (pwm->firmware) {
++		ret = rpi_firmware_property(pwm->firmware, RPI_FIRMWARE_GET_POE_HAT_VAL,
++					    &msg, sizeof(msg));
++		if (!ret && msg.ret)
++			ret = -EIO;
++		*val = le32_to_cpu(msg.val);
++	} else {
++		ret = regmap_read(pwm->regmap, pwm->offset + reg, val);
++	}
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ static int raspberrypi_pwm_get_state(struct pwm_chip *chip,
+@@ -119,7 +127,7 @@ static int raspberrypi_pwm_apply(struct
+ 	if (duty_cycle == rpipwm->duty_cycle)
+ 		return 0;
+ 
+-	ret = raspberrypi_pwm_set_property(rpipwm->firmware, RPI_PWM_CUR_DUTY_REG,
++	ret = raspberrypi_pwm_set_property(rpipwm, RPI_PWM_CUR_DUTY_REG,
+ 					   duty_cycle);
+ 	if (ret) {
+ 		dev_err(chip->dev, "Failed to set duty cycle: %pe\n",
+@@ -146,28 +154,34 @@ static int raspberrypi_pwm_probe(struct
+ 	struct raspberrypi_pwm *rpipwm;
+ 	int ret;
+ 
+-	firmware_node = of_get_parent(dev->of_node);
+-	if (!firmware_node) {
+-		dev_err(dev, "Missing firmware node\n");
+-		return -ENOENT;
+-	}
+-
+-	firmware = devm_rpi_firmware_get(&pdev->dev, firmware_node);
+-	of_node_put(firmware_node);
+-	if (!firmware)
+-		return dev_err_probe(dev, -EPROBE_DEFER,
+-				     "Failed to get firmware handle\n");
+-
+ 	rpipwm = devm_kzalloc(&pdev->dev, sizeof(*rpipwm), GFP_KERNEL);
+ 	if (!rpipwm)
+ 		return -ENOMEM;
+ 
+-	rpipwm->firmware = firmware;
++	if (pdev->dev.parent)
++		rpipwm->regmap = dev_get_regmap(pdev->dev.parent, NULL);
++
++	if (rpipwm->regmap) {
++		ret = device_property_read_u32(&pdev->dev, "reg", &rpipwm->offset);
++		if (ret)
++			return -EINVAL;
++	} else {
++		firmware_node = of_get_parent(dev->of_node);
++
++		firmware = devm_rpi_firmware_get(&pdev->dev, firmware_node);
++		of_node_put(firmware_node);
++		if (!firmware)
++			return dev_err_probe(dev, -EPROBE_DEFER,
++					     "Failed to get firmware handle\n");
++
++		rpipwm->firmware = firmware;
++	}
++
+ 	rpipwm->chip.dev = dev;
+ 	rpipwm->chip.ops = &raspberrypi_pwm_ops;
+ 	rpipwm->chip.npwm = RASPBERRYPI_FIRMWARE_PWM_NUM;
+ 
+-	ret = raspberrypi_pwm_get_property(rpipwm->firmware, RPI_PWM_CUR_DUTY_REG,
++	ret = raspberrypi_pwm_get_property(rpipwm, RPI_PWM_CUR_DUTY_REG,
+ 					   &rpipwm->duty_cycle);
+ 	if (ret) {
+ 		dev_err(dev, "Failed to get duty cycle: %pe\n", ERR_PTR(ret));
+@@ -179,6 +193,7 @@ static int raspberrypi_pwm_probe(struct
+ 
+ static const struct of_device_id raspberrypi_pwm_of_match[] = {
+ 	{ .compatible = "raspberrypi,firmware-poe-pwm", },
++	{ .compatible = "raspberrypi,poe-pwm", },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(of, raspberrypi_pwm_of_match);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0372-power-rpi-poe-Drop-CURRENT_AVG-as-it-is-not-hardware.patch b/target/linux/bcm27xx/patches-6.1/950-0372-power-rpi-poe-Drop-CURRENT_AVG-as-it-is-not-hardware.patch
new file mode 100644
index 00000000000000..e2b9bd8731da6a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0372-power-rpi-poe-Drop-CURRENT_AVG-as-it-is-not-hardware.patch
@@ -0,0 +1,43 @@
+From 1a9e61cf83ad61803255a749d89957aabe80ba98 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 20 Jan 2022 15:48:03 +0000
+Subject: [PATCH] power: rpi-poe: Drop CURRENT_AVG as it is not
+ hardware averaged
+
+As documented the _AVG parameters are meant to be hardware
+averaged, but the implementation for the PoE+ HAT was done in
+software in the firmware.
+
+Drop the property.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/power/supply/rpi_poe_power.c | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+--- a/drivers/power/supply/rpi_poe_power.c
++++ b/drivers/power/supply/rpi_poe_power.c
+@@ -106,15 +106,6 @@ static int rpi_poe_power_supply_get_prop
+ 		r_val->intval = (val > 5);
+ 		return 0;
+ 
+-	case POWER_SUPPLY_PROP_CURRENT_AVG:
+-		val = 50;
+-		ret = read_reg(ctx->fw, RPI_POE_ADC_REG, &val);
+-		if (ret)
+-			return ret;
+-		val = (val * 3300)/9821;
+-		r_val->intval = val * 1000;
+-		return 0;
+-
+ 	case POWER_SUPPLY_PROP_CURRENT_NOW:
+ 		ret = read_reg(ctx->fw, RPI_POE_ADC_REG, &val);
+ 		if (ret)
+@@ -145,7 +136,6 @@ static int rpi_poe_power_supply_get_prop
+ static enum power_supply_property rpi_poe_power_supply_properties[] = {
+ 	POWER_SUPPLY_PROP_HEALTH,
+ 	POWER_SUPPLY_PROP_ONLINE,
+-	POWER_SUPPLY_PROP_CURRENT_AVG,
+ 	POWER_SUPPLY_PROP_CURRENT_NOW,
+ 	POWER_SUPPLY_PROP_CURRENT_MAX,
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0373-power-rpi-poe-Add-option-of-being-created-by-MFD-or-.patch b/target/linux/bcm27xx/patches-6.1/950-0373-power-rpi-poe-Add-option-of-being-created-by-MFD-or-.patch
new file mode 100644
index 00000000000000..de3396850ab02e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0373-power-rpi-poe-Add-option-of-being-created-by-MFD-or-.patch
@@ -0,0 +1,234 @@
+From 710a8410b88cd3cf6b56477b45c09686cc30e576 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 20 Jan 2022 15:50:27 +0000
+Subject: [PATCH] power: rpi-poe: Add option of being created by MFD or
+ FW
+
+The firmware can only use I2C0 if the kernel isn't, therefore
+with libcamera and DRM using it the PoE HAT fan control needs
+to move to the kernel.
+
+Add the option for the driver to be created by the PoE HAT core
+MFD driver, and use the I2C regmap that provides to control fan
+functions.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/power/supply/rpi_poe_power.c | 124 ++++++++++++++++-----------
+ 1 file changed, 75 insertions(+), 49 deletions(-)
+
+--- a/drivers/power/supply/rpi_poe_power.c
++++ b/drivers/power/supply/rpi_poe_power.c
+@@ -12,10 +12,13 @@
+ #include <linux/of.h>
+ #include <linux/platform_device.h>
+ #include <linux/power_supply.h>
++#include <linux/regmap.h>
+ #include <soc/bcm2835/raspberrypi-firmware.h>
+ 
+-#define RPI_POE_ADC_REG			0x2
+-#define RPI_POE_FLAG_REG		0x4
++#define RPI_POE_FW_BASE_REG		0x2
++
++#define RPI_POE_ADC_REG			0x0
++#define RPI_POE_FLAG_REG		0x2
+ 
+ #define RPI_POE_FLAG_AT			BIT(0)
+ #define RPI_POE_FLAG_OC			BIT(1)
+@@ -26,8 +29,12 @@
+ #define DRVNAME "rpi-poe-power-supply"
+ 
+ struct rpi_poe_power_supply_ctx {
+-	struct power_supply *supply;
+ 	struct rpi_firmware *fw;
++
++	struct regmap *regmap;
++	u32 offset;
++
++	struct power_supply *supply;
+ };
+ 
+ struct fw_tag_data_s {
+@@ -36,40 +43,51 @@ struct fw_tag_data_s {
+ 	u32 ret;
+ };
+ 
+-static int write_reg(struct rpi_firmware *fw, u32 reg, u32 *val)
++static int write_reg(struct rpi_poe_power_supply_ctx *ctx, u32 reg, u32 *val)
+ {
+ 	struct fw_tag_data_s fw_tag_data = {
+-		.reg = reg,
++		.reg = reg + RPI_POE_FW_BASE_REG,
+ 		.val = *val
+ 	};
+ 	int ret;
+ 
+-	ret = rpi_firmware_property(fw, RPI_FIRMWARE_SET_POE_HAT_VAL,
+-				    &fw_tag_data, sizeof(fw_tag_data));
+-	if (ret)
+-		return ret;
+-	else if (fw_tag_data.ret)
+-		return -EIO;
+-	return 0;
++	if (ctx->fw) {
++		ret = rpi_firmware_property(ctx->fw, RPI_FIRMWARE_SET_POE_HAT_VAL,
++					    &fw_tag_data, sizeof(fw_tag_data));
++		if (!ret && fw_tag_data.ret)
++			ret = -EIO;
++	} else {
++		ret = regmap_write(ctx->regmap, ctx->offset + reg, *val);
++	}
++
++	return ret;
+ }
+ 
+-static int read_reg(struct rpi_firmware *fw, u32 reg, u32 *val)
++static int read_reg(struct rpi_poe_power_supply_ctx *ctx, u32 reg, u32 *val)
+ {
+ 	struct fw_tag_data_s fw_tag_data = {
+-		.reg = reg,
++		.reg = reg + RPI_POE_FW_BASE_REG,
+ 		.val = *val
+ 	};
++	u32 value;
+ 	int ret;
+ 
+-	ret = rpi_firmware_property(fw, RPI_FIRMWARE_GET_POE_HAT_VAL,
+-				    &fw_tag_data, sizeof(fw_tag_data));
+-	if (ret)
+-		return ret;
+-	else if (fw_tag_data.ret)
+-		return -EIO;
++	if (ctx->fw) {
++		ret = rpi_firmware_property(ctx->fw, RPI_FIRMWARE_GET_POE_HAT_VAL,
++					    &fw_tag_data, sizeof(fw_tag_data));
++		if (!ret && fw_tag_data.ret)
++			ret = -EIO;
++		*val = fw_tag_data.val;
++	} else {
++		ret = regmap_read(ctx->regmap, ctx->offset + reg, &value);
++		if (!ret) {
++			*val = value;
++			ret = regmap_read(ctx->regmap, ctx->offset + reg + 1, &value);
++			*val |= value << 8;
++		}
++	}
+ 
+-	*val = fw_tag_data.val;
+-	return 0;
++	return ret;
+ }
+ 
+ static int rpi_poe_power_supply_get_property(struct power_supply *psy,
+@@ -82,14 +100,14 @@ static int rpi_poe_power_supply_get_prop
+ 
+ 	switch (psp) {
+ 	case POWER_SUPPLY_PROP_HEALTH:
+-		ret = read_reg(ctx->fw, RPI_POE_FLAG_REG, &val);
++		ret = read_reg(ctx, RPI_POE_FLAG_REG, &val);
+ 		if (ret)
+ 			return ret;
+ 
+ 		if (val & RPI_POE_FLAG_OC) {
+ 			r_val->intval = POWER_SUPPLY_HEALTH_UNSPEC_FAILURE;
+ 			val = RPI_POE_FLAG_OC;
+-			ret = write_reg(ctx->fw, RPI_POE_FLAG_REG, &val);
++			ret = write_reg(ctx, RPI_POE_FLAG_REG, &val);
+ 			if (ret)
+ 				return ret;
+ 			return 0;
+@@ -99,7 +117,7 @@ static int rpi_poe_power_supply_get_prop
+ 		return 0;
+ 
+ 	case POWER_SUPPLY_PROP_ONLINE:
+-		ret = read_reg(ctx->fw, RPI_POE_ADC_REG, &val);
++		ret = read_reg(ctx, RPI_POE_ADC_REG, &val);
+ 		if (ret)
+ 			return ret;
+ 
+@@ -107,7 +125,7 @@ static int rpi_poe_power_supply_get_prop
+ 		return 0;
+ 
+ 	case POWER_SUPPLY_PROP_CURRENT_NOW:
+-		ret = read_reg(ctx->fw, RPI_POE_ADC_REG, &val);
++		ret = read_reg(ctx, RPI_POE_ADC_REG, &val);
+ 		if (ret)
+ 			return ret;
+ 		val = (val * 3300)/9821;
+@@ -115,15 +133,14 @@ static int rpi_poe_power_supply_get_prop
+ 		return 0;
+ 
+ 	case POWER_SUPPLY_PROP_CURRENT_MAX:
+-		ret = read_reg(ctx->fw, RPI_POE_FLAG_REG, &val);
++		ret = read_reg(ctx, RPI_POE_FLAG_REG, &val);
+ 		if (ret)
+ 			return ret;
+ 
+-		if (val & RPI_POE_FLAG_AT) {
++		if (val & RPI_POE_FLAG_AT)
+ 			r_val->intval = RPI_POE_CURRENT_AT_MAX;
+-			return 0;
+-		}
+-		r_val->intval = RPI_POE_CURRENT_AF_MAX;
++		else
++			r_val->intval = RPI_POE_CURRENT_AF_MAX;
+ 		return 0;
+ 
+ 	default:
+@@ -158,29 +175,38 @@ static int rpi_poe_power_supply_probe(st
+ 	if (!of_device_is_available(pdev->dev.of_node))
+ 		return -ENODEV;
+ 
+-	fw_node = of_parse_phandle(pdev->dev.of_node, "firmware", 0);
+-	if (!fw_node) {
+-		dev_err(&pdev->dev, "Missing firmware node\n");
+-		return -ENOENT;
+-	}
+-
+ 	ctx = devm_kzalloc(&pdev->dev, sizeof(*ctx), GFP_KERNEL);
+ 	if (!ctx)
+ 		return -ENOMEM;
+ 
+-	ctx->fw = rpi_firmware_get(fw_node);
+-	if (!ctx->fw)
+-		return -EPROBE_DEFER;
+-	if (rpi_firmware_property(ctx->fw,
+-			RPI_FIRMWARE_GET_FIRMWARE_REVISION,
+-			&revision, sizeof(revision))) {
+-		dev_err(&pdev->dev, "Failed to get firmware revision\n");
+-		return -ENOENT;
+-	}
+-	if (revision < 0x60af72e8) {
+-		dev_err(&pdev->dev, "Unsupported firmware\n");
+-		return -ENOENT;
++	if (pdev->dev.parent)
++		ctx->regmap = dev_get_regmap(pdev->dev.parent, NULL);
++
++	if (ctx->regmap) {
++		if (device_property_read_u32(&pdev->dev, "reg", &ctx->offset))
++			return -EINVAL;
++	} else {
++		fw_node = of_parse_phandle(pdev->dev.of_node, "firmware", 0);
++		if (!fw_node) {
++			dev_err(&pdev->dev, "Missing firmware node\n");
++			return -ENOENT;
++		}
++
++		ctx->fw = rpi_firmware_get(fw_node);
++		if (!ctx->fw)
++			return -EPROBE_DEFER;
++		if (rpi_firmware_property(ctx->fw,
++					  RPI_FIRMWARE_GET_FIRMWARE_REVISION,
++					  &revision, sizeof(revision))) {
++			dev_err(&pdev->dev, "Failed to get firmware revision\n");
++			return -ENOENT;
++		}
++		if (revision < 0x60af72e8) {
++			dev_err(&pdev->dev, "Unsupported firmware\n");
++			return -ENOENT;
++		}
+ 	}
++
+ 	platform_set_drvdata(pdev, ctx);
+ 
+ 	psy_cfg.of_node = pdev->dev.of_node;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0374-drivers-bcm2835_unicam-Disable-trigger-mode-operatio.patch b/target/linux/bcm27xx/patches-6.1/950-0374-drivers-bcm2835_unicam-Disable-trigger-mode-operatio.patch
new file mode 100644
index 00000000000000..9751370e628169
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0374-drivers-bcm2835_unicam-Disable-trigger-mode-operatio.patch
@@ -0,0 +1,57 @@
+From 741fb135f1f1746a9e20b6b2445a798c1a296b75 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 18 Jan 2022 13:13:14 +0000
+Subject: [PATCH] drivers: bcm2835_unicam: Disable trigger mode
+ operation
+
+On a Pi3 B/B+ platform the imx219 sensor frequently generates a single corrupt
+frame when the sensor first starts. This can either be a missing line, or
+invalid samples within the line. This only occurrs using the Unicam kernel
+driver.
+
+Disabling trigger mode elimiates this corruption. Since trigger mode is a
+legacy feature copied from the firmware driver and not expected to be needed,
+remove it. Tested on the Raspberry Pi cameras and shows no ill effects.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 14 +-------------
+ 1 file changed, 1 insertion(+), 13 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -983,11 +983,6 @@ static irqreturn_t unicam_isr(int irq, v
+ 		}
+ 	}
+ 
+-	if (reg_read(unicam, UNICAM_ICTL) & UNICAM_FCM) {
+-		/* Switch out of trigger mode if selected */
+-		reg_write_field(unicam, UNICAM_ICTL, 1, UNICAM_TFC);
+-		reg_write_field(unicam, UNICAM_ICTL, 0, UNICAM_FCM);
+-	}
+ 	return IRQ_HANDLED;
+ }
+ 
+@@ -2297,8 +2292,7 @@ static void unicam_start_rx(struct unica
+ 
+ 	reg_write_field(dev, UNICAM_ANA, 0, UNICAM_DDL);
+ 
+-	/* Always start in trigger frame capture mode (UNICAM_FCM set) */
+-	val = UNICAM_FSIE | UNICAM_FEIE | UNICAM_FCM | UNICAM_IBOB;
++	val = UNICAM_FSIE | UNICAM_FEIE | UNICAM_IBOB;
+ 	set_field(&val, line_int_freq, UNICAM_LCIE_MASK);
+ 	reg_write(dev, UNICAM_ICTL, val);
+ 	reg_write(dev, UNICAM_STA, UNICAM_STA_MASK_ALL);
+@@ -2411,12 +2405,6 @@ static void unicam_start_rx(struct unica
+ 	/* Load embedded data buffer pointers if needed */
+ 	if (dev->node[METADATA_PAD].streaming && dev->sensor_embedded_data)
+ 		reg_write_field(dev, UNICAM_DCS, 1, UNICAM_LDP);
+-
+-	/*
+-	 * Enable trigger only for the first frame to
+-	 * sync correctly to the FS from the source.
+-	 */
+-	reg_write_field(dev, UNICAM_ICTL, 1, UNICAM_TFC);
+ }
+ 
+ static void unicam_disable(struct unicam_device *dev)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0375-Extending-ili9881c-driver-support-for-nwe080-panel.patch b/target/linux/bcm27xx/patches-6.1/950-0375-Extending-ili9881c-driver-support-for-nwe080-panel.patch
new file mode 100644
index 00000000000000..3ee30d2ab4c640
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0375-Extending-ili9881c-driver-support-for-nwe080-panel.patch
@@ -0,0 +1,296 @@
+From b9e101dfe5e967b90c8d9e5a90d3784d2cdfb102 Mon Sep 17 00:00:00 2001
+From: Penk Chen <penk@cutiepi.io>
+Date: Mon, 20 Dec 2021 03:44:56 +0900
+Subject: [PATCH] Extending ili9881c driver support for nwe080 panel
+
+Signed-off-by: Penk Chen <penk@cutiepi.io>
+---
+ drivers/gpu/drm/panel/panel-ilitek-ili9881c.c | 249 ++++++++++++++++++
+ 1 file changed, 249 insertions(+)
+
+--- a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
++++ b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
+@@ -1,6 +1,8 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /*
+  * Copyright (C) 2017-2018, Bootlin
++ * Copyright (C) 2021, Henson Li <henson@cutiepi.io>
++ * Copyright (C) 2021, Penk Chen <penk@cutiepi.io>
+  */
+ 
+ #include <linux/delay.h>
+@@ -456,6 +458,228 @@ static const struct ili9881c_instr k101_
+ 	ILI9881C_COMMAND_INSTR(0xD3, 0x3F), /* VN0 */
+ };
+ 
++static const struct ili9881c_instr nwe080_init[] = {
++	ILI9881C_SWITCH_PAGE_INSTR(3),
++	//GIP_1
++	ILI9881C_COMMAND_INSTR(0x01, 0x00),
++	ILI9881C_COMMAND_INSTR(0x02, 0x00),
++	ILI9881C_COMMAND_INSTR(0x03, 0x73),
++	ILI9881C_COMMAND_INSTR(0x04, 0x00),
++	ILI9881C_COMMAND_INSTR(0x05, 0x00),
++	ILI9881C_COMMAND_INSTR(0x06, 0x0A),
++	ILI9881C_COMMAND_INSTR(0x07, 0x00),
++	ILI9881C_COMMAND_INSTR(0x08, 0x00),
++	ILI9881C_COMMAND_INSTR(0x09, 0x20),
++	ILI9881C_COMMAND_INSTR(0x0a, 0x20),
++	ILI9881C_COMMAND_INSTR(0x0b, 0x00),
++	ILI9881C_COMMAND_INSTR(0x0c, 0x00),
++	ILI9881C_COMMAND_INSTR(0x0d, 0x00),
++	ILI9881C_COMMAND_INSTR(0x0e, 0x00),
++	ILI9881C_COMMAND_INSTR(0x0f, 0x1E),
++	ILI9881C_COMMAND_INSTR(0x10, 0x1E),
++	ILI9881C_COMMAND_INSTR(0x11, 0x00),
++	ILI9881C_COMMAND_INSTR(0x12, 0x00),
++	ILI9881C_COMMAND_INSTR(0x13, 0x00),
++	ILI9881C_COMMAND_INSTR(0x14, 0x00),
++	ILI9881C_COMMAND_INSTR(0x15, 0x00),
++	ILI9881C_COMMAND_INSTR(0x16, 0x00),
++	ILI9881C_COMMAND_INSTR(0x17, 0x00),
++	ILI9881C_COMMAND_INSTR(0x18, 0x00),
++	ILI9881C_COMMAND_INSTR(0x19, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1A, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1B, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1C, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1D, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1E, 0x40),
++	ILI9881C_COMMAND_INSTR(0x1F, 0x80),
++	ILI9881C_COMMAND_INSTR(0x20, 0x06),
++	ILI9881C_COMMAND_INSTR(0x21, 0x01),
++	ILI9881C_COMMAND_INSTR(0x22, 0x00),
++	ILI9881C_COMMAND_INSTR(0x23, 0x00),
++	ILI9881C_COMMAND_INSTR(0x24, 0x00),
++	ILI9881C_COMMAND_INSTR(0x25, 0x00),
++	ILI9881C_COMMAND_INSTR(0x26, 0x00),
++	ILI9881C_COMMAND_INSTR(0x27, 0x00),
++	ILI9881C_COMMAND_INSTR(0x28, 0x33),
++	ILI9881C_COMMAND_INSTR(0x29, 0x03),
++	ILI9881C_COMMAND_INSTR(0x2A, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2B, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2C, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2D, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2E, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2F, 0x00),
++
++	ILI9881C_COMMAND_INSTR(0x30, 0x00),
++	ILI9881C_COMMAND_INSTR(0x31, 0x00),
++	ILI9881C_COMMAND_INSTR(0x32, 0x00),
++	ILI9881C_COMMAND_INSTR(0x33, 0x00),
++	ILI9881C_COMMAND_INSTR(0x34, 0x04),
++	ILI9881C_COMMAND_INSTR(0x35, 0x00),
++	ILI9881C_COMMAND_INSTR(0x36, 0x00),
++	ILI9881C_COMMAND_INSTR(0x37, 0x00),
++	ILI9881C_COMMAND_INSTR(0x38, 0x3C),
++	ILI9881C_COMMAND_INSTR(0x39, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3A, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3B, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3C, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3D, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3E, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3F, 0x00),
++
++	ILI9881C_COMMAND_INSTR(0x40, 0x00),
++	ILI9881C_COMMAND_INSTR(0x41, 0x00),
++	ILI9881C_COMMAND_INSTR(0x42, 0x00),
++	ILI9881C_COMMAND_INSTR(0x43, 0x00),
++	ILI9881C_COMMAND_INSTR(0x44, 0x00),
++
++	ILI9881C_COMMAND_INSTR(0x50, 0x10),
++	ILI9881C_COMMAND_INSTR(0x51, 0x32),
++	ILI9881C_COMMAND_INSTR(0x52, 0x54),
++	ILI9881C_COMMAND_INSTR(0x53, 0x76),
++	ILI9881C_COMMAND_INSTR(0x54, 0x98),
++	ILI9881C_COMMAND_INSTR(0x55, 0xba),
++	ILI9881C_COMMAND_INSTR(0x56, 0x10),
++	ILI9881C_COMMAND_INSTR(0x57, 0x32),
++	ILI9881C_COMMAND_INSTR(0x58, 0x54),
++	ILI9881C_COMMAND_INSTR(0x59, 0x76),
++	ILI9881C_COMMAND_INSTR(0x5A, 0x98),
++	ILI9881C_COMMAND_INSTR(0x5B, 0xba),
++	ILI9881C_COMMAND_INSTR(0x5C, 0xdc),
++	ILI9881C_COMMAND_INSTR(0x5D, 0xfe),
++
++	//GIP_3
++	ILI9881C_COMMAND_INSTR(0x5E, 0x00),
++	ILI9881C_COMMAND_INSTR(0x5F, 0x01),
++	ILI9881C_COMMAND_INSTR(0x60, 0x00),
++	ILI9881C_COMMAND_INSTR(0x61, 0x15),
++	ILI9881C_COMMAND_INSTR(0x62, 0x14),
++	ILI9881C_COMMAND_INSTR(0x63, 0x0E),
++	ILI9881C_COMMAND_INSTR(0x64, 0x0F),
++	ILI9881C_COMMAND_INSTR(0x65, 0x0C),
++	ILI9881C_COMMAND_INSTR(0x66, 0x0D),
++	ILI9881C_COMMAND_INSTR(0x67, 0x06),
++	ILI9881C_COMMAND_INSTR(0x68, 0x02),
++	ILI9881C_COMMAND_INSTR(0x69, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6A, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6B, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6C, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6D, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6E, 0x07),
++	ILI9881C_COMMAND_INSTR(0x6F, 0x02),
++
++	ILI9881C_COMMAND_INSTR(0x70, 0x02),
++	ILI9881C_COMMAND_INSTR(0x71, 0x02),
++	ILI9881C_COMMAND_INSTR(0x72, 0x02),
++	ILI9881C_COMMAND_INSTR(0x73, 0x02),
++	ILI9881C_COMMAND_INSTR(0x74, 0x02),
++	ILI9881C_COMMAND_INSTR(0x75, 0x01),
++	ILI9881C_COMMAND_INSTR(0x76, 0x00),
++	ILI9881C_COMMAND_INSTR(0x77, 0x14),
++	ILI9881C_COMMAND_INSTR(0x78, 0x15),
++	ILI9881C_COMMAND_INSTR(0x79, 0x0E),
++	ILI9881C_COMMAND_INSTR(0x7A, 0x0F),
++	ILI9881C_COMMAND_INSTR(0x7B, 0x0C),
++	ILI9881C_COMMAND_INSTR(0x7C, 0x0D),
++	ILI9881C_COMMAND_INSTR(0x7D, 0x06),
++	ILI9881C_COMMAND_INSTR(0x7E, 0x02),
++	ILI9881C_COMMAND_INSTR(0x7F, 0x02),
++
++	ILI9881C_COMMAND_INSTR(0x80, 0x02),
++	ILI9881C_COMMAND_INSTR(0x81, 0x02),
++	ILI9881C_COMMAND_INSTR(0x82, 0x02),
++	ILI9881C_COMMAND_INSTR(0x83, 0x02),
++	ILI9881C_COMMAND_INSTR(0x84, 0x07),
++	ILI9881C_COMMAND_INSTR(0x85, 0x02),
++	ILI9881C_COMMAND_INSTR(0x86, 0x02),
++	ILI9881C_COMMAND_INSTR(0x87, 0x02),
++	ILI9881C_COMMAND_INSTR(0x88, 0x02),
++	ILI9881C_COMMAND_INSTR(0x89, 0x02),
++	ILI9881C_COMMAND_INSTR(0x8A, 0x02),
++
++	ILI9881C_SWITCH_PAGE_INSTR(4),
++	ILI9881C_COMMAND_INSTR(0x6C, 0x15),
++	ILI9881C_COMMAND_INSTR(0x6E, 0x2A),
++
++	//clamp 15V
++	ILI9881C_COMMAND_INSTR(0x6F, 0x35),
++	ILI9881C_COMMAND_INSTR(0x3A, 0x92),
++	ILI9881C_COMMAND_INSTR(0x8D, 0x1F),
++	ILI9881C_COMMAND_INSTR(0x87, 0xBA),
++	ILI9881C_COMMAND_INSTR(0x26, 0x76),
++	ILI9881C_COMMAND_INSTR(0xB2, 0xD1),
++	ILI9881C_COMMAND_INSTR(0xB5, 0x27),
++	ILI9881C_COMMAND_INSTR(0x31, 0x75),
++	ILI9881C_COMMAND_INSTR(0x30, 0x03),
++	ILI9881C_COMMAND_INSTR(0x3B, 0x98),
++	ILI9881C_COMMAND_INSTR(0x35, 0x17),
++	ILI9881C_COMMAND_INSTR(0x33, 0x14),
++	ILI9881C_COMMAND_INSTR(0x38, 0x01),
++	ILI9881C_COMMAND_INSTR(0x39, 0x00),
++
++	ILI9881C_SWITCH_PAGE_INSTR(1),
++	// direction rotate
++	//ILI9881C_COMMAND_INSTR(0x22, 0x0B),
++	ILI9881C_COMMAND_INSTR(0x22, 0x0A),
++	ILI9881C_COMMAND_INSTR(0x31, 0x00),
++	ILI9881C_COMMAND_INSTR(0x53, 0x63),
++	ILI9881C_COMMAND_INSTR(0x55, 0x69),
++	ILI9881C_COMMAND_INSTR(0x50, 0xC7),
++	ILI9881C_COMMAND_INSTR(0x51, 0xC2),
++	ILI9881C_COMMAND_INSTR(0x60, 0x26),
++
++	ILI9881C_COMMAND_INSTR(0xA0, 0x08),
++	ILI9881C_COMMAND_INSTR(0xA1, 0x0F),
++	ILI9881C_COMMAND_INSTR(0xA2, 0x25),
++	ILI9881C_COMMAND_INSTR(0xA3, 0x01),
++	ILI9881C_COMMAND_INSTR(0xA4, 0x23),
++	ILI9881C_COMMAND_INSTR(0xA5, 0x18),
++	ILI9881C_COMMAND_INSTR(0xA6, 0x11),
++	ILI9881C_COMMAND_INSTR(0xA7, 0x1A),
++	ILI9881C_COMMAND_INSTR(0xA8, 0x81),
++	ILI9881C_COMMAND_INSTR(0xA9, 0x19),
++	ILI9881C_COMMAND_INSTR(0xAA, 0x26),
++	ILI9881C_COMMAND_INSTR(0xAB, 0x7C),
++	ILI9881C_COMMAND_INSTR(0xAC, 0x24),
++	ILI9881C_COMMAND_INSTR(0xAD, 0x1E),
++	ILI9881C_COMMAND_INSTR(0xAE, 0x5C),
++	ILI9881C_COMMAND_INSTR(0xAF, 0x2A),
++	ILI9881C_COMMAND_INSTR(0xB0, 0x2B),
++	ILI9881C_COMMAND_INSTR(0xB1, 0x50),
++	ILI9881C_COMMAND_INSTR(0xB2, 0x5C),
++	ILI9881C_COMMAND_INSTR(0xB3, 0x39),
++
++	ILI9881C_COMMAND_INSTR(0xC0, 0x08),
++	ILI9881C_COMMAND_INSTR(0xC1, 0x1F),
++	ILI9881C_COMMAND_INSTR(0xC2, 0x24),
++	ILI9881C_COMMAND_INSTR(0xC3, 0x1D),
++	ILI9881C_COMMAND_INSTR(0xC4, 0x04),
++	ILI9881C_COMMAND_INSTR(0xC5, 0x32),
++	ILI9881C_COMMAND_INSTR(0xC6, 0x24),
++	ILI9881C_COMMAND_INSTR(0xC7, 0x1F),
++	ILI9881C_COMMAND_INSTR(0xC8, 0x90),
++	ILI9881C_COMMAND_INSTR(0xC9, 0x20),
++	ILI9881C_COMMAND_INSTR(0xCA, 0x2C),
++	ILI9881C_COMMAND_INSTR(0xCB, 0x82),
++	ILI9881C_COMMAND_INSTR(0xCC, 0x19),
++	ILI9881C_COMMAND_INSTR(0xCD, 0x22),
++	ILI9881C_COMMAND_INSTR(0xCE, 0x4E),
++	ILI9881C_COMMAND_INSTR(0xCF, 0x28),
++	ILI9881C_COMMAND_INSTR(0xD0, 0x2D),
++	ILI9881C_COMMAND_INSTR(0xD1, 0x51),
++	ILI9881C_COMMAND_INSTR(0xD2, 0x5D),
++	ILI9881C_COMMAND_INSTR(0xD3, 0x39),
++
++	ILI9881C_SWITCH_PAGE_INSTR(0),
++	//PWM
++	ILI9881C_COMMAND_INSTR(0x51, 0x0F),
++	ILI9881C_COMMAND_INSTR(0x52, 0xFF),
++	ILI9881C_COMMAND_INSTR(0x53, 0x2C),
++
++	ILI9881C_COMMAND_INSTR(0x11, 0x00),
++	ILI9881C_COMMAND_INSTR(0x29, 0x00),
++	ILI9881C_COMMAND_INSTR(0x35, 0x00),
++};
++
+ static const struct ili9881c_instr w552946ab_init[] = {
+ 	ILI9881C_SWITCH_PAGE_INSTR(3),
+ 	ILI9881C_COMMAND_INSTR(0x01, 0x00),
+@@ -813,6 +1037,23 @@ static const struct drm_display_mode k10
+ 	.height_mm	= 217,
+ };
+ 
++static const struct drm_display_mode nwe080_default_mode = {
++	.clock 		= 71750,
++
++	.hdisplay	= 800,
++	.hsync_start	= 800 + 52,
++	.hsync_end	= 800 + 52 + 8,
++	.htotal		= 800 + 52 + 8 + 48,
++
++	.vdisplay	= 1280,
++	.vsync_start	= 1280 + 16,
++	.vsync_end	= 1280 + 16 + 6,
++	.vtotal		= 1280 + 16 + 6 + 15,
++
++	.width_mm 	= 107,
++	.height_mm 	= 170,
++};
++
+ static const struct drm_display_mode w552946aba_default_mode = {
+ 	.clock		= 64000,
+ 
+@@ -945,6 +1186,13 @@ static const struct ili9881c_desc k101_i
+ 	.mode_flags = MIPI_DSI_MODE_VIDEO_SYNC_PULSE,
+ };
+ 
++static const struct ili9881c_desc nwe080_desc = {
++	.init = nwe080_init,
++	.init_length = ARRAY_SIZE(nwe080_init),
++	.mode = &nwe080_default_mode,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_SYNC_PULSE | MIPI_DSI_MODE_VIDEO,
++};
++
+ static const struct ili9881c_desc w552946aba_desc = {
+ 	.init = w552946ab_init,
+ 	.init_length = ARRAY_SIZE(w552946ab_init),
+@@ -956,6 +1204,7 @@ static const struct ili9881c_desc w55294
+ static const struct of_device_id ili9881c_of_match[] = {
+ 	{ .compatible = "bananapi,lhr050h41", .data = &lhr050h41_desc },
+ 	{ .compatible = "feixin,k101-im2byl02", .data = &k101_im2byl02_desc },
++	{ .compatible = "nwe,nwe080", .data = &nwe080_desc },
+ 	{ .compatible = "wanchanglong,w552946aba", .data = &w552946aba_desc },
+ 	{ }
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0376-media-bcm2835-unicam-Set-ret-on-error-path-in-unicam.patch b/target/linux/bcm27xx/patches-6.1/950-0376-media-bcm2835-unicam-Set-ret-on-error-path-in-unicam.patch
new file mode 100644
index 00000000000000..e604817c908027
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0376-media-bcm2835-unicam-Set-ret-on-error-path-in-unicam.patch
@@ -0,0 +1,43 @@
+From 7104c55664bae574b77e442520513abdff90d278 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Mon, 31 Jan 2022 17:23:38 -0700
+Subject: [PATCH] media: bcm2835-unicam: Set ret on error path in
+ unicam_async_complete()
+
+Clang warns:
+
+  drivers/media/platform/bcm2835/bcm2835-unicam.c:3109:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
+          if (!source_pads) {
+              ^~~~~~~~~~~~
+  drivers/media/platform/bcm2835/bcm2835-unicam.c:3152:9: note: uninitialized use occurs here
+          return ret;
+                 ^~~
+  drivers/media/platform/bcm2835/bcm2835-unicam.c:3109:2: note: remove the 'if' if its condition is always false
+          if (!source_pads) {
+          ^~~~~~~~~~~~~~~~~~~
+  drivers/media/platform/bcm2835/bcm2835-unicam.c:3091:9: note: initialize the variable 'ret' to silence this warning
+          int ret;
+                 ^
+                  = 0
+  1 warning generated.
+
+When the if condition is true, ret will be used uninitialized, which
+could result in undesirable behavior. Set ret to -ENODEV on the error
+path, which is a standard error code for the ->complete() callback.
+
+Fixes: d056e86eb35f ("media/bcm2835-unicam: Parse pad numbers correctly")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -3108,6 +3108,7 @@ static int unicam_async_complete(struct
+ 	}
+ 	if (!source_pads) {
+ 		unicam_err(unicam, "No source pads on sensor.\n");
++		ret = -ENODEV;
+ 		goto unregister;
+ 	}
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0377-media-i2c-ov9281-Initialize-id_msb-to-zero-in-ov9281.patch b/target/linux/bcm27xx/patches-6.1/950-0377-media-i2c-ov9281-Initialize-id_msb-to-zero-in-ov9281.patch
new file mode 100644
index 00000000000000..a27ed1f25ed31f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0377-media-i2c-ov9281-Initialize-id_msb-to-zero-in-ov9281.patch
@@ -0,0 +1,48 @@
+From 49036d4ab54259a8fa8c1511a7024ed95d68037d Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Mon, 31 Jan 2022 17:50:43 -0700
+Subject: [PATCH] media: i2c: ov9281: Initialize id_msb to zero in
+ ov9281_check_sensor_id()
+
+Clang warns:
+
+  drivers/media/i2c/ov9281.c:1132:6: warning: variable 'id_msb' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized]
+          if (!ret)
+              ^~~~
+  drivers/media/i2c/ov9281.c:1135:9: note: uninitialized use occurs here
+          id |= (id_msb << 8);
+                 ^~~~~~
+  drivers/media/i2c/ov9281.c:1132:2: note: remove the 'if' if its condition is always true
+          if (!ret)
+          ^~~~~~~~~
+  drivers/media/i2c/ov9281.c:1127:20: note: initialize the variable 'id_msb' to silence this warning
+          u32 id = 0, id_msb;
+                            ^
+                             = 0
+  1 warning generated.
+
+If the first ov9281_read_reg() call fails, id_msb will be used
+uninitialized. However, this warning does not actually matter in
+practice because the value of id is not used when either call to
+ov9281_read_reg() fails, as the boolean OR will short circuit due to the
+ret condition being checked first. Regardless, it is not good to use
+variables uninitialized so silence the warning by initializing id_msb to
+0, as was done with id.
+
+Fixes: 20855581e0eb ("media: i2c: ov9281: Read chip ID via 2 reads")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+---
+ drivers/media/i2c/ov9281.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/ov9281.c
++++ b/drivers/media/i2c/ov9281.c
+@@ -1124,7 +1124,7 @@ static int ov9281_check_sensor_id(struct
+ 				  struct i2c_client *client)
+ {
+ 	struct device *dev = &ov9281->client->dev;
+-	u32 id = 0, id_msb;
++	u32 id = 0, id_msb = 0;
+ 	int ret;
+ 
+ 	ret = ov9281_read_reg(client, OV9281_REG_CHIP_ID + 1,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0378-i2c-bcm2835-Make-clock-stretch-timeout-configurable.patch b/target/linux/bcm27xx/patches-6.1/950-0378-i2c-bcm2835-Make-clock-stretch-timeout-configurable.patch
new file mode 100644
index 00000000000000..97131e77a2ae00
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0378-i2c-bcm2835-Make-clock-stretch-timeout-configurable.patch
@@ -0,0 +1,44 @@
+From 622a9f1ce0c53f661bd323fa3e3b071f5a3733b5 Mon Sep 17 00:00:00 2001
+From: Alex Crawford <raspberrypi/linux@code.acrawford.com>
+Date: Fri, 28 Jan 2022 13:36:51 -0800
+Subject: [PATCH] i2c: bcm2835: Make clock-stretch timeout configurable
+
+The default clock-stretch timeout is 35 mS, which works well for
+SMBus, but there are some I2C devices which can stretch the clock even
+longer. Rather than trying to prescribe a safe default for everyone,
+allow the timeout to be configured.
+
+Signed-off-by: Alex Crawford <raspberrypi/linux@code.acrawford.com>
+---
+ drivers/i2c/busses/i2c-bcm2835.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-bcm2835.c
++++ b/drivers/i2c/busses/i2c-bcm2835.c
+@@ -60,6 +60,10 @@ static unsigned int debug;
+ module_param(debug, uint, 0644);
+ MODULE_PARM_DESC(debug, "1=err, 2=isr, 3=xfer");
+ 
++static unsigned int clk_tout_ms = 35; /* SMBUs-recommended 35ms */
++module_param(clk_tout_ms, uint, 0644);
++MODULE_PARM_DESC(clk_tout_ms, "clock-stretch timeout (mS)");
++
+ #define BCM2835_DEBUG_MAX	512
+ struct bcm2835_debug {
+ 	struct i2c_msg *msg;
+@@ -219,12 +223,12 @@ static int clk_bcm2835_i2c_set_rate(stru
+ 			   (redl << BCM2835_I2C_REDL_SHIFT));
+ 
+ 	/*
+-	 * Set the clock stretch timeout to the SMBUs-recommended 35ms.
++	 * Set the clock stretch timeout.
+ 	 */
+-	if (rate > 0xffff*1000/35)
++	if (rate > 0xffff*1000/clk_tout_ms)
+ 	    clk_tout = 0xffff;
+ 	else
+-	    clk_tout = 35*rate/1000;
++	    clk_tout = clk_tout_ms*rate/1000;
+ 
+ 	bcm2835_i2c_writel(div->i2c_dev, BCM2835_I2C_CLKT, clk_tout);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0379-Patching-lan78xx-for-SOF_TIMESTAMPING_TX_SOFTWARE-su.patch b/target/linux/bcm27xx/patches-6.1/950-0379-Patching-lan78xx-for-SOF_TIMESTAMPING_TX_SOFTWARE-su.patch
new file mode 100644
index 00000000000000..2d5c962d23eeca
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0379-Patching-lan78xx-for-SOF_TIMESTAMPING_TX_SOFTWARE-su.patch
@@ -0,0 +1,20 @@
+From d0916eacc78777e9b87f686e0de64dd09540621b Mon Sep 17 00:00:00 2001
+From: tiagofreire-pt <41837236+tiagofreire-pt@users.noreply.github.com>
+Date: Sat, 29 Jan 2022 10:01:36 +0000
+Subject: [PATCH] Patching lan78xx for SOF_TIMESTAMPING_TX_SOFTWARE
+ support
+
+---
+ drivers/net/usb/lan78xx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -1953,6 +1953,7 @@ static const struct ethtool_ops lan78xx_
+ 	.set_link_ksettings = lan78xx_set_link_ksettings,
+ 	.get_regs_len	= lan78xx_get_regs_len,
+ 	.get_regs	= lan78xx_get_regs,
++	.get_ts_info    = ethtool_op_get_ts_info,
+ };
+ 
+ static void lan78xx_init_mac_address(struct lan78xx_net *dev)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0380-media-uapi-Document-format-MEDIA_BUS_FMT_RGB565_1X24.patch b/target/linux/bcm27xx/patches-6.1/950-0380-media-uapi-Document-format-MEDIA_BUS_FMT_RGB565_1X24.patch
new file mode 100644
index 00000000000000..68fface7ae0f4b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0380-media-uapi-Document-format-MEDIA_BUS_FMT_RGB565_1X24.patch
@@ -0,0 +1,60 @@
+From 11858fa85265b2c9918ed60941926c200f3e3866 Mon Sep 17 00:00:00 2001
+From: Chris Morgan <macromorgan@hotmail.com>
+Date: Fri, 28 Jan 2022 17:37:43 -0600
+Subject: [PATCH] media: uapi: Document format
+ MEDIA_BUS_FMT_RGB565_1X24_CPADHI
+
+Add support for MEDIA_BUS_FMT_RGB565_1X24_CPADHI. This format is used
+by the Geekworm MZP280 panel which interfaces with the Raspberry Pi.
+
+Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
+---
+ .../media/v4l/subdev-formats.rst              | 37 +++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+--- a/Documentation/userspace-api/media/v4l/subdev-formats.rst
++++ b/Documentation/userspace-api/media/v4l/subdev-formats.rst
+@@ -624,6 +624,43 @@ The following tables list existing packe
+       - b\ :sub:`2`
+       - b\ :sub:`1`
+       - b\ :sub:`0`
++    * .. _MEDIA_BUS_FMT_RGB565_1X24_CPADHI:
++
++      - MEDIA_BUS_FMT_RGB565_1X24_CPADHI
++      - 0x1020
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      - 0
++      - 0
++      - 0
++      - r\ :sub:`4`
++      - r\ :sub:`3`
++      - r\ :sub:`2`
++      - r\ :sub:`1`
++      - r\ :sub:`0`
++      - 0
++      - 0
++      - g\ :sub:`5`
++      - g\ :sub:`4`
++      - g\ :sub:`3`
++      - g\ :sub:`2`
++      - g\ :sub:`1`
++      - g\ :sub:`0`
++      - 0
++      - 0
++      - 0
++      - b\ :sub:`4`
++      - b\ :sub:`3`
++      - b\ :sub:`2`
++      - b\ :sub:`1`
++      - b\ :sub:`0`
+     * .. _MEDIA-BUS-FMT-BGR565-2X8-BE:
+ 
+       - MEDIA_BUS_FMT_BGR565_2X8_BE
diff --git a/target/linux/bcm27xx/patches-6.1/950-0381-dt-bindings-vendor-prefixes-Add-Geekworm.patch b/target/linux/bcm27xx/patches-6.1/950-0381-dt-bindings-vendor-prefixes-Add-Geekworm.patch
new file mode 100644
index 00000000000000..63fc078e84d152
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0381-dt-bindings-vendor-prefixes-Add-Geekworm.patch
@@ -0,0 +1,23 @@
+From d7e2b470acddada015b8c048374cc528720c8b9a Mon Sep 17 00:00:00 2001
+From: Chris Morgan <macromorgan@hotmail.com>
+Date: Fri, 28 Jan 2022 17:40:50 -0600
+Subject: [PATCH] dt-bindings: vendor-prefixes: Add Geekworm
+
+Add vendor prefix for Geekworm (https://geekworm.com).
+
+Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
+---
+ Documentation/devicetree/bindings/vendor-prefixes.yaml | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/Documentation/devicetree/bindings/vendor-prefixes.yaml
++++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml
+@@ -484,6 +484,8 @@ patternProperties:
+     description: General Electric Company
+   "^geekbuying,.*":
+     description: GeekBuying
++  "^geekworm,.*":
++    description: Geekworm
+   "^gef,.*":
+     description: GE Fanuc Intelligent Platforms Embedded Systems, Inc.
+   "^GEFanuc,.*":
diff --git a/target/linux/bcm27xx/patches-6.1/950-0382-dt-bindings-display-simple-add-Geekworm-MZP280-Panel.patch b/target/linux/bcm27xx/patches-6.1/950-0382-dt-bindings-display-simple-add-Geekworm-MZP280-Panel.patch
new file mode 100644
index 00000000000000..cc127a3aa115b7
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0382-dt-bindings-display-simple-add-Geekworm-MZP280-Panel.patch
@@ -0,0 +1,34 @@
+From 041fb70fa6ddea179c915878cf365b28e9b814d9 Mon Sep 17 00:00:00 2001
+From: Chris Morgan <macromorgan@hotmail.com>
+Date: Fri, 28 Jan 2022 17:41:18 -0600
+Subject: [PATCH] dt-bindings: display: simple: add Geekworm MZP280
+ Panel
+
+The Geekworm MZP280 panel is a 480x640 (portrait) panel with a
+capacitive touch interface and a 40 pin header meant to interface
+directly with the Raspberry Pi. The screen is 2.8 inches diagonally,
+and there appear to be at least 4 distinct versions all with the same
+panel timings.
+
+Timings were derived from drivers posted on the github located here:
+https://github.com/tianyoujian/MZDPI/tree/master/vga
+
+Additional details about this panel family can be found here:
+https://wiki.geekworm.com/2.8_inch_Touch_Screen_for_Pi_zero
+
+Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
+---
+ .../devicetree/bindings/display/panel/panel-simple.yaml         | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/Documentation/devicetree/bindings/display/panel/panel-simple.yaml
++++ b/Documentation/devicetree/bindings/display/panel/panel-simple.yaml
+@@ -156,6 +156,8 @@ properties:
+       - frida,frd350h54004
+         # FriendlyELEC HD702E 800x1280 LCD panel
+       - friendlyarm,hd702e
++        # Geekworm MZP280 2.8" 480x640 LCD panel with capacitive touch
++      - geekworm,mzp280
+         # GiantPlus GPG48273QS5 4.3" (480x272) WQVGA TFT LCD panel
+       - giantplus,gpg48273qs5
+         # GiantPlus GPM940B0 3.0" QVGA TFT LCD panel
diff --git a/target/linux/bcm27xx/patches-6.1/950-0383-drm-panel-simple-add-Geekworm-MZP280-Panel.patch b/target/linux/bcm27xx/patches-6.1/950-0383-drm-panel-simple-add-Geekworm-MZP280-Panel.patch
new file mode 100644
index 00000000000000..dfa2e67b70af7c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0383-drm-panel-simple-add-Geekworm-MZP280-Panel.patch
@@ -0,0 +1,58 @@
+From 93e97366535209b281dce980b4d78362f25bb34c Mon Sep 17 00:00:00 2001
+From: Chris Morgan <macromorgan@hotmail.com>
+Date: Fri, 28 Jan 2022 17:42:12 -0600
+Subject: [PATCH] drm/panel: simple: add Geekworm MZP280 Panel
+
+Add support for the Geekworm MZP280 Panel
+
+Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
+Acked-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 29 ++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -1944,6 +1944,32 @@ static const struct panel_desc friendlya
+ 	},
+ };
+ 
++static const struct drm_display_mode geekworm_mzp280_mode = {
++	.clock = 32000,
++	.hdisplay = 480,
++	.hsync_start = 480 + 41,
++	.hsync_end = 480 + 41 + 20,
++	.htotal = 480 + 41 + 20 + 60,
++	.vdisplay = 640,
++	.vsync_start = 640 + 5,
++	.vsync_end = 640 + 5 + 10,
++	.vtotal = 640 + 5 + 10 + 10,
++	.flags = DRM_MODE_FLAG_NVSYNC | DRM_MODE_FLAG_NHSYNC,
++};
++
++static const struct panel_desc geekworm_mzp280 = {
++	.modes = &geekworm_mzp280_mode,
++	.num_modes = 1,
++	.bpc = 6,
++	.size = {
++		.width = 47,
++		.height = 61,
++	},
++	.bus_format = MEDIA_BUS_FMT_RGB565_1X24_CPADHI,
++	.bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_NEGEDGE,
++	.connector_type = DRM_MODE_CONNECTOR_DPI,
++};
++
+ static const struct drm_display_mode giantplus_gpg482739qs5_mode = {
+ 	.clock = 9000,
+ 	.hdisplay = 480,
+@@ -4103,6 +4129,9 @@ static const struct of_device_id platfor
+ 		.compatible = "friendlyarm,hd702e",
+ 		.data = &friendlyarm_hd702e,
+ 	}, {
++		.compatible = "geekworm,mzp280",
++		.data = &geekworm_mzp280,
++	}, {
+ 		.compatible = "giantplus,gpg482739qs5",
+ 		.data = &giantplus_gpg482739qs5
+ 	}, {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0384-drm-panel-simple-Remove-custom-handling-of-orientati.patch b/target/linux/bcm27xx/patches-6.1/950-0384-drm-panel-simple-Remove-custom-handling-of-orientati.patch
new file mode 100644
index 00000000000000..179f5488801796
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0384-drm-panel-simple-Remove-custom-handling-of-orientati.patch
@@ -0,0 +1,51 @@
+From 948df06ed7f7a44da737aadcb8e9b2b6c1c35dbf Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 1 Feb 2022 12:24:51 +0000
+Subject: [PATCH] drm/panel: simple: Remove custom handling of
+ orientation
+
+Panel orientation is now handled by the drm_panel and
+panel_bridge frameworks, so remove the custom handling.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -154,8 +154,6 @@ struct panel_simple {
+ 	struct edid *edid;
+ 
+ 	struct drm_display_mode override_mode;
+-
+-	enum drm_panel_orientation orientation;
+ };
+ 
+ static inline struct panel_simple *to_panel_simple(struct drm_panel *panel)
+@@ -414,12 +412,6 @@ static int panel_simple_get_modes(struct
+ 	/* add hard-coded panel modes */
+ 	num += panel_simple_get_non_edid_modes(p, connector);
+ 
+-	/*
+-	 * TODO: Remove once all drm drivers call
+-	 * drm_connector_set_orientation_from_panel()
+-	 */
+-	drm_connector_set_panel_orientation(connector, p->orientation);
+-
+ 	return num;
+ }
+ 
+@@ -582,12 +574,6 @@ static int panel_simple_probe(struct dev
+ 		return dev_err_probe(dev, PTR_ERR(panel->enable_gpio),
+ 				     "failed to request GPIO\n");
+ 
+-	err = of_drm_get_panel_orientation(dev->of_node, &panel->orientation);
+-	if (err) {
+-		dev_err(dev, "%pOF: failed to get orientation %d\n", dev->of_node, err);
+-		return err;
+-	}
+-
+ 	ddc = of_parse_phandle(dev->of_node, "ddc-i2c-bus", 0);
+ 	if (ddc) {
+ 		panel->ddc = of_find_i2c_adapter_by_node(ddc);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0385-drm-panel-Add-panel-driver-for-Ilitek-ILI9806E-panel.patch b/target/linux/bcm27xx/patches-6.1/950-0385-drm-panel-Add-panel-driver-for-Ilitek-ILI9806E-panel.patch
new file mode 100644
index 00000000000000..8352cfe0661098
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0385-drm-panel-Add-panel-driver-for-Ilitek-ILI9806E-panel.patch
@@ -0,0 +1,535 @@
+From d7d0a974aad1ff44ee49feffe77b51e8183b953b Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 5 Jan 2022 19:14:48 +0000
+Subject: [PATCH] drm/panel: Add panel driver for Ilitek ILI9806E panel
+
+The Ilitek ILI9806E driver is used in the Pimoroni HyperPixel4
+and potentially other displays. Whilst it can support multiple
+interfaces, this driver only accounts for SPI configuration and
+DPI video data.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/panel/Kconfig                 |  11 +
+ drivers/gpu/drm/panel/Makefile                |   1 +
+ drivers/gpu/drm/panel/panel-ilitek-ili9806e.c | 484 ++++++++++++++++++
+ 3 files changed, 496 insertions(+)
+ create mode 100644 drivers/gpu/drm/panel/panel-ilitek-ili9806e.c
+
+--- a/drivers/gpu/drm/panel/Kconfig
++++ b/drivers/gpu/drm/panel/Kconfig
+@@ -174,6 +174,17 @@ config DRM_PANEL_ILITEK_ILI9341
+ 	  QVGA (240x320) RGB panels. support serial & parallel rgb
+ 	  interface.
+ 
++config DRM_PANEL_ILITEK_ILI9806E
++	tristate "Ilitek ILI9806E-based panels"
++	depends on OF && SPI
++	select DRM_KMS_HELPER
++	depends on DRM_GEM_CMA_HELPER
++	depends on BACKLIGHT_CLASS_DEVICE
++	select DRM_MIPI_DBI
++	help
++	  Say Y if you want to enable support for panels based on the
++	  Ilitek ILI9806e controller.
++
+ config DRM_PANEL_ILITEK_ILI9881C
+ 	tristate "Ilitek ILI9881C-based panels"
+ 	depends on OF
+--- a/drivers/gpu/drm/panel/Makefile
++++ b/drivers/gpu/drm/panel/Makefile
+@@ -15,6 +15,7 @@ obj-$(CONFIG_DRM_PANEL_FEIXIN_K101_IM2BA
+ obj-$(CONFIG_DRM_PANEL_FEIYANG_FY07024DI26A30D) += panel-feiyang-fy07024di26a30d.o
+ obj-$(CONFIG_DRM_PANEL_ILITEK_IL9322) += panel-ilitek-ili9322.o
+ obj-$(CONFIG_DRM_PANEL_ILITEK_ILI9341) += panel-ilitek-ili9341.o
++obj-$(CONFIG_DRM_PANEL_ILITEK_ILI9806E) += panel-ilitek-ili9806e.o
+ obj-$(CONFIG_DRM_PANEL_ILITEK_ILI9881C) += panel-ilitek-ili9881c.o
+ obj-$(CONFIG_DRM_PANEL_INNOLUX_EJ030NA) += panel-innolux-ej030na.o
+ obj-$(CONFIG_DRM_PANEL_INNOLUX_P079ZCA) += panel-innolux-p079zca.o
+--- /dev/null
++++ b/drivers/gpu/drm/panel/panel-ilitek-ili9806e.c
+@@ -0,0 +1,484 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Ilitek ILI9806E TFT LCD drm_panel driver.
++ *
++ * Copyright (C) 2022 Raspberry Pi Ltd
++ *
++ * Derived from drivers/drm/gpu/panel/panel-sitronix-st7789v.c
++ * Copyright (C) 2017 Free Electrons
++ */
++
++#include <drm/drm_modes.h>
++#include <drm/drm_panel.h>
++
++#include <linux/bitops.h>
++#include <linux/gpio/consumer.h>
++#include <linux/media-bus-format.h>
++#include <linux/module.h>
++#include <linux/of_device.h>
++#include <linux/regmap.h>
++#include <linux/regulator/consumer.h>
++#include <linux/spi/spi.h>
++
++#include <video/mipi_display.h>
++#include <video/of_videomode.h>
++#include <video/videomode.h>
++
++struct ili9806 {
++	struct drm_panel panel;
++	struct spi_device *spi;
++	struct gpio_desc *reset;
++	struct regulator *power;
++	u32 bus_format;
++};
++
++#define ILI9806_DATA		BIT(8)
++
++#define ILI9806_MAX_MSG_LEN	6
++
++struct ili9806e_msg {
++	unsigned int len;
++	u16 msg[ILI9806_MAX_MSG_LEN];
++};
++
++#define ILI9806_SET_PAGE(page)	\
++	{				\
++		.len = 6,		\
++		.msg = {		\
++			0xFF,			\
++			ILI9806_DATA | 0xFF,	\
++			ILI9806_DATA | 0x98,	\
++			ILI9806_DATA | 0x06,	\
++			ILI9806_DATA | 0x04,	\
++			ILI9806_DATA | (page)	\
++		},				\
++	}
++
++#define ILI9806_SET_REG_PARAM(reg, data)	\
++	{					\
++		.len = 2,			\
++		.msg = {			\
++			(reg),			\
++			ILI9806_DATA | (data),	\
++		},				\
++	}
++
++#define ILI9806_SET_REG(reg)	\
++	{				\
++		.len = 1,		\
++		.msg = { (reg) },		\
++	}
++
++static const struct ili9806e_msg panel_init[] = {
++	ILI9806_SET_PAGE(1),
++
++	/* interface mode
++	 *   SEPT_SDIO = 0 (spi interface transfer through SDA pin)
++	 *   SDO_STATUS = 1 (always output, but without output tri-state)
++	 */
++	ILI9806_SET_REG_PARAM(0x08, 0x10),
++	/* display control
++	 * VSPL = 1 (vertical sync polarity)
++	 * HSPL = 0 (horizontal sync polarity)
++	 * DPL = 0 (PCLK polarity)
++	 * EPL = 1 (data enable polarity)
++	 */
++	ILI9806_SET_REG_PARAM(0x21, 0x0d),
++	/* resolution control (0x02 = 480x800) */
++	ILI9806_SET_REG_PARAM(0x30, 0x02),
++	/* display inversion control (0x00 = column inversion) */
++	ILI9806_SET_REG_PARAM(0x31, 0x00),
++	/* power control
++	 *  EXB1T = 0 (internal charge pump)
++	 *  EXT_CPCK_SEL = 1 (pump clock control signal = output 2 x waveform)
++	 *  BT = 0 (DDVDH / DDVDL voltage = VCI x 2 / VCI x -2)
++	 */
++	ILI9806_SET_REG_PARAM(0x40, 0x10),
++	/* power control
++	 *  DDVDH_CLP = 5.6 (DDVDH clamp leve)
++	 *  DDVDL_CLP = -5.6 (DDVDL clamp leve)
++	 */
++	ILI9806_SET_REG_PARAM(0x41, 0x55),
++	/* power control
++	 *  VGH_CP = 2DDVDH - DDVDL (step up factor for VGH)
++	 *  VGL_CP = DDVDL + VCL - VCIP (step up factor for VGL)
++	 */
++	ILI9806_SET_REG_PARAM(0x42, 0x02),
++	/* power control
++	 *  VGH_CLPEN = 0 (disable VGH clamp level)
++	 *  VGH_CLP = 9 (15.0 VGH clamp level - but this is disabled so not used?)
++	 */
++	ILI9806_SET_REG_PARAM(0x43, 0x84),
++	/* power control
++	 *  VGL_CLPEN = 0 (disable VGL clamp level)
++	 *  VGL_CLP = 9 (-11.0 VGL clamp level - but this is disabled so not used?)
++	 */
++	ILI9806_SET_REG_PARAM(0x44, 0x84),
++
++	/* power control
++	 *  VREG1OUT voltage for positive gamma?
++	 */
++	ILI9806_SET_REG_PARAM(0x50, 0x78),
++	/* power control
++	 *  VREG2OUT voltage for negative gamma?
++	 */
++	ILI9806_SET_REG_PARAM(0x51, 0x78),
++
++	ILI9806_SET_REG_PARAM(0x52, 0x00),
++	ILI9806_SET_REG_PARAM(0x53, 0x77),
++	ILI9806_SET_REG_PARAM(0x57, 0x60),
++	ILI9806_SET_REG_PARAM(0x60, 0x07),
++	ILI9806_SET_REG_PARAM(0x61, 0x00),
++	ILI9806_SET_REG_PARAM(0x62, 0x08),
++	ILI9806_SET_REG_PARAM(0x63, 0x00),
++	ILI9806_SET_REG_PARAM(0xA0, 0x00),
++	ILI9806_SET_REG_PARAM(0xA1, 0x07),
++	ILI9806_SET_REG_PARAM(0xA2, 0x0C),
++	ILI9806_SET_REG_PARAM(0xA3, 0x0B),
++	ILI9806_SET_REG_PARAM(0xA4, 0x03),
++	ILI9806_SET_REG_PARAM(0xA5, 0x07),
++	ILI9806_SET_REG_PARAM(0xA6, 0x06),
++	ILI9806_SET_REG_PARAM(0xA7, 0x04),
++	ILI9806_SET_REG_PARAM(0xA8, 0x08),
++	ILI9806_SET_REG_PARAM(0xA9, 0x0C),
++	ILI9806_SET_REG_PARAM(0xAA, 0x13),
++	ILI9806_SET_REG_PARAM(0xAB, 0x06),
++	ILI9806_SET_REG_PARAM(0xAC, 0x0D),
++	ILI9806_SET_REG_PARAM(0xAD, 0x19),
++	ILI9806_SET_REG_PARAM(0xAE, 0x10),
++	ILI9806_SET_REG_PARAM(0xAF, 0x00),
++	/* negative gamma control
++	 * set the gray scale voltage to adjust the gamma characteristics of the panel
++	 */
++	ILI9806_SET_REG_PARAM(0xC0, 0x00),
++	ILI9806_SET_REG_PARAM(0xC1, 0x07),
++	ILI9806_SET_REG_PARAM(0xC2, 0x0C),
++	ILI9806_SET_REG_PARAM(0xC3, 0x0B),
++	ILI9806_SET_REG_PARAM(0xC4, 0x03),
++	ILI9806_SET_REG_PARAM(0xC5, 0x07),
++	ILI9806_SET_REG_PARAM(0xC6, 0x07),
++	ILI9806_SET_REG_PARAM(0xC7, 0x04),
++	ILI9806_SET_REG_PARAM(0xC8, 0x08),
++	ILI9806_SET_REG_PARAM(0xC9, 0x0C),
++	ILI9806_SET_REG_PARAM(0xCA, 0x13),
++	ILI9806_SET_REG_PARAM(0xCB, 0x06),
++	ILI9806_SET_REG_PARAM(0xCC, 0x0D),
++	ILI9806_SET_REG_PARAM(0xCD, 0x18),
++	ILI9806_SET_REG_PARAM(0xCE, 0x10),
++	ILI9806_SET_REG_PARAM(0xCF, 0x00),
++
++	ILI9806_SET_PAGE(6),
++
++	ILI9806_SET_REG_PARAM(0x00, 0x20),
++	ILI9806_SET_REG_PARAM(0x01, 0x0A),
++	ILI9806_SET_REG_PARAM(0x02, 0x00),
++	ILI9806_SET_REG_PARAM(0x03, 0x00),
++	ILI9806_SET_REG_PARAM(0x04, 0x01),
++	ILI9806_SET_REG_PARAM(0x05, 0x01),
++	ILI9806_SET_REG_PARAM(0x06, 0x98),
++	ILI9806_SET_REG_PARAM(0x07, 0x06),
++	ILI9806_SET_REG_PARAM(0x08, 0x01),
++	ILI9806_SET_REG_PARAM(0x09, 0x80),
++	ILI9806_SET_REG_PARAM(0x0A, 0x00),
++	ILI9806_SET_REG_PARAM(0x0B, 0x00),
++	ILI9806_SET_REG_PARAM(0x0C, 0x01),
++	ILI9806_SET_REG_PARAM(0x0D, 0x01),
++	ILI9806_SET_REG_PARAM(0x0E, 0x00),
++	ILI9806_SET_REG_PARAM(0x0F, 0x00),
++	ILI9806_SET_REG_PARAM(0x10, 0xF0),
++	ILI9806_SET_REG_PARAM(0x11, 0xF4),
++	ILI9806_SET_REG_PARAM(0x12, 0x01),
++	ILI9806_SET_REG_PARAM(0x13, 0x00),
++	ILI9806_SET_REG_PARAM(0x14, 0x00),
++	ILI9806_SET_REG_PARAM(0x15, 0xC0),
++	ILI9806_SET_REG_PARAM(0x16, 0x08),
++	ILI9806_SET_REG_PARAM(0x17, 0x00),
++	ILI9806_SET_REG_PARAM(0x18, 0x00),
++	ILI9806_SET_REG_PARAM(0x19, 0x00),
++	ILI9806_SET_REG_PARAM(0x1A, 0x00),
++	ILI9806_SET_REG_PARAM(0x1B, 0x00),
++	ILI9806_SET_REG_PARAM(0x1C, 0x00),
++	ILI9806_SET_REG_PARAM(0x1D, 0x00),
++	ILI9806_SET_REG_PARAM(0x20, 0x01),
++	ILI9806_SET_REG_PARAM(0x21, 0x23),
++	ILI9806_SET_REG_PARAM(0x22, 0x45),
++	ILI9806_SET_REG_PARAM(0x23, 0x67),
++	ILI9806_SET_REG_PARAM(0x24, 0x01),
++	ILI9806_SET_REG_PARAM(0x25, 0x23),
++	ILI9806_SET_REG_PARAM(0x26, 0x45),
++	ILI9806_SET_REG_PARAM(0x27, 0x67),
++	ILI9806_SET_REG_PARAM(0x30, 0x11),
++	ILI9806_SET_REG_PARAM(0x31, 0x11),
++	ILI9806_SET_REG_PARAM(0x32, 0x00),
++	ILI9806_SET_REG_PARAM(0x33, 0xEE),
++	ILI9806_SET_REG_PARAM(0x34, 0xFF),
++	ILI9806_SET_REG_PARAM(0x35, 0xBB),
++	ILI9806_SET_REG_PARAM(0x36, 0xAA),
++	ILI9806_SET_REG_PARAM(0x37, 0xDD),
++	ILI9806_SET_REG_PARAM(0x38, 0xCC),
++	ILI9806_SET_REG_PARAM(0x39, 0x66),
++	ILI9806_SET_REG_PARAM(0x3A, 0x77),
++	ILI9806_SET_REG_PARAM(0x3B, 0x22),
++	ILI9806_SET_REG_PARAM(0x3C, 0x22),
++	ILI9806_SET_REG_PARAM(0x3D, 0x22),
++	ILI9806_SET_REG_PARAM(0x3E, 0x22),
++	ILI9806_SET_REG_PARAM(0x3F, 0x22),
++	ILI9806_SET_REG_PARAM(0x40, 0x22),
++	/* register doesn't exist on page 6? */
++	ILI9806_SET_REG_PARAM(0x52, 0x10),
++	/* doesn't make sense, not valid according to datasheet */
++	ILI9806_SET_REG_PARAM(0x53, 0x10),
++	/* doesn't make sense, not valid according to datasheet */
++	ILI9806_SET_REG_PARAM(0x54, 0x13),
++
++	ILI9806_SET_PAGE(7),
++
++	/* enable VREG */
++	ILI9806_SET_REG_PARAM(0x18, 0x1D),
++	/* enable VGL_REG */
++	ILI9806_SET_REG_PARAM(0x17, 0x22),
++	/* register doesn't exist on page 7? */
++	ILI9806_SET_REG_PARAM(0x02, 0x77),
++	/* register doesn't exist on page 7? */
++	ILI9806_SET_REG_PARAM(0x26, 0xB2),
++	/* register doesn't exist on page 7? */
++	ILI9806_SET_REG_PARAM(0xE1, 0x79),
++
++	ILI9806_SET_PAGE(0),
++
++	ILI9806_SET_REG_PARAM(MIPI_DCS_SET_PIXEL_FORMAT,
++			      MIPI_DCS_PIXEL_FMT_18BIT << 4),
++	ILI9806_SET_REG_PARAM(MIPI_DCS_SET_TEAR_ON, 0x00),
++	ILI9806_SET_REG(MIPI_DCS_EXIT_SLEEP_MODE),
++};
++
++#define NUM_INIT_REGS ARRAY_SIZE(panel_init)
++
++static inline struct ili9806 *panel_to_ili9806(struct drm_panel *panel)
++{
++	return container_of(panel, struct ili9806, panel);
++}
++
++static int ili9806_write_msg(struct ili9806 *ctx, const struct ili9806e_msg *msg)
++{
++	struct spi_transfer xfer = { };
++	struct spi_message spi;
++	//u16 txbuf[] = { msg->, ILI9806_DATA | data };
++
++	spi_message_init(&spi);
++
++	xfer.tx_buf = msg->msg;
++	xfer.bits_per_word = 9;
++	xfer.len = sizeof(u16) * msg->len;
++
++	spi_message_add_tail(&xfer, &spi);
++	return spi_sync(ctx->spi, &spi);
++}
++
++static int ili9806e_write_msg_list(struct ili9806 *ctx,
++				   const struct ili9806e_msg msgs[],
++				   unsigned int num_msgs)
++{
++	int ret, i;
++
++	for (i = 0; i < num_msgs; i++) {
++		ret = ili9806_write_msg(ctx, &msgs[i]);
++		if (ret)
++			break;
++	}
++
++	return ret;
++}
++
++static const struct drm_display_mode ili9806e_480x800_mode = {
++	.clock = 32000,
++	.hdisplay = 480,
++	.hsync_start = 480 + 10,
++	.hsync_end = 480 + 10 + 16,
++	.htotal = 480 + 10 + 16 + 59,
++	.vdisplay = 800,
++	.vsync_start = 800 + 15,
++	.vsync_end = 800 + 15 + 113,
++	.vtotal = 800 + 15 + 113 + 15,
++	.flags = DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC,
++};
++
++static int ili9806_get_modes(struct drm_panel *panel,
++			     struct drm_connector *connector)
++{
++	struct ili9806 *ctx = panel_to_ili9806(panel);
++	struct drm_display_mode *mode;
++
++	mode = drm_mode_duplicate(connector->dev, &ili9806e_480x800_mode);
++	if (!mode) {
++		dev_err(panel->dev, "failed to add mode %ux%ux@%u\n",
++			ili9806e_480x800_mode.hdisplay,
++			ili9806e_480x800_mode.vdisplay,
++			drm_mode_vrefresh(&ili9806e_480x800_mode));
++		return -ENOMEM;
++	}
++
++	drm_mode_set_name(mode);
++
++	mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
++	drm_mode_probed_add(connector, mode);
++
++	connector->display_info.width_mm = 61;
++	connector->display_info.height_mm = 103;
++	drm_display_info_set_bus_formats(&connector->display_info,
++					 &ctx->bus_format, 1);
++	connector->display_info.bus_flags =
++					DRM_BUS_FLAG_PIXDATA_DRIVE_NEGEDGE;
++
++	return 1;
++}
++
++static int ili9806_prepare(struct drm_panel *panel)
++{
++	struct ili9806 *ctx = panel_to_ili9806(panel);
++	int ret;
++
++	ret = regulator_enable(ctx->power);
++	if (ret)
++		return ret;
++
++	ret = ili9806e_write_msg_list(ctx, panel_init, NUM_INIT_REGS);
++
++	return ret;
++}
++
++static int ili9806_enable(struct drm_panel *panel)
++{
++	struct ili9806 *ctx = panel_to_ili9806(panel);
++	const struct ili9806e_msg msg = ILI9806_SET_REG(MIPI_DCS_SET_DISPLAY_ON);
++	int ret;
++
++	ret = ili9806_write_msg(ctx, &msg);
++
++	return ret;
++}
++
++static int ili9806_disable(struct drm_panel *panel)
++{
++	struct ili9806 *ctx = panel_to_ili9806(panel);
++	const struct ili9806e_msg msg = ILI9806_SET_REG(MIPI_DCS_SET_DISPLAY_OFF);
++	int ret;
++
++	ret = ili9806_write_msg(ctx, &msg);
++
++	return ret;
++}
++
++static int ili9806_unprepare(struct drm_panel *panel)
++{
++	struct ili9806 *ctx = panel_to_ili9806(panel);
++	const struct ili9806e_msg msg = ILI9806_SET_REG(MIPI_DCS_ENTER_SLEEP_MODE);
++	int ret;
++
++	ret = ili9806_write_msg(ctx, &msg);
++
++	return ret;
++}
++
++static const struct drm_panel_funcs ili9806_drm_funcs = {
++	.disable	= ili9806_disable,
++	.enable		= ili9806_enable,
++	.get_modes	= ili9806_get_modes,
++	.prepare	= ili9806_prepare,
++	.unprepare	= ili9806_unprepare,
++};
++
++static const struct of_device_id ili9806_of_match[] = {
++	{	.compatible = "txw,txw397017s2",
++		.data = (void *)MEDIA_BUS_FMT_RGB888_1X24,
++	}, {
++		.compatible = "pimoroni,hyperpixel4",
++		.data = (void *)MEDIA_BUS_FMT_RGB666_1X24_CPADHI,
++	}, {
++		.compatible = "ilitek,ili9806e",
++		.data = (void *)MEDIA_BUS_FMT_RGB888_1X24,
++	}, {
++		/* sentinel */
++	}
++};
++MODULE_DEVICE_TABLE(of, ili9806_of_match);
++
++static int ili9806_probe(struct spi_device *spi)
++{
++	const struct ili9806e_msg panel_reset[] = {
++		ILI9806_SET_PAGE(0),
++		ILI9806_SET_REG_PARAM(0x01, 0x00)
++	};
++	const struct of_device_id *id;
++	struct ili9806 *ctx;
++	int ret;
++
++	ctx = devm_kzalloc(&spi->dev, sizeof(*ctx), GFP_KERNEL);
++	if (!ctx)
++		return -ENOMEM;
++
++	id = of_match_node(ili9806_of_match, spi->dev.of_node);
++	if (!id)
++		return -ENODEV;
++
++	ctx->bus_format = (u32)(uintptr_t)id->data;
++
++	spi_set_drvdata(spi, ctx);
++	ctx->spi = spi;
++
++	drm_panel_init(&ctx->panel, &spi->dev, &ili9806_drm_funcs,
++		       DRM_MODE_CONNECTOR_DPI);
++
++	ctx->power = devm_regulator_get(&spi->dev, "power");
++	if (IS_ERR(ctx->power))
++		return PTR_ERR(ctx->power);
++
++	ctx->reset = devm_gpiod_get_optional(&spi->dev, "reset", GPIOD_OUT_LOW);
++	if (IS_ERR(ctx->reset)) {
++		dev_err(&spi->dev, "Couldn't get our reset line\n");
++		return PTR_ERR(ctx->reset);
++	}
++
++	/* Soft reset */
++	ili9806e_write_msg_list(ctx, panel_reset, ARRAY_SIZE(panel_reset));
++	msleep(200);
++
++	ret = drm_panel_of_backlight(&ctx->panel);
++	if (ret)
++		return ret;
++
++	drm_panel_add(&ctx->panel);
++
++	return 0;
++}
++
++static void ili9806_remove(struct spi_device *spi)
++{
++	struct ili9806 *ctx = spi_get_drvdata(spi);
++
++	drm_panel_remove(&ctx->panel);
++}
++
++static const struct spi_device_id ili9806_ids[] = {
++	{ "txw397017s2", 0 },
++	{ "ili9806e", 0 },
++	{ "hyperpixel4", 0 },
++	{ /* sentinel */ }
++};
++
++MODULE_DEVICE_TABLE(spi, ili9806_ids);
++
++static struct spi_driver ili9806_driver = {
++	.probe = ili9806_probe,
++	.remove = ili9806_remove,
++	.driver = {
++		.name = "ili9806e",
++		.of_match_table = ili9806_of_match,
++	},
++	.id_table = ili9806_ids,
++};
++module_spi_driver(ili9806_driver);
++
++MODULE_AUTHOR("Dave Stevenson <dave.stevenson@raspberrypi.com>");
++MODULE_DESCRIPTION("ili9806 LCD panel driver");
++MODULE_LICENSE("GPL v2");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0386-drm-panel-Add-panel-driver-for-TDO-Y17B-based-panels.patch b/target/linux/bcm27xx/patches-6.1/950-0386-drm-panel-Add-panel-driver-for-TDO-Y17B-based-panels.patch
new file mode 100644
index 00000000000000..9950e78e5dd1c9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0386-drm-panel-Add-panel-driver-for-TDO-Y17B-based-panels.patch
@@ -0,0 +1,329 @@
+From b74aec9ca440eb1ed2f48a3cc4ef471cd9c9d623 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 26 Jan 2022 16:02:31 +0000
+Subject: [PATCH] drm/panel: Add panel driver for TDO Y17B based panels
+
+The Top DisplayOptoelectronics (TDO) T17B driver chip is used
+in the TL040HDS20CT panel (found in the Pimoroni HyperPixel4
+Square display) and potentially other displays.
+The driver chip supports SPI for  configuration and DPI
+video data.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/panel/Kconfig          |  11 +
+ drivers/gpu/drm/panel/Makefile         |   1 +
+ drivers/gpu/drm/panel/panel-tdo-y17p.c | 277 +++++++++++++++++++++++++
+ 3 files changed, 289 insertions(+)
+ create mode 100644 drivers/gpu/drm/panel/panel-tdo-y17p.c
+
+--- a/drivers/gpu/drm/panel/Kconfig
++++ b/drivers/gpu/drm/panel/Kconfig
+@@ -669,6 +669,17 @@ config DRM_PANEL_TDO_TL070WSH30
+ 	  24 bit RGB per pixel. It provides a MIPI DSI interface to
+ 	  the host, a built-in LED backlight and touch controller.
+ 
++config DRM_PANEL_TPO_Y17P
++	tristate "TDO Y17P-based panels"
++	depends on OF && SPI
++	select DRM_KMS_HELPER
++	depends on DRM_GEM_CMA_HELPER
++	depends on BACKLIGHT_CLASS_DEVICE
++	select DRM_MIPI_DBI
++	help
++	  Say Y if you want to enable support for panels based on the
++	  TDO Y17P controller.
++
+ config DRM_PANEL_TPO_TD028TTEC1
+ 	tristate "Toppoly (TPO) TD028TTEC1 panel driver"
+ 	depends on OF && SPI
+--- a/drivers/gpu/drm/panel/Makefile
++++ b/drivers/gpu/drm/panel/Makefile
+@@ -67,6 +67,7 @@ obj-$(CONFIG_DRM_PANEL_SITRONIX_ST7789V)
+ obj-$(CONFIG_DRM_PANEL_SONY_ACX565AKM) += panel-sony-acx565akm.o
+ obj-$(CONFIG_DRM_PANEL_SONY_TULIP_TRULY_NT35521) += panel-sony-tulip-truly-nt35521.o
+ obj-$(CONFIG_DRM_PANEL_TDO_TL070WSH30) += panel-tdo-tl070wsh30.o
++obj-$(CONFIG_DRM_PANEL_TPO_Y17P) += panel-tdo-y17p.o
+ obj-$(CONFIG_DRM_PANEL_TPO_TD028TTEC1) += panel-tpo-td028ttec1.o
+ obj-$(CONFIG_DRM_PANEL_TPO_TD043MTEA1) += panel-tpo-td043mtea1.o
+ obj-$(CONFIG_DRM_PANEL_TPO_TPG110) += panel-tpo-tpg110.o
+--- /dev/null
++++ b/drivers/gpu/drm/panel/panel-tdo-y17p.c
+@@ -0,0 +1,277 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * TDO Y17P TFT LCD drm_panel driver.
++ *
++ * SPI configured DPI display controller
++ * Copyright (C) 2022 Raspberry Pi Ltd
++ *
++ * Derived from drivers/drm/gpu/panel/panel-sitronix-st7789v.c
++ * Copyright (C) 2017 Free Electrons
++ */
++
++#include <drm/drm_modes.h>
++#include <drm/drm_panel.h>
++
++#include <linux/bitops.h>
++#include <linux/gpio/consumer.h>
++#include <linux/media-bus-format.h>
++#include <linux/module.h>
++#include <linux/of_device.h>
++#include <linux/regmap.h>
++#include <linux/regulator/consumer.h>
++#include <linux/spi/spi.h>
++
++#include <video/mipi_display.h>
++#include <video/of_videomode.h>
++#include <video/videomode.h>
++
++struct tdo_y17p {
++	struct drm_panel panel;
++	struct spi_device *spi;
++	struct gpio_desc *reset;
++	struct regulator *power;
++	u32 bus_format;
++};
++
++static const u16 panel_init[] = {
++	0x0ff, 0x1ff, 0x198, 0x106, 0x104, 0x101, 0x008, 0x110,
++	0x021, 0x109, 0x030, 0x102, 0x031, 0x100, 0x040, 0x110,
++	0x041, 0x155, 0x042, 0x102, 0x043, 0x109, 0x044, 0x107,
++	0x050, 0x178, 0x051, 0x178, 0x052, 0x100, 0x053, 0x16d,
++	0x060, 0x107, 0x061, 0x100, 0x062, 0x108, 0x063, 0x100,
++	0x0a0, 0x100, 0x0a1, 0x107, 0x0a2, 0x10c, 0x0a3, 0x10b,
++	0x0a4, 0x103, 0x0a5, 0x107, 0x0a6, 0x106, 0x0a7, 0x104,
++	0x0a8, 0x108, 0x0a9, 0x10c, 0x0aa, 0x113, 0x0ab, 0x106,
++	0x0ac, 0x10d, 0x0ad, 0x119, 0x0ae, 0x110, 0x0af, 0x100,
++	0x0c0, 0x100, 0x0c1, 0x107, 0x0c2, 0x10c, 0x0c3, 0x10b,
++	0x0c4, 0x103, 0x0c5, 0x107, 0x0c6, 0x107, 0x0c7, 0x104,
++	0x0c8, 0x108, 0x0c9, 0x10c, 0x0ca, 0x113, 0x0cb, 0x106,
++	0x0cc, 0x10d, 0x0cd, 0x118, 0x0ce, 0x110, 0x0cf, 0x100,
++	0x0ff, 0x1ff, 0x198, 0x106, 0x104, 0x106, 0x000, 0x120,
++	0x001, 0x10a, 0x002, 0x100, 0x003, 0x100, 0x004, 0x101,
++	0x005, 0x101, 0x006, 0x198, 0x007, 0x106, 0x008, 0x101,
++	0x009, 0x180, 0x00a, 0x100, 0x00b, 0x100, 0x00c, 0x101,
++	0x00d, 0x101, 0x00e, 0x100, 0x00f, 0x100, 0x010, 0x1f0,
++	0x011, 0x1f4, 0x012, 0x101, 0x013, 0x100, 0x014, 0x100,
++	0x015, 0x1c0, 0x016, 0x108, 0x017, 0x100, 0x018, 0x100,
++	0x019, 0x100, 0x01a, 0x100, 0x01b, 0x100, 0x01c, 0x100,
++	0x01d, 0x100, 0x020, 0x101, 0x021, 0x123, 0x022, 0x145,
++	0x023, 0x167, 0x024, 0x101, 0x025, 0x123, 0x026, 0x145,
++	0x027, 0x167, 0x030, 0x111, 0x031, 0x111, 0x032, 0x100,
++	0x033, 0x1ee, 0x034, 0x1ff, 0x035, 0x1bb, 0x036, 0x1aa,
++	0x037, 0x1dd, 0x038, 0x1cc, 0x039, 0x166, 0x03a, 0x177,
++	0x03b, 0x122, 0x03c, 0x122, 0x03d, 0x122, 0x03e, 0x122,
++	0x03f, 0x122, 0x040, 0x122, 0x052, 0x110, 0x053, 0x110,
++	0x0ff, 0x1ff, 0x198, 0x106, 0x104, 0x107, 0x018, 0x11d,
++	0x017, 0x122, 0x002, 0x177, 0x026, 0x1b2, 0x0e1, 0x179,
++	0x0ff, 0x1ff, 0x198, 0x106, 0x104, 0x100, 0x03a, 0x160,
++	0x035, 0x100, 0x011, 0x100,
++};
++
++#define NUM_INIT_REGS ARRAY_SIZE(panel_init)
++
++static inline struct tdo_y17p *panel_to_tdo_y17p(struct drm_panel *panel)
++{
++	return container_of(panel, struct tdo_y17p, panel);
++}
++
++static int tdo_y17p_write_msg(struct tdo_y17p *ctx, const u16 *msg, unsigned int len)
++{
++	struct spi_transfer xfer = { };
++	struct spi_message spi;
++
++	spi_message_init(&spi);
++
++	xfer.tx_buf = msg;
++	xfer.bits_per_word = 9;
++	xfer.len = sizeof(u16) * len;
++
++	spi_message_add_tail(&xfer, &spi);
++	return spi_sync(ctx->spi, &spi);
++}
++
++static const struct drm_display_mode tdo_y17pe_720x720_mode = {
++	.clock = 36720,
++	.hdisplay = 720,
++	.hsync_start = 720 + 20,
++	.hsync_end = 720 + 20 + 20,
++	.htotal = 720 + 20 + 20 + 40,
++	.vdisplay = 720,
++	.vsync_start = 720 + 15,
++	.vsync_end = 720 + 15 + 15,
++	.vtotal = 720 + 15 + 15 + 15,
++	.flags = DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC,
++};
++
++static int tdo_y17p_get_modes(struct drm_panel *panel,
++			      struct drm_connector *connector)
++{
++	struct tdo_y17p *ctx = panel_to_tdo_y17p(panel);
++	struct drm_display_mode *mode;
++
++	mode = drm_mode_duplicate(connector->dev, &tdo_y17pe_720x720_mode);
++	if (!mode) {
++		dev_err(panel->dev, "failed to add mode %ux%ux@%u\n",
++			tdo_y17pe_720x720_mode.hdisplay,
++			tdo_y17pe_720x720_mode.vdisplay,
++			drm_mode_vrefresh(&tdo_y17pe_720x720_mode));
++		return -ENOMEM;
++	}
++
++	drm_mode_set_name(mode);
++
++	mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
++	drm_mode_probed_add(connector, mode);
++
++	connector->display_info.width_mm = 72;
++	connector->display_info.height_mm = 72;
++	drm_display_info_set_bus_formats(&connector->display_info,
++					 &ctx->bus_format, 1);
++	connector->display_info.bus_flags = 0;
++
++	return 1;
++}
++
++static int tdo_y17p_prepare(struct drm_panel *panel)
++{
++	struct tdo_y17p *ctx = panel_to_tdo_y17p(panel);
++	int ret;
++
++	ret = regulator_enable(ctx->power);
++	if (ret)
++		return ret;
++
++	ret = tdo_y17p_write_msg(ctx, panel_init, NUM_INIT_REGS);
++
++	msleep(120);
++
++	return ret;
++}
++
++static int tdo_y17p_enable(struct drm_panel *panel)
++{
++	struct tdo_y17p *ctx = panel_to_tdo_y17p(panel);
++	const u16 msg[] = { MIPI_DCS_SET_DISPLAY_ON };
++	int ret;
++
++	ret = tdo_y17p_write_msg(ctx, msg, ARRAY_SIZE(msg));
++
++	return ret;
++}
++
++static int tdo_y17p_disable(struct drm_panel *panel)
++{
++	struct tdo_y17p *ctx = panel_to_tdo_y17p(panel);
++	const u16 msg[] = { MIPI_DCS_SET_DISPLAY_OFF };
++	int ret;
++
++	ret = tdo_y17p_write_msg(ctx, msg, ARRAY_SIZE(msg));
++
++	return ret;
++}
++
++static int tdo_y17p_unprepare(struct drm_panel *panel)
++{
++	struct tdo_y17p *ctx = panel_to_tdo_y17p(panel);
++	const u16 msg[] = { MIPI_DCS_ENTER_SLEEP_MODE };
++	int ret;
++
++	ret = tdo_y17p_write_msg(ctx, msg, ARRAY_SIZE(msg));
++
++	return ret;
++}
++
++static const struct drm_panel_funcs tdo_y17p_drm_funcs = {
++	.disable	= tdo_y17p_disable,
++	.enable		= tdo_y17p_enable,
++	.get_modes	= tdo_y17p_get_modes,
++	.prepare	= tdo_y17p_prepare,
++	.unprepare	= tdo_y17p_unprepare,
++};
++
++static const struct of_device_id tdo_y17p_of_match[] = {
++	{	.compatible = "tdo,tl040hds20ct",
++		.data = (void *)MEDIA_BUS_FMT_BGR888_1X24,
++	}, {
++		.compatible = "pimoroni,hyperpixel4square",
++		.data = (void *)MEDIA_BUS_FMT_BGR666_1X24_CPADHI,
++	}, {
++		.compatible = "tdo,y17p",
++		.data = (void *)MEDIA_BUS_FMT_BGR888_1X24,
++	}, {
++		/* sentinel */
++	}
++};
++MODULE_DEVICE_TABLE(of, tdo_y17p_of_match);
++
++static int tdo_y17p_probe(struct spi_device *spi)
++{
++	const struct of_device_id *id;
++	struct tdo_y17p *ctx;
++	int ret;
++
++	ctx = devm_kzalloc(&spi->dev, sizeof(*ctx), GFP_KERNEL);
++	if (!ctx)
++		return -ENOMEM;
++
++	id = of_match_node(tdo_y17p_of_match, spi->dev.of_node);
++	if (!id)
++		return -ENODEV;
++
++	ctx->bus_format = (u32)(uintptr_t)id->data;
++
++	spi_set_drvdata(spi, ctx);
++	ctx->spi = spi;
++
++	drm_panel_init(&ctx->panel, &spi->dev, &tdo_y17p_drm_funcs,
++		       DRM_MODE_CONNECTOR_DPI);
++
++	ctx->power = devm_regulator_get(&spi->dev, "power");
++	if (IS_ERR(ctx->power))
++		return PTR_ERR(ctx->power);
++
++	ctx->reset = devm_gpiod_get_optional(&spi->dev, "reset", GPIOD_OUT_LOW);
++	if (IS_ERR(ctx->reset)) {
++		dev_err(&spi->dev, "Couldn't get our reset line\n");
++		return PTR_ERR(ctx->reset);
++	}
++
++	ret = drm_panel_of_backlight(&ctx->panel);
++	if (ret)
++		return ret;
++
++	drm_panel_add(&ctx->panel);
++
++	return 0;
++}
++
++static void tdo_y17p_remove(struct spi_device *spi)
++{
++	struct tdo_y17p *ctx = spi_get_drvdata(spi);
++
++	drm_panel_remove(&ctx->panel);
++}
++
++static const struct spi_device_id tdo_y17p_ids[] = {
++	{ "tl040hds20ct", 0 },
++	{ "hyperpixel4square", 0 },
++	{ "y17p", 0 },
++	{ /* sentinel */ }
++};
++
++MODULE_DEVICE_TABLE(spi, tdo_y17p_ids);
++
++static struct spi_driver tdo_y17p_driver = {
++	.probe = tdo_y17p_probe,
++	.remove = tdo_y17p_remove,
++	.driver = {
++		.name = "tdo_y17p",
++		.of_match_table = tdo_y17p_of_match,
++	},
++	.id_table = tdo_y17p_ids,
++};
++module_spi_driver(tdo_y17p_driver);
++
++MODULE_AUTHOR("Dave Stevenson <dave.stevenson@raspberrypi.com>");
++MODULE_DESCRIPTION("TDO Y17P LCD panel driver");
++MODULE_LICENSE("GPL v2");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0387-bindings-Add-sck-idle-input-to-spi-gpio.patch b/target/linux/bcm27xx/patches-6.1/950-0387-bindings-Add-sck-idle-input-to-spi-gpio.patch
new file mode 100644
index 00000000000000..809bc23308a6a2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0387-bindings-Add-sck-idle-input-to-spi-gpio.patch
@@ -0,0 +1,23 @@
+From 9131831f5e3f0953dde8ca3807406f1aa1b34791 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 4 Feb 2022 11:33:28 +0000
+Subject: [PATCH] bindings: Add sck-idle-input to spi-gpio
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ Documentation/devicetree/bindings/spi/spi-gpio.yaml | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/Documentation/devicetree/bindings/spi/spi-gpio.yaml
++++ b/Documentation/devicetree/bindings/spi/spi-gpio.yaml
+@@ -43,6 +43,10 @@ properties:
+       with no chip select is connected.
+     $ref: "/schemas/types.yaml#/definitions/uint32"
+ 
++  sck-idle-input:
++    description: Make SCK an input when inactive.
++    type: boolean
++
+   # Deprecated properties
+   gpio-sck: false
+   gpio-miso: false
diff --git a/target/linux/bcm27xx/patches-6.1/950-0388-spi-gpio-Add-sck-idle-input-property.patch b/target/linux/bcm27xx/patches-6.1/950-0388-spi-gpio-Add-sck-idle-input-property.patch
new file mode 100644
index 00000000000000..461fd7f9e838ba
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0388-spi-gpio-Add-sck-idle-input-property.patch
@@ -0,0 +1,57 @@
+From d9061fef9a7109c32d7e4eb1d42e387b9781e92a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 12 Jan 2022 08:23:28 +0000
+Subject: [PATCH] spi: gpio: Add sck-idle-input property
+
+The sck-idle-input property indicates that the spi-gpio driver should
+return the SCK line to an input when the chip select signals are
+inactive.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/spi/spi-gpio.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/spi/spi-gpio.c
++++ b/drivers/spi/spi-gpio.c
+@@ -35,6 +35,7 @@ struct spi_gpio {
+ 	struct gpio_desc		*sck;
+ 	struct gpio_desc		*miso;
+ 	struct gpio_desc		*mosi;
++	bool				sck_idle_input;
+ 	struct gpio_desc		**cs_gpios;
+ };
+ 
+@@ -225,8 +226,12 @@ static void spi_gpio_chipselect(struct s
+ 	struct spi_gpio *spi_gpio = spi_to_spi_gpio(spi);
+ 
+ 	/* set initial clock line level */
+-	if (is_active)
+-		gpiod_set_value_cansleep(spi_gpio->sck, spi->mode & SPI_CPOL);
++	if (is_active) {
++		if (spi_gpio->sck_idle_input)
++			gpiod_direction_output(spi_gpio->sck, spi->mode & SPI_CPOL);
++		else
++			gpiod_set_value_cansleep(spi_gpio->sck, spi->mode & SPI_CPOL);
++	}
+ 
+ 	/* Drive chip select line, if we have one */
+ 	if (spi_gpio->cs_gpios) {
+@@ -235,6 +240,9 @@ static void spi_gpio_chipselect(struct s
+ 		/* SPI chip selects are normally active-low */
+ 		gpiod_set_value_cansleep(cs, (spi->mode & SPI_CS_HIGH) ? is_active : !is_active);
+ 	}
++
++	if (spi_gpio->sck_idle_input && !is_active)
++		gpiod_direction_input(spi_gpio->sck);
+ }
+ 
+ static int spi_gpio_setup(struct spi_device *spi)
+@@ -323,6 +331,7 @@ static int spi_gpio_request(struct devic
+ 	if (IS_ERR(spi_gpio->miso))
+ 		return PTR_ERR(spi_gpio->miso);
+ 
++	spi_gpio->sck_idle_input = device_property_read_bool(dev, "sck-idle-input");
+ 	spi_gpio->sck = devm_gpiod_get(dev, "sck", GPIOD_OUT_LOW);
+ 	return PTR_ERR_OR_ZERO(spi_gpio->sck);
+ }
diff --git a/target/linux/bcm27xx/patches-6.1/950-0389-media-bcm2835-unicam-Handle-a-repeated-frame-start-w.patch b/target/linux/bcm27xx/patches-6.1/950-0389-media-bcm2835-unicam-Handle-a-repeated-frame-start-w.patch
new file mode 100644
index 00000000000000..40a0d51cc55f7e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0389-media-bcm2835-unicam-Handle-a-repeated-frame-start-w.patch
@@ -0,0 +1,63 @@
+From e042524d5b516f852f107661cfb68187e5b1f95b Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 4 Feb 2022 16:12:35 +0000
+Subject: [PATCH] media: bcm2835-unicam: Handle a repeated frame start
+ with no end
+
+In the case of 2 frame starts being received with no frame end
+between, the queued buffer held in next_frm was lost as the
+pointer was overwritten with the dummy buffer.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 29 +++++++++++++++----
+ 1 file changed, 24 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -930,10 +930,14 @@ static irqreturn_t unicam_isr(int irq, v
+ 			 * as complete, as the HW will reuse that buffer.
+ 			 */
+ 			if (unicam->node[i].cur_frm &&
+-			    unicam->node[i].cur_frm != unicam->node[i].next_frm)
++			    unicam->node[i].cur_frm != unicam->node[i].next_frm) {
+ 				unicam_process_buffer_complete(&unicam->node[i],
+ 							       sequence);
+-			unicam->node[i].cur_frm = unicam->node[i].next_frm;
++				unicam->node[i].cur_frm = unicam->node[i].next_frm;
++				unicam->node[i].next_frm = NULL;
++			} else {
++				unicam->node[i].cur_frm = unicam->node[i].next_frm;
++			}
+ 		}
+ 		unicam->sequence++;
+ 	}
+@@ -956,10 +960,25 @@ static irqreturn_t unicam_isr(int irq, v
+ 					   i);
+ 			/*
+ 			 * Set the next frame output to go to a dummy frame
+-			 * if we have not managed to obtain another frame
+-			 * from the queue.
++			 * if no buffer currently queued.
+ 			 */
+-			unicam_schedule_dummy_buffer(&unicam->node[i]);
++			if (!unicam->node[i].next_frm ||
++			    unicam->node[i].next_frm == unicam->node[i].cur_frm) {
++				unicam_schedule_dummy_buffer(&unicam->node[i]);
++			} else if (unicam->node[i].cur_frm) {
++				/*
++				 * Repeated FS without FE. Hardware will have
++				 * swapped buffers, but the cur_frm doesn't
++				 * contain valid data. Return cur_frm to the
++				 * queue.
++				 */
++				spin_lock(&unicam->node[i].dma_queue_lock);
++				list_add_tail(&unicam->node[i].cur_frm->list,
++					      &unicam->node[i].dma_queue);
++				spin_unlock(&unicam->node[i].dma_queue_lock);
++				unicam->node[i].cur_frm = unicam->node[i].next_frm;
++				unicam->node[i].next_frm = NULL;
++			}
+ 		}
+ 
+ 		unicam_queue_event_sof(unicam);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0390-usb-xhci-add-a-quirk-for-Superspeed-bulk-OUT-transfe.patch b/target/linux/bcm27xx/patches-6.1/950-0390-usb-xhci-add-a-quirk-for-Superspeed-bulk-OUT-transfe.patch
new file mode 100644
index 00000000000000..bad3790630772d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0390-usb-xhci-add-a-quirk-for-Superspeed-bulk-OUT-transfe.patch
@@ -0,0 +1,96 @@
+From ba09ce751542f6f80019433364d46a14ade59dd0 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 16 Feb 2022 14:31:02 +0000
+Subject: [PATCH] usb: xhci: add a quirk for Superspeed bulk OUT
+ transfers on VL805
+
+The VL805 has a bug in its internal FIFO space accounting that results
+in bulk OUT babble if a TRB in a large multi-element TD has a data
+buffer size that is larger than and not a multiple of wMaxPacketSize for
+the endpoint. If the downstream USB3.0 link is congested, or latency is
+increased through an intermediate hub, then the VL805 enters a suspected
+FIFO overflow condition and transmits repeated, garbled data to the
+endpoint.
+
+TDs with TRBs of exact multiples of wMaxPacketSize and smaller than
+wMaxPacketSize appear to be handled correctly, so split buffers at a
+1024-byte length boundary and put the remainder in a separate smaller
+TRB.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci-pci.c  |  1 +
+ drivers/usb/host/xhci-ring.c | 21 +++++++++++++++++++--
+ drivers/usb/host/xhci.h      |  1 +
+ 3 files changed, 21 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -298,6 +298,7 @@ static void xhci_pci_quirks(struct devic
+ 		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
+ 		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
+ 		xhci->quirks |= XHCI_VLI_TRB_CACHE_BUG;
++		xhci->quirks |= XHCI_VLI_SS_BULK_OUT_BUG;
+ 	}
+ 
+ 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -3578,14 +3578,15 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
+ 	unsigned int num_trbs;
+ 	unsigned int start_cycle, num_sgs = 0;
+ 	unsigned int enqd_len, block_len, trb_buff_len, full_len;
+-	int sent_len, ret;
+-	u32 field, length_field, remainder;
++	int sent_len, ret, vli_quirk = 0;
++	u32 field, length_field, remainder, maxpacket;
+ 	u64 addr, send_addr;
+ 
+ 	ring = xhci_urb_to_transfer_ring(xhci, urb);
+ 	if (!ring)
+ 		return -EINVAL;
+ 
++	maxpacket = usb_endpoint_maxp(&urb->ep->desc);
+ 	full_len = urb->transfer_buffer_length;
+ 	/* If we have scatter/gather list, we use it. */
+ 	if (urb->num_sgs && !(urb->transfer_flags & URB_DMA_MAP_SINGLE)) {
+@@ -3622,6 +3623,17 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
+ 	start_cycle = ring->cycle_state;
+ 	send_addr = addr;
+ 
++	if (xhci->quirks & XHCI_VLI_SS_BULK_OUT_BUG &&
++	    !usb_urb_dir_in(urb) && urb->dev->speed >= USB_SPEED_SUPER) {
++		/*
++		 * VL805 - superspeed bulk OUT traffic can cause
++		 * an internal fifo overflow if the TRB buffer is larger
++		 * than wMaxPacket and the length is not an integer
++		 * multiple of wMaxPacket.
++		 */
++		vli_quirk = 1;
++	}
++
+ 	/* Queue the TRBs, even if they are zero-length */
+ 	for (enqd_len = 0; first_trb || enqd_len < full_len;
+ 			enqd_len += trb_buff_len) {
+@@ -3634,6 +3646,11 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
+ 		if (enqd_len + trb_buff_len > full_len)
+ 			trb_buff_len = full_len - enqd_len;
+ 
++		if (vli_quirk && trb_buff_len > maxpacket) {
++			/* SS bulk wMaxPacket is 1024B */
++			remainder = trb_buff_len & (maxpacket - 1);
++			trb_buff_len -= remainder;
++		}
+ 		/* Don't change the cycle bit of the first TRB until later */
+ 		if (first_trb) {
+ 			first_trb = false;
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1902,6 +1902,7 @@ struct xhci_hcd {
+ #define XHCI_RESET_TO_DEFAULT	BIT_ULL(44)
+ #define XHCI_AVOID_DQ_ON_LINK	BIT_ULL(45)
+ #define XHCI_VLI_TRB_CACHE_BUG	BIT_ULL(46)
++#define XHCI_VLI_SS_BULK_OUT_BUG	BIT_ULL(47)
+ 
+ 	unsigned int		num_active_eps;
+ 	unsigned int		limit_active_eps;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0391-media-i2c-ov7251-Reinstate-setting-ov7251_global_ini.patch b/target/linux/bcm27xx/patches-6.1/950-0391-media-i2c-ov7251-Reinstate-setting-ov7251_global_ini.patch
new file mode 100644
index 00000000000000..4cab9adb0bfc63
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0391-media-i2c-ov7251-Reinstate-setting-ov7251_global_ini.patch
@@ -0,0 +1,32 @@
+From 69feaeba2b7f283074d81b12df78218f881159f1 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 17 Feb 2022 14:48:30 +0000
+Subject: [PATCH] media: i2c: ov7251: Reinstate setting
+ ov7251_global_init_setting
+
+"media: i2c: Remove .s_power() from ov7251" removed the call that
+sent ov7251_global_init_setting to the sensor. Send it when starting
+streaming.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov7251.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/media/i2c/ov7251.c
++++ b/drivers/media/i2c/ov7251.c
+@@ -1344,6 +1344,14 @@ static int ov7251_s_stream(struct v4l2_s
+ 		if (ret < 0)
+ 			goto err_power_down;
+ 
++		ret = ov7251_set_register_array(ov7251,
++					ov7251_global_init_setting,
++					ARRAY_SIZE(ov7251_global_init_setting));
++		if (ret < 0) {
++			dev_err(ov7251->dev, "could not set global_init_setting\n");
++			goto err_power_down;
++		}
++
+ 		ret = ov7251_pll_configure(ov7251);
+ 		if (ret) {
+ 			dev_err(ov7251->dev, "error configuring PLLs\n");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0392-usb-xhci-rework-XHCI_VLI_SS_BULK_OUT_BUG-quirk.patch b/target/linux/bcm27xx/patches-6.1/950-0392-usb-xhci-rework-XHCI_VLI_SS_BULK_OUT_BUG-quirk.patch
new file mode 100644
index 00000000000000..cb1389b40283e3
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0392-usb-xhci-rework-XHCI_VLI_SS_BULK_OUT_BUG-quirk.patch
@@ -0,0 +1,51 @@
+From 855c0e315e283985bacb623ee72bae2fcec3a463 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Tue, 1 Mar 2022 15:12:15 +0000
+Subject: [PATCH] usb: xhci: rework XHCI_VLI_SS_BULK_OUT_BUG quirk
+
+Fix incorrectly applying the quirk for bulk IN endpoints and remove the
+commentary which is not completely accurate based on observed behaviour.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci-ring.c | 15 +++++----------
+ 1 file changed, 5 insertions(+), 10 deletions(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -3578,7 +3578,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
+ 	unsigned int num_trbs;
+ 	unsigned int start_cycle, num_sgs = 0;
+ 	unsigned int enqd_len, block_len, trb_buff_len, full_len;
+-	int sent_len, ret, vli_quirk = 0;
++	int sent_len, ret, vli_bulk_quirk = 0;
+ 	u32 field, length_field, remainder, maxpacket;
+ 	u64 addr, send_addr;
+ 
+@@ -3624,14 +3624,9 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
+ 	send_addr = addr;
+ 
+ 	if (xhci->quirks & XHCI_VLI_SS_BULK_OUT_BUG &&
+-	    !usb_urb_dir_in(urb) && urb->dev->speed >= USB_SPEED_SUPER) {
+-		/*
+-		 * VL805 - superspeed bulk OUT traffic can cause
+-		 * an internal fifo overflow if the TRB buffer is larger
+-		 * than wMaxPacket and the length is not an integer
+-		 * multiple of wMaxPacket.
+-		 */
+-		vli_quirk = 1;
++	    usb_endpoint_is_bulk_out(&urb->ep->desc)
++	    && urb->dev->speed >= USB_SPEED_SUPER) {
++		vli_bulk_quirk = 1;
+ 	}
+ 
+ 	/* Queue the TRBs, even if they are zero-length */
+@@ -3646,7 +3641,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
+ 		if (enqd_len + trb_buff_len > full_len)
+ 			trb_buff_len = full_len - enqd_len;
+ 
+-		if (vli_quirk && trb_buff_len > maxpacket) {
++		if (vli_bulk_quirk && trb_buff_len > maxpacket) {
+ 			/* SS bulk wMaxPacket is 1024B */
+ 			remainder = trb_buff_len & (maxpacket - 1);
+ 			trb_buff_len -= remainder;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0393-media-i2c-Add-driver-for-Omnivision-OV2311.patch b/target/linux/bcm27xx/patches-6.1/950-0393-media-i2c-Add-driver-for-Omnivision-OV2311.patch
new file mode 100644
index 00000000000000..5db533297defd4
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0393-media-i2c-Add-driver-for-Omnivision-OV2311.patch
@@ -0,0 +1,1228 @@
+From 6390e65023f728f3ba3a85d4a6e7ed883bf8e7e8 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 25 Feb 2022 18:16:13 +0000
+Subject: [PATCH] media/i2c: Add driver for Omnivision OV2311
+
+Omnivision OV2311 is a CSI2 1600x1300 global shutter image sensor.
+Add a driver for it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/Kconfig  |   11 +
+ drivers/media/i2c/Makefile |    1 +
+ drivers/media/i2c/ov2311.c | 1179 ++++++++++++++++++++++++++++++++++++
+ 3 files changed, 1191 insertions(+)
+ create mode 100644 drivers/media/i2c/ov2311.c
+
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -395,6 +395,17 @@ config VIDEO_OV13B10
+ 	  This is a Video4Linux2 sensor driver for the OmniVision
+ 	  OV13B10 camera.
+ 
++config VIDEO_OV2311
++	tristate "OmniVision OV2311 sensor support"
++	depends on I2C && VIDEO_DEV
++	depends on MEDIA_CAMERA_SUPPORT
++	help
++	  This is a Video4Linux2 sensor-level driver for the OmniVision
++	  OV2311 camera.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called ov2311.
++
+ config VIDEO_OV2640
+ 	tristate "OmniVision OV2640 sensor support"
+ 	depends on VIDEO_DEV && I2C
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -77,6 +77,7 @@ obj-$(CONFIG_VIDEO_OV02A10) += ov02a10.o
+ obj-$(CONFIG_VIDEO_OV08D10) += ov08d10.o
+ obj-$(CONFIG_VIDEO_OV13858) += ov13858.o
+ obj-$(CONFIG_VIDEO_OV13B10) += ov13b10.o
++obj-$(CONFIG_VIDEO_OV2311) += ov2311.o
+ obj-$(CONFIG_VIDEO_OV2640) += ov2640.o
+ obj-$(CONFIG_VIDEO_OV2659) += ov2659.o
+ obj-$(CONFIG_VIDEO_OV2680) += ov2680.o
+--- /dev/null
++++ b/drivers/media/i2c/ov2311.c
+@@ -0,0 +1,1179 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Omnivision OV2311 1600x1300 global shutter image sensor driver
++ * Copyright (C) 2022, Raspberry Pi (Trading) Ltd
++ *
++ * This driver is based on the OV9281 driver.
++ * Copyright (C) 2017 Fuzhou Rockchip Electronics Co., Ltd.
++ * Register configuration from
++ * https://github.com/ArduCAM/ArduCAM_USB_Camera_Shield/tree/master/Config/USB3.0_UC-425_Rev.C%2BUC-628_Rev.B/OV2311
++ * with additional exposure and gain register information from
++ * https://github.com/renesas-rcar/linux-bsp/tree/0cf6e36f5bf49e1c2aab87139ec5b588623c56f8/drivers/media/i2c/imagers
++ */
++
++#include <linux/clk.h>
++#include <linux/device.h>
++#include <linux/delay.h>
++#include <linux/gpio/consumer.h>
++#include <linux/i2c.h>
++#include <linux/module.h>
++#include <linux/pm_runtime.h>
++#include <linux/regulator/consumer.h>
++#include <media/media-entity.h>
++#include <media/v4l2-async.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-fwnode.h>
++#include <media/v4l2-subdev.h>
++
++#define OV2311_LINK_FREQ		400000000
++#define OV2311_LANES			2
++
++/* pixel rate = link frequency * 2 * lanes / BITS_PER_SAMPLE */
++#define OV2311_PIXEL_RATE_10BIT		(OV2311_LINK_FREQ * 2 * \
++					 OV2311_LANES / 10)
++#define OV2311_PIXEL_RATE_8BIT		(OV2311_LINK_FREQ * 2 * \
++					 OV2311_LANES / 8)
++#define OV2311_XVCLK_FREQ		24000000
++
++#define CHIP_ID				0x2311
++#define OV2311_REG_CHIP_ID		0x300a
++
++#define OV2311_REG_CTRL_MODE		0x0100
++#define OV2311_MODE_SW_STANDBY		0x0
++#define OV2311_MODE_STREAMING		BIT(0)
++
++#define OV2311_REG_V_FLIP		0x3820
++#define OV2311_REG_H_FLIP		0x3821
++#define OV2311_FLIP_BIT			BIT(2)
++
++#define OV2311_REG_EXPOSURE		0x3501
++#define	OV2311_EXPOSURE_MIN		4
++#define	OV2311_EXPOSURE_STEP		1
++#define OV2311_VTS_MAX			0xffff
++
++#define OV2311_REG_GAIN_H		0x3508
++#define OV2311_REG_GAIN_L		0x3509
++#define OV2311_GAIN_H_MASK		0x07
++#define OV2311_GAIN_H_SHIFT		8
++#define OV2311_GAIN_L_MASK		0xff
++#define OV2311_GAIN_MIN			0x100
++#define OV2311_GAIN_MAX			0x780
++#define OV2311_GAIN_STEP		1
++#define OV2311_GAIN_DEFAULT		OV2311_GAIN_MIN
++
++#define OV2311_REG_TEST_PATTERN		0x5e00
++#define OV2311_TEST_PATTERN_ENABLE	0x80
++#define OV2311_TEST_PATTERN_DISABLE	0x0
++
++#define OV2311_REG_VTS			0x380e
++
++/*
++ * OV2311 native and active pixel array size.
++ * Datasheet not available to confirm these values. renesas-rcar linux-bsp tree
++ * has these values.
++ */
++#define OV2311_NATIVE_WIDTH		1616U
++#define OV2311_NATIVE_HEIGHT		1316U
++#define OV2311_PIXEL_ARRAY_LEFT		8U
++#define OV2311_PIXEL_ARRAY_TOP		8U
++#define OV2311_PIXEL_ARRAY_WIDTH	1600U
++#define OV2311_PIXEL_ARRAY_HEIGHT	1300U
++
++#define REG_NULL			0xFFFF
++
++#define OV2311_REG_VALUE_08BIT		1
++#define OV2311_REG_VALUE_16BIT		2
++#define OV2311_REG_VALUE_24BIT		3
++
++#define OV2311_NAME			"ov2311"
++
++static const char * const ov2311_supply_names[] = {
++	"avdd",		/* Analog power */
++	"dovdd",	/* Digital I/O power */
++	"dvdd",		/* Digital core power */
++};
++
++#define OV2311_NUM_SUPPLIES ARRAY_SIZE(ov2311_supply_names)
++
++struct regval {
++	u16 addr;
++	u8 val;
++};
++
++struct ov2311_mode {
++	u32 width;
++	u32 height;
++	u32 hts_def;
++	u32 vts_def;
++	u32 exp_def;
++	struct v4l2_rect crop;
++	const struct regval *reg_list;
++};
++
++struct ov2311 {
++	struct i2c_client	*client;
++	struct clk		*xvclk;
++	struct gpio_desc	*reset_gpio;
++	struct gpio_desc	*pwdn_gpio;
++	struct regulator_bulk_data supplies[OV2311_NUM_SUPPLIES];
++
++	struct v4l2_subdev	subdev;
++	struct media_pad	pad;
++	struct v4l2_ctrl_handler ctrl_handler;
++	struct v4l2_ctrl	*exposure;
++	struct v4l2_ctrl	*hblank;
++	struct v4l2_ctrl	*vblank;
++	struct v4l2_ctrl	*pixel_rate;
++	/*
++	 * Mutex for serialized access:
++	 * Protect sensor module set pad format and start/stop streaming safely.
++	 */
++	struct mutex		mutex;
++
++	/* Streaming on/off */
++	bool streaming;
++
++	const struct ov2311_mode *cur_mode;
++	u32			code;
++};
++
++#define to_ov2311(sd) container_of(sd, struct ov2311, subdev)
++
++/*
++ * Xclk 24Mhz
++ * max_framerate 60fps for 10 bit, 74.6fps for 8 bit.
++ */
++static const struct regval ov2311_common_regs[] = {
++	{ 0x0103, 0x01 },
++	{ 0x0100, 0x00 },
++	{ 0x0300, 0x01 },
++	{ 0x0302, 0x32 },
++	{ 0x0303, 0x00 },
++	{ 0x0304, 0x03 },
++	{ 0x0305, 0x02 },
++	{ 0x0306, 0x01 },
++	{ 0x030e, 0x04 },
++	{ 0x3001, 0x02 },
++	{ 0x3004, 0x00 },
++	{ 0x3005, 0x00 },
++	{ 0x3006, 0x00 },
++	{ 0x3011, 0x0d },
++	{ 0x3014, 0x04 },
++	{ 0x301c, 0xf0 },
++	{ 0x3020, 0x00 },
++	{ 0x302c, 0x00 },
++	{ 0x302d, 0x12 },
++	{ 0x302e, 0x4c },
++	{ 0x302f, 0x8c },
++	{ 0x3030, 0x10 },
++	{ 0x303f, 0x03 },
++	{ 0x3103, 0x00 },
++	{ 0x3106, 0x08 },
++	{ 0x31ff, 0x01 },
++	{ 0x3501, 0x05 },
++	{ 0x3502, 0xba },
++	{ 0x3506, 0x00 },
++	{ 0x3507, 0x00 },
++	{ 0x3620, 0x67 },
++	{ 0x3633, 0x78 },
++	{ 0x3666, 0x00 },
++	{ 0x3670, 0x68 },
++	{ 0x3674, 0x10 },
++	{ 0x3675, 0x00 },
++	{ 0x3680, 0x84 },
++	{ 0x36a2, 0x04 },
++	{ 0x36a3, 0x80 },
++	{ 0x36b0, 0x00 },
++	{ 0x3700, 0x35 },
++	{ 0x3704, 0x59 },
++	{ 0x3712, 0x00 },
++	{ 0x3713, 0x02 },
++	{ 0x379b, 0x01 },
++	{ 0x379c, 0x10 },
++	{ 0x3800, 0x00 },
++	{ 0x3801, 0x00 },
++	{ 0x3804, 0x06 },
++	{ 0x3805, 0x4f },
++	{ 0x3810, 0x00 },
++	{ 0x3811, 0x08 },
++	{ 0x3812, 0x00 },
++	{ 0x3813, 0x08 },
++	{ 0x3814, 0x11 },
++	{ 0x3815, 0x11 },
++	{ 0x3816, 0x00 },
++	{ 0x3817, 0x00 },
++	{ 0x3818, 0x04 },
++	{ 0x3819, 0x00 },
++	{ 0x382b, 0x5a },
++	{ 0x382c, 0x09 },
++	{ 0x382d, 0x9a },
++	{ 0x3882, 0x02 },
++	{ 0x3883, 0x6c },
++	{ 0x3885, 0x07 },
++	{ 0x389d, 0x03 },
++	{ 0x38a6, 0x00 },
++	{ 0x38a7, 0x01 },
++	{ 0x38b3, 0x07 },
++	{ 0x38b1, 0x00 },
++	{ 0x38e5, 0x02 },
++	{ 0x38e7, 0x00 },
++	{ 0x38e8, 0x00 },
++	{ 0x3910, 0xff },
++	{ 0x3911, 0xff },
++	{ 0x3912, 0x08 },
++	{ 0x3913, 0x00 },
++	{ 0x3914, 0x00 },
++	{ 0x3915, 0x00 },
++	{ 0x391c, 0x00 },
++	{ 0x3920, 0xa5 },
++	{ 0x3921, 0x00 },
++	{ 0x3922, 0x00 },
++	{ 0x3923, 0x00 },
++	{ 0x3924, 0x05 },
++	{ 0x3925, 0x00 },
++	{ 0x3926, 0x00 },
++	{ 0x3927, 0x00 },
++	{ 0x3928, 0x1a },
++	{ 0x392d, 0x05 },
++	{ 0x392e, 0xf2 },
++	{ 0x392f, 0x40 },
++	{ 0x4001, 0x00 },
++	{ 0x4003, 0x40 },
++	{ 0x4008, 0x12 },
++	{ 0x4009, 0x1b },
++	{ 0x400c, 0x0c },
++	{ 0x400d, 0x13 },
++	{ 0x4010, 0xf0 },
++	{ 0x4011, 0x00 },
++	{ 0x4016, 0x00 },
++	{ 0x4017, 0x04 },
++	{ 0x4042, 0x11 },
++	{ 0x4043, 0x70 },
++	{ 0x4045, 0x00 },
++	{ 0x4409, 0x5f },
++	{ 0x450b, 0x00 },
++	{ 0x4600, 0x00 },
++	{ 0x4601, 0xa0 },
++	{ 0x4708, 0x09 },
++	{ 0x470c, 0x81 },
++	{ 0x4710, 0x06 },
++	{ 0x4711, 0x00 },
++	{ 0x4800, 0x00 },
++	{ 0x481f, 0x30 },
++	{ 0x4837, 0x14 },
++	{ 0x4f00, 0x00 },
++	{ 0x4f07, 0x00 },
++	{ 0x4f08, 0x03 },
++	{ 0x4f09, 0x08 },
++	{ 0x4f0c, 0x06 },
++	{ 0x4f0d, 0x02 },
++	{ 0x4f10, 0x00 },
++	{ 0x4f11, 0x00 },
++	{ 0x4f12, 0x07 },
++	{ 0x4f13, 0xe2 },
++	{ 0x5000, 0x9f },
++	{ 0x5001, 0x20 },
++	{ 0x5026, 0x00 },
++	{ 0x5c00, 0x00 },
++	{ 0x5c01, 0x2c },
++	{ 0x5c02, 0x00 },
++	{ 0x5c03, 0x7f },
++	{ 0x5e00, 0x00 },
++	{ 0x5e01, 0x41 },
++	{REG_NULL, 0x00},
++};
++
++static const struct regval ov2311_1600x1300_regs[] = {
++	{ 0x3802, 0x00 },
++	{ 0x3803, 0x00 },
++	{ 0x3806, 0x05 },
++	{ 0x3807, 0x23 },
++	{ 0x3808, 0x06 },
++	{ 0x3809, 0x40 },
++	{ 0x380a, 0x05 },
++	{ 0x380b, 0x14 },
++	{ 0x380c, 0x03 },
++	{ 0x380d, 0x88 },
++	{REG_NULL, 0x00},
++};
++
++static const struct regval ov2311_1600x1080_regs[] = {
++	{ 0x3802, 0x00 },
++	{ 0x3803, 0x6e },
++	{ 0x3806, 0x04 },
++	{ 0x3807, 0xae },
++	{ 0x3808, 0x06 },
++	{ 0x3809, 0x40 },
++	{ 0x380a, 0x04 },
++	{ 0x380b, 0x38 },
++	{ 0x380c, 0x03 },
++	{ 0x380d, 0x88 },
++
++	{ 0x5d01, 0x00 },
++	{ 0x5d02, 0x04 },
++	{ 0x5d03, 0x00 },
++	{ 0x5d04, 0x04 },
++	{ 0x5d05, 0x00 },
++	{REG_NULL, 0x00},
++};
++
++static const struct regval op_10bit[] = {
++	{ 0x030d, 0x5a },
++	{ 0x3662, 0x65 },
++	{REG_NULL, 0x00},
++};
++
++static const struct regval op_8bit[] = {
++	{ 0x030d, 0x70 },
++	{ 0x3662, 0x67 },
++	{REG_NULL, 0x00},
++};
++
++static const struct ov2311_mode supported_modes[] = {
++	{
++		.width = 1600,
++		.height = 1300,
++		.exp_def = 0x0320,
++		.hts_def = (0x0388 * 2),/* Registers 0x380c / 0x380d  * 2 */
++		.vts_def = 0x5c2,	/* Registers 0x380e / 0x380f
++					 * 60fps for 10bpp
++					 */
++		.crop = {
++			.left = OV2311_PIXEL_ARRAY_LEFT,
++			.top = OV2311_PIXEL_ARRAY_TOP,
++			.width = 1600,
++			.height = 1300
++		},
++		.reg_list = ov2311_1600x1300_regs,
++	},
++	{
++		.width = 1600,
++		.height = 1080,
++		.exp_def = 0x0320,
++		.hts_def = (0x0388 * 2),/* Registers 0x380c / 0x380d  * 2 */
++		.vts_def = 0x5c2,	/* Registers 0x380e / 0x380f
++					 * 60fps for 10bpp
++					 */
++		.crop = {
++			.left = OV2311_PIXEL_ARRAY_LEFT,
++			.top = 110 + OV2311_PIXEL_ARRAY_TOP,
++			.width = 1600,
++			.height = 1080
++		},
++		.reg_list = ov2311_1600x1080_regs,
++	},
++};
++
++static const s64 link_freq_menu_items[] = {
++	OV2311_LINK_FREQ
++};
++
++static const char * const ov2311_test_pattern_menu[] = {
++	"Disabled",
++	"Vertical Color Bar Type 1",
++	"Vertical Color Bar Type 2",
++	"Vertical Color Bar Type 3",
++	"Vertical Color Bar Type 4"
++};
++
++/* Write registers up to 4 at a time */
++static int ov2311_write_reg(struct i2c_client *client, u16 reg,
++			    u32 len, u32 val)
++{
++	u32 buf_i, val_i;
++	u8 buf[6];
++	u8 *val_p;
++	__be32 val_be;
++
++	if (len > 4)
++		return -EINVAL;
++
++	buf[0] = reg >> 8;
++	buf[1] = reg & 0xff;
++
++	val_be = cpu_to_be32(val);
++	val_p = (u8 *)&val_be;
++	buf_i = 2;
++	val_i = 4 - len;
++
++	while (val_i < 4)
++		buf[buf_i++] = val_p[val_i++];
++
++	if (i2c_master_send(client, buf, len + 2) != len + 2)
++		return -EIO;
++
++	return 0;
++}
++
++static int ov2311_write_array(struct i2c_client *client,
++			      const struct regval *regs)
++{
++	u32 i;
++	int ret = 0;
++
++	for (i = 0; ret == 0 && regs[i].addr != REG_NULL; i++)
++		ret = ov2311_write_reg(client, regs[i].addr,
++				       OV2311_REG_VALUE_08BIT, regs[i].val);
++
++	return ret;
++}
++
++/* Read registers up to 4 at a time */
++static int ov2311_read_reg(struct i2c_client *client, u16 reg, unsigned int len,
++			   u32 *val)
++{
++	struct i2c_msg msgs[2];
++	u8 *data_be_p;
++	__be32 data_be = 0;
++	__be16 reg_addr_be = cpu_to_be16(reg);
++	int ret;
++
++	if (len > 4 || !len)
++		return -EINVAL;
++
++	data_be_p = (u8 *)&data_be;
++	/* Write register address */
++	msgs[0].addr = client->addr;
++	msgs[0].flags = 0;
++	msgs[0].len = 2;
++	msgs[0].buf = (u8 *)&reg_addr_be;
++
++	/* Read data from register */
++	msgs[1].addr = client->addr;
++	msgs[1].flags = I2C_M_RD;
++	msgs[1].len = len;
++	msgs[1].buf = &data_be_p[4 - len];
++
++	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++	if (ret != ARRAY_SIZE(msgs))
++		return -EIO;
++
++	*val = be32_to_cpu(data_be);
++
++	return 0;
++}
++
++static int ov2311_set_fmt(struct v4l2_subdev *sd,
++			  struct v4l2_subdev_state *sd_state,
++			  struct v4l2_subdev_format *fmt)
++{
++	struct ov2311 *ov2311 = to_ov2311(sd);
++	const struct ov2311_mode *mode;
++	s64 h_blank, vblank_def, pixel_rate;
++
++	mutex_lock(&ov2311->mutex);
++
++	mode = v4l2_find_nearest_size(supported_modes,
++				      ARRAY_SIZE(supported_modes),
++				      width, height,
++				      fmt->format.width,
++				      fmt->format.height);
++	if (fmt->format.code != MEDIA_BUS_FMT_Y8_1X8)
++		fmt->format.code = MEDIA_BUS_FMT_Y10_1X10;
++	fmt->format.width = mode->width;
++	fmt->format.height = mode->height;
++	fmt->format.field = V4L2_FIELD_NONE;
++	fmt->format.colorspace = V4L2_COLORSPACE_RAW;
++	fmt->format.ycbcr_enc =
++			V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->format.colorspace);
++	fmt->format.quantization =
++		V4L2_MAP_QUANTIZATION_DEFAULT(true, fmt->format.colorspace,
++					      fmt->format.ycbcr_enc);
++	fmt->format.xfer_func =
++		V4L2_MAP_XFER_FUNC_DEFAULT(fmt->format.colorspace);
++
++	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++		*v4l2_subdev_get_try_format(sd, sd_state, fmt->pad) =
++								fmt->format;
++	} else {
++		ov2311->cur_mode = mode;
++		ov2311->code = fmt->format.code;
++		h_blank = mode->hts_def - mode->width;
++		__v4l2_ctrl_modify_range(ov2311->hblank, h_blank,
++					 h_blank, 1, h_blank);
++		__v4l2_ctrl_s_ctrl(ov2311->hblank, h_blank);
++		vblank_def = mode->vts_def - mode->height;
++		__v4l2_ctrl_modify_range(ov2311->vblank, vblank_def,
++					 OV2311_VTS_MAX - mode->height,
++					 1, vblank_def);
++		__v4l2_ctrl_s_ctrl(ov2311->vblank, vblank_def);
++
++		pixel_rate = (fmt->format.code == MEDIA_BUS_FMT_Y10_1X10) ?
++			OV2311_PIXEL_RATE_10BIT : OV2311_PIXEL_RATE_8BIT;
++		__v4l2_ctrl_modify_range(ov2311->pixel_rate, pixel_rate,
++					 pixel_rate, 1, pixel_rate);
++	}
++
++	mutex_unlock(&ov2311->mutex);
++
++	return 0;
++}
++
++static int ov2311_get_fmt(struct v4l2_subdev *sd,
++			  struct v4l2_subdev_state *sd_state,
++			  struct v4l2_subdev_format *fmt)
++{
++	struct ov2311 *ov2311 = to_ov2311(sd);
++	const struct ov2311_mode *mode = ov2311->cur_mode;
++
++	mutex_lock(&ov2311->mutex);
++	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++		fmt->format = *v4l2_subdev_get_try_format(sd, sd_state, fmt->pad);
++	} else {
++		fmt->format.width = mode->width;
++		fmt->format.height = mode->height;
++		fmt->format.code = ov2311->code;
++		fmt->format.field = V4L2_FIELD_NONE;
++		fmt->format.colorspace = V4L2_COLORSPACE_SRGB;
++		fmt->format.ycbcr_enc =
++			V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->format.colorspace);
++		fmt->format.quantization =
++			V4L2_MAP_QUANTIZATION_DEFAULT(true,
++						      fmt->format.colorspace,
++						      fmt->format.ycbcr_enc);
++		fmt->format.xfer_func =
++			V4L2_MAP_XFER_FUNC_DEFAULT(fmt->format.colorspace);
++	}
++	mutex_unlock(&ov2311->mutex);
++
++	return 0;
++}
++
++static int ov2311_enum_mbus_code(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *sd_state,
++				 struct v4l2_subdev_mbus_code_enum *code)
++{
++	switch (code->index) {
++	default:
++		return -EINVAL;
++	case 0:
++		code->code = MEDIA_BUS_FMT_Y10_1X10;
++		break;
++	case 1:
++		code->code = MEDIA_BUS_FMT_Y8_1X8;
++		break;
++	}
++
++	return 0;
++}
++
++static int ov2311_enum_frame_sizes(struct v4l2_subdev *sd,
++				   struct v4l2_subdev_state *sd_state,
++				   struct v4l2_subdev_frame_size_enum *fse)
++{
++	if (fse->index >= ARRAY_SIZE(supported_modes))
++		return -EINVAL;
++
++	if (fse->code != MEDIA_BUS_FMT_Y10_1X10 &&
++	    fse->code != MEDIA_BUS_FMT_Y8_1X8)
++		return -EINVAL;
++
++	fse->min_width  = supported_modes[fse->index].width;
++	fse->max_width  = supported_modes[fse->index].width;
++	fse->max_height = supported_modes[fse->index].height;
++	fse->min_height = supported_modes[fse->index].height;
++
++	return 0;
++}
++
++static int ov2311_enable_test_pattern(struct ov2311 *ov2311, u32 pattern)
++{
++	u32 val;
++
++	if (pattern)
++		val = (pattern - 1) | OV2311_TEST_PATTERN_ENABLE;
++	else
++		val = OV2311_TEST_PATTERN_DISABLE;
++
++	return ov2311_write_reg(ov2311->client, OV2311_REG_TEST_PATTERN,
++				OV2311_REG_VALUE_08BIT, val);
++}
++
++static const struct v4l2_rect *
++__ov2311_get_pad_crop(struct ov2311 *ov2311, struct v4l2_subdev_state *sd_state,
++		      unsigned int pad, enum v4l2_subdev_format_whence which)
++{
++	switch (which) {
++	case V4L2_SUBDEV_FORMAT_TRY:
++		return v4l2_subdev_get_try_crop(&ov2311->subdev, sd_state, pad);
++	case V4L2_SUBDEV_FORMAT_ACTIVE:
++		return &ov2311->cur_mode->crop;
++	}
++
++	return NULL;
++}
++
++static int ov2311_get_selection(struct v4l2_subdev *sd,
++				struct v4l2_subdev_state *sd_state,
++				struct v4l2_subdev_selection *sel)
++{
++	switch (sel->target) {
++	case V4L2_SEL_TGT_CROP: {
++		struct ov2311 *ov2311 = to_ov2311(sd);
++
++		mutex_lock(&ov2311->mutex);
++		sel->r = *__ov2311_get_pad_crop(ov2311, sd_state, sel->pad,
++						sel->which);
++		mutex_unlock(&ov2311->mutex);
++
++		return 0;
++	}
++
++	case V4L2_SEL_TGT_NATIVE_SIZE:
++		sel->r.top = 0;
++		sel->r.left = 0;
++		sel->r.width = OV2311_NATIVE_WIDTH;
++		sel->r.height = OV2311_NATIVE_HEIGHT;
++
++		return 0;
++
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++	case V4L2_SEL_TGT_CROP_BOUNDS:
++		sel->r.top = OV2311_PIXEL_ARRAY_TOP;
++		sel->r.left = OV2311_PIXEL_ARRAY_LEFT;
++		sel->r.width = OV2311_PIXEL_ARRAY_WIDTH;
++		sel->r.height = OV2311_PIXEL_ARRAY_HEIGHT;
++
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++static int ov2311_start_stream(struct ov2311 *ov2311)
++{
++	int ret;
++
++	ret = ov2311_write_array(ov2311->client, ov2311_common_regs);
++	if (ret)
++		return ret;
++
++	ret = ov2311_write_array(ov2311->client, ov2311->cur_mode->reg_list);
++	if (ret)
++		return ret;
++
++	if (ov2311->code == MEDIA_BUS_FMT_Y10_1X10)
++		ret = ov2311_write_array(ov2311->client, op_10bit);
++	else
++		ret = ov2311_write_array(ov2311->client, op_8bit);
++	if (ret)
++		return ret;
++
++	/* In case these controls are set before streaming */
++	mutex_unlock(&ov2311->mutex);
++	ret = v4l2_ctrl_handler_setup(&ov2311->ctrl_handler);
++	mutex_lock(&ov2311->mutex);
++	if (ret)
++		return ret;
++
++	return ov2311_write_reg(ov2311->client, OV2311_REG_CTRL_MODE,
++				OV2311_REG_VALUE_08BIT, OV2311_MODE_STREAMING);
++}
++
++static int ov2311_stop_stream(struct ov2311 *ov2311)
++{
++	return ov2311_write_reg(ov2311->client, OV2311_REG_CTRL_MODE,
++				OV2311_REG_VALUE_08BIT, OV2311_MODE_SW_STANDBY);
++}
++
++static int ov2311_s_stream(struct v4l2_subdev *sd, int enable)
++{
++	struct ov2311 *ov2311 = to_ov2311(sd);
++	struct i2c_client *client = ov2311->client;
++	int ret = 0;
++
++	mutex_lock(&ov2311->mutex);
++	if (ov2311->streaming == enable) {
++		mutex_unlock(&ov2311->mutex);
++		return 0;
++	}
++
++	if (enable) {
++		ret = pm_runtime_resume_and_get(&client->dev);
++		if (ret < 0)
++			goto unlock_and_return;
++
++		ret = ov2311_start_stream(ov2311);
++		if (ret) {
++			v4l2_err(sd, "start stream failed while write regs\n");
++			pm_runtime_put(&client->dev);
++			goto unlock_and_return;
++		}
++	} else {
++		ov2311_stop_stream(ov2311);
++		pm_runtime_put(&client->dev);
++	}
++
++	ov2311->streaming = enable;
++
++unlock_and_return:
++	mutex_unlock(&ov2311->mutex);
++
++	return ret;
++}
++
++static int ov2311_power_on(struct device *dev)
++{
++	struct v4l2_subdev *sd = dev_get_drvdata(dev);
++	struct ov2311 *ov2311 = to_ov2311(sd);
++	int ret;
++
++	ret = clk_set_rate(ov2311->xvclk, OV2311_XVCLK_FREQ);
++	if (ret < 0)
++		dev_warn(dev, "Failed to set xvclk rate (24MHz)\n");
++	if (clk_get_rate(ov2311->xvclk) != OV2311_XVCLK_FREQ)
++		dev_warn(dev, "xvclk mismatched, modes are based on 24MHz - rate is %lu\n",
++			 clk_get_rate(ov2311->xvclk));
++
++	ret = clk_prepare_enable(ov2311->xvclk);
++	if (ret < 0) {
++		dev_err(dev, "Failed to enable xvclk\n");
++		return ret;
++	}
++
++	gpiod_set_value_cansleep(ov2311->reset_gpio, 0);
++
++	ret = regulator_bulk_enable(OV2311_NUM_SUPPLIES, ov2311->supplies);
++	if (ret < 0) {
++		dev_err(dev, "Failed to enable regulators\n");
++		goto disable_clk;
++	}
++
++	gpiod_set_value_cansleep(ov2311->reset_gpio, 1);
++
++	usleep_range(500, 1000);
++	gpiod_set_value_cansleep(ov2311->pwdn_gpio, 1);
++
++	usleep_range(1000, 2000);
++
++	return 0;
++
++disable_clk:
++	clk_disable_unprepare(ov2311->xvclk);
++
++	return ret;
++}
++
++static int ov2311_power_off(struct device *dev)
++{
++	struct v4l2_subdev *sd = dev_get_drvdata(dev);
++	struct ov2311 *ov2311 = to_ov2311(sd);
++
++	gpiod_set_value_cansleep(ov2311->pwdn_gpio, 0);
++	clk_disable_unprepare(ov2311->xvclk);
++	gpiod_set_value_cansleep(ov2311->reset_gpio, 0);
++	regulator_bulk_disable(OV2311_NUM_SUPPLIES, ov2311->supplies);
++
++	return 0;
++}
++
++static int ov2311_runtime_resume(struct device *dev)
++{
++	struct v4l2_subdev *sd = dev_get_drvdata(dev);
++	struct ov2311 *ov2311 = to_ov2311(sd);
++	int ret;
++
++	if (ov2311->streaming) {
++		ret = ov2311_start_stream(ov2311);
++		if (ret)
++			goto error;
++	}
++	return 0;
++
++error:
++	ov2311_stop_stream(ov2311);
++	ov2311->streaming = 0;
++	return ret;
++}
++
++static int ov2311_runtime_suspend(struct device *dev)
++{
++	struct v4l2_subdev *sd = dev_get_drvdata(dev);
++	struct ov2311 *ov2311 = to_ov2311(sd);
++
++	if (ov2311->streaming)
++		ov2311_stop_stream(ov2311);
++
++	return 0;
++}
++
++static int ov2311_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	struct ov2311 *ov2311 = to_ov2311(sd);
++	struct v4l2_mbus_framefmt *try_fmt =
++				v4l2_subdev_get_try_format(sd, fh->state, 0);
++	const struct ov2311_mode *def_mode = &supported_modes[0];
++
++	mutex_lock(&ov2311->mutex);
++	/* Initialize try_fmt */
++	try_fmt->width = def_mode->width;
++	try_fmt->height = def_mode->height;
++	try_fmt->code = MEDIA_BUS_FMT_Y10_1X10;
++	try_fmt->field = V4L2_FIELD_NONE;
++	try_fmt->colorspace = V4L2_COLORSPACE_RAW;
++	try_fmt->ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(try_fmt->colorspace);
++	try_fmt->quantization =
++		V4L2_MAP_QUANTIZATION_DEFAULT(true, try_fmt->colorspace,
++					      try_fmt->ycbcr_enc);
++	try_fmt->xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(try_fmt->colorspace);
++
++	mutex_unlock(&ov2311->mutex);
++	/* No crop or compose */
++
++	return 0;
++}
++
++static const struct dev_pm_ops ov2311_pm_ops = {
++	SET_RUNTIME_PM_OPS(ov2311_runtime_suspend, ov2311_runtime_resume, NULL)
++	SET_RUNTIME_PM_OPS(ov2311_power_off, ov2311_power_on, NULL)
++};
++
++static const struct v4l2_subdev_internal_ops ov2311_internal_ops = {
++	.open = ov2311_open,
++};
++
++static const struct v4l2_subdev_core_ops ov2311_core_ops = {
++	.subscribe_event = v4l2_ctrl_subdev_subscribe_event,
++	.unsubscribe_event = v4l2_event_subdev_unsubscribe,
++};
++
++static const struct v4l2_subdev_video_ops ov2311_video_ops = {
++	.s_stream = ov2311_s_stream,
++};
++
++static const struct v4l2_subdev_pad_ops ov2311_pad_ops = {
++	.enum_mbus_code = ov2311_enum_mbus_code,
++	.enum_frame_size = ov2311_enum_frame_sizes,
++	.get_fmt = ov2311_get_fmt,
++	.set_fmt = ov2311_set_fmt,
++	.get_selection = ov2311_get_selection,
++};
++
++static const struct v4l2_subdev_ops ov2311_subdev_ops = {
++	.core	= &ov2311_core_ops,
++	.video	= &ov2311_video_ops,
++	.pad	= &ov2311_pad_ops,
++};
++
++static int ov2311_set_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct ov2311 *ov2311 = container_of(ctrl->handler,
++					     struct ov2311, ctrl_handler);
++	struct i2c_client *client = ov2311->client;
++	s64 max;
++	int ret = 0;
++
++	/* Propagate change of current control to all related controls */
++	switch (ctrl->id) {
++	case V4L2_CID_VBLANK:
++		/* Update max exposure while meeting expected vblanking */
++		max = ov2311->cur_mode->height + ctrl->val - 4;
++		__v4l2_ctrl_modify_range(ov2311->exposure,
++					 ov2311->exposure->minimum, max,
++					 ov2311->exposure->step,
++					 ov2311->exposure->default_value);
++		break;
++	}
++
++	if (pm_runtime_get(&client->dev) <= 0)
++		return 0;
++
++	switch (ctrl->id) {
++	case V4L2_CID_EXPOSURE:
++		ret = ov2311_write_reg(ov2311->client, OV2311_REG_EXPOSURE,
++				       OV2311_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_ANALOGUE_GAIN:
++		ret = ov2311_write_reg(ov2311->client, OV2311_REG_GAIN_H,
++				       OV2311_REG_VALUE_08BIT,
++				       (ctrl->val >> OV2311_GAIN_H_SHIFT) &
++							OV2311_GAIN_H_MASK);
++		ret |= ov2311_write_reg(ov2311->client, OV2311_REG_GAIN_L,
++				       OV2311_REG_VALUE_08BIT,
++				       ctrl->val & OV2311_GAIN_L_MASK);
++		break;
++	case V4L2_CID_VBLANK:
++		ret = ov2311_write_reg(ov2311->client, OV2311_REG_VTS,
++				       OV2311_REG_VALUE_16BIT,
++				       ctrl->val + ov2311->cur_mode->height);
++		break;
++	case V4L2_CID_TEST_PATTERN:
++		ret = ov2311_enable_test_pattern(ov2311, ctrl->val);
++		break;
++	case V4L2_CID_HFLIP:
++		ret = ov2311_write_reg(ov2311->client, OV2311_REG_H_FLIP,
++				       OV2311_REG_VALUE_08BIT,
++				       ctrl->val ? OV2311_FLIP_BIT : 0);
++		break;
++	case V4L2_CID_VFLIP:
++		ret = ov2311_write_reg(ov2311->client, OV2311_REG_V_FLIP,
++				       OV2311_REG_VALUE_08BIT,
++				       ctrl->val ? OV2311_FLIP_BIT : 0);
++		break;
++	default:
++		dev_warn(&client->dev, "%s Unhandled id:0x%x, val:0x%x\n",
++			 __func__, ctrl->id, ctrl->val);
++		break;
++	}
++
++	pm_runtime_put(&client->dev);
++
++	return ret;
++}
++
++static const struct v4l2_ctrl_ops ov2311_ctrl_ops = {
++	.s_ctrl = ov2311_set_ctrl,
++};
++
++static int ov2311_initialize_controls(struct ov2311 *ov2311)
++{
++	struct v4l2_fwnode_device_properties props;
++	const struct ov2311_mode *mode;
++	struct v4l2_ctrl_handler *handler;
++	struct v4l2_ctrl *ctrl;
++	s64 exposure_max, vblank_def;
++	u32 h_blank;
++	int ret;
++
++	handler = &ov2311->ctrl_handler;
++	mode = ov2311->cur_mode;
++	ret = v4l2_ctrl_handler_init(handler, 11);
++	if (ret)
++		return ret;
++	handler->lock = &ov2311->mutex;
++
++	ctrl = v4l2_ctrl_new_int_menu(handler, NULL, V4L2_CID_LINK_FREQ,
++				      0, 0, link_freq_menu_items);
++	if (ctrl)
++		ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	ov2311->pixel_rate = v4l2_ctrl_new_std(handler, NULL,
++					       V4L2_CID_PIXEL_RATE,
++					       OV2311_PIXEL_RATE_10BIT,
++					       OV2311_PIXEL_RATE_10BIT, 1,
++					       OV2311_PIXEL_RATE_10BIT);
++
++	h_blank = mode->hts_def - mode->width;
++	ov2311->hblank = v4l2_ctrl_new_std(handler, NULL, V4L2_CID_HBLANK,
++					   h_blank, h_blank, 1, h_blank);
++	if (ov2311->hblank)
++		ov2311->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	vblank_def = mode->vts_def - mode->height;
++	ov2311->vblank = v4l2_ctrl_new_std(handler, &ov2311_ctrl_ops,
++					   V4L2_CID_VBLANK, vblank_def,
++					   OV2311_VTS_MAX - mode->height, 1,
++					   vblank_def);
++
++	exposure_max = mode->vts_def - 4;
++	ov2311->exposure = v4l2_ctrl_new_std(handler, &ov2311_ctrl_ops,
++					     V4L2_CID_EXPOSURE,
++					     OV2311_EXPOSURE_MIN, exposure_max,
++					     OV2311_EXPOSURE_STEP,
++					     mode->exp_def);
++
++	v4l2_ctrl_new_std(handler, &ov2311_ctrl_ops, V4L2_CID_ANALOGUE_GAIN,
++			  OV2311_GAIN_MIN, OV2311_GAIN_MAX, OV2311_GAIN_STEP,
++			  OV2311_GAIN_DEFAULT);
++
++	v4l2_ctrl_new_std_menu_items(handler, &ov2311_ctrl_ops,
++				     V4L2_CID_TEST_PATTERN,
++				     ARRAY_SIZE(ov2311_test_pattern_menu) - 1,
++				     0, 0, ov2311_test_pattern_menu);
++
++	v4l2_ctrl_new_std(handler, &ov2311_ctrl_ops,
++			  V4L2_CID_HFLIP, 0, 1, 1, 0);
++
++	v4l2_ctrl_new_std(handler, &ov2311_ctrl_ops,
++			  V4L2_CID_VFLIP, 0, 1, 1, 0);
++
++	ret = v4l2_fwnode_device_parse(&ov2311->client->dev, &props);
++	if (ret)
++		goto err_free_handler;
++
++	ret = v4l2_ctrl_new_fwnode_properties(handler, &ov2311_ctrl_ops,
++					      &props);
++	if (ret)
++		goto err_free_handler;
++
++	if (handler->error) {
++		ret = handler->error;
++		dev_err(&ov2311->client->dev,
++			"Failed to init controls(%d)\n", ret);
++		goto err_free_handler;
++	}
++
++	ov2311->subdev.ctrl_handler = handler;
++
++	return 0;
++
++err_free_handler:
++	v4l2_ctrl_handler_free(handler);
++
++	return ret;
++}
++
++static int ov2311_check_sensor_id(struct ov2311 *ov2311,
++				  struct i2c_client *client)
++{
++	struct device *dev = &ov2311->client->dev;
++	u32 id = 0, id_msb;
++	int ret;
++
++	ret = ov2311_read_reg(client, OV2311_REG_CHIP_ID + 1,
++			      OV2311_REG_VALUE_08BIT, &id);
++	if (!ret)
++		ret = ov2311_read_reg(client, OV2311_REG_CHIP_ID,
++				      OV2311_REG_VALUE_08BIT, &id_msb);
++	id |= (id_msb << 8);
++	if (ret || id != CHIP_ID) {
++		dev_err(dev, "Unexpected sensor id(%04x), ret(%d)\n", id, ret);
++		return -ENODEV;
++	}
++
++	dev_info(dev, "Detected OV%06x sensor\n", CHIP_ID);
++
++	return 0;
++}
++
++static int ov2311_configure_regulators(struct ov2311 *ov2311)
++{
++	unsigned int i;
++
++	for (i = 0; i < OV2311_NUM_SUPPLIES; i++)
++		ov2311->supplies[i].supply = ov2311_supply_names[i];
++
++	return devm_regulator_bulk_get(&ov2311->client->dev,
++				       OV2311_NUM_SUPPLIES,
++				       ov2311->supplies);
++}
++
++static int ov2311_probe(struct i2c_client *client,
++			const struct i2c_device_id *id)
++{
++	struct device *dev = &client->dev;
++	struct ov2311 *ov2311;
++	struct v4l2_subdev *sd;
++	int ret;
++
++	ov2311 = devm_kzalloc(dev, sizeof(*ov2311), GFP_KERNEL);
++	if (!ov2311)
++		return -ENOMEM;
++
++	ov2311->client = client;
++	ov2311->cur_mode = &supported_modes[0];
++
++	ov2311->xvclk = devm_clk_get(dev, "xvclk");
++	if (IS_ERR(ov2311->xvclk)) {
++		dev_err(dev, "Failed to get xvclk\n");
++		return -EINVAL;
++	}
++
++	ov2311->reset_gpio = devm_gpiod_get_optional(dev, "reset",
++						     GPIOD_OUT_LOW);
++	if (IS_ERR(ov2311->reset_gpio))
++		dev_warn(dev, "Failed to get reset-gpios\n");
++
++	ov2311->pwdn_gpio = devm_gpiod_get_optional(dev, "pwdn", GPIOD_OUT_LOW);
++	if (IS_ERR(ov2311->pwdn_gpio))
++		dev_warn(dev, "Failed to get pwdn-gpios\n");
++
++	ret = ov2311_configure_regulators(ov2311);
++	if (ret) {
++		dev_err(dev, "Failed to get power regulators\n");
++		return ret;
++	}
++
++	mutex_init(&ov2311->mutex);
++
++	sd = &ov2311->subdev;
++	v4l2_i2c_subdev_init(sd, client, &ov2311_subdev_ops);
++	ret = ov2311_initialize_controls(ov2311);
++	if (ret)
++		goto err_destroy_mutex;
++
++	ret = ov2311_power_on(&client->dev);
++	if (ret)
++		goto err_free_handler;
++
++	ret = ov2311_check_sensor_id(ov2311, client);
++	if (ret)
++		goto err_power_off;
++
++	sd->internal_ops = &ov2311_internal_ops;
++	sd->flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
++
++	ov2311->pad.flags = MEDIA_PAD_FL_SOURCE;
++	sd->entity.function = MEDIA_ENT_F_CAM_SENSOR;
++	ret = media_entity_pads_init(&sd->entity, 1, &ov2311->pad);
++	if (ret < 0)
++		goto err_power_off;
++
++	ret = v4l2_async_register_subdev(sd);
++	if (ret) {
++		dev_err(dev, "v4l2 async register subdev failed\n");
++		goto err_clean_entity;
++	}
++
++	pm_runtime_set_active(dev);
++	pm_runtime_enable(dev);
++	pm_runtime_idle(dev);
++
++	return 0;
++
++err_clean_entity:
++	media_entity_cleanup(&sd->entity);
++err_power_off:
++	ov2311_power_off(&client->dev);
++err_free_handler:
++	v4l2_ctrl_handler_free(&ov2311->ctrl_handler);
++err_destroy_mutex:
++	mutex_destroy(&ov2311->mutex);
++
++	return ret;
++}
++
++static void ov2311_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct ov2311 *ov2311 = to_ov2311(sd);
++
++	v4l2_async_unregister_subdev(sd);
++	media_entity_cleanup(&sd->entity);
++	v4l2_ctrl_handler_free(&ov2311->ctrl_handler);
++	mutex_destroy(&ov2311->mutex);
++
++	pm_runtime_disable(&client->dev);
++	if (!pm_runtime_status_suspended(&client->dev))
++		ov2311_power_off(&client->dev);
++	pm_runtime_set_suspended(&client->dev);
++}
++
++static const struct of_device_id ov2311_of_match[] = {
++	{ .compatible = "ovti,ov2311" },
++	{},
++};
++MODULE_DEVICE_TABLE(of, ov2311_of_match);
++
++static const struct i2c_device_id ov2311_match_id[] = {
++	{ "ovti,ov2311", 0 },
++	{ },
++};
++
++static struct i2c_driver ov2311_i2c_driver = {
++	.driver = {
++		.name = OV2311_NAME,
++		.pm = &ov2311_pm_ops,
++		.of_match_table = of_match_ptr(ov2311_of_match),
++	},
++	.probe		= &ov2311_probe,
++	.remove		= &ov2311_remove,
++	.id_table	= ov2311_match_id,
++};
++
++module_i2c_driver(ov2311_i2c_driver);
++
++MODULE_AUTHOR("Dave Stevenson <dave.stevenson@raspberrypi.com");
++MODULE_DESCRIPTION("OmniVision OV2311 sensor driver");
++MODULE_LICENSE("GPL v2");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0394-staging-vc04_services-isp-Permit-all-sRGB-colour-spa.patch b/target/linux/bcm27xx/patches-6.1/950-0394-staging-vc04_services-isp-Permit-all-sRGB-colour-spa.patch
new file mode 100644
index 00000000000000..a2daffe3590498
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0394-staging-vc04_services-isp-Permit-all-sRGB-colour-spa.patch
@@ -0,0 +1,161 @@
+From 429c4f01eeb8485cf35df0a1c077a66a7cd0a53e Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Wed, 2 Mar 2022 16:47:37 +0000
+Subject: [PATCH] staging: vc04_services: isp: Permit all sRGB colour
+ spaces on ISP outputs
+
+ISP outputs actually support all colour spaces that are fundamentally
+sRGB underneath, regardless of whether an RGB or YUV output format is
+actually requested.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ .../bcm2835-isp/bcm2835-isp-fmts.h            | 45 ++++++++++---------
+ 1 file changed, 25 insertions(+), 20 deletions(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-fmts.h
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-fmts.h
+@@ -34,14 +34,19 @@ struct bcm2835_isp_fmt {
+ #define V4L2_COLORSPACE_MASK_RAW V4L2_COLORSPACE_MASK(V4L2_COLORSPACE_RAW)
+ 
+ /*
+- * The colour spaces we support for YUV outputs. SRGB features here because,
+- * once you assign the default transfer func and so on, it and JPEG effectively
+- * mean the same.
++ * All three colour spaces JPEG, SMPTE170M and REC709 are fundamentally sRGB
++ * underneath (as near as makes no difference to us), just with different YCbCr
++ * encodings. Therefore the ISP can generate sRGB on its main output and any of
++ * the others on its low resolution output. Applications should, when using both
++ * outputs, program the colour spaces on them to be the same, matching whatever
++ * is requested for the low resolution output, even if the main output is
++ * producing an RGB format. In turn this requires us to allow all these colour
++ * spaces for every YUV/RGB output format.
+  */
+-#define V4L2_COLORSPACE_MASK_YUV (V4L2_COLORSPACE_MASK_JPEG | \
+-				  V4L2_COLORSPACE_MASK_SRGB | \
+-				  V4L2_COLORSPACE_MASK_SMPTE170M | \
+-				  V4L2_COLORSPACE_MASK_REC709)
++#define V4L2_COLORSPACE_MASK_ALL_SRGB (V4L2_COLORSPACE_MASK_JPEG |	\
++				       V4L2_COLORSPACE_MASK_SRGB |	\
++				       V4L2_COLORSPACE_MASK_SMPTE170M |	\
++				       V4L2_COLORSPACE_MASK_REC709)
+ 
+ static const struct bcm2835_isp_fmt supported_formats[] = {
+ 	{
+@@ -51,7 +56,7 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 64,
+ 		.mmal_fmt	    = MMAL_ENCODING_I420,
+ 		.size_multiplier_x2 = 3,
+-		.colorspace_mask    = V4L2_COLORSPACE_MASK_YUV,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
+ 		.colorspace_default = V4L2_COLORSPACE_JPEG,
+ 		.step_size	    = 2,
+ 	}, {
+@@ -60,7 +65,7 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 64,
+ 		.mmal_fmt	    = MMAL_ENCODING_YV12,
+ 		.size_multiplier_x2 = 3,
+-		.colorspace_mask    = V4L2_COLORSPACE_MASK_YUV,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
+ 		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
+ 		.step_size	    = 2,
+ 	}, {
+@@ -69,7 +74,7 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_NV12,
+ 		.size_multiplier_x2 = 3,
+-		.colorspace_mask    = V4L2_COLORSPACE_MASK_YUV,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
+ 		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
+ 		.step_size	    = 2,
+ 	}, {
+@@ -78,7 +83,7 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_NV21,
+ 		.size_multiplier_x2 = 3,
+-		.colorspace_mask    = V4L2_COLORSPACE_MASK_YUV,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
+ 		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
+ 		.step_size	    = 2,
+ 	}, {
+@@ -87,7 +92,7 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 64,
+ 		.mmal_fmt	    = MMAL_ENCODING_YUYV,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace_mask    = V4L2_COLORSPACE_MASK_YUV,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
+ 		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
+ 		.step_size	    = 2,
+ 	}, {
+@@ -96,7 +101,7 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 64,
+ 		.mmal_fmt	    = MMAL_ENCODING_UYVY,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace_mask    = V4L2_COLORSPACE_MASK_YUV,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
+ 		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
+ 		.step_size	    = 2,
+ 	}, {
+@@ -105,7 +110,7 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 64,
+ 		.mmal_fmt	    = MMAL_ENCODING_YVYU,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace_mask    = V4L2_COLORSPACE_MASK_YUV,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
+ 		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
+ 		.step_size	    = 2,
+ 	}, {
+@@ -114,7 +119,7 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 64,
+ 		.mmal_fmt	    = MMAL_ENCODING_VYUY,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace_mask    = V4L2_COLORSPACE_MASK_YUV,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
+ 		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
+ 		.step_size	    = 2,
+ 	}, {
+@@ -124,7 +129,7 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_RGB24,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace_mask    = V4L2_COLORSPACE_MASK_SRGB,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
+ 		.colorspace_default = V4L2_COLORSPACE_SRGB,
+ 		.step_size	    = 1,
+ 	}, {
+@@ -133,7 +138,7 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_RGB16,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace_mask    = V4L2_COLORSPACE_MASK_SRGB,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
+ 		.colorspace_default = V4L2_COLORSPACE_SRGB,
+ 		.step_size	    = 1,
+ 	}, {
+@@ -142,7 +147,7 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 32,
+ 		.mmal_fmt	    = MMAL_ENCODING_BGR24,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace_mask    = V4L2_COLORSPACE_MASK_SRGB,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
+ 		.colorspace_default = V4L2_COLORSPACE_SRGB,
+ 		.step_size	    = 1,
+ 	}, {
+@@ -151,7 +156,7 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 64,
+ 		.mmal_fmt	    = MMAL_ENCODING_BGRA,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace_mask    = V4L2_COLORSPACE_MASK_SRGB,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
+ 		.colorspace_default = V4L2_COLORSPACE_SRGB,
+ 		.step_size	    = 1,
+ 	}, {
+@@ -160,7 +165,7 @@ static const struct bcm2835_isp_fmt supp
+ 		.bytesperline_align = 64,
+ 		.mmal_fmt	    = MMAL_ENCODING_RGBA,
+ 		.size_multiplier_x2 = 2,
+-		.colorspace_mask    = V4L2_COLORSPACE_MASK_SRGB,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
+ 		.colorspace_default = V4L2_COLORSPACE_SRGB,
+ 		.step_size	    = 1,
+ 	}, {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0395-drivers-staging-bcm2835-isp-Do-not-cleanup-mmal-vcsm.patch b/target/linux/bcm27xx/patches-6.1/950-0395-drivers-staging-bcm2835-isp-Do-not-cleanup-mmal-vcsm.patch
new file mode 100644
index 00000000000000..bc8a08afd3eab3
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0395-drivers-staging-bcm2835-isp-Do-not-cleanup-mmal-vcsm.patch
@@ -0,0 +1,43 @@
+From 503fc3bae65b74555d0836871a77163f1ea903dc Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Thu, 3 Mar 2022 16:45:53 +0000
+Subject: [PATCH] drivers: staging: bcm2835-isp: Do not cleanup mmal
+ vcsm buffer on stop_streaming
+
+On stop_streaming() the vcsm buffer handle gets released by the buffer cleanup
+code.  This will subsequently cause and error if userland re-queues the same
+buffer on the next start_streaming() call.
+
+Remove this cleanup code and rely on the vb2_ops->buf_cleanup() call to do the
+cleanups instead.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
+@@ -624,7 +624,6 @@ static void bcm2835_isp_node_stop_stream
+ {
+ 	struct bcm2835_isp_node *node = vb2_get_drv_priv(q);
+ 	struct bcm2835_isp_dev *dev = node_get_dev(node);
+-	unsigned int i;
+ 	int ret;
+ 
+ 	v4l2_dbg(1, debug, &dev->v4l2_dev, "%s: node %s[%d], mmal port %p\n",
+@@ -655,14 +654,6 @@ static void bcm2835_isp_node_stop_stream
+ 		}
+ 	}
+ 
+-	/* Release the VCSM handle here to release the associated dmabuf */
+-	for (i = 0; i < q->num_buffers; i++) {
+-		struct vb2_v4l2_buffer *vb2 = to_vb2_v4l2_buffer(q->bufs[i]);
+-		struct bcm2835_isp_buffer *buf =
+-			container_of(vb2, struct bcm2835_isp_buffer, vb);
+-		bcm2835_isp_mmal_buf_cleanup(&buf->mmal);
+-	}
+-
+ 	atomic_dec(&dev->num_streaming);
+ 	/* If all ports disabled, then disable the component */
+ 	if (atomic_read(&dev->num_streaming) == 0) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0396-dt-bindings-media-i2c-Add-binding-for-ad5398-VCM.patch b/target/linux/bcm27xx/patches-6.1/950-0396-dt-bindings-media-i2c-Add-binding-for-ad5398-VCM.patch
new file mode 100644
index 00000000000000..09b52545a4987f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0396-dt-bindings-media-i2c-Add-binding-for-ad5398-VCM.patch
@@ -0,0 +1,39 @@
+From f9517de50bf99b3e9325bf416db6082aeaa94bd5 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 29 Sep 2021 12:33:35 +0100
+Subject: [PATCH] dt-bindings: media: i2c: Add binding for ad5398 VCM
+
+Add a binding for Analog Devices AD5398 10bit current
+sinking DAC when used as a lens VCM driver.
+
+FIXME: Convert to YAML
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../devicetree/bindings/media/i2c/ad5398.txt  | 20 +++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/ad5398.txt
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/ad5398.txt
+@@ -0,0 +1,20 @@
++* Analog Devices AD5398 autofocus coil
++
++Required Properties:
++
++  - compatible: Must contain one of:
++		- "adi,ad5398"
++
++  - reg: I2C slave address
++
++  - VANA-supply: supply of voltage for VANA pin
++
++Example:
++
++       ad5398: coil@c {
++               compatible = "adi,ad5398";
++               reg = <0x0c>;
++
++               VANA-supply = <&vaux4>;
++       };
++
diff --git a/target/linux/bcm27xx/patches-6.1/950-0397-media-i2c-Add-driver-for-AD5398-VCM-lens-driver.patch b/target/linux/bcm27xx/patches-6.1/950-0397-media-i2c-Add-driver-for-AD5398-VCM-lens-driver.patch
new file mode 100644
index 00000000000000..e5b20d2d1eff80
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0397-media-i2c-Add-driver-for-AD5398-VCM-lens-driver.patch
@@ -0,0 +1,387 @@
+From 099c31b8568b7e8c11e57ffced2da1cbccbfbcad Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 29 Sep 2021 14:04:28 +0100
+Subject: [PATCH] media: i2c: Add driver for AD5398 VCM lens driver
+
+Adds a driver for the Analog Devices AD5398 10 bit
+I2C DAC which is commonly used for driving VCM lens
+mechanisms.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/Kconfig  |   7 +
+ drivers/media/i2c/Makefile |   1 +
+ drivers/media/i2c/ad5398.c | 341 +++++++++++++++++++++++++++++++++++++
+ 3 files changed, 349 insertions(+)
+ create mode 100644 drivers/media/i2c/ad5398.c
+
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -810,6 +810,13 @@ endmenu
+ menu "Lens drivers"
+ 	visible if MEDIA_CAMERA_SUPPORT
+ 
++config VIDEO_AD5398
++	tristate "AD5398 lens voice coil support"
++	depends on GPIOLIB && I2C && VIDEO_DEV
++	select MEDIA_CONTROLLER
++	help
++	  This is a driver for the AD5398 camera lens voice coil.
++
+ config VIDEO_AD5820
+ 	tristate "AD5820 lens voice coil support"
+ 	depends on GPIOLIB && I2C && VIDEO_DEV
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -3,6 +3,7 @@
+ msp3400-objs	:=	msp3400-driver.o msp3400-kthreads.o
+ 
+ obj-$(CONFIG_SDR_MAX2175) += max2175.o
++obj-$(CONFIG_VIDEO_AD5398)  += ad5398.o
+ obj-$(CONFIG_VIDEO_AD5820) += ad5820.o
+ obj-$(CONFIG_VIDEO_AD9389B) += ad9389b.o
+ obj-$(CONFIG_VIDEO_ADP1653) += adp1653.o
+--- /dev/null
++++ b/drivers/media/i2c/ad5398.c
+@@ -0,0 +1,341 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * AD5398 DAC driver for camera voice coil focus.
++ * Copyright (C) 2021 Raspberry Pi (Trading) Ltd.
++ *
++ * Based on AD5820 DAC driver by Nokia and TI.
++ *
++ * This driver uses the regulator framework notification hooks on the
++ * assumption that the VCM and sensor share a regulator. This means the VCM
++ * position will be restored when either the sensor or VCM subdevices are opened
++ * or powered up. The client can therefore choose to ignore the VCM subdevice,
++ * and the lens position will be as previously requested. Without that, there
++ * is a hard requirement to have the VCM subdevice open in order for the VCM
++ * to be powered and at the requested position.
++ */
++
++#include <linux/errno.h>
++#include <linux/i2c.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/regulator/consumer.h>
++#include <linux/gpio/consumer.h>
++
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-subdev.h>
++
++/* Register definitions */
++#define AD5398_POWER_DOWN		BIT(15)
++#define AD5398_DAC_SHIFT		4
++
++#define to_ad5398_device(sd)	container_of(sd, struct ad5398_device, subdev)
++
++struct ad5398_device {
++	struct v4l2_subdev subdev;
++	struct ad5398_platform_data *platform_data;
++	struct regulator *vana;
++	struct notifier_block nb;
++
++	struct v4l2_ctrl_handler ctrls;
++	u32 focus_absolute;
++
++	bool standby;
++};
++
++static int ad5398_write(struct ad5398_device *coil, u16 data)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&coil->subdev);
++	struct i2c_msg msg;
++	__be16 be_data;
++	int r;
++
++	if (!client->adapter)
++		return -ENODEV;
++
++	be_data = cpu_to_be16(data);
++	msg.addr  = client->addr;
++	msg.flags = 0;
++	msg.len   = 2;
++	msg.buf   = (u8 *)&be_data;
++
++	r = i2c_transfer(client->adapter, &msg, 1);
++	if (r < 0) {
++		dev_err(&client->dev, "write failed, error %d\n", r);
++		return r;
++	}
++
++	return 0;
++}
++
++/*
++ * Calculate status word and write it to the device based on current
++ * values of V4L2 controls. It is assumed that the stored V4L2 control
++ * values are properly limited and rounded.
++ */
++static int ad5398_update_hw(struct ad5398_device *coil)
++{
++	u16 status;
++
++	status = coil->focus_absolute << AD5398_DAC_SHIFT;
++
++	if (coil->standby)
++		status |= AD5398_POWER_DOWN;
++
++	return ad5398_write(coil, status);
++}
++
++/*
++ * Power handling
++ */
++static int ad5398_power_off(struct ad5398_device *coil)
++{
++	int ret = 0;
++
++	coil->standby = true;
++	ret = ad5398_update_hw(coil);
++
++	return ret;
++}
++
++static int ad5398_power_on(struct ad5398_device *coil)
++{
++	int ret;
++
++	/* Restore the hardware settings. */
++	coil->standby = false;
++	ret = ad5398_update_hw(coil);
++	if (ret)
++		goto fail;
++
++	return 0;
++
++fail:
++	coil->standby = true;
++
++	return ret;
++}
++
++/*
++ * V4L2 controls
++ */
++static int ad5398_set_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct ad5398_device *coil =
++		container_of(ctrl->handler, struct ad5398_device, ctrls);
++
++	switch (ctrl->id) {
++	case V4L2_CID_FOCUS_ABSOLUTE:
++		coil->focus_absolute = ctrl->val;
++		return ad5398_update_hw(coil);
++	}
++
++	return 0;
++}
++
++static const struct v4l2_ctrl_ops ad5398_ctrl_ops = {
++	.s_ctrl = ad5398_set_ctrl,
++};
++
++static int ad5398_init_controls(struct ad5398_device *coil)
++{
++	v4l2_ctrl_handler_init(&coil->ctrls, 1);
++
++	/*
++	 * V4L2_CID_FOCUS_ABSOLUTE
++	 *
++	 * Minimum current is 0 mA, maximum is 120 mA. Thus, 1 code is
++	 * equivalent to 120/1023 = 0.1173 mA. Nevertheless, we do not use [mA]
++	 * for focus position, because it is meaningless for user. Meaningful
++	 * would be to use focus distance or even its inverse, but since the
++	 * driver doesn't have sufficient knowledge to do the conversion, we
++	 * will just use abstract codes here. In any case, smaller value = focus
++	 * position farther from camera. The default zero value means focus at
++	 * infinity, and also least current consumption.
++	 */
++	v4l2_ctrl_new_std(&coil->ctrls, &ad5398_ctrl_ops,
++			  V4L2_CID_FOCUS_ABSOLUTE, 0, 1023, 1, 0);
++
++	if (coil->ctrls.error)
++		return coil->ctrls.error;
++
++	coil->focus_absolute = 0;
++
++	coil->subdev.ctrl_handler = &coil->ctrls;
++
++	return 0;
++}
++
++/*
++ * V4L2 subdev operations
++ */
++static int ad5398_registered(struct v4l2_subdev *subdev)
++{
++	struct ad5398_device *coil = to_ad5398_device(subdev);
++
++	return ad5398_init_controls(coil);
++}
++
++static int
++ad5398_set_power(struct v4l2_subdev *subdev, int on)
++{
++	struct ad5398_device *coil = to_ad5398_device(subdev);
++	int ret;
++
++	if (on)
++		ret = regulator_enable(coil->vana);
++	else
++		ret = regulator_disable(coil->vana);
++
++	return ret;
++}
++
++static int ad5398_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	struct ad5398_device *coil = to_ad5398_device(sd);
++
++	return regulator_enable(coil->vana);
++}
++
++static int ad5398_close(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	struct ad5398_device *coil = to_ad5398_device(sd);
++
++	return regulator_disable(coil->vana);
++}
++
++static const struct v4l2_subdev_core_ops ad5398_core_ops = {
++	.s_power = ad5398_set_power,
++};
++
++static const struct v4l2_subdev_ops ad5398_ops = {
++	.core = &ad5398_core_ops,
++};
++
++static const struct v4l2_subdev_internal_ops ad5398_internal_ops = {
++	.registered = ad5398_registered,
++	.open = ad5398_open,
++	.close = ad5398_close,
++};
++
++/*
++ * I2C driver
++ */
++static int __maybe_unused ad5398_suspend(struct device *dev)
++{
++	struct i2c_client *client = container_of(dev, struct i2c_client, dev);
++	struct v4l2_subdev *subdev = i2c_get_clientdata(client);
++	struct ad5398_device *coil = to_ad5398_device(subdev);
++
++	return regulator_enable(coil->vana);
++}
++
++static int __maybe_unused ad5398_resume(struct device *dev)
++{
++	struct i2c_client *client = container_of(dev, struct i2c_client, dev);
++	struct v4l2_subdev *subdev = i2c_get_clientdata(client);
++	struct ad5398_device *coil = to_ad5398_device(subdev);
++
++	return regulator_disable(coil->vana);
++}
++
++static int ad5398_regulator_notifier(struct notifier_block *nb,
++				     unsigned long event,
++				     void *ignored)
++{
++	struct ad5398_device *coil = container_of(nb, struct ad5398_device, nb);
++
++	if (event == REGULATOR_EVENT_ENABLE)
++		ad5398_power_on(coil);
++	else if (event == REGULATOR_EVENT_PRE_DISABLE)
++		ad5398_power_off(coil);
++
++	return NOTIFY_OK;
++}
++
++static int ad5398_probe(struct i2c_client *client,
++			const struct i2c_device_id *devid)
++{
++	struct ad5398_device *coil;
++	int ret;
++
++	coil = devm_kzalloc(&client->dev, sizeof(*coil), GFP_KERNEL);
++	if (!coil)
++		return -ENOMEM;
++
++	coil->vana = devm_regulator_get(&client->dev, "VANA");
++	if (IS_ERR(coil->vana)) {
++		ret = PTR_ERR(coil->vana);
++		if (ret != -EPROBE_DEFER)
++			dev_err(&client->dev, "could not get regulator for vana\n");
++		return ret;
++	}
++
++	v4l2_i2c_subdev_init(&coil->subdev, client, &ad5398_ops);
++	coil->subdev.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
++	coil->subdev.internal_ops = &ad5398_internal_ops;
++	coil->subdev.entity.function = MEDIA_ENT_F_LENS;
++	strscpy(coil->subdev.name, "ad5398 focus", sizeof(coil->subdev.name));
++
++	coil->nb.notifier_call = &ad5398_regulator_notifier;
++	ret = regulator_register_notifier(coil->vana, &coil->nb);
++	if (ret < 0)
++		return ret;
++
++	ret = media_entity_pads_init(&coil->subdev.entity, 0, NULL);
++	if (ret < 0)
++		goto cleanup2;
++
++	ret = v4l2_async_register_subdev(&coil->subdev);
++	if (ret < 0)
++		goto cleanup;
++
++	return ret;
++
++cleanup:
++	media_entity_cleanup(&coil->subdev.entity);
++cleanup2:
++	regulator_unregister_notifier(coil->vana, &coil->nb);
++	return ret;
++}
++
++static void ad5398_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *subdev = i2c_get_clientdata(client);
++	struct ad5398_device *coil = to_ad5398_device(subdev);
++
++	v4l2_async_unregister_subdev(&coil->subdev);
++	v4l2_ctrl_handler_free(&coil->ctrls);
++	media_entity_cleanup(&coil->subdev.entity);
++}
++
++static const struct i2c_device_id ad5398_id_table[] = {
++	{ "ad5398", 0 },
++	{ }
++};
++MODULE_DEVICE_TABLE(i2c, ad5398_id_table);
++
++static const struct of_device_id ad5398_of_table[] = {
++	{ .compatible = "adi,ad5398" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, ad5398_of_table);
++
++static SIMPLE_DEV_PM_OPS(ad5398_pm, ad5398_suspend, ad5398_resume);
++
++static struct i2c_driver ad5398_i2c_driver = {
++	.driver		= {
++		.name	= "ad5398",
++		.pm	= &ad5398_pm,
++		.of_match_table = ad5398_of_table,
++	},
++	.probe		= ad5398_probe,
++	.remove		= ad5398_remove,
++	.id_table	= ad5398_id_table,
++};
++
++module_i2c_driver(ad5398_i2c_driver);
++
++MODULE_AUTHOR("Dave Stevenson <dave.stevenson@raspberrypi.com>");
++MODULE_DESCRIPTION("AD5398 camera lens driver");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0398-media-i2c-ov5647-Use-v4l2_async_register_subdev_sens.patch b/target/linux/bcm27xx/patches-6.1/950-0398-media-i2c-ov5647-Use-v4l2_async_register_subdev_sens.patch
new file mode 100644
index 00000000000000..8df6a0ce1819d4
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0398-media-i2c-ov5647-Use-v4l2_async_register_subdev_sens.patch
@@ -0,0 +1,26 @@
+From 7c6e7b7571e837d22e94ecfd26328ea59a25a076 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 16 Mar 2022 12:15:41 +0000
+Subject: [PATCH] media: i2c: ov5647: Use
+ v4l2_async_register_subdev_sensor for lens binding
+
+v4l2_async_register_subdev doesn't bind in lens or flash drivers,
+but v4l2_async_register_subdev_sensor does.
+Switch to using v4l2_async_register_subdev_sensor.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov5647.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -1558,7 +1558,7 @@ static int ov5647_probe(struct i2c_clien
+ 	if (ret < 0)
+ 		goto power_off;
+ 
+-	ret = v4l2_async_register_subdev(sd);
++	ret = v4l2_async_register_subdev_sensor(sd);
+ 	if (ret < 0)
+ 		goto power_off;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0399-media-i2c-Rename-ad5398-to-ad5398_vcm.patch b/target/linux/bcm27xx/patches-6.1/950-0399-media-i2c-Rename-ad5398-to-ad5398_vcm.patch
new file mode 100644
index 00000000000000..e3d4031504b1ee
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0399-media-i2c-Rename-ad5398-to-ad5398_vcm.patch
@@ -0,0 +1,717 @@
+From 75bcf465c32541eb20eb5c75c16e073830c5b1d1 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 17 Mar 2022 15:13:10 +0000
+Subject: [PATCH] media: i2c: Rename ad5398 to ad5398_vcm
+
+There's already a regulator module called ad5398 that exposes
+this device through the regulator API. That is meaningless in
+the terms that it uses and how it maps to V4L2, so a new driver
+was added. However the module name collision wasn't noted, so
+rename it now.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/Makefile                   | 2 +-
+ drivers/media/i2c/{ad5398.c => ad5398_vcm.c} | 0
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+ rename drivers/media/i2c/{ad5398.c => ad5398_vcm.c} (100%)
+
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -3,7 +3,7 @@
+ msp3400-objs	:=	msp3400-driver.o msp3400-kthreads.o
+ 
+ obj-$(CONFIG_SDR_MAX2175) += max2175.o
+-obj-$(CONFIG_VIDEO_AD5398)  += ad5398.o
++obj-$(CONFIG_VIDEO_AD5398) += ad5398_vcm.o
+ obj-$(CONFIG_VIDEO_AD5820) += ad5820.o
+ obj-$(CONFIG_VIDEO_AD9389B) += ad9389b.o
+ obj-$(CONFIG_VIDEO_ADP1653) += adp1653.o
+--- a/drivers/media/i2c/ad5398.c
++++ /dev/null
+@@ -1,341 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0-only
+-/*
+- * AD5398 DAC driver for camera voice coil focus.
+- * Copyright (C) 2021 Raspberry Pi (Trading) Ltd.
+- *
+- * Based on AD5820 DAC driver by Nokia and TI.
+- *
+- * This driver uses the regulator framework notification hooks on the
+- * assumption that the VCM and sensor share a regulator. This means the VCM
+- * position will be restored when either the sensor or VCM subdevices are opened
+- * or powered up. The client can therefore choose to ignore the VCM subdevice,
+- * and the lens position will be as previously requested. Without that, there
+- * is a hard requirement to have the VCM subdevice open in order for the VCM
+- * to be powered and at the requested position.
+- */
+-
+-#include <linux/errno.h>
+-#include <linux/i2c.h>
+-#include <linux/kernel.h>
+-#include <linux/module.h>
+-#include <linux/regulator/consumer.h>
+-#include <linux/gpio/consumer.h>
+-
+-#include <media/v4l2-ctrls.h>
+-#include <media/v4l2-device.h>
+-#include <media/v4l2-subdev.h>
+-
+-/* Register definitions */
+-#define AD5398_POWER_DOWN		BIT(15)
+-#define AD5398_DAC_SHIFT		4
+-
+-#define to_ad5398_device(sd)	container_of(sd, struct ad5398_device, subdev)
+-
+-struct ad5398_device {
+-	struct v4l2_subdev subdev;
+-	struct ad5398_platform_data *platform_data;
+-	struct regulator *vana;
+-	struct notifier_block nb;
+-
+-	struct v4l2_ctrl_handler ctrls;
+-	u32 focus_absolute;
+-
+-	bool standby;
+-};
+-
+-static int ad5398_write(struct ad5398_device *coil, u16 data)
+-{
+-	struct i2c_client *client = v4l2_get_subdevdata(&coil->subdev);
+-	struct i2c_msg msg;
+-	__be16 be_data;
+-	int r;
+-
+-	if (!client->adapter)
+-		return -ENODEV;
+-
+-	be_data = cpu_to_be16(data);
+-	msg.addr  = client->addr;
+-	msg.flags = 0;
+-	msg.len   = 2;
+-	msg.buf   = (u8 *)&be_data;
+-
+-	r = i2c_transfer(client->adapter, &msg, 1);
+-	if (r < 0) {
+-		dev_err(&client->dev, "write failed, error %d\n", r);
+-		return r;
+-	}
+-
+-	return 0;
+-}
+-
+-/*
+- * Calculate status word and write it to the device based on current
+- * values of V4L2 controls. It is assumed that the stored V4L2 control
+- * values are properly limited and rounded.
+- */
+-static int ad5398_update_hw(struct ad5398_device *coil)
+-{
+-	u16 status;
+-
+-	status = coil->focus_absolute << AD5398_DAC_SHIFT;
+-
+-	if (coil->standby)
+-		status |= AD5398_POWER_DOWN;
+-
+-	return ad5398_write(coil, status);
+-}
+-
+-/*
+- * Power handling
+- */
+-static int ad5398_power_off(struct ad5398_device *coil)
+-{
+-	int ret = 0;
+-
+-	coil->standby = true;
+-	ret = ad5398_update_hw(coil);
+-
+-	return ret;
+-}
+-
+-static int ad5398_power_on(struct ad5398_device *coil)
+-{
+-	int ret;
+-
+-	/* Restore the hardware settings. */
+-	coil->standby = false;
+-	ret = ad5398_update_hw(coil);
+-	if (ret)
+-		goto fail;
+-
+-	return 0;
+-
+-fail:
+-	coil->standby = true;
+-
+-	return ret;
+-}
+-
+-/*
+- * V4L2 controls
+- */
+-static int ad5398_set_ctrl(struct v4l2_ctrl *ctrl)
+-{
+-	struct ad5398_device *coil =
+-		container_of(ctrl->handler, struct ad5398_device, ctrls);
+-
+-	switch (ctrl->id) {
+-	case V4L2_CID_FOCUS_ABSOLUTE:
+-		coil->focus_absolute = ctrl->val;
+-		return ad5398_update_hw(coil);
+-	}
+-
+-	return 0;
+-}
+-
+-static const struct v4l2_ctrl_ops ad5398_ctrl_ops = {
+-	.s_ctrl = ad5398_set_ctrl,
+-};
+-
+-static int ad5398_init_controls(struct ad5398_device *coil)
+-{
+-	v4l2_ctrl_handler_init(&coil->ctrls, 1);
+-
+-	/*
+-	 * V4L2_CID_FOCUS_ABSOLUTE
+-	 *
+-	 * Minimum current is 0 mA, maximum is 120 mA. Thus, 1 code is
+-	 * equivalent to 120/1023 = 0.1173 mA. Nevertheless, we do not use [mA]
+-	 * for focus position, because it is meaningless for user. Meaningful
+-	 * would be to use focus distance or even its inverse, but since the
+-	 * driver doesn't have sufficient knowledge to do the conversion, we
+-	 * will just use abstract codes here. In any case, smaller value = focus
+-	 * position farther from camera. The default zero value means focus at
+-	 * infinity, and also least current consumption.
+-	 */
+-	v4l2_ctrl_new_std(&coil->ctrls, &ad5398_ctrl_ops,
+-			  V4L2_CID_FOCUS_ABSOLUTE, 0, 1023, 1, 0);
+-
+-	if (coil->ctrls.error)
+-		return coil->ctrls.error;
+-
+-	coil->focus_absolute = 0;
+-
+-	coil->subdev.ctrl_handler = &coil->ctrls;
+-
+-	return 0;
+-}
+-
+-/*
+- * V4L2 subdev operations
+- */
+-static int ad5398_registered(struct v4l2_subdev *subdev)
+-{
+-	struct ad5398_device *coil = to_ad5398_device(subdev);
+-
+-	return ad5398_init_controls(coil);
+-}
+-
+-static int
+-ad5398_set_power(struct v4l2_subdev *subdev, int on)
+-{
+-	struct ad5398_device *coil = to_ad5398_device(subdev);
+-	int ret;
+-
+-	if (on)
+-		ret = regulator_enable(coil->vana);
+-	else
+-		ret = regulator_disable(coil->vana);
+-
+-	return ret;
+-}
+-
+-static int ad5398_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
+-{
+-	struct ad5398_device *coil = to_ad5398_device(sd);
+-
+-	return regulator_enable(coil->vana);
+-}
+-
+-static int ad5398_close(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
+-{
+-	struct ad5398_device *coil = to_ad5398_device(sd);
+-
+-	return regulator_disable(coil->vana);
+-}
+-
+-static const struct v4l2_subdev_core_ops ad5398_core_ops = {
+-	.s_power = ad5398_set_power,
+-};
+-
+-static const struct v4l2_subdev_ops ad5398_ops = {
+-	.core = &ad5398_core_ops,
+-};
+-
+-static const struct v4l2_subdev_internal_ops ad5398_internal_ops = {
+-	.registered = ad5398_registered,
+-	.open = ad5398_open,
+-	.close = ad5398_close,
+-};
+-
+-/*
+- * I2C driver
+- */
+-static int __maybe_unused ad5398_suspend(struct device *dev)
+-{
+-	struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+-	struct v4l2_subdev *subdev = i2c_get_clientdata(client);
+-	struct ad5398_device *coil = to_ad5398_device(subdev);
+-
+-	return regulator_enable(coil->vana);
+-}
+-
+-static int __maybe_unused ad5398_resume(struct device *dev)
+-{
+-	struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+-	struct v4l2_subdev *subdev = i2c_get_clientdata(client);
+-	struct ad5398_device *coil = to_ad5398_device(subdev);
+-
+-	return regulator_disable(coil->vana);
+-}
+-
+-static int ad5398_regulator_notifier(struct notifier_block *nb,
+-				     unsigned long event,
+-				     void *ignored)
+-{
+-	struct ad5398_device *coil = container_of(nb, struct ad5398_device, nb);
+-
+-	if (event == REGULATOR_EVENT_ENABLE)
+-		ad5398_power_on(coil);
+-	else if (event == REGULATOR_EVENT_PRE_DISABLE)
+-		ad5398_power_off(coil);
+-
+-	return NOTIFY_OK;
+-}
+-
+-static int ad5398_probe(struct i2c_client *client,
+-			const struct i2c_device_id *devid)
+-{
+-	struct ad5398_device *coil;
+-	int ret;
+-
+-	coil = devm_kzalloc(&client->dev, sizeof(*coil), GFP_KERNEL);
+-	if (!coil)
+-		return -ENOMEM;
+-
+-	coil->vana = devm_regulator_get(&client->dev, "VANA");
+-	if (IS_ERR(coil->vana)) {
+-		ret = PTR_ERR(coil->vana);
+-		if (ret != -EPROBE_DEFER)
+-			dev_err(&client->dev, "could not get regulator for vana\n");
+-		return ret;
+-	}
+-
+-	v4l2_i2c_subdev_init(&coil->subdev, client, &ad5398_ops);
+-	coil->subdev.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
+-	coil->subdev.internal_ops = &ad5398_internal_ops;
+-	coil->subdev.entity.function = MEDIA_ENT_F_LENS;
+-	strscpy(coil->subdev.name, "ad5398 focus", sizeof(coil->subdev.name));
+-
+-	coil->nb.notifier_call = &ad5398_regulator_notifier;
+-	ret = regulator_register_notifier(coil->vana, &coil->nb);
+-	if (ret < 0)
+-		return ret;
+-
+-	ret = media_entity_pads_init(&coil->subdev.entity, 0, NULL);
+-	if (ret < 0)
+-		goto cleanup2;
+-
+-	ret = v4l2_async_register_subdev(&coil->subdev);
+-	if (ret < 0)
+-		goto cleanup;
+-
+-	return ret;
+-
+-cleanup:
+-	media_entity_cleanup(&coil->subdev.entity);
+-cleanup2:
+-	regulator_unregister_notifier(coil->vana, &coil->nb);
+-	return ret;
+-}
+-
+-static void ad5398_remove(struct i2c_client *client)
+-{
+-	struct v4l2_subdev *subdev = i2c_get_clientdata(client);
+-	struct ad5398_device *coil = to_ad5398_device(subdev);
+-
+-	v4l2_async_unregister_subdev(&coil->subdev);
+-	v4l2_ctrl_handler_free(&coil->ctrls);
+-	media_entity_cleanup(&coil->subdev.entity);
+-}
+-
+-static const struct i2c_device_id ad5398_id_table[] = {
+-	{ "ad5398", 0 },
+-	{ }
+-};
+-MODULE_DEVICE_TABLE(i2c, ad5398_id_table);
+-
+-static const struct of_device_id ad5398_of_table[] = {
+-	{ .compatible = "adi,ad5398" },
+-	{ }
+-};
+-MODULE_DEVICE_TABLE(of, ad5398_of_table);
+-
+-static SIMPLE_DEV_PM_OPS(ad5398_pm, ad5398_suspend, ad5398_resume);
+-
+-static struct i2c_driver ad5398_i2c_driver = {
+-	.driver		= {
+-		.name	= "ad5398",
+-		.pm	= &ad5398_pm,
+-		.of_match_table = ad5398_of_table,
+-	},
+-	.probe		= ad5398_probe,
+-	.remove		= ad5398_remove,
+-	.id_table	= ad5398_id_table,
+-};
+-
+-module_i2c_driver(ad5398_i2c_driver);
+-
+-MODULE_AUTHOR("Dave Stevenson <dave.stevenson@raspberrypi.com>");
+-MODULE_DESCRIPTION("AD5398 camera lens driver");
+-MODULE_LICENSE("GPL");
+--- /dev/null
++++ b/drivers/media/i2c/ad5398_vcm.c
+@@ -0,0 +1,341 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * AD5398 DAC driver for camera voice coil focus.
++ * Copyright (C) 2021 Raspberry Pi (Trading) Ltd.
++ *
++ * Based on AD5820 DAC driver by Nokia and TI.
++ *
++ * This driver uses the regulator framework notification hooks on the
++ * assumption that the VCM and sensor share a regulator. This means the VCM
++ * position will be restored when either the sensor or VCM subdevices are opened
++ * or powered up. The client can therefore choose to ignore the VCM subdevice,
++ * and the lens position will be as previously requested. Without that, there
++ * is a hard requirement to have the VCM subdevice open in order for the VCM
++ * to be powered and at the requested position.
++ */
++
++#include <linux/errno.h>
++#include <linux/i2c.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/regulator/consumer.h>
++#include <linux/gpio/consumer.h>
++
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-subdev.h>
++
++/* Register definitions */
++#define AD5398_POWER_DOWN		BIT(15)
++#define AD5398_DAC_SHIFT		4
++
++#define to_ad5398_device(sd)	container_of(sd, struct ad5398_device, subdev)
++
++struct ad5398_device {
++	struct v4l2_subdev subdev;
++	struct ad5398_platform_data *platform_data;
++	struct regulator *vana;
++	struct notifier_block nb;
++
++	struct v4l2_ctrl_handler ctrls;
++	u32 focus_absolute;
++
++	bool standby;
++};
++
++static int ad5398_write(struct ad5398_device *coil, u16 data)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&coil->subdev);
++	struct i2c_msg msg;
++	__be16 be_data;
++	int r;
++
++	if (!client->adapter)
++		return -ENODEV;
++
++	be_data = cpu_to_be16(data);
++	msg.addr  = client->addr;
++	msg.flags = 0;
++	msg.len   = 2;
++	msg.buf   = (u8 *)&be_data;
++
++	r = i2c_transfer(client->adapter, &msg, 1);
++	if (r < 0) {
++		dev_err(&client->dev, "write failed, error %d\n", r);
++		return r;
++	}
++
++	return 0;
++}
++
++/*
++ * Calculate status word and write it to the device based on current
++ * values of V4L2 controls. It is assumed that the stored V4L2 control
++ * values are properly limited and rounded.
++ */
++static int ad5398_update_hw(struct ad5398_device *coil)
++{
++	u16 status;
++
++	status = coil->focus_absolute << AD5398_DAC_SHIFT;
++
++	if (coil->standby)
++		status |= AD5398_POWER_DOWN;
++
++	return ad5398_write(coil, status);
++}
++
++/*
++ * Power handling
++ */
++static int ad5398_power_off(struct ad5398_device *coil)
++{
++	int ret = 0;
++
++	coil->standby = true;
++	ret = ad5398_update_hw(coil);
++
++	return ret;
++}
++
++static int ad5398_power_on(struct ad5398_device *coil)
++{
++	int ret;
++
++	/* Restore the hardware settings. */
++	coil->standby = false;
++	ret = ad5398_update_hw(coil);
++	if (ret)
++		goto fail;
++
++	return 0;
++
++fail:
++	coil->standby = true;
++
++	return ret;
++}
++
++/*
++ * V4L2 controls
++ */
++static int ad5398_set_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct ad5398_device *coil =
++		container_of(ctrl->handler, struct ad5398_device, ctrls);
++
++	switch (ctrl->id) {
++	case V4L2_CID_FOCUS_ABSOLUTE:
++		coil->focus_absolute = ctrl->val;
++		return ad5398_update_hw(coil);
++	}
++
++	return 0;
++}
++
++static const struct v4l2_ctrl_ops ad5398_ctrl_ops = {
++	.s_ctrl = ad5398_set_ctrl,
++};
++
++static int ad5398_init_controls(struct ad5398_device *coil)
++{
++	v4l2_ctrl_handler_init(&coil->ctrls, 1);
++
++	/*
++	 * V4L2_CID_FOCUS_ABSOLUTE
++	 *
++	 * Minimum current is 0 mA, maximum is 120 mA. Thus, 1 code is
++	 * equivalent to 120/1023 = 0.1173 mA. Nevertheless, we do not use [mA]
++	 * for focus position, because it is meaningless for user. Meaningful
++	 * would be to use focus distance or even its inverse, but since the
++	 * driver doesn't have sufficient knowledge to do the conversion, we
++	 * will just use abstract codes here. In any case, smaller value = focus
++	 * position farther from camera. The default zero value means focus at
++	 * infinity, and also least current consumption.
++	 */
++	v4l2_ctrl_new_std(&coil->ctrls, &ad5398_ctrl_ops,
++			  V4L2_CID_FOCUS_ABSOLUTE, 0, 1023, 1, 0);
++
++	if (coil->ctrls.error)
++		return coil->ctrls.error;
++
++	coil->focus_absolute = 0;
++
++	coil->subdev.ctrl_handler = &coil->ctrls;
++
++	return 0;
++}
++
++/*
++ * V4L2 subdev operations
++ */
++static int ad5398_registered(struct v4l2_subdev *subdev)
++{
++	struct ad5398_device *coil = to_ad5398_device(subdev);
++
++	return ad5398_init_controls(coil);
++}
++
++static int
++ad5398_set_power(struct v4l2_subdev *subdev, int on)
++{
++	struct ad5398_device *coil = to_ad5398_device(subdev);
++	int ret;
++
++	if (on)
++		ret = regulator_enable(coil->vana);
++	else
++		ret = regulator_disable(coil->vana);
++
++	return ret;
++}
++
++static int ad5398_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	struct ad5398_device *coil = to_ad5398_device(sd);
++
++	return regulator_enable(coil->vana);
++}
++
++static int ad5398_close(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	struct ad5398_device *coil = to_ad5398_device(sd);
++
++	return regulator_disable(coil->vana);
++}
++
++static const struct v4l2_subdev_core_ops ad5398_core_ops = {
++	.s_power = ad5398_set_power,
++};
++
++static const struct v4l2_subdev_ops ad5398_ops = {
++	.core = &ad5398_core_ops,
++};
++
++static const struct v4l2_subdev_internal_ops ad5398_internal_ops = {
++	.registered = ad5398_registered,
++	.open = ad5398_open,
++	.close = ad5398_close,
++};
++
++/*
++ * I2C driver
++ */
++static int __maybe_unused ad5398_suspend(struct device *dev)
++{
++	struct i2c_client *client = container_of(dev, struct i2c_client, dev);
++	struct v4l2_subdev *subdev = i2c_get_clientdata(client);
++	struct ad5398_device *coil = to_ad5398_device(subdev);
++
++	return regulator_enable(coil->vana);
++}
++
++static int __maybe_unused ad5398_resume(struct device *dev)
++{
++	struct i2c_client *client = container_of(dev, struct i2c_client, dev);
++	struct v4l2_subdev *subdev = i2c_get_clientdata(client);
++	struct ad5398_device *coil = to_ad5398_device(subdev);
++
++	return regulator_disable(coil->vana);
++}
++
++static int ad5398_regulator_notifier(struct notifier_block *nb,
++				     unsigned long event,
++				     void *ignored)
++{
++	struct ad5398_device *coil = container_of(nb, struct ad5398_device, nb);
++
++	if (event == REGULATOR_EVENT_ENABLE)
++		ad5398_power_on(coil);
++	else if (event == REGULATOR_EVENT_PRE_DISABLE)
++		ad5398_power_off(coil);
++
++	return NOTIFY_OK;
++}
++
++static int ad5398_probe(struct i2c_client *client,
++			const struct i2c_device_id *devid)
++{
++	struct ad5398_device *coil;
++	int ret;
++
++	coil = devm_kzalloc(&client->dev, sizeof(*coil), GFP_KERNEL);
++	if (!coil)
++		return -ENOMEM;
++
++	coil->vana = devm_regulator_get(&client->dev, "VANA");
++	if (IS_ERR(coil->vana)) {
++		ret = PTR_ERR(coil->vana);
++		if (ret != -EPROBE_DEFER)
++			dev_err(&client->dev, "could not get regulator for vana\n");
++		return ret;
++	}
++
++	v4l2_i2c_subdev_init(&coil->subdev, client, &ad5398_ops);
++	coil->subdev.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
++	coil->subdev.internal_ops = &ad5398_internal_ops;
++	coil->subdev.entity.function = MEDIA_ENT_F_LENS;
++	strscpy(coil->subdev.name, "ad5398 focus", sizeof(coil->subdev.name));
++
++	coil->nb.notifier_call = &ad5398_regulator_notifier;
++	ret = regulator_register_notifier(coil->vana, &coil->nb);
++	if (ret < 0)
++		return ret;
++
++	ret = media_entity_pads_init(&coil->subdev.entity, 0, NULL);
++	if (ret < 0)
++		goto cleanup2;
++
++	ret = v4l2_async_register_subdev(&coil->subdev);
++	if (ret < 0)
++		goto cleanup;
++
++	return ret;
++
++cleanup:
++	media_entity_cleanup(&coil->subdev.entity);
++cleanup2:
++	regulator_unregister_notifier(coil->vana, &coil->nb);
++	return ret;
++}
++
++static void ad5398_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *subdev = i2c_get_clientdata(client);
++	struct ad5398_device *coil = to_ad5398_device(subdev);
++
++	v4l2_async_unregister_subdev(&coil->subdev);
++	v4l2_ctrl_handler_free(&coil->ctrls);
++	media_entity_cleanup(&coil->subdev.entity);
++}
++
++static const struct i2c_device_id ad5398_id_table[] = {
++	{ "ad5398", 0 },
++	{ }
++};
++MODULE_DEVICE_TABLE(i2c, ad5398_id_table);
++
++static const struct of_device_id ad5398_of_table[] = {
++	{ .compatible = "adi,ad5398" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, ad5398_of_table);
++
++static SIMPLE_DEV_PM_OPS(ad5398_pm, ad5398_suspend, ad5398_resume);
++
++static struct i2c_driver ad5398_i2c_driver = {
++	.driver		= {
++		.name	= "ad5398",
++		.pm	= &ad5398_pm,
++		.of_match_table = ad5398_of_table,
++	},
++	.probe		= ad5398_probe,
++	.remove		= ad5398_remove,
++	.id_table	= ad5398_id_table,
++};
++
++module_i2c_driver(ad5398_i2c_driver);
++
++MODULE_AUTHOR("Dave Stevenson <dave.stevenson@raspberrypi.com>");
++MODULE_DESCRIPTION("AD5398 camera lens driver");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0400-drivers-staging-bcm2835-isp-Clear-LS-table-handle-in.patch b/target/linux/bcm27xx/patches-6.1/950-0400-drivers-staging-bcm2835-isp-Clear-LS-table-handle-in.patch
new file mode 100644
index 00000000000000..2183f2759451dd
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0400-drivers-staging-bcm2835-isp-Clear-LS-table-handle-in.patch
@@ -0,0 +1,37 @@
+From bdce2bf86c56f023dc37130afafa3617f05e7876 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 22 Mar 2022 15:16:40 +0000
+Subject: [PATCH] drivers: staging: bcm2835-isp: Clear LS table handle
+ in the firmware
+
+When all nodes have stopped streaming, ensure the firmware has released its
+handle on the LS table dmabuf. This is done by passing a null handle in the
+LS params.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c    | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
+@@ -657,6 +657,19 @@ static void bcm2835_isp_node_stop_stream
+ 	atomic_dec(&dev->num_streaming);
+ 	/* If all ports disabled, then disable the component */
+ 	if (atomic_read(&dev->num_streaming) == 0) {
++		struct bcm2835_isp_lens_shading ls;
++		/*
++		 * The ISP component on the firmware has a reference to the
++		 * dmabuf handle for the lens shading table.  Pass a null handle
++		 * to remove that reference now.
++		 */
++		memset(&ls, 0, sizeof(ls));
++		/* Must set a valid grid size for the FW */
++		ls.grid_cell_size = 16;
++		set_isp_param(&dev->node[0],
++			      MMAL_PARAMETER_LENS_SHADING_OVERRIDE,
++			      &ls, sizeof(ls));
++
+ 		ret = vchiq_mmal_component_disable(dev->mmal_instance,
+ 						   dev->component);
+ 		if (ret) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0401-mm-page_alloc-cma-introduce-a-customisable-threshold.patch b/target/linux/bcm27xx/patches-6.1/950-0401-mm-page_alloc-cma-introduce-a-customisable-threshold.patch
new file mode 100644
index 00000000000000..34f1cea30e0b00
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0401-mm-page_alloc-cma-introduce-a-customisable-threshold.patch
@@ -0,0 +1,67 @@
+From ad2b3cbdb8303c5d4eb6c7c6d6428443dbb8d547 Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Tue, 29 Mar 2022 16:10:06 +0100
+Subject: [PATCH] mm,page_alloc,cma: introduce a customisable threshold
+ for allocating pages in cma
+
+On some platforms the cma area can be half the entire system memory,
+meaning that allocations start happening in the cma area immediately.
+This leads to fragmentation and subsequent fatal cma_alloc failures.
+
+We introduce an "alloc_in_cma_threshold" parameter which requires that
+this many sixteenths of the free pages must be in cma before it will
+try to use them. By default this is set to 12, but the previous
+behaviour can be restored by setting it to 8 on startup.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ mm/page_alloc.c | 28 +++++++++++++++++++++++++---
+ 1 file changed, 25 insertions(+), 3 deletions(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -273,6 +273,27 @@ EXPORT_SYMBOL(init_on_alloc);
+ DEFINE_STATIC_KEY_MAYBE(CONFIG_INIT_ON_FREE_DEFAULT_ON, init_on_free);
+ EXPORT_SYMBOL(init_on_free);
+ 
++#define ALLOC_IN_CMA_THRESHOLD_MAX 16
++#define ALLOC_IN_CMA_THRESHOLD_DEFAULT 12
++
++static unsigned long _alloc_in_cma_threshold __read_mostly
++				= ALLOC_IN_CMA_THRESHOLD_DEFAULT;
++
++static int __init alloc_in_cma_threshold_setup(char *buf)
++{
++	unsigned long res;
++
++	if (kstrtoul(buf, 10, &res) < 0 ||
++	    res > ALLOC_IN_CMA_THRESHOLD_MAX) {
++		pr_err("Bad alloc_cma_threshold value\n");
++		return 0;
++	}
++	_alloc_in_cma_threshold = res;
++	pr_info("Setting alloc_in_cma_threshold to %lu\n", res);
++	return 0;
++}
++early_param("alloc_in_cma_threshold", alloc_in_cma_threshold_setup);
++
+ static bool _init_on_alloc_enabled_early __read_mostly
+ 				= IS_ENABLED(CONFIG_INIT_ON_ALLOC_DEFAULT_ON);
+ static int __init early_init_on_alloc(char *buf)
+@@ -3093,12 +3114,13 @@ __rmqueue(struct zone *zone, unsigned in
+ 	if (IS_ENABLED(CONFIG_CMA)) {
+ 		/*
+ 		 * Balance movable allocations between regular and CMA areas by
+-		 * allocating from CMA when over half of the zone's free memory
+-		 * is in the CMA area.
++		 * allocating from CMA when over more than a given proportion of
++		 * the zone's free memory is in the CMA area.
+ 		 */
+ 		if (alloc_flags & ALLOC_CMA &&
+ 		    zone_page_state(zone, NR_FREE_CMA_PAGES) >
+-		    zone_page_state(zone, NR_FREE_PAGES) / 2) {
++		    zone_page_state(zone, NR_FREE_PAGES) / ALLOC_IN_CMA_THRESHOLD_MAX
++		    * _alloc_in_cma_threshold) {
+ 			page = __rmqueue_cma_fallback(zone, order);
+ 			if (page)
+ 				return page;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0402-pinctrl-bcm2835-Only-return-non-GPIOs-to-inputs.patch b/target/linux/bcm27xx/patches-6.1/950-0402-pinctrl-bcm2835-Only-return-non-GPIOs-to-inputs.patch
new file mode 100644
index 00000000000000..449406193a566d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0402-pinctrl-bcm2835-Only-return-non-GPIOs-to-inputs.patch
@@ -0,0 +1,42 @@
+From 5e59ca8ad881317cf15fc4b0e7423cc3d411a969 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 30 Mar 2022 09:48:41 +0100
+Subject: [PATCH] pinctrl: bcm2835: Only return non-GPIOs to inputs
+
+Allowing GPIO state to persist allows the use of gpioset to control
+GPIO levels without having to use the --mode=wait feature.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/pinctrl/bcm/pinctrl-bcm2835.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+@@ -928,9 +928,12 @@ static int bcm2835_pmx_free(struct pinct
+ 		unsigned offset)
+ {
+ 	struct bcm2835_pinctrl *pc = pinctrl_dev_get_drvdata(pctldev);
++	enum bcm2835_fsel fsel = bcm2835_pinctrl_fsel_get(pc, offset);
++
++	/* Return non-GPIOs to GPIO_IN */
++	if (fsel != BCM2835_FSEL_GPIO_IN && fsel != BCM2835_FSEL_GPIO_OUT)
++		bcm2835_pinctrl_fsel_set(pc, offset, BCM2835_FSEL_GPIO_IN);
+ 
+-	/* disable by setting to GPIO_IN */
+-	bcm2835_pinctrl_fsel_set(pc, offset, BCM2835_FSEL_GPIO_IN);
+ 	return 0;
+ }
+ 
+@@ -972,10 +975,7 @@ static void bcm2835_pmx_gpio_disable_fre
+ 		struct pinctrl_gpio_range *range,
+ 		unsigned offset)
+ {
+-	struct bcm2835_pinctrl *pc = pinctrl_dev_get_drvdata(pctldev);
+-
+-	/* disable by setting to GPIO_IN */
+-	bcm2835_pinctrl_fsel_set(pc, offset, BCM2835_FSEL_GPIO_IN);
++	(void)bcm2835_pmx_free(pctldev, offset);
+ }
+ 
+ static int bcm2835_pmx_gpio_set_direction(struct pinctrl_dev *pctldev,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0403-drm-panel-ilitek-ili9881c-Clean-up-on-mipi_dsi_attac.patch b/target/linux/bcm27xx/patches-6.1/950-0403-drm-panel-ilitek-ili9881c-Clean-up-on-mipi_dsi_attac.patch
new file mode 100644
index 00000000000000..25a12d5912257f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0403-drm-panel-ilitek-ili9881c-Clean-up-on-mipi_dsi_attac.patch
@@ -0,0 +1,31 @@
+From 5ff331cb050f52361ec40512cc6d87f4923ed29f Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 31 Mar 2022 12:03:36 +0100
+Subject: [PATCH] drm/panel: ilitek-ili9881c: Clean up on
+ mipi_dsi_attach failure
+
+mipi_dsi_attach is allowed to fail, and currently the probe
+code doesn't clean up (mainly drm_panel_remove) if this happens.
+
+Add cleanup code on failure.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/panel/panel-ilitek-ili9881c.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
++++ b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
+@@ -1161,7 +1161,11 @@ static int ili9881c_dsi_probe(struct mip
+ 	dsi->format = MIPI_DSI_FMT_RGB888;
+ 	dsi->lanes = 4;
+ 
+-	return mipi_dsi_attach(dsi);
++	ret = mipi_dsi_attach(dsi);
++	if (ret)
++		drm_panel_remove(&ctx->panel);
++
++	return ret;
+ }
+ 
+ static void ili9881c_dsi_remove(struct mipi_dsi_device *dsi)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0404-drm-panel-panel-ilitek9881c-Add-prepare_upstream_fir.patch b/target/linux/bcm27xx/patches-6.1/950-0404-drm-panel-panel-ilitek9881c-Add-prepare_upstream_fir.patch
new file mode 100644
index 00000000000000..53373f6b5c8e28
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0404-drm-panel-panel-ilitek9881c-Add-prepare_upstream_fir.patch
@@ -0,0 +1,28 @@
+From 942d55434af46aebe8f5508995807253a6b235b3 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 31 Mar 2022 12:05:04 +0100
+Subject: [PATCH] drm/panel: panel-ilitek9881c: Add
+ prepare_upstream_first flag
+
+The panel sends MIPI DCS commands during prepare and is expecting
+the bus to remain in LP-11 state in-between.
+
+Set the prepare_upstream_first flag so that the upstream DSI host
+is prepared / pre_enabled first, and therefore the bus is in a
+defined state.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/panel/panel-ilitek-ili9881c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
++++ b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
+@@ -1131,6 +1131,7 @@ static int ili9881c_dsi_probe(struct mip
+ 	ctx->dsi = dsi;
+ 	ctx->desc = of_device_get_match_data(&dsi->dev);
+ 
++	ctx->panel.prepare_upstream_first = true;
+ 	drm_panel_init(&ctx->panel, &dsi->dev, &ili9881c_funcs,
+ 		       DRM_MODE_CONNECTOR_DSI);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0405-clk-bcm2835-use-subsys_initcall-for-the-clock-driver.patch b/target/linux/bcm27xx/patches-6.1/950-0405-clk-bcm2835-use-subsys_initcall-for-the-clock-driver.patch
new file mode 100644
index 00000000000000..387d55705558fe
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0405-clk-bcm2835-use-subsys_initcall-for-the-clock-driver.patch
@@ -0,0 +1,28 @@
+From 08e395e134dfe841947baaaf5693f3d329ebdea1 Mon Sep 17 00:00:00 2001
+From: Alberto Solavagione <albertosolavagione30@gmail.com>
+Date: Wed, 20 Apr 2022 17:15:42 +0200
+Subject: [PATCH] clk-bcm2835: use subsys_initcall for the clock driver
+ when IMA is enabled
+
+Co-authored-by: Davide Scovotto <scovottodavide@gmail.com>
+Co-developed-by: Davide Scovotto <scovottodavide@gmail.com>
+Signed-off-by: Davide Scovotto <scovottodavide@gmail.com>
+Signed-off-by: Alberto Solavagione <albertosolavagione30@gmail.com>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -2438,7 +2438,11 @@ static int __init __bcm2835_clk_driver_i
+ {
+ 	return platform_driver_register(&bcm2835_clk_driver);
+ }
++#ifdef CONFIG_IMA
++subsys_initcall(__bcm2835_clk_driver_init);
++#else
+ postcore_initcall(__bcm2835_clk_driver_init);
++#endif
+ 
+ MODULE_AUTHOR("Eric Anholt <eric@anholt.net>");
+ MODULE_DESCRIPTION("BCM2835 clock driver");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0406-tpm_tis_spi_main-Force-probe-routine-to-run-synchron.patch b/target/linux/bcm27xx/patches-6.1/950-0406-tpm_tis_spi_main-Force-probe-routine-to-run-synchron.patch
new file mode 100644
index 00000000000000..cec0faaffa38b3
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0406-tpm_tis_spi_main-Force-probe-routine-to-run-synchron.patch
@@ -0,0 +1,28 @@
+From 608da34369e1d306cb95a9eca5bb5f930243b654 Mon Sep 17 00:00:00 2001
+From: Scovotto Davide <scovottodavide@gmail.com>
+Date: Wed, 20 Apr 2022 17:22:17 +0200
+Subject: [PATCH] tpm_tis_spi_main: Force probe routine to run
+ synchronously with driver and device registration when IMA is enabled
+
+Co-authored-by: Alberto Solavagione <albertosolavagione30@gmail.com>
+Co-developed-by: Alberto Solavagione <albertosolavagione30@gmail.com>
+Signed-off-by: Alberto Solavagione <albertosolavagione30@gmail.com>
+Signed-off-by: Davide Scovotto <scovottodavide@gmail.com>
+---
+ drivers/char/tpm/tpm_tis_spi_main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/char/tpm/tpm_tis_spi_main.c
++++ b/drivers/char/tpm/tpm_tis_spi_main.c
+@@ -252,7 +252,11 @@ static struct spi_driver tpm_tis_spi_dri
+ 		.pm = &tpm_tis_pm,
+ 		.of_match_table = of_match_ptr(of_tis_spi_match),
+ 		.acpi_match_table = ACPI_PTR(acpi_tis_spi_match),
++#ifdef CONFIG_IMA
++		.probe_type = PROBE_FORCE_SYNCHRONOUS,
++#else
+ 		.probe_type = PROBE_PREFER_ASYNCHRONOUS,
++#endif
+ 	},
+ 	.probe = tpm_tis_spi_driver_probe,
+ 	.remove = tpm_tis_spi_remove,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0407-staging-vchiq_arm-Add-log_level-module-params.patch b/target/linux/bcm27xx/patches-6.1/950-0407-staging-vchiq_arm-Add-log_level-module-params.patch
new file mode 100644
index 00000000000000..d7eab66233f08f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0407-staging-vchiq_arm-Add-log_level-module-params.patch
@@ -0,0 +1,27 @@
+From 9ef67cc6f5d954d15471fed8d28b15345edda34d Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 29 Apr 2022 09:19:10 +0100
+Subject: [PATCH] staging: vchiq_arm: Add log_level module params
+
+Add module parameters to control the logging levels for the various
+vchiq logging categories.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .../staging/vc04_services/interface/vchiq_arm/vchiq_arm.c    | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -64,6 +64,11 @@
+ /* Run time control of log level, based on KERN_XXX level. */
+ int vchiq_arm_log_level = VCHIQ_LOG_DEFAULT;
+ int vchiq_susp_log_level = VCHIQ_LOG_ERROR;
++module_param_named(arm_log_level, vchiq_arm_log_level, int, 0644);
++module_param_named(susp_log_level, vchiq_susp_log_level, int, 0644);
++module_param_named(core_log_level, vchiq_core_log_level, int, 0644);
++module_param_named(core_msg_log_level, vchiq_core_msg_log_level, int, 0644);
++module_param_named(sync_log_level, vchiq_sync_log_level, int, 0644);
+ 
+ DEFINE_SPINLOCK(msg_queue_spinlock);
+ struct vchiq_state g_state;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0408-dt-bindings-vendor-prefixes-Add-Arducam.patch b/target/linux/bcm27xx/patches-6.1/950-0408-dt-bindings-vendor-prefixes-Add-Arducam.patch
new file mode 100644
index 00000000000000..37cf24447dad0f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0408-dt-bindings-vendor-prefixes-Add-Arducam.patch
@@ -0,0 +1,23 @@
+From c486b073a13f5a0f3391526cd5c4f3bab938f58b Mon Sep 17 00:00:00 2001
+From: Lee Jackson <info@arducam.com>
+Date: Thu, 21 Apr 2022 14:14:29 +0800
+Subject: [PATCH] dt-bindings: vendor-prefixes: Add Arducam
+
+Add vendor prefix for Arducam (https://arducam.com).
+
+Signed-off-by: Lee Jackson <info@arducam.com>
+---
+ Documentation/devicetree/bindings/vendor-prefixes.yaml | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/Documentation/devicetree/bindings/vendor-prefixes.yaml
++++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml
+@@ -127,6 +127,8 @@ patternProperties:
+     description: arcx Inc. / Archronix Inc.
+   "^aries,.*":
+     description: Aries Embedded GmbH
++  "^arducam,.*":
++    description: Arducam Technology co., Ltd.
+   "^arm,.*":
+     description: ARM Ltd.
+   "^armadeus,.*":
diff --git a/target/linux/bcm27xx/patches-6.1/950-0409-media-dt-bindings-media-i2c-Add-Arducam-Pivariety-Se.patch b/target/linux/bcm27xx/patches-6.1/950-0409-media-dt-bindings-media-i2c-Add-Arducam-Pivariety-Se.patch
new file mode 100644
index 00000000000000..29ad23c0f30389
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0409-media-dt-bindings-media-i2c-Add-Arducam-Pivariety-Se.patch
@@ -0,0 +1,148 @@
+From 543fdf41f158306f263ead06f6036cdfc1e73b05 Mon Sep 17 00:00:00 2001
+From: Lee Jackson <info@arducam.com>
+Date: Thu, 21 Apr 2022 14:18:44 +0800
+Subject: [PATCH] media: dt-bindings: media: i2c: Add Arducam Pivariety
+ Series CMOS sensor binding
+
+Add YAML device tree binding for Arducam Pivariety CMOS image sensor, and
+the relevant MAINTAINERS entries.
+
+Signed-off-by: Lee Jackson <info@arducam.com>
+---
+ .../bindings/media/i2c/arducam-pivariety.yaml | 112 ++++++++++++++++++
+ MAINTAINERS                                   |   8 ++
+ 2 files changed, 120 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/arducam-pivariety.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/arducam-pivariety.yaml
+@@ -0,0 +1,112 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/media/i2c/arducam-pivariety.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Arducam Pivariety Series CMOS Digital Image Sensor
++
++maintainers:
++  - Lee Jackson <info@arducam.com>
++
++description: |-
++  Arducam Pivariety series cameras make compatibility layers for various CMOS
++  sensors and provide a unified command interface. It is programmable through
++  I2C interface. The I2C address is fixed to 0x0C. Image data is sent through
++  MIPI CSI-2, which is configured as either 1, 2 or 4 data lanes.
++
++properties:
++  compatible:
++    const: arducam,arducam-pivariety
++
++  reg:
++    description: I2C device address
++    maxItems: 1
++
++  clocks:
++    maxItems: 1
++
++  VDIG-supply:
++    description:
++      Digital I/O voltage supply, 1.05 volts
++
++  VANA-supply:
++    description:
++      Analog voltage supply, 2.8 volts
++
++  VDDL-supply:
++    description:
++      Digital core voltage supply, 1.8 volts
++
++  reset-gpios:
++    description: |-
++      Reference to the GPIO connected to the xclr pin, if any.
++      Must be released (set high) after all supplies and INCK are applied.
++
++  # See ../video-interfaces.txt for more details
++  port:
++    type: object
++    properties:
++      endpoint:
++        type: object
++        properties:
++          data-lanes:
++            description: |-
++              The sensor supports either two-lane, or four-lane operation.
++              For two-lane operation the property must be set to <1 2>.
++            items:
++              - const: 1
++              - const: 2
++
++          clock-noncontinuous:
++            type: boolean
++            description: |-
++              MIPI CSI-2 clock is non-continuous if this property is present,
++              otherwise it's continuous.
++
++          link-frequencies:
++            allOf:
++              - $ref: /schemas/types.yaml#/definitions/uint64-array
++            description:
++              Allowed data bus frequencies.
++
++        required:
++          - link-frequencies
++
++required:
++  - compatible
++  - reg
++  - clocks
++  - VANA-supply
++  - VDIG-supply
++  - VDDL-supply
++  - port
++
++additionalProperties: false
++
++examples:
++  - |
++    i2c0 {
++        #address-cells = <1>;
++        #size-cells = <0>;
++
++        arducam_pivariety: sensor@0c {
++            compatible = "arducam,arducam-pivariety";
++            reg = <0x0c>;
++            clocks = <&arducam_pivariety_clk>;
++            VANA-supply = <&arducam_pivariety_vana>;   /* 2.8v */
++            VDIG-supply = <&arducam_pivariety_vdig>;   /* 1.05v */
++            VDDL-supply = <&arducam_pivariety_vddl>;   /* 1.8v */
++
++            port {
++                arducam_pivariety_0: endpoint {
++                    remote-endpoint = <&csi1_ep>;
++                    data-lanes = <1 2>;
++                    clock-noncontinuous;
++                    link-frequencies = /bits/ 64 <493500000>;
++                };
++            };
++        };
++    };
++
++...
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -1559,6 +1559,14 @@ S:	Maintained
+ F:	drivers/net/arcnet/
+ F:	include/uapi/linux/if_arcnet.h
+ 
++ARDUCAM PIVARIETY SENSOR DRIVER
++M:	Arducam Kernel Maintenance <info@arducam.com>
++L:	linux-media@vger.kernel.org
++S:	Maintained
++T:	git git://linuxtv.org/media_tree.git
++F:	Documentation/devicetree/bindings/media/i2c/arducam-pivariety.yaml
++F:	drivers/media/i2c/arducam-pivariety.c
++
+ ARM ARCHITECTED TIMER DRIVER
+ M:	Mark Rutland <mark.rutland@arm.com>
+ M:	Marc Zyngier <maz@kernel.org>
diff --git a/target/linux/bcm27xx/patches-6.1/950-0410-media-i2c-Add-driver-of-Arducam-Pivariety-series-cam.patch b/target/linux/bcm27xx/patches-6.1/950-0410-media-i2c-Add-driver-of-Arducam-Pivariety-series-cam.patch
new file mode 100644
index 00000000000000..443f5b0c4f08b2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0410-media-i2c-Add-driver-of-Arducam-Pivariety-series-cam.patch
@@ -0,0 +1,1635 @@
+From 3be790df5d506e21cc729cc0646a16dfebe01aa1 Mon Sep 17 00:00:00 2001
+From: Lee Jackson <info@arducam.com>
+Date: Thu, 14 Apr 2022 17:31:01 +0800
+Subject: [PATCH] media: i2c: Add driver of Arducam Pivariety series
+ camera
+
+Add a driver for the Arducam Pivariety series CSI2 camera sensor.
+
+Signed-off-by: Lee Jackson <info@arducam.com>
+
+SQUASH: Fix VIDEO_ARDUCAM_PIVARIETY Kconfig entry
+
+The cherry-pick from rpi-5.17.y put it in the wrong section, and failed
+to update it for 5.18.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/media/i2c/Kconfig             |   11 +
+ drivers/media/i2c/Makefile            |    1 +
+ drivers/media/i2c/arducam-pivariety.c | 1467 +++++++++++++++++++++++++
+ drivers/media/i2c/arducam-pivariety.h |  107 ++
+ 4 files changed, 1586 insertions(+)
+ create mode 100644 drivers/media/i2c/arducam-pivariety.c
+ create mode 100644 drivers/media/i2c/arducam-pivariety.h
+
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -47,6 +47,17 @@ config VIDEO_AR0521
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called ar0521.
+ 
++config VIDEO_ARDUCAM_PIVARIETY
++	tristate "Arducam Pivariety sensor support"
++	depends on I2C && VIDEO_DEV
++	select VIDEO_V4L2_SUBDEV_API
++	help
++	  This is a Video4Linux2 sensor driver for the Arducam
++	  Pivariety camera series.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called arducam-pivariety.
++
+ config VIDEO_HI556
+ 	tristate "Hynix Hi-556 sensor support"
+ 	depends on I2C && VIDEO_DEV
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -21,6 +21,7 @@ obj-$(CONFIG_VIDEO_AK7375) += ak7375.o
+ obj-$(CONFIG_VIDEO_AK881X) += ak881x.o
+ obj-$(CONFIG_VIDEO_APTINA_PLL) += aptina-pll.o
+ obj-$(CONFIG_VIDEO_AR0521) += ar0521.o
++obj-$(CONFIG_VIDEO_ARDUCAM_PIVARIETY) += arducam-pivariety.o
+ obj-$(CONFIG_VIDEO_BT819) += bt819.o
+ obj-$(CONFIG_VIDEO_BT856) += bt856.o
+ obj-$(CONFIG_VIDEO_BT866) += bt866.o
+--- /dev/null
++++ b/drivers/media/i2c/arducam-pivariety.c
+@@ -0,0 +1,1467 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * A V4L2 driver for Arducam Pivariety Cameras
++ * Copyright (C) 2022 Arducam Technology co., Ltd.
++ *
++ * Based on Sony IMX219 camera driver
++ * Copyright (C) 2019, Raspberry Pi (Trading) Ltd
++ *
++ * I2C read and write method is taken from the OV9281 driver
++ * Copyright (C) 2017 Fuzhou Rockchip Electronics Co., Ltd.
++ */
++
++#include <linux/clk.h>
++#include <linux/delay.h>
++#include <linux/gpio/consumer.h>
++#include <linux/i2c.h>
++#include <linux/module.h>
++#include <linux/pm_runtime.h>
++#include <linux/regulator/consumer.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-fwnode.h>
++#include "arducam-pivariety.h"
++
++static int debug;
++module_param(debug, int, 0644);
++
++/* regulator supplies */
++static const char * const pivariety_supply_name[] = {
++	/* Supplies can be enabled in any order */
++	"VANA",  /* Analog (2.8V) supply */
++	"VDIG",  /* Digital Core (1.8V) supply */
++	"VDDL",  /* IF (1.2V) supply */
++};
++
++/* The supported raw formats. */
++static const u32 codes[] = {
++	MEDIA_BUS_FMT_SBGGR8_1X8,
++	MEDIA_BUS_FMT_SGBRG8_1X8,
++	MEDIA_BUS_FMT_SGRBG8_1X8,
++	MEDIA_BUS_FMT_SRGGB8_1X8,
++	MEDIA_BUS_FMT_Y8_1X8,
++
++	MEDIA_BUS_FMT_SBGGR10_1X10,
++	MEDIA_BUS_FMT_SGBRG10_1X10,
++	MEDIA_BUS_FMT_SGRBG10_1X10,
++	MEDIA_BUS_FMT_SRGGB10_1X10,
++	MEDIA_BUS_FMT_Y10_1X10,
++
++	MEDIA_BUS_FMT_SBGGR12_1X12,
++	MEDIA_BUS_FMT_SGBRG12_1X12,
++	MEDIA_BUS_FMT_SGRBG12_1X12,
++	MEDIA_BUS_FMT_SRGGB12_1X12,
++	MEDIA_BUS_FMT_Y12_1X12,
++};
++
++#define ARDUCAM_NUM_SUPPLIES ARRAY_SIZE(pivariety_supply_name)
++
++#define ARDUCAM_XCLR_MIN_DELAY_US	10000
++#define ARDUCAM_XCLR_DELAY_RANGE_US	1000
++
++#define MAX_CTRLS 32
++
++struct pivariety {
++	struct v4l2_subdev sd;
++	struct media_pad pad;
++
++	struct v4l2_fwnode_bus_mipi_csi2 bus;
++	struct clk *xclk;
++	u32 xclk_freq;
++
++	struct gpio_desc *reset_gpio;
++	struct regulator_bulk_data supplies[ARDUCAM_NUM_SUPPLIES];
++
++	struct arducam_format *supported_formats;
++	int num_supported_formats;
++	int current_format_idx;
++	int current_resolution_idx;
++	int lanes;
++	int bayer_order_volatile;
++	bool wait_until_free;
++
++	struct v4l2_ctrl_handler ctrl_handler;
++	struct v4l2_ctrl *ctrls[MAX_CTRLS];
++	/* V4L2 Controls */
++	struct v4l2_ctrl *vflip;
++	struct v4l2_ctrl *hflip;
++
++	struct v4l2_rect crop;
++	/*
++	 * Mutex for serialized access:
++	 * Protect sensor module set pad format and start/stop streaming safely.
++	 */
++	struct mutex mutex;
++
++	/* Streaming on/off */
++	bool streaming;
++};
++
++static inline struct pivariety *to_pivariety(struct v4l2_subdev *_sd)
++{
++	return container_of(_sd, struct pivariety, sd);
++}
++
++/* Write registers up to 4 at a time */
++static int pivariety_write_reg(struct i2c_client *client, u16 reg, u32 val)
++{
++	unsigned int len = sizeof(u32);
++	u32 buf_i, val_i = 0;
++	u8 buf[6];
++	u8 *val_p;
++	__be32 val_be;
++
++	buf[0] = reg >> 8;
++	buf[1] = reg & 0xff;
++
++	val_be = cpu_to_be32(val);
++	val_p = (u8 *)&val_be;
++	buf_i = 2;
++
++	while (val_i < 4)
++		buf[buf_i++] = val_p[val_i++];
++
++	if (i2c_master_send(client, buf, len + 2) != len + 2)
++		return -EIO;
++
++	return 0;
++}
++
++/* Read registers up to 4 at a time */
++static int pivariety_read_reg(struct i2c_client *client, u16 reg, u32 *val)
++{
++	struct i2c_msg msgs[2];
++	unsigned int len = sizeof(u32);
++	u8 *data_be_p;
++	__be32 data_be = 0;
++	__be16 reg_addr_be = cpu_to_be16(reg);
++	int ret;
++
++	data_be_p = (u8 *)&data_be;
++	/* Write register address */
++	msgs[0].addr = client->addr;
++	msgs[0].flags = 0;
++	msgs[0].len = 2;
++	msgs[0].buf = (u8 *)&reg_addr_be;
++
++	/* Read data from register */
++	msgs[1].addr = client->addr;
++	msgs[1].flags = I2C_M_RD;
++	msgs[1].len = len;
++	msgs[1].buf = data_be_p;
++
++	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++	if (ret != ARRAY_SIZE(msgs))
++		return -EIO;
++
++	*val = be32_to_cpu(data_be);
++
++	return 0;
++}
++
++static int
++pivariety_read(struct pivariety *pivariety, u16 addr, u32 *value)
++{
++	struct v4l2_subdev *sd = &pivariety->sd;
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	int ret, count = 0;
++
++	while (count++ < I2C_READ_RETRY_COUNT) {
++		ret = pivariety_read_reg(client, addr, value);
++		if (!ret) {
++			v4l2_dbg(2, debug, sd, "%s: 0x%02x 0x%04x\n",
++				 __func__, addr, *value);
++			return ret;
++		}
++	}
++
++	v4l2_err(sd, "%s: Reading register 0x%02x failed\n",
++		 __func__, addr);
++
++	return ret;
++}
++
++static int pivariety_write(struct pivariety *pivariety, u16 addr, u32 value)
++{
++	struct v4l2_subdev *sd = &pivariety->sd;
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	int ret, count = 0;
++
++	while (count++ < I2C_WRITE_RETRY_COUNT) {
++		ret = pivariety_write_reg(client, addr, value);
++		if (!ret)
++			return ret;
++	}
++
++	v4l2_err(sd, "%s: Write 0x%04x to register 0x%02x failed\n",
++		 __func__, value, addr);
++
++	return ret;
++}
++
++static int wait_for_free(struct pivariety *pivariety, int interval)
++{
++	u32 value;
++	u32 count = 0;
++
++	while (count++ < (1000 / interval)) {
++		int ret = pivariety_read(pivariety, SYSTEM_IDLE_REG, &value);
++
++		if (!ret && !value)
++			break;
++		msleep(interval);
++	}
++
++	v4l2_dbg(2, debug, &pivariety->sd, "%s: End wait, Count: %d.\n",
++		 __func__, count);
++
++	return 0;
++}
++
++static int is_raw(int pixformat)
++{
++	return pixformat >= 0x28 && pixformat <= 0x2D;
++}
++
++static u32 bayer_to_mbus_code(int data_type, int bayer_order)
++{
++	const u32 depth8[] = {
++		MEDIA_BUS_FMT_SBGGR8_1X8,
++		MEDIA_BUS_FMT_SGBRG8_1X8,
++		MEDIA_BUS_FMT_SGRBG8_1X8,
++		MEDIA_BUS_FMT_SRGGB8_1X8,
++		MEDIA_BUS_FMT_Y8_1X8,
++	};
++
++	const u32 depth10[] = {
++		MEDIA_BUS_FMT_SBGGR10_1X10,
++		MEDIA_BUS_FMT_SGBRG10_1X10,
++		MEDIA_BUS_FMT_SGRBG10_1X10,
++		MEDIA_BUS_FMT_SRGGB10_1X10,
++		MEDIA_BUS_FMT_Y10_1X10,
++	};
++
++	const u32 depth12[] = {
++		MEDIA_BUS_FMT_SBGGR12_1X12,
++		MEDIA_BUS_FMT_SGBRG12_1X12,
++		MEDIA_BUS_FMT_SGRBG12_1X12,
++		MEDIA_BUS_FMT_SRGGB12_1X12,
++		MEDIA_BUS_FMT_Y12_1X12,
++	};
++
++	if (bayer_order < 0 || bayer_order > 4)
++		return 0;
++
++	switch (data_type) {
++	case IMAGE_DT_RAW8:
++		return depth8[bayer_order];
++	case IMAGE_DT_RAW10:
++		return depth10[bayer_order];
++	case IMAGE_DT_RAW12:
++		return depth12[bayer_order];
++	}
++
++	return 0;
++}
++
++static u32 yuv422_to_mbus_code(int data_type, int order)
++{
++	const u32 depth8[] = {
++		MEDIA_BUS_FMT_YUYV8_1X16,
++		MEDIA_BUS_FMT_YVYU8_1X16,
++		MEDIA_BUS_FMT_UYVY8_1X16,
++		MEDIA_BUS_FMT_VYUY8_1X16,
++	};
++
++	const u32 depth10[] = {
++		MEDIA_BUS_FMT_YUYV10_1X20,
++		MEDIA_BUS_FMT_YVYU10_1X20,
++		MEDIA_BUS_FMT_UYVY10_1X20,
++		MEDIA_BUS_FMT_VYUY10_1X20,
++	};
++
++	if (order < 0 || order > 3)
++		return 0;
++
++	switch (data_type) {
++	case IMAGE_DT_YUV422_8:
++		return depth8[order];
++	case IMAGE_DT_YUV422_10:
++		return depth10[order];
++	}
++
++	return 0;
++}
++
++static u32 data_type_to_mbus_code(int data_type, int bayer_order)
++{
++	if (is_raw(data_type))
++		return bayer_to_mbus_code(data_type, bayer_order);
++
++	switch (data_type) {
++	case IMAGE_DT_YUV422_8:
++	case IMAGE_DT_YUV422_10:
++		return yuv422_to_mbus_code(data_type, bayer_order);
++	case IMAGE_DT_RGB565:
++		return MEDIA_BUS_FMT_RGB565_2X8_LE;
++	case IMAGE_DT_RGB888:
++		return MEDIA_BUS_FMT_RGB888_1X24;
++	}
++
++	return 0;
++}
++
++/* Get bayer order based on flip setting. */
++static u32 pivariety_get_format_code(struct pivariety *pivariety,
++				     struct arducam_format *format)
++{
++	unsigned int order, origin_order;
++
++	lockdep_assert_held(&pivariety->mutex);
++
++	/*
++	 * Only the bayer format needs to transform the format.
++	 */
++	if (!is_raw(format->data_type) ||
++	    !pivariety->bayer_order_volatile ||
++	    format->bayer_order == BAYER_ORDER_GRAY)
++		return data_type_to_mbus_code(format->data_type,
++					      format->bayer_order);
++
++	order = format->bayer_order;
++
++	origin_order = order;
++
++	order = (pivariety->hflip && pivariety->hflip->val ? order ^ 1 : order);
++	order = (pivariety->vflip && pivariety->vflip->val ? order ^ 2 : order);
++
++	v4l2_dbg(1, debug, &pivariety->sd, "%s: before: %d, after: %d.\n",
++		 __func__, origin_order, order);
++
++	return data_type_to_mbus_code(format->data_type, order);
++}
++
++/* Power/clock management functions */
++static int pivariety_power_on(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct pivariety *pivariety = to_pivariety(sd);
++	int ret;
++
++	ret = regulator_bulk_enable(ARDUCAM_NUM_SUPPLIES,
++				    pivariety->supplies);
++	if (ret) {
++		dev_err(dev, "%s: failed to enable regulators\n",
++			__func__);
++		return ret;
++	}
++
++	ret = clk_prepare_enable(pivariety->xclk);
++	if (ret) {
++		dev_err(dev, "%s: failed to enable clock\n",
++			__func__);
++		goto reg_off;
++	}
++
++	gpiod_set_value_cansleep(pivariety->reset_gpio, 1);
++	usleep_range(ARDUCAM_XCLR_MIN_DELAY_US,
++		     ARDUCAM_XCLR_MIN_DELAY_US + ARDUCAM_XCLR_DELAY_RANGE_US);
++
++	return 0;
++
++reg_off:
++	regulator_bulk_disable(ARDUCAM_NUM_SUPPLIES, pivariety->supplies);
++
++	return ret;
++}
++
++static int pivariety_power_off(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct pivariety *pivariety = to_pivariety(sd);
++
++	gpiod_set_value_cansleep(pivariety->reset_gpio, 0);
++	regulator_bulk_disable(ARDUCAM_NUM_SUPPLIES, pivariety->supplies);
++	clk_disable_unprepare(pivariety->xclk);
++
++	return 0;
++}
++
++static int pivariety_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	struct pivariety *pivariety = to_pivariety(sd);
++	struct v4l2_mbus_framefmt *try_fmt =
++		v4l2_subdev_get_try_format(sd, fh->state, 0);
++	struct arducam_format *def_fmt = &pivariety->supported_formats[0];
++
++	/* Initialize try_fmt */
++	try_fmt->width = def_fmt->resolution_set->width;
++	try_fmt->height = def_fmt->resolution_set->height;
++	try_fmt->code = def_fmt->mbus_code;
++	try_fmt->field = V4L2_FIELD_NONE;
++
++	return 0;
++}
++
++static int pivariety_s_ctrl(struct v4l2_ctrl *ctrl)
++{
++	int ret, i;
++	struct pivariety *pivariety =
++		container_of(ctrl->handler, struct pivariety,
++			     ctrl_handler);
++	struct arducam_format *supported_fmts = pivariety->supported_formats;
++	int num_supported_formats = pivariety->num_supported_formats;
++
++	v4l2_dbg(3, debug, &pivariety->sd, "%s: cid = (0x%X), value = (%d).\n",
++		 __func__, ctrl->id, ctrl->val);
++
++	ret = pivariety_write(pivariety, CTRL_ID_REG, ctrl->id);
++	ret += pivariety_write(pivariety, CTRL_VALUE_REG, ctrl->val);
++	if (ret < 0)
++		return -EINVAL;
++
++	/* When flip is set, modify all bayer formats */
++	if (ctrl->id == V4L2_CID_VFLIP || ctrl->id == V4L2_CID_HFLIP) {
++		for (i = 0; i < num_supported_formats; i++) {
++			supported_fmts[i].mbus_code =
++				pivariety_get_format_code(pivariety,
++							  &supported_fmts[i]);
++		}
++	}
++
++	/*
++	 * When starting streaming, controls are set in batches,
++	 * and the short interval will cause some controls to be unsuccessfully
++	 * set.
++	 */
++	if (pivariety->wait_until_free)
++		wait_for_free(pivariety, 1);
++	else
++		usleep_range(200, 210);
++
++	return 0;
++}
++
++static const struct v4l2_ctrl_ops pivariety_ctrl_ops = {
++	.s_ctrl = pivariety_s_ctrl,
++};
++
++static int pivariety_enum_mbus_code(struct v4l2_subdev *sd,
++				    struct v4l2_subdev_state *sd_state,
++				    struct v4l2_subdev_mbus_code_enum *code)
++{
++	struct pivariety *pivariety = to_pivariety(sd);
++	struct arducam_format *supported_formats = pivariety->supported_formats;
++	int num_supported_formats = pivariety->num_supported_formats;
++
++	v4l2_dbg(1, debug, sd, "%s: index = (%d)\n", __func__, code->index);
++
++	if (code->index >= num_supported_formats)
++		return -EINVAL;
++
++	code->code = supported_formats[code->index].mbus_code;
++
++	return 0;
++}
++
++static int pivariety_enum_framesizes(struct v4l2_subdev *sd,
++				     struct v4l2_subdev_state *sd_state,
++				     struct v4l2_subdev_frame_size_enum *fse)
++{
++	int i;
++	struct pivariety *pivariety = to_pivariety(sd);
++	struct arducam_format *supported_formats = pivariety->supported_formats;
++	int num_supported_formats = pivariety->num_supported_formats;
++	struct arducam_format *format;
++	struct arducam_resolution *resolution;
++
++	v4l2_dbg(1, debug, sd, "%s: code = (0x%X), index = (%d)\n",
++		 __func__, fse->code, fse->index);
++
++	for (i = 0; i < num_supported_formats; i++) {
++		format = &supported_formats[i];
++		if (fse->code == format->mbus_code) {
++			if (fse->index >= format->num_resolution_set)
++				return -EINVAL;
++
++			resolution = &format->resolution_set[fse->index];
++			fse->min_width = resolution->width;
++			fse->max_width = resolution->width;
++			fse->min_height = resolution->height;
++			fse->max_height = resolution->height;
++
++			return 0;
++		}
++	}
++
++	return -EINVAL;
++}
++
++static int pivariety_get_fmt(struct v4l2_subdev *sd,
++			     struct v4l2_subdev_state *sd_state,
++			     struct v4l2_subdev_format *format)
++{
++	struct pivariety *pivariety = to_pivariety(sd);
++	struct arducam_format *current_format;
++	struct v4l2_mbus_framefmt *fmt = &format->format;
++	int cur_res_idx;
++
++	if (format->pad != 0)
++		return -EINVAL;
++
++	mutex_lock(&pivariety->mutex);
++
++	current_format =
++		&pivariety->supported_formats[pivariety->current_format_idx];
++	cur_res_idx = pivariety->current_resolution_idx;
++	format->format.width =
++		current_format->resolution_set[cur_res_idx].width;
++	format->format.height =
++		current_format->resolution_set[cur_res_idx].height;
++	format->format.code = current_format->mbus_code;
++	format->format.field = V4L2_FIELD_NONE;
++	fmt->colorspace = V4L2_COLORSPACE_RAW;
++	fmt->ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->colorspace);
++	fmt->quantization = V4L2_MAP_QUANTIZATION_DEFAULT(true,
++							  fmt->colorspace,
++							  fmt->ycbcr_enc);
++	fmt->xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(fmt->colorspace);
++
++	v4l2_dbg(1, debug, sd, "%s: width: (%d) height: (%d) code: (0x%X)\n",
++		 __func__, format->format.width, format->format.height,
++		 format->format.code);
++
++	mutex_unlock(&pivariety->mutex);
++	return 0;
++}
++
++static int pivariety_get_fmt_idx_by_code(struct pivariety *pivariety,
++					 u32 mbus_code)
++{
++	int i;
++	u32 data_type;
++	struct arducam_format *formats = pivariety->supported_formats;
++
++	for (i = 0; i < pivariety->num_supported_formats; i++) {
++		if (formats[i].mbus_code == mbus_code)
++			return i;
++	}
++
++	/*
++	 * If the specified format is not found in the list of supported
++	 * formats, try to find a format of the same data type.
++	 */
++	for (i = 0; i < ARRAY_SIZE(codes); i++)
++		if (codes[i] == mbus_code)
++			break;
++
++	if (i >= ARRAY_SIZE(codes))
++		return -EINVAL;
++
++	data_type = i / 5 + IMAGE_DT_RAW8;
++
++	for (i = 0; i < pivariety->num_supported_formats; i++) {
++		if (formats[i].data_type == data_type)
++			return i;
++	}
++
++	return -EINVAL;
++}
++
++static struct v4l2_ctrl *get_control(struct pivariety *pivariety,
++				     u32 id)
++{
++	int index = 0;
++
++	while (index < MAX_CTRLS && pivariety->ctrls[index]) {
++		if (pivariety->ctrls[index]->id == id)
++			return pivariety->ctrls[index];
++		index++;
++	}
++
++	return NULL;
++}
++
++static int update_control(struct pivariety *pivariety, u32 id)
++{
++	struct v4l2_subdev *sd = &pivariety->sd;
++	struct v4l2_ctrl *ctrl;
++	u32 min, max, step, def, id2;
++	int ret = 0;
++
++	pivariety_write(pivariety, CTRL_ID_REG, id);
++	pivariety_read(pivariety, CTRL_ID_REG, &id2);
++
++	v4l2_dbg(1, debug, sd, "%s: Write ID: 0x%08X Read ID: 0x%08X\n",
++		 __func__, id, id2);
++
++	pivariety_write(pivariety, CTRL_VALUE_REG, 0);
++	wait_for_free(pivariety, 1);
++
++	ret += pivariety_read(pivariety, CTRL_MAX_REG, &max);
++	ret += pivariety_read(pivariety, CTRL_MIN_REG, &min);
++	ret += pivariety_read(pivariety, CTRL_DEF_REG, &def);
++	ret += pivariety_read(pivariety, CTRL_STEP_REG, &step);
++
++	if (ret < 0)
++		goto err;
++
++	if (id == NO_DATA_AVAILABLE || max == NO_DATA_AVAILABLE ||
++	    min == NO_DATA_AVAILABLE || def == NO_DATA_AVAILABLE ||
++	    step == NO_DATA_AVAILABLE)
++		goto err;
++
++	v4l2_dbg(1, debug, sd, "%s: min: %d, max: %d, step: %d, def: %d\n",
++		 __func__, min, max, step, def);
++
++	ctrl = get_control(pivariety, id);
++	return __v4l2_ctrl_modify_range(ctrl, min, max, step, def);
++
++err:
++	return -EINVAL;
++}
++
++static int update_controls(struct pivariety *pivariety)
++{
++	int ret = 0;
++	int index = 0;
++
++	wait_for_free(pivariety, 5);
++
++	while (index < MAX_CTRLS && pivariety->ctrls[index]) {
++		ret += update_control(pivariety, pivariety->ctrls[index]->id);
++		index++;
++	}
++
++	return ret;
++}
++
++static int pivariety_set_fmt(struct v4l2_subdev *sd,
++			     struct v4l2_subdev_state *sd_state,
++			     struct v4l2_subdev_format *format)
++{
++	int i, j;
++	struct pivariety *pivariety = to_pivariety(sd);
++	struct arducam_format *supported_formats = pivariety->supported_formats;
++
++	if (format->pad != 0)
++		return -EINVAL;
++
++	mutex_lock(&pivariety->mutex);
++
++	format->format.colorspace = V4L2_COLORSPACE_RAW;
++	format->format.field = V4L2_FIELD_NONE;
++
++	v4l2_dbg(1, debug, sd, "%s: code: 0x%X, width: %d, height: %d\n",
++		 __func__, format->format.code, format->format.width,
++		 format->format.height);
++
++	i = pivariety_get_fmt_idx_by_code(pivariety, format->format.code);
++	if (i < 0)
++		i = 0;
++
++	format->format.code = supported_formats[i].mbus_code;
++
++	for (j = 0; j < supported_formats[i].num_resolution_set; j++) {
++		if (supported_formats[i].resolution_set[j].width ==
++						format->format.width &&
++			supported_formats[i].resolution_set[j].height ==
++						format->format.height) {
++			v4l2_dbg(1, debug, sd,
++				 "%s: format match.\n", __func__);
++			v4l2_dbg(1, debug, sd,
++				 "%s: set format to device: %d %d.\n",
++				 __func__, supported_formats[i].index, j);
++
++			pivariety_write(pivariety, PIXFORMAT_INDEX_REG,
++					supported_formats[i].index);
++			pivariety_write(pivariety, RESOLUTION_INDEX_REG, j);
++
++			pivariety->current_format_idx = i;
++			pivariety->current_resolution_idx = j;
++
++			update_controls(pivariety);
++
++			goto unlock;
++		}
++	}
++
++	format->format.width = supported_formats[i].resolution_set[0].width;
++	format->format.height = supported_formats[i].resolution_set[0].height;
++
++	pivariety_write(pivariety, PIXFORMAT_INDEX_REG,
++			supported_formats[i].index);
++	pivariety_write(pivariety, RESOLUTION_INDEX_REG, 0);
++
++	pivariety->current_format_idx = i;
++	pivariety->current_resolution_idx = 0;
++	update_controls(pivariety);
++
++unlock:
++
++	mutex_unlock(&pivariety->mutex);
++
++	return 0;
++}
++
++/* Start streaming */
++static int pivariety_start_streaming(struct pivariety *pivariety)
++{
++	int ret;
++
++	/* set stream on register */
++	ret = pivariety_write(pivariety, MODE_SELECT_REG,
++			      ARDUCAM_MODE_STREAMING);
++
++	if (ret)
++		return ret;
++
++	wait_for_free(pivariety, 2);
++
++	/*
++	 * When starting streaming, controls are set in batches,
++	 * and the short interval will cause some controls to be unsuccessfully
++	 * set.
++	 */
++	pivariety->wait_until_free = true;
++	/* Apply customized values from user */
++	ret =  __v4l2_ctrl_handler_setup(pivariety->sd.ctrl_handler);
++
++	pivariety->wait_until_free = false;
++	if (ret)
++		return ret;
++
++	wait_for_free(pivariety, 2);
++
++	return ret;
++}
++
++static int pivariety_read_sel(struct pivariety *pivariety,
++			      struct v4l2_rect *rect)
++{
++	int ret = 0;
++
++	ret += pivariety_read(pivariety, IPC_SEL_TOP_REG, &rect->top);
++	ret += pivariety_read(pivariety, IPC_SEL_LEFT_REG, &rect->left);
++	ret += pivariety_read(pivariety, IPC_SEL_WIDTH_REG, &rect->width);
++	ret += pivariety_read(pivariety, IPC_SEL_HEIGHT_REG, &rect->height);
++
++	if (ret || rect->top == NO_DATA_AVAILABLE ||
++	    rect->left == NO_DATA_AVAILABLE ||
++	    rect->width == NO_DATA_AVAILABLE ||
++	    rect->height == NO_DATA_AVAILABLE) {
++		v4l2_err(&pivariety->sd, "%s: Failed to read selection.\n",
++			 __func__);
++		return -EINVAL;
++		}
++
++	return 0;
++}
++
++static const struct v4l2_rect *
++__pivariety_get_pad_crop(struct pivariety *pivariety,
++			 struct v4l2_subdev_state *sd_state,
++			 unsigned int pad,
++			 enum v4l2_subdev_format_whence which)
++{
++	int ret;
++
++	switch (which) {
++	case V4L2_SUBDEV_FORMAT_TRY:
++		return v4l2_subdev_get_try_crop(&pivariety->sd, sd_state, pad);
++	case V4L2_SUBDEV_FORMAT_ACTIVE:
++		ret = pivariety_read_sel(pivariety, &pivariety->crop);
++		if (ret)
++			return NULL;
++		return &pivariety->crop;
++	}
++
++	return NULL;
++}
++
++static int pivariety_get_selection(struct v4l2_subdev *sd,
++				   struct v4l2_subdev_state *sd_state,
++				   struct v4l2_subdev_selection *sel)
++{
++	int ret = 0;
++	struct v4l2_rect rect;
++	struct pivariety *pivariety = to_pivariety(sd);
++
++	ret = pivariety_write(pivariety, IPC_SEL_TARGET_REG, sel->target);
++	if (ret) {
++		v4l2_err(sd, "%s: Write register 0x%02x failed\n",
++			 __func__, IPC_SEL_TARGET_REG);
++		return -EINVAL;
++	}
++
++	wait_for_free(pivariety, 2);
++
++	switch (sel->target) {
++	case V4L2_SEL_TGT_CROP: {
++		mutex_lock(&pivariety->mutex);
++		sel->r = *__pivariety_get_pad_crop(pivariety, sd_state,
++						   sel->pad,
++						   sel->which);
++		mutex_unlock(&pivariety->mutex);
++
++		return 0;
++	}
++
++	case V4L2_SEL_TGT_NATIVE_SIZE:
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++	case V4L2_SEL_TGT_CROP_BOUNDS:
++		ret = pivariety_read_sel(pivariety, &rect);
++		if (ret)
++			return -EINVAL;
++
++		sel->r = rect;
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++/* Stop streaming */
++static int pivariety_stop_streaming(struct pivariety *pivariety)
++{
++	int ret;
++
++	/* set stream off register */
++	ret = pivariety_write(pivariety, MODE_SELECT_REG, ARDUCAM_MODE_STANDBY);
++	if (ret)
++		v4l2_err(&pivariety->sd, "%s failed to set stream\n", __func__);
++
++	/*
++	 * Return success even if it was an error, as there is nothing the
++	 * caller can do about it.
++	 */
++	return 0;
++}
++
++static int pivariety_set_stream(struct v4l2_subdev *sd, int enable)
++{
++	struct pivariety *pivariety = to_pivariety(sd);
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	int ret = 0;
++
++	mutex_lock(&pivariety->mutex);
++	if (pivariety->streaming == enable) {
++		mutex_unlock(&pivariety->mutex);
++		return 0;
++	}
++
++	if (enable) {
++		ret = pm_runtime_get_sync(&client->dev);
++		if (ret < 0) {
++			pm_runtime_put_noidle(&client->dev);
++			goto err_unlock;
++		}
++
++		/*
++		 * Apply default & customized values
++		 * and then start streaming.
++		 */
++		ret = pivariety_start_streaming(pivariety);
++		if (ret)
++			goto err_rpm_put;
++	} else {
++		pivariety_stop_streaming(pivariety);
++		pm_runtime_put(&client->dev);
++	}
++
++	pivariety->streaming = enable;
++
++	/*
++	 * vflip and hflip cannot change during streaming
++	 * Pivariety may not implement flip control.
++	 */
++	if (pivariety->vflip)
++		__v4l2_ctrl_grab(pivariety->vflip, enable);
++
++	if (pivariety->hflip)
++		__v4l2_ctrl_grab(pivariety->hflip, enable);
++
++	mutex_unlock(&pivariety->mutex);
++
++	return ret;
++
++err_rpm_put:
++	pm_runtime_put(&client->dev);
++err_unlock:
++	mutex_unlock(&pivariety->mutex);
++
++	return ret;
++}
++
++static int __maybe_unused pivariety_suspend(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct pivariety *pivariety = to_pivariety(sd);
++
++	if (pivariety->streaming)
++		pivariety_stop_streaming(pivariety);
++
++	return 0;
++}
++
++static int __maybe_unused pivariety_resume(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct pivariety *pivariety = to_pivariety(sd);
++	int ret;
++
++	if (pivariety->streaming) {
++		ret = pivariety_start_streaming(pivariety);
++		if (ret)
++			goto error;
++	}
++
++	return 0;
++
++error:
++	pivariety_stop_streaming(pivariety);
++	pivariety->streaming = 0;
++	return ret;
++}
++
++static int pivariety_get_regulators(struct pivariety *pivariety)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&pivariety->sd);
++	int i;
++
++	for (i = 0; i < ARDUCAM_NUM_SUPPLIES; i++)
++		pivariety->supplies[i].supply = pivariety_supply_name[i];
++
++	return devm_regulator_bulk_get(&client->dev,
++				       ARDUCAM_NUM_SUPPLIES,
++				       pivariety->supplies);
++}
++
++static int pivariety_get_mbus_config(struct v4l2_subdev *sd, unsigned int pad,
++				     struct v4l2_mbus_config *cfg)
++{
++	struct pivariety *pivariety = to_pivariety(sd);
++	const u32 mask = V4L2_MBUS_CSI2_LANE_MASK;
++
++	if (pivariety->lanes > pivariety->bus.num_data_lanes)
++		return -EINVAL;
++
++	cfg->type = V4L2_MBUS_CSI2_DPHY;
++	cfg->flags = (pivariety->lanes << __ffs(mask)) & mask;
++
++	return 0;
++}
++
++static const struct v4l2_subdev_core_ops pivariety_core_ops = {
++	.subscribe_event = v4l2_ctrl_subdev_subscribe_event,
++	.unsubscribe_event = v4l2_event_subdev_unsubscribe,
++};
++
++static const struct v4l2_subdev_video_ops pivariety_video_ops = {
++	.s_stream = pivariety_set_stream,
++};
++
++static const struct v4l2_subdev_pad_ops pivariety_pad_ops = {
++	.enum_mbus_code = pivariety_enum_mbus_code,
++	.get_fmt = pivariety_get_fmt,
++	.set_fmt = pivariety_set_fmt,
++	.enum_frame_size = pivariety_enum_framesizes,
++	.get_selection = pivariety_get_selection,
++	.get_mbus_config = pivariety_get_mbus_config,
++};
++
++static const struct v4l2_subdev_ops pivariety_subdev_ops = {
++	.core = &pivariety_core_ops,
++	.video = &pivariety_video_ops,
++	.pad = &pivariety_pad_ops,
++};
++
++static const struct v4l2_subdev_internal_ops pivariety_internal_ops = {
++	.open = pivariety_open,
++};
++
++static void pivariety_free_controls(struct pivariety *pivariety)
++{
++	v4l2_ctrl_handler_free(pivariety->sd.ctrl_handler);
++	mutex_destroy(&pivariety->mutex);
++}
++
++static int pivariety_get_length_of_set(struct pivariety *pivariety,
++				       u16 idx_reg, u16 val_reg)
++{
++	int ret;
++	int index = 0;
++	u32 val;
++
++	while (1) {
++		ret = pivariety_write(pivariety, idx_reg, index);
++		ret += pivariety_read(pivariety, val_reg, &val);
++
++		if (ret < 0)
++			return -1;
++
++		if (val == NO_DATA_AVAILABLE)
++			break;
++		index++;
++	}
++	pivariety_write(pivariety, idx_reg, 0);
++	return index;
++}
++
++static int pivariety_enum_resolution(struct pivariety *pivariety,
++				     struct arducam_format *format)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&pivariety->sd);
++	int index = 0;
++	u32 width, height;
++	int num_resolution = 0;
++	int ret;
++
++	num_resolution = pivariety_get_length_of_set(pivariety,
++						     RESOLUTION_INDEX_REG,
++						     FORMAT_WIDTH_REG);
++	if (num_resolution < 0)
++		goto err;
++
++	format->resolution_set = devm_kzalloc(&client->dev,
++					      sizeof(*format->resolution_set) *
++								num_resolution,
++					      GFP_KERNEL);
++	while (1) {
++		ret = pivariety_write(pivariety, RESOLUTION_INDEX_REG, index);
++		ret += pivariety_read(pivariety, FORMAT_WIDTH_REG, &width);
++		ret += pivariety_read(pivariety, FORMAT_HEIGHT_REG, &height);
++
++		if (ret < 0)
++			goto err;
++
++		if (width == NO_DATA_AVAILABLE || height == NO_DATA_AVAILABLE)
++			break;
++
++		format->resolution_set[index].width = width;
++		format->resolution_set[index].height = height;
++
++		index++;
++	}
++
++	format->num_resolution_set = index;
++	pivariety_write(pivariety, RESOLUTION_INDEX_REG, 0);
++	return 0;
++err:
++	return -ENODEV;
++}
++
++static int pivariety_enum_pixformat(struct pivariety *pivariety)
++{
++	int ret = 0;
++	u32 mbus_code = 0;
++	int pixfmt_type;
++	int bayer_order;
++	int bayer_order_not_volatile;
++	int lanes;
++	int index = 0;
++	int num_pixformat = 0;
++	struct arducam_format *arducam_fmt;
++	struct i2c_client *client = v4l2_get_subdevdata(&pivariety->sd);
++
++	num_pixformat = pivariety_get_length_of_set(pivariety,
++						    PIXFORMAT_INDEX_REG,
++						    PIXFORMAT_TYPE_REG);
++
++	if (num_pixformat < 0)
++		goto err;
++
++	ret = pivariety_read(pivariety, FLIPS_DONT_CHANGE_ORDER_REG,
++			     &bayer_order_not_volatile);
++	if (bayer_order_not_volatile == NO_DATA_AVAILABLE)
++		pivariety->bayer_order_volatile = 1;
++	else
++		pivariety->bayer_order_volatile = !bayer_order_not_volatile;
++
++	if (ret < 0)
++		goto err;
++
++	pivariety->supported_formats =
++		devm_kzalloc(&client->dev,
++			     sizeof(*pivariety->supported_formats) *
++								num_pixformat,
++			     GFP_KERNEL);
++
++	while (1) {
++		ret = pivariety_write(pivariety, PIXFORMAT_INDEX_REG, index);
++		ret += pivariety_read(pivariety, PIXFORMAT_TYPE_REG,
++				      &pixfmt_type);
++
++		if (pixfmt_type == NO_DATA_AVAILABLE)
++			break;
++
++		ret += pivariety_read(pivariety, MIPI_LANES_REG, &lanes);
++		if (lanes == NO_DATA_AVAILABLE)
++			break;
++
++		ret += pivariety_read(pivariety, PIXFORMAT_ORDER_REG,
++				      &bayer_order);
++		if (ret < 0)
++			goto err;
++
++		mbus_code = data_type_to_mbus_code(pixfmt_type, bayer_order);
++		arducam_fmt = &pivariety->supported_formats[index];
++		arducam_fmt->index = index;
++		arducam_fmt->mbus_code = mbus_code;
++		arducam_fmt->bayer_order = bayer_order;
++		arducam_fmt->data_type = pixfmt_type;
++		if (pivariety_enum_resolution(pivariety, arducam_fmt))
++			goto err;
++
++		index++;
++	}
++
++	pivariety_write(pivariety, PIXFORMAT_INDEX_REG, 0);
++	pivariety->num_supported_formats = index;
++	pivariety->current_format_idx = 0;
++	pivariety->current_resolution_idx = 0;
++	pivariety->lanes = lanes;
++
++	return 0;
++
++err:
++	return -ENODEV;
++}
++
++static const char *pivariety_ctrl_get_name(u32 id)
++{
++	switch (id) {
++	case V4L2_CID_ARDUCAM_EXT_TRI:
++		return "trigger_mode";
++	case V4L2_CID_ARDUCAM_IRCUT:
++		return "ircut";
++	default:
++		return NULL;
++	}
++}
++
++enum v4l2_ctrl_type pivariety_get_v4l2_ctrl_type(u32 id)
++{
++	switch (id) {
++	case V4L2_CID_ARDUCAM_EXT_TRI:
++		return V4L2_CTRL_TYPE_BOOLEAN;
++	case V4L2_CID_ARDUCAM_IRCUT:
++		return V4L2_CTRL_TYPE_BOOLEAN;
++	default:
++		return V4L2_CTRL_TYPE_INTEGER;
++	}
++}
++
++static struct v4l2_ctrl *v4l2_ctrl_new_arducam(struct v4l2_ctrl_handler *hdl,
++					       const struct v4l2_ctrl_ops *ops,
++					       u32 id, s64 min, s64 max,
++					       u64 step, s64 def)
++{
++	struct v4l2_ctrl_config ctrl_cfg = {
++		.ops = ops,
++		.id = id,
++		.name = NULL,
++		.type = V4L2_CTRL_TYPE_INTEGER,
++		.flags = 0,
++		.min = min,
++		.max = max,
++		.def = def,
++		.step = step,
++	};
++
++	ctrl_cfg.name = pivariety_ctrl_get_name(id);
++	ctrl_cfg.type = pivariety_get_v4l2_ctrl_type(id);
++
++	return v4l2_ctrl_new_custom(hdl, &ctrl_cfg, NULL);
++}
++
++static int pivariety_enum_controls(struct pivariety *pivariety)
++{
++	struct v4l2_subdev *sd = &pivariety->sd;
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	struct v4l2_ctrl_handler *ctrl_hdlr = &pivariety->ctrl_handler;
++	struct v4l2_fwnode_device_properties props;
++	struct v4l2_ctrl **ctrl = pivariety->ctrls;
++	int ret, index, num_ctrls;
++	u32 id, min, max, def, step;
++
++	num_ctrls = pivariety_get_length_of_set(pivariety, CTRL_INDEX_REG,
++						CTRL_ID_REG);
++	if (num_ctrls < 0)
++		goto err;
++
++	v4l2_dbg(1, debug, sd, "%s: num_ctrls = %d\n",
++		 __func__, num_ctrls);
++
++	ret = v4l2_ctrl_handler_init(ctrl_hdlr, num_ctrls);
++	if (ret)
++		return ret;
++
++	index = 0;
++	while (1) {
++		ret = pivariety_write(pivariety, CTRL_INDEX_REG, index);
++		pivariety_write(pivariety, CTRL_VALUE_REG, 0);
++		wait_for_free(pivariety, 1);
++
++		ret += pivariety_read(pivariety, CTRL_ID_REG, &id);
++		ret += pivariety_read(pivariety, CTRL_MAX_REG, &max);
++		ret += pivariety_read(pivariety, CTRL_MIN_REG, &min);
++		ret += pivariety_read(pivariety, CTRL_DEF_REG, &def);
++		ret += pivariety_read(pivariety, CTRL_STEP_REG, &step);
++		if (ret < 0)
++			goto err;
++
++		if (id == NO_DATA_AVAILABLE || max == NO_DATA_AVAILABLE ||
++		    min == NO_DATA_AVAILABLE || def == NO_DATA_AVAILABLE ||
++		    step == NO_DATA_AVAILABLE)
++			break;
++
++		v4l2_dbg(1, debug, sd,
++			 "%s: index = %d, id = 0x%x, max = %d, min = %d, def = %d, step = %d\n",
++			 __func__, index, id, max, min, def, step);
++
++		if (v4l2_ctrl_get_name(id)) {
++			*ctrl = v4l2_ctrl_new_std(ctrl_hdlr,
++						  &pivariety_ctrl_ops,
++						  id, min,
++						  max, step,
++						  def);
++			v4l2_dbg(1, debug, sd, "%s: ctrl: 0x%p\n",
++				 __func__, *ctrl);
++		} else if (pivariety_ctrl_get_name(id)) {
++			*ctrl = v4l2_ctrl_new_arducam(ctrl_hdlr,
++						      &pivariety_ctrl_ops,
++						      id, min, max, step, def);
++
++			v4l2_dbg(1, debug, sd,
++				 "%s: new custom ctrl, ctrl: 0x%p.\n",
++				 __func__, *ctrl);
++		} else {
++			index++;
++			continue;
++		}
++
++		if (!*ctrl)
++			goto err;
++
++		switch (id) {
++		case V4L2_CID_HFLIP:
++			pivariety->hflip = *ctrl;
++			if (pivariety->bayer_order_volatile)
++				pivariety->hflip->flags |=
++						V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++			break;
++
++		case V4L2_CID_VFLIP:
++			pivariety->vflip = *ctrl;
++			if (pivariety->bayer_order_volatile)
++				pivariety->vflip->flags |=
++						V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++			break;
++
++		case V4L2_CID_HBLANK:
++			(*ctrl)->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++			break;
++		}
++
++		ctrl++;
++		index++;
++	}
++
++	pivariety_write(pivariety, CTRL_INDEX_REG, 0);
++
++	ret = v4l2_fwnode_device_parse(&client->dev, &props);
++	if (ret)
++		goto err;
++
++	ret = v4l2_ctrl_new_fwnode_properties(ctrl_hdlr,
++					      &pivariety_ctrl_ops,
++					      &props);
++	if (ret)
++		goto err;
++
++	pivariety->sd.ctrl_handler = ctrl_hdlr;
++	v4l2_ctrl_handler_setup(ctrl_hdlr);
++	return 0;
++err:
++	return -ENODEV;
++}
++
++static int pivariety_parse_dt(struct pivariety *pivariety, struct device *dev)
++{
++	struct fwnode_handle *endpoint;
++	struct v4l2_fwnode_endpoint ep_cfg = {
++		.bus_type = V4L2_MBUS_CSI2_DPHY
++	};
++	int ret = -EINVAL;
++
++	/* Get CSI2 bus config */
++	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
++	if (!endpoint) {
++		dev_err(dev, "endpoint node not found\n");
++		return -EINVAL;
++	}
++
++	if (v4l2_fwnode_endpoint_alloc_parse(endpoint, &ep_cfg)) {
++		dev_err(dev, "could not parse endpoint\n");
++		goto error_out;
++	}
++
++	pivariety->bus = ep_cfg.bus.mipi_csi2;
++
++	ret = 0;
++
++error_out:
++	v4l2_fwnode_endpoint_free(&ep_cfg);
++	fwnode_handle_put(endpoint);
++
++	return ret;
++}
++
++static int pivariety_probe(struct i2c_client *client,
++			   const struct i2c_device_id *id)
++{
++	struct device *dev = &client->dev;
++	struct pivariety *pivariety;
++	u32 device_id, firmware_version;
++	int ret;
++
++	pivariety = devm_kzalloc(&client->dev, sizeof(*pivariety), GFP_KERNEL);
++	if (!pivariety)
++		return -ENOMEM;
++
++	/* Initialize subdev */
++	v4l2_i2c_subdev_init(&pivariety->sd, client,
++			     &pivariety_subdev_ops);
++
++	if (pivariety_parse_dt(pivariety, dev))
++		return -EINVAL;
++
++	/* Get system clock (xclk) */
++	pivariety->xclk = devm_clk_get(dev, "xclk");
++	if (IS_ERR(pivariety->xclk)) {
++		dev_err(dev, "failed to get xclk\n");
++		return PTR_ERR(pivariety->xclk);
++	}
++
++	pivariety->xclk_freq = clk_get_rate(pivariety->xclk);
++	if (pivariety->xclk_freq != 24000000) {
++		dev_err(dev, "xclk frequency not supported: %d Hz\n",
++			pivariety->xclk_freq);
++		return -EINVAL;
++	}
++
++	ret = pivariety_get_regulators(pivariety);
++	if (ret)
++		return ret;
++
++	/* Request optional enable pin */
++	pivariety->reset_gpio = devm_gpiod_get_optional(dev, "reset",
++							GPIOD_OUT_HIGH);
++
++	ret = pivariety_power_on(dev);
++	if (ret)
++		return ret;
++
++	ret = pivariety_read(pivariety, DEVICE_ID_REG, &device_id);
++	if (ret || device_id != DEVICE_ID) {
++		dev_err(dev, "probe failed\n");
++		ret = -ENODEV;
++		goto error_power_off;
++	}
++
++	ret = pivariety_read(pivariety, DEVICE_VERSION_REG, &firmware_version);
++	if (ret)
++		dev_err(dev, "read firmware version failed\n");
++
++	dev_info(dev, "firmware version: 0x%04X\n", firmware_version);
++
++	if (pivariety_enum_pixformat(pivariety)) {
++		dev_err(dev, "enum pixformat failed.\n");
++		ret = -ENODEV;
++		goto error_power_off;
++	}
++
++	if (pivariety_enum_controls(pivariety)) {
++		dev_err(dev, "enum controls failed.\n");
++		ret = -ENODEV;
++		goto error_power_off;
++	}
++
++	/* Initialize subdev */
++	pivariety->sd.internal_ops = &pivariety_internal_ops;
++	pivariety->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
++	pivariety->sd.entity.function = MEDIA_ENT_F_CAM_SENSOR;
++	/* Initialize source pad */
++	pivariety->pad.flags = MEDIA_PAD_FL_SOURCE;
++
++	ret = media_entity_pads_init(&pivariety->sd.entity, 1, &pivariety->pad);
++	if (ret)
++		goto error_handler_free;
++
++	ret = v4l2_async_register_subdev_sensor(&pivariety->sd);
++	if (ret < 0)
++		goto error_media_entity;
++
++	pm_runtime_set_active(dev);
++	pm_runtime_enable(dev);
++	pm_runtime_idle(dev);
++
++	return 0;
++
++error_media_entity:
++	media_entity_cleanup(&pivariety->sd.entity);
++
++error_handler_free:
++	pivariety_free_controls(pivariety);
++
++error_power_off:
++	pivariety_power_off(dev);
++
++	return ret;
++}
++
++static void pivariety_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct pivariety *pivariety = to_pivariety(sd);
++
++	v4l2_async_unregister_subdev(sd);
++	media_entity_cleanup(&sd->entity);
++	pivariety_free_controls(pivariety);
++
++	pm_runtime_disable(&client->dev);
++	pm_runtime_set_suspended(&client->dev);
++}
++
++static const struct dev_pm_ops pivariety_pm_ops = {
++	SET_SYSTEM_SLEEP_PM_OPS(pivariety_suspend, pivariety_resume)
++	SET_RUNTIME_PM_OPS(pivariety_power_off, pivariety_power_on, NULL)
++};
++
++static const struct of_device_id arducam_pivariety_dt_ids[] = {
++	{ .compatible = "arducam,arducam-pivariety" },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, arducam_pivariety_dt_ids);
++
++static struct i2c_driver arducam_pivariety_i2c_driver = {
++	.driver = {
++		.name = "arducam-pivariety",
++		.of_match_table	= arducam_pivariety_dt_ids,
++		.pm = &pivariety_pm_ops,
++	},
++	.probe = pivariety_probe,
++	.remove = pivariety_remove,
++};
++
++module_i2c_driver(arducam_pivariety_i2c_driver);
++
++MODULE_AUTHOR("Lee Jackson <info@arducam.com>");
++MODULE_DESCRIPTION("Arducam Pivariety v4l2 driver");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/drivers/media/i2c/arducam-pivariety.h
+@@ -0,0 +1,107 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _ARDUCAM_PIVARIETY_H_
++#define _ARDUCAM_PIVARIETY_H_
++
++#define DEVICE_REG_BASE		0x0100
++#define PIXFORMAT_REG_BASE	0x0200
++#define FORMAT_REG_BASE		0x0300
++#define CTRL_REG_BASE		0x0400
++#define IPC_REG_BASE		0x0600
++
++#define ARDUCAM_MODE_STANDBY		0x00
++#define ARDUCAM_MODE_STREAMING		0x01
++
++#define MODE_SELECT_REG		(DEVICE_REG_BASE | 0x0000)
++#define DEVICE_VERSION_REG	(DEVICE_REG_BASE | 0x0001)
++#define SENSOR_ID_REG		(DEVICE_REG_BASE | 0x0002)
++#define DEVICE_ID_REG		(DEVICE_REG_BASE | 0x0003)
++#define SYSTEM_IDLE_REG		(DEVICE_REG_BASE | 0x0007)
++
++#define PIXFORMAT_INDEX_REG		(PIXFORMAT_REG_BASE | 0x0000)
++#define PIXFORMAT_TYPE_REG		(PIXFORMAT_REG_BASE | 0x0001)
++#define PIXFORMAT_ORDER_REG		(PIXFORMAT_REG_BASE | 0x0002)
++#define MIPI_LANES_REG			(PIXFORMAT_REG_BASE | 0x0003)
++#define FLIPS_DONT_CHANGE_ORDER_REG	(PIXFORMAT_REG_BASE | 0x0004)
++
++#define RESOLUTION_INDEX_REG	(FORMAT_REG_BASE | 0x0000)
++#define FORMAT_WIDTH_REG	(FORMAT_REG_BASE | 0x0001)
++#define FORMAT_HEIGHT_REG	(FORMAT_REG_BASE | 0x0002)
++
++#define CTRL_INDEX_REG	(CTRL_REG_BASE | 0x0000)
++#define CTRL_ID_REG	(CTRL_REG_BASE | 0x0001)
++#define CTRL_MIN_REG	(CTRL_REG_BASE | 0x0002)
++#define CTRL_MAX_REG	(CTRL_REG_BASE | 0x0003)
++#define CTRL_STEP_REG	(CTRL_REG_BASE | 0x0004)
++#define CTRL_DEF_REG	(CTRL_REG_BASE | 0x0005)
++#define CTRL_VALUE_REG	(CTRL_REG_BASE | 0x0006)
++
++#define IPC_SEL_TARGET_REG	(IPC_REG_BASE | 0x0000)
++#define IPC_SEL_TOP_REG		(IPC_REG_BASE | 0x0001)
++#define IPC_SEL_LEFT_REG	(IPC_REG_BASE | 0x0002)
++#define IPC_SEL_WIDTH_REG	(IPC_REG_BASE | 0x0003)
++#define IPC_SEL_HEIGHT_REG	(IPC_REG_BASE | 0x0004)
++#define IPC_DELAY_REG		(IPC_REG_BASE | 0x0005)
++
++#define NO_DATA_AVAILABLE	0xFFFFFFFE
++
++#define DEVICE_ID	0x0030
++
++#define I2C_READ_RETRY_COUNT	3
++#define I2C_WRITE_RETRY_COUNT	2
++
++#define V4L2_CID_ARDUCAM_BASE		(V4L2_CID_USER_BASE + 0x1000)
++#define V4L2_CID_ARDUCAM_EXT_TRI	(V4L2_CID_ARDUCAM_BASE + 1)
++#define V4L2_CID_ARDUCAM_IRCUT		(V4L2_CID_ARDUCAM_BASE + 8)
++
++enum image_dt {
++	IMAGE_DT_YUV420_8 = 0x18,
++	IMAGE_DT_YUV420_10,
++
++	IMAGE_DT_YUV420CSPS_8 = 0x1C,
++	IMAGE_DT_YUV420CSPS_10,
++	IMAGE_DT_YUV422_8,
++	IMAGE_DT_YUV422_10,
++	IMAGE_DT_RGB444,
++	IMAGE_DT_RGB555,
++	IMAGE_DT_RGB565,
++	IMAGE_DT_RGB666,
++	IMAGE_DT_RGB888,
++
++	IMAGE_DT_RAW6 = 0x28,
++	IMAGE_DT_RAW7,
++	IMAGE_DT_RAW8,
++	IMAGE_DT_RAW10,
++	IMAGE_DT_RAW12,
++	IMAGE_DT_RAW14,
++};
++
++enum bayer_order {
++	BAYER_ORDER_BGGR = 0,
++	BAYER_ORDER_GBRG = 1,
++	BAYER_ORDER_GRBG = 2,
++	BAYER_ORDER_RGGB = 3,
++	BAYER_ORDER_GRAY = 4,
++};
++
++enum yuv_order {
++	YUV_ORDER_YUYV = 0,
++	YUV_ORDER_YVYU = 1,
++	YUV_ORDER_UYVY = 2,
++	YUV_ORDER_VYUY = 3,
++};
++
++struct arducam_resolution {
++	u32 width;
++	u32 height;
++};
++
++struct arducam_format {
++	u32 index;
++	u32 mbus_code;
++	u32 bayer_order;
++	u32 data_type;
++	u32 num_resolution_set;
++	struct arducam_resolution *resolution_set;
++};
++
++#endif
diff --git a/target/linux/bcm27xx/patches-6.1/950-0411-thermal-broadcom-Use-dev_err_probe-to-suppress-defer.patch b/target/linux/bcm27xx/patches-6.1/950-0411-thermal-broadcom-Use-dev_err_probe-to-suppress-defer.patch
new file mode 100644
index 00000000000000..1664118980693a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0411-thermal-broadcom-Use-dev_err_probe-to-suppress-defer.patch
@@ -0,0 +1,26 @@
+From edf2f98b1a08b36a6ccbb4dd090acb741e09e085 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 6 May 2022 15:34:44 +0100
+Subject: [PATCH] thermal: broadcom: Use dev_err_probe to suppress
+ defer errors
+
+It is quite common for the devm_thermal_zone_of_sensor_register
+to need to defer, so avoid spamming the log by using
+dev_err_probe instead of dev_err.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/thermal/broadcom/bcm2711_thermal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/thermal/broadcom/bcm2711_thermal.c
++++ b/drivers/thermal/broadcom/bcm2711_thermal.c
+@@ -92,7 +92,7 @@ static int bcm2711_thermal_probe(struct
+ 						&bcm2711_thermal_of_ops);
+ 	if (IS_ERR(thermal)) {
+ 		ret = PTR_ERR(thermal);
+-		dev_err(dev, "could not register sensor: %d\n", ret);
++		dev_err_probe(dev, ret, "could not register sensor: %d\n", ret);
+ 		return ret;
+ 	}
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0412-dt-bindings-hwmon-add-microchip-emc2305.yaml-dt-bind.patch b/target/linux/bcm27xx/patches-6.1/950-0412-dt-bindings-hwmon-add-microchip-emc2305.yaml-dt-bind.patch
new file mode 100644
index 00000000000000..e6cfecfe250c98
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0412-dt-bindings-hwmon-add-microchip-emc2305.yaml-dt-bind.patch
@@ -0,0 +1,75 @@
+From 25478932f5d9e6f763cdf9a0ee2272e33510a76a Mon Sep 17 00:00:00 2001
+From: Michael Shych <michaelsh@nvidia.com>
+Date: Sat, 30 Apr 2022 14:49:04 +0300
+Subject: [PATCH] dt-bindings: hwmon: add microchip,emc2305.yaml dt
+ binding description.
+
+Submitted to linux-hwmon mailing list at
+https://patchwork.kernel.org/project/linux-hwmon/patch/20220430114905.53448-3-michaelsh@nvidia.com/
+
+Add basic description of emc2305 driver device tree binding.
+
+Signed-off-by: Michael Shych <michaelsh@nvidia.com>
+Reviewed-by: Vadim Pasternak <vadimp@nvidia.com>
+---
+ .../bindings/hwmon/microchip,emc2305.yaml     | 54 +++++++++++++++++++
+ 1 file changed, 54 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/hwmon/microchip,emc2305.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/hwmon/microchip,emc2305.yaml
+@@ -0,0 +1,54 @@
++# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
++%YAML 1.2
++---
++
++$id: http://devicetree.org/schemas/hwmon/emc2305.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Microchip EMC2305 RPM-based PWM Fan Speed Controller
++
++properties:
++  compatible:
++    enum:
++      - microcip,emc2305
++
++  emc2305,pwm-min:
++    description:
++      Min pwm of emc2305
++    maxItems: 1
++  emc2305,pwm-max:
++    description:
++      Max pwm of emc2305
++    maxItems: 1
++  emc2305,pwm-channel:
++    description:
++      Max number of pwm channels
++    maxItems: 1
++  emcs205,max-state:
++    description:
++    maxItems: 1
++  emc2305,cooling-levels:
++    description:
++      Quantity of cooling level state.
++    maxItems: 1
++
++required:
++  - compatible
++
++optional:
++  - emc2305,min-pwm
++  - emc2305,max-pwm
++  - emc2305,pwm-channels
++  - emc2305,cooling-levels
++
++additionalProperties: false
++
++examples:
++  - |
++    fan {
++        emc2305,compatible = "microchip,emc2305";
++        emc2305,pwm-min = <0>;
++        emc2305,pwm-max = <255>;
++        emc2305,pwm-channel = <5>
++        emc2305,cooling-levels = <10>;
++    };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0413-dtbindings-Fixup-microchip-emc2305.yaml-bindings.patch b/target/linux/bcm27xx/patches-6.1/950-0413-dtbindings-Fixup-microchip-emc2305.yaml-bindings.patch
new file mode 100644
index 00000000000000..93a913903ed085
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0413-dtbindings-Fixup-microchip-emc2305.yaml-bindings.patch
@@ -0,0 +1,40 @@
+From 2bc4fabde3e63ffb5484804a5f0d1ee950d77475 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 10 May 2022 14:03:30 +0100
+Subject: [PATCH] dtbindings: Fixup microchip,emc2305.yaml bindings
+
+The bindings submitted to mainline had some issues, so fix them up.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../devicetree/bindings/hwmon/microchip,emc2305.yaml      | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/Documentation/devicetree/bindings/hwmon/microchip,emc2305.yaml
++++ b/Documentation/devicetree/bindings/hwmon/microchip,emc2305.yaml
+@@ -5,13 +5,13 @@
+ $id: http://devicetree.org/schemas/hwmon/emc2305.yaml#
+ $schema: http://devicetree.org/meta-schemas/core.yaml#
+ 
+-title: Microchip EMC2305 RPM-based PWM Fan Speed Controller
++title: Microchip EMC230[1|2|3|5] RPM-based PWM Fan Speed Controller
+ 
+ properties:
+   compatible:
+     enum:
+-      - microcip,emc2305
+-
++      - microchip,emc2305
++      - microchip,emc2301
+   emc2305,pwm-min:
+     description:
+       Min pwm of emc2305
+@@ -46,7 +46,7 @@ additionalProperties: false
+ examples:
+   - |
+     fan {
+-        emc2305,compatible = "microchip,emc2305";
++        compatible = "microchip,emc2305";
+         emc2305,pwm-min = <0>;
+         emc2305,pwm-max = <255>;
+         emc2305,pwm-channel = <5>
diff --git a/target/linux/bcm27xx/patches-6.1/950-0414-media-i2c-Update-ov2311-Kconfig-entry.patch b/target/linux/bcm27xx/patches-6.1/950-0414-media-i2c-Update-ov2311-Kconfig-entry.patch
new file mode 100644
index 00000000000000..e998a44aaea607
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0414-media-i2c-Update-ov2311-Kconfig-entry.patch
@@ -0,0 +1,22 @@
+From ad20758237a3cd6c88baa9ef4d874b93a9c36c9f Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 12 May 2022 14:29:48 +0100
+Subject: [PATCH] media: i2c: Update ov2311 Kconfig entry
+
+Bring the OV2311 Kconfig declaration in line with upstream entries.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/media/i2c/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -409,7 +409,6 @@ config VIDEO_OV13B10
+ config VIDEO_OV2311
+ 	tristate "OmniVision OV2311 sensor support"
+ 	depends on I2C && VIDEO_DEV
+-	depends on MEDIA_CAMERA_SUPPORT
+ 	help
+ 	  This is a Video4Linux2 sensor-level driver for the OmniVision
+ 	  OV2311 camera.
diff --git a/target/linux/bcm27xx/patches-6.1/950-0415-media-i2c-Update-ov9281-Kconfig-entry.patch b/target/linux/bcm27xx/patches-6.1/950-0415-media-i2c-Update-ov9281-Kconfig-entry.patch
new file mode 100644
index 00000000000000..00aa8dd4c56d2d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0415-media-i2c-Update-ov9281-Kconfig-entry.patch
@@ -0,0 +1,22 @@
+From 53d17ef5f5618b7abb34b5b0b471253cb8a5358e Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 12 May 2022 14:31:43 +0100
+Subject: [PATCH] media: i2c: Update ov9281 Kconfig entry
+
+Bring the OV9281 Kconfig declaration in line with upstream entries.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/media/i2c/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -1367,7 +1367,6 @@ config VIDEO_TW2804
+ config VIDEO_OV9281
+ 	tristate "OmniVision OV9281 sensor support"
+ 	depends on I2C && VIDEO_DEV
+-	depends on MEDIA_CAMERA_SUPPORT
+ 	help
+ 	  This is a Video4Linux2 sensor-level driver for the OmniVision
+ 	  OV9281 camera.
diff --git a/target/linux/bcm27xx/patches-6.1/950-0416-media-i2c-Update-irs1125-Kconfig-entry.patch b/target/linux/bcm27xx/patches-6.1/950-0416-media-i2c-Update-irs1125-Kconfig-entry.patch
new file mode 100644
index 00000000000000..85634b9997cce1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0416-media-i2c-Update-irs1125-Kconfig-entry.patch
@@ -0,0 +1,25 @@
+From 641461e6a0e15b822b28ad63d8d4976441c493e5 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 12 May 2022 14:32:26 +0100
+Subject: [PATCH] media: i2c: Update irs1125 Kconfig entry
+
+Bring the IRS1125 Kconfig declaration in line with upstream entries.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/media/i2c/Kconfig | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -1406,8 +1406,8 @@ config VIDEO_TW9910
+ 
+ config VIDEO_IRS1125
+ 	tristate "Infineon IRS1125 sensor support"
+-	depends on I2C && VIDEO_DEV && VIDEO_V4L2_SUBDEV_API
+-	depends on MEDIA_CAMERA_SUPPORT
++	depends on I2C && VIDEO_DEV
++	select VIDEO_V4L2_SUBDEV_API
+ 	select V4L2_FWNODE
+ 	help
+ 	  This is a Video4Linux2 sensor-level driver for the Infineon
diff --git a/target/linux/bcm27xx/patches-6.1/950-0417-media-i2c-arducam-pivariety-Fixup-for-mainline-API-c.patch b/target/linux/bcm27xx/patches-6.1/950-0417-media-i2c-arducam-pivariety-Fixup-for-mainline-API-c.patch
new file mode 100644
index 00000000000000..82a5fb11bb01bb
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0417-media-i2c-arducam-pivariety-Fixup-for-mainline-API-c.patch
@@ -0,0 +1,42 @@
+From 3018f1ad77f6943665d5300490cff3c1ee1e4f17 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 12 May 2022 17:42:08 +0100
+Subject: [PATCH] media: i2c: arducam-pivariety: Fixup for mainline API
+ changes
+
+Mainline APIs have changed the way in which the bus flags and
+number of active CSI2 data lanes is signalled, so fix the driver
+up accordingly.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/arducam-pivariety.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/i2c/arducam-pivariety.c
++++ b/drivers/media/i2c/arducam-pivariety.c
+@@ -66,7 +66,7 @@ struct pivariety {
+ 	struct v4l2_subdev sd;
+ 	struct media_pad pad;
+ 
+-	struct v4l2_fwnode_bus_mipi_csi2 bus;
++	struct v4l2_mbus_config_mipi_csi2 bus;
+ 	struct clk *xclk;
+ 	u32 xclk_freq;
+ 
+@@ -946,13 +946,13 @@ static int pivariety_get_mbus_config(str
+ 				     struct v4l2_mbus_config *cfg)
+ {
+ 	struct pivariety *pivariety = to_pivariety(sd);
+-	const u32 mask = V4L2_MBUS_CSI2_LANE_MASK;
+ 
+ 	if (pivariety->lanes > pivariety->bus.num_data_lanes)
+ 		return -EINVAL;
+ 
+ 	cfg->type = V4L2_MBUS_CSI2_DPHY;
+-	cfg->flags = (pivariety->lanes << __ffs(mask)) & mask;
++	cfg->bus.mipi_csi2.flags = pivariety->bus.flags;
++	cfg->bus.mipi_csi2.num_data_lanes = pivariety->lanes;
+ 
+ 	return 0;
+ }
diff --git a/target/linux/bcm27xx/patches-6.1/950-0418-mmc-block-Don-t-do-single-sector-reads-during-recove.patch b/target/linux/bcm27xx/patches-6.1/950-0418-mmc-block-Don-t-do-single-sector-reads-during-recove.patch
new file mode 100644
index 00000000000000..09eff7b97a53fc
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0418-mmc-block-Don-t-do-single-sector-reads-during-recove.patch
@@ -0,0 +1,34 @@
+From 46b28bf91d411852abb18119c27d73da6064826d Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Mon, 16 May 2022 10:28:27 +0100
+Subject: [PATCH] mmc: block: Don't do single-sector reads during
+ recovery
+
+See https://github.com/raspberrypi/linux/issues/5019
+
+If an SD card has degraded performance such that IO operations time out
+then the MMC block layer will leak SG DMA mappings in the swiotlb during
+recovery. It retries the same SG and this causes the leak, as it is
+mapped twice - once in sdhci_pre_req() and again during single-block
+reads in sdhci_prepare_data().
+
+Resetting the card (including power-cycling if a regulator for vmmc is
+present) ought to be enough to recover a stuck state, so for now don't
+try single-block reads in the recovery path.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/block.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -1902,7 +1902,7 @@ static void mmc_blk_mq_rw_recovery(struc
+ 		return;
+ 	}
+ 
+-	if (rq_data_dir(req) == READ && brq->data.blocks >
++	if (0 && rq_data_dir(req) == READ && brq->data.blocks >
+ 			queue_physical_block_size(mq->queue) >> 9) {
+ 		/* Read one (native) sector at a time */
+ 		mmc_blk_read_single(mq, req);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0419-vc04_services-vchiq-mmal-Add-defines-for-mmal_es_for.patch b/target/linux/bcm27xx/patches-6.1/950-0419-vc04_services-vchiq-mmal-Add-defines-for-mmal_es_for.patch
new file mode 100644
index 00000000000000..fb581531baca6c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0419-vc04_services-vchiq-mmal-Add-defines-for-mmal_es_for.patch
@@ -0,0 +1,34 @@
+From 7517e03b97bd0f2f9272ec837e972dce920f2029 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 16 May 2022 17:33:48 +0100
+Subject: [PATCH] vc04_services: vchiq-mmal: Add defines for
+ mmal_es_format flags
+
+There is a flags field in struct mmal_es_format, but the defines
+for what the bits meant weren't included in the headers.
+For V4L2_PIX_FMT_NV12_COL128 support we need them, so add them in.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../staging/vc04_services/vchiq-mmal/mmal-msg-format.h | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-msg-format.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-msg-format.h
+@@ -53,6 +53,16 @@ union mmal_es_specific_format {
+ 	struct mmal_subpicture_format subpicture;
+ };
+ 
++/* The elementary stream will already be framed */
++#define MMAL_ES_FORMAT_FLAG_FRAMED				BIT(0)
++/*
++ * For column formats we ideally want to pass in the column stride. This hasn't
++ * been the past behaviour, so require a new flag to be set should
++ * es->video.width be the column stride (in lines) instead of an ignored width
++ * value.
++ */
++#define MMAL_ES_FORMAT_FLAG_COL_FMTS_WIDTH_IS_COL_STRIDE	BIT(1)
++
+ /* Definition of an elementary stream format (MMAL_ES_FORMAT_T) */
+ struct mmal_es_format_local {
+ 	u32 type;	/* enum mmal_es_type */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0420-random-do-not-use-jump-labels-before-they-are-initia.patch b/target/linux/bcm27xx/patches-6.1/950-0420-random-do-not-use-jump-labels-before-they-are-initia.patch
new file mode 100644
index 00000000000000..a5cefb298d9525
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0420-random-do-not-use-jump-labels-before-they-are-initia.patch
@@ -0,0 +1,86 @@
+From c577ded541087c1d21a6904020670fd59c218e04 Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Tue, 7 Jun 2022 12:02:10 +0200
+Subject: [PATCH] random: do not use jump labels before they are
+ initialized
+
+[ I would like to pursue fixing this more directly first before actually
+  merging this, but I thought I'd send this to the list now anyway as a
+  the "backup" plan. If I can't figure out how to make headway on the
+  main plan in the next few days, it'll be easy to just do this. ]
+
+Stephen reported that a static key warning splat appears during early
+boot on systems that credit randomness from device trees that contain an
+"rng-seed" property, because because setup_machine_fdt() is called
+before jump_label_init() during setup_arch():
+
+ static_key_enable_cpuslocked(): static key '0xffffffe51c6fcfc0' used before call to jump_label_init()
+ WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xb0/0xb8
+ Modules linked in:
+ CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0+ #224 44b43e377bfc84bc99bb5ab885ff694984ee09ff
+ pstate: 600001c9 (nZCv dAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+ pc : static_key_enable_cpuslocked+0xb0/0xb8
+ lr : static_key_enable_cpuslocked+0xb0/0xb8
+ sp : ffffffe51c393cf0
+ x29: ffffffe51c393cf0 x28: 000000008185054c x27: 00000000f1042f10
+ x26: 0000000000000000 x25: 00000000f10302b2 x24: 0000002513200000
+ x23: 0000002513200000 x22: ffffffe51c1c9000 x21: fffffffdfdc00000
+ x20: ffffffe51c2f0831 x19: ffffffe51c6fcfc0 x18: 00000000ffff1020
+ x17: 00000000e1e2ac90 x16: 00000000000000e0 x15: ffffffe51b710708
+ x14: 0000000000000066 x13: 0000000000000018 x12: 0000000000000000
+ x11: 0000000000000000 x10: 00000000ffffffff x9 : 0000000000000000
+ x8 : 0000000000000000 x7 : 61632065726f6665 x6 : 6220646573752027
+ x5 : ffffffe51c641d25 x4 : ffffffe51c13142c x3 : ffff0a00ffffff05
+ x2 : 40000000ffffe003 x1 : 00000000000001c0 x0 : 0000000000000065
+ Call trace:
+  static_key_enable_cpuslocked+0xb0/0xb8
+  static_key_enable+0x2c/0x40
+  crng_set_ready+0x24/0x30
+  execute_in_process_context+0x80/0x90
+  _credit_init_bits+0x100/0x154
+  add_bootloader_randomness+0x64/0x78
+  early_init_dt_scan_chosen+0x140/0x184
+  early_init_dt_scan_nodes+0x28/0x4c
+  early_init_dt_scan+0x40/0x44
+  setup_machine_fdt+0x7c/0x120
+  setup_arch+0x74/0x1d8
+  start_kernel+0x84/0x44c
+  __primary_switched+0xc0/0xc8
+ ---[ end trace 0000000000000000 ]---
+ random: crng init done
+ Machine model: Google Lazor (rev1 - 2) with LTE
+
+A trivial fix went in to address this on arm64, 73e2d827a501 ("arm64:
+Initialize jump labels before setup_machine_fdt()"). But it appears that
+fixing it on other platforms might not be so trivial. Instead, defer the
+setting of the static branch until later in the boot process.
+
+Fixes: f5bda35fba61 ("random: use static branch for crng_ready()")
+Reported-by: Stephen Boyd <swboyd@chromium.org>
+Cc: Ard Biesheuvel <ardb@kernel.org>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Russell King <linux@armlinux.org.uk>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Phil Elwell <phil@raspberrypi.com>
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+---
+ drivers/char/random.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -823,6 +823,14 @@ void __init random_init_early(const char
+ 	unsigned long entropy[BLAKE2S_BLOCK_SIZE / sizeof(long)];
+ 	size_t i, longs, arch_bits;
+ 
++	/*
++	 * If we were initialized by the bootloader before jump labels are
++	 * initialized, then we should enable the static branch here, where
++	 * it's guaranteed that jump labels have been initialized.
++	 */
++	if (!static_branch_likely(&crng_is_ready) && crng_init >= CRNG_READY)
++		crng_set_ready(NULL);
++
+ #if defined(LATENT_ENTROPY_PLUGIN)
+ 	static const u8 compiletime_seed[BLAKE2S_BLOCK_SIZE] __initconst __latent_entropy;
+ 	_mix_pool_bytes(compiletime_seed, sizeof(compiletime_seed));
diff --git a/target/linux/bcm27xx/patches-6.1/950-0421-drm-v3d-Switch-clock-setting-to-new-api.patch b/target/linux/bcm27xx/patches-6.1/950-0421-drm-v3d-Switch-clock-setting-to-new-api.patch
new file mode 100644
index 00000000000000..8339d44fa4e183
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0421-drm-v3d-Switch-clock-setting-to-new-api.patch
@@ -0,0 +1,87 @@
+From fd72b430d69e0352214449cccf3c111b0390ee99 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Wed, 20 Apr 2022 18:08:38 +0100
+Subject: [PATCH] drm/v3d: Switch clock setting to new api
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+drm/v3d: Convert to new clock range API
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/v3d/v3d_drv.c | 22 ++++++++++++++++++++--
+ drivers/gpu/drm/v3d/v3d_gem.c |  4 ++--
+ 2 files changed, 22 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/v3d/v3d_drv.c
++++ b/drivers/gpu/drm/v3d/v3d_drv.c
+@@ -24,6 +24,9 @@
+ #include <drm/drm_drv.h>
+ #include <drm/drm_fb_helper.h>
+ #include <drm/drm_managed.h>
++
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
+ #include <uapi/drm/v3d_drm.h>
+ 
+ #include "v3d_drv.h"
+@@ -207,6 +210,8 @@ map_regs(struct v3d_dev *v3d, void __iom
+ static int v3d_platform_drm_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
++	struct rpi_firmware *firmware;
++	struct device_node *node;
+ 	struct drm_device *drm;
+ 	struct v3d_dev *v3d;
+ 	int ret;
+@@ -266,7 +271,20 @@ static int v3d_platform_drm_probe(struct
+ 			dev_err(dev, "Failed to get clock (%ld)\n", PTR_ERR(v3d->clk));
+ 		return PTR_ERR(v3d->clk);
+ 	}
+-	v3d->clk_up_rate = clk_get_rate(v3d->clk);
++
++	node = rpi_firmware_find_node();
++	if (!node)
++		return -EINVAL;
++
++	firmware = rpi_firmware_get(node);
++	of_node_put(node);
++	if (!firmware)
++		return -EPROBE_DEFER;
++
++	v3d->clk_up_rate = rpi_firmware_clk_get_max_rate(firmware,
++							 RPI_FIRMWARE_V3D_CLK_ID);
++	rpi_firmware_put(firmware);
++
+ 	/* For downclocking, drop it to the minimum frequency we can get from
+ 	 * the CPRMAN clock generator dividing off our parent.  The divider is
+ 	 * 4 bits, but ask for just higher than that so that rounding doesn't
+@@ -300,7 +318,7 @@ static int v3d_platform_drm_probe(struct
+ 	if (ret)
+ 		goto irq_disable;
+ 
+-	ret = clk_set_rate(v3d->clk, v3d->clk_down_rate);
++	ret = clk_set_min_rate(v3d->clk, v3d->clk_down_rate);
+ 	WARN_ON_ONCE(ret != 0);
+ 
+ 	return 0;
+--- a/drivers/gpu/drm/v3d/v3d_gem.c
++++ b/drivers/gpu/drm/v3d/v3d_gem.c
+@@ -25,7 +25,7 @@ v3d_clock_down_work(struct work_struct *
+ 		container_of(work, struct v3d_dev, clk_down_work.work);
+ 	int ret;
+ 
+-	ret = clk_set_rate(v3d->clk, v3d->clk_down_rate);
++	ret = clk_set_min_rate(v3d->clk, v3d->clk_down_rate);
+ 	v3d->clk_up = false;
+ 	WARN_ON_ONCE(ret != 0);
+ }
+@@ -39,7 +39,7 @@ v3d_clock_up_get(struct v3d_dev *v3d)
+ 		if (!v3d->clk_up)  {
+ 			int ret;
+ 
+-			ret = clk_set_rate(v3d->clk, v3d->clk_up_rate);
++			ret = clk_set_min_rate(v3d->clk, v3d->clk_up_rate);
+ 			WARN_ON_ONCE(ret != 0);
+ 			v3d->clk_up = true;
+ 		}
diff --git a/target/linux/bcm27xx/patches-6.1/950-0422-clk-raspberrypi-Enable-minimize-for-all-firmware-clo.patch b/target/linux/bcm27xx/patches-6.1/950-0422-clk-raspberrypi-Enable-minimize-for-all-firmware-clo.patch
new file mode 100644
index 00000000000000..b5fc1c25394f50
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0422-clk-raspberrypi-Enable-minimize-for-all-firmware-clo.patch
@@ -0,0 +1,40 @@
+From 7ce9009442ecacc352f54944cfdf2d256232e1d5 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Wed, 20 Apr 2022 17:40:47 +0100
+Subject: [PATCH] clk-raspberrypi: Enable minimize for all firmware
+ clocks
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/clk/bcm/clk-raspberrypi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/clk/bcm/clk-raspberrypi.c
++++ b/drivers/clk/bcm/clk-raspberrypi.c
+@@ -136,21 +136,26 @@ raspberrypi_clk_variants[RPI_FIRMWARE_NU
+ 	},
+ 	[RPI_FIRMWARE_V3D_CLK_ID] = {
+ 		.export = true,
++		.minimize = true,
+ 	},
+ 	[RPI_FIRMWARE_PIXEL_CLK_ID] = {
+ 		.export = true,
+ 	},
+ 	[RPI_FIRMWARE_HEVC_CLK_ID] = {
+ 		.export = true,
++		.minimize = true,
+ 	},
+ 	[RPI_FIRMWARE_ISP_CLK_ID] = {
+ 		.export = true,
++		.minimize = true,
+ 	},
+ 	[RPI_FIRMWARE_PIXEL_BVB_CLK_ID] = {
+ 		.export = true,
++		.minimize = true,
+ 	},
+ 	[RPI_FIRMWARE_VEC_CLK_ID] = {
+ 		.export = true,
++		.minimize = true,
+ 	},
+ };
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0423-media-dt-bindings-media-i2c-Add-Arducam-64MP-CMOS-se.patch b/target/linux/bcm27xx/patches-6.1/950-0423-media-dt-bindings-media-i2c-Add-Arducam-64MP-CMOS-se.patch
new file mode 100644
index 00000000000000..3a0b78ccb2b254
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0423-media-dt-bindings-media-i2c-Add-Arducam-64MP-CMOS-se.patch
@@ -0,0 +1,151 @@
+From 53d998a246f34b6fbded6c0a7d2d8a8d742142b5 Mon Sep 17 00:00:00 2001
+From: Lee Jackson <info@arducam.com>
+Date: Fri, 13 May 2022 17:21:42 +0800
+Subject: [PATCH] media: dt-bindings: media: i2c: Add Arducam 64MP CMOS
+ sensor binding
+
+Add YAML device tree binding for Arducam 64MP CMOS image sensor, and
+the relevant MAINTAINERS entries.
+
+Signed-off-by: Lee Jackson <info@arducam.com>
+---
+ .../bindings/media/i2c/arducam,64mp.yaml      | 115 ++++++++++++++++++
+ MAINTAINERS                                   |   8 ++
+ 2 files changed, 123 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/arducam,64mp.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/arducam,64mp.yaml
+@@ -0,0 +1,115 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/media/i2c/arducam,64mp.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Arducam 1/1.7-Inch 64Mpixel CMOS Digital Image Sensor
++
++maintainers:
++  - Lee Jackson <info@arducam.com>
++
++description: |-
++  The Arducam 1/1.7-Inch 64Mpixel CMOS active pixel digital image sensor
++  with an active array size of 9248 x 6944. It is programmable through
++  I2C interface. The I2C address is fixed to 0x1A as per sensor data sheet.
++  Image data is sent through MIPI CSI-2, which can be configured for operation
++  with either 2 or 4 data lanes.
++
++properties:
++  compatible:
++    const: arducam,64mp
++
++  reg:
++    description: I2C device address
++    maxItems: 1
++
++  clocks:
++    maxItems: 1
++
++  VDIG-supply:
++    description:
++      Digital I/O voltage supply, 1.05 volts
++
++  VANA-supply:
++    description:
++      Analog voltage supply, 2.8 volts
++
++  VDDL-supply:
++    description:
++      Digital core voltage supply, 1.8 volts
++
++  reset-gpios:
++    description: |-
++      Reference to the GPIO connected to the xclr pin, if any.
++      Must be released (set high) after all supplies and INCK are applied.
++
++  # See ../video-interfaces.txt for more details
++  port:
++    type: object
++    properties:
++      endpoint:
++        type: object
++        properties:
++          data-lanes:
++            description: |-
++              The sensor supports either two-lane, or four-lane operation.
++              For two-lane operation the property must be set to <1 2>.
++            anyOf:
++              - items:
++                  - const: 1
++                  - const: 2
++              - items:
++                  - const: 1
++                  - const: 2
++                  - const: 3
++                  - const: 4
++
++          clock-noncontinuous: true
++
++          link-frequencies:
++            allOf:
++              - $ref: /schemas/types.yaml#/definitions/uint64-array
++            description:
++              Allowed data bus frequencies.
++
++        required:
++          - link-frequencies
++
++required:
++  - compatible
++  - reg
++  - clocks
++  - VANA-supply
++  - VDIG-supply
++  - VDDL-supply
++  - port
++
++additionalProperties: false
++
++examples:
++  - |
++    i2c0 {
++        #address-cells = <1>;
++        #size-cells = <0>;
++
++        arducam_64mp: sensor@1a {
++            compatible = "arducam,64mp";
++            reg = <0x1a>;
++            clocks = <&arducam_64mp_clk>;
++            VANA-supply = <&arducam_64mp_vana>;   /* 2.8v */
++            VDIG-supply = <&arducam_64mp_vdig>;   /* 1.05v */
++            VDDL-supply = <&arducam_64mp_vddl>;   /* 1.8v */
++
++            port {
++                arducam_64mp_0: endpoint {
++                    remote-endpoint = <&csi1_ep>;
++                    data-lanes = <1 2>;
++                    clock-noncontinuous;
++                    link-frequencies = /bits/ 64 <456000000>;
++                };
++            };
++        };
++    };
++
++...
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -1559,6 +1559,14 @@ S:	Maintained
+ F:	drivers/net/arcnet/
+ F:	include/uapi/linux/if_arcnet.h
+ 
++ARDUCAM 64MP SENSOR DRIVER
++M:	Arducam Kernel Maintenance <info@arducam.com>
++L:	linux-media@vger.kernel.org
++S:	Maintained
++T:	git git://linuxtv.org/media_tree.git
++F:	Documentation/devicetree/bindings/media/i2c/arducam,64mp.yaml
++F:	drivers/media/i2c/arducam_64mp.c
++
+ ARDUCAM PIVARIETY SENSOR DRIVER
+ M:	Arducam Kernel Maintenance <info@arducam.com>
+ L:	linux-media@vger.kernel.org
diff --git a/target/linux/bcm27xx/patches-6.1/950-0424-media-i2c-Add-driver-of-Arducam-64MP-camera.patch b/target/linux/bcm27xx/patches-6.1/950-0424-media-i2c-Add-driver-of-Arducam-64MP-camera.patch
new file mode 100644
index 00000000000000..9c34715236aa9a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0424-media-i2c-Add-driver-of-Arducam-64MP-camera.patch
@@ -0,0 +1,2458 @@
+From 1a28fde906ac8a8268b72879dd035e536d4c09c5 Mon Sep 17 00:00:00 2001
+From: Lee Jackson <info@arducam.com>
+Date: Fri, 13 May 2022 17:11:35 +0800
+Subject: [PATCH] media: i2c: Add driver of Arducam 64MP camera
+
+Add a driver for the Arducam 64MP camera sensor.
+Whilst the sensor supports 2 or 4 CSI2 data lanes, this driver
+currently only supports 2 lanes.
+
+The following Bayer modes are currently available:
+
+9152x6944 10-bit @ 2.7fps
+4624x3472 10-bit (binned) @ 10fps
+3840x2160 10-bit (cropped/binned) @ 20fps
+2312x1736 10-bit (binned) @ 30fps
+1920x1080 10-bit (cropped/binned) @ 60fps
+1280x720 10-bit (cropped/binned) @ 120fps
+
+Signed-off-by: Lee Jackson <info@arducam.com>
+---
+ drivers/media/i2c/Kconfig        |   11 +
+ drivers/media/i2c/Makefile       |    1 +
+ drivers/media/i2c/arducam_64mp.c | 2399 ++++++++++++++++++++++++++++++
+ 3 files changed, 2411 insertions(+)
+ create mode 100644 drivers/media/i2c/arducam_64mp.c
+
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -47,6 +47,17 @@ config VIDEO_AR0521
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called ar0521.
+ 
++config VIDEO_ARDUCAM_64MP
++	tristate "Arducam 64MP sensor support"
++	depends on I2C && VIDEO_DEV
++	select VIDEO_V4L2_SUBDEV_API
++	help
++	  This is a Video4Linux2 sensor driver for the Arducam
++	  64MP camera.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called arducam_64mp.
++
+ config VIDEO_ARDUCAM_PIVARIETY
+ 	tristate "Arducam Pivariety sensor support"
+ 	depends on I2C && VIDEO_DEV
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -21,6 +21,7 @@ obj-$(CONFIG_VIDEO_AK7375) += ak7375.o
+ obj-$(CONFIG_VIDEO_AK881X) += ak881x.o
+ obj-$(CONFIG_VIDEO_APTINA_PLL) += aptina-pll.o
+ obj-$(CONFIG_VIDEO_AR0521) += ar0521.o
++obj-$(CONFIG_VIDEO_ARDUCAM_64MP) += arducam_64mp.o
+ obj-$(CONFIG_VIDEO_ARDUCAM_PIVARIETY) += arducam-pivariety.o
+ obj-$(CONFIG_VIDEO_BT819) += bt819.o
+ obj-$(CONFIG_VIDEO_BT856) += bt856.o
+--- /dev/null
++++ b/drivers/media/i2c/arducam_64mp.c
+@@ -0,0 +1,2399 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * A V4L2 driver for Arducam 64MP cameras.
++ * Copyright (C) 2021 Arducam Technology co., Ltd.
++ *
++ * Based on Sony IMX477 camera driver
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ */
++#include <asm/unaligned.h>
++#include <linux/clk.h>
++#include <linux/delay.h>
++#include <linux/gpio/consumer.h>
++#include <linux/i2c.h>
++#include <linux/module.h>
++#include <linux/of_device.h>
++#include <linux/pm_runtime.h>
++#include <linux/regulator/consumer.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-fwnode.h>
++#include <media/v4l2-mediabus.h>
++
++#define ARDUCAM_64MP_REG_VALUE_08BIT	1
++#define ARDUCAM_64MP_REG_VALUE_16BIT	2
++
++/* Chip ID */
++#define ARDUCAM_64MP_REG_CHIP_ID	0x005E
++#define ARDUCAM_64MP_CHIP_ID		0x4136
++
++#define ARDUCAM_64MP_REG_MODE_SELECT	0x0100
++#define ARDUCAM_64MP_MODE_STANDBY	0x00
++#define ARDUCAM_64MP_MODE_STREAMING	0x01
++
++#define ARDUCAM_64MP_REG_ORIENTATION	0x101
++
++#define ARDUCAM_64MP_XCLK_FREQ		24000000
++
++#define ARDUCAM_64MP_DEFAULT_LINK_FREQ	456000000
++
++/* Pixel rate is fixed at 900MHz for all the modes */
++#define ARDUCAM_64MP_PIXEL_RATE		900000000
++
++/* V_TIMING internal */
++#define ARDUCAM_64MP_REG_FRAME_LENGTH	0x0340
++#define ARDUCAM_64MP_FRAME_LENGTH_MAX	0xffff
++
++/* Long exposure multiplier */
++#define ARDUCAM_64MP_LONG_EXP_SHIFT_MAX	7
++#define ARDUCAM_64MP_LONG_EXP_SHIFT_REG	0x3100
++
++/* Exposure control */
++#define ARDUCAM_64MP_REG_EXPOSURE	0x0202
++#define ARDUCAM_64MP_EXPOSURE_OFFSET	48
++#define ARDUCAM_64MP_EXPOSURE_MIN	9
++#define ARDUCAM_64MP_EXPOSURE_STEP	1
++#define ARDUCAM_64MP_EXPOSURE_DEFAULT	0x3e8
++#define ARDUCAM_64MP_EXPOSURE_MAX	(ARDUCAM_64MP_FRAME_LENGTH_MAX - \
++					 ARDUCAM_64MP_EXPOSURE_OFFSET)
++
++/* Analog gain control */
++#define ARDUCAM_64MP_REG_ANALOG_GAIN		0x0204
++#define ARDUCAM_64MP_ANA_GAIN_MIN		0
++#define ARDUCAM_64MP_ANA_GAIN_MAX		1008
++#define ARDUCAM_64MP_ANA_GAIN_STEP		1
++#define ARDUCAM_64MP_ANA_GAIN_DEFAULT		0x0
++
++/* Digital gain control */
++#define ARDUCAM_64MP_REG_DIGITAL_GAIN		0x020e
++#define ARDUCAM_64MP_DGTL_GAIN_MIN		0x0100
++#define ARDUCAM_64MP_DGTL_GAIN_MAX		0x0fff
++#define ARDUCAM_64MP_DGTL_GAIN_DEFAULT		0x0100
++#define ARDUCAM_64MP_DGTL_GAIN_STEP		1
++
++/* Test Pattern Control */
++#define ARDUCAM_64MP_REG_TEST_PATTERN		0x0600
++#define ARDUCAM_64MP_TEST_PATTERN_DISABLE	0
++#define ARDUCAM_64MP_TEST_PATTERN_SOLID_COLOR	1
++#define ARDUCAM_64MP_TEST_PATTERN_COLOR_BARS	2
++#define ARDUCAM_64MP_TEST_PATTERN_GREY_COLOR	3
++#define ARDUCAM_64MP_TEST_PATTERN_PN9		4
++
++/* Test pattern colour components */
++#define ARDUCAM_64MP_REG_TEST_PATTERN_R		0x0602
++#define ARDUCAM_64MP_REG_TEST_PATTERN_GR	0x0604
++#define ARDUCAM_64MP_REG_TEST_PATTERN_B		0x0606
++#define ARDUCAM_64MP_REG_TEST_PATTERN_GB	0x0608
++#define ARDUCAM_64MP_TEST_PATTERN_COLOUR_MIN	0
++#define ARDUCAM_64MP_TEST_PATTERN_COLOUR_MAX	0x0fff
++#define ARDUCAM_64MP_TEST_PATTERN_COLOUR_STEP	1
++#define ARDUCAM_64MP_TEST_PATTERN_R_DEFAULT	\
++	ARDUCAM_64MP_TEST_PATTERN_COLOUR_MAX
++#define ARDUCAM_64MP_TEST_PATTERN_GR_DEFAULT	0
++#define ARDUCAM_64MP_TEST_PATTERN_B_DEFAULT	0
++#define ARDUCAM_64MP_TEST_PATTERN_GB_DEFAULT	0
++
++/* ARDUCAM_64MP native and active pixel array size. */
++#define ARDUCAM_64MP_NATIVE_WIDTH		9344U
++#define ARDUCAM_64MP_NATIVE_HEIGHT		7032U
++#define ARDUCAM_64MP_PIXEL_ARRAY_LEFT		48U
++#define ARDUCAM_64MP_PIXEL_ARRAY_TOP		40U
++#define ARDUCAM_64MP_PIXEL_ARRAY_WIDTH		9248U
++#define ARDUCAM_64MP_PIXEL_ARRAY_HEIGHT		6944U
++
++struct arducam_64mp_reg {
++	u16 address;
++	u8 val;
++};
++
++struct arducam_64mp_reg_list {
++	unsigned int num_of_regs;
++	const struct arducam_64mp_reg *regs;
++};
++
++/* Mode : resolution and related config&values */
++struct arducam_64mp_mode {
++	/* Frame width */
++	unsigned int width;
++
++	/* Frame height */
++	unsigned int height;
++
++	/* H-timing in pixels */
++	unsigned int line_length_pix;
++
++	/* Analog crop rectangle. */
++	struct v4l2_rect crop;
++
++	/* Default framerate. */
++	struct v4l2_fract timeperframe_default;
++
++	/* Default register values */
++	struct arducam_64mp_reg_list reg_list;
++};
++
++static const struct arducam_64mp_reg mode_common_regs[] = {
++	{0x0136, 0x18},
++	{0x0137, 0x00},
++	{0x33F0, 0x01},
++	{0x33F1, 0x03},
++	{0x0111, 0x02},
++	{0x3062, 0x00},
++	{0x3063, 0x30},
++	{0x3076, 0x00},
++	{0x3077, 0x30},
++	{0x1f06, 0x06},
++	{0x1f07, 0x82},
++	{0x1f04, 0x71},
++	{0x1f05, 0x01},
++	{0x1f08, 0x01},
++	{0x5bfe, 0x14},
++	{0x5c0d, 0x2d},
++	{0x5c1c, 0x30},
++	{0x5c2b, 0x32},
++	{0x5c37, 0x2e},
++	{0x5c40, 0x30},
++	{0x5c50, 0x14},
++	{0x5c5f, 0x28},
++	{0x5c6e, 0x28},
++	{0x5c7d, 0x32},
++	{0x5c89, 0x37},
++	{0x5c92, 0x56},
++	{0x5bfc, 0x12},
++	{0x5c0b, 0x2a},
++	{0x5c1a, 0x2c},
++	{0x5c29, 0x2f},
++	{0x5c36, 0x2e},
++	{0x5c3f, 0x2e},
++	{0x5c4e, 0x06},
++	{0x5c5d, 0x1e},
++	{0x5c6c, 0x20},
++	{0x5c7b, 0x1e},
++	{0x5c88, 0x32},
++	{0x5c91, 0x32},
++	{0x5c02, 0x14},
++	{0x5c11, 0x2f},
++	{0x5c20, 0x32},
++	{0x5c2f, 0x34},
++	{0x5c39, 0x31},
++	{0x5c42, 0x31},
++	{0x5c8b, 0x28},
++	{0x5c94, 0x28},
++	{0x5c00, 0x10},
++	{0x5c0f, 0x2c},
++	{0x5c1e, 0x2e},
++	{0x5c2d, 0x32},
++	{0x5c38, 0x2e},
++	{0x5c41, 0x2b},
++	{0x5c61, 0x0a},
++	{0x5c70, 0x0a},
++	{0x5c7f, 0x0a},
++	{0x5c8a, 0x1e},
++	{0x5c93, 0x2a},
++	{0x5bfa, 0x2b},
++	{0x5c09, 0x2d},
++	{0x5c18, 0x2e},
++	{0x5c27, 0x30},
++	{0x5c5b, 0x28},
++	{0x5c6a, 0x22},
++	{0x5c79, 0x42},
++	{0x5bfb, 0x2c},
++	{0x5c0a, 0x2f},
++	{0x5c19, 0x2e},
++	{0x5c28, 0x2e},
++	{0x5c4d, 0x20},
++	{0x5c5c, 0x1e},
++	{0x5c6b, 0x32},
++	{0x5c7a, 0x32},
++	{0x5bfd, 0x30},
++	{0x5c0c, 0x32},
++	{0x5c1b, 0x2e},
++	{0x5c2a, 0x30},
++	{0x5c4f, 0x28},
++	{0x5c5e, 0x32},
++	{0x5c6d, 0x37},
++	{0x5c7c, 0x56},
++	{0x5bff, 0x2e},
++	{0x5c0e, 0x32},
++	{0x5c1d, 0x2e},
++	{0x5c2c, 0x2b},
++	{0x5c51, 0x0a},
++	{0x5c60, 0x0a},
++	{0x5c6f, 0x1e},
++	{0x5c7e, 0x2a},
++	{0x5c01, 0x32},
++	{0x5c10, 0x34},
++	{0x5c1f, 0x31},
++	{0x5c2e, 0x31},
++	{0x5c71, 0x28},
++	{0x5c80, 0x28},
++	{0x5c4c, 0x2a},
++	{0x33f2, 0x01},
++	{0x1f04, 0x73},
++	{0x1f05, 0x01},
++	{0x5bfa, 0x35},
++	{0x5c09, 0x38},
++	{0x5c18, 0x3a},
++	{0x5c27, 0x38},
++	{0x5c5b, 0x25},
++	{0x5c6a, 0x24},
++	{0x5c79, 0x47},
++	{0x5bfc, 0x15},
++	{0x5c0b, 0x2e},
++	{0x5c1a, 0x36},
++	{0x5c29, 0x38},
++	{0x5c36, 0x36},
++	{0x5c3f, 0x36},
++	{0x5c4e, 0x0b},
++	{0x5c5d, 0x20},
++	{0x5c6c, 0x2a},
++	{0x5c7b, 0x25},
++	{0x5c88, 0x25},
++	{0x5c91, 0x22},
++	{0x5bfe, 0x15},
++	{0x5c0d, 0x32},
++	{0x5c1c, 0x36},
++	{0x5c2b, 0x36},
++	{0x5c37, 0x3a},
++	{0x5c40, 0x39},
++	{0x5c50, 0x06},
++	{0x5c5f, 0x22},
++	{0x5c6e, 0x23},
++	{0x5c7d, 0x2e},
++	{0x5c89, 0x44},
++	{0x5c92, 0x51},
++	{0x5d7f, 0x0a},
++	{0x5c00, 0x17},
++	{0x5c0f, 0x36},
++	{0x5c1e, 0x38},
++	{0x5c2d, 0x3c},
++	{0x5c38, 0x38},
++	{0x5c41, 0x36},
++	{0x5c52, 0x0a},
++	{0x5c61, 0x21},
++	{0x5c70, 0x23},
++	{0x5c7f, 0x1b},
++	{0x5c8a, 0x22},
++	{0x5c93, 0x20},
++	{0x5c02, 0x1a},
++	{0x5c11, 0x3e},
++	{0x5c20, 0x3f},
++	{0x5c2f, 0x3d},
++	{0x5c39, 0x3e},
++	{0x5c42, 0x3c},
++	{0x5c54, 0x02},
++	{0x5c63, 0x12},
++	{0x5c72, 0x14},
++	{0x5c81, 0x24},
++	{0x5c8b, 0x1c},
++	{0x5c94, 0x4e},
++	{0x5d8a, 0x09},
++	{0x5bfb, 0x36},
++	{0x5c0a, 0x38},
++	{0x5c19, 0x36},
++	{0x5c28, 0x36},
++	{0x5c4d, 0x2a},
++	{0x5c5c, 0x25},
++	{0x5c6b, 0x25},
++	{0x5c7a, 0x22},
++	{0x5bfd, 0x36},
++	{0x5c0c, 0x36},
++	{0x5c1b, 0x3a},
++	{0x5c2a, 0x39},
++	{0x5c4f, 0x23},
++	{0x5c5e, 0x2e},
++	{0x5c6d, 0x44},
++	{0x5c7c, 0x51},
++	{0x5d63, 0x0a},
++	{0x5bff, 0x38},
++	{0x5c0e, 0x3c},
++	{0x5c1d, 0x38},
++	{0x5c2c, 0x36},
++	{0x5c51, 0x23},
++	{0x5c60, 0x1b},
++	{0x5c6f, 0x22},
++	{0x5c7e, 0x20},
++	{0x5c01, 0x3f},
++	{0x5c10, 0x3d},
++	{0x5c1f, 0x3e},
++	{0x5c2e, 0x3c},
++	{0x5c53, 0x14},
++	{0x5c62, 0x24},
++	{0x5c71, 0x1c},
++	{0x5c80, 0x4e},
++	{0x5d76, 0x09},
++	{0x5c4c, 0x2a},
++	{0x33f2, 0x02},
++	{0x1f04, 0x78},
++	{0x1f05, 0x01},
++	{0x5bfa, 0x37},
++	{0x5c09, 0x36},
++	{0x5c18, 0x39},
++	{0x5c27, 0x38},
++	{0x5c5b, 0x27},
++	{0x5c6a, 0x2b},
++	{0x5c79, 0x48},
++	{0x5bfc, 0x16},
++	{0x5c0b, 0x32},
++	{0x5c1a, 0x33},
++	{0x5c29, 0x37},
++	{0x5c36, 0x36},
++	{0x5c3f, 0x35},
++	{0x5c4e, 0x0d},
++	{0x5c5d, 0x2d},
++	{0x5c6c, 0x23},
++	{0x5c7b, 0x25},
++	{0x5c88, 0x31},
++	{0x5c91, 0x2e},
++	{0x5bfe, 0x15},
++	{0x5c0d, 0x31},
++	{0x5c1c, 0x35},
++	{0x5c2b, 0x36},
++	{0x5c37, 0x35},
++	{0x5c40, 0x37},
++	{0x5c50, 0x0f},
++	{0x5c5f, 0x31},
++	{0x5c6e, 0x30},
++	{0x5c7d, 0x33},
++	{0x5c89, 0x36},
++	{0x5c92, 0x5b},
++	{0x5c00, 0x13},
++	{0x5c0f, 0x2f},
++	{0x5c1e, 0x2e},
++	{0x5c2d, 0x34},
++	{0x5c38, 0x33},
++	{0x5c41, 0x32},
++	{0x5c52, 0x0d},
++	{0x5c61, 0x27},
++	{0x5c70, 0x28},
++	{0x5c7f, 0x1f},
++	{0x5c8a, 0x25},
++	{0x5c93, 0x2c},
++	{0x5c02, 0x15},
++	{0x5c11, 0x36},
++	{0x5c20, 0x39},
++	{0x5c2f, 0x3a},
++	{0x5c39, 0x37},
++	{0x5c42, 0x37},
++	{0x5c54, 0x04},
++	{0x5c63, 0x1c},
++	{0x5c72, 0x1c},
++	{0x5c81, 0x1c},
++	{0x5c8b, 0x28},
++	{0x5c94, 0x24},
++	{0x5bfb, 0x33},
++	{0x5c0a, 0x37},
++	{0x5c19, 0x36},
++	{0x5c28, 0x35},
++	{0x5c4d, 0x23},
++	{0x5c5c, 0x25},
++	{0x5c6b, 0x31},
++	{0x5c7a, 0x2e},
++	{0x5bfd, 0x35},
++	{0x5c0c, 0x36},
++	{0x5c1b, 0x35},
++	{0x5c2a, 0x37},
++	{0x5c4f, 0x30},
++	{0x5c5e, 0x33},
++	{0x5c6d, 0x36},
++	{0x5c7c, 0x5b},
++	{0x5bff, 0x2e},
++	{0x5c0e, 0x34},
++	{0x5c1d, 0x33},
++	{0x5c2c, 0x32},
++	{0x5c51, 0x28},
++	{0x5c60, 0x1f},
++	{0x5c6f, 0x25},
++	{0x5c7e, 0x2c},
++	{0x5c01, 0x39},
++	{0x5c10, 0x3a},
++	{0x5c1f, 0x37},
++	{0x5c2e, 0x37},
++	{0x5c53, 0x1c},
++	{0x5c62, 0x1c},
++	{0x5c71, 0x28},
++	{0x5c80, 0x24},
++	{0x5c4c, 0x2c},
++	{0x33f2, 0x03},
++	{0x1f08, 0x00},
++	{0x32c8, 0x00},
++	{0x4017, 0x40},
++	{0x40a2, 0x01},
++	{0x40ac, 0x01},
++	{0x4328, 0x00},
++	{0x4329, 0xb3},
++	{0x4e15, 0x10},
++	{0x4e19, 0x2f},
++	{0x4e21, 0x0f},
++	{0x4e2f, 0x10},
++	{0x4e3d, 0x10},
++	{0x4e41, 0x2f},
++	{0x4e57, 0x29},
++	{0x4ffb, 0x2f},
++	{0x5011, 0x24},
++	{0x501d, 0x03},
++	{0x505f, 0x41},
++	{0x5060, 0xdf},
++	{0x5065, 0xdf},
++	{0x5066, 0x37},
++	{0x506e, 0x57},
++	{0x5070, 0xc5},
++	{0x5072, 0x57},
++	{0x5075, 0x53},
++	{0x5076, 0x55},
++	{0x5077, 0xc1},
++	{0x5078, 0xc3},
++	{0x5079, 0x53},
++	{0x507a, 0x55},
++	{0x507d, 0x57},
++	{0x507e, 0xdf},
++	{0x507f, 0xc5},
++	{0x5081, 0x57},
++	{0x53c8, 0x01},
++	{0x53c9, 0xe2},
++	{0x53ca, 0x03},
++	{0x5422, 0x7a},
++	{0x548e, 0x40},
++	{0x5497, 0x5e},
++	{0x54a1, 0x40},
++	{0x54a9, 0x40},
++	{0x54b2, 0x5e},
++	{0x54bc, 0x40},
++	{0x57c6, 0x00},
++	{0x583d, 0x0e},
++	{0x583e, 0x0e},
++	{0x583f, 0x0e},
++	{0x5840, 0x0e},
++	{0x5841, 0x0e},
++	{0x5842, 0x0e},
++	{0x5900, 0x12},
++	{0x5901, 0x12},
++	{0x5902, 0x14},
++	{0x5903, 0x12},
++	{0x5904, 0x14},
++	{0x5905, 0x12},
++	{0x5906, 0x14},
++	{0x5907, 0x12},
++	{0x590f, 0x12},
++	{0x5911, 0x12},
++	{0x5913, 0x12},
++	{0x591c, 0x12},
++	{0x591e, 0x12},
++	{0x5920, 0x12},
++	{0x5948, 0x08},
++	{0x5949, 0x08},
++	{0x594a, 0x08},
++	{0x594b, 0x08},
++	{0x594c, 0x08},
++	{0x594d, 0x08},
++	{0x594e, 0x08},
++	{0x594f, 0x08},
++	{0x595c, 0x08},
++	{0x595e, 0x08},
++	{0x5960, 0x08},
++	{0x596e, 0x08},
++	{0x5970, 0x08},
++	{0x5972, 0x08},
++	{0x597e, 0x0f},
++	{0x597f, 0x0f},
++	{0x599a, 0x0f},
++	{0x59de, 0x08},
++	{0x59df, 0x08},
++	{0x59fa, 0x08},
++	{0x5a59, 0x22},
++	{0x5a5b, 0x22},
++	{0x5a5d, 0x1a},
++	{0x5a5f, 0x22},
++	{0x5a61, 0x1a},
++	{0x5a63, 0x22},
++	{0x5a65, 0x1a},
++	{0x5a67, 0x22},
++	{0x5a77, 0x22},
++	{0x5a7b, 0x22},
++	{0x5a7f, 0x22},
++	{0x5a91, 0x22},
++	{0x5a95, 0x22},
++	{0x5a99, 0x22},
++	{0x5ae9, 0x66},
++	{0x5aeb, 0x66},
++	{0x5aed, 0x5e},
++	{0x5aef, 0x66},
++	{0x5af1, 0x5e},
++	{0x5af3, 0x66},
++	{0x5af5, 0x5e},
++	{0x5af7, 0x66},
++	{0x5b07, 0x66},
++	{0x5b0b, 0x66},
++	{0x5b0f, 0x66},
++	{0x5b21, 0x66},
++	{0x5b25, 0x66},
++	{0x5b29, 0x66},
++	{0x5b79, 0x46},
++	{0x5b7b, 0x3e},
++	{0x5b7d, 0x3e},
++	{0x5b89, 0x46},
++	{0x5b8b, 0x46},
++	{0x5b97, 0x46},
++	{0x5b99, 0x46},
++	{0x5c9e, 0x0a},
++	{0x5c9f, 0x08},
++	{0x5ca0, 0x0a},
++	{0x5ca1, 0x0a},
++	{0x5ca2, 0x0b},
++	{0x5ca3, 0x06},
++	{0x5ca4, 0x04},
++	{0x5ca5, 0x06},
++	{0x5ca6, 0x04},
++	{0x5cad, 0x0b},
++	{0x5cae, 0x0a},
++	{0x5caf, 0x0c},
++	{0x5cb0, 0x0a},
++	{0x5cb1, 0x0b},
++	{0x5cb2, 0x08},
++	{0x5cb3, 0x06},
++	{0x5cb4, 0x08},
++	{0x5cb5, 0x04},
++	{0x5cbc, 0x0b},
++	{0x5cbd, 0x09},
++	{0x5cbe, 0x08},
++	{0x5cbf, 0x09},
++	{0x5cc0, 0x0a},
++	{0x5cc1, 0x08},
++	{0x5cc2, 0x06},
++	{0x5cc3, 0x08},
++	{0x5cc4, 0x06},
++	{0x5ccb, 0x0a},
++	{0x5ccc, 0x09},
++	{0x5ccd, 0x0a},
++	{0x5cce, 0x08},
++	{0x5ccf, 0x0a},
++	{0x5cd0, 0x08},
++	{0x5cd1, 0x08},
++	{0x5cd2, 0x08},
++	{0x5cd3, 0x08},
++	{0x5cda, 0x09},
++	{0x5cdb, 0x09},
++	{0x5cdc, 0x08},
++	{0x5cdd, 0x08},
++	{0x5ce3, 0x09},
++	{0x5ce4, 0x08},
++	{0x5ce5, 0x08},
++	{0x5ce6, 0x08},
++	{0x5cf4, 0x04},
++	{0x5d04, 0x04},
++	{0x5d13, 0x06},
++	{0x5d22, 0x06},
++	{0x5d23, 0x04},
++	{0x5d2e, 0x06},
++	{0x5d37, 0x06},
++	{0x5d6f, 0x09},
++	{0x5d72, 0x0f},
++	{0x5d88, 0x0f},
++	{0x5de6, 0x01},
++	{0x5de7, 0x01},
++	{0x5de8, 0x01},
++	{0x5de9, 0x01},
++	{0x5dea, 0x01},
++	{0x5deb, 0x01},
++	{0x5dec, 0x01},
++	{0x5df2, 0x01},
++	{0x5df3, 0x01},
++	{0x5df4, 0x01},
++	{0x5df5, 0x01},
++	{0x5df6, 0x01},
++	{0x5df7, 0x01},
++	{0x5df8, 0x01},
++	{0x5dfe, 0x01},
++	{0x5dff, 0x01},
++	{0x5e00, 0x01},
++	{0x5e01, 0x01},
++	{0x5e02, 0x01},
++	{0x5e03, 0x01},
++	{0x5e04, 0x01},
++	{0x5e0a, 0x01},
++	{0x5e0b, 0x01},
++	{0x5e0c, 0x01},
++	{0x5e0d, 0x01},
++	{0x5e0e, 0x01},
++	{0x5e0f, 0x01},
++	{0x5e10, 0x01},
++	{0x5e16, 0x01},
++	{0x5e17, 0x01},
++	{0x5e18, 0x01},
++	{0x5e1e, 0x01},
++	{0x5e1f, 0x01},
++	{0x5e20, 0x01},
++	{0x5e6e, 0x5a},
++	{0x5e6f, 0x46},
++	{0x5e70, 0x46},
++	{0x5e71, 0x3c},
++	{0x5e72, 0x3c},
++	{0x5e73, 0x28},
++	{0x5e74, 0x28},
++	{0x5e75, 0x6e},
++	{0x5e76, 0x6e},
++	{0x5e81, 0x46},
++	{0x5e83, 0x3c},
++	{0x5e85, 0x28},
++	{0x5e87, 0x6e},
++	{0x5e92, 0x46},
++	{0x5e94, 0x3c},
++	{0x5e96, 0x28},
++	{0x5e98, 0x6e},
++	{0x5ecb, 0x26},
++	{0x5ecc, 0x26},
++	{0x5ecd, 0x26},
++	{0x5ece, 0x26},
++	{0x5ed2, 0x26},
++	{0x5ed3, 0x26},
++	{0x5ed4, 0x26},
++	{0x5ed5, 0x26},
++	{0x5ed9, 0x26},
++	{0x5eda, 0x26},
++	{0x5ee5, 0x08},
++	{0x5ee6, 0x08},
++	{0x5ee7, 0x08},
++	{0x6006, 0x14},
++	{0x6007, 0x14},
++	{0x6008, 0x14},
++	{0x6009, 0x14},
++	{0x600a, 0x14},
++	{0x600b, 0x14},
++	{0x600c, 0x14},
++	{0x600d, 0x22},
++	{0x600e, 0x22},
++	{0x600f, 0x14},
++	{0x601a, 0x14},
++	{0x601b, 0x14},
++	{0x601c, 0x14},
++	{0x601d, 0x14},
++	{0x601e, 0x14},
++	{0x601f, 0x14},
++	{0x6020, 0x14},
++	{0x6021, 0x22},
++	{0x6022, 0x22},
++	{0x6023, 0x14},
++	{0x602e, 0x14},
++	{0x602f, 0x14},
++	{0x6030, 0x14},
++	{0x6031, 0x22},
++	{0x6039, 0x14},
++	{0x603a, 0x14},
++	{0x603b, 0x14},
++	{0x603c, 0x22},
++	{0x6132, 0x0f},
++	{0x6133, 0x0f},
++	{0x6134, 0x0f},
++	{0x6135, 0x0f},
++	{0x6136, 0x0f},
++	{0x6137, 0x0f},
++	{0x6138, 0x0f},
++	{0x613e, 0x0f},
++	{0x613f, 0x0f},
++	{0x6140, 0x0f},
++	{0x6141, 0x0f},
++	{0x6142, 0x0f},
++	{0x6143, 0x0f},
++	{0x6144, 0x0f},
++	{0x614a, 0x0f},
++	{0x614b, 0x0f},
++	{0x614c, 0x0f},
++	{0x614d, 0x0f},
++	{0x614e, 0x0f},
++	{0x614f, 0x0f},
++	{0x6150, 0x0f},
++	{0x6156, 0x0f},
++	{0x6157, 0x0f},
++	{0x6158, 0x0f},
++	{0x6159, 0x0f},
++	{0x615a, 0x0f},
++	{0x615b, 0x0f},
++	{0x615c, 0x0f},
++	{0x6162, 0x0f},
++	{0x6163, 0x0f},
++	{0x6164, 0x0f},
++	{0x616a, 0x0f},
++	{0x616b, 0x0f},
++	{0x616c, 0x0f},
++	{0x6226, 0x00},
++	{0x84f8, 0x01},
++	{0x8501, 0x00},
++	{0x8502, 0x01},
++	{0x8505, 0x00},
++	{0x8744, 0x00},
++	{0x883c, 0x01},
++	{0x8845, 0x00},
++	{0x8846, 0x01},
++	{0x8849, 0x00},
++	{0x9004, 0x1f},
++	{0x9064, 0x4d},
++	{0x9065, 0x3d},
++	{0x922e, 0x91},
++	{0x922f, 0x2a},
++	{0x9230, 0xe2},
++	{0x9231, 0xc0},
++	{0x9232, 0xe2},
++	{0x9233, 0xc1},
++	{0x9234, 0xe2},
++	{0x9235, 0xc2},
++	{0x9236, 0xe2},
++	{0x9237, 0xc3},
++	{0x9238, 0xe2},
++	{0x9239, 0xd4},
++	{0x923a, 0xe2},
++	{0x923b, 0xd5},
++	{0x923c, 0x90},
++	{0x923d, 0x64},
++	{0xb0b9, 0x10},
++	{0xbc76, 0x00},
++	{0xbc77, 0x00},
++	{0xbc78, 0x00},
++	{0xbc79, 0x00},
++	{0xbc7b, 0x28},
++	{0xbc7c, 0x00},
++	{0xbc7d, 0x00},
++	{0xbc7f, 0xc0},
++	{0xc6b9, 0x01},
++	{0xecb5, 0x04},
++	{0xecbf, 0x04},
++	{0x0112, 0x0a},
++	{0x0113, 0x0a},
++	{0x0114, 0x01},
++	{0x0301, 0x08},
++	{0x0303, 0x02},
++	{0x0305, 0x04},
++	{0x0306, 0x01},
++	{0x0307, 0x2c},
++	{0x030b, 0x02},
++	{0x030d, 0x04},
++	{0x030e, 0x01},
++	{0x030f, 0x30},
++	{0x0310, 0x01},
++	{0x4018, 0x00},
++	{0x4019, 0x00},
++	{0x401a, 0x00},
++	{0x401b, 0x00},
++	{0x3400, 0x01},
++	{0x3092, 0x01},
++	{0x3093, 0x00},
++	{0x0350, 0x00},
++};
++
++/* 64 mpix 2.7fps */
++static const struct arducam_64mp_reg mode_9152x6944_regs[] = {
++	{0x0342, 0xb6},
++	{0x0343, 0xb2},
++	{0x0340, 0x1b},
++	{0x0341, 0x76},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x00},
++	{0x0347, 0x00},
++	{0x0348, 0x24},
++	{0x0349, 0x1f},
++	{0x034a, 0x1b},
++	{0x034b, 0x1f},
++	{0x0900, 0x00},
++	{0x0901, 0x11},
++	{0x0902, 0x0a},
++	{0x30d8, 0x00},
++	{0x3200, 0x01},
++	{0x3201, 0x01},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x23},
++	{0x040d, 0xc0},
++	{0x040e, 0x1b},
++	{0x040f, 0x20},
++	{0x034c, 0x23},
++	{0x034d, 0xc0},
++	{0x034e, 0x1b},
++	{0x034f, 0x20},
++	{0x30d9, 0x01},
++	{0x32d5, 0x01},
++	{0x32d6, 0x00},
++	{0x401e, 0x00},
++	{0x40b8, 0x04},
++	{0x40b9, 0x20},
++	{0x40bc, 0x02},
++	{0x40bd, 0x58},
++	{0x40be, 0x02},
++	{0x40bf, 0x58},
++	{0x41a4, 0x00},
++	{0x5a09, 0x01},
++	{0x5a17, 0x01},
++	{0x5a25, 0x01},
++	{0x5a33, 0x01},
++	{0x98d7, 0x14},
++	{0x98d8, 0x14},
++	{0x98d9, 0x00},
++	{0x99c4, 0x00},
++	{0x0202, 0x03},
++	{0x0203, 0xe8},
++	{0x0204, 0x00},
++	{0x0205, 0x00},
++	{0x020e, 0x01},
++	{0x020f, 0x00},
++};
++
++/* 16 mpix 10fps */
++static const struct arducam_64mp_reg mode_4624x3472_regs[] = {
++	{0x0342, 0x63},
++	{0x0343, 0x97},
++	{0x0340, 0x0d},
++	{0x0341, 0xca},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x00},
++	{0x0347, 0x00},
++	{0x0348, 0x24},
++	{0x0349, 0x1f},
++	{0x034a, 0x1b},
++	{0x034b, 0x1f},
++	{0x0900, 0x01},
++	{0x0901, 0x22},
++	{0x0902, 0x08},
++	{0x30d8, 0x04},
++	{0x3200, 0x41},
++	{0x3201, 0x41},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x12},
++	{0x040d, 0x10},
++	{0x040e, 0x0d},
++	{0x040f, 0x90},
++	{0x034c, 0x12},
++	{0x034d, 0x10},
++	{0x034e, 0x0d},
++	{0x034f, 0x90},
++	{0x30d9, 0x00},
++	{0x32d5, 0x00},
++	{0x32d6, 0x00},
++	{0x401e, 0x00},
++	{0x40b8, 0x01},
++	{0x40b9, 0x2c},
++	{0x40bc, 0x01},
++	{0x40bd, 0x18},
++	{0x40be, 0x00},
++	{0x40bf, 0x00},
++	{0x41a4, 0x00},
++	{0x5a09, 0x01},
++	{0x5a17, 0x01},
++	{0x5a25, 0x01},
++	{0x5a33, 0x01},
++	{0x98d7, 0xb4},
++	{0x98d8, 0x8c},
++	{0x98d9, 0x0a},
++	{0x99c4, 0x16},
++};
++
++/* 4k 20fps mode */
++static const struct arducam_64mp_reg mode_3840x2160_regs[] = {
++	{0x0342, 0x4e},
++	{0x0343, 0xb7},
++	{0x0340, 0x08},
++	{0x0341, 0xb9},
++	{0x0344, 0x03},
++	{0x0345, 0x10},
++	{0x0346, 0x05},
++	{0x0347, 0x20},
++	{0x0348, 0x21},
++	{0x0349, 0x0f},
++	{0x034a, 0x15},
++	{0x034b, 0xff},
++	{0x0900, 0x01},
++	{0x0901, 0x22},
++	{0x0902, 0x08},
++	{0x30d8, 0x04},
++	{0x3200, 0x41},
++	{0x3201, 0x41},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x0f},
++	{0x040d, 0x00},
++	{0x040e, 0x08},
++	{0x040f, 0x70},
++	{0x034c, 0x0f},
++	{0x034d, 0x00},
++	{0x034e, 0x08},
++	{0x034f, 0x70},
++	{0x30d9, 0x00},
++	{0x32d5, 0x00},
++	{0x32d6, 0x00},
++	{0x401e, 0x00},
++	{0x40b8, 0x01},
++	{0x40b9, 0x2c},
++	{0x40bc, 0x01},
++	{0x40bd, 0x18},
++	{0x40be, 0x00},
++	{0x40bf, 0x00},
++	{0x41a4, 0x00},
++	{0x5a09, 0x01},
++	{0x5a17, 0x01},
++	{0x5a25, 0x01},
++	{0x5a33, 0x01},
++	{0x98d7, 0xb4},
++	{0x98d8, 0x8c},
++	{0x98d9, 0x0a},
++	{0x99c4, 0x16},
++};
++
++/* 4x4 binned 30fps mode */
++static const struct arducam_64mp_reg mode_2312x1736_regs[] = {
++	{0x0342, 0x33},
++	{0x0343, 0x60},
++	{0x0340, 0x08},
++	{0x0341, 0xe9},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x00},
++	{0x0347, 0x00},
++	{0x0348, 0x24},
++	{0x0349, 0x1f},
++	{0x034a, 0x1b},
++	{0x034b, 0x1f},
++	{0x0900, 0x01},
++	{0x0901, 0x44},
++	{0x0902, 0x08},
++	{0x30d8, 0x00},
++	{0x3200, 0x43},
++	{0x3201, 0x43},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x09},
++	{0x040d, 0x08},
++	{0x040e, 0x06},
++	{0x040f, 0xc8},
++	{0x034c, 0x09},
++	{0x034d, 0x08},
++	{0x034e, 0x06},
++	{0x034f, 0xc8},
++	{0x30d9, 0x01},
++	{0x32d5, 0x00},
++	{0x32d6, 0x00},
++	{0x401e, 0x00},
++	{0x40b8, 0x01},
++	{0x40b9, 0x2c},
++	{0x40bc, 0x01},
++	{0x40bd, 0x18},
++	{0x40be, 0x00},
++	{0x40bf, 0x00},
++	{0x41a4, 0x00},
++	{0x5a09, 0x01},
++	{0x5a17, 0x01},
++	{0x5a25, 0x01},
++	{0x5a33, 0x01},
++	{0x98d7, 0xb4},
++	{0x98d8, 0x8c},
++	{0x98d9, 0x0a},
++	{0x99c4, 0x16},
++};
++
++/* 1080p 60fps mode */
++static const struct arducam_64mp_reg mode_1920x1080_regs[] = {
++	{0x0342, 0x29},
++	{0x0343, 0xe3},
++	{0x0340, 0x05},
++	{0x0341, 0x76},
++	{0x0344, 0x03},
++	{0x0345, 0x10},
++	{0x0346, 0x05},
++	{0x0347, 0x20},
++	{0x0348, 0x21},
++	{0x0349, 0x0f},
++	{0x034a, 0x16},
++	{0x034b, 0x0f},
++	{0x0900, 0x01},
++	{0x0901, 0x44},
++	{0x0902, 0x08},
++	{0x30d8, 0x04},
++	{0x3200, 0x43},
++	{0x3201, 0x43},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x07},
++	{0x040d, 0x80},
++	{0x040e, 0x04},
++	{0x040f, 0x38},
++	{0x034c, 0x07},
++	{0x034d, 0x80},
++	{0x034e, 0x04},
++	{0x034f, 0x38},
++	{0x30d9, 0x00},
++	{0x32d5, 0x00},
++	{0x32d6, 0x00},
++	{0x401e, 0x00},
++	{0x40b8, 0x01},
++	{0x40b9, 0x2c},
++	{0x40bc, 0x01},
++	{0x40bd, 0x18},
++	{0x40be, 0x00},
++	{0x40bf, 0x00},
++	{0x41a4, 0x00},
++	{0x5a09, 0x01},
++	{0x5a17, 0x01},
++	{0x5a25, 0x01},
++	{0x5a33, 0x01},
++	{0x98d7, 0xb4},
++	{0x98d8, 0x8c},
++	{0x98d9, 0x0a},
++	{0x99c4, 0x16},
++};
++
++/* 720p 120fps mode */
++static const struct arducam_64mp_reg mode_1280x720_regs[] = {
++	{0x0342, 0x1d},
++	{0x0343, 0xc4},
++	{0x0340, 0x03},
++	{0x0341, 0xd8},
++	{0x0344, 0x08},
++	{0x0345, 0x10},
++	{0x0346, 0x07},
++	{0x0347, 0xf0},
++	{0x0348, 0x1c},
++	{0x0349, 0x0f},
++	{0x034a, 0x13},
++	{0x034b, 0x3f},
++	{0x0900, 0x01},
++	{0x0901, 0x44},
++	{0x0902, 0x08},
++	{0x30d8, 0x04},
++	{0x3200, 0x43},
++	{0x3201, 0x43},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x05},
++	{0x040d, 0x00},
++	{0x040e, 0x02},
++	{0x040f, 0xd0},
++	{0x034c, 0x05},
++	{0x034d, 0x00},
++	{0x034e, 0x02},
++	{0x034f, 0xd0},
++	{0x30d9, 0x00},
++	{0x32d5, 0x00},
++	{0x32d6, 0x00},
++	{0x401e, 0x00},
++	{0x40b8, 0x01},
++	{0x40b9, 0x2c},
++	{0x40bc, 0x01},
++	{0x40bd, 0x18},
++	{0x40be, 0x00},
++	{0x40bf, 0x00},
++	{0x41a4, 0x00},
++	{0x5a09, 0x01},
++	{0x5a17, 0x01},
++	{0x5a25, 0x01},
++	{0x5a33, 0x01},
++	{0x98d7, 0xb4},
++	{0x98d8, 0x8c},
++	{0x98d9, 0x0a},
++	{0x99c4, 0x16},
++};
++
++/* Mode configs */
++static const struct arducam_64mp_mode supported_modes[] = {
++	{
++		.width = 9152,
++		.height = 6944,
++		.line_length_pix = 0xb6b2,
++		.crop = {
++			.left = ARDUCAM_64MP_PIXEL_ARRAY_LEFT,
++			.top = ARDUCAM_64MP_PIXEL_ARRAY_TOP,
++			.width = 9248,
++			.height = 6944,
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 270
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_9152x6944_regs),
++			.regs = mode_9152x6944_regs,
++		}
++	}, {
++		.width = 4624,
++		.height = 3472,
++		.line_length_pix = 0x6397,
++		.crop = {
++			.left = ARDUCAM_64MP_PIXEL_ARRAY_LEFT,
++			.top = ARDUCAM_64MP_PIXEL_ARRAY_TOP,
++			.width = 9248,
++			.height = 6944,
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 1000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_4624x3472_regs),
++			.regs = mode_4624x3472_regs,
++		}
++	}, {
++		.width = 3840,
++		.height = 2160,
++		.line_length_pix = 0x4eb7,
++		.crop = {
++			.left = ARDUCAM_64MP_PIXEL_ARRAY_LEFT + 784,
++			.top = ARDUCAM_64MP_PIXEL_ARRAY_TOP + 1312,
++			.width = 7680,
++			.height = 4320,
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 2000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_3840x2160_regs),
++			.regs = mode_3840x2160_regs,
++		}
++	}, {
++		.width = 2312,
++		.height = 1736,
++		.line_length_pix = 0x3360,
++		.crop = {
++			.left = ARDUCAM_64MP_PIXEL_ARRAY_LEFT,
++			.top = ARDUCAM_64MP_PIXEL_ARRAY_TOP,
++			.width = 9248,
++			.height = 6944,
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 3000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_2312x1736_regs),
++			.regs = mode_2312x1736_regs,
++		}
++	}, {
++		.width = 1920,
++		.height = 1080,
++		.line_length_pix = 0x29e3,
++		.crop = {
++			.left = ARDUCAM_64MP_PIXEL_ARRAY_LEFT + 784,
++			.top = ARDUCAM_64MP_PIXEL_ARRAY_TOP + 1312,
++			.width = 7680,
++			.height = 4320,
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 6000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_1920x1080_regs),
++			.regs = mode_1920x1080_regs,
++		}
++	}, {
++		.width = 1280,
++		.height = 720,
++		.line_length_pix = 0x1dc4,
++		.crop = {
++			.left = ARDUCAM_64MP_PIXEL_ARRAY_LEFT + 2064,
++			.top = ARDUCAM_64MP_PIXEL_ARRAY_TOP + 2032,
++			.width = 5120,
++			.height = 2880,
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 12000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_1280x720_regs),
++			.regs = mode_1280x720_regs,
++		}
++	},
++};
++
++/*
++ * The supported formats.
++ * This table MUST contain 4 entries per format, to cover the various flip
++ * combinations in the order
++ * - no flip
++ * - h flip
++ * - v flip
++ * - h&v flips
++ */
++static const u32 codes[] = {
++	/* 10-bit modes. */
++	MEDIA_BUS_FMT_SRGGB10_1X10,
++	MEDIA_BUS_FMT_SGRBG10_1X10,
++	MEDIA_BUS_FMT_SGBRG10_1X10,
++	MEDIA_BUS_FMT_SBGGR10_1X10,
++};
++
++static const char * const arducam_64mp_test_pattern_menu[] = {
++	"Disabled",
++	"Color Bars",
++	"Solid Color",
++	"Grey Color Bars",
++	"PN9"
++};
++
++static const int arducam_64mp_test_pattern_val[] = {
++	ARDUCAM_64MP_TEST_PATTERN_DISABLE,
++	ARDUCAM_64MP_TEST_PATTERN_COLOR_BARS,
++	ARDUCAM_64MP_TEST_PATTERN_SOLID_COLOR,
++	ARDUCAM_64MP_TEST_PATTERN_GREY_COLOR,
++	ARDUCAM_64MP_TEST_PATTERN_PN9,
++};
++
++/* regulator supplies */
++static const char * const arducam_64mp_supply_name[] = {
++	/* Supplies can be enabled in any order */
++	"VANA",  /* Analog (2.8V) supply */
++	"VDIG",  /* Digital Core (1.05V) supply */
++	"VDDL",  /* IF (1.8V) supply */
++};
++
++#define ARDUCAM_64MP_NUM_SUPPLIES ARRAY_SIZE(arducam_64mp_supply_name)
++
++/*
++ * Initialisation delay between XCLR low->high and the moment when the sensor
++ * can start capture (i.e. can leave software standby), given by T7 in the
++ * datasheet is 7.7ms.  This does include I2C setup time as well.
++ *
++ * Note, that delay between XCLR low->high and reading the CCI ID register (T6
++ * in the datasheet) is much smaller - 1ms.
++ */
++#define ARDUCAM_64MP_XCLR_MIN_DELAY_US		8000
++#define ARDUCAM_64MP_XCLR_DELAY_RANGE_US	1000
++
++struct arducam_64mp {
++	struct v4l2_subdev sd;
++	struct media_pad pad;
++
++	unsigned int fmt_code;
++
++	struct clk *xclk;
++
++	struct gpio_desc *reset_gpio;
++	struct regulator_bulk_data supplies[ARDUCAM_64MP_NUM_SUPPLIES];
++
++	struct v4l2_ctrl_handler ctrl_handler;
++	/* V4L2 Controls */
++	struct v4l2_ctrl *pixel_rate;
++	struct v4l2_ctrl *exposure;
++	struct v4l2_ctrl *vflip;
++	struct v4l2_ctrl *hflip;
++	struct v4l2_ctrl *vblank;
++	struct v4l2_ctrl *hblank;
++
++	/* Current mode */
++	const struct arducam_64mp_mode *mode;
++
++	/*
++	 * Mutex for serialized access:
++	 * Protect sensor module set pad format and start/stop streaming safely.
++	 */
++	struct mutex mutex;
++
++	/* Streaming on/off */
++	bool streaming;
++
++	/* Rewrite common registers on stream on? */
++	bool common_regs_written;
++
++	/* Current long exposure factor in use. Set through V4L2_CID_VBLANK */
++	unsigned int long_exp_shift;
++};
++
++static inline struct arducam_64mp *to_arducam_64mp(struct v4l2_subdev *_sd)
++{
++	return container_of(_sd, struct arducam_64mp, sd);
++}
++
++/* Read registers up to 2 at a time */
++static int arducam_64mp_read_reg(struct i2c_client *client,
++				 u16 reg, u32 len, u32 *val)
++{
++	struct i2c_msg msgs[2];
++	u8 addr_buf[2] = { reg >> 8, reg & 0xff };
++	u8 data_buf[4] = { 0, };
++	int ret;
++
++	if (len > 4)
++		return -EINVAL;
++
++	/* Write register address */
++	msgs[0].addr = client->addr;
++	msgs[0].flags = 0;
++	msgs[0].len = ARRAY_SIZE(addr_buf);
++	msgs[0].buf = addr_buf;
++
++	/* Read data from register */
++	msgs[1].addr = client->addr;
++	msgs[1].flags = I2C_M_RD;
++	msgs[1].len = len;
++	msgs[1].buf = &data_buf[4 - len];
++
++	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++	if (ret != ARRAY_SIZE(msgs))
++		return -EIO;
++
++	*val = get_unaligned_be32(data_buf);
++
++	return 0;
++}
++
++/* Write registers up to 2 at a time */
++static int arducam_64mp_write_reg(struct arducam_64mp *arducam_64mp,
++				  u16 reg, u32 len, u32 val)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&arducam_64mp->sd);
++	u8 buf[6];
++
++	if (len > 4)
++		return -EINVAL;
++
++	put_unaligned_be16(reg, buf);
++	put_unaligned_be32(val << (8 * (4 - len)), buf + 2);
++	if (i2c_master_send(client, buf, len + 2) != len + 2)
++		return -EIO;
++
++	return 0;
++}
++
++/* Write a list of registers */
++static int arducam_64mp_write_regs(struct arducam_64mp *arducam_64mp,
++				   const struct arducam_64mp_reg *regs, u32 len)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&arducam_64mp->sd);
++	unsigned int i;
++	int ret;
++
++	for (i = 0; i < len; i++) {
++		ret = arducam_64mp_write_reg(arducam_64mp, regs[i].address, 1,
++					     regs[i].val);
++		if (ret) {
++			dev_err_ratelimited(&client->dev,
++					    "Failed to write reg 0x%4.4x. error = %d\n",
++					    regs[i].address, ret);
++
++			return ret;
++		}
++	}
++
++	return 0;
++}
++
++/* Get bayer order based on flip setting. */
++static u32 arducam_64mp_get_format_code(struct arducam_64mp *arducam_64mp)
++{
++	unsigned int i;
++
++	lockdep_assert_held(&arducam_64mp->mutex);
++
++	i = (arducam_64mp->vflip->val ? 2 : 0) |
++	    (arducam_64mp->hflip->val ? 1 : 0);
++
++	return codes[i];
++}
++
++static int arducam_64mp_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++	struct v4l2_mbus_framefmt *try_fmt_img =
++		v4l2_subdev_get_try_format(sd, fh->state, 0);
++	struct v4l2_rect *try_crop;
++
++	mutex_lock(&arducam_64mp->mutex);
++
++	/* Initialize try_fmt for the image pad */
++	try_fmt_img->width = supported_modes[0].width;
++	try_fmt_img->height = supported_modes[0].height;
++	try_fmt_img->code = arducam_64mp_get_format_code(arducam_64mp);
++	try_fmt_img->field = V4L2_FIELD_NONE;
++
++	/* Initialize try_crop */
++	try_crop = v4l2_subdev_get_try_crop(sd, fh->state, 0);
++	try_crop->left = ARDUCAM_64MP_PIXEL_ARRAY_LEFT;
++	try_crop->top = ARDUCAM_64MP_PIXEL_ARRAY_TOP;
++	try_crop->width = ARDUCAM_64MP_PIXEL_ARRAY_WIDTH;
++	try_crop->height = ARDUCAM_64MP_PIXEL_ARRAY_HEIGHT;
++
++	mutex_unlock(&arducam_64mp->mutex);
++
++	return 0;
++}
++
++static void
++arducam_64mp_adjust_exposure_range(struct arducam_64mp *arducam_64mp)
++{
++	int exposure_max, exposure_def;
++
++	/* Honour the VBLANK limits when setting exposure. */
++	exposure_max = arducam_64mp->mode->height + arducam_64mp->vblank->val -
++		       ARDUCAM_64MP_EXPOSURE_OFFSET;
++	exposure_def = min(exposure_max, arducam_64mp->exposure->val);
++	__v4l2_ctrl_modify_range(arducam_64mp->exposure,
++				 arducam_64mp->exposure->minimum,
++				 exposure_max, arducam_64mp->exposure->step,
++				 exposure_def);
++}
++
++static int arducam_64mp_set_frame_length(struct arducam_64mp *arducam_64mp,
++					 unsigned int vblank)
++{
++	unsigned int val = vblank + arducam_64mp->mode->height;
++	int ret = 0;
++
++	arducam_64mp->long_exp_shift = 0;
++
++	while (val > ARDUCAM_64MP_FRAME_LENGTH_MAX) {
++		arducam_64mp->long_exp_shift++;
++		val >>= 1;
++	}
++
++	ret = arducam_64mp_write_reg(arducam_64mp,
++				     ARDUCAM_64MP_REG_FRAME_LENGTH,
++				     ARDUCAM_64MP_REG_VALUE_16BIT, val);
++	if (ret)
++		return ret;
++
++	return arducam_64mp_write_reg(arducam_64mp,
++				      ARDUCAM_64MP_LONG_EXP_SHIFT_REG,
++				      ARDUCAM_64MP_REG_VALUE_08BIT,
++				      arducam_64mp->long_exp_shift);
++}
++
++static int arducam_64mp_set_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct arducam_64mp *arducam_64mp =
++		container_of(ctrl->handler, struct arducam_64mp, ctrl_handler);
++	struct i2c_client *client = v4l2_get_subdevdata(&arducam_64mp->sd);
++	int ret;
++	u32 val;
++	/*
++	 * The VBLANK control may change the limits of usable exposure, so check
++	 * and adjust if necessary.
++	 */
++	if (ctrl->id == V4L2_CID_VBLANK)
++		arducam_64mp_adjust_exposure_range(arducam_64mp);
++
++	/*
++	 * Applying V4L2 control value only happens
++	 * when power is up for streaming
++	 */
++	if (pm_runtime_get_if_in_use(&client->dev) == 0)
++		return 0;
++
++	switch (ctrl->id) {
++	case V4L2_CID_ANALOGUE_GAIN:
++		ret = arducam_64mp_write_reg(arducam_64mp,
++					     ARDUCAM_64MP_REG_ANALOG_GAIN,
++					     ARDUCAM_64MP_REG_VALUE_16BIT,
++					     ctrl->val);
++		break;
++	case V4L2_CID_EXPOSURE:
++		val = ctrl->val >> arducam_64mp->long_exp_shift;
++		ret = arducam_64mp_write_reg(arducam_64mp,
++					     ARDUCAM_64MP_REG_EXPOSURE,
++					     ARDUCAM_64MP_REG_VALUE_16BIT,
++					     val);
++		break;
++	case V4L2_CID_DIGITAL_GAIN:
++		ret = arducam_64mp_write_reg(arducam_64mp,
++					     ARDUCAM_64MP_REG_DIGITAL_GAIN,
++					     ARDUCAM_64MP_REG_VALUE_16BIT,
++					     ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN:
++		val = arducam_64mp_test_pattern_val[ctrl->val];
++		ret = arducam_64mp_write_reg(arducam_64mp,
++					     ARDUCAM_64MP_REG_TEST_PATTERN,
++					     ARDUCAM_64MP_REG_VALUE_16BIT,
++					     val);
++		break;
++	case V4L2_CID_TEST_PATTERN_RED:
++		ret = arducam_64mp_write_reg(arducam_64mp,
++					     ARDUCAM_64MP_REG_TEST_PATTERN_R,
++					     ARDUCAM_64MP_REG_VALUE_16BIT,
++					     ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_GREENR:
++		ret = arducam_64mp_write_reg(arducam_64mp,
++					     ARDUCAM_64MP_REG_TEST_PATTERN_GR,
++					     ARDUCAM_64MP_REG_VALUE_16BIT,
++					     ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_BLUE:
++		ret = arducam_64mp_write_reg(arducam_64mp,
++					     ARDUCAM_64MP_REG_TEST_PATTERN_B,
++					     ARDUCAM_64MP_REG_VALUE_16BIT,
++					     ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_GREENB:
++		ret = arducam_64mp_write_reg(arducam_64mp,
++					     ARDUCAM_64MP_REG_TEST_PATTERN_GB,
++					     ARDUCAM_64MP_REG_VALUE_16BIT,
++					     ctrl->val);
++		break;
++	case V4L2_CID_HFLIP:
++	case V4L2_CID_VFLIP:
++		ret = arducam_64mp_write_reg(arducam_64mp,
++					     ARDUCAM_64MP_REG_ORIENTATION, 1,
++					     arducam_64mp->hflip->val |
++						arducam_64mp->vflip->val << 1);
++		break;
++	case V4L2_CID_VBLANK:
++		ret = arducam_64mp_set_frame_length(arducam_64mp, ctrl->val);
++		break;
++	default:
++		dev_info(&client->dev,
++			 "ctrl(id:0x%x,val:0x%x) is not handled\n",
++			 ctrl->id, ctrl->val);
++		ret = -EINVAL;
++		break;
++	}
++
++	pm_runtime_put(&client->dev);
++
++	return ret;
++}
++
++static const struct v4l2_ctrl_ops arducam_64mp_ctrl_ops = {
++	.s_ctrl = arducam_64mp_set_ctrl,
++};
++
++static int arducam_64mp_enum_mbus_code(struct v4l2_subdev *sd,
++				       struct v4l2_subdev_state *sd_state,
++				       struct v4l2_subdev_mbus_code_enum *code)
++{
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++
++	if (code->index > 0)
++		return -EINVAL;
++
++	code->code = arducam_64mp_get_format_code(arducam_64mp);
++
++	return 0;
++}
++
++static int arducam_64mp_enum_frame_size(struct v4l2_subdev *sd,
++					struct v4l2_subdev_state *sd_state,
++					struct v4l2_subdev_frame_size_enum *fse)
++{
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++
++	if (fse->index >= ARRAY_SIZE(supported_modes))
++		return -EINVAL;
++
++	if (fse->code != arducam_64mp_get_format_code(arducam_64mp))
++		return -EINVAL;
++
++	fse->min_width = supported_modes[fse->index].width;
++	fse->max_width = fse->min_width;
++	fse->min_height = supported_modes[fse->index].height;
++	fse->max_height = fse->min_height;
++
++	return 0;
++}
++
++static void arducam_64mp_reset_colorspace(struct v4l2_mbus_framefmt *fmt)
++{
++	fmt->colorspace = V4L2_COLORSPACE_RAW;
++	fmt->ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->colorspace);
++	fmt->quantization = V4L2_MAP_QUANTIZATION_DEFAULT(true,
++							  fmt->colorspace,
++							  fmt->ycbcr_enc);
++	fmt->xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(fmt->colorspace);
++}
++
++static void
++arducam_64mp_update_image_pad_format(struct arducam_64mp *arducam_64mp,
++				     const struct arducam_64mp_mode *mode,
++				     struct v4l2_subdev_format *fmt)
++{
++	fmt->format.width = mode->width;
++	fmt->format.height = mode->height;
++	fmt->format.field = V4L2_FIELD_NONE;
++	arducam_64mp_reset_colorspace(&fmt->format);
++}
++
++static int arducam_64mp_get_pad_format(struct v4l2_subdev *sd,
++				       struct v4l2_subdev_state *sd_state,
++				       struct v4l2_subdev_format *fmt)
++{
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++
++	if (fmt->pad != 0)
++		return -EINVAL;
++
++	mutex_lock(&arducam_64mp->mutex);
++
++	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++		struct v4l2_mbus_framefmt *try_fmt =
++			v4l2_subdev_get_try_format(&arducam_64mp->sd, sd_state,
++						   fmt->pad);
++		/* update the code which could change due to vflip or hflip: */
++		try_fmt->code = arducam_64mp_get_format_code(arducam_64mp);
++		fmt->format = *try_fmt;
++	} else {
++		arducam_64mp_update_image_pad_format(arducam_64mp,
++						     arducam_64mp->mode,
++						     fmt);
++		fmt->format.code =
++			arducam_64mp_get_format_code(arducam_64mp);
++	}
++
++	mutex_unlock(&arducam_64mp->mutex);
++	return 0;
++}
++
++static unsigned int
++arducam_64mp_get_frame_length(const struct arducam_64mp_mode *mode,
++			      const struct v4l2_fract *timeperframe)
++{
++	u64 frame_length;
++
++	frame_length = (u64)timeperframe->numerator * ARDUCAM_64MP_PIXEL_RATE;
++	do_div(frame_length,
++	       (u64)timeperframe->denominator * mode->line_length_pix);
++
++	if (WARN_ON(frame_length > ARDUCAM_64MP_FRAME_LENGTH_MAX))
++		frame_length = ARDUCAM_64MP_FRAME_LENGTH_MAX;
++
++	return max_t(unsigned int, frame_length, mode->height);
++}
++
++static void arducam_64mp_set_framing_limits(struct arducam_64mp *arducam_64mp)
++{
++	unsigned int frm_length_min, frm_length_default, hblank;
++	const struct arducam_64mp_mode *mode = arducam_64mp->mode;
++
++	/* The default framerate is highest possible framerate. */
++	frm_length_min =
++		arducam_64mp_get_frame_length(mode,
++					      &mode->timeperframe_default);
++	frm_length_default =
++		arducam_64mp_get_frame_length(mode,
++					      &mode->timeperframe_default);
++
++	/* Default to no long exposure multiplier. */
++	arducam_64mp->long_exp_shift = 0;
++
++	/* Update limits and set FPS to default */
++	__v4l2_ctrl_modify_range(arducam_64mp->vblank,
++				 frm_length_min - mode->height,
++				 ((1 << ARDUCAM_64MP_LONG_EXP_SHIFT_MAX) *
++				  ARDUCAM_64MP_FRAME_LENGTH_MAX) - mode->height,
++				 1, frm_length_default - mode->height);
++
++	/* Setting this will adjust the exposure limits as well. */
++	__v4l2_ctrl_s_ctrl(arducam_64mp->vblank,
++			   frm_length_default - mode->height);
++
++	/*
++	 * Currently PPL is fixed to the mode specified value, so hblank
++	 * depends on mode->width only, and is not changeable in any
++	 * way other than changing the mode.
++	 */
++	hblank = mode->line_length_pix - mode->width;
++	__v4l2_ctrl_modify_range(arducam_64mp->hblank, hblank, hblank, 1,
++				 hblank);
++}
++
++static int arducam_64mp_set_pad_format(struct v4l2_subdev *sd,
++				       struct v4l2_subdev_state *sd_state,
++				       struct v4l2_subdev_format *fmt)
++{
++	struct v4l2_mbus_framefmt *framefmt;
++	const struct arducam_64mp_mode *mode;
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++
++	if (fmt->pad != 0)
++		return -EINVAL;
++
++	mutex_lock(&arducam_64mp->mutex);
++
++	/* Bayer order varies with flips */
++	fmt->format.code = arducam_64mp_get_format_code(arducam_64mp);
++
++	mode = v4l2_find_nearest_size(supported_modes,
++				      ARRAY_SIZE(supported_modes),
++				      width, height,
++				      fmt->format.width,
++				      fmt->format.height);
++	arducam_64mp_update_image_pad_format(arducam_64mp, mode, fmt);
++	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++		framefmt = v4l2_subdev_get_try_format(sd, sd_state,
++							fmt->pad);
++		*framefmt = fmt->format;
++	} else {
++		arducam_64mp->mode = mode;
++		arducam_64mp->fmt_code = fmt->format.code;
++		arducam_64mp_set_framing_limits(arducam_64mp);
++	}
++
++	mutex_unlock(&arducam_64mp->mutex);
++
++	return 0;
++}
++
++static const struct v4l2_rect *
++__arducam_64mp_get_pad_crop(struct arducam_64mp *arducam_64mp,
++			    struct v4l2_subdev_state *sd_state,
++			    unsigned int pad,
++			    enum v4l2_subdev_format_whence which)
++{
++	switch (which) {
++	case V4L2_SUBDEV_FORMAT_TRY:
++		return v4l2_subdev_get_try_crop(&arducam_64mp->sd, sd_state,
++						pad);
++	case V4L2_SUBDEV_FORMAT_ACTIVE:
++		return &arducam_64mp->mode->crop;
++	}
++
++	return NULL;
++}
++
++static int arducam_64mp_get_selection(struct v4l2_subdev *sd,
++				      struct v4l2_subdev_state *sd_state,
++				      struct v4l2_subdev_selection *sel)
++{
++	switch (sel->target) {
++	case V4L2_SEL_TGT_CROP: {
++		struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++
++		mutex_lock(&arducam_64mp->mutex);
++		sel->r = *__arducam_64mp_get_pad_crop(arducam_64mp, sd_state,
++						      sel->pad, sel->which);
++		mutex_unlock(&arducam_64mp->mutex);
++
++		return 0;
++	}
++
++	case V4L2_SEL_TGT_NATIVE_SIZE:
++		sel->r.left = 0;
++		sel->r.top = 0;
++		sel->r.width = ARDUCAM_64MP_NATIVE_WIDTH;
++		sel->r.height = ARDUCAM_64MP_NATIVE_HEIGHT;
++
++		return 0;
++
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++	case V4L2_SEL_TGT_CROP_BOUNDS:
++		sel->r.left = ARDUCAM_64MP_PIXEL_ARRAY_LEFT;
++		sel->r.top = ARDUCAM_64MP_PIXEL_ARRAY_TOP;
++		sel->r.width = ARDUCAM_64MP_PIXEL_ARRAY_WIDTH;
++		sel->r.height = ARDUCAM_64MP_PIXEL_ARRAY_HEIGHT;
++
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++/* Start streaming */
++static int arducam_64mp_start_streaming(struct arducam_64mp *arducam_64mp)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&arducam_64mp->sd);
++	const struct arducam_64mp_reg_list *reg_list;
++	int ret;
++
++	if (!arducam_64mp->common_regs_written) {
++		ret = arducam_64mp_write_regs(arducam_64mp, mode_common_regs,
++					      ARRAY_SIZE(mode_common_regs));
++
++		if (ret) {
++			dev_err(&client->dev, "%s failed to set common settings\n",
++				__func__);
++			return ret;
++		}
++		arducam_64mp->common_regs_written = true;
++	}
++
++	/* Apply default values of current mode */
++	reg_list = &arducam_64mp->mode->reg_list;
++	ret = arducam_64mp_write_regs(arducam_64mp, reg_list->regs,
++				      reg_list->num_of_regs);
++	if (ret) {
++		dev_err(&client->dev, "%s failed to set mode\n", __func__);
++		return ret;
++	}
++
++	/* Apply customized values from user */
++	ret =  __v4l2_ctrl_handler_setup(arducam_64mp->sd.ctrl_handler);
++	if (ret)
++		return ret;
++
++	/* set stream on register */
++	return arducam_64mp_write_reg(arducam_64mp,
++				      ARDUCAM_64MP_REG_MODE_SELECT,
++				      ARDUCAM_64MP_REG_VALUE_08BIT,
++				      ARDUCAM_64MP_MODE_STREAMING);
++}
++
++/* Stop streaming */
++static void arducam_64mp_stop_streaming(struct arducam_64mp *arducam_64mp)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&arducam_64mp->sd);
++	int ret;
++
++	/* set stream off register */
++	ret = arducam_64mp_write_reg(arducam_64mp, ARDUCAM_64MP_REG_MODE_SELECT,
++				     ARDUCAM_64MP_REG_VALUE_08BIT,
++				     ARDUCAM_64MP_MODE_STANDBY);
++	if (ret)
++		dev_err(&client->dev, "%s failed to set stream\n", __func__);
++}
++
++static int arducam_64mp_set_stream(struct v4l2_subdev *sd, int enable)
++{
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	int ret = 0;
++
++	mutex_lock(&arducam_64mp->mutex);
++	if (arducam_64mp->streaming == enable) {
++		mutex_unlock(&arducam_64mp->mutex);
++		return 0;
++	}
++
++	if (enable) {
++		ret = pm_runtime_get_sync(&client->dev);
++		if (ret < 0) {
++			pm_runtime_put_noidle(&client->dev);
++			goto err_unlock;
++		}
++
++		/*
++		 * Apply default & customized values
++		 * and then start streaming.
++		 */
++		ret = arducam_64mp_start_streaming(arducam_64mp);
++		if (ret)
++			goto err_rpm_put;
++	} else {
++		arducam_64mp_stop_streaming(arducam_64mp);
++		pm_runtime_put(&client->dev);
++	}
++
++	arducam_64mp->streaming = enable;
++
++	/* vflip and hflip cannot change during streaming */
++	__v4l2_ctrl_grab(arducam_64mp->vflip, enable);
++	__v4l2_ctrl_grab(arducam_64mp->hflip, enable);
++
++	mutex_unlock(&arducam_64mp->mutex);
++
++	return ret;
++
++err_rpm_put:
++	pm_runtime_put(&client->dev);
++err_unlock:
++	mutex_unlock(&arducam_64mp->mutex);
++
++	return ret;
++}
++
++/* Power/clock management functions */
++static int arducam_64mp_power_on(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++	int ret;
++
++	ret = regulator_bulk_enable(ARDUCAM_64MP_NUM_SUPPLIES,
++				    arducam_64mp->supplies);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to enable regulators\n",
++			__func__);
++		return ret;
++	}
++
++	ret = clk_prepare_enable(arducam_64mp->xclk);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to enable clock\n",
++			__func__);
++		goto reg_off;
++	}
++
++	gpiod_set_value_cansleep(arducam_64mp->reset_gpio, 1);
++	usleep_range(ARDUCAM_64MP_XCLR_MIN_DELAY_US,
++		     ARDUCAM_64MP_XCLR_MIN_DELAY_US +
++					ARDUCAM_64MP_XCLR_DELAY_RANGE_US);
++
++	return 0;
++
++reg_off:
++	regulator_bulk_disable(ARDUCAM_64MP_NUM_SUPPLIES,
++			       arducam_64mp->supplies);
++	return ret;
++}
++
++static int arducam_64mp_power_off(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++
++	gpiod_set_value_cansleep(arducam_64mp->reset_gpio, 0);
++	regulator_bulk_disable(ARDUCAM_64MP_NUM_SUPPLIES,
++			       arducam_64mp->supplies);
++	clk_disable_unprepare(arducam_64mp->xclk);
++
++	/* Force reprogramming of the common registers when powered up again. */
++	arducam_64mp->common_regs_written = false;
++
++	return 0;
++}
++
++static int __maybe_unused arducam_64mp_suspend(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++
++	if (arducam_64mp->streaming)
++		arducam_64mp_stop_streaming(arducam_64mp);
++
++	return 0;
++}
++
++static int __maybe_unused arducam_64mp_resume(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++	int ret;
++
++	if (arducam_64mp->streaming) {
++		ret = arducam_64mp_start_streaming(arducam_64mp);
++		if (ret)
++			goto error;
++	}
++
++	return 0;
++
++error:
++	arducam_64mp_stop_streaming(arducam_64mp);
++	arducam_64mp->streaming = 0;
++	return ret;
++}
++
++static int arducam_64mp_get_regulators(struct arducam_64mp *arducam_64mp)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&arducam_64mp->sd);
++	unsigned int i;
++
++	for (i = 0; i < ARDUCAM_64MP_NUM_SUPPLIES; i++)
++		arducam_64mp->supplies[i].supply = arducam_64mp_supply_name[i];
++
++	return devm_regulator_bulk_get(&client->dev,
++				       ARDUCAM_64MP_NUM_SUPPLIES,
++				       arducam_64mp->supplies);
++}
++
++/* Verify chip ID */
++static int arducam_64mp_identify_module(struct arducam_64mp *arducam_64mp)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&arducam_64mp->sd);
++	struct i2c_client *arducam_identifier;
++	int ret;
++	u32 val;
++
++	arducam_identifier = i2c_new_dummy_device(client->adapter, 0x50);
++	if (IS_ERR(arducam_identifier)) {
++		dev_err(&client->dev, "failed to create arducam_identifier\n");
++		return PTR_ERR(arducam_identifier);
++	}
++
++	ret = arducam_64mp_read_reg(arducam_identifier,
++				    ARDUCAM_64MP_REG_CHIP_ID,
++				    ARDUCAM_64MP_REG_VALUE_16BIT, &val);
++	if (ret) {
++		dev_err(&client->dev, "failed to read chip id %x, with error %d\n",
++			ARDUCAM_64MP_CHIP_ID, ret);
++		goto error;
++	}
++
++	if (val != ARDUCAM_64MP_CHIP_ID) {
++		dev_err(&client->dev, "chip id mismatch: %x!=%x\n",
++			ARDUCAM_64MP_CHIP_ID, val);
++		ret = -EIO;
++		goto error;
++	}
++
++	dev_info(&client->dev, "Device found Arducam 64MP.\n");
++
++error:
++	i2c_unregister_device(arducam_identifier);
++
++	return ret;
++}
++
++static const struct v4l2_subdev_core_ops arducam_64mp_core_ops = {
++	.subscribe_event = v4l2_ctrl_subdev_subscribe_event,
++	.unsubscribe_event = v4l2_event_subdev_unsubscribe,
++};
++
++static const struct v4l2_subdev_video_ops arducam_64mp_video_ops = {
++	.s_stream = arducam_64mp_set_stream,
++};
++
++static const struct v4l2_subdev_pad_ops arducam_64mp_pad_ops = {
++	.enum_mbus_code = arducam_64mp_enum_mbus_code,
++	.get_fmt = arducam_64mp_get_pad_format,
++	.set_fmt = arducam_64mp_set_pad_format,
++	.get_selection = arducam_64mp_get_selection,
++	.enum_frame_size = arducam_64mp_enum_frame_size,
++};
++
++static const struct v4l2_subdev_ops arducam_64mp_subdev_ops = {
++	.core = &arducam_64mp_core_ops,
++	.video = &arducam_64mp_video_ops,
++	.pad = &arducam_64mp_pad_ops,
++};
++
++static const struct v4l2_subdev_internal_ops arducam_64mp_internal_ops = {
++	.open = arducam_64mp_open,
++};
++
++/* Initialize control handlers */
++static int arducam_64mp_init_controls(struct arducam_64mp *arducam_64mp)
++{
++	struct v4l2_ctrl_handler *ctrl_hdlr;
++	struct i2c_client *client = v4l2_get_subdevdata(&arducam_64mp->sd);
++	struct v4l2_fwnode_device_properties props;
++	unsigned int i;
++	int ret;
++	u8 test_pattern_max;
++
++	ctrl_hdlr = &arducam_64mp->ctrl_handler;
++	ret = v4l2_ctrl_handler_init(ctrl_hdlr, 16);
++	if (ret)
++		return ret;
++
++	mutex_init(&arducam_64mp->mutex);
++	ctrl_hdlr->lock = &arducam_64mp->mutex;
++
++	/* By default, PIXEL_RATE is read only */
++	arducam_64mp->pixel_rate = v4l2_ctrl_new_std(ctrl_hdlr,
++						     &arducam_64mp_ctrl_ops,
++						     V4L2_CID_PIXEL_RATE,
++						     ARDUCAM_64MP_PIXEL_RATE,
++						     ARDUCAM_64MP_PIXEL_RATE, 1,
++						     ARDUCAM_64MP_PIXEL_RATE);
++
++	/*
++	 * Create the controls here, but mode specific limits are setup
++	 * in the arducam_64mp_set_framing_limits() call below.
++	 */
++	arducam_64mp->vblank = v4l2_ctrl_new_std(ctrl_hdlr,
++						 &arducam_64mp_ctrl_ops,
++						 V4L2_CID_VBLANK,
++						 0, 0xffff, 1, 0);
++	arducam_64mp->hblank = v4l2_ctrl_new_std(ctrl_hdlr,
++						 &arducam_64mp_ctrl_ops,
++						 V4L2_CID_HBLANK,
++						 0, 0xffff, 1, 0);
++
++	/* HBLANK is read-only, but does change with mode. */
++	if (arducam_64mp->hblank)
++		arducam_64mp->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	arducam_64mp->exposure =
++		v4l2_ctrl_new_std(ctrl_hdlr,
++				  &arducam_64mp_ctrl_ops,
++				  V4L2_CID_EXPOSURE,
++				  ARDUCAM_64MP_EXPOSURE_MIN,
++				  ARDUCAM_64MP_EXPOSURE_MAX,
++				  ARDUCAM_64MP_EXPOSURE_STEP,
++				  ARDUCAM_64MP_EXPOSURE_DEFAULT);
++
++	v4l2_ctrl_new_std(ctrl_hdlr, &arducam_64mp_ctrl_ops,
++			  V4L2_CID_ANALOGUE_GAIN, ARDUCAM_64MP_ANA_GAIN_MIN,
++			  ARDUCAM_64MP_ANA_GAIN_MAX, ARDUCAM_64MP_ANA_GAIN_STEP,
++			  ARDUCAM_64MP_ANA_GAIN_DEFAULT);
++
++	v4l2_ctrl_new_std(ctrl_hdlr, &arducam_64mp_ctrl_ops,
++			  V4L2_CID_DIGITAL_GAIN, ARDUCAM_64MP_DGTL_GAIN_MIN,
++			  ARDUCAM_64MP_DGTL_GAIN_MAX,
++			  ARDUCAM_64MP_DGTL_GAIN_STEP,
++			  ARDUCAM_64MP_DGTL_GAIN_DEFAULT);
++
++	arducam_64mp->hflip = v4l2_ctrl_new_std(ctrl_hdlr,
++						&arducam_64mp_ctrl_ops,
++						V4L2_CID_HFLIP, 0, 1, 1, 0);
++	if (arducam_64mp->hflip)
++		arducam_64mp->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
++	arducam_64mp->vflip = v4l2_ctrl_new_std(ctrl_hdlr,
++						&arducam_64mp_ctrl_ops,
++						V4L2_CID_VFLIP, 0, 1, 1, 0);
++	if (arducam_64mp->vflip)
++		arducam_64mp->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
++	test_pattern_max = ARRAY_SIZE(arducam_64mp_test_pattern_menu) - 1;
++	v4l2_ctrl_new_std_menu_items(ctrl_hdlr, &arducam_64mp_ctrl_ops,
++				     V4L2_CID_TEST_PATTERN,
++				     test_pattern_max,
++				     0, 0, arducam_64mp_test_pattern_menu);
++	for (i = 0; i < 4; i++) {
++		/*
++		 * The assumption is that
++		 * V4L2_CID_TEST_PATTERN_GREENR == V4L2_CID_TEST_PATTERN_RED + 1
++		 * V4L2_CID_TEST_PATTERN_BLUE   == V4L2_CID_TEST_PATTERN_RED + 2
++		 * V4L2_CID_TEST_PATTERN_GREENB == V4L2_CID_TEST_PATTERN_RED + 3
++		 */
++		v4l2_ctrl_new_std(ctrl_hdlr, &arducam_64mp_ctrl_ops,
++				  V4L2_CID_TEST_PATTERN_RED + i,
++				  ARDUCAM_64MP_TEST_PATTERN_COLOUR_MIN,
++				  ARDUCAM_64MP_TEST_PATTERN_COLOUR_MAX,
++				  ARDUCAM_64MP_TEST_PATTERN_COLOUR_STEP,
++				  ARDUCAM_64MP_TEST_PATTERN_COLOUR_MAX);
++		/* The "Solid color" pattern is white by default */
++	}
++
++	if (ctrl_hdlr->error) {
++		ret = ctrl_hdlr->error;
++		dev_err(&client->dev, "%s control init failed (%d)\n",
++			__func__, ret);
++		goto error;
++	}
++
++	ret = v4l2_fwnode_device_parse(&client->dev, &props);
++	if (ret)
++		goto error;
++
++	ret = v4l2_ctrl_new_fwnode_properties(ctrl_hdlr, &arducam_64mp_ctrl_ops,
++					      &props);
++	if (ret)
++		goto error;
++
++	arducam_64mp->sd.ctrl_handler = ctrl_hdlr;
++
++	/* Setup exposure and frame/line length limits. */
++	arducam_64mp_set_framing_limits(arducam_64mp);
++
++	return 0;
++
++error:
++	v4l2_ctrl_handler_free(ctrl_hdlr);
++	mutex_destroy(&arducam_64mp->mutex);
++
++	return ret;
++}
++
++static void arducam_64mp_free_controls(struct arducam_64mp *arducam_64mp)
++{
++	v4l2_ctrl_handler_free(arducam_64mp->sd.ctrl_handler);
++	mutex_destroy(&arducam_64mp->mutex);
++}
++
++static int arducam_64mp_check_hwcfg(struct device *dev)
++{
++	struct fwnode_handle *endpoint;
++	struct v4l2_fwnode_endpoint ep_cfg = {
++		.bus_type = V4L2_MBUS_CSI2_DPHY
++	};
++	int ret = -EINVAL;
++
++	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
++	if (!endpoint) {
++		dev_err(dev, "endpoint node not found\n");
++		return -EINVAL;
++	}
++
++	if (v4l2_fwnode_endpoint_alloc_parse(endpoint, &ep_cfg)) {
++		dev_err(dev, "could not parse endpoint\n");
++		goto error_out;
++	}
++
++	/* Check the number of MIPI CSI2 data lanes */
++	if (ep_cfg.bus.mipi_csi2.num_data_lanes != 2) {
++		dev_err(dev, "only 2 data lanes are currently supported\n");
++		goto error_out;
++	}
++
++	/* Check the link frequency set in device tree */
++	if (!ep_cfg.nr_of_link_frequencies) {
++		dev_err(dev, "link-frequency property not found in DT\n");
++		goto error_out;
++	}
++
++	if (ep_cfg.nr_of_link_frequencies != 1 ||
++	    ep_cfg.link_frequencies[0] != ARDUCAM_64MP_DEFAULT_LINK_FREQ) {
++		dev_err(dev, "Link frequency not supported: %lld\n",
++			ep_cfg.link_frequencies[0]);
++		goto error_out;
++	}
++
++	ret = 0;
++
++error_out:
++	v4l2_fwnode_endpoint_free(&ep_cfg);
++	fwnode_handle_put(endpoint);
++
++	return ret;
++}
++
++static const struct of_device_id arducam_64mp_dt_ids[] = {
++	{ .compatible = "arducam,64mp"},
++	{ /* sentinel */ }
++};
++
++static int arducam_64mp_probe(struct i2c_client *client)
++{
++	struct device *dev = &client->dev;
++	struct arducam_64mp *arducam_64mp;
++	const struct of_device_id *match;
++	u32 xclk_freq;
++	int ret;
++
++	arducam_64mp = devm_kzalloc(&client->dev, sizeof(*arducam_64mp),
++				    GFP_KERNEL);
++	if (!arducam_64mp)
++		return -ENOMEM;
++
++	v4l2_i2c_subdev_init(&arducam_64mp->sd, client,
++			     &arducam_64mp_subdev_ops);
++
++	match = of_match_device(arducam_64mp_dt_ids, dev);
++	if (!match)
++		return -ENODEV;
++
++	/* Check the hardware configuration in device tree */
++	if (arducam_64mp_check_hwcfg(dev))
++		return -EINVAL;
++
++	/* Get system clock (xclk) */
++	arducam_64mp->xclk = devm_clk_get(dev, NULL);
++	if (IS_ERR(arducam_64mp->xclk)) {
++		dev_err(dev, "failed to get xclk\n");
++		return PTR_ERR(arducam_64mp->xclk);
++	}
++
++	xclk_freq = clk_get_rate(arducam_64mp->xclk);
++	if (xclk_freq != ARDUCAM_64MP_XCLK_FREQ) {
++		dev_err(dev, "xclk frequency not supported: %d Hz\n",
++			xclk_freq);
++		return -EINVAL;
++	}
++
++	ret = arducam_64mp_get_regulators(arducam_64mp);
++	if (ret) {
++		dev_err(dev, "failed to get regulators\n");
++		return ret;
++	}
++
++	/* Request optional enable pin */
++	arducam_64mp->reset_gpio = devm_gpiod_get_optional(dev, "reset",
++							   GPIOD_OUT_HIGH);
++
++	/*
++	 * The sensor must be powered for arducam_64mp_identify_module()
++	 * to be able to read the CHIP_ID from arducam_identifier.
++	 */
++	ret = arducam_64mp_power_on(dev);
++	if (ret)
++		return ret;
++
++	ret = arducam_64mp_identify_module(arducam_64mp);
++	if (ret)
++		goto error_power_off;
++
++	/* Set default mode to max resolution */
++	arducam_64mp->mode = &supported_modes[0];
++	arducam_64mp->fmt_code = MEDIA_BUS_FMT_SRGGB10_1X10;
++
++	/* Enable runtime PM and turn off the device */
++	pm_runtime_set_active(dev);
++	pm_runtime_enable(dev);
++	pm_runtime_idle(dev);
++
++	/* This needs the pm runtime to be registered. */
++	ret = arducam_64mp_init_controls(arducam_64mp);
++	if (ret)
++		goto error_power_off;
++
++	/* Initialize subdev */
++	arducam_64mp->sd.internal_ops = &arducam_64mp_internal_ops;
++	arducam_64mp->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE |
++			    V4L2_SUBDEV_FL_HAS_EVENTS;
++	arducam_64mp->sd.entity.function = MEDIA_ENT_F_CAM_SENSOR;
++
++	/* Initialize source pads */
++	arducam_64mp->pad.flags = MEDIA_PAD_FL_SOURCE;
++
++	ret = media_entity_pads_init(&arducam_64mp->sd.entity, 1,
++				     &arducam_64mp->pad);
++	if (ret) {
++		dev_err(dev, "failed to init entity pads: %d\n", ret);
++		goto error_handler_free;
++	}
++
++	ret = v4l2_async_register_subdev_sensor(&arducam_64mp->sd);
++	if (ret < 0) {
++		dev_err(dev, "failed to register sensor sub-device: %d\n", ret);
++		goto error_media_entity;
++	}
++
++	return 0;
++
++error_media_entity:
++	media_entity_cleanup(&arducam_64mp->sd.entity);
++
++error_handler_free:
++	arducam_64mp_free_controls(arducam_64mp);
++
++error_power_off:
++	pm_runtime_disable(&client->dev);
++	pm_runtime_set_suspended(&client->dev);
++	arducam_64mp_power_off(&client->dev);
++
++	return ret;
++}
++
++static void arducam_64mp_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++
++	v4l2_async_unregister_subdev(sd);
++	media_entity_cleanup(&sd->entity);
++	arducam_64mp_free_controls(arducam_64mp);
++
++	pm_runtime_disable(&client->dev);
++	if (!pm_runtime_status_suspended(&client->dev))
++		arducam_64mp_power_off(&client->dev);
++	pm_runtime_set_suspended(&client->dev);
++}
++
++MODULE_DEVICE_TABLE(of, arducam_64mp_dt_ids);
++
++static const struct dev_pm_ops arducam_64mp_pm_ops = {
++	SET_SYSTEM_SLEEP_PM_OPS(arducam_64mp_suspend, arducam_64mp_resume)
++	SET_RUNTIME_PM_OPS(arducam_64mp_power_off, arducam_64mp_power_on, NULL)
++};
++
++static struct i2c_driver arducam_64mp_i2c_driver = {
++	.driver = {
++		.name = "arducam_64mp",
++		.of_match_table	= arducam_64mp_dt_ids,
++		.pm = &arducam_64mp_pm_ops,
++	},
++	.probe_new = arducam_64mp_probe,
++	.remove = arducam_64mp_remove,
++};
++
++module_i2c_driver(arducam_64mp_i2c_driver);
++
++MODULE_AUTHOR("Lee Jackson <info@arducam.com>");
++MODULE_DESCRIPTION("Arducam 64MP sensor driver");
++MODULE_LICENSE("GPL v2");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0425-media-i2c-arducam_64mp-Advertise-embedded-data-node-.patch b/target/linux/bcm27xx/patches-6.1/950-0425-media-i2c-arducam_64mp-Advertise-embedded-data-node-.patch
new file mode 100644
index 00000000000000..f1310f2b7768fc
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0425-media-i2c-arducam_64mp-Advertise-embedded-data-node-.patch
@@ -0,0 +1,256 @@
+From 8acf47ea3641126ed10ec54a8f6d72622dd2c61e Mon Sep 17 00:00:00 2001
+From: Lee Jackson <info@arducam.com>
+Date: Wed, 18 May 2022 15:18:59 +0800
+Subject: [PATCH] media: i2c: arducam_64mp: Advertise embedded data
+ node on media pad 1
+
+This commit updates the arducam_64mp driver to adverise support for
+embedded data streams.
+
+The arducam_64mp sensor subdevice overloads the media pad to differentiate
+between image stream (pad 0) and embedded data stream (pad 1) when
+performing the v4l2_subdev_pad_ops functions.
+
+Signed-off-by: Lee Jackson <info@arducam.com>
+---
+ drivers/media/i2c/arducam_64mp.c | 146 ++++++++++++++++++++++---------
+ 1 file changed, 107 insertions(+), 39 deletions(-)
+
+--- a/drivers/media/i2c/arducam_64mp.c
++++ b/drivers/media/i2c/arducam_64mp.c
+@@ -94,6 +94,16 @@
+ #define ARDUCAM_64MP_TEST_PATTERN_B_DEFAULT	0
+ #define ARDUCAM_64MP_TEST_PATTERN_GB_DEFAULT	0
+ 
++/* Embedded metadata stream structure */
++#define ARDUCAM_64MP_EMBEDDED_LINE_WIDTH 16384
++#define ARDUCAM_64MP_NUM_EMBEDDED_LINES 1
++
++enum pad_types {
++	IMAGE_PAD,
++	METADATA_PAD,
++	NUM_PADS
++};
++
+ /* ARDUCAM_64MP native and active pixel array size. */
+ #define ARDUCAM_64MP_NATIVE_WIDTH		9344U
+ #define ARDUCAM_64MP_NATIVE_HEIGHT		7032U
+@@ -1273,7 +1283,7 @@ static const char * const arducam_64mp_s
+ 
+ struct arducam_64mp {
+ 	struct v4l2_subdev sd;
+-	struct media_pad pad;
++	struct media_pad pad[NUM_PADS];
+ 
+ 	unsigned int fmt_code;
+ 
+@@ -1406,7 +1416,9 @@ static int arducam_64mp_open(struct v4l2
+ {
+ 	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
+ 	struct v4l2_mbus_framefmt *try_fmt_img =
+-		v4l2_subdev_get_try_format(sd, fh->state, 0);
++		v4l2_subdev_get_try_format(sd, fh->state, IMAGE_PAD);
++	struct v4l2_mbus_framefmt *try_fmt_meta =
++		v4l2_subdev_get_try_format(sd, fh->state, METADATA_PAD);
+ 	struct v4l2_rect *try_crop;
+ 
+ 	mutex_lock(&arducam_64mp->mutex);
+@@ -1417,8 +1429,14 @@ static int arducam_64mp_open(struct v4l2
+ 	try_fmt_img->code = arducam_64mp_get_format_code(arducam_64mp);
+ 	try_fmt_img->field = V4L2_FIELD_NONE;
+ 
++	/* Initialize try_fmt for the embedded metadata pad */
++	try_fmt_meta->width = ARDUCAM_64MP_EMBEDDED_LINE_WIDTH;
++	try_fmt_meta->height = ARDUCAM_64MP_NUM_EMBEDDED_LINES;
++	try_fmt_meta->code = MEDIA_BUS_FMT_SENSOR_DATA;
++	try_fmt_meta->field = V4L2_FIELD_NONE;
++
+ 	/* Initialize try_crop */
+-	try_crop = v4l2_subdev_get_try_crop(sd, fh->state, 0);
++	try_crop = v4l2_subdev_get_try_crop(sd, fh->state, IMAGE_PAD);
+ 	try_crop->left = ARDUCAM_64MP_PIXEL_ARRAY_LEFT;
+ 	try_crop->top = ARDUCAM_64MP_PIXEL_ARRAY_TOP;
+ 	try_crop->width = ARDUCAM_64MP_PIXEL_ARRAY_WIDTH;
+@@ -1574,10 +1592,20 @@ static int arducam_64mp_enum_mbus_code(s
+ {
+ 	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
+ 
+-	if (code->index > 0)
++	if (code->pad >= NUM_PADS)
+ 		return -EINVAL;
+ 
+-	code->code = arducam_64mp_get_format_code(arducam_64mp);
++	if (code->pad == IMAGE_PAD) {
++		if (code->index > 0)
++			return -EINVAL;
++
++		code->code = arducam_64mp_get_format_code(arducam_64mp);
++	} else {
++		if (code->index > 0)
++			return -EINVAL;
++
++		code->code = MEDIA_BUS_FMT_SENSOR_DATA;
++	}
+ 
+ 	return 0;
+ }
+@@ -1588,16 +1616,29 @@ static int arducam_64mp_enum_frame_size(
+ {
+ 	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
+ 
+-	if (fse->index >= ARRAY_SIZE(supported_modes))
++	if (fse->pad >= NUM_PADS)
+ 		return -EINVAL;
+ 
+-	if (fse->code != arducam_64mp_get_format_code(arducam_64mp))
+-		return -EINVAL;
++	if (fse->pad == IMAGE_PAD) {
++		if (fse->index >= ARRAY_SIZE(supported_modes))
++			return -EINVAL;
++
++		if (fse->code != arducam_64mp_get_format_code(arducam_64mp))
++			return -EINVAL;
++
++		fse->min_width = supported_modes[fse->index].width;
++		fse->max_width = fse->min_width;
++		fse->min_height = supported_modes[fse->index].height;
++		fse->max_height = fse->min_height;
++	} else {
++		if (fse->code != MEDIA_BUS_FMT_SENSOR_DATA || fse->index > 0)
++			return -EINVAL;
+ 
+-	fse->min_width = supported_modes[fse->index].width;
+-	fse->max_width = fse->min_width;
+-	fse->min_height = supported_modes[fse->index].height;
+-	fse->max_height = fse->min_height;
++		fse->min_width = ARDUCAM_64MP_EMBEDDED_LINE_WIDTH;
++		fse->max_width = fse->min_width;
++		fse->min_height = ARDUCAM_64MP_NUM_EMBEDDED_LINES;
++		fse->max_height = fse->min_height;
++	}
+ 
+ 	return 0;
+ }
+@@ -1623,13 +1664,22 @@ arducam_64mp_update_image_pad_format(str
+ 	arducam_64mp_reset_colorspace(&fmt->format);
+ }
+ 
++static void
++arducam_64mp_update_metadata_pad_format(struct v4l2_subdev_format *fmt)
++{
++	fmt->format.width = ARDUCAM_64MP_EMBEDDED_LINE_WIDTH;
++	fmt->format.height = ARDUCAM_64MP_NUM_EMBEDDED_LINES;
++	fmt->format.code = MEDIA_BUS_FMT_SENSOR_DATA;
++	fmt->format.field = V4L2_FIELD_NONE;
++}
++
+ static int arducam_64mp_get_pad_format(struct v4l2_subdev *sd,
+ 				       struct v4l2_subdev_state *sd_state,
+ 				       struct v4l2_subdev_format *fmt)
+ {
+ 	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
+ 
+-	if (fmt->pad != 0)
++	if (fmt->pad >= NUM_PADS)
+ 		return -EINVAL;
+ 
+ 	mutex_lock(&arducam_64mp->mutex);
+@@ -1639,14 +1689,20 @@ static int arducam_64mp_get_pad_format(s
+ 			v4l2_subdev_get_try_format(&arducam_64mp->sd, sd_state,
+ 						   fmt->pad);
+ 		/* update the code which could change due to vflip or hflip: */
+-		try_fmt->code = arducam_64mp_get_format_code(arducam_64mp);
++		try_fmt->code = fmt->pad == IMAGE_PAD ?
++				arducam_64mp_get_format_code(arducam_64mp) :
++				MEDIA_BUS_FMT_SENSOR_DATA;
+ 		fmt->format = *try_fmt;
+ 	} else {
+-		arducam_64mp_update_image_pad_format(arducam_64mp,
+-						     arducam_64mp->mode,
+-						     fmt);
+-		fmt->format.code =
+-			arducam_64mp_get_format_code(arducam_64mp);
++		if (fmt->pad == IMAGE_PAD) {
++			arducam_64mp_update_image_pad_format(arducam_64mp,
++							     arducam_64mp->mode,
++							     fmt);
++			fmt->format.code =
++			       arducam_64mp_get_format_code(arducam_64mp);
++		} else {
++			arducam_64mp_update_metadata_pad_format(fmt);
++		}
+ 	}
+ 
+ 	mutex_unlock(&arducam_64mp->mutex);
+@@ -1714,28 +1770,39 @@ static int arducam_64mp_set_pad_format(s
+ 	const struct arducam_64mp_mode *mode;
+ 	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
+ 
+-	if (fmt->pad != 0)
++	if (fmt->pad >= NUM_PADS)
+ 		return -EINVAL;
+ 
+ 	mutex_lock(&arducam_64mp->mutex);
+ 
+-	/* Bayer order varies with flips */
+-	fmt->format.code = arducam_64mp_get_format_code(arducam_64mp);
+-
+-	mode = v4l2_find_nearest_size(supported_modes,
+-				      ARRAY_SIZE(supported_modes),
+-				      width, height,
+-				      fmt->format.width,
+-				      fmt->format.height);
+-	arducam_64mp_update_image_pad_format(arducam_64mp, mode, fmt);
+-	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
+-		framefmt = v4l2_subdev_get_try_format(sd, sd_state,
+-							fmt->pad);
+-		*framefmt = fmt->format;
++	if (fmt->pad == IMAGE_PAD) {
++		/* Bayer order varies with flips */
++		fmt->format.code = arducam_64mp_get_format_code(arducam_64mp);
++
++		mode = v4l2_find_nearest_size(supported_modes,
++					      ARRAY_SIZE(supported_modes),
++					      width, height,
++					      fmt->format.width,
++					      fmt->format.height);
++		arducam_64mp_update_image_pad_format(arducam_64mp, mode, fmt);
++		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++			framefmt = v4l2_subdev_get_try_format(sd, sd_state,
++							      fmt->pad);
++			*framefmt = fmt->format;
++		} else {
++			arducam_64mp->mode = mode;
++			arducam_64mp->fmt_code = fmt->format.code;
++			arducam_64mp_set_framing_limits(arducam_64mp);
++		}
+ 	} else {
+-		arducam_64mp->mode = mode;
+-		arducam_64mp->fmt_code = fmt->format.code;
+-		arducam_64mp_set_framing_limits(arducam_64mp);
++		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++			framefmt = v4l2_subdev_get_try_format(sd, sd_state,
++							      fmt->pad);
++			*framefmt = fmt->format;
++		} else {
++			/* Only one embedded data mode is supported */
++			arducam_64mp_update_metadata_pad_format(fmt);
++		}
+ 	}
+ 
+ 	mutex_unlock(&arducam_64mp->mutex);
+@@ -2329,10 +2396,11 @@ static int arducam_64mp_probe(struct i2c
+ 	arducam_64mp->sd.entity.function = MEDIA_ENT_F_CAM_SENSOR;
+ 
+ 	/* Initialize source pads */
+-	arducam_64mp->pad.flags = MEDIA_PAD_FL_SOURCE;
++	arducam_64mp->pad[IMAGE_PAD].flags = MEDIA_PAD_FL_SOURCE;
++	arducam_64mp->pad[METADATA_PAD].flags = MEDIA_PAD_FL_SOURCE;
+ 
+-	ret = media_entity_pads_init(&arducam_64mp->sd.entity, 1,
+-				     &arducam_64mp->pad);
++	ret = media_entity_pads_init(&arducam_64mp->sd.entity, NUM_PADS,
++				     arducam_64mp->pad);
+ 	if (ret) {
+ 		dev_err(dev, "failed to init entity pads: %d\n", ret);
+ 		goto error_handler_free;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0426-Add-HDMI1-facility-to-the-driver.patch b/target/linux/bcm27xx/patches-6.1/950-0426-Add-HDMI1-facility-to-the-driver.patch
new file mode 100644
index 00000000000000..4aa973b66c8533
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0426-Add-HDMI1-facility-to-the-driver.patch
@@ -0,0 +1,296 @@
+From 0f9e17aaa52c2f7fc586b1864c3a85156648253d Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Wed, 8 Jun 2022 20:49:22 +0100
+Subject: [PATCH] Add HDMI1 facility to the driver.
+
+Also check for which HDMI devices are connected and only create
+devices for those that are present.
+
+Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+snd_bcm2835: disable HDMI audio when vc4 is used (#3640)
+
+Things don't work too well when both the vc4 driver and the firmware
+driver are trying to control the same audio output:
+
+[  763.569406] bcm2835_audio bcm2835_audio: vchi message timeout, msg=5
+
+Hence, when the vc4 HDMI driver is used, let it control audio. This is done
+by introducing a new device tree property to the audio node, and
+extending the vc4-kms-v3d overlays to set it appropriately.
+
+Signed-off-by: Hristo Venev <hristo@venev.name>
+
+staging: bcm2835-audio: Add disable-headphones flag
+
+Add a property to allow the headphone output to be disabled. Use an
+integer property rather than a boolean so that an overlay can clear it.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+staging: bcm2835-audio: Find compatible firmware node
+
+Commit "ARM: dts: Adopt the upstream snd_bcm2835 handling" removed the
+audio section from the DT and the driver can no longer access the
+referenced firmware node 'brcm,firmware'. Fix that by searching for a
+compatible firmware node instead, similar to drivers/gpu/drm/vc4.
+
+Fixes: b9e62329e096 ("ARM: dts: Adopt the upstream snd_bcm2835 handling")
+Signed-off-by: Juerg Haefliger <juergh@proton.me>
+
+staging: bcm2835-audio: Fix firmware node refcounting
+
+Decrement firmware node refcounts on all exit paths in set_hdmi_enables().
+
+Signed-off-by: Juerg Haefliger <juergh@proton.me>
+
+staging: bcm2835-audio: Log errors in case of firmware query failures
+
+The driver queries the firmware for the number of detected HDMI displays
+and their IDs. Log error messages if queries fail.
+
+Signed-off-by: Juerg Haefliger <juergh@proton.me>
+
+staging: bcm2835-audio: Fix unused enable_hdmi module parameter
+
+The commit "Add HDMI1 facility to the driver." made the enable_hdmi module
+parameter unused. Fix that by making it a global switch for all available
+HDMI audio outputs.
+
+Fixes: 755f3366084b ("Add HDMI1 facility to the driver.")
+Signed-off-by: Juerg Haefliger <juergh@proton.me>
+
+staging: bcm2835-audio: Fix unused enable_headphones module parameter
+
+Since commit "staging: bcm2835-audio: Add disable-headphones flag" the
+enabling/disabling of the headphones output is solely determined by the
+presence of the DT property 'brcm,disable-headphones' and the
+enable_headphones module parameter is unused. Fix that by making it a
+global switch.
+
+Fixes: ee90e47d8824 ("staging: bcm2835-audio: Add disable-headphones flag")
+Signed-off-by: Juerg Haefliger <juergh@proton.me>
+---
+ .../vc04_services/bcm2835-audio/bcm2835-pcm.c |   3 +-
+ .../vc04_services/bcm2835-audio/bcm2835.c     | 110 ++++++++++++++++--
+ .../vc04_services/bcm2835-audio/bcm2835.h     |   6 +-
+ 3 files changed, 105 insertions(+), 14 deletions(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+@@ -321,10 +321,11 @@ static const struct snd_pcm_ops snd_bcm2
+ 
+ /* create a pcm device */
+ int snd_bcm2835_new_pcm(struct bcm2835_chip *chip, const char *name,
+-			int idx, enum snd_bcm2835_route route,
++			enum snd_bcm2835_route route,
+ 			u32 numchannels, bool spdif)
+ {
+ 	struct snd_pcm *pcm;
++	int idx = chip->index++;
+ 	int err;
+ 
+ 	err = snd_pcm_new(chip->card, name, idx, numchannels, 0, &pcm);
+--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+@@ -8,8 +8,9 @@
+ #include <linux/module.h>
+ 
+ #include "bcm2835.h"
++#include <soc/bcm2835/raspberrypi-firmware.h>
+ 
+-static bool enable_hdmi;
++static bool enable_hdmi, enable_hdmi0, enable_hdmi1;
+ static bool enable_headphones = true;
+ static int num_channels = MAX_SUBSTREAMS;
+ 
+@@ -65,14 +66,13 @@ static int bcm2835_audio_dual_newpcm(str
+ 				     u32 numchannels)
+ {
+ 	int err;
+-
+-	err = snd_bcm2835_new_pcm(chip, name, 0, route,
++	err = snd_bcm2835_new_pcm(chip, name, route,
+ 				  numchannels, false);
+ 
+ 	if (err)
+ 		return err;
+ 
+-	err = snd_bcm2835_new_pcm(chip, "IEC958", 1, route, 1, true);
++	err = snd_bcm2835_new_pcm(chip, name, route, 1, true);
+ 	if (err)
+ 		return err;
+ 
+@@ -84,20 +84,33 @@ static int bcm2835_audio_simple_newpcm(s
+ 				       enum snd_bcm2835_route route,
+ 				       u32 numchannels)
+ {
+-	return snd_bcm2835_new_pcm(chip, name, 0, route, numchannels, false);
++	return snd_bcm2835_new_pcm(chip, name, route, numchannels, false);
+ }
+ 
+-static struct bcm2835_audio_driver bcm2835_audio_hdmi = {
++static struct bcm2835_audio_driver bcm2835_audio_hdmi0 = {
++	.driver = {
++		.name = "bcm2835_hdmi",
++		.owner = THIS_MODULE,
++	},
++	.shortname = "bcm2835 HDMI 1",
++	.longname  = "bcm2835 HDMI 1",
++	.minchannels = 1,
++	.newpcm = bcm2835_audio_dual_newpcm,
++	.newctl = snd_bcm2835_new_hdmi_ctl,
++	.route = AUDIO_DEST_HDMI0
++};
++
++static struct bcm2835_audio_driver bcm2835_audio_hdmi1 = {
+ 	.driver = {
+ 		.name = "bcm2835_hdmi",
+ 		.owner = THIS_MODULE,
+ 	},
+-	.shortname = "bcm2835 HDMI",
+-	.longname  = "bcm2835 HDMI",
++	.shortname = "bcm2835 HDMI 2",
++	.longname  = "bcm2835 HDMI 2",
+ 	.minchannels = 1,
+ 	.newpcm = bcm2835_audio_dual_newpcm,
+ 	.newctl = snd_bcm2835_new_hdmi_ctl,
+-	.route = AUDIO_DEST_HDMI
++	.route = AUDIO_DEST_HDMI1
+ };
+ 
+ static struct bcm2835_audio_driver bcm2835_audio_headphones = {
+@@ -120,8 +133,12 @@ struct bcm2835_audio_drivers {
+ 
+ static struct bcm2835_audio_drivers children_devices[] = {
+ 	{
+-		.audio_driver = &bcm2835_audio_hdmi,
+-		.is_enabled = &enable_hdmi,
++		.audio_driver = &bcm2835_audio_hdmi0,
++		.is_enabled = &enable_hdmi0,
++	},
++	{
++		.audio_driver = &bcm2835_audio_hdmi1,
++		.is_enabled = &enable_hdmi1,
+ 	},
+ 	{
+ 		.audio_driver = &bcm2835_audio_headphones,
+@@ -268,10 +285,70 @@ static int snd_add_child_devices(struct
+ 	return 0;
+ }
+ 
++static void set_hdmi_enables(struct device *dev)
++{
++	struct device_node *firmware_node;
++	struct rpi_firmware *firmware = NULL;
++	u32 num_displays, i, display_id;
++	int ret;
++
++	firmware_node = of_find_compatible_node(NULL, NULL,
++					"raspberrypi,bcm2835-firmware");
++	if (firmware_node) {
++		firmware = rpi_firmware_get(firmware_node);
++		of_node_put(firmware_node);
++	}
++
++	if (!firmware) {
++		dev_err(dev, "Failed to get fw structure\n");
++		return;
++	}
++
++	ret = rpi_firmware_property(firmware,
++				    RPI_FIRMWARE_FRAMEBUFFER_GET_NUM_DISPLAYS,
++				    &num_displays, sizeof(u32));
++	if (ret) {
++		dev_err(dev, "Failed to get fw property NUM_DISPLAYS\n");
++		goto out_rpi_fw_put;
++	}
++
++	for (i = 0; i < num_displays; i++) {
++		display_id = i;
++		ret = rpi_firmware_property(firmware,
++				RPI_FIRMWARE_FRAMEBUFFER_GET_DISPLAY_ID,
++				&display_id, sizeof(display_id));
++		if (ret) {
++			dev_err(dev, "Failed to get fw property DISPLAY_ID "
++				"(i = %d)\n", i);
++		} else {
++			if (display_id == 2)
++				enable_hdmi0 = true;
++			if (display_id == 7)
++				enable_hdmi1 = true;
++		}
++	}
++
++	if (!enable_hdmi0 && enable_hdmi1) {
++		/* Swap them over and reassign route. This means
++		 * that if we only have one connected, it is always named
++		 *  HDMI1, irrespective of if its on port HDMI0 or HDMI1.
++		 *  This should match with the naming of HDMI ports in DRM
++		 */
++		enable_hdmi0 = true;
++		enable_hdmi1 = false;
++		bcm2835_audio_hdmi0.route = AUDIO_DEST_HDMI1;
++	}
++
++out_rpi_fw_put:
++	rpi_firmware_put(firmware);
++	return;
++}
++
+ static int snd_bcm2835_alsa_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
+ 	int err;
++	u32 disable_headphones = 0;
+ 
+ 	if (num_channels <= 0 || num_channels > MAX_SUBSTREAMS) {
+ 		num_channels = MAX_SUBSTREAMS;
+@@ -279,6 +356,17 @@ static int snd_bcm2835_alsa_probe(struct
+ 			 num_channels);
+ 	}
+ 
++	if (enable_hdmi &&
++	    !of_property_read_bool(dev->of_node, "brcm,disable-hdmi"))
++		set_hdmi_enables(dev);
++
++	if (enable_headphones) {
++		of_property_read_u32(dev->of_node,
++				     "brcm,disable-headphones",
++				     &disable_headphones);
++		enable_headphones = !disable_headphones;
++	}
++
+ 	err = bcm2835_devm_add_vchi_ctx(dev);
+ 	if (err)
+ 		return err;
+--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
+@@ -33,7 +33,8 @@ enum {
+ enum snd_bcm2835_route {
+ 	AUDIO_DEST_AUTO = 0,
+ 	AUDIO_DEST_HEADPHONES = 1,
+-	AUDIO_DEST_HDMI = 2,
++	AUDIO_DEST_HDMI0 = 2,
++	AUDIO_DEST_HDMI1 = 3,
+ 	AUDIO_DEST_MAX,
+ };
+ 
+@@ -58,6 +59,7 @@ struct bcm2835_chip {
+ 	int volume;
+ 	int dest;
+ 	int mute;
++	int index;
+ 
+ 	unsigned int opened;
+ 	unsigned int spdif_status;
+@@ -85,7 +87,7 @@ struct bcm2835_alsa_stream {
+ 
+ int snd_bcm2835_new_ctl(struct bcm2835_chip *chip);
+ int snd_bcm2835_new_pcm(struct bcm2835_chip *chip, const char *name,
+-			int idx, enum snd_bcm2835_route route,
++			enum snd_bcm2835_route route,
+ 			u32 numchannels, bool spdif);
+ 
+ int snd_bcm2835_new_hdmi_ctl(struct bcm2835_chip *chip);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0427-Populate-phy-driver-block-for-BCM54213PE.patch b/target/linux/bcm27xx/patches-6.1/950-0427-Populate-phy-driver-block-for-BCM54213PE.patch
new file mode 100644
index 00000000000000..5eeeda4eac7304
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0427-Populate-phy-driver-block-for-BCM54213PE.patch
@@ -0,0 +1,33 @@
+From 437be8fec1433d9b023f34af8e4ac2dbe3a113f9 Mon Sep 17 00:00:00 2001
+From: Jonathan Lemon <jonathan.lemon@gmail.com>
+Date: Wed, 4 May 2022 14:33:05 -0700
+Subject: [PATCH] Populate phy driver block for BCM54213PE
+
+The BCM54213PE identifier is a RPI-specific addition.
+Populate the remainder of the driver functions, including the
+required probe routine.
+
+Add a version of bcm54xx_suspend, from upstream.
+
+Signed-off-by: Jonathan Lemon <jonathan.lemon@gmail.com>
+---
+ drivers/net/phy/broadcom.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -921,8 +921,14 @@ static struct phy_driver broadcom_driver
+ 	.phy_id_mask	= 0xffffffff,
+ 	.name		= "Broadcom BCM54213PE",
+ 	/* PHY_GBIT_FEATURES */
++	.get_sset_count	= bcm_phy_get_sset_count,
++	.get_strings	= bcm_phy_get_strings,
++	.get_stats	= bcm54xx_get_stats,
++	.probe		= bcm54xx_phy_probe,
+ 	.config_init	= bcm54xx_config_init,
+ 	.config_intr	= bcm_phy_config_intr,
++	.suspend	= bcm54xx_suspend,
++	.resume		= bcm54xx_resume,
+ }, {
+ 	.phy_id		= PHY_ID_BCM5461,
+ 	.phy_id_mask	= 0xfffffff0,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0428-clk-bcm-rpi-Add-the-BCM283x-pixel-clock.patch b/target/linux/bcm27xx/patches-6.1/950-0428-clk-bcm-rpi-Add-the-BCM283x-pixel-clock.patch
new file mode 100644
index 00000000000000..609e7b83b9e8c1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0428-clk-bcm-rpi-Add-the-BCM283x-pixel-clock.patch
@@ -0,0 +1,26 @@
+From 275331bce7ee7dc7f045218468560db6981d3b95 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 2 Dec 2021 13:53:36 +0000
+Subject: [PATCH] clk: bcm: rpi: Add the BCM283x pixel clock.
+
+The clk-bcm2835 handling of the pixel clock does not function
+correctly when the HDMI power domain is disabled.
+
+The firmware supports it correctly, so add it to the
+firmware clock driver.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/clk/bcm/clk-raspberrypi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/clk/bcm/clk-raspberrypi.c
++++ b/drivers/clk/bcm/clk-raspberrypi.c
+@@ -140,6 +140,7 @@ raspberrypi_clk_variants[RPI_FIRMWARE_NU
+ 	},
+ 	[RPI_FIRMWARE_PIXEL_CLK_ID] = {
+ 		.export = true,
++		.minimize = true,
+ 	},
+ 	[RPI_FIRMWARE_HEVC_CLK_ID] = {
+ 		.export = true,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0429-media-i2c-ov9281-Correct-min-def-vts-for-640x400.patch b/target/linux/bcm27xx/patches-6.1/950-0429-media-i2c-ov9281-Correct-min-def-vts-for-640x400.patch
new file mode 100644
index 00000000000000..28379c221ff856
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0429-media-i2c-ov9281-Correct-min-def-vts-for-640x400.patch
@@ -0,0 +1,27 @@
+From 286fa1d98e627f4991f3fe3981b806555df18cd8 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 4 Jul 2022 18:10:23 +0100
+Subject: [PATCH] media: i2c: ov9281: Correct min/def vts for 640x400
+
+A VTS of 421 in the 640x400 mode only streams at 130.2fps
+instead of the expected ~261fps. This appears to be an invalid
+value for the sensor, as a VTS of 422 works fine to give 259.79fps.
+
+Set the minimum (and default) to 422.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov9281.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/ov9281.c
++++ b/drivers/media/i2c/ov9281.c
+@@ -369,7 +369,7 @@ static const struct ov9281_mode supporte
+ 		.height = 400,
+ 		.exp_def = 0x0320,
+ 		.hts_def = 0x05b0,
+-		.vts_def = 421,
++		.vts_def = 422,
+ 		.crop = {
+ 			.left = 0,
+ 			.top = 0,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0430-media-i2c-ov9281-Change-exposure-default-value-with-.patch b/target/linux/bcm27xx/patches-6.1/950-0430-media-i2c-ov9281-Change-exposure-default-value-with-.patch
new file mode 100644
index 00000000000000..0a7dac9002057a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0430-media-i2c-ov9281-Change-exposure-default-value-with-.patch
@@ -0,0 +1,29 @@
+From ec8627b0eff55db1a8bdfe7bb327c31c6ca3dad7 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 4 Jul 2022 18:12:56 +0100
+Subject: [PATCH] media: i2c: ov9281: Change exposure default value
+ with mode choice
+
+When the exposure range is updated due to changing VBLANK, adopt
+the mode default value, not the current default.
+
+Should the specific default value be outside of the min/max range
+defined, then the whole update is rejected, which can leave an
+invalid exposure range active.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov9281.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/ov9281.c
++++ b/drivers/media/i2c/ov9281.c
+@@ -976,7 +976,7 @@ static int ov9281_set_ctrl(struct v4l2_c
+ 		__v4l2_ctrl_modify_range(ov9281->exposure,
+ 					 ov9281->exposure->minimum, max,
+ 					 ov9281->exposure->step,
+-					 ov9281->exposure->default_value);
++					 ov9281->cur_mode->vts_def);
+ 		break;
+ 	}
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0431-media-bcm2835-unicam-Correctly-handle-FS-FE-ISR-cond.patch b/target/linux/bcm27xx/patches-6.1/950-0431-media-bcm2835-unicam-Correctly-handle-FS-FE-ISR-cond.patch
new file mode 100644
index 00000000000000..efec3af2a1a76a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0431-media-bcm2835-unicam-Correctly-handle-FS-FE-ISR-cond.patch
@@ -0,0 +1,64 @@
+From 1ecf9ebf26821996ae3344765e1b770d7bc4bfc2 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Mon, 8 Aug 2022 10:01:41 +0100
+Subject: [PATCH] media: bcm2835-unicam: Correctly handle FS + FE ISR
+ condtion
+
+If we get a simultaneous FS + FE interrupt for the same frame, it cannot be
+marked as completed and returned to userland as the framebuffer will be refilled
+by Unicam on the next sensor frame. Additionally, the timestamp will be set to 0
+as the FS interrupt handling code will not have run yet.
+
+To avoid these problems, the frame is considered dropped in the FE handler,
+and will be returned to userland on the subsequent sensor frame.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 28 +++++++++++++------
+ 1 file changed, 20 insertions(+), 8 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -919,7 +919,9 @@ static irqreturn_t unicam_isr(int irq, v
+ 		 * to use.
+ 		 */
+ 		for (i = 0; i < ARRAY_SIZE(unicam->node); i++) {
+-			if (!unicam->node[i].streaming)
++			struct unicam_node *node = &unicam->node[i];
++
++			if (!node->streaming)
+ 				continue;
+ 
+ 			/*
+@@ -929,14 +931,24 @@ static irqreturn_t unicam_isr(int irq, v
+ 			 * + FS + LS). In this case, we cannot signal the buffer
+ 			 * as complete, as the HW will reuse that buffer.
+ 			 */
+-			if (unicam->node[i].cur_frm &&
+-			    unicam->node[i].cur_frm != unicam->node[i].next_frm) {
+-				unicam_process_buffer_complete(&unicam->node[i],
+-							       sequence);
+-				unicam->node[i].cur_frm = unicam->node[i].next_frm;
+-				unicam->node[i].next_frm = NULL;
++			if (node->cur_frm && node->cur_frm != node->next_frm) {
++				/*
++				 * This condition checks if FE + FS for the same
++				 * frame has occurred. In such cases, we cannot
++				 * return out the frame, as no buffer handling
++				 * or timestamping has yet been done as part of
++				 * the FS handler.
++				 */
++				if (!node->cur_frm->vb.vb2_buf.timestamp) {
++					unicam_dbg(2, unicam, "ISR: FE without FS, dropping frame\n");
++					continue;
++				}
++
++				unicam_process_buffer_complete(node, sequence);
++				node->cur_frm = node->next_frm;
++				node->next_frm = NULL;
+ 			} else {
+-				unicam->node[i].cur_frm = unicam->node[i].next_frm;
++				node->cur_frm = node->next_frm;
+ 			}
+ 		}
+ 		unicam->sequence++;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0432-drm-panel-simple-hack-ignore-orientation.patch b/target/linux/bcm27xx/patches-6.1/950-0432-drm-panel-simple-hack-ignore-orientation.patch
new file mode 100644
index 00000000000000..f7c47caf31e56c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0432-drm-panel-simple-hack-ignore-orientation.patch
@@ -0,0 +1,24 @@
+From 65c56896ea9cad77b237d26624b6b31c4b4af51b Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Mon, 15 Aug 2022 19:42:38 +0100
+Subject: [PATCH] drm/panel-simple: hack ignore orientation
+
+downstream removal of orientation plus upstream adding of new function
+---
+ drivers/gpu/drm/panel/panel-simple.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -434,9 +434,9 @@ static int panel_simple_get_timings(stru
+ 
+ static enum drm_panel_orientation panel_simple_get_orientation(struct drm_panel *panel)
+ {
+-	struct panel_simple *p = to_panel_simple(panel);
++	//struct panel_simple *p = to_panel_simple(panel);
+ 
+-	return p->orientation;
++	return DRM_MODE_PANEL_ORIENTATION_UNKNOWN;
+ }
+ 
+ static const struct drm_panel_funcs panel_simple_funcs = {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0433-vc04_services-vc-sm-cma-Handle-upstream-require-vchi.patch b/target/linux/bcm27xx/patches-6.1/950-0433-vc04_services-vc-sm-cma-Handle-upstream-require-vchi.patch
new file mode 100644
index 00000000000000..d512ffaa6488d8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0433-vc04_services-vc-sm-cma-Handle-upstream-require-vchi.patch
@@ -0,0 +1,214 @@
+From ac1d09b5d0dd7e9877ace3954d6042723fa75169 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Mon, 15 Aug 2022 19:44:20 +0100
+Subject: [PATCH] vc04_services/vc-sm-cma: Handle upstream require
+ vchiq_instance to be passed around
+
+---
+ .../staging/vc04_services/vc-sm-cma/vc_sm.c   | 12 +++----
+ .../vc04_services/vc-sm-cma/vc_sm_cma_vchi.c  | 36 +++++++++++--------
+ .../vc04_services/vc-sm-cma/vc_sm_cma_vchi.h  |  2 +-
+ 3 files changed, 28 insertions(+), 22 deletions(-)
+
+--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
++++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+@@ -106,6 +106,7 @@ struct sm_state_t {
+ 					 * has finished with a resource.
+ 					 */
+ 	u32 int_trans_id;		/* Interrupted transaction. */
++	struct vchiq_instance *vchiq_instance;
+ };
+ 
+ struct vc_sm_dma_buf_attachment {
+@@ -1491,7 +1492,6 @@ static const struct file_operations vc_s
+ static void vc_sm_connected_init(void)
+ {
+ 	int ret;
+-	struct vchiq_instance *vchiq_instance;
+ 	struct vc_sm_version version;
+ 	struct vc_sm_result_t version_result;
+ 
+@@ -1501,7 +1501,7 @@ static void vc_sm_connected_init(void)
+ 	 * Initialize and create a VCHI connection for the shared memory service
+ 	 * running on videocore.
+ 	 */
+-	ret = vchiq_initialise(&vchiq_instance);
++	ret = vchiq_initialise(&sm_state->vchiq_instance);
+ 	if (ret) {
+ 		pr_err("[%s]: failed to initialise VCHI instance (ret=%d)\n",
+ 		       __func__, ret);
+@@ -1509,7 +1509,7 @@ static void vc_sm_connected_init(void)
+ 		return;
+ 	}
+ 
+-	ret = vchiq_connect(vchiq_instance);
++	ret = vchiq_connect(sm_state->vchiq_instance);
+ 	if (ret) {
+ 		pr_err("[%s]: failed to connect VCHI instance (ret=%d)\n",
+ 		       __func__, ret);
+@@ -1518,7 +1518,7 @@ static void vc_sm_connected_init(void)
+ 	}
+ 
+ 	/* Initialize an instance of the shared memory service. */
+-	sm_state->sm_handle = vc_sm_cma_vchi_init(vchiq_instance, 1,
++	sm_state->sm_handle = vc_sm_cma_vchi_init(sm_state->vchiq_instance, 1,
+ 						  vc_sm_vpu_event);
+ 	if (!sm_state->sm_handle) {
+ 		pr_err("[%s]: failed to initialize shared memory service\n",
+@@ -1576,7 +1576,7 @@ err_remove_misc_dev:
+ 	misc_deregister(&sm_state->misc_dev);
+ err_remove_debugfs:
+ 	debugfs_remove_recursive(sm_state->dir_root);
+-	vc_sm_cma_vchi_stop(&sm_state->sm_handle);
++	vc_sm_cma_vchi_stop(sm_state->vchiq_instance, &sm_state->sm_handle);
+ }
+ 
+ /* Driver loading. */
+@@ -1614,7 +1614,7 @@ static int bcm2835_vc_sm_cma_remove(stru
+ 		debugfs_remove_recursive(sm_state->dir_root);
+ 
+ 		/* Stop the videocore shared memory service. */
+-		vc_sm_cma_vchi_stop(&sm_state->sm_handle);
++		vc_sm_cma_vchi_stop(sm_state->vchiq_instance, &sm_state->sm_handle);
+ 	}
+ 
+ 	if (sm_state) {
+--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c
++++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c
+@@ -70,7 +70,7 @@ struct sm_instance {
+ 	struct list_head free_list;
+ 
+ 	struct semaphore free_sema;
+-
++	struct vchiq_instance *vchiq_instance;
+ };
+ 
+ /* ---- Private Variables ------------------------------------------------ */
+@@ -79,11 +79,11 @@ struct sm_instance {
+ 
+ /* ---- Private Functions ------------------------------------------------ */
+ static int
+-bcm2835_vchi_msg_queue(unsigned int handle,
++bcm2835_vchi_msg_queue(struct vchiq_instance *vchiq_instance, unsigned int handle,
+ 		       void *data,
+ 		       unsigned int size)
+ {
+-	return vchiq_queue_kernel_message(handle, data, size);
++	return vchiq_queue_kernel_message(vchiq_instance, handle, data, size);
+ }
+ 
+ static struct
+@@ -187,12 +187,12 @@ static int vc_sm_cma_vchi_videocore_io(v
+ 
+ 	while (1) {
+ 		if (svc_use)
+-			vchiq_release_service(instance->service_handle[0]);
++			vchiq_release_service(instance->vchiq_instance, instance->service_handle[0]);
+ 		svc_use = 0;
+ 
+ 		if (wait_for_completion_interruptible(&instance->io_cmplt))
+ 			continue;
+-		vchiq_use_service(instance->service_handle[0]);
++		vchiq_use_service(instance->vchiq_instance, instance->service_handle[0]);
+ 		svc_use = 1;
+ 
+ 		do {
+@@ -212,7 +212,8 @@ static int vc_sm_cma_vchi_videocore_io(v
+ 			mutex_unlock(&instance->lock);
+ 			/* Send the command */
+ 			status =
+-				bcm2835_vchi_msg_queue(instance->service_handle[0],
++				bcm2835_vchi_msg_queue(instance->vchiq_instance,
++						       instance->service_handle[0],
+ 						       cmd->msg, cmd->length);
+ 			if (status) {
+ 				pr_err("%s: failed to queue message (%d)",
+@@ -235,7 +236,8 @@ static int vc_sm_cma_vchi_videocore_io(v
+ 
+ 		} while (1);
+ 
+-		while ((header = vchiq_msg_hold(instance->service_handle[0]))) {
++		while ((header = vchiq_msg_hold(instance->vchiq_instance,
++						instance->service_handle[0]))) {
+ 			reply = (struct vc_sm_result_t *)header->data;
+ 			if (reply->trans_id & 0x80000000) {
+ 				/* Async event or cmd from the VPU */
+@@ -247,7 +249,8 @@ static int vc_sm_cma_vchi_videocore_io(v
+ 						      header->size);
+ 			}
+ 
+-			vchiq_release_message(instance->service_handle[0],
++			vchiq_release_message(instance->vchiq_instance,
++					      instance->service_handle[0],
+ 					      header);
+ 		}
+ 
+@@ -264,15 +267,16 @@ static int vc_sm_cma_vchi_videocore_io(v
+ 	return 0;
+ }
+ 
+-static enum vchiq_status vc_sm_cma_vchi_callback(enum vchiq_reason reason,
++static enum vchiq_status vc_sm_cma_vchi_callback(struct vchiq_instance *vchiq_instance,
++						 enum vchiq_reason reason,
+ 						 struct vchiq_header *header,
+ 						 unsigned int handle, void *userdata)
+ {
+-	struct sm_instance *instance = vchiq_get_service_userdata(handle);
++	struct sm_instance *instance = vchiq_get_service_userdata(vchiq_instance, handle);
+ 
+ 	switch (reason) {
+ 	case VCHIQ_MESSAGE_AVAILABLE:
+-		vchiq_msg_queue_push(handle, header);
++		vchiq_msg_queue_push(vchiq_instance, handle, header);
+ 		complete(&instance->io_cmplt);
+ 		break;
+ 
+@@ -320,6 +324,8 @@ struct sm_instance *vc_sm_cma_vchi_init(
+ 		list_add(&instance->free_blk[i].head, &instance->free_list);
+ 	}
+ 
++	instance->vchiq_instance = vchiq_instance;
++
+ 	/* Open the VCHI service connections */
+ 	instance->num_connections = num_connections;
+ 	for (i = 0; i < num_connections; i++) {
+@@ -358,7 +364,7 @@ struct sm_instance *vc_sm_cma_vchi_init(
+ err_close_services:
+ 	for (i = 0; i < instance->num_connections; i++) {
+ 		if (instance->service_handle[i])
+-			vchiq_close_service(instance->service_handle[i]);
++			vchiq_close_service(vchiq_instance, instance->service_handle[i]);
+ 	}
+ 	kfree(instance);
+ err_null:
+@@ -366,7 +372,7 @@ err_null:
+ 	return NULL;
+ }
+ 
+-int vc_sm_cma_vchi_stop(struct sm_instance **handle)
++int vc_sm_cma_vchi_stop(struct vchiq_instance *vchiq_instance, struct sm_instance **handle)
+ {
+ 	struct sm_instance *instance;
+ 	u32 i;
+@@ -385,8 +391,8 @@ int vc_sm_cma_vchi_stop(struct sm_instan
+ 
+ 	/* Close all VCHI service connections */
+ 	for (i = 0; i < instance->num_connections; i++) {
+-		vchiq_use_service(instance->service_handle[i]);
+-		vchiq_close_service(instance->service_handle[i]);
++		vchiq_use_service(vchiq_instance, instance->service_handle[i]);
++		vchiq_close_service(vchiq_instance, instance->service_handle[i]);
+ 	}
+ 
+ 	kfree(instance);
+--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.h
++++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.h
+@@ -35,7 +35,7 @@ struct sm_instance *vc_sm_cma_vchi_init(
+ /*
+  * Terminates the shared memory service.
+  */
+-int vc_sm_cma_vchi_stop(struct sm_instance **handle);
++int vc_sm_cma_vchi_stop(struct vchiq_instance *vchi_instance, struct sm_instance **handle);
+ 
+ /*
+  * Ask the shared memory service to free up some memory that was previously
diff --git a/target/linux/bcm27xx/patches-6.1/950-0434-media-video-mux-Read-CSI2-config-from-FW-and-pass-to.patch b/target/linux/bcm27xx/patches-6.1/950-0434-media-video-mux-Read-CSI2-config-from-FW-and-pass-to.patch
new file mode 100644
index 00000000000000..f057e78f1ffef1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0434-media-video-mux-Read-CSI2-config-from-FW-and-pass-to.patch
@@ -0,0 +1,149 @@
+From 49c4d625a8477689891d68509d9f2b3ede3ed3f9 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 29 Jul 2022 17:46:49 +0100
+Subject: [PATCH] media: video-mux: Read CSI2 config from FW, and pass
+ to receiver
+
+There is no obligation for all source devices on a video-mux to
+require the same bus configuration, so read the configuration
+from the sink ports, and relay via get_mbus_config on the source
+port.
+If the sources support get_mbus_config, then call that first.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/video-mux.c | 68 +++++++++++++++++++++++++++++-
+ 1 file changed, 66 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/video-mux.c
++++ b/drivers/media/platform/video-mux.c
+@@ -20,11 +20,28 @@
+ #include <media/v4l2-mc.h>
+ #include <media/v4l2-subdev.h>
+ 
++struct video_mux_asd {
++	struct v4l2_async_subdev base;
++	unsigned int port;
++};
++
++static inline struct video_mux_asd *to_video_mux_asd(struct v4l2_async_subdev *asd)
++{
++	return container_of(asd, struct video_mux_asd, base);
++}
++
++struct video_mux_pad_cfg {
++	unsigned int num_lanes;
++	bool non_continuous;
++	struct v4l2_subdev *source;
++};
++
+ struct video_mux {
+ 	struct v4l2_subdev subdev;
+ 	struct v4l2_async_notifier notifier;
+ 	struct media_pad *pads;
+ 	struct v4l2_mbus_framefmt *format_mbus;
++	struct video_mux_pad_cfg *cfg;
+ 	struct mux_control *mux;
+ 	struct mutex lock;
+ 	int active;
+@@ -330,10 +347,34 @@ static int video_mux_init_cfg(struct v4l
+ 	return 0;
+ }
+ 
++static int video_mux_get_mbus_config(struct v4l2_subdev *sd,
++				     unsigned int pad,
++				     struct v4l2_mbus_config *cfg)
++{
++	struct video_mux *vmux = v4l2_subdev_to_video_mux(sd);
++	int ret;
++
++	ret = v4l2_subdev_call(vmux->cfg[vmux->active].source, pad, get_mbus_config,
++			       0, cfg);
++
++	if (ret != -ENOIOCTLCMD)
++		return ret;
++
++	cfg->type = V4L2_MBUS_CSI2_DPHY;
++	cfg->bus.mipi_csi2.num_data_lanes = vmux->cfg[vmux->active].num_lanes;
++
++	/* Support for non-continuous CSI-2 clock is missing in pdate mode */
++	if (vmux->cfg[vmux->active].non_continuous)
++		cfg->bus.mipi_csi2.flags |= V4L2_MBUS_CSI2_NONCONTINUOUS_CLOCK;
++
++	return 0;
++};
++
+ static const struct v4l2_subdev_pad_ops video_mux_pad_ops = {
+ 	.init_cfg = video_mux_init_cfg,
+ 	.get_fmt = video_mux_get_format,
+ 	.set_fmt = video_mux_set_format,
++	.get_mbus_config = video_mux_get_mbus_config,
+ };
+ 
+ static const struct v4l2_subdev_ops video_mux_subdev_ops = {
+@@ -346,6 +387,9 @@ static int video_mux_notify_bound(struct
+ 				  struct v4l2_async_subdev *asd)
+ {
+ 	struct video_mux *vmux = notifier_to_video_mux(notifier);
++	unsigned int port = to_video_mux_asd(asd)->port;
++
++	vmux->cfg[port].source = sd;
+ 
+ 	return v4l2_create_fwnode_links(sd, &vmux->subdev);
+ }
+@@ -363,7 +407,7 @@ static int video_mux_async_register(stru
+ 	v4l2_async_nf_init(&vmux->notifier);
+ 
+ 	for (i = 0; i < num_input_pads; i++) {
+-		struct v4l2_async_subdev *asd;
++		struct video_mux_asd *asd;
+ 		struct fwnode_handle *ep, *remote_ep;
+ 
+ 		ep = fwnode_graph_get_endpoint_by_id(
+@@ -381,7 +425,8 @@ static int video_mux_async_register(stru
+ 		fwnode_handle_put(remote_ep);
+ 
+ 		asd = v4l2_async_nf_add_fwnode_remote(&vmux->notifier, ep,
+-						      struct v4l2_async_subdev);
++						      struct video_mux_asd);
++		asd->port = i;
+ 
+ 		fwnode_handle_put(ep);
+ 
+@@ -406,6 +451,9 @@ static int video_mux_probe(struct platfo
+ {
+ 	struct device_node *np = pdev->dev.of_node;
+ 	struct device *dev = &pdev->dev;
++	struct v4l2_fwnode_endpoint fwnode_ep = {
++		.bus_type = V4L2_MBUS_CSI2_DPHY
++	};
+ 	struct device_node *ep;
+ 	struct video_mux *vmux;
+ 	unsigned int num_pads = 0;
+@@ -458,10 +506,26 @@ static int video_mux_probe(struct platfo
+ 	if (!vmux->format_mbus)
+ 		return -ENOMEM;
+ 
++	vmux->cfg = devm_kcalloc(dev, num_pads, sizeof(*vmux->cfg), GFP_KERNEL);
++	if (!vmux->cfg)
++		return -ENOMEM;
++
+ 	for (i = 0; i < num_pads; i++) {
+ 		vmux->pads[i].flags = (i < num_pads - 1) ? MEDIA_PAD_FL_SINK
+ 							 : MEDIA_PAD_FL_SOURCE;
+ 		vmux->format_mbus[i] = video_mux_format_mbus_default;
++
++		ep = of_graph_get_endpoint_by_regs(pdev->dev.of_node, i, 0);
++		if (ep) {
++			ret = v4l2_fwnode_endpoint_parse(of_fwnode_handle(ep), &fwnode_ep);
++			if (!ret) {
++				/* Get number of data lanes */
++				vmux->cfg[i].num_lanes = fwnode_ep.bus.mipi_csi2.num_data_lanes;
++				vmux->cfg[i].non_continuous = fwnode_ep.bus.mipi_csi2.flags &
++							V4L2_MBUS_CSI2_NONCONTINUOUS_CLOCK;
++			}
++			of_node_put(ep);
++		}
+ 	}
+ 
+ 	vmux->subdev.entity.function = MEDIA_ENT_F_VID_MUX;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0435-media-i2c-arducam-pivariety-Add-custom-controls.patch b/target/linux/bcm27xx/patches-6.1/950-0435-media-i2c-arducam-pivariety-Add-custom-controls.patch
new file mode 100644
index 00000000000000..165197b406fbe9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0435-media-i2c-arducam-pivariety-Add-custom-controls.patch
@@ -0,0 +1,40 @@
+From b319421a01177d883539b2f25302300e9544afb0 Mon Sep 17 00:00:00 2001
+From: Lee Jackson <info@arducam.com>
+Date: Fri, 26 Aug 2022 11:41:49 +0800
+Subject: [PATCH] media: i2c: arducam-pivariety: Add custom controls
+
+Add support for strobe_shift, strobe_width and mode custom controls.
+
+Signed-off-by: Lee Jackson <info@arducam.com>
+---
+ drivers/media/i2c/arducam-pivariety.c | 6 ++++++
+ drivers/media/i2c/arducam-pivariety.h | 3 +++
+ 2 files changed, 9 insertions(+)
+
+--- a/drivers/media/i2c/arducam-pivariety.c
++++ b/drivers/media/i2c/arducam-pivariety.c
+@@ -1140,6 +1140,12 @@ static const char *pivariety_ctrl_get_na
+ 		return "trigger_mode";
+ 	case V4L2_CID_ARDUCAM_IRCUT:
+ 		return "ircut";
++	case V4L2_CID_ARDUCAM_STROBE_SHIFT:
++		return "strobe_shift";
++	case V4L2_CID_ARDUCAM_STROBE_WIDTH:
++		return "strobe_width";
++	case V4L2_CID_ARDUCAM_MODE:
++		return "mode";
+ 	default:
+ 		return NULL;
+ 	}
+--- a/drivers/media/i2c/arducam-pivariety.h
++++ b/drivers/media/i2c/arducam-pivariety.h
+@@ -52,6 +52,9 @@
+ #define V4L2_CID_ARDUCAM_BASE		(V4L2_CID_USER_BASE + 0x1000)
+ #define V4L2_CID_ARDUCAM_EXT_TRI	(V4L2_CID_ARDUCAM_BASE + 1)
+ #define V4L2_CID_ARDUCAM_IRCUT		(V4L2_CID_ARDUCAM_BASE + 8)
++#define V4L2_CID_ARDUCAM_STROBE_SHIFT	(V4L2_CID_ARDUCAM_BASE + 14)
++#define V4L2_CID_ARDUCAM_STROBE_WIDTH	(V4L2_CID_ARDUCAM_BASE + 15)
++#define V4L2_CID_ARDUCAM_MODE		(V4L2_CID_ARDUCAM_BASE + 16)
+ 
+ enum image_dt {
+ 	IMAGE_DT_YUV420_8 = 0x18,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0436-media-bcm2835-unicam-Fix-for-possible-dummy-buffer-o.patch b/target/linux/bcm27xx/patches-6.1/950-0436-media-bcm2835-unicam-Fix-for-possible-dummy-buffer-o.patch
new file mode 100644
index 00000000000000..24e3e5ee8a997c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0436-media-bcm2835-unicam-Fix-for-possible-dummy-buffer-o.patch
@@ -0,0 +1,56 @@
+From 5631d65a09fe2249d22fad0985c25dc776b41808 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Fri, 2 Sep 2022 08:35:35 +0100
+Subject: [PATCH] media: bcm2835-unicam: Fix for possible dummy buffer
+ overrun
+
+The Unicam hardware has been observed to cause a buffer overrun when using the
+dummy buffer as a circular buffer. The conditions that cause the overrun are not
+fully known, but it seems to occur when the memory bus is heavily loaded.
+
+To avoid the overrun, program the hardware with a buffer size of 0 when using
+the dummy buffer. This will cause overrun into the allocated dummy buffer, but
+avoid out of bounds writes.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -126,8 +126,11 @@ MODULE_PARM_DESC(media_controller, "Use
+ #define UNICAM_EMBEDDED_SIZE	16384
+ 
+ /*
+- * Size of the dummy buffer. Can be any size really, but the DMA
+- * allocation works in units of page sizes.
++ * Size of the dummy buffer allocation.
++ *
++ * Due to a HW bug causing buffer overruns in circular buffer mode under certain
++ * (not yet fully known) conditions, the dummy buffer allocation is set to a
++ * a single page size, but the hardware gets programmed with a buffer size of 0.
+  */
+ #define DUMMY_BUF_SIZE		(PAGE_SIZE)
+ 
+@@ -843,8 +846,7 @@ static void unicam_schedule_dummy_buffer
+ 	unicam_dbg(3, dev, "Scheduling dummy buffer for node %d\n",
+ 		   node->pad_id);
+ 
+-	unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr, DUMMY_BUF_SIZE,
+-			   node->pad_id);
++	unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr, 0, node->pad_id);
+ 	node->next_frm = NULL;
+ }
+ 
+@@ -2662,8 +2664,8 @@ static void unicam_stop_streaming(struct
+ 		 * This is only really needed if the embedded data pad is
+ 		 * disabled before the image pad.
+ 		 */
+-		unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr,
+-				   DUMMY_BUF_SIZE, METADATA_PAD);
++		unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr, 0,
++				   METADATA_PAD);
+ 	}
+ 
+ 	/* Clear all queued buffers for the node */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0437-usb-xhci-expand-mitigations-for-VLI_SS_BULK_OUT_BUG-.patch b/target/linux/bcm27xx/patches-6.1/950-0437-usb-xhci-expand-mitigations-for-VLI_SS_BULK_OUT_BUG-.patch
new file mode 100644
index 00000000000000..9b46c5ea5b14af
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0437-usb-xhci-expand-mitigations-for-VLI_SS_BULK_OUT_BUG-.patch
@@ -0,0 +1,89 @@
+From c843ba12fdedd07ddd809c84740f4b585839599b Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Thu, 8 Sep 2022 15:50:15 +0100
+Subject: [PATCH] usb: xhci: expand mitigations for VLI_SS_BULK_OUT_BUG
+ quirk
+
+The VL805 can cause data corruption if a SS Bulk OUT endpoint enters a
+flow-control condition and there are TRBs in the transfer ring that are
+not an integral size of wMaxPacket and the endpoint is behind one or more
+hubs.
+
+This is frequently the case encountered when FAT32 filesystems are
+present on mass-storage devices with cluster sizes of 1 sector, and the
+filesystem is being written to with an aggregate of small files.
+
+The initial implementation of this quirk separated TRBs that didn't
+adhere to this limitation into two - the first a multiple of wMaxPacket
+and the second the 512-byte remainder - in an attempt to force TD
+fragments to align with packet boundaries. This reduced the incidence
+rate of data corruption but did not resolve it.
+
+The fix as recommended by VIA is to disable bursts if this sequence of
+TRBs can occur.
+
+Limit turning off bursts to just USB mass-storage devices by searching
+the device's configuration for an interface with a class type of
+USB_CLASS_MASS_STORAGE.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci-mem.c | 31 ++++++++++++++++++++++++++++++-
+ 1 file changed, 30 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1437,6 +1437,7 @@ int xhci_endpoint_init(struct xhci_hcd *
+ 	unsigned int ep_index;
+ 	struct xhci_ep_ctx *ep_ctx;
+ 	struct xhci_ring *ep_ring;
++	struct usb_interface_cache *intfc;
+ 	unsigned int max_packet;
+ 	enum xhci_ring_type ring_type;
+ 	u32 max_esit_payload;
+@@ -1446,6 +1447,8 @@ int xhci_endpoint_init(struct xhci_hcd *
+ 	unsigned int mult;
+ 	unsigned int avg_trb_len;
+ 	unsigned int err_count = 0;
++	unsigned int is_ums_dev = 0;
++	unsigned int i;
+ 
+ 	ep_index = xhci_get_endpoint_index(&ep->desc);
+ 	ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, ep_index);
+@@ -1477,9 +1480,35 @@ int xhci_endpoint_init(struct xhci_hcd *
+ 
+ 	mult = xhci_get_endpoint_mult(udev, ep);
+ 	max_packet = usb_endpoint_maxp(&ep->desc);
+-	max_burst = xhci_get_endpoint_max_burst(udev, ep);
+ 	avg_trb_len = max_esit_payload;
+ 
++	/*
++	 * VL805 errata - Bulk OUT bursts to superspeed mass-storage
++	 * devices behind hub ports can cause data corruption with
++	 * non-wMaxPacket-multiple transfers.
++	 */
++	for (i = 0; i < udev->config->desc.bNumInterfaces; i++) {
++		intfc = udev->config->intf_cache[i];
++		/*
++		 * Slight hack - look at interface altsetting 0, which
++		 * should be the UMS bulk-only interface. If the class
++		 * matches, then we disable out bursts for all OUT
++		 * endpoints because endpoint assignments may change
++		 * between alternate settings.
++		 */
++		if (intfc->altsetting[0].desc.bInterfaceClass ==
++		    USB_CLASS_MASS_STORAGE) {
++			is_ums_dev = 1;
++			break;
++		}
++	}
++	if (xhci->quirks & XHCI_VLI_SS_BULK_OUT_BUG &&
++	    usb_endpoint_is_bulk_out(&ep->desc) && is_ums_dev &&
++	    udev->route)
++		max_burst = 0;
++	else
++		max_burst = xhci_get_endpoint_max_burst(udev, ep);
++
+ 	/* FIXME dig Mult and streams info out of ep companion desc */
+ 
+ 	/* Allow 3 retries for everything but isoc, set CErr = 3 */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0438-usb-xhci-account-for-num_trbs_free-when-invalidating.patch b/target/linux/bcm27xx/patches-6.1/950-0438-usb-xhci-account-for-num_trbs_free-when-invalidating.patch
new file mode 100644
index 00000000000000..e67561ce095821
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0438-usb-xhci-account-for-num_trbs_free-when-invalidating.patch
@@ -0,0 +1,84 @@
+From 18f08bf8df95c687d6fee3d2bb747cbd2fa0b878 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Thu, 22 Sep 2022 14:55:54 +0100
+Subject: [PATCH] usb: xhci: account for num_trbs_free when
+ invalidating TDs
+
+If a ring has a number of TDs enqueued past the dequeue pointer, and the
+URBs corresponding to these TDs are dequeued, then num_trbs_free isn't
+updated to show that these TDs have been converted to no-ops and
+effectively "freed". This means that num_trbs_free creeps downwards
+until the count is exhausted, which then triggers xhci_ring_expansion()
+and effectively leaks memory by infinitely growing the transfer ring.
+
+This is commonly encounted through the use of a usb-serial port where
+the port is repeatedly opened, read, then closed.
+
+Move the num_trbs_free crediting out of the Set TR Dequeue Pointer
+handling and into xhci_invalidate_cancelled_tds().
+
+There is a potential for overestimating the actual space on the ring if
+the ring is nearly full and TDs are arbitrarily enqueued by a device
+driver while it is dequeueing them, but dequeues are usually batched
+during device close/shutdown or endpoint error recovery.
+
+See https://github.com/raspberrypi/linux/issues/5088
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci-ring.c | 14 +++-----------
+ 1 file changed, 3 insertions(+), 11 deletions(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1035,11 +1035,13 @@ static int xhci_invalidate_cancelled_tds
+ 						 td->urb->stream_id, td->urb,
+ 						 cached_td->urb->stream_id, cached_td->urb);
+ 				cached_td = td;
++				ring->num_trbs_free += td->num_trbs;
+ 				break;
+ 			}
+ 		} else {
+ 			td_to_noop(xhci, ring, td, false);
+ 			td->cancel_status = TD_CLEARED;
++			ring->num_trbs_free += td->num_trbs;
+ 		}
+ 	}
+ 
+@@ -1287,10 +1289,7 @@ static void update_ring_for_set_deq_comp
+ 		unsigned int ep_index)
+ {
+ 	union xhci_trb *dequeue_temp;
+-	int num_trbs_free_temp;
+-	bool revert = false;
+ 
+-	num_trbs_free_temp = ep_ring->num_trbs_free;
+ 	dequeue_temp = ep_ring->dequeue;
+ 
+ 	/* If we get two back-to-back stalls, and the first stalled transfer
+@@ -1305,8 +1304,6 @@ static void update_ring_for_set_deq_comp
+ 	}
+ 
+ 	while (ep_ring->dequeue != dev->eps[ep_index].queued_deq_ptr) {
+-		/* We have more usable TRBs */
+-		ep_ring->num_trbs_free++;
+ 		ep_ring->dequeue++;
+ 		if (trb_is_link(ep_ring->dequeue)) {
+ 			if (ep_ring->dequeue ==
+@@ -1316,15 +1313,10 @@ static void update_ring_for_set_deq_comp
+ 			ep_ring->dequeue = ep_ring->deq_seg->trbs;
+ 		}
+ 		if (ep_ring->dequeue == dequeue_temp) {
+-			revert = true;
++			xhci_dbg(xhci, "Unable to find new dequeue pointer\n");
+ 			break;
+ 		}
+ 	}
+-
+-	if (revert) {
+-		xhci_dbg(xhci, "Unable to find new dequeue pointer\n");
+-		ep_ring->num_trbs_free = num_trbs_free_temp;
+-	}
+ }
+ 
+ /*
diff --git a/target/linux/bcm27xx/patches-6.1/950-0439-nvmem-Use-NVMEM_DEVID_AUTO.patch b/target/linux/bcm27xx/patches-6.1/950-0439-nvmem-Use-NVMEM_DEVID_AUTO.patch
new file mode 100644
index 00000000000000..1758d3e1627a06
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0439-nvmem-Use-NVMEM_DEVID_AUTO.patch
@@ -0,0 +1,27 @@
+From 10fcafcad54e1d055b6b67881a5b52b95dbd2da3 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 7 Oct 2022 10:38:31 +0100
+Subject: [PATCH] nvmem: Use NVMEM_DEVID_AUTO
+
+It is reasonable to declare multiple nvmem blocks. Unless a unique 'id'
+is passed in for each block there may be name clashes.
+
+Avoid this by using the magic token NVMEM_DEVID_AUTO.
+
+Fixes: 5a3fa75a4d9cb ("nvmem: Add driver to expose reserved memory as nvmem")
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/nvmem/rmem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/nvmem/rmem.c
++++ b/drivers/nvmem/rmem.c
+@@ -71,6 +71,7 @@ static int rmem_probe(struct platform_de
+ 	config.dev = dev;
+ 	config.priv = priv;
+ 	config.name = "rmem";
++	config.id = NVMEM_DEVID_AUTO;
+ 	config.size = mem->size;
+ 	config.reg_read = rmem_read;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0440-drm-panel-Rename-GEM-CMA-helpers-GEM-DMA-helpers.patch b/target/linux/bcm27xx/patches-6.1/950-0440-drm-panel-Rename-GEM-CMA-helpers-GEM-DMA-helpers.patch
new file mode 100644
index 00000000000000..14a6b7063fa7fd
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0440-drm-panel-Rename-GEM-CMA-helpers-GEM-DMA-helpers.patch
@@ -0,0 +1,35 @@
+From e305f541c34d109a0c415048f5779179d802e0f4 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 18 Oct 2022 16:36:47 +0100
+Subject: [PATCH] drm/panel: Rename GEM CMA helpers GEM DMA helpers
+
+As a result of [1], DRM_GEM_CMA_HELPER has been replaced by
+DRM_GEM_CMA_HELPER.
+
+[1] 4a83c26a1d87 ("drm/gem: rename GEM CMA helpers to GEM DMA helpers")
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/gpu/drm/panel/Kconfig | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/panel/Kconfig
++++ b/drivers/gpu/drm/panel/Kconfig
+@@ -178,7 +178,7 @@ config DRM_PANEL_ILITEK_ILI9806E
+ 	tristate "Ilitek ILI9806E-based panels"
+ 	depends on OF && SPI
+ 	select DRM_KMS_HELPER
+-	depends on DRM_GEM_CMA_HELPER
++	depends on DRM_GEM_DMA_HELPER
+ 	depends on BACKLIGHT_CLASS_DEVICE
+ 	select DRM_MIPI_DBI
+ 	help
+@@ -673,7 +673,7 @@ config DRM_PANEL_TPO_Y17P
+ 	tristate "TDO Y17P-based panels"
+ 	depends on OF && SPI
+ 	select DRM_KMS_HELPER
+-	depends on DRM_GEM_CMA_HELPER
++	depends on DRM_GEM_DMA_HELPER
+ 	depends on BACKLIGHT_CLASS_DEVICE
+ 	select DRM_MIPI_DBI
+ 	help
diff --git a/target/linux/bcm27xx/patches-6.1/950-0441-hwmon-emc2305-fixups-for-driver-submitted-to-mailing.patch b/target/linux/bcm27xx/patches-6.1/950-0441-hwmon-emc2305-fixups-for-driver-submitted-to-mailing.patch
new file mode 100644
index 00000000000000..abb1eacef2403e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0441-hwmon-emc2305-fixups-for-driver-submitted-to-mailing.patch
@@ -0,0 +1,163 @@
+From c53aee9d78372213c34f5ebfb084b58be754a23c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 5 May 2022 15:46:07 +0100
+Subject: [PATCH] hwmon: emc2305: fixups for driver submitted to
+ mailing lists
+
+The driver had a number of issues, checkpatch warnings/errors,
+and other limitations, so fix these up to make it usable.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/hwmon/emc2305.c | 73 +++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 71 insertions(+), 2 deletions(-)
+
+--- a/drivers/hwmon/emc2305.c
++++ b/drivers/hwmon/emc2305.c
+@@ -15,12 +15,13 @@
+ static const unsigned short
+ emc2305_normal_i2c[] = { 0x27, 0x2c, 0x2d, 0x2e, 0x2f, 0x4c, 0x4d, I2C_CLIENT_END };
+ 
++#define EMC2305_REG_FAN_STATUS		0x24
++#define EMC2305_REG_FAN_STALL_STATUS	0x25
+ #define EMC2305_REG_DRIVE_FAIL_STATUS	0x27
+ #define EMC2305_REG_VENDOR		0xfe
+ #define EMC2305_FAN_MAX			0xff
+ #define EMC2305_FAN_MIN			0x00
+ #define EMC2305_FAN_MAX_STATE		10
+-#define EMC2305_DEVICE			0x34
+ #define EMC2305_VENDOR			0x5d
+ #define EMC2305_REG_PRODUCT_ID		0xfd
+ #define EMC2305_TACH_REGS_UNUSE_BITS	3
+@@ -39,6 +40,7 @@ emc2305_normal_i2c[] = { 0x27, 0x2c, 0x2
+ #define EMC2305_RPM_FACTOR		3932160
+ 
+ #define EMC2305_REG_FAN_DRIVE(n)	(0x30 + 0x10 * (n))
++#define EMC2305_REG_FAN_CFG(n)		(0x32 + 0x10 * (n))
+ #define EMC2305_REG_FAN_MIN_DRIVE(n)	(0x38 + 0x10 * (n))
+ #define EMC2305_REG_FAN_TACH(n)		(0x3e + 0x10 * (n))
+ 
+@@ -58,6 +60,15 @@ static const struct i2c_device_id emc230
+ };
+ MODULE_DEVICE_TABLE(i2c, emc2305_ids);
+ 
++static const struct of_device_id emc2305_dt_ids[] = {
++	{ .compatible = "microchip,emc2305" },
++	{ .compatible = "microchip,emc2303" },
++	{ .compatible = "microchip,emc2302" },
++	{ .compatible = "microchip,emc2301" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, emc2305_dt_ids);
++
+ /**
+  * @cdev: cooling device;
+  * @curr_state: cooling current state;
+@@ -101,6 +112,7 @@ struct emc2305_data {
+ 	u8 pwm_num;
+ 	bool pwm_separate;
+ 	u8 pwm_min[EMC2305_PWM_MAX];
++	u8 pwm_max;
+ 	struct emc2305_cdev_data cdev_data[EMC2305_PWM_MAX];
+ };
+ 
+@@ -273,7 +285,7 @@ static int emc2305_set_pwm(struct device
+ 	struct i2c_client *client = data->client;
+ 	int ret;
+ 
+-	if (val < data->pwm_min[channel] || val > EMC2305_FAN_MAX)
++	if (val < data->pwm_min[channel] || val > data->pwm_max)
+ 		return -EINVAL;
+ 
+ 	ret = i2c_smbus_write_byte_data(client, EMC2305_REG_FAN_DRIVE(channel), val);
+@@ -284,6 +296,49 @@ static int emc2305_set_pwm(struct device
+ 	return 0;
+ }
+ 
++static int emc2305_get_tz_of(struct device *dev)
++{
++	struct device_node *np = dev->of_node;
++	struct emc2305_data *data = dev_get_drvdata(dev);
++	int ret = 0;
++	u32 val;
++	int i;
++
++	/* OF parameters are optional - overwrite default setting
++	 * if some of them are provided.
++	 */
++
++	ret = of_property_read_u32(np, "emc2305,cooling-levels", &val);
++	if (!ret)
++		data->max_state = (u8)val;
++	else if (ret != -EINVAL)
++		return ret;
++
++	ret = of_property_read_u32(np, "emc2305,pwm-max", &val);
++	if (!ret)
++		data->pwm_max = (u8)val;
++	else if (ret != -EINVAL)
++		return ret;
++
++	ret = of_property_read_u32(np, "emc2305,pwm-min", &val);
++	if (!ret)
++		for (i = 0; i < EMC2305_PWM_MAX; i++)
++			data->pwm_min[i] = (u8)val;
++	else if (ret != -EINVAL)
++		return ret;
++
++	/* Not defined or 0 means one thermal zone over all cooling devices.
++	 * Otherwise - separated thermal zones for each PWM channel.
++	 */
++	ret = of_property_read_u32(np, "emc2305,pwm-channel", &val);
++	if (!ret)
++		data->pwm_separate = (val != 0);
++	else if (ret != -EINVAL)
++		return ret;
++
++	return 0;
++}
++
+ static int emc2305_set_single_tz(struct device *dev, int idx)
+ {
+ 	struct emc2305_data *data = dev_get_drvdata(dev);
+@@ -572,11 +627,18 @@ static int emc2305_probe(struct i2c_clie
+ 		data->pwm_separate = pdata->pwm_separate;
+ 		for (i = 0; i < EMC2305_PWM_MAX; i++)
+ 			data->pwm_min[i] = pdata->pwm_min[i];
++		data->pwm_max = EMC2305_FAN_MAX;
+ 	} else {
+ 		data->max_state = EMC2305_FAN_MAX_STATE;
+ 		data->pwm_separate = false;
+ 		for (i = 0; i < EMC2305_PWM_MAX; i++)
+ 			data->pwm_min[i] = EMC2305_FAN_MIN;
++		data->pwm_max = EMC2305_FAN_MAX;
++		if (dev->of_node) {
++			ret = emc2305_get_tz_of(dev);
++			if (ret < 0)
++				return ret;
++		}
+ 	}
+ 
+ 	data->hwmon_dev = devm_hwmon_device_register_with_info(dev, "emc2305", data,
+@@ -597,6 +659,12 @@ static int emc2305_probe(struct i2c_clie
+ 			return ret;
+ 	}
+ 
++	/* Acknowledge any existing faults. Stops the device responding on the
++	 * SMBus alert address.
++	 */
++	i2c_smbus_read_byte_data(client, EMC2305_REG_FAN_STALL_STATUS);
++	i2c_smbus_read_byte_data(client, EMC2305_REG_FAN_STATUS);
++
+ 	return 0;
+ }
+ 
+@@ -612,6 +680,7 @@ static struct i2c_driver emc2305_driver
+ 	.class  = I2C_CLASS_HWMON,
+ 	.driver = {
+ 		.name = "emc2305",
++		.of_match_table = emc2305_dt_ids,
+ 	},
+ 	.probe    = emc2305_probe,
+ 	.remove	  = emc2305_remove,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0442-media-bcm2835-unicam-Fix-up-start-stop-api-change.patch b/target/linux/bcm27xx/patches-6.1/950-0442-media-bcm2835-unicam-Fix-up-start-stop-api-change.patch
new file mode 100644
index 00000000000000..d7b56e9d547ead
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0442-media-bcm2835-unicam-Fix-up-start-stop-api-change.patch
@@ -0,0 +1,39 @@
+From bfaa98808955e8f1984a1fee7bdc31add1ea72a7 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Mon, 24 Oct 2022 13:57:23 +0100
+Subject: [PATCH] media: bcm2835-unicam: Fix up start/stop api change
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -2524,7 +2524,7 @@ static int unicam_start_streaming(struct
+ 		goto err_streaming;
+ 	}
+ 
+-	ret = media_pipeline_start(&node->video_dev.entity, &node->pipe);
++	ret = media_pipeline_start(node->video_dev.entity.pads, &node->pipe);
+ 	if (ret < 0) {
+ 		unicam_err(dev, "Failed to start media pipeline: %d\n", ret);
+ 		goto err_pm_put;
+@@ -2618,7 +2618,7 @@ err_vpu_clock:
+ 		unicam_err(dev, "failed to reset the VPU clock\n");
+ 	clk_disable_unprepare(dev->vpu_clock);
+ error_pipeline:
+-	media_pipeline_stop(&node->video_dev.entity);
++	media_pipeline_stop(node->video_dev.entity.pads);
+ err_pm_put:
+ 	unicam_runtime_put(dev);
+ err_streaming:
+@@ -2646,7 +2646,7 @@ static void unicam_stop_streaming(struct
+ 
+ 		unicam_disable(dev);
+ 
+-		media_pipeline_stop(&node->video_dev.entity);
++		media_pipeline_stop(node->video_dev.entity.pads);
+ 
+ 		if (dev->clocks_enabled) {
+ 			if (clk_set_min_rate(dev->vpu_clock, 0))
diff --git a/target/linux/bcm27xx/patches-6.1/950-0443-drivers-usb-dwc_otg-fix-reference-passing-when-check.patch b/target/linux/bcm27xx/patches-6.1/950-0443-drivers-usb-dwc_otg-fix-reference-passing-when-check.patch
new file mode 100644
index 00000000000000..ffe3c4f955e36f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0443-drivers-usb-dwc_otg-fix-reference-passing-when-check.patch
@@ -0,0 +1,59 @@
+From 366250d6009a093ad8843a3721148aad7b45b291 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Tue, 25 Oct 2022 10:50:10 +0100
+Subject: [PATCH] drivers: usb: dwc_otg: fix reference passing when
+ checking bandwidth
+
+The pointer (struct usb_host_endpoint *)->hcpriv should contain a
+reference to dwc_otg_qh_t if the driver has already seen a URB submitted
+to this endpoint.
+
+It then checks whether the qh exists and is already in a schedule in
+order to decide whether to allocate periodic bandwidth or not. Passing a
+pointer to an offset inside of struct usb_host_endpoint instead of just
+the pointer means it dereferences bogus addresses.
+
+Rationalise (delete) a variable while we're at it.
+
+See https://github.com/raspberrypi/linux/issues/5189
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
++++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
+@@ -807,7 +807,6 @@ static int dwc_otg_urb_enqueue(struct us
+ 	struct usb_host_endpoint *ep = urb->ep;
+ #endif
+ 	dwc_irqflags_t irqflags;
+-        void **ref_ep_hcpriv = &ep->hcpriv;
+ 	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
+ 	dwc_otg_hcd_urb_t *dwc_otg_urb;
+ 	int i;
+@@ -824,7 +823,7 @@ static int dwc_otg_urb_enqueue(struct us
+ 	if ((usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
+ 	    || (usb_pipetype(urb->pipe) == PIPE_INTERRUPT)) {
+ 		if (!dwc_otg_hcd_is_bandwidth_allocated
+-		    (dwc_otg_hcd, ref_ep_hcpriv)) {
++		    (dwc_otg_hcd, ep->hcpriv)) {
+ 			alloc_bandwidth = 1;
+ 		}
+ 	}
+@@ -910,13 +909,12 @@ static int dwc_otg_urb_enqueue(struct us
+ #endif
+ 	{
+ 		retval = dwc_otg_hcd_urb_enqueue(dwc_otg_hcd, dwc_otg_urb,
+-						/*(dwc_otg_qh_t **)*/
+-						ref_ep_hcpriv, 1);
++						&ep->hcpriv, 1);
+ 		if (0 == retval) {
+ 			if (alloc_bandwidth) {
+ 				allocate_bus_bandwidth(hcd,
+ 						dwc_otg_hcd_get_ep_bandwidth(
+-							dwc_otg_hcd, *ref_ep_hcpriv),
++							dwc_otg_hcd, ep->hcpriv),
+ 						urb);
+ 			}
+ 		} else {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0444-drivers-gpu-drm-vc4-Add-missing-32-bit-RGB-formats.patch b/target/linux/bcm27xx/patches-6.1/950-0444-drivers-gpu-drm-vc4-Add-missing-32-bit-RGB-formats.patch
new file mode 100644
index 00000000000000..8f8e0184b794c4
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0444-drivers-gpu-drm-vc4-Add-missing-32-bit-RGB-formats.patch
@@ -0,0 +1,50 @@
+From bfdb79d68e27c16a8b3ef43e77f95958774d1bd1 Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Mon, 17 Oct 2022 15:18:24 +0100
+Subject: [PATCH] drivers/gpu/drm/vc4: Add missing 32-bit RGB formats
+
+The missing 32-bit per pixel ABGR and various "RGB with an X value"
+formats are added. Change sent by Dave Stevenson.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_firmware_kms.c | 28 +++++++++++++++-----------
+ 1 file changed, 16 insertions(+), 12 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+@@ -184,18 +184,22 @@ static const struct vc_image_format {
+ 		.drm = DRM_FORMAT_ARGB8888,
+ 		.vc_image = VC_IMAGE_ARGB8888,
+ 	},
+-/*
+- *	FIXME: Need to resolve which DRM format goes to which vc_image format
+- *	for the remaining RGBA and RGBX formats.
+- *	{
+- *		.drm = DRM_FORMAT_ABGR8888,
+- *		.vc_image = VC_IMAGE_RGBA8888,
+- *	},
+- *	{
+- *		.drm = DRM_FORMAT_XBGR8888,
+- *		.vc_image = VC_IMAGE_RGBA8888,
+- *	},
+- */
++	{
++		.drm = DRM_FORMAT_XBGR8888,
++		.vc_image = VC_IMAGE_RGBX32,
++	},
++	{
++		.drm = DRM_FORMAT_ABGR8888,
++		.vc_image = VC_IMAGE_RGBA32,
++	},
++	{
++		.drm = DRM_FORMAT_RGBX8888,
++		.vc_image = VC_IMAGE_BGRX8888,
++	},
++	{
++		.drm = DRM_FORMAT_BGRX8888,
++		.vc_image = VC_IMAGE_RGBX8888,
++	},
+ 	{
+ 		.drm = DRM_FORMAT_RGB565,
+ 		.vc_image = VC_IMAGE_RGB565,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0445-overlays-Add-i2c-sensor-support-for-AHT10.patch b/target/linux/bcm27xx/patches-6.1/950-0445-overlays-Add-i2c-sensor-support-for-AHT10.patch
new file mode 100644
index 00000000000000..30be68169f1510
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0445-overlays-Add-i2c-sensor-support-for-AHT10.patch
@@ -0,0 +1,58 @@
+From 028a15d99246ddf1ac126586a5680faab59e6a86 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 25 Oct 2022 20:27:00 +0100
+Subject: [PATCH] overlays: Add i2c-sensor support for AHT10
+
+Add support for the Aosong AHT10 temperature and humidity sensor.
+
+See: https://github.com/raspberrypi/linux/issues/5222
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README                 |  3 +++
+ arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi | 15 +++++++++++++++
+ 2 files changed, 18 insertions(+)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -1933,6 +1933,9 @@ Params: addr                    Set the
+                                 BMP280, CCS811, DS1621, HDC100X, LM75, SHT3x or
+                                 TMP102
+ 
++        aht10                   Select the Aosong AHT10 temperature and humidity
++                                sensor
++
+         bh1750                  Select the Rohm BH1750 ambient light sensor
+                                 Valid addresses 0x23 or 0x5c, default 0x23
+ 
+--- a/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+@@ -309,6 +309,20 @@
+ 		};
+ 	};
+ 
++	fragment@20 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			aht10: aht10@38 {
++				compatible = "aosong,aht10";
++				reg = <0x38>;
++			};
++		};
++	};
++
+ 	__overrides__ {
+ 		bme280 = <0>,"+0";
+ 		bmp085 = <0>,"+1";
+@@ -331,6 +345,7 @@
+ 		ccs811 = <0>, "+17";
+ 		bh1750 = <0>, "+18";
+ 		max30102 = <0>,"+19";
++		aht10 = <0>,"+20";
+ 
+ 		addr =  <&bme280>,"reg:0", <&bmp280>,"reg:0", <&tmp102>,"reg:0",
+ 			<&lm75>,"reg:0", <&hdc100x>,"reg:0", <&sht3x>,"reg:0",
diff --git a/target/linux/bcm27xx/patches-6.1/950-0446-overlays-Add-README-entry-for-i2c-rtc-rv3032.patch b/target/linux/bcm27xx/patches-6.1/950-0446-overlays-Add-README-entry-for-i2c-rtc-rv3032.patch
new file mode 100644
index 00000000000000..1dc4bb6a57faf9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0446-overlays-Add-README-entry-for-i2c-rtc-rv3032.patch
@@ -0,0 +1,30 @@
+From dd2870ac96dd1cc5234ba674f4ea5a0e408235d5 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 25 Oct 2022 20:08:51 +0100
+Subject: [PATCH] overlays: Add README entry for i2c-rtc,rv3032
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -1808,6 +1808,8 @@ Params: abx80x                  Select o
+ 
+         rv3028                  Select the Micro Crystal RV3028 device
+ 
++        rv3032                  Select the Micro Crystal RV3032 device
++
+         rv8803                  Select the Micro Crystal RV8803 device
+ 
+         sd3078                  Select the ZXW Shenzhen whwave SD3078 device
+@@ -1892,6 +1894,8 @@ Params: abx80x                  Select o
+ 
+         rv3028                  Select the Micro Crystal RV3028 device
+ 
++        rv3032                  Select the Micro Crystal RV3032 device
++
+         rv8803                  Select the Micro Crystal RV8803 device
+ 
+         sd3078                  Select the ZXW Shenzhen whwave SD3078 device
diff --git a/target/linux/bcm27xx/patches-6.1/950-0447-drivers-dwc_otg-stop-GCC-from-patching-FIQ-functions.patch b/target/linux/bcm27xx/patches-6.1/950-0447-drivers-dwc_otg-stop-GCC-from-patching-FIQ-functions.patch
new file mode 100644
index 00000000000000..f017549ee5726b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0447-drivers-dwc_otg-stop-GCC-from-patching-FIQ-functions.patch
@@ -0,0 +1,43 @@
+From 63c794845de126d36d75c7d992fa2e5221651b1b Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 26 Oct 2022 17:46:44 +0100
+Subject: [PATCH] drivers: dwc_otg: stop GCC from patching FIQ
+ functions
+
+Configuring GCC to use task stack protector canaries means it will
+insert calls to check functions in FIQ code. This is bad, as a) the
+FIQ's stack is banked and b) the failure invokes __stack_chk_fail which
+eventually tries to call printk(). Printing to the console inside the
+FIQ is generally fatal.
+
+Add CFLAGS to stop this happening in FIQ code.
+
+Also catch one function where notrace wasn't specified.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/dwc_otg/Makefile          | 1 +
+ drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/dwc_otg/Makefile
++++ b/drivers/usb/host/dwc_otg/Makefile
+@@ -28,6 +28,7 @@ ccflags-y   	+= -DDWC_LINUX
+ ccflags-y   	+= $(CFI)
+ ccflags-y	+= $(BUS_INTERFACE)
+ #ccflags-y	+= -DDWC_DEV_SRPCAP
++CFLAGS_dwc_otg_fiq_fsm.o += -fno-stack-protector
+ 
+ obj-$(CONFIG_USB_DWCOTG) += dwc_otg.o
+ 
+--- a/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
++++ b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
+@@ -142,7 +142,7 @@ inline void fiq_fsm_spin_unlock(fiq_lock
+  * fiq_fsm_restart_channel() - Poke channel enable bit for a split transaction
+  * @channel: channel to re-enable
+  */
+-static void fiq_fsm_restart_channel(struct fiq_state *st, int n, int force)
++static void notrace fiq_fsm_restart_channel(struct fiq_state *st, int n, int force)
+ {
+ 	hcchar_data_t hcchar = { .d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR) };
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0448-overlays-i2c-sensor-Add-mcp980x-support.patch b/target/linux/bcm27xx/patches-6.1/950-0448-overlays-i2c-sensor-Add-mcp980x-support.patch
new file mode 100644
index 00000000000000..a43886ea9e3b13
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0448-overlays-i2c-sensor-Add-mcp980x-support.patch
@@ -0,0 +1,63 @@
+From 4fdc12dae89db7fd02bfbef1a15a0b78263a7764 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 1 Nov 2022 08:47:21 +0000
+Subject: [PATCH] overlays: i2c-sensor: Add mcp980x support
+
+See: https://github.com/raspberrypi/linux/issues/5234
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README               |  4 ++++
+ .../boot/dts/overlays/i2c-sensor-common.dtsi    | 17 ++++++++++++++++-
+ 2 files changed, 20 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -1981,6 +1981,10 @@ Params: addr                    Set the
+         max30102                Select the Maxim Integrated MAX30102 heart-rate
+                                 and blood-oxygen sensor
+ 
++        mcp980x                 Select the Maxim MCP980x range of temperature
++                                sensors (e.g. MCP9808).
++                                Valid addresses are 0x18-0x1f (default 0x18)
++
+         sht3x                   Select the Sensiron SHT3x temperature and
+                                 humidity sensor. Valid addresses 0x44-0x45,
+                                 default 0x44
+--- a/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+@@ -323,6 +323,20 @@
+ 		};
+ 	};
+ 
++	fragment@21 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			mcp980x: mcp980x@18 {
++				compatible = "maxim,mcp980x";
++				reg = <0x18>;
++			};
++		};
++	};
++
+ 	__overrides__ {
+ 		bme280 = <0>,"+0";
+ 		bmp085 = <0>,"+1";
+@@ -346,11 +360,12 @@
+ 		bh1750 = <0>, "+18";
+ 		max30102 = <0>,"+19";
+ 		aht10 = <0>,"+20";
++		mcp980x = <0>,"+21";
+ 
+ 		addr =  <&bme280>,"reg:0", <&bmp280>,"reg:0", <&tmp102>,"reg:0",
+ 			<&lm75>,"reg:0", <&hdc100x>,"reg:0", <&sht3x>,"reg:0",
+ 			<&ds1621>,"reg:0", <&bme680>,"reg:0", <&ccs811>,"reg:0",
+-			<&bh1750>,"reg:0";
++			<&bh1750>,"reg:0", <&mcp980x>,"reg:0";
+ 		int_pin = <&max30102>, "interrupts:0";
+ 	};
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0449-overlays-pisound-Make-button-pins-owned-by-card.patch b/target/linux/bcm27xx/patches-6.1/950-0449-overlays-pisound-Make-button-pins-owned-by-card.patch
new file mode 100644
index 00000000000000..fbdb8ba209c9a1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0449-overlays-pisound-Make-button-pins-owned-by-card.patch
@@ -0,0 +1,49 @@
+From 028e7d32c62c7cd277b23990d29fc71e43f1f66b Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 2 Nov 2022 09:54:39 +0000
+Subject: [PATCH] overlays: pisound: Make button pins owned by card
+
+The pisound overlay claims a number of GPIOs using a pinctrl node, but
+for some reason hangs this claim on the main gpio node. This obscures
+the ownership of the pins (as shown by gpioinfo and in the kernel logs)
+and isn't scalable - only one overlay can use the trick at a time.
+
+Change the overlay to make the pin ownership clear and avoid any future
+conflicts, removing a bogus claim on pins_spi0 at the same time.
+
+See: https://github.com/raspberrypi/linux/issues/5235
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/pisound-overlay.dts | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/pisound-overlay.dts
++++ b/arch/arm/boot/dts/overlays/pisound-overlay.dts
+@@ -55,8 +55,6 @@
+ 			pisound_spi: pisound_spi@0{
+ 				compatible = "blokaslabs,pisound-spi";
+ 				reg = <0>;
+-				pinctrl-names = "default";
+-				pinctrl-0 = <&spi0_pins>;
+ 				spi-max-frequency = <1000000>;
+ 			};
+ 		};
+@@ -80,6 +78,7 @@
+ 			i2s-controller = <&i2s>;
+ 			status = "okay";
+ 
++			pinctrl-names = "default";
+ 			pinctrl-0 = <&pisound_button_pins>;
+ 
+ 			osr-gpios =
+@@ -100,9 +99,6 @@
+ 	fragment@6 {
+ 		target = <&gpio>;
+ 		__overlay__ {
+-			pinctrl-names = "default";
+-			pinctrl-0 = <&pisound_button_pins>;
+-
+ 			pisound_button_pins: pisound_button_pins {
+ 				brcm,pins = <17>;
+ 				brcm,function = <0>; // Input
diff --git a/target/linux/bcm27xx/patches-6.1/950-0450-firmware-raspberrypi-Introduce-rpi_firmware_find_nod.patch b/target/linux/bcm27xx/patches-6.1/950-0450-firmware-raspberrypi-Introduce-rpi_firmware_find_nod.patch
new file mode 100644
index 00000000000000..9feea59a373c11
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0450-firmware-raspberrypi-Introduce-rpi_firmware_find_nod.patch
@@ -0,0 +1,76 @@
+From 7069072c10f54de136613947a5b82f504e5f8478 Mon Sep 17 00:00:00 2001
+From: "maxime@cerno.tech" <maxime@cerno.tech>
+Date: Thu, 20 Oct 2022 11:12:09 +0200
+Subject: [PATCH] firmware: raspberrypi: Introduce
+ rpi_firmware_find_node()
+
+A significant number of RaspberryPi drivers using the firmware don't
+have a phandle to it, so end up scanning the device tree to find a node
+with the firmware compatible.
+
+That code is duplicated everywhere, so let's introduce a helper instead.
+
+Link: https://lore.kernel.org/r/20220815-rpi-fix-4k-60-v4-1-a1b40526df3e@cerno.tech
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/firmware/raspberrypi.c             | 18 ++++++++++++------
+ include/soc/bcm2835/raspberrypi-firmware.h |  7 +++++++
+ 2 files changed, 19 insertions(+), 6 deletions(-)
+
+--- a/drivers/firmware/raspberrypi.c
++++ b/drivers/firmware/raspberrypi.c
+@@ -429,6 +429,18 @@ static int rpi_firmware_remove(struct pl
+ 	return 0;
+ }
+ 
++static const struct of_device_id rpi_firmware_of_match[] = {
++	{ .compatible = "raspberrypi,bcm2835-firmware", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, rpi_firmware_of_match);
++
++struct device_node *rpi_firmware_find_node(void)
++{
++	return of_find_matching_node(NULL, rpi_firmware_of_match);
++}
++EXPORT_SYMBOL_GPL(rpi_firmware_find_node);
++
+ /**
+  * rpi_firmware_get - Get pointer to rpi_firmware structure.
+  * @firmware_node:    Pointer to the firmware Device Tree node.
+@@ -484,12 +496,6 @@ struct rpi_firmware *devm_rpi_firmware_g
+ }
+ EXPORT_SYMBOL_GPL(devm_rpi_firmware_get);
+ 
+-static const struct of_device_id rpi_firmware_of_match[] = {
+-	{ .compatible = "raspberrypi,bcm2835-firmware", },
+-	{},
+-};
+-MODULE_DEVICE_TABLE(of, rpi_firmware_of_match);
+-
+ static struct platform_driver rpi_firmware_driver = {
+ 	.driver = {
+ 		.name = "raspberrypi-firmware",
+--- a/include/soc/bcm2835/raspberrypi-firmware.h
++++ b/include/soc/bcm2835/raspberrypi-firmware.h
+@@ -168,6 +168,7 @@ int rpi_firmware_property(struct rpi_fir
+ int rpi_firmware_property_list(struct rpi_firmware *fw,
+ 			       void *data, size_t tag_size);
+ void rpi_firmware_put(struct rpi_firmware *fw);
++struct device_node *rpi_firmware_find_node(void);
+ struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node);
+ struct rpi_firmware *devm_rpi_firmware_get(struct device *dev,
+ 					   struct device_node *firmware_node);
+@@ -185,6 +186,12 @@ static inline int rpi_firmware_property_
+ }
+ 
+ static inline void rpi_firmware_put(struct rpi_firmware *fw) { }
++
++static inline struct device_node *rpi_firmware_find_node(void)
++{
++	return NULL;
++}
++
+ static inline struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node)
+ {
+ 	return NULL;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0451-firmware-raspberrypi-Move-the-clock-IDs-to-the-firmw.patch b/target/linux/bcm27xx/patches-6.1/950-0451-firmware-raspberrypi-Move-the-clock-IDs-to-the-firmw.patch
new file mode 100644
index 00000000000000..0b474a5d544236
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0451-firmware-raspberrypi-Move-the-clock-IDs-to-the-firmw.patch
@@ -0,0 +1,73 @@
+From 9f520509f20c5c56a0e092c5fb3c991d02420672 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Tue, 20 Sep 2022 13:43:19 +0200
+Subject: [PATCH] firmware: raspberrypi: Move the clock IDs to the
+ firmware header
+
+We'll need the clock IDs in more drivers than just the clock driver from
+now on, so let's move them in the firmware header.
+
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/clk/bcm/clk-raspberrypi.c          | 19 -------------------
+ include/soc/bcm2835/raspberrypi-firmware.h | 19 +++++++++++++++++++
+ 2 files changed, 19 insertions(+), 19 deletions(-)
+
+--- a/drivers/clk/bcm/clk-raspberrypi.c
++++ b/drivers/clk/bcm/clk-raspberrypi.c
+@@ -18,25 +18,6 @@
+ 
+ #include <soc/bcm2835/raspberrypi-firmware.h>
+ 
+-enum rpi_firmware_clk_id {
+-	RPI_FIRMWARE_EMMC_CLK_ID = 1,
+-	RPI_FIRMWARE_UART_CLK_ID,
+-	RPI_FIRMWARE_ARM_CLK_ID,
+-	RPI_FIRMWARE_CORE_CLK_ID,
+-	RPI_FIRMWARE_V3D_CLK_ID,
+-	RPI_FIRMWARE_H264_CLK_ID,
+-	RPI_FIRMWARE_ISP_CLK_ID,
+-	RPI_FIRMWARE_SDRAM_CLK_ID,
+-	RPI_FIRMWARE_PIXEL_CLK_ID,
+-	RPI_FIRMWARE_PWM_CLK_ID,
+-	RPI_FIRMWARE_HEVC_CLK_ID,
+-	RPI_FIRMWARE_EMMC2_CLK_ID,
+-	RPI_FIRMWARE_M2MC_CLK_ID,
+-	RPI_FIRMWARE_PIXEL_BVB_CLK_ID,
+-	RPI_FIRMWARE_VEC_CLK_ID,
+-	RPI_FIRMWARE_NUM_CLK_ID,
+-};
+-
+ static char *rpi_firmware_clk_names[] = {
+ 	[RPI_FIRMWARE_EMMC_CLK_ID]	= "emmc",
+ 	[RPI_FIRMWARE_UART_CLK_ID]	= "uart",
+--- a/include/soc/bcm2835/raspberrypi-firmware.h
++++ b/include/soc/bcm2835/raspberrypi-firmware.h
+@@ -160,6 +160,25 @@ enum rpi_firmware_property_tag {
+ 	RPI_FIRMWARE_GET_DMA_CHANNELS =                       0x00060001,
+ };
+ 
++enum rpi_firmware_clk_id {
++	RPI_FIRMWARE_EMMC_CLK_ID = 1,
++	RPI_FIRMWARE_UART_CLK_ID,
++	RPI_FIRMWARE_ARM_CLK_ID,
++	RPI_FIRMWARE_CORE_CLK_ID,
++	RPI_FIRMWARE_V3D_CLK_ID,
++	RPI_FIRMWARE_H264_CLK_ID,
++	RPI_FIRMWARE_ISP_CLK_ID,
++	RPI_FIRMWARE_SDRAM_CLK_ID,
++	RPI_FIRMWARE_PIXEL_CLK_ID,
++	RPI_FIRMWARE_PWM_CLK_ID,
++	RPI_FIRMWARE_HEVC_CLK_ID,
++	RPI_FIRMWARE_EMMC2_CLK_ID,
++	RPI_FIRMWARE_M2MC_CLK_ID,
++	RPI_FIRMWARE_PIXEL_BVB_CLK_ID,
++	RPI_FIRMWARE_VEC_CLK_ID,
++	RPI_FIRMWARE_NUM_CLK_ID,
++};
++
+ #define GET_DISPLAY_SETTINGS_PAYLOAD_SIZE 64
+ 
+ #if IS_ENABLED(CONFIG_RASPBERRYPI_FIRMWARE)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0452-firmware-raspberrypi-Provide-a-helper-to-query-a-clo.patch b/target/linux/bcm27xx/patches-6.1/950-0452-firmware-raspberrypi-Provide-a-helper-to-query-a-clo.patch
new file mode 100644
index 00000000000000..da30d57810a631
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0452-firmware-raspberrypi-Provide-a-helper-to-query-a-clo.patch
@@ -0,0 +1,96 @@
+From 4c64053e0646f66463bded712d7e6975757cf4c2 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Tue, 20 Sep 2022 13:49:10 +0200
+Subject: [PATCH] firmware: raspberrypi: Provide a helper to query a
+ clock max rate
+
+The firmware allows to query for its clocks the operating range of a
+given clock. We'll need this for some drivers (KMS, in particular) to
+infer the state of some configuration options, so let's create a
+function to do so.
+
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/firmware/raspberrypi.c             | 20 +++++++++++++++++
+ include/soc/bcm2835/raspberrypi-firmware.h | 26 ++++++++++++++++++++++
+ 2 files changed, 46 insertions(+)
+
+--- a/drivers/firmware/raspberrypi.c
++++ b/drivers/firmware/raspberrypi.c
+@@ -342,6 +342,26 @@ static void rpi_register_clk_driver(stru
+ 						-1, NULL, 0);
+ }
+ 
++unsigned int rpi_firmware_clk_get_max_rate(struct rpi_firmware *fw, unsigned int id)
++{
++	struct rpi_firmware_clk_rate_request msg =
++		RPI_FIRMWARE_CLK_RATE_REQUEST(id);
++	int ret;
++
++	ret = rpi_firmware_property(fw, RPI_FIRMWARE_GET_MAX_CLOCK_RATE,
++				    &msg, sizeof(msg));
++	if (ret)
++		/*
++		 * If our firmware doesn't support that operation, or fails, we
++		 * assume the maximum clock rate is absolute maximum we can
++		 * store over our type.
++		 */
++		 return UINT_MAX;
++
++	return le32_to_cpu(msg.rate);
++}
++EXPORT_SYMBOL_GPL(rpi_firmware_clk_get_max_rate);
++
+ static void rpi_firmware_delete(struct kref *kref)
+ {
+ 	struct rpi_firmware *fw = container_of(kref, struct rpi_firmware,
+--- a/include/soc/bcm2835/raspberrypi-firmware.h
++++ b/include/soc/bcm2835/raspberrypi-firmware.h
+@@ -181,12 +181,32 @@ enum rpi_firmware_clk_id {
+ 
+ #define GET_DISPLAY_SETTINGS_PAYLOAD_SIZE 64
+ 
++/**
++ * struct rpi_firmware_clk_rate_request - Firmware Request for a rate
++ * @id:	ID of the clock being queried
++ * @rate: Rate in Hertz. Set by the firmware.
++ *
++ * Used by @RPI_FIRMWARE_GET_CLOCK_RATE, @RPI_FIRMWARE_GET_CLOCK_MEASURED,
++ * @RPI_FIRMWARE_GET_MAX_CLOCK_RATE and @RPI_FIRMWARE_GET_MIN_CLOCK_RATE.
++ */
++struct rpi_firmware_clk_rate_request {
++	__le32 id;
++	__le32 rate;
++} __packed;
++
++#define RPI_FIRMWARE_CLK_RATE_REQUEST(_id)	\
++	{					\
++		.id = _id,			\
++	}
++
+ #if IS_ENABLED(CONFIG_RASPBERRYPI_FIRMWARE)
+ int rpi_firmware_property(struct rpi_firmware *fw,
+ 			  u32 tag, void *data, size_t len);
+ int rpi_firmware_property_list(struct rpi_firmware *fw,
+ 			       void *data, size_t tag_size);
+ void rpi_firmware_put(struct rpi_firmware *fw);
++unsigned int rpi_firmware_clk_get_max_rate(struct rpi_firmware *fw,
++					   unsigned int id);
+ struct device_node *rpi_firmware_find_node(void);
+ struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node);
+ struct rpi_firmware *devm_rpi_firmware_get(struct device *dev,
+@@ -206,6 +226,12 @@ static inline int rpi_firmware_property_
+ 
+ static inline void rpi_firmware_put(struct rpi_firmware *fw) { }
+ 
++static inline unsigned int rpi_firmware_clk_get_max_rate(struct rpi_firmware *fw,
++							 unsigned int id)
++{
++	return UINT_MAX;
++}
++
+ static inline struct device_node *rpi_firmware_find_node(void)
+ {
+ 	return NULL;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0453-drm-vc4-hdmi-Fix-hdmi_enable_4kp60-detection.patch b/target/linux/bcm27xx/patches-6.1/950-0453-drm-vc4-hdmi-Fix-hdmi_enable_4kp60-detection.patch
new file mode 100644
index 00000000000000..2dac12b8a2b69c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0453-drm-vc4-hdmi-Fix-hdmi_enable_4kp60-detection.patch
@@ -0,0 +1,47 @@
+From 98bd7718d38db5c3e8e8af83f30f9cab0d3c140d Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Thu, 24 Mar 2022 11:57:57 +0100
+Subject: [PATCH] drm/vc4: hdmi: Fix hdmi_enable_4kp60 detection
+
+In order to support higher HDMI frequencies, users have to set the
+hdmi_enable_4kp60 parameter in their config.txt file.
+
+We were detecting this so far by calling clk_round_rate() on the core
+clock with the frequency we're supposed to run at when one of those
+modes is enabled. Whether or not the parameter was enabled could then be
+inferred by the returned rate since the maximum clock rate reported by
+the firmware was one of the side effect of setting that parameter.
+
+However, the recent clock rework we did changed what clk_round_rate()
+was returning to always return the minimum allowed, and thus this test
+wasn't reliable anymore.
+
+Let's use the new clk_get_max_rate() function to reliably determine the
+maximum rate allowed on that clock and fix the 4k@60Hz output.
+
+Fixes: e9d6cea2af1c ("clk: bcm: rpi: Run some clocks at the minimum rate allowed")
+Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -46,6 +46,7 @@
+ #include <linux/pm_runtime.h>
+ #include <linux/rational.h>
+ #include <linux/reset.h>
++#include <soc/bcm2835/raspberrypi-clocks.h>
+ #include <sound/dmaengine_pcm.h>
+ #include <sound/hdmi-codec.h>
+ #include <sound/pcm_drm_eld.h>
+@@ -3695,7 +3696,7 @@ static int vc4_hdmi_bind(struct device *
+ 
+ 	if (variant->max_pixel_clock == 600000000) {
+ 		struct vc4_dev *vc4 = to_vc4_dev(drm);
+-		long max_rate = clk_round_rate(vc4->hvs->core_clk, 550000000);
++		unsigned int max_rate = rpi_firmware_clk_get_max_rate(vc4->hvs->core_clk);
+ 
+ 		if (max_rate < 550000000)
+ 			vc4_hdmi->disable_4kp60 = true;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0454-drm-vc4-hdmi-Rework-hdmi_enable_4kp60-detection-code.patch b/target/linux/bcm27xx/patches-6.1/950-0454-drm-vc4-hdmi-Rework-hdmi_enable_4kp60-detection-code.patch
new file mode 100644
index 00000000000000..4b77fe35162f7d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0454-drm-vc4-hdmi-Rework-hdmi_enable_4kp60-detection-code.patch
@@ -0,0 +1,170 @@
+From 1f8c105adca8bcd42256602e3ef9c1dbd0715e37 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Thu, 24 Mar 2022 11:57:57 +0100
+Subject: [PATCH] drm/vc4: hdmi: Rework hdmi_enable_4kp60 detection
+ code
+
+In order to support higher HDMI frequencies, users have to set the
+hdmi_enable_4kp60 parameter in their config.txt file.
+
+This will have the side-effect of raising the maximum of the core clock,
+tied to the HVS, and managed by the HVS driver.
+
+However, we are querying this in the HDMI driver by poking into the HVS
+structure to get our struct clk handle.
+
+Let's make this part of the HVS bind implementation to have all the core
+clock related setup in the same place.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/vc4_drv.h  | 10 ++++++++++
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 15 ++++-----------
+ drivers/gpu/drm/vc4/vc4_hdmi.h |  8 --------
+ drivers/gpu/drm/vc4/vc4_hvs.c  | 23 +++++++++++++++++++++++
+ 4 files changed, 37 insertions(+), 19 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -331,6 +331,8 @@ struct vc4_hvs {
+ 
+ 	struct clk *core_clk;
+ 
++	unsigned long max_core_rate;
++
+ 	/* Memory manager for CRTCs to allocate space in the display
+ 	 * list.  Units are dwords.
+ 	 */
+@@ -342,6 +344,14 @@ struct vc4_hvs {
+ 	struct drm_mm_node mitchell_netravali_filter;
+ 
+ 	struct debugfs_regset32 regset;
++
++	/*
++	 * Even if HDMI0 on the RPi4 can output modes requiring a pixel
++	 * rate higher than 297MHz, it needs some adjustments in the
++	 * config.txt file to be able to do so and thus won't always be
++	 * available.
++	 */
++	bool vc5_hdmi_enable_hdmi_20;
+ };
+ 
+ struct vc4_plane {
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -46,7 +46,6 @@
+ #include <linux/pm_runtime.h>
+ #include <linux/rational.h>
+ #include <linux/reset.h>
+-#include <soc/bcm2835/raspberrypi-clocks.h>
+ #include <sound/dmaengine_pcm.h>
+ #include <sound/hdmi-codec.h>
+ #include <sound/pcm_drm_eld.h>
+@@ -494,6 +493,7 @@ static int vc4_hdmi_connector_detect_ctx
+ static int vc4_hdmi_connector_get_modes(struct drm_connector *connector)
+ {
+ 	struct vc4_hdmi *vc4_hdmi = connector_to_vc4_hdmi(connector);
++	struct vc4_dev *vc4 = to_vc4_dev(connector->dev);
+ 	int ret = 0;
+ 	struct edid *edid;
+ 
+@@ -517,7 +517,7 @@ static int vc4_hdmi_connector_get_modes(
+ 	ret = drm_add_edid_modes(connector, edid);
+ 	kfree(edid);
+ 
+-	if (vc4_hdmi->disable_4kp60) {
++	if (!vc4->hvs->vc5_hdmi_enable_hdmi_20) {
+ 		struct drm_device *drm = connector->dev;
+ 		const struct drm_display_mode *mode;
+ 
+@@ -1980,11 +1980,12 @@ vc4_hdmi_encoder_clock_valid(const struc
+ {
+ 	const struct drm_connector *connector = &vc4_hdmi->connector;
+ 	const struct drm_display_info *info = &connector->display_info;
++	struct vc4_dev *vc4 = to_vc4_dev(connector->dev);
+ 
+ 	if (clock > vc4_hdmi->variant->max_pixel_clock)
+ 		return MODE_CLOCK_HIGH;
+ 
+-	if (vc4_hdmi->disable_4kp60 && clock > HDMI_14_MAX_TMDS_CLK)
++	if (!vc4->hvs->vc5_hdmi_enable_hdmi_20 && clock > HDMI_14_MAX_TMDS_CLK)
+ 		return MODE_CLOCK_HIGH;
+ 
+ 	if (info->max_tmds_clock && clock > (info->max_tmds_clock * 1000))
+@@ -3694,14 +3695,6 @@ static int vc4_hdmi_bind(struct device *
+ 	vc4_hdmi->disable_wifi_frequencies =
+ 		of_property_read_bool(dev->of_node, "wifi-2.4ghz-coexistence");
+ 
+-	if (variant->max_pixel_clock == 600000000) {
+-		struct vc4_dev *vc4 = to_vc4_dev(drm);
+-		unsigned int max_rate = rpi_firmware_clk_get_max_rate(vc4->hvs->core_clk);
+-
+-		if (max_rate < 550000000)
+-			vc4_hdmi->disable_4kp60 = true;
+-	}
+-
+ 	ret = devm_pm_runtime_enable(dev);
+ 	if (ret)
+ 		return ret;
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.h
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.h
+@@ -158,14 +158,6 @@ struct vc4_hdmi {
+ 	 */
+ 	bool disable_wifi_frequencies;
+ 
+-	/*
+-	 * Even if HDMI0 on the RPi4 can output modes requiring a pixel
+-	 * rate higher than 297MHz, it needs some adjustments in the
+-	 * config.txt file to be able to do so and thus won't always be
+-	 * available.
+-	 */
+-	bool disable_4kp60;
+-
+ 	struct cec_adapter *cec_adap;
+ 	struct cec_msg cec_rx_msg;
+ 	bool cec_tx_ok;
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -28,6 +28,8 @@
+ #include <drm/drm_drv.h>
+ #include <drm/drm_vblank.h>
+ 
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
+ #include "vc4_drv.h"
+ #include "vc4_regs.h"
+ 
+@@ -1033,12 +1035,33 @@ static int vc4_hvs_bind(struct device *d
+ 	hvs->regset.nregs = ARRAY_SIZE(hvs_regs);
+ 
+ 	if (vc4->is_vc5) {
++		struct rpi_firmware *firmware;
++		struct device_node *node;
++		unsigned int max_rate;
++
++		node = rpi_firmware_find_node();
++		if (!node)
++			return -EINVAL;
++
++		firmware = rpi_firmware_get(node);
++		of_node_put(node);
++		if (!firmware)
++			return -EPROBE_DEFER;
++
+ 		hvs->core_clk = devm_clk_get(&pdev->dev, NULL);
+ 		if (IS_ERR(hvs->core_clk)) {
+ 			dev_err(&pdev->dev, "Couldn't get core clock\n");
+ 			return PTR_ERR(hvs->core_clk);
+ 		}
+ 
++		max_rate = rpi_firmware_clk_get_max_rate(firmware,
++							 RPI_FIRMWARE_CORE_CLK_ID);
++		rpi_firmware_put(firmware);
++		if (max_rate >= 550000000)
++			hvs->vc5_hdmi_enable_hdmi_20 = true;
++
++		hvs->max_core_rate = max_rate;
++
+ 		ret = clk_prepare_enable(hvs->core_clk);
+ 		if (ret) {
+ 			dev_err(&pdev->dev, "Couldn't enable the core clock\n");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0455-drm-vc4-hdmi-Add-more-checks-for-4k-resolutions.patch b/target/linux/bcm27xx/patches-6.1/950-0455-drm-vc4-hdmi-Add-more-checks-for-4k-resolutions.patch
new file mode 100644
index 00000000000000..5c4ae878bbe4a0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0455-drm-vc4-hdmi-Add-more-checks-for-4k-resolutions.patch
@@ -0,0 +1,88 @@
+From d3c267836e424c9246a4b174d9bd024cb0f656b4 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Tue, 17 May 2022 12:46:42 +0100
+Subject: [PATCH] drm/vc4: hdmi: Add more checks for 4k resolutions
+
+At least the 4096x2160@60Hz mode requires some overclocking that isn't
+available by default, even if hdmi_enable_4kp60 is enabled.
+
+Let's add some logic to detect whether we can satisfy the core clock
+requirements for that mode, and prevent it from being used otherwise.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/vc4_drv.h  |  6 ++++++
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 11 +++++++++--
+ drivers/gpu/drm/vc4/vc4_hvs.c  |  3 +++
+ 3 files changed, 18 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -352,6 +352,12 @@ struct vc4_hvs {
+ 	 * available.
+ 	 */
+ 	bool vc5_hdmi_enable_hdmi_20;
++
++	/*
++	 * 4096x2160@60 requires a core overclock to work, so register
++	 * whether that is sufficient.
++	 */
++	bool vc5_hdmi_enable_4096by2160;
+ };
+ 
+ struct vc4_plane {
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -1976,6 +1976,7 @@ vc4_hdmi_sink_supports_format_bpc(const
+ 
+ static enum drm_mode_status
+ vc4_hdmi_encoder_clock_valid(const struct vc4_hdmi *vc4_hdmi,
++			     const struct drm_display_mode *mode,
+ 			     unsigned long long clock)
+ {
+ 	const struct drm_connector *connector = &vc4_hdmi->connector;
+@@ -1988,6 +1989,12 @@ vc4_hdmi_encoder_clock_valid(const struc
+ 	if (!vc4->hvs->vc5_hdmi_enable_hdmi_20 && clock > HDMI_14_MAX_TMDS_CLK)
+ 		return MODE_CLOCK_HIGH;
+ 
++	/* 4096x2160@60 is not reliable without overclocking core */
++	if (!vc4->hvs->vc5_hdmi_enable_4096by2160 &&
++	    mode->hdisplay > 3840 && mode->vdisplay >= 2160 &&
++	    drm_mode_vrefresh(mode) >= 50)
++		return MODE_CLOCK_HIGH;
++
+ 	if (info->max_tmds_clock && clock > (info->max_tmds_clock * 1000))
+ 		return MODE_CLOCK_HIGH;
+ 
+@@ -2022,7 +2029,7 @@ vc4_hdmi_encoder_compute_clock(const str
+ 	unsigned long long clock;
+ 
+ 	clock = vc4_hdmi_encoder_compute_mode_clock(mode, bpc, fmt);
+-	if (vc4_hdmi_encoder_clock_valid(vc4_hdmi, clock) != MODE_OK)
++	if (vc4_hdmi_encoder_clock_valid(vc4_hdmi, mode, clock) != MODE_OK)
+ 		return -EINVAL;
+ 
+ 	vc4_state->tmds_char_rate = clock;
+@@ -2185,7 +2192,7 @@ vc4_hdmi_encoder_mode_valid(struct drm_e
+ 	     (mode->hsync_end % 2) || (mode->htotal % 2)))
+ 		return MODE_H_ILLEGAL;
+ 
+-	return vc4_hdmi_encoder_clock_valid(vc4_hdmi, mode->clock * 1000);
++	return vc4_hdmi_encoder_clock_valid(vc4_hdmi, mode, mode->clock * 1000);
+ }
+ 
+ static const struct drm_encoder_helper_funcs vc4_hdmi_encoder_helper_funcs = {
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -1060,6 +1060,9 @@ static int vc4_hvs_bind(struct device *d
+ 		if (max_rate >= 550000000)
+ 			hvs->vc5_hdmi_enable_hdmi_20 = true;
+ 
++		if (max_rate >= 600000000)
++			hvs->vc5_hdmi_enable_4096by2160 = true;
++
+ 		hvs->max_core_rate = max_rate;
+ 
+ 		ret = clk_prepare_enable(hvs->core_clk);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0456-drm-vc4-Make-sure-we-don-t-end-up-with-a-core-clock-.patch b/target/linux/bcm27xx/patches-6.1/950-0456-drm-vc4-Make-sure-we-don-t-end-up-with-a-core-clock-.patch
new file mode 100644
index 00000000000000..b38cb1f87851f3
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0456-drm-vc4-Make-sure-we-don-t-end-up-with-a-core-clock-.patch
@@ -0,0 +1,55 @@
+From adf7289aab83651c41e7734b34844470a25ecc5f Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Fri, 25 Mar 2022 17:09:41 +0100
+Subject: [PATCH] drm/vc4: Make sure we don't end up with a core clock
+ too high
+
+Following the clock rate range improvements to the clock framework,
+trying to set a disjoint range on a clock will now result in an error.
+
+Thus, we can't set a minimum rate higher than the maximum reported by
+the firmware, or clk_set_min_rate() will fail.
+
+Thus we need to clamp the rate we are about to ask for to the maximum
+rate possible on that clock.
+
+Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/vc4_kms.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_kms.c
+@@ -399,8 +399,8 @@ static void vc4_atomic_commit_tail(struc
+ 	if (vc4->is_vc5 && !vc4->firmware_kms) {
+ 		unsigned long state_rate = max(old_hvs_state->core_clock_rate,
+ 					       new_hvs_state->core_clock_rate);
+-		unsigned long core_rate = max_t(unsigned long,
+-						500000000, state_rate);
++		unsigned long core_rate = clamp_t(unsigned long, state_rate,
++						  500000000, hvs->max_core_rate);
+ 
+ 		drm_dbg(dev, "Raising the core clock at %lu Hz\n", core_rate);
+ 
+@@ -436,14 +436,17 @@ static void vc4_atomic_commit_tail(struc
+ 	drm_atomic_helper_cleanup_planes(dev, state);
+ 
+ 	if (vc4->is_vc5 && !vc4->firmware_kms) {
+-		drm_dbg(dev, "Running the core clock at %lu Hz\n",
+-			new_hvs_state->core_clock_rate);
++		unsigned long core_rate = min_t(unsigned long,
++						hvs->max_core_rate,
++						new_hvs_state->core_clock_rate);
++
++		drm_dbg(dev, "Running the core clock at %lu Hz\n", core_rate);
+ 
+ 		/*
+ 		 * Request a clock rate based on the current HVS
+ 		 * requirements.
+ 		 */
+-		WARN_ON(clk_set_min_rate(hvs->core_clk, new_hvs_state->core_clock_rate));
++		WARN_ON(clk_set_min_rate(hvs->core_clk, core_rate));
+ 
+ 		drm_dbg(dev, "Core clock actual rate: %lu Hz\n",
+ 			clk_get_rate(hvs->core_clk));
diff --git a/target/linux/bcm27xx/patches-6.1/950-0457-net-phy-BCM54210PE-does-not-support-PTP.patch b/target/linux/bcm27xx/patches-6.1/950-0457-net-phy-BCM54210PE-does-not-support-PTP.patch
new file mode 100644
index 00000000000000..070d33bab7908e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0457-net-phy-BCM54210PE-does-not-support-PTP.patch
@@ -0,0 +1,44 @@
+From b7bdb564eb5b2d0672d0c49d8b6b4c14196f71ca Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Sat, 5 Nov 2022 11:46:08 +0000
+Subject: [PATCH] net: phy: BCM54210PE does not support PTP
+
+BCM54213PE is an Ethernet PHY that supports PTP hardware timestamping.
+BCM54210PW ia another Ethernet PHY, but one without PTP support.
+Unfortunately the two PHYs return the same ID when queried, so some
+extra information is required to determine whether the PHY is PTP-
+capable.
+
+There are two Raspberry Pi products that use these PHYs - Pi 4B and
+CM4 - and fortunately they use different PHY addresses, so use that as
+a differentiator. Choose to treat a PHY with the same ID but another
+address as a BCM54210PE, which seems more common.
+
+See: https://github.com/raspberrypi/linux/issues/5104
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/phy/bcm-phy-ptp.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/net/phy/bcm-phy-ptp.c
++++ b/drivers/net/phy/bcm-phy-ptp.c
+@@ -916,6 +916,18 @@ struct bcm_ptp_private *bcm_ptp_probe(st
+ 	switch (BRCM_PHY_MODEL(phydev)) {
+ 	case PHY_ID_BCM54210E:
+ 		break;
++#ifdef PHY_ID_BCM54213PE
++	case PHY_ID_BCM54213PE:
++		switch (phydev->mdio.addr) {
++		case 0: // CM4 - this is a BCM54210PE which supports PTP
++			break;
++		case 1: //  4B - this is a BCM54213PE which doesn't
++			return NULL;
++		default: // Unknown - assume it's BCM54210PE
++			break;
++		}
++		break;
++#endif
+ 	default:
+ 		return NULL;
+ 	}
diff --git a/target/linux/bcm27xx/patches-6.1/950-0458-drm-vc4_hdmi-Allow-hotplug-detect-to-be-forced.patch b/target/linux/bcm27xx/patches-6.1/950-0458-drm-vc4_hdmi-Allow-hotplug-detect-to-be-forced.patch
new file mode 100644
index 00000000000000..aa52ad983f9859
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0458-drm-vc4_hdmi-Allow-hotplug-detect-to-be-forced.patch
@@ -0,0 +1,58 @@
+From d75b03d83ecc46b2f0ea13b7934cf3a093914388 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Wed, 1 Jun 2022 15:43:51 +0100
+Subject: [PATCH] drm/vc4_hdmi: Allow hotplug detect to be forced
+
+See: https://forum.libreelec.tv/thread/24783-tv-avr-turns-back-on-right-after-turning-them-off
+
+While the kernel provides a :D flag for assuming device is connected,
+it doesn't stop this function from being called and generating a cec_phys_addr_invalidate
+message when hotplug is deasserted.
+
+That message provokes a flurry of CEC messages which for many users results in the TV
+switching back on again and it's very hard to get it to stay switched off.
+
+It seems to only occur with an AVR and TV connected but has been observed across a
+number of manufacturers.
+
+The issue started with https://github.com/raspberrypi/linux/pull/4371
+and this provides an optional way of getting back the old behaviour
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -41,6 +41,8 @@
+ #include <linux/component.h>
+ #include <linux/gpio/consumer.h>
+ #include <linux/i2c.h>
++#include <linux/module.h>
++#include <linux/moduleparam.h>
+ #include <linux/of_address.h>
+ #include <linux/of_platform.h>
+ #include <linux/pm_runtime.h>
+@@ -113,6 +115,10 @@
+ 
+ #define HDMI_14_MAX_TMDS_CLK   (340 * 1000 * 1000)
+ 
++/* bit field to force hotplug detection. bit0 = HDMI0 */
++static int force_hotplug = 0;
++module_param(force_hotplug, int, 0644);
++
+ static const char * const output_format_str[] = {
+ 	[VC4_HDMI_OUTPUT_RGB]		= "RGB",
+ 	[VC4_HDMI_OUTPUT_YUV420]	= "YUV 4:2:0",
+@@ -475,7 +481,9 @@ static int vc4_hdmi_connector_detect_ctx
+ 
+ 	WARN_ON(pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev));
+ 
+-	if (vc4_hdmi->hpd_gpio) {
++	if (force_hotplug & BIT(vc4_hdmi->encoder.type - VC4_ENCODER_TYPE_HDMI0))
++		status = connector_status_connected;
++	else if (vc4_hdmi->hpd_gpio) {
+ 		if (gpiod_get_value_cansleep(vc4_hdmi->hpd_gpio))
+ 			status = connector_status_connected;
+ 	} else {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0459-overlays-i2c-sensor-Add-the-jc42-class-of-sensor.patch b/target/linux/bcm27xx/patches-6.1/950-0459-overlays-i2c-sensor-Add-the-jc42-class-of-sensor.patch
new file mode 100644
index 00000000000000..543b1e16548857
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0459-overlays-i2c-sensor-Add-the-jc42-class-of-sensor.patch
@@ -0,0 +1,84 @@
+From 2ed7fb7bf15420d80c3b272a3a887e142046b7b2 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 7 Nov 2022 15:31:43 +0000
+Subject: [PATCH] overlays: i2c-sensor: Add the jc42 class of sensor
+
+This is a second attempt to solve issue 5234, since it turns out that
+the mcp980x driver only supports MCP9800-MCP9803. MCP9804, MCP9805 and
+MCP9808 require the jc42 driver.
+
+See: https://github.com/raspberrypi/linux/issues/5234
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README              | 13 ++++++++++++-
+ .../boot/dts/overlays/i2c-sensor-common.dtsi   | 18 +++++++++++++++++-
+ 2 files changed, 29 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -1970,6 +1970,15 @@ Params: addr                    Set the
+         int_pin                 Set the GPIO to use for interrupts (max30102
+                                 only)
+ 
++        jc42                    Select any of the many JEDEC JC42.4-compliant
++                                temperature sensors, including:
++                                  ADT7408, AT30TS00, CAT34TS02, CAT6095,
++                                  MAX6604, MCP9804, MCP9805, MCP9808,
++                                  MCP98242, MCP98243, MCP98244, MCP9843,
++                                  SE97, SE98, STTS424(E), STTS2002, STTS3000,
++                                  TSE2002, TSE2004, TS3000, and TS3001.
++                                The default address is 0x18.
++
+         lm75                    Select the Maxim LM75 temperature sensor
+                                 Valid addresses 0x48-0x4f, default 0x4f
+ 
+@@ -1982,7 +1991,9 @@ Params: addr                    Set the
+                                 and blood-oxygen sensor
+ 
+         mcp980x                 Select the Maxim MCP980x range of temperature
+-                                sensors (e.g. MCP9808).
++                                sensors (i.e. MCP9800, MCP9801, MCP9802 and
++                                MCP9803). N.B. For MCP9804, MCP9805 and MCP9808,
++                                use the "jc42" option.
+                                 Valid addresses are 0x18-0x1f (default 0x18)
+ 
+         sht3x                   Select the Sensiron SHT3x temperature and
+--- a/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+@@ -337,6 +337,21 @@
+ 		};
+ 	};
+ 
++	fragment@22 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			jc42: jc42@18 {
++				compatible = "jedec,jc-42.4-temp";
++				reg = <0x18>;
++				smbus-timeout-disable;
++			};
++		};
++	};
++
+ 	__overrides__ {
+ 		bme280 = <0>,"+0";
+ 		bmp085 = <0>,"+1";
+@@ -361,11 +376,12 @@
+ 		max30102 = <0>,"+19";
+ 		aht10 = <0>,"+20";
+ 		mcp980x = <0>,"+21";
++		jc42 = <0>,"+22";
+ 
+ 		addr =  <&bme280>,"reg:0", <&bmp280>,"reg:0", <&tmp102>,"reg:0",
+ 			<&lm75>,"reg:0", <&hdc100x>,"reg:0", <&sht3x>,"reg:0",
+ 			<&ds1621>,"reg:0", <&bme680>,"reg:0", <&ccs811>,"reg:0",
+-			<&bh1750>,"reg:0", <&mcp980x>,"reg:0";
++			<&bh1750>,"reg:0", <&mcp980x>,"reg:0", <&jc42>,"reg:0";
+ 		int_pin = <&max30102>, "interrupts:0";
+ 	};
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0460-overlays-Extend-audremap-to-supports-other-pins.patch b/target/linux/bcm27xx/patches-6.1/950-0460-overlays-Extend-audremap-to-supports-other-pins.patch
new file mode 100644
index 00000000000000..79c833411a85f7
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0460-overlays-Extend-audremap-to-supports-other-pins.patch
@@ -0,0 +1,79 @@
+From 714dd0cab06df74fb47c4b379df332fb0d2ff0de Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 8 Nov 2022 14:40:52 +0000
+Subject: [PATCH] overlays: Extend audremap to supports other pins
+
+Add the parameters pins_40_41 and pins_40_45 to support other audio pin
+options. Also, simplify the overlay using literal assignments.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README             |  6 ++--
+ .../boot/dts/overlays/audremap-overlay.dts    | 29 ++++++-------------
+ 2 files changed, 13 insertions(+), 22 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -680,10 +680,12 @@ Info:   Switches PWM sound output to GPI
+ Load:   dtoverlay=audremap,<param>=<val>
+ Params: swap_lr                 Reverse the channel allocation, which will also
+                                 swap the audio jack outputs (default off)
+-        enable_jack             Don't switch off the audio jack output
+-                                (default off)
++        enable_jack             Don't switch off the audio jack output. Does
++                                nothing on BCM2711 (default off)
+         pins_12_13              Select GPIOs 12 & 13 (default)
+         pins_18_19              Select GPIOs 18 & 19
++        pins_40_41              Select GPIOs 40 & 41
++        pins_40_45              Select GPIOs 40 & 45
+ 
+ 
+ Name:   balena-fin
+--- a/arch/arm/boot/dts/overlays/audremap-overlay.dts
++++ b/arch/arm/boot/dts/overlays/audremap-overlay.dts
+@@ -7,28 +7,11 @@
+         fragment@0 {
+                 target = <&audio_pins>;
+                 frag0: __overlay__ {
++                        brcm,pins = <12 13>;
+                 };
+         };
+ 
+ 	fragment@1 {
+-                target = <&audio_pins>;
+-                __overlay__ {
+-                        brcm,pins = < 12 13 >;
+-                        brcm,function = < 4 >; /* alt0 alt0 */
+-                        brcm,pull = < 0 >;
+-                };
+-        };
+-
+-	fragment@2 {
+-		target = <&audio_pins>;
+-		__dormant__ {
+-                        brcm,pins = < 18 19 >;
+-                        brcm,function = < 2 >; /* alt5 alt5 */
+-                        brcm,pull = < 0 >;
+-		};
+-	};
+-
+-	fragment@3 {
+ 		target = <&chosen>;
+ 		__overlay__  {
+ 			bootargs = "snd_bcm2835.enable_headphones=1";
+@@ -38,7 +21,13 @@
+ 	__overrides__ {
+ 		swap_lr = <&frag0>, "swap_lr?";
+ 		enable_jack = <&frag0>, "enable_jack?";
+-		pins_12_13 = <0>,"+1-2";
+-		pins_18_19 = <0>,"-1+2";
++		pins_12_13 = <&frag0>,"brcm,pins:0=12",
++		             <&frag0>,"brcm,pins:4=13";
++		pins_18_19 = <&frag0>,"brcm,pins:0=18",
++		             <&frag0>,"brcm,pins:4=19";
++		pins_40_41 = <&frag0>,"brcm,pins:0=40",
++		             <&frag0>,"brcm,pins:4=41";
++		pins_40_45 = <&frag0>,"brcm,pins:0=40",
++		             <&frag0>,"brcm,pins:4=45";
+ 	};
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0461-media-adv7180-Nasty-hack-to-allow-input-selection.patch b/target/linux/bcm27xx/patches-6.1/950-0461-media-adv7180-Nasty-hack-to-allow-input-selection.patch
new file mode 100644
index 00000000000000..00a6ece36208da
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0461-media-adv7180-Nasty-hack-to-allow-input-selection.patch
@@ -0,0 +1,89 @@
+From 0b62eb1a849990ea513249adac661003c7138aeb Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 31 Oct 2018 15:00:04 +0000
+Subject: [PATCH] media: adv7180: Nasty hack to allow input selection.
+
+Whilst the adv7180 driver support s_routing, nothing else
+does, and there is a missing lump of framework code to
+define the mapping from connectors on a board to the inputs
+they represent on the ADV7180.
+
+Add a nasty hack to take a module parameter that is passed in
+to s_routing on any call to G_STD, or S_STD (or subdev
+g_input_status call).
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/media/i2c/adv7180.c | 30 ++++++++++++++++++++++++++++--
+ 1 file changed, 28 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -188,6 +188,10 @@
+ /* Initial number of frames to skip to avoid possible garbage */
+ #define ADV7180_NUM_OF_SKIP_FRAMES       2
+ 
++static int dbg_input;
++module_param(dbg_input, int, 0644);
++MODULE_PARM_DESC(dbg_input, "Input number (0-31)");
++
+ struct adv7180_state;
+ 
+ #define ADV7180_FLAG_RESET_POWERED	BIT(0)
+@@ -406,10 +410,24 @@ out:
+ 	return ret;
+ }
+ 
++static void adv7180_check_input(struct v4l2_subdev *sd)
++{
++	struct adv7180_state *state = to_state(sd);
++
++	if (state->input != dbg_input)
++		if (adv7180_s_routing(sd, dbg_input, 0, 0))
++			/* Failed - reset dbg_input */
++			dbg_input = state->input;
++}
++
+ static int adv7180_g_input_status(struct v4l2_subdev *sd, u32 *status)
+ {
+ 	struct adv7180_state *state = to_state(sd);
+-	int ret = mutex_lock_interruptible(&state->mutex);
++	int ret;
++
++	adv7180_check_input(sd);
++
++	ret = mutex_lock_interruptible(&state->mutex);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -435,7 +453,11 @@ static int adv7180_program_std(struct ad
+ static int adv7180_s_std(struct v4l2_subdev *sd, v4l2_std_id std)
+ {
+ 	struct adv7180_state *state = to_state(sd);
+-	int ret = mutex_lock_interruptible(&state->mutex);
++	int ret;
++
++	adv7180_check_input(sd);
++
++	ret = mutex_lock_interruptible(&state->mutex);
+ 
+ 	if (ret)
+ 		return ret;
+@@ -457,6 +479,8 @@ static int adv7180_g_std(struct v4l2_sub
+ {
+ 	struct adv7180_state *state = to_state(sd);
+ 
++	adv7180_check_input(sd);
++
+ 	*norm = state->curr_norm;
+ 
+ 	return 0;
+@@ -886,6 +910,8 @@ static int adv7180_s_stream(struct v4l2_
+ 		return 0;
+ 	}
+ 
++	adv7180_check_input(sd);
++
+ 	/* Must wait until querystd released the lock */
+ 	ret = mutex_lock_interruptible(&state->mutex);
+ 	if (ret)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0462-vc04_services-bcm2835_codec-Allow-larger-images-thro.patch b/target/linux/bcm27xx/patches-6.1/950-0462-vc04_services-bcm2835_codec-Allow-larger-images-thro.patch
new file mode 100644
index 00000000000000..de62fd9549c94c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0462-vc04_services-bcm2835_codec-Allow-larger-images-thro.patch
@@ -0,0 +1,101 @@
+From 38822ea8817873a2cf74353ef6ad8e363e3dea70 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 3 Nov 2022 13:45:37 +0000
+Subject: [PATCH] vc04_services: bcm2835_codec: Allow larger images
+ through the ISP
+
+Whilst the codecs are restricted to 1920x1080 / 1080x1920, the ISP
+isn't, but the limits advertised via V4L2 was 1920x1920 for all
+roles.
+
+Increase the limit to 16k x 16k for the ISP.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../bcm2835-codec/bcm2835-v4l2-codec.c        | 31 ++++++++++++++-----
+ 1 file changed, 23 insertions(+), 8 deletions(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
++++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+@@ -119,8 +119,10 @@ static const char * const components[] =
+ 
+ #define MIN_W		32
+ #define MIN_H		32
+-#define MAX_W		1920
+-#define MAX_H		1920
++#define MAX_W_CODEC	1920
++#define MAX_H_CODEC	1920
++#define MAX_W_ISP	16384
++#define MAX_H_ISP	16384
+ #define BPL_ALIGN	32
+ /*
+  * The decoder spec supports the V4L2_EVENT_SOURCE_CHANGE event, but the docs
+@@ -686,6 +688,13 @@ struct bcm2835_codec_dev {
+ 	/* The list of formats supported on input and output queues. */
+ 	struct bcm2835_codec_fmt_list	supported_fmts[2];
+ 
++	/*
++	 * Max size supported varies based on role. Store during
++	 * bcm2835_codec_create for use later.
++	 */
++	unsigned int max_w;
++	unsigned int max_h;
++
+ 	struct vchiq_mmal_instance	*instance;
+ 
+ 	struct v4l2_m2m_dev	*m2m_dev;
+@@ -1471,10 +1480,10 @@ static int vidioc_try_fmt(struct bcm2835
+ 	 * The V4L2 specification requires the driver to correct the format
+ 	 * struct if any of the dimensions is unsupported
+ 	 */
+-	if (f->fmt.pix_mp.width > MAX_W)
+-		f->fmt.pix_mp.width = MAX_W;
+-	if (f->fmt.pix_mp.height > MAX_H)
+-		f->fmt.pix_mp.height = MAX_H;
++	if (f->fmt.pix_mp.width > ctx->dev->max_w)
++		f->fmt.pix_mp.width = ctx->dev->max_w;
++	if (f->fmt.pix_mp.height > ctx->dev->max_h)
++		f->fmt.pix_mp.height = ctx->dev->max_h;
+ 
+ 	if (!(fmt->flags & V4L2_FMT_FLAG_COMPRESSED)) {
+ 		/* Only clip min w/h on capture. Treat 0x0 as unknown. */
+@@ -2528,6 +2537,7 @@ static int vidioc_encoder_cmd(struct fil
+ static int vidioc_enum_framesizes(struct file *file, void *fh,
+ 				  struct v4l2_frmsizeenum *fsize)
+ {
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
+ 	struct bcm2835_codec_fmt *fmt;
+ 
+ 	fmt = find_format_pix_fmt(fsize->pixel_format, file2ctx(file)->dev,
+@@ -2546,10 +2556,10 @@ static int vidioc_enum_framesizes(struct
+ 	fsize->type = V4L2_FRMSIZE_TYPE_STEPWISE;
+ 
+ 	fsize->stepwise.min_width = MIN_W;
+-	fsize->stepwise.max_width = MAX_W;
++	fsize->stepwise.max_width = ctx->dev->max_w;
+ 	fsize->stepwise.step_width = 2;
+ 	fsize->stepwise.min_height = MIN_H;
+-	fsize->stepwise.max_height = MAX_H;
++	fsize->stepwise.max_height = ctx->dev->max_h;
+ 	fsize->stepwise.step_height = 2;
+ 
+ 	return 0;
+@@ -3623,6 +3633,9 @@ static int bcm2835_codec_create(struct b
+ 	if (ret)
+ 		goto vchiq_finalise;
+ 
++	dev->max_w = MAX_W_CODEC;
++	dev->max_h = MAX_H_CODEC;
++
+ 	switch (role) {
+ 	case DECODE:
+ 		v4l2_disable_ioctl(vfd, VIDIOC_ENCODER_CMD);
+@@ -3645,6 +3658,8 @@ static int bcm2835_codec_create(struct b
+ 		v4l2_disable_ioctl(vfd, VIDIOC_G_PARM);
+ 		function = MEDIA_ENT_F_PROC_VIDEO_SCALER;
+ 		video_nr = isp_video_nr;
++		dev->max_w = MAX_W_ISP;
++		dev->max_h = MAX_H_ISP;
+ 		break;
+ 	case DEINTERLACE:
+ 		v4l2_disable_ioctl(vfd, VIDIOC_DECODER_CMD);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0463-imx296-overlay-clock-frequency-defaults-to-54MHz-but.patch b/target/linux/bcm27xx/patches-6.1/950-0463-imx296-overlay-clock-frequency-defaults-to-54MHz-but.patch
new file mode 100644
index 00000000000000..30178c8f4cde84
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0463-imx296-overlay-clock-frequency-defaults-to-54MHz-but.patch
@@ -0,0 +1,45 @@
+From 55eafc594a9ec1aaa8b01207c5361e79d6b52fe7 Mon Sep 17 00:00:00 2001
+From: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+Date: Fri, 11 Nov 2022 13:36:07 +0000
+Subject: [PATCH] imx296-overlay: clock-frequency defaults to 54MHz but
+ can be overridden
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README             | 3 +++
+ arch/arm/boot/dts/overlays/imx296-overlay.dts | 5 +++--
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -2207,6 +2207,9 @@ Params: rotation                Mounting
+                                 configuring the sensor (default on)
+         cam0                    Adopt the default configuration for CAM0 on a
+                                 Compute Module (CSI0, i2c_vc, and cam0_reg).
++        clock-frequency         Sets the clock frequency to match that used on
++                                the board, which should be one of 54000000
++                                (the default), 37125000 or 74250000.
+ 
+ 
+ Name:   imx327
+--- a/arch/arm/boot/dts/overlays/imx296-overlay.dts
++++ b/arch/arm/boot/dts/overlays/imx296-overlay.dts
+@@ -17,9 +17,9 @@
+ 
+ 	clk_frag: fragment@1 {
+ 		target = <&cam1_clk>;
+-		__overlay__ {
++		clk_over: __overlay__ {
+ 			status = "okay";
+-			clock-frequency = <37125000>;
++			clock-frequency = <54000000>;
+ 		};
+ 	};
+ 
+@@ -99,5 +99,6 @@
+ 		       <&clk_frag>, "target:0=",<&cam0_clk>,
+ 		       <&imx296>, "clocks:0=",<&cam0_clk>,
+ 		       <&imx296>, "VANA-supply:0=",<&cam0_reg>;
++		clock-frequency = <&clk_over>, "clock-frequency:0";
+ 	};
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0464-ASoC-ma120x0p-Corrects-the-volume-level-display.patch b/target/linux/bcm27xx/patches-6.1/950-0464-ASoC-ma120x0p-Corrects-the-volume-level-display.patch
new file mode 100644
index 00000000000000..7e58dfa66a8bf5
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0464-ASoC-ma120x0p-Corrects-the-volume-level-display.patch
@@ -0,0 +1,27 @@
+From 4aec425e27e06f9743fd3f869f6ead77260cf523 Mon Sep 17 00:00:00 2001
+From: Joerg Schambacher <joerg@hifiberry.com>
+Date: Tue, 15 Nov 2022 18:04:45 +0100
+Subject: [PATCH] ASoC:ma120x0p: Corrects the volume level display
+
+Fixes the wrongly changed 'limiter volume' display back to -50dB minimum
+and sets the correct minimum volume level to -144dB to be aligned with
+the controls and display in alsamixer etc.
+
+Signed-off-by: Joerg Schambacher <joerg@hifiberry.com>
+---
+ sound/soc/codecs/ma120x0p.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/codecs/ma120x0p.c
++++ b/sound/soc/codecs/ma120x0p.c
+@@ -893,8 +893,8 @@ static SOC_VALUE_ENUM_SINGLE_DECL(pwr_mo
+ 	pwr_mode_texts,
+ 	pwr_mode_values);
+ 
+-static const DECLARE_TLV_DB_SCALE(ma120x0p_vol_tlv, -5000, 100,  0);
+-static const DECLARE_TLV_DB_SCALE(ma120x0p_lim_tlv, -14400, 100,  0);
++static const DECLARE_TLV_DB_SCALE(ma120x0p_vol_tlv, -14400, 100,  0);
++static const DECLARE_TLV_DB_SCALE(ma120x0p_lim_tlv, -5000, 100,  0);
+ static const DECLARE_TLV_DB_SCALE(ma120x0p_lr_tlv, -5000, 100,  0);
+ 
+ static const struct snd_kcontrol_new ma120x0p_snd_controls[] = {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0465-overlays-Add-overlay-pwm1.patch b/target/linux/bcm27xx/patches-6.1/950-0465-overlays-Add-overlay-pwm1.patch
new file mode 100644
index 00000000000000..89930e4b866c4f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0465-overlays-Add-overlay-pwm1.patch
@@ -0,0 +1,132 @@
+From 6f5604a2d672ffb874f89f9ae276b565ae99dcc6 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 16 Nov 2022 14:54:08 +0000
+Subject: [PATCH] overlays: Add overlay pwm1
+
+pwm1 enables the second PWM interface found on BCM2711. It can only
+be mapped to GPIOs 40 & 41.
+
+See: https://forums.raspberrypi.com/viewtopic.php?t=342458
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/Makefile         |  1 +
+ arch/arm/boot/dts/overlays/README           | 18 +++++++
+ arch/arm/boot/dts/overlays/overlay_map.dts  |  4 ++
+ arch/arm/boot/dts/overlays/pwm1-overlay.dts | 60 +++++++++++++++++++++
+ 4 files changed, 83 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/pwm1-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -183,6 +183,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	pwm.dtbo \
+ 	pwm-2chan.dtbo \
+ 	pwm-ir-tx.dtbo \
++	pwm1.dtbo \
+ 	qca7000.dtbo \
+ 	qca7000-uart0.dtbo \
+ 	ramoops.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -3216,6 +3216,24 @@ Params: gpio_pin                Output G
+         func                    Pin function (default 2 = Alt5)
+ 
+ 
++Name:   pwm1
++Info:   Configures one or two PWM channel on PWM1 (BCM2711 only)
++        N.B.:
++          1) The onboard analogue audio output uses both PWM channels.
++          2) So be careful mixing audio and PWM.
++        Note that even when only one pin is enabled, both channels are available
++        from the PWM driver, so be careful to use the correct one.
++Load:   dtoverlay=pwm1,<param>=<val>
++Params: clock                   PWM clock frequency (informational)
++        pins_40                 Enable channel 0 (PWM1_0) on GPIO 40
++        pins_41                 Enable channel 1 (PWM1_1) on GPIO 41
++        pins_40_41              Enable channels 0 (PWM1_0) and 1 (PW1_1) on
++                                GPIOs 40 and 41 (default)
++        pull_up                 Enable pull-ups on the PWM pins (default)
++        pull_down               Enable pull-downs on the PWM pins
++        pull_off                Disable pulls on the PWM pins
++
++
+ Name:   qca7000
+ Info:   in-tech's Evaluation Board for PLC Stamp micro
+         This uses spi0 and a separate GPIO interrupt to connect the QCA7000.
+--- a/arch/arm/boot/dts/overlays/overlay_map.dts
++++ b/arch/arm/boot/dts/overlays/overlay_map.dts
+@@ -77,6 +77,10 @@
+ 		renamed = "miniuart-bt";
+ 	};
+ 
++	pwm1 {
++		bcm2711;
++	};
++
+ 	ramoops {
+ 		bcm2835;
+ 		bcm2711 = "ramoops-pi4";
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pwm1-overlay.dts
+@@ -0,0 +1,60 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&pins>;
++		__overlay__ {
++			brcm,pins = <40 41>;
++		};
++	};
++
++	fragment@1 {
++		target = <&pins>;
++		__dormant__ {
++			brcm,pins = <40>;
++		};
++	};
++
++	fragment@2 {
++		target = <&pins>;
++		__dormant__ {
++			brcm,pins = <41>;
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			pins: pwm1_overlay_pins {
++				brcm,pins = <40 41>;
++				brcm,function = <BCM2835_FSEL_ALT0>;
++				brcm,pull = <BCM2835_PUD_UP>;
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&pwm1>;
++		pwm: __overlay__ {
++			status = "okay";
++			assigned-clock-rates = <100000000>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&pins>;
++		};
++	};
++
++	__overrides__ {
++		clock = <&pwm>, "assigned-clock-rates:0";
++		pins_40_41 = <0>,"+0-1-2";
++		pins_40 = <0>,"-0+1-2";
++		pins_41 = <0>,"-0-1+2";
++		pull_up = <&pins>, "brcm,pull:0=", <BCM2835_PUD_UP>;
++		pull_down = <&pins>, "brcm,pull:0=", <BCM2835_PUD_DOWN>;
++		pull_off = <&pins>, "brcm,pull:0=", <BCM2835_PUD_OFF>;
++	};
++};
diff --git a/target/linux/bcm27xx/patches-6.1/950-0466-overlays-audremap-Include-the-fsels-values.patch b/target/linux/bcm27xx/patches-6.1/950-0466-overlays-audremap-Include-the-fsels-values.patch
new file mode 100644
index 00000000000000..a6b71271dce2e3
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0466-overlays-audremap-Include-the-fsels-values.patch
@@ -0,0 +1,50 @@
+From ba0b41445ee8a911ed780564788fbd58c34a62fa Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 21 Nov 2022 14:18:57 +0000
+Subject: [PATCH] overlays: audremap: Include the fsels values
+
+Add the alt function selectors, and document that pins_40_45 is not
+suitable for BCM2711 because the pins are split across the two PWM
+interfaces.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README               |  3 ++-
+ arch/arm/boot/dts/overlays/audremap-overlay.dts | 12 ++++++++----
+ 2 files changed, 10 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -685,7 +685,8 @@ Params: swap_lr                 Reverse
+         pins_12_13              Select GPIOs 12 & 13 (default)
+         pins_18_19              Select GPIOs 18 & 19
+         pins_40_41              Select GPIOs 40 & 41
+-        pins_40_45              Select GPIOs 40 & 45
++        pins_40_45              Select GPIOs 40 & 45 (don't use on BCM2711 - the
++                                pins are on different controllers)
+ 
+ 
+ Name:   balena-fin
+--- a/arch/arm/boot/dts/overlays/audremap-overlay.dts
++++ b/arch/arm/boot/dts/overlays/audremap-overlay.dts
+@@ -22,12 +22,16 @@
+ 		swap_lr = <&frag0>, "swap_lr?";
+ 		enable_jack = <&frag0>, "enable_jack?";
+ 		pins_12_13 = <&frag0>,"brcm,pins:0=12",
+-		             <&frag0>,"brcm,pins:4=13";
++		             <&frag0>,"brcm,pins:4=13",
++			     <&frag0>,"brcm,function:0=4";
+ 		pins_18_19 = <&frag0>,"brcm,pins:0=18",
+-		             <&frag0>,"brcm,pins:4=19";
++		             <&frag0>,"brcm,pins:4=19",
++			     <&frag0>,"brcm,function:0=2";
+ 		pins_40_41 = <&frag0>,"brcm,pins:0=40",
+-		             <&frag0>,"brcm,pins:4=41";
++		             <&frag0>,"brcm,pins:4=41",
++			     <&frag0>,"brcm,function:0=4";
+ 		pins_40_45 = <&frag0>,"brcm,pins:0=40",
+-		             <&frag0>,"brcm,pins:4=45";
++		             <&frag0>,"brcm,pins:4=45",
++			     <&frag0>,"brcm,function:0=4";
+ 	};
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0467-overlays-i2c-sensor-Make-smbus-timeout-disable-optio.patch b/target/linux/bcm27xx/patches-6.1/950-0467-overlays-i2c-sensor-Make-smbus-timeout-disable-optio.patch
new file mode 100644
index 00000000000000..83663a2f023cb3
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0467-overlays-i2c-sensor-Make-smbus-timeout-disable-optio.patch
@@ -0,0 +1,48 @@
+From ef6a692bf0e076c905a912fbb8e65481c354a7ca Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 23 Nov 2022 11:51:38 +0000
+Subject: [PATCH] overlays: i2c-sensor: Make smbus-timeout-disable
+ optional
+
+Although disabling the SMBUS timeout may be useful, not all chips
+support it. The driver treats attempting to disable the timeout on a
+non-supporting chip as an error, so make it an option enabled using the
+no_timeout parameter.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README                 | 5 +++++
+ arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi | 2 +-
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -1999,6 +1999,11 @@ Params: addr                    Set the
+                                 use the "jc42" option.
+                                 Valid addresses are 0x18-0x1f (default 0x18)
+ 
++        no_timeout              Disable the SMBUS timeout. N.B. Only supported
++                                by some jc42 devices - using with an
++                                incompatible device can stop it from being
++                                activated.
++
+         sht3x                   Select the Sensiron SHT3x temperature and
+                                 humidity sensor. Valid addresses 0x44-0x45,
+                                 default 0x44
+--- a/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+@@ -347,7 +347,6 @@
+ 			jc42: jc42@18 {
+ 				compatible = "jedec,jc-42.4-temp";
+ 				reg = <0x18>;
+-				smbus-timeout-disable;
+ 			};
+ 		};
+ 	};
+@@ -383,5 +382,6 @@
+ 			<&ds1621>,"reg:0", <&bme680>,"reg:0", <&ccs811>,"reg:0",
+ 			<&bh1750>,"reg:0", <&mcp980x>,"reg:0", <&jc42>,"reg:0";
+ 		int_pin = <&max30102>, "interrupts:0";
++		no_timeout = <&jc42>, "smbus-timeout-disable?";
+ 	};
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0468-overlays-Mention-Digi2-Pro-audio-card-in-README.patch b/target/linux/bcm27xx/patches-6.1/950-0468-overlays-Mention-Digi2-Pro-audio-card-in-README.patch
new file mode 100644
index 00000000000000..f2eab6a6a4f87b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0468-overlays-Mention-Digi2-Pro-audio-card-in-README.patch
@@ -0,0 +1,21 @@
+From 14b2f77aa947c953b9629ae69d4a5fd47933c943 Mon Sep 17 00:00:00 2001
+From: reinisb <reinis.babris@gmail.com>
+Date: Fri, 25 Nov 2022 12:53:50 +0200
+Subject: [PATCH] overlays: Mention Digi2 Pro audio card in README
+
+https://www.hifiberry.com/blog/the-new-digi2-pro/
+---
+ arch/arm/boot/dts/overlays/README | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -1606,7 +1606,7 @@ Params: <None>
+ 
+ 
+ Name:   hifiberry-digi-pro
+-Info:   Configures the HifiBerry Digi+ Pro audio card
++Info:   Configures the HifiBerry Digi+ Pro and Digi2 Pro audio card
+ Load:   dtoverlay=hifiberry-digi-pro
+ Params: <None>
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0469-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch b/target/linux/bcm27xx/patches-6.1/950-0469-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch
new file mode 100644
index 00000000000000..474698e913054b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0469-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch
@@ -0,0 +1,119 @@
+From 4f3e85c6f129199a432ef4ed3edbb667a5dedcc1 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Thu, 1 Dec 2022 16:59:44 +0000
+Subject: [PATCH] usb: xhci: add XHCI_VLI_HUB_TT_QUIRK
+
+The integrated USB2.0 hub in the VL805 chipset has a bug where it
+incorrectly determines the remaining available frame time before the
+host next sends a SOF packet with an incremented frame_number.
+
+See the USB2.0 specification sections 11.3 and 11.14.2.3.
+
+The hub's non-periodic TT handler can transmit the IN/OUT handshake
+token too late, so a following 64-byte DATA0/1 packet causes the ACK
+handshake to collide with the propagated SOF. This causes port babble.
+
+Avoid ringing doorbells for vulnerable endpoints during uFrame 7 if the
+TR is Idle to stop one source of babble. An IN transfer for a Running TR
+may happen at any time, so there's not much we can do about that.
+
+Ideally a hub firmware update to properly implement frame timeouts is
+needed, and to avoid spinning for up to 125us when submitting TDs to
+Idle rings.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci-pci.c  |  1 +
+ drivers/usb/host/xhci-ring.c | 46 ++++++++++++++++++++++++++++++++++++
+ drivers/usb/host/xhci.h      |  1 +
+ 3 files changed, 48 insertions(+)
+
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -299,6 +299,7 @@ static void xhci_pci_quirks(struct devic
+ 		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
+ 		xhci->quirks |= XHCI_VLI_TRB_CACHE_BUG;
+ 		xhci->quirks |= XHCI_VLI_SS_BULK_OUT_BUG;
++		xhci->quirks |= XHCI_VLI_HUB_TT_QUIRK;
+ 	}
+ 
+ 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -3555,6 +3555,48 @@ static int xhci_align_td(struct xhci_hcd
+ 	return 1;
+ }
+ 
++static void xhci_vl805_hub_tt_quirk(struct xhci_hcd *xhci, struct urb *urb,
++				    struct xhci_ring *ring)
++{
++	struct list_head *tmp;
++	struct usb_device *udev = urb->dev;
++	unsigned int timeout = 0;
++	unsigned int single_td = 0;
++
++	/*
++	 * Adding a TD to an Idle ring for a FS nonperiodic endpoint
++	 * that is behind the internal hub's TT will run the risk of causing a
++	 * downstream port babble if submitted late in uFrame 7.
++	 * Wait until we've moved on into at least uFrame 0
++	 * (MFINDEX references the next SOF to be transmitted).
++	 *
++	 * Rings for IN endpoints in the Running state also risk causing
++	 * babble if the returned data is large, but there's not much we can do
++	 * about it here.
++	 */
++	if (udev->route & 0xffff0 || udev->speed != USB_SPEED_FULL)
++		return;
++
++	list_for_each(tmp, &ring->td_list) {
++		single_td++;
++		if (single_td == 2) {
++			single_td = 0;
++			break;
++		}
++	}
++	if (single_td) {
++		while (timeout < 20 &&
++		       (readl(&xhci->run_regs->microframe_index) & 0x7) == 0) {
++			udelay(10);
++			timeout++;
++		}
++		if (timeout >= 20)
++			xhci_warn(xhci, "MFINDEX didn't advance - %u.%u dodged\n",
++				  readl(&xhci->run_regs->microframe_index) >> 3,
++				  readl(&xhci->run_regs->microframe_index) & 7);
++	}
++}
++
+ /* This is very similar to what ehci-q.c qtd_fill() does */
+ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ 		struct urb *urb, int slot_id, unsigned int ep_index)
+@@ -3723,6 +3765,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
+ 	}
+ 
+ 	check_trb_math(urb, enqd_len);
++	if (xhci->quirks & XHCI_VLI_HUB_TT_QUIRK)
++		xhci_vl805_hub_tt_quirk(xhci, urb, ring);
+ 	giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
+ 			start_cycle, start_trb);
+ 	return 0;
+@@ -3858,6 +3902,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *
+ 			/* Event on completion */
+ 			field | TRB_IOC | TRB_TYPE(TRB_STATUS) | ep_ring->cycle_state);
+ 
++	if (xhci->quirks & XHCI_VLI_HUB_TT_QUIRK)
++		xhci_vl805_hub_tt_quirk(xhci, urb, ep_ring);
+ 	giveback_first_trb(xhci, slot_id, ep_index, 0,
+ 			start_cycle, start_trb);
+ 	return 0;
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1903,6 +1903,7 @@ struct xhci_hcd {
+ #define XHCI_AVOID_DQ_ON_LINK	BIT_ULL(45)
+ #define XHCI_VLI_TRB_CACHE_BUG	BIT_ULL(46)
+ #define XHCI_VLI_SS_BULK_OUT_BUG	BIT_ULL(47)
++#define XHCI_VLI_HUB_TT_QUIRK	BIT_ULL(48)
+ 
+ 	unsigned int		num_active_eps;
+ 	unsigned int		limit_active_eps;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0470-media-i2c-ov7251-Add-module-param-to-select-ext-trig.patch b/target/linux/bcm27xx/patches-6.1/950-0470-media-i2c-ov7251-Add-module-param-to-select-ext-trig.patch
new file mode 100644
index 00000000000000..dba8f36af9a920
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0470-media-i2c-ov7251-Add-module-param-to-select-ext-trig.patch
@@ -0,0 +1,88 @@
+From 9524eae5a46285e574b869879fb0228fb4424a5f Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 1 Dec 2022 13:54:49 +0000
+Subject: [PATCH] media: i2c: ov7251: Add module param to select ext
+ trig mode
+
+As there isn't currently a defined mechanism for selecting an
+external trigger mode on image sensors, copy the imx477
+approach of using a module parameter to enable ext trig.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov7251.c | 35 ++++++++++++++++++++++++++++++++---
+ 1 file changed, 32 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/i2c/ov7251.c
++++ b/drivers/media/i2c/ov7251.c
+@@ -23,6 +23,10 @@
+ #include <media/v4l2-fwnode.h>
+ #include <media/v4l2-subdev.h>
+ 
++static int trigger_mode;
++module_param(trigger_mode, int, 0644);
++MODULE_PARM_DESC(trigger_mode, "Set vsync trigger mode: 0=standalone, (1=source - not implemented), 2=sink");
++
+ #define OV7251_SC_MODE_SELECT		0x0100
+ #define OV7251_SC_MODE_SELECT_SW_STANDBY	0x0
+ #define OV7251_SC_MODE_SELECT_STREAMING		0x1
+@@ -525,7 +529,6 @@ static const struct reg_value ov7251_set
+ 	{ 0x3662, 0x01 },
+ 	{ 0x3663, 0x70 },
+ 	{ 0x3664, 0x50 },
+-	{ 0x3666, 0x0a },
+ 	{ 0x3669, 0x1a },
+ 	{ 0x366a, 0x00 },
+ 	{ 0x366b, 0x50 },
+@@ -592,9 +595,8 @@ static const struct reg_value ov7251_set
+ 	{ 0x3c00, 0x89 },
+ 	{ 0x3c01, 0x63 },
+ 	{ 0x3c02, 0x01 },
+-	{ 0x3c03, 0x00 },
+ 	{ 0x3c04, 0x00 },
+-	{ 0x3c05, 0x03 },
++	{ 0x3c05, 0x01 },
+ 	{ 0x3c06, 0x00 },
+ 	{ 0x3c07, 0x06 },
+ 	{ 0x3c0c, 0x01 },
+@@ -624,6 +626,16 @@ static const struct reg_value ov7251_set
+ 	{ 0x5001, 0x80 },
+ };
+ 
++static const struct reg_value ov7251_ext_trig_on[] = {
++	{ 0x3666, 0x00 },
++	{ 0x3c03, 0x17 },
++};
++
++static const struct reg_value ov7251_ext_trig_off[] = {
++	{ 0x3666, 0x0a },
++	{ 0x3c03, 0x00 },
++};
++
+ static const unsigned long supported_xclk_rates[] = {
+ 	[OV7251_19_2_MHZ] = 19200000,
+ 	[OV7251_24_MHZ] = 24000000,
+@@ -1372,6 +1384,23 @@ static int ov7251_s_stream(struct v4l2_s
+ 			dev_err(ov7251->dev, "could not sync v4l2 controls\n");
+ 			goto err_power_down;
+ 		}
++
++		/* Set vsync trigger mode */
++		switch (trigger_mode) {
++		case 2:
++			ov7251_set_register_array(ov7251,
++						  ov7251_ext_trig_on,
++						  ARRAY_SIZE(ov7251_ext_trig_on));
++			break;
++		case 0:
++		default:
++			/* case 1 for ext trig source currently not implemented */
++			ov7251_set_register_array(ov7251,
++						  ov7251_ext_trig_off,
++						  ARRAY_SIZE(ov7251_ext_trig_off));
++			break;
++		}
++
+ 		ret = ov7251_write_reg(ov7251, OV7251_SC_MODE_SELECT,
+ 				       OV7251_SC_MODE_SELECT_STREAMING);
+ 		if (ret)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0471-vc4_hdmi-Avoid-log-spam-for-audio-start-failure.patch b/target/linux/bcm27xx/patches-6.1/950-0471-vc4_hdmi-Avoid-log-spam-for-audio-start-failure.patch
new file mode 100644
index 00000000000000..5032cd825674e4
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0471-vc4_hdmi-Avoid-log-spam-for-audio-start-failure.patch
@@ -0,0 +1,41 @@
+From fc47ef1a8d52d47d00d5957ec45d6b7b4dc661f6 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Tue, 6 Dec 2022 15:05:56 +0000
+Subject: [PATCH] vc4_hdmi: Avoid log spam for audio start failure
+
+We regularly get dmesg error reports of:
+[   18.184066] hdmi-audio-codec hdmi-audio-codec.3.auto: ASoC: error at snd_soc_dai_startup on i2s-hifi: -19
+[   18.184098]  MAI: soc_pcm_open() failed (-19)
+
+Currently I get 30 of these when booting to desktop.
+We always say, ignore they are harmless, but removing them would be good.
+
+A bit of investigation shows, for me, the errors are all generated by second, unused hdmi interface.
+
+It shows as an alsa device, and pulseaudio attempts to open it (numerous times), generating a kernel
+error message each time.
+
+systemctl --user restart pulseaudio.service generates 6 additional error messages.
+
+The error messages all come through:
+https://github.com/raspberrypi/linux/blob/a009a9c0d79dfec114ee5102ec3d3325a172c952/sound/soc/soc-pcm.c#L39
+
+which suggests returning ENOTSUPP, rather that ENODEV will be quiet. And indeed it is.
+
+Note: earlier kernels do not have the quiet ENOTSUPP, so additional cherry-picks will be needed to backport
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -2368,7 +2368,7 @@ static int vc4_hdmi_audio_startup(struct
+ 	}
+ 
+ 	if (!vc4_hdmi_audio_can_stream(vc4_hdmi)) {
+-		ret = -ENODEV;
++		ret = -ENOTSUPP;
+ 		goto out_dev_exit;
+ 	}
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0472-drm-tests-Order-Kunit-tests-in-Makefile.patch b/target/linux/bcm27xx/patches-6.1/950-0472-drm-tests-Order-Kunit-tests-in-Makefile.patch
new file mode 100644
index 00000000000000..679889ac165c50
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0472-drm-tests-Order-Kunit-tests-in-Makefile.patch
@@ -0,0 +1,40 @@
+From e5cda9b56eb3140b7bf698b545686aa850de9928 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Thu, 29 Sep 2022 18:30:56 +0200
+Subject: [PATCH] drm/tests: Order Kunit tests in Makefile
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Since we've recently added a ton of tests, the list starts to be a bit
+of a mess and creates unneeded conflicts.
+
+Let's order it alphabetically.
+
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Noralf Trønnes <noralf@tronnes.org>
+Link: https://lore.kernel.org/r/20220728-rpi-analog-tv-properties-v4-2-60d38873f782@cerno.tech
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/tests/Makefile | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/tests/Makefile
++++ b/drivers/gpu/drm/tests/Makefile
+@@ -1,5 +1,13 @@
+ # SPDX-License-Identifier: GPL-2.0
+ 
+-obj-$(CONFIG_DRM_KUNIT_TEST) += drm_format_helper_test.o drm_damage_helper_test.o \
+-	drm_cmdline_parser_test.o drm_rect_test.o drm_format_test.o drm_plane_helper_test.o \
+-	drm_dp_mst_helper_test.o drm_framebuffer_test.o drm_buddy_test.o drm_mm_test.o
++obj-$(CONFIG_DRM_KUNIT_TEST) += \
++	drm_buddy_test.o \
++	drm_cmdline_parser_test.o \
++	drm_damage_helper_test.o \
++	drm_dp_mst_helper_test.o \
++	drm_format_helper_test.o \
++	drm_format_test.o \
++	drm_framebuffer_test.o \
++	drm_mm_test.o \
++	drm_plane_helper_test.o \
++	drm_rect_test.o
diff --git a/target/linux/bcm27xx/patches-6.1/950-0473-drm-tests-Add-Kunit-Helpers.patch b/target/linux/bcm27xx/patches-6.1/950-0473-drm-tests-Add-Kunit-Helpers.patch
new file mode 100644
index 00000000000000..1bc53ef3db2301
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0473-drm-tests-Add-Kunit-Helpers.patch
@@ -0,0 +1,116 @@
+From baf556e423385c116217e143fe352d2b062a10e3 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 14 Nov 2022 14:00:21 +0100
+Subject: [PATCH] drm/tests: Add Kunit Helpers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+As the number of kunit tests in KMS grows further, we start to have
+multiple test suites that, for example, need to register a mock DRM
+driver to interact with the KMS function they are supposed to test.
+
+Let's add a file meant to provide those kind of helpers to avoid
+duplication.
+
+Reviewed-by: Noralf Trønnes <noralf@tronnes.org>
+Tested-by: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
+Link: https://lore.kernel.org/r/20220728-rpi-analog-tv-properties-v9-2-24b168e5bcd5@cerno.tech
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/tests/Makefile            |  1 +
+ drivers/gpu/drm/tests/drm_kunit_helpers.c | 64 +++++++++++++++++++++++
+ drivers/gpu/drm/tests/drm_kunit_helpers.h |  9 ++++
+ 3 files changed, 74 insertions(+)
+ create mode 100644 drivers/gpu/drm/tests/drm_kunit_helpers.c
+ create mode 100644 drivers/gpu/drm/tests/drm_kunit_helpers.h
+
+--- a/drivers/gpu/drm/tests/Makefile
++++ b/drivers/gpu/drm/tests/Makefile
+@@ -8,6 +8,7 @@ obj-$(CONFIG_DRM_KUNIT_TEST) += \
+ 	drm_format_helper_test.o \
+ 	drm_format_test.o \
+ 	drm_framebuffer_test.o \
++	drm_kunit_helpers.o \
+ 	drm_mm_test.o \
+ 	drm_plane_helper_test.o \
+ 	drm_rect_test.o
+--- /dev/null
++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c
+@@ -0,0 +1,64 @@
++#include <drm/drm_drv.h>
++#include <drm/drm_managed.h>
++
++#include <kunit/resource.h>
++
++#include <linux/device.h>
++
++struct kunit_dev {
++	struct drm_device base;
++};
++
++static const struct drm_mode_config_funcs drm_mode_config_funcs = {
++};
++
++static int dev_init(struct kunit_resource *res, void *ptr)
++{
++	char *name = ptr;
++	struct device *dev;
++
++	dev = root_device_register(name);
++	if (IS_ERR(dev))
++		return PTR_ERR(dev);
++
++	res->data = dev;
++	return 0;
++}
++
++static void dev_free(struct kunit_resource *res)
++{
++	struct device *dev = res->data;
++
++	root_device_unregister(dev);
++}
++
++struct drm_device *drm_kunit_device_init(struct kunit *test, u32 features, char *name)
++{
++	struct kunit_dev *kdev;
++	struct drm_device *drm;
++	struct drm_driver *driver;
++	struct device *dev;
++	int ret;
++
++	dev = kunit_alloc_resource(test, dev_init, dev_free, GFP_KERNEL, name);
++	if (!dev)
++		return ERR_PTR(-ENOMEM);
++
++	driver = kunit_kzalloc(test, sizeof(*driver), GFP_KERNEL);
++	if (!driver)
++		return ERR_PTR(-ENOMEM);
++
++	driver->driver_features = features;
++	kdev = devm_drm_dev_alloc(dev, driver, struct kunit_dev, base);
++	if (IS_ERR(kdev))
++		return ERR_CAST(kdev);
++
++	drm = &kdev->base;
++	drm->mode_config.funcs = &drm_mode_config_funcs;
++
++	ret = drmm_mode_config_init(drm);
++	if (ret)
++		return ERR_PTR(ret);
++
++	return drm;
++}
+--- /dev/null
++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.h
+@@ -0,0 +1,9 @@
++#ifndef DRM_KUNIT_HELPERS_H_
++#define DRM_KUNIT_HELPERS_H_
++
++struct drm_device;
++struct kunit;
++
++struct drm_device *drm_kunit_device_init(struct kunit *test, u32 features, char *name);
++
++#endif // DRM_KUNIT_HELPERS_H_
diff --git a/target/linux/bcm27xx/patches-6.1/950-0474-drm-tests-Include-helpers-header.patch b/target/linux/bcm27xx/patches-6.1/950-0474-drm-tests-Include-helpers-header.patch
new file mode 100644
index 00000000000000..4971d403ad826d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0474-drm-tests-Include-helpers-header.patch
@@ -0,0 +1,34 @@
+From 9cd3f22045be6d2e97fb0efeec08a248e0c05bc8 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Wed, 16 Nov 2022 10:17:10 +0100
+Subject: [PATCH] drm/tests: Include helpers header
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The kunit helpers code weren't including its header, leading to a
+warning that no previous prototype had been defined for public
+functions.
+
+Include the matching header to fix the warning.
+
+Fixes: 44a3928324e9 ("drm/tests: Add Kunit Helpers")
+Reported-by: kernel test robot <lkp@intel.com>
+Reviewed-by: Maíra Canal <mairacanal@riseup.net>
+Link: https://lore.kernel.org/r/20221116091712.1309651-1-maxime@cerno.tech
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/tests/drm_kunit_helpers.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/tests/drm_kunit_helpers.c
++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c
+@@ -5,6 +5,8 @@
+ 
+ #include <linux/device.h>
+ 
++#include "drm_kunit_helpers.h"
++
+ struct kunit_dev {
+ 	struct drm_device base;
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0475-drm-tests-helpers-Add-module-infos.patch b/target/linux/bcm27xx/patches-6.1/950-0475-drm-tests-helpers-Add-module-infos.patch
new file mode 100644
index 00000000000000..c2fea45aa80096
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0475-drm-tests-helpers-Add-module-infos.patch
@@ -0,0 +1,31 @@
+From 42707dfeb57dc0a1cb1519b7ea29de15b4b3af6e Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Wed, 16 Nov 2022 10:17:11 +0100
+Subject: [PATCH] drm/tests: helpers: Add module infos
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The MODULE_LICENSE macro is missing from the kunit helpers file, thus
+leading to a build error.
+
+Let's introduce it along with MODULE_AUTHOR.
+
+Fixes: 44a3928324e9 ("drm/tests: Add Kunit Helpers")
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Reviewed-by: Maíra Canal <mairacanal@riseup.net>
+Link: https://lore.kernel.org/r/20221116091712.1309651-2-maxime@cerno.tech
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/tests/drm_kunit_helpers.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/tests/drm_kunit_helpers.c
++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c
+@@ -64,3 +64,6 @@ struct drm_device *drm_kunit_device_init
+ 
+ 	return drm;
+ }
++
++MODULE_AUTHOR("Maxime Ripard <maxime@cerno.tech>");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0476-drm-tests-helpers-Add-SPDX-header.patch b/target/linux/bcm27xx/patches-6.1/950-0476-drm-tests-helpers-Add-SPDX-header.patch
new file mode 100644
index 00000000000000..44d93987e7409f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0476-drm-tests-helpers-Add-SPDX-header.patch
@@ -0,0 +1,37 @@
+From b15a8411b58861833fa961620417ae51ad052397 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Wed, 16 Nov 2022 16:18:33 +0100
+Subject: [PATCH] drm/tests: helpers: Add SPDX header
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The SPDX header is missing, let's add it and fix the corresponding
+checkpatch warning.
+
+Suggested-by: Maíra Canal <mairacanal@riseup.net>
+Fixes: 44a3928324e9 ("drm/tests: Add Kunit Helpers")
+Reviewed-by: Maíra Canal <mairacanal@riseup.net>
+Link: https://lore.kernel.org/r/20221116151833.1679379-2-maxime@cerno.tech
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/tests/drm_kunit_helpers.c | 2 ++
+ drivers/gpu/drm/tests/drm_kunit_helpers.h | 2 ++
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/tests/drm_kunit_helpers.c
++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c
+@@ -1,3 +1,5 @@
++// SPDX-License-Identifier: GPL-2.0
++
+ #include <drm/drm_drv.h>
+ #include <drm/drm_managed.h>
+ 
+--- a/drivers/gpu/drm/tests/drm_kunit_helpers.h
++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.h
+@@ -1,3 +1,5 @@
++// SPDX-License-Identifier: GPL-2.0
++
+ #ifndef DRM_KUNIT_HELPERS_H_
+ #define DRM_KUNIT_HELPERS_H_
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0477-drm-atomic-Constify-the-old-new-state-accessors.patch b/target/linux/bcm27xx/patches-6.1/950-0477-drm-atomic-Constify-the-old-new-state-accessors.patch
new file mode 100644
index 00000000000000..983c54fae120af
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0477-drm-atomic-Constify-the-old-new-state-accessors.patch
@@ -0,0 +1,199 @@
+From d094cf748495c8c9be15bbbf9801237c8e390c8a Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Wed, 23 Nov 2022 16:25:51 +0100
+Subject: [PATCH] drm/atomic: Constify the old/new state accessors
+
+The drm_atomic_get_(old|new)_*_state don't modify the passed
+drm_atomic_state, so we can make it const.
+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221123-rpi-kunit-tests-v1-9-051a0bb60a16@cerno.tech
+---
+ drivers/gpu/drm/drm_atomic.c | 12 ++++++------
+ include/drm/drm_atomic.h     | 32 ++++++++++++++++----------------
+ 2 files changed, 22 insertions(+), 22 deletions(-)
+
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -880,7 +880,7 @@ EXPORT_SYMBOL(drm_atomic_get_private_obj
+  * or NULL if the private_obj is not part of the global atomic state.
+  */
+ struct drm_private_state *
+-drm_atomic_get_old_private_obj_state(struct drm_atomic_state *state,
++drm_atomic_get_old_private_obj_state(const struct drm_atomic_state *state,
+ 				     struct drm_private_obj *obj)
+ {
+ 	int i;
+@@ -902,7 +902,7 @@ EXPORT_SYMBOL(drm_atomic_get_old_private
+  * or NULL if the private_obj is not part of the global atomic state.
+  */
+ struct drm_private_state *
+-drm_atomic_get_new_private_obj_state(struct drm_atomic_state *state,
++drm_atomic_get_new_private_obj_state(const struct drm_atomic_state *state,
+ 				     struct drm_private_obj *obj)
+ {
+ 	int i;
+@@ -934,7 +934,7 @@ EXPORT_SYMBOL(drm_atomic_get_new_private
+  * not connected.
+  */
+ struct drm_connector *
+-drm_atomic_get_old_connector_for_encoder(struct drm_atomic_state *state,
++drm_atomic_get_old_connector_for_encoder(const struct drm_atomic_state *state,
+ 					 struct drm_encoder *encoder)
+ {
+ 	struct drm_connector_state *conn_state;
+@@ -968,7 +968,7 @@ EXPORT_SYMBOL(drm_atomic_get_old_connect
+  * not connected.
+  */
+ struct drm_connector *
+-drm_atomic_get_new_connector_for_encoder(struct drm_atomic_state *state,
++drm_atomic_get_new_connector_for_encoder(const struct drm_atomic_state *state,
+ 					 struct drm_encoder *encoder)
+ {
+ 	struct drm_connector_state *conn_state;
+@@ -1118,7 +1118,7 @@ EXPORT_SYMBOL(drm_atomic_get_bridge_stat
+  * the bridge is not part of the global atomic state.
+  */
+ struct drm_bridge_state *
+-drm_atomic_get_old_bridge_state(struct drm_atomic_state *state,
++drm_atomic_get_old_bridge_state(const struct drm_atomic_state *state,
+ 				struct drm_bridge *bridge)
+ {
+ 	struct drm_private_state *obj_state;
+@@ -1140,7 +1140,7 @@ EXPORT_SYMBOL(drm_atomic_get_old_bridge_
+  * the bridge is not part of the global atomic state.
+  */
+ struct drm_bridge_state *
+-drm_atomic_get_new_bridge_state(struct drm_atomic_state *state,
++drm_atomic_get_new_bridge_state(const struct drm_atomic_state *state,
+ 				struct drm_bridge *bridge)
+ {
+ 	struct drm_private_state *obj_state;
+--- a/include/drm/drm_atomic.h
++++ b/include/drm/drm_atomic.h
+@@ -515,17 +515,17 @@ struct drm_private_state * __must_check
+ drm_atomic_get_private_obj_state(struct drm_atomic_state *state,
+ 				 struct drm_private_obj *obj);
+ struct drm_private_state *
+-drm_atomic_get_old_private_obj_state(struct drm_atomic_state *state,
++drm_atomic_get_old_private_obj_state(const struct drm_atomic_state *state,
+ 				     struct drm_private_obj *obj);
+ struct drm_private_state *
+-drm_atomic_get_new_private_obj_state(struct drm_atomic_state *state,
++drm_atomic_get_new_private_obj_state(const struct drm_atomic_state *state,
+ 				     struct drm_private_obj *obj);
+ 
+ struct drm_connector *
+-drm_atomic_get_old_connector_for_encoder(struct drm_atomic_state *state,
++drm_atomic_get_old_connector_for_encoder(const struct drm_atomic_state *state,
+ 					 struct drm_encoder *encoder);
+ struct drm_connector *
+-drm_atomic_get_new_connector_for_encoder(struct drm_atomic_state *state,
++drm_atomic_get_new_connector_for_encoder(const struct drm_atomic_state *state,
+ 					 struct drm_encoder *encoder);
+ 
+ /**
+@@ -540,7 +540,7 @@ drm_atomic_get_new_connector_for_encoder
+  * @drm_atomic_get_new_crtc_state should be used instead.
+  */
+ static inline struct drm_crtc_state *
+-drm_atomic_get_existing_crtc_state(struct drm_atomic_state *state,
++drm_atomic_get_existing_crtc_state(const struct drm_atomic_state *state,
+ 				   struct drm_crtc *crtc)
+ {
+ 	return state->crtcs[drm_crtc_index(crtc)].state;
+@@ -555,7 +555,7 @@ drm_atomic_get_existing_crtc_state(struc
+  * NULL if the CRTC is not part of the global atomic state.
+  */
+ static inline struct drm_crtc_state *
+-drm_atomic_get_old_crtc_state(struct drm_atomic_state *state,
++drm_atomic_get_old_crtc_state(const struct drm_atomic_state *state,
+ 			      struct drm_crtc *crtc)
+ {
+ 	return state->crtcs[drm_crtc_index(crtc)].old_state;
+@@ -569,7 +569,7 @@ drm_atomic_get_old_crtc_state(struct drm
+  * NULL if the CRTC is not part of the global atomic state.
+  */
+ static inline struct drm_crtc_state *
+-drm_atomic_get_new_crtc_state(struct drm_atomic_state *state,
++drm_atomic_get_new_crtc_state(const struct drm_atomic_state *state,
+ 			      struct drm_crtc *crtc)
+ {
+ 	return state->crtcs[drm_crtc_index(crtc)].new_state;
+@@ -587,7 +587,7 @@ drm_atomic_get_new_crtc_state(struct drm
+  * @drm_atomic_get_new_plane_state should be used instead.
+  */
+ static inline struct drm_plane_state *
+-drm_atomic_get_existing_plane_state(struct drm_atomic_state *state,
++drm_atomic_get_existing_plane_state(const struct drm_atomic_state *state,
+ 				    struct drm_plane *plane)
+ {
+ 	return state->planes[drm_plane_index(plane)].state;
+@@ -602,7 +602,7 @@ drm_atomic_get_existing_plane_state(stru
+  * NULL if the plane is not part of the global atomic state.
+  */
+ static inline struct drm_plane_state *
+-drm_atomic_get_old_plane_state(struct drm_atomic_state *state,
++drm_atomic_get_old_plane_state(const struct drm_atomic_state *state,
+ 			       struct drm_plane *plane)
+ {
+ 	return state->planes[drm_plane_index(plane)].old_state;
+@@ -617,7 +617,7 @@ drm_atomic_get_old_plane_state(struct dr
+  * NULL if the plane is not part of the global atomic state.
+  */
+ static inline struct drm_plane_state *
+-drm_atomic_get_new_plane_state(struct drm_atomic_state *state,
++drm_atomic_get_new_plane_state(const struct drm_atomic_state *state,
+ 			       struct drm_plane *plane)
+ {
+ 	return state->planes[drm_plane_index(plane)].new_state;
+@@ -635,7 +635,7 @@ drm_atomic_get_new_plane_state(struct dr
+  * @drm_atomic_get_new_connector_state should be used instead.
+  */
+ static inline struct drm_connector_state *
+-drm_atomic_get_existing_connector_state(struct drm_atomic_state *state,
++drm_atomic_get_existing_connector_state(const struct drm_atomic_state *state,
+ 					struct drm_connector *connector)
+ {
+ 	int index = drm_connector_index(connector);
+@@ -655,7 +655,7 @@ drm_atomic_get_existing_connector_state(
+  * or NULL if the connector is not part of the global atomic state.
+  */
+ static inline struct drm_connector_state *
+-drm_atomic_get_old_connector_state(struct drm_atomic_state *state,
++drm_atomic_get_old_connector_state(const struct drm_atomic_state *state,
+ 				   struct drm_connector *connector)
+ {
+ 	int index = drm_connector_index(connector);
+@@ -675,7 +675,7 @@ drm_atomic_get_old_connector_state(struc
+  * or NULL if the connector is not part of the global atomic state.
+  */
+ static inline struct drm_connector_state *
+-drm_atomic_get_new_connector_state(struct drm_atomic_state *state,
++drm_atomic_get_new_connector_state(const struct drm_atomic_state *state,
+ 				   struct drm_connector *connector)
+ {
+ 	int index = drm_connector_index(connector);
+@@ -713,7 +713,7 @@ drm_atomic_get_new_connector_state(struc
+  * Read-only pointer to the current plane state.
+  */
+ static inline const struct drm_plane_state *
+-__drm_atomic_get_current_plane_state(struct drm_atomic_state *state,
++__drm_atomic_get_current_plane_state(const struct drm_atomic_state *state,
+ 				     struct drm_plane *plane)
+ {
+ 	if (state->planes[drm_plane_index(plane)].state)
+@@ -1134,10 +1134,10 @@ struct drm_bridge_state *
+ drm_atomic_get_bridge_state(struct drm_atomic_state *state,
+ 			    struct drm_bridge *bridge);
+ struct drm_bridge_state *
+-drm_atomic_get_old_bridge_state(struct drm_atomic_state *state,
++drm_atomic_get_old_bridge_state(const struct drm_atomic_state *state,
+ 				struct drm_bridge *bridge);
+ struct drm_bridge_state *
+-drm_atomic_get_new_bridge_state(struct drm_atomic_state *state,
++drm_atomic_get_new_bridge_state(const struct drm_atomic_state *state,
+ 				struct drm_bridge *bridge);
+ 
+ #endif /* DRM_ATOMIC_H_ */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0478-drm-vc4-Constify-container_of-wrappers.patch b/target/linux/bcm27xx/patches-6.1/950-0478-drm-vc4-Constify-container_of-wrappers.patch
new file mode 100644
index 00000000000000..795c8e191e2a79
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0478-drm-vc4-Constify-container_of-wrappers.patch
@@ -0,0 +1,91 @@
+From aec4486d6889afcfe706684f2d24cfe9350168b4 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Wed, 23 Nov 2022 16:25:53 +0100
+Subject: [PATCH] drm/vc4: Constify container_of wrappers
+
+None of our wrappers around container_of to access our objects from the
+DRM object pointer actually modify the latter.
+
+Let's make them const.
+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221123-rpi-kunit-tests-v1-11-051a0bb60a16@cerno.tech
+---
+ drivers/gpu/drm/vc4/vc4_drv.h | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -238,7 +238,7 @@ struct vc4_dev {
+ };
+ 
+ static inline struct vc4_dev *
+-to_vc4_dev(struct drm_device *dev)
++to_vc4_dev(const struct drm_device *dev)
+ {
+ 	return container_of(dev, struct vc4_dev, base);
+ }
+@@ -291,7 +291,7 @@ struct vc4_bo {
+ };
+ 
+ static inline struct vc4_bo *
+-to_vc4_bo(struct drm_gem_object *bo)
++to_vc4_bo(const struct drm_gem_object *bo)
+ {
+ 	return container_of(to_drm_gem_dma_obj(bo), struct vc4_bo, base);
+ }
+@@ -304,7 +304,7 @@ struct vc4_fence {
+ };
+ 
+ static inline struct vc4_fence *
+-to_vc4_fence(struct dma_fence *fence)
++to_vc4_fence(const struct dma_fence *fence)
+ {
+ 	return container_of(fence, struct vc4_fence, base);
+ }
+@@ -365,7 +365,7 @@ struct vc4_plane {
+ };
+ 
+ static inline struct vc4_plane *
+-to_vc4_plane(struct drm_plane *plane)
++to_vc4_plane(const struct drm_plane *plane)
+ {
+ 	return container_of(plane, struct vc4_plane, base);
+ }
+@@ -441,7 +441,7 @@ struct vc4_plane_state {
+ };
+ 
+ static inline struct vc4_plane_state *
+-to_vc4_plane_state(struct drm_plane_state *state)
++to_vc4_plane_state(const struct drm_plane_state *state)
+ {
+ 	return container_of(state, struct vc4_plane_state, base);
+ }
+@@ -471,7 +471,7 @@ struct vc4_encoder {
+ };
+ 
+ static inline struct vc4_encoder *
+-to_vc4_encoder(struct drm_encoder *encoder)
++to_vc4_encoder(const struct drm_encoder *encoder)
+ {
+ 	return container_of(encoder, struct vc4_encoder, base);
+ }
+@@ -565,7 +565,7 @@ struct vc4_crtc {
+ };
+ 
+ static inline struct vc4_crtc *
+-to_vc4_crtc(struct drm_crtc *crtc)
++to_vc4_crtc(const struct drm_crtc *crtc)
+ {
+ 	return container_of(crtc, struct vc4_crtc, base);
+ }
+@@ -608,7 +608,7 @@ struct vc4_crtc_state {
+ #define VC4_HVS_CHANNEL_DISABLED ((unsigned int)-1)
+ 
+ static inline struct vc4_crtc_state *
+-to_vc4_crtc_state(struct drm_crtc_state *crtc_state)
++to_vc4_crtc_state(const struct drm_crtc_state *crtc_state)
+ {
+ 	return container_of(crtc_state, struct vc4_crtc_state, base);
+ }
diff --git a/target/linux/bcm27xx/patches-6.1/950-0479-drm-vc4-kms-Constify-the-HVS-old-new-state-helpers.patch b/target/linux/bcm27xx/patches-6.1/950-0479-drm-vc4-kms-Constify-the-HVS-old-new-state-helpers.patch
new file mode 100644
index 00000000000000..e94dbb8a31989e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0479-drm-vc4-kms-Constify-the-HVS-old-new-state-helpers.patch
@@ -0,0 +1,35 @@
+From 18d15815d045976ffce0c57aed3d3a61e0d04297 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Wed, 23 Nov 2022 16:25:55 +0100
+Subject: [PATCH] drm/vc4: kms: Constify the HVS old/new state helpers
+
+The vc4_hvs_get_(old|new)_global_state functions don't modify the
+drm_atomic_state passed as an argument, so let's make it const.
+
+Link: https://lore.kernel.org/r/20221123-rpi-kunit-tests-v1-13-051a0bb60a16@cerno.tech
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/vc4_kms.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_kms.c
+@@ -194,7 +194,7 @@ vc4_ctm_commit(struct vc4_dev *vc4, stru
+ }
+ 
+ static struct vc4_hvs_state *
+-vc4_hvs_get_new_global_state(struct drm_atomic_state *state)
++vc4_hvs_get_new_global_state(const struct drm_atomic_state *state)
+ {
+ 	struct vc4_dev *vc4 = to_vc4_dev(state->dev);
+ 	struct drm_private_state *priv_state;
+@@ -207,7 +207,7 @@ vc4_hvs_get_new_global_state(struct drm_
+ }
+ 
+ static struct vc4_hvs_state *
+-vc4_hvs_get_old_global_state(struct drm_atomic_state *state)
++vc4_hvs_get_old_global_state(const struct drm_atomic_state *state)
+ {
+ 	struct vc4_dev *vc4 = to_vc4_dev(state->dev);
+ 	struct drm_private_state *priv_state;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0480-drm-vc4-kms-Sort-the-CRTCs-by-output-before-assignin.patch b/target/linux/bcm27xx/patches-6.1/950-0480-drm-vc4-kms-Sort-the-CRTCs-by-output-before-assignin.patch
new file mode 100644
index 00000000000000..dc667ed366cc2a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0480-drm-vc4-kms-Sort-the-CRTCs-by-output-before-assignin.patch
@@ -0,0 +1,201 @@
+From 91dc4d4202c571edfcbc9357642609b07a9cbee8 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Wed, 23 Nov 2022 16:25:52 +0100
+Subject: [PATCH] drm/vc4: kms: Sort the CRTCs by output before
+ assigning them
+
+On the vc4 devices (and later), the blending is done by a single device
+called the HVS. The HVS has three FIFO that can operate in parallel, and
+route their output to 6 CRTCs and 7 encoders on the BCM2711.
+
+Each of these CRTCs and encoders have some constraints on which FIFO
+they can feed from, so we need some code to take all those constraints
+into account and assign FIFOs to CRTCs.
+
+The problem can be simplified by assigning those FIFOs to CRTCs by
+ascending output index number. We had a comment mentioning it already,
+but we were never actually enforcing it.
+
+It was working still in most situations because the probe order is
+roughly equivalent, except for the (optional, and fairly rarely used on
+the Pi4) VEC which was last in the probe order sequence, but one of the
+earliest device to assign.
+
+This resulted in configurations that were rejected by our code but were
+still valid with a different assignment.
+
+We can fix this by making sure we assign CRTCs to FIFOs by ordering
+them by ascending HVS output index.
+
+Fixes: 87ebcd42fb7b ("drm/vc4: crtc: Assign output to channel automatically")
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221123-rpi-kunit-tests-v1-10-051a0bb60a16@cerno.tech
+---
+ drivers/gpu/drm/vc4/vc4_kms.c | 109 ++++++++++++++++++++++++----------
+ 1 file changed, 76 insertions(+), 33 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_kms.c
+@@ -12,6 +12,7 @@
+  */
+ 
+ #include <linux/clk.h>
++#include <linux/sort.h>
+ 
+ #include <drm/drm_atomic.h>
+ #include <drm/drm_atomic_helper.h>
+@@ -791,6 +792,20 @@ static int vc4_hvs_channels_obj_init(str
+ 	return drmm_add_action_or_reset(&vc4->base, vc4_hvs_channels_obj_fini, NULL);
+ }
+ 
++static int cmp_vc4_crtc_hvs_output(const void *a, const void *b)
++{
++	const struct vc4_crtc *crtc_a =
++		to_vc4_crtc(*(const struct drm_crtc **)a);
++	const struct vc4_crtc_data *data_a =
++		vc4_crtc_to_vc4_crtc_data(crtc_a);
++	const struct vc4_crtc *crtc_b =
++		to_vc4_crtc(*(const struct drm_crtc **)b);
++	const struct vc4_crtc_data *data_b =
++		vc4_crtc_to_vc4_crtc_data(crtc_b);
++
++	return data_a->hvs_output - data_b->hvs_output;
++}
++
+ /*
+  * The BCM2711 HVS has up to 7 outputs connected to the pixelvalves and
+  * the TXP (and therefore all the CRTCs found on that platform).
+@@ -826,10 +841,11 @@ static int vc4_pv_muxing_atomic_check(st
+ {
+ 	struct vc4_dev *vc4 = to_vc4_dev(state->dev);
+ 	struct vc4_hvs_state *hvs_new_state;
+-	struct drm_crtc_state *old_crtc_state, *new_crtc_state;
++	struct drm_crtc **sorted_crtcs;
+ 	struct drm_crtc *crtc;
+ 	unsigned int unassigned_channels = 0;
+ 	unsigned int i;
++	int ret;
+ 
+ 	hvs_new_state = vc4_hvs_get_global_state(state);
+ 	if (IS_ERR(hvs_new_state))
+@@ -839,18 +855,62 @@ static int vc4_pv_muxing_atomic_check(st
+ 		if (!hvs_new_state->fifo_state[i].in_use)
+ 			unassigned_channels |= BIT(i);
+ 
+-	for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) {
+-		struct vc4_crtc_state *old_vc4_crtc_state =
+-			to_vc4_crtc_state(old_crtc_state);
+-		struct vc4_crtc_state *new_vc4_crtc_state =
+-			to_vc4_crtc_state(new_crtc_state);
+-		struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
++	/*
++	 * The problem we have to solve here is that we have up to 7
++	 * encoders, connected to up to 6 CRTCs.
++	 *
++	 * Those CRTCs, depending on the instance, can be routed to 1, 2
++	 * or 3 HVS FIFOs, and we need to set the muxing between FIFOs and
++	 * outputs in the HVS accordingly.
++	 *
++	 * It would be pretty hard to come up with an algorithm that
++	 * would generically solve this. However, the current routing
++	 * trees we support allow us to simplify a bit the problem.
++	 *
++	 * Indeed, with the current supported layouts, if we try to
++	 * assign in the ascending crtc index order the FIFOs, we can't
++	 * fall into the situation where an earlier CRTC that had
++	 * multiple routes is assigned one that was the only option for
++	 * a later CRTC.
++	 *
++	 * If the layout changes and doesn't give us that in the future,
++	 * we will need to have something smarter, but it works so far.
++	 */
++	sorted_crtcs = kmalloc_array(dev->num_crtcs, sizeof(*sorted_crtcs), GFP_KERNEL);
++	if (!sorted_crtcs)
++		return -ENOMEM;
++
++	i = 0;
++	drm_for_each_crtc(crtc, dev)
++		sorted_crtcs[i++] = crtc;
++
++	sort(sorted_crtcs, i, sizeof(*sorted_crtcs), cmp_vc4_crtc_hvs_output, NULL);
++
++	for (i = 0; i < dev->num_crtcs; i++) {
++		struct vc4_crtc_state *old_vc4_crtc_state, *new_vc4_crtc_state;
++		struct drm_crtc_state *old_crtc_state, *new_crtc_state;
++		struct vc4_crtc *vc4_crtc;
+ 		unsigned int matching_channels;
+ 		unsigned int channel;
+ 
+ 		if (vc4->firmware_kms)
+ 			continue;
+ 
++		crtc = sorted_crtcs[i];
++		if (!crtc)
++			continue;
++		vc4_crtc = to_vc4_crtc(crtc);
++
++		old_crtc_state = drm_atomic_get_old_crtc_state(state, crtc);
++		if (!old_crtc_state)
++			continue;
++		old_vc4_crtc_state = to_vc4_crtc_state(old_crtc_state);
++
++		new_crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
++		if (!new_crtc_state)
++			continue;
++		new_vc4_crtc_state = to_vc4_crtc_state(new_crtc_state);
++
+ 		drm_dbg(dev, "%s: Trying to find a channel.\n", crtc->name);
+ 
+ 		/* Nothing to do here, let's skip it */
+@@ -879,33 +939,11 @@ static int vc4_pv_muxing_atomic_check(st
+ 			continue;
+ 		}
+ 
+-		/*
+-		 * The problem we have to solve here is that we have
+-		 * up to 7 encoders, connected to up to 6 CRTCs.
+-		 *
+-		 * Those CRTCs, depending on the instance, can be
+-		 * routed to 1, 2 or 3 HVS FIFOs, and we need to set
+-		 * the change the muxing between FIFOs and outputs in
+-		 * the HVS accordingly.
+-		 *
+-		 * It would be pretty hard to come up with an
+-		 * algorithm that would generically solve
+-		 * this. However, the current routing trees we support
+-		 * allow us to simplify a bit the problem.
+-		 *
+-		 * Indeed, with the current supported layouts, if we
+-		 * try to assign in the ascending crtc index order the
+-		 * FIFOs, we can't fall into the situation where an
+-		 * earlier CRTC that had multiple routes is assigned
+-		 * one that was the only option for a later CRTC.
+-		 *
+-		 * If the layout changes and doesn't give us that in
+-		 * the future, we will need to have something smarter,
+-		 * but it works so far.
+-		 */
+ 		matching_channels = unassigned_channels & vc4_crtc->data->hvs_available_channels;
+-		if (!matching_channels)
+-			return -EINVAL;
++		if (!matching_channels) {
++			ret = -EINVAL;
++			goto err_free_crtc_array;
++		}
+ 
+ 		channel = ffs(matching_channels) - 1;
+ 
+@@ -915,7 +953,12 @@ static int vc4_pv_muxing_atomic_check(st
+ 		hvs_new_state->fifo_state[channel].in_use = true;
+ 	}
+ 
++	kfree(sorted_crtcs);
+ 	return 0;
++
++err_free_crtc_array:
++	kfree(sorted_crtcs);
++	return ret;
+ }
+ 
+ static int
diff --git a/target/linux/bcm27xx/patches-6.1/950-0481-drm-vc4-txp-Reorder-the-variable-assignments.patch b/target/linux/bcm27xx/patches-6.1/950-0481-drm-vc4-txp-Reorder-the-variable-assignments.patch
new file mode 100644
index 00000000000000..99a0dae2d11c62
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0481-drm-vc4-txp-Reorder-the-variable-assignments.patch
@@ -0,0 +1,58 @@
+From 32d1377cec2075ce76756f687b964b1b02beed65 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Wed, 23 Nov 2022 16:25:56 +0100
+Subject: [PATCH] drm/vc4: txp: Reorder the variable assignments
+
+The current order of variable assignments is unneccessarily complex,
+let's make it simpler.
+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221123-rpi-kunit-tests-v1-14-051a0bb60a16@cerno.tech
+---
+ drivers/gpu/drm/vc4/vc4_txp.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -490,7 +490,6 @@ static int vc4_txp_bind(struct device *d
+ 	struct drm_device *drm = dev_get_drvdata(master);
+ 	struct vc4_crtc *vc4_crtc;
+ 	struct vc4_txp *txp;
+-	struct drm_crtc *crtc;
+ 	struct drm_encoder *encoder;
+ 	int ret, irq;
+ 
+@@ -501,18 +500,16 @@ static int vc4_txp_bind(struct device *d
+ 	txp = drmm_kzalloc(drm, sizeof(*txp), GFP_KERNEL);
+ 	if (!txp)
+ 		return -ENOMEM;
+-	vc4_crtc = &txp->base;
+-	crtc = &vc4_crtc->base;
+-
+-	vc4_crtc->pdev = pdev;
+-	vc4_crtc->data = &vc4_txp_crtc_data;
+-	vc4_crtc->feeds_txp = true;
+ 
+ 	txp->pdev = pdev;
+-
+ 	txp->regs = vc4_ioremap_regs(pdev, 0);
+ 	if (IS_ERR(txp->regs))
+ 		return PTR_ERR(txp->regs);
++
++	vc4_crtc = &txp->base;
++	vc4_crtc->pdev = pdev;
++	vc4_crtc->data = &vc4_txp_crtc_data;
++	vc4_crtc->feeds_txp = true;
+ 	vc4_crtc->regset.base = txp->regs;
+ 	vc4_crtc->regset.regs = txp_regs;
+ 	vc4_crtc->regset.nregs = ARRAY_SIZE(txp_regs);
+@@ -533,7 +530,7 @@ static int vc4_txp_bind(struct device *d
+ 		return ret;
+ 
+ 	encoder = &txp->connector.encoder;
+-	encoder->possible_crtcs = drm_crtc_mask(crtc);
++	encoder->possible_crtcs = drm_crtc_mask(&vc4_crtc->base);
+ 
+ 	ret = devm_request_irq(dev, irq, vc4_txp_interrupt, 0,
+ 			       dev_name(dev), txp);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0482-drm-vc4-Add-TXP-encoder-type.patch b/target/linux/bcm27xx/patches-6.1/950-0482-drm-vc4-Add-TXP-encoder-type.patch
new file mode 100644
index 00000000000000..0784395c41a493
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0482-drm-vc4-Add-TXP-encoder-type.patch
@@ -0,0 +1,100 @@
+From cbaaad53cb0b50e64a981c1acde491243a525861 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Wed, 23 Nov 2022 16:25:57 +0100
+Subject: [PATCH] drm/vc4: Add TXP encoder type
+
+The TXP is integrated as a separate CRTC/Encoder/Connector combo, but
+for some reason doesn't rely on the vc4_encoder type and it's associated
+type.
+
+Let's create a type to make it consistent with the other encoders.
+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221123-rpi-kunit-tests-v1-15-051a0bb60a16@cerno.tech
+---
+ drivers/gpu/drm/vc4/vc4_drv.h |  1 +
+ drivers/gpu/drm/vc4/vc4_txp.c | 30 ++++++++++++++++++++----------
+ 2 files changed, 21 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -455,6 +455,7 @@ enum vc4_encoder_type {
+ 	VC4_ENCODER_TYPE_DSI1,
+ 	VC4_ENCODER_TYPE_SMI,
+ 	VC4_ENCODER_TYPE_DPI,
++	VC4_ENCODER_TYPE_TXP,
+ };
+ 
+ struct vc4_encoder {
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -153,6 +153,7 @@ struct vc4_txp {
+ 
+ 	struct platform_device *pdev;
+ 
++	struct vc4_encoder encoder;
+ 	struct drm_writeback_connector connector;
+ 
+ 	void __iomem *regs;
+@@ -160,7 +161,7 @@ struct vc4_txp {
+ 
+ static inline struct vc4_txp *encoder_to_vc4_txp(struct drm_encoder *encoder)
+ {
+-	return container_of(encoder, struct vc4_txp, connector.encoder);
++	return container_of(encoder, struct vc4_txp, encoder.base);
+ }
+ 
+ static inline struct vc4_txp *connector_to_vc4_txp(struct drm_connector *conn)
+@@ -488,9 +489,10 @@ static int vc4_txp_bind(struct device *d
+ {
+ 	struct platform_device *pdev = to_platform_device(dev);
+ 	struct drm_device *drm = dev_get_drvdata(master);
++	struct vc4_encoder *vc4_encoder;
++	struct drm_encoder *encoder;
+ 	struct vc4_crtc *vc4_crtc;
+ 	struct vc4_txp *txp;
+-	struct drm_encoder *encoder;
+ 	int ret, irq;
+ 
+ 	irq = platform_get_irq(pdev, 0);
+@@ -514,13 +516,24 @@ static int vc4_txp_bind(struct device *d
+ 	vc4_crtc->regset.regs = txp_regs;
+ 	vc4_crtc->regset.nregs = ARRAY_SIZE(txp_regs);
+ 
++	vc4_encoder = &txp->encoder;
++	txp->encoder.type = VC4_ENCODER_TYPE_TXP;
++
++	encoder = &vc4_encoder->base;
++	encoder->possible_crtcs = drm_crtc_mask(&vc4_crtc->base);
++
++	drm_encoder_helper_add(encoder, &vc4_txp_encoder_helper_funcs);
++
++	ret = drmm_encoder_init(drm, encoder, NULL, DRM_MODE_ENCODER_VIRTUAL, NULL);
++	if (ret)
++		return ret;
++
+ 	drm_connector_helper_add(&txp->connector.base,
+ 				 &vc4_txp_connector_helper_funcs);
+-	ret = drm_writeback_connector_init(drm, &txp->connector,
+-					   &vc4_txp_connector_funcs,
+-					   &vc4_txp_encoder_helper_funcs,
+-					   drm_fmts, ARRAY_SIZE(drm_fmts),
+-					   0);
++	ret = drm_writeback_connector_init_with_encoder(drm, &txp->connector,
++							encoder,
++							&vc4_txp_connector_funcs,
++							drm_fmts, ARRAY_SIZE(drm_fmts));
+ 	if (ret)
+ 		return ret;
+ 
+@@ -529,9 +542,6 @@ static int vc4_txp_bind(struct device *d
+ 	if (ret)
+ 		return ret;
+ 
+-	encoder = &txp->connector.encoder;
+-	encoder->possible_crtcs = drm_crtc_mask(&vc4_crtc->base);
+-
+ 	ret = devm_request_irq(dev, irq, vc4_txp_interrupt, 0,
+ 			       dev_name(dev), txp);
+ 	if (ret)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0483-drm-vc4-txp-Initialise-the-CRTC-before-the-encoder-a.patch b/target/linux/bcm27xx/patches-6.1/950-0483-drm-vc4-txp-Initialise-the-CRTC-before-the-encoder-a.patch
new file mode 100644
index 00000000000000..3db32889cd2afa
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0483-drm-vc4-txp-Initialise-the-CRTC-before-the-encoder-a.patch
@@ -0,0 +1,42 @@
+From 6314c24d162b32cfe3113329e5a44bfd7ac71ddc Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Wed, 23 Nov 2022 16:25:58 +0100
+Subject: [PATCH] drm/vc4: txp: Initialise the CRTC before the encoder
+ and connector
+
+It makes more sense to register the CRTC before the encoder and
+connectors, so let's move our call around.
+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221123-rpi-kunit-tests-v1-16-051a0bb60a16@cerno.tech
+---
+ drivers/gpu/drm/vc4/vc4_txp.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -516,6 +516,11 @@ static int vc4_txp_bind(struct device *d
+ 	vc4_crtc->regset.regs = txp_regs;
+ 	vc4_crtc->regset.nregs = ARRAY_SIZE(txp_regs);
+ 
++	ret = vc4_crtc_init(drm, vc4_crtc,
++			    &vc4_txp_crtc_funcs, &vc4_txp_crtc_helper_funcs);
++	if (ret)
++		return ret;
++
+ 	vc4_encoder = &txp->encoder;
+ 	txp->encoder.type = VC4_ENCODER_TYPE_TXP;
+ 
+@@ -537,11 +542,6 @@ static int vc4_txp_bind(struct device *d
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = vc4_crtc_init(drm, vc4_crtc,
+-			    &vc4_txp_crtc_funcs, &vc4_txp_crtc_helper_funcs);
+-	if (ret)
+-		return ret;
+-
+ 	ret = devm_request_irq(dev, irq, vc4_txp_interrupt, 0,
+ 			       dev_name(dev), txp);
+ 	if (ret)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0484-drm-vc4-crtc-Pass-the-device-and-data-in-vc4_crtc_in.patch b/target/linux/bcm27xx/patches-6.1/950-0484-drm-vc4-crtc-Pass-the-device-and-data-in-vc4_crtc_in.patch
new file mode 100644
index 00000000000000..e3526c089b4236
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0484-drm-vc4-crtc-Pass-the-device-and-data-in-vc4_crtc_in.patch
@@ -0,0 +1,103 @@
+From 81c14f160cd4129057f3fec5ff5a0f897f91db54 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Wed, 23 Nov 2022 16:25:59 +0100
+Subject: [PATCH] drm/vc4: crtc: Pass the device and data in
+ vc4_crtc_init
+
+Both users of vc4_crtc_init need the same extra initialization to set
+the pointer to the platform_device and the CRTC data. Since it's
+mandatory, let's make them both arguments of vc4_crtc_init().
+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221123-rpi-kunit-tests-v1-17-051a0bb60a16@cerno.tech
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c | 17 +++++++++++------
+ drivers/gpu/drm/vc4/vc4_drv.h  |  6 ++++--
+ drivers/gpu/drm/vc4/vc4_txp.c  |  7 ++-----
+ 3 files changed, 17 insertions(+), 13 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -1318,9 +1318,12 @@ static void vc4_set_crtc_possible_masks(
+ 	}
+ }
+ 
+-int vc4_crtc_init(struct drm_device *drm, struct vc4_crtc *vc4_crtc,
++int vc4_crtc_init(struct drm_device *drm, struct platform_device *pdev,
++		  struct vc4_crtc *vc4_crtc,
++		  const struct vc4_crtc_data *data,
+ 		  const struct drm_crtc_funcs *crtc_funcs,
+-		  const struct drm_crtc_helper_funcs *crtc_helper_funcs)
++		  const struct drm_crtc_helper_funcs *crtc_helper_funcs,
++		  bool feeds_txp)
+ {
+ 	struct vc4_dev *vc4 = to_vc4_dev(drm);
+ 	struct drm_crtc *crtc = &vc4_crtc->base;
+@@ -1340,6 +1343,9 @@ int vc4_crtc_init(struct drm_device *drm
+ 		return PTR_ERR(primary_plane);
+ 	}
+ 
++	vc4_crtc->data = data;
++	vc4_crtc->pdev = pdev;
++	vc4_crtc->feeds_txp = feeds_txp;
+ 	spin_lock_init(&vc4_crtc->irq_lock);
+ 	ret = drmm_crtc_init_with_planes(drm, crtc, primary_plane, NULL,
+ 					 crtc_funcs, NULL);
+@@ -1402,8 +1408,6 @@ static int vc4_crtc_bind(struct device *
+ 	pv_data = of_device_get_match_data(dev);
+ 	if (!pv_data)
+ 		return -ENODEV;
+-	vc4_crtc->data = &pv_data->base;
+-	vc4_crtc->pdev = pdev;
+ 
+ 	vc4_crtc->regs = vc4_ioremap_regs(pdev, 0);
+ 	if (IS_ERR(vc4_crtc->regs))
+@@ -1413,8 +1417,9 @@ static int vc4_crtc_bind(struct device *
+ 	vc4_crtc->regset.regs = crtc_regs;
+ 	vc4_crtc->regset.nregs = ARRAY_SIZE(crtc_regs);
+ 
+-	ret = vc4_crtc_init(drm, vc4_crtc,
+-			    &vc4_crtc_funcs, &vc4_crtc_helper_funcs);
++	ret = vc4_crtc_init(drm, pdev, vc4_crtc, &pv_data->base,
++			    &vc4_crtc_funcs, &vc4_crtc_helper_funcs,
++			    false);
+ 	if (ret)
+ 		return ret;
+ 	vc4_set_crtc_possible_masks(drm, crtc);
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -887,9 +887,11 @@ int vc4_bo_debugfs_init(struct drm_minor
+ /* vc4_crtc.c */
+ extern struct platform_driver vc4_crtc_driver;
+ int vc4_crtc_disable_at_boot(struct drm_crtc *crtc);
+-int vc4_crtc_init(struct drm_device *drm, struct vc4_crtc *vc4_crtc,
++int vc4_crtc_init(struct drm_device *drm, struct platform_device *pdev,
++		  struct vc4_crtc *vc4_crtc, const struct vc4_crtc_data *data,
+ 		  const struct drm_crtc_funcs *crtc_funcs,
+-		  const struct drm_crtc_helper_funcs *crtc_helper_funcs);
++		  const struct drm_crtc_helper_funcs *crtc_helper_funcs,
++		  bool feeds_txp);
+ int vc4_page_flip(struct drm_crtc *crtc,
+ 		  struct drm_framebuffer *fb,
+ 		  struct drm_pending_vblank_event *event,
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -509,15 +509,12 @@ static int vc4_txp_bind(struct device *d
+ 		return PTR_ERR(txp->regs);
+ 
+ 	vc4_crtc = &txp->base;
+-	vc4_crtc->pdev = pdev;
+-	vc4_crtc->data = &vc4_txp_crtc_data;
+-	vc4_crtc->feeds_txp = true;
+ 	vc4_crtc->regset.base = txp->regs;
+ 	vc4_crtc->regset.regs = txp_regs;
+ 	vc4_crtc->regset.nregs = ARRAY_SIZE(txp_regs);
+ 
+-	ret = vc4_crtc_init(drm, vc4_crtc,
+-			    &vc4_txp_crtc_funcs, &vc4_txp_crtc_helper_funcs);
++	ret = vc4_crtc_init(drm, pdev, vc4_crtc, &vc4_txp_crtc_data,
++			    &vc4_txp_crtc_funcs, &vc4_txp_crtc_helper_funcs, true);
+ 	if (ret)
+ 		return ret;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0485-drm-vc4-crtc-Provide-a-CRTC-name.patch b/target/linux/bcm27xx/patches-6.1/950-0485-drm-vc4-crtc-Provide-a-CRTC-name.patch
new file mode 100644
index 00000000000000..bfb344a99469bb
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0485-drm-vc4-crtc-Provide-a-CRTC-name.patch
@@ -0,0 +1,116 @@
+From 0058bbeb9f6223b9760aba662ccba5d25290e4bd Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Wed, 23 Nov 2022 16:26:02 +0100
+Subject: [PATCH] drm/vc4: crtc: Provide a CRTC name
+
+It's fairly hard to figure out the instance of the CRTC affected by an
+atomic change using the default name.
+
+Since we can provide our own to the CRTC initialization functions, let's
+do so to make the debugging sessions easier.
+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221123-rpi-kunit-tests-v1-20-051a0bb60a16@cerno.tech
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c | 10 +++++++++-
+ drivers/gpu/drm/vc4/vc4_drv.h  |  2 ++
+ drivers/gpu/drm/vc4/vc4_txp.c  |  1 +
+ 3 files changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -1173,6 +1173,7 @@ static const struct drm_crtc_helper_func
+ 
+ static const struct vc4_pv_data bcm2835_pv0_data = {
+ 	.base = {
++		.name = "pixelvalve-0",
+ 		.debugfs_name = "crtc0_regs",
+ 		.hvs_available_channels = BIT(0),
+ 		.hvs_output = 0,
+@@ -1187,6 +1188,7 @@ static const struct vc4_pv_data bcm2835_
+ 
+ static const struct vc4_pv_data bcm2835_pv1_data = {
+ 	.base = {
++		.name = "pixelvalve-1",
+ 		.debugfs_name = "crtc1_regs",
+ 		.hvs_available_channels = BIT(2),
+ 		.hvs_output = 2,
+@@ -1201,6 +1203,7 @@ static const struct vc4_pv_data bcm2835_
+ 
+ static const struct vc4_pv_data bcm2835_pv2_data = {
+ 	.base = {
++		.name = "pixelvalve-2",
+ 		.debugfs_name = "crtc2_regs",
+ 		.hvs_available_channels = BIT(1),
+ 		.hvs_output = 1,
+@@ -1215,6 +1218,7 @@ static const struct vc4_pv_data bcm2835_
+ 
+ static const struct vc4_pv_data bcm2711_pv0_data = {
+ 	.base = {
++		.name = "pixelvalve-0",
+ 		.debugfs_name = "crtc0_regs",
+ 		.hvs_available_channels = BIT(0),
+ 		.hvs_output = 0,
+@@ -1229,6 +1233,7 @@ static const struct vc4_pv_data bcm2711_
+ 
+ static const struct vc4_pv_data bcm2711_pv1_data = {
+ 	.base = {
++		.name = "pixelvalve-1",
+ 		.debugfs_name = "crtc1_regs",
+ 		.hvs_available_channels = BIT(0) | BIT(1) | BIT(2),
+ 		.hvs_output = 3,
+@@ -1243,6 +1248,7 @@ static const struct vc4_pv_data bcm2711_
+ 
+ static const struct vc4_pv_data bcm2711_pv2_data = {
+ 	.base = {
++		.name = "pixelvalve-2",
+ 		.debugfs_name = "crtc2_regs",
+ 		.hvs_available_channels = BIT(0) | BIT(1) | BIT(2),
+ 		.hvs_output = 4,
+@@ -1256,6 +1262,7 @@ static const struct vc4_pv_data bcm2711_
+ 
+ static const struct vc4_pv_data bcm2711_pv3_data = {
+ 	.base = {
++		.name = "pixelvalve-3",
+ 		.debugfs_name = "crtc3_regs",
+ 		.hvs_available_channels = BIT(1),
+ 		.hvs_output = 1,
+@@ -1269,6 +1276,7 @@ static const struct vc4_pv_data bcm2711_
+ 
+ static const struct vc4_pv_data bcm2711_pv4_data = {
+ 	.base = {
++		.name = "pixelvalve-4",
+ 		.debugfs_name = "crtc4_regs",
+ 		.hvs_available_channels = BIT(0) | BIT(1) | BIT(2),
+ 		.hvs_output = 5,
+@@ -1348,7 +1356,7 @@ int vc4_crtc_init(struct drm_device *drm
+ 	vc4_crtc->feeds_txp = feeds_txp;
+ 	spin_lock_init(&vc4_crtc->irq_lock);
+ 	ret = drmm_crtc_init_with_planes(drm, crtc, primary_plane, NULL,
+-					 crtc_funcs, NULL);
++					 crtc_funcs, data->name);
+ 	if (ret)
+ 		return ret;
+ 
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -478,6 +478,8 @@ to_vc4_encoder(const struct drm_encoder
+ }
+ 
+ struct vc4_crtc_data {
++	const char *name;
++
+ 	const char *debugfs_name;
+ 
+ 	/* Bitmask of channels (FIFOs) of the HVS that the output can source from */
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -480,6 +480,7 @@ static irqreturn_t vc4_txp_interrupt(int
+ }
+ 
+ static const struct vc4_crtc_data vc4_txp_crtc_data = {
++	.name = "txp",
+ 	.debugfs_name = "txp_regs",
+ 	.hvs_available_channels = BIT(2),
+ 	.hvs_output = 2,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0486-drm-tests-helpers-Add-missing-export.patch b/target/linux/bcm27xx/patches-6.1/950-0486-drm-tests-helpers-Add-missing-export.patch
new file mode 100644
index 00000000000000..55272f2ffef50b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0486-drm-tests-helpers-Add-missing-export.patch
@@ -0,0 +1,25 @@
+From 06a4752fb31b0b4abf0f31301cec18b59f6454bd Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 28 Nov 2022 09:19:38 +0100
+Subject: [PATCH] drm/tests: helpers: Add missing export
+
+drm_kunit_device_init() is a public function meant to be used by other
+tests, but isn't exported. This leads to modpost errors when the other
+tests are compiled as module.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/tests/drm_kunit_helpers.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/tests/drm_kunit_helpers.c
++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c
+@@ -66,6 +66,7 @@ struct drm_device *drm_kunit_device_init
+ 
+ 	return drm;
+ }
++EXPORT_SYMBOL(drm_kunit_device_init);
+ 
+ MODULE_AUTHOR("Maxime Ripard <maxime@cerno.tech>");
+ MODULE_LICENSE("GPL");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0487-drm-tests-helpers-Move-the-helper-header-to-include-.patch b/target/linux/bcm27xx/patches-6.1/950-0487-drm-tests-helpers-Move-the-helper-header-to-include-.patch
new file mode 100644
index 00000000000000..2f8671c0e19996
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0487-drm-tests-helpers-Move-the-helper-header-to-include-.patch
@@ -0,0 +1,63 @@
+From f5e9c38169dc19ff64f32a38e4fdd3eef74df103 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 28 Nov 2022 14:12:43 +0100
+Subject: [PATCH] drm/tests: helpers: Move the helper header to
+ include/drm
+
+We'll need to use those helpers from drivers too, so let's move it to a
+more visible location.
+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/tests/drm_kunit_helpers.c                  | 3 +--
+ {drivers/gpu/drm/tests => include/drm}/drm_kunit_helpers.h | 0
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+ rename {drivers/gpu/drm/tests => include/drm}/drm_kunit_helpers.h (100%)
+
+--- a/drivers/gpu/drm/tests/drm_kunit_helpers.c
++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c
+@@ -1,14 +1,13 @@
+ // SPDX-License-Identifier: GPL-2.0
+ 
+ #include <drm/drm_drv.h>
++#include <drm/drm_kunit_helpers.h>
+ #include <drm/drm_managed.h>
+ 
+ #include <kunit/resource.h>
+ 
+ #include <linux/device.h>
+ 
+-#include "drm_kunit_helpers.h"
+-
+ struct kunit_dev {
+ 	struct drm_device base;
+ };
+--- a/drivers/gpu/drm/tests/drm_kunit_helpers.h
++++ /dev/null
+@@ -1,11 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-
+-#ifndef DRM_KUNIT_HELPERS_H_
+-#define DRM_KUNIT_HELPERS_H_
+-
+-struct drm_device;
+-struct kunit;
+-
+-struct drm_device *drm_kunit_device_init(struct kunit *test, u32 features, char *name);
+-
+-#endif // DRM_KUNIT_HELPERS_H_
+--- /dev/null
++++ b/include/drm/drm_kunit_helpers.h
+@@ -0,0 +1,11 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#ifndef DRM_KUNIT_HELPERS_H_
++#define DRM_KUNIT_HELPERS_H_
++
++struct drm_device;
++struct kunit;
++
++struct drm_device *drm_kunit_device_init(struct kunit *test, u32 features, char *name);
++
++#endif // DRM_KUNIT_HELPERS_H_
diff --git a/target/linux/bcm27xx/patches-6.1/950-0488-drm-tests-Introduce-a-config-option-for-the-KUnit-he.patch b/target/linux/bcm27xx/patches-6.1/950-0488-drm-tests-Introduce-a-config-option-for-the-KUnit-he.patch
new file mode 100644
index 00000000000000..bac2e701631f6e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0488-drm-tests-Introduce-a-config-option-for-the-KUnit-he.patch
@@ -0,0 +1,74 @@
+From 1ddfbb0af0c23a845e941f4e49c6a65358b1c58e Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Thu, 1 Dec 2022 13:37:20 +0100
+Subject: [PATCH] drm/tests: Introduce a config option for the KUnit
+ helpers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Driver-specific tests will need access to the helpers without pulling
+every DRM framework test. Let's create an intermediate Kconfig options
+for the helpers.
+
+Suggested-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/Kconfig        | 7 +++++++
+ drivers/gpu/drm/Makefile       | 2 +-
+ drivers/gpu/drm/tests/Makefile | 4 +++-
+ 3 files changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/Kconfig
++++ b/drivers/gpu/drm/Kconfig
+@@ -64,6 +64,12 @@ config DRM_USE_DYNAMIC_DEBUG
+ 	  bytes per callsite, the .data costs can be substantial, and
+ 	  are therefore configurable.
+ 
++config DRM_KUNIT_TEST_HELPERS
++	tristate
++	depends on DRM && KUNIT
++	help
++	  KUnit Helpers for KMS drivers.
++
+ config DRM_KUNIT_TEST
+ 	tristate "KUnit tests for DRM" if !KUNIT_ALL_TESTS
+ 	depends on DRM && KUNIT
+@@ -74,6 +80,7 @@ config DRM_KUNIT_TEST
+ 	select DRM_KMS_HELPER
+ 	select DRM_BUDDY
+ 	select DRM_EXPORT_FOR_TESTS if m
++	select DRM_KUNIT_TEST_HELPERS
+ 	default KUNIT_ALL_TESTS
+ 	help
+ 	  This builds unit tests for DRM. This option is not useful for
+--- a/drivers/gpu/drm/Makefile
++++ b/drivers/gpu/drm/Makefile
+@@ -77,7 +77,7 @@ obj-$(CONFIG_DRM_KMS_HELPER) += drm_kms_
+ # Drivers and the rest
+ #
+ 
+-obj-$(CONFIG_DRM_KUNIT_TEST) += tests/
++obj-y			+= tests/
+ 
+ obj-$(CONFIG_DRM_MIPI_DBI) += drm_mipi_dbi.o
+ obj-$(CONFIG_DRM_MIPI_DSI) += drm_mipi_dsi.o
+--- a/drivers/gpu/drm/tests/Makefile
++++ b/drivers/gpu/drm/tests/Makefile
+@@ -1,5 +1,8 @@
+ # SPDX-License-Identifier: GPL-2.0
+ 
++obj-$(CONFIG_DRM_KUNIT_TEST_HELPERS) += \
++	drm_kunit_helpers.o
++
+ obj-$(CONFIG_DRM_KUNIT_TEST) += \
+ 	drm_buddy_test.o \
+ 	drm_cmdline_parser_test.o \
+@@ -8,7 +11,6 @@ obj-$(CONFIG_DRM_KUNIT_TEST) += \
+ 	drm_format_helper_test.o \
+ 	drm_format_test.o \
+ 	drm_framebuffer_test.o \
+-	drm_kunit_helpers.o \
+ 	drm_mm_test.o \
+ 	drm_plane_helper_test.o \
+ 	drm_rect_test.o
diff --git a/target/linux/bcm27xx/patches-6.1/950-0489-drm-tests-helpers-Document-drm_kunit_device_init.patch b/target/linux/bcm27xx/patches-6.1/950-0489-drm-tests-helpers-Document-drm_kunit_device_init.patch
new file mode 100644
index 00000000000000..01f21d73efcf87
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0489-drm-tests-helpers-Document-drm_kunit_device_init.patch
@@ -0,0 +1,44 @@
+From 1b723c252bbfb7abefd4bd866825a5385bfa5748 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 28 Nov 2022 13:50:58 +0100
+Subject: [PATCH] drm/tests: helpers: Document drm_kunit_device_init()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Commit 44a3928324e9 ("drm/tests: Add Kunit Helpers") introduced the
+drm_kunit_device_init() function but didn't document it properly. Add
+that documentation.
+
+Reviewed-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/tests/drm_kunit_helpers.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/drivers/gpu/drm/tests/drm_kunit_helpers.c
++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c
+@@ -35,6 +35,23 @@ static void dev_free(struct kunit_resour
+ 	root_device_unregister(dev);
+ }
+ 
++/**
++ * drm_kunit_device_init - Allocates a mock DRM device for KUnit tests
++ * @test: The test context object
++ * @features: Mocked DRM device driver features
++ * @name: Name of the struct &device to allocate
++ *
++ * This function allocates a new struct &device, creates a struct
++ * &drm_driver and will create a struct &drm_device using both.
++ *
++ * The device and driver are tied to the @test context and will get
++ * cleaned at the end of the test. The drm_device is allocated through
++ * devm_drm_dev_alloc() and will thus be freed through a device-managed
++ * resource.
++ *
++ * Returns:
++ * A pointer to the new drm_device, or an ERR_PTR() otherwise.
++ */
+ struct drm_device *drm_kunit_device_init(struct kunit *test, u32 features, char *name)
+ {
+ 	struct kunit_dev *kdev;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0490-drm-tests-helpers-Switch-to-EXPORT_SYMBOL_GPL.patch b/target/linux/bcm27xx/patches-6.1/950-0490-drm-tests-helpers-Switch-to-EXPORT_SYMBOL_GPL.patch
new file mode 100644
index 00000000000000..47971cae522e9a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0490-drm-tests-helpers-Switch-to-EXPORT_SYMBOL_GPL.patch
@@ -0,0 +1,27 @@
+From d0799b2a8757875d6bcfb91dfad037b017b764c3 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Thu, 1 Dec 2022 14:59:07 +0100
+Subject: [PATCH] drm/tests: helpers: Switch to EXPORT_SYMBOL_GPL
+
+drm_kunit_device_init() among other things will allocate a device and
+wrap around root_device_register. This function is exported with
+EXPORT_SYMBOL_GPL, so we can't really change the license.
+
+Fixes: 199557fab925 ("drm/tests: helpers: Add missing export")
+Suggested-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/tests/drm_kunit_helpers.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/tests/drm_kunit_helpers.c
++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c
+@@ -82,7 +82,7 @@ struct drm_device *drm_kunit_device_init
+ 
+ 	return drm;
+ }
+-EXPORT_SYMBOL(drm_kunit_device_init);
++EXPORT_SYMBOL_GPL(drm_kunit_device_init);
+ 
+ MODULE_AUTHOR("Maxime Ripard <maxime@cerno.tech>");
+ MODULE_LICENSE("GPL");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0491-drm-tests-helpers-Rename-the-device-init-helper.patch b/target/linux/bcm27xx/patches-6.1/950-0491-drm-tests-helpers-Rename-the-device-init-helper.patch
new file mode 100644
index 00000000000000..c8f0d9c4816eed
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0491-drm-tests-helpers-Rename-the-device-init-helper.patch
@@ -0,0 +1,63 @@
+From 781ffca07b71a83a6d81e1782659f8a43d7ea401 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 21 Nov 2022 13:22:59 +0100
+Subject: [PATCH] drm/tests: helpers: Rename the device init helper
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The name doesn't really fit the conventions for the other helpers in
+DRM/KMS, so let's rename it to make it obvious that we allocate a new
+DRM device.
+
+Reviewed-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/tests/drm_kunit_helpers.c | 8 +++++---
+ include/drm/drm_kunit_helpers.h           | 5 ++++-
+ 2 files changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/tests/drm_kunit_helpers.c
++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c
+@@ -36,7 +36,7 @@ static void dev_free(struct kunit_resour
+ }
+ 
+ /**
+- * drm_kunit_device_init - Allocates a mock DRM device for KUnit tests
++ * drm_kunit_helper_alloc_drm_device - Allocates a mock DRM device for KUnit tests
+  * @test: The test context object
+  * @features: Mocked DRM device driver features
+  * @name: Name of the struct &device to allocate
+@@ -52,7 +52,9 @@ static void dev_free(struct kunit_resour
+  * Returns:
+  * A pointer to the new drm_device, or an ERR_PTR() otherwise.
+  */
+-struct drm_device *drm_kunit_device_init(struct kunit *test, u32 features, char *name)
++struct drm_device *
++drm_kunit_helper_alloc_drm_device(struct kunit *test,
++				  u32 features, char *name)
+ {
+ 	struct kunit_dev *kdev;
+ 	struct drm_device *drm;
+@@ -82,7 +84,7 @@ struct drm_device *drm_kunit_device_init
+ 
+ 	return drm;
+ }
+-EXPORT_SYMBOL_GPL(drm_kunit_device_init);
++EXPORT_SYMBOL_GPL(drm_kunit_helper_alloc_drm_device);
+ 
+ MODULE_AUTHOR("Maxime Ripard <maxime@cerno.tech>");
+ MODULE_LICENSE("GPL");
+--- a/include/drm/drm_kunit_helpers.h
++++ b/include/drm/drm_kunit_helpers.h
+@@ -6,6 +6,9 @@
+ struct drm_device;
+ struct kunit;
+ 
+-struct drm_device *drm_kunit_device_init(struct kunit *test, u32 features, char *name);
++struct drm_device *
++drm_kunit_helper_alloc_drm_device(struct kunit *test,
++				  u32 features,
++				  char *name);
+ 
+ #endif // DRM_KUNIT_HELPERS_H_
diff --git a/target/linux/bcm27xx/patches-6.1/950-0492-drm-tests-helpers-Remove-the-name-parameter.patch b/target/linux/bcm27xx/patches-6.1/950-0492-drm-tests-helpers-Remove-the-name-parameter.patch
new file mode 100644
index 00000000000000..a9cc4d53c4cfd0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0492-drm-tests-helpers-Remove-the-name-parameter.patch
@@ -0,0 +1,66 @@
+From 3a47f6ffdf0cdfd2c59105322ea75796c2708586 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 21 Nov 2022 13:25:32 +0100
+Subject: [PATCH] drm/tests: helpers: Remove the name parameter
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The device name isn't really useful, we can just define it instead of
+exposing it in the API.
+
+Reviewed-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/tests/drm_kunit_helpers.c | 7 ++++---
+ include/drm/drm_kunit_helpers.h           | 3 +--
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/tests/drm_kunit_helpers.c
++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c
+@@ -8,6 +8,8 @@
+ 
+ #include <linux/device.h>
+ 
++#define KUNIT_DEVICE_NAME	"drm-kunit-mock-device"
++
+ struct kunit_dev {
+ 	struct drm_device base;
+ };
+@@ -39,7 +41,6 @@ static void dev_free(struct kunit_resour
+  * drm_kunit_helper_alloc_drm_device - Allocates a mock DRM device for KUnit tests
+  * @test: The test context object
+  * @features: Mocked DRM device driver features
+- * @name: Name of the struct &device to allocate
+  *
+  * This function allocates a new struct &device, creates a struct
+  * &drm_driver and will create a struct &drm_device using both.
+@@ -54,7 +55,7 @@ static void dev_free(struct kunit_resour
+  */
+ struct drm_device *
+ drm_kunit_helper_alloc_drm_device(struct kunit *test,
+-				  u32 features, char *name)
++				  u32 features)
+ {
+ 	struct kunit_dev *kdev;
+ 	struct drm_device *drm;
+@@ -62,7 +63,7 @@ drm_kunit_helper_alloc_drm_device(struct
+ 	struct device *dev;
+ 	int ret;
+ 
+-	dev = kunit_alloc_resource(test, dev_init, dev_free, GFP_KERNEL, name);
++	dev = kunit_alloc_resource(test, dev_init, dev_free, GFP_KERNEL, KUNIT_DEVICE_NAME);
+ 	if (!dev)
+ 		return ERR_PTR(-ENOMEM);
+ 
+--- a/include/drm/drm_kunit_helpers.h
++++ b/include/drm/drm_kunit_helpers.h
+@@ -8,7 +8,6 @@ struct kunit;
+ 
+ struct drm_device *
+ drm_kunit_helper_alloc_drm_device(struct kunit *test,
+-				  u32 features,
+-				  char *name);
++				  u32 features);
+ 
+ #endif // DRM_KUNIT_HELPERS_H_
diff --git a/target/linux/bcm27xx/patches-6.1/950-0493-drm-tests-helpers-Create-the-device-in-another-funct.patch b/target/linux/bcm27xx/patches-6.1/950-0493-drm-tests-helpers-Create-the-device-in-another-funct.patch
new file mode 100644
index 00000000000000..8c5b6531fdff33
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0493-drm-tests-helpers-Create-the-device-in-another-funct.patch
@@ -0,0 +1,127 @@
+From cb8e04462f60d3f0659ef3adbba06cdf474f7fe3 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 21 Nov 2022 11:11:52 +0100
+Subject: [PATCH] drm/tests: helpers: Create the device in another
+ function
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+We'll need in some tests to control when the device needs to be added
+and removed, so let's split the device creation from the DRM device
+creation function.
+
+Reviewed-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/tests/drm_kunit_helpers.c | 56 +++++++++++++----------
+ include/drm/drm_kunit_helpers.h           |  5 +-
+ 2 files changed, 37 insertions(+), 24 deletions(-)
+
+--- a/drivers/gpu/drm/tests/drm_kunit_helpers.c
++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c
+@@ -17,36 +17,51 @@ struct kunit_dev {
+ static const struct drm_mode_config_funcs drm_mode_config_funcs = {
+ };
+ 
+-static int dev_init(struct kunit_resource *res, void *ptr)
++/**
++ * drm_kunit_helper_alloc_device - Allocate a mock device for a KUnit test
++ * @test: The test context object
++ *
++ * This allocates a fake struct &device to create a mock for a KUnit
++ * test.
++ *
++ * Callers need to make sure drm_kunit_helper_free_device() on the
++ * device when done.
++ *
++ * Returns:
++ * A pointer to the new device, or an ERR_PTR() otherwise.
++ */
++struct device *drm_kunit_helper_alloc_device(struct kunit *test)
+ {
+-	char *name = ptr;
+-	struct device *dev;
+-
+-	dev = root_device_register(name);
+-	if (IS_ERR(dev))
+-		return PTR_ERR(dev);
+-
+-	res->data = dev;
+-	return 0;
++	return root_device_register(KUNIT_DEVICE_NAME);
+ }
++EXPORT_SYMBOL_GPL(drm_kunit_helper_alloc_device);
+ 
+-static void dev_free(struct kunit_resource *res)
++/**
++ * drm_kunit_helper_free_device - Frees a mock device
++ * @test: The test context object
++ * @dev: The device to free
++ *
++ * Frees a device allocated with drm_kunit_helper_alloc_device().
++ */
++void drm_kunit_helper_free_device(struct kunit *test, struct device *dev)
+ {
+-	struct device *dev = res->data;
+-
+ 	root_device_unregister(dev);
+ }
++EXPORT_SYMBOL_GPL(drm_kunit_helper_free_device);
+ 
+ /**
+  * drm_kunit_helper_alloc_drm_device - Allocates a mock DRM device for KUnit tests
+  * @test: The test context object
++ * @dev: The parent device object
+  * @features: Mocked DRM device driver features
+  *
+- * This function allocates a new struct &device, creates a struct
+- * &drm_driver and will create a struct &drm_device using both.
++ * This function creates a struct &drm_driver and will create a struct
++ * &drm_device from @dev and that driver.
+  *
+- * The device and driver are tied to the @test context and will get
+- * cleaned at the end of the test. The drm_device is allocated through
++ * @dev should be allocated using drm_kunit_helper_alloc_device().
++ *
++ * The driver is tied to the @test context and will get cleaned at the
++ * end of the test. The drm_device is allocated through
+  * devm_drm_dev_alloc() and will thus be freed through a device-managed
+  * resource.
+  *
+@@ -54,19 +69,14 @@ static void dev_free(struct kunit_resour
+  * A pointer to the new drm_device, or an ERR_PTR() otherwise.
+  */
+ struct drm_device *
+-drm_kunit_helper_alloc_drm_device(struct kunit *test,
++drm_kunit_helper_alloc_drm_device(struct kunit *test, struct device *dev,
+ 				  u32 features)
+ {
+ 	struct kunit_dev *kdev;
+ 	struct drm_device *drm;
+ 	struct drm_driver *driver;
+-	struct device *dev;
+ 	int ret;
+ 
+-	dev = kunit_alloc_resource(test, dev_init, dev_free, GFP_KERNEL, KUNIT_DEVICE_NAME);
+-	if (!dev)
+-		return ERR_PTR(-ENOMEM);
+-
+ 	driver = kunit_kzalloc(test, sizeof(*driver), GFP_KERNEL);
+ 	if (!driver)
+ 		return ERR_PTR(-ENOMEM);
+--- a/include/drm/drm_kunit_helpers.h
++++ b/include/drm/drm_kunit_helpers.h
+@@ -6,8 +6,11 @@
+ struct drm_device;
+ struct kunit;
+ 
++struct device *drm_kunit_helper_alloc_device(struct kunit *test);
++void drm_kunit_helper_free_device(struct kunit *test, struct device *dev);
++
+ struct drm_device *
+-drm_kunit_helper_alloc_drm_device(struct kunit *test,
++drm_kunit_helper_alloc_drm_device(struct kunit *test, struct device *dev,
+ 				  u32 features);
+ 
+ #endif // DRM_KUNIT_HELPERS_H_
diff --git a/target/linux/bcm27xx/patches-6.1/950-0494-drm-tests-helpers-Switch-to-a-platform_device.patch b/target/linux/bcm27xx/patches-6.1/950-0494-drm-tests-helpers-Switch-to-a-platform_device.patch
new file mode 100644
index 00000000000000..21310b83dfad4d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0494-drm-tests-helpers-Switch-to-a-platform_device.patch
@@ -0,0 +1,59 @@
+From 04f6ec35cbb9794bb185f58d15c7d8f326374618 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 21 Nov 2022 13:33:37 +0100
+Subject: [PATCH] drm/tests: helpers: Switch to a platform_device
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The device managed resources are ran if the device has bus, which is not
+the case of a root_device.
+
+Let's use a platform_device instead.
+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Reviewed-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/tests/drm_kunit_helpers.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/tests/drm_kunit_helpers.c
++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c
+@@ -7,6 +7,7 @@
+ #include <kunit/resource.h>
+ 
+ #include <linux/device.h>
++#include <linux/platform_device.h>
+ 
+ #define KUNIT_DEVICE_NAME	"drm-kunit-mock-device"
+ 
+@@ -32,7 +33,16 @@ static const struct drm_mode_config_func
+  */
+ struct device *drm_kunit_helper_alloc_device(struct kunit *test)
+ {
+-	return root_device_register(KUNIT_DEVICE_NAME);
++	struct platform_device *pdev;
++	int ret;
++
++	pdev = platform_device_alloc(KUNIT_DEVICE_NAME, PLATFORM_DEVID_NONE);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, pdev);
++
++	ret = platform_device_add(pdev);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	return &pdev->dev;
+ }
+ EXPORT_SYMBOL_GPL(drm_kunit_helper_alloc_device);
+ 
+@@ -45,7 +55,9 @@ EXPORT_SYMBOL_GPL(drm_kunit_helper_alloc
+  */
+ void drm_kunit_helper_free_device(struct kunit *test, struct device *dev)
+ {
+-	root_device_unregister(dev);
++	struct platform_device *pdev = to_platform_device(dev);
++
++	platform_device_unregister(pdev);
+ }
+ EXPORT_SYMBOL_GPL(drm_kunit_helper_free_device);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0495-drm-tests-helpers-Make-sure-the-device-is-bound.patch b/target/linux/bcm27xx/patches-6.1/950-0495-drm-tests-helpers-Make-sure-the-device-is-bound.patch
new file mode 100644
index 00000000000000..76989df502106c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0495-drm-tests-helpers-Make-sure-the-device-is-bound.patch
@@ -0,0 +1,74 @@
+From 51e89f803856386ebecef22453ab34907a393954 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 21 Nov 2022 13:18:29 +0100
+Subject: [PATCH] drm/tests: helpers: Make sure the device is bound
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The device managed resources are freed when the device is detached, so
+it has to be bound in the first place.
+
+Let's create a fake driver that we will bind to our fake device to
+benefit from the device managed cleanups in our tests.
+
+Reviewed-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/tests/drm_kunit_helpers.c | 26 ++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/tests/drm_kunit_helpers.c
++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c
+@@ -18,12 +18,32 @@ struct kunit_dev {
+ static const struct drm_mode_config_funcs drm_mode_config_funcs = {
+ };
+ 
++static int fake_probe(struct platform_device *pdev)
++{
++	return 0;
++}
++
++static int fake_remove(struct platform_device *pdev)
++{
++	return 0;
++}
++
++static struct platform_driver fake_platform_driver = {
++	.probe	= fake_probe,
++	.remove	= fake_remove,
++	.driver = {
++		.name	= KUNIT_DEVICE_NAME,
++	},
++};
++
+ /**
+  * drm_kunit_helper_alloc_device - Allocate a mock device for a KUnit test
+  * @test: The test context object
+  *
+  * This allocates a fake struct &device to create a mock for a KUnit
+- * test.
++ * test. The device will also be bound to a fake driver. It will thus be
++ * able to leverage the usual infrastructure and most notably the
++ * device-managed resources just like a "real" device.
+  *
+  * Callers need to make sure drm_kunit_helper_free_device() on the
+  * device when done.
+@@ -36,6 +56,9 @@ struct device *drm_kunit_helper_alloc_de
+ 	struct platform_device *pdev;
+ 	int ret;
+ 
++	ret = platform_driver_register(&fake_platform_driver);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
+ 	pdev = platform_device_alloc(KUNIT_DEVICE_NAME, PLATFORM_DEVID_NONE);
+ 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, pdev);
+ 
+@@ -58,6 +81,7 @@ void drm_kunit_helper_free_device(struct
+ 	struct platform_device *pdev = to_platform_device(dev);
+ 
+ 	platform_device_unregister(pdev);
++	platform_driver_unregister(&fake_platform_driver);
+ }
+ EXPORT_SYMBOL_GPL(drm_kunit_helper_free_device);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0496-drm-tests-helpers-Allow-for-a-custom-device-struct-t.patch b/target/linux/bcm27xx/patches-6.1/950-0496-drm-tests-helpers-Allow-for-a-custom-device-struct-t.patch
new file mode 100644
index 00000000000000..4e88976d9d3624
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0496-drm-tests-helpers-Allow-for-a-custom-device-struct-t.patch
@@ -0,0 +1,135 @@
+From 6f034f1e2e19a86ea85355efdf6dc55fa8a04e59 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 21 Nov 2022 14:28:44 +0100
+Subject: [PATCH] drm/tests: helpers: Allow for a custom device struct
+ to be allocated
+
+The current helper to allocate a DRM device doesn't allow for any
+subclassing by drivers, which is going to be troublesome as we work on
+getting some kunit testing on atomic modesetting code.
+
+Let's use a similar pattern to the other allocation helpers by providing
+the structure size and offset as arguments.
+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/tests/drm_kunit_helpers.c | 40 +++++------------------
+ include/drm/drm_kunit_helpers.h           | 32 ++++++++++++++++--
+ 2 files changed, 39 insertions(+), 33 deletions(-)
+
+--- a/drivers/gpu/drm/tests/drm_kunit_helpers.c
++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c
+@@ -11,10 +11,6 @@
+ 
+ #define KUNIT_DEVICE_NAME	"drm-kunit-mock-device"
+ 
+-struct kunit_dev {
+-	struct drm_device base;
+-};
+-
+ static const struct drm_mode_config_funcs drm_mode_config_funcs = {
+ };
+ 
+@@ -85,32 +81,14 @@ void drm_kunit_helper_free_device(struct
+ }
+ EXPORT_SYMBOL_GPL(drm_kunit_helper_free_device);
+ 
+-/**
+- * drm_kunit_helper_alloc_drm_device - Allocates a mock DRM device for KUnit tests
+- * @test: The test context object
+- * @dev: The parent device object
+- * @features: Mocked DRM device driver features
+- *
+- * This function creates a struct &drm_driver and will create a struct
+- * &drm_device from @dev and that driver.
+- *
+- * @dev should be allocated using drm_kunit_helper_alloc_device().
+- *
+- * The driver is tied to the @test context and will get cleaned at the
+- * end of the test. The drm_device is allocated through
+- * devm_drm_dev_alloc() and will thus be freed through a device-managed
+- * resource.
+- *
+- * Returns:
+- * A pointer to the new drm_device, or an ERR_PTR() otherwise.
+- */
+ struct drm_device *
+-drm_kunit_helper_alloc_drm_device(struct kunit *test, struct device *dev,
+-				  u32 features)
++__drm_kunit_helper_alloc_drm_device(struct kunit *test, struct device *dev,
++				    size_t size, size_t offset,
++				    u32 features)
+ {
+-	struct kunit_dev *kdev;
+ 	struct drm_device *drm;
+ 	struct drm_driver *driver;
++	void *container;
+ 	int ret;
+ 
+ 	driver = kunit_kzalloc(test, sizeof(*driver), GFP_KERNEL);
+@@ -118,11 +96,11 @@ drm_kunit_helper_alloc_drm_device(struct
+ 		return ERR_PTR(-ENOMEM);
+ 
+ 	driver->driver_features = features;
+-	kdev = devm_drm_dev_alloc(dev, driver, struct kunit_dev, base);
+-	if (IS_ERR(kdev))
+-		return ERR_CAST(kdev);
++	container = __devm_drm_dev_alloc(dev, driver, size, offset);
++	if (IS_ERR(container))
++		return ERR_CAST(container);
+ 
+-	drm = &kdev->base;
++	drm = container + offset;
+ 	drm->mode_config.funcs = &drm_mode_config_funcs;
+ 
+ 	ret = drmm_mode_config_init(drm);
+@@ -131,7 +109,7 @@ drm_kunit_helper_alloc_drm_device(struct
+ 
+ 	return drm;
+ }
+-EXPORT_SYMBOL_GPL(drm_kunit_helper_alloc_drm_device);
++EXPORT_SYMBOL_GPL(__drm_kunit_helper_alloc_drm_device);
+ 
+ MODULE_AUTHOR("Maxime Ripard <maxime@cerno.tech>");
+ MODULE_LICENSE("GPL");
+--- a/include/drm/drm_kunit_helpers.h
++++ b/include/drm/drm_kunit_helpers.h
+@@ -10,7 +10,35 @@ struct device *drm_kunit_helper_alloc_de
+ void drm_kunit_helper_free_device(struct kunit *test, struct device *dev);
+ 
+ struct drm_device *
+-drm_kunit_helper_alloc_drm_device(struct kunit *test, struct device *dev,
+-				  u32 features);
++__drm_kunit_helper_alloc_drm_device(struct kunit *test, struct device *dev,
++				    size_t size, size_t offset,
++				    u32 features);
++
++/**
++ * drm_kunit_helper_alloc_drm_device - Allocates a mock DRM device for KUnit tests
++ * @_test: The test context object
++ * @_dev: The parent device object
++ * @_type: the type of the struct which contains struct &drm_device
++ * @_member: the name of the &drm_device within @_type.
++ * @_features: Mocked DRM device driver features
++ *
++ * This function creates a struct &drm_driver and will create a struct
++ * &drm_device from @_dev and that driver.
++ *
++ * @_dev should be allocated using drm_kunit_helper_alloc_device().
++ *
++ * The driver is tied to the @_test context and will get cleaned at the
++ * end of the test. The drm_device is allocated through
++ * devm_drm_dev_alloc() and will thus be freed through a device-managed
++ * resource.
++ *
++ * Returns:
++ * A pointer to the new drm_device, or an ERR_PTR() otherwise.
++ */
++#define drm_kunit_helper_alloc_drm_device(_test, _dev, _type, _member, _feat)	\
++	((_type *)__drm_kunit_helper_alloc_drm_device(_test, _dev,		\
++						      sizeof(_type),		\
++						      offsetof(_type, _member),	\
++						      _feat))
+ 
+ #endif // DRM_KUNIT_HELPERS_H_
diff --git a/target/linux/bcm27xx/patches-6.1/950-0497-drm-tests-helpers-Allow-to-pass-a-custom-drm_driver.patch b/target/linux/bcm27xx/patches-6.1/950-0497-drm-tests-helpers-Allow-to-pass-a-custom-drm_driver.patch
new file mode 100644
index 00000000000000..a241045d100e2e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0497-drm-tests-helpers-Allow-to-pass-a-custom-drm_driver.patch
@@ -0,0 +1,120 @@
+From 9dd62a4a37af19e33bfb3c8f7e7a096ffc6ce8a9 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 21 Nov 2022 17:02:15 +0100
+Subject: [PATCH] drm/tests: helpers: Allow to pass a custom drm_driver
+
+Some tests will need to provide their own drm_driver instead of relying
+on the dumb one in the helpers, so let's create a helper that allows to
+do so.
+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/tests/drm_kunit_helpers.c | 15 +++----
+ include/drm/drm_kunit_helpers.h           | 51 ++++++++++++++++++++++-
+ 2 files changed, 54 insertions(+), 12 deletions(-)
+
+--- a/drivers/gpu/drm/tests/drm_kunit_helpers.c
++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c
+@@ -82,20 +82,15 @@ void drm_kunit_helper_free_device(struct
+ EXPORT_SYMBOL_GPL(drm_kunit_helper_free_device);
+ 
+ struct drm_device *
+-__drm_kunit_helper_alloc_drm_device(struct kunit *test, struct device *dev,
+-				    size_t size, size_t offset,
+-				    u32 features)
++__drm_kunit_helper_alloc_drm_device_with_driver(struct kunit *test,
++						struct device *dev,
++						size_t size, size_t offset,
++						const struct drm_driver *driver)
+ {
+ 	struct drm_device *drm;
+-	struct drm_driver *driver;
+ 	void *container;
+ 	int ret;
+ 
+-	driver = kunit_kzalloc(test, sizeof(*driver), GFP_KERNEL);
+-	if (!driver)
+-		return ERR_PTR(-ENOMEM);
+-
+-	driver->driver_features = features;
+ 	container = __devm_drm_dev_alloc(dev, driver, size, offset);
+ 	if (IS_ERR(container))
+ 		return ERR_CAST(container);
+@@ -109,7 +104,7 @@ __drm_kunit_helper_alloc_drm_device(stru
+ 
+ 	return drm;
+ }
+-EXPORT_SYMBOL_GPL(__drm_kunit_helper_alloc_drm_device);
++EXPORT_SYMBOL_GPL(__drm_kunit_helper_alloc_drm_device_with_driver);
+ 
+ MODULE_AUTHOR("Maxime Ripard <maxime@cerno.tech>");
+ MODULE_LICENSE("GPL");
+--- a/include/drm/drm_kunit_helpers.h
++++ b/include/drm/drm_kunit_helpers.h
+@@ -3,6 +3,8 @@
+ #ifndef DRM_KUNIT_HELPERS_H_
+ #define DRM_KUNIT_HELPERS_H_
+ 
++#include <kunit/test.h>
++
+ struct drm_device;
+ struct kunit;
+ 
+@@ -10,9 +12,54 @@ struct device *drm_kunit_helper_alloc_de
+ void drm_kunit_helper_free_device(struct kunit *test, struct device *dev);
+ 
+ struct drm_device *
+-__drm_kunit_helper_alloc_drm_device(struct kunit *test, struct device *dev,
++__drm_kunit_helper_alloc_drm_device_with_driver(struct kunit *test,
++						struct device *dev,
++						size_t size, size_t offset,
++						const struct drm_driver *driver);
++
++/**
++ * drm_kunit_helper_alloc_drm_device_with_driver - Allocates a mock DRM device for KUnit tests
++ * @_test: The test context object
++ * @_dev: The parent device object
++ * @_type: the type of the struct which contains struct &drm_device
++ * @_member: the name of the &drm_device within @_type.
++ * @_drv: Mocked DRM device driver features
++ *
++ * This function creates a struct &drm_device from @_dev and @_drv.
++ *
++ * @_dev should be allocated using drm_kunit_helper_alloc_device().
++ *
++ * The driver is tied to the @_test context and will get cleaned at the
++ * end of the test. The drm_device is allocated through
++ * devm_drm_dev_alloc() and will thus be freed through a device-managed
++ * resource.
++ *
++ * Returns:
++ * A pointer to the new drm_device, or an ERR_PTR() otherwise.
++ */
++#define drm_kunit_helper_alloc_drm_device_with_driver(_test, _dev, _type, _member, _drv)	\
++	((_type *)__drm_kunit_helper_alloc_drm_device_with_driver(_test, _dev,			\
++						       sizeof(_type),				\
++						       offsetof(_type, _member),		\
++						       _drv))
++
++static inline struct drm_device *
++__drm_kunit_helper_alloc_drm_device(struct kunit *test,
++				    struct device *dev,
+ 				    size_t size, size_t offset,
+-				    u32 features);
++				    u32 features)
++{
++	struct drm_driver *driver;
++
++	driver = kunit_kzalloc(test, sizeof(*driver), GFP_KERNEL);
++	KUNIT_ASSERT_NOT_NULL(test, driver);
++
++	driver->driver_features = features;
++
++	return __drm_kunit_helper_alloc_drm_device_with_driver(test, dev,
++							       size, offset,
++							       driver);
++}
+ 
+ /**
+  * drm_kunit_helper_alloc_drm_device - Allocates a mock DRM device for KUnit tests
diff --git a/target/linux/bcm27xx/patches-6.1/950-0498-drm-vc4-Move-HVS-state-to-main-header.patch b/target/linux/bcm27xx/patches-6.1/950-0498-drm-vc4-Move-HVS-state-to-main-header.patch
new file mode 100644
index 00000000000000..cb492fcb640819
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0498-drm-vc4-Move-HVS-state-to-main-header.patch
@@ -0,0 +1,116 @@
+From 037268376a9c4698eae418cff89e5cd188c0c73c Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Thu, 10 Nov 2022 12:57:53 +0100
+Subject: [PATCH] drm/vc4: Move HVS state to main header
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+In order to introduce unit tests for the HVS state computation, we'll
+need access to the vc4_hvs_state struct definition and its associated
+helpers.
+
+Let's move them in our driver header.
+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Reviewed-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/vc4_drv.h | 23 +++++++++++++++++++++++
+ drivers/gpu/drm/vc4/vc4_kms.c | 25 +++----------------------
+ 2 files changed, 26 insertions(+), 22 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -360,6 +360,29 @@ struct vc4_hvs {
+ 	bool vc5_hdmi_enable_4096by2160;
+ };
+ 
++#define HVS_NUM_CHANNELS 3
++
++struct vc4_hvs_state {
++	struct drm_private_state base;
++	unsigned long core_clock_rate;
++
++	struct {
++		unsigned in_use: 1;
++		unsigned long fifo_load;
++		struct drm_crtc_commit *pending_commit;
++	} fifo_state[HVS_NUM_CHANNELS];
++};
++
++static inline struct vc4_hvs_state *
++to_vc4_hvs_state(const struct drm_private_state *priv)
++{
++	return container_of(priv, struct vc4_hvs_state, base);
++}
++
++struct vc4_hvs_state *vc4_hvs_get_global_state(struct drm_atomic_state *state);
++struct vc4_hvs_state *vc4_hvs_get_old_global_state(const struct drm_atomic_state *state);
++struct vc4_hvs_state *vc4_hvs_get_new_global_state(const struct drm_atomic_state *state);
++
+ struct vc4_plane {
+ 	struct drm_plane base;
+ };
+--- a/drivers/gpu/drm/vc4/vc4_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_kms.c
+@@ -25,8 +25,6 @@
+ #include "vc4_drv.h"
+ #include "vc4_regs.h"
+ 
+-#define HVS_NUM_CHANNELS 3
+-
+ struct vc4_ctm_state {
+ 	struct drm_private_state base;
+ 	struct drm_color_ctm *ctm;
+@@ -39,23 +37,6 @@ to_vc4_ctm_state(const struct drm_privat
+ 	return container_of(priv, struct vc4_ctm_state, base);
+ }
+ 
+-struct vc4_hvs_state {
+-	struct drm_private_state base;
+-	unsigned long core_clock_rate;
+-
+-	struct {
+-		unsigned in_use: 1;
+-		unsigned long fifo_load;
+-		struct drm_crtc_commit *pending_commit;
+-	} fifo_state[HVS_NUM_CHANNELS];
+-};
+-
+-static struct vc4_hvs_state *
+-to_vc4_hvs_state(const struct drm_private_state *priv)
+-{
+-	return container_of(priv, struct vc4_hvs_state, base);
+-}
+-
+ struct vc4_load_tracker_state {
+ 	struct drm_private_state base;
+ 	u64 hvs_load;
+@@ -194,7 +175,7 @@ vc4_ctm_commit(struct vc4_dev *vc4, stru
+ 		  VC4_SET_FIELD(ctm_state->fifo, SCALER_OLEDOFFS_DISPFIFO));
+ }
+ 
+-static struct vc4_hvs_state *
++struct vc4_hvs_state *
+ vc4_hvs_get_new_global_state(const struct drm_atomic_state *state)
+ {
+ 	struct vc4_dev *vc4 = to_vc4_dev(state->dev);
+@@ -207,7 +188,7 @@ vc4_hvs_get_new_global_state(const struc
+ 	return to_vc4_hvs_state(priv_state);
+ }
+ 
+-static struct vc4_hvs_state *
++struct vc4_hvs_state *
+ vc4_hvs_get_old_global_state(const struct drm_atomic_state *state)
+ {
+ 	struct vc4_dev *vc4 = to_vc4_dev(state->dev);
+@@ -220,7 +201,7 @@ vc4_hvs_get_old_global_state(const struc
+ 	return to_vc4_hvs_state(priv_state);
+ }
+ 
+-static struct vc4_hvs_state *
++struct vc4_hvs_state *
+ vc4_hvs_get_global_state(struct drm_atomic_state *state)
+ {
+ 	struct vc4_dev *vc4 = to_vc4_dev(state->dev);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0499-drm-vc4-crtc-Introduce-a-lower-level-crtc-init-helpe.patch b/target/linux/bcm27xx/patches-6.1/950-0499-drm-vc4-crtc-Introduce-a-lower-level-crtc-init-helpe.patch
new file mode 100644
index 00000000000000..aaec147cd1d785
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0499-drm-vc4-crtc-Introduce-a-lower-level-crtc-init-helpe.patch
@@ -0,0 +1,131 @@
+From 4e2742244ff3084dfcd465180d7b7b843af13854 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 14 Nov 2022 14:11:41 +0100
+Subject: [PATCH] drm/vc4: crtc: Introduce a lower-level crtc init
+ helper
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The current vc4_crtc_init() helper assumes that we will be using
+hardware planes and calls vc4_plane_init().
+
+While it's a reasonable assumption, we'll want to mock the plane and
+thus provide our own. Let's create a helper that will take the plane as
+an argument.
+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Reviewed-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c | 70 +++++++++++++++++++++++++---------
+ drivers/gpu/drm/vc4/vc4_drv.h  |  6 +++
+ 2 files changed, 57 insertions(+), 19 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -1326,31 +1326,38 @@ static void vc4_set_crtc_possible_masks(
+ 	}
+ }
+ 
+-int vc4_crtc_init(struct drm_device *drm, struct platform_device *pdev,
+-		  struct vc4_crtc *vc4_crtc,
+-		  const struct vc4_crtc_data *data,
+-		  const struct drm_crtc_funcs *crtc_funcs,
+-		  const struct drm_crtc_helper_funcs *crtc_helper_funcs,
+-		  bool feeds_txp)
++/**
++ * __vc4_crtc_init - Initializes a CRTC
++ * @drm: DRM Device
++ * @pdev: CRTC Platform Device
++ * @vc4_crtc: CRTC Object to Initialize
++ * @data: Configuration data associated with this CRTC
++ * @primary_plane: Primary plane for CRTC
++ * @crtc_funcs: Callbacks for the new CRTC
++ * @crtc_helper_funcs: Helper Callbacks for the new CRTC
++ * @feeds_txp: Is this CRTC connected to the TXP?
++ *
++ * Initializes our private CRTC structure. This function is mostly
++ * relevant for KUnit testing, all other users should use
++ * vc4_crtc_init() instead.
++ *
++ * Returns:
++ * 0 on success, a negative error code on failure.
++ */
++int __vc4_crtc_init(struct drm_device *drm,
++		    struct platform_device *pdev,
++		    struct vc4_crtc *vc4_crtc,
++		    const struct vc4_crtc_data *data,
++		    struct drm_plane *primary_plane,
++		    const struct drm_crtc_funcs *crtc_funcs,
++		    const struct drm_crtc_helper_funcs *crtc_helper_funcs,
++		    bool feeds_txp)
+ {
+ 	struct vc4_dev *vc4 = to_vc4_dev(drm);
+ 	struct drm_crtc *crtc = &vc4_crtc->base;
+-	struct drm_plane *primary_plane;
+ 	unsigned int i;
+ 	int ret;
+ 
+-	/* For now, we create just the primary and the legacy cursor
+-	 * planes.  We should be able to stack more planes on easily,
+-	 * but to do that we would need to compute the bandwidth
+-	 * requirement of the plane configuration, and reject ones
+-	 * that will take too much.
+-	 */
+-	primary_plane = vc4_plane_init(drm, DRM_PLANE_TYPE_PRIMARY, 0);
+-	if (IS_ERR(primary_plane)) {
+-		dev_err(drm->dev, "failed to construct primary plane\n");
+-		return PTR_ERR(primary_plane);
+-	}
+-
+ 	vc4_crtc->data = data;
+ 	vc4_crtc->pdev = pdev;
+ 	vc4_crtc->feeds_txp = feeds_txp;
+@@ -1399,6 +1406,31 @@ int vc4_crtc_init(struct drm_device *drm
+ 	return 0;
+ }
+ 
++int vc4_crtc_init(struct drm_device *drm, struct platform_device *pdev,
++		  struct vc4_crtc *vc4_crtc,
++		  const struct vc4_crtc_data *data,
++		  const struct drm_crtc_funcs *crtc_funcs,
++		  const struct drm_crtc_helper_funcs *crtc_helper_funcs,
++		  bool feeds_txp)
++{
++	struct drm_plane *primary_plane;
++
++	/* For now, we create just the primary and the legacy cursor
++	 * planes.  We should be able to stack more planes on easily,
++	 * but to do that we would need to compute the bandwidth
++	 * requirement of the plane configuration, and reject ones
++	 * that will take too much.
++	 */
++	primary_plane = vc4_plane_init(drm, DRM_PLANE_TYPE_PRIMARY, 0);
++	if (IS_ERR(primary_plane)) {
++		dev_err(drm->dev, "failed to construct primary plane\n");
++		return PTR_ERR(primary_plane);
++	}
++
++	return __vc4_crtc_init(drm, pdev, vc4_crtc, data, primary_plane,
++			       crtc_funcs, crtc_helper_funcs, feeds_txp);
++}
++
+ static int vc4_crtc_bind(struct device *dev, struct device *master, void *data)
+ {
+ 	struct platform_device *pdev = to_platform_device(dev);
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -912,6 +912,12 @@ int vc4_bo_debugfs_init(struct drm_minor
+ /* vc4_crtc.c */
+ extern struct platform_driver vc4_crtc_driver;
+ int vc4_crtc_disable_at_boot(struct drm_crtc *crtc);
++int __vc4_crtc_init(struct drm_device *drm, struct platform_device *pdev,
++		    struct vc4_crtc *vc4_crtc, const struct vc4_crtc_data *data,
++		    struct drm_plane *primary_plane,
++		    const struct drm_crtc_funcs *crtc_funcs,
++		    const struct drm_crtc_helper_funcs *crtc_helper_funcs,
++		    bool feeds_txp);
+ int vc4_crtc_init(struct drm_device *drm, struct platform_device *pdev,
+ 		  struct vc4_crtc *vc4_crtc, const struct vc4_crtc_data *data,
+ 		  const struct drm_crtc_funcs *crtc_funcs,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0500-drm-vc4-crtc-Make-encoder-lookup-helper-public.patch b/target/linux/bcm27xx/patches-6.1/950-0500-drm-vc4-crtc-Make-encoder-lookup-helper-public.patch
new file mode 100644
index 00000000000000..995a0e7a0cd2c9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0500-drm-vc4-crtc-Make-encoder-lookup-helper-public.patch
@@ -0,0 +1,78 @@
+From 5607ae85bd64208356567c77fed84a395d4e2182 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 14 Nov 2022 16:18:09 +0100
+Subject: [PATCH] drm/vc4: crtc: Make encoder lookup helper public
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+We'll need a function that looks up an encoder by its vc4_encoder_type.
+Such a function is already present in the CRTC code, so let's make it
+public so that we can reuse it in the unit tests.
+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Reviewed-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c | 17 +----------------
+ drivers/gpu/drm/vc4/vc4_drv.h  | 16 ++++++++++++++++
+ 2 files changed, 17 insertions(+), 16 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -520,21 +520,6 @@ static int vc4_crtc_disable(struct drm_c
+ 	return 0;
+ }
+ 
+-static struct drm_encoder *vc4_crtc_get_encoder_by_type(struct drm_crtc *crtc,
+-							enum vc4_encoder_type type)
+-{
+-	struct drm_encoder *encoder;
+-
+-	drm_for_each_encoder(encoder, crtc->dev) {
+-		struct vc4_encoder *vc4_encoder = to_vc4_encoder(encoder);
+-
+-		if (vc4_encoder->type == type)
+-			return encoder;
+-	}
+-
+-	return NULL;
+-}
+-
+ int vc4_crtc_disable_at_boot(struct drm_crtc *crtc)
+ {
+ 	struct drm_device *drm = crtc->dev;
+@@ -570,7 +555,7 @@ int vc4_crtc_disable_at_boot(struct drm_
+ 
+ 	pv_data = vc4_crtc_to_vc4_pv_data(vc4_crtc);
+ 	encoder_type = pv_data->encoder_types[encoder_sel];
+-	encoder = vc4_crtc_get_encoder_by_type(crtc, encoder_type);
++	encoder = vc4_find_encoder_by_type(drm, encoder_type);
+ 	if (WARN_ON(!encoder))
+ 		return 0;
+ 
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -500,6 +500,22 @@ to_vc4_encoder(const struct drm_encoder
+ 	return container_of(encoder, struct vc4_encoder, base);
+ }
+ 
++static inline
++struct drm_encoder *vc4_find_encoder_by_type(struct drm_device *drm,
++					     enum vc4_encoder_type type)
++{
++	struct drm_encoder *encoder;
++
++	drm_for_each_encoder(encoder, drm) {
++		struct vc4_encoder *vc4_encoder = to_vc4_encoder(encoder);
++
++		if (vc4_encoder->type == type)
++			return encoder;
++	}
++
++	return NULL;
++}
++
+ struct vc4_crtc_data {
+ 	const char *name;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0501-drm-vc4-hvs-Provide-a-function-to-initialize-the-HVS.patch b/target/linux/bcm27xx/patches-6.1/950-0501-drm-vc4-hvs-Provide-a-function-to-initialize-the-HVS.patch
new file mode 100644
index 00000000000000..033fd9843a6bc5
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0501-drm-vc4-hvs-Provide-a-function-to-initialize-the-HVS.patch
@@ -0,0 +1,131 @@
+From e75de2a5fd951a0244b2000dc2ad3922b0ab0f5e Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Wed, 23 Nov 2022 16:00:53 +0100
+Subject: [PATCH] drm/vc4: hvs: Provide a function to initialize the
+ HVS structure
+
+We'll need to initialize the HVS structure without a backing device to
+create a mock we'll use for testing.
+
+Split the structure initialization part into a separate function.
+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/vc4_drv.h |  1 +
+ drivers/gpu/drm/vc4/vc4_hvs.c | 73 +++++++++++++++++++++--------------
+ 2 files changed, 44 insertions(+), 30 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -1036,6 +1036,7 @@ void vc4_irq_reset(struct drm_device *de
+ 
+ /* vc4_hvs.c */
+ extern struct platform_driver vc4_hvs_driver;
++struct vc4_hvs *__vc4_hvs_alloc(struct vc4_dev *vc4, struct platform_device *pdev);
+ void vc4_hvs_stop_channel(struct vc4_hvs *hvs, unsigned int output);
+ int vc4_hvs_get_fifo_from_output(struct vc4_hvs *hvs, unsigned int output);
+ u8 vc4_hvs_get_fifo_frame_count(struct vc4_hvs *hvs, unsigned int fifo);
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -1010,6 +1010,46 @@ int vc4_hvs_debugfs_init(struct drm_mino
+ 	return 0;
+ }
+ 
++struct vc4_hvs *__vc4_hvs_alloc(struct vc4_dev *vc4, struct platform_device *pdev)
++{
++	struct drm_device *drm = &vc4->base;
++	struct vc4_hvs *hvs;
++
++	hvs = drmm_kzalloc(drm, sizeof(*hvs), GFP_KERNEL);
++	if (!hvs)
++		return ERR_PTR(-ENOMEM);
++
++	hvs->vc4 = vc4;
++	hvs->pdev = pdev;
++
++	spin_lock_init(&hvs->mm_lock);
++
++	/* Set up the HVS display list memory manager.  We never
++	 * overwrite the setup from the bootloader (just 128b out of
++	 * our 16K), since we don't want to scramble the screen when
++	 * transitioning from the firmware's boot setup to runtime.
++	 */
++	drm_mm_init(&hvs->dlist_mm,
++		    HVS_BOOTLOADER_DLIST_END,
++		    (SCALER_DLIST_SIZE >> 2) - HVS_BOOTLOADER_DLIST_END);
++
++	/* Set up the HVS LBM memory manager.  We could have some more
++	 * complicated data structure that allowed reuse of LBM areas
++	 * between planes when they don't overlap on the screen, but
++	 * for now we just allocate globally.
++	 */
++	if (!vc4->is_vc5)
++		/* 48k words of 2x12-bit pixels */
++		drm_mm_init(&hvs->lbm_mm, 0, 48 * 1024);
++	else
++		/* 60k words of 4x12-bit pixels */
++		drm_mm_init(&hvs->lbm_mm, 0, 60 * 1024);
++
++	vc4->hvs = hvs;
++
++	return hvs;
++}
++
+ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
+ {
+ 	struct platform_device *pdev = to_platform_device(dev);
+@@ -1020,11 +1060,9 @@ static int vc4_hvs_bind(struct device *d
+ 	u32 dispctrl;
+ 	u32 reg, top;
+ 
+-	hvs = drmm_kzalloc(drm, sizeof(*hvs), GFP_KERNEL);
+-	if (!hvs)
+-		return -ENOMEM;
+-	hvs->vc4 = vc4;
+-	hvs->pdev = pdev;
++	hvs = __vc4_hvs_alloc(vc4, NULL);
++	if (IS_ERR(hvs))
++		return PTR_ERR(hvs);
+ 
+ 	hvs->regs = vc4_ioremap_regs(pdev, 0);
+ 	if (IS_ERR(hvs->regs))
+@@ -1077,29 +1115,6 @@ static int vc4_hvs_bind(struct device *d
+ 	else
+ 		hvs->dlist = hvs->regs + SCALER5_DLIST_START;
+ 
+-	spin_lock_init(&hvs->mm_lock);
+-
+-	/* Set up the HVS display list memory manager.  We never
+-	 * overwrite the setup from the bootloader (just 128b out of
+-	 * our 16K), since we don't want to scramble the screen when
+-	 * transitioning from the firmware's boot setup to runtime.
+-	 */
+-	drm_mm_init(&hvs->dlist_mm,
+-		    HVS_BOOTLOADER_DLIST_END,
+-		    (SCALER_DLIST_SIZE >> 2) - HVS_BOOTLOADER_DLIST_END);
+-
+-	/* Set up the HVS LBM memory manager.  We could have some more
+-	 * complicated data structure that allowed reuse of LBM areas
+-	 * between planes when they don't overlap on the screen, but
+-	 * for now we just allocate globally.
+-	 */
+-	if (!vc4->is_vc5)
+-		/* 48k words of 2x12-bit pixels */
+-		drm_mm_init(&hvs->lbm_mm, 0, 48 * 1024);
+-	else
+-		/* 60k words of 4x12-bit pixels */
+-		drm_mm_init(&hvs->lbm_mm, 0, 60 * 1024);
+-
+ 	/* Upload filter kernels.  We only have the one for now, so we
+ 	 * keep it around for the lifetime of the driver.
+ 	 */
+@@ -1109,8 +1124,6 @@ static int vc4_hvs_bind(struct device *d
+ 	if (ret)
+ 		return ret;
+ 
+-	vc4->hvs = hvs;
+-
+ 	reg = HVS_READ(SCALER_DISPECTRL);
+ 	reg &= ~SCALER_DISPECTRL_DSP2_MUX_MASK;
+ 	HVS_WRITE(SCALER_DISPECTRL,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0502-drm-vc4-tests-Introduce-a-mocking-infrastructure.patch b/target/linux/bcm27xx/patches-6.1/950-0502-drm-vc4-tests-Introduce-a-mocking-infrastructure.patch
new file mode 100644
index 00000000000000..7290aa2084d20f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0502-drm-vc4-tests-Introduce-a-mocking-infrastructure.patch
@@ -0,0 +1,736 @@
+From 8e1854782b26898db7c4f6ea7247e56be0469a01 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 21 Nov 2022 18:18:40 +0100
+Subject: [PATCH] drm/vc4: tests: Introduce a mocking infrastructure
+
+In order to test the current atomic_check hooks we need to have a DRM
+device that has roughly the same capabilities and layout that the actual
+hardware. We'll also need a bunch of functions to create arbitrary
+atomic states.
+
+Let's create some helpers to create a device that behaves like the real
+one, and some helpers to maintain the atomic state we want to check.
+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/Kconfig                 |  16 ++
+ drivers/gpu/drm/vc4/Makefile                |   6 +
+ drivers/gpu/drm/vc4/tests/.kunitconfig      |  13 ++
+ drivers/gpu/drm/vc4/tests/vc4_mock.c        | 200 ++++++++++++++++++++
+ drivers/gpu/drm/vc4/tests/vc4_mock.h        |  60 ++++++
+ drivers/gpu/drm/vc4/tests/vc4_mock_crtc.c   |  41 ++++
+ drivers/gpu/drm/vc4/tests/vc4_mock_output.c |  99 ++++++++++
+ drivers/gpu/drm/vc4/tests/vc4_mock_plane.c  |  47 +++++
+ drivers/gpu/drm/vc4/vc4_crtc.c              |  20 +-
+ drivers/gpu/drm/vc4/vc4_drv.c               |   4 +-
+ drivers/gpu/drm/vc4/vc4_drv.h               |  16 ++
+ drivers/gpu/drm/vc4/vc4_firmware_kms.c      |   6 +-
+ drivers/gpu/drm/vc4/vc4_txp.c               |   2 +-
+ 13 files changed, 514 insertions(+), 16 deletions(-)
+ create mode 100644 drivers/gpu/drm/vc4/tests/.kunitconfig
+ create mode 100644 drivers/gpu/drm/vc4/tests/vc4_mock.c
+ create mode 100644 drivers/gpu/drm/vc4/tests/vc4_mock.h
+ create mode 100644 drivers/gpu/drm/vc4/tests/vc4_mock_crtc.c
+ create mode 100644 drivers/gpu/drm/vc4/tests/vc4_mock_output.c
+ create mode 100644 drivers/gpu/drm/vc4/tests/vc4_mock_plane.c
+
+--- a/drivers/gpu/drm/vc4/Kconfig
++++ b/drivers/gpu/drm/vc4/Kconfig
+@@ -34,3 +34,19 @@ config DRM_VC4_HDMI_CEC
+ 	help
+ 	  Choose this option if you have a Broadcom VC4 GPU
+ 	  and want to use CEC.
++
++config DRM_VC4_KUNIT_TEST
++	bool "KUnit tests for VC4" if !KUNIT_ALL_TESTS
++	depends on DRM_VC4 && KUNIT
++	select DRM_KUNIT_TEST_HELPERS
++	default KUNIT_ALL_TESTS
++	help
++	  This builds unit tests for the VC4 DRM/KMS driver. This option is
++	  not useful for distributions or general kernels, but only for kernel
++	  developers working on the VC4 driver.
++
++	  For more information on KUnit and unit tests in general,
++	  please refer to the KUnit documentation in
++	  Documentation/dev-tools/kunit/.
++
++	  If in doubt, say "N".
+--- a/drivers/gpu/drm/vc4/Makefile
++++ b/drivers/gpu/drm/vc4/Makefile
+@@ -26,6 +26,12 @@ vc4-y := \
+ 	vc4_validate.o \
+ 	vc4_validate_shaders.o
+ 
++vc4-$(CONFIG_DRM_VC4_KUNIT_TEST) += \
++	tests/vc4_mock.o \
++	tests/vc4_mock_crtc.o \
++	tests/vc4_mock_output.o \
++	tests/vc4_mock_plane.o
++
+ vc4-$(CONFIG_DEBUG_FS) += vc4_debugfs.o
+ 
+ obj-$(CONFIG_DRM_VC4)  += vc4.o
+--- /dev/null
++++ b/drivers/gpu/drm/vc4/tests/.kunitconfig
+@@ -0,0 +1,13 @@
++CONFIG_ARCH_BCM=y
++CONFIG_ARCH_BCM2835=y
++CONFIG_BCM2835_MBOX=y
++CONFIG_KUNIT=y
++CONFIG_DRM=y
++CONFIG_DRM_VC4=y
++CONFIG_DRM_VC4_KUNIT_TEST=y
++CONFIG_MAILBOX=y
++CONFIG_RASPBERRYPI_FIRMWARE=y
++CONFIG_SND=y
++CONFIG_SND_SOC=y
++CONFIG_SOUND=y
++CONFIG_COMMON_CLK=y
+--- /dev/null
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock.c
+@@ -0,0 +1,200 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <drm/drm_drv.h>
++#include <drm/drm_kunit_helpers.h>
++
++#include <kunit/test.h>
++
++#include "vc4_mock.h"
++
++struct vc4_mock_output_desc {
++	enum vc4_encoder_type	vc4_encoder_type;
++	unsigned int		encoder_type;
++	unsigned int		connector_type;
++};
++
++#define VC4_MOCK_OUTPUT_DESC(_vc4_type, _etype, _ctype)					\
++	{										\
++		.vc4_encoder_type = _vc4_type,						\
++		.encoder_type = _etype,							\
++		.connector_type = _ctype,						\
++	}
++
++struct vc4_mock_pipe_desc {
++	const struct vc4_crtc_data *data;
++	const struct vc4_mock_output_desc *outputs;
++	unsigned int noutputs;
++};
++
++#define VC4_MOCK_CRTC_DESC(_data, ...)							\
++	{										\
++		.data = _data,								\
++		.outputs = (struct vc4_mock_output_desc[]) { __VA_ARGS__ },		\
++		.noutputs = sizeof((struct vc4_mock_output_desc[]) { __VA_ARGS__ }) /	\
++			     sizeof(struct vc4_mock_output_desc),			\
++	}
++
++#define VC4_MOCK_PIXELVALVE_DESC(_data, ...)						\
++	VC4_MOCK_CRTC_DESC(&(_data)->base, __VA_ARGS__)
++
++struct vc4_mock_desc {
++	const struct vc4_mock_pipe_desc *pipes;
++	unsigned int npipes;
++};
++
++#define VC4_MOCK_DESC(...)								\
++	{										\
++		.pipes = (struct vc4_mock_pipe_desc[]) { __VA_ARGS__ },			\
++		.npipes = sizeof((struct vc4_mock_pipe_desc[]) { __VA_ARGS__ }) /	\
++			     sizeof(struct vc4_mock_pipe_desc),				\
++	}
++
++static const struct vc4_mock_desc vc4_mock =
++	VC4_MOCK_DESC(
++		VC4_MOCK_CRTC_DESC(&vc4_txp_crtc_data,
++				   VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_TXP,
++							DRM_MODE_ENCODER_VIRTUAL,
++							DRM_MODE_CONNECTOR_WRITEBACK)),
++		VC4_MOCK_PIXELVALVE_DESC(&bcm2835_pv0_data,
++					 VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_DSI0,
++							      DRM_MODE_ENCODER_DSI,
++							      DRM_MODE_CONNECTOR_DSI),
++					 VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_DPI,
++							      DRM_MODE_ENCODER_DPI,
++							      DRM_MODE_CONNECTOR_DPI)),
++		VC4_MOCK_PIXELVALVE_DESC(&bcm2835_pv1_data,
++					 VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_DSI1,
++							      DRM_MODE_ENCODER_DSI,
++							      DRM_MODE_CONNECTOR_DSI)),
++		VC4_MOCK_PIXELVALVE_DESC(&bcm2835_pv2_data,
++					 VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_HDMI0,
++							      DRM_MODE_ENCODER_TMDS,
++							      DRM_MODE_CONNECTOR_HDMIA),
++					 VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_VEC,
++							      DRM_MODE_ENCODER_TVDAC,
++							      DRM_MODE_CONNECTOR_Composite)),
++);
++
++static const struct vc4_mock_desc vc5_mock =
++	VC4_MOCK_DESC(
++		VC4_MOCK_CRTC_DESC(&vc4_txp_crtc_data,
++				   VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_TXP,
++							DRM_MODE_ENCODER_VIRTUAL,
++							DRM_MODE_CONNECTOR_WRITEBACK)),
++		VC4_MOCK_PIXELVALVE_DESC(&bcm2711_pv0_data,
++					 VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_DSI0,
++							      DRM_MODE_ENCODER_DSI,
++							      DRM_MODE_CONNECTOR_DSI),
++					 VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_DPI,
++							      DRM_MODE_ENCODER_DPI,
++							      DRM_MODE_CONNECTOR_DPI)),
++		VC4_MOCK_PIXELVALVE_DESC(&bcm2711_pv1_data,
++					 VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_DSI1,
++							      DRM_MODE_ENCODER_DSI,
++							      DRM_MODE_CONNECTOR_DSI)),
++		VC4_MOCK_PIXELVALVE_DESC(&bcm2711_pv2_data,
++					 VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_HDMI0,
++							      DRM_MODE_ENCODER_TMDS,
++							      DRM_MODE_CONNECTOR_HDMIA)),
++		VC4_MOCK_PIXELVALVE_DESC(&bcm2711_pv3_data,
++					 VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_VEC,
++							      DRM_MODE_ENCODER_TVDAC,
++							      DRM_MODE_CONNECTOR_Composite)),
++		VC4_MOCK_PIXELVALVE_DESC(&bcm2711_pv4_data,
++					 VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_HDMI1,
++							      DRM_MODE_ENCODER_TMDS,
++							      DRM_MODE_CONNECTOR_HDMIA)),
++);
++
++static int __build_one_pipe(struct kunit *test, struct drm_device *drm,
++			    const struct vc4_mock_pipe_desc *pipe)
++{
++	struct vc4_dummy_plane *dummy_plane;
++	struct drm_plane *plane;
++	struct vc4_dummy_crtc *dummy_crtc;
++	struct drm_crtc *crtc;
++	unsigned int i;
++
++	dummy_plane = vc4_dummy_plane(test, drm, DRM_PLANE_TYPE_PRIMARY);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dummy_plane);
++
++	plane = &dummy_plane->plane.base;
++	dummy_crtc = vc4_mock_pv(test, drm, plane, pipe->data);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dummy_crtc);
++
++	crtc = &dummy_crtc->crtc.base;
++	for (i = 0; i < pipe->noutputs; i++) {
++		const struct vc4_mock_output_desc *mock_output = &pipe->outputs[i];
++		struct vc4_dummy_output *dummy_output;
++
++		dummy_output = vc4_dummy_output(test, drm, crtc,
++						mock_output->vc4_encoder_type,
++						mock_output->encoder_type,
++						mock_output->connector_type);
++		KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dummy_output);
++	}
++
++	return 0;
++}
++
++static int __build_mock(struct kunit *test, struct drm_device *drm,
++			const struct vc4_mock_desc *mock)
++{
++	unsigned int i;
++
++	for (i = 0; i < mock->npipes; i++) {
++		const struct vc4_mock_pipe_desc *pipe = &mock->pipes[i];
++		int ret;
++
++		ret = __build_one_pipe(test, drm, pipe);
++		KUNIT_ASSERT_EQ(test, ret, 0);
++	}
++
++	return 0;
++}
++
++static struct vc4_dev *__mock_device(struct kunit *test, bool is_vc5)
++{
++	struct drm_device *drm;
++	const struct drm_driver *drv = is_vc5 ? &vc5_drm_driver : &vc4_drm_driver;
++	const struct vc4_mock_desc *desc = is_vc5 ? &vc5_mock : &vc4_mock;
++	struct vc4_dev *vc4;
++	struct device *dev;
++	int ret;
++
++	dev = drm_kunit_helper_alloc_device(test);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dev);
++
++	vc4 = drm_kunit_helper_alloc_drm_device_with_driver(test, dev,
++							    struct vc4_dev, base,
++							    drv);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, vc4);
++
++	vc4->dev = dev;
++	vc4->is_vc5 = is_vc5;
++
++	vc4->hvs = __vc4_hvs_alloc(vc4, NULL);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, vc4->hvs);
++
++	drm = &vc4->base;
++	ret = __build_mock(test, drm, desc);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	ret = vc4_kms_load(drm);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	ret = drm_dev_register(drm, 0);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	return vc4;
++}
++
++struct vc4_dev *vc4_mock_device(struct kunit *test)
++{
++	return __mock_device(test, false);
++}
++
++struct vc4_dev *vc5_mock_device(struct kunit *test)
++{
++	return __mock_device(test, true);
++}
+--- /dev/null
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock.h
+@@ -0,0 +1,60 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++
++#ifndef VC4_MOCK_H_
++#define VC4_MOCK_H_
++
++#include "../vc4_drv.h"
++
++static inline
++struct drm_crtc *vc4_find_crtc_for_encoder(struct kunit *test,
++					   struct drm_device *drm,
++					   struct drm_encoder *encoder)
++{
++	struct drm_crtc *crtc;
++
++	KUNIT_ASSERT_EQ(test, hweight32(encoder->possible_crtcs), 1);
++
++	drm_for_each_crtc(crtc, drm)
++		if (encoder->possible_crtcs & drm_crtc_mask(crtc))
++			return crtc;
++
++	return NULL;
++}
++
++struct vc4_dummy_plane {
++	struct vc4_plane plane;
++};
++
++struct vc4_dummy_plane *vc4_dummy_plane(struct kunit *test,
++					struct drm_device *drm,
++					enum drm_plane_type type);
++
++struct vc4_dummy_crtc {
++	struct vc4_crtc crtc;
++};
++
++struct vc4_dummy_crtc *vc4_mock_pv(struct kunit *test,
++				   struct drm_device *drm,
++				   struct drm_plane *plane,
++				   const struct vc4_crtc_data *data);
++
++struct vc4_dummy_output {
++	struct vc4_encoder encoder;
++	struct drm_connector connector;
++};
++
++struct vc4_dummy_output *vc4_dummy_output(struct kunit *test,
++					  struct drm_device *drm,
++					  struct drm_crtc *crtc,
++					  enum vc4_encoder_type vc4_encoder_type,
++					  unsigned int kms_encoder_type,
++					  unsigned int connector_type);
++
++struct vc4_dev *vc4_mock_device(struct kunit *test);
++struct vc4_dev *vc5_mock_device(struct kunit *test);
++
++int vc4_mock_atomic_add_output(struct kunit *test, struct drm_device *drm,
++			       enum vc4_encoder_type type,
++			       struct drm_atomic_state *state);
++
++#endif // VC4_MOCK_H_
+--- /dev/null
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock_crtc.c
+@@ -0,0 +1,41 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <drm/drm_atomic_state_helper.h>
++#include <drm/drm_modeset_helper_vtables.h>
++
++#include <kunit/test.h>
++
++#include "vc4_mock.h"
++
++static const struct drm_crtc_helper_funcs vc4_dummy_crtc_helper_funcs = {
++	.atomic_check	= vc4_crtc_atomic_check,
++};
++
++static const struct drm_crtc_funcs vc4_dummy_crtc_funcs = {
++	.atomic_destroy_state	= vc4_crtc_destroy_state,
++	.atomic_duplicate_state	= vc4_crtc_duplicate_state,
++	.reset			= vc4_crtc_reset,
++};
++
++struct vc4_dummy_crtc *vc4_mock_pv(struct kunit *test,
++				   struct drm_device *drm,
++				   struct drm_plane *plane,
++				   const struct vc4_crtc_data *data)
++{
++	struct vc4_dummy_crtc *dummy_crtc;
++	struct vc4_crtc *vc4_crtc;
++	int ret;
++
++	dummy_crtc = kunit_kzalloc(test, sizeof(*dummy_crtc), GFP_KERNEL);
++	KUNIT_ASSERT_NOT_NULL(test, dummy_crtc);
++
++	vc4_crtc = &dummy_crtc->crtc;
++	ret = __vc4_crtc_init(drm, NULL,
++			      vc4_crtc, data, plane,
++			      &vc4_dummy_crtc_funcs,
++			      &vc4_dummy_crtc_helper_funcs,
++			      false);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	return dummy_crtc;
++}
+--- /dev/null
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock_output.c
+@@ -0,0 +1,99 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <drm/drm_atomic_state_helper.h>
++#include <drm/drm_atomic_uapi.h>
++#include <drm/drm_connector.h>
++#include <drm/drm_crtc.h>
++#include <drm/drm_encoder.h>
++#include <drm/drm_modeset_helper_vtables.h>
++
++#include <kunit/test.h>
++
++#include "vc4_mock.h"
++
++static const struct drm_connector_helper_funcs vc4_dummy_connector_helper_funcs = {
++};
++
++static const struct drm_connector_funcs vc4_dummy_connector_funcs = {
++	.atomic_destroy_state	= drm_atomic_helper_connector_destroy_state,
++	.atomic_duplicate_state	= drm_atomic_helper_connector_duplicate_state,
++	.reset			= drm_atomic_helper_connector_reset,
++};
++
++struct vc4_dummy_output *vc4_dummy_output(struct kunit *test,
++					  struct drm_device *drm,
++					  struct drm_crtc *crtc,
++					  enum vc4_encoder_type vc4_encoder_type,
++					  unsigned int kms_encoder_type,
++					  unsigned int connector_type)
++{
++	struct vc4_dummy_output *dummy_output;
++	struct drm_connector *conn;
++	struct drm_encoder *enc;
++	int ret;
++
++	dummy_output = kunit_kzalloc(test, sizeof(*dummy_output), GFP_KERNEL);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dummy_output);
++	dummy_output->encoder.type = vc4_encoder_type;
++
++	enc = &dummy_output->encoder.base;
++	ret = drmm_encoder_init(drm, enc,
++				NULL,
++				kms_encoder_type,
++				NULL);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++	enc->possible_crtcs = drm_crtc_mask(crtc);
++
++	conn = &dummy_output->connector;
++	ret = drmm_connector_init(drm, conn,
++				  &vc4_dummy_connector_funcs,
++				  connector_type,
++				  NULL);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	drm_connector_helper_add(conn, &vc4_dummy_connector_helper_funcs);
++	drm_connector_attach_encoder(conn, enc);
++
++	return dummy_output;
++}
++
++static const struct drm_display_mode default_mode = {
++	DRM_SIMPLE_MODE(640, 480, 64, 48)
++};
++
++int vc4_mock_atomic_add_output(struct kunit *test, struct drm_device *drm,
++			       enum vc4_encoder_type type,
++			       struct drm_atomic_state *state)
++{
++	struct vc4_dummy_output *output;
++	struct drm_connector *conn;
++	struct drm_connector_state *conn_state;
++	struct drm_encoder *encoder;
++	struct drm_crtc *crtc;
++	struct drm_crtc_state *crtc_state;
++	int ret;
++
++	encoder = vc4_find_encoder_by_type(drm, type);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, encoder);
++
++	crtc = vc4_find_crtc_for_encoder(test, drm, encoder);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, crtc);
++
++	output = container_of(encoder, struct vc4_dummy_output, encoder.base);
++	conn = &output->connector;
++	conn_state = drm_atomic_get_connector_state(state, conn);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, conn_state);
++
++	ret = drm_atomic_set_crtc_for_connector(conn_state, crtc);
++	KUNIT_EXPECT_EQ(test, ret, 0);
++
++	crtc_state = drm_atomic_get_crtc_state(state, crtc);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, crtc_state);
++
++	ret = drm_atomic_set_mode_for_crtc(crtc_state, &default_mode);
++	KUNIT_EXPECT_EQ(test, ret, 0);
++
++	crtc_state->active = true;
++
++	return 0;
++}
+--- /dev/null
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock_plane.c
+@@ -0,0 +1,47 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <drm/drm_atomic_state_helper.h>
++#include <drm/drm_fourcc.h>
++#include <drm/drm_modeset_helper_vtables.h>
++#include <drm/drm_plane.h>
++
++#include <kunit/test.h>
++
++#include "vc4_mock.h"
++
++static const struct drm_plane_helper_funcs vc4_dummy_plane_helper_funcs = {
++};
++
++static const struct drm_plane_funcs vc4_dummy_plane_funcs = {
++	.atomic_destroy_state	= drm_atomic_helper_plane_destroy_state,
++	.atomic_duplicate_state	= drm_atomic_helper_plane_duplicate_state,
++	.reset			= drm_atomic_helper_plane_reset,
++};
++
++static const uint32_t vc4_dummy_plane_formats[] = {
++	DRM_FORMAT_XRGB8888,
++};
++
++struct vc4_dummy_plane *vc4_dummy_plane(struct kunit *test,
++					struct drm_device *drm,
++					enum drm_plane_type type)
++{
++	struct vc4_dummy_plane *dummy_plane;
++	struct drm_plane *plane;
++
++	dummy_plane = drmm_universal_plane_alloc(drm,
++						 struct vc4_dummy_plane, plane.base,
++						 0,
++						 &vc4_dummy_plane_funcs,
++						 vc4_dummy_plane_formats,
++						 ARRAY_SIZE(vc4_dummy_plane_formats),
++						 NULL,
++						 DRM_PLANE_TYPE_PRIMARY,
++						 NULL);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dummy_plane);
++
++	plane = &dummy_plane->plane.base;
++	drm_plane_helper_add(plane, &vc4_dummy_plane_helper_funcs);
++
++	return dummy_plane;
++}
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -709,8 +709,8 @@ void vc4_crtc_get_margins(struct drm_crt
+ 	}
+ }
+ 
+-static int vc4_crtc_atomic_check(struct drm_crtc *crtc,
+-				 struct drm_atomic_state *state)
++int vc4_crtc_atomic_check(struct drm_crtc *crtc,
++			  struct drm_atomic_state *state)
+ {
+ 	struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state,
+ 									  crtc);
+@@ -1156,7 +1156,7 @@ static const struct drm_crtc_helper_func
+ 	.get_scanout_position = vc4_crtc_get_scanout_position,
+ };
+ 
+-static const struct vc4_pv_data bcm2835_pv0_data = {
++const struct vc4_pv_data bcm2835_pv0_data = {
+ 	.base = {
+ 		.name = "pixelvalve-0",
+ 		.debugfs_name = "crtc0_regs",
+@@ -1171,7 +1171,7 @@ static const struct vc4_pv_data bcm2835_
+ 	},
+ };
+ 
+-static const struct vc4_pv_data bcm2835_pv1_data = {
++const struct vc4_pv_data bcm2835_pv1_data = {
+ 	.base = {
+ 		.name = "pixelvalve-1",
+ 		.debugfs_name = "crtc1_regs",
+@@ -1186,7 +1186,7 @@ static const struct vc4_pv_data bcm2835_
+ 	},
+ };
+ 
+-static const struct vc4_pv_data bcm2835_pv2_data = {
++const struct vc4_pv_data bcm2835_pv2_data = {
+ 	.base = {
+ 		.name = "pixelvalve-2",
+ 		.debugfs_name = "crtc2_regs",
+@@ -1201,7 +1201,7 @@ static const struct vc4_pv_data bcm2835_
+ 	},
+ };
+ 
+-static const struct vc4_pv_data bcm2711_pv0_data = {
++const struct vc4_pv_data bcm2711_pv0_data = {
+ 	.base = {
+ 		.name = "pixelvalve-0",
+ 		.debugfs_name = "crtc0_regs",
+@@ -1216,7 +1216,7 @@ static const struct vc4_pv_data bcm2711_
+ 	},
+ };
+ 
+-static const struct vc4_pv_data bcm2711_pv1_data = {
++const struct vc4_pv_data bcm2711_pv1_data = {
+ 	.base = {
+ 		.name = "pixelvalve-1",
+ 		.debugfs_name = "crtc1_regs",
+@@ -1231,7 +1231,7 @@ static const struct vc4_pv_data bcm2711_
+ 	},
+ };
+ 
+-static const struct vc4_pv_data bcm2711_pv2_data = {
++const struct vc4_pv_data bcm2711_pv2_data = {
+ 	.base = {
+ 		.name = "pixelvalve-2",
+ 		.debugfs_name = "crtc2_regs",
+@@ -1245,7 +1245,7 @@ static const struct vc4_pv_data bcm2711_
+ 	},
+ };
+ 
+-static const struct vc4_pv_data bcm2711_pv3_data = {
++const struct vc4_pv_data bcm2711_pv3_data = {
+ 	.base = {
+ 		.name = "pixelvalve-3",
+ 		.debugfs_name = "crtc3_regs",
+@@ -1259,7 +1259,7 @@ static const struct vc4_pv_data bcm2711_
+ 	},
+ };
+ 
+-static const struct vc4_pv_data bcm2711_pv4_data = {
++const struct vc4_pv_data bcm2711_pv4_data = {
+ 	.base = {
+ 		.name = "pixelvalve-4",
+ 		.debugfs_name = "crtc4_regs",
+--- a/drivers/gpu/drm/vc4/vc4_drv.c
++++ b/drivers/gpu/drm/vc4/vc4_drv.c
+@@ -196,7 +196,7 @@ static const struct drm_ioctl_desc vc4_d
+ 	DRM_IOCTL_DEF_DRV(VC4_PERFMON_GET_VALUES, vc4_perfmon_get_values_ioctl, DRM_RENDER_ALLOW),
+ };
+ 
+-static const struct drm_driver vc4_drm_driver = {
++const struct drm_driver vc4_drm_driver = {
+ 	.driver_features = (DRIVER_MODESET |
+ 			    DRIVER_ATOMIC |
+ 			    DRIVER_GEM |
+@@ -225,7 +225,7 @@ static const struct drm_driver vc4_drm_d
+ 	.patchlevel = DRIVER_PATCHLEVEL,
+ };
+ 
+-static const struct drm_driver vc5_drm_driver = {
++const struct drm_driver vc5_drm_driver = {
+ 	.driver_features = (DRIVER_MODESET |
+ 			    DRIVER_ATOMIC |
+ 			    DRIVER_GEM),
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -25,6 +25,9 @@
+ struct drm_device;
+ struct drm_gem_object;
+ 
++extern const struct drm_driver vc4_drm_driver;
++extern const struct drm_driver vc5_drm_driver;
++
+ /* Don't forget to update vc4_bo.c: bo_type_names[] when adding to
+  * this.
+  */
+@@ -528,6 +531,8 @@ struct vc4_crtc_data {
+ 	int hvs_output;
+ };
+ 
++extern const struct vc4_crtc_data vc4_txp_crtc_data;
++
+ struct vc4_pv_data {
+ 	struct vc4_crtc_data	base;
+ 
+@@ -540,6 +545,15 @@ struct vc4_pv_data {
+ 	enum vc4_encoder_type encoder_types[4];
+ };
+ 
++extern const struct vc4_pv_data bcm2835_pv0_data;
++extern const struct vc4_pv_data bcm2835_pv1_data;
++extern const struct vc4_pv_data bcm2835_pv2_data;
++extern const struct vc4_pv_data bcm2711_pv0_data;
++extern const struct vc4_pv_data bcm2711_pv1_data;
++extern const struct vc4_pv_data bcm2711_pv2_data;
++extern const struct vc4_pv_data bcm2711_pv3_data;
++extern const struct vc4_pv_data bcm2711_pv4_data;
++
+ struct vc5_gamma_entry {
+ 	u32 x_c_terms;
+ 	u32 grad_term;
+@@ -944,6 +958,8 @@ int vc4_page_flip(struct drm_crtc *crtc,
+ 		  struct drm_pending_vblank_event *event,
+ 		  uint32_t flags,
+ 		  struct drm_modeset_acquire_ctx *ctx);
++int vc4_crtc_atomic_check(struct drm_crtc *crtc,
++			  struct drm_atomic_state *state);
+ struct drm_crtc_state *vc4_crtc_duplicate_state(struct drm_crtc *crtc);
+ void vc4_crtc_destroy_state(struct drm_crtc *crtc,
+ 			    struct drm_crtc_state *state);
+--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+@@ -1161,8 +1161,8 @@ vc4_crtc_mode_valid(struct drm_crtc *crt
+ 	return MODE_OK;
+ }
+ 
+-static int vc4_crtc_atomic_check(struct drm_crtc *crtc,
+-				 struct drm_atomic_state *state)
++static int vc4_fkms_crtc_atomic_check(struct drm_crtc *crtc,
++				      struct drm_atomic_state *state)
+ {
+ 	struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state,
+ 									  crtc);
+@@ -1341,7 +1341,7 @@ static const struct drm_crtc_funcs vc4_c
+ static const struct drm_crtc_helper_funcs vc4_crtc_helper_funcs = {
+ 	.mode_set_nofb = vc4_crtc_mode_set_nofb,
+ 	.mode_valid = vc4_crtc_mode_valid,
+-	.atomic_check = vc4_crtc_atomic_check,
++	.atomic_check = vc4_fkms_crtc_atomic_check,
+ 	.atomic_flush = vc4_crtc_atomic_flush,
+ 	.atomic_enable = vc4_crtc_enable,
+ 	.atomic_disable = vc4_crtc_disable,
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -479,7 +479,7 @@ static irqreturn_t vc4_txp_interrupt(int
+ 	return IRQ_HANDLED;
+ }
+ 
+-static const struct vc4_crtc_data vc4_txp_crtc_data = {
++const struct vc4_crtc_data vc4_txp_crtc_data = {
+ 	.name = "txp",
+ 	.debugfs_name = "txp_regs",
+ 	.hvs_available_channels = BIT(2),
diff --git a/target/linux/bcm27xx/patches-6.1/950-0503-drm-vc4-tests-Fail-the-current-test-if-we-access-a-r.patch b/target/linux/bcm27xx/patches-6.1/950-0503-drm-vc4-tests-Fail-the-current-test-if-we-access-a-r.patch
new file mode 100644
index 00000000000000..3edc1814d1edaf
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0503-drm-vc4-tests-Fail-the-current-test-if-we-access-a-r.patch
@@ -0,0 +1,201 @@
+From 01e67fe435419efedf2431d582fdd17340041453 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 21 Nov 2022 17:04:31 +0100
+Subject: [PATCH] drm/vc4: tests: Fail the current test if we access a
+ register
+
+Accessing a register when running under kunit is a bad idea since our
+device is completely mocked.
+
+Fail the current test if we ever access any of our hardware registers.
+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c      | 13 +++++++++++--
+ drivers/gpu/drm/vc4/vc4_dpi.c       | 13 +++++++++++--
+ drivers/gpu/drm/vc4/vc4_drv.h       | 29 +++++++++++++++++++++++++----
+ drivers/gpu/drm/vc4/vc4_dsi.c       |  9 ++++++++-
+ drivers/gpu/drm/vc4/vc4_hdmi_regs.h |  4 ++++
+ drivers/gpu/drm/vc4/vc4_txp.c       | 13 +++++++++++--
+ drivers/gpu/drm/vc4/vc4_vec.c       | 13 +++++++++++--
+ 7 files changed, 81 insertions(+), 13 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -50,8 +50,17 @@
+ 
+ #define HVS_FIFO_LATENCY_PIX	6
+ 
+-#define CRTC_WRITE(offset, val) writel(val, vc4_crtc->regs + (offset))
+-#define CRTC_READ(offset) readl(vc4_crtc->regs + (offset))
++#define CRTC_WRITE(offset, val)								\
++	do {										\
++		kunit_fail_current_test("Accessing a register in a unit test!\n");	\
++		writel(val, vc4_crtc->regs + (offset));					\
++	} while (0)
++
++#define CRTC_READ(offset)								\
++	({										\
++		kunit_fail_current_test("Accessing a register in a unit test!\n");	\
++		readl(vc4_crtc->regs + (offset));					\
++	})
+ 
+ static const struct debugfs_reg32 crtc_regs[] = {
+ 	VC4_REG32(PV_CONTROL),
+--- a/drivers/gpu/drm/vc4/vc4_dpi.c
++++ b/drivers/gpu/drm/vc4/vc4_dpi.c
+@@ -103,8 +103,17 @@ to_vc4_dpi(struct drm_encoder *encoder)
+ 	return container_of(encoder, struct vc4_dpi, encoder.base);
+ }
+ 
+-#define DPI_READ(offset) readl(dpi->regs + (offset))
+-#define DPI_WRITE(offset, val) writel(val, dpi->regs + (offset))
++#define DPI_READ(offset)								\
++	({										\
++		kunit_fail_current_test("Accessing a register in a unit test!\n");	\
++		readl(dpi->regs + (offset));						\
++	})
++
++#define DPI_WRITE(offset, val)								\
++	do {										\
++		kunit_fail_current_test("Accessing a register in a unit test!\n");	\
++		writel(val, dpi->regs + (offset));					\
++	} while (0)
+ 
+ static const struct debugfs_reg32 dpi_regs[] = {
+ 	VC4_REG32(DPI_C),
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -19,6 +19,8 @@
+ #include <drm/drm_mm.h>
+ #include <drm/drm_modeset_lock.h>
+ 
++#include <kunit/test-bug.h>
++
+ #include "uapi/drm/vc4_drm.h"
+ #include "vc4_regs.h"
+ 
+@@ -669,10 +671,29 @@ to_vc4_crtc_state(const struct drm_crtc_
+ 	return container_of(crtc_state, struct vc4_crtc_state, base);
+ }
+ 
+-#define V3D_READ(offset) readl(vc4->v3d->regs + offset)
+-#define V3D_WRITE(offset, val) writel(val, vc4->v3d->regs + offset)
+-#define HVS_READ(offset) readl(hvs->regs + offset)
+-#define HVS_WRITE(offset, val) writel(val, hvs->regs + offset)
++#define V3D_READ(offset)								\
++	({										\
++		kunit_fail_current_test("Accessing a register in a unit test!\n");	\
++		readl(vc4->v3d->regs + (offset));						\
++	})
++
++#define V3D_WRITE(offset, val)								\
++	do {										\
++		kunit_fail_current_test("Accessing a register in a unit test!\n");	\
++		writel(val, vc4->v3d->regs + (offset));					\
++	} while (0)
++
++#define HVS_READ(offset)								\
++	({										\
++		kunit_fail_current_test("Accessing a register in a unit test!\n");	\
++		readl(hvs->regs + (offset));						\
++	})
++
++#define HVS_WRITE(offset, val)								\
++	do {										\
++		kunit_fail_current_test("Accessing a register in a unit test!\n");	\
++		writel(val, hvs->regs + (offset));					\
++	} while (0)
+ 
+ #define VC4_REG32(reg) { .name = #reg, .offset = reg }
+ 
+--- a/drivers/gpu/drm/vc4/vc4_dsi.c
++++ b/drivers/gpu/drm/vc4/vc4_dsi.c
+@@ -623,6 +623,8 @@ dsi_dma_workaround_write(struct vc4_dsi
+ 	dma_cookie_t cookie;
+ 	int ret;
+ 
++	kunit_fail_current_test("Accessing a register in a unit test!\n");
++
+ 	/* DSI0 should be able to write normally. */
+ 	if (!chan) {
+ 		writel(val, dsi->regs + offset);
+@@ -651,7 +653,12 @@ dsi_dma_workaround_write(struct vc4_dsi
+ 		DRM_ERROR("Failed to wait for DMA: %d\n", ret);
+ }
+ 
+-#define DSI_READ(offset) readl(dsi->regs + (offset))
++#define DSI_READ(offset)								\
++	({										\
++		kunit_fail_current_test("Accessing a register in a unit test!\n");	\
++		readl(dsi->regs + (offset));						\
++	})
++
+ #define DSI_WRITE(offset, val) dsi_dma_workaround_write(dsi, offset, val)
+ #define DSI_PORT_READ(offset) \
+ 	DSI_READ(dsi->variant->port ? DSI1_##offset : DSI0_##offset)
+--- a/drivers/gpu/drm/vc4/vc4_hdmi_regs.h
++++ b/drivers/gpu/drm/vc4/vc4_hdmi_regs.h
+@@ -456,6 +456,8 @@ static inline u32 vc4_hdmi_read(struct v
+ 
+ 	WARN_ON(pm_runtime_status_suspended(&hdmi->pdev->dev));
+ 
++	kunit_fail_current_test("Accessing an HDMI register in a unit test!\n");
++
+ 	if (reg >= variant->num_registers) {
+ 		dev_warn(&hdmi->pdev->dev,
+ 			 "Invalid register ID %u\n", reg);
+@@ -486,6 +488,8 @@ static inline void vc4_hdmi_write(struct
+ 
+ 	WARN_ON(pm_runtime_status_suspended(&hdmi->pdev->dev));
+ 
++	kunit_fail_current_test("Accessing an HDMI register in a unit test!\n");
++
+ 	if (reg >= variant->num_registers) {
+ 		dev_warn(&hdmi->pdev->dev,
+ 			 "Invalid register ID %u\n", reg);
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -145,8 +145,17 @@
+ /* Number of lines received and committed to memory. */
+ #define TXP_PROGRESS		0x10
+ 
+-#define TXP_READ(offset) readl(txp->regs + (offset))
+-#define TXP_WRITE(offset, val) writel(val, txp->regs + (offset))
++#define TXP_READ(offset)								\
++	({										\
++		kunit_fail_current_test("Accessing a register in a unit test!\n");	\
++		readl(txp->regs + (offset));						\
++	})
++
++#define TXP_WRITE(offset, val)								\
++	do {										\
++		kunit_fail_current_test("Accessing a register in a unit test!\n");	\
++		writel(val, txp->regs + (offset));					\
++	} while (0)
+ 
+ struct vc4_txp {
+ 	struct vc4_crtc	base;
+--- a/drivers/gpu/drm/vc4/vc4_vec.c
++++ b/drivers/gpu/drm/vc4/vc4_vec.c
+@@ -207,8 +207,17 @@ struct vc4_vec {
+ 	struct debugfs_regset32 regset;
+ };
+ 
+-#define VEC_READ(offset) readl(vec->regs + (offset))
+-#define VEC_WRITE(offset, val) writel(val, vec->regs + (offset))
++#define VEC_READ(offset)								\
++	({										\
++		kunit_fail_current_test("Accessing a register in a unit test!\n");	\
++		readl(vec->regs + (offset));						\
++	})
++
++#define VEC_WRITE(offset, val)								\
++	do {										\
++		kunit_fail_current_test("Accessing a register in a unit test!\n");	\
++		writel(val, vec->regs + (offset));					\
++	} while (0)
+ 
+ static inline struct vc4_vec *
+ encoder_to_vc4_vec(struct drm_encoder *encoder)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0504-drm-vc4-tests-Add-unit-test-suite-for-the-PV-muxing.patch b/target/linux/bcm27xx/patches-6.1/950-0504-drm-vc4-tests-Add-unit-test-suite-for-the-PV-muxing.patch
new file mode 100644
index 00000000000000..5ab57ce3a16c53
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0504-drm-vc4-tests-Add-unit-test-suite-for-the-PV-muxing.patch
@@ -0,0 +1,1159 @@
+From 27aebda6c6498ff8f948b9cc8facef30f522af33 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 14 Nov 2022 16:06:22 +0100
+Subject: [PATCH] drm/vc4: tests: Add unit test suite for the PV muxing
+
+The HVS to PixelValve muxing code is fairly error prone and has a bunch
+of arbitrary constraints due to the hardware setup.
+
+Let's create a test suite that makes sure that the possible combinations
+work and the invalid ones don't.
+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/Makefile                  |    3 +-
+ drivers/gpu/drm/vc4/tests/vc4_mock.h          |    9 +-
+ drivers/gpu/drm/vc4/tests/vc4_mock_output.c   |   49 +-
+ .../gpu/drm/vc4/tests/vc4_test_pv_muxing.c    | 1039 +++++++++++++++++
+ 4 files changed, 1091 insertions(+), 9 deletions(-)
+ create mode 100644 drivers/gpu/drm/vc4/tests/vc4_test_pv_muxing.c
+
+--- a/drivers/gpu/drm/vc4/Makefile
++++ b/drivers/gpu/drm/vc4/Makefile
+@@ -30,7 +30,8 @@ vc4-$(CONFIG_DRM_VC4_KUNIT_TEST) += \
+ 	tests/vc4_mock.o \
+ 	tests/vc4_mock_crtc.o \
+ 	tests/vc4_mock_output.o \
+-	tests/vc4_mock_plane.o
++	tests/vc4_mock_plane.o \
++	tests/vc4_test_pv_muxing.o
+ 
+ vc4-$(CONFIG_DEBUG_FS) += vc4_debugfs.o
+ 
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock.h
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock.h
+@@ -53,8 +53,11 @@ struct vc4_dummy_output *vc4_dummy_outpu
+ struct vc4_dev *vc4_mock_device(struct kunit *test);
+ struct vc4_dev *vc5_mock_device(struct kunit *test);
+ 
+-int vc4_mock_atomic_add_output(struct kunit *test, struct drm_device *drm,
+-			       enum vc4_encoder_type type,
+-			       struct drm_atomic_state *state);
++int vc4_mock_atomic_add_output(struct kunit *test,
++			       struct drm_atomic_state *state,
++			       enum vc4_encoder_type type);
++int vc4_mock_atomic_del_output(struct kunit *test,
++			       struct drm_atomic_state *state,
++			       enum vc4_encoder_type type);
+ 
+ #endif // VC4_MOCK_H_
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock_output.c
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock_output.c
+@@ -61,16 +61,17 @@ static const struct drm_display_mode def
+ 	DRM_SIMPLE_MODE(640, 480, 64, 48)
+ };
+ 
+-int vc4_mock_atomic_add_output(struct kunit *test, struct drm_device *drm,
+-			       enum vc4_encoder_type type,
+-			       struct drm_atomic_state *state)
++int vc4_mock_atomic_add_output(struct kunit *test,
++			       struct drm_atomic_state *state,
++			       enum vc4_encoder_type type)
+ {
++	struct drm_device *drm = state->dev;
++	struct drm_connector_state *conn_state;
++	struct drm_crtc_state *crtc_state;
+ 	struct vc4_dummy_output *output;
+ 	struct drm_connector *conn;
+-	struct drm_connector_state *conn_state;
+ 	struct drm_encoder *encoder;
+ 	struct drm_crtc *crtc;
+-	struct drm_crtc_state *crtc_state;
+ 	int ret;
+ 
+ 	encoder = vc4_find_encoder_by_type(drm, type);
+@@ -97,3 +98,41 @@ int vc4_mock_atomic_add_output(struct ku
+ 
+ 	return 0;
+ }
++
++int vc4_mock_atomic_del_output(struct kunit *test,
++			       struct drm_atomic_state *state,
++			       enum vc4_encoder_type type)
++{
++	struct drm_device *drm = state->dev;
++	struct drm_connector_state *conn_state;
++	struct drm_crtc_state *crtc_state;
++	struct vc4_dummy_output *output;
++	struct drm_connector *conn;
++	struct drm_encoder *encoder;
++	struct drm_crtc *crtc;
++	int ret;
++
++	encoder = vc4_find_encoder_by_type(drm, type);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, encoder);
++
++	crtc = vc4_find_crtc_for_encoder(test, drm, encoder);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, crtc);
++
++	crtc_state = drm_atomic_get_crtc_state(state, crtc);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, crtc_state);
++
++	crtc_state->active = false;
++
++	ret = drm_atomic_set_mode_for_crtc(crtc_state, NULL);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	output = container_of(encoder, struct vc4_dummy_output, encoder.base);
++	conn = &output->connector;
++	conn_state = drm_atomic_get_connector_state(state, conn);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, conn_state);
++
++	ret = drm_atomic_set_crtc_for_connector(conn_state, NULL);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	return 0;
++}
+--- /dev/null
++++ b/drivers/gpu/drm/vc4/tests/vc4_test_pv_muxing.c
+@@ -0,0 +1,1039 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <drm/drm_atomic.h>
++#include <drm/drm_atomic_helper.h>
++#include <drm/drm_atomic_state_helper.h>
++#include <drm/drm_atomic_uapi.h>
++#include <drm/drm_crtc.h>
++#include <drm/drm_drv.h>
++#include <drm/drm_fourcc.h>
++#include <drm/drm_kunit_helpers.h>
++#include <drm/drm_mode.h>
++#include <drm/drm_modeset_helper_vtables.h>
++#include <drm/drm_plane.h>
++
++#include <kunit/test.h>
++
++#include "../vc4_drv.h"
++
++#include "vc4_mock.h"
++
++struct pv_muxing_priv {
++	struct vc4_dev *vc4;
++	struct drm_modeset_acquire_ctx ctx;
++	struct drm_atomic_state *state;
++};
++
++static bool check_fifo_conflict(struct kunit *test,
++				const struct drm_atomic_state *state)
++{
++	struct vc4_hvs_state *hvs_state;
++	unsigned int used_fifos = 0;
++	unsigned int i;
++
++	hvs_state = vc4_hvs_get_new_global_state(state);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, hvs_state);
++
++	for (i = 0; i < HVS_NUM_CHANNELS; i++) {
++		if (!hvs_state->fifo_state[i].in_use)
++			continue;
++
++		KUNIT_EXPECT_FALSE(test, used_fifos & BIT(i));
++		used_fifos |= BIT(i);
++	}
++
++	return true;
++}
++
++struct encoder_constraint {
++	enum vc4_encoder_type type;
++	unsigned int *channels;
++	size_t nchannels;
++};
++
++#define ENCODER_CONSTRAINT(_type, ...)					\
++	{								\
++		.type = _type,						\
++		.channels = (unsigned int[]) { __VA_ARGS__ },		\
++		.nchannels = sizeof((unsigned int[]) { __VA_ARGS__ }) /	\
++			     sizeof(unsigned int),			\
++	}
++
++static bool __check_encoder_constraints(const struct encoder_constraint *constraints,
++					size_t nconstraints,
++					enum vc4_encoder_type type,
++					unsigned int channel)
++{
++	unsigned int i;
++
++	for (i = 0; i < nconstraints; i++) {
++		const struct encoder_constraint *constraint = &constraints[i];
++		unsigned int j;
++
++		if (constraint->type != type)
++			continue;
++
++		for (j = 0; j < constraint->nchannels; j++) {
++			unsigned int _channel = constraint->channels[j];
++
++			if (channel != _channel)
++				continue;
++
++			return true;
++		}
++	}
++
++	return false;
++}
++
++static const struct encoder_constraint vc4_encoder_constraints[] = {
++	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_DPI, 0),
++	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_DSI0, 0),
++	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_HDMI0, 1),
++	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_VEC, 1),
++	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_TXP, 2),
++	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_DSI1, 2),
++};
++
++static const struct encoder_constraint vc5_encoder_constraints[] = {
++	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_DPI, 0),
++	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_DSI0, 0),
++	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_VEC, 1),
++	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_TXP, 0, 2),
++	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_DSI1, 0, 1, 2),
++	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_HDMI0, 0, 1, 2),
++	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_HDMI1, 0, 1, 2),
++};
++
++static bool check_vc4_encoder_constraints(enum vc4_encoder_type type, unsigned int channel)
++{
++	return __check_encoder_constraints(vc4_encoder_constraints,
++					   ARRAY_SIZE(vc4_encoder_constraints),
++					   type, channel);
++}
++
++static bool check_vc5_encoder_constraints(enum vc4_encoder_type type, unsigned int channel)
++{
++	return __check_encoder_constraints(vc5_encoder_constraints,
++					   ARRAY_SIZE(vc5_encoder_constraints),
++					   type, channel);
++}
++
++static struct vc4_crtc_state *
++get_vc4_crtc_state_for_encoder(struct kunit *test,
++			       const struct drm_atomic_state *state,
++			       enum vc4_encoder_type type)
++{
++	struct drm_device *drm = state->dev;
++	struct drm_crtc_state *new_crtc_state;
++	struct drm_encoder *encoder;
++	struct drm_crtc *crtc;
++
++	encoder = vc4_find_encoder_by_type(drm, type);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, encoder);
++
++	crtc = vc4_find_crtc_for_encoder(test, drm, encoder);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, crtc);
++
++	new_crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
++	if (!new_crtc_state)
++		return NULL;
++
++	return to_vc4_crtc_state(new_crtc_state);
++}
++
++static bool check_channel_for_encoder(struct kunit *test,
++				      const struct drm_atomic_state *state,
++				      enum vc4_encoder_type type,
++				      bool (*check_fn)(enum vc4_encoder_type type, unsigned int channel))
++{
++	struct vc4_crtc_state *new_vc4_crtc_state;
++	struct vc4_hvs_state *new_hvs_state;
++	unsigned int channel;
++
++	new_hvs_state = vc4_hvs_get_new_global_state(state);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, new_hvs_state);
++
++	new_vc4_crtc_state = get_vc4_crtc_state_for_encoder(test, state, type);
++	KUNIT_ASSERT_NOT_NULL(test, new_vc4_crtc_state);
++
++	channel = new_vc4_crtc_state->assigned_channel;
++	KUNIT_EXPECT_NE(test, channel, VC4_HVS_CHANNEL_DISABLED);
++
++	KUNIT_EXPECT_TRUE(test, new_hvs_state->fifo_state[channel].in_use);
++
++	KUNIT_EXPECT_TRUE(test, check_fn(type, channel));
++
++	return true;
++}
++
++struct pv_muxing_param {
++	const char *name;
++	struct vc4_dev *(*mock_fn)(struct kunit *test);
++	bool (*check_fn)(enum vc4_encoder_type type, unsigned int channel);
++	enum vc4_encoder_type *encoders;
++	size_t nencoders;
++};
++
++static void vc4_test_pv_muxing_desc(const struct pv_muxing_param *t, char *desc)
++{
++	strscpy(desc, t->name, KUNIT_PARAM_DESC_SIZE);
++}
++
++#define PV_MUXING_TEST(_name, _mock_fn, _check_fn, ...)					\
++	{										\
++		.name = _name,								\
++		.mock_fn = &_mock_fn,							\
++		.check_fn = &_check_fn,							\
++		.encoders = (enum vc4_encoder_type[]) { __VA_ARGS__ },			\
++		.nencoders = sizeof((enum vc4_encoder_type[]) { __VA_ARGS__ }) /	\
++			     sizeof(enum vc4_encoder_type),				\
++	}
++
++#define VC4_PV_MUXING_TEST(_name, ...)		\
++	PV_MUXING_TEST(_name, vc4_mock_device, check_vc4_encoder_constraints, __VA_ARGS__)
++
++#define VC5_PV_MUXING_TEST(_name, ...)		\
++	PV_MUXING_TEST(_name, vc5_mock_device, check_vc5_encoder_constraints, __VA_ARGS__)
++
++static const struct pv_muxing_param vc4_test_pv_muxing_params[] = {
++	VC4_PV_MUXING_TEST("1 output: DSI0",
++			   VC4_ENCODER_TYPE_DSI0),
++	VC4_PV_MUXING_TEST("1 output: DPI",
++			   VC4_ENCODER_TYPE_DPI),
++	VC4_PV_MUXING_TEST("1 output: HDMI0",
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC4_PV_MUXING_TEST("1 output: VEC",
++			   VC4_ENCODER_TYPE_VEC),
++	VC4_PV_MUXING_TEST("1 output: DSI1",
++			   VC4_ENCODER_TYPE_DSI1),
++	VC4_PV_MUXING_TEST("1 output: TXP",
++			   VC4_ENCODER_TYPE_TXP),
++	VC4_PV_MUXING_TEST("2 outputs: DSI0, HDMI0",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC4_PV_MUXING_TEST("2 outputs: DSI0, VEC",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_VEC),
++	VC4_PV_MUXING_TEST("2 outputs: DSI0, DSI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_DSI1),
++	VC4_PV_MUXING_TEST("2 outputs: DSI0, TXP",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_TXP),
++	VC4_PV_MUXING_TEST("2 outputs: DPI, HDMI0",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC4_PV_MUXING_TEST("2 outputs: DPI, VEC",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_VEC),
++	VC4_PV_MUXING_TEST("2 outputs: DPI, DSI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_DSI1),
++	VC4_PV_MUXING_TEST("2 outputs: DPI, TXP",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_TXP),
++	VC4_PV_MUXING_TEST("2 outputs: HDMI0, DSI1",
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_DSI1),
++	VC4_PV_MUXING_TEST("2 outputs: HDMI0, TXP",
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_TXP),
++	VC4_PV_MUXING_TEST("2 outputs: VEC, DSI1",
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_DSI1),
++	VC4_PV_MUXING_TEST("2 outputs: VEC, TXP",
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_TXP),
++	VC4_PV_MUXING_TEST("3 outputs: DSI0, HDMI0, DSI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_DSI1),
++	VC4_PV_MUXING_TEST("3 outputs: DSI0, HDMI0, TXP",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_TXP),
++	VC4_PV_MUXING_TEST("3 outputs: DSI0, VEC, DSI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_DSI1),
++	VC4_PV_MUXING_TEST("3 outputs: DSI0, VEC, TXP",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_TXP),
++	VC4_PV_MUXING_TEST("3 outputs: DPI, HDMI0, DSI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_DSI1),
++	VC4_PV_MUXING_TEST("3 outputs: DPI, HDMI0, TXP",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_TXP),
++	VC4_PV_MUXING_TEST("3 outputs: DPI, VEC, DSI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_DSI1),
++	VC4_PV_MUXING_TEST("3 outputs: DPI, VEC, TXP",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_TXP),
++};
++
++KUNIT_ARRAY_PARAM(vc4_test_pv_muxing,
++		  vc4_test_pv_muxing_params,
++		  vc4_test_pv_muxing_desc);
++
++static const struct pv_muxing_param vc4_test_pv_muxing_invalid_params[] = {
++	VC4_PV_MUXING_TEST("DPI/DSI0 Conflict",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_DSI0),
++	VC4_PV_MUXING_TEST("TXP/DSI1 Conflict",
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_DSI1),
++	VC4_PV_MUXING_TEST("HDMI0/VEC Conflict",
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_VEC),
++	VC4_PV_MUXING_TEST("More than 3 outputs: DSI0, HDMI0, DSI1, TXP",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_TXP),
++	VC4_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, DSI1, TXP",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_TXP),
++	VC4_PV_MUXING_TEST("More than 3 outputs: DPI, HDMI0, DSI1, TXP",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_TXP),
++	VC4_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, DSI1, TXP",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_TXP),
++};
++
++KUNIT_ARRAY_PARAM(vc4_test_pv_muxing_invalid,
++		  vc4_test_pv_muxing_invalid_params,
++		  vc4_test_pv_muxing_desc);
++
++static const struct pv_muxing_param vc5_test_pv_muxing_params[] = {
++	VC5_PV_MUXING_TEST("1 output: DPI",
++			   VC4_ENCODER_TYPE_DPI),
++	VC5_PV_MUXING_TEST("1 output: DSI0",
++			   VC4_ENCODER_TYPE_DSI0),
++	VC5_PV_MUXING_TEST("1 output: DSI1",
++			   VC4_ENCODER_TYPE_DSI1),
++	VC5_PV_MUXING_TEST("1 output: HDMI0",
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC5_PV_MUXING_TEST("1 output: HDMI1",
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("1 output: VEC",
++			   VC4_ENCODER_TYPE_VEC),
++	VC5_PV_MUXING_TEST("2 outputs: DPI, DSI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_DSI1),
++	VC5_PV_MUXING_TEST("2 outputs: DPI, HDMI0",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC5_PV_MUXING_TEST("2 outputs: DPI, HDMI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("2 outputs: DPI, TXP",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_TXP),
++	VC5_PV_MUXING_TEST("2 outputs: DPI, VEC",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_VEC),
++	VC5_PV_MUXING_TEST("2 outputs: DPI, DSI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_DSI1),
++	VC5_PV_MUXING_TEST("2 outputs: DSI0, DSI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_DSI1),
++	VC5_PV_MUXING_TEST("2 outputs: DSI0, HDMI0",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC5_PV_MUXING_TEST("2 outputs: DSI0, HDMI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("2 outputs: DSI0, TXP",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_TXP),
++	VC5_PV_MUXING_TEST("2 outputs: DSI0, VEC",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_VEC),
++	VC5_PV_MUXING_TEST("2 outputs: DSI0, DSI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_DSI1),
++	VC5_PV_MUXING_TEST("2 outputs: DSI1, VEC",
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_VEC),
++	VC5_PV_MUXING_TEST("2 outputs: DSI1, TXP",
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_TXP),
++	VC5_PV_MUXING_TEST("2 outputs: DSI1, HDMI0",
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC5_PV_MUXING_TEST("2 outputs: DSI1, HDMI1",
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("2 outputs: HDMI0, VEC",
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_VEC),
++	VC5_PV_MUXING_TEST("2 outputs: HDMI0, TXP",
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_TXP),
++	VC5_PV_MUXING_TEST("2 outputs: HDMI0, HDMI1",
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("2 outputs: HDMI1, VEC",
++			   VC4_ENCODER_TYPE_HDMI1,
++			   VC4_ENCODER_TYPE_VEC),
++	VC5_PV_MUXING_TEST("2 outputs: HDMI1, TXP",
++			   VC4_ENCODER_TYPE_HDMI1,
++			   VC4_ENCODER_TYPE_TXP),
++	VC5_PV_MUXING_TEST("2 outputs: TXP, VEC",
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_VEC),
++	VC5_PV_MUXING_TEST("3 outputs: DPI, VEC, TXP",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_TXP),
++	VC5_PV_MUXING_TEST("3 outputs: DPI, VEC, DSI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_DSI1),
++	VC5_PV_MUXING_TEST("3 outputs: DPI, VEC, HDMI0",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC5_PV_MUXING_TEST("3 outputs: DPI, VEC, HDMI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("3 outputs: DPI, TXP, DSI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_DSI1),
++	VC5_PV_MUXING_TEST("3 outputs: DPI, TXP, HDMI0",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC5_PV_MUXING_TEST("3 outputs: DPI, TXP, HDMI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("3 outputs: DPI, DSI1, HDMI0",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC5_PV_MUXING_TEST("3 outputs: DPI, DSI1, HDMI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("3 outputs: DPI, HDMI0, HDMI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("3 outputs: DSI0, VEC, TXP",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_TXP),
++	VC5_PV_MUXING_TEST("3 outputs: DSI0, VEC, DSI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_DSI1),
++	VC5_PV_MUXING_TEST("3 outputs: DSI0, VEC, HDMI0",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC5_PV_MUXING_TEST("3 outputs: DSI0, VEC, HDMI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("3 outputs: DSI0, TXP, DSI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_DSI1),
++	VC5_PV_MUXING_TEST("3 outputs: DSI0, TXP, HDMI0",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC5_PV_MUXING_TEST("3 outputs: DSI0, TXP, HDMI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("3 outputs: DSI0, DSI1, HDMI0",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC5_PV_MUXING_TEST("3 outputs: DSI0, DSI1, HDMI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("3 outputs: DSI0, HDMI0, HDMI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_HDMI1),
++};
++
++KUNIT_ARRAY_PARAM(vc5_test_pv_muxing,
++		  vc5_test_pv_muxing_params,
++		  vc4_test_pv_muxing_desc);
++
++static const struct pv_muxing_param vc5_test_pv_muxing_invalid_params[] = {
++	VC5_PV_MUXING_TEST("DPI/DSI0 Conflict",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_DSI0),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, TXP, DSI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_DSI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, TXP, HDMI0",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, TXP, HDMI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, DSI1, HDMI0",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, DSI1, HDMI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, HDMI0, HDMI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, TXP, DSI1, HDMI0",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, TXP, DSI1, HDMI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, TXP, HDMI0, HDMI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, DSI1, HDMI0, HDMI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, TXP, DSI1, HDMI0",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, TXP, DSI1, HDMI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, TXP, HDMI0, HDMI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, DSI1, HDMI0, HDMI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, TXP, DSI1, HDMI0, HDMI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, TXP, DSI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_DSI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, TXP, HDMI0",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, TXP, HDMI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, DSI1, HDMI0",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, DSI1, HDMI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, HDMI0, HDMI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, TXP, DSI1, HDMI0",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, TXP, DSI1, HDMI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, TXP, HDMI0, HDMI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, DSI1, HDMI0, HDMI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, TXP, DSI1, HDMI0",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, TXP, DSI1, HDMI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, TXP, HDMI0, HDMI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, DSI1, HDMI0, HDMI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, TXP, DSI1, HDMI0, HDMI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: VEC, TXP, DSI1, HDMI0, HDMI1",
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, TXP, DSI1, HDMI0, HDMI1",
++			   VC4_ENCODER_TYPE_DPI,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, TXP, DSI1, HDMI0, HDMI1",
++			   VC4_ENCODER_TYPE_DSI0,
++			   VC4_ENCODER_TYPE_VEC,
++			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_DSI1,
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_HDMI1),
++};
++
++KUNIT_ARRAY_PARAM(vc5_test_pv_muxing_invalid,
++		  vc5_test_pv_muxing_invalid_params,
++		  vc4_test_pv_muxing_desc);
++
++static void drm_vc4_test_pv_muxing(struct kunit *test)
++{
++	const struct pv_muxing_param *params = test->param_value;
++	const struct pv_muxing_priv *priv = test->priv;
++	struct drm_atomic_state *state = priv->state;
++	unsigned int i;
++	int ret;
++
++	for (i = 0; i < params->nencoders; i++) {
++		enum vc4_encoder_type enc_type = params->encoders[i];
++
++		ret = vc4_mock_atomic_add_output(test, state, enc_type);
++		KUNIT_ASSERT_EQ(test, ret, 0);
++	}
++
++	ret = drm_atomic_check_only(state);
++	KUNIT_EXPECT_EQ(test, ret, 0);
++
++	KUNIT_EXPECT_TRUE(test,
++			  check_fifo_conflict(test, state));
++
++	for (i = 0; i < params->nencoders; i++) {
++		enum vc4_encoder_type enc_type = params->encoders[i];
++
++		KUNIT_EXPECT_TRUE(test, check_channel_for_encoder(test, state, enc_type,
++								  params->check_fn));
++	}
++}
++
++static void drm_vc4_test_pv_muxing_invalid(struct kunit *test)
++{
++	const struct pv_muxing_param *params = test->param_value;
++	const struct pv_muxing_priv *priv = test->priv;
++	struct drm_atomic_state *state = priv->state;
++	unsigned int i;
++	int ret;
++
++	for (i = 0; i < params->nencoders; i++) {
++		enum vc4_encoder_type enc_type = params->encoders[i];
++
++		ret = vc4_mock_atomic_add_output(test, state, enc_type);
++		KUNIT_ASSERT_EQ(test, ret, 0);
++	}
++
++	ret = drm_atomic_check_only(state);
++	KUNIT_EXPECT_LT(test, ret, 0);
++}
++
++static int vc4_pv_muxing_test_init(struct kunit *test)
++{
++	const struct pv_muxing_param *params = test->param_value;
++	struct drm_atomic_state *state;
++	struct pv_muxing_priv *priv;
++	struct drm_device *drm;
++	struct vc4_dev *vc4;
++
++	priv = kunit_kzalloc(test, sizeof(*priv), GFP_KERNEL);
++	KUNIT_ASSERT_NOT_NULL(test, priv);
++	test->priv = priv;
++
++	vc4 = params->mock_fn(test);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, vc4);
++	priv->vc4 = vc4;
++
++	drm_modeset_acquire_init(&priv->ctx, 0);
++
++	drm = &vc4->base;
++	state = drm_atomic_state_alloc(drm);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, state);
++
++	state->acquire_ctx = &priv->ctx;
++
++	priv->state = state;
++
++	return 0;
++}
++
++static void vc4_pv_muxing_test_exit(struct kunit *test)
++{
++	struct pv_muxing_priv *priv = test->priv;
++	struct vc4_dev *vc4 = priv->vc4;
++	struct drm_device *drm = &vc4->base;
++	struct drm_atomic_state *state = priv->state;
++
++	drm_atomic_state_put(state);
++	drm_modeset_drop_locks(&priv->ctx);
++	drm_modeset_acquire_fini(&priv->ctx);
++	drm_dev_unregister(drm);
++	drm_kunit_helper_free_device(test, vc4->dev);
++}
++
++static struct kunit_case vc4_pv_muxing_tests[] = {
++	KUNIT_CASE_PARAM(drm_vc4_test_pv_muxing,
++			 vc4_test_pv_muxing_gen_params),
++	KUNIT_CASE_PARAM(drm_vc4_test_pv_muxing_invalid,
++			 vc4_test_pv_muxing_invalid_gen_params),
++	{}
++};
++
++static struct kunit_suite vc4_pv_muxing_test_suite = {
++	.name = "vc4-pv-muxing-combinations",
++	.init = vc4_pv_muxing_test_init,
++	.exit = vc4_pv_muxing_test_exit,
++	.test_cases = vc4_pv_muxing_tests,
++};
++
++static struct kunit_case vc5_pv_muxing_tests[] = {
++	KUNIT_CASE_PARAM(drm_vc4_test_pv_muxing,
++			 vc5_test_pv_muxing_gen_params),
++	KUNIT_CASE_PARAM(drm_vc4_test_pv_muxing_invalid,
++			 vc5_test_pv_muxing_invalid_gen_params),
++	{}
++};
++
++static struct kunit_suite vc5_pv_muxing_test_suite = {
++	.name = "vc5-pv-muxing-combinations",
++	.init = vc4_pv_muxing_test_init,
++	.exit = vc4_pv_muxing_test_exit,
++	.test_cases = vc5_pv_muxing_tests,
++};
++
++/* See
++ * https://lore.kernel.org/all/3e113525-aa89-b1e2-56b7-ca55bd41d057@samsung.com/
++ * and
++ * https://lore.kernel.org/dri-devel/20200917121623.42023-1-maxime@cerno.tech/
++ */
++static void drm_test_vc5_pv_muxing_bugs_subsequent_crtc_enable(struct kunit *test)
++{
++	struct drm_modeset_acquire_ctx ctx;
++	struct drm_atomic_state *state;
++	struct vc4_crtc_state *new_vc4_crtc_state;
++	struct vc4_hvs_state *new_hvs_state;
++	unsigned int hdmi0_channel;
++	unsigned int hdmi1_channel;
++	struct drm_device *drm;
++	struct vc4_dev *vc4;
++	int ret;
++
++	vc4 = vc5_mock_device(test);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, vc4);
++
++	drm_modeset_acquire_init(&ctx, 0);
++
++	drm = &vc4->base;
++	state = drm_atomic_state_alloc(drm);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, state);
++
++	state->acquire_ctx = &ctx;
++
++	ret = vc4_mock_atomic_add_output(test, state, VC4_ENCODER_TYPE_HDMI0);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	ret = drm_atomic_check_only(state);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	new_hvs_state = vc4_hvs_get_new_global_state(state);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, new_hvs_state);
++
++	new_vc4_crtc_state = get_vc4_crtc_state_for_encoder(test, state,
++							    VC4_ENCODER_TYPE_HDMI0);
++	KUNIT_ASSERT_NOT_NULL(test, new_vc4_crtc_state);
++
++	hdmi0_channel = new_vc4_crtc_state->assigned_channel;
++	KUNIT_ASSERT_NE(test, hdmi0_channel, VC4_HVS_CHANNEL_DISABLED);
++	KUNIT_ASSERT_TRUE(test, new_hvs_state->fifo_state[hdmi0_channel].in_use);
++
++	ret = drm_atomic_helper_swap_state(state, false);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	drm_atomic_state_put(state);
++
++	state = drm_atomic_state_alloc(drm);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, state);
++
++	state->acquire_ctx = &ctx;
++
++	ret = vc4_mock_atomic_add_output(test, state, VC4_ENCODER_TYPE_HDMI1);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	ret = drm_atomic_check_only(state);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	new_hvs_state = vc4_hvs_get_new_global_state(state);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, new_hvs_state);
++
++	new_vc4_crtc_state = get_vc4_crtc_state_for_encoder(test, state,
++							    VC4_ENCODER_TYPE_HDMI1);
++	KUNIT_ASSERT_NOT_NULL(test, new_vc4_crtc_state);
++
++	hdmi1_channel = new_vc4_crtc_state->assigned_channel;
++	KUNIT_ASSERT_NE(test, hdmi1_channel, VC4_HVS_CHANNEL_DISABLED);
++	KUNIT_ASSERT_TRUE(test, new_hvs_state->fifo_state[hdmi1_channel].in_use);
++
++	KUNIT_EXPECT_NE(test, hdmi0_channel, hdmi1_channel);
++
++	drm_atomic_state_put(state);
++	drm_modeset_drop_locks(&ctx);
++	drm_modeset_acquire_fini(&ctx);
++	drm_dev_unregister(drm);
++	drm_kunit_helper_free_device(test, vc4->dev);
++}
++
++static void drm_test_vc5_pv_muxing_bugs_stable_fifo(struct kunit *test)
++{
++	struct drm_modeset_acquire_ctx ctx;
++	struct drm_atomic_state *state;
++	struct vc4_crtc_state *new_vc4_crtc_state;
++	struct vc4_hvs_state *new_hvs_state;
++	unsigned int old_hdmi0_channel;
++	unsigned int old_hdmi1_channel;
++	struct drm_device *drm;
++	struct vc4_dev *vc4;
++	int ret;
++
++	vc4 = vc5_mock_device(test);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, vc4);
++
++	drm_modeset_acquire_init(&ctx, 0);
++
++	drm = &vc4->base;
++	state = drm_atomic_state_alloc(drm);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, state);
++
++	state->acquire_ctx = &ctx;
++
++	ret = vc4_mock_atomic_add_output(test, state, VC4_ENCODER_TYPE_HDMI0);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	ret = vc4_mock_atomic_add_output(test, state, VC4_ENCODER_TYPE_HDMI1);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	ret = drm_atomic_check_only(state);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	new_hvs_state = vc4_hvs_get_new_global_state(state);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, new_hvs_state);
++
++	new_vc4_crtc_state = get_vc4_crtc_state_for_encoder(test, state,
++							    VC4_ENCODER_TYPE_HDMI0);
++	KUNIT_ASSERT_NOT_NULL(test, new_vc4_crtc_state);
++
++	old_hdmi0_channel = new_vc4_crtc_state->assigned_channel;
++	KUNIT_ASSERT_NE(test, old_hdmi0_channel, VC4_HVS_CHANNEL_DISABLED);
++	KUNIT_ASSERT_TRUE(test, new_hvs_state->fifo_state[old_hdmi0_channel].in_use);
++
++	new_vc4_crtc_state = get_vc4_crtc_state_for_encoder(test, state,
++							    VC4_ENCODER_TYPE_HDMI1);
++	KUNIT_ASSERT_NOT_NULL(test, new_vc4_crtc_state);
++
++	old_hdmi1_channel = new_vc4_crtc_state->assigned_channel;
++	KUNIT_ASSERT_NE(test, old_hdmi1_channel, VC4_HVS_CHANNEL_DISABLED);
++	KUNIT_ASSERT_TRUE(test, new_hvs_state->fifo_state[old_hdmi1_channel].in_use);
++
++	ret = drm_atomic_helper_swap_state(state, false);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	drm_atomic_state_put(state);
++
++	state = drm_atomic_state_alloc(drm);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, state);
++
++	state->acquire_ctx = &ctx;
++
++	ret = vc4_mock_atomic_del_output(test, state, VC4_ENCODER_TYPE_HDMI0);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	ret = drm_atomic_check_only(state);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	new_hvs_state = vc4_hvs_get_new_global_state(state);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, new_hvs_state);
++
++	new_vc4_crtc_state = get_vc4_crtc_state_for_encoder(test, state,
++							    VC4_ENCODER_TYPE_HDMI1);
++
++	if (new_vc4_crtc_state) {
++		unsigned int hdmi1_channel;
++
++		hdmi1_channel = new_vc4_crtc_state->assigned_channel;
++		KUNIT_ASSERT_NE(test, hdmi1_channel, VC4_HVS_CHANNEL_DISABLED);
++		KUNIT_ASSERT_TRUE(test, new_hvs_state->fifo_state[hdmi1_channel].in_use);
++
++		KUNIT_EXPECT_EQ(test, old_hdmi1_channel, hdmi1_channel);
++	}
++
++	drm_atomic_state_put(state);
++	drm_modeset_drop_locks(&ctx);
++	drm_modeset_acquire_fini(&ctx);
++	drm_dev_unregister(drm);
++	drm_kunit_helper_free_device(test, vc4->dev);
++}
++
++static void
++drm_test_vc5_pv_muxing_bugs_subsequent_crtc_enable_too_many_crtc_state(struct kunit *test)
++{
++	struct drm_modeset_acquire_ctx ctx;
++	struct drm_atomic_state *state;
++	struct vc4_crtc_state *new_vc4_crtc_state;
++	struct drm_device *drm;
++	struct vc4_dev *vc4;
++	int ret;
++
++	vc4 = vc5_mock_device(test);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, vc4);
++
++	drm_modeset_acquire_init(&ctx, 0);
++
++	drm = &vc4->base;
++	state = drm_atomic_state_alloc(drm);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, state);
++
++	state->acquire_ctx = &ctx;
++
++	ret = vc4_mock_atomic_add_output(test, state, VC4_ENCODER_TYPE_HDMI0);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	ret = drm_atomic_check_only(state);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	ret = drm_atomic_helper_swap_state(state, false);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	drm_atomic_state_put(state);
++
++	state = drm_atomic_state_alloc(drm);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, state);
++
++	state->acquire_ctx = &ctx;
++
++	ret = vc4_mock_atomic_add_output(test, state, VC4_ENCODER_TYPE_HDMI1);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	ret = drm_atomic_check_only(state);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	new_vc4_crtc_state = get_vc4_crtc_state_for_encoder(test, state,
++							    VC4_ENCODER_TYPE_HDMI0);
++	KUNIT_EXPECT_NULL(test, new_vc4_crtc_state);
++
++	drm_atomic_state_put(state);
++	drm_modeset_drop_locks(&ctx);
++	drm_modeset_acquire_fini(&ctx);
++	drm_dev_unregister(drm);
++	drm_kunit_helper_free_device(test, vc4->dev);
++}
++
++static struct kunit_case vc5_pv_muxing_bugs_tests[] = {
++	KUNIT_CASE(drm_test_vc5_pv_muxing_bugs_subsequent_crtc_enable),
++	KUNIT_CASE(drm_test_vc5_pv_muxing_bugs_subsequent_crtc_enable_too_many_crtc_state),
++	KUNIT_CASE(drm_test_vc5_pv_muxing_bugs_stable_fifo),
++	{}
++};
++
++static struct kunit_suite vc5_pv_muxing_bugs_test_suite = {
++	.name = "vc5-pv-muxing-bugs",
++	.test_cases = vc5_pv_muxing_bugs_tests,
++};
++
++kunit_test_suites(
++	&vc4_pv_muxing_test_suite,
++	&vc5_pv_muxing_test_suite,
++	&vc5_pv_muxing_bugs_test_suite
++);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0505-Documentation-gpu-vc4-Add-KUnit-Tests-Section.patch b/target/linux/bcm27xx/patches-6.1/950-0505-Documentation-gpu-vc4-Add-KUnit-Tests-Section.patch
new file mode 100644
index 00000000000000..633691570f0936
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0505-Documentation-gpu-vc4-Add-KUnit-Tests-Section.patch
@@ -0,0 +1,38 @@
+From 2765d84553542d356236a0e4f79ca320fba5aa73 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Thu, 1 Dec 2022 11:08:24 +0100
+Subject: [PATCH] Documentation: gpu: vc4: Add KUnit Tests Section
+
+Now that we have VC4-specific tests in place, let's document them
+properly.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ Documentation/gpu/vc4.rst | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/Documentation/gpu/vc4.rst
++++ b/Documentation/gpu/vc4.rst
+@@ -54,6 +54,22 @@ VEC (Composite TV out) encoder
+ .. kernel-doc:: drivers/gpu/drm/vc4/vc4_vec.c
+    :doc: VC4 SDTV module
+ 
++KUnit Tests
++===========
++
++The VC4 Driver uses KUnit to perform driver-specific unit and
++integration tests.
++
++These tests are using a mock driver and can be ran using the
++command::
++	./tools/testing/kunit/kunit.py run \
++		--kunitconfig=drivers/gpu/drm/vc4/tests/.kunitconfig \
++		--cross_compile aarch64-linux-gnu- --arch arm64
++
++Parts of the driver that are currently covered by tests are:
++ * The HVS to PixelValve dynamic FIFO assignment, for the BCM2835-7
++   and BCM2711.
++
+ Memory Management and 3D Command Submission
+ ===========================================
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0506-.github-Add-Github-Workflow-for-KUnit.patch b/target/linux/bcm27xx/patches-6.1/950-0506-.github-Add-Github-Workflow-for-KUnit.patch
new file mode 100644
index 00000000000000..bb3c3f160aa6a2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0506-.github-Add-Github-Workflow-for-KUnit.patch
@@ -0,0 +1,74 @@
+From d172f330087422b8f33ad5e0f60f903820e7b321 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Thu, 8 Dec 2022 13:17:42 +0100
+Subject: [PATCH] .github: Add Github Workflow for KUnit
+
+Now that we have some KUnit coverage, let's add a github actions file to
+run them on each push or pull request.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ .github/workflows/kunit.yml | 57 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 57 insertions(+)
+ create mode 100644 .github/workflows/kunit.yml
+
+--- /dev/null
++++ b/.github/workflows/kunit.yml
+@@ -0,0 +1,57 @@
++name: KUnit Tests
++
++on:
++  pull_request:
++    branches: [ "rpi-*"]
++
++  push:
++    branches: [ "rpi-*"]
++
++jobs:
++  core:
++    name: Generic DRM/KMS Unit Tests
++    runs-on: ubuntu-latest
++
++    steps:
++      - uses: actions/checkout@v3
++
++      - name: Run Generic DRM Tests
++        run: |
++          ./tools/testing/kunit/kunit.py run \
++              --kunitconfig=drivers/gpu/drm/tests
++
++  vc4-arm:
++    name: VC4 Unit Tests on ARM
++    runs-on: ubuntu-latest
++
++    steps:
++      - uses: actions/checkout@v3
++
++      - name: Install Dependencies
++        run: |
++          sudo apt-get update
++          sudo apt-get install -y gcc-arm-linux-gnueabihf qemu-system-arm
++
++      - name: Run VC4 Tests
++        run: |
++          ./tools/testing/kunit/kunit.py run \
++              --kunitconfig=drivers/gpu/drm/vc4/tests \
++              --cross_compile=arm-linux-gnueabihf- --arch=arm
++
++  vc4-arm64:
++    name: VC4 Unit Tests on ARM64
++    runs-on: ubuntu-latest
++
++    steps:
++      - uses: actions/checkout@v3
++
++      - name: Install Dependencies
++        run: |
++          sudo apt-get update
++          sudo apt-get install -y gcc-aarch64-linux-gnu qemu-system-arm
++
++      - name: Run VC4 Tests
++        run: |
++          ./tools/testing/kunit/kunit.py run \
++              --kunitconfig=drivers/gpu/drm/vc4/tests \
++              --cross_compile=aarch64-linux-gnu- --arch=arm64
diff --git a/target/linux/bcm27xx/patches-6.1/950-0507-.github-workflows-Add-dtoverlaycheck-workflow.patch b/target/linux/bcm27xx/patches-6.1/950-0507-.github-workflows-Add-dtoverlaycheck-workflow.patch
new file mode 100644
index 00000000000000..92a7b7edf4b690
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0507-.github-workflows-Add-dtoverlaycheck-workflow.patch
@@ -0,0 +1,62 @@
+From 4aec59014afc64d912502d70194a8823b0a6150a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 6 Dec 2022 18:11:58 +0000
+Subject: [PATCH] .github/workflows: Add dtoverlaycheck workflow
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .github/workflows/dtoverlaycheck.yml | 48 ++++++++++++++++++++++++++++
+ 1 file changed, 48 insertions(+)
+ create mode 100644 .github/workflows/dtoverlaycheck.yml
+
+--- /dev/null
++++ b/.github/workflows/dtoverlaycheck.yml
+@@ -0,0 +1,48 @@
++name: Pi dtoverlay checks
++
++on:
++  pull_request:
++    paths-ignore:
++      - '.github/**'
++    branches: [ "rpi-*" ]
++  push:
++    paths-ignore:
++      - '.github/**'
++    branches: [ "rpi-*" ]
++  workflow_dispatch:
++
++env:
++  UTILS_DIR: "${{github.workspace}}/utils"
++
++jobs:
++  dtoverlaycheck:
++    runs-on: ubuntu-latest
++
++    steps:
++    - name: Install toolchain
++      run: |
++        sudo apt update
++        sudo apt-get install gcc-arm-linux-gnueabihf libfdt-dev device-tree-compiler
++      timeout-minutes: 10
++
++    - uses: actions/checkout@v3
++      with:
++        fetch-depth: 1
++        clean: true
++
++    - name: overlaycheck
++      run: |
++        git clone https://github.com/raspberrypi/utils ${{env.UTILS_DIR}}
++        cd ${{env.UTILS_DIR}}
++        pwd
++        mkdir build
++        cd build
++        pwd
++        cmake ..
++        make -j4
++        sudo make install
++        cd ${{github.workspace}}
++        pwd
++        make ARCH=arm KERNEL=kernel CROSS_COMPILE=arm-linux-gnueabihf- bcm2711_defconfig
++        make ARCH=arm KERNEL=kernel CROSS_COMPILE=arm-linux-gnueabihf- dtbs
++        ${{env.UTILS_DIR}}/overlaycheck/overlaycheck
diff --git a/target/linux/bcm27xx/patches-6.1/950-0508-.github-workflows-Create-workflow-to-CI-kernel-build.patch b/target/linux/bcm27xx/patches-6.1/950-0508-.github-workflows-Create-workflow-to-CI-kernel-build.patch
new file mode 100644
index 00000000000000..101f6dafca3eee
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0508-.github-workflows-Create-workflow-to-CI-kernel-build.patch
@@ -0,0 +1,285 @@
+From baa2e8235af7143148d8799c5caed2a2eefd9107 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 11 Nov 2022 17:09:32 +0000
+Subject: [PATCH] .github/workflows: Create workflow to CI kernel
+ builds
+
+Builds the bcmrpi, bcm2709, bcm2711, and bcm2835 32 bit kernels,
+and defconfig and bcm2711 64bit kernels, saving the artifacts for
+7 days.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .github/workflows/kernel-build.yml | 266 +++++++++++++++++++++++++++++
+ 1 file changed, 266 insertions(+)
+ create mode 100644 .github/workflows/kernel-build.yml
+
+--- /dev/null
++++ b/.github/workflows/kernel-build.yml
+@@ -0,0 +1,266 @@
++name: Pi kernel build tests
++
++on:
++  pull_request:
++    paths-ignore:
++      - '.github/**'
++    branches: [ "rpi-*" ]
++  push:
++    paths-ignore:
++      - '.github/**'
++    branches: [ "rpi-*" ]
++  workflow_dispatch:
++
++env:
++  NUM_JOBS: 3
++
++jobs:
++  build-bcm2835:
++
++    runs-on: ubuntu-latest
++
++    steps:
++    - name: Update install
++      run:
++        sudo apt-get update
++
++    - name: Install toolchain
++      run:
++        sudo apt-get install gcc-arm-linux-gnueabihf
++      timeout-minutes: 5
++
++    - uses: actions/checkout@v3
++      with:
++        fetch-depth: 1
++        clean: true
++
++    - name: Build kernel
++      run: |
++        mkdir ${{github.workspace}}/build
++        make ARCH=arm KERNEL=kernel CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build bcm2835_defconfig
++        make ARCH=arm KERNEL=kernel CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} Image modules dtbs
++        mkdir -p ${{github.workspace}}/install/boot
++        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
++        cp ${{github.workspace}}/build/arch/arm/boot/dts/*.dtb ${{github.workspace}}/install/boot/
++        cp -r ${{github.workspace}}/build/arch/arm/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/
++        cp ${{github.workspace}}/build/arch/arm/boot/Image ${{github.workspace}}/install/boot/
++
++    - name: Tar build
++      run: tar -cvf bcm2835_build.tar -C ${{github.workspace}}/install .
++
++    - name: Upload results
++      uses: actions/upload-artifact@v3
++      with:
++        name: bcm2835_build
++        path: bcm2835_build.tar
++        retention-days: 7
++
++  build-arm64:
++
++    runs-on: ubuntu-latest
++
++    steps:
++    - name: Update install
++      run:
++        sudo apt-get update
++
++    - name: Install toolchain
++      run:
++        sudo apt-get install gcc-aarch64-linux-gnu
++      timeout-minutes: 5
++
++    - uses: actions/checkout@v3
++      with:
++        fetch-depth: 1
++        clean: true
++
++    - name: Build kernel
++      run: |
++        mkdir ${{github.workspace}}/build
++        make ARCH=arm64 KERNEL=kernel8 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build defconfig
++        make ARCH=arm64 KERNEL=kernel8 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} Image.gz modules dtbs
++        mkdir -p ${{github.workspace}}/install/boot
++        make ARCH=arm64 KERNEL=kernel8 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
++        cp ${{github.workspace}}/build/arch/arm64/boot/dts/broadcom/*.dtb ${{github.workspace}}/install/boot/
++        cp -r ${{github.workspace}}/build/arch/arm64/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/
++        cp ${{github.workspace}}/build/arch/arm64/boot/Image.gz ${{github.workspace}}/install/boot/
++
++    - name: Tar build
++      run: tar -cvf arm64_build.tar -C ${{github.workspace}}/install .
++
++    - name: Upload results
++      uses: actions/upload-artifact@v3
++      with:
++        name: arm64_build
++        path: arm64_build.tar
++        retention-days: 7
++
++  build-bcmrpi:
++
++    runs-on: ubuntu-latest
++
++    steps:
++    - name: Update install
++      run:
++        sudo apt-get update
++
++    - name: Install toolchain
++      run:
++        sudo apt-get install gcc-arm-linux-gnueabihf
++      timeout-minutes: 5
++
++    - uses: actions/checkout@v3
++      with:
++        fetch-depth: 1
++        clean: true
++
++    - name: Build kernel
++      run: |
++        mkdir ${{github.workspace}}/build
++        make ARCH=arm KERNEL=kernel CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build bcm2711_defconfig
++        make ARCH=arm KERNEL=kernel CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} zImage modules dtbs
++        mkdir -p ${{github.workspace}}/install/boot
++        make ARCH=arm KERNEL=kernel CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
++        cp ${{github.workspace}}/build/arch/arm/boot/dts/*.dtb ${{github.workspace}}/install/boot/
++        cp -r ${{github.workspace}}/build/arch/arm/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/
++        cp ${{github.workspace}}/build/arch/arm/boot/zImage ${{github.workspace}}/install/boot/
++
++    - name: Tar build
++      run: tar -cvf bcmrpi_build.tar -C ${{github.workspace}}/install .
++
++    - name: Upload results
++      uses: actions/upload-artifact@v3
++      with:
++        name: bcmrpi_build
++        path: bcmrpi_build.tar
++        retention-days: 7
++
++  build-bcm2709:
++
++    runs-on: ubuntu-latest
++
++    steps:
++    - name: Update install
++      run:
++        sudo apt-get update
++
++    - name: Install toolchain
++      run:
++        sudo apt-get install gcc-arm-linux-gnueabihf
++      timeout-minutes: 5
++
++    - uses: actions/checkout@v3
++      with:
++        fetch-depth: 1
++        clean: true
++
++    - name: Build kernel
++      run: |
++        mkdir ${{github.workspace}}/build
++        make ARCH=arm KERNEL=kernel7 CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build bcm2709_defconfig
++        make ARCH=arm KERNEL=kernel7 CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} zImage modules dtbs
++        mkdir -p ${{github.workspace}}/install/boot
++        make ARCH=arm KERNEL=kernel7 CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
++        cp ${{github.workspace}}/build/arch/arm/boot/dts/*.dtb ${{github.workspace}}/install/boot/
++        cp -r ${{github.workspace}}/build/arch/arm/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/
++        cp ${{github.workspace}}/build/arch/arm/boot/zImage ${{github.workspace}}/install/boot/
++
++    - name: Tar build
++      run: tar -cvf bcm2709_build.tar -C ${{github.workspace}}/install .
++
++    - name: Upload results
++      uses: actions/upload-artifact@v3
++      with:
++        name: bcm2709_build
++        path: bcm2709_build.tar
++        retention-days: 7
++
++  build-bcm2711:
++
++    runs-on: ubuntu-latest
++
++    steps:
++    - name: Update install
++      run:
++        sudo apt-get update
++
++    - name: Install toolchain
++      run:
++        sudo apt-get install gcc-arm-linux-gnueabihf
++      timeout-minutes: 5
++
++    - uses: actions/checkout@v3
++      with:
++        fetch-depth: 1
++        clean: true
++
++    - name: Build kernel
++      run: |
++        mkdir ${{github.workspace}}/build
++        make ARCH=arm KERNEL=kernel7l CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build bcm2711_defconfig
++        make ARCH=arm KERNEL=kernel7l CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} zImage modules dtbs
++        mkdir -p ${{github.workspace}}/install/boot
++        make ARCH=arm KERNEL=kernel7l CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
++        cp ${{github.workspace}}/build/arch/arm/boot/dts/*.dtb ${{github.workspace}}/install/boot/
++        cp -r ${{github.workspace}}/build/arch/arm/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/
++        cp ${{github.workspace}}/build/arch/arm/boot/zImage ${{github.workspace}}/install/boot/
++
++    - name: Tar build
++      run: tar -cvf bcm2711_build.tar -C ${{github.workspace}}/install .
++
++    - name: Upload results
++      uses: actions/upload-artifact@v3
++      with:
++        name: bcm2711_build
++        path: bcm2711_build.tar
++        retention-days: 7
++
++  build-bcm2711-arm64:
++
++    runs-on: ubuntu-latest
++
++    steps:
++    - name: Update install
++      run:
++        sudo apt-get update
++
++    - name: Install toolchain
++      run:
++        sudo apt-get install gcc-arm-linux-gnueabihf
++      timeout-minutes: 5
++
++    - uses: actions/checkout@v3
++      with:
++        fetch-depth: 1
++        clean: true
++
++    - name: Install toolchain
++      run:
++        sudo apt-get install gcc-aarch64-linux-gnu
++      timeout-minutes: 5
++
++    - uses: actions/checkout@v3
++      with:
++        fetch-depth: 1
++        clean: true
++
++    - name: Build kernel
++      run: |
++        mkdir ${{github.workspace}}/build
++        make ARCH=arm64 KERNEL=kernel8 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build bcm2711_defconfig
++        make ARCH=arm64 KERNEL=kernel8 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} Image.gz modules dtbs
++        mkdir -p ${{github.workspace}}/install/boot
++        make ARCH=arm64 KERNEL=kernel8 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
++        cp ${{github.workspace}}/build/arch/arm64/boot/dts/broadcom/*.dtb ${{github.workspace}}/install/boot/
++        cp -r ${{github.workspace}}/build/arch/arm64/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/
++        cp ${{github.workspace}}/build/arch/arm64/boot/Image.gz ${{github.workspace}}/install/boot/
++
++    - name: Tar build
++      run: tar -cvf bcm2711_arm64_build.tar -C ${{github.workspace}}/install .
++
++    - name: Upload results
++      uses: actions/upload-artifact@v3
++      with:
++        name: bcm2711_arm64_build
++        path: bcm2711_arm64_build.tar
++        retention-days: 7
diff --git a/target/linux/bcm27xx/patches-6.1/950-0509-README-Add-README.md-with-CI-kernel-build-status-tag.patch b/target/linux/bcm27xx/patches-6.1/950-0509-README-Add-README.md-with-CI-kernel-build-status-tag.patch
new file mode 100644
index 00000000000000..610efdc8a7bce2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0509-README-Add-README.md-with-CI-kernel-build-status-tag.patch
@@ -0,0 +1,50 @@
+From 81eebfa296eb1454cde3bf1cbd919f8b9eb6cf64 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 14 Nov 2022 17:14:15 +0000
+Subject: [PATCH] README: Add README.md with CI kernel build status
+ tags
+
+This is a copy of README with the tags added.
+
+You can not delete the file README as then checkpatch complains
+you aren't in a kernel tree.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ README.md | 30 ++++++++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+ create mode 100644 README.md
+
+--- /dev/null
++++ b/README.md
+@@ -0,0 +1,30 @@
++Linux kernel
++============
++
++There are several guides for kernel developers and users. These guides can
++be rendered in a number of formats, like HTML and PDF. Please read
++Documentation/admin-guide/README.rst first.
++
++In order to build the documentation, use ``make htmldocs`` or
++``make pdfdocs``.  The formatted documentation can also be read online at:
++
++    https://www.kernel.org/doc/html/latest/
++
++There are various text files in the Documentation/ subdirectory,
++several of them using the Restructured Text markup notation.
++
++Please read the Documentation/process/changes.rst file, as it contains the
++requirements for building and running the kernel, and information about
++the problems which may result by upgrading your kernel.
++
++Build status for rpi-5.15.y:
++[![Pi kernel build tests](https://github.com/raspberrypi/linux/actions/workflows/kernel-build.yml/badge.svg?branch=rpi-5.15.y)](https://github.com/raspberrypi/linux/actions/workflows/kernel-build.yml)
++[![dtoverlaycheck](https://github.com/raspberrypi/linux/actions/workflows/dtoverlaycheck.yml/badge.svg?branch=rpi-5.15.y)](https://github.com/raspberrypi/linux/actions/workflows/dtoverlaycheck.yml)
++
++Build status for rpi-6.0.y:
++[![Pi kernel build tests](https://github.com/raspberrypi/linux/actions/workflows/kernel-build.yml/badge.svg?branch=rpi-6.0.y)](https://github.com/raspberrypi/linux/actions/workflows/kernel-build.yml)
++[![dtoverlaycheck](https://github.com/raspberrypi/linux/actions/workflows/dtoverlaycheck.yml/badge.svg?branch=rpi-6.0.y)](https://github.com/raspberrypi/linux/actions/workflows/dtoverlaycheck.yml)
++
++Build status for rpi-6.1.y:
++[![Pi kernel build tests](https://github.com/raspberrypi/linux/actions/workflows/kernel-build.yml/badge.svg?branch=rpi-6.1.y)](https://github.com/raspberrypi/linux/actions/workflows/kernel-build.yml)
++[![dtoverlaycheck](https://github.com/raspberrypi/linux/actions/workflows/dtoverlaycheck.yml/badge.svg?branch=rpi-6.1.y)](https://github.com/raspberrypi/linux/actions/workflows/dtoverlaycheck.yml)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0510-drm-panel-panel-ilitek9881c-Use-cansleep-methods.patch b/target/linux/bcm27xx/patches-6.1/950-0510-drm-panel-panel-ilitek9881c-Use-cansleep-methods.patch
new file mode 100644
index 00000000000000..c95f4c0323f273
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0510-drm-panel-panel-ilitek9881c-Use-cansleep-methods.patch
@@ -0,0 +1,37 @@
+From b969ef21e3522c6829aafaa1fecd33fa653596e4 Mon Sep 17 00:00:00 2001
+From: Mark Williams <mwp@mwp.id.au>
+Date: Wed, 7 Dec 2022 18:20:40 -0700
+Subject: [PATCH] drm/panel: panel-ilitek9881c: Use cansleep methods
+
+Use cansleep version of gpiod_set_value so external IO drivers (like
+via I2C) can be used.
+
+Signed-off-by: Mark Williams <mwp@mwp.id.au>
+---
+ drivers/gpu/drm/panel/panel-ilitek-ili9881c.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
++++ b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
+@@ -940,10 +940,10 @@ static int ili9881c_prepare(struct drm_p
+ 	msleep(5);
+ 
+ 	/* And reset it */
+-	gpiod_set_value(ctx->reset, 1);
++	gpiod_set_value_cansleep(ctx->reset, 1);
+ 	msleep(20);
+ 
+-	gpiod_set_value(ctx->reset, 0);
++	gpiod_set_value_cansleep(ctx->reset, 0);
+ 	msleep(20);
+ 
+ 	for (i = 0; i < ctx->desc->init_length; i++) {
+@@ -998,7 +998,7 @@ static int ili9881c_unprepare(struct drm
+ 
+ 	mipi_dsi_dcs_enter_sleep_mode(ctx->dsi);
+ 	regulator_disable(ctx->power);
+-	gpiod_set_value(ctx->reset, 1);
++	gpiod_set_value_cansleep(ctx->reset, 1);
+ 
+ 	return 0;
+ }
diff --git a/target/linux/bcm27xx/patches-6.1/950-0511-drm-panel-panel-ilitek9881c-Crystalfontz-support.patch b/target/linux/bcm27xx/patches-6.1/950-0511-drm-panel-panel-ilitek9881c-Crystalfontz-support.patch
new file mode 100644
index 00000000000000..10b8c5122e43ae
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0511-drm-panel-panel-ilitek9881c-Crystalfontz-support.patch
@@ -0,0 +1,276 @@
+From 87125150ecb1a21daff9a95165d4357f80d68ec6 Mon Sep 17 00:00:00 2001
+From: Mark Williams <mwp@mwp.id.au>
+Date: Wed, 7 Dec 2022 19:55:15 -0700
+Subject: [PATCH] drm/panel: panel-ilitek9881c: Crystalfontz support
+
+Add support for Crystalfontz CFAF7201280A0-050Tx panel.
+
+Signed-off-by: Mark Williams <mwp@mwp.id.au>
+---
+ drivers/gpu/drm/panel/panel-ilitek-ili9881c.c | 229 ++++++++++++++++++
+ 1 file changed, 229 insertions(+)
+
+--- a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
++++ b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
+@@ -3,6 +3,7 @@
+  * Copyright (C) 2017-2018, Bootlin
+  * Copyright (C) 2021, Henson Li <henson@cutiepi.io>
+  * Copyright (C) 2021, Penk Chen <penk@cutiepi.io>
++ * Copyright (C) 2022, Mark Williams <mark@crystalfontz.com>
+  */
+ 
+ #include <linux/delay.h>
+@@ -887,6 +888,212 @@ static const struct ili9881c_instr w5529
+ 	ILI9881C_SWITCH_PAGE_INSTR(0),
+ };
+ 
++static const struct ili9881c_instr cfaf7201280a0_050tx_init[] = {
++	//ILI9881C PAGE3
++	ILI9881C_SWITCH_PAGE_INSTR(3),
++	//GIP_1
++	ILI9881C_COMMAND_INSTR(0x01, 0x00), //added
++	ILI9881C_COMMAND_INSTR(0x02, 0x00),
++	ILI9881C_COMMAND_INSTR(0x03, 0x73),
++	ILI9881C_COMMAND_INSTR(0x04, 0x00),
++	ILI9881C_COMMAND_INSTR(0x05, 0x00),
++	ILI9881C_COMMAND_INSTR(0x06, 0x0A),
++	ILI9881C_COMMAND_INSTR(0x07, 0x00),
++	ILI9881C_COMMAND_INSTR(0x08, 0x00),
++	ILI9881C_COMMAND_INSTR(0x09, 0x01),
++	ILI9881C_COMMAND_INSTR(0x0A, 0x00),
++	ILI9881C_COMMAND_INSTR(0x0B, 0x00),
++	ILI9881C_COMMAND_INSTR(0x0C, 0x01),
++	ILI9881C_COMMAND_INSTR(0x0D, 0x00),
++	ILI9881C_COMMAND_INSTR(0x0E, 0x00),
++	ILI9881C_COMMAND_INSTR(0x0F, 0x1D),
++	ILI9881C_COMMAND_INSTR(0x10, 0x1D),
++	ILI9881C_COMMAND_INSTR(0x11, 0x00),
++	ILI9881C_COMMAND_INSTR(0x12, 0x00),
++	ILI9881C_COMMAND_INSTR(0x13, 0x00),
++	ILI9881C_COMMAND_INSTR(0x14, 0x00),
++	ILI9881C_COMMAND_INSTR(0x15, 0x00),
++	ILI9881C_COMMAND_INSTR(0x16, 0x00),
++	ILI9881C_COMMAND_INSTR(0x17, 0x00),
++	ILI9881C_COMMAND_INSTR(0x18, 0x00),
++	ILI9881C_COMMAND_INSTR(0x19, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1A, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1B, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1C, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1D, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1E, 0x40),
++	ILI9881C_COMMAND_INSTR(0x1F, 0x80),
++	ILI9881C_COMMAND_INSTR(0x20, 0x06),
++	ILI9881C_COMMAND_INSTR(0x21, 0x02),
++	ILI9881C_COMMAND_INSTR(0x22, 0x00),
++	ILI9881C_COMMAND_INSTR(0x23, 0x00),
++	ILI9881C_COMMAND_INSTR(0x24, 0x00),
++	ILI9881C_COMMAND_INSTR(0x25, 0x00),
++	ILI9881C_COMMAND_INSTR(0x26, 0x00),
++	ILI9881C_COMMAND_INSTR(0x27, 0x00),
++	ILI9881C_COMMAND_INSTR(0x28, 0x33),
++	ILI9881C_COMMAND_INSTR(0x29, 0x03),
++	ILI9881C_COMMAND_INSTR(0x2A, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2B, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2C, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2D, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2E, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2F, 0x00),
++	ILI9881C_COMMAND_INSTR(0x30, 0x00),
++	ILI9881C_COMMAND_INSTR(0x31, 0x00),
++	ILI9881C_COMMAND_INSTR(0x32, 0x00),
++	ILI9881C_COMMAND_INSTR(0x33, 0x00),
++	ILI9881C_COMMAND_INSTR(0x34, 0x04),
++	ILI9881C_COMMAND_INSTR(0x35, 0x00),
++	ILI9881C_COMMAND_INSTR(0x36, 0x00),
++	ILI9881C_COMMAND_INSTR(0x37, 0x00),
++	ILI9881C_COMMAND_INSTR(0x38, 0x3C),
++	ILI9881C_COMMAND_INSTR(0x39, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3A, 0x40),
++	ILI9881C_COMMAND_INSTR(0x3B, 0x40),
++	ILI9881C_COMMAND_INSTR(0x3C, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3D, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3E, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3F, 0x00),
++	ILI9881C_COMMAND_INSTR(0x40, 0x00),
++	ILI9881C_COMMAND_INSTR(0x41, 0x00),
++	ILI9881C_COMMAND_INSTR(0x42, 0x00),
++	ILI9881C_COMMAND_INSTR(0x43, 0x00),
++	ILI9881C_COMMAND_INSTR(0x44, 0x00),
++	//GIP_2
++	ILI9881C_COMMAND_INSTR(0x50, 0x01),
++	ILI9881C_COMMAND_INSTR(0x51, 0x23),
++	ILI9881C_COMMAND_INSTR(0x52, 0x45),
++	ILI9881C_COMMAND_INSTR(0x53, 0x67),
++	ILI9881C_COMMAND_INSTR(0x54, 0x89),
++	ILI9881C_COMMAND_INSTR(0x55, 0xAB),
++	ILI9881C_COMMAND_INSTR(0x56, 0x01),
++	ILI9881C_COMMAND_INSTR(0x57, 0x23),
++	ILI9881C_COMMAND_INSTR(0x58, 0x45),
++	ILI9881C_COMMAND_INSTR(0x59, 0x67),
++	ILI9881C_COMMAND_INSTR(0x5A, 0x89),
++	ILI9881C_COMMAND_INSTR(0x5B, 0xAB),
++	ILI9881C_COMMAND_INSTR(0x5C, 0xCD),
++	ILI9881C_COMMAND_INSTR(0x5D, 0xEF),
++	//GIP_3
++	ILI9881C_COMMAND_INSTR(0x5E, 0x11),
++	ILI9881C_COMMAND_INSTR(0x5F, 0x01),
++	ILI9881C_COMMAND_INSTR(0x60, 0x00),
++	ILI9881C_COMMAND_INSTR(0x61, 0x15),
++	ILI9881C_COMMAND_INSTR(0x62, 0x14),
++	ILI9881C_COMMAND_INSTR(0x63, 0x0E),
++	ILI9881C_COMMAND_INSTR(0x64, 0x0F),
++	ILI9881C_COMMAND_INSTR(0x65, 0x0C),
++	ILI9881C_COMMAND_INSTR(0x66, 0x0D),
++	ILI9881C_COMMAND_INSTR(0x67, 0x06),
++	ILI9881C_COMMAND_INSTR(0x68, 0x02),
++	ILI9881C_COMMAND_INSTR(0x69, 0x07),
++	ILI9881C_COMMAND_INSTR(0x6A, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6B, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6C, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6D, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6E, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6F, 0x02),
++	ILI9881C_COMMAND_INSTR(0x70, 0x02),
++	ILI9881C_COMMAND_INSTR(0x71, 0x02),
++	ILI9881C_COMMAND_INSTR(0x72, 0x02),
++	ILI9881C_COMMAND_INSTR(0x73, 0x02),
++	ILI9881C_COMMAND_INSTR(0x74, 0x02),
++	ILI9881C_COMMAND_INSTR(0x75, 0x01),
++	ILI9881C_COMMAND_INSTR(0x76, 0x00),
++	ILI9881C_COMMAND_INSTR(0x77, 0x14),
++	ILI9881C_COMMAND_INSTR(0x78, 0x15),
++	ILI9881C_COMMAND_INSTR(0x79, 0x0E),
++	ILI9881C_COMMAND_INSTR(0x7A, 0x0F),
++	ILI9881C_COMMAND_INSTR(0x7B, 0x0C),
++	ILI9881C_COMMAND_INSTR(0x7C, 0x0D),
++	ILI9881C_COMMAND_INSTR(0x7D, 0x06),
++	ILI9881C_COMMAND_INSTR(0x7E, 0x02),
++	ILI9881C_COMMAND_INSTR(0x7F, 0x07),
++	ILI9881C_COMMAND_INSTR(0x80, 0x02),
++	ILI9881C_COMMAND_INSTR(0x81, 0x02),
++	ILI9881C_COMMAND_INSTR(0x82, 0x02),
++	ILI9881C_COMMAND_INSTR(0x83, 0x02),
++	ILI9881C_COMMAND_INSTR(0x84, 0x02),
++	ILI9881C_COMMAND_INSTR(0x85, 0x02),
++	ILI9881C_COMMAND_INSTR(0x86, 0x02),
++	ILI9881C_COMMAND_INSTR(0x87, 0x02),
++	ILI9881C_COMMAND_INSTR(0x88, 0x02),
++	ILI9881C_COMMAND_INSTR(0x89, 0x02),
++	ILI9881C_COMMAND_INSTR(0x8A, 0x02),
++	//ILI9881C PAGE4
++	ILI9881C_SWITCH_PAGE_INSTR(4),
++	ILI9881C_COMMAND_INSTR(0x6C, 0x15),
++	ILI9881C_COMMAND_INSTR(0x6E, 0x2B),
++	// VGH & VGL OUTPUT
++	ILI9881C_COMMAND_INSTR(0x6F, 0x33),
++	ILI9881C_COMMAND_INSTR(0x8D, 0x18),
++	ILI9881C_COMMAND_INSTR(0x87, 0xBA),
++	ILI9881C_COMMAND_INSTR(0x26, 0x76),
++	//Reload Gamma setting
++	ILI9881C_COMMAND_INSTR(0xB2, 0xD1),
++	ILI9881C_COMMAND_INSTR(0xB5, 0x06),
++	ILI9881C_COMMAND_INSTR(0x3A, 0x24),
++	ILI9881C_COMMAND_INSTR(0x35, 0x1F),
++
++	//ILI9881C PAGE1
++	ILI9881C_SWITCH_PAGE_INSTR(1),
++	ILI9881C_COMMAND_INSTR(0x22, 0x09),
++	//Column inversion
++	ILI9881C_COMMAND_INSTR(0x31, 0x00),
++	ILI9881C_COMMAND_INSTR(0x40, 0x33),
++	ILI9881C_COMMAND_INSTR(0x53, 0xA2),
++	ILI9881C_COMMAND_INSTR(0x55, 0x92),
++	ILI9881C_COMMAND_INSTR(0x50, 0x96),
++	ILI9881C_COMMAND_INSTR(0x51, 0x96),
++	ILI9881C_COMMAND_INSTR(0x60, 0x22),
++	ILI9881C_COMMAND_INSTR(0x61, 0x00),
++	ILI9881C_COMMAND_INSTR(0x62, 0x19),
++	ILI9881C_COMMAND_INSTR(0x63, 0x00),
++	//---P-GAMMA START---
++	ILI9881C_COMMAND_INSTR(0xA0, 0x08),
++	ILI9881C_COMMAND_INSTR(0xA1, 0x11),
++	ILI9881C_COMMAND_INSTR(0xA2, 0x19),
++	ILI9881C_COMMAND_INSTR(0xA3, 0x0D),
++	ILI9881C_COMMAND_INSTR(0xA4, 0x0D),
++	ILI9881C_COMMAND_INSTR(0xA5, 0x1E),
++	ILI9881C_COMMAND_INSTR(0xA6, 0x14),
++	ILI9881C_COMMAND_INSTR(0xA7, 0x17),
++	ILI9881C_COMMAND_INSTR(0xA8, 0x4F),
++	ILI9881C_COMMAND_INSTR(0xA9, 0x1A),
++	ILI9881C_COMMAND_INSTR(0xAA, 0x27),
++	ILI9881C_COMMAND_INSTR(0xAB, 0x49),
++	ILI9881C_COMMAND_INSTR(0xAC, 0x1A),
++	ILI9881C_COMMAND_INSTR(0xAD, 0x18),
++	ILI9881C_COMMAND_INSTR(0xAE, 0x4C),
++	ILI9881C_COMMAND_INSTR(0xAF, 0x22),
++	ILI9881C_COMMAND_INSTR(0xB0, 0x27),
++	ILI9881C_COMMAND_INSTR(0xB1, 0x4B),
++	ILI9881C_COMMAND_INSTR(0xB2, 0x60),
++	ILI9881C_COMMAND_INSTR(0xB3, 0x39),
++	//--- N-GAMMA START---
++	ILI9881C_COMMAND_INSTR(0xC0, 0x08),
++	ILI9881C_COMMAND_INSTR(0xC1, 0x11),
++	ILI9881C_COMMAND_INSTR(0xC2, 0x19),
++	ILI9881C_COMMAND_INSTR(0xC3, 0x0D),
++	ILI9881C_COMMAND_INSTR(0xC4, 0x0D),
++	ILI9881C_COMMAND_INSTR(0xC5, 0x1E),
++	ILI9881C_COMMAND_INSTR(0xC6, 0x14),
++	ILI9881C_COMMAND_INSTR(0xC7, 0x17),
++	ILI9881C_COMMAND_INSTR(0xC8, 0x4F),
++	ILI9881C_COMMAND_INSTR(0xC9, 0x1A),
++	ILI9881C_COMMAND_INSTR(0xCA, 0x27),
++	ILI9881C_COMMAND_INSTR(0xCB, 0x49),
++	ILI9881C_COMMAND_INSTR(0xCC, 0x1A),
++	ILI9881C_COMMAND_INSTR(0xCD, 0x18),
++	ILI9881C_COMMAND_INSTR(0xCE, 0x4C),
++	ILI9881C_COMMAND_INSTR(0xCF, 0x33),
++	ILI9881C_COMMAND_INSTR(0xD0, 0x27),
++	ILI9881C_COMMAND_INSTR(0xD1, 0x4B),
++	ILI9881C_COMMAND_INSTR(0xD2, 0x60),
++	ILI9881C_COMMAND_INSTR(0xD3, 0x39),
++};
++
+ static inline struct ili9881c *panel_to_ili9881c(struct drm_panel *panel)
+ {
+ 	return container_of(panel, struct ili9881c, panel);
+@@ -1071,6 +1278,20 @@ static const struct drm_display_mode w55
+ 	.height_mm	= 121,
+ };
+ 
++static const struct drm_display_mode cfaf7201280a0_050tx_default_mode = {
++	.clock		= 72830,
++	.hdisplay	= 720,
++	.hsync_start	= 720 + 87,
++	.hsync_end	= 720 + 87 + 20,
++	.htotal		= 720 + 87 + 20 + 87,
++	.vdisplay	= 1280,
++	.vsync_start	= 1280 + 16,
++	.vsync_end	= 1280 + 16 + 8,
++	.vtotal		= 1280 + 16 + 8 + 16,
++	.width_mm	= 62,
++	.height_mm	= 1108
++};
++
+ static int ili9881c_get_modes(struct drm_panel *panel,
+ 			      struct drm_connector *connector)
+ {
+@@ -1206,11 +1427,19 @@ static const struct ili9881c_desc w55294
+ 		      MIPI_DSI_MODE_LPM | MIPI_DSI_MODE_NO_EOT_PACKET,
+ };
+ 
++static const struct ili9881c_desc cfaf7201280a0_050tx_desc = {
++	.init = cfaf7201280a0_050tx_init,
++	.init_length = ARRAY_SIZE(cfaf7201280a0_050tx_init),
++	.mode = &cfaf7201280a0_050tx_default_mode,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_SYNC_PULSE | MIPI_DSI_MODE_VIDEO,
++};
++
+ static const struct of_device_id ili9881c_of_match[] = {
+ 	{ .compatible = "bananapi,lhr050h41", .data = &lhr050h41_desc },
+ 	{ .compatible = "feixin,k101-im2byl02", .data = &k101_im2byl02_desc },
+ 	{ .compatible = "nwe,nwe080", .data = &nwe080_desc },
+ 	{ .compatible = "wanchanglong,w552946aba", .data = &w552946aba_desc },
++	{ .compatible = "crystalfontz,cfaf7201280a0_050tx", .data = &cfaf7201280a0_050tx_desc },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(of, ili9881c_of_match);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0512-overlays-Add-crystalfontz-cfa050_pi_m.patch b/target/linux/bcm27xx/patches-6.1/950-0512-overlays-Add-crystalfontz-cfa050_pi_m.patch
new file mode 100644
index 00000000000000..94109e26695a9f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0512-overlays-Add-crystalfontz-cfa050_pi_m.patch
@@ -0,0 +1,171 @@
+From 86356a59b7688f8080aab516f1723f2ffbf15090 Mon Sep 17 00:00:00 2001
+From: Mark Williams <mwp@mwp.id.au>
+Date: Thu, 8 Dec 2022 04:58:05 -0700
+Subject: [PATCH] overlays: Add crystalfontz-cfa050_pi_m
+
+Add support for the Crystalfontz CFA050-PI-M series of Raspberry Pi
+CM4-based modules using the CFAF7201280A0_050Tx TFT LCD displays.
+
+Signed-off-by: Mark Williams <mwp@mwp.id.au>
+---
+ arch/arm/boot/dts/overlays/Makefile           |   1 +
+ arch/arm/boot/dts/overlays/README             |   9 ++
+ .../crystalfontz-cfa050_pi_m-overlay.dts      | 124 ++++++++++++++++++
+ 3 files changed, 134 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/crystalfontz-cfa050_pi_m-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -40,6 +40,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	chipdip-dac.dtbo \
+ 	cirrus-wm5102.dtbo \
+ 	cma.dtbo \
++	crystalfontz-cfa050_pi_m.dtbo \
+ 	cutiepi-panel.dtbo \
+ 	dacberry400.dtbo \
+ 	dht11.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -804,6 +804,15 @@ Params: cma-512                 CMA is 5
+         cma-default             Use upstream's default value
+ 
+ 
++Name:   crystalfontz-cfa050_pi_m
++Info:   Configures the Crystalfontz CFA050-PI-M series of Raspberry Pi CM4
++        based modules using the CFA7201280A0_050Tx 7" TFT LCD displays,
++        with or without capacitive touch screen.
++        Requires use of vc4-kms-v3d.
++Load:   dtoverlay=crystalfontz-cfa050_pi_m,<param>=<val>
++Params: captouch                Enable capacitive touch display
++
++
+ Name:   cutiepi-panel
+ Info:   8" TFT LCD display and touch panel used by cutiepi.io
+ Load:   dtoverlay=cutiepi-panel
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/crystalfontz-cfa050_pi_m-overlay.dts
+@@ -0,0 +1,124 @@
++/*
++ * crystalfontz-cfa050_pi_m-overlay.dts
++ * Configures the Crystalfontz CFA050-PI-M series of modules
++ * using CFAF7201280A0-050TC/TN panels with RaspberryPi CM4 DSI1
++ */
++/dts-v1/;
++/plugin/;
++/{
++// RaspberryPi CM4
++	compatible = "brcm,bcm2835";
++// PCF8574 I2C GPIO EXPANDER
++	fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			pcf8574a: pcf8574a@38 {
++				reg = <0x38>;
++				compatible = "nxp,pcf8574";
++				gpio-controller;
++				#gpio-cells = <2>;
++				ngpios = <8>;
++				gpio-line-names = "TFT_RESET", "TOUCH_RESET", "EXT_P2", "EXT_P3",
++					"EXT_P4", "EXT_P5", "EXT_P6", "EXT_P7";
++			};
++		};
++	};
++// LM3630a BACKLIGHT LED CONTROLLER
++	fragment@1 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			lm3630a: backlight@36 {
++				reg = <0x36>;
++				compatible = "ti,lm3630a";
++				#address-cells = <1>;
++				#size-cells = <0>;
++				led@0 {
++					reg = <0>;
++					led-sources = <0 1>;
++					label = "lcd-backlight";
++					default-brightness = <128>;
++					max-brightness = <255>;
++				};
++			};
++		};
++	};
++// CFAF7201280A0_050Tx TFT DSI PANEL
++	fragment@2 {
++		target = <&dsi1>;
++		__overlay__  {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			port {
++				dsi_out: endpoint {
++					remote-endpoint = <&panel_in>;
++				};
++			};
++			dsi_panel: dsi_panel@0 {
++				compatible = "crystalfontz,cfaf7201280a0_050tx";
++				reg = <0>;
++				reset-gpios = <&pcf8574a 0 1>;
++				backlight = <&lm3630a>;
++				fps = <60>;
++				port {
++					panel_in: endpoint {
++						remote-endpoint = <&dsi_out>;
++					};
++				};
++			};
++		};
++	};
++// rPI GPIO INPUT FOR TOUCH IC IRQ
++	fragment@3 {
++		target = <&gpio>;
++		__dormant__ {
++			gt928intpins: gt928intpins {
++				brcm,pins = <26>;
++				brcm,function = <0>;
++				brcm,pull = <1>;
++			};
++		};
++	};
++// GT928 TOUCH CONTROLLER IC
++	fragment@4 {
++		target = <&i2c_csi_dsi>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			gt928@5d {
++				compatible = "goodix,gt928";
++				reg = <0x5d>;
++				interrupt-parent = <&gpio>;
++				interrupts = <26 2>;
++				irq-gpios = <&gpio 26 0>;
++				reset-gpios = <&pcf8574a 1 1>;
++				touchscreen-inverted-x;
++				touchscreen-inverted-y;
++			};
++		};
++	};
++// PCF85063A RTC on I2C
++	fragment@5 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			pcf85063a@51 {
++				compatible = "nxp,pcf85063a";
++				reg = <0x51>;
++			};
++		};
++	};
++// CAPACITIVE TOUCH OPTION FOR TFT PANEL
++	__overrides__ {
++		captouch = <0>,"+3+4";
++	};
++};
diff --git a/target/linux/bcm27xx/patches-6.1/950-0513-net-bcmgenet-Add-eee-module-parameter.patch b/target/linux/bcm27xx/patches-6.1/950-0513-net-bcmgenet-Add-eee-module-parameter.patch
new file mode 100644
index 00000000000000..a145f6c48f07cf
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0513-net-bcmgenet-Add-eee-module-parameter.patch
@@ -0,0 +1,46 @@
+From d69cdb1cc4e3f717f63910cb2c40ca26f912ea34 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 14 Dec 2022 15:00:51 +0000
+Subject: [PATCH] net: bcmgenet: Add 'eee' module parameter
+
+On some switches, having EEE enabled causes the link to become
+unstable. With this patch, adding 'genet.eee=N' to the kernel command
+line will cause EEE to be disabled on the link.
+
+See: https://github.com/raspberrypi/linux/issues/4289
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -70,6 +70,9 @@ static void bcmgenet_set_rx_mode(struct
+ static bool skip_umac_reset = false;
+ module_param(skip_umac_reset, bool, 0444);
+ MODULE_PARM_DESC(skip_umac_reset, "Skip UMAC reset step");
++static bool eee = true;
++module_param(eee, bool, 0444);
++MODULE_PARM_DESC(eee, "Enable EEE (default Y)");
+ 
+ static inline void bcmgenet_writel(u32 value, void __iomem *offset)
+ {
+@@ -3438,6 +3441,17 @@ static int bcmgenet_open(struct net_devi
+ 
+ 	bcmgenet_phy_pause_set(dev, priv->rx_pause, priv->tx_pause);
+ 
++	if (!eee) {
++		struct ethtool_eee eee_data;
++
++		ret = bcmgenet_get_eee(dev, &eee_data);
++		if (ret == 0) {
++			eee_data.eee_enabled = 0;
++			bcmgenet_set_eee(dev, &eee_data);
++			netdev_warn(dev, "EEE disabled\n");
++		}
++	}
++
+ 	bcmgenet_netif_start(dev);
+ 
+ 	netif_tx_start_all_queues(dev);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0514-dts-bcm2711-Add-eee-dtparam.patch b/target/linux/bcm27xx/patches-6.1/950-0514-dts-bcm2711-Add-eee-dtparam.patch
new file mode 100644
index 00000000000000..37566eedd6e5aa
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0514-dts-bcm2711-Add-eee-dtparam.patch
@@ -0,0 +1,32 @@
+From efba9faf0c1bbf937989e03a75b9cf1d7ed59677 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 14 Dec 2022 15:28:16 +0000
+Subject: [PATCH] dts: bcm2711: Add 'eee' dtparam
+
+The 'eee' dtparam allows EEE to be disabled on the onboard Ethernet
+controller. Adding 'dtparam=eee=off' to config.txt causes
+'genet.eee=N' to be added to the kernel command line, which in turn
+tells the Genet driver to disable EEE.
+
+See: https://github.com/raspberrypi/linux/issues/4289
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/bcm2711-rpi-ds.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
++++ b/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
+@@ -2,8 +2,12 @@
+ #include "bcm270x-rpi.dtsi"
+ 
+ / {
++	chosen: chosen {
++	};
++
+ 	__overrides__ {
+ 		arm_freq;
++		eee = <&chosen>,"bootargs{on='',off='genet.eee=N'}";
+ 		hdmi = <&hdmi0>,"status",
+ 		       <&hdmi1>,"status";
+ 		pcie = <&pcie0>,"status";
diff --git a/target/linux/bcm27xx/patches-6.1/950-0515-dtoverlays-Add-overlay-cm-swap-i2c0-to-swap-buses-on.patch b/target/linux/bcm27xx/patches-6.1/950-0515-dtoverlays-Add-overlay-cm-swap-i2c0-to-swap-buses-on.patch
new file mode 100644
index 00000000000000..5c37d93698ec6d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0515-dtoverlays-Add-overlay-cm-swap-i2c0-to-swap-buses-on.patch
@@ -0,0 +1,86 @@
+From 16188a175bccc8fc6809b2751ba853defdff9197 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 15 Dec 2022 15:57:18 +0000
+Subject: [PATCH] dtoverlays: Add overlay cm-swap-i2c0 to swap buses on
+ i2c0mux
+
+The legacy camera stack wiring instructions connect the cameras
+to the opposite sets of GPIOs compared to the arrangement
+more normally used with libcamera on all other platforms.
+
+Add an overlay to allow easy swapping of the assignments so
+that the legacy wiring can be used with libcamera.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/Makefile           |  1 +
+ arch/arm/boot/dts/overlays/README             | 16 +++++++++++
+ .../dts/overlays/cm-swap-i2c0-overlay.dts     | 27 +++++++++++++++++++
+ 3 files changed, 44 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/cm-swap-i2c0-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -39,6 +39,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	cap1106.dtbo \
+ 	chipdip-dac.dtbo \
+ 	cirrus-wm5102.dtbo \
++	cm-swap-i2c0.dtbo \
+ 	cma.dtbo \
+ 	crystalfontz-cfa050_pi_m.dtbo \
+ 	cutiepi-panel.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -787,6 +787,22 @@ Load:   dtoverlay=cirrus-wm5102
+ Params: <None>
+ 
+ 
++Name:   cm-swap-i2c0
++Info:   Largely for Compute Modules 1&3 where the original instructions for
++        adding a camera used GPIOs 0&1 for CAM1 and 28&29 for CAM0, whilst all
++        other platforms use 28&29 (or 44&45) for CAM1.
++        The default assignment through using this overlay is for
++        i2c0 to use 28&29, and i2c10 (aka i2c_csi_dsi) to use 28&29, but the
++        overrides allow this to be changed.
++Load:   dtoverlay=cm-swap-i2c0,<param>=<val>
++Params: i2c0-gpio0              Use GPIOs 0&1 for i2c0
++        i2c0-gpio28             Use GPIOs 28&29 for i2c0 (default)
++        i2c0-gpio44             Use GPIOs 44&45 for i2c0
++        i2c10-gpio0             Use GPIOs 0&1 for i2c0 (default)
++        i2c10-gpio28            Use GPIOs 28&29 for i2c0
++        i2c10-gpio44            Use GPIOs 44&45 for i2c0
++
++
+ Name:   cma
+ Info:   Set custom CMA sizes, only use if you know what you are doing, might
+         clash with other overlays like vc4-fkms-v3d and vc4-kms-v3d.
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/cm-swap-i2c0-overlay.dts
+@@ -0,0 +1,27 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX708 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c0mux>;
++		i2c0mux_frag: __overlay__ {
++			pinctrl-0 = <&i2c0_gpio28>;
++			pinctrl-1 = <&i2c0_gpio0>;
++		};
++	};
++
++	__overrides__ {
++		i2c0-gpio0 = <&i2c0mux_frag>, "pinctrl-0:0=",<&i2c0_gpio0>;
++		i2c0-gpio28 = <&i2c0mux_frag>, "pinctrl-0:0=",<&i2c0_gpio28>;
++		i2c0-gpio44 = <&i2c0mux_frag>, "pinctrl-0:0=",<&i2c0_gpio44>;
++		i2c10-gpio0 = <&i2c0mux_frag>, "pinctrl-1:0=",<&i2c0_gpio0>;
++		i2c10-gpio28 = <&i2c0mux_frag>, "pinctrl-1:0=",<&i2c0_gpio28>;
++		i2c10-gpio44 = <&i2c0mux_frag>, "pinctrl-1:0=",<&i2c0_gpio44>;
++	};
++};
diff --git a/target/linux/bcm27xx/patches-6.1/950-0516-dt-Correct-cam_reg-GPIO-assignments-for-CM1-3.patch b/target/linux/bcm27xx/patches-6.1/950-0516-dt-Correct-cam_reg-GPIO-assignments-for-CM1-3.patch
new file mode 100644
index 00000000000000..57c8dc10f12a4a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0516-dt-Correct-cam_reg-GPIO-assignments-for-CM1-3.patch
@@ -0,0 +1,71 @@
+From 531f8723c990ecb8727ae40716db3069d954acd7 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 15 Dec 2022 15:59:28 +0000
+Subject: [PATCH] dt: Correct cam_reg GPIO assignments for CM1&3.
+
+The standard instructions for wiring up cameras on CM1&3
+assign GPIOs for both the shutdown and LED pins on the
+camera connectors.
+The assignment in DT matched the LED wiring, not the shutdown
+line, so didn't control the camera power correctly.
+
+Update the base DT accordingly.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/bcm2708-rpi-cm.dts  | 4 ++--
+ arch/arm/boot/dts/bcm2710-rpi-cm3.dts | 4 ++--
+ arch/arm/boot/dts/overlays/README     | 4 ++--
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm2708-rpi-cm.dts
++++ b/arch/arm/boot/dts/bcm2708-rpi-cm.dts
+@@ -11,12 +11,12 @@
+ };
+ 
+ &cam1_reg {
+-	gpio = <&gpio 2 GPIO_ACTIVE_HIGH>;
++	gpio = <&gpio 3 GPIO_ACTIVE_HIGH>;
+ 	status = "disabled";
+ };
+ 
+ cam0_reg: &cam0_regulator {
+-	gpio = <&gpio 30 GPIO_ACTIVE_HIGH>;
++	gpio = <&gpio 31 GPIO_ACTIVE_HIGH>;
+ };
+ 
+ &uart0 {
+--- a/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
++++ b/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
+@@ -11,12 +11,12 @@
+ };
+ 
+ &cam1_reg {
+-	gpio = <&gpio 2 GPIO_ACTIVE_HIGH>;
++	gpio = <&gpio 3 GPIO_ACTIVE_HIGH>;
+ 	status = "disabled";
+ };
+ 
+ cam0_reg: &cam0_regulator {
+-	gpio = <&gpio 30 GPIO_ACTIVE_HIGH>;
++	gpio = <&gpio 31 GPIO_ACTIVE_HIGH>;
+ };
+ 
+ &uart0 {
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -146,12 +146,12 @@ Params:
+ 
+         cam0_reg                Enables CAM 0 regulator. CM1 & 3 only.
+ 
+-        cam0_reg_gpio           Set GPIO for CAM 0 regulator. Default 30.
++        cam0_reg_gpio           Set GPIO for CAM 0 regulator. Default 31.
+                                 CM1 & 3 only.
+ 
+         cam1_reg                Enables CAM 1 regulator. CM1 & 3 only.
+ 
+-        cam1_reg_gpio           Set GPIO for CAM 1 regulator. Default 2.
++        cam1_reg_gpio           Set GPIO for CAM 1 regulator. Default 3.
+                                 CM1 & 3 only.
+ 
+         eee                     Enable Energy Efficient Ethernet support for
diff --git a/target/linux/bcm27xx/patches-6.1/950-0517-dt-Add-camX_reg_gpio-to-CM4.patch b/target/linux/bcm27xx/patches-6.1/950-0517-dt-Add-camX_reg_gpio-to-CM4.patch
new file mode 100644
index 00000000000000..4c6b108df36397
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0517-dt-Add-camX_reg_gpio-to-CM4.patch
@@ -0,0 +1,59 @@
+From 4aa602dc3f534cc5b1afcc587f1be8d713e389e5 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 15 Dec 2022 16:13:07 +0000
+Subject: [PATCH] dt: Add camX_reg_gpio to CM4
+
+To make it easier for custom routing of camera control GPIOs,
+add the camX_reg_gpio parameter to CM4 DT as well.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/bcm2711-rpi-cm4.dts |  7 +++++++
+ arch/arm/boot/dts/overlays/README     | 18 ++++++++++++------
+ 2 files changed, 19 insertions(+), 6 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm2711-rpi-cm4.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-cm4.dts
+@@ -574,5 +574,12 @@ cam0_reg: &cam1_reg {
+ 		sd_poll_once = <&emmc2>, "non-removable?";
+ 		spi_dma4 = <&spi0>, "dmas:0=", <&dma40>,
+ 			   <&spi0>, "dmas:8=", <&dma40>;
++
++		cam0_reg = <&cam0_reg>,"status";
++		cam0_reg_gpio = <&cam0_reg>,"gpio:4",
++				  <&cam0_reg>,"gpio:0=", <&gpio>;
++		cam1_reg = <&cam1_reg>,"status";
++		cam1_reg_gpio = <&cam1_reg>,"gpio:4",
++				  <&cam1_reg>,"gpio:0=", <&gpio>;
+ 	};
+ };
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -144,15 +144,21 @@ Params:
+                                 See /sys/kernel/debug/raspberrypi_axi_monitor
+                                 for the results.
+ 
+-        cam0_reg                Enables CAM 0 regulator. CM1 & 3 only.
++        cam0_reg                Enables CAM 0 regulator.
++                                Only required on CM1 & 3.
+ 
+-        cam0_reg_gpio           Set GPIO for CAM 0 regulator. Default 31.
+-                                CM1 & 3 only.
++        cam0_reg_gpio           Set GPIO for CAM 0 regulator.
++                                Default 31 on CM1 & 3.
++                                Default of GPIO expander 5 on CM4, but override
++                                switches to normal GPIO.
+ 
+-        cam1_reg                Enables CAM 1 regulator. CM1 & 3 only.
++        cam1_reg                Enables CAM 1 regulator.
++                                Only required on CM1 & 3.
+ 
+-        cam1_reg_gpio           Set GPIO for CAM 1 regulator. Default 3.
+-                                CM1 & 3 only.
++        cam1_reg_gpio           Set GPIO for CAM 1 regulator.
++                                Default 3 on CM1 & 3.
++                                Default of GPIO expander 5 on CM4, but override
++                                switches to normal GPIO.
+ 
+         eee                     Enable Energy Efficient Ethernet support for
+                                 compatible devices (default "on"). See also
diff --git a/target/linux/bcm27xx/patches-6.1/950-0518-dt-Add-camX_reg-and-camX_reg_gpio-overrides-to-CM4S.patch b/target/linux/bcm27xx/patches-6.1/950-0518-dt-Add-camX_reg-and-camX_reg_gpio-overrides-to-CM4S.patch
new file mode 100644
index 00000000000000..238e0ed688165a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0518-dt-Add-camX_reg-and-camX_reg_gpio-overrides-to-CM4S.patch
@@ -0,0 +1,64 @@
+From d9bad36a8f7530ec17ffe93521a8a71bc1e54a20 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 15 Dec 2022 16:15:27 +0000
+Subject: [PATCH] dt: Add camX_reg and camX_reg_gpio overrides to CM4S
+
+CM4S follows the pattern of CM1&3 for routing camera
+GPIO control, but didn't have the overrides defined to
+allow enabling and configuring the camera regulator
+GPIOs. Add them.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/bcm2711-rpi-cm4s.dts | 9 +++++++--
+ arch/arm/boot/dts/overlays/README      | 4 ++--
+ 2 files changed, 9 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm2711-rpi-cm4s.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-cm4s.dts
+@@ -403,12 +403,12 @@
+ };
+ 
+ &cam1_reg {
+-	gpio = <&gpio 2 GPIO_ACTIVE_HIGH>;
++	gpio = <&gpio 3 GPIO_ACTIVE_HIGH>;
+ 	status = "disabled";
+ };
+ 
+ cam0_reg: &cam0_regulator {
+-	gpio = <&gpio 30 GPIO_ACTIVE_HIGH>;
++	gpio = <&gpio 31 GPIO_ACTIVE_HIGH>;
+ 	status = "disabled";
+ };
+ 
+@@ -423,5 +423,10 @@ cam0_reg: &cam0_regulator {
+ 		sd_poll_once = <&emmc2>, "non-removable?";
+ 		spi_dma4 = <&spi0>, "dmas:0=", <&dma40>,
+ 			   <&spi0>, "dmas:8=", <&dma40>;
++
++		cam0_reg = <&cam0_reg>,"status";
++		cam0_reg_gpio = <&cam0_reg>,"gpio:4";
++		cam1_reg = <&cam1_reg>,"status";
++		cam1_reg_gpio = <&cam1_reg>,"gpio:4";
+ 	};
+ };
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -148,7 +148,7 @@ Params:
+                                 Only required on CM1 & 3.
+ 
+         cam0_reg_gpio           Set GPIO for CAM 0 regulator.
+-                                Default 31 on CM1 & 3.
++                                Default 31 on CM1, 3, and 4S.
+                                 Default of GPIO expander 5 on CM4, but override
+                                 switches to normal GPIO.
+ 
+@@ -156,7 +156,7 @@ Params:
+                                 Only required on CM1 & 3.
+ 
+         cam1_reg_gpio           Set GPIO for CAM 1 regulator.
+-                                Default 3 on CM1 & 3.
++                                Default 3 on CM1, 3, and 4S.
+                                 Default of GPIO expander 5 on CM4, but override
+                                 switches to normal GPIO.
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0519-overlays-Add-disable-emmc2.patch b/target/linux/bcm27xx/patches-6.1/950-0519-overlays-Add-disable-emmc2.patch
new file mode 100644
index 00000000000000..5b95bdf3502b01
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0519-overlays-Add-disable-emmc2.patch
@@ -0,0 +1,75 @@
+From 138d3b64a111b52f2cfe42c3ef84283bd281fae4 Mon Sep 17 00:00:00 2001
+From: Tim Gover <tim.gover@raspberrypi.com>
+Date: Fri, 16 Dec 2022 15:51:17 +0000
+Subject: [PATCH] overlays: Add disable-emmc2
+
+Add a new overlay that disables the EMMC2 controller on BCM2711.
+This can be useful on a Compute Module 4 if the onboard EMMC2
+storage is unreliable and the system can be booted by other
+means e.g Network / USB.
+
+Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/Makefile                 |  1 +
+ arch/arm/boot/dts/overlays/README                   |  8 ++++++++
+ .../arm/boot/dts/overlays/disable-emmc2-overlay.dts | 13 +++++++++++++
+ arch/arm/boot/dts/overlays/overlay_map.dts          |  4 ++++
+ 4 files changed, 26 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/disable-emmc2-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -49,6 +49,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	dionaudio-loco.dtbo \
+ 	dionaudio-loco-v2.dtbo \
+ 	disable-bt.dtbo \
++	disable-emmc2.dtbo \
+ 	disable-wifi.dtbo \
+ 	dpi18.dtbo \
+ 	dpi18cpadhi.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -895,6 +895,14 @@ Load:   dtoverlay=disable-bt
+ Params: <None>
+ 
+ 
++Name:   disable-emmc2
++Info:   Disable EMMC2 controller on BCM2711.
++        The allows the onboard EMMC storage on Compute Module 4 to be disabled
++        e.g. if a fault has occurred.
++Load:   dtoverlay=disable-emmc2
++Params: <None>
++
++
+ Name:   disable-wifi
+ Info:   Disable onboard WLAN on Pi 3B, 3B+, 3A+, 4B and Zero W.
+ Load:   dtoverlay=disable-wifi
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/disable-emmc2-overlay.dts
+@@ -0,0 +1,13 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&emmc2>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++};
+--- a/arch/arm/boot/dts/overlays/overlay_map.dts
++++ b/arch/arm/boot/dts/overlays/overlay_map.dts
+@@ -9,6 +9,10 @@
+ 		bcm2711;
+ 	};
+ 
++	disable-emmc2 {
++		bcm2711;
++	};
++
+ 	highperi {
+ 		bcm2711;
+ 	};
diff --git a/target/linux/bcm27xx/patches-6.1/950-0520-xhci-constrain-XHCI_VLI_HUB_TT_QUIRK-to-old-firmware.patch b/target/linux/bcm27xx/patches-6.1/950-0520-xhci-constrain-XHCI_VLI_HUB_TT_QUIRK-to-old-firmware.patch
new file mode 100644
index 00000000000000..662f2d360cf8e2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0520-xhci-constrain-XHCI_VLI_HUB_TT_QUIRK-to-old-firmware.patch
@@ -0,0 +1,53 @@
+From b5a62178cd25c598612036858df5934c4140d242 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Fri, 16 Dec 2022 15:18:21 +0000
+Subject: [PATCH] xhci: constrain XHCI_VLI_HUB_TT_QUIRK to old firmware
+ versions
+
+VLI have a firmware update for the VL805 which resolves the incorrect
+frame time calculation in the hub's TT. Limit applying the quirk to
+known-bad firmwares.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci-pci.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -27,6 +27,8 @@
+ #define SPARSE_DISABLE_BIT	17
+ #define SPARSE_CNTL_ENABLE	0xC12C
+ 
++#define VL805_FW_VER_0138C0	0x0138C0
++
+ /* Device for a quirk */
+ #define PCI_VENDOR_ID_FRESCO_LOGIC	0x1b73
+ #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK	0x1000
+@@ -104,6 +106,16 @@ static int xhci_pci_reinit(struct xhci_h
+ 	return 0;
+ }
+ 
++static u32 xhci_vl805_get_fw_version(struct pci_dev *dev)
++{
++	int ret;
++	u32 ver;
++
++	ret = pci_read_config_dword(dev, 0x50, &ver);
++	/* Default to a fw version of 0 instead of ~0 */
++	return ret ? 0 : ver;
++}
++
+ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ {
+ 	struct pci_dev                  *pdev = to_pci_dev(dev);
+@@ -299,7 +311,8 @@ static void xhci_pci_quirks(struct devic
+ 		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
+ 		xhci->quirks |= XHCI_VLI_TRB_CACHE_BUG;
+ 		xhci->quirks |= XHCI_VLI_SS_BULK_OUT_BUG;
+-		xhci->quirks |= XHCI_VLI_HUB_TT_QUIRK;
++		if (xhci_vl805_get_fw_version(pdev) < VL805_FW_VER_0138C0)
++			xhci->quirks |= XHCI_VLI_HUB_TT_QUIRK;
+ 	}
+ 
+ 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
diff --git a/target/linux/bcm27xx/patches-6.1/950-0521-drm-panel-simple-Add-Innolux-AT056tN53V1-5.6-VGA.patch b/target/linux/bcm27xx/patches-6.1/950-0521-drm-panel-simple-Add-Innolux-AT056tN53V1-5.6-VGA.patch
new file mode 100644
index 00000000000000..5ce1d8a190d43b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0521-drm-panel-simple-Add-Innolux-AT056tN53V1-5.6-VGA.patch
@@ -0,0 +1,177 @@
+From ca58a9eacc862c84c9caf066aaa32ea16195d2c2 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <8911409+pelwell@users.noreply.github.com>
+Date: Mon, 19 Dec 2022 16:32:33 +0000
+Subject: [PATCH] drm/panel: simple: Add Innolux AT056tN53V1 5.6" VGA
+
+Add support for the Innolux AT056tN53V1 5.6" VGA (640x480) TFT LCD
+panel.
+
+Signed-off-by: Joerg Quinten <aBUGSworstnightmare@gmail.com>
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .../bindings/display/panel/panel-simple.yaml  |  2 +
+ .../media/v4l/subdev-formats.rst              | 76 ++++++++++++++++++-
+ drivers/gpu/drm/panel/panel-simple.c          | 35 +++++++++
+ 3 files changed, 112 insertions(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/display/panel/panel-simple.yaml
++++ b/Documentation/devicetree/bindings/display/panel/panel-simple.yaml
+@@ -174,6 +174,8 @@ properties:
+       - ivo,m133nwf4-r0
+         # Innolux AT043TN24 4.3" WQVGA TFT LCD panel
+       - innolux,at043tn24
++        # Innolux AT056tN53V1 5.6" VGA (640x480) TFT LCD panel
++      - innolux,at056tn53v1
+         # Innolux AT070TN92 7.0" WQVGA TFT LCD panel
+       - innolux,at070tn92
+         # Innolux G070Y2-L01 7" WVGA (800x480) TFT LCD panel
+--- a/Documentation/userspace-api/media/v4l/subdev-formats.rst
++++ b/Documentation/userspace-api/media/v4l/subdev-formats.rst
+@@ -627,7 +627,7 @@ The following tables list existing packe
+     * .. _MEDIA_BUS_FMT_RGB565_1X24_CPADHI:
+ 
+       - MEDIA_BUS_FMT_RGB565_1X24_CPADHI
+-      - 0x1020
++      - 0x1022
+       -
+       -
+       -
+@@ -949,6 +949,43 @@ The following tables list existing packe
+       - g\ :sub:`5`
+       - g\ :sub:`4`
+       - g\ :sub:`3`
++    * .. _MEDIA-BUS-FMT-BGR666-1X18:
++
++      - MEDIA_BUS_FMT-BGR666_1X18
++      - 0x1023
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      - b\ :sub:`5`
++      - b\ :sub:`4`
++      - b\ :sub:`3`
++      - b\ :sub:`2`
++      - b\ :sub:`1`
++      - b\ :sub:`0`
++      - g\ :sub:`5`
++      - g\ :sub:`4`
++      - g\ :sub:`3`
++      - g\ :sub:`2`
++      - g\ :sub:`1`
++      - g\ :sub:`0`
++      - r\ :sub:`5`
++      - r\ :sub:`4`
++      - r\ :sub:`3`
++      - r\ :sub:`2`
++      - r\ :sub:`1`
++      - r\ :sub:`0`
+     * .. _MEDIA-BUS-FMT-RGB666-1X18:
+ 
+       - MEDIA_BUS_FMT_RGB666_1X18
+@@ -1023,6 +1060,43 @@ The following tables list existing packe
+       - g\ :sub:`2`
+       - g\ :sub:`1`
+       - g\ :sub:`0`
++    * .. _MEDIA-BUS-FMT-BGR666-1X24_CPADHI:
++
++      - MEDIA_BUS_FMT_BGR666_1X24_CPADHI
++      - 0x1024
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      - 0
++      - 0
++      - b\ :sub:`5`
++      - b\ :sub:`4`
++      - b\ :sub:`3`
++      - b\ :sub:`2`
++      - b\ :sub:`1`
++      - b\ :sub:`0`
++      - 0
++      - 0
++      - g\ :sub:`5`
++      - g\ :sub:`4`
++      - g\ :sub:`3`
++      - g\ :sub:`2`
++      - g\ :sub:`1`
++      - g\ :sub:`0`
++      - 0
++      - 0
++      - r\ :sub:`5`
++      - r\ :sub:`4`
++      - r\ :sub:`3`
++      - r\ :sub:`2`
++      - r\ :sub:`1`
++      - r\ :sub:`0`
+     * .. _MEDIA-BUS-FMT-RGB666-1X24_CPADHI:
+ 
+       - MEDIA_BUS_FMT_RGB666_1X24_CPADHI
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -2135,6 +2135,38 @@ static const struct panel_desc innolux_a
+ 	.bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE,
+ };
+ 
++static const struct display_timing innolux_at056tn53v1_timing = {
++	.pixelclock = { 39700000, 39700000, 39700000},
++	.hactive = { 640, 640, 640 },
++	.hfront_porch = { 16, 16, 16 },
++	.hback_porch = { 134, 134, 134 },
++	.hsync_len = { 10, 10, 10},
++	.vactive = { 480, 480, 480 },
++	.vfront_porch = { 32, 32, 32},
++	.vback_porch = { 11, 11, 11 },
++	.vsync_len = { 2, 2, 2 },
++	.flags = DRM_MODE_FLAG_PVSYNC | DRM_MODE_FLAG_PHSYNC,
++};
++
++static const struct panel_desc innolux_at056tn53v1 = {
++	.timings = &innolux_at056tn53v1_timing,
++	.num_timings = 1,
++	.bpc = 6,
++	.size = {
++		.width = 112,
++		.height = 84,
++	},
++	.delay = {
++		.prepare = 50,
++		.enable = 200,
++		.disable = 110,
++		.unprepare = 200,
++	},
++	.bus_format = MEDIA_BUS_FMT_BGR666_1X24_CPADHI,
++	.bus_flags = DRM_BUS_FLAG_PIXDATA_SAMPLE_POSEDGE,
++	.connector_type = DRM_MODE_CONNECTOR_DPI,
++};
++
+ static const struct drm_display_mode innolux_at070tn92_mode = {
+ 	.clock = 33333,
+ 	.hdisplay = 800,
+@@ -4139,6 +4171,9 @@ static const struct of_device_id platfor
+ 		.compatible = "innolux,at043tn24",
+ 		.data = &innolux_at043tn24,
+ 	}, {
++		.compatible = "innolux,at056tn53v1",
++		.data = &innolux_at056tn53v1,
++	}, {
+ 		.compatible = "innolux,at070tn92",
+ 		.data = &innolux_at070tn92,
+ 	}, {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0522-overlays-audremap-Fix-setting-of-the-pin-function.patch b/target/linux/bcm27xx/patches-6.1/950-0522-overlays-audremap-Fix-setting-of-the-pin-function.patch
new file mode 100644
index 00000000000000..2305c9f5c00067
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0522-overlays-audremap-Fix-setting-of-the-pin-function.patch
@@ -0,0 +1,33 @@
+From afb542abe9793ff22690244e6e07c5069f829628 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kotlenga <k.kotlenga@sims.pl>
+Date: Thu, 29 Dec 2022 19:14:32 +0100
+Subject: [PATCH] overlays: audremap: Fix setting of the pin function
+
+The brcm,function property must be set in the overlay fragment too -
+otherwise the parametrization won't work. At least that's the case for
+bcm2711-rpi-cm4.dts which starts with empty properties:
+
+&gpio {
+        audio_pins: audio_pins {
+                brcm,pins = <>;
+                brcm,function = <>;
+        };
+};
+
+This was broken since a56df85d2f42fd461fdc05f33617141aca5ba465.
+
+Signed-off-by: Krzysztof Kotlenga <k.kotlenga@sims.pl>
+---
+ arch/arm/boot/dts/overlays/audremap-overlay.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/boot/dts/overlays/audremap-overlay.dts
++++ b/arch/arm/boot/dts/overlays/audremap-overlay.dts
+@@ -8,6 +8,7 @@
+                 target = <&audio_pins>;
+                 frag0: __overlay__ {
+                         brcm,pins = <12 13>;
++                        brcm,function = <4>; /* alt0 alt0 */
+                 };
+         };
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0523-media-dt-bindings-Add-DW9817-to-DW9807-binding.patch b/target/linux/bcm27xx/patches-6.1/950-0523-media-dt-bindings-Add-DW9817-to-DW9807-binding.patch
new file mode 100644
index 00000000000000..e8e6c6ac4c2e57
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0523-media-dt-bindings-Add-DW9817-to-DW9807-binding.patch
@@ -0,0 +1,46 @@
+From 44511cf5030dc164dfb5bf523de28713fe0cfc0a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 3 Jan 2023 15:44:10 +0000
+Subject: [PATCH] media: dt-bindings: Add DW9817 to DW9807 binding
+
+The DW9817 is programmatically the same as DW9807, but
+the output drive is a bi-directional -100 to +100mA
+instead of 0-100mA.
+
+Add the appropriate compativle string.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../bindings/media/i2c/dongwoon,dw9807-vcm.yaml      | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/Documentation/devicetree/bindings/media/i2c/dongwoon,dw9807-vcm.yaml
++++ b/Documentation/devicetree/bindings/media/i2c/dongwoon,dw9807-vcm.yaml
+@@ -5,18 +5,24 @@
+ $id: http://devicetree.org/schemas/media/i2c/dongwoon,dw9807-vcm.yaml#
+ $schema: http://devicetree.org/meta-schemas/core.yaml#
+ 
+-title: Dongwoon Anatech DW9807 voice coil lens driver
++title: Dongwoon Anatech DW9807 and DW9817 voice coil lens driver
+ 
+ maintainers:
+   - Sakari Ailus <sakari.ailus@linux.intel.com>
+ 
+ description: |
+   DW9807 is a 10-bit DAC with current sink capability. It is intended for
+-  controlling voice coil lenses.
++  controlling voice coil lenses. The output drive is 0-100mA.
++  DW9817 is very similar as a 10-bit DAC with current sink capability,
++  however the output drive is a bidirection -100 to +100mA.
++
+ 
+ properties:
+   compatible:
+-    const: dongwoon,dw9807-vcm
++    items:
++      - enum:
++          - dongwoon,dw9807-vcm
++          - dongwoon,dw9817-vcm
+ 
+   reg:
+     maxItems: 1
diff --git a/target/linux/bcm27xx/patches-6.1/950-0524-media-dw9807-vcm-Add-support-for-DW9817-bidirectiona.patch b/target/linux/bcm27xx/patches-6.1/950-0524-media-dw9807-vcm-Add-support-for-DW9817-bidirectiona.patch
new file mode 100644
index 00000000000000..8521afad65ac9a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0524-media-dw9807-vcm-Add-support-for-DW9817-bidirectiona.patch
@@ -0,0 +1,223 @@
+From 2977dc08b02dd7097791a4d3c94796f33a165abc Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 3 Jan 2023 15:38:08 +0000
+Subject: [PATCH] media: dw9807-vcm: Add support for DW9817
+ bidirectional VCM driver
+
+The DW9817 is effectively the same as DW9807 from a programming
+interface, however it drives +/-100mA instead of 0-100mA. This means
+that the power on ramp needs to take the lens from the midpoint, and
+power off return it there. It also changes the default position for
+the module.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/dw9807-vcm.c | 115 +++++++++++++++++++++++++--------
+ 1 file changed, 88 insertions(+), 27 deletions(-)
+
+--- a/drivers/media/i2c/dw9807-vcm.c
++++ b/drivers/media/i2c/dw9807-vcm.c
+@@ -1,6 +1,14 @@
+ // SPDX-License-Identifier: GPL-2.0
+ // Copyright (C) 2018 Intel Corporation
+ 
++/*
++ * DW9807 is a 10-bit DAC driver, capable of sinking up to 100mA.
++ *
++ * DW9817 is a bidirectional 10-bit driver, driving up to +/- 100mA.
++ * Operationally it is identical to DW9807, except that the idle position is
++ * the mid-point, not 0.
++ */
++
+ #include <linux/acpi.h>
+ #include <linux/delay.h>
+ #include <linux/i2c.h>
+@@ -38,10 +46,16 @@
+ 
+ #define MAX_RETRY		10
+ 
++struct dw9807_cfg {
++	unsigned int idle_pos;
++	unsigned int default_pos;
++};
++
+ struct dw9807_device {
+ 	struct v4l2_ctrl_handler ctrls_vcm;
+ 	struct v4l2_subdev sd;
+ 	u16 current_val;
++	u16 idle_pos;
+ };
+ 
+ static inline struct dw9807_device *sd_to_dw9807_vcm(
+@@ -109,6 +123,40 @@ static int dw9807_set_dac(struct i2c_cli
+ 	return 0;
+ }
+ 
++/*
++ * The lens position is gradually moved in units of DW9807_CTRL_STEPS,
++ * to make the movements smoothly. In all cases, even when "start" and
++ * "end" are the same, the lens will be set to the "end" position.
++ *
++ * (We don't use hardware slew rate control, because it differs widely
++ * between otherwise-compatible ICs, and may need lens-specific tuning.)
++ */
++static int dw9807_ramp(struct i2c_client *client, int start, int end)
++{
++	int step, val, ret;
++
++	if (start < end)
++		step = DW9807_CTRL_STEPS;
++	else
++		step = -DW9807_CTRL_STEPS;
++
++	val = start;
++	while (true) {
++		val += step;
++		if (step * (val - end) >= 0)
++			val = end;
++		ret = dw9807_set_dac(client, val);
++		if (ret)
++			dev_err_ratelimited(&client->dev, "%s I2C failure: %d",
++					    __func__, ret);
++		if (val == end)
++			break;
++		usleep_range(DW9807_CTRL_DELAY_US, DW9807_CTRL_DELAY_US + 10);
++	}
++
++	return ret;
++}
++
+ static int dw9807_set_ctrl(struct v4l2_ctrl *ctrl)
+ {
+ 	struct dw9807_device *dev_vcm = container_of(ctrl->handler,
+@@ -118,7 +166,7 @@ static int dw9807_set_ctrl(struct v4l2_c
+ 		struct i2c_client *client = v4l2_get_subdevdata(&dev_vcm->sd);
+ 
+ 		dev_vcm->current_val = ctrl->val;
+-		return dw9807_set_dac(client, ctrl->val);
++		return dw9807_ramp(client, ctrl->val, ctrl->val);
+ 	}
+ 
+ 	return -EINVAL;
+@@ -163,7 +211,8 @@ static int dw9807_init_controls(struct d
+ 	v4l2_ctrl_handler_init(hdl, 1);
+ 
+ 	v4l2_ctrl_new_std(hdl, ops, V4L2_CID_FOCUS_ABSOLUTE,
+-			  0, DW9807_MAX_FOCUS_POS, DW9807_FOCUS_STEPS, 0);
++			  0, DW9807_MAX_FOCUS_POS, DW9807_FOCUS_STEPS,
++			  dev_vcm->current_val);
+ 
+ 	dev_vcm->sd.ctrl_handler = hdl;
+ 	if (hdl->error) {
+@@ -175,9 +224,32 @@ static int dw9807_init_controls(struct d
+ 	return 0;
+ }
+ 
++/* Compatible devices; in fact there are many similar chips.
++ * "data" holds the powered-off (zero current) lens position and a
++ * default/initial control value (which need not be the same as the powered-off
++ * value).
++ */
++static const struct dw9807_cfg dw9807_cfg = {
++	.idle_pos = 0,
++	.default_pos = 0
++};
++
++static const struct dw9807_cfg dw9817_cfg = {
++	.idle_pos = 512,
++	.default_pos = 480,
++};
++
++static const struct of_device_id dw9807_of_table[] = {
++	{ .compatible = "dongwoon,dw9807-vcm", .data = &dw9807_cfg },
++	{ .compatible = "dongwoon,dw9817-vcm", .data = &dw9817_cfg },
++	{ /* sentinel */ }
++};
++
+ static int dw9807_probe(struct i2c_client *client)
+ {
+ 	struct dw9807_device *dw9807_dev;
++	const struct of_device_id *match;
++	const struct dw9807_cfg *cfg;
+ 	int rval;
+ 
+ 	dw9807_dev = devm_kzalloc(&client->dev, sizeof(*dw9807_dev),
+@@ -185,6 +257,13 @@ static int dw9807_probe(struct i2c_clien
+ 	if (dw9807_dev == NULL)
+ 		return -ENOMEM;
+ 
++	match = i2c_of_match_device(dw9807_of_table, client);
++	if (match) {
++		cfg = (const struct dw9807_cfg *)match->data;
++		dw9807_dev->idle_pos = cfg->idle_pos;
++		dw9807_dev->current_val = cfg->default_pos;
++	}
++
+ 	v4l2_i2c_subdev_init(&dw9807_dev->sd, client, &dw9807_ops);
+ 	dw9807_dev->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
+ 	dw9807_dev->sd.internal_ops = &dw9807_int_ops;
+@@ -203,7 +282,8 @@ static int dw9807_probe(struct i2c_clien
+ 	if (rval < 0)
+ 		goto err_cleanup;
+ 
+-	pm_runtime_set_active(&client->dev);
++	if (!dw9807_dev->vdd)
++		pm_runtime_set_active(&client->dev);
+ 	pm_runtime_enable(&client->dev);
+ 	pm_runtime_idle(&client->dev);
+ 
+@@ -237,15 +317,10 @@ static int __maybe_unused dw9807_vcm_sus
+ 	struct v4l2_subdev *sd = i2c_get_clientdata(client);
+ 	struct dw9807_device *dw9807_dev = sd_to_dw9807_vcm(sd);
+ 	const char tx_data[2] = { DW9807_CTL_ADDR, 0x01 };
+-	int ret, val;
++	int ret;
+ 
+-	for (val = dw9807_dev->current_val & ~(DW9807_CTRL_STEPS - 1);
+-	     val >= 0; val -= DW9807_CTRL_STEPS) {
+-		ret = dw9807_set_dac(client, val);
+-		if (ret)
+-			dev_err_once(dev, "%s I2C failure: %d", __func__, ret);
+-		usleep_range(DW9807_CTRL_DELAY_US, DW9807_CTRL_DELAY_US + 10);
+-	}
++	if (abs(dw9807_dev->current_val - dw9807_dev->idle_pos) > DW9807_CTRL_STEPS)
++		dw9807_ramp(client, dw9807_dev->current_val, dw9807_dev->idle_pos);
+ 
+ 	/* Power down */
+ 	ret = i2c_master_send(client, tx_data, sizeof(tx_data));
+@@ -269,7 +344,7 @@ static int  __maybe_unused dw9807_vcm_re
+ 	struct v4l2_subdev *sd = i2c_get_clientdata(client);
+ 	struct dw9807_device *dw9807_dev = sd_to_dw9807_vcm(sd);
+ 	const char tx_data[2] = { DW9807_CTL_ADDR, 0x00 };
+-	int ret, val;
++	int ret;
+ 
+ 	/* Power on */
+ 	ret = i2c_master_send(client, tx_data, sizeof(tx_data));
+@@ -278,25 +353,11 @@ static int  __maybe_unused dw9807_vcm_re
+ 		return ret;
+ 	}
+ 
+-	for (val = dw9807_dev->current_val % DW9807_CTRL_STEPS;
+-	     val < dw9807_dev->current_val + DW9807_CTRL_STEPS - 1;
+-	     val += DW9807_CTRL_STEPS) {
+-		ret = dw9807_set_dac(client, val);
+-		if (ret)
+-			dev_err_ratelimited(dev, "%s I2C failure: %d",
+-						__func__, ret);
+-		usleep_range(DW9807_CTRL_DELAY_US, DW9807_CTRL_DELAY_US + 10);
+-	}
++	dw9807_ramp(client, dw9807_dev->idle_pos, dw9807_dev->current_val);
+ 
+ 	return 0;
+ }
+ 
+-static const struct of_device_id dw9807_of_table[] = {
+-	{ .compatible = "dongwoon,dw9807-vcm" },
+-	/* Compatibility for older firmware, NEVER USE THIS IN FIRMWARE! */
+-	{ .compatible = "dongwoon,dw9807" },
+-	{ /* sentinel */ }
+-};
+ MODULE_DEVICE_TABLE(of, dw9807_of_table);
+ 
+ static const struct dev_pm_ops dw9807_pm_ops = {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0525-media-dt-bindings-Add-regulator-to-dw9807-vcm.patch b/target/linux/bcm27xx/patches-6.1/950-0525-media-dt-bindings-Add-regulator-to-dw9807-vcm.patch
new file mode 100644
index 00000000000000..13d9175644065c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0525-media-dt-bindings-Add-regulator-to-dw9807-vcm.patch
@@ -0,0 +1,40 @@
+From d2b7bb49d170cecb5c4f3e8df19b7b2a2891e4ce Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 3 Jan 2023 16:41:08 +0000
+Subject: [PATCH] media: dt-bindings: Add regulator to dw9807-vcm
+
+The VCM driver will often be controlled via a regulator,
+therefore add in the relevant DT hooks.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../devicetree/bindings/media/i2c/dongwoon,dw9807-vcm.yaml    | 4 ++++
+ drivers/media/i2c/dw9807-vcm.c                                | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+--- a/Documentation/devicetree/bindings/media/i2c/dongwoon,dw9807-vcm.yaml
++++ b/Documentation/devicetree/bindings/media/i2c/dongwoon,dw9807-vcm.yaml
+@@ -27,6 +27,10 @@ properties:
+   reg:
+     maxItems: 1
+ 
++  VDD-supply:
++    description:
++      Definition of the regulator used as VDD power supply to the driver.
++
+ required:
+   - compatible
+   - reg
+--- a/drivers/media/i2c/dw9807-vcm.c
++++ b/drivers/media/i2c/dw9807-vcm.c
+@@ -301,6 +301,10 @@ static void dw9807_remove(struct i2c_cli
+ 	struct v4l2_subdev *sd = i2c_get_clientdata(client);
+ 	struct dw9807_device *dw9807_dev = sd_to_dw9807_vcm(sd);
+ 
++	if (dw9807_dev->vdd)
++		regulator_unregister_notifier(dw9807_dev->vdd,
++					      &dw9807_dev->notifier);
++
+ 	pm_runtime_disable(&client->dev);
+ 
+ 	dw9807_subdev_cleanup(dw9807_dev);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0526-media-dw9807-vcm-Add-regulator-support-to-the-driver.patch b/target/linux/bcm27xx/patches-6.1/950-0526-media-dw9807-vcm-Add-regulator-support-to-the-driver.patch
new file mode 100644
index 00000000000000..aa814c7e1c7a06
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0526-media-dw9807-vcm-Add-regulator-support-to-the-driver.patch
@@ -0,0 +1,187 @@
+From 441e1fbef6c33549520b52ff357682b6fe7e8646 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 3 Jan 2023 16:35:59 +0000
+Subject: [PATCH] media: dw9807-vcm: Add regulator support to the
+ driver
+
+Uses the regulator notifier framework so that the current
+focus position will be restored whenever any user of the
+regulator powers it up. This means that should the VCM
+and sensor share a common regulator then starting the sensor
+will automatically restore the default position. If they
+have independent regulators then it will behave be powered
+up when the VCM subdev is opened.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/dw9807-vcm.c | 113 ++++++++++++++++++++++++++-------
+ 1 file changed, 90 insertions(+), 23 deletions(-)
+
+--- a/drivers/media/i2c/dw9807-vcm.c
++++ b/drivers/media/i2c/dw9807-vcm.c
+@@ -15,6 +15,7 @@
+ #include <linux/iopoll.h>
+ #include <linux/module.h>
+ #include <linux/pm_runtime.h>
++#include <linux/regulator/consumer.h>
+ #include <media/v4l2-ctrls.h>
+ #include <media/v4l2-device.h>
+ 
+@@ -46,6 +47,9 @@
+ 
+ #define MAX_RETRY		10
+ 
++#define DW9807_PW_MIN_DELAY_US		100
++#define DW9807_PW_DELAY_RANGE_US	10
++
+ struct dw9807_cfg {
+ 	unsigned int idle_pos;
+ 	unsigned int default_pos;
+@@ -56,6 +60,8 @@ struct dw9807_device {
+ 	struct v4l2_subdev sd;
+ 	u16 current_val;
+ 	u16 idle_pos;
++	struct regulator *vdd;
++	struct notifier_block notifier;
+ };
+ 
+ static inline struct dw9807_device *sd_to_dw9807_vcm(
+@@ -157,6 +163,66 @@ static int dw9807_ramp(struct i2c_client
+ 	return ret;
+ }
+ 
++static int dw9807_active(struct dw9807_device *dw9807_dev)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&dw9807_dev->sd);
++	const char tx_data[2] = { DW9807_CTL_ADDR, 0x00 };
++	int ret;
++
++	/* Power on */
++	ret = i2c_master_send(client, tx_data, sizeof(tx_data));
++	if (ret < 0) {
++		dev_err(&client->dev, "I2C write CTL fail ret = %d\n", ret);
++		return ret;
++	}
++
++	return dw9807_ramp(client, dw9807_dev->idle_pos, dw9807_dev->current_val);
++}
++
++static int dw9807_standby(struct dw9807_device *dw9807_dev)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&dw9807_dev->sd);
++	const char tx_data[2] = { DW9807_CTL_ADDR, 0x01 };
++	int ret;
++
++	if (abs(dw9807_dev->current_val - dw9807_dev->idle_pos) > DW9807_CTRL_STEPS)
++		dw9807_ramp(client, dw9807_dev->current_val, dw9807_dev->idle_pos);
++
++	/* Power down */
++	ret = i2c_master_send(client, tx_data, sizeof(tx_data));
++	if (ret < 0) {
++		dev_err(&client->dev, "I2C write CTL fail ret = %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++static int dw9807_regulator_event(struct notifier_block *nb,
++				  unsigned long action, void *data)
++{
++	struct dw9807_device *dw9807_dev =
++		container_of(nb, struct dw9807_device, notifier);
++
++	if (action & REGULATOR_EVENT_ENABLE) {
++		/*
++		 * Initialisation delay between VDD low->high and the moment
++		 * when the i2c command is available.
++		 * From the datasheet, it should be 10ms + 2ms (max power
++		 * up sequence duration)
++		 */
++		usleep_range(DW9807_PW_MIN_DELAY_US,
++			     DW9807_PW_MIN_DELAY_US +
++			     DW9807_PW_DELAY_RANGE_US);
++
++		dw9807_active(dw9807_dev);
++	} else if (action & REGULATOR_EVENT_PRE_DISABLE) {
++		dw9807_standby(dw9807_dev);
++	}
++
++	return 0;
++}
++
+ static int dw9807_set_ctrl(struct v4l2_ctrl *ctrl)
+ {
+ 	struct dw9807_device *dev_vcm = container_of(ctrl->handler,
+@@ -257,6 +323,24 @@ static int dw9807_probe(struct i2c_clien
+ 	if (dw9807_dev == NULL)
+ 		return -ENOMEM;
+ 
++	dw9807_dev->vdd = devm_regulator_get_optional(&client->dev, "VDD");
++	if (IS_ERR(dw9807_dev->vdd)) {
++		if (PTR_ERR(dw9807_dev->vdd) != -ENODEV)
++			return PTR_ERR(dw9807_dev->vdd);
++
++		dw9807_dev->vdd = NULL;
++	} else {
++		dw9807_dev->notifier.notifier_call = dw9807_regulator_event;
++
++		rval = regulator_register_notifier(dw9807_dev->vdd,
++						   &dw9807_dev->notifier);
++		if (rval) {
++			dev_err(&client->dev,
++				"could not register regulator notifier\n");
++			return rval;
++		}
++	}
++
+ 	match = i2c_of_match_device(dw9807_of_table, client);
+ 	if (match) {
+ 		cfg = (const struct dw9807_cfg *)match->data;
+@@ -320,20 +404,11 @@ static int __maybe_unused dw9807_vcm_sus
+ 	struct i2c_client *client = to_i2c_client(dev);
+ 	struct v4l2_subdev *sd = i2c_get_clientdata(client);
+ 	struct dw9807_device *dw9807_dev = sd_to_dw9807_vcm(sd);
+-	const char tx_data[2] = { DW9807_CTL_ADDR, 0x01 };
+-	int ret;
+-
+-	if (abs(dw9807_dev->current_val - dw9807_dev->idle_pos) > DW9807_CTRL_STEPS)
+-		dw9807_ramp(client, dw9807_dev->current_val, dw9807_dev->idle_pos);
+ 
+-	/* Power down */
+-	ret = i2c_master_send(client, tx_data, sizeof(tx_data));
+-	if (ret < 0) {
+-		dev_err(&client->dev, "I2C write CTL fail ret = %d\n", ret);
+-		return ret;
+-	}
++	if (dw9807_dev->vdd)
++		return regulator_disable(dw9807_dev->vdd);
+ 
+-	return 0;
++	return dw9807_standby(dw9807_dev);
+ }
+ 
+ /*
+@@ -347,19 +422,11 @@ static int  __maybe_unused dw9807_vcm_re
+ 	struct i2c_client *client = to_i2c_client(dev);
+ 	struct v4l2_subdev *sd = i2c_get_clientdata(client);
+ 	struct dw9807_device *dw9807_dev = sd_to_dw9807_vcm(sd);
+-	const char tx_data[2] = { DW9807_CTL_ADDR, 0x00 };
+-	int ret;
+-
+-	/* Power on */
+-	ret = i2c_master_send(client, tx_data, sizeof(tx_data));
+-	if (ret < 0) {
+-		dev_err(&client->dev, "I2C write CTL fail ret = %d\n", ret);
+-		return ret;
+-	}
+ 
+-	dw9807_ramp(client, dw9807_dev->idle_pos, dw9807_dev->current_val);
++	if (dw9807_dev->vdd)
++		return regulator_enable(dw9807_dev->vdd);
+ 
+-	return 0;
++	return dw9807_active(dw9807_dev);
+ }
+ 
+ MODULE_DEVICE_TABLE(of, dw9807_of_table);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0527-media-dw9807-vcm-Smooth-the-first-user-movement-of-t.patch b/target/linux/bcm27xx/patches-6.1/950-0527-media-dw9807-vcm-Smooth-the-first-user-movement-of-t.patch
new file mode 100644
index 00000000000000..60c25d60232fad
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0527-media-dw9807-vcm-Smooth-the-first-user-movement-of-t.patch
@@ -0,0 +1,49 @@
+From a701a312ff709f0dcd6862be6e8fcc328379c4d1 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 3 Jan 2023 16:53:37 +0000
+Subject: [PATCH] media: dw9807-vcm: Smooth the first user movement of
+ the lens
+
+The power up/down sequence is already ramped. Extend this to
+the first user movement as well, as this will generally avoid
+the "tick" noises due to rapid movements and overshooting.
+Subsequent movements are generally smaller and so don't cause
+issues.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/dw9807-vcm.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/dw9807-vcm.c
++++ b/drivers/media/i2c/dw9807-vcm.c
+@@ -62,6 +62,7 @@ struct dw9807_device {
+ 	u16 idle_pos;
+ 	struct regulator *vdd;
+ 	struct notifier_block notifier;
++	bool first;
+ };
+ 
+ static inline struct dw9807_device *sd_to_dw9807_vcm(
+@@ -176,6 +177,8 @@ static int dw9807_active(struct dw9807_d
+ 		return ret;
+ 	}
+ 
++	dw9807_dev->first = true;
++
+ 	return dw9807_ramp(client, dw9807_dev->idle_pos, dw9807_dev->current_val);
+ }
+ 
+@@ -230,9 +233,11 @@ static int dw9807_set_ctrl(struct v4l2_c
+ 
+ 	if (ctrl->id == V4L2_CID_FOCUS_ABSOLUTE) {
+ 		struct i2c_client *client = v4l2_get_subdevdata(&dev_vcm->sd);
++		int start = (dev_vcm->first) ? dev_vcm->current_val : ctrl->val;
+ 
++		dev_vcm->first = false;
+ 		dev_vcm->current_val = ctrl->val;
+-		return dw9807_ramp(client, ctrl->val, ctrl->val);
++		return dw9807_ramp(client, start, ctrl->val);
+ 	}
+ 
+ 	return -EINVAL;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0528-dtbindings-media-i2c-Add-IMX708-CMOS-sensor-binding.patch b/target/linux/bcm27xx/patches-6.1/950-0528-dtbindings-media-i2c-Add-IMX708-CMOS-sensor-binding.patch
new file mode 100644
index 00000000000000..2e6188af4bb617
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0528-dtbindings-media-i2c-Add-IMX708-CMOS-sensor-binding.patch
@@ -0,0 +1,155 @@
+From 27a49357c8dc582428cc7a7c80b39da157bf3f66 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 22 Dec 2022 14:08:35 +0000
+Subject: [PATCH] dtbindings: media: i2c: Add IMX708 CMOS sensor
+ binding
+
+Add YAML devicetree binding for IMX708 CMOS image sensor.
+Let's also add a MAINTAINERS entry for the binding and driver.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../devicetree/bindings/media/i2c/imx708.yaml | 119 ++++++++++++++++++
+ MAINTAINERS                                   |   8 ++
+ 2 files changed, 127 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/imx708.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/imx708.yaml
+@@ -0,0 +1,119 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/media/i2c/imx708.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Sony 1/2.3-Inch 12Mpixel CMOS Digital Image Sensor
++
++maintainers:
++  - Naushir Patuck <naush@raspberypi.com>
++
++description: |-
++  The Sony IMX708 is a 1/2.3-inch CMOS active pixel digital image sensor
++  with an active array size of 4608H x 2592V. It is programmable through
++  I2C interface. The I2C address is fixed to 0x1A as per sensor data sheet.
++  Image data is sent through MIPI CSI-2, which is configured as either 2 or
++  4 data lanes.
++
++properties:
++  compatible:
++    const: sony,imx708
++
++  reg:
++    description: I2C device address
++    maxItems: 1
++
++  clocks:
++    maxItems: 1
++
++  VDIG-supply:
++    description:
++      Digital I/O voltage supply, 1.1 volts
++
++  VANA1-supply:
++    description:
++      Analog1 voltage supply, 2.8 volts
++
++  VANA2-supply:
++    description:
++      Analog2 voltage supply, 1.8 volts
++
++  VDDL-supply:
++    description:
++      Digital core voltage supply, 1.8 volts
++
++  reset-gpios:
++    description: |-
++      Reference to the GPIO connected to the xclr pin, if any.
++      Must be released (set high) after all supplies and INCK are applied.
++
++  # See ../video-interfaces.txt for more details
++  port:
++    type: object
++    properties:
++      endpoint:
++        type: object
++        properties:
++          data-lanes:
++            description: |-
++              The sensor supports either two-lane, or four-lane operation.
++              For two-lane operation the property must be set to <1 2>.
++            items:
++              - const: 1
++              - const: 2
++
++          clock-noncontinuous:
++            type: boolean
++            description: |-
++              MIPI CSI-2 clock is non-continuous if this property is present,
++              otherwise it's continuous.
++
++          link-frequencies:
++            allOf:
++              - $ref: /schemas/types.yaml#/definitions/uint64-array
++            description:
++              Allowed data bus frequencies.
++
++        required:
++          - link-frequencies
++
++required:
++  - compatible
++  - reg
++  - clocks
++  - VANA1-supply
++  - VANA2-supply
++  - VDIG-supply
++  - VDDL-supply
++  - port
++
++additionalProperties: false
++
++examples:
++  - |
++    i2c0 {
++        #address-cells = <1>;
++        #size-cells = <0>;
++
++        imx708: sensor@1a {
++            compatible = "sony,imx708";
++            reg = <0x1a>;
++            clocks = <&imx708_clk>;
++            VANA1-supply = <&imx708_vana1>; /* 1.8v */
++            VANA2-supply = <&imx708_vana2>; /* 2.8v */
++            VDIG-supply = <&imx708_vdig>;   /* 1.1v */
++            VDDL-supply = <&imx708_vddl>;   /* 1.8v */
++
++            port {
++                imx708_0: endpoint {
++                    remote-endpoint = <&csi1_ep>;
++                    data-lanes = <1 2>;
++                    clock-noncontinuous;
++                    link-frequencies = /bits/ 64 <450000000>;
++                };
++            };
++        };
++    };
++
++...
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -19328,6 +19328,14 @@ T:	git git://linuxtv.org/media_tree.git
+ F:	Documentation/devicetree/bindings/media/i2c/imx519.yaml
+ F:	drivers/media/i2c/imx519.c
+ 
++SONY IMX708 SENSOR DRIVER
++M:	Raspberry Pi Kernel Maintenance <kernel-list@raspberrypi.com>
++L:	linux-media@vger.kernel.org
++S:	Maintained
++T:	git git://linuxtv.org/media_tree.git
++F:	Documentation/devicetree/bindings/media/i2c/imx708.yaml
++F:	drivers/media/i2c/imx708.c
++
+ SONY MEMORYSTICK SUBSYSTEM
+ M:	Maxim Levitsky <maximlevitsky@gmail.com>
+ M:	Alex Dubov <oakad@yahoo.com>
diff --git a/target/linux/bcm27xx/patches-6.1/950-0529-media-i2c-Add-a-driver-for-the-Sony-IMX708-image-sen.patch b/target/linux/bcm27xx/patches-6.1/950-0529-media-i2c-Add-a-driver-for-the-Sony-IMX708-image-sen.patch
new file mode 100644
index 00000000000000..1f8cda317893e1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0529-media-i2c-Add-a-driver-for-the-Sony-IMX708-image-sen.patch
@@ -0,0 +1,2045 @@
+From e97a08baa18802bb3704e1dfda87193417d5fa58 Mon Sep 17 00:00:00 2001
+From: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+Date: Thu, 22 Dec 2022 13:59:33 +0000
+Subject: [PATCH] media/i2c: Add a driver for the Sony IMX708 image
+ sensor
+
+The imx708 is a 12MP MIPI sensor with a 16:9 aspect ratio, here using
+two CSI-2 lanes. It is a "quad Bayer" sensor with all 3 modes offering
+10-bit output:
+
+12MP: 4608x2592 up to 14.35fps (full FoV)
+1080p: 2304x1296 up to 56.02fps (full FoV)
+720p: 1536x864 up to 120.12fps (cropped)
+
+This imx708 sensor driver is based heavily on the imx477 driver and
+has been tested on the Raspberry Pi platform using libcamera.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/Kconfig  |   13 +
+ drivers/media/i2c/Makefile |    1 +
+ drivers/media/i2c/imx708.c | 1984 ++++++++++++++++++++++++++++++++++++
+ 3 files changed, 1998 insertions(+)
+ create mode 100644 drivers/media/i2c/imx708.c
+
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -261,6 +261,19 @@ config VIDEO_IMX519
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called IMX519.
+ 
++config VIDEO_IMX708
++	tristate "Sony IMX708 sensor support"
++	depends on I2C && VIDEO_DEV
++	select MEDIA_CONTROLLER
++	select VIDEO_V4L2_SUBDEV_API
++	select V4L2_FWNODE
++	help
++	  This is a Video4Linux2 sensor driver for the Sony
++	  IMX708 camera.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called imx708.
++
+ config VIDEO_MAX9271_LIB
+ 	tristate
+ 
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -53,6 +53,7 @@ obj-$(CONFIG_VIDEO_IMX355) += imx355.o
+ obj-$(CONFIG_VIDEO_IMX412) += imx412.o
+ obj-$(CONFIG_VIDEO_IMX477) += imx477.o
+ obj-$(CONFIG_VIDEO_IMX519) += imx519.o
++obj-$(CONFIG_VIDEO_IMX708) += imx708.o
+ obj-$(CONFIG_VIDEO_IR_I2C) += ir-kbd-i2c.o
+ obj-$(CONFIG_VIDEO_IRS1125) += irs1125.o
+ obj-$(CONFIG_VIDEO_ISL7998X) += isl7998x.o
+--- /dev/null
++++ b/drivers/media/i2c/imx708.c
+@@ -0,0 +1,1984 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * A V4L2 driver for Sony IMX708 cameras.
++ * Copyright (C) 2022, Raspberry Pi Ltd
++ *
++ * Based on Sony imx477 camera driver
++ * Copyright (C) 2020 Raspberry Pi Ltd
++ */
++#include <asm/unaligned.h>
++#include <linux/clk.h>
++#include <linux/delay.h>
++#include <linux/gpio/consumer.h>
++#include <linux/i2c.h>
++#include <linux/module.h>
++#include <linux/pm_runtime.h>
++#include <linux/regulator/consumer.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-fwnode.h>
++#include <media/v4l2-mediabus.h>
++
++#define IMX708_REG_VALUE_08BIT		1
++#define IMX708_REG_VALUE_16BIT		2
++
++/* Chip ID */
++#define IMX708_REG_CHIP_ID		0x0016
++#define IMX708_CHIP_ID			0x0708
++
++#define IMX708_REG_MODE_SELECT		0x0100
++#define IMX708_MODE_STANDBY		0x00
++#define IMX708_MODE_STREAMING		0x01
++
++#define IMX708_REG_ORIENTATION		0x101
++
++#define IMX708_XCLK_FREQ		24000000
++
++#define IMX708_DEFAULT_LINK_FREQ	450000000
++
++/* Default initial pixel rate, will get updated for each mode. */
++#define IMX708_INITIAL_PIXEL_RATE	590000000
++
++/* V_TIMING internal */
++#define IMX708_REG_FRAME_LENGTH		0x0340
++#define IMX708_FRAME_LENGTH_MAX		0xffff
++
++/* Exposure control */
++#define IMX708_REG_EXPOSURE		0x0202
++#define IMX708_EXPOSURE_OFFSET		48
++#define IMX708_EXPOSURE_DEFAULT		0x640
++#define IMX708_EXPOSURE_STEP		1
++#define IMX708_EXPOSURE_MIN		1
++#define IMX708_EXPOSURE_MAX		(IMX708_FRAME_LENGTH_MAX - \
++					 IMX708_EXPOSURE_OFFSET)
++
++/* Analog gain control */
++#define IMX708_REG_ANALOG_GAIN		0x0204
++#define IMX708_ANA_GAIN_MIN		112
++#define IMX708_ANA_GAIN_MAX		960
++#define IMX708_ANA_GAIN_STEP		1
++#define IMX708_ANA_GAIN_DEFAULT	   IMX708_ANA_GAIN_MIN
++
++/* Digital gain control */
++#define IMX708_REG_DIGITAL_GAIN		0x020e
++#define IMX708_DGTL_GAIN_MIN		0x0100
++#define IMX708_DGTL_GAIN_MAX		0xffff
++#define IMX708_DGTL_GAIN_DEFAULT	0x0100
++#define IMX708_DGTL_GAIN_STEP		1
++
++/* Colour balance controls */
++#define IMX708_REG_COLOUR_BALANCE_RED   0x0b90
++#define IMX708_REG_COLOUR_BALANCE_BLUE	0x0b92
++#define IMX708_COLOUR_BALANCE_MIN	0x01
++#define IMX708_COLOUR_BALANCE_MAX	0xffff
++#define IMX708_COLOUR_BALANCE_STEP	0x01
++#define IMX708_COLOUR_BALANCE_DEFAULT	0x100
++
++/* Test Pattern Control */
++#define IMX708_REG_TEST_PATTERN		0x0600
++#define IMX708_TEST_PATTERN_DISABLE	0
++#define IMX708_TEST_PATTERN_SOLID_COLOR	1
++#define IMX708_TEST_PATTERN_COLOR_BARS	2
++#define IMX708_TEST_PATTERN_GREY_COLOR	3
++#define IMX708_TEST_PATTERN_PN9		4
++
++/* Test pattern colour components */
++#define IMX708_REG_TEST_PATTERN_R	0x0602
++#define IMX708_REG_TEST_PATTERN_GR	0x0604
++#define IMX708_REG_TEST_PATTERN_B	0x0606
++#define IMX708_REG_TEST_PATTERN_GB	0x0608
++#define IMX708_TEST_PATTERN_COLOUR_MIN	0
++#define IMX708_TEST_PATTERN_COLOUR_MAX	0x0fff
++#define IMX708_TEST_PATTERN_COLOUR_STEP	1
++
++#define IMX708_REG_BASE_SPC_GAINS_L	0x7b10
++#define IMX708_REG_BASE_SPC_GAINS_R	0x7c00
++
++/* HDR exposure ratio (long:med == med:short) */
++#define IMX708_HDR_EXPOSURE_RATIO       4
++#define IMX708_REG_MID_EXPOSURE	0x3116
++#define IMX708_REG_SHT_EXPOSURE	0x0224
++#define IMX708_REG_MID_ANALOG_GAIN	0x3118
++#define IMX708_REG_SHT_ANALOG_GAIN	0x0216
++
++/*
++ * Metadata buffer holds a variety of data, all sent with the same VC/DT (0x12).
++ * It comprises two scanlines (of up to 5760 bytes each, for 4608 pixels)
++ * of embedded data, one line of PDAF data, and two lines of AE-HIST data
++ * (AE histograms are valid for HDR mode and empty in non-HDR modes).
++ */
++#define IMX708_EMBEDDED_LINE_WIDTH (5 * 5760)
++#define IMX708_NUM_EMBEDDED_LINES 1
++
++enum pad_types {
++	IMAGE_PAD,
++	METADATA_PAD,
++	NUM_PADS
++};
++
++/* IMX708 native and active pixel array size. */
++#define IMX708_NATIVE_WIDTH		4640U
++#define IMX708_NATIVE_HEIGHT		2658U
++#define IMX708_PIXEL_ARRAY_LEFT		16U
++#define IMX708_PIXEL_ARRAY_TOP		24U
++#define IMX708_PIXEL_ARRAY_WIDTH	4608U
++#define IMX708_PIXEL_ARRAY_HEIGHT	2592U
++
++struct imx708_reg {
++	u16 address;
++	u8 val;
++};
++
++struct imx708_reg_list {
++	unsigned int num_of_regs;
++	const struct imx708_reg *regs;
++};
++
++/* Mode : resolution and related config&values */
++struct imx708_mode {
++	/* Frame width */
++	unsigned int width;
++
++	/* Frame height */
++	unsigned int height;
++
++	/* H-timing in pixels */
++	unsigned int line_length_pix;
++
++	/* Analog crop rectangle. */
++	struct v4l2_rect crop;
++
++	/* Highest possible framerate. */
++	unsigned int vblank_min;
++
++	/* Default framerate. */
++	unsigned int vblank_default;
++
++	/* Default register values */
++	struct imx708_reg_list reg_list;
++
++	/* Not all modes have the same pixel rate. */
++	u64 pixel_rate;
++
++	/* Not all modes have the same minimum exposure. */
++	u32 exposure_lines_min;
++
++	/* Not all modes have the same exposure lines step. */
++	u32 exposure_lines_step;
++
++	/* HDR flag, currently not used at runtime */
++	bool hdr;
++};
++
++/* Default PDAF pixel correction gains */
++static const u8 pdaf_gains[2][9] = {
++	{ 0x4c, 0x4c, 0x4c, 0x46, 0x3e, 0x38, 0x35, 0x35, 0x35 },
++	{ 0x35, 0x35, 0x35, 0x38, 0x3e, 0x46, 0x4c, 0x4c, 0x4c }
++};
++
++static const struct imx708_reg mode_common_regs[] = {
++	{0x0100, 0x00},
++	{0x0136, 0x18},
++	{0x0137, 0x00},
++	{0x33F0, 0x02},
++	{0x33F1, 0x05},
++	{0x3062, 0x00},
++	{0x3063, 0x12},
++	{0x3068, 0x00},
++	{0x3069, 0x12},
++	{0x306A, 0x00},
++	{0x306B, 0x30},
++	{0x3076, 0x00},
++	{0x3077, 0x30},
++	{0x3078, 0x00},
++	{0x3079, 0x30},
++	{0x5E54, 0x0C},
++	{0x6E44, 0x00},
++	{0xB0B6, 0x01},
++	{0xE829, 0x00},
++	{0xF001, 0x08},
++	{0xF003, 0x08},
++	{0xF00D, 0x10},
++	{0xF00F, 0x10},
++	{0xF031, 0x08},
++	{0xF033, 0x08},
++	{0xF03D, 0x10},
++	{0xF03F, 0x10},
++	{0x0112, 0x0A},
++	{0x0113, 0x0A},
++	{0x0114, 0x01},
++	{0x0B8E, 0x01},
++	{0x0B8F, 0x00},
++	{0x0B94, 0x01},
++	{0x0B95, 0x00},
++	{0x3400, 0x01},
++	{0x3478, 0x01},
++	{0x3479, 0x1c},
++	{0x3091, 0x01},
++	{0x3092, 0x00},
++	{0x3419, 0x00},
++	{0xBCF1, 0x02},
++	{0x3094, 0x01},
++	{0x3095, 0x01},
++	{0x3362, 0x00},
++	{0x3363, 0x00},
++	{0x3364, 0x00},
++	{0x3365, 0x00},
++	{0x0138, 0x01},
++};
++
++/* 10-bit. */
++static const struct imx708_reg mode_4608x2592_regs[] = {
++	{0x0342, 0x3D},
++	{0x0343, 0x20},
++	{0x0340, 0x0A},
++	{0x0341, 0x59},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x00},
++	{0x0347, 0x00},
++	{0x0348, 0x11},
++	{0x0349, 0xFF},
++	{0x034A, 0X0A},
++	{0x034B, 0x1F},
++	{0x0220, 0x62},
++	{0x0222, 0x01},
++	{0x0900, 0x00},
++	{0x0901, 0x11},
++	{0x0902, 0x0A},
++	{0x3200, 0x01},
++	{0x3201, 0x01},
++	{0x32D5, 0x01},
++	{0x32D6, 0x00},
++	{0x32DB, 0x01},
++	{0x32DF, 0x00},
++	{0x350C, 0x00},
++	{0x350D, 0x00},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040A, 0x00},
++	{0x040B, 0x00},
++	{0x040C, 0x12},
++	{0x040D, 0x00},
++	{0x040E, 0x0A},
++	{0x040F, 0x20},
++	{0x034C, 0x12},
++	{0x034D, 0x00},
++	{0x034E, 0x0A},
++	{0x034F, 0x20},
++	{0x0301, 0x05},
++	{0x0303, 0x02},
++	{0x0305, 0x02},
++	{0x0306, 0x00},
++	{0x0307, 0x7C},
++	{0x030B, 0x02},
++	{0x030D, 0x04},
++	{0x030E, 0x01},
++	{0x030F, 0x2C},
++	{0x0310, 0x01},
++	{0x3CA0, 0x00},
++	{0x3CA1, 0x64},
++	{0x3CA4, 0x00},
++	{0x3CA5, 0x00},
++	{0x3CA6, 0x00},
++	{0x3CA7, 0x00},
++	{0x3CAA, 0x00},
++	{0x3CAB, 0x00},
++	{0x3CB8, 0x00},
++	{0x3CB9, 0x08},
++	{0x3CBA, 0x00},
++	{0x3CBB, 0x00},
++	{0x3CBC, 0x00},
++	{0x3CBD, 0x3C},
++	{0x3CBE, 0x00},
++	{0x3CBF, 0x00},
++	{0x0202, 0x0A},
++	{0x0203, 0x29},
++	{0x0224, 0x01},
++	{0x0225, 0xF4},
++	{0x3116, 0x01},
++	{0x3117, 0xF4},
++	{0x0204, 0x00},
++	{0x0205, 0x00},
++	{0x0216, 0x00},
++	{0x0217, 0x00},
++	{0x0218, 0x01},
++	{0x0219, 0x00},
++	{0x020E, 0x01},
++	{0x020F, 0x00},
++	{0x3118, 0x00},
++	{0x3119, 0x00},
++	{0x311A, 0x01},
++	{0x311B, 0x00},
++	{0x341a, 0x00},
++	{0x341b, 0x00},
++	{0x341c, 0x00},
++	{0x341d, 0x00},
++	{0x341e, 0x01},
++	{0x341f, 0x20},
++	{0x3420, 0x00},
++	{0x3421, 0xd8},
++	{0xC428, 0x00},
++	{0xC429, 0x04},
++	{0x3366, 0x00},
++	{0x3367, 0x00},
++	{0x3368, 0x00},
++	{0x3369, 0x00},
++};
++
++static const struct imx708_reg mode_2x2binned_regs[] = {
++	{0x0342, 0x1E},
++	{0x0343, 0x90},
++	{0x0340, 0x05},
++	{0x0341, 0x38},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x00},
++	{0x0347, 0x00},
++	{0x0348, 0x11},
++	{0x0349, 0xFF},
++	{0x034A, 0X0A},
++	{0x034B, 0x1F},
++	{0x0220, 0x62},
++	{0x0222, 0x01},
++	{0x0900, 0x01},
++	{0x0901, 0x22},
++	{0x0902, 0x08},
++	{0x3200, 0x41},
++	{0x3201, 0x41},
++	{0x32D5, 0x00},
++	{0x32D6, 0x00},
++	{0x32DB, 0x01},
++	{0x32DF, 0x00},
++	{0x350C, 0x00},
++	{0x350D, 0x00},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040A, 0x00},
++	{0x040B, 0x00},
++	{0x040C, 0x09},
++	{0x040D, 0x00},
++	{0x040E, 0x05},
++	{0x040F, 0x10},
++	{0x034C, 0x09},
++	{0x034D, 0x00},
++	{0x034E, 0x05},
++	{0x034F, 0x10},
++	{0x0301, 0x05},
++	{0x0303, 0x02},
++	{0x0305, 0x02},
++	{0x0306, 0x00},
++	{0x0307, 0x7A},
++	{0x030B, 0x02},
++	{0x030D, 0x04},
++	{0x030E, 0x01},
++	{0x030F, 0x2C},
++	{0x0310, 0x01},
++	{0x3CA0, 0x00},
++	{0x3CA1, 0x3C},
++	{0x3CA4, 0x00},
++	{0x3CA5, 0x3C},
++	{0x3CA6, 0x00},
++	{0x3CA7, 0x00},
++	{0x3CAA, 0x00},
++	{0x3CAB, 0x00},
++	{0x3CB8, 0x00},
++	{0x3CB9, 0x1C},
++	{0x3CBA, 0x00},
++	{0x3CBB, 0x08},
++	{0x3CBC, 0x00},
++	{0x3CBD, 0x1E},
++	{0x3CBE, 0x00},
++	{0x3CBF, 0x0A},
++	{0x0202, 0x05},
++	{0x0203, 0x08},
++	{0x0224, 0x01},
++	{0x0225, 0xF4},
++	{0x3116, 0x01},
++	{0x3117, 0xF4},
++	{0x0204, 0x00},
++	{0x0205, 0x70},
++	{0x0216, 0x00},
++	{0x0217, 0x70},
++	{0x0218, 0x01},
++	{0x0219, 0x00},
++	{0x020E, 0x01},
++	{0x020F, 0x00},
++	{0x3118, 0x00},
++	{0x3119, 0x70},
++	{0x311A, 0x01},
++	{0x311B, 0x00},
++	{0x341a, 0x00},
++	{0x341b, 0x00},
++	{0x341c, 0x00},
++	{0x341d, 0x00},
++	{0x341e, 0x00},
++	{0x341f, 0x90},
++	{0x3420, 0x00},
++	{0x3421, 0x6c},
++	{0x3366, 0x00},
++	{0x3367, 0x00},
++	{0x3368, 0x00},
++	{0x3369, 0x00},
++};
++
++static const struct imx708_reg mode_2x2binned_720p_regs[] = {
++	{0x0342, 0x14},
++	{0x0343, 0x60},
++	{0x0340, 0x04},
++	{0x0341, 0xB6},
++	{0x0344, 0x03},
++	{0x0345, 0x00},
++	{0x0346, 0x01},
++	{0x0347, 0xB0},
++	{0x0348, 0x0E},
++	{0x0349, 0xFF},
++	{0x034A, 0x08},
++	{0x034B, 0x6F},
++	{0x0220, 0x62},
++	{0x0222, 0x01},
++	{0x0900, 0x01},
++	{0x0901, 0x22},
++	{0x0902, 0x08},
++	{0x3200, 0x41},
++	{0x3201, 0x41},
++	{0x32D5, 0x00},
++	{0x32D6, 0x00},
++	{0x32DB, 0x01},
++	{0x32DF, 0x01},
++	{0x350C, 0x00},
++	{0x350D, 0x00},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040A, 0x00},
++	{0x040B, 0x00},
++	{0x040C, 0x06},
++	{0x040D, 0x00},
++	{0x040E, 0x03},
++	{0x040F, 0x60},
++	{0x034C, 0x06},
++	{0x034D, 0x00},
++	{0x034E, 0x03},
++	{0x034F, 0x60},
++	{0x0301, 0x05},
++	{0x0303, 0x02},
++	{0x0305, 0x02},
++	{0x0306, 0x00},
++	{0x0307, 0x76},
++	{0x030B, 0x02},
++	{0x030D, 0x04},
++	{0x030E, 0x01},
++	{0x030F, 0x2C},
++	{0x0310, 0x01},
++	{0x3CA0, 0x00},
++	{0x3CA1, 0x3C},
++	{0x3CA4, 0x01},
++	{0x3CA5, 0x5E},
++	{0x3CA6, 0x00},
++	{0x3CA7, 0x00},
++	{0x3CAA, 0x00},
++	{0x3CAB, 0x00},
++	{0x3CB8, 0x00},
++	{0x3CB9, 0x0C},
++	{0x3CBA, 0x00},
++	{0x3CBB, 0x04},
++	{0x3CBC, 0x00},
++	{0x3CBD, 0x1E},
++	{0x3CBE, 0x00},
++	{0x3CBF, 0x05},
++	{0x0202, 0x04},
++	{0x0203, 0x86},
++	{0x0224, 0x01},
++	{0x0225, 0xF4},
++	{0x3116, 0x01},
++	{0x3117, 0xF4},
++	{0x0204, 0x00},
++	{0x0205, 0x70},
++	{0x0216, 0x00},
++	{0x0217, 0x70},
++	{0x0218, 0x01},
++	{0x0219, 0x00},
++	{0x020E, 0x01},
++	{0x020F, 0x00},
++	{0x3118, 0x00},
++	{0x3119, 0x70},
++	{0x311A, 0x01},
++	{0x311B, 0x00},
++	{0x341a, 0x00},
++	{0x341b, 0x00},
++	{0x341c, 0x00},
++	{0x341d, 0x00},
++	{0x341e, 0x00},
++	{0x341f, 0x60},
++	{0x3420, 0x00},
++	{0x3421, 0x48},
++	{0x3366, 0x00},
++	{0x3367, 0x00},
++	{0x3368, 0x00},
++	{0x3369, 0x00},
++};
++
++static const struct imx708_reg mode_hdr_regs[] = {
++	{0x0342, 0x14},
++	{0x0343, 0x60},
++	{0x0340, 0x0A},
++	{0x0341, 0x5B},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x00},
++	{0x0347, 0x00},
++	{0x0348, 0x11},
++	{0x0349, 0xFF},
++	{0x034A, 0X0A},
++	{0x034B, 0x1F},
++	{0x0220, 0x01},
++	{0x0222, IMX708_HDR_EXPOSURE_RATIO},
++	{0x0900, 0x00},
++	{0x0901, 0x11},
++	{0x0902, 0x0A},
++	{0x3200, 0x01},
++	{0x3201, 0x01},
++	{0x32D5, 0x00},
++	{0x32D6, 0x00},
++	{0x32DB, 0x01},
++	{0x32DF, 0x00},
++	{0x350C, 0x00},
++	{0x350D, 0x00},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040A, 0x00},
++	{0x040B, 0x00},
++	{0x040C, 0x09},
++	{0x040D, 0x00},
++	{0x040E, 0x05},
++	{0x040F, 0x10},
++	{0x034C, 0x09},
++	{0x034D, 0x00},
++	{0x034E, 0x05},
++	{0x034F, 0x10},
++	{0x0301, 0x05},
++	{0x0303, 0x02},
++	{0x0305, 0x02},
++	{0x0306, 0x00},
++	{0x0307, 0xA2},
++	{0x030B, 0x02},
++	{0x030D, 0x04},
++	{0x030E, 0x01},
++	{0x030F, 0x2C},
++	{0x0310, 0x01},
++	{0x3CA0, 0x00},
++	{0x3CA1, 0x00},
++	{0x3CA4, 0x00},
++	{0x3CA5, 0x00},
++	{0x3CA6, 0x00},
++	{0x3CA7, 0x28},
++	{0x3CAA, 0x00},
++	{0x3CAB, 0x00},
++	{0x3CB8, 0x00},
++	{0x3CB9, 0x30},
++	{0x3CBA, 0x00},
++	{0x3CBB, 0x00},
++	{0x3CBC, 0x00},
++	{0x3CBD, 0x32},
++	{0x3CBE, 0x00},
++	{0x3CBF, 0x00},
++	{0x0202, 0x0A},
++	{0x0203, 0x2B},
++	{0x0224, 0x0A},
++	{0x0225, 0x2B},
++	{0x3116, 0x0A},
++	{0x3117, 0x2B},
++	{0x0204, 0x00},
++	{0x0205, 0x00},
++	{0x0216, 0x00},
++	{0x0217, 0x00},
++	{0x0218, 0x01},
++	{0x0219, 0x00},
++	{0x020E, 0x01},
++	{0x020F, 0x00},
++	{0x3118, 0x00},
++	{0x3119, 0x00},
++	{0x311A, 0x01},
++	{0x311B, 0x00},
++	{0x341a, 0x00},
++	{0x341b, 0x00},
++	{0x341c, 0x00},
++	{0x341d, 0x00},
++	{0x341e, 0x00},
++	{0x341f, 0x90},
++	{0x3420, 0x00},
++	{0x3421, 0x6c},
++	{0x3360, 0x01},
++	{0x3361, 0x01},
++	{0x3366, 0x09},
++	{0x3367, 0x00},
++	{0x3368, 0x05},
++	{0x3369, 0x10},
++};
++
++/* Mode configs. Keep separate lists for when HDR is enabled or not. */
++static const struct imx708_mode supported_modes_10bit_no_hdr[] = {
++	{
++		/* Full resolution. */
++		.width = 4608,
++		.height = 2592,
++		.line_length_pix = 0x3d20,
++		.crop = {
++			.left = IMX708_PIXEL_ARRAY_LEFT,
++			.top = IMX708_PIXEL_ARRAY_TOP,
++			.width = 4608,
++			.height = 2592,
++		},
++		.vblank_min = 58,
++		.vblank_default = 58,
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_4608x2592_regs),
++			.regs = mode_4608x2592_regs,
++		},
++		.pixel_rate = 595200000,
++		.exposure_lines_min = 8,
++		.exposure_lines_step = 1,
++		.hdr = false
++	},
++	{
++		/* regular 2x2 binned. */
++		.width = 2304,
++		.height = 1296,
++		.line_length_pix = 0x1e90,
++		.crop = {
++			.left = IMX708_PIXEL_ARRAY_LEFT,
++			.top = IMX708_PIXEL_ARRAY_TOP,
++			.width = 4608,
++			.height = 2592,
++		},
++		.vblank_min = 40,
++		.vblank_default = 1198,
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_2x2binned_regs),
++			.regs = mode_2x2binned_regs,
++		},
++		.pixel_rate = 585600000,
++		.exposure_lines_min = 4,
++		.exposure_lines_step = 2,
++		.hdr = false
++	},
++	{
++		/* 2x2 binned and cropped for 720p. */
++		.width = 1536,
++		.height = 864,
++		.line_length_pix = 0x1460,
++		.crop = {
++			.left = IMX708_PIXEL_ARRAY_LEFT,
++			.top = IMX708_PIXEL_ARRAY_TOP,
++			.width = 4608,
++			.height = 2592,
++		},
++		.vblank_min = 40,
++		.vblank_default = 2755,
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_2x2binned_720p_regs),
++			.regs = mode_2x2binned_720p_regs,
++		},
++		.pixel_rate = 566400000,
++		.exposure_lines_min = 4,
++		.exposure_lines_step = 2,
++		.hdr = false
++	},
++};
++
++static const struct imx708_mode supported_modes_10bit_hdr[] = {
++	{
++		/* There's only one HDR mode, which is 2x2 downscaled */
++		.width = 2304,
++		.height = 1296,
++		.line_length_pix = 0x1460,
++		.crop = {
++			.left = IMX708_PIXEL_ARRAY_LEFT,
++			.top = IMX708_PIXEL_ARRAY_TOP,
++			.width = 4608,
++			.height = 2592,
++		},
++		.vblank_min = 3673,
++		.vblank_default = 3673,
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_hdr_regs),
++			.regs = mode_hdr_regs,
++		},
++		.pixel_rate = 777600000,
++		.exposure_lines_min = 8 * IMX708_HDR_EXPOSURE_RATIO * IMX708_HDR_EXPOSURE_RATIO,
++		.exposure_lines_step = 2 * IMX708_HDR_EXPOSURE_RATIO * IMX708_HDR_EXPOSURE_RATIO,
++		.hdr = true
++	}
++};
++
++/*
++ * The supported formats.
++ * This table MUST contain 4 entries per format, to cover the various flip
++ * combinations in the order
++ * - no flip
++ * - h flip
++ * - v flip
++ * - h&v flips
++ */
++static const u32 codes[] = {
++	/* 10-bit modes. */
++	MEDIA_BUS_FMT_SRGGB10_1X10,
++	MEDIA_BUS_FMT_SGRBG10_1X10,
++	MEDIA_BUS_FMT_SGBRG10_1X10,
++	MEDIA_BUS_FMT_SBGGR10_1X10,
++};
++
++static const char * const imx708_test_pattern_menu[] = {
++	"Disabled",
++	"Color Bars",
++	"Solid Color",
++	"Grey Color Bars",
++	"PN9"
++};
++
++static const int imx708_test_pattern_val[] = {
++	IMX708_TEST_PATTERN_DISABLE,
++	IMX708_TEST_PATTERN_COLOR_BARS,
++	IMX708_TEST_PATTERN_SOLID_COLOR,
++	IMX708_TEST_PATTERN_GREY_COLOR,
++	IMX708_TEST_PATTERN_PN9,
++};
++
++/* regulator supplies */
++static const char * const imx708_supply_name[] = {
++	/* Supplies can be enabled in any order */
++	"VANA1",  /* Analog1 (2.8V) supply */
++	"VANA2",  /* Analog2 (1.8V) supply */
++	"VDIG",  /* Digital Core (1.1V) supply */
++	"VDDL",  /* IF (1.8V) supply */
++};
++
++#define IMX708_NUM_SUPPLIES ARRAY_SIZE(imx708_supply_name)
++
++/*
++ * Initialisation delay between XCLR low->high and the moment when the sensor
++ * can start capture (i.e. can leave software standby), given by T7 in the
++ * datasheet is 8ms.  This does include I2C setup time as well.
++ *
++ * Note, that delay between XCLR low->high and reading the CCI ID register (T6
++ * in the datasheet) is much smaller - 600us.
++ */
++#define IMX708_XCLR_MIN_DELAY_US	8000
++#define IMX708_XCLR_DELAY_RANGE_US	1000
++
++struct imx708 {
++	struct v4l2_subdev sd;
++	struct media_pad pad[NUM_PADS];
++
++	struct v4l2_mbus_framefmt fmt;
++
++	struct clk *xclk;
++	u32 xclk_freq;
++
++	struct gpio_desc *reset_gpio;
++	struct regulator_bulk_data supplies[IMX708_NUM_SUPPLIES];
++
++	struct v4l2_ctrl_handler ctrl_handler;
++	/* V4L2 Controls */
++	struct v4l2_ctrl *pixel_rate;
++	struct v4l2_ctrl *exposure;
++	struct v4l2_ctrl *vflip;
++	struct v4l2_ctrl *hflip;
++	struct v4l2_ctrl *vblank;
++	struct v4l2_ctrl *hblank;
++	struct v4l2_ctrl *red_balance;
++	struct v4l2_ctrl *blue_balance;
++	struct v4l2_ctrl *notify_gains;
++	struct v4l2_ctrl *hdr_mode;
++
++	/* Current mode */
++	const struct imx708_mode *mode;
++
++	/*
++	 * Mutex for serialized access:
++	 * Protect sensor module set pad format and start/stop streaming safely.
++	 */
++	struct mutex mutex;
++
++	/* Streaming on/off */
++	bool streaming;
++
++	/* Rewrite common registers on stream on? */
++	bool common_regs_written;
++};
++
++static inline struct imx708 *to_imx708(struct v4l2_subdev *_sd)
++{
++	return container_of(_sd, struct imx708, sd);
++}
++
++static inline void get_mode_table(unsigned int code,
++				  const struct imx708_mode **mode_list,
++				  unsigned int *num_modes,
++				  bool hdr_enable)
++{
++	switch (code) {
++	/* 10-bit */
++	case MEDIA_BUS_FMT_SRGGB10_1X10:
++	case MEDIA_BUS_FMT_SGRBG10_1X10:
++	case MEDIA_BUS_FMT_SGBRG10_1X10:
++	case MEDIA_BUS_FMT_SBGGR10_1X10:
++		if (hdr_enable) {
++			*mode_list = supported_modes_10bit_hdr;
++			*num_modes = ARRAY_SIZE(supported_modes_10bit_hdr);
++		} else {
++			*mode_list = supported_modes_10bit_no_hdr;
++			*num_modes = ARRAY_SIZE(supported_modes_10bit_no_hdr);
++		}
++		break;
++	default:
++		*mode_list = NULL;
++		*num_modes = 0;
++	}
++}
++
++/* Read registers up to 2 at a time */
++static int imx708_read_reg(struct imx708 *imx708, u16 reg, u32 len, u32 *val)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
++	struct i2c_msg msgs[2];
++	u8 addr_buf[2] = { reg >> 8, reg & 0xff };
++	u8 data_buf[4] = { 0, };
++	int ret;
++
++	if (len > 4)
++		return -EINVAL;
++
++	/* Write register address */
++	msgs[0].addr = client->addr;
++	msgs[0].flags = 0;
++	msgs[0].len = ARRAY_SIZE(addr_buf);
++	msgs[0].buf = addr_buf;
++
++	/* Read data from register */
++	msgs[1].addr = client->addr;
++	msgs[1].flags = I2C_M_RD;
++	msgs[1].len = len;
++	msgs[1].buf = &data_buf[4 - len];
++
++	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++	if (ret != ARRAY_SIZE(msgs))
++		return -EIO;
++
++	*val = get_unaligned_be32(data_buf);
++
++	return 0;
++}
++
++/* Write registers up to 2 at a time */
++static int imx708_write_reg(struct imx708 *imx708, u16 reg, u32 len, u32 val)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
++	u8 buf[6];
++
++	if (len > 4)
++		return -EINVAL;
++
++	put_unaligned_be16(reg, buf);
++	put_unaligned_be32(val << (8 * (4 - len)), buf + 2);
++	if (i2c_master_send(client, buf, len + 2) != len + 2)
++		return -EIO;
++
++	return 0;
++}
++
++/* Write a list of registers */
++static int imx708_write_regs(struct imx708 *imx708,
++			     const struct imx708_reg *regs, u32 len)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
++	unsigned int i;
++	int ret;
++
++	for (i = 0; i < len; i++) {
++		ret = imx708_write_reg(imx708, regs[i].address, 1, regs[i].val);
++		if (ret) {
++			dev_err_ratelimited(&client->dev,
++					    "Failed to write reg 0x%4.4x. error = %d\n",
++					    regs[i].address, ret);
++
++			return ret;
++		}
++	}
++
++	return 0;
++}
++
++/* Get bayer order based on flip setting. */
++static u32 imx708_get_format_code(struct imx708 *imx708)
++{
++	unsigned int i;
++
++	lockdep_assert_held(&imx708->mutex);
++
++	i = (imx708->vflip->val ? 2 : 0) |
++	    (imx708->hflip->val ? 1 : 0);
++
++	return codes[i];
++}
++
++static void imx708_set_default_format(struct imx708 *imx708)
++{
++	struct v4l2_mbus_framefmt *fmt = &imx708->fmt;
++
++	/* Set default mode to max resolution */
++	imx708->mode = &supported_modes_10bit_no_hdr[0];
++
++	/* fmt->code not set as it will always be computed based on flips */
++	fmt->colorspace = V4L2_COLORSPACE_RAW;
++	fmt->ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->colorspace);
++	fmt->quantization = V4L2_MAP_QUANTIZATION_DEFAULT(true,
++							  fmt->colorspace,
++							  fmt->ycbcr_enc);
++	fmt->xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(fmt->colorspace);
++	fmt->width = imx708->mode->width;
++	fmt->height = imx708->mode->height;
++	fmt->field = V4L2_FIELD_NONE;
++}
++
++static int imx708_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	struct imx708 *imx708 = to_imx708(sd);
++	struct v4l2_mbus_framefmt *try_fmt_img =
++		v4l2_subdev_get_try_format(sd, fh->state, IMAGE_PAD);
++	struct v4l2_mbus_framefmt *try_fmt_meta =
++		v4l2_subdev_get_try_format(sd, fh->state, METADATA_PAD);
++	struct v4l2_rect *try_crop;
++
++	mutex_lock(&imx708->mutex);
++
++	/* Initialize try_fmt for the image pad */
++	if (imx708->hdr_mode->val) {
++		try_fmt_img->width = supported_modes_10bit_hdr[0].width;
++		try_fmt_img->height = supported_modes_10bit_hdr[0].height;
++	} else {
++		try_fmt_img->width = supported_modes_10bit_no_hdr[0].width;
++		try_fmt_img->height = supported_modes_10bit_no_hdr[0].height;
++	}
++	try_fmt_img->code = imx708_get_format_code(imx708);
++	try_fmt_img->field = V4L2_FIELD_NONE;
++
++	/* Initialize try_fmt for the embedded metadata pad */
++	try_fmt_meta->width = IMX708_EMBEDDED_LINE_WIDTH;
++	try_fmt_meta->height = IMX708_NUM_EMBEDDED_LINES;
++	try_fmt_meta->code = MEDIA_BUS_FMT_SENSOR_DATA;
++	try_fmt_meta->field = V4L2_FIELD_NONE;
++
++	/* Initialize try_crop */
++	try_crop = v4l2_subdev_get_try_crop(sd, fh->state, IMAGE_PAD);
++	try_crop->left = IMX708_PIXEL_ARRAY_LEFT;
++	try_crop->top = IMX708_PIXEL_ARRAY_TOP;
++	try_crop->width = IMX708_PIXEL_ARRAY_WIDTH;
++	try_crop->height = IMX708_PIXEL_ARRAY_HEIGHT;
++
++	mutex_unlock(&imx708->mutex);
++
++	return 0;
++}
++
++static int imx708_set_exposure(struct imx708 *imx708, unsigned int val)
++{
++	int ret;
++
++	val = max(val, imx708->mode->exposure_lines_min);
++	val -= val % imx708->mode->exposure_lines_step;
++
++	/*
++	 * In HDR mode this will set the longest exposure. The sensor
++	 * will automatically divide the medium and short ones by 4,16.
++	 */
++	ret = imx708_write_reg(imx708, IMX708_REG_EXPOSURE,
++			       IMX708_REG_VALUE_16BIT, val);
++
++	return ret;
++}
++
++static void imx708_adjust_exposure_range(struct imx708 *imx708,
++					 struct v4l2_ctrl *ctrl)
++{
++	int exposure_max, exposure_def;
++
++	/* Honour the VBLANK limits when setting exposure. */
++	exposure_max = imx708->mode->height + imx708->vblank->val -
++		IMX708_EXPOSURE_OFFSET;
++	exposure_def = min(exposure_max, imx708->exposure->val);
++	__v4l2_ctrl_modify_range(imx708->exposure, imx708->exposure->minimum,
++				 exposure_max, imx708->exposure->step,
++				 exposure_def);
++}
++
++static int imx708_set_analogue_gain(struct imx708 *imx708, unsigned int val)
++{
++	int ret;
++
++	/*
++	 * In HDR mode this will set the gain for the longest exposure,
++	 * and by default the sensor uses the same gain for all of them.
++	 */
++	ret = imx708_write_reg(imx708, IMX708_REG_ANALOG_GAIN,
++			       IMX708_REG_VALUE_16BIT, val);
++
++	return ret;
++}
++
++static void imx708_set_framing_limits(struct imx708 *imx708)
++{
++	unsigned int hblank;
++	const struct imx708_mode *mode = imx708->mode;
++
++	__v4l2_ctrl_modify_range(imx708->pixel_rate,
++				 mode->pixel_rate, mode->pixel_rate,
++				 1, mode->pixel_rate);
++
++	/* Update limits and set FPS to default */
++	__v4l2_ctrl_modify_range(imx708->vblank, mode->vblank_min,
++				 IMX708_FRAME_LENGTH_MAX - mode->height,
++				 1, mode->vblank_default);
++
++	/*
++	 * Currently PPL is fixed to the mode specified value, so hblank
++	 * depends on mode->width only, and is not changeable in any
++	 * way other than changing the mode.
++	 */
++	hblank = mode->line_length_pix - mode->width;
++	__v4l2_ctrl_modify_range(imx708->hblank, hblank, hblank, 1, hblank);
++}
++
++static int imx708_set_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct imx708 *imx708 =
++		container_of(ctrl->handler, struct imx708, ctrl_handler);
++	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
++	const struct imx708_mode *mode_list;
++	unsigned int code, num_modes;
++	int ret = 0;
++
++	/*
++	 * The VBLANK control may change the limits of usable exposure, so check
++	 * and adjust if necessary.
++	 */
++	if (ctrl->id == V4L2_CID_VBLANK)
++		imx708_adjust_exposure_range(imx708, ctrl);
++
++	/*
++	 * Applying V4L2 control value only happens
++	 * when power is up for streaming
++	 */
++	if (pm_runtime_get_if_in_use(&client->dev) == 0)
++		return 0;
++
++	switch (ctrl->id) {
++	case V4L2_CID_ANALOGUE_GAIN:
++		imx708_set_analogue_gain(imx708, ctrl->val);
++		break;
++	case V4L2_CID_EXPOSURE:
++		ret = imx708_set_exposure(imx708, ctrl->val);
++		break;
++	case V4L2_CID_DIGITAL_GAIN:
++		ret = imx708_write_reg(imx708, IMX708_REG_DIGITAL_GAIN,
++				       IMX708_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN:
++		ret = imx708_write_reg(imx708, IMX708_REG_TEST_PATTERN,
++				       IMX708_REG_VALUE_16BIT,
++				       imx708_test_pattern_val[ctrl->val]);
++		break;
++	case V4L2_CID_TEST_PATTERN_RED:
++		ret = imx708_write_reg(imx708, IMX708_REG_TEST_PATTERN_R,
++				       IMX708_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_GREENR:
++		ret = imx708_write_reg(imx708, IMX708_REG_TEST_PATTERN_GR,
++				       IMX708_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_BLUE:
++		ret = imx708_write_reg(imx708, IMX708_REG_TEST_PATTERN_B,
++				       IMX708_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_GREENB:
++		ret = imx708_write_reg(imx708, IMX708_REG_TEST_PATTERN_GB,
++				       IMX708_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_HFLIP:
++	case V4L2_CID_VFLIP:
++		ret = imx708_write_reg(imx708, IMX708_REG_ORIENTATION, 1,
++				       imx708->hflip->val |
++				       imx708->vflip->val << 1);
++		break;
++	case V4L2_CID_VBLANK:
++		ret = imx708_write_reg(imx708, IMX708_REG_FRAME_LENGTH,
++				       IMX708_REG_VALUE_16BIT,
++				       imx708->mode->height + ctrl->val);
++		break;
++	case V4L2_CID_NOTIFY_GAINS:
++		ret = imx708_write_reg(imx708, IMX708_REG_COLOUR_BALANCE_BLUE,
++				       IMX708_REG_VALUE_16BIT,
++				       imx708->notify_gains->p_new.p_u32[0]);
++		if (ret)
++			break;
++		ret = imx708_write_reg(imx708, IMX708_REG_COLOUR_BALANCE_RED,
++				       IMX708_REG_VALUE_16BIT,
++				       imx708->notify_gains->p_new.p_u32[3]);
++		break;
++	case V4L2_CID_WIDE_DYNAMIC_RANGE:
++		code = imx708_get_format_code(imx708);
++		get_mode_table(code, &mode_list, &num_modes, ctrl->val);
++		imx708->mode = v4l2_find_nearest_size(mode_list,
++						      num_modes,
++						      width, height,
++						      imx708->mode->width,
++						      imx708->mode->height);
++		imx708_set_framing_limits(imx708);
++		break;
++	default:
++		dev_info(&client->dev,
++			 "ctrl(id:0x%x,val:0x%x) is not handled\n",
++			 ctrl->id, ctrl->val);
++		ret = -EINVAL;
++		break;
++	}
++
++	pm_runtime_put(&client->dev);
++
++	return ret;
++}
++
++static const struct v4l2_ctrl_ops imx708_ctrl_ops = {
++	.s_ctrl = imx708_set_ctrl,
++};
++
++static int imx708_enum_mbus_code(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *sd_state,
++				 struct v4l2_subdev_mbus_code_enum *code)
++{
++	struct imx708 *imx708 = to_imx708(sd);
++
++	if (code->pad >= NUM_PADS)
++		return -EINVAL;
++
++	if (code->pad == IMAGE_PAD) {
++		if (code->index >= (ARRAY_SIZE(codes) / 4))
++			return -EINVAL;
++
++		code->code = imx708_get_format_code(imx708);
++	} else {
++		if (code->index > 0)
++			return -EINVAL;
++
++		code->code = MEDIA_BUS_FMT_SENSOR_DATA;
++	}
++
++	return 0;
++}
++
++static int imx708_enum_frame_size(struct v4l2_subdev *sd,
++				  struct v4l2_subdev_state *sd_state,
++				  struct v4l2_subdev_frame_size_enum *fse)
++{
++	struct imx708 *imx708 = to_imx708(sd);
++
++	if (fse->pad >= NUM_PADS)
++		return -EINVAL;
++
++	if (fse->pad == IMAGE_PAD) {
++		const struct imx708_mode *mode_list;
++		unsigned int num_modes;
++
++		get_mode_table(fse->code, &mode_list, &num_modes,
++			       imx708->hdr_mode->val);
++
++		if (fse->index >= num_modes)
++			return -EINVAL;
++
++		if (fse->code != imx708_get_format_code(imx708))
++			return -EINVAL;
++
++		fse->min_width = mode_list[fse->index].width;
++		fse->max_width = fse->min_width;
++		fse->min_height = mode_list[fse->index].height;
++		fse->max_height = fse->min_height;
++	} else {
++		if (fse->code != MEDIA_BUS_FMT_SENSOR_DATA || fse->index > 0)
++			return -EINVAL;
++
++		fse->min_width = IMX708_EMBEDDED_LINE_WIDTH;
++		fse->max_width = fse->min_width;
++		fse->min_height = IMX708_NUM_EMBEDDED_LINES;
++		fse->max_height = fse->min_height;
++	}
++
++	return 0;
++}
++
++static void imx708_reset_colorspace(struct v4l2_mbus_framefmt *fmt)
++{
++	fmt->colorspace = V4L2_COLORSPACE_RAW;
++	fmt->ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->colorspace);
++	fmt->quantization = V4L2_MAP_QUANTIZATION_DEFAULT(true,
++							  fmt->colorspace,
++							  fmt->ycbcr_enc);
++	fmt->xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(fmt->colorspace);
++}
++
++static void imx708_update_image_pad_format(struct imx708 *imx708,
++					   const struct imx708_mode *mode,
++					   struct v4l2_subdev_format *fmt)
++{
++	fmt->format.width = mode->width;
++	fmt->format.height = mode->height;
++	fmt->format.field = V4L2_FIELD_NONE;
++	imx708_reset_colorspace(&fmt->format);
++}
++
++static void imx708_update_metadata_pad_format(struct v4l2_subdev_format *fmt)
++{
++	fmt->format.width = IMX708_EMBEDDED_LINE_WIDTH;
++	fmt->format.height = IMX708_NUM_EMBEDDED_LINES;
++	fmt->format.code = MEDIA_BUS_FMT_SENSOR_DATA;
++	fmt->format.field = V4L2_FIELD_NONE;
++}
++
++static int imx708_get_pad_format(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *sd_state,
++				 struct v4l2_subdev_format *fmt)
++{
++	struct imx708 *imx708 = to_imx708(sd);
++
++	if (fmt->pad >= NUM_PADS)
++		return -EINVAL;
++
++	mutex_lock(&imx708->mutex);
++
++	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++		struct v4l2_mbus_framefmt *try_fmt =
++			v4l2_subdev_get_try_format(&imx708->sd, sd_state,
++						   fmt->pad);
++		/* update the code which could change due to vflip or hflip */
++		try_fmt->code = fmt->pad == IMAGE_PAD ?
++				imx708_get_format_code(imx708) :
++				MEDIA_BUS_FMT_SENSOR_DATA;
++		fmt->format = *try_fmt;
++	} else {
++		if (fmt->pad == IMAGE_PAD) {
++			imx708_update_image_pad_format(imx708, imx708->mode,
++						       fmt);
++			fmt->format.code = imx708_get_format_code(imx708);
++		} else {
++			imx708_update_metadata_pad_format(fmt);
++		}
++	}
++
++	mutex_unlock(&imx708->mutex);
++	return 0;
++}
++
++static int imx708_set_pad_format(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *sd_state,
++				 struct v4l2_subdev_format *fmt)
++{
++	struct v4l2_mbus_framefmt *framefmt;
++	const struct imx708_mode *mode;
++	struct imx708 *imx708 = to_imx708(sd);
++
++	if (fmt->pad >= NUM_PADS)
++		return -EINVAL;
++
++	mutex_lock(&imx708->mutex);
++
++	if (fmt->pad == IMAGE_PAD) {
++		const struct imx708_mode *mode_list;
++		unsigned int num_modes;
++
++		/* Bayer order varies with flips */
++		fmt->format.code = imx708_get_format_code(imx708);
++
++		get_mode_table(fmt->format.code, &mode_list, &num_modes,
++			       imx708->hdr_mode->val);
++
++		mode = v4l2_find_nearest_size(mode_list,
++					      num_modes,
++					      width, height,
++					      fmt->format.width,
++					      fmt->format.height);
++		imx708_update_image_pad_format(imx708, mode, fmt);
++		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++			framefmt = v4l2_subdev_get_try_format(sd, sd_state,
++							      fmt->pad);
++			*framefmt = fmt->format;
++		} else {
++			imx708->mode = mode;
++			imx708_set_framing_limits(imx708);
++		}
++	} else {
++		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++			framefmt = v4l2_subdev_get_try_format(sd, sd_state,
++							      fmt->pad);
++			*framefmt = fmt->format;
++		} else {
++			/* Only one embedded data mode is supported */
++			imx708_update_metadata_pad_format(fmt);
++		}
++	}
++
++	mutex_unlock(&imx708->mutex);
++
++	return 0;
++}
++
++static const struct v4l2_rect *
++__imx708_get_pad_crop(struct imx708 *imx708, struct v4l2_subdev_state *sd_state,
++		      unsigned int pad, enum v4l2_subdev_format_whence which)
++{
++	switch (which) {
++	case V4L2_SUBDEV_FORMAT_TRY:
++		return v4l2_subdev_get_try_crop(&imx708->sd, sd_state, pad);
++	case V4L2_SUBDEV_FORMAT_ACTIVE:
++		return &imx708->mode->crop;
++	}
++
++	return NULL;
++}
++
++static int imx708_get_selection(struct v4l2_subdev *sd,
++				struct v4l2_subdev_state *sd_state,
++				struct v4l2_subdev_selection *sel)
++{
++	switch (sel->target) {
++	case V4L2_SEL_TGT_CROP: {
++		struct imx708 *imx708 = to_imx708(sd);
++
++		mutex_lock(&imx708->mutex);
++		sel->r = *__imx708_get_pad_crop(imx708, sd_state, sel->pad,
++						sel->which);
++		mutex_unlock(&imx708->mutex);
++
++		return 0;
++	}
++
++	case V4L2_SEL_TGT_NATIVE_SIZE:
++		sel->r.left = 0;
++		sel->r.top = 0;
++		sel->r.width = IMX708_NATIVE_WIDTH;
++		sel->r.height = IMX708_NATIVE_HEIGHT;
++
++		return 0;
++
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++	case V4L2_SEL_TGT_CROP_BOUNDS:
++		sel->r.left = IMX708_PIXEL_ARRAY_LEFT;
++		sel->r.top = IMX708_PIXEL_ARRAY_TOP;
++		sel->r.width = IMX708_PIXEL_ARRAY_WIDTH;
++		sel->r.height = IMX708_PIXEL_ARRAY_HEIGHT;
++
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++/* Start streaming */
++static int imx708_start_streaming(struct imx708 *imx708)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
++	const struct imx708_reg_list *reg_list;
++	int i, ret;
++	u32 val;
++
++	if (!imx708->common_regs_written) {
++		ret = imx708_write_regs(imx708, mode_common_regs,
++					ARRAY_SIZE(mode_common_regs));
++		if (ret) {
++			dev_err(&client->dev, "%s failed to set common settings\n",
++				__func__);
++			return ret;
++		}
++
++		ret = imx708_read_reg(imx708, IMX708_REG_BASE_SPC_GAINS_L,
++				      IMX708_REG_VALUE_08BIT, &val);
++		if (ret == 0 && val == 0x40) {
++			for (i = 0; i < 54 && ret == 0; i++) {
++				ret = imx708_write_reg(imx708,
++						       IMX708_REG_BASE_SPC_GAINS_L + i,
++						       IMX708_REG_VALUE_08BIT,
++						       pdaf_gains[0][i % 9]);
++			}
++			for (i = 0; i < 54 && ret == 0; i++) {
++				ret = imx708_write_reg(imx708,
++						       IMX708_REG_BASE_SPC_GAINS_R + i,
++						       IMX708_REG_VALUE_08BIT,
++						       pdaf_gains[1][i % 9]);
++			}
++		}
++		if (ret) {
++			dev_err(&client->dev, "%s failed to set PDAF gains\n",
++				__func__);
++			return ret;
++		}
++
++		imx708->common_regs_written = true;
++	}
++
++	/* Apply default values of current mode */
++	reg_list = &imx708->mode->reg_list;
++	ret = imx708_write_regs(imx708, reg_list->regs, reg_list->num_of_regs);
++	if (ret) {
++		dev_err(&client->dev, "%s failed to set mode\n", __func__);
++		return ret;
++	}
++
++	/* Apply customized values from user */
++	ret =  __v4l2_ctrl_handler_setup(imx708->sd.ctrl_handler);
++	if (ret)
++		return ret;
++
++	/* set stream on register */
++	return imx708_write_reg(imx708, IMX708_REG_MODE_SELECT,
++				IMX708_REG_VALUE_08BIT, IMX708_MODE_STREAMING);
++}
++
++/* Stop streaming */
++static void imx708_stop_streaming(struct imx708 *imx708)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
++	int ret;
++
++	/* set stream off register */
++	ret = imx708_write_reg(imx708, IMX708_REG_MODE_SELECT,
++			       IMX708_REG_VALUE_08BIT, IMX708_MODE_STANDBY);
++	if (ret)
++		dev_err(&client->dev, "%s failed to set stream\n", __func__);
++}
++
++static int imx708_set_stream(struct v4l2_subdev *sd, int enable)
++{
++	struct imx708 *imx708 = to_imx708(sd);
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	int ret = 0;
++
++	mutex_lock(&imx708->mutex);
++	if (imx708->streaming == enable) {
++		mutex_unlock(&imx708->mutex);
++		return 0;
++	}
++
++	if (enable) {
++		ret = pm_runtime_get_sync(&client->dev);
++		if (ret < 0) {
++			pm_runtime_put_noidle(&client->dev);
++			goto err_unlock;
++		}
++
++		/*
++		 * Apply default & customized values
++		 * and then start streaming.
++		 */
++		ret = imx708_start_streaming(imx708);
++		if (ret)
++			goto err_rpm_put;
++	} else {
++		imx708_stop_streaming(imx708);
++		pm_runtime_put(&client->dev);
++	}
++
++	imx708->streaming = enable;
++
++	/* vflip/hflip and hdr mode cannot change during streaming */
++	__v4l2_ctrl_grab(imx708->vflip, enable);
++	__v4l2_ctrl_grab(imx708->hflip, enable);
++	__v4l2_ctrl_grab(imx708->hdr_mode, enable);
++
++	mutex_unlock(&imx708->mutex);
++
++	return ret;
++
++err_rpm_put:
++	pm_runtime_put(&client->dev);
++err_unlock:
++	mutex_unlock(&imx708->mutex);
++
++	return ret;
++}
++
++/* Power/clock management functions */
++static int imx708_power_on(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx708 *imx708 = to_imx708(sd);
++	int ret;
++
++	ret = regulator_bulk_enable(IMX708_NUM_SUPPLIES,
++				    imx708->supplies);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to enable regulators\n",
++			__func__);
++		return ret;
++	}
++
++	ret = clk_prepare_enable(imx708->xclk);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to enable clock\n",
++			__func__);
++		goto reg_off;
++	}
++
++	gpiod_set_value_cansleep(imx708->reset_gpio, 1);
++	usleep_range(IMX708_XCLR_MIN_DELAY_US,
++		     IMX708_XCLR_MIN_DELAY_US + IMX708_XCLR_DELAY_RANGE_US);
++
++	return 0;
++
++reg_off:
++	regulator_bulk_disable(IMX708_NUM_SUPPLIES, imx708->supplies);
++	return ret;
++}
++
++static int imx708_power_off(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx708 *imx708 = to_imx708(sd);
++
++	gpiod_set_value_cansleep(imx708->reset_gpio, 0);
++	regulator_bulk_disable(IMX708_NUM_SUPPLIES, imx708->supplies);
++	clk_disable_unprepare(imx708->xclk);
++
++	/* Force reprogramming of the common registers when powered up again. */
++	imx708->common_regs_written = false;
++
++	return 0;
++}
++
++static int __maybe_unused imx708_suspend(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx708 *imx708 = to_imx708(sd);
++
++	if (imx708->streaming)
++		imx708_stop_streaming(imx708);
++
++	return 0;
++}
++
++static int __maybe_unused imx708_resume(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx708 *imx708 = to_imx708(sd);
++	int ret;
++
++	if (imx708->streaming) {
++		ret = imx708_start_streaming(imx708);
++		if (ret)
++			goto error;
++	}
++
++	return 0;
++
++error:
++	imx708_stop_streaming(imx708);
++	imx708->streaming = 0;
++	return ret;
++}
++
++static int imx708_get_regulators(struct imx708 *imx708)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
++	unsigned int i;
++
++	for (i = 0; i < IMX708_NUM_SUPPLIES; i++)
++		imx708->supplies[i].supply = imx708_supply_name[i];
++
++	return devm_regulator_bulk_get(&client->dev,
++				       IMX708_NUM_SUPPLIES,
++				       imx708->supplies);
++}
++
++/* Verify chip ID */
++static int imx708_identify_module(struct imx708 *imx708)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
++	int ret;
++	u32 val;
++
++	ret = imx708_read_reg(imx708, IMX708_REG_CHIP_ID,
++			      IMX708_REG_VALUE_16BIT, &val);
++	if (ret) {
++		dev_err(&client->dev, "failed to read chip id %x, with error %d\n",
++			IMX708_CHIP_ID, ret);
++		return ret;
++	}
++
++	if (val != IMX708_CHIP_ID) {
++		dev_err(&client->dev, "chip id mismatch: %x!=%x\n",
++			IMX708_CHIP_ID, val);
++		return -EIO;
++	}
++
++	ret = imx708_read_reg(imx708, 0x0000, IMX708_REG_VALUE_16BIT, &val);
++	if (!ret) {
++		dev_info(&client->dev, "camera module ID 0x%04x\n", val);
++		snprintf(imx708->sd.name, sizeof(imx708->sd.name), "imx708%s%s",
++			 val & 0x02 ? "_wide" : "",
++			 val & 0x80 ? "_noir" : "");
++	}
++
++	return 0;
++}
++
++static const struct v4l2_subdev_core_ops imx708_core_ops = {
++	.subscribe_event = v4l2_ctrl_subdev_subscribe_event,
++	.unsubscribe_event = v4l2_event_subdev_unsubscribe,
++};
++
++static const struct v4l2_subdev_video_ops imx708_video_ops = {
++	.s_stream = imx708_set_stream,
++};
++
++static const struct v4l2_subdev_pad_ops imx708_pad_ops = {
++	.enum_mbus_code = imx708_enum_mbus_code,
++	.get_fmt = imx708_get_pad_format,
++	.set_fmt = imx708_set_pad_format,
++	.get_selection = imx708_get_selection,
++	.enum_frame_size = imx708_enum_frame_size,
++};
++
++static const struct v4l2_subdev_ops imx708_subdev_ops = {
++	.core = &imx708_core_ops,
++	.video = &imx708_video_ops,
++	.pad = &imx708_pad_ops,
++};
++
++static const struct v4l2_subdev_internal_ops imx708_internal_ops = {
++	.open = imx708_open,
++};
++
++static const struct v4l2_ctrl_config imx708_notify_gains_ctrl = {
++	.ops = &imx708_ctrl_ops,
++	.id = V4L2_CID_NOTIFY_GAINS,
++	.type = V4L2_CTRL_TYPE_U32,
++	.min = IMX708_COLOUR_BALANCE_MIN,
++	.max = IMX708_COLOUR_BALANCE_MAX,
++	.step = IMX708_COLOUR_BALANCE_STEP,
++	.def = IMX708_COLOUR_BALANCE_DEFAULT,
++	.dims = { 4 },
++	.elem_size = sizeof(u32),
++};
++
++/* Initialize control handlers */
++static int imx708_init_controls(struct imx708 *imx708)
++{
++	struct v4l2_ctrl_handler *ctrl_hdlr;
++	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
++	struct v4l2_fwnode_device_properties props;
++	unsigned int i;
++	int ret;
++
++	ctrl_hdlr = &imx708->ctrl_handler;
++	ret = v4l2_ctrl_handler_init(ctrl_hdlr, 16);
++	if (ret)
++		return ret;
++
++	mutex_init(&imx708->mutex);
++	ctrl_hdlr->lock = &imx708->mutex;
++
++	/* By default, PIXEL_RATE is read only */
++	imx708->pixel_rate = v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops,
++					       V4L2_CID_PIXEL_RATE,
++					       IMX708_INITIAL_PIXEL_RATE,
++					       IMX708_INITIAL_PIXEL_RATE, 1,
++					       IMX708_INITIAL_PIXEL_RATE);
++
++	/*
++	 * Create the controls here, but mode specific limits are setup
++	 * in the imx708_set_framing_limits() call below.
++	 */
++	imx708->vblank = v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops,
++					   V4L2_CID_VBLANK, 0, 0xffff, 1, 0);
++	imx708->hblank = v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops,
++					   V4L2_CID_HBLANK, 0, 0xffff, 1, 0);
++
++	imx708->exposure = v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops,
++					     V4L2_CID_EXPOSURE,
++					     IMX708_EXPOSURE_MIN,
++					     IMX708_EXPOSURE_MAX,
++					     IMX708_EXPOSURE_STEP,
++					     IMX708_EXPOSURE_DEFAULT);
++
++	v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops, V4L2_CID_ANALOGUE_GAIN,
++			  IMX708_ANA_GAIN_MIN, IMX708_ANA_GAIN_MAX,
++			  IMX708_ANA_GAIN_STEP, IMX708_ANA_GAIN_DEFAULT);
++
++	v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops, V4L2_CID_DIGITAL_GAIN,
++			  IMX708_DGTL_GAIN_MIN, IMX708_DGTL_GAIN_MAX,
++			  IMX708_DGTL_GAIN_STEP, IMX708_DGTL_GAIN_DEFAULT);
++
++	imx708->hflip = v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops,
++					  V4L2_CID_HFLIP, 0, 1, 1, 0);
++
++	imx708->vflip = v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops,
++					  V4L2_CID_VFLIP, 0, 1, 1, 0);
++
++	v4l2_ctrl_new_std_menu_items(ctrl_hdlr, &imx708_ctrl_ops,
++				     V4L2_CID_TEST_PATTERN,
++				     ARRAY_SIZE(imx708_test_pattern_menu) - 1,
++				     0, 0, imx708_test_pattern_menu);
++	for (i = 0; i < 4; i++) {
++		/*
++		 * The assumption is that
++		 * V4L2_CID_TEST_PATTERN_GREENR == V4L2_CID_TEST_PATTERN_RED + 1
++		 * V4L2_CID_TEST_PATTERN_BLUE   == V4L2_CID_TEST_PATTERN_RED + 2
++		 * V4L2_CID_TEST_PATTERN_GREENB == V4L2_CID_TEST_PATTERN_RED + 3
++		 */
++		v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops,
++				  V4L2_CID_TEST_PATTERN_RED + i,
++				  IMX708_TEST_PATTERN_COLOUR_MIN,
++				  IMX708_TEST_PATTERN_COLOUR_MAX,
++				  IMX708_TEST_PATTERN_COLOUR_STEP,
++				  IMX708_TEST_PATTERN_COLOUR_MAX);
++		/* The "Solid color" pattern is white by default */
++	}
++
++	imx708->notify_gains = v4l2_ctrl_new_custom(ctrl_hdlr,
++						    &imx708_notify_gains_ctrl, NULL);
++
++	imx708->hdr_mode = v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops,
++					     V4L2_CID_WIDE_DYNAMIC_RANGE,
++					     0, 1, 1, 0);
++
++	ret = v4l2_fwnode_device_parse(&client->dev, &props);
++	if (ret)
++		goto error;
++
++	v4l2_ctrl_new_fwnode_properties(ctrl_hdlr, &imx708_ctrl_ops, &props);
++
++	if (ctrl_hdlr->error) {
++		ret = ctrl_hdlr->error;
++		dev_err(&client->dev, "%s control init failed (%d)\n",
++			__func__, ret);
++		goto error;
++	}
++
++	imx708->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++	imx708->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++	imx708->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++	imx708->hdr_mode->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
++	imx708->sd.ctrl_handler = ctrl_hdlr;
++
++	/* Setup exposure and frame/line length limits. */
++	imx708_set_framing_limits(imx708);
++
++	return 0;
++
++error:
++	v4l2_ctrl_handler_free(ctrl_hdlr);
++	mutex_destroy(&imx708->mutex);
++
++	return ret;
++}
++
++static void imx708_free_controls(struct imx708 *imx708)
++{
++	v4l2_ctrl_handler_free(imx708->sd.ctrl_handler);
++	mutex_destroy(&imx708->mutex);
++}
++
++static int imx708_check_hwcfg(struct device *dev)
++{
++	struct fwnode_handle *endpoint;
++	struct v4l2_fwnode_endpoint ep_cfg = {
++		.bus_type = V4L2_MBUS_CSI2_DPHY
++	};
++	int ret = -EINVAL;
++
++	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
++	if (!endpoint) {
++		dev_err(dev, "endpoint node not found\n");
++		return -EINVAL;
++	}
++
++	if (v4l2_fwnode_endpoint_alloc_parse(endpoint, &ep_cfg)) {
++		dev_err(dev, "could not parse endpoint\n");
++		goto error_out;
++	}
++
++	/* Check the number of MIPI CSI2 data lanes */
++	if (ep_cfg.bus.mipi_csi2.num_data_lanes != 2) {
++		dev_err(dev, "only 2 data lanes are currently supported\n");
++		goto error_out;
++	}
++
++	/* Check the link frequency set in device tree */
++	if (!ep_cfg.nr_of_link_frequencies) {
++		dev_err(dev, "link-frequency property not found in DT\n");
++		goto error_out;
++	}
++
++	if (ep_cfg.nr_of_link_frequencies != 1 ||
++	    ep_cfg.link_frequencies[0] != IMX708_DEFAULT_LINK_FREQ) {
++		dev_err(dev, "Link frequency not supported: %lld\n",
++			ep_cfg.link_frequencies[0]);
++		goto error_out;
++	}
++
++	ret = 0;
++
++error_out:
++	v4l2_fwnode_endpoint_free(&ep_cfg);
++	fwnode_handle_put(endpoint);
++
++	return ret;
++}
++
++static int imx708_probe(struct i2c_client *client)
++{
++	struct device *dev = &client->dev;
++	struct imx708 *imx708;
++	int ret;
++
++	imx708 = devm_kzalloc(&client->dev, sizeof(*imx708), GFP_KERNEL);
++	if (!imx708)
++		return -ENOMEM;
++
++	v4l2_i2c_subdev_init(&imx708->sd, client, &imx708_subdev_ops);
++
++	/* Check the hardware configuration in device tree */
++	if (imx708_check_hwcfg(dev))
++		return -EINVAL;
++
++	/* Get system clock (xclk) */
++	imx708->xclk = devm_clk_get(dev, NULL);
++	if (IS_ERR(imx708->xclk)) {
++		dev_err(dev, "failed to get xclk\n");
++		return PTR_ERR(imx708->xclk);
++	}
++
++	imx708->xclk_freq = clk_get_rate(imx708->xclk);
++	if (imx708->xclk_freq != IMX708_XCLK_FREQ) {
++		dev_err(dev, "xclk frequency not supported: %d Hz\n",
++			imx708->xclk_freq);
++		return -EINVAL;
++	}
++
++	ret = imx708_get_regulators(imx708);
++	if (ret) {
++		dev_err(dev, "failed to get regulators\n");
++		return ret;
++	}
++
++	/* Request optional enable pin */
++	imx708->reset_gpio = devm_gpiod_get_optional(dev, "reset",
++						     GPIOD_OUT_HIGH);
++
++	/*
++	 * The sensor must be powered for imx708_identify_module()
++	 * to be able to read the CHIP_ID register
++	 */
++	ret = imx708_power_on(dev);
++	if (ret)
++		return ret;
++
++	ret = imx708_identify_module(imx708);
++	if (ret)
++		goto error_power_off;
++
++	/* Initialize default format */
++	imx708_set_default_format(imx708);
++
++	/* Enable runtime PM and turn off the device */
++	pm_runtime_set_active(dev);
++	pm_runtime_enable(dev);
++	pm_runtime_idle(dev);
++
++	/* This needs the pm runtime to be registered. */
++	ret = imx708_init_controls(imx708);
++	if (ret)
++		goto error_power_off;
++
++	/* Initialize subdev */
++	imx708->sd.internal_ops = &imx708_internal_ops;
++	imx708->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE |
++			    V4L2_SUBDEV_FL_HAS_EVENTS;
++	imx708->sd.entity.function = MEDIA_ENT_F_CAM_SENSOR;
++
++	/* Initialize source pads */
++	imx708->pad[IMAGE_PAD].flags = MEDIA_PAD_FL_SOURCE;
++	imx708->pad[METADATA_PAD].flags = MEDIA_PAD_FL_SOURCE;
++
++	ret = media_entity_pads_init(&imx708->sd.entity, NUM_PADS, imx708->pad);
++	if (ret) {
++		dev_err(dev, "failed to init entity pads: %d\n", ret);
++		goto error_handler_free;
++	}
++
++	ret = v4l2_async_register_subdev_sensor(&imx708->sd);
++	if (ret < 0) {
++		dev_err(dev, "failed to register sensor sub-device: %d\n", ret);
++		goto error_media_entity;
++	}
++
++	return 0;
++
++error_media_entity:
++	media_entity_cleanup(&imx708->sd.entity);
++
++error_handler_free:
++	imx708_free_controls(imx708);
++
++error_power_off:
++	pm_runtime_disable(&client->dev);
++	pm_runtime_set_suspended(&client->dev);
++	imx708_power_off(&client->dev);
++
++	return ret;
++}
++
++static void imx708_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx708 *imx708 = to_imx708(sd);
++
++	v4l2_async_unregister_subdev(sd);
++	media_entity_cleanup(&sd->entity);
++	imx708_free_controls(imx708);
++
++	pm_runtime_disable(&client->dev);
++	if (!pm_runtime_status_suspended(&client->dev))
++		imx708_power_off(&client->dev);
++	pm_runtime_set_suspended(&client->dev);
++}
++
++static const struct of_device_id imx708_dt_ids[] = {
++	{ .compatible = "sony,imx708" },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, imx708_dt_ids);
++
++static const struct dev_pm_ops imx708_pm_ops = {
++	SET_SYSTEM_SLEEP_PM_OPS(imx708_suspend, imx708_resume)
++	SET_RUNTIME_PM_OPS(imx708_power_off, imx708_power_on, NULL)
++};
++
++static struct i2c_driver imx708_i2c_driver = {
++	.driver = {
++		.name = "imx708",
++		.of_match_table	= imx708_dt_ids,
++		.pm = &imx708_pm_ops,
++	},
++	.probe_new = imx708_probe,
++	.remove = imx708_remove,
++};
++
++module_i2c_driver(imx708_i2c_driver);
++
++MODULE_AUTHOR("David Plowman <david.plowman@raspberrypi.com>");
++MODULE_DESCRIPTION("Sony IMX708 sensor driver");
++MODULE_LICENSE("GPL v2");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0530-dtoverlays-Add-overlays-for-the-IMX708-image-sensor.patch b/target/linux/bcm27xx/patches-6.1/950-0530-dtoverlays-Add-overlays-for-the-IMX708-image-sensor.patch
new file mode 100644
index 00000000000000..bbfa81a4b1fda0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0530-dtoverlays-Add-overlays-for-the-IMX708-image-sensor.patch
@@ -0,0 +1,434 @@
+From 15808e7f0b3e320c52e71cab722f2dbb137a6d95 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 22 Dec 2022 14:12:54 +0000
+Subject: [PATCH] dtoverlays: Add overlays for the IMX708 image sensor
+
+New overlay to support the Sony IMX708 image sensor.
+This includes a VCM for lens control.
+Also adds support to the camera mux overlays.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/Makefile           |   1 +
+ arch/arm/boot/dts/overlays/README             |  23 ++++
+ .../dts/overlays/camera-mux-2port-overlay.dts |  32 ++++++
+ .../dts/overlays/camera-mux-4port-overlay.dts |  64 +++++++++++
+ arch/arm/boot/dts/overlays/imx708-overlay.dts | 104 ++++++++++++++++++
+ arch/arm/boot/dts/overlays/imx708.dtsi        |  35 ++++++
+ 6 files changed, 259 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/imx708-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx708.dtsi
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -122,6 +122,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	imx462.dtbo \
+ 	imx477.dtbo \
+ 	imx519.dtbo \
++	imx708.dtbo \
+ 	iqaudio-codec.dtbo \
+ 	iqaudio-dac.dtbo \
+ 	iqaudio-dacplus.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -716,6 +716,7 @@ Params: cam0-imx219             Select I
+         cam0-imx258             Select IMX258 for camera on port 0
+         cam0-imx290             Select IMX290 for camera on port 0
+         cam0-imx477             Select IMX477 for camera on port 0
++        cam0-imx708             Select IMX708 for camera on port 0
+         cam0-ov2311             Select OV2311 for camera on port 0
+         cam0-ov5647             Select OV5647 for camera on port 0
+         cam0-ov7251             Select OV7251 for camera on port 0
+@@ -725,6 +726,7 @@ Params: cam0-imx219             Select I
+         cam1-imx258             Select IMX258 for camera on port 1
+         cam1-imx290             Select IMX290 for camera on port 1
+         cam1-imx477             Select IMX477 for camera on port 1
++        cam1-imx708             Select IMX708 for camera on port 1
+         cam1-ov2311             Select OV2311 for camera on port 1
+         cam1-ov5647             Select OV5647 for camera on port 1
+         cam1-ov7251             Select OV7251 for camera on port 1
+@@ -741,6 +743,7 @@ Params: cam0-imx219             Select I
+         cam0-imx258             Select IMX258 for camera on port 0
+         cam0-imx290             Select IMX290 for camera on port 0
+         cam0-imx477             Select IMX477 for camera on port 0
++        cam0-imx708             Select IMX708 for camera on port 0
+         cam0-ov2311             Select OV2311 for camera on port 0
+         cam0-ov5647             Select OV5647 for camera on port 0
+         cam0-ov7251             Select OV7251 for camera on port 0
+@@ -750,6 +753,7 @@ Params: cam0-imx219             Select I
+         cam1-imx258             Select IMX258 for camera on port 1
+         cam1-imx290             Select IMX290 for camera on port 1
+         cam1-imx477             Select IMX477 for camera on port 1
++        cam1-imx708             Select IMX708 for camera on port 1
+         cam1-ov2311             Select OV2311 for camera on port 1
+         cam1-ov5647             Select OV5647 for camera on port 1
+         cam1-ov7251             Select OV7251 for camera on port 1
+@@ -759,6 +763,7 @@ Params: cam0-imx219             Select I
+         cam2-imx258             Select IMX258 for camera on port 2
+         cam2-imx290             Select IMX290 for camera on port 2
+         cam2-imx477             Select IMX477 for camera on port 2
++        cam2-imx708             Select IMX708 for camera on port 2
+         cam2-ov2311             Select OV2311 for camera on port 2
+         cam2-ov5647             Select OV5647 for camera on port 2
+         cam2-ov7251             Select OV7251 for camera on port 2
+@@ -768,6 +773,7 @@ Params: cam0-imx219             Select I
+         cam3-imx258             Select IMX258 for camera on port 3
+         cam3-imx290             Select IMX290 for camera on port 3
+         cam3-imx477             Select IMX477 for camera on port 3
++        cam3-imx708             Select IMX708 for camera on port 3
+         cam3-ov2311             Select OV2311 for camera on port 3
+         cam3-ov5647             Select OV5647 for camera on port 3
+         cam3-ov7251             Select OV7251 for camera on port 3
+@@ -2345,6 +2351,23 @@ Params: rotation                Mounting
+         media-controller        Configure use of Media Controller API for
+                                 configuring the sensor (default on)
+         cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   imx708
++Info:   Sony IMX708 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=imx708,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 180)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        vcm                     Select lens driver state. Default is enabled,
++                                but vcm=off will disable.
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
+                                 Compute Module (CSI0, i2c_vc, and cam0_reg).
+ 
+ 
+--- a/arch/arm/boot/dts/overlays/camera-mux-2port-overlay.dts
++++ b/arch/arm/boot/dts/overlays/camera-mux-2port-overlay.dts
+@@ -112,6 +112,16 @@
+ 					#undef cam_endpoint
+ 					#undef cam1_clk
+ 
++					#define cam_node imx708_0
++					#define cam_endpoint imx708_0_ep
++					#define vcm_node imx708_0_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx708.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
+ 					#define cam_node ov5647_0
+ 					#define cam_endpoint ov5647_0_ep
+ 					#define cam1_clk clk_25mhz
+@@ -182,6 +192,16 @@
+ 					#undef cam_endpoint
+ 					#undef cam1_clk
+ 
++					#define cam_node imx708_1
++					#define cam_endpoint imx708_1_ep
++					#define vcm_node imx708_1_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx708.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
+ 					#define cam_node ov5647_1
+ 					#define cam_endpoint ov5647_1_ep
+ 					#define cam1_clk clk_25mhz
+@@ -353,6 +373,12 @@
+ 			      <&imx477_0_ep>, "remote-endpoint:0=",<&mux_in0>,
+ 			      <&mux_in0>, "clock-noncontinuous?",
+ 			      <&imx477_0>, "status=okay";
++		cam0-imx708 = <&mux_in0>, "remote-endpoint:0=",<&imx708_0_ep>,
++			      <&imx708_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&mux_in0>, "clock-noncontinuous?",
++			      <&imx708_0>, "status=okay",
++			      <&imx708_0_vcm>, "status=okay",
++			      <&imx708_0>,"lens-focus:0=", <&imx708_0_vcm>;
+ 		cam0-ov5647 = <&mux_in0>, "remote-endpoint:0=",<&ov5647_0_ep>,
+ 			      <&ov5647_0_ep>, "remote-endpoint:0=",<&mux_in0>,
+ 			      <&ov5647_0>, "status=okay";
+@@ -381,6 +407,12 @@
+ 			      <&imx477_1_ep>, "remote-endpoint:0=",<&mux_in1>,
+ 			      <&mux_in1>, "clock-noncontinuous?",
+ 			      <&imx477_1>, "status=okay";
++		cam1-imx708 = <&mux_in1>, "remote-endpoint:0=",<&imx708_1_ep>,
++			      <&imx708_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&mux_in1>, "clock-noncontinuous?",
++			      <&imx708_1>, "status=okay",
++			      <&imx708_1_vcm>, "status=okay",
++			      <&imx708_1>,"lens-focus:0=", <&imx708_1_vcm>;
+ 		cam1-ov5647 = <&mux_in1>, "remote-endpoint:0=",<&ov5647_1_ep>,
+ 			      <&ov5647_1_ep>, "remote-endpoint:0=",<&mux_in1>,
+ 			      <&ov5647_1>, "status=okay";
+--- a/arch/arm/boot/dts/overlays/camera-mux-4port-overlay.dts
++++ b/arch/arm/boot/dts/overlays/camera-mux-4port-overlay.dts
+@@ -170,6 +170,16 @@
+ 					#undef cam_endpoint
+ 					#undef cam1_clk
+ 
++					#define cam_node imx708_0
++					#define cam_endpoint imx708_0_ep
++					#define vcm_node imx708_0_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx708.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
+ 					#define cam_node ov5647_0
+ 					#define cam_endpoint ov5647_0_ep
+ 					#define cam1_clk clk_25mhz
+@@ -240,6 +250,16 @@
+ 					#undef cam_endpoint
+ 					#undef cam1_clk
+ 
++					#define cam_node imx708_1
++					#define cam_endpoint imx708_1_ep
++					#define vcm_node imx708_1_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx708.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
+ 					#define cam_node ov5647_1
+ 					#define cam_endpoint ov5647_1_ep
+ 					#define cam1_clk clk_25mhz
+@@ -310,6 +330,16 @@
+ 					#undef cam_endpoint
+ 					#undef cam1_clk
+ 
++					#define cam_node imx708_2
++					#define cam_endpoint imx708_2_ep
++					#define vcm_node imx708_2_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx708.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
+ 					#define cam_node ov5647_2
+ 					#define cam_endpoint ov5647_2_ep
+ 					#define cam1_clk clk_25mhz
+@@ -380,6 +410,16 @@
+ 					#undef cam_endpoint
+ 					#undef cam1_clk
+ 
++					#define cam_node imx708_3
++					#define cam_endpoint imx708_3_ep
++					#define vcm_node imx708_3_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx708.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
+ 					#define cam_node ov5647_3
+ 					#define cam_endpoint ov5647_3_ep
+ 					#define cam1_clk clk_25mhz
+@@ -568,6 +608,12 @@
+ 			      <&imx477_0_ep>, "remote-endpoint:0=",<&mux_in0>,
+ 			      <&mux_in0>, "clock-noncontinuous?",
+ 			      <&imx477_0>, "status=okay";
++		cam0-imx708 = <&mux_in0>, "remote-endpoint:0=",<&imx708_0_ep>,
++			      <&imx708_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&mux_in0>, "clock-noncontinuous?",
++			      <&imx708_0>, "status=okay",
++			      <&imx708_0_vcm>, "status=okay",
++			      <&imx708_0>,"lens-focus:0=", <&imx708_0_vcm>;
+ 		cam0-ov5647 = <&mux_in0>, "remote-endpoint:0=",<&ov5647_0_ep>,
+ 			      <&ov5647_0_ep>, "remote-endpoint:0=",<&mux_in0>,
+ 			      <&ov5647_0>, "status=okay";
+@@ -596,6 +642,12 @@
+ 			      <&imx477_1_ep>, "remote-endpoint:0=",<&mux_in1>,
+ 			      <&mux_in1>, "clock-noncontinuous?",
+ 			      <&imx477_1>, "status=okay";
++		cam1-imx708 = <&mux_in1>, "remote-endpoint:0=",<&imx708_1_ep>,
++			      <&imx708_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&mux_in1>, "clock-noncontinuous?",
++			      <&imx708_1>, "status=okay",
++			      <&imx708_1_vcm>, "status=okay",
++			      <&imx708_1>,"lens-focus:0=", <&imx708_1_vcm>;
+ 		cam1-ov5647 = <&mux_in1>, "remote-endpoint:0=",<&ov5647_1_ep>,
+ 			      <&ov5647_1_ep>, "remote-endpoint:0=",<&mux_in1>,
+ 			      <&ov5647_1>, "status=okay";
+@@ -624,6 +676,12 @@
+ 			      <&imx477_2_ep>, "remote-endpoint:0=",<&mux_in2>,
+ 			      <&mux_in2>, "clock-noncontinuous?",
+ 			      <&imx477_2>, "status=okay";
++		cam2-imx708 = <&mux_in2>, "remote-endpoint:0=",<&imx708_2_ep>,
++			      <&imx708_2_ep>, "remote-endpoint:0=",<&mux_in2>,
++			      <&mux_in2>, "clock-noncontinuous?",
++			      <&imx708_2>, "status=okay",
++			      <&imx708_2_vcm>, "status=okay",
++			      <&imx708_2>,"lens-focus:0=", <&imx708_2_vcm>;
+ 		cam2-ov5647 = <&mux_in2>, "remote-endpoint:0=",<&ov5647_2_ep>,
+ 			      <&ov5647_2_ep>, "remote-endpoint:0=",<&mux_in2>,
+ 			      <&ov5647_2>, "status=okay";
+@@ -652,6 +710,12 @@
+ 			      <&imx477_3_ep>, "remote-endpoint:0=",<&mux_in3>,
+ 			      <&mux_in3>, "clock-noncontinuous?",
+ 			      <&imx477_3>, "status=okay";
++		cam3-imx708 = <&mux_in3>, "remote-endpoint:0=",<&imx708_3_ep>,
++			      <&imx708_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++			      <&mux_in3>, "clock-noncontinuous?",
++			      <&imx708_3>, "status=okay",
++			      <&imx708_3_vcm>, "status=okay",
++			      <&imx708_3>,"lens-focus:0=", <&imx708_3_vcm>;
+ 		cam3-ov5647 = <&mux_in3>, "remote-endpoint:0=",<&ov5647_3_ep>,
+ 			      <&ov5647_3_ep>, "remote-endpoint:0=",<&mux_in3>,
+ 			      <&ov5647_3>, "status=okay";
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx708-overlay.dts
+@@ -0,0 +1,104 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX708 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@1 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			status = "okay";
++			clock-frequency = <24000000>;
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	reg_frag: fragment@3 {
++		target = <&cam1_reg>;
++		cam_reg: __overlay__ {
++			startup-delay-us = <70000>;
++			off-on-delay-us = <30000>;
++			regulator-min-microvolt = <2700000>;
++			regulator-max-microvolt = <2700000>;
++		};
++	};
++
++	fragment@4 {
++		target = <&cam_node>;
++		__overlay__ {
++			lens-focus = <&vcm_node>;
++		};
++	};
++
++	i2c_frag: fragment@100 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "imx708.dtsi"
++		};
++	};
++
++	csi_frag: fragment@101 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++			brcm,media-controller;
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	__overrides__ {
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <&csi>,"brcm,media-controller?";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_vc>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&reg_frag>, "target:0=",<&cam0_reg>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "VANA1-supply:0=",<&cam0_reg>,
++		       <&vcm_node>, "VDD-supply:0=",<&cam0_reg>;
++		vcm = <&vcm_node>, "status",
++		      <0>, "=4";
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
++
++&vcm_node {
++	status = "okay";
++};
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx708.dtsi
+@@ -0,0 +1,35 @@
++// Fragment that configures a Sony IMX708
++
++cam_node: imx708@1a {
++	compatible = "sony,imx708";
++	reg = <0x1a>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "xclk";
++
++	VANA1-supply = <&cam1_reg>;	/* 2.8v */
++	VANA2-supply = <&cam_dummy_reg>;/* 1.8v */
++	VDIG-supply = <&cam_dummy_reg>;	/* 1.1v */
++	VDDL-supply = <&cam_dummy_reg>;	/* 1.8v */
++
++	rotation = <180>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			data-lanes = <1 2>;
++			clock-noncontinuous;
++			link-frequencies =
++				/bits/ 64 <450000000>;
++		};
++	};
++};
++
++vcm_node: dw9817@c {
++	compatible = "dongwoon,dw9817-vcm";
++	reg = <0x0c>;
++	status = "disabled";
++	VDD-supply = <&cam1_reg>;
++};
diff --git a/target/linux/bcm27xx/patches-6.1/950-0531-net-phy-broadcom-Make-LEDs-3-4-shadow-LEDs-1-2.patch b/target/linux/bcm27xx/patches-6.1/950-0531-net-phy-broadcom-Make-LEDs-3-4-shadow-LEDs-1-2.patch
new file mode 100644
index 00000000000000..ce389fd3f07aa3
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0531-net-phy-broadcom-Make-LEDs-3-4-shadow-LEDs-1-2.patch
@@ -0,0 +1,35 @@
+From 72f813551de816215429cae538359371730ade97 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 3 Jan 2023 16:00:21 +0000
+Subject: [PATCH] net: phy: broadcom: Make LEDs 3+4 shadow LEDs 1+2
+
+CM4 uses BCM54210PE, which supports 2 additional LEDs, choosing LED3
+for the amber LED because it shows activity by default (LED4 is not
+connected). However, this makes it uncontrollable by the eth_led<n>
+dtparams which target LEDs 1+2.
+
+Solve the problem by making LEDs 3+4 mirror LEDs 1+2 (which is much
+simpler than adding baseboard-specific overrides, but comes with a
+risk of making one of the LEDs redundant).
+
+See: https://github.com/raspberrypi/linux/issues/5289
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/phy/broadcom.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -416,6 +416,11 @@ static int bcm54xx_config_init(struct ph
+ 		val = BCM5482_SHD_LEDS1_LED1(BCM_LED_SRC_MULTICOLOR1) |
+ 			BCM5482_SHD_LEDS1_LED3(BCM_LED_SRC_MULTICOLOR1);
+ 		bcm_phy_write_shadow(phydev, BCM5482_SHD_LEDS1, val);
++		/* BCM54210PE controls two extra LEDs with the next register.
++		 * Make them shadow the first pair of LEDs - useful on CM4 which
++		 * uses LED3 for ETH_LEDY instead of LED1.
++		 */
++		bcm_phy_write_shadow(phydev, BCM5482_SHD_LEDS1 + 1, val);
+ 
+ 		val = BCM_LED_MULTICOLOR_IN_PHASE |
+ 			BCM5482_SHD_LEDS1_LED1(led_modes[0]) |
diff --git a/target/linux/bcm27xx/patches-6.1/950-0532-overlays-i2c-sensor-MS-temp-pressure-sensors.patch b/target/linux/bcm27xx/patches-6.1/950-0532-overlays-i2c-sensor-MS-temp-pressure-sensors.patch
new file mode 100644
index 00000000000000..368c4e9e87d27d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0532-overlays-i2c-sensor-MS-temp-pressure-sensors.patch
@@ -0,0 +1,150 @@
+From 837a3647eb9edd7b11d98d85e9c70997a6717397 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 4 Jan 2023 09:14:53 +0000
+Subject: [PATCH] overlays: i2c-sensor: MS temp & pressure sensors
+
+Add support for the Measurement Specialities temperature and pressure
+sensors to the i2c-sensor overlay. The supported devices are MS5637,
+MS5803, MS5805, MS5837 and MS8607.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README             | 20 ++++-
+ .../boot/dts/overlays/i2c-sensor-common.dtsi  | 79 ++++++++++++++++++-
+ 2 files changed, 96 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -1982,8 +1982,9 @@ Info:   Adds support for a number of I2C
+         light level and chemical sensors on i2c_arm
+ Load:   dtoverlay=i2c-sensor,<param>=<val>
+ Params: addr                    Set the address for the BH1750, BME280, BME680,
+-                                BMP280, CCS811, DS1621, HDC100X, LM75, SHT3x or
+-                                TMP102
++                                BMP280, CCS811, DS1621, HDC100X, JC42, LM75,
++                                MCP980x, MS5637, MS5803, MS5805, MS5837, MS8607,
++                                SHT3x or TMP102
+ 
+         aht10                   Select the Aosong AHT10 temperature and humidity
+                                 sensor
+@@ -2044,6 +2045,21 @@ Params: addr                    Set the
+                                 use the "jc42" option.
+                                 Valid addresses are 0x18-0x1f (default 0x18)
+ 
++        ms5637                  Select the Measurement Specialities MS5637
++                                pressure and temperature sensor.
++
++        ms5803                  Select the Measurement Specialities MS5803
++                                pressure and temperature sensor.
++
++        ms5805                  Select the Measurement Specialities MS5805
++                                pressure and temperature sensor.
++
++        ms5837                  Select the Measurement Specialities MS5837
++                                pressure and temperature sensor.
++
++        ms8607                  Select the Measurement Specialities MS8607
++                                pressure and temperature sensor.
++
+         no_timeout              Disable the SMBUS timeout. N.B. Only supported
+                                 by some jc42 devices - using with an
+                                 incompatible device can stop it from being
+--- a/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+@@ -351,6 +351,76 @@
+ 		};
+ 	};
+ 
++	fragment@23 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ms5637: ms5637@76 {
++				compatible = "meas,ms5637";
++				reg = <0x76>;
++			};
++		};
++	};
++
++	fragment@24 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ms5803: ms5803@76 {
++				compatible = "meas,ms5803";
++				reg = <0x76>;
++			};
++		};
++	};
++
++	fragment@25 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ms5805: ms5805@76 {
++				compatible = "meas,ms5805";
++				reg = <0x76>;
++			};
++		};
++	};
++
++	fragment@26 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ms5837: ms5837@76 {
++				compatible = "meas,ms5837";
++				reg = <0x76>;
++			};
++		};
++	};
++
++	fragment@27 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ms8607: ms8607@76 {
++				compatible = "meas,ms8607-temppressure";
++				reg = <0x76>;
++			};
++		};
++	};
++
+ 	__overrides__ {
+ 		bme280 = <0>,"+0";
+ 		bmp085 = <0>,"+1";
+@@ -376,11 +446,18 @@
+ 		aht10 = <0>,"+20";
+ 		mcp980x = <0>,"+21";
+ 		jc42 = <0>,"+22";
++		ms5637 = <0>,"+23";
++		ms5803 = <0>,"+24";
++		ms5805 = <0>,"+25";
++		ms5837 = <0>,"+26";
++		ms8607 = <0>,"+27";
+ 
+ 		addr =  <&bme280>,"reg:0", <&bmp280>,"reg:0", <&tmp102>,"reg:0",
+ 			<&lm75>,"reg:0", <&hdc100x>,"reg:0", <&sht3x>,"reg:0",
+ 			<&ds1621>,"reg:0", <&bme680>,"reg:0", <&ccs811>,"reg:0",
+-			<&bh1750>,"reg:0", <&mcp980x>,"reg:0", <&jc42>,"reg:0";
++			<&bh1750>,"reg:0", <&mcp980x>,"reg:0", <&jc42>,"reg:0",
++			<&ms5637>,"reg:0", <&ms5803>,"reg:0", <&ms5805>,"reg:0",
++			<&ms5837>,"reg:0", <&ms8607>,"reg:0";
+ 		int_pin = <&max30102>, "interrupts:0";
+ 		no_timeout = <&jc42>, "smbus-timeout-disable?";
+ 	};
diff --git a/target/linux/bcm27xx/patches-6.1/950-0533-drivers-media-imx708-Enable-long-exposure-mode.patch b/target/linux/bcm27xx/patches-6.1/950-0533-drivers-media-imx708-Enable-long-exposure-mode.patch
new file mode 100644
index 00000000000000..9672efdfd9384e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0533-drivers-media-imx708-Enable-long-exposure-mode.patch
@@ -0,0 +1,102 @@
+From 321814f1f361336278e9d682492152098b0a0f00 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Thu, 5 Jan 2023 14:44:48 +0000
+Subject: [PATCH] drivers: media: imx708: Enable long exposure mode
+
+Enable long exposure modes by using the long exposure shift register setting
+in the imx708 sensor.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx708.c | 41 +++++++++++++++++++++++++++++++++-----
+ 1 file changed, 36 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/i2c/imx708.c
++++ b/drivers/media/i2c/imx708.c
+@@ -44,6 +44,10 @@
+ #define IMX708_REG_FRAME_LENGTH		0x0340
+ #define IMX708_FRAME_LENGTH_MAX		0xffff
+ 
++/* Long exposure multiplier */
++#define IMX708_LONG_EXP_SHIFT_MAX	7
++#define IMX708_LONG_EXP_SHIFT_REG	0x3100
++
+ /* Exposure control */
+ #define IMX708_REG_EXPOSURE		0x0202
+ #define IMX708_EXPOSURE_OFFSET		48
+@@ -806,6 +810,9 @@ struct imx708 {
+ 
+ 	/* Rewrite common registers on stream on? */
+ 	bool common_regs_written;
++
++	/* Current long exposure factor in use. Set through V4L2_CID_VBLANK */
++	unsigned int long_exp_shift;
+ };
+ 
+ static inline struct imx708 *to_imx708(struct v4l2_subdev *_sd)
+@@ -994,7 +1001,8 @@ static int imx708_set_exposure(struct im
+ 	 * will automatically divide the medium and short ones by 4,16.
+ 	 */
+ 	ret = imx708_write_reg(imx708, IMX708_REG_EXPOSURE,
+-			       IMX708_REG_VALUE_16BIT, val);
++			       IMX708_REG_VALUE_16BIT,
++			       val >> imx708->long_exp_shift);
+ 
+ 	return ret;
+ }
+@@ -1027,18 +1035,42 @@ static int imx708_set_analogue_gain(stru
+ 	return ret;
+ }
+ 
++static int imx708_set_frame_length(struct imx708 *imx708, unsigned int val)
++{
++	int ret = 0;
++
++	imx708->long_exp_shift = 0;
++
++	while (val > IMX708_FRAME_LENGTH_MAX) {
++		imx708->long_exp_shift++;
++		val >>= 1;
++	}
++
++	ret = imx708_write_reg(imx708, IMX708_REG_FRAME_LENGTH,
++			       IMX708_REG_VALUE_16BIT, val);
++	if (ret)
++		return ret;
++
++	return imx708_write_reg(imx708, IMX708_LONG_EXP_SHIFT_REG,
++				IMX708_REG_VALUE_08BIT, imx708->long_exp_shift);
++}
++
+ static void imx708_set_framing_limits(struct imx708 *imx708)
+ {
+ 	unsigned int hblank;
+ 	const struct imx708_mode *mode = imx708->mode;
+ 
++	/* Default to no long exposure multiplier */
++	imx708->long_exp_shift = 0;
++
+ 	__v4l2_ctrl_modify_range(imx708->pixel_rate,
+ 				 mode->pixel_rate, mode->pixel_rate,
+ 				 1, mode->pixel_rate);
+ 
+ 	/* Update limits and set FPS to default */
+ 	__v4l2_ctrl_modify_range(imx708->vblank, mode->vblank_min,
+-				 IMX708_FRAME_LENGTH_MAX - mode->height,
++				 ((1 << IMX708_LONG_EXP_SHIFT_MAX) *
++					IMX708_FRAME_LENGTH_MAX) - mode->height,
+ 				 1, mode->vblank_default);
+ 
+ 	/*
+@@ -1112,9 +1144,8 @@ static int imx708_set_ctrl(struct v4l2_c
+ 				       imx708->vflip->val << 1);
+ 		break;
+ 	case V4L2_CID_VBLANK:
+-		ret = imx708_write_reg(imx708, IMX708_REG_FRAME_LENGTH,
+-				       IMX708_REG_VALUE_16BIT,
+-				       imx708->mode->height + ctrl->val);
++		ret = imx708_set_frame_length(imx708,
++					      imx708->mode->height + ctrl->val);
+ 		break;
+ 	case V4L2_CID_NOTIFY_GAINS:
+ 		ret = imx708_write_reg(imx708, IMX708_REG_COLOUR_BALANCE_BLUE,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0534-drivers-media-i2c-imx708-Fix-crop-information.patch b/target/linux/bcm27xx/patches-6.1/950-0534-drivers-media-i2c-imx708-Fix-crop-information.patch
new file mode 100644
index 00000000000000..5f30cc4c078d94
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0534-drivers-media-i2c-imx708-Fix-crop-information.patch
@@ -0,0 +1,29 @@
+From 5148d8f41352d28fac3752c7aa116fd213e50c98 Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Tue, 10 Jan 2023 13:14:27 +0000
+Subject: [PATCH] drivers: media: i2c: imx708: Fix crop information
+
+The 1536x864 mode contained incorrect crop information.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ drivers/media/i2c/imx708.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/i2c/imx708.c
++++ b/drivers/media/i2c/imx708.c
+@@ -673,10 +673,10 @@ static const struct imx708_mode supporte
+ 		.height = 864,
+ 		.line_length_pix = 0x1460,
+ 		.crop = {
+-			.left = IMX708_PIXEL_ARRAY_LEFT,
+-			.top = IMX708_PIXEL_ARRAY_TOP,
+-			.width = 4608,
+-			.height = 2592,
++			.left = IMX708_PIXEL_ARRAY_LEFT + 768,
++			.top = IMX708_PIXEL_ARRAY_TOP + 432,
++			.width = 3072,
++			.height = 1728,
+ 		},
+ 		.vblank_min = 40,
+ 		.vblank_default = 2755,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0535-drm-vc4-hdmi-Correct-CSC-setup-for-YCbCr4-4-4.patch b/target/linux/bcm27xx/patches-6.1/950-0535-drm-vc4-hdmi-Correct-CSC-setup-for-YCbCr4-4-4.patch
new file mode 100644
index 00000000000000..76b2d41f314524
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0535-drm-vc4-hdmi-Correct-CSC-setup-for-YCbCr4-4-4.patch
@@ -0,0 +1,36 @@
+From e872dd065cd2b55d9532213404dc70f351de0031 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 14 Nov 2022 19:30:27 +0000
+Subject: [PATCH] drm/vc4: hdmi: Correct CSC setup for YCbCr4:4:4
+
+The CSC requires the coefficients to be swapped around for
+4:4:4 mode, but the swap was incorrectly defined.
+
+Correct the swap.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -1335,12 +1335,12 @@ static void vc5_hdmi_set_csc_coeffs_swap
+ 	lockdep_assert_held(&vc4_hdmi->hw_lock);
+ 
+ 	/* YUV444 needs the CSC matrices using the channels in a different order */
+-	HDMI_WRITE(HDMI_CSC_12_11, (coeffs[2][1] << 16) | coeffs[2][0]);
+-	HDMI_WRITE(HDMI_CSC_14_13, (coeffs[2][3] << 16) | coeffs[2][2]);
+-	HDMI_WRITE(HDMI_CSC_22_21, (coeffs[0][1] << 16) | coeffs[0][0]);
+-	HDMI_WRITE(HDMI_CSC_24_23, (coeffs[0][3] << 16) | coeffs[0][2]);
+-	HDMI_WRITE(HDMI_CSC_32_31, (coeffs[1][1] << 16) | coeffs[1][0]);
+-	HDMI_WRITE(HDMI_CSC_34_33, (coeffs[1][3] << 16) | coeffs[1][2]);
++	HDMI_WRITE(HDMI_CSC_12_11, (coeffs[1][1] << 16) | coeffs[1][0]);
++	HDMI_WRITE(HDMI_CSC_14_13, (coeffs[1][3] << 16) | coeffs[1][2]);
++	HDMI_WRITE(HDMI_CSC_22_21, (coeffs[2][1] << 16) | coeffs[2][0]);
++	HDMI_WRITE(HDMI_CSC_24_23, (coeffs[2][3] << 16) | coeffs[2][2]);
++	HDMI_WRITE(HDMI_CSC_32_31, (coeffs[0][1] << 16) | coeffs[0][0]);
++	HDMI_WRITE(HDMI_CSC_34_33, (coeffs[0][3] << 16) | coeffs[0][2]);
+ }
+ 
+ static void vc5_hdmi_csc_setup(struct vc4_hdmi *vc4_hdmi,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0536-drm-vc4-hdmi-Add-property-to-allow-manual-config-of-.patch b/target/linux/bcm27xx/patches-6.1/950-0536-drm-vc4-hdmi-Add-property-to-allow-manual-config-of-.patch
new file mode 100644
index 00000000000000..957b9702467015
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0536-drm-vc4-hdmi-Add-property-to-allow-manual-config-of-.patch
@@ -0,0 +1,176 @@
+From 8bac9bb3f865b262e009faffb31d0d0b844faa5f Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 14 Nov 2022 19:32:10 +0000
+Subject: [PATCH] drm/vc4: hdmi: Add property to allow manual config of
+ RGB or YCbCr
+
+Add a custom property "Output format" that allows the overriding
+of the default colourspace choice in the way that the old
+firmware hdmi_pixel_encoding property did. If the chosen format is not
+supported, then it will still drop back to the older behaviour.
+
+This won't be acceptable to upstream, but it adds back the missing
+functionality of hdmi_pixel_encoding.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 60 ++++++++++++++++++++++++++++++++++
+ drivers/gpu/drm/vc4/vc4_hdmi.h |  8 +++++
+ 2 files changed, 68 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -556,6 +556,7 @@ static int vc4_hdmi_connector_atomic_che
+ 
+ 	if (old_state->colorspace != new_state->colorspace ||
+ 	    old_vc4_state->broadcast_rgb != new_vc4_state->broadcast_rgb ||
++	    old_vc4_state->requested_output_format != new_vc4_state->requested_output_format ||
+ 	    !drm_connector_atomic_hdr_metadata_equal(old_state, new_state)) {
+ 		struct drm_crtc_state *crtc_state;
+ 
+@@ -590,6 +591,8 @@ int vc4_hdmi_connector_get_property(stru
+ 
+ 	if (property == vc4_hdmi->broadcast_rgb_property) {
+ 		*val = vc4_conn_state->broadcast_rgb;
++	} else if (property == vc4_hdmi->output_format_property) {
++		*val = vc4_conn_state->requested_output_format;
+ 	} else {
+ 		DRM_DEBUG_ATOMIC("Unknown property [PROP:%d:%s]\n",
+ 				 property->base.id, property->name);
+@@ -621,6 +624,9 @@ int vc4_hdmi_connector_set_property(stru
+ 	if (property == vc4_hdmi->broadcast_rgb_property) {
+ 		vc4_conn_state->broadcast_rgb = val;
+ 		return 0;
++	} else if (property == vc4_hdmi->output_format_property) {
++		vc4_conn_state->requested_output_format = val;
++		return 0;
+ 	}
+ 
+ 	DRM_DEBUG_ATOMIC("Unknown property [PROP:%d:%s]\n",
+@@ -664,6 +670,7 @@ vc4_hdmi_connector_duplicate_state(struc
+ 	new_state->tmds_char_rate = vc4_state->tmds_char_rate;
+ 	new_state->output_bpc = vc4_state->output_bpc;
+ 	new_state->output_format = vc4_state->output_format;
++	new_state->requested_output_format = vc4_state->requested_output_format;
+ 	new_state->broadcast_rgb = vc4_state->broadcast_rgb;
+ 	__drm_atomic_helper_connector_duplicate_state(connector, &new_state->base);
+ 
+@@ -711,6 +718,33 @@ vc4_hdmi_attach_broadcast_rgb_property(s
+ 	drm_object_attach_property(&vc4_hdmi->connector.base, prop, 0);
+ }
+ 
++static const struct drm_prop_enum_list output_format_names[] = {
++	{ VC4_HDMI_OUTPUT_AUTO, "Automatic" },
++	{ VC4_HDMI_OUTPUT_RGB, "RGB" },
++	{ VC4_HDMI_OUTPUT_YUV422, "YCbCr 4:2:2" },
++	{ VC4_HDMI_OUTPUT_YUV444, "YCbCr 4:4:4" },
++};
++
++static void
++vc4_hdmi_attach_output_format_property(struct drm_device *dev,
++				       struct vc4_hdmi *vc4_hdmi)
++{
++	struct drm_property *prop = vc4_hdmi->output_format_property;
++
++	if (!prop) {
++		prop = drm_property_create_enum(dev, DRM_MODE_PROP_ENUM,
++						"Output format",
++						output_format_names,
++						ARRAY_SIZE(output_format_names));
++		if (!prop)
++			return;
++
++		vc4_hdmi->output_format_property = prop;
++	}
++
++	drm_object_attach_property(&vc4_hdmi->connector.base, prop, 0);
++}
++
+ static int vc4_hdmi_connector_init(struct drm_device *dev,
+ 				   struct vc4_hdmi *vc4_hdmi)
+ {
+@@ -758,6 +792,7 @@ static int vc4_hdmi_connector_init(struc
+ 		drm_connector_attach_hdr_output_metadata_property(connector);
+ 
+ 	vc4_hdmi_attach_broadcast_rgb_property(dev, vc4_hdmi);
++	vc4_hdmi_attach_output_format_property(dev, vc4_hdmi);
+ 
+ 	drm_connector_attach_encoder(connector, encoder);
+ 
+@@ -1895,6 +1930,11 @@ static void vc4_hdmi_encoder_atomic_mode
+ 	vc4_hdmi->broadcast_rgb = vc4_state->broadcast_rgb;
+ 	vc4_hdmi->output_bpc = vc4_state->output_bpc;
+ 	vc4_hdmi->output_format = vc4_state->output_format;
++	vc4_hdmi->requested_output_format = vc4_state->requested_output_format;
++	vc4_hdmi->broadcast_rgb = vc4_state->broadcast_rgb;
++	memcpy(&vc4_hdmi->saved_adjusted_mode,
++	       &crtc_state->adjusted_mode,
++	       sizeof(vc4_hdmi->saved_adjusted_mode));
+ 	mutex_unlock(&vc4_hdmi->mutex);
+ }
+ 
+@@ -2056,6 +2096,26 @@ vc4_hdmi_encoder_compute_format(const st
+ 	const struct drm_display_info *info = &connector->display_info;
+ 	unsigned int format;
+ 
++	if (vc4_state->requested_output_format != VC4_HDMI_OUTPUT_AUTO) {
++		drm_dbg(dev, "Trying with user requested output %u\n",
++			vc4_state->requested_output_format);
++
++		format = vc4_state->requested_output_format;
++		if (vc4_hdmi_sink_supports_format_bpc(vc4_hdmi, info, mode,
++						      format, bpc)) {
++			int ret;
++
++			ret = vc4_hdmi_encoder_compute_clock(vc4_hdmi, vc4_state,
++							     mode, bpc, format);
++			if (!ret) {
++				vc4_state->output_format = format;
++				return 0;
++			}
++		}
++
++		return -EINVAL;
++	}
++
+ 	drm_dbg(dev, "Trying with an RGB output\n");
+ 
+ 	format = VC4_HDMI_OUTPUT_RGB;
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.h
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.h
+@@ -111,6 +111,7 @@ struct vc4_hdmi_audio {
+ };
+ 
+ enum vc4_hdmi_output_format {
++	VC4_HDMI_OUTPUT_AUTO,
+ 	VC4_HDMI_OUTPUT_RGB,
+ 	VC4_HDMI_OUTPUT_YUV422,
+ 	VC4_HDMI_OUTPUT_YUV444,
+@@ -130,6 +131,7 @@ struct vc4_hdmi {
+ 	struct delayed_work scrambling_work;
+ 
+ 	struct drm_property *broadcast_rgb_property;
++	struct drm_property *output_format_property;
+ 
+ 	struct i2c_adapter *ddc;
+ 	void __iomem *hdmicore_regs;
+@@ -223,6 +225,11 @@ struct vc4_hdmi {
+ 	 * for use outside of KMS hooks. Protected by @mutex.
+ 	 */
+ 	enum vc4_hdmi_output_format output_format;
++	/**
++	 * @requested_output_format: Copy of @vc4_connector_state.requested_output_format
++	 * for use outside of KMS hooks. Protected by @mutex.
++	 */
++	enum vc4_hdmi_output_format requested_output_format;
+ 
+ 	/**
+ 	 * @broadcast_rgb: Copy of @vc4_connector_state.broadcast_rgb
+@@ -249,6 +256,7 @@ struct vc4_hdmi_connector_state {
+ 	unsigned long long		tmds_char_rate;
+ 	unsigned int 			output_bpc;
+ 	enum vc4_hdmi_output_format	output_format;
++	enum vc4_hdmi_output_format	requested_output_format;
+ 	int				broadcast_rgb;
+ };
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0537-bcm2835-mmc-Honor-return-value-of-mmc_of_parse.patch b/target/linux/bcm27xx/patches-6.1/950-0537-bcm2835-mmc-Honor-return-value-of-mmc_of_parse.patch
new file mode 100644
index 00000000000000..6648e5e44f3c04
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0537-bcm2835-mmc-Honor-return-value-of-mmc_of_parse.patch
@@ -0,0 +1,30 @@
+From a29e90b43912193131804427e133d1869695044f Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Sat, 14 Jan 2023 10:03:46 +0100
+Subject: [PATCH] bcm2835-mmc: Honor return value of mmc_of_parse()
+
+bcm2835_mmc_probe() ignores errors returned by mmc_of_parse() and in
+particular ignores -EPROBE_DEFER, which may be returned if the power
+sequencing driver configured in the devicetree is compiled as a module.
+
+The user-visible result is that access to the SDIO device fails because
+its power sequencing requirements have not been observed.  Fix it.
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+---
+ drivers/mmc/host/bcm2835-mmc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/bcm2835-mmc.c
++++ b/drivers/mmc/host/bcm2835-mmc.c
+@@ -1474,7 +1474,9 @@ static int bcm2835_mmc_probe(struct plat
+ 	}
+ 
+ 	if (node) {
+-		mmc_of_parse(mmc);
++		ret = mmc_of_parse(mmc);
++		if (ret)
++			goto err;
+ 
+ 		/* Read any custom properties */
+ 		of_property_read_u32(node,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0538-.github-workflows-Set-warnings-as-errors-for-builds.patch b/target/linux/bcm27xx/patches-6.1/950-0538-.github-workflows-Set-warnings-as-errors-for-builds.patch
new file mode 100644
index 00000000000000..f880a637c1833f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0538-.github-workflows-Set-warnings-as-errors-for-builds.patch
@@ -0,0 +1,63 @@
+From 0a1c5c32cfe570a688a09c90ab16052fcb258342 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 13 Jan 2023 14:32:45 +0000
+Subject: [PATCH] .github/workflows: Set warnings-as-errors for builds
+
+To avoid code with build warnings being introduced into the tree, force
+CONFIG_WERROR=y in the build workflow.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .github/workflows/kernel-build.yml | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/.github/workflows/kernel-build.yml
++++ b/.github/workflows/kernel-build.yml
+@@ -38,6 +38,7 @@ jobs:
+       run: |
+         mkdir ${{github.workspace}}/build
+         make ARCH=arm KERNEL=kernel CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build bcm2835_defconfig
++        scripts/config --file ${{github.workspace}}/build/.config --set-val CONFIG_WERROR y
+         make ARCH=arm KERNEL=kernel CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} Image modules dtbs
+         mkdir -p ${{github.workspace}}/install/boot
+         make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
+@@ -78,6 +79,7 @@ jobs:
+       run: |
+         mkdir ${{github.workspace}}/build
+         make ARCH=arm64 KERNEL=kernel8 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build defconfig
++        scripts/config --file ${{github.workspace}}/build/.config --set-val CONFIG_WERROR y
+         make ARCH=arm64 KERNEL=kernel8 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} Image.gz modules dtbs
+         mkdir -p ${{github.workspace}}/install/boot
+         make ARCH=arm64 KERNEL=kernel8 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
+@@ -118,6 +120,7 @@ jobs:
+       run: |
+         mkdir ${{github.workspace}}/build
+         make ARCH=arm KERNEL=kernel CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build bcm2711_defconfig
++        scripts/config --file ${{github.workspace}}/build/.config --set-val CONFIG_WERROR y
+         make ARCH=arm KERNEL=kernel CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} zImage modules dtbs
+         mkdir -p ${{github.workspace}}/install/boot
+         make ARCH=arm KERNEL=kernel CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
+@@ -158,6 +161,7 @@ jobs:
+       run: |
+         mkdir ${{github.workspace}}/build
+         make ARCH=arm KERNEL=kernel7 CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build bcm2709_defconfig
++        scripts/config --file ${{github.workspace}}/build/.config --set-val CONFIG_WERROR y
+         make ARCH=arm KERNEL=kernel7 CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} zImage modules dtbs
+         mkdir -p ${{github.workspace}}/install/boot
+         make ARCH=arm KERNEL=kernel7 CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
+@@ -198,6 +202,7 @@ jobs:
+       run: |
+         mkdir ${{github.workspace}}/build
+         make ARCH=arm KERNEL=kernel7l CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build bcm2711_defconfig
++        scripts/config --file ${{github.workspace}}/build/.config --set-val CONFIG_WERROR y
+         make ARCH=arm KERNEL=kernel7l CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} zImage modules dtbs
+         mkdir -p ${{github.workspace}}/install/boot
+         make ARCH=arm KERNEL=kernel7l CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
+@@ -248,6 +253,7 @@ jobs:
+       run: |
+         mkdir ${{github.workspace}}/build
+         make ARCH=arm64 KERNEL=kernel8 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build bcm2711_defconfig
++        scripts/config --file ${{github.workspace}}/build/.config --set-val CONFIG_WERROR y
+         make ARCH=arm64 KERNEL=kernel8 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} Image.gz modules dtbs
+         mkdir -p ${{github.workspace}}/install/boot
+         make ARCH=arm64 KERNEL=kernel8 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
diff --git a/target/linux/bcm27xx/patches-6.1/950-0539-overlays-i2c-sensor-Add-mpu6050-and-mpu9250.patch b/target/linux/bcm27xx/patches-6.1/950-0539-overlays-i2c-sensor-Add-mpu6050-and-mpu9250.patch
new file mode 100644
index 00000000000000..9ff84dd1e7c4ef
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0539-overlays-i2c-sensor-Add-mpu6050-and-mpu9250.patch
@@ -0,0 +1,168 @@
+From d9cc69d32d100db9e383c81bd5c8f62ec16fd61c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 17 Jan 2023 15:47:04 +0000
+Subject: [PATCH] overlays: i2c-sensor: Add mpu6050 and mpu9250
+
+Add support for the MPU6050 and MPU9250 IMU sensors to the i2c-sensor
+container overlay. At the same time, deprecate the standalone mpu6050
+overlay, but keep it around for now.
+
+(Also fix a few typos spotted while editing)
+
+See: https://github.com/raspberrypi/linux/issues/5325
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README             | 26 ++++++-----
+ .../boot/dts/overlays/i2c-sensor-common.dtsi  | 43 ++++++++++++++++++-
+ arch/arm/boot/dts/overlays/overlay_map.dts    |  4 ++
+ 3 files changed, 61 insertions(+), 12 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -1983,8 +1983,8 @@ Info:   Adds support for a number of I2C
+ Load:   dtoverlay=i2c-sensor,<param>=<val>
+ Params: addr                    Set the address for the BH1750, BME280, BME680,
+                                 BMP280, CCS811, DS1621, HDC100X, JC42, LM75,
+-                                MCP980x, MS5637, MS5803, MS5805, MS5837, MS8607,
+-                                SHT3x or TMP102
++                                MCP980x, MPU6050, MPU9250, MS5637, MS5803,
++                                MS5805, MS5837, MS8607, SHT3x or TMP102
+ 
+         aht10                   Select the Aosong AHT10 temperature and humidity
+                                 sensor
+@@ -2016,8 +2016,8 @@ Params: addr                    Set the
+ 
+         htu21                   Select the HTU21 temperature and humidity sensor
+ 
+-        int_pin                 Set the GPIO to use for interrupts (max30102
+-                                only)
++        int_pin                 Set the GPIO to use for interrupts (max30102,
++                                mpu6050 and mpu9250 only)
+ 
+         jc42                    Select any of the many JEDEC JC42.4-compliant
+                                 temperature sensors, including:
+@@ -2045,6 +2045,12 @@ Params: addr                    Set the
+                                 use the "jc42" option.
+                                 Valid addresses are 0x18-0x1f (default 0x18)
+ 
++        mpu6050                 Select the InvenSense MPU6050 IMU. Valid
++                                valid addresses are 0x68 and 0x69 (default 0x68)
++
++        mpu9250                 Select the InvenSense MPU9250 IMU. Valid
++                                valid addresses are 0x68 and 0x69 (default 0x68)
++
+         ms5637                  Select the Measurement Specialities MS5637
+                                 pressure and temperature sensor.
+ 
+@@ -2913,10 +2919,10 @@ Params: overclock_50            Clock (i
+ 
+ 
+ Name:   mpu6050
+-Info:   Overlay for i2c connected mpu6050 imu
+-Load:   dtoverlay=mpu6050,<param>=<val>
+-Params: interrupt               GPIO pin for interrupt (default 4)
+-        addr                    I2C address of the device (default 0x68)
++Info:   This overlay has been deprecated - use "dtoverlay=i2c-sensor,mpu6050"
++        instead. Note that "int_pin" is the new name for the "interrupt"
++        parameter.
++Load:   <Deprecated>
+ 
+ 
+ Name:   mz61581
+@@ -3416,7 +3422,7 @@ Params: <None>
+ 
+ 
+ Name:   rpi-dac
+-Info:   This overlay has been renaamed to i2s-dac.
++Info:   This overlay has been renamed to i2s-dac.
+ Load:   <Deprecated>
+ 
+ 
+@@ -3546,7 +3552,7 @@ Params: poe_fan_temp0           Temperat
+ 
+ 
+ Name:   rpi-proto
+-Info:   This overlay has been renamaed to proto-codec.
++Info:   This overlay has been renamed to proto-codec.
+ Load:   <Deprecated>
+ 
+ 
+--- a/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+@@ -421,6 +421,40 @@
+ 		};
+ 	};
+ 
++	fragment@28 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++                        clock-frequency = <400000>;
++
++                        mpu6050: mpu6050@68 {
++                                compatible = "invensense,mpu6050";
++                                reg = <0x68>;
++                                interrupt-parent = <&gpio>;
++                                interrupts = <4 2>;
++                        };
++		};
++	};
++
++	fragment@29 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++                        clock-frequency = <400000>;
++
++                        mpu9250: mpu9250@68 {
++                                compatible = "invensense,mpu9250";
++                                reg = <0x68>;
++                                interrupt-parent = <&gpio>;
++                                interrupts = <4 2>;
++                        };
++		};
++	};
++
+ 	__overrides__ {
+ 		bme280 = <0>,"+0";
+ 		bmp085 = <0>,"+1";
+@@ -451,14 +485,19 @@
+ 		ms5805 = <0>,"+25";
+ 		ms5837 = <0>,"+26";
+ 		ms8607 = <0>,"+27";
++		mpu6050 = <0>,"+28";
++		mpu9250 = <0>,"+29";
+ 
+ 		addr =  <&bme280>,"reg:0", <&bmp280>,"reg:0", <&tmp102>,"reg:0",
+ 			<&lm75>,"reg:0", <&hdc100x>,"reg:0", <&sht3x>,"reg:0",
+ 			<&ds1621>,"reg:0", <&bme680>,"reg:0", <&ccs811>,"reg:0",
+ 			<&bh1750>,"reg:0", <&mcp980x>,"reg:0", <&jc42>,"reg:0",
+ 			<&ms5637>,"reg:0", <&ms5803>,"reg:0", <&ms5805>,"reg:0",
+-			<&ms5837>,"reg:0", <&ms8607>,"reg:0";
+-		int_pin = <&max30102>, "interrupts:0";
++			<&ms5837>,"reg:0", <&ms8607>,"reg:0",
++			<&mpu6050>, "reg:0", <&mpu9250>, "reg:0";
++		int_pin = <&max30102>, "interrupts:0",
++			<&mpu6050>, "interrupts:0",
++			<&mpu9250>, "interrupts:0";
+ 		no_timeout = <&jc42>, "smbus-timeout-disable?";
+ 	};
+ };
+--- a/arch/arm/boot/dts/overlays/overlay_map.dts
++++ b/arch/arm/boot/dts/overlays/overlay_map.dts
+@@ -61,6 +61,10 @@
+ 		bcm2711;
+ 	};
+ 
++	mpu6050 {
++		deprecated = "use i2c-sensor,mpu6050";
++	};
++
+ 	pcie-32bit-dma {
+ 		bcm2711;
+ 	};
diff --git a/target/linux/bcm27xx/patches-6.1/950-0540-.github-workflows-Correct-kernel-builds-artifacts.patch b/target/linux/bcm27xx/patches-6.1/950-0540-.github-workflows-Correct-kernel-builds-artifacts.patch
new file mode 100644
index 00000000000000..359efd5c85976d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0540-.github-workflows-Correct-kernel-builds-artifacts.patch
@@ -0,0 +1,147 @@
+From 3e32a992acb7248183a3eb1d92503ac2d2eb2617 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 18 Jan 2023 09:34:31 +0000
+Subject: [PATCH] .github/workflows: Correct kernel builds artifacts
+
+Modify the kernel build workflow to create artifacts with the correct
+names and structure, both as an example of what we expect and in case
+anyone wants to use the output.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .github/workflows/kernel-build.yml | 76 ++++++++++++++++--------------
+ 1 file changed, 41 insertions(+), 35 deletions(-)
+
+--- a/.github/workflows/kernel-build.yml
++++ b/.github/workflows/kernel-build.yml
+@@ -37,14 +37,15 @@ jobs:
+     - name: Build kernel
+       run: |
+         mkdir ${{github.workspace}}/build
+-        make ARCH=arm KERNEL=kernel CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build bcm2835_defconfig
++        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build bcm2835_defconfig
+         scripts/config --file ${{github.workspace}}/build/.config --set-val CONFIG_WERROR y
+-        make ARCH=arm KERNEL=kernel CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} Image modules dtbs
+-        mkdir -p ${{github.workspace}}/install/boot
++        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} zImage modules dtbs
++        mkdir -p ${{github.workspace}}/install/boot/overlays
+         make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
+         cp ${{github.workspace}}/build/arch/arm/boot/dts/*.dtb ${{github.workspace}}/install/boot/
+-        cp -r ${{github.workspace}}/build/arch/arm/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/
+-        cp ${{github.workspace}}/build/arch/arm/boot/Image ${{github.workspace}}/install/boot/
++        cp ${{github.workspace}}/build/arch/arm/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/overlays/
++        cp ${{github.workspace}}/arch/arm/boot/dts/overlays/README ${{github.workspace}}/install/boot/overlays/
++        cp ${{github.workspace}}/build/arch/arm/boot/zImage ${{github.workspace}}/install/boot/kernel.img
+ 
+     - name: Tar build
+       run: tar -cvf bcm2835_build.tar -C ${{github.workspace}}/install .
+@@ -78,14 +79,15 @@ jobs:
+     - name: Build kernel
+       run: |
+         mkdir ${{github.workspace}}/build
+-        make ARCH=arm64 KERNEL=kernel8 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build defconfig
++        make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build defconfig
+         scripts/config --file ${{github.workspace}}/build/.config --set-val CONFIG_WERROR y
+-        make ARCH=arm64 KERNEL=kernel8 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} Image.gz modules dtbs
+-        mkdir -p ${{github.workspace}}/install/boot
+-        make ARCH=arm64 KERNEL=kernel8 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
++        make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} Image.gz modules dtbs
++        mkdir -p ${{github.workspace}}/install/boot/overlays
++        make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
+         cp ${{github.workspace}}/build/arch/arm64/boot/dts/broadcom/*.dtb ${{github.workspace}}/install/boot/
+-        cp -r ${{github.workspace}}/build/arch/arm64/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/
+-        cp ${{github.workspace}}/build/arch/arm64/boot/Image.gz ${{github.workspace}}/install/boot/
++        cp ${{github.workspace}}/build/arch/arm64/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/overlays/
++        cp ${{github.workspace}}/arch/arm64/boot/dts/overlays/README ${{github.workspace}}/install/boot/overlays/
++        cp ${{github.workspace}}/build/arch/arm64/boot/Image.gz ${{github.workspace}}/install/boot/kernel8.img
+ 
+     - name: Tar build
+       run: tar -cvf arm64_build.tar -C ${{github.workspace}}/install .
+@@ -119,14 +121,15 @@ jobs:
+     - name: Build kernel
+       run: |
+         mkdir ${{github.workspace}}/build
+-        make ARCH=arm KERNEL=kernel CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build bcm2711_defconfig
++        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build bcmrpi_defconfig
+         scripts/config --file ${{github.workspace}}/build/.config --set-val CONFIG_WERROR y
+-        make ARCH=arm KERNEL=kernel CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} zImage modules dtbs
+-        mkdir -p ${{github.workspace}}/install/boot
+-        make ARCH=arm KERNEL=kernel CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
++        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} zImage modules dtbs
++        mkdir -p ${{github.workspace}}/install/boot/overlays
++        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
+         cp ${{github.workspace}}/build/arch/arm/boot/dts/*.dtb ${{github.workspace}}/install/boot/
+-        cp -r ${{github.workspace}}/build/arch/arm/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/
+-        cp ${{github.workspace}}/build/arch/arm/boot/zImage ${{github.workspace}}/install/boot/
++        cp ${{github.workspace}}/build/arch/arm/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/overlays/
++        cp ${{github.workspace}}/arch/arm/boot/dts/overlays/README ${{github.workspace}}/install/boot/overlays/
++        cp ${{github.workspace}}/build/arch/arm/boot/zImage ${{github.workspace}}/install/boot/kernel.img
+ 
+     - name: Tar build
+       run: tar -cvf bcmrpi_build.tar -C ${{github.workspace}}/install .
+@@ -160,14 +163,15 @@ jobs:
+     - name: Build kernel
+       run: |
+         mkdir ${{github.workspace}}/build
+-        make ARCH=arm KERNEL=kernel7 CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build bcm2709_defconfig
++        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build bcm2709_defconfig
+         scripts/config --file ${{github.workspace}}/build/.config --set-val CONFIG_WERROR y
+-        make ARCH=arm KERNEL=kernel7 CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} zImage modules dtbs
+-        mkdir -p ${{github.workspace}}/install/boot
+-        make ARCH=arm KERNEL=kernel7 CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
++        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} zImage modules dtbs
++        mkdir -p ${{github.workspace}}/install/boot/overlays
++        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
+         cp ${{github.workspace}}/build/arch/arm/boot/dts/*.dtb ${{github.workspace}}/install/boot/
+-        cp -r ${{github.workspace}}/build/arch/arm/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/
+-        cp ${{github.workspace}}/build/arch/arm/boot/zImage ${{github.workspace}}/install/boot/
++        cp ${{github.workspace}}/build/arch/arm/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/overlays/
++        cp ${{github.workspace}}/arch/arm/boot/dts/overlays/README ${{github.workspace}}/install/boot/overlays/
++        cp ${{github.workspace}}/build/arch/arm/boot/zImage ${{github.workspace}}/install/boot/kernel7.img
+ 
+     - name: Tar build
+       run: tar -cvf bcm2709_build.tar -C ${{github.workspace}}/install .
+@@ -201,14 +205,15 @@ jobs:
+     - name: Build kernel
+       run: |
+         mkdir ${{github.workspace}}/build
+-        make ARCH=arm KERNEL=kernel7l CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build bcm2711_defconfig
++        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build bcm2711_defconfig
+         scripts/config --file ${{github.workspace}}/build/.config --set-val CONFIG_WERROR y
+-        make ARCH=arm KERNEL=kernel7l CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} zImage modules dtbs
+-        mkdir -p ${{github.workspace}}/install/boot
+-        make ARCH=arm KERNEL=kernel7l CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
++        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} zImage modules dtbs
++        mkdir -p ${{github.workspace}}/install/boot/overlays
++        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
+         cp ${{github.workspace}}/build/arch/arm/boot/dts/*.dtb ${{github.workspace}}/install/boot/
+-        cp -r ${{github.workspace}}/build/arch/arm/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/
+-        cp ${{github.workspace}}/build/arch/arm/boot/zImage ${{github.workspace}}/install/boot/
++        cp ${{github.workspace}}/build/arch/arm/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/overlays/
++        cp ${{github.workspace}}/arch/arm/boot/dts/overlays/README ${{github.workspace}}/install/boot/overlays/
++        cp ${{github.workspace}}/build/arch/arm/boot/zImage ${{github.workspace}}/install/boot/kernel7l.img
+ 
+     - name: Tar build
+       run: tar -cvf bcm2711_build.tar -C ${{github.workspace}}/install .
+@@ -252,14 +257,15 @@ jobs:
+     - name: Build kernel
+       run: |
+         mkdir ${{github.workspace}}/build
+-        make ARCH=arm64 KERNEL=kernel8 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build bcm2711_defconfig
++        make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build bcm2711_defconfig
+         scripts/config --file ${{github.workspace}}/build/.config --set-val CONFIG_WERROR y
+-        make ARCH=arm64 KERNEL=kernel8 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} Image.gz modules dtbs
+-        mkdir -p ${{github.workspace}}/install/boot
+-        make ARCH=arm64 KERNEL=kernel8 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
++        make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} Image.gz modules dtbs
++        mkdir -p ${{github.workspace}}/install/boot/overlays
++        make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
+         cp ${{github.workspace}}/build/arch/arm64/boot/dts/broadcom/*.dtb ${{github.workspace}}/install/boot/
+-        cp -r ${{github.workspace}}/build/arch/arm64/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/
+-        cp ${{github.workspace}}/build/arch/arm64/boot/Image.gz ${{github.workspace}}/install/boot/
++        cp ${{github.workspace}}/build/arch/arm64/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/overlays/
++        cp ${{github.workspace}}/arch/arm64/boot/dts/overlays/README ${{github.workspace}}/install/boot/overlays/
++        cp ${{github.workspace}}/build/arch/arm64/boot/Image.gz ${{github.workspace}}/install/boot/kernel8.img
+ 
+     - name: Tar build
+       run: tar -cvf bcm2711_arm64_build.tar -C ${{github.workspace}}/install .
diff --git a/target/linux/bcm27xx/patches-6.1/950-0541-overlays-i2c-sensor-Use-TABs-for-indentation.patch b/target/linux/bcm27xx/patches-6.1/950-0541-overlays-i2c-sensor-Use-TABs-for-indentation.patch
new file mode 100644
index 00000000000000..c7746c78e001db
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0541-overlays-i2c-sensor-Use-TABs-for-indentation.patch
@@ -0,0 +1,67 @@
+From 20bdf59afc9d613744e22c4c12f531dc22554f10 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 18 Jan 2023 16:37:01 +0000
+Subject: [PATCH] overlays: i2c-sensor: Use TABs for indentation
+
+A whitespace-only change replacing groups of 8 spaces with TABs.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .../boot/dts/overlays/i2c-sensor-common.dtsi  | 34 +++++++++----------
+ 1 file changed, 17 insertions(+), 17 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+@@ -427,14 +427,14 @@
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 			status = "okay";
+-                        clock-frequency = <400000>;
++			clock-frequency = <400000>;
+ 
+-                        mpu6050: mpu6050@68 {
+-                                compatible = "invensense,mpu6050";
+-                                reg = <0x68>;
+-                                interrupt-parent = <&gpio>;
+-                                interrupts = <4 2>;
+-                        };
++			mpu6050: mpu6050@68 {
++				compatible = "invensense,mpu6050";
++				reg = <0x68>;
++				interrupt-parent = <&gpio>;
++				interrupts = <4 2>;
++			};
+ 		};
+ 	};
+ 
+@@ -444,14 +444,14 @@
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 			status = "okay";
+-                        clock-frequency = <400000>;
++			clock-frequency = <400000>;
+ 
+-                        mpu9250: mpu9250@68 {
+-                                compatible = "invensense,mpu9250";
+-                                reg = <0x68>;
+-                                interrupt-parent = <&gpio>;
+-                                interrupts = <4 2>;
+-                        };
++			mpu9250: mpu9250@68 {
++				compatible = "invensense,mpu9250";
++				reg = <0x68>;
++				interrupt-parent = <&gpio>;
++				interrupts = <4 2>;
++			};
+ 		};
+ 	};
+ 
+@@ -488,7 +488,7 @@
+ 		mpu6050 = <0>,"+28";
+ 		mpu9250 = <0>,"+29";
+ 
+-		addr =  <&bme280>,"reg:0", <&bmp280>,"reg:0", <&tmp102>,"reg:0",
++		addr =	<&bme280>,"reg:0", <&bmp280>,"reg:0", <&tmp102>,"reg:0",
+ 			<&lm75>,"reg:0", <&hdc100x>,"reg:0", <&sht3x>,"reg:0",
+ 			<&ds1621>,"reg:0", <&bme680>,"reg:0", <&ccs811>,"reg:0",
+ 			<&bh1750>,"reg:0", <&mcp980x>,"reg:0", <&jc42>,"reg:0",
diff --git a/target/linux/bcm27xx/patches-6.1/950-0542-overlays-i2c-sensor-Add-BNO055-IMU-sensor.patch b/target/linux/bcm27xx/patches-6.1/950-0542-overlays-i2c-sensor-Add-BNO055-IMU-sensor.patch
new file mode 100644
index 00000000000000..3d8ba021ac6ff7
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0542-overlays-i2c-sensor-Add-BNO055-IMU-sensor.patch
@@ -0,0 +1,97 @@
+From 04ca4e22abfc21a615b6003ea512fa79dee94cd5 Mon Sep 17 00:00:00 2001
+From: PolarStarWalker <savmot1929@gmail.com>
+Date: Mon, 2 Jan 2023 02:13:27 +0300
+Subject: [PATCH] overlays: i2c-sensor: Add BNO055 IMU sensor
+
+Add support for the Bosch BNO055 9-dof IMU sensor.
+
+Signed-off-by: PolarStarWalker <savmot1929@gmail.com>
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README             |  6 ++++
+ .../boot/dts/overlays/i2c-sensor-common.dtsi  | 28 ++++++++++++++++++-
+ 2 files changed, 33 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -2005,6 +2005,9 @@ Params: addr                    Set the
+         bmp280                  Select the Bosch Sensortronic BMP280
+                                 Valid addresses 0x76-0x77, default 0x76
+ 
++        bno055                  Select the Bosch Sensortronic BNO055 IMU
++                                Valid address 0x28-0x29, default 0x29
++
+         ccs811                  Select the AMS CCS811 digital gas sensor
+                                 Valid addresses 0x5a-0x5b, default 0x5b
+ 
+@@ -2071,6 +2074,9 @@ Params: addr                    Set the
+                                 incompatible device can stop it from being
+                                 activated.
+ 
++        reset_pin               GPIO to be used to reset the device (bno055
++                                only, disabled by default)
++
+         sht3x                   Select the Sensiron SHT3x temperature and
+                                 humidity sensor. Valid addresses 0x44-0x45,
+                                 default 0x44
+--- a/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+@@ -2,6 +2,8 @@
+ /dts-v1/;
+ /plugin/;
+ 
++#include <dt-bindings/gpio/gpio.h>
++
+ / {
+ 	compatible = "brcm,bcm2835";
+ 
+@@ -455,6 +457,27 @@
+ 		};
+ 	};
+ 
++	fragment@30 {
++		target = <&bno055>;
++		__dormant__ {
++			reset-gpios = <&gpio 5 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	fragment@31 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			bno055: bno055@29 {
++				compatible = "bosch,bno055";
++				reg = <0x29>;
++			};
++		};
++	};
++
+ 	__overrides__ {
+ 		bme280 = <0>,"+0";
+ 		bmp085 = <0>,"+1";
+@@ -487,6 +510,7 @@
+ 		ms8607 = <0>,"+27";
+ 		mpu6050 = <0>,"+28";
+ 		mpu9250 = <0>,"+29";
++		bno055 = <0>,"+31";
+ 
+ 		addr =	<&bme280>,"reg:0", <&bmp280>,"reg:0", <&tmp102>,"reg:0",
+ 			<&lm75>,"reg:0", <&hdc100x>,"reg:0", <&sht3x>,"reg:0",
+@@ -494,10 +518,12 @@
+ 			<&bh1750>,"reg:0", <&mcp980x>,"reg:0", <&jc42>,"reg:0",
+ 			<&ms5637>,"reg:0", <&ms5803>,"reg:0", <&ms5805>,"reg:0",
+ 			<&ms5837>,"reg:0", <&ms8607>,"reg:0",
+-			<&mpu6050>, "reg:0", <&mpu9250>, "reg:0";
++			<&mpu6050>,"reg:0", <&mpu9250>,"reg:0",
++			<&bno055>,"reg:0";
+ 		int_pin = <&max30102>, "interrupts:0",
+ 			<&mpu6050>, "interrupts:0",
+ 			<&mpu9250>, "interrupts:0";
+ 		no_timeout = <&jc42>, "smbus-timeout-disable?";
++		reset_pin = <&bno055>,"reset-gpios:4", <0>,"+30";
+ 	};
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0543-dtoverlay-Update-vc4-kms-dpi-generic-for-changed-med.patch b/target/linux/bcm27xx/patches-6.1/950-0543-dtoverlay-Update-vc4-kms-dpi-generic-for-changed-med.patch
new file mode 100644
index 00000000000000..2efac2bf71a4cd
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0543-dtoverlay-Update-vc4-kms-dpi-generic-for-changed-med.patch
@@ -0,0 +1,34 @@
+From 5db5dc0aaa9800c196066c76078947d941ee45ad Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 19 Jan 2023 19:51:49 +0000
+Subject: [PATCH] dtoverlay: Update vc4-kms-dpi-generic for changed
+ mediabus formats
+
+Several of the media bus formats aren't merged upstream yet,
+therefore the values change when upstream does introduce
+new formats.
+
+As vc4-kms-dpi-generic references the media bus formats explicitly
+by number, update it to match.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/vc4-kms-dpi-generic-overlay.dts | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/vc4-kms-dpi-generic-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dpi-generic-overlay.dts
+@@ -65,10 +65,10 @@
+ 
+ 		rgb565 = <&panel_generic>, "bus-format:0=0x1017",
+ 			<&dpi_node_generic>, "pinctrl-0:0=",<&dpi_16bit_gpio0>;
+-		rgb565-padhi = <&panel_generic>, "bus-format:0=0x1020",
++		rgb565-padhi = <&panel_generic>, "bus-format:0=0x1022",
+ 			<&dpi_node_generic>, "pinctrl-0:0=",<&dpi_16bit_cpadhi_gpio0>;
+-		bgr666 = <&panel_generic>, "bus-format:0=0x101f";
+-		bgr666-padhi = <&panel_generic>, "bus-format:0=0x101e",
++		bgr666 = <&panel_generic>, "bus-format:0=0x1023";
++		bgr666-padhi = <&panel_generic>, "bus-format:0=0x1024",
+ 			<&dpi_node_generic>, "pinctrl-0:0=",<&dpi_18bit_cpadhi_gpio0>;
+ 		rgb666-padhi = <&panel_generic>, "bus-format:0=0x1015",
+ 			<&dpi_node_generic>, "pinctrl-0:0=",<&dpi_18bit_cpadhi_gpio0>;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0544-drm-vc4-hvs-Defer-dlist-slots-deallocation.patch b/target/linux/bcm27xx/patches-6.1/950-0544-drm-vc4-hvs-Defer-dlist-slots-deallocation.patch
new file mode 100644
index 00000000000000..86359ea61c49d4
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0544-drm-vc4-hvs-Defer-dlist-slots-deallocation.patch
@@ -0,0 +1,401 @@
+From 01576f30d7af7455fcf6d650834791f4b80901e8 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Thu, 16 Dec 2021 14:54:54 +0100
+Subject: [PATCH] drm/vc4: hvs: Defer dlist slots deallocation
+
+During normal operations, the cursor position update is done through an
+asynchronous plane update, which on the vc4 driver basically just
+modifies the right dlist word to move the plane to the new coordinates.
+
+However, when we have the overscan margins setup, we fall back to a
+regular commit when we are next to the edges. And since that commit
+happens to be on a cursor plane, it's considered a legacy cursor update
+by KMS.
+
+The main difference it makes is that it won't wait for its completion
+(ie, next vblank) before returning. This means if we have multiple
+commits happening in rapid succession, we can have several of them
+happening before the next vblank.
+
+In parallel, our dlist allocation is tied to a CRTC state, and each time
+we do a commit we end up with a new CRTC state, with the previous one
+being freed. This means that we free our previous dlist entry (but don't
+clear it though) every time a new one is being committed.
+
+Now, if we were to have two commits happening before the next vblank, we
+could end up freeing reusing the same dlist entries before the next
+vblank.
+
+Indeed, we would start from an initial state taking, for example, the
+dlist entries 10 to 20, then start a commit taking the entries 20 to 30
+and setting the dlist pointer to 20, and freeing the dlist entries 10 to
+20. However, since we haven't reach vblank yet, the HVS is still using
+the entries 10 to 20.
+
+If we were to make a new commit now, chances are the allocator are going
+to give the 10 to 20 entries back, and we would change their content to
+match the new state. If vblank hasn't happened yet, we just corrupted
+the active dlist entries.
+
+A first attempt to solve this was made by creating an intermediate dlist
+buffer to store the current (ie, as of the last commit) dlist content,
+that we would update each time the HVS is done with a frame. However, if
+the interrupt handler missed the vblank window, we would end up copying
+our intermediate dlist to the hardware one during the composition,
+essentially creating the same issue.
+
+Since making sure that our interrupt handler runs within a fixed,
+constrained, time window would require to make Linux a real-time kernel,
+this seems a bit out of scope.
+
+Instead, we can work around our original issue by keeping the dlist
+slots allocation longer. That way, we won't reuse a dlist slot while
+it's still in flight. In order to achieve this, instead of freeing the
+dlist slot when its associated CRTC state is destroyed, we'll queue it
+in a list.
+
+A naive implementation would free the buffers in that queue when we get
+our end of frame interrupt. However, there's still a race since, just
+like in the shadow dlist case, we don't control when the handler for
+that interrupt is going to run. Thus, we can end up with a commit adding
+an old dlist allocation to our queue during the window between our
+actual interrupt and when our handler will run. And since that buffer is
+still being used for the composition of the current frame, we can't free
+it right away, exposing us to the original bug.
+
+Fortunately for us, the hardware provides a frame counter that is
+increased each time the first line of a frame is being generated.
+Associating the frame counter the image is supposed to go away to the
+allocation, and then only deallocate buffers that have a counter below
+or equal to the one we see when the deallocation code should prevent the
+above race from occuring.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c |  10 +-
+ drivers/gpu/drm/vc4/vc4_drv.h  |  15 ++-
+ drivers/gpu/drm/vc4/vc4_hvs.c  | 184 ++++++++++++++++++++++++++++++---
+ 3 files changed, 186 insertions(+), 23 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -1096,14 +1096,8 @@ void vc4_crtc_destroy_state(struct drm_c
+ 	struct vc4_dev *vc4 = to_vc4_dev(crtc->dev);
+ 	struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(state);
+ 
+-	if (drm_mm_node_allocated(&vc4_state->mm)) {
+-		unsigned long flags;
+-
+-		spin_lock_irqsave(&vc4->hvs->mm_lock, flags);
+-		drm_mm_remove_node(&vc4_state->mm);
+-		spin_unlock_irqrestore(&vc4->hvs->mm_lock, flags);
+-
+-	}
++	vc4_hvs_mark_dlist_entry_stale(vc4->hvs, vc4_state->mm);
++	vc4_state->mm = NULL;
+ 
+ 	drm_atomic_helper_crtc_destroy_state(crtc, state);
+ }
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -346,6 +346,9 @@ struct vc4_hvs {
+ 	struct drm_mm lbm_mm;
+ 	spinlock_t mm_lock;
+ 
++	struct list_head stale_dlist_entries;
++	struct work_struct free_dlist_work;
++
+ 	struct drm_mm_node mitchell_netravali_filter;
+ 
+ 	struct debugfs_regset32 regset;
+@@ -648,10 +651,16 @@ struct drm_connector *vc4_get_crtc_conne
+ struct drm_encoder *vc4_get_crtc_encoder(struct drm_crtc *crtc,
+ 					 struct drm_crtc_state *state);
+ 
++struct vc4_hvs_dlist_allocation {
++	struct list_head node;
++	struct drm_mm_node mm_node;
++	unsigned int channel;
++	u8 target_frame_count;
++};
++
+ struct vc4_crtc_state {
+ 	struct drm_crtc_state base;
+-	/* Dlist area for this CRTC configuration. */
+-	struct drm_mm_node mm;
++	struct vc4_hvs_dlist_allocation *mm;
+ 	bool txp_armed;
+ 	unsigned int assigned_channel;
+ 
+@@ -1077,6 +1086,8 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
+ void vc4_hvs_stop_channel(struct vc4_hvs *hvs, unsigned int output);
+ int vc4_hvs_get_fifo_from_output(struct vc4_hvs *hvs, unsigned int output);
+ u8 vc4_hvs_get_fifo_frame_count(struct vc4_hvs *hvs, unsigned int fifo);
++void vc4_hvs_mark_dlist_entry_stale(struct vc4_hvs *hvs,
++				    struct vc4_hvs_dlist_allocation *alloc);
+ int vc4_hvs_atomic_check(struct drm_crtc *crtc, struct drm_atomic_state *state);
+ void vc4_hvs_atomic_begin(struct drm_crtc *crtc, struct drm_atomic_state *state);
+ void vc4_hvs_atomic_enable(struct drm_crtc *crtc, struct drm_atomic_state *state);
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -412,6 +412,152 @@ static void vc5_hvs_update_gamma_lut(str
+ 	vc5_hvs_lut_load(hvs, vc4_crtc);
+ }
+ 
++static void vc4_hvs_irq_enable_eof(const struct vc4_hvs *hvs,
++				   unsigned int channel)
++{
++	struct vc4_dev *vc4 = hvs->vc4;
++	u32 irq_mask = vc4->is_vc5 ?
++		SCALER5_DISPCTRL_DSPEIEOF(channel) :
++		SCALER_DISPCTRL_DSPEIEOF(channel);
++
++	HVS_WRITE(SCALER_DISPCTRL,
++		  HVS_READ(SCALER_DISPCTRL) | irq_mask);
++}
++
++static void vc4_hvs_irq_clear_eof(const struct vc4_hvs *hvs,
++				  unsigned int channel)
++{
++	struct vc4_dev *vc4 = hvs->vc4;
++	u32 irq_mask = vc4->is_vc5 ?
++		SCALER5_DISPCTRL_DSPEIEOF(channel) :
++		SCALER_DISPCTRL_DSPEIEOF(channel);
++
++	HVS_WRITE(SCALER_DISPCTRL,
++		  HVS_READ(SCALER_DISPCTRL) & ~irq_mask);
++}
++
++static struct vc4_hvs_dlist_allocation *
++vc4_hvs_alloc_dlist_entry(struct vc4_hvs *hvs,
++			  unsigned int channel,
++			  size_t dlist_count)
++{
++	struct vc4_hvs_dlist_allocation *alloc;
++	unsigned long flags;
++	int ret;
++
++	if (channel == VC4_HVS_CHANNEL_DISABLED)
++		return NULL;
++
++	alloc = kzalloc(sizeof(*alloc), GFP_KERNEL);
++	if (!alloc)
++		return ERR_PTR(-ENOMEM);
++
++	spin_lock_irqsave(&hvs->mm_lock, flags);
++	ret = drm_mm_insert_node(&hvs->dlist_mm, &alloc->mm_node,
++				 dlist_count);
++	spin_unlock_irqrestore(&hvs->mm_lock, flags);
++	if (ret)
++		return ERR_PTR(ret);
++
++	alloc->channel = channel;
++
++	return alloc;
++}
++
++void vc4_hvs_mark_dlist_entry_stale(struct vc4_hvs *hvs,
++				    struct vc4_hvs_dlist_allocation *alloc)
++{
++	unsigned long flags;
++	u8 frcnt;
++
++	if (!alloc)
++		return;
++
++	if (!drm_mm_node_allocated(&alloc->mm_node))
++		return;
++
++	frcnt = vc4_hvs_get_fifo_frame_count(hvs, alloc->channel);
++	alloc->target_frame_count = (frcnt + 1) & ((1 << 6) - 1);
++
++	spin_lock_irqsave(&hvs->mm_lock, flags);
++
++	list_add_tail(&alloc->node, &hvs->stale_dlist_entries);
++
++	HVS_WRITE(SCALER_DISPSTAT, SCALER_DISPSTAT_EOF(alloc->channel));
++	vc4_hvs_irq_enable_eof(hvs, alloc->channel);
++
++	spin_unlock_irqrestore(&hvs->mm_lock, flags);
++}
++
++static void vc4_hvs_schedule_dlist_sweep(struct vc4_hvs *hvs,
++					 unsigned int channel)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&hvs->mm_lock, flags);
++
++	if (!list_empty(&hvs->stale_dlist_entries))
++		queue_work(system_unbound_wq, &hvs->free_dlist_work);
++
++	vc4_hvs_irq_clear_eof(hvs, channel);
++
++	spin_unlock_irqrestore(&hvs->mm_lock, flags);
++}
++
++/*
++ * Frame counts are essentially sequence numbers over 6 bits, and we
++ * thus can use sequence number arithmetic and follow the RFC1982 to
++ * implement proper comparison between them.
++ */
++static bool vc4_hvs_frcnt_lte(u8 cnt1, u8 cnt2)
++{
++	return (s8)((cnt1 << 2) - (cnt2 << 2)) <= 0;
++}
++
++/*
++ * Some atomic commits (legacy cursor updates, mostly) will not wait for
++ * the next vblank and will just return once the commit has been pushed
++ * to the hardware.
++ *
++ * On the hardware side, our HVS stores the planes parameters in its
++ * context RAM, and will use part of the RAM to store data during the
++ * frame rendering.
++ *
++ * This interacts badly if we get multiple commits before the next
++ * vblank since we could end up overwriting the DLIST entries used by
++ * previous commits if our dlist allocation reuses that entry. In such a
++ * case, we would overwrite the data currently being used by the
++ * hardware, resulting in a corrupted frame.
++ *
++ * In order to work around this, we'll queue the dlist entries in a list
++ * once the associated CRTC state is destroyed. The HVS only allows us
++ * to know which entry is being active, but not which one are no longer
++ * being used, so in order to avoid freeing entries that are still used
++ * by the hardware we add a guesstimate of the frame count where our
++ * entry will no longer be used, and thus will only free those entries
++ * when we will have reached that frame count.
++ */
++static void vc4_hvs_dlist_free_work(struct work_struct *work)
++{
++	struct vc4_hvs *hvs = container_of(work, struct vc4_hvs, free_dlist_work);
++	struct vc4_hvs_dlist_allocation *cur, *next;
++	unsigned long flags;
++
++	spin_lock_irqsave(&hvs->mm_lock, flags);
++	list_for_each_entry_safe(cur, next, &hvs->stale_dlist_entries, node) {
++		u8 frcnt;
++
++		frcnt = vc4_hvs_get_fifo_frame_count(hvs, cur->channel);
++		if (!vc4_hvs_frcnt_lte(cur->target_frame_count, frcnt))
++			continue;
++
++		list_del(&cur->node);
++		drm_mm_remove_node(&cur->mm_node);
++		kfree(cur);
++	}
++	spin_unlock_irqrestore(&hvs->mm_lock, flags);
++}
++
+ u8 vc4_hvs_get_fifo_frame_count(struct vc4_hvs *hvs, unsigned int fifo)
+ {
+ 	struct drm_device *drm = &hvs->vc4->base;
+@@ -643,13 +789,12 @@ int vc4_hvs_atomic_check(struct drm_crtc
+ {
+ 	struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
+ 	struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(crtc_state);
++	struct vc4_hvs_dlist_allocation *alloc;
+ 	struct drm_device *dev = crtc->dev;
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 	struct drm_plane *plane;
+-	unsigned long flags;
+ 	const struct drm_plane_state *plane_state;
+ 	u32 dlist_count = 0;
+-	int ret;
+ 
+ 	/* The pixelvalve can only feed one encoder (and encoders are
+ 	 * 1:1 with connectors.)
+@@ -662,12 +807,11 @@ int vc4_hvs_atomic_check(struct drm_crtc
+ 
+ 	dlist_count++; /* Account for SCALER_CTL0_END. */
+ 
+-	spin_lock_irqsave(&vc4->hvs->mm_lock, flags);
+-	ret = drm_mm_insert_node(&vc4->hvs->dlist_mm, &vc4_state->mm,
+-				 dlist_count);
+-	spin_unlock_irqrestore(&vc4->hvs->mm_lock, flags);
+-	if (ret)
+-		return ret;
++	alloc = vc4_hvs_alloc_dlist_entry(vc4->hvs, vc4_state->assigned_channel, dlist_count);
++	if (IS_ERR(alloc))
++		return PTR_ERR(alloc);
++
++	vc4_state->mm = alloc;
+ 
+ 	return vc4_hvs_gamma_check(crtc, state);
+ }
+@@ -683,8 +827,9 @@ static void vc4_hvs_install_dlist(struct
+ 	if (!drm_dev_enter(dev, &idx))
+ 		return;
+ 
++	WARN_ON(!vc4_state->mm);
+ 	HVS_WRITE(SCALER_DISPLISTX(vc4_state->assigned_channel),
+-		  vc4_state->mm.start);
++		  vc4_state->mm->mm_node.start);
+ 
+ 	drm_dev_exit(idx);
+ }
+@@ -711,8 +856,10 @@ static void vc4_hvs_update_dlist(struct
+ 		spin_unlock_irqrestore(&dev->event_lock, flags);
+ 	}
+ 
++	WARN_ON(!vc4_state->mm);
++
+ 	spin_lock_irqsave(&vc4_crtc->irq_lock, flags);
+-	vc4_crtc->current_dlist = vc4_state->mm.start;
++	vc4_crtc->current_dlist = vc4_state->mm->mm_node.start;
+ 	spin_unlock_irqrestore(&vc4_crtc->irq_lock, flags);
+ }
+ 
+@@ -769,8 +916,7 @@ void vc4_hvs_atomic_flush(struct drm_crt
+ 	struct vc4_plane_state *vc4_plane_state;
+ 	bool debug_dump_regs = false;
+ 	bool enable_bg_fill = false;
+-	u32 __iomem *dlist_start = vc4->hvs->dlist + vc4_state->mm.start;
+-	u32 __iomem *dlist_next = dlist_start;
++	u32 __iomem *dlist_start, *dlist_next;
+ 	unsigned int zpos = 0;
+ 	bool found = false;
+ 	int idx;
+@@ -788,6 +934,9 @@ void vc4_hvs_atomic_flush(struct drm_crt
+ 		vc4_hvs_dump_state(hvs);
+ 	}
+ 
++	dlist_start = vc4->hvs->dlist + vc4_state->mm->mm_node.start;
++	dlist_next = dlist_start;
++
+ 	/* Copy all the active planes' dlist contents to the hardware dlist. */
+ 	do {
+ 		found = false;
+@@ -821,7 +970,8 @@ void vc4_hvs_atomic_flush(struct drm_crt
+ 	writel(SCALER_CTL0_END, dlist_next);
+ 	dlist_next++;
+ 
+-	WARN_ON_ONCE(dlist_next - dlist_start != vc4_state->mm.size);
++	WARN_ON(!vc4_state->mm);
++	WARN_ON_ONCE(dlist_next - dlist_start != vc4_state->mm->mm_node.size);
+ 
+ 	if (enable_bg_fill)
+ 		/* This sets a black background color fill, as is the case
+@@ -960,6 +1110,11 @@ static irqreturn_t vc4_hvs_irq_handler(i
+ 
+ 			irqret = IRQ_HANDLED;
+ 		}
++
++		if (status & SCALER_DISPSTAT_EOF(channel)) {
++			vc4_hvs_schedule_dlist_sweep(hvs, channel);
++			irqret = IRQ_HANDLED;
++		}
+ 	}
+ 
+ 	/* Clear every per-channel interrupt flag. */
+@@ -1024,6 +1179,9 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
+ 
+ 	spin_lock_init(&hvs->mm_lock);
+ 
++	INIT_LIST_HEAD(&hvs->stale_dlist_entries);
++	INIT_WORK(&hvs->free_dlist_work, vc4_hvs_dlist_free_work);
++
+ 	/* Set up the HVS display list memory manager.  We never
+ 	 * overwrite the setup from the bootloader (just 128b out of
+ 	 * our 16K), since we don't want to scramble the screen when
diff --git a/target/linux/bcm27xx/patches-6.1/950-0545-vc4-hdmi-Always-enable-GCP-with-AVMUTE-cleared.patch b/target/linux/bcm27xx/patches-6.1/950-0545-vc4-hdmi-Always-enable-GCP-with-AVMUTE-cleared.patch
new file mode 100644
index 00000000000000..69933251c8aa9f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0545-vc4-hdmi-Always-enable-GCP-with-AVMUTE-cleared.patch
@@ -0,0 +1,104 @@
+From 3bd2ed90a679b87d4dc3fe0a70a83c323df915de Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Wed, 11 Jan 2023 17:30:58 +0000
+Subject: [PATCH] vc4/hdmi: Always enable GCP with AVMUTE cleared
+
+See: https://forum.libreelec.tv/thread/24780-le-10-0-1-rpi4-no-picture-after-update-from-le-10-0-0
+
+Issue is some displays go blank at the point of firmware to kms handover.
+Plugging/unplugging hdmi cable, power cycling display, or switching standby off/on
+typically resolve this case.
+
+Finally managed to find a display that suffers from this, and track down the issue.
+
+The firmware uses AVMUTE in normal operation. It will set AVMUTE before disabling hdmi
+clocks and phy. It will clear AVMUTE after clocks and phy are set up for a new hdmi mode.
+
+But with the hdmi handover from firmware to kms, AVMUTE will be set by firmware.
+
+kms driver typically has no GCP packet (except for deep colour modes).
+The spec isn't clear on whether to consider the AVMUTE as continuing indefinitely
+in the absense of a GCP packet, or to consider that state to have ended.
+
+Most displays behave as we want, but there are a number (from mutiple manufacturers)
+which need to see AVMUTE cleared before displaying a picture.
+
+Lets just always enable GCP packet with AVMUTE cleared. That resolves the issue on
+problematic displays.
+
+From HDMI 1.4 spec:
+A CD field of zero (Color Depth not indicated) shall be used whenever the Sink does
+not indicate support for Deep Color. This value may also be used in Deep Color mode
+to transmit a GCP indicating only non-Deep Color information (e.g. AVMUTE).
+
+So use CD=0 where we were previously not enabling a GCP.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -107,6 +107,10 @@
+ #define VC5_HDMI_GCP_WORD_1_GCP_SUBPACKET_BYTE_1_SHIFT	8
+ #define VC5_HDMI_GCP_WORD_1_GCP_SUBPACKET_BYTE_1_MASK	VC4_MASK(15, 8)
+ 
++#define VC5_HDMI_GCP_WORD_1_GCP_SUBPACKET_BYTE_0_MASK	VC4_MASK(7, 0)
++#define VC5_HDMI_GCP_WORD_1_GCP_SUBPACKET_BYTE_0_SET_AVMUTE	BIT(0)
++#define VC5_HDMI_GCP_WORD_1_GCP_SUBPACKET_BYTE_0_CLEAR_AVMUTE	BIT(4)
++
+ # define VC4_HD_M_SW_RST			BIT(2)
+ # define VC4_HD_M_ENABLE			BIT(0)
+ 
+@@ -1559,7 +1563,6 @@ static void vc5_hdmi_set_timings(struct
+ 					VC4_HDMI_VERTB_VBP));
+ 	unsigned long flags;
+ 	unsigned char gcp;
+-	bool gcp_en;
+ 	u32 reg;
+ 	int idx;
+ 
+@@ -1594,16 +1597,13 @@ static void vc5_hdmi_set_timings(struct
+ 	switch (vc4_state->output_bpc) {
+ 	case 12:
+ 		gcp = 6;
+-		gcp_en = true;
+ 		break;
+ 	case 10:
+ 		gcp = 5;
+-		gcp_en = true;
+ 		break;
+ 	case 8:
+ 	default:
+-		gcp = 4;
+-		gcp_en = false;
++		gcp = 0;
+ 		break;
+ 	}
+ 
+@@ -1612,8 +1612,7 @@ static void vc5_hdmi_set_timings(struct
+ 	 * doesn't signal in GCP.
+ 	 */
+ 	if (vc4_state->output_format == VC4_HDMI_OUTPUT_YUV422) {
+-		gcp = 4;
+-		gcp_en = false;
++		gcp = 0;
+ 	}
+ 
+ 	reg = HDMI_READ(HDMI_DEEP_COLOR_CONFIG_1);
+@@ -1626,11 +1625,12 @@ static void vc5_hdmi_set_timings(struct
+ 	reg = HDMI_READ(HDMI_GCP_WORD_1);
+ 	reg &= ~VC5_HDMI_GCP_WORD_1_GCP_SUBPACKET_BYTE_1_MASK;
+ 	reg |= VC4_SET_FIELD(gcp, VC5_HDMI_GCP_WORD_1_GCP_SUBPACKET_BYTE_1);
++	reg &= ~VC5_HDMI_GCP_WORD_1_GCP_SUBPACKET_BYTE_0_MASK;
++	reg |= VC5_HDMI_GCP_WORD_1_GCP_SUBPACKET_BYTE_0_CLEAR_AVMUTE;
+ 	HDMI_WRITE(HDMI_GCP_WORD_1, reg);
+ 
+ 	reg = HDMI_READ(HDMI_GCP_CONFIG);
+-	reg &= ~VC5_HDMI_GCP_CONFIG_GCP_ENABLE;
+-	reg |= gcp_en ? VC5_HDMI_GCP_CONFIG_GCP_ENABLE : 0;
++	reg |= VC5_HDMI_GCP_CONFIG_GCP_ENABLE;
+ 	HDMI_WRITE(HDMI_GCP_CONFIG, reg);
+ 
+ 	reg = HDMI_READ(HDMI_MISC_CONTROL);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0546-media-bcm2835-v4l2-codec-Enable-selection-ioctl-for-.patch b/target/linux/bcm27xx/patches-6.1/950-0546-media-bcm2835-v4l2-codec-Enable-selection-ioctl-for-.patch
new file mode 100644
index 00000000000000..cf2e9a804ae5f1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0546-media-bcm2835-v4l2-codec-Enable-selection-ioctl-for-.patch
@@ -0,0 +1,34 @@
+From 774df1d5ef0d70c558ce8c6a56ab9e1e7114bb5f Mon Sep 17 00:00:00 2001
+From: John Cox <jc@kynesim.co.uk>
+Date: Thu, 19 Jan 2023 16:46:32 +0000
+Subject: [PATCH] media: bcm2835-v4l2-codec: Enable selection ioctl for
+ ISP
+
+The ISP cases do nothing. Remove the break that separates them from the
+deinterlace case so they now do the same as deinterlace. This enables
+simple width & height setting, but does not enable setting left and
+top coordinates.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+---
+ .../staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c    | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
++++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+@@ -1857,7 +1857,6 @@ static int vidioc_g_selection(struct fil
+ 		}
+ 		break;
+ 	case ISP:
+-		break;
+ 	case DEINTERLACE:
+ 		if (s->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) {
+ 			switch (s->target) {
+@@ -1981,7 +1980,6 @@ static int vidioc_s_selection(struct fil
+ 		}
+ 		break;
+ 	case ISP:
+-		break;
+ 	case DEINTERLACE:
+ 		if (s->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) {
+ 			switch (s->target) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0547-.github-workflows-Switch-to-a-matrix-build.patch b/target/linux/bcm27xx/patches-6.1/950-0547-.github-workflows-Switch-to-a-matrix-build.patch
new file mode 100644
index 00000000000000..51f32be5a0fd69
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0547-.github-workflows-Switch-to-a-matrix-build.patch
@@ -0,0 +1,333 @@
+From 3ca614742a496b66a9b92ce6be05ff555fdfc2c2 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 23 Jan 2023 16:50:51 +0000
+Subject: [PATCH] .github/workflows: Switch to a matrix build
+
+Remove the per-build duplication by putting build parameters in a
+matrix.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .github/workflows/kernel-build.yml | 293 ++++++-----------------------
+ 1 file changed, 59 insertions(+), 234 deletions(-)
+
+--- a/.github/workflows/kernel-build.yml
++++ b/.github/workflows/kernel-build.yml
+@@ -15,177 +15,40 @@ env:
+   NUM_JOBS: 3
+ 
+ jobs:
+-  build-bcm2835:
+-
+-    runs-on: ubuntu-latest
+-
+-    steps:
+-    - name: Update install
+-      run:
+-        sudo apt-get update
+-
+-    - name: Install toolchain
+-      run:
+-        sudo apt-get install gcc-arm-linux-gnueabihf
+-      timeout-minutes: 5
+-
+-    - uses: actions/checkout@v3
+-      with:
+-        fetch-depth: 1
+-        clean: true
+-
+-    - name: Build kernel
+-      run: |
+-        mkdir ${{github.workspace}}/build
+-        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build bcm2835_defconfig
+-        scripts/config --file ${{github.workspace}}/build/.config --set-val CONFIG_WERROR y
+-        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} zImage modules dtbs
+-        mkdir -p ${{github.workspace}}/install/boot/overlays
+-        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
+-        cp ${{github.workspace}}/build/arch/arm/boot/dts/*.dtb ${{github.workspace}}/install/boot/
+-        cp ${{github.workspace}}/build/arch/arm/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/overlays/
+-        cp ${{github.workspace}}/arch/arm/boot/dts/overlays/README ${{github.workspace}}/install/boot/overlays/
+-        cp ${{github.workspace}}/build/arch/arm/boot/zImage ${{github.workspace}}/install/boot/kernel.img
+-
+-    - name: Tar build
+-      run: tar -cvf bcm2835_build.tar -C ${{github.workspace}}/install .
+-
+-    - name: Upload results
+-      uses: actions/upload-artifact@v3
+-      with:
+-        name: bcm2835_build
+-        path: bcm2835_build.tar
+-        retention-days: 7
+-
+-  build-arm64:
+-
+-    runs-on: ubuntu-latest
+-
+-    steps:
+-    - name: Update install
+-      run:
+-        sudo apt-get update
+-
+-    - name: Install toolchain
+-      run:
+-        sudo apt-get install gcc-aarch64-linux-gnu
+-      timeout-minutes: 5
+-
+-    - uses: actions/checkout@v3
+-      with:
+-        fetch-depth: 1
+-        clean: true
+-
+-    - name: Build kernel
+-      run: |
+-        mkdir ${{github.workspace}}/build
+-        make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build defconfig
+-        scripts/config --file ${{github.workspace}}/build/.config --set-val CONFIG_WERROR y
+-        make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} Image.gz modules dtbs
+-        mkdir -p ${{github.workspace}}/install/boot/overlays
+-        make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
+-        cp ${{github.workspace}}/build/arch/arm64/boot/dts/broadcom/*.dtb ${{github.workspace}}/install/boot/
+-        cp ${{github.workspace}}/build/arch/arm64/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/overlays/
+-        cp ${{github.workspace}}/arch/arm64/boot/dts/overlays/README ${{github.workspace}}/install/boot/overlays/
+-        cp ${{github.workspace}}/build/arch/arm64/boot/Image.gz ${{github.workspace}}/install/boot/kernel8.img
+-
+-    - name: Tar build
+-      run: tar -cvf arm64_build.tar -C ${{github.workspace}}/install .
+-
+-    - name: Upload results
+-      uses: actions/upload-artifact@v3
+-      with:
+-        name: arm64_build
+-        path: arm64_build.tar
+-        retention-days: 7
+-
+-  build-bcmrpi:
+-
+-    runs-on: ubuntu-latest
+-
+-    steps:
+-    - name: Update install
+-      run:
+-        sudo apt-get update
+-
+-    - name: Install toolchain
+-      run:
+-        sudo apt-get install gcc-arm-linux-gnueabihf
+-      timeout-minutes: 5
+-
+-    - uses: actions/checkout@v3
+-      with:
+-        fetch-depth: 1
+-        clean: true
+-
+-    - name: Build kernel
+-      run: |
+-        mkdir ${{github.workspace}}/build
+-        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build bcmrpi_defconfig
+-        scripts/config --file ${{github.workspace}}/build/.config --set-val CONFIG_WERROR y
+-        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} zImage modules dtbs
+-        mkdir -p ${{github.workspace}}/install/boot/overlays
+-        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
+-        cp ${{github.workspace}}/build/arch/arm/boot/dts/*.dtb ${{github.workspace}}/install/boot/
+-        cp ${{github.workspace}}/build/arch/arm/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/overlays/
+-        cp ${{github.workspace}}/arch/arm/boot/dts/overlays/README ${{github.workspace}}/install/boot/overlays/
+-        cp ${{github.workspace}}/build/arch/arm/boot/zImage ${{github.workspace}}/install/boot/kernel.img
+-
+-    - name: Tar build
+-      run: tar -cvf bcmrpi_build.tar -C ${{github.workspace}}/install .
+-
+-    - name: Upload results
+-      uses: actions/upload-artifact@v3
+-      with:
+-        name: bcmrpi_build
+-        path: bcmrpi_build.tar
+-        retention-days: 7
+-
+-  build-bcm2709:
+-
++  build:
+     runs-on: ubuntu-latest
++    strategy:
++      matrix:
++        include:
++          - name: bcm2835
++            arch: arm
++            defconfig: bcm2835_defconfig
++            kernel: kernel
+ 
+-    steps:
+-    - name: Update install
+-      run:
+-        sudo apt-get update
+-
+-    - name: Install toolchain
+-      run:
+-        sudo apt-get install gcc-arm-linux-gnueabihf
+-      timeout-minutes: 5
+-
+-    - uses: actions/checkout@v3
+-      with:
+-        fetch-depth: 1
+-        clean: true
++          - name: arm64
++            arch: arm64
++            defconfig: defconfig
++            kernel: kernel8
+ 
+-    - name: Build kernel
+-      run: |
+-        mkdir ${{github.workspace}}/build
+-        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build bcm2709_defconfig
+-        scripts/config --file ${{github.workspace}}/build/.config --set-val CONFIG_WERROR y
+-        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} zImage modules dtbs
+-        mkdir -p ${{github.workspace}}/install/boot/overlays
+-        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
+-        cp ${{github.workspace}}/build/arch/arm/boot/dts/*.dtb ${{github.workspace}}/install/boot/
+-        cp ${{github.workspace}}/build/arch/arm/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/overlays/
+-        cp ${{github.workspace}}/arch/arm/boot/dts/overlays/README ${{github.workspace}}/install/boot/overlays/
+-        cp ${{github.workspace}}/build/arch/arm/boot/zImage ${{github.workspace}}/install/boot/kernel7.img
++          - name: bcmrpi
++            arch: arm
++            defconfig: bcmrpi_defconfig
++            kernel: kernel
+ 
+-    - name: Tar build
+-      run: tar -cvf bcm2709_build.tar -C ${{github.workspace}}/install .
++          - name: bcm2709
++            arch: arm
++            defconfig: bcm2709_defconfig
++            kernel: kernel7
+ 
+-    - name: Upload results
+-      uses: actions/upload-artifact@v3
+-      with:
+-        name: bcm2709_build
+-        path: bcm2709_build.tar
+-        retention-days: 7
+-
+-  build-bcm2711:
++          - name: bcm2711
++            arch: arm
++            defconfig: bcm2711_defconfig
++            kernel: kernel7l
+ 
+-    runs-on: ubuntu-latest
++          - name: bcm2711_arm64
++            arch: arm64
++            defconfig: bcm2711_defconfig
++            kernel: kernel8
+ 
+     steps:
+     - name: Update install
+@@ -194,59 +57,11 @@ jobs:
+ 
+     - name: Install toolchain
+       run:
+-        sudo apt-get install gcc-arm-linux-gnueabihf
+-      timeout-minutes: 5
+-
+-    - uses: actions/checkout@v3
+-      with:
+-        fetch-depth: 1
+-        clean: true
+-
+-    - name: Build kernel
+-      run: |
+-        mkdir ${{github.workspace}}/build
+-        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build bcm2711_defconfig
+-        scripts/config --file ${{github.workspace}}/build/.config --set-val CONFIG_WERROR y
+-        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} zImage modules dtbs
+-        mkdir -p ${{github.workspace}}/install/boot/overlays
+-        make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
+-        cp ${{github.workspace}}/build/arch/arm/boot/dts/*.dtb ${{github.workspace}}/install/boot/
+-        cp ${{github.workspace}}/build/arch/arm/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/overlays/
+-        cp ${{github.workspace}}/arch/arm/boot/dts/overlays/README ${{github.workspace}}/install/boot/overlays/
+-        cp ${{github.workspace}}/build/arch/arm/boot/zImage ${{github.workspace}}/install/boot/kernel7l.img
+-
+-    - name: Tar build
+-      run: tar -cvf bcm2711_build.tar -C ${{github.workspace}}/install .
+-
+-    - name: Upload results
+-      uses: actions/upload-artifact@v3
+-      with:
+-        name: bcm2711_build
+-        path: bcm2711_build.tar
+-        retention-days: 7
+-
+-  build-bcm2711-arm64:
+-
+-    runs-on: ubuntu-latest
+-
+-    steps:
+-    - name: Update install
+-      run:
+-        sudo apt-get update
+-
+-    - name: Install toolchain
+-      run:
+-        sudo apt-get install gcc-arm-linux-gnueabihf
+-      timeout-minutes: 5
+-
+-    - uses: actions/checkout@v3
+-      with:
+-        fetch-depth: 1
+-        clean: true
+-
+-    - name: Install toolchain
+-      run:
+-        sudo apt-get install gcc-aarch64-linux-gnu
++        if [[ "${{matrix.arch}}" == "arm64" ]]; then
++          sudo apt-get install gcc-aarch64-linux-gnu;
++        else
++          sudo apt-get install gcc-arm-linux-gnueabihf;
++        fi
+       timeout-minutes: 5
+ 
+     - uses: actions/checkout@v3
+@@ -254,25 +69,35 @@ jobs:
+         fetch-depth: 1
+         clean: true
+ 
+-    - name: Build kernel
++    - name: Build kernel ${{matrix.name}}
+       run: |
+         mkdir ${{github.workspace}}/build
+-        make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build bcm2711_defconfig
++        export ARCH=${{matrix.arch}}
++        if [[ "$ARCH" == "arm64" ]]; then
++          export CROSS_COMPILE=aarch64-linux-gnu-
++          export DTS_SUBDIR=broadcom
++          export IMAGE=Image.gz
++        else
++          export CROSS_COMPILE=arm-linux-gnueabihf-
++          export DTS_SUBDIR=
++          export IMAGE=zImage
++        fi
++        make O=${{github.workspace}}/build ${{matrix.defconfig}}
+         scripts/config --file ${{github.workspace}}/build/.config --set-val CONFIG_WERROR y
+-        make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} Image.gz modules dtbs
++        make O=${{github.workspace}}/build -j ${{env.NUM_JOBS}} $IMAGE modules dtbs
+         mkdir -p ${{github.workspace}}/install/boot/overlays
+-        make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
+-        cp ${{github.workspace}}/build/arch/arm64/boot/dts/broadcom/*.dtb ${{github.workspace}}/install/boot/
+-        cp ${{github.workspace}}/build/arch/arm64/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/overlays/
+-        cp ${{github.workspace}}/arch/arm64/boot/dts/overlays/README ${{github.workspace}}/install/boot/overlays/
+-        cp ${{github.workspace}}/build/arch/arm64/boot/Image.gz ${{github.workspace}}/install/boot/kernel8.img
++        make O=${{github.workspace}}/build INSTALL_MOD_PATH=${{github.workspace}}/install modules_install
++        cp ${{github.workspace}}/build/arch/${ARCH}/boot/dts/${DTS_SUBDIR}/*.dtb ${{github.workspace}}/install/boot/
++        cp ${{github.workspace}}/build/arch/${ARCH}/boot/dts/overlays/*.dtb* ${{github.workspace}}/install/boot/overlays/
++        cp ${{github.workspace}}/arch/${ARCH}/boot/dts/overlays/README ${{github.workspace}}/install/boot/overlays/
++        cp ${{github.workspace}}/build/arch/${ARCH}/boot/$IMAGE ${{github.workspace}}/install/boot/${{matrix.kernel}}.img
+ 
+     - name: Tar build
+-      run: tar -cvf bcm2711_arm64_build.tar -C ${{github.workspace}}/install .
++      run: tar -cvf ${{matrix.name}}_build.tar -C ${{github.workspace}}/install .
+ 
+     - name: Upload results
+       uses: actions/upload-artifact@v3
+       with:
+-        name: bcm2711_arm64_build
+-        path: bcm2711_arm64_build.tar
++        name: ${{matrix.name}}_build
++        path: ${{matrix.name}}_build.tar
+         retention-days: 7
diff --git a/target/linux/bcm27xx/patches-6.1/950-0548-overlays-i2c-sensor-Add-SHT4X-support.patch b/target/linux/bcm27xx/patches-6.1/950-0548-overlays-i2c-sensor-Add-SHT4X-support.patch
new file mode 100644
index 00000000000000..28fb05e56708b0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0548-overlays-i2c-sensor-Add-SHT4X-support.patch
@@ -0,0 +1,74 @@
+From 7f4d21e48d07ada294c9c383b350860aa20efeea Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 24 Jan 2023 11:34:38 +0000
+Subject: [PATCH] overlays: i2c-sensor: Add SHT4X support
+
+Add support for the Sensirion SHT4X temperature and humidity
+sensor.
+
+See: https://github.com/raspberrypi/linux/issues/5334
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README              |  8 ++++++--
+ .../boot/dts/overlays/i2c-sensor-common.dtsi   | 18 +++++++++++++++++-
+ 2 files changed, 23 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -2077,8 +2077,12 @@ Params: addr                    Set the
+         reset_pin               GPIO to be used to reset the device (bno055
+                                 only, disabled by default)
+ 
+-        sht3x                   Select the Sensiron SHT3x temperature and
+-                                humidity sensor. Valid addresses 0x44-0x45,
++        sht3x                   Select the Sensirion SHT3x temperature and
++                                humidity sensors. Valid addresses 0x44-0x45,
++                                default 0x44
++
++        sht4x                   Select the Sensirion SHT4x temperature and
++                                humidity sensors. Valid addresses 0x44-0x45,
+                                 default 0x44
+ 
+         si7020                  Select the Silicon Labs Si7013/20/21 humidity/
+--- a/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+@@ -478,6 +478,21 @@
+ 		};
+ 	};
+ 
++	fragment@32 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			sht4x: sht4x@44 {
++				compatible = "sht4x";
++				reg = <0x44>;
++				status = "okay";
++			};
++		};
++	};
++
+ 	__overrides__ {
+ 		bme280 = <0>,"+0";
+ 		bmp085 = <0>,"+1";
+@@ -511,6 +526,7 @@
+ 		mpu6050 = <0>,"+28";
+ 		mpu9250 = <0>,"+29";
+ 		bno055 = <0>,"+31";
++		sht4x = <0>,"+32";
+ 
+ 		addr =	<&bme280>,"reg:0", <&bmp280>,"reg:0", <&tmp102>,"reg:0",
+ 			<&lm75>,"reg:0", <&hdc100x>,"reg:0", <&sht3x>,"reg:0",
+@@ -519,7 +535,7 @@
+ 			<&ms5637>,"reg:0", <&ms5803>,"reg:0", <&ms5805>,"reg:0",
+ 			<&ms5837>,"reg:0", <&ms8607>,"reg:0",
+ 			<&mpu6050>,"reg:0", <&mpu9250>,"reg:0",
+-			<&bno055>,"reg:0";
++			<&bno055>,"reg:0", <&sht4x>,"reg:0";
+ 		int_pin = <&max30102>, "interrupts:0",
+ 			<&mpu6050>, "interrupts:0",
+ 			<&mpu9250>, "interrupts:0";
diff --git a/target/linux/bcm27xx/patches-6.1/950-0549-kunit-Provide-a-static-key-to-check-if-KUnit-is-acti.patch b/target/linux/bcm27xx/patches-6.1/950-0549-kunit-Provide-a-static-key-to-check-if-KUnit-is-acti.patch
new file mode 100644
index 00000000000000..cfd4c22919e3b8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0549-kunit-Provide-a-static-key-to-check-if-KUnit-is-acti.patch
@@ -0,0 +1,75 @@
+From 0f354629c10f457751c20a230b13b1b7ac2f1fbc Mon Sep 17 00:00:00 2001
+From: David Gow <davidgow@google.com>
+Date: Fri, 25 Nov 2022 16:43:04 +0800
+Subject: [PATCH] kunit: Provide a static key to check if KUnit is
+ actively running tests
+
+KUnit does a few expensive things when enabled. This hasn't been a
+problem because KUnit was only enabled on test kernels, but with a few
+people enabling (but not _using_) KUnit on production systems, we need a
+runtime way of handling this.
+
+Provide a 'kunit_running' static key (defaulting to false), which allows
+us to hide any KUnit code behind a static branch. This should reduce the
+performance impact (on other code) of having KUnit enabled to a single
+NOP when no tests are running.
+
+Note that, while it looks unintuitive, tests always run entirely within
+__kunit_test_suites_init(), so it's safe to decrement the static key at
+the end of this function, rather than in __kunit_test_suites_exit(),
+which is only there to clean up results in debugfs.
+
+Signed-off-by: David Gow <davidgow@google.com>
+Reviewed-by: Daniel Latypov <dlatypov@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+---
+ include/kunit/test.h | 4 ++++
+ lib/kunit/test.c     | 6 ++++++
+ 2 files changed, 10 insertions(+)
+
+--- a/include/kunit/test.h
++++ b/include/kunit/test.h
+@@ -16,6 +16,7 @@
+ #include <linux/container_of.h>
+ #include <linux/err.h>
+ #include <linux/init.h>
++#include <linux/jump_label.h>
+ #include <linux/kconfig.h>
+ #include <linux/kref.h>
+ #include <linux/list.h>
+@@ -27,6 +28,9 @@
+ 
+ #include <asm/rwonce.h>
+ 
++/* Static key: true if any KUnit tests are currently running */
++DECLARE_STATIC_KEY_FALSE(kunit_running);
++
+ struct kunit;
+ 
+ /* Size of log associated with test. */
+--- a/lib/kunit/test.c
++++ b/lib/kunit/test.c
+@@ -20,6 +20,8 @@
+ #include "string-stream.h"
+ #include "try-catch-impl.h"
+ 
++DEFINE_STATIC_KEY_FALSE(kunit_running);
++
+ #if IS_BUILTIN(CONFIG_KUNIT)
+ /*
+  * Fail the current test and print an error message to the log.
+@@ -622,10 +624,14 @@ int __kunit_test_suites_init(struct kuni
+ 		return 0;
+ 	}
+ 
++	static_branch_inc(&kunit_running);
++
+ 	for (i = 0; i < num_suites; i++) {
+ 		kunit_init_suite(suites[i]);
+ 		kunit_run_tests(suites[i]);
+ 	}
++
++	static_branch_dec(&kunit_running);
+ 	return 0;
+ }
+ EXPORT_SYMBOL_GPL(__kunit_test_suites_init);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0550-kunit-Use-the-static-key-when-retrieving-the-current.patch b/target/linux/bcm27xx/patches-6.1/950-0550-kunit-Use-the-static-key-when-retrieving-the-current.patch
new file mode 100644
index 00000000000000..531d5fe6ac677d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0550-kunit-Use-the-static-key-when-retrieving-the-current.patch
@@ -0,0 +1,174 @@
+From e7950beaf2123170d65709df3988c25a280c05f1 Mon Sep 17 00:00:00 2001
+From: David Gow <davidgow@google.com>
+Date: Fri, 25 Nov 2022 16:43:05 +0800
+Subject: [PATCH] kunit: Use the static key when retrieving the current
+ test
+
+In order to detect if a KUnit test is running, and to access its
+context, the 'kunit_test' member of the current task_struct is used.
+Usually, this is accessed directly or via the kunit_fail_current_task()
+function.
+
+In order to speed up the case where no test is running, add a wrapper,
+kunit_get_current_test(), which uses the static key to fail early.
+Equally, Speed up kunit_fail_current_test() by using the static key.
+
+This should make it convenient for code to call this
+unconditionally in fakes or error paths, without worrying that this will
+slow the code down significantly.
+
+If CONFIG_KUNIT=n (or m), this compiles away to nothing. If
+CONFIG_KUNIT=y, it will compile down to a NOP (on most architectures) if
+no KUnit test is currently running.
+
+Note that kunit_get_current_test() does not work if KUnit is built as a
+module. This mirrors the existing restriction on kunit_fail_current_test().
+
+Note that the definition of kunit_fail_current_test() still wraps an
+empty, inline function if KUnit is not built-in. This is to ensure that
+the printf format string __attribute__ will still work.
+
+Also update the documentation to suggest users use the new
+kunit_get_current_test() function, update the example, and to describe
+the behaviour when KUnit is disabled better.
+
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Sadiya Kazi <sadiyakazi@google.com>
+Signed-off-by: David Gow <davidgow@google.com>
+Reviewed-by: Daniel Latypov <dlatypov@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+---
+ Documentation/dev-tools/kunit/usage.rst | 30 +++++++++-----
+ include/kunit/test-bug.h                | 53 +++++++++++++++++++++++--
+ 2 files changed, 71 insertions(+), 12 deletions(-)
+
+--- a/Documentation/dev-tools/kunit/usage.rst
++++ b/Documentation/dev-tools/kunit/usage.rst
+@@ -625,17 +625,23 @@ as shown in next section: *Accessing The
+ Accessing The Current Test
+ --------------------------
+ 
+-In some cases, we need to call test-only code from outside the test file.
+-For example, see example in section *Injecting Test-Only Code* or if
+-we are providing a fake implementation of an ops struct. Using
+-``kunit_test`` field in ``task_struct``, we can access it via
+-``current->kunit_test``.
++In some cases, we need to call test-only code from outside the test file.  This
++is helpful, for example, when providing a fake implementation of a function, or
++to fail any current test from within an error handler.
++We can do this via the ``kunit_test`` field in ``task_struct``, which we can
++access using the ``kunit_get_current_test()`` function in ``kunit/test-bug.h``.
++
++``kunit_get_current_test()`` is safe to call even if KUnit is not enabled. If
++KUnit is not enabled, was built as a module (``CONFIG_KUNIT=m``), or no test is
++running in the current task, it will return ``NULL``. This compiles down to
++either a no-op or a static key check, so will have a negligible performance
++impact when no test is running.
+ 
+-The example below includes how to implement "mocking":
++The example below uses this to implement a "mock" implementation of a function, ``foo``:
+ 
+ .. code-block:: c
+ 
+-	#include <linux/sched.h> /* for current */
++	#include <kunit/test-bug.h> /* for kunit_get_current_test */
+ 
+ 	struct test_data {
+ 		int foo_result;
+@@ -644,7 +650,7 @@ The example below includes how to implem
+ 
+ 	static int fake_foo(int arg)
+ 	{
+-		struct kunit *test = current->kunit_test;
++		struct kunit *test = kunit_get_current_test();
+ 		struct test_data *test_data = test->priv;
+ 
+ 		KUNIT_EXPECT_EQ(test, test_data->want_foo_called_with, arg);
+@@ -675,7 +681,7 @@ Each test can have multiple resources wh
+ flexibility as a ``priv`` member, but also, for example, allowing helper
+ functions to create resources without conflicting with each other. It is also
+ possible to define a clean up function for each resource, making it easy to
+-avoid resource leaks. For more information, see Documentation/dev-tools/kunit/api/test.rst.
++avoid resource leaks. For more information, see Documentation/dev-tools/kunit/api/resource.rst.
+ 
+ Failing The Current Test
+ ------------------------
+@@ -703,3 +709,9 @@ structures as shown below:
+ 	static void my_debug_function(void) { }
+ 	#endif
+ 
++``kunit_fail_current_test()`` is safe to call even if KUnit is not enabled. If
++KUnit is not enabled, was built as a module (``CONFIG_KUNIT=m``), or no test is
++running in the current task, it will do nothing. This compiles down to either a
++no-op or a static key check, so will have a negligible performance impact when
++no test is running.
++
+--- a/include/kunit/test-bug.h
++++ b/include/kunit/test-bug.h
+@@ -9,16 +9,63 @@
+ #ifndef _KUNIT_TEST_BUG_H
+ #define _KUNIT_TEST_BUG_H
+ 
+-#define kunit_fail_current_test(fmt, ...) \
+-	__kunit_fail_current_test(__FILE__, __LINE__, fmt, ##__VA_ARGS__)
+-
+ #if IS_BUILTIN(CONFIG_KUNIT)
+ 
++#include <linux/jump_label.h> /* For static branch */
++#include <linux/sched.h>
++
++/* Static key if KUnit is running any tests. */
++DECLARE_STATIC_KEY_FALSE(kunit_running);
++
++/**
++ * kunit_get_current_test() - Return a pointer to the currently running
++ *			      KUnit test.
++ *
++ * If a KUnit test is running in the current task, returns a pointer to its
++ * associated struct kunit. This pointer can then be passed to any KUnit
++ * function or assertion. If no test is running (or a test is running in a
++ * different task), returns NULL.
++ *
++ * This function is safe to call even when KUnit is disabled. If CONFIG_KUNIT
++ * is not enabled, it will compile down to nothing and will return quickly no
++ * test is running.
++ */
++static inline struct kunit *kunit_get_current_test(void)
++{
++	if (!static_branch_unlikely(&kunit_running))
++		return NULL;
++
++	return current->kunit_test;
++}
++
++
++/**
++ * kunit_fail_current_test() - If a KUnit test is running, fail it.
++ *
++ * If a KUnit test is running in the current task, mark that test as failed.
++ *
++ * This macro will only work if KUnit is built-in (though the tests
++ * themselves can be modules). Otherwise, it compiles down to nothing.
++ */
++#define kunit_fail_current_test(fmt, ...) do {					\
++		if (static_branch_unlikely(&kunit_running)) {			\
++			__kunit_fail_current_test(__FILE__, __LINE__,		\
++						  fmt, ##__VA_ARGS__);		\
++		}								\
++	} while (0)
++
++
+ extern __printf(3, 4) void __kunit_fail_current_test(const char *file, int line,
+ 						    const char *fmt, ...);
+ 
+ #else
+ 
++static inline struct kunit *kunit_get_current_test(void) { return NULL; }
++
++/* We define this with an empty helper function so format string warnings work */
++#define kunit_fail_current_test(fmt, ...) \
++		__kunit_fail_current_test(__FILE__, __LINE__, fmt, ##__VA_ARGS__)
++
+ static inline __printf(3, 4) void __kunit_fail_current_test(const char *file, int line,
+ 							    const char *fmt, ...)
+ {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0551-drm-vc4-hvs-Initialize-the-dlist-allocation-list-ent.patch b/target/linux/bcm27xx/patches-6.1/950-0551-drm-vc4-hvs-Initialize-the-dlist-allocation-list-ent.patch
new file mode 100644
index 00000000000000..9cd549b355138e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0551-drm-vc4-hvs-Initialize-the-dlist-allocation-list-ent.patch
@@ -0,0 +1,30 @@
+From 8c51f78f0fb8bd8a3bab02155eea8d1f5cdc1a9b Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Wed, 25 Jan 2023 12:38:37 +0100
+Subject: [PATCH] drm/vc4: hvs: Initialize the dlist allocation list
+ entry
+
+The vc4_hvs_dlist_allocation structure has a list that we don't
+initialize when we allocate a new instance.
+
+This makes any call reading the list structure (such as list_empty) fail
+with a NULL pointer dereference.
+
+Let's make sure our list is always initialized.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -452,6 +452,8 @@ vc4_hvs_alloc_dlist_entry(struct vc4_hvs
+ 	if (!alloc)
+ 		return ERR_PTR(-ENOMEM);
+ 
++	INIT_LIST_HEAD(&alloc->node);
++
+ 	spin_lock_irqsave(&hvs->mm_lock, flags);
+ 	ret = drm_mm_insert_node(&hvs->dlist_mm, &alloc->mm_node,
+ 				 dlist_count);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0552-drm-vc4-hvs-Move-the-dlist-allocation-destruction-to.patch b/target/linux/bcm27xx/patches-6.1/950-0552-drm-vc4-hvs-Move-the-dlist-allocation-destruction-to.patch
new file mode 100644
index 00000000000000..0db70594153912
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0552-drm-vc4-hvs-Move-the-dlist-allocation-destruction-to.patch
@@ -0,0 +1,46 @@
+From 718d920a2dfd680811bdf987706b50a6e23f0527 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Wed, 25 Jan 2023 12:54:36 +0100
+Subject: [PATCH] drm/vc4: hvs: Move the dlist allocation destruction
+ to a function
+
+We'll need to destroy a dlist allocation in multiple code paths, so
+let's move it to a separate function.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -466,6 +466,18 @@ vc4_hvs_alloc_dlist_entry(struct vc4_hvs
+ 	return alloc;
+ }
+ 
++static void vc4_hvs_free_dlist_entry_locked(struct vc4_hvs *hvs,
++					    struct vc4_hvs_dlist_allocation *alloc)
++{
++	lockdep_assert_held(&hvs->mm_lock);
++
++	if (!list_empty(&alloc->node))
++		list_del(&alloc->node);
++
++	drm_mm_remove_node(&alloc->mm_node);
++	kfree(alloc);
++}
++
+ void vc4_hvs_mark_dlist_entry_stale(struct vc4_hvs *hvs,
+ 				    struct vc4_hvs_dlist_allocation *alloc)
+ {
+@@ -553,9 +565,7 @@ static void vc4_hvs_dlist_free_work(stru
+ 		if (!vc4_hvs_frcnt_lte(cur->target_frame_count, frcnt))
+ 			continue;
+ 
+-		list_del(&cur->node);
+-		drm_mm_remove_node(&cur->mm_node);
+-		kfree(cur);
++		vc4_hvs_free_dlist_entry_locked(hvs, cur);
+ 	}
+ 	spin_unlock_irqrestore(&hvs->mm_lock, flags);
+ }
diff --git a/target/linux/bcm27xx/patches-6.1/950-0553-drm-vc4-hvs-Destroy-dlist-allocations-immediately-wh.patch b/target/linux/bcm27xx/patches-6.1/950-0553-drm-vc4-hvs-Destroy-dlist-allocations-immediately-wh.patch
new file mode 100644
index 00000000000000..ad5fc3740fa68e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0553-drm-vc4-hvs-Destroy-dlist-allocations-immediately-wh.patch
@@ -0,0 +1,48 @@
+From 9be7327ba367a71d75ecd86688b9fb317444529c Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Wed, 25 Jan 2023 13:05:26 +0100
+Subject: [PATCH] drm/vc4: hvs: Destroy dlist allocations immediately
+ when running a test
+
+When running a kunit test, the driver runs with a mock device. As such,
+any attempt to read or write to a hardware register will fail the
+current test immediately.
+
+The dlist allocation management recently introduced will read the
+current frame count from the HVS to defer its destruction until a
+subsequent frame has been output. This obviously involves a register
+read that fails the Kunit tests.
+
+Change the destruction deferral function to destroy the allocation
+immediately if we run under kunit. This is essentially harmless since
+the main reason for that deferall is to prevent any access to the
+hardware dlist while a frame described by that list is rendered. On our
+mock driver, we have neither a hardware dlist nor a rendering, so it
+doesn't matter.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -490,6 +490,18 @@ void vc4_hvs_mark_dlist_entry_stale(stru
+ 	if (!drm_mm_node_allocated(&alloc->mm_node))
+ 		return;
+ 
++	/*
++	 * Kunit tests run with a mock device and we consider any hardware
++	 * access a test failure. Let's free the dlist allocation right away if
++	 * we're running under kunit, we won't risk a dlist corruption anyway.
++	 */
++	if (kunit_get_current_test()) {
++		spin_lock_irqsave(&hvs->mm_lock, flags);
++		vc4_hvs_free_dlist_entry_locked(hvs, alloc);
++		spin_unlock_irqrestore(&hvs->mm_lock, flags);
++		return;
++	}
++
+ 	frcnt = vc4_hvs_get_fifo_frame_count(hvs, alloc->channel);
+ 	alloc->target_frame_count = (frcnt + 1) & ((1 << 6) - 1);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0554-ARM-dts-Set-the-LED-default-state-to-off.patch b/target/linux/bcm27xx/patches-6.1/950-0554-ARM-dts-Set-the-LED-default-state-to-off.patch
new file mode 100644
index 00000000000000..257561318ba42e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0554-ARM-dts-Set-the-LED-default-state-to-off.patch
@@ -0,0 +1,270 @@
+From 808b5ec5bddc978f7dcb3e7afafd959503213b1c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 24 Jan 2023 16:54:16 +0000
+Subject: [PATCH] ARM: dts: Set the LED default-state to "off"
+
+The default-state property for an LED determines the state of the LED
+when its trigger is set to "none". Many users expect that specifying a
+trigger of "none" means that the LED will be off, and there is a logic
+to that assumption, but the current default of "keep" makes the
+assumption false.
+
+Given that no Pi models have a default-trigger of "none", changing the
+default-state should have no visible impact for most people, but doing
+so will permit a more obvious and more consistent way of turning off
+the LEDs.
+
+Note that 6.2 included an upstream DT reorganisation that required some
+downstream changes, and while doing that I changed the default states.
+This commit brings rpi-6.1.y into line with rpi-6.2.y.
+
+See: https://github.com/raspberrypi/firmware/issues/1742
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/bcm2708-rpi-b-plus.dts   | 2 ++
+ arch/arm/boot/dts/bcm2708-rpi-b-rev1.dts   | 1 +
+ arch/arm/boot/dts/bcm2708-rpi-b.dts        | 1 +
+ arch/arm/boot/dts/bcm2708-rpi-cm.dtsi      | 1 +
+ arch/arm/boot/dts/bcm2708-rpi-zero-w.dts   | 1 +
+ arch/arm/boot/dts/bcm2708-rpi-zero.dts     | 1 +
+ arch/arm/boot/dts/bcm2709-rpi-2-b.dts      | 2 ++
+ arch/arm/boot/dts/bcm2709-rpi-cm2.dts      | 1 +
+ arch/arm/boot/dts/bcm2710-rpi-2-b.dts      | 2 ++
+ arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts | 2 ++
+ arch/arm/boot/dts/bcm2710-rpi-3-b.dts      | 2 ++
+ arch/arm/boot/dts/bcm2710-rpi-cm3.dts      | 1 +
+ arch/arm/boot/dts/bcm2710-rpi-zero-2-w.dts | 1 +
+ arch/arm/boot/dts/bcm2711-rpi-4-b.dts      | 2 ++
+ arch/arm/boot/dts/bcm2711-rpi-400.dts      | 3 ++-
+ arch/arm/boot/dts/bcm2711-rpi-cm4.dts      | 2 ++
+ arch/arm/boot/dts/bcm2711-rpi-cm4s.dts     | 1 +
+ 17 files changed, 25 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
++++ b/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
+@@ -158,12 +158,14 @@
+ &leds {
+ 	act_led: led-act {
+ 		label = "led0";
++		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&gpio 47 0>;
+ 	};
+ 
+ 	pwr_led: led-pwr {
+ 		label = "led1";
++		default-state = "off";
+ 		linux,default-trigger = "input";
+ 		gpios = <&gpio 35 0>;
+ 	};
+--- a/arch/arm/boot/dts/bcm2708-rpi-b-rev1.dts
++++ b/arch/arm/boot/dts/bcm2708-rpi-b-rev1.dts
+@@ -176,6 +176,7 @@ i2c_csi_dsi: &i2c1 {
+ &leds {
+ 	act_led: led-act {
+ 		label = "led0";
++		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&gpio 16 1>;
+ 	};
+--- a/arch/arm/boot/dts/bcm2708-rpi-b.dts
++++ b/arch/arm/boot/dts/bcm2708-rpi-b.dts
+@@ -158,6 +158,7 @@
+ &leds {
+ 	act_led: led-act {
+ 		label = "led0";
++		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&gpio 16 1>;
+ 	};
+--- a/arch/arm/boot/dts/bcm2708-rpi-cm.dtsi
++++ b/arch/arm/boot/dts/bcm2708-rpi-cm.dtsi
+@@ -4,6 +4,7 @@
+ &leds {
+ 	act_led: led-act {
+ 		label = "led0";
++		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&gpio 47 0>;
+ 	};
+--- a/arch/arm/boot/dts/bcm2708-rpi-zero-w.dts
++++ b/arch/arm/boot/dts/bcm2708-rpi-zero-w.dts
+@@ -214,6 +214,7 @@
+ &leds {
+ 	act_led: led-act {
+ 		label = "led0";
++		default-state = "off";
+ 		linux,default-trigger = "actpwr";
+ 		gpios = <&gpio 47 GPIO_ACTIVE_LOW>;
+ 	};
+--- a/arch/arm/boot/dts/bcm2708-rpi-zero.dts
++++ b/arch/arm/boot/dts/bcm2708-rpi-zero.dts
+@@ -155,6 +155,7 @@
+ &leds {
+ 	act_led: led-act {
+ 		label = "led0";
++		default-state = "off";
+ 		linux,default-trigger = "actpwr";
+ 		gpios = <&gpio 47 GPIO_ACTIVE_LOW>;
+ 	};
+--- a/arch/arm/boot/dts/bcm2709-rpi-2-b.dts
++++ b/arch/arm/boot/dts/bcm2709-rpi-2-b.dts
+@@ -158,12 +158,14 @@
+ &leds {
+ 	act_led: led-act {
+ 		label = "led0";
++		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&gpio 47 0>;
+ 	};
+ 
+ 	pwr_led: led-pwr {
+ 		label = "led1";
++		default-state = "off";
+ 		linux,default-trigger = "input";
+ 		gpios = <&gpio 35 0>;
+ 	};
+--- a/arch/arm/boot/dts/bcm2709-rpi-cm2.dts
++++ b/arch/arm/boot/dts/bcm2709-rpi-cm2.dts
+@@ -192,6 +192,7 @@ cam0_reg: &cam0_regulator {
+ &leds {
+ 	act_led: led-act {
+ 		label = "led0";
++		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&virtgpio 0 0>;
+ 	};
+--- a/arch/arm/boot/dts/bcm2710-rpi-2-b.dts
++++ b/arch/arm/boot/dts/bcm2710-rpi-2-b.dts
+@@ -158,12 +158,14 @@
+ &leds {
+ 	act_led: led-act {
+ 		label = "led0";
++		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&gpio 47 0>;
+ 	};
+ 
+ 	pwr_led: led-pwr {
+ 		label = "led1";
++		default-state = "off";
+ 		linux,default-trigger = "input";
+ 		gpios = <&gpio 35 0>;
+ 	};
+--- a/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
++++ b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
+@@ -234,12 +234,14 @@
+ &leds {
+ 	act_led: led-act {
+ 		label = "led0";
++		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&gpio 29 0>;
+ 	};
+ 
+ 	pwr_led: led-pwr {
+ 		label = "led1";
++		default-state = "off";
+ 		linux,default-trigger = "default-on";
+ 		gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
+ 	};
+--- a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
++++ b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
+@@ -249,12 +249,14 @@
+ &leds {
+ 	act_led: led-act {
+ 		label = "led0";
++		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&virtgpio 0 0>;
+ 	};
+ 
+ 	pwr_led: led-pwr {
+ 		label = "led1";
++		default-state = "off";
+ 		linux,default-trigger = "input";
+ 		gpios = <&expgpio 7 0>;
+ 	};
+--- a/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
++++ b/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
+@@ -191,6 +191,7 @@ cam0_reg: &cam0_regulator {
+ &leds {
+ 	act_led: led-act {
+ 		label = "led0";
++		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&virtgpio 0 0>;
+ 	};
+--- a/arch/arm/boot/dts/bcm2710-rpi-zero-2-w.dts
++++ b/arch/arm/boot/dts/bcm2710-rpi-zero-2-w.dts
+@@ -227,6 +227,7 @@
+ &leds {
+ 	act_led: led-act {
+ 		label = "led0";
++		default-state = "off";
+ 		linux,default-trigger = "actpwr";
+ 		gpios = <&gpio 29 GPIO_ACTIVE_LOW>;
+ 	};
+--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
+@@ -507,12 +507,14 @@
+ &leds {
+ 	act_led: led-act {
+ 		label = "led0";
++		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
+ 	};
+ 
+ 	pwr_led: led-pwr {
+ 		label = "led1";
++		default-state = "off";
+ 		linux,default-trigger = "default-on";
+ 		gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
+ 	};
+--- a/arch/arm/boot/dts/bcm2711-rpi-400.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-400.dts
+@@ -514,13 +514,14 @@
+ &leds {
+ 	act_led: led-act {
+ 		label = "led0";
++		default-state = "off";
+ 		linux,default-trigger = "default-on";
+-		default-state = "on";
+ 		gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
+ 	};
+ 
+ 	pwr_led: led-pwr {
+ 		label = "led1";
++		default-state = "off";
+ 		linux,default-trigger = "default-on";
+ 		gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
+ 	};
+--- a/arch/arm/boot/dts/bcm2711-rpi-cm4.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-cm4.dts
+@@ -519,12 +519,14 @@
+ &leds {
+ 	act_led: led-act {
+ 		label = "led0";
++		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
+ 	};
+ 
+ 	pwr_led: led-pwr {
+ 		label = "led1";
++		default-state = "off";
+ 		linux,default-trigger = "default-on";
+ 		gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
+ 	};
+--- a/arch/arm/boot/dts/bcm2711-rpi-cm4s.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-cm4s.dts
+@@ -389,6 +389,7 @@
+ &leds {
+ 	act_led: led-act {
+ 		label = "led0";
++		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 	};
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0555-README.md-Replace-6.0-build-status-with-6.2.patch b/target/linux/bcm27xx/patches-6.1/950-0555-README.md-Replace-6.0-build-status-with-6.2.patch
new file mode 100644
index 00000000000000..889ae948a89049
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0555-README.md-Replace-6.0-build-status-with-6.2.patch
@@ -0,0 +1,27 @@
+From 1cc246c143210efe249978419b094b03bf2137e0 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <8911409+pelwell@users.noreply.github.com>
+Date: Wed, 25 Jan 2023 10:19:52 +0000
+Subject: [PATCH] README.md: Replace 6.0 build status with 6.2
+
+6.0 is EOL and 6.2 is heading towards release, so update the build status display accordingly.
+---
+ README.md | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/README.md
++++ b/README.md
+@@ -21,10 +21,10 @@ Build status for rpi-5.15.y:
+ [![Pi kernel build tests](https://github.com/raspberrypi/linux/actions/workflows/kernel-build.yml/badge.svg?branch=rpi-5.15.y)](https://github.com/raspberrypi/linux/actions/workflows/kernel-build.yml)
+ [![dtoverlaycheck](https://github.com/raspberrypi/linux/actions/workflows/dtoverlaycheck.yml/badge.svg?branch=rpi-5.15.y)](https://github.com/raspberrypi/linux/actions/workflows/dtoverlaycheck.yml)
+ 
+-Build status for rpi-6.0.y:
+-[![Pi kernel build tests](https://github.com/raspberrypi/linux/actions/workflows/kernel-build.yml/badge.svg?branch=rpi-6.0.y)](https://github.com/raspberrypi/linux/actions/workflows/kernel-build.yml)
+-[![dtoverlaycheck](https://github.com/raspberrypi/linux/actions/workflows/dtoverlaycheck.yml/badge.svg?branch=rpi-6.0.y)](https://github.com/raspberrypi/linux/actions/workflows/dtoverlaycheck.yml)
+-
+ Build status for rpi-6.1.y:
+ [![Pi kernel build tests](https://github.com/raspberrypi/linux/actions/workflows/kernel-build.yml/badge.svg?branch=rpi-6.1.y)](https://github.com/raspberrypi/linux/actions/workflows/kernel-build.yml)
+ [![dtoverlaycheck](https://github.com/raspberrypi/linux/actions/workflows/dtoverlaycheck.yml/badge.svg?branch=rpi-6.1.y)](https://github.com/raspberrypi/linux/actions/workflows/dtoverlaycheck.yml)
++
++Build status for rpi-6.2.y:
++[![Pi kernel build tests](https://github.com/raspberrypi/linux/actions/workflows/kernel-build.yml/badge.svg?branch=rpi-6.2.y)](https://github.com/raspberrypi/linux/actions/workflows/kernel-build.yml)
++[![dtoverlaycheck](https://github.com/raspberrypi/linux/actions/workflows/dtoverlaycheck.yml/badge.svg?branch=rpi-6.2.y)](https://github.com/raspberrypi/linux/actions/workflows/dtoverlaycheck.yml)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0556-.github-workflows-Retain-artifacts-for-90-days.patch b/target/linux/bcm27xx/patches-6.1/950-0556-.github-workflows-Retain-artifacts-for-90-days.patch
new file mode 100644
index 00000000000000..abc61e8b68b65b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0556-.github-workflows-Retain-artifacts-for-90-days.patch
@@ -0,0 +1,18 @@
+From 05a9a53de8785c82332081a5f44cc34dc9fa5f0c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 25 Jan 2023 15:01:43 +0000
+Subject: [PATCH] .github/workflows: Retain artifacts for 90 days
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .github/workflows/kernel-build.yml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/.github/workflows/kernel-build.yml
++++ b/.github/workflows/kernel-build.yml
+@@ -100,4 +100,4 @@ jobs:
+       with:
+         name: ${{matrix.name}}_build
+         path: ${{matrix.name}}_build.tar
+-        retention-days: 7
++        retention-days: 90
diff --git a/target/linux/bcm27xx/patches-6.1/950-0557-media-bcm2835-v4l2-codec-Add-profile-level-ctrls-to-.patch b/target/linux/bcm27xx/patches-6.1/950-0557-media-bcm2835-v4l2-codec-Add-profile-level-ctrls-to-.patch
new file mode 100644
index 00000000000000..002280d1ea80d9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0557-media-bcm2835-v4l2-codec-Add-profile-level-ctrls-to-.patch
@@ -0,0 +1,121 @@
+From a99a43c595e40de8e584c47b0d05a61d931b416e Mon Sep 17 00:00:00 2001
+From: John Cox <jc@kynesim.co.uk>
+Date: Mon, 30 Jan 2023 16:34:55 +0000
+Subject: [PATCH] media: bcm2835-v4l2-codec: Add profile & level ctrls
+ to decode
+
+In order to support discovery of what profile & levels are supported by
+stateful decoders implement the profile and level controls where they
+are defined by V4L2.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+---
+ .../bcm2835-codec/bcm2835-v4l2-codec.c        | 86 ++++++++++++++++++-
+ 1 file changed, 85 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
++++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+@@ -3195,6 +3195,89 @@ static int queue_init(void *priv, struct
+ 	return vb2_queue_init(dst_vq);
+ }
+ 
++static void dec_add_profile_ctrls(struct bcm2835_codec_dev *const dev,
++				  struct v4l2_ctrl_handler *const hdl)
++{
++	unsigned int i;
++	const struct bcm2835_codec_fmt_list *const list = &dev->supported_fmts[0];
++
++	for (i = 0; i < list->num_entries; ++i) {
++		switch (list->list[i].fourcc) {
++		case V4L2_PIX_FMT_H264:
++			v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++					       V4L2_CID_MPEG_VIDEO_H264_LEVEL,
++					       V4L2_MPEG_VIDEO_H264_LEVEL_4_2,
++					       ~(BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_0) |
++						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1B) |
++						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_1) |
++						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_2) |
++						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_3) |
++						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_0) |
++						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_1) |
++						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_2) |
++						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
++						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
++						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
++						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0) |
++						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_1) |
++						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_2)),
++					       V4L2_MPEG_VIDEO_H264_LEVEL_4_0);
++			v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++					       V4L2_CID_MPEG_VIDEO_H264_PROFILE,
++					       V4L2_MPEG_VIDEO_H264_PROFILE_HIGH,
++					       ~(BIT(V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE) |
++						 BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE) |
++						 BIT(V4L2_MPEG_VIDEO_H264_PROFILE_MAIN) |
++						 BIT(V4L2_MPEG_VIDEO_H264_PROFILE_HIGH)),
++						V4L2_MPEG_VIDEO_H264_PROFILE_HIGH);
++			break;
++		case V4L2_PIX_FMT_MPEG2:
++			v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++					       V4L2_CID_MPEG_VIDEO_MPEG2_LEVEL,
++					       V4L2_MPEG_VIDEO_MPEG2_LEVEL_HIGH,
++					       ~(BIT(V4L2_MPEG_VIDEO_MPEG2_LEVEL_LOW) |
++						 BIT(V4L2_MPEG_VIDEO_MPEG2_LEVEL_MAIN) |
++						 BIT(V4L2_MPEG_VIDEO_MPEG2_LEVEL_HIGH_1440) |
++						 BIT(V4L2_MPEG_VIDEO_MPEG2_LEVEL_HIGH)),
++					       V4L2_MPEG_VIDEO_MPEG2_LEVEL_MAIN);
++			v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++					       V4L2_CID_MPEG_VIDEO_MPEG2_PROFILE,
++					       V4L2_MPEG_VIDEO_MPEG2_PROFILE_MAIN,
++					       ~(BIT(V4L2_MPEG_VIDEO_MPEG2_PROFILE_SIMPLE) |
++						 BIT(V4L2_MPEG_VIDEO_MPEG2_PROFILE_MAIN)),
++					       V4L2_MPEG_VIDEO_MPEG2_PROFILE_MAIN);
++			break;
++		case V4L2_PIX_FMT_MPEG4:
++			v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++					       V4L2_CID_MPEG_VIDEO_MPEG4_LEVEL,
++					       V4L2_MPEG_VIDEO_MPEG4_LEVEL_5,
++					       ~(BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_0) |
++						 BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_0B) |
++						 BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_1) |
++						 BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_2) |
++						 BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_3) |
++						 BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_3B) |
++						 BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_4) |
++						 BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_5)),
++					       V4L2_MPEG_VIDEO_MPEG4_LEVEL_4);
++			v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++					       V4L2_CID_MPEG_VIDEO_MPEG4_PROFILE,
++					       V4L2_MPEG_VIDEO_MPEG4_PROFILE_ADVANCED_SIMPLE,
++					       ~(BIT(V4L2_MPEG_VIDEO_MPEG4_PROFILE_SIMPLE) |
++						 BIT(V4L2_MPEG_VIDEO_MPEG4_PROFILE_ADVANCED_SIMPLE)),
++					       V4L2_MPEG_VIDEO_MPEG4_PROFILE_ADVANCED_SIMPLE);
++			break;
++		/* No profiles defined by V4L2 */
++		case V4L2_PIX_FMT_H263:
++		case V4L2_PIX_FMT_JPEG:
++		case V4L2_PIX_FMT_MJPEG:
++		case V4L2_PIX_FMT_VC1_ANNEX_G:
++		default:
++			break;
++		}
++	}
++}
++
+ /*
+  * File operations
+  */
+@@ -3334,11 +3417,12 @@ static int bcm2835_codec_open(struct fil
+ 	break;
+ 	case DECODE:
+ 	{
+-		v4l2_ctrl_handler_init(hdl, 1);
++		v4l2_ctrl_handler_init(hdl, 1 + dev->supported_fmts[0].num_entries * 2);
+ 
+ 		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
+ 				  V4L2_CID_MIN_BUFFERS_FOR_CAPTURE,
+ 				  1, 1, 1, 1);
++		dec_add_profile_ctrls(dev, hdl);
+ 		if (hdl->error) {
+ 			rc = hdl->error;
+ 			goto free_ctrl_handler;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0558-drm-vc4_plane-Add-support-for-YUV444-formats.patch b/target/linux/bcm27xx/patches-6.1/950-0558-drm-vc4_plane-Add-support-for-YUV444-formats.patch
new file mode 100644
index 00000000000000..e71d5ecd261f7c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0558-drm-vc4_plane-Add-support-for-YUV444-formats.patch
@@ -0,0 +1,53 @@
+From 18c4facfe095ee51ea193970bbe7826f86cbabf7 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Tue, 31 Jan 2023 15:14:32 +0000
+Subject: [PATCH] drm/vc4_plane: Add support for YUV444 formats
+
+Support displaying DRM_FORMAT_YUV444 and DRM_FORMAT_YVU444 formats.
+Tested with kmstest and kodi. e.g.
+
+kmstest -r 1920x1080@60 -f 400x300-YU24
+
+Note: without the shift of width, only half the chroma is fetched,
+resulting in correct left half of image and corrupt colours on right half.
+
+The increase in width shouldn't affect fetching of Y data,
+as the hardware will clamp at dest width.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -110,6 +110,18 @@ static const struct hvs_format {
+ 		.pixel_order_hvs5 = HVS_PIXEL_ORDER_XYCRCB,
+ 	},
+ 	{
++		.drm = DRM_FORMAT_YUV444,
++		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV422_3PLANE,
++		.pixel_order = HVS_PIXEL_ORDER_XYCBCR,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_XYCBCR,
++	},
++	{
++		.drm = DRM_FORMAT_YVU444,
++		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV422_3PLANE,
++		.pixel_order = HVS_PIXEL_ORDER_XYCRCB,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_XYCRCB,
++	},
++	{
+ 		.drm = DRM_FORMAT_YUV420,
+ 		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV420_3PLANE,
+ 		.pixel_order = HVS_PIXEL_ORDER_XYCBCR,
+@@ -1106,6 +1118,10 @@ static int vc4_plane_mode_set(struct drm
+ 	       vc4_state->src_y + vc4_state->src_h[0] < (state->fb->height << 16))
+ 		height++;
+ 
++	/* for YUV444 hardware wants double the width, otherwise it doesn't fetch full width of chroma */
++	if (format->drm == DRM_FORMAT_YUV444 || format->drm == DRM_FORMAT_YVU444)
++		width <<= 1;
++
+ 	/* Don't waste cycles mixing with plane alpha if the set alpha
+ 	 * is opaque or there is no per-pixel alpha information.
+ 	 * In any case we use the alpha property value as the fixed alpha.
diff --git a/target/linux/bcm27xx/patches-6.1/950-0559-drm-vc4-Calculate-bpc-based-on-max_requested_bpc.patch b/target/linux/bcm27xx/patches-6.1/950-0559-drm-vc4-Calculate-bpc-based-on-max_requested_bpc.patch
new file mode 100644
index 00000000000000..849b6911f2a934
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0559-drm-vc4-Calculate-bpc-based-on-max_requested_bpc.patch
@@ -0,0 +1,29 @@
+From c62902946e0ff3f3032c9fa1327924dd7de42abb Mon Sep 17 00:00:00 2001
+From: Matthias Reichl <hias@horus.com>
+Date: Sat, 14 Jan 2023 16:24:39 +0100
+Subject: [PATCH] drm/vc4: Calculate bpc based on max_requested_bpc
+
+This aligns vc4 with Intel, AMD and Synopsis drivers and fixes max bpc
+connector property not working as expected on monitors with YCbCr 4:2:2
+support but not deep color support.
+
+max_bpc in connector state is clamped at max_bpc from display info and
+the latter only takes deep color modes into account so it will always
+be 8, even if the display can do 4:2:2 12-bit output.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -2156,7 +2156,7 @@ vc4_hdmi_encoder_compute_config(const st
+ {
+ 	struct drm_device *dev = vc4_hdmi->connector.dev;
+ 	struct drm_connector_state *conn_state = &vc4_state->base;
+-	unsigned int max_bpc = clamp_t(unsigned int, conn_state->max_bpc, 8, 12);
++	unsigned int max_bpc = clamp_t(unsigned int, conn_state->max_requested_bpc, 8, 12);
+ 	unsigned int bpc;
+ 	int ret;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0560-media-dt-bindings-ak7375-Convert-to-DT-schema.patch b/target/linux/bcm27xx/patches-6.1/950-0560-media-dt-bindings-ak7375-Convert-to-DT-schema.patch
new file mode 100644
index 00000000000000..a740212aebd49b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0560-media-dt-bindings-ak7375-Convert-to-DT-schema.patch
@@ -0,0 +1,87 @@
+From cf1b98c1d99fcc779414f18a8f79b501260043c3 Mon Sep 17 00:00:00 2001
+From: Yassine Oudjana <y.oudjana@protonmail.com>
+Date: Fri, 9 Dec 2022 17:37:39 +0300
+Subject: [PATCH] media: dt-bindings: ak7375: Convert to DT schema
+
+commit 6d801f89ad7c485bbb14c0138d991beebd307aa6 upstream
+
+Convert DT bindings document for AKM AK7375 VCM to DT schema
+format and add an example.
+
+Signed-off-by: Yassine Oudjana <y.oudjana@protonmail.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Tested-by: Umang Jain <umang.jain@ideasonboard.com>
+---
+ .../devicetree/bindings/media/i2c/ak7375.txt  |  8 ----
+ .../media/i2c/asahi-kasei,ak7375.yaml         | 41 +++++++++++++++++++
+ MAINTAINERS                                   |  2 +-
+ 3 files changed, 42 insertions(+), 9 deletions(-)
+ delete mode 100644 Documentation/devicetree/bindings/media/i2c/ak7375.txt
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/asahi-kasei,ak7375.yaml
+
+--- a/Documentation/devicetree/bindings/media/i2c/ak7375.txt
++++ /dev/null
+@@ -1,8 +0,0 @@
+-Asahi Kasei Microdevices AK7375 voice coil lens driver
+-
+-AK7375 is a camera voice coil lens.
+-
+-Mandatory properties:
+-
+-- compatible: "asahi-kasei,ak7375"
+-- reg: I2C slave address
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/asahi-kasei,ak7375.yaml
+@@ -0,0 +1,41 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/media/i2c/asahi-kasei,ak7375.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Asahi Kasei Microdevices AK7375 voice coil lens actuator
++
++maintainers:
++  - Tianshu Qiu <tian.shu.qiu@intel.com>
++
++description:
++  AK7375 is a voice coil motor (VCM) camera lens actuator that
++  is controlled over I2C.
++
++properties:
++  compatible:
++    const: asahi-kasei,ak7375
++
++  reg:
++    maxItems: 1
++
++required:
++  - compatible
++  - reg
++
++additionalProperties: false
++
++examples:
++  - |
++    i2c {
++        #address-cells = <1>;
++        #size-cells = <0>;
++
++        ak7375: camera-lens@c {
++            compatible = "asahi-kasei,ak7375";
++            reg = <0x0c>;
++        };
++    };
++
++...
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -3173,7 +3173,7 @@ M:	Tianshu Qiu <tian.shu.qiu@intel.com>
+ L:	linux-media@vger.kernel.org
+ S:	Maintained
+ T:	git git://linuxtv.org/media_tree.git
+-F:	Documentation/devicetree/bindings/media/i2c/ak7375.txt
++F:	Documentation/devicetree/bindings/media/i2c/asahi-kasei,ak7375.yaml
+ F:	drivers/media/i2c/ak7375.c
+ 
+ ASAHI KASEI AK8974 DRIVER
diff --git a/target/linux/bcm27xx/patches-6.1/950-0561-media-dt-bindings-ak7375-Add-supplies.patch b/target/linux/bcm27xx/patches-6.1/950-0561-media-dt-bindings-ak7375-Add-supplies.patch
new file mode 100644
index 00000000000000..d8fd6141813c11
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0561-media-dt-bindings-ak7375-Add-supplies.patch
@@ -0,0 +1,47 @@
+From b076677ea22db8ceb66aa168c82c9c160dc1a9f1 Mon Sep 17 00:00:00 2001
+From: Yassine Oudjana <y.oudjana@protonmail.com>
+Date: Fri, 9 Dec 2022 17:37:40 +0300
+Subject: [PATCH] media: dt-bindings: ak7375: Add supplies
+
+commit 04a79f078329b14f260db15250e84c97022f42cd upstream
+
+Add supply properties to describe regulators needed to power
+the AK7375 VCM.
+
+Signed-off-by: Yassine Oudjana <y.oudjana@protonmail.com>
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Tested-by: Umang Jain <umang.jain@ideasonboard.com>
+---
+ .../bindings/media/i2c/asahi-kasei,ak7375.yaml        | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/Documentation/devicetree/bindings/media/i2c/asahi-kasei,ak7375.yaml
++++ b/Documentation/devicetree/bindings/media/i2c/asahi-kasei,ak7375.yaml
+@@ -20,9 +20,17 @@ properties:
+   reg:
+     maxItems: 1
+ 
++  vdd-supply:
++    description: VDD supply
++
++  vio-supply:
++    description: I/O pull-up supply
++
+ required:
+   - compatible
+   - reg
++  - vdd-supply
++  - vio-supply
+ 
+ additionalProperties: false
+ 
+@@ -35,6 +43,9 @@ examples:
+         ak7375: camera-lens@c {
+             compatible = "asahi-kasei,ak7375";
+             reg = <0x0c>;
++
++            vdd-supply = <&vreg_l23a_2p8>;
++            vio-supply = <&vreg_lvs1a_1p8>;
+         };
+     };
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0562-media-i2c-ak7375-Add-regulator-management.patch b/target/linux/bcm27xx/patches-6.1/950-0562-media-i2c-ak7375-Add-regulator-management.patch
new file mode 100644
index 00000000000000..55d276dbc0ba3e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0562-media-i2c-ak7375-Add-regulator-management.patch
@@ -0,0 +1,108 @@
+From 159ef6a1740ded1bfd542bab7d69208cf0865814 Mon Sep 17 00:00:00 2001
+From: Yassine Oudjana <y.oudjana@protonmail.com>
+Date: Fri, 9 Dec 2022 17:37:41 +0300
+Subject: [PATCH] media: i2c: ak7375: Add regulator management
+
+commit 90f7e76eac50c1ae54a445abc6a286837ade46cf upstream
+
+Make the driver get needed regulators on probe and enable/disable
+them on runtime PM callbacks.
+
+Signed-off-by: Yassine Oudjana <y.oudjana@protonmail.com>
+Tested-by: Umang Jain <umang.jain@ideasonboard.com>
+---
+ drivers/media/i2c/ak7375.c | 38 ++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 38 insertions(+)
+
+--- a/drivers/media/i2c/ak7375.c
++++ b/drivers/media/i2c/ak7375.c
+@@ -6,6 +6,7 @@
+ #include <linux/i2c.h>
+ #include <linux/module.h>
+ #include <linux/pm_runtime.h>
++#include <linux/regulator/consumer.h>
+ #include <media/v4l2-ctrls.h>
+ #include <media/v4l2-device.h>
+ 
+@@ -23,17 +24,29 @@
+  */
+ #define AK7375_CTRL_STEPS	64
+ #define AK7375_CTRL_DELAY_US	1000
++/*
++ * The vcm may take up 10 ms (tDELAY) to power on and start taking
++ * I2C messages. Based on AK7371 datasheet.
++ */
++#define AK7375_POWER_DELAY_US	10000
+ 
+ #define AK7375_REG_POSITION	0x0
+ #define AK7375_REG_CONT		0x2
+ #define AK7375_MODE_ACTIVE	0x0
+ #define AK7375_MODE_STANDBY	0x40
+ 
++static const char * const ak7375_supply_names[] = {
++	"vdd",
++	"vio",
++};
++
+ /* ak7375 device structure */
+ struct ak7375_device {
+ 	struct v4l2_ctrl_handler ctrls_vcm;
+ 	struct v4l2_subdev sd;
+ 	struct v4l2_ctrl *focus;
++	struct regulator_bulk_data supplies[ARRAY_SIZE(ak7375_supply_names)];
++
+ 	/* active or standby mode */
+ 	bool active;
+ };
+@@ -133,12 +146,24 @@ static int ak7375_probe(struct i2c_clien
+ {
+ 	struct ak7375_device *ak7375_dev;
+ 	int ret;
++	unsigned int i;
+ 
+ 	ak7375_dev = devm_kzalloc(&client->dev, sizeof(*ak7375_dev),
+ 				  GFP_KERNEL);
+ 	if (!ak7375_dev)
+ 		return -ENOMEM;
+ 
++	for (i = 0; i < ARRAY_SIZE(ak7375_supply_names); i++)
++		ak7375_dev->supplies[i].supply = ak7375_supply_names[i];
++
++	ret = devm_regulator_bulk_get(&client->dev,
++				      ARRAY_SIZE(ak7375_supply_names),
++				      ak7375_dev->supplies);
++	if (ret) {
++		dev_err_probe(&client->dev, ret, "Failed to get regulators\n");
++		return ret;
++	}
++
+ 	v4l2_i2c_subdev_init(&ak7375_dev->sd, client, &ak7375_ops);
+ 	ak7375_dev->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
+ 	ak7375_dev->sd.internal_ops = &ak7375_int_ops;
+@@ -208,6 +233,11 @@ static int __maybe_unused ak7375_vcm_sus
+ 	if (ret)
+ 		dev_err(dev, "%s I2C failure: %d\n", __func__, ret);
+ 
++	ret = regulator_bulk_disable(ARRAY_SIZE(ak7375_supply_names),
++				     ak7375_dev->supplies);
++	if (ret)
++		return ret;
++
+ 	ak7375_dev->active = false;
+ 
+ 	return 0;
+@@ -228,6 +258,14 @@ static int __maybe_unused ak7375_vcm_res
+ 	if (ak7375_dev->active)
+ 		return 0;
+ 
++	ret = regulator_bulk_enable(ARRAY_SIZE(ak7375_supply_names),
++				    ak7375_dev->supplies);
++	if (ret)
++		return ret;
++
++	/* Wait for vcm to become ready */
++	usleep_range(AK7375_POWER_DELAY_US, AK7375_POWER_DELAY_US + 500);
++
+ 	ret = ak7375_i2c_write(ak7375_dev, AK7375_REG_CONT,
+ 		AK7375_MODE_ACTIVE, 1);
+ 	if (ret) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0563-dtoverlays-Add-VCM-option-to-imx519.patch b/target/linux/bcm27xx/patches-6.1/950-0563-dtoverlays-Add-VCM-option-to-imx519.patch
new file mode 100644
index 00000000000000..92439d348dcde0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0563-dtoverlays-Add-VCM-option-to-imx519.patch
@@ -0,0 +1,151 @@
+From 0c0ce98b6c48ffd63690e17872c82a6ea4e08fbf Mon Sep 17 00:00:00 2001
+From: Lee Jackson <info@arducam.com>
+Date: Mon, 20 Feb 2023 10:25:33 +0800
+Subject: [PATCH] dtoverlays: Add VCM option to imx519
+
+VCM is enabled by default, but you can use 'vcm=off' to disable VCM support.
+
+Signed-off-by: Lee Jackson <lee.jackson@arducam.com>
+---
+ arch/arm/boot/dts/overlays/README             |  2 +
+ arch/arm/boot/dts/overlays/imx519-overlay.dts | 61 +++++++++----------
+ arch/arm/boot/dts/overlays/imx519.dtsi        | 34 +++++++++++
+ 3 files changed, 65 insertions(+), 32 deletions(-)
+ create mode 100644 arch/arm/boot/dts/overlays/imx519.dtsi
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -2384,6 +2384,8 @@ Params: rotation                Mounting
+                                 configuring the sensor (default on)
+         cam0                    Adopt the default configuration for CAM0 on a
+                                 Compute Module (CSI0, i2c_vc, and cam0_reg).
++        vcm                     Select lens driver state. Default is enabled,
++                                but vcm=off will disable.
+ 
+ 
+ Name:   imx708
+--- a/arch/arm/boot/dts/overlays/imx519-overlay.dts
++++ b/arch/arm/boot/dts/overlays/imx519-overlay.dts
+@@ -15,32 +15,7 @@
+ 			#size-cells = <0>;
+ 			status = "okay";
+ 
+-			imx519: imx519@1a {
+-				compatible = "sony,imx519";
+-				reg = <0x1a>;
+-				status = "okay";
+-
+-				clocks = <&cam1_clk>;
+-				clock-names = "xclk";
+-
+-				VANA-supply = <&cam1_reg>;	/* 2.8v */
+-				VDIG-supply = <&cam_dummy_reg>;	/* 1.8v */
+-				VDDL-supply = <&cam_dummy_reg>;	/* 1.2v */
+-
+-				rotation = <0>;
+-				orientation = <2>;
+-
+-				port {
+-					imx519_0: endpoint {
+-						remote-endpoint = <&csi1_ep>;
+-						clock-lanes = <0>;
+-						data-lanes = <1 2>;
+-						clock-noncontinuous;
+-						link-frequencies =
+-							/bits/ 64 <493500000>;
+-					};
+-				};
+-			};
++			#include "imx519.dtsi"
+ 		};
+ 	};
+ 
+@@ -51,8 +26,8 @@
+ 			brcm,media-controller;
+ 
+ 			port{
+-				csi1_ep: endpoint{
+-					remote-endpoint = <&imx519_0>;
++				csi_ep: endpoint{
++					remote-endpoint = <&cam_endpoint>;
+ 					clock-lanes = <0>;
+ 					data-lanes = <1 2>;
+ 					clock-noncontinuous;
+@@ -83,14 +58,36 @@
+ 		};
+ 	};
+ 
++	fragment@5 {
++		target = <&cam_node>;
++		__overlay__ {
++			lens-focus = <&vcm_node>;
++		};
++	};
++
+ 	__overrides__ {
+-		rotation = <&imx519>,"rotation:0";
+-		orientation = <&imx519>,"orientation:0";
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
+ 		media-controller = <&csi>,"brcm,media-controller?";
+ 		cam0 = <&i2c_frag>, "target:0=",<&i2c_vc>,
+ 		       <&csi_frag>, "target:0=",<&csi0>,
+ 		       <&clk_frag>, "target:0=",<&cam0_clk>,
+-		       <&imx519>, "clocks:0=",<&cam0_clk>,
+-		       <&imx519>, "VANA-supply:0=",<&cam0_reg>;
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "VANA-supply:0=",<&cam0_reg>,
++		       <&vcm_node>, "vdd-supply:0=",<&cam0_reg>;
++		vcm = <&vcm_node>, "status",
++		      <0>, "=5";
+ 	};
+ };
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
++
++&vcm_node {
++	status = "okay";
++};
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx519.dtsi
+@@ -0,0 +1,34 @@
++// Fragment that configures a Sony IMX519
++
++cam_node: imx519@1a {
++	compatible = "sony,imx519";
++	reg = <0x1a>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "xclk";
++
++	VANA-supply = <&cam1_reg>;	/* 2.8v */
++	VDIG-supply = <&cam_dummy_reg>;	/* 1.8v */
++	VDDL-supply = <&cam_dummy_reg>;	/* 1.2v */
++
++	rotation = <0>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			data-lanes = <1 2>;
++			clock-noncontinuous;
++			link-frequencies =
++				/bits/ 64 <493500000>;
++		};
++	};
++};
++
++vcm_node: ak7375@c {
++	compatible = "asahi-kasei,ak7375";
++	reg = <0x0c>;
++	status = "disabled";
++	vdd-supply = <&cam1_reg>;
++};
diff --git a/target/linux/bcm27xx/patches-6.1/950-0564-dtoverlays-Add-IMX519-support-to-camera-mux-overlays.patch b/target/linux/bcm27xx/patches-6.1/950-0564-dtoverlays-Add-IMX519-support-to-camera-mux-overlays.patch
new file mode 100644
index 00000000000000..2b551e60a91e98
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0564-dtoverlays-Add-IMX519-support-to-camera-mux-overlays.patch
@@ -0,0 +1,246 @@
+From 5e2246c5ac556309546fc603fd7a17f8b143b566 Mon Sep 17 00:00:00 2001
+From: Lee Jackson <info@arducam.com>
+Date: Fri, 24 Feb 2023 08:33:34 +0800
+Subject: [PATCH] dtoverlays: Add IMX519 support to camera mux overlays
+
+Signed-off-by: Lee Jackson <lee.jackson@arducam.com>
+---
+ arch/arm/boot/dts/overlays/README             |  6 ++
+ .../dts/overlays/camera-mux-2port-overlay.dts | 32 ++++++++++
+ .../dts/overlays/camera-mux-4port-overlay.dts | 64 +++++++++++++++++++
+ 3 files changed, 102 insertions(+)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -716,6 +716,7 @@ Params: cam0-imx219             Select I
+         cam0-imx258             Select IMX258 for camera on port 0
+         cam0-imx290             Select IMX290 for camera on port 0
+         cam0-imx477             Select IMX477 for camera on port 0
++        cam0-imx519             Select IMX519 for camera on port 0
+         cam0-imx708             Select IMX708 for camera on port 0
+         cam0-ov2311             Select OV2311 for camera on port 0
+         cam0-ov5647             Select OV5647 for camera on port 0
+@@ -726,6 +727,7 @@ Params: cam0-imx219             Select I
+         cam1-imx258             Select IMX258 for camera on port 1
+         cam1-imx290             Select IMX290 for camera on port 1
+         cam1-imx477             Select IMX477 for camera on port 1
++        cam1-imx519             Select IMX519 for camera on port 1
+         cam1-imx708             Select IMX708 for camera on port 1
+         cam1-ov2311             Select OV2311 for camera on port 1
+         cam1-ov5647             Select OV5647 for camera on port 1
+@@ -743,6 +745,7 @@ Params: cam0-imx219             Select I
+         cam0-imx258             Select IMX258 for camera on port 0
+         cam0-imx290             Select IMX290 for camera on port 0
+         cam0-imx477             Select IMX477 for camera on port 0
++        cam0-imx519             Select IMX519 for camera on port 0
+         cam0-imx708             Select IMX708 for camera on port 0
+         cam0-ov2311             Select OV2311 for camera on port 0
+         cam0-ov5647             Select OV5647 for camera on port 0
+@@ -753,6 +756,7 @@ Params: cam0-imx219             Select I
+         cam1-imx258             Select IMX258 for camera on port 1
+         cam1-imx290             Select IMX290 for camera on port 1
+         cam1-imx477             Select IMX477 for camera on port 1
++        cam1-imx519             Select IMX519 for camera on port 1
+         cam1-imx708             Select IMX708 for camera on port 1
+         cam1-ov2311             Select OV2311 for camera on port 1
+         cam1-ov5647             Select OV5647 for camera on port 1
+@@ -763,6 +767,7 @@ Params: cam0-imx219             Select I
+         cam2-imx258             Select IMX258 for camera on port 2
+         cam2-imx290             Select IMX290 for camera on port 2
+         cam2-imx477             Select IMX477 for camera on port 2
++        cam2-imx519             Select IMX519 for camera on port 2
+         cam2-imx708             Select IMX708 for camera on port 2
+         cam2-ov2311             Select OV2311 for camera on port 2
+         cam2-ov5647             Select OV5647 for camera on port 2
+@@ -773,6 +778,7 @@ Params: cam0-imx219             Select I
+         cam3-imx258             Select IMX258 for camera on port 3
+         cam3-imx290             Select IMX290 for camera on port 3
+         cam3-imx477             Select IMX477 for camera on port 3
++        cam3-imx519             Select IMX519 for camera on port 3
+         cam3-imx708             Select IMX708 for camera on port 3
+         cam3-ov2311             Select OV2311 for camera on port 3
+         cam3-ov5647             Select OV5647 for camera on port 3
+--- a/arch/arm/boot/dts/overlays/camera-mux-2port-overlay.dts
++++ b/arch/arm/boot/dts/overlays/camera-mux-2port-overlay.dts
+@@ -112,6 +112,16 @@
+ 					#undef cam_endpoint
+ 					#undef cam1_clk
+ 
++					#define cam_node imx519_0
++					#define cam_endpoint imx519_0_ep
++					#define vcm_node imx519_0_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx519.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
+ 					#define cam_node imx708_0
+ 					#define cam_endpoint imx708_0_ep
+ 					#define vcm_node imx708_0_vcm
+@@ -192,6 +202,16 @@
+ 					#undef cam_endpoint
+ 					#undef cam1_clk
+ 
++					#define cam_node imx519_1
++					#define cam_endpoint imx519_1_ep
++					#define vcm_node imx519_1_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx519.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
+ 					#define cam_node imx708_1
+ 					#define cam_endpoint imx708_1_ep
+ 					#define vcm_node imx708_1_vcm
+@@ -373,6 +393,12 @@
+ 			      <&imx477_0_ep>, "remote-endpoint:0=",<&mux_in0>,
+ 			      <&mux_in0>, "clock-noncontinuous?",
+ 			      <&imx477_0>, "status=okay";
++		cam0-imx519 = <&mux_in0>, "remote-endpoint:0=",<&imx519_0_ep>,
++			      <&imx519_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&mux_in0>, "clock-noncontinuous?",
++			      <&imx519_0>, "status=okay",
++				  <&imx519_0_vcm>, "status=okay",
++			      <&imx519_0>,"lens-focus:0=", <&imx519_0_vcm>;
+ 		cam0-imx708 = <&mux_in0>, "remote-endpoint:0=",<&imx708_0_ep>,
+ 			      <&imx708_0_ep>, "remote-endpoint:0=",<&mux_in0>,
+ 			      <&mux_in0>, "clock-noncontinuous?",
+@@ -407,6 +433,12 @@
+ 			      <&imx477_1_ep>, "remote-endpoint:0=",<&mux_in1>,
+ 			      <&mux_in1>, "clock-noncontinuous?",
+ 			      <&imx477_1>, "status=okay";
++		cam1-imx519 = <&mux_in1>, "remote-endpoint:0=",<&imx519_1_ep>,
++			      <&imx519_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&mux_in1>, "clock-noncontinuous?",
++			      <&imx519_1>, "status=okay",
++			      <&imx519_1_vcm>, "status=okay",
++			      <&imx519_1>,"lens-focus:0=", <&imx519_1_vcm>;
+ 		cam1-imx708 = <&mux_in1>, "remote-endpoint:0=",<&imx708_1_ep>,
+ 			      <&imx708_1_ep>, "remote-endpoint:0=",<&mux_in1>,
+ 			      <&mux_in1>, "clock-noncontinuous?",
+--- a/arch/arm/boot/dts/overlays/camera-mux-4port-overlay.dts
++++ b/arch/arm/boot/dts/overlays/camera-mux-4port-overlay.dts
+@@ -170,6 +170,16 @@
+ 					#undef cam_endpoint
+ 					#undef cam1_clk
+ 
++					#define cam_node imx519_0
++					#define cam_endpoint imx519_0_ep
++					#define vcm_node imx519_0_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx519.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
+ 					#define cam_node imx708_0
+ 					#define cam_endpoint imx708_0_ep
+ 					#define vcm_node imx708_0_vcm
+@@ -250,6 +260,16 @@
+ 					#undef cam_endpoint
+ 					#undef cam1_clk
+ 
++					#define cam_node imx519_1
++					#define cam_endpoint imx519_1_ep
++					#define vcm_node imx519_1_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx519.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
+ 					#define cam_node imx708_1
+ 					#define cam_endpoint imx708_1_ep
+ 					#define vcm_node imx708_1_vcm
+@@ -330,6 +350,16 @@
+ 					#undef cam_endpoint
+ 					#undef cam1_clk
+ 
++					#define cam_node imx519_2
++					#define cam_endpoint imx519_2_ep
++					#define vcm_node imx519_2_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx519.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
+ 					#define cam_node imx708_2
+ 					#define cam_endpoint imx708_2_ep
+ 					#define vcm_node imx708_2_vcm
+@@ -410,6 +440,16 @@
+ 					#undef cam_endpoint
+ 					#undef cam1_clk
+ 
++					#define cam_node imx519_3
++					#define cam_endpoint imx519_3_ep
++					#define vcm_node imx519_3_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx519.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
+ 					#define cam_node imx708_3
+ 					#define cam_endpoint imx708_3_ep
+ 					#define vcm_node imx708_3_vcm
+@@ -608,6 +648,12 @@
+ 			      <&imx477_0_ep>, "remote-endpoint:0=",<&mux_in0>,
+ 			      <&mux_in0>, "clock-noncontinuous?",
+ 			      <&imx477_0>, "status=okay";
++		cam0-imx519 = <&mux_in0>, "remote-endpoint:0=",<&imx519_0_ep>,
++			      <&imx519_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&mux_in0>, "clock-noncontinuous?",
++			      <&imx519_0>, "status=okay",
++			      <&imx519_0_vcm>, "status=okay",
++			      <&imx519_0>,"lens-focus:0=", <&imx519_0_vcm>;
+ 		cam0-imx708 = <&mux_in0>, "remote-endpoint:0=",<&imx708_0_ep>,
+ 			      <&imx708_0_ep>, "remote-endpoint:0=",<&mux_in0>,
+ 			      <&mux_in0>, "clock-noncontinuous?",
+@@ -642,6 +688,12 @@
+ 			      <&imx477_1_ep>, "remote-endpoint:0=",<&mux_in1>,
+ 			      <&mux_in1>, "clock-noncontinuous?",
+ 			      <&imx477_1>, "status=okay";
++		cam1-imx519 = <&mux_in1>, "remote-endpoint:0=",<&imx519_1_ep>,
++			      <&imx519_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&mux_in1>, "clock-noncontinuous?",
++			      <&imx519_1>, "status=okay",
++			      <&imx519_1_vcm>, "status=okay",
++			      <&imx519_1>,"lens-focus:0=", <&imx519_1_vcm>;
+ 		cam1-imx708 = <&mux_in1>, "remote-endpoint:0=",<&imx708_1_ep>,
+ 			      <&imx708_1_ep>, "remote-endpoint:0=",<&mux_in1>,
+ 			      <&mux_in1>, "clock-noncontinuous?",
+@@ -676,6 +728,12 @@
+ 			      <&imx477_2_ep>, "remote-endpoint:0=",<&mux_in2>,
+ 			      <&mux_in2>, "clock-noncontinuous?",
+ 			      <&imx477_2>, "status=okay";
++		cam2-imx519 = <&mux_in2>, "remote-endpoint:0=",<&imx519_2_ep>,
++			      <&imx519_2_ep>, "remote-endpoint:0=",<&mux_in2>,
++			      <&mux_in2>, "clock-noncontinuous?",
++			      <&imx519_2>, "status=okay",
++			      <&imx519_2_vcm>, "status=okay",
++			      <&imx519_2>,"lens-focus:0=", <&imx519_2_vcm>;
+ 		cam2-imx708 = <&mux_in2>, "remote-endpoint:0=",<&imx708_2_ep>,
+ 			      <&imx708_2_ep>, "remote-endpoint:0=",<&mux_in2>,
+ 			      <&mux_in2>, "clock-noncontinuous?",
+@@ -710,6 +768,12 @@
+ 			      <&imx477_3_ep>, "remote-endpoint:0=",<&mux_in3>,
+ 			      <&mux_in3>, "clock-noncontinuous?",
+ 			      <&imx477_3>, "status=okay";
++		cam3-imx519 = <&mux_in3>, "remote-endpoint:0=",<&imx519_3_ep>,
++			      <&imx519_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++			      <&mux_in3>, "clock-noncontinuous?",
++			      <&imx519_3>, "status=okay",
++			      <&imx519_3_vcm>, "status=okay",
++			      <&imx519_3>,"lens-focus:0=", <&imx519_3_vcm>;
+ 		cam3-imx708 = <&mux_in3>, "remote-endpoint:0=",<&imx708_3_ep>,
+ 			      <&imx708_3_ep>, "remote-endpoint:0=",<&mux_in3>,
+ 			      <&mux_in3>, "clock-noncontinuous?",
diff --git a/target/linux/bcm27xx/patches-6.1/950-0565-vc04_services-bcm2835_codec-Ignore-READ_ONLY-ctrls-i.patch b/target/linux/bcm27xx/patches-6.1/950-0565-vc04_services-bcm2835_codec-Ignore-READ_ONLY-ctrls-i.patch
new file mode 100644
index 00000000000000..d1968b0b77c563
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0565-vc04_services-bcm2835_codec-Ignore-READ_ONLY-ctrls-i.patch
@@ -0,0 +1,181 @@
+From 3ad45d26aba6f69f82220f59824b4d8422b2b220 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 14 Feb 2023 15:35:43 +0000
+Subject: [PATCH] vc04_services: bcm2835_codec: Ignore READ_ONLY ctrls
+ in s_ctrl
+
+In adding the MPEG2/MPEG4/H264 level and profile controls to
+the decoder, they weren't declared as read-only, nor handlers
+added to bcm2835_codec_s_ctrl. That resulted in an error message
+"Invalid control" being logged every time v4l2_ctrl_handler_setup
+was called from bcm2835_codec_create_component.
+
+Define those controls as read only, and exit early from s_ctrl
+on read only controls.
+
+Fixes: "media: bcm2835-v4l2-codec: Add profile & level ctrls to decode"
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../bcm2835-codec/bcm2835-v4l2-codec.c        | 127 ++++++++++--------
+ 1 file changed, 68 insertions(+), 59 deletions(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
++++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+@@ -2224,6 +2224,9 @@ static int bcm2835_codec_s_ctrl(struct v
+ 		container_of(ctrl->handler, struct bcm2835_codec_ctx, hdl);
+ 	int ret = 0;
+ 
++	if (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY)
++		return 0;
++
+ 	switch (ctrl->id) {
+ 	case V4L2_CID_MPEG_VIDEO_BITRATE:
+ 		ctx->bitrate = ctrl->val;
+@@ -2376,7 +2379,7 @@ static int bcm2835_codec_s_ctrl(struct v
+ 		break;
+ 
+ 	default:
+-		v4l2_err(&ctx->dev->v4l2_dev, "Invalid control\n");
++		v4l2_err(&ctx->dev->v4l2_dev, "Invalid control %08x\n", ctrl->id);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -3198,74 +3201,80 @@ static int queue_init(void *priv, struct
+ static void dec_add_profile_ctrls(struct bcm2835_codec_dev *const dev,
+ 				  struct v4l2_ctrl_handler *const hdl)
+ {
++	struct v4l2_ctrl *ctrl;
+ 	unsigned int i;
+ 	const struct bcm2835_codec_fmt_list *const list = &dev->supported_fmts[0];
+ 
+ 	for (i = 0; i < list->num_entries; ++i) {
+ 		switch (list->list[i].fourcc) {
+ 		case V4L2_PIX_FMT_H264:
+-			v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
+-					       V4L2_CID_MPEG_VIDEO_H264_LEVEL,
+-					       V4L2_MPEG_VIDEO_H264_LEVEL_4_2,
+-					       ~(BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_0) |
+-						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1B) |
+-						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_1) |
+-						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_2) |
+-						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_3) |
+-						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_0) |
+-						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_1) |
+-						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_2) |
+-						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
+-						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
+-						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
+-						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0) |
+-						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_1) |
+-						 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_2)),
+-					       V4L2_MPEG_VIDEO_H264_LEVEL_4_0);
+-			v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
+-					       V4L2_CID_MPEG_VIDEO_H264_PROFILE,
+-					       V4L2_MPEG_VIDEO_H264_PROFILE_HIGH,
+-					       ~(BIT(V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE) |
+-						 BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE) |
+-						 BIT(V4L2_MPEG_VIDEO_H264_PROFILE_MAIN) |
+-						 BIT(V4L2_MPEG_VIDEO_H264_PROFILE_HIGH)),
+-						V4L2_MPEG_VIDEO_H264_PROFILE_HIGH);
++			ctrl = v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++						      V4L2_CID_MPEG_VIDEO_H264_LEVEL,
++						      V4L2_MPEG_VIDEO_H264_LEVEL_4_2,
++						      ~(BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_0) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1B) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_1) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_2) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_3) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_0) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_1) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_2) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_1) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_2)),
++						       V4L2_MPEG_VIDEO_H264_LEVEL_4_0);
++			ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++			ctrl = v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++						      V4L2_CID_MPEG_VIDEO_H264_PROFILE,
++						      V4L2_MPEG_VIDEO_H264_PROFILE_HIGH,
++						      ~(BIT(V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE) |
++							BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE) |
++							BIT(V4L2_MPEG_VIDEO_H264_PROFILE_MAIN) |
++							BIT(V4L2_MPEG_VIDEO_H264_PROFILE_HIGH)),
++						       V4L2_MPEG_VIDEO_H264_PROFILE_HIGH);
++			ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+ 			break;
+ 		case V4L2_PIX_FMT_MPEG2:
+-			v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
+-					       V4L2_CID_MPEG_VIDEO_MPEG2_LEVEL,
+-					       V4L2_MPEG_VIDEO_MPEG2_LEVEL_HIGH,
+-					       ~(BIT(V4L2_MPEG_VIDEO_MPEG2_LEVEL_LOW) |
+-						 BIT(V4L2_MPEG_VIDEO_MPEG2_LEVEL_MAIN) |
+-						 BIT(V4L2_MPEG_VIDEO_MPEG2_LEVEL_HIGH_1440) |
+-						 BIT(V4L2_MPEG_VIDEO_MPEG2_LEVEL_HIGH)),
+-					       V4L2_MPEG_VIDEO_MPEG2_LEVEL_MAIN);
+-			v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
+-					       V4L2_CID_MPEG_VIDEO_MPEG2_PROFILE,
+-					       V4L2_MPEG_VIDEO_MPEG2_PROFILE_MAIN,
+-					       ~(BIT(V4L2_MPEG_VIDEO_MPEG2_PROFILE_SIMPLE) |
+-						 BIT(V4L2_MPEG_VIDEO_MPEG2_PROFILE_MAIN)),
+-					       V4L2_MPEG_VIDEO_MPEG2_PROFILE_MAIN);
++			ctrl = v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++						      V4L2_CID_MPEG_VIDEO_MPEG2_LEVEL,
++						      V4L2_MPEG_VIDEO_MPEG2_LEVEL_HIGH,
++						      ~(BIT(V4L2_MPEG_VIDEO_MPEG2_LEVEL_LOW) |
++							BIT(V4L2_MPEG_VIDEO_MPEG2_LEVEL_MAIN) |
++							BIT(V4L2_MPEG_VIDEO_MPEG2_LEVEL_HIGH_1440) |
++							BIT(V4L2_MPEG_VIDEO_MPEG2_LEVEL_HIGH)),
++						      V4L2_MPEG_VIDEO_MPEG2_LEVEL_MAIN);
++			ctrl = v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++						      V4L2_CID_MPEG_VIDEO_MPEG2_PROFILE,
++						      V4L2_MPEG_VIDEO_MPEG2_PROFILE_MAIN,
++						      ~(BIT(V4L2_MPEG_VIDEO_MPEG2_PROFILE_SIMPLE) |
++							BIT(V4L2_MPEG_VIDEO_MPEG2_PROFILE_MAIN)),
++						      V4L2_MPEG_VIDEO_MPEG2_PROFILE_MAIN);
++			ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+ 			break;
+ 		case V4L2_PIX_FMT_MPEG4:
+-			v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
+-					       V4L2_CID_MPEG_VIDEO_MPEG4_LEVEL,
+-					       V4L2_MPEG_VIDEO_MPEG4_LEVEL_5,
+-					       ~(BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_0) |
+-						 BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_0B) |
+-						 BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_1) |
+-						 BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_2) |
+-						 BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_3) |
+-						 BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_3B) |
+-						 BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_4) |
+-						 BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_5)),
+-					       V4L2_MPEG_VIDEO_MPEG4_LEVEL_4);
+-			v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
+-					       V4L2_CID_MPEG_VIDEO_MPEG4_PROFILE,
+-					       V4L2_MPEG_VIDEO_MPEG4_PROFILE_ADVANCED_SIMPLE,
+-					       ~(BIT(V4L2_MPEG_VIDEO_MPEG4_PROFILE_SIMPLE) |
+-						 BIT(V4L2_MPEG_VIDEO_MPEG4_PROFILE_ADVANCED_SIMPLE)),
+-					       V4L2_MPEG_VIDEO_MPEG4_PROFILE_ADVANCED_SIMPLE);
++			ctrl = v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++						      V4L2_CID_MPEG_VIDEO_MPEG4_LEVEL,
++						      V4L2_MPEG_VIDEO_MPEG4_LEVEL_5,
++						      ~(BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_0) |
++							BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_0B) |
++							BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_1) |
++							BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_2) |
++							BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_3) |
++							BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_3B) |
++							BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_4) |
++							BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_5)),
++						      V4L2_MPEG_VIDEO_MPEG4_LEVEL_4);
++			ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++			ctrl = v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++						      V4L2_CID_MPEG_VIDEO_MPEG4_PROFILE,
++						      V4L2_MPEG_VIDEO_MPEG4_PROFILE_ADVANCED_SIMPLE,
++						      ~(BIT(V4L2_MPEG_VIDEO_MPEG4_PROFILE_SIMPLE) |
++							BIT(V4L2_MPEG_VIDEO_MPEG4_PROFILE_ADVANCED_SIMPLE)),
++						      V4L2_MPEG_VIDEO_MPEG4_PROFILE_ADVANCED_SIMPLE);
++			ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+ 			break;
+ 		/* No profiles defined by V4L2 */
+ 		case V4L2_PIX_FMT_H263:
diff --git a/target/linux/bcm27xx/patches-6.1/950-0566-ASoC-bcm-Fix-Rpi-PROTO-and-audioinjector.net-Pi.patch b/target/linux/bcm27xx/patches-6.1/950-0566-ASoC-bcm-Fix-Rpi-PROTO-and-audioinjector.net-Pi.patch
new file mode 100644
index 00000000000000..4a8d9eaf90fe1f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0566-ASoC-bcm-Fix-Rpi-PROTO-and-audioinjector.net-Pi.patch
@@ -0,0 +1,36 @@
+From 686855c2e6dcd6d802570e51dae19e95b78d2630 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 28 Feb 2023 14:15:42 +0000
+Subject: [PATCH] ASoC: bcm: Fix Rpi-PROTO and audioinjector.net Pi
+
+As of kernel 5.19 the WM8731 driver has separate I2C and SPI support
+modules. Change the Kconfig definitions for the audioinjector.net Pi
+and Rpi-PROTO soundcards to select SND_SOC_WM8731_I2C.
+
+See: https://github.com/raspberrypi/linux/issues/5364
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ sound/soc/bcm/Kconfig | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/bcm/Kconfig
++++ b/sound/soc/bcm/Kconfig
+@@ -135,7 +135,7 @@ config SND_BCM2708_SOC_RPI_DAC
+ config SND_BCM2708_SOC_RPI_PROTO
+ 	tristate "Support for Rpi-PROTO"
+ 	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+-	select SND_SOC_WM8731
++	select SND_SOC_WM8731_I2C
+ 	help
+ 	  Say Y or M if you want to add support for Audio Codec Board PROTO (WM8731).
+ 
+@@ -206,7 +206,7 @@ config SND_BCM2708_SOC_ADAU1977_ADC
+ config SND_AUDIOINJECTOR_PI_SOUNDCARD
+ 	tristate "Support for audioinjector.net Pi add on soundcard"
+ 	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+-	select SND_SOC_WM8731
++	select SND_SOC_WM8731_I2C
+ 	help
+ 	  Say Y or M if you want to add support for audioinjector.net Pi Hat
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0567-dtoverlays-Add-VCM-option-to-Arducam64MP.patch b/target/linux/bcm27xx/patches-6.1/950-0567-dtoverlays-Add-VCM-option-to-Arducam64MP.patch
new file mode 100644
index 00000000000000..14051e4c859be2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0567-dtoverlays-Add-VCM-option-to-Arducam64MP.patch
@@ -0,0 +1,151 @@
+From 96fddfeae4b139aa4b84540a1784a5be8053454c Mon Sep 17 00:00:00 2001
+From: Lee Jackson <info@arducam.com>
+Date: Mon, 27 Feb 2023 08:47:23 +0800
+Subject: [PATCH] dtoverlays: Add VCM option to Arducam64MP
+
+VCM is enabled by default, but you can use 'vcm=off' to disable VCM support.
+
+Signed-off-by: Lee Jackson <lee.jackson@arducam.com>
+---
+ arch/arm/boot/dts/overlays/README             |  2 +
+ .../dts/overlays/arducam-64mp-overlay.dts     | 61 +++++++++----------
+ arch/arm/boot/dts/overlays/arducam-64mp.dtsi  | 34 +++++++++++
+ 3 files changed, 65 insertions(+), 32 deletions(-)
+ create mode 100644 arch/arm/boot/dts/overlays/arducam-64mp.dtsi
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -613,6 +613,8 @@ Params: rotation                Mounting
+                                 configuring the sensor (default on)
+         cam0                    Adopt the default configuration for CAM0 on a
+                                 Compute Module (CSI0, i2c_vc, and cam0_reg).
++        vcm                     Select lens driver state. Default is enabled,
++                                but vcm=off will disable.
+ 
+ 
+ Name:   arducam-pivariety
+--- a/arch/arm/boot/dts/overlays/arducam-64mp-overlay.dts
++++ b/arch/arm/boot/dts/overlays/arducam-64mp-overlay.dts
+@@ -13,32 +13,7 @@
+ 			#size-cells = <0>;
+ 			status = "okay";
+ 
+-			arducam_64mp: arducam_64mp@1a {
+-				compatible = "arducam,64mp";
+-				reg = <0x1a>;
+-				status = "okay";
+-
+-				clocks = <&cam1_clk>;
+-				clock-names = "xclk";
+-
+-				VANA-supply = <&cam1_reg>;	/* 2.8v */
+-				VDIG-supply = <&cam_dummy_reg>;	/* 1.8v */
+-				VDDL-supply = <&cam_dummy_reg>;	/* 1.2v */
+-
+-				rotation = <0>;
+-				orientation = <2>;
+-
+-				port {
+-					arducam_64mp_0: endpoint {
+-						remote-endpoint = <&csi1_ep>;
+-						clock-lanes = <0>;
+-						data-lanes = <1 2>;
+-						clock-noncontinuous;
+-						link-frequencies =
+-							/bits/ 64 <456000000>;
+-					};
+-				};
+-			};
++			#include "arducam-64mp.dtsi"
+ 		};
+ 	};
+ 
+@@ -49,8 +24,8 @@
+ 			brcm,media-controller;
+ 
+ 			port{
+-				csi1_ep: endpoint{
+-					remote-endpoint = <&arducam_64mp_0>;
++				csi_ep: endpoint{
++					remote-endpoint = <&cam_endpoint>;
+ 					clock-lanes = <0>;
+ 					data-lanes = <1 2>;
+ 					clock-noncontinuous;
+@@ -81,14 +56,36 @@
+ 		};
+ 	};
+ 
++	fragment@5 {
++		target = <&cam_node>;
++		__overlay__ {
++			lens-focus = <&vcm_node>;
++		};
++	};
++
+ 	__overrides__ {
+-		rotation = <&arducam_64mp>,"rotation:0";
+-		orientation = <&arducam_64mp>,"orientation:0";
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
+ 		media-controller = <&csi>,"brcm,media-controller?";
+ 		cam0 = <&i2c_frag>, "target:0=",<&i2c_vc>,
+ 		       <&csi_frag>, "target:0=",<&csi0>,
+ 		       <&clk_frag>, "target:0=",<&cam0_clk>,
+-		       <&arducam_64mp>, "clocks:0=",<&cam0_clk>,
+-		       <&arducam_64mp>, "VANA-supply:0=",<&cam0_reg>;
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "VANA-supply:0=",<&cam0_reg>,
++		       <&vcm_node>, "VDD-supply:0=", <&cam0_reg>;
++		vcm = <&vcm_node>, "status",
++		      <0>, "=5";
+ 	};
+ };
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
++
++&vcm_node {
++	status = "okay";
++};
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/arducam-64mp.dtsi
+@@ -0,0 +1,34 @@
++// Fragment that configures a Arducam64MP
++
++cam_node: arducam_64mp@1a {
++	compatible = "arducam,64mp";
++	reg = <0x1a>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "xclk";
++
++	VANA-supply = <&cam1_reg>;	/* 2.8v */
++	VDIG-supply = <&cam_dummy_reg>;	/* 1.8v */
++	VDDL-supply = <&cam_dummy_reg>;	/* 1.2v */
++
++	rotation = <0>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			data-lanes = <1 2>;
++			clock-noncontinuous;
++			link-frequencies =
++				/bits/ 64 <456000000>;
++		};
++	};
++};
++
++vcm_node: dw9817_arducam64mp@c {
++	compatible = "dongwoon,dw9817-vcm";
++	reg = <0x0c>;
++	status = "disabled";
++	VDD-supply = <&cam1_reg>;
++};
diff --git a/target/linux/bcm27xx/patches-6.1/950-0568-dtoverlays-Add-Arducam64MP-support-to-camera-mux-ove.patch b/target/linux/bcm27xx/patches-6.1/950-0568-dtoverlays-Add-Arducam64MP-support-to-camera-mux-ove.patch
new file mode 100644
index 00000000000000..77a4746d02cfe0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0568-dtoverlays-Add-Arducam64MP-support-to-camera-mux-ove.patch
@@ -0,0 +1,251 @@
+From 7db83bf5b09ebc07e5e70bc88496a60b9abecdc4 Mon Sep 17 00:00:00 2001
+From: Lee Jackson <info@arducam.com>
+Date: Mon, 27 Feb 2023 19:38:05 +0800
+Subject: [PATCH] dtoverlays: Add Arducam64MP support to camera mux
+ overlays
+
+Signed-off-by: Lee Jackson <lee.jackson@arducam.com>
+---
+ arch/arm/boot/dts/overlays/README             | 10 ++-
+ .../dts/overlays/camera-mux-2port-overlay.dts | 32 ++++++++++
+ .../dts/overlays/camera-mux-4port-overlay.dts | 64 +++++++++++++++++++
+ 3 files changed, 104 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -714,7 +714,8 @@ Info:   Configures a 2 port camera multi
+         Note that currently ALL IMX290 modules share a common clock, therefore
+         all modules will need to have the same clock frequency.
+ Load:   dtoverlay=camera-mux-2port,<param>=<val>
+-Params: cam0-imx219             Select IMX219 for camera on port 0
++Params: cam0-arducam-64mp       Select Arducam64MP for camera on port 0
++        cam0-imx219             Select IMX219 for camera on port 0
+         cam0-imx258             Select IMX258 for camera on port 0
+         cam0-imx290             Select IMX290 for camera on port 0
+         cam0-imx477             Select IMX477 for camera on port 0
+@@ -725,6 +726,7 @@ Params: cam0-imx219             Select I
+         cam0-ov7251             Select OV7251 for camera on port 0
+         cam0-ov9281             Select OV9281 for camera on port 0
+         cam0-imx290-clk-freq    Set clock frequency for an IMX290 on port 0
++        cam1-arducam-64mp       Select Arducam64MP for camera on port 1
+         cam1-imx219             Select IMX219 for camera on port 1
+         cam1-imx258             Select IMX258 for camera on port 1
+         cam1-imx290             Select IMX290 for camera on port 1
+@@ -743,7 +745,8 @@ Info:   Configures a 4 port camera multi
+         Note that currently ALL IMX290 modules share a common clock, therefore
+         all modules will need to have the same clock frequency.
+ Load:   dtoverlay=camera-mux-4port,<param>=<val>
+-Params: cam0-imx219             Select IMX219 for camera on port 0
++Params: cam0-arducam-64mp       Select Arducam64MP for camera on port 0
++        cam0-imx219             Select IMX219 for camera on port 0
+         cam0-imx258             Select IMX258 for camera on port 0
+         cam0-imx290             Select IMX290 for camera on port 0
+         cam0-imx477             Select IMX477 for camera on port 0
+@@ -754,6 +757,7 @@ Params: cam0-imx219             Select I
+         cam0-ov7251             Select OV7251 for camera on port 0
+         cam0-ov9281             Select OV9281 for camera on port 0
+         cam0-imx290-clk-freq    Set clock frequency for an IMX290 on port 0
++        cam1-arducam-64mp       Select Arducam64MP for camera on port 1
+         cam1-imx219             Select IMX219 for camera on port 1
+         cam1-imx258             Select IMX258 for camera on port 1
+         cam1-imx290             Select IMX290 for camera on port 1
+@@ -765,6 +769,7 @@ Params: cam0-imx219             Select I
+         cam1-ov7251             Select OV7251 for camera on port 1
+         cam1-ov9281             Select OV9281 for camera on port 1
+         cam1-imx290-clk-freq    Set clock frequency for an IMX290 on port 1
++        cam2-arducam-64mp       Select Arducam64MP for camera on port 2
+         cam2-imx219             Select IMX219 for camera on port 2
+         cam2-imx258             Select IMX258 for camera on port 2
+         cam2-imx290             Select IMX290 for camera on port 2
+@@ -776,6 +781,7 @@ Params: cam0-imx219             Select I
+         cam2-ov7251             Select OV7251 for camera on port 2
+         cam2-ov9281             Select OV9281 for camera on port 2
+         cam2-imx290-clk-freq    Set clock frequency for an IMX290 on port 2
++        cam3-arducam-64mp       Select Arducam64MP for camera on port 3
+         cam3-imx219             Select IMX219 for camera on port 3
+         cam3-imx258             Select IMX258 for camera on port 3
+         cam3-imx290             Select IMX290 for camera on port 3
+--- a/arch/arm/boot/dts/overlays/camera-mux-2port-overlay.dts
++++ b/arch/arm/boot/dts/overlays/camera-mux-2port-overlay.dts
+@@ -96,6 +96,16 @@
+ 					#address-cells = <1>;
+ 					#size-cells = <0>;
+ 
++					#define cam_node arducam_64mp_0
++					#define cam_endpoint arducam_64mp_0_ep
++					#define vcm_node arducam_64mp_0_vcm
++					#define cam1_clk clk_24mhz
++					#include "arducam-64mp.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
+ 					#define cam_node imx219_0
+ 					#define cam_endpoint imx219_0_ep
+ 					#define cam1_clk clk_24mhz
+@@ -186,6 +196,16 @@
+ 					#address-cells = <1>;
+ 					#size-cells = <0>;
+ 
++					#define cam_node arducam_64mp_1
++					#define cam_endpoint arducam_64mp_1_ep
++					#define vcm_node arducam_64mp_1_vcm
++					#define cam1_clk clk_24mhz
++					#include "arducam-64mp.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
+ 					#define cam_node imx219_1
+ 					#define cam_endpoint imx219_1_ep
+ 					#define cam1_clk clk_24mhz
+@@ -385,6 +405,12 @@
+ 	};
+ 
+ 	__overrides__ {
++		cam0-arducam-64mp = <&mux_in0>, "remote-endpoint:0=",<&arducam_64mp_0_ep>,
++				    <&arducam_64mp_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++				    <&mux_in0>, "clock-noncontinuous?",
++				    <&arducam_64mp_0>, "status=okay",
++				    <&arducam_64mp_0_vcm>, "status=okay",
++				    <&arducam_64mp_0>,"lens-focus:0=", <&arducam_64mp_0_vcm>;
+ 		cam0-imx219 = <&mux_in0>, "remote-endpoint:0=",<&imx219_0_ep>,
+ 			      <&imx219_0_ep>, "remote-endpoint:0=",<&mux_in0>,
+ 			      <&mux_in0>, "clock-noncontinuous?",
+@@ -425,6 +451,12 @@
+ 			      <&ov2311_0_ep>, "remote-endpoint:0=",<&mux_in0>,
+ 			      <&ov2311_0>, "status=okay";
+ 
++		cam1-arducam-64mp = <&mux_in1>, "remote-endpoint:0=",<&arducam_64mp_1_ep>,
++				    <&arducam_64mp_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++				    <&mux_in1>, "clock-noncontinuous?",
++				    <&arducam_64mp_1>, "status=okay",
++				    <&arducam_64mp_1_vcm>, "status=okay",
++				    <&arducam_64mp_1>,"lens-focus:0=", <&arducam_64mp_1_vcm>;
+ 		cam1-imx219 = <&mux_in1>, "remote-endpoint:0=",<&imx219_1_ep>,
+ 			      <&imx219_1_ep>, "remote-endpoint:0=",<&mux_in1>,
+ 			      <&mux_in1>, "clock-noncontinuous?",
+--- a/arch/arm/boot/dts/overlays/camera-mux-4port-overlay.dts
++++ b/arch/arm/boot/dts/overlays/camera-mux-4port-overlay.dts
+@@ -154,6 +154,16 @@
+ 					#address-cells = <1>;
+ 					#size-cells = <0>;
+ 
++					#define cam_node arducam_64mp_0
++					#define cam_endpoint arducam_64mp_0_ep
++					#define vcm_node arducam_64mp_0_vcm
++					#define cam1_clk clk_24mhz
++					#include "arducam-64mp.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
+ 					#define cam_node imx219_0
+ 					#define cam_endpoint imx219_0_ep
+ 					#define cam1_clk clk_24mhz
+@@ -244,6 +254,16 @@
+ 					#address-cells = <1>;
+ 					#size-cells = <0>;
+ 
++					#define cam_node arducam_64mp_1
++					#define cam_endpoint arducam_64mp_1_ep
++					#define vcm_node arducam_64mp_1_vcm
++					#define cam1_clk clk_24mhz
++					#include "arducam-64mp.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
+ 					#define cam_node imx219_1
+ 					#define cam_endpoint imx219_1_ep
+ 					#define cam1_clk clk_24mhz
+@@ -334,6 +354,16 @@
+ 					#address-cells = <1>;
+ 					#size-cells = <0>;
+ 
++					#define cam_node arducam_64mp_2
++					#define cam_endpoint arducam_64mp_2_ep
++					#define vcm_node arducam_64mp_2_vcm
++					#define cam1_clk clk_24mhz
++					#include "arducam-64mp.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
+ 					#define cam_node imx219_2
+ 					#define cam_endpoint imx219_2_ep
+ 					#define cam1_clk clk_24mhz
+@@ -424,6 +454,16 @@
+ 					#address-cells = <1>;
+ 					#size-cells = <0>;
+ 
++					#define cam_node arducam_64mp_3
++					#define cam_endpoint arducam_64mp_3_ep
++					#define vcm_node arducam_64mp_3_vcm
++					#define cam1_clk clk_24mhz
++					#include "arducam-64mp.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
+ 					#define cam_node imx219_3
+ 					#define cam_endpoint imx219_3_ep
+ 					#define cam1_clk clk_24mhz
+@@ -640,6 +680,12 @@
+ 	};
+ 
+ 	__overrides__ {
++		cam0-arducam-64mp = <&mux_in0>, "remote-endpoint:0=",<&arducam_64mp_0_ep>,
++				    <&arducam_64mp_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++				    <&mux_in0>, "clock-noncontinuous?",
++				    <&arducam_64mp_0>, "status=okay",
++				    <&arducam_64mp_0_vcm>, "status=okay",
++				    <&arducam_64mp_0>,"lens-focus:0=", <&arducam_64mp_0_vcm>;
+ 		cam0-imx219 = <&mux_in0>, "remote-endpoint:0=",<&imx219_0_ep>,
+ 			      <&imx219_0_ep>, "remote-endpoint:0=",<&mux_in0>,
+ 			      <&mux_in0>, "clock-noncontinuous?",
+@@ -680,6 +726,12 @@
+ 			      <&ov2311_0_ep>, "remote-endpoint:0=",<&mux_in0>,
+ 			      <&ov2311_0>, "status=okay";
+ 
++		cam1-arducam-64mp = <&mux_in1>, "remote-endpoint:0=",<&arducam_64mp_1_ep>,
++				    <&arducam_64mp_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++				    <&mux_in1>, "clock-noncontinuous?",
++				    <&arducam_64mp_1>, "status=okay",
++				    <&arducam_64mp_1_vcm>, "status=okay",
++				    <&arducam_64mp_1>,"lens-focus:0=", <&arducam_64mp_1_vcm>;
+ 		cam1-imx219 = <&mux_in1>, "remote-endpoint:0=",<&imx219_1_ep>,
+ 			      <&imx219_1_ep>, "remote-endpoint:0=",<&mux_in1>,
+ 			      <&mux_in1>, "clock-noncontinuous?",
+@@ -720,6 +772,12 @@
+ 			      <&ov2311_1_ep>, "remote-endpoint:0=",<&mux_in1>,
+ 			      <&ov2311_1>, "status=okay";
+ 
++		cam2-arducam-64mp = <&mux_in2>, "remote-endpoint:0=",<&arducam_64mp_2_ep>,
++				    <&arducam_64mp_2_ep>, "remote-endpoint:0=",<&mux_in2>,
++				    <&mux_in2>, "clock-noncontinuous?",
++				    <&arducam_64mp_2>, "status=okay",
++				    <&arducam_64mp_2_vcm>, "status=okay",
++				    <&arducam_64mp_2>,"lens-focus:0=", <&arducam_64mp_2_vcm>;
+ 		cam2-imx219 = <&mux_in2>, "remote-endpoint:0=",<&imx219_2_ep>,
+ 			      <&imx219_2_ep>, "remote-endpoint:0=",<&mux_in2>,
+ 			      <&mux_in2>, "clock-noncontinuous?",
+@@ -760,6 +818,12 @@
+ 			      <&ov2311_2_ep>, "remote-endpoint:0=",<&mux_in2>,
+ 			      <&ov2311_2>, "status=okay";
+ 
++		cam3-arducam-64mp = <&mux_in3>, "remote-endpoint:0=",<&arducam_64mp_3_ep>,
++				    <&arducam_64mp_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++				    <&mux_in3>, "clock-noncontinuous?",
++				    <&arducam_64mp_3>, "status=okay",
++				    <&arducam_64mp_3_vcm>, "status=okay",
++				    <&arducam_64mp_3>,"lens-focus:0=", <&arducam_64mp_3_vcm>;
+ 		cam3-imx219 = <&mux_in3>, "remote-endpoint:0=",<&imx219_3_ep>,
+ 			      <&imx219_3_ep>, "remote-endpoint:0=",<&mux_in3>,
+ 			      <&mux_in3>, "clock-noncontinuous?",
diff --git a/target/linux/bcm27xx/patches-6.1/950-0569-drm-panel-panel-sitronix-st7701-Support-SPI-config-a.patch b/target/linux/bcm27xx/patches-6.1/950-0569-drm-panel-panel-sitronix-st7701-Support-SPI-config-a.patch
new file mode 100644
index 00000000000000..1f0d517b2a622e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0569-drm-panel-panel-sitronix-st7701-Support-SPI-config-a.patch
@@ -0,0 +1,555 @@
+From bf7ce2d1c54900ac19fef0bf0e317732682820e5 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 1 Feb 2022 15:27:01 +0000
+Subject: [PATCH] drm/panel/panel-sitronix-st7701: Support SPI config
+ and RGB data
+
+The ST7701 supports numerous different interface mechanisms for
+MIPI DSI, RGB, or SPI. The driver was only implementing DSI input,
+so add RGB parallel input with SPI configuration.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/panel/panel-sitronix-st7701.c | 374 ++++++++++++++++--
+ 1 file changed, 351 insertions(+), 23 deletions(-)
+
+--- a/drivers/gpu/drm/panel/panel-sitronix-st7701.c
++++ b/drivers/gpu/drm/panel/panel-sitronix-st7701.c
+@@ -7,16 +7,21 @@
+ #include <drm/drm_mipi_dsi.h>
+ #include <drm/drm_modes.h>
+ #include <drm/drm_panel.h>
++#include <drm/drm_print.h>
+ 
+ #include <linux/bitfield.h>
+ #include <linux/gpio/consumer.h>
+ #include <linux/delay.h>
++#include <linux/media-bus-format.h>
+ #include <linux/module.h>
+ #include <linux/of_device.h>
+ #include <linux/regulator/consumer.h>
++#include <linux/spi/spi.h>
+ 
+ #include <video/mipi_display.h>
+ 
++#define SPI_DATA_FLAG			0x100
++
+ /* Command2 BKx selection command */
+ #define DSI_CMD2BKX_SEL			0xFF
+ 
+@@ -53,6 +58,10 @@
+ #define DSI_CMD2BK1_SEL			0x11
+ #define DSI_CMD2BK3_SEL			0x13
+ #define DSI_CMD2BKX_SEL_NONE		0x00
++#define SPI_CMD2BK3_SEL			(SPI_DATA_FLAG | DSI_CMD2BK3_SEL)
++#define SPI_CMD2BK1_SEL			(SPI_DATA_FLAG | DSI_CMD2BK1_SEL)
++#define SPI_CMD2BK0_SEL			(SPI_DATA_FLAG | DSI_CMD2BK0_SEL)
++#define SPI_CMD2BKX_SEL_NONE		(SPI_DATA_FLAG | DSI_CMD2BKX_SEL_NONE)
+ 
+ /* Command2, BK0 bytes */
+ #define DSI_CMD2_BK0_GAMCTRL_AJ_MASK	GENMASK(7, 6)
+@@ -112,11 +121,23 @@ enum op_bias {
+ 
+ struct st7701;
+ 
++struct st7701;
++
++enum st7701_ctrl_if {
++	ST7701_CTRL_DSI,
++	ST7701_CTRL_SPI,
++};
++
+ struct st7701_panel_desc {
+ 	const struct drm_display_mode *mode;
+ 	unsigned int lanes;
+ 	enum mipi_dsi_pixel_format format;
++	u32 mediabus_format;
+ 	unsigned int panel_sleep_delay;
++	void (*init_sequence)(struct st7701 *st7701);
++	unsigned int conn_type;
++	enum st7701_ctrl_if interface;
++	u32 bus_flags;
+ 
+ 	/* TFT matrix driver configuration, panel specific. */
+ 	const u8	pv_gamma[16];	/* Positive voltage gamma control */
+@@ -142,6 +163,9 @@ struct st7701_panel_desc {
+ struct st7701 {
+ 	struct drm_panel panel;
+ 	struct mipi_dsi_device *dsi;
++	struct spi_device *spi;
++	const struct device *dev;
++
+ 	const struct st7701_panel_desc *desc;
+ 
+ 	struct regulator_bulk_data supplies[2];
+@@ -191,7 +215,23 @@ static u8 st7701_vgls_map(struct st7701
+ 	return 0;
+ }
+ 
+-static void st7701_init_sequence(struct st7701 *st7701)
++#define ST7701_SPI(st7701, seq...)				\
++	{							\
++		const u16 d[] = { seq };			\
++		struct spi_transfer xfer = { };			\
++		struct spi_message spi;				\
++								\
++		spi_message_init(&spi);				\
++								\
++		xfer.tx_buf = d;				\
++		xfer.bits_per_word = 9;				\
++		xfer.len = sizeof(u16) * ARRAY_SIZE(d);		\
++								\
++		spi_message_add_tail(&xfer, &spi);		\
++		spi_sync((st7701)->spi, &spi);			\
++	}
++
++static void ts8550b_init_sequence(struct st7701 *st7701)
+ {
+ 	const struct st7701_panel_desc *desc = st7701->desc;
+ 	const struct drm_display_mode *mode = desc->mode;
+@@ -404,6 +444,111 @@ static void dmt028vghmcmi_1a_gip_sequenc
+ 	ST7701_DSI(st7701, 0x3A, 0x70);
+ }
+ 
++static void txw210001b0_init_sequence(struct st7701 *st7701)
++{
++	ST7701_SPI(st7701, MIPI_DCS_SOFT_RESET);
++
++	usleep_range(5000, 7000);
++
++	ST7701_SPI(st7701, DSI_CMD2BKX_SEL,
++		   0x177, 0x101, 0x100, 0x100, SPI_CMD2BK0_SEL);
++
++	ST7701_SPI(st7701, DSI_CMD2_BK0_LNESET, 0x13B, 0x100);
++
++	ST7701_SPI(st7701, DSI_CMD2_BK0_PORCTRL, 0x10B, 0x102);
++
++	ST7701_SPI(st7701, DSI_CMD2_BK0_INVSEL, 0x100, 0x102);
++
++	ST7701_SPI(st7701, 0xCC, 0x110);
++
++	/*
++	 * Gamma option B:
++	 * Positive Voltage Gamma Control
++	 */
++	ST7701_SPI(st7701, DSI_CMD2_BK0_PVGAMCTRL,
++		   0x102, 0x113, 0x11B, 0x10D, 0x110, 0x105, 0x108, 0x107,
++		   0x107, 0x124, 0x104, 0x111, 0x10E, 0x12C, 0x133, 0x11D);
++
++	/* Negative Voltage Gamma Control */
++	ST7701_SPI(st7701, DSI_CMD2_BK0_NVGAMCTRL,
++		   0x105, 0x113, 0x11B, 0x10D, 0x111, 0x105, 0x108, 0x107,
++		   0x107, 0x124, 0x104, 0x111, 0x10E, 0x12C, 0x133, 0x11D);
++
++	ST7701_SPI(st7701, DSI_CMD2BKX_SEL,
++		   0x177, 0x101, 0x100, 0x100, SPI_CMD2BK1_SEL);
++
++	ST7701_SPI(st7701, DSI_CMD2_BK1_VRHS, 0x15D);
++
++	ST7701_SPI(st7701, DSI_CMD2_BK1_VCOM, 0x143);
++
++	ST7701_SPI(st7701, DSI_CMD2_BK1_VGHSS, 0x181);
++
++	ST7701_SPI(st7701, DSI_CMD2_BK1_TESTCMD, 0x180);
++
++	ST7701_SPI(st7701, DSI_CMD2_BK1_VGLS, 0x143);
++
++	ST7701_SPI(st7701, DSI_CMD2_BK1_PWCTLR1, 0x185);
++
++	ST7701_SPI(st7701, DSI_CMD2_BK1_PWCTLR2, 0x120);
++
++	ST7701_SPI(st7701, DSI_CMD2_BK1_SPD1, 0x178);
++
++	ST7701_SPI(st7701, DSI_CMD2_BK1_SPD2, 0x178);
++
++	ST7701_SPI(st7701, DSI_CMD2_BK1_MIPISET1, 0x188);
++
++	ST7701_SPI(st7701, 0xE0, 0x100, 0x100, 0x102);
++
++	ST7701_SPI(st7701, 0xE1,
++		   0x103, 0x1A0, 0x100, 0x100, 0x104, 0x1A0, 0x100, 0x100,
++		   0x100, 0x120, 0x120);
++
++	ST7701_SPI(st7701, 0xE2,
++		   0x100, 0x100, 0x100, 0x100, 0x100, 0x100, 0x100, 0x100,
++		   0x100, 0x100, 0x100, 0x100, 0x100);
++
++	ST7701_SPI(st7701, 0xE3, 0x100, 0x100, 0x111, 0x100);
++
++	ST7701_SPI(st7701, 0xE4, 0x122, 0x100);
++
++	ST7701_SPI(st7701, 0xE5,
++		   0x105, 0x1EC, 0x1A0, 0x1A0, 0x107, 0x1EE, 0x1A0, 0x1A0,
++		   0x100, 0x100, 0x100, 0x100, 0x100, 0x100, 0x100, 0x100);
++
++	ST7701_SPI(st7701, 0xE6, 0x100, 0x100, 0x111, 0x100);
++
++	ST7701_SPI(st7701, 0xE7, 0x122, 0x100);
++
++	ST7701_SPI(st7701, 0xE8,
++		   0x106, 0x1ED, 0x1A0, 0x1A0, 0x108, 0x1EF, 0x1A0, 0x1A0,
++		   0x100, 0x100, 0x100, 0x100, 0x100, 0x100, 0x100, 0x100);
++
++	ST7701_SPI(st7701, 0xEB,
++		   0x100, 0x100, 0x140, 0x140, 0x100, 0x100, 0x100);
++
++	ST7701_SPI(st7701, 0xED,
++		   0x1FF, 0x1FF, 0x1FF, 0x1BA, 0x10A, 0x1BF, 0x145, 0x1FF,
++		   0x1FF, 0x154, 0x1FB, 0x1A0, 0x1AB, 0x1FF, 0x1FF, 0x1FF);
++
++	ST7701_SPI(st7701, 0xEF, 0x110, 0x10D, 0x104, 0x108, 0x13F, 0x11F);
++
++	ST7701_SPI(st7701, DSI_CMD2BKX_SEL,
++		   0x177, 0x101, 0x100, 0x100, SPI_CMD2BK3_SEL);
++
++	ST7701_SPI(st7701, 0xEF, 0x108);
++
++	ST7701_SPI(st7701, DSI_CMD2BKX_SEL,
++		   0x177, 0x101, 0x100, 0x100, SPI_CMD2BKX_SEL_NONE);
++
++	ST7701_SPI(st7701, 0xCD, 0x108);  /* RGB format COLCTRL */
++
++	ST7701_SPI(st7701, 0x36, 0x108); /* MadCtl */
++
++	ST7701_SPI(st7701, 0x3A, 0x166);  /* Colmod */
++
++	ST7701_SPI(st7701, MIPI_DCS_EXIT_SLEEP_MODE);
++}
++
+ static int st7701_prepare(struct drm_panel *panel)
+ {
+ 	struct st7701 *st7701 = panel_to_st7701(panel);
+@@ -420,7 +565,7 @@ static int st7701_prepare(struct drm_pan
+ 	gpiod_set_value(st7701->reset, 1);
+ 	msleep(150);
+ 
+-	st7701_init_sequence(st7701);
++	st7701->desc->init_sequence(st7701);
+ 
+ 	if (st7701->desc->gip_sequence)
+ 		st7701->desc->gip_sequence(st7701);
+@@ -436,7 +581,15 @@ static int st7701_enable(struct drm_pane
+ {
+ 	struct st7701 *st7701 = panel_to_st7701(panel);
+ 
+-	ST7701_DSI(st7701, MIPI_DCS_SET_DISPLAY_ON, 0x00);
++	switch (st7701->desc->interface) {
++	case ST7701_CTRL_DSI:
++		ST7701_DSI(st7701, MIPI_DCS_SET_DISPLAY_ON, 0x00);
++		break;
++	case ST7701_CTRL_SPI:
++		ST7701_SPI(st7701, MIPI_DCS_SET_DISPLAY_ON);
++		msleep(30);
++		break;
++	}
+ 
+ 	return 0;
+ }
+@@ -445,7 +598,14 @@ static int st7701_disable(struct drm_pan
+ {
+ 	struct st7701 *st7701 = panel_to_st7701(panel);
+ 
+-	ST7701_DSI(st7701, MIPI_DCS_SET_DISPLAY_OFF, 0x00);
++	switch (st7701->desc->interface) {
++	case ST7701_CTRL_DSI:
++		ST7701_DSI(st7701, MIPI_DCS_SET_DISPLAY_OFF, 0x00);
++		break;
++	case ST7701_CTRL_SPI:
++		ST7701_SPI(st7701, MIPI_DCS_SET_DISPLAY_OFF);
++		break;
++	}
+ 
+ 	return 0;
+ }
+@@ -454,7 +614,14 @@ static int st7701_unprepare(struct drm_p
+ {
+ 	struct st7701 *st7701 = panel_to_st7701(panel);
+ 
+-	ST7701_DSI(st7701, MIPI_DCS_ENTER_SLEEP_MODE, 0x00);
++	switch (st7701->desc->interface) {
++	case ST7701_CTRL_DSI:
++		ST7701_DSI(st7701, MIPI_DCS_ENTER_SLEEP_MODE, 0x00);
++		break;
++	case ST7701_CTRL_SPI:
++		ST7701_SPI(st7701, MIPI_DCS_ENTER_SLEEP_MODE);
++		break;
++	}
+ 
+ 	msleep(st7701->sleep_delay);
+ 
+@@ -485,7 +652,7 @@ static int st7701_get_modes(struct drm_p
+ 
+ 	mode = drm_mode_duplicate(connector->dev, desc_mode);
+ 	if (!mode) {
+-		dev_err(&st7701->dsi->dev, "failed to add mode %ux%u@%u\n",
++		dev_err(st7701->dev, "failed to add mode %ux%u@%u\n",
+ 			desc_mode->hdisplay, desc_mode->vdisplay,
+ 			drm_mode_vrefresh(desc_mode));
+ 		return -ENOMEM;
+@@ -494,9 +661,18 @@ static int st7701_get_modes(struct drm_p
+ 	drm_mode_set_name(mode);
+ 	drm_mode_probed_add(connector, mode);
+ 
++	if (st7701->desc->mediabus_format)
++		drm_display_info_set_bus_formats(&connector->display_info,
++						 &st7701->desc->mediabus_format,
++						 1);
++	connector->display_info.bus_flags = 0;
++
+ 	connector->display_info.width_mm = desc_mode->width_mm;
+ 	connector->display_info.height_mm = desc_mode->height_mm;
+ 
++	if (st7701->desc->bus_flags)
++		connector->display_info.bus_flags = st7701->desc->bus_flags;
++
+ 	return 1;
+ }
+ 
+@@ -532,6 +708,9 @@ static const struct st7701_panel_desc ts
+ 	.lanes = 2,
+ 	.format = MIPI_DSI_FMT_RGB888,
+ 	.panel_sleep_delay = 80, /* panel need extra 80ms for sleep out cmd */
++	.init_sequence = ts8550b_init_sequence,
++	.conn_type = DRM_MODE_CONNECTOR_DSI,
++	.interface = ST7701_CTRL_DSI,
+ 
+ 	.pv_gamma = {
+ 		CFIELD_PREP(DSI_CMD2_BK0_GAMCTRL_AJ_MASK, 0) |
+@@ -708,38 +887,74 @@ static const struct st7701_panel_desc dm
+ 	.gip_sequence = dmt028vghmcmi_1a_gip_sequence,
+ };
+ 
+-static int st7701_dsi_probe(struct mipi_dsi_device *dsi)
++static const struct drm_display_mode txw210001b0_mode = {
++	.clock		= 19200,
++
++	.hdisplay	= 480,
++	.hsync_start	= 480 + 10,
++	.hsync_end	= 480 + 10 + 16,
++	.htotal		= 480 + 10 + 16 + 56,
++
++	.vdisplay	= 480,
++	.vsync_start	= 480 + 15,
++	.vsync_end	= 480 + 15 + 60,
++	.vtotal		= 480 + 15 + 60 + 15,
++
++	.width_mm	= 53,
++	.height_mm	= 53,
++	.flags = DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC,
++
++	.type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED,
++};
++
++static const struct st7701_panel_desc txw210001b0_desc = {
++	.mode = &txw210001b0_mode,
++	.mediabus_format = MEDIA_BUS_FMT_RGB888_1X24,
++	.init_sequence = txw210001b0_init_sequence,
++	.conn_type = DRM_MODE_CONNECTOR_DPI,
++	.interface = ST7701_CTRL_SPI,
++	.bus_flags = DRM_BUS_FLAG_PIXDATA_DRIVE_NEGEDGE,
++};
++
++static const struct st7701_panel_desc hyperpixel2r_desc = {
++	.mode = &txw210001b0_mode,
++	.mediabus_format = MEDIA_BUS_FMT_RGB666_1X24_CPADHI,
++	.init_sequence = txw210001b0_init_sequence,
++	.conn_type = DRM_MODE_CONNECTOR_DPI,
++	.interface = ST7701_CTRL_SPI,
++	.bus_flags = DRM_BUS_FLAG_PIXDATA_DRIVE_NEGEDGE,
++};
++
++static int st7701_probe(struct device *dev, struct st7701 **ret_st7701)
+ {
+ 	const struct st7701_panel_desc *desc;
+ 	struct st7701 *st7701;
+ 	int ret;
+ 
+-	st7701 = devm_kzalloc(&dsi->dev, sizeof(*st7701), GFP_KERNEL);
++	st7701 = devm_kzalloc(dev, sizeof(*st7701), GFP_KERNEL);
+ 	if (!st7701)
+ 		return -ENOMEM;
+ 
+-	desc = of_device_get_match_data(&dsi->dev);
+-	dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_BURST |
+-			  MIPI_DSI_MODE_LPM | MIPI_DSI_CLOCK_NON_CONTINUOUS;
+-	dsi->format = desc->format;
+-	dsi->lanes = desc->lanes;
++	desc = of_device_get_match_data(dev);
++	if (!desc)
++		return -EINVAL;
+ 
+ 	st7701->supplies[0].supply = "VCC";
+ 	st7701->supplies[1].supply = "IOVCC";
+ 
+-	ret = devm_regulator_bulk_get(&dsi->dev, ARRAY_SIZE(st7701->supplies),
++	ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(st7701->supplies),
+ 				      st7701->supplies);
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	st7701->reset = devm_gpiod_get(&dsi->dev, "reset", GPIOD_OUT_LOW);
++	st7701->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
+ 	if (IS_ERR(st7701->reset)) {
+-		dev_err(&dsi->dev, "Couldn't get our reset GPIO\n");
++		dev_err(dev, "Couldn't get our reset GPIO\n");
+ 		return PTR_ERR(st7701->reset);
+ 	}
+ 
+-	drm_panel_init(&st7701->panel, &dsi->dev, &st7701_funcs,
+-		       DRM_MODE_CONNECTOR_DSI);
++	drm_panel_init(&st7701->panel, dev, &st7701_funcs,
++		       desc->conn_type);
+ 
+ 	/**
+ 	 * Once sleep out has been issued, ST7701 IC required to wait 120ms
+@@ -758,9 +973,30 @@ static int st7701_dsi_probe(struct mipi_
+ 
+ 	drm_panel_add(&st7701->panel);
+ 
++	st7701->desc = desc;
++	st7701->dev = dev;
++
++	*ret_st7701 = st7701;
++
++	return 0;
++}
++
++static int st7701_dsi_probe(struct mipi_dsi_device *dsi)
++{
++	struct st7701 *st7701;
++	int ret;
++
++	ret = st7701_probe(&dsi->dev, &st7701);
++
++	if (ret)
++		return ret;
++
++	dsi->mode_flags = MIPI_DSI_MODE_VIDEO;
++	dsi->format = st7701->desc->format;
++	dsi->lanes = st7701->desc->lanes;
++
+ 	mipi_dsi_set_drvdata(dsi, st7701);
+ 	st7701->dsi = dsi;
+-	st7701->desc = desc;
+ 
+ 	ret = mipi_dsi_attach(dsi);
+ 	if (ret)
+@@ -781,22 +1017,114 @@ static void st7701_dsi_remove(struct mip
+ 	drm_panel_remove(&st7701->panel);
+ }
+ 
+-static const struct of_device_id st7701_of_match[] = {
++static const struct of_device_id st7701_dsi_of_match[] = {
+ 	{ .compatible = "densitron,dmt028vghmcmi-1a", .data = &dmt028vghmcmi_1a_desc },
+ 	{ .compatible = "techstar,ts8550b", .data = &ts8550b_desc },
+ 	{ }
+ };
+-MODULE_DEVICE_TABLE(of, st7701_of_match);
++MODULE_DEVICE_TABLE(of, st7701_dsi_of_match);
+ 
+ static struct mipi_dsi_driver st7701_dsi_driver = {
+ 	.probe		= st7701_dsi_probe,
+ 	.remove		= st7701_dsi_remove,
+ 	.driver = {
+ 		.name		= "st7701",
+-		.of_match_table	= st7701_of_match,
++		.of_match_table	= st7701_dsi_of_match,
+ 	},
+ };
+-module_mipi_dsi_driver(st7701_dsi_driver);
++
++/* SPI display  probe */
++static const struct of_device_id st7701_spi_of_match[] = {
++	{	.compatible = "txw,txw210001b0",
++		.data = &txw210001b0_desc,
++	}, {
++		.compatible = "pimoroni,hyperpixel2round",
++		.data = &hyperpixel2r_desc,
++	}, {
++		/* sentinel */
++	}
++};
++MODULE_DEVICE_TABLE(of, st7701_spi_of_match);
++
++static int st7701_spi_probe(struct spi_device *spi)
++{
++	struct st7701 *st7701;
++	int ret;
++
++	spi->mode = SPI_MODE_3;
++	spi->bits_per_word = 9;
++	ret = spi_setup(spi);
++	if (ret < 0) {
++		dev_err(&spi->dev, "failed to setup SPI: %d\n", ret);
++		return ret;
++	}
++
++	ret = st7701_probe(&spi->dev, &st7701);
++
++	if (ret)
++		return ret;
++
++	spi_set_drvdata(spi, st7701);
++	st7701->spi = spi;
++
++	return 0;
++}
++
++static void st7701_spi_remove(struct spi_device *spi)
++{
++	struct st7701 *ctx = spi_get_drvdata(spi);
++
++	drm_panel_remove(&ctx->panel);
++}
++
++static const struct spi_device_id st7701_spi_ids[] = {
++	{ "txw210001b0", 0 },
++	{ "hyperpixel2round", 0 },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(spi, st7701_spi_ids);
++
++static struct spi_driver st7701_spi_driver = {
++	.probe = st7701_spi_probe,
++	.remove = st7701_spi_remove,
++	.driver = {
++		.name = "st7701",
++		.of_match_table = st7701_spi_of_match,
++	},
++	.id_table = st7701_spi_ids,
++};
++
++static int __init panel_st7701_init(void)
++{
++	int err;
++
++	err = spi_register_driver(&st7701_spi_driver);
++	if (err < 0)
++		return err;
++
++	if (IS_ENABLED(CONFIG_DRM_MIPI_DSI)) {
++		err = mipi_dsi_driver_register(&st7701_dsi_driver);
++		if (err < 0)
++			goto err_did_spi_register;
++	}
++
++	return 0;
++
++err_did_spi_register:
++	spi_unregister_driver(&st7701_spi_driver);
++
++	return err;
++}
++module_init(panel_st7701_init);
++
++static void __exit panel_st7701_exit(void)
++{
++	if (IS_ENABLED(CONFIG_DRM_MIPI_DSI))
++		mipi_dsi_driver_unregister(&st7701_dsi_driver);
++
++	spi_unregister_driver(&st7701_spi_driver);
++}
++module_exit(panel_st7701_exit);
+ 
+ MODULE_AUTHOR("Jagan Teki <jagan@amarulasolutions.com>");
+ MODULE_DESCRIPTION("Sitronix ST7701 LCD Panel Driver");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0570-overlays-Remove-lirc-rpi-from-media-center.patch b/target/linux/bcm27xx/patches-6.1/950-0570-overlays-Remove-lirc-rpi-from-media-center.patch
new file mode 100644
index 00000000000000..0f2db63d242b80
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0570-overlays-Remove-lirc-rpi-from-media-center.patch
@@ -0,0 +1,101 @@
+From 1ec1688fcb2ecc8a4bf865b6f61d65bf8410a157 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 6 Mar 2023 16:34:39 +0000
+Subject: [PATCH] overlays: Remove lirc-rpi from media-center
+
+lirc-rpi was retired years ago, suggesting that this overlay is not
+being used. Before deleting outright, remove the lirc-rpi element.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README             | 12 -----
+ .../dts/overlays/media-center-overlay.dts     | 50 +------------------
+ 2 files changed, 1 insertion(+), 61 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -2774,18 +2774,6 @@ Params: speed                   Display
+         xohms                   Touchpanel sensitivity (X-plate resistance)
+         swapxy                  Swap x and y axis
+         backlight               Change backlight GPIO pin {e.g. 12, 18}
+-        gpio_out_pin            GPIO for output (default "17")
+-        gpio_in_pin             GPIO for input (default "18")
+-        gpio_in_pull            Pull up/down/off on the input pin
+-                                (default "down")
+-        sense                   Override the IR receive auto-detection logic:
+-                                 "0" = force active-high
+-                                 "1" = force active-low
+-                                 "-1" = use auto-detection
+-                                (default "-1")
+-        softcarrier             Turn the software carrier "on" or "off"
+-                                (default "on")
+-        invert                  "on" = invert the output pin (default "off")
+         debug                   "on" = enable additional debug messages
+                                 (default "off")
+ 
+--- a/arch/arm/boot/dts/overlays/media-center-overlay.dts
++++ b/arch/arm/boot/dts/overlays/media-center-overlay.dts
+@@ -73,62 +73,14 @@
+ 		};
+ 	};
+ 
+-	fragment@4 {
+-		target-path = "/";
+-		__overlay__ {
+-			lirc_rpi: lirc_rpi {
+-				compatible = "rpi,lirc-rpi";
+-				pinctrl-names = "default";
+-				pinctrl-0 = <&lirc_pins>;
+-				status = "okay";
+-
+-				// Override autodetection of IR receiver circuit
+-				// (0 = active high, 1 = active low, -1 = no override )
+-				rpi,sense = <0xffffffff>;
+-
+-				// Software carrier
+-				// (0 = off, 1 = on)
+-				rpi,softcarrier = <1>;
+-
+-				// Invert output
+-				// (0 = off, 1 = on)
+-				rpi,invert = <0>;
+-
+-				// Enable debugging messages
+-				// (0 = off, 1 = on)
+-				rpi,debug = <0>;
+-			};
+-		};
+-	};
+-
+-	fragment@5 {
+-		target = <&gpio>;
+-		__overlay__ {
+-			lirc_pins: lirc_pins {
+-				brcm,pins = <6 5>;
+-				brcm,function = <1 0>; // out in
+-				brcm,pull = <0 1>; // off down
+-			};
+-		};
+-	};
+-
+ 	__overrides__ {
+ 		speed =     <&rpidisplay>,"spi-max-frequency:0";
+ 		rotate =    <&rpidisplay>,"rotate:0";
+ 		fps =       <&rpidisplay>,"fps:0";
+-		debug =     <&rpidisplay>,"debug:0", 
+-		            <&lirc_rpi>,"rpi,debug:0";
++		debug =     <&rpidisplay>,"debug:0";
+ 		xohms =     <&rpidisplay_ts>,"ti,x-plate-ohms;0";
+ 		swapxy =    <&rpidisplay_ts>,"ti,swap-xy?";
+ 		backlight = <&rpidisplay>,"led-gpios:4",
+ 		            <&rpi_display_pins>,"brcm,pins:0";
+-
+-		gpio_out_pin =  <&lirc_pins>,"brcm,pins:0";
+-		gpio_in_pin =   <&lirc_pins>,"brcm,pins:4";
+-		gpio_in_pull =  <&lirc_pins>,"brcm,pull:4";
+-
+-		sense =         <&lirc_rpi>,"rpi,sense:0";
+-		softcarrier =   <&lirc_rpi>,"rpi,softcarrier:0";
+-		invert =        <&lirc_rpi>,"rpi,invert:0";
+ 	};
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0571-overlays-pca953x-Fix-a-typos-in-the-pcal-variants.patch b/target/linux/bcm27xx/patches-6.1/950-0571-overlays-pca953x-Fix-a-typos-in-the-pcal-variants.patch
new file mode 100644
index 00000000000000..43118f08b3e1d4
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0571-overlays-pca953x-Fix-a-typos-in-the-pcal-variants.patch
@@ -0,0 +1,64 @@
+From cdbefcc4fdaa9623f6bed4beef692e6d4453a17d Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 6 Mar 2023 17:15:36 +0000
+Subject: [PATCH] overlays: pca953x: Fix a typos in the pcal variants
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README              |  6 +++---
+ arch/arm/boot/dts/overlays/pca953x-overlay.dts | 12 ++++++------
+ 2 files changed, 9 insertions(+), 9 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -3045,9 +3045,9 @@ Params: addr                    I2C addr
+         pca9574                 Select the NXP PCA9574 (8 bit)
+         pca9575                 Select the NXP PCA9575 (16 bit)
+         pca9698                 Select the NXP PCA9698 (40 bit)
+-        pca16416                Select the NXP PCA16416 (16 bit)
+-        pca16524                Select the NXP PCA16524 (24 bit)
+-        pca19555a               Select the NXP PCA19555A (16 bit)
++        pcal6416                Select the NXP PCAL6416 (16 bit)
++        pcal6524                Select the NXP PCAL6524 (24 bit)
++        pcal9555a               Select the NXP PCAL9555A (16 bit)
+         max7310                 Select the Maxim MAX7310 (8 bit)
+         max7312                 Select the Maxim MAX7312 (16 bit)
+         max7313                 Select the Maxim MAX7313 (16 bit)
+--- a/arch/arm/boot/dts/overlays/pca953x-overlay.dts
++++ b/arch/arm/boot/dts/overlays/pca953x-overlay.dts
+@@ -110,19 +110,19 @@
+ 	fragment@15 {
+ 		target = <&pca>;
+ 		__dormant__ {
+-			compatible = "nxp,pca16416";
++			compatible = "nxp,pcal6416";
+ 		};
+ 	};
+ 	fragment@16 {
+ 		target = <&pca>;
+ 		__dormant__ {
+-			compatible = "nxp,pca16524";
++			compatible = "nxp,pcal6524";
+ 		};
+ 	};
+ 	fragment@17 {
+ 		target = <&pca>;
+ 		__dormant__ {
+-			compatible = "nxp,pca19555a";
++			compatible = "nxp,pcal9555a";
+ 		};
+ 	};
+ 	fragment@18 {
+@@ -220,9 +220,9 @@
+ 		pca9574 = <0>, "+12";
+ 		pca9575 = <0>, "+13";
+ 		pca9698 = <0>, "+14";
+-		pca16416 = <0>, "+15";
+-		pca16524 = <0>, "+16";
+-		pca19555a = <0>, "+17";
++		pcal6416 = <0>, "+15";
++		pcal6524 = <0>, "+16";
++		pcal9555a = <0>, "+17";
+ 		max7310 = <0>, "+18";
+ 		max7312 = <0>, "+19";
+ 		max7313 = <0>, "+20";
diff --git a/target/linux/bcm27xx/patches-6.1/950-0572-iio-adc-mcp3422-Add-correct-compatible-strings.patch b/target/linux/bcm27xx/patches-6.1/950-0572-iio-adc-mcp3422-Add-correct-compatible-strings.patch
new file mode 100644
index 00000000000000..2b6bc3ebb53781
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0572-iio-adc-mcp3422-Add-correct-compatible-strings.patch
@@ -0,0 +1,28 @@
+From 019ce2b273a27409664b52ae73a26f06dc696239 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 6 Mar 2023 20:04:34 +0000
+Subject: [PATCH] iio: adc: mcp3422: Add correct compatible strings
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/iio/adc/mcp3422.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/adc/mcp3422.c
++++ b/drivers/iio/adc/mcp3422.c
+@@ -407,7 +407,14 @@ static const struct i2c_device_id mcp342
+ MODULE_DEVICE_TABLE(i2c, mcp3422_id);
+ 
+ static const struct of_device_id mcp3422_of_match[] = {
+-	{ .compatible = "mcp3422" },
++	{ .compatible = "microchip,mcp3421" },
++	{ .compatible = "microchip,mcp3422" },
++	{ .compatible = "microchip,mcp3423" },
++	{ .compatible = "microchip,mcp3424" },
++	{ .compatible = "microchip,mcp3425" },
++	{ .compatible = "microchip,mcp3426" },
++	{ .compatible = "microchip,mcp3427" },
++	{ .compatible = "microchip,mcp3428" },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(of, mcp3422_of_match);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0573-ASoC-adau1977-Add-correct-compatible-strings.patch b/target/linux/bcm27xx/patches-6.1/950-0573-ASoC-adau1977-Add-correct-compatible-strings.patch
new file mode 100644
index 00000000000000..20a194d87ec0ce
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0573-ASoC-adau1977-Add-correct-compatible-strings.patch
@@ -0,0 +1,32 @@
+From f341deecd13b96ad61614eeff4b92afa766f7269 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 6 Mar 2023 20:48:14 +0000
+Subject: [PATCH] ASoC: adau1977: Add correct compatible strings
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ sound/soc/codecs/adau1977-i2c.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/sound/soc/codecs/adau1977-i2c.c
++++ b/sound/soc/codecs/adau1977-i2c.c
+@@ -38,9 +38,19 @@ static const struct i2c_device_id adau19
+ };
+ MODULE_DEVICE_TABLE(i2c, adau1977_i2c_ids);
+ 
++static const struct of_device_id adau1977_of_ids[] = {
++	{ .compatible = "adi,adau1977", },
++	{ .compatible = "adi,adau1978", },
++	{ .compatible = "adi,adau1979", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, adau1977_of_ids);
++
++
+ static struct i2c_driver adau1977_i2c_driver = {
+ 	.driver = {
+ 		.name = "adau1977",
++		.of_match_table = adau1977_of_ids,
+ 	},
+ 	.probe_new = adau1977_i2c_probe,
+ 	.id_table = adau1977_i2c_ids,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0574-overlays-Use-vendor-qualified-compatible-strings.patch b/target/linux/bcm27xx/patches-6.1/950-0574-overlays-Use-vendor-qualified-compatible-strings.patch
new file mode 100644
index 00000000000000..c656267c125ead
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0574-overlays-Use-vendor-qualified-compatible-strings.patch
@@ -0,0 +1,155 @@
+From bc54d285f62135f434d6b481ae25e3a71a05702d Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 6 Mar 2023 20:54:47 +0000
+Subject: [PATCH] overlays: Use vendor-qualified compatible strings
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .../arm/boot/dts/overlays/i2c-rtc-common.dtsi |  2 +-
+ .../boot/dts/overlays/i2c-sensor-common.dtsi  | 22 +++++++++----------
+ .../arm/boot/dts/overlays/papirus-overlay.dts |  2 +-
+ .../arm/boot/dts/overlays/spi-rtc-overlay.dts |  4 ++--
+ 4 files changed, 15 insertions(+), 15 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/i2c-rtc-common.dtsi
++++ b/arch/arm/boot/dts/overlays/i2c-rtc-common.dtsi
+@@ -250,7 +250,7 @@
+ 			#size-cells = <0>;
+ 
+ 			s35390a: s35390a@30 {
+-				compatible = "ablic,s35390a";
++				compatible = "sii,s35390a";
+ 				reg = <0x30>;
+ 			};
+ 		};
+--- a/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+@@ -76,7 +76,7 @@
+ 			status = "okay";
+ 
+ 			htu21: htu21@40 {
+-				compatible = "htu21";
++				compatible = "meas,htu21";
+ 				reg = <0x40>;
+ 				status = "okay";
+ 			};
+@@ -91,7 +91,7 @@
+ 			status = "okay";
+ 
+ 			lm75: lm75@4f {
+-				compatible = "lm75";
++				compatible = "national,lm75";
+ 				reg = <0x4f>;
+ 				status = "okay";
+ 			};
+@@ -106,7 +106,7 @@
+ 			status = "okay";
+ 
+ 			si7020: si7020@40 {
+-				compatible = "si7020";
++				compatible = "silabs,si7020";
+ 				reg = <0x40>;
+ 				status = "okay";
+ 			};
+@@ -136,7 +136,7 @@
+ 			status = "okay";
+ 
+ 			hdc100x: hdc100x@40 {
+-				compatible = "hdc100x";
++				compatible = "ti,hdc1000";
+ 				reg = <0x40>;
+ 				status = "okay";
+ 			};
+@@ -151,7 +151,7 @@
+ 			status = "okay";
+ 
+ 			tsl4531: tsl4531@29 {
+-				compatible = "tsl4531";
++				compatible = "amstaos,tsl4531";
+ 				reg = <0x29>;
+ 				status = "okay";
+ 			};
+@@ -166,7 +166,7 @@
+ 			status = "okay";
+ 
+ 			veml6070: veml6070@38 {
+-				compatible = "veml6070";
++				compatible = "vishay,veml6070";
+ 				reg = <0x38>;
+ 				status = "okay";
+ 			};
+@@ -181,7 +181,7 @@
+ 			status = "okay";
+ 
+ 			sht3x: sht3x@44 {
+-				compatible = "sht3x";
++				compatible = "sensirion,sht3x";
+ 				reg = <0x44>;
+ 				status = "okay";
+ 			};
+@@ -196,7 +196,7 @@
+ 			status = "okay";
+ 
+ 			ds1621: ds1621@48 {
+-				compatible = "ds1621";
++				compatible = "dallas,ds1621";
+ 				reg = <0x48>;
+ 				status = "okay";
+ 			};
+@@ -271,7 +271,7 @@
+ 			status = "okay";
+ 
+ 			ccs811: ccs811@5b {
+-				compatible = "ccs811";
++				compatible = "ams,ccs811";
+ 				reg = <0x5b>;
+ 				status = "okay";
+ 			};
+@@ -286,7 +286,7 @@
+ 			status = "okay";
+ 
+ 			bh1750: bh1750@23 {
+-				compatible = "bh1750";
++				compatible = "rohm,bh1750";
+ 				reg = <0x23>;
+ 				status = "okay";
+ 			};
+@@ -486,7 +486,7 @@
+ 			status = "okay";
+ 
+ 			sht4x: sht4x@44 {
+-				compatible = "sht4x";
++				compatible = "sensirion,sht4x";
+ 				reg = <0x44>;
+ 				status = "okay";
+ 			};
+--- a/arch/arm/boot/dts/overlays/papirus-overlay.dts
++++ b/arch/arm/boot/dts/overlays/papirus-overlay.dts
+@@ -14,7 +14,7 @@
+ 			status = "okay";
+ 
+ 			display_temp: lm75@48 {
+-				compatible = "lm75b";
++				compatible = "national,lm75b";
+ 				reg = <0x48>;
+ 				status = "okay";
+ 				#thermal-sensor-cells = <0>;
+--- a/arch/arm/boot/dts/overlays/spi-rtc-overlay.dts
++++ b/arch/arm/boot/dts/overlays/spi-rtc-overlay.dts
+@@ -8,14 +8,14 @@
+ 	fragment@0 {
+ 		target = <&rtc>;
+ 		__dormant__ {
+-			compatible = "maxim,ds3232";
++			compatible = "dallas,ds3232";
+ 		};
+ 	};
+ 
+ 	fragment@1 {
+ 		target = <&rtc>;
+ 		__dormant__ {
+-			compatible = "maxim,ds3234";
++			compatible = "dallas,ds3234";
+ 		};
+ 	};
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0575-mfd-arizona-i2c-Declare-of-MODULE_DEVICE_TABLE.patch b/target/linux/bcm27xx/patches-6.1/950-0575-mfd-arizona-i2c-Declare-of-MODULE_DEVICE_TABLE.patch
new file mode 100644
index 00000000000000..5c38ec84e07358
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0575-mfd-arizona-i2c-Declare-of-MODULE_DEVICE_TABLE.patch
@@ -0,0 +1,23 @@
+From cb8f89d446f8d204f0dbcd968bf27b0415c835ab Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 6 Mar 2023 20:56:08 +0000
+Subject: [PATCH] mfd: arizona-i2c: Declare of MODULE_DEVICE_TABLE
+
+Without a MODULE_DEVICE_TABLE declare for the of_device_ids, the
+compatible strings won't be turned into module aliases.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/mfd/arizona-i2c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mfd/arizona-i2c.c
++++ b/drivers/mfd/arizona-i2c.c
+@@ -112,6 +112,7 @@ static const struct of_device_id arizona
+ 	{ .compatible = "wlf,wm1814", .data = (void *)WM1814 },
+ 	{},
+ };
++MODULE_DEVICE_TABLE(of, arizona_i2c_of_match);
+ #endif
+ 
+ static struct i2c_driver arizona_i2c_driver = {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0576-gpio-pca953x-Add-ti-tca9554-compatible-string.patch b/target/linux/bcm27xx/patches-6.1/950-0576-gpio-pca953x-Add-ti-tca9554-compatible-string.patch
new file mode 100644
index 00000000000000..a310201d1a17de
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0576-gpio-pca953x-Add-ti-tca9554-compatible-string.patch
@@ -0,0 +1,20 @@
+From 960361905d77ecf3a84eaa5ca02369ddb5144bd4 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 6 Mar 2023 21:04:05 +0000
+Subject: [PATCH] gpio: pca953x: Add ti,tca9554 compatible string
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/gpio/gpio-pca953x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -1358,6 +1358,7 @@ static const struct of_device_id pca953x
+ 	{ .compatible = "ti,tca6416", .data = OF_953X(16, PCA_INT), },
+ 	{ .compatible = "ti,tca6424", .data = OF_953X(24, PCA_INT), },
+ 	{ .compatible = "ti,tca9539", .data = OF_953X(16, PCA_INT), },
++	{ .compatible = "ti,tca9554", .data = OF_953X( 8, PCA_INT), },
+ 
+ 	{ .compatible = "onnn,cat9554", .data = OF_953X( 8, PCA_INT), },
+ 	{ .compatible = "onnn,pca9654", .data = OF_953X( 8, PCA_INT), },
diff --git a/target/linux/bcm27xx/patches-6.1/950-0577-hwmon-aht10-Add-DT-compatible-string.patch b/target/linux/bcm27xx/patches-6.1/950-0577-hwmon-aht10-Add-DT-compatible-string.patch
new file mode 100644
index 00000000000000..3b316c0fee83d5
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0577-hwmon-aht10-Add-DT-compatible-string.patch
@@ -0,0 +1,29 @@
+From b77c63aa6c620edb9ad908b5660d24fb3e27bd12 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 7 Mar 2023 11:52:36 +0000
+Subject: [PATCH] hwmon: (aht10): Add DT compatible string
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/hwmon/aht10.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/hwmon/aht10.c
++++ b/drivers/hwmon/aht10.c
+@@ -332,9 +332,16 @@ static const struct i2c_device_id aht10_
+ };
+ MODULE_DEVICE_TABLE(i2c, aht10_id);
+ 
++static const struct of_device_id aht10_of_id[] = {
++	{ .compatible = "aosong,aht10", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, aht10_of_id);
++
+ static struct i2c_driver aht10_driver = {
+ 	.driver = {
+ 		.name = "aht10",
++		.of_match_table = aht10_of_id,
+ 	},
+ 	.probe      = aht10_probe,
+ 	.id_table   = aht10_id,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0578-hwmon-ds1621-Add-DT-compatible-strings.patch b/target/linux/bcm27xx/patches-6.1/950-0578-hwmon-ds1621-Add-DT-compatible-strings.patch
new file mode 100644
index 00000000000000..5903e8afbbee7a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0578-hwmon-ds1621-Add-DT-compatible-strings.patch
@@ -0,0 +1,29 @@
+From 9205fca2f330f2b7bd7a53eaec7bf2f8015d4501 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 7 Mar 2023 12:12:36 +0000
+Subject: [PATCH] hwmon: (ds1621) Add DT compatible strings
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/hwmon/ds1621.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/hwmon/ds1621.c
++++ b/drivers/hwmon/ds1621.c
+@@ -378,6 +378,16 @@ static const struct i2c_device_id ds1621
+ };
+ MODULE_DEVICE_TABLE(i2c, ds1621_id);
+ 
++static const struct of_device_id ds1621_of_ids[] = {
++	{ .compatible = "dallas,ds1621", },
++	{ .compatible = "dallas,ds1625", },
++	{ .compatible = "dallas,ds1631", },
++	{ .compatible = "dallas,ds1721", },
++	{ .compatible = "dallas,ds1731", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, ds1621_of_ids);
++
+ /* This is the driver that will be inserted */
+ static struct i2c_driver ds1621_driver = {
+ 	.class		= I2C_CLASS_HWMON,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0579-rtc-ds3232-Add-DT-compatible-string-for-ds3234.patch b/target/linux/bcm27xx/patches-6.1/950-0579-rtc-ds3232-Add-DT-compatible-string-for-ds3234.patch
new file mode 100644
index 00000000000000..1cd473dd4f5862
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0579-rtc-ds3232-Add-DT-compatible-string-for-ds3234.patch
@@ -0,0 +1,29 @@
+From bff500336ec392a64586aca9e1fc024a5cc159a8 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 7 Mar 2023 20:51:53 +0000
+Subject: [PATCH] rtc: ds3232: Add DT compatible string for ds3234
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/rtc/rtc-ds3232.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/rtc/rtc-ds3232.c
++++ b/drivers/rtc/rtc-ds3232.c
+@@ -701,9 +701,16 @@ static int ds3234_probe(struct spi_devic
+ 	return ds3232_probe(&spi->dev, regmap, spi->irq, "ds3234");
+ }
+ 
++static const  __maybe_unused struct of_device_id ds3234_of_match[] = {
++	{ .compatible = "dallas,ds3234" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, ds3234_of_match);
++
+ static struct spi_driver ds3234_driver = {
+ 	.driver = {
+ 		.name	 = "ds3234",
++		.of_match_table = of_match_ptr(ds3234_of_match),
+ 	},
+ 	.probe	 = ds3234_probe,
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0580-hwmon-sht3x-Add-DT-compatible-string.patch b/target/linux/bcm27xx/patches-6.1/950-0580-hwmon-sht3x-Add-DT-compatible-string.patch
new file mode 100644
index 00000000000000..bed23fcb709259
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0580-hwmon-sht3x-Add-DT-compatible-string.patch
@@ -0,0 +1,32 @@
+From 4ae8587685a3def5b87881f43940ffe0fd794208 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 7 Mar 2023 21:47:58 +0000
+Subject: [PATCH] hwmon: (sht3x) Add DT compatible string
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/hwmon/sht3x.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/hwmon/sht3x.c
++++ b/drivers/hwmon/sht3x.c
+@@ -741,8 +741,18 @@ static const struct i2c_device_id sht3x_
+ 
+ MODULE_DEVICE_TABLE(i2c, sht3x_ids);
+ 
++static const struct of_device_id sht3x_of_ids[] = {
++	{ .compatible = "sensirion,sht3x" },
++	{ .compatible = "sensirion,sts3x" },
++	{}
++};
++MODULE_DEVICE_TABLE(of, sht3x_of_ids);
++
+ static struct i2c_driver sht3x_i2c_driver = {
+-	.driver.name = "sht3x",
++	.driver = {
++		.name = "sht3x",
++		.of_match_table = sht3x_of_ids,
++	},
+ 	.probe_new   = sht3x_probe,
+ 	.id_table    = sht3x_ids,
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0581-iio-light-tsl4531-Add-DT-compatible-string.patch b/target/linux/bcm27xx/patches-6.1/950-0581-iio-light-tsl4531-Add-DT-compatible-string.patch
new file mode 100644
index 00000000000000..df279eec43769f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0581-iio-light-tsl4531-Add-DT-compatible-string.patch
@@ -0,0 +1,29 @@
+From 267601d68d4c5184727b4abe1fe64e89157ee8d7 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 7 Mar 2023 21:48:54 +0000
+Subject: [PATCH] iio: light: tsl4531: Add DT compatible string
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/iio/light/tsl4531.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/iio/light/tsl4531.c
++++ b/drivers/iio/light/tsl4531.c
+@@ -233,9 +233,16 @@ static const struct i2c_device_id tsl453
+ };
+ MODULE_DEVICE_TABLE(i2c, tsl4531_id);
+ 
++static const struct of_device_id tsl4531_of_id[] = {
++	{ .compatible = "amstaos,tsl4531" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, tsl4531_of_id);
++
+ static struct i2c_driver tsl4531_driver = {
+ 	.driver = {
+ 		.name   = TSL4531_DRV_NAME,
++		.of_match_table = tsl4531_of_id,
+ 		.pm	= pm_sleep_ptr(&tsl4531_pm_ops),
+ 	},
+ 	.probe  = tsl4531_probe,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0582-iio-light-veml6070-Add-DT-compatible-string.patch b/target/linux/bcm27xx/patches-6.1/950-0582-iio-light-veml6070-Add-DT-compatible-string.patch
new file mode 100644
index 00000000000000..437ecae793b8a3
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0582-iio-light-veml6070-Add-DT-compatible-string.patch
@@ -0,0 +1,29 @@
+From d337a3f310c82341597676d4b8ad51e60aa4a243 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 7 Mar 2023 21:49:30 +0000
+Subject: [PATCH] iio: light: veml6070: Add DT compatible string
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/iio/light/veml6070.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/iio/light/veml6070.c
++++ b/drivers/iio/light/veml6070.c
+@@ -195,9 +195,16 @@ static const struct i2c_device_id veml60
+ };
+ MODULE_DEVICE_TABLE(i2c, veml6070_id);
+ 
++static const struct of_device_id veml6070_of_id[] = {
++	{ .compatible = "vishay,veml6070" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, veml6070_of_id);
++
+ static struct i2c_driver veml6070_driver = {
+ 	.driver = {
+ 		.name   = VEML6070_DRV_NAME,
++		.of_match_table = veml6070_of_id,
+ 	},
+ 	.probe  = veml6070_probe,
+ 	.remove  = veml6070_remove,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0583-workflows-We-all-love-checkpatch-so-add-it-to-the-CI.patch b/target/linux/bcm27xx/patches-6.1/950-0583-workflows-We-all-love-checkpatch-so-add-it-to-the-CI.patch
new file mode 100644
index 00000000000000..109ae27c40c826
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0583-workflows-We-all-love-checkpatch-so-add-it-to-the-CI.patch
@@ -0,0 +1,46 @@
+From 6c110195b1f9b4e39676065d5973ecf603746862 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 8 Mar 2023 15:28:19 +0000
+Subject: [PATCH] workflows: We all love checkpatch, so add it to the
+ CI workflows
+
+This is currently running on defaults, so the --strict desired
+for media drivers and similar won't be observed. That may be
+possible to add later.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .github/workflows/checkpatch.yml     | 18 ++++++++++++++++++
+ .github/workflows/ci_checkpatch.conf |  4 ++++
+ 2 files changed, 22 insertions(+)
+ create mode 100644 .github/workflows/checkpatch.yml
+ create mode 100644 .github/workflows/ci_checkpatch.conf
+
+--- /dev/null
++++ b/.github/workflows/checkpatch.yml
+@@ -0,0 +1,18 @@
++name: Advisory checkpatch review
++on: [pull_request]
++
++jobs:
++  review:
++    name: checkpatch review
++    runs-on: ubuntu-latest
++    steps:
++    - name: 'Calculate PR commits + 1'
++      run: echo "PR_FETCH_DEPTH=$(( ${{ github.event.pull_request.commits }} + 1 ))" >> $GITHUB_ENV
++    - uses: actions/checkout@v3
++      with:
++        ref: ${{ github.event.pull_request.head.sha }}
++        fetch-depth: ${{ env.PR_FETCH_DEPTH }}
++    - name: Copy checkpatch.conf
++      run: cp ${{github.workspace}}/.github/workflows/ci_checkpatch.conf ${{github.workspace}}/.checkpatch.conf
++    - name: Run checkpatch review
++      uses: webispy/checkpatch-action@v9
+--- /dev/null
++++ b/.github/workflows/ci_checkpatch.conf
+@@ -0,0 +1,4 @@
++--no-tree
++--ignore FILE_PATH_CHANGES
++--ignore GIT_COMMIT_ID
++--ignore SPDX_LICENSE_TAG
diff --git a/target/linux/bcm27xx/patches-6.1/950-0584-ARM-dts-Standardise-on-the-upstream-LED-names.patch b/target/linux/bcm27xx/patches-6.1/950-0584-ARM-dts-Standardise-on-the-upstream-LED-names.patch
new file mode 100644
index 00000000000000..c7b568933be663
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0584-ARM-dts-Standardise-on-the-upstream-LED-names.patch
@@ -0,0 +1,262 @@
+From 38dcfe11a53bf7467858b1bae60e16754bf1869f Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 10 Mar 2023 10:02:35 +0000
+Subject: [PATCH] ARM: dts: Standardise on the upstream LED names
+
+Historically, downstream Pi DTS files have named the LEDs led0 and (if
+present) led1, while upstream have used the more meaningful "ACT" and
+"PWR". As part of a closer alignment with upstream, make the LED names
+match.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/bcm2708-rpi-b-plus.dts   | 3 +--
+ arch/arm/boot/dts/bcm2708-rpi-b-rev1.dts   | 1 -
+ arch/arm/boot/dts/bcm2708-rpi-b.dts        | 1 -
+ arch/arm/boot/dts/bcm2708-rpi-cm.dtsi      | 1 -
+ arch/arm/boot/dts/bcm2708-rpi-zero-w.dts   | 1 -
+ arch/arm/boot/dts/bcm2708-rpi-zero.dts     | 1 -
+ arch/arm/boot/dts/bcm2709-rpi-2-b.dts      | 3 +--
+ arch/arm/boot/dts/bcm2709-rpi-cm2.dts      | 1 -
+ arch/arm/boot/dts/bcm2710-rpi-2-b.dts      | 3 +--
+ arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts | 3 +--
+ arch/arm/boot/dts/bcm2710-rpi-3-b.dts      | 3 +--
+ arch/arm/boot/dts/bcm2710-rpi-cm3.dts      | 1 -
+ arch/arm/boot/dts/bcm2710-rpi-zero-2-w.dts | 1 -
+ arch/arm/boot/dts/bcm2711-rpi-4-b.dts      | 2 --
+ arch/arm/boot/dts/bcm2711-rpi-400.dts      | 2 --
+ arch/arm/boot/dts/bcm2711-rpi-cm4.dts      | 2 --
+ arch/arm/boot/dts/bcm2711-rpi-cm4s.dts     | 1 -
+ 17 files changed, 5 insertions(+), 25 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
++++ b/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
+@@ -157,14 +157,13 @@
+ 
+ &leds {
+ 	act_led: led-act {
+-		label = "led0";
+ 		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&gpio 47 0>;
+ 	};
+ 
+ 	pwr_led: led-pwr {
+-		label = "led1";
++		label = "PWR";
+ 		default-state = "off";
+ 		linux,default-trigger = "input";
+ 		gpios = <&gpio 35 0>;
+--- a/arch/arm/boot/dts/bcm2708-rpi-b-rev1.dts
++++ b/arch/arm/boot/dts/bcm2708-rpi-b-rev1.dts
+@@ -175,7 +175,6 @@ i2c_csi_dsi: &i2c1 {
+ 
+ &leds {
+ 	act_led: led-act {
+-		label = "led0";
+ 		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&gpio 16 1>;
+--- a/arch/arm/boot/dts/bcm2708-rpi-b.dts
++++ b/arch/arm/boot/dts/bcm2708-rpi-b.dts
+@@ -157,7 +157,6 @@
+ 
+ &leds {
+ 	act_led: led-act {
+-		label = "led0";
+ 		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&gpio 16 1>;
+--- a/arch/arm/boot/dts/bcm2708-rpi-cm.dtsi
++++ b/arch/arm/boot/dts/bcm2708-rpi-cm.dtsi
+@@ -3,7 +3,6 @@
+ 
+ &leds {
+ 	act_led: led-act {
+-		label = "led0";
+ 		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&gpio 47 0>;
+--- a/arch/arm/boot/dts/bcm2708-rpi-zero-w.dts
++++ b/arch/arm/boot/dts/bcm2708-rpi-zero-w.dts
+@@ -213,7 +213,6 @@
+ 
+ &leds {
+ 	act_led: led-act {
+-		label = "led0";
+ 		default-state = "off";
+ 		linux,default-trigger = "actpwr";
+ 		gpios = <&gpio 47 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm2708-rpi-zero.dts
++++ b/arch/arm/boot/dts/bcm2708-rpi-zero.dts
+@@ -154,7 +154,6 @@
+ 
+ &leds {
+ 	act_led: led-act {
+-		label = "led0";
+ 		default-state = "off";
+ 		linux,default-trigger = "actpwr";
+ 		gpios = <&gpio 47 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm2709-rpi-2-b.dts
++++ b/arch/arm/boot/dts/bcm2709-rpi-2-b.dts
+@@ -157,14 +157,13 @@
+ 
+ &leds {
+ 	act_led: led-act {
+-		label = "led0";
+ 		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&gpio 47 0>;
+ 	};
+ 
+ 	pwr_led: led-pwr {
+-		label = "led1";
++		label = "PWR";
+ 		default-state = "off";
+ 		linux,default-trigger = "input";
+ 		gpios = <&gpio 35 0>;
+--- a/arch/arm/boot/dts/bcm2709-rpi-cm2.dts
++++ b/arch/arm/boot/dts/bcm2709-rpi-cm2.dts
+@@ -191,7 +191,6 @@ cam0_reg: &cam0_regulator {
+ 
+ &leds {
+ 	act_led: led-act {
+-		label = "led0";
+ 		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&virtgpio 0 0>;
+--- a/arch/arm/boot/dts/bcm2710-rpi-2-b.dts
++++ b/arch/arm/boot/dts/bcm2710-rpi-2-b.dts
+@@ -157,14 +157,13 @@
+ 
+ &leds {
+ 	act_led: led-act {
+-		label = "led0";
+ 		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&gpio 47 0>;
+ 	};
+ 
+ 	pwr_led: led-pwr {
+-		label = "led1";
++		label = "PWR";
+ 		default-state = "off";
+ 		linux,default-trigger = "input";
+ 		gpios = <&gpio 35 0>;
+--- a/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
++++ b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
+@@ -233,14 +233,13 @@
+ 
+ &leds {
+ 	act_led: led-act {
+-		label = "led0";
+ 		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&gpio 29 0>;
+ 	};
+ 
+ 	pwr_led: led-pwr {
+-		label = "led1";
++		label = "PWR";
+ 		default-state = "off";
+ 		linux,default-trigger = "default-on";
+ 		gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
++++ b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
+@@ -248,14 +248,13 @@
+ 
+ &leds {
+ 	act_led: led-act {
+-		label = "led0";
+ 		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&virtgpio 0 0>;
+ 	};
+ 
+ 	pwr_led: led-pwr {
+-		label = "led1";
++		label = "PWR";
+ 		default-state = "off";
+ 		linux,default-trigger = "input";
+ 		gpios = <&expgpio 7 0>;
+--- a/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
++++ b/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
+@@ -190,7 +190,6 @@ cam0_reg: &cam0_regulator {
+ 
+ &leds {
+ 	act_led: led-act {
+-		label = "led0";
+ 		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&virtgpio 0 0>;
+--- a/arch/arm/boot/dts/bcm2710-rpi-zero-2-w.dts
++++ b/arch/arm/boot/dts/bcm2710-rpi-zero-2-w.dts
+@@ -226,7 +226,6 @@
+ 
+ &leds {
+ 	act_led: led-act {
+-		label = "led0";
+ 		default-state = "off";
+ 		linux,default-trigger = "actpwr";
+ 		gpios = <&gpio 29 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
+@@ -506,14 +506,12 @@
+ 
+ &leds {
+ 	act_led: led-act {
+-		label = "led0";
+ 		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
+ 	};
+ 
+ 	pwr_led: led-pwr {
+-		label = "led1";
+ 		default-state = "off";
+ 		linux,default-trigger = "default-on";
+ 		gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm2711-rpi-400.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-400.dts
+@@ -513,14 +513,12 @@
+ 
+ &leds {
+ 	act_led: led-act {
+-		label = "led0";
+ 		default-state = "off";
+ 		linux,default-trigger = "default-on";
+ 		gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
+ 	};
+ 
+ 	pwr_led: led-pwr {
+-		label = "led1";
+ 		default-state = "off";
+ 		linux,default-trigger = "default-on";
+ 		gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm2711-rpi-cm4.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-cm4.dts
+@@ -518,14 +518,12 @@
+ 
+ &leds {
+ 	act_led: led-act {
+-		label = "led0";
+ 		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 		gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
+ 	};
+ 
+ 	pwr_led: led-pwr {
+-		label = "led1";
+ 		default-state = "off";
+ 		linux,default-trigger = "default-on";
+ 		gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm2711-rpi-cm4s.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-cm4s.dts
+@@ -388,7 +388,6 @@
+ 
+ &leds {
+ 	act_led: led-act {
+-		label = "led0";
+ 		default-state = "off";
+ 		linux,default-trigger = "mmc0";
+ 	};
diff --git a/target/linux/bcm27xx/patches-6.1/950-0585-ARM-dts-bcm2711-rpi-400-Restore-the-ACT-LED.patch b/target/linux/bcm27xx/patches-6.1/950-0585-ARM-dts-bcm2711-rpi-400-Restore-the-ACT-LED.patch
new file mode 100644
index 00000000000000..1e3ef094a72971
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0585-ARM-dts-bcm2711-rpi-400-Restore-the-ACT-LED.patch
@@ -0,0 +1,64 @@
+From 11289568f8c1530a16721c9aeaae3ae1668eacbb Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 10 Mar 2023 11:22:24 +0000
+Subject: [PATCH] ARM: dts: bcm2711-rpi-400: Restore the ACT LED
+
+Pi 400 doesn't have an ACT LED, only a green PWR LED, but a user may
+wish to remap the ACT functionality to a GPIO on the 40-pin header.
+Restore the ACT LED declaration, but leave it disabled in order to
+prevent a GPIO being claimed until either the act_led_gpio dtparam
+or the act-led overlay is used.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/bcm2711-rpi-400.dts          | 12 ++++++++----
+ arch/arm/boot/dts/overlays/act-led-overlay.dts |  3 ++-
+ 2 files changed, 10 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm2711-rpi-400.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-400.dts
+@@ -512,16 +512,19 @@
+ };
+ 
+ &leds {
++	// Declare the LED but leave it disabled, in case a user wants to map it
++	// to a GPIO on the header
+ 	act_led: led-act {
+ 		default-state = "off";
+-		linux,default-trigger = "default-on";
+-		gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
++		linux,default-trigger = "mmc0";
++		gpios = <&gpio 0 GPIO_ACTIVE_HIGH>;
++		status = "disabled";
+ 	};
+ 
+ 	pwr_led: led-pwr {
+ 		default-state = "off";
+ 		linux,default-trigger = "default-on";
+-		gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
++		gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
+ 	};
+ };
+ 
+@@ -542,7 +545,8 @@
+ 	__overrides__ {
+ 		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_hdmi=0'}";
+ 
+-		act_led_gpio = <&act_led>,"gpios:4";
++		act_led_gpio = <&act_led>,"gpios:4",
++			       <&act_led>,"status=okay";
+ 		act_led_activelow = <&act_led>,"gpios:8";
+ 		act_led_trigger = <&act_led>,"linux,default-trigger";
+ 
+--- a/arch/arm/boot/dts/overlays/act-led-overlay.dts
++++ b/arch/arm/boot/dts/overlays/act-led-overlay.dts
+@@ -21,7 +21,8 @@
+ 	};
+ 
+ 	__overrides__ {
+-		gpio = <&frag0>,"gpios:4";
++		gpio = <&frag0>,"gpios:4",
++		       <&frag0>,"status=okay";
+ 		activelow = <&frag0>,"gpios:8";
+ 	};
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0586-ARM-dts-bcm2711-rpi-400-Add-dummy-cam1-regulator.patch b/target/linux/bcm27xx/patches-6.1/950-0586-ARM-dts-bcm2711-rpi-400-Add-dummy-cam1-regulator.patch
new file mode 100644
index 00000000000000..77f25f7f59eb2f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0586-ARM-dts-bcm2711-rpi-400-Add-dummy-cam1-regulator.patch
@@ -0,0 +1,26 @@
+From 54449638b90cf7d225c537792ffc57ec93b12148 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 10 Mar 2023 11:56:10 +0000
+Subject: [PATCH] ARM: dts: bcm2711-rpi-400: Add dummy cam1 regulator
+
+Adding the cam1_reg label to the dummy camera regulator gets rid of an
+error when all overlays are tried against all boards, and brings it
+closer to what's happening in 6.2.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/bcm2711-rpi-400.dts | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/arm/boot/dts/bcm2711-rpi-400.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-400.dts
+@@ -537,6 +537,9 @@
+ 	pinctrl-0 = <&audio_pins>;
+ };
+ 
++cam0_reg: &cam_dummy_reg {
++};
++
+ &genet_mdio {
+ 	clock-frequency = <1950000>;
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0587-overlays-vc4-kms-fkms-v3d-Raise-CMA-to-512MB.patch b/target/linux/bcm27xx/patches-6.1/950-0587-overlays-vc4-kms-fkms-v3d-Raise-CMA-to-512MB.patch
new file mode 100644
index 00000000000000..71149da59fe3e9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0587-overlays-vc4-kms-fkms-v3d-Raise-CMA-to-512MB.patch
@@ -0,0 +1,37 @@
+From d1f5ac4f1a999b010e043072bf5d26c80d382b33 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 10 Mar 2023 15:07:10 +0000
+Subject: [PATCH] overlays: vc4-kms/fkms-v3d: Raise CMA to 512MB
+
+On Pi 4, raise the requested CMA size to 512MB by default, on the
+understanding that the firmware will cap that to 256MB if it's a
+32-bit kernel with less than 2GB of RAM.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/vc4-fkms-v3d-pi4-overlay.dts | 2 +-
+ arch/arm/boot/dts/overlays/vc4-kms-v3d-pi4-overlay.dts  | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/vc4-fkms-v3d-pi4-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-fkms-v3d-pi4-overlay.dts
+@@ -8,7 +8,7 @@
+ #include "cma-overlay.dts"
+ 
+ &frag0 {
+-	size = <((320-4)*1024*1024)>;
++	size = <((512-4)*1024*1024)>;
+ };
+ 
+ / {
+--- a/arch/arm/boot/dts/overlays/vc4-kms-v3d-pi4-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-kms-v3d-pi4-overlay.dts
+@@ -10,7 +10,7 @@
+ #include "cma-overlay.dts"
+ 
+ &frag0 {
+-	size = <((320-4)*1024*1024)>;
++	size = <((512-4)*1024*1024)>;
+ };
+ 
+ / {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0588-media-i2c-imx219-Sensor-should-report-RAW-color-spac.patch b/target/linux/bcm27xx/patches-6.1/950-0588-media-i2c-imx219-Sensor-should-report-RAW-color-spac.patch
new file mode 100644
index 00000000000000..d842cd1099f708
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0588-media-i2c-imx219-Sensor-should-report-RAW-color-spac.patch
@@ -0,0 +1,33 @@
+From fa426d8007bf462ad9423b49f01e6106865caca5 Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Thu, 21 Oct 2021 14:41:55 +0100
+Subject: [PATCH] media: i2c: imx219: Sensor should report RAW color
+ space
+
+Tested on Raspberry Pi running libcamera.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ drivers/media/i2c/imx219.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/imx219.c
++++ b/drivers/media/i2c/imx219.c
+@@ -584,7 +584,7 @@ static void imx219_set_default_format(st
+ 
+ 	fmt = &imx219->fmt;
+ 	fmt->code = MEDIA_BUS_FMT_SRGGB10_1X10;
+-	fmt->colorspace = V4L2_COLORSPACE_SRGB;
++	fmt->colorspace = V4L2_COLORSPACE_RAW;
+ 	fmt->ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->colorspace);
+ 	fmt->quantization = V4L2_MAP_QUANTIZATION_DEFAULT(true,
+ 							  fmt->colorspace,
+@@ -754,7 +754,7 @@ static int imx219_enum_frame_size(struct
+ 
+ static void imx219_reset_colorspace(struct v4l2_mbus_framefmt *fmt)
+ {
+-	fmt->colorspace = V4L2_COLORSPACE_SRGB;
++	fmt->colorspace = V4L2_COLORSPACE_RAW;
+ 	fmt->ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->colorspace);
+ 	fmt->quantization = V4L2_MAP_QUANTIZATION_DEFAULT(true,
+ 							  fmt->colorspace,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0589-media-i2c-imx219-Correct-the-minimum-vblanking-value.patch b/target/linux/bcm27xx/patches-6.1/950-0589-media-i2c-imx219-Correct-the-minimum-vblanking-value.patch
new file mode 100644
index 00000000000000..8383a967e2cb29
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0589-media-i2c-imx219-Correct-the-minimum-vblanking-value.patch
@@ -0,0 +1,26 @@
+From dc65a6b457153e907fe66e49364a21f3c5248add Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Tue, 25 Jan 2022 15:48:53 +0000
+Subject: [PATCH] media: i2c: imx219: Correct the minimum vblanking
+ value
+
+The datasheet for this sensor documents the minimum vblanking as being
+32 lines. It does fix some problems with occasional black lines at the
+bottom of images (tested on Raspberry Pi).
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ drivers/media/i2c/imx219.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/imx219.c
++++ b/drivers/media/i2c/imx219.c
+@@ -55,7 +55,7 @@
+ #define IMX219_VTS_30FPS_640x480	0x06e3
+ #define IMX219_VTS_MAX			0xffff
+ 
+-#define IMX219_VBLANK_MIN		4
++#define IMX219_VBLANK_MIN		32
+ 
+ /*Frame Length Line*/
+ #define IMX219_FLL_MIN			0x08a6
diff --git a/target/linux/bcm27xx/patches-6.1/950-0590-media-i2c-imx219-make-HBLANK-r-w-to-allow-longer-exp.patch b/target/linux/bcm27xx/patches-6.1/950-0590-media-i2c-imx219-make-HBLANK-r-w-to-allow-longer-exp.patch
new file mode 100644
index 00000000000000..dffae37774756f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0590-media-i2c-imx219-make-HBLANK-r-w-to-allow-longer-exp.patch
@@ -0,0 +1,105 @@
+From 9c3cf1138410254184dd863ab2177d1f8d6c652b Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 10 Mar 2023 17:27:10 +0000
+Subject: [PATCH] media: i2c: imx219: make HBLANK r/w to allow longer
+ exposures
+
+The HBLANK control was read-only, and always configured such
+that the sensor HTS register was 3448. This limited the maximum
+exposure time that could be achieved to around 1.26 secs.
+
+Make HBLANK read/write so that the line time can be extended,
+and thereby allow longer exposures (and slower frame rates).
+Retain the overall HTS setting when changing modes rather than
+resetting it to a default.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/imx219.c | 37 ++++++++++++++++++++++++-------------
+ 1 file changed, 24 insertions(+), 13 deletions(-)
+
+--- a/drivers/media/i2c/imx219.c
++++ b/drivers/media/i2c/imx219.c
+@@ -63,8 +63,10 @@
+ #define IMX219_FLL_STEP			1
+ #define IMX219_FLL_DEFAULT		0x0c98
+ 
+-/* HBLANK control - read only */
+-#define IMX219_PPL_DEFAULT		3448
++/* HBLANK control range */
++#define IMX219_PPL_MIN			3448
++#define IMX219_PPL_MAX			0x7ff0
++#define IMX219_REG_HTS			0x0162
+ 
+ /* Exposure control */
+ #define IMX219_REG_EXPOSURE		0x015a
+@@ -191,8 +193,6 @@ static const struct imx219_reg imx219_co
+ 	{0x479b, 0x0e},
+ 
+ 	/* Frame Bank Register Group "A" */
+-	{0x0162, 0x0d},	/* Line_Length_A */
+-	{0x0163, 0x78},
+ 	{0x0170, 0x01}, /* X_ODD_INC_A */
+ 	{0x0171, 0x01}, /* Y_ODD_INC_A */
+ 
+@@ -679,6 +679,11 @@ static int imx219_set_ctrl(struct v4l2_c
+ 				       IMX219_REG_VALUE_16BIT,
+ 				       imx219->mode->height + ctrl->val);
+ 		break;
++	case V4L2_CID_HBLANK:
++		ret = imx219_write_reg(imx219, IMX219_REG_HTS,
++				       IMX219_REG_VALUE_16BIT,
++				       imx219->mode->width + ctrl->val);
++		break;
+ 	case V4L2_CID_TEST_PATTERN_RED:
+ 		ret = imx219_write_reg(imx219, IMX219_REG_TESTP_RED,
+ 				       IMX219_REG_VALUE_16BIT, ctrl->val);
+@@ -837,6 +842,8 @@ static int imx219_set_pad_format(struct
+ 		*framefmt = fmt->format;
+ 	} else if (imx219->mode != mode ||
+ 		   imx219->fmt.code != fmt->format.code) {
++		u32 prev_hts = imx219->mode->width + imx219->hblank->val;
++
+ 		imx219->fmt = fmt->format;
+ 		imx219->mode = mode;
+ 		/* Update limits and set FPS to default */
+@@ -854,13 +861,19 @@ static int imx219_set_pad_format(struct
+ 					 exposure_max, imx219->exposure->step,
+ 					 exposure_def);
+ 		/*
+-		 * Currently PPL is fixed to IMX219_PPL_DEFAULT, so hblank
+-		 * depends on mode->width only, and is not changeble in any
+-		 * way other than changing the mode.
++		 * Retain PPL setting from previous mode so that the
++		 * line time does not change on a mode change.
++		 * Limits have to be recomputed as the controls define
++		 * the blanking only, so PPL values need to have the
++		 * mode width subtracted.
+ 		 */
+-		hblank = IMX219_PPL_DEFAULT - mode->width;
+-		__v4l2_ctrl_modify_range(imx219->hblank, hblank, hblank, 1,
+-					 hblank);
++		hblank = prev_hts - mode->width;
++		__v4l2_ctrl_modify_range(imx219->hblank,
++					 IMX219_PPL_MIN - mode->width,
++					 IMX219_PPL_MAX - mode->width,
++					 1,
++					 IMX219_PPL_MIN - mode->width);
++		__v4l2_ctrl_s_ctrl(imx219->hblank, hblank);
+ 	}
+ 
+ 	mutex_unlock(&imx219->mutex);
+@@ -1263,12 +1276,10 @@ static int imx219_init_controls(struct i
+ 					   V4L2_CID_VBLANK, IMX219_VBLANK_MIN,
+ 					   IMX219_VTS_MAX - height, 1,
+ 					   imx219->mode->vts_def - height);
+-	hblank = IMX219_PPL_DEFAULT - imx219->mode->width;
++	hblank = IMX219_PPL_MIN - imx219->mode->width;
+ 	imx219->hblank = v4l2_ctrl_new_std(ctrl_hdlr, &imx219_ctrl_ops,
+ 					   V4L2_CID_HBLANK, hblank, hblank,
+ 					   1, hblank);
+-	if (imx219->hblank)
+-		imx219->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+ 	exposure_max = imx219->mode->vts_def - 4;
+ 	exposure_def = (exposure_max < IMX219_EXPOSURE_DEFAULT) ?
+ 		exposure_max : IMX219_EXPOSURE_DEFAULT;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0591-media-imx219-Advertise-embedded-data-node-on-media-p.patch b/target/linux/bcm27xx/patches-6.1/950-0591-media-imx219-Advertise-embedded-data-node-on-media-p.patch
new file mode 100644
index 00000000000000..cecf3dd3669877
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0591-media-imx219-Advertise-embedded-data-node-on-media-p.patch
@@ -0,0 +1,356 @@
+From 99c350f5550237cf14e6d90149e87837b995c11b Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Fri, 10 Mar 2023 17:43:57 +0000
+Subject: [PATCH] media: imx219: Advertise embedded data node on media
+ pad 1
+
+This commit updates the imx219 driver to adverise support for embedded
+data streams.  This can then be used by the bcm2835-unicam driver, which
+has recently been updated to expose the embedded data stream to
+userland.
+
+The imx219 sensor subdevice overloads the media pad to differentiate
+between image stream (pad 0) and embedded data stream (pad 1) when
+performing the v4l2_subdev_pad_ops functions.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/imx219.c | 243 ++++++++++++++++++++++++-------------
+ 1 file changed, 161 insertions(+), 82 deletions(-)
+
+--- a/drivers/media/i2c/imx219.c
++++ b/drivers/media/i2c/imx219.c
+@@ -126,6 +126,16 @@
+ #define IMX219_PIXEL_ARRAY_WIDTH	3280U
+ #define IMX219_PIXEL_ARRAY_HEIGHT	2464U
+ 
++/* Embedded metadata stream structure */
++#define IMX219_EMBEDDED_LINE_WIDTH 16384
++#define IMX219_NUM_EMBEDDED_LINES 1
++
++enum pad_types {
++	IMAGE_PAD,
++	METADATA_PAD,
++	NUM_PADS
++};
++
+ struct imx219_reg {
+ 	u16 address;
+ 	u8 val;
+@@ -448,7 +458,7 @@ static const struct imx219_mode supporte
+ 
+ struct imx219 {
+ 	struct v4l2_subdev sd;
+-	struct media_pad pad;
++	struct media_pad pad[NUM_PADS];
+ 
+ 	struct v4l2_mbus_framefmt fmt;
+ 
+@@ -598,18 +608,26 @@ static void imx219_set_default_format(st
+ static int imx219_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
+ {
+ 	struct imx219 *imx219 = to_imx219(sd);
+-	struct v4l2_mbus_framefmt *try_fmt =
+-		v4l2_subdev_get_try_format(sd, fh->state, 0);
++	struct v4l2_mbus_framefmt *try_fmt_img =
++		v4l2_subdev_get_try_format(sd, fh->state, IMAGE_PAD);
++	struct v4l2_mbus_framefmt *try_fmt_meta =
++		v4l2_subdev_get_try_format(sd, fh->state, METADATA_PAD);
+ 	struct v4l2_rect *try_crop;
+ 
+ 	mutex_lock(&imx219->mutex);
+ 
+ 	/* Initialize try_fmt */
+-	try_fmt->width = supported_modes[0].width;
+-	try_fmt->height = supported_modes[0].height;
+-	try_fmt->code = imx219_get_format_code(imx219,
+-					       MEDIA_BUS_FMT_SRGGB10_1X10);
+-	try_fmt->field = V4L2_FIELD_NONE;
++	try_fmt_img->width = supported_modes[0].width;
++	try_fmt_img->height = supported_modes[0].height;
++	try_fmt_img->code = imx219_get_format_code(imx219,
++						   MEDIA_BUS_FMT_SRGGB10_1X10);
++	try_fmt_img->field = V4L2_FIELD_NONE;
++
++	/* Initialize try_fmt for the embedded metadata pad */
++	try_fmt_meta->width = IMX219_EMBEDDED_LINE_WIDTH;
++	try_fmt_meta->height = IMX219_NUM_EMBEDDED_LINES;
++	try_fmt_meta->code = MEDIA_BUS_FMT_SENSOR_DATA;
++	try_fmt_meta->field = V4L2_FIELD_NONE;
+ 
+ 	/* Initialize try_crop rectangle. */
+ 	try_crop = v4l2_subdev_get_try_crop(sd, fh->state, 0);
+@@ -723,12 +741,22 @@ static int imx219_enum_mbus_code(struct
+ {
+ 	struct imx219 *imx219 = to_imx219(sd);
+ 
+-	if (code->index >= (ARRAY_SIZE(codes) / 4))
++	if (code->pad >= NUM_PADS)
+ 		return -EINVAL;
+ 
+-	mutex_lock(&imx219->mutex);
+-	code->code = imx219_get_format_code(imx219, codes[code->index * 4]);
+-	mutex_unlock(&imx219->mutex);
++	if (code->pad == IMAGE_PAD) {
++		if (code->index >= (ARRAY_SIZE(codes) / 4))
++			return -EINVAL;
++
++		mutex_lock(&imx219->mutex);
++		code->code = imx219_get_format_code(imx219, codes[code->index * 4]);
++		mutex_unlock(&imx219->mutex);
++	} else {
++		if (code->index > 0)
++			return -EINVAL;
++
++		code->code = MEDIA_BUS_FMT_SENSOR_DATA;
++	}
+ 
+ 	return 0;
+ }
+@@ -740,19 +768,32 @@ static int imx219_enum_frame_size(struct
+ 	struct imx219 *imx219 = to_imx219(sd);
+ 	u32 code;
+ 
+-	if (fse->index >= ARRAY_SIZE(supported_modes))
++	if (fse->pad >= NUM_PADS)
+ 		return -EINVAL;
+ 
+-	mutex_lock(&imx219->mutex);
+-	code = imx219_get_format_code(imx219, fse->code);
+-	mutex_unlock(&imx219->mutex);
+-	if (fse->code != code)
+-		return -EINVAL;
++	if (fse->pad == IMAGE_PAD) {
++		if (fse->index >= ARRAY_SIZE(supported_modes))
++			return -EINVAL;
++
++		mutex_lock(&imx219->mutex);
++		code = imx219_get_format_code(imx219, fse->code);
++		mutex_unlock(&imx219->mutex);
++		if (fse->code != code)
++			return -EINVAL;
++
++		fse->min_width = supported_modes[fse->index].width;
++		fse->max_width = fse->min_width;
++		fse->min_height = supported_modes[fse->index].height;
++		fse->max_height = fse->min_height;
++	} else {
++		if (fse->code != MEDIA_BUS_FMT_SENSOR_DATA || fse->index > 0)
++			return -EINVAL;
+ 
+-	fse->min_width = supported_modes[fse->index].width;
+-	fse->max_width = fse->min_width;
+-	fse->min_height = supported_modes[fse->index].height;
+-	fse->max_height = fse->min_height;
++		fse->min_width = IMX219_EMBEDDED_LINE_WIDTH;
++		fse->max_width = fse->min_width;
++		fse->min_height = IMX219_NUM_EMBEDDED_LINES;
++		fse->max_height = fse->min_height;
++	}
+ 
+ 	return 0;
+ }
+@@ -767,9 +808,9 @@ static void imx219_reset_colorspace(stru
+ 	fmt->xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(fmt->colorspace);
+ }
+ 
+-static void imx219_update_pad_format(struct imx219 *imx219,
+-				     const struct imx219_mode *mode,
+-				     struct v4l2_subdev_format *fmt)
++static void imx219_update_image_pad_format(struct imx219 *imx219,
++					   const struct imx219_mode *mode,
++					   struct v4l2_subdev_format *fmt)
+ {
+ 	fmt->format.width = mode->width;
+ 	fmt->format.height = mode->height;
+@@ -777,21 +818,39 @@ static void imx219_update_pad_format(str
+ 	imx219_reset_colorspace(&fmt->format);
+ }
+ 
++static void imx219_update_metadata_pad_format(struct v4l2_subdev_format *fmt)
++{
++	fmt->format.width = IMX219_EMBEDDED_LINE_WIDTH;
++	fmt->format.height = IMX219_NUM_EMBEDDED_LINES;
++	fmt->format.code = MEDIA_BUS_FMT_SENSOR_DATA;
++	fmt->format.field = V4L2_FIELD_NONE;
++}
++
+ static int __imx219_get_pad_format(struct imx219 *imx219,
+ 				   struct v4l2_subdev_state *sd_state,
+ 				   struct v4l2_subdev_format *fmt)
+ {
++	if (fmt->pad >= NUM_PADS)
++		return -EINVAL;
++
+ 	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
+ 		struct v4l2_mbus_framefmt *try_fmt =
+ 			v4l2_subdev_get_try_format(&imx219->sd, sd_state,
+ 						   fmt->pad);
+ 		/* update the code which could change due to vflip or hflip: */
+-		try_fmt->code = imx219_get_format_code(imx219, try_fmt->code);
++		try_fmt->code = fmt->pad == IMAGE_PAD ?
++				imx219_get_format_code(imx219, try_fmt->code) :
++				MEDIA_BUS_FMT_SENSOR_DATA;
+ 		fmt->format = *try_fmt;
+ 	} else {
+-		imx219_update_pad_format(imx219, imx219->mode, fmt);
+-		fmt->format.code = imx219_get_format_code(imx219,
+-							  imx219->fmt.code);
++		if (fmt->pad == IMAGE_PAD) {
++			imx219_update_image_pad_format(imx219, imx219->mode,
++						       fmt);
++			fmt->format.code = imx219_get_format_code(imx219,
++								  imx219->fmt.code);
++		} else {
++			imx219_update_metadata_pad_format(fmt);
++		}
+ 	}
+ 
+ 	return 0;
+@@ -821,59 +880,78 @@ static int imx219_set_pad_format(struct
+ 	int exposure_max, exposure_def, hblank;
+ 	unsigned int i;
+ 
+-	mutex_lock(&imx219->mutex);
+-
+-	for (i = 0; i < ARRAY_SIZE(codes); i++)
+-		if (codes[i] == fmt->format.code)
+-			break;
+-	if (i >= ARRAY_SIZE(codes))
+-		i = 0;
++	if (fmt->pad >= NUM_PADS)
++		return -EINVAL;
+ 
+-	/* Bayer order varies with flips */
+-	fmt->format.code = imx219_get_format_code(imx219, codes[i]);
++	mutex_lock(&imx219->mutex);
+ 
+-	mode = v4l2_find_nearest_size(supported_modes,
+-				      ARRAY_SIZE(supported_modes),
+-				      width, height,
+-				      fmt->format.width, fmt->format.height);
+-	imx219_update_pad_format(imx219, mode, fmt);
+-	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
+-		framefmt = v4l2_subdev_get_try_format(sd, sd_state, fmt->pad);
+-		*framefmt = fmt->format;
+-	} else if (imx219->mode != mode ||
+-		   imx219->fmt.code != fmt->format.code) {
+-		u32 prev_hts = imx219->mode->width + imx219->hblank->val;
+-
+-		imx219->fmt = fmt->format;
+-		imx219->mode = mode;
+-		/* Update limits and set FPS to default */
+-		__v4l2_ctrl_modify_range(imx219->vblank, IMX219_VBLANK_MIN,
+-					 IMX219_VTS_MAX - mode->height, 1,
+-					 mode->vts_def - mode->height);
+-		__v4l2_ctrl_s_ctrl(imx219->vblank,
+-				   mode->vts_def - mode->height);
+-		/* Update max exposure while meeting expected vblanking */
+-		exposure_max = mode->vts_def - 4;
+-		exposure_def = (exposure_max < IMX219_EXPOSURE_DEFAULT) ?
+-			exposure_max : IMX219_EXPOSURE_DEFAULT;
+-		__v4l2_ctrl_modify_range(imx219->exposure,
+-					 imx219->exposure->minimum,
+-					 exposure_max, imx219->exposure->step,
+-					 exposure_def);
+-		/*
+-		 * Retain PPL setting from previous mode so that the
+-		 * line time does not change on a mode change.
+-		 * Limits have to be recomputed as the controls define
+-		 * the blanking only, so PPL values need to have the
+-		 * mode width subtracted.
+-		 */
+-		hblank = prev_hts - mode->width;
+-		__v4l2_ctrl_modify_range(imx219->hblank,
+-					 IMX219_PPL_MIN - mode->width,
+-					 IMX219_PPL_MAX - mode->width,
+-					 1,
+-					 IMX219_PPL_MIN - mode->width);
+-		__v4l2_ctrl_s_ctrl(imx219->hblank, hblank);
++	if (fmt->pad == IMAGE_PAD) {
++		for (i = 0; i < ARRAY_SIZE(codes); i++)
++			if (codes[i] == fmt->format.code)
++				break;
++		if (i >= ARRAY_SIZE(codes))
++			i = 0;
++
++		/* Bayer order varies with flips */
++		fmt->format.code = imx219_get_format_code(imx219, codes[i]);
++
++		mode = v4l2_find_nearest_size(supported_modes,
++					      ARRAY_SIZE(supported_modes),
++					      width, height,
++					      fmt->format.width,
++					      fmt->format.height);
++		imx219_update_image_pad_format(imx219, mode, fmt);
++		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++			framefmt = v4l2_subdev_get_try_format(sd, sd_state,
++							      fmt->pad);
++			*framefmt = fmt->format;
++		} else if (imx219->mode != mode ||
++			   imx219->fmt.code != fmt->format.code) {
++			u32 prev_hts = imx219->mode->width + imx219->hblank->val;
++
++			imx219->fmt = fmt->format;
++			imx219->mode = mode;
++			/* Update limits and set FPS to default */
++			__v4l2_ctrl_modify_range(imx219->vblank,
++						 IMX219_VBLANK_MIN,
++						 IMX219_VTS_MAX - mode->height,
++						 1,
++						 mode->vts_def - mode->height);
++			__v4l2_ctrl_s_ctrl(imx219->vblank,
++					   mode->vts_def - mode->height);
++			/* Update max exposure while meeting expected vblanking */
++			exposure_max = mode->vts_def - 4;
++			exposure_def = (exposure_max < IMX219_EXPOSURE_DEFAULT) ?
++				exposure_max : IMX219_EXPOSURE_DEFAULT;
++			__v4l2_ctrl_modify_range(imx219->exposure,
++						 imx219->exposure->minimum,
++						 exposure_max,
++						 imx219->exposure->step,
++						 exposure_def);
++			/*
++			 * Retain PPL setting from previous mode so that the
++			 * line time does not change on a mode change.
++			 * Limits have to be recomputed as the controls define
++			 * the blanking only, so PPL values need to have the
++			 * mode width subtracted.
++			 */
++			hblank = prev_hts - mode->width;
++			__v4l2_ctrl_modify_range(imx219->hblank,
++						 IMX219_PPL_MIN - mode->width,
++						 IMX219_PPL_MAX - mode->width,
++						 1,
++						 IMX219_PPL_MIN - mode->width);
++			__v4l2_ctrl_s_ctrl(imx219->hblank, hblank);
++		}
++	} else {
++		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++			framefmt = v4l2_subdev_get_try_format(sd, sd_state,
++							      fmt->pad);
++			*framefmt = fmt->format;
++		} else {
++			/* Only one embedded data mode is supported */
++			imx219_update_metadata_pad_format(fmt);
++		}
+ 	}
+ 
+ 	mutex_unlock(&imx219->mutex);
+@@ -1490,12 +1568,13 @@ static int imx219_probe(struct i2c_clien
+ 	imx219->sd.entity.function = MEDIA_ENT_F_CAM_SENSOR;
+ 
+ 	/* Initialize source pad */
+-	imx219->pad.flags = MEDIA_PAD_FL_SOURCE;
++	imx219->pad[IMAGE_PAD].flags = MEDIA_PAD_FL_SOURCE;
++	imx219->pad[METADATA_PAD].flags = MEDIA_PAD_FL_SOURCE;
+ 
+ 	/* Initialize default format */
+ 	imx219_set_default_format(imx219);
+ 
+-	ret = media_entity_pads_init(&imx219->sd.entity, 1, &imx219->pad);
++	ret = media_entity_pads_init(&imx219->sd.entity, NUM_PADS, imx219->pad);
+ 	if (ret) {
+ 		dev_err(dev, "failed to init entity pads: %d\n", ret);
+ 		goto error_handler_free;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0592-drm-vc4-drop-unnecessary-and-harmful-HDMI-RGB-format.patch b/target/linux/bcm27xx/patches-6.1/950-0592-drm-vc4-drop-unnecessary-and-harmful-HDMI-RGB-format.patch
new file mode 100644
index 00000000000000..61da526f7078d2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0592-drm-vc4-drop-unnecessary-and-harmful-HDMI-RGB-format.patch
@@ -0,0 +1,37 @@
+From d2bcf55697d2fcdbbc7752779e9d35ff84d8975e Mon Sep 17 00:00:00 2001
+From: Matthias Reichl <hias@horus.com>
+Date: Sat, 11 Mar 2023 22:41:17 +0100
+Subject: [PATCH] drm/vc4: drop unnecessary and harmful HDMI RGB format
+ check
+
+RGB is a mandatory format for all DVI and HDMI monitors so there's
+no need to check for presence of the DRM_COLOR_FORMAT_RGB444 bit in
+color_formats.
+
+More importantly this checks breaks working around EDID issues with
+eg video=HDMI-A-1:1024x768D or drm.edid_firmware=edid/1024x768.bin
+as the RGB444 bit is only set when a valid EDID with digital bit set in
+the input byte is present - which isn't the case when no EDID can be
+read from the display device at all or with the in-built kernel EDIDs,
+which mimic analog (VGA) displays without the digital bit set.
+
+So drop the check, if we output video on the HDMI connector we can
+assume that the display can accept 8bit RGB.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -1962,9 +1962,6 @@ vc4_hdmi_sink_supports_format_bpc(const
+ 	case VC4_HDMI_OUTPUT_RGB:
+ 		drm_dbg(dev, "RGB Format, checking the constraints.\n");
+ 
+-		if (!(info->color_formats & DRM_COLOR_FORMAT_RGB444))
+-			return false;
+-
+ 		if (bpc == 10 && !(info->edid_hdmi_rgb444_dc_modes & DRM_EDID_HDMI_DC_30)) {
+ 			drm_dbg(dev, "10 BPC but sink doesn't support Deep Color 30.\n");
+ 			return false;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0593-dt-bindings-media-i2c-Add-IMX296-CMOS-sensor-binding.patch b/target/linux/bcm27xx/patches-6.1/950-0593-dt-bindings-media-i2c-Add-IMX296-CMOS-sensor-binding.patch
new file mode 100644
index 00000000000000..cfdeef78abad58
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0593-dt-bindings-media-i2c-Add-IMX296-CMOS-sensor-binding.patch
@@ -0,0 +1,145 @@
+From 7ed07a716b1aab15c91a3238dacbc1fc76ace567 Mon Sep 17 00:00:00 2001
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Date: Tue, 23 Aug 2022 03:58:21 +0300
+Subject: [PATCH] dt-bindings: media: i2c: Add IMX296 CMOS sensor
+ binding
+
+Add YAML devicetree binding for IMX296 CMOS image sensor. Let's also
+add MAINTAINERS entry for the binding and driver.
+
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ .../bindings/media/i2c/sony,imx296.yaml       | 106 ++++++++++++++++++
+ MAINTAINERS                                   |   8 ++
+ 2 files changed, 114 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/sony,imx296.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/sony,imx296.yaml
+@@ -0,0 +1,106 @@
++# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/media/i2c/sony,imx296.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Sony IMX296 1/2.8-Inch CMOS Image Sensor
++
++maintainers:
++  - Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
++  - Laurent Pinchart <laurent.pinchart@ideasonboard.com>
++
++description: |-
++  The Sony IMX296 is a 1/2.9-Inch active pixel type CMOS Solid-state image
++  sensor with square pixel array and 1.58 M effective pixels. This chip
++  features a global shutter with variable charge-integration time. It is
++  programmable through I2C and 4-wire interfaces. The sensor output is
++  available via CSI-2 serial data output (1 Lane).
++
++properties:
++  compatible:
++    enum:
++      - sony,imx296
++      - sony,imx296ll
++      - sony,imx296lq
++    description:
++      The IMX296 sensor exists in two different models, a colour variant
++      (IMX296LQ) and a monochrome variant (IMX296LL). The device exposes the
++      model through registers, allowing for auto-detection with a common
++      "sony,imx296" compatible string. However, some camera modules disable the
++      ability to read the sensor model register, which disables this feature.
++      In those cases, the exact model needs to be specified as "sony,imx296ll"
++      or "sony,imx296lq".
++
++  reg:
++    maxItems: 1
++
++  clocks:
++    maxItems: 1
++
++  clock-names:
++    description: Input clock (37.125 MHz, 54 MHz or 74.25 MHz)
++    items:
++      - const: inck
++
++  avdd-supply:
++    description: Analog power supply (3.3V)
++
++  dvdd-supply:
++    description: Digital power supply (1.2V)
++
++  ovdd-supply:
++    description: Interface power supply (1.8V)
++
++  reset-gpios:
++    description: Sensor reset (XCLR) GPIO
++    maxItems: 1
++
++  port:
++    $ref: /schemas/graph.yaml#/properties/port
++
++required:
++  - compatible
++  - reg
++  - clocks
++  - clock-names
++  - avdd-supply
++  - dvdd-supply
++  - ovdd-supply
++  - port
++
++additionalProperties: false
++
++examples:
++  - |
++    #include <dt-bindings/gpio/gpio.h>
++
++    i2c {
++        #address-cells = <1>;
++        #size-cells = <0>;
++
++        imx296: camera-sensor@1a {
++            compatible = "sony,imx296";
++            reg = <0x1a>;
++
++            pinctrl-names = "default";
++            pinctrl-0 = <&camera_rear_default>;
++
++            clocks = <&gcc 90>;
++            clock-names = "inck";
++
++            avdd-supply = <&camera_vdda_3v3>;
++            dvdd-supply = <&camera_vddd_1v2>;
++            ovdd-supply = <&camera_vddo_1v8>;
++
++            reset-gpios = <&msmgpio 35 GPIO_ACTIVE_LOW>;
++
++            port {
++                imx296_ep: endpoint {
++                    remote-endpoint = <&csiphy0_ep>;
++                };
++            };
++        };
++    };
++
++...
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -19270,6 +19270,14 @@ T:	git git://linuxtv.org/media_tree.git
+ F:	Documentation/devicetree/bindings/media/i2c/imx290.txt
+ F:	drivers/media/i2c/imx290.c
+ 
++SONY IMX296 SENSOR DRIVER
++M:	Laurent Pinchart <laurent.pinchart@ideasonboard.com>
++M:	Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
++L:	linux-media@vger.kernel.org
++S:	Maintained
++T:	git git://linuxtv.org/media_tree.git
++F:	Documentation/devicetree/bindings/media/i2c/sony,imx296.yaml
++
+ SONY IMX319 SENSOR DRIVER
+ M:	Bingbu Cao <bingbu.cao@intel.com>
+ L:	linux-media@vger.kernel.org
diff --git a/target/linux/bcm27xx/patches-6.1/950-0594-media-i2c-IMX296-camera-sensor-driver.patch b/target/linux/bcm27xx/patches-6.1/950-0594-media-i2c-IMX296-camera-sensor-driver.patch
new file mode 100644
index 00000000000000..2581db28235159
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0594-media-i2c-IMX296-camera-sensor-driver.patch
@@ -0,0 +1,1240 @@
+From 1a08cc86d5da8bb08747277d8f46040b0fb0da3e Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Tue, 23 Aug 2022 03:58:22 +0300
+Subject: [PATCH] media: i2c: IMX296 camera sensor driver
+
+The IMX296LLR is a monochrome 1.60MP CMOS sensor from Sony. The driver
+supports cropping and binning (but not both at the same time due to
+hardware limitations) and exposure, gain, vertical blanking and test
+pattern controls.
+
+Preliminary support is also included for the color IMX296LQR sensor.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+[Sakari Ailus: Make driver's remove function return void]
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ MAINTAINERS                |    1 +
+ drivers/media/i2c/Kconfig  |   13 +
+ drivers/media/i2c/Makefile |    1 +
+ drivers/media/i2c/imx296.c | 1172 ++++++++++++++++++++++++++++++++++++
+ 4 files changed, 1187 insertions(+)
+ create mode 100644 drivers/media/i2c/imx296.c
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -19277,6 +19277,7 @@ L:	linux-media@vger.kernel.org
+ S:	Maintained
+ T:	git git://linuxtv.org/media_tree.git
+ F:	Documentation/devicetree/bindings/media/i2c/sony,imx296.yaml
++F:	drivers/media/i2c/imx296.c
+ 
+ SONY IMX319 SENSOR DRIVER
+ M:	Bingbu Cao <bingbu.cao@intel.com>
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -184,6 +184,19 @@ config VIDEO_IMX290
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called imx290.
+ 
++config VIDEO_IMX296
++	tristate "Sony IMX296 sensor support"
++	depends on I2C && VIDEO_DEV
++	select MEDIA_CONTROLLER
++	select V4L2_FWNODE
++	select VIDEO_V4L2_SUBDEV_API
++	help
++	  This is a Video4Linux2 sensor driver for the Sony
++	  IMX296 camera.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called imx296.
++
+ config VIDEO_IMX319
+ 	tristate "Sony IMX319 sensor support"
+ 	depends on I2C && VIDEO_DEV
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -46,6 +46,7 @@ obj-$(CONFIG_VIDEO_IMX219) += imx219.o
+ obj-$(CONFIG_VIDEO_IMX258) += imx258.o
+ obj-$(CONFIG_VIDEO_IMX274) += imx274.o
+ obj-$(CONFIG_VIDEO_IMX290) += imx290.o
++obj-$(CONFIG_VIDEO_IMX296) += imx296.o
+ obj-$(CONFIG_VIDEO_IMX319) += imx319.o
+ obj-$(CONFIG_VIDEO_IMX334) += imx334.o
+ obj-$(CONFIG_VIDEO_IMX335) += imx335.o
+--- /dev/null
++++ b/drivers/media/i2c/imx296.c
+@@ -0,0 +1,1172 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Driver for IMX296 CMOS Image Sensor from Sony
++ *
++ * Copyright 2019 Laurent Pinchart <laurent.pinchart@ideasonboard.com>
++ */
++
++#include <linux/clk.h>
++#include <linux/gpio/consumer.h>
++#include <linux/i2c.h>
++#include <linux/module.h>
++#include <linux/of_device.h>
++#include <linux/pm_runtime.h>
++#include <linux/regmap.h>
++#include <linux/regulator/consumer.h>
++#include <linux/slab.h>
++#include <linux/videodev2.h>
++
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-fwnode.h>
++#include <media/v4l2-subdev.h>
++
++#define IMX296_PIXEL_ARRAY_WIDTH			1456
++#define IMX296_PIXEL_ARRAY_HEIGHT			1088
++
++#define IMX296_REG_8BIT(n)				((1 << 16) | (n))
++#define IMX296_REG_16BIT(n)				((2 << 16) | (n))
++#define IMX296_REG_24BIT(n)				((3 << 16) | (n))
++#define IMX296_REG_SIZE_SHIFT				16
++#define IMX296_REG_ADDR_MASK				0xffff
++
++#define IMX296_CTRL00					IMX296_REG_8BIT(0x3000)
++#define IMX296_CTRL00_STANDBY				BIT(0)
++#define IMX296_CTRL08					IMX296_REG_8BIT(0x3008)
++#define IMX296_CTRL08_REGHOLD				BIT(0)
++#define IMX296_CTRL0A					IMX296_REG_8BIT(0x300a)
++#define IMX296_CTRL0A_XMSTA				BIT(0)
++#define IMX296_CTRL0B					IMX296_REG_8BIT(0x300b)
++#define IMX296_CTRL0B_TRIGEN				BIT(0)
++#define IMX296_CTRL0D					IMX296_REG_8BIT(0x300d)
++#define IMX296_CTRL0D_WINMODE_ALL			(0 << 0)
++#define IMX296_CTRL0D_WINMODE_FD_BINNING		(2 << 0)
++#define IMX296_CTRL0D_HADD_ON_BINNING			BIT(5)
++#define IMX296_CTRL0D_SAT_CNT				BIT(6)
++#define IMX296_CTRL0E					IMX296_REG_8BIT(0x300e)
++#define IMX296_CTRL0E_VREVERSE				BIT(0)
++#define IMX296_CTRL0E_HREVERSE				BIT(1)
++#define IMX296_VMAX					IMX296_REG_24BIT(0x3010)
++#define IMX296_HMAX					IMX296_REG_16BIT(0x3014)
++#define IMX296_TMDCTRL					IMX296_REG_8BIT(0x301d)
++#define IMX296_TMDCTRL_LATCH				BIT(0)
++#define IMX296_TMDOUT					IMX296_REG_16BIT(0x301e)
++#define IMX296_TMDOUT_MASK				0x3ff
++#define IMX296_WDSEL					IMX296_REG_8BIT(0x3021)
++#define IMX296_WDSEL_NORMAL				(0 << 0)
++#define IMX296_WDSEL_MULTI_2				(1 << 0)
++#define IMX296_WDSEL_MULTI_4				(3 << 0)
++#define IMX296_BLKLEVELAUTO				IMX296_REG_8BIT(0x3022)
++#define IMX296_BLKLEVELAUTO_ON				0x01
++#define IMX296_BLKLEVELAUTO_OFF				0xf0
++#define IMX296_SST					IMX296_REG_8BIT(0x3024)
++#define IMX296_SST_EN					BIT(0)
++#define IMX296_CTRLTOUT					IMX296_REG_8BIT(0x3026)
++#define IMX296_CTRLTOUT_TOUT1SEL_LOW			(0 << 0)
++#define IMX296_CTRLTOUT_TOUT1SEL_PULSE			(3 << 0)
++#define IMX296_CTRLTOUT_TOUT2SEL_LOW			(0 << 2)
++#define IMX296_CTRLTOUT_TOUT2SEL_PULSE			(3 << 2)
++#define IMX296_CTRLTRIG					IMX296_REG_8BIT(0x3029)
++#define IMX296_CTRLTRIG_TOUT1_SEL_LOW			(0 << 0)
++#define IMX296_CTRLTRIG_TOUT1_SEL_PULSE1		(1 << 0)
++#define IMX296_CTRLTRIG_TOUT2_SEL_LOW			(0 << 4)
++#define IMX296_CTRLTRIG_TOUT2_SEL_PULSE2		(2 << 4)
++#define IMX296_SYNCSEL					IMX296_REG_8BIT(0x3036)
++#define IMX296_SYNCSEL_NORMAL				0xc0
++#define IMX296_SYNCSEL_HIZ				0xf0
++#define IMX296_PULSE1					IMX296_REG_8BIT(0x306d)
++#define IMX296_PULSE1_EN_NOR				BIT(0)
++#define IMX296_PULSE1_EN_TRIG				BIT(1)
++#define IMX296_PULSE1_POL_HIGH				(0 << 2)
++#define IMX296_PULSE1_POL_LOW				(1 << 2)
++#define IMX296_PULSE1_UP				IMX296_REG_24BIT(0x3070)
++#define IMX296_PULSE1_DN				IMX296_REG_24BIT(0x3074)
++#define IMX296_PULSE2					IMX296_REG_8BIT(0x3079)
++#define IMX296_PULSE2_EN_NOR				BIT(0)
++#define IMX296_PULSE2_EN_TRIG				BIT(1)
++#define IMX296_PULSE2_POL_HIGH				(0 << 2)
++#define IMX296_PULSE2_POL_LOW				(1 << 2)
++#define IMX296_PULSE2_UP				IMX296_REG_24BIT(0x307c)
++#define IMX296_PULSE2_DN				IMX296_REG_24BIT(0x3080)
++#define IMX296_INCKSEL(n)				IMX296_REG_8BIT(0x3089 + (n))
++#define IMX296_SHS1					IMX296_REG_24BIT(0x308d)
++#define IMX296_SHS2					IMX296_REG_24BIT(0x3090)
++#define IMX296_SHS3					IMX296_REG_24BIT(0x3094)
++#define IMX296_SHS4					IMX296_REG_24BIT(0x3098)
++#define IMX296_VBLANKLP					IMX296_REG_8BIT(0x309c)
++#define IMX296_VBLANKLP_NORMAL				0x04
++#define IMX296_VBLANKLP_LOW_POWER			0x2c
++#define IMX296_EXP_CNT					IMX296_REG_8BIT(0x30a3)
++#define IMX296_EXP_CNT_RESET				BIT(0)
++#define IMX296_EXP_MAX					IMX296_REG_16BIT(0x30a6)
++#define IMX296_VINT					IMX296_REG_8BIT(0x30aa)
++#define IMX296_VINT_EN					BIT(0)
++#define IMX296_LOWLAGTRG				IMX296_REG_8BIT(0x30ae)
++#define IMX296_LOWLAGTRG_FAST				BIT(0)
++#define IMX296_I2CCTRL					IMX296_REG_8BIT(0x30ef)
++#define IMX296_I2CCTRL_I2CACKEN				BIT(0)
++
++#define IMX296_SENSOR_INFO				IMX296_REG_16BIT(0x3148)
++#define IMX296_SENSOR_INFO_MONO				BIT(15)
++#define IMX296_SENSOR_INFO_IMX296LQ			0x4a00
++#define IMX296_SENSOR_INFO_IMX296LL			0xca00
++#define IMX296_S_SHSA					IMX296_REG_16BIT(0x31ca)
++#define IMX296_S_SHSB					IMX296_REG_16BIT(0x31d2)
++/*
++ * Registers 0x31c8 to 0x31cd, 0x31d0 to 0x31d5, 0x31e2, 0x31e3, 0x31ea and
++ * 0x31eb are related to exposure mode but otherwise not documented.
++ */
++
++#define IMX296_GAINCTRL					IMX296_REG_8BIT(0x3200)
++#define IMX296_GAINCTRL_WD_GAIN_MODE_NORMAL		0x01
++#define IMX296_GAINCTRL_WD_GAIN_MODE_MULTI		0x41
++#define IMX296_GAIN					IMX296_REG_16BIT(0x3204)
++#define IMX296_GAIN_MIN					0
++#define IMX296_GAIN_MAX					480
++#define IMX296_GAIN1					IMX296_REG_16BIT(0x3208)
++#define IMX296_GAIN2					IMX296_REG_16BIT(0x320c)
++#define IMX296_GAIN3					IMX296_REG_16BIT(0x3210)
++#define IMX296_GAINDLY					IMX296_REG_8BIT(0x3212)
++#define IMX296_GAINDLY_NONE				0x08
++#define IMX296_GAINDLY_1FRAME				0x09
++#define IMX296_PGCTRL					IMX296_REG_8BIT(0x3238)
++#define IMX296_PGCTRL_REGEN				BIT(0)
++#define IMX296_PGCTRL_THRU				BIT(1)
++#define IMX296_PGCTRL_CLKEN				BIT(2)
++#define IMX296_PGCTRL_MODE(n)				((n) << 3)
++#define IMX296_PGHPOS					IMX296_REG_16BIT(0x3239)
++#define IMX296_PGVPOS					IMX296_REG_16BIT(0x323c)
++#define IMX296_PGHPSTEP					IMX296_REG_8BIT(0x323e)
++#define IMX296_PGVPSTEP					IMX296_REG_8BIT(0x323f)
++#define IMX296_PGHPNUM					IMX296_REG_8BIT(0x3240)
++#define IMX296_PGVPNUM					IMX296_REG_8BIT(0x3241)
++#define IMX296_PGDATA1					IMX296_REG_16BIT(0x3244)
++#define IMX296_PGDATA2					IMX296_REG_16BIT(0x3246)
++#define IMX296_PGHGSTEP					IMX296_REG_8BIT(0x3249)
++#define IMX296_BLKLEVEL					IMX296_REG_16BIT(0x3254)
++
++#define IMX296_FID0_ROI					IMX296_REG_8BIT(0x3300)
++#define IMX296_FID0_ROIH1ON				BIT(0)
++#define IMX296_FID0_ROIV1ON				BIT(1)
++#define IMX296_FID0_ROIPH1				IMX296_REG_16BIT(0x3310)
++#define IMX296_FID0_ROIPV1				IMX296_REG_16BIT(0x3312)
++#define IMX296_FID0_ROIWH1				IMX296_REG_16BIT(0x3314)
++#define IMX296_FID0_ROIWH1_MIN				80
++#define IMX296_FID0_ROIWV1				IMX296_REG_16BIT(0x3316)
++#define IMX296_FID0_ROIWV1_MIN				4
++
++#define IMX296_CM_HSST_STARTTMG				IMX296_REG_16BIT(0x4018)
++#define IMX296_CM_HSST_ENDTMG				IMX296_REG_16BIT(0x401a)
++#define IMX296_DA_HSST_STARTTMG				IMX296_REG_16BIT(0x404d)
++#define IMX296_DA_HSST_ENDTMG				IMX296_REG_16BIT(0x4050)
++#define IMX296_LM_HSST_STARTTMG				IMX296_REG_16BIT(0x4094)
++#define IMX296_LM_HSST_ENDTMG				IMX296_REG_16BIT(0x4096)
++#define IMX296_SST_SIEASTA1_SET				IMX296_REG_8BIT(0x40c9)
++#define IMX296_SST_SIEASTA1PRE_1U			IMX296_REG_16BIT(0x40cc)
++#define IMX296_SST_SIEASTA1PRE_1D			IMX296_REG_16BIT(0x40ce)
++#define IMX296_SST_SIEASTA1PRE_2U			IMX296_REG_16BIT(0x40d0)
++#define IMX296_SST_SIEASTA1PRE_2D			IMX296_REG_16BIT(0x40d2)
++#define IMX296_HSST					IMX296_REG_8BIT(0x40dc)
++#define IMX296_HSST_EN					BIT(2)
++
++#define IMX296_CKREQSEL					IMX296_REG_8BIT(0x4101)
++#define IMX296_CKREQSEL_HS				BIT(2)
++#define IMX296_GTTABLENUM				IMX296_REG_8BIT(0x4114)
++#define IMX296_CTRL418C					IMX296_REG_8BIT(0x418c)
++
++struct imx296_clk_params {
++	unsigned int freq;
++	u8 incksel[4];
++	u8 ctrl418c;
++};
++
++static const struct imx296_clk_params imx296_clk_params[] = {
++	{ 37125000, { 0x80, 0x0b, 0x80, 0x08 }, 116 },
++	{ 54000000, { 0xb0, 0x0f, 0xb0, 0x0c }, 168 },
++	{ 74250000, { 0x80, 0x0f, 0x80, 0x0c }, 232 },
++};
++
++static const char * const imx296_supply_names[] = {
++	"dvdd",
++	"ovdd",
++	"avdd",
++};
++
++struct imx296 {
++	struct device *dev;
++	struct clk *clk;
++	struct regulator_bulk_data supplies[ARRAY_SIZE(imx296_supply_names)];
++	struct gpio_desc *reset;
++	struct regmap *regmap;
++
++	const struct imx296_clk_params *clk_params;
++	bool mono;
++
++	bool streaming;
++
++	struct v4l2_subdev subdev;
++	struct media_pad pad;
++
++	struct v4l2_ctrl_handler ctrls;
++	struct v4l2_ctrl *hblank;
++	struct v4l2_ctrl *vblank;
++};
++
++static inline struct imx296 *to_imx296(struct v4l2_subdev *sd)
++{
++	return container_of(sd, struct imx296, subdev);
++}
++
++static int imx296_read(struct imx296 *sensor, u32 addr)
++{
++	u8 data[3] = { 0, 0, 0 };
++	int ret;
++
++	ret = regmap_raw_read(sensor->regmap, addr & IMX296_REG_ADDR_MASK, data,
++			      (addr >> IMX296_REG_SIZE_SHIFT) & 3);
++	if (ret < 0)
++		return ret;
++
++	return (data[2] << 16) | (data[1] << 8) | data[0];
++}
++
++static int imx296_write(struct imx296 *sensor, u32 addr, u32 value, int *err)
++{
++	u8 data[3] = { value & 0xff, (value >> 8) & 0xff, value >> 16 };
++	int ret;
++
++	if (err && *err)
++		return *err;
++
++	ret = regmap_raw_write(sensor->regmap, addr & IMX296_REG_ADDR_MASK,
++			       data, (addr >> IMX296_REG_SIZE_SHIFT) & 3);
++	if (ret < 0) {
++		dev_err(sensor->dev, "%u-bit write to 0x%04x failed: %d\n",
++			((addr >> IMX296_REG_SIZE_SHIFT) & 3) * 8,
++			addr & IMX296_REG_ADDR_MASK, ret);
++		if (err)
++			*err = ret;
++	}
++
++	return ret;
++}
++
++static int imx296_power_on(struct imx296 *sensor)
++{
++	int ret;
++
++	ret = regulator_bulk_enable(ARRAY_SIZE(sensor->supplies),
++				    sensor->supplies);
++	if (ret < 0)
++		return ret;
++
++	udelay(1);
++
++	ret = gpiod_direction_output(sensor->reset, 0);
++	if (ret < 0)
++		goto err_supply;
++
++	udelay(1);
++
++	ret = clk_prepare_enable(sensor->clk);
++	if (ret < 0)
++		goto err_reset;
++
++	/*
++	 * The documentation doesn't explicitly say how much time is required
++	 * after providing a clock and before starting I2C communication. It
++	 * mentions a delay of 20µs in 4-wire mode, but tests showed that a
++	 * delay of 100µs resulted in I2C communication failures, while 500µs
++	 * seems to be enough. Be conservative.
++	 */
++	usleep_range(1000, 2000);
++
++	return 0;
++
++err_reset:
++	gpiod_direction_output(sensor->reset, 1);
++err_supply:
++	regulator_bulk_disable(ARRAY_SIZE(sensor->supplies), sensor->supplies);
++	return ret;
++}
++
++static void imx296_power_off(struct imx296 *sensor)
++{
++	clk_disable_unprepare(sensor->clk);
++	gpiod_direction_output(sensor->reset, 1);
++	regulator_bulk_disable(ARRAY_SIZE(sensor->supplies), sensor->supplies);
++}
++
++/* -----------------------------------------------------------------------------
++ * Controls
++ */
++
++static const char * const imx296_test_pattern_menu[] = {
++	"Disabled",
++	"Multiple Pixels",
++	"Sequence 1",
++	"Sequence 2",
++	"Gradient",
++	"Row",
++	"Column",
++	"Cross",
++	"Stripe",
++	"Checks",
++};
++
++static int imx296_s_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct imx296 *sensor = container_of(ctrl->handler, struct imx296, ctrls);
++	const struct v4l2_mbus_framefmt *format;
++	struct v4l2_subdev_state *state;
++	unsigned int vmax;
++	int ret = 0;
++
++	if (!sensor->streaming)
++		return 0;
++
++	state = v4l2_subdev_get_locked_active_state(&sensor->subdev);
++	format = v4l2_subdev_get_pad_format(&sensor->subdev, state, 0);
++
++	switch (ctrl->id) {
++	case V4L2_CID_EXPOSURE:
++		/* Clamp the exposure value to VMAX. */
++		vmax = format->height + sensor->vblank->cur.val;
++		ctrl->val = min_t(int, ctrl->val, vmax);
++		imx296_write(sensor, IMX296_SHS1, vmax - ctrl->val, &ret);
++		break;
++
++	case V4L2_CID_ANALOGUE_GAIN:
++		imx296_write(sensor, IMX296_GAIN, ctrl->val, &ret);
++		break;
++
++	case V4L2_CID_VBLANK:
++		imx296_write(sensor, IMX296_VMAX, format->height + ctrl->val,
++			     &ret);
++		break;
++
++	case V4L2_CID_TEST_PATTERN:
++		if (ctrl->val) {
++			imx296_write(sensor, IMX296_PGHPOS, 8, &ret);
++			imx296_write(sensor, IMX296_PGVPOS, 8, &ret);
++			imx296_write(sensor, IMX296_PGHPSTEP, 8, &ret);
++			imx296_write(sensor, IMX296_PGVPSTEP, 8, &ret);
++			imx296_write(sensor, IMX296_PGHPNUM, 100, &ret);
++			imx296_write(sensor, IMX296_PGVPNUM, 100, &ret);
++			imx296_write(sensor, IMX296_PGDATA1, 0x300, &ret);
++			imx296_write(sensor, IMX296_PGDATA2, 0x100, &ret);
++			imx296_write(sensor, IMX296_PGHGSTEP, 0, &ret);
++			imx296_write(sensor, IMX296_BLKLEVEL, 0, &ret);
++			imx296_write(sensor, IMX296_BLKLEVELAUTO,
++				     IMX296_BLKLEVELAUTO_OFF, &ret);
++			imx296_write(sensor, IMX296_PGCTRL,
++				     IMX296_PGCTRL_REGEN |
++				     IMX296_PGCTRL_CLKEN |
++				     IMX296_PGCTRL_MODE(ctrl->val - 1), &ret);
++		} else {
++			imx296_write(sensor, IMX296_PGCTRL,
++				     IMX296_PGCTRL_CLKEN, &ret);
++			imx296_write(sensor, IMX296_BLKLEVEL, 0x3c, &ret);
++			imx296_write(sensor, IMX296_BLKLEVELAUTO,
++				     IMX296_BLKLEVELAUTO_ON, &ret);
++		}
++		break;
++
++	default:
++		ret = -EINVAL;
++		break;
++	}
++
++	return ret;
++}
++
++static const struct v4l2_ctrl_ops imx296_ctrl_ops = {
++	.s_ctrl = imx296_s_ctrl,
++};
++
++static int imx296_ctrls_init(struct imx296 *sensor)
++{
++	struct v4l2_fwnode_device_properties props;
++	unsigned int hblank;
++	int ret;
++
++	ret = v4l2_fwnode_device_parse(sensor->dev, &props);
++	if (ret < 0)
++		return ret;
++
++	v4l2_ctrl_handler_init(&sensor->ctrls, 9);
++
++	v4l2_ctrl_new_std(&sensor->ctrls, &imx296_ctrl_ops,
++			  V4L2_CID_EXPOSURE, 1, 1048575, 1, 1104);
++	v4l2_ctrl_new_std(&sensor->ctrls, &imx296_ctrl_ops,
++			  V4L2_CID_ANALOGUE_GAIN, IMX296_GAIN_MIN,
++			  IMX296_GAIN_MAX, 1, IMX296_GAIN_MIN);
++
++	/*
++	 * Horizontal blanking is controlled through the HMAX register, which
++	 * contains a line length in INCK clock units. The INCK frequency is
++	 * fixed to 74.25 MHz. The HMAX value is currently fixed to 1100,
++	 * convert it to a number of pixels based on the nominal pixel rate.
++	 */
++	hblank = 1100 * 1188000000ULL / 10 / 74250000
++	       - IMX296_PIXEL_ARRAY_WIDTH;
++	sensor->hblank = v4l2_ctrl_new_std(&sensor->ctrls, &imx296_ctrl_ops,
++					   V4L2_CID_HBLANK, hblank, hblank, 1,
++					   hblank);
++	if (sensor->hblank)
++		sensor->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	sensor->vblank = v4l2_ctrl_new_std(&sensor->ctrls, &imx296_ctrl_ops,
++					   V4L2_CID_VBLANK, 30,
++					   1048575 - IMX296_PIXEL_ARRAY_HEIGHT,
++					   1, 30);
++	/*
++	 * The sensor calculates the MIPI timings internally to achieve a bit
++	 * rate between 1122 and 1198 Mbps. The exact value is unfortunately not
++	 * reported, at least according to the documentation. Report a nominal
++	 * rate of 1188 Mbps as that is used by the datasheet in multiple
++	 * examples.
++	 */
++	v4l2_ctrl_new_std(&sensor->ctrls, NULL, V4L2_CID_PIXEL_RATE,
++			  1122000000 / 10, 1198000000 / 10, 1, 1188000000 / 10);
++	v4l2_ctrl_new_std_menu_items(&sensor->ctrls, &imx296_ctrl_ops,
++				     V4L2_CID_TEST_PATTERN,
++				     ARRAY_SIZE(imx296_test_pattern_menu) - 1,
++				     0, 0, imx296_test_pattern_menu);
++
++	v4l2_ctrl_new_fwnode_properties(&sensor->ctrls, &imx296_ctrl_ops,
++					&props);
++
++	if (sensor->ctrls.error) {
++		dev_err(sensor->dev, "failed to add controls (%d)\n",
++			sensor->ctrls.error);
++		v4l2_ctrl_handler_free(&sensor->ctrls);
++		return sensor->ctrls.error;
++	}
++
++	sensor->subdev.ctrl_handler = &sensor->ctrls;
++
++	return 0;
++}
++
++/* -----------------------------------------------------------------------------
++ * V4L2 Subdev Operations
++ */
++
++/*
++ * This table is extracted from vendor data that is entirely undocumented. The
++ * first register write is required to activate the CSI-2 output. The other
++ * entries may or may not be optional?
++ */
++static const struct {
++	unsigned int reg;
++	unsigned int value;
++} imx296_init_table[] = {
++	{ IMX296_REG_8BIT(0x3005), 0xf0 },
++	{ IMX296_REG_8BIT(0x309e), 0x04 },
++	{ IMX296_REG_8BIT(0x30a0), 0x04 },
++	{ IMX296_REG_8BIT(0x30a1), 0x3c },
++	{ IMX296_REG_8BIT(0x30a4), 0x5f },
++	{ IMX296_REG_8BIT(0x30a8), 0x91 },
++	{ IMX296_REG_8BIT(0x30ac), 0x28 },
++	{ IMX296_REG_8BIT(0x30af), 0x09 },
++	{ IMX296_REG_8BIT(0x30df), 0x00 },
++	{ IMX296_REG_8BIT(0x3165), 0x00 },
++	{ IMX296_REG_8BIT(0x3169), 0x10 },
++	{ IMX296_REG_8BIT(0x316a), 0x02 },
++	{ IMX296_REG_8BIT(0x31c8), 0xf3 },	/* Exposure-related */
++	{ IMX296_REG_8BIT(0x31d0), 0xf4 },	/* Exposure-related */
++	{ IMX296_REG_8BIT(0x321a), 0x00 },
++	{ IMX296_REG_8BIT(0x3226), 0x02 },
++	{ IMX296_REG_8BIT(0x3256), 0x01 },
++	{ IMX296_REG_8BIT(0x3541), 0x72 },
++	{ IMX296_REG_8BIT(0x3516), 0x77 },
++	{ IMX296_REG_8BIT(0x350b), 0x7f },
++	{ IMX296_REG_8BIT(0x3758), 0xa3 },
++	{ IMX296_REG_8BIT(0x3759), 0x00 },
++	{ IMX296_REG_8BIT(0x375a), 0x85 },
++	{ IMX296_REG_8BIT(0x375b), 0x00 },
++	{ IMX296_REG_8BIT(0x3832), 0xf5 },
++	{ IMX296_REG_8BIT(0x3833), 0x00 },
++	{ IMX296_REG_8BIT(0x38a2), 0xf6 },
++	{ IMX296_REG_8BIT(0x38a3), 0x00 },
++	{ IMX296_REG_8BIT(0x3a00), 0x80 },
++	{ IMX296_REG_8BIT(0x3d48), 0xa3 },
++	{ IMX296_REG_8BIT(0x3d49), 0x00 },
++	{ IMX296_REG_8BIT(0x3d4a), 0x85 },
++	{ IMX296_REG_8BIT(0x3d4b), 0x00 },
++	{ IMX296_REG_8BIT(0x400e), 0x58 },
++	{ IMX296_REG_8BIT(0x4014), 0x1c },
++	{ IMX296_REG_8BIT(0x4041), 0x2a },
++	{ IMX296_REG_8BIT(0x40a2), 0x06 },
++	{ IMX296_REG_8BIT(0x40c1), 0xf6 },
++	{ IMX296_REG_8BIT(0x40c7), 0x0f },
++	{ IMX296_REG_8BIT(0x40c8), 0x00 },
++	{ IMX296_REG_8BIT(0x4174), 0x00 },
++};
++
++static int imx296_setup(struct imx296 *sensor, struct v4l2_subdev_state *state)
++{
++	const struct v4l2_mbus_framefmt *format;
++	const struct v4l2_rect *crop;
++	unsigned int i;
++	int ret = 0;
++
++	format = v4l2_subdev_get_pad_format(&sensor->subdev, state, 0);
++	crop = v4l2_subdev_get_pad_crop(&sensor->subdev, state, 0);
++
++	for (i = 0; i < ARRAY_SIZE(imx296_init_table); ++i)
++		imx296_write(sensor, imx296_init_table[i].reg,
++			     imx296_init_table[i].value, &ret);
++
++	if (crop->width != IMX296_PIXEL_ARRAY_WIDTH ||
++	    crop->height != IMX296_PIXEL_ARRAY_HEIGHT) {
++		imx296_write(sensor, IMX296_FID0_ROI,
++			     IMX296_FID0_ROIH1ON | IMX296_FID0_ROIV1ON, &ret);
++		imx296_write(sensor, IMX296_FID0_ROIPH1, crop->left, &ret);
++		imx296_write(sensor, IMX296_FID0_ROIPV1, crop->top, &ret);
++		imx296_write(sensor, IMX296_FID0_ROIWH1, crop->width, &ret);
++		imx296_write(sensor, IMX296_FID0_ROIWV1, crop->height, &ret);
++	} else {
++		imx296_write(sensor, IMX296_FID0_ROI, 0, &ret);
++	}
++
++	imx296_write(sensor, IMX296_CTRL0D,
++		     (crop->width != format->width ?
++		      IMX296_CTRL0D_HADD_ON_BINNING : 0) |
++		     (crop->height != format->height ?
++		      IMX296_CTRL0D_WINMODE_FD_BINNING : 0),
++		     &ret);
++
++	/*
++	 * HMAX and VMAX configure horizontal and vertical blanking by
++	 * specifying the total line time and frame time respectively. The line
++	 * time is specified in operational clock units (which appears to be the
++	 * output of an internal PLL, fixed at 74.25 MHz regardless of the
++	 * exernal clock frequency), while the frame time is specified as a
++	 * number of lines.
++	 *
++	 * In the vertical direction the sensor outputs the following:
++	 *
++	 * - one line for the FS packet
++	 * - two lines of embedded data (DT 0x12)
++	 * - six null lines (DT 0x10)
++	 * - four lines of vertical effective optical black (DT 0x37)
++	 * - 8 to 1088 lines of active image data (RAW10, DT 0x2b)
++	 * - one line for the FE packet
++	 * - 16 or more lines of vertical blanking
++	 */
++	imx296_write(sensor, IMX296_HMAX, 1100, &ret);
++	imx296_write(sensor, IMX296_VMAX,
++		     format->height + sensor->vblank->cur.val, &ret);
++
++	for (i = 0; i < ARRAY_SIZE(sensor->clk_params->incksel); ++i)
++		imx296_write(sensor, IMX296_INCKSEL(i),
++			     sensor->clk_params->incksel[i], &ret);
++	imx296_write(sensor, IMX296_GTTABLENUM, 0xc5, &ret);
++	imx296_write(sensor, IMX296_CTRL418C, sensor->clk_params->ctrl418c,
++		     &ret);
++
++	imx296_write(sensor, IMX296_GAINDLY, IMX296_GAINDLY_NONE, &ret);
++	imx296_write(sensor, IMX296_BLKLEVEL, 0x03c, &ret);
++
++	return ret;
++}
++
++static int imx296_stream_on(struct imx296 *sensor)
++{
++	int ret = 0;
++
++	imx296_write(sensor, IMX296_CTRL00, 0, &ret);
++	usleep_range(2000, 5000);
++	imx296_write(sensor, IMX296_CTRL0A, 0, &ret);
++
++	return ret;
++}
++
++static int imx296_stream_off(struct imx296 *sensor)
++{
++	int ret = 0;
++
++	imx296_write(sensor, IMX296_CTRL0A, IMX296_CTRL0A_XMSTA, &ret);
++	imx296_write(sensor, IMX296_CTRL00, IMX296_CTRL00_STANDBY, &ret);
++
++	return ret;
++}
++
++static int imx296_s_stream(struct v4l2_subdev *sd, int enable)
++{
++	struct imx296 *sensor = to_imx296(sd);
++	struct v4l2_subdev_state *state;
++	int ret;
++
++	state = v4l2_subdev_lock_and_get_active_state(sd);
++
++	if (!enable) {
++		ret = imx296_stream_off(sensor);
++
++		pm_runtime_mark_last_busy(sensor->dev);
++		pm_runtime_put_autosuspend(sensor->dev);
++
++		sensor->streaming = false;
++
++		goto unlock;
++	}
++
++	ret = pm_runtime_resume_and_get(sensor->dev);
++	if (ret < 0)
++		goto unlock;
++
++	ret = imx296_setup(sensor, state);
++	if (ret < 0)
++		goto err_pm;
++
++	/*
++	 * Set streaming to true to ensure __v4l2_ctrl_handler_setup() will set
++	 * the controls. The flag is reset to false further down if an error
++	 * occurs.
++	 */
++	sensor->streaming = true;
++
++	ret = __v4l2_ctrl_handler_setup(&sensor->ctrls);
++	if (ret < 0)
++		goto err_pm;
++
++	ret = imx296_stream_on(sensor);
++	if (ret)
++		goto err_pm;
++
++unlock:
++	v4l2_subdev_unlock_state(state);
++
++	return ret;
++
++err_pm:
++	/*
++	 * In case of error, turn the power off synchronously as the device
++	 * likely has no other chance to recover.
++	 */
++	pm_runtime_put_sync(sensor->dev);
++	sensor->streaming = false;
++
++	goto unlock;
++}
++
++static int imx296_enum_mbus_code(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *state,
++				 struct v4l2_subdev_mbus_code_enum *code)
++{
++	struct imx296 *sensor = to_imx296(sd);
++
++	if (code->index != 0)
++		return -EINVAL;
++
++	code->code = sensor->mono ? MEDIA_BUS_FMT_Y10_1X10
++		   : MEDIA_BUS_FMT_SBGGR10_1X10;
++
++	return 0;
++}
++
++static int imx296_enum_frame_size(struct v4l2_subdev *sd,
++				  struct v4l2_subdev_state *state,
++				  struct v4l2_subdev_frame_size_enum *fse)
++{
++	const struct v4l2_mbus_framefmt *format;
++
++	format = v4l2_subdev_get_pad_format(sd, state, fse->pad);
++
++	if (fse->index >= 2 || fse->code != format->code)
++		return -EINVAL;
++
++	fse->min_width = IMX296_PIXEL_ARRAY_WIDTH / (fse->index + 1);
++	fse->max_width = fse->min_width;
++	fse->min_height = IMX296_PIXEL_ARRAY_HEIGHT / (fse->index + 1);
++	fse->max_height = fse->min_height;
++
++	return 0;
++}
++
++static int imx296_get_format(struct v4l2_subdev *sd,
++			     struct v4l2_subdev_state *state,
++			     struct v4l2_subdev_format *fmt)
++{
++	fmt->format = *v4l2_subdev_get_pad_format(sd, state, fmt->pad);
++
++	return 0;
++}
++
++static int imx296_set_format(struct v4l2_subdev *sd,
++			     struct v4l2_subdev_state *state,
++			     struct v4l2_subdev_format *fmt)
++{
++	struct imx296 *sensor = to_imx296(sd);
++	struct v4l2_mbus_framefmt *format;
++	struct v4l2_rect *crop;
++
++	crop = v4l2_subdev_get_pad_crop(sd, state, fmt->pad);
++	format = v4l2_subdev_get_pad_format(sd, state, fmt->pad);
++
++	/*
++	 * Binning is only allowed when cropping is disabled according to the
++	 * documentation. This should be double-checked.
++	 */
++	if (crop->width == IMX296_PIXEL_ARRAY_WIDTH &&
++	    crop->height == IMX296_PIXEL_ARRAY_HEIGHT) {
++		unsigned int width;
++		unsigned int height;
++		unsigned int hratio;
++		unsigned int vratio;
++
++		/* Clamp the width and height to avoid dividing by zero. */
++		width = clamp_t(unsigned int, fmt->format.width,
++				crop->width / 2, crop->width);
++		height = clamp_t(unsigned int, fmt->format.height,
++				 crop->height / 2, crop->height);
++
++		hratio = DIV_ROUND_CLOSEST(crop->width, width);
++		vratio = DIV_ROUND_CLOSEST(crop->height, height);
++
++		format->width = crop->width / hratio;
++		format->height = crop->height / vratio;
++	} else {
++		format->width = crop->width;
++		format->height = crop->height;
++	}
++
++	format->code = sensor->mono ? MEDIA_BUS_FMT_Y10_1X10
++		     : MEDIA_BUS_FMT_SBGGR10_1X10;
++	format->field = V4L2_FIELD_NONE;
++	format->colorspace = V4L2_COLORSPACE_RAW;
++	format->ycbcr_enc = V4L2_YCBCR_ENC_DEFAULT;
++	format->quantization = V4L2_QUANTIZATION_FULL_RANGE;
++	format->xfer_func = V4L2_XFER_FUNC_NONE;
++
++	fmt->format = *format;
++
++	return 0;
++}
++
++static int imx296_get_selection(struct v4l2_subdev *sd,
++				struct v4l2_subdev_state *state,
++				struct v4l2_subdev_selection *sel)
++{
++	switch (sel->target) {
++	case V4L2_SEL_TGT_CROP:
++		sel->r = *v4l2_subdev_get_pad_crop(sd, state, sel->pad);
++		break;
++
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++	case V4L2_SEL_TGT_CROP_BOUNDS:
++	case V4L2_SEL_TGT_NATIVE_SIZE:
++		sel->r.left = 0;
++		sel->r.top = 0;
++		sel->r.width = IMX296_PIXEL_ARRAY_WIDTH;
++		sel->r.height = IMX296_PIXEL_ARRAY_HEIGHT;
++		break;
++
++	default:
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static int imx296_set_selection(struct v4l2_subdev *sd,
++				struct v4l2_subdev_state *state,
++				struct v4l2_subdev_selection *sel)
++{
++	struct v4l2_mbus_framefmt *format;
++	struct v4l2_rect *crop;
++	struct v4l2_rect rect;
++
++	if (sel->target != V4L2_SEL_TGT_CROP)
++		return -EINVAL;
++
++	/*
++	 * Clamp the crop rectangle boundaries and align them to a multiple of 4
++	 * pixels to satisfy hardware requirements.
++	 */
++	rect.left = clamp(ALIGN(sel->r.left, 4), 0,
++			  IMX296_PIXEL_ARRAY_WIDTH - IMX296_FID0_ROIWH1_MIN);
++	rect.top = clamp(ALIGN(sel->r.top, 4), 0,
++			 IMX296_PIXEL_ARRAY_HEIGHT - IMX296_FID0_ROIWV1_MIN);
++	rect.width = clamp_t(unsigned int, ALIGN(sel->r.width, 4),
++			     IMX296_FID0_ROIWH1_MIN, IMX296_PIXEL_ARRAY_WIDTH);
++	rect.height = clamp_t(unsigned int, ALIGN(sel->r.height, 4),
++			      IMX296_FID0_ROIWV1_MIN, IMX296_PIXEL_ARRAY_HEIGHT);
++
++	rect.width = min_t(unsigned int, rect.width,
++			   IMX296_PIXEL_ARRAY_WIDTH - rect.left);
++	rect.height = min_t(unsigned int, rect.height,
++			    IMX296_PIXEL_ARRAY_HEIGHT - rect.top);
++
++	crop = v4l2_subdev_get_pad_crop(sd, state, sel->pad);
++
++	if (rect.width != crop->width || rect.height != crop->height) {
++		/*
++		 * Reset the output image size if the crop rectangle size has
++		 * been modified.
++		 */
++		format = v4l2_subdev_get_pad_format(sd, state, sel->pad);
++		format->width = rect.width;
++		format->height = rect.height;
++	}
++
++	*crop = rect;
++	sel->r = rect;
++
++	return 0;
++}
++
++static int imx296_init_cfg(struct v4l2_subdev *sd,
++			   struct v4l2_subdev_state *state)
++{
++	struct v4l2_subdev_selection sel = {
++		.target = V4L2_SEL_TGT_CROP,
++		.r.width = IMX296_PIXEL_ARRAY_WIDTH,
++		.r.height = IMX296_PIXEL_ARRAY_HEIGHT,
++	};
++	struct v4l2_subdev_format format = {
++		.format = {
++			.width = IMX296_PIXEL_ARRAY_WIDTH,
++			.height = IMX296_PIXEL_ARRAY_HEIGHT,
++		},
++	};
++
++	imx296_set_selection(sd, state, &sel);
++	imx296_set_format(sd, state, &format);
++
++	return 0;
++}
++
++static const struct v4l2_subdev_video_ops imx296_subdev_video_ops = {
++	.s_stream = imx296_s_stream,
++};
++
++static const struct v4l2_subdev_pad_ops imx296_subdev_pad_ops = {
++	.enum_mbus_code = imx296_enum_mbus_code,
++	.enum_frame_size = imx296_enum_frame_size,
++	.get_fmt = imx296_get_format,
++	.set_fmt = imx296_set_format,
++	.get_selection = imx296_get_selection,
++	.set_selection = imx296_set_selection,
++	.init_cfg = imx296_init_cfg,
++};
++
++static const struct v4l2_subdev_ops imx296_subdev_ops = {
++	.video = &imx296_subdev_video_ops,
++	.pad = &imx296_subdev_pad_ops,
++};
++
++static int imx296_subdev_init(struct imx296 *sensor)
++{
++	struct i2c_client *client = to_i2c_client(sensor->dev);
++	int ret;
++
++	v4l2_i2c_subdev_init(&sensor->subdev, client, &imx296_subdev_ops);
++
++	ret = imx296_ctrls_init(sensor);
++	if (ret < 0)
++		return ret;
++
++	sensor->subdev.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
++	sensor->pad.flags = MEDIA_PAD_FL_SOURCE;
++	sensor->subdev.entity.function = MEDIA_ENT_F_CAM_SENSOR;
++	ret = media_entity_pads_init(&sensor->subdev.entity, 1, &sensor->pad);
++	if (ret < 0) {
++		v4l2_ctrl_handler_free(&sensor->ctrls);
++		return ret;
++	}
++
++	sensor->subdev.state_lock = sensor->subdev.ctrl_handler->lock;
++
++	v4l2_subdev_init_finalize(&sensor->subdev);
++
++	return ret;
++}
++
++static void imx296_subdev_cleanup(struct imx296 *sensor)
++{
++	media_entity_cleanup(&sensor->subdev.entity);
++	v4l2_ctrl_handler_free(&sensor->ctrls);
++}
++
++/* -----------------------------------------------------------------------------
++ * Power management
++ */
++
++static int __maybe_unused imx296_runtime_resume(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *subdev = i2c_get_clientdata(client);
++	struct imx296 *sensor = to_imx296(subdev);
++
++	return imx296_power_on(sensor);
++}
++
++static int __maybe_unused imx296_runtime_suspend(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *subdev = i2c_get_clientdata(client);
++	struct imx296 *sensor = to_imx296(subdev);
++
++	imx296_power_off(sensor);
++
++	return 0;
++}
++
++static const struct dev_pm_ops imx296_pm_ops = {
++	SET_RUNTIME_PM_OPS(imx296_runtime_suspend, imx296_runtime_resume, NULL)
++};
++
++/* -----------------------------------------------------------------------------
++ * Probe & Remove
++ */
++
++static int imx296_read_temperature(struct imx296 *sensor, int *temp)
++{
++	int tmdout;
++	int ret;
++
++	ret = imx296_write(sensor, IMX296_TMDCTRL, IMX296_TMDCTRL_LATCH, NULL);
++	if (ret < 0)
++		return ret;
++
++	tmdout = imx296_read(sensor, IMX296_TMDOUT) & IMX296_TMDOUT_MASK;
++	if (tmdout < 0)
++		return tmdout;
++
++	/* T(°C) = 246.312 - 0.304 * TMDOUT */;
++	*temp = 246312 - 304 * tmdout;
++
++	return imx296_write(sensor, IMX296_TMDCTRL, 0, NULL);
++}
++
++static int imx296_identify_model(struct imx296 *sensor)
++{
++	unsigned int model;
++	int temp = 0;
++	int ret;
++
++	model = (uintptr_t)of_device_get_match_data(sensor->dev);
++	if (model) {
++		dev_dbg(sensor->dev,
++			"sensor model auto-detection disabled, forcing 0x%04x\n",
++			model);
++		sensor->mono = model & IMX296_SENSOR_INFO_MONO;
++		return 0;
++	}
++
++	/*
++	 * While most registers can be read when the sensor is in standby, this
++	 * is not the case of the sensor info register :-(
++	 */
++	ret = imx296_write(sensor, IMX296_CTRL00, 0, NULL);
++	if (ret < 0) {
++		dev_err(sensor->dev,
++			"failed to get sensor out of standby (%d)\n", ret);
++		return ret;
++	}
++
++	ret = imx296_read(sensor, IMX296_SENSOR_INFO);
++	if (ret < 0) {
++		dev_err(sensor->dev, "failed to read sensor information (%d)\n",
++			ret);
++		goto done;
++	}
++
++	model = (ret >> 6) & 0x1ff;
++
++	switch (model) {
++	case 296:
++		sensor->mono = ret & IMX296_SENSOR_INFO_MONO;
++		break;
++	/*
++	 * The IMX297 seems to share features with the IMX296, it may be
++	 * possible to support it in the same driver.
++	 */
++	case 297:
++	default:
++		dev_err(sensor->dev, "invalid device model 0x%04x\n", ret);
++		ret = -ENODEV;
++		goto done;
++	}
++
++	ret = imx296_read_temperature(sensor, &temp);
++	if (ret < 0)
++		goto done;
++
++	dev_info(sensor->dev, "found IMX%u%s (%u.%uC)\n", model,
++		 sensor->mono ? "LL" : "LQ", temp / 1000, (temp / 100) % 10);
++
++done:
++	imx296_write(sensor, IMX296_CTRL00, IMX296_CTRL00_STANDBY, NULL);
++	return ret;
++}
++
++static const struct regmap_config imx296_regmap_config = {
++	.reg_bits = 16,
++	.val_bits = 8,
++
++	.wr_table = &(const struct regmap_access_table) {
++		.no_ranges = (const struct regmap_range[]) {
++			{
++				.range_min = IMX296_SENSOR_INFO & 0xffff,
++				.range_max = (IMX296_SENSOR_INFO & 0xffff) + 1,
++			},
++		},
++		.n_no_ranges = 1,
++	},
++};
++
++static int imx296_probe(struct i2c_client *client)
++{
++	struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent);
++	unsigned long clk_rate;
++	struct imx296 *sensor;
++	unsigned int i;
++	int ret;
++
++	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA)) {
++		dev_warn(&adapter->dev,
++			 "I2C-Adapter doesn't support I2C_FUNC_SMBUS_BYTE\n");
++		return -EIO;
++	}
++
++	sensor = devm_kzalloc(&client->dev, sizeof(*sensor), GFP_KERNEL);
++	if (!sensor)
++		return -ENOMEM;
++
++	sensor->dev = &client->dev;
++
++	/* Acquire resources. */
++	for (i = 0; i < ARRAY_SIZE(sensor->supplies); ++i)
++		sensor->supplies[i].supply = imx296_supply_names[i];
++
++	ret = devm_regulator_bulk_get(sensor->dev, ARRAY_SIZE(sensor->supplies),
++				      sensor->supplies);
++	if (ret) {
++		dev_err_probe(sensor->dev, ret, "failed to get supplies\n");
++		return ret;
++	}
++
++	sensor->reset = devm_gpiod_get_optional(sensor->dev, "reset",
++						GPIOD_OUT_HIGH);
++	if (IS_ERR(sensor->reset))
++		return dev_err_probe(sensor->dev, PTR_ERR(sensor->reset),
++				     "failed to get reset GPIO\n");
++
++	sensor->clk = devm_clk_get(sensor->dev, "inck");
++	if (IS_ERR(sensor->clk))
++		return dev_err_probe(sensor->dev, PTR_ERR(sensor->clk),
++				     "failed to get clock\n");
++
++	clk_rate = clk_get_rate(sensor->clk);
++	for (i = 0; i < ARRAY_SIZE(imx296_clk_params); ++i) {
++		if (clk_rate == imx296_clk_params[i].freq) {
++			sensor->clk_params = &imx296_clk_params[i];
++			break;
++		}
++	}
++
++	if (!sensor->clk_params) {
++		dev_err(sensor->dev, "unsupported clock rate %lu\n", clk_rate);
++		return -EINVAL;
++	}
++
++	sensor->regmap = devm_regmap_init_i2c(client, &imx296_regmap_config);
++	if (IS_ERR(sensor->regmap))
++		return PTR_ERR(sensor->regmap);
++
++	/*
++	 * Enable power management. The driver supports runtime PM, but needs to
++	 * work when runtime PM is disabled in the kernel. To that end, power
++	 * the sensor on manually here, identify it, and fully initialize it.
++	 */
++	ret = imx296_power_on(sensor);
++	if (ret < 0)
++		return ret;
++
++	ret = imx296_identify_model(sensor);
++	if (ret < 0)
++		goto err_power;
++
++	/* Initialize the V4L2 subdev. */
++	ret = imx296_subdev_init(sensor);
++	if (ret < 0)
++		goto err_power;
++
++	/*
++	 * Enable runtime PM. As the device has been powered manually, mark it
++	 * as active, and increase the usage count without resuming the device.
++	 */
++	pm_runtime_set_active(sensor->dev);
++	pm_runtime_get_noresume(sensor->dev);
++	pm_runtime_enable(sensor->dev);
++
++	/* Register the V4L2 subdev. */
++	ret = v4l2_async_register_subdev(&sensor->subdev);
++	if (ret < 0)
++		goto err_pm;
++
++	/*
++	 * Finally, enable autosuspend and decrease the usage count. The device
++	 * will get suspended after the autosuspend delay, turning the power
++	 * off.
++	 */
++	pm_runtime_set_autosuspend_delay(sensor->dev, 1000);
++	pm_runtime_use_autosuspend(sensor->dev);
++	pm_runtime_put_autosuspend(sensor->dev);
++
++	return 0;
++
++err_pm:
++	pm_runtime_disable(sensor->dev);
++	pm_runtime_put_noidle(sensor->dev);
++	imx296_subdev_cleanup(sensor);
++err_power:
++	imx296_power_off(sensor);
++	return ret;
++}
++
++static void imx296_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *subdev = i2c_get_clientdata(client);
++	struct imx296 *sensor = to_imx296(subdev);
++
++	v4l2_async_unregister_subdev(subdev);
++
++	imx296_subdev_cleanup(sensor);
++
++	/*
++	 * Disable runtime PM. In case runtime PM is disabled in the kernel,
++	 * make sure to turn power off manually.
++	 */
++	pm_runtime_disable(sensor->dev);
++	if (!pm_runtime_status_suspended(sensor->dev))
++		imx296_power_off(sensor);
++	pm_runtime_set_suspended(sensor->dev);
++}
++
++static const struct of_device_id imx296_of_match[] = {
++	{ .compatible = "sony,imx296", .data = NULL },
++	{ .compatible = "sony,imx296ll", .data = (void *)IMX296_SENSOR_INFO_IMX296LL },
++	{ .compatible = "sony,imx296lq", .data = (void *)IMX296_SENSOR_INFO_IMX296LQ },
++	{ /* sentinel */ },
++};
++MODULE_DEVICE_TABLE(of, imx296_of_match);
++
++static struct i2c_driver imx296_i2c_driver = {
++	.driver = {
++		.of_match_table = imx296_of_match,
++		.name = "imx296",
++		.pm = &imx296_pm_ops
++	},
++	.probe_new = imx296_probe,
++	.remove = imx296_remove,
++};
++
++module_i2c_driver(imx296_i2c_driver);
++
++MODULE_DESCRIPTION("Sony IMX296 Camera driver");
++MODULE_AUTHOR("Laurent Pinchart <laurent.pinchart@ideasonboard.com>");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0595-media-i2c-imx296-Get-sensor-crop-working.patch b/target/linux/bcm27xx/patches-6.1/950-0595-media-i2c-imx296-Get-sensor-crop-working.patch
new file mode 100644
index 00000000000000..7a7d96f398199d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0595-media-i2c-imx296-Get-sensor-crop-working.patch
@@ -0,0 +1,35 @@
+From 95efa1b896a11f6392c3194a9d71960ea01c9443 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 14 Mar 2023 10:10:01 +0000
+Subject: [PATCH] media: i2c: imx296: Get sensor crop working
+
+Add a missing register write (MIPIC_AREA3W) when setting up a crop
+window in the sensor to get this functionality working.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx296.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/media/i2c/imx296.c
++++ b/drivers/media/i2c/imx296.c
+@@ -171,6 +171,7 @@
+ #define IMX296_CKREQSEL					IMX296_REG_8BIT(0x4101)
+ #define IMX296_CKREQSEL_HS				BIT(2)
+ #define IMX296_GTTABLENUM				IMX296_REG_8BIT(0x4114)
++#define IMX296_MIPIC_AREA3W				IMX296_REG_16BIT(0x4182)
+ #define IMX296_CTRL418C					IMX296_REG_8BIT(0x418c)
+ 
+ struct imx296_clk_params {
+@@ -526,8 +527,11 @@ static int imx296_setup(struct imx296 *s
+ 		imx296_write(sensor, IMX296_FID0_ROIPV1, crop->top, &ret);
+ 		imx296_write(sensor, IMX296_FID0_ROIWH1, crop->width, &ret);
+ 		imx296_write(sensor, IMX296_FID0_ROIWV1, crop->height, &ret);
++		imx296_write(sensor, IMX296_MIPIC_AREA3W, crop->height, &ret);
+ 	} else {
+ 		imx296_write(sensor, IMX296_FID0_ROI, 0, &ret);
++		imx296_write(sensor, IMX296_MIPIC_AREA3W,
++			     IMX296_PIXEL_ARRAY_HEIGHT, &ret);
+ 	}
+ 
+ 	imx296_write(sensor, IMX296_CTRL0D,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0596-media-i2c-imx296-Disable-binning-for-colour-variant.patch b/target/linux/bcm27xx/patches-6.1/950-0596-media-i2c-imx296-Disable-binning-for-colour-variant.patch
new file mode 100644
index 00000000000000..01ab02df943e3e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0596-media-i2c-imx296-Disable-binning-for-colour-variant.patch
@@ -0,0 +1,32 @@
+From 6e52a6d45d5296b5396b0b8ad27bbe6dfc3db235 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 14 Mar 2023 12:55:14 +0000
+Subject: [PATCH] media: i2c: imx296: Disable binning for colour
+ variant
+
+Binning is only supported on the mono variant of the IMX296 sensor.
+Disable reporting of the binning mode for the colour variant.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx296.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/imx296.c
++++ b/drivers/media/i2c/imx296.c
+@@ -674,11 +674,14 @@ static int imx296_enum_frame_size(struct
+ 				  struct v4l2_subdev_state *state,
+ 				  struct v4l2_subdev_frame_size_enum *fse)
+ {
++	const struct imx296 *sensor = to_imx296(sd);
+ 	const struct v4l2_mbus_framefmt *format;
++	/* Binning only works on the mono sensor variant */
++	unsigned int max_index = sensor->mono ? 2 : 1;
+ 
+ 	format = v4l2_subdev_get_pad_format(sd, state, fse->pad);
+ 
+-	if (fse->index >= 2 || fse->code != format->code)
++	if (fse->index >= max_index || fse->code != format->code)
+ 		return -EINVAL;
+ 
+ 	fse->min_width = IMX296_PIXEL_ARRAY_WIDTH / (fse->index + 1);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0597-media-i2c-imx296-Add-helper-for-hblank-control.patch b/target/linux/bcm27xx/patches-6.1/950-0597-media-i2c-imx296-Add-helper-for-hblank-control.patch
new file mode 100644
index 00000000000000..06463d82e6b4c6
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0597-media-i2c-imx296-Add-helper-for-hblank-control.patch
@@ -0,0 +1,84 @@
+From 6b0cce78e4c84189c93ad0fbad7b8d08439135d4 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 14 Mar 2023 12:56:14 +0000
+Subject: [PATCH] media: i2c: imx296: Add helper for hblank control
+
+Add a helper function to setup the horizontal blanking control. Update
+the control limits on set_format as the horizontal blanking time must
+remain constant regardless of sensor output width.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx296.c | 44 ++++++++++++++++++++++++++------------
+ 1 file changed, 30 insertions(+), 14 deletions(-)
+
+--- a/drivers/media/i2c/imx296.c
++++ b/drivers/media/i2c/imx296.c
+@@ -384,10 +384,36 @@ static const struct v4l2_ctrl_ops imx296
+ 	.s_ctrl = imx296_s_ctrl,
+ };
+ 
++static void imx296_setup_hblank(struct imx296 *sensor, unsigned int width)
++{
++	/*
++	 * Horizontal blanking is controlled through the HMAX register, which
++	 * contains a line length in contains a line length in units of an
++	 * internal 74.25 MHz clock derived from the INCLK. The HMAX value is
++	 * currently fixed to 1100, convert it to a number of pixels based on
++	 * the nominal pixel rate.
++	 *
++	 * Horizontal blanking is fixed, regardless of the crop width, so
++	 * ensure the hblank limits are adjusted to account for this.
++	 */
++	unsigned int hblank = 1100 * 1188000000ULL / 10 / 74250000 - width;
++
++	if (!sensor->hblank) {
++		sensor->hblank = v4l2_ctrl_new_std(&sensor->ctrls,
++						   &imx296_ctrl_ops,
++						   V4L2_CID_HBLANK, hblank,
++						   hblank, 1, hblank);
++		if (sensor->hblank)
++			sensor->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++	} else {
++		__v4l2_ctrl_modify_range(sensor->hblank, hblank, hblank, 1,
++					 hblank);
++	}
++}
++
+ static int imx296_ctrls_init(struct imx296 *sensor)
+ {
+ 	struct v4l2_fwnode_device_properties props;
+-	unsigned int hblank;
+ 	int ret;
+ 
+ 	ret = v4l2_fwnode_device_parse(sensor->dev, &props);
+@@ -402,19 +428,7 @@ static int imx296_ctrls_init(struct imx2
+ 			  V4L2_CID_ANALOGUE_GAIN, IMX296_GAIN_MIN,
+ 			  IMX296_GAIN_MAX, 1, IMX296_GAIN_MIN);
+ 
+-	/*
+-	 * Horizontal blanking is controlled through the HMAX register, which
+-	 * contains a line length in INCK clock units. The INCK frequency is
+-	 * fixed to 74.25 MHz. The HMAX value is currently fixed to 1100,
+-	 * convert it to a number of pixels based on the nominal pixel rate.
+-	 */
+-	hblank = 1100 * 1188000000ULL / 10 / 74250000
+-	       - IMX296_PIXEL_ARRAY_WIDTH;
+-	sensor->hblank = v4l2_ctrl_new_std(&sensor->ctrls, &imx296_ctrl_ops,
+-					   V4L2_CID_HBLANK, hblank, hblank, 1,
+-					   hblank);
+-	if (sensor->hblank)
+-		sensor->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++	imx296_setup_hblank(sensor, IMX296_PIXEL_ARRAY_WIDTH);
+ 
+ 	sensor->vblank = v4l2_ctrl_new_std(&sensor->ctrls, &imx296_ctrl_ops,
+ 					   V4L2_CID_VBLANK, 30,
+@@ -739,6 +753,8 @@ static int imx296_set_format(struct v4l2
+ 		format->height = crop->height;
+ 	}
+ 
++	imx296_setup_hblank(sensor, format->width);
++
+ 	format->code = sensor->mono ? MEDIA_BUS_FMT_Y10_1X10
+ 		     : MEDIA_BUS_FMT_SBGGR10_1X10;
+ 	format->field = V4L2_FIELD_NONE;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0598-media-i2c-imx296-Set-a-1-frame-gain-delay.patch b/target/linux/bcm27xx/patches-6.1/950-0598-media-i2c-imx296-Set-a-1-frame-gain-delay.patch
new file mode 100644
index 00000000000000..2537d9f7745e9d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0598-media-i2c-imx296-Set-a-1-frame-gain-delay.patch
@@ -0,0 +1,25 @@
+From 9fc440641b43e04a07d04988bba830bb57f1231c Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 14 Mar 2023 10:46:46 +0000
+Subject: [PATCH] media: i2c: imx296: Set a 1 frame gain delay
+
+Set the gain delay to 1 frame in the sensor. This avoids any race
+condition or ambiguity over when the setting is applied through
+userland.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx296.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/imx296.c
++++ b/drivers/media/i2c/imx296.c
+@@ -584,7 +584,7 @@ static int imx296_setup(struct imx296 *s
+ 	imx296_write(sensor, IMX296_CTRL418C, sensor->clk_params->ctrl418c,
+ 		     &ret);
+ 
+-	imx296_write(sensor, IMX296_GAINDLY, IMX296_GAINDLY_NONE, &ret);
++	imx296_write(sensor, IMX296_GAINDLY, IMX296_GAINDLY_1FRAME, &ret);
+ 	imx296_write(sensor, IMX296_BLKLEVEL, 0x03c, &ret);
+ 
+ 	return ret;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0599-media-i2c-imx296-Add-horizontal-vertical-flip-suppor.patch b/target/linux/bcm27xx/patches-6.1/950-0599-media-i2c-imx296-Add-horizontal-vertical-flip-suppor.patch
new file mode 100644
index 00000000000000..139bc6b434b8f6
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0599-media-i2c-imx296-Add-horizontal-vertical-flip-suppor.patch
@@ -0,0 +1,150 @@
+From 621a1194ac97d166b4bf747c5fedabdbfb01620c Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 14 Mar 2023 11:00:48 +0000
+Subject: [PATCH] media: i2c: imx296: Add horizontal/vertical flip
+ support
+
+Add support for setting horizontal and/or vertial flips in the IMX296
+sensor through the V4L2_CID_HFLIP and V4L2_CID_VFLIP controls.
+
+Add a new helper function to return the media bus format code that
+depends on the sensor flips.
+
+Grab the V4L2_CID_HFLIP and V4L2_CID_VFLIP controls on stream on, and
+release on stream off to ensure flips cannot be changed while the sensor
+is streaming.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx296.c | 64 +++++++++++++++++++++++++++++++++++---
+ 1 file changed, 59 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/i2c/imx296.c
++++ b/drivers/media/i2c/imx296.c
+@@ -210,6 +210,8 @@ struct imx296 {
+ 	struct v4l2_ctrl_handler ctrls;
+ 	struct v4l2_ctrl *hblank;
+ 	struct v4l2_ctrl *vblank;
++	struct v4l2_ctrl *vflip;
++	struct v4l2_ctrl *hflip;
+ };
+ 
+ static inline struct imx296 *to_imx296(struct v4l2_subdev *sd)
+@@ -251,6 +253,36 @@ static int imx296_write(struct imx296 *s
+ 	return ret;
+ }
+ 
++/*
++ * The supported formats.
++ * This table MUST contain 4 entries per format, to cover the various flip
++ * combinations in the order
++ * - no flip
++ * - h flip
++ * - v flip
++ * - h&v flips
++ */
++static const u32 mbus_codes[] = {
++	/* 10-bit modes. */
++	MEDIA_BUS_FMT_SRGGB10_1X10,
++	MEDIA_BUS_FMT_SGRBG10_1X10,
++	MEDIA_BUS_FMT_SGBRG10_1X10,
++	MEDIA_BUS_FMT_SBGGR10_1X10,
++};
++
++static u32 imx296_mbus_code(const struct imx296 *sensor)
++{
++	unsigned int i = 0;
++
++	if (sensor->mono)
++		return MEDIA_BUS_FMT_Y10_1X10;
++
++	if (sensor->vflip && sensor->hflip)
++		i = (sensor->vflip->val ? 2 : 0) | (sensor->hflip->val ? 1 : 0);
++
++	return mbus_codes[i];
++}
++
+ static int imx296_power_on(struct imx296 *sensor)
+ {
+ 	int ret;
+@@ -345,6 +377,13 @@ static int imx296_s_ctrl(struct v4l2_ctr
+ 			     &ret);
+ 		break;
+ 
++	case V4L2_CID_HFLIP:
++	case V4L2_CID_VFLIP:
++		imx296_write(sensor, IMX296_CTRL0E,
++			     sensor->vflip->val | (sensor->hflip->val << 1),
++			     &ret);
++		break;
++
+ 	case V4L2_CID_TEST_PATTERN:
+ 		if (ctrl->val) {
+ 			imx296_write(sensor, IMX296_PGHPOS, 8, &ret);
+@@ -428,6 +467,16 @@ static int imx296_ctrls_init(struct imx2
+ 			  V4L2_CID_ANALOGUE_GAIN, IMX296_GAIN_MIN,
+ 			  IMX296_GAIN_MAX, 1, IMX296_GAIN_MIN);
+ 
++	sensor->hflip = v4l2_ctrl_new_std(&sensor->ctrls, &imx296_ctrl_ops,
++					  V4L2_CID_HFLIP, 0, 1, 1, 0);
++	if (sensor->hflip && !sensor->mono)
++		sensor->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
++	sensor->vflip = v4l2_ctrl_new_std(&sensor->ctrls, &imx296_ctrl_ops,
++					  V4L2_CID_VFLIP, 0, 1, 1, 0);
++	if (sensor->vflip && !sensor->mono)
++		sensor->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
+ 	imx296_setup_hblank(sensor, IMX296_PIXEL_ARRAY_WIDTH);
+ 
+ 	sensor->vblank = v4l2_ctrl_new_std(&sensor->ctrls, &imx296_ctrl_ops,
+@@ -598,6 +647,10 @@ static int imx296_stream_on(struct imx29
+ 	usleep_range(2000, 5000);
+ 	imx296_write(sensor, IMX296_CTRL0A, 0, &ret);
+ 
++	/* vflip and hflip cannot change during streaming */
++	__v4l2_ctrl_grab(sensor->vflip, 1);
++	__v4l2_ctrl_grab(sensor->hflip, 1);
++
+ 	return ret;
+ }
+ 
+@@ -608,6 +661,9 @@ static int imx296_stream_off(struct imx2
+ 	imx296_write(sensor, IMX296_CTRL0A, IMX296_CTRL0A_XMSTA, &ret);
+ 	imx296_write(sensor, IMX296_CTRL00, IMX296_CTRL00_STANDBY, &ret);
+ 
++	__v4l2_ctrl_grab(sensor->vflip, 0);
++	__v4l2_ctrl_grab(sensor->hflip, 0);
++
+ 	return ret;
+ }
+ 
+@@ -678,8 +734,7 @@ static int imx296_enum_mbus_code(struct
+ 	if (code->index != 0)
+ 		return -EINVAL;
+ 
+-	code->code = sensor->mono ? MEDIA_BUS_FMT_Y10_1X10
+-		   : MEDIA_BUS_FMT_SBGGR10_1X10;
++	code->code = imx296_mbus_code(sensor);
+ 
+ 	return 0;
+ }
+@@ -695,7 +750,7 @@ static int imx296_enum_frame_size(struct
+ 
+ 	format = v4l2_subdev_get_pad_format(sd, state, fse->pad);
+ 
+-	if (fse->index >= max_index || fse->code != format->code)
++	if (fse->index >= max_index || fse->code != imx296_mbus_code(sensor))
+ 		return -EINVAL;
+ 
+ 	fse->min_width = IMX296_PIXEL_ARRAY_WIDTH / (fse->index + 1);
+@@ -755,8 +810,7 @@ static int imx296_set_format(struct v4l2
+ 
+ 	imx296_setup_hblank(sensor, format->width);
+ 
+-	format->code = sensor->mono ? MEDIA_BUS_FMT_Y10_1X10
+-		     : MEDIA_BUS_FMT_SBGGR10_1X10;
++	format->code = imx296_mbus_code(sensor);
+ 	format->field = V4L2_FIELD_NONE;
+ 	format->colorspace = V4L2_COLORSPACE_RAW;
+ 	format->ycbcr_enc = V4L2_YCBCR_ENC_DEFAULT;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0600-media-i2c-imx296-Adjust-cropping-limits.patch b/target/linux/bcm27xx/patches-6.1/950-0600-media-i2c-imx296-Adjust-cropping-limits.patch
new file mode 100644
index 00000000000000..4a967c29f3e5d3
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0600-media-i2c-imx296-Adjust-cropping-limits.patch
@@ -0,0 +1,28 @@
+From b7f69e6c5afbf151131d52420da5ef9169b616d0 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Thu, 16 Mar 2023 09:29:41 +0000
+Subject: [PATCH] media: i2c: imx296: Adjust cropping limits
+
+Through emperical testing, the sensor can crop upto a 96x88 window to
+produce a valid Bayer frame. Adjust the ROIWH1_MIN ROIWV1_MIN
+appropriately for this limit.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx296.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/imx296.c
++++ b/drivers/media/i2c/imx296.c
+@@ -150,9 +150,9 @@
+ #define IMX296_FID0_ROIPH1				IMX296_REG_16BIT(0x3310)
+ #define IMX296_FID0_ROIPV1				IMX296_REG_16BIT(0x3312)
+ #define IMX296_FID0_ROIWH1				IMX296_REG_16BIT(0x3314)
+-#define IMX296_FID0_ROIWH1_MIN				80
++#define IMX296_FID0_ROIWH1_MIN				96
+ #define IMX296_FID0_ROIWV1				IMX296_REG_16BIT(0x3316)
+-#define IMX296_FID0_ROIWV1_MIN				4
++#define IMX296_FID0_ROIWV1_MIN				88
+ 
+ #define IMX296_CM_HSST_STARTTMG				IMX296_REG_16BIT(0x4018)
+ #define IMX296_CM_HSST_ENDTMG				IMX296_REG_16BIT(0x401a)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0601-reboot-Use-power-off-rather-than-busy-spinning-when-.patch b/target/linux/bcm27xx/patches-6.1/950-0601-reboot-Use-power-off-rather-than-busy-spinning-when-.patch
new file mode 100644
index 00000000000000..ac774db5b2a8ff
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0601-reboot-Use-power-off-rather-than-busy-spinning-when-.patch
@@ -0,0 +1,33 @@
+From 55974977523c2c5089613549ea51c007d7a71b40 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Thu, 16 Mar 2023 14:41:16 +0000
+Subject: [PATCH] reboot: Use power off rather than busy spinning when
+ halt is requested
+
+Busy spinning after halt is dumb
+We've previously applied this patch to arch/arm
+but it is currenltly missing in arch/arm64
+
+Pi4 after "sudo halt" uses 520mA
+Pi4 after "sudo shutdown now" uses 310mA
+
+Make them both use the lower powered option
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ arch/arm64/kernel/process.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/arch/arm64/kernel/process.c
++++ b/arch/arm64/kernel/process.c
+@@ -96,9 +96,7 @@ void machine_shutdown(void)
+  */
+ void machine_halt(void)
+ {
+-	local_irq_disable();
+-	smp_send_stop();
+-	while (1);
++	machine_power_off();
+ }
+ 
+ /*
diff --git a/target/linux/bcm27xx/patches-6.1/950-0602-media-i2c-Add-PDAF-support-for-IMX519.patch b/target/linux/bcm27xx/patches-6.1/950-0602-media-i2c-Add-PDAF-support-for-IMX519.patch
new file mode 100644
index 00000000000000..974baae559f324
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0602-media-i2c-Add-PDAF-support-for-IMX519.patch
@@ -0,0 +1,427 @@
+From 534b6bc119e761da1aa2b1aabcb13f3b9878e7ec Mon Sep 17 00:00:00 2001
+From: Lee Jackson <lee.jackson@arducam.com>
+Date: Wed, 22 Mar 2023 16:19:13 +0800
+Subject: [PATCH] media: i2c: Add PDAF support for IMX519
+
+Add PDAF support for IMX519, and reduce the pixel rate to 426666667,
+link freq to 408000000.
+
+Signed-off-by: Lee Jackson <lee.jackson@arducam.com>
+---
+ drivers/media/i2c/imx519.c | 170 +++++++++++++++++++++++--------------
+ 1 file changed, 106 insertions(+), 64 deletions(-)
+
+--- a/drivers/media/i2c/imx519.c
++++ b/drivers/media/i2c/imx519.c
+@@ -36,10 +36,10 @@
+ 
+ #define IMX519_XCLK_FREQ		24000000
+ 
+-#define IMX519_DEFAULT_LINK_FREQ	493500000
++#define IMX519_DEFAULT_LINK_FREQ	408000000
+ 
+-/* Pixel rate is fixed at 686MHz for all the modes */
+-#define IMX519_PIXEL_RATE		686000000
++/* Pixel rate is fixed at 426MHz for all the modes */
++#define IMX519_PIXEL_RATE		426666667
+ 
+ /* V_TIMING internal */
+ #define IMX519_REG_FRAME_LENGTH		0x0340
+@@ -52,7 +52,7 @@
+ /* Exposure control */
+ #define IMX519_REG_EXPOSURE		0x0202
+ #define IMX519_EXPOSURE_OFFSET		32
+-#define IMX519_EXPOSURE_MIN		1
++#define IMX519_EXPOSURE_MIN		20
+ #define IMX519_EXPOSURE_STEP		1
+ #define IMX519_EXPOSURE_DEFAULT		0x3e8
+ #define IMX519_EXPOSURE_MAX		(IMX519_FRAME_LENGTH_MAX - \
+@@ -94,7 +94,7 @@
+ #define IMX519_TEST_PATTERN_GB_DEFAULT	0
+ 
+ /* Embedded metadata stream structure */
+-#define IMX519_EMBEDDED_LINE_WIDTH 16384
++#define IMX519_EMBEDDED_LINE_WIDTH (5820 * 3)
+ #define IMX519_NUM_EMBEDDED_LINES 1
+ 
+ enum pad_types {
+@@ -146,6 +146,7 @@ struct imx519_mode {
+ };
+ 
+ static const struct imx519_reg mode_common_regs[] = {
++	{0x0100, 0x00},
+ 	{0x0136, 0x18},
+ 	{0x0137, 0x00},
+ 	{0x3c7e, 0x01},
+@@ -418,6 +419,7 @@ static const struct imx519_reg mode_comm
+ 	{0xae05, 0x03},
+ 	{0xbc1c, 0x08},
+ 	{0xbcf1, 0x02},
++	{0x38a3, 0x00},
+ };
+ 
+ /* 16 mpix 10fps */
+@@ -426,8 +428,8 @@ static const struct imx519_reg mode_4656
+ 	{0x0112, 0x0a},
+ 	{0x0113, 0x0a},
+ 	{0x0114, 0x01},
+-	{0x0342, 0x42},
+-	{0x0343, 0x00},
++	{0x0342, 0x31},
++	{0x0343, 0x6a},
+ 	{0x0340, 0x0d},
+ 	{0x0341, 0xf4},
+ 	{0x0344, 0x00},
+@@ -464,22 +466,30 @@ static const struct imx519_reg mode_4656
+ 	{0x034f, 0xa8},
+ 	{0x0301, 0x06},
+ 	{0x0303, 0x04},
+-	{0x0305, 0x04},
++	{0x0305, 0x06},
+ 	{0x0306, 0x01},
+-	{0x0307, 0x57},
++	{0x0307, 0x40},
+ 	{0x0309, 0x0a},
+ 	{0x030b, 0x02},
+ 	{0x030d, 0x04},
+ 	{0x030e, 0x01},
+-	{0x030f, 0x49},
++	{0x030f, 0x10},
+ 	{0x0310, 0x01},
+-	{0x0820, 0x07},
+-	{0x0821, 0xb6},
++	{0x0820, 0x0a},
++	{0x0821, 0x20},
+ 	{0x0822, 0x00},
+ 	{0x0823, 0x00},
+ 	{0x3e20, 0x01},
+-	{0x3e37, 0x00},
++	{0x3e37, 0x01},
+ 	{0x3e3b, 0x00},
++	{0x38a4, 0x00},
++	{0x38a5, 0x00},
++	{0x38a6, 0x00},
++	{0x38a7, 0x00},
++	{0x38a8, 0x01},
++	{0x38a9, 0x23},
++	{0x38aa, 0x01},
++	{0x38ab, 0x23},
+ 	{0x0106, 0x00},
+ 	{0x0b00, 0x00},
+ 	{0x3230, 0x00},
+@@ -503,8 +513,8 @@ static const struct imx519_reg mode_3840
+ 	{0x0112, 0x0a},
+ 	{0x0113, 0x0a},
+ 	{0x0114, 0x01},
+-	{0x0342, 0x38},
+-	{0x0343, 0x70},
++	{0x0342, 0x28},
++	{0x0343, 0xf6},
+ 	{0x0340, 0x08},
+ 	{0x0341, 0xd4},
+ 	{0x0344, 0x01},
+@@ -541,22 +551,30 @@ static const struct imx519_reg mode_3840
+ 	{0x034f, 0x70},
+ 	{0x0301, 0x06},
+ 	{0x0303, 0x04},
+-	{0x0305, 0x04},
++	{0x0305, 0x06},
+ 	{0x0306, 0x01},
+-	{0x0307, 0x57},
++	{0x0307, 0x40},
+ 	{0x0309, 0x0a},
+ 	{0x030b, 0x02},
+ 	{0x030d, 0x04},
+ 	{0x030e, 0x01},
+-	{0x030f, 0x49},
++	{0x030f, 0x10},
+ 	{0x0310, 0x01},
+-	{0x0820, 0x07},
+-	{0x0821, 0xb6},
++	{0x0820, 0x0a},
++	{0x0821, 0x20},
+ 	{0x0822, 0x00},
+ 	{0x0823, 0x00},
+ 	{0x3e20, 0x01},
+-	{0x3e37, 0x00},
++	{0x3e37, 0x01},
+ 	{0x3e3b, 0x00},
++	{0x38a4, 0x00},
++	{0x38a5, 0x00},
++	{0x38a6, 0x00},
++	{0x38a7, 0x00},
++	{0x38a8, 0x00},
++	{0x38a9, 0xf0},
++	{0x38aa, 0x00},
++	{0x38ab, 0xb4},
+ 	{0x0106, 0x00},
+ 	{0x0b00, 0x00},
+ 	{0x3230, 0x00},
+@@ -580,10 +598,10 @@ static const struct imx519_reg mode_2328
+ 	{0x0112, 0x0a},
+ 	{0x0113, 0x0a},
+ 	{0x0114, 0x01},
+-	{0x0342, 0x24},
+-	{0x0343, 0x12},
+-	{0x0340, 0x09},
+-	{0x0341, 0xac},
++	{0x0342, 0x19},
++	{0x0343, 0x70},
++	{0x0340, 0x08},
++	{0x0341, 0x88},
+ 	{0x0344, 0x00},
+ 	{0x0345, 0x00},
+ 	{0x0346, 0x00},
+@@ -598,8 +616,8 @@ static const struct imx519_reg mode_2328
+ 	{0x0900, 0x01},
+ 	{0x0901, 0x22},
+ 	{0x0902, 0x0a},
+-	{0x3f4c, 0x01},
+-	{0x3f4d, 0x01},
++	{0x3f4c, 0x05},
++	{0x3f4d, 0x03},
+ 	{0x4254, 0x7f},
+ 	{0x0401, 0x00},
+ 	{0x0404, 0x00},
+@@ -618,22 +636,30 @@ static const struct imx519_reg mode_2328
+ 	{0x034f, 0xd4},
+ 	{0x0301, 0x06},
+ 	{0x0303, 0x04},
+-	{0x0305, 0x04},
++	{0x0305, 0x06},
+ 	{0x0306, 0x01},
+-	{0x0307, 0x57},
++	{0x0307, 0x40},
+ 	{0x0309, 0x0a},
+ 	{0x030b, 0x02},
+ 	{0x030d, 0x04},
+ 	{0x030e, 0x01},
+-	{0x030f, 0x49},
++	{0x030f, 0x10},
+ 	{0x0310, 0x01},
+-	{0x0820, 0x07},
+-	{0x0821, 0xb6},
++	{0x0820, 0x0a},
++	{0x0821, 0x20},
+ 	{0x0822, 0x00},
+ 	{0x0823, 0x00},
+ 	{0x3e20, 0x01},
+-	{0x3e37, 0x00},
++	{0x3e37, 0x01},
+ 	{0x3e3b, 0x00},
++	{0x38a4, 0x00},
++	{0x38a5, 0x00},
++	{0x38a6, 0x00},
++	{0x38a7, 0x00},
++	{0x38a8, 0x00},
++	{0x38a9, 0x91},
++	{0x38aa, 0x00},
++	{0x38ab, 0x91},
+ 	{0x0106, 0x00},
+ 	{0x0b00, 0x00},
+ 	{0x3230, 0x00},
+@@ -657,8 +683,8 @@ static const struct imx519_reg mode_1920
+ 	{0x0112, 0x0a},
+ 	{0x0113, 0x0a},
+ 	{0x0114, 0x01},
+-	{0x0342, 0x25},
+-	{0x0343, 0xd9},
++	{0x0342, 0x17},
++	{0x0343, 0x8b},
+ 	{0x0340, 0x04},
+ 	{0x0341, 0x9c},
+ 	{0x0344, 0x01},
+@@ -675,8 +701,8 @@ static const struct imx519_reg mode_1920
+ 	{0x0900, 0x01},
+ 	{0x0901, 0x22},
+ 	{0x0902, 0x0a},
+-	{0x3f4c, 0x01},
+-	{0x3f4d, 0x01},
++	{0x3f4c, 0x05},
++	{0x3f4d, 0x03},
+ 	{0x4254, 0x7f},
+ 	{0x0401, 0x00},
+ 	{0x0404, 0x00},
+@@ -695,22 +721,30 @@ static const struct imx519_reg mode_1920
+ 	{0x034f, 0x38},
+ 	{0x0301, 0x06},
+ 	{0x0303, 0x04},
+-	{0x0305, 0x04},
++	{0x0305, 0x06},
+ 	{0x0306, 0x01},
+-	{0x0307, 0x57},
++	{0x0307, 0x40},
+ 	{0x0309, 0x0a},
+ 	{0x030b, 0x02},
+ 	{0x030d, 0x04},
+ 	{0x030e, 0x01},
+-	{0x030f, 0x49},
++	{0x030f, 0x10},
+ 	{0x0310, 0x01},
+-	{0x0820, 0x07},
+-	{0x0821, 0xb6},
++	{0x0820, 0x0a},
++	{0x0821, 0x20},
+ 	{0x0822, 0x00},
+ 	{0x0823, 0x00},
+ 	{0x3e20, 0x01},
+-	{0x3e37, 0x00},
++	{0x3e37, 0x01},
+ 	{0x3e3b, 0x00},
++	{0x38a4, 0x00},
++	{0x38a5, 0x00},
++	{0x38a6, 0x00},
++	{0x38a7, 0x00},
++	{0x38a8, 0x00},
++	{0x38a9, 0x78},
++	{0x38aa, 0x00},
++	{0x38ab, 0x5a},
+ 	{0x0106, 0x00},
+ 	{0x0b00, 0x00},
+ 	{0x3230, 0x00},
+@@ -734,8 +768,8 @@ static const struct imx519_reg mode_1280
+ 	{0x0112, 0x0a},
+ 	{0x0113, 0x0a},
+ 	{0x0114, 0x01},
+-	{0x0342, 0x1b},
+-	{0x0343, 0x3b},
++	{0x0342, 0x18},
++	{0x0343, 0x00},
+ 	{0x0340, 0x03},
+ 	{0x0341, 0x34},
+ 	{0x0344, 0x04},
+@@ -752,8 +786,8 @@ static const struct imx519_reg mode_1280
+ 	{0x0900, 0x01},
+ 	{0x0901, 0x22},
+ 	{0x0902, 0x0a},
+-	{0x3f4c, 0x01},
+-	{0x3f4d, 0x01},
++	{0x3f4c, 0x05},
++	{0x3f4d, 0x03},
+ 	{0x4254, 0x7f},
+ 	{0x0401, 0x00},
+ 	{0x0404, 0x00},
+@@ -772,22 +806,30 @@ static const struct imx519_reg mode_1280
+ 	{0x034f, 0xd0},
+ 	{0x0301, 0x06},
+ 	{0x0303, 0x04},
+-	{0x0305, 0x04},
++	{0x0305, 0x06},
+ 	{0x0306, 0x01},
+-	{0x0307, 0x57},
++	{0x0307, 0x40},
+ 	{0x0309, 0x0a},
+ 	{0x030b, 0x02},
+ 	{0x030d, 0x04},
+ 	{0x030e, 0x01},
+-	{0x030f, 0x49},
++	{0x030f, 0x10},
+ 	{0x0310, 0x01},
+-	{0x0820, 0x07},
+-	{0x0821, 0xb6},
++	{0x0820, 0x0a},
++	{0x0821, 0x20},
+ 	{0x0822, 0x00},
+ 	{0x0823, 0x00},
+ 	{0x3e20, 0x01},
+-	{0x3e37, 0x00},
++	{0x3e37, 0x01},
+ 	{0x3e3b, 0x00},
++	{0x38a4, 0x00},
++	{0x38a5, 0x00},
++	{0x38a6, 0x00},
++	{0x38a7, 0x00},
++	{0x38a8, 0x00},
++	{0x38a9, 0x50},
++	{0x38aa, 0x00},
++	{0x38ab, 0x3c},
+ 	{0x0106, 0x00},
+ 	{0x0b00, 0x00},
+ 	{0x3230, 0x00},
+@@ -810,7 +852,7 @@ static const struct imx519_mode supporte
+ 	{
+ 		.width = 4656,
+ 		.height = 3496,
+-		.line_length_pix = 0x4200,
++		.line_length_pix = 0x316a,
+ 		.crop = {
+ 			.left = IMX519_PIXEL_ARRAY_LEFT,
+ 			.top = IMX519_PIXEL_ARRAY_TOP,
+@@ -819,11 +861,11 @@ static const struct imx519_mode supporte
+ 		},
+ 		.timeperframe_min = {
+ 			.numerator = 100,
+-			.denominator = 1000
++			.denominator = 900
+ 		},
+ 		.timeperframe_default = {
+ 			.numerator = 100,
+-			.denominator = 1000
++			.denominator = 900
+ 		},
+ 		.reg_list = {
+ 			.num_of_regs = ARRAY_SIZE(mode_4656x3496_regs),
+@@ -833,7 +875,7 @@ static const struct imx519_mode supporte
+ 	{
+ 		.width = 3840,
+ 		.height = 2160,
+-		.line_length_pix = 0x3870,
++		.line_length_pix = 0x28f6,
+ 		.crop = {
+ 			.left = IMX519_PIXEL_ARRAY_LEFT + 408,
+ 			.top = IMX519_PIXEL_ARRAY_TOP + 672,
+@@ -842,11 +884,11 @@ static const struct imx519_mode supporte
+ 		},
+ 		.timeperframe_min = {
+ 			.numerator = 100,
+-			.denominator = 2100
++			.denominator = 1800
+ 		},
+ 		.timeperframe_default = {
+ 			.numerator = 100,
+-			.denominator = 2100
++			.denominator = 1800
+ 		},
+ 		.reg_list = {
+ 			.num_of_regs = ARRAY_SIZE(mode_3840x2160_regs),
+@@ -856,7 +898,7 @@ static const struct imx519_mode supporte
+ 	{
+ 		.width = 2328,
+ 		.height = 1748,
+-		.line_length_pix = 0x2412,
++		.line_length_pix = 0x1970,
+ 		.crop = {
+ 			.left = IMX519_PIXEL_ARRAY_LEFT,
+ 			.top = IMX519_PIXEL_ARRAY_TOP,
+@@ -879,7 +921,7 @@ static const struct imx519_mode supporte
+ 	{
+ 		.width = 1920,
+ 		.height = 1080,
+-		.line_length_pix = 0x25D9,
++		.line_length_pix = 0x178b,
+ 		.crop = {
+ 			.left = IMX519_PIXEL_ARRAY_LEFT + 408,
+ 			.top = IMX519_PIXEL_ARRAY_TOP + 674,
+@@ -902,7 +944,7 @@ static const struct imx519_mode supporte
+ 	{
+ 		.width = 1280,
+ 		.height = 720,
+-		.line_length_pix = 0x1B3B,
++		.line_length_pix = 0x1800,
+ 		.crop = {
+ 			.left = IMX519_PIXEL_ARRAY_LEFT + 1048,
+ 			.top = IMX519_PIXEL_ARRAY_TOP + 1042,
+@@ -911,11 +953,11 @@ static const struct imx519_mode supporte
+ 		},
+ 		.timeperframe_min = {
+ 			.numerator = 100,
+-			.denominator = 12000
++			.denominator = 8000
+ 		},
+ 		.timeperframe_default = {
+ 			.numerator = 100,
+-			.denominator = 12000
++			.denominator = 8000
+ 		},
+ 		.reg_list = {
+ 			.num_of_regs = ARRAY_SIZE(mode_1280x720_regs),
diff --git a/target/linux/bcm27xx/patches-6.1/950-0603-dtoverlays-Reduce-the-link-frequencies-of-IMX519.patch b/target/linux/bcm27xx/patches-6.1/950-0603-dtoverlays-Reduce-the-link-frequencies-of-IMX519.patch
new file mode 100644
index 00000000000000..1145cca377b6cd
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0603-dtoverlays-Reduce-the-link-frequencies-of-IMX519.patch
@@ -0,0 +1,23 @@
+From 24a303eec794e5a1e8479430191237c2ebdd23d9 Mon Sep 17 00:00:00 2001
+From: Lee Jackson <lee.jackson@arducam.com>
+Date: Wed, 22 Mar 2023 16:24:19 +0800
+Subject: [PATCH] dtoverlays: Reduce the link-frequencies of IMX519
+
+Modify the link-frequencies of IMX519 to 408000000.
+
+Signed-off-by: Lee Jackson <lee.jackson@arducam.com>
+---
+ arch/arm/boot/dts/overlays/imx519.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/overlays/imx519.dtsi
++++ b/arch/arm/boot/dts/overlays/imx519.dtsi
+@@ -21,7 +21,7 @@ cam_node: imx519@1a {
+ 			data-lanes = <1 2>;
+ 			clock-noncontinuous;
+ 			link-frequencies =
+-				/bits/ 64 <493500000>;
++				/bits/ 64 <408000000>;
+ 		};
+ 	};
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0604-drivers-media-i2c-imx708-Fix-WIDE_DYNAMIC_RANGE-cont.patch b/target/linux/bcm27xx/patches-6.1/950-0604-drivers-media-i2c-imx708-Fix-WIDE_DYNAMIC_RANGE-cont.patch
new file mode 100644
index 00000000000000..2d0c0e4ffe811b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0604-drivers-media-i2c-imx708-Fix-WIDE_DYNAMIC_RANGE-cont.patch
@@ -0,0 +1,94 @@
+From 700a1a11144c9b18b9da3d900a1d8bfa30a195a8 Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Wed, 22 Mar 2023 12:01:57 +0000
+Subject: [PATCH] drivers: media: i2c: imx708: Fix WIDE_DYNAMIC_RANGE
+ control with long exposure
+
+Setting V4L2_CID_WIDE_DYNAMIC_RANGE was causing the long exposure
+shift count to be reset, which is incorrect if the user has already
+changed the frame length to cause it to have a non-zero value.
+
+Because it only updates control ranges and doesn't set any registers,
+the control can also be applied when the sensor is not powered on.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ drivers/media/i2c/imx708.c | 45 ++++++++++++++++++++++++--------------
+ 1 file changed, 28 insertions(+), 17 deletions(-)
+
+--- a/drivers/media/i2c/imx708.c
++++ b/drivers/media/i2c/imx708.c
+@@ -171,7 +171,7 @@ struct imx708_mode {
+ 	/* Not all modes have the same exposure lines step. */
+ 	u32 exposure_lines_step;
+ 
+-	/* HDR flag, currently not used at runtime */
++	/* HDR flag, used for checking if the current mode is HDR */
+ 	bool hdr;
+ };
+ 
+@@ -1060,9 +1060,6 @@ static void imx708_set_framing_limits(st
+ 	unsigned int hblank;
+ 	const struct imx708_mode *mode = imx708->mode;
+ 
+-	/* Default to no long exposure multiplier */
+-	imx708->long_exp_shift = 0;
+-
+ 	__v4l2_ctrl_modify_range(imx708->pixel_rate,
+ 				 mode->pixel_rate, mode->pixel_rate,
+ 				 1, mode->pixel_rate);
+@@ -1091,12 +1088,33 @@ static int imx708_set_ctrl(struct v4l2_c
+ 	unsigned int code, num_modes;
+ 	int ret = 0;
+ 
+-	/*
+-	 * The VBLANK control may change the limits of usable exposure, so check
+-	 * and adjust if necessary.
+-	 */
+-	if (ctrl->id == V4L2_CID_VBLANK)
++	switch (ctrl->id) {
++	case V4L2_CID_VBLANK:
++		/*
++		 * The VBLANK control may change the limits of usable exposure,
++		 * so check and adjust if necessary.
++		 */
+ 		imx708_adjust_exposure_range(imx708, ctrl);
++		break;
++
++	case V4L2_CID_WIDE_DYNAMIC_RANGE:
++		/*
++		 * The WIDE_DYNAMIC_RANGE control can also be applied immediately
++		 * as it doesn't set any registers. Don't do anything if the mode
++		 * already matches.
++		 */
++		if (imx708->mode && imx708->mode->hdr != ctrl->val) {
++			code = imx708_get_format_code(imx708);
++			get_mode_table(code, &mode_list, &num_modes, ctrl->val);
++			imx708->mode = v4l2_find_nearest_size(mode_list,
++							      num_modes,
++							      width, height,
++							      imx708->mode->width,
++							      imx708->mode->height);
++			imx708_set_framing_limits(imx708);
++		}
++		break;
++	}
+ 
+ 	/*
+ 	 * Applying V4L2 control value only happens
+@@ -1158,14 +1176,7 @@ static int imx708_set_ctrl(struct v4l2_c
+ 				       imx708->notify_gains->p_new.p_u32[3]);
+ 		break;
+ 	case V4L2_CID_WIDE_DYNAMIC_RANGE:
+-		code = imx708_get_format_code(imx708);
+-		get_mode_table(code, &mode_list, &num_modes, ctrl->val);
+-		imx708->mode = v4l2_find_nearest_size(mode_list,
+-						      num_modes,
+-						      width, height,
+-						      imx708->mode->width,
+-						      imx708->mode->height);
+-		imx708_set_framing_limits(imx708);
++		/* Already handled above. */
+ 		break;
+ 	default:
+ 		dev_info(&client->dev,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0605-rpisense-fb-Add-explicit-fb_deferred_io_mmap-hook.patch b/target/linux/bcm27xx/patches-6.1/950-0605-rpisense-fb-Add-explicit-fb_deferred_io_mmap-hook.patch
new file mode 100644
index 00000000000000..e5abb783e24de8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0605-rpisense-fb-Add-explicit-fb_deferred_io_mmap-hook.patch
@@ -0,0 +1,26 @@
+From 4b9950c6574aa5c9302b3b8bbf44fd31ee1cad7a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 27 Mar 2023 10:25:25 +0100
+Subject: [PATCH] rpisense-fb: Add explicit fb_deferred_io_mmap hook
+
+As of commit [1], introduced in 5.18, fbdev drivers that use
+deferred IO and need mmap support must include an explicit fb_mmap
+pointer to the fb_deferred_io_mmap.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+[1] 590558510327 ("fbdev: Put mmap for deferred I/O into drivers")
+---
+ drivers/video/fbdev/rpisense-fb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/video/fbdev/rpisense-fb.c
++++ b/drivers/video/fbdev/rpisense-fb.c
+@@ -191,6 +191,7 @@ static struct fb_ops rpisense_fb_ops = {
+ 	.fb_copyarea	= rpisense_fb_copyarea,
+ 	.fb_imageblit	= rpisense_fb_imageblit,
+ 	.fb_ioctl	= rpisense_fb_ioctl,
++	.fb_mmap	= fb_deferred_io_mmap,
+ };
+ 
+ static int rpisense_fb_probe(struct platform_device *pdev)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0606-hwrng-bcm2835-sleep-more-intelligently.patch b/target/linux/bcm27xx/patches-6.1/950-0606-hwrng-bcm2835-sleep-more-intelligently.patch
new file mode 100644
index 00000000000000..40c1091106a6dc
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0606-hwrng-bcm2835-sleep-more-intelligently.patch
@@ -0,0 +1,66 @@
+From 3537a855e3858b1f8b6cee545a22b8b67037235c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 22 Mar 2023 15:30:38 +0000
+Subject: [PATCH] hwrng: bcm2835 - sleep more intelligently
+
+While waiting for random data, use sleeps that are proportional
+to the amount of data expected. Prevent indefinite waits by
+giving up if nothing is received for a second.
+
+See: https://github.com/raspberrypi/linux/issues/5390
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/char/hw_random/bcm2835-rng.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+--- a/drivers/char/hw_random/bcm2835-rng.c
++++ b/drivers/char/hw_random/bcm2835-rng.c
+@@ -14,6 +14,7 @@
+ #include <linux/printk.h>
+ #include <linux/clk.h>
+ #include <linux/reset.h>
++#include <linux/delay.h>
+ 
+ #define RNG_CTRL	0x0
+ #define RNG_STATUS	0x4
+@@ -28,6 +29,9 @@
+ 
+ #define RNG_INT_OFF	0x1
+ 
++#define RNG_FIFO_WORDS	4
++#define RNG_US_PER_WORD	34 /* Tuned for throughput */
++
+ struct bcm2835_rng_priv {
+ 	struct hwrng rng;
+ 	void __iomem *base;
+@@ -64,19 +68,23 @@ static inline void rng_writel(struct bcm
+ static int bcm2835_rng_read(struct hwrng *rng, void *buf, size_t max,
+ 			       bool wait)
+ {
++	u32 retries = 1000000/(RNG_FIFO_WORDS * RNG_US_PER_WORD);
+ 	struct bcm2835_rng_priv *priv = to_rng_priv(rng);
+ 	u32 max_words = max / sizeof(u32);
+ 	u32 num_words, count;
+ 
+-	while ((rng_readl(priv, RNG_STATUS) >> 24) == 0) {
+-		if (!wait)
++	num_words = rng_readl(priv, RNG_STATUS) >> 24;
++
++	while (!num_words) {
++		if (!wait || !retries)
+ 			return 0;
+-		hwrng_msleep(rng, 1000);
++		retries--;
++		usleep_range((u32)RNG_US_PER_WORD,
++			     (u32)RNG_US_PER_WORD * RNG_FIFO_WORDS);
++		num_words = rng_readl(priv, RNG_STATUS) >> 24;
+ 	}
+ 
+-	num_words = rng_readl(priv, RNG_STATUS) >> 24;
+-	if (num_words > max_words)
+-		num_words = max_words;
++	num_words = min(num_words, max_words);
+ 
+ 	for (count = 0; count < num_words; count++)
+ 		((u32 *)buf)[count] = rng_readl(priv, RNG_DATA);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0607-vc04_services-bcm2835_codec-Set-MPEG2_LEVEL-control-.patch b/target/linux/bcm27xx/patches-6.1/950-0607-vc04_services-bcm2835_codec-Set-MPEG2_LEVEL-control-.patch
new file mode 100644
index 00000000000000..8392f17b4cae39
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0607-vc04_services-bcm2835_codec-Set-MPEG2_LEVEL-control-.patch
@@ -0,0 +1,24 @@
+From e718fc8f42a900b7b07b806ddfdb8c2b7a1aa3b1 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 10 Mar 2023 16:57:29 +0000
+Subject: [PATCH] vc04_services: bcm2835_codec: Set MPEG2_LEVEL control
+ to READ_ONLY
+
+V4L2_CID_MPEG_VIDEO_MPEG2_LEVEL  was missed from
+"vc04_services: bcm2835_codec: Ignore READ_ONLY ctrls in s_ctrl"
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
++++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+@@ -3246,6 +3246,7 @@ static void dec_add_profile_ctrls(struct
+ 							BIT(V4L2_MPEG_VIDEO_MPEG2_LEVEL_HIGH_1440) |
+ 							BIT(V4L2_MPEG_VIDEO_MPEG2_LEVEL_HIGH)),
+ 						      V4L2_MPEG_VIDEO_MPEG2_LEVEL_MAIN);
++			ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+ 			ctrl = v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
+ 						      V4L2_CID_MPEG_VIDEO_MPEG2_PROFILE,
+ 						      V4L2_MPEG_VIDEO_MPEG2_PROFILE_MAIN,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0608-staging-bcm2835-codec-Add-V4L2_CID_MPEG_VIDEO_B_FRAM.patch b/target/linux/bcm27xx/patches-6.1/950-0608-staging-bcm2835-codec-Add-V4L2_CID_MPEG_VIDEO_B_FRAM.patch
new file mode 100644
index 00000000000000..168b2d8c9dc6b5
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0608-staging-bcm2835-codec-Add-V4L2_CID_MPEG_VIDEO_B_FRAM.patch
@@ -0,0 +1,49 @@
+From bf9263611ac50bbe7b0113782468f653a28d2e52 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 14 Mar 2023 14:29:52 +0000
+Subject: [PATCH] staging: bcm2835-codec: Add
+ V4L2_CID_MPEG_VIDEO_B_FRAMES control
+
+FFmpeg insists on trying to set V4L2_CID_MPEG_VIDEO_B_FRAMES to
+0, and generates an error should it fail.
+As our encoder doesn't support B frames, add a stub handler for
+it to silence FFmpeg.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c   | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
++++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+@@ -2367,6 +2367,10 @@ static int bcm2835_codec_s_ctrl(struct v
+ 						    sizeof(u32_value));
+ 		break;
+ 	}
++	case V4L2_CID_MPEG_VIDEO_B_FRAMES:
++		ret = 0;
++		break;
++
+ 	case V4L2_CID_JPEG_COMPRESSION_QUALITY:
+ 		if (!ctx->component)
+ 			break;
+@@ -3356,7 +3360,7 @@ static int bcm2835_codec_open(struct fil
+ 	case ENCODE:
+ 	{
+ 		/* Encode controls */
+-		v4l2_ctrl_handler_init(hdl, 11);
++		v4l2_ctrl_handler_init(hdl, 12);
+ 
+ 		v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
+ 				       V4L2_CID_MPEG_VIDEO_BITRATE_MODE,
+@@ -3417,6 +3421,10 @@ static int bcm2835_codec_open(struct fil
+ 		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
+ 				  V4L2_CID_MPEG_VIDEO_FORCE_KEY_FRAME,
+ 				  0, 0, 0, 0);
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_MPEG_VIDEO_B_FRAMES,
++				  0, 0,
++				  1, 0);
+ 		if (hdl->error) {
+ 			rc = hdl->error;
+ 			goto free_ctrl_handler;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0609-staging-bcm2835-codec-Add-support-for-V4L2_CID_MPEG_.patch b/target/linux/bcm27xx/patches-6.1/950-0609-staging-bcm2835-codec-Add-support-for-V4L2_CID_MPEG_.patch
new file mode 100644
index 00000000000000..a8cb19652c09bc
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0609-staging-bcm2835-codec-Add-support-for-V4L2_CID_MPEG_.patch
@@ -0,0 +1,70 @@
+From f096c11828df983c5581bb96e8b238543652c008 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 14 Mar 2023 16:49:46 +0000
+Subject: [PATCH] staging: bcm2835-codec: Add support for
+ V4L2_CID_MPEG_VIDEO_GOP_SIZE
+
+For H264, V4L2_CID_MPEG_VIDEO_H264_I_PERIOD is meant to be the intra
+I-frame period, whilst V4L2_CID_MPEG_VIDEO_GOP_SIZE is the intra IDR
+frame period.
+The firmware encoder doesn't produce I-frames that aren't IDR as well,
+therefore V4L2_CID_MPEG_VIDEO_GOP_SIZE is technically the correct
+control, however users may have adopted V4L2_CID_MPEG_VIDEO_H264_I_PERIOD.
+
+Add support for V4L2_CID_MPEG_VIDEO_GOP_SIZE controlling the encoder,
+and have VIDIOC_S_CTRL for V4L2_CID_MPEG_VIDEO_H264_I_PERIOD update
+the value for V4L2_CID_MPEG_VIDEO_GOP_SIZE (the reverse is not
+implemented).
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../bcm2835-codec/bcm2835-v4l2-codec.c          | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
++++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+@@ -705,6 +705,7 @@ struct bcm2835_codec_ctx {
+ 	struct bcm2835_codec_dev	*dev;
+ 
+ 	struct v4l2_ctrl_handler hdl;
++	struct v4l2_ctrl *gop_size;
+ 
+ 	struct vchiq_mmal_component  *component;
+ 	bool component_enabled;
+@@ -2286,6 +2287,17 @@ static int bcm2835_codec_s_ctrl(struct v
+ 		break;
+ 
+ 	case V4L2_CID_MPEG_VIDEO_H264_I_PERIOD:
++		/*
++		 * Incorrect initial implementation meant that H264_I_PERIOD
++		 * was implemented to control intra-I period. As the MMAL
++		 * encoder never produces I-frames that aren't IDR frames, it
++		 * should actually have been GOP_SIZE.
++		 * Support both controls, but writing to H264_I_PERIOD will
++		 * update GOP_SIZE.
++		 */
++		__v4l2_ctrl_s_ctrl(ctx->gop_size, ctrl->val);
++	fallthrough;
++	case V4L2_CID_MPEG_VIDEO_GOP_SIZE:
+ 		if (!ctx->component)
+ 			break;
+ 
+@@ -3360,7 +3372,7 @@ static int bcm2835_codec_open(struct fil
+ 	case ENCODE:
+ 	{
+ 		/* Encode controls */
+-		v4l2_ctrl_handler_init(hdl, 12);
++		v4l2_ctrl_handler_init(hdl, 13);
+ 
+ 		v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
+ 				       V4L2_CID_MPEG_VIDEO_BITRATE_MODE,
+@@ -3425,6 +3437,9 @@ static int bcm2835_codec_open(struct fil
+ 				  V4L2_CID_MPEG_VIDEO_B_FRAMES,
+ 				  0, 0,
+ 				  1, 0);
++		ctx->gop_size = v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++						  V4L2_CID_MPEG_VIDEO_GOP_SIZE,
++						  0, 0x7FFFFFFF, 1, 60);
+ 		if (hdl->error) {
+ 			rc = hdl->error;
+ 			goto free_ctrl_handler;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0610-dtoverlays-Add-inverted-override-property-to-ssd1306.patch b/target/linux/bcm27xx/patches-6.1/950-0610-dtoverlays-Add-inverted-override-property-to-ssd1306.patch
new file mode 100644
index 00000000000000..535c751da654d2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0610-dtoverlays-Add-inverted-override-property-to-ssd1306.patch
@@ -0,0 +1,38 @@
+From d2db7798740061f6d54487ecaa9da15bc89cdc3c Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javierm@redhat.com>
+Date: Tue, 28 Mar 2023 05:11:58 +0200
+Subject: [PATCH] dtoverlays: Add inverted override property to
+ ssd1306-spi
+
+The new ssd130x DRM driver supports both SSD1306 I2C and SPI panels and is
+compatible with the ssd1307fb driver bindings. So the "solomon,com-invdir"
+DT property (to invert the COM pin scan dir) can also be used for SPI now.
+
+This allows to configure panels whose scan direction needs to be inverted.
+
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+---
+ arch/arm/boot/dts/overlays/README                  | 2 ++
+ arch/arm/boot/dts/overlays/ssd1306-spi-overlay.dts | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -4074,6 +4074,8 @@ Params: speed                   SPI bus
+         dc_pin                  GPIO pin for D/C (default 24)
+         reset_pin               GPIO pin for RESET (default 25)
+         height                  Display height (32 or 64; default 64)
++        inverted                Set this if display is inverted and mirrored.
++                                (default=not set)
+ 
+ 
+ Name:   ssd1331-spi
+--- a/arch/arm/boot/dts/overlays/ssd1306-spi-overlay.dts
++++ b/arch/arm/boot/dts/overlays/ssd1306-spi-overlay.dts
+@@ -80,5 +80,6 @@
+ 		reset_pin = <&ssd1306>,"reset-gpios:4",
+ 		            <&ssd1306_pins>,"brcm,pins:0";
+ 		height    = <&ssd1306>,"solomon,height:0";
++		inverted = <&ssd1306>,"solomon,com-invdir?";
+ 	};
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0611-media-i2c-imx290-Reset-to-upstream.patch b/target/linux/bcm27xx/patches-6.1/950-0611-media-i2c-imx290-Reset-to-upstream.patch
new file mode 100644
index 00000000000000..338329f22fd1e3
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0611-media-i2c-imx290-Reset-to-upstream.patch
@@ -0,0 +1,1002 @@
+From da0ac2bb7f9ce7ab8657ccd20d704a16a9cc61c0 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 24 Nov 2022 18:09:07 +0000
+Subject: [PATCH] media: i2c: imx290: Reset to upstream.
+
+For backporting a load of upstream commits, reset to upstream first.
+Downstream patches then need to be regenerated and applied.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/imx290.c | 621 ++++++++-----------------------------
+ 1 file changed, 133 insertions(+), 488 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -1,16 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /*
+- * Sony IMX462 / IMX290 / IMX327 CMOS Image Sensor Driver
+- *
+- * The IMX462, IMX290,and IMX327 are very similar 1920x1080 1/2.8 CMOS image
+- * sensors.
+- * IMX327 can support up to 60fps with 10 or 12bit readout.
+- * IMX290 adds support for 120fps, but only 10bit and when connected over 4
+- * CSI-2 lanes.
+- * IMX462 adds support for 120fps in both 10 and 12bit readout modes.
+- *
+- * The modules don't appear to have a mechanism to identify whether the mono or
+- * colour variant is connected, therefore it is done via compatible string.
++ * Sony IMX290 CMOS Image Sensor Driver
+  *
+  * Copyright (C) 2019 FRAMOS GmbH.
+  *
+@@ -23,7 +13,6 @@
+ #include <linux/gpio/consumer.h>
+ #include <linux/i2c.h>
+ #include <linux/module.h>
+-#include <linux/of_device.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/regmap.h>
+ #include <linux/regulator/consumer.h>
+@@ -33,28 +22,15 @@
+ #include <media/v4l2-fwnode.h>
+ #include <media/v4l2-subdev.h>
+ 
+-enum imx290_clk_index {
+-	CLK_37_125,
+-	CLK_74_25,
+-};
+-
+ #define IMX290_STANDBY 0x3000
+ #define IMX290_REGHOLD 0x3001
+ #define IMX290_XMSTA 0x3002
+-#define IMX290_FLIP_WINMODE 0x3007
+ #define IMX290_FR_FDG_SEL 0x3009
+ #define IMX290_BLKLEVEL_LOW 0x300a
+ #define IMX290_BLKLEVEL_HIGH 0x300b
+ #define IMX290_GAIN 0x3014
+-#define IMX290_VMAX_LOW 0x3018
+-#define IMX290_VMAX_MAX 0x3fff
+ #define IMX290_HMAX_LOW 0x301c
+ #define IMX290_HMAX_HIGH 0x301d
+-#define IMX290_HMAX_MAX 0xffff
+-
+-#define IMX290_EXPOSURE_MIN 1
+-#define IMX290_EXPOSURE_STEP 1
+-#define IMX290_EXPOSURE_LOW 0x3020
+ #define IMX290_PGCTRL 0x308c
+ #define IMX290_PHY_LANE_NUM 0x3407
+ #define IMX290_CSI_LANE_MODE 0x3443
+@@ -63,13 +39,6 @@ enum imx290_clk_index {
+ #define IMX290_PGCTRL_THRU BIT(1)
+ #define IMX290_PGCTRL_MODE(n) ((n) << 4)
+ 
+-#define IMX290_NATIVE_WIDTH		1945U
+-#define IMX290_NATIVE_HEIGHT		1109U
+-#define IMX290_PIXEL_ARRAY_LEFT		4U
+-#define IMX290_PIXEL_ARRAY_TOP		12U
+-#define IMX290_PIXEL_ARRAY_WIDTH	1937U
+-#define IMX290_PIXEL_ARRAY_HEIGHT	1097U
+-
+ static const char * const imx290_supply_name[] = {
+ 	"vdda",
+ 	"vddd",
+@@ -87,31 +56,19 @@ struct imx290_mode {
+ 	u32 width;
+ 	u32 height;
+ 	u32 hmax;
+-	u32 vmax;
+ 	u8 link_freq_index;
+-	struct v4l2_rect crop;
+-
+-	const struct imx290_regval *mode_data;
+-	u32 mode_data_size;
+-	const struct imx290_regval *lane_data;
+-	u32 lane_data_size;
+ 
+-
+-	/* Clock setup can vary. Index as enum imx290_clk_index */
+-	const struct imx290_regval *clk_data[2];
+-	u32 clk_size;
++	const struct imx290_regval *data;
++	u32 data_size;
+ };
+ 
+ struct imx290 {
+ 	struct device *dev;
+ 	struct clk *xclk;
+-	u32 xclk_freq;
+ 	struct regmap *regmap;
+ 	u8 nlanes;
+ 	u8 bpp;
+ 
+-	const struct imx290_pixfmt *formats;
+-
+ 	struct v4l2_subdev sd;
+ 	struct media_pad pad;
+ 	struct v4l2_mbus_framefmt current_format;
+@@ -123,11 +80,6 @@ struct imx290 {
+ 	struct v4l2_ctrl_handler ctrls;
+ 	struct v4l2_ctrl *link_freq;
+ 	struct v4l2_ctrl *pixel_rate;
+-	struct v4l2_ctrl *hblank;
+-	struct v4l2_ctrl *vblank;
+-	struct v4l2_ctrl *hflip;
+-	struct v4l2_ctrl *vflip;
+-	struct v4l2_ctrl *exposure;
+ 
+ 	struct mutex lock;
+ };
+@@ -137,18 +89,11 @@ struct imx290_pixfmt {
+ 	u8 bpp;
+ };
+ 
+-#define IMX290_NUM_FORMATS 2
+-
+-static const struct imx290_pixfmt imx290_colour_formats[IMX290_NUM_FORMATS] = {
++static const struct imx290_pixfmt imx290_formats[] = {
+ 	{ MEDIA_BUS_FMT_SRGGB10_1X10, 10 },
+ 	{ MEDIA_BUS_FMT_SRGGB12_1X12, 12 },
+ };
+ 
+-static const struct imx290_pixfmt imx290_mono_formats[IMX290_NUM_FORMATS] = {
+-	{ MEDIA_BUS_FMT_Y10_1X10, 10 },
+-	{ MEDIA_BUS_FMT_Y12_1X12, 12 },
+-};
+-
+ static const struct regmap_config imx290_regmap_config = {
+ 	.reg_bits = 16,
+ 	.val_bits = 8,
+@@ -168,7 +113,11 @@ static const char * const imx290_test_pa
+ 
+ static const struct imx290_regval imx290_global_init_settings[] = {
+ 	{ 0x3007, 0x00 },
++	{ 0x3018, 0x65 },
++	{ 0x3019, 0x04 },
+ 	{ 0x301a, 0x00 },
++	{ 0x3444, 0x20 },
++	{ 0x3445, 0x25 },
+ 	{ 0x303a, 0x0c },
+ 	{ 0x3040, 0x00 },
+ 	{ 0x3041, 0x00 },
+@@ -222,33 +171,8 @@ static const struct imx290_regval imx290
+ 	{ 0x33b3, 0x04 },
+ };
+ 
+-static const struct imx290_regval imx290_37_125mhz_clock_1080p[] = {
+-	{ 0x305c, 0x18 },
+-	{ 0x305d, 0x03 },
+-	{ 0x305e, 0x20 },
+-	{ 0x305f, 0x01 },
+-	{ 0x315e, 0x1a },
+-	{ 0x3164, 0x1a },
+-	{ 0x3444, 0x20 },
+-	{ 0x3445, 0x25 },
+-	{ 0x3480, 0x49 },
+-};
+-
+-static const struct imx290_regval imx290_74_250mhz_clock_1080p[] = {
+-	{ 0x305c, 0x0c },
+-	{ 0x305d, 0x03 },
+-	{ 0x305e, 0x10 },
+-	{ 0x305f, 0x01 },
+-	{ 0x315e, 0x1b },
+-	{ 0x3164, 0x1b },
+-	{ 0x3444, 0x40 },
+-	{ 0x3445, 0x4a },
+-	{ 0x3480, 0x92 },
+-};
+-
+-static const struct imx290_regval imx290_1080p_common_settings[] = {
++static const struct imx290_regval imx290_1080p_settings[] = {
+ 	/* mode settings */
+-	{ IMX290_FR_FDG_SEL, 0x01 },
+ 	{ 0x3007, 0x00 },
+ 	{ 0x303a, 0x0c },
+ 	{ 0x3414, 0x0a },
+@@ -258,36 +182,15 @@ static const struct imx290_regval imx290
+ 	{ 0x3419, 0x04 },
+ 	{ 0x3012, 0x64 },
+ 	{ 0x3013, 0x00 },
+-};
+-
+-static const struct imx290_regval imx290_1080p_2lane_settings[] = {
+-	{ 0x3405, 0x00 },
++	{ 0x305c, 0x18 },
++	{ 0x305d, 0x03 },
++	{ 0x305e, 0x20 },
++	{ 0x305f, 0x01 },
++	{ 0x315e, 0x1a },
++	{ 0x3164, 0x1a },
++	{ 0x3480, 0x49 },
+ 	/* data rate settings */
+-	{ IMX290_PHY_LANE_NUM, 0x01 },
+-	{ IMX290_CSI_LANE_MODE, 0x01 },
+-	{ 0x3446, 0x77 },
+-	{ 0x3447, 0x00 },
+-	{ 0x3448, 0x67 },
+-	{ 0x3449, 0x00 },
+-	{ 0x344a, 0x47 },
+-	{ 0x344b, 0x00 },
+-	{ 0x344c, 0x37 },
+-	{ 0x344d, 0x00 },
+-	{ 0x344e, 0x3f },
+-	{ 0x344f, 0x00 },
+-	{ 0x3450, 0xff },
+-	{ 0x3451, 0x00 },
+-	{ 0x3452, 0x3f },
+-	{ 0x3453, 0x00 },
+-	{ 0x3454, 0x37 },
+-	{ 0x3455, 0x00 },
+-};
+-
+-static const struct imx290_regval imx290_1080p_4lane_settings[] = {
+ 	{ 0x3405, 0x10 },
+-	/* data rate settings */
+-	{ IMX290_PHY_LANE_NUM, 0x03 },
+-	{ IMX290_CSI_LANE_MODE, 0x03 },
+ 	{ 0x3446, 0x57 },
+ 	{ 0x3447, 0x00 },
+ 	{ 0x3448, 0x37 },
+@@ -306,33 +209,8 @@ static const struct imx290_regval imx290
+ 	{ 0x3455, 0x00 },
+ };
+ 
+-static const struct imx290_regval imx290_37_125mhz_clock_720p[] = {
+-	{ 0x305c, 0x20 },
+-	{ 0x305d, 0x00 },
+-	{ 0x305e, 0x20 },
+-	{ 0x305f, 0x01 },
+-	{ 0x315e, 0x1a },
+-	{ 0x3164, 0x1a },
+-	{ 0x3444, 0x20 },
+-	{ 0x3445, 0x25 },
+-	{ 0x3480, 0x49 },
+-};
+-
+-static const struct imx290_regval imx290_74_250mhz_clock_720p[] = {
+-	{ 0x305c, 0x10 },
+-	{ 0x305d, 0x00 },
+-	{ 0x305e, 0x10 },
+-	{ 0x305f, 0x01 },
+-	{ 0x315e, 0x1b },
+-	{ 0x3164, 0x1b },
+-	{ 0x3444, 0x40 },
+-	{ 0x3445, 0x4a },
+-	{ 0x3480, 0x92 },
+-};
+-
+-static const struct imx290_regval imx290_720p_common_settings[] = {
++static const struct imx290_regval imx290_720p_settings[] = {
+ 	/* mode settings */
+-	{ IMX290_FR_FDG_SEL, 0x01 },
+ 	{ 0x3007, 0x10 },
+ 	{ 0x303a, 0x06 },
+ 	{ 0x3414, 0x04 },
+@@ -342,36 +220,15 @@ static const struct imx290_regval imx290
+ 	{ 0x3419, 0x02 },
+ 	{ 0x3012, 0x64 },
+ 	{ 0x3013, 0x00 },
+-};
+-
+-static const struct imx290_regval imx290_720p_2lane_settings[] = {
+-	{ 0x3405, 0x00 },
+-	{ IMX290_PHY_LANE_NUM, 0x01 },
+-	{ IMX290_CSI_LANE_MODE, 0x01 },
++	{ 0x305c, 0x20 },
++	{ 0x305d, 0x00 },
++	{ 0x305e, 0x20 },
++	{ 0x305f, 0x01 },
++	{ 0x315e, 0x1a },
++	{ 0x3164, 0x1a },
++	{ 0x3480, 0x49 },
+ 	/* data rate settings */
+-	{ 0x3446, 0x67 },
+-	{ 0x3447, 0x00 },
+-	{ 0x3448, 0x57 },
+-	{ 0x3449, 0x00 },
+-	{ 0x344a, 0x2f },
+-	{ 0x344b, 0x00 },
+-	{ 0x344c, 0x27 },
+-	{ 0x344d, 0x00 },
+-	{ 0x344e, 0x2f },
+-	{ 0x344f, 0x00 },
+-	{ 0x3450, 0xbf },
+-	{ 0x3451, 0x00 },
+-	{ 0x3452, 0x2f },
+-	{ 0x3453, 0x00 },
+-	{ 0x3454, 0x27 },
+-	{ 0x3455, 0x00 },
+-};
+-
+-static const struct imx290_regval imx290_720p_4lane_settings[] = {
+ 	{ 0x3405, 0x10 },
+-	{ IMX290_PHY_LANE_NUM, 0x03 },
+-	{ IMX290_CSI_LANE_MODE, 0x03 },
+-	/* data rate settings */
+ 	{ 0x3446, 0x4f },
+ 	{ 0x3447, 0x00 },
+ 	{ 0x3448, 0x2f },
+@@ -451,46 +308,18 @@ static const struct imx290_mode imx290_m
+ 	{
+ 		.width = 1920,
+ 		.height = 1080,
+-		.hmax = 0x0898,
+-		.vmax = 0x0465,
++		.hmax = 0x1130,
+ 		.link_freq_index = FREQ_INDEX_1080P,
+-		.crop = {
+-			.left = 4 + 8,
+-			.top = 12 + 8,
+-			.width = 1920,
+-			.height = 1080,
+-		},
+-		.mode_data = imx290_1080p_common_settings,
+-		.mode_data_size = ARRAY_SIZE(imx290_1080p_common_settings),
+-		.lane_data = imx290_1080p_2lane_settings,
+-		.lane_data_size = ARRAY_SIZE(imx290_1080p_2lane_settings),
+-		.clk_data = {
+-			[CLK_37_125] = imx290_37_125mhz_clock_1080p,
+-			[CLK_74_25] = imx290_74_250mhz_clock_1080p,
+-		},
+-		.clk_size = ARRAY_SIZE(imx290_37_125mhz_clock_1080p),
++		.data = imx290_1080p_settings,
++		.data_size = ARRAY_SIZE(imx290_1080p_settings),
+ 	},
+ 	{
+ 		.width = 1280,
+ 		.height = 720,
+-		.hmax = 0x0ce4,
+-		.vmax = 0x02ee,
++		.hmax = 0x19c8,
+ 		.link_freq_index = FREQ_INDEX_720P,
+-		.crop = {
+-			.left = 4 + 8 + 320,
+-			.top = 12 + 8 + 180,
+-			.width = 1280,
+-			.height = 720,
+-		},
+-		.mode_data = imx290_720p_common_settings,
+-		.mode_data_size = ARRAY_SIZE(imx290_720p_common_settings),
+-		.lane_data = imx290_720p_2lane_settings,
+-		.lane_data_size = ARRAY_SIZE(imx290_720p_2lane_settings),
+-		.clk_data = {
+-			[CLK_37_125] = imx290_37_125mhz_clock_720p,
+-			[CLK_74_25] = imx290_74_250mhz_clock_720p,
+-		},
+-		.clk_size = ARRAY_SIZE(imx290_37_125mhz_clock_720p),
++		.data = imx290_720p_settings,
++		.data_size = ARRAY_SIZE(imx290_720p_settings),
+ 	},
+ };
+ 
+@@ -499,45 +328,17 @@ static const struct imx290_mode imx290_m
+ 		.width = 1920,
+ 		.height = 1080,
+ 		.hmax = 0x0898,
+-		.vmax = 0x0465,
+ 		.link_freq_index = FREQ_INDEX_1080P,
+-		.crop = {
+-			.left = 4 + 8,
+-			.top = 12 + 8,
+-			.width = 1920,
+-			.height = 1080,
+-		},
+-		.mode_data = imx290_1080p_common_settings,
+-		.mode_data_size = ARRAY_SIZE(imx290_1080p_common_settings),
+-		.lane_data = imx290_1080p_4lane_settings,
+-		.lane_data_size = ARRAY_SIZE(imx290_1080p_4lane_settings),
+-		.clk_data = {
+-			[CLK_37_125] = imx290_37_125mhz_clock_1080p,
+-			[CLK_74_25] = imx290_74_250mhz_clock_1080p,
+-		},
+-		.clk_size = ARRAY_SIZE(imx290_37_125mhz_clock_1080p),
++		.data = imx290_1080p_settings,
++		.data_size = ARRAY_SIZE(imx290_1080p_settings),
+ 	},
+ 	{
+ 		.width = 1280,
+ 		.height = 720,
+ 		.hmax = 0x0ce4,
+-		.vmax = 0x02ee,
+ 		.link_freq_index = FREQ_INDEX_720P,
+-		.crop = {
+-			.left = 4 + 8 + 320,
+-			.top = 12 + 8 + 180,
+-			.width = 1280,
+-			.height = 720,
+-		},
+-		.mode_data = imx290_720p_common_settings,
+-		.mode_data_size = ARRAY_SIZE(imx290_720p_common_settings),
+-		.lane_data = imx290_720p_4lane_settings,
+-		.lane_data_size = ARRAY_SIZE(imx290_720p_4lane_settings),
+-		.clk_data = {
+-			[CLK_37_125] = imx290_37_125mhz_clock_720p,
+-			[CLK_74_25] = imx290_74_250mhz_clock_720p,
+-		},
+-		.clk_size = ARRAY_SIZE(imx290_37_125mhz_clock_720p),
++		.data = imx290_720p_settings,
++		.data_size = ARRAY_SIZE(imx290_720p_settings),
+ 	},
+ };
+ 
+@@ -651,53 +452,6 @@ static int imx290_set_gain(struct imx290
+ 	return ret;
+ }
+ 
+-static int imx290_set_exposure(struct imx290 *imx290, u32 value)
+-{
+-	u32 exposure = (imx290->current_mode->height + imx290->vblank->val) -
+-						value - 1;
+-	int ret;
+-
+-	ret = imx290_write_buffered_reg(imx290, IMX290_EXPOSURE_LOW, 3,
+-					exposure);
+-	if (ret)
+-		dev_err(imx290->dev, "Unable to write exposure\n");
+-
+-	return ret;
+-}
+-
+-static int imx290_set_hmax(struct imx290 *imx290, u32 val)
+-{
+-	u32 hmax = val + imx290->current_mode->width;
+-	int ret;
+-
+-	ret = imx290_write_buffered_reg(imx290, IMX290_HMAX_LOW, 2,
+-					hmax);
+-	if (ret)
+-		dev_err(imx290->dev, "Error setting HMAX register\n");
+-
+-	return ret;
+-}
+-
+-static int imx290_set_vmax(struct imx290 *imx290, u32 val)
+-{
+-	u32 vmax = val + imx290->current_mode->height;
+-	int ret;
+-
+-	ret = imx290_write_buffered_reg(imx290, IMX290_VMAX_LOW, 3,
+-					vmax);
+-	if (ret)
+-		dev_err(imx290->dev, "Unable to write vmax\n");
+-
+-	/*
+-	 * Becuse of the way exposure works for this sensor, updating
+-	 * vblank causes the effective exposure to change, so we must
+-	 * set it back to the "new" correct value.
+-	 */
+-	imx290_set_exposure(imx290, imx290->exposure->val);
+-
+-	return ret;
+-}
+-
+ /* Stop streaming */
+ static int imx290_stop_streaming(struct imx290 *imx290)
+ {
+@@ -717,50 +471,15 @@ static int imx290_set_ctrl(struct v4l2_c
+ 	struct imx290 *imx290 = container_of(ctrl->handler,
+ 					     struct imx290, ctrls);
+ 	int ret = 0;
+-	u8 val;
+-
+-	if (ctrl->id == V4L2_CID_VBLANK) {
+-		u32 vmax = ctrl->val + imx290->current_mode->height;
+-
+-		/*
+-		 * Changing vblank changes the allowed range for exposure.
+-		 * We don't supply the current exposure as default here as it
+-		 * may lie outside the new range. We will reset it just below.
+-		 */
+-		__v4l2_ctrl_modify_range(imx290->exposure,
+-					 IMX290_EXPOSURE_MIN,
+-					 vmax - 2,
+-					 IMX290_EXPOSURE_STEP,
+-					 vmax - 2);
+-	}
+ 
+ 	/* V4L2 controls values will be applied only when power is already up */
+ 	if (!pm_runtime_get_if_in_use(imx290->dev))
+ 		return 0;
+ 
+ 	switch (ctrl->id) {
+-	case V4L2_CID_ANALOGUE_GAIN:
++	case V4L2_CID_GAIN:
+ 		ret = imx290_set_gain(imx290, ctrl->val);
+ 		break;
+-	case V4L2_CID_EXPOSURE:
+-		ret = imx290_set_exposure(imx290, ctrl->val);
+-		break;
+-	case V4L2_CID_HBLANK:
+-		ret = imx290_set_hmax(imx290, ctrl->val);
+-		break;
+-	case V4L2_CID_VBLANK:
+-		ret = imx290_set_vmax(imx290, ctrl->val);
+-		break;
+-	case V4L2_CID_HFLIP:
+-	case V4L2_CID_VFLIP:
+-		/* WINMODE is in bits [6:4], so need to read-modify-write */
+-		ret = imx290_read_reg(imx290, IMX290_FLIP_WINMODE, &val);
+-		if (ret)
+-			break;
+-		val &= ~0x03;
+-		val |= imx290->vflip->val | (imx290->hflip->val << 1);
+-		ret = imx290_write_reg(imx290, IMX290_FLIP_WINMODE, val);
+-		break;
+ 	case V4L2_CID_TEST_PATTERN:
+ 		if (ctrl->val) {
+ 			imx290_write_reg(imx290, IMX290_BLKLEVEL_LOW, 0x00);
+@@ -800,12 +519,10 @@ static int imx290_enum_mbus_code(struct
+ 				 struct v4l2_subdev_state *sd_state,
+ 				 struct v4l2_subdev_mbus_code_enum *code)
+ {
+-	const struct imx290 *imx290 = to_imx290(sd);
+-
+-	if (code->index >= IMX290_NUM_FORMATS)
++	if (code->index >= ARRAY_SIZE(imx290_formats))
+ 		return -EINVAL;
+ 
+-	code->code = imx290->formats[code->index].code;
++	code->code = imx290_formats[code->index].code;
+ 
+ 	return 0;
+ }
+@@ -817,8 +534,8 @@ static int imx290_enum_frame_size(struct
+ 	const struct imx290 *imx290 = to_imx290(sd);
+ 	const struct imx290_mode *imx290_modes = imx290_modes_ptr(imx290);
+ 
+-	if (fse->code != imx290->formats[0].code &&
+-	    fse->code != imx290->formats[1].code)
++	if ((fse->code != imx290_formats[0].code) &&
++	    (fse->code != imx290_formats[1].code))
+ 		return -EINVAL;
+ 
+ 	if (fse->index >= imx290_modes_num(imx290))
+@@ -859,9 +576,23 @@ static inline u8 imx290_get_link_freq_in
+ 	return imx290->current_mode->link_freq_index;
+ }
+ 
++static s64 imx290_get_link_freq(struct imx290 *imx290)
++{
++	u8 index = imx290_get_link_freq_index(imx290);
++
++	return *(imx290_link_freqs_ptr(imx290) + index);
++}
++
+ static u64 imx290_calc_pixel_rate(struct imx290 *imx290)
+ {
+-	return 148500000;
++	s64 link_freq = imx290_get_link_freq(imx290);
++	u8 nlanes = imx290->nlanes;
++	u64 pixel_rate;
++
++	/* pixel rate = link_freq * 2 * nr_of_lanes / bits_per_sample */
++	pixel_rate = link_freq * 2 * nlanes;
++	do_div(pixel_rate, imx290->bpp);
++	return pixel_rate;
+ }
+ 
+ static int imx290_set_fmt(struct v4l2_subdev *sd,
+@@ -882,30 +613,22 @@ static int imx290_set_fmt(struct v4l2_su
+ 	fmt->format.width = mode->width;
+ 	fmt->format.height = mode->height;
+ 
+-	for (i = 0; i < IMX290_NUM_FORMATS; i++)
+-		if (imx290->formats[i].code == fmt->format.code)
++	for (i = 0; i < ARRAY_SIZE(imx290_formats); i++)
++		if (imx290_formats[i].code == fmt->format.code)
+ 			break;
+ 
+-	if (i >= IMX290_NUM_FORMATS)
++	if (i >= ARRAY_SIZE(imx290_formats))
+ 		i = 0;
+ 
+-	fmt->format.code = imx290->formats[i].code;
++	fmt->format.code = imx290_formats[i].code;
+ 	fmt->format.field = V4L2_FIELD_NONE;
+-	fmt->format.colorspace = V4L2_COLORSPACE_RAW;
+-	fmt->format.ycbcr_enc =
+-			V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->format.colorspace);
+-	fmt->format.quantization =
+-		V4L2_MAP_QUANTIZATION_DEFAULT(true, fmt->format.colorspace,
+-					      fmt->format.ycbcr_enc);
+-	fmt->format.xfer_func =
+-		V4L2_MAP_XFER_FUNC_DEFAULT(fmt->format.colorspace);
+ 
+ 	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
+ 		format = v4l2_subdev_get_try_format(sd, sd_state, fmt->pad);
+ 	} else {
+ 		format = &imx290->current_format;
+ 		imx290->current_mode = mode;
+-		imx290->bpp = imx290->formats[i].bpp;
++		imx290->bpp = imx290_formats[i].bpp;
+ 
+ 		if (imx290->link_freq)
+ 			__v4l2_ctrl_s_ctrl(imx290->link_freq,
+@@ -913,18 +636,6 @@ static int imx290_set_fmt(struct v4l2_su
+ 		if (imx290->pixel_rate)
+ 			__v4l2_ctrl_s_ctrl_int64(imx290->pixel_rate,
+ 						 imx290_calc_pixel_rate(imx290));
+-
+-		if (imx290->hblank)
+-			__v4l2_ctrl_modify_range(imx290->hblank,
+-						 mode->hmax - mode->width,
+-						 IMX290_HMAX_MAX - mode->width,
+-						 1, mode->hmax - mode->width);
+-		if (imx290->vblank)
+-			__v4l2_ctrl_modify_range(imx290->vblank,
+-						 mode->vmax - mode->height,
+-						 IMX290_VMAX_MAX - mode->height,
+-						 1,
+-						 mode->vmax - mode->height);
+ 	}
+ 
+ 	*format = fmt->format;
+@@ -954,7 +665,6 @@ static int imx290_write_current_format(s
+ 
+ 	switch (imx290->current_format.code) {
+ 	case MEDIA_BUS_FMT_SRGGB10_1X10:
+-	case MEDIA_BUS_FMT_Y10_1X10:
+ 		ret = imx290_set_register_array(imx290, imx290_10bit_settings,
+ 						ARRAY_SIZE(
+ 							imx290_10bit_settings));
+@@ -964,7 +674,6 @@ static int imx290_write_current_format(s
+ 		}
+ 		break;
+ 	case MEDIA_BUS_FMT_SRGGB12_1X12:
+-	case MEDIA_BUS_FMT_Y12_1X12:
+ 		ret = imx290_set_register_array(imx290, imx290_12bit_settings,
+ 						ARRAY_SIZE(
+ 							imx290_12bit_settings));
+@@ -981,63 +690,28 @@ static int imx290_write_current_format(s
+ 	return 0;
+ }
+ 
+-static const struct v4l2_rect *
+-__imx290_get_pad_crop(struct imx290 *imx290,
+-		      struct v4l2_subdev_state *sd_state,
+-		      unsigned int pad, enum v4l2_subdev_format_whence which)
+-{
+-	switch (which) {
+-	case V4L2_SUBDEV_FORMAT_TRY:
+-		return v4l2_subdev_get_try_crop(&imx290->sd, sd_state, pad);
+-	case V4L2_SUBDEV_FORMAT_ACTIVE:
+-		return &imx290->current_mode->crop;
+-	}
+-
+-	return NULL;
+-}
+-
+-static int imx290_get_selection(struct v4l2_subdev *sd,
+-				struct v4l2_subdev_state *sd_state,
+-				struct v4l2_subdev_selection *sel)
++static int imx290_set_hmax(struct imx290 *imx290, u32 val)
+ {
+-	switch (sel->target) {
+-	case V4L2_SEL_TGT_CROP: {
+-		struct imx290 *imx290 = to_imx290(sd);
+-
+-		mutex_lock(&imx290->lock);
+-		sel->r = *__imx290_get_pad_crop(imx290, sd_state, sel->pad,
+-						sel->which);
+-		mutex_unlock(&imx290->lock);
++	int ret;
+ 
+-		return 0;
++	ret = imx290_write_reg(imx290, IMX290_HMAX_LOW, (val & 0xff));
++	if (ret) {
++		dev_err(imx290->dev, "Error setting HMAX register\n");
++		return ret;
+ 	}
+ 
+-	case V4L2_SEL_TGT_NATIVE_SIZE:
+-		sel->r.top = 0;
+-		sel->r.left = 0;
+-		sel->r.width = IMX290_NATIVE_WIDTH;
+-		sel->r.height = IMX290_NATIVE_HEIGHT;
+-
+-		return 0;
+-
+-	case V4L2_SEL_TGT_CROP_DEFAULT:
+-	case V4L2_SEL_TGT_CROP_BOUNDS:
+-		sel->r.top = IMX290_PIXEL_ARRAY_TOP;
+-		sel->r.left = IMX290_PIXEL_ARRAY_LEFT;
+-		sel->r.width = IMX290_PIXEL_ARRAY_WIDTH;
+-		sel->r.height = IMX290_PIXEL_ARRAY_HEIGHT;
+-
+-		return 0;
++	ret = imx290_write_reg(imx290, IMX290_HMAX_HIGH, ((val >> 8) & 0xff));
++	if (ret) {
++		dev_err(imx290->dev, "Error setting HMAX register\n");
++		return ret;
+ 	}
+ 
+-	return -EINVAL;
++	return 0;
+ }
+ 
+ /* Start streaming */
+ static int imx290_start_streaming(struct imx290 *imx290)
+ {
+-	enum imx290_clk_index clk_idx = imx290->xclk_freq == 37125000 ?
+-					CLK_37_125 : CLK_74_25;
+ 	int ret;
+ 
+ 	/* Set init register settings */
+@@ -1049,14 +723,6 @@ static int imx290_start_streaming(struct
+ 		return ret;
+ 	}
+ 
+-	ret = imx290_set_register_array(imx290,
+-					imx290->current_mode->clk_data[clk_idx],
+-					imx290->current_mode->clk_size);
+-	if (ret < 0) {
+-		dev_err(imx290->dev, "Could not set clock registers\n");
+-		return ret;
+-	}
+-
+ 	/* Apply the register values related to current frame format */
+ 	ret = imx290_write_current_format(imx290);
+ 	if (ret < 0) {
+@@ -1065,22 +731,15 @@ static int imx290_start_streaming(struct
+ 	}
+ 
+ 	/* Apply default values of current mode */
+-	ret = imx290_set_register_array(imx290,
+-					imx290->current_mode->mode_data,
+-					imx290->current_mode->mode_data_size);
++	ret = imx290_set_register_array(imx290, imx290->current_mode->data,
++					imx290->current_mode->data_size);
+ 	if (ret < 0) {
+ 		dev_err(imx290->dev, "Could not set current mode\n");
+ 		return ret;
+ 	}
+-
+-	/* Apply lane config registers of current mode */
+-	ret = imx290_set_register_array(imx290,
+-					imx290->current_mode->lane_data,
+-					imx290->current_mode->lane_data_size);
+-	if (ret < 0) {
+-		dev_err(imx290->dev, "Could not set current mode\n");
++	ret = imx290_set_hmax(imx290, imx290->current_mode->hmax);
++	if (ret < 0)
+ 		return ret;
+-	}
+ 
+ 	/* Apply customized values from user */
+ 	ret = v4l2_ctrl_handler_setup(imx290->sd.ctrl_handler);
+@@ -1119,9 +778,6 @@ static int imx290_set_stream(struct v4l2
+ 		imx290_stop_streaming(imx290);
+ 		pm_runtime_put(imx290->dev);
+ 	}
+-	/* vflip and hflip cannot change during streaming */
+-	__v4l2_ctrl_grab(imx290->vflip, enable);
+-	__v4l2_ctrl_grab(imx290->hflip, enable);
+ 
+ unlock_and_return:
+ 
+@@ -1139,6 +795,49 @@ static int imx290_get_regulators(struct
+ 				       imx290->supplies);
+ }
+ 
++static int imx290_set_data_lanes(struct imx290 *imx290)
++{
++	int ret = 0, laneval, frsel;
++
++	switch (imx290->nlanes) {
++	case 2:
++		laneval = 0x01;
++		frsel = 0x02;
++		break;
++	case 4:
++		laneval = 0x03;
++		frsel = 0x01;
++		break;
++	default:
++		/*
++		 * We should never hit this since the data lane count is
++		 * validated in probe itself
++		 */
++		dev_err(imx290->dev, "Lane configuration not supported\n");
++		ret = -EINVAL;
++		goto exit;
++	}
++
++	ret = imx290_write_reg(imx290, IMX290_PHY_LANE_NUM, laneval);
++	if (ret) {
++		dev_err(imx290->dev, "Error setting Physical Lane number register\n");
++		goto exit;
++	}
++
++	ret = imx290_write_reg(imx290, IMX290_CSI_LANE_MODE, laneval);
++	if (ret) {
++		dev_err(imx290->dev, "Error setting CSI Lane mode register\n");
++		goto exit;
++	}
++
++	ret = imx290_write_reg(imx290, IMX290_FR_FDG_SEL, frsel);
++	if (ret)
++		dev_err(imx290->dev, "Error setting FR/FDG SEL register\n");
++
++exit:
++	return ret;
++}
++
+ static int imx290_power_on(struct device *dev)
+ {
+ 	struct v4l2_subdev *sd = dev_get_drvdata(dev);
+@@ -1162,6 +861,9 @@ static int imx290_power_on(struct device
+ 	gpiod_set_value_cansleep(imx290->rst_gpio, 0);
+ 	usleep_range(30000, 31000);
+ 
++	/* Set data lane count */
++	imx290_set_data_lanes(imx290);
++
+ 	return 0;
+ }
+ 
+@@ -1191,7 +893,6 @@ static const struct v4l2_subdev_pad_ops
+ 	.enum_frame_size = imx290_enum_frame_size,
+ 	.get_fmt = imx290_get_fmt,
+ 	.set_fmt = imx290_set_fmt,
+-	.get_selection = imx290_get_selection,
+ };
+ 
+ static const struct v4l2_subdev_ops imx290_subdev_ops = {
+@@ -1225,35 +926,16 @@ static s64 imx290_check_link_freqs(const
+ 	return 0;
+ }
+ 
+-static const struct of_device_id imx290_of_match[] = {
+-	/*
+-	 * imx327 supports 1080p60 at 10 and 12bit.
+-	 * imx290 adds 10bit 1080p120.
+-	 * imx462 adds 10 and 12bit 1080p120.
+-	 * This driver currently maxes out at 1080p60, which is supported by all
+-	 * of them, but add the compatible strings for future implementation.
+-	 */
+-	{ .compatible = "sony,imx327", .data = imx290_colour_formats },
+-	{ .compatible = "sony,imx327-mono", .data = imx290_mono_formats },
+-	{ .compatible = "sony,imx290", .data = imx290_colour_formats },
+-	{ .compatible = "sony,imx290-mono", .data = imx290_mono_formats },
+-	{ .compatible = "sony,imx462", .data = imx290_colour_formats },
+-	{ .compatible = "sony,imx462-mono", .data = imx290_mono_formats },
+-	{ /* sentinel */ }
+-};
+-
+ static int imx290_probe(struct i2c_client *client)
+ {
+-	struct v4l2_fwnode_device_properties props;
+ 	struct device *dev = &client->dev;
+ 	struct fwnode_handle *endpoint;
+ 	/* Only CSI2 is supported for now: */
+ 	struct v4l2_fwnode_endpoint ep = {
+ 		.bus_type = V4L2_MBUS_CSI2_DPHY
+ 	};
+-	const struct of_device_id *match;
+-	const struct imx290_mode *mode;
+ 	struct imx290 *imx290;
++	u32 xclk_freq;
+ 	s64 fq;
+ 	int ret;
+ 
+@@ -1268,11 +950,6 @@ static int imx290_probe(struct i2c_clien
+ 		return -ENODEV;
+ 	}
+ 
+-	match = of_match_device(imx290_of_match, dev);
+-	if (!match)
+-		return -ENODEV;
+-	imx290->formats = (const struct imx290_pixfmt *)match->data;
+-
+ 	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
+ 	if (!endpoint) {
+ 		dev_err(dev, "Endpoint node not found\n");
+@@ -1322,21 +999,21 @@ static int imx290_probe(struct i2c_clien
+ 	}
+ 
+ 	ret = fwnode_property_read_u32(dev_fwnode(dev), "clock-frequency",
+-				       &imx290->xclk_freq);
++				       &xclk_freq);
+ 	if (ret) {
+ 		dev_err(dev, "Could not get xclk frequency\n");
+ 		goto free_err;
+ 	}
+ 
+ 	/* external clock must be 37.125 MHz */
+-	if (imx290->xclk_freq != 37125000 && imx290->xclk_freq != 74250000) {
++	if (xclk_freq != 37125000) {
+ 		dev_err(dev, "External clock frequency %u is not supported\n",
+-			imx290->xclk_freq);
++			xclk_freq);
+ 		ret = -EINVAL;
+ 		goto free_err;
+ 	}
+ 
+-	ret = clk_set_rate(imx290->xclk, imx290->xclk_freq);
++	ret = clk_set_rate(imx290->xclk, xclk_freq);
+ 	if (ret) {
+ 		dev_err(dev, "Could not set xclk frequency\n");
+ 		goto free_err;
+@@ -1360,39 +1037,15 @@ static int imx290_probe(struct i2c_clien
+ 
+ 	/*
+ 	 * Initialize the frame format. In particular, imx290->current_mode
+-	 * and imx290->bpp are set to defaults.
++	 * and imx290->bpp are set to defaults: imx290_calc_pixel_rate() call
++	 * below relies on these fields.
+ 	 */
+ 	imx290_entity_init_cfg(&imx290->sd, NULL);
+ 
+-	v4l2_ctrl_handler_init(&imx290->ctrls, 11);
++	v4l2_ctrl_handler_init(&imx290->ctrls, 4);
+ 
+ 	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-			  V4L2_CID_ANALOGUE_GAIN, 0, 100, 1, 0);
+-
+-	mode = imx290->current_mode;
+-	imx290->hblank = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-					   V4L2_CID_HBLANK,
+-					   mode->hmax - mode->width,
+-					   IMX290_HMAX_MAX - mode->width, 1,
+-					   mode->hmax - mode->width);
+-
+-	imx290->vblank = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-					   V4L2_CID_VBLANK,
+-					   mode->vmax - mode->height,
+-					   IMX290_VMAX_MAX - mode->height, 1,
+-					   mode->vmax - mode->height);
+-
+-	imx290->exposure = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-					     V4L2_CID_EXPOSURE,
+-					     IMX290_EXPOSURE_MIN,
+-					     mode->vmax - 2,
+-					     IMX290_EXPOSURE_STEP,
+-					     mode->vmax - 2);
+-
+-	imx290->hflip = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-					  V4L2_CID_HFLIP, 0, 1, 1, 0);
+-	imx290->vflip = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-					  V4L2_CID_VFLIP, 0, 1, 1, 0);
++			  V4L2_CID_GAIN, 0, 72, 1, 0);
+ 
+ 	imx290->link_freq =
+ 		v4l2_ctrl_new_int_menu(&imx290->ctrls, &imx290_ctrl_ops,
+@@ -1412,15 +1065,6 @@ static int imx290_probe(struct i2c_clien
+ 				     ARRAY_SIZE(imx290_test_pattern_menu) - 1,
+ 				     0, 0, imx290_test_pattern_menu);
+ 
+-	ret = v4l2_fwnode_device_parse(&client->dev, &props);
+-	if (ret)
+-		goto free_ctrl;
+-
+-	ret = v4l2_ctrl_new_fwnode_properties(&imx290->ctrls, &imx290_ctrl_ops,
+-					      &props);
+-	if (ret)
+-		goto free_ctrl;
+-
+ 	imx290->sd.ctrl_handler = &imx290->ctrls;
+ 
+ 	if (imx290->ctrls.error) {
+@@ -1443,9 +1087,6 @@ static int imx290_probe(struct i2c_clien
+ 		goto free_ctrl;
+ 	}
+ 
+-	/* Initialize the frame format (this also sets imx290->current_mode) */
+-	imx290_entity_init_cfg(&imx290->sd, NULL);
+-
+ 	ret = v4l2_async_register_subdev(&imx290->sd);
+ 	if (ret < 0) {
+ 		dev_err(dev, "Could not register v4l2 device\n");
+@@ -1495,6 +1136,10 @@ static void imx290_remove(struct i2c_cli
+ 	pm_runtime_set_suspended(imx290->dev);
+ }
+ 
++static const struct of_device_id imx290_of_match[] = {
++	{ .compatible = "sony,imx290" },
++	{ /* sentinel */ }
++};
+ MODULE_DEVICE_TABLE(of, imx290_of_match);
+ 
+ static struct i2c_driver imx290_i2c_driver = {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0612-media-i2c-imx290-Use-device-lock-for-the-control-han.patch b/target/linux/bcm27xx/patches-6.1/950-0612-media-i2c-imx290-Use-device-lock-for-the-control-han.patch
new file mode 100644
index 00000000000000..ab8dfc47976a55
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0612-media-i2c-imx290-Use-device-lock-for-the-control-han.patch
@@ -0,0 +1,30 @@
+From 9da6b4ad7ee76da4d274f305412fc6f2bc95c91c Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sun, 16 Oct 2022 09:15:05 +0300
+Subject: [PATCH] media: i2c: imx290: Use device lock for the control
+ handler
+
+Upstream commit 08878cbc0cbf.
+
+The link frequency and pixel rate controls are set without holding the
+control handler lock, resulting in kernel warnings. As the value of
+those controls depend on the format, the simplest fix is to use the
+device lock for the control handler.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -1043,6 +1043,7 @@ static int imx290_probe(struct i2c_clien
+ 	imx290_entity_init_cfg(&imx290->sd, NULL);
+ 
+ 	v4l2_ctrl_handler_init(&imx290->ctrls, 4);
++	imx290->ctrls.lock = &imx290->lock;
+ 
+ 	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+ 			  V4L2_CID_GAIN, 0, 72, 1, 0);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0613-media-i2c-imx290-Print-error-code-when-I2C-transfer-.patch b/target/linux/bcm27xx/patches-6.1/950-0613-media-i2c-imx290-Print-error-code-when-I2C-transfer-.patch
new file mode 100644
index 00000000000000..bb5a2a6b1a3bff
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0613-media-i2c-imx290-Print-error-code-when-I2C-transfer-.patch
@@ -0,0 +1,40 @@
+From 25b4bd6894bf79b5d6150d66222d63afea32f24f Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sun, 16 Oct 2022 09:15:06 +0300
+Subject: [PATCH] media: i2c: imx290: Print error code when I2C
+ transfer fails
+
+Upstream commit fbe0a89dc7e3.
+
+Knowing why I2C transfers fail is useful for debugging. Extend the error
+message to print the error code.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -370,7 +370,8 @@ static inline int __always_unused imx290
+ 
+ 	ret = regmap_read(imx290->regmap, addr, &regval);
+ 	if (ret) {
+-		dev_err(imx290->dev, "I2C read failed for addr: %x\n", addr);
++		dev_err(imx290->dev, "Failed to read register 0x%04x: %d\n",
++			addr, ret);
+ 		return ret;
+ 	}
+ 
+@@ -385,7 +386,8 @@ static int imx290_write_reg(struct imx29
+ 
+ 	ret = regmap_write(imx290->regmap, addr, value);
+ 	if (ret) {
+-		dev_err(imx290->dev, "I2C write failed for addr: %x\n", addr);
++		dev_err(imx290->dev, "Failed to write register 0x%04x: %d\n",
++			addr, ret);
+ 		return ret;
+ 	}
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0614-media-i2c-imx290-Replace-macro-with-explicit-ARRAY_S.patch b/target/linux/bcm27xx/patches-6.1/950-0614-media-i2c-imx290-Replace-macro-with-explicit-ARRAY_S.patch
new file mode 100644
index 00000000000000..136998b0ace9bc
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0614-media-i2c-imx290-Replace-macro-with-explicit-ARRAY_S.patch
@@ -0,0 +1,53 @@
+From 40361e75c3da4145a21ef6284ad76c28983b4364 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sun, 16 Oct 2022 09:15:07 +0300
+Subject: [PATCH] media: i2c: imx290: Replace macro with explicit
+ ARRAY_SIZE()
+
+Upstream commit 2548df538cdd.
+
+Use ARRAY_SIZE(imx290->supplies) for code that needs the size of the
+array, instead of relying on the IMX290_NUM_SUPPLIES. The result is less
+error-prone as it ties the size to the array.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -790,10 +790,10 @@ static int imx290_get_regulators(struct
+ {
+ 	unsigned int i;
+ 
+-	for (i = 0; i < IMX290_NUM_SUPPLIES; i++)
++	for (i = 0; i < ARRAY_SIZE(imx290->supplies); i++)
+ 		imx290->supplies[i].supply = imx290_supply_name[i];
+ 
+-	return devm_regulator_bulk_get(dev, IMX290_NUM_SUPPLIES,
++	return devm_regulator_bulk_get(dev, ARRAY_SIZE(imx290->supplies),
+ 				       imx290->supplies);
+ }
+ 
+@@ -852,7 +852,8 @@ static int imx290_power_on(struct device
+ 		return ret;
+ 	}
+ 
+-	ret = regulator_bulk_enable(IMX290_NUM_SUPPLIES, imx290->supplies);
++	ret = regulator_bulk_enable(ARRAY_SIZE(imx290->supplies),
++				    imx290->supplies);
+ 	if (ret) {
+ 		dev_err(dev, "Failed to enable regulators\n");
+ 		clk_disable_unprepare(imx290->xclk);
+@@ -876,7 +877,7 @@ static int imx290_power_off(struct devic
+ 
+ 	clk_disable_unprepare(imx290->xclk);
+ 	gpiod_set_value_cansleep(imx290->rst_gpio, 1);
+-	regulator_bulk_disable(IMX290_NUM_SUPPLIES, imx290->supplies);
++	regulator_bulk_disable(ARRAY_SIZE(imx290->supplies), imx290->supplies);
+ 
+ 	return 0;
+ }
diff --git a/target/linux/bcm27xx/patches-6.1/950-0615-media-i2c-imx290-Drop-imx290_write_buffered_reg.patch b/target/linux/bcm27xx/patches-6.1/950-0615-media-i2c-imx290-Drop-imx290_write_buffered_reg.patch
new file mode 100644
index 00000000000000..101eb38834bec1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0615-media-i2c-imx290-Drop-imx290_write_buffered_reg.patch
@@ -0,0 +1,67 @@
+From 51fc780bc99a0cfe74fcfc42744d8265fcafedcb Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sun, 16 Oct 2022 09:15:08 +0300
+Subject: [PATCH] media: i2c: imx290: Drop imx290_write_buffered_reg()
+
+Upstream commit b817888a0c50.
+
+The imx290_write_buffered_reg() function wraps a register write with
+register hold, to enable changing multiple registers synchronously. It
+is used for the gain only, which is an 8-bit register, defeating its
+purpose.
+
+The feature is useful, but should be implemented differently. Drop the
+function for now, to prepare for a rework of register access.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Acked-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 32 +-------------------------------
+ 1 file changed, 1 insertion(+), 31 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -413,41 +413,11 @@ static int imx290_set_register_array(str
+ 	return 0;
+ }
+ 
+-static int imx290_write_buffered_reg(struct imx290 *imx290, u16 address_low,
+-				     u8 nr_regs, u32 value)
+-{
+-	unsigned int i;
+-	int ret;
+-
+-	ret = imx290_write_reg(imx290, IMX290_REGHOLD, 0x01);
+-	if (ret) {
+-		dev_err(imx290->dev, "Error setting hold register\n");
+-		return ret;
+-	}
+-
+-	for (i = 0; i < nr_regs; i++) {
+-		ret = imx290_write_reg(imx290, address_low + i,
+-				       (u8)(value >> (i * 8)));
+-		if (ret) {
+-			dev_err(imx290->dev, "Error writing buffered registers\n");
+-			return ret;
+-		}
+-	}
+-
+-	ret = imx290_write_reg(imx290, IMX290_REGHOLD, 0x00);
+-	if (ret) {
+-		dev_err(imx290->dev, "Error setting hold register\n");
+-		return ret;
+-	}
+-
+-	return ret;
+-}
+-
+ static int imx290_set_gain(struct imx290 *imx290, u32 value)
+ {
+ 	int ret;
+ 
+-	ret = imx290_write_buffered_reg(imx290, IMX290_GAIN, 1, value);
++	ret = imx290_write_reg(imx290, IMX290_GAIN, value);
+ 	if (ret)
+ 		dev_err(imx290->dev, "Unable to write gain\n");
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0616-media-i2c-imx290-Drop-regmap-cache.patch b/target/linux/bcm27xx/patches-6.1/950-0616-media-i2c-imx290-Drop-regmap-cache.patch
new file mode 100644
index 00000000000000..a6183217c4e4fc
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0616-media-i2c-imx290-Drop-regmap-cache.patch
@@ -0,0 +1,27 @@
+From 02e4438d2270b2684190970cef3e5252156d8e7c Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sun, 16 Oct 2022 09:15:09 +0300
+Subject: [PATCH] media: i2c: imx290: Drop regmap cache
+
+Upstream commit 72e4bf6dd136.
+
+Only two registers are ever read, and once only. There's no need to
+cache values.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -97,7 +97,6 @@ static const struct imx290_pixfmt imx290
+ static const struct regmap_config imx290_regmap_config = {
+ 	.reg_bits = 16,
+ 	.val_bits = 8,
+-	.cache_type = REGCACHE_RBTREE,
+ };
+ 
+ static const char * const imx290_test_pattern_menu[] = {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0617-media-i2c-imx290-Specify-HMAX-values-in-decimal.patch b/target/linux/bcm27xx/patches-6.1/950-0617-media-i2c-imx290-Specify-HMAX-values-in-decimal.patch
new file mode 100644
index 00000000000000..05206cbe0a3fe0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0617-media-i2c-imx290-Specify-HMAX-values-in-decimal.patch
@@ -0,0 +1,54 @@
+From c1461dc7f90c1789418e493df0fb866ebe74151a Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sun, 16 Oct 2022 09:15:10 +0300
+Subject: [PATCH] media: i2c: imx290: Specify HMAX values in decimal
+
+Upstream commit 72825bc6f7f5.
+
+The HMAX value specifies the total line length in pixels. It's thus more
+readable in decimal than hexadecimal. Fix it.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -307,7 +307,7 @@ static const struct imx290_mode imx290_m
+ 	{
+ 		.width = 1920,
+ 		.height = 1080,
+-		.hmax = 0x1130,
++		.hmax = 4400,
+ 		.link_freq_index = FREQ_INDEX_1080P,
+ 		.data = imx290_1080p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_1080p_settings),
+@@ -315,7 +315,7 @@ static const struct imx290_mode imx290_m
+ 	{
+ 		.width = 1280,
+ 		.height = 720,
+-		.hmax = 0x19c8,
++		.hmax = 6600,
+ 		.link_freq_index = FREQ_INDEX_720P,
+ 		.data = imx290_720p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_720p_settings),
+@@ -326,7 +326,7 @@ static const struct imx290_mode imx290_m
+ 	{
+ 		.width = 1920,
+ 		.height = 1080,
+-		.hmax = 0x0898,
++		.hmax = 2200,
+ 		.link_freq_index = FREQ_INDEX_1080P,
+ 		.data = imx290_1080p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_1080p_settings),
+@@ -334,7 +334,7 @@ static const struct imx290_mode imx290_m
+ 	{
+ 		.width = 1280,
+ 		.height = 720,
+-		.hmax = 0x0ce4,
++		.hmax = 3300,
+ 		.link_freq_index = FREQ_INDEX_720P,
+ 		.data = imx290_720p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_720p_settings),
diff --git a/target/linux/bcm27xx/patches-6.1/950-0618-media-i2c-imx290-Support-variable-sized-registers.patch b/target/linux/bcm27xx/patches-6.1/950-0618-media-i2c-imx290-Support-variable-sized-registers.patch
new file mode 100644
index 00000000000000..0768f7f97f022e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0618-media-i2c-imx290-Support-variable-sized-registers.patch
@@ -0,0 +1,431 @@
+From dbb775e681426042415eb6cf48242c5c980af293 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sun, 16 Oct 2022 09:15:11 +0300
+Subject: [PATCH] media: i2c: imx290: Support variable-sized registers
+
+Upstream commit e70abe881463.
+
+The IMX290 has registers of different sizes. To simplify the code,
+handle this in the read/write functions instead of in the callers by
+encoding the register size in the symbolic name macros. All registers
+are defined as 8-bit for now, a subsequent change will move to larger
+registers where applicable.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 354 +++++++++++++++++++------------------
+ 1 file changed, 181 insertions(+), 173 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -22,22 +22,28 @@
+ #include <media/v4l2-fwnode.h>
+ #include <media/v4l2-subdev.h>
+ 
+-#define IMX290_STANDBY 0x3000
+-#define IMX290_REGHOLD 0x3001
+-#define IMX290_XMSTA 0x3002
+-#define IMX290_FR_FDG_SEL 0x3009
+-#define IMX290_BLKLEVEL_LOW 0x300a
+-#define IMX290_BLKLEVEL_HIGH 0x300b
+-#define IMX290_GAIN 0x3014
+-#define IMX290_HMAX_LOW 0x301c
+-#define IMX290_HMAX_HIGH 0x301d
+-#define IMX290_PGCTRL 0x308c
+-#define IMX290_PHY_LANE_NUM 0x3407
+-#define IMX290_CSI_LANE_MODE 0x3443
+-
+-#define IMX290_PGCTRL_REGEN BIT(0)
+-#define IMX290_PGCTRL_THRU BIT(1)
+-#define IMX290_PGCTRL_MODE(n) ((n) << 4)
++#define IMX290_REG_SIZE_SHIFT				16
++#define IMX290_REG_ADDR_MASK				0xffff
++#define IMX290_REG_8BIT(n)				((1U << IMX290_REG_SIZE_SHIFT) | (n))
++#define IMX290_REG_16BIT(n)				((2U << IMX290_REG_SIZE_SHIFT) | (n))
++#define IMX290_REG_24BIT(n)				((3U << IMX290_REG_SIZE_SHIFT) | (n))
++
++#define IMX290_STANDBY					IMX290_REG_8BIT(0x3000)
++#define IMX290_REGHOLD					IMX290_REG_8BIT(0x3001)
++#define IMX290_XMSTA					IMX290_REG_8BIT(0x3002)
++#define IMX290_FR_FDG_SEL				IMX290_REG_8BIT(0x3009)
++#define IMX290_BLKLEVEL_LOW				IMX290_REG_8BIT(0x300a)
++#define IMX290_BLKLEVEL_HIGH				IMX290_REG_8BIT(0x300b)
++#define IMX290_GAIN					IMX290_REG_8BIT(0x3014)
++#define IMX290_HMAX_LOW					IMX290_REG_8BIT(0x301c)
++#define IMX290_HMAX_HIGH				IMX290_REG_8BIT(0x301d)
++#define IMX290_PGCTRL					IMX290_REG_8BIT(0x308c)
++#define IMX290_PHY_LANE_NUM				IMX290_REG_8BIT(0x3407)
++#define IMX290_CSI_LANE_MODE				IMX290_REG_8BIT(0x3443)
++
++#define IMX290_PGCTRL_REGEN				BIT(0)
++#define IMX290_PGCTRL_THRU				BIT(1)
++#define IMX290_PGCTRL_MODE(n)				((n) << 4)
+ 
+ static const char * const imx290_supply_name[] = {
+ 	"vdda",
+@@ -48,7 +54,7 @@ static const char * const imx290_supply_
+ #define IMX290_NUM_SUPPLIES ARRAY_SIZE(imx290_supply_name)
+ 
+ struct imx290_regval {
+-	u16 reg;
++	u32 reg;
+ 	u8 val;
+ };
+ 
+@@ -111,163 +117,163 @@ static const char * const imx290_test_pa
+ };
+ 
+ static const struct imx290_regval imx290_global_init_settings[] = {
+-	{ 0x3007, 0x00 },
+-	{ 0x3018, 0x65 },
+-	{ 0x3019, 0x04 },
+-	{ 0x301a, 0x00 },
+-	{ 0x3444, 0x20 },
+-	{ 0x3445, 0x25 },
+-	{ 0x303a, 0x0c },
+-	{ 0x3040, 0x00 },
+-	{ 0x3041, 0x00 },
+-	{ 0x303c, 0x00 },
+-	{ 0x303d, 0x00 },
+-	{ 0x3042, 0x9c },
+-	{ 0x3043, 0x07 },
+-	{ 0x303e, 0x49 },
+-	{ 0x303f, 0x04 },
+-	{ 0x304b, 0x0a },
+-	{ 0x300f, 0x00 },
+-	{ 0x3010, 0x21 },
+-	{ 0x3012, 0x64 },
+-	{ 0x3016, 0x09 },
+-	{ 0x3070, 0x02 },
+-	{ 0x3071, 0x11 },
+-	{ 0x309b, 0x10 },
+-	{ 0x309c, 0x22 },
+-	{ 0x30a2, 0x02 },
+-	{ 0x30a6, 0x20 },
+-	{ 0x30a8, 0x20 },
+-	{ 0x30aa, 0x20 },
+-	{ 0x30ac, 0x20 },
+-	{ 0x30b0, 0x43 },
+-	{ 0x3119, 0x9e },
+-	{ 0x311c, 0x1e },
+-	{ 0x311e, 0x08 },
+-	{ 0x3128, 0x05 },
+-	{ 0x313d, 0x83 },
+-	{ 0x3150, 0x03 },
+-	{ 0x317e, 0x00 },
+-	{ 0x32b8, 0x50 },
+-	{ 0x32b9, 0x10 },
+-	{ 0x32ba, 0x00 },
+-	{ 0x32bb, 0x04 },
+-	{ 0x32c8, 0x50 },
+-	{ 0x32c9, 0x10 },
+-	{ 0x32ca, 0x00 },
+-	{ 0x32cb, 0x04 },
+-	{ 0x332c, 0xd3 },
+-	{ 0x332d, 0x10 },
+-	{ 0x332e, 0x0d },
+-	{ 0x3358, 0x06 },
+-	{ 0x3359, 0xe1 },
+-	{ 0x335a, 0x11 },
+-	{ 0x3360, 0x1e },
+-	{ 0x3361, 0x61 },
+-	{ 0x3362, 0x10 },
+-	{ 0x33b0, 0x50 },
+-	{ 0x33b2, 0x1a },
+-	{ 0x33b3, 0x04 },
++	{ IMX290_REG_8BIT(0x3007), 0x00 },
++	{ IMX290_REG_8BIT(0x3018), 0x65 },
++	{ IMX290_REG_8BIT(0x3019), 0x04 },
++	{ IMX290_REG_8BIT(0x301a), 0x00 },
++	{ IMX290_REG_8BIT(0x3444), 0x20 },
++	{ IMX290_REG_8BIT(0x3445), 0x25 },
++	{ IMX290_REG_8BIT(0x303a), 0x0c },
++	{ IMX290_REG_8BIT(0x3040), 0x00 },
++	{ IMX290_REG_8BIT(0x3041), 0x00 },
++	{ IMX290_REG_8BIT(0x303c), 0x00 },
++	{ IMX290_REG_8BIT(0x303d), 0x00 },
++	{ IMX290_REG_8BIT(0x3042), 0x9c },
++	{ IMX290_REG_8BIT(0x3043), 0x07 },
++	{ IMX290_REG_8BIT(0x303e), 0x49 },
++	{ IMX290_REG_8BIT(0x303f), 0x04 },
++	{ IMX290_REG_8BIT(0x304b), 0x0a },
++	{ IMX290_REG_8BIT(0x300f), 0x00 },
++	{ IMX290_REG_8BIT(0x3010), 0x21 },
++	{ IMX290_REG_8BIT(0x3012), 0x64 },
++	{ IMX290_REG_8BIT(0x3016), 0x09 },
++	{ IMX290_REG_8BIT(0x3070), 0x02 },
++	{ IMX290_REG_8BIT(0x3071), 0x11 },
++	{ IMX290_REG_8BIT(0x309b), 0x10 },
++	{ IMX290_REG_8BIT(0x309c), 0x22 },
++	{ IMX290_REG_8BIT(0x30a2), 0x02 },
++	{ IMX290_REG_8BIT(0x30a6), 0x20 },
++	{ IMX290_REG_8BIT(0x30a8), 0x20 },
++	{ IMX290_REG_8BIT(0x30aa), 0x20 },
++	{ IMX290_REG_8BIT(0x30ac), 0x20 },
++	{ IMX290_REG_8BIT(0x30b0), 0x43 },
++	{ IMX290_REG_8BIT(0x3119), 0x9e },
++	{ IMX290_REG_8BIT(0x311c), 0x1e },
++	{ IMX290_REG_8BIT(0x311e), 0x08 },
++	{ IMX290_REG_8BIT(0x3128), 0x05 },
++	{ IMX290_REG_8BIT(0x313d), 0x83 },
++	{ IMX290_REG_8BIT(0x3150), 0x03 },
++	{ IMX290_REG_8BIT(0x317e), 0x00 },
++	{ IMX290_REG_8BIT(0x32b8), 0x50 },
++	{ IMX290_REG_8BIT(0x32b9), 0x10 },
++	{ IMX290_REG_8BIT(0x32ba), 0x00 },
++	{ IMX290_REG_8BIT(0x32bb), 0x04 },
++	{ IMX290_REG_8BIT(0x32c8), 0x50 },
++	{ IMX290_REG_8BIT(0x32c9), 0x10 },
++	{ IMX290_REG_8BIT(0x32ca), 0x00 },
++	{ IMX290_REG_8BIT(0x32cb), 0x04 },
++	{ IMX290_REG_8BIT(0x332c), 0xd3 },
++	{ IMX290_REG_8BIT(0x332d), 0x10 },
++	{ IMX290_REG_8BIT(0x332e), 0x0d },
++	{ IMX290_REG_8BIT(0x3358), 0x06 },
++	{ IMX290_REG_8BIT(0x3359), 0xe1 },
++	{ IMX290_REG_8BIT(0x335a), 0x11 },
++	{ IMX290_REG_8BIT(0x3360), 0x1e },
++	{ IMX290_REG_8BIT(0x3361), 0x61 },
++	{ IMX290_REG_8BIT(0x3362), 0x10 },
++	{ IMX290_REG_8BIT(0x33b0), 0x50 },
++	{ IMX290_REG_8BIT(0x33b2), 0x1a },
++	{ IMX290_REG_8BIT(0x33b3), 0x04 },
+ };
+ 
+ static const struct imx290_regval imx290_1080p_settings[] = {
+ 	/* mode settings */
+-	{ 0x3007, 0x00 },
+-	{ 0x303a, 0x0c },
+-	{ 0x3414, 0x0a },
+-	{ 0x3472, 0x80 },
+-	{ 0x3473, 0x07 },
+-	{ 0x3418, 0x38 },
+-	{ 0x3419, 0x04 },
+-	{ 0x3012, 0x64 },
+-	{ 0x3013, 0x00 },
+-	{ 0x305c, 0x18 },
+-	{ 0x305d, 0x03 },
+-	{ 0x305e, 0x20 },
+-	{ 0x305f, 0x01 },
+-	{ 0x315e, 0x1a },
+-	{ 0x3164, 0x1a },
+-	{ 0x3480, 0x49 },
++	{ IMX290_REG_8BIT(0x3007), 0x00 },
++	{ IMX290_REG_8BIT(0x303a), 0x0c },
++	{ IMX290_REG_8BIT(0x3414), 0x0a },
++	{ IMX290_REG_8BIT(0x3472), 0x80 },
++	{ IMX290_REG_8BIT(0x3473), 0x07 },
++	{ IMX290_REG_8BIT(0x3418), 0x38 },
++	{ IMX290_REG_8BIT(0x3419), 0x04 },
++	{ IMX290_REG_8BIT(0x3012), 0x64 },
++	{ IMX290_REG_8BIT(0x3013), 0x00 },
++	{ IMX290_REG_8BIT(0x305c), 0x18 },
++	{ IMX290_REG_8BIT(0x305d), 0x03 },
++	{ IMX290_REG_8BIT(0x305e), 0x20 },
++	{ IMX290_REG_8BIT(0x305f), 0x01 },
++	{ IMX290_REG_8BIT(0x315e), 0x1a },
++	{ IMX290_REG_8BIT(0x3164), 0x1a },
++	{ IMX290_REG_8BIT(0x3480), 0x49 },
+ 	/* data rate settings */
+-	{ 0x3405, 0x10 },
+-	{ 0x3446, 0x57 },
+-	{ 0x3447, 0x00 },
+-	{ 0x3448, 0x37 },
+-	{ 0x3449, 0x00 },
+-	{ 0x344a, 0x1f },
+-	{ 0x344b, 0x00 },
+-	{ 0x344c, 0x1f },
+-	{ 0x344d, 0x00 },
+-	{ 0x344e, 0x1f },
+-	{ 0x344f, 0x00 },
+-	{ 0x3450, 0x77 },
+-	{ 0x3451, 0x00 },
+-	{ 0x3452, 0x1f },
+-	{ 0x3453, 0x00 },
+-	{ 0x3454, 0x17 },
+-	{ 0x3455, 0x00 },
++	{ IMX290_REG_8BIT(0x3405), 0x10 },
++	{ IMX290_REG_8BIT(0x3446), 0x57 },
++	{ IMX290_REG_8BIT(0x3447), 0x00 },
++	{ IMX290_REG_8BIT(0x3448), 0x37 },
++	{ IMX290_REG_8BIT(0x3449), 0x00 },
++	{ IMX290_REG_8BIT(0x344a), 0x1f },
++	{ IMX290_REG_8BIT(0x344b), 0x00 },
++	{ IMX290_REG_8BIT(0x344c), 0x1f },
++	{ IMX290_REG_8BIT(0x344d), 0x00 },
++	{ IMX290_REG_8BIT(0x344e), 0x1f },
++	{ IMX290_REG_8BIT(0x344f), 0x00 },
++	{ IMX290_REG_8BIT(0x3450), 0x77 },
++	{ IMX290_REG_8BIT(0x3451), 0x00 },
++	{ IMX290_REG_8BIT(0x3452), 0x1f },
++	{ IMX290_REG_8BIT(0x3453), 0x00 },
++	{ IMX290_REG_8BIT(0x3454), 0x17 },
++	{ IMX290_REG_8BIT(0x3455), 0x00 },
+ };
+ 
+ static const struct imx290_regval imx290_720p_settings[] = {
+ 	/* mode settings */
+-	{ 0x3007, 0x10 },
+-	{ 0x303a, 0x06 },
+-	{ 0x3414, 0x04 },
+-	{ 0x3472, 0x00 },
+-	{ 0x3473, 0x05 },
+-	{ 0x3418, 0xd0 },
+-	{ 0x3419, 0x02 },
+-	{ 0x3012, 0x64 },
+-	{ 0x3013, 0x00 },
+-	{ 0x305c, 0x20 },
+-	{ 0x305d, 0x00 },
+-	{ 0x305e, 0x20 },
+-	{ 0x305f, 0x01 },
+-	{ 0x315e, 0x1a },
+-	{ 0x3164, 0x1a },
+-	{ 0x3480, 0x49 },
++	{ IMX290_REG_8BIT(0x3007), 0x10 },
++	{ IMX290_REG_8BIT(0x303a), 0x06 },
++	{ IMX290_REG_8BIT(0x3414), 0x04 },
++	{ IMX290_REG_8BIT(0x3472), 0x00 },
++	{ IMX290_REG_8BIT(0x3473), 0x05 },
++	{ IMX290_REG_8BIT(0x3418), 0xd0 },
++	{ IMX290_REG_8BIT(0x3419), 0x02 },
++	{ IMX290_REG_8BIT(0x3012), 0x64 },
++	{ IMX290_REG_8BIT(0x3013), 0x00 },
++	{ IMX290_REG_8BIT(0x305c), 0x20 },
++	{ IMX290_REG_8BIT(0x305d), 0x00 },
++	{ IMX290_REG_8BIT(0x305e), 0x20 },
++	{ IMX290_REG_8BIT(0x305f), 0x01 },
++	{ IMX290_REG_8BIT(0x315e), 0x1a },
++	{ IMX290_REG_8BIT(0x3164), 0x1a },
++	{ IMX290_REG_8BIT(0x3480), 0x49 },
+ 	/* data rate settings */
+-	{ 0x3405, 0x10 },
+-	{ 0x3446, 0x4f },
+-	{ 0x3447, 0x00 },
+-	{ 0x3448, 0x2f },
+-	{ 0x3449, 0x00 },
+-	{ 0x344a, 0x17 },
+-	{ 0x344b, 0x00 },
+-	{ 0x344c, 0x17 },
+-	{ 0x344d, 0x00 },
+-	{ 0x344e, 0x17 },
+-	{ 0x344f, 0x00 },
+-	{ 0x3450, 0x57 },
+-	{ 0x3451, 0x00 },
+-	{ 0x3452, 0x17 },
+-	{ 0x3453, 0x00 },
+-	{ 0x3454, 0x17 },
+-	{ 0x3455, 0x00 },
++	{ IMX290_REG_8BIT(0x3405), 0x10 },
++	{ IMX290_REG_8BIT(0x3446), 0x4f },
++	{ IMX290_REG_8BIT(0x3447), 0x00 },
++	{ IMX290_REG_8BIT(0x3448), 0x2f },
++	{ IMX290_REG_8BIT(0x3449), 0x00 },
++	{ IMX290_REG_8BIT(0x344a), 0x17 },
++	{ IMX290_REG_8BIT(0x344b), 0x00 },
++	{ IMX290_REG_8BIT(0x344c), 0x17 },
++	{ IMX290_REG_8BIT(0x344d), 0x00 },
++	{ IMX290_REG_8BIT(0x344e), 0x17 },
++	{ IMX290_REG_8BIT(0x344f), 0x00 },
++	{ IMX290_REG_8BIT(0x3450), 0x57 },
++	{ IMX290_REG_8BIT(0x3451), 0x00 },
++	{ IMX290_REG_8BIT(0x3452), 0x17 },
++	{ IMX290_REG_8BIT(0x3453), 0x00 },
++	{ IMX290_REG_8BIT(0x3454), 0x17 },
++	{ IMX290_REG_8BIT(0x3455), 0x00 },
+ };
+ 
+ static const struct imx290_regval imx290_10bit_settings[] = {
+-	{ 0x3005, 0x00},
+-	{ 0x3046, 0x00},
+-	{ 0x3129, 0x1d},
+-	{ 0x317c, 0x12},
+-	{ 0x31ec, 0x37},
+-	{ 0x3441, 0x0a},
+-	{ 0x3442, 0x0a},
+-	{ 0x300a, 0x3c},
+-	{ 0x300b, 0x00},
++	{ IMX290_REG_8BIT(0x3005), 0x00},
++	{ IMX290_REG_8BIT(0x3046), 0x00},
++	{ IMX290_REG_8BIT(0x3129), 0x1d},
++	{ IMX290_REG_8BIT(0x317c), 0x12},
++	{ IMX290_REG_8BIT(0x31ec), 0x37},
++	{ IMX290_REG_8BIT(0x3441), 0x0a},
++	{ IMX290_REG_8BIT(0x3442), 0x0a},
++	{ IMX290_REG_8BIT(0x300a), 0x3c},
++	{ IMX290_REG_8BIT(0x300b), 0x00},
+ };
+ 
+ static const struct imx290_regval imx290_12bit_settings[] = {
+-	{ 0x3005, 0x01 },
+-	{ 0x3046, 0x01 },
+-	{ 0x3129, 0x00 },
+-	{ 0x317c, 0x00 },
+-	{ 0x31ec, 0x0e },
+-	{ 0x3441, 0x0c },
+-	{ 0x3442, 0x0c },
+-	{ 0x300a, 0xf0 },
+-	{ 0x300b, 0x00 },
++	{ IMX290_REG_8BIT(0x3005), 0x01 },
++	{ IMX290_REG_8BIT(0x3046), 0x01 },
++	{ IMX290_REG_8BIT(0x3129), 0x00 },
++	{ IMX290_REG_8BIT(0x317c), 0x00 },
++	{ IMX290_REG_8BIT(0x31ec), 0x0e },
++	{ IMX290_REG_8BIT(0x3441), 0x0c },
++	{ IMX290_REG_8BIT(0x3442), 0x0c },
++	{ IMX290_REG_8BIT(0x300a), 0xf0 },
++	{ IMX290_REG_8BIT(0x300b), 0x00 },
+ };
+ 
+ /* supported link frequencies */
+@@ -362,33 +368,35 @@ static inline struct imx290 *to_imx290(s
+ 	return container_of(_sd, struct imx290, sd);
+ }
+ 
+-static inline int __always_unused imx290_read_reg(struct imx290 *imx290, u16 addr, u8 *value)
++static int __always_unused imx290_read_reg(struct imx290 *imx290, u32 addr, u32 *value)
+ {
+-	unsigned int regval;
++	u8 data[3] = { 0, 0, 0 };
+ 	int ret;
+ 
+-	ret = regmap_read(imx290->regmap, addr, &regval);
+-	if (ret) {
+-		dev_err(imx290->dev, "Failed to read register 0x%04x: %d\n",
+-			addr, ret);
++	ret = regmap_raw_read(imx290->regmap, addr & IMX290_REG_ADDR_MASK,
++			      data, (addr >> IMX290_REG_SIZE_SHIFT) & 3);
++	if (ret < 0) {
++		dev_err(imx290->dev, "%u-bit read from 0x%04x failed: %d\n",
++			 ((addr >> IMX290_REG_SIZE_SHIFT) & 3) * 8,
++			 addr & IMX290_REG_ADDR_MASK, ret);
+ 		return ret;
+ 	}
+ 
+-	*value = regval & 0xff;
+-
++	*value = (data[2] << 16) | (data[1] << 8) | data[0];
+ 	return 0;
+ }
+ 
+-static int imx290_write_reg(struct imx290 *imx290, u16 addr, u8 value)
++static int imx290_write_reg(struct imx290 *imx290, u32 addr, u32 value)
+ {
++	u8 data[3] = { value & 0xff, (value >> 8) & 0xff, value >> 16 };
+ 	int ret;
+ 
+-	ret = regmap_write(imx290->regmap, addr, value);
+-	if (ret) {
+-		dev_err(imx290->dev, "Failed to write register 0x%04x: %d\n",
+-			addr, ret);
+-		return ret;
+-	}
++	ret = regmap_raw_write(imx290->regmap, addr & IMX290_REG_ADDR_MASK,
++			       data, (addr >> IMX290_REG_SIZE_SHIFT) & 3);
++	if (ret < 0)
++		dev_err(imx290->dev, "%u-bit write to 0x%04x failed: %d\n",
++			 ((addr >> IMX290_REG_SIZE_SHIFT) & 3) * 8,
++			 addr & IMX290_REG_ADDR_MASK, ret);
+ 
+ 	return ret;
+ }
diff --git a/target/linux/bcm27xx/patches-6.1/950-0619-media-i2c-imx290-Correct-register-sizes.patch b/target/linux/bcm27xx/patches-6.1/950-0619-media-i2c-imx290-Correct-register-sizes.patch
new file mode 100644
index 00000000000000..2c6ebf1a869588
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0619-media-i2c-imx290-Correct-register-sizes.patch
@@ -0,0 +1,98 @@
+From babb7bfc9e6eb5b0484912f72636a81cd38db3d1 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sun, 16 Oct 2022 09:15:12 +0300
+Subject: [PATCH] media: i2c: imx290: Correct register sizes
+
+Upstream commit 454a86f33dd0.
+
+Define registers with the appropriate size, using the variable-size
+register access mechanism that has just been introduced. This simplifies
+the code.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 39 +++++++++-----------------------------
+ 1 file changed, 9 insertions(+), 30 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -32,12 +32,11 @@
+ #define IMX290_REGHOLD					IMX290_REG_8BIT(0x3001)
+ #define IMX290_XMSTA					IMX290_REG_8BIT(0x3002)
+ #define IMX290_FR_FDG_SEL				IMX290_REG_8BIT(0x3009)
+-#define IMX290_BLKLEVEL_LOW				IMX290_REG_8BIT(0x300a)
+-#define IMX290_BLKLEVEL_HIGH				IMX290_REG_8BIT(0x300b)
++#define IMX290_BLKLEVEL					IMX290_REG_16BIT(0x300a)
+ #define IMX290_GAIN					IMX290_REG_8BIT(0x3014)
+-#define IMX290_HMAX_LOW					IMX290_REG_8BIT(0x301c)
+-#define IMX290_HMAX_HIGH				IMX290_REG_8BIT(0x301d)
++#define IMX290_HMAX					IMX290_REG_16BIT(0x301c)
+ #define IMX290_PGCTRL					IMX290_REG_8BIT(0x308c)
++#define IMX290_CHIP_ID					IMX290_REG_16BIT(0x319a)
+ #define IMX290_PHY_LANE_NUM				IMX290_REG_8BIT(0x3407)
+ #define IMX290_CSI_LANE_MODE				IMX290_REG_8BIT(0x3443)
+ 
+@@ -461,8 +460,7 @@ static int imx290_set_ctrl(struct v4l2_c
+ 		break;
+ 	case V4L2_CID_TEST_PATTERN:
+ 		if (ctrl->val) {
+-			imx290_write_reg(imx290, IMX290_BLKLEVEL_LOW, 0x00);
+-			imx290_write_reg(imx290, IMX290_BLKLEVEL_HIGH, 0x00);
++			imx290_write_reg(imx290, IMX290_BLKLEVEL, 0);
+ 			usleep_range(10000, 11000);
+ 			imx290_write_reg(imx290, IMX290_PGCTRL,
+ 					 (u8)(IMX290_PGCTRL_REGEN |
+@@ -472,12 +470,11 @@ static int imx290_set_ctrl(struct v4l2_c
+ 			imx290_write_reg(imx290, IMX290_PGCTRL, 0x00);
+ 			usleep_range(10000, 11000);
+ 			if (imx290->bpp == 10)
+-				imx290_write_reg(imx290, IMX290_BLKLEVEL_LOW,
++				imx290_write_reg(imx290, IMX290_BLKLEVEL,
+ 						 0x3c);
+ 			else /* 12 bits per pixel */
+-				imx290_write_reg(imx290, IMX290_BLKLEVEL_LOW,
++				imx290_write_reg(imx290, IMX290_BLKLEVEL,
+ 						 0xf0);
+-			imx290_write_reg(imx290, IMX290_BLKLEVEL_HIGH, 0x00);
+ 		}
+ 		break;
+ 	default:
+@@ -669,25 +666,6 @@ static int imx290_write_current_format(s
+ 	return 0;
+ }
+ 
+-static int imx290_set_hmax(struct imx290 *imx290, u32 val)
+-{
+-	int ret;
+-
+-	ret = imx290_write_reg(imx290, IMX290_HMAX_LOW, (val & 0xff));
+-	if (ret) {
+-		dev_err(imx290->dev, "Error setting HMAX register\n");
+-		return ret;
+-	}
+-
+-	ret = imx290_write_reg(imx290, IMX290_HMAX_HIGH, ((val >> 8) & 0xff));
+-	if (ret) {
+-		dev_err(imx290->dev, "Error setting HMAX register\n");
+-		return ret;
+-	}
+-
+-	return 0;
+-}
+-
+ /* Start streaming */
+ static int imx290_start_streaming(struct imx290 *imx290)
+ {
+@@ -716,8 +694,9 @@ static int imx290_start_streaming(struct
+ 		dev_err(imx290->dev, "Could not set current mode\n");
+ 		return ret;
+ 	}
+-	ret = imx290_set_hmax(imx290, imx290->current_mode->hmax);
+-	if (ret < 0)
++
++	ret = imx290_write_reg(imx290, IMX290_HMAX, imx290->current_mode->hmax);
++	if (ret)
+ 		return ret;
+ 
+ 	/* Apply customized values from user */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0620-media-i2c-imx290-Simplify-error-handling-when-writin.patch b/target/linux/bcm27xx/patches-6.1/950-0620-media-i2c-imx290-Simplify-error-handling-when-writin.patch
new file mode 100644
index 00000000000000..bd36c22f6ec7bf
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0620-media-i2c-imx290-Simplify-error-handling-when-writin.patch
@@ -0,0 +1,200 @@
+From a04966a5f739570c32ac6bcc44c68643bf836780 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sun, 16 Oct 2022 09:15:13 +0300
+Subject: [PATCH] media: i2c: imx290: Simplify error handling when
+ writing registers
+
+Upstream commit e611f3dac54c.
+
+Error handling for register writes requires checking the error status of
+every single write. This makes the code complex, or incorrect when the
+checks are omitted. Simplify this by passing a pointer to an error code
+to the imx290_write_reg() function, which allows writing multiple
+registers in a row and only checking for errors at the end.
+
+While at it, rename imx290_write_reg() to imx290_write() as there's
+nothing else than registers to write, and rename imx290_read_reg()
+accordingly.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 86 ++++++++++++++------------------------
+ 1 file changed, 32 insertions(+), 54 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -367,7 +367,7 @@ static inline struct imx290 *to_imx290(s
+ 	return container_of(_sd, struct imx290, sd);
+ }
+ 
+-static int __always_unused imx290_read_reg(struct imx290 *imx290, u32 addr, u32 *value)
++static int __always_unused imx290_read(struct imx290 *imx290, u32 addr, u32 *value)
+ {
+ 	u8 data[3] = { 0, 0, 0 };
+ 	int ret;
+@@ -385,17 +385,23 @@ static int __always_unused imx290_read_r
+ 	return 0;
+ }
+ 
+-static int imx290_write_reg(struct imx290 *imx290, u32 addr, u32 value)
++static int imx290_write(struct imx290 *imx290, u32 addr, u32 value, int *err)
+ {
+ 	u8 data[3] = { value & 0xff, (value >> 8) & 0xff, value >> 16 };
+ 	int ret;
+ 
++	if (err && *err)
++		return *err;
++
+ 	ret = regmap_raw_write(imx290->regmap, addr & IMX290_REG_ADDR_MASK,
+ 			       data, (addr >> IMX290_REG_SIZE_SHIFT) & 3);
+-	if (ret < 0)
++	if (ret < 0) {
+ 		dev_err(imx290->dev, "%u-bit write to 0x%04x failed: %d\n",
+ 			 ((addr >> IMX290_REG_SIZE_SHIFT) & 3) * 8,
+ 			 addr & IMX290_REG_ADDR_MASK, ret);
++		if (err)
++			*err = ret;
++	}
+ 
+ 	return ret;
+ }
+@@ -408,7 +414,7 @@ static int imx290_set_register_array(str
+ 	int ret;
+ 
+ 	for (i = 0; i < num_settings; ++i, ++settings) {
+-		ret = imx290_write_reg(imx290, settings->reg, settings->val);
++		ret = imx290_write(imx290, settings->reg, settings->val, NULL);
+ 		if (ret < 0)
+ 			return ret;
+ 	}
+@@ -419,29 +425,16 @@ static int imx290_set_register_array(str
+ 	return 0;
+ }
+ 
+-static int imx290_set_gain(struct imx290 *imx290, u32 value)
+-{
+-	int ret;
+-
+-	ret = imx290_write_reg(imx290, IMX290_GAIN, value);
+-	if (ret)
+-		dev_err(imx290->dev, "Unable to write gain\n");
+-
+-	return ret;
+-}
+-
+ /* Stop streaming */
+ static int imx290_stop_streaming(struct imx290 *imx290)
+ {
+-	int ret;
++	int ret = 0;
+ 
+-	ret = imx290_write_reg(imx290, IMX290_STANDBY, 0x01);
+-	if (ret < 0)
+-		return ret;
++	imx290_write(imx290, IMX290_STANDBY, 0x01, &ret);
+ 
+ 	msleep(30);
+ 
+-	return imx290_write_reg(imx290, IMX290_XMSTA, 0x01);
++	return imx290_write(imx290, IMX290_XMSTA, 0x01, &ret);
+ }
+ 
+ static int imx290_set_ctrl(struct v4l2_ctrl *ctrl)
+@@ -456,25 +449,25 @@ static int imx290_set_ctrl(struct v4l2_c
+ 
+ 	switch (ctrl->id) {
+ 	case V4L2_CID_GAIN:
+-		ret = imx290_set_gain(imx290, ctrl->val);
++		ret = imx290_write(imx290, IMX290_GAIN, ctrl->val, NULL);
+ 		break;
+ 	case V4L2_CID_TEST_PATTERN:
+ 		if (ctrl->val) {
+-			imx290_write_reg(imx290, IMX290_BLKLEVEL, 0);
++			imx290_write(imx290, IMX290_BLKLEVEL, 0, &ret);
+ 			usleep_range(10000, 11000);
+-			imx290_write_reg(imx290, IMX290_PGCTRL,
+-					 (u8)(IMX290_PGCTRL_REGEN |
+-					 IMX290_PGCTRL_THRU |
+-					 IMX290_PGCTRL_MODE(ctrl->val)));
++			imx290_write(imx290, IMX290_PGCTRL,
++				     (u8)(IMX290_PGCTRL_REGEN |
++				     IMX290_PGCTRL_THRU |
++				     IMX290_PGCTRL_MODE(ctrl->val)), &ret);
+ 		} else {
+-			imx290_write_reg(imx290, IMX290_PGCTRL, 0x00);
++			imx290_write(imx290, IMX290_PGCTRL, 0x00, &ret);
+ 			usleep_range(10000, 11000);
+ 			if (imx290->bpp == 10)
+-				imx290_write_reg(imx290, IMX290_BLKLEVEL,
+-						 0x3c);
++				imx290_write(imx290, IMX290_BLKLEVEL, 0x3c,
++					     &ret);
+ 			else /* 12 bits per pixel */
+-				imx290_write_reg(imx290, IMX290_BLKLEVEL,
+-						 0xf0);
++				imx290_write(imx290, IMX290_BLKLEVEL, 0xf0,
++					     &ret);
+ 		}
+ 		break;
+ 	default:
+@@ -695,7 +688,8 @@ static int imx290_start_streaming(struct
+ 		return ret;
+ 	}
+ 
+-	ret = imx290_write_reg(imx290, IMX290_HMAX, imx290->current_mode->hmax);
++	ret = imx290_write(imx290, IMX290_HMAX, imx290->current_mode->hmax,
++			   NULL);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -706,14 +700,12 @@ static int imx290_start_streaming(struct
+ 		return ret;
+ 	}
+ 
+-	ret = imx290_write_reg(imx290, IMX290_STANDBY, 0x00);
+-	if (ret < 0)
+-		return ret;
++	imx290_write(imx290, IMX290_STANDBY, 0x00, &ret);
+ 
+ 	msleep(30);
+ 
+ 	/* Start streaming */
+-	return imx290_write_reg(imx290, IMX290_XMSTA, 0x00);
++	return imx290_write(imx290, IMX290_XMSTA, 0x00, &ret);
+ }
+ 
+ static int imx290_set_stream(struct v4l2_subdev *sd, int enable)
+@@ -772,27 +764,13 @@ static int imx290_set_data_lanes(struct
+ 		 * validated in probe itself
+ 		 */
+ 		dev_err(imx290->dev, "Lane configuration not supported\n");
+-		ret = -EINVAL;
+-		goto exit;
+-	}
+-
+-	ret = imx290_write_reg(imx290, IMX290_PHY_LANE_NUM, laneval);
+-	if (ret) {
+-		dev_err(imx290->dev, "Error setting Physical Lane number register\n");
+-		goto exit;
+-	}
+-
+-	ret = imx290_write_reg(imx290, IMX290_CSI_LANE_MODE, laneval);
+-	if (ret) {
+-		dev_err(imx290->dev, "Error setting CSI Lane mode register\n");
+-		goto exit;
++		return -EINVAL;
+ 	}
+ 
+-	ret = imx290_write_reg(imx290, IMX290_FR_FDG_SEL, frsel);
+-	if (ret)
+-		dev_err(imx290->dev, "Error setting FR/FDG SEL register\n");
++	imx290_write(imx290, IMX290_PHY_LANE_NUM, laneval, &ret);
++	imx290_write(imx290, IMX290_CSI_LANE_MODE, laneval, &ret);
++	imx290_write(imx290, IMX290_FR_FDG_SEL, frsel, &ret);
+ 
+-exit:
+ 	return ret;
+ }
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0621-media-i2c-imx290-Define-more-register-macros.patch b/target/linux/bcm27xx/patches-6.1/950-0621-media-i2c-imx290-Define-more-register-macros.patch
new file mode 100644
index 00000000000000..cd45f56ac93ec5
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0621-media-i2c-imx290-Define-more-register-macros.patch
@@ -0,0 +1,294 @@
+From 43a9d91f96b8206813d95dce2fd5bbcf5f3bf586 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 17 Oct 2022 11:35:45 +0300
+Subject: [PATCH] media: i2c: imx290: Define more register macros
+
+Upstream commit 79d99ae8a77e.
+
+Define macros for all registers programmed by the driver for which
+documentation is available to increase readability. This starts making
+use of 16-bit registers in the register arrays, so the value field has
+to be increased to 32 bits.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Acked-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 219 +++++++++++++++++++++----------------
+ 1 file changed, 124 insertions(+), 95 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -31,14 +31,73 @@
+ #define IMX290_STANDBY					IMX290_REG_8BIT(0x3000)
+ #define IMX290_REGHOLD					IMX290_REG_8BIT(0x3001)
+ #define IMX290_XMSTA					IMX290_REG_8BIT(0x3002)
++#define IMX290_ADBIT					IMX290_REG_8BIT(0x3005)
++#define IMX290_ADBIT_10BIT				(0 << 0)
++#define IMX290_ADBIT_12BIT				(1 << 0)
++#define IMX290_CTRL_07					IMX290_REG_8BIT(0x3007)
++#define IMX290_VREVERSE					BIT(0)
++#define IMX290_HREVERSE					BIT(1)
++#define IMX290_WINMODE_1080P				(0 << 4)
++#define IMX290_WINMODE_720P				(1 << 4)
++#define IMX290_WINMODE_CROP				(4 << 4)
+ #define IMX290_FR_FDG_SEL				IMX290_REG_8BIT(0x3009)
+ #define IMX290_BLKLEVEL					IMX290_REG_16BIT(0x300a)
+ #define IMX290_GAIN					IMX290_REG_8BIT(0x3014)
++#define IMX290_VMAX					IMX290_REG_24BIT(0x3018)
+ #define IMX290_HMAX					IMX290_REG_16BIT(0x301c)
++#define IMX290_SHS1					IMX290_REG_24BIT(0x3020)
++#define IMX290_WINWV_OB					IMX290_REG_8BIT(0x303a)
++#define IMX290_WINPV					IMX290_REG_16BIT(0x303c)
++#define IMX290_WINWV					IMX290_REG_16BIT(0x303e)
++#define IMX290_WINPH					IMX290_REG_16BIT(0x3040)
++#define IMX290_WINWH					IMX290_REG_16BIT(0x3042)
++#define IMX290_OUT_CTRL					IMX290_REG_8BIT(0x3046)
++#define IMX290_ODBIT_10BIT				(0 << 0)
++#define IMX290_ODBIT_12BIT				(1 << 0)
++#define IMX290_OPORTSEL_PARALLEL			(0x0 << 4)
++#define IMX290_OPORTSEL_LVDS_2CH			(0xd << 4)
++#define IMX290_OPORTSEL_LVDS_4CH			(0xe << 4)
++#define IMX290_OPORTSEL_LVDS_8CH			(0xf << 4)
++#define IMX290_XSOUTSEL					IMX290_REG_8BIT(0x304b)
++#define IMX290_XSOUTSEL_XVSOUTSEL_HIGH			(0 << 0)
++#define IMX290_XSOUTSEL_XVSOUTSEL_VSYNC			(2 << 0)
++#define IMX290_XSOUTSEL_XHSOUTSEL_HIGH			(0 << 2)
++#define IMX290_XSOUTSEL_XHSOUTSEL_HSYNC			(2 << 2)
++#define IMX290_INCKSEL1					IMX290_REG_8BIT(0x305c)
++#define IMX290_INCKSEL2					IMX290_REG_8BIT(0x305d)
++#define IMX290_INCKSEL3					IMX290_REG_8BIT(0x305e)
++#define IMX290_INCKSEL4					IMX290_REG_8BIT(0x305f)
+ #define IMX290_PGCTRL					IMX290_REG_8BIT(0x308c)
++#define IMX290_ADBIT1					IMX290_REG_8BIT(0x3129)
++#define IMX290_ADBIT1_10BIT				0x1d
++#define IMX290_ADBIT1_12BIT				0x00
++#define IMX290_INCKSEL5					IMX290_REG_8BIT(0x315e)
++#define IMX290_INCKSEL6					IMX290_REG_8BIT(0x3164)
++#define IMX290_ADBIT2					IMX290_REG_8BIT(0x317c)
++#define IMX290_ADBIT2_10BIT				0x12
++#define IMX290_ADBIT2_12BIT				0x00
+ #define IMX290_CHIP_ID					IMX290_REG_16BIT(0x319a)
++#define IMX290_ADBIT3					IMX290_REG_8BIT(0x31ec)
++#define IMX290_ADBIT3_10BIT				0x37
++#define IMX290_ADBIT3_12BIT				0x0e
++#define IMX290_REPETITION				IMX290_REG_8BIT(0x3405)
+ #define IMX290_PHY_LANE_NUM				IMX290_REG_8BIT(0x3407)
++#define IMX290_OPB_SIZE_V				IMX290_REG_8BIT(0x3414)
++#define IMX290_Y_OUT_SIZE				IMX290_REG_16BIT(0x3418)
++#define IMX290_CSI_DT_FMT				IMX290_REG_16BIT(0x3441)
++#define IMX290_CSI_DT_FMT_RAW10				0x0a0a
++#define IMX290_CSI_DT_FMT_RAW12				0x0c0c
+ #define IMX290_CSI_LANE_MODE				IMX290_REG_8BIT(0x3443)
++#define IMX290_EXTCK_FREQ				IMX290_REG_16BIT(0x3444)
++#define IMX290_TCLKPOST					IMX290_REG_16BIT(0x3446)
++#define IMX290_THSZERO					IMX290_REG_16BIT(0x3448)
++#define IMX290_THSPREPARE				IMX290_REG_16BIT(0x344a)
++#define IMX290_TCLKTRAIL				IMX290_REG_16BIT(0x344c)
++#define IMX290_THSTRAIL					IMX290_REG_16BIT(0x344e)
++#define IMX290_TCLKZERO					IMX290_REG_16BIT(0x3450)
++#define IMX290_TCLKPREPARE				IMX290_REG_16BIT(0x3452)
++#define IMX290_TLPX					IMX290_REG_16BIT(0x3454)
++#define IMX290_X_OUT_SIZE				IMX290_REG_16BIT(0x3472)
+ 
+ #define IMX290_PGCTRL_REGEN				BIT(0)
+ #define IMX290_PGCTRL_THRU				BIT(1)
+@@ -54,7 +113,7 @@ static const char * const imx290_supply_
+ 
+ struct imx290_regval {
+ 	u32 reg;
+-	u8 val;
++	u32 val;
+ };
+ 
+ struct imx290_mode {
+@@ -116,22 +175,16 @@ static const char * const imx290_test_pa
+ };
+ 
+ static const struct imx290_regval imx290_global_init_settings[] = {
+-	{ IMX290_REG_8BIT(0x3007), 0x00 },
+-	{ IMX290_REG_8BIT(0x3018), 0x65 },
+-	{ IMX290_REG_8BIT(0x3019), 0x04 },
+-	{ IMX290_REG_8BIT(0x301a), 0x00 },
+-	{ IMX290_REG_8BIT(0x3444), 0x20 },
+-	{ IMX290_REG_8BIT(0x3445), 0x25 },
+-	{ IMX290_REG_8BIT(0x303a), 0x0c },
+-	{ IMX290_REG_8BIT(0x3040), 0x00 },
+-	{ IMX290_REG_8BIT(0x3041), 0x00 },
+-	{ IMX290_REG_8BIT(0x303c), 0x00 },
+-	{ IMX290_REG_8BIT(0x303d), 0x00 },
+-	{ IMX290_REG_8BIT(0x3042), 0x9c },
+-	{ IMX290_REG_8BIT(0x3043), 0x07 },
+-	{ IMX290_REG_8BIT(0x303e), 0x49 },
+-	{ IMX290_REG_8BIT(0x303f), 0x04 },
+-	{ IMX290_REG_8BIT(0x304b), 0x0a },
++	{ IMX290_CTRL_07, IMX290_WINMODE_1080P },
++	{ IMX290_VMAX, 1125 },
++	{ IMX290_EXTCK_FREQ, 0x2520 },
++	{ IMX290_WINWV_OB, 12 },
++	{ IMX290_WINPH, 0 },
++	{ IMX290_WINPV, 0 },
++	{ IMX290_WINWH, 1948 },
++	{ IMX290_WINWV, 1097 },
++	{ IMX290_XSOUTSEL, IMX290_XSOUTSEL_XVSOUTSEL_VSYNC |
++			   IMX290_XSOUTSEL_XHSOUTSEL_HSYNC },
+ 	{ IMX290_REG_8BIT(0x300f), 0x00 },
+ 	{ IMX290_REG_8BIT(0x3010), 0x21 },
+ 	{ IMX290_REG_8BIT(0x3012), 0x64 },
+@@ -177,102 +230,78 @@ static const struct imx290_regval imx290
+ 
+ static const struct imx290_regval imx290_1080p_settings[] = {
+ 	/* mode settings */
+-	{ IMX290_REG_8BIT(0x3007), 0x00 },
+-	{ IMX290_REG_8BIT(0x303a), 0x0c },
+-	{ IMX290_REG_8BIT(0x3414), 0x0a },
+-	{ IMX290_REG_8BIT(0x3472), 0x80 },
+-	{ IMX290_REG_8BIT(0x3473), 0x07 },
+-	{ IMX290_REG_8BIT(0x3418), 0x38 },
+-	{ IMX290_REG_8BIT(0x3419), 0x04 },
++	{ IMX290_CTRL_07, IMX290_WINMODE_1080P },
++	{ IMX290_WINWV_OB, 12 },
++	{ IMX290_OPB_SIZE_V, 10 },
++	{ IMX290_X_OUT_SIZE, 1920 },
++	{ IMX290_Y_OUT_SIZE, 1080 },
+ 	{ IMX290_REG_8BIT(0x3012), 0x64 },
+ 	{ IMX290_REG_8BIT(0x3013), 0x00 },
+-	{ IMX290_REG_8BIT(0x305c), 0x18 },
+-	{ IMX290_REG_8BIT(0x305d), 0x03 },
+-	{ IMX290_REG_8BIT(0x305e), 0x20 },
+-	{ IMX290_REG_8BIT(0x305f), 0x01 },
+-	{ IMX290_REG_8BIT(0x315e), 0x1a },
+-	{ IMX290_REG_8BIT(0x3164), 0x1a },
++	{ IMX290_INCKSEL1, 0x18 },
++	{ IMX290_INCKSEL2, 0x03 },
++	{ IMX290_INCKSEL3, 0x20 },
++	{ IMX290_INCKSEL4, 0x01 },
++	{ IMX290_INCKSEL5, 0x1a },
++	{ IMX290_INCKSEL6, 0x1a },
+ 	{ IMX290_REG_8BIT(0x3480), 0x49 },
+ 	/* data rate settings */
+-	{ IMX290_REG_8BIT(0x3405), 0x10 },
+-	{ IMX290_REG_8BIT(0x3446), 0x57 },
+-	{ IMX290_REG_8BIT(0x3447), 0x00 },
+-	{ IMX290_REG_8BIT(0x3448), 0x37 },
+-	{ IMX290_REG_8BIT(0x3449), 0x00 },
+-	{ IMX290_REG_8BIT(0x344a), 0x1f },
+-	{ IMX290_REG_8BIT(0x344b), 0x00 },
+-	{ IMX290_REG_8BIT(0x344c), 0x1f },
+-	{ IMX290_REG_8BIT(0x344d), 0x00 },
+-	{ IMX290_REG_8BIT(0x344e), 0x1f },
+-	{ IMX290_REG_8BIT(0x344f), 0x00 },
+-	{ IMX290_REG_8BIT(0x3450), 0x77 },
+-	{ IMX290_REG_8BIT(0x3451), 0x00 },
+-	{ IMX290_REG_8BIT(0x3452), 0x1f },
+-	{ IMX290_REG_8BIT(0x3453), 0x00 },
+-	{ IMX290_REG_8BIT(0x3454), 0x17 },
+-	{ IMX290_REG_8BIT(0x3455), 0x00 },
++	{ IMX290_REPETITION, 0x10 },
++	{ IMX290_TCLKPOST, 87 },
++	{ IMX290_THSZERO, 55 },
++	{ IMX290_THSPREPARE, 31 },
++	{ IMX290_TCLKTRAIL, 31 },
++	{ IMX290_THSTRAIL, 31 },
++	{ IMX290_TCLKZERO, 119 },
++	{ IMX290_TCLKPREPARE, 31 },
++	{ IMX290_TLPX, 23 },
+ };
+ 
+ static const struct imx290_regval imx290_720p_settings[] = {
+ 	/* mode settings */
+-	{ IMX290_REG_8BIT(0x3007), 0x10 },
+-	{ IMX290_REG_8BIT(0x303a), 0x06 },
+-	{ IMX290_REG_8BIT(0x3414), 0x04 },
+-	{ IMX290_REG_8BIT(0x3472), 0x00 },
+-	{ IMX290_REG_8BIT(0x3473), 0x05 },
+-	{ IMX290_REG_8BIT(0x3418), 0xd0 },
+-	{ IMX290_REG_8BIT(0x3419), 0x02 },
++	{ IMX290_CTRL_07, IMX290_WINMODE_720P },
++	{ IMX290_WINWV_OB, 6 },
++	{ IMX290_OPB_SIZE_V, 4 },
++	{ IMX290_X_OUT_SIZE, 1280 },
++	{ IMX290_Y_OUT_SIZE, 720 },
+ 	{ IMX290_REG_8BIT(0x3012), 0x64 },
+ 	{ IMX290_REG_8BIT(0x3013), 0x00 },
+-	{ IMX290_REG_8BIT(0x305c), 0x20 },
+-	{ IMX290_REG_8BIT(0x305d), 0x00 },
+-	{ IMX290_REG_8BIT(0x305e), 0x20 },
+-	{ IMX290_REG_8BIT(0x305f), 0x01 },
+-	{ IMX290_REG_8BIT(0x315e), 0x1a },
+-	{ IMX290_REG_8BIT(0x3164), 0x1a },
++	{ IMX290_INCKSEL1, 0x20 },
++	{ IMX290_INCKSEL2, 0x00 },
++	{ IMX290_INCKSEL3, 0x20 },
++	{ IMX290_INCKSEL4, 0x01 },
++	{ IMX290_INCKSEL5, 0x1a },
++	{ IMX290_INCKSEL6, 0x1a },
+ 	{ IMX290_REG_8BIT(0x3480), 0x49 },
+ 	/* data rate settings */
+-	{ IMX290_REG_8BIT(0x3405), 0x10 },
+-	{ IMX290_REG_8BIT(0x3446), 0x4f },
+-	{ IMX290_REG_8BIT(0x3447), 0x00 },
+-	{ IMX290_REG_8BIT(0x3448), 0x2f },
+-	{ IMX290_REG_8BIT(0x3449), 0x00 },
+-	{ IMX290_REG_8BIT(0x344a), 0x17 },
+-	{ IMX290_REG_8BIT(0x344b), 0x00 },
+-	{ IMX290_REG_8BIT(0x344c), 0x17 },
+-	{ IMX290_REG_8BIT(0x344d), 0x00 },
+-	{ IMX290_REG_8BIT(0x344e), 0x17 },
+-	{ IMX290_REG_8BIT(0x344f), 0x00 },
+-	{ IMX290_REG_8BIT(0x3450), 0x57 },
+-	{ IMX290_REG_8BIT(0x3451), 0x00 },
+-	{ IMX290_REG_8BIT(0x3452), 0x17 },
+-	{ IMX290_REG_8BIT(0x3453), 0x00 },
+-	{ IMX290_REG_8BIT(0x3454), 0x17 },
+-	{ IMX290_REG_8BIT(0x3455), 0x00 },
++	{ IMX290_REPETITION, 0x10 },
++	{ IMX290_TCLKPOST, 79 },
++	{ IMX290_THSZERO, 47 },
++	{ IMX290_THSPREPARE, 23 },
++	{ IMX290_TCLKTRAIL, 23 },
++	{ IMX290_THSTRAIL, 23 },
++	{ IMX290_TCLKZERO, 87 },
++	{ IMX290_TCLKPREPARE, 23 },
++	{ IMX290_TLPX, 23 },
+ };
+ 
+ static const struct imx290_regval imx290_10bit_settings[] = {
+-	{ IMX290_REG_8BIT(0x3005), 0x00},
+-	{ IMX290_REG_8BIT(0x3046), 0x00},
+-	{ IMX290_REG_8BIT(0x3129), 0x1d},
+-	{ IMX290_REG_8BIT(0x317c), 0x12},
+-	{ IMX290_REG_8BIT(0x31ec), 0x37},
+-	{ IMX290_REG_8BIT(0x3441), 0x0a},
+-	{ IMX290_REG_8BIT(0x3442), 0x0a},
+-	{ IMX290_REG_8BIT(0x300a), 0x3c},
+-	{ IMX290_REG_8BIT(0x300b), 0x00},
++	{ IMX290_ADBIT, IMX290_ADBIT_10BIT },
++	{ IMX290_OUT_CTRL, IMX290_ODBIT_10BIT },
++	{ IMX290_ADBIT1, IMX290_ADBIT1_10BIT },
++	{ IMX290_ADBIT2, IMX290_ADBIT2_10BIT },
++	{ IMX290_ADBIT3, IMX290_ADBIT3_10BIT },
++	{ IMX290_CSI_DT_FMT, IMX290_CSI_DT_FMT_RAW10 },
++	{ IMX290_BLKLEVEL, 60 },
+ };
+ 
+ static const struct imx290_regval imx290_12bit_settings[] = {
+-	{ IMX290_REG_8BIT(0x3005), 0x01 },
+-	{ IMX290_REG_8BIT(0x3046), 0x01 },
+-	{ IMX290_REG_8BIT(0x3129), 0x00 },
+-	{ IMX290_REG_8BIT(0x317c), 0x00 },
+-	{ IMX290_REG_8BIT(0x31ec), 0x0e },
+-	{ IMX290_REG_8BIT(0x3441), 0x0c },
+-	{ IMX290_REG_8BIT(0x3442), 0x0c },
+-	{ IMX290_REG_8BIT(0x300a), 0xf0 },
+-	{ IMX290_REG_8BIT(0x300b), 0x00 },
++	{ IMX290_ADBIT, IMX290_ADBIT_12BIT },
++	{ IMX290_OUT_CTRL, IMX290_ODBIT_12BIT },
++	{ IMX290_ADBIT1, IMX290_ADBIT1_12BIT },
++	{ IMX290_ADBIT2, IMX290_ADBIT2_12BIT },
++	{ IMX290_ADBIT3, IMX290_ADBIT3_12BIT },
++	{ IMX290_CSI_DT_FMT, IMX290_CSI_DT_FMT_RAW12 },
++	{ IMX290_BLKLEVEL, 240 },
+ };
+ 
+ /* supported link frequencies */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0622-media-i2c-imx290-Add-exposure-time-control.patch b/target/linux/bcm27xx/patches-6.1/950-0622-media-i2c-imx290-Add-exposure-time-control.patch
new file mode 100644
index 00000000000000..8bca0ae647e694
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0622-media-i2c-imx290-Add-exposure-time-control.patch
@@ -0,0 +1,70 @@
+From ead4ef32c120f20ee9b1d8f9f0a4f75c2dc14af3 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sun, 16 Oct 2022 09:15:15 +0300
+Subject: [PATCH] media: i2c: imx290: Add exposure time control
+
+Upstream commit 827c7e69cb2d.
+
+Support configuring the exposure time, which is expressed as the
+complement of the exposure time (frame period minus integration time).
+The frame period is currently fixed.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Acked-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -103,6 +103,8 @@
+ #define IMX290_PGCTRL_THRU				BIT(1)
+ #define IMX290_PGCTRL_MODE(n)				((n) << 4)
+ 
++#define IMX290_VMAX_DEFAULT				1125
++
+ static const char * const imx290_supply_name[] = {
+ 	"vdda",
+ 	"vddd",
+@@ -176,7 +178,7 @@ static const char * const imx290_test_pa
+ 
+ static const struct imx290_regval imx290_global_init_settings[] = {
+ 	{ IMX290_CTRL_07, IMX290_WINMODE_1080P },
+-	{ IMX290_VMAX, 1125 },
++	{ IMX290_VMAX, IMX290_VMAX_DEFAULT },
+ 	{ IMX290_EXTCK_FREQ, 0x2520 },
+ 	{ IMX290_WINWV_OB, 12 },
+ 	{ IMX290_WINPH, 0 },
+@@ -480,6 +482,12 @@ static int imx290_set_ctrl(struct v4l2_c
+ 	case V4L2_CID_GAIN:
+ 		ret = imx290_write(imx290, IMX290_GAIN, ctrl->val, NULL);
+ 		break;
++
++	case V4L2_CID_EXPOSURE:
++		ret = imx290_write(imx290, IMX290_SHS1,
++				   IMX290_VMAX_DEFAULT - ctrl->val - 1, NULL);
++		break;
++
+ 	case V4L2_CID_TEST_PATTERN:
+ 		if (ctrl->val) {
+ 			imx290_write(imx290, IMX290_BLKLEVEL, 0, &ret);
+@@ -1008,12 +1016,16 @@ static int imx290_probe(struct i2c_clien
+ 	 */
+ 	imx290_entity_init_cfg(&imx290->sd, NULL);
+ 
+-	v4l2_ctrl_handler_init(&imx290->ctrls, 4);
++	v4l2_ctrl_handler_init(&imx290->ctrls, 5);
+ 	imx290->ctrls.lock = &imx290->lock;
+ 
+ 	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+ 			  V4L2_CID_GAIN, 0, 72, 1, 0);
+ 
++	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
++			  V4L2_CID_EXPOSURE, 1, IMX290_VMAX_DEFAULT - 2, 1,
++			  IMX290_VMAX_DEFAULT - 2);
++
+ 	imx290->link_freq =
+ 		v4l2_ctrl_new_int_menu(&imx290->ctrls, &imx290_ctrl_ops,
+ 				       V4L2_CID_LINK_FREQ,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0623-media-i2c-imx290-Fix-max-gain-value.patch b/target/linux/bcm27xx/patches-6.1/950-0623-media-i2c-imx290-Fix-max-gain-value.patch
new file mode 100644
index 00000000000000..2a5200f5275527
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0623-media-i2c-imx290-Fix-max-gain-value.patch
@@ -0,0 +1,52 @@
+From cf16974cd2daa3ae3fa3faf7c12c8b2d44828950 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sun, 16 Oct 2022 09:15:16 +0300
+Subject: [PATCH] media: i2c: imx290: Fix max gain value
+
+Upstream commit 6d7a87f2d3a6.
+
+The gain is expressed in multiple of 0.3dB, as a value between 0.0dB
+and 72.0dB. Gains between 0.0dB and 30.0dB (included) apply analog gain
+only, higher gains from 30.3dB to 72dB apply additional digital gain.
+
+The maximum gain value is erroneously set to 72. Increase it to 100 to
+cover the whole analog gain range. Support for digital gain can be added
+separately if needed.
+
+The IMX327 and IMX462 are largely compatible with the IMX290, but have
+an analog gain range of 0.0dB to 29.4dB and 42dB of digital gain. When
+support for those sensors gets added to the driver, the gain control
+should be adjusted accordingly.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -1019,8 +1019,21 @@ static int imx290_probe(struct i2c_clien
+ 	v4l2_ctrl_handler_init(&imx290->ctrls, 5);
+ 	imx290->ctrls.lock = &imx290->lock;
+ 
++	/*
++	 * The sensor has an analog gain and a digital gain, both controlled
++	 * through a single gain value, expressed in 0.3dB increments. Values
++	 * from 0.0dB (0) to 30.0dB (100) apply analog gain only, higher values
++	 * up to 72.0dB (240) add further digital gain. Limit the range to
++	 * analog gain only, support for digital gain can be added separately
++	 * if needed.
++	 *
++	 * The IMX327 and IMX462 are largely compatible with the IMX290, but
++	 * have an analog gain range of 0.0dB to 29.4dB and 42dB of digital
++	 * gain. When support for those sensors gets added to the driver, the
++	 * gain control should be adjusted accordingly.
++	 */
+ 	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-			  V4L2_CID_GAIN, 0, 72, 1, 0);
++			  V4L2_CID_GAIN, 0, 100, 1, 0);
+ 
+ 	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+ 			  V4L2_CID_EXPOSURE, 1, IMX290_VMAX_DEFAULT - 2, 1,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0624-media-i2c-imx290-Split-control-initialization-to-sep.patch b/target/linux/bcm27xx/patches-6.1/950-0624-media-i2c-imx290-Split-control-initialization-to-sep.patch
new file mode 100644
index 00000000000000..5ce44ac6383527
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0624-media-i2c-imx290-Split-control-initialization-to-sep.patch
@@ -0,0 +1,150 @@
+From 53bfa82420b36fb13c8efac38b7a334ea5e71a3c Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sun, 16 Oct 2022 09:15:17 +0300
+Subject: [PATCH] media: i2c: imx290: Split control initialization to
+ separate function
+
+Upstream commit 72c87b7ad560.
+
+The imx290_probe() function is too large. Split control initialzation to
+a dedicated function to increase code readability.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Acked-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 109 +++++++++++++++++++++----------------
+ 1 file changed, 61 insertions(+), 48 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -878,6 +878,62 @@ static const struct media_entity_operati
+ 	.link_validate = v4l2_subdev_link_validate,
+ };
+ 
++static int imx290_ctrl_init(struct imx290 *imx290)
++{
++	int ret;
++
++	v4l2_ctrl_handler_init(&imx290->ctrls, 5);
++	imx290->ctrls.lock = &imx290->lock;
++
++	/*
++	 * The sensor has an analog gain and a digital gain, both controlled
++	 * through a single gain value, expressed in 0.3dB increments. Values
++	 * from 0.0dB (0) to 30.0dB (100) apply analog gain only, higher values
++	 * up to 72.0dB (240) add further digital gain. Limit the range to
++	 * analog gain only, support for digital gain can be added separately
++	 * if needed.
++	 *
++	 * The IMX327 and IMX462 are largely compatible with the IMX290, but
++	 * have an analog gain range of 0.0dB to 29.4dB and 42dB of digital
++	 * gain. When support for those sensors gets added to the driver, the
++	 * gain control should be adjusted accordingly.
++	 */
++	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
++			  V4L2_CID_GAIN, 0, 100, 1, 0);
++
++	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
++			  V4L2_CID_EXPOSURE, 1, IMX290_VMAX_DEFAULT - 2, 1,
++			  IMX290_VMAX_DEFAULT - 2);
++
++	imx290->link_freq =
++		v4l2_ctrl_new_int_menu(&imx290->ctrls, &imx290_ctrl_ops,
++				       V4L2_CID_LINK_FREQ,
++				       imx290_link_freqs_num(imx290) - 1, 0,
++				       imx290_link_freqs_ptr(imx290));
++	if (imx290->link_freq)
++		imx290->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	imx290->pixel_rate = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
++					       V4L2_CID_PIXEL_RATE,
++					       1, INT_MAX, 1,
++					       imx290_calc_pixel_rate(imx290));
++
++	v4l2_ctrl_new_std_menu_items(&imx290->ctrls, &imx290_ctrl_ops,
++				     V4L2_CID_TEST_PATTERN,
++				     ARRAY_SIZE(imx290_test_pattern_menu) - 1,
++				     0, 0, imx290_test_pattern_menu);
++
++	imx290->sd.ctrl_handler = &imx290->ctrls;
++
++	if (imx290->ctrls.error) {
++		ret = imx290->ctrls.error;
++		v4l2_ctrl_handler_free(&imx290->ctrls);
++		return ret;
++	}
++
++	return 0;
++}
++
+ /*
+  * Returns 0 if all link frequencies used by the driver for the given number
+  * of MIPI data lanes are mentioned in the device tree, or the value of the
+@@ -1016,54 +1072,10 @@ static int imx290_probe(struct i2c_clien
+ 	 */
+ 	imx290_entity_init_cfg(&imx290->sd, NULL);
+ 
+-	v4l2_ctrl_handler_init(&imx290->ctrls, 5);
+-	imx290->ctrls.lock = &imx290->lock;
+-
+-	/*
+-	 * The sensor has an analog gain and a digital gain, both controlled
+-	 * through a single gain value, expressed in 0.3dB increments. Values
+-	 * from 0.0dB (0) to 30.0dB (100) apply analog gain only, higher values
+-	 * up to 72.0dB (240) add further digital gain. Limit the range to
+-	 * analog gain only, support for digital gain can be added separately
+-	 * if needed.
+-	 *
+-	 * The IMX327 and IMX462 are largely compatible with the IMX290, but
+-	 * have an analog gain range of 0.0dB to 29.4dB and 42dB of digital
+-	 * gain. When support for those sensors gets added to the driver, the
+-	 * gain control should be adjusted accordingly.
+-	 */
+-	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-			  V4L2_CID_GAIN, 0, 100, 1, 0);
+-
+-	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-			  V4L2_CID_EXPOSURE, 1, IMX290_VMAX_DEFAULT - 2, 1,
+-			  IMX290_VMAX_DEFAULT - 2);
+-
+-	imx290->link_freq =
+-		v4l2_ctrl_new_int_menu(&imx290->ctrls, &imx290_ctrl_ops,
+-				       V4L2_CID_LINK_FREQ,
+-				       imx290_link_freqs_num(imx290) - 1, 0,
+-				       imx290_link_freqs_ptr(imx290));
+-	if (imx290->link_freq)
+-		imx290->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+-
+-	imx290->pixel_rate = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-					       V4L2_CID_PIXEL_RATE,
+-					       1, INT_MAX, 1,
+-					       imx290_calc_pixel_rate(imx290));
+-
+-	v4l2_ctrl_new_std_menu_items(&imx290->ctrls, &imx290_ctrl_ops,
+-				     V4L2_CID_TEST_PATTERN,
+-				     ARRAY_SIZE(imx290_test_pattern_menu) - 1,
+-				     0, 0, imx290_test_pattern_menu);
+-
+-	imx290->sd.ctrl_handler = &imx290->ctrls;
+-
+-	if (imx290->ctrls.error) {
+-		dev_err(dev, "Control initialization error %d\n",
+-			imx290->ctrls.error);
+-		ret = imx290->ctrls.error;
+-		goto free_ctrl;
++	ret = imx290_ctrl_init(imx290);
++	if (ret < 0) {
++		dev_err(dev, "Control initialization error %d\n", ret);
++		goto free_mutex;
+ 	}
+ 
+ 	v4l2_i2c_subdev_init(&imx290->sd, client, &imx290_subdev_ops);
+@@ -1104,6 +1116,7 @@ free_entity:
+ 	media_entity_cleanup(&imx290->sd.entity);
+ free_ctrl:
+ 	v4l2_ctrl_handler_free(&imx290->ctrls);
++free_mutex:
+ 	mutex_destroy(&imx290->lock);
+ free_err:
+ 	v4l2_fwnode_endpoint_free(&ep);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0625-media-i2c-imx290-Implement-HBLANK-and-VBLANK-control.patch b/target/linux/bcm27xx/patches-6.1/950-0625-media-i2c-imx290-Implement-HBLANK-and-VBLANK-control.patch
new file mode 100644
index 00000000000000..cf076239bdf0b1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0625-media-i2c-imx290-Implement-HBLANK-and-VBLANK-control.patch
@@ -0,0 +1,83 @@
+From eefa9ce2af54be4a6fa33add2c3d0ddac2739622 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sun, 16 Oct 2022 09:15:18 +0300
+Subject: [PATCH] media: i2c: imx290: Implement HBLANK and VBLANK
+ controls
+
+Upstream commit 0c3b56c905e3.
+
+Add support for the V4L2_CID_HBLANK and V4L2_CID_VBLANK controls to the
+imx290 driver. Make the controls read-only to start with, to report the
+values to userspace for timing calculation.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 33 ++++++++++++++++++++++++++++++++-
+ 1 file changed, 32 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -146,6 +146,8 @@ struct imx290 {
+ 	struct v4l2_ctrl_handler ctrls;
+ 	struct v4l2_ctrl *link_freq;
+ 	struct v4l2_ctrl *pixel_rate;
++	struct v4l2_ctrl *hblank;
++	struct v4l2_ctrl *vblank;
+ 
+ 	struct mutex lock;
+ };
+@@ -642,6 +644,20 @@ static int imx290_set_fmt(struct v4l2_su
+ 		if (imx290->pixel_rate)
+ 			__v4l2_ctrl_s_ctrl_int64(imx290->pixel_rate,
+ 						 imx290_calc_pixel_rate(imx290));
++
++		if (imx290->hblank) {
++			unsigned int hblank = mode->hmax - mode->width;
++
++			__v4l2_ctrl_modify_range(imx290->hblank, hblank, hblank,
++						 1, hblank);
++		}
++
++		if (imx290->vblank) {
++			unsigned int vblank = IMX290_VMAX_DEFAULT - mode->height;
++
++			__v4l2_ctrl_modify_range(imx290->vblank, vblank, vblank,
++						 1, vblank);
++		}
+ 	}
+ 
+ 	*format = fmt->format;
+@@ -880,9 +896,10 @@ static const struct media_entity_operati
+ 
+ static int imx290_ctrl_init(struct imx290 *imx290)
+ {
++	unsigned int blank;
+ 	int ret;
+ 
+-	v4l2_ctrl_handler_init(&imx290->ctrls, 5);
++	v4l2_ctrl_handler_init(&imx290->ctrls, 7);
+ 	imx290->ctrls.lock = &imx290->lock;
+ 
+ 	/*
+@@ -923,6 +940,20 @@ static int imx290_ctrl_init(struct imx29
+ 				     ARRAY_SIZE(imx290_test_pattern_menu) - 1,
+ 				     0, 0, imx290_test_pattern_menu);
+ 
++	blank = imx290->current_mode->hmax - imx290->current_mode->width;
++	imx290->hblank = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
++					   V4L2_CID_HBLANK, blank, blank, 1,
++					   blank);
++	if (imx290->hblank)
++		imx290->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	blank = IMX290_VMAX_DEFAULT - imx290->current_mode->height;
++	imx290->vblank = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
++					   V4L2_CID_VBLANK, blank, blank, 1,
++					   blank);
++	if (imx290->vblank)
++		imx290->vblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
+ 	imx290->sd.ctrl_handler = &imx290->ctrls;
+ 
+ 	if (imx290->ctrls.error) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0626-media-i2c-imx290-Create-controls-for-fwnode-properti.patch b/target/linux/bcm27xx/patches-6.1/950-0626-media-i2c-imx290-Create-controls-for-fwnode-properti.patch
new file mode 100644
index 00000000000000..13f0c4c6b3dc32
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0626-media-i2c-imx290-Create-controls-for-fwnode-properti.patch
@@ -0,0 +1,47 @@
+From 10594f95e425d0eb7d36344cac5f276ab7e99658 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sun, 16 Oct 2022 09:15:19 +0300
+Subject: [PATCH] media: i2c: imx290: Create controls for fwnode
+ properties
+
+Upstream commit 4c9c93cf8657.
+
+Create the V4L2_CID_ORIENTATION and V4L2_CID_ROTATION controls to
+expose the corresponding fwnode properties.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Acked-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -896,10 +896,15 @@ static const struct media_entity_operati
+ 
+ static int imx290_ctrl_init(struct imx290 *imx290)
+ {
++	struct v4l2_fwnode_device_properties props;
+ 	unsigned int blank;
+ 	int ret;
+ 
+-	v4l2_ctrl_handler_init(&imx290->ctrls, 7);
++	ret = v4l2_fwnode_device_parse(imx290->dev, &props);
++	if (ret < 0)
++		return ret;
++
++	v4l2_ctrl_handler_init(&imx290->ctrls, 9);
+ 	imx290->ctrls.lock = &imx290->lock;
+ 
+ 	/*
+@@ -954,6 +959,9 @@ static int imx290_ctrl_init(struct imx29
+ 	if (imx290->vblank)
+ 		imx290->vblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+ 
++	v4l2_ctrl_new_fwnode_properties(&imx290->ctrls, &imx290_ctrl_ops,
++					&props);
++
+ 	imx290->sd.ctrl_handler = &imx290->ctrls;
+ 
+ 	if (imx290->ctrls.error) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0627-media-i2c-imx290-Move-registers-with-fixed-value-to-.patch b/target/linux/bcm27xx/patches-6.1/950-0627-media-i2c-imx290-Move-registers-with-fixed-value-to-.patch
new file mode 100644
index 00000000000000..560203ecfad97f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0627-media-i2c-imx290-Move-registers-with-fixed-value-to-.patch
@@ -0,0 +1,69 @@
+From a3fd80d2328aa8d2fd48a9bcf3db90d10a357529 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sun, 16 Oct 2022 09:15:20 +0300
+Subject: [PATCH] media: i2c: imx290: Move registers with fixed value
+ to init array
+
+Upstream commit 0b274ef2208d.
+
+Registers 0x3012, 0x3013 and 0x3480 are not documented and are set in
+the per-mode register arrays with values indentical for all modes. Move
+them to the common array.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Acked-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -192,6 +192,7 @@ static const struct imx290_regval imx290
+ 	{ IMX290_REG_8BIT(0x300f), 0x00 },
+ 	{ IMX290_REG_8BIT(0x3010), 0x21 },
+ 	{ IMX290_REG_8BIT(0x3012), 0x64 },
++	{ IMX290_REG_8BIT(0x3013), 0x00 },
+ 	{ IMX290_REG_8BIT(0x3016), 0x09 },
+ 	{ IMX290_REG_8BIT(0x3070), 0x02 },
+ 	{ IMX290_REG_8BIT(0x3071), 0x11 },
+@@ -230,6 +231,7 @@ static const struct imx290_regval imx290
+ 	{ IMX290_REG_8BIT(0x33b0), 0x50 },
+ 	{ IMX290_REG_8BIT(0x33b2), 0x1a },
+ 	{ IMX290_REG_8BIT(0x33b3), 0x04 },
++	{ IMX290_REG_8BIT(0x3480), 0x49 },
+ };
+ 
+ static const struct imx290_regval imx290_1080p_settings[] = {
+@@ -239,15 +241,12 @@ static const struct imx290_regval imx290
+ 	{ IMX290_OPB_SIZE_V, 10 },
+ 	{ IMX290_X_OUT_SIZE, 1920 },
+ 	{ IMX290_Y_OUT_SIZE, 1080 },
+-	{ IMX290_REG_8BIT(0x3012), 0x64 },
+-	{ IMX290_REG_8BIT(0x3013), 0x00 },
+ 	{ IMX290_INCKSEL1, 0x18 },
+ 	{ IMX290_INCKSEL2, 0x03 },
+ 	{ IMX290_INCKSEL3, 0x20 },
+ 	{ IMX290_INCKSEL4, 0x01 },
+ 	{ IMX290_INCKSEL5, 0x1a },
+ 	{ IMX290_INCKSEL6, 0x1a },
+-	{ IMX290_REG_8BIT(0x3480), 0x49 },
+ 	/* data rate settings */
+ 	{ IMX290_REPETITION, 0x10 },
+ 	{ IMX290_TCLKPOST, 87 },
+@@ -267,15 +266,12 @@ static const struct imx290_regval imx290
+ 	{ IMX290_OPB_SIZE_V, 4 },
+ 	{ IMX290_X_OUT_SIZE, 1280 },
+ 	{ IMX290_Y_OUT_SIZE, 720 },
+-	{ IMX290_REG_8BIT(0x3012), 0x64 },
+-	{ IMX290_REG_8BIT(0x3013), 0x00 },
+ 	{ IMX290_INCKSEL1, 0x20 },
+ 	{ IMX290_INCKSEL2, 0x00 },
+ 	{ IMX290_INCKSEL3, 0x20 },
+ 	{ IMX290_INCKSEL4, 0x01 },
+ 	{ IMX290_INCKSEL5, 0x1a },
+ 	{ IMX290_INCKSEL6, 0x1a },
+-	{ IMX290_REG_8BIT(0x3480), 0x49 },
+ 	/* data rate settings */
+ 	{ IMX290_REPETITION, 0x10 },
+ 	{ IMX290_TCLKPOST, 79 },
diff --git a/target/linux/bcm27xx/patches-6.1/950-0628-media-i2c-imx290-Factor-out-format-retrieval-to-sepa.patch b/target/linux/bcm27xx/patches-6.1/950-0628-media-i2c-imx290-Factor-out-format-retrieval-to-sepa.patch
new file mode 100644
index 00000000000000..59c83e034e0133
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0628-media-i2c-imx290-Factor-out-format-retrieval-to-sepa.patch
@@ -0,0 +1,64 @@
+From f46108f6b967602e60505ae0198709467668dc83 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sun, 16 Oct 2022 09:15:21 +0300
+Subject: [PATCH] media: i2c: imx290: Factor out format retrieval to
+ separate function
+
+Upstream commit b25537efeea9
+
+The driver duplicates the same pattern to access the try or active
+format in multiple locations. Factor it out to a separate function.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 24 ++++++++++++++----------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -519,6 +519,16 @@ static const struct v4l2_ctrl_ops imx290
+ 	.s_ctrl = imx290_set_ctrl,
+ };
+ 
++static struct v4l2_mbus_framefmt *
++imx290_get_pad_format(struct imx290 *imx290, struct v4l2_subdev_state *state,
++		      u32 which)
++{
++	if (which == V4L2_SUBDEV_FORMAT_ACTIVE)
++		return &imx290->current_format;
++	else
++		return v4l2_subdev_get_try_format(&imx290->sd, state, 0);
++}
++
+ static int imx290_enum_mbus_code(struct v4l2_subdev *sd,
+ 				 struct v4l2_subdev_state *sd_state,
+ 				 struct v4l2_subdev_mbus_code_enum *code)
+@@ -562,12 +572,7 @@ static int imx290_get_fmt(struct v4l2_su
+ 
+ 	mutex_lock(&imx290->lock);
+ 
+-	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY)
+-		framefmt = v4l2_subdev_get_try_format(&imx290->sd, sd_state,
+-						      fmt->pad);
+-	else
+-		framefmt = &imx290->current_format;
+-
++	framefmt = imx290_get_pad_format(imx290, sd_state, fmt->which);
+ 	fmt->format = *framefmt;
+ 
+ 	mutex_unlock(&imx290->lock);
+@@ -627,10 +632,9 @@ static int imx290_set_fmt(struct v4l2_su
+ 	fmt->format.code = imx290_formats[i].code;
+ 	fmt->format.field = V4L2_FIELD_NONE;
+ 
+-	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
+-		format = v4l2_subdev_get_try_format(sd, sd_state, fmt->pad);
+-	} else {
+-		format = &imx290->current_format;
++	format = imx290_get_pad_format(imx290, sd_state, fmt->which);
++
++	if (fmt->which == V4L2_SUBDEV_FORMAT_ACTIVE) {
+ 		imx290->current_mode = mode;
+ 		imx290->bpp = imx290_formats[i].bpp;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0629-media-i2c-imx290-Add-crop-selection-targets-support.patch b/target/linux/bcm27xx/patches-6.1/950-0629-media-i2c-imx290-Add-crop-selection-targets-support.patch
new file mode 100644
index 00000000000000..dccea7d570ab01
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0629-media-i2c-imx290-Add-crop-selection-targets-support.patch
@@ -0,0 +1,136 @@
+From 663ffc173ab99d9cb9165cb91393783b7ac40c1f Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sun, 16 Oct 2022 09:15:22 +0300
+Subject: [PATCH] media: i2c: imx290: Add crop selection targets
+ support
+
+Upstream commit b4ab57b07c5b.
+
+Implement read-only access to crop selection rectangles to expose the
+analogue crop rectangle. The public (leaked) IMX290 documentation is not
+very clear on how cropping is implemented and configured exactly, so
+the margins may not be entirely accurate.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 94 ++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 94 insertions(+)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -105,6 +105,53 @@
+ 
+ #define IMX290_VMAX_DEFAULT				1125
+ 
++
++/*
++ * The IMX290 pixel array is organized as follows:
++ *
++ *     +------------------------------------+
++ *     |           Optical Black            |     }  Vertical effective optical black (10)
++ * +---+------------------------------------+---+
++ * |   |                                    |   | }  Effective top margin (8)
++ * |   |   +----------------------------+   |   | \
++ * |   |   |                            |   |   |  |
++ * |   |   |                            |   |   |  |
++ * |   |   |                            |   |   |  |
++ * |   |   |    Recording Pixel Area    |   |   |  | Recommended height (1080)
++ * |   |   |                            |   |   |  |
++ * |   |   |                            |   |   |  |
++ * |   |   |                            |   |   |  |
++ * |   |   +----------------------------+   |   | /
++ * |   |                                    |   | }  Effective bottom margin (9)
++ * +---+------------------------------------+---+
++ *  <-> <-> <--------------------------> <-> <->
++ *                                            \----  Ignored right margin (4)
++ *                                        \--------  Effective right margin (9)
++ *                       \-------------------------  Recommended width (1920)
++ *       \-----------------------------------------  Effective left margin (8)
++ *   \---------------------------------------------  Ignored left margin (4)
++ *
++ * The optical black lines are output over CSI-2 with a separate data type.
++ *
++ * The pixel array is meant to have 1920x1080 usable pixels after image
++ * processing in an ISP. It has 8 (9) extra active pixels usable for color
++ * processing in the ISP on the top and left (bottom and right) sides of the
++ * image. In addition, 4 additional pixels are present on the left and right
++ * sides of the image, documented as "ignored area".
++ *
++ * As far as is understood, all pixels of the pixel array (ignored area, color
++ * processing margins and recording area) can be output by the sensor.
++ */
++
++#define IMX290_PIXEL_ARRAY_WIDTH			1945
++#define IMX290_PIXEL_ARRAY_HEIGHT			1097
++#define IMX920_PIXEL_ARRAY_MARGIN_LEFT			12
++#define IMX920_PIXEL_ARRAY_MARGIN_RIGHT			13
++#define IMX920_PIXEL_ARRAY_MARGIN_TOP			8
++#define IMX920_PIXEL_ARRAY_MARGIN_BOTTOM		9
++#define IMX290_PIXEL_ARRAY_RECORDING_WIDTH		1920
++#define IMX290_PIXEL_ARRAY_RECORDING_HEIGHT		1080
++
+ static const char * const imx290_supply_name[] = {
+ 	"vdda",
+ 	"vddd",
+@@ -667,6 +714,52 @@ static int imx290_set_fmt(struct v4l2_su
+ 	return 0;
+ }
+ 
++static int imx290_get_selection(struct v4l2_subdev *sd,
++				struct v4l2_subdev_state *sd_state,
++				struct v4l2_subdev_selection *sel)
++{
++	struct imx290 *imx290 = to_imx290(sd);
++	struct v4l2_mbus_framefmt *format;
++
++	switch (sel->target) {
++	case V4L2_SEL_TGT_CROP: {
++		format = imx290_get_pad_format(imx290, sd_state, sel->which);
++
++		mutex_lock(&imx290->lock);
++
++		sel->r.top = IMX920_PIXEL_ARRAY_MARGIN_TOP
++			   + (IMX290_PIXEL_ARRAY_RECORDING_HEIGHT - format->height) / 2;
++		sel->r.left = IMX920_PIXEL_ARRAY_MARGIN_LEFT
++			    + (IMX290_PIXEL_ARRAY_RECORDING_WIDTH - format->width) / 2;
++		sel->r.width = format->width;
++		sel->r.height = format->height;
++
++		mutex_unlock(&imx290->lock);
++		return 0;
++	}
++
++	case V4L2_SEL_TGT_NATIVE_SIZE:
++	case V4L2_SEL_TGT_CROP_BOUNDS:
++		sel->r.top = 0;
++		sel->r.left = 0;
++		sel->r.width = IMX290_PIXEL_ARRAY_WIDTH;
++		sel->r.height = IMX290_PIXEL_ARRAY_HEIGHT;
++
++		return 0;
++
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++		sel->r.top = IMX920_PIXEL_ARRAY_MARGIN_TOP;
++		sel->r.left = IMX920_PIXEL_ARRAY_MARGIN_LEFT;
++		sel->r.width = IMX290_PIXEL_ARRAY_RECORDING_WIDTH;
++		sel->r.height = IMX290_PIXEL_ARRAY_RECORDING_HEIGHT;
++
++		return 0;
++
++	default:
++		return -EINVAL;
++	}
++}
++
+ static int imx290_entity_init_cfg(struct v4l2_subdev *subdev,
+ 				  struct v4l2_subdev_state *sd_state)
+ {
+@@ -883,6 +976,7 @@ static const struct v4l2_subdev_pad_ops
+ 	.enum_frame_size = imx290_enum_frame_size,
+ 	.get_fmt = imx290_get_fmt,
+ 	.set_fmt = imx290_set_fmt,
++	.get_selection = imx290_get_selection,
+ };
+ 
+ static const struct v4l2_subdev_ops imx290_subdev_ops = {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0630-media-i2c-imx290-Replace-GAIN-control-with-ANALOGUE_.patch b/target/linux/bcm27xx/patches-6.1/950-0630-media-i2c-imx290-Replace-GAIN-control-with-ANALOGUE_.patch
new file mode 100644
index 00000000000000..0cd0ac8582d326
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0630-media-i2c-imx290-Replace-GAIN-control-with-ANALOGUE_.patch
@@ -0,0 +1,38 @@
+From 07e177363a8c2596740f22a049568cd448d923dd Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sun, 16 Oct 2022 09:15:23 +0300
+Subject: [PATCH] media: i2c: imx290: Replace GAIN control with
+ ANALOGUE_GAIN
+
+Upstream commit 3dd10515a1d9
+
+The IMX290 gain register controls the analogue gain. Replace the
+V4L2_CID_GAIN control with V4L2_CID_ANALOGUE_GAIN.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -524,7 +524,7 @@ static int imx290_set_ctrl(struct v4l2_c
+ 		return 0;
+ 
+ 	switch (ctrl->id) {
+-	case V4L2_CID_GAIN:
++	case V4L2_CID_ANALOGUE_GAIN:
+ 		ret = imx290_write(imx290, IMX290_GAIN, ctrl->val, NULL);
+ 		break;
+ 
+@@ -1015,7 +1015,7 @@ static int imx290_ctrl_init(struct imx29
+ 	 * gain control should be adjusted accordingly.
+ 	 */
+ 	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-			  V4L2_CID_GAIN, 0, 100, 1, 0);
++			  V4L2_CID_ANALOGUE_GAIN, 0, 100, 1, 0);
+ 
+ 	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+ 			  V4L2_CID_EXPOSURE, 1, IMX290_VMAX_DEFAULT - 2, 1,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0631-media-i2c-imx290-Group-functions-in-sections.patch b/target/linux/bcm27xx/patches-6.1/950-0631-media-i2c-imx290-Group-functions-in-sections.patch
new file mode 100644
index 00000000000000..ad0f8f52cf44da
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0631-media-i2c-imx290-Group-functions-in-sections.patch
@@ -0,0 +1,714 @@
+From c4977346ac1a7e1a9175146e2fc20feca2f96703 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 16 Jan 2023 15:44:38 +0100
+Subject: [PATCH] media: i2c: imx290: Group functions in sections
+
+Upstream commit cb7e1c8dbe60
+
+Move functions around to group them in logical sections, in order to
+improve readability. As a result, the IMX290_NUM_SUPPLIES macro has to
+be changed. No other code change is included, only moves.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 688 +++++++++++++++++++------------------
+ 1 file changed, 356 insertions(+), 332 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -152,13 +152,7 @@
+ #define IMX290_PIXEL_ARRAY_RECORDING_WIDTH		1920
+ #define IMX290_PIXEL_ARRAY_RECORDING_HEIGHT		1080
+ 
+-static const char * const imx290_supply_name[] = {
+-	"vdda",
+-	"vddd",
+-	"vdddo",
+-};
+-
+-#define IMX290_NUM_SUPPLIES ARRAY_SIZE(imx290_supply_name)
++#define IMX290_NUM_SUPPLIES				3
+ 
+ struct imx290_regval {
+ 	u32 reg;
+@@ -199,31 +193,14 @@ struct imx290 {
+ 	struct mutex lock;
+ };
+ 
+-struct imx290_pixfmt {
+-	u32 code;
+-	u8 bpp;
+-};
+-
+-static const struct imx290_pixfmt imx290_formats[] = {
+-	{ MEDIA_BUS_FMT_SRGGB10_1X10, 10 },
+-	{ MEDIA_BUS_FMT_SRGGB12_1X12, 12 },
+-};
+-
+-static const struct regmap_config imx290_regmap_config = {
+-	.reg_bits = 16,
+-	.val_bits = 8,
+-};
++static inline struct imx290 *to_imx290(struct v4l2_subdev *_sd)
++{
++	return container_of(_sd, struct imx290, sd);
++}
+ 
+-static const char * const imx290_test_pattern_menu[] = {
+-	"Disabled",
+-	"Sequence Pattern 1",
+-	"Horizontal Color-bar Chart",
+-	"Vertical Color-bar Chart",
+-	"Sequence Pattern 2",
+-	"Gradation Pattern 1",
+-	"Gradation Pattern 2",
+-	"000/555h Toggle Pattern",
+-};
++/* -----------------------------------------------------------------------------
++ * Modes and formats
++ */
+ 
+ static const struct imx290_regval imx290_global_init_settings[] = {
+ 	{ IMX290_CTRL_07, IMX290_WINMODE_1080P },
+@@ -438,10 +415,19 @@ static inline int imx290_modes_num(const
+ 		return ARRAY_SIZE(imx290_modes_4lanes);
+ }
+ 
+-static inline struct imx290 *to_imx290(struct v4l2_subdev *_sd)
+-{
+-	return container_of(_sd, struct imx290, sd);
+-}
++struct imx290_pixfmt {
++	u32 code;
++	u8 bpp;
++};
++
++static const struct imx290_pixfmt imx290_formats[] = {
++	{ MEDIA_BUS_FMT_SRGGB10_1X10, 10 },
++	{ MEDIA_BUS_FMT_SRGGB12_1X12, 12 },
++};
++
++/* -----------------------------------------------------------------------------
++ * Register access
++ */
+ 
+ static int __always_unused imx290_read(struct imx290 *imx290, u32 addr, u32 *value)
+ {
+@@ -501,18 +487,94 @@ static int imx290_set_register_array(str
+ 	return 0;
+ }
+ 
+-/* Stop streaming */
+-static int imx290_stop_streaming(struct imx290 *imx290)
++static int imx290_set_data_lanes(struct imx290 *imx290)
+ {
+-	int ret = 0;
++	int ret = 0, laneval, frsel;
+ 
+-	imx290_write(imx290, IMX290_STANDBY, 0x01, &ret);
++	switch (imx290->nlanes) {
++	case 2:
++		laneval = 0x01;
++		frsel = 0x02;
++		break;
++	case 4:
++		laneval = 0x03;
++		frsel = 0x01;
++		break;
++	default:
++		/*
++		 * We should never hit this since the data lane count is
++		 * validated in probe itself
++		 */
++		dev_err(imx290->dev, "Lane configuration not supported\n");
++		return -EINVAL;
++	}
+ 
+-	msleep(30);
++	imx290_write(imx290, IMX290_PHY_LANE_NUM, laneval, &ret);
++	imx290_write(imx290, IMX290_CSI_LANE_MODE, laneval, &ret);
++	imx290_write(imx290, IMX290_FR_FDG_SEL, frsel, &ret);
+ 
+-	return imx290_write(imx290, IMX290_XMSTA, 0x01, &ret);
++	return ret;
++}
++
++static int imx290_write_current_format(struct imx290 *imx290)
++{
++	int ret;
++
++	switch (imx290->current_format.code) {
++	case MEDIA_BUS_FMT_SRGGB10_1X10:
++		ret = imx290_set_register_array(imx290, imx290_10bit_settings,
++						ARRAY_SIZE(
++							imx290_10bit_settings));
++		if (ret < 0) {
++			dev_err(imx290->dev, "Could not set format registers\n");
++			return ret;
++		}
++		break;
++	case MEDIA_BUS_FMT_SRGGB12_1X12:
++		ret = imx290_set_register_array(imx290, imx290_12bit_settings,
++						ARRAY_SIZE(
++							imx290_12bit_settings));
++		if (ret < 0) {
++			dev_err(imx290->dev, "Could not set format registers\n");
++			return ret;
++		}
++		break;
++	default:
++		dev_err(imx290->dev, "Unknown pixel format\n");
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static inline u8 imx290_get_link_freq_index(struct imx290 *imx290)
++{
++	return imx290->current_mode->link_freq_index;
+ }
+ 
++static s64 imx290_get_link_freq(struct imx290 *imx290)
++{
++	u8 index = imx290_get_link_freq_index(imx290);
++
++	return *(imx290_link_freqs_ptr(imx290) + index);
++}
++
++static u64 imx290_calc_pixel_rate(struct imx290 *imx290)
++{
++	s64 link_freq = imx290_get_link_freq(imx290);
++	u8 nlanes = imx290->nlanes;
++	u64 pixel_rate;
++
++	/* pixel rate = link_freq * 2 * nr_of_lanes / bits_per_sample */
++	pixel_rate = link_freq * 2 * nlanes;
++	do_div(pixel_rate, imx290->bpp);
++	return pixel_rate;
++}
++
++/* ----------------------------------------------------------------------------
++ * Controls
++ */
++
+ static int imx290_set_ctrl(struct v4l2_ctrl *ctrl)
+ {
+ 	struct imx290 *imx290 = container_of(ctrl->handler,
+@@ -566,6 +628,187 @@ static const struct v4l2_ctrl_ops imx290
+ 	.s_ctrl = imx290_set_ctrl,
+ };
+ 
++static const char * const imx290_test_pattern_menu[] = {
++	"Disabled",
++	"Sequence Pattern 1",
++	"Horizontal Color-bar Chart",
++	"Vertical Color-bar Chart",
++	"Sequence Pattern 2",
++	"Gradation Pattern 1",
++	"Gradation Pattern 2",
++	"000/555h Toggle Pattern",
++};
++
++static int imx290_ctrl_init(struct imx290 *imx290)
++{
++	struct v4l2_fwnode_device_properties props;
++	unsigned int blank;
++	int ret;
++
++	ret = v4l2_fwnode_device_parse(imx290->dev, &props);
++	if (ret < 0)
++		return ret;
++
++	v4l2_ctrl_handler_init(&imx290->ctrls, 9);
++	imx290->ctrls.lock = &imx290->lock;
++
++	/*
++	 * The sensor has an analog gain and a digital gain, both controlled
++	 * through a single gain value, expressed in 0.3dB increments. Values
++	 * from 0.0dB (0) to 30.0dB (100) apply analog gain only, higher values
++	 * up to 72.0dB (240) add further digital gain. Limit the range to
++	 * analog gain only, support for digital gain can be added separately
++	 * if needed.
++	 *
++	 * The IMX327 and IMX462 are largely compatible with the IMX290, but
++	 * have an analog gain range of 0.0dB to 29.4dB and 42dB of digital
++	 * gain. When support for those sensors gets added to the driver, the
++	 * gain control should be adjusted accordingly.
++	 */
++	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
++			  V4L2_CID_ANALOGUE_GAIN, 0, 100, 1, 0);
++
++	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
++			  V4L2_CID_EXPOSURE, 1, IMX290_VMAX_DEFAULT - 2, 1,
++			  IMX290_VMAX_DEFAULT - 2);
++
++	imx290->link_freq =
++		v4l2_ctrl_new_int_menu(&imx290->ctrls, &imx290_ctrl_ops,
++				       V4L2_CID_LINK_FREQ,
++				       imx290_link_freqs_num(imx290) - 1, 0,
++				       imx290_link_freqs_ptr(imx290));
++	if (imx290->link_freq)
++		imx290->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	imx290->pixel_rate = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
++					       V4L2_CID_PIXEL_RATE,
++					       1, INT_MAX, 1,
++					       imx290_calc_pixel_rate(imx290));
++
++	v4l2_ctrl_new_std_menu_items(&imx290->ctrls, &imx290_ctrl_ops,
++				     V4L2_CID_TEST_PATTERN,
++				     ARRAY_SIZE(imx290_test_pattern_menu) - 1,
++				     0, 0, imx290_test_pattern_menu);
++
++	blank = imx290->current_mode->hmax - imx290->current_mode->width;
++	imx290->hblank = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
++					   V4L2_CID_HBLANK, blank, blank, 1,
++					   blank);
++	if (imx290->hblank)
++		imx290->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	blank = IMX290_VMAX_DEFAULT - imx290->current_mode->height;
++	imx290->vblank = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
++					   V4L2_CID_VBLANK, blank, blank, 1,
++					   blank);
++	if (imx290->vblank)
++		imx290->vblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	v4l2_ctrl_new_fwnode_properties(&imx290->ctrls, &imx290_ctrl_ops,
++					&props);
++
++	imx290->sd.ctrl_handler = &imx290->ctrls;
++
++	if (imx290->ctrls.error) {
++		ret = imx290->ctrls.error;
++		v4l2_ctrl_handler_free(&imx290->ctrls);
++		return ret;
++	}
++
++	return 0;
++}
++
++/* ----------------------------------------------------------------------------
++ * Subdev operations
++ */
++
++/* Start streaming */
++static int imx290_start_streaming(struct imx290 *imx290)
++{
++	int ret;
++
++	/* Set init register settings */
++	ret = imx290_set_register_array(imx290, imx290_global_init_settings,
++					ARRAY_SIZE(
++						imx290_global_init_settings));
++	if (ret < 0) {
++		dev_err(imx290->dev, "Could not set init registers\n");
++		return ret;
++	}
++
++	/* Apply the register values related to current frame format */
++	ret = imx290_write_current_format(imx290);
++	if (ret < 0) {
++		dev_err(imx290->dev, "Could not set frame format\n");
++		return ret;
++	}
++
++	/* Apply default values of current mode */
++	ret = imx290_set_register_array(imx290, imx290->current_mode->data,
++					imx290->current_mode->data_size);
++	if (ret < 0) {
++		dev_err(imx290->dev, "Could not set current mode\n");
++		return ret;
++	}
++
++	ret = imx290_write(imx290, IMX290_HMAX, imx290->current_mode->hmax,
++			   NULL);
++	if (ret)
++		return ret;
++
++	/* Apply customized values from user */
++	ret = v4l2_ctrl_handler_setup(imx290->sd.ctrl_handler);
++	if (ret) {
++		dev_err(imx290->dev, "Could not sync v4l2 controls\n");
++		return ret;
++	}
++
++	imx290_write(imx290, IMX290_STANDBY, 0x00, &ret);
++
++	msleep(30);
++
++	/* Start streaming */
++	return imx290_write(imx290, IMX290_XMSTA, 0x00, &ret);
++}
++
++/* Stop streaming */
++static int imx290_stop_streaming(struct imx290 *imx290)
++{
++	int ret = 0;
++
++	imx290_write(imx290, IMX290_STANDBY, 0x01, &ret);
++
++	msleep(30);
++
++	return imx290_write(imx290, IMX290_XMSTA, 0x01, &ret);
++}
++
++static int imx290_set_stream(struct v4l2_subdev *sd, int enable)
++{
++	struct imx290 *imx290 = to_imx290(sd);
++	int ret = 0;
++
++	if (enable) {
++		ret = pm_runtime_resume_and_get(imx290->dev);
++		if (ret < 0)
++			goto unlock_and_return;
++
++		ret = imx290_start_streaming(imx290);
++		if (ret) {
++			dev_err(imx290->dev, "Start stream failed\n");
++			pm_runtime_put(imx290->dev);
++			goto unlock_and_return;
++		}
++	} else {
++		imx290_stop_streaming(imx290);
++		pm_runtime_put(imx290->dev);
++	}
++
++unlock_and_return:
++
++	return ret;
++}
++
+ static struct v4l2_mbus_framefmt *
+ imx290_get_pad_format(struct imx290 *imx290, struct v4l2_subdev_state *state,
+ 		      u32 which)
+@@ -627,30 +870,6 @@ static int imx290_get_fmt(struct v4l2_su
+ 	return 0;
+ }
+ 
+-static inline u8 imx290_get_link_freq_index(struct imx290 *imx290)
+-{
+-	return imx290->current_mode->link_freq_index;
+-}
+-
+-static s64 imx290_get_link_freq(struct imx290 *imx290)
+-{
+-	u8 index = imx290_get_link_freq_index(imx290);
+-
+-	return *(imx290_link_freqs_ptr(imx290) + index);
+-}
+-
+-static u64 imx290_calc_pixel_rate(struct imx290 *imx290)
+-{
+-	s64 link_freq = imx290_get_link_freq(imx290);
+-	u8 nlanes = imx290->nlanes;
+-	u64 pixel_rate;
+-
+-	/* pixel rate = link_freq * 2 * nr_of_lanes / bits_per_sample */
+-	pixel_rate = link_freq * 2 * nlanes;
+-	do_div(pixel_rate, imx290->bpp);
+-	return pixel_rate;
+-}
+-
+ static int imx290_set_fmt(struct v4l2_subdev *sd,
+ 			  struct v4l2_subdev_state *sd_state,
+ 			  struct v4l2_subdev_format *fmt)
+@@ -774,151 +993,31 @@ static int imx290_entity_init_cfg(struct
+ 	return 0;
+ }
+ 
+-static int imx290_write_current_format(struct imx290 *imx290)
+-{
+-	int ret;
+-
+-	switch (imx290->current_format.code) {
+-	case MEDIA_BUS_FMT_SRGGB10_1X10:
+-		ret = imx290_set_register_array(imx290, imx290_10bit_settings,
+-						ARRAY_SIZE(
+-							imx290_10bit_settings));
+-		if (ret < 0) {
+-			dev_err(imx290->dev, "Could not set format registers\n");
+-			return ret;
+-		}
+-		break;
+-	case MEDIA_BUS_FMT_SRGGB12_1X12:
+-		ret = imx290_set_register_array(imx290, imx290_12bit_settings,
+-						ARRAY_SIZE(
+-							imx290_12bit_settings));
+-		if (ret < 0) {
+-			dev_err(imx290->dev, "Could not set format registers\n");
+-			return ret;
+-		}
+-		break;
+-	default:
+-		dev_err(imx290->dev, "Unknown pixel format\n");
+-		return -EINVAL;
+-	}
+-
+-	return 0;
+-}
+-
+-/* Start streaming */
+-static int imx290_start_streaming(struct imx290 *imx290)
+-{
+-	int ret;
+-
+-	/* Set init register settings */
+-	ret = imx290_set_register_array(imx290, imx290_global_init_settings,
+-					ARRAY_SIZE(
+-						imx290_global_init_settings));
+-	if (ret < 0) {
+-		dev_err(imx290->dev, "Could not set init registers\n");
+-		return ret;
+-	}
+-
+-	/* Apply the register values related to current frame format */
+-	ret = imx290_write_current_format(imx290);
+-	if (ret < 0) {
+-		dev_err(imx290->dev, "Could not set frame format\n");
+-		return ret;
+-	}
+-
+-	/* Apply default values of current mode */
+-	ret = imx290_set_register_array(imx290, imx290->current_mode->data,
+-					imx290->current_mode->data_size);
+-	if (ret < 0) {
+-		dev_err(imx290->dev, "Could not set current mode\n");
+-		return ret;
+-	}
+-
+-	ret = imx290_write(imx290, IMX290_HMAX, imx290->current_mode->hmax,
+-			   NULL);
+-	if (ret)
+-		return ret;
+-
+-	/* Apply customized values from user */
+-	ret = v4l2_ctrl_handler_setup(imx290->sd.ctrl_handler);
+-	if (ret) {
+-		dev_err(imx290->dev, "Could not sync v4l2 controls\n");
+-		return ret;
+-	}
+-
+-	imx290_write(imx290, IMX290_STANDBY, 0x00, &ret);
+-
+-	msleep(30);
+-
+-	/* Start streaming */
+-	return imx290_write(imx290, IMX290_XMSTA, 0x00, &ret);
+-}
+-
+-static int imx290_set_stream(struct v4l2_subdev *sd, int enable)
+-{
+-	struct imx290 *imx290 = to_imx290(sd);
+-	int ret = 0;
+-
+-	if (enable) {
+-		ret = pm_runtime_resume_and_get(imx290->dev);
+-		if (ret < 0)
+-			goto unlock_and_return;
+-
+-		ret = imx290_start_streaming(imx290);
+-		if (ret) {
+-			dev_err(imx290->dev, "Start stream failed\n");
+-			pm_runtime_put(imx290->dev);
+-			goto unlock_and_return;
+-		}
+-	} else {
+-		imx290_stop_streaming(imx290);
+-		pm_runtime_put(imx290->dev);
+-	}
+-
+-unlock_and_return:
+-
+-	return ret;
+-}
+-
+-static int imx290_get_regulators(struct device *dev, struct imx290 *imx290)
+-{
+-	unsigned int i;
+-
+-	for (i = 0; i < ARRAY_SIZE(imx290->supplies); i++)
+-		imx290->supplies[i].supply = imx290_supply_name[i];
+-
+-	return devm_regulator_bulk_get(dev, ARRAY_SIZE(imx290->supplies),
+-				       imx290->supplies);
+-}
++static const struct v4l2_subdev_video_ops imx290_video_ops = {
++	.s_stream = imx290_set_stream,
++};
+ 
+-static int imx290_set_data_lanes(struct imx290 *imx290)
+-{
+-	int ret = 0, laneval, frsel;
++static const struct v4l2_subdev_pad_ops imx290_pad_ops = {
++	.init_cfg = imx290_entity_init_cfg,
++	.enum_mbus_code = imx290_enum_mbus_code,
++	.enum_frame_size = imx290_enum_frame_size,
++	.get_fmt = imx290_get_fmt,
++	.set_fmt = imx290_set_fmt,
++	.get_selection = imx290_get_selection,
++};
+ 
+-	switch (imx290->nlanes) {
+-	case 2:
+-		laneval = 0x01;
+-		frsel = 0x02;
+-		break;
+-	case 4:
+-		laneval = 0x03;
+-		frsel = 0x01;
+-		break;
+-	default:
+-		/*
+-		 * We should never hit this since the data lane count is
+-		 * validated in probe itself
+-		 */
+-		dev_err(imx290->dev, "Lane configuration not supported\n");
+-		return -EINVAL;
+-	}
++static const struct v4l2_subdev_ops imx290_subdev_ops = {
++	.video = &imx290_video_ops,
++	.pad = &imx290_pad_ops,
++};
+ 
+-	imx290_write(imx290, IMX290_PHY_LANE_NUM, laneval, &ret);
+-	imx290_write(imx290, IMX290_CSI_LANE_MODE, laneval, &ret);
+-	imx290_write(imx290, IMX290_FR_FDG_SEL, frsel, &ret);
++static const struct media_entity_operations imx290_subdev_entity_ops = {
++	.link_validate = v4l2_subdev_link_validate,
++};
+ 
+-	return ret;
+-}
++/* ----------------------------------------------------------------------------
++ * Power management
++ */
+ 
+ static int imx290_power_on(struct device *dev)
+ {
+@@ -966,105 +1065,30 @@ static const struct dev_pm_ops imx290_pm
+ 	SET_RUNTIME_PM_OPS(imx290_power_off, imx290_power_on, NULL)
+ };
+ 
+-static const struct v4l2_subdev_video_ops imx290_video_ops = {
+-	.s_stream = imx290_set_stream,
+-};
+-
+-static const struct v4l2_subdev_pad_ops imx290_pad_ops = {
+-	.init_cfg = imx290_entity_init_cfg,
+-	.enum_mbus_code = imx290_enum_mbus_code,
+-	.enum_frame_size = imx290_enum_frame_size,
+-	.get_fmt = imx290_get_fmt,
+-	.set_fmt = imx290_set_fmt,
+-	.get_selection = imx290_get_selection,
+-};
++/* ----------------------------------------------------------------------------
++ * Probe & remove
++ */
+ 
+-static const struct v4l2_subdev_ops imx290_subdev_ops = {
+-	.video = &imx290_video_ops,
+-	.pad = &imx290_pad_ops,
++static const struct regmap_config imx290_regmap_config = {
++	.reg_bits = 16,
++	.val_bits = 8,
+ };
+ 
+-static const struct media_entity_operations imx290_subdev_entity_ops = {
+-	.link_validate = v4l2_subdev_link_validate,
++static const char * const imx290_supply_name[IMX290_NUM_SUPPLIES] = {
++	"vdda",
++	"vddd",
++	"vdddo",
+ };
+ 
+-static int imx290_ctrl_init(struct imx290 *imx290)
++static int imx290_get_regulators(struct device *dev, struct imx290 *imx290)
+ {
+-	struct v4l2_fwnode_device_properties props;
+-	unsigned int blank;
+-	int ret;
+-
+-	ret = v4l2_fwnode_device_parse(imx290->dev, &props);
+-	if (ret < 0)
+-		return ret;
+-
+-	v4l2_ctrl_handler_init(&imx290->ctrls, 9);
+-	imx290->ctrls.lock = &imx290->lock;
+-
+-	/*
+-	 * The sensor has an analog gain and a digital gain, both controlled
+-	 * through a single gain value, expressed in 0.3dB increments. Values
+-	 * from 0.0dB (0) to 30.0dB (100) apply analog gain only, higher values
+-	 * up to 72.0dB (240) add further digital gain. Limit the range to
+-	 * analog gain only, support for digital gain can be added separately
+-	 * if needed.
+-	 *
+-	 * The IMX327 and IMX462 are largely compatible with the IMX290, but
+-	 * have an analog gain range of 0.0dB to 29.4dB and 42dB of digital
+-	 * gain. When support for those sensors gets added to the driver, the
+-	 * gain control should be adjusted accordingly.
+-	 */
+-	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-			  V4L2_CID_ANALOGUE_GAIN, 0, 100, 1, 0);
+-
+-	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-			  V4L2_CID_EXPOSURE, 1, IMX290_VMAX_DEFAULT - 2, 1,
+-			  IMX290_VMAX_DEFAULT - 2);
+-
+-	imx290->link_freq =
+-		v4l2_ctrl_new_int_menu(&imx290->ctrls, &imx290_ctrl_ops,
+-				       V4L2_CID_LINK_FREQ,
+-				       imx290_link_freqs_num(imx290) - 1, 0,
+-				       imx290_link_freqs_ptr(imx290));
+-	if (imx290->link_freq)
+-		imx290->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+-
+-	imx290->pixel_rate = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-					       V4L2_CID_PIXEL_RATE,
+-					       1, INT_MAX, 1,
+-					       imx290_calc_pixel_rate(imx290));
+-
+-	v4l2_ctrl_new_std_menu_items(&imx290->ctrls, &imx290_ctrl_ops,
+-				     V4L2_CID_TEST_PATTERN,
+-				     ARRAY_SIZE(imx290_test_pattern_menu) - 1,
+-				     0, 0, imx290_test_pattern_menu);
+-
+-	blank = imx290->current_mode->hmax - imx290->current_mode->width;
+-	imx290->hblank = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-					   V4L2_CID_HBLANK, blank, blank, 1,
+-					   blank);
+-	if (imx290->hblank)
+-		imx290->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+-
+-	blank = IMX290_VMAX_DEFAULT - imx290->current_mode->height;
+-	imx290->vblank = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-					   V4L2_CID_VBLANK, blank, blank, 1,
+-					   blank);
+-	if (imx290->vblank)
+-		imx290->vblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+-
+-	v4l2_ctrl_new_fwnode_properties(&imx290->ctrls, &imx290_ctrl_ops,
+-					&props);
+-
+-	imx290->sd.ctrl_handler = &imx290->ctrls;
++	unsigned int i;
+ 
+-	if (imx290->ctrls.error) {
+-		ret = imx290->ctrls.error;
+-		v4l2_ctrl_handler_free(&imx290->ctrls);
+-		return ret;
+-	}
++	for (i = 0; i < ARRAY_SIZE(imx290->supplies); i++)
++		imx290->supplies[i].supply = imx290_supply_name[i];
+ 
+-	return 0;
++	return devm_regulator_bulk_get(dev, ARRAY_SIZE(imx290->supplies),
++				       imx290->supplies);
+ }
+ 
+ /*
diff --git a/target/linux/bcm27xx/patches-6.1/950-0632-media-i2c-imx290-Factor-out-subdev-init-and-cleanup-.patch b/target/linux/bcm27xx/patches-6.1/950-0632-media-i2c-imx290-Factor-out-subdev-init-and-cleanup-.patch
new file mode 100644
index 00000000000000..fdd85f0cc59f47
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0632-media-i2c-imx290-Factor-out-subdev-init-and-cleanup-.patch
@@ -0,0 +1,235 @@
+From bb459b1433e79fa048f6a904e90393f9f26ea52a Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 16 Jan 2023 15:44:39 +0100
+Subject: [PATCH] media: i2c: imx290: Factor out subdev init and
+ cleanup to functions
+
+Upstream commit dfb704da8300.
+
+The probe() function is large. Make it more readable by factoring the
+subdev initialization code out. While at it, rename the error labels as
+the "free_" prefix isn't accurate.
+
+No functional change intended.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 108 +++++++++++++++++++++----------------
+ 1 file changed, 62 insertions(+), 46 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -1015,6 +1015,47 @@ static const struct media_entity_operati
+ 	.link_validate = v4l2_subdev_link_validate,
+ };
+ 
++static int imx290_subdev_init(struct imx290 *imx290)
++{
++	struct i2c_client *client = to_i2c_client(imx290->dev);
++	int ret;
++
++	/*
++	 * Initialize the frame format. In particular, imx290->current_mode
++	 * and imx290->bpp are set to defaults: imx290_calc_pixel_rate() call
++	 * below relies on these fields.
++	 */
++	imx290_entity_init_cfg(&imx290->sd, NULL);
++
++	ret = imx290_ctrl_init(imx290);
++	if (ret < 0) {
++		dev_err(imx290->dev, "Control initialization error %d\n", ret);
++		return ret;
++	}
++
++	v4l2_i2c_subdev_init(&imx290->sd, client, &imx290_subdev_ops);
++	imx290->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
++	imx290->sd.dev = imx290->dev;
++	imx290->sd.entity.ops = &imx290_subdev_entity_ops;
++	imx290->sd.entity.function = MEDIA_ENT_F_CAM_SENSOR;
++
++	imx290->pad.flags = MEDIA_PAD_FL_SOURCE;
++	ret = media_entity_pads_init(&imx290->sd.entity, 1, &imx290->pad);
++	if (ret < 0) {
++		dev_err(imx290->dev, "Could not register media entity\n");
++		v4l2_ctrl_handler_free(&imx290->ctrls);
++		return ret;
++	}
++
++	return 0;
++}
++
++static void imx290_subdev_cleanup(struct imx290 *imx290)
++{
++	media_entity_cleanup(&imx290->sd.entity);
++	v4l2_ctrl_handler_free(&imx290->ctrls);
++}
++
+ /* ----------------------------------------------------------------------------
+  * Power management
+  */
+@@ -1147,10 +1188,10 @@ static int imx290_probe(struct i2c_clien
+ 	fwnode_handle_put(endpoint);
+ 	if (ret == -ENXIO) {
+ 		dev_err(dev, "Unsupported bus type, should be CSI2\n");
+-		goto free_err;
++		goto err_endpoint;
+ 	} else if (ret) {
+ 		dev_err(dev, "Parsing endpoint node failed\n");
+-		goto free_err;
++		goto err_endpoint;
+ 	}
+ 
+ 	/* Get number of data lanes */
+@@ -1158,7 +1199,7 @@ static int imx290_probe(struct i2c_clien
+ 	if (imx290->nlanes != 2 && imx290->nlanes != 4) {
+ 		dev_err(dev, "Invalid data lanes: %d\n", imx290->nlanes);
+ 		ret = -EINVAL;
+-		goto free_err;
++		goto err_endpoint;
+ 	}
+ 
+ 	dev_dbg(dev, "Using %u data lanes\n", imx290->nlanes);
+@@ -1166,7 +1207,7 @@ static int imx290_probe(struct i2c_clien
+ 	if (!ep.nr_of_link_frequencies) {
+ 		dev_err(dev, "link-frequency property not found in DT\n");
+ 		ret = -EINVAL;
+-		goto free_err;
++		goto err_endpoint;
+ 	}
+ 
+ 	/* Check that link frequences for all the modes are in device tree */
+@@ -1174,7 +1215,7 @@ static int imx290_probe(struct i2c_clien
+ 	if (fq) {
+ 		dev_err(dev, "Link frequency of %lld is not supported\n", fq);
+ 		ret = -EINVAL;
+-		goto free_err;
++		goto err_endpoint;
+ 	}
+ 
+ 	/* get system clock (xclk) */
+@@ -1182,14 +1223,14 @@ static int imx290_probe(struct i2c_clien
+ 	if (IS_ERR(imx290->xclk)) {
+ 		dev_err(dev, "Could not get xclk");
+ 		ret = PTR_ERR(imx290->xclk);
+-		goto free_err;
++		goto err_endpoint;
+ 	}
+ 
+ 	ret = fwnode_property_read_u32(dev_fwnode(dev), "clock-frequency",
+ 				       &xclk_freq);
+ 	if (ret) {
+ 		dev_err(dev, "Could not get xclk frequency\n");
+-		goto free_err;
++		goto err_endpoint;
+ 	}
+ 
+ 	/* external clock must be 37.125 MHz */
+@@ -1197,19 +1238,19 @@ static int imx290_probe(struct i2c_clien
+ 		dev_err(dev, "External clock frequency %u is not supported\n",
+ 			xclk_freq);
+ 		ret = -EINVAL;
+-		goto free_err;
++		goto err_endpoint;
+ 	}
+ 
+ 	ret = clk_set_rate(imx290->xclk, xclk_freq);
+ 	if (ret) {
+ 		dev_err(dev, "Could not set xclk frequency\n");
+-		goto free_err;
++		goto err_endpoint;
+ 	}
+ 
+ 	ret = imx290_get_regulators(dev, imx290);
+ 	if (ret < 0) {
+ 		dev_err(dev, "Cannot get regulators\n");
+-		goto free_err;
++		goto err_endpoint;
+ 	}
+ 
+ 	imx290->rst_gpio = devm_gpiod_get_optional(dev, "reset",
+@@ -1217,48 +1258,26 @@ static int imx290_probe(struct i2c_clien
+ 	if (IS_ERR(imx290->rst_gpio)) {
+ 		dev_err(dev, "Cannot get reset gpio\n");
+ 		ret = PTR_ERR(imx290->rst_gpio);
+-		goto free_err;
++		goto err_endpoint;
+ 	}
+ 
+ 	mutex_init(&imx290->lock);
+ 
+-	/*
+-	 * Initialize the frame format. In particular, imx290->current_mode
+-	 * and imx290->bpp are set to defaults: imx290_calc_pixel_rate() call
+-	 * below relies on these fields.
+-	 */
+-	imx290_entity_init_cfg(&imx290->sd, NULL);
+-
+-	ret = imx290_ctrl_init(imx290);
+-	if (ret < 0) {
+-		dev_err(dev, "Control initialization error %d\n", ret);
+-		goto free_mutex;
+-	}
+-
+-	v4l2_i2c_subdev_init(&imx290->sd, client, &imx290_subdev_ops);
+-	imx290->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
+-	imx290->sd.dev = &client->dev;
+-	imx290->sd.entity.ops = &imx290_subdev_entity_ops;
+-	imx290->sd.entity.function = MEDIA_ENT_F_CAM_SENSOR;
+-
+-	imx290->pad.flags = MEDIA_PAD_FL_SOURCE;
+-	ret = media_entity_pads_init(&imx290->sd.entity, 1, &imx290->pad);
+-	if (ret < 0) {
+-		dev_err(dev, "Could not register media entity\n");
+-		goto free_ctrl;
+-	}
++	ret = imx290_subdev_init(imx290);
++	if (ret)
++		goto err_mutex;
+ 
+ 	ret = v4l2_async_register_subdev(&imx290->sd);
+ 	if (ret < 0) {
+ 		dev_err(dev, "Could not register v4l2 device\n");
+-		goto free_entity;
++		goto err_subdev;
+ 	}
+ 
+ 	/* Power on the device to match runtime PM state below */
+ 	ret = imx290_power_on(dev);
+ 	if (ret < 0) {
+ 		dev_err(dev, "Could not power on the device\n");
+-		goto free_entity;
++		goto err_subdev;
+ 	}
+ 
+ 	pm_runtime_set_active(dev);
+@@ -1269,13 +1288,11 @@ static int imx290_probe(struct i2c_clien
+ 
+ 	return 0;
+ 
+-free_entity:
+-	media_entity_cleanup(&imx290->sd.entity);
+-free_ctrl:
+-	v4l2_ctrl_handler_free(&imx290->ctrls);
+-free_mutex:
++err_subdev:
++	imx290_subdev_cleanup(imx290);
++err_mutex:
+ 	mutex_destroy(&imx290->lock);
+-free_err:
++err_endpoint:
+ 	v4l2_fwnode_endpoint_free(&ep);
+ 
+ 	return ret;
+@@ -1287,8 +1304,7 @@ static void imx290_remove(struct i2c_cli
+ 	struct imx290 *imx290 = to_imx290(sd);
+ 
+ 	v4l2_async_unregister_subdev(sd);
+-	media_entity_cleanup(&sd->entity);
+-	v4l2_ctrl_handler_free(sd->ctrl_handler);
++	imx290_subdev_cleanup(imx290);
+ 
+ 	mutex_destroy(&imx290->lock);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0633-media-i2c-imx290-Factor-out-control-update-code-to-a.patch b/target/linux/bcm27xx/patches-6.1/950-0633-media-i2c-imx290-Factor-out-control-update-code-to-a.patch
new file mode 100644
index 00000000000000..bae4bb59da374a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0633-media-i2c-imx290-Factor-out-control-update-code-to-a.patch
@@ -0,0 +1,78 @@
+From d28f7567b1043aec24558bd72dc10983db25f25c Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 16 Jan 2023 15:44:40 +0100
+Subject: [PATCH] media: i2c: imx290: Factor out control update code to
+ a function
+
+Upstream commit a7941da37c43
+
+Move the control update code to a separate function to group it with all
+the control-related code and make imx290_set_fmt() more readable.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 43 ++++++++++++++++++++------------------
+ 1 file changed, 23 insertions(+), 20 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -639,6 +639,28 @@ static const char * const imx290_test_pa
+ 	"000/555h Toggle Pattern",
+ };
+ 
++static void imx290_ctrl_update(struct imx290 *imx290,
++			       const struct imx290_mode *mode)
++{
++	unsigned int hblank = mode->hmax - mode->width;
++	unsigned int vblank = IMX290_VMAX_DEFAULT - mode->height;
++
++	/*
++	 * This function may be called from imx290_set_fmt() before controls
++	 * get created by imx290_ctrl_init(). Return immediately in that case.
++	 */
++	if (!imx290->ctrls.lock)
++		return;
++
++	__v4l2_ctrl_s_ctrl(imx290->link_freq,
++			   imx290_get_link_freq_index(imx290));
++	__v4l2_ctrl_s_ctrl_int64(imx290->pixel_rate,
++				 imx290_calc_pixel_rate(imx290));
++
++	__v4l2_ctrl_modify_range(imx290->hblank, hblank, hblank, 1, hblank);
++	__v4l2_ctrl_modify_range(imx290->vblank, vblank, vblank, 1, vblank);
++}
++
+ static int imx290_ctrl_init(struct imx290 *imx290)
+ {
+ 	struct v4l2_fwnode_device_properties props;
+@@ -904,26 +926,7 @@ static int imx290_set_fmt(struct v4l2_su
+ 		imx290->current_mode = mode;
+ 		imx290->bpp = imx290_formats[i].bpp;
+ 
+-		if (imx290->link_freq)
+-			__v4l2_ctrl_s_ctrl(imx290->link_freq,
+-					   imx290_get_link_freq_index(imx290));
+-		if (imx290->pixel_rate)
+-			__v4l2_ctrl_s_ctrl_int64(imx290->pixel_rate,
+-						 imx290_calc_pixel_rate(imx290));
+-
+-		if (imx290->hblank) {
+-			unsigned int hblank = mode->hmax - mode->width;
+-
+-			__v4l2_ctrl_modify_range(imx290->hblank, hblank, hblank,
+-						 1, hblank);
+-		}
+-
+-		if (imx290->vblank) {
+-			unsigned int vblank = IMX290_VMAX_DEFAULT - mode->height;
+-
+-			__v4l2_ctrl_modify_range(imx290->vblank, vblank, vblank,
+-						 1, vblank);
+-		}
++		imx290_ctrl_update(imx290, mode);
+ 	}
+ 
+ 	*format = fmt->format;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0634-media-i2c-imx290-Access-link_freq_index-directly.patch b/target/linux/bcm27xx/patches-6.1/950-0634-media-i2c-imx290-Access-link_freq_index-directly.patch
new file mode 100644
index 00000000000000..8d5ce22209a957
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0634-media-i2c-imx290-Access-link_freq_index-directly.patch
@@ -0,0 +1,49 @@
+From 27404eb8c29cfe1e0d40925f6d628fad8cc5a977 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 16 Jan 2023 15:44:41 +0100
+Subject: [PATCH] media: i2c: imx290: Access link_freq_index directly
+
+Upstream commit 70bbf56aa82c
+
+The imx290_get_link_freq_index() function hides the fact that it relies
+on the imx290 current_mode field, which obfuscates the code instead of
+making it more readable. Inline it in the callers, and use the mode
+pointer we already have in imx290_ctrl_update() instead of using the
+current_mode field.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -547,14 +547,9 @@ static int imx290_write_current_format(s
+ 	return 0;
+ }
+ 
+-static inline u8 imx290_get_link_freq_index(struct imx290 *imx290)
+-{
+-	return imx290->current_mode->link_freq_index;
+-}
+-
+ static s64 imx290_get_link_freq(struct imx290 *imx290)
+ {
+-	u8 index = imx290_get_link_freq_index(imx290);
++	u8 index = imx290->current_mode->link_freq_index;
+ 
+ 	return *(imx290_link_freqs_ptr(imx290) + index);
+ }
+@@ -652,8 +647,7 @@ static void imx290_ctrl_update(struct im
+ 	if (!imx290->ctrls.lock)
+ 		return;
+ 
+-	__v4l2_ctrl_s_ctrl(imx290->link_freq,
+-			   imx290_get_link_freq_index(imx290));
++	__v4l2_ctrl_s_ctrl(imx290->link_freq, mode->link_freq_index);
+ 	__v4l2_ctrl_s_ctrl_int64(imx290->pixel_rate,
+ 				 imx290_calc_pixel_rate(imx290));
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0635-media-i2c-imx290-Pass-format-and-mode-to-imx290_calc.patch b/target/linux/bcm27xx/patches-6.1/950-0635-media-i2c-imx290-Pass-format-and-mode-to-imx290_calc.patch
new file mode 100644
index 00000000000000..41fb54b5357ab8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0635-media-i2c-imx290-Pass-format-and-mode-to-imx290_calc.patch
@@ -0,0 +1,83 @@
+From 58cb4180d3da2c3c096427ff77b967f217bd2f8d Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 16 Jan 2023 15:44:42 +0100
+Subject: [PATCH] media: i2c: imx290: Pass format and mode to
+ imx290_calc_pixel_rate()
+
+Upstream commit 31b54a422b3f
+
+Avoid accessing the imx290 current_format and current_mode fields in
+imx290_calc_pixel_rate() to prepare for the removal of those fields.
+Among the two callers of the function, imx290_ctrl_update() has an
+explicit mode pointer already, and we can also give it a format pointer.
+Use those explicitly.
+
+While at it, inline the imx290_get_link_freq() function in
+imx290_calc_pixel_rate() as it is only called there.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 22 ++++++++--------------
+ 1 file changed, 8 insertions(+), 14 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -547,21 +547,14 @@ static int imx290_write_current_format(s
+ 	return 0;
+ }
+ 
+-static s64 imx290_get_link_freq(struct imx290 *imx290)
++static u64 imx290_calc_pixel_rate(struct imx290 *imx290,
++				  const struct imx290_mode *mode)
+ {
+-	u8 index = imx290->current_mode->link_freq_index;
+-
+-	return *(imx290_link_freqs_ptr(imx290) + index);
+-}
+-
+-static u64 imx290_calc_pixel_rate(struct imx290 *imx290)
+-{
+-	s64 link_freq = imx290_get_link_freq(imx290);
+-	u8 nlanes = imx290->nlanes;
++	s64 link_freq = imx290_link_freqs_ptr(imx290)[mode->link_freq_index];
+ 	u64 pixel_rate;
+ 
+ 	/* pixel rate = link_freq * 2 * nr_of_lanes / bits_per_sample */
+-	pixel_rate = link_freq * 2 * nlanes;
++	pixel_rate = link_freq * 2 * imx290->nlanes;
+ 	do_div(pixel_rate, imx290->bpp);
+ 	return pixel_rate;
+ }
+@@ -649,7 +642,7 @@ static void imx290_ctrl_update(struct im
+ 
+ 	__v4l2_ctrl_s_ctrl(imx290->link_freq, mode->link_freq_index);
+ 	__v4l2_ctrl_s_ctrl_int64(imx290->pixel_rate,
+-				 imx290_calc_pixel_rate(imx290));
++				 imx290_calc_pixel_rate(imx290, mode));
+ 
+ 	__v4l2_ctrl_modify_range(imx290->hblank, hblank, hblank, 1, hblank);
+ 	__v4l2_ctrl_modify_range(imx290->vblank, vblank, vblank, 1, vblank);
+@@ -659,6 +652,7 @@ static int imx290_ctrl_init(struct imx29
+ {
+ 	struct v4l2_fwnode_device_properties props;
+ 	unsigned int blank;
++	u64 pixel_rate;
+ 	int ret;
+ 
+ 	ret = v4l2_fwnode_device_parse(imx290->dev, &props);
+@@ -696,10 +690,10 @@ static int imx290_ctrl_init(struct imx29
+ 	if (imx290->link_freq)
+ 		imx290->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+ 
++	pixel_rate = imx290_calc_pixel_rate(imx290, imx290->current_mode);
+ 	imx290->pixel_rate = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+ 					       V4L2_CID_PIXEL_RATE,
+-					       1, INT_MAX, 1,
+-					       imx290_calc_pixel_rate(imx290));
++					       1, INT_MAX, 1, pixel_rate);
+ 
+ 	v4l2_ctrl_new_std_menu_items(&imx290->ctrls, &imx290_ctrl_ops,
+ 				     V4L2_CID_TEST_PATTERN,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0636-media-i2c-imx290-Compute-pixel-rate-and-blanking-in-.patch b/target/linux/bcm27xx/patches-6.1/950-0636-media-i2c-imx290-Compute-pixel-rate-and-blanking-in-.patch
new file mode 100644
index 00000000000000..293ff3dc96f7e0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0636-media-i2c-imx290-Compute-pixel-rate-and-blanking-in-.patch
@@ -0,0 +1,131 @@
+From 317b043056ef595bf7d4af2c807946afb405c117 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 16 Jan 2023 15:44:43 +0100
+Subject: [PATCH] media: i2c: imx290: Compute pixel rate and blanking
+ in one place
+
+Upstream commit 693b5cb598cc
+
+The hblank, vblank, pixel rate and link frequency values and limits are
+currently computed when creating controls, in imx290_ctrl_init(), and
+updated in imx290_ctrl_update(). This duplicates the logic in different
+places. Simplify the code by setting the control values and limits to
+hardcoded values when creating the controls, and call
+imx290_ctrl_update() to then update them.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Acked-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 43 +++++++++++++++++---------------------
+ 1 file changed, 19 insertions(+), 24 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -547,18 +547,6 @@ static int imx290_write_current_format(s
+ 	return 0;
+ }
+ 
+-static u64 imx290_calc_pixel_rate(struct imx290 *imx290,
+-				  const struct imx290_mode *mode)
+-{
+-	s64 link_freq = imx290_link_freqs_ptr(imx290)[mode->link_freq_index];
+-	u64 pixel_rate;
+-
+-	/* pixel rate = link_freq * 2 * nr_of_lanes / bits_per_sample */
+-	pixel_rate = link_freq * 2 * imx290->nlanes;
+-	do_div(pixel_rate, imx290->bpp);
+-	return pixel_rate;
+-}
+-
+ /* ----------------------------------------------------------------------------
+  * Controls
+  */
+@@ -632,6 +620,8 @@ static void imx290_ctrl_update(struct im
+ {
+ 	unsigned int hblank = mode->hmax - mode->width;
+ 	unsigned int vblank = IMX290_VMAX_DEFAULT - mode->height;
++	s64 link_freq = imx290_link_freqs_ptr(imx290)[mode->link_freq_index];
++	u64 pixel_rate;
+ 
+ 	/*
+ 	 * This function may be called from imx290_set_fmt() before controls
+@@ -640,9 +630,12 @@ static void imx290_ctrl_update(struct im
+ 	if (!imx290->ctrls.lock)
+ 		return;
+ 
++	/* pixel rate = link_freq * 2 * nr_of_lanes / bits_per_sample */
++	pixel_rate = link_freq * 2 * imx290->nlanes;
++	do_div(pixel_rate, imx290->bpp);
++
+ 	__v4l2_ctrl_s_ctrl(imx290->link_freq, mode->link_freq_index);
+-	__v4l2_ctrl_s_ctrl_int64(imx290->pixel_rate,
+-				 imx290_calc_pixel_rate(imx290, mode));
++	__v4l2_ctrl_s_ctrl_int64(imx290->pixel_rate, pixel_rate);
+ 
+ 	__v4l2_ctrl_modify_range(imx290->hblank, hblank, hblank, 1, hblank);
+ 	__v4l2_ctrl_modify_range(imx290->vblank, vblank, vblank, 1, vblank);
+@@ -651,8 +644,6 @@ static void imx290_ctrl_update(struct im
+ static int imx290_ctrl_init(struct imx290 *imx290)
+ {
+ 	struct v4l2_fwnode_device_properties props;
+-	unsigned int blank;
+-	u64 pixel_rate;
+ 	int ret;
+ 
+ 	ret = v4l2_fwnode_device_parse(imx290->dev, &props);
+@@ -682,6 +673,11 @@ static int imx290_ctrl_init(struct imx29
+ 			  V4L2_CID_EXPOSURE, 1, IMX290_VMAX_DEFAULT - 2, 1,
+ 			  IMX290_VMAX_DEFAULT - 2);
+ 
++	/*
++	 * Set the link frequency, pixel rate, horizontal blanking and vertical
++	 * blanking to hardcoded values, they will be updated by
++	 * imx290_ctrl_update().
++	 */
+ 	imx290->link_freq =
+ 		v4l2_ctrl_new_int_menu(&imx290->ctrls, &imx290_ctrl_ops,
+ 				       V4L2_CID_LINK_FREQ,
+@@ -690,27 +686,22 @@ static int imx290_ctrl_init(struct imx29
+ 	if (imx290->link_freq)
+ 		imx290->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+ 
+-	pixel_rate = imx290_calc_pixel_rate(imx290, imx290->current_mode);
+ 	imx290->pixel_rate = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+ 					       V4L2_CID_PIXEL_RATE,
+-					       1, INT_MAX, 1, pixel_rate);
++					       1, INT_MAX, 1, 1);
+ 
+ 	v4l2_ctrl_new_std_menu_items(&imx290->ctrls, &imx290_ctrl_ops,
+ 				     V4L2_CID_TEST_PATTERN,
+ 				     ARRAY_SIZE(imx290_test_pattern_menu) - 1,
+ 				     0, 0, imx290_test_pattern_menu);
+ 
+-	blank = imx290->current_mode->hmax - imx290->current_mode->width;
+ 	imx290->hblank = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-					   V4L2_CID_HBLANK, blank, blank, 1,
+-					   blank);
++					   V4L2_CID_HBLANK, 1, 1, 1, 1);
+ 	if (imx290->hblank)
+ 		imx290->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+ 
+-	blank = IMX290_VMAX_DEFAULT - imx290->current_mode->height;
+ 	imx290->vblank = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-					   V4L2_CID_VBLANK, blank, blank, 1,
+-					   blank);
++					   V4L2_CID_VBLANK, 1, 1, 1, 1);
+ 	if (imx290->vblank)
+ 		imx290->vblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+ 
+@@ -725,6 +716,10 @@ static int imx290_ctrl_init(struct imx29
+ 		return ret;
+ 	}
+ 
++	mutex_lock(imx290->ctrls.lock);
++	imx290_ctrl_update(imx290, imx290->current_mode);
++	mutex_unlock(imx290->ctrls.lock);
++
+ 	return 0;
+ }
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0637-media-i2c-imx290-Factor-out-black-level-setting-to-a.patch b/target/linux/bcm27xx/patches-6.1/950-0637-media-i2c-imx290-Factor-out-black-level-setting-to-a.patch
new file mode 100644
index 00000000000000..dda5eba989e648
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0637-media-i2c-imx290-Factor-out-black-level-setting-to-a.patch
@@ -0,0 +1,131 @@
+From d0f282c0afb570a286d6b8438ec0041ca2d2d6db Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 16 Jan 2023 15:44:44 +0100
+Subject: [PATCH] media: i2c: imx290: Factor out black level setting to
+ a function
+
+Upstream commit ee4ce8936693
+
+The black level programmed in the BLKLEVEL register depends on the
+output format. The black level value computation is currently performed
+in imx290_set_ctrl(), in addition to having different black level values
+in the output-specific register value tables. Move it to a separate
+function to simplify the imx290_set_ctrl() code.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 50 ++++++++++++++++++++------------------
+ 1 file changed, 26 insertions(+), 24 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -152,6 +152,9 @@
+ #define IMX290_PIXEL_ARRAY_RECORDING_WIDTH		1920
+ #define IMX290_PIXEL_ARRAY_RECORDING_HEIGHT		1080
+ 
++/* Equivalent value for 16bpp */
++#define IMX290_BLACK_LEVEL_DEFAULT			3840
++
+ #define IMX290_NUM_SUPPLIES				3
+ 
+ struct imx290_regval {
+@@ -315,7 +318,6 @@ static const struct imx290_regval imx290
+ 	{ IMX290_ADBIT2, IMX290_ADBIT2_10BIT },
+ 	{ IMX290_ADBIT3, IMX290_ADBIT3_10BIT },
+ 	{ IMX290_CSI_DT_FMT, IMX290_CSI_DT_FMT_RAW10 },
+-	{ IMX290_BLKLEVEL, 60 },
+ };
+ 
+ static const struct imx290_regval imx290_12bit_settings[] = {
+@@ -325,7 +327,6 @@ static const struct imx290_regval imx290
+ 	{ IMX290_ADBIT2, IMX290_ADBIT2_12BIT },
+ 	{ IMX290_ADBIT3, IMX290_ADBIT3_12BIT },
+ 	{ IMX290_CSI_DT_FMT, IMX290_CSI_DT_FMT_RAW12 },
+-	{ IMX290_BLKLEVEL, 240 },
+ };
+ 
+ /* supported link frequencies */
+@@ -516,35 +517,40 @@ static int imx290_set_data_lanes(struct
+ 	return ret;
+ }
+ 
++static int imx290_set_black_level(struct imx290 *imx290,
++				  unsigned int black_level, int *err)
++{
++	return imx290_write(imx290, IMX290_BLKLEVEL,
++			    black_level >> (16 - imx290->bpp), err);
++}
++
+ static int imx290_write_current_format(struct imx290 *imx290)
+ {
++	const struct imx290_regval *regs;
++	unsigned int num_regs;
+ 	int ret;
+ 
+ 	switch (imx290->current_format.code) {
+ 	case MEDIA_BUS_FMT_SRGGB10_1X10:
+-		ret = imx290_set_register_array(imx290, imx290_10bit_settings,
+-						ARRAY_SIZE(
+-							imx290_10bit_settings));
+-		if (ret < 0) {
+-			dev_err(imx290->dev, "Could not set format registers\n");
+-			return ret;
+-		}
++		regs = imx290_10bit_settings;
++		num_regs = ARRAY_SIZE(imx290_10bit_settings);
+ 		break;
+ 	case MEDIA_BUS_FMT_SRGGB12_1X12:
+-		ret = imx290_set_register_array(imx290, imx290_12bit_settings,
+-						ARRAY_SIZE(
+-							imx290_12bit_settings));
+-		if (ret < 0) {
+-			dev_err(imx290->dev, "Could not set format registers\n");
+-			return ret;
+-		}
++		regs = imx290_12bit_settings;
++		num_regs = ARRAY_SIZE(imx290_12bit_settings);
+ 		break;
+ 	default:
+ 		dev_err(imx290->dev, "Unknown pixel format\n");
+ 		return -EINVAL;
+ 	}
+ 
+-	return 0;
++	ret = imx290_set_register_array(imx290, regs, num_regs);
++	if (ret < 0) {
++		dev_err(imx290->dev, "Could not set format registers\n");
++		return ret;
++	}
++
++	return imx290_set_black_level(imx290, IMX290_BLACK_LEVEL_DEFAULT, &ret);
+ }
+ 
+ /* ----------------------------------------------------------------------------
+@@ -573,7 +579,7 @@ static int imx290_set_ctrl(struct v4l2_c
+ 
+ 	case V4L2_CID_TEST_PATTERN:
+ 		if (ctrl->val) {
+-			imx290_write(imx290, IMX290_BLKLEVEL, 0, &ret);
++			imx290_set_black_level(imx290, 0, &ret);
+ 			usleep_range(10000, 11000);
+ 			imx290_write(imx290, IMX290_PGCTRL,
+ 				     (u8)(IMX290_PGCTRL_REGEN |
+@@ -582,12 +588,8 @@ static int imx290_set_ctrl(struct v4l2_c
+ 		} else {
+ 			imx290_write(imx290, IMX290_PGCTRL, 0x00, &ret);
+ 			usleep_range(10000, 11000);
+-			if (imx290->bpp == 10)
+-				imx290_write(imx290, IMX290_BLKLEVEL, 0x3c,
+-					     &ret);
+-			else /* 12 bits per pixel */
+-				imx290_write(imx290, IMX290_BLKLEVEL, 0xf0,
+-					     &ret);
++			imx290_set_black_level(imx290, IMX290_BLACK_LEVEL_DEFAULT,
++					       &ret);
+ 		}
+ 		break;
+ 	default:
diff --git a/target/linux/bcm27xx/patches-6.1/950-0638-media-i2c-imx290-Factor-out-DT-parsing-to-separate-f.patch b/target/linux/bcm27xx/patches-6.1/950-0638-media-i2c-imx290-Factor-out-DT-parsing-to-separate-f.patch
new file mode 100644
index 00000000000000..79df9996af4043
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0638-media-i2c-imx290-Factor-out-DT-parsing-to-separate-f.patch
@@ -0,0 +1,202 @@
+From 4afc11ae3b786ad8425435b70ab0285fbf951b05 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 16 Jan 2023 15:44:45 +0100
+Subject: [PATCH] media: i2c: imx290: Factor out DT parsing to separate
+ function
+
+Upstream commit 6b69c52277ed
+
+Make the probe() function more readable by factoring out the DT parsing
+code to a separate function. No functional change intended.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 95 +++++++++++++++++++++-----------------
+ 1 file changed, 52 insertions(+), 43 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -1142,111 +1142,124 @@ static s64 imx290_check_link_freqs(const
+ 	return 0;
+ }
+ 
+-static int imx290_probe(struct i2c_client *client)
++static int imx290_parse_dt(struct imx290 *imx290)
+ {
+-	struct device *dev = &client->dev;
+-	struct fwnode_handle *endpoint;
+ 	/* Only CSI2 is supported for now: */
+ 	struct v4l2_fwnode_endpoint ep = {
+ 		.bus_type = V4L2_MBUS_CSI2_DPHY
+ 	};
+-	struct imx290 *imx290;
+-	u32 xclk_freq;
+-	s64 fq;
++	struct fwnode_handle *endpoint;
+ 	int ret;
++	s64 fq;
+ 
+-	imx290 = devm_kzalloc(dev, sizeof(*imx290), GFP_KERNEL);
+-	if (!imx290)
+-		return -ENOMEM;
+-
+-	imx290->dev = dev;
+-	imx290->regmap = devm_regmap_init_i2c(client, &imx290_regmap_config);
+-	if (IS_ERR(imx290->regmap)) {
+-		dev_err(dev, "Unable to initialize I2C\n");
+-		return -ENODEV;
+-	}
+-
+-	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
++	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(imx290->dev), NULL);
+ 	if (!endpoint) {
+-		dev_err(dev, "Endpoint node not found\n");
++		dev_err(imx290->dev, "Endpoint node not found\n");
+ 		return -EINVAL;
+ 	}
+ 
+ 	ret = v4l2_fwnode_endpoint_alloc_parse(endpoint, &ep);
+ 	fwnode_handle_put(endpoint);
+ 	if (ret == -ENXIO) {
+-		dev_err(dev, "Unsupported bus type, should be CSI2\n");
+-		goto err_endpoint;
++		dev_err(imx290->dev, "Unsupported bus type, should be CSI2\n");
++		goto done;
+ 	} else if (ret) {
+-		dev_err(dev, "Parsing endpoint node failed\n");
+-		goto err_endpoint;
++		dev_err(imx290->dev, "Parsing endpoint node failed\n");
++		goto done;
+ 	}
+ 
+ 	/* Get number of data lanes */
+ 	imx290->nlanes = ep.bus.mipi_csi2.num_data_lanes;
+ 	if (imx290->nlanes != 2 && imx290->nlanes != 4) {
+-		dev_err(dev, "Invalid data lanes: %d\n", imx290->nlanes);
++		dev_err(imx290->dev, "Invalid data lanes: %d\n", imx290->nlanes);
+ 		ret = -EINVAL;
+-		goto err_endpoint;
++		goto done;
+ 	}
+ 
+-	dev_dbg(dev, "Using %u data lanes\n", imx290->nlanes);
++	dev_dbg(imx290->dev, "Using %u data lanes\n", imx290->nlanes);
+ 
+ 	if (!ep.nr_of_link_frequencies) {
+-		dev_err(dev, "link-frequency property not found in DT\n");
++		dev_err(imx290->dev, "link-frequency property not found in DT\n");
+ 		ret = -EINVAL;
+-		goto err_endpoint;
++		goto done;
+ 	}
+ 
+ 	/* Check that link frequences for all the modes are in device tree */
+ 	fq = imx290_check_link_freqs(imx290, &ep);
+ 	if (fq) {
+-		dev_err(dev, "Link frequency of %lld is not supported\n", fq);
++		dev_err(imx290->dev, "Link frequency of %lld is not supported\n",
++			fq);
+ 		ret = -EINVAL;
+-		goto err_endpoint;
++		goto done;
+ 	}
+ 
++	ret = 0;
++
++done:
++	v4l2_fwnode_endpoint_free(&ep);
++	return ret;
++}
++
++static int imx290_probe(struct i2c_client *client)
++{
++	struct device *dev = &client->dev;
++	struct imx290 *imx290;
++	u32 xclk_freq;
++	int ret;
++
++	imx290 = devm_kzalloc(dev, sizeof(*imx290), GFP_KERNEL);
++	if (!imx290)
++		return -ENOMEM;
++
++	imx290->dev = dev;
++	imx290->regmap = devm_regmap_init_i2c(client, &imx290_regmap_config);
++	if (IS_ERR(imx290->regmap)) {
++		dev_err(dev, "Unable to initialize I2C\n");
++		return -ENODEV;
++	}
++
++	ret = imx290_parse_dt(imx290);
++	if (ret)
++		return ret;
++
+ 	/* get system clock (xclk) */
+ 	imx290->xclk = devm_clk_get(dev, "xclk");
+ 	if (IS_ERR(imx290->xclk)) {
+ 		dev_err(dev, "Could not get xclk");
+-		ret = PTR_ERR(imx290->xclk);
+-		goto err_endpoint;
++		return PTR_ERR(imx290->xclk);
+ 	}
+ 
+ 	ret = fwnode_property_read_u32(dev_fwnode(dev), "clock-frequency",
+ 				       &xclk_freq);
+ 	if (ret) {
+ 		dev_err(dev, "Could not get xclk frequency\n");
+-		goto err_endpoint;
++		return ret;
+ 	}
+ 
+ 	/* external clock must be 37.125 MHz */
+ 	if (xclk_freq != 37125000) {
+ 		dev_err(dev, "External clock frequency %u is not supported\n",
+ 			xclk_freq);
+-		ret = -EINVAL;
+-		goto err_endpoint;
++		return -EINVAL;
+ 	}
+ 
+ 	ret = clk_set_rate(imx290->xclk, xclk_freq);
+ 	if (ret) {
+ 		dev_err(dev, "Could not set xclk frequency\n");
+-		goto err_endpoint;
++		return ret;
+ 	}
+ 
+ 	ret = imx290_get_regulators(dev, imx290);
+ 	if (ret < 0) {
+ 		dev_err(dev, "Cannot get regulators\n");
+-		goto err_endpoint;
++		return ret;
+ 	}
+ 
+ 	imx290->rst_gpio = devm_gpiod_get_optional(dev, "reset",
+ 						   GPIOD_OUT_HIGH);
+ 	if (IS_ERR(imx290->rst_gpio)) {
+ 		dev_err(dev, "Cannot get reset gpio\n");
+-		ret = PTR_ERR(imx290->rst_gpio);
+-		goto err_endpoint;
++		return PTR_ERR(imx290->rst_gpio);
+ 	}
+ 
+ 	mutex_init(&imx290->lock);
+@@ -1272,16 +1285,12 @@ static int imx290_probe(struct i2c_clien
+ 	pm_runtime_enable(dev);
+ 	pm_runtime_idle(dev);
+ 
+-	v4l2_fwnode_endpoint_free(&ep);
+-
+ 	return 0;
+ 
+ err_subdev:
+ 	imx290_subdev_cleanup(imx290);
+ err_mutex:
+ 	mutex_destroy(&imx290->lock);
+-err_endpoint:
+-	v4l2_fwnode_endpoint_free(&ep);
+ 
+ 	return ret;
+ }
diff --git a/target/linux/bcm27xx/patches-6.1/950-0639-media-i2c-imx290-Use-dev_err_probe.patch b/target/linux/bcm27xx/patches-6.1/950-0639-media-i2c-imx290-Use-dev_err_probe.patch
new file mode 100644
index 00000000000000..044922b00a8cbb
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0639-media-i2c-imx290-Use-dev_err_probe.patch
@@ -0,0 +1,56 @@
+From 5589814e868f5becefdb44d28c07cb39cbb7e9bd Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 16 Jan 2023 15:44:46 +0100
+Subject: [PATCH] media: i2c: imx290: Use dev_err_probe()
+
+Upstream commit 63127235bebd
+
+Improve error handling in the probe() function with dev_err_probe().
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 20 ++++++++------------
+ 1 file changed, 8 insertions(+), 12 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -1224,10 +1224,9 @@ static int imx290_probe(struct i2c_clien
+ 
+ 	/* get system clock (xclk) */
+ 	imx290->xclk = devm_clk_get(dev, "xclk");
+-	if (IS_ERR(imx290->xclk)) {
+-		dev_err(dev, "Could not get xclk");
+-		return PTR_ERR(imx290->xclk);
+-	}
++	if (IS_ERR(imx290->xclk))
++		return dev_err_probe(dev, PTR_ERR(imx290->xclk),
++				     "Could not get xclk");
+ 
+ 	ret = fwnode_property_read_u32(dev_fwnode(dev), "clock-frequency",
+ 				       &xclk_freq);
+@@ -1250,17 +1249,14 @@ static int imx290_probe(struct i2c_clien
+ 	}
+ 
+ 	ret = imx290_get_regulators(dev, imx290);
+-	if (ret < 0) {
+-		dev_err(dev, "Cannot get regulators\n");
+-		return ret;
+-	}
++	if (ret < 0)
++		return dev_err_probe(dev, ret, "Cannot get regulators\n");
+ 
+ 	imx290->rst_gpio = devm_gpiod_get_optional(dev, "reset",
+ 						   GPIOD_OUT_HIGH);
+-	if (IS_ERR(imx290->rst_gpio)) {
+-		dev_err(dev, "Cannot get reset gpio\n");
+-		return PTR_ERR(imx290->rst_gpio);
+-	}
++	if (IS_ERR(imx290->rst_gpio))
++		return dev_err_probe(dev, PTR_ERR(imx290->rst_gpio),
++				     "Cannot get reset gpio\n");
+ 
+ 	mutex_init(&imx290->lock);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0640-media-i2c-imx290-Factor-out-clock-initialization-to-.patch b/target/linux/bcm27xx/patches-6.1/950-0640-media-i2c-imx290-Factor-out-clock-initialization-to-.patch
new file mode 100644
index 00000000000000..b23d667d659764
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0640-media-i2c-imx290-Factor-out-clock-initialization-to-.patch
@@ -0,0 +1,113 @@
+From 88c013f4c7e60431bca7bc6487971f671397e0fd Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 16 Jan 2023 15:44:47 +0100
+Subject: [PATCH] media: i2c: imx290: Factor out clock initialization
+ to separate function
+
+Upstream commit e5d363ca82b9
+
+Move the external clock initialization code from probe() to a separate
+function to improve readability. No functional change intended.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 57 +++++++++++++++++++++++---------------
+ 1 file changed, 35 insertions(+), 22 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -1120,6 +1120,34 @@ static int imx290_get_regulators(struct
+ 				       imx290->supplies);
+ }
+ 
++static int imx290_init_clk(struct imx290 *imx290)
++{
++	u32 xclk_freq;
++	int ret;
++
++	ret = fwnode_property_read_u32(dev_fwnode(imx290->dev),
++				       "clock-frequency", &xclk_freq);
++	if (ret) {
++		dev_err(imx290->dev, "Could not get xclk frequency\n");
++		return ret;
++	}
++
++	/* external clock must be 37.125 MHz */
++	if (xclk_freq != 37125000) {
++		dev_err(imx290->dev, "External clock frequency %u is not supported\n",
++			xclk_freq);
++		return -EINVAL;
++	}
++
++	ret = clk_set_rate(imx290->xclk, xclk_freq);
++	if (ret) {
++		dev_err(imx290->dev, "Could not set xclk frequency\n");
++		return ret;
++	}
++
++	return 0;
++}
++
+ /*
+  * Returns 0 if all link frequencies used by the driver for the given number
+  * of MIPI data lanes are mentioned in the device tree, or the value of the
+@@ -1204,7 +1232,6 @@ static int imx290_probe(struct i2c_clien
+ {
+ 	struct device *dev = &client->dev;
+ 	struct imx290 *imx290;
+-	u32 xclk_freq;
+ 	int ret;
+ 
+ 	imx290 = devm_kzalloc(dev, sizeof(*imx290), GFP_KERNEL);
+@@ -1222,32 +1249,12 @@ static int imx290_probe(struct i2c_clien
+ 	if (ret)
+ 		return ret;
+ 
+-	/* get system clock (xclk) */
++	/* Acquire resources. */
+ 	imx290->xclk = devm_clk_get(dev, "xclk");
+ 	if (IS_ERR(imx290->xclk))
+ 		return dev_err_probe(dev, PTR_ERR(imx290->xclk),
+ 				     "Could not get xclk");
+ 
+-	ret = fwnode_property_read_u32(dev_fwnode(dev), "clock-frequency",
+-				       &xclk_freq);
+-	if (ret) {
+-		dev_err(dev, "Could not get xclk frequency\n");
+-		return ret;
+-	}
+-
+-	/* external clock must be 37.125 MHz */
+-	if (xclk_freq != 37125000) {
+-		dev_err(dev, "External clock frequency %u is not supported\n",
+-			xclk_freq);
+-		return -EINVAL;
+-	}
+-
+-	ret = clk_set_rate(imx290->xclk, xclk_freq);
+-	if (ret) {
+-		dev_err(dev, "Could not set xclk frequency\n");
+-		return ret;
+-	}
+-
+ 	ret = imx290_get_regulators(dev, imx290);
+ 	if (ret < 0)
+ 		return dev_err_probe(dev, ret, "Cannot get regulators\n");
+@@ -1258,8 +1265,14 @@ static int imx290_probe(struct i2c_clien
+ 		return dev_err_probe(dev, PTR_ERR(imx290->rst_gpio),
+ 				     "Cannot get reset gpio\n");
+ 
++	/* Initialize external clock frequency. */
++	ret = imx290_init_clk(imx290);
++	if (ret)
++		return ret;
++
+ 	mutex_init(&imx290->lock);
+ 
++	/* Initialize and register subdev. */
+ 	ret = imx290_subdev_init(imx290);
+ 	if (ret)
+ 		goto err_mutex;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0641-media-i2c-imx290-Use-V4L2-subdev-active-state.patch b/target/linux/bcm27xx/patches-6.1/950-0641-media-i2c-imx290-Use-V4L2-subdev-active-state.patch
new file mode 100644
index 00000000000000..64db65641eae7a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0641-media-i2c-imx290-Use-V4L2-subdev-active-state.patch
@@ -0,0 +1,398 @@
+From 94caa6139edcfebd8934f362f562eac56b85b610 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 17 Oct 2022 12:44:27 +0200
+Subject: [PATCH] media: i2c: imx290: Use V4L2 subdev active state
+
+Upstream commit a2514b9a634a
+
+Use the V4L2 subdev active state API to store the active format. This
+simplifies the driver not only by dropping the imx290 current_format
+field, but it also allows dropping the imx290 lock, replaced with the
+state lock.
+
+The lock check in imx290_ctrl_update() can be dropped as
+imx290_set_fmt() can't be called anywmore with which set to ACTIVE
+before controls are initialized.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 154 ++++++++++++++++---------------------
+ 1 file changed, 65 insertions(+), 89 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -177,12 +177,12 @@ struct imx290 {
+ 	struct clk *xclk;
+ 	struct regmap *regmap;
+ 	u8 nlanes;
+-	u8 bpp;
+ 
+ 	struct v4l2_subdev sd;
+ 	struct media_pad pad;
+-	struct v4l2_mbus_framefmt current_format;
++
+ 	const struct imx290_mode *current_mode;
++	u8 bpp;
+ 
+ 	struct regulator_bulk_data supplies[IMX290_NUM_SUPPLIES];
+ 	struct gpio_desc *rst_gpio;
+@@ -192,8 +192,6 @@ struct imx290 {
+ 	struct v4l2_ctrl *pixel_rate;
+ 	struct v4l2_ctrl *hblank;
+ 	struct v4l2_ctrl *vblank;
+-
+-	struct mutex lock;
+ };
+ 
+ static inline struct imx290 *to_imx290(struct v4l2_subdev *_sd)
+@@ -524,13 +522,14 @@ static int imx290_set_black_level(struct
+ 			    black_level >> (16 - imx290->bpp), err);
+ }
+ 
+-static int imx290_write_current_format(struct imx290 *imx290)
++static int imx290_setup_format(struct imx290 *imx290,
++			       const struct v4l2_mbus_framefmt *format)
+ {
+ 	const struct imx290_regval *regs;
+ 	unsigned int num_regs;
+ 	int ret;
+ 
+-	switch (imx290->current_format.code) {
++	switch (format->code) {
+ 	case MEDIA_BUS_FMT_SRGGB10_1X10:
+ 		regs = imx290_10bit_settings;
+ 		num_regs = ARRAY_SIZE(imx290_10bit_settings);
+@@ -563,6 +562,15 @@ static int imx290_set_ctrl(struct v4l2_c
+ 					     struct imx290, ctrls);
+ 	int ret = 0;
+ 
++	/*
++	 * Return immediately for controls that don't need to be applied to the
++	 * device. Those controls are modified in imx290_ctrl_update(), which
++	 * is called at probe time before runtime PM is initialized, so we
++	 * can't proceed to the pm_runtime_get_if_in_use() call below.
++	 */
++	if (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY)
++		return 0;
++
+ 	/* V4L2 controls values will be applied only when power is already up */
+ 	if (!pm_runtime_get_if_in_use(imx290->dev))
+ 		return 0;
+@@ -592,6 +600,7 @@ static int imx290_set_ctrl(struct v4l2_c
+ 					       &ret);
+ 		}
+ 		break;
++
+ 	default:
+ 		ret = -EINVAL;
+ 		break;
+@@ -625,13 +634,6 @@ static void imx290_ctrl_update(struct im
+ 	s64 link_freq = imx290_link_freqs_ptr(imx290)[mode->link_freq_index];
+ 	u64 pixel_rate;
+ 
+-	/*
+-	 * This function may be called from imx290_set_fmt() before controls
+-	 * get created by imx290_ctrl_init(). Return immediately in that case.
+-	 */
+-	if (!imx290->ctrls.lock)
+-		return;
+-
+ 	/* pixel rate = link_freq * 2 * nr_of_lanes / bits_per_sample */
+ 	pixel_rate = link_freq * 2 * imx290->nlanes;
+ 	do_div(pixel_rate, imx290->bpp);
+@@ -653,7 +655,6 @@ static int imx290_ctrl_init(struct imx29
+ 		return ret;
+ 
+ 	v4l2_ctrl_handler_init(&imx290->ctrls, 9);
+-	imx290->ctrls.lock = &imx290->lock;
+ 
+ 	/*
+ 	 * The sensor has an analog gain and a digital gain, both controlled
+@@ -718,10 +719,6 @@ static int imx290_ctrl_init(struct imx29
+ 		return ret;
+ 	}
+ 
+-	mutex_lock(imx290->ctrls.lock);
+-	imx290_ctrl_update(imx290, imx290->current_mode);
+-	mutex_unlock(imx290->ctrls.lock);
+-
+ 	return 0;
+ }
+ 
+@@ -730,8 +727,10 @@ static int imx290_ctrl_init(struct imx29
+  */
+ 
+ /* Start streaming */
+-static int imx290_start_streaming(struct imx290 *imx290)
++static int imx290_start_streaming(struct imx290 *imx290,
++				  struct v4l2_subdev_state *state)
+ {
++	const struct v4l2_mbus_framefmt *format;
+ 	int ret;
+ 
+ 	/* Set init register settings */
+@@ -744,7 +743,8 @@ static int imx290_start_streaming(struct
+ 	}
+ 
+ 	/* Apply the register values related to current frame format */
+-	ret = imx290_write_current_format(imx290);
++	format = v4l2_subdev_get_pad_format(&imx290->sd, state, 0);
++	ret = imx290_setup_format(imx290, format);
+ 	if (ret < 0) {
+ 		dev_err(imx290->dev, "Could not set frame format\n");
+ 		return ret;
+@@ -764,7 +764,7 @@ static int imx290_start_streaming(struct
+ 		return ret;
+ 
+ 	/* Apply customized values from user */
+-	ret = v4l2_ctrl_handler_setup(imx290->sd.ctrl_handler);
++	ret = __v4l2_ctrl_handler_setup(imx290->sd.ctrl_handler);
+ 	if (ret) {
+ 		dev_err(imx290->dev, "Could not sync v4l2 controls\n");
+ 		return ret;
+@@ -793,39 +793,32 @@ static int imx290_stop_streaming(struct
+ static int imx290_set_stream(struct v4l2_subdev *sd, int enable)
+ {
+ 	struct imx290 *imx290 = to_imx290(sd);
++	struct v4l2_subdev_state *state;
+ 	int ret = 0;
+ 
++	state = v4l2_subdev_lock_and_get_active_state(sd);
++
+ 	if (enable) {
+ 		ret = pm_runtime_resume_and_get(imx290->dev);
+ 		if (ret < 0)
+-			goto unlock_and_return;
++			goto unlock;
+ 
+-		ret = imx290_start_streaming(imx290);
++		ret = imx290_start_streaming(imx290, state);
+ 		if (ret) {
+ 			dev_err(imx290->dev, "Start stream failed\n");
+ 			pm_runtime_put(imx290->dev);
+-			goto unlock_and_return;
++			goto unlock;
+ 		}
+ 	} else {
+ 		imx290_stop_streaming(imx290);
+ 		pm_runtime_put(imx290->dev);
+ 	}
+ 
+-unlock_and_return:
+-
++unlock:
++	v4l2_subdev_unlock_state(state);
+ 	return ret;
+ }
+ 
+-static struct v4l2_mbus_framefmt *
+-imx290_get_pad_format(struct imx290 *imx290, struct v4l2_subdev_state *state,
+-		      u32 which)
+-{
+-	if (which == V4L2_SUBDEV_FORMAT_ACTIVE)
+-		return &imx290->current_format;
+-	else
+-		return v4l2_subdev_get_try_format(&imx290->sd, state, 0);
+-}
+-
+ static int imx290_enum_mbus_code(struct v4l2_subdev *sd,
+ 				 struct v4l2_subdev_state *sd_state,
+ 				 struct v4l2_subdev_mbus_code_enum *code)
+@@ -860,23 +853,6 @@ static int imx290_enum_frame_size(struct
+ 	return 0;
+ }
+ 
+-static int imx290_get_fmt(struct v4l2_subdev *sd,
+-			  struct v4l2_subdev_state *sd_state,
+-			  struct v4l2_subdev_format *fmt)
+-{
+-	struct imx290 *imx290 = to_imx290(sd);
+-	struct v4l2_mbus_framefmt *framefmt;
+-
+-	mutex_lock(&imx290->lock);
+-
+-	framefmt = imx290_get_pad_format(imx290, sd_state, fmt->which);
+-	fmt->format = *framefmt;
+-
+-	mutex_unlock(&imx290->lock);
+-
+-	return 0;
+-}
+-
+ static int imx290_set_fmt(struct v4l2_subdev *sd,
+ 			  struct v4l2_subdev_state *sd_state,
+ 			  struct v4l2_subdev_format *fmt)
+@@ -886,8 +862,6 @@ static int imx290_set_fmt(struct v4l2_su
+ 	struct v4l2_mbus_framefmt *format;
+ 	unsigned int i;
+ 
+-	mutex_lock(&imx290->lock);
+-
+ 	mode = v4l2_find_nearest_size(imx290_modes_ptr(imx290),
+ 				      imx290_modes_num(imx290), width, height,
+ 				      fmt->format.width, fmt->format.height);
+@@ -905,7 +879,7 @@ static int imx290_set_fmt(struct v4l2_su
+ 	fmt->format.code = imx290_formats[i].code;
+ 	fmt->format.field = V4L2_FIELD_NONE;
+ 
+-	format = imx290_get_pad_format(imx290, sd_state, fmt->which);
++	format = v4l2_subdev_get_pad_format(sd, sd_state, 0);
+ 
+ 	if (fmt->which == V4L2_SUBDEV_FORMAT_ACTIVE) {
+ 		imx290->current_mode = mode;
+@@ -916,8 +890,6 @@ static int imx290_set_fmt(struct v4l2_su
+ 
+ 	*format = fmt->format;
+ 
+-	mutex_unlock(&imx290->lock);
+-
+ 	return 0;
+ }
+ 
+@@ -925,14 +897,11 @@ static int imx290_get_selection(struct v
+ 				struct v4l2_subdev_state *sd_state,
+ 				struct v4l2_subdev_selection *sel)
+ {
+-	struct imx290 *imx290 = to_imx290(sd);
+ 	struct v4l2_mbus_framefmt *format;
+ 
+ 	switch (sel->target) {
+ 	case V4L2_SEL_TGT_CROP: {
+-		format = imx290_get_pad_format(imx290, sd_state, sel->which);
+-
+-		mutex_lock(&imx290->lock);
++		format = v4l2_subdev_get_pad_format(sd, sd_state, 0);
+ 
+ 		sel->r.top = IMX920_PIXEL_ARRAY_MARGIN_TOP
+ 			   + (IMX290_PIXEL_ARRAY_RECORDING_HEIGHT - format->height) / 2;
+@@ -941,7 +910,6 @@ static int imx290_get_selection(struct v
+ 		sel->r.width = format->width;
+ 		sel->r.height = format->height;
+ 
+-		mutex_unlock(&imx290->lock);
+ 		return 0;
+ 	}
+ 
+@@ -970,11 +938,13 @@ static int imx290_get_selection(struct v
+ static int imx290_entity_init_cfg(struct v4l2_subdev *subdev,
+ 				  struct v4l2_subdev_state *sd_state)
+ {
+-	struct v4l2_subdev_format fmt = { 0 };
+-
+-	fmt.which = sd_state ? V4L2_SUBDEV_FORMAT_TRY : V4L2_SUBDEV_FORMAT_ACTIVE;
+-	fmt.format.width = 1920;
+-	fmt.format.height = 1080;
++	struct v4l2_subdev_format fmt = {
++		.which = V4L2_SUBDEV_FORMAT_TRY,
++		.format = {
++			.width = 1920,
++			.height = 1080,
++		},
++	};
+ 
+ 	imx290_set_fmt(subdev, sd_state, &fmt);
+ 
+@@ -989,7 +959,7 @@ static const struct v4l2_subdev_pad_ops
+ 	.init_cfg = imx290_entity_init_cfg,
+ 	.enum_mbus_code = imx290_enum_mbus_code,
+ 	.enum_frame_size = imx290_enum_frame_size,
+-	.get_fmt = imx290_get_fmt,
++	.get_fmt = v4l2_subdev_get_fmt,
+ 	.set_fmt = imx290_set_fmt,
+ 	.get_selection = imx290_get_selection,
+ };
+@@ -1008,18 +978,8 @@ static int imx290_subdev_init(struct imx
+ 	struct i2c_client *client = to_i2c_client(imx290->dev);
+ 	int ret;
+ 
+-	/*
+-	 * Initialize the frame format. In particular, imx290->current_mode
+-	 * and imx290->bpp are set to defaults: imx290_calc_pixel_rate() call
+-	 * below relies on these fields.
+-	 */
+-	imx290_entity_init_cfg(&imx290->sd, NULL);
+-
+-	ret = imx290_ctrl_init(imx290);
+-	if (ret < 0) {
+-		dev_err(imx290->dev, "Control initialization error %d\n", ret);
+-		return ret;
+-	}
++	imx290->current_mode = &imx290_modes_ptr(imx290)[0];
++	imx290->bpp = imx290_formats[0].bpp;
+ 
+ 	v4l2_i2c_subdev_init(&imx290->sd, client, &imx290_subdev_ops);
+ 	imx290->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
+@@ -1031,15 +991,37 @@ static int imx290_subdev_init(struct imx
+ 	ret = media_entity_pads_init(&imx290->sd.entity, 1, &imx290->pad);
+ 	if (ret < 0) {
+ 		dev_err(imx290->dev, "Could not register media entity\n");
+-		v4l2_ctrl_handler_free(&imx290->ctrls);
+ 		return ret;
+ 	}
+ 
++	ret = imx290_ctrl_init(imx290);
++	if (ret < 0) {
++		dev_err(imx290->dev, "Control initialization error %d\n", ret);
++		goto err_media;
++	}
++
++	imx290->sd.state_lock = imx290->ctrls.lock;
++
++	ret = v4l2_subdev_init_finalize(&imx290->sd);
++	if (ret < 0) {
++		dev_err(imx290->dev, "subdev initialization error %d\n", ret);
++		goto err_ctrls;
++	}
++
++	imx290_ctrl_update(imx290, imx290->current_mode);
++
+ 	return 0;
++
++err_ctrls:
++	v4l2_ctrl_handler_free(&imx290->ctrls);
++err_media:
++	media_entity_cleanup(&imx290->sd.entity);
++	return ret;
+ }
+ 
+ static void imx290_subdev_cleanup(struct imx290 *imx290)
+ {
++	v4l2_subdev_cleanup(&imx290->sd);
+ 	media_entity_cleanup(&imx290->sd.entity);
+ 	v4l2_ctrl_handler_free(&imx290->ctrls);
+ }
+@@ -1270,12 +1252,10 @@ static int imx290_probe(struct i2c_clien
+ 	if (ret)
+ 		return ret;
+ 
+-	mutex_init(&imx290->lock);
+-
+ 	/* Initialize and register subdev. */
+ 	ret = imx290_subdev_init(imx290);
+ 	if (ret)
+-		goto err_mutex;
++		return ret;
+ 
+ 	ret = v4l2_async_register_subdev(&imx290->sd);
+ 	if (ret < 0) {
+@@ -1298,8 +1278,6 @@ static int imx290_probe(struct i2c_clien
+ 
+ err_subdev:
+ 	imx290_subdev_cleanup(imx290);
+-err_mutex:
+-	mutex_destroy(&imx290->lock);
+ 
+ 	return ret;
+ }
+@@ -1312,8 +1290,6 @@ static void imx290_remove(struct i2c_cli
+ 	v4l2_async_unregister_subdev(sd);
+ 	imx290_subdev_cleanup(imx290);
+ 
+-	mutex_destroy(&imx290->lock);
+-
+ 	pm_runtime_disable(imx290->dev);
+ 	if (!pm_runtime_status_suspended(imx290->dev))
+ 		imx290_power_off(imx290->dev);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0642-media-i2c-imx290-Rename-extend-and-expand-usage-of-i.patch b/target/linux/bcm27xx/patches-6.1/950-0642-media-i2c-imx290-Rename-extend-and-expand-usage-of-i.patch
new file mode 100644
index 00000000000000..304fd5097ff2ac
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0642-media-i2c-imx290-Rename-extend-and-expand-usage-of-i.patch
@@ -0,0 +1,258 @@
+From fd31edb90963d91390b372153028fab79e7f060e Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 17 Oct 2022 12:44:27 +0200
+Subject: [PATCH] media: i2c: imx290: Rename, extend and expand usage
+ of imx290_pixfmt
+
+Upstream commit 10591fe63691
+
+The imx290_pixfmt structure contains information about formats,
+currently limited to the bpp value. Extend it with the register settings
+for each format, and rename it to imx290_format_info to make its purpose
+clearer. Add a function named imx290_format_info() to look up format
+info for a media bus code, and use it through the code. This allows
+dropping the imx290 bpp field as the value is now looked up dynamically.
+
+The error handling in imx290_setup_format() can also be dropped, as the
+format is guaranteed by imx290_set_fmt() to be valid.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Acked-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 99 ++++++++++++++++++++++----------------
+ 1 file changed, 58 insertions(+), 41 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -182,7 +182,6 @@ struct imx290 {
+ 	struct media_pad pad;
+ 
+ 	const struct imx290_mode *current_mode;
+-	u8 bpp;
+ 
+ 	struct regulator_bulk_data supplies[IMX290_NUM_SUPPLIES];
+ 	struct gpio_desc *rst_gpio;
+@@ -414,16 +413,41 @@ static inline int imx290_modes_num(const
+ 		return ARRAY_SIZE(imx290_modes_4lanes);
+ }
+ 
+-struct imx290_pixfmt {
++struct imx290_format_info {
+ 	u32 code;
+ 	u8 bpp;
++	const struct imx290_regval *regs;
++	unsigned int num_regs;
+ };
+ 
+-static const struct imx290_pixfmt imx290_formats[] = {
+-	{ MEDIA_BUS_FMT_SRGGB10_1X10, 10 },
+-	{ MEDIA_BUS_FMT_SRGGB12_1X12, 12 },
++static const struct imx290_format_info imx290_formats[] = {
++	{
++		.code = MEDIA_BUS_FMT_SRGGB10_1X10,
++		.bpp = 10,
++		.regs = imx290_10bit_settings,
++		.num_regs = ARRAY_SIZE(imx290_10bit_settings),
++	}, {
++		.code = MEDIA_BUS_FMT_SRGGB12_1X12,
++		.bpp = 12,
++		.regs = imx290_12bit_settings,
++		.num_regs = ARRAY_SIZE(imx290_12bit_settings),
++	}
+ };
+ 
++static const struct imx290_format_info *imx290_format_info(u32 code)
++{
++	unsigned int i;
++
++	for (i = 0; i < ARRAY_SIZE(imx290_formats); ++i) {
++		const struct imx290_format_info *info = &imx290_formats[i];
++
++		if (info->code == code)
++			return info;
++	}
++
++	return NULL;
++}
++
+ /* -----------------------------------------------------------------------------
+  * Register access
+  */
+@@ -516,40 +540,31 @@ static int imx290_set_data_lanes(struct
+ }
+ 
+ static int imx290_set_black_level(struct imx290 *imx290,
++				  const struct v4l2_mbus_framefmt *format,
+ 				  unsigned int black_level, int *err)
+ {
++	unsigned int bpp = imx290_format_info(format->code)->bpp;
++
+ 	return imx290_write(imx290, IMX290_BLKLEVEL,
+-			    black_level >> (16 - imx290->bpp), err);
++			    black_level >> (16 - bpp), err);
+ }
+ 
+ static int imx290_setup_format(struct imx290 *imx290,
+ 			       const struct v4l2_mbus_framefmt *format)
+ {
+-	const struct imx290_regval *regs;
+-	unsigned int num_regs;
++	const struct imx290_format_info *info;
+ 	int ret;
+ 
+-	switch (format->code) {
+-	case MEDIA_BUS_FMT_SRGGB10_1X10:
+-		regs = imx290_10bit_settings;
+-		num_regs = ARRAY_SIZE(imx290_10bit_settings);
+-		break;
+-	case MEDIA_BUS_FMT_SRGGB12_1X12:
+-		regs = imx290_12bit_settings;
+-		num_regs = ARRAY_SIZE(imx290_12bit_settings);
+-		break;
+-	default:
+-		dev_err(imx290->dev, "Unknown pixel format\n");
+-		return -EINVAL;
+-	}
++	info = imx290_format_info(format->code);
+ 
+-	ret = imx290_set_register_array(imx290, regs, num_regs);
++	ret = imx290_set_register_array(imx290, info->regs, info->num_regs);
+ 	if (ret < 0) {
+ 		dev_err(imx290->dev, "Could not set format registers\n");
+ 		return ret;
+ 	}
+ 
+-	return imx290_set_black_level(imx290, IMX290_BLACK_LEVEL_DEFAULT, &ret);
++	return imx290_set_black_level(imx290, format,
++				      IMX290_BLACK_LEVEL_DEFAULT, &ret);
+ }
+ 
+ /* ----------------------------------------------------------------------------
+@@ -560,6 +575,8 @@ static int imx290_set_ctrl(struct v4l2_c
+ {
+ 	struct imx290 *imx290 = container_of(ctrl->handler,
+ 					     struct imx290, ctrls);
++	const struct v4l2_mbus_framefmt *format;
++	struct v4l2_subdev_state *state;
+ 	int ret = 0;
+ 
+ 	/*
+@@ -575,6 +592,9 @@ static int imx290_set_ctrl(struct v4l2_c
+ 	if (!pm_runtime_get_if_in_use(imx290->dev))
+ 		return 0;
+ 
++	state = v4l2_subdev_get_locked_active_state(&imx290->sd);
++	format = v4l2_subdev_get_pad_format(&imx290->sd, state, 0);
++
+ 	switch (ctrl->id) {
+ 	case V4L2_CID_ANALOGUE_GAIN:
+ 		ret = imx290_write(imx290, IMX290_GAIN, ctrl->val, NULL);
+@@ -587,7 +607,7 @@ static int imx290_set_ctrl(struct v4l2_c
+ 
+ 	case V4L2_CID_TEST_PATTERN:
+ 		if (ctrl->val) {
+-			imx290_set_black_level(imx290, 0, &ret);
++			imx290_set_black_level(imx290, format, 0, &ret);
+ 			usleep_range(10000, 11000);
+ 			imx290_write(imx290, IMX290_PGCTRL,
+ 				     (u8)(IMX290_PGCTRL_REGEN |
+@@ -596,8 +616,8 @@ static int imx290_set_ctrl(struct v4l2_c
+ 		} else {
+ 			imx290_write(imx290, IMX290_PGCTRL, 0x00, &ret);
+ 			usleep_range(10000, 11000);
+-			imx290_set_black_level(imx290, IMX290_BLACK_LEVEL_DEFAULT,
+-					       &ret);
++			imx290_set_black_level(imx290, format,
++					       IMX290_BLACK_LEVEL_DEFAULT, &ret);
+ 		}
+ 		break;
+ 
+@@ -627,6 +647,7 @@ static const char * const imx290_test_pa
+ };
+ 
+ static void imx290_ctrl_update(struct imx290 *imx290,
++			       const struct v4l2_mbus_framefmt *format,
+ 			       const struct imx290_mode *mode)
+ {
+ 	unsigned int hblank = mode->hmax - mode->width;
+@@ -636,7 +657,7 @@ static void imx290_ctrl_update(struct im
+ 
+ 	/* pixel rate = link_freq * 2 * nr_of_lanes / bits_per_sample */
+ 	pixel_rate = link_freq * 2 * imx290->nlanes;
+-	do_div(pixel_rate, imx290->bpp);
++	do_div(pixel_rate, imx290_format_info(format->code)->bpp);
+ 
+ 	__v4l2_ctrl_s_ctrl(imx290->link_freq, mode->link_freq_index);
+ 	__v4l2_ctrl_s_ctrl_int64(imx290->pixel_rate, pixel_rate);
+@@ -838,8 +859,7 @@ static int imx290_enum_frame_size(struct
+ 	const struct imx290 *imx290 = to_imx290(sd);
+ 	const struct imx290_mode *imx290_modes = imx290_modes_ptr(imx290);
+ 
+-	if ((fse->code != imx290_formats[0].code) &&
+-	    (fse->code != imx290_formats[1].code))
++	if (!imx290_format_info(fse->code))
+ 		return -EINVAL;
+ 
+ 	if (fse->index >= imx290_modes_num(imx290))
+@@ -860,7 +880,6 @@ static int imx290_set_fmt(struct v4l2_su
+ 	struct imx290 *imx290 = to_imx290(sd);
+ 	const struct imx290_mode *mode;
+ 	struct v4l2_mbus_framefmt *format;
+-	unsigned int i;
+ 
+ 	mode = v4l2_find_nearest_size(imx290_modes_ptr(imx290),
+ 				      imx290_modes_num(imx290), width, height,
+@@ -869,23 +888,17 @@ static int imx290_set_fmt(struct v4l2_su
+ 	fmt->format.width = mode->width;
+ 	fmt->format.height = mode->height;
+ 
+-	for (i = 0; i < ARRAY_SIZE(imx290_formats); i++)
+-		if (imx290_formats[i].code == fmt->format.code)
+-			break;
++	if (!imx290_format_info(fmt->format.code))
++		fmt->format.code = imx290_formats[0].code;
+ 
+-	if (i >= ARRAY_SIZE(imx290_formats))
+-		i = 0;
+-
+-	fmt->format.code = imx290_formats[i].code;
+ 	fmt->format.field = V4L2_FIELD_NONE;
+ 
+ 	format = v4l2_subdev_get_pad_format(sd, sd_state, 0);
+ 
+ 	if (fmt->which == V4L2_SUBDEV_FORMAT_ACTIVE) {
+ 		imx290->current_mode = mode;
+-		imx290->bpp = imx290_formats[i].bpp;
+ 
+-		imx290_ctrl_update(imx290, mode);
++		imx290_ctrl_update(imx290, &fmt->format, mode);
+ 	}
+ 
+ 	*format = fmt->format;
+@@ -976,10 +989,11 @@ static const struct media_entity_operati
+ static int imx290_subdev_init(struct imx290 *imx290)
+ {
+ 	struct i2c_client *client = to_i2c_client(imx290->dev);
++	const struct v4l2_mbus_framefmt *format;
++	struct v4l2_subdev_state *state;
+ 	int ret;
+ 
+ 	imx290->current_mode = &imx290_modes_ptr(imx290)[0];
+-	imx290->bpp = imx290_formats[0].bpp;
+ 
+ 	v4l2_i2c_subdev_init(&imx290->sd, client, &imx290_subdev_ops);
+ 	imx290->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
+@@ -1008,7 +1022,10 @@ static int imx290_subdev_init(struct imx
+ 		goto err_ctrls;
+ 	}
+ 
+-	imx290_ctrl_update(imx290, imx290->current_mode);
++	state = v4l2_subdev_lock_and_get_active_state(&imx290->sd);
++	format = v4l2_subdev_get_pad_format(&imx290->sd, state, 0);
++	imx290_ctrl_update(imx290, format, imx290->current_mode);
++	v4l2_subdev_unlock_state(state);
+ 
+ 	return 0;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0643-media-i2c-imx290-Use-runtime-PM-autosuspend.patch b/target/linux/bcm27xx/patches-6.1/950-0643-media-i2c-imx290-Use-runtime-PM-autosuspend.patch
new file mode 100644
index 00000000000000..1abddcca37c88a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0643-media-i2c-imx290-Use-runtime-PM-autosuspend.patch
@@ -0,0 +1,132 @@
+From 28725443a44ba4ed854195cd2916a0ae59c4259f Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 16 Jan 2023 15:44:50 +0100
+Subject: [PATCH] media: i2c: imx290: Use runtime PM autosuspend
+
+Upstream commit a8c3e0c1bf1e
+
+Use runtime PM autosuspend to avoid powering off the sensor during fast
+stop-reconfigure-restart cycles. This also fixes runtime PM handling in
+the probe function that didn't suspend the device, effectively leaving
+it resumed forever.
+
+While at it, improve documentation of power management in probe() and
+remove().
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Acked-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 58 +++++++++++++++++++++++++++++---------
+ 1 file changed, 45 insertions(+), 13 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -626,7 +626,8 @@ static int imx290_set_ctrl(struct v4l2_c
+ 		break;
+ 	}
+ 
+-	pm_runtime_put(imx290->dev);
++	pm_runtime_mark_last_busy(imx290->dev);
++	pm_runtime_put_autosuspend(imx290->dev);
+ 
+ 	return ret;
+ }
+@@ -827,12 +828,13 @@ static int imx290_set_stream(struct v4l2
+ 		ret = imx290_start_streaming(imx290, state);
+ 		if (ret) {
+ 			dev_err(imx290->dev, "Start stream failed\n");
+-			pm_runtime_put(imx290->dev);
++			pm_runtime_put_sync(imx290->dev);
+ 			goto unlock;
+ 		}
+ 	} else {
+ 		imx290_stop_streaming(imx290);
+-		pm_runtime_put(imx290->dev);
++		pm_runtime_mark_last_busy(imx290->dev);
++		pm_runtime_put_autosuspend(imx290->dev);
+ 	}
+ 
+ unlock:
+@@ -1269,33 +1271,59 @@ static int imx290_probe(struct i2c_clien
+ 	if (ret)
+ 		return ret;
+ 
+-	/* Initialize and register subdev. */
++	/* Initialize the V4L2 subdev. */
+ 	ret = imx290_subdev_init(imx290);
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = v4l2_async_register_subdev(&imx290->sd);
+-	if (ret < 0) {
+-		dev_err(dev, "Could not register v4l2 device\n");
+-		goto err_subdev;
+-	}
+-
+-	/* Power on the device to match runtime PM state below */
++	/*
++	 * Enable power management. The driver supports runtime PM, but needs to
++	 * work when runtime PM is disabled in the kernel. To that end, power
++	 * the sensor on manually here.
++	 */
+ 	ret = imx290_power_on(dev);
+ 	if (ret < 0) {
+ 		dev_err(dev, "Could not power on the device\n");
+ 		goto err_subdev;
+ 	}
+ 
++	/*
++	 * Enable runtime PM with autosuspend. As the device has been powered
++	 * manually, mark it as active, and increase the usage count without
++	 * resuming the device.
++	 */
+ 	pm_runtime_set_active(dev);
++	pm_runtime_get_noresume(dev);
+ 	pm_runtime_enable(dev);
+-	pm_runtime_idle(dev);
++	pm_runtime_set_autosuspend_delay(dev, 1000);
++	pm_runtime_use_autosuspend(dev);
++
++	/*
++	 * Finally, register the V4L2 subdev. This must be done after
++	 * initializing everything as the subdev can be used immediately after
++	 * being registered.
++	 */
++	ret = v4l2_async_register_subdev(&imx290->sd);
++	if (ret < 0) {
++		dev_err(dev, "Could not register v4l2 device\n");
++		goto err_pm;
++	}
++
++	/*
++	 * Decrease the PM usage count. The device will get suspended after the
++	 * autosuspend delay, turning the power off.
++	 */
++	pm_runtime_mark_last_busy(dev);
++	pm_runtime_put_autosuspend(dev);
+ 
+ 	return 0;
+ 
++err_pm:
++	pm_runtime_disable(dev);
++	pm_runtime_put_noidle(dev);
++	imx290_power_off(dev);
+ err_subdev:
+ 	imx290_subdev_cleanup(imx290);
+-
+ 	return ret;
+ }
+ 
+@@ -1307,6 +1335,10 @@ static void imx290_remove(struct i2c_cli
+ 	v4l2_async_unregister_subdev(sd);
+ 	imx290_subdev_cleanup(imx290);
+ 
++	/*
++	 * Disable runtime PM. In case runtime PM is disabled in the kernel,
++	 * make sure to turn power off manually.
++	 */
+ 	pm_runtime_disable(imx290->dev);
+ 	if (!pm_runtime_status_suspended(imx290->dev))
+ 		imx290_power_off(imx290->dev);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0644-media-i2c-imx290-Initialize-runtime-PM-before-subdev.patch b/target/linux/bcm27xx/patches-6.1/950-0644-media-i2c-imx290-Initialize-runtime-PM-before-subdev.patch
new file mode 100644
index 00000000000000..32f8bd4cd212ac
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0644-media-i2c-imx290-Initialize-runtime-PM-before-subdev.patch
@@ -0,0 +1,172 @@
+From 42d779016414396fe047ef41af6bc8297f3cd6a4 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 16 Jan 2023 15:44:51 +0100
+Subject: [PATCH] media: i2c: imx290: Initialize runtime PM before
+ subdev
+
+Upstream commit 02852c01f654
+
+Initializing the subdev before runtime PM means that no subdev
+initialization can interact with the runtime PM framework. This can be
+problematic when modifying controls, as the .s_ctrl() handler commonly
+calls pm_runtime_get_if_in_use(). These code paths are not trivial,
+making the driver fragile and possibly causing subtle bugs.
+
+To make the subdev initialization more robust, initialize runtime PM
+first.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Acked-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 59 ++++++++++++++++++++++----------------
+ 1 file changed, 34 insertions(+), 25 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -581,9 +581,7 @@ static int imx290_set_ctrl(struct v4l2_c
+ 
+ 	/*
+ 	 * Return immediately for controls that don't need to be applied to the
+-	 * device. Those controls are modified in imx290_ctrl_update(), which
+-	 * is called at probe time before runtime PM is initialized, so we
+-	 * can't proceed to the pm_runtime_get_if_in_use() call below.
++	 * device.
+ 	 */
+ 	if (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY)
+ 		return 0;
+@@ -1049,22 +1047,20 @@ static void imx290_subdev_cleanup(struct
+  * Power management
+  */
+ 
+-static int imx290_power_on(struct device *dev)
++static int imx290_power_on(struct imx290 *imx290)
+ {
+-	struct v4l2_subdev *sd = dev_get_drvdata(dev);
+-	struct imx290 *imx290 = to_imx290(sd);
+ 	int ret;
+ 
+ 	ret = clk_prepare_enable(imx290->xclk);
+ 	if (ret) {
+-		dev_err(dev, "Failed to enable clock\n");
++		dev_err(imx290->dev, "Failed to enable clock\n");
+ 		return ret;
+ 	}
+ 
+ 	ret = regulator_bulk_enable(ARRAY_SIZE(imx290->supplies),
+ 				    imx290->supplies);
+ 	if (ret) {
+-		dev_err(dev, "Failed to enable regulators\n");
++		dev_err(imx290->dev, "Failed to enable regulators\n");
+ 		clk_disable_unprepare(imx290->xclk);
+ 		return ret;
+ 	}
+@@ -1079,20 +1075,33 @@ static int imx290_power_on(struct device
+ 	return 0;
+ }
+ 
+-static int imx290_power_off(struct device *dev)
++static void imx290_power_off(struct imx290 *imx290)
+ {
+-	struct v4l2_subdev *sd = dev_get_drvdata(dev);
+-	struct imx290 *imx290 = to_imx290(sd);
+-
+ 	clk_disable_unprepare(imx290->xclk);
+ 	gpiod_set_value_cansleep(imx290->rst_gpio, 1);
+ 	regulator_bulk_disable(ARRAY_SIZE(imx290->supplies), imx290->supplies);
++}
++
++static int imx290_runtime_resume(struct device *dev)
++{
++	struct v4l2_subdev *sd = dev_get_drvdata(dev);
++	struct imx290 *imx290 = to_imx290(sd);
++
++	return imx290_power_on(imx290);
++}
++
++static int imx290_runtime_suspend(struct device *dev)
++{
++	struct v4l2_subdev *sd = dev_get_drvdata(dev);
++	struct imx290 *imx290 = to_imx290(sd);
++
++	imx290_power_off(imx290);
+ 
+ 	return 0;
+ }
+ 
+ static const struct dev_pm_ops imx290_pm_ops = {
+-	SET_RUNTIME_PM_OPS(imx290_power_off, imx290_power_on, NULL)
++	SET_RUNTIME_PM_OPS(imx290_runtime_suspend, imx290_runtime_resume, NULL)
+ };
+ 
+ /* ----------------------------------------------------------------------------
+@@ -1271,20 +1280,15 @@ static int imx290_probe(struct i2c_clien
+ 	if (ret)
+ 		return ret;
+ 
+-	/* Initialize the V4L2 subdev. */
+-	ret = imx290_subdev_init(imx290);
+-	if (ret)
+-		return ret;
+-
+ 	/*
+ 	 * Enable power management. The driver supports runtime PM, but needs to
+ 	 * work when runtime PM is disabled in the kernel. To that end, power
+ 	 * the sensor on manually here.
+ 	 */
+-	ret = imx290_power_on(dev);
++	ret = imx290_power_on(imx290);
+ 	if (ret < 0) {
+ 		dev_err(dev, "Could not power on the device\n");
+-		goto err_subdev;
++		return ret;
+ 	}
+ 
+ 	/*
+@@ -1298,6 +1302,11 @@ static int imx290_probe(struct i2c_clien
+ 	pm_runtime_set_autosuspend_delay(dev, 1000);
+ 	pm_runtime_use_autosuspend(dev);
+ 
++	/* Initialize the V4L2 subdev. */
++	ret = imx290_subdev_init(imx290);
++	if (ret)
++		goto err_pm;
++
+ 	/*
+ 	 * Finally, register the V4L2 subdev. This must be done after
+ 	 * initializing everything as the subdev can be used immediately after
+@@ -1306,7 +1315,7 @@ static int imx290_probe(struct i2c_clien
+ 	ret = v4l2_async_register_subdev(&imx290->sd);
+ 	if (ret < 0) {
+ 		dev_err(dev, "Could not register v4l2 device\n");
+-		goto err_pm;
++		goto err_subdev;
+ 	}
+ 
+ 	/*
+@@ -1318,12 +1327,12 @@ static int imx290_probe(struct i2c_clien
+ 
+ 	return 0;
+ 
++err_subdev:
++	imx290_subdev_cleanup(imx290);
+ err_pm:
+ 	pm_runtime_disable(dev);
+ 	pm_runtime_put_noidle(dev);
+-	imx290_power_off(dev);
+-err_subdev:
+-	imx290_subdev_cleanup(imx290);
++	imx290_power_off(imx290);
+ 	return ret;
+ }
+ 
+@@ -1341,7 +1350,7 @@ static void imx290_remove(struct i2c_cli
+ 	 */
+ 	pm_runtime_disable(imx290->dev);
+ 	if (!pm_runtime_status_suspended(imx290->dev))
+-		imx290_power_off(imx290->dev);
++		imx290_power_off(imx290);
+ 	pm_runtime_set_suspended(imx290->dev);
+ }
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0645-media-i2c-imx290-Configure-data-lanes-at-start-time.patch b/target/linux/bcm27xx/patches-6.1/950-0645-media-i2c-imx290-Configure-data-lanes-at-start-time.patch
new file mode 100644
index 00000000000000..57a7b1c7b944cb
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0645-media-i2c-imx290-Configure-data-lanes-at-start-time.patch
@@ -0,0 +1,41 @@
+From f463515fa1c3d34eeff708d3c015d357049b4df1 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 16 Jan 2023 15:44:52 +0100
+Subject: [PATCH] media: i2c: imx290: Configure data lanes at start
+ time
+
+Upstream commit 7d399658f7c6
+
+There's no need to configure the data lanes in the runtime PM resume
+handler. Do so in imx290_start_streaming() instead.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -762,6 +762,9 @@ static int imx290_start_streaming(struct
+ 		return ret;
+ 	}
+ 
++	/* Set data lane count */
++	imx290_set_data_lanes(imx290);
++
+ 	/* Apply the register values related to current frame format */
+ 	format = v4l2_subdev_get_pad_format(&imx290->sd, state, 0);
+ 	ret = imx290_setup_format(imx290, format);
+@@ -1069,9 +1072,6 @@ static int imx290_power_on(struct imx290
+ 	gpiod_set_value_cansleep(imx290->rst_gpio, 0);
+ 	usleep_range(30000, 31000);
+ 
+-	/* Set data lane count */
+-	imx290_set_data_lanes(imx290);
+-
+ 	return 0;
+ }
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0646-media-i2c-imx290-Simplify-imx290_set_data_lanes.patch b/target/linux/bcm27xx/patches-6.1/950-0646-media-i2c-imx290-Simplify-imx290_set_data_lanes.patch
new file mode 100644
index 00000000000000..369dfeda624ce0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0646-media-i2c-imx290-Simplify-imx290_set_data_lanes.patch
@@ -0,0 +1,59 @@
+From 1551a08118c8e468b3afe0dd5ae0cfa47b7518e1 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 16 Jan 2023 15:44:53 +0100
+Subject: [PATCH] media: i2c: imx290: Simplify imx290_set_data_lanes()
+
+Upstream commit 76c001287f6a
+
+There's no need to check for an incorrect number of data lanes in
+imx290_set_data_lanes() as the value is validated at probe() time. Drop
+the check.
+
+The PHY_LANE_NUM and CSI_LANE_MODE registers are programmed with a value
+equal to the number of lanes minus one. Compute it instead of handling
+it in the switch/case.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 17 +++++------------
+ 1 file changed, 5 insertions(+), 12 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -512,28 +512,21 @@ static int imx290_set_register_array(str
+ 
+ static int imx290_set_data_lanes(struct imx290 *imx290)
+ {
+-	int ret = 0, laneval, frsel;
++	int ret = 0;
++	u32 frsel;
+ 
+ 	switch (imx290->nlanes) {
+ 	case 2:
+-		laneval = 0x01;
++	default:
+ 		frsel = 0x02;
+ 		break;
+ 	case 4:
+-		laneval = 0x03;
+ 		frsel = 0x01;
+ 		break;
+-	default:
+-		/*
+-		 * We should never hit this since the data lane count is
+-		 * validated in probe itself
+-		 */
+-		dev_err(imx290->dev, "Lane configuration not supported\n");
+-		return -EINVAL;
+ 	}
+ 
+-	imx290_write(imx290, IMX290_PHY_LANE_NUM, laneval, &ret);
+-	imx290_write(imx290, IMX290_CSI_LANE_MODE, laneval, &ret);
++	imx290_write(imx290, IMX290_PHY_LANE_NUM, imx290->nlanes - 1, &ret);
++	imx290_write(imx290, IMX290_CSI_LANE_MODE, imx290->nlanes - 1, &ret);
+ 	imx290_write(imx290, IMX290_FR_FDG_SEL, frsel, &ret);
+ 
+ 	return ret;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0647-media-i2c-imx290-Handle-error-from-imx290_set_data_l.patch b/target/linux/bcm27xx/patches-6.1/950-0647-media-i2c-imx290-Handle-error-from-imx290_set_data_l.patch
new file mode 100644
index 00000000000000..f624ff0a85ca6d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0647-media-i2c-imx290-Handle-error-from-imx290_set_data_l.patch
@@ -0,0 +1,34 @@
+From 705b61d95a10db07cf60f6087e543c826fa53c28 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 16 Jan 2023 15:44:54 +0100
+Subject: [PATCH] media: i2c: imx290: Handle error from
+ imx290_set_data_lanes()
+
+Upstream commit 05ef7ec49d6b
+
+Check the error status returned by imx290_set_data_lanes() in its
+caller and propagate it.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -756,7 +756,11 @@ static int imx290_start_streaming(struct
+ 	}
+ 
+ 	/* Set data lane count */
+-	imx290_set_data_lanes(imx290);
++	ret = imx290_set_data_lanes(imx290);
++	if (ret < 0) {
++		dev_err(imx290->dev, "Could not set data lanes\n");
++		return ret;
++	}
+ 
+ 	/* Apply the register values related to current frame format */
+ 	format = v4l2_subdev_get_pad_format(&imx290->sd, state, 0);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0648-dtbindings-Reset-imx290.txt-to-upstream.patch b/target/linux/bcm27xx/patches-6.1/950-0648-dtbindings-Reset-imx290.txt-to-upstream.patch
new file mode 100644
index 00000000000000..52d0dae2257465
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0648-dtbindings-Reset-imx290.txt-to-upstream.patch
@@ -0,0 +1,30 @@
+From 2c9a29b01ad8a5b9489f4713f12acf52e42b89cb Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 28 Mar 2023 14:49:41 +0100
+Subject: [PATCH] dtbindings: Reset imx290.txt to upstream
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ Documentation/devicetree/bindings/media/i2c/imx290.txt | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/Documentation/devicetree/bindings/media/i2c/imx290.txt
++++ b/Documentation/devicetree/bindings/media/i2c/imx290.txt
+@@ -1,14 +1,13 @@
+ * Sony IMX290 1/2.8-Inch CMOS Image Sensor
+ 
+ The Sony IMX290 is a 1/2.8-Inch CMOS Solid-state image sensor with
+-Square Pixel for Color or Monochrome Cameras. It is programmable through I2C
+-and 4-wire interfaces.
+-The sensor output is available via CMOS logic parallel SDR output,
++Square Pixel for Color Cameras. It is programmable through I2C and 4-wire
++interfaces. The sensor output is available via CMOS logic parallel SDR output,
+ Low voltage LVDS DDR output and CSI-2 serial data output. The CSI-2 bus is the
+ default. No bindings have been defined for the other busses.
+ 
+ Required Properties:
+-- compatible: Should be "sony,imx290", or "sony,imx290-mono"
++- compatible: Should be "sony,imx290"
+ - reg: I2C bus address of the device
+ - clocks: Reference to the xclk clock.
+ - clock-names: Should be "xclk".
diff --git a/target/linux/bcm27xx/patches-6.1/950-0649-media-dt-bindings-Convert-imx290.txt-to-YAML.patch b/target/linux/bcm27xx/patches-6.1/950-0649-media-dt-bindings-Convert-imx290.txt-to-YAML.patch
new file mode 100644
index 00000000000000..14a8a4a029b2af
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0649-media-dt-bindings-Convert-imx290.txt-to-YAML.patch
@@ -0,0 +1,230 @@
+From 22774ebfc4073fd3c0fc729e2ae1e0e762ec127e Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sun, 16 Oct 2022 09:15:04 +0300
+Subject: [PATCH] media: dt-bindings: Convert imx290.txt to YAML
+
+Upstream commit a96dfea1df25
+
+Convert the Sony IMX290 DT binding from text to YAML. Add Manivannan as
+a maintainer given that he is listed in MAINTAINERS for the file, as
+volunteering myself.
+
+The name of the input clock, "xclk", is wrong as the hardware manual
+names it INCK. As the device has a single clock, the name could be
+omitted, but that would require a corresponding change to the driver and
+is thus a candidate for further patches.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ .../devicetree/bindings/media/i2c/imx290.txt  |  57 --------
+ .../bindings/media/i2c/sony,imx290.yaml       | 129 ++++++++++++++++++
+ MAINTAINERS                                   |   2 +-
+ 3 files changed, 130 insertions(+), 58 deletions(-)
+ delete mode 100644 Documentation/devicetree/bindings/media/i2c/imx290.txt
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/sony,imx290.yaml
+
+--- a/Documentation/devicetree/bindings/media/i2c/imx290.txt
++++ /dev/null
+@@ -1,57 +0,0 @@
+-* Sony IMX290 1/2.8-Inch CMOS Image Sensor
+-
+-The Sony IMX290 is a 1/2.8-Inch CMOS Solid-state image sensor with
+-Square Pixel for Color Cameras. It is programmable through I2C and 4-wire
+-interfaces. The sensor output is available via CMOS logic parallel SDR output,
+-Low voltage LVDS DDR output and CSI-2 serial data output. The CSI-2 bus is the
+-default. No bindings have been defined for the other busses.
+-
+-Required Properties:
+-- compatible: Should be "sony,imx290"
+-- reg: I2C bus address of the device
+-- clocks: Reference to the xclk clock.
+-- clock-names: Should be "xclk".
+-- clock-frequency: Frequency of the xclk clock in Hz.
+-- vdddo-supply: Sensor digital IO regulator.
+-- vdda-supply: Sensor analog regulator.
+-- vddd-supply: Sensor digital core regulator.
+-
+-Optional Properties:
+-- reset-gpios: Sensor reset GPIO
+-
+-The imx290 device node should contain one 'port' child node with
+-an 'endpoint' subnode. For further reading on port node refer to
+-Documentation/devicetree/bindings/media/video-interfaces.txt.
+-
+-Required Properties on endpoint:
+-- data-lanes: check ../video-interfaces.txt
+-- link-frequencies: check ../video-interfaces.txt
+-- remote-endpoint: check ../video-interfaces.txt
+-
+-Example:
+-	&i2c1 {
+-		...
+-		imx290: camera-sensor@1a {
+-			compatible = "sony,imx290";
+-			reg = <0x1a>;
+-
+-			reset-gpios = <&msmgpio 35 GPIO_ACTIVE_LOW>;
+-			pinctrl-names = "default";
+-			pinctrl-0 = <&camera_rear_default>;
+-
+-			clocks = <&gcc GCC_CAMSS_MCLK0_CLK>;
+-			clock-names = "xclk";
+-			clock-frequency = <37125000>;
+-
+-			vdddo-supply = <&camera_vdddo_1v8>;
+-			vdda-supply = <&camera_vdda_2v8>;
+-			vddd-supply = <&camera_vddd_1v5>;
+-
+-			port {
+-				imx290_ep: endpoint {
+-					data-lanes = <1 2 3 4>;
+-					link-frequencies = /bits/ 64 <445500000>;
+-					remote-endpoint = <&csiphy0_ep>;
+-				};
+-			};
+-		};
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/sony,imx290.yaml
+@@ -0,0 +1,129 @@
++# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/media/i2c/sony,imx290.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Sony IMX290 1/2.8-Inch CMOS Image Sensor
++
++maintainers:
++  - Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
++  - Laurent Pinchart <laurent.pinchart@ideasonboard.com>
++
++description: |-
++  The Sony IMX290 is a 1/2.8-Inch CMOS Solid-state image sensor with Square
++  Pixel for Color Cameras. It is programmable through I2C and 4-wire
++  interfaces. The sensor output is available via CMOS logic parallel SDR
++  output, Low voltage LVDS DDR output and CSI-2 serial data output. The CSI-2
++  bus is the default. No bindings have been defined for the other busses.
++
++properties:
++  compatible:
++    enum:
++      - sony,imx290
++
++  reg:
++    maxItems: 1
++
++  clocks:
++    maxItems: 1
++
++  clock-names:
++    description: Input clock (37.125 MHz or 74.25 MHz)
++    items:
++      - const: xclk
++
++  clock-frequency:
++    description: Frequency of the xclk clock in Hz
++
++  vdda-supply:
++    description: Analog power supply (2.9V)
++
++  vddd-supply:
++    description: Digital core power supply (1.2V)
++
++  vdddo-supply:
++    description: Digital I/O power supply (1.8V)
++
++  reset-gpios:
++    description: Sensor reset (XCLR) GPIO
++    maxItems: 1
++
++  port:
++    $ref: /schemas/graph.yaml#/$defs/port-base
++    description: |
++      Video output port
++
++    properties:
++      endpoint:
++        $ref: /schemas/media/video-interfaces.yaml#
++        unevaluatedProperties: false
++
++        properties:
++          data-lanes:
++            anyOf:
++              - items:
++                  - const: 1
++                  - const: 2
++              - items:
++                  - const: 1
++                  - const: 2
++                  - const: 3
++                  - const: 4
++
++          link-frequencies: true
++
++        required:
++          - data-lanes
++          - link-frequencies
++
++    additionalProperties: false
++
++required:
++  - compatible
++  - reg
++  - clocks
++  - clock-names
++  - clock-frequency
++  - vdda-supply
++  - vddd-supply
++  - vdddo-supply
++  - port
++
++additionalProperties: false
++
++examples:
++  - |
++    #include <dt-bindings/gpio/gpio.h>
++
++    i2c {
++        #address-cells = <1>;
++        #size-cells = <0>;
++
++        imx290: camera-sensor@1a {
++            compatible = "sony,imx290";
++            reg = <0x1a>;
++
++            pinctrl-names = "default";
++            pinctrl-0 = <&camera_rear_default>;
++
++            clocks = <&gcc 90>;
++            clock-names = "xclk";
++            clock-frequency = <37125000>;
++
++            vdddo-supply = <&camera_vdddo_1v8>;
++            vdda-supply = <&camera_vdda_2v8>;
++            vddd-supply = <&camera_vddd_1v5>;
++
++            reset-gpios = <&msmgpio 35 GPIO_ACTIVE_LOW>;
++
++            port {
++                imx290_ep: endpoint {
++                    data-lanes = <1 2 3 4>;
++                    link-frequencies = /bits/ 64 <445500000>;
++                    remote-endpoint = <&csiphy0_ep>;
++                };
++            };
++        };
++    };
++...
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -19267,7 +19267,7 @@ M:	Manivannan Sadhasivam <manivannan.sad
+ L:	linux-media@vger.kernel.org
+ S:	Maintained
+ T:	git git://linuxtv.org/media_tree.git
+-F:	Documentation/devicetree/bindings/media/i2c/imx290.txt
++F:	Documentation/devicetree/bindings/media/i2c/sony,imx290.yaml
+ F:	drivers/media/i2c/imx290.c
+ 
+ SONY IMX296 SENSOR DRIVER
diff --git a/target/linux/bcm27xx/patches-6.1/950-0650-media-dt-bindings-media-i2c-Add-mono-version-to-IMX2.patch b/target/linux/bcm27xx/patches-6.1/950-0650-media-dt-bindings-media-i2c-Add-mono-version-to-IMX2.patch
new file mode 100644
index 00000000000000..f07cd8d44efdb9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0650-media-dt-bindings-media-i2c-Add-mono-version-to-IMX2.patch
@@ -0,0 +1,69 @@
+From 695dadec7459162f4945320081c9c4d2712406a4 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 16 Feb 2023 00:29:49 +0200
+Subject: [PATCH] media: dt-bindings: media: i2c: Add mono version to
+ IMX290 bindings
+
+Should be upstream commit f0c720ff2d21
+
+The IMX290 module is available as either monochrome or colour and
+the variant is not detectable at runtime.
+
+Add a new compatible string for the monochrome version, based on the
+full device name IMX290LLR. For consistency, add a new compatible string
+for the colour version based on the IMX290LQR full device name, and
+deprecate the current ambiguous compatible string.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Tested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ .../bindings/media/i2c/sony,imx290.yaml       | 24 +++++++++++++------
+ 1 file changed, 17 insertions(+), 7 deletions(-)
+
+--- a/Documentation/devicetree/bindings/media/i2c/sony,imx290.yaml
++++ b/Documentation/devicetree/bindings/media/i2c/sony,imx290.yaml
+@@ -12,15 +12,25 @@ maintainers:
+ 
+ description: |-
+   The Sony IMX290 is a 1/2.8-Inch CMOS Solid-state image sensor with Square
+-  Pixel for Color Cameras. It is programmable through I2C and 4-wire
+-  interfaces. The sensor output is available via CMOS logic parallel SDR
+-  output, Low voltage LVDS DDR output and CSI-2 serial data output. The CSI-2
+-  bus is the default. No bindings have been defined for the other busses.
++  Pixel, available in either mono or colour variants. It is programmable
++  through I2C and 4-wire interfaces.
++
++  The sensor output is available via CMOS logic parallel SDR output, Low voltage
++  LVDS DDR output and CSI-2 serial data output. The CSI-2 bus is the default.
++  No bindings have been defined for the other busses.
++
++  imx290lqr is the full model identifier for the colour variant. "sony,imx290"
++  is treated the same as this as it was the original compatible string.
++  imx290llr is the mono version of the sensor.
+ 
+ properties:
+   compatible:
+-    enum:
+-      - sony,imx290
++    oneOf:
++      - enum:
++          - sony,imx290lqr # Colour
++          - sony,imx290llr # Monochrome
++      - const: sony,imx290
++        deprecated: true
+ 
+   reg:
+     maxItems: 1
+@@ -101,7 +111,7 @@ examples:
+         #size-cells = <0>;
+ 
+         imx290: camera-sensor@1a {
+-            compatible = "sony,imx290";
++            compatible = "sony,imx290lqr";
+             reg = <0x1a>;
+ 
+             pinctrl-names = "default";
diff --git a/target/linux/bcm27xx/patches-6.1/950-0651-media-dt-bindings-media-i2c-Add-imx327-version-to-IM.patch b/target/linux/bcm27xx/patches-6.1/950-0651-media-dt-bindings-media-i2c-Add-imx327-version-to-IM.patch
new file mode 100644
index 00000000000000..2fdfd3e333d8a9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0651-media-dt-bindings-media-i2c-Add-imx327-version-to-IM.patch
@@ -0,0 +1,29 @@
+From a78f785e776c674f8151a53243245890040be5e6 Mon Sep 17 00:00:00 2001
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+Date: Fri, 17 Feb 2023 10:52:20 +0100
+Subject: [PATCH] media: dt-bindings: media: i2c: Add imx327 version to
+ IMX327 bindings
+
+Should be upstream commit 783ecfe5556a
+
+The imx290 driver can be used for both imx290 and imx327 as they have a
+similar register set and configuration. imx327 lacks 8 lanes LVDS and
+120 FPS support.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ Documentation/devicetree/bindings/media/i2c/sony,imx290.yaml | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/Documentation/devicetree/bindings/media/i2c/sony,imx290.yaml
++++ b/Documentation/devicetree/bindings/media/i2c/sony,imx290.yaml
+@@ -29,6 +29,7 @@ properties:
+       - enum:
+           - sony,imx290lqr # Colour
+           - sony,imx290llr # Monochrome
++          - sony,imx327lqr # Colour
+       - const: sony,imx290
+         deprecated: true
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0652-media-i2c-imx290-Make-use-of-get_unaligned_le24-put_.patch b/target/linux/bcm27xx/patches-6.1/950-0652-media-i2c-imx290-Make-use-of-get_unaligned_le24-put_.patch
new file mode 100644
index 00000000000000..1e322e4f9182b1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0652-media-i2c-imx290-Make-use-of-get_unaligned_le24-put_.patch
@@ -0,0 +1,52 @@
+From e6a7be26a288f293847b92fe6333bb981eb74ba3 Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Fri, 10 Feb 2023 00:12:05 +0200
+Subject: [PATCH] media: i2c: imx290: Make use of get_unaligned_le24(),
+ put_unaligned_le24()
+
+Should be upstream commit 5d129c4539c3
+
+Since we have a proper endianness converters for LE 24-bit data use them.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -16,6 +16,9 @@
+ #include <linux/pm_runtime.h>
+ #include <linux/regmap.h>
+ #include <linux/regulator/consumer.h>
++
++#include <asm/unaligned.h>
++
+ #include <media/media-entity.h>
+ #include <media/v4l2-ctrls.h>
+ #include <media/v4l2-device.h>
+@@ -466,18 +469,20 @@ static int __always_unused imx290_read(s
+ 		return ret;
+ 	}
+ 
+-	*value = (data[2] << 16) | (data[1] << 8) | data[0];
++	*value = get_unaligned_le24(data);
+ 	return 0;
+ }
+ 
+ static int imx290_write(struct imx290 *imx290, u32 addr, u32 value, int *err)
+ {
+-	u8 data[3] = { value & 0xff, (value >> 8) & 0xff, value >> 16 };
++	u8 data[3];
+ 	int ret;
+ 
+ 	if (err && *err)
+ 		return *err;
+ 
++	put_unaligned_le24(value, data);
++
+ 	ret = regmap_raw_write(imx290->regmap, addr & IMX290_REG_ADDR_MASK,
+ 			       data, (addr >> IMX290_REG_SIZE_SHIFT) & 3);
+ 	if (ret < 0) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0653-media-i2c-imx290-Use-device_property_read_u32-direct.patch b/target/linux/bcm27xx/patches-6.1/950-0653-media-i2c-imx290-Use-device_property_read_u32-direct.patch
new file mode 100644
index 00000000000000..593dab94f8e87e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0653-media-i2c-imx290-Use-device_property_read_u32-direct.patch
@@ -0,0 +1,31 @@
+From 6555dd4a687f121572a91ad9333a81991be8b266 Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Fri, 10 Feb 2023 00:09:54 +0200
+Subject: [PATCH] media: i2c: imx290: Use device_property_read_u32()
+ directly
+
+Should be upstream commit 971458482809
+
+No need to call fwnode_property_read_u32(dev_fwnode()), when
+we have already existing helper. So use it.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -1137,8 +1137,8 @@ static int imx290_init_clk(struct imx290
+ 	u32 xclk_freq;
+ 	int ret;
+ 
+-	ret = fwnode_property_read_u32(dev_fwnode(imx290->dev),
+-				       "clock-frequency", &xclk_freq);
++	ret = device_property_read_u32(imx290->dev, "clock-frequency",
++				       &xclk_freq);
+ 	if (ret) {
+ 		dev_err(imx290->dev, "Could not get xclk frequency\n");
+ 		return ret;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0654-media-i2c-imx290-Add-support-for-the-mono-sensor-var.patch b/target/linux/bcm27xx/patches-6.1/950-0654-media-i2c-imx290-Add-support-for-the-mono-sensor-var.patch
new file mode 100644
index 00000000000000..71b520eb8cc6ed
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0654-media-i2c-imx290-Add-support-for-the-mono-sensor-var.patch
@@ -0,0 +1,216 @@
+From d0cc0819d6750d39624741d9091ab3f73836f11b Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 16 Feb 2023 00:29:50 +0200
+Subject: [PATCH] media: i2c: imx290: Add support for the mono sensor
+ variant
+
+Should be upstream commit 9bf52c7136d1
+
+The IMX290 module is available as either mono or colour (Bayer).
+
+Update the driver so that it can advertise the correct mono
+formats instead of the colour ones.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Tested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 75 +++++++++++++++++++++++++++++++-------
+ 1 file changed, 61 insertions(+), 14 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -13,6 +13,7 @@
+ #include <linux/gpio/consumer.h>
+ #include <linux/i2c.h>
+ #include <linux/module.h>
++#include <linux/of_device.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/regmap.h>
+ #include <linux/regulator/consumer.h>
+@@ -160,6 +161,21 @@
+ 
+ #define IMX290_NUM_SUPPLIES				3
+ 
++enum imx290_colour_variant {
++	IMX290_VARIANT_COLOUR,
++	IMX290_VARIANT_MONO,
++	IMX290_VARIANT_MAX
++};
++
++enum imx290_model {
++	IMX290_MODEL_IMX290LQR,
++	IMX290_MODEL_IMX290LLR,
++};
++
++struct imx290_model_info {
++	enum imx290_colour_variant colour_variant;
++};
++
+ struct imx290_regval {
+ 	u32 reg;
+ 	u32 val;
+@@ -180,6 +196,7 @@ struct imx290 {
+ 	struct clk *xclk;
+ 	struct regmap *regmap;
+ 	u8 nlanes;
++	const struct imx290_model_info *model;
+ 
+ 	struct v4l2_subdev sd;
+ 	struct media_pad pad;
+@@ -417,7 +434,7 @@ static inline int imx290_modes_num(const
+ }
+ 
+ struct imx290_format_info {
+-	u32 code;
++	u32 code[IMX290_VARIANT_MAX];
+ 	u8 bpp;
+ 	const struct imx290_regval *regs;
+ 	unsigned int num_regs;
+@@ -425,26 +442,33 @@ struct imx290_format_info {
+ 
+ static const struct imx290_format_info imx290_formats[] = {
+ 	{
+-		.code = MEDIA_BUS_FMT_SRGGB10_1X10,
++		.code = {
++			[IMX290_VARIANT_COLOUR] = MEDIA_BUS_FMT_SRGGB10_1X10,
++			[IMX290_VARIANT_MONO] = MEDIA_BUS_FMT_Y10_1X10
++		},
+ 		.bpp = 10,
+ 		.regs = imx290_10bit_settings,
+ 		.num_regs = ARRAY_SIZE(imx290_10bit_settings),
+ 	}, {
+-		.code = MEDIA_BUS_FMT_SRGGB12_1X12,
++		.code = {
++			[IMX290_VARIANT_COLOUR] = MEDIA_BUS_FMT_SRGGB12_1X12,
++			[IMX290_VARIANT_MONO] = MEDIA_BUS_FMT_Y12_1X12
++		},
+ 		.bpp = 12,
+ 		.regs = imx290_12bit_settings,
+ 		.num_regs = ARRAY_SIZE(imx290_12bit_settings),
+ 	}
+ };
+ 
+-static const struct imx290_format_info *imx290_format_info(u32 code)
++static const struct imx290_format_info *
++imx290_format_info(const struct imx290 *imx290, u32 code)
+ {
+ 	unsigned int i;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(imx290_formats); ++i) {
+ 		const struct imx290_format_info *info = &imx290_formats[i];
+ 
+-		if (info->code == code)
++		if (info->code[imx290->model->colour_variant] == code)
+ 			return info;
+ 	}
+ 
+@@ -541,7 +565,7 @@ static int imx290_set_black_level(struct
+ 				  const struct v4l2_mbus_framefmt *format,
+ 				  unsigned int black_level, int *err)
+ {
+-	unsigned int bpp = imx290_format_info(format->code)->bpp;
++	unsigned int bpp = imx290_format_info(imx290, format->code)->bpp;
+ 
+ 	return imx290_write(imx290, IMX290_BLKLEVEL,
+ 			    black_level >> (16 - bpp), err);
+@@ -553,7 +577,7 @@ static int imx290_setup_format(struct im
+ 	const struct imx290_format_info *info;
+ 	int ret;
+ 
+-	info = imx290_format_info(format->code);
++	info = imx290_format_info(imx290, format->code);
+ 
+ 	ret = imx290_set_register_array(imx290, info->regs, info->num_regs);
+ 	if (ret < 0) {
+@@ -654,7 +678,7 @@ static void imx290_ctrl_update(struct im
+ 
+ 	/* pixel rate = link_freq * 2 * nr_of_lanes / bits_per_sample */
+ 	pixel_rate = link_freq * 2 * imx290->nlanes;
+-	do_div(pixel_rate, imx290_format_info(format->code)->bpp);
++	do_div(pixel_rate, imx290_format_info(imx290, format->code)->bpp);
+ 
+ 	__v4l2_ctrl_s_ctrl(imx290->link_freq, mode->link_freq_index);
+ 	__v4l2_ctrl_s_ctrl_int64(imx290->pixel_rate, pixel_rate);
+@@ -849,10 +873,12 @@ static int imx290_enum_mbus_code(struct
+ 				 struct v4l2_subdev_state *sd_state,
+ 				 struct v4l2_subdev_mbus_code_enum *code)
+ {
++	const struct imx290 *imx290 = to_imx290(sd);
++
+ 	if (code->index >= ARRAY_SIZE(imx290_formats))
+ 		return -EINVAL;
+ 
+-	code->code = imx290_formats[code->index].code;
++	code->code = imx290_formats[code->index].code[imx290->model->colour_variant];
+ 
+ 	return 0;
+ }
+@@ -864,7 +890,7 @@ static int imx290_enum_frame_size(struct
+ 	const struct imx290 *imx290 = to_imx290(sd);
+ 	const struct imx290_mode *imx290_modes = imx290_modes_ptr(imx290);
+ 
+-	if (!imx290_format_info(fse->code))
++	if (!imx290_format_info(imx290, fse->code))
+ 		return -EINVAL;
+ 
+ 	if (fse->index >= imx290_modes_num(imx290))
+@@ -893,8 +919,8 @@ static int imx290_set_fmt(struct v4l2_su
+ 	fmt->format.width = mode->width;
+ 	fmt->format.height = mode->height;
+ 
+-	if (!imx290_format_info(fmt->format.code))
+-		fmt->format.code = imx290_formats[0].code;
++	if (!imx290_format_info(imx290, fmt->format.code))
++		fmt->format.code = imx290_formats[0].code[imx290->model->colour_variant];
+ 
+ 	fmt->format.field = V4L2_FIELD_NONE;
+ 
+@@ -1182,6 +1208,15 @@ static s64 imx290_check_link_freqs(const
+ 	return 0;
+ }
+ 
++static const struct imx290_model_info imx290_models[] = {
++	[IMX290_MODEL_IMX290LQR] = {
++		.colour_variant = IMX290_VARIANT_COLOUR,
++	},
++	[IMX290_MODEL_IMX290LLR] = {
++		.colour_variant = IMX290_VARIANT_MONO,
++	},
++};
++
+ static int imx290_parse_dt(struct imx290 *imx290)
+ {
+ 	/* Only CSI2 is supported for now: */
+@@ -1192,6 +1227,8 @@ static int imx290_parse_dt(struct imx290
+ 	int ret;
+ 	s64 fq;
+ 
++	imx290->model = of_device_get_match_data(imx290->dev);
++
+ 	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(imx290->dev), NULL);
+ 	if (!endpoint) {
+ 		dev_err(imx290->dev, "Endpoint node not found\n");
+@@ -1357,8 +1394,18 @@ static void imx290_remove(struct i2c_cli
+ }
+ 
+ static const struct of_device_id imx290_of_match[] = {
+-	{ .compatible = "sony,imx290" },
+-	{ /* sentinel */ }
++	{
++		/* Deprecated - synonym for "sony,imx290lqr" */
++		.compatible = "sony,imx290",
++		.data = &imx290_models[IMX290_MODEL_IMX290LQR],
++	}, {
++		.compatible = "sony,imx290lqr",
++		.data = &imx290_models[IMX290_MODEL_IMX290LQR],
++	}, {
++		.compatible = "sony,imx290llr",
++		.data = &imx290_models[IMX290_MODEL_IMX290LLR],
++	},
++	{ /* sentinel */ },
+ };
+ MODULE_DEVICE_TABLE(of, imx290_of_match);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0655-media-i2c-imx290-Match-kernel-coding-style-on-whites.patch b/target/linux/bcm27xx/patches-6.1/950-0655-media-i2c-imx290-Match-kernel-coding-style-on-whites.patch
new file mode 100644
index 00000000000000..42d8c2d38251cb
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0655-media-i2c-imx290-Match-kernel-coding-style-on-whites.patch
@@ -0,0 +1,66 @@
+From db282fbb46900d381eec2ef3d15cf84c5048b120 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 16 Feb 2023 00:29:51 +0200
+Subject: [PATCH] media: i2c: imx290: Match kernel coding style on
+ whitespace
+
+Should be upstream commit 76d1bd4f0f45
+
+Fix up a couple of coding style issues regarding missing blank
+lines after declarations, double blank lines, and incorrect
+indentation.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -109,7 +109,6 @@
+ 
+ #define IMX290_VMAX_DEFAULT				1125
+ 
+-
+ /*
+  * The IMX290 pixel array is organized as follows:
+  *
+@@ -353,6 +352,7 @@ static const s64 imx290_link_freq_2lanes
+ 	[FREQ_INDEX_1080P] = 445500000,
+ 	[FREQ_INDEX_720P] = 297000000,
+ };
++
+ static const s64 imx290_link_freq_4lanes[] = {
+ 	[FREQ_INDEX_1080P] = 222750000,
+ 	[FREQ_INDEX_720P] = 148500000,
+@@ -488,7 +488,7 @@ static int __always_unused imx290_read(s
+ 			      data, (addr >> IMX290_REG_SIZE_SHIFT) & 3);
+ 	if (ret < 0) {
+ 		dev_err(imx290->dev, "%u-bit read from 0x%04x failed: %d\n",
+-			 ((addr >> IMX290_REG_SIZE_SHIFT) & 3) * 8,
++			((addr >> IMX290_REG_SIZE_SHIFT) & 3) * 8,
+ 			 addr & IMX290_REG_ADDR_MASK, ret);
+ 		return ret;
+ 	}
+@@ -511,7 +511,7 @@ static int imx290_write(struct imx290 *i
+ 			       data, (addr >> IMX290_REG_SIZE_SHIFT) & 3);
+ 	if (ret < 0) {
+ 		dev_err(imx290->dev, "%u-bit write to 0x%04x failed: %d\n",
+-			 ((addr >> IMX290_REG_SIZE_SHIFT) & 3) * 8,
++			((addr >> IMX290_REG_SIZE_SHIFT) & 3) * 8,
+ 			 addr & IMX290_REG_ADDR_MASK, ret);
+ 		if (err)
+ 			*err = ret;
+@@ -777,8 +777,7 @@ static int imx290_start_streaming(struct
+ 
+ 	/* Set init register settings */
+ 	ret = imx290_set_register_array(imx290, imx290_global_init_settings,
+-					ARRAY_SIZE(
+-						imx290_global_init_settings));
++					ARRAY_SIZE(imx290_global_init_settings));
+ 	if (ret < 0) {
+ 		dev_err(imx290->dev, "Could not set init registers\n");
+ 		return ret;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0656-media-i2c-imx290-Set-the-colorspace-fields-in-the-fo.patch b/target/linux/bcm27xx/patches-6.1/950-0656-media-i2c-imx290-Set-the-colorspace-fields-in-the-fo.patch
new file mode 100644
index 00000000000000..6f5756e3c21cd2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0656-media-i2c-imx290-Set-the-colorspace-fields-in-the-fo.patch
@@ -0,0 +1,32 @@
+From afa7161b9e5d42ca8efc5cf08e88f9dfc58b786c Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 16 Feb 2023 00:29:52 +0200
+Subject: [PATCH] media: i2c: imx290: Set the colorspace fields in the
+ format
+
+Should be upstream commit 7843b2eb081b
+
+The colorspace fields were left untouched in imx290_set_fmt
+which lead to a v4l2-compliance failure.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -922,6 +922,10 @@ static int imx290_set_fmt(struct v4l2_su
+ 		fmt->format.code = imx290_formats[0].code[imx290->model->colour_variant];
+ 
+ 	fmt->format.field = V4L2_FIELD_NONE;
++	fmt->format.colorspace = V4L2_COLORSPACE_RAW;
++	fmt->format.ycbcr_enc = V4L2_YCBCR_ENC_601;
++	fmt->format.quantization = V4L2_QUANTIZATION_FULL_RANGE;
++	fmt->format.xfer_func = V4L2_XFER_FUNC_NONE;
+ 
+ 	format = v4l2_subdev_get_pad_format(sd, sd_state, 0);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0657-media-i2c-imx290-Add-V4L2_SUBDEV_FL_HAS_EVENTS-and-s.patch b/target/linux/bcm27xx/patches-6.1/950-0657-media-i2c-imx290-Add-V4L2_SUBDEV_FL_HAS_EVENTS-and-s.patch
new file mode 100644
index 00000000000000..1fdd8c46624622
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0657-media-i2c-imx290-Add-V4L2_SUBDEV_FL_HAS_EVENTS-and-s.patch
@@ -0,0 +1,66 @@
+From 418b65e7035604266a598945beebdc30f6d58458 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 16 Feb 2023 00:29:53 +0200
+Subject: [PATCH] media: i2c: imx290: Add V4L2_SUBDEV_FL_HAS_EVENTS and
+ subscribe hooks
+
+Should be upstream commit 5f9dee39ab55
+
+Any V4L2 subdevice that implements controls and declares
+V4L2_SUBDEV_FL_HAS_DEVNODE should also declare V4L2_SUBDEV_FL_HAS_EVENTS
+and implement subscribe_event and unsubscribe_event hooks.
+
+This driver didn't and would therefore fail v4l2-compliance
+testing.
+
+Add the relevant hooks.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -23,6 +23,7 @@
+ #include <media/media-entity.h>
+ #include <media/v4l2-ctrls.h>
+ #include <media/v4l2-device.h>
++#include <media/v4l2-event.h>
+ #include <media/v4l2-fwnode.h>
+ #include <media/v4l2-subdev.h>
+ 
+@@ -998,6 +999,11 @@ static int imx290_entity_init_cfg(struct
+ 	return 0;
+ }
+ 
++static const struct v4l2_subdev_core_ops imx290_core_ops = {
++	.subscribe_event = v4l2_ctrl_subdev_subscribe_event,
++	.unsubscribe_event = v4l2_event_subdev_unsubscribe,
++};
++
+ static const struct v4l2_subdev_video_ops imx290_video_ops = {
+ 	.s_stream = imx290_set_stream,
+ };
+@@ -1012,6 +1018,7 @@ static const struct v4l2_subdev_pad_ops
+ };
+ 
+ static const struct v4l2_subdev_ops imx290_subdev_ops = {
++	.core = &imx290_core_ops,
+ 	.video = &imx290_video_ops,
+ 	.pad = &imx290_pad_ops,
+ };
+@@ -1030,7 +1037,8 @@ static int imx290_subdev_init(struct imx
+ 	imx290->current_mode = &imx290_modes_ptr(imx290)[0];
+ 
+ 	v4l2_i2c_subdev_init(&imx290->sd, client, &imx290_subdev_ops);
+-	imx290->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
++	imx290->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE |
++			    V4L2_SUBDEV_FL_HAS_EVENTS;
+ 	imx290->sd.dev = imx290->dev;
+ 	imx290->sd.entity.ops = &imx290_subdev_entity_ops;
+ 	imx290->sd.entity.function = MEDIA_ENT_F_CAM_SENSOR;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0658-media-i2c-imx290-Fix-the-pixel-rate-at-148.5Mpix-s.patch b/target/linux/bcm27xx/patches-6.1/950-0658-media-i2c-imx290-Fix-the-pixel-rate-at-148.5Mpix-s.patch
new file mode 100644
index 00000000000000..b5f8bab1949465
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0658-media-i2c-imx290-Fix-the-pixel-rate-at-148.5Mpix-s.patch
@@ -0,0 +1,89 @@
+From 5003200e5b6e1485515fe18aa5031769930e465e Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 16 Feb 2023 00:29:54 +0200
+Subject: [PATCH] media: i2c: imx290: Fix the pixel rate at 148.5Mpix/s
+
+Should be upstream commit 4381df0c756f
+
+The datasheet lists the link frequency changes between
+1080p and 720p modes. This is correct that the link frequency
+changes as measured on an oscilloscope.
+
+Link frequency is not necessarily the same as pixel rate.
+
+The datasheet gives standard configurations for 1080p and 720p
+modes at a number of frame rates.
+Looking at the 1080p mode it gives:
+HMAX = 0x898 = 2200
+VMAX = 0x465 = 1125
+2200 * 1125 * 60fps = 148.5MPix/s
+
+Looking at the 720p mode it gives:
+HMAX = 0xce4 = 3300
+VMAX = 0x2ee = 750
+3300 * 750 * 60fps = 148.5Mpix/s
+
+This driver currently scales the pixel rate proportionally to the
+link frequency, however the above shows that this is not the
+correct thing to do, and currently all frame rate and exposure
+calculations give incorrect results.
+
+Correctly report the pixel rate as being 148.5MPix/s under any
+mode.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 16 +++++-----------
+ 1 file changed, 5 insertions(+), 11 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -110,6 +110,8 @@
+ 
+ #define IMX290_VMAX_DEFAULT				1125
+ 
++#define IMX290_PIXEL_RATE				148500000
++
+ /*
+  * The IMX290 pixel array is organized as follows:
+  *
+@@ -208,7 +210,6 @@ struct imx290 {
+ 
+ 	struct v4l2_ctrl_handler ctrls;
+ 	struct v4l2_ctrl *link_freq;
+-	struct v4l2_ctrl *pixel_rate;
+ 	struct v4l2_ctrl *hblank;
+ 	struct v4l2_ctrl *vblank;
+ };
+@@ -674,15 +675,8 @@ static void imx290_ctrl_update(struct im
+ {
+ 	unsigned int hblank = mode->hmax - mode->width;
+ 	unsigned int vblank = IMX290_VMAX_DEFAULT - mode->height;
+-	s64 link_freq = imx290_link_freqs_ptr(imx290)[mode->link_freq_index];
+-	u64 pixel_rate;
+-
+-	/* pixel rate = link_freq * 2 * nr_of_lanes / bits_per_sample */
+-	pixel_rate = link_freq * 2 * imx290->nlanes;
+-	do_div(pixel_rate, imx290_format_info(imx290, format->code)->bpp);
+ 
+ 	__v4l2_ctrl_s_ctrl(imx290->link_freq, mode->link_freq_index);
+-	__v4l2_ctrl_s_ctrl_int64(imx290->pixel_rate, pixel_rate);
+ 
+ 	__v4l2_ctrl_modify_range(imx290->hblank, hblank, hblank, 1, hblank);
+ 	__v4l2_ctrl_modify_range(imx290->vblank, vblank, vblank, 1, vblank);
+@@ -732,9 +726,9 @@ static int imx290_ctrl_init(struct imx29
+ 	if (imx290->link_freq)
+ 		imx290->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+ 
+-	imx290->pixel_rate = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-					       V4L2_CID_PIXEL_RATE,
+-					       1, INT_MAX, 1, 1);
++	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops, V4L2_CID_PIXEL_RATE,
++			  IMX290_PIXEL_RATE, IMX290_PIXEL_RATE, 1,
++			  IMX290_PIXEL_RATE);
+ 
+ 	v4l2_ctrl_new_std_menu_items(&imx290->ctrls, &imx290_ctrl_ops,
+ 				     V4L2_CID_TEST_PATTERN,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0659-media-i2c-imx290-Support-60fps-in-2-lane-operation.patch b/target/linux/bcm27xx/patches-6.1/950-0659-media-i2c-imx290-Support-60fps-in-2-lane-operation.patch
new file mode 100644
index 00000000000000..01e51faeaf512c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0659-media-i2c-imx290-Support-60fps-in-2-lane-operation.patch
@@ -0,0 +1,71 @@
+From 9d6d7d83aacafc8b0bbf7b2b9b8a7622c4060bec Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 16 Feb 2023 00:29:55 +0200
+Subject: [PATCH] media: i2c: imx290: Support 60fps in 2 lane operation
+
+Should be upstream commit 7d4f22ba99cc
+
+Commit "97589ad61c73 media: i2c: imx290: Add support for 2 data lanes"
+added support for running in two lane mode (instead of 4), but
+without changing the link frequency that resulted in a max of 30fps.
+
+Commit "98e0500eadb7 media: i2c: imx290: Add configurable link frequency
+and pixel rate" then doubled the link frequency when in 2 lane mode,
+but didn't undo the correction for running at only 30fps, just extending
+horizontal blanking instead.
+
+Remove the 30fps limit on 2 lane by correcting the register config
+in accordance with the datasheet for 60fps operation over 2 lanes.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 17 +++--------------
+ 1 file changed, 3 insertions(+), 14 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -385,7 +385,7 @@ static const struct imx290_mode imx290_m
+ 	{
+ 		.width = 1920,
+ 		.height = 1080,
+-		.hmax = 4400,
++		.hmax = 2200,
+ 		.link_freq_index = FREQ_INDEX_1080P,
+ 		.data = imx290_1080p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_1080p_settings),
+@@ -393,7 +393,7 @@ static const struct imx290_mode imx290_m
+ 	{
+ 		.width = 1280,
+ 		.height = 720,
+-		.hmax = 6600,
++		.hmax = 3300,
+ 		.link_freq_index = FREQ_INDEX_720P,
+ 		.data = imx290_720p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_720p_settings),
+@@ -544,21 +544,10 @@ static int imx290_set_register_array(str
+ static int imx290_set_data_lanes(struct imx290 *imx290)
+ {
+ 	int ret = 0;
+-	u32 frsel;
+-
+-	switch (imx290->nlanes) {
+-	case 2:
+-	default:
+-		frsel = 0x02;
+-		break;
+-	case 4:
+-		frsel = 0x01;
+-		break;
+-	}
+ 
+ 	imx290_write(imx290, IMX290_PHY_LANE_NUM, imx290->nlanes - 1, &ret);
+ 	imx290_write(imx290, IMX290_CSI_LANE_MODE, imx290->nlanes - 1, &ret);
+-	imx290_write(imx290, IMX290_FR_FDG_SEL, frsel, &ret);
++	imx290_write(imx290, IMX290_FR_FDG_SEL, 0x01, &ret);
+ 
+ 	return ret;
+ }
diff --git a/target/linux/bcm27xx/patches-6.1/950-0660-media-i2c-imx290-Use-CSI-timings-as-per-datasheet.patch b/target/linux/bcm27xx/patches-6.1/950-0660-media-i2c-imx290-Use-CSI-timings-as-per-datasheet.patch
new file mode 100644
index 00000000000000..b431491ff527a6
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0660-media-i2c-imx290-Use-CSI-timings-as-per-datasheet.patch
@@ -0,0 +1,193 @@
+From e2f0a5c9cbd4945f715014069b7cc7041bba787b Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 16 Feb 2023 00:29:56 +0200
+Subject: [PATCH] media: i2c: imx290: Use CSI timings as per datasheet
+
+Should be upstream commit 34819ba0b450
+
+Commit "98e0500eadb7 media: i2c: imx290: Add configurable link frequency
+and pixel rate" added support for the increased link frequencies
+on 2 data lanes, but didn't update the CSI timing registers in
+accordance with the datasheet.
+
+Use the specified settings.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 126 +++++++++++++++++++++++++++++++------
+ 1 file changed, 106 insertions(+), 20 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -193,6 +193,18 @@ struct imx290_mode {
+ 	u32 data_size;
+ };
+ 
++struct imx290_csi_cfg {
++	u16 repetition;
++	u16 tclkpost;
++	u16 thszero;
++	u16 thsprepare;
++	u16 tclktrail;
++	u16 thstrail;
++	u16 tclkzero;
++	u16 tclkprepare;
++	u16 tlpx;
++};
++
+ struct imx290 {
+ 	struct device *dev;
+ 	struct clk *xclk;
+@@ -292,16 +304,6 @@ static const struct imx290_regval imx290
+ 	{ IMX290_INCKSEL4, 0x01 },
+ 	{ IMX290_INCKSEL5, 0x1a },
+ 	{ IMX290_INCKSEL6, 0x1a },
+-	/* data rate settings */
+-	{ IMX290_REPETITION, 0x10 },
+-	{ IMX290_TCLKPOST, 87 },
+-	{ IMX290_THSZERO, 55 },
+-	{ IMX290_THSPREPARE, 31 },
+-	{ IMX290_TCLKTRAIL, 31 },
+-	{ IMX290_THSTRAIL, 31 },
+-	{ IMX290_TCLKZERO, 119 },
+-	{ IMX290_TCLKPREPARE, 31 },
+-	{ IMX290_TLPX, 23 },
+ };
+ 
+ static const struct imx290_regval imx290_720p_settings[] = {
+@@ -317,16 +319,6 @@ static const struct imx290_regval imx290
+ 	{ IMX290_INCKSEL4, 0x01 },
+ 	{ IMX290_INCKSEL5, 0x1a },
+ 	{ IMX290_INCKSEL6, 0x1a },
+-	/* data rate settings */
+-	{ IMX290_REPETITION, 0x10 },
+-	{ IMX290_TCLKPOST, 79 },
+-	{ IMX290_THSZERO, 47 },
+-	{ IMX290_THSPREPARE, 23 },
+-	{ IMX290_TCLKTRAIL, 23 },
+-	{ IMX290_THSTRAIL, 23 },
+-	{ IMX290_TCLKZERO, 87 },
+-	{ IMX290_TCLKPREPARE, 23 },
+-	{ IMX290_TLPX, 23 },
+ };
+ 
+ static const struct imx290_regval imx290_10bit_settings[] = {
+@@ -347,6 +339,58 @@ static const struct imx290_regval imx290
+ 	{ IMX290_CSI_DT_FMT, IMX290_CSI_DT_FMT_RAW12 },
+ };
+ 
++static const struct imx290_csi_cfg imx290_csi_222_75mhz = {
++	/* 222.75MHz or 445.5Mbit/s per lane */
++	.repetition = 0x10,
++	.tclkpost = 87,
++	.thszero = 55,
++	.thsprepare = 31,
++	.tclktrail = 31,
++	.thstrail = 31,
++	.tclkzero = 119,
++	.tclkprepare = 31,
++	.tlpx = 23,
++};
++
++static const struct imx290_csi_cfg imx290_csi_445_5mhz = {
++	/* 445.5MHz or 891Mbit/s per lane */
++	.repetition = 0x00,
++	.tclkpost = 119,
++	.thszero = 103,
++	.thsprepare = 71,
++	.tclktrail = 55,
++	.thstrail = 63,
++	.tclkzero = 255,
++	.tclkprepare = 63,
++	.tlpx = 55,
++};
++
++static const struct imx290_csi_cfg imx290_csi_148_5mhz = {
++	/* 148.5MHz or 297Mbit/s per lane */
++	.repetition = 0x10,
++	.tclkpost = 79,
++	.thszero = 47,
++	.thsprepare = 23,
++	.tclktrail = 23,
++	.thstrail = 23,
++	.tclkzero = 87,
++	.tclkprepare = 23,
++	.tlpx = 23,
++};
++
++static const struct imx290_csi_cfg imx290_csi_297mhz = {
++	/* 297MHz or 594Mbit/s per lane */
++	.repetition = 0x00,
++	.tclkpost = 103,
++	.thszero = 87,
++	.thsprepare = 47,
++	.tclktrail = 39,
++	.thstrail = 47,
++	.tclkzero = 191,
++	.tclkprepare = 47,
++	.tlpx = 39,
++};
++
+ /* supported link frequencies */
+ #define FREQ_INDEX_1080P	0
+ #define FREQ_INDEX_720P		1
+@@ -562,6 +606,42 @@ static int imx290_set_black_level(struct
+ 			    black_level >> (16 - bpp), err);
+ }
+ 
++static int imx290_set_csi_config(struct imx290 *imx290)
++{
++	const s64 *link_freqs = imx290_link_freqs_ptr(imx290);
++	const struct imx290_csi_cfg *csi_cfg;
++	int ret = 0;
++
++	switch (link_freqs[imx290->current_mode->link_freq_index]) {
++	case 445500000:
++		csi_cfg = &imx290_csi_445_5mhz;
++		break;
++	case 297000000:
++		csi_cfg = &imx290_csi_297mhz;
++		break;
++	case 222750000:
++		csi_cfg = &imx290_csi_222_75mhz;
++		break;
++	case 148500000:
++		csi_cfg = &imx290_csi_148_5mhz;
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	imx290_write(imx290, IMX290_REPETITION, csi_cfg->repetition, &ret);
++	imx290_write(imx290, IMX290_TCLKPOST, csi_cfg->tclkpost, &ret);
++	imx290_write(imx290, IMX290_THSZERO, csi_cfg->thszero, &ret);
++	imx290_write(imx290, IMX290_THSPREPARE, csi_cfg->thsprepare, &ret);
++	imx290_write(imx290, IMX290_TCLKTRAIL, csi_cfg->tclktrail, &ret);
++	imx290_write(imx290, IMX290_THSTRAIL, csi_cfg->thstrail, &ret);
++	imx290_write(imx290, IMX290_TCLKZERO, csi_cfg->tclkzero, &ret);
++	imx290_write(imx290, IMX290_TCLKPREPARE, csi_cfg->tclkprepare, &ret);
++	imx290_write(imx290, IMX290_TLPX, csi_cfg->tlpx, &ret);
++
++	return ret;
++}
++
+ static int imx290_setup_format(struct imx290 *imx290,
+ 			       const struct v4l2_mbus_framefmt *format)
+ {
+@@ -774,6 +854,12 @@ static int imx290_start_streaming(struct
+ 		return ret;
+ 	}
+ 
++	ret = imx290_set_csi_config(imx290);
++	if (ret < 0) {
++		dev_err(imx290->dev, "Could not set csi cfg\n");
++		return ret;
++	}
++
+ 	/* Apply the register values related to current frame format */
+ 	format = v4l2_subdev_get_pad_format(&imx290->sd, state, 0);
+ 	ret = imx290_setup_format(imx290, format);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0661-media-i2c-imx290-Convert-V4L2_CID_HBLANK-to-read-wri.patch b/target/linux/bcm27xx/patches-6.1/950-0661-media-i2c-imx290-Convert-V4L2_CID_HBLANK-to-read-wri.patch
new file mode 100644
index 00000000000000..28682d4574b8c3
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0661-media-i2c-imx290-Convert-V4L2_CID_HBLANK-to-read-wri.patch
@@ -0,0 +1,134 @@
+From 98105970373a9e79dcaa4291f2802b1dd9fe909e Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 16 Feb 2023 00:29:57 +0200
+Subject: [PATCH] media: i2c: imx290: Convert V4L2_CID_HBLANK to
+ read/write
+
+Should be upstream commit 8cab2bd86307
+
+The driver exposed V4L2_CID_HBLANK as a read only control to allow
+for exposure calculations and determination of the frame rate.
+
+Convert to a read/write control so that the frame rate can be
+controlled.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 33 +++++++++++++++++++--------------
+ 1 file changed, 19 insertions(+), 14 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -50,6 +50,7 @@
+ #define IMX290_GAIN					IMX290_REG_8BIT(0x3014)
+ #define IMX290_VMAX					IMX290_REG_24BIT(0x3018)
+ #define IMX290_HMAX					IMX290_REG_16BIT(0x301c)
++#define IMX290_HMAX_MAX					0xffff
+ #define IMX290_SHS1					IMX290_REG_24BIT(0x3020)
+ #define IMX290_WINWV_OB					IMX290_REG_8BIT(0x303a)
+ #define IMX290_WINPV					IMX290_REG_16BIT(0x303c)
+@@ -186,7 +187,7 @@ struct imx290_regval {
+ struct imx290_mode {
+ 	u32 width;
+ 	u32 height;
+-	u32 hmax;
++	u32 hmax_min;
+ 	u8 link_freq_index;
+ 
+ 	const struct imx290_regval *data;
+@@ -429,7 +430,7 @@ static const struct imx290_mode imx290_m
+ 	{
+ 		.width = 1920,
+ 		.height = 1080,
+-		.hmax = 2200,
++		.hmax_min = 2200,
+ 		.link_freq_index = FREQ_INDEX_1080P,
+ 		.data = imx290_1080p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_1080p_settings),
+@@ -437,7 +438,7 @@ static const struct imx290_mode imx290_m
+ 	{
+ 		.width = 1280,
+ 		.height = 720,
+-		.hmax = 3300,
++		.hmax_min = 3300,
+ 		.link_freq_index = FREQ_INDEX_720P,
+ 		.data = imx290_720p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_720p_settings),
+@@ -448,7 +449,7 @@ static const struct imx290_mode imx290_m
+ 	{
+ 		.width = 1920,
+ 		.height = 1080,
+-		.hmax = 2200,
++		.hmax_min = 2200,
+ 		.link_freq_index = FREQ_INDEX_1080P,
+ 		.data = imx290_1080p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_1080p_settings),
+@@ -456,7 +457,7 @@ static const struct imx290_mode imx290_m
+ 	{
+ 		.width = 1280,
+ 		.height = 720,
+-		.hmax = 3300,
++		.hmax_min = 3300,
+ 		.link_freq_index = FREQ_INDEX_720P,
+ 		.data = imx290_720p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_720p_settings),
+@@ -712,6 +713,12 @@ static int imx290_set_ctrl(struct v4l2_c
+ 		}
+ 		break;
+ 
++	case V4L2_CID_HBLANK:
++		ret = imx290_write(imx290, IMX290_HMAX,
++				   ctrl->val + imx290->current_mode->width,
++				   NULL);
++		break;
++
+ 	default:
+ 		ret = -EINVAL;
+ 		break;
+@@ -742,12 +749,14 @@ static void imx290_ctrl_update(struct im
+ 			       const struct v4l2_mbus_framefmt *format,
+ 			       const struct imx290_mode *mode)
+ {
+-	unsigned int hblank = mode->hmax - mode->width;
++	unsigned int hblank_min = mode->hmax_min - mode->width;
++	unsigned int hblank_max = IMX290_HMAX_MAX - mode->width;
+ 	unsigned int vblank = IMX290_VMAX_DEFAULT - mode->height;
+ 
+ 	__v4l2_ctrl_s_ctrl(imx290->link_freq, mode->link_freq_index);
+ 
+-	__v4l2_ctrl_modify_range(imx290->hblank, hblank, hblank, 1, hblank);
++	__v4l2_ctrl_modify_range(imx290->hblank, hblank_min, hblank_max, 1,
++				 hblank_min);
+ 	__v4l2_ctrl_modify_range(imx290->vblank, vblank, vblank, 1, vblank);
+ }
+ 
+@@ -804,10 +813,11 @@ static int imx290_ctrl_init(struct imx29
+ 				     ARRAY_SIZE(imx290_test_pattern_menu) - 1,
+ 				     0, 0, imx290_test_pattern_menu);
+ 
++	/*
++	 * Actual range will be set from imx290_ctrl_update later in the probe.
++	 */
+ 	imx290->hblank = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+ 					   V4L2_CID_HBLANK, 1, 1, 1, 1);
+-	if (imx290->hblank)
+-		imx290->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+ 
+ 	imx290->vblank = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+ 					   V4L2_CID_VBLANK, 1, 1, 1, 1);
+@@ -876,11 +886,6 @@ static int imx290_start_streaming(struct
+ 		return ret;
+ 	}
+ 
+-	ret = imx290_write(imx290, IMX290_HMAX, imx290->current_mode->hmax,
+-			   NULL);
+-	if (ret)
+-		return ret;
+-
+ 	/* Apply customized values from user */
+ 	ret = __v4l2_ctrl_handler_setup(imx290->sd.ctrl_handler);
+ 	if (ret) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0662-media-i2c-imx290-Convert-V4L2_CID_VBLANK-to-read-wri.patch b/target/linux/bcm27xx/patches-6.1/950-0662-media-i2c-imx290-Convert-V4L2_CID_VBLANK-to-read-wri.patch
new file mode 100644
index 00000000000000..71a625f2603a2a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0662-media-i2c-imx290-Convert-V4L2_CID_VBLANK-to-read-wri.patch
@@ -0,0 +1,177 @@
+From 421e9f60f24504de605c7bc4ba98e51b73b2aa6d Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 16 Feb 2023 00:29:58 +0200
+Subject: [PATCH] media: i2c: imx290: Convert V4L2_CID_VBLANK to
+ read/write
+
+Should be upstream commit 97792a11021b
+
+The driver exposed V4L2_CID_VBLANK as a read only control to allow
+for exposure calculations and determination of the frame rate.
+
+Convert to a read/write control so that the frame rate can be
+controlled.
+V4L2_CID_VBLANK also sets the limits for the exposure control,
+therefore exposure ranges have to be updated when vblank changes
+(either via s_ctrl, or via changing mode).
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Acked-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 58 +++++++++++++++++++++++++++++++-------
+ 1 file changed, 48 insertions(+), 10 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -49,6 +49,7 @@
+ #define IMX290_BLKLEVEL					IMX290_REG_16BIT(0x300a)
+ #define IMX290_GAIN					IMX290_REG_8BIT(0x3014)
+ #define IMX290_VMAX					IMX290_REG_24BIT(0x3018)
++#define IMX290_VMAX_MAX					0x3ffff
+ #define IMX290_HMAX					IMX290_REG_16BIT(0x301c)
+ #define IMX290_HMAX_MAX					0xffff
+ #define IMX290_SHS1					IMX290_REG_24BIT(0x3020)
+@@ -109,6 +110,9 @@
+ #define IMX290_PGCTRL_THRU				BIT(1)
+ #define IMX290_PGCTRL_MODE(n)				((n) << 4)
+ 
++/* Number of lines by which exposure must be less than VMAX */
++#define IMX290_EXPOSURE_OFFSET				2
++
+ #define IMX290_VMAX_DEFAULT				1125
+ 
+ #define IMX290_PIXEL_RATE				148500000
+@@ -225,6 +229,7 @@ struct imx290 {
+ 	struct v4l2_ctrl *link_freq;
+ 	struct v4l2_ctrl *hblank;
+ 	struct v4l2_ctrl *vblank;
++	struct v4l2_ctrl *exposure;
+ };
+ 
+ static inline struct imx290 *to_imx290(struct v4l2_subdev *_sd)
+@@ -238,7 +243,6 @@ static inline struct imx290 *to_imx290(s
+ 
+ static const struct imx290_regval imx290_global_init_settings[] = {
+ 	{ IMX290_CTRL_07, IMX290_WINMODE_1080P },
+-	{ IMX290_VMAX, IMX290_VMAX_DEFAULT },
+ 	{ IMX290_EXTCK_FREQ, 0x2520 },
+ 	{ IMX290_WINWV_OB, 12 },
+ 	{ IMX290_WINPH, 0 },
+@@ -664,6 +668,16 @@ static int imx290_setup_format(struct im
+ /* ----------------------------------------------------------------------------
+  * Controls
+  */
++static void imx290_exposure_update(struct imx290 *imx290,
++				   const struct imx290_mode *mode)
++{
++	unsigned int exposure_max;
++
++	exposure_max = imx290->vblank->val + mode->height -
++		       IMX290_EXPOSURE_OFFSET;
++	__v4l2_ctrl_modify_range(imx290->exposure, 1, exposure_max, 1,
++				 exposure_max);
++}
+ 
+ static int imx290_set_ctrl(struct v4l2_ctrl *ctrl)
+ {
+@@ -671,7 +685,7 @@ static int imx290_set_ctrl(struct v4l2_c
+ 					     struct imx290, ctrls);
+ 	const struct v4l2_mbus_framefmt *format;
+ 	struct v4l2_subdev_state *state;
+-	int ret = 0;
++	int ret = 0, vmax;
+ 
+ 	/*
+ 	 * Return immediately for controls that don't need to be applied to the
+@@ -680,6 +694,11 @@ static int imx290_set_ctrl(struct v4l2_c
+ 	if (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY)
+ 		return 0;
+ 
++	if (ctrl->id == V4L2_CID_VBLANK) {
++		/* Changing vblank changes the allowed range for exposure. */
++		imx290_exposure_update(imx290, imx290->current_mode);
++	}
++
+ 	/* V4L2 controls values will be applied only when power is already up */
+ 	if (!pm_runtime_get_if_in_use(imx290->dev))
+ 		return 0;
+@@ -692,9 +711,23 @@ static int imx290_set_ctrl(struct v4l2_c
+ 		ret = imx290_write(imx290, IMX290_GAIN, ctrl->val, NULL);
+ 		break;
+ 
++	case V4L2_CID_VBLANK:
++		ret = imx290_write(imx290, IMX290_VMAX,
++				   ctrl->val + imx290->current_mode->height,
++				   NULL);
++		/*
++		 * Due to the way that exposure is programmed in this sensor in
++		 * relation to VMAX, we have to reprogramme it whenever VMAX is
++		 * changed.
++		 * Update ctrl so that the V4L2_CID_EXPOSURE case can refer to
++		 * it.
++		 */
++		ctrl = imx290->exposure;
++		fallthrough;
+ 	case V4L2_CID_EXPOSURE:
++		vmax = imx290->vblank->val + imx290->current_mode->height;
+ 		ret = imx290_write(imx290, IMX290_SHS1,
+-				   IMX290_VMAX_DEFAULT - ctrl->val - 1, NULL);
++				   vmax - ctrl->val - 1, NULL);
+ 		break;
+ 
+ 	case V4L2_CID_TEST_PATTERN:
+@@ -751,13 +784,15 @@ static void imx290_ctrl_update(struct im
+ {
+ 	unsigned int hblank_min = mode->hmax_min - mode->width;
+ 	unsigned int hblank_max = IMX290_HMAX_MAX - mode->width;
+-	unsigned int vblank = IMX290_VMAX_DEFAULT - mode->height;
++	unsigned int vblank_min = IMX290_VMAX_DEFAULT - mode->height;
++	unsigned int vblank_max = IMX290_VMAX_MAX - mode->height;
+ 
+ 	__v4l2_ctrl_s_ctrl(imx290->link_freq, mode->link_freq_index);
+ 
+ 	__v4l2_ctrl_modify_range(imx290->hblank, hblank_min, hblank_max, 1,
+ 				 hblank_min);
+-	__v4l2_ctrl_modify_range(imx290->vblank, vblank, vblank, 1, vblank);
++	__v4l2_ctrl_modify_range(imx290->vblank, vblank_min, vblank_max, 1,
++				 vblank_min);
+ }
+ 
+ static int imx290_ctrl_init(struct imx290 *imx290)
+@@ -787,9 +822,13 @@ static int imx290_ctrl_init(struct imx29
+ 	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+ 			  V4L2_CID_ANALOGUE_GAIN, 0, 100, 1, 0);
+ 
+-	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-			  V4L2_CID_EXPOSURE, 1, IMX290_VMAX_DEFAULT - 2, 1,
+-			  IMX290_VMAX_DEFAULT - 2);
++	/*
++	 * Correct range will be determined through imx290_ctrl_update setting
++	 * V4L2_CID_VBLANK.
++	 */
++	imx290->exposure = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
++					     V4L2_CID_EXPOSURE, 1, 65535, 1,
++					     65535);
+ 
+ 	/*
+ 	 * Set the link frequency, pixel rate, horizontal blanking and vertical
+@@ -821,8 +860,6 @@ static int imx290_ctrl_init(struct imx29
+ 
+ 	imx290->vblank = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+ 					   V4L2_CID_VBLANK, 1, 1, 1, 1);
+-	if (imx290->vblank)
+-		imx290->vblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+ 
+ 	v4l2_ctrl_new_fwnode_properties(&imx290->ctrls, &imx290_ctrl_ops,
+ 					&props);
+@@ -1008,6 +1045,7 @@ static int imx290_set_fmt(struct v4l2_su
+ 		imx290->current_mode = mode;
+ 
+ 		imx290_ctrl_update(imx290, &fmt->format, mode);
++		imx290_exposure_update(imx290, mode);
+ 	}
+ 
+ 	*format = fmt->format;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0663-media-i2c-imx290-VMAX-is-mode-dependent.patch b/target/linux/bcm27xx/patches-6.1/950-0663-media-i2c-imx290-VMAX-is-mode-dependent.patch
new file mode 100644
index 00000000000000..56d94855dd86e5
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0663-media-i2c-imx290-VMAX-is-mode-dependent.patch
@@ -0,0 +1,82 @@
+From ea3632a2047fe42351c806dddb3d42f96137876e Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 16 Feb 2023 00:29:59 +0200
+Subject: [PATCH] media: i2c: imx290: VMAX is mode dependent
+
+Should be upstream commit b3aa351ea88a
+
+The default VMAX for 60fps in 720p mode is 750 according to the
+datasheet, however the driver always left it at 1125 thereby stopping
+60fps being achieved.
+
+Make VMAX (and therefore V4L2_CID_VBLANK) mode dependent so that 720p60
+can be achieved.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -113,8 +113,6 @@
+ /* Number of lines by which exposure must be less than VMAX */
+ #define IMX290_EXPOSURE_OFFSET				2
+ 
+-#define IMX290_VMAX_DEFAULT				1125
+-
+ #define IMX290_PIXEL_RATE				148500000
+ 
+ /*
+@@ -192,6 +190,7 @@ struct imx290_mode {
+ 	u32 width;
+ 	u32 height;
+ 	u32 hmax_min;
++	u32 vmax_min;
+ 	u8 link_freq_index;
+ 
+ 	const struct imx290_regval *data;
+@@ -435,6 +434,7 @@ static const struct imx290_mode imx290_m
+ 		.width = 1920,
+ 		.height = 1080,
+ 		.hmax_min = 2200,
++		.vmax_min = 1125,
+ 		.link_freq_index = FREQ_INDEX_1080P,
+ 		.data = imx290_1080p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_1080p_settings),
+@@ -443,6 +443,7 @@ static const struct imx290_mode imx290_m
+ 		.width = 1280,
+ 		.height = 720,
+ 		.hmax_min = 3300,
++		.vmax_min = 750,
+ 		.link_freq_index = FREQ_INDEX_720P,
+ 		.data = imx290_720p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_720p_settings),
+@@ -454,6 +455,7 @@ static const struct imx290_mode imx290_m
+ 		.width = 1920,
+ 		.height = 1080,
+ 		.hmax_min = 2200,
++		.vmax_min = 1125,
+ 		.link_freq_index = FREQ_INDEX_1080P,
+ 		.data = imx290_1080p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_1080p_settings),
+@@ -462,6 +464,7 @@ static const struct imx290_mode imx290_m
+ 		.width = 1280,
+ 		.height = 720,
+ 		.hmax_min = 3300,
++		.vmax_min = 750,
+ 		.link_freq_index = FREQ_INDEX_720P,
+ 		.data = imx290_720p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_720p_settings),
+@@ -784,7 +787,7 @@ static void imx290_ctrl_update(struct im
+ {
+ 	unsigned int hblank_min = mode->hmax_min - mode->width;
+ 	unsigned int hblank_max = IMX290_HMAX_MAX - mode->width;
+-	unsigned int vblank_min = IMX290_VMAX_DEFAULT - mode->height;
++	unsigned int vblank_min = mode->vmax_min - mode->height;
+ 	unsigned int vblank_max = IMX290_VMAX_MAX - mode->height;
+ 
+ 	__v4l2_ctrl_s_ctrl(imx290->link_freq, mode->link_freq_index);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0664-media-i2c-imx290-Remove-duplicated-write-to-IMX290_C.patch b/target/linux/bcm27xx/patches-6.1/950-0664-media-i2c-imx290-Remove-duplicated-write-to-IMX290_C.patch
new file mode 100644
index 00000000000000..477f8ebd6c86d8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0664-media-i2c-imx290-Remove-duplicated-write-to-IMX290_C.patch
@@ -0,0 +1,33 @@
+From e6d94416e7585b5c9b3f5ed0d8de86e57d8da3bb Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 16 Feb 2023 00:30:00 +0200
+Subject: [PATCH] media: i2c: imx290: Remove duplicated write to
+ IMX290_CTRL_07
+
+Should be upstream commit 454ce4c6d77b
+
+IMX290_CTRL_07 was written from both imx290_global_init_settings
+and imx290_1080p_settings and imx290_720p_settings.
+
+Remove it from imx290_global_init_settings as the setting varies
+based on the mode.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -241,7 +241,6 @@ static inline struct imx290 *to_imx290(s
+  */
+ 
+ static const struct imx290_regval imx290_global_init_settings[] = {
+-	{ IMX290_CTRL_07, IMX290_WINMODE_1080P },
+ 	{ IMX290_EXTCK_FREQ, 0x2520 },
+ 	{ IMX290_WINWV_OB, 12 },
+ 	{ IMX290_WINPH, 0 },
diff --git a/target/linux/bcm27xx/patches-6.1/950-0665-media-i2c-imx290-Add-support-for-74.25MHz-external-c.patch b/target/linux/bcm27xx/patches-6.1/950-0665-media-i2c-imx290-Add-support-for-74.25MHz-external-c.patch
new file mode 100644
index 00000000000000..dfbc541c80a663
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0665-media-i2c-imx290-Add-support-for-74.25MHz-external-c.patch
@@ -0,0 +1,274 @@
+From dcef754861ddd47e88f722abefc768410f1a17d1 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 16 Feb 2023 00:30:01 +0200
+Subject: [PATCH] media: i2c: imx290: Add support for 74.25MHz external
+ clock
+
+Should be upstream commit b8b86dfe1aee
+
+The sensor supports either a 37.125 or 74.25MHz external, but
+the driver only supported 37.125MHz.
+
+Add the relevant register configuration for either clock
+frequency option.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 132 ++++++++++++++++++++++++++++++++-----
+ 1 file changed, 116 insertions(+), 16 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -105,6 +105,7 @@
+ #define IMX290_TCLKPREPARE				IMX290_REG_16BIT(0x3452)
+ #define IMX290_TLPX					IMX290_REG_16BIT(0x3454)
+ #define IMX290_X_OUT_SIZE				IMX290_REG_16BIT(0x3472)
++#define IMX290_INCKSEL7					IMX290_REG_8BIT(0x3480)
+ 
+ #define IMX290_PGCTRL_REGEN				BIT(0)
+ #define IMX290_PGCTRL_THRU				BIT(1)
+@@ -181,11 +182,29 @@ struct imx290_model_info {
+ 	enum imx290_colour_variant colour_variant;
+ };
+ 
++enum imx290_clk_freq {
++	IMX290_CLK_37_125,
++	IMX290_CLK_74_25,
++	IMX290_NUM_CLK
++};
++
+ struct imx290_regval {
+ 	u32 reg;
+ 	u32 val;
+ };
+ 
++/*
++ * Clock configuration for registers INCKSEL1 to INCKSEL6.
++ */
++struct imx290_clk_cfg {
++	u8 incksel1;
++	u8 incksel2;
++	u8 incksel3;
++	u8 incksel4;
++	u8 incksel5;
++	u8 incksel6;
++};
++
+ struct imx290_mode {
+ 	u32 width;
+ 	u32 height;
+@@ -195,6 +214,8 @@ struct imx290_mode {
+ 
+ 	const struct imx290_regval *data;
+ 	u32 data_size;
++
++	const struct imx290_clk_cfg *clk_cfg;
+ };
+ 
+ struct imx290_csi_cfg {
+@@ -213,6 +234,7 @@ struct imx290 {
+ 	struct device *dev;
+ 	struct clk *xclk;
+ 	struct regmap *regmap;
++	enum imx290_clk_freq xclk_idx;
+ 	u8 nlanes;
+ 	const struct imx290_model_info *model;
+ 
+@@ -241,7 +263,6 @@ static inline struct imx290 *to_imx290(s
+  */
+ 
+ static const struct imx290_regval imx290_global_init_settings[] = {
+-	{ IMX290_EXTCK_FREQ, 0x2520 },
+ 	{ IMX290_WINWV_OB, 12 },
+ 	{ IMX290_WINPH, 0 },
+ 	{ IMX290_WINPV, 0 },
+@@ -291,7 +312,18 @@ static const struct imx290_regval imx290
+ 	{ IMX290_REG_8BIT(0x33b0), 0x50 },
+ 	{ IMX290_REG_8BIT(0x33b2), 0x1a },
+ 	{ IMX290_REG_8BIT(0x33b3), 0x04 },
+-	{ IMX290_REG_8BIT(0x3480), 0x49 },
++};
++
++#define IMX290_NUM_CLK_REGS	2
++static const struct imx290_regval xclk_regs[][IMX290_NUM_CLK_REGS] = {
++	[IMX290_CLK_37_125] = {
++		{ IMX290_EXTCK_FREQ, (37125 * 256) / 1000 },
++		{ IMX290_INCKSEL7, 0x49 },
++	},
++	[IMX290_CLK_74_25] = {
++		{ IMX290_EXTCK_FREQ, (74250 * 256) / 1000 },
++		{ IMX290_INCKSEL7, 0x92 },
++	},
+ };
+ 
+ static const struct imx290_regval imx290_1080p_settings[] = {
+@@ -301,12 +333,6 @@ static const struct imx290_regval imx290
+ 	{ IMX290_OPB_SIZE_V, 10 },
+ 	{ IMX290_X_OUT_SIZE, 1920 },
+ 	{ IMX290_Y_OUT_SIZE, 1080 },
+-	{ IMX290_INCKSEL1, 0x18 },
+-	{ IMX290_INCKSEL2, 0x03 },
+-	{ IMX290_INCKSEL3, 0x20 },
+-	{ IMX290_INCKSEL4, 0x01 },
+-	{ IMX290_INCKSEL5, 0x1a },
+-	{ IMX290_INCKSEL6, 0x1a },
+ };
+ 
+ static const struct imx290_regval imx290_720p_settings[] = {
+@@ -316,12 +342,6 @@ static const struct imx290_regval imx290
+ 	{ IMX290_OPB_SIZE_V, 4 },
+ 	{ IMX290_X_OUT_SIZE, 1280 },
+ 	{ IMX290_Y_OUT_SIZE, 720 },
+-	{ IMX290_INCKSEL1, 0x20 },
+-	{ IMX290_INCKSEL2, 0x00 },
+-	{ IMX290_INCKSEL3, 0x20 },
+-	{ IMX290_INCKSEL4, 0x01 },
+-	{ IMX290_INCKSEL5, 0x1a },
+-	{ IMX290_INCKSEL6, 0x1a },
+ };
+ 
+ static const struct imx290_regval imx290_10bit_settings[] = {
+@@ -427,6 +447,48 @@ static inline int imx290_link_freqs_num(
+ 		return ARRAY_SIZE(imx290_link_freq_4lanes);
+ }
+ 
++static const struct imx290_clk_cfg imx290_1080p_clock_config[] = {
++	[IMX290_CLK_37_125] = {
++		/* 37.125MHz clock config */
++		.incksel1 = 0x18,
++		.incksel2 = 0x03,
++		.incksel3 = 0x20,
++		.incksel4 = 0x01,
++		.incksel5 = 0x1a,
++		.incksel6 = 0x1a,
++	},
++	[IMX290_CLK_74_25] = {
++		/* 74.25MHz clock config */
++		.incksel1 = 0x0c,
++		.incksel2 = 0x03,
++		.incksel3 = 0x10,
++		.incksel4 = 0x01,
++		.incksel5 = 0x1b,
++		.incksel6 = 0x1b,
++	},
++};
++
++static const struct imx290_clk_cfg imx290_720p_clock_config[] = {
++	[IMX290_CLK_37_125] = {
++		/* 37.125MHz clock config */
++		.incksel1 = 0x20,
++		.incksel2 = 0x00,
++		.incksel3 = 0x20,
++		.incksel4 = 0x01,
++		.incksel5 = 0x1a,
++		.incksel6 = 0x1a,
++	},
++	[IMX290_CLK_74_25] = {
++		/* 74.25MHz clock config */
++		.incksel1 = 0x10,
++		.incksel2 = 0x00,
++		.incksel3 = 0x10,
++		.incksel4 = 0x01,
++		.incksel5 = 0x1b,
++		.incksel6 = 0x1b,
++	},
++};
++
+ /* Mode configs */
+ static const struct imx290_mode imx290_modes_2lanes[] = {
+ 	{
+@@ -437,6 +499,7 @@ static const struct imx290_mode imx290_m
+ 		.link_freq_index = FREQ_INDEX_1080P,
+ 		.data = imx290_1080p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_1080p_settings),
++		.clk_cfg = imx290_1080p_clock_config,
+ 	},
+ 	{
+ 		.width = 1280,
+@@ -446,6 +509,7 @@ static const struct imx290_mode imx290_m
+ 		.link_freq_index = FREQ_INDEX_720P,
+ 		.data = imx290_720p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_720p_settings),
++		.clk_cfg = imx290_720p_clock_config,
+ 	},
+ };
+ 
+@@ -458,6 +522,7 @@ static const struct imx290_mode imx290_m
+ 		.link_freq_index = FREQ_INDEX_1080P,
+ 		.data = imx290_1080p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_1080p_settings),
++		.clk_cfg = imx290_1080p_clock_config,
+ 	},
+ 	{
+ 		.width = 1280,
+@@ -467,6 +532,7 @@ static const struct imx290_mode imx290_m
+ 		.link_freq_index = FREQ_INDEX_720P,
+ 		.data = imx290_720p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_720p_settings),
++		.clk_cfg = imx290_720p_clock_config,
+ 	},
+ };
+ 
+@@ -592,6 +658,26 @@ static int imx290_set_register_array(str
+ 	return 0;
+ }
+ 
++static int imx290_set_clock(struct imx290 *imx290)
++{
++	const struct imx290_mode *mode = imx290->current_mode;
++	enum imx290_clk_freq clk_idx = imx290->xclk_idx;
++	const struct imx290_clk_cfg *clk_cfg = &mode->clk_cfg[clk_idx];
++	int ret;
++
++	ret = imx290_set_register_array(imx290, xclk_regs[clk_idx],
++					IMX290_NUM_CLK_REGS);
++
++	imx290_write(imx290, IMX290_INCKSEL1, clk_cfg->incksel1, &ret);
++	imx290_write(imx290, IMX290_INCKSEL2, clk_cfg->incksel2, &ret);
++	imx290_write(imx290, IMX290_INCKSEL3, clk_cfg->incksel3, &ret);
++	imx290_write(imx290, IMX290_INCKSEL4, clk_cfg->incksel4, &ret);
++	imx290_write(imx290, IMX290_INCKSEL5, clk_cfg->incksel5, &ret);
++	imx290_write(imx290, IMX290_INCKSEL6, clk_cfg->incksel6, &ret);
++
++	return ret;
++}
++
+ static int imx290_set_data_lanes(struct imx290 *imx290)
+ {
+ 	int ret = 0;
+@@ -896,6 +982,13 @@ static int imx290_start_streaming(struct
+ 		return ret;
+ 	}
+ 
++	/* Set clock parameters based on mode and xclk */
++	ret = imx290_set_clock(imx290);
++	if (ret < 0) {
++		dev_err(imx290->dev, "Could not set clocks\n");
++		return ret;
++	}
++
+ 	/* Set data lane count */
+ 	ret = imx290_set_data_lanes(imx290);
+ 	if (ret < 0) {
+@@ -1295,8 +1388,15 @@ static int imx290_init_clk(struct imx290
+ 		return ret;
+ 	}
+ 
+-	/* external clock must be 37.125 MHz */
+-	if (xclk_freq != 37125000) {
++	/* external clock must be 37.125 MHz or 74.25MHz */
++	switch (xclk_freq) {
++	case 37125000:
++		imx290->xclk_idx = IMX290_CLK_37_125;
++		break;
++	case 74250000:
++		imx290->xclk_idx = IMX290_CLK_74_25;
++		break;
++	default:
+ 		dev_err(imx290->dev, "External clock frequency %u is not supported\n",
+ 			xclk_freq);
+ 		return -EINVAL;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0666-media-i2c-imx290-Add-support-for-H-V-Flips.patch b/target/linux/bcm27xx/patches-6.1/950-0666-media-i2c-imx290-Add-support-for-H-V-Flips.patch
new file mode 100644
index 00000000000000..d3cf5de51d7b29
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0666-media-i2c-imx290-Add-support-for-H-V-Flips.patch
@@ -0,0 +1,176 @@
+From bb0085733894a1292fb0ca4c397caec84a7c2502 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 16 Feb 2023 00:30:02 +0200
+Subject: [PATCH] media: i2c: imx290: Add support for H & V Flips
+
+Should be upstream commit 42765b80f8c6
+
+The sensor supports H & V flips, so add the relevant hooks for
+V4L2_CID_HFLIP and V4L2_CID_VFLIP to configure them.
+
+Note that the Bayer order is maintained as the readout area
+shifts by 1 pixel in the appropriate direction (note the
+comment about the top margin being 8 pixels whilst the bottom
+margin is 9). The V4L2_SEL_TGT_CROP region is therefore
+adjusted appropriately.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 51 ++++++++++++++++++++++++++++++++++----
+ 1 file changed, 46 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -211,6 +211,7 @@ struct imx290_mode {
+ 	u32 hmax_min;
+ 	u32 vmax_min;
+ 	u8 link_freq_index;
++	u8 ctrl_07;
+ 
+ 	const struct imx290_regval *data;
+ 	u32 data_size;
+@@ -251,6 +252,10 @@ struct imx290 {
+ 	struct v4l2_ctrl *hblank;
+ 	struct v4l2_ctrl *vblank;
+ 	struct v4l2_ctrl *exposure;
++	struct {
++		struct v4l2_ctrl *hflip;
++		struct v4l2_ctrl *vflip;
++	};
+ };
+ 
+ static inline struct imx290 *to_imx290(struct v4l2_subdev *_sd)
+@@ -328,7 +333,6 @@ static const struct imx290_regval xclk_r
+ 
+ static const struct imx290_regval imx290_1080p_settings[] = {
+ 	/* mode settings */
+-	{ IMX290_CTRL_07, IMX290_WINMODE_1080P },
+ 	{ IMX290_WINWV_OB, 12 },
+ 	{ IMX290_OPB_SIZE_V, 10 },
+ 	{ IMX290_X_OUT_SIZE, 1920 },
+@@ -337,7 +341,6 @@ static const struct imx290_regval imx290
+ 
+ static const struct imx290_regval imx290_720p_settings[] = {
+ 	/* mode settings */
+-	{ IMX290_CTRL_07, IMX290_WINMODE_720P },
+ 	{ IMX290_WINWV_OB, 6 },
+ 	{ IMX290_OPB_SIZE_V, 4 },
+ 	{ IMX290_X_OUT_SIZE, 1280 },
+@@ -497,6 +500,7 @@ static const struct imx290_mode imx290_m
+ 		.hmax_min = 2200,
+ 		.vmax_min = 1125,
+ 		.link_freq_index = FREQ_INDEX_1080P,
++		.ctrl_07 = IMX290_WINMODE_1080P,
+ 		.data = imx290_1080p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_1080p_settings),
+ 		.clk_cfg = imx290_1080p_clock_config,
+@@ -507,6 +511,7 @@ static const struct imx290_mode imx290_m
+ 		.hmax_min = 3300,
+ 		.vmax_min = 750,
+ 		.link_freq_index = FREQ_INDEX_720P,
++		.ctrl_07 = IMX290_WINMODE_720P,
+ 		.data = imx290_720p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_720p_settings),
+ 		.clk_cfg = imx290_720p_clock_config,
+@@ -520,6 +525,7 @@ static const struct imx290_mode imx290_m
+ 		.hmax_min = 2200,
+ 		.vmax_min = 1125,
+ 		.link_freq_index = FREQ_INDEX_1080P,
++		.ctrl_07 = IMX290_WINMODE_1080P,
+ 		.data = imx290_1080p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_1080p_settings),
+ 		.clk_cfg = imx290_1080p_clock_config,
+@@ -530,6 +536,7 @@ static const struct imx290_mode imx290_m
+ 		.hmax_min = 3300,
+ 		.vmax_min = 750,
+ 		.link_freq_index = FREQ_INDEX_720P,
++		.ctrl_07 = IMX290_WINMODE_720P,
+ 		.data = imx290_720p_settings,
+ 		.data_size = ARRAY_SIZE(imx290_720p_settings),
+ 		.clk_cfg = imx290_720p_clock_config,
+@@ -840,6 +847,20 @@ static int imx290_set_ctrl(struct v4l2_c
+ 				   NULL);
+ 		break;
+ 
++	case V4L2_CID_HFLIP:
++	case V4L2_CID_VFLIP:
++	{
++		u32 reg;
++
++		reg = imx290->current_mode->ctrl_07;
++		if (imx290->hflip->val)
++			reg |= IMX290_HREVERSE;
++		if (imx290->vflip->val)
++			reg |= IMX290_VREVERSE;
++		ret = imx290_write(imx290, IMX290_CTRL_07, reg, NULL);
++		break;
++	}
++
+ 	default:
+ 		ret = -EINVAL;
+ 		break;
+@@ -892,7 +913,7 @@ static int imx290_ctrl_init(struct imx29
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	v4l2_ctrl_handler_init(&imx290->ctrls, 9);
++	v4l2_ctrl_handler_init(&imx290->ctrls, 11);
+ 
+ 	/*
+ 	 * The sensor has an analog gain and a digital gain, both controlled
+@@ -949,6 +970,12 @@ static int imx290_ctrl_init(struct imx29
+ 	imx290->vblank = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+ 					   V4L2_CID_VBLANK, 1, 1, 1, 1);
+ 
++	imx290->hflip = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
++					  V4L2_CID_HFLIP, 0, 1, 1, 0);
++	imx290->vflip = v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
++					  V4L2_CID_VFLIP, 0, 1, 1, 0);
++	v4l2_ctrl_cluster(2, &imx290->hflip);
++
+ 	v4l2_ctrl_new_fwnode_properties(&imx290->ctrls, &imx290_ctrl_ops,
+ 					&props);
+ 
+@@ -1070,6 +1097,13 @@ static int imx290_set_stream(struct v4l2
+ 		pm_runtime_put_autosuspend(imx290->dev);
+ 	}
+ 
++	/*
++	 * vflip and hflip should not be changed during streaming as the sensor
++	 * will produce an invalid frame.
++	 */
++	__v4l2_ctrl_grab(imx290->vflip, enable);
++	__v4l2_ctrl_grab(imx290->hflip, enable);
++
+ unlock:
+ 	v4l2_subdev_unlock_state(state);
+ 	return ret;
+@@ -1152,16 +1186,23 @@ static int imx290_get_selection(struct v
+ 				struct v4l2_subdev_state *sd_state,
+ 				struct v4l2_subdev_selection *sel)
+ {
++	struct imx290 *imx290 = to_imx290(sd);
+ 	struct v4l2_mbus_framefmt *format;
+ 
+ 	switch (sel->target) {
+ 	case V4L2_SEL_TGT_CROP: {
+ 		format = v4l2_subdev_get_pad_format(sd, sd_state, 0);
+ 
++		/*
++		 * The sensor moves the readout by 1 pixel based on flips to
++		 * keep the Bayer order the same.
++		 */
+ 		sel->r.top = IMX920_PIXEL_ARRAY_MARGIN_TOP
+-			   + (IMX290_PIXEL_ARRAY_RECORDING_HEIGHT - format->height) / 2;
++			   + (IMX290_PIXEL_ARRAY_RECORDING_HEIGHT - format->height) / 2
++			   + imx290->vflip->val;
+ 		sel->r.left = IMX920_PIXEL_ARRAY_MARGIN_LEFT
+-			    + (IMX290_PIXEL_ARRAY_RECORDING_WIDTH - format->width) / 2;
++			    + (IMX290_PIXEL_ARRAY_RECORDING_WIDTH - format->width) / 2
++			    + imx290->hflip->val;
+ 		sel->r.width = format->width;
+ 		sel->r.height = format->height;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0667-media-i2c-imx290-Add-the-error-code-to-logs-in-start.patch b/target/linux/bcm27xx/patches-6.1/950-0667-media-i2c-imx290-Add-the-error-code-to-logs-in-start.patch
new file mode 100644
index 00000000000000..9f4eed6111f4d0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0667-media-i2c-imx290-Add-the-error-code-to-logs-in-start.patch
@@ -0,0 +1,72 @@
+From ca2e3e4cb1704ae28a15e889165bf5f319dcb905 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 16 Feb 2023 00:30:03 +0200
+Subject: [PATCH] media: i2c: imx290: Add the error code to logs in
+ start_streaming
+
+Should be upstream commit 5fcaecd6b5aa
+
+imx290_start_streaming logs what failed, but not the error
+code from that function. Add it into the log message.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -1012,20 +1012,20 @@ static int imx290_start_streaming(struct
+ 	/* Set clock parameters based on mode and xclk */
+ 	ret = imx290_set_clock(imx290);
+ 	if (ret < 0) {
+-		dev_err(imx290->dev, "Could not set clocks\n");
++		dev_err(imx290->dev, "Could not set clocks - %d\n", ret);
+ 		return ret;
+ 	}
+ 
+ 	/* Set data lane count */
+ 	ret = imx290_set_data_lanes(imx290);
+ 	if (ret < 0) {
+-		dev_err(imx290->dev, "Could not set data lanes\n");
++		dev_err(imx290->dev, "Could not set data lanes - %d\n", ret);
+ 		return ret;
+ 	}
+ 
+ 	ret = imx290_set_csi_config(imx290);
+ 	if (ret < 0) {
+-		dev_err(imx290->dev, "Could not set csi cfg\n");
++		dev_err(imx290->dev, "Could not set csi cfg - %d\n", ret);
+ 		return ret;
+ 	}
+ 
+@@ -1033,7 +1033,7 @@ static int imx290_start_streaming(struct
+ 	format = v4l2_subdev_get_pad_format(&imx290->sd, state, 0);
+ 	ret = imx290_setup_format(imx290, format);
+ 	if (ret < 0) {
+-		dev_err(imx290->dev, "Could not set frame format\n");
++		dev_err(imx290->dev, "Could not set frame format - %d\n", ret);
+ 		return ret;
+ 	}
+ 
+@@ -1041,14 +1041,14 @@ static int imx290_start_streaming(struct
+ 	ret = imx290_set_register_array(imx290, imx290->current_mode->data,
+ 					imx290->current_mode->data_size);
+ 	if (ret < 0) {
+-		dev_err(imx290->dev, "Could not set current mode\n");
++		dev_err(imx290->dev, "Could not set current mode - %d\n", ret);
+ 		return ret;
+ 	}
+ 
+ 	/* Apply customized values from user */
+ 	ret = __v4l2_ctrl_handler_setup(imx290->sd.ctrl_handler);
+ 	if (ret) {
+-		dev_err(imx290->dev, "Could not sync v4l2 controls\n");
++		dev_err(imx290->dev, "Could not sync v4l2 controls - %d\n", ret);
+ 		return ret;
+ 	}
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0668-media-i2c-imx290-Add-support-for-imx327-variant.patch b/target/linux/bcm27xx/patches-6.1/950-0668-media-i2c-imx290-Add-support-for-imx327-variant.patch
new file mode 100644
index 00000000000000..eddee2a78c0bbb
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0668-media-i2c-imx290-Add-support-for-imx327-variant.patch
@@ -0,0 +1,122 @@
+From 953826015a003f08f033d33e09799a5380c1b5ae Mon Sep 17 00:00:00 2001
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+Date: Fri, 17 Feb 2023 10:52:21 +0100
+Subject: [PATCH] media: i2c: imx290: Add support for imx327 variant
+
+Should be upstream commit 3c3f66b8125a
+
+Both sensors are quite similar. Their specs only differ regarding LVDS
+and parallel output but are identical regarding MIPI-CSI-2 interface.
+But they use a different init setting of hard-coded values, taken from
+the datasheet.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+---
+ drivers/media/i2c/imx290.c | 44 ++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 42 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -176,10 +176,14 @@ enum imx290_colour_variant {
+ enum imx290_model {
+ 	IMX290_MODEL_IMX290LQR,
+ 	IMX290_MODEL_IMX290LLR,
++	IMX290_MODEL_IMX327LQR,
+ };
+ 
+ struct imx290_model_info {
+ 	enum imx290_colour_variant colour_variant;
++	const struct imx290_regval *init_regs;
++	size_t init_regs_num;
++	const char *name;
+ };
+ 
+ enum imx290_clk_freq {
+@@ -275,10 +279,14 @@ static const struct imx290_regval imx290
+ 	{ IMX290_WINWV, 1097 },
+ 	{ IMX290_XSOUTSEL, IMX290_XSOUTSEL_XVSOUTSEL_VSYNC |
+ 			   IMX290_XSOUTSEL_XHSOUTSEL_HSYNC },
+-	{ IMX290_REG_8BIT(0x300f), 0x00 },
+-	{ IMX290_REG_8BIT(0x3010), 0x21 },
++	{ IMX290_REG_8BIT(0x3011), 0x02 },
+ 	{ IMX290_REG_8BIT(0x3012), 0x64 },
+ 	{ IMX290_REG_8BIT(0x3013), 0x00 },
++};
++
++static const struct imx290_regval imx290_global_init_settings_290[] = {
++	{ IMX290_REG_8BIT(0x300f), 0x00 },
++	{ IMX290_REG_8BIT(0x3010), 0x21 },
+ 	{ IMX290_REG_8BIT(0x3016), 0x09 },
+ 	{ IMX290_REG_8BIT(0x3070), 0x02 },
+ 	{ IMX290_REG_8BIT(0x3071), 0x11 },
+@@ -331,6 +339,12 @@ static const struct imx290_regval xclk_r
+ 	},
+ };
+ 
++static const struct imx290_regval imx290_global_init_settings_327[] = {
++	{ IMX290_REG_8BIT(0x309e), 0x4A },
++	{ IMX290_REG_8BIT(0x309f), 0x4A },
++	{ IMX290_REG_8BIT(0x313b), 0x61 },
++};
++
+ static const struct imx290_regval imx290_1080p_settings[] = {
+ 	/* mode settings */
+ 	{ IMX290_WINWV_OB, 12 },
+@@ -1009,6 +1023,14 @@ static int imx290_start_streaming(struct
+ 		return ret;
+ 	}
+ 
++	/* Set mdel specific init register settings */
++	ret = imx290_set_register_array(imx290, imx290->model->init_regs,
++					imx290->model->init_regs_num);
++	if (ret < 0) {
++		dev_err(imx290->dev, "Could not set model specific init registers\n");
++		return ret;
++	}
++
+ 	/* Set clock parameters based on mode and xclk */
+ 	ret = imx290_set_clock(imx290);
+ 	if (ret < 0) {
+@@ -1477,9 +1499,21 @@ static s64 imx290_check_link_freqs(const
+ static const struct imx290_model_info imx290_models[] = {
+ 	[IMX290_MODEL_IMX290LQR] = {
+ 		.colour_variant = IMX290_VARIANT_COLOUR,
++		.init_regs = imx290_global_init_settings_290,
++		.init_regs_num = ARRAY_SIZE(imx290_global_init_settings_290),
++		.name = "imx290",
+ 	},
+ 	[IMX290_MODEL_IMX290LLR] = {
+ 		.colour_variant = IMX290_VARIANT_MONO,
++		.init_regs = imx290_global_init_settings_290,
++		.init_regs_num = ARRAY_SIZE(imx290_global_init_settings_290),
++		.name = "imx290",
++	},
++	[IMX290_MODEL_IMX327LQR] = {
++		.colour_variant = IMX290_VARIANT_COLOUR,
++		.init_regs = imx290_global_init_settings_327,
++		.init_regs_num = ARRAY_SIZE(imx290_global_init_settings_327),
++		.name = "imx327",
+ 	},
+ };
+ 
+@@ -1612,6 +1646,9 @@ static int imx290_probe(struct i2c_clien
+ 	if (ret)
+ 		goto err_pm;
+ 
++	v4l2_i2c_subdev_set_name(&imx290->sd, client,
++				 imx290->model->name, NULL);
++
+ 	/*
+ 	 * Finally, register the V4L2 subdev. This must be done after
+ 	 * initializing everything as the subdev can be used immediately after
+@@ -1670,6 +1707,9 @@ static const struct of_device_id imx290_
+ 	}, {
+ 		.compatible = "sony,imx290llr",
+ 		.data = &imx290_models[IMX290_MODEL_IMX290LLR],
++	}, {
++		.compatible = "sony,imx327lqr",
++		.data = &imx290_models[IMX290_MODEL_IMX327LQR],
+ 	},
+ 	{ /* sentinel */ },
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0669-dtoverlays-Update-compatible-strings-for-imx290-327-.patch b/target/linux/bcm27xx/patches-6.1/950-0669-dtoverlays-Update-compatible-strings-for-imx290-327-.patch
new file mode 100644
index 00000000000000..31e19be15ef6b4
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0669-dtoverlays-Update-compatible-strings-for-imx290-327-.patch
@@ -0,0 +1,92 @@
+From 50b181819224c717a468ced24ec7106e87b02dcd Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 28 Mar 2023 15:16:57 +0100
+Subject: [PATCH] dtoverlays: Update compatible strings for
+ imx290/327/462
+
+Now upstream have accepted patches adding a mono version of
+IMX290, and IMX327, update the compatible strings in the overlays
+to match.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/imx290-overlay.dts | 4 ++--
+ arch/arm/boot/dts/overlays/imx290_327.dtsi    | 2 +-
+ arch/arm/boot/dts/overlays/imx327-overlay.dts | 5 +++--
+ arch/arm/boot/dts/overlays/imx462-overlay.dts | 6 ++++--
+ 4 files changed, 10 insertions(+), 7 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/imx290-overlay.dts
++++ b/arch/arm/boot/dts/overlays/imx290-overlay.dts
+@@ -15,14 +15,14 @@
+ 	fragment@101 {
+ 		target = <&cam_node>;
+ 		__overlay__ {
+-			compatible = "sony,imx290";
++			compatible = "sony,imx290lqr";
+ 		};
+ 	};
+ 
+ 	fragment@102 {
+ 		target = <&cam_node>;
+ 		__dormant__ {
+-			compatible = "sony,imx290-mono";
++			compatible = "sony,imx290llr";
+ 		};
+ 	};
+ 
+--- a/arch/arm/boot/dts/overlays/imx290_327.dtsi
++++ b/arch/arm/boot/dts/overlays/imx290_327.dtsi
+@@ -1,7 +1,7 @@
+ // Fragment to configure and IMX290 / IMX327 / IMX462 image sensor
+ 
+ cam_node: imx290@1a {
+-	compatible = "sony,imx290";
++	compatible = "sony,imx290lqr";
+ 	reg = <0x1a>;
+ 	status = "disabled";
+ 
+--- a/arch/arm/boot/dts/overlays/imx327-overlay.dts
++++ b/arch/arm/boot/dts/overlays/imx327-overlay.dts
+@@ -15,14 +15,15 @@
+ 	fragment@101 {
+ 		target = <&cam_node>;
+ 		__overlay__ {
+-			compatible = "sony,imx327";
++			compatible = "sony,imx327lqr";
+ 		};
+ 	};
+ 
+ 	fragment@102 {
+ 		target = <&cam_node>;
+ 		__dormant__ {
+-			compatible = "sony,imx327-mono";
++			// IMX327 mono is undefined in the binding - use imx290
++			compatible = "sony,imx290llr";
+ 		};
+ 	};
+ 
+--- a/arch/arm/boot/dts/overlays/imx462-overlay.dts
++++ b/arch/arm/boot/dts/overlays/imx462-overlay.dts
+@@ -12,17 +12,19 @@
+ 	// Fragment numbers deliberately high to avoid conflicts with the
+ 	// included imx290_327 overlay file.
+ 
++	//IMX462 is not defined in the bindings, so use IMX290 for now.
++
+ 	fragment@101 {
+ 		target = <&cam_node>;
+ 		__overlay__ {
+-			compatible = "sony,imx462";
++			compatible = "sony,imx290lqr";
+ 		};
+ 	};
+ 
+ 	fragment@102 {
+ 		target = <&cam_node>;
+ 		__dormant__ {
+-			compatible = "sony,imx462-mono";
++			compatible = "sony,imx290llr";
+ 		};
+ 	};
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0670-fbdev-Don-t-cancel-deferred-work-if-pagelist-empty.patch b/target/linux/bcm27xx/patches-6.1/950-0670-fbdev-Don-t-cancel-deferred-work-if-pagelist-empty.patch
new file mode 100644
index 00000000000000..35441799dd536a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0670-fbdev-Don-t-cancel-deferred-work-if-pagelist-empty.patch
@@ -0,0 +1,36 @@
+From a25b0ea78e73b699e89c6d5589ba43cd0a22f97e Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 29 Mar 2023 09:49:36 +0100
+Subject: [PATCH] fbdev: Don't cancel deferred work if pagelist empty
+
+Since [1], the fbdev deferred IO framework is careful to cancel
+pending updates on close to prevent dirty pages being accessed after
+they may have been reused. However, this is not necessary in the case
+that the pagelist is empty, and drivers that don't make use of the
+pagelist may have wanted updates cancelled for no good reason.
+
+Avoid penalising fbdev drivers that don't make use of the pagelist by
+making the cancelling of deferred IO on close conditional on there
+being a non-empty pagelist.
+
+See: https://github.com/raspberrypi/linux/issues/5398
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+[1] 3efc61d95259 ("fbdev: Fix invalid page access after closing deferred I/O devices")
+---
+ drivers/video/fbdev/core/fb_defio.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/video/fbdev/core/fb_defio.c
++++ b/drivers/video/fbdev/core/fb_defio.c
+@@ -321,7 +321,8 @@ static void fb_deferred_io_lastclose(str
+ 	struct page *page;
+ 	int i;
+ 
+-	cancel_delayed_work_sync(&info->deferred_work);
++	if (!list_empty(&info->fbdefio->pagereflist))
++		cancel_delayed_work_sync(&info->deferred_work);
+ 
+ 	/* clear out the mapping that we setup */
+ 	for (i = 0 ; i < info->fix.smem_len; i += PAGE_SIZE) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0671-usb-xhci-drop-and-add-the-endpoint-context-in-xhci_f.patch b/target/linux/bcm27xx/patches-6.1/950-0671-usb-xhci-drop-and-add-the-endpoint-context-in-xhci_f.patch
new file mode 100644
index 00000000000000..0146bbd6160d06
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0671-usb-xhci-drop-and-add-the-endpoint-context-in-xhci_f.patch
@@ -0,0 +1,30 @@
+From 0103035be2b28a8dbb5ccc207c61043d5eb1bc18 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Fri, 10 Mar 2023 14:21:42 +0000
+Subject: [PATCH] usb: xhci: drop and add the endpoint context in
+ xhci_fixup_endpoint()
+
+Setting both the Drop and Add bits on the input context prevents the
+corruption of split transactions seen with the BCM2711 XHCI controller,
+which is a dwc3 variant.
+
+This is a downstream feature that allows usbhid to restrict polling
+intervals on mice and keyboards, and was only tested on a VL805 which
+didn't complain about the fact the endpoint got added twice.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1730,7 +1730,7 @@ static void xhci_fixup_endpoint(struct u
+ 		return;
+ 	}
+ 	ctrl_ctx->add_flags = xhci_get_endpoint_flag_from_index(ep_index);
+-	ctrl_ctx->drop_flags = 0;
++	ctrl_ctx->drop_flags = ctrl_ctx->add_flags;
+ 
+ 	spin_unlock_irqrestore(&xhci->lock, flags);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0672-drivers-media-imx708-Increase-usable-link-frequencie.patch b/target/linux/bcm27xx/patches-6.1/950-0672-drivers-media-imx708-Increase-usable-link-frequencie.patch
new file mode 100644
index 00000000000000..46826279452a93
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0672-drivers-media-imx708-Increase-usable-link-frequencie.patch
@@ -0,0 +1,224 @@
+From 6efb946e6cb808c35e4fb620974c12244a95b4e7 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Fri, 31 Mar 2023 14:56:09 +0100
+Subject: [PATCH] drivers: media: imx708: Increase usable link
+ frequencies
+
+Add support for three different usable link frequencies (default 450Mhz,
+447Mhz, and 453MHz) for the IMX708 camera sensor. The choice of
+frequency is handled thorugh the "link-frequency" overlay parameter.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx708.c | 94 +++++++++++++++++++++++++++++++-------
+ 1 file changed, 78 insertions(+), 16 deletions(-)
+
+--- a/drivers/media/i2c/imx708.c
++++ b/drivers/media/i2c/imx708.c
+@@ -35,8 +35,6 @@
+ 
+ #define IMX708_XCLK_FREQ		24000000
+ 
+-#define IMX708_DEFAULT_LINK_FREQ	450000000
+-
+ /* Default initial pixel rate, will get updated for each mode. */
+ #define IMX708_INITIAL_PIXEL_RATE	590000000
+ 
+@@ -181,6 +179,50 @@ static const u8 pdaf_gains[2][9] = {
+ 	{ 0x35, 0x35, 0x35, 0x38, 0x3e, 0x46, 0x4c, 0x4c, 0x4c }
+ };
+ 
++/* Link frequency setup */
++enum {
++	IMX708_LINK_FREQ_450MHZ,
++	IMX708_LINK_FREQ_447MHZ,
++	IMX708_LINK_FREQ_453MHZ,
++};
++
++static const s64 link_freqs[] = {
++	[IMX708_LINK_FREQ_450MHZ] = 450000000,
++	[IMX708_LINK_FREQ_447MHZ] = 447000000,
++	[IMX708_LINK_FREQ_453MHZ] = 453000000,
++};
++
++/* 450MHz is the nominal "default" link frequency */
++static const struct imx708_reg link_450Mhz_regs[] = {
++	{0x030E, 0x01},
++	{0x030F, 0x2c},
++};
++
++static const struct imx708_reg link_447Mhz_regs[] = {
++	{0x030E, 0x01},
++	{0x030F, 0x2a},
++};
++
++static const struct imx708_reg link_453Mhz_regs[] = {
++	{0x030E, 0x01},
++	{0x030F, 0x2e},
++};
++
++static const struct imx708_reg_list link_freq_regs[] = {
++	[IMX708_LINK_FREQ_450MHZ] = {
++		.regs = link_450Mhz_regs,
++		.num_of_regs = ARRAY_SIZE(link_450Mhz_regs)
++	},
++	[IMX708_LINK_FREQ_447MHZ] = {
++		.regs = link_447Mhz_regs,
++		.num_of_regs = ARRAY_SIZE(link_447Mhz_regs)
++	},
++	[IMX708_LINK_FREQ_453MHZ] = {
++		.regs = link_453Mhz_regs,
++		.num_of_regs = ARRAY_SIZE(link_453Mhz_regs)
++	},
++};
++
+ static const struct imx708_reg mode_common_regs[] = {
+ 	{0x0100, 0x00},
+ 	{0x0136, 0x18},
+@@ -278,8 +320,6 @@ static const struct imx708_reg mode_4608
+ 	{0x0307, 0x7C},
+ 	{0x030B, 0x02},
+ 	{0x030D, 0x04},
+-	{0x030E, 0x01},
+-	{0x030F, 0x2C},
+ 	{0x0310, 0x01},
+ 	{0x3CA0, 0x00},
+ 	{0x3CA1, 0x64},
+@@ -376,8 +416,6 @@ static const struct imx708_reg mode_2x2b
+ 	{0x0307, 0x7A},
+ 	{0x030B, 0x02},
+ 	{0x030D, 0x04},
+-	{0x030E, 0x01},
+-	{0x030F, 0x2C},
+ 	{0x0310, 0x01},
+ 	{0x3CA0, 0x00},
+ 	{0x3CA1, 0x3C},
+@@ -472,8 +510,6 @@ static const struct imx708_reg mode_2x2b
+ 	{0x0307, 0x76},
+ 	{0x030B, 0x02},
+ 	{0x030D, 0x04},
+-	{0x030E, 0x01},
+-	{0x030F, 0x2C},
+ 	{0x0310, 0x01},
+ 	{0x3CA0, 0x00},
+ 	{0x3CA1, 0x3C},
+@@ -568,8 +604,6 @@ static const struct imx708_reg mode_hdr_
+ 	{0x0307, 0xA2},
+ 	{0x030B, 0x02},
+ 	{0x030D, 0x04},
+-	{0x030E, 0x01},
+-	{0x030F, 0x2C},
+ 	{0x0310, 0x01},
+ 	{0x3CA0, 0x00},
+ 	{0x3CA1, 0x00},
+@@ -795,6 +829,7 @@ struct imx708 {
+ 	struct v4l2_ctrl *blue_balance;
+ 	struct v4l2_ctrl *notify_gains;
+ 	struct v4l2_ctrl *hdr_mode;
++	struct v4l2_ctrl *link_freq;
+ 
+ 	/* Current mode */
+ 	const struct imx708_mode *mode;
+@@ -813,6 +848,8 @@ struct imx708 {
+ 
+ 	/* Current long exposure factor in use. Set through V4L2_CID_VBLANK */
+ 	unsigned int long_exp_shift;
++
++	unsigned int link_freq_idx;
+ };
+ 
+ static inline struct imx708 *to_imx708(struct v4l2_subdev *_sd)
+@@ -1428,7 +1465,7 @@ static int imx708_get_selection(struct v
+ static int imx708_start_streaming(struct imx708 *imx708)
+ {
+ 	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
+-	const struct imx708_reg_list *reg_list;
++	const struct imx708_reg_list *reg_list, *freq_regs;
+ 	int i, ret;
+ 	u32 val;
+ 
+@@ -1474,6 +1511,16 @@ static int imx708_start_streaming(struct
+ 		return ret;
+ 	}
+ 
++	/* Update the link frequency registers */
++	freq_regs = &link_freq_regs[imx708->link_freq_idx];
++	ret = imx708_write_regs(imx708, freq_regs->regs,
++				freq_regs->num_of_regs);
++	if (ret) {
++		dev_err(&client->dev, "%s failed to set link frequency registers\n",
++			__func__);
++		return ret;
++	}
++
+ 	/* Apply customized values from user */
+ 	ret =  __v4l2_ctrl_handler_setup(imx708->sd.ctrl_handler);
+ 	if (ret)
+@@ -1720,6 +1767,7 @@ static int imx708_init_controls(struct i
+ 	struct v4l2_ctrl_handler *ctrl_hdlr;
+ 	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
+ 	struct v4l2_fwnode_device_properties props;
++	struct v4l2_ctrl *ctrl;
+ 	unsigned int i;
+ 	int ret;
+ 
+@@ -1738,6 +1786,12 @@ static int imx708_init_controls(struct i
+ 					       IMX708_INITIAL_PIXEL_RATE, 1,
+ 					       IMX708_INITIAL_PIXEL_RATE);
+ 
++	ctrl = v4l2_ctrl_new_int_menu(ctrl_hdlr, &imx708_ctrl_ops,
++				      V4L2_CID_LINK_FREQ, 0, 0,
++				      &link_freqs[imx708->link_freq_idx]);
++	if (ctrl)
++		ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
+ 	/*
+ 	 * Create the controls here, but mode specific limits are setup
+ 	 * in the imx708_set_framing_limits() call below.
+@@ -1833,13 +1887,14 @@ static void imx708_free_controls(struct
+ 	mutex_destroy(&imx708->mutex);
+ }
+ 
+-static int imx708_check_hwcfg(struct device *dev)
++static int imx708_check_hwcfg(struct device *dev, struct imx708 *imx708)
+ {
+ 	struct fwnode_handle *endpoint;
+ 	struct v4l2_fwnode_endpoint ep_cfg = {
+ 		.bus_type = V4L2_MBUS_CSI2_DPHY
+ 	};
+ 	int ret = -EINVAL;
++	int i;
+ 
+ 	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
+ 	if (!endpoint) {
+@@ -1864,11 +1919,18 @@ static int imx708_check_hwcfg(struct dev
+ 		goto error_out;
+ 	}
+ 
+-	if (ep_cfg.nr_of_link_frequencies != 1 ||
+-	    ep_cfg.link_frequencies[0] != IMX708_DEFAULT_LINK_FREQ) {
++	for (i = 0; i < ARRAY_SIZE(link_freqs); i++) {
++		if (link_freqs[i] == ep_cfg.link_frequencies[0]) {
++			imx708->link_freq_idx = i;
++			break;
++		}
++	}
++
++	if (i == ARRAY_SIZE(link_freqs)) {
+ 		dev_err(dev, "Link frequency not supported: %lld\n",
+ 			ep_cfg.link_frequencies[0]);
+-		goto error_out;
++			ret = -EINVAL;
++			goto error_out;
+ 	}
+ 
+ 	ret = 0;
+@@ -1893,7 +1955,7 @@ static int imx708_probe(struct i2c_clien
+ 	v4l2_i2c_subdev_init(&imx708->sd, client, &imx708_subdev_ops);
+ 
+ 	/* Check the hardware configuration in device tree */
+-	if (imx708_check_hwcfg(dev))
++	if (imx708_check_hwcfg(dev, imx708))
+ 		return -EINVAL;
+ 
+ 	/* Get system clock (xclk) */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0673-dtoverlays-Add-link-frequency-parameter-for-the-Sony.patch b/target/linux/bcm27xx/patches-6.1/950-0673-dtoverlays-Add-link-frequency-parameter-for-the-Sony.patch
new file mode 100644
index 00000000000000..c263622a2a9ef1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0673-dtoverlays-Add-link-frequency-parameter-for-the-Sony.patch
@@ -0,0 +1,36 @@
+From 4137914f6648cdcf0fcea63bd08e4a3ec8e1e39b Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Fri, 31 Mar 2023 14:56:49 +0100
+Subject: [PATCH] dtoverlays: Add link-frequency parameter for the Sony
+ IMX708 sensor
+
+Add a parameter to change the sensor device CSI-2 link frequency to
+one of the following values: 450Mhz (default), 447Mhz, or 453Mhz.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README             | 2 ++
+ arch/arm/boot/dts/overlays/imx708-overlay.dts | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -2417,6 +2417,8 @@ Params: rotation                Mounting
+                                 configuring the sensor (default on)
+         cam0                    Adopt the default configuration for CAM0 on a
+                                 Compute Module (CSI0, i2c_vc, and cam0_reg).
++        link-frequency          Allowable link frequency values to use in Hz:
++                                450000000 (default), 447000000, 453000000.
+ 
+ 
+ Name:   iqaudio-codec
+--- a/arch/arm/boot/dts/overlays/imx708-overlay.dts
++++ b/arch/arm/boot/dts/overlays/imx708-overlay.dts
+@@ -88,6 +88,7 @@
+ 		       <&vcm_node>, "VDD-supply:0=",<&cam0_reg>;
+ 		vcm = <&vcm_node>, "status",
+ 		      <0>, "=4";
++		link-frequency = <&cam_endpoint>,"link-frequencies#0";
+ 	};
+ };
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0674-drivers-media-imx708-Remove-unused-control-fields.patch b/target/linux/bcm27xx/patches-6.1/950-0674-drivers-media-imx708-Remove-unused-control-fields.patch
new file mode 100644
index 00000000000000..e7bb3e98bc712b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0674-drivers-media-imx708-Remove-unused-control-fields.patch
@@ -0,0 +1,49 @@
+From efeb651a86570eae98d98c7d8a57560caf51d55c Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Fri, 31 Mar 2023 10:07:26 +0100
+Subject: [PATCH] drivers: media: imx708: Remove unused control fields
+
+Remove unused and redundant control fields from the state structure.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx708.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+--- a/drivers/media/i2c/imx708.c
++++ b/drivers/media/i2c/imx708.c
+@@ -825,9 +825,6 @@ struct imx708 {
+ 	struct v4l2_ctrl *hflip;
+ 	struct v4l2_ctrl *vblank;
+ 	struct v4l2_ctrl *hblank;
+-	struct v4l2_ctrl *red_balance;
+-	struct v4l2_ctrl *blue_balance;
+-	struct v4l2_ctrl *notify_gains;
+ 	struct v4l2_ctrl *hdr_mode;
+ 	struct v4l2_ctrl *link_freq;
+ 
+@@ -1205,12 +1202,12 @@ static int imx708_set_ctrl(struct v4l2_c
+ 	case V4L2_CID_NOTIFY_GAINS:
+ 		ret = imx708_write_reg(imx708, IMX708_REG_COLOUR_BALANCE_BLUE,
+ 				       IMX708_REG_VALUE_16BIT,
+-				       imx708->notify_gains->p_new.p_u32[0]);
++				       ctrl->p_new.p_u32[0]);
+ 		if (ret)
+ 			break;
+ 		ret = imx708_write_reg(imx708, IMX708_REG_COLOUR_BALANCE_RED,
+ 				       IMX708_REG_VALUE_16BIT,
+-				       imx708->notify_gains->p_new.p_u32[3]);
++				       ctrl->p_new.p_u32[3]);
+ 		break;
+ 	case V4L2_CID_WIDE_DYNAMIC_RANGE:
+ 		/* Already handled above. */
+@@ -1842,8 +1839,7 @@ static int imx708_init_controls(struct i
+ 		/* The "Solid color" pattern is white by default */
+ 	}
+ 
+-	imx708->notify_gains = v4l2_ctrl_new_custom(ctrl_hdlr,
+-						    &imx708_notify_gains_ctrl, NULL);
++	v4l2_ctrl_new_custom(ctrl_hdlr, &imx708_notify_gains_ctrl, NULL);
+ 
+ 	imx708->hdr_mode = v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops,
+ 					     V4L2_CID_WIDE_DYNAMIC_RANGE,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0675-drivers-media-imx708-Tidy-ups-to-address-upstream-re.patch b/target/linux/bcm27xx/patches-6.1/950-0675-drivers-media-imx708-Tidy-ups-to-address-upstream-re.patch
new file mode 100644
index 00000000000000..66ef16a7deecc0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0675-drivers-media-imx708-Tidy-ups-to-address-upstream-re.patch
@@ -0,0 +1,191 @@
+From 0b6b245f8fcff205f097ce1c1bba4760f8b4f859 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Fri, 31 Mar 2023 10:33:51 +0100
+Subject: [PATCH] drivers: media: imx708: Tidy-ups to address upstream
+ review comments
+
+This commit addresses vaious tidy-ups requesed for upstreaming the
+IMX708 driver. Notably:
+
+- Remove #define IMX708_NUM_SUPPLIES and use ARRAY_SIZE() directly
+- Use dev_err_probe where possible in imx708_probe()
+- Fix error handling paths in imx708_probe()
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx708.c | 61 +++++++++++++++++---------------------
+ 1 file changed, 28 insertions(+), 33 deletions(-)
+
+--- a/drivers/media/i2c/imx708.c
++++ b/drivers/media/i2c/imx708.c
+@@ -792,8 +792,6 @@ static const char * const imx708_supply_
+ 	"VDDL",  /* IF (1.8V) supply */
+ };
+ 
+-#define IMX708_NUM_SUPPLIES ARRAY_SIZE(imx708_supply_name)
+-
+ /*
+  * Initialisation delay between XCLR low->high and the moment when the sensor
+  * can start capture (i.e. can leave software standby), given by T7 in the
+@@ -815,7 +813,7 @@ struct imx708 {
+ 	u32 xclk_freq;
+ 
+ 	struct gpio_desc *reset_gpio;
+-	struct regulator_bulk_data supplies[IMX708_NUM_SUPPLIES];
++	struct regulator_bulk_data supplies[ARRAY_SIZE(imx708_supply_name)];
+ 
+ 	struct v4l2_ctrl_handler ctrl_handler;
+ 	/* V4L2 Controls */
+@@ -935,9 +933,10 @@ static int imx708_write_regs(struct imx7
+ {
+ 	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
+ 	unsigned int i;
+-	int ret;
+ 
+ 	for (i = 0; i < len; i++) {
++		int ret;
++
+ 		ret = imx708_write_reg(imx708, regs[i].address, 1, regs[i].val);
+ 		if (ret) {
+ 			dev_err_ratelimited(&client->dev,
+@@ -1025,8 +1024,6 @@ static int imx708_open(struct v4l2_subde
+ 
+ static int imx708_set_exposure(struct imx708 *imx708, unsigned int val)
+ {
+-	int ret;
+-
+ 	val = max(val, imx708->mode->exposure_lines_min);
+ 	val -= val % imx708->mode->exposure_lines_step;
+ 
+@@ -1034,11 +1031,9 @@ static int imx708_set_exposure(struct im
+ 	 * In HDR mode this will set the longest exposure. The sensor
+ 	 * will automatically divide the medium and short ones by 4,16.
+ 	 */
+-	ret = imx708_write_reg(imx708, IMX708_REG_EXPOSURE,
+-			       IMX708_REG_VALUE_16BIT,
+-			       val >> imx708->long_exp_shift);
+-
+-	return ret;
++	return imx708_write_reg(imx708, IMX708_REG_EXPOSURE,
++				IMX708_REG_VALUE_16BIT,
++				val >> imx708->long_exp_shift);
+ }
+ 
+ static void imx708_adjust_exposure_range(struct imx708 *imx708,
+@@ -1071,7 +1066,7 @@ static int imx708_set_analogue_gain(stru
+ 
+ static int imx708_set_frame_length(struct imx708 *imx708, unsigned int val)
+ {
+-	int ret = 0;
++	int ret;
+ 
+ 	imx708->long_exp_shift = 0;
+ 
+@@ -1091,8 +1086,8 @@ static int imx708_set_frame_length(struc
+ 
+ static void imx708_set_framing_limits(struct imx708 *imx708)
+ {
+-	unsigned int hblank;
+ 	const struct imx708_mode *mode = imx708->mode;
++	unsigned int hblank;
+ 
+ 	__v4l2_ctrl_modify_range(imx708->pixel_rate,
+ 				 mode->pixel_rate, mode->pixel_rate,
+@@ -1599,7 +1594,7 @@ static int imx708_power_on(struct device
+ 	struct imx708 *imx708 = to_imx708(sd);
+ 	int ret;
+ 
+-	ret = regulator_bulk_enable(IMX708_NUM_SUPPLIES,
++	ret = regulator_bulk_enable(ARRAY_SIZE(imx708_supply_name),
+ 				    imx708->supplies);
+ 	if (ret) {
+ 		dev_err(&client->dev, "%s: failed to enable regulators\n",
+@@ -1621,7 +1616,8 @@ static int imx708_power_on(struct device
+ 	return 0;
+ 
+ reg_off:
+-	regulator_bulk_disable(IMX708_NUM_SUPPLIES, imx708->supplies);
++	regulator_bulk_disable(ARRAY_SIZE(imx708_supply_name),
++			       imx708->supplies);
+ 	return ret;
+ }
+ 
+@@ -1632,7 +1628,8 @@ static int imx708_power_off(struct devic
+ 	struct imx708 *imx708 = to_imx708(sd);
+ 
+ 	gpiod_set_value_cansleep(imx708->reset_gpio, 0);
+-	regulator_bulk_disable(IMX708_NUM_SUPPLIES, imx708->supplies);
++	regulator_bulk_disable(ARRAY_SIZE(imx708_supply_name),
++			       imx708->supplies);
+ 	clk_disable_unprepare(imx708->xclk);
+ 
+ 	/* Force reprogramming of the common registers when powered up again. */
+@@ -1679,11 +1676,11 @@ static int imx708_get_regulators(struct
+ 	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
+ 	unsigned int i;
+ 
+-	for (i = 0; i < IMX708_NUM_SUPPLIES; i++)
++	for (i = 0; i < ARRAY_SIZE(imx708_supply_name); i++)
+ 		imx708->supplies[i].supply = imx708_supply_name[i];
+ 
+ 	return devm_regulator_bulk_get(&client->dev,
+-				       IMX708_NUM_SUPPLIES,
++				       ARRAY_SIZE(imx708_supply_name),
+ 				       imx708->supplies);
+ }
+ 
+@@ -1956,23 +1953,19 @@ static int imx708_probe(struct i2c_clien
+ 
+ 	/* Get system clock (xclk) */
+ 	imx708->xclk = devm_clk_get(dev, NULL);
+-	if (IS_ERR(imx708->xclk)) {
+-		dev_err(dev, "failed to get xclk\n");
+-		return PTR_ERR(imx708->xclk);
+-	}
++	if (IS_ERR(imx708->xclk))
++		return dev_err_probe(dev, PTR_ERR(imx708->xclk),
++				     "failed to get xclk\n");
+ 
+ 	imx708->xclk_freq = clk_get_rate(imx708->xclk);
+-	if (imx708->xclk_freq != IMX708_XCLK_FREQ) {
+-		dev_err(dev, "xclk frequency not supported: %d Hz\n",
+-			imx708->xclk_freq);
+-		return -EINVAL;
+-	}
++	if (imx708->xclk_freq != IMX708_XCLK_FREQ)
++		return dev_err_probe(dev, -EINVAL,
++				     "xclk frequency not supported: %d Hz\n",
++				     imx708->xclk_freq);
+ 
+ 	ret = imx708_get_regulators(imx708);
+-	if (ret) {
+-		dev_err(dev, "failed to get regulators\n");
+-		return ret;
+-	}
++	if (ret)
++		return dev_err_probe(dev, ret, "failed to get regulators\n");
+ 
+ 	/* Request optional enable pin */
+ 	imx708->reset_gpio = devm_gpiod_get_optional(dev, "reset",
+@@ -2001,7 +1994,7 @@ static int imx708_probe(struct i2c_clien
+ 	/* This needs the pm runtime to be registered. */
+ 	ret = imx708_init_controls(imx708);
+ 	if (ret)
+-		goto error_power_off;
++		goto error_pm_runtime;
+ 
+ 	/* Initialize subdev */
+ 	imx708->sd.internal_ops = &imx708_internal_ops;
+@@ -2033,9 +2026,11 @@ error_media_entity:
+ error_handler_free:
+ 	imx708_free_controls(imx708);
+ 
+-error_power_off:
++error_pm_runtime:
+ 	pm_runtime_disable(&client->dev);
+ 	pm_runtime_set_suspended(&client->dev);
++
++error_power_off:
+ 	imx708_power_off(&client->dev);
+ 
+ 	return ret;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0676-dt-bindings-media-i2c-Replace-IMX708-sensor-binding-.patch b/target/linux/bcm27xx/patches-6.1/950-0676-dt-bindings-media-i2c-Replace-IMX708-sensor-binding-.patch
new file mode 100644
index 00000000000000..35efa5413f338a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0676-dt-bindings-media-i2c-Replace-IMX708-sensor-binding-.patch
@@ -0,0 +1,282 @@
+From f3dbbaa2a6c8ddfc22feac62e1fea6310a4fd659 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Fri, 31 Mar 2023 11:52:25 +0100
+Subject: [PATCH] dt-bindings: media: i2c: Replace IMX708 sensor
+ binding documentation file
+
+Replace the existing imx708.yaml file with sony,imx708.yaml that follows
+the latest devicetree conventions for camera sensors.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../devicetree/bindings/media/i2c/imx708.yaml | 119 ----------------
+ .../bindings/media/i2c/sony,imx708.yaml       | 128 ++++++++++++++++++
+ MAINTAINERS                                   |   2 +-
+ 3 files changed, 129 insertions(+), 120 deletions(-)
+ delete mode 100644 Documentation/devicetree/bindings/media/i2c/imx708.yaml
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/sony,imx708.yaml
+
+--- a/Documentation/devicetree/bindings/media/i2c/imx708.yaml
++++ /dev/null
+@@ -1,119 +0,0 @@
+-# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+-%YAML 1.2
+----
+-$id: http://devicetree.org/schemas/media/i2c/imx708.yaml#
+-$schema: http://devicetree.org/meta-schemas/core.yaml#
+-
+-title: Sony 1/2.3-Inch 12Mpixel CMOS Digital Image Sensor
+-
+-maintainers:
+-  - Naushir Patuck <naush@raspberypi.com>
+-
+-description: |-
+-  The Sony IMX708 is a 1/2.3-inch CMOS active pixel digital image sensor
+-  with an active array size of 4608H x 2592V. It is programmable through
+-  I2C interface. The I2C address is fixed to 0x1A as per sensor data sheet.
+-  Image data is sent through MIPI CSI-2, which is configured as either 2 or
+-  4 data lanes.
+-
+-properties:
+-  compatible:
+-    const: sony,imx708
+-
+-  reg:
+-    description: I2C device address
+-    maxItems: 1
+-
+-  clocks:
+-    maxItems: 1
+-
+-  VDIG-supply:
+-    description:
+-      Digital I/O voltage supply, 1.1 volts
+-
+-  VANA1-supply:
+-    description:
+-      Analog1 voltage supply, 2.8 volts
+-
+-  VANA2-supply:
+-    description:
+-      Analog2 voltage supply, 1.8 volts
+-
+-  VDDL-supply:
+-    description:
+-      Digital core voltage supply, 1.8 volts
+-
+-  reset-gpios:
+-    description: |-
+-      Reference to the GPIO connected to the xclr pin, if any.
+-      Must be released (set high) after all supplies and INCK are applied.
+-
+-  # See ../video-interfaces.txt for more details
+-  port:
+-    type: object
+-    properties:
+-      endpoint:
+-        type: object
+-        properties:
+-          data-lanes:
+-            description: |-
+-              The sensor supports either two-lane, or four-lane operation.
+-              For two-lane operation the property must be set to <1 2>.
+-            items:
+-              - const: 1
+-              - const: 2
+-
+-          clock-noncontinuous:
+-            type: boolean
+-            description: |-
+-              MIPI CSI-2 clock is non-continuous if this property is present,
+-              otherwise it's continuous.
+-
+-          link-frequencies:
+-            allOf:
+-              - $ref: /schemas/types.yaml#/definitions/uint64-array
+-            description:
+-              Allowed data bus frequencies.
+-
+-        required:
+-          - link-frequencies
+-
+-required:
+-  - compatible
+-  - reg
+-  - clocks
+-  - VANA1-supply
+-  - VANA2-supply
+-  - VDIG-supply
+-  - VDDL-supply
+-  - port
+-
+-additionalProperties: false
+-
+-examples:
+-  - |
+-    i2c0 {
+-        #address-cells = <1>;
+-        #size-cells = <0>;
+-
+-        imx708: sensor@1a {
+-            compatible = "sony,imx708";
+-            reg = <0x1a>;
+-            clocks = <&imx708_clk>;
+-            VANA1-supply = <&imx708_vana1>; /* 1.8v */
+-            VANA2-supply = <&imx708_vana2>; /* 2.8v */
+-            VDIG-supply = <&imx708_vdig>;   /* 1.1v */
+-            VDDL-supply = <&imx708_vddl>;   /* 1.8v */
+-
+-            port {
+-                imx708_0: endpoint {
+-                    remote-endpoint = <&csi1_ep>;
+-                    data-lanes = <1 2>;
+-                    clock-noncontinuous;
+-                    link-frequencies = /bits/ 64 <450000000>;
+-                };
+-            };
+-        };
+-    };
+-
+-...
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/sony,imx708.yaml
+@@ -0,0 +1,128 @@
++# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/media/i2c/sony,imx708.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Sony 1/2.3-Inch 12Mpixel CMOS Digital Image Sensor
++
++maintainers:
++  - Raspberry Pi Kernel Maintenance <kernel-list@raspberrypi.com>
++
++description: |-
++  The Sony IMX708 is a 1/2.3-inch CMOS active pixel digital image sensor
++  with an active array size of 4608H x 2592V. It is programmable through
++  I2C interface. The I2C address is fixed to 0x1A as per sensor data sheet.
++  Image data is sent through MIPI CSI-2, which is configured as either 2 or
++  4 data lanes.
++
++properties:
++  compatible:
++    const: sony,imx708
++
++  reg:
++    maxItems: 1
++
++  clocks:
++    maxItems: 1
++
++  clock-names:
++    description: Input clock (6 to 27 MHz)
++    items:
++      - const: inck
++
++  vdig-supply:
++    description:
++      Digital I/O voltage supply, 1.1 volts
++
++  vana1-supply:
++    description:
++      Analog1 voltage supply, 2.8 volts
++
++  vana2-supply:
++    description:
++      Analog2 voltage supply, 1.8 volts
++
++  vddl-supply:
++    description:
++      Digital core voltage supply, 1.8 volts
++
++  reset-gpios:
++    description: Sensor reset (XCLR) GPIO
++    maxItems: 1
++
++  port:
++    $ref: /schemas/graph.yaml#/$defs/port-base
++    description: |
++      Video output port
++
++    properties:
++      endpoint:
++        $ref: /schemas/media/video-interfaces.yaml#
++        unevaluatedProperties: false
++
++        properties:
++          data-lanes:
++            anyOf:
++              - items:
++                  - const: 1
++                  - const: 2
++              - items:
++                  - const: 1
++                  - const: 2
++                  - const: 3
++                  - const: 4
++
++          link-frequencies: true
++
++        required:
++          - data-lanes
++          - link-frequencies
++
++    additionalProperties: false
++
++required:
++  - compatible
++  - reg
++  - clocks
++  - clock-names
++  - vdig-supply
++  - vana1-supply
++  - vana2-supply
++  - vddl-supply
++  - port
++
++additionalProperties: false
++
++examples:
++  - |
++    #include <dt-bindings/gpio/gpio.h>
++
++    i2c {
++        #address-cells = <1>;
++        #size-cells = <0>;
++
++        imx708: camera-sensor@1a {
++            compatible = "sony,imx708";
++            reg = <0x1a>;
++
++            clocks = <&clk 90>;
++            clock-names = "inck";
++
++            vdig-supply = <&camera_vdig>;
++            vana1-supply = <&camera_vana1>;
++            vana2-supply = <&camera_vana2>;
++            vddl-supply = <&camera_vddl>;
++
++            reset-gpios = <&gpio 35 GPIO_ACTIVE_LOW>;
++
++            port {
++                imx708_ep: endpoint {
++                    data-lanes = <1 2>;
++                    link-frequencies = /bits/ 64 <450000000>;
++                    remote-endpoint = <&csi_ep>;
++                };
++            };
++        };
++    };
++...
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -19342,7 +19342,7 @@ M:	Raspberry Pi Kernel Maintenance <kern
+ L:	linux-media@vger.kernel.org
+ S:	Maintained
+ T:	git git://linuxtv.org/media_tree.git
+-F:	Documentation/devicetree/bindings/media/i2c/imx708.yaml
++F:	Documentation/devicetree/bindings/media/i2c/sony,imx708.yaml
+ F:	drivers/media/i2c/imx708.c
+ 
+ SONY MEMORYSTICK SUBSYSTEM
diff --git a/target/linux/bcm27xx/patches-6.1/950-0677-dtoverlays-Follow-the-standard-devicetree-labels-for.patch b/target/linux/bcm27xx/patches-6.1/950-0677-dtoverlays-Follow-the-standard-devicetree-labels-for.patch
new file mode 100644
index 00000000000000..625b62dc6f3f9f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0677-dtoverlays-Follow-the-standard-devicetree-labels-for.patch
@@ -0,0 +1,34 @@
+From 08d38a30e843061fef8612fda72f8cc1da9e9481 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Fri, 31 Mar 2023 15:08:10 +0100
+Subject: [PATCH] dtoverlays: Follow the standard devicetree labels for
+ IMX708
+
+Switch the system clock name from "xclk" to "inclk".
+Use lower case lables for all regulator names.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/imx708.dtsi | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/imx708.dtsi
++++ b/arch/arm/boot/dts/overlays/imx708.dtsi
+@@ -6,12 +6,12 @@ cam_node: imx708@1a {
+ 	status = "disabled";
+ 
+ 	clocks = <&cam1_clk>;
+-	clock-names = "xclk";
++	clock-names = "inclk";
+ 
+-	VANA1-supply = <&cam1_reg>;	/* 2.8v */
+-	VANA2-supply = <&cam_dummy_reg>;/* 1.8v */
+-	VDIG-supply = <&cam_dummy_reg>;	/* 1.1v */
+-	VDDL-supply = <&cam_dummy_reg>;	/* 1.8v */
++	vana1-supply = <&cam1_reg>;	/* 2.8v */
++	vana2-supply = <&cam_dummy_reg>;/* 1.8v */
++	vdig-supply = <&cam_dummy_reg>;	/* 1.1v */
++	vddl-supply = <&cam_dummy_reg>;	/* 1.8v */
+ 
+ 	rotation = <180>;
+ 	orientation = <2>;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0678-drivers-media-imx708-Follow-the-standard-devicetree-.patch b/target/linux/bcm27xx/patches-6.1/950-0678-drivers-media-imx708-Follow-the-standard-devicetree-.patch
new file mode 100644
index 00000000000000..bc4dcc43c52ccb
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0678-drivers-media-imx708-Follow-the-standard-devicetree-.patch
@@ -0,0 +1,96 @@
+From 6d6d0783a96c6a4eeeef42039bfd5ac23f2575f1 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Fri, 31 Mar 2023 15:05:33 +0100
+Subject: [PATCH] drivers: media: imx708: Follow the standard
+ devicetree labels
+
+Switch the system clock name from "xclk" to "inclk".
+Use lower case lables for all regulator names.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx708.c | 36 ++++++++++++++++++------------------
+ 1 file changed, 18 insertions(+), 18 deletions(-)
+
+--- a/drivers/media/i2c/imx708.c
++++ b/drivers/media/i2c/imx708.c
+@@ -33,7 +33,7 @@
+ 
+ #define IMX708_REG_ORIENTATION		0x101
+ 
+-#define IMX708_XCLK_FREQ		24000000
++#define IMX708_INCLK_FREQ		24000000
+ 
+ /* Default initial pixel rate, will get updated for each mode. */
+ #define IMX708_INITIAL_PIXEL_RATE	590000000
+@@ -786,10 +786,10 @@ static const int imx708_test_pattern_val
+ /* regulator supplies */
+ static const char * const imx708_supply_name[] = {
+ 	/* Supplies can be enabled in any order */
+-	"VANA1",  /* Analog1 (2.8V) supply */
+-	"VANA2",  /* Analog2 (1.8V) supply */
+-	"VDIG",  /* Digital Core (1.1V) supply */
+-	"VDDL",  /* IF (1.8V) supply */
++	"vana1",  /* Analog1 (2.8V) supply */
++	"vana2",  /* Analog2 (1.8V) supply */
++	"vdig",  /* Digital Core (1.1V) supply */
++	"vddl",  /* IF (1.8V) supply */
+ };
+ 
+ /*
+@@ -809,8 +809,8 @@ struct imx708 {
+ 
+ 	struct v4l2_mbus_framefmt fmt;
+ 
+-	struct clk *xclk;
+-	u32 xclk_freq;
++	struct clk *inclk;
++	u32 inclk_freq;
+ 
+ 	struct gpio_desc *reset_gpio;
+ 	struct regulator_bulk_data supplies[ARRAY_SIZE(imx708_supply_name)];
+@@ -1602,7 +1602,7 @@ static int imx708_power_on(struct device
+ 		return ret;
+ 	}
+ 
+-	ret = clk_prepare_enable(imx708->xclk);
++	ret = clk_prepare_enable(imx708->inclk);
+ 	if (ret) {
+ 		dev_err(&client->dev, "%s: failed to enable clock\n",
+ 			__func__);
+@@ -1630,7 +1630,7 @@ static int imx708_power_off(struct devic
+ 	gpiod_set_value_cansleep(imx708->reset_gpio, 0);
+ 	regulator_bulk_disable(ARRAY_SIZE(imx708_supply_name),
+ 			       imx708->supplies);
+-	clk_disable_unprepare(imx708->xclk);
++	clk_disable_unprepare(imx708->inclk);
+ 
+ 	/* Force reprogramming of the common registers when powered up again. */
+ 	imx708->common_regs_written = false;
+@@ -1951,17 +1951,17 @@ static int imx708_probe(struct i2c_clien
+ 	if (imx708_check_hwcfg(dev, imx708))
+ 		return -EINVAL;
+ 
+-	/* Get system clock (xclk) */
+-	imx708->xclk = devm_clk_get(dev, NULL);
+-	if (IS_ERR(imx708->xclk))
+-		return dev_err_probe(dev, PTR_ERR(imx708->xclk),
+-				     "failed to get xclk\n");
++	/* Get system clock (inclk) */
++	imx708->inclk = devm_clk_get(dev, "inclk");
++	if (IS_ERR(imx708->inclk))
++		return dev_err_probe(dev, PTR_ERR(imx708->inclk),
++				     "failed to get inclk\n");
+ 
+-	imx708->xclk_freq = clk_get_rate(imx708->xclk);
+-	if (imx708->xclk_freq != IMX708_XCLK_FREQ)
++	imx708->inclk_freq = clk_get_rate(imx708->inclk);
++	if (imx708->inclk_freq != IMX708_INCLK_FREQ)
+ 		return dev_err_probe(dev, -EINVAL,
+-				     "xclk frequency not supported: %d Hz\n",
+-				     imx708->xclk_freq);
++				     "inclk frequency not supported: %d Hz\n",
++				     imx708->inclk_freq);
+ 
+ 	ret = imx708_get_regulators(imx708);
+ 	if (ret)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0679-drives-media-imx708-Put-HFLIP-and-VFLIP-controls-in-.patch b/target/linux/bcm27xx/patches-6.1/950-0679-drives-media-imx708-Put-HFLIP-and-VFLIP-controls-in-.patch
new file mode 100644
index 00000000000000..22bbf8830cf58d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0679-drives-media-imx708-Put-HFLIP-and-VFLIP-controls-in-.patch
@@ -0,0 +1,41 @@
+From c14ac3e46f17ce0c1dd2f58ed1d24c1010f577f6 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Fri, 31 Mar 2023 12:02:09 +0100
+Subject: [PATCH] drives: media: imx708: Put HFLIP and VFLIP controls
+ in a cluster
+
+Create a cluster for the HVLIP and VFLIP controls so they are treated
+as a single composite control.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx708.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/imx708.c
++++ b/drivers/media/i2c/imx708.c
+@@ -819,12 +819,14 @@ struct imx708 {
+ 	/* V4L2 Controls */
+ 	struct v4l2_ctrl *pixel_rate;
+ 	struct v4l2_ctrl *exposure;
+-	struct v4l2_ctrl *vflip;
+-	struct v4l2_ctrl *hflip;
+ 	struct v4l2_ctrl *vblank;
+ 	struct v4l2_ctrl *hblank;
+ 	struct v4l2_ctrl *hdr_mode;
+ 	struct v4l2_ctrl *link_freq;
++	struct {
++		struct v4l2_ctrl *hflip;
++		struct v4l2_ctrl *vflip;
++	};
+ 
+ 	/* Current mode */
+ 	const struct imx708_mode *mode;
+@@ -1815,6 +1817,7 @@ static int imx708_init_controls(struct i
+ 
+ 	imx708->vflip = v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops,
+ 					  V4L2_CID_VFLIP, 0, 1, 1, 0);
++	v4l2_ctrl_cluster(2, &imx708->hflip);
+ 
+ 	v4l2_ctrl_new_std_menu_items(ctrl_hdlr, &imx708_ctrl_ops,
+ 				     V4L2_CID_TEST_PATTERN,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0680-media-bcm2835-unicam-Start-and-stop-media_pipeline-w.patch b/target/linux/bcm27xx/patches-6.1/950-0680-media-bcm2835-unicam-Start-and-stop-media_pipeline-w.patch
new file mode 100644
index 00000000000000..095bb71b524d86
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0680-media-bcm2835-unicam-Start-and-stop-media_pipeline-w.patch
@@ -0,0 +1,43 @@
+From e43d09e8749afa7fdfdd83439690d304b5acc98d Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 28 Mar 2023 13:43:43 +0100
+Subject: [PATCH] media: bcm2835-unicam: Start and stop media_pipeline
+ with same node
+
+media_pipeline_start and media_pipeline_stop now validate that
+the pipeline is being started and stopped with the same pipe
+and pad handles.
+When running with embedded metadata (eg imx477 and imx708), the
+start typically happens from the metadata pad, whilst stop is
+always from the image pad.
+
+Always pass the image pad to media_pipeline_start to ensure
+that the calls are balanced.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -2524,7 +2524,8 @@ static int unicam_start_streaming(struct
+ 		goto err_streaming;
+ 	}
+ 
+-	ret = media_pipeline_start(node->video_dev.entity.pads, &node->pipe);
++	ret = media_pipeline_start(dev->node[IMAGE_PAD].video_dev.entity.pads,
++				   &dev->node[IMAGE_PAD].pipe);
+ 	if (ret < 0) {
+ 		unicam_err(dev, "Failed to start media pipeline: %d\n", ret);
+ 		goto err_pm_put;
+@@ -2618,7 +2619,8 @@ err_vpu_clock:
+ 		unicam_err(dev, "failed to reset the VPU clock\n");
+ 	clk_disable_unprepare(dev->vpu_clock);
+ error_pipeline:
+-	media_pipeline_stop(node->video_dev.entity.pads);
++	if (node->pad_id == IMAGE_PAD)
++		media_pipeline_stop(dev->node[IMAGE_PAD].video_dev.entity.pads);
+ err_pm_put:
+ 	unicam_runtime_put(dev);
+ err_streaming:
diff --git a/target/linux/bcm27xx/patches-6.1/950-0681-fixup-gpio-fsm-Avoid-truncation-of-delay-jiffies.patch b/target/linux/bcm27xx/patches-6.1/950-0681-fixup-gpio-fsm-Avoid-truncation-of-delay-jiffies.patch
new file mode 100644
index 00000000000000..d1ff9389a50f85
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0681-fixup-gpio-fsm-Avoid-truncation-of-delay-jiffies.patch
@@ -0,0 +1,26 @@
+From 0fcc2d8ccfb1a35da7ab3c34218865fd0ab240c0 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Sat, 1 Apr 2023 11:50:07 +0100
+Subject: [PATCH] fixup! gpio-fsm: Avoid truncation of delay jiffies
+
+The kernel's time unit of jiffies should be stored as an unsigned long
+value. Storing it as an unsigned int, as gpio-fsm did, leads to
+truncation and malfunction when the kernel is built for a 64-bit
+platform.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/gpio/gpio-fsm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpio/gpio-fsm.c
++++ b/drivers/gpio/gpio-fsm.c
+@@ -121,7 +121,7 @@ struct gpio_fsm {
+ 	struct fsm_state *current_state;
+ 	struct fsm_state *next_state;
+ 	struct fsm_state *delay_target_state;
+-	unsigned int delay_jiffies;
++	unsigned long delay_jiffies;
+ 	int delay_ms;
+ 	unsigned int debug;
+ 	bool shutting_down;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0682-staging-bcm2835-codec-Add-missing-alignment-for-V4L2.patch b/target/linux/bcm27xx/patches-6.1/950-0682-staging-bcm2835-codec-Add-missing-alignment-for-V4L2.patch
new file mode 100644
index 00000000000000..9d0462a74a596d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0682-staging-bcm2835-codec-Add-missing-alignment-for-V4L2.patch
@@ -0,0 +1,26 @@
+From e9ec7b00d139fbfb37a57d3109b651809cc568cc Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 12 Apr 2023 17:28:11 +0100
+Subject: [PATCH] staging: bcm2835-codec: Add missing alignment for
+ V4L2_PIX_FMT_RGBA32
+
+The patch adding image encode (JPEG) to the driver missed adding
+the alignment constraint for V4L2_PIX_FMT_RGBA32, which meant
+it ended up giving a stride and size of 0.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c    | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
++++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+@@ -263,7 +263,7 @@ static const struct bcm2835_codec_fmt su
+ 	}, {
+ 		.fourcc			= V4L2_PIX_FMT_RGBA32,
+ 		.depth			= 32,
+-		.bytesperline_align	= { 32, 32, 32, 32 },
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
+ 		.flags			= 0,
+ 		.mmal_fmt		= MMAL_ENCODING_RGBA,
+ 		.size_multiplier_x2	= 2,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0683-ARM-dts-bcm27xx-Add-i2c_arm-vc-and-friends.patch b/target/linux/bcm27xx/patches-6.1/950-0683-ARM-dts-bcm27xx-Add-i2c_arm-vc-and-friends.patch
new file mode 100644
index 00000000000000..e2f9ee863c473f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0683-ARM-dts-bcm27xx-Add-i2c_arm-vc-and-friends.patch
@@ -0,0 +1,166 @@
+From 56a619cbaa22d536455de8e339747faa196615de Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 12 Apr 2023 16:11:40 +0100
+Subject: [PATCH] ARM: dts: bcm27xx: Add i2c_arm/vc and friends
+
+Since there is now a dedicated dts file for the rev1 Model B (the only
+Pi to drive the primary camera with i2c1), move the creation of the
+i2c_arm, i2c_vc and i2c labels, aliases and overrides into the base dts
+files.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/bcm2708-rpi-b-plus.dts |  6 ++++++
+ arch/arm/boot/dts/bcm2708-rpi-b-rev1.dts | 13 +++++++++++++
+ arch/arm/boot/dts/bcm2708-rpi-b.dts      |  6 ++++++
+ arch/arm/boot/dts/bcm2708-rpi-cm.dtsi    |  6 ++++++
+ arch/arm/boot/dts/bcm2708-rpi-zero-w.dts |  3 +++
+ arch/arm/boot/dts/bcm2708-rpi-zero.dts   |  3 +++
+ arch/arm/boot/dts/bcm2709-rpi.dtsi       |  3 +++
+ arch/arm/boot/dts/bcm270x-rpi.dtsi       |  7 +++++++
+ arch/arm/boot/dts/bcm2711-rpi-ds.dtsi    |  3 +++
+ 9 files changed, 50 insertions(+)
+
+--- a/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
++++ b/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
+@@ -186,6 +186,12 @@
+ cam0_reg: &cam_dummy_reg {
+ };
+ 
++i2c_arm: &i2c1 {
++};
++
++i2c_vc: &i2c0 {
++};
++
+ / {
+ 	__overrides__ {
+ 		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_headphones=1 snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_headphones=0 snd_bcm2835.enable_hdmi=0'}";
+--- a/arch/arm/boot/dts/bcm2708-rpi-b-rev1.dts
++++ b/arch/arm/boot/dts/bcm2708-rpi-b-rev1.dts
+@@ -197,6 +197,12 @@ i2c_csi_dsi: &i2c1 {
+ cam0_reg: &cam_dummy_reg {
+ };
+ 
++i2c_arm: &i2c0 {
++};
++
++i2c_vc: &i2c1 {
++};
++
+ / {
+ 	__overrides__ {
+ 		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_headphones=1 snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_headphones=0 snd_bcm2835.enable_hdmi=0'}";
+@@ -204,5 +210,12 @@ cam0_reg: &cam_dummy_reg {
+ 		act_led_gpio = <&act_led>,"gpios:4";
+ 		act_led_activelow = <&act_led>,"gpios:8";
+ 		act_led_trigger = <&act_led>,"linux,default-trigger";
++
++		i2c = <&i2c0>,"status";
++		i2c_arm = <&i2c0>,"status";
++		i2c_vc = <&i2c1>,"status";
++		i2c_baudrate = <&i2c0>,"clock-frequency:0";
++		i2c_arm_baudrate = <&i2c0>,"clock-frequency:0";
++		i2c_vc_baudrate = <&i2c1>,"clock-frequency:0";
+ 	};
+ };
+--- a/arch/arm/boot/dts/bcm2708-rpi-b.dts
++++ b/arch/arm/boot/dts/bcm2708-rpi-b.dts
+@@ -179,6 +179,12 @@
+ cam0_reg: &cam_dummy_reg {
+ };
+ 
++i2c_arm: &i2c1 {
++};
++
++i2c_vc: &i2c0 {
++};
++
+ / {
+ 	__overrides__ {
+ 		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_headphones=1 snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_headphones=0 snd_bcm2835.enable_hdmi=0'}";
+--- a/arch/arm/boot/dts/bcm2708-rpi-cm.dtsi
++++ b/arch/arm/boot/dts/bcm2708-rpi-cm.dtsi
+@@ -9,6 +9,12 @@
+ 	};
+ };
+ 
++i2c_arm: &i2c1 {
++};
++
++i2c_vc: &i2c0 {
++};
++
+ / {
+ 	__overrides__ {
+ 		act_led_gpio = <&act_led>,"gpios:4";
+--- a/arch/arm/boot/dts/bcm2708-rpi-zero-w.dts
++++ b/arch/arm/boot/dts/bcm2708-rpi-zero-w.dts
+@@ -235,6 +235,9 @@
+ cam0_reg: &cam_dummy_reg {
+ };
+ 
++i2c_arm: &i2c1 {};
++i2c_vc: &i2c0 {};
++
+ / {
+ 	__overrides__ {
+ 		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_hdmi=0'}";
+--- a/arch/arm/boot/dts/bcm2708-rpi-zero.dts
++++ b/arch/arm/boot/dts/bcm2708-rpi-zero.dts
+@@ -176,6 +176,9 @@
+ cam0_reg: &cam_dummy_reg {
+ };
+ 
++i2c_arm: &i2c1 {};
++i2c_vc: &i2c0 {};
++
+ / {
+ 	__overrides__ {
+ 		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_hdmi=0'}";
+--- a/arch/arm/boot/dts/bcm2709-rpi.dtsi
++++ b/arch/arm/boot/dts/bcm2709-rpi.dtsi
+@@ -3,3 +3,6 @@
+ &vchiq {
+ 	compatible = "brcm,bcm2836-vchiq", "brcm,bcm2835-vchiq";
+ };
++
++i2c_arm: &i2c1 {};
++i2c_vc: &i2c0 {};
+--- a/arch/arm/boot/dts/bcm270x-rpi.dtsi
++++ b/arch/arm/boot/dts/bcm270x-rpi.dtsi
+@@ -21,6 +21,7 @@
+ 		i2c0 = &i2c0;
+ 		i2c1 = &i2c1;
+ 		i2c10 = &i2c_csi_dsi;
++		i2c = &i2c_arm;
+ 		spi0 = &spi0;
+ 		spi1 = &spi1;
+ 		spi2 = &spi2;
+@@ -79,8 +80,14 @@
+ 		spi = <&spi0>,"status";
+ 		i2c0 = <&i2c0if>,"status",<&i2c0mux>,"status";
+ 		i2c1 = <&i2c1>,"status";
++		i2c = <&i2c1>,"status";
++		i2c_arm = <&i2c1>,"status";
++		i2c_vc = <&i2c0if>,"status",<&i2c0mux>,"status";
+ 		i2c0_baudrate = <&i2c0if>,"clock-frequency:0";
+ 		i2c1_baudrate = <&i2c1>,"clock-frequency:0";
++		i2c_baudrate = <&i2c1>,"clock-frequency:0";
++		i2c_arm_baudrate = <&i2c1>,"clock-frequency:0";
++		i2c_vc_baudrate = <&i2c0if>,"clock-frequency:0";
+ 
+ 		watchdog = <&watchdog>,"status";
+ 		random = <&random>,"status";
+--- a/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
++++ b/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
+@@ -267,6 +267,9 @@
+ 	interrupts = <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>;
+ };
+ 
++i2c_arm: &i2c1 {};
++i2c_vc: &i2c0 {};
++
+ /delete-node/ &v3d;
+ 
+ / {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0684-overlays-Add-pcf857x-support.patch b/target/linux/bcm27xx/patches-6.1/950-0684-overlays-Add-pcf857x-support.patch
new file mode 100644
index 00000000000000..e66f83cfee2f74
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0684-overlays-Add-pcf857x-support.patch
@@ -0,0 +1,80 @@
+From e0db80960019c296c47690dea9052dc4960f4f99 Mon Sep 17 00:00:00 2001
+From: Clarke X <1014930533@qq.com>
+Date: Sat, 8 Apr 2023 11:29:16 +0800
+Subject: [PATCH] overlays: Add pcf857x support
+
+Add pcf857x overlay with related documents.
+
+Signed-off-by: Clarke X <1014930533@qq.com>
+---
+ arch/arm/boot/dts/overlays/Makefile           |  1 +
+ arch/arm/boot/dts/overlays/README             | 11 +++++++
+ .../arm/boot/dts/overlays/pcf857x-overlay.dts | 32 +++++++++++++++++++
+ 3 files changed, 44 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/pcf857x-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -167,6 +167,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	ov9281.dtbo \
+ 	papirus.dtbo \
+ 	pca953x.dtbo \
++	pcf857x.dtbo \
+ 	pcie-32bit-dma.dtbo \
+ 	pibell.dtbo \
+ 	pifacedigital.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -3065,6 +3065,17 @@ Params: addr                    I2C addr
+         xra1202                 Select the Exar XRA1202 (8 bit)
+ 
+ 
++Name:   pcf857x
++Info:   NXP PCF857x family of I2C GPIO expanders.
++Load:   dtoverlay=pcf857x,<param>=<val>
++Params: addr                    I2C address of expander. Default
++                                depends on model selected.
++        pcf8574                 Select the NXP PCF8574 (8 bit)
++        pcf8574a                Select the NXP PCF8574A (8 bit)
++        pcf8575                 Select the NXP PCF8575 (16 bit)
++        pca8574                 Select the NXP PCA8574 (8 bit)
++
++
+ Name:   pcie-32bit-dma
+ Info:   Force PCIe config to support 32bit DMA addresses at the expense of
+         having to bounce buffers.
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pcf857x-overlay.dts
+@@ -0,0 +1,32 @@
++// Definitions for PCF857X GPIO Extender from NXP
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pcf857x: pcf857x@0 {
++				compatible = "";
++				reg = <0x00>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		pcf8574  = <&pcf857x>,"compatible=nxp,pcf8574",  <&pcf857x>,"reg:0=0x20";
++		pcf8574a = <&pcf857x>,"compatible=nxp,pcf8574a", <&pcf857x>,"reg:0=0x38";
++		pcf8575  = <&pcf857x>,"compatible=nxp,pcf8575",  <&pcf857x>,"reg:0=0x20";
++		pca8574  = <&pcf857x>,"compatible=nxp,pca8574", <&pcf857x>,"reg:0=0x20";
++		addr = <&pcf857x>,"reg:0";
++	};
++};
diff --git a/target/linux/bcm27xx/patches-6.1/950-0685-overlays-Add-gpio-charger-support.patch b/target/linux/bcm27xx/patches-6.1/950-0685-overlays-Add-gpio-charger-support.patch
new file mode 100644
index 00000000000000..d98f76a1d76995
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0685-overlays-Add-gpio-charger-support.patch
@@ -0,0 +1,93 @@
+From 97fb20dfd682cf2748d1286322455cb8bf8b034d Mon Sep 17 00:00:00 2001
+From: Clarke X <1014930533@qq.com>
+Date: Sat, 8 Apr 2023 09:56:13 +0800
+Subject: [PATCH] overlays: Add gpio-charger support
+
+Add gpio-charger overlay for charger via gpio.
+
+Signed-off-by: Clarke X <1014930533@qq.com>
+---
+ arch/arm/boot/dts/overlays/Makefile           |  1 +
+ arch/arm/boot/dts/overlays/README             | 14 +++++++
+ .../dts/overlays/gpio-charger-overlay.dts     | 42 +++++++++++++++++++
+ 3 files changed, 57 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/gpio-charger-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -68,6 +68,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	ghost-amp.dtbo \
+ 	goodix.dtbo \
+ 	googlevoicehat-soundcard.dtbo \
++	gpio-charger.dtbo \
+ 	gpio-fan.dtbo \
+ 	gpio-hog.dtbo \
+ 	gpio-ir.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -1248,6 +1248,20 @@ Load:   dtoverlay=googlevoicehat-soundca
+ Params: <None>
+ 
+ 
++Name:   gpio-charger
++Info:   This is a generic overlay for detecting charger with GPIO.
++Load:   dtoverlay=gpio-charger,<param>=<val>
++Params: gpio                    GPIO pin to trigger on (default 4)
++        active_low              When this is 1 (active low), a falling
++                                edge generates a charging event and a
++                                rising edge generates a discharging event.
++                                When this is 0 (active high), this is
++                                reversed. The default is 0 (active high)
++        gpio_pull               Desired pull-up/down state (off, down, up)
++                                Default is "down".
++        type                    Set a charger type for the pin. (Default: mains)
++
++
+ Name:   gpio-fan
+ Info:   Configure a GPIO pin to control a cooling fan.
+ Load:   dtoverlay=gpio-fan,<param>=<val>
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-charger-overlay.dts
+@@ -0,0 +1,42 @@
++// Definitions for gpio-charger module
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		// Configure the gpio pin controller
++		target = <&gpio>;
++		__overlay__ {
++			pin_state: charger_pins@0 {
++				brcm,pins = <4>; // gpio number
++				brcm,function = <0>; // 0 = input, 1 = output
++				brcm,pull = <1>; // 0 = none, 1 = pull down, 2 = pull up
++			};
++		};
++	};
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			charger: charger@0 {
++				compatible = "gpio-charger";
++				pinctrl-0 = <&pin_state>;
++				status = "okay";
++				gpios = <&gpio 4 0>;
++				charger-type = "mains";
++			};
++		};
++	};
++
++	__overrides__ {
++		gpio =       <&charger>,"reg:0",
++			     <&charger>,"gpios:4",
++			     <&pin_state>,"reg:0",
++			     <&pin_state>,"brcm,pins:0";
++		type =       <&charger>,"charger-type";
++		gpio_pull =  <&pin_state>,"brcm,pull:0";
++		active_low = <&charger>,"gpios:8";
++	};
++
++};
diff --git a/target/linux/bcm27xx/patches-6.1/950-0686-media-i2c-imx219-Scale-the-pixel-clock-rate-for-the-.patch b/target/linux/bcm27xx/patches-6.1/950-0686-media-i2c-imx219-Scale-the-pixel-clock-rate-for-the-.patch
new file mode 100644
index 00000000000000..35a859440abd6a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0686-media-i2c-imx219-Scale-the-pixel-clock-rate-for-the-.patch
@@ -0,0 +1,129 @@
+From e5390cad270d49f3b0dc0a03eccfef63ffa7520f Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 8 Feb 2022 13:49:11 +0000
+Subject: [PATCH] media: i2c: imx219: Scale the pixel clock rate for
+ the 640x480 mode
+
+The 640x480 mode uses a special binning mode for high framerate operation where
+the pixel rate is effectively doubled. Account for this when setting up the
+pixel clock rate, and applying the vblank and exposure controls.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx219.c | 33 ++++++++++++++++++++++++++-------
+ 1 file changed, 26 insertions(+), 7 deletions(-)
+
+--- a/drivers/media/i2c/imx219.c
++++ b/drivers/media/i2c/imx219.c
+@@ -164,6 +164,9 @@ struct imx219_mode {
+ 
+ 	/* 2x2 binning is used */
+ 	bool binning;
++
++	/* Relative pixel clock rate factor for the mode. */
++	unsigned int rate_factor;
+ };
+ 
+ static const struct imx219_reg imx219_common_regs[] = {
+@@ -402,6 +405,7 @@ static const struct imx219_mode supporte
+ 			.regs = mode_3280x2464_regs,
+ 		},
+ 		.binning = false,
++		.rate_factor = 1,
+ 	},
+ 	{
+ 		/* 1080P 30fps cropped */
+@@ -419,6 +423,7 @@ static const struct imx219_mode supporte
+ 			.regs = mode_1920_1080_regs,
+ 		},
+ 		.binning = false,
++		.rate_factor = 1,
+ 	},
+ 	{
+ 		/* 2x2 binned 30fps mode */
+@@ -436,6 +441,7 @@ static const struct imx219_mode supporte
+ 			.regs = mode_1640_1232_regs,
+ 		},
+ 		.binning = true,
++		.rate_factor = 1,
+ 	},
+ 	{
+ 		/* 640x480 30fps mode */
+@@ -453,6 +459,11 @@ static const struct imx219_mode supporte
+ 			.regs = mode_640_480_regs,
+ 		},
+ 		.binning = true,
++		/*
++		 * This mode uses a special 2x2 binning that doubles the
++		 * internal pixel clock rate.
++		 */
++		.rate_factor = 2,
+ 	},
+ };
+ 
+@@ -675,7 +686,8 @@ static int imx219_set_ctrl(struct v4l2_c
+ 		break;
+ 	case V4L2_CID_EXPOSURE:
+ 		ret = imx219_write_reg(imx219, IMX219_REG_EXPOSURE,
+-				       IMX219_REG_VALUE_16BIT, ctrl->val);
++				       IMX219_REG_VALUE_16BIT,
++				       ctrl->val / imx219->mode->rate_factor);
+ 		break;
+ 	case V4L2_CID_DIGITAL_GAIN:
+ 		ret = imx219_write_reg(imx219, IMX219_REG_DIGITAL_GAIN,
+@@ -695,7 +707,8 @@ static int imx219_set_ctrl(struct v4l2_c
+ 	case V4L2_CID_VBLANK:
+ 		ret = imx219_write_reg(imx219, IMX219_REG_VTS,
+ 				       IMX219_REG_VALUE_16BIT,
+-				       imx219->mode->height + ctrl->val);
++				       (imx219->mode->height + ctrl->val) /
++						imx219->mode->rate_factor);
+ 		break;
+ 	case V4L2_CID_HBLANK:
+ 		ret = imx219_write_reg(imx219, IMX219_REG_HTS,
+@@ -877,7 +890,7 @@ static int imx219_set_pad_format(struct
+ 	struct imx219 *imx219 = to_imx219(sd);
+ 	const struct imx219_mode *mode;
+ 	struct v4l2_mbus_framefmt *framefmt;
+-	int exposure_max, exposure_def, hblank;
++	int exposure_max, exposure_def, hblank, pixel_rate;
+ 	unsigned int i;
+ 
+ 	if (fmt->pad >= NUM_PADS)
+@@ -942,6 +955,12 @@ static int imx219_set_pad_format(struct
+ 						 1,
+ 						 IMX219_PPL_MIN - mode->width);
+ 			__v4l2_ctrl_s_ctrl(imx219->hblank, hblank);
++
++			/* Scale the pixel rate based on the mode specific factor */
++			pixel_rate =
++				IMX219_PIXEL_RATE * imx219->mode->rate_factor;
++			__v4l2_ctrl_modify_range(imx219->pixel_rate, pixel_rate,
++						 pixel_rate, 1, pixel_rate);
+ 		}
+ 	} else {
+ 		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
+@@ -1323,7 +1342,7 @@ static int imx219_init_controls(struct i
+ 	struct v4l2_ctrl_handler *ctrl_hdlr;
+ 	unsigned int height = imx219->mode->height;
+ 	struct v4l2_fwnode_device_properties props;
+-	int exposure_max, exposure_def, hblank;
++	int exposure_max, exposure_def, hblank, pixel_rate;
+ 	int i, ret;
+ 
+ 	ctrl_hdlr = &imx219->ctrl_handler;
+@@ -1335,11 +1354,11 @@ static int imx219_init_controls(struct i
+ 	ctrl_hdlr->lock = &imx219->mutex;
+ 
+ 	/* By default, PIXEL_RATE is read only */
++	pixel_rate = IMX219_PIXEL_RATE * imx219->mode->rate_factor;
+ 	imx219->pixel_rate = v4l2_ctrl_new_std(ctrl_hdlr, &imx219_ctrl_ops,
+ 					       V4L2_CID_PIXEL_RATE,
+-					       IMX219_PIXEL_RATE,
+-					       IMX219_PIXEL_RATE, 1,
+-					       IMX219_PIXEL_RATE);
++					       pixel_rate, pixel_rate,
++					       1, pixel_rate);
+ 
+ 	imx219->link_freq =
+ 		v4l2_ctrl_new_int_menu(ctrl_hdlr, &imx219_ctrl_ops,
diff --git a/target/linux/bcm27xx/patches-6.1/950-0687-hwmon-emc2305-Add-calls-to-initialise-of-cooling-map.patch b/target/linux/bcm27xx/patches-6.1/950-0687-hwmon-emc2305-Add-calls-to-initialise-of-cooling-map.patch
new file mode 100644
index 00000000000000..c08e0411784bde
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0687-hwmon-emc2305-Add-calls-to-initialise-of-cooling-map.patch
@@ -0,0 +1,54 @@
+From 76f8210c9498983b492645ec2c90c5c547ae415b Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 21 Apr 2023 14:49:38 +0100
+Subject: [PATCH] hwmon: emc2305: Add calls to initialise of cooling
+ maps
+
+Commit 46ef9d4ed26b ("hwmon: emc2305: fixups for driver submitted to
+mailing lists") missed adding the call to thermal_of_cooling_device_register
+required to configure any cooling maps for the device, hence stopping it
+from actually ever changing speed.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/hwmon/emc2305.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+--- a/drivers/hwmon/emc2305.c
++++ b/drivers/hwmon/emc2305.c
+@@ -348,9 +348,17 @@ static int emc2305_set_single_tz(struct
+ 	cdev_idx = (idx) ? idx - 1 : 0;
+ 	pwm = data->pwm_min[cdev_idx];
+ 
+-	data->cdev_data[cdev_idx].cdev =
+-		thermal_cooling_device_register(emc2305_fan_name[idx], data,
+-						&emc2305_cooling_ops);
++	if (dev->of_node)
++		data->cdev_data[cdev_idx].cdev =
++			devm_thermal_of_cooling_device_register(dev, dev->of_node,
++								emc2305_fan_name[idx],
++								data,
++								&emc2305_cooling_ops);
++	else
++		data->cdev_data[cdev_idx].cdev =
++			thermal_cooling_device_register(emc2305_fan_name[idx],
++							data,
++							&emc2305_cooling_ops);
+ 
+ 	if (IS_ERR(data->cdev_data[cdev_idx].cdev)) {
+ 		dev_err(dev, "Failed to register cooling device %s\n", emc2305_fan_name[idx]);
+@@ -403,9 +411,11 @@ static void emc2305_unset_tz(struct devi
+ 	int i;
+ 
+ 	/* Unregister cooling device. */
+-	for (i = 0; i < EMC2305_PWM_MAX; i++)
+-		if (data->cdev_data[i].cdev)
+-			thermal_cooling_device_unregister(data->cdev_data[i].cdev);
++	if (!dev->of_node) {
++		for (i = 0; i < EMC2305_PWM_MAX; i++)
++			if (data->cdev_data[i].cdev)
++				thermal_cooling_device_unregister(data->cdev_data[i].cdev);
++	}
+ }
+ 
+ static umode_t
diff --git a/target/linux/bcm27xx/patches-6.1/950-0688-drm-panel-Add-panel-driver-for-Waveshare-DSI-touchsc.patch b/target/linux/bcm27xx/patches-6.1/950-0688-drm-panel-Add-panel-driver-for-Waveshare-DSI-touchsc.patch
new file mode 100644
index 00000000000000..7c445096900205
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0688-drm-panel-Add-panel-driver-for-Waveshare-DSI-touchsc.patch
@@ -0,0 +1,461 @@
+From cd117c5e63682b561b29cac1794e2e4413ad6773 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 14 Apr 2023 13:50:08 +0100
+Subject: [PATCH] drm/panel: Add panel driver for Waveshare DSI
+ touchscreens
+
+Waveshare sell a range of DSI panels of varying sizes, all
+using a common MCU to control the panel and backlight.
+
+Add a panel driver that supports these panels.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/panel/Kconfig               |  10 +
+ drivers/gpu/drm/panel/Makefile              |   1 +
+ drivers/gpu/drm/panel/panel-waveshare-dsi.c | 411 ++++++++++++++++++++
+ 3 files changed, 422 insertions(+)
+ create mode 100644 drivers/gpu/drm/panel/panel-waveshare-dsi.c
+
+--- a/drivers/gpu/drm/panel/Kconfig
++++ b/drivers/gpu/drm/panel/Kconfig
+@@ -720,6 +720,16 @@ config DRM_PANEL_VISIONOX_RM69299
+ 	  Say Y here if you want to enable support for Visionox
+ 	  RM69299  DSI Video Mode panel.
+ 
++config DRM_PANEL_WAVESHARE_TOUCHSCREEN
++	tristate "Waveshare touchscreen panels"
++	depends on DRM_MIPI_DSI
++	depends on I2C
++	depends on BACKLIGHT_CLASS_DEVICE
++	help
++	  Say Y here if you want to enable support for the Waveshare
++	  DSI Touchscreens.  To compile this driver as a module,
++	  choose M here.
++
+ config DRM_PANEL_WIDECHIPS_WS2401
+ 	tristate "Widechips WS2401 DPI panel driver"
+ 	depends on SPI && GPIOLIB
+--- a/drivers/gpu/drm/panel/Makefile
++++ b/drivers/gpu/drm/panel/Makefile
+@@ -73,5 +73,6 @@ obj-$(CONFIG_DRM_PANEL_TPO_TD043MTEA1) +
+ obj-$(CONFIG_DRM_PANEL_TPO_TPG110) += panel-tpo-tpg110.o
+ obj-$(CONFIG_DRM_PANEL_TRULY_NT35597_WQXGA) += panel-truly-nt35597.o
+ obj-$(CONFIG_DRM_PANEL_VISIONOX_RM69299) += panel-visionox-rm69299.o
++obj-$(CONFIG_DRM_PANEL_WAVESHARE_TOUCHSCREEN) += panel-waveshare-dsi.o
+ obj-$(CONFIG_DRM_PANEL_WIDECHIPS_WS2401) += panel-widechips-ws2401.o
+ obj-$(CONFIG_DRM_PANEL_XINPENG_XPP055C272) += panel-xinpeng-xpp055c272.o
+--- /dev/null
++++ b/drivers/gpu/drm/panel/panel-waveshare-dsi.c
+@@ -0,0 +1,411 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright © 2023 Raspberry Pi Ltd
++ *
++ * Based on panel-raspberrypi-touchscreen by Broadcom
++ */
++
++#include <linux/backlight.h>
++#include <linux/delay.h>
++#include <linux/err.h>
++#include <linux/fb.h>
++#include <linux/i2c.h>
++#include <linux/media-bus-format.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
++#include <linux/of_graph.h>
++#include <linux/pm.h>
++
++#include <drm/drm_crtc.h>
++#include <drm/drm_device.h>
++#include <drm/drm_mipi_dsi.h>
++#include <drm/drm_panel.h>
++
++#define WS_DSI_DRIVER_NAME "ws-ts-dsi"
++
++struct ws_panel {
++	struct drm_panel base;
++	struct mipi_dsi_device *dsi;
++	struct i2c_client *i2c;
++	const struct drm_display_mode *mode;
++	enum drm_panel_orientation orientation;
++};
++
++/* 2.8inch 480x640
++ * https://www.waveshare.com/product/raspberry-pi/displays/2.8inch-dsi-lcd.htm
++ */
++static const struct drm_display_mode ws_panel_2_8_mode = {
++	.clock = 50000,
++	.hdisplay = 480,
++	.hsync_start = 480 + 150,
++	.hsync_end = 480 + 150 + 50,
++	.htotal = 480 + 150 + 50 + 150,
++	.vdisplay = 640,
++	.vsync_start = 640 + 150,
++	.vsync_end = 640 + 150 + 50,
++	.vtotal = 640 + 150 + 50 + 150,
++};
++
++/* 3.4inch 800x800 Round
++ * https://www.waveshare.com/product/displays/lcd-oled/3.4inch-dsi-lcd-c.htm
++ */
++static const struct drm_display_mode ws_panel_3_4_mode = {
++	.clock = 50000,
++	.hdisplay = 800,
++	.hsync_start = 800 + 32,
++	.hsync_end = 800 + 32 + 6,
++	.htotal = 800 + 32 + 6 + 120,
++	.vdisplay = 800,
++	.vsync_start = 800 + 8,
++	.vsync_end = 800 + 8 + 4,
++	.vtotal = 800 + 8 + 4 + 16,
++};
++
++/* 4.0inch 480x800
++ * https://www.waveshare.com/product/raspberry-pi/displays/4inch-dsi-lcd.htm
++ */
++static const struct drm_display_mode ws_panel_4_0_mode = {
++	.clock = 50000,
++	.hdisplay = 480,
++	.hsync_start = 480 + 150,
++	.hsync_end = 480 + 150 + 100,
++	.htotal = 480 + 150 + 100 + 150,
++	.vdisplay = 800,
++	.vsync_start = 800 + 20,
++	.vsync_end = 800 + 20 + 100,
++	.vtotal = 800 + 20 + 100 + 20,
++};
++
++/* 7.0inch C 1024x600
++ * https://www.waveshare.com/product/raspberry-pi/displays/lcd-oled/7inch-dsi-lcd-c-with-case-a.htm
++ */
++static const struct drm_display_mode ws_panel_7_0_c_mode = {
++	.clock = 50000,
++	.hdisplay = 1024,
++	.hsync_start = 1024 + 100,
++	.hsync_end = 1024 + 100 + 100,
++	.htotal = 1024 + 100 + 100 + 100,
++	.vdisplay = 600,
++	.vsync_start = 600 + 10,
++	.vsync_end = 600 + 10 + 10,
++	.vtotal = 600 + 10 + 10 + 10,
++};
++
++/* 7.9inch 400x1280
++ * https://www.waveshare.com/product/raspberry-pi/displays/7.9inch-dsi-lcd.htm
++ */
++static const struct drm_display_mode ws_panel_7_9_mode = {
++	.clock = 50000,
++	.hdisplay = 400,
++	.hsync_start = 400 + 40,
++	.hsync_end = 400 + 40 + 30,
++	.htotal = 400 + 40 + 30 + 40,
++	.vdisplay = 1280,
++	.vsync_start = 1280 + 20,
++	.vsync_end = 1280 + 20 + 10,
++	.vtotal = 1280 + 20 + 10 + 20,
++};
++
++/* 8.0inch or 10.1inch 1280x800
++ * https://www.waveshare.com/product/raspberry-pi/displays/8inch-dsi-lcd-c.htm
++ * https://www.waveshare.com/product/raspberry-pi/displays/10.1inch-dsi-lcd-c.htm
++ */
++static const struct drm_display_mode ws_panel_10_1_mode = {
++	.clock = 76800,
++	.hdisplay = 1280,
++	.hsync_start = 1280 + 40,
++	.hsync_end = 1280 + 40 + 20,
++	.htotal = 1280 + 40 + 20 + 40,
++	.vdisplay = 800,
++	.vsync_start = 800 + 40,
++	.vsync_end = 800 + 40 + 48,
++	.vtotal = 800 + 40 + 48 + 40,
++};
++
++/* 11.9inch 320x1480
++ * https://www.waveshare.com/product/raspberry-pi/displays/11.9inch-dsi-lcd.htm
++ */
++static const struct drm_display_mode ws_panel_11_9_mode = {
++	.clock = 50000,
++	.hdisplay = 320,
++	.hsync_start = 320 + 60,
++	.hsync_end = 320 + 60 + 60,
++	.htotal = 320 + 60 + 60 + 120,
++	.vdisplay = 1480,
++	.vsync_start = 1480 + 60,
++	.vsync_end = 1480 + 60 + 60,
++	.vtotal = 1480 + 60 + 60 + 60,
++};
++
++static struct ws_panel *panel_to_ts(struct drm_panel *panel)
++{
++	return container_of(panel, struct ws_panel, base);
++}
++
++static void ws_panel_i2c_write(struct ws_panel *ts, u8 reg, u8 val)
++{
++	int ret;
++
++	ret = i2c_smbus_write_byte_data(ts->i2c, reg, val);
++	if (ret)
++		dev_err(&ts->i2c->dev, "I2C write failed: %d\n", ret);
++}
++
++static int ws_panel_disable(struct drm_panel *panel)
++{
++	struct ws_panel *ts = panel_to_ts(panel);
++
++	ws_panel_i2c_write(ts, 0xad, 0x00);
++
++	return 0;
++}
++
++static int ws_panel_unprepare(struct drm_panel *panel)
++{
++	return 0;
++}
++
++static int ws_panel_prepare(struct drm_panel *panel)
++{
++	return 0;
++}
++
++static int ws_panel_enable(struct drm_panel *panel)
++{
++	struct ws_panel *ts = panel_to_ts(panel);
++
++	ws_panel_i2c_write(ts, 0xad, 0x01);
++
++	return 0;
++}
++
++static int ws_panel_get_modes(struct drm_panel *panel,
++			      struct drm_connector *connector)
++{
++	static const u32 bus_format = MEDIA_BUS_FMT_RGB888_1X24;
++	struct ws_panel *ts = panel_to_ts(panel);
++	struct drm_display_mode *mode;
++
++	mode = drm_mode_duplicate(connector->dev, ts->mode);
++	if (!mode) {
++		dev_err(panel->dev, "failed to add mode %ux%u@%u\n",
++			ts->mode->hdisplay,
++			ts->mode->vdisplay,
++			drm_mode_vrefresh(ts->mode));
++	}
++
++	mode->type |= DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
++
++	drm_mode_set_name(mode);
++
++	drm_mode_probed_add(connector, mode);
++
++	connector->display_info.bpc = 8;
++	connector->display_info.width_mm = 154;
++	connector->display_info.height_mm = 86;
++	drm_display_info_set_bus_formats(&connector->display_info,
++					 &bus_format, 1);
++
++	/*
++	 * TODO: Remove once all drm drivers call
++	 * drm_connector_set_orientation_from_panel()
++	 */
++	drm_connector_set_panel_orientation(connector, ts->orientation);
++
++	return 1;
++}
++
++static enum drm_panel_orientation ws_panel_get_orientation(struct drm_panel *panel)
++{
++	struct ws_panel *ts = panel_to_ts(panel);
++
++	return ts->orientation;
++}
++
++static const struct drm_panel_funcs ws_panel_funcs = {
++	.disable = ws_panel_disable,
++	.unprepare = ws_panel_unprepare,
++	.prepare = ws_panel_prepare,
++	.enable = ws_panel_enable,
++	.get_modes = ws_panel_get_modes,
++	.get_orientation = ws_panel_get_orientation,
++};
++
++static int ws_panel_bl_update_status(struct backlight_device *bl)
++{
++	struct ws_panel *ts = bl_get_data(bl);
++
++	ws_panel_i2c_write(ts, 0xab, 0xff - backlight_get_brightness(bl));
++	ws_panel_i2c_write(ts, 0xaa, 0x01);
++
++	return 0;
++}
++
++static const struct backlight_ops ws_panel_bl_ops = {
++	.update_status = ws_panel_bl_update_status,
++};
++
++static struct backlight_device *
++ws_panel_create_backlight(struct ws_panel *ts)
++{
++	struct device *dev = ts->base.dev;
++	const struct backlight_properties props = {
++		.type = BACKLIGHT_RAW,
++		.brightness = 255,
++		.max_brightness = 255,
++	};
++
++	return devm_backlight_device_register(dev, dev_name(dev), dev, ts,
++					      &ws_panel_bl_ops, &props);
++}
++
++static int ws_panel_probe(struct i2c_client *i2c,
++			  const struct i2c_device_id *id)
++{
++	struct device *dev = &i2c->dev;
++	struct ws_panel *ts;
++	struct device_node *endpoint, *dsi_host_node;
++	struct mipi_dsi_host *host;
++	struct mipi_dsi_device_info info = {
++		.type = WS_DSI_DRIVER_NAME,
++		.channel = 0,
++		.node = NULL,
++	};
++	int ret;
++
++	ts = devm_kzalloc(dev, sizeof(*ts), GFP_KERNEL);
++	if (!ts)
++		return -ENOMEM;
++
++	ts->mode = of_device_get_match_data(dev);
++	if (!ts->mode)
++		return -EINVAL;
++
++	i2c_set_clientdata(i2c, ts);
++
++	ts->i2c = i2c;
++
++	ws_panel_i2c_write(ts, 0xc0, 0x01);
++	ws_panel_i2c_write(ts, 0xc2, 0x01);
++	ws_panel_i2c_write(ts, 0xac, 0x01);
++
++	ret = of_drm_get_panel_orientation(dev->of_node, &ts->orientation);
++	if (ret) {
++		dev_err(dev, "%pOF: failed to get orientation %d\n", dev->of_node, ret);
++		return ret;
++	}
++
++	/* Look up the DSI host.  It needs to probe before we do. */
++	endpoint = of_graph_get_next_endpoint(dev->of_node, NULL);
++	if (!endpoint)
++		return -ENODEV;
++
++	dsi_host_node = of_graph_get_remote_port_parent(endpoint);
++	if (!dsi_host_node)
++		goto error;
++
++	host = of_find_mipi_dsi_host_by_node(dsi_host_node);
++	of_node_put(dsi_host_node);
++	if (!host) {
++		of_node_put(endpoint);
++		return -EPROBE_DEFER;
++	}
++
++	info.node = of_graph_get_remote_port(endpoint);
++	if (!info.node)
++		goto error;
++
++	of_node_put(endpoint);
++
++	ts->dsi = devm_mipi_dsi_device_register_full(dev, host, &info);
++	if (IS_ERR(ts->dsi)) {
++		dev_err(dev, "DSI device registration failed: %ld\n",
++			PTR_ERR(ts->dsi));
++		return PTR_ERR(ts->dsi);
++	}
++
++	drm_panel_init(&ts->base, dev, &ws_panel_funcs,
++		       DRM_MODE_CONNECTOR_DSI);
++
++	ts->base.backlight = ws_panel_create_backlight(ts);
++	if (IS_ERR(ts->base.backlight)) {
++		ret = PTR_ERR(ts->base.backlight);
++		dev_err(dev, "Failed to create backlight: %d\n", ret);
++		return ret;
++	}
++
++	/* This appears last, as it's what will unblock the DSI host
++	 * driver's component bind function.
++	 */
++	drm_panel_add(&ts->base);
++
++	ts->dsi->mode_flags = (MIPI_DSI_MODE_VIDEO |
++			   MIPI_DSI_MODE_VIDEO_SYNC_PULSE |
++			   MIPI_DSI_MODE_LPM);
++	ts->dsi->format = MIPI_DSI_FMT_RGB888;
++	ts->dsi->lanes = 2;
++
++	ret = devm_mipi_dsi_attach(dev, ts->dsi);
++
++	if (ret)
++		dev_err(dev, "failed to attach dsi to host: %d\n", ret);
++
++	return 0;
++
++error:
++	of_node_put(endpoint);
++	return -ENODEV;
++}
++
++static void ws_panel_remove(struct i2c_client *i2c)
++{
++	struct ws_panel *ts = i2c_get_clientdata(i2c);
++
++	drm_panel_remove(&ts->base);
++}
++
++static const struct of_device_id ws_panel_of_ids[] = {
++	{
++		.compatible = "waveshare,2.8inch-panel",
++		.data = &ws_panel_2_8_mode,
++	}, {
++		.compatible = "waveshare,3.4inch-panel",
++		.data = &ws_panel_3_4_mode,
++	}, {
++		.compatible = "waveshare,4.0inch-panel",
++		.data = &ws_panel_4_0_mode,
++	}, {
++		.compatible = "waveshare,7.0inch-c-panel",
++		.data = &ws_panel_7_0_c_mode,
++	}, {
++		.compatible = "waveshare,7.9inch-panel",
++		.data = &ws_panel_7_9_mode,
++	}, {
++		.compatible = "waveshare,8.0inch-panel",
++		.data = &ws_panel_10_1_mode,
++	}, {
++		.compatible = "waveshare,10.1inch-panel",
++		.data = &ws_panel_10_1_mode,
++	}, {
++		.compatible = "waveshare,11.9inch-panel",
++		.data = &ws_panel_11_9_mode,
++	}, {
++		/* sentinel */
++	}
++};
++MODULE_DEVICE_TABLE(of, ws_panel_of_ids);
++
++static struct i2c_driver ws_panel_driver = {
++	.driver = {
++		.name = "ws_touchscreen",
++		.of_match_table = ws_panel_of_ids,
++	},
++	.probe = ws_panel_probe,
++	.remove = ws_panel_remove,
++};
++module_i2c_driver(ws_panel_driver);
++
++MODULE_AUTHOR("Dave Stevenson <dave.stevenson@raspberrypi.com>");
++MODULE_DESCRIPTION("Waveshare DSI panel driver");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0689-input-goodix-Add-option-to-poll-instead-of-relying-o.patch b/target/linux/bcm27xx/patches-6.1/950-0689-input-goodix-Add-option-to-poll-instead-of-relying-o.patch
new file mode 100644
index 00000000000000..008bdf36da70ab
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0689-input-goodix-Add-option-to-poll-instead-of-relying-o.patch
@@ -0,0 +1,139 @@
+From 13a9614267e7d8d4075144a7bf4dbebfcc565367 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 30 Jan 2023 14:46:16 +0000
+Subject: [PATCH] input: goodix: Add option to poll instead of relying
+ on IRQ line
+
+The interrupt line from the touch controller is not necessarily
+connected to the SoC, so add the option to poll for touch info.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/input/touchscreen/goodix.c | 70 +++++++++++++++++++++++++++---
+ drivers/input/touchscreen/goodix.h |  2 +
+ 2 files changed, 66 insertions(+), 6 deletions(-)
+
+--- a/drivers/input/touchscreen/goodix.c
++++ b/drivers/input/touchscreen/goodix.c
+@@ -48,6 +48,8 @@
+ #define MAX_CONTACTS_LOC	5
+ #define TRIGGER_LOC		6
+ 
++#define POLL_INTERVAL_MS		17	/* 17ms = 60fps */
++
+ /* Our special handling for GPIO accesses through ACPI is x86 specific */
+ #if defined CONFIG_X86 && defined CONFIG_ACPI
+ #define ACPI_GPIO_SUPPORT
+@@ -513,16 +515,67 @@ static irqreturn_t goodix_ts_irq_handler
+ 	return IRQ_HANDLED;
+ }
+ 
++static void goodix_ts_irq_poll_timer(struct timer_list *t)
++{
++	struct goodix_ts_data *ts = from_timer(ts, t, timer);
++
++	schedule_work(&ts->work_i2c_poll);
++	mod_timer(&ts->timer, jiffies + msecs_to_jiffies(POLL_INTERVAL_MS));
++}
++
++static void goodix_ts_work_i2c_poll(struct work_struct *work)
++{
++	struct goodix_ts_data *ts = container_of(work,
++			struct goodix_ts_data, work_i2c_poll);
++
++	goodix_process_events(ts);
++	goodix_i2c_write_u8(ts->client, GOODIX_READ_COOR_ADDR, 0);
++}
++
++static void goodix_enable_irq(struct goodix_ts_data *ts)
++{
++	if (ts->client->irq) {
++		enable_irq(ts->client->irq);
++	} else {
++		ts->timer.expires = jiffies + msecs_to_jiffies(POLL_INTERVAL_MS);
++		add_timer(&ts->timer);
++	}
++}
++
++static void goodix_disable_irq(struct goodix_ts_data *ts)
++{
++	if (ts->client->irq) {
++		disable_irq(ts->client->irq);
++	} else {
++		del_timer(&ts->timer);
++		cancel_work_sync(&ts->work_i2c_poll);
++	}
++}
++
+ static void goodix_free_irq(struct goodix_ts_data *ts)
+ {
+-	devm_free_irq(&ts->client->dev, ts->client->irq, ts);
++	if (ts->client->irq) {
++		devm_free_irq(&ts->client->dev, ts->client->irq, ts);
++	} else {
++		del_timer(&ts->timer);
++		cancel_work_sync(&ts->work_i2c_poll);
++	}
+ }
+ 
+ static int goodix_request_irq(struct goodix_ts_data *ts)
+ {
+-	return devm_request_threaded_irq(&ts->client->dev, ts->client->irq,
+-					 NULL, goodix_ts_irq_handler,
+-					 ts->irq_flags, ts->client->name, ts);
++	if (ts->client->irq) {
++		return devm_request_threaded_irq(&ts->client->dev, ts->client->irq,
++						 NULL, goodix_ts_irq_handler,
++						 ts->irq_flags, ts->client->name, ts);
++	} else {
++		INIT_WORK(&ts->work_i2c_poll,
++			  goodix_ts_work_i2c_poll);
++		timer_setup(&ts->timer, goodix_ts_irq_poll_timer, 0);
++		if (ts->irq_pin_access_method == IRQ_PIN_ACCESS_NONE)
++			goodix_enable_irq(ts);
++		return 0;
++	}
+ }
+ 
+ static int goodix_check_cfg_8(struct goodix_ts_data *ts, const u8 *cfg, int len)
+@@ -1406,6 +1459,11 @@ static void goodix_ts_remove(struct i2c_
+ {
+ 	struct goodix_ts_data *ts = i2c_get_clientdata(client);
+ 
++	if (!client->irq) {
++		del_timer(&ts->timer);
++		cancel_work_sync(&ts->work_i2c_poll);
++	}
++
+ 	if (ts->load_cfg_from_disk)
+ 		wait_for_completion(&ts->firmware_loading_complete);
+ }
+@@ -1421,7 +1479,7 @@ static int __maybe_unused goodix_suspend
+ 
+ 	/* We need gpio pins to suspend/resume */
+ 	if (ts->irq_pin_access_method == IRQ_PIN_ACCESS_NONE) {
+-		disable_irq(client->irq);
++		goodix_disable_irq(ts);
+ 		return 0;
+ 	}
+ 
+@@ -1465,7 +1523,7 @@ static int __maybe_unused goodix_resume(
+ 	int error;
+ 
+ 	if (ts->irq_pin_access_method == IRQ_PIN_ACCESS_NONE) {
+-		enable_irq(client->irq);
++		goodix_enable_irq(ts);
+ 		return 0;
+ 	}
+ 
+--- a/drivers/input/touchscreen/goodix.h
++++ b/drivers/input/touchscreen/goodix.h
+@@ -104,6 +104,8 @@ struct goodix_ts_data {
+ 	u8 main_clk[GOODIX_MAIN_CLK_LEN];
+ 	int bak_ref_len;
+ 	u8 *bak_ref;
++	struct timer_list timer;
++	struct work_struct work_i2c_poll;
+ };
+ 
+ int goodix_i2c_read(struct i2c_client *client, u16 reg, u8 *buf, int len);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0690-dtoverlays-Add-an-overlay-for-the-Waveshare-DSI-scre.patch b/target/linux/bcm27xx/patches-6.1/950-0690-dtoverlays-Add-an-overlay-for-the-Waveshare-DSI-scre.patch
new file mode 100644
index 00000000000000..855ea9bd4cb50e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0690-dtoverlays-Add-an-overlay-for-the-Waveshare-DSI-scre.patch
@@ -0,0 +1,190 @@
+From 6e1ccf7cfe1b758963743b88fa1b078b011c77b3 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 14 Apr 2023 13:57:52 +0100
+Subject: [PATCH] dtoverlays: Add an overlay for the Waveshare DSI
+ screens
+
+They come in varying sizes, but all have the same MCU for
+power control and touch controller.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/Makefile           |   1 +
+ arch/arm/boot/dts/overlays/README             |  28 ++++
+ .../vc4-kms-dsi-waveshare-panel-overlay.dts   | 123 ++++++++++++++++++
+ 3 files changed, 152 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dsi-waveshare-panel-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -272,6 +272,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	vc4-kms-dsi-7inch.dtbo \
+ 	vc4-kms-dsi-lt070me05000.dtbo \
+ 	vc4-kms-dsi-lt070me05000-v2.dtbo \
++	vc4-kms-dsi-waveshare-panel.dtbo \
+ 	vc4-kms-kippah-7inch.dtbo \
+ 	vc4-kms-v3d.dtbo \
+ 	vc4-kms-v3d-pi4.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -4493,6 +4493,34 @@ Load:   dtoverlay=vc4-kms-dsi-lt070me050
+ Params: <None>
+ 
+ 
++Name:   vc4-kms-dsi-waveshare-panel
++Info:   Enable a Waveshare DSI touchscreen
++        Includes the Goodix driver for the touchscreen element.
++        The default is for the display to be using the I2C0 option for control.
++        Use the i2c1 override if using the I2C1 wiring with jumper wires from
++        GPIOs 2&3 (pins 3&5).
++        invx/invy/swapxy should be used with caution as the panel specifier will
++        set the default inversions for that panel. Always use them after the
++        panel specifier, and be aware that you may need to set them as =0, not
++        just adding it.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dsi-waveshare-panel,<param>=<val>
++Params: 2_8_inch                2.8" 480x640
++        3_4_inch                3.4" 800x800 round
++        4_0_inch                4.0" 480x800
++        7_0_inchC               7.0" C 1024x600
++        7_9_inch                7.9" 400x1280
++        8_0_inch                8.0" 1280x800
++        10_1_inch               10.1" 1280x800
++        11_9_inch               11.9" 320x1480
++        i2c1                    Use i2c-1 with jumper wires from GPIOs 2&3
++        disable_touch           Disable the touch controller
++        rotation                Set the panel orientation property
++        invx                    Touchscreen inverted x axis
++        invy                    Touchscreen inverted y axis
++        swapxy                  Touchscreen swapped x y axis
++
++
+ Name:   vc4-kms-kippah-7inch
+ Info:   This overlay is now deprecated - see vc4-kms-dpi-panel,kippah-7inch
+ Load:   <Deprecated>
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dsi-waveshare-panel-overlay.dts
+@@ -0,0 +1,123 @@
++/*
++ * Device Tree overlay for Waveshare DSI Touchscreens
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&dsi1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			port {
++				dsi_out: endpoint {
++					remote-endpoint = <&panel_in>;
++				};
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++		};
++	};
++
++	frag2: fragment@2 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			panel: panel_disp1@45 {
++				reg = <0x45>;
++				compatible = "waveshare,10.1inch-panel";
++
++				port {
++					panel_in: endpoint {
++						remote-endpoint = <&dsi_out>;
++					};
++				};
++			};
++
++			touch: goodix@14 {
++				reg = <0x14>;
++				compatible = "goodix,gt911";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@5 {
++		target = <&i2c_arm>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		2_8_inch = <&panel>, "compatible=waveshare,2.8inch-panel",
++				   <&touch>, "touchscreen-size-x:0=640",
++				   <&touch>, "touchscreen-size-y:0=480",
++				   <&touch>, "touchscreen-inverted-y?",
++				   <&touch>, "touchscreen-swapped-x-y?";
++		3_4_inch = <&panel>, "compatible=waveshare,3.4inch-panel",
++				   <&touch>, "touchscreen-size-x:0=800",
++				   <&touch>, "touchscreen-size-y:0=800";
++		4_0_inch = <&panel>, "compatible=waveshare,4.0inch-panel",
++				   <&touch>, "touchscreen-size-x:0=800",
++				   <&touch>, "touchscreen-size-y:0=480",
++				   <&touch>, "touchscreen-inverted-x?",
++				   <&touch>, "touchscreen-swapped-x-y?";
++		7_0_inchC = <&panel>, "compatible=waveshare,7.0inch-c-panel",
++				   <&touch>, "touchscreen-size-x:0=800",
++				   <&touch>, "touchscreen-size-y:0=480";
++		7_9_inch = <&panel>, "compatible=waveshare,7.9inch-panel",
++				   <&touch>, "touchscreen-size-x:0=400",
++				   <&touch>, "touchscreen-size-y:0=1280",
++				   <&touch>, "touchscreen-inverted-x?",
++				   <&touch>, "touchscreen-inverted-y?";
++		8_0_inch = <&panel>, "compatible=waveshare,8.0inch-panel",
++				   <&touch>, "touchscreen-size-x:0=800",
++				   <&touch>, "touchscreen-size-y:0=1280",
++				   <&touch>, "touchscreen-inverted-x?",
++				   <&touch>, "touchscreen-swapped-x-y?";
++		10_1_inch = <&panel>, "compatible=waveshare,10.1inch-panel",
++				   <&touch>, "touchscreen-size-x:0=800",
++				   <&touch>, "touchscreen-size-y:0=1280",
++				   <&touch>, "touchscreen-inverted-x?",
++				   <&touch>, "touchscreen-swapped-x-y?";
++		11_9_inch = <&panel>, "compatible=waveshare,11.9inch-panel",
++				   <&touch>, "touchscreen-size-x:0=320",
++				   <&touch>, "touchscreen-size-y:0=1480",
++				   <&touch>, "touchscreen-inverted-x?",
++				   <&touch>, "touchscreen-swapped-x-y?";
++		i2c1 = <&frag2>, "target:0=",<&i2c1>,
++		       <0>, "-3-4+5";
++		disable_touch = <&touch>, "status=disabled";
++		rotation = <&panel>, "rotation:0";
++		invx = <&touch>,"touchscreen-inverted-x?";
++		invy = <&touch>,"touchscreen-inverted-y?";
++		swapxy = <&touch>,"touchscreen-swapped-x-y?";
++	};
++};
diff --git a/target/linux/bcm27xx/patches-6.1/950-0691-arm-boot-dts-overlays-mipi-dbi-spi-fix-default-brigh.patch b/target/linux/bcm27xx/patches-6.1/950-0691-arm-boot-dts-overlays-mipi-dbi-spi-fix-default-brigh.patch
new file mode 100644
index 00000000000000..337a502f970074
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0691-arm-boot-dts-overlays-mipi-dbi-spi-fix-default-brigh.patch
@@ -0,0 +1,30 @@
+From d566473897f50c1531111f117d4a84fdf5729729 Mon Sep 17 00:00:00 2001
+From: David Lechner <david@lechnology.com>
+Date: Mon, 24 Apr 2023 10:15:59 -0500
+Subject: [PATCH] arm/boot/dts/overlays/mipi-dbi-spi: fix default
+ brightness (#5442)
+
+There is an off-by-one error in the default brightness for the PWM backlight
+in the MIPI DBI SPI overlay that produces the following message in the
+kernel logs:
+
+    pwm-backlight backlight_pwm: invalid default brightness level: 16, using 15
+
+The value is 0-based, so the max brightness is 15, not 16.
+
+Signed-off-by: David Lechner <david@lechnology.com>
+---
+ arch/arm/boot/dts/overlays/mipi-dbi-spi-overlay.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/overlays/mipi-dbi-spi-overlay.dts
++++ b/arch/arm/boot/dts/overlays/mipi-dbi-spi-overlay.dts
+@@ -80,7 +80,7 @@
+ 			backlight_pwm: backlight_pwm {
+ 				compatible = "pwm-backlight";
+ 				brightness-levels = <0 6 8 12 16 24 32 40 48 64 96 128 160 192 224 255>;
+-				default-brightness-level = <16>;
++				default-brightness-level = <15>;
+ 				pwms = <&pwm 0 200000>;
+ 			};
+ 		};
diff --git a/target/linux/bcm27xx/patches-6.1/950-0692-dtoverlays-Add-overrides-for-alternate-i2c-buses-to-.patch b/target/linux/bcm27xx/patches-6.1/950-0692-dtoverlays-Add-overrides-for-alternate-i2c-buses-to-.patch
new file mode 100644
index 00000000000000..095e115fc7dc79
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0692-dtoverlays-Add-overrides-for-alternate-i2c-buses-to-.patch
@@ -0,0 +1,116 @@
+From 911dedf3f51adf8cfd6554af1c89c922c4453889 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 24 Apr 2023 16:27:57 +0100
+Subject: [PATCH] dtoverlays: Add overrides for alternate i2c buses to
+ i2c-mux
+
+The i2c-mux overlay was fixed to i2c-1. Add overrides to allow
+it to be assigned to alternate buses.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README             | 16 ++++++++
+ .../arm/boot/dts/overlays/i2c-mux-overlay.dts | 40 +++++++++++++++++--
+ 2 files changed, 53 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -1833,6 +1833,22 @@ Params: pca9542                 Select t
+ 
+         addr                    Change I2C address of the device (default 0x70)
+ 
++        i2c0                    Choose the I2C0 bus on GPIOs 0&1
++
++        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++
++        i2c3                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++
++        i2c4                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++
++        i2c5                    Choose the I2C5 bus (configure with the i2c4
++                                overlay - BCM2711 only)
++
++        i2c6                    Choose the I2C6 bus (configure with the i2c6
++                                overlay - BCM2711 only)
++
+ 
+ [ The i2c-mux-pca9548a overlay has been deleted. See i2c-mux. ]
+ 
+--- a/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
+@@ -7,7 +7,7 @@
+ 	compatible = "brcm,bcm2835";
+ 
+ 	fragment@0 {
+-		target = <&i2c_arm>;
++		target = <&i2cbus>;
+ 		__dormant__ {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+@@ -34,7 +34,7 @@
+ 	};
+ 
+ 	fragment@1 {
+-		target = <&i2c_arm>;
++		target = <&i2cbus>;
+ 		__dormant__ {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+@@ -71,7 +71,7 @@
+ 	};
+ 
+ 	fragment@2 {
+-		target = <&i2c_arm>;
++		target = <&i2cbus>;
+ 		__dormant__ {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+@@ -127,6 +127,27 @@
+ 		};
+ 	};
+ 
++	frag100: fragment@100 {
++		target = <&i2c_arm>;
++		i2cbus: __overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@101 {
++		target = <&i2c0if>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@102 {
++		target = <&i2c0mux>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
+ 	__overrides__ {
+ 		pca9542 = <0>, "+0";
+ 		pca9545 = <0>, "+1";
+@@ -135,5 +156,18 @@
+ 		addr =  <&pca9542>,"reg:0",
+ 			<&pca9545>,"reg:0",
+ 			<&pca9548>,"reg:0";
++
++		i2c0 = <&frag100>, "target:0=",<&i2c0>,
++			      <0>,"+101+102";
++		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
++			      <0>,"+101+102";
++		i2c3 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c3";
++		i2c4 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c4";
++		i2c5 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c5";
++		i2c6 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c6";
+ 	};
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0693-dtoverlays-Add-overrides-for-alternate-i2c-buses-to-.patch b/target/linux/bcm27xx/patches-6.1/950-0693-dtoverlays-Add-overrides-for-alternate-i2c-buses-to-.patch
new file mode 100644
index 00000000000000..5e6b0d3161d755
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0693-dtoverlays-Add-overrides-for-alternate-i2c-buses-to-.patch
@@ -0,0 +1,88 @@
+From aa985e8be1c2fe4600b68831808c0b70241a37a6 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 24 Apr 2023 16:30:07 +0100
+Subject: [PATCH] dtoverlays: Add overrides for alternate i2c buses to
+ i2c-pwm-pva9685a
+
+The i2c-pwm-pca9685a overlay was fixed to i2c-1. Add overrides to allow
+it to be assigned to alternate buses.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README             | 10 +++++
+ .../dts/overlays/i2c-pwm-pca9685a-overlay.dts | 37 ++++++++++++++++++-
+ 2 files changed, 46 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -1857,6 +1857,16 @@ Name:   i2c-pwm-pca9685a
+ Info:   Adds support for an NXP PCA9685A I2C PWM controller on i2c_arm
+ Load:   dtoverlay=i2c-pwm-pca9685a,<param>=<val>
+ Params: addr                    I2C address of PCA9685A (default 0x40)
++        i2c0                    Choose the I2C0 bus on GPIOs 0&1
++        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++        i2c3                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++        i2c4                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++        i2c5                    Choose the I2C5 bus (configure with the i2c4
++                                overlay - BCM2711 only)
++        i2c6                    Choose the I2C6 bus (configure with the i2c6
++                                overlay - BCM2711 only)
+ 
+ 
+ Name:   i2c-rtc
+--- a/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
+@@ -6,7 +6,7 @@
+ 	compatible = "brcm,bcm2835";
+ 
+ 	fragment@0 {
+-		target = <&i2c_arm>;
++		target = <&i2cbus>;
+ 		__overlay__ {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+@@ -20,7 +20,42 @@
+ 			};
+ 		};
+ 	};
++
++
++	frag100: fragment@100 {
++		target = <&i2c_arm>;
++		i2cbus: __overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@101 {
++		target = <&i2c0if>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@102 {
++		target = <&i2c0mux>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
+ 	__overrides__ {
+ 		addr = <&pca>,"reg:0";
++		i2c0 = <&frag100>, "target:0=",<&i2c0>,
++			      <0>,"+101+102";
++		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
++			      <0>,"+101+102";
++		i2c3 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c3";
++		i2c4 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c4";
++		i2c5 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c5";
++		i2c6 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c6";
+ 	};
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0694-fixup-Export-optimised-__memcpy.patch b/target/linux/bcm27xx/patches-6.1/950-0694-fixup-Export-optimised-__memcpy.patch
new file mode 100644
index 00000000000000..d4b7395a669dae
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0694-fixup-Export-optimised-__memcpy.patch
@@ -0,0 +1,27 @@
+From b8b90753b5c70bfe57c460305e30992e027d0d7a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 11 Apr 2023 08:55:49 +0100
+Subject: [PATCH] fixup! Export optimised __memcpy
+
+Sinc [1] uaccess_with_memcpy.c uses __memcpy instead of memcpy. Make
+the optimised memcpy available as __memcpy as well to avoid linkage
+failures.
+
+[1] ceac10c83b33 ("ARM: 9290/1: uaccess: Fix KASAN false-positives")
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/lib/memcpy_rpi.S | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/lib/memcpy_rpi.S
++++ b/arch/arm/lib/memcpy_rpi.S
+@@ -58,6 +58,8 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBI
+ 
+ ENTRY(mmiocpy)
+ ENTRY(memcpy)
++ENTRY(__memcpy)
+         memcpy  0
++ENDPROC(__memcpy)
+ ENDPROC(memcpy)
+ ENDPROC(mmiocpy)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0695-hwmon-emc2305-Change-OF-properties-pwm-min-pwm-max-t.patch b/target/linux/bcm27xx/patches-6.1/950-0695-hwmon-emc2305-Change-OF-properties-pwm-min-pwm-max-t.patch
new file mode 100644
index 00000000000000..6be34bf9b78725
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0695-hwmon-emc2305-Change-OF-properties-pwm-min-pwm-max-t.patch
@@ -0,0 +1,69 @@
+From ab304fd0099444dc7535c81abbbc0077cd878d7e Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 21 Apr 2023 15:48:39 +0100
+Subject: [PATCH] hwmon: emc2305: Change OF properties pwm-min &
+ pwm-max to u8
+
+There is no DT binding for emc2305 as mainline are still
+discussing how to do a generic fan binding.
+The 5.15 driver was reading the "emc2305," properties
+"cooling-levels", "pwm-max", "pwm-min", and "pwm-channel" as u8.
+The overlay was writing them as u16 (;) so it was working.
+
+The 6.1 driver was reading as u32, which failed as there is
+insufficient data.
+
+As this is all downstream only, revert to u8 to match 5.15.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/hwmon/emc2305.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/hwmon/emc2305.c
++++ b/drivers/hwmon/emc2305.c
+@@ -301,36 +301,36 @@ static int emc2305_get_tz_of(struct devi
+ 	struct device_node *np = dev->of_node;
+ 	struct emc2305_data *data = dev_get_drvdata(dev);
+ 	int ret = 0;
+-	u32 val;
++	u8 val;
+ 	int i;
+ 
+ 	/* OF parameters are optional - overwrite default setting
+ 	 * if some of them are provided.
+ 	 */
+ 
+-	ret = of_property_read_u32(np, "emc2305,cooling-levels", &val);
++	ret = of_property_read_u8(np, "emc2305,cooling-levels", &val);
+ 	if (!ret)
+-		data->max_state = (u8)val;
++		data->max_state = val;
+ 	else if (ret != -EINVAL)
+ 		return ret;
+ 
+-	ret = of_property_read_u32(np, "emc2305,pwm-max", &val);
++	ret = of_property_read_u8(np, "emc2305,pwm-max", &val);
+ 	if (!ret)
+-		data->pwm_max = (u8)val;
++		data->pwm_max = val;
+ 	else if (ret != -EINVAL)
+ 		return ret;
+ 
+-	ret = of_property_read_u32(np, "emc2305,pwm-min", &val);
++	ret = of_property_read_u8(np, "emc2305,pwm-min", &val);
+ 	if (!ret)
+ 		for (i = 0; i < EMC2305_PWM_MAX; i++)
+-			data->pwm_min[i] = (u8)val;
++			data->pwm_min[i] = val;
+ 	else if (ret != -EINVAL)
+ 		return ret;
+ 
+ 	/* Not defined or 0 means one thermal zone over all cooling devices.
+ 	 * Otherwise - separated thermal zones for each PWM channel.
+ 	 */
+-	ret = of_property_read_u32(np, "emc2305,pwm-channel", &val);
++	ret = of_property_read_u8(np, "emc2305,pwm-channel", &val);
+ 	if (!ret)
+ 		data->pwm_separate = (val != 0);
+ 	else if (ret != -EINVAL)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0696-dtoverlays-Change-i2c-fan-pwm-max-min-overrides-to-u.patch b/target/linux/bcm27xx/patches-6.1/950-0696-dtoverlays-Change-i2c-fan-pwm-max-min-overrides-to-u.patch
new file mode 100644
index 00000000000000..d042310d60d716
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0696-dtoverlays-Change-i2c-fan-pwm-max-min-overrides-to-u.patch
@@ -0,0 +1,26 @@
+From dbddf5d0389a11cc403289fbb55eb5740ff3ea46 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 21 Apr 2023 15:51:56 +0100
+Subject: [PATCH] dtoverlays: Change i2c-fan pwm-max/min overrides to
+ u8
+
+The driver is only reading a u8, so change the overlay to match.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/i2c-fan-overlay.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/i2c-fan-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-fan-overlay.dts
+@@ -94,8 +94,8 @@
+ 		i2c6 = <&frag100>, "target?=0",
+ 		       <&frag100>, "target-path=i2c6";
+ 		addr =		<&emc2301>,"reg:0";
+-		minpwm =	<&emc2301>,"emc2305,pwm-min;0";
+-		maxpwm =	<&emc2301>,"emc2305,pwm-max;0";
++		minpwm =	<&emc2301>,"emc2305,pwm-min.0";
++		maxpwm =	<&emc2301>,"emc2305,pwm-max.0";
+ 		midtemp =	<&fanmid0>,"temperature:0";
+ 		midtemp_hyst =	<&fanmid0>,"hysteresis:0";
+ 		maxtemp =	<&fanmax0>,"temperature:0";
diff --git a/target/linux/bcm27xx/patches-6.1/950-0697-drm-vc4-Limit-max_bpc-to-8-on-Pi0-3.patch b/target/linux/bcm27xx/patches-6.1/950-0697-drm-vc4-Limit-max_bpc-to-8-on-Pi0-3.patch
new file mode 100644
index 00000000000000..db13ad93d50752
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0697-drm-vc4-Limit-max_bpc-to-8-on-Pi0-3.patch
@@ -0,0 +1,37 @@
+From d1e78bb6380ca89d0b00ab60d65d9f34f346b6fe Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 24 Apr 2023 18:32:45 +0100
+Subject: [PATCH] drm/vc4: Limit max_bpc to 8 on Pi0-3
+
+Pi 0-3 have no deep colour support and only 24bpp output,
+so max_bpc should remain as 8.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -783,7 +783,6 @@ static int vc4_hdmi_connector_init(struc
+ 
+ 	drm_connector_attach_colorspace_property(connector);
+ 	drm_connector_attach_tv_margin_properties(connector);
+-	drm_connector_attach_max_bpc_property(connector, 8, 12);
+ 
+ 	connector->polled = (DRM_CONNECTOR_POLL_CONNECT |
+ 			     DRM_CONNECTOR_POLL_DISCONNECT);
+@@ -792,8 +791,12 @@ static int vc4_hdmi_connector_init(struc
+ 	connector->doublescan_allowed = 0;
+ 	connector->stereo_allowed = 1;
+ 
+-	if (vc4_hdmi->variant->supports_hdr)
++	if (vc4_hdmi->variant->supports_hdr) {
++		drm_connector_attach_max_bpc_property(connector, 8, 12);
+ 		drm_connector_attach_hdr_output_metadata_property(connector);
++	} else {
++		drm_connector_attach_max_bpc_property(connector, 8, 8);
++	}
+ 
+ 	vc4_hdmi_attach_broadcast_rgb_property(dev, vc4_hdmi);
+ 	vc4_hdmi_attach_output_format_property(dev, vc4_hdmi);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0698-serial-8250-Add-NOMSI-bug-for-bcm2835aux.patch b/target/linux/bcm27xx/patches-6.1/950-0698-serial-8250-Add-NOMSI-bug-for-bcm2835aux.patch
new file mode 100644
index 00000000000000..885806f9761f0a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0698-serial-8250-Add-NOMSI-bug-for-bcm2835aux.patch
@@ -0,0 +1,103 @@
+From 501e87c5f421654e1bb6fd4a25de46420549cae8 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 24 Apr 2023 11:48:31 +0100
+Subject: [PATCH] serial: 8250: Add NOMSI bug for bcm2835aux
+
+The BCM2835 mini-UART has no modem status interrupt, causing all
+transmission to stop, never to use, if a speed change ever happens
+while the CTS signal is high.
+
+Add a simple polling mechanism in order to allow recovery in that
+situation.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/tty/serial/8250/8250.h            |  1 +
+ drivers/tty/serial/8250/8250_bcm2835aux.c |  1 +
+ drivers/tty/serial/8250/8250_core.c       | 15 +++++++++++++++
+ drivers/tty/serial/8250/8250_port.c       |  9 +++++++++
+ 4 files changed, 26 insertions(+)
+
+--- a/drivers/tty/serial/8250/8250.h
++++ b/drivers/tty/serial/8250/8250.h
+@@ -93,6 +93,7 @@ struct serial8250_config {
+ #define UART_BUG_THRE	BIT(3)	/* UART has buggy THRE reassertion */
+ #define UART_BUG_PARITY	BIT(4)	/* UART mishandles parity if FIFO enabled */
+ #define UART_BUG_TXRACE	BIT(5)	/* UART Tx fails to set remote DR */
++#define UART_BUG_NOMSI	BIT(6)	/* UART has no modem status interrupt */
+ 
+ 
+ #ifdef CONFIG_SERIAL_8250_SHARE_IRQ
+--- a/drivers/tty/serial/8250/8250_bcm2835aux.c
++++ b/drivers/tty/serial/8250/8250_bcm2835aux.c
+@@ -109,6 +109,7 @@ static int bcm2835aux_serial_probe(struc
+ 			UPF_SKIP_TEST | UPF_IOREMAP;
+ 	up.port.rs485_config = serial8250_em485_config;
+ 	up.port.rs485_supported = serial8250_em485_supported;
++	up.bugs |= UART_BUG_NOMSI;
+ 	up.rs485_start_tx = bcm2835aux_rs485_start_tx;
+ 	up.rs485_stop_tx = bcm2835aux_rs485_stop_tx;
+ 
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -252,6 +252,18 @@ static void serial8250_timeout(struct ti
+ 	mod_timer(&up->timer, jiffies + uart_poll_timeout(&up->port));
+ }
+ 
++static void serial8250_cts_poll_timeout(struct timer_list *t)
++{
++	struct uart_8250_port *up = from_timer(up, t, timer);
++	unsigned long flags;
++
++	spin_lock_irqsave(&up->port.lock, flags);
++	serial8250_modem_status(up);
++	spin_unlock_irqrestore(&up->port.lock, flags);
++	if (up->port.hw_stopped)
++		mod_timer(&up->timer, jiffies + 1);
++}
++
+ static void serial8250_backup_timeout(struct timer_list *t)
+ {
+ 	struct uart_8250_port *up = from_timer(up, t, timer);
+@@ -314,6 +326,9 @@ static void univ8250_setup_timer(struct
+ 			  uart_poll_timeout(port) + HZ / 5);
+ 	}
+ 
++	if (up->bugs & UART_BUG_NOMSI)
++		up->timer.function = serial8250_cts_poll_timeout;
++
+ 	/*
+ 	 * If the "interrupt" for this port doesn't correspond with any
+ 	 * hardware interrupt, we use a timer-based system.  The original
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -1559,6 +1559,9 @@ static void serial8250_stop_tx(struct ua
+ 		serial_icr_write(up, UART_ACR, up->acr);
+ 	}
+ 	serial8250_rpm_put(up);
++
++	if (port->hw_stopped && (up->bugs & UART_BUG_NOMSI))
++		mod_timer(&up->timer, jiffies + 1);
+ }
+ 
+ static inline void __start_tx(struct uart_port *port)
+@@ -1669,6 +1672,9 @@ static void serial8250_start_tx(struct u
+ 	struct uart_8250_port *up = up_to_u8250p(port);
+ 	struct uart_8250_em485 *em485 = up->em485;
+ 
++	if (up->bugs & UART_BUG_NOMSI)
++		del_timer(&up->timer);
++
+ 	if (!port->x_char && uart_circ_empty(&port->state->xmit))
+ 		return;
+ 
+@@ -1889,6 +1895,9 @@ unsigned int serial8250_modem_status(str
+ 			uart_handle_cts_change(port, status & UART_MSR_CTS);
+ 
+ 		wake_up_interruptible(&port->state->port.delta_msr_wait);
++	} else if (up->bugs & UART_BUG_NOMSI &&	port->hw_stopped &&
++		   status & UART_MSR_CTS) {
++		uart_handle_cts_change(port, status & UART_MSR_CTS);
+ 	}
+ 
+ 	return status;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0699-Bluetooth-hci_sync-Add-fallback-bd-address-prop.patch b/target/linux/bcm27xx/patches-6.1/950-0699-Bluetooth-hci_sync-Add-fallback-bd-address-prop.patch
new file mode 100644
index 00000000000000..6fd82ce0112e45
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0699-Bluetooth-hci_sync-Add-fallback-bd-address-prop.patch
@@ -0,0 +1,41 @@
+From dffb648dffeab7246040a30b7d1669387d1e767e Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 25 Apr 2023 11:49:41 +0100
+Subject: [PATCH] Bluetooth: hci_sync: Add fallback-bd-address prop
+
+The kernel Bluetooth framework understands that devices may not
+be programmed with valid Bluetooth addresses. It also has the ability
+to override a Bluetooth address with the value of the local-bd-address
+DT property, but it ignores the validity of the existing address when
+doing so.
+
+Add a new boolean property, fallback-bd-address, which indicates that
+the given local-bd-address property should only be used if the device
+does not already have a valid BDADDR.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ net/bluetooth/hci_sync.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -4540,6 +4540,7 @@ static const struct {
+  */
+ static int hci_dev_setup_sync(struct hci_dev *hdev)
+ {
++	struct fwnode_handle *fwnode = dev_fwnode(hdev->dev.parent);
+ 	int ret = 0;
+ 	bool invalid_bdaddr;
+ 	size_t i;
+@@ -4568,7 +4569,9 @@ static int hci_dev_setup_sync(struct hci
+ 
+ 	if (!ret) {
+ 		if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) {
+-			if (!bacmp(&hdev->public_addr, BDADDR_ANY))
++			if (!bacmp(&hdev->public_addr, BDADDR_ANY) &&
++			    (invalid_bdaddr ||
++			     !fwnode_property_present(fwnode, "fallback-bd-address")))
+ 				hci_dev_get_bd_addr_from_property(hdev);
+ 
+ 			if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
diff --git a/target/linux/bcm27xx/patches-6.1/950-0700-Bluetooth-hci_bcm-Add-more-invalid-BDADDRs.patch b/target/linux/bcm27xx/patches-6.1/950-0700-Bluetooth-hci_bcm-Add-more-invalid-BDADDRs.patch
new file mode 100644
index 00000000000000..97e53ad37f08b9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0700-Bluetooth-hci_bcm-Add-more-invalid-BDADDRs.patch
@@ -0,0 +1,44 @@
+From 0b5ed6065e35da3e27a6ade1682ce0ba0fbc4ec0 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 6 Apr 2023 10:38:40 +0100
+Subject: [PATCH] Bluetooth: hci_bcm: Add more invalid BDADDRs
+
+The kernel needs to recognise the default BDADDRs used by the Bluetooth
+modems, so add a few more that we care about.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/bluetooth/btbcm.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/bluetooth/btbcm.c
++++ b/drivers/bluetooth/btbcm.c
+@@ -24,11 +24,15 @@
+ #define BDADDR_BCM20702A1 (&(bdaddr_t) {{0x00, 0x00, 0xa0, 0x02, 0x70, 0x20}})
+ #define BDADDR_BCM2076B1 (&(bdaddr_t) {{0x79, 0x56, 0x00, 0xa0, 0x76, 0x20}})
+ #define BDADDR_BCM43430A0 (&(bdaddr_t) {{0xac, 0x1f, 0x12, 0xa0, 0x43, 0x43}})
++#define BDADDR_BCM43430A1 (&(bdaddr_t) {{0xac, 0x1f, 0x12, 0xa1, 0x43, 0x43}})
++#define BDADDR_BCM43430B0 (&(bdaddr_t) {{0xac, 0x1f, 0x37, 0xb0, 0x43, 0x43}})
+ #define BDADDR_BCM4324B3 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb3, 0x24, 0x43}})
+ #define BDADDR_BCM4330B1 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb1, 0x30, 0x43}})
+ #define BDADDR_BCM4334B0 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb0, 0x34, 0x43}})
++#define BDADDR_BCM4345C0 (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0xc0, 0x45, 0x43}})
+ #define BDADDR_BCM4345C5 (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0xc5, 0x45, 0x43}})
+ #define BDADDR_BCM43341B (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0x1b, 0x34, 0x43}})
++#define BDADDR_BCM43438 (&(bdaddr_t) {{0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa}})
+ 
+ #define BCM_FW_NAME_LEN			64
+ #define BCM_FW_NAME_COUNT_MAX		4
+@@ -122,8 +126,12 @@ int btbcm_check_bdaddr(struct hci_dev *h
+ 	    !bacmp(&bda->bdaddr, BDADDR_BCM4324B3) ||
+ 	    !bacmp(&bda->bdaddr, BDADDR_BCM4330B1) ||
+ 	    !bacmp(&bda->bdaddr, BDADDR_BCM4334B0) ||
++	    !bacmp(&bda->bdaddr, BDADDR_BCM4345C0) ||
+ 	    !bacmp(&bda->bdaddr, BDADDR_BCM4345C5) ||
+ 	    !bacmp(&bda->bdaddr, BDADDR_BCM43430A0) ||
++	    !bacmp(&bda->bdaddr, BDADDR_BCM43430A1) ||
++	    !bacmp(&bda->bdaddr, BDADDR_BCM43430B0) ||
++	    !bacmp(&bda->bdaddr, BDADDR_BCM43438) ||
+ 	    !bacmp(&bda->bdaddr, BDADDR_BCM43341B)) {
+ 		/* Try falling back to BDADDR EFI variable */
+ 		if (btbcm_set_bdaddr_from_efi(hdev) != 0) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0701-ARM-dts-bcm27xx-Enable-kernel-Bluetooth.patch b/target/linux/bcm27xx/patches-6.1/950-0701-ARM-dts-bcm27xx-Enable-kernel-Bluetooth.patch
new file mode 100644
index 00000000000000..0772b38c41025a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0701-ARM-dts-bcm27xx-Enable-kernel-Bluetooth.patch
@@ -0,0 +1,196 @@
+From 2b704b4ac2202a3fae96c20125c78c4bd4b29064 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 14 Feb 2023 11:20:58 +0000
+Subject: [PATCH] ARM: dts: bcm27xx: Enable kernel Bluetooth
+
+Change the base Device Tree files so that by default the kernel is
+responsible for initialisation of the onboard Bluetooth modems.
+Use dtparam=krnbt=off to revert to the old behaviour.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/bcm2708-rpi-bt.dtsi         | 18 ++++++++++++++---
+ arch/arm/boot/dts/bcm271x-rpi-bt.dtsi         | 18 ++++++++++++++---
+ arch/arm/boot/dts/overlays/README             | 11 ++++++++--
+ .../boot/dts/overlays/disable-bt-overlay.dts  |  7 +------
+ .../boot/dts/overlays/miniuart-bt-overlay.dts | 20 ++++++-------------
+ 5 files changed, 46 insertions(+), 28 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm2708-rpi-bt.dtsi
++++ b/arch/arm/boot/dts/bcm2708-rpi-bt.dtsi
+@@ -5,22 +5,34 @@
+ 		compatible = "brcm,bcm43438-bt";
+ 		max-speed = <3000000>;
+ 		shutdown-gpios = <&gpio 45 GPIO_ACTIVE_HIGH>;
+-		status = "disabled";
++		local-bd-address = [ 00 00 00 00 00 00 ];
++		fallback-bd-address; // Don't override a valid address
++		status = "okay";
+ 	};
+ };
+ 
+ &uart1 {
+ 	minibt: bluetooth {
+ 		compatible = "brcm,bcm43438-bt";
+-		max-speed = <460800>;
++		max-speed = <230400>;
+ 		shutdown-gpios = <&gpio 45 GPIO_ACTIVE_HIGH>;
++		local-bd-address = [ 00 00 00 00 00 00 ];
++		fallback-bd-address; // Don't override a valid address
+ 		status = "disabled";
+ 	};
+ };
+ 
+ / {
++	aliases {
++		bluetooth = &bt;
++	};
++
+ 	__overrides__ {
++		bdaddr = <&bt>,"local-bd-address[",
++		       <&bt>,"fallback-bd-address?=0",
++		       <&minibt>,"local-bd-address[",
++		       <&minibt>,"fallback-bd-address?=0";
+ 		krnbt = <&bt>,"status";
+-		krnbt_baudrate = <&bt>,"max-speed:0";
++		krnbt_baudrate = <&bt>,"max-speed:0", <&minibt>,"max-speed:0";
+ 	};
+ };
+--- a/arch/arm/boot/dts/bcm271x-rpi-bt.dtsi
++++ b/arch/arm/boot/dts/bcm271x-rpi-bt.dtsi
+@@ -5,22 +5,34 @@
+ 		compatible = "brcm,bcm43438-bt";
+ 		max-speed = <3000000>;
+ 		shutdown-gpios = <&expgpio 0 GPIO_ACTIVE_HIGH>;
+-		status = "disabled";
++		local-bd-address = [ 00 00 00 00 00 00 ];
++		fallback-bd-address; // Don't override a valid address
++		status = "okay";
+ 	};
+ };
+ 
+ &uart1 {
+ 	minibt: bluetooth {
+ 		compatible = "brcm,bcm43438-bt";
+-		max-speed = <460800>;
++		max-speed = <230400>;
+ 		shutdown-gpios = <&expgpio 0 GPIO_ACTIVE_HIGH>;
++		local-bd-address = [ 00 00 00 00 00 00 ];
++		fallback-bd-address; // Don't override a valid address
+ 		status = "disabled";
+ 	};
+ };
+ 
+ / {
++	aliases {
++		bluetooth = &bt;
++	};
++
+ 	__overrides__ {
++		bdaddr = <&bt>,"local-bd-address[",
++		       <&bt>,"fallback-bd-address?=0",
++		       <&minibt>,"local-bd-address[",
++		       <&minibt>,"fallback-bd-address?=0";
+ 		krnbt = <&bt>,"status";
+-		krnbt_baudrate = <&bt>,"max-speed:0";
++		krnbt_baudrate = <&bt>,"max-speed:0", <&minibt>,"max-speed:0";
+ 	};
+ };
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -144,6 +144,13 @@ Params:
+                                 See /sys/kernel/debug/raspberrypi_axi_monitor
+                                 for the results.
+ 
++        bdaddr                  Set an alternative Bluetooth address (BDADDR).
++                                The value should be a 6-byte hexadecimal value,
++                                with or without colon separators, written least-
++                                significant-byte first. For example,
++                                bdaddr=06:05:04:03:02:01
++                                will set the BDADDR to 01:02:03:04:05:06.
++
+         cam0_reg                Enables CAM 0 regulator.
+                                 Only required on CM1 & 3.
+ 
+@@ -219,9 +226,9 @@ Params:
+         i2s                     Set to "on" to enable the i2s interface
+                                 (default "off")
+ 
+-        krnbt                   Set to "on" to enable autoprobing of Bluetooth
++        krnbt                   Set to "off" to disable autoprobing of Bluetooth
+                                 driver without need of hciattach/btattach
+-                                (default "off")
++                                (default "on")
+ 
+         krnbt_baudrate          Set the baudrate of the PL011 UART when used
+                                 with krnbt=on
+--- a/arch/arm/boot/dts/overlays/disable-bt-overlay.dts
++++ b/arch/arm/boot/dts/overlays/disable-bt-overlay.dts
+@@ -1,12 +1,7 @@
+ /dts-v1/;
+ /plugin/;
+ 
+-/* Disable Bluetooth and restore UART0/ttyAMA0 over GPIOs 14 & 15.
+-   To disable the systemd service that initialises the modem so it doesn't use
+-   the UART:
+-
+-       sudo systemctl disable hciuart
+-*/
++/* Disable Bluetooth and restore UART0/ttyAMA0 over GPIOs 14 & 15. */
+ 
+ #include <dt-bindings/gpio/gpio.h>
+ 
+--- a/arch/arm/boot/dts/overlays/miniuart-bt-overlay.dts
++++ b/arch/arm/boot/dts/overlays/miniuart-bt-overlay.dts
+@@ -40,7 +40,7 @@
+ 		target = <&uart1>;
+ 		__overlay__ {
+ 			pinctrl-names = "default";
+-			pinctrl-0 = <&uart1_pins &bt_pins &fake_bt_cts>;
++			pinctrl-0 = <&uart1_pins>;
+ 			status = "okay";
+ 		};
+ 	};
+@@ -57,23 +57,13 @@
+ 	fragment@4 {
+ 		target = <&uart1_pins>;
+ 		__overlay__ {
+-			brcm,pins = <32 33>;
++			brcm,pins = <32 33 30 31>;
+ 			brcm,function = <2>; /* alt5=UART1 */
+-			brcm,pull = <0 2>;
++			brcm,pull = <0 2 2 0>;
+ 		};
+ 	};
+ 
+ 	fragment@5 {
+-		target = <&gpio>;
+-		__overlay__ {
+-			fake_bt_cts: fake_bt_cts {
+-				brcm,pins = <31>;
+-				brcm,function = <1>; /* output */
+-			};
+-		};
+-	};
+-
+-	fragment@6 {
+ 		target-path = "/aliases";
+ 		__overlay__ {
+ 			serial0 = "/soc/serial@7e201000";
+@@ -81,13 +71,15 @@
+ 		};
+ 	};
+ 
+-	fragment@7 {
++	fragment@6 {
+ 		target = <&minibt>;
+ 		minibt_frag: __overlay__ {
++			status = "okay";
+ 		};
+ 	};
+ 
+ 	__overrides__ {
+ 		krnbt = <&minibt_frag>,"status";
++		krnbt_baudrate = <&minibt_frag>,"max-speed:0";
+ 	};
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0702-overlays-Update-miniuart-bt-now-krnbt-is-default.patch b/target/linux/bcm27xx/patches-6.1/950-0702-overlays-Update-miniuart-bt-now-krnbt-is-default.patch
new file mode 100644
index 00000000000000..fa1469044fccab
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0702-overlays-Update-miniuart-bt-now-krnbt-is-default.patch
@@ -0,0 +1,181 @@
+From 2da5974313a0580d948c760214a2ea6f4e59bebf Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 19 Apr 2023 15:13:48 +0100
+Subject: [PATCH] overlays: Update miniuart-bt now krnbt is default
+
+Now that the kernel controls the onboard Bluetooth initialisation by
+default, the miniuart-bt overlay needs updating to match.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/bcm2708-rpi-zero-w.dts           |  6 ++++++
+ arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts         |  6 ++++++
+ arch/arm/boot/dts/bcm2710-rpi-3-b.dts              |  6 ++++++
+ arch/arm/boot/dts/bcm2710-rpi-zero-2-w.dts         |  6 ++++++
+ arch/arm/boot/dts/bcm2711-rpi-4-b.dts              |  6 ++++++
+ arch/arm/boot/dts/bcm2711-rpi-400.dts              |  6 ++++++
+ arch/arm/boot/dts/bcm2711-rpi-cm4.dts              |  6 ++++++
+ arch/arm/boot/dts/overlays/README                  | 13 ++++---------
+ arch/arm/boot/dts/overlays/miniuart-bt-overlay.dts |  8 +++-----
+ 9 files changed, 49 insertions(+), 14 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm2708-rpi-zero-w.dts
++++ b/arch/arm/boot/dts/bcm2708-rpi-zero-w.dts
+@@ -138,6 +138,12 @@
+ 		brcm,pull;
+ 	};
+ 
++	uart1_bt_pins: uart1_bt_pins {
++		brcm,pins = <32 33 30 31>;
++		brcm,function = <BCM2835_FSEL_ALT5>; /* alt5=UART1 */
++		brcm,pull = <0 2 2 0>;
++	};
++
+ 	audio_pins: audio_pins {
+ 		brcm,pins = <>;
+ 		brcm,function = <>;
+--- a/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
++++ b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
+@@ -140,6 +140,12 @@
+ 		brcm,pull;
+ 	};
+ 
++	uart1_bt_pins: uart1_bt_pins {
++		brcm,pins = <32 33 30 31>;
++		brcm,function = <BCM2835_FSEL_ALT5>; /* alt5=UART1 */
++		brcm,pull = <0 2 2 0>;
++	};
++
+ 	audio_pins: audio_pins {
+ 		brcm,pins = <40 41>;
+ 		brcm,function = <4>;
+--- a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
++++ b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
+@@ -140,6 +140,12 @@
+ 		brcm,pull;
+ 	};
+ 
++	uart1_bt_pins: uart1_bt_pins {
++		brcm,pins = <32 33>;
++		brcm,function = <BCM2835_FSEL_ALT5>; /* alt5=UART1 */
++		brcm,pull = <0 2>;
++	};
++
+ 	audio_pins: audio_pins {
+ 		brcm,pins = <40 41>;
+ 		brcm,function = <4>;
+--- a/arch/arm/boot/dts/bcm2710-rpi-zero-2-w.dts
++++ b/arch/arm/boot/dts/bcm2710-rpi-zero-2-w.dts
+@@ -138,6 +138,12 @@
+ 		brcm,pull;
+ 	};
+ 
++	uart1_bt_pins: uart1_bt_pins {
++		brcm,pins = <32 33 30 31>;
++		brcm,function = <BCM2835_FSEL_ALT5>; /* alt5=UART1 */
++		brcm,pull = <0 2 2 0>;
++	};
++
+ 	audio_pins: audio_pins {
+ 		brcm,pins = <>;
+ 		brcm,function = <>;
+--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
+@@ -445,6 +445,12 @@
+ 		brcm,pull;
+ 	};
+ 
++	uart1_bt_pins: uart1_bt_pins {
++		brcm,pins = <32 33 30 31>;
++		brcm,function = <BCM2835_FSEL_ALT5>; /* alt5=UART1 */
++		brcm,pull = <0 2 2 0>;
++	};
++
+ 	uart2_pins: uart2_pins {
+ 		brcm,pins = <0 1>;
+ 		brcm,function = <BCM2835_FSEL_ALT4>;
+--- a/arch/arm/boot/dts/bcm2711-rpi-400.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-400.dts
+@@ -445,6 +445,12 @@
+ 		brcm,pull;
+ 	};
+ 
++	uart1_bt_pins: uart1_bt_pins {
++		brcm,pins = <32 33 30 31>;
++		brcm,function = <BCM2835_FSEL_ALT5>; /* alt5=UART1 */
++		brcm,pull = <0 2 2 0>;
++	};
++
+ 	uart2_pins: uart2_pins {
+ 		brcm,pins = <0 1>;
+ 		brcm,function = <BCM2835_FSEL_ALT4>;
+--- a/arch/arm/boot/dts/bcm2711-rpi-cm4.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-cm4.dts
+@@ -454,6 +454,12 @@
+ 		brcm,pull;
+ 	};
+ 
++	uart1_bt_pins: uart1_bt_pins {
++		brcm,pins = <32 33 30 31>;
++		brcm,function = <BCM2835_FSEL_ALT5>; /* alt5=UART1 */
++		brcm,pull = <0 2 2 0>;
++	};
++
+ 	uart2_pins: uart2_pins {
+ 		brcm,pins = <0 1>;
+ 		brcm,function = <BCM2835_FSEL_ALT4>;
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -2887,17 +2887,12 @@ Params: speed                   SPI bus
+ 
+ 
+ Name:   miniuart-bt
+-Info:   Switch the onboard Bluetooth function on Pi 3B, 3B+, 3A+, 4B and Zero W
++Info:   Switch the onboard Bluetooth function of a BT-equipped Raspberry Pi
+         to use the mini-UART (ttyS0) and restore UART0/ttyAMA0 over GPIOs 14 &
+-        15. Note that this may reduce the maximum usable baudrate.
+-        N.B. It is also necessary to edit /lib/systemd/system/hciuart.service
+-        and replace ttyAMA0 with ttyS0, unless using Raspbian or another
+-        distribution with udev rules that create /dev/serial0 and /dev/serial1,
+-        in which case use /dev/serial1 instead because it will always be
+-        correct. Furthermore, you must also set core_freq and core_freq_min to
+-        the same value in config.txt or the miniuart will not work.
++        15. Note that this option uses a lower baudrate, and should only be used
++        with low-bandwidth peripherals.
+ Load:   dtoverlay=miniuart-bt,<param>=<val>
+-Params: krnbt                   Set to "on" to enable autoprobing of Bluetooth
++Params: krnbt                   Set to "off" to disable autoprobing of Bluetooth
+                                 driver without need of hciattach/btattach
+ 
+ 
+--- a/arch/arm/boot/dts/overlays/miniuart-bt-overlay.dts
++++ b/arch/arm/boot/dts/overlays/miniuart-bt-overlay.dts
+@@ -55,11 +55,9 @@
+ 	};
+ 
+ 	fragment@4 {
+-		target = <&uart1_pins>;
++		target = <&uart1>;
+ 		__overlay__ {
+-			brcm,pins = <32 33 30 31>;
+-			brcm,function = <2>; /* alt5=UART1 */
+-			brcm,pull = <0 2 2 0>;
++			pinctrl-0 = <&uart1_bt_pins>;
+ 		};
+ 	};
+ 
+@@ -68,6 +66,7 @@
+ 		__overlay__ {
+ 			serial0 = "/soc/serial@7e201000";
+ 			serial1 = "/soc/serial@7e215040";
++			bluetooth = "/soc/serial@7e215040/bluetooth";
+ 		};
+ 	};
+ 
+@@ -80,6 +79,5 @@
+ 
+ 	__overrides__ {
+ 		krnbt = <&minibt_frag>,"status";
+-		krnbt_baudrate = <&minibt_frag>,"max-speed:0";
+ 	};
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0703-ARM-dts-bcm2711-Add-extra-serial-aliases.patch b/target/linux/bcm27xx/patches-6.1/950-0703-ARM-dts-bcm2711-Add-extra-serial-aliases.patch
new file mode 100644
index 00000000000000..92f5a2f82eccf5
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0703-ARM-dts-bcm2711-Add-extra-serial-aliases.patch
@@ -0,0 +1,164 @@
+From dfc14f5786f1613f398422c7567c7e0cdd60f021 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 24 Feb 2023 14:53:48 +0000
+Subject: [PATCH] ARM: dts: bcm2711: Add extra serial aliases
+
+With UART numbering from DT aliases re-enabled, add aliases for the
+additional BCM2711 UARTs. Also use the opportunity to remove some
+DTS duplication.
+
+See: https://forums.raspberrypi.com/viewtopic.php?t=347868
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/bcm2711-rpi-4-b.dts  | 19 ------------------
+ arch/arm/boot/dts/bcm2711-rpi-400.dts  | 19 ------------------
+ arch/arm/boot/dts/bcm2711-rpi-cm4.dts  | 19 ------------------
+ arch/arm/boot/dts/bcm2711-rpi-cm4s.dts | 15 +++-----------
+ arch/arm/boot/dts/bcm2711-rpi-ds.dtsi  | 27 ++++++++++++++++++++++++++
+ 5 files changed, 30 insertions(+), 69 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
+@@ -268,25 +268,6 @@
+ 		bootargs = "coherent_pool=1M 8250.nr_uarts=1 snd_bcm2835.enable_headphones=0";
+ 	};
+ 
+-	aliases {
+-		serial0 = &uart1;
+-		serial1 = &uart0;
+-		mmc0 = &emmc2;
+-		mmc1 = &mmcnr;
+-		mmc2 = &sdhost;
+-		i2c3 = &i2c3;
+-		i2c4 = &i2c4;
+-		i2c5 = &i2c5;
+-		i2c6 = &i2c6;
+-		i2c20 = &ddc0;
+-		i2c21 = &ddc1;
+-		spi3 = &spi3;
+-		spi4 = &spi4;
+-		spi5 = &spi5;
+-		spi6 = &spi6;
+-		/delete-property/ intc;
+-	};
+-
+ 	/delete-node/ wifi-pwrseq;
+ };
+ 
+--- a/arch/arm/boot/dts/bcm2711-rpi-400.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-400.dts
+@@ -268,25 +268,6 @@
+ 		bootargs = "coherent_pool=1M 8250.nr_uarts=1 snd_bcm2835.enable_headphones=0";
+ 	};
+ 
+-	aliases {
+-		serial0 = &uart1;
+-		serial1 = &uart0;
+-		mmc0 = &emmc2;
+-		mmc1 = &mmcnr;
+-		mmc2 = &sdhost;
+-		i2c3 = &i2c3;
+-		i2c4 = &i2c4;
+-		i2c5 = &i2c5;
+-		i2c6 = &i2c6;
+-		i2c20 = &ddc0;
+-		i2c21 = &ddc1;
+-		spi3 = &spi3;
+-		spi4 = &spi4;
+-		spi5 = &spi5;
+-		spi6 = &spi6;
+-		/delete-property/ intc;
+-	};
+-
+ 	/delete-node/ wifi-pwrseq;
+ };
+ 
+--- a/arch/arm/boot/dts/bcm2711-rpi-cm4.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-cm4.dts
+@@ -277,25 +277,6 @@
+ 		bootargs = "coherent_pool=1M 8250.nr_uarts=1 snd_bcm2835.enable_headphones=0";
+ 	};
+ 
+-	aliases {
+-		serial0 = &uart1;
+-		serial1 = &uart0;
+-		mmc0 = &emmc2;
+-		mmc1 = &mmcnr;
+-		mmc2 = &sdhost;
+-		i2c3 = &i2c3;
+-		i2c4 = &i2c4;
+-		i2c5 = &i2c5;
+-		i2c6 = &i2c6;
+-		i2c20 = &ddc0;
+-		i2c21 = &ddc1;
+-		spi3 = &spi3;
+-		spi4 = &spi4;
+-		spi5 = &spi5;
+-		spi6 = &spi6;
+-		/delete-property/ intc;
+-	};
+-
+ 	/delete-node/ wifi-pwrseq;
+ };
+ 
+--- a/arch/arm/boot/dts/bcm2711-rpi-cm4s.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-cm4s.dts
+@@ -163,18 +163,9 @@
+ 
+ 	aliases {
+ 		serial0 = &uart0;
+-		mmc0 = &emmc2;
+-		mmc1 = &mmcnr;
+-		mmc2 = &sdhost;
+-		i2c3 = &i2c3;
+-		i2c4 = &i2c4;
+-		i2c5 = &i2c5;
+-		i2c6 = &i2c6;
+-		spi3 = &spi3;
+-		spi4 = &spi4;
+-		spi5 = &spi5;
+-		spi6 = &spi6;
+-		/delete-property/ intc;
++		serial1 = &uart1;
++		/delete-property/ i2c20;
++		/delete-property/ i2c21;
+ 	};
+ 
+ 	/delete-node/ wifi-pwrseq;
+--- a/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
++++ b/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
+@@ -26,6 +26,33 @@
+ 	chosen {
+ 		/delete-property/ stdout-path;
+ 	};
++
++	aliases {
++		uart2 = &uart2;
++		uart3 = &uart3;
++		uart4 = &uart4;
++		uart5 = &uart5;
++		serial0 = &uart1;
++		serial1 = &uart0;
++		serial2 = &uart2;
++		serial3 = &uart3;
++		serial4 = &uart4;
++		serial5 = &uart5;
++		mmc0 = &emmc2;
++		mmc1 = &mmcnr;
++		mmc2 = &sdhost;
++		i2c3 = &i2c3;
++		i2c4 = &i2c4;
++		i2c5 = &i2c5;
++		i2c6 = &i2c6;
++		i2c20 = &ddc0;
++		i2c21 = &ddc1;
++		spi3 = &spi3;
++		spi4 = &spi4;
++		spi5 = &spi5;
++		spi6 = &spi6;
++		/delete-property/ intc;
++	};
+ };
+ 
+ &vc4 {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0704-pinctrl-bcm2835-Workaround-for-edge-IRQ-loss.patch b/target/linux/bcm27xx/patches-6.1/950-0704-pinctrl-bcm2835-Workaround-for-edge-IRQ-loss.patch
new file mode 100644
index 00000000000000..65345f480e7f10
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0704-pinctrl-bcm2835-Workaround-for-edge-IRQ-loss.patch
@@ -0,0 +1,67 @@
+From dcb717bc899cd55a969fb4f1f8526f313efe148c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 5 May 2023 11:25:48 +0100
+Subject: [PATCH] pinctrl: bcm2835: Workaround for edge IRQ loss
+
+It has been observed that edge events can be lost when GPIO edges occur
+close to each other. Investigation suggests this is due to a hardware
+bug, although no mechanism has been identified.
+
+Work around the event loss by moving the IRQ acknowledgement into the
+main ISR, adding missing events by explicit level-change detection.
+
+See: https://forums.raspberrypi.com/viewtopic.php?t=350295
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/pinctrl/bcm/pinctrl-bcm2835.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+@@ -422,15 +422,32 @@ static void bcm2835_gpio_irq_handle_bank
+ 	unsigned long events;
+ 	unsigned offset;
+ 	unsigned gpio;
++	u32 levs, levs2;
+ 
+ 	events = bcm2835_gpio_rd(pc, GPEDS0 + bank * 4);
++	levs = bcm2835_gpio_rd(pc, GPLEV0 + bank * 4);
+ 	events &= mask;
+ 	events &= pc->enabled_irq_map[bank];
++	bcm2835_gpio_wr(pc, GPEDS0 + bank * 4, events);
++
++retry:
+ 	for_each_set_bit(offset, &events, 32) {
+ 		gpio = (32 * bank) + offset;
+ 		generic_handle_domain_irq(pc->gpio_chip.irq.domain,
+ 					  gpio);
+ 	}
++	events = bcm2835_gpio_rd(pc, GPEDS0 + bank * 4);
++	levs2 = bcm2835_gpio_rd(pc, GPLEV0 + bank * 4);
++
++	events |= levs2 & ~levs & bcm2835_gpio_rd(pc, GPREN0 + bank * 4);
++	events |= ~levs2 & levs & bcm2835_gpio_rd(pc, GPFEN0 + bank * 4);
++	events &= mask;
++	events &= pc->enabled_irq_map[bank];
++	if (events) {
++		bcm2835_gpio_wr(pc, GPEDS0 + bank * 4, events);
++		levs = levs2;
++		goto retry;
++	}
+ }
+ 
+ static void bcm2835_gpio_irq_handler(struct irq_desc *desc)
+@@ -670,11 +687,7 @@ static int bcm2835_gpio_irq_set_type(str
+ 
+ static void bcm2835_gpio_irq_ack(struct irq_data *data)
+ {
+-	struct gpio_chip *chip = irq_data_get_irq_chip_data(data);
+-	struct bcm2835_pinctrl *pc = gpiochip_get_data(chip);
+-	unsigned gpio = irqd_to_hwirq(data);
+-
+-	bcm2835_gpio_set_bit(pc, GPEDS0, gpio);
++	/* Nothing to do - the main interrupt handler includes the ACK */
+ }
+ 
+ static int bcm2835_gpio_irq_set_wake(struct irq_data *data, unsigned int on)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0705-drm-v3d-New-debugfs-end-points-to-query-GPU-usage-st.patch b/target/linux/bcm27xx/patches-6.1/950-0705-drm-v3d-New-debugfs-end-points-to-query-GPU-usage-st.patch
new file mode 100644
index 00000000000000..193b40081b069b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0705-drm-v3d-New-debugfs-end-points-to-query-GPU-usage-st.patch
@@ -0,0 +1,493 @@
+From 2725d86da22e2d2e46d970f0b2f2193a0b8e653b Mon Sep 17 00:00:00 2001
+From: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
+Date: Tue, 7 Feb 2023 13:54:02 +0100
+Subject: [PATCH] drm/v3d: New debugfs end-points to query GPU usage
+ stats.
+
+Two new debugfs interfaces are implemented:
+
+- gpu_usage: exposes the total runtime since boot of each
+of the 5 scheduling queues available at V3D (BIN, RENDER,
+CSD, TFU, CACHE_CLEAN). So if the interface is queried at
+two different points of time the usage percentage of each
+of the queues can be calculated.
+
+- gpu_pid_usage: exposes the same information but to the
+level of detail of each process using the V3D driver. The
+runtime for process using the driver is stored. So the
+percentages of usage by PID can be calculated with
+measures at different timestamps.
+
+The storage of gpu_pid_usage stats is only done if
+the debugfs interface is polled during the last 70 seconds.
+If a process does not submit a GPU job during last 70
+seconds its stats will also be purged.
+
+Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
+---
+ drivers/gpu/drm/v3d/v3d_debugfs.c |  79 +++++++++++++++++
+ drivers/gpu/drm/v3d/v3d_drv.h     |  59 +++++++++++++
+ drivers/gpu/drm/v3d/v3d_gem.c     |   1 +
+ drivers/gpu/drm/v3d/v3d_irq.c     |   5 ++
+ drivers/gpu/drm/v3d/v3d_sched.c   | 139 +++++++++++++++++++++++++++++-
+ 5 files changed, 282 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/v3d/v3d_debugfs.c
++++ b/drivers/gpu/drm/v3d/v3d_debugfs.c
+@@ -6,6 +6,7 @@
+ #include <linux/debugfs.h>
+ #include <linux/seq_file.h>
+ #include <linux/string_helpers.h>
++#include <linux/sched/clock.h>
+ 
+ #include <drm/drm_debugfs.h>
+ 
+@@ -202,6 +203,82 @@ static int v3d_debugfs_bo_stats(struct s
+ 	return 0;
+ }
+ 
++static int v3d_debugfs_gpu_usage(struct seq_file *m, void *unused)
++{
++	struct drm_info_node *node = (struct drm_info_node *)m->private;
++	struct drm_device *dev = node->minor->dev;
++	struct v3d_dev *v3d = to_v3d_dev(dev);
++	struct v3d_queue_stats *queue_stats;
++	enum v3d_queue queue;
++	u64 timestamp = local_clock();
++	u64 active_runtime;
++
++	seq_printf(m, "timestamp;%llu;\n", local_clock());
++	seq_printf(m, "\"QUEUE\";\"JOBS\";\"RUNTIME\";\"ACTIVE\";\n");
++	for (queue = 0; queue < V3D_MAX_QUEUES; queue++) {
++		if (!v3d->queue[queue].sched.ready)
++			continue;
++
++		queue_stats = &v3d->gpu_queue_stats[queue];
++		mutex_lock(&queue_stats->lock);
++		v3d_sched_stats_update(queue_stats);
++		if (queue_stats->last_pid)
++			active_runtime = timestamp - queue_stats->last_exec_start;
++		else
++			active_runtime = 0;
++
++		seq_printf(m, "%s;%d;%llu;%c;\n",
++			   v3d_queue_to_string(queue),
++			   queue_stats->jobs_sent,
++			   queue_stats->runtime + active_runtime,
++			   queue_stats->last_pid?'1':'0');
++		mutex_unlock(&queue_stats->lock);
++	}
++
++	return 0;
++}
++
++static int v3d_debugfs_gpu_pid_usage(struct seq_file *m, void *unused)
++{
++	struct drm_info_node *node = (struct drm_info_node *)m->private;
++	struct drm_device *dev = node->minor->dev;
++	struct v3d_dev *v3d = to_v3d_dev(dev);
++	struct v3d_queue_stats *queue_stats;
++	struct v3d_queue_pid_stats *cur;
++	enum v3d_queue queue;
++	u64 active_runtime;
++	u64 timestamp = local_clock();
++
++	seq_printf(m, "timestamp;%llu;\n", timestamp);
++	seq_printf(m, "\"QUEUE\";\"PID\",\"JOBS\";\"RUNTIME\";\"ACTIVE\";\n");
++	for (queue = 0; queue < V3D_MAX_QUEUES; queue++) {
++
++		if (!v3d->queue[queue].sched.ready)
++			continue;
++
++		queue_stats = &v3d->gpu_queue_stats[queue];
++		mutex_lock(&queue_stats->lock);
++		queue_stats->gpu_pid_stats_timeout = jiffies + V3D_QUEUE_STATS_TIMEOUT;
++		v3d_sched_stats_update(queue_stats);
++		list_for_each_entry(cur, &queue_stats->pid_stats_list, list) {
++
++			if (cur->pid == queue_stats->last_pid)
++				active_runtime = timestamp - queue_stats->last_exec_start;
++			else
++				active_runtime = 0;
++
++			seq_printf(m, "%s;%d;%d;%llu;%c;\n",
++				   v3d_queue_to_string(queue),
++				   cur->pid, cur->jobs_sent,
++				   cur->runtime + active_runtime,
++				   cur->pid == queue_stats->last_pid ? '1' : '0');
++		}
++		mutex_unlock(&queue_stats->lock);
++	}
++
++	return 0;
++}
++
+ static int v3d_measure_clock(struct seq_file *m, void *unused)
+ {
+ 	struct drm_info_node *node = (struct drm_info_node *)m->private;
+@@ -241,6 +318,8 @@ static const struct drm_info_list v3d_de
+ 	{"v3d_regs", v3d_v3d_debugfs_regs, 0},
+ 	{"measure_clock", v3d_measure_clock, 0},
+ 	{"bo_stats", v3d_debugfs_bo_stats, 0},
++	{"gpu_usage", v3d_debugfs_gpu_usage, 0},
++	{"gpu_pid_usage", v3d_debugfs_gpu_pid_usage, 0},
+ };
+ 
+ void
+--- a/drivers/gpu/drm/v3d/v3d_drv.h
++++ b/drivers/gpu/drm/v3d/v3d_drv.h
+@@ -21,6 +21,19 @@ struct reset_control;
+ 
+ #define V3D_MAX_QUEUES (V3D_CACHE_CLEAN + 1)
+ 
++static inline char *
++v3d_queue_to_string(enum v3d_queue queue)
++{
++	switch (queue) {
++	case V3D_BIN: return "v3d_bin";
++	case V3D_RENDER: return "v3d_render";
++	case V3D_TFU: return "v3d_tfu";
++	case V3D_CSD: return "v3d_csd";
++	case V3D_CACHE_CLEAN: return "v3d_cache_clean";
++	}
++	return "UNKNOWN";
++}
++
+ struct v3d_queue_state {
+ 	struct drm_gpu_scheduler sched;
+ 
+@@ -28,6 +41,44 @@ struct v3d_queue_state {
+ 	u64 emit_seqno;
+ };
+ 
++struct v3d_queue_pid_stats {
++	struct	list_head list;
++	u64	runtime;
++	/* Time in jiffes.to purge the stats of this process. Every time a
++	 * process sends a new job to the queue, this timeout is delayed by
++	 * V3D_QUEUE_STATS_TIMEOUT while the gpu_pid_stats_timeout of the
++	 * queue is not reached.
++	 */
++	unsigned long timeout_purge;
++	u32	jobs_sent;
++	pid_t	pid;
++};
++
++struct v3d_queue_stats {
++	struct mutex lock;
++	u64	last_exec_start;
++	u64	last_exec_end;
++	u64	runtime;
++	u32	jobs_sent;
++	/* Time in jiffes to stop collecting gpu stats by process. This is
++	 * increased by every access to*the debugfs interface gpu_pid_usage.
++	 * If the debugfs is not used stats are not collected.
++	 */
++	unsigned long gpu_pid_stats_timeout;
++	pid_t	last_pid;
++	struct list_head pid_stats_list;
++};
++
++/* pid_stats by process (v3d_queue_pid_stats) are recorded if there is an
++ * access to the gpu_pid_usageare debugfs interface for the last
++ * V3D_QUEUE_STATS_TIMEOUT (70s).
++ *
++ * The same timeout is used to purge the stats by process for those process
++ * that have not sent jobs this period.
++ */
++#define V3D_QUEUE_STATS_TIMEOUT (70 * HZ)
++
++
+ /* Performance monitor object. The perform lifetime is controlled by userspace
+  * using perfmon related ioctls. A perfmon can be attached to a submit_cl
+  * request, and when this is the case, HW perf counters will be activated just
+@@ -147,6 +198,8 @@ struct v3d_dev {
+ 		u32 num_allocated;
+ 		u32 pages_allocated;
+ 	} bo_stats;
++
++	struct v3d_queue_stats gpu_queue_stats[V3D_MAX_QUEUES];
+ };
+ 
+ static inline struct v3d_dev *
+@@ -244,6 +297,11 @@ struct v3d_job {
+ 	 */
+ 	struct v3d_perfmon *perfmon;
+ 
++	/* PID of the process that submitted the job that could be used to
++	 * for collecting stats by process of gpu usage.
++	 */
++	pid_t client_pid;
++
+ 	/* Callback for the freeing of the job on refcount going to 0. */
+ 	void (*free)(struct kref *ref);
+ };
+@@ -408,6 +466,7 @@ void v3d_mmu_remove_ptes(struct v3d_bo *
+ /* v3d_sched.c */
+ int v3d_sched_init(struct v3d_dev *v3d);
+ void v3d_sched_fini(struct v3d_dev *v3d);
++void v3d_sched_stats_update(struct v3d_queue_stats *queue_stats);
+ 
+ /* v3d_perfmon.c */
+ void v3d_perfmon_get(struct v3d_perfmon *perfmon);
+--- a/drivers/gpu/drm/v3d/v3d_gem.c
++++ b/drivers/gpu/drm/v3d/v3d_gem.c
+@@ -516,6 +516,7 @@ v3d_job_init(struct v3d_dev *v3d, struct
+ 	job = *container;
+ 	job->v3d = v3d;
+ 	job->free = free;
++	job->client_pid = current->pid;
+ 
+ 	ret = drm_sched_job_init(&job->base, &v3d_priv->sched_entity[queue],
+ 				 v3d_priv);
+--- a/drivers/gpu/drm/v3d/v3d_irq.c
++++ b/drivers/gpu/drm/v3d/v3d_irq.c
+@@ -14,6 +14,7 @@
+  */
+ 
+ #include <linux/platform_device.h>
++#include <linux/sched/clock.h>
+ 
+ #include "v3d_drv.h"
+ #include "v3d_regs.h"
+@@ -100,6 +101,7 @@ v3d_irq(int irq, void *arg)
+ 	if (intsts & V3D_INT_FLDONE) {
+ 		struct v3d_fence *fence =
+ 			to_v3d_fence(v3d->bin_job->base.irq_fence);
++		v3d->gpu_queue_stats[V3D_BIN].last_exec_end = local_clock();
+ 
+ 		trace_v3d_bcl_irq(&v3d->drm, fence->seqno);
+ 		dma_fence_signal(&fence->base);
+@@ -109,6 +111,7 @@ v3d_irq(int irq, void *arg)
+ 	if (intsts & V3D_INT_FRDONE) {
+ 		struct v3d_fence *fence =
+ 			to_v3d_fence(v3d->render_job->base.irq_fence);
++		v3d->gpu_queue_stats[V3D_RENDER].last_exec_end = local_clock();
+ 
+ 		trace_v3d_rcl_irq(&v3d->drm, fence->seqno);
+ 		dma_fence_signal(&fence->base);
+@@ -118,6 +121,7 @@ v3d_irq(int irq, void *arg)
+ 	if (intsts & V3D_INT_CSDDONE) {
+ 		struct v3d_fence *fence =
+ 			to_v3d_fence(v3d->csd_job->base.irq_fence);
++		v3d->gpu_queue_stats[V3D_CSD].last_exec_end = local_clock();
+ 
+ 		trace_v3d_csd_irq(&v3d->drm, fence->seqno);
+ 		dma_fence_signal(&fence->base);
+@@ -154,6 +158,7 @@ v3d_hub_irq(int irq, void *arg)
+ 	if (intsts & V3D_HUB_INT_TFUC) {
+ 		struct v3d_fence *fence =
+ 			to_v3d_fence(v3d->tfu_job->base.irq_fence);
++		v3d->gpu_queue_stats[V3D_TFU].last_exec_end = local_clock();
+ 
+ 		trace_v3d_tfu_irq(&v3d->drm, fence->seqno);
+ 		dma_fence_signal(&fence->base);
+--- a/drivers/gpu/drm/v3d/v3d_sched.c
++++ b/drivers/gpu/drm/v3d/v3d_sched.c
+@@ -19,6 +19,7 @@
+  */
+ 
+ #include <linux/kthread.h>
++#include <linux/sched/clock.h>
+ 
+ #include "v3d_drv.h"
+ #include "v3d_regs.h"
+@@ -72,6 +73,114 @@ v3d_switch_perfmon(struct v3d_dev *v3d,
+ 		v3d_perfmon_start(v3d, job->perfmon);
+ }
+ 
++/*
++ * Updates the scheduling stats of the gpu queues runtime for completed jobs.
++ *
++ * It should be called before any new job submission to the queue or before
++ * accessing the stats from the debugfs interface.
++ *
++ * It is expected that calls to this function are done with queue_stats->lock
++ * locked.
++ */
++void
++v3d_sched_stats_update(struct v3d_queue_stats *queue_stats)
++{
++	struct list_head *pid_stats_list = &queue_stats->pid_stats_list;
++	struct v3d_queue_pid_stats *cur, *tmp;
++	u64 runtime = 0;
++	bool store_pid_stats =
++		time_is_after_jiffies(queue_stats->gpu_pid_stats_timeout);
++
++	/* If debugfs stats gpu_pid_usage has not been polled for a period,
++	 * the pid stats collection is stopped and we purge any existing
++	 * pid_stats.
++	 *
++	 * pid_stats are also purged for clients that have reached the
++	 * timeout_purge because the process probably does not exist anymore.
++	 */
++	list_for_each_entry_safe_reverse(cur, tmp, pid_stats_list, list) {
++		if (!store_pid_stats || time_is_before_jiffies(cur->timeout_purge)) {
++			list_del(&cur->list);
++			kfree(cur);
++		} else {
++			break;
++		}
++	}
++	/* If a job has finished its stats are updated. */
++	if (queue_stats->last_pid && queue_stats->last_exec_end) {
++		runtime = queue_stats->last_exec_end -
++			  queue_stats->last_exec_start;
++		queue_stats->runtime += runtime;
++
++		if (store_pid_stats) {
++			struct v3d_queue_pid_stats *pid_stats;
++			/* Last job info is always at the head of the list */
++			pid_stats = list_first_entry_or_null(pid_stats_list,
++				struct v3d_queue_pid_stats, list);
++			if (pid_stats &&
++			    pid_stats->pid == queue_stats->last_pid) {
++				pid_stats->runtime += runtime;
++			}
++		}
++		queue_stats->last_pid = 0;
++	}
++}
++
++/*
++ * Updates the queue usage adding the information of a new job that is
++ * about to be sent to the GPU to be executed.
++ */
++int
++v3d_sched_stats_add_job(struct v3d_queue_stats *queue_stats,
++			struct drm_sched_job *sched_job)
++{
++
++	struct v3d_queue_pid_stats *pid_stats = NULL;
++	struct v3d_job *job = sched_job?to_v3d_job(sched_job):NULL;
++	struct v3d_queue_pid_stats *cur;
++	struct list_head *pid_stats_list = &queue_stats->pid_stats_list;
++	int ret = 0;
++
++	mutex_lock(&queue_stats->lock);
++
++	/* Completion of previous job requires an update of its runtime stats */
++	v3d_sched_stats_update(queue_stats);
++
++	queue_stats->last_exec_start = local_clock();
++	queue_stats->last_exec_end = 0;
++	queue_stats->jobs_sent++;
++	queue_stats->last_pid = job->client_pid;
++
++	/* gpu usage stats by process are being collected */
++	if (time_is_after_jiffies(queue_stats->gpu_pid_stats_timeout)) {
++		list_for_each_entry(cur, pid_stats_list, list) {
++			if (cur->pid == job->client_pid) {
++				pid_stats = cur;
++				break;
++			}
++		}
++		/* pid_stats of this client is moved to the head of the list. */
++		if (pid_stats) {
++			list_move(&pid_stats->list, pid_stats_list);
++		} else {
++			pid_stats = kzalloc(sizeof(struct v3d_queue_pid_stats),
++					    GFP_KERNEL);
++			if (!pid_stats) {
++				ret = -ENOMEM;
++				goto err_mem;
++			}
++			pid_stats->pid = job->client_pid;
++			list_add(&pid_stats->list, pid_stats_list);
++		}
++		pid_stats->jobs_sent++;
++		pid_stats->timeout_purge = jiffies + V3D_QUEUE_STATS_TIMEOUT;
++	}
++
++err_mem:
++	mutex_unlock(&queue_stats->lock);
++	return ret;
++}
++
+ static struct dma_fence *v3d_bin_job_run(struct drm_sched_job *sched_job)
+ {
+ 	struct v3d_bin_job *job = to_bin_job(sched_job);
+@@ -107,6 +216,7 @@ static struct dma_fence *v3d_bin_job_run
+ 	trace_v3d_submit_cl(dev, false, to_v3d_fence(fence)->seqno,
+ 			    job->start, job->end);
+ 
++	v3d_sched_stats_add_job(&v3d->gpu_queue_stats[V3D_BIN], sched_job);
+ 	v3d_switch_perfmon(v3d, &job->base);
+ 
+ 	/* Set the current and end address of the control list.
+@@ -158,6 +268,7 @@ static struct dma_fence *v3d_render_job_
+ 	trace_v3d_submit_cl(dev, true, to_v3d_fence(fence)->seqno,
+ 			    job->start, job->end);
+ 
++	v3d_sched_stats_add_job(&v3d->gpu_queue_stats[V3D_RENDER], sched_job);
+ 	v3d_switch_perfmon(v3d, &job->base);
+ 
+ 	/* XXX: Set the QCFG */
+@@ -190,6 +301,7 @@ v3d_tfu_job_run(struct drm_sched_job *sc
+ 
+ 	trace_v3d_submit_tfu(dev, to_v3d_fence(fence)->seqno);
+ 
++	v3d_sched_stats_add_job(&v3d->gpu_queue_stats[V3D_TFU], sched_job);
+ 	V3D_WRITE(V3D_TFU_IIA, job->args.iia);
+ 	V3D_WRITE(V3D_TFU_IIS, job->args.iis);
+ 	V3D_WRITE(V3D_TFU_ICA, job->args.ica);
+@@ -231,6 +343,7 @@ v3d_csd_job_run(struct drm_sched_job *sc
+ 
+ 	trace_v3d_submit_csd(dev, to_v3d_fence(fence)->seqno);
+ 
++	v3d_sched_stats_add_job(&v3d->gpu_queue_stats[V3D_CSD], sched_job);
+ 	v3d_switch_perfmon(v3d, &job->base);
+ 
+ 	for (i = 1; i <= 6; i++)
+@@ -247,7 +360,10 @@ v3d_cache_clean_job_run(struct drm_sched
+ 	struct v3d_job *job = to_v3d_job(sched_job);
+ 	struct v3d_dev *v3d = job->v3d;
+ 
++	v3d_sched_stats_add_job(&v3d->gpu_queue_stats[V3D_CACHE_CLEAN],
++				sched_job);
+ 	v3d_clean_caches(v3d);
++	v3d->gpu_queue_stats[V3D_CACHE_CLEAN].last_exec_end = local_clock();
+ 
+ 	return NULL;
+ }
+@@ -385,8 +501,18 @@ v3d_sched_init(struct v3d_dev *v3d)
+ 	int hw_jobs_limit = 1;
+ 	int job_hang_limit = 0;
+ 	int hang_limit_ms = 500;
++	enum v3d_queue q;
+ 	int ret;
+ 
++	for (q = 0; q < V3D_MAX_QUEUES; q++) {
++		INIT_LIST_HEAD(&v3d->gpu_queue_stats[q].pid_stats_list);
++		/* Setting timeout before current jiffies disables collecting
++		 * pid_stats on scheduling init.
++		 */
++		v3d->gpu_queue_stats[q].gpu_pid_stats_timeout = jiffies - 1;
++		mutex_init(&v3d->gpu_queue_stats[q].lock);
++	}
++
+ 	ret = drm_sched_init(&v3d->queue[V3D_BIN].sched,
+ 			     &v3d_bin_sched_ops,
+ 			     hw_jobs_limit, job_hang_limit,
+@@ -440,9 +566,20 @@ void
+ v3d_sched_fini(struct v3d_dev *v3d)
+ {
+ 	enum v3d_queue q;
++	struct v3d_queue_stats *queue_stats;
+ 
+ 	for (q = 0; q < V3D_MAX_QUEUES; q++) {
+-		if (v3d->queue[q].sched.ready)
++		if (v3d->queue[q].sched.ready) {
++			queue_stats = &v3d->gpu_queue_stats[q];
++			mutex_lock(&queue_stats->lock);
++			/* Setting gpu_pid_stats_timeout to jiffies-1 will
++			 * make v3d_sched_stats_update to purge all
++			 * allocated pid_stats.
++			 */
++			queue_stats->gpu_pid_stats_timeout = jiffies - 1;
++			v3d_sched_stats_update(queue_stats);
++			mutex_unlock(&queue_stats->lock);
+ 			drm_sched_fini(&v3d->queue[q].sched);
++		}
+ 	}
+ }
diff --git a/target/linux/bcm27xx/patches-6.1/950-0706-ARM-dts-bcm2711-rpi-ds-Group-the-common-pins.patch b/target/linux/bcm27xx/patches-6.1/950-0706-ARM-dts-bcm2711-rpi-ds-Group-the-common-pins.patch
new file mode 100644
index 00000000000000..806c06292b44b5
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0706-ARM-dts-bcm2711-rpi-ds-Group-the-common-pins.patch
@@ -0,0 +1,693 @@
+From d06fdceb579a5dcdb1bc864ec7ca4f8a94bc3cab Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 9 May 2023 13:52:39 +0100
+Subject: [PATCH] ARM: dts: bcm2711-rpi-ds: Group the common pins
+
+Move common pin group declarations into the shared bcm2711-rpi-ds.dtsi.
+No functional change.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/bcm2711-rpi-4-b.dts  | 121 -------------------------
+ arch/arm/boot/dts/bcm2711-rpi-400.dts  | 121 -------------------------
+ arch/arm/boot/dts/bcm2711-rpi-cm4.dts  | 121 -------------------------
+ arch/arm/boot/dts/bcm2711-rpi-cm4s.dts | 121 -------------------------
+ arch/arm/boot/dts/bcm2711-rpi-ds.dtsi  | 121 +++++++++++++++++++++++++
+ 5 files changed, 121 insertions(+), 484 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
+@@ -310,103 +310,6 @@
+ };
+ 
+ &gpio {
+-	spi0_pins: spi0_pins {
+-		brcm,pins = <9 10 11>;
+-		brcm,function = <BCM2835_FSEL_ALT0>;
+-	};
+-
+-	spi0_cs_pins: spi0_cs_pins {
+-		brcm,pins = <8 7>;
+-		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+-	};
+-
+-	spi3_pins: spi3_pins {
+-		brcm,pins = <1 2 3>;
+-		brcm,function = <BCM2835_FSEL_ALT3>;
+-	};
+-
+-	spi3_cs_pins: spi3_cs_pins {
+-		brcm,pins = <0 24>;
+-		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+-	};
+-
+-	spi4_pins: spi4_pins {
+-		brcm,pins = <5 6 7>;
+-		brcm,function = <BCM2835_FSEL_ALT3>;
+-	};
+-
+-	spi4_cs_pins: spi4_cs_pins {
+-		brcm,pins = <4 25>;
+-		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+-	};
+-
+-	spi5_pins: spi5_pins {
+-		brcm,pins = <13 14 15>;
+-		brcm,function = <BCM2835_FSEL_ALT3>;
+-	};
+-
+-	spi5_cs_pins: spi5_cs_pins {
+-		brcm,pins = <12 26>;
+-		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+-	};
+-
+-	spi6_pins: spi6_pins {
+-		brcm,pins = <19 20 21>;
+-		brcm,function = <BCM2835_FSEL_ALT3>;
+-	};
+-
+-	spi6_cs_pins: spi6_cs_pins {
+-		brcm,pins = <18 27>;
+-		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+-	};
+-
+-	i2c0_pins: i2c0 {
+-		brcm,pins = <0 1>;
+-		brcm,function = <BCM2835_FSEL_ALT0>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2c1_pins: i2c1 {
+-		brcm,pins = <2 3>;
+-		brcm,function = <BCM2835_FSEL_ALT0>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2c3_pins: i2c3 {
+-		brcm,pins = <4 5>;
+-		brcm,function = <BCM2835_FSEL_ALT5>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2c4_pins: i2c4 {
+-		brcm,pins = <8 9>;
+-		brcm,function = <BCM2835_FSEL_ALT5>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2c5_pins: i2c5 {
+-		brcm,pins = <12 13>;
+-		brcm,function = <BCM2835_FSEL_ALT5>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2c6_pins: i2c6 {
+-		brcm,pins = <22 23>;
+-		brcm,function = <BCM2835_FSEL_ALT5>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2s_pins: i2s {
+-		brcm,pins = <18 19 20 21>;
+-		brcm,function = <BCM2835_FSEL_ALT0>;
+-	};
+-
+-	sdio_pins: sdio_pins {
+-		brcm,pins =     <34 35 36 37 38 39>;
+-		brcm,function = <BCM2835_FSEL_ALT3>; // alt3 = SD1
+-		brcm,pull =     <0 2 2 2 2 2>;
+-	};
+-
+ 	bt_pins: bt_pins {
+ 		brcm,pins = "-"; // non-empty to keep btuart happy, //4 = 0
+ 				 // to fool pinctrl
+@@ -431,30 +334,6 @@
+ 		brcm,function = <BCM2835_FSEL_ALT5>; /* alt5=UART1 */
+ 		brcm,pull = <0 2 2 0>;
+ 	};
+-
+-	uart2_pins: uart2_pins {
+-		brcm,pins = <0 1>;
+-		brcm,function = <BCM2835_FSEL_ALT4>;
+-		brcm,pull = <0 2>;
+-	};
+-
+-	uart3_pins: uart3_pins {
+-		brcm,pins = <4 5>;
+-		brcm,function = <BCM2835_FSEL_ALT4>;
+-		brcm,pull = <0 2>;
+-	};
+-
+-	uart4_pins: uart4_pins {
+-		brcm,pins = <8 9>;
+-		brcm,function = <BCM2835_FSEL_ALT4>;
+-		brcm,pull = <0 2>;
+-	};
+-
+-	uart5_pins: uart5_pins {
+-		brcm,pins = <12 13>;
+-		brcm,function = <BCM2835_FSEL_ALT4>;
+-		brcm,pull = <0 2>;
+-	};
+ };
+ 
+ &i2c0if {
+--- a/arch/arm/boot/dts/bcm2711-rpi-400.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-400.dts
+@@ -310,103 +310,6 @@
+ };
+ 
+ &gpio {
+-	spi0_pins: spi0_pins {
+-		brcm,pins = <9 10 11>;
+-		brcm,function = <BCM2835_FSEL_ALT0>;
+-	};
+-
+-	spi0_cs_pins: spi0_cs_pins {
+-		brcm,pins = <8 7>;
+-		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+-	};
+-
+-	spi3_pins: spi3_pins {
+-		brcm,pins = <1 2 3>;
+-		brcm,function = <BCM2835_FSEL_ALT3>;
+-	};
+-
+-	spi3_cs_pins: spi3_cs_pins {
+-		brcm,pins = <0 24>;
+-		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+-	};
+-
+-	spi4_pins: spi4_pins {
+-		brcm,pins = <5 6 7>;
+-		brcm,function = <BCM2835_FSEL_ALT3>;
+-	};
+-
+-	spi4_cs_pins: spi4_cs_pins {
+-		brcm,pins = <4 25>;
+-		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+-	};
+-
+-	spi5_pins: spi5_pins {
+-		brcm,pins = <13 14 15>;
+-		brcm,function = <BCM2835_FSEL_ALT3>;
+-	};
+-
+-	spi5_cs_pins: spi5_cs_pins {
+-		brcm,pins = <12 26>;
+-		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+-	};
+-
+-	spi6_pins: spi6_pins {
+-		brcm,pins = <19 20 21>;
+-		brcm,function = <BCM2835_FSEL_ALT3>;
+-	};
+-
+-	spi6_cs_pins: spi6_cs_pins {
+-		brcm,pins = <18 27>;
+-		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+-	};
+-
+-	i2c0_pins: i2c0 {
+-		brcm,pins = <0 1>;
+-		brcm,function = <BCM2835_FSEL_ALT0>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2c1_pins: i2c1 {
+-		brcm,pins = <2 3>;
+-		brcm,function = <BCM2835_FSEL_ALT0>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2c3_pins: i2c3 {
+-		brcm,pins = <4 5>;
+-		brcm,function = <BCM2835_FSEL_ALT5>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2c4_pins: i2c4 {
+-		brcm,pins = <8 9>;
+-		brcm,function = <BCM2835_FSEL_ALT5>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2c5_pins: i2c5 {
+-		brcm,pins = <12 13>;
+-		brcm,function = <BCM2835_FSEL_ALT5>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2c6_pins: i2c6 {
+-		brcm,pins = <22 23>;
+-		brcm,function = <BCM2835_FSEL_ALT5>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2s_pins: i2s {
+-		brcm,pins = <18 19 20 21>;
+-		brcm,function = <BCM2835_FSEL_ALT0>;
+-	};
+-
+-	sdio_pins: sdio_pins {
+-		brcm,pins =     <34 35 36 37 38 39>;
+-		brcm,function = <BCM2835_FSEL_ALT3>; // alt3 = SD1
+-		brcm,pull =     <0 2 2 2 2 2>;
+-	};
+-
+ 	bt_pins: bt_pins {
+ 		brcm,pins = "-"; // non-empty to keep btuart happy, //4 = 0
+ 				 // to fool pinctrl
+@@ -431,30 +334,6 @@
+ 		brcm,function = <BCM2835_FSEL_ALT5>; /* alt5=UART1 */
+ 		brcm,pull = <0 2 2 0>;
+ 	};
+-
+-	uart2_pins: uart2_pins {
+-		brcm,pins = <0 1>;
+-		brcm,function = <BCM2835_FSEL_ALT4>;
+-		brcm,pull = <0 2>;
+-	};
+-
+-	uart3_pins: uart3_pins {
+-		brcm,pins = <4 5>;
+-		brcm,function = <BCM2835_FSEL_ALT4>;
+-		brcm,pull = <0 2>;
+-	};
+-
+-	uart4_pins: uart4_pins {
+-		brcm,pins = <8 9>;
+-		brcm,function = <BCM2835_FSEL_ALT4>;
+-		brcm,pull = <0 2>;
+-	};
+-
+-	uart5_pins: uart5_pins {
+-		brcm,pins = <12 13>;
+-		brcm,function = <BCM2835_FSEL_ALT4>;
+-		brcm,pull = <0 2>;
+-	};
+ };
+ 
+ &i2c0if {
+--- a/arch/arm/boot/dts/bcm2711-rpi-cm4.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-cm4.dts
+@@ -319,103 +319,6 @@
+ };
+ 
+ &gpio {
+-	spi0_pins: spi0_pins {
+-		brcm,pins = <9 10 11>;
+-		brcm,function = <BCM2835_FSEL_ALT0>;
+-	};
+-
+-	spi0_cs_pins: spi0_cs_pins {
+-		brcm,pins = <8 7>;
+-		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+-	};
+-
+-	spi3_pins: spi3_pins {
+-		brcm,pins = <1 2 3>;
+-		brcm,function = <BCM2835_FSEL_ALT3>;
+-	};
+-
+-	spi3_cs_pins: spi3_cs_pins {
+-		brcm,pins = <0 24>;
+-		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+-	};
+-
+-	spi4_pins: spi4_pins {
+-		brcm,pins = <5 6 7>;
+-		brcm,function = <BCM2835_FSEL_ALT3>;
+-	};
+-
+-	spi4_cs_pins: spi4_cs_pins {
+-		brcm,pins = <4 25>;
+-		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+-	};
+-
+-	spi5_pins: spi5_pins {
+-		brcm,pins = <13 14 15>;
+-		brcm,function = <BCM2835_FSEL_ALT3>;
+-	};
+-
+-	spi5_cs_pins: spi5_cs_pins {
+-		brcm,pins = <12 26>;
+-		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+-	};
+-
+-	spi6_pins: spi6_pins {
+-		brcm,pins = <19 20 21>;
+-		brcm,function = <BCM2835_FSEL_ALT3>;
+-	};
+-
+-	spi6_cs_pins: spi6_cs_pins {
+-		brcm,pins = <18 27>;
+-		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+-	};
+-
+-	i2c0_pins: i2c0 {
+-		brcm,pins = <0 1>;
+-		brcm,function = <BCM2835_FSEL_ALT0>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2c1_pins: i2c1 {
+-		brcm,pins = <2 3>;
+-		brcm,function = <BCM2835_FSEL_ALT0>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2c3_pins: i2c3 {
+-		brcm,pins = <4 5>;
+-		brcm,function = <BCM2835_FSEL_ALT5>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2c4_pins: i2c4 {
+-		brcm,pins = <8 9>;
+-		brcm,function = <BCM2835_FSEL_ALT5>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2c5_pins: i2c5 {
+-		brcm,pins = <12 13>;
+-		brcm,function = <BCM2835_FSEL_ALT5>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2c6_pins: i2c6 {
+-		brcm,pins = <22 23>;
+-		brcm,function = <BCM2835_FSEL_ALT5>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2s_pins: i2s {
+-		brcm,pins = <18 19 20 21>;
+-		brcm,function = <BCM2835_FSEL_ALT0>;
+-	};
+-
+-	sdio_pins: sdio_pins {
+-		brcm,pins =     <34 35 36 37 38 39>;
+-		brcm,function = <BCM2835_FSEL_ALT3>; // alt3 = SD1
+-		brcm,pull =     <0 2 2 2 2 2>;
+-	};
+-
+ 	bt_pins: bt_pins {
+ 		brcm,pins = "-"; // non-empty to keep btuart happy, //4 = 0
+ 				 // to fool pinctrl
+@@ -440,30 +343,6 @@
+ 		brcm,function = <BCM2835_FSEL_ALT5>; /* alt5=UART1 */
+ 		brcm,pull = <0 2 2 0>;
+ 	};
+-
+-	uart2_pins: uart2_pins {
+-		brcm,pins = <0 1>;
+-		brcm,function = <BCM2835_FSEL_ALT4>;
+-		brcm,pull = <0 2>;
+-	};
+-
+-	uart3_pins: uart3_pins {
+-		brcm,pins = <4 5>;
+-		brcm,function = <BCM2835_FSEL_ALT4>;
+-		brcm,pull = <0 2>;
+-	};
+-
+-	uart4_pins: uart4_pins {
+-		brcm,pins = <8 9>;
+-		brcm,function = <BCM2835_FSEL_ALT4>;
+-		brcm,pull = <0 2>;
+-	};
+-
+-	uart5_pins: uart5_pins {
+-		brcm,pins = <12 13>;
+-		brcm,function = <BCM2835_FSEL_ALT4>;
+-		brcm,pull = <0 2>;
+-	};
+ };
+ 
+ &i2c0if {
+--- a/arch/arm/boot/dts/bcm2711-rpi-cm4s.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-cm4s.dts
+@@ -200,132 +200,11 @@
+ };
+ 
+ &gpio {
+-	spi0_pins: spi0_pins {
+-		brcm,pins = <9 10 11>;
+-		brcm,function = <BCM2835_FSEL_ALT0>;
+-	};
+-
+-	spi0_cs_pins: spi0_cs_pins {
+-		brcm,pins = <8 7>;
+-		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+-	};
+-
+-	spi3_pins: spi3_pins {
+-		brcm,pins = <1 2 3>;
+-		brcm,function = <BCM2835_FSEL_ALT3>;
+-	};
+-
+-	spi3_cs_pins: spi3_cs_pins {
+-		brcm,pins = <0 24>;
+-		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+-	};
+-
+-	spi4_pins: spi4_pins {
+-		brcm,pins = <5 6 7>;
+-		brcm,function = <BCM2835_FSEL_ALT3>;
+-	};
+-
+-	spi4_cs_pins: spi4_cs_pins {
+-		brcm,pins = <4 25>;
+-		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+-	};
+-
+-	spi5_pins: spi5_pins {
+-		brcm,pins = <13 14 15>;
+-		brcm,function = <BCM2835_FSEL_ALT3>;
+-	};
+-
+-	spi5_cs_pins: spi5_cs_pins {
+-		brcm,pins = <12 26>;
+-		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+-	};
+-
+-	spi6_pins: spi6_pins {
+-		brcm,pins = <19 20 21>;
+-		brcm,function = <BCM2835_FSEL_ALT3>;
+-	};
+-
+-	spi6_cs_pins: spi6_cs_pins {
+-		brcm,pins = <18 27>;
+-		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+-	};
+-
+-	i2c0_pins: i2c0 {
+-		brcm,pins = <0 1>;
+-		brcm,function = <BCM2835_FSEL_ALT0>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2c1_pins: i2c1 {
+-		brcm,pins = <2 3>;
+-		brcm,function = <BCM2835_FSEL_ALT0>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2c3_pins: i2c3 {
+-		brcm,pins = <4 5>;
+-		brcm,function = <BCM2835_FSEL_ALT5>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2c4_pins: i2c4 {
+-		brcm,pins = <8 9>;
+-		brcm,function = <BCM2835_FSEL_ALT5>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2c5_pins: i2c5 {
+-		brcm,pins = <12 13>;
+-		brcm,function = <BCM2835_FSEL_ALT5>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2c6_pins: i2c6 {
+-		brcm,pins = <22 23>;
+-		brcm,function = <BCM2835_FSEL_ALT5>;
+-		brcm,pull = <BCM2835_PUD_UP>;
+-	};
+-
+-	i2s_pins: i2s {
+-		brcm,pins = <18 19 20 21>;
+-		brcm,function = <BCM2835_FSEL_ALT0>;
+-	};
+-
+-	sdio_pins: sdio_pins {
+-		brcm,pins =     <34 35 36 37 38 39>;
+-		brcm,function = <BCM2835_FSEL_ALT3>; // alt3 = SD1
+-		brcm,pull =     <0 2 2 2 2 2>;
+-	};
+-
+ 	uart0_pins: uart0_pins {
+ 		brcm,pins;
+ 		brcm,function;
+ 		brcm,pull;
+ 	};
+-
+-	uart2_pins: uart2_pins {
+-		brcm,pins = <0 1>;
+-		brcm,function = <BCM2835_FSEL_ALT4>;
+-		brcm,pull = <0 2>;
+-	};
+-
+-	uart3_pins: uart3_pins {
+-		brcm,pins = <4 5>;
+-		brcm,function = <BCM2835_FSEL_ALT4>;
+-		brcm,pull = <0 2>;
+-	};
+-
+-	uart4_pins: uart4_pins {
+-		brcm,pins = <8 9>;
+-		brcm,function = <BCM2835_FSEL_ALT4>;
+-		brcm,pull = <0 2>;
+-	};
+-
+-	uart5_pins: uart5_pins {
+-		brcm,pins = <12 13>;
+-		brcm,function = <BCM2835_FSEL_ALT4>;
+-		brcm,pull = <0 2>;
+-	};
+ };
+ 
+ &i2c0if {
+--- a/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
++++ b/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
+@@ -171,6 +171,127 @@
+ &gpio {
+ 	interrupts = <GIC_SPI 113 IRQ_TYPE_LEVEL_HIGH>,
+ 		     <GIC_SPI 114 IRQ_TYPE_LEVEL_HIGH>;
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi3_pins: spi3_pins {
++		brcm,pins = <1 2 3>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi3_cs_pins: spi3_cs_pins {
++		brcm,pins = <0 24>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi4_pins: spi4_pins {
++		brcm,pins = <5 6 7>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi4_cs_pins: spi4_cs_pins {
++		brcm,pins = <4 25>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi5_pins: spi5_pins {
++		brcm,pins = <13 14 15>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi5_cs_pins: spi5_cs_pins {
++		brcm,pins = <12 26>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi6_pins: spi6_pins {
++		brcm,pins = <19 20 21>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi6_cs_pins: spi6_cs_pins {
++		brcm,pins = <18 27>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c3_pins: i2c3 {
++		brcm,pins = <4 5>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c4_pins: i2c4 {
++		brcm,pins = <8 9>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c5_pins: i2c5 {
++		brcm,pins = <12 13>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c6_pins: i2c6 {
++		brcm,pins = <22 23>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++	};
++
++	sdio_pins: sdio_pins {
++		brcm,pins =     <34 35 36 37 38 39>;
++		brcm,function = <BCM2835_FSEL_ALT3>; // alt3 = SD1
++		brcm,pull =     <0 2 2 2 2 2>;
++	};
++
++	uart2_pins: uart2_pins {
++		brcm,pins = <0 1>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++
++	uart3_pins: uart3_pins {
++		brcm,pins = <4 5>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++
++	uart4_pins: uart4_pins {
++		brcm,pins = <8 9>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++
++	uart5_pins: uart5_pins {
++		brcm,pins = <12 13>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
+ };
+ 
+ &emmc2 {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0707-ARM-dts-bcm2711-rpi-ds-Set-default-I-O-pins.patch b/target/linux/bcm27xx/patches-6.1/950-0707-ARM-dts-bcm2711-rpi-ds-Set-default-I-O-pins.patch
new file mode 100644
index 00000000000000..caeba6f71fc451
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0707-ARM-dts-bcm2711-rpi-ds-Set-default-I-O-pins.patch
@@ -0,0 +1,84 @@
+From 4dda6d4ab43c8628066b0c0f72107249cfb86d39 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 9 May 2023 14:20:58 +0100
+Subject: [PATCH] ARM: dts: bcm2711-rpi-ds: Set default I/O pins
+
+Give all the extended I/O interfaces - I2C3-6, SPI3-6 and UART2-5 -
+sensible default pinctrl references.
+
+See: https://github.com/raspberrypi/linux/pull/5443
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/bcm2711-rpi-ds.dtsi | 60 +++++++++++++++++++++++++++
+ 1 file changed, 60 insertions(+)
+
+--- a/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
++++ b/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
+@@ -418,6 +418,66 @@
+ i2c_arm: &i2c1 {};
+ i2c_vc: &i2c0 {};
+ 
++&i2c3 {
++	pinctrl-0 = <&i2c3_pins>;
++	pinctrl-names = "default";
++};
++
++&i2c4 {
++	pinctrl-0 = <&i2c4_pins>;
++	pinctrl-names = "default";
++};
++
++&i2c5 {
++	pinctrl-0 = <&i2c5_pins>;
++	pinctrl-names = "default";
++};
++
++&i2c6 {
++	pinctrl-0 = <&i2c6_pins>;
++	pinctrl-names = "default";
++};
++
++&spi3 {
++	pinctrl-0 = <&spi3_pins &spi3_cs_pins>;
++	pinctrl-names = "default";
++};
++
++&spi4 {
++	pinctrl-0 = <&spi4_pins &spi4_cs_pins>;
++	pinctrl-names = "default";
++};
++
++&spi5 {
++	pinctrl-0 = <&spi5_pins &spi5_cs_pins>;
++	pinctrl-names = "default";
++};
++
++&spi6 {
++	pinctrl-0 = <&spi6_pins &spi6_cs_pins>;
++	pinctrl-names = "default";
++};
++
++&uart2 {
++	pinctrl-0 = <&uart2_pins>;
++	pinctrl-names = "default";
++};
++
++&uart3 {
++	pinctrl-0 = <&uart3_pins>;
++	pinctrl-names = "default";
++};
++
++&uart4 {
++	pinctrl-0 = <&uart4_pins>;
++	pinctrl-names = "default";
++};
++
++&uart5 {
++	pinctrl-0 = <&uart5_pins>;
++	pinctrl-names = "default";
++};
++
+ /delete-node/ &v3d;
+ 
+ / {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0708-overlays-bcm2711-Remove-I-O-pinctrl-references.patch b/target/linux/bcm27xx/patches-6.1/950-0708-overlays-bcm2711-Remove-I-O-pinctrl-references.patch
new file mode 100644
index 00000000000000..2694e82d625818
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0708-overlays-bcm2711-Remove-I-O-pinctrl-references.patch
@@ -0,0 +1,207 @@
+From 9cd4f409e6d78aad4b70ef16810526ebc6bc24de Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 9 May 2023 14:25:10 +0100
+Subject: [PATCH] overlays: bcm2711: Remove I/O pinctrl references
+
+Now that the base bcm2711 base dts files give the added I/O interfaces
+references to the default pinctrl nodes, remove the same from their
+respective overlays.
+
+See: https://github.com/raspberrypi/linux/pull/5443
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/i2c3-overlay.dts     | 2 --
+ arch/arm/boot/dts/overlays/i2c4-overlay.dts     | 2 --
+ arch/arm/boot/dts/overlays/i2c5-overlay.dts     | 2 --
+ arch/arm/boot/dts/overlays/i2c6-overlay.dts     | 2 --
+ arch/arm/boot/dts/overlays/spi3-1cs-overlay.dts | 2 --
+ arch/arm/boot/dts/overlays/spi3-2cs-overlay.dts | 2 --
+ arch/arm/boot/dts/overlays/spi4-1cs-overlay.dts | 2 --
+ arch/arm/boot/dts/overlays/spi4-2cs-overlay.dts | 2 --
+ arch/arm/boot/dts/overlays/spi5-1cs-overlay.dts | 2 --
+ arch/arm/boot/dts/overlays/spi5-2cs-overlay.dts | 2 --
+ arch/arm/boot/dts/overlays/spi6-1cs-overlay.dts | 2 --
+ arch/arm/boot/dts/overlays/spi6-2cs-overlay.dts | 2 --
+ arch/arm/boot/dts/overlays/uart2-overlay.dts    | 2 --
+ arch/arm/boot/dts/overlays/uart3-overlay.dts    | 2 --
+ arch/arm/boot/dts/overlays/uart4-overlay.dts    | 2 --
+ arch/arm/boot/dts/overlays/uart5-overlay.dts    | 2 --
+ 16 files changed, 32 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/i2c3-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c3-overlay.dts
+@@ -8,8 +8,6 @@
+ 		target = <&i2c3>;
+ 		frag0: __overlay__ {
+ 			status = "okay";
+-			pinctrl-names = "default";
+-			pinctrl-0 = <&i2c3_pins>;
+ 			clock-frequency = <100000>;
+ 		};
+ 	};
+--- a/arch/arm/boot/dts/overlays/i2c4-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c4-overlay.dts
+@@ -8,8 +8,6 @@
+ 		target = <&i2c4>;
+ 		frag0: __overlay__ {
+ 			status = "okay";
+-			pinctrl-names = "default";
+-			pinctrl-0 = <&i2c4_pins>;
+ 			clock-frequency = <100000>;
+ 		};
+ 	};
+--- a/arch/arm/boot/dts/overlays/i2c5-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c5-overlay.dts
+@@ -8,8 +8,6 @@
+ 		target = <&i2c5>;
+ 		frag0: __overlay__ {
+ 			status = "okay";
+-			pinctrl-names = "default";
+-			pinctrl-0 = <&i2c5_pins>;
+ 			clock-frequency = <100000>;
+ 		};
+ 	};
+--- a/arch/arm/boot/dts/overlays/i2c6-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c6-overlay.dts
+@@ -8,8 +8,6 @@
+ 		target = <&i2c6>;
+ 		frag0: __overlay__ {
+ 			status = "okay";
+-			pinctrl-names = "default";
+-			pinctrl-0 = <&i2c6_pins>;
+ 			clock-frequency = <100000>;
+ 		};
+ 	};
+--- a/arch/arm/boot/dts/overlays/spi3-1cs-overlay.dts
++++ b/arch/arm/boot/dts/overlays/spi3-1cs-overlay.dts
+@@ -20,8 +20,6 @@
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 
+-			pinctrl-names = "default";
+-		        pinctrl-0 = <&spi3_pins &spi3_cs_pins>;
+ 			cs-gpios = <&gpio 0 1>;
+ 			status = "okay";
+ 
+--- a/arch/arm/boot/dts/overlays/spi3-2cs-overlay.dts
++++ b/arch/arm/boot/dts/overlays/spi3-2cs-overlay.dts
+@@ -20,8 +20,6 @@
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 
+-			pinctrl-names = "default";
+-		        pinctrl-0 = <&spi3_pins &spi3_cs_pins>;
+ 			cs-gpios = <&gpio 0 1>, <&gpio 24 1>;
+ 			status = "okay";
+ 
+--- a/arch/arm/boot/dts/overlays/spi4-1cs-overlay.dts
++++ b/arch/arm/boot/dts/overlays/spi4-1cs-overlay.dts
+@@ -20,8 +20,6 @@
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 
+-			pinctrl-names = "default";
+-		        pinctrl-0 = <&spi4_pins &spi4_cs_pins>;
+ 			cs-gpios = <&gpio 4 1>;
+ 			status = "okay";
+ 
+--- a/arch/arm/boot/dts/overlays/spi4-2cs-overlay.dts
++++ b/arch/arm/boot/dts/overlays/spi4-2cs-overlay.dts
+@@ -20,8 +20,6 @@
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 
+-			pinctrl-names = "default";
+-		        pinctrl-0 = <&spi4_pins &spi4_cs_pins>;
+ 			cs-gpios = <&gpio 4 1>, <&gpio 25 1>;
+ 			status = "okay";
+ 
+--- a/arch/arm/boot/dts/overlays/spi5-1cs-overlay.dts
++++ b/arch/arm/boot/dts/overlays/spi5-1cs-overlay.dts
+@@ -20,8 +20,6 @@
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 
+-			pinctrl-names = "default";
+-		        pinctrl-0 = <&spi5_pins &spi5_cs_pins>;
+ 			cs-gpios = <&gpio 12 1>;
+ 			status = "okay";
+ 
+--- a/arch/arm/boot/dts/overlays/spi5-2cs-overlay.dts
++++ b/arch/arm/boot/dts/overlays/spi5-2cs-overlay.dts
+@@ -20,8 +20,6 @@
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 
+-			pinctrl-names = "default";
+-		        pinctrl-0 = <&spi5_pins &spi5_cs_pins>;
+ 			cs-gpios = <&gpio 12 1>, <&gpio 26 1>;
+ 			status = "okay";
+ 
+--- a/arch/arm/boot/dts/overlays/spi6-1cs-overlay.dts
++++ b/arch/arm/boot/dts/overlays/spi6-1cs-overlay.dts
+@@ -20,8 +20,6 @@
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 
+-			pinctrl-names = "default";
+-		        pinctrl-0 = <&spi6_pins &spi6_cs_pins>;
+ 			cs-gpios = <&gpio 18 1>;
+ 			status = "okay";
+ 
+--- a/arch/arm/boot/dts/overlays/spi6-2cs-overlay.dts
++++ b/arch/arm/boot/dts/overlays/spi6-2cs-overlay.dts
+@@ -20,8 +20,6 @@
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 
+-			pinctrl-names = "default";
+-		        pinctrl-0 = <&spi6_pins &spi6_cs_pins>;
+ 			cs-gpios = <&gpio 18 1>, <&gpio 27 1>;
+ 			status = "okay";
+ 
+--- a/arch/arm/boot/dts/overlays/uart2-overlay.dts
++++ b/arch/arm/boot/dts/overlays/uart2-overlay.dts
+@@ -7,8 +7,6 @@
+ 	fragment@0 {
+ 		target = <&uart2>;
+ 		__overlay__ {
+-			pinctrl-names = "default";
+-			pinctrl-0 = <&uart2_pins>;
+ 			status = "okay";
+ 		};
+ 	};
+--- a/arch/arm/boot/dts/overlays/uart3-overlay.dts
++++ b/arch/arm/boot/dts/overlays/uart3-overlay.dts
+@@ -7,8 +7,6 @@
+ 	fragment@0 {
+ 		target = <&uart3>;
+ 		__overlay__ {
+-			pinctrl-names = "default";
+-			pinctrl-0 = <&uart3_pins>;
+ 			status = "okay";
+ 		};
+ 	};
+--- a/arch/arm/boot/dts/overlays/uart4-overlay.dts
++++ b/arch/arm/boot/dts/overlays/uart4-overlay.dts
+@@ -7,8 +7,6 @@
+ 	fragment@0 {
+ 		target = <&uart4>;
+ 		__overlay__ {
+-			pinctrl-names = "default";
+-			pinctrl-0 = <&uart4_pins>;
+ 			status = "okay";
+ 		};
+ 	};
+--- a/arch/arm/boot/dts/overlays/uart5-overlay.dts
++++ b/arch/arm/boot/dts/overlays/uart5-overlay.dts
+@@ -7,8 +7,6 @@
+ 	fragment@0 {
+ 		target = <&uart5>;
+ 		__overlay__ {
+-			pinctrl-names = "default";
+-			pinctrl-0 = <&uart5_pins>;
+ 			status = "okay";
+ 		};
+ 	};
diff --git a/target/linux/bcm27xx/patches-6.1/950-0709-ARM-dts-bcm27xx-Correct-the-dma-ranges.patch b/target/linux/bcm27xx/patches-6.1/950-0709-ARM-dts-bcm27xx-Correct-the-dma-ranges.patch
new file mode 100644
index 00000000000000..88be17f62e93c9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0709-ARM-dts-bcm27xx-Correct-the-dma-ranges.patch
@@ -0,0 +1,89 @@
+From 96c1d3649471109b3da9fc04797fa84f8cab4c81 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 11 May 2023 09:59:04 +0100
+Subject: [PATCH] ARM: dts: bcm27xx: Correct the dma-ranges
+
+Step one of using DMA addresses the intended way is to make sure that
+the mapping between CPU physical addresses and DMA addresses in Device
+Tree is complete and correct.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/bcm2708.dtsi        |  3 ++-
+ arch/arm/boot/dts/bcm2709.dtsi        |  3 +++
+ arch/arm/boot/dts/bcm2710.dtsi        |  3 +++
+ arch/arm/boot/dts/bcm2711-rpi-ds.dtsi | 13 ++++++++++++-
+ 4 files changed, 20 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm2708.dtsi
++++ b/arch/arm/boot/dts/bcm2708.dtsi
+@@ -10,7 +10,8 @@
+ };
+ 
+ &soc {
+-	dma-ranges = <0x80000000 0x00000000 0x20000000>;
++	dma-ranges = <0x80000000 0x00000000 0x20000000>,
++		     <0x7e000000 0x20000000 0x02000000>;
+ };
+ 
+ &vc4 {
+--- a/arch/arm/boot/dts/bcm2709.dtsi
++++ b/arch/arm/boot/dts/bcm2709.dtsi
+@@ -8,6 +8,9 @@
+ 		ranges = <0x7e000000 0x3f000000 0x01000000>,
+ 		         <0x40000000 0x40000000 0x00040000>;
+ 
++		dma-ranges = <0xc0000000 0x00000000 0x3f000000>,
++			     <0x7e000000 0x3f000000 0x01000000>;
++
+ 		/delete-node/ timer@7e003000;
+ 	};
+ 
+--- a/arch/arm/boot/dts/bcm2710.dtsi
++++ b/arch/arm/boot/dts/bcm2710.dtsi
+@@ -11,6 +11,9 @@
+ 	};
+ 
+ 	soc {
++		dma-ranges = <0xc0000000 0x00000000 0x3f000000>,
++			     <0x7e000000 0x3f000000 0x01000000>;
++
+ 		/delete-node/ timer@7e003000;
+ 	};
+ 
+--- a/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
++++ b/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
+@@ -18,6 +18,10 @@
+ 	     /* Add a label */
+ 	};
+ 
++	soc: soc {
++	     /* Add a label */
++	};
++
+ 	arm-pmu {
+ 		compatible = "arm,cortex-a72-pmu", "arm,armv8-pmuv3", "arm,cortex-a7-pmu";
+ 
+@@ -64,6 +68,12 @@
+ 	alloc-ranges = <0x0 0x00000000 0x30000000>;
+ };
+ 
++&soc {
++	/* Add the physical <-> DMA mapping for the I/O space */
++	dma-ranges = <0xc0000000  0x0 0x00000000  0x40000000>,
++		     <0x7c000000  0x0 0xfc000000  0x03800000>;
++};
++
+ &scb {
+ 	#size-cells = <2>;
+ 
+@@ -71,7 +81,8 @@
+ 		 <0x0 0x40000000  0x0 0xff800000  0x0 0x00800000>,
+ 		 <0x6 0x00000000  0x6 0x00000000  0x0 0x40000000>,
+ 		 <0x0 0x00000000  0x0 0x00000000  0x0 0xfc000000>;
+-	dma-ranges = <0x0 0x00000000  0x0 0x00000000  0x4 0x00000000>;
++	dma-ranges = <0x4 0x7c000000  0x0 0xfc000000  0x0 0x03800000>,
++		     <0x0 0x00000000  0x0 0x00000000  0x4 0x00000000>;
+ 
+ 	dma40: dma@7e007b00 {
+ 		compatible = "brcm,bcm2711-dma";
diff --git a/target/linux/bcm27xx/patches-6.1/950-0710-bcm2835-dma-Derive-slave-DMA-addresses-correctly.patch b/target/linux/bcm27xx/patches-6.1/950-0710-bcm2835-dma-Derive-slave-DMA-addresses-correctly.patch
new file mode 100644
index 00000000000000..548f8c114558e7
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0710-bcm2835-dma-Derive-slave-DMA-addresses-correctly.patch
@@ -0,0 +1,73 @@
+From 6d317d92627736a94e6c1c4b49c3f63cc33c28aa Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 11 May 2023 10:00:01 +0100
+Subject: [PATCH] bcm2835-dma: Derive slave DMA addresses correctly
+
+Slave addresses for DMA are meant to be supplied as physical addresses
+(contrary to what struct snd_dmaengine_dai_dma_data does). It is up to
+the DMA controller driver to perform the translation based on its own
+view of the world, as described in Device Tree.
+
+Now that the Pi Device Trees have the correct peripheral mappings,
+replace the hacky address munging with phys_to_dma().
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/dma/bcm2835-dma.c | 23 +++++------------------
+ 1 file changed, 5 insertions(+), 18 deletions(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -18,6 +18,7 @@
+  *	Copyright 2012 Marvell International Ltd.
+  */
+ #include <linux/dmaengine.h>
++#include <linux/dma-direct.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/dmapool.h>
+ #include <linux/err.h>
+@@ -910,22 +911,12 @@ static struct dma_async_tx_descriptor *b
+ 	if (direction == DMA_DEV_TO_MEM) {
+ 		if (c->cfg.src_addr_width != DMA_SLAVE_BUSWIDTH_4_BYTES)
+ 			return NULL;
+-		src = c->cfg.src_addr;
+-		/*
+-		 * One would think it ought to be possible to get the physical
+-		 * to dma address mapping information from the dma-ranges DT
+-		 * property, but I've not found a way yet that doesn't involve
+-		 * open-coding the whole thing.
+-		 */
+-		if (c->is_40bit_channel)
+-		    src |= 0x400000000ull;
++		src = phys_to_dma(chan->device->dev, c->cfg.src_addr);
+ 		info |= BCM2835_DMA_S_DREQ | BCM2835_DMA_D_INC;
+ 	} else {
+ 		if (c->cfg.dst_addr_width != DMA_SLAVE_BUSWIDTH_4_BYTES)
+ 			return NULL;
+-		dst = c->cfg.dst_addr;
+-		if (c->is_40bit_channel)
+-		    dst |= 0x400000000ull;
++		dst = phys_to_dma(chan->device->dev, c->cfg.dst_addr);
+ 		info |= BCM2835_DMA_D_DREQ | BCM2835_DMA_S_INC;
+ 	}
+ 
+@@ -994,17 +985,13 @@ static struct dma_async_tx_descriptor *b
+ 	if (direction == DMA_DEV_TO_MEM) {
+ 		if (c->cfg.src_addr_width != DMA_SLAVE_BUSWIDTH_4_BYTES)
+ 			return NULL;
+-		src = c->cfg.src_addr;
+-		if (c->is_40bit_channel)
+-		    src |= 0x400000000ull;
++		src = phys_to_dma(chan->device->dev, c->cfg.src_addr);
+ 		dst = buf_addr;
+ 		info |= BCM2835_DMA_S_DREQ | BCM2835_DMA_D_INC;
+ 	} else {
+ 		if (c->cfg.dst_addr_width != DMA_SLAVE_BUSWIDTH_4_BYTES)
+ 			return NULL;
+-		dst = c->cfg.dst_addr;
+-		if (c->is_40bit_channel)
+-		    dst |= 0x400000000ull;
++		dst = phys_to_dma(chan->device->dev, c->cfg.dst_addr);
+ 		src = buf_addr;
+ 		info |= BCM2835_DMA_D_DREQ | BCM2835_DMA_S_INC;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0711-ASoC-bcm2835-i2s-Use-phys-addresses-for-DAI-DMA.patch b/target/linux/bcm27xx/patches-6.1/950-0711-ASoC-bcm2835-i2s-Use-phys-addresses-for-DAI-DMA.patch
new file mode 100644
index 00000000000000..fd4917b0230b02
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0711-ASoC-bcm2835-i2s-Use-phys-addresses-for-DAI-DMA.patch
@@ -0,0 +1,65 @@
+From 6ecbde16d1e4f1ffd8e7e7e535f01942df8963f4 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 11 May 2023 10:07:45 +0100
+Subject: [PATCH] ASoC: bcm2835-i2s: Use phys addresses for DAI DMA
+
+Contrary to what struct snd_dmaengine_dai_dma_data suggests, the
+configuration of addresses of DMA slave interfaces should be done in
+CPU physical addresses.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ sound/soc/bcm/bcm2835-i2s.c | 18 ++++--------------
+ 1 file changed, 4 insertions(+), 14 deletions(-)
+
+--- a/sound/soc/bcm/bcm2835-i2s.c
++++ b/sound/soc/bcm/bcm2835-i2s.c
+@@ -30,7 +30,6 @@
+ #include <linux/init.h>
+ #include <linux/io.h>
+ #include <linux/module.h>
+-#include <linux/of_address.h>
+ #include <linux/slab.h>
+ 
+ #include <sound/core.h>
+@@ -830,8 +829,7 @@ static int bcm2835_i2s_probe(struct plat
+ 	struct bcm2835_i2s_dev *dev;
+ 	int ret;
+ 	void __iomem *base;
+-	const __be32 *addr;
+-	dma_addr_t dma_base;
++	struct resource *res;
+ 
+ 	dev = devm_kzalloc(&pdev->dev, sizeof(*dev),
+ 			   GFP_KERNEL);
+@@ -846,7 +844,7 @@ static int bcm2835_i2s_probe(struct plat
+ 				     "could not get clk\n");
+ 
+ 	/* Request ioarea */
+-	base = devm_platform_ioremap_resource(pdev, 0);
++	base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
+ 	if (IS_ERR(base))
+ 		return PTR_ERR(base);
+ 
+@@ -855,19 +853,11 @@ static int bcm2835_i2s_probe(struct plat
+ 	if (IS_ERR(dev->i2s_regmap))
+ 		return PTR_ERR(dev->i2s_regmap);
+ 
+-	/* Set the DMA address - we have to parse DT ourselves */
+-	addr = of_get_address(pdev->dev.of_node, 0, NULL, NULL);
+-	if (!addr) {
+-		dev_err(&pdev->dev, "could not get DMA-register address\n");
+-		return -EINVAL;
+-	}
+-	dma_base = be32_to_cpup(addr);
+-
+ 	dev->dma_data[SNDRV_PCM_STREAM_PLAYBACK].addr =
+-		dma_base + BCM2835_I2S_FIFO_A_REG;
++		res->start + BCM2835_I2S_FIFO_A_REG;
+ 
+ 	dev->dma_data[SNDRV_PCM_STREAM_CAPTURE].addr =
+-		dma_base + BCM2835_I2S_FIFO_A_REG;
++		res->start + BCM2835_I2S_FIFO_A_REG;
+ 
+ 	/* Set the bus width */
+ 	dev->dma_data[SNDRV_PCM_STREAM_PLAYBACK].addr_width =
diff --git a/target/linux/bcm27xx/patches-6.1/950-0712-drm-vc4-Use-phys-addresses-for-slave-DMA-config.patch b/target/linux/bcm27xx/patches-6.1/950-0712-drm-vc4-Use-phys-addresses-for-slave-DMA-config.patch
new file mode 100644
index 00000000000000..2c83a8083b9311
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0712-drm-vc4-Use-phys-addresses-for-slave-DMA-config.patch
@@ -0,0 +1,48 @@
+From ae6d666715a795257698f97caf1891d90a6a50e4 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 11 May 2023 16:08:15 +0100
+Subject: [PATCH] drm/vc4: Use phys addresses for slave DMA config
+
+Slave addresses for DMA are meant to be supplied as physical addresses
+(contrary to what struct snd_dmaengine_dai_dma_data does).
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 13 ++++---------
+ 1 file changed, 4 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -2719,7 +2719,7 @@ static int vc4_hdmi_audio_init(struct vc
+ 	struct snd_soc_card *card = &vc4_hdmi->audio.card;
+ 	struct device *dev = &vc4_hdmi->pdev->dev;
+ 	struct platform_device *codec_pdev;
+-	const __be32 *addr;
++	struct resource *iomem;
+ 	int index, len;
+ 	int ret;
+ 
+@@ -2755,20 +2755,15 @@ static int vc4_hdmi_audio_init(struct vc
+ 	}
+ 
+ 	/*
+-	 * Get the physical address of VC4_HD_MAI_DATA. We need to retrieve
+-	 * the bus address specified in the DT, because the physical address
+-	 * (the one returned by platform_get_resource()) is not appropriate
+-	 * for DMA transfers.
+-	 * This VC/MMU should probably be exposed to avoid this kind of hacks.
++	 * Get the physical address of VC4_HD_MAI_DATA.
+ 	 */
+ 	index = of_property_match_string(dev->of_node, "reg-names", "hd");
+ 	/* Before BCM2711, we don't have a named register range */
+ 	if (index < 0)
+ 		index = 1;
++	iomem = platform_get_resource(vc4_hdmi->pdev, IORESOURCE_MEM, index);
+ 
+-	addr = of_get_address(dev->of_node, index, NULL, NULL);
+-
+-	vc4_hdmi->audio.dma_data.addr = be32_to_cpup(addr) + mai_data->offset;
++	vc4_hdmi->audio.dma_data.addr = iomem->start + mai_data->offset;
+ 	vc4_hdmi->audio.dma_data.addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ 	vc4_hdmi->audio.dma_data.maxburst = 2;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0713-bcm2835-smi-Use-phys-addresses-for-slave-DMA-config.patch b/target/linux/bcm27xx/patches-6.1/950-0713-bcm2835-smi-Use-phys-addresses-for-slave-DMA-config.patch
new file mode 100644
index 00000000000000..382821a1933758
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0713-bcm2835-smi-Use-phys-addresses-for-slave-DMA-config.patch
@@ -0,0 +1,51 @@
+From a226d75cbc55d5cf6b433565af2de1dbf89c9232 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 11 May 2023 16:10:52 +0100
+Subject: [PATCH] bcm2835-smi: Use phys addresses for slave DMA config
+
+Contrary to what struct snd_dmaengine_dai_dma_data suggests, the
+configuration of addresses of DMA slave interfaces should be done in
+CPU physical addresses.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/misc/bcm2835_smi.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+--- a/drivers/misc/bcm2835_smi.c
++++ b/drivers/misc/bcm2835_smi.c
+@@ -64,7 +64,7 @@ struct bcm2835_smi_instance {
+ 	struct device *dev;
+ 	struct smi_settings settings;
+ 	__iomem void *smi_regs_ptr;
+-	dma_addr_t smi_regs_busaddr;
++	phys_addr_t smi_regs_busaddr;
+ 
+ 	struct dma_chan *dma_chan;
+ 	struct dma_slave_config dma_config;
+@@ -858,7 +858,6 @@ static int bcm2835_smi_probe(struct plat
+ 	struct device_node *node = dev->of_node;
+ 	struct resource *ioresource;
+ 	struct bcm2835_smi_instance *inst;
+-	const __be32 *addr;
+ 
+ 	/* We require device tree support */
+ 	if (!node)
+@@ -872,14 +871,13 @@ static int bcm2835_smi_probe(struct plat
+ 	inst->dev = dev;
+ 	spin_lock_init(&inst->transaction_lock);
+ 
+-	ioresource = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	inst->smi_regs_ptr = devm_ioremap_resource(dev, ioresource);
++	inst->smi_regs_ptr = devm_platform_get_and_ioremap_resource(pdev, 0,
++								    &ioresource);
+ 	if (IS_ERR(inst->smi_regs_ptr)) {
+ 		err = PTR_ERR(inst->smi_regs_ptr);
+ 		goto err;
+ 	}
+-	addr = of_get_address(node, 0, NULL, NULL);
+-	inst->smi_regs_busaddr = be32_to_cpu(*addr);
++	inst->smi_regs_busaddr = ioresource->start;
+ 
+ 	err = bcm2835_smi_dma_setup(inst);
+ 	if (err)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0714-bcm2835-mmc-Use-phys-addresses-for-slave-DMA-config.patch b/target/linux/bcm27xx/patches-6.1/950-0714-bcm2835-mmc-Use-phys-addresses-for-slave-DMA-config.patch
new file mode 100644
index 00000000000000..f52e9438f07658
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0714-bcm2835-mmc-Use-phys-addresses-for-slave-DMA-config.patch
@@ -0,0 +1,51 @@
+From b4c2f9c2f928b8481d85569ebd4efa419d29cfdb Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 11 May 2023 16:19:57 +0100
+Subject: [PATCH] bcm2835-mmc: Use phys addresses for slave DMA config
+
+Contrary to what struct snd_dmaengine_dai_dma_data suggests, the
+configuration of addresses of DMA slave interfaces should be done in
+CPU physical addresses.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/mmc/host/bcm2835-mmc.c | 16 +---------------
+ 1 file changed, 1 insertion(+), 15 deletions(-)
+
+--- a/drivers/mmc/host/bcm2835-mmc.c
++++ b/drivers/mmc/host/bcm2835-mmc.c
+@@ -1404,7 +1404,6 @@ static int bcm2835_mmc_probe(struct plat
+ 	struct resource *iomem;
+ 	struct bcm2835_host *host;
+ 	struct mmc_host *mmc;
+-	const __be32 *addr;
+ 	int ret;
+ 
+ 	mmc = mmc_alloc_host(sizeof(*host), dev);
+@@ -1417,25 +1416,12 @@ static int bcm2835_mmc_probe(struct plat
+ 	host->timeout = msecs_to_jiffies(1000);
+ 	spin_lock_init(&host->lock);
+ 
+-	iomem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	host->ioaddr = devm_ioremap_resource(dev, iomem);
++	host->ioaddr = devm_platform_get_and_ioremap_resource(pdev, 0, &iomem);
+ 	if (IS_ERR(host->ioaddr)) {
+ 		ret = PTR_ERR(host->ioaddr);
+ 		goto err;
+ 	}
+ 
+-	addr = of_get_address(node, 0, NULL, NULL);
+-	if (!addr) {
+-		dev_err(dev, "could not get DMA-register address\n");
+-		ret = -ENODEV;
+-		goto err;
+-	}
+-	host->bus_addr = be32_to_cpup(addr);
+-	pr_debug(" - ioaddr %lx, iomem->start %lx, bus_addr %lx\n",
+-		 (unsigned long)host->ioaddr,
+-		 (unsigned long)iomem->start,
+-		 (unsigned long)host->bus_addr);
+-
+ #ifndef FORCE_PIO
+ 	if (node) {
+ 		host->dma_chan_rxtx = dma_request_slave_channel(dev, "rx-tx");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0715-ARM-dts-bcm2709-10-Retain-the-system-timer-node.patch b/target/linux/bcm27xx/patches-6.1/950-0715-ARM-dts-bcm2709-10-Retain-the-system-timer-node.patch
new file mode 100644
index 00000000000000..5d88fae1c4b176
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0715-ARM-dts-bcm2709-10-Retain-the-system-timer-node.patch
@@ -0,0 +1,59 @@
+From 39b579459fd42703731f833057d49ef120400c5f Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 11 May 2023 15:44:18 +0100
+Subject: [PATCH] ARM: dts: bcm2709/10: Retain the system-timer node
+
+Although the system timer is largely ignored in favour of the ARM local
+timers, retain the DT node so that the bcm2835-sdhost logging can find
+the timer in a cleaner fashion.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/bcm2709.dtsi | 6 ++++--
+ arch/arm/boot/dts/bcm2710.dtsi | 6 ++++--
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm2709.dtsi
++++ b/arch/arm/boot/dts/bcm2709.dtsi
+@@ -10,8 +10,6 @@
+ 
+ 		dma-ranges = <0xc0000000 0x00000000 0x3f000000>,
+ 			     <0x7e000000 0x3f000000 0x01000000>;
+-
+-		/delete-node/ timer@7e003000;
+ 	};
+ 
+ 	__overrides__ {
+@@ -22,6 +20,10 @@
+ 	};
+ };
+ 
++&system_timer {
++	status = "disabled";
++};
++
+ &vc4 {
+ 	status = "disabled";
+ };
+--- a/arch/arm/boot/dts/bcm2710.dtsi
++++ b/arch/arm/boot/dts/bcm2710.dtsi
+@@ -13,8 +13,6 @@
+ 	soc {
+ 		dma-ranges = <0xc0000000 0x00000000 0x3f000000>,
+ 			     <0x7e000000 0x3f000000 0x01000000>;
+-
+-		/delete-node/ timer@7e003000;
+ 	};
+ 
+ 	__overrides__ {
+@@ -25,6 +23,10 @@
+ 	};
+ };
+ 
++&system_timer {
++	status = "disabled";
++};
++
+ &vc4 {
+ 	status = "disabled";
+ };
diff --git a/target/linux/bcm27xx/patches-6.1/950-0716-bcm2835-sdhost-Use-DT-to-configure-logging.patch b/target/linux/bcm27xx/patches-6.1/950-0716-bcm2835-sdhost-Use-DT-to-configure-logging.patch
new file mode 100644
index 00000000000000..6227a9031a6a0e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0716-bcm2835-sdhost-Use-DT-to-configure-logging.patch
@@ -0,0 +1,45 @@
+From ff2217b2d7f964250dbb9feae94caec8adf3d124 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 11 May 2023 16:23:13 +0100
+Subject: [PATCH] bcm2835-sdhost: Use DT to configure logging
+
+Retrieve the system timer base address directly from DT.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/mmc/host/bcm2835-sdhost.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/mmc/host/bcm2835-sdhost.c
++++ b/drivers/mmc/host/bcm2835-sdhost.c
+@@ -242,15 +242,19 @@ static void __iomem *timer_base;
+ #define LOG_ENTRIES (256*1)
+ #define LOG_SIZE (sizeof(LOG_ENTRY_T)*LOG_ENTRIES)
+ 
+-static void log_init(struct device *dev, u32 bus_to_phys)
++static void log_init(struct device *dev)
+ {
++	struct device_node *np;
++
+ 	spin_lock_init(&log_lock);
+ 	sdhost_log_buf = dma_alloc_coherent(dev, LOG_SIZE, &sdhost_log_addr,
+ 					     GFP_KERNEL);
+ 	if (sdhost_log_buf) {
++		np = of_find_compatible_node(NULL, NULL,
++					     "brcm,bcm2835-system-timer");
+ 		pr_info("sdhost: log_buf @ %p (%llx)\n",
+ 			sdhost_log_buf, (u64)sdhost_log_addr);
+-		timer_base = ioremap(bus_to_phys + 0x7e003000, SZ_4K);
++		timer_base = of_iomap(np, 0);
+ 		if (!timer_base)
+ 			pr_err("sdhost: failed to remap timer\n");
+ 	}
+@@ -2123,7 +2127,7 @@ static int bcm2835_sdhost_probe(struct p
+ 		 (unsigned long)host->max_clk,
+ 		 (int)host->irq);
+ 
+-	log_init(dev, iomem->start - host->bus_addr);
++	log_init(dev);
+ 
+ 	if (node)
+ 		mmc_of_parse(mmc);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0717-bcm2835-sdhost-Use-phys-addresses-for-slave-DMA-conf.patch b/target/linux/bcm27xx/patches-6.1/950-0717-bcm2835-sdhost-Use-phys-addresses-for-slave-DMA-conf.patch
new file mode 100644
index 00000000000000..4fee7efa226087
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0717-bcm2835-sdhost-Use-phys-addresses-for-slave-DMA-conf.patch
@@ -0,0 +1,54 @@
+From 975bb6f620418ffcfa101561583d6cadc8025a1d Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 11 May 2023 16:24:26 +0100
+Subject: [PATCH] bcm2835-sdhost: Use phys addresses for slave DMA
+ config
+
+Contrary to what struct snd_dmaengine_dai_dma_data suggests, the
+configuration of addresses of DMA slave interfaces should be done in
+CPU physical addresses.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/mmc/host/bcm2835-sdhost.c | 17 ++---------------
+ 1 file changed, 2 insertions(+), 15 deletions(-)
+
+--- a/drivers/mmc/host/bcm2835-sdhost.c
++++ b/drivers/mmc/host/bcm2835-sdhost.c
+@@ -2015,9 +2015,7 @@ static int bcm2835_sdhost_probe(struct p
+ 	struct resource *iomem;
+ 	struct bcm2835_host *host;
+ 	struct mmc_host *mmc;
+-	const __be32 *addr;
+ 	u32 msg[3];
+-	int na;
+ 	int ret;
+ 
+ 	pr_debug("bcm2835_sdhost_probe\n");
+@@ -2034,24 +2032,13 @@ static int bcm2835_sdhost_probe(struct p
+ 	host->allow_dma = 1;
+ 	spin_lock_init(&host->lock);
+ 
+-	iomem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	host->ioaddr = devm_ioremap_resource(dev, iomem);
++	host->ioaddr = devm_platform_get_and_ioremap_resource(pdev, 0, &iomem);
+ 	if (IS_ERR(host->ioaddr)) {
+ 		ret = PTR_ERR(host->ioaddr);
+ 		goto err;
+ 	}
+ 
+-	na = of_n_addr_cells(node);
+-	addr = of_get_address(node, 0, NULL, NULL);
+-	if (!addr) {
+-		dev_err(dev, "could not get DMA-register address\n");
+-		return -ENODEV;
+-	}
+-	host->bus_addr = (phys_addr_t)of_read_number(addr, na);
+-	pr_debug(" - ioaddr %lx, iomem->start %lx, bus_addr %lx\n",
+-		 (unsigned long)host->ioaddr,
+-		 (unsigned long)iomem->start,
+-		 (unsigned long)host->bus_addr);
++	host->bus_addr = iomem->start;
+ 
+ 	if (node) {
+ 		/* Read any custom properties */
diff --git a/target/linux/bcm27xx/patches-6.1/950-0718-mmc-bcm2835-Use-phys-addresses-for-slave-DMA-config.patch b/target/linux/bcm27xx/patches-6.1/950-0718-mmc-bcm2835-Use-phys-addresses-for-slave-DMA-config.patch
new file mode 100644
index 00000000000000..7dae4532d9fc3d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0718-mmc-bcm2835-Use-phys-addresses-for-slave-DMA-config.patch
@@ -0,0 +1,60 @@
+From 69939eb84658f25f2300a34c3f7719ac05c86dec Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 11 May 2023 16:25:46 +0100
+Subject: [PATCH] mmc: bcm2835: Use phys addresses for slave DMA config
+
+Contrary to what struct snd_dmaengine_dai_dma_data suggests, the
+configuration of addresses of DMA slave interfaces should be done in
+CPU physical addresses.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/mmc/host/bcm2835.c | 17 +++--------------
+ 1 file changed, 3 insertions(+), 14 deletions(-)
+
+--- a/drivers/mmc/host/bcm2835.c
++++ b/drivers/mmc/host/bcm2835.c
+@@ -38,7 +38,6 @@
+ #include <linux/io.h>
+ #include <linux/iopoll.h>
+ #include <linux/module.h>
+-#include <linux/of_address.h>
+ #include <linux/of_irq.h>
+ #include <linux/platform_device.h>
+ #include <linux/scatterlist.h>
+@@ -1355,8 +1354,8 @@ static int bcm2835_probe(struct platform
+ 	struct device *dev = &pdev->dev;
+ 	struct clk *clk;
+ 	struct bcm2835_host *host;
++	struct resource *iomem;
+ 	struct mmc_host *mmc;
+-	const __be32 *regaddr_p;
+ 	int ret;
+ 
+ 	dev_dbg(dev, "%s\n", __func__);
+@@ -1369,23 +1368,13 @@ static int bcm2835_probe(struct platform
+ 	host->pdev = pdev;
+ 	spin_lock_init(&host->lock);
+ 
+-	host->ioaddr = devm_platform_ioremap_resource(pdev, 0);
++	host->ioaddr = devm_platform_get_and_ioremap_resource(pdev, 0, &iomem);
+ 	if (IS_ERR(host->ioaddr)) {
+ 		ret = PTR_ERR(host->ioaddr);
+ 		goto err;
+ 	}
+ 
+-	/* Parse OF address directly to get the physical address for
+-	 * DMA to our registers.
+-	 */
+-	regaddr_p = of_get_address(pdev->dev.of_node, 0, NULL, NULL);
+-	if (!regaddr_p) {
+-		dev_err(dev, "Can't get phys address\n");
+-		ret = -EINVAL;
+-		goto err;
+-	}
+-
+-	host->phys_addr = be32_to_cpup(regaddr_p);
++	host->phys_addr = iomem->start;
+ 
+ 	host->dma_chan = NULL;
+ 	host->dma_desc = NULL;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0719-spi-bcm2835-Use-phys-addresses-for-slave-DMA-config.patch b/target/linux/bcm27xx/patches-6.1/950-0719-spi-bcm2835-Use-phys-addresses-for-slave-DMA-config.patch
new file mode 100644
index 00000000000000..8b734c23bd7f4e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0719-spi-bcm2835-Use-phys-addresses-for-slave-DMA-config.patch
@@ -0,0 +1,86 @@
+From b71cfec520b128ce190e70b1c32df8bfc2492d9a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 11 May 2023 16:27:06 +0100
+Subject: [PATCH] spi: bcm2835: Use phys addresses for slave DMA config
+
+Contrary to what struct snd_dmaengine_dai_dma_data suggests, the
+configuration of addresses of DMA slave interfaces should be done in
+CPU physical addresses.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/spi/spi-bcm2835.c | 22 +++++++---------------
+ 1 file changed, 7 insertions(+), 15 deletions(-)
+
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -116,6 +116,7 @@ MODULE_PARM_DESC(polling_limit_us,
+  */
+ struct bcm2835_spi {
+ 	void __iomem *regs;
++	phys_addr_t phys_addr;
+ 	struct clk *clk;
+ 	unsigned long clk_hz;
+ 	int irq;
+@@ -887,19 +888,8 @@ static int bcm2835_dma_init(struct spi_c
+ 			    struct bcm2835_spi *bs)
+ {
+ 	struct dma_slave_config slave_config;
+-	const __be32 *addr;
+-	dma_addr_t dma_reg_base;
+ 	int ret;
+ 
+-	/* base address in dma-space */
+-	addr = of_get_address(ctlr->dev.of_node, 0, NULL, NULL);
+-	if (!addr) {
+-		dev_err(dev, "could not get DMA-register address - not using dma mode\n");
+-		/* Fall back to interrupt mode */
+-		return 0;
+-	}
+-	dma_reg_base = be32_to_cpup(addr);
+-
+ 	/* get tx/rx dma */
+ 	ctlr->dma_tx = dma_request_chan(dev, "tx");
+ 	if (IS_ERR(ctlr->dma_tx)) {
+@@ -921,7 +911,7 @@ static int bcm2835_dma_init(struct spi_c
+ 	 * or, in case of an RX-only transfer, cyclically copies from the zero
+ 	 * page to the FIFO using a preallocated, reusable descriptor.
+ 	 */
+-	slave_config.dst_addr = (u32)(dma_reg_base + BCM2835_SPI_FIFO);
++	slave_config.dst_addr = bs->phys_addr + BCM2835_SPI_FIFO;
+ 	slave_config.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ 
+ 	ret = dmaengine_slave_config(ctlr->dma_tx, &slave_config);
+@@ -960,9 +950,9 @@ static int bcm2835_dma_init(struct spi_c
+ 	 * RX FIFO or, in case of a TX-only transfer, cyclically writes a
+ 	 * precalculated value to the CS register to clear the RX FIFO.
+ 	 */
+-	slave_config.src_addr = (u32)(dma_reg_base + BCM2835_SPI_FIFO);
++	slave_config.src_addr = bs->phys_addr + BCM2835_SPI_FIFO;
+ 	slave_config.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+-	slave_config.dst_addr = (u32)(dma_reg_base + BCM2835_SPI_CS);
++	slave_config.dst_addr = bs->phys_addr + BCM2835_SPI_CS;
+ 	slave_config.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ 
+ 	ret = dmaengine_slave_config(ctlr->dma_rx, &slave_config);
+@@ -1335,6 +1325,7 @@ static int bcm2835_spi_probe(struct plat
+ {
+ 	struct spi_controller *ctlr;
+ 	struct bcm2835_spi *bs;
++	struct resource *iomem;
+ 	int err;
+ 
+ 	ctlr = devm_spi_alloc_master(&pdev->dev, sizeof(*bs));
+@@ -1357,10 +1348,11 @@ static int bcm2835_spi_probe(struct plat
+ 	bs = spi_controller_get_devdata(ctlr);
+ 	bs->ctlr = ctlr;
+ 
+-	bs->regs = devm_platform_ioremap_resource(pdev, 0);
++	bs->regs = devm_platform_get_and_ioremap_resource(pdev, 0, &iomem);
+ 	if (IS_ERR(bs->regs))
+ 		return PTR_ERR(bs->regs);
+ 
++	bs->phys_addr = iomem->start;
+ 	bs->clk = devm_clk_get(&pdev->dev, NULL);
+ 	if (IS_ERR(bs->clk))
+ 		return dev_err_probe(&pdev->dev, PTR_ERR(bs->clk),
diff --git a/target/linux/bcm27xx/patches-6.1/950-0720-ARM-dts-bcm2711-rpi-Add-i2s_dma4.patch b/target/linux/bcm27xx/patches-6.1/950-0720-ARM-dts-bcm2711-rpi-Add-i2s_dma4.patch
new file mode 100644
index 00000000000000..a025145ef7590f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0720-ARM-dts-bcm2711-rpi-Add-i2s_dma4.patch
@@ -0,0 +1,96 @@
+From 358b2d553762030d3e7e66eb4c0bb7140d348c43 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 11 May 2023 11:50:57 +0100
+Subject: [PATCH] ARM: dts: bcm2711-rpi: Add i2s_dma4
+
+Add an i2s_dma4 parameter to make the I2S interface use 40-bit DMA
+channels, taking the opportunity to remove some duplication.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/bcm2711-rpi-4-b.dts  | 4 ----
+ arch/arm/boot/dts/bcm2711-rpi-400.dts  | 4 ----
+ arch/arm/boot/dts/bcm2711-rpi-cm4.dts  | 4 ----
+ arch/arm/boot/dts/bcm2711-rpi-cm4s.dts | 4 ----
+ arch/arm/boot/dts/bcm2711-rpi-ds.dtsi  | 6 ++++++
+ arch/arm/boot/dts/overlays/README      | 4 ++++
+ 6 files changed, 10 insertions(+), 16 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
+@@ -414,9 +414,5 @@ cam0_reg: &cam_dummy_reg {
+ 
+ 		eth_led0 = <&phy1>,"led-modes:0";
+ 		eth_led1 = <&phy1>,"led-modes:4";
+-
+-		sd_poll_once = <&emmc2>, "non-removable?";
+-		spi_dma4 = <&spi0>, "dmas:0=", <&dma40>,
+-			   <&spi0>, "dmas:8=", <&dma40>;
+ 	};
+ };
+--- a/arch/arm/boot/dts/bcm2711-rpi-400.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-400.dts
+@@ -425,9 +425,5 @@ cam0_reg: &cam_dummy_reg {
+ 
+ 		eth_led0 = <&phy1>,"led-modes:0";
+ 		eth_led1 = <&phy1>,"led-modes:4";
+-
+-		sd_poll_once = <&emmc2>, "non-removable?";
+-		spi_dma4 = <&spi0>, "dmas:0=", <&dma40>,
+-			   <&spi0>, "dmas:8=", <&dma40>;
+ 	};
+ };
+--- a/arch/arm/boot/dts/bcm2711-rpi-cm4.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-cm4.dts
+@@ -437,10 +437,6 @@ cam0_reg: &cam1_reg {
+ 			<&ant2>, "output-high?=off",
+ 			<&ant2>, "output-low?=on";
+ 
+-		sd_poll_once = <&emmc2>, "non-removable?";
+-		spi_dma4 = <&spi0>, "dmas:0=", <&dma40>,
+-			   <&spi0>, "dmas:8=", <&dma40>;
+-
+ 		cam0_reg = <&cam0_reg>,"status";
+ 		cam0_reg_gpio = <&cam0_reg>,"gpio:4",
+ 				  <&cam0_reg>,"gpio:0=", <&gpio>;
+--- a/arch/arm/boot/dts/bcm2711-rpi-cm4s.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-cm4s.dts
+@@ -290,10 +290,6 @@ cam0_reg: &cam0_regulator {
+ 		act_led_activelow = <&act_led>,"gpios:8";
+ 		act_led_trigger = <&act_led>,"linux,default-trigger";
+ 
+-		sd_poll_once = <&emmc2>, "non-removable?";
+-		spi_dma4 = <&spi0>, "dmas:0=", <&dma40>,
+-			   <&spi0>, "dmas:8=", <&dma40>;
+-
+ 		cam0_reg = <&cam0_reg>,"status";
+ 		cam0_reg_gpio = <&cam0_reg>,"gpio:4";
+ 		cam1_reg = <&cam1_reg>,"status";
+--- a/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
++++ b/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
+@@ -12,6 +12,12 @@
+ 		       <&hdmi1>,"status";
+ 		pcie = <&pcie0>,"status";
+ 		sd = <&emmc2>,"status";
++
++		sd_poll_once = <&emmc2>, "non-removable?";
++		spi_dma4 = <&spi0>, "dmas:0=", <&dma40>,
++			   <&spi0>, "dmas:8=", <&dma40>;
++		i2s_dma4 = <&i2s>, "dmas:0=", <&dma40>,
++			   <&i2s>, "dmas:8=", <&dma40>;
+ 	};
+ 
+ 	scb: scb {
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -226,6 +226,10 @@ Params:
+         i2s                     Set to "on" to enable the i2s interface
+                                 (default "off")
+ 
++        i2s_dma4                Use to enable 40-bit DMA on the i2s interface
++                                (the assigned value doesn't matter)
++                                (2711 only)
++
+         krnbt                   Set to "off" to disable autoprobing of Bluetooth
+                                 driver without need of hciattach/btattach
+                                 (default "on")
diff --git a/target/linux/bcm27xx/patches-6.1/950-0721-fixup-bcm2835-mmc-Really-use-phys-addresses.patch b/target/linux/bcm27xx/patches-6.1/950-0721-fixup-bcm2835-mmc-Really-use-phys-addresses.patch
new file mode 100644
index 00000000000000..9d5491ec4e8052
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0721-fixup-bcm2835-mmc-Really-use-phys-addresses.patch
@@ -0,0 +1,23 @@
+From 0f38c137279dd32e865956aa95aa3787fef11b1a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 15 May 2023 09:15:56 +0100
+Subject: [PATCH] fixup! bcm2835-mmc: Really use phys addresses
+
+Commit [1] is missing a vital line - add it.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/mmc/host/bcm2835-mmc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/mmc/host/bcm2835-mmc.c
++++ b/drivers/mmc/host/bcm2835-mmc.c
+@@ -1422,6 +1422,8 @@ static int bcm2835_mmc_probe(struct plat
+ 		goto err;
+ 	}
+ 
++	host->bus_addr = iomem->start;
++
+ #ifndef FORCE_PIO
+ 	if (node) {
+ 		host->dma_chan_rxtx = dma_request_slave_channel(dev, "rx-tx");
diff --git a/target/linux/bcm27xx/patches-6.1/950-0722-dmaengine-bcm2835-Fix-position-reporting-for-40-bits.patch b/target/linux/bcm27xx/patches-6.1/950-0722-dmaengine-bcm2835-Fix-position-reporting-for-40-bits.patch
new file mode 100644
index 00000000000000..35d7342ef60350
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0722-dmaengine-bcm2835-Fix-position-reporting-for-40-bits.patch
@@ -0,0 +1,55 @@
+From 95d4bdad3bf5340b0bf1e53e28fcd487d9253315 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 27 Mar 2023 17:10:07 +0200
+Subject: [PATCH] dmaengine: bcm2835: Fix position reporting for 40
+ bits channels
+
+For 40 bits channels, the position is reported by reading the upper byte
+in the SRCI/DESTI registers. However the driver adds that upper byte
+with an 8-bits left shift, while it should be 32.
+
+Fixes: 9a52a9918306 ("bcm2835-dma: Add proper 40-bit DMA support")
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/dma/bcm2835-dma.c | 27 ++++++++++++++++-----------
+ 1 file changed, 16 insertions(+), 11 deletions(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -819,20 +819,25 @@ static enum dma_status bcm2835_dma_tx_st
+ 		struct bcm2835_desc *d = c->desc;
+ 		dma_addr_t pos;
+ 
+-		if (d->dir == DMA_MEM_TO_DEV && c->is_40bit_channel)
+-			pos = readl(c->chan_base + BCM2711_DMA40_SRC) +
+-				((readl(c->chan_base + BCM2711_DMA40_SRCI) &
+-				  0xff) << 8);
+-		else if (d->dir == DMA_MEM_TO_DEV && !c->is_40bit_channel)
++		if (d->dir == DMA_MEM_TO_DEV && c->is_40bit_channel) {
++			u64 lo_bits, hi_bits;
++
++			lo_bits = readl(c->chan_base + BCM2711_DMA40_SRC);
++			hi_bits = readl(c->chan_base + BCM2711_DMA40_SRCI) & 0xff;
++			pos = (hi_bits << 32) | lo_bits;
++		} else if (d->dir == DMA_MEM_TO_DEV && !c->is_40bit_channel) {
+ 			pos = readl(c->chan_base + BCM2835_DMA_SOURCE_AD);
+-		else if (d->dir == DMA_DEV_TO_MEM && c->is_40bit_channel)
+-			pos = readl(c->chan_base + BCM2711_DMA40_DEST) +
+-				((readl(c->chan_base + BCM2711_DMA40_DESTI) &
+-				  0xff) << 8);
+-		else if (d->dir == DMA_DEV_TO_MEM && !c->is_40bit_channel)
++		} else if (d->dir == DMA_DEV_TO_MEM && c->is_40bit_channel) {
++			u64 lo_bits, hi_bits;
++
++			lo_bits = readl(c->chan_base + BCM2711_DMA40_DEST);
++			hi_bits = readl(c->chan_base + BCM2711_DMA40_DESTI) & 0xff;
++			pos = (hi_bits << 32) | lo_bits;
++		} else if (d->dir == DMA_DEV_TO_MEM && !c->is_40bit_channel) {
+ 			pos = readl(c->chan_base + BCM2835_DMA_DEST_AD);
+-		else
++		} else {
+ 			pos = 0;
++		}
+ 
+ 		txstate->residue = bcm2835_dma_desc_size_pos(d, pos);
+ 	} else {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0723-dmaengine-bcm2835-Use-to_bcm2711_cbaddr-where-releva.patch b/target/linux/bcm27xx/patches-6.1/950-0723-dmaengine-bcm2835-Use-to_bcm2711_cbaddr-where-releva.patch
new file mode 100644
index 00000000000000..d069778b2dac20
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0723-dmaengine-bcm2835-Use-to_bcm2711_cbaddr-where-releva.patch
@@ -0,0 +1,25 @@
+From 4176c964cd42c43d90fc1b60ff8266613462ebe8 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Thu, 13 Apr 2023 16:44:21 +0200
+Subject: [PATCH] dmaengine: bcm2835: Use to_bcm2711_cbaddr where
+ relevant
+
+bcm2711_dma40_memcpy has some code strictly equivalent to the
+to_bcm2711_cbaddr() function. Let's use it instead.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/dma/bcm2835-dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -1149,7 +1149,7 @@ void bcm2711_dma40_memcpy(dma_addr_t dst
+ 	scb->len = size;
+ 	scb->next_cb = 0;
+ 
+-	writel((u32)(memcpy_scb_dma >> 5), memcpy_chan + BCM2711_DMA40_CB);
++	writel(to_bcm2711_cbaddr(memcpy_scb_dma), memcpy_chan + BCM2711_DMA40_CB);
+ 	writel(BCM2711_DMA40_MEMCPY_FLAGS + BCM2711_DMA40_ACTIVE,
+ 	       memcpy_chan + BCM2711_DMA40_CS);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0724-dmaengine-bcm2835-Fix-descriptors-usage-for-40-bits-.patch b/target/linux/bcm27xx/patches-6.1/950-0724-dmaengine-bcm2835-Fix-descriptors-usage-for-40-bits-.patch
new file mode 100644
index 00000000000000..1532b783ce6423
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0724-dmaengine-bcm2835-Fix-descriptors-usage-for-40-bits-.patch
@@ -0,0 +1,115 @@
+From 793023dc148830c18c437b58d88a118a72091038 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Thu, 13 Apr 2023 16:47:10 +0200
+Subject: [PATCH] dmaengine: bcm2835: Fix descriptors usage for 40-bits
+ channels
+
+The bcm2835_dma_create_cb_chain() function is in charge of building up
+the descriptors chain for a given transfer.
+
+It was initially supporting only the BCM2835-style DMA controller, and
+was later expanded to support controllers with 40-bits channels that use
+a different descriptor layout.
+
+However, some part of the function only use the old style descriptor,
+even when building a chain of new-style descriptors, resulting in weird
+bugs.
+
+Fixes: 9a52a9918306 ("bcm2835-dma: Add proper 40-bit DMA support")
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/dma/bcm2835-dma.c | 69 ++++++++++++++++++++++++++++-----------
+ 1 file changed, 50 insertions(+), 19 deletions(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -543,7 +543,10 @@ static struct bcm2835_desc *bcm2835_dma_
+ 				cyclic ? finalextrainfo : 0);
+ 
+ 			/* calculate new remaining length */
+-			len -= control_block->length;
++			if (c->is_40bit_channel)
++				len -= ((struct bcm2711_dma40_scb *)control_block)->len;
++			else
++				len -= control_block->length;
+ 		}
+ 
+ 		/* link this the last controlblock */
+@@ -555,10 +558,19 @@ static struct bcm2835_desc *bcm2835_dma_
+ 			d->cb_list[frame - 1].cb->next = cb_entry->paddr;
+ 
+ 		/* update src and dst and length */
+-		if (src && (info & BCM2835_DMA_S_INC))
+-			src += control_block->length;
+-		if (dst && (info & BCM2835_DMA_D_INC))
+-			dst += control_block->length;
++		if (src && (info & BCM2835_DMA_S_INC)) {
++			if (c->is_40bit_channel)
++				src += ((struct bcm2711_dma40_scb *)control_block)->len;
++			else
++				src += control_block->length;
++		}
++
++		if (dst && (info & BCM2835_DMA_D_INC)) {
++			if (c->is_40bit_channel)
++				dst += ((struct bcm2711_dma40_scb *)control_block)->len;
++			else
++				dst += control_block->length;
++		}
+ 
+ 		/* Length of total transfer */
+ 		if (c->is_40bit_channel)
+@@ -779,20 +791,39 @@ static size_t bcm2835_dma_desc_size_pos(
+ 	unsigned int i;
+ 	size_t size;
+ 
+-	for (size = i = 0; i < d->frames; i++) {
+-		struct bcm2835_dma_cb *control_block = d->cb_list[i].cb;
+-		size_t this_size = control_block->length;
+-		dma_addr_t dma;
+-
+-		if (d->dir == DMA_DEV_TO_MEM)
+-			dma = control_block->dst;
+-		else
+-			dma = control_block->src;
+-
+-		if (size)
+-			size += this_size;
+-		else if (addr >= dma && addr < dma + this_size)
+-			size += dma + this_size - addr;
++	if (d->c->is_40bit_channel) {
++		for (size = i = 0; i < d->frames; i++) {
++			struct bcm2711_dma40_scb *control_block =
++				(struct bcm2711_dma40_scb *)d->cb_list[i].cb;
++			size_t this_size = control_block->len;
++			dma_addr_t dma;
++
++			if (d->dir == DMA_DEV_TO_MEM)
++				dma = control_block->dst;
++			else
++				dma = control_block->src;
++
++			if (size)
++				size += this_size;
++			else if (addr >= dma && addr < dma + this_size)
++				size += dma + this_size - addr;
++		}
++	} else {
++		for (size = i = 0; i < d->frames; i++) {
++			struct bcm2835_dma_cb *control_block = d->cb_list[i].cb;
++			size_t this_size = control_block->length;
++			dma_addr_t dma;
++
++			if (d->dir == DMA_DEV_TO_MEM)
++				dma = control_block->dst;
++			else
++				dma = control_block->src;
++
++			if (size)
++				size += this_size;
++			else if (addr >= dma && addr < dma + this_size)
++				size += dma + this_size - addr;
++		}
+ 	}
+ 
+ 	return size;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0725-bcm2835-dma-Fix-WAIT_RESP-on-memcpy.patch b/target/linux/bcm27xx/patches-6.1/950-0725-bcm2835-dma-Fix-WAIT_RESP-on-memcpy.patch
new file mode 100644
index 00000000000000..34f9fb984389c7
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0725-bcm2835-dma-Fix-WAIT_RESP-on-memcpy.patch
@@ -0,0 +1,25 @@
+From 8c9492ba95ee874a745d0556da4377798bb0a606 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Fri, 21 Apr 2023 16:00:51 +0100
+Subject: [PATCH] bcm2835-dma: Fix WAIT_RESP on memcpy
+
+It goes in info not extra
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/dma/bcm2835-dma.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -899,8 +899,8 @@ static struct dma_async_tx_descriptor *b
+ 	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+ 	struct bcm2835_desc *d;
+ 	u32 info = BCM2835_DMA_D_INC | BCM2835_DMA_S_INC |
+-		   WIDE_SOURCE(c->dreq) | WIDE_DEST(c->dreq);
+-	u32 extra = BCM2835_DMA_INT_EN | WAIT_RESP(c->dreq);
++		   WAIT_RESP(c->dreq) | WIDE_SOURCE(c->dreq) | WIDE_DEST(c->dreq);
++	u32 extra = BCM2835_DMA_INT_EN;
+ 	size_t max_len = bcm2835_dma_max_frame_length(c);
+ 	size_t frames;
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0726-bcm2835-dma-Fix-dma_abort-for-40-bit-channels.patch b/target/linux/bcm27xx/patches-6.1/950-0726-bcm2835-dma-Fix-dma_abort-for-40-bit-channels.patch
new file mode 100644
index 00000000000000..07fd80ff375e55
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0726-bcm2835-dma-Fix-dma_abort-for-40-bit-channels.patch
@@ -0,0 +1,78 @@
+From 160cee9f3b24ef830fdf3abbe56f4de94eeea812 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Fri, 21 Apr 2023 20:23:42 +0100
+Subject: [PATCH] bcm2835-dma: Fix dma_abort for 40-bit channels
+
+It wasn't aborting the transfer and caused stop/start
+of hdmi audio dma to be unreliable.
+
+New sequence approved by Broadcom.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/dma/bcm2835-dma.c | 42 ++++++++++++++++++++++++++-------------
+ 1 file changed, 28 insertions(+), 14 deletions(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -651,10 +651,6 @@ static void bcm2835_dma_abort(struct bcm
+ {
+ 	void __iomem *chan_base = c->chan_base;
+ 	long int timeout = 10000;
+-	u32 wait_mask = BCM2835_DMA_WAITING_FOR_WRITES;
+-
+-	if (c->is_40bit_channel)
+-		wait_mask = BCM2711_DMA40_WAITING_FOR_WRITES;
+ 
+ 	/*
+ 	 * A zero control block address means the channel is idle.
+@@ -663,19 +659,37 @@ static void bcm2835_dma_abort(struct bcm
+ 	if (!readl(chan_base + BCM2835_DMA_ADDR))
+ 		return;
+ 
+-	/* Write 0 to the active bit - Pause the DMA */
+-	writel(0, chan_base + BCM2835_DMA_CS);
+-
+-	/* Wait for any current AXI transfer to complete */
+-	while ((readl(chan_base + BCM2835_DMA_CS) & wait_mask) && --timeout)
+-		cpu_relax();
+-
+-	/* Peripheral might be stuck and fail to signal AXI write responses */
+-	if (!timeout)
+-		dev_err(c->vc.chan.device->dev,
+-			"failed to complete outstanding writes\n");
++	if (c->is_40bit_channel) {
++		/* Halt the current DMA */
++		writel(readl(chan_base + BCM2711_DMA40_CS) | BCM2711_DMA40_HALT,
++			     chan_base + BCM2711_DMA40_CS);
++
++		while ((readl(chan_base + BCM2711_DMA40_CS) & BCM2711_DMA40_HALT) && --timeout)
++			cpu_relax();
++
++		/* Peripheral might be stuck and fail to halt */
++		if (!timeout)
++			dev_err(c->vc.chan.device->dev,
++				"failed to halt dma\n");
++
++		writel(0, chan_base + BCM2711_DMA40_CS);
++		writel(0, chan_base + BCM2711_DMA40_CB);
++	} else {
++		/* Write 0 to the active bit - Pause the DMA */
++		writel(0, chan_base + BCM2835_DMA_CS);
++
++		/* Wait for any current AXI transfer to complete */
++		while ((readl(chan_base + BCM2835_DMA_CS) & BCM2835_DMA_WAITING_FOR_WRITES)
++		       && --timeout)
++			cpu_relax();
++
++		/* Peripheral might be stuck and fail to signal AXI write responses */
++		if (!timeout)
++			dev_err(c->vc.chan.device->dev,
++				"failed to complete outstanding writes\n");
+ 
+-	writel(BCM2835_DMA_RESET, chan_base + BCM2835_DMA_CS);
++		writel(BCM2835_DMA_RESET, chan_base + BCM2835_DMA_CS);
++	}
+ }
+ 
+ static void bcm2835_dma_start_desc(struct bcm2835_chan *c)
diff --git a/target/linux/bcm27xx/patches-6.1/950-0727-bcm2835-dma-Fix-dma_abort-for-non-40bit-channels.patch b/target/linux/bcm27xx/patches-6.1/950-0727-bcm2835-dma-Fix-dma_abort-for-non-40bit-channels.patch
new file mode 100644
index 00000000000000..188c28633788a2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0727-bcm2835-dma-Fix-dma_abort-for-non-40bit-channels.patch
@@ -0,0 +1,68 @@
+From 6609cb1bb479d833d11703b711cd12ade9bf8750 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Wed, 26 Apr 2023 13:40:34 +0100
+Subject: [PATCH] bcm2835-dma: Fix dma_abort for non-40bit channels
+
+The sequence we were doing was not safe.
+
+Clearing CS meant BCM2835_DMA_WAIT_FOR_WRITES was cleared
+and so polling BCM2835_DMA_WAITING_FOR_WRITES has no benefit
+
+Broadcom have provided a recommended sequence to abort
+a dma lite channel, so switch to that.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/dma/bcm2835-dma.c | 31 +++++++++++++++++++++++++++----
+ 1 file changed, 27 insertions(+), 4 deletions(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -675,10 +675,18 @@ static void bcm2835_dma_abort(struct bcm
+ 		writel(0, chan_base + BCM2711_DMA40_CS);
+ 		writel(0, chan_base + BCM2711_DMA40_CB);
+ 	} else {
++		/*
++		 * A zero control block address means the channel is idle.
++		 * (The ACTIVE flag in the CS register is not a reliable indicator.)
++		 */
++		if (!readl(chan_base + BCM2835_DMA_ADDR))
++			return;
++
+ 		/* Write 0 to the active bit - Pause the DMA */
+-		writel(0, chan_base + BCM2835_DMA_CS);
++		writel(readl(chan_base + BCM2835_DMA_CS) & ~BCM2835_DMA_ACTIVE,
++		       chan_base + BCM2835_DMA_CS);
+ 
+-		/* Wait for any current AXI transfer to complete */
++		/* wait for DMA to be paused */
+ 		while ((readl(chan_base + BCM2835_DMA_CS) & BCM2835_DMA_WAITING_FOR_WRITES)
+ 		       && --timeout)
+ 			cpu_relax();
+@@ -686,9 +694,24 @@ static void bcm2835_dma_abort(struct bcm
+ 		/* Peripheral might be stuck and fail to signal AXI write responses */
+ 		if (!timeout)
+ 			dev_err(c->vc.chan.device->dev,
+-				"failed to complete outstanding writes\n");
++				"failed to pause dma\n");
++
++		/* We need to clear the next DMA block pending */
++		writel(0, chan_base + BCM2835_DMA_NEXTCB);
++
++		/* Abort the DMA, which needs to be enabled to complete */
++		writel(readl(chan_base + BCM2835_DMA_CS) | BCM2835_DMA_ABORT | BCM2835_DMA_ACTIVE,
++		chan_base + BCM2835_DMA_CS);
++
++		/* wait for DMA to have been aborted */
++		timeout = 10000;
++		while ((readl(chan_base + BCM2835_DMA_CS) & BCM2835_DMA_ABORT) && --timeout)
++			cpu_relax();
+ 
+-		writel(BCM2835_DMA_RESET, chan_base + BCM2835_DMA_CS);
++		/* Peripheral might be stuck and fail to signal AXI write responses */
++		if (!timeout)
++			dev_err(c->vc.chan.device->dev,
++				"failed to abort dma\n");
+ 	}
+ }
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0728-bcm2835-dma-Support-dma-flags-for-multi-beat-burst.patch b/target/linux/bcm27xx/patches-6.1/950-0728-bcm2835-dma-Support-dma-flags-for-multi-beat-burst.patch
new file mode 100644
index 00000000000000..c3c33746ccbd15
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0728-bcm2835-dma-Support-dma-flags-for-multi-beat-burst.patch
@@ -0,0 +1,96 @@
+From 8c5a3ead40c1778595be768db284c66c03546e2d Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Fri, 21 Apr 2023 20:24:54 +0100
+Subject: [PATCH] bcm2835-dma: Support dma flags for multi-beat burst
+
+Add a control bit to enable a multi-beat burst on a DMA.
+This improves DMA performance and is required for HDMI audio.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/dma/bcm2835-dma.c | 28 ++++++++++++++++++++--------
+ 1 file changed, 20 insertions(+), 8 deletions(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -158,7 +158,8 @@ struct bcm2835_desc {
+ #define BCM2835_DMA_S_WIDTH	BIT(9) /* 128bit writes if set */
+ #define BCM2835_DMA_S_DREQ	BIT(10) /* enable SREQ for source */
+ #define BCM2835_DMA_S_IGNORE	BIT(11) /* ignore source reads - read 0 */
+-#define BCM2835_DMA_BURST_LENGTH(x) ((x & 15) << 12)
++#define BCM2835_DMA_BURST_LENGTH(x) (((x) & 15) << 12)
++#define BCM2835_DMA_GET_BURST_LENGTH(x) (((x) >> 12) & 15)
+ #define BCM2835_DMA_CS_FLAGS(x) (x & (BCM2835_DMA_PRIORITY(15) | \
+ 				      BCM2835_DMA_PANIC_PRIORITY(15) | \
+ 				      BCM2835_DMA_WAIT_FOR_WRITES | \
+@@ -182,6 +183,11 @@ struct bcm2835_desc {
+ #define WIDE_DEST(x) ((x & BCM2835_DMA_WIDE_DEST) ? \
+ 		      BCM2835_DMA_D_WIDTH : 0)
+ 
++/* A fake bit to request that the driver requires multi-beat burst */
++#define BCM2835_DMA_BURST BIT(30)
++#define BURST_LENGTH(x) ((x & BCM2835_DMA_BURST) ? \
++		      BCM2835_DMA_BURST_LENGTH(3) : 0)
++
+ 
+ /* debug register bits */
+ #define BCM2835_DMA_DEBUG_LAST_NOT_SET_ERR	BIT(0)
+@@ -285,7 +291,7 @@ struct bcm2835_desc {
+ /* the max dma length for different channels */
+ #define MAX_DMA40_LEN SZ_1G
+ 
+-#define BCM2711_DMA40_BURST_LEN(x)	((min(x,16) - 1) << 8)
++#define BCM2711_DMA40_BURST_LEN(x)	(((x) & 15) << 8)
+ #define BCM2711_DMA40_INC		BIT(12)
+ #define BCM2711_DMA40_SIZE_32		(0 << 13)
+ #define BCM2711_DMA40_SIZE_64		(1 << 13)
+@@ -362,12 +368,16 @@ static inline uint32_t to_bcm2711_ti(uin
+ 
+ static inline uint32_t to_bcm2711_srci(uint32_t info)
+ {
+-	return ((info & BCM2835_DMA_S_INC) ? BCM2711_DMA40_INC : 0);
++	return ((info & BCM2835_DMA_S_INC) ? BCM2711_DMA40_INC : 0) |
++	       ((info & BCM2835_DMA_S_WIDTH) ? BCM2711_DMA40_SIZE_128 : 0) |
++	       BCM2711_DMA40_BURST_LEN(BCM2835_DMA_GET_BURST_LENGTH(info));
+ }
+ 
+ static inline uint32_t to_bcm2711_dsti(uint32_t info)
+ {
+-	return ((info & BCM2835_DMA_D_INC) ? BCM2711_DMA40_INC : 0);
++	return ((info & BCM2835_DMA_D_INC) ? BCM2711_DMA40_INC : 0) |
++	       ((info & BCM2835_DMA_D_WIDTH) ? BCM2711_DMA40_SIZE_128 : 0) |
++	       BCM2711_DMA40_BURST_LEN(BCM2835_DMA_GET_BURST_LENGTH(info));
+ }
+ 
+ static inline uint32_t to_bcm2711_cbaddr(dma_addr_t addr)
+@@ -936,7 +946,8 @@ static struct dma_async_tx_descriptor *b
+ 	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+ 	struct bcm2835_desc *d;
+ 	u32 info = BCM2835_DMA_D_INC | BCM2835_DMA_S_INC |
+-		   WAIT_RESP(c->dreq) | WIDE_SOURCE(c->dreq) | WIDE_DEST(c->dreq);
++		   WAIT_RESP(c->dreq) | WIDE_SOURCE(c->dreq) |
++		   WIDE_DEST(c->dreq) | BURST_LENGTH(c->dreq);
+ 	u32 extra = BCM2835_DMA_INT_EN;
+ 	size_t max_len = bcm2835_dma_max_frame_length(c);
+ 	size_t frames;
+@@ -967,8 +978,8 @@ static struct dma_async_tx_descriptor *b
+ 	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+ 	struct bcm2835_desc *d;
+ 	dma_addr_t src = 0, dst = 0;
+-	u32 info = WAIT_RESP(c->dreq) |
+-		   WIDE_SOURCE(c->dreq) | WIDE_DEST(c->dreq);
++	u32 info = WAIT_RESP(c->dreq) | WIDE_SOURCE(c->dreq) |
++		   WIDE_DEST(c->dreq) | BURST_LENGTH(c->dreq);
+ 	u32 extra = BCM2835_DMA_INT_EN;
+ 	size_t frames;
+ 
+@@ -1020,7 +1031,8 @@ static struct dma_async_tx_descriptor *b
+ 	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+ 	struct bcm2835_desc *d;
+ 	dma_addr_t src, dst;
+-	u32 info = WAIT_RESP(c->dreq) | WIDE_SOURCE(c->dreq) | WIDE_DEST(c->dreq);
++	u32 info = WAIT_RESP(c->dreq) | WIDE_SOURCE(c->dreq) |
++		   WIDE_DEST(c->dreq) | BURST_LENGTH(c->dreq);
+ 	u32 extra = 0;
+ 	size_t max_len = bcm2835_dma_max_frame_length(c);
+ 	size_t frames;
diff --git a/target/linux/bcm27xx/patches-6.1/950-0729-bcm2835-dma-Need-to-keep-PROT-bits-set-in-CS-on-40bi.patch b/target/linux/bcm27xx/patches-6.1/950-0729-bcm2835-dma-Need-to-keep-PROT-bits-set-in-CS-on-40bi.patch
new file mode 100644
index 00000000000000..637f4562dd83b7
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0729-bcm2835-dma-Need-to-keep-PROT-bits-set-in-CS-on-40bi.patch
@@ -0,0 +1,77 @@
+From 132f5d41c2da9f7292f1495fd30cf04a3de8d196 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Fri, 5 May 2023 11:23:50 +0100
+Subject: [PATCH] bcm2835-dma: Need to keep PROT bits set in CS on
+ 40bit controller
+
+Resetting them to zero puts DMA channel into secure mode
+which makes further accesses impossible
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/dma/bcm2835-dma.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -249,6 +249,9 @@ struct bcm2835_desc {
+ #define BCM2711_DMA40_DISDEBUG		BIT(29)
+ #define BCM2711_DMA40_ABORT		BIT(30)
+ #define BCM2711_DMA40_HALT		BIT(31)
++// we always want to run in supervisor mode
++#define BCM2711_DMA40_PROT		(BIT(8)|BIT(9))
++
+ #define BCM2711_DMA40_CS_FLAGS(x) (x & (BCM2711_DMA40_QOS(15) | \
+ 					BCM2711_DMA40_PANIC_QOS(15) | \
+ 					BCM2711_DMA40_WAIT_FOR_WRITES |	\
+@@ -682,7 +685,7 @@ static void bcm2835_dma_abort(struct bcm
+ 			dev_err(c->vc.chan.device->dev,
+ 				"failed to halt dma\n");
+ 
+-		writel(0, chan_base + BCM2711_DMA40_CS);
++		writel(BCM2711_DMA40_PROT, chan_base + BCM2711_DMA40_CS);
+ 		writel(0, chan_base + BCM2711_DMA40_CB);
+ 	} else {
+ 		/*
+@@ -742,7 +745,7 @@ static void bcm2835_dma_start_desc(struc
+ 	if (c->is_40bit_channel) {
+ 		writel(to_bcm2711_cbaddr(d->cb_list[0].paddr),
+ 		       c->chan_base + BCM2711_DMA40_CB);
+-		writel(BCM2711_DMA40_ACTIVE | BCM2711_DMA40_CS_FLAGS(c->dreq),
++		writel(BCM2711_DMA40_ACTIVE | BCM2711_DMA40_PROT | BCM2711_DMA40_CS_FLAGS(c->dreq),
+ 		       c->chan_base + BCM2711_DMA40_CS);
+ 	} else {
+ 		writel(d->cb_list[0].paddr, c->chan_base + BCM2835_DMA_ADDR);
+@@ -775,8 +778,13 @@ static irqreturn_t bcm2835_dma_callback(
+ 	 * if this IRQ handler is threaded.) If the channel is finished, it
+ 	 * will remain idle despite the ACTIVE flag being set.
+ 	 */
+-	writel(BCM2835_DMA_INT | BCM2835_DMA_ACTIVE | BCM2835_DMA_CS_FLAGS(c->dreq),
+-	       c->chan_base + BCM2835_DMA_CS);
++	if (c->is_40bit_channel)
++		writel(BCM2835_DMA_INT | BCM2711_DMA40_ACTIVE | BCM2711_DMA40_PROT |
++		       BCM2711_DMA40_CS_FLAGS(c->dreq),
++		       c->chan_base + BCM2711_DMA40_CS);
++	else
++		writel(BCM2835_DMA_INT | BCM2835_DMA_ACTIVE | BCM2835_DMA_CS_FLAGS(c->dreq),
++		       c->chan_base + BCM2835_DMA_CS);
+ 
+ 	d = c->desc;
+ 
+@@ -1230,14 +1238,14 @@ void bcm2711_dma40_memcpy(dma_addr_t dst
+ 	scb->next_cb = 0;
+ 
+ 	writel(to_bcm2711_cbaddr(memcpy_scb_dma), memcpy_chan + BCM2711_DMA40_CB);
+-	writel(BCM2711_DMA40_MEMCPY_FLAGS + BCM2711_DMA40_ACTIVE,
++	writel(BCM2711_DMA40_MEMCPY_FLAGS | BCM2711_DMA40_ACTIVE | BCM2711_DMA40_PROT,
+ 	       memcpy_chan + BCM2711_DMA40_CS);
+ 
+ 	/* Poll for completion */
+ 	while (!(readl(memcpy_chan + BCM2711_DMA40_CS) & BCM2711_DMA40_END))
+ 		cpu_relax();
+ 
+-	writel(BCM2711_DMA40_END, memcpy_chan + BCM2711_DMA40_CS);
++	writel(BCM2711_DMA40_END | BCM2711_DMA40_PROT, memcpy_chan + BCM2711_DMA40_CS);
+ 
+ 	spin_unlock_irqrestore(&memcpy_lock, flags);
+ }
diff --git a/target/linux/bcm27xx/patches-6.1/950-0730-bcm2711-rpi-ds-Switch-to-dma40-channel-for-hdmi-audi.patch b/target/linux/bcm27xx/patches-6.1/950-0730-bcm2711-rpi-ds-Switch-to-dma40-channel-for-hdmi-audi.patch
new file mode 100644
index 00000000000000..f5545ea5cc37a8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0730-bcm2711-rpi-ds-Switch-to-dma40-channel-for-hdmi-audi.patch
@@ -0,0 +1,58 @@
+From e73d889889d4795cc1640ec0a6f813bfe585b838 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Thu, 4 May 2023 16:09:49 +0100
+Subject: [PATCH] bcm2711-rpi-ds: Switch to dma40 channel for hdmi
+ audio
+
+Also tweak the flags:
+Remove NO_WAIT_RESP (27)
+Add BURST_LENGTH (30)
+
+The AXI path from DMA controller to HDMI audio fifo
+is long, and may have considerable delay.
+
+When using DMA without waiting for responses it is
+very easy to overfill the fifo as when the fifo
+removes DREQ there may be large numbers of writes
+in flight.
+
+This means the DREQ fifo threshold must be set low
+enough to accommodate the maximum number of in flight
+writes (unknown by something like 24),
+which means the 32 element fifo only requests data
+when it contains fewer than 8 entries, making it
+susceptable to underflow.
+
+If we wait for write responses we can set the DREQ
+fifo threshold much higher as there are a controlled
+number of writes in flight.
+
+However the overall bandwidth is reduced by setting
+this, so also enable a burstsize of 4 to improve
+bandwidth.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ arch/arm/boot/dts/bcm2711-rpi-ds.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
++++ b/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
+@@ -364,7 +364,7 @@
+ 		 <&firmware_clocks 14>,
+ 		 <&dvp 0>,
+ 		 <&clk_27MHz>;
+-	dmas = <&dma (10|(1<<27)|(1<<24)|(10<<16)|(15<<20))>;
++	dmas = <&dma40 (10|(1<<30)|(1<<24)|(10<<16)|(15<<20))>;
+ 	status = "disabled";
+ };
+ 
+@@ -397,7 +397,7 @@
+ 		 <&firmware_clocks 14>,
+ 		 <&dvp 1>,
+ 		 <&clk_27MHz>;
+-	dmas = <&dma (17|(1<<27)|(1<<24)|(10<<16)|(15<<20))>;
++	dmas = <&dma40 (17|(1<<30)|(1<<24)|(10<<16)|(15<<20))>;
+ 	status = "disabled";
+ };
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0731-drm-vc4-hdmi-Increase-MAI-fifo-dreq-threshold.patch b/target/linux/bcm27xx/patches-6.1/950-0731-drm-vc4-hdmi-Increase-MAI-fifo-dreq-threshold.patch
new file mode 100644
index 00000000000000..ce2aec7f31cc10
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0731-drm-vc4-hdmi-Increase-MAI-fifo-dreq-threshold.patch
@@ -0,0 +1,50 @@
+From 7b3d872d5cb43e85da3c9a6406d784ccfdd59845 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Fri, 21 Apr 2023 22:00:16 +0100
+Subject: [PATCH] drm/vc4: hdmi: Increase MAI fifo dreq threshold
+
+Now we wait for write responses and have a burst
+size of 4, we can set the fifo threshold much higher.
+
+Set it to 28 (of the 32 entry size) to keep fifo
+fuller and reduce chance of underflow.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -2555,6 +2555,7 @@ static int vc4_hdmi_audio_prepare(struct
+ {
+ 	struct vc4_hdmi *vc4_hdmi = dev_get_drvdata(dev);
+ 	struct drm_device *drm = vc4_hdmi->connector.dev;
++	struct vc4_dev *vc4 = to_vc4_dev(drm);
+ 	struct drm_encoder *encoder = &vc4_hdmi->encoder.base;
+ 	unsigned int sample_rate = params->sample_rate;
+ 	unsigned int channels = params->channels;
+@@ -2613,11 +2614,18 @@ static int vc4_hdmi_audio_prepare(struct
+ 					     VC4_HDMI_AUDIO_PACKET_CEA_MASK);
+ 
+ 	/* Set the MAI threshold */
+-	HDMI_WRITE(HDMI_MAI_THR,
+-		   VC4_SET_FIELD(0x08, VC4_HD_MAI_THR_PANICHIGH) |
+-		   VC4_SET_FIELD(0x08, VC4_HD_MAI_THR_PANICLOW) |
+-		   VC4_SET_FIELD(0x06, VC4_HD_MAI_THR_DREQHIGH) |
+-		   VC4_SET_FIELD(0x08, VC4_HD_MAI_THR_DREQLOW));
++	if (vc4->is_vc5)
++		HDMI_WRITE(HDMI_MAI_THR,
++			VC4_SET_FIELD(0x10, VC4_HD_MAI_THR_PANICHIGH) |
++			VC4_SET_FIELD(0x10, VC4_HD_MAI_THR_PANICLOW) |
++			VC4_SET_FIELD(0x1c, VC4_HD_MAI_THR_DREQHIGH) |
++			VC4_SET_FIELD(0x1c, VC4_HD_MAI_THR_DREQLOW));
++	else
++		HDMI_WRITE(HDMI_MAI_THR,
++			VC4_SET_FIELD(0x8, VC4_HD_MAI_THR_PANICHIGH) |
++			VC4_SET_FIELD(0x8, VC4_HD_MAI_THR_PANICLOW) |
++			VC4_SET_FIELD(0x6, VC4_HD_MAI_THR_DREQHIGH) |
++			VC4_SET_FIELD(0x8, VC4_HD_MAI_THR_DREQLOW));
+ 
+ 	HDMI_WRITE(HDMI_MAI_CONFIG,
+ 		   VC4_HDMI_MAI_CONFIG_BIT_REVERSE |
diff --git a/target/linux/bcm27xx/patches-6.1/950-0732-ARM-dts-bcm2711-rpi-Set-a-1GB-ZONE_DMA-limit.patch b/target/linux/bcm27xx/patches-6.1/950-0732-ARM-dts-bcm2711-rpi-Set-a-1GB-ZONE_DMA-limit.patch
new file mode 100644
index 00000000000000..e0083b8c637fdd
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0732-ARM-dts-bcm2711-rpi-Set-a-1GB-ZONE_DMA-limit.patch
@@ -0,0 +1,41 @@
+From f3e5f85353153a6941fc9e32871b5037e875d1ae Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 17 May 2023 13:39:18 +0100
+Subject: [PATCH] ARM: dts: bcm2711-rpi: Set a 1GB ZONE_DMA limit
+
+The arm64 initialisation uses the physical address reachable by all
+DMA controllers to set the size of ZONE_DMA. This fails on BCM2711
+with the current dts files because the declaration of the I/O space
+fools it into thinking the legacy 30-bit DMA channels can see most
+of the 32-bit space.
+
+Take advantage of the simple nature of the implementation by adding
+a node with a restricted dma-ranges property solely so to act as the
+limiting factor in the calculation.
+
+See: https://github.com/raspberrypi/linux/issues/5470
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/bcm2711-rpi-ds.dtsi | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
++++ b/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
+@@ -63,6 +63,16 @@
+ 		spi6 = &spi6;
+ 		/delete-property/ intc;
+ 	};
++
++	/*
++	 * Add a node with a dma-ranges value that exists only to be found
++	 * by of_dma_get_max_cpu_address, and hence limit the DMA zone.
++	 */
++	zone_dma {
++		#address-cells = <1>;
++		#size-cells = <1>;
++		dma-ranges = <0x0  0x0 0x0  0x40000000>;
++	};
+ };
+ 
+ &vc4 {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0733-ARM-dts-bcm27xx-Add-stdout-path-to-serial0.patch b/target/linux/bcm27xx/patches-6.1/950-0733-ARM-dts-bcm27xx-Add-stdout-path-to-serial0.patch
new file mode 100644
index 00000000000000..3fe7b4ea2ab81f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0733-ARM-dts-bcm27xx-Add-stdout-path-to-serial0.patch
@@ -0,0 +1,39 @@
+From d703aa3db7a3f6db81c6dcd03a8f462864e19144 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 17 May 2023 16:53:24 +0100
+Subject: [PATCH] ARM: dts: bcm27xx: Add stdout-path to serial0
+
+Rather than deleting the upstream stdout-path declaration, overwrite
+it with one selecting serial0, which will always be the UART mapped
+to the 40-pin header (provided enable_uart=1 is specified). Doing
+so has the advantage that earlycon can be configured just by adding
+"earlycon" to the command line.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/bcm270x.dtsi        | 2 +-
+ arch/arm/boot/dts/bcm2711-rpi-ds.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm270x.dtsi
++++ b/arch/arm/boot/dts/bcm270x.dtsi
+@@ -5,7 +5,7 @@
+ 	chosen: chosen {
+ 		// Disable audio by default
+ 		bootargs = "coherent_pool=1M snd_bcm2835.enable_headphones=0";
+-		/delete-property/ stdout-path;
++		stdout-path = "serial0:115200n8";
+ 	};
+ 
+ 	soc: soc {
+--- a/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
++++ b/arch/arm/boot/dts/bcm2711-rpi-ds.dtsi
+@@ -34,7 +34,7 @@
+ 	};
+ 
+ 	chosen {
+-		/delete-property/ stdout-path;
++		stdout-path = "serial0:115200n8";
+ 	};
+ 
+ 	aliases {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0734-input-edt-ft5x06-Only-read-data-for-number-of-points.patch b/target/linux/bcm27xx/patches-6.1/950-0734-input-edt-ft5x06-Only-read-data-for-number-of-points.patch
new file mode 100644
index 00000000000000..6b2442ce9ad787
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0734-input-edt-ft5x06-Only-read-data-for-number-of-points.patch
@@ -0,0 +1,58 @@
+From 4c2cec3cfad183400f191413e4867f3f07273ed6 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 19 May 2023 18:16:58 +0100
+Subject: [PATCH] input: edt-ft5x06: Only read data for number of
+ points reported
+
+Rather than always reading the maximum number of points supported
+by the chip (which may be as high as 10), read the number of
+active points first, and read data for just those.
+In most cases this will result in less data on the I2C bus,
+with only the maximum touch points taking more due to a second
+read that has to configure the start address.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/input/touchscreen/edt-ft5x06.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/input/touchscreen/edt-ft5x06.c
++++ b/drivers/input/touchscreen/edt-ft5x06.c
+@@ -220,6 +220,7 @@ static irqreturn_t edt_ft5x06_ts_isr(int
+ 		offset = 5; /* where the actual touch data starts */
+ 		tplen = 4;  /* data comes in so called frames */
+ 		crclen = 1; /* length of the crc data */
++		datalen = tplen * tsdata->max_support_points + offset + crclen;
+ 		break;
+ 
+ 	case EDT_M09:
+@@ -230,6 +231,7 @@ static irqreturn_t edt_ft5x06_ts_isr(int
+ 		offset = 3;
+ 		tplen = 6;
+ 		crclen = 0;
++		datalen = 3;
+ 		break;
+ 
+ 	default:
+@@ -237,7 +239,6 @@ static irqreturn_t edt_ft5x06_ts_isr(int
+ 	}
+ 
+ 	memset(rdbuf, 0, sizeof(rdbuf));
+-	datalen = tplen * tsdata->max_support_points + offset + crclen;
+ 
+ 	error = edt_ft5x06_ts_readwrite(tsdata->client,
+ 					sizeof(cmd), &cmd,
+@@ -267,6 +268,13 @@ static irqreturn_t edt_ft5x06_ts_isr(int
+ 		 * points.
+ 		 */
+ 		num_points = min(rdbuf[2] & 0xf, tsdata->max_support_points);
++		if (num_points) {
++			datalen = tplen * num_points + crclen;
++			cmd = offset;
++			error = edt_ft5x06_ts_readwrite(tsdata->client,
++							sizeof(cmd), &cmd,
++							datalen, &rdbuf[offset]);
++		}
+ 	}
+ 
+ 	for (i = 0; i < num_points; i++) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0735-i2c-bcm2835-Flush-FIFOs-cleanly-on-error.patch b/target/linux/bcm27xx/patches-6.1/950-0735-i2c-bcm2835-Flush-FIFOs-cleanly-on-error.patch
new file mode 100644
index 00000000000000..1c9e721fe4570e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0735-i2c-bcm2835-Flush-FIFOs-cleanly-on-error.patch
@@ -0,0 +1,45 @@
+From a563176190609097f9efa312a09f7a9b527c9a68 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 23 May 2023 14:11:52 +0100
+Subject: [PATCH] i2c-bcm2835: Flush FIFOs cleanly on error
+
+On error condition, note the error return code, but still
+handle the FIFOs in the normal way rather than relying on
+C_CLEAR flushing everything cleanly.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/i2c/busses/i2c-bcm2835.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-bcm2835.c
++++ b/drivers/i2c/busses/i2c-bcm2835.c
+@@ -385,10 +385,8 @@ static irqreturn_t bcm2835_i2c_isr(int t
+ 	bcm2835_debug_add(i2c_dev, val);
+ 
+ 	err = val & (BCM2835_I2C_S_CLKT | BCM2835_I2C_S_ERR);
+-	if (err) {
++	if (err)
+ 		i2c_dev->msg_err = err;
+-		goto complete;
+-	}
+ 
+ 	if (val & BCM2835_I2C_S_DONE) {
+ 		if (!i2c_dev->curr_msg) {
+@@ -400,8 +398,6 @@ static irqreturn_t bcm2835_i2c_isr(int t
+ 
+ 		if ((val & BCM2835_I2C_S_RXD) || i2c_dev->msg_buf_remaining)
+ 			i2c_dev->msg_err = BCM2835_I2C_S_LEN;
+-		else
+-			i2c_dev->msg_err = 0;
+ 		goto complete;
+ 	}
+ 
+@@ -465,6 +461,7 @@ static int bcm2835_i2c_xfer(struct i2c_a
+ 
+ 	i2c_dev->curr_msg = msgs;
+ 	i2c_dev->num_msgs = num;
++	i2c_dev->msg_err = 0;
+ 	reinit_completion(&i2c_dev->completion);
+ 
+ 	bcm2835_i2c_start_transfer(i2c_dev);
diff --git a/target/linux/bcm27xx/patches-6.1/950-0736-i2c-bcm2835-Do-not-abort-transfers-on-ERR-if-still-a.patch b/target/linux/bcm27xx/patches-6.1/950-0736-i2c-bcm2835-Do-not-abort-transfers-on-ERR-if-still-a.patch
new file mode 100644
index 00000000000000..37375675bbf159
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0736-i2c-bcm2835-Do-not-abort-transfers-on-ERR-if-still-a.patch
@@ -0,0 +1,28 @@
+From f14a14edf12354103e28e8b0336614385766b30a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 23 May 2023 14:14:05 +0100
+Subject: [PATCH] i2c-bcm2835: Do not abort transfers on ERR if still
+ active
+
+If a transaction is aborted immediately on ERR being reported,
+then the bus is not returned to the STOP condition, and devices
+generally get very upset.
+
+Handle the ERR and CLKT conditions only when TA is not set.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/i2c/busses/i2c-bcm2835.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-bcm2835.c
++++ b/drivers/i2c/busses/i2c-bcm2835.c
+@@ -385,7 +385,7 @@ static irqreturn_t bcm2835_i2c_isr(int t
+ 	bcm2835_debug_add(i2c_dev, val);
+ 
+ 	err = val & (BCM2835_I2C_S_CLKT | BCM2835_I2C_S_ERR);
+-	if (err)
++	if (err && !(val & BCM2835_I2C_S_TA))
+ 		i2c_dev->msg_err = err;
+ 
+ 	if (val & BCM2835_I2C_S_DONE) {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0737-i2c-bcm2835-Implement-I2C_M_IGNORE_NAK.patch b/target/linux/bcm27xx/patches-6.1/950-0737-i2c-bcm2835-Implement-I2C_M_IGNORE_NAK.patch
new file mode 100644
index 00000000000000..7238b0293d869f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0737-i2c-bcm2835-Implement-I2C_M_IGNORE_NAK.patch
@@ -0,0 +1,61 @@
+From 5faad0781d619f13723886e36dfed3ea7eeff00f Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 23 May 2023 14:31:03 +0100
+Subject: [PATCH] i2c-bcm2835: Implement I2C_M_IGNORE_NAK
+
+Now that transfers aren't aborted immediately (and uncleanly) on
+errors, and the FIFOs are always drained after all transfers, we
+can implement I2C_M_IGNORE_NAK by ignoring the returned error
+value.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/i2c/busses/i2c-bcm2835.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-bcm2835.c
++++ b/drivers/i2c/busses/i2c-bcm2835.c
+@@ -443,6 +443,7 @@ static int bcm2835_i2c_xfer(struct i2c_a
+ {
+ 	struct bcm2835_i2c_dev *i2c_dev = i2c_get_adapdata(adap);
+ 	unsigned long time_left;
++	bool ignore_nak = false;
+ 	int i;
+ 
+ 	if (debug)
+@@ -452,12 +453,15 @@ static int bcm2835_i2c_xfer(struct i2c_a
+ 		for (i = 0; i < num; i++)
+ 			bcm2835_debug_print_msg(i2c_dev, &msgs[i], i + 1, num, __func__);
+ 
+-	for (i = 0; i < (num - 1); i++)
++	for (i = 0; i < (num - 1); i++) {
+ 		if (msgs[i].flags & I2C_M_RD) {
+ 			dev_warn_once(i2c_dev->dev,
+ 				      "only one read message supported, has to be last\n");
+ 			return -EOPNOTSUPP;
+ 		}
++		if (msgs[i].flags & I2C_M_IGNORE_NAK)
++			ignore_nak = true;
++	}
+ 
+ 	i2c_dev->curr_msg = msgs;
+ 	i2c_dev->num_msgs = num;
+@@ -471,6 +475,9 @@ static int bcm2835_i2c_xfer(struct i2c_a
+ 
+ 	bcm2835_i2c_finish_transfer(i2c_dev);
+ 
++	if (ignore_nak)
++		i2c_dev->msg_err &= ~BCM2835_I2C_S_ERR;
++
+ 	if (debug > 1 || (debug && (!time_left || i2c_dev->msg_err)))
+ 		bcm2835_debug_print(i2c_dev);
+ 	i2c_dev->debug_num_msgs = 0;
+@@ -497,7 +504,7 @@ static int bcm2835_i2c_xfer(struct i2c_a
+ 
+ static u32 bcm2835_i2c_func(struct i2c_adapter *adap)
+ {
+-	return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
++	return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL | I2C_FUNC_PROTOCOL_MANGLING;
+ }
+ 
+ static const struct i2c_algorithm bcm2835_i2c_algo = {
diff --git a/target/linux/bcm27xx/patches-6.1/950-0738-pps-Compatibility-hack-should-be-X86-specific.patch b/target/linux/bcm27xx/patches-6.1/950-0738-pps-Compatibility-hack-should-be-X86-specific.patch
new file mode 100644
index 00000000000000..df24ee7607e8c3
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0738-pps-Compatibility-hack-should-be-X86-specific.patch
@@ -0,0 +1,48 @@
+From 138d22ae4abf49d9694a4398857fb4be5114f103 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 22 May 2023 14:22:55 +0100
+Subject: [PATCH] pps: Compatibility hack should be X86-specific
+
+As of [1], using PPS_FETCH on a 64-bit ARM kernel with a 32-bit userland
+is broken, returning a timeout. This is because the requested 4-byte
+alignment for struct pps_ktime_compat (illegal on arm64) results in the
+timeout flags field being uninitialised.
+
+Make the hack specific to X86_64 builds with CONFIG_COMPAT defined.
+
+[1] commit c2a49fe8eeef ("pps: fix padding issue with PPS_FETCH for
+    ioctl_compat")
+
+See: https://github.com/raspberrypi/linux/issues/5430
+Fixes: c2a49fe8eeef ("pps: fix padding issue with PPS_FETCH for ioctl_compat")
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/pps/pps.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/pps/pps.c
++++ b/drivers/pps/pps.c
+@@ -249,12 +249,13 @@ static long pps_cdev_ioctl(struct file *
+ static long pps_cdev_compat_ioctl(struct file *file,
+ 		unsigned int cmd, unsigned long arg)
+ {
+-	struct pps_device *pps = file->private_data;
+-	void __user *uarg = (void __user *) arg;
+ 
+ 	cmd = _IOC(_IOC_DIR(cmd), _IOC_TYPE(cmd), _IOC_NR(cmd), sizeof(void *));
+ 
++#ifdef CONFIG_X86_64
+ 	if (cmd == PPS_FETCH) {
++		struct pps_device *pps = file->private_data;
++		void __user *uarg = (void __user *) arg;
+ 		struct pps_fdata_compat compat;
+ 		struct pps_fdata fdata;
+ 		int err;
+@@ -289,6 +290,7 @@ static long pps_cdev_compat_ioctl(struct
+ 		return copy_to_user(uarg, &compat,
+ 				sizeof(struct pps_fdata_compat)) ? -EFAULT : 0;
+ 	}
++#endif
+ 
+ 	return pps_cdev_ioctl(file, cmd, arg);
+ }
diff --git a/target/linux/bcm27xx/patches-6.1/950-0739-bcm2835-dma-Fixes-for-dma_abort.patch b/target/linux/bcm27xx/patches-6.1/950-0739-bcm2835-dma-Fixes-for-dma_abort.patch
new file mode 100644
index 00000000000000..9314cd73c7ef18
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0739-bcm2835-dma-Fixes-for-dma_abort.patch
@@ -0,0 +1,154 @@
+From 4db71468da38668b1b2b5ad3d8bf120f702b6387 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Thu, 25 May 2023 17:04:20 +0100
+Subject: [PATCH] bcm2835-dma: Fixes for dma_abort
+
+There is a problem with the current abort scheme
+when dma is blocked on a DREQ which prevents halting.
+
+This is triggered by SPI driver which aborts dma
+in this state and so leads to a halt timeout.
+
+Discussion with Broadcom suggests the sequence:
+
+CS.ACTIVE=0
+while (CS.OUTSTANDING_TRANSACTIONS == 0)
+  wait()
+DEBUG.RESET=1
+
+should be safe on a dma40 channel.
+
+Unfortunately the non-dma40 channels don't have
+OUTSTANDING_TRANSACTIONS, so we need a more
+complicated scheme.
+
+We attempt to abort the channel, which will work
+if there is no blocked DREQ.
+
+It it times out, we can assume there is no AXI
+transfer in progress and reset anyway.
+
+The length of the timeout is observed at ~20us.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/dma/bcm2835-dma.c | 74 +++++++++++++++++++++------------------
+ 1 file changed, 40 insertions(+), 34 deletions(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -245,6 +245,7 @@ struct bcm2835_desc {
+ #define BCM2711_DMA40_ERR		BIT(10)
+ #define BCM2711_DMA40_QOS(x)		(((x) & 0x1f) << 16)
+ #define BCM2711_DMA40_PANIC_QOS(x)	(((x) & 0x1f) << 20)
++#define BCM2711_DMA40_TRANSACTIONS	BIT(25)
+ #define BCM2711_DMA40_WAIT_FOR_WRITES	BIT(28)
+ #define BCM2711_DMA40_DISDEBUG		BIT(29)
+ #define BCM2711_DMA40_ABORT		BIT(30)
+@@ -663,30 +664,37 @@ static void bcm2835_dma_fill_cb_chain_wi
+ static void bcm2835_dma_abort(struct bcm2835_chan *c)
+ {
+ 	void __iomem *chan_base = c->chan_base;
+-	long int timeout = 10000;
+-
+-	/*
+-	 * A zero control block address means the channel is idle.
+-	 * (The ACTIVE flag in the CS register is not a reliable indicator.)
+-	 */
+-	if (!readl(chan_base + BCM2835_DMA_ADDR))
+-		return;
++	long timeout = 100;
+ 
+ 	if (c->is_40bit_channel) {
+-		/* Halt the current DMA */
+-		writel(readl(chan_base + BCM2711_DMA40_CS) | BCM2711_DMA40_HALT,
++		/*
++		 * A zero control block address means the channel is idle.
++		 * (The ACTIVE flag in the CS register is not a reliable indicator.)
++		 */
++		if (!readl(chan_base + BCM2711_DMA40_CB))
++			return;
++
++		/* Pause the current DMA */
++		writel(readl(chan_base + BCM2711_DMA40_CS) & ~BCM2711_DMA40_ACTIVE,
+ 			     chan_base + BCM2711_DMA40_CS);
+ 
+-		while ((readl(chan_base + BCM2711_DMA40_CS) & BCM2711_DMA40_HALT) && --timeout)
++		/* wait for outstanding transactions to complete */
++		while ((readl(chan_base + BCM2711_DMA40_CS) & BCM2711_DMA40_TRANSACTIONS) &&
++			--timeout)
+ 			cpu_relax();
+ 
+-		/* Peripheral might be stuck and fail to halt */
++		/* Peripheral might be stuck and fail to complete */
+ 		if (!timeout)
+ 			dev_err(c->vc.chan.device->dev,
+-				"failed to halt dma\n");
++				"failed to complete pause on dma %d (CS:%08x)\n", c->ch,
++				readl(chan_base + BCM2711_DMA40_CS));
+ 
++		/* Set CS back to default state */
+ 		writel(BCM2711_DMA40_PROT, chan_base + BCM2711_DMA40_CS);
+-		writel(0, chan_base + BCM2711_DMA40_CB);
++
++		/* Reset the DMA */
++		writel(readl(chan_base + BCM2711_DMA40_DEBUG) | BCM2711_DMA40_DEBUG_RESET,
++		       chan_base + BCM2711_DMA40_DEBUG);
+ 	} else {
+ 		/*
+ 		 * A zero control block address means the channel is idle.
+@@ -695,36 +703,34 @@ static void bcm2835_dma_abort(struct bcm
+ 		if (!readl(chan_base + BCM2835_DMA_ADDR))
+ 			return;
+ 
+-		/* Write 0 to the active bit - Pause the DMA */
+-		writel(readl(chan_base + BCM2835_DMA_CS) & ~BCM2835_DMA_ACTIVE,
+-		       chan_base + BCM2835_DMA_CS);
+-
+-		/* wait for DMA to be paused */
+-		while ((readl(chan_base + BCM2835_DMA_CS) & BCM2835_DMA_WAITING_FOR_WRITES)
+-		       && --timeout)
+-			cpu_relax();
+-
+-		/* Peripheral might be stuck and fail to signal AXI write responses */
+-		if (!timeout)
+-			dev_err(c->vc.chan.device->dev,
+-				"failed to pause dma\n");
+-
+ 		/* We need to clear the next DMA block pending */
+ 		writel(0, chan_base + BCM2835_DMA_NEXTCB);
+ 
+ 		/* Abort the DMA, which needs to be enabled to complete */
+ 		writel(readl(chan_base + BCM2835_DMA_CS) | BCM2835_DMA_ABORT | BCM2835_DMA_ACTIVE,
+-		chan_base + BCM2835_DMA_CS);
++		      chan_base + BCM2835_DMA_CS);
+ 
+-		/* wait for DMA to have been aborted */
+-		timeout = 10000;
++		/* wait for DMA to be aborted */
+ 		while ((readl(chan_base + BCM2835_DMA_CS) & BCM2835_DMA_ABORT) && --timeout)
+ 			cpu_relax();
+ 
+-		/* Peripheral might be stuck and fail to signal AXI write responses */
+-		if (!timeout)
++		/* Write 0 to the active bit - Pause the DMA */
++		writel(readl(chan_base + BCM2835_DMA_CS) & ~BCM2835_DMA_ACTIVE,
++		       chan_base + BCM2835_DMA_CS);
++
++		/*
++		 * Peripheral might be stuck and fail to complete
++		 * This is expected when dreqs are enabled but not asserted
++		 * so only report error in non dreq case
++		 */
++		if (!timeout && !(readl(chan_base + BCM2835_DMA_TI) &
++		   (BCM2835_DMA_S_DREQ | BCM2835_DMA_D_DREQ)))
+ 			dev_err(c->vc.chan.device->dev,
+-				"failed to abort dma\n");
++				"failed to complete pause on dma %d (CS:%08x)\n", c->ch,
++				readl(chan_base + BCM2835_DMA_CS));
++
++		/* Set CS back to default state and reset the DMA */
++		writel(BCM2835_DMA_RESET, chan_base + BCM2835_DMA_CS);
+ 	}
+ }
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0740-bcm2835-dma-Move-definition-of-PROT-bits-to-expected.patch b/target/linux/bcm27xx/patches-6.1/950-0740-bcm2835-dma-Move-definition-of-PROT-bits-to-expected.patch
new file mode 100644
index 00000000000000..b5f287f3c3f87e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0740-bcm2835-dma-Move-definition-of-PROT-bits-to-expected.patch
@@ -0,0 +1,33 @@
+From 432d271f831a8182efa9a6ae9769fb81c32370da Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Tue, 30 May 2023 15:51:48 +0100
+Subject: [PATCH] bcm2835-dma: Move definition of PROT bits to expected
+ place
+
+Fixes: 654368fe848c ("bcm2835-dma: Need to keep PROT bits set in CS on 40bit controller")
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/dma/bcm2835-dma.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -242,6 +242,8 @@ struct bcm2835_desc {
+ #define BCM2711_DMA40_WR_PAUSED		BIT(5)  /* Writing is paused */
+ #define BCM2711_DMA40_DREQ_PAUSED	BIT(6)  /* Is paused by DREQ flow control */
+ #define BCM2711_DMA40_WAITING_FOR_WRITES BIT(7)  /* Waiting for last write */
++// we always want to run in supervisor mode
++#define BCM2711_DMA40_PROT		(BIT(8)|BIT(9))
+ #define BCM2711_DMA40_ERR		BIT(10)
+ #define BCM2711_DMA40_QOS(x)		(((x) & 0x1f) << 16)
+ #define BCM2711_DMA40_PANIC_QOS(x)	(((x) & 0x1f) << 20)
+@@ -250,8 +252,6 @@ struct bcm2835_desc {
+ #define BCM2711_DMA40_DISDEBUG		BIT(29)
+ #define BCM2711_DMA40_ABORT		BIT(30)
+ #define BCM2711_DMA40_HALT		BIT(31)
+-// we always want to run in supervisor mode
+-#define BCM2711_DMA40_PROT		(BIT(8)|BIT(9))
+ 
+ #define BCM2711_DMA40_CS_FLAGS(x) (x & (BCM2711_DMA40_QOS(15) | \
+ 					BCM2711_DMA40_PANIC_QOS(15) | \
diff --git a/target/linux/bcm27xx/patches-6.1/950-0741-drivers-media-imx296-Disable-2x2-binned-mode.patch b/target/linux/bcm27xx/patches-6.1/950-0741-drivers-media-imx296-Disable-2x2-binned-mode.patch
new file mode 100644
index 00000000000000..eb1e8f303e53cc
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0741-drivers-media-imx296-Disable-2x2-binned-mode.patch
@@ -0,0 +1,68 @@
+From 9af77c3135bd68fc825cb2aaaae2d5d58aa56ad8 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Wed, 31 May 2023 15:51:58 +0100
+Subject: [PATCH] drivers: media: imx296: Disable 2x2 binned mode
+
+Disable enumerating and setting of the 2x2 binned mode entirely as it
+does not seem to work for either mono or colour sensor variants.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx296.c | 36 +++++++-----------------------------
+ 1 file changed, 7 insertions(+), 29 deletions(-)
+
+--- a/drivers/media/i2c/imx296.c
++++ b/drivers/media/i2c/imx296.c
+@@ -745,12 +745,14 @@ static int imx296_enum_frame_size(struct
+ {
+ 	const struct imx296 *sensor = to_imx296(sd);
+ 	const struct v4l2_mbus_framefmt *format;
+-	/* Binning only works on the mono sensor variant */
+-	unsigned int max_index = sensor->mono ? 2 : 1;
+ 
+ 	format = v4l2_subdev_get_pad_format(sd, state, fse->pad);
+ 
+-	if (fse->index >= max_index || fse->code != imx296_mbus_code(sensor))
++	/*
++	 * Binning does not seem to work on either mono or colour sensor
++	 * variants. Disable enumerating the binned frame size for now.
++	 */
++	if (fse->index >= 1 || fse->code != imx296_mbus_code(sensor))
+ 		return -EINVAL;
+ 
+ 	fse->min_width = IMX296_PIXEL_ARRAY_WIDTH / (fse->index + 1);
+@@ -781,32 +783,8 @@ static int imx296_set_format(struct v4l2
+ 	crop = v4l2_subdev_get_pad_crop(sd, state, fmt->pad);
+ 	format = v4l2_subdev_get_pad_format(sd, state, fmt->pad);
+ 
+-	/*
+-	 * Binning is only allowed when cropping is disabled according to the
+-	 * documentation. This should be double-checked.
+-	 */
+-	if (crop->width == IMX296_PIXEL_ARRAY_WIDTH &&
+-	    crop->height == IMX296_PIXEL_ARRAY_HEIGHT) {
+-		unsigned int width;
+-		unsigned int height;
+-		unsigned int hratio;
+-		unsigned int vratio;
+-
+-		/* Clamp the width and height to avoid dividing by zero. */
+-		width = clamp_t(unsigned int, fmt->format.width,
+-				crop->width / 2, crop->width);
+-		height = clamp_t(unsigned int, fmt->format.height,
+-				 crop->height / 2, crop->height);
+-
+-		hratio = DIV_ROUND_CLOSEST(crop->width, width);
+-		vratio = DIV_ROUND_CLOSEST(crop->height, height);
+-
+-		format->width = crop->width / hratio;
+-		format->height = crop->height / vratio;
+-	} else {
+-		format->width = crop->width;
+-		format->height = crop->height;
+-	}
++	format->width = crop->width;
++	format->height = crop->height;
+ 
+ 	imx296_setup_hblank(sensor, format->width);
+ 
diff --git a/target/linux/bcm27xx/patches-6.1/950-0742-panel-sitronix-st7701-Fix-panel-prepare-over-SPI.patch b/target/linux/bcm27xx/patches-6.1/950-0742-panel-sitronix-st7701-Fix-panel-prepare-over-SPI.patch
new file mode 100644
index 00000000000000..eccffec4e172ec
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/950-0742-panel-sitronix-st7701-Fix-panel-prepare-over-SPI.patch
@@ -0,0 +1,37 @@
+From 162aedd492c420bbfe3d44dae1770c60a6c367bb Mon Sep 17 00:00:00 2001
+From: Jack Andersen <jackoalan@gmail.com>
+Date: Fri, 26 May 2023 12:19:19 -0700
+Subject: [PATCH] panel-sitronix-st7701: Fix panel prepare over SPI
+
+A DSI write is issued in st7701_prepare even when the probed panel
+runs on SPI. In practice, this results in a panic with the
+vc4-kms-dpi-hyperpixel2r overlay active.
+
+Perform the equivalent write over SPI in this case.
+
+Signed-off-by: Jack Andersen <jackoalan@gmail.com>
+---
+ drivers/gpu/drm/panel/panel-sitronix-st7701.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/panel/panel-sitronix-st7701.c
++++ b/drivers/gpu/drm/panel/panel-sitronix-st7701.c
+@@ -571,8 +571,16 @@ static int st7701_prepare(struct drm_pan
+ 		st7701->desc->gip_sequence(st7701);
+ 
+ 	/* Disable Command2 */
+-	ST7701_DSI(st7701, DSI_CMD2BKX_SEL,
+-		   0x77, 0x01, 0x00, 0x00, DSI_CMD2BKX_SEL_NONE);
++	switch (st7701->desc->interface) {
++	case ST7701_CTRL_DSI:
++		ST7701_DSI(st7701, DSI_CMD2BKX_SEL,
++			   0x77, 0x01, 0x00, 0x00, DSI_CMD2BKX_SEL_NONE);
++		break;
++	case ST7701_CTRL_SPI:
++		ST7701_SPI(st7701, DSI_CMD2BKX_SEL,
++			   0x177, 0x101, 0x100, 0x100, SPI_CMD2BKX_SEL_NONE);
++		break;
++	}
+ 
+ 	return 0;
+ }
diff --git a/target/linux/bcm27xx/patches-6.1/960-hwrng-iproc-set-quality-to-1000.patch b/target/linux/bcm27xx/patches-6.1/960-hwrng-iproc-set-quality-to-1000.patch
new file mode 100644
index 00000000000000..b23d63f75c7c1e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.1/960-hwrng-iproc-set-quality-to-1000.patch
@@ -0,0 +1,25 @@
+From d3e5e7f3a4e6f61e8c380b9a610212267ee72dbd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Sat, 20 Feb 2021 19:24:50 +0100
+Subject: [PATCH] hwrng: iproc: set quality to 1000
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This allows khwrngd to make use of iproc-rng200.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ drivers/char/hw_random/iproc-rng200.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/char/hw_random/iproc-rng200.c
++++ b/drivers/char/hw_random/iproc-rng200.c
+@@ -250,6 +250,7 @@ static int iproc_rng200_probe(struct pla
+ 
+ 	priv->rng.name = pdev->name;
+ 	priv->rng.cleanup = iproc_rng200_cleanup;
++	priv->rng.quality = 1000;
+ 
+ 	if (of_device_is_compatible(dev->of_node, "brcm,bcm2711-rng200")) {
+ 		priv->rng.init = bcm2711_rng200_init;
diff --git a/target/linux/bcm47xx/Makefile b/target/linux/bcm47xx/Makefile
index 3a4820185175fd..a56c53ca6d5b7e 100644
--- a/target/linux/bcm47xx/Makefile
+++ b/target/linux/bcm47xx/Makefile
@@ -10,7 +10,7 @@ BOARDNAME:=Broadcom BCM47xx/53xx (MIPS)
 FEATURES:=squashfs usb
 SUBTARGETS:=generic mips74k legacy
 
-KERNEL_PATCHVER:=5.10
+KERNEL_PATCHVER:=5.15
 
 define Target/Description
 	Build firmware images for Broadcom based BCM47xx/53xx routers with MIPS CPU, *not* ARM.
diff --git a/target/linux/bcm47xx/config-5.15 b/target/linux/bcm47xx/config-5.15
new file mode 100644
index 00000000000000..6f091c0e7fe074
--- /dev/null
+++ b/target/linux/bcm47xx/config-5.15
@@ -0,0 +1,176 @@
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_BCM47XX=y
+CONFIG_BCM47XX_BCMA=y
+CONFIG_BCM47XX_NVRAM=y
+CONFIG_BCM47XX_SPROM=y
+CONFIG_BCM47XX_SSB=y
+CONFIG_BCM47XX_WDT=y
+CONFIG_BCMA=y
+CONFIG_BCMA_BLOCKIO=y
+CONFIG_BCMA_DEBUG=y
+CONFIG_BCMA_DRIVER_GMAC_CMN=y
+CONFIG_BCMA_DRIVER_GPIO=y
+CONFIG_BCMA_DRIVER_MIPS=y
+CONFIG_BCMA_DRIVER_PCI=y
+CONFIG_BCMA_DRIVER_PCI_HOSTMODE=y
+CONFIG_BCMA_HOST_PCI=y
+CONFIG_BCMA_HOST_PCI_POSSIBLE=y
+CONFIG_BCMA_HOST_SOC=y
+CONFIG_BCMA_NFLASH=y
+CONFIG_BCMA_PFLASH=y
+CONFIG_BCMA_SFLASH=y
+# CONFIG_BGMAC_BCMA is not set
+CONFIG_BLK_MQ_PCI=y
+CONFIG_CEVT_R4K=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CMDLINE="noinitrd console=ttyS0,115200"
+CONFIG_CMDLINE_BOOL=y
+# CONFIG_CMDLINE_OVERRIDE is not set
+# CONFIG_COMMON_CLK is not set
+CONFIG_COMPAT_32BIT_TIME=y
+# CONFIG_CPU_BMIPS is not set
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_MIPS32=y
+CONFIG_CPU_MIPS32_R1=y
+# CONFIG_CPU_MIPS32_R2 is not set
+CONFIG_CPU_MIPSR1=y
+CONFIG_CPU_MIPSR2_IRQ_VI=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CSRC_R4K=y
+CONFIG_DMA_NONCOHERENT=y
+# CONFIG_EARLY_PRINTK is not set
+CONFIG_FIXED_PHY=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_WDT=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDWARE_WATCHPOINTS=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HW_RANDOM=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+CONFIG_LEDS_GPIO_REGISTER=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+CONFIG_MIPS_CLOCK_VSYSCALL=y
+# CONFIG_MIPS_CMDLINE_BUILTIN_EXTEND is not set
+CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER=y
+CONFIG_MIPS_EBPF_JIT=y
+CONFIG_MIPS_L1_CACHE_SHIFT=5
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MTD_BCM47XXSFLASH=y
+CONFIG_MTD_BCM47XX_PARTS=y
+CONFIG_MTD_NAND_BCM47XXNFLASH=y
+CONFIG_MTD_NAND_BRCMNAND=y
+CONFIG_MTD_NAND_BRCMNAND_BCMA=y
+CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_PARSER_TRX=y
+CONFIG_MTD_PHYSMAP=y
+CONFIG_MTD_RAW_NAND=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_PER_CPU_KM=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NO_EXCEPT_FILL=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+# CONFIG_OF is not set
+CONFIG_PCI=y
+CONFIG_PCI_DISABLE_COMMON_QUIRKS=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DRIVERS_LEGACY=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SRCU=y
+CONFIG_SSB=y
+CONFIG_SSB_B43_PCI_BRIDGE=y
+CONFIG_SSB_BLOCKIO=y
+CONFIG_SSB_DRIVER_EXTIF=y
+CONFIG_SSB_DRIVER_GIGE=y
+CONFIG_SSB_DRIVER_GPIO=y
+CONFIG_SSB_DRIVER_MIPS=y
+CONFIG_SSB_DRIVER_PCICORE=y
+CONFIG_SSB_DRIVER_PCICORE_POSSIBLE=y
+CONFIG_SSB_EMBEDDED=y
+CONFIG_SSB_HOST_SOC=y
+CONFIG_SSB_PCICORE_HOSTMODE=y
+CONFIG_SSB_PCIHOST=y
+CONFIG_SSB_PCIHOST_POSSIBLE=y
+CONFIG_SSB_SERIAL=y
+CONFIG_SSB_SFLASH=y
+CONFIG_SSB_SPROM=y
+CONFIG_SWCONFIG=y
+CONFIG_SWCONFIG_B53=y
+CONFIG_SWCONFIG_B53_PHY_DRIVER=y
+CONFIG_SWCONFIG_B53_PHY_FIXUP=y
+CONFIG_SWPHY=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYS_HAS_CPU_BMIPS=y
+CONFIG_SYS_HAS_CPU_BMIPS32_3300=y
+CONFIG_SYS_HAS_CPU_MIPS32_R1=y
+CONFIG_SYS_HAS_CPU_MIPS32_R2=y
+CONFIG_SYS_HAS_EARLY_PRINTK=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_HIGHMEM=y
+CONFIG_SYS_SUPPORTS_LITTLE_ENDIAN=y
+CONFIG_SYS_SUPPORTS_MIPS16=y
+CONFIG_SYS_SUPPORTS_ZBOOT=y
+CONFIG_TARGET_ISA_REV=1
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TINY_SRCU=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_GENERIC_EARLY_PRINTK_8250=y
+CONFIG_WATCHDOG_CORE=y
diff --git a/target/linux/bcm47xx/generic/profiles/100-Broadcom-b43.mk b/target/linux/bcm47xx/generic/profiles/100-Broadcom-b43.mk
index 8ff95b4dd95208..a6c14cb33c42b8 100644
--- a/target/linux/bcm47xx/generic/profiles/100-Broadcom-b43.mk
+++ b/target/linux/bcm47xx/generic/profiles/100-Broadcom-b43.mk
@@ -4,13 +4,13 @@
 
 define Profile/Broadcom-b43
   NAME:=Broadcom SoC, all Ethernet, BCM43xx WiFi (b43, default)
-  PACKAGES:=kmod-b44 kmod-tg3 kmod-bgmac kmod-b43 kmod-b43legacy
+  PACKAGES:=kmod-b44 kmod-tg3 kmod-bgmac kmod-b43
 endef
 
 define Profile/Broadcom-b43/Description
 	Package set compatible with hardware any Broadcom BCM47xx or BCM535x
-	SoC with Broadcom BCM43xx Wifi cards using the mac80211, b43 and
-	b43legacy drivers and b44, tg3 or bgmac Ethernet driver.
+	SoC with Broadcom BCM43xx Wifi cards using the mac80211, b43 and b44,
+	tg3 or bgmac Ethernet driver.
 endef
 
 $(eval $(call Profile,Broadcom-b43))
diff --git a/target/linux/bcm47xx/generic/profiles/101-Broadcom-wl.mk b/target/linux/bcm47xx/generic/profiles/101-Broadcom-wl.mk
index 498bc7bfda7275..5bd3cd5031be3a 100644
--- a/target/linux/bcm47xx/generic/profiles/101-Broadcom-wl.mk
+++ b/target/linux/bcm47xx/generic/profiles/101-Broadcom-wl.mk
@@ -4,7 +4,7 @@
 
 define Profile/Broadcom-wl
   NAME:=Broadcom SoC, all Ethernet, BCM43xx WiFi (wl, proprietary)
-  PACKAGES:=-wpad-basic-wolfssl kmod-b44 kmod-tg3 kmod-bgmac kmod-brcm-wl wlc nas
+  PACKAGES:=-wpad-basic-mbedtls kmod-b44 kmod-tg3 kmod-bgmac kmod-brcm-wl wlc nas
 endef
 
 define Profile/Broadcom-wl/Description
diff --git a/target/linux/bcm47xx/generic/profiles/105-Broadcom-none.mk b/target/linux/bcm47xx/generic/profiles/105-Broadcom-none.mk
index 0b883825d0f63a..b90ee8c329ec21 100644
--- a/target/linux/bcm47xx/generic/profiles/105-Broadcom-none.mk
+++ b/target/linux/bcm47xx/generic/profiles/105-Broadcom-none.mk
@@ -4,7 +4,7 @@
 
 define Profile/Broadcom-none
   NAME:=Broadcom SoC, all Ethernet, No WiFi
-  PACKAGES:=-wpad-basic-wolfssl kmod-b44 kmod-tg3 kmod-bgmac
+  PACKAGES:=-wpad-basic-mbedtls kmod-b44 kmod-tg3 kmod-bgmac
 endef
 
 define Profile/Broadcom-none/Description
diff --git a/target/linux/bcm47xx/generic/profiles/200-Broadcom-b44-b43.mk b/target/linux/bcm47xx/generic/profiles/200-Broadcom-b44-b43.mk
index 0231bff642b4f3..a1f8a0efb3dba4 100644
--- a/target/linux/bcm47xx/generic/profiles/200-Broadcom-b44-b43.mk
+++ b/target/linux/bcm47xx/generic/profiles/200-Broadcom-b44-b43.mk
@@ -4,13 +4,13 @@
 
 define Profile/Broadcom-b44-b43
   NAME:=Broadcom SoC, b44 Ethernet, BCM43xx WiFi (b43, default)
-  PACKAGES:=kmod-b44 kmod-b43 kmod-b43legacy
+  PACKAGES:=kmod-b44 kmod-b43
 endef
 
 define Profile/Broadcom-b44-b43/Description
 	Package set compatible with hardware older Broadcom BCM47xx or BCM535x
 	SoC with Broadcom BCM43xx Wifi cards using the mac80211, b43 and
-	b43legacy drivers and b44 Ethernet driver.
+	b44 Ethernet driver.
 endef
 
 $(eval $(call Profile,Broadcom-b44-b43))
diff --git a/target/linux/bcm47xx/generic/profiles/201-Broadcom-b44-wl.mk b/target/linux/bcm47xx/generic/profiles/201-Broadcom-b44-wl.mk
index 5d55398dfc940a..8ae8e15ee5669f 100644
--- a/target/linux/bcm47xx/generic/profiles/201-Broadcom-b44-wl.mk
+++ b/target/linux/bcm47xx/generic/profiles/201-Broadcom-b44-wl.mk
@@ -4,7 +4,7 @@
 
 define Profile/Broadcom-b44-wl
   NAME:=Broadcom SoC, b44 Ethernet, BCM43xx WiFi (wl, proprietary)
-  PACKAGES:=-wpad-basic-wolfssl kmod-b44 kmod-brcm-wl wlc nas
+  PACKAGES:=-wpad-basic-mbedtls kmod-b44 kmod-brcm-wl wlc nas
 endef
 
 define Profile/Broadcom-b44-wl/Description
diff --git a/target/linux/bcm47xx/generic/profiles/205-Broadcom-b44-none.mk b/target/linux/bcm47xx/generic/profiles/205-Broadcom-b44-none.mk
index 79a223a316190b..6ae1767510be5c 100644
--- a/target/linux/bcm47xx/generic/profiles/205-Broadcom-b44-none.mk
+++ b/target/linux/bcm47xx/generic/profiles/205-Broadcom-b44-none.mk
@@ -4,7 +4,7 @@
 
 define Profile/Broadcom-b44-none
   NAME:=Broadcom SoC, b44 Ethernet, No WiFi
-  PACKAGES:=-wpad-basic-wolfssl kmod-b44
+  PACKAGES:=-wpad-basic-mbedtls kmod-b44
 endef
 
 define Profile/Broadcom-b44-none/Description
diff --git a/target/linux/bcm47xx/generic/profiles/211-Broadcom-tg3-wl.mk b/target/linux/bcm47xx/generic/profiles/211-Broadcom-tg3-wl.mk
index f594027662cc02..605c295d5e5fef 100644
--- a/target/linux/bcm47xx/generic/profiles/211-Broadcom-tg3-wl.mk
+++ b/target/linux/bcm47xx/generic/profiles/211-Broadcom-tg3-wl.mk
@@ -4,7 +4,7 @@
 
 define Profile/Broadcom-tg3-wl
   NAME:=Broadcom SoC, tg3 Ethernet, BCM43xx WiFi (wl, proprietary)
-  PACKAGES:=-wpad-basic-wolfssl kmod-brcm-wl wlc nas kmod-tg3
+  PACKAGES:=-wpad-basic-mbedtls kmod-brcm-wl wlc nas kmod-tg3
 endef
 
 define Profile/Broadcom-tg3-wl/Description
diff --git a/target/linux/bcm47xx/generic/profiles/215-Broadcom-tg3-none.mk b/target/linux/bcm47xx/generic/profiles/215-Broadcom-tg3-none.mk
index a75e49cb055487..3b66edd4b81de7 100644
--- a/target/linux/bcm47xx/generic/profiles/215-Broadcom-tg3-none.mk
+++ b/target/linux/bcm47xx/generic/profiles/215-Broadcom-tg3-none.mk
@@ -4,7 +4,7 @@
 
 define Profile/Broadcom-tg3-none
   NAME:=Broadcom SoC, tg3 Ethernet, no WiFi
-  PACKAGES:=-wpad-basic-wolfssl kmod-tg3
+  PACKAGES:=-wpad-basic-mbedtls kmod-tg3
 endef
 
 define Profile/Broadcom-tg3-none/Description
diff --git a/target/linux/bcm47xx/generic/profiles/221-Broadcom-bgmac-wl.mk b/target/linux/bcm47xx/generic/profiles/221-Broadcom-bgmac-wl.mk
index b426b99d37a346..264fed8a81a978 100644
--- a/target/linux/bcm47xx/generic/profiles/221-Broadcom-bgmac-wl.mk
+++ b/target/linux/bcm47xx/generic/profiles/221-Broadcom-bgmac-wl.mk
@@ -4,7 +4,7 @@
 
 define Profile/Broadcom-bgmac-wl
   NAME:=Broadcom SoC, bgmac Ethernet, BCM43xx WiFi (wl, proprietary)
-  PACKAGES:=-wpad-basic-wolfssl kmod-bgmac kmod-brcm-wl wlc nas
+  PACKAGES:=-wpad-basic-mbedtls kmod-bgmac kmod-brcm-wl wlc nas
 endef
 
 define Profile/Broadcom-bgmac-wl/Description
diff --git a/target/linux/bcm47xx/generic/profiles/225-Broadcom-bgmac-none.mk b/target/linux/bcm47xx/generic/profiles/225-Broadcom-bgmac-none.mk
index 8ce675543e4120..67cb64e6419036 100644
--- a/target/linux/bcm47xx/generic/profiles/225-Broadcom-bgmac-none.mk
+++ b/target/linux/bcm47xx/generic/profiles/225-Broadcom-bgmac-none.mk
@@ -4,7 +4,7 @@
 
 define Profile/Broadcom-bgmac-none
   NAME:=Broadcom SoC, bgmac Ethernet, No WiFi
-  PACKAGES:=-wpad-basic-wolfssl kmod-bgmac
+  PACKAGES:=-wpad-basic-mbedtls kmod-bgmac
 endef
 
 define Profile/Broadcom-bgmac-none/Description
diff --git a/target/linux/bcm47xx/generic/profiles/PS-1208MFG.mk b/target/linux/bcm47xx/generic/profiles/PS-1208MFG.mk
index 88b417840a7369..cc0136a8380b59 100644
--- a/target/linux/bcm47xx/generic/profiles/PS-1208MFG.mk
+++ b/target/linux/bcm47xx/generic/profiles/PS-1208MFG.mk
@@ -4,7 +4,7 @@
 
 define Profile/Ps1208mfg
   NAME:=Edimax PS-1208MFG
-  PACKAGES:=-firewall -dropbear -dnsmasq -mtd -ppp -wpad-basic-wolfssl kmod-b44 block-mount kmod-usb-storage kmod-usb2 kmod-usb-ohci -iptables -swconfig kmod-fs-ext4
+  PACKAGES:=-firewall -dropbear -dnsmasq -mtd -ppp -wpad-basic-mbedtls kmod-b44 block-mount kmod-usb-storage kmod-usb2 kmod-usb-ohci -iptables -swconfig kmod-fs-ext4
 endef
 
 define Profile/Ps1208mfg/Description
diff --git a/target/linux/bcm47xx/generic/target.mk b/target/linux/bcm47xx/generic/target.mk
index 70397de3989657..3edeef2a518152 100644
--- a/target/linux/bcm47xx/generic/target.mk
+++ b/target/linux/bcm47xx/generic/target.mk
@@ -1,7 +1,7 @@
 BOARDNAME:=Generic
 FEATURES+=pcmcia
 
-DEFAULT_PACKAGES += wpad-basic-wolfssl
+DEFAULT_PACKAGES += wpad-basic-mbedtls
 
 define Target/Description
 	Build generic firmware for all Broadcom BCM47xx and BCM53xx MIPS
diff --git a/target/linux/bcm47xx/image/generic.mk b/target/linux/bcm47xx/image/generic.mk
index 94064cb7d13c08..5cab0fa93285c7 100644
--- a/target/linux/bcm47xx/image/generic.mk
+++ b/target/linux/bcm47xx/image/generic.mk
@@ -10,6 +10,7 @@ define Device/linksys_wrt300n-v1.1
   $(Device/linksys)
   DEVICE_ID := EWC2
   VERSION := 1.51.2
+  DEFAULT := n
 endef
 TARGET_DEVICES += linksys_wrt300n-v1.1
 
@@ -20,6 +21,7 @@ define Device/linksys_wrt310n-v1
   $(Device/linksys)
   DEVICE_ID := 310N
   VERSION := 1.0.10
+  DEFAULT := n
 endef
 TARGET_DEVICES += linksys_wrt310n-v1
 
@@ -30,6 +32,7 @@ define Device/linksys_wrt350n-v1
   $(Device/linksys)
   DEVICE_ID := EWCG
   VERSION := 1.04.1
+  DEFAULT := n
 endef
 TARGET_DEVICES += linksys_wrt350n-v1
 
diff --git a/target/linux/bcm47xx/image/legacy.mk b/target/linux/bcm47xx/image/legacy.mk
index 4538813b911ceb..3c682d37e7eb67 100644
--- a/target/linux/bcm47xx/image/legacy.mk
+++ b/target/linux/bcm47xx/image/legacy.mk
@@ -4,9 +4,10 @@
 
 define Device/asus_wl-300g
   DEVICE_MODEL := WL-300g
-  DEVICE_PACKAGES := kmod-b43 kmod-b43legacy
+  DEVICE_PACKAGES := kmod-b43
   $(Device/asus)
   PRODUCTID := "WL300g      "
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_wl-300g
 
@@ -15,6 +16,7 @@ define Device/asus_wl-320gp
   DEVICE_PACKAGES := kmod-b43
   $(Device/asus)
   PRODUCTID := "WL320gP     "
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_wl-320gp
 
@@ -23,6 +25,7 @@ define Device/asus_wl-330ge
   DEVICE_PACKAGES := kmod-b43
   $(Device/asus)
   PRODUCTID := "WL-330gE    "
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_wl-330ge
 
@@ -31,6 +34,7 @@ define Device/asus_wl-500gd
   DEVICE_PACKAGES := kmod-b43 $(USB2_PACKAGES)
   $(Device/asus)
   PRODUCTID := "WL500gx     "
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_wl-500gd
 
@@ -40,6 +44,7 @@ define Device/asus_wl-500gp-v1
   DEVICE_PACKAGES := kmod-b43 $(USB2_PACKAGES)
   $(Device/asus)
   PRODUCTID := "WL500gp     "
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_wl-500gp-v1
 
@@ -49,6 +54,7 @@ define Device/asus_wl-500gp-v2
   DEVICE_PACKAGES := kmod-b43 $(USB2_PACKAGES)
   $(Device/asus)
   PRODUCTID := "WL500gpv2   "
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_wl-500gp-v2
 
@@ -57,6 +63,7 @@ define Device/asus_wl-500w
   DEVICE_PACKAGES := kmod-b43 kmod-usb-uhci kmod-usb2-pci
   $(Device/asus)
   PRODUCTID := "WL500W      "
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_wl-500w
 
@@ -65,6 +72,7 @@ define Device/asus_wl-520gu
   DEVICE_PACKAGES := kmod-b43 $(USB2_PACKAGES)
   $(Device/asus)
   PRODUCTID := "WL520gu     "
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_wl-520gu
 
@@ -73,14 +81,16 @@ define Device/asus_wl-550ge
   DEVICE_PACKAGES := kmod-b43
   $(Device/asus)
   PRODUCTID := "WL550gE     "
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_wl-550ge
 
 define Device/asus_wl-hdd25
   DEVICE_MODEL := WL-HDD25
-  DEVICE_PACKAGES := kmod-b43 kmod-b43legacy $(USB1_PACKAGES)
+  DEVICE_PACKAGES := kmod-b43 $(USB1_PACKAGES)
   $(Device/asus)
   PRODUCTID := "WLHDD       "
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_wl-hdd25
 
@@ -99,6 +109,7 @@ define Device/edimax_ps1208-mfg
   DEVICE_PACKAGES := kmod-b43 $(USB2_PACKAGES)
   IMAGES := bin
   IMAGE/bin := append-rootfs | trx-with-loader | edimax-bin
+  DEFAULT := n
 endef
 TARGET_DEVICES += edimax_ps1208-mfg
 
@@ -109,6 +120,7 @@ define Device/huawei_e970
   KERNEL_NAME = vmlinux.gz
   IMAGES := bin
   IMAGE/bin := append-rootfs | trx-without-loader | huawei-bin
+  DEFAULT := n
 endef
 TARGET_DEVICES += huawei_e970
 
@@ -118,6 +130,7 @@ define Device/linksys_wrt54g3g
   $(Device/linksys)
   DEVICE_ID := W54F
   VERSION := 2.20.1
+  DEFAULT := n
 endef
 TARGET_DEVICES += linksys_wrt54g3g
 
@@ -126,6 +139,7 @@ define Device/linksys_wrt54g3g-em
   $(Device/linksys)
   DEVICE_ID := W3GN
   VERSION := 2.20.1
+  DEFAULT := n
 endef
 TARGET_DEVICES += linksys_wrt54g3g-em
 
@@ -140,15 +154,17 @@ define Device/linksys_wrt54g3gv2-vf
   DEVICE_ID := 3G2V
   VERSION := 3.00.24
   SERIAL := 6
+  DEFAULT := n
 endef
 TARGET_DEVICES += linksys_wrt54g3gv2-vf
 
 define Device/linksys_wrt54g
   DEVICE_MODEL := WRT54G
-  DEVICE_PACKAGES := kmod-b43 kmod-b43legacy
+  DEVICE_PACKAGES := kmod-b43
   $(Device/linksys)
   DEVICE_ID := W54G
   VERSION := 4.71.1
+  DEFAULT := n
 endef
 TARGET_DEVICES += linksys_wrt54g
 
@@ -163,6 +179,7 @@ define Device/linksys_wrt54gs
   FILESYSTEMS := $(FS_128K)
   DEVICE_ID := W54S
   VERSION := 4.80.1
+  DEFAULT := n
 endef
 TARGET_DEVICES += linksys_wrt54gs
 
@@ -173,6 +190,7 @@ define Device/linksys_wrt54gs-v4
   $(Device/linksys)
   DEVICE_ID := W54s
   VERSION := 1.09.1
+  DEFAULT := n
 endef
 TARGET_DEVICES += linksys_wrt54gs-v4
 
@@ -183,6 +201,7 @@ define Device/linksys_wrtsl54gs
   FILESYSTEMS := $(FS_128K)
   DEVICE_ID := W54U
   VERSION := 2.08.1
+  DEFAULT := n
 endef
 TARGET_DEVICES += linksys_wrtsl54gs
 
@@ -192,6 +211,7 @@ define Device/linksys_wrt150n
   $(Device/linksys)
   DEVICE_ID := N150
   VERSION := 1.51.3
+  DEFAULT := n
 endef
 TARGET_DEVICES += linksys_wrt150n
 
@@ -202,6 +222,7 @@ define Device/linksys_wrt160n-v1
   $(Device/linksys)
   DEVICE_ID := N150
   VERSION := 1.50.1
+  DEFAULT := n
 endef
 TARGET_DEVICES += linksys_wrt160n-v1
 
@@ -213,30 +234,34 @@ define Device/linksys_wrt300n-v1
   IMAGES := bin trx
   DEVICE_ID := EWCB
   VERSION := 1.03.6
+  DEFAULT := n
 endef
 TARGET_DEVICES += linksys_wrt300n-v1
 
 define Device/motorola_wa840g
   DEVICE_MODEL := WA840G
-  DEVICE_PACKAGES := kmod-b43 kmod-b43legacy
+  DEVICE_PACKAGES := kmod-b43
   $(Device/motorola)
   MOTOROLA_DEVICE := 2
+  DEFAULT := n
 endef
 TARGET_DEVICES += motorola_wa840g
 
 define Device/motorola_we800g
   DEVICE_MODEL := WE800G
-  DEVICE_PACKAGES := kmod-b43 kmod-b43legacy
+  DEVICE_PACKAGES := kmod-b43
   $(Device/motorola)
   MOTOROLA_DEVICE := 3
+  DEFAULT := n
 endef
 TARGET_DEVICES += motorola_we800g
 
 define Device/motorola_wr850g
   DEVICE_MODEL := WR850G
-  DEVICE_PACKAGES := kmod-b43 kmod-b43legacy
+  DEVICE_PACKAGES := kmod-b43
   $(Device/motorola)
   MOTOROLA_DEVICE := 1
+  DEFAULT := n
 endef
 TARGET_DEVICES += motorola_wr850g
 
@@ -247,6 +272,7 @@ define Device/netgear_wgr614-v8
   $(Device/netgear)
   NETGEAR_BOARD_ID := U12H072T00_NETGEAR
   NETGEAR_REGION := 2
+  DEFAULT := n
 endef
 TARGET_DEVICES += netgear_wgr614-v8
 
@@ -257,6 +283,7 @@ define Device/netgear_wgt634u
   FILESYSTEMS := $(FS_128K)
   IMAGES := bin
   IMAGE/bin := append-rootfs | trx-with-loader | prepend-with-elf
+  DEFAULT := n
 endef
 TARGET_DEVICES += netgear_wgt634u
 
@@ -267,6 +294,7 @@ define Device/netgear_wndr3300-v1
   $(Device/netgear)
   NETGEAR_BOARD_ID := U12H093T00_NETGEAR
   NETGEAR_REGION := 2
+  DEFAULT := n
 endef
 TARGET_DEVICES += netgear_wndr3300-v1
 
@@ -277,6 +305,7 @@ define Device/netgear_wnr834b-v2
   $(Device/netgear)
   NETGEAR_BOARD_ID := U12H081T00_NETGEAR
   NETGEAR_REGION := 2
+  DEFAULT := n
 endef
 TARGET_DEVICES += netgear_wnr834b-v2
 
@@ -286,6 +315,7 @@ define Device/usrobotics_usr5461
   DEVICE_PACKAGES := kmod-b43 $(USB1_PACKAGES)
   IMAGES := bin
   IMAGE/bin := append-rootfs | trx-with-loader | usrobotics-bin
+  DEFAULT := n
 endef
 TARGET_DEVICES += usrobotics_usr5461
 
diff --git a/target/linux/bcm47xx/image/lzma-loader/src/Makefile b/target/linux/bcm47xx/image/lzma-loader/src/Makefile
index a3e7ae1c92ee07..0bad8dd9bb393b 100644
--- a/target/linux/bcm47xx/image/lzma-loader/src/Makefile
+++ b/target/linux/bcm47xx/image/lzma-loader/src/Makefile
@@ -18,8 +18,8 @@
 #
 
 TEXT_START	:= 0x80001000
-BZ_TEXT_START	:= 0x80700000
-BZ_STACK_START	:= 0x80800000
+BZ_TEXT_START	:= 0x80d00000
+BZ_STACK_START	:= 0x80e00000
 
 OBJCOPY		:= $(CROSS_COMPILE)objcopy -O binary -R .reginfo -R .note -R .comment -R .mdebug -S
 
diff --git a/target/linux/bcm47xx/image/mips74k.mk b/target/linux/bcm47xx/image/mips74k.mk
index 7e65821a5589cf..0f7610f3ddceeb 100644
--- a/target/linux/bcm47xx/image/mips74k.mk
+++ b/target/linux/bcm47xx/image/mips74k.mk
@@ -24,6 +24,7 @@ define Device/asus_rt-n10
   DEVICE_PACKAGES := kmod-b43
   $(Device/asus)
   PRODUCTID := "RT-N10      "
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_rt-n10
 
@@ -33,6 +34,7 @@ define Device/asus_rt-n10p
   DEVICE_PACKAGES := kmod-b43
   $(Device/asus)
   PRODUCTID := RT-N10P
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_rt-n10p
 
@@ -41,6 +43,7 @@ define Device/asus_rt-n10p-v2
   DEVICE_VARIANT := v2
   $(Device/asus)
   PRODUCTID := RT-N10PV2
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_rt-n10p-v2
 
@@ -50,6 +53,7 @@ define Device/asus_rt-n10u
   DEVICE_PACKAGES := kmod-b43 $(USB2_PACKAGES)
   $(Device/asus)
   PRODUCTID := RT-N10U
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_rt-n10u
 
@@ -59,6 +63,7 @@ define Device/asus_rt-n10u-b
   DEVICE_PACKAGES := kmod-b43 $(USB2_PACKAGES)
   $(Device/asus)
   PRODUCTID := RT-N10U
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_rt-n10u-b
 
@@ -68,6 +73,7 @@ define Device/asus_rt-n12
   DEVICE_PACKAGES := kmod-b43
   $(Device/asus)
   PRODUCTID := "RT-N12      "
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_rt-n12
 
@@ -76,6 +82,7 @@ define Device/asus_rt-n12-b1
   DEVICE_VARIANT := B1
   $(Device/asus)
   PRODUCTID := RT-N12B1
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_rt-n12-b1
 
@@ -84,6 +91,7 @@ define Device/asus_rt-n12-c1
   DEVICE_VARIANT := C1
   $(Device/asus)
   PRODUCTID := RT-N12C1
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_rt-n12-c1
 
@@ -92,6 +100,7 @@ define Device/asus_rt-n12-d1
   DEVICE_VARIANT := D1
   $(Device/asus)
   PRODUCTID := RT-N12D1
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_rt-n12-d1
 
@@ -99,6 +108,7 @@ define Device/asus_rt-n12hp
   DEVICE_MODEL := RT-N12HP
   $(Device/asus)
   PRODUCTID := RT-N12HP
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_rt-n12hp
 
@@ -131,6 +141,7 @@ define Device/asus_rt-n53
   DEVICE_PACKAGES := kmod-b43
   $(Device/asus)
   PRODUCTID := RT-N53
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_rt-n53
 
@@ -168,6 +179,7 @@ define Device/linksys_wrt310n-v2
   $(Device/linksys)
   DEVICE_ID := 310N
   VERSION := 2.0.1
+  DEFAULT := n
 endef
 TARGET_DEVICES += linksys_wrt310n-v2
 
@@ -178,6 +190,7 @@ define Device/linksys_wrt320n-v1
   $(Device/linksys)
   DEVICE_ID := 320N
   VERSION := 1.0.5
+  DEFAULT := n
 endef
 TARGET_DEVICES += linksys_wrt320n-v1
 
@@ -187,6 +200,7 @@ define Device/linksys_e900-v1
   $(Device/linksys)
   DEVICE_ID := E900
   VERSION := 1.0.4
+  DEFAULT := n
 endef
 TARGET_DEVICES += linksys_e900-v1
 
@@ -197,6 +211,7 @@ define Device/linksys_e1000
   $(Device/linksys)
   DEVICE_ID := E100
   VERSION := 1.1.3
+  DEFAULT := n
 endef
 TARGET_DEVICES += linksys_e1000
 
@@ -206,6 +221,7 @@ define Device/linksys_e1200-v1
   $(Device/linksys)
   DEVICE_ID := E120
   VERSION := 1.0.3
+  DEFAULT := n
 endef
 TARGET_DEVICES += linksys_e1200-v1
 
@@ -215,6 +231,7 @@ define Device/linksys_e1200-v2
   $(Device/linksys)
   DEVICE_ID := E122
   VERSION := 1.0.4
+  DEFAULT := n
 endef
 TARGET_DEVICES += linksys_e1200-v2
 
@@ -224,6 +241,7 @@ define Device/linksys_e1500-v1
   $(Device/linksys)
   DEVICE_ID := E150
   VERSION := 1.0.5
+  DEFAULT := n
 endef
 TARGET_DEVICES += linksys_e1500-v1
 
@@ -244,6 +262,7 @@ define Device/linksys_e2000-v1
   $(Device/linksys)
   DEVICE_ID := 32XN
   VERSION := 1.0.4
+  DEFAULT := n
 endef
 TARGET_DEVICES += linksys_e2000-v1
 
@@ -323,6 +342,7 @@ define Device/netgear_wgr614-v10-na
   $(Device/netgear)
   NETGEAR_BOARD_ID := U12H139T01_NETGEAR
   NETGEAR_REGION := 2
+  DEFAULT := n
 endef
 TARGET_DEVICES += netgear_wgr614-v10-na
 
@@ -332,6 +352,7 @@ define Device/netgear_wgr614-v10
   $(Device/netgear)
   NETGEAR_BOARD_ID := U12H139T01_NETGEAR
   NETGEAR_REGION := 1
+  DEFAULT := n
 endef
 TARGET_DEVICES += netgear_wgr614-v10
 
@@ -350,6 +371,7 @@ define Device/netgear_wn3000rp
   $(Device/netgear)
   NETGEAR_BOARD_ID := U12H163T01_NETGEAR
   NETGEAR_REGION := 1
+  DEFAULT := n
 endef
 TARGET_DEVICES += netgear_wn3000rp
 
@@ -420,6 +442,7 @@ define Device/netgear_wnr1000-v3
   $(Device/netgear)
   NETGEAR_BOARD_ID := U12H139T00_NETGEAR
   NETGEAR_REGION := 2
+  DEFAULT := n
 endef
 TARGET_DEVICES += netgear_wnr1000-v3
 
@@ -430,6 +453,7 @@ define Device/netgear_wnr2000v2
   $(Device/netgear)
   NETGEAR_BOARD_ID := U12H114T00_NETGEAR
   NETGEAR_REGION := 2
+  DEFAULT := n
 endef
 TARGET_DEVICES += netgear_wnr2000v2
 
@@ -482,6 +506,7 @@ define Device/netgear_wnr3500-v2
   $(Device/netgear)
   NETGEAR_BOARD_ID := U12H127T00_NETGEAR
   NETGEAR_REGION := 2
+  DEFAULT := n
 endef
 TARGET_DEVICES += netgear_wnr3500-v2
 
diff --git a/target/linux/bcm47xx/legacy/config-default b/target/linux/bcm47xx/legacy/config-default
index 8a52e475c7f405..b80b03b5cb7047 100644
--- a/target/linux/bcm47xx/legacy/config-default
+++ b/target/linux/bcm47xx/legacy/config-default
@@ -1,8 +1,8 @@
+CONFIG_ADM6996_PHY=y
 CONFIG_B44=y
 CONFIG_B44_PCI=y
 CONFIG_B44_PCICORE_AUTOSELECT=y
 CONFIG_B44_PCI_AUTOSELECT=y
 # CONFIG_BCM47XX_BCMA is not set
 # CONFIG_BCMA is not set
-# CONFIG_MTD_NAND is not set
 # CONFIG_SSB_DRIVER_GIGE is not set
diff --git a/target/linux/bcm47xx/legacy/profiles/100-Broadcom-b43.mk b/target/linux/bcm47xx/legacy/profiles/100-Broadcom-b43.mk
index c54f11bb89558c..691513728c107a 100644
--- a/target/linux/bcm47xx/legacy/profiles/100-Broadcom-b43.mk
+++ b/target/linux/bcm47xx/legacy/profiles/100-Broadcom-b43.mk
@@ -4,13 +4,13 @@
 
 define Profile/Broadcom-b43
   NAME:=Broadcom SoC, all Ethernet, BCM43xx WiFi (b43, default)
-  PACKAGES:=kmod-b43 kmod-b43legacy
+  PACKAGES:=kmod-b43
 endef
 
 define Profile/Broadcom-b43/Description
 	Package set compatible with hardware any Broadcom BCM47xx or BCM535x
 	SoC with Broadcom BCM43xx Wifi cards using the mac80211, b43 and
-	b43legacy drivers and b44, tg3 or bgmac Ethernet driver.
+	b44, tg3 or bgmac Ethernet driver.
 endef
 
 $(eval $(call Profile,Broadcom-b43))
diff --git a/target/linux/bcm47xx/legacy/profiles/101-Broadcom-wl.mk b/target/linux/bcm47xx/legacy/profiles/101-Broadcom-wl.mk
index a4c58f63345478..0d989815200353 100644
--- a/target/linux/bcm47xx/legacy/profiles/101-Broadcom-wl.mk
+++ b/target/linux/bcm47xx/legacy/profiles/101-Broadcom-wl.mk
@@ -4,7 +4,7 @@
 
 define Profile/Broadcom-wl
   NAME:=Broadcom SoC, all Ethernet, BCM43xx WiFi (wl, proprietary)
-  PACKAGES:=-wpad-basic-wolfssl kmod-brcm-wl-mini wlc nas
+  PACKAGES:=-wpad-basic-mbedtls kmod-brcm-wl-mini wlc nas
 endef
 
 define Profile/Broadcom-wl/Description
diff --git a/target/linux/bcm47xx/legacy/target.mk b/target/linux/bcm47xx/legacy/target.mk
index e3586a8add7263..ac89d798adcdea 100644
--- a/target/linux/bcm47xx/legacy/target.mk
+++ b/target/linux/bcm47xx/legacy/target.mk
@@ -1,7 +1,7 @@
 FEATURES += low_mem pcmcia small_flash
 BOARDNAME:=Legacy (BMIPS3300)
 
-DEFAULT_PACKAGES += wpad-basic-wolfssl
+DEFAULT_PACKAGES += wpad-basic-mbedtls
 
 define Target/Description
 	Build firmware for Broadcom BCM47xx and BCM53xx devices with
diff --git a/target/linux/bcm47xx/mips74k/config-default b/target/linux/bcm47xx/mips74k/config-default
index 2c3c40377ae30c..3ba49507d422c0 100644
--- a/target/linux/bcm47xx/mips74k/config-default
+++ b/target/linux/bcm47xx/mips74k/config-default
@@ -1,20 +1,16 @@
-# CONFIG_ADM6996_PHY is not set
 # CONFIG_BCM47XX_SSB is not set
 CONFIG_BGMAC=y
 CONFIG_BGMAC_BCMA=y
 CONFIG_BOUNCE=y
+CONFIG_CPU_HAS_DIEI=y
+CONFIG_CPU_HAS_RIXI=y
 # CONFIG_CPU_MIPS32_R1 is not set
-# CONFIG_CPU_MIPSR1 is not set
 CONFIG_CPU_MIPS32_R2=y
 CONFIG_CPU_MIPSR2=y
-# CONFIG_FIXED_PHY is not set
+CONFIG_CPU_SUPPORTS_MSA=y
 # CONFIG_GPIO_WDT is not set
 CONFIG_HIGHMEM=y
+CONFIG_KMAP_LOCAL=y
+CONFIG_MIPS_SPRAM=y
 # CONFIG_SSB is not set
-# CONFIG_SSB_DRIVER_EXTIF is not set
-# CONFIG_SSB_DRIVER_GIGE is not set
-# CONFIG_SSB_DRIVER_MIPS is not set
-# CONFIG_SSB_EMBEDDED is not set
-# CONFIG_SSB_PCICORE_HOSTMODE is not set
-# CONFIG_SSB_SERIAL is not set
-# CONFIG_SSB_SFLASH is not set
+CONFIG_TARGET_ISA_REV=2
diff --git a/target/linux/bcm47xx/mips74k/profiles/102-Broadcom-wl.mk b/target/linux/bcm47xx/mips74k/profiles/102-Broadcom-wl.mk
index 66a44dc0fbb79c..0b0e7067701304 100644
--- a/target/linux/bcm47xx/mips74k/profiles/102-Broadcom-wl.mk
+++ b/target/linux/bcm47xx/mips74k/profiles/102-Broadcom-wl.mk
@@ -4,7 +4,7 @@
 
 define Profile/Broadcom-mips74k-wl
   NAME:=Broadcom SoC, BCM43xx WiFi (proprietary wl)
-  PACKAGES:=-wpad-basic-wolfssl kmod-brcm-wl wlc nas
+  PACKAGES:=-wpad-basic-mbedtls kmod-brcm-wl wlc nas
 endef
 
 define Profile/Broadcom-mips74k-wl/Description
diff --git a/target/linux/bcm47xx/mips74k/profiles/103-Broadcom-none.mk b/target/linux/bcm47xx/mips74k/profiles/103-Broadcom-none.mk
index d5e3f57fcdfd23..d225e2fc70c9f3 100644
--- a/target/linux/bcm47xx/mips74k/profiles/103-Broadcom-none.mk
+++ b/target/linux/bcm47xx/mips74k/profiles/103-Broadcom-none.mk
@@ -4,7 +4,7 @@
 
 define Profile/Broadcom-mips74k-none
   NAME:=Broadcom SoC, No WiFi
-  PACKAGES:=-wpad-basic-wolfssl
+  PACKAGES:=-wpad-basic-mbedtls
 endef
 
 define Profile/Broadcom-mips74k-none/Description
diff --git a/target/linux/bcm47xx/mips74k/target.mk b/target/linux/bcm47xx/mips74k/target.mk
index ee20982e542afd..e982b15b0cbdc7 100644
--- a/target/linux/bcm47xx/mips74k/target.mk
+++ b/target/linux/bcm47xx/mips74k/target.mk
@@ -1,7 +1,7 @@
 BOARDNAME:=MIPS 74K
 CPU_TYPE:=74kc
 
-DEFAULT_PACKAGES += wpad-basic-wolfssl
+DEFAULT_PACKAGES += wpad-basic-mbedtls
 
 define Target/Description
 	Build firmware for Broadcom BCM47xx and BCM53xx devices with
diff --git a/target/linux/bcm47xx/patches-5.15/030-v5.17-0001-MIPS-BCM47XX-Define-Linksys-WRT310N-V2-buttons.patch b/target/linux/bcm47xx/patches-5.15/030-v5.17-0001-MIPS-BCM47XX-Define-Linksys-WRT310N-V2-buttons.patch
new file mode 100644
index 00000000000000..921825be5caa2b
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/030-v5.17-0001-MIPS-BCM47XX-Define-Linksys-WRT310N-V2-buttons.patch
@@ -0,0 +1,40 @@
+From eea175eedf3e2f71b9538d21e643e7a1be4923df Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Thu, 6 Jan 2022 19:51:37 -0800
+Subject: [PATCH] MIPS: BCM47XX: Define Linksys WRT310N V2 buttons
+
+Update the buttons registration code to register the two buttons (WPS,
+system rester) using the existing BCM47XX_BOARD_LINKSYS_WRT310NV2 board
+entry.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+---
+ arch/mips/bcm47xx/buttons.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/mips/bcm47xx/buttons.c
++++ b/arch/mips/bcm47xx/buttons.c
+@@ -277,6 +277,12 @@ bcm47xx_buttons_linksys_wrt310nv1[] __in
+ };
+ 
+ static const struct gpio_keys_button
++bcm47xx_buttons_linksys_wrt310n_v2[] __initconst = {
++	BCM47XX_GPIO_KEY(5, KEY_WPS_BUTTON),
++	BCM47XX_GPIO_KEY(6, KEY_RESTART),
++};
++
++static const struct gpio_keys_button
+ bcm47xx_buttons_linksys_wrt54g3gv2[] __initconst = {
+ 	BCM47XX_GPIO_KEY(5, KEY_WIMAX),
+ 	BCM47XX_GPIO_KEY(6, KEY_RESTART),
+@@ -608,6 +614,9 @@ int __init bcm47xx_buttons_register(void
+ 	case BCM47XX_BOARD_LINKSYS_WRT310NV1:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt310nv1);
+ 		break;
++	case BCM47XX_BOARD_LINKSYS_WRT310NV2:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt310n_v2);
++		break;
+ 	case BCM47XX_BOARD_LINKSYS_WRT54G3GV2:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt54g3gv2);
+ 		break;
diff --git a/target/linux/bcm47xx/patches-5.15/030-v5.17-0002-MIPS-BCM47XX-Add-board-entry-for-Linksys-WRT320N-v1.patch b/target/linux/bcm47xx/patches-5.15/030-v5.17-0002-MIPS-BCM47XX-Add-board-entry-for-Linksys-WRT320N-v1.patch
new file mode 100644
index 00000000000000..3fb013a58577ce
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/030-v5.17-0002-MIPS-BCM47XX-Add-board-entry-for-Linksys-WRT320N-v1.patch
@@ -0,0 +1,89 @@
+From 3829e4f10a232964cc728c0479c8097922e5e073 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Thu, 6 Jan 2022 19:51:38 -0800
+Subject: [PATCH] MIPS: BCM47XX: Add board entry for Linksys WRT320N v1
+
+This router is based on a Broadcom BCM4717A1 chipset and supports
+802.11n Wi-Fi. Add a board entry for that router and register LEDs and
+buttons accordingly.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+---
+ arch/mips/bcm47xx/board.c                          |  1 +
+ arch/mips/bcm47xx/buttons.c                        |  9 +++++++++
+ arch/mips/bcm47xx/leds.c                           | 10 ++++++++++
+ arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h |  1 +
+ 4 files changed, 21 insertions(+)
+
+--- a/arch/mips/bcm47xx/board.c
++++ b/arch/mips/bcm47xx/board.c
+@@ -141,6 +141,7 @@ struct bcm47xx_board_type_list2 bcm47xx_
+ 	{{BCM47XX_BOARD_LINKSYS_WRT300NV11, "Linksys WRT300N V1.1"}, "WRT300N", "1.1"},
+ 	{{BCM47XX_BOARD_LINKSYS_WRT310NV1, "Linksys WRT310N V1"}, "WRT310N", "1.0"},
+ 	{{BCM47XX_BOARD_LINKSYS_WRT310NV2, "Linksys WRT310N V2"}, "WRT310N", "2.0"},
++	{{BCM47XX_BOARD_LINKSYS_WRT320N_V1, "Linksys WRT320N V1"}, "WRT320N", "1.0"},
+ 	{{BCM47XX_BOARD_LINKSYS_WRT54G3GV2, "Linksys WRT54G3GV2-VF"}, "WRT54G3GV2-VF", "1.0"},
+ 	{{BCM47XX_BOARD_LINKSYS_WRT610NV1, "Linksys WRT610N V1"}, "WRT610N", "1.0"},
+ 	{{BCM47XX_BOARD_LINKSYS_WRT610NV2, "Linksys WRT610N V2"}, "WRT610N", "2.0"},
+--- a/arch/mips/bcm47xx/buttons.c
++++ b/arch/mips/bcm47xx/buttons.c
+@@ -283,6 +283,12 @@ bcm47xx_buttons_linksys_wrt310n_v2[] __i
+ };
+ 
+ static const struct gpio_keys_button
++bcm47xx_buttons_linksys_wrt320n_v1[] __initconst = {
++	BCM47XX_GPIO_KEY(5, KEY_WPS_BUTTON),
++	BCM47XX_GPIO_KEY(8, KEY_RESTART),
++};
++
++static const struct gpio_keys_button
+ bcm47xx_buttons_linksys_wrt54g3gv2[] __initconst = {
+ 	BCM47XX_GPIO_KEY(5, KEY_WIMAX),
+ 	BCM47XX_GPIO_KEY(6, KEY_RESTART),
+@@ -617,6 +623,9 @@ int __init bcm47xx_buttons_register(void
+ 	case BCM47XX_BOARD_LINKSYS_WRT310NV2:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt310n_v2);
+ 		break;
++	case BCM47XX_BOARD_LINKSYS_WRT320N_V1:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt320n_v1);
++		break;
+ 	case BCM47XX_BOARD_LINKSYS_WRT54G3GV2:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt54g3gv2);
+ 		break;
+--- a/arch/mips/bcm47xx/leds.c
++++ b/arch/mips/bcm47xx/leds.c
+@@ -314,6 +314,13 @@ bcm47xx_leds_linksys_wrt310nv1[] __initc
+ };
+ 
+ static const struct gpio_led
++bcm47xx_leds_linksys_wrt320n_v1[] __initconst = {
++	BCM47XX_GPIO_LED(1, "blue", "wlan", 1, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED(2, "blue", "power", 0, LEDS_GPIO_DEFSTATE_ON),
++	BCM47XX_GPIO_LED(4, "amber", "wps", 1, LEDS_GPIO_DEFSTATE_OFF),
++};
++
++static const struct gpio_led
+ bcm47xx_leds_linksys_wrt54g_generic[] __initconst = {
+ 	BCM47XX_GPIO_LED(0, "unk", "dmz", 1, LEDS_GPIO_DEFSTATE_OFF),
+ 	BCM47XX_GPIO_LED(1, "unk", "power", 0, LEDS_GPIO_DEFSTATE_ON),
+@@ -689,6 +696,9 @@ void __init bcm47xx_leds_register(void)
+ 	case BCM47XX_BOARD_LINKSYS_WRT310NV1:
+ 		bcm47xx_set_pdata(bcm47xx_leds_linksys_wrt310nv1);
+ 		break;
++	case BCM47XX_BOARD_LINKSYS_WRT320N_V1:
++		bcm47xx_set_pdata(bcm47xx_leds_linksys_wrt320n_v1);
++		break;
+ 	case BCM47XX_BOARD_LINKSYS_WRT54G3GV2:
+ 		bcm47xx_set_pdata(bcm47xx_leds_linksys_wrt54g3gv2);
+ 		break;
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
+@@ -72,6 +72,7 @@ enum bcm47xx_board {
+ 	BCM47XX_BOARD_LINKSYS_WRT300NV11,
+ 	BCM47XX_BOARD_LINKSYS_WRT310NV1,
+ 	BCM47XX_BOARD_LINKSYS_WRT310NV2,
++	BCM47XX_BOARD_LINKSYS_WRT320N_V1,
+ 	BCM47XX_BOARD_LINKSYS_WRT54G3GV2,
+ 	BCM47XX_BOARD_LINKSYS_WRT54G_TYPE_0101,
+ 	BCM47XX_BOARD_LINKSYS_WRT54G_TYPE_0467,
diff --git a/target/linux/bcm47xx/patches-5.15/030-v5.17-0003-MIPS-BCM47XX-Add-LEDs-and-buttons-for-Asus-RTN-10U.patch b/target/linux/bcm47xx/patches-5.15/030-v5.17-0003-MIPS-BCM47XX-Add-LEDs-and-buttons-for-Asus-RTN-10U.patch
new file mode 100644
index 00000000000000..c09140e99d026c
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/030-v5.17-0003-MIPS-BCM47XX-Add-LEDs-and-buttons-for-Asus-RTN-10U.patch
@@ -0,0 +1,67 @@
+From aecf89f2f8e8a604c33085c230a1f04ea325de64 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Thu, 6 Jan 2022 19:51:39 -0800
+Subject: [PATCH] MIPS: BCM47XX: Add LEDs and buttons for Asus RTN-10U
+
+Add the definitions for the buttons and LEDs used on the Asus RTN-10U
+router.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+---
+ arch/mips/bcm47xx/buttons.c |  9 +++++++++
+ arch/mips/bcm47xx/leds.c    | 11 +++++++++++
+ 2 files changed, 20 insertions(+)
+
+--- a/arch/mips/bcm47xx/buttons.c
++++ b/arch/mips/bcm47xx/buttons.c
+@@ -27,6 +27,12 @@
+ /* Asus */
+ 
+ static const struct gpio_keys_button
++bcm47xx_buttons_asus_rtn10u[] __initconst = {
++	BCM47XX_GPIO_KEY(20, KEY_WPS_BUTTON),
++	BCM47XX_GPIO_KEY(21, KEY_RESTART),
++};
++
++static const struct gpio_keys_button
+ bcm47xx_buttons_asus_rtn12[] __initconst = {
+ 	BCM47XX_GPIO_KEY(0, KEY_WPS_BUTTON),
+ 	BCM47XX_GPIO_KEY(1, KEY_RESTART),
+@@ -490,6 +496,9 @@ int __init bcm47xx_buttons_register(void
+ 	int err;
+ 
+ 	switch (board) {
++	case BCM47XX_BOARD_ASUS_RTN10U:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_rtn10u);
++		break;
+ 	case BCM47XX_BOARD_ASUS_RTN12:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_rtn12);
+ 		break;
+--- a/arch/mips/bcm47xx/leds.c
++++ b/arch/mips/bcm47xx/leds.c
+@@ -30,6 +30,14 @@
+ /* Asus */
+ 
+ static const struct gpio_led
++bcm47xx_leds_asus_rtn10u[] __initconst = {
++	BCM47XX_GPIO_LED(5, "green", "wlan", 0, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED(6, "green", "power", 1, LEDS_GPIO_DEFSTATE_ON),
++	BCM47XX_GPIO_LED(7, "green", "wps", 0, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED(8, "green", "usb", 0, LEDS_GPIO_DEFSTATE_OFF),
++};
++
++static const struct gpio_led
+ bcm47xx_leds_asus_rtn12[] __initconst = {
+ 	BCM47XX_GPIO_LED(2, "unk", "power", 1, LEDS_GPIO_DEFSTATE_ON),
+ 	BCM47XX_GPIO_LED(7, "unk", "wlan", 0, LEDS_GPIO_DEFSTATE_OFF),
+@@ -563,6 +571,9 @@ void __init bcm47xx_leds_register(void)
+ 	enum bcm47xx_board board = bcm47xx_board_get();
+ 
+ 	switch (board) {
++	case BCM47XX_BOARD_ASUS_RTN10U:
++		bcm47xx_set_pdata(bcm47xx_leds_asus_rtn10u);
++		break;
+ 	case BCM47XX_BOARD_ASUS_RTN12:
+ 		bcm47xx_set_pdata(bcm47xx_leds_asus_rtn12);
+ 		break;
diff --git a/target/linux/bcm47xx/patches-5.15/030-v5.17-0004-MIPS-BCM47XX-Add-support-for-Netgear-R6300-v1.patch b/target/linux/bcm47xx/patches-5.15/030-v5.17-0004-MIPS-BCM47XX-Add-support-for-Netgear-R6300-v1.patch
new file mode 100644
index 00000000000000..8740942d6f1553
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/030-v5.17-0004-MIPS-BCM47XX-Add-support-for-Netgear-R6300-v1.patch
@@ -0,0 +1,60 @@
+From 15e690af5cc3cd8f5d14ee2aa3a093f80196110e Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Thu, 6 Jan 2022 19:51:40 -0800
+Subject: [PATCH] MIPS: BCM47XX: Add support for Netgear R6300 v1
+
+Add support for the Netgear R6300 v1 Wi-Fi router using a Broadcom
+BCM4706 chipset and supporting 802.11n and 802.11ac.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+---
+ arch/mips/bcm47xx/board.c                          | 1 +
+ arch/mips/bcm47xx/buttons.c                        | 8 ++++++++
+ arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h | 1 +
+ 3 files changed, 10 insertions(+)
+
+--- a/arch/mips/bcm47xx/board.c
++++ b/arch/mips/bcm47xx/board.c
+@@ -162,6 +162,7 @@ struct bcm47xx_board_type_list1 bcm47xx_
+ 	{{BCM47XX_BOARD_LUXUL_XWR_600_V1, "Luxul XWR-600 V1"}, "luxul_xwr600_v1"},
+ 	{{BCM47XX_BOARD_LUXUL_XWR_1750_V1, "Luxul XWR-1750 V1"}, "luxul_xwr1750_v1"},
+ 	{{BCM47XX_BOARD_NETGEAR_R6200_V1, "Netgear R6200 V1"}, "U12H192T00_NETGEAR"},
++	{{BCM47XX_BOARD_NETGEAR_R6300_V1, "Netgear R6300 V1"}, "U12H218T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614V8, "Netgear WGR614 V8"}, "U12H072T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614V9, "Netgear WGR614 V9"}, "U12H094T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614_V10, "Netgear WGR614 V10"}, "U12H139T01_NETGEAR"},
+--- a/arch/mips/bcm47xx/buttons.c
++++ b/arch/mips/bcm47xx/buttons.c
+@@ -410,6 +410,11 @@ bcm47xx_buttons_netgear_r6200_v1[] __ini
+ };
+ 
+ static const struct gpio_keys_button
++bcm47xx_buttons_netgear_r6300_v1[] __initconst = {
++	BCM47XX_GPIO_KEY(6, KEY_RESTART),
++};
++
++static const struct gpio_keys_button
+ bcm47xx_buttons_netgear_wndr3400v1[] __initconst = {
+ 	BCM47XX_GPIO_KEY(4, KEY_RESTART),
+ 	BCM47XX_GPIO_KEY(6, KEY_WPS_BUTTON),
+@@ -701,6 +706,9 @@ int __init bcm47xx_buttons_register(void
+ 	case BCM47XX_BOARD_NETGEAR_R6200_V1:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_r6200_v1);
+ 		break;
++	case BCM47XX_BOARD_NETGEAR_R6300_V1:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_r6300_v1);
++		break;
+ 	case BCM47XX_BOARD_NETGEAR_WNDR3400V1:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wndr3400v1);
+ 		break;
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
+@@ -100,6 +100,7 @@ enum bcm47xx_board {
+ 	BCM47XX_BOARD_MOTOROLA_WR850GV2V3,
+ 
+ 	BCM47XX_BOARD_NETGEAR_R6200_V1,
++	BCM47XX_BOARD_NETGEAR_R6300_V1,
+ 	BCM47XX_BOARD_NETGEAR_WGR614V8,
+ 	BCM47XX_BOARD_NETGEAR_WGR614V9,
+ 	BCM47XX_BOARD_NETGEAR_WGR614_V10,
diff --git a/target/linux/bcm47xx/patches-5.15/030-v5.17-0005-MIPS-BCM47XX-Add-support-for-Netgear-WN2500RP-v1-v2.patch b/target/linux/bcm47xx/patches-5.15/030-v5.17-0005-MIPS-BCM47XX-Add-support-for-Netgear-WN2500RP-v1-v2.patch
new file mode 100644
index 00000000000000..6975bce9523208
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/030-v5.17-0005-MIPS-BCM47XX-Add-support-for-Netgear-WN2500RP-v1-v2.patch
@@ -0,0 +1,63 @@
+From 4da27b6d550427a0560a15df36de99cb17629216 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Thu, 6 Jan 2022 19:51:41 -0800
+Subject: [PATCH] MIPS: BCM47XX: Add support for Netgear WN2500RP v1 & v2
+
+Add support for the Netgear WN2500 RP v1 and v2 Wi-Fi range extenders
+based on the BCM5357 chipset and supporting 802.11n and 802.11ac.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+---
+ arch/mips/bcm47xx/board.c                          | 2 ++
+ arch/mips/bcm47xx/buttons.c                        | 9 +++++++++
+ arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h | 2 ++
+ 3 files changed, 13 insertions(+)
+
+--- a/arch/mips/bcm47xx/board.c
++++ b/arch/mips/bcm47xx/board.c
+@@ -166,6 +166,8 @@ struct bcm47xx_board_type_list1 bcm47xx_
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614V8, "Netgear WGR614 V8"}, "U12H072T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614V9, "Netgear WGR614 V9"}, "U12H094T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614_V10, "Netgear WGR614 V10"}, "U12H139T01_NETGEAR"},
++	{{BCM47XX_BOARD_NETGEAR_WN2500RP_V1, "Netgear WN2500RP V1"}, "U12H197T00_NETGEAR"},
++	{{BCM47XX_BOARD_NETGEAR_WN2500RP_V2, "Netgear WN2500RP V2"}, "U12H294T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNDR3300, "Netgear WNDR3300"}, "U12H093T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNDR3400V1, "Netgear WNDR3400 V1"}, "U12H155T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNDR3400V2, "Netgear WNDR3400 V2"}, "U12H187T00_NETGEAR"},
+--- a/arch/mips/bcm47xx/buttons.c
++++ b/arch/mips/bcm47xx/buttons.c
+@@ -415,6 +415,12 @@ bcm47xx_buttons_netgear_r6300_v1[] __ini
+ };
+ 
+ static const struct gpio_keys_button
++bcm47xx_buttons_netgear_wn2500rp_v1[] __initconst = {
++	BCM47XX_GPIO_KEY(12, KEY_RESTART),
++	BCM47XX_GPIO_KEY(31, KEY_WPS_BUTTON),
++};
++
++static const struct gpio_keys_button
+ bcm47xx_buttons_netgear_wndr3400v1[] __initconst = {
+ 	BCM47XX_GPIO_KEY(4, KEY_RESTART),
+ 	BCM47XX_GPIO_KEY(6, KEY_WPS_BUTTON),
+@@ -709,6 +715,9 @@ int __init bcm47xx_buttons_register(void
+ 	case BCM47XX_BOARD_NETGEAR_R6300_V1:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_r6300_v1);
+ 		break;
++	case BCM47XX_BOARD_NETGEAR_WN2500RP_V1:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wn2500rp_v1);
++		break;
+ 	case BCM47XX_BOARD_NETGEAR_WNDR3400V1:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wndr3400v1);
+ 		break;
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
+@@ -104,6 +104,8 @@ enum bcm47xx_board {
+ 	BCM47XX_BOARD_NETGEAR_WGR614V8,
+ 	BCM47XX_BOARD_NETGEAR_WGR614V9,
+ 	BCM47XX_BOARD_NETGEAR_WGR614_V10,
++	BCM47XX_BOARD_NETGEAR_WN2500RP_V1,
++	BCM47XX_BOARD_NETGEAR_WN2500RP_V2,
+ 	BCM47XX_BOARD_NETGEAR_WNDR3300,
+ 	BCM47XX_BOARD_NETGEAR_WNDR3400V1,
+ 	BCM47XX_BOARD_NETGEAR_WNDR3400V2,
diff --git a/target/linux/bcm47xx/patches-5.15/031-v6.0-MIPS-BCM47XX-Add-support-for-Netgear-WNR3500L-v2.patch b/target/linux/bcm47xx/patches-5.15/031-v6.0-MIPS-BCM47XX-Add-support-for-Netgear-WNR3500L-v2.patch
new file mode 100644
index 00000000000000..8c2233c804af7c
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/031-v6.0-MIPS-BCM47XX-Add-support-for-Netgear-WNR3500L-v2.patch
@@ -0,0 +1,109 @@
+From c022e87162219d67d687df22c977d1c2fc95fb42 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Thu, 14 Jul 2022 14:13:01 -0700
+Subject: [PATCH] MIPS: BCM47XX: Add support for Netgear WNR3500L v2
+
+Add support for the Netgear WNR3500L v2 router based on the BCM47186
+chipset and supporting 802.11n Wi-Fi.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+---
+ arch/mips/bcm47xx/board.c                          |  2 ++
+ arch/mips/bcm47xx/buttons.c                        | 10 ++++++++++
+ arch/mips/bcm47xx/leds.c                           | 11 +++++++++++
+ arch/mips/bcm47xx/workarounds.c                    |  1 +
+ arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h |  1 +
+ 5 files changed, 25 insertions(+)
+
+--- a/arch/mips/bcm47xx/board.c
++++ b/arch/mips/bcm47xx/board.c
+@@ -181,6 +181,7 @@ struct bcm47xx_board_type_list1 bcm47xx_
+ 	{{BCM47XX_BOARD_NETGEAR_WNR1000_V3, "Netgear WNR1000 V3"}, "U12H139T50_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNR2000, "Netgear WNR2000"}, "U12H114T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNR3500L, "Netgear WNR3500L"}, "U12H136T99_NETGEAR"},
++	{{BCM47XX_BOARD_NETGEAR_WNR3500L_V2, "Netgear WNR3500L V2"}, "U12H172T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNR3500U, "Netgear WNR3500U"}, "U12H136T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNR3500V2, "Netgear WNR3500 V2"}, "U12H127T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNR3500V2VC, "Netgear WNR3500 V2vc"}, "U12H127T70_NETGEAR"},
+@@ -195,6 +196,7 @@ struct bcm47xx_board_type_list3 bcm47xx_
+ 	{{BCM47XX_BOARD_PHICOMM_M1, "Phicomm M1"}, "0x0590", "80", "0x1104"},
+ 	{{BCM47XX_BOARD_ZTE_H218N, "ZTE H218N"}, "0x053d", "1234", "0x1305"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNR3500L, "Netgear WNR3500L"}, "0x04CF", "3500", "02"},
++	{{BCM47XX_BOARD_NETGEAR_WNR3500L_V2, "Netgear WNR3500L V2"}, "0x052b", "3500L", "02"},
+ 	{{BCM47XX_BOARD_LINKSYS_WRT54G_TYPE_0101, "Linksys WRT54G/GS/GL"}, "0x0101", "42", "0x10"},
+ 	{{BCM47XX_BOARD_LINKSYS_WRT54G_TYPE_0467, "Linksys WRT54G/GS/GL"}, "0x0467", "42", "0x10"},
+ 	{{BCM47XX_BOARD_LINKSYS_WRT54G_TYPE_0708, "Linksys WRT54G/GS/GL"}, "0x0708", "42", "0x10"},
+--- a/arch/mips/bcm47xx/buttons.c
++++ b/arch/mips/bcm47xx/buttons.c
+@@ -460,6 +460,13 @@ bcm47xx_buttons_netgear_wnr3500lv1[] __i
+ };
+ 
+ static const struct gpio_keys_button
++bcm47xx_buttons_netgear_wnr3500lv2[] __initconst = {
++	BCM47XX_GPIO_KEY(4, KEY_RESTART),
++	BCM47XX_GPIO_KEY(6, KEY_WPS_BUTTON),
++	BCM47XX_GPIO_KEY(8, KEY_RFKILL),
++};
++
++static const struct gpio_keys_button
+ bcm47xx_buttons_netgear_wnr834bv2[] __initconst = {
+ 	BCM47XX_GPIO_KEY(6, KEY_RESTART),
+ };
+@@ -736,6 +743,9 @@ int __init bcm47xx_buttons_register(void
+ 	case BCM47XX_BOARD_NETGEAR_WNR3500L:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wnr3500lv1);
+ 		break;
++	case BCM47XX_BOARD_NETGEAR_WNR3500L_V2:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wnr3500lv2);
++		break;
+ 	case BCM47XX_BOARD_NETGEAR_WNR834BV2:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wnr834bv2);
+ 		break;
+--- a/arch/mips/bcm47xx/leds.c
++++ b/arch/mips/bcm47xx/leds.c
+@@ -528,6 +528,14 @@ bcm47xx_leds_netgear_wnr3500lv1[] __init
+ };
+ 
+ static const struct gpio_led
++bcm47xx_leds_netgear_wnr3500lv2[] __initconst = {
++	BCM47XX_GPIO_LED(0, "blue", "wlan", 0, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED(1, "green", "wps", 0, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED(3, "green", "power", 0, LEDS_GPIO_DEFSTATE_ON),
++	BCM47XX_GPIO_LED(7, "amber", "power", 0, LEDS_GPIO_DEFSTATE_OFF),
++};
++
++static const struct gpio_led
+ bcm47xx_leds_netgear_wnr834bv2[] __initconst = {
+ 	BCM47XX_GPIO_LED(2, "green", "power", 0, LEDS_GPIO_DEFSTATE_ON),
+ 	BCM47XX_GPIO_LED(3, "amber", "power", 0, LEDS_GPIO_DEFSTATE_OFF),
+@@ -791,6 +799,9 @@ void __init bcm47xx_leds_register(void)
+ 	case BCM47XX_BOARD_NETGEAR_WNR3500L:
+ 		bcm47xx_set_pdata(bcm47xx_leds_netgear_wnr3500lv1);
+ 		break;
++	case BCM47XX_BOARD_NETGEAR_WNR3500L_V2:
++		bcm47xx_set_pdata(bcm47xx_leds_netgear_wnr3500lv2);
++		break;
+ 	case BCM47XX_BOARD_NETGEAR_WNR834BV2:
+ 		bcm47xx_set_pdata(bcm47xx_leds_netgear_wnr834bv2);
+ 		break;
+--- a/arch/mips/bcm47xx/workarounds.c
++++ b/arch/mips/bcm47xx/workarounds.c
+@@ -22,6 +22,7 @@ void __init bcm47xx_workarounds(void)
+ 
+ 	switch (board) {
+ 	case BCM47XX_BOARD_NETGEAR_WNR3500L:
++	case BCM47XX_BOARD_NETGEAR_WNR3500L_V2:
+ 		bcm47xx_workarounds_enable_usb_power(12);
+ 		break;
+ 	case BCM47XX_BOARD_NETGEAR_WNDR3400V2:
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
+@@ -118,6 +118,7 @@ enum bcm47xx_board {
+ 	BCM47XX_BOARD_NETGEAR_WNR1000_V3,
+ 	BCM47XX_BOARD_NETGEAR_WNR2000,
+ 	BCM47XX_BOARD_NETGEAR_WNR3500L,
++	BCM47XX_BOARD_NETGEAR_WNR3500L_V2,
+ 	BCM47XX_BOARD_NETGEAR_WNR3500U,
+ 	BCM47XX_BOARD_NETGEAR_WNR3500V2,
+ 	BCM47XX_BOARD_NETGEAR_WNR3500V2VC,
diff --git a/target/linux/bcm47xx/patches-5.15/032-v6.3-MIPS-BCM47XX-Add-support-for-Linksys-E2500-V3.patch b/target/linux/bcm47xx/patches-5.15/032-v6.3-MIPS-BCM47XX-Add-support-for-Linksys-E2500-V3.patch
new file mode 100644
index 00000000000000..4faecdc7d567ec
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/032-v6.3-MIPS-BCM47XX-Add-support-for-Linksys-E2500-V3.patch
@@ -0,0 +1,65 @@
+From fc605b914167de75432c3b5aae239fb191e84a31 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 8 Feb 2023 08:03:01 +0100
+Subject: [PATCH] MIPS: BCM47XX: Add support for Linksys E2500 V3
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+It's a BCM5358 based home WiFi router. 16 MiB flash, 64 MiB RAM, BCM5325
+switch, on-SoC 802.11n radio.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+---
+ arch/mips/bcm47xx/board.c                          | 1 +
+ arch/mips/bcm47xx/buttons.c                        | 9 +++++++++
+ arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h | 1 +
+ 3 files changed, 11 insertions(+)
+
+--- a/arch/mips/bcm47xx/board.c
++++ b/arch/mips/bcm47xx/board.c
+@@ -130,6 +130,7 @@ struct bcm47xx_board_type_list2 bcm47xx_
+ 	{{BCM47XX_BOARD_LINKSYS_E1000V21, "Linksys E1000 V2.1"}, "E1000", "2.1"},
+ 	{{BCM47XX_BOARD_LINKSYS_E1200V2, "Linksys E1200 V2"}, "E1200", "2.0"},
+ 	{{BCM47XX_BOARD_LINKSYS_E2000V1, "Linksys E2000 V1"}, "Linksys E2000", "1.0"},
++	{{BCM47XX_BOARD_LINKSYS_E2500V3, "Linksys E2500 V3"}, "E2500", "1.0"},
+ 	/* like WRT610N v2.0 */
+ 	{{BCM47XX_BOARD_LINKSYS_E3000V1, "Linksys E3000 V1"}, "E300", "1.0"},
+ 	{{BCM47XX_BOARD_LINKSYS_E3200V1, "Linksys E3200 V1"}, "E3200", "1.0"},
+--- a/arch/mips/bcm47xx/buttons.c
++++ b/arch/mips/bcm47xx/buttons.c
+@@ -223,6 +223,12 @@ bcm47xx_buttons_linksys_e2000v1[] __init
+ };
+ 
+ static const struct gpio_keys_button
++bcm47xx_buttons_linksys_e2500v3[] __initconst = {
++	BCM47XX_GPIO_KEY(9, KEY_WPS_BUTTON),
++	BCM47XX_GPIO_KEY(10, KEY_RESTART),
++};
++
++static const struct gpio_keys_button
+ bcm47xx_buttons_linksys_e3000v1[] __initconst = {
+ 	BCM47XX_GPIO_KEY(4, KEY_WPS_BUTTON),
+ 	BCM47XX_GPIO_KEY(6, KEY_RESTART),
+@@ -617,6 +623,9 @@ int __init bcm47xx_buttons_register(void
+ 	case BCM47XX_BOARD_LINKSYS_E2000V1:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_e2000v1);
+ 		break;
++	case BCM47XX_BOARD_LINKSYS_E2500V3:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_e2500v3);
++		break;
+ 	case BCM47XX_BOARD_LINKSYS_E3000V1:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_e3000v1);
+ 		break;
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
+@@ -61,6 +61,7 @@ enum bcm47xx_board {
+ 	BCM47XX_BOARD_LINKSYS_E1000V21,
+ 	BCM47XX_BOARD_LINKSYS_E1200V2,
+ 	BCM47XX_BOARD_LINKSYS_E2000V1,
++	BCM47XX_BOARD_LINKSYS_E2500V3,
+ 	BCM47XX_BOARD_LINKSYS_E3000V1,
+ 	BCM47XX_BOARD_LINKSYS_E3200V1,
+ 	BCM47XX_BOARD_LINKSYS_E4200V1,
diff --git a/target/linux/bcm47xx/patches-5.15/100-v5.18-mtd-rawnand-brcmnand-Assign-soc-as-early-as-possible.patch b/target/linux/bcm47xx/patches-5.15/100-v5.18-mtd-rawnand-brcmnand-Assign-soc-as-early-as-possible.patch
new file mode 100644
index 00000000000000..a87d6acd0caf3b
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/100-v5.18-mtd-rawnand-brcmnand-Assign-soc-as-early-as-possible.patch
@@ -0,0 +1,33 @@
+From: Florian Fainelli <f.fainelli@gmail.com>
+Subject: [PATCH v3 1/9] mtd: rawnand: brcmnand: Assign soc as early as possible
+Date: Fri, 07 Jan 2022 10:46:06 -0800
+Content-Type: text/plain; charset="utf-8"
+
+In order to key off the brcmnand_probe() code in subsequent changes
+depending upon ctrl->soc, assign that variable as early as possible,
+instead of much later when we have checked that it is non-NULL.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ drivers/mtd/nand/raw/brcmnand/brcmnand.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+@@ -2998,6 +2998,7 @@ int brcmnand_probe(struct platform_devic
+ 
+ 	dev_set_drvdata(dev, ctrl);
+ 	ctrl->dev = dev;
++	ctrl->soc = soc;
+ 
+ 	init_completion(&ctrl->done);
+ 	init_completion(&ctrl->dma_done);
+@@ -3138,8 +3139,6 @@ int brcmnand_probe(struct platform_devic
+ 	 * interesting ways
+ 	 */
+ 	if (soc) {
+-		ctrl->soc = soc;
+-
+ 		ret = devm_request_irq(dev, ctrl->irq, brcmnand_irq, 0,
+ 				       DRV_NAME, ctrl);
+ 
diff --git a/target/linux/bcm47xx/patches-5.15/101-v5.18-mtd-rawnand-brcmnand-Allow-SoC-to-provide-I-O-operations.patch b/target/linux/bcm47xx/patches-5.15/101-v5.18-mtd-rawnand-brcmnand-Allow-SoC-to-provide-I-O-operations.patch
new file mode 100644
index 00000000000000..8da25358655312
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/101-v5.18-mtd-rawnand-brcmnand-Allow-SoC-to-provide-I-O-operations.patch
@@ -0,0 +1,150 @@
+From: Florian Fainelli <f.fainelli@gmail.com>
+Subject: [PATCH v3 2/9] mtd: rawnand: brcmnand: Allow SoC to provide I/O operations
+Date: Fri, 07 Jan 2022 10:46:07 -0800
+Content-Type: text/plain; charset="utf-8"
+
+Allow a brcmnand_soc instance to provide a custom set of I/O operations
+which we will require when using this driver on a BCMA bus which is not
+directly memory mapped I/O. Update the nand_{read,write}_reg accordingly
+to use the SoC operations if provided.
+
+To minimize the penalty on other SoCs which do support standard MMIO
+accesses, we use a static key which is disabled by default and gets
+enabled if a soc implementation does provide I/O operations.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ drivers/mtd/nand/raw/brcmnand/brcmnand.c | 28 +++++++++++++++++++++--
+ drivers/mtd/nand/raw/brcmnand/brcmnand.h | 29 ++++++++++++++++++++++++
+ 2 files changed, 55 insertions(+), 2 deletions(-)
+
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+@@ -25,6 +25,7 @@
+ #include <linux/of.h>
+ #include <linux/of_platform.h>
+ #include <linux/slab.h>
++#include <linux/static_key.h>
+ #include <linux/list.h>
+ #include <linux/log2.h>
+ 
+@@ -207,6 +208,8 @@ enum {
+ 
+ struct brcmnand_host;
+ 
++static DEFINE_STATIC_KEY_FALSE(brcmnand_soc_has_ops_key);
++
+ struct brcmnand_controller {
+ 	struct device		*dev;
+ 	struct nand_controller	controller;
+@@ -592,15 +595,25 @@ enum {
+ 	INTFC_CTLR_READY		= BIT(31),
+ };
+ 
++static inline bool brcmnand_non_mmio_ops(struct brcmnand_controller *ctrl)
++{
++	return static_branch_unlikely(&brcmnand_soc_has_ops_key);
++}
++
+ static inline u32 nand_readreg(struct brcmnand_controller *ctrl, u32 offs)
+ {
++	if (brcmnand_non_mmio_ops(ctrl))
++		return brcmnand_soc_read(ctrl->soc, offs);
+ 	return brcmnand_readl(ctrl->nand_base + offs);
+ }
+ 
+ static inline void nand_writereg(struct brcmnand_controller *ctrl, u32 offs,
+ 				 u32 val)
+ {
+-	brcmnand_writel(val, ctrl->nand_base + offs);
++	if (brcmnand_non_mmio_ops(ctrl))
++		brcmnand_soc_write(ctrl->soc, val, offs);
++	else
++		brcmnand_writel(val, ctrl->nand_base + offs);
+ }
+ 
+ static int brcmnand_revision_init(struct brcmnand_controller *ctrl)
+@@ -766,13 +779,18 @@ static inline void brcmnand_rmw_reg(stru
+ 
+ static inline u32 brcmnand_read_fc(struct brcmnand_controller *ctrl, int word)
+ {
++	if (brcmnand_non_mmio_ops(ctrl))
++		return brcmnand_soc_read(ctrl->soc, BRCMNAND_NON_MMIO_FC_ADDR);
+ 	return __raw_readl(ctrl->nand_fc + word * 4);
+ }
+ 
+ static inline void brcmnand_write_fc(struct brcmnand_controller *ctrl,
+ 				     int word, u32 val)
+ {
+-	__raw_writel(val, ctrl->nand_fc + word * 4);
++	if (brcmnand_non_mmio_ops(ctrl))
++		brcmnand_soc_write(ctrl->soc, val, BRCMNAND_NON_MMIO_FC_ADDR);
++	else
++		__raw_writel(val, ctrl->nand_fc + word * 4);
+ }
+ 
+ static inline void edu_writel(struct brcmnand_controller *ctrl,
+@@ -3000,6 +3018,12 @@ int brcmnand_probe(struct platform_devic
+ 	ctrl->dev = dev;
+ 	ctrl->soc = soc;
+ 
++	/* Enable the static key if the soc provides I/O operations indicating
++	 * that a non-memory mapped IO access path must be used
++	 */
++	if (brcmnand_soc_has_ops(ctrl->soc))
++		static_branch_enable(&brcmnand_soc_has_ops_key);
++
+ 	init_completion(&ctrl->done);
+ 	init_completion(&ctrl->dma_done);
+ 	init_completion(&ctrl->edu_done);
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.h
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.h
+@@ -11,12 +11,25 @@
+ 
+ struct platform_device;
+ struct dev_pm_ops;
++struct brcmnand_io_ops;
++
++/* Special register offset constant to intercept a non-MMIO access
++ * to the flash cache register space. This is intentionally large
++ * not to overlap with an existing offset.
++ */
++#define BRCMNAND_NON_MMIO_FC_ADDR	0xffffffff
+ 
+ struct brcmnand_soc {
+ 	bool (*ctlrdy_ack)(struct brcmnand_soc *soc);
+ 	void (*ctlrdy_set_enabled)(struct brcmnand_soc *soc, bool en);
+ 	void (*prepare_data_bus)(struct brcmnand_soc *soc, bool prepare,
+ 				 bool is_param);
++	const struct brcmnand_io_ops *ops;
++};
++
++struct brcmnand_io_ops {
++	u32 (*read_reg)(struct brcmnand_soc *soc, u32 offset);
++	void (*write_reg)(struct brcmnand_soc *soc, u32 val, u32 offset);
+ };
+ 
+ static inline void brcmnand_soc_data_bus_prepare(struct brcmnand_soc *soc,
+@@ -58,6 +71,22 @@ static inline void brcmnand_writel(u32 v
+ 		writel_relaxed(val, addr);
+ }
+ 
++static inline bool brcmnand_soc_has_ops(struct brcmnand_soc *soc)
++{
++	return soc && soc->ops && soc->ops->read_reg && soc->ops->write_reg;
++}
++
++static inline u32 brcmnand_soc_read(struct brcmnand_soc *soc, u32 offset)
++{
++	return soc->ops->read_reg(soc, offset);
++}
++
++static inline void brcmnand_soc_write(struct brcmnand_soc *soc, u32 val,
++				      u32 offset)
++{
++	soc->ops->write_reg(soc, val, offset);
++}
++
+ int brcmnand_probe(struct platform_device *pdev, struct brcmnand_soc *soc);
+ int brcmnand_remove(struct platform_device *pdev);
+ 
diff --git a/target/linux/bcm47xx/patches-5.15/102-v5.18-mtd-rawnand-brcmnand-Avoid-pdev-in-brcmnand_init_cs.patch b/target/linux/bcm47xx/patches-5.15/102-v5.18-mtd-rawnand-brcmnand-Avoid-pdev-in-brcmnand_init_cs.patch
new file mode 100644
index 00000000000000..d7eab183d6c616
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/102-v5.18-mtd-rawnand-brcmnand-Avoid-pdev-in-brcmnand_init_cs.patch
@@ -0,0 +1,52 @@
+From: Florian Fainelli <f.fainelli@gmail.com>
+Subject: [PATCH v3 3/9] mtd: rawnand: brcmnand: Avoid pdev in brcmnand_init_cs()
+Date: Fri, 07 Jan 2022 10:46:08 -0800
+Content-Type: text/plain; charset="utf-8"
+
+In preparation for encapsulating more of what the loop calling
+brcmnand_init_cs() does, avoid using platform_device when it is the
+device behind platform_device that we are using for printing errors.
+
+No functional changes introduced.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ drivers/mtd/nand/raw/brcmnand/brcmnand.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+@@ -2771,7 +2771,7 @@ static const struct nand_controller_ops
+ static int brcmnand_init_cs(struct brcmnand_host *host, struct device_node *dn)
+ {
+ 	struct brcmnand_controller *ctrl = host->ctrl;
+-	struct platform_device *pdev = host->pdev;
++	struct device *dev = ctrl->dev;
+ 	struct mtd_info *mtd;
+ 	struct nand_chip *chip;
+ 	int ret;
+@@ -2779,7 +2779,7 @@ static int brcmnand_init_cs(struct brcmn
+ 
+ 	ret = of_property_read_u32(dn, "reg", &host->cs);
+ 	if (ret) {
+-		dev_err(&pdev->dev, "can't get chip-select\n");
++		dev_err(dev, "can't get chip-select\n");
+ 		return -ENXIO;
+ 	}
+ 
+@@ -2788,13 +2788,13 @@ static int brcmnand_init_cs(struct brcmn
+ 
+ 	nand_set_flash_node(chip, dn);
+ 	nand_set_controller_data(chip, host);
+-	mtd->name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "brcmnand.%d",
++	mtd->name = devm_kasprintf(dev, GFP_KERNEL, "brcmnand.%d",
+ 				   host->cs);
+ 	if (!mtd->name)
+ 		return -ENOMEM;
+ 
+ 	mtd->owner = THIS_MODULE;
+-	mtd->dev.parent = &pdev->dev;
++	mtd->dev.parent = dev;
+ 
+ 	chip->legacy.cmd_ctrl = brcmnand_cmd_ctrl;
+ 	chip->legacy.cmdfunc = brcmnand_cmdfunc;
diff --git a/target/linux/bcm47xx/patches-5.15/103-v5.18-mtd-rawnand-brcmnand-Move-OF-operations-out-of-brcmnand_init_cs.patch b/target/linux/bcm47xx/patches-5.15/103-v5.18-mtd-rawnand-brcmnand-Move-OF-operations-out-of-brcmnand_init_cs.patch
new file mode 100644
index 00000000000000..e2fa72add1c4af
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/103-v5.18-mtd-rawnand-brcmnand-Move-OF-operations-out-of-brcmnand_init_cs.patch
@@ -0,0 +1,63 @@
+From: Florian Fainelli <f.fainelli@gmail.com>
+Subject: [PATCH v3 4/9] mtd: rawnand: brcmnand: Move OF operations out of brcmnand_init_cs()
+Date: Fri, 07 Jan 2022 10:46:09 -0800
+Content-Type: text/plain; charset="utf-8"
+
+In order to initialize a given chip select object for use by the
+brcmnand driver, move all of the Device Tree specific routines outside
+of brcmnand_init_cs() in order to make it usable in a platform data
+configuration which will be necessary for supporting BCMA chips.
+
+No functional changes introduced.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ drivers/mtd/nand/raw/brcmnand/brcmnand.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+@@ -2768,7 +2768,7 @@ static const struct nand_controller_ops
+ 	.attach_chip = brcmnand_attach_chip,
+ };
+ 
+-static int brcmnand_init_cs(struct brcmnand_host *host, struct device_node *dn)
++static int brcmnand_init_cs(struct brcmnand_host *host)
+ {
+ 	struct brcmnand_controller *ctrl = host->ctrl;
+ 	struct device *dev = ctrl->dev;
+@@ -2777,16 +2777,9 @@ static int brcmnand_init_cs(struct brcmn
+ 	int ret;
+ 	u16 cfg_offs;
+ 
+-	ret = of_property_read_u32(dn, "reg", &host->cs);
+-	if (ret) {
+-		dev_err(dev, "can't get chip-select\n");
+-		return -ENXIO;
+-	}
+-
+ 	mtd = nand_to_mtd(&host->chip);
+ 	chip = &host->chip;
+ 
+-	nand_set_flash_node(chip, dn);
+ 	nand_set_controller_data(chip, host);
+ 	mtd->name = devm_kasprintf(dev, GFP_KERNEL, "brcmnand.%d",
+ 				   host->cs);
+@@ -3193,7 +3186,16 @@ int brcmnand_probe(struct platform_devic
+ 			host->pdev = pdev;
+ 			host->ctrl = ctrl;
+ 
+-			ret = brcmnand_init_cs(host, child);
++			ret = of_property_read_u32(child, "reg", &host->cs);
++			if (ret) {
++				dev_err(dev, "can't get chip-select\n");
++				devm_kfree(dev, host);
++				continue;
++			}
++
++			nand_set_flash_node(&host->chip, child);
++
++			ret = brcmnand_init_cs(host);
+ 			if (ret) {
+ 				devm_kfree(dev, host);
+ 				continue; /* Try all chip-selects */
diff --git a/target/linux/bcm47xx/patches-5.15/104-v5.18-mtd-rawnand-brcmnand-Allow-working-without-interrupts.patch b/target/linux/bcm47xx/patches-5.15/104-v5.18-mtd-rawnand-brcmnand-Allow-working-without-interrupts.patch
new file mode 100644
index 00000000000000..bdf325d732eb05
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/104-v5.18-mtd-rawnand-brcmnand-Allow-working-without-interrupts.patch
@@ -0,0 +1,91 @@
+From: Florian Fainelli <f.fainelli@gmail.com>
+Subject: [PATCH v3 5/9] mtd: rawnand: brcmnand: Allow working without interrupts
+Date: Fri, 07 Jan 2022 10:46:10 -0800
+Content-Type: text/plain; charset="utf-8"
+
+The BCMA devices include the brcmnand controller but they do not wire up
+any interrupt line, allow the main interrupt to be optional and update
+the completion path to also check for the lack of an interrupt line.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ drivers/mtd/nand/raw/brcmnand/brcmnand.c | 52 +++++++++++-------------
+ 1 file changed, 24 insertions(+), 28 deletions(-)
+
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+@@ -216,7 +216,7 @@ struct brcmnand_controller {
+ 	void __iomem		*nand_base;
+ 	void __iomem		*nand_fc; /* flash cache */
+ 	void __iomem		*flash_dma_base;
+-	unsigned int		irq;
++	int			irq;
+ 	unsigned int		dma_irq;
+ 	int			nand_version;
+ 
+@@ -1610,7 +1610,7 @@ static bool brcmstb_nand_wait_for_comple
+ 	bool err = false;
+ 	int sts;
+ 
+-	if (mtd->oops_panic_write) {
++	if (mtd->oops_panic_write || ctrl->irq < 0) {
+ 		/* switch to interrupt polling and PIO mode */
+ 		disable_ctrl_irqs(ctrl);
+ 		sts = bcmnand_ctrl_poll_status(ctrl, NAND_CTRL_RDY,
+@@ -3144,33 +3144,29 @@ int brcmnand_probe(struct platform_devic
+ 	}
+ 
+ 	/* IRQ */
+-	ctrl->irq = platform_get_irq(pdev, 0);
+-	if ((int)ctrl->irq < 0) {
+-		dev_err(dev, "no IRQ defined\n");
+-		ret = -ENODEV;
+-		goto err;
+-	}
+-
+-	/*
+-	 * Some SoCs integrate this controller (e.g., its interrupt bits) in
+-	 * interesting ways
+-	 */
+-	if (soc) {
+-		ret = devm_request_irq(dev, ctrl->irq, brcmnand_irq, 0,
+-				       DRV_NAME, ctrl);
+-
+-		/* Enable interrupt */
+-		ctrl->soc->ctlrdy_ack(ctrl->soc);
+-		ctrl->soc->ctlrdy_set_enabled(ctrl->soc, true);
+-	} else {
+-		/* Use standard interrupt infrastructure */
+-		ret = devm_request_irq(dev, ctrl->irq, brcmnand_ctlrdy_irq, 0,
+-				       DRV_NAME, ctrl);
+-	}
+-	if (ret < 0) {
+-		dev_err(dev, "can't allocate IRQ %d: error %d\n",
+-			ctrl->irq, ret);
+-		goto err;
++	ctrl->irq = platform_get_irq_optional(pdev, 0);
++	if (ctrl->irq > 0) {
++		/*
++		 * Some SoCs integrate this controller (e.g., its interrupt bits) in
++		 * interesting ways
++		 */
++		if (soc) {
++			ret = devm_request_irq(dev, ctrl->irq, brcmnand_irq, 0,
++					       DRV_NAME, ctrl);
++
++			/* Enable interrupt */
++			ctrl->soc->ctlrdy_ack(ctrl->soc);
++			ctrl->soc->ctlrdy_set_enabled(ctrl->soc, true);
++		} else {
++			/* Use standard interrupt infrastructure */
++			ret = devm_request_irq(dev, ctrl->irq, brcmnand_ctlrdy_irq, 0,
++					       DRV_NAME, ctrl);
++		}
++		if (ret < 0) {
++			dev_err(dev, "can't allocate IRQ %d: error %d\n",
++				ctrl->irq, ret);
++			goto err;
++		}
+ 	}
+ 
+ 	for_each_available_child_of_node(dn, child) {
diff --git a/target/linux/bcm47xx/patches-5.15/105-v5.18-mtd-rawnand-brcmnand-Add-platform-data-structure-for-BCMA.patch b/target/linux/bcm47xx/patches-5.15/105-v5.18-mtd-rawnand-brcmnand-Add-platform-data-structure-for-BCMA.patch
new file mode 100644
index 00000000000000..56c686f3083b64
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/105-v5.18-mtd-rawnand-brcmnand-Add-platform-data-structure-for-BCMA.patch
@@ -0,0 +1,115 @@
+From: Florian Fainelli <f.fainelli@gmail.com>
+Subject: [PATCH v3 6/9] mtd: rawnand: brcmnand: Add platform data structure for BCMA
+Date: Fri, 07 Jan 2022 10:46:11 -0800
+Content-Type: text/plain; charset="utf-8"
+
+Update the BCMA's chipcommon nand flash driver to detect which
+chip-select is used and pass that information via platform data to the
+brcmnand driver. Make sure that the brcmnand platform data structure is
+always at the beginning of the platform data of the "nflash" device
+created by BCMA to allow brcmnand to safely de-reference it.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ MAINTAINERS                                 |  1 +
+ drivers/bcma/driver_chipcommon_nflash.c     | 20 +++++++++++++++++++-
+ include/linux/bcma/bcma_driver_chipcommon.h |  5 +++++
+ include/linux/platform_data/brcmnand.h      | 12 ++++++++++++
+ 4 files changed, 37 insertions(+), 1 deletion(-)
+ create mode 100644 include/linux/platform_data/brcmnand.h
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -3901,6 +3901,7 @@ L:	linux-mtd@lists.infradead.org
+ L:	bcm-kernel-feedback-list@broadcom.com
+ S:	Maintained
+ F:	drivers/mtd/nand/raw/brcmnand/
++F:	include/linux/platform_data/brcmnand.h
+ 
+ BROADCOM STB PCIE DRIVER
+ M:	Jim Quinlan <jim2101024@gmail.com>
+--- a/drivers/bcma/driver_chipcommon_nflash.c
++++ b/drivers/bcma/driver_chipcommon_nflash.c
+@@ -7,18 +7,28 @@
+ 
+ #include "bcma_private.h"
+ 
++#include <linux/bitops.h>
+ #include <linux/platform_device.h>
++#include <linux/platform_data/brcmnand.h>
+ #include <linux/bcma/bcma.h>
+ 
++/* Alternate NAND controller driver name in order to allow both bcm47xxnflash
++ * and bcma_brcmnand to be built into the same kernel image.
++ */
++static const char *bcma_nflash_alt_name = "bcma_brcmnand";
++
+ struct platform_device bcma_nflash_dev = {
+ 	.name		= "bcma_nflash",
+ 	.num_resources	= 0,
+ };
+ 
++static const char *probes[] = { "bcm47xxpart", NULL };
++
+ /* Initialize NAND flash access */
+ int bcma_nflash_init(struct bcma_drv_cc *cc)
+ {
+ 	struct bcma_bus *bus = cc->core->bus;
++	u32 reg;
+ 
+ 	if (bus->chipinfo.id != BCMA_CHIP_ID_BCM4706 &&
+ 	    cc->core->id.rev != 38) {
+@@ -33,8 +43,16 @@ int bcma_nflash_init(struct bcma_drv_cc
+ 
+ 	cc->nflash.present = true;
+ 	if (cc->core->id.rev == 38 &&
+-	    (cc->status & BCMA_CC_CHIPST_5357_NAND_BOOT))
++	    (cc->status & BCMA_CC_CHIPST_5357_NAND_BOOT)) {
+ 		cc->nflash.boot = true;
++		/* Determine the chip select that is being used */
++		reg = bcma_cc_read32(cc, BCMA_CC_NAND_CS_NAND_SELECT) & 0xff;
++		cc->nflash.brcmnand_info.chip_select = ffs(reg) - 1;
++		cc->nflash.brcmnand_info.part_probe_types = probes;
++		cc->nflash.brcmnand_info.ecc_stepsize = 512;
++		cc->nflash.brcmnand_info.ecc_strength = 1;
++		bcma_nflash_dev.name = bcma_nflash_alt_name;
++	}
+ 
+ 	/* Prepare platform device, but don't register it yet. It's too early,
+ 	 * malloc (required by device_private_init) is not available yet. */
+--- a/include/linux/bcma/bcma_driver_chipcommon.h
++++ b/include/linux/bcma/bcma_driver_chipcommon.h
+@@ -3,6 +3,7 @@
+ #define LINUX_BCMA_DRIVER_CC_H_
+ 
+ #include <linux/platform_device.h>
++#include <linux/platform_data/brcmnand.h>
+ #include <linux/gpio.h>
+ 
+ /** ChipCommon core registers. **/
+@@ -599,6 +600,10 @@ struct bcma_sflash {
+ 
+ #ifdef CONFIG_BCMA_NFLASH
+ struct bcma_nflash {
++	/* Must be the fist member for the brcmnand driver to
++	 * de-reference that structure.
++	 */
++	struct brcmnand_platform_data brcmnand_info;
+ 	bool present;
+ 	bool boot;		/* This is the flash the SoC boots from */
+ };
+--- /dev/null
++++ b/include/linux/platform_data/brcmnand.h
+@@ -0,0 +1,12 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++#ifndef BRCMNAND_PLAT_DATA_H
++#define BRCMNAND_PLAT_DATA_H
++
++struct brcmnand_platform_data {
++	int	chip_select;
++	const char * const *part_probe_types;
++	unsigned int ecc_stepsize;
++	unsigned int ecc_strength;
++};
++
++#endif /* BRCMNAND_PLAT_DATA_H */
diff --git a/target/linux/bcm47xx/patches-5.15/106-v5.18-mtd-rawnand-brcmnand-Allow-platform-data-instantation.patch b/target/linux/bcm47xx/patches-5.15/106-v5.18-mtd-rawnand-brcmnand-Allow-platform-data-instantation.patch
new file mode 100644
index 00000000000000..31d686b9557b41
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/106-v5.18-mtd-rawnand-brcmnand-Allow-platform-data-instantation.patch
@@ -0,0 +1,124 @@
+From: Florian Fainelli <f.fainelli@gmail.com>
+Subject: [PATCH v3 7/9] mtd: rawnand: brcmnand: Allow platform data instantation
+Date: Fri, 07 Jan 2022 10:46:12 -0800
+Content-Type: text/plain; charset="utf-8"
+
+Make use of the recently refactored code in brcmnand_init_cs() and
+derive the chip-select from the platform data that is supplied. Update
+the various code paths to avoid relying on possibly non-existent
+resources, too.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ drivers/mtd/nand/raw/brcmnand/brcmnand.c | 45 ++++++++++++++++++------
+ 1 file changed, 35 insertions(+), 10 deletions(-)
+
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+@@ -9,6 +9,7 @@
+ #include <linux/delay.h>
+ #include <linux/device.h>
+ #include <linux/platform_device.h>
++#include <linux/platform_data/brcmnand.h>
+ #include <linux/err.h>
+ #include <linux/completion.h>
+ #include <linux/interrupt.h>
+@@ -2768,7 +2769,8 @@ static const struct nand_controller_ops
+ 	.attach_chip = brcmnand_attach_chip,
+ };
+ 
+-static int brcmnand_init_cs(struct brcmnand_host *host)
++static int brcmnand_init_cs(struct brcmnand_host *host,
++			    const char * const *part_probe_types)
+ {
+ 	struct brcmnand_controller *ctrl = host->ctrl;
+ 	struct device *dev = ctrl->dev;
+@@ -2821,7 +2823,7 @@ static int brcmnand_init_cs(struct brcmn
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = mtd_device_register(mtd, NULL, 0);
++	ret = mtd_device_parse_register(mtd, part_probe_types, NULL, NULL, 0);
+ 	if (ret)
+ 		nand_cleanup(chip);
+ 
+@@ -2990,17 +2992,15 @@ static int brcmnand_edu_setup(struct pla
+ 
+ int brcmnand_probe(struct platform_device *pdev, struct brcmnand_soc *soc)
+ {
++	struct brcmnand_platform_data *pd = dev_get_platdata(&pdev->dev);
+ 	struct device *dev = &pdev->dev;
+ 	struct device_node *dn = dev->of_node, *child;
+ 	struct brcmnand_controller *ctrl;
++	struct brcmnand_host *host;
+ 	struct resource *res;
+ 	int ret;
+ 
+-	/* We only support device-tree instantiation */
+-	if (!dn)
+-		return -ENODEV;
+-
+-	if (!of_match_node(brcmnand_of_match, dn))
++	if (dn && !of_match_node(brcmnand_of_match, dn))
+ 		return -ENODEV;
+ 
+ 	ctrl = devm_kzalloc(dev, sizeof(*ctrl), GFP_KERNEL);
+@@ -3027,7 +3027,7 @@ int brcmnand_probe(struct platform_devic
+ 	/* NAND register range */
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	ctrl->nand_base = devm_ioremap_resource(dev, res);
+-	if (IS_ERR(ctrl->nand_base))
++	if (IS_ERR(ctrl->nand_base) && !brcmnand_soc_has_ops(soc))
+ 		return PTR_ERR(ctrl->nand_base);
+ 
+ 	/* Enable clock before using NAND registers */
+@@ -3171,7 +3171,6 @@ int brcmnand_probe(struct platform_devic
+ 
+ 	for_each_available_child_of_node(dn, child) {
+ 		if (of_device_is_compatible(child, "brcm,nandcs")) {
+-			struct brcmnand_host *host;
+ 
+ 			host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
+ 			if (!host) {
+@@ -3191,7 +3190,7 @@ int brcmnand_probe(struct platform_devic
+ 
+ 			nand_set_flash_node(&host->chip, child);
+ 
+-			ret = brcmnand_init_cs(host);
++			ret = brcmnand_init_cs(host, NULL);
+ 			if (ret) {
+ 				devm_kfree(dev, host);
+ 				continue; /* Try all chip-selects */
+@@ -3201,6 +3200,32 @@ int brcmnand_probe(struct platform_devic
+ 		}
+ 	}
+ 
++	if (!list_empty(&ctrl->host_list))
++		return 0;
++
++	if (!pd) {
++		ret = -ENODEV;
++		goto err;
++	}
++
++	/* If we got there we must have been probing via platform data */
++	host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
++	if (!host) {
++		ret = -ENOMEM;
++		goto err;
++	}
++	host->pdev = pdev;
++	host->ctrl = ctrl;
++	host->cs = pd->chip_select;
++	host->chip.ecc.size = pd->ecc_stepsize;
++	host->chip.ecc.strength = pd->ecc_strength;
++
++	ret = brcmnand_init_cs(host, pd->part_probe_types);
++	if (ret)
++		goto err;
++
++	list_add_tail(&host->node, &ctrl->host_list);
++
+ 	/* No chip-selects could initialize properly */
+ 	if (list_empty(&ctrl->host_list)) {
+ 		ret = -ENODEV;
diff --git a/target/linux/bcm47xx/patches-5.15/107-v5.18-mtd-rawnand-brcmnand-BCMA-controller-uses-command-shift-of-0.patch b/target/linux/bcm47xx/patches-5.15/107-v5.18-mtd-rawnand-brcmnand-BCMA-controller-uses-command-shift-of-0.patch
new file mode 100644
index 00000000000000..188d59b7d1665d
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/107-v5.18-mtd-rawnand-brcmnand-BCMA-controller-uses-command-shift-of-0.patch
@@ -0,0 +1,29 @@
+From: Florian Fainelli <f.fainelli@gmail.com>
+Subject: [PATCH v3 8/9] mtd: rawnand: brcmnand: BCMA controller uses command shift of 0
+Date: Fri, 07 Jan 2022 10:46:13 -0800
+Content-Type: text/plain; charset="utf-8"
+
+For some odd and unexplained reason the BCMA NAND controller, albeit
+revision 3.4 uses a command shift of 0 instead of 24 as it should be,
+quirk that.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ drivers/mtd/nand/raw/brcmnand/brcmnand.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+@@ -916,6 +916,12 @@ static void brcmnand_wr_corr_thresh(stru
+ 
+ static inline int brcmnand_cmd_shift(struct brcmnand_controller *ctrl)
+ {
++	/* Kludge for the BCMA-based NAND controller which does not actually
++	 * shift the command
++	 */
++	if (ctrl->nand_version == 0x0304 && brcmnand_non_mmio_ops(ctrl))
++		return 0;
++
+ 	if (ctrl->nand_version < 0x0602)
+ 		return 24;
+ 	return 0;
diff --git a/target/linux/bcm47xx/patches-5.15/108-v5.18-mtd-rawnand-brcmnand-Add-BCMA-shim.patch b/target/linux/bcm47xx/patches-5.15/108-v5.18-mtd-rawnand-brcmnand-Add-BCMA-shim.patch
new file mode 100644
index 00000000000000..baa48ef5a0d7a5
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/108-v5.18-mtd-rawnand-brcmnand-Add-BCMA-shim.patch
@@ -0,0 +1,201 @@
+From: Florian Fainelli <f.fainelli@gmail.com>
+Subject: [PATCH v3 9/9] mtd: rawnand: brcmnand: Add BCMA shim
+Date: Fri, 07 Jan 2022 10:46:14 -0800
+Content-Type: text/plain; charset="utf-8"
+
+Add a BCMA shim to allow us to register the brcmnand driver using the
+BCMA bus which provides indirect memory mapped access to SoC registers.
+
+There are a number of registers that need to be byte swapped because
+they are natively big endian, coming directly from the NAND chip, and
+there is no bus interface unlike the iProc or STB platforms that
+performs the byte swapping for us.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ drivers/mtd/nand/raw/Kconfig              |  13 +++
+ drivers/mtd/nand/raw/brcmnand/Makefile    |   2 +
+ drivers/mtd/nand/raw/brcmnand/bcma_nand.c | 132 ++++++++++++++++++++++
+ drivers/mtd/nand/raw/brcmnand/brcmnand.c  |   4 +
+ 4 files changed, 151 insertions(+)
+ create mode 100644 drivers/mtd/nand/raw/brcmnand/bcma_nand.c
+
+--- a/drivers/mtd/nand/raw/Kconfig
++++ b/drivers/mtd/nand/raw/Kconfig
+@@ -208,6 +208,19 @@ config MTD_NAND_BRCMNAND
+ 	  originally designed for Set-Top Box but is used on various BCM7xxx,
+ 	  BCM3xxx, BCM63xxx, iProc/Cygnus and more.
+ 
++if MTD_NAND_BRCMNAND
++
++config MTD_NAND_BRCMNAND_BCMA
++	tristate "Broadcom BCMA NAND controller"
++	depends on BCMA_NFLASH
++	depends on BCMA
++	help
++	  Enables the BRCMNAND controller over BCMA on BCM47186/BCM5358 SoCs.
++	  The glue driver will take care of performing the low-level I/O
++	  operations to interface the BRCMNAND controller over the BCMA bus.
++
++endif # MTD_NAND_BRCMNAND
++
+ config MTD_NAND_BCM47XXNFLASH
+ 	tristate "BCM4706 BCMA NAND controller"
+ 	depends on BCMA_NFLASH
+--- a/drivers/mtd/nand/raw/brcmnand/Makefile
++++ b/drivers/mtd/nand/raw/brcmnand/Makefile
+@@ -6,3 +6,5 @@ obj-$(CONFIG_MTD_NAND_BRCMNAND)		+= bcm6
+ obj-$(CONFIG_MTD_NAND_BRCMNAND)		+= bcm6368_nand.o
+ obj-$(CONFIG_MTD_NAND_BRCMNAND)		+= brcmstb_nand.o
+ obj-$(CONFIG_MTD_NAND_BRCMNAND)		+= brcmnand.o
++
++obj-$(CONFIG_MTD_NAND_BRCMNAND_BCMA)	+= bcma_nand.o
+--- /dev/null
++++ b/drivers/mtd/nand/raw/brcmnand/bcma_nand.c
+@@ -0,0 +1,132 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Copyright © 2021 Broadcom
++ */
++#include <linux/bcma/bcma.h>
++#include <linux/bcma/bcma_driver_chipcommon.h>
++#include <linux/device.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++
++#include "brcmnand.h"
++
++struct brcmnand_bcma_soc {
++	struct brcmnand_soc soc;
++	struct bcma_drv_cc *cc;
++};
++
++static inline bool brcmnand_bcma_needs_swapping(u32 offset)
++{
++	switch (offset) {
++	case BCMA_CC_NAND_SPARE_RD0:
++	case BCMA_CC_NAND_SPARE_RD4:
++	case BCMA_CC_NAND_SPARE_RD8:
++	case BCMA_CC_NAND_SPARE_RD12:
++	case BCMA_CC_NAND_SPARE_WR0:
++	case BCMA_CC_NAND_SPARE_WR4:
++	case BCMA_CC_NAND_SPARE_WR8:
++	case BCMA_CC_NAND_SPARE_WR12:
++	case BCMA_CC_NAND_DEVID:
++	case BCMA_CC_NAND_DEVID_X:
++	case BCMA_CC_NAND_SPARE_RD16:
++	case BCMA_CC_NAND_SPARE_RD20:
++	case BCMA_CC_NAND_SPARE_RD24:
++	case BCMA_CC_NAND_SPARE_RD28:
++		return true;
++	}
++
++	return false;
++}
++
++static inline struct brcmnand_bcma_soc *to_bcma_soc(struct brcmnand_soc *soc)
++{
++	return container_of(soc, struct brcmnand_bcma_soc, soc);
++}
++
++static u32 brcmnand_bcma_read_reg(struct brcmnand_soc *soc, u32 offset)
++{
++	struct brcmnand_bcma_soc *sc = to_bcma_soc(soc);
++	u32 val;
++
++	/* Offset into the NAND block and deal with the flash cache separately */
++	if (offset == BRCMNAND_NON_MMIO_FC_ADDR)
++		offset = BCMA_CC_NAND_CACHE_DATA;
++	else
++		offset += BCMA_CC_NAND_REVISION;
++
++	val = bcma_cc_read32(sc->cc, offset);
++
++	/* Swap if necessary */
++	if (brcmnand_bcma_needs_swapping(offset))
++		val = be32_to_cpu(val);
++	return val;
++}
++
++static void brcmnand_bcma_write_reg(struct brcmnand_soc *soc, u32 val,
++				    u32 offset)
++{
++	struct brcmnand_bcma_soc *sc = to_bcma_soc(soc);
++
++	/* Offset into the NAND block */
++	if (offset == BRCMNAND_NON_MMIO_FC_ADDR)
++		offset = BCMA_CC_NAND_CACHE_DATA;
++	else
++		offset += BCMA_CC_NAND_REVISION;
++
++	/* Swap if necessary */
++	if (brcmnand_bcma_needs_swapping(offset))
++		val = cpu_to_be32(val);
++
++	bcma_cc_write32(sc->cc, offset, val);
++}
++
++static struct brcmnand_io_ops brcmnand_bcma_io_ops = {
++	.read_reg	= brcmnand_bcma_read_reg,
++	.write_reg	= brcmnand_bcma_write_reg,
++};
++
++static void brcmnand_bcma_prepare_data_bus(struct brcmnand_soc *soc, bool prepare,
++					   bool is_param)
++{
++	struct brcmnand_bcma_soc *sc = to_bcma_soc(soc);
++
++	/* Reset the cache address to ensure we are already accessing the
++	 * beginning of a sub-page.
++	 */
++	bcma_cc_write32(sc->cc, BCMA_CC_NAND_CACHE_ADDR, 0);
++}
++
++static int brcmnand_bcma_nand_probe(struct platform_device *pdev)
++{
++	struct bcma_nflash *nflash = dev_get_platdata(&pdev->dev);
++	struct brcmnand_bcma_soc *soc;
++
++	soc = devm_kzalloc(&pdev->dev, sizeof(*soc), GFP_KERNEL);
++	if (!soc)
++		return -ENOMEM;
++
++	soc->cc = container_of(nflash, struct bcma_drv_cc, nflash);
++	soc->soc.prepare_data_bus = brcmnand_bcma_prepare_data_bus;
++	soc->soc.ops = &brcmnand_bcma_io_ops;
++
++	if (soc->cc->core->bus->chipinfo.id == BCMA_CHIP_ID_BCM4706) {
++		dev_err(&pdev->dev, "Use bcm47xxnflash for 4706!\n");
++		return -ENODEV;
++	}
++
++	return brcmnand_probe(pdev, &soc->soc);
++}
++
++static struct platform_driver brcmnand_bcma_nand_driver = {
++	.probe			= brcmnand_bcma_nand_probe,
++	.remove			= brcmnand_remove,
++	.driver = {
++		.name		= "bcma_brcmnand",
++		.pm		= &brcmnand_pm_ops,
++	}
++};
++module_platform_driver(brcmnand_bcma_nand_driver);
++
++MODULE_LICENSE("GPL v2");
++MODULE_AUTHOR("Broadcom");
++MODULE_DESCRIPTION("NAND controller driver glue for BCMA chips");
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+@@ -598,7 +598,11 @@ enum {
+ 
+ static inline bool brcmnand_non_mmio_ops(struct brcmnand_controller *ctrl)
+ {
++#if IS_ENABLED(CONFIG_MTD_NAND_BRCMNAND_BCMA)
+ 	return static_branch_unlikely(&brcmnand_soc_has_ops_key);
++#else
++	return false;
++#endif
+ }
+ 
+ static inline u32 nand_readreg(struct brcmnand_controller *ctrl, u32 offs)
diff --git a/target/linux/bcm47xx/patches-5.15/130-MIPS-BCM47XX-Add-support-for-Huawei-B593u-12.patch b/target/linux/bcm47xx/patches-5.15/130-MIPS-BCM47XX-Add-support-for-Huawei-B593u-12.patch
new file mode 100644
index 00000000000000..333c3d7b8707ac
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/130-MIPS-BCM47XX-Add-support-for-Huawei-B593u-12.patch
@@ -0,0 +1,61 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 27 Feb 2023 07:44:38 +0100
+Subject: [PATCH] MIPS: BCM47XX: Add support for Huawei B593u-12
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+It's a BCM5358 based home router. One of very few bcm47xx devices with
+cellular modems (here: LTE).
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+ arch/mips/bcm47xx/board.c                          | 1 +
+ arch/mips/bcm47xx/leds.c                           | 8 ++++++++
+ arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h | 1 +
+ 3 files changed, 10 insertions(+)
+
+--- a/arch/mips/bcm47xx/board.c
++++ b/arch/mips/bcm47xx/board.c
+@@ -193,6 +193,7 @@ struct bcm47xx_board_type_list1 bcm47xx_
+ /* boardtype, boardnum, boardrev */
+ static const
+ struct bcm47xx_board_type_list3 bcm47xx_board_list_board[] __initconst = {
++	{{BCM47XX_BOARD_HUAWEI_B593U_12, "Huawei B593u-12"}, "0x053d", "1234", "0x1301"},
+ 	{{BCM47XX_BOARD_HUAWEI_E970, "Huawei E970"}, "0x048e", "0x5347", "0x11"},
+ 	{{BCM47XX_BOARD_PHICOMM_M1, "Phicomm M1"}, "0x0590", "80", "0x1104"},
+ 	{{BCM47XX_BOARD_ZTE_H218N, "ZTE H218N"}, "0x053d", "1234", "0x1305"},
+--- a/arch/mips/bcm47xx/leds.c
++++ b/arch/mips/bcm47xx/leds.c
+@@ -223,6 +223,11 @@ bcm47xx_leds_dlink_dir330[] __initconst
+ /* Huawei */
+ 
+ static const struct gpio_led
++bcm47xx_leds_huawei_b593u_12[] __initconst = {
++	BCM47XX_GPIO_LED(5, "blue", "wlan", 0, LEDS_GPIO_DEFSTATE_OFF),
++};
++
++static const struct gpio_led
+ bcm47xx_leds_huawei_e970[] __initconst = {
+ 	BCM47XX_GPIO_LED(0, "unk", "wlan", 0, LEDS_GPIO_DEFSTATE_OFF),
+ };
+@@ -672,6 +677,9 @@ void __init bcm47xx_leds_register(void)
+ 		bcm47xx_set_pdata(bcm47xx_leds_dlink_dir330);
+ 		break;
+ 
++	case BCM47XX_BOARD_HUAWEI_B593U_12:
++		bcm47xx_set_pdata(bcm47xx_leds_huawei_b593u_12);
++		break;
+ 	case BCM47XX_BOARD_HUAWEI_E970:
+ 		bcm47xx_set_pdata(bcm47xx_leds_huawei_e970);
+ 		break;
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
+@@ -53,6 +53,7 @@ enum bcm47xx_board {
+ 	BCM47XX_BOARD_DLINK_DIR130,
+ 	BCM47XX_BOARD_DLINK_DIR330,
+ 
++	BCM47XX_BOARD_HUAWEI_B593U_12,
+ 	BCM47XX_BOARD_HUAWEI_E970,
+ 
+ 	BCM47XX_BOARD_LINKSYS_E900V1,
diff --git a/target/linux/bcm47xx/patches-5.15/159-cpu_fixes.patch b/target/linux/bcm47xx/patches-5.15/159-cpu_fixes.patch
new file mode 100644
index 00000000000000..fe7eff19113ee5
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/159-cpu_fixes.patch
@@ -0,0 +1,484 @@
+--- a/arch/mips/include/asm/r4kcache.h
++++ b/arch/mips/include/asm/r4kcache.h
+@@ -27,6 +27,38 @@
+ extern void (*r4k_blast_dcache)(void);
+ extern void (*r4k_blast_icache)(void);
+ 
++#if defined(CONFIG_BCM47XX) && !defined(CONFIG_CPU_MIPS32_R2)
++#include <asm/paccess.h>
++#include <linux/ssb/ssb.h>
++#define BCM4710_DUMMY_RREG() bcm4710_dummy_rreg()
++
++static inline unsigned long bcm4710_dummy_rreg(void)
++{
++      return *(volatile unsigned long *)(KSEG1ADDR(SSB_ENUM_BASE));
++}
++
++#define BCM4710_FILL_TLB(addr) bcm4710_fill_tlb((void *)(addr))
++
++static inline unsigned long bcm4710_fill_tlb(void *addr)
++{
++      return *(unsigned long *)addr;
++}
++
++#define BCM4710_PROTECTED_FILL_TLB(addr) bcm4710_protected_fill_tlb((void *)(addr))
++
++static inline void bcm4710_protected_fill_tlb(void *addr)
++{
++      unsigned long x;
++      get_dbe(x, (unsigned long *)addr);;
++}
++
++#else
++#define BCM4710_DUMMY_RREG()
++
++#define BCM4710_FILL_TLB(addr)
++#define BCM4710_PROTECTED_FILL_TLB(addr)
++#endif
++
+ /*
+  * This macro return a properly sign-extended address suitable as base address
+  * for indexed cache operations.  Two issues here:
+@@ -60,6 +92,7 @@ static inline void flush_icache_line_ind
+ 
+ static inline void flush_dcache_line_indexed(unsigned long addr)
+ {
++	BCM4710_DUMMY_RREG();
+ 	cache_op(Index_Writeback_Inv_D, addr);
+ }
+ 
+@@ -83,11 +116,13 @@ static inline void flush_icache_line(uns
+ 
+ static inline void flush_dcache_line(unsigned long addr)
+ {
++	BCM4710_DUMMY_RREG();
+ 	cache_op(Hit_Writeback_Inv_D, addr);
+ }
+ 
+ static inline void invalidate_dcache_line(unsigned long addr)
+ {
++	BCM4710_DUMMY_RREG();
+ 	cache_op(Hit_Invalidate_D, addr);
+ }
+ 
+@@ -160,6 +195,7 @@ static inline int protected_flush_icache
+ 		return protected_cache_op(Hit_Invalidate_I_Loongson2, addr);
+ 
+ 	default:
++		BCM4710_DUMMY_RREG();
+ 		return protected_cache_op(Hit_Invalidate_I, addr);
+ 	}
+ }
+@@ -172,6 +208,7 @@ static inline int protected_flush_icache
+  */
+ static inline int protected_writeback_dcache_line(unsigned long addr)
+ {
++	BCM4710_DUMMY_RREG();
+ 	return protected_cache_op(Hit_Writeback_Inv_D, addr);
+ }
+ 
+@@ -193,8 +230,51 @@ static inline void invalidate_tcache_pag
+ 	unroll(times, _cache_op, insn, op, (addr) + (i++ * (lsize)));	\
+ } while (0)
+ 
++static inline void blast_dcache(void)
++{
++	unsigned long start = KSEG0;
++	unsigned long dcache_size = current_cpu_data.dcache.waysize * current_cpu_data.dcache.ways;
++	unsigned long end = (start + dcache_size);
++
++	do {
++		BCM4710_DUMMY_RREG();
++		cache_op(Index_Writeback_Inv_D, start);
++		start += current_cpu_data.dcache.linesz;
++	} while(start < end);
++}
++
++static inline void blast_dcache_page(unsigned long page)
++{
++	unsigned long start = page;
++	unsigned long end = start + PAGE_SIZE;
++
++	BCM4710_FILL_TLB(start);
++	do {
++		BCM4710_DUMMY_RREG();
++		cache_op(Hit_Writeback_Inv_D, start);
++		start += current_cpu_data.dcache.linesz;
++	} while(start < end);
++}
++
++static inline void blast_dcache_page_indexed(unsigned long page)
++{
++	unsigned long start = page;
++	unsigned long end = start + PAGE_SIZE;
++	unsigned long ws_inc = 1UL << current_cpu_data.dcache.waybit;
++	unsigned long ws_end = current_cpu_data.dcache.ways <<
++	                       current_cpu_data.dcache.waybit;
++	unsigned long ws, addr;
++	for (ws = 0; ws < ws_end; ws += ws_inc) {
++		start = page + ws;
++		for (addr = start; addr < end; addr += current_cpu_data.dcache.linesz) {
++			BCM4710_DUMMY_RREG();
++			cache_op(Index_Writeback_Inv_D, addr);
++		}
++	}
++}
++
+ /* build blast_xxx, blast_xxx_page, blast_xxx_page_indexed */
+-#define __BUILD_BLAST_CACHE(pfx, desc, indexop, hitop, lsize, extra)	\
++#define __BUILD_BLAST_CACHE(pfx, desc, indexop, hitop, lsize, extra, war) \
+ static inline void extra##blast_##pfx##cache##lsize(void)		\
+ {									\
+ 	unsigned long start = INDEX_BASE;				\
+@@ -204,6 +284,7 @@ static inline void extra##blast_##pfx##c
+ 			       current_cpu_data.desc.waybit;		\
+ 	unsigned long ws, addr;						\
+ 									\
++	war								\
+ 	for (ws = 0; ws < ws_end; ws += ws_inc)				\
+ 		for (addr = start; addr < end; addr += lsize * 32)	\
+ 			cache_unroll(32, kernel_cache, indexop,		\
+@@ -215,6 +296,7 @@ static inline void extra##blast_##pfx##c
+ 	unsigned long start = page;					\
+ 	unsigned long end = page + PAGE_SIZE;				\
+ 									\
++	war								\
+ 	do {								\
+ 		cache_unroll(32, kernel_cache, hitop, start, lsize);	\
+ 		start += lsize * 32;					\
+@@ -231,32 +313,33 @@ static inline void extra##blast_##pfx##c
+ 			       current_cpu_data.desc.waybit;		\
+ 	unsigned long ws, addr;						\
+ 									\
++	war								\
+ 	for (ws = 0; ws < ws_end; ws += ws_inc)				\
+ 		for (addr = start; addr < end; addr += lsize * 32)	\
+ 			cache_unroll(32, kernel_cache, indexop,		\
+ 				     addr | ws, lsize);			\
+ }
+ 
+-__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 16, )
+-__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 16, )
+-__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 16, )
+-__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 32, )
+-__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 32, )
+-__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I_Loongson2, 32, loongson2_)
+-__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 32, )
+-__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 64, )
+-__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 64, )
+-__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 64, )
+-__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 128, )
+-__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 128, )
+-__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 128, )
+-
+-__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 16, )
+-__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 32, )
+-__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 16, )
+-__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 32, )
+-__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 64, )
+-__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 128, )
++__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 16, , )
++__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 16, , BCM4710_FILL_TLB(start);)
++__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 16, , )
++__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 32, , )
++__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 32, , BCM4710_FILL_TLB(start);)
++__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I_Loongson2, 32, loongson2_, BCM4710_FILL_TLB(start);)
++__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 32, , )
++__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 64, , )
++__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 64, , BCM4710_FILL_TLB(start);)
++__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 64, , )
++__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 128, , )
++__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 128, , )
++__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 128, , )
++
++__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 16, , )
++__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 32, , )
++__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 16, , )
++__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 32, , )
++__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 64, , )
++__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 128, , )
+ 
+ #define __BUILD_BLAST_USER_CACHE(pfx, desc, indexop, hitop, lsize) \
+ static inline void blast_##pfx##cache##lsize##_user_page(unsigned long page) \
+@@ -281,65 +364,36 @@ __BUILD_BLAST_USER_CACHE(d, dcache, Inde
+ __BUILD_BLAST_USER_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 64)
+ 
+ /* build blast_xxx_range, protected_blast_xxx_range */
+-#define __BUILD_BLAST_CACHE_RANGE(pfx, desc, hitop, prot, extra)	\
++#define __BUILD_BLAST_CACHE_RANGE(pfx, desc, hitop, prot, extra, war, war2)	\
+ static inline void prot##extra##blast_##pfx##cache##_range(unsigned long start, \
+ 						    unsigned long end)	\
+ {									\
+ 	unsigned long lsize = cpu_##desc##_line_size();			\
+-	unsigned long lsize_2 = lsize * 2;				\
+-	unsigned long lsize_3 = lsize * 3;				\
+-	unsigned long lsize_4 = lsize * 4;				\
+-	unsigned long lsize_5 = lsize * 5;				\
+-	unsigned long lsize_6 = lsize * 6;				\
+-	unsigned long lsize_7 = lsize * 7;				\
+-	unsigned long lsize_8 = lsize * 8;				\
+ 	unsigned long addr = start & ~(lsize - 1);			\
+-	unsigned long aend = (end + lsize - 1) & ~(lsize - 1);		\
+-	int lines = (aend - addr) / lsize;				\
+-									\
+-	while (lines >= 8) {						\
+-		prot##cache_op(hitop, addr);				\
+-		prot##cache_op(hitop, addr + lsize);			\
+-		prot##cache_op(hitop, addr + lsize_2);			\
+-		prot##cache_op(hitop, addr + lsize_3);			\
+-		prot##cache_op(hitop, addr + lsize_4);			\
+-		prot##cache_op(hitop, addr + lsize_5);			\
+-		prot##cache_op(hitop, addr + lsize_6);			\
+-		prot##cache_op(hitop, addr + lsize_7);			\
+-		addr += lsize_8;					\
+-		lines -= 8;						\
+-	}								\
++	unsigned long aend = (end - 1) & ~(lsize - 1);			\
+ 									\
+-	if (lines & 0x4) {						\
+-		prot##cache_op(hitop, addr);				\
+-		prot##cache_op(hitop, addr + lsize);			\
+-		prot##cache_op(hitop, addr + lsize_2);			\
+-		prot##cache_op(hitop, addr + lsize_3);			\
+-		addr += lsize_4;					\
+-	}								\
+-									\
+-	if (lines & 0x2) {						\
+-		prot##cache_op(hitop, addr);				\
+-		prot##cache_op(hitop, addr + lsize);			\
+-		addr += lsize_2;					\
+-	}								\
++	war								\
+ 									\
+-	if (lines & 0x1) {						\
++	while (1) {							\
++		war2							\
+ 		prot##cache_op(hitop, addr);				\
++		if (addr == aend)					\
++			break;						\
++		addr += lsize;						\
+ 	}								\
+ }
+ 
+-__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, protected_, )
+-__BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I, protected_, )
+-__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, protected_, )
++__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, protected_, , BCM4710_PROTECTED_FILL_TLB(addr); BCM4710_PROTECTED_FILL_TLB(aend);, BCM4710_DUMMY_RREG();)
++__BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I, protected_, , , )
++__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, protected_, , , )
+ __BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I_Loongson2, \
+-	protected_, loongson2_)
+-__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, , )
+-__BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I, , )
+-__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, , )
++	protected_, loongson2_, , )
++__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, , , BCM4710_FILL_TLB(addr); BCM4710_FILL_TLB(aend);, BCM4710_DUMMY_RREG();)
++__BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I, , , , )
++__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, , , , )
+ /* blast_inv_dcache_range */
+-__BUILD_BLAST_CACHE_RANGE(inv_d, dcache, Hit_Invalidate_D, , )
+-__BUILD_BLAST_CACHE_RANGE(inv_s, scache, Hit_Invalidate_SD, , )
++__BUILD_BLAST_CACHE_RANGE(inv_d, dcache, Hit_Invalidate_D, , , , BCM4710_DUMMY_RREG();)
++__BUILD_BLAST_CACHE_RANGE(inv_s, scache, Hit_Invalidate_SD, , , , )
+ 
+ /* Currently, this is very specific to Loongson-3 */
+ #define __BUILD_BLAST_CACHE_NODE(pfx, desc, indexop, hitop, lsize)	\
+--- a/arch/mips/include/asm/stackframe.h
++++ b/arch/mips/include/asm/stackframe.h
+@@ -429,6 +429,10 @@
+ #else
+ 		.set	push
+ 		.set	arch=r4000
++#ifdef CONFIG_BCM47XX
++		nop
++		nop
++#endif
+ 		eret
+ 		.set	pop
+ #endif
+--- a/arch/mips/kernel/genex.S
++++ b/arch/mips/kernel/genex.S
+@@ -22,6 +22,19 @@
+ #include <asm/war.h>
+ #include <asm/thread_info.h>
+ 
++#ifdef CONFIG_BCM47XX
++# ifdef eret
++#  undef eret
++# endif
++# define eret 					\
++	.set push;				\
++	.set noreorder;				\
++	 nop; 					\
++	 nop;					\
++	 eret;					\
++	.set pop;
++#endif
++
+ 	__INIT
+ 
+ /*
+@@ -33,6 +46,9 @@
+ NESTED(except_vec3_generic, 0, sp)
+ 	.set	push
+ 	.set	noat
++#ifdef CONFIG_BCM47XX
++	nop
++#endif
+ 	mfc0	k1, CP0_CAUSE
+ 	andi	k1, k1, 0x7c
+ #ifdef CONFIG_64BIT
+@@ -53,6 +69,9 @@ NESTED(except_vec3_r4000, 0, sp)
+ 	.set	push
+ 	.set	arch=r4000
+ 	.set	noat
++#ifdef CONFIG_BCM47XX
++	nop
++#endif
+ 	mfc0	k1, CP0_CAUSE
+ 	li	k0, 31<<2
+ 	andi	k1, k1, 0x7c
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -38,6 +38,9 @@
+ #include <asm/traps.h>
+ #include <asm/mips-cps.h>
+ 
++/* For enabling BCM4710 cache workarounds */
++static int bcm4710 = 0;
++
+ /*
+  * Bits describing what cache ops an SMP callback function may perform.
+  *
+@@ -190,6 +193,9 @@ static void r4k_blast_dcache_user_page_s
+ {
+ 	unsigned long  dc_lsize = cpu_dcache_line_size();
+ 
++	if (bcm4710)
++		r4k_blast_dcache_page = blast_dcache_page;
++	else
+ 	if (dc_lsize == 0)
+ 		r4k_blast_dcache_user_page = (void *)cache_noop;
+ 	else if (dc_lsize == 16)
+@@ -208,6 +214,9 @@ static void r4k_blast_dcache_page_indexe
+ {
+ 	unsigned long dc_lsize = cpu_dcache_line_size();
+ 
++	if (bcm4710)
++		r4k_blast_dcache_page_indexed = blast_dcache_page_indexed;
++	else
+ 	if (dc_lsize == 0)
+ 		r4k_blast_dcache_page_indexed = (void *)cache_noop;
+ 	else if (dc_lsize == 16)
+@@ -227,6 +236,9 @@ static void r4k_blast_dcache_setup(void)
+ {
+ 	unsigned long dc_lsize = cpu_dcache_line_size();
+ 
++	if (bcm4710)
++		r4k_blast_dcache = blast_dcache;
++	else
+ 	if (dc_lsize == 0)
+ 		r4k_blast_dcache = (void *)cache_noop;
+ 	else if (dc_lsize == 16)
+@@ -1826,6 +1838,17 @@ static void coherency_setup(void)
+ 	 * silly idea of putting something else there ...
+ 	 */
+ 	switch (current_cpu_type()) {
++	case CPU_BMIPS3300:
++		{
++			u32 cm;
++			cm = read_c0_diag();
++			/* Enable icache */
++			cm |= (1 << 31);
++			/* Enable dcache */
++			cm |= (1 << 30);
++			write_c0_diag(cm);
++		}
++		break;
+ 	case CPU_R4000PC:
+ 	case CPU_R4000SC:
+ 	case CPU_R4000MC:
+@@ -1872,6 +1895,15 @@ void r4k_cache_init(void)
+ 	extern void build_copy_page(void);
+ 	struct cpuinfo_mips *c = &current_cpu_data;
+ 
++	/* Check if special workarounds are required */
++#if defined(CONFIG_BCM47XX) && !defined(CONFIG_CPU_MIPS32_R2)
++	if (current_cpu_data.cputype == CPU_BMIPS32 && (current_cpu_data.processor_id & 0xff) == 0) {
++		printk("Enabling BCM4710A0 cache workarounds.\n");
++		bcm4710 = 1;
++	} else
++#endif
++		bcm4710 = 0;
++
+ 	probe_pcache();
+ 	probe_vcache();
+ 	setup_scache();
+@@ -1944,7 +1976,15 @@ void r4k_cache_init(void)
+ 	 */
+ 	local_r4k___flush_cache_all(NULL);
+ 
++#ifdef CONFIG_BCM47XX
++	{
++		static void (*_coherency_setup)(void);
++		_coherency_setup = (void (*)(void)) KSEG1ADDR(coherency_setup);
++		_coherency_setup();
++	}
++#else
+ 	coherency_setup();
++#endif
+ 	board_cache_error_setup = r4k_cache_error_setup;
+ 
+ 	/*
+--- a/arch/mips/mm/tlbex.c
++++ b/arch/mips/mm/tlbex.c
+@@ -985,6 +985,9 @@ void build_get_pgde32(u32 **p, unsigned
+ 		uasm_i_srl(p, ptr, ptr, SMP_CPUID_PTRSHIFT);
+ 		uasm_i_addu(p, ptr, tmp, ptr);
+ #else
++#ifdef CONFIG_BCM47XX
++		uasm_i_nop(p);
++#endif
+ 		UASM_i_LA_mostly(p, ptr, pgdc);
+ #endif
+ 		uasm_i_mfc0(p, tmp, C0_BADVADDR); /* get faulting address */
+@@ -1347,6 +1350,9 @@ static void build_r4000_tlb_refill_handl
+ #ifdef CONFIG_64BIT
+ 		build_get_pmde64(&p, &l, &r, K0, K1); /* get pmd in K1 */
+ #else
++# ifdef CONFIG_BCM47XX
++		uasm_i_nop(&p);
++# endif
+ 		build_get_pgde32(&p, K0, K1); /* get pgd in K1 */
+ #endif
+ 
+@@ -1358,6 +1364,9 @@ static void build_r4000_tlb_refill_handl
+ 		build_update_entries(&p, K0, K1);
+ 		build_tlb_write_entry(&p, &l, &r, tlb_random);
+ 		uasm_l_leave(&l, p);
++#ifdef CONFIG_BCM47XX
++		uasm_i_nop(&p);
++#endif
+ 		uasm_i_eret(&p); /* return from trap */
+ 	}
+ #ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT
+@@ -2059,6 +2068,9 @@ build_r4000_tlbchange_handler_head(u32 *
+ #ifdef CONFIG_64BIT
+ 	build_get_pmde64(p, l, r, wr.r1, wr.r2); /* get pmd in ptr */
+ #else
++# ifdef CONFIG_BCM47XX
++	uasm_i_nop(p);
++# endif
+ 	build_get_pgde32(p, wr.r1, wr.r2); /* get pgd in ptr */
+ #endif
+ 
+@@ -2105,6 +2117,9 @@ build_r4000_tlbchange_handler_tail(u32 *
+ 	build_tlb_write_entry(p, l, r, tlb_indexed);
+ 	uasm_l_leave(l, *p);
+ 	build_restore_work_registers(p);
++#ifdef CONFIG_BCM47XX
++	uasm_i_nop(p);
++#endif
+ 	uasm_i_eret(p); /* return from trap */
+ 
+ #ifdef CONFIG_64BIT
diff --git a/target/linux/bcm47xx/patches-5.15/160-kmap_coherent.patch b/target/linux/bcm47xx/patches-5.15/160-kmap_coherent.patch
new file mode 100644
index 00000000000000..aedf6afa246531
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/160-kmap_coherent.patch
@@ -0,0 +1,78 @@
+From: Jeff Hansen <jhansen@cardaccess-inc.com>
+Subject: [PATCH] kmap_coherent
+
+On ASUS WL-500gP there are some "Data bus error"s when executing simple
+commands liks "ps" or "cat /proc/1/cmdline".
+
+This fixes OpenWrt ticket #1485: https://dev.openwrt.org/ticket/1485
+---
+--- a/arch/mips/include/asm/cpu-features.h
++++ b/arch/mips/include/asm/cpu-features.h
+@@ -240,6 +240,9 @@
+ #ifndef cpu_has_pindexed_dcache
+ #define cpu_has_pindexed_dcache	(cpu_data[0].dcache.flags & MIPS_CACHE_PINDEX)
+ #endif
++#ifndef cpu_use_kmap_coherent
++#define cpu_use_kmap_coherent 1
++#endif
+ 
+ /*
+  * I-Cache snoops remote store.	 This only matters on SMP.  Some multiprocessors
+--- a/arch/mips/include/asm/mach-bcm47xx/cpu-feature-overrides.h
++++ b/arch/mips/include/asm/mach-bcm47xx/cpu-feature-overrides.h
+@@ -80,4 +80,6 @@
+ #define cpu_scache_line_size()		0
+ #define cpu_has_vz			0
+ 
++#define cpu_use_kmap_coherent		0
++
+ #endif /* __ASM_MACH_BCM47XX_CPU_FEATURE_OVERRIDES_H */
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -702,7 +702,7 @@ static inline void local_r4k_flush_cache
+ 		map_coherent = (cpu_has_dc_aliases &&
+ 				page_mapcount(page) &&
+ 				!Page_dcache_dirty(page));
+-		if (map_coherent)
++		if (map_coherent && cpu_use_kmap_coherent)
+ 			vaddr = kmap_coherent(page, addr);
+ 		else
+ 			vaddr = kmap_atomic(page);
+@@ -729,7 +729,7 @@ static inline void local_r4k_flush_cache
+ 	}
+ 
+ 	if (vaddr) {
+-		if (map_coherent)
++		if (map_coherent && cpu_use_kmap_coherent)
+ 			kunmap_coherent();
+ 		else
+ 			kunmap_atomic(vaddr);
+--- a/arch/mips/mm/init.c
++++ b/arch/mips/mm/init.c
+@@ -172,7 +172,7 @@ void copy_user_highpage(struct page *to,
+ 	void *vfrom, *vto;
+ 
+ 	vto = kmap_atomic(to);
+-	if (cpu_has_dc_aliases &&
++	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
+ 	    page_mapcount(from) && !Page_dcache_dirty(from)) {
+ 		vfrom = kmap_coherent(from, vaddr);
+ 		copy_page(vto, vfrom);
+@@ -194,7 +194,7 @@ void copy_to_user_page(struct vm_area_st
+ 	struct page *page, unsigned long vaddr, void *dst, const void *src,
+ 	unsigned long len)
+ {
+-	if (cpu_has_dc_aliases &&
++	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
+ 	    page_mapcount(page) && !Page_dcache_dirty(page)) {
+ 		void *vto = kmap_coherent(page, vaddr) + (vaddr & ~PAGE_MASK);
+ 		memcpy(vto, src, len);
+@@ -212,7 +212,7 @@ void copy_from_user_page(struct vm_area_
+ 	struct page *page, unsigned long vaddr, void *dst, const void *src,
+ 	unsigned long len)
+ {
+-	if (cpu_has_dc_aliases &&
++	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
+ 	    page_mapcount(page) && !Page_dcache_dirty(page)) {
+ 		void *vfrom = kmap_coherent(page, vaddr) + (vaddr & ~PAGE_MASK);
+ 		memcpy(dst, vfrom, len);
diff --git a/target/linux/bcm47xx/patches-5.15/209-b44-register-adm-switch.patch b/target/linux/bcm47xx/patches-5.15/209-b44-register-adm-switch.patch
new file mode 100644
index 00000000000000..7728ec10942fd3
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/209-b44-register-adm-switch.patch
@@ -0,0 +1,121 @@
+From b36f694256f41bc71571f467646d015dda128d14 Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Sat, 9 Nov 2013 17:03:59 +0100
+Subject: [PATCH 210/210] b44: register adm switch
+
+---
+ drivers/net/ethernet/broadcom/b44.c |   57 +++++++++++++++++++++++++++++++++++
+ drivers/net/ethernet/broadcom/b44.h |    3 ++
+ 2 files changed, 60 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/b44.c
++++ b/drivers/net/ethernet/broadcom/b44.c
+@@ -31,6 +31,8 @@
+ #include <linux/ssb/ssb.h>
+ #include <linux/slab.h>
+ #include <linux/phy.h>
++#include <linux/platform_device.h>
++#include <linux/platform_data/adm6996-gpio.h>
+ 
+ #include <linux/uaccess.h>
+ #include <asm/io.h>
+@@ -2243,6 +2245,69 @@ static void b44_adjust_link(struct net_d
+ 	}
+ }
+ 
++#ifdef CONFIG_BCM47XX
++static int b44_register_adm_switch(struct b44 *bp)
++{
++	int gpio;
++	struct platform_device *pdev;
++	struct adm6996_gpio_platform_data adm_data = {0};
++	struct platform_device_info info = {0};
++
++	adm_data.model = ADM6996L;
++	gpio = bcm47xx_nvram_gpio_pin("adm_eecs");
++	if (gpio >= 0)
++		adm_data.eecs = gpio;
++	else
++		adm_data.eecs = 2;
++
++	gpio = bcm47xx_nvram_gpio_pin("adm_eesk");
++	if (gpio >= 0)
++		adm_data.eesk = gpio;
++	else
++		adm_data.eesk = 3;
++
++	gpio = bcm47xx_nvram_gpio_pin("adm_eedi");
++	if (gpio >= 0)
++		adm_data.eedi = gpio;
++	else
++		adm_data.eedi = 4;
++
++	/*
++	 * We ignore the "adm_rc" GPIO here. The driver does not use it,
++	 * and it conflicts with the Reset button GPIO on the Linksys WRT54GSv1.
++	 */
++
++	info.parent = bp->sdev->dev;
++	info.name = "adm6996_gpio";
++	info.id = -1;
++	info.data = &adm_data;
++	info.size_data = sizeof(adm_data);
++
++	if (!bp->adm_switch) {
++		pdev = platform_device_register_full(&info);
++		if (IS_ERR(pdev))
++			return PTR_ERR(pdev);
++
++		bp->adm_switch = pdev;
++	}
++	return 0;
++}
++static void b44_unregister_adm_switch(struct b44 *bp)
++{
++	if (bp->adm_switch)
++		platform_device_unregister(bp->adm_switch);
++}
++#else
++static int b44_register_adm_switch(struct b44 *bp)
++{
++	return 0;
++}
++static void b44_unregister_adm_switch(struct b44 *bp)
++{
++
++}
++#endif /* CONFIG_BCM47XX */
++
+ static int b44_register_phy_one(struct b44 *bp)
+ {
+ 	__ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
+@@ -2279,6 +2344,9 @@ static int b44_register_phy_one(struct b
+ 	if (!mdiobus_is_registered_device(bp->mii_bus, bp->phy_addr) &&
+ 	    (sprom->boardflags_lo & (B44_BOARDFLAG_ROBO | B44_BOARDFLAG_ADM))) {
+ 
++		if (sprom->boardflags_lo & B44_BOARDFLAG_ADM)
++			b44_register_adm_switch(bp);
++
+ 		dev_info(sdev->dev,
+ 			 "could not find PHY at %i, use fixed one\n",
+ 			 bp->phy_addr);
+@@ -2473,6 +2541,7 @@ static void b44_remove_one(struct ssb_de
+ 	unregister_netdev(dev);
+ 	if (bp->flags & B44_FLAG_EXTERNAL_PHY)
+ 		b44_unregister_phy_one(bp);
++	b44_unregister_adm_switch(bp);
+ 	ssb_device_disable(sdev, 0);
+ 	ssb_bus_may_powerdown(sdev->bus);
+ 	netif_napi_del(&bp->napi);
+--- a/drivers/net/ethernet/broadcom/b44.h
++++ b/drivers/net/ethernet/broadcom/b44.h
+@@ -408,6 +408,9 @@ struct b44 {
+ 	struct mii_bus		*mii_bus;
+ 	int			old_link;
+ 	struct mii_if_info	mii_if;
++
++	/* platform device for associated switch */
++	struct platform_device *adm_switch;
+ };
+ 
+ #endif /* _B44_H */
diff --git a/target/linux/bcm47xx/patches-5.15/210-b44_phy_fix.patch b/target/linux/bcm47xx/patches-5.15/210-b44_phy_fix.patch
new file mode 100644
index 00000000000000..bedebc415e73e5
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/210-b44_phy_fix.patch
@@ -0,0 +1,54 @@
+--- a/drivers/net/ethernet/broadcom/b44.c
++++ b/drivers/net/ethernet/broadcom/b44.c
+@@ -429,10 +429,34 @@ static void b44_wap54g10_workaround(stru
+ error:
+ 	pr_warn("PHY: cannot reset MII transceiver isolate bit\n");
+ }
++
++static void b44_bcm47xx_workarounds(struct b44 *bp)
++{
++	char buf[20];
++	struct ssb_device *sdev = bp->sdev;
++
++	/* Toshiba WRC-1000, Siemens SE505 v1, Askey RT-210W, RT-220W */
++	if (sdev->bus->sprom.board_num == 100) {
++		bp->phy_addr = B44_PHY_ADDR_NO_LOCAL_PHY;
++	} else {
++		/* WL-HDD */
++		if (bcm47xx_nvram_getenv("hardware_version", buf, sizeof(buf)) >= 0 &&
++		    !strncmp(buf, "WL300-", strlen("WL300-"))) {
++			if (sdev->bus->sprom.et0phyaddr == 0 &&
++			    sdev->bus->sprom.et1phyaddr == 1)
++				bp->phy_addr = B44_PHY_ADDR_NO_LOCAL_PHY;
++		}
++	}
++	return;
++}
+ #else
+ static inline void b44_wap54g10_workaround(struct b44 *bp)
+ {
+ }
++
++static inline void b44_bcm47xx_workarounds(struct b44 *bp)
++{
++}
+ #endif
+ 
+ static int b44_setup_phy(struct b44 *bp)
+@@ -441,6 +465,7 @@ static int b44_setup_phy(struct b44 *bp)
+ 	int err;
+ 
+ 	b44_wap54g10_workaround(bp);
++	b44_bcm47xx_workarounds(bp);
+ 
+ 	if (bp->flags & B44_FLAG_EXTERNAL_PHY)
+ 		return 0;
+@@ -2173,6 +2198,8 @@ static int b44_get_invariants(struct b44
+ 	 * valid PHY address. */
+ 	bp->phy_addr &= 0x1F;
+ 
++	b44_bcm47xx_workarounds(bp);
++
+ 	memcpy(bp->dev->dev_addr, addr, ETH_ALEN);
+ 
+ 	if (!is_valid_ether_addr(&bp->dev->dev_addr[0])){
diff --git a/target/linux/bcm47xx/patches-5.15/280-activate_ssb_support_in_usb.patch b/target/linux/bcm47xx/patches-5.15/280-activate_ssb_support_in_usb.patch
new file mode 100644
index 00000000000000..f6e9e6d30a627f
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/280-activate_ssb_support_in_usb.patch
@@ -0,0 +1,25 @@
+This prevents the options from being delete with make kernel_oldconfig.
+---
+ drivers/ssb/Kconfig |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/bcma/Kconfig
++++ b/drivers/bcma/Kconfig
+@@ -36,6 +36,7 @@ config BCMA_HOST_PCI
+ config BCMA_HOST_SOC
+ 	bool "Support for BCMA in a SoC"
+ 	depends on HAS_IOMEM
++	select USB_HCD_BCMA if USB_EHCI_HCD || USB_OHCI_HCD
+ 	help
+ 	  Host interface for a Broadcom AIX bus directly mapped into
+ 	  the memory. This only works with the Broadcom SoCs from the
+--- a/drivers/ssb/Kconfig
++++ b/drivers/ssb/Kconfig
+@@ -141,6 +141,7 @@ config SSB_SFLASH
+ config SSB_EMBEDDED
+ 	bool
+ 	depends on SSB_DRIVER_MIPS && SSB_PCICORE_HOSTMODE
++	select USB_HCD_SSB if USB_EHCI_HCD || USB_OHCI_HCD
+ 	default y
+ 
+ config SSB_DRIVER_EXTIF
diff --git a/target/linux/bcm47xx/patches-5.15/300-fork_cacheflush.patch b/target/linux/bcm47xx/patches-5.15/300-fork_cacheflush.patch
new file mode 100644
index 00000000000000..daa2c1adf05cfe
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/300-fork_cacheflush.patch
@@ -0,0 +1,21 @@
+From: Wolfram Joost <dbox2@frokaschwei.de>
+Subject: [PATCH] fork_cacheflush
+
+On ASUS WL-500gP there are many unexpected "Segmentation fault"s that
+seem to be caused by a kernel. They can be avoided by:
+1) Disabling highpage
+2) Using flush_cache_mm in flush_cache_dup_mm
+
+For details see OpenWrt ticket #2035 https://dev.openwrt.org/ticket/2035
+---
+--- a/arch/mips/include/asm/cacheflush.h
++++ b/arch/mips/include/asm/cacheflush.h
+@@ -46,7 +46,7 @@
+ extern void (*flush_cache_all)(void);
+ extern void (*__flush_cache_all)(void);
+ extern void (*flush_cache_mm)(struct mm_struct *mm);
+-#define flush_cache_dup_mm(mm)	do { (void) (mm); } while (0)
++#define flush_cache_dup_mm(mm) flush_cache_mm(mm)
+ extern void (*flush_cache_range)(struct vm_area_struct *vma,
+ 	unsigned long start, unsigned long end);
+ extern void (*flush_cache_page)(struct vm_area_struct *vma, unsigned long page, unsigned long pfn);
diff --git a/target/linux/bcm47xx/patches-5.15/310-no_highpage.patch b/target/linux/bcm47xx/patches-5.15/310-no_highpage.patch
new file mode 100644
index 00000000000000..8f368e3e9eab5c
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/310-no_highpage.patch
@@ -0,0 +1,74 @@
+From: Jeff Hansen <jhansen@cardaccess-inc.com>
+Subject: [PATCH] no highpage
+
+On ASUS WL-500gP there are many unexpected "Segmentation fault"s that
+seem to be caused by a kernel. They can be avoided by:
+1) Disabling highpage
+2) Using flush_cache_mm in flush_cache_dup_mm
+
+For details see OpenWrt ticket #2035 https://dev.openwrt.org/ticket/2035
+---
+--- a/arch/mips/include/asm/page.h
++++ b/arch/mips/include/asm/page.h
+@@ -71,6 +71,7 @@ static inline unsigned int page_size_ftl
+ #endif /* CONFIG_MIPS_HUGE_TLB_SUPPORT */
+ 
+ #include <linux/pfn.h>
++#include <asm/cpu-features.h>
+ 
+ extern void build_clear_page(void);
+ extern void build_copy_page(void);
+@@ -110,11 +111,16 @@ static inline void clear_user_page(void
+ 		flush_data_cache_page((unsigned long)addr);
+ }
+ 
+-struct vm_area_struct;
+-extern void copy_user_highpage(struct page *to, struct page *from,
+-	unsigned long vaddr, struct vm_area_struct *vma);
++static inline void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
++	struct page *to)
++{
++	extern void (*flush_data_cache_page)(unsigned long addr);
+ 
+-#define __HAVE_ARCH_COPY_USER_HIGHPAGE
++	copy_page(vto, vfrom);
++	if (!cpu_has_ic_fills_f_dc ||
++	    pages_do_alias((unsigned long)vto, vaddr & PAGE_MASK))
++		flush_data_cache_page((unsigned long)vto);
++}
+ 
+ /*
+  * These are used to make use of C type-checking..
+--- a/arch/mips/mm/init.c
++++ b/arch/mips/mm/init.c
+@@ -166,30 +166,6 @@ void kunmap_coherent(void)
+ 	preempt_enable();
+ }
+ 
+-void copy_user_highpage(struct page *to, struct page *from,
+-	unsigned long vaddr, struct vm_area_struct *vma)
+-{
+-	void *vfrom, *vto;
+-
+-	vto = kmap_atomic(to);
+-	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
+-	    page_mapcount(from) && !Page_dcache_dirty(from)) {
+-		vfrom = kmap_coherent(from, vaddr);
+-		copy_page(vto, vfrom);
+-		kunmap_coherent();
+-	} else {
+-		vfrom = kmap_atomic(from);
+-		copy_page(vto, vfrom);
+-		kunmap_atomic(vfrom);
+-	}
+-	if ((!cpu_has_ic_fills_f_dc) ||
+-	    pages_do_alias((unsigned long)vto, vaddr & PAGE_MASK))
+-		flush_data_cache_page((unsigned long)vto);
+-	kunmap_atomic(vto);
+-	/* Make sure this page is cleared on other CPU's too before using it */
+-	smp_wmb();
+-}
+-
+ void copy_to_user_page(struct vm_area_struct *vma,
+ 	struct page *page, unsigned long vaddr, void *dst, const void *src,
+ 	unsigned long len)
diff --git a/target/linux/bcm47xx/patches-5.15/400-mtd-bcm47xxpart-get-nvram.patch b/target/linux/bcm47xx/patches-5.15/400-mtd-bcm47xxpart-get-nvram.patch
new file mode 100644
index 00000000000000..17abe89d1d4395
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/400-mtd-bcm47xxpart-get-nvram.patch
@@ -0,0 +1,34 @@
+--- a/drivers/mtd/parsers/bcm47xxpart.c
++++ b/drivers/mtd/parsers/bcm47xxpart.c
+@@ -98,6 +98,7 @@ static int bcm47xxpart_parse(struct mtd_
+ 	int trx_num = 0; /* Number of found TRX partitions */
+ 	int possible_nvram_sizes[] = { 0x8000, 0xF000, 0x10000, };
+ 	int err;
++	bool found_nvram = false;
+ 
+ 	/*
+ 	 * Some really old flashes (like AT45DB*) had smaller erasesize-s, but
+@@ -279,12 +280,23 @@ static int bcm47xxpart_parse(struct mtd_
+ 		if (buf[0] == NVRAM_HEADER) {
+ 			bcm47xxpart_add_part(&parts[curr_part++], "nvram",
+ 					     master->size - blocksize, 0);
++			found_nvram = true;
+ 			break;
+ 		}
+ 	}
+ 
+ 	kfree(buf);
+ 
++	if (!found_nvram) {
++		pr_err("can not find a nvram partition reserve last block\n");
++		bcm47xxpart_add_part(&parts[curr_part++], "nvram_guess",
++				     master->size - blocksize * 2, MTD_WRITEABLE);
++		for (i = 0; i < curr_part; i++) {
++			if (parts[i].size + parts[i].offset == master->size)
++				parts[i].offset -= blocksize * 2;
++		}
++	}
++
+ 	/*
+ 	 * Assume that partitions end at the beginning of the one they are
+ 	 * followed by.
diff --git a/target/linux/bcm47xx/patches-5.15/700-net-bgmac-connect-to-PHY-even-if-it-is-BGMAC_PHY_NOR.patch b/target/linux/bcm47xx/patches-5.15/700-net-bgmac-connect-to-PHY-even-if-it-is-BGMAC_PHY_NOR.patch
new file mode 100644
index 00000000000000..2fcfbb74383b44
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/700-net-bgmac-connect-to-PHY-even-if-it-is-BGMAC_PHY_NOR.patch
@@ -0,0 +1,42 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Sun, 7 Nov 2021 14:20:40 +0100
+Subject: [PATCH] net: bgmac: connect to PHY even if it is BGMAC_PHY_NOREGS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Recent bgmac change was meant to just fix a race between "Generic PHY"
+and "bcm53xx" drivers after -EPROBE_DEFER. It modified bgmac to use
+phy_connect() only if there is a real PHY device connected.
+
+That change broke bgmac on bcm47xx. bcma_phy_connect() now registers a
+fixed PHY with the bgmac_phy_connect_direct(). That fails as another
+fixed PHY (also using address 0) is already registered - by bcm47xx arch
+code bcm47xx_register_bus_complete().
+
+This change brings origial behaviour. It connects Ethernet interface
+with pseudo-PHY (switch device) and adjusts Ethernet interface link to
+match connected switch.
+
+This fixes:
+[    2.548098] bgmac_bcma bcma0:1: Failed to register fixed PHY device
+[    2.554584] bgmac_bcma bcma0:1: Cannot connect to phy
+
+Fixes: b5375509184d ("net: bgmac: improve handling PHY")
+Link: https://lore.kernel.org/netdev/3639116e-9292-03ca-b9d9-d741118a4541@gmail.com/T/#u
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+ drivers/net/ethernet/broadcom/bgmac-bcma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/bgmac-bcma.c
++++ b/drivers/net/ethernet/broadcom/bgmac-bcma.c
+@@ -94,7 +94,7 @@ static int bcma_phy_connect(struct bgmac
+ 		return 0;
+ 
+ 	/* Connect to the PHY */
+-	if (bgmac->mii_bus && bgmac->phyaddr != BGMAC_PHY_NOREGS) {
++	if (bgmac->mii_bus) {
+ 		snprintf(bus_id, sizeof(bus_id), PHY_ID_FMT, bgmac->mii_bus->id,
+ 			 bgmac->phyaddr);
+ 		phy_dev = phy_connect(bgmac->net_dev, bus_id, bgmac_adjust_link,
diff --git a/target/linux/bcm47xx/patches-5.15/701-net-bgmac-connect-to-PHY-even-if-it-is-BGMAC_PHY_NOR.patch b/target/linux/bcm47xx/patches-5.15/701-net-bgmac-connect-to-PHY-even-if-it-is-BGMAC_PHY_NOR.patch
new file mode 100644
index 00000000000000..3a2f4b06ed6d8c
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/701-net-bgmac-connect-to-PHY-even-if-it-is-BGMAC_PHY_NOR.patch
@@ -0,0 +1,33 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 10 Jun 2022 13:10:47 +0200
+Subject: [PATCH] bgmac: reduce max frame size to support just MTU 1500
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+bgmac allocates new replacement buffer before handling each received
+frame. Allocating & DMA-preparing 9724 B each time consumes a lot of CPU
+time. Ideally bgmac should just respect currently set MTU but it isn't
+the case right now. For now just revert back to the old limited frame
+size.
+
+This change bumps NAT masquarade speed by ~95%.
+
+Ref: 8c7da63978f1 ("bgmac: configure MTU and add support for frames beyond 8192 byte size")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+ drivers/net/ethernet/broadcom/bgmac.h | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bgmac.h
++++ b/drivers/net/ethernet/broadcom/bgmac.h
+@@ -328,8 +328,7 @@
+ #define BGMAC_RX_FRAME_OFFSET			30		/* There are 2 unused bytes between header and real data */
+ #define BGMAC_RX_BUF_OFFSET			(NET_SKB_PAD + NET_IP_ALIGN - \
+ 						 BGMAC_RX_FRAME_OFFSET)
+-/* Jumbo frame size with FCS */
+-#define BGMAC_RX_MAX_FRAME_SIZE			9724
++#define BGMAC_RX_MAX_FRAME_SIZE			1536
+ #define BGMAC_RX_BUF_SIZE			(BGMAC_RX_FRAME_OFFSET + BGMAC_RX_MAX_FRAME_SIZE)
+ #define BGMAC_RX_ALLOC_SIZE			(SKB_DATA_ALIGN(BGMAC_RX_BUF_SIZE + BGMAC_RX_BUF_OFFSET) + \
+ 						 SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
diff --git a/target/linux/bcm47xx/patches-5.15/791-tg3-no-pci-sleep.patch b/target/linux/bcm47xx/patches-5.15/791-tg3-no-pci-sleep.patch
new file mode 100644
index 00000000000000..2c2f540695229c
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/791-tg3-no-pci-sleep.patch
@@ -0,0 +1,17 @@
+When the Ethernet controller is powered down and someone wants to 
+access the mdio bus like the witch driver (b53) the system crashed if 
+PCI_D3hot was set before. This patch deactivates this power sawing mode 
+when a switch driver is in use.
+
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -4267,7 +4267,8 @@ static int tg3_power_down_prepare(struct
+ static void tg3_power_down(struct tg3 *tp)
+ {
+ 	pci_wake_from_d3(tp->pdev, tg3_flag(tp, WOL_ENABLE));
+-	pci_set_power_state(tp->pdev, PCI_D3hot);
++	if (!tg3_flag(tp, ROBOSWITCH))
++		pci_set_power_state(tp->pdev, PCI_D3hot);
+ }
+ 
+ static void tg3_aux_stat_to_speed_duplex(struct tg3 *tp, u32 val, u32 *speed, u8 *duplex)
diff --git a/target/linux/bcm47xx/patches-5.15/800-bcma-add-table-of-serial-flashes-with-smaller-blocks.patch b/target/linux/bcm47xx/patches-5.15/800-bcma-add-table-of-serial-flashes-with-smaller-blocks.patch
new file mode 100644
index 00000000000000..318dc55810c684
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/800-bcma-add-table-of-serial-flashes-with-smaller-blocks.patch
@@ -0,0 +1,73 @@
+From 597715c61ae75a05ab3310a34ff3857a006f0f63 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Thu, 20 Nov 2014 21:32:42 +0100
+Subject: [PATCH] bcma: add table of serial flashes with smaller blocks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+---
+ drivers/bcma/driver_chipcommon_sflash.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+--- a/drivers/bcma/driver_chipcommon_sflash.c
++++ b/drivers/bcma/driver_chipcommon_sflash.c
+@@ -9,6 +9,7 @@
+ 
+ #include <linux/platform_device.h>
+ #include <linux/bcma/bcma.h>
++#include <bcm47xx_board.h>
+ 
+ static struct resource bcma_sflash_resource = {
+ 	.name	= "bcma_sflash",
+@@ -42,6 +43,13 @@ static const struct bcma_sflash_tbl_e bc
+ 	{ NULL },
+ };
+ 
++/* Some devices use smaller blocks (and have more of them) */
++static const struct bcma_sflash_tbl_e bcma_sflash_st_shrink_tbl[] = {
++	{ "M25P16", 0x14, 0x1000, 512, },
++	{ "M25P32", 0x15, 0x1000, 1024, },
++	{ NULL },
++};
++
+ static const struct bcma_sflash_tbl_e bcma_sflash_sst_tbl[] = {
+ 	{ "SST25WF512", 1, 0x1000, 16, },
+ 	{ "SST25VF512", 0x48, 0x1000, 16, },
+@@ -85,6 +93,24 @@ static void bcma_sflash_cmd(struct bcma_
+ 	bcma_err(cc->core->bus, "SFLASH control command failed (timeout)!\n");
+ }
+ 
++const struct bcma_sflash_tbl_e *bcma_sflash_shrink_flash(u32 id)
++{
++	enum bcm47xx_board board = bcm47xx_board_get();
++	const struct bcma_sflash_tbl_e *e;
++
++	switch (board) {
++	case BCM47XX_BOARD_NETGEAR_WGR614_V10:
++	case BCM47XX_BOARD_NETGEAR_WNR1000_V3:
++		for (e = bcma_sflash_st_shrink_tbl; e->name; e++) {
++			if (e->id == id)
++				return e;
++		}
++		return NULL;
++	default:
++		return NULL;
++	}
++}
++
+ /* Initialize serial flash access */
+ int bcma_sflash_init(struct bcma_drv_cc *cc)
+ {
+@@ -115,6 +141,10 @@ int bcma_sflash_init(struct bcma_drv_cc
+ 		case 0x13:
+ 			return -ENOTSUPP;
+ 		default:
++			e = bcma_sflash_shrink_flash(id);
++			if (e)
++				break;
++
+ 			for (e = bcma_sflash_st_tbl; e->name; e++) {
+ 				if (e->id == id)
+ 					break;
diff --git a/target/linux/bcm47xx/patches-5.15/820-wgt634u-nvram-fix.patch b/target/linux/bcm47xx/patches-5.15/820-wgt634u-nvram-fix.patch
new file mode 100644
index 00000000000000..82997ca65a116b
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/820-wgt634u-nvram-fix.patch
@@ -0,0 +1,296 @@
+The Netgear wgt634u uses a different format for storing the 
+configuration. This patch is needed to read out the correct 
+configuration. The cfe_env.c file uses a different method way to read 
+out the configuration than the in kernel cfe config reader.
+
+--- a/drivers/firmware/broadcom/Makefile
++++ b/drivers/firmware/broadcom/Makefile
+@@ -1,4 +1,4 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+-obj-$(CONFIG_BCM47XX_NVRAM)		+= bcm47xx_nvram.o
++obj-$(CONFIG_BCM47XX_NVRAM)		+= bcm47xx_nvram.o cfe_env.o
+ obj-$(CONFIG_BCM47XX_SPROM)		+= bcm47xx_sprom.o
+ obj-$(CONFIG_TEE_BNXT_FW)		+= tee_bnxt_fw.o
+--- /dev/null
++++ b/drivers/firmware/broadcom/cfe_env.c
+@@ -0,0 +1,228 @@
++/*
++ * CFE environment variable access
++ *
++ * Copyright 2001-2003, Broadcom Corporation
++ * Copyright 2006, Felix Fietkau <nbd@nbd.name>
++ * 
++ * This program is free software; you can redistribute  it and/or modify it
++ * under  the terms of  the GNU General  Public License as published by the
++ * Free Software Foundation;  either version 2 of the  License, or (at your
++ * option) any later version.
++ */
++
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/string.h>
++#include <asm/io.h>
++#include <linux/uaccess.h>
++
++#define NVRAM_SIZE       (0x1ff0)
++static char _nvdata[NVRAM_SIZE];
++static char _valuestr[256];
++
++/*
++ * TLV types.  These codes are used in the "type-length-value"
++ * encoding of the items stored in the NVRAM device (flash or EEPROM)
++ *
++ * The layout of the flash/nvram is as follows:
++ *
++ * <type> <length> <data ...> <type> <length> <data ...> <type_end>
++ *
++ * The type code of "ENV_TLV_TYPE_END" marks the end of the list.
++ * The "length" field marks the length of the data section, not
++ * including the type and length fields.
++ *
++ * Environment variables are stored as follows:
++ *
++ * <type_env> <length> <flags> <name> = <value>
++ *
++ * If bit 0 (low bit) is set, the length is an 8-bit value.
++ * If bit 0 (low bit) is clear, the length is a 16-bit value
++ * 
++ * Bit 7 set indicates "user" TLVs.  In this case, bit 0 still
++ * indicates the size of the length field.  
++ *
++ * Flags are from the constants below:
++ *
++ */
++#define ENV_LENGTH_16BITS	0x00	/* for low bit */
++#define ENV_LENGTH_8BITS	0x01
++
++#define ENV_TYPE_USER		0x80
++
++#define ENV_CODE_SYS(n,l) (((n)<<1)|(l))
++#define ENV_CODE_USER(n,l) ((((n)<<1)|(l)) | ENV_TYPE_USER)
++
++/*
++ * The actual TLV types we support
++ */
++
++#define ENV_TLV_TYPE_END	0x00	
++#define ENV_TLV_TYPE_ENV	ENV_CODE_SYS(0,ENV_LENGTH_8BITS)
++
++/*
++ * Environment variable flags 
++ */
++
++#define ENV_FLG_NORMAL		0x00	/* normal read/write */
++#define ENV_FLG_BUILTIN		0x01	/* builtin - not stored in flash */
++#define ENV_FLG_READONLY	0x02	/* read-only - cannot be changed */
++
++#define ENV_FLG_MASK		0xFF	/* mask of attributes we keep */
++#define ENV_FLG_ADMIN		0x100	/* lets us internally override permissions */
++
++
++/*  *********************************************************************
++    *  _nvram_read(buffer,offset,length)
++    *  
++    *  Read data from the NVRAM device
++    *  
++    *  Input parameters: 
++    *  	   buffer - destination buffer
++    *  	   offset - offset of data to read
++    *  	   length - number of bytes to read
++    *  	   
++    *  Return value:
++    *  	   number of bytes read, or <0 if error occured
++    ********************************************************************* */
++static int
++_nvram_read(unsigned char *nv_buf, unsigned char *buffer, int offset, int length)
++{
++    int i;
++    if (offset > NVRAM_SIZE)
++	return -1; 
++
++    for ( i = 0; i < length; i++) {
++	buffer[i] = ((volatile unsigned char*)nv_buf)[offset + i];
++    }
++    return length;
++}
++
++
++static char*
++_strnchr(const char *dest,int c,size_t cnt)
++{
++	while (*dest && (cnt > 0)) {
++	if (*dest == c) return (char *) dest;
++	dest++;
++	cnt--;
++	}
++	return NULL;
++}
++
++
++
++/*
++ * Core support API: Externally visible.
++ */
++
++/*
++ * Get the value of an NVRAM variable
++ * @param	name	name of variable to get
++ * @return	value of variable or NULL if undefined
++ */
++
++char *cfe_env_get(unsigned char *nv_buf, const char *name)
++{
++    int size;
++    unsigned char *buffer;
++    unsigned char *ptr;
++    unsigned char *envval;
++    unsigned int reclen;
++    unsigned int rectype;
++    int offset;
++    int flg;
++    
++	if (!strcmp(name, "nvram_type"))
++		return "cfe";
++	
++    size = NVRAM_SIZE;
++    buffer = &_nvdata[0];
++
++    ptr = buffer;
++    offset = 0;
++
++    /* Read the record type and length */
++    if (_nvram_read(nv_buf, ptr,offset,1) != 1) {
++	goto error;
++    }
++    
++    while ((*ptr != ENV_TLV_TYPE_END)  && (size > 1)) {
++
++	/* Adjust pointer for TLV type */
++	rectype = *(ptr);
++	offset++;
++	size--;
++
++	/* 
++	 * Read the length.  It can be either 1 or 2 bytes
++	 * depending on the code 
++	 */
++	if (rectype & ENV_LENGTH_8BITS) {
++	    /* Read the record type and length - 8 bits */
++	    if (_nvram_read(nv_buf, ptr,offset,1) != 1) {
++		goto error;
++	    }
++	    reclen = *(ptr);
++	    size--;
++	    offset++;
++	}
++	else {
++	    /* Read the record type and length - 16 bits, MSB first */
++	    if (_nvram_read(nv_buf, ptr,offset,2) != 2) {
++		goto error;
++	    }
++	    reclen = (((unsigned int) *(ptr)) << 8) + (unsigned int) *(ptr+1);
++	    size -= 2;
++	    offset += 2;
++	}
++
++	if (reclen > size)
++	    break;	/* should not happen, bad NVRAM */
++
++	switch (rectype) {
++	    case ENV_TLV_TYPE_ENV:
++		/* Read the TLV data */
++		if (_nvram_read(nv_buf, ptr,offset,reclen) != reclen)
++		    goto error;
++		flg = *ptr++;
++		envval = (unsigned char *) _strnchr(ptr,'=',(reclen-1));
++		if (envval) {
++		    *envval++ = '\0';
++		    memcpy(_valuestr,envval,(reclen-1)-(envval-ptr));
++		    _valuestr[(reclen-1)-(envval-ptr)] = '\0';
++#if 0			
++		    printk(KERN_INFO "NVRAM:%s=%s\n", ptr, _valuestr);
++#endif
++		    if(!strcmp(ptr, name)){
++			return _valuestr;
++		    }
++		    if((strlen(ptr) > 1) && !strcmp(&ptr[1], name))
++			return _valuestr;
++		}
++		break;
++		
++	    default: 
++		/* Unknown TLV type, skip it. */
++		break;
++	    }
++
++	/*
++	 * Advance to next TLV 
++	 */
++		
++	size -= (int)reclen;
++	offset += reclen;
++
++	/* Read the next record type */
++	ptr = buffer;
++	if (_nvram_read(nv_buf, ptr,offset,1) != 1)
++	    goto error;
++	}
++
++error:
++    return NULL;
++
++}
++
+--- a/drivers/firmware/broadcom/bcm47xx_nvram.c
++++ b/drivers/firmware/broadcom/bcm47xx_nvram.c
+@@ -33,6 +33,8 @@ struct nvram_header {
+ static char nvram_buf[NVRAM_SPACE];
+ static size_t nvram_len;
+ static const u32 nvram_sizes[] = {0x6000, 0x8000, 0xF000, 0x10000};
++static int cfe_env;
++extern char *cfe_env_get(char *nv_buf, const char *name);
+ 
+ /**
+  * bcm47xx_nvram_is_valid - check for a valid NVRAM at specified memory
+@@ -80,6 +82,26 @@ static int bcm47xx_nvram_find_and_copy(v
+ 		return -EEXIST;
+ 	}
+ 
++	cfe_env = 0;
++
++	/* XXX: hack for supporting the CFE environment stuff on WGT634U */
++	if (res_size >= 8 * 1024 * 1024) {
++		u32 *src = (u32 *)(flash_start + 8 * 1024 * 1024 - 0x2000);
++		u32 *dst = (u32 *)nvram_buf;
++
++		if ((*src & 0xff00ff) == 0x000001) {
++			printk("early_nvram_init: WGT634U NVRAM found.\n");
++
++			for (i = 0; i < 0x1ff0; i++) {
++				if (*src == 0xFFFFFFFF)
++					break;
++				*dst++ = *src++;
++			}
++			cfe_env = 1;
++			return 0;
++		}
++	}
++
+ 	/* TODO: when nvram is on nand flash check for bad blocks first. */
+ 
+ 	/* Try every possible flash size and check for NVRAM at its end */
+@@ -190,6 +212,13 @@ int bcm47xx_nvram_getenv(const char *nam
+ 	if (!name)
+ 		return -EINVAL;
+ 
++	if (cfe_env) {
++		value = cfe_env_get(nvram_buf, name);
++		if (!value)
++			return -ENOENT;
++		return snprintf(val, val_len, "%s", value);
++	}
++
+ 	if (!nvram_len) {
+ 		err = nvram_init();
+ 		if (err)
diff --git a/target/linux/bcm47xx/patches-5.15/830-huawei_e970_support.patch b/target/linux/bcm47xx/patches-5.15/830-huawei_e970_support.patch
new file mode 100644
index 00000000000000..1746fee592cc30
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/830-huawei_e970_support.patch
@@ -0,0 +1,101 @@
+--- a/arch/mips/bcm47xx/setup.c
++++ b/arch/mips/bcm47xx/setup.c
+@@ -37,6 +37,7 @@
+ #include <linux/ssb/ssb.h>
+ #include <linux/ssb/ssb_embedded.h>
+ #include <linux/bcma/bcma_soc.h>
++#include <linux/old_gpio_wdt.h>
+ #include <asm/bootinfo.h>
+ #include <asm/idle.h>
+ #include <asm/prom.h>
+@@ -254,6 +255,33 @@ static struct fixed_phy_status bcm47xx_f
+ 	.duplex	= DUPLEX_FULL,
+ };
+ 
++static struct gpio_wdt_platform_data gpio_wdt_data;
++
++static struct platform_device gpio_wdt_device = {
++	.name			= "gpio-wdt",
++	.id			= 0,
++	.dev			= {
++		.platform_data	= &gpio_wdt_data,
++	},
++};
++
++static int __init bcm47xx_register_gpio_watchdog(void)
++{
++	enum bcm47xx_board board = bcm47xx_board_get();
++
++	switch (board) {
++	case BCM47XX_BOARD_HUAWEI_E970:
++		pr_info("bcm47xx: detected Huawei E970 or similar, starting early gpio_wdt timer\n");
++		gpio_wdt_data.gpio = 7;
++		gpio_wdt_data.interval = HZ;
++		gpio_wdt_data.first_interval = HZ / 5;
++		return platform_device_register(&gpio_wdt_device);
++	default:
++		/* Nothing to do */
++		return 0;
++	}
++}
++
+ static int __init bcm47xx_register_bus_complete(void)
+ {
+ 	switch (bcm47xx_bus_type) {
+@@ -275,6 +303,7 @@ static int __init bcm47xx_register_bus_c
+ 	bcm47xx_workarounds();
+ 
+ 	fixed_phy_add(PHY_POLL, 0, &bcm47xx_fixed_phy_status);
++	bcm47xx_register_gpio_watchdog();
+ 	return 0;
+ }
+ device_initcall(bcm47xx_register_bus_complete);
+--- a/arch/mips/configs/bcm47xx_defconfig
++++ b/arch/mips/configs/bcm47xx_defconfig
+@@ -63,6 +63,7 @@ CONFIG_HW_RANDOM=y
+ CONFIG_GPIO_SYSFS=y
+ CONFIG_WATCHDOG=y
+ CONFIG_BCM47XX_WDT=y
++CONFIG_GPIO_WDT=y
+ CONFIG_SSB_DRIVER_GIGE=y
+ CONFIG_BCMA_DRIVER_GMAC_CMN=y
+ CONFIG_USB=y
+--- a/drivers/ssb/embedded.c
++++ b/drivers/ssb/embedded.c
+@@ -34,11 +34,36 @@ int ssb_watchdog_timer_set(struct ssb_bu
+ }
+ EXPORT_SYMBOL(ssb_watchdog_timer_set);
+ 
++#ifdef CONFIG_BCM47XX
++#include <bcm47xx_board.h>
++
++static bool ssb_watchdog_supported(void)
++{
++	enum bcm47xx_board board = bcm47xx_board_get();
++
++	/* The Huawei E970 has a hardware watchdog using a GPIO */
++	switch (board) {
++	case BCM47XX_BOARD_HUAWEI_E970:
++		return false;
++	default:
++		return true;
++	}
++}
++#else
++static bool ssb_watchdog_supported(void)
++{
++	return true;
++}
++#endif
++
+ int ssb_watchdog_register(struct ssb_bus *bus)
+ {
+ 	struct bcm47xx_wdt wdt = {};
+ 	struct platform_device *pdev;
+ 
++	if (!ssb_watchdog_supported())
++		return 0;
++
+ 	if (ssb_chipco_available(&bus->chipco)) {
+ 		wdt.driver_data = &bus->chipco;
+ 		wdt.timer_set = ssb_chipco_watchdog_timer_set_wdt;
diff --git a/target/linux/bcm47xx/patches-5.15/831-old_gpio_wdt.patch b/target/linux/bcm47xx/patches-5.15/831-old_gpio_wdt.patch
new file mode 100644
index 00000000000000..cb3bd0f263c0e9
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/831-old_gpio_wdt.patch
@@ -0,0 +1,360 @@
+This generic GPIO watchdog is used on Huawei E970 (bcm47xx)
+
+Signed-off-by: Mathias Adam <m.adam--openwrt@adamis.de>
+
+--- a/drivers/watchdog/Kconfig
++++ b/drivers/watchdog/Kconfig
+@@ -1664,6 +1664,15 @@ config WDT_MTX1
+ 	  Hardware driver for the MTX-1 boards. This is a watchdog timer that
+ 	  will reboot the machine after a 100 seconds timer expired.
+ 
++config GPIO_WDT
++	tristate "GPIO Hardware Watchdog"
++ 	help
++	  Hardware driver for GPIO-controlled watchdogs. GPIO pin and
++	  toggle interval settings are platform-specific. The driver
++	  will stop toggling the GPIO (i.e. machine reboots) after a
++	  100 second timer expired and no process has written to
++	  /dev/watchdog during that time.
++
+ config SIBYTE_WDOG
+ 	tristate "Sibyte SoC hardware watchdog"
+ 	depends on CPU_SB1
+--- a/drivers/watchdog/Makefile
++++ b/drivers/watchdog/Makefile
+@@ -159,6 +159,7 @@ obj-$(CONFIG_RC32434_WDT) += rc32434_wdt
+ obj-$(CONFIG_INDYDOG) += indydog.o
+ obj-$(CONFIG_JZ4740_WDT) += jz4740_wdt.o
+ obj-$(CONFIG_WDT_MTX1) += mtx-1_wdt.o
++obj-$(CONFIG_GPIO_WDT) += old_gpio_wdt.o
+ obj-$(CONFIG_SIBYTE_WDOG) += sb_wdog.o
+ obj-$(CONFIG_AR7_WDT) += ar7_wdt.o
+ obj-$(CONFIG_TXX9_WDT) += txx9wdt.o
+--- /dev/null
++++ b/drivers/watchdog/old_gpio_wdt.c
+@@ -0,0 +1,301 @@
++/*
++ *      Driver for GPIO-controlled Hardware Watchdogs.
++ *
++ *      Copyright (C) 2013 Mathias Adam <m.adam--linux@adamis.de>
++ *
++ *      Replaces mtx1_wdt (driver for the MTX-1 Watchdog):
++ *
++ *      (C) Copyright 2005 4G Systems <info@4g-systems.biz>,
++ *                              All Rights Reserved.
++ *                              http://www.4g-systems.biz
++ *
++ *      (C) Copyright 2007 OpenWrt.org, Florian Fainelli <florian@openwrt.org>
++ *
++ *      This program is free software; you can redistribute it and/or
++ *      modify it under the terms of the GNU General Public License
++ *      as published by the Free Software Foundation; either version
++ *      2 of the License, or (at your option) any later version.
++ *
++ *      Neither Michael Stickel nor 4G Systems admit liability nor provide
++ *      warranty for any of this software. This material is provided
++ *      "AS-IS" and at no charge.
++ *
++ *      (c) Copyright 2005    4G Systems <info@4g-systems.biz>
++ *
++ *      Release 0.01.
++ *      Author: Michael Stickel  michael.stickel@4g-systems.biz
++ *
++ *      Release 0.02.
++ *      Author: Florian Fainelli florian@openwrt.org
++ *              use the Linux watchdog/timer APIs
++ *
++ *      Release 0.03.
++ *      Author: Mathias Adam <m.adam--linux@adamis.de>
++ *              make it a generic gpio watchdog driver
++ *
++ *      The Watchdog is configured to reset the MTX-1
++ *      if it is not triggered for 100 seconds.
++ *      It should not be triggered more often than 1.6 seconds.
++ *
++ *      A timer triggers the watchdog every 5 seconds, until
++ *      it is opened for the first time. After the first open
++ *      it MUST be triggered every 2..95 seconds.
++ */
++
++#include <linux/module.h>
++#include <linux/moduleparam.h>
++#include <linux/types.h>
++#include <linux/errno.h>
++#include <linux/miscdevice.h>
++#include <linux/fs.h>
++#include <linux/init.h>
++#include <linux/ioport.h>
++#include <linux/timer.h>
++#include <linux/completion.h>
++#include <linux/jiffies.h>
++#include <linux/watchdog.h>
++#include <linux/platform_device.h>
++#include <linux/io.h>
++#include <linux/uaccess.h>
++#include <linux/gpio.h>
++#include <linux/old_gpio_wdt.h>
++
++static int ticks = 100 * HZ;
++
++static struct {
++	struct completion stop;
++	spinlock_t lock;
++	int running;
++	struct timer_list timer;
++	int queue;
++	int default_ticks;
++	unsigned long inuse;
++	unsigned gpio;
++	unsigned int gstate;
++	int interval;
++	int first_interval;
++} gpio_wdt_device;
++
++static void gpio_wdt_trigger(struct timer_list *unused)
++{
++	spin_lock(&gpio_wdt_device.lock);
++	if (gpio_wdt_device.running && ticks > 0)
++		ticks -= gpio_wdt_device.interval;
++
++	/* toggle wdt gpio */
++	gpio_wdt_device.gstate = !gpio_wdt_device.gstate;
++	gpio_set_value(gpio_wdt_device.gpio, gpio_wdt_device.gstate);
++
++	if (gpio_wdt_device.queue && ticks > 0)
++		mod_timer(&gpio_wdt_device.timer, jiffies + gpio_wdt_device.interval);
++	else
++		complete(&gpio_wdt_device.stop);
++	spin_unlock(&gpio_wdt_device.lock);
++}
++
++static void gpio_wdt_reset(void)
++{
++	ticks = gpio_wdt_device.default_ticks;
++}
++
++
++static void gpio_wdt_start(void)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&gpio_wdt_device.lock, flags);
++	if (!gpio_wdt_device.queue) {
++		gpio_wdt_device.queue = 1;
++		gpio_wdt_device.gstate = 1;
++		gpio_set_value(gpio_wdt_device.gpio, 1);
++		mod_timer(&gpio_wdt_device.timer, jiffies + gpio_wdt_device.first_interval);
++	}
++	gpio_wdt_device.running++;
++	spin_unlock_irqrestore(&gpio_wdt_device.lock, flags);
++}
++
++static int gpio_wdt_stop(void)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&gpio_wdt_device.lock, flags);
++	if (gpio_wdt_device.queue) {
++		gpio_wdt_device.queue = 0;
++		gpio_wdt_device.gstate = 0;
++		gpio_set_value(gpio_wdt_device.gpio, 0);
++	}
++	ticks = gpio_wdt_device.default_ticks;
++	spin_unlock_irqrestore(&gpio_wdt_device.lock, flags);
++	return 0;
++}
++
++/* Filesystem functions */
++
++static int gpio_wdt_open(struct inode *inode, struct file *file)
++{
++	if (test_and_set_bit(0, &gpio_wdt_device.inuse))
++		return -EBUSY;
++	return nonseekable_open(inode, file);
++}
++
++
++static int gpio_wdt_release(struct inode *inode, struct file *file)
++{
++	clear_bit(0, &gpio_wdt_device.inuse);
++	return 0;
++}
++
++static long gpio_wdt_ioctl(struct file *file, unsigned int cmd,
++							unsigned long arg)
++{
++	void __user *argp = (void __user *)arg;
++	int __user *p = (int __user *)argp;
++	unsigned int value;
++	static const struct watchdog_info ident = {
++		.options = WDIOF_CARDRESET,
++		.identity = "GPIO WDT",
++	};
++
++	switch (cmd) {
++	case WDIOC_GETSUPPORT:
++		if (copy_to_user(argp, &ident, sizeof(ident)))
++			return -EFAULT;
++		break;
++	case WDIOC_GETSTATUS:
++	case WDIOC_GETBOOTSTATUS:
++		put_user(0, p);
++		break;
++	case WDIOC_SETOPTIONS:
++		if (get_user(value, p))
++			return -EFAULT;
++		if (value & WDIOS_ENABLECARD)
++			gpio_wdt_start();
++		else if (value & WDIOS_DISABLECARD)
++			gpio_wdt_stop();
++		else
++			return -EINVAL;
++		return 0;
++	case WDIOC_KEEPALIVE:
++		gpio_wdt_reset();
++		break;
++	default:
++		return -ENOTTY;
++	}
++	return 0;
++}
++
++
++static ssize_t gpio_wdt_write(struct file *file, const char *buf,
++						size_t count, loff_t *ppos)
++{
++	if (!count)
++		return -EIO;
++	gpio_wdt_reset();
++	return count;
++}
++
++static const struct file_operations gpio_wdt_fops = {
++	.owner		= THIS_MODULE,
++	.llseek		= no_llseek,
++	.unlocked_ioctl	= gpio_wdt_ioctl,
++	.open		= gpio_wdt_open,
++	.write		= gpio_wdt_write,
++	.release	= gpio_wdt_release,
++};
++
++
++static struct miscdevice gpio_wdt_misc = {
++	.minor	= WATCHDOG_MINOR,
++	.name	= "watchdog",
++	.fops	= &gpio_wdt_fops,
++};
++
++
++static int gpio_wdt_probe(struct platform_device *pdev)
++{
++	int ret;
++	struct gpio_wdt_platform_data *gpio_wdt_data = pdev->dev.platform_data;
++
++	gpio_wdt_device.gpio = gpio_wdt_data->gpio;
++	gpio_wdt_device.interval = gpio_wdt_data->interval;
++	gpio_wdt_device.first_interval = gpio_wdt_data->first_interval;
++	if (gpio_wdt_device.first_interval <= 0) {
++		gpio_wdt_device.first_interval = gpio_wdt_device.interval;
++	}
++
++	ret = gpio_request(gpio_wdt_device.gpio, "gpio-wdt");
++	if (ret < 0) {
++		dev_err(&pdev->dev, "failed to request gpio");
++		return ret;
++	}
++
++	spin_lock_init(&gpio_wdt_device.lock);
++	init_completion(&gpio_wdt_device.stop);
++	gpio_wdt_device.queue = 0;
++	clear_bit(0, &gpio_wdt_device.inuse);
++	timer_setup(&gpio_wdt_device.timer, gpio_wdt_trigger, 0L);
++	gpio_wdt_device.default_ticks = ticks;
++
++	gpio_wdt_start();
++	dev_info(&pdev->dev, "GPIO Hardware Watchdog driver (gpio=%i interval=%i/%i)\n",
++		gpio_wdt_data->gpio, gpio_wdt_data->first_interval, gpio_wdt_data->interval);
++	return 0;
++}
++
++static int gpio_wdt_remove(struct platform_device *pdev)
++{
++	/* FIXME: do we need to lock this test ? */
++	if (gpio_wdt_device.queue) {
++		gpio_wdt_device.queue = 0;
++		wait_for_completion(&gpio_wdt_device.stop);
++	}
++
++	gpio_free(gpio_wdt_device.gpio);
++	misc_deregister(&gpio_wdt_misc);
++	return 0;
++}
++
++static struct platform_driver gpio_wdt_driver = {
++	.probe = gpio_wdt_probe,
++	.remove = gpio_wdt_remove,
++	.driver.name = "gpio-wdt",
++	.driver.owner = THIS_MODULE,
++};
++
++static int __init gpio_wdt_init(void)
++{
++	return platform_driver_register(&gpio_wdt_driver);
++}
++arch_initcall(gpio_wdt_init);
++
++/*
++ * We do wdt initialization in two steps: arch_initcall probes the wdt
++ * very early to start pinging the watchdog (misc devices are not yet
++ * available), and later module_init() just registers the misc device.
++ */
++static int gpio_wdt_init_late(void)
++{
++	int ret;
++
++	ret = misc_register(&gpio_wdt_misc);
++	if (ret < 0) {
++		pr_err("GPIO_WDT: failed to register misc device\n");
++		return ret;
++	}
++	return 0;
++}
++#ifndef MODULE
++module_init(gpio_wdt_init_late);
++#endif
++
++static void __exit gpio_wdt_exit(void)
++{
++	platform_driver_unregister(&gpio_wdt_driver);
++}
++module_exit(gpio_wdt_exit);
++
++MODULE_AUTHOR("Michael Stickel, Florian Fainelli, Mathias Adam");
++MODULE_DESCRIPTION("Driver for GPIO hardware watchdogs");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
++MODULE_ALIAS("platform:gpio-wdt");
+--- /dev/null
++++ b/include/linux/old_gpio_wdt.h
+@@ -0,0 +1,21 @@
++/*
++ *  Definitions for the GPIO watchdog driver
++ *
++ *  Copyright (C) 2013 Mathias Adam <m.adam--linux@adamis.de>
++ *
++ *  This program is free software; you can redistribute it and/or modify
++ *  it under the terms of the GNU General Public License version 2 as
++ *  published by the Free Software Foundation.
++ *
++ */
++
++#ifndef _GPIO_WDT_H_
++#define _GPIO_WDT_H_
++
++struct gpio_wdt_platform_data {
++	int	gpio;		/* GPIO line number */
++	int	interval;	/* watchdog reset interval in system ticks */
++	int	first_interval;	/* first wd reset interval in system ticks */
++};
++
++#endif /* _GPIO_WDT_H_ */
diff --git a/target/linux/bcm47xx/patches-5.15/900-ssb-reject-PCI-writes-setting-CardBus-bridge-resourc.patch b/target/linux/bcm47xx/patches-5.15/900-ssb-reject-PCI-writes-setting-CardBus-bridge-resourc.patch
new file mode 100644
index 00000000000000..970e36eb68393d
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/900-ssb-reject-PCI-writes-setting-CardBus-bridge-resourc.patch
@@ -0,0 +1,30 @@
+From 5c81397a0147ea59c778d1de14ef54e2268221f6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Wed, 8 Apr 2015 06:58:11 +0200
+Subject: [PATCH] ssb: reject PCI writes setting CardBus bridge resources
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+If SoC has a CardBus we can set resources of device at slot 1 only. It's
+impossigle to set bridge resources as it simply overwrites device 1
+configuration and usually results in Data bus error-s.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+---
+ drivers/ssb/driver_pcicore.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/ssb/driver_pcicore.c
++++ b/drivers/ssb/driver_pcicore.c
+@@ -165,6 +165,10 @@ static int ssb_extpci_write_config(struc
+ 	WARN_ON(!pc->hostmode);
+ 	if (unlikely(len != 1 && len != 2 && len != 4))
+ 		goto out;
++	/* CardBus SoCs allow configuring dev 1 resources only */
++	if (extpci_core->cardbusmode && dev != 1 &&
++	    off >= PCI_BASE_ADDRESS_0 && off <= PCI_BASE_ADDRESS_5)
++		goto out;
+ 	addr = get_cfgspace_addr(pc, bus, dev, func, off);
+ 	if (unlikely(!addr))
+ 		goto out;
diff --git a/target/linux/bcm47xx/patches-5.15/940-bcm47xx-yenta.patch b/target/linux/bcm47xx/patches-5.15/940-bcm47xx-yenta.patch
new file mode 100644
index 00000000000000..1a5b98b8b214ad
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/940-bcm47xx-yenta.patch
@@ -0,0 +1,48 @@
+--- a/drivers/pcmcia/yenta_socket.c
++++ b/drivers/pcmcia/yenta_socket.c
+@@ -923,6 +923,8 @@ static struct cardbus_type cardbus_type[
+ 
+ static unsigned int yenta_probe_irq(struct yenta_socket *socket, u32 isa_irq_mask)
+ {
++/* WRT54G3G does not like this */
++#ifndef CONFIG_BCM47XX
+ 	int i;
+ 	unsigned long val;
+ 	u32 mask;
+@@ -951,6 +953,9 @@ static unsigned int yenta_probe_irq(stru
+ 	mask = probe_irq_mask(val) & 0xffff;
+ 
+ 	return mask;
++#else
++	return 0;
++#endif
+ }
+ 
+ 
+@@ -1031,6 +1036,10 @@ static void yenta_get_socket_capabilitie
+ 	else
+ 		socket->socket.irq_mask = 0;
+ 
++	/* irq mask probing is broken for the WRT54G3G */
++	if (socket->socket.irq_mask == 0)
++		socket->socket.irq_mask = 0x6f8;
++
+ 	dev_info(&socket->dev->dev, "ISA IRQ mask 0x%04x, PCI irq %d\n",
+ 		 socket->socket.irq_mask, socket->cb_irq);
+ }
+@@ -1262,6 +1271,15 @@ static int yenta_probe(struct pci_dev *d
+ 	dev_info(&dev->dev, "Socket status: %08x\n",
+ 		 cb_readl(socket, CB_SOCKET_STATE));
+ 
++	/* Generate an interrupt on card insert/remove */
++	config_writew(socket, CB_SOCKET_MASK, CB_CSTSMASK | CB_CDMASK);
++
++	/* Set up Multifunction Routing Status Register */
++	config_writew(socket, 0x8C, 0x1000 /* MFUNC3 to GPIO3 */ | 0x2 /* MFUNC0 to INTA */);
++
++	/* Switch interrupts to parallelized */
++	config_writeb(socket, 0x92, 0x64);
++
+ 	yenta_fixup_parent_bridge(dev->subordinate);
+ 
+ 	/* Register it with the pcmcia layer.. */
diff --git a/target/linux/bcm47xx/patches-5.15/976-ssb_increase_pci_delay.patch b/target/linux/bcm47xx/patches-5.15/976-ssb_increase_pci_delay.patch
new file mode 100644
index 00000000000000..201be1b1873515
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/976-ssb_increase_pci_delay.patch
@@ -0,0 +1,11 @@
+--- a/drivers/ssb/driver_pcicore.c
++++ b/drivers/ssb/driver_pcicore.c
+@@ -394,7 +394,7 @@ static void ssb_pcicore_init_hostmode(st
+ 	/* Give some time to the PCI controller to configure itself with the new
+ 	 * values. Not waiting at this point causes crashes of the machine.
+ 	 */
+-	mdelay(10);
++	mdelay(300);
+ 	register_pci_controller(&ssb_pcicore_controller);
+ }
+ 
diff --git a/target/linux/bcm47xx/patches-5.15/999-wl_exports.patch b/target/linux/bcm47xx/patches-5.15/999-wl_exports.patch
new file mode 100644
index 00000000000000..b47913af70eef5
--- /dev/null
+++ b/target/linux/bcm47xx/patches-5.15/999-wl_exports.patch
@@ -0,0 +1,24 @@
+--- a/drivers/firmware/broadcom/bcm47xx_nvram.c
++++ b/drivers/firmware/broadcom/bcm47xx_nvram.c
+@@ -30,7 +30,8 @@ struct nvram_header {
+ 	u32 config_ncdl;	/* ncdl values for memc */
+ };
+ 
+-static char nvram_buf[NVRAM_SPACE];
++char nvram_buf[NVRAM_SPACE];
++EXPORT_SYMBOL(nvram_buf);
+ static size_t nvram_len;
+ static const u32 nvram_sizes[] = {0x6000, 0x8000, 0xF000, 0x10000};
+ static int cfe_env;
+--- a/arch/mips/mm/cache.c
++++ b/arch/mips/mm/cache.c
+@@ -63,6 +63,9 @@ void (*_dma_cache_wback_inv)(unsigned lo
+ void (*_dma_cache_wback)(unsigned long start, unsigned long size);
+ void (*_dma_cache_inv)(unsigned long start, unsigned long size);
+ 
++EXPORT_SYMBOL(_dma_cache_wback_inv);
++EXPORT_SYMBOL(_dma_cache_inv);
++
+ #endif /* CONFIG_DMA_NONCOHERENT */
+ 
+ /*
diff --git a/target/linux/bcm4908/Makefile b/target/linux/bcm4908/Makefile
index fcfe04962b7796..2d848b50c69a82 100644
--- a/target/linux/bcm4908/Makefile
+++ b/target/linux/bcm4908/Makefile
@@ -9,7 +9,7 @@ FEATURES:=squashfs nand usb gpio
 CPU_TYPE:=cortex-a53
 SUBTARGETS:=generic
 
-KERNEL_PATCHVER:=5.10
+KERNEL_PATCHVER:=5.15
 
 define Target/Description
 	Build firmware images for Broadcom BCM4908 SoC family routers.
@@ -22,6 +22,7 @@ KERNELNAME:=Image dtbs
 DEFAULT_PACKAGES += \
 	bcm4908img fdt-utils uboot-envtools \
 	kmod-gpio-button-hotplug \
-	kmod-usb-ohci kmod-usb2 kmod-usb3
+	kmod-usb-ohci kmod-usb2 kmod-usb3 \
+	kmod-usb-ledtrig-usbport
 
 $(eval $(call BuildTarget))
diff --git a/target/linux/bcm4908/base-files/lib/preinit/75_rootfs_prepare b/target/linux/bcm4908/base-files/lib/preinit/75_rootfs_prepare
index 09c12cd31db380..829dd6adf1343a 100644
--- a/target/linux/bcm4908/base-files/lib/preinit/75_rootfs_prepare
+++ b/target/linux/bcm4908/base-files/lib/preinit/75_rootfs_prepare
@@ -23,7 +23,7 @@ rootfs_prepare() {
 	ubinfo /dev/ubi0 -N metadata1 > /dev/null 2>&1 || return
 
 	# Find UBI volume device (e.g. ubi0_123)
-	local ubivol="$(grep rootfs_data /sys/devices/virtual/ubi/ubi*/ubi*/name | sed -n 's/.*\(ubi\d*_\d*\).*/\1/p')"
+	local ubivol="$(grep rootfs_data /sys/class/ubi/ubi*/name | sed -n 's/.*\(ubi\d*_\d*\).*/\1/p')"
 	if [ -n "$ubivol" ]; then
 		bcm4908_verify_rootfs_data $ubivol
 	else
diff --git a/target/linux/bcm4908/base-files/usr/libexec/platform/packet-steering.sh b/target/linux/bcm4908/base-files/usr/libexec/platform/packet-steering.sh
new file mode 100644
index 00000000000000..825bca311fca31
--- /dev/null
+++ b/target/linux/bcm4908/base-files/usr/libexec/platform/packet-steering.sh
@@ -0,0 +1,29 @@
+#!/bin/sh
+
+packet_steering="$(uci -q get network.@globals[0].packet_steering)"
+num_cpus="$(grep -c "^processor.*:" /proc/cpuinfo)"
+flow_offloading="$(uci -q get firewall.@defaults[0].flow_offloading)"
+flow_offloading_hw="$(uci -q get firewall.@defaults[0].flow_offloading_hw)"
+rps_eth0=0
+rps_br_lan=0
+
+[ "$packet_steering" = 1 ] && {
+	if [ ${flow_offloading_hw:-0} -gt 0 ]; then
+		# HW offloading
+		# Not implemented
+		:
+	elif [ ${flow_offloading:-0} -gt 0 ]; then
+		# SW offloading
+		# BCM4908 always reaches ~940 Mb/s
+		:
+	else
+		# Default
+		case "$num_cpus" in
+			2) rps_eth0=2; rps_br_lan=2;;
+			4) rps_eth0=e; rps_br_lan=e;;
+		esac
+	fi
+}
+
+echo $rps_eth0 > /sys/class/net/eth0/queues/rx-0/rps_cpus
+echo $rps_br_lan > /sys/class/net/br-lan/queues/rx-0/rps_cpus
diff --git a/target/linux/bcm4908/config-5.15 b/target/linux/bcm4908/config-5.15
new file mode 100644
index 00000000000000..892985f7f4bf7c
--- /dev/null
+++ b/target/linux/bcm4908/config-5.15
@@ -0,0 +1,241 @@
+CONFIG_64BIT=y
+CONFIG_ARCH_BCM4908=y
+CONFIG_ARCH_BCMBCA=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
+CONFIG_ARCH_MMAP_RND_BITS=18
+CONFIG_ARCH_MMAP_RND_BITS_MAX=24
+CONFIG_ARCH_MMAP_RND_BITS_MIN=18
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=11
+CONFIG_ARCH_PROC_KCORE_TEXT=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_STACKWALK=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARCH_WANTS_NO_INSTR=y
+CONFIG_ARM64=y
+CONFIG_ARM64_4K_PAGES=y
+CONFIG_ARM64_CRYPTO=y
+CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
+CONFIG_ARM64_PAGE_SHIFT=12
+CONFIG_ARM64_PA_BITS=48
+CONFIG_ARM64_PA_BITS_48=y
+CONFIG_ARM64_PTR_AUTH=y
+CONFIG_ARM64_PTR_AUTH_KERNEL=y
+CONFIG_ARM64_SVE=y
+CONFIG_ARM64_TAGGED_ADDR_ABI=y
+CONFIG_ARM64_VA_BITS=39
+CONFIG_ARM64_VA_BITS_39=y
+CONFIG_ARM_AMBA=y
+CONFIG_ARM_ARCH_TIMER=y
+CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+CONFIG_ARM_GIC=y
+CONFIG_ARM_GIC_V3=y
+CONFIG_ARM_GIC_V3_ITS=y
+CONFIG_ARM_PSCI_FW=y
+CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
+CONFIG_B53=y
+CONFIG_BCM4908_ENET=y
+CONFIG_BCM7038_WDT=y
+CONFIG_BCM7XXX_PHY=y
+CONFIG_BCM_NET_PHYLIB=y
+CONFIG_BCM_PMB=y
+# CONFIG_BLK_DEV_INITRD is not set
+CONFIG_BLK_PM=y
+CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CMDLINE="earlycon=bcm63xx_uart,0xff800640 console=ttyS0,115200"
+CONFIG_CMDLINE_FROM_BOOTLOADER=y
+CONFIG_COMMON_CLK=y
+# CONFIG_COMPAT_32BIT_TIME is not set
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_RMAP=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_CE=y
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
+CONFIG_CRYPTO_CRYPTD=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_SIMD=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DMA_DIRECT_REMAP=y
+CONFIG_DMA_REMAP=y
+CONFIG_DTC=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FRAME_POINTER=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ARCH_TOPOLOGY=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_CSUM=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_MSI_IRQ=y
+CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_GRO_CELLS=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_I2C=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_BRCMSTB=y
+CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+CONFIG_LEDS_BCM63138=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MDIO_BCM_UNIMAC=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MODULES_USE_ELF_RELA=y
+CONFIG_MTD_BRCM_U_BOOT=y
+CONFIG_MTD_CMDLINE_PARTS=y
+CONFIG_MTD_NAND_BRCMNAND=y
+CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_NAND_ECC_SW_HAMMING=y
+CONFIG_MTD_OF_PARTS_BCM4908=y
+# CONFIG_MTD_OF_PARTS_LINKSYS_NS is not set
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_SPLIT_CFE_BOOTFS=y
+# CONFIG_MTD_SPLIT_SQUASHFS_ROOT is not set
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_LIMIT=20
+CONFIG_MTD_UBI_BLOCK=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_SG_DMA_LENGTH=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_BCM_SF2=y
+CONFIG_NET_DSA_TAG_BRCM=y
+CONFIG_NET_DSA_TAG_BRCM_COMMON=y
+CONFIG_NET_DSA_TAG_BRCM_LEGACY=y
+CONFIG_NET_DSA_TAG_BRCM_PREPEND=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NO_IOPORT_MAP=y
+CONFIG_NR_CPUS=4
+CONFIG_NVMEM=y
+CONFIG_NVMEM_SYSFS=y
+CONFIG_NVMEM_U_BOOT_ENV=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_PADATA=y
+CONFIG_PARTITION_PERCPU=y
+CONFIG_PGTABLE_LEVELS=3
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PHYS_ADDR_T_64BIT=y
+CONFIG_PHY_BRCM_USB=y
+CONFIG_PINCTRL=y
+CONFIG_PINCTRL_BCM4908=y
+# CONFIG_PINCTRL_SINGLE is not set
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RELOCATABLE=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RODATA_FULL_DEFAULT_ENABLED=y
+CONFIG_RPS=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIAL_BCM63XX=y
+CONFIG_SERIAL_BCM63XX_CONSOLE=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SMP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SPARSEMEM=y
+CONFIG_SPARSEMEM_EXTREME=y
+CONFIG_SPARSEMEM_VMEMMAP=y
+CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SRCU=y
+CONFIG_SWIOTLB=y
+CONFIG_SWPHY=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_THREAD_INFO_IN_TASK=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UBIFS_FS=y
+CONFIG_UNMAP_KERNEL_AT_EL0=y
+CONFIG_USB_SUPPORT=y
+CONFIG_VMAP_STACK=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZONE_DMA32=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/bcm4908/image/Makefile b/target/linux/bcm4908/image/Makefile
index 7116c2a9f1fb23..658ec810d1b31f 100644
--- a/target/linux/bcm4908/image/Makefile
+++ b/target/linux/bcm4908/image/Makefile
@@ -75,9 +75,9 @@ define Device/Default
 endef
 
 define Device/asus_gt-ac5300
-  DEVICE_VENDOR := Asus
+  DEVICE_VENDOR := ASUS
   DEVICE_MODEL := GT-AC5300
-  DEVICE_DTS := broadcom/bcm4908/bcm4908-asus-gt-ac5300
+  DEVICE_DTS := broadcom/bcmbca/bcm4908-asus-gt-ac5300
   IMAGES := bin
   IMAGE/bin := append-ubi | bcm4908img | bcm4908asus
   ASUS_PRODUCTID := GT-AC5300
@@ -88,7 +88,7 @@ endef
 TARGET_DEVICES += asus_gt-ac5300
 
 define Device/asus_gt-ax6000
-  DEVICE_VENDOR := Asus
+  DEVICE_VENDOR := ASUS
   DEVICE_MODEL := GT-AX6000
   DEVICE_DTS := broadcom/bcmbca/bcm4912-asus-gt-ax6000
   IMAGES := pkgtb
@@ -100,7 +100,7 @@ endef
 define Device/netgear_r8000p
   DEVICE_VENDOR := Netgear
   DEVICE_MODEL := R8000P
-  DEVICE_DTS := broadcom/bcm4908/bcm4906-netgear-r8000p
+  DEVICE_DTS := broadcom/bcmbca/bcm4906-netgear-r8000p
   IMAGES := bin
   IMAGE/chk := append-ubi | bcm4908img | netgear-chk
   NETGEAR_BOARD_ID := U12H359T00_NETGEAR
@@ -112,7 +112,7 @@ define Device/tplink_archer-c2300-v1
   DEVICE_VENDOR := TP-Link
   DEVICE_MODEL := Archer C2300
   DEVICE_VARIANT := v1
-  DEVICE_DTS := broadcom/bcm4908/bcm4906-tplink-archer-c2300-v1
+  DEVICE_DTS := broadcom/bcmbca/bcm4906-tplink-archer-c2300-v1
   IMAGES := bin
   IMAGE/bin := append-ubi | bcm4908img
   BROKEN := y
diff --git a/target/linux/bcm4908/image/bootfs-bcm4908.its b/target/linux/bcm4908/image/bootfs-bcm4908.its
index d5ac21fd6a44f2..2086fc7ec9be4c 100644
--- a/target/linux/bcm4908/image/bootfs-bcm4908.its
+++ b/target/linux/bcm4908/image/bootfs-bcm4908.its
@@ -25,7 +25,7 @@
 
 		fdt_linux_RAX220 {
 			description = "dtb";
-			data = /incbin/("${dts_dir}/broadcom/bcm4908/bcm4908-netgear-raxe500.dtb");
+			data = /incbin/("${dts_dir}/broadcom/bcmbca/bcm4908-netgear-raxe500.dtb");
 			arch = "arm64";
 			type = "flat_dt";
 			compression = "none";
diff --git a/target/linux/bcm4908/patches-5.15/030-v5.16-0001-arm64-dts-broadcom-bcm4908-Fix-NAND-node-name.patch b/target/linux/bcm4908/patches-5.15/030-v5.16-0001-arm64-dts-broadcom-bcm4908-Fix-NAND-node-name.patch
new file mode 100644
index 00000000000000..aaa5241c44f96f
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/030-v5.16-0001-arm64-dts-broadcom-bcm4908-Fix-NAND-node-name.patch
@@ -0,0 +1,27 @@
+From d0ae9c944b9472c5691a482297df7a57d7fd1199 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 19 Aug 2021 14:11:08 +0200
+Subject: [PATCH] arm64: dts: broadcom: bcm4908: Fix NAND node name
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This matches nand-controller.yaml requirements.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
+@@ -298,7 +298,7 @@
+ 			status = "okay";
+ 		};
+ 
+-		nand@1800 {
++		nand-controller@1800 {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 			compatible = "brcm,nand-bcm63138", "brcm,brcmnand-v7.1", "brcm,brcmnand";
diff --git a/target/linux/bcm4908/patches-5.15/031-v5.17-0001-dt-bindings-arm-bcm-document-Netgear-RAXE500-binding.patch b/target/linux/bcm4908/patches-5.15/031-v5.17-0001-dt-bindings-arm-bcm-document-Netgear-RAXE500-binding.patch
new file mode 100644
index 00000000000000..4d5ffcb9e35274
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/031-v5.17-0001-dt-bindings-arm-bcm-document-Netgear-RAXE500-binding.patch
@@ -0,0 +1,27 @@
+From 7b0c9ca7f18e8d2e2cf3c342d91f037d436777bf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 5 Nov 2021 11:14:12 +0100
+Subject: [PATCH] dt-bindings: arm: bcm: document Netgear RAXE500 binding
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+One more BCM4908 based device.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ Documentation/devicetree/bindings/arm/bcm/brcm,bcm4908.yaml | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/Documentation/devicetree/bindings/arm/bcm/brcm,bcm4908.yaml
++++ b/Documentation/devicetree/bindings/arm/bcm/brcm,bcm4908.yaml
+@@ -29,6 +29,7 @@ properties:
+         items:
+           - enum:
+               - asus,gt-ac5300
++              - netgear,raxe500
+           - const: brcm,bcm4908
+ 
+       - description: BCM49408 based boards
diff --git a/target/linux/bcm4908/patches-5.15/032-v5.18-0002-arm64-dts-broadcom-bcm4908-add-pinctrl-binding.patch b/target/linux/bcm4908/patches-5.15/032-v5.18-0002-arm64-dts-broadcom-bcm4908-add-pinctrl-binding.patch
new file mode 100644
index 00000000000000..70b4dc216d23e3
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/032-v5.18-0002-arm64-dts-broadcom-bcm4908-add-pinctrl-binding.patch
@@ -0,0 +1,160 @@
+From 72b1c5da796ec5266f2012c36470e226cb4f09c9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 30 Dec 2021 12:05:35 +0100
+Subject: [PATCH] arm64: dts: broadcom: bcm4908: add pinctrl binding
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Describe pinmux block with its maps.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ .../boot/dts/broadcom/bcmbca/bcm4908.dtsi    | 135 ++++++++++++++++++
+ 1 file changed, 135 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
+@@ -289,6 +289,141 @@
+ 			gpio-controller;
+ 		};
+ 
++		pinctrl@560 {
++			compatible = "brcm,bcm4908-pinctrl";
++			reg = <0x560 0x10>;
++
++			pins_led_0_a: led_0-a-pins {
++				function = "led_0";
++				groups = "led_0_grp_a";
++			};
++
++			pins_led_1_a: led_1-a-pins {
++				function = "led_1";
++				groups = "led_1_grp_a";
++			};
++
++			pins_led_2_a: led_2-a-pins {
++				function = "led_2";
++				groups = "led_2_grp_a";
++			};
++
++			pins_led_3_a: led_3-a-pins {
++				function = "led_3";
++				groups = "led_3_grp_a";
++			};
++
++			pins_led_4_a: led_4-a-pins {
++				function = "led_4";
++				groups = "led_4_grp_a";
++			};
++
++			pins_led_5_a: led_5-a-pins {
++				function = "led_5";
++				groups = "led_5_grp_a";
++			};
++
++			pins_led_6_a: led_6-a-pins {
++				function = "led_6";
++				groups = "led_6_grp_a";
++			};
++
++			pins_led_7_a: led_7-a-pins {
++				function = "led_7";
++				groups = "led_7_grp_a";
++			};
++
++			pins_led_8_a: led_8-a-pins {
++				function = "led_8";
++				groups = "led_8_grp_a";
++			};
++
++			pins_led_9_a: led_9-a-pins {
++				function = "led_9";
++				groups = "led_9_grp_a";
++			};
++
++			pins_led_21_a: led_21-a-pins {
++				function = "led_21";
++				groups = "led_21_grp_a";
++			};
++
++			pins_led_22_a: led_22-a-pins {
++				function = "led_22";
++				groups = "led_22_grp_a";
++			};
++
++			pins_led_26_a: led_26-a-pins {
++				function = "led_26";
++				groups = "led_26_grp_a";
++			};
++
++			pins_led_27_a: led_27-a-pins {
++				function = "led_27";
++				groups = "led_27_grp_a";
++			};
++
++			pins_led_28_a: led_28-a-pins {
++				function = "led_28";
++				groups = "led_28_grp_a";
++			};
++
++			pins_led_29_a: led_29-a-pins {
++				function = "led_29";
++				groups = "led_29_grp_a";
++			};
++
++			pins_led_30_a: led_30-a-pins {
++				function = "led_30";
++				groups = "led_30_grp_a";
++			};
++
++			pins_hs_uart: hs_uart-pins {
++				function = "hs_uart";
++				groups = "hs_uart_grp";
++			};
++
++			pins_i2c_a: i2c-a-pins {
++				function = "i2c";
++				groups = "i2c_grp_a";
++			};
++
++			pins_i2c_b: i2c-b-pins {
++				function = "i2c";
++				groups = "i2c_grp_b";
++			};
++
++			pins_i2s: i2s-pins {
++				function = "i2s";
++				groups = "i2s_grp";
++			};
++
++			pins_nand_ctrl: nand_ctrl-pins {
++				function = "nand_ctrl";
++				groups = "nand_ctrl_grp";
++			};
++
++			pins_nand_data: nand_data-pins {
++				function = "nand_data";
++				groups = "nand_data_grp";
++			};
++
++			pins_emmc_ctrl: emmc_ctrl-pins {
++				function = "emmc_ctrl";
++				groups = "emmc_ctrl_grp";
++			};
++
++			pins_usb0_pwr: usb0_pwr-pins {
++				function = "usb0_pwr";
++				groups = "usb0_pwr_grp";
++			};
++
++			pins_usb1_pwr: usb1_pwr-pins {
++				function = "usb1_pwr";
++				groups = "usb1_pwr_grp";
++			};
++		};
++
+ 		uart0: serial@640 {
+ 			compatible = "brcm,bcm6345-uart";
+ 			reg = <0x640 0x18>;
diff --git a/target/linux/bcm4908/patches-5.15/032-v5.18-0003-arm64-dts-broadcom-bcm4908-add-watchdog-block.patch b/target/linux/bcm4908/patches-5.15/032-v5.18-0003-arm64-dts-broadcom-bcm4908-add-watchdog-block.patch
new file mode 100644
index 00000000000000..47d680d7590854
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/032-v5.18-0003-arm64-dts-broadcom-bcm4908-add-watchdog-block.patch
@@ -0,0 +1,35 @@
+From 47513f6dd93b5b7d91143219c2c1fb883664ed13 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 9 Feb 2022 21:14:17 +0100
+Subject: [PATCH] arm64: dts: broadcom: bcm4908: add watchdog block
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+BCM4908 has the same watchdog as BCM63xx devices. Use "brcm,bcm6345-wdt"
+binding which matches the first SoC with that block.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
+@@ -278,6 +278,15 @@
+ 		twd: timer-mfd@400 {
+ 			compatible = "brcm,bcm4908-twd", "simple-mfd", "syscon";
+ 			reg = <0x400 0x4c>;
++			ranges = <0x0 0x400 0x4c>;
++
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			watchdog@28 {
++				compatible = "brcm,bcm6345-wdt";
++				reg = <0x28 0x8>;
++			};
+ 		};
+ 
+ 		gpio0: gpio-controller@500 {
diff --git a/target/linux/bcm4908/patches-5.15/032-v5.18-0004-arm64-dts-broadcom-bcm4908-add-I2C-block.patch b/target/linux/bcm4908/patches-5.15/032-v5.18-0004-arm64-dts-broadcom-bcm4908-add-I2C-block.patch
new file mode 100644
index 00000000000000..a92ee6e3e70b5e
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/032-v5.18-0004-arm64-dts-broadcom-bcm4908-add-I2C-block.patch
@@ -0,0 +1,34 @@
+From ba5dfa2fd8d0aed4e4b6f650ba9e8ea7cdd6ead1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 15 Feb 2022 07:36:39 +0100
+Subject: [PATCH] arm64: dts: broadcom: bcm4908: add I2C block
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+BCM4908 uses the same I2C hw as BCM63xx / BCM67xx / BCM68xx SoCs.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
+@@ -458,6 +458,15 @@
+ 			};
+ 		};
+ 
++		i2c@2100 {
++			compatible = "brcm,brcmper-i2c";
++			reg = <0x2100 0x58>;
++			clock-frequency = <97500>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&pins_i2c_a>;
++			status = "disabled";
++		};
++
+ 		misc@2600 {
+ 			compatible = "brcm,misc", "simple-mfd";
+ 			reg = <0x2600 0xe4>;
diff --git a/target/linux/bcm4908/patches-5.15/033-v6.0-0004-arm64-dts-Add-DTS-files-for-bcmbca-SoC-BCM63146.patchgit b/target/linux/bcm4908/patches-5.15/033-v6.0-0004-arm64-dts-Add-DTS-files-for-bcmbca-SoC-BCM63146.patchgit
new file mode 100644
index 00000000000000..7cd13e5c22ff01
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/033-v6.0-0004-arm64-dts-Add-DTS-files-for-bcmbca-SoC-BCM63146.patchgit
@@ -0,0 +1,174 @@
+From 82a58061ada60058ec00113c179380f945914709 Mon Sep 17 00:00:00 2001
+From: William Zhang <william.zhang@broadcom.com>
+Date: Wed, 8 Jun 2022 11:00:59 -0700
+Subject: [PATCH] arm64: dts: Add DTS files for bcmbca SoC BCM63146
+
+Add DTS for ARMv8 based broadband SoC BCM63146. bcm63146.dtsi is the
+SoC description DTS header and bcm963146.dts is a simple DTS file for
+Broadcom BCM963146 Reference board that only enable the UART port.
+
+Signed-off-by: William Zhang <william.zhang@broadcom.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm64/boot/dts/broadcom/bcmbca/Makefile  |   3 +-
+ .../boot/dts/broadcom/bcmbca/bcm63146.dtsi    | 110 ++++++++++++++++++
+ .../boot/dts/broadcom/bcmbca/bcm963146.dts    |  30 +++++
+ 3 files changed, 142 insertions(+), 1 deletion(-)
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcmbca/bcm63146.dtsi
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcmbca/bcm963146.dts
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/Makefile
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/Makefile
+@@ -7,4 +7,5 @@ dtb-$(CONFIG_ARCH_BCMBCA) += \
+ 				bcm4912-asus-gt-ax6000.dtb \
+ 				bcm94912.dtb \
+ 				bcm963158.dtb \
+-				bcm96858.dtb
++				bcm96858.dtb \
++				bcm963146.dtb
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm63146.dtsi
+@@ -0,0 +1,110 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Copyright 2022 Broadcom Ltd.
++ */
++
++#include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/interrupt-controller/arm-gic.h>
++
++/ {
++	compatible = "brcm,bcm63146", "brcm,bcmbca";
++	#address-cells = <2>;
++	#size-cells = <2>;
++
++	interrupt-parent = <&gic>;
++
++	cpus {
++		#address-cells = <2>;
++		#size-cells = <0>;
++
++		B53_0: cpu@0 {
++			compatible = "brcm,brahma-b53";
++			device_type = "cpu";
++			reg = <0x0 0x0>;
++			next-level-cache = <&L2_0>;
++			enable-method = "psci";
++		};
++
++		B53_1: cpu@1 {
++			compatible = "brcm,brahma-b53";
++			device_type = "cpu";
++			reg = <0x0 0x1>;
++			next-level-cache = <&L2_0>;
++			enable-method = "psci";
++		};
++
++		L2_0: l2-cache0 {
++			compatible = "cache";
++		};
++	};
++
++	timer {
++		compatible = "arm,armv8-timer";
++		interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>,
++			<GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>,
++			<GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>,
++			<GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>;
++	};
++
++	pmu: pmu {
++		compatible = "arm,cortex-a53-pmu";
++		interrupts = <GIC_SPI 7 IRQ_TYPE_LEVEL_HIGH>,
++			<GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-affinity = <&B53_0>, <&B53_1>;
++	};
++
++	clocks: clocks {
++		periph_clk: periph-clk {
++			compatible = "fixed-clock";
++			#clock-cells = <0>;
++			clock-frequency = <200000000>;
++		};
++		uart_clk: uart-clk {
++			compatible = "fixed-factor-clock";
++			#clock-cells = <0>;
++			clocks = <&periph_clk>;
++			clock-div = <4>;
++			clock-mult = <1>;
++		};
++	};
++
++	psci {
++		compatible = "arm,psci-0.2";
++		method = "smc";
++	};
++
++	axi@81000000 {
++		compatible = "simple-bus";
++		#address-cells = <1>;
++		#size-cells = <1>;
++		ranges = <0x0 0x0 0x81000000 0x8000>;
++
++		gic: interrupt-controller@1000 {
++			compatible = "arm,gic-400";
++			#interrupt-cells = <3>;
++			interrupt-controller;
++			reg = <0x1000 0x1000>,
++				<0x2000 0x2000>,
++				<0x4000 0x2000>,
++				<0x6000 0x2000>;
++			interrupts = <GIC_PPI 9 (GIC_CPU_MASK_SIMPLE(2) |
++					IRQ_TYPE_LEVEL_HIGH)>;
++		};
++	};
++
++	bus@ff800000 {
++		compatible = "simple-bus";
++		#address-cells = <1>;
++		#size-cells = <1>;
++		ranges = <0x0 0x0 0xff800000 0x800000>;
++
++		uart0: serial@12000 {
++			compatible = "arm,pl011", "arm,primecell";
++			reg = <0x12000 0x1000>;
++			interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&uart_clk>, <&uart_clk>;
++			clock-names = "uartclk", "apb_pclk";
++			status = "disabled";
++		};
++	};
++};
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm963146.dts
+@@ -0,0 +1,30 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Copyright 2022 Broadcom Ltd.
++ */
++
++/dts-v1/;
++
++#include "bcm63146.dtsi"
++
++/ {
++	model = "Broadcom BCM963146 Reference Board";
++	compatible = "brcm,bcm963146", "brcm,bcm63146", "brcm,bcmbca";
++
++	aliases {
++		serial0 = &uart0;
++	};
++
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
++	memory@0 {
++		device_type = "memory";
++		reg = <0x0 0x0 0x0 0x08000000>;
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
diff --git a/target/linux/bcm4908/patches-5.15/033-v6.0-0005-arm64-dts-Add-DTS-files-for-bcmbca-SoC-BCM6856.patchgit b/target/linux/bcm4908/patches-5.15/033-v6.0-0005-arm64-dts-Add-DTS-files-for-bcmbca-SoC-BCM6856.patchgit
new file mode 100644
index 00000000000000..2e0da2e54a8566
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/033-v6.0-0005-arm64-dts-Add-DTS-files-for-bcmbca-SoC-BCM6856.patchgit
@@ -0,0 +1,167 @@
+From 64eca7ad058cff861b48cdead8dee40dfc284e9e Mon Sep 17 00:00:00 2001
+From: William Zhang <william.zhang@broadcom.com>
+Date: Wed, 8 Jun 2022 11:04:36 -0700
+Subject: [PATCH] arm64: dts: Add DTS files for bcmbca SoC BCM6856
+
+Add DTS for ARMv8 based broadband SoC BCM6856. bcm6856.dtsi is the
+SoC description DTS header and bcm96856.dts is a simple DTS file for
+Broadcom BCM96956 Reference board that only enable the UART port.
+
+Signed-off-by: William Zhang <william.zhang@broadcom.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm64/boot/dts/broadcom/bcmbca/Makefile  |   3 +-
+ .../boot/dts/broadcom/bcmbca/bcm6856.dtsi     | 103 ++++++++++++++++++
+ .../boot/dts/broadcom/bcmbca/bcm96856.dts     |  30 +++++
+ 3 files changed, 135 insertions(+), 1 deletion(-)
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcmbca/bcm6856.dtsi
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcmbca/bcm96856.dts
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/Makefile
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/Makefile
+@@ -8,4 +8,5 @@ dtb-$(CONFIG_ARCH_BCMBCA) += \
+ 				bcm94912.dtb \
+ 				bcm963158.dtb \
+ 				bcm96858.dtb \
+-				bcm963146.dtb
++				bcm963146.dtb \
++				bcm96856.dtb
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm6856.dtsi
+@@ -0,0 +1,103 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Copyright 2022 Broadcom Ltd.
++ */
++
++#include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/interrupt-controller/arm-gic.h>
++
++/ {
++	compatible = "brcm,bcm6856", "brcm,bcmbca";
++	#address-cells = <2>;
++	#size-cells = <2>;
++
++	interrupt-parent = <&gic>;
++
++	cpus {
++		#address-cells = <2>;
++		#size-cells = <0>;
++
++		B53_0: cpu@0 {
++			compatible = "brcm,brahma-b53";
++			device_type = "cpu";
++			reg = <0x0 0x0>;
++			next-level-cache = <&L2_0>;
++			enable-method = "psci";
++		};
++
++		B53_1: cpu@1 {
++			compatible = "brcm,brahma-b53";
++			device_type = "cpu";
++			reg = <0x0 0x1>;
++			next-level-cache = <&L2_0>;
++			enable-method = "psci";
++		};
++
++		L2_0: l2-cache0 {
++			compatible = "cache";
++		};
++	};
++
++	timer {
++		compatible = "arm,armv8-timer";
++		interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>,
++			<GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>,
++			<GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>,
++			<GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>;
++	};
++
++	pmu: pmu {
++		compatible = "arm,cortex-a53-pmu";
++		interrupts = <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>,
++			<GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-affinity = <&B53_0>, <&B53_1>;
++	};
++
++	clocks: clocks {
++		periph_clk:periph-clk {
++			compatible = "fixed-clock";
++			#clock-cells = <0>;
++			clock-frequency = <200000000>;
++		};
++	};
++
++	psci {
++		compatible = "arm,psci-0.2";
++		method = "smc";
++	};
++
++	axi@81000000 {
++		compatible = "simple-bus";
++		#address-cells = <1>;
++		#size-cells = <1>;
++		ranges = <0x0 0x0 0x81000000 0x8000>;
++
++		gic: interrupt-controller@1000 {
++			compatible = "arm,gic-400";
++			#interrupt-cells = <3>;
++			interrupt-controller;
++			reg = <0x1000 0x1000>, /* GICD */
++				<0x2000 0x2000>, /* GICC */
++				<0x4000 0x2000>, /* GICH */
++				<0x6000 0x2000>; /* GICV */
++			interrupts = <GIC_PPI 9 (GIC_CPU_MASK_SIMPLE(2) |
++					IRQ_TYPE_LEVEL_HIGH)>;
++		};
++	};
++
++	bus@ff800000 {
++		compatible = "simple-bus";
++		#address-cells = <1>;
++		#size-cells = <1>;
++		ranges = <0x0 0x0 0xff800000 0x800000>;
++
++		uart0: serial@640 {
++			compatible = "brcm,bcm6345-uart";
++			reg = <0x640 0x18>;
++			interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&periph_clk>;
++			clock-names = "refclk";
++			status = "disabled";
++		};
++	};
++};
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm96856.dts
+@@ -0,0 +1,30 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Copyright 2022 Broadcom Ltd.
++ */
++
++/dts-v1/;
++
++#include "bcm6856.dtsi"
++
++/ {
++	model = "Broadcom BCM96856 Reference Board";
++	compatible = "brcm,bcm96856", "brcm,bcm6856", "brcm,bcmbca";
++
++	aliases {
++		serial0 = &uart0;
++	};
++
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
++	memory@0 {
++		device_type = "memory";
++		reg = <0x0 0x0 0x0 0x08000000>;
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
diff --git a/target/linux/bcm4908/patches-5.15/033-v6.0-0006-arm64-dts-Add-DTS-files-for-bcmbca-SoC-BCM6813.patchgit b/target/linux/bcm4908/patches-5.15/033-v6.0-0006-arm64-dts-Add-DTS-files-for-bcmbca-SoC-BCM6813.patchgit
new file mode 100644
index 00000000000000..6be8ab8ee45b61
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/033-v6.0-0006-arm64-dts-Add-DTS-files-for-bcmbca-SoC-BCM6813.patchgit
@@ -0,0 +1,192 @@
+From eab6bb0994b806525fc5e362e8b865f61c4a9e20 Mon Sep 17 00:00:00 2001
+From: William Zhang <william.zhang@broadcom.com>
+Date: Thu, 9 Jun 2022 17:15:33 -0700
+Subject: [PATCH] arm64: dts: Add DTS files for bcmbca SoC BCM6813
+
+Add DTS for ARMv8 based broadband SoC BCM6813. bcm6813.dtsi is the
+SoC description DTS header and bcm96813.dts is a simple DTS file for
+Broadcom BCM96813 Reference board that only enable the UART port.
+
+Signed-off-by: William Zhang <william.zhang@broadcom.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm64/boot/dts/broadcom/bcmbca/Makefile  |   3 +-
+ .../boot/dts/broadcom/bcmbca/bcm6813.dtsi     | 128 ++++++++++++++++++
+ .../boot/dts/broadcom/bcmbca/bcm96813.dts     |  30 ++++
+ 3 files changed, 160 insertions(+), 1 deletion(-)
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcmbca/bcm6813.dtsi
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcmbca/bcm96813.dts
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/Makefile
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/Makefile
+@@ -9,4 +9,5 @@ dtb-$(CONFIG_ARCH_BCMBCA) += \
+ 				bcm963158.dtb \
+ 				bcm96858.dtb \
+ 				bcm963146.dtb \
+-				bcm96856.dtb
++				bcm96856.dtb \
++				bcm96813.dtb
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm6813.dtsi
+@@ -0,0 +1,128 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Copyright 2022 Broadcom Ltd.
++ */
++
++#include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/interrupt-controller/arm-gic.h>
++
++/ {
++	compatible = "brcm,bcm6813", "brcm,bcmbca";
++	#address-cells = <2>;
++	#size-cells = <2>;
++
++	interrupt-parent = <&gic>;
++
++	cpus {
++		#address-cells = <2>;
++		#size-cells = <0>;
++
++		B53_0: cpu@0 {
++			compatible = "brcm,brahma-b53";
++			device_type = "cpu";
++			reg = <0x0 0x0>;
++			next-level-cache = <&L2_0>;
++			enable-method = "psci";
++		};
++
++		B53_1: cpu@1 {
++			compatible = "brcm,brahma-b53";
++			device_type = "cpu";
++			reg = <0x0 0x1>;
++			next-level-cache = <&L2_0>;
++			enable-method = "psci";
++		};
++
++		B53_2: cpu@2 {
++			compatible = "brcm,brahma-b53";
++			device_type = "cpu";
++			reg = <0x0 0x2>;
++			next-level-cache = <&L2_0>;
++			enable-method = "psci";
++		};
++
++		B53_3: cpu@3 {
++			compatible = "brcm,brahma-b53";
++			device_type = "cpu";
++			reg = <0x0 0x3>;
++			next-level-cache = <&L2_0>;
++			enable-method = "psci";
++		};
++
++		L2_0: l2-cache0 {
++			compatible = "cache";
++		};
++	};
++
++	timer {
++		compatible = "arm,armv8-timer";
++		interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
++			<GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
++			<GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
++			<GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>;
++	};
++
++	pmu: pmu {
++		compatible = "arm,cortex-a53-pmu";
++		interrupts = <GIC_SPI 7 IRQ_TYPE_LEVEL_HIGH>,
++			<GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>,
++			<GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>,
++			<GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-affinity = <&B53_0>, <&B53_1>,
++			<&B53_2>, <&B53_3>;
++	};
++
++	clocks: clocks {
++		periph_clk: periph-clk {
++			compatible = "fixed-clock";
++			#clock-cells = <0>;
++			clock-frequency = <200000000>;
++		};
++		uart_clk: uart-clk {
++			compatible = "fixed-factor-clock";
++			#clock-cells = <0>;
++			clocks = <&periph_clk>;
++			clock-div = <4>;
++			clock-mult = <1>;
++		};
++	};
++
++	psci {
++		compatible = "arm,psci-0.2";
++		method = "smc";
++	};
++
++	axi@81000000 {
++		compatible = "simple-bus";
++		#address-cells = <1>;
++		#size-cells = <1>;
++		ranges = <0x0 0x0 0x81000000 0x8000>;
++
++		gic: interrupt-controller@1000 {
++			compatible = "arm,gic-400";
++			#interrupt-cells = <3>;
++			interrupt-controller;
++			interrupts = <GIC_PPI 9 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
++			reg = <0x1000 0x1000>,
++				<0x2000 0x2000>,
++				<0x4000 0x2000>,
++				<0x6000 0x2000>;
++		};
++	};
++
++	bus@ff800000 {
++		compatible = "simple-bus";
++		#address-cells = <1>;
++		#size-cells = <1>;
++		ranges = <0x0 0x0 0xff800000 0x800000>;
++
++		uart0: serial@12000 {
++			compatible = "arm,pl011", "arm,primecell";
++			reg = <0x12000 0x1000>;
++			interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&uart_clk>, <&uart_clk>;
++			clock-names = "uartclk", "apb_pclk";
++			status = "disabled";
++		};
++	};
++};
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm96813.dts
+@@ -0,0 +1,30 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Copyright 2022 Broadcom Ltd.
++ */
++
++/dts-v1/;
++
++#include "bcm6813.dtsi"
++
++/ {
++	model = "Broadcom BCM96813 Reference Board";
++	compatible = "brcm,bcm96813", "brcm,bcm6813", "brcm,bcmbca";
++
++	aliases {
++		serial0 = &uart0;
++	};
++
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
++	memory@0 {
++		device_type = "memory";
++		reg = <0x0 0x0 0x0 0x08000000>;
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
diff --git a/target/linux/bcm4908/patches-5.15/033-v6.0-0007-arm64-dts-broadcom-align-gpio-key-node-names-with-dt.patchgit b/target/linux/bcm4908/patches-5.15/033-v6.0-0007-arm64-dts-broadcom-align-gpio-key-node-names-with-dt.patchgit
new file mode 100644
index 00000000000000..987da135d746c0
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/033-v6.0-0007-arm64-dts-broadcom-align-gpio-key-node-names-with-dt.patchgit
@@ -0,0 +1,79 @@
+From ea559c81b61603d4044df6f826f10a832c42c98c Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Wed, 15 Jun 2022 17:52:59 -0700
+Subject: [PATCH] arm64: dts: broadcom: align gpio-key node names with dtschema
+
+The node names should be generic and DT schema expects certain pattern
+(e.g. with key/button/switch).
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20220616005333.18491-6-krzysztof.kozlowski@linaro.org
+---
+ .../broadcom/bcmbca/bcm4906-tplink-archer-c2300-v1.dts   | 8 ++++----
+ .../boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts  | 8 ++++----
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4906-tplink-archer-c2300-v1.dts
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4906-tplink-archer-c2300-v1.dts
+@@ -83,25 +83,25 @@
+ 		compatible = "gpio-keys-polled";
+ 		poll-interval = <100>;
+ 
+-		brightness {
++		key-brightness {
+ 			label = "LEDs";
+ 			linux,code = <KEY_BRIGHTNESS_ZERO>;
+ 			gpios = <&gpio0 18 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		wps {
++		key-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&gpio0 21 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		wifi {
++		key-wifi {
+ 			label = "WiFi";
+ 			linux,code = <KEY_RFKILL>;
+ 			gpios = <&gpio0 22 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		restart {
++		key-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&gpio0 23 GPIO_ACTIVE_LOW>;
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts
+@@ -18,25 +18,25 @@
+ 		compatible = "gpio-keys-polled";
+ 		poll-interval = <100>;
+ 
+-		wifi {
++		key-wifi {
+ 			label = "WiFi";
+ 			linux,code = <KEY_RFKILL>;
+ 			gpios = <&gpio0 28 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		wps {
++		key-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&gpio0 29 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		restart {
++		key-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&gpio0 30 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		brightness {
++		key-brightness {
+ 			label = "LEDs";
+ 			linux,code = <KEY_BRIGHTNESS_ZERO>;
+ 			gpios = <&gpio0 31 GPIO_ACTIVE_LOW>;
diff --git a/target/linux/bcm4908/patches-5.15/033-v6.0-0008-arm64-dts-broadcom-bcm4908-Fix-timer-node-for-BCM490.patchgit b/target/linux/bcm4908/patches-5.15/033-v6.0-0008-arm64-dts-broadcom-bcm4908-Fix-timer-node-for-BCM490.patchgit
new file mode 100644
index 00000000000000..95540d3aab6d5e
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/033-v6.0-0008-arm64-dts-broadcom-bcm4908-Fix-timer-node-for-BCM490.patchgit
@@ -0,0 +1,33 @@
+From b4a544e415e9be33b37d9bfa9d9f9f4d13f553d6 Mon Sep 17 00:00:00 2001
+From: William Zhang <william.zhang@broadcom.com>
+Date: Fri, 8 Jul 2022 11:25:06 -0700
+Subject: [PATCH] arm64: dts: broadcom: bcm4908: Fix timer node for BCM4906 SoC
+
+The cpu mask value in interrupt property inherits from bcm4908.dtsi
+which sets to four cpus. Correct the value to two cpus for dual core
+BCM4906 SoC.
+
+Fixes: c8b404fb05dc ("arm64: dts: broadcom: bcm4908: add BCM4906 Netgear R8000P DTS files")
+Signed-off-by: William Zhang <william.zhang@broadcom.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm64/boot/dts/broadcom/bcmbca/bcm4906.dtsi | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4906.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4906.dtsi
+@@ -17,6 +17,14 @@
+ 			     <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>;
+ 	};
+ 
++	timer {
++		compatible = "arm,armv8-timer";
++		interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>,
++			     <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>,
++			     <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>,
++			     <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>;
++	};
++
+ 	pmu {
+ 		compatible = "arm,cortex-a53-pmu";
+ 		interrupts = <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>,
diff --git a/target/linux/bcm4908/patches-5.15/033-v6.0-0011-arm64-bcmbca-add-arch-bcmbca-machine-entry.patch b/target/linux/bcm4908/patches-5.15/033-v6.0-0011-arm64-bcmbca-add-arch-bcmbca-machine-entry.patch
new file mode 100644
index 00000000000000..603e30cb8a3d26
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/033-v6.0-0011-arm64-bcmbca-add-arch-bcmbca-machine-entry.patch
@@ -0,0 +1,31 @@
+From fdcd652ce2b6b819f5c4dc3cead5215c84ee6933 Mon Sep 17 00:00:00 2001
+From: William Zhang <william.zhang@broadcom.com>
+Date: Wed, 1 Jun 2022 15:56:50 -0700
+Subject: [PATCH] arm64: bcmbca: add arch bcmbca machine entry
+
+Add ARCH_BCMBCA config for Broadcom Broadband SoC chipsets
+
+Signed-off-by: William Zhang <william.zhang@broadcom.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm64/Kconfig.platforms | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/arm64/Kconfig.platforms
++++ b/arch/arm64/Kconfig.platforms
+@@ -65,6 +65,15 @@ config ARCH_BCM_IPROC
+ 	help
+ 	  This enables support for Broadcom iProc based SoCs
+ 
++config ARCH_BCMBCA
++	bool "Broadcom Broadband SoC"
++	help
++	  Say Y if you intend to run the kernel on a Broadcom Broadband ARM-based
++	  BCA chipset.
++
++	  This enables support for Broadcom BCA ARM-based broadband chipsets,
++	  including the DSL, PON and Wireless family of chips.
++
+ config ARCH_BERLIN
+ 	bool "Marvell Berlin SoC Family"
+ 	select DW_APB_ICTL
diff --git a/target/linux/bcm4908/patches-5.15/034-v6.1-0001-arm64-dts-broadcom-bcm4908-add-remaining-LED-pins.patch b/target/linux/bcm4908/patches-5.15/034-v6.1-0001-arm64-dts-broadcom-bcm4908-add-remaining-LED-pins.patch
new file mode 100644
index 00000000000000..69b15222684b71
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/034-v6.1-0001-arm64-dts-broadcom-bcm4908-add-remaining-LED-pins.patch
@@ -0,0 +1,115 @@
+From 456b6dd1baadd2da10e28ffd1717b06d1fa17a97 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 18 Jul 2022 15:20:58 +0200
+Subject: [PATCH] arm64: dts: broadcom: bcm4908: add remaining LED pins
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Include all 32 pins.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20220718132100.13277-1-zajec5@gmail.com
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ .../boot/dts/broadcom/bcmbca/bcm4908.dtsi    | 75 +++++++++++++++++++
+ 1 file changed, 75 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
+@@ -352,6 +352,61 @@
+ 				groups = "led_9_grp_a";
+ 			};
+ 
++			pins_led_10_a: led_10-a-pins {
++				function = "led_10";
++				groups = "led_10_grp_a";
++			};
++
++			pins_led_11_a: led_11-a-pins {
++				function = "led_11";
++				groups = "led_11_grp_a";
++			};
++
++			pins_led_12_a: led_12-a-pins {
++				function = "led_12";
++				groups = "led_12_grp_a";
++			};
++
++			pins_led_13_a: led_13-a-pins {
++				function = "led_13";
++				groups = "led_13_grp_a";
++			};
++
++			pins_led_14_a: led_14-a-pins {
++				function = "led_14";
++				groups = "led_14_grp_a";
++			};
++
++			pins_led_15_a: led_15-a-pins {
++				function = "led_15";
++				groups = "led_15_grp_a";
++			};
++
++			pins_led_16_a: led_16-a-pins {
++				function = "led_16";
++				groups = "led_16_grp_a";
++			};
++
++			pins_led_17_a: led_17-a-pins {
++				function = "led_17";
++				groups = "led_17_grp_a";
++			};
++
++			pins_led_18_a: led_18-a-pins {
++				function = "led_18";
++				groups = "led_18_grp_a";
++			};
++
++			pins_led_19_a: led_19-a-pins {
++				function = "led_19";
++				groups = "led_19_grp_a";
++			};
++
++			pins_led_20_a: led_20-a-pins {
++				function = "led_20";
++				groups = "led_20_grp_a";
++			};
++
+ 			pins_led_21_a: led_21-a-pins {
+ 				function = "led_21";
+ 				groups = "led_21_grp_a";
+@@ -362,6 +417,21 @@
+ 				groups = "led_22_grp_a";
+ 			};
+ 
++			pins_led_23_a: led_23-a-pins {
++				function = "led_23";
++				groups = "led_23_grp_a";
++			};
++
++			pins_led_24_a: led_24-a-pins {
++				function = "led_24";
++				groups = "led_24_grp_a";
++			};
++
++			pins_led_25_a: led_25-a-pins {
++				function = "led_25";
++				groups = "led_25_grp_a";
++			};
++
+ 			pins_led_26_a: led_26-a-pins {
+ 				function = "led_26";
+ 				groups = "led_26_grp_a";
+@@ -387,6 +457,11 @@
+ 				groups = "led_30_grp_a";
+ 			};
+ 
++			pins_led_31_a: led_31-a-pins {
++				function = "led_31";
++				groups = "led_31_grp_a";
++			};
++
+ 			pins_hs_uart: hs_uart-pins {
+ 				function = "hs_uart";
+ 				groups = "hs_uart_grp";
diff --git a/target/linux/bcm4908/patches-5.15/034-v6.1-0002-arm64-dts-broadcom-bcm4908-add-LEDs-controller-block.patch b/target/linux/bcm4908/patches-5.15/034-v6.1-0002-arm64-dts-broadcom-bcm4908-add-LEDs-controller-block.patch
new file mode 100644
index 00000000000000..28641ab7883e41
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/034-v6.1-0002-arm64-dts-broadcom-bcm4908-add-LEDs-controller-block.patch
@@ -0,0 +1,35 @@
+From 7de56b1dc1149c702d4cc1e89ccc251bfb2bc246 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 18 Jul 2022 15:20:59 +0200
+Subject: [PATCH] arm64: dts: broadcom: bcm4908: add LEDs controller block
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+BCM4908 includes LEDs controller that supports multiple brightness
+levels & hardware blinking.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20220718132100.13277-2-zajec5@gmail.com
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
+@@ -517,6 +517,14 @@
+ 			status = "okay";
+ 		};
+ 
++		leds: leds@800 {
++			compatible = "brcm,bcm4908-leds", "brcm,bcm63138-leds";
++			reg = <0x800 0xdc>;
++
++			#address-cells = <1>;
++			#size-cells = <0>;
++		};
++
+ 		nand-controller@1800 {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
diff --git a/target/linux/bcm4908/patches-5.15/034-v6.1-0003-arm64-dts-broadcom-bcm4908-add-Asus-GT-AC5300-LEDs.patch b/target/linux/bcm4908/patches-5.15/034-v6.1-0003-arm64-dts-broadcom-bcm4908-add-Asus-GT-AC5300-LEDs.patch
new file mode 100644
index 00000000000000..f4c7d8c489536d
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/034-v6.1-0003-arm64-dts-broadcom-bcm4908-add-Asus-GT-AC5300-LEDs.patch
@@ -0,0 +1,81 @@
+From 3bcae3396e986b4ab97a69e8de517e32f9691a4b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 18 Jul 2022 15:21:00 +0200
+Subject: [PATCH] arm64: dts: broadcom: bcm4908: add Asus GT-AC5300 LEDs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+There are 5 software-controllable LEDs on PCB.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20220718132100.13277-3-zajec5@gmail.com
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ .../bcmbca/bcm4908-asus-gt-ac5300.dts        | 48 +++++++++++++++++++
+ 1 file changed, 48 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts
+@@ -2,6 +2,7 @@
+ 
+ #include <dt-bindings/gpio/gpio.h>
+ #include <dt-bindings/input/input.h>
++#include <dt-bindings/leds/common.h>
+ 
+ #include "bcm4908.dtsi"
+ 
+@@ -118,6 +119,53 @@
+ 	};
+ };
+ 
++&leds {
++	led-power@11 {
++		reg = <0x11>;
++		function = LED_FUNCTION_POWER;
++		color = <LED_COLOR_ID_WHITE>;
++		default-state = "on";
++		active-low;
++		pinctrl-names = "default";
++		pinctrl-0 = <&pins_led_17_a>;
++	};
++
++	led-wan-red@12 {
++		reg = <0x12>;
++		function = LED_FUNCTION_WAN;
++		color = <LED_COLOR_ID_RED>;
++		active-low;
++		pinctrl-names = "default";
++		pinctrl-0 = <&pins_led_18_a>;
++	};
++
++	led-wps@14 {
++		reg = <0x14>;
++		function = LED_FUNCTION_WPS;
++		color = <LED_COLOR_ID_WHITE>;
++		active-low;
++		pinctrl-names = "default";
++		pinctrl-0 = <&pins_led_20_a>;
++	};
++
++	led-wan-white@15 {
++		reg = <0x15>;
++		function = LED_FUNCTION_WAN;
++		color = <LED_COLOR_ID_WHITE>;
++		active-low;
++		pinctrl-names = "default";
++		pinctrl-0 = <&pins_led_21_a>;
++	};
++
++	led-lan@19 {
++		reg = <0x19>;
++		function = LED_FUNCTION_LAN;
++		color = <LED_COLOR_ID_WHITE>;
++		pinctrl-names = "default";
++		pinctrl-0 = <&pins_led_25_a>;
++	};
++};
++
+ &nandcs {
+ 	nand-ecc-strength = <4>;
+ 	nand-ecc-step-size = <512>;
diff --git a/target/linux/bcm4908/patches-5.15/034-v6.1-0004-arm64-dts-bcmbca-update-BCM4908-board-dts-files.patch b/target/linux/bcm4908/patches-5.15/034-v6.1-0004-arm64-dts-bcmbca-update-BCM4908-board-dts-files.patch
new file mode 100644
index 00000000000000..8f9d3604cb54ff
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/034-v6.1-0004-arm64-dts-bcmbca-update-BCM4908-board-dts-files.patch
@@ -0,0 +1,66 @@
+From 4fdcbde682291fba2c3f45a41decd656d92a314f Mon Sep 17 00:00:00 2001
+From: William Zhang <william.zhang@broadcom.com>
+Date: Wed, 3 Aug 2022 10:54:49 -0700
+Subject: [PATCH] arm64: dts: bcmbca: update BCM4908 board dts files
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Append "brcm,bcmbca" to compatible strings based on the new bcmbca
+binding rule for BCM4908 family based boards.
+
+Signed-off-by: William Zhang <william.zhang@broadcom.com>
+Acked-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20220803175455.47638-4-william.zhang@broadcom.com
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm64/boot/dts/broadcom/bcmbca/bcm4906-netgear-r8000p.dts | 2 +-
+ .../dts/broadcom/bcmbca/bcm4906-tplink-archer-c2300-v1.dts     | 2 +-
+ arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts | 2 +-
+ .../arm64/boot/dts/broadcom/bcmbca/bcm4908-netgear-raxe500.dts | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4906-netgear-r8000p.dts
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4906-netgear-r8000p.dts
+@@ -7,7 +7,7 @@
+ #include "bcm4906.dtsi"
+ 
+ / {
+-	compatible = "netgear,r8000p", "brcm,bcm4906", "brcm,bcm4908";
++	compatible = "netgear,r8000p", "brcm,bcm4906", "brcm,bcm4908", "brcm,bcmbca";
+ 	model = "Netgear R8000P";
+ 
+ 	memory@0 {
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4906-tplink-archer-c2300-v1.dts
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4906-tplink-archer-c2300-v1.dts
+@@ -7,7 +7,7 @@
+ #include "bcm4906.dtsi"
+ 
+ / {
+-	compatible = "tplink,archer-c2300-v1", "brcm,bcm4906", "brcm,bcm4908";
++	compatible = "tplink,archer-c2300-v1", "brcm,bcm4906", "brcm,bcm4908", "brcm,bcmbca";
+ 	model = "TP-Link Archer C2300 V1";
+ 
+ 	memory@0 {
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts
+@@ -7,7 +7,7 @@
+ #include "bcm4908.dtsi"
+ 
+ / {
+-	compatible = "asus,gt-ac5300", "brcm,bcm4908";
++	compatible = "asus,gt-ac5300", "brcm,bcm4908", "brcm,bcmbca";
+ 	model = "Asus GT-AC5300";
+ 
+ 	memory@0 {
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-netgear-raxe500.dts
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-netgear-raxe500.dts
+@@ -3,7 +3,7 @@
+ #include "bcm4908.dtsi"
+ 
+ / {
+-	compatible = "netgear,raxe500", "brcm,bcm4908";
++	compatible = "netgear,raxe500", "brcm,bcm4908", "brcm,bcmbca";
+ 	model = "Netgear RAXE500";
+ 
+ 	memory@0 {
diff --git a/target/linux/bcm4908/patches-5.15/034-v6.1-0006-arm64-dts-Add-BCM4908-generic-board-dts.patch b/target/linux/bcm4908/patches-5.15/034-v6.1-0006-arm64-dts-Add-BCM4908-generic-board-dts.patch
new file mode 100644
index 00000000000000..b19c5d33b4c3d6
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/034-v6.1-0006-arm64-dts-Add-BCM4908-generic-board-dts.patch
@@ -0,0 +1,62 @@
+From 72e0bdb6d7edb1785d58f2e8e7c80e1d2f93a319 Mon Sep 17 00:00:00 2001
+From: William Zhang <william.zhang@broadcom.com>
+Date: Wed, 3 Aug 2022 10:54:51 -0700
+Subject: [PATCH] arm64: dts: Add BCM4908 generic board dts
+
+Add generic bare bone bcm94908.dts file to support any 4908 based
+design. It supports cpu subsystem, memory and an uart console. This can
+be useful for board bring-up and cpu subsystem and memory related kernel
+test as well.
+
+Signed-off-by: William Zhang <william.zhang@broadcom.com>
+Link: https://lore.kernel.org/r/20220803175455.47638-6-william.zhang@broadcom.com
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm64/boot/dts/broadcom/bcmbca/Makefile  |  1 +
+ .../boot/dts/broadcom/bcmbca/bcm94908.dts     | 30 +++++++++++++++++++
+ 2 files changed, 31 insertions(+)
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcmbca/bcm94908.dts
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/Makefile
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/Makefile
+@@ -4,6 +4,7 @@ dtb-$(CONFIG_ARCH_BCMBCA) += \
+ 				bcm4906-tplink-archer-c2300-v1.dtb \
+ 				bcm4908-asus-gt-ac5300.dtb \
+ 				bcm4908-netgear-raxe500.dtb \
++				bcm94908.dtb \
+ 				bcm4912-asus-gt-ax6000.dtb \
+ 				bcm94912.dtb \
+ 				bcm963158.dtb \
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm94908.dts
+@@ -0,0 +1,30 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Copyright 2022 Broadcom Ltd.
++ */
++
++/dts-v1/;
++
++#include "bcm4908.dtsi"
++
++/ {
++	model = "Broadcom BCM94908 Reference Board";
++	compatible = "brcm,bcm94908", "brcm,bcm4908", "brcm,bcmbca";
++
++	aliases {
++		serial0 = &uart0;
++	};
++
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
++	memory@0 {
++		device_type = "memory";
++		reg = <0x0 0x0 0x0 0x08000000>;
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
diff --git a/target/linux/bcm4908/patches-5.15/035-v6.2-0001-arm64-dts-broadcom-bcmbca-bcm4908-add-TWD-block-time.patch b/target/linux/bcm4908/patches-5.15/035-v6.2-0001-arm64-dts-broadcom-bcmbca-bcm4908-add-TWD-block-time.patch
new file mode 100644
index 00000000000000..a3f49ca440a92d
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/035-v6.2-0001-arm64-dts-broadcom-bcmbca-bcm4908-add-TWD-block-time.patch
@@ -0,0 +1,31 @@
+From 68064196cffea33f090bd2e8d81cd5e20107ecf1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 3 Nov 2022 11:53:16 +0100
+Subject: [PATCH] arm64: dts: broadcom: bcmbca: bcm4908: add TWD block timer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+BCM4908 TWD contains block with 4 timers. Add binding for it.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20221103105316.21294-1-zajec5@gmail.com
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
+@@ -283,6 +283,11 @@
+ 			#address-cells = <1>;
+ 			#size-cells = <1>;
+ 
++			timer@0 {
++				compatible = "brcm,bcm63138-timer";
++				reg = <0x0 0x28>;
++			};
++
+ 			watchdog@28 {
+ 				compatible = "brcm,bcm6345-wdt";
+ 				reg = <0x28 0x8>;
diff --git a/target/linux/bcm4908/patches-5.15/035-v6.2-0002-arm64-dts-broadcom-bcmbca-bcm6858-add-TWD-block.patch b/target/linux/bcm4908/patches-5.15/035-v6.2-0002-arm64-dts-broadcom-bcmbca-bcm6858-add-TWD-block.patch
new file mode 100644
index 00000000000000..e8e81ae5441bf0
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/035-v6.2-0002-arm64-dts-broadcom-bcmbca-bcm6858-add-TWD-block.patch
@@ -0,0 +1,46 @@
+From 4f9fb09175e87a233787a2dee1e5dabb14deb022 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 3 Nov 2022 12:00:15 +0100
+Subject: [PATCH] arm64: dts: broadcom: bcmbca: bcm6858: add TWD block
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+BCM6858 contains TWD block with timers, watchdog, and reset subblocks.
+Describe it.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20221103110015.21761-1-zajec5@gmail.com
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ .../boot/dts/broadcom/bcmbca/bcm6858.dtsi     | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm6858.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm6858.dtsi
+@@ -109,6 +109,25 @@
+ 		#size-cells = <1>;
+ 		ranges = <0x0 0x0 0xff800000 0x62000>;
+ 
++		twd: timer-mfd@400 {
++			compatible = "brcm,bcm4908-twd", "simple-mfd", "syscon";
++			reg = <0x400 0x4c>;
++			ranges = <0x0 0x400 0x4c>;
++
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			timer@0 {
++				compatible = "brcm,bcm63138-timer";
++				reg = <0x0 0x28>;
++			};
++
++			watchdog@28 {
++				compatible = "brcm,bcm6345-wdt";
++				reg = <0x28 0x8>;
++			};
++		};
++
+ 		uart0: serial@640 {
+ 			compatible = "brcm,bcm6345-uart";
+ 			reg = <0x640 0x18>;
diff --git a/target/linux/bcm4908/patches-5.15/035-v6.2-0003-arm64-dts-Update-cache-properties-for-broadcom.patch b/target/linux/bcm4908/patches-5.15/035-v6.2-0003-arm64-dts-Update-cache-properties-for-broadcom.patch
new file mode 100644
index 00000000000000..a19ab8cf8fddb4
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/035-v6.2-0003-arm64-dts-Update-cache-properties-for-broadcom.patch
@@ -0,0 +1,134 @@
+From e567e58d6819adc002c57b81e16b88da24d3b4aa Mon Sep 17 00:00:00 2001
+From: Pierre Gondois <pierre.gondois@arm.com>
+Date: Tue, 22 Nov 2022 17:32:07 +0100
+Subject: [PATCH] arm64: dts: Update cache properties for broadcom
+
+The DeviceTree Specification v0.3 specifies that the cache node
+'compatible' and 'cache-level' properties are 'required'. Cf.
+s3.8 Multi-level and Shared Cache Nodes
+The 'cache-unified' property should be present if one of the
+properties for unified cache is present ('cache-size', ...).
+
+Update the Device Trees accordingly.
+
+Acked-by: William Zhang <william.zhang@broadcom.com>
+Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
+Link: https://lore.kernel.org/r/20221122163208.3810985-3-pierre.gondois@arm.com
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi    | 1 +
+ arch/arm64/boot/dts/broadcom/bcmbca/bcm4912.dtsi    | 1 +
+ arch/arm64/boot/dts/broadcom/bcmbca/bcm63146.dtsi   | 1 +
+ arch/arm64/boot/dts/broadcom/bcmbca/bcm63158.dtsi   | 1 +
+ arch/arm64/boot/dts/broadcom/bcmbca/bcm6813.dtsi    | 1 +
+ arch/arm64/boot/dts/broadcom/bcmbca/bcm6856.dtsi    | 1 +
+ arch/arm64/boot/dts/broadcom/bcmbca/bcm6858.dtsi    | 1 +
+ arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi    | 1 +
+ arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi | 4 ++++
+ 9 files changed, 12 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
+@@ -63,6 +63,7 @@
+ 
+ 		l2: l2-cache0 {
+ 			compatible = "cache";
++			cache-level = <2>;
+ 		};
+ 	};
+ 
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4912.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4912.dtsi
+@@ -51,6 +51,7 @@
+ 
+ 		L2_0: l2-cache0 {
+ 			compatible = "cache";
++			cache-level = <2>;
+ 		};
+ 	};
+ 
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm63146.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm63146.dtsi
+@@ -35,6 +35,7 @@
+ 
+ 		L2_0: l2-cache0 {
+ 			compatible = "cache";
++			cache-level = <2>;
+ 		};
+ 	};
+ 
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm63158.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm63158.dtsi
+@@ -51,6 +51,7 @@
+ 
+ 		L2_0: l2-cache0 {
+ 			compatible = "cache";
++			cache-level = <2>;
+ 		};
+ 	};
+ 
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm6813.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm6813.dtsi
+@@ -51,6 +51,7 @@
+ 
+ 		L2_0: l2-cache0 {
+ 			compatible = "cache";
++			cache-level = <2>;
+ 		};
+ 	};
+ 
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm6856.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm6856.dtsi
+@@ -35,6 +35,7 @@
+ 
+ 		L2_0: l2-cache0 {
+ 			compatible = "cache";
++			cache-level = <2>;
+ 		};
+ 	};
+ 
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm6858.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm6858.dtsi
+@@ -50,6 +50,7 @@
+ 		};
+ 		L2_0: l2-cache0 {
+ 			compatible = "cache";
++			cache-level = <2>;
+ 		};
+ 	};
+ 
+--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+@@ -79,6 +79,7 @@
+ 
+ 		CLUSTER0_L2: l2-cache@0 {
+ 			compatible = "cache";
++			cache-level = <2>;
+ 		};
+ 	};
+ 
+--- a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
++++ b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
+@@ -108,18 +108,22 @@
+ 
+ 		CLUSTER0_L2: l2-cache@0 {
+ 			compatible = "cache";
++			cache-level = <2>;
+ 		};
+ 
+ 		CLUSTER1_L2: l2-cache@100 {
+ 			compatible = "cache";
++			cache-level = <2>;
+ 		};
+ 
+ 		CLUSTER2_L2: l2-cache@200 {
+ 			compatible = "cache";
++			cache-level = <2>;
+ 		};
+ 
+ 		CLUSTER3_L2: l2-cache@300 {
+ 			compatible = "cache";
++			cache-level = <2>;
+ 		};
+ 	};
+ 
diff --git a/target/linux/bcm4908/patches-5.15/036-v6.4-0001-arm64-dts-broadcom-bcmbca-Add-spi-controller-node.patch b/target/linux/bcm4908/patches-5.15/036-v6.4-0001-arm64-dts-broadcom-bcmbca-Add-spi-controller-node.patch
new file mode 100644
index 00000000000000..e8e122817931e8
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/036-v6.4-0001-arm64-dts-broadcom-bcmbca-Add-spi-controller-node.patch
@@ -0,0 +1,367 @@
+From f5d83b714e304d5f3229da434af2eeea033c4f5d Mon Sep 17 00:00:00 2001
+From: William Zhang <william.zhang@broadcom.com>
+Date: Mon, 6 Feb 2023 22:58:15 -0800
+Subject: [PATCH] arm64: dts: broadcom: bcmbca: Add spi controller node
+
+Add support for HSSPI controller in ARMv8 chip dts files.
+
+Signed-off-by: William Zhang <william.zhang@broadcom.com>
+Link: https://lore.kernel.org/r/20230207065826.285013-5-william.zhang@broadcom.com
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ .../boot/dts/broadcom/bcmbca/bcm4908.dtsi     | 18 +++++++++++++++++
+ .../boot/dts/broadcom/bcmbca/bcm4912.dtsi     | 20 +++++++++++++++++++
+ .../boot/dts/broadcom/bcmbca/bcm63146.dtsi    | 19 ++++++++++++++++++
+ .../boot/dts/broadcom/bcmbca/bcm63158.dtsi    | 19 ++++++++++++++++++
+ .../boot/dts/broadcom/bcmbca/bcm6813.dtsi     | 20 +++++++++++++++++++
+ .../boot/dts/broadcom/bcmbca/bcm6856.dtsi     | 18 +++++++++++++++++
+ .../boot/dts/broadcom/bcmbca/bcm6858.dtsi     | 18 +++++++++++++++++
+ .../boot/dts/broadcom/bcmbca/bcm94908.dts     |  4 ++++
+ .../boot/dts/broadcom/bcmbca/bcm94912.dts     |  4 ++++
+ .../boot/dts/broadcom/bcmbca/bcm963146.dts    |  4 ++++
+ .../boot/dts/broadcom/bcmbca/bcm963158.dts    |  4 ++++
+ .../boot/dts/broadcom/bcmbca/bcm96813.dts     |  4 ++++
+ .../boot/dts/broadcom/bcmbca/bcm96856.dts     |  4 ++++
+ .../boot/dts/broadcom/bcmbca/bcm96858.dts     |  4 ++++
+ 14 files changed, 160 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
+@@ -107,6 +107,12 @@
+ 			clock-frequency = <50000000>;
+ 			clock-output-names = "periph";
+ 		};
++
++		hsspi_pll: hsspi-pll {
++			compatible = "fixed-clock";
++			#clock-cells = <0>;
++			clock-frequency = <400000000>;
++		};
+ 	};
+ 
+ 	soc {
+@@ -531,6 +537,18 @@
+ 			#size-cells = <0>;
+ 		};
+ 
++		hsspi: spi@1000{
++			#address-cells = <1>;
++			#size-cells = <0>;
++			compatible = "brcm,bcm4908-hsspi", "brcm,bcmbca-hsspi-v1.0";
++			reg = <0x1000 0x600>;
++			interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&hsspi_pll &hsspi_pll>;
++			clock-names = "hsspi", "pll";
++			num-cs = <8>;
++			status = "disabled";
++		};
++
+ 		nand-controller@1800 {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4912.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4912.dtsi
+@@ -79,6 +79,7 @@
+ 			#clock-cells = <0>;
+ 			clock-frequency = <200000000>;
+ 		};
++
+ 		uart_clk: uart-clk {
+ 			compatible = "fixed-factor-clock";
+ 			#clock-cells = <0>;
+@@ -86,6 +87,12 @@
+ 			clock-div = <4>;
+ 			clock-mult = <1>;
+ 		};
++
++		hsspi_pll: hsspi-pll {
++			compatible = "fixed-clock";
++			#clock-cells = <0>;
++			clock-frequency = <200000000>;
++		};
+ 	};
+ 
+ 	psci {
+@@ -117,6 +124,19 @@
+ 		#size-cells = <1>;
+ 		ranges = <0x0 0x0 0xff800000 0x800000>;
+ 
++		hsspi: spi@1000 {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			compatible = "brcm,bcm4912-hsspi", "brcm,bcmbca-hsspi-v1.1";
++			reg = <0x1000 0x600>, <0x2610 0x4>;
++			reg-names = "hsspi", "spim-ctrl";
++			interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&hsspi_pll &hsspi_pll>;
++			clock-names = "hsspi", "pll";
++			num-cs = <8>;
++			status = "disabled";
++		};
++
+ 		uart0: serial@12000 {
+ 			compatible = "arm,pl011", "arm,primecell";
+ 			reg = <0x12000 0x1000>;
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm63146.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm63146.dtsi
+@@ -60,6 +60,7 @@
+ 			#clock-cells = <0>;
+ 			clock-frequency = <200000000>;
+ 		};
++
+ 		uart_clk: uart-clk {
+ 			compatible = "fixed-factor-clock";
+ 			#clock-cells = <0>;
+@@ -67,6 +68,12 @@
+ 			clock-div = <4>;
+ 			clock-mult = <1>;
+ 		};
++
++		hsspi_pll: hsspi-pll {
++			compatible = "fixed-clock";
++			#clock-cells = <0>;
++			clock-frequency = <200000000>;
++		};
+ 	};
+ 
+ 	psci {
+@@ -99,6 +106,18 @@
+ 		#size-cells = <1>;
+ 		ranges = <0x0 0x0 0xff800000 0x800000>;
+ 
++		hsspi: spi@1000 {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			compatible = "brcm,bcm63146-hsspi", "brcm,bcmbca-hsspi-v1.0";
++			reg = <0x1000 0x600>;
++			interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&hsspi_pll &hsspi_pll>;
++			clock-names = "hsspi", "pll";
++			num-cs = <8>;
++			status = "disabled";
++		};
++
+ 		uart0: serial@12000 {
+ 			compatible = "arm,pl011", "arm,primecell";
+ 			reg = <0x12000 0x1000>;
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm63158.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm63158.dtsi
+@@ -79,6 +79,7 @@
+ 			#clock-cells = <0>;
+ 			clock-frequency = <200000000>;
+ 		};
++
+ 		uart_clk: uart-clk {
+ 			compatible = "fixed-factor-clock";
+ 			#clock-cells = <0>;
+@@ -86,6 +87,12 @@
+ 			clock-div = <4>;
+ 			clock-mult = <1>;
+ 		};
++
++		hsspi_pll: hsspi-pll {
++			compatible = "fixed-clock";
++			#clock-cells = <0>;
++			clock-frequency = <400000000>;
++		};
+ 	};
+ 
+ 	psci {
+@@ -117,6 +124,18 @@
+ 		#size-cells = <1>;
+ 		ranges = <0x0 0x0 0xff800000 0x800000>;
+ 
++		hsspi: spi@1000 {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			compatible = "brcm,bcm63158-hsspi", "brcm,bcmbca-hsspi-v1.0";
++			reg = <0x1000 0x600>;
++			interrupts = <GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&hsspi_pll &hsspi_pll>;
++			clock-names = "hsspi", "pll";
++			num-cs = <8>;
++			status = "disabled";
++		};
++
+ 		uart0: serial@12000 {
+ 			compatible = "arm,pl011", "arm,primecell";
+ 			reg = <0x12000 0x1000>;
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm6813.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm6813.dtsi
+@@ -79,6 +79,7 @@
+ 			#clock-cells = <0>;
+ 			clock-frequency = <200000000>;
+ 		};
++
+ 		uart_clk: uart-clk {
+ 			compatible = "fixed-factor-clock";
+ 			#clock-cells = <0>;
+@@ -86,6 +87,12 @@
+ 			clock-div = <4>;
+ 			clock-mult = <1>;
+ 		};
++
++		hsspi_pll: hsspi-pll {
++			compatible = "fixed-clock";
++			#clock-cells = <0>;
++			clock-frequency = <200000000>;
++		};
+ 	};
+ 
+ 	psci {
+@@ -117,6 +124,19 @@
+ 		#size-cells = <1>;
+ 		ranges = <0x0 0x0 0xff800000 0x800000>;
+ 
++		hsspi: spi@1000 {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			compatible = "brcm,bcm6813-hsspi", "brcm,bcmbca-hsspi-v1.1";
++			reg = <0x1000 0x600>, <0x2610 0x4>;
++			reg-names = "hsspi", "spim-ctrl";
++			interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&hsspi_pll &hsspi_pll>;
++			clock-names = "hsspi", "pll";
++			num-cs = <8>;
++			status = "disabled";
++		};
++
+ 		uart0: serial@12000 {
+ 			compatible = "arm,pl011", "arm,primecell";
+ 			reg = <0x12000 0x1000>;
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm6856.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm6856.dtsi
+@@ -60,6 +60,12 @@
+ 			#clock-cells = <0>;
+ 			clock-frequency = <200000000>;
+ 		};
++
++		hsspi_pll: hsspi-pll {
++			compatible = "fixed-clock";
++			#clock-cells = <0>;
++			clock-frequency = <400000000>;
++		};
+ 	};
+ 
+ 	psci {
+@@ -100,5 +106,17 @@
+ 			clock-names = "refclk";
+ 			status = "disabled";
+ 		};
++
++		hsspi: spi@1000 {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			compatible = "brcm,bcm6856-hsspi", "brcm,bcmbca-hsspi-v1.0";
++			reg = <0x1000 0x600>;
++			interrupts = <GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&hsspi_pll &hsspi_pll>;
++			clock-names = "hsspi", "pll";
++			num-cs = <8>;
++			status = "disabled";
++		};
+ 	};
+ };
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm6858.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm6858.dtsi
+@@ -78,6 +78,12 @@
+ 			#clock-cells = <0>;
+ 			clock-frequency = <200000000>;
+ 		};
++
++		hsspi_pll: hsspi-pll {
++			compatible = "fixed-clock";
++			#clock-cells = <0>;
++			clock-frequency = <400000000>;
++		};
+ 	};
+ 
+ 	psci {
+@@ -137,5 +143,17 @@
+ 			clock-names = "refclk";
+ 			status = "disabled";
+ 		};
++
++		hsspi: spi@1000 {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			compatible = "brcm,bcm6858-hsspi", "brcm,bcmbca-hsspi-v1.0";
++			reg = <0x1000 0x600>;
++			interrupts = <GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&hsspi_pll &hsspi_pll>;
++			clock-names = "hsspi", "pll";
++			num-cs = <8>;
++			status = "disabled";
++		};
+ 	};
+ };
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm94908.dts
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm94908.dts
+@@ -28,3 +28,7 @@
+ &uart0 {
+ 	status = "okay";
+ };
++
++&hsspi {
++	status = "okay";
++};
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm94912.dts
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm94912.dts
+@@ -28,3 +28,7 @@
+ &uart0 {
+ 	status = "okay";
+ };
++
++&hsspi {
++	status = "okay";
++};
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm963146.dts
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm963146.dts
+@@ -28,3 +28,7 @@
+ &uart0 {
+ 	status = "okay";
+ };
++
++&hsspi {
++	status = "okay";
++};
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm963158.dts
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm963158.dts
+@@ -28,3 +28,7 @@
+ &uart0 {
+ 	status = "okay";
+ };
++
++&hsspi {
++	status = "okay";
++};
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm96813.dts
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm96813.dts
+@@ -28,3 +28,7 @@
+ &uart0 {
+ 	status = "okay";
+ };
++
++&hsspi {
++	status = "okay";
++};
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm96856.dts
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm96856.dts
+@@ -28,3 +28,7 @@
+ &uart0 {
+ 	status = "okay";
+ };
++
++&hsspi {
++	status = "okay";
++};
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm96858.dts
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm96858.dts
+@@ -28,3 +28,7 @@
+ &uart0 {
+ 	status = "okay";
+ };
++
++&hsspi {
++	status = "okay";
++};
diff --git a/target/linux/bcm4908/patches-5.15/036-v6.4-0003-arm64-dts-broadcom-bcmbca-bcm4908-fix-LED-nodenames.patch b/target/linux/bcm4908/patches-5.15/036-v6.4-0003-arm64-dts-broadcom-bcmbca-bcm4908-fix-LED-nodenames.patch
new file mode 100644
index 00000000000000..7ce17c1870fa5a
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/036-v6.4-0003-arm64-dts-broadcom-bcmbca-bcm4908-fix-LED-nodenames.patch
@@ -0,0 +1,66 @@
+From 23be9f68f933adee8163b8efc9c6bff71410cc7c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 28 Feb 2023 15:43:59 +0100
+Subject: [PATCH] arm64: dts: broadcom: bcmbca: bcm4908: fix LED nodenames
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This fixes:
+arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dtb: leds@800: 'led-lan@19', 'led-power@11', 'led-wan-red@12', 'led-wan-white@15', 'led-wps@14' do not match any of the regexes: '^led@[a-f0-9]+$', 'pinctrl-[0-9]+'
+        From schema: Documentation/devicetree/bindings/leds/leds-bcm63138.yaml
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/all/20230228144400.21689-2-zajec5@gmail.com/
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ .../dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts     | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts
+@@ -120,7 +120,7 @@
+ };
+ 
+ &leds {
+-	led-power@11 {
++	led@11 {
+ 		reg = <0x11>;
+ 		function = LED_FUNCTION_POWER;
+ 		color = <LED_COLOR_ID_WHITE>;
+@@ -130,7 +130,7 @@
+ 		pinctrl-0 = <&pins_led_17_a>;
+ 	};
+ 
+-	led-wan-red@12 {
++	led@12 {
+ 		reg = <0x12>;
+ 		function = LED_FUNCTION_WAN;
+ 		color = <LED_COLOR_ID_RED>;
+@@ -139,7 +139,7 @@
+ 		pinctrl-0 = <&pins_led_18_a>;
+ 	};
+ 
+-	led-wps@14 {
++	led@14 {
+ 		reg = <0x14>;
+ 		function = LED_FUNCTION_WPS;
+ 		color = <LED_COLOR_ID_WHITE>;
+@@ -148,7 +148,7 @@
+ 		pinctrl-0 = <&pins_led_20_a>;
+ 	};
+ 
+-	led-wan-white@15 {
++	led@15 {
+ 		reg = <0x15>;
+ 		function = LED_FUNCTION_WAN;
+ 		color = <LED_COLOR_ID_WHITE>;
+@@ -157,7 +157,7 @@
+ 		pinctrl-0 = <&pins_led_21_a>;
+ 	};
+ 
+-	led-lan@19 {
++	led@19 {
+ 		reg = <0x19>;
+ 		function = LED_FUNCTION_LAN;
+ 		color = <LED_COLOR_ID_WHITE>;
diff --git a/target/linux/bcm4908/patches-5.15/036-v6.4-0005-arm64-dts-broadcom-bcmbca-bcm4908-add-on-SoC-USB-por.patch b/target/linux/bcm4908/patches-5.15/036-v6.4-0005-arm64-dts-broadcom-bcmbca-bcm4908-add-on-SoC-USB-por.patch
new file mode 100644
index 00000000000000..47b2455ae63fb9
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/036-v6.4-0005-arm64-dts-broadcom-bcmbca-bcm4908-add-on-SoC-USB-por.patch
@@ -0,0 +1,81 @@
+From 477cad715de1dfc256a20da3ed83b62f3cb2944d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 28 Feb 2023 15:45:18 +0100
+Subject: [PATCH] arm64: dts: broadcom: bcmbca: bcm4908: add on-SoC USB ports
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+BCM4908 has 3 USB controllers each with 2 USB ports. Home routers often
+have LEDs indicating state of selected USB ports. Describe those SoC USB
+ports to allow using them as LED trigger sources.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/all/20230228144520.21816-1-zajec5@gmail.com/
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ .../boot/dts/broadcom/bcmbca/bcm4908.dtsi     | 39 +++++++++++++++++++
+ 1 file changed, 39 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
+@@ -148,6 +148,19 @@
+ 			interrupts = <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>;
+ 			phys = <&usb_phy PHY_TYPE_USB2>;
+ 			status = "disabled";
++
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			ehci_port1: port@1 {
++				reg = <1>;
++				#trigger-source-cells = <0>;
++			};
++
++			ehci_port2: port@2 {
++				reg = <2>;
++				#trigger-source-cells = <0>;
++			};
+ 		};
+ 
+ 		ohci: usb@c400 {
+@@ -156,6 +169,19 @@
+ 			interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>;
+ 			phys = <&usb_phy PHY_TYPE_USB2>;
+ 			status = "disabled";
++
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			ohci_port1: port@1 {
++				reg = <1>;
++				#trigger-source-cells = <0>;
++			};
++
++			ohci_port2: port@2 {
++				reg = <2>;
++				#trigger-source-cells = <0>;
++			};
+ 		};
+ 
+ 		xhci: usb@d000 {
+@@ -164,6 +190,19 @@
+ 			interrupts = <GIC_SPI 74 IRQ_TYPE_LEVEL_HIGH>;
+ 			phys = <&usb_phy PHY_TYPE_USB3>;
+ 			status = "disabled";
++
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			xhci_port1: port@1 {
++				reg = <1>;
++				#trigger-source-cells = <0>;
++			};
++
++			xhci_port2: port@2 {
++				reg = <2>;
++				#trigger-source-cells = <0>;
++			};
+ 		};
+ 
+ 		bus@80000 {
diff --git a/target/linux/bcm4908/patches-5.15/036-v6.4-0006-arm64-dts-broadcom-bcmbca-bcm4908-add-Netgear-R8000P.patch b/target/linux/bcm4908/patches-5.15/036-v6.4-0006-arm64-dts-broadcom-bcmbca-bcm4908-add-Netgear-R8000P.patch
new file mode 100644
index 00000000000000..3e210d68e11aaf
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/036-v6.4-0006-arm64-dts-broadcom-bcmbca-bcm4908-add-Netgear-R8000P.patch
@@ -0,0 +1,38 @@
+From 889e53ccccc29ff4bf8d4c89cca34e8768845747 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 28 Feb 2023 15:45:19 +0100
+Subject: [PATCH] arm64: dts: broadcom: bcmbca: bcm4908: add Netgear R8000P USB
+ LED triggers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This device has 2 USB LEDs meant to be triggered by devices in relevant
+USB ports.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/all/20230228144520.21816-2-zajec5@gmail.com/
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ .../arm64/boot/dts/broadcom/bcmbca/bcm4906-netgear-r8000p.dts | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4906-netgear-r8000p.dts
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4906-netgear-r8000p.dts
+@@ -58,12 +58,16 @@
+ 			function = "usb2";
+ 			color = <LED_COLOR_ID_WHITE>;
+ 			gpios = <&gpio0 17 GPIO_ACTIVE_LOW>;
++			trigger-sources = <&ohci_port1>, <&ehci_port1>;
++			linux,default-trigger = "usbport";
+ 		};
+ 
+ 		led-usb3 {
+ 			function = "usb3";
+ 			color = <LED_COLOR_ID_WHITE>;
+ 			gpios = <&gpio0 18 GPIO_ACTIVE_LOW>;
++			trigger-sources = <&ohci_port2>, <&ehci_port2>, <&xhci_port2>;
++			linux,default-trigger = "usbport";
+ 		};
+ 
+ 		led-wifi {
diff --git a/target/linux/bcm4908/patches-5.15/036-v6.4-0007-arm64-dts-broadcom-bcmbca-bcm4908-add-TP-Link-C2300-.patch b/target/linux/bcm4908/patches-5.15/036-v6.4-0007-arm64-dts-broadcom-bcmbca-bcm4908-add-TP-Link-C2300-.patch
new file mode 100644
index 00000000000000..959ccd4fa3493c
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/036-v6.4-0007-arm64-dts-broadcom-bcmbca-bcm4908-add-TP-Link-C2300-.patch
@@ -0,0 +1,41 @@
+From e6d356b146b75f1f77621aab7950a1eb550859f9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 28 Feb 2023 15:45:20 +0100
+Subject: [PATCH] arm64: dts: broadcom: bcmbca: bcm4908: add TP-Link C2300 USB
+ LED triggers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This device has 2 USB LEDs meant to be triggered by devices in relevant
+USB ports.
+
+While at it fix typo in USB LED name.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/all/20230228144520.21816-3-zajec5@gmail.com/
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ .../dts/broadcom/bcmbca/bcm4906-tplink-archer-c2300-v1.dts  | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4906-tplink-archer-c2300-v1.dts
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4906-tplink-archer-c2300-v1.dts
+@@ -64,12 +64,16 @@
+ 			function = "usb2";
+ 			color = <LED_COLOR_ID_BLUE>;
+ 			gpios = <&gpio0 15 GPIO_ACTIVE_LOW>;
++			trigger-sources = <&ohci_port1>, <&ehci_port1>;
++			linux,default-trigger = "usbport";
+ 		};
+ 
+ 		led-usb3 {
+-			function = "usbd3";
++			function = "usb3";
+ 			color = <LED_COLOR_ID_BLUE>;
+ 			gpios = <&gpio0 17 GPIO_ACTIVE_LOW>;
++			trigger-sources = <&ohci_port2>, <&ehci_port2>, <&xhci_port2>;
++			linux,default-trigger = "usbport";
+ 		};
+ 
+ 		led-brightness {
diff --git a/target/linux/bcm4908/patches-5.15/040-v6.1-mtd-parsers-add-Broadcom-s-U-Boot-parser.patch b/target/linux/bcm4908/patches-5.15/040-v6.1-mtd-parsers-add-Broadcom-s-U-Boot-parser.patch
new file mode 100644
index 00000000000000..4d4059b17f14fe
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/040-v6.1-mtd-parsers-add-Broadcom-s-U-Boot-parser.patch
@@ -0,0 +1,137 @@
+From 002181f5b150e60c77f21de7ad4dd10e4614cd91 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 11 Jul 2022 17:30:41 +0200
+Subject: [PATCH] mtd: parsers: add Broadcom's U-Boot parser
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Broadcom stores environment variables blocks inside U-Boot partition
+itself. This driver finds & registers them.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220711153041.6036-2-zajec5@gmail.com
+---
+ drivers/mtd/parsers/Kconfig       | 10 ++++
+ drivers/mtd/parsers/Makefile      |  1 +
+ drivers/mtd/parsers/brcm_u-boot.c | 84 +++++++++++++++++++++++++++++++
+ 3 files changed, 95 insertions(+)
+ create mode 100644 drivers/mtd/parsers/brcm_u-boot.c
+
+--- a/drivers/mtd/parsers/Kconfig
++++ b/drivers/mtd/parsers/Kconfig
+@@ -20,6 +20,16 @@ config MTD_BCM63XX_PARTS
+ 	  This provides partition parsing for BCM63xx devices with CFE
+ 	  bootloaders.
+ 
++config MTD_BRCM_U_BOOT
++	tristate "Broadcom's U-Boot partition parser"
++	depends on ARCH_BCM4908 || COMPILE_TEST
++	help
++	  Broadcom uses a custom way of storing U-Boot environment variables.
++	  They are placed inside U-Boot partition itself at unspecified offset.
++	  It's possible to locate them by looking for a custom header with a
++	  magic value. This driver does that and creates subpartitions for
++	  each found environment variables block.
++
+ config MTD_CMDLINE_PARTS
+ 	tristate "Command line partition table parsing"
+ 	depends on MTD
+--- a/drivers/mtd/parsers/Makefile
++++ b/drivers/mtd/parsers/Makefile
+@@ -2,6 +2,7 @@
+ obj-$(CONFIG_MTD_AR7_PARTS)		+= ar7part.o
+ obj-$(CONFIG_MTD_BCM47XX_PARTS)		+= bcm47xxpart.o
+ obj-$(CONFIG_MTD_BCM63XX_PARTS)		+= bcm63xxpart.o
++obj-$(CONFIG_MTD_BRCM_U_BOOT)		+= brcm_u-boot.o
+ obj-$(CONFIG_MTD_CMDLINE_PARTS)		+= cmdlinepart.o
+ obj-$(CONFIG_MTD_MYLOADER_PARTS)		+= myloader.o
+ obj-$(CONFIG_MTD_OF_PARTS)		+= ofpart.o
+--- /dev/null
++++ b/drivers/mtd/parsers/brcm_u-boot.c
+@@ -0,0 +1,84 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Copyright © 2022 Rafał Miłecki <rafal@milecki.pl>
++ */
++
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/slab.h>
++#include <linux/mtd/mtd.h>
++#include <linux/mtd/partitions.h>
++
++#define BRCM_U_BOOT_MAX_OFFSET		0x200000
++#define BRCM_U_BOOT_STEP		0x1000
++
++#define BRCM_U_BOOT_MAX_PARTS		2
++
++#define BRCM_U_BOOT_MAGIC		0x75456e76	/* uEnv */
++
++struct brcm_u_boot_header {
++	__le32 magic;
++	__le32 length;
++} __packed;
++
++static const char *names[BRCM_U_BOOT_MAX_PARTS] = {
++	"u-boot-env",
++	"u-boot-env-backup",
++};
++
++static int brcm_u_boot_parse(struct mtd_info *mtd,
++			     const struct mtd_partition **pparts,
++			     struct mtd_part_parser_data *data)
++{
++	struct brcm_u_boot_header header;
++	struct mtd_partition *parts;
++	size_t bytes_read;
++	size_t offset;
++	int err;
++	int i = 0;
++
++	parts = kcalloc(BRCM_U_BOOT_MAX_PARTS, sizeof(*parts), GFP_KERNEL);
++	if (!parts)
++		return -ENOMEM;
++
++	for (offset = 0;
++	     offset < min_t(size_t, mtd->size, BRCM_U_BOOT_MAX_OFFSET);
++	     offset += BRCM_U_BOOT_STEP) {
++		err = mtd_read(mtd, offset, sizeof(header), &bytes_read, (uint8_t *)&header);
++		if (err && !mtd_is_bitflip(err)) {
++			pr_err("Failed to read from %s at 0x%zx: %d\n", mtd->name, offset, err);
++			continue;
++		}
++
++		if (le32_to_cpu(header.magic) != BRCM_U_BOOT_MAGIC)
++			continue;
++
++		parts[i].name = names[i];
++		parts[i].offset = offset;
++		parts[i].size = sizeof(header) + le32_to_cpu(header.length);
++		i++;
++		pr_info("offset:0x%zx magic:0x%08x BINGO\n", offset, header.magic);
++
++		if (i == BRCM_U_BOOT_MAX_PARTS)
++			break;
++	}
++
++	*pparts = parts;
++
++	return i;
++};
++
++static const struct of_device_id brcm_u_boot_of_match_table[] = {
++	{ .compatible = "brcm,u-boot" },
++	{},
++};
++MODULE_DEVICE_TABLE(of, brcm_u_boot_of_match_table);
++
++static struct mtd_part_parser brcm_u_boot_mtd_parser = {
++	.parse_fn = brcm_u_boot_parse,
++	.name = "brcm_u-boot",
++	.of_match_table = brcm_u_boot_of_match_table,
++};
++module_mtd_part_parser(brcm_u_boot_mtd_parser);
++
++MODULE_LICENSE("GPL");
diff --git a/target/linux/bcm4908/patches-5.15/070-v5.17-net-dsa-bcm_sf2-refactor-LED-regs-access.patch b/target/linux/bcm4908/patches-5.15/070-v5.17-net-dsa-bcm_sf2-refactor-LED-regs-access.patch
new file mode 100644
index 00000000000000..fd0b13c17ba952
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/070-v5.17-net-dsa-bcm_sf2-refactor-LED-regs-access.patch
@@ -0,0 +1,209 @@
+From af30f8eaa8fe4ff1987280f716309711997bd979 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 29 Dec 2021 18:16:42 +0100
+Subject: [PATCH] net: dsa: bcm_sf2: refactor LED regs access
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+1. Define more regs. Some switches (e.g. BCM4908) have up to 6 regs.
+2. Add helper for handling non-lineral port <-> reg mappings.
+3. Add support for 12 B LED reg blocks on BCM4908 (different layout)
+
+Complete support for LEDs setup will be implemented once Linux receives
+a proper design & implementation for "hardware" LEDs.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20211229171642.22942-1-zajec5@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/bcm_sf2.c      | 54 ++++++++++++++++++++++++----
+ drivers/net/dsa/bcm_sf2.h      | 10 ++++++
+ drivers/net/dsa/bcm_sf2_regs.h | 65 +++++++++++++++++++++++++++++++---
+ 3 files changed, 119 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -62,6 +62,38 @@ static u16 bcm_sf2_reg_rgmii_cntrl(struc
+ 	return REG_SWITCH_STATUS;
+ }
+ 
++static u16 bcm_sf2_reg_led_base(struct bcm_sf2_priv *priv, int port)
++{
++	switch (port) {
++	case 0:
++		return REG_LED_0_CNTRL;
++	case 1:
++		return REG_LED_1_CNTRL;
++	case 2:
++		return REG_LED_2_CNTRL;
++	}
++
++	switch (priv->type) {
++	case BCM4908_DEVICE_ID:
++		switch (port) {
++		case 3:
++			return REG_LED_3_CNTRL;
++		case 7:
++			return REG_LED_4_CNTRL;
++		default:
++			break;
++		}
++		break;
++	default:
++		break;
++	}
++
++	WARN_ONCE(1, "Unsupported port %d\n", port);
++
++	/* RO fallback reg */
++	return REG_SWITCH_STATUS;
++}
++
+ /* Return the number of active ports, not counting the IMP (CPU) port */
+ static unsigned int bcm_sf2_num_active_ports(struct dsa_switch *ds)
+ {
+@@ -187,9 +219,14 @@ static void bcm_sf2_gphy_enable_set(stru
+ 
+ 	/* Use PHY-driven LED signaling */
+ 	if (!enable) {
+-		reg = reg_readl(priv, REG_LED_CNTRL(0));
+-		reg |= SPDLNK_SRC_SEL;
+-		reg_writel(priv, reg, REG_LED_CNTRL(0));
++		u16 led_ctrl = bcm_sf2_reg_led_base(priv, 0);
++
++		if (priv->type == BCM7278_DEVICE_ID ||
++		    priv->type == BCM7445_DEVICE_ID) {
++			reg = reg_led_readl(priv, led_ctrl, 0);
++			reg |= LED_CNTRL_SPDLNK_SRC_SEL;
++			reg_led_writel(priv, reg, led_ctrl, 0);
++		}
+ 	}
+ }
+ 
+@@ -1241,9 +1278,14 @@ static const u16 bcm_sf2_4908_reg_offset
+ 	[REG_SPHY_CNTRL]	= 0x24,
+ 	[REG_CROSSBAR]		= 0xc8,
+ 	[REG_RGMII_11_CNTRL]	= 0x014c,
+-	[REG_LED_0_CNTRL]	= 0x40,
+-	[REG_LED_1_CNTRL]	= 0x4c,
+-	[REG_LED_2_CNTRL]	= 0x58,
++	[REG_LED_0_CNTRL]		= 0x40,
++	[REG_LED_1_CNTRL]		= 0x4c,
++	[REG_LED_2_CNTRL]		= 0x58,
++	[REG_LED_3_CNTRL]		= 0x64,
++	[REG_LED_4_CNTRL]		= 0x88,
++	[REG_LED_5_CNTRL]		= 0xa0,
++	[REG_LED_AGGREGATE_CTRL]	= 0xb8,
++
+ };
+ 
+ static const struct bcm_sf2_of_data bcm_sf2_4908_data = {
+--- a/drivers/net/dsa/bcm_sf2.h
++++ b/drivers/net/dsa/bcm_sf2.h
+@@ -210,6 +210,16 @@ SF2_IO_MACRO(acb);
+ SWITCH_INTR_L2(0);
+ SWITCH_INTR_L2(1);
+ 
++static inline u32 reg_led_readl(struct bcm_sf2_priv *priv, u16 off, u16 reg)
++{
++	return readl_relaxed(priv->reg + priv->reg_offsets[off] + reg);
++}
++
++static inline void reg_led_writel(struct bcm_sf2_priv *priv, u32 val, u16 off, u16 reg)
++{
++	writel_relaxed(val, priv->reg + priv->reg_offsets[off] + reg);
++}
++
+ /* RXNFC */
+ int bcm_sf2_get_rxnfc(struct dsa_switch *ds, int port,
+ 		      struct ethtool_rxnfc *nfc, u32 *rule_locs);
+--- a/drivers/net/dsa/bcm_sf2_regs.h
++++ b/drivers/net/dsa/bcm_sf2_regs.h
+@@ -25,6 +25,10 @@ enum bcm_sf2_reg_offs {
+ 	REG_LED_0_CNTRL,
+ 	REG_LED_1_CNTRL,
+ 	REG_LED_2_CNTRL,
++	REG_LED_3_CNTRL,
++	REG_LED_4_CNTRL,
++	REG_LED_5_CNTRL,
++	REG_LED_AGGREGATE_CTRL,
+ 	REG_SWITCH_REG_MAX,
+ };
+ 
+@@ -56,6 +60,63 @@ enum bcm_sf2_reg_offs {
+ #define CROSSBAR_BCM4908_EXT_GPHY4	1
+ #define CROSSBAR_BCM4908_EXT_RGMII	2
+ 
++/* Relative to REG_LED_*_CNTRL (BCM7278, BCM7445) */
++#define  LED_CNTRL_NO_LINK_ENCODE_SHIFT		0
++#define  LED_CNTRL_M10_ENCODE_SHIFT		2
++#define  LED_CNTRL_M100_ENCODE_SHIFT		4
++#define  LED_CNTRL_M1000_ENCODE_SHIFT		6
++#define  LED_CNTRL_SEL_NO_LINK_ENCODE_SHIFT	8
++#define  LED_CNTRL_SEL_10M_ENCODE_SHIFT		10
++#define  LED_CNTRL_SEL_100M_ENCODE_SHIFT	12
++#define  LED_CNTRL_SEL_1000M_ENCODE_SHIFT	14
++#define  LED_CNTRL_RX_DV_EN			(1 << 16)
++#define  LED_CNTRL_TX_EN_EN			(1 << 17)
++#define  LED_CNTRL_SPDLNK_LED0_ACT_SEL_SHIFT	18
++#define  LED_CNTRL_SPDLNK_LED1_ACT_SEL_SHIFT	20
++#define  LED_CNTRL_ACT_LED_ACT_SEL_SHIFT	22
++#define  LED_CNTRL_SPDLNK_SRC_SEL		(1 << 24)
++#define  LED_CNTRL_SPDLNK_LED0_ACT_POL_SEL	(1 << 25)
++#define  LED_CNTRL_SPDLNK_LED1_ACT_POL_SEL	(1 << 26)
++#define  LED_CNTRL_ACT_LED_POL_SEL		(1 << 27)
++#define  LED_CNTRL_MASK				0x3
++
++/* Register relative to REG_LED_*_CNTRL (BCM4908) */
++#define REG_LED_CTRL				0x0
++#define  LED_CTRL_RX_ACT_EN			0x00000001
++#define  LED_CTRL_TX_ACT_EN			0x00000002
++#define  LED_CTRL_SPDLNK_LED0_ACT_SEL		0x00000004
++#define  LED_CTRL_SPDLNK_LED1_ACT_SEL		0x00000008
++#define  LED_CTRL_SPDLNK_LED2_ACT_SEL		0x00000010
++#define  LED_CTRL_ACT_LED_ACT_SEL		0x00000020
++#define  LED_CTRL_SPDLNK_LED0_ACT_POL_SEL	0x00000040
++#define  LED_CTRL_SPDLNK_LED1_ACT_POL_SEL	0x00000080
++#define  LED_CTRL_SPDLNK_LED2_ACT_POL_SEL	0x00000100
++#define  LED_CTRL_ACT_LED_POL_SEL		0x00000200
++#define  LED_CTRL_LED_SPD_OVRD			0x00001c00
++#define  LED_CTRL_LNK_STATUS_OVRD		0x00002000
++#define  LED_CTRL_SPD_OVRD_EN			0x00004000
++#define  LED_CTRL_LNK_OVRD_EN			0x00008000
++
++/* Register relative to REG_LED_*_CNTRL (BCM4908) */
++#define REG_LED_LINK_SPEED_ENC_SEL		0x4
++#define  LED_LINK_SPEED_ENC_SEL_NO_LINK_SHIFT	0
++#define  LED_LINK_SPEED_ENC_SEL_10M_SHIFT	3
++#define  LED_LINK_SPEED_ENC_SEL_100M_SHIFT	6
++#define  LED_LINK_SPEED_ENC_SEL_1000M_SHIFT	9
++#define  LED_LINK_SPEED_ENC_SEL_2500M_SHIFT	12
++#define  LED_LINK_SPEED_ENC_SEL_10G_SHIFT	15
++#define  LED_LINK_SPEED_ENC_SEL_MASK		0x7
++
++/* Register relative to REG_LED_*_CNTRL (BCM4908) */
++#define REG_LED_LINK_SPEED_ENC			0x8
++#define  LED_LINK_SPEED_ENC_NO_LINK_SHIFT	0
++#define  LED_LINK_SPEED_ENC_M10_SHIFT		3
++#define  LED_LINK_SPEED_ENC_M100_SHIFT		6
++#define  LED_LINK_SPEED_ENC_M1000_SHIFT		9
++#define  LED_LINK_SPEED_ENC_M2500_SHIFT		12
++#define  LED_LINK_SPEED_ENC_M10G_SHIFT		15
++#define  LED_LINK_SPEED_ENC_MASK		0x7
++
+ /* Relative to REG_RGMII_CNTRL */
+ #define  RGMII_MODE_EN			(1 << 0)
+ #define  ID_MODE_DIS			(1 << 1)
+@@ -73,10 +134,6 @@ enum bcm_sf2_reg_offs {
+ #define  LPI_COUNT_SHIFT		9
+ #define  LPI_COUNT_MASK			0x3F
+ 
+-#define REG_LED_CNTRL(x)		(REG_LED_0_CNTRL + (x))
+-
+-#define  SPDLNK_SRC_SEL			(1 << 24)
+-
+ /* Register set relative to 'INTRL2_0' and 'INTRL2_1' */
+ #define INTRL2_CPU_STATUS		0x00
+ #define INTRL2_CPU_SET			0x04
diff --git a/target/linux/bcm4908/patches-5.15/071-v6.1-0001-net-broadcom-bcm4908_enet-handle-EPROBE_DEFER-when-g.patch b/target/linux/bcm4908/patches-5.15/071-v6.1-0001-net-broadcom-bcm4908_enet-handle-EPROBE_DEFER-when-g.patch
new file mode 100644
index 00000000000000..1cf761838c517e
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/071-v6.1-0001-net-broadcom-bcm4908_enet-handle-EPROBE_DEFER-when-g.patch
@@ -0,0 +1,53 @@
+From e93a766da57fff3273bcb618edf5dfca1fb86b89 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 15 Sep 2022 15:30:13 +0200
+Subject: [PATCH] net: broadcom: bcm4908_enet: handle -EPROBE_DEFER when
+ getting MAC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reading MAC from OF may return -EPROBE_DEFER if underlaying NVMEM device
+isn't ready yet. In such case pass that error code up and "wait" to be
+probed later.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20220915133013.2243-1-zajec5@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bcm4908_enet.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bcm4908_enet.c
++++ b/drivers/net/ethernet/broadcom/bcm4908_enet.c
+@@ -720,6 +720,8 @@ static int bcm4908_enet_probe(struct pla
+ 
+ 	SET_NETDEV_DEV(netdev, &pdev->dev);
+ 	err = of_get_mac_address(dev->of_node, netdev->dev_addr);
++	if (err == -EPROBE_DEFER)
++		goto err_dma_free;
+ 	if (err)
+ 		eth_hw_addr_random(netdev);
+ 	netdev->netdev_ops = &bcm4908_enet_netdev_ops;
+@@ -730,14 +732,17 @@ static int bcm4908_enet_probe(struct pla
+ 	netif_napi_add(netdev, &enet->rx_ring.napi, bcm4908_enet_poll_rx, NAPI_POLL_WEIGHT);
+ 
+ 	err = register_netdev(netdev);
+-	if (err) {
+-		bcm4908_enet_dma_free(enet);
+-		return err;
+-	}
++	if (err)
++		goto err_dma_free;
+ 
+ 	platform_set_drvdata(pdev, enet);
+ 
+ 	return 0;
++
++err_dma_free:
++	bcm4908_enet_dma_free(enet);
++
++	return err;
+ }
+ 
+ static int bcm4908_enet_remove(struct platform_device *pdev)
diff --git a/target/linux/bcm4908/patches-5.15/072-v6.2-0001-net-broadcom-bcm4908_enet-use-build_skb.patch b/target/linux/bcm4908/patches-5.15/072-v6.2-0001-net-broadcom-bcm4908_enet-use-build_skb.patch
new file mode 100644
index 00000000000000..1b4cc9e24ccf04
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/072-v6.2-0001-net-broadcom-bcm4908_enet-use-build_skb.patch
@@ -0,0 +1,152 @@
+From 3a1cc23a75abcd9cea585eb84846507363d58397 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 25 Oct 2022 15:22:45 +0200
+Subject: [PATCH] net: broadcom: bcm4908_enet: use build_skb()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RX code can be more efficient with the build_skb(). Allocating actual
+SKB around eth packet buffer - right before passing it up - results in
+a better cache usage.
+
+Without RPS (echo 0 > rps_cpus) BCM4908 NAT masq performance "jumps"
+between two speeds: ~900 Mbps and 940 Mbps (it's a 4 CPUs SoC). This
+change bumps the lower speed from 905 Mb/s to 918 Mb/s (tested using
+single stream iperf 2.0.5 traffic).
+
+There are more optimizations to consider. One obvious to try is GRO
+however as BCM4908 doesn't do hw csum is may actually lower performance.
+Sometimes. Some early testing:
+
+┌─────────────────────────────────┬─────────────────────┬────────────────────┐
+│                                 │ netif_receive_skb() │ napi_gro_receive() │
+├─────────────────────────────────┼─────────────────────┼────────────────────┤
+│ netdev_alloc_skb()              │            905 Mb/s │           892 Mb/s │
+│ napi_alloc_frag() + build_skb() │            918 Mb/s │           917 Mb/s │
+└─────────────────────────────────┴─────────────────────┴────────────────────┘
+
+Another ideas:
+1. napi_build_skb()
+2. skb_copy_from_linear_data() for small packets
+
+Those need proper testing first though. That can be done later.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20221025132245.22871-1-zajec5@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/broadcom/bcm4908_enet.c | 53 +++++++++++++-------
+ 1 file changed, 36 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bcm4908_enet.c
++++ b/drivers/net/ethernet/broadcom/bcm4908_enet.c
+@@ -36,13 +36,24 @@
+ #define ENET_MAX_ETH_OVERHEAD			(ETH_HLEN + BRCM_MAX_TAG_LEN + VLAN_HLEN + \
+ 						 ETH_FCS_LEN + 4) /* 32 */
+ 
++#define ENET_RX_SKB_BUF_SIZE			(NET_SKB_PAD + NET_IP_ALIGN + \
++						 ETH_HLEN + BRCM_MAX_TAG_LEN + VLAN_HLEN + \
++						 ENET_MTU_MAX + ETH_FCS_LEN + 4)
++#define ENET_RX_SKB_BUF_ALLOC_SIZE		(SKB_DATA_ALIGN(ENET_RX_SKB_BUF_SIZE) + \
++						 SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
++#define ENET_RX_BUF_DMA_OFFSET			(NET_SKB_PAD + NET_IP_ALIGN)
++#define ENET_RX_BUF_DMA_SIZE			(ENET_RX_SKB_BUF_SIZE - ENET_RX_BUF_DMA_OFFSET)
++
+ struct bcm4908_enet_dma_ring_bd {
+ 	__le32 ctl;
+ 	__le32 addr;
+ } __packed;
+ 
+ struct bcm4908_enet_dma_ring_slot {
+-	struct sk_buff *skb;
++	union {
++		void *buf;			/* RX */
++		struct sk_buff *skb;		/* TX */
++	};
+ 	unsigned int len;
+ 	dma_addr_t dma_addr;
+ };
+@@ -260,22 +271,21 @@ static int bcm4908_enet_dma_alloc_rx_buf
+ 	u32 tmp;
+ 	int err;
+ 
+-	slot->len = ENET_MTU_MAX + ENET_MAX_ETH_OVERHEAD;
+-
+-	slot->skb = netdev_alloc_skb(enet->netdev, slot->len);
+-	if (!slot->skb)
++	slot->buf = napi_alloc_frag(ENET_RX_SKB_BUF_ALLOC_SIZE);
++	if (!slot->buf)
+ 		return -ENOMEM;
+ 
+-	slot->dma_addr = dma_map_single(dev, slot->skb->data, slot->len, DMA_FROM_DEVICE);
++	slot->dma_addr = dma_map_single(dev, slot->buf + ENET_RX_BUF_DMA_OFFSET,
++					ENET_RX_BUF_DMA_SIZE, DMA_FROM_DEVICE);
+ 	err = dma_mapping_error(dev, slot->dma_addr);
+ 	if (err) {
+ 		dev_err(dev, "Failed to map DMA buffer: %d\n", err);
+-		kfree_skb(slot->skb);
+-		slot->skb = NULL;
++		skb_free_frag(slot->buf);
++		slot->buf = NULL;
+ 		return err;
+ 	}
+ 
+-	tmp = slot->len << DMA_CTL_LEN_DESC_BUFLENGTH_SHIFT;
++	tmp = ENET_RX_BUF_DMA_SIZE << DMA_CTL_LEN_DESC_BUFLENGTH_SHIFT;
+ 	tmp |= DMA_CTL_STATUS_OWN;
+ 	if (idx == enet->rx_ring.length - 1)
+ 		tmp |= DMA_CTL_STATUS_WRAP;
+@@ -315,11 +325,11 @@ static void bcm4908_enet_dma_uninit(stru
+ 
+ 	for (i = rx_ring->length - 1; i >= 0; i--) {
+ 		slot = &rx_ring->slots[i];
+-		if (!slot->skb)
++		if (!slot->buf)
+ 			continue;
+ 		dma_unmap_single(dev, slot->dma_addr, slot->len, DMA_FROM_DEVICE);
+-		kfree_skb(slot->skb);
+-		slot->skb = NULL;
++		skb_free_frag(slot->buf);
++		slot->buf = NULL;
+ 	}
+ }
+ 
+@@ -575,6 +585,7 @@ static int bcm4908_enet_poll_rx(struct n
+ 	while (handled < weight) {
+ 		struct bcm4908_enet_dma_ring_bd *buf_desc;
+ 		struct bcm4908_enet_dma_ring_slot slot;
++		struct sk_buff *skb;
+ 		u32 ctl;
+ 		int len;
+ 		int err;
+@@ -598,16 +609,24 @@ static int bcm4908_enet_poll_rx(struct n
+ 
+ 		if (len < ETH_ZLEN ||
+ 		    (ctl & (DMA_CTL_STATUS_SOP | DMA_CTL_STATUS_EOP)) != (DMA_CTL_STATUS_SOP | DMA_CTL_STATUS_EOP)) {
+-			kfree_skb(slot.skb);
++			skb_free_frag(slot.buf);
+ 			enet->netdev->stats.rx_dropped++;
+ 			break;
+ 		}
+ 
+-		dma_unmap_single(dev, slot.dma_addr, slot.len, DMA_FROM_DEVICE);
++		dma_unmap_single(dev, slot.dma_addr, ENET_RX_BUF_DMA_SIZE, DMA_FROM_DEVICE);
++
++		skb = build_skb(slot.buf, ENET_RX_SKB_BUF_ALLOC_SIZE);
++		if (unlikely(!skb)) {
++			skb_free_frag(slot.buf);
++			enet->netdev->stats.rx_dropped++;
++			break;
++		}
++		skb_reserve(skb, ENET_RX_BUF_DMA_OFFSET);
++		skb_put(skb, len - ETH_FCS_LEN);
++		skb->protocol = eth_type_trans(skb, enet->netdev);
+ 
+-		skb_put(slot.skb, len - ETH_FCS_LEN);
+-		slot.skb->protocol = eth_type_trans(slot.skb, enet->netdev);
+-		netif_receive_skb(slot.skb);
++		netif_receive_skb(skb);
+ 
+ 		enet->netdev->stats.rx_packets++;
+ 		enet->netdev->stats.rx_bytes += len;
diff --git a/target/linux/bcm4908/patches-5.15/072-v6.2-0002-net-broadcom-bcm4908_enet-report-queued-and-transmit.patch b/target/linux/bcm4908/patches-5.15/072-v6.2-0002-net-broadcom-bcm4908_enet-report-queued-and-transmit.patch
new file mode 100644
index 00000000000000..fe85aefa7c0797
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/072-v6.2-0002-net-broadcom-bcm4908_enet-report-queued-and-transmit.patch
@@ -0,0 +1,45 @@
+From 471ef777ec79baadc5cd9773d08f95f49cf5e2b1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 31 Oct 2022 11:48:56 +0100
+Subject: [PATCH] net: broadcom: bcm4908_enet: report queued and transmitted
+ bytes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This allows BQL to operate avoiding buffer bloat and reducing latency.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20221031104856.32388-1-zajec5@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bcm4908_enet.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/bcm4908_enet.c
++++ b/drivers/net/ethernet/broadcom/bcm4908_enet.c
+@@ -505,6 +505,7 @@ static int bcm4908_enet_stop(struct net_
+ 	netif_carrier_off(netdev);
+ 	napi_disable(&rx_ring->napi);
+ 	napi_disable(&tx_ring->napi);
++	netdev_reset_queue(netdev);
+ 
+ 	bcm4908_enet_dma_rx_ring_disable(enet, &enet->rx_ring);
+ 	bcm4908_enet_dma_tx_ring_disable(enet, &enet->tx_ring);
+@@ -564,6 +565,8 @@ static int bcm4908_enet_start_xmit(struc
+ 	if (ring->write_idx + 1 == ring->length - 1)
+ 		tmp |= DMA_CTL_STATUS_WRAP;
+ 
++	netdev_sent_queue(enet->netdev, skb->len);
++
+ 	buf_desc->addr = cpu_to_le32((uint32_t)slot->dma_addr);
+ 	buf_desc->ctl = cpu_to_le32(tmp);
+ 
+@@ -671,6 +674,7 @@ static int bcm4908_enet_poll_tx(struct n
+ 			tx_ring->read_idx = 0;
+ 	}
+ 
++	netdev_completed_queue(enet->netdev, handled, bytes);
+ 	enet->netdev->stats.tx_packets += handled;
+ 	enet->netdev->stats.tx_bytes += bytes;
+ 
diff --git a/target/linux/bcm4908/patches-5.15/080-v5.18-0001-dt-bindings-pinctrl-Add-binding-for-BCM4908-pinctrl.patch b/target/linux/bcm4908/patches-5.15/080-v5.18-0001-dt-bindings-pinctrl-Add-binding-for-BCM4908-pinctrl.patch
new file mode 100644
index 00000000000000..adc7d6bb0c5cdc
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/080-v5.18-0001-dt-bindings-pinctrl-Add-binding-for-BCM4908-pinctrl.patch
@@ -0,0 +1,111 @@
+From 7b5730f0ff24b0d7d1cb660a482384a807618a46 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 24 Jan 2022 11:22:42 +0100
+Subject: [PATCH] dt-bindings: pinctrl: Add binding for BCM4908 pinctrl
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+It's hardware block that is part of every SoC from BCM4908 family.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20220124102243.14912-1-zajec5@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+---
+ .../pinctrl/brcm,bcm4908-pinctrl.yaml         | 72 +++++++++++++++++++
+ MAINTAINERS                                   |  7 ++
+ 2 files changed, 79 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/pinctrl/brcm,bcm4908-pinctrl.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/pinctrl/brcm,bcm4908-pinctrl.yaml
+@@ -0,0 +1,72 @@
++# SPDX-License-Identifier: GPL-2.0-only OR BSD-2-Clause
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/pinctrl/brcm,bcm4908-pinctrl.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Broadcom BCM4908 pin controller
++
++maintainers:
++  - Rafał Miłecki <rafal@milecki.pl>
++
++description:
++  Binding for pin controller present on BCM4908 family SoCs.
++
++properties:
++  compatible:
++    const: brcm,bcm4908-pinctrl
++
++  reg:
++    maxItems: 1
++
++patternProperties:
++  '-pins$':
++    type: object
++    $ref: pinmux-node.yaml#
++
++    properties:
++      function:
++        enum: [ led_0, led_1, led_2, led_3, led_4, led_5, led_6, led_7, led_8,
++                led_9, led_10, led_11, led_12, led_13, led_14, led_15, led_16,
++                led_17, led_18, led_19, led_20, led_21, led_22, led_23, led_24,
++                led_25, led_26, led_27, led_28, led_29, led_30, led_31,
++                hs_uart, i2c, i2s, nand_ctrl, nand_data, emmc_ctrl, usb0_pwr,
++                usb1_pwr ]
++
++      groups:
++        minItems: 1
++        maxItems: 2
++        items:
++          enum: [ led_0_grp_a, led_1_grp_a, led_2_grp_a, led_3_grp_a,
++                  led_4_grp_a, led_5_grp_a, led_6_grp_a, led_7_grp_a,
++                  led_8_grp_a, led_9_grp_a, led_10_grp_a, led_10_grp_b,
++                  led_11_grp_a, led_11_grp_b, led_12_grp_a, led_12_grp_b,
++                  led_13_grp_a, led_13_grp_b, led_14_grp_a, led_15_grp_a,
++                  led_16_grp_a, led_17_grp_a, led_18_grp_a, led_19_grp_a,
++                  led_20_grp_a, led_21_grp_a, led_22_grp_a, led_23_grp_a,
++                  led_24_grp_a, led_25_grp_a, led_26_grp_a, led_27_grp_a,
++                  led_28_grp_a, led_29_grp_a, led_30_grp_a, led_31_grp_a,
++                  led_31_grp_b, hs_uart_grp, i2c_grp_a, i2c_grp_b, i2s_grp,
++                  nand_ctrl_grp, nand_data_grp, emmc_ctrl_grp, usb0_pwr_grp,
++                  usb1_pwr_grp ]
++
++allOf:
++  - $ref: pinctrl.yaml#
++
++required:
++  - compatible
++  - reg
++
++unevaluatedProperties: false
++
++examples:
++  - |
++    pinctrl@ff800560 {
++        compatible = "brcm,bcm4908-pinctrl";
++        reg = <0xff800560 0x10>;
++
++        led_0-a-pins {
++            function = "led_0";
++            groups = "led_0_grp_a";
++        };
++    };
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -3573,6 +3573,13 @@ F:	Documentation/devicetree/bindings/net
+ F:	drivers/net/ethernet/broadcom/bcm4908_enet.*
+ F:	drivers/net/ethernet/broadcom/unimac.h
+ 
++BROADCOM BCM4908 PINMUX DRIVER
++M:	Rafał Miłecki <rafal@milecki.pl>
++M:	bcm-kernel-feedback-list@broadcom.com
++L:	linux-gpio@vger.kernel.org
++S:	Maintained
++F:	Documentation/devicetree/bindings/pinctrl/brcm,bcm4908-pinctrl.yaml
++
+ BROADCOM BCM5301X ARM ARCHITECTURE
+ M:	Hauke Mehrtens <hauke@hauke-m.de>
+ M:	Rafał Miłecki <zajec5@gmail.com>
diff --git a/target/linux/bcm4908/patches-5.15/080-v5.18-0002-pinctrl-bcm-add-driver-for-BCM4908-pinmux.patch b/target/linux/bcm4908/patches-5.15/080-v5.18-0002-pinctrl-bcm-add-driver-for-BCM4908-pinmux.patch
new file mode 100644
index 00000000000000..3fd847b97e2bf8
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/080-v5.18-0002-pinctrl-bcm-add-driver-for-BCM4908-pinmux.patch
@@ -0,0 +1,629 @@
+From f7e322d99f1180270fb4a3e1ae992b3116cfcf34 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 24 Jan 2022 11:22:43 +0100
+Subject: [PATCH] pinctrl: bcm: add driver for BCM4908 pinmux
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+BCM4908 has its own pins layout so it needs a custom binding and a Linux
+driver.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/20220124102243.14912-2-zajec5@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+---
+ MAINTAINERS                           |   1 +
+ drivers/pinctrl/bcm/Kconfig           |  14 +
+ drivers/pinctrl/bcm/Makefile          |   1 +
+ drivers/pinctrl/bcm/pinctrl-bcm4908.c | 563 ++++++++++++++++++++++++++
+ 4 files changed, 579 insertions(+)
+ create mode 100644 drivers/pinctrl/bcm/pinctrl-bcm4908.c
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -3579,6 +3579,7 @@ M:	bcm-kernel-feedback-list@broadcom.com
+ L:	linux-gpio@vger.kernel.org
+ S:	Maintained
+ F:	Documentation/devicetree/bindings/pinctrl/brcm,bcm4908-pinctrl.yaml
++F:	drivers/pinctrl/bcm/pinctrl-bcm4908.c
+ 
+ BROADCOM BCM5301X ARM ARCHITECTURE
+ M:	Hauke Mehrtens <hauke@hauke-m.de>
+--- a/drivers/pinctrl/bcm/Kconfig
++++ b/drivers/pinctrl/bcm/Kconfig
+@@ -29,6 +29,20 @@ config PINCTRL_BCM2835
+ 	help
+ 	   Say Y here to enable the Broadcom BCM2835 GPIO driver.
+ 
++config PINCTRL_BCM4908
++	tristate "Broadcom BCM4908 pinmux driver"
++	depends on OF && (ARCH_BCM4908 || COMPILE_TEST)
++	select PINMUX
++	select PINCONF
++	select GENERIC_PINCONF
++	select GENERIC_PINCTRL_GROUPS
++	select GENERIC_PINMUX_FUNCTIONS
++	default ARCH_BCM4908
++	help
++	  Driver for BCM4908 family SoCs with integrated pin controller.
++
++	  If compiled as module it will be called pinctrl-bcm4908.
++
+ config PINCTRL_BCM63XX
+ 	bool
+ 	select PINMUX
+--- a/drivers/pinctrl/bcm/Makefile
++++ b/drivers/pinctrl/bcm/Makefile
+@@ -3,6 +3,7 @@
+ 
+ obj-$(CONFIG_PINCTRL_BCM281XX)		+= pinctrl-bcm281xx.o
+ obj-$(CONFIG_PINCTRL_BCM2835)		+= pinctrl-bcm2835.o
++obj-$(CONFIG_PINCTRL_BCM4908)		+= pinctrl-bcm4908.o
+ obj-$(CONFIG_PINCTRL_BCM63XX)		+= pinctrl-bcm63xx.o
+ obj-$(CONFIG_PINCTRL_BCM6318)		+= pinctrl-bcm6318.o
+ obj-$(CONFIG_PINCTRL_BCM6328)		+= pinctrl-bcm6328.o
+--- /dev/null
++++ b/drivers/pinctrl/bcm/pinctrl-bcm4908.c
+@@ -0,0 +1,560 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Copyright (C) 2021 Rafał Miłecki <rafal@milecki.pl> */
++
++#include <linux/err.h>
++#include <linux/io.h>
++#include <linux/mod_devicetable.h>
++#include <linux/module.h>
++#include <linux/pinctrl/pinconf-generic.h>
++#include <linux/pinctrl/pinctrl.h>
++#include <linux/pinctrl/pinmux.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++#include <linux/string_helpers.h>
++
++#include "../core.h"
++#include "../pinmux.h"
++
++#define BCM4908_NUM_PINS			86
++
++#define BCM4908_TEST_PORT_BLOCK_EN_LSB			0x00
++#define BCM4908_TEST_PORT_BLOCK_DATA_MSB		0x04
++#define BCM4908_TEST_PORT_BLOCK_DATA_LSB		0x08
++#define  BCM4908_TEST_PORT_LSB_PINMUX_DATA_SHIFT	12
++#define BCM4908_TEST_PORT_COMMAND			0x0c
++#define  BCM4908_TEST_PORT_CMD_LOAD_MUX_REG		0x00000021
++
++struct bcm4908_pinctrl {
++	struct device *dev;
++	void __iomem *base;
++	struct mutex mutex;
++	struct pinctrl_dev *pctldev;
++	struct pinctrl_desc pctldesc;
++};
++
++/*
++ * Groups
++ */
++
++struct bcm4908_pinctrl_pin_setup {
++	unsigned int number;
++	unsigned int function;
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_0_pins_a[] = {
++	{ 0, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_1_pins_a[] = {
++	{ 1, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_2_pins_a[] = {
++	{ 2, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_3_pins_a[] = {
++	{ 3, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_4_pins_a[] = {
++	{ 4, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_5_pins_a[] = {
++	{ 5, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_6_pins_a[] = {
++	{ 6, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_7_pins_a[] = {
++	{ 7, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_8_pins_a[] = {
++	{ 8, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_9_pins_a[] = {
++	{ 9, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_10_pins_a[] = {
++	{ 10, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_11_pins_a[] = {
++	{ 11, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_12_pins_a[] = {
++	{ 12, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_13_pins_a[] = {
++	{ 13, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_14_pins_a[] = {
++	{ 14, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_15_pins_a[] = {
++	{ 15, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_16_pins_a[] = {
++	{ 16, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_17_pins_a[] = {
++	{ 17, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_18_pins_a[] = {
++	{ 18, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_19_pins_a[] = {
++	{ 19, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_20_pins_a[] = {
++	{ 20, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_21_pins_a[] = {
++	{ 21, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_22_pins_a[] = {
++	{ 22, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_23_pins_a[] = {
++	{ 23, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_24_pins_a[] = {
++	{ 24, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_25_pins_a[] = {
++	{ 25, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_26_pins_a[] = {
++	{ 26, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_27_pins_a[] = {
++	{ 27, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_28_pins_a[] = {
++	{ 28, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_29_pins_a[] = {
++	{ 29, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_30_pins_a[] = {
++	{ 30, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_31_pins_a[] = {
++	{ 31, 3 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_10_pins_b[] = {
++	{ 8, 2 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_11_pins_b[] = {
++	{ 9, 2 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_12_pins_b[] = {
++	{ 0, 2 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_13_pins_b[] = {
++	{ 1, 2 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup led_31_pins_b[] = {
++	{ 30, 2 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup hs_uart_pins[] = {
++	{ 10, 0 },	/* CTS */
++	{ 11, 0 },	/* RTS */
++	{ 12, 0 },	/* RXD */
++	{ 13, 0 },	/* TXD */
++};
++
++static const struct bcm4908_pinctrl_pin_setup i2c_pins_a[] = {
++	{ 18, 0 },	/* SDA */
++	{ 19, 0 },	/* SCL */
++};
++
++static const struct bcm4908_pinctrl_pin_setup i2c_pins_b[] = {
++	{ 22, 0 },	/* SDA */
++	{ 23, 0 },	/* SCL */
++};
++
++static const struct bcm4908_pinctrl_pin_setup i2s_pins[] = {
++	{ 27, 0 },	/* MCLK */
++	{ 28, 0 },	/* LRCK */
++	{ 29, 0 },	/* SDATA */
++	{ 30, 0 },	/* SCLK */
++};
++
++static const struct bcm4908_pinctrl_pin_setup nand_ctrl_pins[] = {
++	{ 32, 0 },
++	{ 33, 0 },
++	{ 34, 0 },
++	{ 43, 0 },
++	{ 44, 0 },
++	{ 45, 0 },
++	{ 56, 1 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup nand_data_pins[] = {
++	{ 35, 0 },
++	{ 36, 0 },
++	{ 37, 0 },
++	{ 38, 0 },
++	{ 39, 0 },
++	{ 40, 0 },
++	{ 41, 0 },
++	{ 42, 0 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup emmc_ctrl_pins[] = {
++	{ 46, 0 },
++	{ 47, 0 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup usb0_pwr_pins[] = {
++	{ 63, 0 },
++	{ 64, 0 },
++};
++
++static const struct bcm4908_pinctrl_pin_setup usb1_pwr_pins[] = {
++	{ 66, 0 },
++	{ 67, 0 },
++};
++
++struct bcm4908_pinctrl_grp {
++	const char *name;
++	const struct bcm4908_pinctrl_pin_setup *pins;
++	const unsigned int num_pins;
++};
++
++static const struct bcm4908_pinctrl_grp bcm4908_pinctrl_grps[] = {
++	{ "led_0_grp_a", led_0_pins_a, ARRAY_SIZE(led_0_pins_a) },
++	{ "led_1_grp_a", led_1_pins_a, ARRAY_SIZE(led_1_pins_a) },
++	{ "led_2_grp_a", led_2_pins_a, ARRAY_SIZE(led_2_pins_a) },
++	{ "led_3_grp_a", led_3_pins_a, ARRAY_SIZE(led_3_pins_a) },
++	{ "led_4_grp_a", led_4_pins_a, ARRAY_SIZE(led_4_pins_a) },
++	{ "led_5_grp_a", led_5_pins_a, ARRAY_SIZE(led_5_pins_a) },
++	{ "led_6_grp_a", led_6_pins_a, ARRAY_SIZE(led_6_pins_a) },
++	{ "led_7_grp_a", led_7_pins_a, ARRAY_SIZE(led_7_pins_a) },
++	{ "led_8_grp_a", led_8_pins_a, ARRAY_SIZE(led_8_pins_a) },
++	{ "led_9_grp_a", led_9_pins_a, ARRAY_SIZE(led_9_pins_a) },
++	{ "led_10_grp_a", led_10_pins_a, ARRAY_SIZE(led_10_pins_a) },
++	{ "led_11_grp_a", led_11_pins_a, ARRAY_SIZE(led_11_pins_a) },
++	{ "led_12_grp_a", led_12_pins_a, ARRAY_SIZE(led_12_pins_a) },
++	{ "led_13_grp_a", led_13_pins_a, ARRAY_SIZE(led_13_pins_a) },
++	{ "led_14_grp_a", led_14_pins_a, ARRAY_SIZE(led_14_pins_a) },
++	{ "led_15_grp_a", led_15_pins_a, ARRAY_SIZE(led_15_pins_a) },
++	{ "led_16_grp_a", led_16_pins_a, ARRAY_SIZE(led_16_pins_a) },
++	{ "led_17_grp_a", led_17_pins_a, ARRAY_SIZE(led_17_pins_a) },
++	{ "led_18_grp_a", led_18_pins_a, ARRAY_SIZE(led_18_pins_a) },
++	{ "led_19_grp_a", led_19_pins_a, ARRAY_SIZE(led_19_pins_a) },
++	{ "led_20_grp_a", led_20_pins_a, ARRAY_SIZE(led_20_pins_a) },
++	{ "led_21_grp_a", led_21_pins_a, ARRAY_SIZE(led_21_pins_a) },
++	{ "led_22_grp_a", led_22_pins_a, ARRAY_SIZE(led_22_pins_a) },
++	{ "led_23_grp_a", led_23_pins_a, ARRAY_SIZE(led_23_pins_a) },
++	{ "led_24_grp_a", led_24_pins_a, ARRAY_SIZE(led_24_pins_a) },
++	{ "led_25_grp_a", led_25_pins_a, ARRAY_SIZE(led_25_pins_a) },
++	{ "led_26_grp_a", led_26_pins_a, ARRAY_SIZE(led_26_pins_a) },
++	{ "led_27_grp_a", led_27_pins_a, ARRAY_SIZE(led_27_pins_a) },
++	{ "led_28_grp_a", led_28_pins_a, ARRAY_SIZE(led_28_pins_a) },
++	{ "led_29_grp_a", led_29_pins_a, ARRAY_SIZE(led_29_pins_a) },
++	{ "led_30_grp_a", led_30_pins_a, ARRAY_SIZE(led_30_pins_a) },
++	{ "led_31_grp_a", led_31_pins_a, ARRAY_SIZE(led_31_pins_a) },
++	{ "led_10_grp_b", led_10_pins_b, ARRAY_SIZE(led_10_pins_b) },
++	{ "led_11_grp_b", led_11_pins_b, ARRAY_SIZE(led_11_pins_b) },
++	{ "led_12_grp_b", led_12_pins_b, ARRAY_SIZE(led_12_pins_b) },
++	{ "led_13_grp_b", led_13_pins_b, ARRAY_SIZE(led_13_pins_b) },
++	{ "led_31_grp_b", led_31_pins_b, ARRAY_SIZE(led_31_pins_b) },
++	{ "hs_uart_grp", hs_uart_pins, ARRAY_SIZE(hs_uart_pins) },
++	{ "i2c_grp_a", i2c_pins_a, ARRAY_SIZE(i2c_pins_a) },
++	{ "i2c_grp_b", i2c_pins_b, ARRAY_SIZE(i2c_pins_b) },
++	{ "i2s_grp", i2s_pins, ARRAY_SIZE(i2s_pins) },
++	{ "nand_ctrl_grp", nand_ctrl_pins, ARRAY_SIZE(nand_ctrl_pins) },
++	{ "nand_data_grp", nand_data_pins, ARRAY_SIZE(nand_data_pins) },
++	{ "emmc_ctrl_grp", emmc_ctrl_pins, ARRAY_SIZE(emmc_ctrl_pins) },
++	{ "usb0_pwr_grp", usb0_pwr_pins, ARRAY_SIZE(usb0_pwr_pins) },
++	{ "usb1_pwr_grp", usb1_pwr_pins, ARRAY_SIZE(usb1_pwr_pins) },
++};
++
++/*
++ * Functions
++ */
++
++struct bcm4908_pinctrl_function {
++	const char *name;
++	const char **groups;
++	const unsigned int num_groups;
++};
++
++static const char *led_0_groups[] = { "led_0_grp_a" };
++static const char *led_1_groups[] = { "led_1_grp_a" };
++static const char *led_2_groups[] = { "led_2_grp_a" };
++static const char *led_3_groups[] = { "led_3_grp_a" };
++static const char *led_4_groups[] = { "led_4_grp_a" };
++static const char *led_5_groups[] = { "led_5_grp_a" };
++static const char *led_6_groups[] = { "led_6_grp_a" };
++static const char *led_7_groups[] = { "led_7_grp_a" };
++static const char *led_8_groups[] = { "led_8_grp_a" };
++static const char *led_9_groups[] = { "led_9_grp_a" };
++static const char *led_10_groups[] = { "led_10_grp_a", "led_10_grp_b" };
++static const char *led_11_groups[] = { "led_11_grp_a", "led_11_grp_b" };
++static const char *led_12_groups[] = { "led_12_grp_a", "led_12_grp_b" };
++static const char *led_13_groups[] = { "led_13_grp_a", "led_13_grp_b" };
++static const char *led_14_groups[] = { "led_14_grp_a" };
++static const char *led_15_groups[] = { "led_15_grp_a" };
++static const char *led_16_groups[] = { "led_16_grp_a" };
++static const char *led_17_groups[] = { "led_17_grp_a" };
++static const char *led_18_groups[] = { "led_18_grp_a" };
++static const char *led_19_groups[] = { "led_19_grp_a" };
++static const char *led_20_groups[] = { "led_20_grp_a" };
++static const char *led_21_groups[] = { "led_21_grp_a" };
++static const char *led_22_groups[] = { "led_22_grp_a" };
++static const char *led_23_groups[] = { "led_23_grp_a" };
++static const char *led_24_groups[] = { "led_24_grp_a" };
++static const char *led_25_groups[] = { "led_25_grp_a" };
++static const char *led_26_groups[] = { "led_26_grp_a" };
++static const char *led_27_groups[] = { "led_27_grp_a" };
++static const char *led_28_groups[] = { "led_28_grp_a" };
++static const char *led_29_groups[] = { "led_29_grp_a" };
++static const char *led_30_groups[] = { "led_30_grp_a" };
++static const char *led_31_groups[] = { "led_31_grp_a", "led_31_grp_b" };
++static const char *hs_uart_groups[] = { "hs_uart_grp" };
++static const char *i2c_groups[] = { "i2c_grp_a", "i2c_grp_b" };
++static const char *i2s_groups[] = { "i2s_grp" };
++static const char *nand_ctrl_groups[] = { "nand_ctrl_grp" };
++static const char *nand_data_groups[] = { "nand_data_grp" };
++static const char *emmc_ctrl_groups[] = { "emmc_ctrl_grp" };
++static const char *usb0_pwr_groups[] = { "usb0_pwr_grp" };
++static const char *usb1_pwr_groups[] = { "usb1_pwr_grp" };
++
++static const struct bcm4908_pinctrl_function bcm4908_pinctrl_functions[] = {
++	{ "led_0", led_0_groups, ARRAY_SIZE(led_0_groups) },
++	{ "led_1", led_1_groups, ARRAY_SIZE(led_1_groups) },
++	{ "led_2", led_2_groups, ARRAY_SIZE(led_2_groups) },
++	{ "led_3", led_3_groups, ARRAY_SIZE(led_3_groups) },
++	{ "led_4", led_4_groups, ARRAY_SIZE(led_4_groups) },
++	{ "led_5", led_5_groups, ARRAY_SIZE(led_5_groups) },
++	{ "led_6", led_6_groups, ARRAY_SIZE(led_6_groups) },
++	{ "led_7", led_7_groups, ARRAY_SIZE(led_7_groups) },
++	{ "led_8", led_8_groups, ARRAY_SIZE(led_8_groups) },
++	{ "led_9", led_9_groups, ARRAY_SIZE(led_9_groups) },
++	{ "led_10", led_10_groups, ARRAY_SIZE(led_10_groups) },
++	{ "led_11", led_11_groups, ARRAY_SIZE(led_11_groups) },
++	{ "led_12", led_12_groups, ARRAY_SIZE(led_12_groups) },
++	{ "led_13", led_13_groups, ARRAY_SIZE(led_13_groups) },
++	{ "led_14", led_14_groups, ARRAY_SIZE(led_14_groups) },
++	{ "led_15", led_15_groups, ARRAY_SIZE(led_15_groups) },
++	{ "led_16", led_16_groups, ARRAY_SIZE(led_16_groups) },
++	{ "led_17", led_17_groups, ARRAY_SIZE(led_17_groups) },
++	{ "led_18", led_18_groups, ARRAY_SIZE(led_18_groups) },
++	{ "led_19", led_19_groups, ARRAY_SIZE(led_19_groups) },
++	{ "led_20", led_20_groups, ARRAY_SIZE(led_20_groups) },
++	{ "led_21", led_21_groups, ARRAY_SIZE(led_21_groups) },
++	{ "led_22", led_22_groups, ARRAY_SIZE(led_22_groups) },
++	{ "led_23", led_23_groups, ARRAY_SIZE(led_23_groups) },
++	{ "led_24", led_24_groups, ARRAY_SIZE(led_24_groups) },
++	{ "led_25", led_25_groups, ARRAY_SIZE(led_25_groups) },
++	{ "led_26", led_26_groups, ARRAY_SIZE(led_26_groups) },
++	{ "led_27", led_27_groups, ARRAY_SIZE(led_27_groups) },
++	{ "led_28", led_28_groups, ARRAY_SIZE(led_28_groups) },
++	{ "led_29", led_29_groups, ARRAY_SIZE(led_29_groups) },
++	{ "led_30", led_30_groups, ARRAY_SIZE(led_30_groups) },
++	{ "led_31", led_31_groups, ARRAY_SIZE(led_31_groups) },
++	{ "hs_uart", hs_uart_groups, ARRAY_SIZE(hs_uart_groups) },
++	{ "i2c", i2c_groups, ARRAY_SIZE(i2c_groups) },
++	{ "i2s", i2s_groups, ARRAY_SIZE(i2s_groups) },
++	{ "nand_ctrl", nand_ctrl_groups, ARRAY_SIZE(nand_ctrl_groups) },
++	{ "nand_data", nand_data_groups, ARRAY_SIZE(nand_data_groups) },
++	{ "emmc_ctrl", emmc_ctrl_groups, ARRAY_SIZE(emmc_ctrl_groups) },
++	{ "usb0_pwr", usb0_pwr_groups, ARRAY_SIZE(usb0_pwr_groups) },
++	{ "usb1_pwr", usb1_pwr_groups, ARRAY_SIZE(usb1_pwr_groups) },
++};
++
++/*
++ * Groups code
++ */
++
++static const struct pinctrl_ops bcm4908_pinctrl_ops = {
++	.get_groups_count = pinctrl_generic_get_group_count,
++	.get_group_name = pinctrl_generic_get_group_name,
++	.get_group_pins = pinctrl_generic_get_group_pins,
++	.dt_node_to_map = pinconf_generic_dt_node_to_map_group,
++	.dt_free_map = pinconf_generic_dt_free_map,
++};
++
++/*
++ * Functions code
++ */
++
++static int bcm4908_pinctrl_set_mux(struct pinctrl_dev *pctrl_dev,
++			      unsigned int func_selector,
++			      unsigned int group_selector)
++{
++	struct bcm4908_pinctrl *bcm4908_pinctrl = pinctrl_dev_get_drvdata(pctrl_dev);
++	const struct bcm4908_pinctrl_grp *group;
++	struct group_desc *group_desc;
++	int i;
++
++	group_desc = pinctrl_generic_get_group(pctrl_dev, group_selector);
++	if (!group_desc)
++		return -EINVAL;
++	group = group_desc->data;
++
++	mutex_lock(&bcm4908_pinctrl->mutex);
++	for (i = 0; i < group->num_pins; i++) {
++		u32 lsb = 0;
++
++		lsb |= group->pins[i].number;
++		lsb |= group->pins[i].function << BCM4908_TEST_PORT_LSB_PINMUX_DATA_SHIFT;
++
++		writel(0x0, bcm4908_pinctrl->base + BCM4908_TEST_PORT_BLOCK_DATA_MSB);
++		writel(lsb, bcm4908_pinctrl->base + BCM4908_TEST_PORT_BLOCK_DATA_LSB);
++		writel(BCM4908_TEST_PORT_CMD_LOAD_MUX_REG,
++		       bcm4908_pinctrl->base + BCM4908_TEST_PORT_COMMAND);
++	}
++	mutex_unlock(&bcm4908_pinctrl->mutex);
++
++	return 0;
++}
++
++static const struct pinmux_ops bcm4908_pinctrl_pmxops = {
++	.get_functions_count = pinmux_generic_get_function_count,
++	.get_function_name = pinmux_generic_get_function_name,
++	.get_function_groups = pinmux_generic_get_function_groups,
++	.set_mux = bcm4908_pinctrl_set_mux,
++};
++
++/*
++ * Controller code
++ */
++
++static struct pinctrl_desc bcm4908_pinctrl_desc = {
++	.name = "bcm4908-pinctrl",
++	.pctlops = &bcm4908_pinctrl_ops,
++	.pmxops = &bcm4908_pinctrl_pmxops,
++};
++
++static const struct of_device_id bcm4908_pinctrl_of_match_table[] = {
++	{ .compatible = "brcm,bcm4908-pinctrl", },
++	{ }
++};
++
++static int bcm4908_pinctrl_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct bcm4908_pinctrl *bcm4908_pinctrl;
++	struct pinctrl_desc *pctldesc;
++	struct pinctrl_pin_desc *pins;
++	int i;
++
++	bcm4908_pinctrl = devm_kzalloc(dev, sizeof(*bcm4908_pinctrl), GFP_KERNEL);
++	if (!bcm4908_pinctrl)
++		return -ENOMEM;
++	pctldesc = &bcm4908_pinctrl->pctldesc;
++	platform_set_drvdata(pdev, bcm4908_pinctrl);
++
++	/* Set basic properties */
++
++	bcm4908_pinctrl->dev = dev;
++
++	bcm4908_pinctrl->base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(bcm4908_pinctrl->base))
++		return PTR_ERR(bcm4908_pinctrl->base);
++
++	mutex_init(&bcm4908_pinctrl->mutex);
++
++	memcpy(pctldesc, &bcm4908_pinctrl_desc, sizeof(*pctldesc));
++
++	/* Set pinctrl properties */
++
++	pins = devm_kcalloc(dev, BCM4908_NUM_PINS, sizeof(*pins), GFP_KERNEL);
++	if (!pins)
++		return -ENOMEM;
++	for (i = 0; i < BCM4908_NUM_PINS; i++) {
++		pins[i].number = i;
++		pins[i].name = devm_kasprintf(dev, GFP_KERNEL, "pin-%d", i);
++		if (!pins[i].name)
++			return -ENOMEM;
++	}
++	pctldesc->pins = pins;
++	pctldesc->npins = BCM4908_NUM_PINS;
++
++	/* Register */
++
++	bcm4908_pinctrl->pctldev = devm_pinctrl_register(dev, pctldesc, bcm4908_pinctrl);
++	if (IS_ERR(bcm4908_pinctrl->pctldev))
++		return dev_err_probe(dev, PTR_ERR(bcm4908_pinctrl->pctldev),
++				     "Failed to register pinctrl\n");
++
++	/* Groups */
++
++	for (i = 0; i < ARRAY_SIZE(bcm4908_pinctrl_grps); i++) {
++		const struct bcm4908_pinctrl_grp *group = &bcm4908_pinctrl_grps[i];
++		int *pins;
++		int j;
++
++		pins = devm_kcalloc(dev, group->num_pins, sizeof(*pins), GFP_KERNEL);
++		if (!pins)
++			return -ENOMEM;
++		for (j = 0; j < group->num_pins; j++)
++			pins[j] = group->pins[j].number;
++
++		pinctrl_generic_add_group(bcm4908_pinctrl->pctldev, group->name,
++					  pins, group->num_pins, (void *)group);
++	}
++
++	/* Functions */
++
++	for (i = 0; i < ARRAY_SIZE(bcm4908_pinctrl_functions); i++) {
++		const struct bcm4908_pinctrl_function *function = &bcm4908_pinctrl_functions[i];
++
++		pinmux_generic_add_function(bcm4908_pinctrl->pctldev,
++					    function->name,
++					    function->groups,
++					    function->num_groups, NULL);
++	}
++
++	return 0;
++}
++
++static struct platform_driver bcm4908_pinctrl_driver = {
++	.probe = bcm4908_pinctrl_probe,
++	.driver = {
++		.name = "bcm4908-pinctrl",
++		.of_match_table = bcm4908_pinctrl_of_match_table,
++	},
++};
++
++module_platform_driver(bcm4908_pinctrl_driver);
++
++MODULE_AUTHOR("Rafał Miłecki");
++MODULE_LICENSE("GPL v2");
++MODULE_DEVICE_TABLE(of, bcm4908_pinctrl_of_match_table);
diff --git a/target/linux/bcm4908/patches-5.15/081-v5.18-0001-i2c-brcmstb-allow-compiling-on-BCM4908.patch b/target/linux/bcm4908/patches-5.15/081-v5.18-0001-i2c-brcmstb-allow-compiling-on-BCM4908.patch
new file mode 100644
index 00000000000000..246f2494131cf4
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/081-v5.18-0001-i2c-brcmstb-allow-compiling-on-BCM4908.patch
@@ -0,0 +1,30 @@
+From d0aee048d648ec2d9aa7af43b127ebf847d497d5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 11 Feb 2022 11:58:06 +0100
+Subject: [PATCH] i2c: brcmstb: allow compiling on BCM4908
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+BCM4908 SoCs use the same I2C hardware block as STB and BCM63xx devices.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+---
+ drivers/i2c/busses/Kconfig | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -477,8 +477,8 @@ config I2C_BCM_KONA
+ 
+ config I2C_BRCMSTB
+ 	tristate "BRCM Settop/DSL I2C controller"
+-	depends on ARCH_BCM2835 || ARCH_BRCMSTB || BMIPS_GENERIC || \
+-		   ARCH_BCM_63XX || COMPILE_TEST
++	depends on ARCH_BCM2835 || ARCH_BCM4908 || ARCH_BCM_63XX || \
++		   ARCH_BRCMSTB || BMIPS_GENERIC || COMPILE_TEST
+ 	default y
+ 	help
+ 	  If you say yes to this option, support will be included for the
diff --git a/target/linux/bcm4908/patches-5.15/082-v5.18-watchdog-allow-building-BCM7038_WDT-for-BCM4908.patch b/target/linux/bcm4908/patches-5.15/082-v5.18-watchdog-allow-building-BCM7038_WDT-for-BCM4908.patch
new file mode 100644
index 00000000000000..0717436ffa39f0
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/082-v5.18-watchdog-allow-building-BCM7038_WDT-for-BCM4908.patch
@@ -0,0 +1,32 @@
+From cd91fb2776967b2b2dea27307a3f23ba3d9bbb32 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 9 Feb 2022 21:32:02 +0100
+Subject: [PATCH] watchdog: allow building BCM7038_WDT for BCM4908
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+BCM4908 is a SoCs family that shares a lot of hardware with BCM63xx
+including the watchdog block. Allow building this driver for it.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20220209203202.26395-1-zajec5@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+---
+ drivers/watchdog/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/watchdog/Kconfig
++++ b/drivers/watchdog/Kconfig
+@@ -1756,7 +1756,7 @@ config BCM7038_WDT
+ 	tristate "BCM7038 Watchdog"
+ 	select WATCHDOG_CORE
+ 	depends on HAS_IOMEM
+-	depends on ARCH_BRCMSTB || BMIPS_GENERIC || COMPILE_TEST
++	depends on ARCH_BCM4908 || ARCH_BRCMSTB || BMIPS_GENERIC || COMPILE_TEST
+ 	help
+ 	 Watchdog driver for the built-in hardware in Broadcom 7038 and
+ 	 later SoCs used in set-top boxes.  BCM7038 was made public
diff --git a/target/linux/bcm4908/patches-5.15/083-v5.20-watchdog-bcm7038_wdt-Support-BCM6345-compatible-stri.patch b/target/linux/bcm4908/patches-5.15/083-v5.20-watchdog-bcm7038_wdt-Support-BCM6345-compatible-stri.patch
new file mode 100644
index 00000000000000..14b6c61bac7e58
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/083-v5.20-watchdog-bcm7038_wdt-Support-BCM6345-compatible-stri.patch
@@ -0,0 +1,34 @@
+From 2dd441f16d6ad6104d85c4e5dfeb6dde4df26869 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 16 Feb 2022 07:34:08 +0100
+Subject: [PATCH] watchdog: bcm7038_wdt: Support BCM6345 compatible string
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+A new "compatible" value has been added in the commit 17fffe91ba36
+("dt-bindings: watchdog: Add BCM6345 compatible to BCM7038 binding").
+It's meant to be used for BCM63xx SoCs family but hardware block can be
+programmed just like the 7038 one.
+
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20220216063408.23168-1-zajec5@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+---
+ drivers/watchdog/bcm7038_wdt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/watchdog/bcm7038_wdt.c
++++ b/drivers/watchdog/bcm7038_wdt.c
+@@ -212,6 +212,7 @@ static SIMPLE_DEV_PM_OPS(bcm7038_wdt_pm_
+ 			 bcm7038_wdt_resume);
+ 
+ static const struct of_device_id bcm7038_wdt_match[] = {
++	{ .compatible = "brcm,bcm6345-wdt" },
+ 	{ .compatible = "brcm,bcm7038-wdt" },
+ 	{},
+ };
diff --git a/target/linux/bcm4908/patches-5.15/300-arm64-dts-broadcom-bcmbca-bcm4908-limit-amount-of-GP.patch b/target/linux/bcm4908/patches-5.15/300-arm64-dts-broadcom-bcmbca-bcm4908-limit-amount-of-GP.patch
new file mode 100644
index 00000000000000..a7c6d0102fe475
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/300-arm64-dts-broadcom-bcmbca-bcm4908-limit-amount-of-GP.patch
@@ -0,0 +1,23 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 15 Feb 2021 22:01:03 +0100
+Subject: [PATCH] arm64: dts: broadcom: bcmbca: bcm4908: limit amount of GPIOs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Linux driver can't handle more than 64 GPIOs
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
+@@ -343,7 +343,7 @@
+ 		gpio0: gpio-controller@500 {
+ 			compatible = "brcm,bcm6345-gpio";
+ 			reg-names = "dirout", "dat";
+-			reg = <0x500 0x28>, <0x528 0x28>;
++			reg = <0x500 0x8>, <0x528 0x8>;
+ 
+ 			#gpio-cells = <2>;
+ 			gpio-controller;
diff --git a/target/linux/bcm4908/patches-5.15/301-arm64-don-t-issue-HVC-on-boot.patch b/target/linux/bcm4908/patches-5.15/301-arm64-don-t-issue-HVC-on-boot.patch
new file mode 100644
index 00000000000000..d167c2ed00d3e0
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/301-arm64-don-t-issue-HVC-on-boot.patch
@@ -0,0 +1,30 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 12 Aug 2021 11:52:42 +0200
+Subject: [PATCH] arm64: don't issue HVC on boot
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Broadcom's CFE loader seems to miss setting SCR_EL3.HCE which results in
+generating an UNDEF and kernel panic on the first HVC.
+
+HVC gets issued by kernels 5.12+ while booting, by kexec and KVM. Until
+someone finds a workaround we have to avoid all above.
+
+Workarounds: 0c93df9622d4 ("arm64: Initialise as nVHE before switching to VHE")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+ arch/arm64/kernel/hyp-stub.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/kernel/hyp-stub.S
++++ b/arch/arm64/kernel/hyp-stub.S
+@@ -238,7 +238,7 @@ SYM_FUNC_START(switch_to_vhe)
+ 
+ 	// Turn the world upside down
+ 	mov	x0, #HVC_VHE_RESTART
+-	hvc	#0
++//	hvc	#0
+ 1:
+ 	ret
+ SYM_FUNC_END(switch_to_vhe)
diff --git a/target/linux/bcm4908/patches-5.15/400-mtd-rawnand-brcmnand-disable-WP-on-BCM4908.patch b/target/linux/bcm4908/patches-5.15/400-mtd-rawnand-brcmnand-disable-WP-on-BCM4908.patch
new file mode 100644
index 00000000000000..74dddb7f489503
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/400-mtd-rawnand-brcmnand-disable-WP-on-BCM4908.patch
@@ -0,0 +1,34 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 21 Jan 2021 10:44:53 +0100
+Subject: [PATCH] mtd: rawnand: brcmnand: disable WP on BCM4908
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+BCM4908 contains NAND controller version 0x0701 (v7.1). It means that
+NAND_WP should be available.
+
+For some reason setting #WP on doesn't result in clearing NAND_STATUS_WP
+status bit:
+[    1.077857] bcm63138_nand ff801800.nand: timeout on status poll (expected c0000040 got c00000c0)
+[    1.086832] bcm63138_nand ff801800.nand: nand #WP expected on
+
+For now try working without touching #WP.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+@@ -37,7 +37,11 @@
+  * 1: NAND_WP is set by default, cleared for erase/write operations
+  * 2: NAND_WP is always cleared
+  */
++#if IS_ENABLED(CONFIG_ARCH_BCM4908)
++static int wp_on = 0;
++#else
+ static int wp_on = 1;
++#endif
+ module_param(wp_on, int, 0444);
+ 
+ /***********************************************************************
diff --git a/target/linux/bcm4908/patches-5.15/700-net-dsa-bcm_sf2-enable-GPHY-for-switch-probing.patch b/target/linux/bcm4908/patches-5.15/700-net-dsa-bcm_sf2-enable-GPHY-for-switch-probing.patch
new file mode 100644
index 00000000000000..af1c9bcefd595b
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/700-net-dsa-bcm_sf2-enable-GPHY-for-switch-probing.patch
@@ -0,0 +1,46 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 15 Feb 2021 23:59:26 +0100
+Subject: [PATCH] net: dsa: bcm_sf2: enable GPHY for switch probing
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+GPHY needs to be enabled to succesfully probe & setup switch port
+connected to it. Otherwise hardcoding PHY OUI would be required.
+
+Before:
+brcm-sf2 80080000.switch lan4 (uninitialized): PHY [800c05c0.mdio--1:08] driver [Generic PHY] (irq=POLL)
+brcm-sf2 80080000.switch lan3 (uninitialized): PHY [800c05c0.mdio--1:09] driver [Generic PHY] (irq=POLL)
+brcm-sf2 80080000.switch lan2 (uninitialized): PHY [800c05c0.mdio--1:0a] driver [Generic PHY] (irq=POLL)
+brcm-sf2 80080000.switch lan1 (uninitialized): PHY [800c05c0.mdio--1:0b] driver [Generic PHY] (irq=POLL)
+brcm-sf2 80080000.switch wan (uninitialized): error -5 setting up PHY for tree 0, switch 0, port 7
+
+After:
+brcm-sf2 80080000.switch lan4 (uninitialized): PHY [800c05c0.mdio--1:08] driver [Generic PHY] (irq=POLL)
+brcm-sf2 80080000.switch lan3 (uninitialized): PHY [800c05c0.mdio--1:09] driver [Generic PHY] (irq=POLL)
+brcm-sf2 80080000.switch lan2 (uninitialized): PHY [800c05c0.mdio--1:0a] driver [Generic PHY] (irq=POLL)
+brcm-sf2 80080000.switch lan1 (uninitialized): PHY [800c05c0.mdio--1:0b] driver [Generic PHY] (irq=POLL)
+brcm-sf2 80080000.switch wan (uninitialized): PHY [800c05c0.mdio--1:0c] driver [Generic PHY] (irq=POLL)
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+ drivers/net/dsa/bcm_sf2.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -1538,10 +1538,14 @@ static int bcm_sf2_sw_probe(struct platf
+ 	rev = reg_readl(priv, REG_PHY_REVISION);
+ 	priv->hw_params.gphy_rev = rev & PHY_REVISION_MASK;
+ 
++	bcm_sf2_gphy_enable_set(priv->dev->ds, true);
++
+ 	ret = b53_switch_register(dev);
+ 	if (ret)
+ 		goto out_mdio;
+ 
++	bcm_sf2_gphy_enable_set(priv->dev->ds, false);
++
+ 	dev_info(&pdev->dev,
+ 		 "Starfighter 2 top: %x.%02x, core: %x.%02x, IRQs: %d, %d\n",
+ 		 priv->hw_params.top_rev >> 8, priv->hw_params.top_rev & 0xff,
diff --git a/target/linux/bcm4908/patches-5.15/701-net-dsa-bcm_sf2-keep-GPHY-enabled-on-the-BCM4908.patch b/target/linux/bcm4908/patches-5.15/701-net-dsa-bcm_sf2-keep-GPHY-enabled-on-the-BCM4908.patch
new file mode 100644
index 00000000000000..e78b4a47d70cf5
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.15/701-net-dsa-bcm_sf2-keep-GPHY-enabled-on-the-BCM4908.patch
@@ -0,0 +1,30 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 16 Feb 2021 00:06:35 +0100
+Subject: [PATCH] net: dsa: bcm_sf2: keep GPHY enabled on the BCM4908
+
+Trying to access disabled PHY results in MDIO_READ_FAIL and:
+[   11.962886] brcm-sf2 80080000.switch wan: configuring for phy/internal link mode
+[   11.972500] 8021q: adding VLAN 0 to HW filter on device wan
+[   11.980205] ------------[ cut here ]------------
+[   11.984885] WARNING: CPU: 0 PID: 7 at phy_error+0x10/0x58
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+ drivers/net/dsa/bcm_sf2.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -1552,6 +1552,12 @@ static int bcm_sf2_sw_probe(struct platf
+ 		 priv->hw_params.core_rev >> 8, priv->hw_params.core_rev & 0xff,
+ 		 priv->irq0, priv->irq1);
+ 
++	/* BCM4908 has 5 GPHYs which means bcm_sf2_port_setup() will not enable
++	 * GPHY when needed. Leave it enabled here.
++	 */
++	if (priv->type == BCM4908_DEVICE_ID)
++		bcm_sf2_gphy_enable_set(priv->dev->ds, true);
++
+ 	return 0;
+ 
+ out_mdio:
diff --git a/target/linux/bcm53xx/Makefile b/target/linux/bcm53xx/Makefile
index 605baeac3541db..84f08f1f802548 100644
--- a/target/linux/bcm53xx/Makefile
+++ b/target/linux/bcm53xx/Makefile
@@ -11,8 +11,8 @@ FEATURES:=squashfs nand usb pci pcie gpio pwm
 CPU_TYPE:=cortex-a9
 SUBTARGETS:=generic
 
-KERNEL_PATCHVER:=5.10
-KERNEL_TESTING_PATCHVER:=5.15
+KERNEL_PATCHVER:=5.15
+KERNEL_TESTING_PATCHVER:=6.1
 
 define Target/Description
 	Build firmware images for Broadcom based BCM47xx/53xx routers with ARM CPU, *not* MIPS.
diff --git a/target/linux/bcm53xx/base-files/etc/board.d/02_network b/target/linux/bcm53xx/base-files/etc/board.d/02_network
index c2e5afc5ed8045..6bec600540ead0 100644
--- a/target/linux/bcm53xx/base-files/etc/board.d/02_network
+++ b/target/linux/bcm53xx/base-files/etc/board.d/02_network
@@ -16,6 +16,9 @@ bcm53xx_setup_interfaces()
 	asus,rt-ac88u)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4 extsw" "wan"
 		;;
+	dlink,dwl-8610ap)
+		ucidef_set_interface_lan "eth0 eth1" "dhcp"
+		;;
 	linksys,panamera)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4 lan5 lan6 lan7 lan8 extsw" "wan"
 		;;
diff --git a/target/linux/bcm53xx/base-files/etc/uci-defaults/09_fix_crc b/target/linux/bcm53xx/base-files/etc/uci-defaults/09_fix_crc
index eae84bb771b82d..89ce8970d75ab7 100644
--- a/target/linux/bcm53xx/base-files/etc/uci-defaults/09_fix_crc
+++ b/target/linux/bcm53xx/base-files/etc/uci-defaults/09_fix_crc
@@ -1,5 +1,22 @@
+. /lib/functions.sh
+
+board=$(board_name)
+
 kernel_size=$(sed -n 's/mtd[0-9]*: \([0-9a-f]*\).*"\(kernel\|linux\)".*/\1/p' /proc/mtd)
 
-mtd ${kernel_size:+-c 0x$kernel_size} fixtrx firmware && exit 0
-mtd ${kernel_size:+-c 0x$kernel_size} fixseama firmware && exit 0
-exit 1
+fixtrx() {
+	mtd ${kernel_size:+-c 0x$kernel_size} fixtrx firmware && exit 0
+}
+
+fixseama() {
+	mtd ${kernel_size:+-c 0x$kernel_size} fixseama firmware && exit 0
+}
+
+case "$board" in
+dlink,dir-885l)
+	fixseama
+	;;
+*)
+	fixtrx
+	;;
+esac
diff --git a/target/linux/bcm53xx/base-files/usr/libexec/platform/packet-steering.sh b/target/linux/bcm53xx/base-files/usr/libexec/platform/packet-steering.sh
new file mode 100644
index 00000000000000..939a356d235b33
--- /dev/null
+++ b/target/linux/bcm53xx/base-files/usr/libexec/platform/packet-steering.sh
@@ -0,0 +1,25 @@
+#!/bin/sh
+
+packet_steering="$(uci -q get network.@globals[0].packet_steering)"
+flow_offloading="$(uci -q get firewall.@defaults[0].flow_offloading)"
+flow_offloading_hw="$(uci -q get firewall.@defaults[0].flow_offloading_hw)"
+
+[ "$packet_steering" != 1 ] && {
+	echo 0 > /sys/class/net/br-lan/queues/rx-0/rps_cpus
+	echo 0 > /sys/class/net/eth0/queues/rx-0/rps_cpus
+	exit 0
+}
+
+if [ ${flow_offloading_hw:-0} -gt 0 ]; then
+	# HW offloading
+	echo 0 > /sys/class/net/br-lan/queues/rx-0/rps_cpus
+	echo 0 > /sys/class/net/eth0/queues/rx-0/rps_cpus
+elif [ ${flow_offloading:-0} -gt 0 ]; then
+	# SW offloading
+	# br-lan setup doesn't seem to matter for offloading case
+	echo 2 > /sys/class/net/eth0/queues/rx-0/rps_cpus
+else
+	# Default
+	echo 2 > /sys/class/net/br-lan/queues/rx-0/rps_cpus
+	echo 0 > /sys/class/net/eth0/queues/rx-0/rps_cpus
+fi
diff --git a/target/linux/bcm53xx/config-5.15 b/target/linux/bcm53xx/config-5.15
index 32ac9fb6cc94ce..9cd1f079d10df8 100644
--- a/target/linux/bcm53xx/config-5.15
+++ b/target/linux/bcm53xx/config-5.15
@@ -1,4 +1,3 @@
-CONFIG_AF_UNIX_OOB=y
 CONFIG_ALIGNMENT_TRAP=y
 CONFIG_ARCH_32BIT_OFF_T=y
 CONFIG_ARCH_BCM=y
@@ -24,6 +23,7 @@ CONFIG_ARM_APPENDED_DTB=y
 CONFIG_ARM_ARCH_TIMER=y
 CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
 # CONFIG_ARM_ATAG_DTB_COMPAT is not set
+CONFIG_ARM_CRYPTO=y
 CONFIG_ARM_ERRATA_754322=y
 CONFIG_ARM_ERRATA_764369=y
 CONFIG_ARM_ERRATA_775420=y
@@ -53,6 +53,7 @@ CONFIG_BCMA_DEBUG=y
 CONFIG_BCMA_DRIVER_GMAC_CMN=y
 CONFIG_BCMA_DRIVER_GPIO=y
 CONFIG_BCMA_DRIVER_PCI=y
+CONFIG_BCMA_FALLBACK_SPROM=y
 CONFIG_BCMA_HOST_PCI=y
 CONFIG_BCMA_HOST_PCI_POSSIBLE=y
 CONFIG_BCMA_HOST_SOC=y
@@ -64,7 +65,6 @@ CONFIG_BCM_SR_THERMAL=y
 CONFIG_BGMAC=y
 CONFIG_BGMAC_BCMA=y
 # CONFIG_BGMAC_PLATFORM is not set
-CONFIG_BINARY_PRINTF=y
 CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK=y
 CONFIG_BLK_MQ_PCI=y
 CONFIG_BOUNCE=y
@@ -95,7 +95,6 @@ CONFIG_CPU_THUMB_CAPABLE=y
 CONFIG_CPU_TLB_V7=y
 CONFIG_CPU_V7=y
 CONFIG_CRC16=y
-CONFIG_CRYPTO_BLAKE2S=y
 CONFIG_CRYPTO_DEFLATE=y
 CONFIG_CRYPTO_HASH_INFO=y
 CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
@@ -171,7 +170,6 @@ CONFIG_HW_RANDOM_BCM2835=y
 CONFIG_HZ_FIXED=0
 CONFIG_HZ_PERIODIC=y
 CONFIG_INITRAMFS_SOURCE=""
-CONFIG_IO_URING=y
 CONFIG_IRQCHIP=y
 CONFIG_IRQ_DOMAIN=y
 CONFIG_IRQ_DOMAIN_HIERARCHY=y
@@ -183,7 +181,6 @@ CONFIG_KMAP_LOCAL_NON_LINEAR_PTE_ARRAY=y
 CONFIG_LIBFDT=y
 CONFIG_LOCK_DEBUGGING_SUPPORT=y
 CONFIG_LOCK_SPIN_ON_OWNER=y
-CONFIG_LTO_NONE=y
 CONFIG_LZO_COMPRESS=y
 CONFIG_LZO_DECOMPRESS=y
 CONFIG_MDIO_BCM_IPROC=y
@@ -205,6 +202,7 @@ CONFIG_MTD_NAND_CORE=y
 CONFIG_MTD_NAND_ECC=y
 CONFIG_MTD_NAND_ECC_SW_HAMMING=y
 CONFIG_MTD_OF_PARTS_LINKSYS_NS=y
+CONFIG_MTD_PARSER_TPLINK_SAFELOADER=y
 CONFIG_MTD_PARSER_TRX=y
 CONFIG_MTD_RAW_NAND=y
 CONFIG_MTD_SPI_NOR=y
@@ -223,7 +221,6 @@ CONFIG_NET_DSA_TAG_BRCM_LEGACY=y
 CONFIG_NET_DSA_TAG_BRCM_PREPEND=y
 CONFIG_NET_FLOW_LIMIT=y
 CONFIG_NET_SELFTESTS=y
-CONFIG_NET_SOCK_MSG=y
 CONFIG_NET_SWITCHDEV=y
 CONFIG_NR_CPUS=2
 CONFIG_NVMEM=y
diff --git a/target/linux/bcm53xx/config-6.1 b/target/linux/bcm53xx/config-6.1
new file mode 100644
index 00000000000000..d96beb687df0d7
--- /dev/null
+++ b/target/linux/bcm53xx/config-6.1
@@ -0,0 +1,318 @@
+CONFIG_ALIGNMENT_TRAP=y
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_BCM=y
+CONFIG_ARCH_BCM_5301X=y
+CONFIG_ARCH_BCM_53573=y
+# CONFIG_ARCH_BCM_HR2 is not set
+CONFIG_ARCH_BCM_IPROC=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+CONFIG_ARCH_MULTIPLATFORM=y
+CONFIG_ARCH_MULTI_V6_V7=y
+CONFIG_ARCH_MULTI_V7=y
+CONFIG_ARCH_NR_GPIO=0
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX=y
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARM=y
+CONFIG_ARM_AMBA=y
+CONFIG_ARM_APPENDED_DTB=y
+CONFIG_ARM_ARCH_TIMER=y
+CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+# CONFIG_ARM_ATAG_DTB_COMPAT is not set
+CONFIG_ARM_CRYPTO=y
+CONFIG_ARM_ERRATA_754322=y
+CONFIG_ARM_ERRATA_764369=y
+CONFIG_ARM_ERRATA_775420=y
+CONFIG_ARM_GIC=y
+CONFIG_ARM_GLOBAL_TIMER=y
+CONFIG_ARM_GT_INITIAL_PRESCALER_VAL=1
+CONFIG_ARM_HAS_SG_CHAIN=y
+CONFIG_ARM_HEAVY_MB=y
+CONFIG_ARM_L1_CACHE_SHIFT=6
+CONFIG_ARM_L1_CACHE_SHIFT_6=y
+CONFIG_ARM_PATCH_IDIV=y
+CONFIG_ARM_PATCH_PHYS_VIRT=y
+CONFIG_ARM_THUMB=y
+CONFIG_ARM_UNWIND=y
+CONFIG_ARM_VIRT_EXT=y
+CONFIG_ATAGS=y
+CONFIG_AUTO_ZRELADDR=y
+CONFIG_B53=y
+CONFIG_B53_MDIO_DRIVER=y
+CONFIG_B53_SRAB_DRIVER=y
+CONFIG_BCM47XX_NVRAM=y
+CONFIG_BCM47XX_SPROM=y
+CONFIG_BCM47XX_WDT=y
+CONFIG_BCMA=y
+CONFIG_BCMA_BLOCKIO=y
+CONFIG_BCMA_DEBUG=y
+CONFIG_BCMA_DRIVER_GMAC_CMN=y
+CONFIG_BCMA_DRIVER_GPIO=y
+CONFIG_BCMA_DRIVER_PCI=y
+CONFIG_BCMA_FALLBACK_SPROM=y
+CONFIG_BCMA_HOST_PCI=y
+CONFIG_BCMA_HOST_PCI_POSSIBLE=y
+CONFIG_BCMA_HOST_SOC=y
+CONFIG_BCMA_SFLASH=y
+# CONFIG_BCM_CYGNUS_PHY is not set
+CONFIG_BCM_NET_PHYLIB=y
+CONFIG_BCM_NS_THERMAL=y
+CONFIG_BCM_SR_THERMAL=y
+CONFIG_BGMAC=y
+CONFIG_BGMAC_BCMA=y
+# CONFIG_BGMAC_PLATFORM is not set
+CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BOUNCE=y
+CONFIG_BROADCOM_PHY=y
+CONFIG_CACHE_L2X0=y
+CONFIG_CLKSRC_ARM_GLOBAL_TIMER_SCHED_CLOCK=y
+CONFIG_CLKSRC_MMIO=y
+# CONFIG_CLK_BCM_NS2 is not set
+CONFIG_CLK_BCM_NSP=y
+# CONFIG_CLK_BCM_SR is not set
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMMON_CLK_IPROC=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CPU_32v6K=y
+CONFIG_CPU_32v7=y
+CONFIG_CPU_ABRT_EV7=y
+CONFIG_CPU_CACHE_V7=y
+CONFIG_CPU_CACHE_VIPT=y
+CONFIG_CPU_COPY_V6=y
+CONFIG_CPU_CP15=y
+CONFIG_CPU_CP15_MMU=y
+CONFIG_CPU_HAS_ASID=y
+CONFIG_CPU_PABRT_V7=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SPECTRE=y
+CONFIG_CPU_THUMB_CAPABLE=y
+CONFIG_CPU_TLB_V7=y
+CONFIG_CPU_V7=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DEBUG_BCM_5301X=y
+CONFIG_DEBUG_LL=y
+CONFIG_DEBUG_LL_INCLUDE="debug/8250.S"
+CONFIG_DEBUG_MISC=y
+CONFIG_DEBUG_UART_8250=y
+CONFIG_DEBUG_UART_8250_SHIFT=0
+CONFIG_DEBUG_UART_PHYS=0x18000300
+CONFIG_DEBUG_UART_VIRT=0xf1000300
+CONFIG_DEBUG_UNCOMPRESS=y
+CONFIG_DEBUG_USER=y
+CONFIG_DMA_OPS=y
+CONFIG_DMA_REMAP=y
+CONFIG_DTC=y
+CONFIG_EARLY_PRINTK=y
+CONFIG_EDAC_ATOMIC_SCRUB=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EXTCON=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+# CONFIG_FW_LOADER_USER_HELPER_FALLBACK is not set
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ARCH_TOPOLOGY=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_MULTI_HANDLER=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GENERIC_VDSO_32=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_74X164=y
+CONFIG_GPIO_BCM_XGS_IPROC=y
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GRO_CELLS=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDEN_BRANCH_PREDICTOR=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HAVE_SMP=y
+CONFIG_HIGHMEM=y
+CONFIG_HIGHPTE=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_BCM2835=y
+CONFIG_HZ_FIXED=0
+CONFIG_HZ_PERIODIC=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+CONFIG_KMAP_LOCAL=y
+CONFIG_KMAP_LOCAL_NON_LINEAR_PTE_ARRAY=y
+# CONFIG_LEDS_BCM63138 is not set
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MDIO_BCM_IPROC=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_BUS_MUX=y
+# CONFIG_MDIO_BUS_MUX_BCM_IPROC is not set
+CONFIG_MDIO_BUS_MUX_MMIOREG=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGHT_HAVE_CACHE_L2X0=y
+CONFIG_MIGRATION=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MTD_BCM47XXSFLASH=y
+CONFIG_MTD_BCM47XX_PARTS=y
+CONFIG_MTD_NAND_BRCMNAND=y
+CONFIG_MTD_NAND_BRCMNAND_IPROC=y
+CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_NAND_ECC_SW_HAMMING=y
+CONFIG_MTD_OF_PARTS_LINKSYS_NS=y
+CONFIG_MTD_PARSER_TPLINK_SAFELOADER=y
+CONFIG_MTD_PARSER_TRX=y
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPLIT_SEAMA_FW=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_LIMIT=20
+CONFIG_MTD_UBI_BLOCK=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_TAG_BRCM=y
+CONFIG_NET_DSA_TAG_BRCM_COMMON=y
+CONFIG_NET_DSA_TAG_BRCM_LEGACY=y
+CONFIG_NET_DSA_TAG_BRCM_PREPEND=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NR_CPUS=2
+CONFIG_NVMEM=y
+CONFIG_NVMEM_BRCM_NVRAM=y
+CONFIG_NVMEM_SYSFS=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_OLD_SIGACTION=y
+CONFIG_OLD_SIGSUSPEND3=y
+CONFIG_OUTER_CACHE=y
+CONFIG_OUTER_CACHE_SYNC=y
+CONFIG_PADATA=y
+CONFIG_PAGE_OFFSET=0xC0000000
+CONFIG_PCI=y
+CONFIG_PCIE_IPROC=y
+CONFIG_PCIE_IPROC_BCMA=y
+# CONFIG_PCIE_IPROC_PLATFORM is not set
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+# CONFIG_PHY_BCM_NS_USB2 is not set
+# CONFIG_PHY_BCM_NS_USB3 is not set
+# CONFIG_PHY_BCM_SR_PCIE is not set
+CONFIG_PHY_BCM_SR_USB=y
+# CONFIG_PHY_BRCM_SATA is not set
+# CONFIG_PHY_NS2_USB_DRD is not set
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_IPROC_GPIO is not set
+CONFIG_PINCTRL_NS=y
+# CONFIG_PINCTRL_NS2_MUX is not set
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_PWM=y
+CONFIG_PWM_BCM_IPROC=y
+CONFIG_PWM_SYSFS=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+CONFIG_SERIAL_8250_FSL=y
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SMP=y
+CONFIG_SMP_ON_UP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SPI=y
+CONFIG_SPI_BCM_QSPI=y
+CONFIG_SPI_BITBANG=y
+CONFIG_SPI_GPIO=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRCU=y
+CONFIG_SWPHY=y
+CONFIG_SWP_EMULATE=y
+CONFIG_SYS_SUPPORTS_APM_EMULATION=y
+CONFIG_THERMAL=y
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_GOV_STEP_WISE=y
+CONFIG_THERMAL_OF=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UBIFS_FS=y
+CONFIG_UNCOMPRESS_INCLUDE="debug/uncompress.h"
+CONFIG_UNWINDER_ARM=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_OF=y
+# CONFIG_VFP is not set
+CONFIG_WATCHDOG_CORE=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_XZ_DEC_ARM=y
+CONFIG_XZ_DEC_BCJ=y
+CONFIG_ZBOOT_ROM_BSS=0x0
+CONFIG_ZBOOT_ROM_TEXT=0x0
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/bcm53xx/image/Makefile b/target/linux/bcm53xx/image/Makefile
index d101ff95a7b89f..defa68e59f981d 100644
--- a/target/linux/bcm53xx/image/Makefile
+++ b/target/linux/bcm53xx/image/Makefile
@@ -105,13 +105,29 @@ define Build/seama-nand
 		-i $@.entity
 endef
 
+define Build/dwl8610ap-image
+	mkdir -p $@.tmptar
+	# The DWL8610AP pretends to be a Broadcom reference design
+	echo "bcm953012er" > $@.tmptar/board
+	echo "LVL7" > $@.tmptar/model
+	# Something high beyond what D-Link has put out
+	echo "5.0.0.0" > $@.tmptar/version
+	# Create rootfs.bin, this is just a NAND image including everything
+	cp $@ $@.tmptar/rootfs.bin
+	# Hash the rootfs.bin
+	cat $@.tmptar/rootfs.bin | md5sum > $@.tmptar/rootfs.md5
+	cd $@.tmptar && tar -c -f $@.new *
+	rm -rf $@.tmptar
+	mv $@.new $@
+endef
+
 DEVICE_VARS += ASUS_PRODUCTID
 DEVICE_VARS += BUFFALO_TAG_PLATFORM BUFFALO_TAG_VERSION BUFFALO_TAG_MINOR
 DEVICE_VARS += SIGNATURE
 DEVICE_VARS += NETGEAR_BOARD_ID NETGEAR_REGION TPLINK_BOARD
 DEVICE_VARS += LUXUL_BOARD
 
-IEEE8021X := wpad-basic-wolfssl
+IEEE8021X := wpad-basic-mbedtls
 B43 := $(IEEE8021X) kmod-b43
 BRCMFMAC_43602A1 := $(IEEE8021X) kmod-brcmfmac brcmfmac-firmware-43602a1-pcie
 BRCMFMAC_4366B1 := $(IEEE8021X) kmod-brcmfmac brcmfmac-firmware-4366b1-pcie
@@ -170,7 +186,7 @@ TARGET_DEVICES += asus_rt-ac87u
 define Device/asus_rt-ac88u
   $(call Device/asus)
   DEVICE_MODEL := RT-AC88U
-  DEVICE_PACKAGES := $(BRCMFMAC_4366C0) $(USB3_PACKAGES)
+  DEVICE_PACKAGES := $(BRCMFMAC_4366B1) $(BRCMFMAC_4366C0) $(USB3_PACKAGES)
   ASUS_PRODUCTID := RT-AC88U
 endef
 TARGET_DEVICES += asus_rt-ac88u
@@ -250,6 +266,15 @@ define Device/dlink_dir-885l
 endef
 TARGET_DEVICES += dlink_dir-885l
 
+define Device/dlink_dwl-8610ap
+  DEVICE_VENDOR := D-Link
+  DEVICE_MODEL := DWL-8610AP
+  DEVICE_PACKAGES := $(B43)
+  IMAGES := factory.tar
+  IMAGE/factory.tar := append-ubi | trx-nand | dwl8610ap-image
+endef
+TARGET_DEVICES += dlink_dwl-8610ap
+
 define Device/linksys_ea6300-v1
   DEVICE_VENDOR := Linksys
   DEVICE_MODEL := EA6300
@@ -326,7 +351,7 @@ define Device/meraki_mr26
   DEVICE_VENDOR := Meraki
   DEVICE_MODEL := MR26
   DEVICE_PACKAGES := $(B43) kmod-i2c-bcm-iproc kmod-eeprom-at24 \
-	kmod-hwmon-ina2xx nu801
+	kmod-hwmon-ina2xx kmod-leds-uleds nu801
   DEVICE_DTS := bcm53015-meraki-mr26
 # resize the initramfs to fit the size of the existing part.safe.
   KERNEL_LOADADDR := 0x00008000
diff --git a/target/linux/bcm53xx/patches-5.15/033-v5.19-0002-ARM-dts-BCM5301X-Fix-DTC-warning-for-NAND-node.patch b/target/linux/bcm53xx/patches-5.15/033-v5.19-0002-ARM-dts-BCM5301X-Fix-DTC-warning-for-NAND-node.patch
new file mode 100644
index 00000000000000..e61fef8aabdc76
--- /dev/null
+++ b/target/linux/bcm53xx/patches-5.15/033-v5.19-0002-ARM-dts-BCM5301X-Fix-DTC-warning-for-NAND-node.patch
@@ -0,0 +1,31 @@
+From 90103611d573c5c238350f9b1d7cb682c62f5681 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ar=C4=B1n=C3=A7=20=C3=9CNAL?= <arinc.unal@arinc9.com>
+Date: Fri, 1 Apr 2022 13:19:58 +0300
+Subject: [PATCH] ARM: dts: BCM5301X: Fix DTC warning for NAND node
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Remove the unnecessary #address-cells and #size-cells properties on the
+nand@0 node to fix the warning below.
+
+Warning (avoid_unnecessary_addr_size): /nand-controller@18028000/nand@0: unnecessary #address-cells/#size-cells without "ranges" or child "reg" property
+
+Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Acked-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm/boot/dts/bcm5301x-nand-cs0.dtsi | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm5301x-nand-cs0.dtsi
++++ b/arch/arm/boot/dts/bcm5301x-nand-cs0.dtsi
+@@ -10,8 +10,6 @@
+ 		nandcs: nand@0 {
+ 			compatible = "brcm,nandcs";
+ 			reg = <0>;
+-			#address-cells = <1>;
+-			#size-cells = <1>;
+ 
+ 			partitions {
+ 				compatible = "brcm,bcm947xx-cfe-partitions";
diff --git a/target/linux/bcm53xx/patches-5.15/033-v5.19-0003-ARM-dts-BCM5301X-Remove-cell-properties-from-srab-po.patch b/target/linux/bcm53xx/patches-5.15/033-v5.19-0003-ARM-dts-BCM5301X-Remove-cell-properties-from-srab-po.patch
new file mode 100644
index 00000000000000..6ef8720b1d5e0e
--- /dev/null
+++ b/target/linux/bcm53xx/patches-5.15/033-v5.19-0003-ARM-dts-BCM5301X-Remove-cell-properties-from-srab-po.patch
@@ -0,0 +1,40 @@
+From e5ff0a7aab3ef5dd8ec7636b936c95179aa5ddfa Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ar=C4=B1n=C3=A7=20=C3=9CNAL?= <arinc.unal@arinc9.com>
+Date: Fri, 1 Apr 2022 13:19:59 +0300
+Subject: [PATCH] ARM: dts: BCM5301X: Remove cell properties from srab ports on
+ Asus RT-AC88U
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Remove #address-cells and #size-cells properties from the ports node of
+&srab. They are already defined on bcm5301x.dtsi, there's no need to define
+them again.
+
+Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Acked-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm/boot/dts/bcm47094-asus-rt-ac88u.dts | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm47094-asus-rt-ac88u.dts
++++ b/arch/arm/boot/dts/bcm47094-asus-rt-ac88u.dts
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+ /*
+- * Copyright (C) 2021 Arınç ÜNAL <arinc.unal@arinc9.com>
++ * Copyright (C) 2021-2022 Arınç ÜNAL <arinc.unal@arinc9.com>
+  */
+ 
+ /dts-v1/;
+@@ -177,9 +177,6 @@
+ 	dsa,member = <0 0>;
+ 
+ 	ports {
+-		#address-cells = <1>;
+-		#size-cells = <0>;
+-
+ 		port@0 {
+ 			reg = <0>;
+ 			label = "lan4";
diff --git a/target/linux/bcm53xx/patches-5.15/033-v5.19-0004-ARM-dts-BCM5301X-Add-rgmii-to-port-5-of-Broadcom-swi.patch b/target/linux/bcm53xx/patches-5.15/033-v5.19-0004-ARM-dts-BCM5301X-Add-rgmii-to-port-5-of-Broadcom-swi.patch
new file mode 100644
index 00000000000000..aa192b3a118f01
--- /dev/null
+++ b/target/linux/bcm53xx/patches-5.15/033-v5.19-0004-ARM-dts-BCM5301X-Add-rgmii-to-port-5-of-Broadcom-swi.patch
@@ -0,0 +1,29 @@
+From 4b7a67420a34ebd8fbf0111221a8bfd8001d418d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ar=C4=B1n=C3=A7=20=C3=9CNAL?= <arinc.unal@arinc9.com>
+Date: Fri, 1 Apr 2022 13:20:00 +0300
+Subject: [PATCH] ARM: dts: BCM5301X: Add rgmii to port@5 of Broadcom switch on
+ Asus RT-AC88U
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Define phy-mode of the Broadcom switch's port@5 as rgmii. This doesn't seem
+to matter but let's explicitly define it since phy-mode as rgmii is defined
+on the other side which is port@6 of the Realtek switch.
+
+Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm/boot/dts/bcm47094-asus-rt-ac88u.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/boot/dts/bcm47094-asus-rt-ac88u.dts
++++ b/arch/arm/boot/dts/bcm47094-asus-rt-ac88u.dts
+@@ -205,6 +205,7 @@
+ 		sw0_p5: port@5 {
+ 			reg = <5>;
+ 			label = "extsw";
++			phy-mode = "rgmii";
+ 
+ 			fixed-link {
+ 				speed = <1000>;
diff --git a/target/linux/bcm53xx/patches-5.15/033-v5.19-0005-ARM-dts-BCM5301X-Retrieve-gmac1-MAC-address-from-NVR.patch b/target/linux/bcm53xx/patches-5.15/033-v5.19-0005-ARM-dts-BCM5301X-Retrieve-gmac1-MAC-address-from-NVR.patch
new file mode 100644
index 00000000000000..4c0858be0a71c5
--- /dev/null
+++ b/target/linux/bcm53xx/patches-5.15/033-v5.19-0005-ARM-dts-BCM5301X-Retrieve-gmac1-MAC-address-from-NVR.patch
@@ -0,0 +1,43 @@
+From 7f7f8c7b9f3cbae1355fb3b0ce4ea9d6f1552521 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ar=C4=B1n=C3=A7=20=C3=9CNAL?= <arinc.unal@arinc9.com>
+Date: Fri, 1 Apr 2022 13:20:01 +0300
+Subject: [PATCH] ARM: dts: BCM5301X: Retrieve gmac1 MAC address from NVRAM on
+ Asus RT-AC88U
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The et1macaddr NVRAM variable contains a MAC address for gmac1 on Asus
+RT-AC88U. Add NVMEM cell for it and reference it in the gmac1 node.
+
+Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Acked-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm/boot/dts/bcm47094-asus-rt-ac88u.dts | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/arch/arm/boot/dts/bcm47094-asus-rt-ac88u.dts
++++ b/arch/arm/boot/dts/bcm47094-asus-rt-ac88u.dts
+@@ -25,6 +25,9 @@
+ 	nvram@1c080000 {
+ 		compatible = "brcm,nvram";
+ 		reg = <0x1c080000 0x00180000>;
++
++		et1macaddr: et1macaddr {
++		};
+ 	};
+ 
+ 	leds {
+@@ -239,6 +242,11 @@
+ 	};
+ };
+ 
++&gmac1 {
++	nvmem-cells = <&et1macaddr>;
++	nvmem-cell-names = "mac-address";
++};
++
+ &usb2 {
+ 	vcc-gpio = <&chipcommon 9 GPIO_ACTIVE_HIGH>;
+ };
diff --git a/target/linux/bcm53xx/patches-5.15/033-v5.19-0006-ARM-dts-BCM5301X-Fix-compatible-strings-for-BCM53012.patch b/target/linux/bcm53xx/patches-5.15/033-v5.19-0006-ARM-dts-BCM5301X-Fix-compatible-strings-for-BCM53012.patch
new file mode 100644
index 00000000000000..59e99dae6261cc
--- /dev/null
+++ b/target/linux/bcm53xx/patches-5.15/033-v5.19-0006-ARM-dts-BCM5301X-Fix-compatible-strings-for-BCM53012.patch
@@ -0,0 +1,65 @@
+From 69bb5c6f3f41fe6baa86a775c8a3e69dd27f85d6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ar=C4=B1n=C3=A7=20=C3=9CNAL?= <arinc.unal@arinc9.com>
+Date: Sat, 2 Apr 2022 23:46:21 +0300
+Subject: [PATCH] ARM: dts: BCM5301X: Fix compatible strings for BCM53012 and
+ BCM53016 SoC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fix compatible strings for devicetrees using the BCM53012 and BCM53016 SoC.
+
+Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm/boot/dts/bcm53016-meraki-mr32.dts | 2 +-
+ arch/arm/boot/dts/bcm953012er.dts          | 2 +-
+ arch/arm/boot/dts/bcm953012hr.dts          | 2 +-
+ arch/arm/boot/dts/bcm953012k.dts           | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm53016-meraki-mr32.dts
++++ b/arch/arm/boot/dts/bcm53016-meraki-mr32.dts
+@@ -13,7 +13,7 @@
+ #include <dt-bindings/leds/common.h>
+ 
+ / {
+-	compatible = "meraki,mr32", "brcm,brcm53016", "brcm,bcm4708";
++	compatible = "meraki,mr32", "brcm,bcm53016", "brcm,bcm4708";
+ 	model = "Meraki MR32";
+ 
+ 	chosen {
+--- a/arch/arm/boot/dts/bcm953012er.dts
++++ b/arch/arm/boot/dts/bcm953012er.dts
+@@ -37,7 +37,7 @@
+ 
+ / {
+ 	model = "NorthStar Enterprise Router (BCM953012ER)";
+-	compatible = "brcm,bcm953012er", "brcm,brcm53012", "brcm,bcm4708";
++	compatible = "brcm,bcm953012er", "brcm,bcm53012", "brcm,bcm4708";
+ 
+ 	memory@0 {
+ 		device_type = "memory";
+--- a/arch/arm/boot/dts/bcm953012hr.dts
++++ b/arch/arm/boot/dts/bcm953012hr.dts
+@@ -37,7 +37,7 @@
+ 
+ / {
+ 	model = "NorthStar HR (BCM953012HR)";
+-	compatible = "brcm,bcm953012hr", "brcm,brcm53012", "brcm,bcm4708";
++	compatible = "brcm,bcm953012hr", "brcm,bcm53012", "brcm,bcm4708";
+ 
+ 	aliases {
+ 		ethernet0 = &gmac0;
+--- a/arch/arm/boot/dts/bcm953012k.dts
++++ b/arch/arm/boot/dts/bcm953012k.dts
+@@ -36,7 +36,7 @@
+ 
+ / {
+ 	model = "NorthStar SVK (BCM953012K)";
+-	compatible = "brcm,bcm953012k", "brcm,brcm53012", "brcm,bcm4708";
++	compatible = "brcm,bcm953012k", "brcm,bcm53012", "brcm,bcm4708";
+ 
+ 	aliases {
+ 		serial0 = &uart0;
diff --git a/target/linux/bcm53xx/patches-5.15/033-v5.19-0007-ARM-dts-BCM5301X-Disable-gmac0-and-enable-port-8-on-.patch b/target/linux/bcm53xx/patches-5.15/033-v5.19-0007-ARM-dts-BCM5301X-Disable-gmac0-and-enable-port-8-on-.patch
new file mode 100644
index 00000000000000..f75a53777f3f3c
--- /dev/null
+++ b/target/linux/bcm53xx/patches-5.15/033-v5.19-0007-ARM-dts-BCM5301X-Disable-gmac0-and-enable-port-8-on-.patch
@@ -0,0 +1,39 @@
+From b9cff8783439ff1803709128af3a0e04c5f5f047 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ar=C4=B1n=C3=A7=20=C3=9CNAL?= <arinc.unal@arinc9.com>
+Date: Sun, 10 Apr 2022 12:44:55 +0300
+Subject: [PATCH] ARM: dts: BCM5301X: Disable gmac0 and enable port@8 on Asus
+ RT-AC88U
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Disable gmac0 which is not connected to any switch MAC. Enable port@8 of
+the Broadcom switch which is connected to gmac2.
+
+Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm/boot/dts/bcm47094-asus-rt-ac88u.dts | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/bcm47094-asus-rt-ac88u.dts
++++ b/arch/arm/boot/dts/bcm47094-asus-rt-ac88u.dts
+@@ -232,7 +232,6 @@
+ 			reg = <8>;
+ 			ethernet = <&gmac2>;
+ 			label = "cpu";
+-			status = "disabled";
+ 
+ 			fixed-link {
+ 				speed = <1000>;
+@@ -242,6 +241,10 @@
+ 	};
+ };
+ 
++&gmac0 {
++	status = "disabled";
++};
++
+ &gmac1 {
+ 	nvmem-cells = <&et1macaddr>;
+ 	nvmem-cell-names = "mac-address";
diff --git a/target/linux/bcm53xx/patches-5.15/033-v5.19-0008-ARM-dts-BCM5301X-Add-DT-for-WZR-1166DHP-DHP2.patch b/target/linux/bcm53xx/patches-5.15/033-v5.19-0008-ARM-dts-BCM5301X-Add-DT-for-WZR-1166DHP-DHP2.patch
new file mode 100644
index 00000000000000..c6f1cbd5e24b67
--- /dev/null
+++ b/target/linux/bcm53xx/patches-5.15/033-v5.19-0008-ARM-dts-BCM5301X-Add-DT-for-WZR-1166DHP-DHP2.patch
@@ -0,0 +1,300 @@
+From 417aea4436bb658d8c5c4dcd0e3c255931d0ee96 Mon Sep 17 00:00:00 2001
+From: SHIMAMOTO Takayoshi <takayoshi.shimamoto.360@gmail.com>
+Date: Fri, 22 Apr 2022 00:10:54 +0900
+Subject: [PATCH] ARM: dts: BCM5301X: Add DT for WZR-1166DHP,DHP2
+
+Buffalo WZR-1166DHP/WZR-1166DHP2  wireless router with
+
+    - BCM4708A0
+    - 128MiB NAND flash
+    - 2T2R 11ac/a/b/g/n Wi-Fi
+    - 4x 10/100/1000M ethernet switch
+    - 1x USB 3.0 port
+
+  WZR-1166DHP and WZR-1166DHP2 have different memory capacity.
+
+  WZR-1166DHP
+    - 512 MiB DDR2 SDRAM
+
+  WZR-1166DHP2
+    - 256 MiB DDR2 SDRAM
+
+  These hardware components are very similar to the WZR-1750DHP
+   except for the number of antennas.
+
+Signed-off-by: SHIMAMOTO Takayoshi <takayoshi.shimamoto.360@gmail.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm/boot/dts/Makefile                    |   2 +
+ .../bcm4708-buffalo-wzr-1166dhp-common.dtsi   | 192 ++++++++++++++++++
+ .../boot/dts/bcm4708-buffalo-wzr-1166dhp.dts  |  26 +++
+ .../boot/dts/bcm4708-buffalo-wzr-1166dhp2.dts |  26 +++
+ 4 files changed, 246 insertions(+)
+ create mode 100644 arch/arm/boot/dts/bcm4708-buffalo-wzr-1166dhp-common.dtsi
+ create mode 100644 arch/arm/boot/dts/bcm4708-buffalo-wzr-1166dhp.dts
+ create mode 100644 arch/arm/boot/dts/bcm4708-buffalo-wzr-1166dhp2.dts
+
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -98,6 +98,8 @@ dtb-$(CONFIG_ARCH_BCM_5301X) += \
+ 	bcm4708-asus-rt-ac56u.dtb \
+ 	bcm4708-asus-rt-ac68u.dtb \
+ 	bcm4708-buffalo-wzr-1750dhp.dtb \
++	bcm4708-buffalo-wzr-1166dhp.dtb \
++	bcm4708-buffalo-wzr-1166dhp2.dtb \
+ 	bcm4708-linksys-ea6300-v1.dtb \
+ 	bcm4708-linksys-ea6500-v2.dtb \
+ 	bcm4708-luxul-xap-1510.dtb \
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm4708-buffalo-wzr-1166dhp-common.dtsi
+@@ -0,0 +1,192 @@
++// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
++/*
++ * Broadcom BCM470X / BCM5301X ARM platform code.
++ * DTS for Buffalo WZR-1166DHP and WZR-1166DHP2
++ *
++ * Copyright (C) 2014 Rafał Miłecki <zajec5@gmail.com>
++ * Copyright (C) 2022 SHIMAMOTO Takayoshi <takayoshi.shimamoto.360@gmail.com>
++ */
++
++
++#include "bcm4708.dtsi"
++#include "bcm5301x-nand-cs0-bch8.dtsi"
++#include <dt-bindings/leds/common.h>
++
++/ {
++	spi {
++		compatible = "spi-gpio";
++		num-chipselects = <1>;
++		gpio-sck = <&chipcommon 7 0>;
++		gpio-mosi = <&chipcommon 4 0>;
++		cs-gpios = <&chipcommon 6 0>;
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		hc595: gpio_spi@0 {
++			compatible = "fairchild,74hc595";
++			reg = <0>;
++			registers-number = <1>;
++			spi-max-frequency = <100000>;
++
++			gpio-controller;
++			#gpio-cells = <2>;
++
++		};
++	};
++
++	leds {
++		compatible = "gpio-leds";
++
++		usb {
++			/* label = "bcm53xx:blue:usb"; */
++			function = LED_FUNCTION_USB;
++			color = <LED_COLOR_ID_BLUE>;
++			gpios = <&hc595 0 GPIO_ACTIVE_HIGH>;
++			trigger-sources = <&ohci_port1>, <&ehci_port1>,
++					  <&xhci_port1>, <&ohci_port2>,
++					  <&ehci_port2>;
++			linux,default-trigger = "usbport";
++		};
++
++		power0 {
++			/* label = "bcm53xx:red:power"; */
++			function = LED_FUNCTION_FAULT;
++			color = <LED_COLOR_ID_RED>;
++			gpios = <&hc595 1 GPIO_ACTIVE_HIGH>;
++		};
++
++		power1 {
++			/* label = "bcm53xx:white:power"; */
++			function = LED_FUNCTION_POWER;
++			color = <LED_COLOR_ID_WHITE>;
++			gpios = <&hc595 2 GPIO_ACTIVE_HIGH>;
++			linux,default-trigger = "default-on";
++		};
++
++		router0 {
++			/*  label = "bcm53xx:blue:router"; */
++			function = LED_FUNCTION_STATUS;
++			color = <LED_COLOR_ID_BLUE>;
++			gpios = <&hc595 3 GPIO_ACTIVE_HIGH>;
++			linux,default-trigger = "default-on";
++		};
++
++		router1 {
++			/* label = "bcm53xx:amber:router"; */
++			function = LED_FUNCTION_STATUS;
++			color = <LED_COLOR_ID_AMBER>;
++			gpios = <&hc595 4 GPIO_ACTIVE_HIGH>;
++		};
++
++		wan {
++			/* label = "bcm53xx:blue:wan"; */
++			function = LED_FUNCTION_WAN;
++			color = <LED_COLOR_ID_BLUE>;
++			gpios = <&hc595 5 GPIO_ACTIVE_HIGH>;
++			linux,default-trigger = "default-on";
++		};
++
++		wireless0 {
++			/* label = "bcm53xx:blue:wireless"; */
++			function = LED_FUNCTION_WLAN;
++			color = <LED_COLOR_ID_BLUE>;
++			gpios = <&hc595 6 GPIO_ACTIVE_HIGH>;
++		};
++
++		wireless1 {
++			/* label = "bcm53xx:amber:wireless"; */
++			function = LED_FUNCTION_WLAN;
++			color = <LED_COLOR_ID_AMBER>;
++			gpios = <&hc595 7 GPIO_ACTIVE_HIGH>;
++		};
++	};
++
++	gpio-keys {
++		compatible = "gpio-keys";
++
++		restart {
++			label = "Reset";
++			linux,code = <KEY_RESTART>;
++			gpios = <&chipcommon 11 GPIO_ACTIVE_LOW>;
++		};
++
++		aoss {
++			label = "AOSS";
++			linux,code = <KEY_WPS_BUTTON>;
++			gpios = <&chipcommon 12 GPIO_ACTIVE_LOW>;
++		};
++
++		/* Commit mode set by switch? */
++		mode {
++			label = "Mode";
++			linux,code = <KEY_SETUP>;
++			gpios = <&chipcommon 13 GPIO_ACTIVE_LOW>;
++		};
++
++		/* Switch: AP mode */
++		sw_ap {
++			label = "AP";
++			linux,code = <BTN_0>;
++			gpios = <&chipcommon 14 GPIO_ACTIVE_LOW>;
++		};
++
++		eject {
++			label = "USB eject";
++			linux,code = <KEY_EJECTCD>;
++			gpios = <&chipcommon 15 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
++
++&usb2 {
++	vcc-gpio = <&chipcommon 9 GPIO_ACTIVE_HIGH>;
++};
++
++&usb3 {
++	vcc-gpio = <&chipcommon 10 GPIO_ACTIVE_LOW>;
++};
++
++&spi_nor {
++	status = "okay";
++};
++
++&usb3_phy {
++	status = "okay";
++};
++
++&srab {
++	status = "okay";
++
++	ports {
++		port@0 {
++			reg = <0>;
++			label = "lan1";
++		};
++
++		port@1 {
++			reg = <1>;
++			label = "lan2";
++		};
++
++		port@2 {
++			reg = <2>;
++			label = "lan3";
++		};
++
++		port@3 {
++			reg = <3>;
++			label = "lan4";
++		};
++
++		port@4 {
++			reg = <4>;
++			label = "wan";
++		};
++
++		port@5 {
++			reg = <5>;
++			label = "cpu";
++			ethernet = <&gmac0>;
++		};
++	};
++};
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm4708-buffalo-wzr-1166dhp.dts
+@@ -0,0 +1,26 @@
++// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
++/*
++ * Device Tree Bindigs for Buffalo WZR-1166DHP
++ *
++ * Copyright (C) 2022 SHIMAMOTO Takayoshi <takayoshi.shimamoto.360@gmail.com>
++ */
++
++/dts-v1/;
++
++#include "bcm4708-buffalo-wzr-1166dhp-common.dtsi"
++
++/ {
++	compatible = "buffalo,wzr-1166dhp", "brcm,bcm4708";
++	model = "Buffalo WZR-1166DHP";
++
++	chosen {
++		bootargs = "console=ttyS0,115200";
++	};
++
++	memory@0 {
++		device_type = "memory";
++		reg = <0x00000000 0x08000000>,
++		      <0x88000000 0x18000000>;
++	};
++
++};
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm4708-buffalo-wzr-1166dhp2.dts
+@@ -0,0 +1,26 @@
++// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
++/*
++ * Device Tree Bindigs for Buffalo WZR-1166DHP2
++ *
++ * Copyright (C) 2022 SHIMAMOTO Takayoshi <takayoshi.shimamoto.360@gmail.com>
++ */
++
++/dts-v1/;
++
++#include "bcm4708-buffalo-wzr-1166dhp-common.dtsi"
++
++/ {
++	compatible = "buffalo,wzr-1166dhp2", "brcm,bcm4708";
++	model = "Buffalo WZR-1166DHP2";
++
++	chosen {
++		bootargs = "console=ttyS0,115200";
++	};
++
++	memory@0 {
++		device_type = "memory";
++		reg = <0x00000000 0x08000000>,
++		      <0x88000000 0x08000000>;
++	};
++
++};
diff --git a/target/linux/bcm53xx/patches-5.15/033-v5.19-0009-Revert-ARM-dts-BCM5301X-Fix-DTC-warning-for-NAND-nod.patch b/target/linux/bcm53xx/patches-5.15/033-v5.19-0009-Revert-ARM-dts-BCM5301X-Fix-DTC-warning-for-NAND-nod.patch
new file mode 100644
index 00000000000000..cc7e9741a7a911
--- /dev/null
+++ b/target/linux/bcm53xx/patches-5.15/033-v5.19-0009-Revert-ARM-dts-BCM5301X-Fix-DTC-warning-for-NAND-nod.patch
@@ -0,0 +1,32 @@
+From 18176b9d82eebaf4408dc0440f54d57a8cbced83 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 13 May 2022 11:11:07 +0200
+Subject: [PATCH] Revert "ARM: dts: BCM5301X: Fix DTC warning for NAND node"
+
+This reverts commit 90103611d573, which caused a new DTC warning
+
+arch/arm/boot/dts/bcm953012hr.dts:57.3-33: Warning (reg_format): /nand-controller@18028000/nand@0/partition@0:reg: property has invalid length (8 bytes) (#address-cells == 2, #size-cells == 1)
+arch/arm/boot/dts/bcm953012hr.dts:62.3-33: Warning (reg_format): /nand-controller@18028000/nand@0/partition@200000:reg: property has invalid length (8 bytes) (#address-cells == 2, #size-cells == 1)
+arch/arm/boot/dts/bcm953012hr.dts:66.3-33: Warning (reg_format): /nand-controller@18028000/nand@0/partition@600000:reg: property has invalid length (8 bytes) (#address-cells == 2, #size-cells == 1)
+arch/arm/boot/dts/bcm953012hr.dts:70.3-33: Warning (reg_format): /nand-controller@18028000/nand@0/partition@1000000:reg: property has invalid length (8 bytes) (#address-cells == 2, #size-cells == 1)
+arch/arm/boot/dts/bcm953012hr.dtb: Warning (pci_device_reg): Failed prerequisite 'reg_format'
+arch/arm/boot/dts/bcm953012hr.dtb: Warning (pci_device_bus_num): Failed prerequisite 'reg_format'
+arch/arm/boot/dts/bcm953012hr.dtb: Warning (i2c_bus_reg): Failed prerequisite 'reg_format'
+arch/arm/boot/dts/bcm953012hr.dtb: Warning (spi_bus_reg): Failed prerequisite 'reg_format'
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+---
+ arch/arm/boot/dts/bcm5301x-nand-cs0.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/boot/dts/bcm5301x-nand-cs0.dtsi
++++ b/arch/arm/boot/dts/bcm5301x-nand-cs0.dtsi
+@@ -10,6 +10,8 @@
+ 		nandcs: nand@0 {
+ 			compatible = "brcm,nandcs";
+ 			reg = <0>;
++			#address-cells = <1>;
++			#size-cells = <1>;
+ 
+ 			partitions {
+ 				compatible = "brcm,bcm947xx-cfe-partitions";
diff --git a/target/linux/bcm53xx/patches-5.15/034-v6.0-0001-ARM-dts-broadcom-align-gpio-key-node-names-with-dtsc.patch b/target/linux/bcm53xx/patches-5.15/034-v6.0-0001-ARM-dts-broadcom-align-gpio-key-node-names-with-dtsc.patch
new file mode 100644
index 00000000000000..33d675297e3b65
--- /dev/null
+++ b/target/linux/bcm53xx/patches-5.15/034-v6.0-0001-ARM-dts-broadcom-align-gpio-key-node-names-with-dtsc.patch
@@ -0,0 +1,912 @@
+From c5aec5611aec8fb1ca68f68e41acaefccfc93c16 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Thu, 9 Jun 2022 13:39:30 +0200
+Subject: [PATCH] ARM: dts: broadcom: align gpio-key node names with dtschema
+
+The node names should be generic and DT schema expects certain pattern
+(e.g. with key/button/switch).
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts          |  6 +++---
+ arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts          |  8 ++++----
+ .../boot/dts/bcm4708-buffalo-wzr-1166dhp-common.dtsi | 10 +++++-----
+ arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts    | 10 +++++-----
+ arch/arm/boot/dts/bcm4708-linksys-ea6300-v1.dts      |  4 ++--
+ arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts      |  4 ++--
+ arch/arm/boot/dts/bcm4708-luxul-xap-1510.dts         |  2 +-
+ arch/arm/boot/dts/bcm4708-luxul-xwc-1000.dts         |  2 +-
+ arch/arm/boot/dts/bcm4708-netgear-r6250.dts          |  6 +++---
+ arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts       |  6 +++---
+ arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts        |  6 +++---
+ arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts          |  4 ++--
+ arch/arm/boot/dts/bcm47081-buffalo-wzr-600dhp2.dts   |  8 ++++----
+ arch/arm/boot/dts/bcm47081-buffalo-wzr-900dhp.dts    |  2 +-
+ arch/arm/boot/dts/bcm47081-luxul-xap-1410.dts        |  2 +-
+ arch/arm/boot/dts/bcm47081-luxul-xwr-1200.dts        |  2 +-
+ arch/arm/boot/dts/bcm47081-tplink-archer-c5-v2.dts   |  4 ++--
+ arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts          |  4 ++--
+ arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts    | 12 ++++++------
+ arch/arm/boot/dts/bcm4709-linksys-ea9200.dts         |  4 ++--
+ arch/arm/boot/dts/bcm4709-netgear-r7000.dts          |  6 +++---
+ arch/arm/boot/dts/bcm4709-netgear-r8000.dts          |  8 ++++----
+ arch/arm/boot/dts/bcm4709-tplink-archer-c9-v1.dts    |  4 ++--
+ arch/arm/boot/dts/bcm47094-asus-rt-ac88u.dts         |  8 ++++----
+ arch/arm/boot/dts/bcm47094-dlink-dir-885l.dts        |  6 +++---
+ arch/arm/boot/dts/bcm47094-linksys-panamera.dts      |  6 +++---
+ arch/arm/boot/dts/bcm47094-luxul-abr-4500.dts        |  2 +-
+ arch/arm/boot/dts/bcm47094-luxul-xap-1610.dts        |  2 +-
+ arch/arm/boot/dts/bcm47094-luxul-xbr-4500.dts        |  2 +-
+ arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dts        |  2 +-
+ arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts        |  2 +-
+ arch/arm/boot/dts/bcm47094-luxul-xwr-3150-v1.dts     |  2 +-
+ arch/arm/boot/dts/bcm47094-netgear-r8500.dts         |  8 ++++----
+ arch/arm/boot/dts/bcm47094-phicomm-k3.dts            |  2 +-
+ arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts        |  2 +-
+ arch/arm/boot/dts/bcm47189-luxul-xap-810.dts         |  2 +-
+ arch/arm/boot/dts/bcm47189-tenda-ac9.dts             |  6 +++---
+ arch/arm/boot/dts/bcm53016-meraki-mr32.dts           |  2 +-
+ arch/arm/boot/dts/bcm911360_entphn.dts               |  4 ++--
+ arch/arm/boot/dts/bcm947189acdbmr.dts                |  4 ++--
+ arch/arm/boot/dts/bcm953012er.dts                    |  4 ++--
+ arch/arm/boot/dts/bcm958625-meraki-alamo.dtsi        |  2 +-
+ arch/arm/boot/dts/bcm958625-meraki-kingpin.dtsi      |  2 +-
+ 43 files changed, 97 insertions(+), 97 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts
++++ b/arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts
+@@ -70,19 +70,19 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		rfkill {
++		button-rfkill {
+ 			label = "WiFi";
+ 			linux,code = <KEY_RFKILL>;
+ 			gpios = <&chipcommon 7 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 11 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		wps {
++		button-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 15 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts
++++ b/arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts
+@@ -54,25 +54,25 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		brightness {
++		button-brightness {
+ 			label = "Backlight";
+ 			linux,code = <KEY_BRIGHTNESS_ZERO>;
+ 			gpios = <&chipcommon 5 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		wps {
++		button-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 7 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 11 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		rfkill {
++		button-rfkill {
+ 			label = "WiFi";
+ 			linux,code = <KEY_RFKILL>;
+ 			gpios = <&chipcommon 15 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm4708-buffalo-wzr-1166dhp-common.dtsi
++++ b/arch/arm/boot/dts/bcm4708-buffalo-wzr-1166dhp-common.dtsi
+@@ -104,33 +104,33 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 11 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		aoss {
++		button-aoss {
+ 			label = "AOSS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 12 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+ 		/* Commit mode set by switch? */
+-		mode {
++		button-mode {
+ 			label = "Mode";
+ 			linux,code = <KEY_SETUP>;
+ 			gpios = <&chipcommon 13 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+ 		/* Switch: AP mode */
+-		sw_ap {
++		button-sw-ap {
+ 			label = "AP";
+ 			linux,code = <BTN_0>;
+ 			gpios = <&chipcommon 14 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		eject {
++		button-eject {
+ 			label = "USB eject";
+ 			linux,code = <KEY_EJECTCD>;
+ 			gpios = <&chipcommon 15 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts
++++ b/arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts
+@@ -100,33 +100,33 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 11 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		aoss {
++		button-aoss {
+ 			label = "AOSS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 12 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+ 		/* Commit mode set by switch? */
+-		mode {
++		button-mode {
+ 			label = "Mode";
+ 			linux,code = <KEY_SETUP>;
+ 			gpios = <&chipcommon 13 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+ 		/* Switch: AP mode */
+-		sw_ap {
++		button-sw-ap {
+ 			label = "AP";
+ 			linux,code = <BTN_0>;
+ 			gpios = <&chipcommon 14 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		eject {
++		button-eject {
+ 			label = "USB eject";
+ 			linux,code = <KEY_EJECTCD>;
+ 			gpios = <&chipcommon 15 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm4708-linksys-ea6300-v1.dts
++++ b/arch/arm/boot/dts/bcm4708-linksys-ea6300-v1.dts
+@@ -29,13 +29,13 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		wps {
++		button-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 7 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 11 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts
++++ b/arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts
+@@ -25,13 +25,13 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		wps {
++		button-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 7 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 11 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm4708-luxul-xap-1510.dts
++++ b/arch/arm/boot/dts/bcm4708-luxul-xap-1510.dts
+@@ -45,7 +45,7 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 11 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm4708-luxul-xwc-1000.dts
++++ b/arch/arm/boot/dts/bcm4708-luxul-xwc-1000.dts
+@@ -52,7 +52,7 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 7 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm4708-netgear-r6250.dts
++++ b/arch/arm/boot/dts/bcm4708-netgear-r6250.dts
+@@ -63,19 +63,19 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		wps {
++		button-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 4 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		rfkill {
++		button-rfkill {
+ 			label = "WiFi";
+ 			linux,code = <KEY_RFKILL>;
+ 			gpios = <&chipcommon 5 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 6 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts
++++ b/arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts
+@@ -59,19 +59,19 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		wps {
++		button-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 4 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		rfkill {
++		button-rfkill {
+ 			label = "WiFi";
+ 			linux,code = <KEY_RFKILL>;
+ 			gpios = <&chipcommon 5 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 6 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts
++++ b/arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts
+@@ -94,19 +94,19 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		rfkill {
++		button-rfkill {
+ 			label = "WiFi";
+ 			linux,code = <KEY_RFKILL>;
+ 			gpios = <&chipcommon 0 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		wps {
++		button-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 7 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 11 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts
++++ b/arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts
+@@ -60,13 +60,13 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 7 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		wps {
++		button-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 11 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm47081-buffalo-wzr-600dhp2.dts
++++ b/arch/arm/boot/dts/bcm47081-buffalo-wzr-600dhp2.dts
+@@ -91,26 +91,26 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		aoss {
++		button-aoss {
+ 			label = "AOSS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 9 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 11 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+ 		/* Switch device mode? */
+-		mode {
++		button-mode {
+ 			label = "Mode";
+ 			linux,code = <KEY_SETUP>;
+ 			gpios = <&chipcommon 14 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		eject {
++		button-eject {
+ 			label = "USB eject";
+ 			linux,code = <KEY_EJECTCD>;
+ 			gpios = <&chipcommon 15 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm47081-buffalo-wzr-900dhp.dts
++++ b/arch/arm/boot/dts/bcm47081-buffalo-wzr-900dhp.dts
+@@ -96,7 +96,7 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 11 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm47081-luxul-xap-1410.dts
++++ b/arch/arm/boot/dts/bcm47081-luxul-xap-1410.dts
+@@ -45,7 +45,7 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 11 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm47081-luxul-xwr-1200.dts
++++ b/arch/arm/boot/dts/bcm47081-luxul-xwr-1200.dts
+@@ -94,7 +94,7 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 11 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm47081-tplink-archer-c5-v2.dts
++++ b/arch/arm/boot/dts/bcm47081-tplink-archer-c5-v2.dts
+@@ -77,13 +77,13 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		rfkill {
++		button-rfkill {
+ 			label = "WiFi";
+ 			linux,code = <KEY_RFKILL>;
+ 			gpios = <&chipcommon 3 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 7 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts
++++ b/arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts
+@@ -50,13 +50,13 @@
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 
+-		wps {
++		button-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 2 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 11 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts
++++ b/arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts
+@@ -80,39 +80,39 @@
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 
+-		power {
++		button-power {
+ 			label = "Power";
+ 			linux,code = <KEY_POWER>;
+ 			gpios = <&chipcommon 1 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 15 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		aoss {
++		button-aoss {
+ 			label = "AOSS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 16 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+ 		/* Commit mode set by switch? */
+-		mode {
++		button-mode {
+ 			label = "Mode";
+ 			linux,code = <KEY_SETUP>;
+ 			gpios = <&chipcommon 17 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+ 		/* Switch: AP mode */
+-		sw_ap {
++		button-sw-ap {
+ 			label = "AP";
+ 			linux,code = <BTN_0>;
+ 			gpios = <&chipcommon 18 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		eject {
++		button-eject {
+ 			label = "USB eject";
+ 			linux,code = <KEY_EJECTCD>;
+ 			gpios = <&chipcommon 20 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm4709-linksys-ea9200.dts
++++ b/arch/arm/boot/dts/bcm4709-linksys-ea9200.dts
+@@ -32,13 +32,13 @@
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 
+-		wps {
++		button-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 3 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 17 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm4709-netgear-r7000.dts
++++ b/arch/arm/boot/dts/bcm4709-netgear-r7000.dts
+@@ -75,19 +75,19 @@
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 
+-		wps {
++		button-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 4 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		rfkill {
++		button-rfkill {
+ 			label = "WiFi";
+ 			linux,code = <KEY_RFKILL>;
+ 			gpios = <&chipcommon 5 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 6 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm4709-netgear-r8000.dts
++++ b/arch/arm/boot/dts/bcm4709-netgear-r8000.dts
+@@ -102,25 +102,25 @@
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 
+-		rfkill {
++		button-rfkill {
+ 			label = "WiFi";
+ 			linux,code = <KEY_RFKILL>;
+ 			gpios = <&chipcommon 4 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		wps {
++		button-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 5 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 6 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		brightness {
++		button-brightness {
+ 			label = "Backlight";
+ 			linux,code = <KEY_BRIGHTNESS_ZERO>;
+ 			gpios = <&chipcommon 19 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm4709-tplink-archer-c9-v1.dts
++++ b/arch/arm/boot/dts/bcm4709-tplink-archer-c9-v1.dts
+@@ -80,13 +80,13 @@
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 
+-		wps {
++		button-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 0 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 3 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm47094-asus-rt-ac88u.dts
++++ b/arch/arm/boot/dts/bcm47094-asus-rt-ac88u.dts
+@@ -72,25 +72,25 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		wps {
++		button-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 20 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		reset {
++		button-reset {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 11 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		wifi {
++		button-wifi {
+ 			label = "Wi-Fi";
+ 			linux,code = <KEY_RFKILL>;
+ 			gpios = <&chipcommon 18 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		led {
++		button-led {
+ 			label = "Backlight";
+ 			linux,code = <KEY_BRIGHTNESS_ZERO>;
+ 			gpios = <&chipcommon 4 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm47094-dlink-dir-885l.dts
++++ b/arch/arm/boot/dts/bcm47094-dlink-dir-885l.dts
+@@ -86,20 +86,20 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		wps {
++		button-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 7 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+ 		/* Switch: router / extender */
+-		extender {
++		button-extender {
+ 			label = "Extender";
+ 			linux,code = <BTN_0>;
+ 			gpios = <&chipcommon 10 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 17 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm47094-linksys-panamera.dts
++++ b/arch/arm/boot/dts/bcm47094-linksys-panamera.dts
+@@ -30,19 +30,19 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		wps {
++		button-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 3 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		rfkill {
++		button-rfkill {
+ 				label = "WiFi";
+ 				linux,code = <KEY_RFKILL>;
+ 				gpios = <&chipcommon 16 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		reset {
++		button-reset {
+ 				label = "Reset";
+ 				linux,code = <KEY_RESTART>;
+ 				gpios = <&chipcommon 17 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm47094-luxul-abr-4500.dts
++++ b/arch/arm/boot/dts/bcm47094-luxul-abr-4500.dts
+@@ -49,7 +49,7 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 17 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm47094-luxul-xap-1610.dts
++++ b/arch/arm/boot/dts/bcm47094-luxul-xap-1610.dts
+@@ -43,7 +43,7 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 17 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm47094-luxul-xbr-4500.dts
++++ b/arch/arm/boot/dts/bcm47094-luxul-xbr-4500.dts
+@@ -49,7 +49,7 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 17 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dts
++++ b/arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dts
+@@ -37,7 +37,7 @@
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 19 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts
++++ b/arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts
+@@ -89,7 +89,7 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 17 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm47094-luxul-xwr-3150-v1.dts
++++ b/arch/arm/boot/dts/bcm47094-luxul-xwr-3150-v1.dts
+@@ -67,7 +67,7 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 17 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm47094-netgear-r8500.dts
++++ b/arch/arm/boot/dts/bcm47094-netgear-r8500.dts
+@@ -65,25 +65,25 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		brightness {
++		button-brightness {
+ 			label = "Backlight";
+ 			linux,code = <KEY_BRIGHTNESS_ZERO>;
+ 			gpios = <&chipcommon 1 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 10 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		wps {
++		button-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 14 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		rfkill {
++		button-rfkill {
+ 			label = "WiFi";
+ 			linux,code = <KEY_RFKILL>;
+ 			gpios = <&chipcommon 20 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm47094-phicomm-k3.dts
++++ b/arch/arm/boot/dts/bcm47094-phicomm-k3.dts
+@@ -22,7 +22,7 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 17 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts
++++ b/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts
+@@ -39,7 +39,7 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 7 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts
++++ b/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts
+@@ -49,7 +49,7 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 7 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm47189-tenda-ac9.dts
++++ b/arch/arm/boot/dts/bcm47189-tenda-ac9.dts
+@@ -59,19 +59,19 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		rfkill {
++		button-rfkill {
+ 			label = "WiFi";
+ 			linux,code = <KEY_RFKILL>;
+ 			gpios = <&chipcommon 3 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 7 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		wps {
++		button-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 9 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm53016-meraki-mr32.dts
++++ b/arch/arm/boot/dts/bcm53016-meraki-mr32.dts
+@@ -50,7 +50,7 @@
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 21 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm911360_entphn.dts
++++ b/arch/arm/boot/dts/bcm911360_entphn.dts
+@@ -47,10 +47,10 @@
+ 		stdout-path = "serial0:115200n8";
+ 	};
+ 
+-	gpio_keys {
++	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		hook {
++		button-hook {
+ 			label = "HOOK";
+ 			linux,code = <KEY_O>;
+ 			gpios = <&gpio_asiu 48 0>;
+--- a/arch/arm/boot/dts/bcm947189acdbmr.dts
++++ b/arch/arm/boot/dts/bcm947189acdbmr.dts
+@@ -44,13 +44,13 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 7 GPIO_ACTIVE_HIGH>;
+ 		};
+ 
+-		wps {
++		button-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 9 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm953012er.dts
++++ b/arch/arm/boot/dts/bcm953012er.dts
+@@ -47,13 +47,13 @@
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+ 
+-		wps {
++		button-wps {
+ 			label = "WPS";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&chipcommon 6 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		restart {
++		button-restart {
+ 			label = "Reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&chipcommon 15 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm958625-meraki-alamo.dtsi
++++ b/arch/arm/boot/dts/bcm958625-meraki-alamo.dtsi
+@@ -13,7 +13,7 @@
+ 		autorepeat;
+ 		poll-interval = <20>;
+ 
+-		reset {
++		button-reset {
+ 			label = "reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&gpioa 8 GPIO_ACTIVE_LOW>;
+--- a/arch/arm/boot/dts/bcm958625-meraki-kingpin.dtsi
++++ b/arch/arm/boot/dts/bcm958625-meraki-kingpin.dtsi
+@@ -14,7 +14,7 @@
+ 		autorepeat;
+ 		poll-interval = <20>;
+ 
+-		reset {
++		button-reset {
+ 			label = "reset";
+ 			linux,code = <KEY_RESTART>;
+ 			gpios = <&gpioa 6 GPIO_ACTIVE_LOW>;
diff --git a/target/linux/bcm53xx/patches-5.15/034-v6.0-0002-ARM-dts-broadcom-correct-gpio-keys-properties.patch b/target/linux/bcm53xx/patches-5.15/034-v6.0-0002-ARM-dts-broadcom-correct-gpio-keys-properties.patch
new file mode 100644
index 00000000000000..7bded431b059ec
--- /dev/null
+++ b/target/linux/bcm53xx/patches-5.15/034-v6.0-0002-ARM-dts-broadcom-correct-gpio-keys-properties.patch
@@ -0,0 +1,108 @@
+From d634a6969c03803a945fdc2bccbe7d813420e569 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Thu, 9 Jun 2022 13:39:31 +0200
+Subject: [PATCH] ARM: dts: broadcom: correct gpio-keys properties
+
+gpio-keys children do not use unit addresses.
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts       | 2 --
+ arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts | 2 --
+ arch/arm/boot/dts/bcm4709-linksys-ea9200.dts      | 2 --
+ arch/arm/boot/dts/bcm4709-netgear-r7000.dts       | 2 --
+ arch/arm/boot/dts/bcm4709-netgear-r8000.dts       | 2 --
+ arch/arm/boot/dts/bcm4709-tplink-archer-c9-v1.dts | 2 --
+ arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dts     | 2 --
+ arch/arm/boot/dts/bcm53016-meraki-mr32.dts        | 2 --
+ 8 files changed, 16 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts
++++ b/arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts
+@@ -47,8 +47,6 @@
+ 
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+-		#address-cells = <1>;
+-		#size-cells = <0>;
+ 
+ 		button-wps {
+ 			label = "WPS";
+--- a/arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts
++++ b/arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts
+@@ -77,8 +77,6 @@
+ 
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+-		#address-cells = <1>;
+-		#size-cells = <0>;
+ 
+ 		button-power {
+ 			label = "Power";
+--- a/arch/arm/boot/dts/bcm4709-linksys-ea9200.dts
++++ b/arch/arm/boot/dts/bcm4709-linksys-ea9200.dts
+@@ -29,8 +29,6 @@
+ 
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+-		#address-cells = <1>;
+-		#size-cells = <0>;
+ 
+ 		button-wps {
+ 			label = "WPS";
+--- a/arch/arm/boot/dts/bcm4709-netgear-r7000.dts
++++ b/arch/arm/boot/dts/bcm4709-netgear-r7000.dts
+@@ -72,8 +72,6 @@
+ 
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+-		#address-cells = <1>;
+-		#size-cells = <0>;
+ 
+ 		button-wps {
+ 			label = "WPS";
+--- a/arch/arm/boot/dts/bcm4709-netgear-r8000.dts
++++ b/arch/arm/boot/dts/bcm4709-netgear-r8000.dts
+@@ -99,8 +99,6 @@
+ 
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+-		#address-cells = <1>;
+-		#size-cells = <0>;
+ 
+ 		button-rfkill {
+ 			label = "WiFi";
+--- a/arch/arm/boot/dts/bcm4709-tplink-archer-c9-v1.dts
++++ b/arch/arm/boot/dts/bcm4709-tplink-archer-c9-v1.dts
+@@ -77,8 +77,6 @@
+ 
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+-		#address-cells = <1>;
+-		#size-cells = <0>;
+ 
+ 		button-wps {
+ 			label = "WPS";
+--- a/arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dts
++++ b/arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dts
+@@ -34,8 +34,6 @@
+ 
+ 	gpio-keys {
+ 		compatible = "gpio-keys";
+-		#address-cells = <1>;
+-		#size-cells = <0>;
+ 
+ 		button-restart {
+ 			label = "Reset";
+--- a/arch/arm/boot/dts/bcm53016-meraki-mr32.dts
++++ b/arch/arm/boot/dts/bcm53016-meraki-mr32.dts
+@@ -47,8 +47,6 @@
+ 
+ 	keys {
+ 		compatible = "gpio-keys";
+-		#address-cells = <1>;
+-		#size-cells = <0>;
+ 
+ 		button-restart {
+ 			label = "Reset";
diff --git a/target/linux/bcm53xx/patches-5.15/035-v6.2-0001-ARM-dts-BCM5301X-Correct-description-of-TP-Link-part.patch b/target/linux/bcm53xx/patches-5.15/035-v6.2-0001-ARM-dts-BCM5301X-Correct-description-of-TP-Link-part.patch
new file mode 100644
index 00000000000000..4c4ed036b90266
--- /dev/null
+++ b/target/linux/bcm53xx/patches-5.15/035-v6.2-0001-ARM-dts-BCM5301X-Correct-description-of-TP-Link-part.patch
@@ -0,0 +1,99 @@
+From c8ee9f119bfb4244f76c9971c341ec06b49332cd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 8 Nov 2022 12:07:08 +0100
+Subject: [PATCH] ARM: dts: BCM5301X: Correct description of TP-Link partitions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+TP-Link routers have flash space partitioned according to the partitions
+table. It may look like fixed partitioning but those partitions can be
+actually reorganized. New can be added (or some removed), offsets and
+sizes may change.
+
+Fix DT to use binding for the TP-Link SafeLoader partitioning method.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20221108110708.13693-1-zajec5@gmail.com
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ .../boot/dts/bcm47081-tplink-archer-c5-v2.dts | 25 ++++---------------
+ .../boot/dts/bcm4709-tplink-archer-c9-v1.dts  | 25 ++++---------------
+ 2 files changed, 10 insertions(+), 40 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm47081-tplink-archer-c5-v2.dts
++++ b/arch/arm/boot/dts/bcm47081-tplink-archer-c5-v2.dts
+@@ -95,30 +95,15 @@
+ 	status = "okay";
+ 
+ 	partitions {
+-		compatible = "fixed-partitions";
+-		#address-cells = <1>;
+-		#size-cells = <1>;
++		compatible = "tplink,safeloader-partitions";
++		partitions-table-offset = <0xe50000>;
+ 
+-		boot@0 {
+-			label = "boot";
+-			reg = <0x000000 0x040000>;
+-			read-only;
+-		};
+-
+-		os-image@100000 {
+-			label = "os-image";
+-			reg = <0x040000 0x200000>;
++		partition-os-image {
+ 			compatible = "brcm,trx";
+ 		};
+ 
+-		rootfs@240000 {
+-			label = "rootfs";
+-			reg = <0x240000 0xc00000>;
+-		};
+-
+-		nvram@ff0000 {
+-			label = "nvram";
+-			reg = <0xff0000 0x010000>;
++		partition-file-system {
++			linux,rootfs;
+ 		};
+ 	};
+ };
+--- a/arch/arm/boot/dts/bcm4709-tplink-archer-c9-v1.dts
++++ b/arch/arm/boot/dts/bcm4709-tplink-archer-c9-v1.dts
+@@ -104,30 +104,15 @@
+ 	status = "okay";
+ 
+ 	partitions {
+-		compatible = "fixed-partitions";
+-		#address-cells = <1>;
+-		#size-cells = <1>;
++		compatible = "tplink,safeloader-partitions";
++		partitions-table-offset = <0xe50000>;
+ 
+-		boot@0 {
+-			label = "boot";
+-			reg = <0x000000 0x040000>;
+-			read-only;
+-		};
+-
+-		os-image@100000 {
+-			label = "os-image";
+-			reg = <0x040000 0x200000>;
++		partition-os-image {
+ 			compatible = "brcm,trx";
+ 		};
+ 
+-		rootfs@240000 {
+-			label = "rootfs";
+-			reg = <0x240000 0xc00000>;
+-		};
+-
+-		nvram@ff0000 {
+-			label = "nvram";
+-			reg = <0xff0000 0x010000>;
++		partition-file-system {
++			linux,rootfs;
+ 		};
+ 	};
+ };
diff --git a/target/linux/bcm53xx/patches-5.15/035-v6.2-0001-ARM-dts-bcm47094-Add-devicetree-for-D-Link-DIR-890L.patch b/target/linux/bcm53xx/patches-5.15/035-v6.2-0001-ARM-dts-bcm47094-Add-devicetree-for-D-Link-DIR-890L.patch
new file mode 100644
index 00000000000000..4842e16649612c
--- /dev/null
+++ b/target/linux/bcm53xx/patches-5.15/035-v6.2-0001-ARM-dts-bcm47094-Add-devicetree-for-D-Link-DIR-890L.patch
@@ -0,0 +1,242 @@
+From b1ba87897ceda8e49a47aa92832dd7bff8583e21 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Mon, 7 Nov 2022 14:41:04 +0100
+Subject: [PATCH] ARM: dts: bcm47094: Add devicetree for D-Link DIR-890L
+
+This adds a device tree for the D-Link DIR-890L. This device
+is very similar to D-Link DIR-885L, the differences are detailed
+as a comment in the DTS file.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20221107134104.1422169-2-linus.walleij@linaro.org
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm/boot/dts/Makefile                    |   1 +
+ arch/arm/boot/dts/bcm47094-dlink-dir-890l.dts | 211 ++++++++++++++++++
+ 2 files changed, 212 insertions(+)
+ create mode 100644 arch/arm/boot/dts/bcm47094-dlink-dir-890l.dts
+
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -121,6 +121,7 @@ dtb-$(CONFIG_ARCH_BCM_5301X) += \
+ 	bcm4709-tplink-archer-c9-v1.dtb \
+ 	bcm47094-asus-rt-ac88u.dtb \
+ 	bcm47094-dlink-dir-885l.dtb \
++	bcm47094-dlink-dir-890l.dtb \
+ 	bcm47094-linksys-panamera.dtb \
+ 	bcm47094-luxul-abr-4500.dtb \
+ 	bcm47094-luxul-xap-1610.dtb \
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm47094-dlink-dir-890l.dts
+@@ -0,0 +1,211 @@
++// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
++/*
++ * Device tree for D-Link DIR-890L
++ * D-Link calls this board "WRGAC36"
++ * this router has the same looks and form factor as D-Link DIR-885L.
++ *
++ * Some differences from DIR-885L include a separate USB2 port, separate LEDs
++ * for USB2 and USB3, a separate VCC supply for the USB2 slot and no
++ * router/extender switch is mounted (there is an empty mount point on the
++ * PCB) so this device is a pure router. Also the LAN ports are in the right
++ * order.
++ *
++ * Based on the device tree for DIR-885L
++ * Copyright (C) 2016 Rafał Miłecki <zajec5@gmail.com>
++ * Copyright (C) 2022 Linus Walleij
++ */
++
++/dts-v1/;
++
++#include "bcm47094.dtsi"
++#include "bcm5301x-nand-cs0-bch1.dtsi"
++
++/ {
++	compatible = "dlink,dir-890l", "brcm,bcm47094", "brcm,bcm4708";
++	model = "D-Link DIR-890L";
++
++	chosen {
++		bootargs = "console=ttyS0,115200 earlycon";
++	};
++
++	memory@0 {
++		device_type = "memory";
++		reg = <0x00000000 0x08000000>,
++		      <0x88000000 0x08000000>;
++	};
++
++	leds {
++		/*
++		 * LED information is derived from the boot log which
++		 * conveniently lists all the LEDs.
++		 */
++		compatible = "gpio-leds";
++
++		power-white {
++			label = "bcm53xx:white:power";
++			gpios = <&chipcommon 0 GPIO_ACTIVE_LOW>;
++			linux,default-trigger = "default-on";
++		};
++
++		wan-white {
++			label = "bcm53xx:white:wan";
++			gpios = <&chipcommon 1 GPIO_ACTIVE_LOW>;
++		};
++
++		power-amber {
++			label = "bcm53xx:amber:power";
++			gpios = <&chipcommon 2 GPIO_ACTIVE_LOW>;
++		};
++
++		wan-amber {
++			label = "bcm53xx:amber:wan";
++			gpios = <&chipcommon 3 GPIO_ACTIVE_LOW>;
++		};
++
++		usb3-white {
++			label = "bcm53xx:white:usb3";
++			gpios = <&chipcommon 8 GPIO_ACTIVE_LOW>;
++			trigger-sources = <&xhci_port1>;
++			linux,default-trigger = "usbport";
++		};
++
++		usb2-white {
++			label = "bcm53xx:white:usb2";
++			gpios = <&chipcommon 15 GPIO_ACTIVE_LOW>;
++			trigger-sources = <&ohci_port1>, <&ehci_port1>;
++			linux,default-trigger = "usbport";
++		};
++
++		2ghz {
++			label = "bcm53xx:white:2ghz";
++			gpios = <&chipcommon 13 GPIO_ACTIVE_LOW>;
++		};
++
++		5ghz {
++			label = "bcm53xx:white:5ghz";
++			gpios = <&chipcommon 14 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	gpio-keys {
++		compatible = "gpio-keys";
++
++		button-wps {
++			label = "WPS";
++			linux,code = <KEY_WPS_BUTTON>;
++			gpios = <&chipcommon 7 GPIO_ACTIVE_LOW>;
++		};
++
++		/* Called "factory reset" in the vendor dmesg */
++		button-restart {
++			label = "Reset";
++			linux,code = <KEY_RESTART>;
++			gpios = <&chipcommon 17 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	/*
++	 * The flash memory is memory mapped at 0x1e000000-0x1fffffff
++	 * 64KB blocks; total size 2MB, same that can be
++	 * found attached to the spi_nor SPI controller.
++	 */
++	nvram@1e1f0000 {
++		compatible = "brcm,nvram";
++		reg = <0x1e1f0000 0x00010000>;
++
++		et0macaddr: et0macaddr {
++		};
++	};
++};
++
++&gmac2 {
++	/*
++	 * The NVRAM curiously does not contain a MAC address
++	 * for et2 so since that is the only ethernet interface
++	 * actually in use on the platform, we use this et0 MAC
++	 * address for et2.
++	 */
++	nvmem-cells = <&et0macaddr>;
++	nvmem-cell-names = "mac-address";
++};
++
++&spi_nor {
++	status = "okay";
++};
++
++&nandcs {
++	/* Spansion S34ML01G2, 128MB with 128KB erase blocks */
++	partitions {
++		compatible = "fixed-partitions";
++		#address-cells = <1>;
++		#size-cells = <1>;
++
++		/*
++		 * This is called "nflash" in the vendor kernel with
++		 * "upgrade" and "rootfs" (probably using OpenWrt
++		 * splitpart). We call it "firmware" like standard tools
++		 * assume. The CFE loader contains incorrect information
++		 * about TRX partitions, ignore this, there are no TRX
++		 * partitions: this device uses SEAMA.
++		 */
++		firmware@0 {
++			label = "firmware";
++			reg = <0x00000000 0x08000000>;
++		};
++	};
++};
++
++&usb2 {
++	vcc-gpios = <&chipcommon 21 GPIO_ACTIVE_HIGH>;
++};
++
++&usb3 {
++	vcc-gpios = <&chipcommon 18 GPIO_ACTIVE_HIGH>;
++};
++
++&usb3_phy {
++	status = "okay";
++};
++
++&srab {
++	status = "okay";
++
++	ports {
++		port@0 {
++			reg = <0>;
++			label = "lan1";
++		};
++
++		port@1 {
++			reg = <1>;
++			label = "lan2";
++		};
++
++		port@2 {
++			reg = <2>;
++			label = "lan3";
++		};
++
++		port@3 {
++			reg = <3>;
++			label = "lan4";
++		};
++
++		port@4 {
++			reg = <4>;
++			label = "wan";
++		};
++
++		port@8 {
++			reg = <8>;
++			label = "cpu";
++			ethernet = <&gmac2>;
++			phy-mode = "rgmii";
++
++			fixed-link {
++				speed = <1000>;
++				full-duplex;
++			};
++		};
++	};
++};
diff --git a/target/linux/bcm53xx/patches-5.15/035-v6.2-0001-ARM-dts-bcm53016-Add-devicetree-for-D-Link-DWL-8610A.patch b/target/linux/bcm53xx/patches-5.15/035-v6.2-0001-ARM-dts-bcm53016-Add-devicetree-for-D-Link-DWL-8610A.patch
new file mode 100644
index 00000000000000..b7528e9f716b55
--- /dev/null
+++ b/target/linux/bcm53xx/patches-5.15/035-v6.2-0001-ARM-dts-bcm53016-Add-devicetree-for-D-Link-DWL-8610A.patch
@@ -0,0 +1,165 @@
+From 9f66e1dd82e3186aee95282657512ca2aef1afe0 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Wed, 19 Oct 2022 21:34:49 +0200
+Subject: [PATCH] ARM: dts: bcm53016: Add devicetree for D-Link DWL-8610AP
+
+This adds a device tree for the BCM53016-based D-Link DWL-8610AP
+access point wireless router.
+
+The TRX-format partitions had to be named "firmware" due to
+an OpenWrt patch that only accepts parting such nodes if they
+are named "firmware".
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20221019193449.3036010-2-linus.walleij@linaro.org
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm/boot/dts/Makefile                    |   1 +
+ .../boot/dts/bcm53016-dlink-dwl-8610ap.dts    | 131 ++++++++++++++++++
+ 2 files changed, 132 insertions(+)
+ create mode 100644 arch/arm/boot/dts/bcm53016-dlink-dwl-8610ap.dts
+
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -132,6 +132,7 @@ dtb-$(CONFIG_ARCH_BCM_5301X) += \
+ 	bcm47094-netgear-r8500.dtb \
+ 	bcm47094-phicomm-k3.dtb \
+ 	bcm53015-meraki-mr26.dtb \
++	bcm53016-dlink-dwl-8610ap.dtb \
+ 	bcm53016-meraki-mr32.dtb \
+ 	bcm94708.dtb \
+ 	bcm94709.dtb \
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm53016-dlink-dwl-8610ap.dts
+@@ -0,0 +1,131 @@
++// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
++/dts-v1/;
++
++#include "bcm4709.dtsi"
++#include "bcm5301x-nand-cs0-bch8.dtsi"
++#include <dt-bindings/leds/common.h>
++#include <dt-bindings/input/input.h>
++
++/ {
++	model = "D-Link DWL-8610AP";
++	compatible = "dlink,dwl-8610ap", "brcm,bcm53016", "brcm,bcm4708";
++
++	memory@0 {
++		device_type = "memory";
++		/* 512 MB RAM in 2 x Macronix D9PSH chips */
++		reg = <0x00000000 0x08000000>,
++		      <0x88000000 0x08000000>;
++	};
++
++	leds {
++		compatible = "gpio-leds";
++
++		power {
++			function = LED_FUNCTION_POWER;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&chipcommon 0 GPIO_ACTIVE_LOW>;
++			default-state = "on";
++		};
++
++		diag {
++			/* Actually "diag" unclear what this means */
++			function = LED_FUNCTION_INDICATOR;
++			color = <LED_COLOR_ID_RED>;
++			gpios = <&chipcommon 1 GPIO_ACTIVE_LOW>;
++			default-state = "on";
++			linux,default-trigger = "heartbeat";
++		};
++
++		wlan-2g {
++			function = LED_FUNCTION_WLAN;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&chipcommon 5 GPIO_ACTIVE_LOW>;
++		};
++
++		wlan-5g {
++			function = LED_FUNCTION_WLAN;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&chipcommon 8 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	gpio_keys {
++		compatible = "gpio-keys";
++
++		button-reset {
++			debounce-interval = <100>;
++			wakeup-source;
++			linux,code = <KEY_RESTART>;
++			label = "reset";
++			/* This GPIO is actually stored in NVRAM, but it's not gonna change */
++			gpios = <&chipcommon 4 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	/*
++	 * Flash memory at 0x1e000000-0x1fffffff
++	 * Macronix 32 64KB blocks; total size 2MB, same that can be
++	 * found attached to the spi_nor SPI controller.
++	 */
++	nvram@1e080000 {
++		compatible = "brcm,nvram";
++		reg = <0x1e080000 0x00020000>;
++
++		et0macaddr: et0macaddr {
++		};
++
++		et1macaddr: et1macaddr {
++		};
++	};
++};
++
++&gmac0 {
++	nvmem-cells = <&et0macaddr>;
++	nvmem-cell-names = "mac-address";
++};
++
++&gmac1 {
++	nvmem-cells = <&et1macaddr>;
++	nvmem-cell-names = "mac-address";
++};
++
++&spi_nor {
++	/* Serial SPI NOR Flash MX 25L1606E */
++	status = "okay";
++};
++
++&nandcs {
++	/*
++	 * Spansion S34ML01G100TFI00 128 MB NAND Flash memory
++	 *
++	 * This ECC is a bit unorthodox but it is what the stock firmware
++	 * is using, so to be able to mount the original partitions
++	 * this is necessary.
++	 */
++	nand-ecc-strength = <5>;
++	partitions {
++		compatible = "fixed-partitions";
++		#address-cells = <1>;
++		#size-cells = <1>;
++
++		/* This is named nflash1.trx in CFE */
++		trx@0 {
++			label = "firmware";
++			reg = <0x00000000 0x02800000>;
++			compatible = "brcm,trx";
++		};
++
++		/* This is named nflash1.trx2 in CFE */
++		trx2@2800000 {
++			label = "firmware2";
++			reg = <0x02800000 0x02800000>;
++			compatible = "brcm,trx";
++		};
++
++		/* This is named nflash1.rwfs in CFE */
++		free@5000000 {
++			label = "free";
++			reg = <0x05000000 0x03000000>;
++		};
++	};
++};
diff --git a/target/linux/bcm53xx/patches-5.15/036-v6.2-bcma-support-SPROM-rev-11.patch b/target/linux/bcm53xx/patches-5.15/036-v6.2-bcma-support-SPROM-rev-11.patch
new file mode 100644
index 00000000000000..5ebc78ca2023b4
--- /dev/null
+++ b/target/linux/bcm53xx/patches-5.15/036-v6.2-bcma-support-SPROM-rev-11.patch
@@ -0,0 +1,28 @@
+From b9457a04eb89645049fdf427c13e6a18d5501895 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Tue, 11 Oct 2022 14:24:40 +0200
+Subject: [PATCH] bcma: support SPROM rev 11
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Rev 11 works fine for me to set the MAC address of gmac0 and
+gmac1 in the D-Link DWL-8610AP.
+
+Cc: Rafał Miłecki <zajec5@gmail.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+---
+ drivers/bcma/sprom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/bcma/sprom.c
++++ b/drivers/bcma/sprom.c
+@@ -170,7 +170,7 @@ static int bcma_sprom_valid(struct bcma_
+ 		return err;
+ 
+ 	revision = sprom[words - 1] & SSB_SPROM_REVISION_REV;
+-	if (revision != 8 && revision != 9 && revision != 10) {
++	if (revision < 8 || revision > 11) {
+ 		pr_err("Unsupported SPROM revision: %d\n", revision);
+ 		return -ENOENT;
+ 	}
diff --git a/target/linux/bcm53xx/patches-5.15/180-usb-xhci-add-support-for-performing-fake-doorbell.patch b/target/linux/bcm53xx/patches-5.15/180-usb-xhci-add-support-for-performing-fake-doorbell.patch
index 285dd8df84a929..bcf4776c12a9e3 100644
--- a/target/linux/bcm53xx/patches-5.15/180-usb-xhci-add-support-for-performing-fake-doorbell.patch
+++ b/target/linux/bcm53xx/patches-5.15/180-usb-xhci-add-support-for-performing-fake-doorbell.patch
@@ -40,7 +40,7 @@ it on BCM4708 family.
  /* called during probe() after chip reset completes */
 --- a/drivers/usb/host/xhci.c
 +++ b/drivers/usb/host/xhci.c
-@@ -157,6 +157,49 @@ int xhci_start(struct xhci_hcd *xhci)
+@@ -158,6 +158,49 @@ int xhci_start(struct xhci_hcd *xhci)
  	return ret;
  }
  
@@ -90,7 +90,7 @@ it on BCM4708 family.
  /*
   * Reset a halted HC.
   *
-@@ -607,10 +650,20 @@ static int xhci_init(struct usb_hcd *hcd
+@@ -611,10 +654,20 @@ static int xhci_init(struct usb_hcd *hcd
  
  static int xhci_run_finished(struct xhci_hcd *xhci)
  {
@@ -114,7 +114,7 @@ it on BCM4708 family.
  	xhci->shared_hcd->state = HC_STATE_RUNNING;
  	xhci->cmd_ring_state = CMD_RING_STATE_RUNNING;
  
-@@ -620,6 +673,10 @@ static int xhci_run_finished(struct xhci
+@@ -624,6 +677,10 @@ static int xhci_run_finished(struct xhci
  	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
  			"Finished xhci_run for USB3 roothub");
  	return 0;
@@ -127,11 +127,11 @@ it on BCM4708 family.
  /*
 --- a/drivers/usb/host/xhci.h
 +++ b/drivers/usb/host/xhci.h
-@@ -1903,6 +1903,7 @@ struct xhci_hcd {
- #define XHCI_NO_SOFT_RETRY	BIT_ULL(40)
- #define XHCI_BROKEN_D3COLD	BIT_ULL(41)
+@@ -1906,6 +1906,7 @@ struct xhci_hcd {
  #define XHCI_EP_CTX_BROKEN_DCS	BIT_ULL(42)
-+#define XHCI_FAKE_DOORBELL	BIT_ULL(44)
+ #define XHCI_SUSPEND_RESUME_CLKS	BIT_ULL(43)
+ #define XHCI_RESET_TO_DEFAULT	BIT_ULL(44)
++#define XHCI_FAKE_DOORBELL	BIT_ULL(45)
  
  	unsigned int		num_active_eps;
  	unsigned int		limit_active_eps;
diff --git a/target/linux/bcm53xx/patches-5.15/304-ARM-dts-BCM5301X-Specify-switch-ports-for-remaining-.patch b/target/linux/bcm53xx/patches-5.15/304-ARM-dts-BCM5301X-Specify-switch-ports-for-remaining-.patch
index d20fe71d483483..0fb29e99d34f71 100644
--- a/target/linux/bcm53xx/patches-5.15/304-ARM-dts-BCM5301X-Specify-switch-ports-for-remaining-.patch
+++ b/target/linux/bcm53xx/patches-5.15/304-ARM-dts-BCM5301X-Specify-switch-ports-for-remaining-.patch
@@ -311,7 +311,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
 +};
 --- a/arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts
 +++ b/arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts
-@@ -68,6 +68,38 @@
+@@ -66,6 +66,38 @@
  	status = "okay";
  };
  
@@ -352,7 +352,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  		compatible = "fixed-partitions";
 --- a/arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts
 +++ b/arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts
-@@ -132,3 +132,40 @@
+@@ -130,3 +130,40 @@
  &usb3_phy {
  	status = "okay";
  };
@@ -395,7 +395,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
 +};
 --- a/arch/arm/boot/dts/bcm4709-linksys-ea9200.dts
 +++ b/arch/arm/boot/dts/bcm4709-linksys-ea9200.dts
-@@ -49,3 +49,45 @@
+@@ -47,3 +47,45 @@
  &usb3_phy {
  	status = "okay";
  };
@@ -443,7 +443,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
 +};
 --- a/arch/arm/boot/dts/bcm4709-netgear-r7000.dts
 +++ b/arch/arm/boot/dts/bcm4709-netgear-r7000.dts
-@@ -106,3 +106,40 @@
+@@ -104,3 +104,40 @@
  &usb3_phy {
  	status = "okay";
  };
@@ -621,7 +621,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  
 --- a/arch/arm/boot/dts/bcm4709-tplink-archer-c9-v1.dts
 +++ b/arch/arm/boot/dts/bcm4709-tplink-archer-c9-v1.dts
-@@ -102,6 +102,43 @@
+@@ -100,6 +100,43 @@
  	vcc-gpio = <&chipcommon 12 GPIO_ACTIVE_HIGH>;
  };
  
diff --git a/target/linux/bcm53xx/patches-5.15/310-ARM-BCM5301X-Add-DT-for-Netgear-R7900.patch b/target/linux/bcm53xx/patches-5.15/310-ARM-BCM5301X-Add-DT-for-Netgear-R7900.patch
index c4de90760ecd79..e76a12fe1b3346 100644
--- a/target/linux/bcm53xx/patches-5.15/310-ARM-BCM5301X-Add-DT-for-Netgear-R7900.patch
+++ b/target/linux/bcm53xx/patches-5.15/310-ARM-BCM5301X-Add-DT-for-Netgear-R7900.patch
@@ -9,7 +9,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
 
 --- a/arch/arm/boot/dts/Makefile
 +++ b/arch/arm/boot/dts/Makefile
-@@ -115,6 +115,7 @@ dtb-$(CONFIG_ARCH_BCM_5301X) += \
+@@ -117,6 +117,7 @@ dtb-$(CONFIG_ARCH_BCM_5301X) += \
  	bcm4709-buffalo-wxr-1900dhp.dtb \
  	bcm4709-linksys-ea9200.dtb \
  	bcm4709-netgear-r7000.dtb \
diff --git a/target/linux/bcm53xx/patches-5.15/315-ARM-dts-BCM5301X-Extend-RAM-to-full-256MB-for-Linksy.patch b/target/linux/bcm53xx/patches-5.15/315-ARM-dts-BCM5301X-Extend-RAM-to-full-256MB-for-Linksy.patch
new file mode 100644
index 00000000000000..068d676962814a
--- /dev/null
+++ b/target/linux/bcm53xx/patches-5.15/315-ARM-dts-BCM5301X-Extend-RAM-to-full-256MB-for-Linksy.patch
@@ -0,0 +1,27 @@
+From e492f69e4da879db7b3e9a2290e5b6620f1335b5 Mon Sep 17 00:00:00 2001
+From: Aleksey Nasibulin <alealexpro100@ya.ru>
+Date: Thu, 13 Oct 2022 08:16:51 +0000
+Subject: [PATCH] ARM: dts: BCM5301X: Extend RAM to full 256MB for Linksys
+ EA6500 V2
+
+Linksys ea6500-v2 have 256MB of ram. Currently we only use 128MB.
+Expand the definition to use all the available RAM.
+
+Fixes: 03e96644d7a8 ("ARM: dts: BCM5301X: Add basic DT for Linksys EA6500 V2")
+Signed-off-by: Aleksey Nasibulin <alealexpro100@ya.ru>
+---
+ arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts
++++ b/arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts
+@@ -19,7 +19,8 @@
+ 
+ 	memory@0 {
+ 		device_type = "memory";
+-		reg = <0x00000000 0x08000000>;
++		reg = <0x00000000 0x08000000>,
++		      <0x88000000 0x08000000>;
+ 	};
+ 
+ 	gpio-keys {
diff --git a/target/linux/bcm53xx/patches-6.1/035-v6.2-0001-ARM-dts-BCM5301X-Correct-description-of-TP-Link-part.patch b/target/linux/bcm53xx/patches-6.1/035-v6.2-0001-ARM-dts-BCM5301X-Correct-description-of-TP-Link-part.patch
new file mode 100644
index 00000000000000..4c4ed036b90266
--- /dev/null
+++ b/target/linux/bcm53xx/patches-6.1/035-v6.2-0001-ARM-dts-BCM5301X-Correct-description-of-TP-Link-part.patch
@@ -0,0 +1,99 @@
+From c8ee9f119bfb4244f76c9971c341ec06b49332cd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 8 Nov 2022 12:07:08 +0100
+Subject: [PATCH] ARM: dts: BCM5301X: Correct description of TP-Link partitions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+TP-Link routers have flash space partitioned according to the partitions
+table. It may look like fixed partitioning but those partitions can be
+actually reorganized. New can be added (or some removed), offsets and
+sizes may change.
+
+Fix DT to use binding for the TP-Link SafeLoader partitioning method.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20221108110708.13693-1-zajec5@gmail.com
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ .../boot/dts/bcm47081-tplink-archer-c5-v2.dts | 25 ++++---------------
+ .../boot/dts/bcm4709-tplink-archer-c9-v1.dts  | 25 ++++---------------
+ 2 files changed, 10 insertions(+), 40 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm47081-tplink-archer-c5-v2.dts
++++ b/arch/arm/boot/dts/bcm47081-tplink-archer-c5-v2.dts
+@@ -95,30 +95,15 @@
+ 	status = "okay";
+ 
+ 	partitions {
+-		compatible = "fixed-partitions";
+-		#address-cells = <1>;
+-		#size-cells = <1>;
++		compatible = "tplink,safeloader-partitions";
++		partitions-table-offset = <0xe50000>;
+ 
+-		boot@0 {
+-			label = "boot";
+-			reg = <0x000000 0x040000>;
+-			read-only;
+-		};
+-
+-		os-image@100000 {
+-			label = "os-image";
+-			reg = <0x040000 0x200000>;
++		partition-os-image {
+ 			compatible = "brcm,trx";
+ 		};
+ 
+-		rootfs@240000 {
+-			label = "rootfs";
+-			reg = <0x240000 0xc00000>;
+-		};
+-
+-		nvram@ff0000 {
+-			label = "nvram";
+-			reg = <0xff0000 0x010000>;
++		partition-file-system {
++			linux,rootfs;
+ 		};
+ 	};
+ };
+--- a/arch/arm/boot/dts/bcm4709-tplink-archer-c9-v1.dts
++++ b/arch/arm/boot/dts/bcm4709-tplink-archer-c9-v1.dts
+@@ -104,30 +104,15 @@
+ 	status = "okay";
+ 
+ 	partitions {
+-		compatible = "fixed-partitions";
+-		#address-cells = <1>;
+-		#size-cells = <1>;
++		compatible = "tplink,safeloader-partitions";
++		partitions-table-offset = <0xe50000>;
+ 
+-		boot@0 {
+-			label = "boot";
+-			reg = <0x000000 0x040000>;
+-			read-only;
+-		};
+-
+-		os-image@100000 {
+-			label = "os-image";
+-			reg = <0x040000 0x200000>;
++		partition-os-image {
+ 			compatible = "brcm,trx";
+ 		};
+ 
+-		rootfs@240000 {
+-			label = "rootfs";
+-			reg = <0x240000 0xc00000>;
+-		};
+-
+-		nvram@ff0000 {
+-			label = "nvram";
+-			reg = <0xff0000 0x010000>;
++		partition-file-system {
++			linux,rootfs;
+ 		};
+ 	};
+ };
diff --git a/target/linux/bcm53xx/patches-6.1/035-v6.2-0001-ARM-dts-bcm47094-Add-devicetree-for-D-Link-DIR-890L.patch b/target/linux/bcm53xx/patches-6.1/035-v6.2-0001-ARM-dts-bcm47094-Add-devicetree-for-D-Link-DIR-890L.patch
new file mode 100644
index 00000000000000..21bb94fcc34e69
--- /dev/null
+++ b/target/linux/bcm53xx/patches-6.1/035-v6.2-0001-ARM-dts-bcm47094-Add-devicetree-for-D-Link-DIR-890L.patch
@@ -0,0 +1,242 @@
+From b1ba87897ceda8e49a47aa92832dd7bff8583e21 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Mon, 7 Nov 2022 14:41:04 +0100
+Subject: [PATCH] ARM: dts: bcm47094: Add devicetree for D-Link DIR-890L
+
+This adds a device tree for the D-Link DIR-890L. This device
+is very similar to D-Link DIR-885L, the differences are detailed
+as a comment in the DTS file.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20221107134104.1422169-2-linus.walleij@linaro.org
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm/boot/dts/Makefile                    |   1 +
+ arch/arm/boot/dts/bcm47094-dlink-dir-890l.dts | 211 ++++++++++++++++++
+ 2 files changed, 212 insertions(+)
+ create mode 100644 arch/arm/boot/dts/bcm47094-dlink-dir-890l.dts
+
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -129,6 +129,7 @@ dtb-$(CONFIG_ARCH_BCM_5301X) += \
+ 	bcm4709-tplink-archer-c9-v1.dtb \
+ 	bcm47094-asus-rt-ac88u.dtb \
+ 	bcm47094-dlink-dir-885l.dtb \
++	bcm47094-dlink-dir-890l.dtb \
+ 	bcm47094-linksys-panamera.dtb \
+ 	bcm47094-luxul-abr-4500.dtb \
+ 	bcm47094-luxul-xap-1610.dtb \
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm47094-dlink-dir-890l.dts
+@@ -0,0 +1,211 @@
++// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
++/*
++ * Device tree for D-Link DIR-890L
++ * D-Link calls this board "WRGAC36"
++ * this router has the same looks and form factor as D-Link DIR-885L.
++ *
++ * Some differences from DIR-885L include a separate USB2 port, separate LEDs
++ * for USB2 and USB3, a separate VCC supply for the USB2 slot and no
++ * router/extender switch is mounted (there is an empty mount point on the
++ * PCB) so this device is a pure router. Also the LAN ports are in the right
++ * order.
++ *
++ * Based on the device tree for DIR-885L
++ * Copyright (C) 2016 Rafał Miłecki <zajec5@gmail.com>
++ * Copyright (C) 2022 Linus Walleij
++ */
++
++/dts-v1/;
++
++#include "bcm47094.dtsi"
++#include "bcm5301x-nand-cs0-bch1.dtsi"
++
++/ {
++	compatible = "dlink,dir-890l", "brcm,bcm47094", "brcm,bcm4708";
++	model = "D-Link DIR-890L";
++
++	chosen {
++		bootargs = "console=ttyS0,115200 earlycon";
++	};
++
++	memory@0 {
++		device_type = "memory";
++		reg = <0x00000000 0x08000000>,
++		      <0x88000000 0x08000000>;
++	};
++
++	leds {
++		/*
++		 * LED information is derived from the boot log which
++		 * conveniently lists all the LEDs.
++		 */
++		compatible = "gpio-leds";
++
++		power-white {
++			label = "bcm53xx:white:power";
++			gpios = <&chipcommon 0 GPIO_ACTIVE_LOW>;
++			linux,default-trigger = "default-on";
++		};
++
++		wan-white {
++			label = "bcm53xx:white:wan";
++			gpios = <&chipcommon 1 GPIO_ACTIVE_LOW>;
++		};
++
++		power-amber {
++			label = "bcm53xx:amber:power";
++			gpios = <&chipcommon 2 GPIO_ACTIVE_LOW>;
++		};
++
++		wan-amber {
++			label = "bcm53xx:amber:wan";
++			gpios = <&chipcommon 3 GPIO_ACTIVE_LOW>;
++		};
++
++		usb3-white {
++			label = "bcm53xx:white:usb3";
++			gpios = <&chipcommon 8 GPIO_ACTIVE_LOW>;
++			trigger-sources = <&xhci_port1>;
++			linux,default-trigger = "usbport";
++		};
++
++		usb2-white {
++			label = "bcm53xx:white:usb2";
++			gpios = <&chipcommon 15 GPIO_ACTIVE_LOW>;
++			trigger-sources = <&ohci_port1>, <&ehci_port1>;
++			linux,default-trigger = "usbport";
++		};
++
++		2ghz {
++			label = "bcm53xx:white:2ghz";
++			gpios = <&chipcommon 13 GPIO_ACTIVE_LOW>;
++		};
++
++		5ghz {
++			label = "bcm53xx:white:5ghz";
++			gpios = <&chipcommon 14 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	gpio-keys {
++		compatible = "gpio-keys";
++
++		button-wps {
++			label = "WPS";
++			linux,code = <KEY_WPS_BUTTON>;
++			gpios = <&chipcommon 7 GPIO_ACTIVE_LOW>;
++		};
++
++		/* Called "factory reset" in the vendor dmesg */
++		button-restart {
++			label = "Reset";
++			linux,code = <KEY_RESTART>;
++			gpios = <&chipcommon 17 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	/*
++	 * The flash memory is memory mapped at 0x1e000000-0x1fffffff
++	 * 64KB blocks; total size 2MB, same that can be
++	 * found attached to the spi_nor SPI controller.
++	 */
++	nvram@1e1f0000 {
++		compatible = "brcm,nvram";
++		reg = <0x1e1f0000 0x00010000>;
++
++		et0macaddr: et0macaddr {
++		};
++	};
++};
++
++&gmac2 {
++	/*
++	 * The NVRAM curiously does not contain a MAC address
++	 * for et2 so since that is the only ethernet interface
++	 * actually in use on the platform, we use this et0 MAC
++	 * address for et2.
++	 */
++	nvmem-cells = <&et0macaddr>;
++	nvmem-cell-names = "mac-address";
++};
++
++&spi_nor {
++	status = "okay";
++};
++
++&nandcs {
++	/* Spansion S34ML01G2, 128MB with 128KB erase blocks */
++	partitions {
++		compatible = "fixed-partitions";
++		#address-cells = <1>;
++		#size-cells = <1>;
++
++		/*
++		 * This is called "nflash" in the vendor kernel with
++		 * "upgrade" and "rootfs" (probably using OpenWrt
++		 * splitpart). We call it "firmware" like standard tools
++		 * assume. The CFE loader contains incorrect information
++		 * about TRX partitions, ignore this, there are no TRX
++		 * partitions: this device uses SEAMA.
++		 */
++		firmware@0 {
++			label = "firmware";
++			reg = <0x00000000 0x08000000>;
++		};
++	};
++};
++
++&usb2 {
++	vcc-gpios = <&chipcommon 21 GPIO_ACTIVE_HIGH>;
++};
++
++&usb3 {
++	vcc-gpios = <&chipcommon 18 GPIO_ACTIVE_HIGH>;
++};
++
++&usb3_phy {
++	status = "okay";
++};
++
++&srab {
++	status = "okay";
++
++	ports {
++		port@0 {
++			reg = <0>;
++			label = "lan1";
++		};
++
++		port@1 {
++			reg = <1>;
++			label = "lan2";
++		};
++
++		port@2 {
++			reg = <2>;
++			label = "lan3";
++		};
++
++		port@3 {
++			reg = <3>;
++			label = "lan4";
++		};
++
++		port@4 {
++			reg = <4>;
++			label = "wan";
++		};
++
++		port@8 {
++			reg = <8>;
++			label = "cpu";
++			ethernet = <&gmac2>;
++			phy-mode = "rgmii";
++
++			fixed-link {
++				speed = <1000>;
++				full-duplex;
++			};
++		};
++	};
++};
diff --git a/target/linux/bcm53xx/patches-6.1/035-v6.2-0001-ARM-dts-bcm53016-Add-devicetree-for-D-Link-DWL-8610A.patch b/target/linux/bcm53xx/patches-6.1/035-v6.2-0001-ARM-dts-bcm53016-Add-devicetree-for-D-Link-DWL-8610A.patch
new file mode 100644
index 00000000000000..cd2423183906c6
--- /dev/null
+++ b/target/linux/bcm53xx/patches-6.1/035-v6.2-0001-ARM-dts-bcm53016-Add-devicetree-for-D-Link-DWL-8610A.patch
@@ -0,0 +1,165 @@
+From 9f66e1dd82e3186aee95282657512ca2aef1afe0 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Wed, 19 Oct 2022 21:34:49 +0200
+Subject: [PATCH] ARM: dts: bcm53016: Add devicetree for D-Link DWL-8610AP
+
+This adds a device tree for the BCM53016-based D-Link DWL-8610AP
+access point wireless router.
+
+The TRX-format partitions had to be named "firmware" due to
+an OpenWrt patch that only accepts parting such nodes if they
+are named "firmware".
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20221019193449.3036010-2-linus.walleij@linaro.org
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm/boot/dts/Makefile                    |   1 +
+ .../boot/dts/bcm53016-dlink-dwl-8610ap.dts    | 131 ++++++++++++++++++
+ 2 files changed, 132 insertions(+)
+ create mode 100644 arch/arm/boot/dts/bcm53016-dlink-dwl-8610ap.dts
+
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -140,6 +140,7 @@ dtb-$(CONFIG_ARCH_BCM_5301X) += \
+ 	bcm47094-netgear-r8500.dtb \
+ 	bcm47094-phicomm-k3.dtb \
+ 	bcm53015-meraki-mr26.dtb \
++	bcm53016-dlink-dwl-8610ap.dtb \
+ 	bcm53016-meraki-mr32.dtb \
+ 	bcm94708.dtb \
+ 	bcm94709.dtb \
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm53016-dlink-dwl-8610ap.dts
+@@ -0,0 +1,131 @@
++// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
++/dts-v1/;
++
++#include "bcm4709.dtsi"
++#include "bcm5301x-nand-cs0-bch8.dtsi"
++#include <dt-bindings/leds/common.h>
++#include <dt-bindings/input/input.h>
++
++/ {
++	model = "D-Link DWL-8610AP";
++	compatible = "dlink,dwl-8610ap", "brcm,bcm53016", "brcm,bcm4708";
++
++	memory@0 {
++		device_type = "memory";
++		/* 512 MB RAM in 2 x Macronix D9PSH chips */
++		reg = <0x00000000 0x08000000>,
++		      <0x88000000 0x08000000>;
++	};
++
++	leds {
++		compatible = "gpio-leds";
++
++		power {
++			function = LED_FUNCTION_POWER;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&chipcommon 0 GPIO_ACTIVE_LOW>;
++			default-state = "on";
++		};
++
++		diag {
++			/* Actually "diag" unclear what this means */
++			function = LED_FUNCTION_INDICATOR;
++			color = <LED_COLOR_ID_RED>;
++			gpios = <&chipcommon 1 GPIO_ACTIVE_LOW>;
++			default-state = "on";
++			linux,default-trigger = "heartbeat";
++		};
++
++		wlan-2g {
++			function = LED_FUNCTION_WLAN;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&chipcommon 5 GPIO_ACTIVE_LOW>;
++		};
++
++		wlan-5g {
++			function = LED_FUNCTION_WLAN;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&chipcommon 8 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	gpio_keys {
++		compatible = "gpio-keys";
++
++		button-reset {
++			debounce-interval = <100>;
++			wakeup-source;
++			linux,code = <KEY_RESTART>;
++			label = "reset";
++			/* This GPIO is actually stored in NVRAM, but it's not gonna change */
++			gpios = <&chipcommon 4 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	/*
++	 * Flash memory at 0x1e000000-0x1fffffff
++	 * Macronix 32 64KB blocks; total size 2MB, same that can be
++	 * found attached to the spi_nor SPI controller.
++	 */
++	nvram@1e080000 {
++		compatible = "brcm,nvram";
++		reg = <0x1e080000 0x00020000>;
++
++		et0macaddr: et0macaddr {
++		};
++
++		et1macaddr: et1macaddr {
++		};
++	};
++};
++
++&gmac0 {
++	nvmem-cells = <&et0macaddr>;
++	nvmem-cell-names = "mac-address";
++};
++
++&gmac1 {
++	nvmem-cells = <&et1macaddr>;
++	nvmem-cell-names = "mac-address";
++};
++
++&spi_nor {
++	/* Serial SPI NOR Flash MX 25L1606E */
++	status = "okay";
++};
++
++&nandcs {
++	/*
++	 * Spansion S34ML01G100TFI00 128 MB NAND Flash memory
++	 *
++	 * This ECC is a bit unorthodox but it is what the stock firmware
++	 * is using, so to be able to mount the original partitions
++	 * this is necessary.
++	 */
++	nand-ecc-strength = <5>;
++	partitions {
++		compatible = "fixed-partitions";
++		#address-cells = <1>;
++		#size-cells = <1>;
++
++		/* This is named nflash1.trx in CFE */
++		trx@0 {
++			label = "firmware";
++			reg = <0x00000000 0x02800000>;
++			compatible = "brcm,trx";
++		};
++
++		/* This is named nflash1.trx2 in CFE */
++		trx2@2800000 {
++			label = "firmware2";
++			reg = <0x02800000 0x02800000>;
++			compatible = "brcm,trx";
++		};
++
++		/* This is named nflash1.rwfs in CFE */
++		free@5000000 {
++			label = "free";
++			reg = <0x05000000 0x03000000>;
++		};
++	};
++};
diff --git a/target/linux/bcm53xx/patches-6.1/036-v6.2-bcma-support-SPROM-rev-11.patch b/target/linux/bcm53xx/patches-6.1/036-v6.2-bcma-support-SPROM-rev-11.patch
new file mode 100644
index 00000000000000..5ebc78ca2023b4
--- /dev/null
+++ b/target/linux/bcm53xx/patches-6.1/036-v6.2-bcma-support-SPROM-rev-11.patch
@@ -0,0 +1,28 @@
+From b9457a04eb89645049fdf427c13e6a18d5501895 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Tue, 11 Oct 2022 14:24:40 +0200
+Subject: [PATCH] bcma: support SPROM rev 11
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Rev 11 works fine for me to set the MAC address of gmac0 and
+gmac1 in the D-Link DWL-8610AP.
+
+Cc: Rafał Miłecki <zajec5@gmail.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+---
+ drivers/bcma/sprom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/bcma/sprom.c
++++ b/drivers/bcma/sprom.c
+@@ -170,7 +170,7 @@ static int bcma_sprom_valid(struct bcma_
+ 		return err;
+ 
+ 	revision = sprom[words - 1] & SSB_SPROM_REVISION_REV;
+-	if (revision != 8 && revision != 9 && revision != 10) {
++	if (revision < 8 || revision > 11) {
+ 		pr_err("Unsupported SPROM revision: %d\n", revision);
+ 		return -ENOENT;
+ 	}
diff --git a/target/linux/bcm53xx/patches-6.1/140-mtd-parsers-trx-parse-firmware-MTD-partitions-only.patch b/target/linux/bcm53xx/patches-6.1/140-mtd-parsers-trx-parse-firmware-MTD-partitions-only.patch
new file mode 100644
index 00000000000000..e1933e75c78a20
--- /dev/null
+++ b/target/linux/bcm53xx/patches-6.1/140-mtd-parsers-trx-parse-firmware-MTD-partitions-only.patch
@@ -0,0 +1,43 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 13 Apr 2021 18:25:20 +0200
+Subject: [PATCH] mtd: parsers: trx: parse "firmware" MTD partitions only
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Parsing every partition with "compatible" set to "brcm,trx" results in
+parsing both: firmware partition and failsafe partition on devices that
+implement failsafe booting. This affects e.g. Linksys EA9500 which has:
+
+partition@200000 {
+	reg = <0x0200000 0x01d00000>;
+	compatible = "linksys,ns-firmware", "brcm,trx";
+};
+
+partition@1f00000 {
+	reg = <0x01f00000 0x01d00000>;
+	compatible = "linksys,ns-firmware", "brcm,trx";
+};
+
+Check for MTD partition name "firmware" before parsing. Recently added
+ofpart_linksys_ns.c creates "firmware" and "failsafe" depending on
+bootloader setup.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+ drivers/mtd/parsers/parser_trx.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/mtd/parsers/parser_trx.c
++++ b/drivers/mtd/parsers/parser_trx.c
+@@ -92,6 +92,10 @@ static int parser_trx_parse(struct mtd_i
+ 	if (err != 0 && err != -EINVAL)
+ 		pr_err("failed to parse \"brcm,trx-magic\" DT attribute, using default: %d\n", err);
+ 
++	/* Don't parse any failsafe / backup partitions */
++	if (strcmp(mtd->name, "firmware"))
++		return -EINVAL;
++
+ 	parts = kcalloc(TRX_PARSER_MAX_PARTS, sizeof(struct mtd_partition),
+ 			GFP_KERNEL);
+ 	if (!parts)
diff --git a/target/linux/bcm53xx/patches-6.1/180-usb-xhci-add-support-for-performing-fake-doorbell.patch b/target/linux/bcm53xx/patches-6.1/180-usb-xhci-add-support-for-performing-fake-doorbell.patch
new file mode 100644
index 00000000000000..33066a84d8e03f
--- /dev/null
+++ b/target/linux/bcm53xx/patches-6.1/180-usb-xhci-add-support-for-performing-fake-doorbell.patch
@@ -0,0 +1,117 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Sat, 1 Oct 2016 22:54:48 +0200
+Subject: [PATCH] usb: xhci: add support for performing fake doorbell
+
+Broadcom's Northstar XHCI controllers seem to need a special start
+procedure to work correctly. There isn't any official documentation of
+this, the problem is that controller doesn't detect any connected
+devices with default setup. Moreover connecting USB device to controller
+that doesn't run properly can cause SoC's watchdog issues.
+
+A workaround that was successfully tested on multiple devices is to
+perform a fake doorbell. This patch adds code for doing this and enables
+it on BCM4708 family.
+---
+ drivers/usb/host/xhci-plat.c |  6 +++++
+ drivers/usb/host/xhci.c      | 63 +++++++++++++++++++++++++++++++++++++++++---
+ drivers/usb/host/xhci.h      |  1 +
+ 3 files changed, 67 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -77,6 +77,8 @@ static int xhci_priv_resume_quirk(struct
+ static void xhci_plat_quirks(struct device *dev, struct xhci_hcd *xhci)
+ {
+ 	struct xhci_plat_priv *priv = xhci_to_priv(xhci);
++	struct platform_device*pdev = to_platform_device(dev);
++	struct device_node *node = pdev->dev.of_node;
+ 
+ 	/*
+ 	 * As of now platform drivers don't provide MSI support so we ensure
+@@ -84,6 +86,9 @@ static void xhci_plat_quirks(struct devi
+ 	 * dev struct in order to setup MSI
+ 	 */
+ 	xhci->quirks |= XHCI_PLAT | priv->quirks;
++
++	if (node && of_machine_is_compatible("brcm,bcm4708"))
++		xhci->quirks |= XHCI_FAKE_DOORBELL;
+ }
+ 
+ /* called during probe() after chip reset completes */
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -161,6 +161,49 @@ int xhci_start(struct xhci_hcd *xhci)
+ 	return ret;
+ }
+ 
++/**
++ * xhci_fake_doorbell - Perform a fake doorbell on a specified slot
++ *
++ * Some controllers require a fake doorbell to start correctly. Without that
++ * they simply don't detect any devices.
++ */
++static int xhci_fake_doorbell(struct xhci_hcd *xhci, int slot_id)
++{
++	u32 temp;
++
++	/* Alloc a virt device for that slot */
++	if (!xhci_alloc_virt_device(xhci, slot_id, NULL, GFP_NOIO)) {
++		xhci_warn(xhci, "Could not allocate xHCI USB device data structures\n");
++		return -ENOMEM;
++	}
++
++	/* Ring fake doorbell for slot_id ep 0 */
++	xhci_ring_ep_doorbell(xhci, slot_id, 0, 0);
++	usleep_range(1000, 1500);
++
++	/* Read the status to check if HSE is set or not */
++	temp = readl(&xhci->op_regs->status);
++
++	/* Clear HSE if set */
++	if (temp & STS_FATAL) {
++		xhci_dbg(xhci, "HSE problem detected, status: 0x%08x\n", temp);
++		temp &= ~0x1fff;
++		temp |= STS_FATAL;
++		writel(temp, &xhci->op_regs->status);
++		usleep_range(1000, 1500);
++		readl(&xhci->op_regs->status);
++	}
++
++	/* Free virt device */
++	xhci_free_virt_device(xhci, slot_id);
++
++	/* We're done if controller is already running */
++	if (readl(&xhci->op_regs->command) & CMD_RUN)
++		return 0;
++
++	return xhci_start(xhci);
++}
++
+ /*
+  * Reset a halted HC.
+  *
+@@ -641,6 +684,14 @@ static int xhci_run_finished(struct xhci
+ 		return -ENODEV;
+ 	}
+ 
++	if (xhci->quirks & XHCI_FAKE_DOORBELL) {
++		int err = xhci_fake_doorbell(xhci, 1);
++		if (err) {
++			xhci_halt(xhci);
++			return err;
++		}
++	}
++
+ 	xhci->cmd_ring_state = CMD_RING_STATE_RUNNING;
+ 
+ 	if (xhci->quirks & XHCI_NEC_HOST)
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1899,6 +1899,7 @@ struct xhci_hcd {
+ #define XHCI_EP_CTX_BROKEN_DCS	BIT_ULL(42)
+ #define XHCI_SUSPEND_RESUME_CLKS	BIT_ULL(43)
+ #define XHCI_RESET_TO_DEFAULT	BIT_ULL(44)
++#define XHCI_FAKE_DOORBELL	BIT_ULL(45)
+ 
+ 	unsigned int		num_active_eps;
+ 	unsigned int		limit_active_eps;
diff --git a/target/linux/bcm53xx/patches-6.1/300-ARM-BCM5301X-Disable-MMU-and-Dcache-during-decompres.patch b/target/linux/bcm53xx/patches-6.1/300-ARM-BCM5301X-Disable-MMU-and-Dcache-during-decompres.patch
new file mode 100644
index 00000000000000..034d5b52fc79c6
--- /dev/null
+++ b/target/linux/bcm53xx/patches-6.1/300-ARM-BCM5301X-Disable-MMU-and-Dcache-during-decompres.patch
@@ -0,0 +1,101 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 24 Sep 2014 22:14:07 +0200
+Subject: [PATCH] ARM: BCM5301X: Disable MMU and Dcache during decompression
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Broadcom devices have broken CFE (bootloader) that leaves hardware in an
+invalid state. It causes problems with booting Linux. On Northstar
+devices kernel was randomly hanging in ~25% of tries during early init.
+Hangs used to happen at random places in the start_kernel. On BCM53573
+kernel doesn't even seem to start booting.
+
+To workaround this problem we need to do following very early:
+1) Clear 2 following bits in the SCTLR register:
+#define CR_M    (1 << 0)        /* MMU enable */
+#define CR_C    (1 << 2)        /* Dcache enable */
+2) Flush the whole D-cache
+3) Disable L2 cache
+
+Unfortunately this patch is not upstreamable as it does above things
+unconditionally. We can't check if we are running on Broadcom platform
+in any safe way and doing such hacks with ARCH_MULTI_V7 is unacceptable
+as it could break other devices support.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+
+--- a/arch/arm/boot/compressed/Makefile
++++ b/arch/arm/boot/compressed/Makefile
+@@ -35,6 +35,11 @@ ifeq ($(CONFIG_ARCH_ACORN),y)
+ OBJS		+= ll_char_wr.o font.o
+ endif
+ 
++ifeq ($(CONFIG_ARCH_BCM_5301X),y)
++OBJS		+= head-bcm_5301x-mpcore.o
++OBJS		+= cache-v7-min.o
++endif
++
+ ifeq ($(CONFIG_ARCH_SA1100),y)
+ OBJS		+= head-sa1100.o
+ endif
+--- /dev/null
++++ b/arch/arm/boot/compressed/head-bcm_5301x-mpcore.S
+@@ -0,0 +1,37 @@
++/*
++ *
++ * Platform specific tweaks.  This is merged into head.S by the linker.
++ *
++ */
++
++#include <linux/linkage.h>
++#include <asm/assembler.h>
++#include <asm/cp15.h>
++
++		.section        ".start", "ax"
++
++/*
++ * This code section is spliced into the head code by the linker
++ */
++
++__plat_uncompress_start:
++
++	@ Preserve r8/r7 i.e. kernel entry values
++	mov	r12, r8
++
++	@ Clear MMU enable and Dcache enable bits
++	mrc	p15, 0, r0, c1, c0, 0		@ Read SCTLR
++	bic	r0, #CR_C|CR_M
++	mcr	p15, 0, r0, c1, c0, 0		@ Write SCTLR
++	nop
++
++	@ Call the cache invalidation routine
++	bl	v7_flush_dcache_all
++	nop
++	mov	r0,#0
++	ldr	r3, =0x19022000			@ L2 cache controller, control reg
++	str	r0, [r3, #0x100]		@ Disable L2 cache
++	nop
++
++	@ Restore
++	mov	r8, r12
+--- a/arch/arm/boot/compressed/cache-v7-min.S
++++ b/arch/arm/boot/compressed/cache-v7-min.S
+@@ -12,6 +12,7 @@
+ 
+ #include <linux/linkage.h>
+ #include <linux/init.h>
++#include <asm/assembler.h>
+ 
+ 	__INIT
+ 
+@@ -63,7 +64,7 @@ loop2:
+  ARM(	orr	r11, r11, r9, lsl r2	)	@ factor index number into r11
+  THUMB(	lsl	r6, r9, r2		)
+  THUMB(	orr	r11, r11, r6		)	@ factor index number into r11
+-	mcr	p15, 0, r11, c7, c14, 2		@ clean & invalidate by set/way
++	mcr     p15, 0, r11, c7, c6, 2		@ clean & invalidate by set/way
+ 	subs	r9, r9, #1			@ decrement the index
+ 	bge	loop2
+ 	subs	r4, r4, #1			@ decrement the way
diff --git a/target/linux/bcm53xx/patches-6.1/304-ARM-dts-BCM5301X-Specify-switch-ports-for-remaining-.patch b/target/linux/bcm53xx/patches-6.1/304-ARM-dts-BCM5301X-Specify-switch-ports-for-remaining-.patch
new file mode 100644
index 00000000000000..0fb29e99d34f71
--- /dev/null
+++ b/target/linux/bcm53xx/patches-6.1/304-ARM-dts-BCM5301X-Specify-switch-ports-for-remaining-.patch
@@ -0,0 +1,711 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Subject: [PATCH] ARM: dts: BCM5301X: Specify switch ports for remaining
+ devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+
+--- a/arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts
++++ b/arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts
+@@ -93,3 +93,40 @@
+ &usb3_phy {
+ 	status = "okay";
+ };
++
++&srab {
++	status = "okay";
++
++	ports {
++		port@0 {
++			reg = <0>;
++			label = "lan1";
++		};
++
++		port@1 {
++			reg = <1>;
++			label = "lan2";
++		};
++
++		port@2 {
++			reg = <2>;
++			label = "lan3";
++		};
++
++		port@3 {
++			reg = <3>;
++			label = "lan4";
++		};
++
++		port@4 {
++			reg = <4>;
++			label = "wan";
++		};
++
++		port@5 {
++			reg = <5>;
++			label = "cpu";
++			ethernet = <&gmac0>;
++		};
++	};
++};
+--- a/arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts
++++ b/arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts
+@@ -83,3 +83,40 @@
+ &usb3_phy {
+ 	status = "okay";
+ };
++
++&srab {
++	status = "okay";
++
++	ports {
++		port@0 {
++			reg = <0>;
++			label = "wan";
++		};
++
++		port@1 {
++			reg = <1>;
++			label = "lan1";
++		};
++
++		port@2 {
++			reg = <2>;
++			label = "lan2";
++		};
++
++		port@3 {
++			reg = <3>;
++			label = "lan3";
++		};
++
++		port@4 {
++			reg = <4>;
++			label = "lan4";
++		};
++
++		port@5 {
++			reg = <5>;
++			label = "cpu";
++			ethernet = <&gmac0>;
++		};
++	};
++};
+--- a/arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts
++++ b/arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts
+@@ -149,3 +149,40 @@
+ &usb3_phy {
+ 	status = "okay";
+ };
++
++&srab {
++	status = "okay";
++
++	ports {
++		port@0 {
++			reg = <0>;
++			label = "lan1";
++		};
++
++		port@1 {
++			reg = <1>;
++			label = "lan2";
++		};
++
++		port@2 {
++			reg = <2>;
++			label = "lan3";
++		};
++
++		port@3 {
++			reg = <3>;
++			label = "lan4";
++		};
++
++		port@4 {
++			reg = <4>;
++			label = "wan";
++		};
++
++		port@5 {
++			reg = <5>;
++			label = "cpu";
++			ethernet = <&gmac0>;
++		};
++	};
++};
+--- a/arch/arm/boot/dts/bcm4708-linksys-ea6300-v1.dts
++++ b/arch/arm/boot/dts/bcm4708-linksys-ea6300-v1.dts
+@@ -46,3 +46,40 @@
+ &usb3_phy {
+ 	status = "okay";
+ };
++
++&srab {
++	status = "okay";
++
++	ports {
++		port@0 {
++			reg = <0>;
++			label = "lan1";
++		};
++
++		port@1 {
++			reg = <1>;
++			label = "lan2";
++		};
++
++		port@2 {
++			reg = <2>;
++			label = "lan3";
++		};
++
++		port@3 {
++			reg = <3>;
++			label = "lan4";
++		};
++
++		port@4 {
++			reg = <4>;
++			label = "wan";
++		};
++
++		port@5 {
++			reg = <5>;
++			label = "cpu";
++			ethernet = <&gmac0>;
++		};
++	};
++};
+--- a/arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts
++++ b/arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts
+@@ -42,3 +42,40 @@
+ &usb3_phy {
+ 	status = "okay";
+ };
++
++&srab {
++	status = "okay";
++
++	ports {
++		port@0 {
++			reg = <0>;
++			label = "lan1";
++		};
++
++		port@1 {
++			reg = <1>;
++			label = "lan2";
++		};
++
++		port@2 {
++			reg = <2>;
++			label = "lan3";
++		};
++
++		port@3 {
++			reg = <3>;
++			label = "lan4";
++		};
++
++		port@4 {
++			reg = <4>;
++			label = "wan";
++		};
++
++		port@5 {
++			reg = <5>;
++			label = "cpu";
++			ethernet = <&gmac0>;
++		};
++	};
++};
+--- a/arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts
++++ b/arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts
+@@ -86,3 +86,40 @@
+ &usb3_phy {
+ 	status = "okay";
+ };
++
++&srab {
++	status = "okay";
++
++	ports {
++		port@0 {
++			reg = <0>;
++			label = "lan1";
++		};
++
++		port@1 {
++			reg = <1>;
++			label = "lan2";
++		};
++
++		port@2 {
++			reg = <2>;
++			label = "lan3";
++		};
++
++		port@3 {
++			reg = <3>;
++			label = "lan4";
++		};
++
++		port@4 {
++			reg = <4>;
++			label = "wan";
++		};
++
++		port@5 {
++			reg = <5>;
++			label = "cpu";
++			ethernet = <&gmac0>;
++		};
++	};
++};
+--- a/arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts
++++ b/arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts
+@@ -77,3 +77,40 @@
+ &usb3_phy {
+ 	status = "okay";
+ };
++
++&srab {
++	status = "okay";
++
++	ports {
++		port@0 {
++			reg = <0>;
++			label = "wan";
++		};
++
++		port@1 {
++			reg = <1>;
++			label = "lan1";
++		};
++
++		port@2 {
++			reg = <2>;
++			label = "lan2";
++		};
++
++		port@3 {
++			reg = <3>;
++			label = "lan3";
++		};
++
++		port@4 {
++			reg = <4>;
++			label = "lan4";
++		};
++
++		port@5 {
++			reg = <5>;
++			label = "cpu";
++			ethernet = <&gmac0>;
++		};
++	};
++};
+--- a/arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts
++++ b/arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts
+@@ -66,6 +66,38 @@
+ 	status = "okay";
+ };
+ 
++&srab {
++	status = "okay";
++
++	ports {
++		port@0 {
++			reg = <0>;
++			label = "wan";
++		};
++
++		port@1 {
++			reg = <1>;
++			label = "lan1";
++		};
++
++		port@2 {
++			reg = <2>;
++			label = "lan2";
++		};
++
++		port@3 {
++			reg = <3>;
++			label = "lan3";
++		};
++
++		port@7 {
++			reg = <7>;
++			label = "cpu";
++			ethernet = <&gmac1>;
++		};
++	};
++};
++
+ &nandcs {
+ 	partitions {
+ 		compatible = "fixed-partitions";
+--- a/arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts
++++ b/arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts
+@@ -130,3 +130,40 @@
+ &usb3_phy {
+ 	status = "okay";
+ };
++
++&srab {
++	status = "okay";
++
++	ports {
++		port@0 {
++			reg = <0>;
++			label = "lan1";
++		};
++
++		port@1 {
++			reg = <1>;
++			label = "lan2";
++		};
++
++		port@2 {
++			reg = <2>;
++			label = "lan3";
++		};
++
++		port@3 {
++			reg = <3>;
++			label = "lan4";
++		};
++
++		port@4 {
++			reg = <4>;
++			label = "wan";
++		};
++
++		port@5 {
++			reg = <5>;
++			label = "cpu";
++			ethernet = <&gmac0>;
++		};
++	};
++};
+--- a/arch/arm/boot/dts/bcm4709-linksys-ea9200.dts
++++ b/arch/arm/boot/dts/bcm4709-linksys-ea9200.dts
+@@ -47,3 +47,45 @@
+ &usb3_phy {
+ 	status = "okay";
+ };
++
++&srab {
++	status = "okay";
++
++	ports {
++		port@0 {
++			reg = <0>;
++			label = "lan1";
++		};
++
++		port@1 {
++			reg = <1>;
++			label = "lan2";
++		};
++
++		port@2 {
++			reg = <2>;
++			label = "lan3";
++		};
++
++		port@3 {
++			reg = <3>;
++			label = "lan4";
++		};
++
++		port@4 {
++			reg = <4>;
++			label = "wan";
++		};
++
++		port@8 {
++			reg = <8>;
++			label = "cpu";
++			ethernet = <&gmac2>;
++
++			fixed-link {
++				speed = <1000>;
++				full-duplex;
++			};
++		};
++	};
++};
+--- a/arch/arm/boot/dts/bcm4709-netgear-r7000.dts
++++ b/arch/arm/boot/dts/bcm4709-netgear-r7000.dts
+@@ -104,3 +104,40 @@
+ &usb3_phy {
+ 	status = "okay";
+ };
++
++&srab {
++	status = "okay";
++
++	ports {
++		port@0 {
++			reg = <0>;
++			label = "wan";
++		};
++
++		port@1 {
++			reg = <1>;
++			label = "lan1";
++		};
++
++		port@2 {
++			reg = <2>;
++			label = "lan2";
++		};
++
++		port@3 {
++			reg = <3>;
++			label = "lan3";
++		};
++
++		port@4 {
++			reg = <4>;
++			label = "lan4";
++		};
++
++		port@5 {
++			reg = <5>;
++			label = "cpu";
++			ethernet = <&gmac0>;
++		};
++	};
++};
+--- a/arch/arm/boot/dts/bcm47094-netgear-r8500.dts
++++ b/arch/arm/boot/dts/bcm47094-netgear-r8500.dts
+@@ -94,3 +94,45 @@
+ &usb3_phy {
+ 	status = "okay";
+ };
++
++&srab {
++	status = "okay";
++
++	ports {
++		port@0 {
++			reg = <0>;
++			label = "wan";
++		};
++
++		port@1 {
++			reg = <1>;
++			label = "lan1";
++		};
++
++		port@2 {
++			reg = <2>;
++			label = "lan2";
++		};
++
++		port@3 {
++			reg = <3>;
++			label = "lan3";
++		};
++
++		port@4 {
++			reg = <4>;
++			label = "lan4";
++		};
++
++		port@8 {
++			reg = <8>;
++			label = "cpu";
++			ethernet = <&gmac2>;
++
++			fixed-link {
++				speed = <1000>;
++				full-duplex;
++			};
++		};
++	};
++};
+--- a/arch/arm/boot/dts/bcm47094-phicomm-k3.dts
++++ b/arch/arm/boot/dts/bcm47094-phicomm-k3.dts
+@@ -38,6 +38,38 @@
+ 	status = "okay";
+ };
+ 
++&srab {
++	status = "okay";
++
++	ports {
++		port@0 {
++			reg = <0>;
++			label = "lan1";
++		};
++
++		port@1 {
++			reg = <1>;
++			label = "lan2";
++		};
++
++		port@2 {
++			reg = <2>;
++			label = "lan3";
++		};
++
++		port@3 {
++			reg = <3>;
++			label = "wan";
++		};
++
++		port@5 {
++			reg = <5>;
++			label = "cpu";
++			ethernet = <&gmac0>;
++		};
++	};
++};
++
+ &nandcs {
+ 	partitions {
+ 		compatible = "fixed-partitions";
+--- a/arch/arm/boot/dts/bcm47081-tplink-archer-c5-v2.dts
++++ b/arch/arm/boot/dts/bcm47081-tplink-archer-c5-v2.dts
+@@ -91,6 +91,43 @@
+ 	};
+ };
+ 
++&srab {
++	status = "okay";
++
++	ports {
++		port@0 {
++			reg = <0>;
++			label = "wan";
++		};
++
++		port@1 {
++			reg = <1>;
++			label = "lan1";
++		};
++
++		port@2 {
++			reg = <2>;
++			label = "lan2";
++		};
++
++		port@3 {
++			reg = <3>;
++			label = "lan3";
++		};
++
++		port@4 {
++			reg = <4>;
++			label = "lan4";
++		};
++
++		port@5 {
++			reg = <5>;
++			label = "cpu";
++			ethernet = <&gmac0>;
++		};
++	};
++};
++
+ &spi_nor {
+ 	status = "okay";
+ 
+--- a/arch/arm/boot/dts/bcm4709-tplink-archer-c9-v1.dts
++++ b/arch/arm/boot/dts/bcm4709-tplink-archer-c9-v1.dts
+@@ -100,6 +100,43 @@
+ 	vcc-gpio = <&chipcommon 12 GPIO_ACTIVE_HIGH>;
+ };
+ 
++&srab {
++	status = "okay";
++
++	ports {
++		port@0 {
++			reg = <0>;
++			label = "wan";
++		};
++
++		port@1 {
++			reg = <1>;
++			label = "lan1";
++		};
++
++		port@2 {
++			reg = <2>;
++			label = "lan2";
++		};
++
++		port@3 {
++			reg = <3>;
++			label = "lan3";
++		};
++
++		port@4 {
++			reg = <4>;
++			label = "lan4";
++		};
++
++		port@5 {
++			reg = <5>;
++			label = "cpu";
++			ethernet = <&gmac0>;
++		};
++	};
++};
++
+ &spi_nor {
+ 	status = "okay";
+ 
+--- a/arch/arm/boot/dts/bcm47081-buffalo-wzr-900dhp.dts
++++ b/arch/arm/boot/dts/bcm47081-buffalo-wzr-900dhp.dts
+@@ -107,3 +107,41 @@
+ &usb3_phy {
+ 	status = "okay";
+ };
++
++&srab {
++	status = "okay";
++
++	ports {
++		port@0 {
++			reg = <0>;
++			label = "lan1";
++		};
++
++		port@1 {
++			reg = <1>;
++			label = "lan2";
++		};
++
++		port@2 {
++			reg = <2>;
++			label = "lan3";
++		};
++
++		port@3 {
++			reg = <3>;
++			label = "lan4";
++		};
++
++		port@4 {
++			reg = <4>;
++			label = "wan";
++		};
++
++		port@5 {
++			reg = <5>;
++			label = "cpu";
++			ethernet = <&gmac0>;
++		};
++	};
++};
++
diff --git a/target/linux/bcm53xx/patches-6.1/310-ARM-BCM5301X-Add-DT-for-Netgear-R7900.patch b/target/linux/bcm53xx/patches-6.1/310-ARM-BCM5301X-Add-DT-for-Netgear-R7900.patch
new file mode 100644
index 00000000000000..02340f4e9f07a6
--- /dev/null
+++ b/target/linux/bcm53xx/patches-6.1/310-ARM-BCM5301X-Add-DT-for-Netgear-R7900.patch
@@ -0,0 +1,64 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Subject: [PATCH] ARM: BCM5301X: Add DT for Netgear R7900
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+---
+
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -125,6 +125,7 @@ dtb-$(CONFIG_ARCH_BCM_5301X) += \
+ 	bcm4709-buffalo-wxr-1900dhp.dtb \
+ 	bcm4709-linksys-ea9200.dtb \
+ 	bcm4709-netgear-r7000.dtb \
++	bcm4709-netgear-r7900.dtb \
+ 	bcm4709-netgear-r8000.dtb \
+ 	bcm4709-tplink-archer-c9-v1.dtb \
+ 	bcm47094-asus-rt-ac88u.dtb \
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm4709-netgear-r7900.dts
+@@ -0,0 +1,42 @@
++/*
++ * Broadcom BCM470X / BCM5301X ARM platform code.
++ * DTS for Netgear R7900
++ *
++ * Copyright (C) 2016 Rafał Miłecki <zajec5@gmail.com>
++ *
++ * Licensed under the GNU/GPL. See COPYING for details.
++ */
++
++/dts-v1/;
++
++#include "bcm4709.dtsi"
++#include "bcm5301x-nand-cs0-bch8.dtsi"
++
++/ {
++	compatible = "netgear,r7900", "brcm,bcm4709", "brcm,bcm4708";
++	model = "Netgear R7900";
++
++	chosen {
++		bootargs = "console=ttyS0,115200";
++	};
++
++	memory {
++		reg = <0x00000000 0x08000000
++		       0x88000000 0x08000000>;
++	};
++
++	axi@18000000 {
++		usb3@23000 {
++			reg = <0x00023000 0x1000>;
++
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			vcc-gpio = <&chipcommon 0 GPIO_ACTIVE_HIGH>;
++		};
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
diff --git a/target/linux/bcm53xx/patches-6.1/315-ARM-dts-BCM5301X-Extend-RAM-to-full-256MB-for-Linksy.patch b/target/linux/bcm53xx/patches-6.1/315-ARM-dts-BCM5301X-Extend-RAM-to-full-256MB-for-Linksy.patch
new file mode 100644
index 00000000000000..068d676962814a
--- /dev/null
+++ b/target/linux/bcm53xx/patches-6.1/315-ARM-dts-BCM5301X-Extend-RAM-to-full-256MB-for-Linksy.patch
@@ -0,0 +1,27 @@
+From e492f69e4da879db7b3e9a2290e5b6620f1335b5 Mon Sep 17 00:00:00 2001
+From: Aleksey Nasibulin <alealexpro100@ya.ru>
+Date: Thu, 13 Oct 2022 08:16:51 +0000
+Subject: [PATCH] ARM: dts: BCM5301X: Extend RAM to full 256MB for Linksys
+ EA6500 V2
+
+Linksys ea6500-v2 have 256MB of ram. Currently we only use 128MB.
+Expand the definition to use all the available RAM.
+
+Fixes: 03e96644d7a8 ("ARM: dts: BCM5301X: Add basic DT for Linksys EA6500 V2")
+Signed-off-by: Aleksey Nasibulin <alealexpro100@ya.ru>
+---
+ arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts
++++ b/arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts
+@@ -19,7 +19,8 @@
+ 
+ 	memory@0 {
+ 		device_type = "memory";
+-		reg = <0x00000000 0x08000000>;
++		reg = <0x00000000 0x08000000>,
++		      <0x88000000 0x08000000>;
+ 	};
+ 
+ 	gpio-keys {
diff --git a/target/linux/bcm53xx/patches-6.1/321-ARM-dts-BCM5301X-Describe-partition-formats.patch b/target/linux/bcm53xx/patches-6.1/321-ARM-dts-BCM5301X-Describe-partition-formats.patch
new file mode 100644
index 00000000000000..f2861177dd1d57
--- /dev/null
+++ b/target/linux/bcm53xx/patches-6.1/321-ARM-dts-BCM5301X-Describe-partition-formats.patch
@@ -0,0 +1,25 @@
+From 7166207bd1d8c46d09d640d46afc685df9bb9083 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 22 Nov 2018 09:21:49 +0100
+Subject: [PATCH] ARM: dts: BCM5301X: Describe partition formats
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+It's needed by OpenWrt for custom partitioning.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+ arch/arm/boot/dts/bcm47094-dlink-dir-885l.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/boot/dts/bcm47094-dlink-dir-885l.dts
++++ b/arch/arm/boot/dts/bcm47094-dlink-dir-885l.dts
+@@ -35,6 +35,7 @@
+ 				partition@0 {
+ 					label = "firmware";
+ 					reg = <0x00000000 0x08000000>;
++					compatible = "seama";
+ 				};
+ 			};
+ 		};
diff --git a/target/linux/bcm53xx/patches-6.1/500-UBI-Detect-EOF-mark-and-erase-all-remaining-blocks.patch b/target/linux/bcm53xx/patches-6.1/500-UBI-Detect-EOF-mark-and-erase-all-remaining-blocks.patch
new file mode 100644
index 00000000000000..209c57ca0bdbbc
--- /dev/null
+++ b/target/linux/bcm53xx/patches-6.1/500-UBI-Detect-EOF-mark-and-erase-all-remaining-blocks.patch
@@ -0,0 +1,59 @@
+From 2a2af518266a29323cf30c3f9ba9ef2ceb1dd84b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Thu, 16 Oct 2014 20:52:16 +0200
+Subject: [PATCH] UBI: Detect EOF mark and erase all remaining blocks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+---
+ drivers/mtd/ubi/attach.c | 5 +++++
+ drivers/mtd/ubi/io.c     | 4 ++++
+ drivers/mtd/ubi/ubi.h    | 1 +
+ 3 files changed, 10 insertions(+)
+
+--- a/drivers/mtd/ubi/attach.c
++++ b/drivers/mtd/ubi/attach.c
+@@ -82,6 +82,9 @@ static int self_check_ai(struct ubi_devi
+ #define AV_ADD		BIT(1)
+ #define AV_FIND_OR_ADD	(AV_FIND | AV_ADD)
+ 
++/* Set on finding block with 0xdeadc0de, indicates erasing all blocks behind */
++bool erase_all_next;
++
+ /**
+  * find_or_add_av - internal function to find a volume, add a volume or do
+  *		    both (find and add if missing).
+@@ -1580,6 +1583,8 @@ int ubi_attach(struct ubi_device *ubi, i
+ 	if (!ai)
+ 		return -ENOMEM;
+ 
++	erase_all_next = false;
++
+ #ifdef CONFIG_MTD_UBI_FASTMAP
+ 	/* On small flash devices we disable fastmap in any case. */
+ 	if ((int)mtd_div_by_eb(ubi->mtd->size, ubi->mtd) <= UBI_FM_MAX_START) {
+--- a/drivers/mtd/ubi/io.c
++++ b/drivers/mtd/ubi/io.c
+@@ -717,6 +717,10 @@ int ubi_io_read_ec_hdr(struct ubi_device
+ 	}
+ 
+ 	magic = be32_to_cpu(ec_hdr->magic);
++	if (magic == 0xdeadc0de)
++		erase_all_next = true;
++	if (erase_all_next)
++		return read_err ? UBI_IO_FF_BITFLIPS : UBI_IO_FF;
+ 	if (magic != UBI_EC_HDR_MAGIC) {
+ 		if (mtd_is_eccerr(read_err))
+ 			return UBI_IO_BAD_HDR_EBADMSG;
+--- a/drivers/mtd/ubi/ubi.h
++++ b/drivers/mtd/ubi/ubi.h
+@@ -820,6 +820,7 @@ extern struct mutex ubi_devices_mutex;
+ extern struct blocking_notifier_head ubi_notifiers;
+ 
+ /* attach.c */
++extern bool erase_all_next;
+ struct ubi_ainf_peb *ubi_alloc_aeb(struct ubi_attach_info *ai, int pnum,
+ 				   int ec);
+ void ubi_free_aeb(struct ubi_attach_info *ai, struct ubi_ainf_peb *aeb);
diff --git a/target/linux/bcm53xx/patches-6.1/600-net-disable-GRO-by-default.patch b/target/linux/bcm53xx/patches-6.1/600-net-disable-GRO-by-default.patch
new file mode 100644
index 00000000000000..9f6343c7917097
--- /dev/null
+++ b/target/linux/bcm53xx/patches-6.1/600-net-disable-GRO-by-default.patch
@@ -0,0 +1,36 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 20 Jun 2022 10:01:18 +0200
+Subject: [PATCH] net: disable GRO by default
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+In many cases GRO improves network performance however it comes at a
+cost of chacksums calculations. In case of slow CPU and missing hardware
+csum calculation support GRO can actually decrease network speed.
+
+On BCM4708 *disabling* GRO results in following NAT masquarade speed
+changes:
+1. 364 Mb/s → 396 Mb/s (packet steering disabled)
+2. 341 Mb/s → 566 Mb/s (packet steering enabled)
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+ include/linux/netdev_features.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/netdev_features.h
++++ b/include/linux/netdev_features.h
+@@ -242,10 +242,10 @@ static inline int find_next_netdev_featu
+ #define NETIF_F_UPPER_DISABLES	NETIF_F_LRO
+ 
+ /* changeable features with no special hardware requirements */
+-#define NETIF_F_SOFT_FEATURES	(NETIF_F_GSO | NETIF_F_GRO)
++#define NETIF_F_SOFT_FEATURES	(NETIF_F_GSO)
+ 
+ /* Changeable features with no special hardware requirements that defaults to off. */
+-#define NETIF_F_SOFT_FEATURES_OFF	(NETIF_F_GRO_FRAGLIST | NETIF_F_GRO_UDP_FWD)
++#define NETIF_F_SOFT_FEATURES_OFF	(NETIF_F_GRO_FRAGLIST | NETIF_F_GRO_UDP_FWD | NETIF_F_GRO)
+ 
+ #define NETIF_F_VLAN_FEATURES	(NETIF_F_HW_VLAN_CTAG_FILTER | \
+ 				 NETIF_F_HW_VLAN_CTAG_RX | \
diff --git a/target/linux/bcm53xx/patches-6.1/700-bgmac-reduce-max-frame-size-to-support-just-MTU-1500.patch b/target/linux/bcm53xx/patches-6.1/700-bgmac-reduce-max-frame-size-to-support-just-MTU-1500.patch
new file mode 100644
index 00000000000000..3a2f4b06ed6d8c
--- /dev/null
+++ b/target/linux/bcm53xx/patches-6.1/700-bgmac-reduce-max-frame-size-to-support-just-MTU-1500.patch
@@ -0,0 +1,33 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 10 Jun 2022 13:10:47 +0200
+Subject: [PATCH] bgmac: reduce max frame size to support just MTU 1500
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+bgmac allocates new replacement buffer before handling each received
+frame. Allocating & DMA-preparing 9724 B each time consumes a lot of CPU
+time. Ideally bgmac should just respect currently set MTU but it isn't
+the case right now. For now just revert back to the old limited frame
+size.
+
+This change bumps NAT masquarade speed by ~95%.
+
+Ref: 8c7da63978f1 ("bgmac: configure MTU and add support for frames beyond 8192 byte size")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+ drivers/net/ethernet/broadcom/bgmac.h | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bgmac.h
++++ b/drivers/net/ethernet/broadcom/bgmac.h
+@@ -328,8 +328,7 @@
+ #define BGMAC_RX_FRAME_OFFSET			30		/* There are 2 unused bytes between header and real data */
+ #define BGMAC_RX_BUF_OFFSET			(NET_SKB_PAD + NET_IP_ALIGN - \
+ 						 BGMAC_RX_FRAME_OFFSET)
+-/* Jumbo frame size with FCS */
+-#define BGMAC_RX_MAX_FRAME_SIZE			9724
++#define BGMAC_RX_MAX_FRAME_SIZE			1536
+ #define BGMAC_RX_BUF_SIZE			(BGMAC_RX_FRAME_OFFSET + BGMAC_RX_MAX_FRAME_SIZE)
+ #define BGMAC_RX_ALLOC_SIZE			(SKB_DATA_ALIGN(BGMAC_RX_BUF_SIZE + BGMAC_RX_BUF_OFFSET) + \
+ 						 SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
diff --git a/target/linux/bcm53xx/patches-6.1/905-BCM53573-minor-hacks.patch b/target/linux/bcm53xx/patches-6.1/905-BCM53573-minor-hacks.patch
new file mode 100644
index 00000000000000..721cc3c154893b
--- /dev/null
+++ b/target/linux/bcm53xx/patches-6.1/905-BCM53573-minor-hacks.patch
@@ -0,0 +1,80 @@
+From 6f1c62440eb6846cb8045d7a5480ec7bbe47c96f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 15 Aug 2016 10:30:41 +0200
+Subject: [PATCH] BCM53573 minor hacks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+
+--- a/arch/arm/boot/dts/bcm53573.dtsi
++++ b/arch/arm/boot/dts/bcm53573.dtsi
+@@ -54,6 +54,7 @@
+ 			     <GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
+ 			     <GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
+ 			     <GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>;
++		clocks = <&ilp>;
+ 	};
+ 
+ 	clocks {
+--- a/drivers/bcma/main.c
++++ b/drivers/bcma/main.c
+@@ -330,14 +330,6 @@ static int bcma_register_devices(struct
+ 	}
+ #endif
+ 
+-#ifdef CONFIG_BCMA_SFLASH
+-	if (bus->drv_cc.sflash.present) {
+-		err = platform_device_register(&bcma_sflash_dev);
+-		if (err)
+-			bcma_err(bus, "Error registering serial flash\n");
+-	}
+-#endif
+-
+ #ifdef CONFIG_BCMA_NFLASH
+ 	if (bus->drv_cc.nflash.present) {
+ 		err = platform_device_register(&bcma_nflash_dev);
+@@ -415,6 +407,14 @@ int bcma_bus_register(struct bcma_bus *b
+ 			bcma_register_core(bus, core);
+ 	}
+ 
++#ifdef CONFIG_BCMA_SFLASH
++	if (bus->drv_cc.sflash.present) {
++		err = platform_device_register(&bcma_sflash_dev);
++		if (err)
++			bcma_err(bus, "Error registering serial flash\n");
++	}
++#endif
++
+ 	/* Try to get SPROM */
+ 	err = bcma_sprom_get(bus);
+ 	if (err == -ENOENT) {
+--- a/drivers/clocksource/arm_arch_timer.c
++++ b/drivers/clocksource/arm_arch_timer.c
+@@ -14,6 +14,7 @@
+ #include <linux/smp.h>
+ #include <linux/cpu.h>
+ #include <linux/cpu_pm.h>
++#include <linux/clk.h>
+ #include <linux/clockchips.h>
+ #include <linux/clocksource.h>
+ #include <linux/clocksource_ids.h>
+@@ -1021,6 +1022,16 @@ static void __init arch_timer_of_configu
+ 	if (of_property_read_u32(np, "clock-frequency", &arch_timer_rate))
+ 		arch_timer_rate = rate;
+ 
++	/* Get clk rate through clk driver if present */
++	if (!arch_timer_rate) {
++		struct clk *clk = of_clk_get(np, 0);
++
++		if (!IS_ERR(clk)) {
++			if (!clk_prepare_enable(clk))
++				arch_timer_rate = clk_get_rate(clk);
++		}
++	}
++
+ 	/* Check the timer frequency. */
+ 	if (validate_timer_rate())
+ 		pr_warn("frequency not available\n");
diff --git a/target/linux/bcm63xx/Makefile b/target/linux/bcm63xx/Makefile
index db71e359f6affb..f206aed3d355b2 100644
--- a/target/linux/bcm63xx/Makefile
+++ b/target/linux/bcm63xx/Makefile
@@ -9,10 +9,9 @@ ARCH:=mips
 BOARD:=bcm63xx
 BOARDNAME:=Broadcom BCM63xx
 SUBTARGETS:=generic smp
-FEATURES:=squashfs usb atm pci pcmcia usbgadget
+FEATURES:=squashfs usb atm pci pcmcia usbgadget source-only
 
-KERNEL_PATCHVER:=5.10
-KERNEL_TESTING_PATCHVER:=5.15
+KERNEL_PATCHVER:=5.15
 
 define Target/Description
 	Build firmware images for Broadcom based xDSL/routers
diff --git a/target/linux/bcm63xx/base-files/lib/upgrade/platform.sh b/target/linux/bcm63xx/base-files/lib/upgrade/platform.sh
index 0d836729ee6d0e..620e0ab4f42b95 100644
--- a/target/linux/bcm63xx/base-files/lib/upgrade/platform.sh
+++ b/target/linux/bcm63xx/base-files/lib/upgrade/platform.sh
@@ -29,42 +29,6 @@ platform_check_image() {
 	esac
 }
 
-cfe_jffs2_upgrade_tar() {
-	local tar_file="$1"
-	local kernel_mtd="$(find_mtd_index $CI_KERNPART)"
-
-	if [ -z "$kernel_mtd" ]; then
-		echo "$CI_KERNPART partition not found"
-		return 1
-	fi
-
-	local board_dir=$(tar tf $tar_file | grep -m 1 '^sysupgrade-.*/$')
-	board_dir=${board_dir%/}
-
-	local kernel_length=$(tar xf $tar_file ${board_dir}/kernel -O | wc -c 2> /dev/null)
-	local rootfs_length=$(tar xf $tar_file ${board_dir}/root -O | wc -c 2> /dev/null)
-
-	if [ "$kernel_length" = 0 ]; then
-		echo "kernel cannot be empty"
-		return 1
-	fi
-
-	flash_erase -j /dev/mtd${kernel_mtd} 0 0
-	tar xf $tar_file ${board_dir}/kernel -O | nandwrite /dev/mtd${kernel_mtd} -
-
-	local rootfs_type="$(identify_tar "$tar_file" ${board_dir}/root)"
-
-	nand_upgrade_prepare_ubi "$rootfs_length" "$rootfs_type" "0" "0"
-
-	local ubidev="$( nand_find_ubi "$CI_UBIPART" )"
-
-	local root_ubivol="$(nand_find_volume $ubidev $CI_ROOTPART)"
-	tar xf $tar_file ${board_dir}/root -O | \
-		ubiupdatevol /dev/$root_ubivol -s $rootfs_length -
-
-	nand_do_upgrade_success
-}
-
 platform_do_upgrade() {
 	case "$(board_name)" in
 		comtrend,vg-8050|\
@@ -72,7 +36,8 @@ platform_do_upgrade() {
 		huawei,hg253s-v2|\
 		netgear,dgnd3700-v2)
 			REQUIRE_IMAGE_METADATA=1
-			cfe_jffs2_upgrade_tar "$1"
+			CI_JFFS2_CLEAN_MARKERS=1
+			nand_do_upgrade "$1"
 			;;
 		sercomm,ad1018|\
 		sercomm,h500-s-lowi|\
diff --git a/target/linux/bcm63xx/dts/bcm63167-sercomm-h500-s-vfes.dts b/target/linux/bcm63xx/dts/bcm63167-sercomm-h500-s-vfes.dts
index bd69ccd316376a..5349a5435622b9 100644
--- a/target/linux/bcm63xx/dts/bcm63167-sercomm-h500-s-vfes.dts
+++ b/target/linux/bcm63xx/dts/bcm63167-sercomm-h500-s-vfes.dts
@@ -4,7 +4,7 @@
  *
  * Copyright (C) 2020 Daniel González Cabanelas <dgcbueu@gmail.com>
  */
- 
+
 #include "bcm63167-sercomm-h500-s.dtsi"
 
 / {
diff --git a/target/linux/bcm63xx/dts/bcm6358-bt-home-hub-2-a.dts b/target/linux/bcm63xx/dts/bcm6358-bt-home-hub-2-a.dts
index b5eea3dcb124a4..10aea48783b317 100644
--- a/target/linux/bcm63xx/dts/bcm6358-bt-home-hub-2-a.dts
+++ b/target/linux/bcm63xx/dts/bcm6358-bt-home-hub-2-a.dts
@@ -60,7 +60,7 @@
 	};
 
 	led_power_green: led@1 {
-		reg = <0>;
+		reg = <1>;
 		active-low;
 		label = "green:power";
 		default-state = "on";
diff --git a/target/linux/bcm63xx/dts/bcm6362-netgear-dgnd3700-v2.dts b/target/linux/bcm63xx/dts/bcm6362-netgear-dgnd3700-v2.dts
index 50133265f7ea72..4bef5908e03596 100644
--- a/target/linux/bcm63xx/dts/bcm6362-netgear-dgnd3700-v2.dts
+++ b/target/linux/bcm63xx/dts/bcm6362-netgear-dgnd3700-v2.dts
@@ -167,6 +167,7 @@
 				compatible = "brcm,wfi";
 				label = "wfi";
 				reg = <0x0004000 0x1c7c000>;
+				brcm,cferam = "cfe";
 			};
 
 			partition@1c80000 {
diff --git a/target/linux/bcm63xx/image/Makefile b/target/linux/bcm63xx/image/Makefile
index f35358173c5f14..45b526878d0eb3 100644
--- a/target/linux/bcm63xx/image/Makefile
+++ b/target/linux/bcm63xx/image/Makefile
@@ -8,8 +8,7 @@ include $(INCLUDE_DIR)/image.mk
 
 KERNEL_LOADADDR = 0x80010000		# RAM start + 64K
 LOADER_ENTRY = 0x80a00000		# RAM start + 10M, for relocate
-RAMSIZE = 0x02000000			# 32MB
-LZMA_TEXT_START = 0x81800000		# 32MB - 8MB
+LZMA_TEXT_START = 0x81800000		# RAM start + 24M
 
 RELOCATE_MAKEOPTS= \
 		CACHELINE_SIZE=16 \
@@ -37,7 +36,6 @@ define Build/loader-lzma
 		KDIR=$(KDIR) \
 		LOADER_ADDR=$(if $(DEVICE_LOADADDR),$(DEVICE_LOADADDR),$(LOADER_ENTRY)) \
 		KERNEL_ADDR=$(KERNEL_LOADADDR) \
-		RAMSIZE=$(RAMSIZE) \
 		LZMA_TEXT_START=$(LZMA_TEXT_START) \
 		CHIP_ID=$(CHIP_ID) \
 		PKG_BUILD_DIR="$@.src" \
@@ -305,12 +303,12 @@ define Device/Default
 endef
 DEVICE_VARS += CHIP_ID DEVICE_LOADADDR
 
-ATH5K_PACKAGES := kmod-ath5k wpad-basic-wolfssl
-ATH9K_PACKAGES := kmod-ath9k wpad-basic-wolfssl
-B43_PACKAGES := kmod-b43 wpad-basic-wolfssl
+ATH5K_PACKAGES := kmod-ath5k wpad-basic-mbedtls
+ATH9K_PACKAGES := kmod-ath9k wpad-basic-mbedtls
+B43_PACKAGES := kmod-b43 wpad-basic-mbedtls
 BRCMWL_PACKAGES := kmod-brcm-wl nas wlc
-RT28_PACKAGES := kmod-rt2800-pci wpad-basic-wolfssl
-RT61_PACKAGES := kmod-rt61-pci wpad-basic-wolfssl
+RT28_PACKAGES := kmod-rt2800-pci wpad-basic-mbedtls
+RT61_PACKAGES := kmod-rt61-pci wpad-basic-mbedtls
 USB1_PACKAGES := kmod-usb-ohci kmod-usb-ledtrig-usbport
 USB2_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-usb-ledtrig-usbport
 
diff --git a/target/linux/bcm63xx/image/bcm63xx.mk b/target/linux/bcm63xx/image/bcm63xx.mk
index 97959d7819ce5e..9c5cc9bce5baf5 100644
--- a/target/linux/bcm63xx/image/bcm63xx.mk
+++ b/target/linux/bcm63xx/image/bcm63xx.mk
@@ -210,6 +210,7 @@ define Device/adb_a4001n
   CHIP_ID := 6328
   FLASH_MB := 8
   DEVICE_PACKAGES := $(USB2_PACKAGES) $(B43_PACKAGES)
+  DEFAULT := n
 endef
 TARGET_DEVICES += adb_a4001n
 
@@ -222,6 +223,7 @@ define Device/adb_a4001n1
   CHIP_ID := 6328
   FLASH_MB := 16
   DEVICE_PACKAGES := $(USB2_PACKAGES) $(B43_PACKAGES)
+  DEFAULT := n
 endef
 TARGET_DEVICES += adb_a4001n1
 
@@ -234,6 +236,7 @@ define Device/adb_pdg-a4001n-a-000-1a1-ax
   CHIP_ID := 6328
   FLASH_MB := 16
   DEVICE_PACKAGES := $(USB2_PACKAGES) $(B43_PACKAGES)
+  DEFAULT := n
 endef
 TARGET_DEVICES += adb_pdg-a4001n-a-000-1a1-ax
 
@@ -269,6 +272,7 @@ define Device/alcatel_rg100a
   CHIP_ID := 6358
   BLOCK_SIZE := 0x20000
   DEVICE_PACKAGES := $(USB2_PACKAGES) $(B43_PACKAGES)
+  DEFAULT := n
 endef
 TARGET_DEVICES += alcatel_rg100a
 
@@ -448,6 +452,7 @@ define Device/comtrend_ct-6373
   CFE_BOARD_ID := CT6373-1
   CHIP_ID := 6358
   DEVICE_PACKAGES := $(B43_PACKAGES) $(USB2_PACKAGES)
+  DEFAULT := n
 endef
 TARGET_DEVICES += comtrend_ct-6373
 
@@ -532,6 +537,7 @@ define Device/d-link_dsl-2650u
   CFE_BOARD_ID := 96358VW2
   CHIP_ID := 6358
   DEVICE_PACKAGES := $(B43_PACKAGES) $(USB2_PACKAGES)
+  DEFAULT := n
 endef
 TARGET_DEVICES += d-link_dsl-2650u
 
@@ -593,6 +599,7 @@ define Device/d-link_dsl-2750u-c1
   CHIP_ID := 6328
   FLASH_MB := 8
   DEVICE_PACKAGES := $(USB2_PACKAGES) $(B43_PACKAGES)
+  DEFAULT := n
 endef
 TARGET_DEVICES += d-link_dsl-2750u-c1
 
@@ -618,6 +625,7 @@ define Device/d-link_dva-g3810bn-tl
   CFE_BOARD_ID := 96358VW
   CHIP_ID := 6358
   DEVICE_PACKAGES := $(B43_PACKAGES) $(USB2_PACKAGES)
+  DEFAULT := n
 endef
 TARGET_DEVICES += d-link_dva-g3810bn-tl
 
@@ -765,6 +773,7 @@ define Device/huawei_echolife-hg622
   BLOCK_SIZE := 0x20000
   FLASH_MB := 16
   DEVICE_PACKAGES := $(RT28_PACKAGES) $(USB2_PACKAGES)
+  DEFAULT := n
 endef
 TARGET_DEVICES += huawei_echolife-hg622
 
@@ -825,6 +834,7 @@ define Device/netgear_cvg834g
   HCS_MAGIC_BYTES := 0xa020
   HCS_REV_MIN := 0001
   HCS_REV_MAJ := 0022
+  DEFAULT := n
 endef
 TARGET_DEVICES += netgear_cvg834g
 
@@ -930,6 +940,7 @@ define Device/pirelli_a226g
   CHIP_ID := 6358
   CFE_EXTRAS += --signature2 IMAGE --tag-version 8
   DEVICE_PACKAGES := $(B43_PACKAGES) $(USB2_PACKAGES)
+  DEFAULT := n
 endef
 TARGET_DEVICES += pirelli_a226g
 
@@ -941,6 +952,7 @@ define Device/pirelli_a226m
   CHIP_ID := 6358
   CFE_EXTRAS += --signature2 IMAGE --tag-version 8
   DEVICE_PACKAGES := $(USB2_PACKAGES)
+  DEFAULT := n
 endef
 TARGET_DEVICES += pirelli_a226m
 
@@ -965,6 +977,7 @@ define Device/pirelli_agpf-s0
   CFE_EXTRAS += --signature2 IMAGE --tag-version 8
   BLOCK_SIZE := 0x20000
   DEVICE_PACKAGES := $(B43_PACKAGES) $(USB2_PACKAGES)
+  DEFAULT := n
 endef
 TARGET_DEVICES += pirelli_agpf-s0
 
@@ -1009,6 +1022,7 @@ define Device/sagem_fast-2704n
   CHIP_ID := 6318
   FLASH_MB := 8
   DEVICE_PACKAGES := $(B43_PACKAGES) $(USB2_PACKAGES)
+  DEFAULT := n
 endef
 TARGET_DEVICES += sagem_fast-2704n
 
@@ -1046,6 +1060,7 @@ define Device/sfr_neufbox-4-sercomm-r0
   CHIP_ID := 6358
   CFE_EXTRAS += --rsa-signature "$(VERSION_DIST)-$(firstword $(subst -,$(space),$(REVISION)))"
   DEVICE_PACKAGES := $(B43_PACKAGES) $(USB2_PACKAGES)
+  DEFAULT := n
 endef
 TARGET_DEVICES += sfr_neufbox-4-sercomm-r0
 
@@ -1058,6 +1073,7 @@ define Device/sfr_neufbox-4-foxconn-r1
   CHIP_ID := 6358
   CFE_EXTRAS += --rsa-signature "$(VERSION_DIST)-$(firstword $(subst -,$(space),$(REVISION)))"
   DEVICE_PACKAGES := $(B43_PACKAGES) $(USB2_PACKAGES)
+  DEFAULT := n
 endef
 TARGET_DEVICES += sfr_neufbox-4-foxconn-r1
 
@@ -1096,6 +1112,7 @@ define Device/t-com_speedport-w-303v
   CFE_BOARD_ID := 96358-502V
   CHIP_ID := 6358
   DEVICE_PACKAGES := $(B43_PACKAGES)
+  DEFAULT := n
 endef
 TARGET_DEVICES += t-com_speedport-w-303v
 
@@ -1182,6 +1199,7 @@ define Device/telsey_cpva642
   CFE_EXTRAS += --signature "Telsey Tlc" --signature2 "99.99.999" --second-image-flag "0"
   FLASH_MB := 8
   DEVICE_PACKAGES := $(RT63_PACKAGES) $(USB2_PACKAGES)
+  DEFAULT := n
 endef
 TARGET_DEVICES += telsey_cpva642
 
diff --git a/target/linux/bcm63xx/patches-5.15/111-drivers-mtd-nand-macronix-comment-unused-function.patch b/target/linux/bcm63xx/patches-5.15/111-drivers-mtd-nand-macronix-comment-unused-function.patch
new file mode 100644
index 00000000000000..38f3b8bc774f28
--- /dev/null
+++ b/target/linux/bcm63xx/patches-5.15/111-drivers-mtd-nand-macronix-comment-unused-function.patch
@@ -0,0 +1,154 @@
+From 00cf359b486a3d14c29014e9d57d92ab81972866 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 9 May 2023 14:03:08 +0200
+Subject: [PATCH] drivers: mtd: nand: macronix: comment unused function
+
+Comment unused function since macronix_nand_block_protection_support
+cause booting problems.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/mtd/nand/raw/nand_macronix.c | 132 +++++++++++++--------------
+ 1 file changed, 66 insertions(+), 66 deletions(-)
+
+--- a/drivers/mtd/nand/raw/nand_macronix.c
++++ b/drivers/mtd/nand/raw/nand_macronix.c
+@@ -179,72 +179,72 @@ static void macronix_nand_fix_broken_get
+ 		     ONFI_FEATURE_ADDR_TIMING_MODE, 1);
+ }
+ 
+-/*
+- * Macronix NAND supports Block Protection by Protectoin(PT) pin;
+- * active high at power-on which protects the entire chip even the #WP is
+- * disabled. Lock/unlock protection area can be partition according to
+- * protection bits, i.e. upper 1/2 locked, upper 1/4 locked and so on.
+- */
+-static int mxic_nand_lock(struct nand_chip *chip, loff_t ofs, uint64_t len)
+-{
+-	u8 feature[ONFI_SUBFEATURE_PARAM_LEN];
+-	int ret;
+-
+-	feature[0] = MXIC_BLOCK_PROTECTION_ALL_LOCK;
+-	nand_select_target(chip, 0);
+-	ret = nand_set_features(chip, ONFI_FEATURE_ADDR_MXIC_PROTECTION,
+-				feature);
+-	nand_deselect_target(chip);
+-	if (ret)
+-		pr_err("%s all blocks failed\n", __func__);
+-
+-	return ret;
+-}
+-
+-static int mxic_nand_unlock(struct nand_chip *chip, loff_t ofs, uint64_t len)
+-{
+-	u8 feature[ONFI_SUBFEATURE_PARAM_LEN];
+-	int ret;
+-
+-	feature[0] = MXIC_BLOCK_PROTECTION_ALL_UNLOCK;
+-	nand_select_target(chip, 0);
+-	ret = nand_set_features(chip, ONFI_FEATURE_ADDR_MXIC_PROTECTION,
+-				feature);
+-	nand_deselect_target(chip);
+-	if (ret)
+-		pr_err("%s all blocks failed\n", __func__);
+-
+-	return ret;
+-}
+-
+-static void macronix_nand_block_protection_support(struct nand_chip *chip)
+-{
+-	u8 feature[ONFI_SUBFEATURE_PARAM_LEN];
+-	int ret;
+-
+-	bitmap_set(chip->parameters.get_feature_list,
+-		   ONFI_FEATURE_ADDR_MXIC_PROTECTION, 1);
+-
+-	feature[0] = MXIC_BLOCK_PROTECTION_ALL_UNLOCK;
+-	nand_select_target(chip, 0);
+-	ret = nand_get_features(chip, ONFI_FEATURE_ADDR_MXIC_PROTECTION,
+-				feature);
+-	nand_deselect_target(chip);
+-	if (ret || feature[0] != MXIC_BLOCK_PROTECTION_ALL_LOCK) {
+-		if (ret)
+-			pr_err("Block protection check failed\n");
+-
+-		bitmap_clear(chip->parameters.get_feature_list,
+-			     ONFI_FEATURE_ADDR_MXIC_PROTECTION, 1);
+-		return;
+-	}
+-
+-	bitmap_set(chip->parameters.set_feature_list,
+-		   ONFI_FEATURE_ADDR_MXIC_PROTECTION, 1);
+-
+-	chip->ops.lock_area = mxic_nand_lock;
+-	chip->ops.unlock_area = mxic_nand_unlock;
+-}
++// /*
++//  * Macronix NAND supports Block Protection by Protectoin(PT) pin;
++//  * active high at power-on which protects the entire chip even the #WP is
++//  * disabled. Lock/unlock protection area can be partition according to
++//  * protection bits, i.e. upper 1/2 locked, upper 1/4 locked and so on.
++//  */
++// static int mxic_nand_lock(struct nand_chip *chip, loff_t ofs, uint64_t len)
++// {
++// 	u8 feature[ONFI_SUBFEATURE_PARAM_LEN];
++// 	int ret;
++
++// 	feature[0] = MXIC_BLOCK_PROTECTION_ALL_LOCK;
++// 	nand_select_target(chip, 0);
++// 	ret = nand_set_features(chip, ONFI_FEATURE_ADDR_MXIC_PROTECTION,
++// 				feature);
++// 	nand_deselect_target(chip);
++// 	if (ret)
++// 		pr_err("%s all blocks failed\n", __func__);
++
++// 	return ret;
++// }
++
++// static int mxic_nand_unlock(struct nand_chip *chip, loff_t ofs, uint64_t len)
++// {
++// 	u8 feature[ONFI_SUBFEATURE_PARAM_LEN];
++// 	int ret;
++
++// 	feature[0] = MXIC_BLOCK_PROTECTION_ALL_UNLOCK;
++// 	nand_select_target(chip, 0);
++// 	ret = nand_set_features(chip, ONFI_FEATURE_ADDR_MXIC_PROTECTION,
++// 				feature);
++// 	nand_deselect_target(chip);
++// 	if (ret)
++// 		pr_err("%s all blocks failed\n", __func__);
++
++// 	return ret;
++// }
++
++// static void macronix_nand_block_protection_support(struct nand_chip *chip)
++// {
++// 	u8 feature[ONFI_SUBFEATURE_PARAM_LEN];
++// 	int ret;
++
++// 	bitmap_set(chip->parameters.get_feature_list,
++// 		   ONFI_FEATURE_ADDR_MXIC_PROTECTION, 1);
++
++// 	feature[0] = MXIC_BLOCK_PROTECTION_ALL_UNLOCK;
++// 	nand_select_target(chip, 0);
++// 	ret = nand_get_features(chip, ONFI_FEATURE_ADDR_MXIC_PROTECTION,
++// 				feature);
++// 	nand_deselect_target(chip);
++// 	if (ret || feature[0] != MXIC_BLOCK_PROTECTION_ALL_LOCK) {
++// 		if (ret)
++// 			pr_err("Block protection check failed\n");
++
++// 		bitmap_clear(chip->parameters.get_feature_list,
++// 			     ONFI_FEATURE_ADDR_MXIC_PROTECTION, 1);
++// 		return;
++// 	}
++
++// 	bitmap_set(chip->parameters.set_feature_list,
++// 		   ONFI_FEATURE_ADDR_MXIC_PROTECTION, 1);
++
++// 	chip->ops.lock_area = mxic_nand_lock;
++// 	chip->ops.unlock_area = mxic_nand_unlock;
++// }
+ 
+ static int nand_power_down_op(struct nand_chip *chip)
+ {
diff --git a/target/linux/bcm63xx/patches-5.15/143-gpio-fix-device-tree-gpio-hogs-on-dual-role-gpio-pin.patch b/target/linux/bcm63xx/patches-5.15/143-gpio-fix-device-tree-gpio-hogs-on-dual-role-gpio-pin.patch
index fe134a3a44b102..4874fd1237980c 100644
--- a/target/linux/bcm63xx/patches-5.15/143-gpio-fix-device-tree-gpio-hogs-on-dual-role-gpio-pin.patch
+++ b/target/linux/bcm63xx/patches-5.15/143-gpio-fix-device-tree-gpio-hogs-on-dual-role-gpio-pin.patch
@@ -116,7 +116,7 @@ Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
  }
 --- a/drivers/gpio/gpiolib.c
 +++ b/drivers/gpio/gpiolib.c
-@@ -1768,7 +1768,8 @@ int gpiochip_add_pingroup_range(struct g
+@@ -1802,7 +1802,8 @@ int gpiochip_add_pingroup_range(struct g
  
  	list_add_tail(&pin_range->node, &gdev->pin_ranges);
  
@@ -126,7 +126,7 @@ Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
  }
  EXPORT_SYMBOL_GPL(gpiochip_add_pingroup_range);
  
-@@ -1825,7 +1826,7 @@ int gpiochip_add_pin_range(struct gpio_c
+@@ -1859,7 +1860,7 @@ int gpiochip_add_pin_range(struct gpio_c
  
  	list_add_tail(&pin_range->node, &gdev->pin_ranges);
  
diff --git a/target/linux/bcm63xx/patches-5.15/339-MIPS-BCM63XX-add-support-for-BCM63268.patch b/target/linux/bcm63xx/patches-5.15/339-MIPS-BCM63XX-add-support-for-BCM63268.patch
index bba964f4811e0e..50732865a4f484 100644
--- a/target/linux/bcm63xx/patches-5.15/339-MIPS-BCM63XX-add-support-for-BCM63268.patch
+++ b/target/linux/bcm63xx/patches-5.15/339-MIPS-BCM63XX-add-support-for-BCM63268.patch
@@ -46,16 +46,37 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		val = bcm_mpi_readl(MPI_CSBASE_REG(0));
 --- a/arch/mips/bcm63xx/clk.c
 +++ b/arch/mips/bcm63xx/clk.c
-@@ -169,6 +169,8 @@ static void enetsw_set(struct clk *clk,
+@@ -52,6 +52,18 @@ static void bcm_hwclock_set(u32 mask, in
+ 	bcm_perf_writel(reg, PERF_CKCTL_REG);
+ }
+ 
++static void bcm_gpiorobosw_set(u32 mask, int enable)
++{
++	u32 reg;
++
++	reg = bcm_gpio_readl(GPIO_ROBOSW_SW_CTRL_REG);
++	if (enable)
++		reg |= mask;
++	else
++		reg &= ~mask;
++	bcm_gpio_writel(reg, GPIO_ROBOSW_SW_CTRL_REG);
++}
++
+ /*
+  * Ethernet MAC "misc" clock: dma clocks and main clock on 6348
+  */
+@@ -169,6 +181,10 @@ static void enetsw_set(struct clk *clk,
  			clk_disable_unlocked(&clk_swpkt_sar);
  		}
  		bcm_hwclock_set(CKCTL_6368_ROBOSW_EN, enable);
 +	} else if (BCMCPU_IS_63268()) {
++		bcm_gpiorobosw_set(GPIO_ROBOSW_MII_DUMB_FWDG_EN |
++				   GPIO_ROBOSW_HW_FWDG_EN, enable);
 +		bcm_hwclock_set(CKCTL_63268_ROBOSW_EN, enable);
  	} else {
  		return;
  	}
-@@ -214,6 +216,8 @@ static void usbh_set(struct clk *clk, in
+@@ -214,6 +230,8 @@ static void usbh_set(struct clk *clk, in
  		bcm_hwclock_set(CKCTL_6362_USBH_EN, enable);
  	else if (BCMCPU_IS_6368())
  		bcm_hwclock_set(CKCTL_6368_USBH_EN, enable);
@@ -64,7 +85,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	else
  		return;
  
-@@ -236,6 +240,8 @@ static void usbd_set(struct clk *clk, in
+@@ -236,6 +254,8 @@ static void usbd_set(struct clk *clk, in
  		bcm_hwclock_set(CKCTL_6362_USBD_EN, enable);
  	else if (BCMCPU_IS_6368())
  		bcm_hwclock_set(CKCTL_6368_USBD_EN, enable);
@@ -73,7 +94,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	else
  		return;
  
-@@ -262,9 +268,13 @@ static void spi_set(struct clk *clk, int
+@@ -262,9 +282,13 @@ static void spi_set(struct clk *clk, int
  		mask = CKCTL_6358_SPI_EN;
  	else if (BCMCPU_IS_6362())
  		mask = CKCTL_6362_SPI_EN;
@@ -89,7 +110,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	bcm_hwclock_set(mask, enable);
  }
  
-@@ -283,6 +293,8 @@ static void hsspi_set(struct clk *clk, i
+@@ -283,6 +307,8 @@ static void hsspi_set(struct clk *clk, i
  		mask = CKCTL_6328_HSSPI_EN;
  	else if (BCMCPU_IS_6362())
  		mask = CKCTL_6362_HSSPI_EN;
@@ -98,7 +119,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	else
  		return;
  
-@@ -352,6 +364,8 @@ static void pcie_set(struct clk *clk, in
+@@ -352,6 +378,8 @@ static void pcie_set(struct clk *clk, in
  		bcm_hwclock_set(CKCTL_6328_PCIE_EN, enable);
  	else if (BCMCPU_IS_6362())
  		bcm_hwclock_set(CKCTL_6362_PCIE_EN, enable);
@@ -107,7 +128,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  }
  
  static struct clk clk_pcie = {
-@@ -548,6 +562,21 @@ static struct clk_lookup bcm6368_clks[]
+@@ -550,6 +578,21 @@ static struct clk_lookup bcm6368_clks[]
  	CLKDEV_INIT(NULL, "ipsec", &clk_ipsec),
  };
  
@@ -129,7 +150,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  #define HSSPI_PLL_HZ_6328	133333333
  #define HSSPI_PLL_HZ_6362	400000000
  
-@@ -580,6 +609,10 @@ static int __init bcm63xx_clk_init(void)
+@@ -582,6 +625,10 @@ static int __init bcm63xx_clk_init(void)
  	case BCM6368_CPU_ID:
  		clkdev_add_table(bcm6368_clks, ARRAY_SIZE(bcm6368_clks));
  		break;
@@ -663,7 +684,19 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  /* MIPS PLL control register */
  #define PERF_MIPSPLLCTL_REG		0x34
  #define MIPSPLLCTL_N1_SHIFT		20
-@@ -1367,6 +1439,13 @@
+@@ -559,6 +631,11 @@
+ #define STRAPBUS_6368_BOOT_SEL_SERIAL	1
+ #define STRAPBUS_6368_BOOT_SEL_PARALLEL 3
+ 
++/* BCM6318 BCM6328 BCM6362 BCM63268 */
++#define GPIO_ROBOSW_SW_CTRL_REG		0x40
++#define GPIO_ROBOSW_MII_DUMB_FWDG_EN	(1 << 0)
++#define GPIO_ROBOSW_HW_FWDG_EN		(1 << 3)
++
+ 
+ /*************************************************************************
+  * _REG relative to RSET_ENET
+@@ -1367,6 +1444,13 @@
  #define STRAPBUS_6362_BOOT_SEL_SERIAL	(1 << 15)
  #define STRAPBUS_6362_BOOT_SEL_NAND	(0 << 15)
  
diff --git a/target/linux/bcm63xx/patches-5.15/341-MIPS-BCM63XX-add-support-for-BCM6318.patch b/target/linux/bcm63xx/patches-5.15/341-MIPS-BCM63XX-add-support-for-BCM6318.patch
index cb0f8f3e1b6704..121d02a81a4c0a 100644
--- a/target/linux/bcm63xx/patches-5.15/341-MIPS-BCM63XX-add-support-for-BCM6318.patch
+++ b/target/linux/bcm63xx/patches-5.15/341-MIPS-BCM63XX-add-support-for-BCM6318.patch
@@ -46,7 +46,7 @@ Subject: [PATCH 51/53] MIPS: BCM63XX: add support for BCM6318
  		val = bcm_mpi_readl(MPI_CSBASE_REG(0));
 --- a/arch/mips/bcm63xx/clk.c
 +++ b/arch/mips/bcm63xx/clk.c
-@@ -289,7 +289,9 @@ static void hsspi_set(struct clk *clk, i
+@@ -303,7 +303,9 @@ static void hsspi_set(struct clk *clk, i
  {
  	u32 mask;
  
@@ -57,7 +57,7 @@ Subject: [PATCH 51/53] MIPS: BCM63XX: add support for BCM6318
  		mask = CKCTL_6328_HSSPI_EN;
  	else if (BCMCPU_IS_6362())
  		mask = CKCTL_6362_HSSPI_EN;
-@@ -456,6 +458,19 @@ static struct clk_lookup bcm3368_clks[]
+@@ -472,6 +474,19 @@ static struct clk_lookup bcm3368_clks[]
  	CLKDEV_INIT("bcm63xx_enet.1", "enet", &clk_enet1),
  };
  
@@ -77,7 +77,7 @@ Subject: [PATCH 51/53] MIPS: BCM63XX: add support for BCM6318
  static struct clk_lookup bcm6328_clks[] = {
  	/* fixed rate clocks */
  	CLKDEV_INIT(NULL, "periph", &clk_periph),
-@@ -577,6 +592,7 @@ static struct clk_lookup bcm63268_clks[]
+@@ -593,6 +608,7 @@ static struct clk_lookup bcm63268_clks[]
  	CLKDEV_INIT(NULL, "pcie", &clk_pcie),
  };
  
@@ -85,7 +85,7 @@ Subject: [PATCH 51/53] MIPS: BCM63XX: add support for BCM6318
  #define HSSPI_PLL_HZ_6328	133333333
  #define HSSPI_PLL_HZ_6362	400000000
  
-@@ -586,6 +602,10 @@ static int __init bcm63xx_clk_init(void)
+@@ -602,6 +618,10 @@ static int __init bcm63xx_clk_init(void)
  	case BCM3368_CPU_ID:
  		clkdev_add_table(bcm3368_clks, ARRAY_SIZE(bcm3368_clks));
  		break;
@@ -599,7 +599,7 @@ Subject: [PATCH 51/53] MIPS: BCM63XX: add support for BCM6318
  #define TIMER_CTL0_REG			0x4
  #define TIMER_CTL1_REG			0x8
  #define TIMER_CTL2_REG			0xC
-@@ -1254,6 +1326,8 @@
+@@ -1259,6 +1331,8 @@
  #define SDRAM_CFG_32B_MASK		(1 << SDRAM_CFG_32B_SHIFT)
  #define SDRAM_CFG_BANK_SHIFT		13
  #define SDRAM_CFG_BANK_MASK		(1 << SDRAM_CFG_BANK_SHIFT)
diff --git a/target/linux/bcm63xx/patches-5.15/343-MIPS-BCM63XX-add-PCIe-support-for-BCM6318.patch b/target/linux/bcm63xx/patches-5.15/343-MIPS-BCM63XX-add-PCIe-support-for-BCM6318.patch
index 1ebb451b59e3fe..feba1a6ef71eb0 100644
--- a/target/linux/bcm63xx/patches-5.15/343-MIPS-BCM63XX-add-PCIe-support-for-BCM6318.patch
+++ b/target/linux/bcm63xx/patches-5.15/343-MIPS-BCM63XX-add-PCIe-support-for-BCM6318.patch
@@ -13,8 +13,8 @@ Subject: [PATCH 53/53] MIPS: BCM63XX: add PCIe support for BCM6318
 
 --- a/arch/mips/bcm63xx/clk.c
 +++ b/arch/mips/bcm63xx/clk.c
-@@ -52,6 +52,18 @@ static void bcm_hwclock_set(u32 mask, in
- 	bcm_perf_writel(reg, PERF_CKCTL_REG);
+@@ -64,6 +64,18 @@ static void bcm_gpiorobosw_set(u32 mask,
+ 	bcm_gpio_writel(reg, GPIO_ROBOSW_SW_CTRL_REG);
  }
  
 +static void bcm_ub_hwclock_set(u32 mask, int enable)
@@ -32,7 +32,7 @@ Subject: [PATCH 53/53] MIPS: BCM63XX: add PCIe support for BCM6318
  /*
   * Ethernet MAC "misc" clock: dma clocks and main clock on 6348
   */
-@@ -362,12 +374,17 @@ static struct clk clk_ipsec = {
+@@ -376,12 +388,17 @@ static struct clk clk_ipsec = {
  
  static void pcie_set(struct clk *clk, int enable)
  {
@@ -70,7 +70,7 @@ Subject: [PATCH 53/53] MIPS: BCM63XX: add PCIe support for BCM6318
  #define BCM_PCIE_MEM_END_PA_6328	(BCM_PCIE_MEM_BASE_PA_6328 +	\
 --- a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_regs.h
 +++ b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_regs.h
-@@ -1530,6 +1530,17 @@
+@@ -1535,6 +1535,17 @@
   * _REG relative to RSET_PCIE
   *************************************************************************/
  
@@ -88,7 +88,7 @@ Subject: [PATCH 53/53] MIPS: BCM63XX: add PCIe support for BCM6318
  #define PCIE_CONFIG2_REG		0x408
  #define CONFIG2_BAR1_SIZE_EN		1
  #define CONFIG2_BAR1_SIZE_MASK		0xf
-@@ -1575,7 +1586,54 @@
+@@ -1580,7 +1591,54 @@
  #define PCIE_RC_INT_C			(1 << 2)
  #define PCIE_RC_INT_D			(1 << 3)
  
diff --git a/target/linux/bcm63xx/patches-5.15/346-MIPS-BCM63XX-USB-ENETSW-6318-clocks.patch b/target/linux/bcm63xx/patches-5.15/346-MIPS-BCM63XX-USB-ENETSW-6318-clocks.patch
index a8eea5b1190617..f6fb193d6ad849 100644
--- a/target/linux/bcm63xx/patches-5.15/346-MIPS-BCM63XX-USB-ENETSW-6318-clocks.patch
+++ b/target/linux/bcm63xx/patches-5.15/346-MIPS-BCM63XX-USB-ENETSW-6318-clocks.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/clk.c
 +++ b/arch/mips/bcm63xx/clk.c
-@@ -168,7 +168,11 @@ static struct clk clk_swpkt_usb = {
+@@ -180,7 +180,11 @@ static struct clk clk_swpkt_usb = {
   */
  static void enetsw_set(struct clk *clk, int enable)
  {
@@ -13,7 +13,7 @@
  		bcm_hwclock_set(CKCTL_6328_ROBOSW_EN, enable);
  	} else if (BCMCPU_IS_6362()) {
  		bcm_hwclock_set(CKCTL_6362_ROBOSW_EN, enable);
-@@ -220,18 +224,22 @@ static struct clk clk_pcm = {
+@@ -234,18 +238,22 @@ static struct clk clk_pcm = {
   */
  static void usbh_set(struct clk *clk, int enable)
  {
diff --git a/target/linux/bcm63xx/patches-5.15/347-MIPS-BCM6318-USB-support.patch b/target/linux/bcm63xx/patches-5.15/347-MIPS-BCM6318-USB-support.patch
index 15d4679670ee6e..ddbb30d04f0600 100644
--- a/target/linux/bcm63xx/patches-5.15/347-MIPS-BCM6318-USB-support.patch
+++ b/target/linux/bcm63xx/patches-5.15/347-MIPS-BCM6318-USB-support.patch
@@ -71,7 +71,7 @@
  
  #define GPIO_PINMUX_OTHR_REG		0x24
  #define GPIO_PINMUX_OTHR_6328_USB_SHIFT 12
-@@ -1000,6 +1006,7 @@
+@@ -1005,6 +1011,7 @@
  
  #define USBH_PRIV_SWAP_6358_REG		0x0
  #define USBH_PRIV_SWAP_6368_REG		0x1c
@@ -79,7 +79,7 @@
  
  #define USBH_PRIV_SWAP_USBD_SHIFT	6
  #define USBH_PRIV_SWAP_USBD_MASK	(1 << USBH_PRIV_SWAP_USBD_SHIFT)
-@@ -1025,6 +1032,13 @@
+@@ -1030,6 +1037,13 @@
  #define USBH_PRIV_SETUP_IOC_SHIFT	4
  #define USBH_PRIV_SETUP_IOC_MASK	(1 << USBH_PRIV_SETUP_IOC_SHIFT)
  
diff --git a/target/linux/bcm63xx/patches-5.15/348-MIPS-BCM63XX-fix-BCM63268-USB-clock.patch b/target/linux/bcm63xx/patches-5.15/348-MIPS-BCM63XX-fix-BCM63268-USB-clock.patch
index cdff8d5a4d885c..e4496227c19503 100644
--- a/target/linux/bcm63xx/patches-5.15/348-MIPS-BCM63XX-fix-BCM63268-USB-clock.patch
+++ b/target/linux/bcm63xx/patches-5.15/348-MIPS-BCM63XX-fix-BCM63268-USB-clock.patch
@@ -10,7 +10,7 @@
  
  /*************************************************************************
   * _REG relative to RSET_WDT
-@@ -1534,6 +1537,11 @@
+@@ -1539,6 +1542,11 @@
  #define STRAPBUS_63268_FCVO_SHIFT	21
  #define STRAPBUS_63268_FCVO_MASK	(0xf << STRAPBUS_63268_FCVO_SHIFT)
  
@@ -24,7 +24,7 @@
  #define STRAPBUS_6328_FCVO_MASK		(0x1f << STRAPBUS_6328_FCVO_SHIFT)
 --- a/arch/mips/bcm63xx/clk.c
 +++ b/arch/mips/bcm63xx/clk.c
-@@ -64,6 +64,26 @@ static void bcm_ub_hwclock_set(u32 mask,
+@@ -76,6 +76,26 @@ static void bcm_ub_hwclock_set(u32 mask,
  	bcm_perf_writel(reg, PERF_UB_CKCTL_REG);
  }
  
@@ -51,7 +51,7 @@
  /*
   * Ethernet MAC "misc" clock: dma clocks and main clock on 6348
   */
-@@ -236,7 +256,17 @@ static void usbh_set(struct clk *clk, in
+@@ -250,7 +270,17 @@ static void usbh_set(struct clk *clk, in
  	} else if (BCMCPU_IS_6368()) {
  		bcm_hwclock_set(CKCTL_6368_USBH_EN, enable);
  	} else if (BCMCPU_IS_63268()) {
diff --git a/target/linux/bcm63xx/patches-5.15/349-MIPS-BCM63XX-add-BCM63268-USB-support.patch b/target/linux/bcm63xx/patches-5.15/349-MIPS-BCM63XX-add-BCM63268-USB-support.patch
index 3f98ddfdc36eac..05f58c6f9f3856 100644
--- a/target/linux/bcm63xx/patches-5.15/349-MIPS-BCM63XX-add-BCM63268-USB-support.patch
+++ b/target/linux/bcm63xx/patches-5.15/349-MIPS-BCM63XX-add-BCM63268-USB-support.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_regs.h
 +++ b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_regs.h
-@@ -1034,11 +1034,18 @@
+@@ -1039,11 +1039,18 @@
  #define USBH_PRIV_SETUP_6368_REG	0x28
  #define USBH_PRIV_SETUP_IOC_SHIFT	4
  #define USBH_PRIV_SETUP_IOC_MASK	(1 << USBH_PRIV_SETUP_IOC_SHIFT)
diff --git a/target/linux/bcm63xx/patches-5.15/389-MIPS-BCM63XX-add-clkdev-lookups-for-device-tree.patch b/target/linux/bcm63xx/patches-5.15/389-MIPS-BCM63XX-add-clkdev-lookups-for-device-tree.patch
index d6b1190b9d8afa..012aab16d99682 100644
--- a/target/linux/bcm63xx/patches-5.15/389-MIPS-BCM63XX-add-clkdev-lookups-for-device-tree.patch
+++ b/target/linux/bcm63xx/patches-5.15/389-MIPS-BCM63XX-add-clkdev-lookups-for-device-tree.patch
@@ -9,7 +9,7 @@ Subject: [PATCH] MIPS: BCM63XX: add clkdev lookups for device tree
 
 --- a/arch/mips/bcm63xx/clk.c
 +++ b/arch/mips/bcm63xx/clk.c
-@@ -501,6 +501,8 @@ static struct clk_lookup bcm3368_clks[]
+@@ -517,6 +517,8 @@ static struct clk_lookup bcm3368_clks[]
  	CLKDEV_INIT(NULL, "periph", &clk_periph),
  	CLKDEV_INIT("bcm63xx_uart.0", "refclk", &clk_periph),
  	CLKDEV_INIT("bcm63xx_uart.1", "refclk", &clk_periph),
@@ -18,7 +18,7 @@ Subject: [PATCH] MIPS: BCM63XX: add clkdev lookups for device tree
  	/* gated clocks */
  	CLKDEV_INIT(NULL, "enet0", &clk_enet0),
  	CLKDEV_INIT(NULL, "enet1", &clk_enet1),
-@@ -517,7 +519,9 @@ static struct clk_lookup bcm6318_clks[]
+@@ -533,7 +535,9 @@ static struct clk_lookup bcm6318_clks[]
  	/* fixed rate clocks */
  	CLKDEV_INIT(NULL, "periph", &clk_periph),
  	CLKDEV_INIT("bcm63xx_uart.0", "refclk", &clk_periph),
@@ -28,7 +28,7 @@ Subject: [PATCH] MIPS: BCM63XX: add clkdev lookups for device tree
  	/* gated clocks */
  	CLKDEV_INIT(NULL, "enetsw", &clk_enetsw),
  	CLKDEV_INIT(NULL, "usbh", &clk_usbh),
-@@ -531,7 +535,10 @@ static struct clk_lookup bcm6328_clks[]
+@@ -547,7 +551,10 @@ static struct clk_lookup bcm6328_clks[]
  	CLKDEV_INIT(NULL, "periph", &clk_periph),
  	CLKDEV_INIT("bcm63xx_uart.0", "refclk", &clk_periph),
  	CLKDEV_INIT("bcm63xx_uart.1", "refclk", &clk_periph),
@@ -39,7 +39,7 @@ Subject: [PATCH] MIPS: BCM63XX: add clkdev lookups for device tree
  	/* gated clocks */
  	CLKDEV_INIT(NULL, "enetsw", &clk_enetsw),
  	CLKDEV_INIT(NULL, "usbh", &clk_usbh),
-@@ -544,6 +551,7 @@ static struct clk_lookup bcm6338_clks[]
+@@ -560,6 +567,7 @@ static struct clk_lookup bcm6338_clks[]
  	/* fixed rate clocks */
  	CLKDEV_INIT(NULL, "periph", &clk_periph),
  	CLKDEV_INIT("bcm63xx_uart.0", "refclk", &clk_periph),
@@ -47,7 +47,7 @@ Subject: [PATCH] MIPS: BCM63XX: add clkdev lookups for device tree
  	/* gated clocks */
  	CLKDEV_INIT(NULL, "enet0", &clk_enet0),
  	CLKDEV_INIT(NULL, "enet1", &clk_enet1),
-@@ -558,6 +566,7 @@ static struct clk_lookup bcm6345_clks[]
+@@ -574,6 +582,7 @@ static struct clk_lookup bcm6345_clks[]
  	/* fixed rate clocks */
  	CLKDEV_INIT(NULL, "periph", &clk_periph),
  	CLKDEV_INIT("bcm63xx_uart.0", "refclk", &clk_periph),
@@ -55,7 +55,7 @@ Subject: [PATCH] MIPS: BCM63XX: add clkdev lookups for device tree
  	/* gated clocks */
  	CLKDEV_INIT(NULL, "enet0", &clk_enet0),
  	CLKDEV_INIT(NULL, "enet1", &clk_enet1),
-@@ -572,6 +581,7 @@ static struct clk_lookup bcm6348_clks[]
+@@ -588,6 +597,7 @@ static struct clk_lookup bcm6348_clks[]
  	/* fixed rate clocks */
  	CLKDEV_INIT(NULL, "periph", &clk_periph),
  	CLKDEV_INIT("bcm63xx_uart.0", "refclk", &clk_periph),
@@ -63,7 +63,7 @@ Subject: [PATCH] MIPS: BCM63XX: add clkdev lookups for device tree
  	/* gated clocks */
  	CLKDEV_INIT(NULL, "enet0", &clk_enet0),
  	CLKDEV_INIT(NULL, "enet1", &clk_enet1),
-@@ -588,6 +598,8 @@ static struct clk_lookup bcm6358_clks[]
+@@ -604,6 +614,8 @@ static struct clk_lookup bcm6358_clks[]
  	CLKDEV_INIT(NULL, "periph", &clk_periph),
  	CLKDEV_INIT("bcm63xx_uart.0", "refclk", &clk_periph),
  	CLKDEV_INIT("bcm63xx_uart.1", "refclk", &clk_periph),
@@ -72,7 +72,7 @@ Subject: [PATCH] MIPS: BCM63XX: add clkdev lookups for device tree
  	/* gated clocks */
  	CLKDEV_INIT(NULL, "enet0", &clk_enet0),
  	CLKDEV_INIT(NULL, "enet1", &clk_enet1),
-@@ -607,7 +619,10 @@ static struct clk_lookup bcm6362_clks[]
+@@ -623,7 +635,10 @@ static struct clk_lookup bcm6362_clks[]
  	CLKDEV_INIT(NULL, "periph", &clk_periph),
  	CLKDEV_INIT("bcm63xx_uart.0", "refclk", &clk_periph),
  	CLKDEV_INIT("bcm63xx_uart.1", "refclk", &clk_periph),
@@ -83,7 +83,7 @@ Subject: [PATCH] MIPS: BCM63XX: add clkdev lookups for device tree
  	/* gated clocks */
  	CLKDEV_INIT(NULL, "enetsw", &clk_enetsw),
  	CLKDEV_INIT(NULL, "usbh", &clk_usbh),
-@@ -623,6 +638,8 @@ static struct clk_lookup bcm6368_clks[]
+@@ -639,6 +654,8 @@ static struct clk_lookup bcm6368_clks[]
  	CLKDEV_INIT(NULL, "periph", &clk_periph),
  	CLKDEV_INIT("bcm63xx_uart.0", "refclk", &clk_periph),
  	CLKDEV_INIT("bcm63xx_uart.1", "refclk", &clk_periph),
@@ -92,7 +92,7 @@ Subject: [PATCH] MIPS: BCM63XX: add clkdev lookups for device tree
  	/* gated clocks */
  	CLKDEV_INIT(NULL, "enetsw", &clk_enetsw),
  	CLKDEV_INIT(NULL, "usbh", &clk_usbh),
-@@ -637,7 +654,10 @@ static struct clk_lookup bcm63268_clks[]
+@@ -653,7 +670,10 @@ static struct clk_lookup bcm63268_clks[]
  	CLKDEV_INIT(NULL, "periph", &clk_periph),
  	CLKDEV_INIT("bcm63xx_uart.0", "refclk", &clk_periph),
  	CLKDEV_INIT("bcm63xx_uart.1", "refclk", &clk_periph),
diff --git a/target/linux/bcm63xx/patches-5.15/393-bcm6358-power-cycle-usb-pll.patch b/target/linux/bcm63xx/patches-5.15/393-bcm6358-power-cycle-usb-pll.patch
new file mode 100644
index 00000000000000..43b82bca32e340
--- /dev/null
+++ b/target/linux/bcm63xx/patches-5.15/393-bcm6358-power-cycle-usb-pll.patch
@@ -0,0 +1,47 @@
+--- a/arch/mips/bcm63xx/clk.c
++++ b/arch/mips/bcm63xx/clk.c
+@@ -258,6 +258,8 @@ static struct clk clk_pcm = {
+  */
+ static void usbh_set(struct clk *clk, int enable)
+ {
++	u32 reg;
++
+ 	if (BCMCPU_IS_6318()) {
+ 		bcm_hwclock_set(CKCTL_6318_USB_EN, enable);
+ 		bcm_ub_hwclock_set(UB_CKCTL_6318_USB_EN, enable);
+@@ -265,13 +267,19 @@ static void usbh_set(struct clk *clk, in
+ 		bcm_hwclock_set(CKCTL_6328_USBH_EN, enable);
+ 	} else if (BCMCPU_IS_6348()) {
+ 		bcm_hwclock_set(CKCTL_6348_USBH_EN, enable);
++	} else if (BCMCPU_IS_6358()) {
++		/* power cycle the USB PLL */
++		reg = bcm_rset_readl(RSET_USBH_PRIV, USBH_PRIV_PLL_CTRL_6358_REG);
++		reg &= ~USBH_PRIV_PLL_CTRL_6358_EN;
++		bcm_rset_writel(RSET_USBH_PRIV, reg, USBH_PRIV_PLL_CTRL_6358_REG);
++		mdelay(1);
++		reg |= USBH_PRIV_PLL_CTRL_6358_EN;
++		bcm_rset_writel(RSET_USBH_PRIV, reg, USBH_PRIV_PLL_CTRL_6358_REG);
+ 	} else if (BCMCPU_IS_6362()) {
+ 		bcm_hwclock_set(CKCTL_6362_USBH_EN, enable);
+ 	} else if (BCMCPU_IS_6368()) {
+ 		bcm_hwclock_set(CKCTL_6368_USBH_EN, enable);
+ 	} else if (BCMCPU_IS_63268()) {
+-		u32 reg;
+-
+ 		bcm_hwclock_set(CKCTL_63268_USBH_EN, enable);
+ 		bcm_misc_iddq_set(IDDQ_CTRL_63268_USBH, enable);
+ 		bcm63xx_core_set_reset(BCM63XX_RESET_USBH, !enable);
+--- a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_regs.h
++++ b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_regs.h
+@@ -1043,9 +1043,11 @@
+ #define USBH_PRIV_SETUP_IPP_MASK	(1 << USBH_PRIV_SETUP_IPP_SHIFT)
+ 
+ #define USBH_PRIV_SETUP_6318_REG	0x00
++#define USBH_PRIV_PLL_CTRL_6358_REG	0x0c
+ #define USBH_PRIV_PLL_CTRL1_6368_REG	0x18
+ #define USBH_PRIV_PLL_CTRL1_6318_REG	0x04
+ 
++#define USBH_PRIV_PLL_CTRL_6358_EN		(1 << 25)
+ #define USBH_PRIV_PLL_CTRL1_6318_SUSP_EN	(1 << 27)
+ #define USBH_PRIV_PLL_CTRL1_6318_IDDQ_PWRDN	(1 << 31)
+ #define USBH_PRIV_PLL_CTRL1_63268_IDDQ_PWRDN	(1 << 9)
diff --git a/target/linux/bcm63xx/patches-5.15/408-bcm63xx_enet-enable-rgmii-clock-on-external-ports.patch b/target/linux/bcm63xx/patches-5.15/408-bcm63xx_enet-enable-rgmii-clock-on-external-ports.patch
index 575c433d348870..f2b0d70d4a64a5 100644
--- a/target/linux/bcm63xx/patches-5.15/408-bcm63xx_enet-enable-rgmii-clock-on-external-ports.patch
+++ b/target/linux/bcm63xx/patches-5.15/408-bcm63xx_enet-enable-rgmii-clock-on-external-ports.patch
@@ -10,7 +10,7 @@ Subject: [PATCH 54/81] bcm63xx_enet: enable rgmii clock on external ports
 
 --- a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_regs.h
 +++ b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_regs.h
-@@ -968,6 +968,19 @@
+@@ -973,6 +973,19 @@
  #define ENETSW_PORTOV_FDX_MASK		(1 << 1)
  #define ENETSW_PORTOV_LINKUP_MASK	(1 << 0)
  
diff --git a/target/linux/bcm63xx/patches-5.15/411-MIPS-BCM63XX-Register-SPI-flash-if-present.patch b/target/linux/bcm63xx/patches-5.15/411-MIPS-BCM63XX-Register-SPI-flash-if-present.patch
index 0a3b34b743b8a0..364e7005338d2a 100644
--- a/target/linux/bcm63xx/patches-5.15/411-MIPS-BCM63XX-Register-SPI-flash-if-present.patch
+++ b/target/linux/bcm63xx/patches-5.15/411-MIPS-BCM63XX-Register-SPI-flash-if-present.patch
@@ -146,7 +146,7 @@ Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
  #define STRAPBUS_6368_BOOT_SEL_MASK	0x3
  #define STRAPBUS_6368_BOOT_SEL_NAND	0
  #define STRAPBUS_6368_BOOT_SEL_SERIAL	1
-@@ -1565,6 +1566,7 @@
+@@ -1572,6 +1573,7 @@
  #define IDDQ_CTRL_63268_USBH		(1 << 4)
  
  #define MISC_STRAPBUS_6328_REG		0x240
diff --git a/target/linux/bcm63xx/patches-5.15/430-MIPS-BCM63XX-add-nand-clocks.patch b/target/linux/bcm63xx/patches-5.15/430-MIPS-BCM63XX-add-nand-clocks.patch
index a29c3b780bf231..432c2251761fe1 100644
--- a/target/linux/bcm63xx/patches-5.15/430-MIPS-BCM63XX-add-nand-clocks.patch
+++ b/target/linux/bcm63xx/patches-5.15/430-MIPS-BCM63XX-add-nand-clocks.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/clk.c
 +++ b/arch/mips/bcm63xx/clk.c
-@@ -430,6 +430,23 @@ static struct clk clk_pcie = {
+@@ -452,6 +452,23 @@ static struct clk clk_pcie = {
  };
  
  /*
@@ -24,7 +24,7 @@
   * Internal peripheral clock
   */
  static struct clk clk_periph = {
-@@ -624,6 +641,7 @@ static struct clk_lookup bcm6362_clks[]
+@@ -648,6 +665,7 @@ static struct clk_lookup bcm6362_clks[]
  	CLKDEV_INIT("bcm63xx-hsspi.0", "pll", &clk_hsspi_pll),
  	CLKDEV_INIT("10001000.spi", "pll", &clk_hsspi_pll),
  	/* gated clocks */
@@ -32,7 +32,7 @@
  	CLKDEV_INIT(NULL, "enetsw", &clk_enetsw),
  	CLKDEV_INIT(NULL, "usbh", &clk_usbh),
  	CLKDEV_INIT(NULL, "usbd", &clk_usbd),
-@@ -641,6 +659,7 @@ static struct clk_lookup bcm6368_clks[]
+@@ -665,6 +683,7 @@ static struct clk_lookup bcm6368_clks[]
  	CLKDEV_INIT("10000100.serial", "refclk", &clk_periph),
  	CLKDEV_INIT("10000120.serial", "refclk", &clk_periph),
  	/* gated clocks */
@@ -40,7 +40,7 @@
  	CLKDEV_INIT(NULL, "enetsw", &clk_enetsw),
  	CLKDEV_INIT(NULL, "usbh", &clk_usbh),
  	CLKDEV_INIT(NULL, "usbd", &clk_usbd),
-@@ -659,6 +678,7 @@ static struct clk_lookup bcm63268_clks[]
+@@ -683,6 +702,7 @@ static struct clk_lookup bcm63268_clks[]
  	CLKDEV_INIT("bcm63xx-hsspi.0", "pll", &clk_hsspi_pll),
  	CLKDEV_INIT("10001000.spi", "pll", &clk_hsspi_pll),
  	/* gated clocks */
diff --git a/target/linux/bcm63xx/patches-5.15/431-MIPS-BCM63XX-add-nand-rset.patch b/target/linux/bcm63xx/patches-5.15/431-MIPS-BCM63XX-add-nand-rset.patch
index 090ffeb43cefee..75eea3a66c26e1 100644
--- a/target/linux/bcm63xx/patches-5.15/431-MIPS-BCM63XX-add-nand-rset.patch
+++ b/target/linux/bcm63xx/patches-5.15/431-MIPS-BCM63XX-add-nand-rset.patch
@@ -111,7 +111,7 @@
  #endif /* ! BCM63XX_IO_H_ */
 --- a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_regs.h
 +++ b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_regs.h
-@@ -1688,4 +1688,31 @@
+@@ -1695,4 +1695,31 @@
  #define OTP_USER_BITS_6328_REG(i)	(0x20 + (i) * 4)
  #define   OTP_6328_REG3_TP1_DISABLED	BIT(9)
  
diff --git a/target/linux/bcm63xx/profiles/default.mk b/target/linux/bcm63xx/profiles/default.mk
index 3e8b07d35f08b0..65f2111087daa9 100644
--- a/target/linux/bcm63xx/profiles/default.mk
+++ b/target/linux/bcm63xx/profiles/default.mk
@@ -4,7 +4,7 @@
 
 define Profile/Default
   NAME:=Default Profile
-  PACKAGES:=kmod-b43 wpad-basic-wolfssl
+  PACKAGES:=kmod-b43 wpad-basic-mbedtls
   PRIORITY:=1
 endef
 
diff --git a/target/linux/bmips/Makefile b/target/linux/bmips/Makefile
index fa648665d97f7e..f45a70c2895e9e 100644
--- a/target/linux/bmips/Makefile
+++ b/target/linux/bmips/Makefile
@@ -6,10 +6,11 @@ ARCH:=mips
 CPU_TYPE:=mips32
 BOARD:=bmips
 BOARDNAME:=Broadcom BMIPS
-SUBTARGETS:=generic nand
-FEATURES:=gpio source-only squashfs usb
+SUBTARGETS:=bcm6318 bcm6328 bcm6358 bcm6362 bcm6368 bcm63268
+FEATURES:=gpio squashfs usb
 
 KERNEL_PATCHVER:=5.15
+KERNEL_TESTING_PATCHVER:=6.1
 
 define Target/Description
 	Build firmware images for BCM33xx cable modem chips,
diff --git a/target/linux/bmips/bcm6318/base-files/etc/board.d/01_leds b/target/linux/bmips/bcm6318/base-files/etc/board.d/01_leds
new file mode 100644
index 00000000000000..98355460a0a992
--- /dev/null
+++ b/target/linux/bmips/bcm6318/base-files/etc/board.d/01_leds
@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+. /lib/functions/leds.sh
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+comtrend,ar-5315u)
+	ucidef_set_led_usbport "usb" "USB" "green:usb" "usb1-port1" "usb2-port1"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/bmips/bcm6318/base-files/etc/board.d/02_network b/target/linux/bmips/bcm6318/base-files/etc/board.d/02_network
new file mode 100644
index 00000000000000..92b2e8f4d4067a
--- /dev/null
+++ b/target/linux/bmips/bcm6318/base-files/etc/board.d/02_network
@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+comtrend,ar-5315u)
+	ucidef_set_bridge_device switch
+	ucidef_set_interface_lan "lan1 lan2 lan3 lan4"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/bmips/bcm6318/base-files/etc/uci-defaults/09_fix_crc b/target/linux/bmips/bcm6318/base-files/etc/uci-defaults/09_fix_crc
new file mode 100644
index 00000000000000..a52f0ecc402fd4
--- /dev/null
+++ b/target/linux/bmips/bcm6318/base-files/etc/uci-defaults/09_fix_crc
@@ -0,0 +1,11 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+. /lib/functions.sh
+
+case "$(board_name)" in
+comtrend,ar-5315u)
+	mtd fixtrx firmware
+	;;
+esac
+
+exit 0
diff --git a/target/linux/bmips/bcm6318/base-files/lib/upgrade/platform.sh b/target/linux/bmips/bcm6318/base-files/lib/upgrade/platform.sh
new file mode 100644
index 00000000000000..1cf95be26a5f0a
--- /dev/null
+++ b/target/linux/bmips/bcm6318/base-files/lib/upgrade/platform.sh
@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+PART_NAME=firmware
+REQUIRE_IMAGE_METADATA=1
+
+platform_check_image() {
+	return 0
+}
+
+platform_do_upgrade() {
+	case "$(board_name)" in
+	*)
+		default_do_upgrade "$1"
+		;;
+	esac
+}
diff --git a/target/linux/bmips/bcm6318/config-5.15 b/target/linux/bmips/bcm6318/config-5.15
new file mode 100644
index 00000000000000..50401a58e8dbc4
--- /dev/null
+++ b/target/linux/bmips/bcm6318/config-5.15
@@ -0,0 +1,271 @@
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_B53=y
+CONFIG_B53_MDIO_DRIVER=y
+CONFIG_B53_MMAP_DRIVER=y
+CONFIG_B53_SPI_DRIVER=y
+CONFIG_BCM6345_EXT_IRQ=y
+CONFIG_BCM6345_L1_IRQ=y
+# CONFIG_BCM6348_ENET is not set
+CONFIG_BCM6368_ENETSW=y
+CONFIG_BCM63XX_POWER=y
+CONFIG_BCM7038_WDT=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BMIPS_GENERIC=y
+CONFIG_CEVT_R4K=y
+# CONFIG_CLK_BCM63268_TIMER is not set
+CONFIG_CLK_BCM_63XX_GATE=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CPU_BMIPS=y
+CONFIG_CPU_BMIPS32_3300=y
+CONFIG_CPU_BMIPS4350=y
+CONFIG_CPU_BMIPS4380=y
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_RIXI=y
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_MIPS32=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_NO_EFFICIENT_FFS=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_CPUFREQ=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CRASH_DUMP=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_CSRC_R4K=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_DTC=y
+# CONFIG_DT_BCM93384WVG is not set
+# CONFIG_DT_BCM93384WVG_VIPER is not set
+# CONFIG_DT_BCM96368MVWG is not set
+# CONFIG_DT_BCM97125CBMB is not set
+# CONFIG_DT_BCM97346DBSMB is not set
+# CONFIG_DT_BCM97358SVMB is not set
+# CONFIG_DT_BCM97360SVMB is not set
+# CONFIG_DT_BCM97362SVMB is not set
+# CONFIG_DT_BCM97420C is not set
+# CONFIG_DT_BCM97425SVMB is not set
+# CONFIG_DT_BCM97435SVMB is not set
+# CONFIG_DT_BCM9EJTAGPRB is not set
+# CONFIG_DT_COMTREND_VR3032U is not set
+# CONFIG_DT_NETGEAR_CVG834G is not set
+CONFIG_DT_NONE=y
+# CONFIG_DT_SFR_NEUFBOX4_SERCOMM is not set
+# CONFIG_DT_SFR_NEUFBOX6_SERCOMM is not set
+CONFIG_FIXED_PHY=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+# CONFIG_GPIO_BRCMSTB is not set
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_GPIO_REGMAP=y
+CONFIG_GRO_CELLS=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+# CONFIG_LEDS_SERCOMM_MSP430 is not set
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_BUS_MUX=y
+CONFIG_MDIO_BUS_MUX_BCM6368=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+CONFIG_MIPS_CLOCK_VSYSCALL=y
+# CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER is not set
+CONFIG_MIPS_CMDLINE_FROM_DTB=y
+CONFIG_MIPS_EBPF_JIT=y
+CONFIG_MIPS_EXTERNAL_TIMER=y
+CONFIG_MIPS_L1_CACHE_SHIFT=6
+CONFIG_MIPS_L1_CACHE_SHIFT_4=y
+CONFIG_MIPS_L1_CACHE_SHIFT_6=y
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+# CONFIG_MIPS_NO_APPENDED_DTB is not set
+CONFIG_MIPS_NR_CPU_NR_MAP=2
+CONFIG_MIPS_O32_FP64_SUPPORT=y
+CONFIG_MIPS_RAW_APPENDED_DTB=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MODULE_FORCE_LOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+# CONFIG_MTD_BCM63XX_PARTS is not set
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_BE_BYTE_SWAP=y
+# CONFIG_MTD_CFI_GEOMETRY is not set
+# CONFIG_MTD_CFI_NOSWAP is not set
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_JEDECPROBE=y
+# CONFIG_MTD_PARSER_IMAGETAG is not set
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPLIT_BCM63XX_FW=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_TAG_BRCM=y
+CONFIG_NET_DSA_TAG_BRCM_COMMON=y
+CONFIG_NET_DSA_TAG_BRCM_LEGACY=y
+CONFIG_NET_DSA_TAG_BRCM_PREPEND=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NO_EXCEPT_FILL=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+CONFIG_NR_CPUS=2
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_PADATA=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_BCM6318=y
+# CONFIG_PCIE_BCM6328 is not set
+CONFIG_PCIE_PME=y
+# CONFIG_PCI_BCM6348 is not set
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DRIVERS_LEGACY=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PHYSICAL_START=0x80010000
+CONFIG_PHY_BCM63XX_USBH=y
+# CONFIG_PHY_BRCM_SATA is not set
+CONFIG_PINCTRL=y
+CONFIG_PINCTRL_BCM6318=y
+# CONFIG_PINCTRL_BCM63268 is not set
+# CONFIG_PINCTRL_BCM6328 is not set
+# CONFIG_PINCTRL_BCM6358 is not set
+# CONFIG_PINCTRL_BCM6362 is not set
+# CONFIG_PINCTRL_BCM6368 is not set
+CONFIG_PINCTRL_BCM63XX=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PROC_VMCORE=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RELAY=y
+CONFIG_RESET_BCM6345=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIAL_BCM63XX=y
+CONFIG_SERIAL_BCM63XX_CONSOLE=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SMP=y
+CONFIG_SMP_UP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOC_BCM63XX=y
+CONFIG_SPI=y
+# CONFIG_SPI_BCM63XX is not set
+CONFIG_SPI_BCM63XX_HSSPI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRCU=y
+CONFIG_SWAP_IO_SPACE=y
+CONFIG_SWPHY=y
+CONFIG_SYNC_R4K=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYS_HAS_CPU_BMIPS=y
+CONFIG_SYS_HAS_CPU_BMIPS32_3300=y
+CONFIG_SYS_HAS_CPU_BMIPS4350=y
+CONFIG_SYS_HAS_CPU_BMIPS4380=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+CONFIG_SYS_SUPPORTS_HOTPLUG_CPU=y
+CONFIG_SYS_SUPPORTS_SMP=y
+CONFIG_TARGET_ISA_REV=0
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_USB_EHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_EHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_OHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_OHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_OF=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_WATCHDOG_NOWAYOUT=y
+CONFIG_WEAK_ORDERING=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/bmips/bcm6318/config-6.1 b/target/linux/bmips/bcm6318/config-6.1
new file mode 100644
index 00000000000000..4f54ce553391da
--- /dev/null
+++ b/target/linux/bmips/bcm6318/config-6.1
@@ -0,0 +1,286 @@
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_FORCE_MAX_ORDER=11
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_B53=y
+CONFIG_B53_MDIO_DRIVER=y
+CONFIG_B53_MMAP_DRIVER=y
+CONFIG_B53_SPI_DRIVER=y
+CONFIG_BCM6345_EXT_IRQ=y
+CONFIG_BCM6345_L1_IRQ=y
+# CONFIG_BCM6348_ENET is not set
+CONFIG_BCM6368_ENETSW=y
+CONFIG_BCM63XX_POWER=y
+CONFIG_BCM7038_WDT=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BMIPS_GENERIC=y
+CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
+CONFIG_CC_NO_ARRAY_BOUNDS=y
+CONFIG_CEVT_R4K=y
+# CONFIG_CLK_BCM63268_TIMER is not set
+CONFIG_CLK_BCM_63XX_GATE=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONTEXT_TRACKING=y
+CONFIG_CONTEXT_TRACKING_IDLE=y
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CPU_BMIPS=y
+CONFIG_CPU_BMIPS32_3300=y
+CONFIG_CPU_BMIPS4350=y
+CONFIG_CPU_BMIPS4380=y
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_RIXI=y
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_MIPS32=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_NO_EFFICIENT_FFS=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_CPUFREQ=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CRASH_DUMP=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_LIB_SHA1=y
+CONFIG_CRYPTO_LIB_UTILS=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_CSRC_R4K=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_DTC=y
+# CONFIG_DT_BCM93384WVG is not set
+# CONFIG_DT_BCM93384WVG_VIPER is not set
+# CONFIG_DT_BCM96368MVWG is not set
+# CONFIG_DT_BCM97125CBMB is not set
+# CONFIG_DT_BCM97346DBSMB is not set
+# CONFIG_DT_BCM97358SVMB is not set
+# CONFIG_DT_BCM97360SVMB is not set
+# CONFIG_DT_BCM97362SVMB is not set
+# CONFIG_DT_BCM97420C is not set
+# CONFIG_DT_BCM97425SVMB is not set
+# CONFIG_DT_BCM97435SVMB is not set
+# CONFIG_DT_BCM9EJTAGPRB is not set
+# CONFIG_DT_COMTREND_VR3032U is not set
+# CONFIG_DT_NETGEAR_CVG834G is not set
+CONFIG_DT_NONE=y
+# CONFIG_DT_SFR_NEUFBOX4_SERCOMM is not set
+# CONFIG_DT_SFR_NEUFBOX6_SERCOMM is not set
+CONFIG_EXCLUSIVE_SYSTEM_RAM=y
+CONFIG_FIXED_PHY=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CFE=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_FW_LOADER_SYSFS=y
+CONFIG_GCC11_NO_ARRAY_BOUNDS=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+# CONFIG_GPIO_BRCMSTB is not set
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_GPIO_REGMAP=y
+CONFIG_GRO_CELLS=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+# CONFIG_LEDS_SERCOMM_MSP430 is not set
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_BUS_MUX=y
+CONFIG_MDIO_BUS_MUX_BCM6368=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+CONFIG_MIPS_CLOCK_VSYSCALL=y
+# CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER is not set
+CONFIG_MIPS_CMDLINE_FROM_DTB=y
+CONFIG_MIPS_EXTERNAL_TIMER=y
+CONFIG_MIPS_L1_CACHE_SHIFT=6
+CONFIG_MIPS_L1_CACHE_SHIFT_4=y
+CONFIG_MIPS_L1_CACHE_SHIFT_6=y
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+# CONFIG_MIPS_NO_APPENDED_DTB is not set
+CONFIG_MIPS_NR_CPU_NR_MAP=2
+CONFIG_MIPS_O32_FP64_SUPPORT=y
+CONFIG_MIPS_RAW_APPENDED_DTB=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MODULE_FORCE_LOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+# CONFIG_MTD_BCM63XX_PARTS is not set
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_BE_BYTE_SWAP=y
+# CONFIG_MTD_CFI_GEOMETRY is not set
+# CONFIG_MTD_CFI_NOSWAP is not set
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_JEDECPROBE=y
+# CONFIG_MTD_PARSER_IMAGETAG is not set
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPLIT_BCM63XX_FW=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_TAG_BRCM=y
+CONFIG_NET_DSA_TAG_BRCM_COMMON=y
+CONFIG_NET_DSA_TAG_BRCM_LEGACY=y
+CONFIG_NET_DSA_TAG_BRCM_PREPEND=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NO_EXCEPT_FILL=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+CONFIG_NR_CPUS=2
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_PADATA=y
+CONFIG_PAGE_POOL=y
+CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
+CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_BCM6318=y
+# CONFIG_PCIE_BCM6328 is not set
+CONFIG_PCIE_PME=y
+# CONFIG_PCI_BCM6348 is not set
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DRIVERS_LEGACY=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PHYSICAL_START=0x80010000
+CONFIG_PHY_BCM63XX_USBH=y
+# CONFIG_PHY_BRCM_SATA is not set
+CONFIG_PINCTRL=y
+CONFIG_PINCTRL_BCM6318=y
+# CONFIG_PINCTRL_BCM63268 is not set
+# CONFIG_PINCTRL_BCM6328 is not set
+# CONFIG_PINCTRL_BCM6358 is not set
+# CONFIG_PINCTRL_BCM6362 is not set
+# CONFIG_PINCTRL_BCM6368 is not set
+CONFIG_PINCTRL_BCM63XX=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PREEMPT_NONE_BUILD=y
+CONFIG_PROC_VMCORE=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RANDSTRUCT_NONE=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RELAY=y
+CONFIG_RESET_BCM6345=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIAL_BCM63XX=y
+CONFIG_SERIAL_BCM63XX_CONSOLE=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SMP=y
+CONFIG_SMP_UP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOC_BCM63XX=y
+CONFIG_SPI=y
+# CONFIG_SPI_BCM63XX is not set
+CONFIG_SPI_BCM63XX_HSSPI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRCU=y
+CONFIG_SWAP_IO_SPACE=y
+CONFIG_SWPHY=y
+CONFIG_SYNC_R4K=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYS_HAS_CPU_BMIPS=y
+CONFIG_SYS_HAS_CPU_BMIPS32_3300=y
+CONFIG_SYS_HAS_CPU_BMIPS4350=y
+CONFIG_SYS_HAS_CPU_BMIPS4380=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+CONFIG_SYS_SUPPORTS_HOTPLUG_CPU=y
+CONFIG_SYS_SUPPORTS_SMP=y
+CONFIG_TARGET_ISA_REV=0
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_USB_EHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_EHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_OHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_OHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_OF=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_WATCHDOG_NOWAYOUT=y
+CONFIG_WEAK_ORDERING=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMMON=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/bmips/bcm6318/target.mk b/target/linux/bmips/bcm6318/target.mk
new file mode 100644
index 00000000000000..a8bbc8b9765645
--- /dev/null
+++ b/target/linux/bmips/bcm6318/target.mk
@@ -0,0 +1,8 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+SUBTARGET:=bcm6318
+BOARDNAME:=BCM6318 based boards
+
+define Target/Description
+  Build firmware images for Broadcom BCM6318 based boards.
+endef
diff --git a/target/linux/bmips/bcm63268/base-files/etc/board.d/01_leds b/target/linux/bmips/bcm63268/base-files/etc/board.d/01_leds
new file mode 100644
index 00000000000000..d5b65a9c0facfc
--- /dev/null
+++ b/target/linux/bmips/bcm63268/base-files/etc/board.d/01_leds
@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+. /lib/functions/leds.sh
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+comtrend,vr-3032u)
+	ucidef_set_led_usbport "usb" "USB" "green:usb" "usb1-port1" "usb2-port1"
+	;;
+sercomm,h500-s-lowi |\
+sercomm,h500-s-vfes)
+	ucidef_set_led_netdev "wan" "WAN" "green:internet" "wan"
+	ucidef_set_led_netdev "wifi" "WiFi" "green:wifi" "wifi"
+	ucidef_set_led_usbport "usb" "USB" "green:mobile" "usb1-port1" "usb2-port1"
+	;;
+sercomm,shg2500)
+	ucidef_set_led_netdev "wan" "WAN" "green:internet" "wan"
+	ucidef_set_led_usbport "usb1" "USB1" "blue:modem" "usb1-port1" "usb2-port1"
+	ucidef_set_led_usbport "usb2" "USB2" "green:modem" "usb1-port2" "usb2-port2"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/bmips/bcm63268/base-files/etc/board.d/02_network b/target/linux/bmips/bcm63268/base-files/etc/board.d/02_network
new file mode 100644
index 00000000000000..7fb9333cc18aa8
--- /dev/null
+++ b/target/linux/bmips/bcm63268/base-files/etc/board.d/02_network
@@ -0,0 +1,28 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+comtrend,vr-3032u)
+	ucidef_set_bridge_device switch
+	ucidef_set_interface_lan "lan1 lan2 lan3 lan4"
+	;;
+sercomm,h500-s-lowi |\
+sercomm,h500-s-vfes)
+	ucidef_set_bridge_device switch
+	ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" "wan"
+	ucidef_set_interface "qtn" device "wifi" protocol "static" ipaddr "1.1.1.1" netmask "255.255.255.252"
+	uci add_list firewall.@zone[0].network='qtn'
+	;;
+comtrend,vg-8050 |\
+sercomm,shg2500)
+	ucidef_set_bridge_device switch
+	ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" "wan"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/bmips/bcm63268/base-files/etc/board.d/03_gpio_switches b/target/linux/bmips/bcm63268/base-files/etc/board.d/03_gpio_switches
new file mode 100644
index 00000000000000..75ac111b0cbb92
--- /dev/null
+++ b/target/linux/bmips/bcm63268/base-files/etc/board.d/03_gpio_switches
@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+sercomm,h500-s-lowi |\
+sercomm,h500-s-vfes)
+	ucidef_add_gpio_switch "qtn_power" "Quantenna Module Power" "480" "1"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/bmips/bcm63268/base-files/lib/upgrade/platform.sh b/target/linux/bmips/bcm63268/base-files/lib/upgrade/platform.sh
new file mode 100644
index 00000000000000..fd309d380994f2
--- /dev/null
+++ b/target/linux/bmips/bcm63268/base-files/lib/upgrade/platform.sh
@@ -0,0 +1,26 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+PART_NAME=firmware
+REQUIRE_IMAGE_METADATA=1
+
+platform_check_image() {
+	return 0
+}
+
+platform_do_upgrade() {
+	case "$(board_name)" in
+	comtrend,vg-8050 |\
+	comtrend,vr-3032u)
+		CI_JFFS2_CLEAN_MARKERS=1
+		nand_do_upgrade "$1"
+		;;
+	sercomm,h500-s-lowi |\
+	sercomm,h500-s-vfes |\
+	sercomm,shg2500)
+		nand_do_upgrade "$1"
+		;;
+	*)
+		default_do_upgrade "$1"
+		;;
+	esac
+}
diff --git a/target/linux/bmips/bcm63268/config-5.15 b/target/linux/bmips/bcm63268/config-5.15
new file mode 100644
index 00000000000000..09754e9f8be408
--- /dev/null
+++ b/target/linux/bmips/bcm63268/config-5.15
@@ -0,0 +1,285 @@
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_B53=y
+CONFIG_B53_MDIO_DRIVER=y
+CONFIG_B53_MMAP_DRIVER=y
+CONFIG_B53_SPI_DRIVER=y
+CONFIG_BCM6345_EXT_IRQ=y
+CONFIG_BCM6345_L1_IRQ=y
+# CONFIG_BCM6348_ENET is not set
+CONFIG_BCM6368_ENETSW=y
+CONFIG_BCM63XX_POWER=y
+CONFIG_BCM7038_WDT=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BMIPS_GENERIC=y
+CONFIG_CEVT_R4K=y
+CONFIG_CLK_BCM63268_TIMER=y
+CONFIG_CLK_BCM_63XX_GATE=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CPU_BMIPS=y
+CONFIG_CPU_BMIPS32_3300=y
+CONFIG_CPU_BMIPS4350=y
+CONFIG_CPU_BMIPS4380=y
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_RIXI=y
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_MIPS32=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_NO_EFFICIENT_FFS=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_CPUFREQ=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CRASH_DUMP=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_CSRC_R4K=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_DTC=y
+# CONFIG_DT_BCM93384WVG is not set
+# CONFIG_DT_BCM93384WVG_VIPER is not set
+# CONFIG_DT_BCM96368MVWG is not set
+# CONFIG_DT_BCM97125CBMB is not set
+# CONFIG_DT_BCM97346DBSMB is not set
+# CONFIG_DT_BCM97358SVMB is not set
+# CONFIG_DT_BCM97360SVMB is not set
+# CONFIG_DT_BCM97362SVMB is not set
+# CONFIG_DT_BCM97420C is not set
+# CONFIG_DT_BCM97425SVMB is not set
+# CONFIG_DT_BCM97435SVMB is not set
+# CONFIG_DT_BCM9EJTAGPRB is not set
+# CONFIG_DT_COMTREND_VR3032U is not set
+# CONFIG_DT_NETGEAR_CVG834G is not set
+CONFIG_DT_NONE=y
+# CONFIG_DT_SFR_NEUFBOX4_SERCOMM is not set
+# CONFIG_DT_SFR_NEUFBOX6_SERCOMM is not set
+CONFIG_FIXED_PHY=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+# CONFIG_GPIO_BRCMSTB is not set
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_GPIO_REGMAP=y
+CONFIG_GRO_CELLS=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_BCM2835=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+# CONFIG_LEDS_SERCOMM_MSP430 is not set
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_BUS_MUX=y
+CONFIG_MDIO_BUS_MUX_BCM6368=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+CONFIG_MIPS_CLOCK_VSYSCALL=y
+# CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER is not set
+CONFIG_MIPS_CMDLINE_FROM_DTB=y
+CONFIG_MIPS_EBPF_JIT=y
+CONFIG_MIPS_EXTERNAL_TIMER=y
+CONFIG_MIPS_L1_CACHE_SHIFT=6
+CONFIG_MIPS_L1_CACHE_SHIFT_4=y
+CONFIG_MIPS_L1_CACHE_SHIFT_6=y
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+# CONFIG_MIPS_NO_APPENDED_DTB is not set
+CONFIG_MIPS_NR_CPU_NR_MAP=2
+CONFIG_MIPS_O32_FP64_SUPPORT=y
+CONFIG_MIPS_RAW_APPENDED_DTB=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MODULE_FORCE_LOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+# CONFIG_MTD_BCM63XX_PARTS is not set
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_BE_BYTE_SWAP=y
+# CONFIG_MTD_CFI_GEOMETRY is not set
+# CONFIG_MTD_CFI_NOSWAP is not set
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_NAND_BRCMNAND=y
+CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_NAND_ECC_SW_HAMMING=y
+# CONFIG_MTD_PARSER_IMAGETAG is not set
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPLIT_BCM63XX_FW=y
+CONFIG_MTD_SPLIT_BCM_WFI_FW=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_LIMIT=20
+CONFIG_MTD_UBI_BLOCK=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_TAG_BRCM=y
+CONFIG_NET_DSA_TAG_BRCM_COMMON=y
+CONFIG_NET_DSA_TAG_BRCM_LEGACY=y
+CONFIG_NET_DSA_TAG_BRCM_PREPEND=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NO_EXCEPT_FILL=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+CONFIG_NR_CPUS=2
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_PADATA=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+# CONFIG_PCIE_BCM6318 is not set
+CONFIG_PCIE_BCM6328=y
+CONFIG_PCIE_PME=y
+# CONFIG_PCI_BCM6348 is not set
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DRIVERS_LEGACY=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PHYSICAL_START=0x80010000
+CONFIG_PHY_BCM63XX_USBH=y
+# CONFIG_PHY_BRCM_SATA is not set
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_BCM6318 is not set
+CONFIG_PINCTRL_BCM63268=y
+# CONFIG_PINCTRL_BCM6328 is not set
+# CONFIG_PINCTRL_BCM6358 is not set
+# CONFIG_PINCTRL_BCM6362 is not set
+# CONFIG_PINCTRL_BCM6368 is not set
+CONFIG_PINCTRL_BCM63XX=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PROC_VMCORE=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RELAY=y
+CONFIG_RESET_BCM6345=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIAL_BCM63XX=y
+CONFIG_SERIAL_BCM63XX_CONSOLE=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SMP=y
+CONFIG_SMP_UP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOC_BCM63XX=y
+CONFIG_SPI=y
+CONFIG_SPI_BCM63XX=y
+CONFIG_SPI_BCM63XX_HSSPI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRCU=y
+CONFIG_SWAP_IO_SPACE=y
+CONFIG_SWPHY=y
+CONFIG_SYNC_R4K=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYS_HAS_CPU_BMIPS=y
+CONFIG_SYS_HAS_CPU_BMIPS32_3300=y
+CONFIG_SYS_HAS_CPU_BMIPS4350=y
+CONFIG_SYS_HAS_CPU_BMIPS4380=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+CONFIG_SYS_SUPPORTS_HOTPLUG_CPU=y
+CONFIG_SYS_SUPPORTS_SMP=y
+CONFIG_TARGET_ISA_REV=0
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UBIFS_FS=y
+CONFIG_USB_EHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_EHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_OHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_OHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_OF=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_WATCHDOG_NOWAYOUT=y
+CONFIG_WEAK_ORDERING=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/bmips/bcm63268/config-6.1 b/target/linux/bmips/bcm63268/config-6.1
new file mode 100644
index 00000000000000..2ed4eba2f6e11d
--- /dev/null
+++ b/target/linux/bmips/bcm63268/config-6.1
@@ -0,0 +1,301 @@
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_FORCE_MAX_ORDER=11
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_B53=y
+CONFIG_B53_MDIO_DRIVER=y
+CONFIG_B53_MMAP_DRIVER=y
+CONFIG_B53_SPI_DRIVER=y
+CONFIG_BCM6345_EXT_IRQ=y
+CONFIG_BCM6345_L1_IRQ=y
+# CONFIG_BCM6348_ENET is not set
+CONFIG_BCM6368_ENETSW=y
+CONFIG_BCM63XX_POWER=y
+CONFIG_BCM7038_WDT=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BMIPS_GENERIC=y
+CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
+CONFIG_CC_NO_ARRAY_BOUNDS=y
+CONFIG_CEVT_R4K=y
+CONFIG_CLK_BCM63268_TIMER=y
+CONFIG_CLK_BCM_63XX_GATE=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONTEXT_TRACKING=y
+CONFIG_CONTEXT_TRACKING_IDLE=y
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CPU_BMIPS=y
+CONFIG_CPU_BMIPS32_3300=y
+CONFIG_CPU_BMIPS4350=y
+CONFIG_CPU_BMIPS4380=y
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_RIXI=y
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_MIPS32=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_NO_EFFICIENT_FFS=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_CPUFREQ=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CRASH_DUMP=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_LIB_SHA1=y
+CONFIG_CRYPTO_LIB_UTILS=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_CSRC_R4K=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_DTC=y
+# CONFIG_DT_BCM93384WVG is not set
+# CONFIG_DT_BCM93384WVG_VIPER is not set
+# CONFIG_DT_BCM96368MVWG is not set
+# CONFIG_DT_BCM97125CBMB is not set
+# CONFIG_DT_BCM97346DBSMB is not set
+# CONFIG_DT_BCM97358SVMB is not set
+# CONFIG_DT_BCM97360SVMB is not set
+# CONFIG_DT_BCM97362SVMB is not set
+# CONFIG_DT_BCM97420C is not set
+# CONFIG_DT_BCM97425SVMB is not set
+# CONFIG_DT_BCM97435SVMB is not set
+# CONFIG_DT_BCM9EJTAGPRB is not set
+# CONFIG_DT_COMTREND_VR3032U is not set
+# CONFIG_DT_NETGEAR_CVG834G is not set
+CONFIG_DT_NONE=y
+# CONFIG_DT_SFR_NEUFBOX4_SERCOMM is not set
+# CONFIG_DT_SFR_NEUFBOX6_SERCOMM is not set
+CONFIG_EXCLUSIVE_SYSTEM_RAM=y
+CONFIG_FIXED_PHY=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CFE=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_FW_LOADER_SYSFS=y
+CONFIG_GCC11_NO_ARRAY_BOUNDS=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+# CONFIG_GPIO_BRCMSTB is not set
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_GPIO_REGMAP=y
+CONFIG_GRO_CELLS=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_BCM2835=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+# CONFIG_LEDS_SERCOMM_MSP430 is not set
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_BUS_MUX=y
+CONFIG_MDIO_BUS_MUX_BCM6368=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+CONFIG_MIPS_CLOCK_VSYSCALL=y
+# CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER is not set
+CONFIG_MIPS_CMDLINE_FROM_DTB=y
+CONFIG_MIPS_EXTERNAL_TIMER=y
+CONFIG_MIPS_L1_CACHE_SHIFT=6
+CONFIG_MIPS_L1_CACHE_SHIFT_4=y
+CONFIG_MIPS_L1_CACHE_SHIFT_6=y
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+# CONFIG_MIPS_NO_APPENDED_DTB is not set
+CONFIG_MIPS_NR_CPU_NR_MAP=2
+CONFIG_MIPS_O32_FP64_SUPPORT=y
+CONFIG_MIPS_RAW_APPENDED_DTB=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MODULE_FORCE_LOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+# CONFIG_MTD_BCM63XX_PARTS is not set
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_BE_BYTE_SWAP=y
+# CONFIG_MTD_CFI_GEOMETRY is not set
+# CONFIG_MTD_CFI_NOSWAP is not set
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_NAND_BRCMNAND=y
+CONFIG_MTD_NAND_BRCMNAND_BCM63XX=y
+CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_NAND_ECC_SW_HAMMING=y
+# CONFIG_MTD_PARSER_IMAGETAG is not set
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPLIT_BCM63XX_FW=y
+CONFIG_MTD_SPLIT_BCM_WFI_FW=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_LIMIT=20
+CONFIG_MTD_UBI_BLOCK=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_TAG_BRCM=y
+CONFIG_NET_DSA_TAG_BRCM_COMMON=y
+CONFIG_NET_DSA_TAG_BRCM_LEGACY=y
+CONFIG_NET_DSA_TAG_BRCM_PREPEND=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NO_EXCEPT_FILL=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+CONFIG_NR_CPUS=2
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_PADATA=y
+CONFIG_PAGE_POOL=y
+CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
+CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+# CONFIG_PCIE_BCM6318 is not set
+CONFIG_PCIE_BCM6328=y
+CONFIG_PCIE_PME=y
+# CONFIG_PCI_BCM6348 is not set
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DRIVERS_LEGACY=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PHYSICAL_START=0x80010000
+CONFIG_PHY_BCM63XX_USBH=y
+# CONFIG_PHY_BRCM_SATA is not set
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_BCM6318 is not set
+CONFIG_PINCTRL_BCM63268=y
+# CONFIG_PINCTRL_BCM6328 is not set
+# CONFIG_PINCTRL_BCM6358 is not set
+# CONFIG_PINCTRL_BCM6362 is not set
+# CONFIG_PINCTRL_BCM6368 is not set
+CONFIG_PINCTRL_BCM63XX=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PREEMPT_NONE_BUILD=y
+CONFIG_PROC_VMCORE=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RANDSTRUCT_NONE=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RELAY=y
+CONFIG_RESET_BCM6345=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIAL_BCM63XX=y
+CONFIG_SERIAL_BCM63XX_CONSOLE=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SMP=y
+CONFIG_SMP_UP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOC_BCM63XX=y
+CONFIG_SPI=y
+CONFIG_SPI_BCM63XX=y
+CONFIG_SPI_BCM63XX_HSSPI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRCU=y
+CONFIG_SWAP_IO_SPACE=y
+CONFIG_SWPHY=y
+CONFIG_SYNC_R4K=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYS_HAS_CPU_BMIPS=y
+CONFIG_SYS_HAS_CPU_BMIPS32_3300=y
+CONFIG_SYS_HAS_CPU_BMIPS4350=y
+CONFIG_SYS_HAS_CPU_BMIPS4380=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+CONFIG_SYS_SUPPORTS_HOTPLUG_CPU=y
+CONFIG_SYS_SUPPORTS_SMP=y
+CONFIG_TARGET_ISA_REV=0
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UBIFS_FS=y
+CONFIG_USB_EHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_EHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_OHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_OHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_OF=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_WATCHDOG_NOWAYOUT=y
+CONFIG_WEAK_ORDERING=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMMON=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/bmips/bcm63268/target.mk b/target/linux/bmips/bcm63268/target.mk
new file mode 100644
index 00000000000000..98cc6c533cf361
--- /dev/null
+++ b/target/linux/bmips/bcm63268/target.mk
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+SUBTARGET:=bcm63268
+BOARDNAME:=BCM63268 based boards
+FEATURES+=nand
+
+define Target/Description
+  Build firmware images for Broadcom BCM63268 based boards.
+endef
diff --git a/target/linux/bmips/bcm6328/base-files/etc/board.d/01_leds b/target/linux/bmips/bcm6328/base-files/etc/board.d/01_leds
new file mode 100644
index 00000000000000..5e80eb34e736e4
--- /dev/null
+++ b/target/linux/bmips/bcm6328/base-files/etc/board.d/01_leds
@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+. /lib/functions/leds.sh
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+nucom,r5010unv2 |\
+sercomm,ad1018)
+	ucidef_set_led_usbport "usb" "USB" "green:usb" "usb1-port1" "usb2-port1"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/bmips/bcm6328/base-files/etc/board.d/02_network b/target/linux/bmips/bcm6328/base-files/etc/board.d/02_network
new file mode 100644
index 00000000000000..bfedad9e455835
--- /dev/null
+++ b/target/linux/bmips/bcm6328/base-files/etc/board.d/02_network
@@ -0,0 +1,22 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+comtrend,ar-5381u |\
+comtrend,ar-5387un |\
+nucom,r5010unv2)
+	ucidef_set_bridge_device switch
+	ucidef_set_interface_lan "lan1 lan2 lan3 lan4"
+	;;
+sercomm,ad1018)
+	ucidef_set_bridge_device switch
+	ucidef_set_interface_lan "lan1 lan2 lan3 fibre"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/bmips/bcm6328/base-files/etc/uci-defaults/09_fix_crc b/target/linux/bmips/bcm6328/base-files/etc/uci-defaults/09_fix_crc
new file mode 100644
index 00000000000000..2056ea017ff997
--- /dev/null
+++ b/target/linux/bmips/bcm6328/base-files/etc/uci-defaults/09_fix_crc
@@ -0,0 +1,13 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+. /lib/functions.sh
+
+case "$(board_name)" in
+comtrend,ar-5381u |\
+comtrend,ar-5387un |\
+nucom,r5010unv2)
+	mtd fixtrx firmware
+	;;
+esac
+
+exit 0
diff --git a/target/linux/bmips/bcm6328/base-files/lib/upgrade/platform.sh b/target/linux/bmips/bcm6328/base-files/lib/upgrade/platform.sh
new file mode 100644
index 00000000000000..d820b20718801d
--- /dev/null
+++ b/target/linux/bmips/bcm6328/base-files/lib/upgrade/platform.sh
@@ -0,0 +1,19 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+PART_NAME=firmware
+REQUIRE_IMAGE_METADATA=1
+
+platform_check_image() {
+	return 0
+}
+
+platform_do_upgrade() {
+	case "$(board_name)" in
+	sercomm,ad1018)
+		nand_do_upgrade "$1"
+		;;
+	*)
+		default_do_upgrade "$1"
+		;;
+	esac
+}
diff --git a/target/linux/bmips/bcm6328/config-5.15 b/target/linux/bmips/bcm6328/config-5.15
new file mode 100644
index 00000000000000..1e7712ead69d73
--- /dev/null
+++ b/target/linux/bmips/bcm6328/config-5.15
@@ -0,0 +1,283 @@
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_B53=y
+CONFIG_B53_MDIO_DRIVER=y
+CONFIG_B53_MMAP_DRIVER=y
+CONFIG_B53_SPI_DRIVER=y
+CONFIG_BCM6345_EXT_IRQ=y
+CONFIG_BCM6345_L1_IRQ=y
+# CONFIG_BCM6348_ENET is not set
+CONFIG_BCM6368_ENETSW=y
+CONFIG_BCM63XX_POWER=y
+CONFIG_BCM7038_WDT=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BMIPS_GENERIC=y
+CONFIG_CEVT_R4K=y
+# CONFIG_CLK_BCM63268_TIMER is not set
+CONFIG_CLK_BCM_63XX_GATE=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CPU_BMIPS=y
+CONFIG_CPU_BMIPS32_3300=y
+CONFIG_CPU_BMIPS4350=y
+CONFIG_CPU_BMIPS4380=y
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_RIXI=y
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_MIPS32=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_NO_EFFICIENT_FFS=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_CPUFREQ=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CRASH_DUMP=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_CSRC_R4K=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_DTC=y
+# CONFIG_DT_BCM93384WVG is not set
+# CONFIG_DT_BCM93384WVG_VIPER is not set
+# CONFIG_DT_BCM96368MVWG is not set
+# CONFIG_DT_BCM97125CBMB is not set
+# CONFIG_DT_BCM97346DBSMB is not set
+# CONFIG_DT_BCM97358SVMB is not set
+# CONFIG_DT_BCM97360SVMB is not set
+# CONFIG_DT_BCM97362SVMB is not set
+# CONFIG_DT_BCM97420C is not set
+# CONFIG_DT_BCM97425SVMB is not set
+# CONFIG_DT_BCM97435SVMB is not set
+# CONFIG_DT_BCM9EJTAGPRB is not set
+# CONFIG_DT_COMTREND_VR3032U is not set
+# CONFIG_DT_NETGEAR_CVG834G is not set
+CONFIG_DT_NONE=y
+# CONFIG_DT_SFR_NEUFBOX4_SERCOMM is not set
+# CONFIG_DT_SFR_NEUFBOX6_SERCOMM is not set
+CONFIG_FIXED_PHY=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+# CONFIG_GPIO_BRCMSTB is not set
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_GPIO_REGMAP=y
+CONFIG_GRO_CELLS=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+# CONFIG_LEDS_SERCOMM_MSP430 is not set
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_BUS_MUX=y
+CONFIG_MDIO_BUS_MUX_BCM6368=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+CONFIG_MIPS_CLOCK_VSYSCALL=y
+# CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER is not set
+CONFIG_MIPS_CMDLINE_FROM_DTB=y
+CONFIG_MIPS_EBPF_JIT=y
+CONFIG_MIPS_EXTERNAL_TIMER=y
+CONFIG_MIPS_L1_CACHE_SHIFT=6
+CONFIG_MIPS_L1_CACHE_SHIFT_4=y
+CONFIG_MIPS_L1_CACHE_SHIFT_6=y
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+# CONFIG_MIPS_NO_APPENDED_DTB is not set
+CONFIG_MIPS_NR_CPU_NR_MAP=2
+CONFIG_MIPS_O32_FP64_SUPPORT=y
+CONFIG_MIPS_RAW_APPENDED_DTB=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MODULE_FORCE_LOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+# CONFIG_MTD_BCM63XX_PARTS is not set
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_BE_BYTE_SWAP=y
+# CONFIG_MTD_CFI_GEOMETRY is not set
+# CONFIG_MTD_CFI_NOSWAP is not set
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_NAND_BRCMNAND=y
+CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_NAND_ECC_SW_HAMMING=y
+# CONFIG_MTD_PARSER_IMAGETAG is not set
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPLIT_BCM63XX_FW=y
+CONFIG_MTD_SPLIT_BCM_WFI_FW=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_LIMIT=20
+CONFIG_MTD_UBI_BLOCK=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_TAG_BRCM=y
+CONFIG_NET_DSA_TAG_BRCM_COMMON=y
+CONFIG_NET_DSA_TAG_BRCM_LEGACY=y
+CONFIG_NET_DSA_TAG_BRCM_PREPEND=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NO_EXCEPT_FILL=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+CONFIG_NR_CPUS=2
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_PADATA=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+# CONFIG_PCIE_BCM6318 is not set
+CONFIG_PCIE_BCM6328=y
+CONFIG_PCIE_PME=y
+CONFIG_PCI_BCM6348=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DRIVERS_LEGACY=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PHYSICAL_START=0x80010000
+CONFIG_PHY_BCM63XX_USBH=y
+# CONFIG_PHY_BRCM_SATA is not set
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_BCM6318 is not set
+# CONFIG_PINCTRL_BCM63268 is not set
+CONFIG_PINCTRL_BCM6328=y
+# CONFIG_PINCTRL_BCM6358 is not set
+# CONFIG_PINCTRL_BCM6362 is not set
+# CONFIG_PINCTRL_BCM6368 is not set
+CONFIG_PINCTRL_BCM63XX=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PROC_VMCORE=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RELAY=y
+CONFIG_RESET_BCM6345=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIAL_BCM63XX=y
+CONFIG_SERIAL_BCM63XX_CONSOLE=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SMP=y
+CONFIG_SMP_UP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOC_BCM63XX=y
+CONFIG_SPI=y
+# CONFIG_SPI_BCM63XX is not set
+CONFIG_SPI_BCM63XX_HSSPI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRCU=y
+CONFIG_SWAP_IO_SPACE=y
+CONFIG_SWPHY=y
+CONFIG_SYNC_R4K=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYS_HAS_CPU_BMIPS=y
+CONFIG_SYS_HAS_CPU_BMIPS32_3300=y
+CONFIG_SYS_HAS_CPU_BMIPS4350=y
+CONFIG_SYS_HAS_CPU_BMIPS4380=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+CONFIG_SYS_SUPPORTS_HOTPLUG_CPU=y
+CONFIG_SYS_SUPPORTS_SMP=y
+CONFIG_TARGET_ISA_REV=0
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UBIFS_FS=y
+CONFIG_USB_EHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_EHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_OHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_OHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_OF=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_WATCHDOG_NOWAYOUT=y
+CONFIG_WEAK_ORDERING=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/bmips/bcm6328/config-6.1 b/target/linux/bmips/bcm6328/config-6.1
new file mode 100644
index 00000000000000..85d5578b8eb956
--- /dev/null
+++ b/target/linux/bmips/bcm6328/config-6.1
@@ -0,0 +1,298 @@
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_FORCE_MAX_ORDER=11
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_B53=y
+CONFIG_B53_MDIO_DRIVER=y
+CONFIG_B53_MMAP_DRIVER=y
+CONFIG_B53_SPI_DRIVER=y
+CONFIG_BCM6345_EXT_IRQ=y
+CONFIG_BCM6345_L1_IRQ=y
+# CONFIG_BCM6348_ENET is not set
+CONFIG_BCM6368_ENETSW=y
+CONFIG_BCM63XX_POWER=y
+CONFIG_BCM7038_WDT=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BMIPS_GENERIC=y
+CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
+CONFIG_CC_NO_ARRAY_BOUNDS=y
+CONFIG_CEVT_R4K=y
+# CONFIG_CLK_BCM63268_TIMER is not set
+CONFIG_CLK_BCM_63XX_GATE=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONTEXT_TRACKING=y
+CONFIG_CONTEXT_TRACKING_IDLE=y
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CPU_BMIPS=y
+CONFIG_CPU_BMIPS32_3300=y
+CONFIG_CPU_BMIPS4350=y
+CONFIG_CPU_BMIPS4380=y
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_RIXI=y
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_MIPS32=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_NO_EFFICIENT_FFS=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_CPUFREQ=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CRASH_DUMP=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_LIB_SHA1=y
+CONFIG_CRYPTO_LIB_UTILS=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_CSRC_R4K=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_DTC=y
+# CONFIG_DT_BCM93384WVG is not set
+# CONFIG_DT_BCM93384WVG_VIPER is not set
+# CONFIG_DT_BCM96368MVWG is not set
+# CONFIG_DT_BCM97125CBMB is not set
+# CONFIG_DT_BCM97346DBSMB is not set
+# CONFIG_DT_BCM97358SVMB is not set
+# CONFIG_DT_BCM97360SVMB is not set
+# CONFIG_DT_BCM97362SVMB is not set
+# CONFIG_DT_BCM97420C is not set
+# CONFIG_DT_BCM97425SVMB is not set
+# CONFIG_DT_BCM97435SVMB is not set
+# CONFIG_DT_BCM9EJTAGPRB is not set
+# CONFIG_DT_COMTREND_VR3032U is not set
+# CONFIG_DT_NETGEAR_CVG834G is not set
+CONFIG_DT_NONE=y
+# CONFIG_DT_SFR_NEUFBOX4_SERCOMM is not set
+# CONFIG_DT_SFR_NEUFBOX6_SERCOMM is not set
+CONFIG_EXCLUSIVE_SYSTEM_RAM=y
+CONFIG_FIXED_PHY=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CFE=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_FW_LOADER_SYSFS=y
+CONFIG_GCC11_NO_ARRAY_BOUNDS=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+# CONFIG_GPIO_BRCMSTB is not set
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_GPIO_REGMAP=y
+CONFIG_GRO_CELLS=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+# CONFIG_LEDS_SERCOMM_MSP430 is not set
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_BUS_MUX=y
+CONFIG_MDIO_BUS_MUX_BCM6368=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+CONFIG_MIPS_CLOCK_VSYSCALL=y
+# CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER is not set
+CONFIG_MIPS_CMDLINE_FROM_DTB=y
+CONFIG_MIPS_EXTERNAL_TIMER=y
+CONFIG_MIPS_L1_CACHE_SHIFT=6
+CONFIG_MIPS_L1_CACHE_SHIFT_4=y
+CONFIG_MIPS_L1_CACHE_SHIFT_6=y
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+# CONFIG_MIPS_NO_APPENDED_DTB is not set
+CONFIG_MIPS_NR_CPU_NR_MAP=2
+CONFIG_MIPS_O32_FP64_SUPPORT=y
+CONFIG_MIPS_RAW_APPENDED_DTB=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MODULE_FORCE_LOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+# CONFIG_MTD_BCM63XX_PARTS is not set
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_BE_BYTE_SWAP=y
+# CONFIG_MTD_CFI_GEOMETRY is not set
+# CONFIG_MTD_CFI_NOSWAP is not set
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_NAND_BRCMNAND=y
+CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_NAND_ECC_SW_HAMMING=y
+# CONFIG_MTD_PARSER_IMAGETAG is not set
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPLIT_BCM63XX_FW=y
+CONFIG_MTD_SPLIT_BCM_WFI_FW=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_LIMIT=20
+CONFIG_MTD_UBI_BLOCK=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_TAG_BRCM=y
+CONFIG_NET_DSA_TAG_BRCM_COMMON=y
+CONFIG_NET_DSA_TAG_BRCM_LEGACY=y
+CONFIG_NET_DSA_TAG_BRCM_PREPEND=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NO_EXCEPT_FILL=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+CONFIG_NR_CPUS=2
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_PADATA=y
+CONFIG_PAGE_POOL=y
+CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
+CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+# CONFIG_PCIE_BCM6318 is not set
+CONFIG_PCIE_BCM6328=y
+CONFIG_PCIE_PME=y
+CONFIG_PCI_BCM6348=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DRIVERS_LEGACY=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PHYSICAL_START=0x80010000
+CONFIG_PHY_BCM63XX_USBH=y
+# CONFIG_PHY_BRCM_SATA is not set
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_BCM6318 is not set
+# CONFIG_PINCTRL_BCM63268 is not set
+CONFIG_PINCTRL_BCM6328=y
+# CONFIG_PINCTRL_BCM6358 is not set
+# CONFIG_PINCTRL_BCM6362 is not set
+# CONFIG_PINCTRL_BCM6368 is not set
+CONFIG_PINCTRL_BCM63XX=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PREEMPT_NONE_BUILD=y
+CONFIG_PROC_VMCORE=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RANDSTRUCT_NONE=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RELAY=y
+CONFIG_RESET_BCM6345=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIAL_BCM63XX=y
+CONFIG_SERIAL_BCM63XX_CONSOLE=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SMP=y
+CONFIG_SMP_UP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOC_BCM63XX=y
+CONFIG_SPI=y
+# CONFIG_SPI_BCM63XX is not set
+CONFIG_SPI_BCM63XX_HSSPI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRCU=y
+CONFIG_SWAP_IO_SPACE=y
+CONFIG_SWPHY=y
+CONFIG_SYNC_R4K=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYS_HAS_CPU_BMIPS=y
+CONFIG_SYS_HAS_CPU_BMIPS32_3300=y
+CONFIG_SYS_HAS_CPU_BMIPS4350=y
+CONFIG_SYS_HAS_CPU_BMIPS4380=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+CONFIG_SYS_SUPPORTS_HOTPLUG_CPU=y
+CONFIG_SYS_SUPPORTS_SMP=y
+CONFIG_TARGET_ISA_REV=0
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UBIFS_FS=y
+CONFIG_USB_EHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_EHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_OHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_OHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_OF=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_WATCHDOG_NOWAYOUT=y
+CONFIG_WEAK_ORDERING=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMMON=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/bmips/bcm6328/target.mk b/target/linux/bmips/bcm6328/target.mk
new file mode 100644
index 00000000000000..a514130fc7b016
--- /dev/null
+++ b/target/linux/bmips/bcm6328/target.mk
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+SUBTARGET:=bcm6328
+BOARDNAME:=BCM6328 based boards
+FEATURES+=nand
+
+define Target/Description
+  Build firmware images for Broadcom BCM6328 based boards.
+endef
diff --git a/target/linux/bmips/bcm6358/base-files/etc/board.d/01_leds b/target/linux/bmips/bcm6358/base-files/etc/board.d/01_leds
new file mode 100644
index 00000000000000..74fdef28fb3163
--- /dev/null
+++ b/target/linux/bmips/bcm6358/base-files/etc/board.d/01_leds
@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+. /lib/functions/leds.sh
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+huawei,hg556a-b)
+	ucidef_set_led_usbport "usb" "USB" "red:hspa" "1-1-port1" "1-1-port2" "usb1-port2" "usb2-port2"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/bmips/bcm6358/base-files/etc/board.d/02_network b/target/linux/bmips/bcm6358/base-files/etc/board.d/02_network
new file mode 100644
index 00000000000000..470d1b1bd0d5a3
--- /dev/null
+++ b/target/linux/bmips/bcm6358/base-files/etc/board.d/02_network
@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+huawei,hg556a-b)
+	ucidef_set_interface_lan "eth0"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/bmips/bcm6358/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom b/target/linux/bmips/bcm6358/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
new file mode 100644
index 00000000000000..b12d89f29d9be4
--- /dev/null
+++ b/target/linux/bmips/bcm6358/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
@@ -0,0 +1,34 @@
+#!/bin/sh
+
+[ -e /lib/firmware/$FIRMWARE ] && exit 0
+
+. /lib/functions/caldata.sh
+
+caldata_extract_swap() {
+	local part=$1
+	local offset=$2
+	local count=$3
+	local mtd
+
+	mtd=$(find_mtd_chardev $part)
+	[ -n "$mtd" ] || caldata_die "no mtd device found for partition $part"
+
+	offset=$(($offset / 2))
+	count=$(($count / 2))
+
+	dd if=$mtd of=/lib/firmware/$FIRMWARE bs=2 skip=$offset count=$count conv=swab 2>/dev/null || \
+		caldata_die "failed to extract calibration data from $mtd"
+}
+
+case "$FIRMWARE" in
+	"ath9k-eeprom-pci-0000:00:01.0.bin")
+		case "$(board_name)" in
+			huawei,hg556a-b)
+				caldata_extract_swap "cal_data" 0x1e000 0xeb8
+				;;
+			*)
+				caldata_die "board $board is not supported yet"
+				;;
+		esac
+		;;
+esac
diff --git a/target/linux/bmips/bcm6358/base-files/lib/upgrade/platform.sh b/target/linux/bmips/bcm6358/base-files/lib/upgrade/platform.sh
new file mode 100644
index 00000000000000..1cf95be26a5f0a
--- /dev/null
+++ b/target/linux/bmips/bcm6358/base-files/lib/upgrade/platform.sh
@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+PART_NAME=firmware
+REQUIRE_IMAGE_METADATA=1
+
+platform_check_image() {
+	return 0
+}
+
+platform_do_upgrade() {
+	case "$(board_name)" in
+	*)
+		default_do_upgrade "$1"
+		;;
+	esac
+}
diff --git a/target/linux/bmips/bcm6358/config-5.15 b/target/linux/bmips/bcm6358/config-5.15
new file mode 100644
index 00000000000000..5d7a299444388a
--- /dev/null
+++ b/target/linux/bmips/bcm6358/config-5.15
@@ -0,0 +1,265 @@
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_B53=y
+CONFIG_B53_MDIO_DRIVER=y
+CONFIG_B53_SPI_DRIVER=y
+CONFIG_BCM6345_EXT_IRQ=y
+CONFIG_BCM6345_L1_IRQ=y
+CONFIG_BCM6348_ENET=y
+# CONFIG_BCM6368_ENETSW is not set
+CONFIG_BCM7038_WDT=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BMIPS_GENERIC=y
+CONFIG_CEVT_R4K=y
+# CONFIG_CLK_BCM63268_TIMER is not set
+CONFIG_CLK_BCM_63XX_GATE=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CPU_BMIPS=y
+CONFIG_CPU_BMIPS32_3300=y
+CONFIG_CPU_BMIPS4350=y
+CONFIG_CPU_BMIPS4380=y
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_RIXI=y
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_MIPS32=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_NO_EFFICIENT_FFS=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_CPUFREQ=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CRASH_DUMP=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_CSRC_R4K=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_DTC=y
+# CONFIG_DT_BCM93384WVG is not set
+# CONFIG_DT_BCM93384WVG_VIPER is not set
+# CONFIG_DT_BCM96368MVWG is not set
+# CONFIG_DT_BCM97125CBMB is not set
+# CONFIG_DT_BCM97346DBSMB is not set
+# CONFIG_DT_BCM97358SVMB is not set
+# CONFIG_DT_BCM97360SVMB is not set
+# CONFIG_DT_BCM97362SVMB is not set
+# CONFIG_DT_BCM97420C is not set
+# CONFIG_DT_BCM97425SVMB is not set
+# CONFIG_DT_BCM97435SVMB is not set
+# CONFIG_DT_BCM9EJTAGPRB is not set
+# CONFIG_DT_COMTREND_VR3032U is not set
+# CONFIG_DT_NETGEAR_CVG834G is not set
+CONFIG_DT_NONE=y
+# CONFIG_DT_SFR_NEUFBOX4_SERCOMM is not set
+# CONFIG_DT_SFR_NEUFBOX6_SERCOMM is not set
+CONFIG_FIXED_PHY=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+# CONFIG_GPIO_BRCMSTB is not set
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_GPIO_REGMAP=y
+CONFIG_GRO_CELLS=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+# CONFIG_LEDS_SERCOMM_MSP430 is not set
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MDIO_BUS=y
+# CONFIG_MDIO_BUS_MUX_BCM6368 is not set
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+CONFIG_MIPS_CLOCK_VSYSCALL=y
+# CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER is not set
+CONFIG_MIPS_CMDLINE_FROM_DTB=y
+CONFIG_MIPS_EBPF_JIT=y
+CONFIG_MIPS_EXTERNAL_TIMER=y
+CONFIG_MIPS_L1_CACHE_SHIFT=6
+CONFIG_MIPS_L1_CACHE_SHIFT_4=y
+CONFIG_MIPS_L1_CACHE_SHIFT_6=y
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+# CONFIG_MIPS_NO_APPENDED_DTB is not set
+CONFIG_MIPS_NR_CPU_NR_MAP=2
+CONFIG_MIPS_O32_FP64_SUPPORT=y
+CONFIG_MIPS_RAW_APPENDED_DTB=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MODULE_FORCE_LOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+# CONFIG_MTD_BCM63XX_PARTS is not set
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_BE_BYTE_SWAP=y
+# CONFIG_MTD_CFI_GEOMETRY is not set
+# CONFIG_MTD_CFI_NOSWAP is not set
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_JEDECPROBE=y
+# CONFIG_MTD_PARSER_IMAGETAG is not set
+CONFIG_MTD_PHYSMAP=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPLIT_BCM63XX_FW=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_TAG_BRCM=y
+CONFIG_NET_DSA_TAG_BRCM_COMMON=y
+CONFIG_NET_DSA_TAG_BRCM_LEGACY=y
+CONFIG_NET_DSA_TAG_BRCM_PREPEND=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NO_EXCEPT_FILL=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+CONFIG_NR_CPUS=2
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_PADATA=y
+CONFIG_PCI=y
+# CONFIG_PCIE_BCM6318 is not set
+# CONFIG_PCIE_BCM6328 is not set
+CONFIG_PCI_BCM6348=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DRIVERS_LEGACY=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PHYSICAL_START=0x80010000
+CONFIG_PHY_BCM63XX_USBH=y
+# CONFIG_PHY_BRCM_SATA is not set
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_BCM6318 is not set
+# CONFIG_PINCTRL_BCM63268 is not set
+# CONFIG_PINCTRL_BCM6328 is not set
+CONFIG_PINCTRL_BCM6358=y
+# CONFIG_PINCTRL_BCM6362 is not set
+# CONFIG_PINCTRL_BCM6368 is not set
+CONFIG_PINCTRL_BCM63XX=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PROC_VMCORE=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RELAY=y
+CONFIG_RESET_BCM6345=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIAL_BCM63XX=y
+CONFIG_SERIAL_BCM63XX_CONSOLE=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SMP=y
+CONFIG_SMP_UP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+# CONFIG_SOC_BCM63XX is not set
+CONFIG_SPI=y
+CONFIG_SPI_BCM63XX=y
+# CONFIG_SPI_BCM63XX_HSSPI is not set
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRCU=y
+CONFIG_SWAP_IO_SPACE=y
+CONFIG_SWPHY=y
+CONFIG_SYNC_R4K=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYS_HAS_CPU_BMIPS=y
+CONFIG_SYS_HAS_CPU_BMIPS32_3300=y
+CONFIG_SYS_HAS_CPU_BMIPS4350=y
+CONFIG_SYS_HAS_CPU_BMIPS4380=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+CONFIG_SYS_SUPPORTS_HOTPLUG_CPU=y
+CONFIG_SYS_SUPPORTS_SMP=y
+CONFIG_TARGET_ISA_REV=0
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_USB_EHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_EHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_OHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_OHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_OF=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_WATCHDOG_NOWAYOUT=y
+CONFIG_WEAK_ORDERING=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/bmips/bcm6358/config-6.1 b/target/linux/bmips/bcm6358/config-6.1
new file mode 100644
index 00000000000000..1d95a92cbc322b
--- /dev/null
+++ b/target/linux/bmips/bcm6358/config-6.1
@@ -0,0 +1,280 @@
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_FORCE_MAX_ORDER=11
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_B53=y
+CONFIG_B53_MDIO_DRIVER=y
+CONFIG_B53_SPI_DRIVER=y
+CONFIG_BCM6345_EXT_IRQ=y
+CONFIG_BCM6345_L1_IRQ=y
+CONFIG_BCM6348_ENET=y
+# CONFIG_BCM6368_ENETSW is not set
+CONFIG_BCM7038_WDT=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BMIPS_GENERIC=y
+CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
+CONFIG_CC_NO_ARRAY_BOUNDS=y
+CONFIG_CEVT_R4K=y
+# CONFIG_CLK_BCM63268_TIMER is not set
+CONFIG_CLK_BCM_63XX_GATE=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONTEXT_TRACKING=y
+CONFIG_CONTEXT_TRACKING_IDLE=y
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CPU_BMIPS=y
+CONFIG_CPU_BMIPS32_3300=y
+CONFIG_CPU_BMIPS4350=y
+CONFIG_CPU_BMIPS4380=y
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_RIXI=y
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_MIPS32=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_NO_EFFICIENT_FFS=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_CPUFREQ=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CRASH_DUMP=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_LIB_SHA1=y
+CONFIG_CRYPTO_LIB_UTILS=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_CSRC_R4K=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_DTC=y
+# CONFIG_DT_BCM93384WVG is not set
+# CONFIG_DT_BCM93384WVG_VIPER is not set
+# CONFIG_DT_BCM96368MVWG is not set
+# CONFIG_DT_BCM97125CBMB is not set
+# CONFIG_DT_BCM97346DBSMB is not set
+# CONFIG_DT_BCM97358SVMB is not set
+# CONFIG_DT_BCM97360SVMB is not set
+# CONFIG_DT_BCM97362SVMB is not set
+# CONFIG_DT_BCM97420C is not set
+# CONFIG_DT_BCM97425SVMB is not set
+# CONFIG_DT_BCM97435SVMB is not set
+# CONFIG_DT_BCM9EJTAGPRB is not set
+# CONFIG_DT_COMTREND_VR3032U is not set
+# CONFIG_DT_NETGEAR_CVG834G is not set
+CONFIG_DT_NONE=y
+# CONFIG_DT_SFR_NEUFBOX4_SERCOMM is not set
+# CONFIG_DT_SFR_NEUFBOX6_SERCOMM is not set
+CONFIG_EXCLUSIVE_SYSTEM_RAM=y
+CONFIG_FIXED_PHY=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CFE=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_FW_LOADER_SYSFS=y
+CONFIG_GCC11_NO_ARRAY_BOUNDS=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+# CONFIG_GPIO_BRCMSTB is not set
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_GPIO_REGMAP=y
+CONFIG_GRO_CELLS=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+# CONFIG_LEDS_SERCOMM_MSP430 is not set
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MDIO_BUS=y
+# CONFIG_MDIO_BUS_MUX_BCM6368 is not set
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+CONFIG_MIPS_CLOCK_VSYSCALL=y
+# CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER is not set
+CONFIG_MIPS_CMDLINE_FROM_DTB=y
+CONFIG_MIPS_EXTERNAL_TIMER=y
+CONFIG_MIPS_L1_CACHE_SHIFT=6
+CONFIG_MIPS_L1_CACHE_SHIFT_4=y
+CONFIG_MIPS_L1_CACHE_SHIFT_6=y
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+# CONFIG_MIPS_NO_APPENDED_DTB is not set
+CONFIG_MIPS_NR_CPU_NR_MAP=2
+CONFIG_MIPS_O32_FP64_SUPPORT=y
+CONFIG_MIPS_RAW_APPENDED_DTB=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MODULE_FORCE_LOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+# CONFIG_MTD_BCM63XX_PARTS is not set
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_BE_BYTE_SWAP=y
+# CONFIG_MTD_CFI_GEOMETRY is not set
+# CONFIG_MTD_CFI_NOSWAP is not set
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_JEDECPROBE=y
+# CONFIG_MTD_PARSER_IMAGETAG is not set
+CONFIG_MTD_PHYSMAP=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPLIT_BCM63XX_FW=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_TAG_BRCM=y
+CONFIG_NET_DSA_TAG_BRCM_COMMON=y
+CONFIG_NET_DSA_TAG_BRCM_LEGACY=y
+CONFIG_NET_DSA_TAG_BRCM_PREPEND=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NO_EXCEPT_FILL=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+CONFIG_NR_CPUS=2
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_PADATA=y
+CONFIG_PAGE_POOL=y
+CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
+CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
+CONFIG_PCI=y
+# CONFIG_PCIE_BCM6318 is not set
+# CONFIG_PCIE_BCM6328 is not set
+CONFIG_PCI_BCM6348=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DRIVERS_LEGACY=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PHYSICAL_START=0x80010000
+CONFIG_PHY_BCM63XX_USBH=y
+# CONFIG_PHY_BRCM_SATA is not set
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_BCM6318 is not set
+# CONFIG_PINCTRL_BCM63268 is not set
+# CONFIG_PINCTRL_BCM6328 is not set
+CONFIG_PINCTRL_BCM6358=y
+# CONFIG_PINCTRL_BCM6362 is not set
+# CONFIG_PINCTRL_BCM6368 is not set
+CONFIG_PINCTRL_BCM63XX=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PREEMPT_NONE_BUILD=y
+CONFIG_PROC_VMCORE=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RANDSTRUCT_NONE=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RELAY=y
+CONFIG_RESET_BCM6345=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIAL_BCM63XX=y
+CONFIG_SERIAL_BCM63XX_CONSOLE=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SMP=y
+CONFIG_SMP_UP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+# CONFIG_SOC_BCM63XX is not set
+CONFIG_SPI=y
+CONFIG_SPI_BCM63XX=y
+# CONFIG_SPI_BCM63XX_HSSPI is not set
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRCU=y
+CONFIG_SWAP_IO_SPACE=y
+CONFIG_SWPHY=y
+CONFIG_SYNC_R4K=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYS_HAS_CPU_BMIPS=y
+CONFIG_SYS_HAS_CPU_BMIPS32_3300=y
+CONFIG_SYS_HAS_CPU_BMIPS4350=y
+CONFIG_SYS_HAS_CPU_BMIPS4380=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+CONFIG_SYS_SUPPORTS_HOTPLUG_CPU=y
+CONFIG_SYS_SUPPORTS_SMP=y
+CONFIG_TARGET_ISA_REV=0
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_USB_EHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_EHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_OHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_OHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_OF=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_WATCHDOG_NOWAYOUT=y
+CONFIG_WEAK_ORDERING=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMMON=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/bmips/bcm6358/target.mk b/target/linux/bmips/bcm6358/target.mk
new file mode 100644
index 00000000000000..d868d0a986d7ed
--- /dev/null
+++ b/target/linux/bmips/bcm6358/target.mk
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+SUBTARGET:=bcm6358
+BOARDNAME:=BCM6358 based boards
+FEATURES+=low_mem
+
+define Target/Description
+  Build firmware images for Broadcom BCM6358 based boards.
+endef
diff --git a/target/linux/bmips/bcm6362/base-files/etc/board.d/01_leds b/target/linux/bmips/bcm6362/base-files/etc/board.d/01_leds
new file mode 100644
index 00000000000000..cb1d24ce8921e3
--- /dev/null
+++ b/target/linux/bmips/bcm6362/base-files/etc/board.d/01_leds
@@ -0,0 +1,20 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+. /lib/functions/leds.sh
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+huawei,hg253s-v2)
+	ucidef_set_led_usbport "usb" "USB" "green:usb" "usb1-port1" "usb2-port1"
+	;;
+netgear,dgnd3700-v2)
+	ucidef_set_led_usbport "usb1" "USB1" "green:usb1" "usb1-port1" "usb2-port1"
+	ucidef_set_led_usbport "usb2" "USB2" "green:usb2" "usb1-port2" "usb2-port2"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/bmips/bcm6362/base-files/etc/board.d/02_network b/target/linux/bmips/bcm6362/base-files/etc/board.d/02_network
new file mode 100644
index 00000000000000..7986f783106780
--- /dev/null
+++ b/target/linux/bmips/bcm6362/base-files/etc/board.d/02_network
@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+huawei,hg253s-v2 |\
+netgear,dgnd3700-v2)
+	ucidef_set_bridge_device switch
+	ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" "wan"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/bmips/bcm6362/base-files/lib/upgrade/platform.sh b/target/linux/bmips/bcm6362/base-files/lib/upgrade/platform.sh
new file mode 100644
index 00000000000000..ded966e4cca0b9
--- /dev/null
+++ b/target/linux/bmips/bcm6362/base-files/lib/upgrade/platform.sh
@@ -0,0 +1,21 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+PART_NAME=firmware
+REQUIRE_IMAGE_METADATA=1
+
+platform_check_image() {
+	return 0
+}
+
+platform_do_upgrade() {
+	case "$(board_name)" in
+	huawei,hg253s-v2 |\
+	netgear,dgnd3700-v2)
+		CI_JFFS2_CLEAN_MARKERS=1
+		nand_do_upgrade "$1"
+		;;
+	*)
+		default_do_upgrade "$1"
+		;;
+	esac
+}
diff --git a/target/linux/bmips/bcm6362/config-5.15 b/target/linux/bmips/bcm6362/config-5.15
new file mode 100644
index 00000000000000..5f9b528d957f24
--- /dev/null
+++ b/target/linux/bmips/bcm6362/config-5.15
@@ -0,0 +1,285 @@
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_B53=y
+CONFIG_B53_MDIO_DRIVER=y
+CONFIG_B53_MMAP_DRIVER=y
+CONFIG_B53_SPI_DRIVER=y
+CONFIG_BCM6345_EXT_IRQ=y
+CONFIG_BCM6345_L1_IRQ=y
+# CONFIG_BCM6348_ENET is not set
+CONFIG_BCM6368_ENETSW=y
+CONFIG_BCM63XX_POWER=y
+CONFIG_BCM7038_WDT=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BMIPS_GENERIC=y
+CONFIG_CEVT_R4K=y
+# CONFIG_CLK_BCM63268_TIMER is not set
+CONFIG_CLK_BCM_63XX_GATE=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CPU_BMIPS=y
+CONFIG_CPU_BMIPS32_3300=y
+CONFIG_CPU_BMIPS4350=y
+CONFIG_CPU_BMIPS4380=y
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_RIXI=y
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_MIPS32=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_NO_EFFICIENT_FFS=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_CPUFREQ=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CRASH_DUMP=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_CSRC_R4K=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_DTC=y
+# CONFIG_DT_BCM93384WVG is not set
+# CONFIG_DT_BCM93384WVG_VIPER is not set
+# CONFIG_DT_BCM96368MVWG is not set
+# CONFIG_DT_BCM97125CBMB is not set
+# CONFIG_DT_BCM97346DBSMB is not set
+# CONFIG_DT_BCM97358SVMB is not set
+# CONFIG_DT_BCM97360SVMB is not set
+# CONFIG_DT_BCM97362SVMB is not set
+# CONFIG_DT_BCM97420C is not set
+# CONFIG_DT_BCM97425SVMB is not set
+# CONFIG_DT_BCM97435SVMB is not set
+# CONFIG_DT_BCM9EJTAGPRB is not set
+# CONFIG_DT_COMTREND_VR3032U is not set
+# CONFIG_DT_NETGEAR_CVG834G is not set
+CONFIG_DT_NONE=y
+# CONFIG_DT_SFR_NEUFBOX4_SERCOMM is not set
+# CONFIG_DT_SFR_NEUFBOX6_SERCOMM is not set
+CONFIG_FIXED_PHY=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+# CONFIG_GPIO_BRCMSTB is not set
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_GPIO_REGMAP=y
+CONFIG_GRO_CELLS=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_BCM2835=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+# CONFIG_LEDS_SERCOMM_MSP430 is not set
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_BUS_MUX=y
+CONFIG_MDIO_BUS_MUX_BCM6368=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+CONFIG_MIPS_CLOCK_VSYSCALL=y
+# CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER is not set
+CONFIG_MIPS_CMDLINE_FROM_DTB=y
+CONFIG_MIPS_EBPF_JIT=y
+CONFIG_MIPS_EXTERNAL_TIMER=y
+CONFIG_MIPS_L1_CACHE_SHIFT=6
+CONFIG_MIPS_L1_CACHE_SHIFT_4=y
+CONFIG_MIPS_L1_CACHE_SHIFT_6=y
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+# CONFIG_MIPS_NO_APPENDED_DTB is not set
+CONFIG_MIPS_NR_CPU_NR_MAP=2
+CONFIG_MIPS_O32_FP64_SUPPORT=y
+CONFIG_MIPS_RAW_APPENDED_DTB=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MODULE_FORCE_LOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+# CONFIG_MTD_BCM63XX_PARTS is not set
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_BE_BYTE_SWAP=y
+# CONFIG_MTD_CFI_GEOMETRY is not set
+# CONFIG_MTD_CFI_NOSWAP is not set
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_NAND_BRCMNAND=y
+CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_NAND_ECC_SW_HAMMING=y
+# CONFIG_MTD_PARSER_IMAGETAG is not set
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPLIT_BCM63XX_FW=y
+CONFIG_MTD_SPLIT_BCM_WFI_FW=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_LIMIT=20
+CONFIG_MTD_UBI_BLOCK=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_TAG_BRCM=y
+CONFIG_NET_DSA_TAG_BRCM_COMMON=y
+CONFIG_NET_DSA_TAG_BRCM_LEGACY=y
+CONFIG_NET_DSA_TAG_BRCM_PREPEND=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NO_EXCEPT_FILL=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+CONFIG_NR_CPUS=2
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_PADATA=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+# CONFIG_PCIE_BCM6318 is not set
+CONFIG_PCIE_BCM6328=y
+CONFIG_PCIE_PME=y
+# CONFIG_PCI_BCM6348 is not set
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DRIVERS_LEGACY=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PHYSICAL_START=0x80010000
+CONFIG_PHY_BCM63XX_USBH=y
+# CONFIG_PHY_BRCM_SATA is not set
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_BCM6318 is not set
+# CONFIG_PINCTRL_BCM63268 is not set
+# CONFIG_PINCTRL_BCM6328 is not set
+# CONFIG_PINCTRL_BCM6358 is not set
+CONFIG_PINCTRL_BCM6362=y
+# CONFIG_PINCTRL_BCM6368 is not set
+CONFIG_PINCTRL_BCM63XX=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PROC_VMCORE=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RELAY=y
+CONFIG_RESET_BCM6345=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIAL_BCM63XX=y
+CONFIG_SERIAL_BCM63XX_CONSOLE=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SMP=y
+CONFIG_SMP_UP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOC_BCM63XX=y
+CONFIG_SPI=y
+CONFIG_SPI_BCM63XX=y
+CONFIG_SPI_BCM63XX_HSSPI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRCU=y
+CONFIG_SWAP_IO_SPACE=y
+CONFIG_SWPHY=y
+CONFIG_SYNC_R4K=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYS_HAS_CPU_BMIPS=y
+CONFIG_SYS_HAS_CPU_BMIPS32_3300=y
+CONFIG_SYS_HAS_CPU_BMIPS4350=y
+CONFIG_SYS_HAS_CPU_BMIPS4380=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+CONFIG_SYS_SUPPORTS_HOTPLUG_CPU=y
+CONFIG_SYS_SUPPORTS_SMP=y
+CONFIG_TARGET_ISA_REV=0
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UBIFS_FS=y
+CONFIG_USB_EHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_EHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_OHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_OHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_OF=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_WATCHDOG_NOWAYOUT=y
+CONFIG_WEAK_ORDERING=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/bmips/bcm6362/config-6.1 b/target/linux/bmips/bcm6362/config-6.1
new file mode 100644
index 00000000000000..b51f7e4166aadb
--- /dev/null
+++ b/target/linux/bmips/bcm6362/config-6.1
@@ -0,0 +1,300 @@
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_FORCE_MAX_ORDER=11
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_B53=y
+CONFIG_B53_MDIO_DRIVER=y
+CONFIG_B53_MMAP_DRIVER=y
+CONFIG_B53_SPI_DRIVER=y
+CONFIG_BCM6345_EXT_IRQ=y
+CONFIG_BCM6345_L1_IRQ=y
+# CONFIG_BCM6348_ENET is not set
+CONFIG_BCM6368_ENETSW=y
+CONFIG_BCM63XX_POWER=y
+CONFIG_BCM7038_WDT=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BMIPS_GENERIC=y
+CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
+CONFIG_CC_NO_ARRAY_BOUNDS=y
+CONFIG_CEVT_R4K=y
+# CONFIG_CLK_BCM63268_TIMER is not set
+CONFIG_CLK_BCM_63XX_GATE=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONTEXT_TRACKING=y
+CONFIG_CONTEXT_TRACKING_IDLE=y
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CPU_BMIPS=y
+CONFIG_CPU_BMIPS32_3300=y
+CONFIG_CPU_BMIPS4350=y
+CONFIG_CPU_BMIPS4380=y
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_RIXI=y
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_MIPS32=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_NO_EFFICIENT_FFS=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_CPUFREQ=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CRASH_DUMP=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_LIB_SHA1=y
+CONFIG_CRYPTO_LIB_UTILS=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_CSRC_R4K=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_DTC=y
+# CONFIG_DT_BCM93384WVG is not set
+# CONFIG_DT_BCM93384WVG_VIPER is not set
+# CONFIG_DT_BCM96368MVWG is not set
+# CONFIG_DT_BCM97125CBMB is not set
+# CONFIG_DT_BCM97346DBSMB is not set
+# CONFIG_DT_BCM97358SVMB is not set
+# CONFIG_DT_BCM97360SVMB is not set
+# CONFIG_DT_BCM97362SVMB is not set
+# CONFIG_DT_BCM97420C is not set
+# CONFIG_DT_BCM97425SVMB is not set
+# CONFIG_DT_BCM97435SVMB is not set
+# CONFIG_DT_BCM9EJTAGPRB is not set
+# CONFIG_DT_COMTREND_VR3032U is not set
+# CONFIG_DT_NETGEAR_CVG834G is not set
+CONFIG_DT_NONE=y
+# CONFIG_DT_SFR_NEUFBOX4_SERCOMM is not set
+# CONFIG_DT_SFR_NEUFBOX6_SERCOMM is not set
+CONFIG_EXCLUSIVE_SYSTEM_RAM=y
+CONFIG_FIXED_PHY=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CFE=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_FW_LOADER_SYSFS=y
+CONFIG_GCC11_NO_ARRAY_BOUNDS=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+# CONFIG_GPIO_BRCMSTB is not set
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_GPIO_REGMAP=y
+CONFIG_GRO_CELLS=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_BCM2835=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+# CONFIG_LEDS_SERCOMM_MSP430 is not set
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_BUS_MUX=y
+CONFIG_MDIO_BUS_MUX_BCM6368=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+CONFIG_MIPS_CLOCK_VSYSCALL=y
+# CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER is not set
+CONFIG_MIPS_CMDLINE_FROM_DTB=y
+CONFIG_MIPS_EXTERNAL_TIMER=y
+CONFIG_MIPS_L1_CACHE_SHIFT=6
+CONFIG_MIPS_L1_CACHE_SHIFT_4=y
+CONFIG_MIPS_L1_CACHE_SHIFT_6=y
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+# CONFIG_MIPS_NO_APPENDED_DTB is not set
+CONFIG_MIPS_NR_CPU_NR_MAP=2
+CONFIG_MIPS_O32_FP64_SUPPORT=y
+CONFIG_MIPS_RAW_APPENDED_DTB=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MODULE_FORCE_LOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+# CONFIG_MTD_BCM63XX_PARTS is not set
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_BE_BYTE_SWAP=y
+# CONFIG_MTD_CFI_GEOMETRY is not set
+# CONFIG_MTD_CFI_NOSWAP is not set
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_NAND_BRCMNAND=y
+CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_NAND_ECC_SW_HAMMING=y
+# CONFIG_MTD_PARSER_IMAGETAG is not set
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPLIT_BCM63XX_FW=y
+CONFIG_MTD_SPLIT_BCM_WFI_FW=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_LIMIT=20
+CONFIG_MTD_UBI_BLOCK=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_TAG_BRCM=y
+CONFIG_NET_DSA_TAG_BRCM_COMMON=y
+CONFIG_NET_DSA_TAG_BRCM_LEGACY=y
+CONFIG_NET_DSA_TAG_BRCM_PREPEND=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NO_EXCEPT_FILL=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+CONFIG_NR_CPUS=2
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_PADATA=y
+CONFIG_PAGE_POOL=y
+CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
+CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+# CONFIG_PCIE_BCM6318 is not set
+CONFIG_PCIE_BCM6328=y
+CONFIG_PCIE_PME=y
+# CONFIG_PCI_BCM6348 is not set
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DRIVERS_LEGACY=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PHYSICAL_START=0x80010000
+CONFIG_PHY_BCM63XX_USBH=y
+# CONFIG_PHY_BRCM_SATA is not set
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_BCM6318 is not set
+# CONFIG_PINCTRL_BCM63268 is not set
+# CONFIG_PINCTRL_BCM6328 is not set
+# CONFIG_PINCTRL_BCM6358 is not set
+CONFIG_PINCTRL_BCM6362=y
+# CONFIG_PINCTRL_BCM6368 is not set
+CONFIG_PINCTRL_BCM63XX=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PREEMPT_NONE_BUILD=y
+CONFIG_PROC_VMCORE=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RANDSTRUCT_NONE=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RELAY=y
+CONFIG_RESET_BCM6345=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIAL_BCM63XX=y
+CONFIG_SERIAL_BCM63XX_CONSOLE=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SMP=y
+CONFIG_SMP_UP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOC_BCM63XX=y
+CONFIG_SPI=y
+CONFIG_SPI_BCM63XX=y
+CONFIG_SPI_BCM63XX_HSSPI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRCU=y
+CONFIG_SWAP_IO_SPACE=y
+CONFIG_SWPHY=y
+CONFIG_SYNC_R4K=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYS_HAS_CPU_BMIPS=y
+CONFIG_SYS_HAS_CPU_BMIPS32_3300=y
+CONFIG_SYS_HAS_CPU_BMIPS4350=y
+CONFIG_SYS_HAS_CPU_BMIPS4380=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+CONFIG_SYS_SUPPORTS_HOTPLUG_CPU=y
+CONFIG_SYS_SUPPORTS_SMP=y
+CONFIG_TARGET_ISA_REV=0
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UBIFS_FS=y
+CONFIG_USB_EHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_EHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_OHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_OHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_OF=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_WATCHDOG_NOWAYOUT=y
+CONFIG_WEAK_ORDERING=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMMON=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/bmips/bcm6362/target.mk b/target/linux/bmips/bcm6362/target.mk
new file mode 100644
index 00000000000000..81addd45f6b0e6
--- /dev/null
+++ b/target/linux/bmips/bcm6362/target.mk
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+SUBTARGET:=bcm6362
+BOARDNAME:=BCM6362 based boards
+FEATURES+=nand
+
+define Target/Description
+  Build firmware images for Broadcom BCM6362 based boards.
+endef
diff --git a/target/linux/bmips/bcm6368/base-files/etc/board.d/01_leds b/target/linux/bmips/bcm6368/base-files/etc/board.d/01_leds
new file mode 100644
index 00000000000000..9af5257c1160e3
--- /dev/null
+++ b/target/linux/bmips/bcm6368/base-files/etc/board.d/01_leds
@@ -0,0 +1,38 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+. /lib/functions/leds.sh
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+actiontec,r1000h)
+	ucidef_set_led_usbport "usb" "USB" "green:usb" "usb1-port1" "usb2-port1"
+	ucidef_set_led_netdev "wan" "WAN" "green:wan" "wan"
+	;;
+comtrend,wap-5813n)
+	ucidef_set_led_usbport "usb" "USB" "green:usb" "usb1-port1" "usb2-port1"
+	;;
+netgear,dgnd3700-v1 |\
+netgear,dgnd3800b)
+	ucidef_set_led_netdev "lan" "LAN" "green:lan" "switch.1"
+	ucidef_set_led_netdev "wan" "WAN" "green:wan" "wan"
+	ucidef_set_led_netdev "wlan0" "WIFI2G" "green:wifi2g" "phy0-ap0"
+	ucidef_set_led_netdev "wlan1" "WIFI5G" "blue:wifi5g" "phy1-ap0"
+	ucidef_set_led_usbport "usb1" "USB1" "green:usb1" "usb1-port1" "usb2-port1"
+	ucidef_set_led_usbport "usb2" "USB2" "green:usb2" "usb1-port2" "usb2-port2"
+	;;
+netgear,evg2000)
+	ucidef_set_led_netdev "lan" "LAN" "green:lan" "switch.1"
+	ucidef_set_led_netdev "wan" "WAN" "green:wan" "wan"
+	ucidef_set_led_usbdev "usb" "USB" "green:usb" "usb1-port1" "usb2-port1" "usb1-port2" "usb2-port2"
+	;;
+observa,vh4032n)
+	ucidef_set_led_usbport "usb1" "USB1" "blue:hspa" "usb1-port1" "usb2-port1"
+	ucidef_set_led_usbport "usb2" "USB2" "red:hspa" "1-2-port1" "1-2-port2"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/bmips/bcm6368/base-files/etc/board.d/02_network b/target/linux/bmips/bcm6368/base-files/etc/board.d/02_network
new file mode 100644
index 00000000000000..fabc4216cd5f73
--- /dev/null
+++ b/target/linux/bmips/bcm6368/base-files/etc/board.d/02_network
@@ -0,0 +1,29 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+comtrend,vr-3025u |\
+observa,vh4032n)
+	ucidef_set_bridge_device switch
+	ucidef_set_interface_lan "lan1 lan2 lan3 lan4"
+	;;
+comtrend,vr-3025un)
+	ucidef_set_bridge_device switch
+	ucidef_set_interface_lan "lan1 lan2 lan3 iptv"
+	;;
+actiontec,r1000h |\
+comtrend,wap-5813n |\
+netgear,dgnd3700-v1 |\
+netgear,dgnd3800b |\
+netgear,evg2000)
+	ucidef_set_bridge_device switch
+	ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" "wan"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/bmips/bcm6368/base-files/etc/uci-defaults/09_fix_crc b/target/linux/bmips/bcm6368/base-files/etc/uci-defaults/09_fix_crc
new file mode 100644
index 00000000000000..f3b1eafdfc66fc
--- /dev/null
+++ b/target/linux/bmips/bcm6368/base-files/etc/uci-defaults/09_fix_crc
@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+. /lib/functions.sh
+
+case "$(board_name)" in
+actiontec,r1000h |\
+comtrend,vr-3025u |\
+comtrend,vr-3025un |\
+comtrend,wap-5813n |\
+netgear,evg2000 |\
+observa,vh4032n)
+	mtd fixtrx firmware
+	;;
+esac
+
+exit 0
diff --git a/target/linux/bmips/bcm6368/base-files/lib/upgrade/platform.sh b/target/linux/bmips/bcm6368/base-files/lib/upgrade/platform.sh
new file mode 100644
index 00000000000000..1cf95be26a5f0a
--- /dev/null
+++ b/target/linux/bmips/bcm6368/base-files/lib/upgrade/platform.sh
@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+PART_NAME=firmware
+REQUIRE_IMAGE_METADATA=1
+
+platform_check_image() {
+	return 0
+}
+
+platform_do_upgrade() {
+	case "$(board_name)" in
+	*)
+		default_do_upgrade "$1"
+		;;
+	esac
+}
diff --git a/target/linux/bmips/bcm6368/config-5.15 b/target/linux/bmips/bcm6368/config-5.15
new file mode 100644
index 00000000000000..910d36ce0b3e92
--- /dev/null
+++ b/target/linux/bmips/bcm6368/config-5.15
@@ -0,0 +1,281 @@
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_B53=y
+CONFIG_B53_MDIO_DRIVER=y
+CONFIG_B53_MMAP_DRIVER=y
+CONFIG_B53_SPI_DRIVER=y
+CONFIG_BCM6345_EXT_IRQ=y
+CONFIG_BCM6345_L1_IRQ=y
+# CONFIG_BCM6348_ENET is not set
+CONFIG_BCM6368_ENETSW=y
+CONFIG_BCM7038_WDT=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BMIPS_GENERIC=y
+CONFIG_CEVT_R4K=y
+# CONFIG_CLK_BCM63268_TIMER is not set
+CONFIG_CLK_BCM_63XX_GATE=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CPU_BMIPS=y
+CONFIG_CPU_BMIPS32_3300=y
+CONFIG_CPU_BMIPS4350=y
+CONFIG_CPU_BMIPS4380=y
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_RIXI=y
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_MIPS32=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_NO_EFFICIENT_FFS=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_CPUFREQ=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CRASH_DUMP=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_CSRC_R4K=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_DTC=y
+# CONFIG_DT_BCM93384WVG is not set
+# CONFIG_DT_BCM93384WVG_VIPER is not set
+# CONFIG_DT_BCM96368MVWG is not set
+# CONFIG_DT_BCM97125CBMB is not set
+# CONFIG_DT_BCM97346DBSMB is not set
+# CONFIG_DT_BCM97358SVMB is not set
+# CONFIG_DT_BCM97360SVMB is not set
+# CONFIG_DT_BCM97362SVMB is not set
+# CONFIG_DT_BCM97420C is not set
+# CONFIG_DT_BCM97425SVMB is not set
+# CONFIG_DT_BCM97435SVMB is not set
+# CONFIG_DT_BCM9EJTAGPRB is not set
+# CONFIG_DT_COMTREND_VR3032U is not set
+# CONFIG_DT_NETGEAR_CVG834G is not set
+CONFIG_DT_NONE=y
+# CONFIG_DT_SFR_NEUFBOX4_SERCOMM is not set
+# CONFIG_DT_SFR_NEUFBOX6_SERCOMM is not set
+CONFIG_FIXED_PHY=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+# CONFIG_GPIO_BRCMSTB is not set
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_GPIO_REGMAP=y
+CONFIG_GRO_CELLS=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_BCM2835=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+# CONFIG_LEDS_SERCOMM_MSP430 is not set
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_BUS_MUX=y
+CONFIG_MDIO_BUS_MUX_BCM6368=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+CONFIG_MIPS_CLOCK_VSYSCALL=y
+# CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER is not set
+CONFIG_MIPS_CMDLINE_FROM_DTB=y
+CONFIG_MIPS_EBPF_JIT=y
+CONFIG_MIPS_EXTERNAL_TIMER=y
+CONFIG_MIPS_L1_CACHE_SHIFT=6
+CONFIG_MIPS_L1_CACHE_SHIFT_4=y
+CONFIG_MIPS_L1_CACHE_SHIFT_6=y
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+# CONFIG_MIPS_NO_APPENDED_DTB is not set
+CONFIG_MIPS_NR_CPU_NR_MAP=2
+CONFIG_MIPS_O32_FP64_SUPPORT=y
+CONFIG_MIPS_RAW_APPENDED_DTB=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MODULE_FORCE_LOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+# CONFIG_MTD_BCM63XX_PARTS is not set
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_BE_BYTE_SWAP=y
+# CONFIG_MTD_CFI_GEOMETRY is not set
+# CONFIG_MTD_CFI_NOSWAP is not set
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_NAND_BRCMNAND=y
+CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_NAND_ECC_SW_HAMMING=y
+# CONFIG_MTD_PARSER_IMAGETAG is not set
+CONFIG_MTD_PHYSMAP=y
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPLIT_BCM63XX_FW=y
+CONFIG_MTD_SPLIT_BCM_WFI_FW=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_LIMIT=20
+CONFIG_MTD_UBI_BLOCK=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_TAG_BRCM=y
+CONFIG_NET_DSA_TAG_BRCM_COMMON=y
+CONFIG_NET_DSA_TAG_BRCM_LEGACY=y
+CONFIG_NET_DSA_TAG_BRCM_PREPEND=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NO_EXCEPT_FILL=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+CONFIG_NR_CPUS=2
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_PADATA=y
+CONFIG_PCI=y
+# CONFIG_PCIE_BCM6318 is not set
+# CONFIG_PCIE_BCM6328 is not set
+CONFIG_PCI_BCM6348=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DRIVERS_LEGACY=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PHYSICAL_START=0x80010000
+CONFIG_PHY_BCM63XX_USBH=y
+# CONFIG_PHY_BRCM_SATA is not set
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_BCM6318 is not set
+# CONFIG_PINCTRL_BCM63268 is not set
+# CONFIG_PINCTRL_BCM6328 is not set
+# CONFIG_PINCTRL_BCM6358 is not set
+# CONFIG_PINCTRL_BCM6362 is not set
+CONFIG_PINCTRL_BCM6368=y
+CONFIG_PINCTRL_BCM63XX=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PROC_VMCORE=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RELAY=y
+CONFIG_RESET_BCM6345=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIAL_BCM63XX=y
+CONFIG_SERIAL_BCM63XX_CONSOLE=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SMP=y
+CONFIG_SMP_UP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+# CONFIG_SOC_BCM63XX is not set
+CONFIG_SPI=y
+CONFIG_SPI_BCM63XX=y
+# CONFIG_SPI_BCM63XX_HSSPI is not set
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRCU=y
+CONFIG_SWAP_IO_SPACE=y
+CONFIG_SWPHY=y
+CONFIG_SYNC_R4K=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYS_HAS_CPU_BMIPS=y
+CONFIG_SYS_HAS_CPU_BMIPS32_3300=y
+CONFIG_SYS_HAS_CPU_BMIPS4350=y
+CONFIG_SYS_HAS_CPU_BMIPS4380=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+CONFIG_SYS_SUPPORTS_HOTPLUG_CPU=y
+CONFIG_SYS_SUPPORTS_SMP=y
+CONFIG_TARGET_ISA_REV=0
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UBIFS_FS=y
+CONFIG_USB_EHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_EHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_OHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_OHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_OF=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_WATCHDOG_NOWAYOUT=y
+CONFIG_WEAK_ORDERING=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/bmips/bcm6368/config-6.1 b/target/linux/bmips/bcm6368/config-6.1
new file mode 100644
index 00000000000000..6fd4fe03bbe12b
--- /dev/null
+++ b/target/linux/bmips/bcm6368/config-6.1
@@ -0,0 +1,296 @@
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_FORCE_MAX_ORDER=11
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_B53=y
+CONFIG_B53_MDIO_DRIVER=y
+CONFIG_B53_MMAP_DRIVER=y
+CONFIG_B53_SPI_DRIVER=y
+CONFIG_BCM6345_EXT_IRQ=y
+CONFIG_BCM6345_L1_IRQ=y
+# CONFIG_BCM6348_ENET is not set
+CONFIG_BCM6368_ENETSW=y
+CONFIG_BCM7038_WDT=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BMIPS_GENERIC=y
+CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
+CONFIG_CC_NO_ARRAY_BOUNDS=y
+CONFIG_CEVT_R4K=y
+# CONFIG_CLK_BCM63268_TIMER is not set
+CONFIG_CLK_BCM_63XX_GATE=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONTEXT_TRACKING=y
+CONFIG_CONTEXT_TRACKING_IDLE=y
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CPU_BMIPS=y
+CONFIG_CPU_BMIPS32_3300=y
+CONFIG_CPU_BMIPS4350=y
+CONFIG_CPU_BMIPS4380=y
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_RIXI=y
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_MIPS32=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_NO_EFFICIENT_FFS=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_CPUFREQ=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CRASH_DUMP=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_LIB_SHA1=y
+CONFIG_CRYPTO_LIB_UTILS=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_CSRC_R4K=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_DTC=y
+# CONFIG_DT_BCM93384WVG is not set
+# CONFIG_DT_BCM93384WVG_VIPER is not set
+# CONFIG_DT_BCM96368MVWG is not set
+# CONFIG_DT_BCM97125CBMB is not set
+# CONFIG_DT_BCM97346DBSMB is not set
+# CONFIG_DT_BCM97358SVMB is not set
+# CONFIG_DT_BCM97360SVMB is not set
+# CONFIG_DT_BCM97362SVMB is not set
+# CONFIG_DT_BCM97420C is not set
+# CONFIG_DT_BCM97425SVMB is not set
+# CONFIG_DT_BCM97435SVMB is not set
+# CONFIG_DT_BCM9EJTAGPRB is not set
+# CONFIG_DT_COMTREND_VR3032U is not set
+# CONFIG_DT_NETGEAR_CVG834G is not set
+CONFIG_DT_NONE=y
+# CONFIG_DT_SFR_NEUFBOX4_SERCOMM is not set
+# CONFIG_DT_SFR_NEUFBOX6_SERCOMM is not set
+CONFIG_EXCLUSIVE_SYSTEM_RAM=y
+CONFIG_FIXED_PHY=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CFE=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_FW_LOADER_SYSFS=y
+CONFIG_GCC11_NO_ARRAY_BOUNDS=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+# CONFIG_GPIO_BRCMSTB is not set
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_GPIO_REGMAP=y
+CONFIG_GRO_CELLS=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_BCM2835=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+# CONFIG_LEDS_SERCOMM_MSP430 is not set
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_BUS_MUX=y
+CONFIG_MDIO_BUS_MUX_BCM6368=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+CONFIG_MIPS_CLOCK_VSYSCALL=y
+# CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER is not set
+CONFIG_MIPS_CMDLINE_FROM_DTB=y
+CONFIG_MIPS_EXTERNAL_TIMER=y
+CONFIG_MIPS_L1_CACHE_SHIFT=6
+CONFIG_MIPS_L1_CACHE_SHIFT_4=y
+CONFIG_MIPS_L1_CACHE_SHIFT_6=y
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+# CONFIG_MIPS_NO_APPENDED_DTB is not set
+CONFIG_MIPS_NR_CPU_NR_MAP=2
+CONFIG_MIPS_O32_FP64_SUPPORT=y
+CONFIG_MIPS_RAW_APPENDED_DTB=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MODULE_FORCE_LOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+# CONFIG_MTD_BCM63XX_PARTS is not set
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_BE_BYTE_SWAP=y
+# CONFIG_MTD_CFI_GEOMETRY is not set
+# CONFIG_MTD_CFI_NOSWAP is not set
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_NAND_BRCMNAND=y
+CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_NAND_ECC_SW_HAMMING=y
+# CONFIG_MTD_PARSER_IMAGETAG is not set
+CONFIG_MTD_PHYSMAP=y
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPLIT_BCM63XX_FW=y
+CONFIG_MTD_SPLIT_BCM_WFI_FW=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_LIMIT=20
+CONFIG_MTD_UBI_BLOCK=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_TAG_BRCM=y
+CONFIG_NET_DSA_TAG_BRCM_COMMON=y
+CONFIG_NET_DSA_TAG_BRCM_LEGACY=y
+CONFIG_NET_DSA_TAG_BRCM_PREPEND=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NO_EXCEPT_FILL=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+CONFIG_NR_CPUS=2
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_PADATA=y
+CONFIG_PAGE_POOL=y
+CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
+CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
+CONFIG_PCI=y
+# CONFIG_PCIE_BCM6318 is not set
+# CONFIG_PCIE_BCM6328 is not set
+CONFIG_PCI_BCM6348=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DRIVERS_LEGACY=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PHYSICAL_START=0x80010000
+CONFIG_PHY_BCM63XX_USBH=y
+# CONFIG_PHY_BRCM_SATA is not set
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_BCM6318 is not set
+# CONFIG_PINCTRL_BCM63268 is not set
+# CONFIG_PINCTRL_BCM6328 is not set
+# CONFIG_PINCTRL_BCM6358 is not set
+# CONFIG_PINCTRL_BCM6362 is not set
+CONFIG_PINCTRL_BCM6368=y
+CONFIG_PINCTRL_BCM63XX=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PREEMPT_NONE_BUILD=y
+CONFIG_PROC_VMCORE=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RANDSTRUCT_NONE=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RELAY=y
+CONFIG_RESET_BCM6345=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIAL_BCM63XX=y
+CONFIG_SERIAL_BCM63XX_CONSOLE=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SMP=y
+CONFIG_SMP_UP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+# CONFIG_SOC_BCM63XX is not set
+CONFIG_SPI=y
+CONFIG_SPI_BCM63XX=y
+# CONFIG_SPI_BCM63XX_HSSPI is not set
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRCU=y
+CONFIG_SWAP_IO_SPACE=y
+CONFIG_SWPHY=y
+CONFIG_SYNC_R4K=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYS_HAS_CPU_BMIPS=y
+CONFIG_SYS_HAS_CPU_BMIPS32_3300=y
+CONFIG_SYS_HAS_CPU_BMIPS4350=y
+CONFIG_SYS_HAS_CPU_BMIPS4380=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+CONFIG_SYS_SUPPORTS_HOTPLUG_CPU=y
+CONFIG_SYS_SUPPORTS_SMP=y
+CONFIG_TARGET_ISA_REV=0
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UBIFS_FS=y
+CONFIG_USB_EHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_EHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_OHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_OHCI_BIG_ENDIAN_MMIO=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_OF=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_WATCHDOG_NOWAYOUT=y
+CONFIG_WEAK_ORDERING=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMMON=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/bmips/bcm6368/target.mk b/target/linux/bmips/bcm6368/target.mk
new file mode 100644
index 00000000000000..950bf7224ab9c9
--- /dev/null
+++ b/target/linux/bmips/bcm6368/target.mk
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+SUBTARGET:=bcm6368
+BOARDNAME:=BCM6368 based boards
+FEATURES+=nand
+
+define Target/Description
+  Build firmware images for Broadcom BCM6368 based boards.
+endef
diff --git a/target/linux/bmips/dts/bcm63167-sercomm-h500-s-lowi.dts b/target/linux/bmips/dts/bcm63167-sercomm-h500-s-lowi.dts
new file mode 100644
index 00000000000000..c0ad03fa22865d
--- /dev/null
+++ b/target/linux/bmips/dts/bcm63167-sercomm-h500-s-lowi.dts
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "bcm63167-sercomm-h500-s.dtsi"
+
+/ {
+	model = "Sercomm H500-s lowi";
+	compatible = "sercomm,h500-s-lowi", "brcm,bcm63167", "brcm,bcm63268";
+};
diff --git a/target/linux/bmips/dts/bcm63167-sercomm-h500-s-vfes.dts b/target/linux/bmips/dts/bcm63167-sercomm-h500-s-vfes.dts
new file mode 100644
index 00000000000000..830a5cba148f52
--- /dev/null
+++ b/target/linux/bmips/dts/bcm63167-sercomm-h500-s-vfes.dts
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "bcm63167-sercomm-h500-s.dtsi"
+
+/ {
+	model = "Sercomm H500-s vfes";
+	compatible = "sercomm,h500-s-vfes", "brcm,bcm63167", "brcm,bcm63268";
+};
diff --git a/target/linux/bmips/dts/bcm63167-sercomm-h500-s.dtsi b/target/linux/bmips/dts/bcm63167-sercomm-h500-s.dtsi
new file mode 100644
index 00000000000000..95f330d6c53520
--- /dev/null
+++ b/target/linux/bmips/dts/bcm63167-sercomm-h500-s.dtsi
@@ -0,0 +1,296 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "bcm63268.dtsi"
+
+/ {
+	aliases {
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_green;
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <100>;
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 34 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 35 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+	};
+};
+
+&ehci {
+	status = "okay";
+};
+
+&ethernet {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_cferom_6a0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&leds {
+	status = "okay";
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&pinctrl_leds>;
+
+	led@0 {
+		reg = <0>;
+		label = "red:mobile";
+	};
+
+	led@1 {
+		reg = <1>;
+		label = "green:mobile";
+	};
+
+	led_power_red: led@8 {
+		reg = <8>;
+		label = "red:power";
+		panic-indicator;
+	};
+
+	led@9 {
+		reg = <9>;
+		label = "green:wifi";
+	};
+
+	led@12 {
+		reg = <12>;
+		label = "red:phone";
+	};
+
+	led@13 {
+		reg = <13>;
+		label = "red:wifi";
+	};
+
+	led@14 {
+		reg = <14>;
+		label = "red:internet";
+	};
+
+	led@15 {
+		reg = <15>;
+		label = "green:internet";
+	};
+
+	led@16 {
+		reg = <16>;
+		label = "green:phone";
+	};
+
+	led_power_green: led@17 {
+		reg = <17>;
+		label = "green:power";
+	};
+
+	led@23 {
+		reg = <23>;
+		label = "blue:mobile";
+	};
+};
+
+&mdio_int {
+	phy12: ethernet-phy@c {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <12>;
+	};
+};
+
+&mdio_ext {
+	switch@1e {
+		compatible = "brcm,bcm53134";
+		reg = <30>;
+
+		dsa,member = <1 0>;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@1 {
+				reg = <1>;
+				label = "lan3";
+			};
+
+			port@2 {
+				reg = <2>;
+				label = "lan2";
+			};
+
+			port@3 {
+				reg = <3>;
+				label = "lan1";
+			};
+
+			port@5 {
+				reg = <5>;
+				label = "wifi";
+
+				phy-mode = "rgmii";
+
+				fixed-link {
+					speed = <1000>;
+					full-duplex;
+				};
+			};
+
+			port@8 {
+				reg = <8>;
+
+				phy-mode = "rgmii-txid";
+				ethernet = <&switch0port4>;
+
+				fixed-link {
+					speed = <1000>;
+					full-duplex;
+				};
+			};
+		};
+	};
+};
+
+&nflash {
+	status = "okay";
+
+	nandcs@0 {
+		compatible = "brcm,nandcs";
+		reg = <0>;
+		nand-ecc-step-size = <512>;
+		nand-ecc-strength = <4>;
+		nand-on-flash-bbt;
+		brcm,nand-oob-sector-size = <64>;
+
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			cferom: partition@0 {
+				label = "cferom";
+				reg = <0x0000000 0x0020000>;
+				read-only;
+			};
+
+			partition@20000 {
+				label = "part_map";
+				reg = <0x0020000 0x00a0000>;
+				read-only;
+			};
+
+			partition@c0000 {
+				label = "cferam1";
+				reg = <0x00c0000 0x0140000>;
+				read-only;
+			};
+
+			partition@200000 {
+				label = "cferam2";
+				reg = <0x0200000 0x0140000>;
+				read-only;
+			};
+
+			partition@6920000 {
+				label = "bootflag1";
+				reg = <0x6920000 0x0140000>;
+			};
+
+			partition@6a60000 {
+				label = "bootflag2";
+				reg = <0x6a60000 0x0140000>;
+			};
+
+			partition@520000 {
+				compatible = "sercomm,wfi";
+				label = "wfi";
+				reg = <0x0520000 0x6400000>;
+			};
+
+			partition@6ba0000 {
+				label = "xml_cfg";
+				reg = <0x6ba0000 0x0280000>;
+				read-only;
+			};
+
+			partition@6e20000 {
+				label = "app_data";
+				reg = <0x6e20000 0x0280000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&ohci {
+	status = "okay";
+};
+
+&switch0 {
+	dsa,member = <0 0>;
+
+	ports {
+		port@3 {
+			reg = <3>;
+			label = "wan";
+
+			phy-handle = <&phy12>;
+			phy-mode = "gmii";
+		};
+
+		switch0port4: port@4 {
+			reg = <4>;
+			label = "extsw";
+
+			phy-mode = "rgmii-txid";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
+
+&pinctrl {
+	pinctrl_leds: leds {
+		function = "led";
+		pins = "gpio0",  "gpio1",  "gpio8",  "gpio9",
+		       "gpio12", "gpio13", "gpio14", "gpio15",
+		       "gpio16", "gpio17", "gpio23";
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usbh {
+	status = "okay";
+};
+
+&cferom {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_cferom_6a0: macaddr@6a0 {
+		reg = <0x6a0 0x6>;
+	};
+};
diff --git a/target/linux/bmips/dts/bcm63168-comtrend-vr-3032u.dts b/target/linux/bmips/dts/bcm63168-comtrend-vr-3032u.dts
index 95fda0843c48de..5196f90afa8fa6 100644
--- a/target/linux/bmips/dts/bcm63168-comtrend-vr-3032u.dts
+++ b/target/linux/bmips/dts/bcm63168-comtrend-vr-3032u.dts
@@ -11,15 +11,11 @@
 		led-failsafe = &led_power_green;
 		led-running = &led_power_green;
 		led-upgrade = &led_power_green;
-
-		led-dsl = &led_dsl_green;
-		led-internet = &led_internet_green;
-		led-usb = &led_usb_green;
 	};
 
 	keys {
 		compatible = "gpio-keys-polled";
-		poll-interval = <20>;
+		poll-interval = <100>;
 
 		reset {
 			label = "reset";
@@ -78,13 +74,13 @@
 		label = "red:internet";
 	};
 
-	led_dsl_green: led@3 {
+	led@3 {
 		reg = <3>;
 		active-low;
 		label = "green:dsl";
 	};
 
-	led_usb_green: led@4 {
+	led@4 {
 		reg = <4>;
 		active-low;
 		label = "green:usb";
@@ -96,7 +92,7 @@
 		label = "green:wps";
 	};
 
-	led_internet_green: led@8 {
+	led@8 {
 		reg = <8>;
 		active-low;
 		label = "green:internet";
@@ -162,6 +158,9 @@
 		nand-on-flash-bbt;
 		brcm,nand-oob-sector-size = <64>;
 
+		#address-cells = <1>;
+		#size-cells = <1>;
+
 		partitions {
 			compatible = "fixed-partitions";
 			#address-cells = <1>;
@@ -193,6 +192,7 @@
 			label = "lan2";
 
 			phy-handle = <&phy1>;
+			phy-mode = "mii";
 		};
 
 		port@1 {
@@ -200,6 +200,7 @@
 			label = "lan3";
 
 			phy-handle = <&phy2>;
+			phy-mode = "mii";
 		};
 
 		port@2 {
@@ -207,6 +208,7 @@
 			label = "lan4";
 
 			phy-handle = <&phy3>;
+			phy-mode = "mii";
 		};
 
 		port@3 {
@@ -214,6 +216,7 @@
 			label = "lan1";
 
 			phy-handle = <&phy4>;
+			phy-mode = "mii";
 		};
 	};
 };
diff --git a/target/linux/bmips/dts/bcm63168-sercomm-shg2500.dts b/target/linux/bmips/dts/bcm63168-sercomm-shg2500.dts
new file mode 100644
index 00000000000000..7b0ebf2aefc35d
--- /dev/null
+++ b/target/linux/bmips/dts/bcm63168-sercomm-shg2500.dts
@@ -0,0 +1,321 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "bcm63268.dtsi"
+
+/ {
+	model = "Sercomm SHG2500";
+	compatible = "sercomm,shg2500", "brcm,bcm63168", "brcm,bcm63268";
+
+	aliases {
+		led-boot = &led_power_red;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_red;
+		led-upgrade = &led_power_red;
+	};
+
+	i2c {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio 14 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio 9 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN)>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <100>;
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 34 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 35 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+	};
+
+	bcm4360-sprom {
+		compatible = "brcm,bcma-sprom";
+
+		pci-bus = <1>;
+		pci-dev = <0>;
+
+		nvmem-cells = <&macaddr_cferom_6a0>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <1>;
+
+		brcm,sprom = "brcm/bcm4360-sprom.bin";
+	};
+};
+
+&ehci {
+	status = "okay";
+};
+
+&ethernet {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_cferom_6a0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&hsspi {
+	status = "okay";
+
+	led-controller@1 {
+		compatible = "sercomm,msp430-leds";
+		reg = <1>;
+		spi-max-frequency = <500000>;
+
+		led@1 {
+			reg = <1>;
+			label = "red:modem";
+		};
+
+		led@2 {
+			reg = <2>;
+			label = "green:modem";
+		};
+
+		led@3 {
+			reg = <3>;
+			label = "blue:modem";
+		};
+
+		led@4 {
+			reg = <4>;
+			label = "red:internet";
+		};
+
+		led@5 {
+			reg = <5>;
+			label = "red:phone";
+		};
+
+		led@6 {
+			reg = <6>;
+			label = "green:phone";
+		};
+
+		led@7 {
+			reg = <7>;
+			label = "green:wifi";
+		};
+
+		led_power_red: led@8 {
+			reg = <8>;
+			label = "red:power";
+		};
+
+		led@9 {
+			reg = <9>;
+			label = "green:internet";
+		};
+	};
+};
+
+&mdio_int {
+	phy12: ethernet-phy@c {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <12>;
+	};
+};
+
+&mdio_ext {
+	switch@1e {
+		compatible = "brcm,bcm53125";
+		reg = <30>;
+
+		dsa,member = <1 0>;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@1 {
+				reg = <1>;
+				label = "lan1";
+			};
+
+			port@2 {
+				reg = <2>;
+				label = "lan2";
+			};
+
+			port@3 {
+				reg = <3>;
+				label = "lan3";
+			};
+
+			port@4 {
+				reg = <4>;
+				label = "lan4";
+			};
+
+			port@8 {
+				reg = <8>;
+
+				phy-mode = "rgmii";
+				ethernet = <&switch0port4>;
+
+				fixed-link {
+					speed = <1000>;
+					full-duplex;
+				};
+			};
+		};
+	};
+};
+
+&nflash {
+	status = "okay";
+
+	nandcs@0 {
+		compatible = "brcm,nandcs";
+		reg = <0>;
+		nand-ecc-step-size = <512>;
+		nand-ecc-strength = <15>;
+		nand-on-flash-bbt;
+		brcm,nand-oob-sector-size = <64>;
+
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			cferom: partition@0 {
+				label = "cferom";
+				reg = <0x0000000 0x0020000>;
+				read-only;
+			};
+
+			partition@20000 {
+				label = "part_map";
+				reg = <0x0020000 0x00a0000>;
+				read-only;
+			};
+
+			partition@c0000 {
+				label = "cferam1";
+				reg = <0x00c0000 0x0140000>;
+				read-only;
+			};
+
+			partition@200000 {
+				label = "cferam2";
+				reg = <0x0200000 0x0140000>;
+				read-only;
+			};
+
+			artition@6920000 {
+				label = "bootflag1";
+				reg = <0x6920000 0x0140000>;
+			};
+
+			partition@6a60000 {
+				label = "bootflag2";
+				reg = <0x6a60000 0x0140000>;
+			};
+
+			partition@520000 {
+				compatible = "sercomm,wfi";
+				label = "wfi";
+				reg = <0x0520000 0x6400000>;
+			};
+
+			partition@6ba0000 {
+				label = "xml_cfg";
+				reg = <0x6ba0000 0x0280000>;
+				read-only;
+			};
+
+			partition@6e20000 {
+				label = "app_data";
+				reg = <0x6e20000 0x0280000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&ohci {
+	status = "okay";
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pinctrl {
+	pinctrl_uart1: uart1-pins {
+		pinctrl_uart1_sdin: uart1_sdin {
+			function = "uart1_sdin";
+			pins = "gpio12";
+		};
+
+		pinctrl_uart1_sdout: uart1_sdout {
+			function = "uart1_sdout";
+			pins = "gpio13";
+		};
+	};
+};
+
+&switch0 {
+	dsa,member = <0 0>;
+
+	ports {
+		port@3 {
+			reg = <3>;
+			label = "wan";
+
+			phy-handle = <&phy12>;
+			phy-mode = "gmii";
+		};
+
+		switch0port4: port@4 {
+			reg = <4>;
+			label = "extsw";
+
+			phy-mode = "rgmii";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&uart1 {
+	status = "okay";
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&pinctrl_uart1>;
+};
+
+&usbh {
+	status = "okay";
+};
+
+&cferom {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_cferom_6a0: macaddr@6a0 {
+		reg = <0x6a0 0x6>;
+	};
+};
diff --git a/target/linux/bmips/dts/bcm63169-comtrend-vg-8050.dts b/target/linux/bmips/dts/bcm63169-comtrend-vg-8050.dts
new file mode 100644
index 00000000000000..bf96673af8af8d
--- /dev/null
+++ b/target/linux/bmips/dts/bcm63169-comtrend-vg-8050.dts
@@ -0,0 +1,237 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "bcm63268.dtsi"
+
+/ {
+	model = "Comtrend VG-8050";
+	compatible = "comtrend,vg-8050", "brcm,bcm63169", "brcm,bcm63268";
+
+	aliases {
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_green;
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <100>;
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 33 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 34 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+		};
+	};
+};
+
+&ehci {
+	status = "okay";
+};
+
+&ethernet {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_cferom_6a0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&hsspi {
+	status = "okay";
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&pinctrl_hsspi_cs5>;
+
+	switch@5 {
+		compatible = "brcm,bcm53125";
+		reg = <5>;
+		spi-max-frequency = <781000>;
+		spi-cpha;
+		spi-cpol;
+		dsa,member = <1 0>;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				label = "lan4";
+			};
+
+			port@1 {
+				reg = <1>;
+				label = "lan3";
+			};
+
+			port@2 {
+				reg = <2>;
+				label = "lan2";
+			};
+
+			port@3 {
+				reg = <3>;
+				label = "lan1";
+			};
+
+			port@4 {
+				reg = <4>;
+				label = "wan";
+			};
+
+			port@8 {
+				reg = <8>;
+
+				phy-mode = "rgmii";
+				ethernet = <&switch0port6>;
+
+				fixed-link {
+					speed = <1000>;
+					full-duplex;
+				};
+			};
+		};
+	};
+};
+
+&leds {
+	status = "okay";
+
+	brcm,serial-leds;
+	brcm,serial-dat-low;
+	brcm,serial-shift-inv;
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&pinctrl_serial_led>;
+
+	led@2 {
+		reg = <2>;
+		active-low;
+		label = "red:internet";
+	};
+
+	led_power_red: led@3 {
+		reg = <3>;
+		active-low;
+		label = "red:power";
+		panic-indicator;
+	};
+
+	led_power_green: led@6 {
+		reg = <6>;
+		active-low;
+		label = "green:power";
+	};
+
+	led@7 {
+		reg = <7>;
+		active-low;
+		label = "green:wps";
+	};
+
+	led@8 {
+		reg = <8>;
+		active-low;
+		label = "green:internet";
+	};
+
+	led@10 {
+		reg = <10>;
+		active-low;
+		label = "green:voip";
+	};
+
+	led@12 {
+		reg = <12>;
+		active-low;
+		label = "red:voip";
+	};
+
+	led@14 {
+		reg = <14>;
+		active-low;
+		label = "red:wps";
+	};
+};
+
+&nflash {
+	status = "okay";
+
+	nandcs@0 {
+		compatible = "brcm,nandcs";
+		reg = <0>;
+		nand-ecc-step-size = <512>;
+		nand-ecc-strength = <15>;
+		nand-on-flash-bbt;
+		brcm,nand-oob-sector-size = <64>;
+
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			cferom: partition@0 {
+				label = "cferom";
+				reg = <0x0000000 0x0020000>;
+				read-only;
+			};
+
+			partition@20000 {
+				compatible = "brcm,wfi-split";
+				label = "wfi";
+				reg = <0x0020000 0x7ac0000>;
+			};
+		};
+	};
+};
+
+&ohci {
+	status = "okay";
+};
+
+&switch0 {
+	dsa,member = <0 0>;
+
+	ports {
+		switch0port6: port@6 {
+			reg = <6>;
+			label = "extsw";
+
+			phy-mode = "rgmii";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usbh {
+	status = "okay";
+};
+
+&cferom {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_cferom_6a0: macaddr@6a0 {
+		reg = <0x6a0 0x6>;
+	};
+};
diff --git a/target/linux/bmips/dts/bcm6318-comtrend-ar-5315u.dts b/target/linux/bmips/dts/bcm6318-comtrend-ar-5315u.dts
index a54d63277054da..45ed6e2a3b7123 100644
--- a/target/linux/bmips/dts/bcm6318-comtrend-ar-5315u.dts
+++ b/target/linux/bmips/dts/bcm6318-comtrend-ar-5315u.dts
@@ -11,33 +11,29 @@
 		led-failsafe = &led_power_red;
 		led-running = &led_power_green;
 		led-upgrade = &led_power_green;
-
-		led-dsl = &led_dsl_green;
-		led-internet = &led_internet_green;
-		led-usb = &led_usb_green;
 	};
 
 	keys {
 		compatible = "gpio-keys-polled";
-		poll-interval = <20>;
+		poll-interval = <100>;
 
 		wps {
 			label = "wps";
-			gpios = <&pinctrl 3 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
 			linux,code = <KEY_WPS_BUTTON>;
 			debounce-interval = <60>;
 		};
 
 		reset {
 			label = "reset";
-			gpios = <&pinctrl 33 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio 33 GPIO_ACTIVE_LOW>;
 			linux,code = <KEY_RESTART>;
 			debounce-interval = <60>;
 		};
 	};
 
 	bcm43217-sprom {
-		compatible = "brcm,bcm43217-sprom";
+		compatible = "brcm,bcma-sprom";
 
 		pci-bus = <1>;
 		pci-dev = <0>;
@@ -46,6 +42,7 @@
 		nvmem-cell-names = "mac-address";
 		mac-address-increment = <1>;
 
+		brcm,sprom = "brcm/bcm43217-sprom.bin";
 		brcm,sprom-fixups = <6 0x1c00>,
 				    <65 0x1255>,
 				    <97 0xfe55>,
@@ -129,41 +126,41 @@
 		label = "green:power";
 	};
 
-	led_usb_green: led@2 {
+	led@2 {
 		reg = <2>;
 		active-low;
 		label = "green:usb";
 	};
 
 	led@4 {
+		/* EPHY0 Act */
 		reg = <4>;
 		brcm,hardware-controlled;
 		brcm,link-signal-sources = <4>;
-		/* EPHY0 Act */
 	};
 
 	led@5 {
+		/* EPHY1 Act */
 		reg = <5>;
 		brcm,hardware-controlled;
 		brcm,link-signal-sources = <5>;
-		/* EPHY1 Act */
 	};
 
 	led@6 {
+		/* EPHY2 Act */
 		reg = <6>;
 		brcm,hardware-controlled;
 		brcm,link-signal-sources = <6>;
-		/* EPHY2 Act */
 	};
 
 	led@7 {
+		/* EPHY3 Act */
 		reg = <7>;
 		brcm,hardware-controlled;
 		brcm,link-signal-sources = <7>;
-		/* EPHY3 Act */
 	};
 
-	led_internet_green: led@8 {
+	led@8 {
 		reg = <8>;
 		active-low;
 		label = "green:internet";
@@ -175,7 +172,7 @@
 		label = "red:internet";
 	};
 
-	led_dsl_green: led@10 {
+	led@10 {
 		reg = <10>;
 		active-low;
 		label = "green:dsl";
@@ -185,6 +182,7 @@
 		reg = <11>;
 		active-low;
 		label = "red:power";
+		panic-indicator;
 	};
 };
 
@@ -213,6 +211,7 @@
 			label = "lan4";
 
 			phy-handle = <&phy1>;
+			phy-mode = "mii";
 		};
 
 		port@1 {
@@ -220,6 +219,7 @@
 			label = "lan3";
 
 			phy-handle = <&phy2>;
+			phy-mode = "mii";
 		};
 
 		port@2 {
@@ -227,6 +227,7 @@
 			label = "lan2";
 
 			phy-handle = <&phy3>;
+			phy-mode = "mii";
 		};
 
 		port@3 {
@@ -234,6 +235,7 @@
 			label = "lan1";
 
 			phy-handle = <&phy4>;
+			phy-mode = "mii";
 		};
 	};
 };
diff --git a/target/linux/bmips/dts/bcm6318.dtsi b/target/linux/bmips/dts/bcm6318.dtsi
index 9f613ad47ac9f2..28c656d090e11c 100644
--- a/target/linux/bmips/dts/bcm6318.dtsi
+++ b/target/linux/bmips/dts/bcm6318.dtsi
@@ -6,6 +6,7 @@
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/interrupt-controller/bcm6318-interrupt-controller.h>
+#include <dt-bindings/interrupt-controller/irq.h>
 #include <dt-bindings/reset/bcm6318-reset.h>
 #include <dt-bindings/soc/bcm6318-pm.h>
 
@@ -103,6 +104,7 @@
 			interrupt-controller;
 			#interrupt-cells = <2>;
 
+			interrupt-parent = <&periph_intc>;
 			interrupts = <BCM6318_IRQ_EXT0>,
 				     <BCM6318_IRQ_EXT1>,
 				     <BCM6318_IRQ_EXT2>,
@@ -143,6 +145,8 @@
 		};
 
 		gpio_cntl: syscon@10000080 {
+			#address-cells = <1>;
+			#size-cells = <1>;
 			compatible = "brcm,bcm6318-gpio-sysctl",
 				     "syscon", "simple-mfd";
 			reg = <0x10000080 0x80>;
@@ -390,7 +394,7 @@
 		switch0: switch@10080000 {
 			#address-cells = <1>;
 			#size-cells = <0>;
-			compatible = "brcm,bcm6328-switch";
+			compatible = "brcm,bcm6318-switch";
 			reg = <0x10080000 0x8000>;
 			big-endian;
 
@@ -400,7 +404,6 @@
 
 				port@8 {
 					reg = <8>;
-					label = "cpu";
 
 					phy-mode = "internal";
 					ethernet = <&ethernet>;
diff --git a/target/linux/bmips/dts/bcm63268.dtsi b/target/linux/bmips/dts/bcm63268.dtsi
index 2ab14e5a335a47..f9a31d36ef7219 100644
--- a/target/linux/bmips/dts/bcm63268.dtsi
+++ b/target/linux/bmips/dts/bcm63268.dtsi
@@ -6,6 +6,7 @@
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/interrupt-controller/bcm63268-interrupt-controller.h>
+#include <dt-bindings/interrupt-controller/irq.h>
 #include <dt-bindings/reset/bcm63268-reset.h>
 #include <dt-bindings/soc/bcm63268-pm.h>
 
@@ -118,6 +119,7 @@
 			interrupt-controller;
 			#interrupt-cells = <2>;
 
+			interrupt-parent = <&periph_intc>;
 			interrupts = <BCM63268_IRQ_EXT0>,
 				     <BCM63268_IRQ_EXT1>,
 				     <BCM63268_IRQ_EXT2>,
@@ -154,6 +156,8 @@
 		};
 
 		gpio_cntl: syscon@100000c0 {
+			#address-cells = <1>;
+			#size-cells = <1>;
 			compatible = "brcm,bcm63268-gpio-sysctl",
 				     "syscon", "simple-mfd";
 			reg = <0x100000c0 0x80>;
@@ -440,6 +444,18 @@
 			status = "disabled";
 		};
 
+		random: rng@10002880 {
+			compatible = "brcm,bcm6368-rng";
+			reg = <0x10002880 0x14>;
+
+			clocks = <&periph_clk BCM63268_CLK_IPSEC>;
+			clock-names = "ipsec";
+
+			resets = <&periph_rst BCM63268_RST_IPSEC>;
+
+			power-domains = <&periph_pwr BCM63268_POWER_DOMAIN_IPSEC>;
+		};
+
 		ethernet: ethernet@1000d800 {
 			compatible = "brcm,bcm63268-enetsw";
 			reg = <0x1000d800 0x80>,
@@ -511,7 +527,7 @@
 		switch0: switch@10700000 {
 			#address-cells = <1>;
 			#size-cells = <0>;
-			compatible = "brcm,bcm6328-switch";
+			compatible = "brcm,bcm63268-switch";
 			reg = <0x10700000 0x8000>;
 			big-endian;
 
@@ -521,7 +537,6 @@
 
 				port@8 {
 					reg = <8>;
-					label = "cpu";
 
 					phy-mode = "internal";
 					ethernet = <&ethernet>;
diff --git a/target/linux/bmips/dts/bcm6328-comtrend-ar-5381u.dts b/target/linux/bmips/dts/bcm6328-comtrend-ar-5381u.dts
new file mode 100644
index 00000000000000..7499e7090ff49e
--- /dev/null
+++ b/target/linux/bmips/dts/bcm6328-comtrend-ar-5381u.dts
@@ -0,0 +1,190 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "bcm6328.dtsi"
+
+/ {
+	model = "Comtrend AR-5381u";
+	compatible = "comtrend,ar-5381u", "brcm,bcm6328";
+
+	aliases {
+		led-boot = &led_power_green;
+		led-failsafe = &led_alarm_red;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_green;
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <100>;
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+	};
+
+	bcm43225-sprom {
+		compatible = "brcm,bcma-sprom";
+
+		pci-bus = <1>;
+		pci-dev = <0>;
+
+		nvmem-cells = <&macaddr_cfe_6a0>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <1>;
+
+		brcm,sprom = "brcm/bcm43225-sprom.bin";
+		brcm,sprom-fixups = <97 0xfee5>,
+				    <98 0x157c>,
+				    <99 0xfae7>,
+				    <113 0xfefa>,
+				    <114 0x15d6>,
+				    <115 0xfaf8>;
+	};
+};
+
+&ehci {
+	status = "okay";
+};
+
+&ethernet {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_cfe_6a0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&hsspi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		spi-max-frequency = <16666667>;
+		spi-tx-bus-width = <2>;
+		spi-rx-bus-width = <2>;
+		reg = <0>;
+
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			cfe: partition@0 {
+				reg = <0x000000 0x010000>;
+				label = "cfe";
+				read-only;
+			};
+
+			partition@10000 {
+				compatible = "brcm,bcm963xx-imagetag";
+				reg = <0x010000 0xfe0000>;
+				label = "firmware";
+			};
+
+			partition@ff0000 {
+				reg = <0xff0000 0x010000>;
+				label = "nvram";
+			};
+		};
+	};
+};
+
+&leds {
+	status = "okay";
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&pinctrl_leds>;
+
+	led_alarm_red: led@2 {
+		reg = <2>;
+		active-low;
+		label = "red:alarm";
+		panic-indicator;
+	};
+
+	led@3 {
+		reg = <3>;
+		active-low;
+		label = "green:internet";
+	};
+
+	led_power_green: led@4 {
+		reg = <4>;
+		active-low;
+		label = "green:power";
+	};
+};
+
+&ohci {
+	status = "okay";
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pinctrl {
+	pinctrl_leds: leds {
+		function = "led";
+		pins = "gpio2", "gpio3", "gpio4";
+	};
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			reg = <0>;
+			label = "lan1";
+
+			phy-handle = <&phy1>;
+			phy-mode = "mii";
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan2";
+
+			phy-handle = <&phy2>;
+			phy-mode = "mii";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan3";
+
+			phy-handle = <&phy3>;
+			phy-mode = "mii";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan4";
+
+			phy-handle = <&phy4>;
+			phy-mode = "mii";
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usbh {
+	status = "okay";
+};
+
+&cfe {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_cfe_6a0: macaddr@6a0 {
+		reg = <0x6a0 0x6>;
+	};
+};
diff --git a/target/linux/bmips/dts/bcm6328-comtrend-ar-5387un.dts b/target/linux/bmips/dts/bcm6328-comtrend-ar-5387un.dts
index 47db0809e19ebb..a0d1c117f74755 100644
--- a/target/linux/bmips/dts/bcm6328-comtrend-ar-5387un.dts
+++ b/target/linux/bmips/dts/bcm6328-comtrend-ar-5387un.dts
@@ -11,14 +11,11 @@
 		led-failsafe = &led_power_red;
 		led-running = &led_power_green;
 		led-upgrade = &led_power_green;
-
-		led-dsl = &led_dsl_green;
-		led-internet = &led_internet_green;
 	};
 
 	keys {
 		compatible = "gpio-keys-polled";
-		poll-interval = <20>;
+		poll-interval = <100>;
 
 		reset {
 			label = "reset";
@@ -29,7 +26,7 @@
 	};
 
 	bcm43225-sprom {
-		compatible = "brcm,bcm43225-sprom";
+		compatible = "brcm,bcma-sprom";
 
 		pci-bus = <1>;
 		pci-dev = <0>;
@@ -38,6 +35,7 @@
 		nvmem-cell-names = "mac-address";
 		mac-address-increment = <1>;
 
+		brcm,sprom = "brcm/bcm43225-sprom.bin";
 		brcm,sprom-fixups = <2 0x05bb>,
 				    <65 0x1204>,
 				    <78 0x0303>,
@@ -128,9 +126,10 @@
 	led_power_red: led@4 {
 		reg = <4>;
 		label = "red:power";
+		panic-indicator;
 	};
 
-	led_internet_green: led@7 {
+	led@7 {
 		reg = <7>;
 		label = "green:internet";
 	};
@@ -140,7 +139,7 @@
 		label = "green:power";
 	};
 
-	led_dsl_green: led@11 {
+	led@11 {
 		reg = <11>;
 		active-low;
 		label = "green:dsl";
@@ -170,6 +169,7 @@
 			label = "lan1";
 
 			phy-handle = <&phy1>;
+			phy-mode = "mii";
 		};
 
 		port@1 {
@@ -177,6 +177,7 @@
 			label = "lan2";
 
 			phy-handle = <&phy2>;
+			phy-mode = "mii";
 		};
 
 		port@2 {
@@ -184,6 +185,7 @@
 			label = "lan3";
 
 			phy-handle = <&phy3>;
+			phy-mode = "mii";
 		};
 
 		port@3 {
@@ -191,6 +193,7 @@
 			label = "lan4";
 
 			phy-handle = <&phy4>;
+			phy-mode = "mii";
 		};
 	};
 };
diff --git a/target/linux/bmips/dts/bcm6328-nucom-r5010unv2.dts b/target/linux/bmips/dts/bcm6328-nucom-r5010unv2.dts
new file mode 100644
index 00000000000000..826b2a61e25c5e
--- /dev/null
+++ b/target/linux/bmips/dts/bcm6328-nucom-r5010unv2.dts
@@ -0,0 +1,216 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "bcm6328.dtsi"
+
+/ {
+	model = "NuCom R5010UNv2";
+	compatible = "nucom,r5010unv2", "brcm,bcm6328";
+
+	aliases {
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_green;
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <100>;
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 24 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+		};
+	};
+
+	bcm43217-sprom {
+		compatible = "brcm,bcma-sprom";
+
+		pci-bus = <1>;
+		pci-dev = <0>;
+
+		nvmem-cells = <&macaddr_cfe_6a0>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <1>;
+
+		brcm,sprom = "brcm/bcm43217-sprom.bin";
+	};
+};
+
+&ehci {
+	status = "okay";
+};
+
+&ethernet {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_cfe_6a0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&hsspi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		spi-max-frequency = <16666667>;
+		spi-tx-bus-width = <2>;
+		spi-rx-bus-width = <2>;
+		reg = <0>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			cfe: partition@0 {
+				label = "cfe";
+				reg = <0x000000 0x010000>;
+				read-only;
+			};
+
+			partition@10000 {
+				compatible = "brcm,bcm963xx-imagetag";
+				label = "firmware";
+				reg = <0x010000 0xfe0000>;
+			};
+
+			partition@ff0000 {
+				label = "nvram";
+				reg = <0xff0000 0x010000>;
+			};
+		};
+	};
+};
+
+&leds {
+	status = "okay";
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&pinctrl_ephy0_act_led &pinctrl_ephy1_act_led
+		     &pinctrl_ephy2_act_led &pinctrl_ephy3_act_led
+		     &pinctrl_leds>;
+
+	led@1 {
+		reg = <1>;
+		active-low;
+		label = "green:internet";
+	};
+
+	led@2 {
+		reg = <2>;
+		active-low;
+		label = "red:internet";
+	};
+
+	led@3 {
+		reg = <3>;
+		active-low;
+		label = "green:dsl";
+	};
+
+	led_power_green: led@4 {
+		reg = <4>;
+		active-low;
+		label = "green:power";
+	};
+
+	led_power_red: led@5 {
+		reg = <5>;
+		active-low;
+		label = "red:power";
+		panic-indicator;
+	};
+
+	led@10 {
+		reg = <10>;
+		active-low;
+		label = "green:wps";
+	};
+
+	led@11 {
+		reg = <11>;
+		active-low;
+		label = "green:usb";
+	};
+};
+
+&ohci {
+	status = "okay";
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pinctrl {
+	pinctrl_leds: leds {
+		function = "led";
+		pins = "gpio1", "gpio2", "gpio3",
+		       "gpio4", "gpio5", "gpio10",
+		       "gpio11";
+	};
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			reg = <0>;
+			label = "lan1";
+
+			phy-handle = <&phy1>;
+			phy-mode = "mii";
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan2";
+
+			phy-handle = <&phy2>;
+			phy-mode = "mii";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan3";
+
+			phy-handle = <&phy3>;
+			phy-mode = "mii";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan4";
+
+			phy-handle = <&phy4>;
+			phy-mode = "mii";
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usbh {
+	status = "okay";
+};
+
+&cfe {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_cfe_6a0: macaddr@6a0 {
+		reg = <0x6a0 0x6>;
+	};
+};
diff --git a/target/linux/bmips/dts/bcm6328-sercomm-ad1018.dts b/target/linux/bmips/dts/bcm6328-sercomm-ad1018.dts
new file mode 100644
index 00000000000000..5d182668188700
--- /dev/null
+++ b/target/linux/bmips/dts/bcm6328-sercomm-ad1018.dts
@@ -0,0 +1,312 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "bcm6328.dtsi"
+
+/ {
+	model = "Sercomm AD1018";
+	compatible = "sercomm,ad1018", "brcm,bcm6328";
+
+	aliases {
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_green;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_green;
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <100>;
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 24 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+		};
+
+		wlan {
+			label = "wlan";
+			gpios = <&gpio 25 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WLAN>;
+			debounce-interval = <60>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 31 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+	};
+
+	bcm432217-sprom {
+		compatible = "brcm,bcma-sprom";
+
+		pci-bus = <1>;
+		pci-dev = <0>;
+
+		nvmem-cells = <&macaddr_cferom_6a0>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <1>;
+
+		brcm,sprom = "brcm/bcm43217-sprom.bin";
+		brcm,sprom-fixups = <6 0x1c00>,
+				    <65 0x1256>,
+				    <96 0x2046>,
+				    <97 0xfe69>,
+				    <98 0x1726>,
+				    <99 0xfa5c>,
+				    <112 0x2046>,
+				    <113 0xfea8>,
+				    <114 0x1978>,
+				    <115 0xfa26>,
+				    <161 0x2222>,
+				    <169 0x2222>,
+				    <171 0x2222>,
+				    <173 0x2222>,
+				    <174 0x4444>,
+				    <175 0x2222>,
+				    <176 0x4444>;
+	};
+};
+
+&ehci {
+	status = "okay";
+};
+
+&ethernet {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_cferom_6a0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&leds {
+	status = "okay";
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&pinctrl_leds &pinctrl_serial_led
+		     &pinctrl_ephy0_spd_led &pinctrl_ephy1_act_led
+		     &pinctrl_ephy2_act_led &pinctrl_ephy3_act_led>;
+
+	brcm,serial-leds;
+	brcm,serial-shift-inv;
+	brcm,serial-dat-low;
+
+	led@0 {
+		reg = <0>;
+		active-low;
+		label = "red:internet";
+	};
+
+	led@1 {
+		reg = <1>;
+		active-low;
+		label = "green:internet";
+	};
+
+	led_power_green: led@8 {
+		reg = <8>;
+		active-low;
+		label = "green:power";
+		default-state = "on";
+	};
+
+	led@10 {
+		reg = <10>;
+		active-low;
+		label = "green:adsl";
+	};
+
+	led@11 {
+		reg = <11>;
+		active-low;
+		label = "red:adsl";
+	};
+
+	led@12 {
+		reg = <12>;
+		active-low;
+		label = "green:phone";
+	};
+
+	led@13 {
+		reg = <13>;
+		active-low;
+		label = "green:wps";
+	};
+
+	led@14 {
+		reg = <14>;
+		active-low;
+		label = "green:wifi";
+	};
+
+	led@15 {
+		reg = <15>;
+		active-low;
+		label = "green:usb";
+	};
+
+	led@17 {
+		/* EPHY0 Spd */
+		reg = <17>;
+		brcm,hardware-controlled;
+	};
+};
+
+&ohci {
+	status = "okay";
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pinctrl {
+	pinctrl_leds: leds {
+		function = "led";
+		pins = "gpio0", "gpio1";
+	};
+};
+
+&nflash {
+	status = "okay";
+
+	nandcs@0 {
+		compatible = "brcm,nandcs";
+		reg = <0>;
+		nand-ecc-step-size = <512>;
+		nand-ecc-strength = <15>;
+		nand-on-flash-bbt;
+
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			cferom: partition@0 {
+				label = "cferom";
+				reg = <0x0000000 0x0020000>;
+				read-only;
+			};
+
+			partition@20000 {
+				label = "mmap";
+				reg = <0x0020000 0x00a0000>;
+				read-only;
+			};
+
+			partition@c0000 {
+				label = "cferam1";
+				reg = <0x00c0000 0x0140000>;
+				read-only;
+			};
+
+			partition@200000 {
+				label = "cferam2";
+				reg = <0x0200000 0x0140000>;
+				read-only;
+			};
+
+			partition@340000 {
+				label = "serial";
+				reg = <0x0340000 0x00a0000>;
+				read-only;
+			};
+
+			partition@3e0000 {
+				label = "protect";
+				reg = <0x03e0000 0x0140000>;
+				read-only;
+			};
+
+			partition@6920000 {
+				label = "bootflag1";
+				reg = <0x6920000 0x0140000>;
+				read-only;
+			};
+
+			partition@6a60000 {
+				label = "bootflag2";
+				reg = <0x6a60000 0x0140000>;
+				read-only;
+			};
+
+			partition@520000 {
+				compatible = "sercomm,wfi";
+				label = "wfi";
+				reg = <0x0520000 0x6400000>;
+			};
+
+			partition@6ba0000 {
+				label = "xml_cfg";
+				reg = <0x6ba0000 0x0280000>;
+				read-only;
+			};
+
+			partition@6e20000 {
+				label = "app_dat";
+				reg = <0x6e20000 0x0280000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			reg = <0>;
+			label = "fibre";
+
+			phy-handle = <&phy1>;
+			phy-mode = "mii";
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan3";
+
+			phy-handle = <&phy2>;
+			phy-mode = "mii";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan2";
+
+			phy-handle = <&phy3>;
+			phy-mode = "mii";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan1";
+
+			phy-handle = <&phy4>;
+			phy-mode = "mii";
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usbh {
+	status = "okay";
+};
+
+&cferom {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_cferom_6a0: macaddr@6a0 {
+		reg = <0x6a0 0x6>;
+	};
+};
diff --git a/target/linux/bmips/dts/bcm6328.dtsi b/target/linux/bmips/dts/bcm6328.dtsi
index c8e9138ccbd875..f45f94f5b86222 100644
--- a/target/linux/bmips/dts/bcm6328.dtsi
+++ b/target/linux/bmips/dts/bcm6328.dtsi
@@ -6,6 +6,7 @@
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/interrupt-controller/bcm6328-interrupt-controller.h>
+#include <dt-bindings/interrupt-controller/irq.h>
 #include <dt-bindings/reset/bcm6328-reset.h>
 #include <dt-bindings/soc/bcm6328-pm.h>
 
@@ -105,6 +106,7 @@
 			interrupt-controller;
 			#interrupt-cells = <2>;
 
+			interrupt-parent = <&periph_intc>;
 			interrupts = <BCM6328_IRQ_EXTO>,
 				     <BCM6328_IRQ_EXT1>,
 				     <BCM6328_IRQ_EXT2>,
@@ -146,6 +148,8 @@
 		};
 
 		gpio_cntl: syscon@10000080 {
+			#address-cells = <1>;
+			#size-cells = <1>;
 			compatible = "brcm,bcm6328-gpio-sysctl",
 				     "syscon", "simple-mfd";
 			reg = <0x10000080 0x80>;
@@ -418,7 +422,6 @@
 
 				port@8 {
 					reg = <8>;
-					label = "cpu";
 
 					phy-mode = "internal";
 					ethernet = <&ethernet>;
diff --git a/target/linux/bmips/dts/bcm6358-huawei-hg556a-b.dts b/target/linux/bmips/dts/bcm6358-huawei-hg556a-b.dts
index 6c8b093edfa95a..d5f162846d24b5 100644
--- a/target/linux/bmips/dts/bcm6358-huawei-hg556a-b.dts
+++ b/target/linux/bmips/dts/bcm6358-huawei-hg556a-b.dts
@@ -3,22 +3,19 @@
 #include "bcm6358.dtsi"
 
 / {
-	compatible = "huawei,hg556a-b", "brcm,bcm6358";
 	model = "Huawei EchoLife HG556a (version B)";
+	compatible = "huawei,hg556a-b", "brcm,bcm6358";
 
 	aliases {
 		led-boot = &led_power_red;
 		led-failsafe = &led_power_red;
 		led-running = &led_power_red;
 		led-upgrade = &led_power_red;
-
-		led-dsl = &led_dsl_red;
-		led-usb = &led_hspa_red;
 	};
 
 	keys {
 		compatible = "gpio-keys-polled";
-		poll-interval = <20>;
+		poll-interval = <100>;
 
 		help {
 			label = "help";
@@ -57,12 +54,12 @@
 			gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
 		};
 
-		led_hspa_red: led@1 {
+		led@1 {
 			label = "red:hspa";
 			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
 		};
 
-		led_dsl_red: led@2 {
+		led@2 {
 			label = "red:dsl";
 			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
 		};
@@ -119,24 +116,36 @@
 		};
 	};
 
-	ath9k-fixup {
-		compatible = "brcm,ath9k-fixup";
-		reg = <0x30000000 0x8000000>;
+	ath9k-leds {
+		compatible = "gpio-leds";
 
-		pci-dev = <1>;
+		wlan {
+			label = "red:wlan";
+			gpios = <&ath9k 2 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy0tpt";
+		};
+	};
+};
 
-		nvmem-cells = <&macaddr_cfe_6a0>;
-		nvmem-cell-names = "mac-address";
-		mac-address-increment = <1>;
+&ehci {
+	status = "okay";
+};
+
+&ethernet1 {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_cfe_6a0>;
+	nvmem-cell-names = "mac-address";
 
-		ath,eeprom = <&cal_data 0x1e000>;
-		ath,endian-check;
-		ath,led-pin = <2>;
-		ath,led-active-high;
+	phy-mode = "mii";
+
+	fixed-link {
+		speed = <100>;
+		full-duplex;
 	};
 };
 
-&ehci {
+&iudma {
 	status = "okay";
 };
 
@@ -146,6 +155,20 @@
 
 &pci {
 	status = "okay";
+
+	ath9k: wifi@1,0 {
+		compatible = "pci168c,0029";
+		reg = <0x0800 0 0 0 0>;
+
+		qca,no-eeprom;
+
+		nvmem-cells = <&macaddr_cfe_6a0>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <1>;
+
+		#gpio-cells = <2>;
+		gpio-controller;
+	};
 };
 
 &pflash {
@@ -189,6 +212,16 @@
 	status = "okay";
 };
 
+&cal_data {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	cal_data_1e000: cal@1e000 {
+		reg = <0x1e000 0xeb8>;
+	};
+};
+
 &cfe {
 	compatible = "nvmem-cells";
 	#address-cells = <1>;
diff --git a/target/linux/bmips/dts/bcm6358.dtsi b/target/linux/bmips/dts/bcm6358.dtsi
index 34334df9ba1f1a..b56ec698ba6574 100644
--- a/target/linux/bmips/dts/bcm6358.dtsi
+++ b/target/linux/bmips/dts/bcm6358.dtsi
@@ -6,6 +6,7 @@
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/interrupt-controller/bcm6358-interrupt-controller.h>
+#include <dt-bindings/interrupt-controller/irq.h>
 #include <dt-bindings/reset/bcm6358-reset.h>
 
 / {
@@ -124,6 +125,7 @@
 			interrupt-controller;
 			#interrupt-cells = <2>;
 
+			interrupt-parent = <&periph_intc>;
 			interrupts = <BCM6358_IRQ_EXT0>,
 				     <BCM6358_IRQ_EXT1>,
 				     <BCM6358_IRQ_EXT2>,
@@ -138,6 +140,7 @@
 			interrupt-controller;
 			#interrupt-cells = <2>;
 
+			interrupt-parent = <&periph_intc>;
 			interrupts = <BCM6358_IRQ_EXT4>,
 				     <BCM6358_IRQ_EXT5>;
 		};
@@ -158,6 +161,8 @@
 		};
 
 		gpio_cntl: syscon@fffe0080 {
+			#address-cells = <1>;
+			#size-cells = <1>;
 			compatible = "brcm,bcm6358-gpio-sysctl",
 				     "syscon", "simple-mfd";
 			reg = <0xfffe0080 0x50>;
@@ -279,16 +284,14 @@
 
 		pci: pci@fffe1000 {
 			compatible = "brcm,bcm6348-pci";
-			reg = <0xfffe1000 0x200>,
-			      <0x08000000 0x10000>;
-			reg-names = "pci",
-				    "pci-io";
+			reg = <0xfffe1000 0x200>;
 			#address-cells = <3>;
 			#size-cells = <2>;
 
 			device_type = "pci";
 			bus-range = <0x00 0x01>;
-			ranges = <0x2000000 0 0x30000000 0x30000000 0 0x8000000>;
+			ranges = <0x2000000 0 0x30000000 0x30000000 0 0x8000000>,
+				 <0x1000000 0 0x08000000 0x08000000 0 0x0010000>;
 			linux,pci-probe-only = <1>;
 
 			interrupt-parent = <&periph_intc>;
@@ -342,5 +345,84 @@
 
 			status = "disabled";
 		};
+
+		ethernet0: ethernet@fffe4000 {
+			compatible = "brcm,bcm6358-emac";
+			reg = <0xfffe4000 0x2dc>;
+
+			clocks = <&periph_clk BCM6358_CLK_ENET0>;
+
+			interrupt-parent = <&periph_intc>;
+			interrupts = <BCM6358_IRQ_EMAC0>,
+					<BCM6358_IRQ_EMAC0_RX_DMA>,
+					<BCM6358_IRQ_EMAC0_TX_DMA>;
+			interrupt-names = "emac",
+					  "rx",
+					  "tx";
+
+			brcm,iudma = <&iudma>;
+
+			dma-rx = <0>;
+			dma-tx = <1>;
+
+			status = "disabled";
+
+			mdio0: mdio {
+				#address-cells = <1>;
+				#size-cells = <0>;
+			};
+		};
+
+		ethernet1: ethernet@fffe4800 {
+			compatible = "brcm,bcm6358-emac";
+			reg = <0xfffe4800 0x2dc>;
+
+			clocks = <&periph_clk BCM6358_CLK_ENET1>;
+
+			interrupt-parent = <&periph_intc>;
+			interrupts = <BCM6358_IRQ_EMAC1>,
+				     <BCM6358_IRQ_EMAC1_RX_DMA>,
+				     <BCM6358_IRQ_EMAC1_TX_DMA>;
+			interrupt-names = "emac",
+					  "rx",
+					  "tx";
+
+			brcm,iudma = <&iudma>;
+			brcm,external-mii;
+
+			dma-rx = <2>;
+			dma-tx = <3>;
+
+			status = "disabled";
+
+			mdio1: mdio {
+				#address-cells = <1>;
+				#size-cells = <0>;
+			};
+		};
+
+		iudma: dma@fffe5000 {
+			#address-cells = <1>;
+			#size-cells = <1>;
+			compatible = "brcm,bcm6358-iudma";
+			reg = <0xfffe5000 0x24>,
+			      <0xfffe5100 0x80>,
+			      <0xfffe5200 0x80>;
+			reg-names = "dma",
+				    "dma-channels",
+				    "dma-sram";
+
+			dma-channels = <8>;
+
+			clocks = <&periph_clk BCM6358_CLK_EMUSB>,
+				 <&periph_clk BCM6358_CLK_USBSU>,
+				 <&periph_clk BCM6358_CLK_EPHY>,
+				 <&periph_clk BCM6358_CLK_ENET>;
+
+			resets = <&periph_rst BCM6358_RST_ENET>,
+				 <&periph_rst BCM6358_RST_EPHY>;
+
+			status = "disabled";
+		};
 	};
 };
diff --git a/target/linux/bmips/dts/bcm6362-huawei-hg253s-v2.dts b/target/linux/bmips/dts/bcm6362-huawei-hg253s-v2.dts
new file mode 100644
index 00000000000000..f562bcd9b2b24a
--- /dev/null
+++ b/target/linux/bmips/dts/bcm6362-huawei-hg253s-v2.dts
@@ -0,0 +1,236 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "bcm6362.dtsi"
+
+/ {
+	model = "Huawei HG253s v2";
+	compatible = "huawei,hg253s-v2", "brcm,bcm6362";
+
+	aliases {
+		led-boot = &led_phone_green;
+		led-failsafe = &led_phone_green;
+		led-upgrade = &led_phone_green;
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <100>;
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 24 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+
+		wlan {
+			label = "wlan";
+			gpios = <&gpio 25 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WLAN>;
+			debounce-interval = <60>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 26 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_phone_green: led@28 {
+			label = "green:phone";
+			gpios = <&gpio 28 GPIO_ACTIVE_LOW>;
+		};
+
+		led@30 {
+			label = "green:usb";
+			gpios = <&gpio 30 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&ehci {
+	status = "okay";
+};
+
+&ethernet {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_cferom_6a0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&leds {
+	status = "okay";
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&pinctrl_leds>;
+
+	led@3 {
+		reg = <3>;
+		active-low;
+		label = "green:internet";
+	};
+
+	led@5 {
+		reg = <5>;
+		active-low;
+		label = "green:wifi";
+	};
+};
+
+&lsspi {
+	status = "okay";
+
+	switch@0 {
+		compatible = "brcm,bcm53125";
+		reg = <0>;
+		spi-max-frequency = <781000>;
+
+		dsa,member = <1 0>;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@1 {
+				reg = <1>;
+				label = "lan4";
+			};
+
+			port@2 {
+				reg = <2>;
+				label = "lan3";
+			};
+
+			port@3 {
+				reg = <3>;
+				label = "lan2";
+			};
+
+			port@4 {
+				reg = <4>;
+				label = "lan1";
+			};
+
+			port@8 {
+				reg = <8>;
+
+				phy-mode = "rgmii";
+				ethernet = <&switch0port4>;
+
+				fixed-link {
+					speed = <1000>;
+					full-duplex;
+					asym-pause;
+					pause;
+				};
+			};
+		};
+	};
+};
+
+&mdio_ext {
+	phy24: ethernet-phy@18 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <24>;
+	};
+};
+
+&nflash {
+	status = "okay";
+
+	nandcs@0 {
+		compatible = "brcm,nandcs";
+		reg = <0>;
+		nand-ecc-step-size = <512>;
+		nand-ecc-strength = <15>;
+		nand-on-flash-bbt;
+		brcm,nand-oob-sector-size = <64>;
+
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			cferom: partition@0 {
+				label = "cferom";
+				reg = <0x0000000 0x0020000>;
+				read-only;
+			};
+
+			partition@20000 {
+				compatible = "brcm,wfi";
+				label = "wfi";
+				reg = <0x0020000 0x7d80000>;
+			};
+
+			partition@7da0000 {
+				label = "nvram";
+				reg = <0x7da0000 0x160000>;
+			};
+		};
+	};
+};
+
+&ohci {
+	status = "okay";
+};
+
+&pinctrl {
+	pinctrl_leds: leds {
+		function = "led";
+		pins = "gpio3", "gpio5";
+	};
+};
+
+&switch0 {
+	dsa,member = <0 0>;
+
+	ports {
+		switch0port4: port@4 {
+			reg = <4>;
+			label = "extsw";
+
+			phy-mode = "rgmii";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+
+		port@5 {
+			reg = <5>;
+			label = "wan";
+
+			phy-handle = <&phy24>;
+			phy-mode = "rgmii-txid";
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usbh {
+	status = "okay";
+};
+
+&cferom {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_cferom_6a0: macaddr@6a0 {
+		reg = <0x6a0 0x6>;
+	};
+};
diff --git a/target/linux/bmips/dts/bcm6362-netgear-dgnd3700-v2.dts b/target/linux/bmips/dts/bcm6362-netgear-dgnd3700-v2.dts
index b99fecaaa626e3..a335218be07d3d 100644
--- a/target/linux/bmips/dts/bcm6362-netgear-dgnd3700-v2.dts
+++ b/target/linux/bmips/dts/bcm6362-netgear-dgnd3700-v2.dts
@@ -11,17 +11,11 @@
 		led-failsafe = &led_power_red;
 		led-running = &led_power_green;
 		led-upgrade = &led_power_green;
-
-		led-dsl = &led_dsl_green;
-		led-ethernet = &led_ethernet_green;
-		led-internet = &led_internet_green;
-		led-usb = &led_usb1_green;
-		led-usb2 = &led_usb2_green;
 	};
 
 	keys {
 		compatible = "gpio-keys-polled";
-		poll-interval = <20>;
+		poll-interval = <100>;
 
 		wlan {
 			label = "wlan";
@@ -48,7 +42,7 @@
 	leds {
 		compatible = "gpio-leds";
 
-		led_dsl_green: led@28 {
+		led@28 {
 			label = "green:dsl";
 			gpios = <&gpio 28 GPIO_ACTIVE_LOW>;
 		};
@@ -56,6 +50,7 @@
 		led_power_red: led@34 {
 			label = "red:power";
 			gpios = <&gpio 34 GPIO_ACTIVE_LOW>;
+			panic-indicator;
 		};
 	};
 };
@@ -82,7 +77,7 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_leds &pinctrl_serial_led>;
 
-	led_internet_green: led@1 {
+	led@1 {
 		reg = <1>;
 		active-low;
 		label = "green:internet";
@@ -99,13 +94,13 @@
 		label = "green:wps";
 	};
 
-	led_usb1_green: led@10 {
+	led@10 {
 		reg = <10>;
 		active-low;
 		label = "green:usb1";
 	};
 
-	led_usb2_green: led@11 {
+	led@11 {
 		reg = <11>;
 		active-low;
 		label = "green:usb2";
@@ -117,7 +112,7 @@
 		label = "amber:internet";
 	};
 
-	led_ethernet_green: led@13 {
+	led@13 {
 		reg = <13>;
 		active-low;
 		label = "green:ethernet";
@@ -148,6 +143,57 @@
 	};
 };
 
+&mdio_ext {
+	switch@1e {
+		compatible = "brcm,bcm53125";
+		reg = <30>;
+
+		dsa,member = <1 0>;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				label = "lan1";
+			};
+
+			port@1 {
+				reg = <1>;
+				label = "lan2";
+			};
+
+			port@2 {
+				reg = <2>;
+				label = "lan3";
+			};
+
+			port@3 {
+				reg = <3>;
+				label = "lan4";
+			};
+
+			port@4 {
+				reg = <4>;
+				label = "wan";
+			};
+
+			port@8 {
+				reg = <8>;
+
+				phy-mode = "rgmii";
+				ethernet = <&switch0port4>;
+
+				fixed-link {
+					speed = <1000>;
+					full-duplex;
+				};
+			};
+		};
+	};
+};
+
 &nflash {
 	status = "okay";
 
@@ -158,6 +204,9 @@
 		nand-ecc-strength = <15>;
 		nand-on-flash-bbt;
 
+		#address-cells = <1>;
+		#size-cells = <1>;
+
 		partitions {
 			compatible = "fixed-partitions";
 			#address-cells = <1>;
@@ -173,6 +222,7 @@
 				compatible = "brcm,wfi";
 				label = "wfi";
 				reg = <0x0004000 0x1c7c000>;
+				brcm,cferam = "cfe";
 			};
 
 			partition@1c80000 {
@@ -224,8 +274,10 @@
 };
 
 &switch0 {
+	dsa,member = <0 0>;
+
 	ports {
-		port@4 {
+		switch0port4: port@4 {
 			reg = <4>;
 			label = "extsw";
 
diff --git a/target/linux/bmips/dts/bcm6362.dtsi b/target/linux/bmips/dts/bcm6362.dtsi
index 77473c22bb19fb..e615eaf8b3b230 100644
--- a/target/linux/bmips/dts/bcm6362.dtsi
+++ b/target/linux/bmips/dts/bcm6362.dtsi
@@ -6,6 +6,7 @@
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/interrupt-controller/bcm6362-interrupt-controller.h>
+#include <dt-bindings/interrupt-controller/irq.h>
 #include <dt-bindings/reset/bcm6362-reset.h>
 #include <dt-bindings/soc/bcm6362-pm.h>
 
@@ -118,6 +119,7 @@
 			interrupt-controller;
 			#interrupt-cells = <2>;
 
+			interrupt-parent = <&periph_intc>;
 			interrupts = <BCM6362_IRQ_EXT0>,
 				     <BCM6362_IRQ_EXT1>,
 				     <BCM6362_IRQ_EXT2>,
@@ -147,6 +149,8 @@
 		};
 
 		gpio_cntl: syscon@10000080 {
+			#address-cells = <1>;
+			#size-cells = <1>;
 			compatible = "brcm,bcm6362-gpio-sysctl",
 				     "syscon", "simple-mfd";
 			reg = <0x10000080 0x80>;
@@ -473,6 +477,18 @@
 			status = "disabled";
 		};
 
+		random: rng@10002880 {
+			compatible = "brcm,bcm6368-rng";
+			reg = <0x10002880 0x14>;
+
+			clocks = <&periph_clk BCM6362_CLK_IPSEC>;
+			clock-names = "ipsec";
+
+			resets = <&periph_rst BCM6362_RST_IPSEC>;
+
+			power-domains = <&periph_pwr BCM6362_POWER_DOMAIN_IPSEC>;
+		};
+
 		ethernet: ethernet@1000d800 {
 			compatible = "brcm,bcm6362-enetsw";
 			reg = <0x1000d800 0x80>,
@@ -505,7 +521,7 @@
 		switch0: switch@10e00000 {
 			#address-cells = <1>;
 			#size-cells = <0>;
-			compatible = "brcm,bcm6328-switch";
+			compatible = "brcm,bcm6362-switch";
 			reg = <0x10e00000 0x8000>;
 			big-endian;
 
@@ -515,7 +531,6 @@
 
 				port@8 {
 					reg = <8>;
-					label = "cpu";
 
 					phy-mode = "internal";
 					ethernet = <&ethernet>;
diff --git a/target/linux/bmips/dts/bcm6368-actiontec-r1000h.dts b/target/linux/bmips/dts/bcm6368-actiontec-r1000h.dts
new file mode 100644
index 00000000000000..ff115afb8fbd1a
--- /dev/null
+++ b/target/linux/bmips/dts/bcm6368-actiontec-r1000h.dts
@@ -0,0 +1,220 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "bcm6368.dtsi"
+
+/ {
+	model = "Actiontec R1000H";
+	compatible = "actiontec,r1000h", "brcm,bcm6368";
+
+	aliases {
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_green;
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <100>;
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 34 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 35 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led@5 {
+			label = "green:wan";
+			gpios = <&gpio 5 GPIO_ACTIVE_HIGH>;
+		};
+
+		led@21 {
+			label = "green:usb";
+			gpios = <&gpio 21 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_green: led@22 {
+			label = "green:power";
+			gpios = <&gpio 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		led@23 {
+			label = "green:wps";
+			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_red: led@24 {
+			label = "red:power";
+			gpios = <&gpio 24 GPIO_ACTIVE_HIGH>;
+			panic-indicator;
+		};
+
+		led@30 {
+			label = "red:wps";
+			gpios = <&gpio 30 GPIO_ACTIVE_LOW>;
+		};
+
+		led@31 {
+			label = "red:wan";
+			gpios = <&gpio 31 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&ehci {
+	status = "okay";
+};
+
+&ethernet {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_cfe_6a0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&mdio_ext {
+	switch@1e {
+		compatible = "brcm,bcm53115";
+		reg = <30>;
+
+		dsa,member = <1 0>;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				label = "lan1";
+			};
+
+			port@1 {
+				reg = <1>;
+				label = "lan2";
+			};
+
+			port@2 {
+				reg = <2>;
+				label = "lan3";
+			};
+
+			port@3 {
+				reg = <3>;
+				label = "lan4";
+			};
+
+			port@4 {
+				reg = <4>;
+				label = "wan";
+			};
+
+			port@5 {
+				/* HPNA coaxial port */
+				reg = <5>;
+				label = "coax";
+
+				phy-mode = "mii";
+
+				fixed-link {
+					speed = <100>;
+					full-duplex;
+				};
+			};
+
+			port@8 {
+				reg = <8>;
+
+				phy-mode = "rgmii";
+				ethernet = <&switch0port5>;
+
+				fixed-link {
+					speed = <1000>;
+					full-duplex;
+				};
+			};
+		};
+	};
+};
+
+&switch0 {
+	dsa,member = <0 0>;
+
+	ports {
+		switch0port5: port@5 {
+			reg = <5>;
+			label = "extsw";
+
+			phy-mode = "rgmii";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
+
+&pflash {
+	status = "okay";
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		cfe: partition@0 {
+			label = "CFE";
+			reg = <0x000000 0x020000>;
+			read-only;
+		};
+
+		partition@20000 {
+			label = "firmware";
+			reg = <0x020000 0x1fc0000>;
+			compatible = "brcm,bcm963xx-imagetag";
+		};
+
+		partition@fe0000 {
+			label = "nvram";
+			reg = <0x1fe0000 0x020000>;
+		};
+	};
+};
+
+&ohci {
+	status = "okay";
+};
+
+&pci {
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usbh {
+	status = "okay";
+};
+
+&cfe {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_cfe_6a0: macaddr@6a0 {
+		reg = <0x6a0 0x6>;
+	};
+};
diff --git a/target/linux/bmips/dts/bcm6368-comtrend-vr-3025u.dts b/target/linux/bmips/dts/bcm6368-comtrend-vr-3025u.dts
index 29d8dfd56e0960..e67db8b6bde631 100644
--- a/target/linux/bmips/dts/bcm6368-comtrend-vr-3025u.dts
+++ b/target/linux/bmips/dts/bcm6368-comtrend-vr-3025u.dts
@@ -11,14 +11,11 @@
 		led-failsafe = &led_power_red;
 		led-running = &led_power_green;
 		led-upgrade = &led_power_green;
-
-		led-dsl = &led_dsl_green;
-		led-internet = &led_internet_green;
 	};
 
 	keys {
 		compatible = "gpio-keys-polled";
-		poll-interval = <20>;
+		poll-interval = <100>;
 
 		reset {
 			label = "reset";
@@ -31,12 +28,12 @@
 	leds {
 		compatible = "gpio-leds";
 
-		led_dsl_green: led@2 {
+		led@2 {
 			label = "green:dsl";
 			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
 		};
 
-		led_internet_green: led@5 {
+		led@5 {
 			label = "green:internet";
 			gpios = <&gpio 5 GPIO_ACTIVE_HIGH>;
 		};
@@ -49,6 +46,7 @@
 		led_power_red: led@24 {
 			label = "red:power";
 			gpios = <&gpio 24 GPIO_ACTIVE_HIGH>;
+			panic-indicator;
 		};
 
 		led@31 {
@@ -58,7 +56,7 @@
 	};
 
 	bcm43222-sprom {
-		compatible = "brcm,bcm43222-sprom";
+		compatible = "brcm,ssb-sprom";
 
 		pci-bus = <0>;
 		pci-dev = <1>;
@@ -67,6 +65,7 @@
 		nvmem-cell-names = "mac-address";
 		mac-address-increment = <1>;
 
+		brcm,sprom = "brcm/bcm43222-sprom.bin";
 		brcm,sprom-fixups = <97 0xfeb3>,
 				    <98 0x1618>,
 				    <99 0xfab0>,
@@ -135,6 +134,7 @@
 			label = "lan1";
 
 			phy-handle = <&phy1>;
+			phy-mode = "mii";
 		};
 
 		port@1 {
@@ -142,6 +142,7 @@
 			label = "lan2";
 
 			phy-handle = <&phy2>;
+			phy-mode = "mii";
 		};
 
 		port@2 {
@@ -149,6 +150,7 @@
 			label = "lan3";
 
 			phy-handle = <&phy3>;
+			phy-mode = "mii";
 		};
 
 		port@3 {
@@ -156,6 +158,7 @@
 			label = "lan4";
 
 			phy-handle = <&phy4>;
+			phy-mode = "mii";
 		};
 	};
 };
diff --git a/target/linux/bmips/dts/bcm6368-comtrend-vr-3025un.dts b/target/linux/bmips/dts/bcm6368-comtrend-vr-3025un.dts
new file mode 100644
index 00000000000000..3256783e0e88db
--- /dev/null
+++ b/target/linux/bmips/dts/bcm6368-comtrend-vr-3025un.dts
@@ -0,0 +1,182 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "bcm6368.dtsi"
+
+/ {
+	model = "Comtrend VR-3025un";
+	compatible = "comtrend,vr-3025un", "brcm,bcm6368";
+
+	aliases {
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_green;
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <100>;
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 34 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led@2 {
+			label = "green:dsl";
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+		};
+
+		led@5 {
+			label = "green:internet";
+			gpios = <&gpio 5 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_power_green: led@22 {
+			label = "green:power";
+			gpios = <&gpio 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_power_red: led@24 {
+			label = "red:power";
+			gpios = <&gpio 24 GPIO_ACTIVE_HIGH>;
+			panic-indicator;
+		};
+
+		led@31 {
+			label = "red:internet";
+			gpios = <&gpio 31 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	bcm43222-sprom {
+		compatible = "brcm,ssb-sprom";
+
+		pci-bus = <0>;
+		pci-dev = <1>;
+
+		nvmem-cells = <&macaddr_cfe_6a0>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <1>;
+
+		brcm,sprom = "brcm/bcm43222-sprom.bin";
+		brcm,sprom-fixups = <97 0xfeb3>,
+				    <98 0x1618>,
+				    <99 0xfab0>,
+				    <113 0xfed1>,
+				    <114 0x1609>,
+				    <115 0xfad9>;
+	};
+};
+
+&ehci {
+	status = "okay";
+};
+
+&ethernet {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_cfe_6a0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&ohci {
+	status = "okay";
+};
+
+&pci {
+	status = "okay";
+};
+
+&pflash {
+	status = "okay";
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		cfe: partition@0 {
+			label = "CFE";
+			reg = <0x000000 0x010000>;
+			read-only;
+		};
+
+		partition@20000 {
+			compatible = "brcm,bcm963xx-imagetag";
+			label = "firmware";
+			reg = <0x010000 0x7e0000>;
+		};
+
+		partition@1fe0000 {
+			label = "nvram";
+			reg = <0x7f0000 0x010000>;
+		};
+	};
+};
+
+&pinctrl {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pinctrl_ephy0_led &pinctrl_ephy1_led
+		     &pinctrl_ephy2_led &pinctrl_ephy3_led>;
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			reg = <0>;
+			label = "lan1";
+
+			phy-handle = <&phy1>;
+			phy-mode = "mii";
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan2";
+
+			phy-handle = <&phy2>;
+			phy-mode = "mii";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan3";
+
+			phy-handle = <&phy3>;
+			phy-mode = "mii";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "iptv";
+
+			phy-handle = <&phy4>;
+			phy-mode = "mii";
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usbh {
+	status = "okay";
+};
+
+&cfe {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_cfe_6a0: macaddr@6a0 {
+		reg = <0x6a0 0x6>;
+	};
+};
diff --git a/target/linux/bmips/dts/bcm6368-netgear-dgnd3700-v1.dts b/target/linux/bmips/dts/bcm6368-netgear-dgnd3700-v1.dts
new file mode 100644
index 00000000000000..4ec6c480834b80
--- /dev/null
+++ b/target/linux/bmips/dts/bcm6368-netgear-dgnd3700-v1.dts
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "bcm6368-netgear-dgnd3700.dtsi"
+
+/ {
+	model = "Netgear DGND3700 v1";
+	compatible = "netgear,dgnd3700-v1", "brcm,bcm6368";
+};
diff --git a/target/linux/bmips/dts/bcm6368-netgear-dgnd3700.dtsi b/target/linux/bmips/dts/bcm6368-netgear-dgnd3700.dtsi
new file mode 100644
index 00000000000000..c878dd2cffa2b1
--- /dev/null
+++ b/target/linux/bmips/dts/bcm6368-netgear-dgnd3700.dtsi
@@ -0,0 +1,265 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "bcm6368.dtsi"
+
+/ {
+	aliases {
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_green;
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <100>;
+
+		rfkill {
+			label = "rfkill";
+			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			debounce-interval = <60>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 35 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led@2 {
+			label = "green:dsl";
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+		};
+
+		led@4 {
+			label = "red:wan";
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+		};
+
+		led@5 {
+			label = "green:wan";
+			gpios = <&gpio 5 GPIO_ACTIVE_LOW>;
+		};
+
+		led@11 {
+			label = "green:wps";
+			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led@13 {
+			/* Front USB port */
+			label = "green:usb2";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		};
+
+		led@14 {
+			/* Back USB port */
+			label = "green:usb1";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_red: led@22 {
+			label = "red:power";
+			gpios = <&gpio 22 GPIO_ACTIVE_LOW>;
+			panic-indicator;
+		};
+
+		led@23 {
+			label = "green:lan";
+			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_green: led@24 {
+			label = "green:power";
+			gpios = <&gpio 24 GPIO_ACTIVE_LOW>;
+		};
+
+		led@26 {
+			label = "green:wifi2g";
+			gpios = <&gpio 26 GPIO_ACTIVE_LOW>;
+		};
+
+		led@27 {
+			label = "blue:wifi5g";
+			gpios = <&gpio 27 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&ehci {
+	status = "okay";
+};
+
+&ethernet {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_cfe_6a0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&lsspi {
+	status = "okay";
+
+	switch@1 {
+		compatible = "brcm,bcm53115";
+		reg = <1>;
+		spi-max-frequency = <781000>;
+		dsa,member = <1 0>;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				label = "wan";
+			};
+
+			port@1 {
+				reg = <1>;
+				label = "lan4";
+			};
+
+			port@2 {
+				reg = <2>;
+				label = "lan3";
+			};
+
+			port@3 {
+				reg = <3>;
+				label = "lan2";
+			};
+
+			port@4 {
+				reg = <4>;
+				label = "lan1";
+			};
+
+			port@8 {
+				reg = <8>;
+
+				phy-mode = "rgmii";
+				ethernet = <&switch0port5>;
+
+				fixed-link {
+					speed = <1000>;
+					full-duplex;
+				};
+			};
+		};
+	};
+};
+
+&nflash {
+	status = "okay";
+
+	nandcs@0 {
+		compatible = "brcm,nandcs";
+		reg = <0>;
+		nand-ecc-step-size = <512>;
+		nand-ecc-strength = <15>;
+		nand-on-flash-bbt;
+		brcm,nand-oob-sector-size = <64>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "storage";
+				reg = <0 0>; /* autodetected size */
+			};
+		};
+	};
+};
+
+&ohci {
+	status = "okay";
+};
+
+&pci {
+	status = "okay";
+};
+
+&pflash {
+	status = "okay";
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		cfe: partition@0 {
+			label = "CFE";
+			reg = <0x0000000 0x0020000>;
+			read-only;
+		};
+
+		partition@20000 {
+			compatible = "brcm,bcm963xx-imagetag";
+			label = "firmware";
+			reg = <0x0020000 0x1e20000>;
+		};
+
+		partition@1e40000 {
+			label = "board_data";
+			reg = <0x1e40000 0x1a0000>;
+			read-only;
+		};
+
+		partition@1fe0000 {
+			label = "nvram";
+			reg = <0x1fe0000 0x020000>;
+		};
+	};
+};
+
+&switch0 {
+	dsa,member = <0 0>;
+
+	ports {
+		switch0port5: port@5 {
+			reg = <5>;
+			label = "extsw";
+
+			phy-mode = "rgmii";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usbh {
+	status = "okay";
+};
+
+&cfe {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_cfe_6a0: macaddr@6a0 {
+		reg = <0x6a0 0x6>;
+	};
+};
diff --git a/target/linux/bmips/dts/bcm6368-netgear-dgnd3800b.dts b/target/linux/bmips/dts/bcm6368-netgear-dgnd3800b.dts
new file mode 100644
index 00000000000000..350d3619c05256
--- /dev/null
+++ b/target/linux/bmips/dts/bcm6368-netgear-dgnd3800b.dts
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "bcm6368-netgear-dgnd3700.dtsi"
+
+/ {
+	model = "Netgear DGND3800B";
+	compatible = "netgear,dgnd3800b", "brcm,bcm6368";
+};
diff --git a/target/linux/bmips/dts/bcm6368-observa-vh4032n.dts b/target/linux/bmips/dts/bcm6368-observa-vh4032n.dts
new file mode 100644
index 00000000000000..14fbd856f8ffc2
--- /dev/null
+++ b/target/linux/bmips/dts/bcm6368-observa-vh4032n.dts
@@ -0,0 +1,233 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "bcm6368.dtsi"
+
+/ {
+	model = "Observa VH4032N";
+	compatible = "observa,vh4032n", "brcm,bcm6368";
+
+	aliases {
+		led-boot = &led_power_blue;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_blue;
+		led-upgrade = &led_power_blue;
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <100>;
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 34 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+
+		rfkill {
+			label = "rfkill";
+			gpios = <&gpio 35 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led@2 {
+			label = "blue:dsl";
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+		};
+
+		led@5 {
+			label = "red:dsl";
+			gpios = <&gpio 5 GPIO_ACTIVE_LOW>;
+		};
+
+		led@11 {
+			label = "blue:hspa";
+			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led@12 {
+			label = "red:hspa";
+			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_blue: led@22 {
+			label = "blue:power";
+			gpios = <&gpio 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_power_red: led@24 {
+			label = "red:power";
+			gpios = <&gpio 24 GPIO_ACTIVE_HIGH>;
+			panic-indicator;
+		};
+
+		led@25 {
+			label = "blue:voice";
+			gpios = <&gpio 25 GPIO_ACTIVE_LOW>;
+		};
+
+		led@26 {
+			label = "red:voice";
+			gpios = <&gpio 26 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	bcm43222-sprom {
+		compatible = "brcm,ssb-sprom";
+
+		pci-bus = <0>;
+		pci-dev = <1>;
+
+		nvmem-cells = <&macaddr_cfe_6a0>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <1>;
+
+		brcm,sprom = "brcm/bcm43222-sprom.bin";
+		brcm,sprom-fixups = <2   0x04d2>, <4   0x4350>,
+				    <65  0x1300>, <68  0x0402>,
+				    <70  0x0090>, <71  0x4c19>,
+				    <72  0x2345>, <87  0x0315>,
+				    <88  0x0315>, <96  0x2048>,
+				    <97  0xfed7>, <98  0x15a6>,
+				    <99  0xfaee>, <100 0x3e3a>,
+				    <101 0x3a36>, <102 0xff7f>,
+				    <103 0x11b9>, <104 0xfc53>,
+				    <105 0xffe6>, <106 0xfdd2>,
+				    <107 0xfe49>, <108 0xff6a>,
+				    <109 0x136e>, <110 0xfbed>,
+				    <111 0x0000>, <112 0x2048>,
+				    <113 0xfee2>, <114 0x15e5>,
+				    <115 0xfaed>, <116 0x3e3a>,
+				    <117 0x3a36>, <118 0xffc8>,
+				    <119 0x12b8>, <120 0xfca1>,
+				    <121 0xff9b>, <122 0x122a>,
+				    <123 0xfcc8>, <124 0xff95>,
+				    <125 0x146b>, <126 0xfbba>,
+				    <127 0x0000>, <161 0x0000>,
+				    <162 0x0000>, <169 0x0000>,
+				    <170 0x0000>, <171 0x0000>,
+				    <172 0x0000>, <173 0x0000>,
+				    <174 0x0000>, <175 0x0000>,
+				    <176 0x0000>, <219 0x1108>;
+	};
+};
+
+&ehci {
+	status = "okay";
+};
+
+&ethernet {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_cfe_6a0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gpio {
+	usb_hub_reset {
+		gpio-hog;
+		gpios = <27 GPIO_ACTIVE_HIGH>;
+		output-high;
+		line-name = "usb-hub-reset-gpio";
+	};
+};
+
+&ohci {
+	status = "okay";
+};
+
+&pci {
+	status = "okay";
+};
+
+&pflash {
+	status = "okay";
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		cfe: partition@0 {
+			label = "CFE";
+			reg = <0x0000000 0x0020000>;
+			read-only;
+		};
+
+		partition@20000 {
+			compatible = "brcm,bcm963xx-imagetag";
+			label = "firmware";
+			reg = <0x0020000 0x1fc0000>;
+		};
+
+		partition@1fe0000 {
+			label = "nvram";
+			reg = <0x1fe0000 0x020000>;
+		};
+	};
+};
+
+&pinctrl {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pinctrl_ephy0_led &pinctrl_ephy1_led
+		     &pinctrl_ephy2_led &pinctrl_ephy3_led>;
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			reg = <0>;
+			label = "lan4";
+
+			phy-handle = <&phy1>;
+			phy-mode = "mii";
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan3";
+
+			phy-handle = <&phy2>;
+			phy-mode = "mii";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan2";
+
+			phy-handle = <&phy3>;
+			phy-mode = "mii";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan1";
+
+			phy-handle = <&phy4>;
+			phy-mode = "mii";
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usbh {
+	status = "okay";
+};
+
+&cfe {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_cfe_6a0: macaddr@6a0 {
+		reg = <0x6a0 0x6>;
+	};
+};
diff --git a/target/linux/bmips/dts/bcm6368.dtsi b/target/linux/bmips/dts/bcm6368.dtsi
index b50a572fd00073..0ac1269166bda0 100644
--- a/target/linux/bmips/dts/bcm6368.dtsi
+++ b/target/linux/bmips/dts/bcm6368.dtsi
@@ -6,6 +6,7 @@
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/interrupt-controller/bcm6368-interrupt-controller.h>
+#include <dt-bindings/interrupt-controller/irq.h>
 #include <dt-bindings/reset/bcm6368-reset.h>
 
 / {
@@ -108,6 +109,7 @@
 			interrupt-controller;
 			#interrupt-cells = <2>;
 
+			interrupt-parent = <&periph_intc>;
 			interrupts = <BCM6368_IRQ_EXT0>,
 				     <BCM6368_IRQ_EXT1>,
 				     <BCM6368_IRQ_EXT2>,
@@ -122,6 +124,7 @@
 			interrupt-controller;
 			#interrupt-cells = <2>;
 
+			interrupt-parent = <&periph_intc>;
 			interrupts = <BCM6368_IRQ_EXT4>,
 				     <BCM6368_IRQ_EXT5>;
 		};
@@ -149,6 +152,8 @@
 		};
 
 		gpio_cntl: syscon@10000080 {
+			#address-cells = <1>;
+			#size-cells = <1>;
 			compatible = "brcm,bcm6368-gpio-sysctl",
 				     "syscon", "simple-mfd";
 			reg = <0x10000080 0x80>;
@@ -408,16 +413,14 @@
 
 		pci: pci@10001000 {
 			compatible = "brcm,bcm6348-pci";
-			reg = <0x10001000 0x200>,
-			      <0x08000000 0x10000>;
-			reg-names = "pci",
-				    "pci-io";
+			reg = <0x10001000 0x200>;
 			#address-cells = <3>;
 			#size-cells = <2>;
 
 			device_type = "pci";
 			bus-range = <0x00 0x01>;
-			ranges = <0x2000000 0 0x30000000 0x30000000 0 0x8000000>;
+			ranges = <0x2000000 0 0x30000000 0x30000000 0 0x8000000>,
+				 <0x1000000 0 0x08000000 0x08000000 0 0x0010000>;
 			linux,pci-probe-only = <1>;
 
 			interrupt-parent = <&periph_intc>;
@@ -519,7 +522,7 @@
 		switch0: switch@10f00000 {
 			#address-cells = <1>;
 			#size-cells = <0>;
-			compatible = "brcm,bcm6328-switch";
+			compatible = "brcm,bcm6368-switch";
 			reg = <0x10f00000 0x8000>;
 			big-endian;
 
@@ -529,7 +532,6 @@
 
 				port@8 {
 					reg = <8>;
-					label = "cpu";
 
 					phy-mode = "internal";
 					ethernet = <&ethernet>;
diff --git a/target/linux/bmips/dts/bcm6369-comtrend-wap-5813n.dts b/target/linux/bmips/dts/bcm6369-comtrend-wap-5813n.dts
new file mode 100644
index 00000000000000..517a894cf506a4
--- /dev/null
+++ b/target/linux/bmips/dts/bcm6369-comtrend-wap-5813n.dts
@@ -0,0 +1,230 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "bcm6368.dtsi"
+
+/ {
+	model = "Comtrend WAP-5813n";
+	compatible = "comtrend,wap-5813n", "brcm,bcm6369", "brcm,bcm6368";
+
+	aliases {
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_green;
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <100>;
+
+		wlan {
+			label = "wlan";
+			gpios = <&gpio 32 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WLAN>;
+			debounce-interval = <60>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 34 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 35 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led@5 {
+			label = "green:internet";
+			gpios = <&gpio 5 GPIO_ACTIVE_HIGH>;
+		};
+
+		led@14 {
+			label = "green:usb";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_green: led@22 {
+			label = "green:power";
+			gpios = <&gpio 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		led@23 {
+			label = "green:wps";
+			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_red: led@24 {
+			label = "red:power";
+			gpios = <&gpio 24 GPIO_ACTIVE_HIGH>;
+			panic-indicator;
+		};
+
+		led@31 {
+			label = "red:internet";
+			gpios = <&gpio 31 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	bcm4322-sprom {
+		compatible = "brcm,ssb-sprom";
+
+		pci-bus = <0>;
+		pci-dev = <1>;
+
+		nvmem-cells = <&macaddr_cfe_6a0>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <1>;
+
+		brcm,sprom = "brcm/bcm4322-sprom.bin";
+		brcm,sprom-fixups = <97 0xfeed>,
+				    <98 0x15d1>,
+				    <99 0xfb0d>,
+				    <113 0xfef7>,
+				    <114 0x15f7>,
+				    <115 0xfb1a>;
+	};
+};
+
+&ehci {
+	status = "okay";
+};
+
+&ethernet {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_cfe_6a0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&lsspi {
+	status = "okay";
+
+	switch@0 {
+		compatible = "brcm,bcm53115";
+		reg = <0>;
+		spi-max-frequency = <781000>;
+		dsa,member = <1 0>;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				label = "lan4";
+			};
+
+			port@1 {
+				reg = <1>;
+				label = "lan3";
+			};
+
+			port@2 {
+				reg = <2>;
+				label = "lan2";
+			};
+
+			port@3 {
+				reg = <3>;
+				label = "lan1";
+			};
+
+			port@4 {
+				reg = <4>;
+				label = "wan";
+			};
+
+			port@5 {
+				reg = <5>;
+
+				phy-mode = "rgmii";
+				ethernet = <&switch0port4>;
+
+				fixed-link {
+					speed = <1000>;
+					full-duplex;
+				};
+			};
+		};
+	};
+};
+
+&pflash {
+	status = "okay";
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		cfe: partition@0 {
+			label = "CFE";
+			reg = <0x000000 0x010000>;
+			read-only;
+		};
+
+		partition@20000 {
+			label = "firmware";
+			reg = <0x010000 0x7e0000>;
+			compatible = "brcm,bcm963xx-imagetag";
+		};
+
+		partition@fe0000 {
+			label = "nvram";
+			reg = <0x7f0000 0x010000>;
+		};
+	};
+};
+
+&ohci {
+	status = "okay";
+};
+
+&pci {
+	status = "okay";
+};
+
+&switch0 {
+	dsa,member = <0 0>;
+
+	ports {
+		switch0port4: port@4 {
+			reg = <4>;
+			label = "extsw";
+
+			phy-mode = "rgmii";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usbh {
+	status = "okay";
+};
+
+&cfe {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_cfe_6a0: macaddr@6a0 {
+		reg = <0x6a0 0x6>;
+	};
+};
diff --git a/target/linux/bmips/dts/bcm6369-netgear-evg2000.dts b/target/linux/bmips/dts/bcm6369-netgear-evg2000.dts
new file mode 100644
index 00000000000000..460c88f755c2cb
--- /dev/null
+++ b/target/linux/bmips/dts/bcm6369-netgear-evg2000.dts
@@ -0,0 +1,237 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "bcm6368.dtsi"
+
+/ {
+	model = "Netgear EVG2000";
+	compatible = "netgear,evg2000", "brcm,bcm6369", "brcm,bcm6368";
+
+	aliases {
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_green;
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <100>;
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 25 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 26 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led@2 {
+			label = "green:voip2";
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+		};
+
+		led@4 {
+			label = "red:internet";
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+		};
+
+		led@5 {
+			label = "green:internet";
+			gpios = <&gpio 5 GPIO_ACTIVE_LOW>;
+		};
+
+		led@14 {
+			label = "green:voip1";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		};
+
+		led@15 {
+			label = "green:usb";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_green: led@22 {
+			label = "green:power";
+			gpios = <&gpio 22 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_red: led@23 {
+			label = "red:power";
+			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
+			panic-indicator;
+		};
+
+		led@24 {
+			label = "green:lan";
+			gpios = <&gpio 24 GPIO_ACTIVE_LOW>;
+		};
+
+		led@27 {
+			label = "green:wan";
+			gpios = <&gpio 27 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	bcm4322-sprom {
+		compatible = "brcm,ssb-sprom";
+
+		pci-bus = <0>;
+		pci-dev = <1>;
+
+		nvmem-cells = <&macaddr_cfe_6a0>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <1>;
+
+		brcm,sprom = "brcm/bcm4322-sprom.bin";
+		brcm,sprom-fixups = <219 0xec08>;
+	};
+};
+
+&ehci {
+	status = "okay";
+};
+
+&ethernet {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_cfe_6a0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&mdio_ext {
+	switch@1e {
+		compatible = "brcm,bcm53115";
+		reg = <30>;
+
+		dsa,member = <1 0>;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				label = "wan";
+			};
+
+			port@1 {
+				reg = <1>;
+				label = "lan1";
+			};
+
+			port@2 {
+				reg = <2>;
+				label = "lan2";
+			};
+
+			port@3 {
+				reg = <3>;
+				label = "lan3";
+			};
+
+			port@4 {
+				reg = <4>;
+				label = "lan4";
+			};
+
+			port@8 {
+				reg = <8>;
+
+				phy-mode = "rgmii";
+				ethernet = <&switch0port5>;
+
+				fixed-link {
+					speed = <1000>;
+					full-duplex;
+				};
+			};
+		};
+	};
+};
+
+&switch0 {
+	dsa,member = <0 0>;
+
+	ports {
+		switch0port5: port@5 {
+			reg = <5>;
+			label = "extsw";
+
+			phy-mode = "rgmii";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
+
+&pflash {
+	status = "okay";
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		cfe: partition@0 {
+			label = "CFE";
+			reg = <0x000000 0x020000>;
+			read-only;
+		};
+
+		partition@20000 {
+			label = "firmware";
+			reg = <0x020000 0xf40000>;
+			compatible = "brcm,bcm963xx-imagetag";
+		};
+
+		partition@f60000 {
+			label = "board_data";
+			reg = <0xf60000 0x080000>;
+			read-only;
+		};
+
+		partition@fe0000 {
+			label = "nvram";
+			reg = <0xfe0000 0x020000>;
+		};
+	};
+};
+
+&ohci {
+	status = "okay";
+};
+
+&pci {
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usbh {
+	status = "okay";
+};
+
+&cfe {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_cfe_6a0: macaddr@6a0 {
+		reg = <0x6a0 0x6>;
+	};
+};
diff --git a/target/linux/bmips/files/drivers/leds/leds-sercomm-msp430.c b/target/linux/bmips/files/drivers/leds/leds-sercomm-msp430.c
new file mode 100644
index 00000000000000..d3167de053c0cc
--- /dev/null
+++ b/target/linux/bmips/files/drivers/leds/leds-sercomm-msp430.c
@@ -0,0 +1,384 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Driver for Sercomm MSP430G2513 LEDs.
+ *
+ * Copyright 2023 Álvaro Fernández Rojas <noltari@gmail.com>
+ */
+
+#include <linux/delay.h>
+#include <linux/leds.h>
+#include <linux/module.h>
+#include <linux/of_device.h>
+#include <linux/spi/spi.h>
+#include "leds.h"
+
+/*
+ * MSP430G2513 SPI protocol description:
+ * +----+----+----+----+----+----+
+ * | b1 | b2 | b3 | b4 | b5 | b6 |
+ * +----+----+----+----+----+----+
+ * 6 bytes TX & RX per transaction.
+ *
+ * LEDs:
+ * MSP430G2513 can control up to 9 LEDs.
+ * b1: LED ID [1,9]
+ * b2: LED function
+ * b3-b6: LED function parameters
+ *
+ * LED functions:
+ * [0] Off
+ * [1] On
+ * [2] Flash
+ *   - b4: delay (x 6ms)
+ *   - b5: repeat (0 = infinite)
+ * [3] Pulse
+ *   - b3: delay (x 6ms)
+ *   - b4: blink while pulsing? (unknown)
+ *   - b5: repeat (0 = infinite)
+ * [4] Pulse On
+ *   - b3: delay (x 6ms)
+ *   - b4: blink while pulsing? (unknown)
+ *   - b5: repeat (0 = infinite)
+ * [5] Pulse Off
+ *   - b3: delay (x 6ms)
+ *   - b4: blink while pulsing? (unknown)
+ *   - b5: repeat (0 = infinite)
+ * [6] Level
+ *   - b3: brightness [0,4]
+ *
+ * MCU Commands (b1 = 0x55):
+ * [0x0a] FW upgrade data
+ *   - b3: Data size (usually 0x40), which is appended to TX & RX.
+ * [0x31] Get MCU version? (unknown)
+ * [0x68] Get MCU work mode
+ * [0xa5] Start FW upgrade
+ * [0xf0] End FW upgrade
+ */
+
+#define MSP430_CMD_BYTES		6
+#define MSP430_CMD_MCU			0x55
+#define MSP430_MCU_WM			0x68
+
+#define MSP430_LED_MIN_ID		1
+#define MSP430_LED_MAX_ID		9
+
+#define MSP430_LED_OFF			0
+#define MSP430_LED_ON			1
+#define MSP430_LED_FLASH		2
+#define MSP430_LED_PULSE		3
+#define MSP430_LED_PULSE_ON		4
+#define MSP430_LED_PULSE_OFF		5
+#define MSP430_LED_LEVEL		6
+
+#define MSP430_LED_BLINK_DEF		500
+#define MSP430_LED_BLINK_MASK		0xff
+#define MSP430_LED_BLINK_MS		6
+#define MSP430_LED_BLINK_MAX		(MSP430_LED_BLINK_MS * \
+					 MSP430_LED_BLINK_MASK)
+
+#define MSP430_LED_BRIGHTNESS_MAX	5
+#define MSP430_LED_REPEAT_MAX		0xff
+
+/**
+ * struct msp430_led - state container for Sercomm MSP430 based LEDs
+ * @cdev: LED class device for this LED
+ * @spi: spi resource
+ * @id: LED ID
+ */
+struct msp430_led {
+	struct led_classdev cdev;
+	struct spi_device *spi;
+	u8 id;
+};
+
+static inline int msp430_cmd(struct spi_device *spi, u8 tx[MSP430_CMD_BYTES],
+			     u8 rx[MSP430_CMD_BYTES])
+{
+	struct device *dev = &spi->dev;
+	int rc;
+
+	memset(rx, 0, MSP430_CMD_BYTES);
+
+	rc = spi_write_then_read(spi, tx, MSP430_CMD_BYTES,
+				  rx, MSP430_CMD_BYTES);
+	if (rc)
+		dev_err(dev, "spi error\n");
+
+	dev_dbg(dev, "msp430_cmd: [%02x %02x %02x %02x %02x %02x]"
+		" -> [%02x %02x %02x %02x %02x %02x]",
+		tx[0], tx[1], tx[2], tx[3], tx[4], tx[5],
+		rx[0], rx[1], rx[2], rx[3], rx[4], rx[5]);
+
+	return rc;
+}
+
+static unsigned long msp430_blink_delay(unsigned long delay)
+{
+	unsigned long msp430_delay;
+
+	msp430_delay = delay + MSP430_LED_BLINK_MS / 2;
+	msp430_delay = msp430_delay / MSP430_LED_BLINK_MS;
+	if (msp430_delay == 0)
+		msp430_delay = 1;
+
+	return msp430_delay;
+}
+
+static int msp430_blink_set(struct led_classdev *led_cdev,
+			    unsigned long *delay_on,
+			    unsigned long *delay_off)
+{
+	struct msp430_led *led =
+		container_of(led_cdev, struct msp430_led, cdev);
+	u8 tx[MSP430_CMD_BYTES] = {led->id, MSP430_LED_FLASH, 0, 0, 0, 0};
+	u8 rx[MSP430_CMD_BYTES];
+	unsigned long delay;
+
+	if (!*delay_on)
+		*delay_on = MSP430_LED_BLINK_DEF;
+	if (!*delay_off)
+		*delay_off = MSP430_LED_BLINK_DEF;
+
+	delay = msp430_blink_delay(*delay_on);
+	if (delay != msp430_blink_delay(*delay_off)) {
+		dev_dbg(led_cdev->dev,
+			"fallback to soft blinking (delay_on != delay_off)\n");
+		return -EINVAL;
+	}
+
+	if (delay > MSP430_LED_BLINK_MASK) {
+		dev_dbg(led_cdev->dev,
+			"fallback to soft blinking (delay > %ums)\n",
+			MSP430_LED_BLINK_MAX);
+		return -EINVAL;
+	}
+
+	tx[3] = delay;
+
+	return msp430_cmd(led->spi, tx, rx);
+}
+
+static int msp430_brightness_set(struct led_classdev *led_cdev,
+				 enum led_brightness brightness)
+{
+	struct msp430_led *led =
+		container_of(led_cdev, struct msp430_led, cdev);
+	u8 tx[MSP430_CMD_BYTES] = {led->id, 0, 0, 0, 0, 0};
+	u8 rx[MSP430_CMD_BYTES];
+	u8 val = (u8) brightness;
+
+	switch (val)
+	{
+	case LED_OFF:
+		tx[1] = MSP430_LED_OFF;
+		break;
+	case MSP430_LED_BRIGHTNESS_MAX:
+		tx[1] = MSP430_LED_ON;
+		break;
+	default:
+		tx[1] = MSP430_LED_LEVEL;
+		tx[2] = val - 1;
+		break;
+	}
+
+	return msp430_cmd(led->spi, tx, rx);
+}
+
+static int msp430_pattern_clear(struct led_classdev *ldev)
+{
+	msp430_brightness_set(ldev, LED_OFF);
+
+	return 0;
+}
+
+static int msp430_pattern_set(struct led_classdev *led_cdev,
+			      struct led_pattern *pattern,
+			      u32 len, int repeat)
+{
+	struct msp430_led *led =
+		container_of(led_cdev, struct msp430_led, cdev);
+	u8 tx[MSP430_CMD_BYTES] = {led->id, 0, 0, 0, 0, 0};
+	u8 rx[MSP430_CMD_BYTES];
+	unsigned long delay0;
+	unsigned long delay1;
+	int rc;
+
+	if (len != 2 ||
+	    repeat > MSP430_LED_REPEAT_MAX ||
+	    pattern[0].delta_t > MSP430_LED_BLINK_MAX ||
+	    pattern[1].delta_t > MSP430_LED_BLINK_MAX)
+		return -EINVAL;
+
+	delay0 = msp430_blink_delay(pattern[0].delta_t);
+	delay1 = msp430_blink_delay(pattern[1].delta_t);
+
+	/* Infinite pattern */
+	if (repeat < 0)
+		repeat = 0;
+
+	/* Pulse: <off> <delay> <max> <delay> */
+	if (delay0 == delay1 &&
+	    pattern[0].brightness == LED_OFF &&
+	    pattern[1].brightness == MSP430_LED_BRIGHTNESS_MAX)
+	{
+		tx[1] = MSP430_LED_PULSE;
+		tx[2] = delay0;
+		tx[4] = (u8) repeat;
+	}
+
+	/* Pulse On: <off> <delay> <max> <0ms> */
+	if (pattern[0].delta_t != 0 &&
+	    pattern[1].delta_t == 0 &&
+	    pattern[0].brightness == LED_OFF &&
+	    pattern[1].brightness == MSP430_LED_BRIGHTNESS_MAX) {
+		tx[1] = MSP430_LED_PULSE_ON;
+		tx[2] = delay0;
+		tx[4] = (u8) repeat;
+	}
+
+	/* Pulse Off: <max> <delay> <off> <0ms> */
+	if (pattern[0].delta_t != 0 &&
+	    pattern[1].delta_t == 0 &&
+	    pattern[0].brightness == MSP430_LED_BRIGHTNESS_MAX &&
+	    pattern[1].brightness == LED_OFF) {
+		tx[1] = MSP430_LED_PULSE_OFF;
+		tx[2] = delay0;
+		tx[4] = (u8) repeat;
+	}
+
+	if (!tx[1])
+		return -EINVAL;
+
+	rc = msp430_cmd(led->spi, tx, rx);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+static int msp430_led(struct spi_device *spi, struct device_node *nc, u8 id)
+{
+	struct device *dev = &spi->dev;
+	struct led_init_data init_data = {};
+	struct msp430_led *led;
+	enum led_default_state state;
+	int rc;
+
+	led = devm_kzalloc(dev, sizeof(*led), GFP_KERNEL);
+	if (!led)
+		return -ENOMEM;
+
+	led->id = id;
+	led->spi = spi;
+
+	init_data.fwnode = of_fwnode_handle(nc);
+
+	state = led_init_default_state_get(init_data.fwnode);
+	switch (state) {
+	case LEDS_DEFSTATE_ON:
+		led->cdev.brightness = MSP430_LED_BRIGHTNESS_MAX;
+		break;
+	default:
+		led->cdev.brightness = LED_OFF;
+		break;
+	}
+
+	msp430_brightness_set(&led->cdev, led->cdev.brightness);
+
+	led->cdev.blink_set = msp430_blink_set;
+	led->cdev.brightness_set_blocking = msp430_brightness_set;
+	led->cdev.max_brightness = MSP430_LED_BRIGHTNESS_MAX;
+	led->cdev.pattern_clear = msp430_pattern_clear;
+	led->cdev.pattern_set = msp430_pattern_set;
+
+	rc = devm_led_classdev_register_ext(dev, &led->cdev, &init_data);
+	if (rc < 0)
+		return rc;
+
+	dev_dbg(dev, "registered LED %s\n", led->cdev.name);
+
+	return 0;
+}
+
+static inline int msp430_check_workmode(struct spi_device *spi)
+{
+	struct device *dev = &spi->dev;
+	u8 tx[MSP430_CMD_BYTES] = {MSP430_CMD_MCU, MSP430_MCU_WM, 0, 0, 0, 0};
+	u8 rx[MSP430_CMD_BYTES];
+	int rc;
+
+	rc = msp430_cmd(spi, tx, rx);
+	if (rc)
+		return rc;
+
+	if ((rx[3] == 0xA5 && rx[4] == 'Z') ||
+	    (rx[4] == 0xA5 && rx[5] == 'Z') ||
+	    (rx[4] == '\b' && rx[5] == '\n')) {
+		dev_err(dev, "invalid workmode: "
+			"[%02x %02x %02x %02x %02x %02x]\n",
+			rx[0], rx[1], rx[2], rx[3], rx[4], rx[5]);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int msp430_leds_probe(struct spi_device *spi)
+{
+	struct device *dev = &spi->dev;
+	struct device_node *np = dev_of_node(dev);
+	struct device_node *child;
+	int rc;
+
+	rc = msp430_check_workmode(spi);
+	if (rc)
+		return rc;
+
+	for_each_available_child_of_node(np, child) {
+		u32 reg;
+
+		if (of_property_read_u32(child, "reg", &reg))
+			continue;
+
+		if (reg < MSP430_LED_MIN_ID || reg > MSP430_LED_MAX_ID) {
+			dev_err(dev, "invalid LED (%u) [%d, %d]\n", reg,
+				MSP430_LED_MIN_ID, MSP430_LED_MAX_ID);
+			continue;
+		}
+
+		rc = msp430_led(spi, child, reg);
+		if (rc < 0) {
+			of_node_put(child);
+			return rc;
+		}
+	}
+
+	return 0;
+}
+
+static const struct of_device_id msp430_leds_of_match[] = {
+	{ .compatible = "sercomm,msp430-leds", },
+	{ /* sentinel */ },
+};
+MODULE_DEVICE_TABLE(of, msp430_leds_of_match);
+
+static const struct spi_device_id msp430_leds_id_table[] = {
+	{ "msp430-leds", 0 },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(spi, msp430_leds_id_table);
+
+static struct spi_driver msp430_leds_driver = {
+	.driver = {
+		.name = KBUILD_MODNAME,
+		.of_match_table = msp430_leds_of_match,
+	},
+	.id_table = msp430_leds_id_table,
+	.probe = msp430_leds_probe,
+};
+module_spi_driver(msp430_leds_driver);
+
+MODULE_AUTHOR("Álvaro Fernández Rojas <noltari@gmail.com>");
+MODULE_DESCRIPTION("LED driver for Sercomm MSP430 controllers");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:leds-sercomm-msp430");
diff --git a/target/linux/bmips/files/drivers/net/ethernet/broadcom/bcm6348-enet.c b/target/linux/bmips/files/drivers/net/ethernet/broadcom/bcm6348-enet.c
new file mode 100644
index 00000000000000..21eb6ea0c20d6a
--- /dev/null
+++ b/target/linux/bmips/files/drivers/net/ethernet/broadcom/bcm6348-enet.c
@@ -0,0 +1,1732 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * BCM6348 Ethernet Controller Driver
+ *
+ * Copyright (C) 2020 Álvaro Fernández Rojas <noltari@gmail.com>
+ * Copyright (C) 2015 Jonas Gorski <jonas.gorski@gmail.com>
+ * Copyright (C) 2008 Maxime Bizon <mbizon@freebox.fr>
+ */
+
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/dma-mapping.h>
+#include <linux/err.h>
+#include <linux/etherdevice.h>
+#include <linux/if_vlan.h>
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/mtd/mtd.h>
+#include <linux/of_address.h>
+#include <linux/of_clk.h>
+#include <linux/of_irq.h>
+#include <linux/of_mdio.h>
+#include <linux/of_net.h>
+#include <linux/of_platform.h>
+#include <linux/phy.h>
+#include <linux/platform_device.h>
+#include <linux/reset.h>
+#include <linux/version.h>
+
+/* DMA channels */
+#define DMA_CHAN_WIDTH			0x10
+
+/* Controller Configuration Register */
+#define DMA_CFG_REG			0x0
+#define DMA_CFG_EN_SHIFT		0
+#define DMA_CFG_EN_MASK			(1 << DMA_CFG_EN_SHIFT)
+#define DMA_CFG_FLOWCH_MASK(x)		(1 << ((x >> 1) + 1))
+
+/* Flow Control Descriptor Low Threshold register */
+#define DMA_FLOWCL_REG(x)		(0x4 + (x) * 6)
+
+/* Flow Control Descriptor High Threshold register */
+#define DMA_FLOWCH_REG(x)		(0x8 + (x) * 6)
+
+/* Flow Control Descriptor Buffer Alloca Threshold register */
+#define DMA_BUFALLOC_REG(x)		(0xc + (x) * 6)
+#define DMA_BUFALLOC_FORCE_SHIFT	31
+#define DMA_BUFALLOC_FORCE_MASK		(1 << DMA_BUFALLOC_FORCE_SHIFT)
+
+/* Channel Configuration register */
+#define DMAC_CHANCFG_REG		0x0
+#define DMAC_CHANCFG_EN_SHIFT		0
+#define DMAC_CHANCFG_EN_MASK		(1 << DMAC_CHANCFG_EN_SHIFT)
+#define DMAC_CHANCFG_PKTHALT_SHIFT	1
+#define DMAC_CHANCFG_PKTHALT_MASK	(1 << DMAC_CHANCFG_PKTHALT_SHIFT)
+#define DMAC_CHANCFG_BUFHALT_SHIFT	2
+#define DMAC_CHANCFG_BUFHALT_MASK	(1 << DMAC_CHANCFG_BUFHALT_SHIFT)
+#define DMAC_CHANCFG_CHAINING_SHIFT	2
+#define DMAC_CHANCFG_CHAINING_MASK	(1 << DMAC_CHANCFG_CHAINING_SHIFT)
+#define DMAC_CHANCFG_WRAP_EN_SHIFT	3
+#define DMAC_CHANCFG_WRAP_EN_MASK	(1 << DMAC_CHANCFG_WRAP_EN_SHIFT)
+#define DMAC_CHANCFG_FLOWC_EN_SHIFT	4
+#define DMAC_CHANCFG_FLOWC_EN_MASK	(1 << DMAC_CHANCFG_FLOWC_EN_SHIFT)
+
+/* Interrupt Control/Status register */
+#define DMAC_IR_REG			0x4
+#define DMAC_IR_BUFDONE_MASK		(1 << 0)
+#define DMAC_IR_PKTDONE_MASK		(1 << 1)
+#define DMAC_IR_NOTOWNER_MASK		(1 << 2)
+
+/* Interrupt Mask register */
+#define DMAC_IRMASK_REG			0x8
+
+/* Maximum Burst Length */
+#define DMAC_MAXBURST_REG		0xc
+
+/* Ring Start Address register */
+#define DMAS_RSTART_REG			0x0
+
+/* State Ram Word 2 */
+#define DMAS_SRAM2_REG			0x4
+
+/* State Ram Word 3 */
+#define DMAS_SRAM3_REG			0x8
+
+/* State Ram Word 4 */
+#define DMAS_SRAM4_REG			0xc
+
+struct bcm6348_iudma_desc {
+	u32 len_stat;
+	u32 address;
+};
+
+/* control */
+#define DMADESC_LENGTH_SHIFT		16
+#define DMADESC_LENGTH_MASK		(0xfff << DMADESC_LENGTH_SHIFT)
+#define DMADESC_OWNER_MASK		(1 << 15)
+#define DMADESC_EOP_MASK		(1 << 14)
+#define DMADESC_SOP_MASK		(1 << 13)
+#define DMADESC_ESOP_MASK		(DMADESC_EOP_MASK | DMADESC_SOP_MASK)
+#define DMADESC_WRAP_MASK		(1 << 12)
+
+/* status */
+#define DMADESC_UNDER_MASK		(1 << 9)
+#define DMADESC_APPEND_CRC		(1 << 8)
+#define DMADESC_OVSIZE_MASK		(1 << 4)
+#define DMADESC_RXER_MASK		(1 << 2)
+#define DMADESC_CRC_MASK		(1 << 1)
+#define DMADESC_OV_MASK			(1 << 0)
+#define DMADESC_ERR_MASK		(DMADESC_UNDER_MASK | \
+					 DMADESC_OVSIZE_MASK | \
+					 DMADESC_RXER_MASK | \
+					 DMADESC_CRC_MASK | \
+					 DMADESC_OV_MASK)
+
+struct bcm6348_iudma {
+	void __iomem *dma_base;
+	void __iomem *dma_chan;
+	void __iomem *dma_sram;
+
+	spinlock_t dma_base_lock;
+
+	struct clk **clock;
+	unsigned int num_clocks;
+
+	struct reset_control **reset;
+	unsigned int num_resets;
+
+	unsigned int dma_channels;
+};
+
+int bcm6348_iudma_drivers_register(struct platform_device *pdev);
+
+static inline u32 dma_readl(struct bcm6348_iudma *iudma, u32 off)
+{
+	u32 val;
+
+	spin_lock(&iudma->dma_base_lock);
+	val = __raw_readl(iudma->dma_base + off);
+	spin_unlock(&iudma->dma_base_lock);
+
+	return val;
+}
+
+static inline void dma_writel(struct bcm6348_iudma *iudma, u32 val, u32 off)
+{
+	spin_lock(&iudma->dma_base_lock);
+	__raw_writel(val, iudma->dma_base + off);
+	spin_unlock(&iudma->dma_base_lock);
+}
+
+static inline u32 dmac_readl(struct bcm6348_iudma *iudma, u32 off, int chan)
+{
+	return __raw_readl(iudma->dma_chan + chan * DMA_CHAN_WIDTH + off);
+}
+
+static inline void dmac_writel(struct bcm6348_iudma *iudma, u32 val, u32 off,
+			       int chan)
+{
+	__raw_writel(val, iudma->dma_chan + chan * DMA_CHAN_WIDTH + off);
+}
+
+static inline void dmas_writel(struct bcm6348_iudma *iudma, u32 val, u32 off,
+			       int chan)
+{
+	__raw_writel(val, iudma->dma_sram + chan * DMA_CHAN_WIDTH + off);
+}
+
+static void bcm6348_iudma_chan_stop(struct bcm6348_iudma *iudma, int chan)
+{
+	int limit = 1000;
+
+	dmac_writel(iudma, 0, DMAC_CHANCFG_REG, chan);
+
+	do {
+		u32 val;
+
+		val = dmac_readl(iudma, DMAC_CHANCFG_REG, chan);
+		if (!(val & DMAC_CHANCFG_EN_MASK))
+			break;
+
+		udelay(1);
+	} while (limit--);
+}
+
+static int bcm6348_iudma_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node;
+	struct bcm6348_iudma *iudma;
+	unsigned i;
+	int num_resets;
+	int ret;
+
+	iudma = devm_kzalloc(dev, sizeof(*iudma), GFP_KERNEL);
+	if (!iudma)
+		return -ENOMEM;
+
+	if (of_property_read_u32(node, "dma-channels", &iudma->dma_channels))
+		return -ENODEV;
+
+	iudma->dma_base = devm_platform_ioremap_resource_byname(pdev, "dma");
+	if (IS_ERR_OR_NULL(iudma->dma_base))
+		return PTR_ERR(iudma->dma_base);
+
+	iudma->dma_chan = devm_platform_ioremap_resource_byname(pdev,
+								"dma-channels");
+	if (IS_ERR_OR_NULL(iudma->dma_chan))
+		return PTR_ERR(iudma->dma_chan);
+
+	iudma->dma_sram = devm_platform_ioremap_resource_byname(pdev,
+								"dma-sram");
+	if (IS_ERR_OR_NULL(iudma->dma_sram))
+		return PTR_ERR(iudma->dma_sram);
+
+	iudma->num_clocks = of_clk_get_parent_count(node);
+	if (iudma->num_clocks) {
+		iudma->clock = devm_kcalloc(dev, iudma->num_clocks,
+					    sizeof(struct clk *), GFP_KERNEL);
+		if (IS_ERR_OR_NULL(iudma->clock))
+			return PTR_ERR(iudma->clock);
+	}
+	for (i = 0; i < iudma->num_clocks; i++) {
+		iudma->clock[i] = of_clk_get(node, i);
+		if (IS_ERR_OR_NULL(iudma->clock[i])) {
+			dev_err(dev, "error getting iudma clock %d\n", i);
+			return PTR_ERR(iudma->clock[i]);
+		}
+
+		ret = clk_prepare_enable(iudma->clock[i]);
+		if (ret) {
+			dev_err(dev, "error enabling iudma clock %d\n", i);
+			return ret;
+		}
+	}
+
+	num_resets = of_count_phandle_with_args(node, "resets",
+						"#reset-cells");
+	if (num_resets > 0)
+		iudma->num_resets = num_resets;
+	else
+		iudma->num_resets = 0;
+	if (iudma->num_resets) {
+		iudma->reset = devm_kcalloc(dev, iudma->num_resets,
+					    sizeof(struct reset_control *),
+					    GFP_KERNEL);
+		if (IS_ERR_OR_NULL(iudma->reset))
+			return PTR_ERR(iudma->reset);
+	}
+	for (i = 0; i < iudma->num_resets; i++) {
+		iudma->reset[i] = devm_reset_control_get_by_index(dev, i);
+		if (IS_ERR_OR_NULL(iudma->reset[i])) {
+			dev_err(dev, "error getting iudma reset %d\n", i);
+			return PTR_ERR(iudma->reset[i]);
+		}
+
+		ret = reset_control_reset(iudma->reset[i]);
+		if (ret) {
+			dev_err(dev, "error performing iudma reset %d\n", i);
+			return ret;
+		}
+	}
+
+	dma_writel(iudma, 0, DMA_CFG_REG);
+	for (i = 0; i < iudma->dma_channels; i++)
+		bcm6348_iudma_chan_stop(iudma, i);
+	dma_writel(iudma, DMA_CFG_EN_MASK, DMA_CFG_REG);
+
+	spin_lock_init(&iudma->dma_base_lock);
+
+	dev_info(dev, "bcm6348-iudma @ 0x%px\n", iudma->dma_base);
+
+	platform_set_drvdata(pdev, iudma);
+
+	return bcm6348_iudma_drivers_register(pdev);
+}
+
+static const struct of_device_id bcm6348_iudma_of_match[] = {
+	{ .compatible = "brcm,bcm6338-iudma", },
+	{ .compatible = "brcm,bcm6348-iudma", },
+	{ .compatible = "brcm,bcm6358-iudma", },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, bcm6348_emac_of_match);
+
+static struct platform_driver bcm6348_iudma_driver = {
+	.driver = {
+		.name = "bcm6348-iudma",
+		.of_match_table = of_match_ptr(bcm6348_iudma_of_match),
+	},
+	.probe	= bcm6348_iudma_probe,
+};
+module_platform_driver(bcm6348_iudma_driver);
+
+/*
+ * BCM6348 Eternet MACs
+ */
+
+/* MTU */
+#define ENET_MAX_MTU			2046
+
+#define ENET_TAG_SIZE			6
+#define ENET_MTU_OVERHEAD		(VLAN_ETH_HLEN + VLAN_HLEN + \
+					 ENET_TAG_SIZE)
+
+/* Default number of descriptor */
+#define ENET_DEF_RX_DESC		64
+#define ENET_DEF_TX_DESC		32
+#define ENET_DEF_CPY_BREAK		128
+
+/* Maximum burst len for dma (4 bytes unit) */
+#define ENET_DMA_MAXBURST		8
+
+/* Receiver Configuration register */
+#define ENET_RXCFG_REG			0x0
+#define ENET_RXCFG_ALLMCAST_SHIFT	1
+#define ENET_RXCFG_ALLMCAST_MASK	(1 << ENET_RXCFG_ALLMCAST_SHIFT)
+#define ENET_RXCFG_PROMISC_SHIFT	3
+#define ENET_RXCFG_PROMISC_MASK		(1 << ENET_RXCFG_PROMISC_SHIFT)
+#define ENET_RXCFG_LOOPBACK_SHIFT	4
+#define ENET_RXCFG_LOOPBACK_MASK	(1 << ENET_RXCFG_LOOPBACK_SHIFT)
+#define ENET_RXCFG_ENFLOW_SHIFT		5
+#define ENET_RXCFG_ENFLOW_MASK		(1 << ENET_RXCFG_ENFLOW_SHIFT)
+
+/* Receive Maximum Length register */
+#define ENET_RXMAXLEN_REG		0x4
+#define ENET_RXMAXLEN_SHIFT		0
+#define ENET_RXMAXLEN_MASK		(0x7ff << ENET_RXMAXLEN_SHIFT)
+
+/* Transmit Maximum Length register */
+#define ENET_TXMAXLEN_REG		0x8
+#define ENET_TXMAXLEN_SHIFT		0
+#define ENET_TXMAXLEN_MASK		(0x7ff << ENET_TXMAXLEN_SHIFT)
+
+/* MII Status/Control register */
+#define ENET_MIISC_REG			0x10
+#define ENET_MIISC_MDCFREQDIV_SHIFT	0
+#define ENET_MIISC_MDCFREQDIV_MASK	(0x7f << ENET_MIISC_MDCFREQDIV_SHIFT)
+#define ENET_MIISC_PREAMBLEEN_SHIFT	7
+#define ENET_MIISC_PREAMBLEEN_MASK	(1 << ENET_MIISC_PREAMBLEEN_SHIFT)
+
+/* MII Data register */
+#define ENET_MIID_REG			0x14
+#define ENET_MIID_DATA_SHIFT		0
+#define ENET_MIID_DATA_MASK		(0xffff << ENET_MIID_DATA_SHIFT)
+#define ENET_MIID_TA_SHIFT		16
+#define ENET_MIID_TA_MASK		(0x3 << ENET_MIID_TA_SHIFT)
+#define ENET_MIID_REG_SHIFT		18
+#define ENET_MIID_REG_MASK		(0x1f << ENET_MIID_REG_SHIFT)
+#define ENET_MIID_PHY_SHIFT		23
+#define ENET_MIID_PHY_MASK		(0x1f << ENET_MIID_PHY_SHIFT)
+#define ENET_MIID_OP_SHIFT		28
+#define ENET_MIID_OP_WRITE		(0x5 << ENET_MIID_OP_SHIFT)
+#define ENET_MIID_OP_READ		(0x6 << ENET_MIID_OP_SHIFT)
+
+/* Ethernet Interrupt Mask register */
+#define ENET_IRMASK_REG			0x18
+
+/* Ethernet Interrupt register */
+#define ENET_IR_REG			0x1c
+#define ENET_IR_MII			BIT(0)
+#define ENET_IR_MIB			BIT(1)
+#define ENET_IR_FLOWC			BIT(2)
+
+/* Ethernet Control register */
+#define ENET_CTL_REG			0x2c
+#define ENET_CTL_ENABLE_SHIFT		0
+#define ENET_CTL_ENABLE_MASK		(1 << ENET_CTL_ENABLE_SHIFT)
+#define ENET_CTL_DISABLE_SHIFT		1
+#define ENET_CTL_DISABLE_MASK		(1 << ENET_CTL_DISABLE_SHIFT)
+#define ENET_CTL_SRESET_SHIFT		2
+#define ENET_CTL_SRESET_MASK		(1 << ENET_CTL_SRESET_SHIFT)
+#define ENET_CTL_EPHYSEL_SHIFT		3
+#define ENET_CTL_EPHYSEL_MASK		(1 << ENET_CTL_EPHYSEL_SHIFT)
+
+/* Transmit Control register */
+#define ENET_TXCTL_REG			0x30
+#define ENET_TXCTL_FD_SHIFT		0
+#define ENET_TXCTL_FD_MASK		(1 << ENET_TXCTL_FD_SHIFT)
+
+/* Transmit Watermask register */
+#define ENET_TXWMARK_REG		0x34
+#define ENET_TXWMARK_WM_SHIFT		0
+#define ENET_TXWMARK_WM_MASK		(0x3f << ENET_TXWMARK_WM_SHIFT)
+
+/* MIB Control register */
+#define ENET_MIBCTL_REG			0x38
+#define ENET_MIBCTL_RDCLEAR_SHIFT	0
+#define ENET_MIBCTL_RDCLEAR_MASK	(1 << ENET_MIBCTL_RDCLEAR_SHIFT)
+
+/* Perfect Match Data Low register */
+#define ENET_PML_REG(x)			(0x58 + (x) * 8)
+#define ENET_PMH_REG(x)			(0x5c + (x) * 8)
+#define ENET_PMH_DATAVALID_SHIFT	16
+#define ENET_PMH_DATAVALID_MASK		(1 << ENET_PMH_DATAVALID_SHIFT)
+
+/* MIB register */
+#define ENET_MIB_REG(x)			(0x200 + (x) * 4)
+#define ENET_MIB_REG_COUNT		55
+
+/*
+ * TX transmit threshold (4 bytes unit), FIFO is 256 bytes, the value
+ * must be low enough so that a DMA transfer of above burst length can
+ * not overflow the fifo
+ */
+#define ENET_TX_FIFO_TRESH		32
+
+struct bcm6348_emac {
+	struct bcm6348_iudma *iudma;
+	void __iomem *base;
+
+	struct clk **clock;
+	unsigned int num_clocks;
+
+	struct reset_control **reset;
+	unsigned int num_resets;
+
+	int copybreak;
+
+	int irq_rx;
+	int irq_tx;
+
+	/* hw view of rx & tx dma ring */
+	dma_addr_t rx_desc_dma;
+	dma_addr_t tx_desc_dma;
+
+	/* allocated size (in bytes) for rx & tx dma ring */
+	unsigned int rx_desc_alloc_size;
+	unsigned int tx_desc_alloc_size;
+
+	struct napi_struct napi;
+
+	/* dma channel id for rx */
+	int rx_chan;
+
+	/* number of dma desc in rx ring */
+	int rx_ring_size;
+
+	/* cpu view of rx dma ring */
+	struct bcm6348_iudma_desc *rx_desc_cpu;
+
+	/* current number of armed descriptor given to hardware for rx */
+	int rx_desc_count;
+
+	/* next rx descriptor to fetch from hardware */
+	int rx_curr_desc;
+
+	/* next dirty rx descriptor to refill */
+	int rx_dirty_desc;
+
+	/* size of allocated rx skbs */
+	unsigned int rx_skb_size;
+
+	/* list of skb given to hw for rx */
+	struct sk_buff **rx_skb;
+
+	/* used when rx skb allocation failed, so we defer rx queue
+	 * refill */
+	struct timer_list rx_timeout;
+
+	/* lock rx_timeout against rx normal operation */
+	spinlock_t rx_lock;
+
+	/* dma channel id for tx */
+	int tx_chan;
+
+	/* number of dma desc in tx ring */
+	int tx_ring_size;
+
+	/* cpu view of tx dma ring */
+	struct bcm6348_iudma_desc *tx_desc_cpu;
+
+	/* number of available descriptor for tx */
+	int tx_desc_count;
+
+	/* next tx descriptor avaiable */
+	int tx_curr_desc;
+
+	/* next dirty tx descriptor to reclaim */
+	int tx_dirty_desc;
+
+	/* list of skb given to hw for tx */
+	struct sk_buff **tx_skb;
+
+	/* lock used by tx reclaim and xmit */
+	spinlock_t tx_lock;
+
+	/* network device reference */
+	struct net_device *net_dev;
+
+	/* platform device reference */
+	struct platform_device *pdev;
+
+	/* external mii bus */
+	bool ext_mii;
+
+	/* phy */
+	int old_link;
+	int old_duplex;
+	int old_pause;
+};
+
+static inline void emac_writel(struct bcm6348_emac *emac, u32 val, u32 off)
+{
+	__raw_writel(val, emac->base + off);
+}
+
+static inline u32 emac_readl(struct bcm6348_emac *emac, u32 off)
+{
+	return __raw_readl(emac->base + off);
+}
+
+/*
+ * refill rx queue
+ */
+static int bcm6348_emac_refill_rx(struct net_device *ndev)
+{
+	struct bcm6348_emac *emac = netdev_priv(ndev);
+	struct bcm6348_iudma *iudma = emac->iudma;
+	struct platform_device *pdev = emac->pdev;
+	struct device *dev = &pdev->dev;
+
+	while (emac->rx_desc_count < emac->rx_ring_size) {
+		struct bcm6348_iudma_desc *desc;
+		struct sk_buff *skb;
+		dma_addr_t p;
+		int desc_idx;
+		u32 len_stat;
+
+		desc_idx = emac->rx_dirty_desc;
+		desc = &emac->rx_desc_cpu[desc_idx];
+
+		if (!emac->rx_skb[desc_idx]) {
+			skb = netdev_alloc_skb(ndev, emac->rx_skb_size);
+			if (!skb)
+				break;
+			emac->rx_skb[desc_idx] = skb;
+			p = dma_map_single(dev, skb->data, emac->rx_skb_size,
+					   DMA_FROM_DEVICE);
+			desc->address = p;
+		}
+
+		len_stat = emac->rx_skb_size << DMADESC_LENGTH_SHIFT;
+		len_stat |= DMADESC_OWNER_MASK;
+		if (emac->rx_dirty_desc == emac->rx_ring_size - 1) {
+			len_stat |= DMADESC_WRAP_MASK;
+			emac->rx_dirty_desc = 0;
+		} else {
+			emac->rx_dirty_desc++;
+		}
+		wmb();
+		desc->len_stat = len_stat;
+
+		emac->rx_desc_count++;
+
+		/* tell dma engine we allocated one buffer */
+		dma_writel(iudma, 1, DMA_BUFALLOC_REG(emac->rx_chan));
+	}
+
+	/* If rx ring is still empty, set a timer to try allocating
+	 * again at a later time. */
+	if (emac->rx_desc_count == 0 && netif_running(ndev)) {
+		dev_warn(dev, "unable to refill rx ring\n");
+		emac->rx_timeout.expires = jiffies + HZ;
+		add_timer(&emac->rx_timeout);
+	}
+
+	return 0;
+}
+
+/*
+ * timer callback to defer refill rx queue in case we're OOM
+ */
+static void bcm6348_emac_refill_rx_timer(struct timer_list *t)
+{
+	struct bcm6348_emac *emac = from_timer(emac, t, rx_timeout);
+	struct net_device *ndev = emac->net_dev;
+
+	spin_lock(&emac->rx_lock);
+	bcm6348_emac_refill_rx(ndev);
+	spin_unlock(&emac->rx_lock);
+}
+
+/*
+ * extract packet from rx queue
+ */
+static int bcm6348_emac_receive_queue(struct net_device *ndev, int budget)
+{
+	struct bcm6348_emac *emac = netdev_priv(ndev);
+	struct bcm6348_iudma *iudma = emac->iudma;
+	struct platform_device *pdev = emac->pdev;
+	struct device *dev = &pdev->dev;
+	int processed = 0;
+
+	/* don't scan ring further than number of refilled
+	 * descriptor */
+	if (budget > emac->rx_desc_count)
+		budget = emac->rx_desc_count;
+
+	do {
+		struct bcm6348_iudma_desc *desc;
+		struct sk_buff *skb;
+		int desc_idx;
+		u32 len_stat;
+		unsigned int len;
+
+		desc_idx = emac->rx_curr_desc;
+		desc = &emac->rx_desc_cpu[desc_idx];
+
+		/* make sure we actually read the descriptor status at
+		 * each loop */
+		rmb();
+
+		len_stat = desc->len_stat;
+
+		/* break if dma ownership belongs to hw */
+		if (len_stat & DMADESC_OWNER_MASK)
+			break;
+
+		processed++;
+		emac->rx_curr_desc++;
+		if (emac->rx_curr_desc == emac->rx_ring_size)
+			emac->rx_curr_desc = 0;
+		emac->rx_desc_count--;
+
+		/* if the packet does not have start of packet _and_
+		 * end of packet flag set, then just recycle it */
+		if ((len_stat & DMADESC_ESOP_MASK) != DMADESC_ESOP_MASK) {
+			ndev->stats.rx_dropped++;
+			continue;
+		}
+
+		/* valid packet */
+		skb = emac->rx_skb[desc_idx];
+		len = (len_stat & DMADESC_LENGTH_MASK)
+		      >> DMADESC_LENGTH_SHIFT;
+		/* don't include FCS */
+		len -= 4;
+
+		if (len < emac->copybreak) {
+			struct sk_buff *nskb;
+
+			nskb = napi_alloc_skb(&emac->napi, len);
+			if (!nskb) {
+				/* forget packet, just rearm desc */
+				ndev->stats.rx_dropped++;
+				continue;
+			}
+
+			dma_sync_single_for_cpu(dev, desc->address,
+						len, DMA_FROM_DEVICE);
+			memcpy(nskb->data, skb->data, len);
+			dma_sync_single_for_device(dev, desc->address,
+						   len, DMA_FROM_DEVICE);
+			skb = nskb;
+		} else {
+			dma_unmap_single(dev, desc->address,
+					 emac->rx_skb_size, DMA_FROM_DEVICE);
+			emac->rx_skb[desc_idx] = NULL;
+		}
+
+		skb_put(skb, len);
+		skb->protocol = eth_type_trans(skb, ndev);
+		ndev->stats.rx_packets++;
+		ndev->stats.rx_bytes += len;
+		netif_receive_skb(skb);
+	} while (--budget > 0);
+
+	if (processed || !emac->rx_desc_count) {
+		bcm6348_emac_refill_rx(ndev);
+
+		/* kick rx dma */
+		dmac_writel(iudma, DMAC_CHANCFG_EN_MASK, DMAC_CHANCFG_REG,
+			    emac->rx_chan);
+	}
+
+	return processed;
+}
+
+/*
+ * try to or force reclaim of transmitted buffers
+ */
+static int bcm6348_emac_tx_reclaim(struct net_device *ndev, int force)
+{
+	struct bcm6348_emac *emac = netdev_priv(ndev);
+	struct platform_device *pdev = emac->pdev;
+	struct device *dev = &pdev->dev;
+	int released = 0;
+
+	while (emac->tx_desc_count < emac->tx_ring_size) {
+		struct bcm6348_iudma_desc *desc;
+		struct sk_buff *skb;
+
+		/* We run in a bh and fight against start_xmit, which
+		 * is called with bh disabled */
+		spin_lock(&emac->tx_lock);
+
+		desc = &emac->tx_desc_cpu[emac->tx_dirty_desc];
+
+		if (!force && (desc->len_stat & DMADESC_OWNER_MASK)) {
+			spin_unlock(&emac->tx_lock);
+			break;
+		}
+
+		/* ensure other field of the descriptor were not read
+		 * before we checked ownership */
+		rmb();
+
+		skb = emac->tx_skb[emac->tx_dirty_desc];
+		emac->tx_skb[emac->tx_dirty_desc] = NULL;
+		dma_unmap_single(dev, desc->address, skb->len, DMA_TO_DEVICE);
+
+		emac->tx_dirty_desc++;
+		if (emac->tx_dirty_desc == emac->tx_ring_size)
+			emac->tx_dirty_desc = 0;
+		emac->tx_desc_count++;
+
+		spin_unlock(&emac->tx_lock);
+
+		if (desc->len_stat & DMADESC_UNDER_MASK)
+			ndev->stats.tx_errors++;
+
+		dev_kfree_skb(skb);
+		released++;
+	}
+
+	if (netif_queue_stopped(ndev) && released)
+		netif_wake_queue(ndev);
+
+	return released;
+}
+
+static int bcm6348_emac_poll(struct napi_struct *napi, int budget)
+{
+	struct bcm6348_emac *emac = container_of(napi, struct bcm6348_emac,
+						 napi);
+	struct bcm6348_iudma *iudma = emac->iudma;
+	struct net_device *ndev = emac->net_dev;
+	int rx_work_done;
+
+	/* ack interrupts */
+	dmac_writel(iudma, DMAC_IR_PKTDONE_MASK, DMAC_IR_REG,
+		    emac->rx_chan);
+	dmac_writel(iudma, DMAC_IR_PKTDONE_MASK, DMAC_IR_REG,
+		    emac->tx_chan);
+
+	/* reclaim sent skb */
+	bcm6348_emac_tx_reclaim(ndev, 0);
+
+	spin_lock(&emac->rx_lock);
+	rx_work_done = bcm6348_emac_receive_queue(ndev, budget);
+	spin_unlock(&emac->rx_lock);
+
+	if (rx_work_done >= budget) {
+		/* rx queue is not yet empty/clean */
+		return rx_work_done;
+	}
+
+	/* no more packet in rx/tx queue, remove device from poll
+	 * queue */
+	napi_complete_done(napi, rx_work_done);
+
+	/* restore rx/tx interrupt */
+	dmac_writel(iudma, DMAC_IR_PKTDONE_MASK, DMAC_IRMASK_REG,
+		    emac->rx_chan);
+	dmac_writel(iudma, DMAC_IR_PKTDONE_MASK, DMAC_IRMASK_REG,
+		    emac->tx_chan);
+
+	return rx_work_done;
+}
+
+/*
+ * emac interrupt handler
+ */
+static irqreturn_t bcm6348_emac_isr_mac(int irq, void *dev_id)
+{
+	struct net_device *ndev = dev_id;
+	struct bcm6348_emac *emac = netdev_priv(ndev);
+	u32 stat;
+
+	stat = emac_readl(emac, ENET_IR_REG);
+	if (!(stat & ENET_IR_MIB))
+		return IRQ_NONE;
+
+	/* clear & mask interrupt */
+	emac_writel(emac, ENET_IR_MIB, ENET_IR_REG);
+	emac_writel(emac, 0, ENET_IRMASK_REG);
+
+	return IRQ_HANDLED;
+}
+
+/*
+ * rx/tx dma interrupt handler
+ */
+static irqreturn_t bcm6348_emac_isr_dma(int irq, void *dev_id)
+{
+	struct net_device *ndev = dev_id;
+	struct bcm6348_emac *emac = netdev_priv(ndev);
+	struct bcm6348_iudma *iudma = emac->iudma;
+
+	/* mask rx/tx interrupts */
+	dmac_writel(iudma, 0, DMAC_IRMASK_REG, emac->rx_chan);
+	dmac_writel(iudma, 0, DMAC_IRMASK_REG, emac->tx_chan);
+
+	napi_schedule(&emac->napi);
+
+	return IRQ_HANDLED;
+}
+
+/*
+ * tx request callback
+ */
+static netdev_tx_t bcm6348_emac_start_xmit(struct sk_buff *skb,
+					   struct net_device *ndev)
+{
+	struct bcm6348_emac *emac = netdev_priv(ndev);
+	struct bcm6348_iudma *iudma = emac->iudma;
+	struct platform_device *pdev = emac->pdev;
+	struct device *dev = &pdev->dev;
+	struct bcm6348_iudma_desc *desc;
+	u32 len_stat;
+	netdev_tx_t ret;
+
+	/* lock against tx reclaim */
+	spin_lock(&emac->tx_lock);
+
+	/* make sure the tx hw queue is not full, should not happen
+	 * since we stop queue before it's the case */
+	if (unlikely(!emac->tx_desc_count)) {
+		netif_stop_queue(ndev);
+		dev_err(dev, "xmit called with no tx desc available?\n");
+		ret = NETDEV_TX_BUSY;
+		goto out_unlock;
+	}
+
+	/* point to the next available desc */
+	desc = &emac->tx_desc_cpu[emac->tx_curr_desc];
+	emac->tx_skb[emac->tx_curr_desc] = skb;
+
+	/* fill descriptor */
+	desc->address = dma_map_single(dev, skb->data, skb->len,
+				       DMA_TO_DEVICE);
+
+	len_stat = (skb->len << DMADESC_LENGTH_SHIFT) & DMADESC_LENGTH_MASK;
+	len_stat |= DMADESC_ESOP_MASK | DMADESC_APPEND_CRC |
+		    DMADESC_OWNER_MASK;
+
+	emac->tx_curr_desc++;
+	if (emac->tx_curr_desc == emac->tx_ring_size) {
+		emac->tx_curr_desc = 0;
+		len_stat |= DMADESC_WRAP_MASK;
+	}
+	emac->tx_desc_count--;
+
+	/* dma might be already polling, make sure we update desc
+	 * fields in correct order */
+	wmb();
+	desc->len_stat = len_stat;
+	wmb();
+
+	/* kick tx dma */
+	dmac_writel(iudma, DMAC_CHANCFG_EN_MASK, DMAC_CHANCFG_REG,
+		    emac->tx_chan);
+
+	/* stop queue if no more desc available */
+	if (!emac->tx_desc_count)
+		netif_stop_queue(ndev);
+
+	ndev->stats.tx_bytes += skb->len;
+	ndev->stats.tx_packets++;
+	ret = NETDEV_TX_OK;
+
+out_unlock:
+	spin_unlock(&emac->tx_lock);
+	return ret;
+}
+
+/*
+ * Change the interface's emac address.
+ */
+static int bcm6348_emac_set_mac_address(struct net_device *ndev, void *p)
+{
+	struct bcm6348_emac *emac = netdev_priv(ndev);
+	struct sockaddr *addr = p;
+	u32 val;
+
+	eth_hw_addr_set(ndev, addr->sa_data);
+
+	/* use perfect match register 0 to store my emac address */
+	val = (ndev->dev_addr[2] << 24) | (ndev->dev_addr[3] << 16) |
+		(ndev->dev_addr[4] << 8) | ndev->dev_addr[5];
+	emac_writel(emac, val, ENET_PML_REG(0));
+
+	val = (ndev->dev_addr[0] << 8 | ndev->dev_addr[1]);
+	val |= ENET_PMH_DATAVALID_MASK;
+	emac_writel(emac, val, ENET_PMH_REG(0));
+
+	return 0;
+}
+
+/*
+ * Change rx mode (promiscuous/allmulti) and update multicast list
+ */
+static void bcm6348_emac_set_multicast_list(struct net_device *ndev)
+{
+	struct bcm6348_emac *emac = netdev_priv(ndev);
+	struct netdev_hw_addr *ha;
+	u32 val;
+	unsigned int i;
+
+	val = emac_readl(emac, ENET_RXCFG_REG);
+
+	if (ndev->flags & IFF_PROMISC)
+		val |= ENET_RXCFG_PROMISC_MASK;
+	else
+		val &= ~ENET_RXCFG_PROMISC_MASK;
+
+	/* only 3 perfect match registers left, first one is used for
+	 * own mac address */
+	if ((ndev->flags & IFF_ALLMULTI) || netdev_mc_count(ndev) > 3)
+		val |= ENET_RXCFG_ALLMCAST_MASK;
+	else
+		val &= ~ENET_RXCFG_ALLMCAST_MASK;
+
+	/* no need to set perfect match registers if we catch all
+	 * multicast */
+	if (val & ENET_RXCFG_ALLMCAST_MASK) {
+		emac_writel(emac, val, ENET_RXCFG_REG);
+		return;
+	}
+
+	i = 0;
+	netdev_for_each_mc_addr(ha, ndev) {
+		u8 *dmi_addr;
+		u32 tmp;
+
+		if (i == 3)
+			break;
+
+		/* update perfect match registers */
+		dmi_addr = ha->addr;
+		tmp = (dmi_addr[2] << 24) | (dmi_addr[3] << 16) |
+			(dmi_addr[4] << 8) | dmi_addr[5];
+		emac_writel(emac, tmp, ENET_PML_REG(i + 1));
+
+		tmp = (dmi_addr[0] << 8 | dmi_addr[1]);
+		tmp |= ENET_PMH_DATAVALID_MASK;
+		emac_writel(emac, tmp, ENET_PMH_REG(i++ + 1));
+	}
+
+	for (; i < 3; i++) {
+		emac_writel(emac, 0, ENET_PML_REG(i + 1));
+		emac_writel(emac, 0, ENET_PMH_REG(i + 1));
+	}
+
+	emac_writel(emac, val, ENET_RXCFG_REG);
+}
+
+/*
+ * disable emac
+ */
+static void bcm6348_emac_disable_mac(struct bcm6348_emac *emac)
+{
+	int limit;
+	u32 val;
+
+	val = emac_readl(emac, ENET_CTL_REG);
+	val |= ENET_CTL_DISABLE_MASK;
+	emac_writel(emac, val, ENET_CTL_REG);
+
+	limit = 1000;
+	do {
+		val = emac_readl(emac, ENET_CTL_REG);
+		if (!(val & ENET_CTL_DISABLE_MASK))
+			break;
+		udelay(1);
+	} while (limit--);
+}
+
+/*
+ * set emac duplex parameters
+ */
+static void bcm6348_emac_set_duplex(struct bcm6348_emac *emac, int fullduplex)
+{
+	u32 val;
+
+	val = emac_readl(emac, ENET_TXCTL_REG);
+	if (fullduplex)
+		val |= ENET_TXCTL_FD_MASK;
+	else
+		val &= ~ENET_TXCTL_FD_MASK;
+	emac_writel(emac, val, ENET_TXCTL_REG);
+}
+
+/*
+ * set emac flow control parameters
+ */
+static void bcm6348_emac_set_flow(struct bcm6348_emac *emac, bool rx_en, bool tx_en)
+{
+	struct bcm6348_iudma *iudma = emac->iudma;
+	u32 val;
+
+	val = emac_readl(emac, ENET_RXCFG_REG);
+	if (rx_en)
+		val |= ENET_RXCFG_ENFLOW_MASK;
+	else
+		val &= ~ENET_RXCFG_ENFLOW_MASK;
+	emac_writel(emac, val, ENET_RXCFG_REG);
+
+	dmas_writel(iudma, emac->rx_desc_dma, DMAS_RSTART_REG, emac->rx_chan);
+	dmas_writel(iudma, emac->tx_desc_dma, DMAS_RSTART_REG, emac->tx_chan);
+
+	val = dma_readl(iudma, DMA_CFG_REG);
+	if (tx_en)
+		val |= DMA_CFG_FLOWCH_MASK(emac->rx_chan);
+	else
+		val &= ~DMA_CFG_FLOWCH_MASK(emac->rx_chan);
+	dma_writel(iudma, val, DMA_CFG_REG);
+}
+
+/*
+ * adjust emac phy
+ */
+static void bcm6348_emac_adjust_phy(struct net_device *ndev)
+{
+	struct phy_device *phydev = ndev->phydev;
+	struct bcm6348_emac *emac = netdev_priv(ndev);
+	struct platform_device *pdev = emac->pdev;
+	struct device *dev = &pdev->dev;
+	bool status_changed = false;
+
+	if (emac->old_link != phydev->link) {
+		status_changed = true;
+		emac->old_link = phydev->link;
+	}
+
+	if (phydev->link && phydev->duplex != emac->old_duplex) {
+		bcm6348_emac_set_duplex(emac, phydev->duplex == DUPLEX_FULL);
+		status_changed = true;
+		emac->old_duplex = phydev->duplex;
+	}
+
+	if (phydev->link && phydev->pause != emac->old_pause) {
+		bool rx_pause_en, tx_pause_en;
+
+		if (phydev->pause) {
+			rx_pause_en = true;
+			tx_pause_en = true;
+		} else {
+			rx_pause_en = false;
+			tx_pause_en = false;
+		}
+
+		bcm6348_emac_set_flow(emac, rx_pause_en, tx_pause_en);
+		status_changed = true;
+		emac->old_pause = phydev->pause;
+	}
+
+	if (status_changed)
+		dev_info(dev, "%s: phy link %s %s/%s/%s/%s\n",
+			 ndev->name,
+			 phydev->link ? "UP" : "DOWN",
+			 phy_modes(phydev->interface),
+			 phy_speed_to_str(phydev->speed),
+			 phy_duplex_to_str(phydev->duplex),
+			 phydev->pause ? "rx/tx" : "off");
+}
+
+
+static int bcm6348_emac_open(struct net_device *ndev)
+{
+	struct bcm6348_emac *emac = netdev_priv(ndev);
+	struct bcm6348_iudma *iudma = emac->iudma;
+	struct platform_device *pdev = emac->pdev;
+	struct device *dev = &pdev->dev;
+	struct sockaddr addr;
+	unsigned int i, size;
+	int ret;
+	void *p;
+	u32 val;
+
+	/* mask all interrupts and request them */
+	emac_writel(emac, 0, ENET_IRMASK_REG);
+	dmac_writel(iudma, 0, DMAC_IRMASK_REG, emac->rx_chan);
+	dmac_writel(iudma, 0, DMAC_IRMASK_REG, emac->tx_chan);
+
+	ret = request_irq(ndev->irq, bcm6348_emac_isr_mac, 0, ndev->name,
+			  ndev);
+	if (ret)
+		return ret;
+
+	ret = request_irq(emac->irq_rx, bcm6348_emac_isr_dma,
+			  0, ndev->name, ndev);
+	if (ret)
+		goto out_freeirq;
+
+	ret = request_irq(emac->irq_tx, bcm6348_emac_isr_dma,
+			  0, ndev->name, ndev);
+	if (ret)
+		goto out_freeirq_rx;
+
+	/* initialize perfect match registers */
+	for (i = 0; i < 4; i++) {
+		emac_writel(emac, 0, ENET_PML_REG(i));
+		emac_writel(emac, 0, ENET_PMH_REG(i));
+	}
+
+	/* write device mac address */
+	memcpy(addr.sa_data, ndev->dev_addr, ETH_ALEN);
+	bcm6348_emac_set_mac_address(ndev, &addr);
+
+	/* allocate rx dma ring */
+	size = emac->rx_ring_size * sizeof(struct bcm6348_iudma_desc);
+	p = dma_alloc_coherent(dev, size, &emac->rx_desc_dma, GFP_KERNEL);
+	if (!p) {
+		dev_err(dev, "cannot allocate rx ring %u\n", size);
+		ret = -ENOMEM;
+		goto out_freeirq_tx;
+	}
+
+	memset(p, 0, size);
+	emac->rx_desc_alloc_size = size;
+	emac->rx_desc_cpu = p;
+
+	/* allocate tx dma ring */
+	size = emac->tx_ring_size * sizeof(struct bcm6348_iudma_desc);
+	p = dma_alloc_coherent(dev, size, &emac->tx_desc_dma, GFP_KERNEL);
+	if (!p) {
+		dev_err(dev, "cannot allocate tx ring\n");
+		ret = -ENOMEM;
+		goto out_free_rx_ring;
+	}
+
+	memset(p, 0, size);
+	emac->tx_desc_alloc_size = size;
+	emac->tx_desc_cpu = p;
+
+	emac->tx_skb = kzalloc(sizeof(struct sk_buff *) * emac->tx_ring_size,
+			       GFP_KERNEL);
+	if (!emac->tx_skb) {
+		dev_err(dev, "cannot allocate rx skb queue\n");
+		ret = -ENOMEM;
+		goto out_free_tx_ring;
+	}
+
+	emac->tx_desc_count = emac->tx_ring_size;
+	emac->tx_dirty_desc = 0;
+	emac->tx_curr_desc = 0;
+	spin_lock_init(&emac->tx_lock);
+
+	/* init & fill rx ring with skbs */
+	emac->rx_skb = kzalloc(sizeof(struct sk_buff *) * emac->rx_ring_size,
+			       GFP_KERNEL);
+	if (!emac->rx_skb) {
+		dev_err(dev, "cannot allocate rx skb queue\n");
+		ret = -ENOMEM;
+		goto out_free_tx_skb;
+	}
+
+	emac->rx_desc_count = 0;
+	emac->rx_dirty_desc = 0;
+	emac->rx_curr_desc = 0;
+
+	/* initialize flow control buffer allocation */
+	dma_writel(iudma, DMA_BUFALLOC_FORCE_MASK | 0,
+		   DMA_BUFALLOC_REG(emac->rx_chan));
+
+	if (bcm6348_emac_refill_rx(ndev)) {
+		dev_err(dev, "cannot allocate rx skb queue\n");
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	/* write rx & tx ring addresses */
+	dmas_writel(iudma, emac->rx_desc_dma,
+		    DMAS_RSTART_REG, emac->rx_chan);
+	dmas_writel(iudma, emac->tx_desc_dma,
+		    DMAS_RSTART_REG, emac->tx_chan);
+
+	/* clear remaining state ram for rx & tx channel */
+	dmas_writel(iudma, 0, DMAS_SRAM2_REG, emac->rx_chan);
+	dmas_writel(iudma, 0, DMAS_SRAM2_REG, emac->tx_chan);
+	dmas_writel(iudma, 0, DMAS_SRAM3_REG, emac->rx_chan);
+	dmas_writel(iudma, 0, DMAS_SRAM3_REG, emac->tx_chan);
+	dmas_writel(iudma, 0, DMAS_SRAM4_REG, emac->rx_chan);
+	dmas_writel(iudma, 0, DMAS_SRAM4_REG, emac->tx_chan);
+
+	/* set max rx/tx length */
+	emac_writel(emac, ndev->mtu, ENET_RXMAXLEN_REG);
+	emac_writel(emac, ndev->mtu, ENET_TXMAXLEN_REG);
+
+	/* set dma maximum burst len */
+	dmac_writel(iudma, ENET_DMA_MAXBURST,
+		    DMAC_MAXBURST_REG, emac->rx_chan);
+	dmac_writel(iudma, ENET_DMA_MAXBURST,
+		    DMAC_MAXBURST_REG, emac->tx_chan);
+
+	/* set correct transmit fifo watermark */
+	emac_writel(emac, ENET_TX_FIFO_TRESH, ENET_TXWMARK_REG);
+
+	/* set flow control low/high threshold to 1/3 / 2/3 */
+	val = emac->rx_ring_size / 3;
+	dma_writel(iudma, val, DMA_FLOWCL_REG(emac->rx_chan));
+	val = (emac->rx_ring_size * 2) / 3;
+	dma_writel(iudma, val, DMA_FLOWCH_REG(emac->rx_chan));
+
+	/* all set, enable emac and interrupts, start dma engine and
+	 * kick rx dma channel
+	 */
+	wmb();
+	val = emac_readl(emac, ENET_CTL_REG);
+	val |= ENET_CTL_ENABLE_MASK;
+	emac_writel(emac, val, ENET_CTL_REG);
+	dmac_writel(iudma, DMAC_CHANCFG_EN_MASK,
+		    DMAC_CHANCFG_REG, emac->rx_chan);
+
+	/* watch "mib counters about to overflow" interrupt */
+	emac_writel(emac, ENET_IR_MIB, ENET_IR_REG);
+	emac_writel(emac, ENET_IR_MIB, ENET_IRMASK_REG);
+
+	/* watch "packet transferred" interrupt in rx and tx */
+	dmac_writel(iudma, DMAC_IR_PKTDONE_MASK,
+		    DMAC_IR_REG, emac->rx_chan);
+	dmac_writel(iudma, DMAC_IR_PKTDONE_MASK,
+		    DMAC_IR_REG, emac->tx_chan);
+
+	/* make sure we enable napi before rx interrupt  */
+	napi_enable(&emac->napi);
+
+	dmac_writel(iudma, DMAC_IR_PKTDONE_MASK,
+		    DMAC_IRMASK_REG, emac->rx_chan);
+	dmac_writel(iudma, DMAC_IR_PKTDONE_MASK,
+		    DMAC_IRMASK_REG, emac->tx_chan);
+
+	if (ndev->phydev)
+		phy_start(ndev->phydev);
+
+	netif_carrier_on(ndev);
+	netif_start_queue(ndev);
+
+	return 0;
+
+out:
+	for (i = 0; i < emac->rx_ring_size; i++) {
+		struct bcm6348_iudma_desc *desc;
+
+		if (!emac->rx_skb[i])
+			continue;
+
+		desc = &emac->rx_desc_cpu[i];
+		dma_unmap_single(dev, desc->address, emac->rx_skb_size,
+				 DMA_FROM_DEVICE);
+		kfree_skb(emac->rx_skb[i]);
+	}
+	kfree(emac->rx_skb);
+
+out_free_tx_skb:
+	kfree(emac->tx_skb);
+
+out_free_tx_ring:
+	dma_free_coherent(dev, emac->tx_desc_alloc_size,
+			  emac->tx_desc_cpu, emac->tx_desc_dma);
+
+out_free_rx_ring:
+	dma_free_coherent(dev, emac->rx_desc_alloc_size,
+			  emac->rx_desc_cpu, emac->rx_desc_dma);
+
+out_freeirq_tx:
+	if (emac->irq_tx != -1)
+		free_irq(emac->irq_tx, ndev);
+
+out_freeirq_rx:
+	free_irq(emac->irq_rx, ndev);
+
+out_freeirq:
+	if (ndev->phydev)
+		phy_disconnect(ndev->phydev);
+
+	return ret;
+}
+
+static int bcm6348_emac_stop(struct net_device *ndev)
+{
+	struct bcm6348_emac *emac = netdev_priv(ndev);
+	struct bcm6348_iudma *iudma = emac->iudma;
+	struct device *dev = &emac->pdev->dev;
+	unsigned int i;
+
+	netif_stop_queue(ndev);
+	napi_disable(&emac->napi);
+	if (ndev->phydev)
+		phy_stop(ndev->phydev);
+	del_timer_sync(&emac->rx_timeout);
+
+	/* mask all interrupts */
+	emac_writel(emac, 0, ENET_IRMASK_REG);
+	dmac_writel(iudma, 0, DMAC_IRMASK_REG, emac->rx_chan);
+	dmac_writel(iudma, 0, DMAC_IRMASK_REG, emac->tx_chan);
+
+	/* disable dma & emac */
+	bcm6348_iudma_chan_stop(iudma, emac->tx_chan);
+	bcm6348_iudma_chan_stop(iudma, emac->rx_chan);
+	bcm6348_emac_disable_mac(emac);
+
+	/* force reclaim of all tx buffers */
+	bcm6348_emac_tx_reclaim(ndev, 1);
+
+	/* free the rx skb ring */
+	for (i = 0; i < emac->rx_ring_size; i++) {
+		struct bcm6348_iudma_desc *desc;
+
+		if (!emac->rx_skb[i])
+			continue;
+
+		desc = &emac->rx_desc_cpu[i];
+		dma_unmap_single_attrs(dev, desc->address, emac->rx_skb_size,
+				       DMA_FROM_DEVICE,
+				       DMA_ATTR_SKIP_CPU_SYNC);
+		kfree_skb(emac->rx_skb[i]);
+	}
+
+	/* free remaining allocated memory */
+	kfree(emac->rx_skb);
+	kfree(emac->tx_skb);
+	dma_free_coherent(dev, emac->rx_desc_alloc_size, emac->rx_desc_cpu,
+			  emac->rx_desc_dma);
+	dma_free_coherent(dev, emac->tx_desc_alloc_size, emac->tx_desc_cpu,
+			  emac->tx_desc_dma);
+	free_irq(emac->irq_tx, ndev);
+	free_irq(emac->irq_rx, ndev);
+	free_irq(ndev->irq, ndev);
+
+	netdev_reset_queue(ndev);
+
+	return 0;
+}
+
+static const struct net_device_ops bcm6348_emac_ops = {
+	.ndo_open = bcm6348_emac_open,
+	.ndo_stop = bcm6348_emac_stop,
+	.ndo_start_xmit = bcm6348_emac_start_xmit,
+	.ndo_set_mac_address = bcm6348_emac_set_mac_address,
+	.ndo_set_rx_mode = bcm6348_emac_set_multicast_list,
+};
+
+static int bcm6348_emac_mdio_op(struct bcm6348_emac *emac, uint32_t data)
+{
+	int limit;
+
+	/* Make sure mii interrupt status is cleared */
+	emac_writel(emac, ENET_IR_MII, ENET_IR_REG);
+
+	/* Issue mii op */
+	emac_writel(emac, data, ENET_MIID_REG);
+	wmb();
+
+	/* busy wait on mii interrupt bit, with timeout */
+	limit = 1000;
+	do {
+		if (emac_readl(emac, ENET_IR_REG) & ENET_IR_MII)
+			break;
+		udelay(1);
+	} while (limit-- > 0);
+
+	return (limit < 0) ? 1 : 0;
+}
+
+static int bcm6348_emac_mdio_read(struct mii_bus *bus, int phy_id, int loc)
+{
+	struct bcm6348_emac *emac = bus->priv;
+	struct platform_device *pdev = emac->pdev;
+	struct device *dev = &pdev->dev;
+	uint32_t reg;
+
+	reg = 0x2 << ENET_MIID_TA_SHIFT;
+	reg |= loc << ENET_MIID_REG_SHIFT;
+	reg |= phy_id << ENET_MIID_PHY_SHIFT;
+	reg |= ENET_MIID_OP_READ;
+
+	if (bcm6348_emac_mdio_op(emac, reg)) {
+		dev_err(dev, "mdio_read: phy=%d loc=%x timeout!\n",
+			phy_id, loc);
+		return -EINVAL;
+	}
+
+	reg = emac_readl(emac, ENET_MIID_REG);
+	reg = (reg >> ENET_MIID_DATA_SHIFT) & ENET_MIID_DATA_MASK;
+
+	return (int) reg;
+}
+
+static int bcm6348_emac_mdio_write(struct mii_bus *bus, int phy_id,
+				   int loc, uint16_t val)
+{
+	struct bcm6348_emac *emac = bus->priv;
+	struct platform_device *pdev = emac->pdev;
+	struct device *dev = &pdev->dev;
+	uint32_t reg;
+
+	reg = (val << ENET_MIID_DATA_SHIFT) & ENET_MIID_DATA_MASK;
+	reg |= 0x2 << ENET_MIID_TA_SHIFT;
+	reg |= loc << ENET_MIID_REG_SHIFT;
+	reg |= phy_id << ENET_MIID_PHY_SHIFT;
+	reg |= ENET_MIID_OP_WRITE;
+
+	if (bcm6348_emac_mdio_op(emac, reg)) {
+		dev_err(dev, "mdio_write: phy=%d loc=%x timeout!\n",
+			phy_id, loc);
+		return -EINVAL;
+	}
+
+	bcm6348_emac_mdio_op(emac, reg);
+
+	return 0;
+}
+
+static int bcm6348_emac_mdio_init(struct bcm6348_emac *emac,
+				  struct device_node *np)
+{
+	struct platform_device *pdev = emac->pdev;
+	struct device *dev = &pdev->dev;
+	struct device_node *mnp;
+	struct mii_bus *mii_bus;
+	int ret;
+
+	mnp = of_get_child_by_name(np, "mdio");
+	if (!mnp)
+		return -ENODEV;
+
+	mii_bus = devm_mdiobus_alloc(dev);
+	if (!mii_bus) {
+		of_node_put(mnp);
+		return -ENOMEM;
+	}
+
+	mii_bus->priv = emac;
+	mii_bus->name = np->full_name;
+	snprintf(mii_bus->id, MII_BUS_ID_SIZE, "%s-mii", dev_name(dev));
+	mii_bus->parent = dev;
+	mii_bus->read = bcm6348_emac_mdio_read;
+	mii_bus->write = bcm6348_emac_mdio_write;
+	mii_bus->phy_mask = 0x3f;
+
+	ret = devm_of_mdiobus_register(dev, mii_bus, mnp);
+	of_node_put(mnp);
+	if (ret) {
+		dev_err(dev, "MDIO bus registration failed\n");
+		return ret;
+	}
+
+	dev_info(dev, "MDIO bus init\n");
+
+	return 0;
+}
+
+/*
+ * preinit hardware to allow mii operation while device is down
+ */
+static void bcm6348_emac_hw_preinit(struct bcm6348_emac *emac)
+{
+	u32 val;
+	int limit;
+
+	/* make sure emac is disabled */
+	bcm6348_emac_disable_mac(emac);
+
+	/* soft reset emac */
+	val = ENET_CTL_SRESET_MASK;
+	emac_writel(emac, val, ENET_CTL_REG);
+	wmb();
+
+	limit = 1000;
+	do {
+		val = emac_readl(emac, ENET_CTL_REG);
+		if (!(val & ENET_CTL_SRESET_MASK))
+			break;
+		udelay(1);
+	} while (limit--);
+
+	/* select correct mii interface */
+	val = emac_readl(emac, ENET_CTL_REG);
+	if (emac->ext_mii)
+		val |= ENET_CTL_EPHYSEL_MASK;
+	else
+		val &= ~ENET_CTL_EPHYSEL_MASK;
+	emac_writel(emac, val, ENET_CTL_REG);
+
+	/* turn on mdc clock */
+	emac_writel(emac, (0x1f << ENET_MIISC_MDCFREQDIV_SHIFT) |
+		    ENET_MIISC_PREAMBLEEN_MASK, ENET_MIISC_REG);
+
+	/* set mib counters to self-clear when read */
+	val = emac_readl(emac, ENET_MIBCTL_REG);
+	val |= ENET_MIBCTL_RDCLEAR_MASK;
+	emac_writel(emac, val, ENET_MIBCTL_REG);
+}
+
+static int bcm6348_emac_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node;
+	struct device_node *dma_node;
+	struct platform_device *dma_pdev;
+	struct bcm6348_emac *emac;
+	struct bcm6348_iudma *iudma;
+	struct net_device *ndev;
+	unsigned char dev_addr[ETH_ALEN];
+	unsigned i;
+	int num_resets;
+	int ret;
+
+	dma_node = of_parse_phandle(node, "brcm,iudma", 0);
+	if (!dma_node)
+		return -EINVAL;
+
+	dma_pdev = of_find_device_by_node(dma_node);
+	of_node_put(dma_node);
+	if (!dma_pdev)
+		return -EINVAL;
+
+	iudma = platform_get_drvdata(dma_pdev);
+	if (!iudma)
+		return -EPROBE_DEFER;
+
+	ndev = devm_alloc_etherdev(dev, sizeof(*emac));
+	if (!ndev)
+		return -ENOMEM;
+
+	platform_set_drvdata(pdev, ndev);
+	SET_NETDEV_DEV(ndev, dev);
+
+	emac = netdev_priv(ndev);
+	emac->iudma = iudma;
+	emac->pdev = pdev;
+	emac->net_dev = ndev;
+
+	emac->base = devm_platform_ioremap_resource(pdev, 0);
+	if (IS_ERR_OR_NULL(emac->base))
+		return PTR_ERR(emac->base);
+
+	ndev->irq = of_irq_get_byname(node, "emac");
+	if (!ndev->irq)
+		return -ENODEV;
+
+	emac->irq_rx = of_irq_get_byname(node, "rx");
+	if (!emac->irq_rx)
+		return -ENODEV;
+
+	emac->irq_tx = of_irq_get_byname(node, "tx");
+	if (!emac->irq_tx)
+		return -ENODEV;
+
+	if (of_property_read_u32(node, "dma-rx", &emac->rx_chan))
+		return -ENODEV;
+
+	if (of_property_read_u32(node, "dma-tx", &emac->tx_chan))
+		return -ENODEV;
+
+	emac->ext_mii = of_property_read_bool(node, "brcm,external-mii");
+
+	emac->rx_ring_size = ENET_DEF_RX_DESC;
+	emac->tx_ring_size = ENET_DEF_TX_DESC;
+	emac->copybreak = ENET_DEF_CPY_BREAK;
+
+	emac->old_link = 0;
+	emac->old_duplex = -1;
+	emac->old_pause = -1;
+
+	of_get_mac_address(node, dev_addr);
+	if (is_valid_ether_addr(dev_addr)) {
+		dev_addr_set(ndev, dev_addr);
+		dev_info(dev, "mtd mac %pM\n", dev_addr);
+	} else {
+		eth_hw_addr_random(ndev);
+		dev_info(dev, "random mac\n");
+	}
+
+	emac->rx_skb_size = ALIGN(ndev->mtu + ENET_MTU_OVERHEAD,
+				  ENET_DMA_MAXBURST * 4);
+
+	emac->num_clocks = of_clk_get_parent_count(node);
+	if (emac->num_clocks) {
+		emac->clock = devm_kcalloc(dev, emac->num_clocks,
+					   sizeof(struct clk *), GFP_KERNEL);
+		if (IS_ERR_OR_NULL(emac->clock))
+			return PTR_ERR(emac->clock);
+	}
+	for (i = 0; i < emac->num_clocks; i++) {
+		emac->clock[i] = of_clk_get(node, i);
+		if (IS_ERR_OR_NULL(emac->clock[i])) {
+			dev_err(dev, "error getting emac clock %d\n", i);
+			return PTR_ERR(emac->clock[i]);
+		}
+
+		ret = clk_prepare_enable(emac->clock[i]);
+		if (ret) {
+			dev_err(dev, "error enabling emac clock %d\n", i);
+			return ret;
+		}
+	}
+
+	num_resets = of_count_phandle_with_args(node, "resets",
+						"#reset-cells");
+	if (num_resets > 0)
+		emac->num_resets = num_resets;
+	else
+		emac->num_resets = 0;
+	if (emac->num_resets) {
+		emac->reset = devm_kcalloc(dev, emac->num_resets,
+					   sizeof(struct reset_control *),
+					   GFP_KERNEL);
+		if (IS_ERR_OR_NULL(emac->reset))
+			return PTR_ERR(emac->reset);
+		
+	}
+	for (i = 0; i < emac->num_resets; i++) {
+		emac->reset[i] = devm_reset_control_get_by_index(dev, i);
+		if (IS_ERR_OR_NULL(emac->reset[i])) {
+			dev_err(dev, "error getting emac reset %d\n", i);
+			return PTR_ERR(emac->reset[i]);
+		}
+
+		ret = reset_control_reset(emac->reset[i]);
+		if (ret) {
+			dev_err(dev, "error performing emac reset %d\n", i);
+			return ret;
+		}
+	}
+
+	/* do minimal hardware init to be able to probe mii bus */
+	bcm6348_emac_hw_preinit(emac);
+
+	ret = bcm6348_emac_mdio_init(emac, node);
+	if (ret)
+		return ret;
+
+	spin_lock_init(&emac->rx_lock);
+
+	timer_setup(&emac->rx_timeout, bcm6348_emac_refill_rx_timer, 0);
+
+	/* zero mib counters */
+	for (i = 0; i < ENET_MIB_REG_COUNT; i++)
+		emac_writel(emac, 0, ENET_MIB_REG(i));
+
+	/* register netdevice */
+	ndev->netdev_ops = &bcm6348_emac_ops;
+	ndev->min_mtu = ETH_ZLEN - ETH_HLEN;
+	ndev->mtu = ETH_DATA_LEN - VLAN_ETH_HLEN;
+	ndev->max_mtu = ENET_MAX_MTU - VLAN_ETH_HLEN;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6,1,0)
+	netif_napi_add(ndev, &emac->napi, bcm6348_emac_poll);
+#else
+	netif_napi_add(ndev, &emac->napi, bcm6348_emac_poll, 16);
+#endif
+	SET_NETDEV_DEV(ndev, dev);
+
+	ret = devm_register_netdev(dev, ndev);
+	if (ret)
+		goto out_disable_clk;
+
+	netif_carrier_off(ndev);
+
+	ndev->phydev = of_phy_get_and_connect(ndev, node,
+					      bcm6348_emac_adjust_phy);
+	if (IS_ERR_OR_NULL(ndev->phydev))
+		dev_warn(dev, "PHY not found!\n");
+
+	dev_info(dev, "%s at 0x%px, IRQ %d\n", ndev->name, emac->base,
+		 ndev->irq);
+
+	return 0;
+
+out_disable_clk:
+	for (i = 0; i < emac->num_resets; i++)
+		reset_control_assert(emac->reset[i]);
+
+	for (i = 0; i < emac->num_clocks; i++)
+		clk_disable_unprepare(emac->clock[i]);
+
+	return ret;
+}
+
+static int bcm6348_emac_remove(struct platform_device *pdev)
+{
+	struct net_device *ndev = platform_get_drvdata(pdev);
+	struct bcm6348_emac *emac = netdev_priv(ndev);
+	unsigned int i;
+
+	emac_writel(emac, 0, ENET_MIISC_REG);
+
+	for (i = 0; i < emac->num_resets; i++)
+		reset_control_assert(emac->reset[i]);
+
+	for (i = 0; i < emac->num_clocks; i++)
+		clk_disable_unprepare(emac->clock[i]);
+
+	return 0;
+}
+
+static const struct of_device_id bcm6348_emac_of_match[] = {
+	{ .compatible = "brcm,bcm6338-emac", },
+	{ .compatible = "brcm,bcm6348-emac", },
+	{ .compatible = "brcm,bcm6358-emac", },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, bcm6348_emac_of_match);
+
+static struct platform_driver bcm6348_emac_driver = {
+	.driver = {
+		.name = "bcm6348-emac",
+		.of_match_table = of_match_ptr(bcm6348_emac_of_match),
+	},
+	.probe	= bcm6348_emac_probe,
+	.remove	= bcm6348_emac_remove,
+};
+
+int bcm6348_iudma_drivers_register(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	int ret;
+
+	ret = platform_driver_register(&bcm6348_emac_driver);
+	if (ret)
+		dev_err(dev, "error registering emac driver!\n");
+
+	return ret;
+}
+
+MODULE_AUTHOR("Álvaro Fernández Rojas <noltari@gmail.com>");
+MODULE_DESCRIPTION("BCM6348 Ethernet Controller Driver");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:bcm6348-enet");
diff --git a/target/linux/bmips/files/drivers/net/ethernet/broadcom/bcm6368-enetsw.c b/target/linux/bmips/files/drivers/net/ethernet/broadcom/bcm6368-enetsw.c
index d9ecba518862f2..321e95dbbb3d11 100644
--- a/target/linux/bmips/files/drivers/net/ethernet/broadcom/bcm6368-enetsw.c
+++ b/target/linux/bmips/files/drivers/net/ethernet/broadcom/bcm6368-enetsw.c
@@ -20,11 +20,14 @@
 #include <linux/pm_domain.h>
 #include <linux/pm_runtime.h>
 #include <linux/reset.h>
+#include <linux/version.h>
 
 /* MTU */
-#define ENETSW_TAG_SIZE			6
+#define ENETSW_TAG_SIZE			(6 + VLAN_HLEN)
 #define ENETSW_MTU_OVERHEAD		(VLAN_ETH_HLEN + VLAN_HLEN + \
 					 ENETSW_TAG_SIZE)
+#define ENETSW_FRAG_SIZE(x)		(SKB_DATA_ALIGN(NET_SKB_PAD + x + \
+					 SKB_DATA_ALIGN(sizeof(struct skb_shared_info))))
 
 /* default number of descriptor */
 #define ENETSW_DEF_RX_DESC		64
@@ -170,13 +173,16 @@ struct bcm6368_enetsw {
 	/* next dirty rx descriptor to refill */
 	int rx_dirty_desc;
 
-	/* size of allocated rx skbs */
-	unsigned int rx_skb_size;
+	/* size of allocated rx buffer */
+	unsigned int rx_buf_size;
 
-	/* list of skb given to hw for rx */
-	struct sk_buff **rx_skb;
+	/* size of allocated rx frag */
+	unsigned int rx_frag_size;
 
-	/* used when rx skb allocation failed, so we defer rx queue
+	/* list of buffer given to hw for rx */
+	unsigned char **rx_buf;
+
+	/* used when rx buffer allocation failed, so we defer rx queue
 	 * refill */
 	struct timer_list rx_timeout;
 
@@ -189,9 +195,6 @@ struct bcm6368_enetsw {
 	/* number of dma desc in tx ring */
 	int tx_ring_size;
 
-	/* maximum dma burst size */
-	int dma_maxburst;
-
 	/* cpu view of rx dma ring */
 	struct bcm6368_enetsw_desc *tx_desc_cpu;
 
@@ -215,15 +218,6 @@ struct bcm6368_enetsw {
 
 	/* platform device reference */
 	struct platform_device *pdev;
-
-	/* dma channel enable mask */
-	u32 dma_chan_en_mask;
-
-	/* dma channel interrupt mask */
-	u32 dma_chan_int_mask;
-
-	/* dma channel width */
-	unsigned int dma_chan_width;
 };
 
 static inline void dma_writel(struct bcm6368_enetsw *priv, u32 val, u32 off)
@@ -233,50 +227,62 @@ static inline void dma_writel(struct bcm6368_enetsw *priv, u32 val, u32 off)
 
 static inline u32 dma_readl(struct bcm6368_enetsw *priv, u32 off, int chan)
 {
-	return __raw_readl(priv->dma_chan + off + chan * priv->dma_chan_width);
+	return __raw_readl(priv->dma_chan + off + chan * DMA_CHAN_WIDTH);
 }
 
-static inline void dmac_writel(struct bcm6368_enetsw *priv, u32 val,
-				    u32 off, int chan)
+static inline void dmac_writel(struct bcm6368_enetsw *priv, u32 val, u32 off,
+			       int chan)
 {
-	__raw_writel(val, priv->dma_chan + off + chan * priv->dma_chan_width);
+	__raw_writel(val, priv->dma_chan + off + chan * DMA_CHAN_WIDTH);
 }
 
 static inline void dmas_writel(struct bcm6368_enetsw *priv, u32 val,
 				    u32 off, int chan)
 {
-	__raw_writel(val, priv->dma_sram + off + chan * priv->dma_chan_width);
+	__raw_writel(val, priv->dma_sram + off + chan * DMA_CHAN_WIDTH);
 }
 
 /*
  * refill rx queue
  */
-static int bcm6368_enetsw_refill_rx(struct net_device *dev)
+static int bcm6368_enetsw_refill_rx(struct net_device *ndev, bool napi_mode)
 {
-	struct bcm6368_enetsw *priv = netdev_priv(dev);
+	struct bcm6368_enetsw *priv = netdev_priv(ndev);
+	struct platform_device *pdev = priv->pdev;
+	struct device *dev = &pdev->dev;
 
 	while (priv->rx_desc_count < priv->rx_ring_size) {
 		struct bcm6368_enetsw_desc *desc;
-		struct sk_buff *skb;
-		dma_addr_t p;
 		int desc_idx;
 		u32 len_stat;
 
 		desc_idx = priv->rx_dirty_desc;
 		desc = &priv->rx_desc_cpu[desc_idx];
 
-		if (!priv->rx_skb[desc_idx]) {
-			skb = netdev_alloc_skb(dev, priv->rx_skb_size);
-			if (!skb)
+		if (!priv->rx_buf[desc_idx]) {
+			unsigned char *buf;
+			dma_addr_t p;
+
+			if (likely(napi_mode))
+				buf = napi_alloc_frag(priv->rx_frag_size);
+			else
+				buf = netdev_alloc_frag(priv->rx_frag_size);
+
+			if (unlikely(!buf))
+				break;
+
+			p = dma_map_single(dev, buf + NET_SKB_PAD,
+					   priv->rx_buf_size, DMA_FROM_DEVICE);
+			if (unlikely(dma_mapping_error(dev, p))) {
+				skb_free_frag(buf);
 				break;
-			priv->rx_skb[desc_idx] = skb;
-			p = dma_map_single(&priv->pdev->dev, skb->data,
-					   priv->rx_skb_size,
-					   DMA_FROM_DEVICE);
+			}
+
+			priv->rx_buf[desc_idx] = buf;
 			desc->address = p;
 		}
 
-		len_stat = priv->rx_skb_size << DMADESC_LENGTH_SHIFT;
+		len_stat = priv->rx_buf_size << DMADESC_LENGTH_SHIFT;
 		len_stat |= DMADESC_OWNER_MASK;
 		if (priv->rx_dirty_desc == priv->rx_ring_size - 1) {
 			len_stat |= DMADESC_WRAP_MASK;
@@ -295,8 +301,8 @@ static int bcm6368_enetsw_refill_rx(struct net_device *dev)
 
 	/* If rx ring is still empty, set a timer to try allocating
 	 * again at a later time. */
-	if (priv->rx_desc_count == 0 && netif_running(dev)) {
-		dev_warn(&priv->pdev->dev, "unable to refill rx ring\n");
+	if (priv->rx_desc_count == 0 && netif_running(ndev)) {
+		dev_warn(dev, "unable to refill rx ring\n");
 		priv->rx_timeout.expires = jiffies + HZ;
 		add_timer(&priv->rx_timeout);
 	}
@@ -310,22 +316,27 @@ static int bcm6368_enetsw_refill_rx(struct net_device *dev)
 static void bcm6368_enetsw_refill_rx_timer(struct timer_list *t)
 {
 	struct bcm6368_enetsw *priv = from_timer(priv, t, rx_timeout);
-	struct net_device *dev = priv->net_dev;
+	struct net_device *ndev = priv->net_dev;
 
 	spin_lock(&priv->rx_lock);
-	bcm6368_enetsw_refill_rx(dev);
+	bcm6368_enetsw_refill_rx(ndev, false);
 	spin_unlock(&priv->rx_lock);
 }
 
 /*
  * extract packet from rx queue
  */
-static int bcm6368_enetsw_receive_queue(struct net_device *dev, int budget)
+static int bcm6368_enetsw_receive_queue(struct net_device *ndev, int budget)
 {
-	struct bcm6368_enetsw *priv = netdev_priv(dev);
-	struct device *kdev = &priv->pdev->dev;
+	struct bcm6368_enetsw *priv = netdev_priv(ndev);
+	struct platform_device *pdev = priv->pdev;
+	struct device *dev = &pdev->dev;
+	struct list_head rx_list;
+	struct sk_buff *skb;
 	int processed = 0;
 
+	INIT_LIST_HEAD(&rx_list);
+
 	/* don't scan ring further than number of refilled
 	 * descriptor */
 	if (budget > priv->rx_desc_count)
@@ -333,7 +344,8 @@ static int bcm6368_enetsw_receive_queue(struct net_device *dev, int budget)
 
 	do {
 		struct bcm6368_enetsw_desc *desc;
-		struct sk_buff *skb;
+		unsigned int frag_size;
+		unsigned char *buf;
 		int desc_idx;
 		u32 len_stat;
 		unsigned int len;
@@ -355,56 +367,69 @@ static int bcm6368_enetsw_receive_queue(struct net_device *dev, int budget)
 		priv->rx_curr_desc++;
 		if (priv->rx_curr_desc == priv->rx_ring_size)
 			priv->rx_curr_desc = 0;
-		priv->rx_desc_count--;
 
 		/* if the packet does not have start of packet _and_
 		 * end of packet flag set, then just recycle it */
 		if ((len_stat & DMADESC_ESOP_MASK) != DMADESC_ESOP_MASK) {
-			dev->stats.rx_dropped++;
+			ndev->stats.rx_dropped++;
 			continue;
 		}
 
 		/* valid packet */
-		skb = priv->rx_skb[desc_idx];
+		buf = priv->rx_buf[desc_idx];
 		len = (len_stat & DMADESC_LENGTH_MASK)
 		      >> DMADESC_LENGTH_SHIFT;
 		/* don't include FCS */
 		len -= 4;
 
 		if (len < priv->copybreak) {
-			struct sk_buff *nskb;
+			unsigned int nfrag_size = ENETSW_FRAG_SIZE(len);
+			unsigned char *nbuf = napi_alloc_frag(nfrag_size);
 
-			nskb = napi_alloc_skb(&priv->napi, len);
-			if (!nskb) {
+			if (unlikely(!nbuf)) {
 				/* forget packet, just rearm desc */
-				dev->stats.rx_dropped++;
+				ndev->stats.rx_dropped++;
 				continue;
 			}
 
-			dma_sync_single_for_cpu(kdev, desc->address,
+			dma_sync_single_for_cpu(dev, desc->address,
 						len, DMA_FROM_DEVICE);
-			memcpy(nskb->data, skb->data, len);
-			dma_sync_single_for_device(kdev, desc->address,
+			memcpy(nbuf + NET_SKB_PAD, buf + NET_SKB_PAD, len);
+			dma_sync_single_for_device(dev, desc->address,
 						   len, DMA_FROM_DEVICE);
-			skb = nskb;
+			buf = nbuf;
+			frag_size = nfrag_size;
 		} else {
-			dma_unmap_single(&priv->pdev->dev, desc->address,
-					 priv->rx_skb_size, DMA_FROM_DEVICE);
-			priv->rx_skb[desc_idx] = NULL;
+			dma_unmap_single(dev, desc->address,
+					 priv->rx_buf_size, DMA_FROM_DEVICE);
+			priv->rx_buf[desc_idx] = NULL;
+			frag_size = priv->rx_frag_size;
+		}
+
+		skb = napi_build_skb(buf, frag_size);
+		if (unlikely(!skb)) {
+			skb_free_frag(buf);
+			ndev->stats.rx_dropped++;
+			continue;
 		}
 
+		skb_reserve(skb, NET_SKB_PAD);
 		skb_put(skb, len);
-		skb->protocol = eth_type_trans(skb, dev);
-		dev->stats.rx_packets++;
-		dev->stats.rx_bytes += len;
-		netif_receive_skb(skb);
-	} while (--budget > 0);
+		ndev->stats.rx_packets++;
+		ndev->stats.rx_bytes += len;
+		list_add_tail(&skb->list, &rx_list);
+	} while (processed < budget);
+
+	list_for_each_entry(skb, &rx_list, list)
+		skb->protocol = eth_type_trans(skb, ndev);
+	netif_receive_skb_list(&rx_list);
+	priv->rx_desc_count -= processed;
 
 	if (processed || !priv->rx_desc_count) {
-		bcm6368_enetsw_refill_rx(dev);
+		bcm6368_enetsw_refill_rx(ndev, true);
 
 		/* kick rx dma */
-		dmac_writel(priv, priv->dma_chan_en_mask,
+		dmac_writel(priv, DMAC_CHANCFG_EN_MASK,
 			    DMAC_CHANCFG_REG, priv->rx_chan);
 	}
 
@@ -414,9 +439,13 @@ static int bcm6368_enetsw_receive_queue(struct net_device *dev, int budget)
 /*
  * try to or force reclaim of transmitted buffers
  */
-static int bcm6368_enetsw_tx_reclaim(struct net_device *dev, int force)
+static int bcm6368_enetsw_tx_reclaim(struct net_device *ndev, int force,
+				     int budget)
 {
-	struct bcm6368_enetsw *priv = netdev_priv(dev);
+	struct bcm6368_enetsw *priv = netdev_priv(ndev);
+	struct platform_device *pdev = priv->pdev;
+	struct device *dev = &pdev->dev;
+	unsigned int bytes = 0;
 	int released = 0;
 
 	while (priv->tx_desc_count < priv->tx_ring_size) {
@@ -440,7 +469,7 @@ static int bcm6368_enetsw_tx_reclaim(struct net_device *dev, int force)
 
 		skb = priv->tx_skb[priv->tx_dirty_desc];
 		priv->tx_skb[priv->tx_dirty_desc] = NULL;
-		dma_unmap_single(&priv->pdev->dev, desc->address, skb->len,
+		dma_unmap_single(dev, desc->address, skb->len,
 				 DMA_TO_DEVICE);
 
 		priv->tx_dirty_desc++;
@@ -451,14 +480,17 @@ static int bcm6368_enetsw_tx_reclaim(struct net_device *dev, int force)
 		spin_unlock(&priv->tx_lock);
 
 		if (desc->len_stat & DMADESC_UNDER_MASK)
-			dev->stats.tx_errors++;
+			ndev->stats.tx_errors++;
 
-		dev_kfree_skb(skb);
+		bytes += skb->len;
+		napi_consume_skb(skb, budget);
 		released++;
 	}
 
-	if (netif_queue_stopped(dev) && released)
-		netif_wake_queue(dev);
+	netdev_completed_queue(ndev, released, bytes);
+
+	if (netif_queue_stopped(ndev) && released)
+		netif_wake_queue(ndev);
 
 	return released;
 }
@@ -469,20 +501,20 @@ static int bcm6368_enetsw_tx_reclaim(struct net_device *dev, int force)
 static int bcm6368_enetsw_poll(struct napi_struct *napi, int budget)
 {
 	struct bcm6368_enetsw *priv = container_of(napi, struct bcm6368_enetsw, napi);
-	struct net_device *dev = priv->net_dev;
+	struct net_device *ndev = priv->net_dev;
 	int rx_work_done;
 
 	/* ack interrupts */
-	dmac_writel(priv, priv->dma_chan_int_mask,
+	dmac_writel(priv, DMAC_IR_PKTDONE_MASK,
 			 DMAC_IR_REG, priv->rx_chan);
-	dmac_writel(priv, priv->dma_chan_int_mask,
+	dmac_writel(priv, DMAC_IR_PKTDONE_MASK,
 			 DMAC_IR_REG, priv->tx_chan);
 
 	/* reclaim sent skb */
-	bcm6368_enetsw_tx_reclaim(dev, 0);
+	bcm6368_enetsw_tx_reclaim(ndev, 0, budget);
 
 	spin_lock(&priv->rx_lock);
-	rx_work_done = bcm6368_enetsw_receive_queue(dev, budget);
+	rx_work_done = bcm6368_enetsw_receive_queue(ndev, budget);
 	spin_unlock(&priv->rx_lock);
 
 	if (rx_work_done >= budget) {
@@ -495,10 +527,10 @@ static int bcm6368_enetsw_poll(struct napi_struct *napi, int budget)
 	napi_complete_done(napi, rx_work_done);
 
 	/* restore rx/tx interrupt */
-	dmac_writel(priv, priv->dma_chan_int_mask,
-			 DMAC_IRMASK_REG, priv->rx_chan);
-	dmac_writel(priv, priv->dma_chan_int_mask,
-			 DMAC_IRMASK_REG, priv->tx_chan);
+	dmac_writel(priv, DMAC_IR_PKTDONE_MASK,
+		    DMAC_IRMASK_REG, priv->rx_chan);
+	dmac_writel(priv, DMAC_IR_PKTDONE_MASK,
+		    DMAC_IRMASK_REG, priv->tx_chan);
 
 	return rx_work_done;
 }
@@ -508,8 +540,8 @@ static int bcm6368_enetsw_poll(struct napi_struct *napi, int budget)
  */
 static irqreturn_t bcm6368_enetsw_isr_dma(int irq, void *dev_id)
 {
-	struct net_device *dev = dev_id;
-	struct bcm6368_enetsw *priv = netdev_priv(dev);
+	struct net_device *ndev = dev_id;
+	struct bcm6368_enetsw *priv = netdev_priv(ndev);
 
 	/* mask rx/tx interrupts */
 	dmac_writel(priv, 0, DMAC_IRMASK_REG, priv->rx_chan);
@@ -524,12 +556,15 @@ static irqreturn_t bcm6368_enetsw_isr_dma(int irq, void *dev_id)
  * tx request callback
  */
 static netdev_tx_t
-bcm6368_enetsw_start_xmit(struct sk_buff *skb, struct net_device *dev)
+bcm6368_enetsw_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 {
-	struct bcm6368_enetsw *priv = netdev_priv(dev);
+	struct bcm6368_enetsw *priv = netdev_priv(ndev);
+	struct platform_device *pdev = priv->pdev;
+	struct device *dev = &pdev->dev;
 	struct bcm6368_enetsw_desc *desc;
 	u32 len_stat;
 	netdev_tx_t ret;
+	dma_addr_t p;
 
 	/* lock against tx reclaim */
 	spin_lock(&priv->tx_lock);
@@ -537,9 +572,8 @@ bcm6368_enetsw_start_xmit(struct sk_buff *skb, struct net_device *dev)
 	/* make sure the tx hw queue is not full, should not happen
 	 * since we stop queue before it's the case */
 	if (unlikely(!priv->tx_desc_count)) {
-		netif_stop_queue(dev);
-		dev_err(&priv->pdev->dev, "xmit called with no tx desc "
-			"available?\n");
+		netif_stop_queue(ndev);
+		dev_err(dev, "xmit called with no tx desc available?\n");
 		ret = NETDEV_TX_BUSY;
 		goto out_unlock;
 	}
@@ -564,13 +598,18 @@ bcm6368_enetsw_start_xmit(struct sk_buff *skb, struct net_device *dev)
 		data = skb_put_zero(skb, needed);
 	}
 
+	/* fill descriptor */
+	p = dma_map_single(dev, skb->data, skb->len, DMA_TO_DEVICE);
+	if (unlikely(dma_mapping_error(dev, p))) {
+		dev_kfree_skb(skb);
+		ret = NETDEV_TX_OK;
+		goto out_unlock;
+	}
+
 	/* point to the next available desc */
 	desc = &priv->tx_desc_cpu[priv->tx_curr_desc];
 	priv->tx_skb[priv->tx_curr_desc] = skb;
-
-	/* fill descriptor */
-	desc->address = dma_map_single(&priv->pdev->dev, skb->data, skb->len,
-				       DMA_TO_DEVICE);
+	desc->address = p;
 
 	len_stat = (skb->len << DMADESC_LENGTH_SHIFT) & DMADESC_LENGTH_MASK;
 	len_stat |= DMADESC_ESOP_MASK | DMADESC_APPEND_CRC |
@@ -589,16 +628,18 @@ bcm6368_enetsw_start_xmit(struct sk_buff *skb, struct net_device *dev)
 	desc->len_stat = len_stat;
 	wmb();
 
+	netdev_sent_queue(ndev, skb->len);
+
 	/* kick tx dma */
-	dmac_writel(priv, priv->dma_chan_en_mask, DMAC_CHANCFG_REG,
+	dmac_writel(priv, DMAC_CHANCFG_EN_MASK, DMAC_CHANCFG_REG,
 		    priv->tx_chan);
 
 	/* stop queue if no more desc available */
 	if (!priv->tx_desc_count)
-		netif_stop_queue(dev);
+		netif_stop_queue(ndev);
 
-	dev->stats.tx_bytes += skb->len;
-	dev->stats.tx_packets++;
+	ndev->stats.tx_bytes += skb->len;
+	ndev->stats.tx_packets++;
 	ret = NETDEV_TX_OK;
 
 out_unlock:
@@ -626,10 +667,11 @@ static void bcm6368_enetsw_disable_dma(struct bcm6368_enetsw *priv, int chan)
 	} while (limit--);
 }
 
-static int bcm6368_enetsw_open(struct net_device *dev)
+static int bcm6368_enetsw_open(struct net_device *ndev)
 {
-	struct bcm6368_enetsw *priv = netdev_priv(dev);
-	struct device *kdev = &priv->pdev->dev;
+	struct bcm6368_enetsw *priv = netdev_priv(ndev);
+	struct platform_device *pdev = priv->pdev;
+	struct device *dev = &pdev->dev;
 	int i, ret;
 	unsigned int size;
 	void *p;
@@ -640,22 +682,22 @@ static int bcm6368_enetsw_open(struct net_device *dev)
 	dmac_writel(priv, 0, DMAC_IRMASK_REG, priv->tx_chan);
 
 	ret = request_irq(priv->irq_rx, bcm6368_enetsw_isr_dma,
-			  0, dev->name, dev);
+			  0, ndev->name, ndev);
 	if (ret)
 		goto out_freeirq;
 
 	if (priv->irq_tx != -1) {
 		ret = request_irq(priv->irq_tx, bcm6368_enetsw_isr_dma,
-				  0, dev->name, dev);
+				  0, ndev->name, ndev);
 		if (ret)
 			goto out_freeirq_rx;
 	}
 
 	/* allocate rx dma ring */
 	size = priv->rx_ring_size * sizeof(struct bcm6368_enetsw_desc);
-	p = dma_alloc_coherent(kdev, size, &priv->rx_desc_dma, GFP_KERNEL);
+	p = dma_alloc_coherent(dev, size, &priv->rx_desc_dma, GFP_KERNEL);
 	if (!p) {
-		dev_err(kdev, "cannot allocate rx ring %u\n", size);
+		dev_err(dev, "cannot allocate rx ring %u\n", size);
 		ret = -ENOMEM;
 		goto out_freeirq_tx;
 	}
@@ -666,9 +708,9 @@ static int bcm6368_enetsw_open(struct net_device *dev)
 
 	/* allocate tx dma ring */
 	size = priv->tx_ring_size * sizeof(struct bcm6368_enetsw_desc);
-	p = dma_alloc_coherent(kdev, size, &priv->tx_desc_dma, GFP_KERNEL);
+	p = dma_alloc_coherent(dev, size, &priv->tx_desc_dma, GFP_KERNEL);
 	if (!p) {
-		dev_err(kdev, "cannot allocate tx ring\n");
+		dev_err(dev, "cannot allocate tx ring\n");
 		ret = -ENOMEM;
 		goto out_free_rx_ring;
 	}
@@ -680,7 +722,7 @@ static int bcm6368_enetsw_open(struct net_device *dev)
 	priv->tx_skb = kzalloc(sizeof(struct sk_buff *) * priv->tx_ring_size,
 			       GFP_KERNEL);
 	if (!priv->tx_skb) {
-		dev_err(kdev, "cannot allocate rx skb queue\n");
+		dev_err(dev, "cannot allocate tx skb queue\n");
 		ret = -ENOMEM;
 		goto out_free_tx_ring;
 	}
@@ -690,11 +732,11 @@ static int bcm6368_enetsw_open(struct net_device *dev)
 	priv->tx_curr_desc = 0;
 	spin_lock_init(&priv->tx_lock);
 
-	/* init & fill rx ring with skbs */
-	priv->rx_skb = kzalloc(sizeof(struct sk_buff *) * priv->rx_ring_size,
+	/* init & fill rx ring with buffers */
+	priv->rx_buf = kzalloc(sizeof(unsigned char *) * priv->rx_ring_size,
 			       GFP_KERNEL);
-	if (!priv->rx_skb) {
-		dev_err(kdev, "cannot allocate rx skb queue\n");
+	if (!priv->rx_buf) {
+		dev_err(dev, "cannot allocate rx buffer queue\n");
 		ret = -ENOMEM;
 		goto out_free_tx_skb;
 	}
@@ -707,8 +749,8 @@ static int bcm6368_enetsw_open(struct net_device *dev)
 	dma_writel(priv, DMA_BUFALLOC_FORCE_MASK | 0,
 		   DMA_BUFALLOC_REG(priv->rx_chan));
 
-	if (bcm6368_enetsw_refill_rx(dev)) {
-		dev_err(kdev, "cannot allocate rx skb queue\n");
+	if (bcm6368_enetsw_refill_rx(ndev, false)) {
+		dev_err(dev, "cannot allocate rx buffer queue\n");
 		ret = -ENOMEM;
 		goto out;
 	}
@@ -728,9 +770,9 @@ static int bcm6368_enetsw_open(struct net_device *dev)
 	dmas_writel(priv, 0, DMAS_SRAM4_REG, priv->tx_chan);
 
 	/* set dma maximum burst len */
-	dmac_writel(priv, priv->dma_maxburst,
+	dmac_writel(priv, ENETSW_DMA_MAXBURST,
 		    DMAC_MAXBURST_REG, priv->rx_chan);
-	dmac_writel(priv, priv->dma_maxburst,
+	dmac_writel(priv, ENETSW_DMA_MAXBURST,
 		    DMAC_MAXBURST_REG, priv->tx_chan);
 
 	/* set flow control low/high threshold to 1/3 / 2/3 */
@@ -761,8 +803,8 @@ static int bcm6368_enetsw_open(struct net_device *dev)
 	dmac_writel(priv, DMAC_IR_PKTDONE_MASK,
 		    DMAC_IRMASK_REG, priv->tx_chan);
 
-	netif_carrier_on(dev);
-	netif_start_queue(dev);
+	netif_carrier_on(ndev);
+	netif_start_queue(ndev);
 
 	return 0;
 
@@ -770,45 +812,46 @@ static int bcm6368_enetsw_open(struct net_device *dev)
 	for (i = 0; i < priv->rx_ring_size; i++) {
 		struct bcm6368_enetsw_desc *desc;
 
-		if (!priv->rx_skb[i])
+		if (!priv->rx_buf[i])
 			continue;
 
 		desc = &priv->rx_desc_cpu[i];
-		dma_unmap_single(kdev, desc->address, priv->rx_skb_size,
+		dma_unmap_single(dev, desc->address, priv->rx_buf_size,
 				 DMA_FROM_DEVICE);
-		kfree_skb(priv->rx_skb[i]);
+		skb_free_frag(priv->rx_buf[i]);
 	}
-	kfree(priv->rx_skb);
+	kfree(priv->rx_buf);
 
 out_free_tx_skb:
 	kfree(priv->tx_skb);
 
 out_free_tx_ring:
-	dma_free_coherent(kdev, priv->tx_desc_alloc_size,
+	dma_free_coherent(dev, priv->tx_desc_alloc_size,
 			  priv->tx_desc_cpu, priv->tx_desc_dma);
 
 out_free_rx_ring:
-	dma_free_coherent(kdev, priv->rx_desc_alloc_size,
+	dma_free_coherent(dev, priv->rx_desc_alloc_size,
 			  priv->rx_desc_cpu, priv->rx_desc_dma);
 
 out_freeirq_tx:
 	if (priv->irq_tx != -1)
-		free_irq(priv->irq_tx, dev);
+		free_irq(priv->irq_tx, ndev);
 
 out_freeirq_rx:
-	free_irq(priv->irq_rx, dev);
+	free_irq(priv->irq_rx, ndev);
 
 out_freeirq:
 	return ret;
 }
 
-static int bcm6368_enetsw_stop(struct net_device *dev)
+static int bcm6368_enetsw_stop(struct net_device *ndev)
 {
-	struct bcm6368_enetsw *priv = netdev_priv(dev);
-	struct device *kdev = &priv->pdev->dev;
+	struct bcm6368_enetsw *priv = netdev_priv(ndev);
+	struct platform_device *pdev = priv->pdev;
+	struct device *dev = &pdev->dev;
 	int i;
 
-	netif_stop_queue(dev);
+	netif_stop_queue(ndev);
 	napi_disable(&priv->napi);
 	del_timer_sync(&priv->rx_timeout);
 
@@ -821,32 +864,34 @@ static int bcm6368_enetsw_stop(struct net_device *dev)
 	bcm6368_enetsw_disable_dma(priv, priv->rx_chan);
 
 	/* force reclaim of all tx buffers */
-	bcm6368_enetsw_tx_reclaim(dev, 1);
+	bcm6368_enetsw_tx_reclaim(ndev, 1, 0);
 
-	/* free the rx skb ring */
+	/* free the rx buffer ring */
 	for (i = 0; i < priv->rx_ring_size; i++) {
 		struct bcm6368_enetsw_desc *desc;
 
-		if (!priv->rx_skb[i])
+		if (!priv->rx_buf[i])
 			continue;
 
 		desc = &priv->rx_desc_cpu[i];
-		dma_unmap_single_attrs(kdev, desc->address, priv->rx_skb_size,
+		dma_unmap_single_attrs(dev, desc->address, priv->rx_buf_size,
 				       DMA_FROM_DEVICE,
 				       DMA_ATTR_SKIP_CPU_SYNC);
-		kfree_skb(priv->rx_skb[i]);
+		skb_free_frag(priv->rx_buf[i]);
 	}
 
 	/* free remaining allocated memory */
-	kfree(priv->rx_skb);
+	kfree(priv->rx_buf);
 	kfree(priv->tx_skb);
-	dma_free_coherent(kdev, priv->rx_desc_alloc_size,
+	dma_free_coherent(dev, priv->rx_desc_alloc_size,
 			  priv->rx_desc_cpu, priv->rx_desc_dma);
-	dma_free_coherent(kdev, priv->tx_desc_alloc_size,
+	dma_free_coherent(dev, priv->tx_desc_alloc_size,
 			  priv->tx_desc_cpu, priv->tx_desc_dma);
 	if (priv->irq_tx != -1)
-		free_irq(priv->irq_tx, dev);
-	free_irq(priv->irq_rx, dev);
+		free_irq(priv->irq_tx, ndev);
+	free_irq(priv->irq_rx, ndev);
+
+	netdev_reset_queue(ndev);
 
 	return 0;
 }
@@ -859,19 +904,26 @@ static const struct net_device_ops bcm6368_enetsw_ops = {
 
 static int bcm6368_enetsw_probe(struct platform_device *pdev)
 {
-	struct bcm6368_enetsw *priv;
 	struct device *dev = &pdev->dev;
 	struct device_node *node = dev->of_node;
+	struct bcm6368_enetsw *priv;
 	struct net_device *ndev;
 	struct resource *res;
+	unsigned char dev_addr[ETH_ALEN];
 	unsigned i;
+	int num_resets;
 	int ret;
 
-	ndev = alloc_etherdev(sizeof(*priv));
+	ndev = devm_alloc_etherdev(dev, sizeof(*priv));
 	if (!ndev)
 		return -ENOMEM;
 
+	platform_set_drvdata(pdev, ndev);
+	SET_NETDEV_DEV(ndev, dev);
+
 	priv = netdev_priv(ndev);
+	priv->pdev = pdev;
+	priv->net_dev = ndev;
 
 	priv->num_pms = of_count_phandle_with_args(node, "power-domains",
 						   "#power-domain-cells");
@@ -911,18 +963,18 @@ static int bcm6368_enetsw_probe(struct platform_device *pdev)
 
 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dma");
 	priv->dma_base = devm_ioremap_resource(dev, res);
-	if (IS_ERR(priv->dma_base))
+	if (IS_ERR_OR_NULL(priv->dma_base))
 		return PTR_ERR(priv->dma_base);
 
 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
 					   "dma-channels");
 	priv->dma_chan = devm_ioremap_resource(dev, res);
-	if (IS_ERR(priv->dma_chan))
+	if (IS_ERR_OR_NULL(priv->dma_chan))
 		return PTR_ERR(priv->dma_chan);
 
 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dma-sram");
 	priv->dma_sram = devm_ioremap_resource(dev, res);
-	if (IS_ERR(priv->dma_sram))
+	if (IS_ERR_OR_NULL(priv->dma_sram))
 		return PTR_ERR(priv->dma_sram);
 
 	priv->irq_rx = platform_get_irq_byname(pdev, "rx");
@@ -943,38 +995,34 @@ static int bcm6368_enetsw_probe(struct platform_device *pdev)
 
 	priv->rx_ring_size = ENETSW_DEF_RX_DESC;
 	priv->tx_ring_size = ENETSW_DEF_TX_DESC;
-
-	priv->dma_maxburst = ENETSW_DMA_MAXBURST;
-
 	priv->copybreak = ENETSW_DEF_CPY_BREAK;
 
-	priv->dma_chan_en_mask = DMAC_CHANCFG_EN_MASK;
-	priv->dma_chan_int_mask = DMAC_IR_PKTDONE_MASK;
-	priv->dma_chan_width = DMA_CHAN_WIDTH;
-
-	of_get_mac_address(node, ndev->dev_addr);
-	if (is_valid_ether_addr(ndev->dev_addr)) {
-		dev_info(dev, "mtd mac %pM\n", ndev->dev_addr);
+	of_get_mac_address(node, dev_addr);
+	if (is_valid_ether_addr(dev_addr)) {
+		dev_addr_set(ndev, dev_addr);
+		dev_info(dev, "mtd mac %pM\n", dev_addr);
 	} else {
-		random_ether_addr(ndev->dev_addr);
-		dev_info(dev, "random mac %pM\n", ndev->dev_addr);
+		eth_hw_addr_random(ndev);
+		dev_info(dev, "random mac\n");
 	}
 
-	priv->rx_skb_size = ALIGN(ndev->mtu + ENETSW_MTU_OVERHEAD,
-				  priv->dma_maxburst * 4);
+	priv->rx_buf_size = ALIGN(ndev->mtu + ENETSW_MTU_OVERHEAD,
+				  ENETSW_DMA_MAXBURST * 4);
+
+	priv->rx_frag_size = ENETSW_FRAG_SIZE(priv->rx_buf_size);
 
 	priv->num_clocks = of_clk_get_parent_count(node);
 	if (priv->num_clocks) {
 		priv->clock = devm_kcalloc(dev, priv->num_clocks,
 					   sizeof(struct clk *), GFP_KERNEL);
-		if (!priv->clock)
-			return -ENOMEM;
+		if (IS_ERR_OR_NULL(priv->clock))
+			return PTR_ERR(priv->clock);
 	}
 	for (i = 0; i < priv->num_clocks; i++) {
 		priv->clock[i] = of_clk_get(node, i);
 		if (IS_ERR(priv->clock[i])) {
 			dev_err(dev, "error getting clock %d\n", i);
-			return -EINVAL;
+			return PTR_ERR(priv->clock[i]);
 		}
 
 		ret = clk_prepare_enable(priv->clock[i]);
@@ -984,20 +1032,24 @@ static int bcm6368_enetsw_probe(struct platform_device *pdev)
 		}
 	}
 
-	priv->num_resets = of_count_phandle_with_args(node, "resets",
-						      "#reset-cells");
+	num_resets = of_count_phandle_with_args(node, "resets",
+						"#reset-cells");
+	if (num_resets > 0)
+		priv->num_resets = num_resets;
+	else
+		priv->num_resets = 0;
 	if (priv->num_resets) {
 		priv->reset = devm_kcalloc(dev, priv->num_resets,
 					   sizeof(struct reset_control *),
 					   GFP_KERNEL);
-		if (!priv->reset)
-			return -ENOMEM;
+		if (IS_ERR_OR_NULL(priv->reset))
+			return PTR_ERR(priv->reset);
 	}
 	for (i = 0; i < priv->num_resets; i++) {
 		priv->reset[i] = devm_reset_control_get_by_index(dev, i);
 		if (IS_ERR(priv->reset[i])) {
 			dev_err(dev, "error getting reset %d\n", i);
-			return -EINVAL;
+			return PTR_ERR(priv->reset[i]);
 		}
 
 		ret = reset_control_reset(priv->reset[i]);
@@ -1016,17 +1068,21 @@ static int bcm6368_enetsw_probe(struct platform_device *pdev)
 	ndev->min_mtu = ETH_ZLEN;
 	ndev->mtu = ETH_DATA_LEN + ENETSW_TAG_SIZE;
 	ndev->max_mtu = ETH_DATA_LEN + ENETSW_TAG_SIZE;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6,1,0)
+	netif_napi_add(ndev, &priv->napi, bcm6368_enetsw_poll);
+#else
 	netif_napi_add(ndev, &priv->napi, bcm6368_enetsw_poll, 16);
-	SET_NETDEV_DEV(ndev, dev);
+#endif
 
-	ret = register_netdev(ndev);
-	if (ret)
+	ret = devm_register_netdev(dev, ndev);
+	if (ret) {
+		netif_napi_del(&priv->napi);
 		goto out_disable_clk;
+	}
 
 	netif_carrier_off(ndev);
-	platform_set_drvdata(pdev, ndev);
-	priv->pdev = pdev;
-	priv->net_dev = ndev;
+
+	dev_info(dev, "%s at 0x%px, IRQ %d\n", ndev->name, priv->dma_base, ndev->irq);
 
 	return 0;
 
@@ -1047,8 +1103,6 @@ static int bcm6368_enetsw_remove(struct platform_device *pdev)
 	struct bcm6368_enetsw *priv = netdev_priv(ndev);
 	unsigned int i;
 
-	unregister_netdev(ndev);
-
 	pm_runtime_put_sync(dev);
 	for (i = 0; priv->pm && i < priv->num_pms; i++) {
 		dev_pm_domain_detach(priv->pm[i], true);
@@ -1061,8 +1115,6 @@ static int bcm6368_enetsw_remove(struct platform_device *pdev)
 	for (i = 0; i < priv->num_clocks; i++)
 		clk_disable_unprepare(priv->clock[i]);
 
-	free_netdev(ndev);
-
 	return 0;
 }
 
@@ -1085,3 +1137,8 @@ static struct platform_driver bcm6368_enetsw_driver = {
 	.remove	= bcm6368_enetsw_remove,
 };
 module_platform_driver(bcm6368_enetsw_driver);
+
+MODULE_AUTHOR("Álvaro Fernández Rojas <noltari@gmail.com>");
+MODULE_DESCRIPTION("BCM6368 Ethernet Switch Controller Driver");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:bcm6368-enetsw");
diff --git a/target/linux/bmips/files/drivers/pci/controller/pci-bcm6348.c b/target/linux/bmips/files/drivers/pci/controller/pci-bcm6348.c
index 730068ae7946d6..bf6775c94798da 100644
--- a/target/linux/bmips/files/drivers/pci/controller/pci-bcm6348.c
+++ b/target/linux/bmips/files/drivers/pci/controller/pci-bcm6348.c
@@ -13,6 +13,7 @@
 #include <linux/kernel.h>
 #include <linux/memblock.h>
 #include <linux/mm.h>
+#include <linux/module.h>
 #include <linux/of_address.h>
 #include <linux/of_gpio.h>
 #include <linux/of_irq.h>
@@ -335,10 +336,7 @@ static struct pci_ops bcm6348_pci_ops = {
 	.write = bcm6348_pci_write,
 };
 
-static struct resource bcm6348_pci_io_resource = {
-	.name = "BCM6348 PCI IO space",
-	.flags = IORESOURCE_IO,
-};
+static struct resource bcm6348_pci_io_resource;
 static struct resource bcm6348_pci_mem_resource;
 static struct resource bcm6348_pci_busn_resource;
 
@@ -732,26 +730,13 @@ static int bcm6348_pci_probe(struct platform_device *pdev)
 
 	of_pci_check_probe_only();
 
-	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "pci");
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	priv->pci = devm_ioremap_resource(dev, res);
 	if (IS_ERR(priv->pci))
 		return PTR_ERR(priv->pci);
 
 	priv->pcmcia = priv->pci + PCMCIA_OFFSET;
 
-	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "pci-io");
-	if (!res)
-		return -EINVAL;
-#ifdef CONFIG_CARDBUS
-	bcm6348_pci_io_resource.start = res->start;
-	bcm6348_pci_io_resource.end = res->end - (resource_size(res) >> 1);
-	bcm6348_cb_io_resource.start = res->start + (resource_size(res) >> 1);
-	bcm6348_cb_io_resource.end = res->end;
-#else
-	bcm6348_pci_io_resource.start = res->start;
-	bcm6348_pci_io_resource.end = res->end;
-#endif
-
 	priv->irq = platform_get_irq(pdev, 0);
 	if (!priv->irq)
 		return -ENODEV;
@@ -773,6 +758,12 @@ static int bcm6348_pci_probe(struct platform_device *pdev)
 	of_pci_parse_bus_range(np, &bcm6348_pci_busn_resource);
 	pci_add_resource(&resources, &bcm6348_pci_busn_resource);
 
+#ifdef CONFIG_CARDBUS
+	bcm6348_cb_io_resource.start = bcm6348_pci_io_resource.start + (resource_size(&bcm6348_pci_io_resource) >> 1);
+	bcm6348_cb_io_resource.end = bcm6348_pci_io_resource.end;
+	bcm6348_pci_io_resource.end = bcm6348_pci_io_resource.end - (resource_size(&bcm6348_pci_io_resource) >> 1);
+#endif
+
 	/*
 	 * Configuration accesses are done through IO space, remap 4
 	 * first bytes to access it from CPU.
@@ -807,6 +798,7 @@ static const struct of_device_id bcm6348_pci_of_match[] = {
 	{ .compatible = "brcm,bcm6348-pci", },
 	{ /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, bcm6348_pci_of_match);
 
 static struct platform_driver bcm6348_pci_driver = {
 	.probe = bcm6348_pci_probe,
@@ -815,12 +807,9 @@ static struct platform_driver bcm6348_pci_driver = {
 		.of_match_table = bcm6348_pci_of_match,
 	},
 };
+module_platform_driver(bcm6348_pci_driver);
 
-int __init bcm6348_pci_init(void)
-{
-	int ret = platform_driver_register(&bcm6348_pci_driver);
-	if (ret)
-		pr_err("pci-bcm6348: Error registering platform driver!\n");
-	return ret;
-}
-late_initcall_sync(bcm6348_pci_init);
+MODULE_AUTHOR("Álvaro Fernández Rojas <noltari@gmail.com>");
+MODULE_DESCRIPTION("BCM6348 PCI Controller Driver");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:bcm6348-pci");
diff --git a/target/linux/bmips/files/drivers/pci/controller/pcie-bcm6318.c b/target/linux/bmips/files/drivers/pci/controller/pcie-bcm6318.c
index d73bf850fb4f4c..2a8fdece0993b1 100644
--- a/target/linux/bmips/files/drivers/pci/controller/pcie-bcm6318.c
+++ b/target/linux/bmips/files/drivers/pci/controller/pcie-bcm6318.c
@@ -12,6 +12,7 @@
 #include <linux/delay.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
+#include <linux/module.h>
 #include <linux/of_gpio.h>
 #include <linux/of_irq.h>
 #include <linux/of_pci.h>
@@ -385,6 +386,7 @@ static const struct of_device_id bcm6318_pcie_of_match[] = {
 	{ .compatible = "brcm,bcm6318-pcie", },
 	{ /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, bcm6318_pcie_of_match);
 
 static struct platform_driver bcm6318_pcie_driver = {
 	.probe = bcm6318_pcie_probe,
@@ -393,12 +395,9 @@ static struct platform_driver bcm6318_pcie_driver = {
 		.of_match_table = bcm6318_pcie_of_match,
 	},
 };
+module_platform_driver(bcm6318_pcie_driver);
 
-int __init bcm6318_pcie_init(void)
-{
-	int ret = platform_driver_register(&bcm6318_pcie_driver);
-	if (ret)
-		pr_err("pci-bcm6318: Error registering platform driver!\n");
-	return ret;
-}
-late_initcall_sync(bcm6318_pcie_init);
+MODULE_AUTHOR("Álvaro Fernández Rojas <noltari@gmail.com>");
+MODULE_DESCRIPTION("BCM6318 PCIe Controller Driver");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:bcm6318-pcie");
diff --git a/target/linux/bmips/files/drivers/pci/controller/pcie-bcm6328.c b/target/linux/bmips/files/drivers/pci/controller/pcie-bcm6328.c
index f2f74fd5e65e38..e0950ba439f49f 100644
--- a/target/linux/bmips/files/drivers/pci/controller/pcie-bcm6328.c
+++ b/target/linux/bmips/files/drivers/pci/controller/pcie-bcm6328.c
@@ -13,6 +13,7 @@
 #include <linux/kernel.h>
 #include <linux/mfd/syscon.h>
 #include <linux/mm.h>
+#include <linux/module.h>
 #include <linux/of_gpio.h>
 #include <linux/of_irq.h>
 #include <linux/of_pci.h>
@@ -395,6 +396,7 @@ static const struct of_device_id bcm6328_pcie_of_match[] = {
 	{ .compatible = "brcm,bcm6328-pcie", },
 	{ /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, bcm6328_pcie_of_match);
 
 static struct platform_driver bcm6328_pcie_driver = {
 	.probe = bcm6328_pcie_probe,
@@ -403,12 +405,9 @@ static struct platform_driver bcm6328_pcie_driver = {
 		.of_match_table = bcm6328_pcie_of_match,
 	},
 };
+module_platform_driver(bcm6328_pcie_driver);
 
-int __init bcm6328_pcie_init(void)
-{
-	int ret = platform_driver_register(&bcm6328_pcie_driver);
-	if (ret)
-		pr_err("pci-bcm6328: Error registering platform driver!\n");
-	return ret;
-}
-late_initcall_sync(bcm6328_pcie_init);
+MODULE_AUTHOR("Álvaro Fernández Rojas <noltari@gmail.com>");
+MODULE_DESCRIPTION("BCM6328 PCIe Controller Driver");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:bcm6328-pcie");
diff --git a/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm6318-interrupt-controller.h b/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm6318-interrupt-controller.h
index 34bf929edafa83..91d70377cc650d 100644
--- a/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm6318-interrupt-controller.h
+++ b/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm6318-interrupt-controller.h
@@ -81,4 +81,9 @@
 #define BCM6318_IRQ_EPHY2_IDDQ_ENERGY	78
 #define BCM6318_IRQ_EPHY3_IDDQ_ENERGY	79
 
+#define BCM6318_EXTIRQ_0		0 /* GPIO 33 */
+#define BCM6318_EXTIRQ_1		1
+#define BCM6318_EXTIRQ_2		2
+#define BCM6318_EXTIRQ_3		3
+
 #endif /* __DT_BINDINGS_INTERRUPT_CONTROLLER_BCM6318_H */
diff --git a/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm63268-interrupt-controller.h b/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm63268-interrupt-controller.h
index 84a5f44611d4d1..90b7890f505d6c 100644
--- a/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm63268-interrupt-controller.h
+++ b/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm63268-interrupt-controller.h
@@ -35,9 +35,9 @@
 #define BCM63268_IRQ_ATM_DMA3		29
 #define BCM63268_IRQ_WAKE_ON_IRQ	30
 #define BCM63268_IRQ_GPHY		31
-#define BCM63268_IRQ_DECT0              32		
+#define BCM63268_IRQ_DECT0              32
 #define BCM63268_IRQ_DECT1		33
-#define BCM63268_IRQ_UART1              34		
+#define BCM63268_IRQ_UART1              34
 #define BCM63268_IRQ_WLAN_GPIO		35
 #define BCM63268_IRQ_USB_CTL_TX_DMA	36
 #define BCM63268_IRQ_USB_BULK_TX_DMA	37
@@ -83,4 +83,9 @@
 #define BCM63268_IRQ_ATM_DMA19		79
 #define BCM63268_IRQ_LSSPI		80
 
+#define BCM63268_EXTIRQ_0		0 /* GPIO 32 */
+#define BCM63268_EXTIRQ_1		1 /* GPIO 33 */
+#define BCM63268_EXTIRQ_2		2 /* GPIO 34 */
+#define BCM63268_EXTIRQ_3		3 /* GPIO 35 */
+
 #endif /* __DT_BINDINGS_INTERRUPT_CONTROLLER_BCM63268_H */
diff --git a/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm6328-interrupt-controller.h b/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm6328-interrupt-controller.h
index 1f5192d9feefb2..2a6a1da8886394 100644
--- a/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm6328-interrupt-controller.h
+++ b/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm6328-interrupt-controller.h
@@ -65,4 +65,9 @@
 #define BCM6328_IRQ_ATM_DMA19		62
 #define BCM6328_IRQ_SAR			63
 
+#define BCM6328_EXTIRQ_0		0 /* GPIO 23 */
+#define BCM6328_EXTIRQ_1		1 /* GPIO 24 */
+#define BCM6328_EXTIRQ_2		2 /* GPIO 15 */
+#define BCM6328_EXTIRQ_3		3 /* GPIO 12 */
+
 #endif /* __DT_BINDINGS_INTERRUPT_CONTROLLER_BCM6328_H */
diff --git a/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm6358-interrupt-controller.h b/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm6358-interrupt-controller.h
index dc412d1f5960cc..51c7e50cf49a98 100644
--- a/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm6358-interrupt-controller.h
+++ b/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm6358-interrupt-controller.h
@@ -35,4 +35,11 @@
 #define BCM6358_IRQ_DG			30
 #define BCM6358_IRQ_MPI			31
 
+#define BCM6358_EXTIRQ0_0		0 /* GPIO 34 */
+#define BCM6358_EXTIRQ0_1		1 /* GPIO 35 */
+#define BCM6358_EXTIRQ0_2		2 /* GPIO 36 */
+#define BCM6358_EXTIRQ0_3		3 /* GPIO 37 */
+#define BCM6358_EXTIRQ1_4		0 /* GPIO 32 */
+#define BCM6358_EXTIRQ1_5		1 /* GPIO 33 */
+
 #endif /* __DT_BINDINGS_INTERRUPT_CONTROLLER_BCM6358_H */
diff --git a/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm6362-interrupt-controller.h b/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm6362-interrupt-controller.h
index 2cb329204a442d..bec089b1592d0e 100644
--- a/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm6362-interrupt-controller.h
+++ b/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm6362-interrupt-controller.h
@@ -65,7 +65,12 @@
 #define BCM6362_IRQ_ATM_DMA15		59
 #define BCM6362_IRQ_ATM_DMA16		60
 #define BCM6362_IRQ_ATM_DMA17		61
-#define BCM6362_IRQ_ATM_DMA18		62		
+#define BCM6362_IRQ_ATM_DMA18		62
 #define BCM6362_IRQ_ATM_DMA19		63
 
+#define BCM6362_EXTIRQ_0		0 /* GPIO 24 */
+#define BCM6362_EXTIRQ_1		1 /* GPIO 25 */
+#define BCM6362_EXTIRQ_2		2 /* GPIO 26 */
+#define BCM6362_EXTIRQ_3		3 /* GPIO 27 */
+
 #endif /* __DT_BINDINGS_INTERRUPT_CONTROLLER_BCM6362_H */
diff --git a/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm6368-interrupt-controller.h b/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm6368-interrupt-controller.h
index 96a73d645e6179..0f36200749578d 100644
--- a/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm6368-interrupt-controller.h
+++ b/target/linux/bmips/files/include/dt-bindings/interrupt-controller/bcm6368-interrupt-controller.h
@@ -35,14 +35,14 @@
 #define BCM6368_IRQ_USB_BULK_TX_DMA	29
 #define BCM6368_IRQ_USB_ISO_RX_DMA	30
 #define BCM6368_IRQ_USB_ISO_TX_DMA	31
-#define BCM6368_IRQ_ENETSW_RX_DMA0	32	
-#define BCM6368_IRQ_ENETSW_RX_DMA1	33	
-#define BCM6368_IRQ_ENETSW_RX_DMA2	34	
-#define BCM6368_IRQ_ENETSW_RX_DMA3	35	
-#define BCM6368_IRQ_ENETSW_TX_DMA0	36	
-#define BCM6368_IRQ_ENETSW_TX_DMA1	37	
-#define BCM6368_IRQ_ENETSW_TX_DMA2	38	
-#define BCM6368_IRQ_ENETSW_TX_DMA3	39	
+#define BCM6368_IRQ_ENETSW_RX_DMA0	32
+#define BCM6368_IRQ_ENETSW_RX_DMA1	33
+#define BCM6368_IRQ_ENETSW_RX_DMA2	34
+#define BCM6368_IRQ_ENETSW_RX_DMA3	35
+#define BCM6368_IRQ_ENETSW_TX_DMA0	36
+#define BCM6368_IRQ_ENETSW_TX_DMA1	37
+#define BCM6368_IRQ_ENETSW_TX_DMA2	38
+#define BCM6368_IRQ_ENETSW_TX_DMA3	39
 #define BCM6368_IRQ_ATM_DMA0		40
 #define BCM6368_IRQ_ATM_DMA1		41
 #define BCM6368_IRQ_ATM_DMA2		42
@@ -68,4 +68,11 @@
 #define BCM6368_IRQ_PCM_DMA0		62
 #define BCM6368_IRQ_PCM_DMA1		63
 
+#define BCM6368_EXTIRQ0_0		0 /* GPIO 34 */
+#define BCM6368_EXTIRQ0_1		1 /* GPIO 35 */
+#define BCM6368_EXTIRQ0_2		2 /* GPIO 36 */
+#define BCM6368_EXTIRQ0_3		3 /* GPIO 37 */
+#define BCM6368_EXTIRQ1_4		0 /* GPIO 32 */
+#define BCM6368_EXTIRQ1_5		1 /* GPIO 33 */
+
 #endif /* __DT_BINDINGS_INTERRUPT_CONTROLLER_BCM6368_H */
diff --git a/target/linux/bmips/image/Makefile b/target/linux/bmips/image/Makefile
index 89cd04b0ec710f..9311e2df096fc0 100644
--- a/target/linux/bmips/image/Makefile
+++ b/target/linux/bmips/image/Makefile
@@ -4,11 +4,18 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/image.mk
 
 KERNEL_LOADADDR := 0x80010000		# RAM start + 64K
-LOADER_ENTRY := 0x80a00000		# RAM start + 10M, for relocate
-RAMSIZE := 0x02000000			# 32MB
-LZMA_TEXT_START := 0x81800000		# 32MB - 8MB
-
+LOADER_ENTRY := 0x81000000		# RAM start + 16M, for relocate
+LZMA_TEXT_START := 0x82000000		# RAM start + 32M
+
+DEVICE_VARS += CFE_BOARD_ID CFE_EXTRAS
+DEVICE_VARS += CFE_PART_FLAGS CFE_PART_ID
+DEVICE_VARS += CFE_RAM_FILE
+DEVICE_VARS += CFE_RAM_JFFS2_NAME CFE_RAM_JFFS2_PAD
+DEVICE_VARS += CFE_WFI_CHIP_ID CFE_WFI_FLASH_TYPE
+DEVICE_VARS += CFE_WFI_FLAGS CFE_WFI_VERSION
 DEVICE_VARS += CHIP_ID DEVICE_LOADADDR
+DEVICE_VARS += FLASH_MB IMAGE_OFFSET
+DEVICE_VARS += SERCOMM_FSVER SERCOMM_HWVER SERCOMM_SWVER
 
 define Build/Compile
 	rm -rf $(KDIR)/relocate
@@ -32,7 +39,6 @@ define Build/loader-lzma
 		LOADER_NAME="$(notdir $@)" \
 		LZMA_TEXT_START=$(LZMA_TEXT_START) \
 		PKG_BUILD_DIR="$@.src" \
-		RAMSIZE=$(RAMSIZE) \
 		TARGET_DIR="$(dir $@)" \
 		compile loader.$(1)
 	@mv "$@.$(1)" "$@"
@@ -196,12 +202,18 @@ define Build/cfe-sercomm-crypto
 endef
 
 define Build/cfe-sercomm-load
+	$(TOPDIR)/scripts/sercomm-pid.py \
+		--hw-version $(SERCOMM_HWVER) \
+		--sw-version $(SERCOMM_SWVER) \
+		--extra-padding-size 0x10 \
+		--pid-file $@.pid
 	$(TOPDIR)/scripts/sercomm-payload.py \
 		--input-file $@ \
 		--output-file $@.new \
-		--pid "$(SERCOMM_PID)"
+		--pid-file $@.pid
 
 	mv $@.new $@
+	rm -f $@.pid
 endef
 
 define Build/cfe-sercomm-part
@@ -210,18 +222,18 @@ define Build/cfe-sercomm-part
 		--output-file $@.kernel_rootfs \
 		--part-name kernel_rootfs \
 		--part-version OpenWrt \
-		--rootfs-version $(SERCOMM_VERSION)
+		--rootfs-version $(SERCOMM_FSVER)
 
 	rm -rf $@-rootfs_lib
 	mkdir -p $@-rootfs_lib
-	echo $(SERCOMM_VERSION) > $@-rootfs_lib/lib_ver
+	echo $(SERCOMM_FSVER) > $@-rootfs_lib/lib_ver
 	$(call Build/cfe-jffs2,$@-rootfs_lib)
 	$(call Build/pad-to,$(BLOCKSIZE))
 	$(TOPDIR)/scripts/sercomm-partition-tag.py \
 		--input-file $@ \
 		--output-file $@.rootfs_lib \
 		--part-name rootfs_lib \
-		--part-version $(SERCOMM_VERSION)
+		--part-version $(SERCOMM_FSVER)
 
 	mv $@.kernel_rootfs $@
 	dd if=$@.rootfs_lib >> $@
@@ -249,11 +261,83 @@ define Device/Default
   DEVICE_LOADADDR :=
 endef
 
-ATH9K_PACKAGES := kmod-ath9k wpad-basic-wolfssl
-B43_PACKAGES := kmod-b43 wpad-basic-wolfssl
-USB1_PACKAGES := kmod-usb-ohci kmod-ledtrig-usbdev
+define Device/bcm63xx-cfe
+  FILESYSTEMS := squashfs jffs2-64k jffs2-128k
+  KERNEL := kernel-bin | append-dtb | relocate-kernel | lzma
+  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-lzma elf
+  KERNEL_INITRAMFS_SUFFIX := .elf
+  IMAGES := cfe.bin sysupgrade.bin
+  IMAGE/cfe.bin := \
+    cfe-bin $$$$(if $$$$(FLASH_MB),--pad $$$$(shell expr $$$$(FLASH_MB) / 2))
+  IMAGE/sysupgrade.bin := cfe-bin | append-metadata
+  BLOCKSIZE := 0x10000
+  IMAGE_OFFSET :=
+  FLASH_MB :=
+  CFE_BOARD_ID :=
+  CFE_EXTRAS = --block-size $$(BLOCKSIZE) \
+    --image-offset $$(if $$(IMAGE_OFFSET),$$(IMAGE_OFFSET),$$(BLOCKSIZE))
+endef
+
+# Legacy CFEs with specific LZMA parameters and no length
+define Device/bcm63xx-cfe-legacy
+  $(Device/bcm63xx-cfe)
+  KERNEL := kernel-bin | append-dtb | relocate-kernel | lzma-cfe
+endef
+
+# CFE expects a single JFFS2 partition with cferam and kernel. However,
+# it's possible to fool CFE into properly loading both cferam and kernel
+# from two different JFFS2 partitions by adding dummy files (see
+# cfe-jffs2-cferam and cfe-jffs2-kernel).
+# Separate JFFS2 partitions allow upgrading openwrt without reflashing cferam
+# JFFS2 partition, which is much safer in case anything goes wrong.
+define Device/bcm63xx-nand
+  FILESYSTEMS := squashfs ubifs
+  KERNEL := kernel-bin | append-dtb | relocate-kernel | lzma | cfe-jffs2-kernel
+  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-lzma elf
+  KERNEL_INITRAMFS_SUFFIX := .elf
+  IMAGES := cfe.bin sysupgrade.bin
+  IMAGE/cfe.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) |\
+    cfe-jffs2-cferam | append-ubi | cfe-wfi-tag
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  KERNEL_SIZE := 5120k
+  CFE_PART_FLAGS :=
+  CFE_PART_ID :=
+  CFE_RAM_FILE :=
+  CFE_RAM_JFFS2_NAME :=
+  CFE_RAM_JFFS2_PAD :=
+  CFE_WFI_VERSION :=
+  CFE_WFI_CHIP_ID = 0x$$(CHIP_ID)
+  CFE_WFI_FLASH_TYPE :=
+  CFE_WFI_FLAGS :=
+  UBINIZE_OPTS := -E 5
+  DEVICE_PACKAGES += nand-utils
+endef
+
+define Device/bcm63xx-netgear
+  $(Device/bcm63xx-cfe)
+  DEVICE_VENDOR := NETGEAR
+  IMAGES := factory.chk sysupgrade.bin
+  IMAGE/factory.chk := cfe-bin | netgear-chk
+  NETGEAR_BOARD_ID :=
+  NETGEAR_REGION :=
+endef
+
+define Device/sercomm-nand
+  $(Device/bcm63xx-nand)
+  IMAGES := factory.img sysupgrade.bin
+  IMAGE/factory.img := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-ubi |\
+    cfe-sercomm-part | gzip | cfe-sercomm-load | cfe-sercomm-crypto
+  SERCOMM_FSVER :=
+  SERCOMM_HWVER :=
+  SERCOMM_SWVER :=
+endef
+
+### Package helpers ###
+ATH9K_PACKAGES := kmod-ath9k kmod-owl-loader wpad-basic-mbedtls
+B43_PACKAGES := kmod-b43 wpad-basic-mbedtls
+USB1_PACKAGES := kmod-usb-ohci kmod-usb-ledtrig-usbport
 USB2_PACKAGES := $(USB1_PACKAGES) kmod-usb2
 
-include bcm63xx_$(SUBTARGET).mk
+include $(SUBTARGET).mk
 
 $(eval $(call BuildImage))
diff --git a/target/linux/bmips/image/bcm6318.mk b/target/linux/bmips/image/bcm6318.mk
new file mode 100644
index 00000000000000..bfd75cc077329c
--- /dev/null
+++ b/target/linux/bmips/image/bcm6318.mk
@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+define Device/comtrend_ar-5315u
+  $(Device/bcm63xx-cfe)
+  DEVICE_VENDOR := Comtrend
+  DEVICE_MODEL := AR-5315u
+  CHIP_ID := 6318
+  CFE_BOARD_ID := 96318A-1441N1
+  FLASH_MB := 16
+  DEVICE_PACKAGES += $(USB2_PACKAGES) \
+    $(B43_PACKAGES) broadcom-43217-sprom \
+    kmod-leds-bcm6328
+endef
+TARGET_DEVICES += comtrend_ar-5315u
diff --git a/target/linux/bmips/image/bcm63268.mk b/target/linux/bmips/image/bcm63268.mk
new file mode 100644
index 00000000000000..941e83f71bf6bd
--- /dev/null
+++ b/target/linux/bmips/image/bcm63268.mk
@@ -0,0 +1,102 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+define Device/comtrend_vg-8050
+  $(Device/bcm63xx-nand)
+  DEVICE_VENDOR := Comtrend
+  DEVICE_MODEL := VG-8050
+  CHIP_ID := 63268
+  SOC := bcm63169
+  CFE_RAM_FILE := comtrend,vg-8050/cferam.000
+  CFE_RAM_JFFS2_NAME := cferam.000
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  SUBPAGESIZE := 512
+  VID_HDR_OFFSET := 2048
+  DEVICE_PACKAGES += $(USB2_PACKAGES) \
+    kmod-leds-bcm6328
+  CFE_WFI_FLASH_TYPE := 3
+  CFE_WFI_VERSION := 0x5732
+endef
+TARGET_DEVICES += comtrend_vg-8050
+
+define Device/comtrend_vr-3032u
+  $(Device/bcm63xx-nand)
+  DEVICE_VENDOR := Comtrend
+  DEVICE_MODEL := VR-3032u
+  CHIP_ID := 63268
+  SOC := bcm63168
+  CFE_RAM_FILE := comtrend,vr-3032u/cferam.000
+  CFE_RAM_JFFS2_NAME := cferam.000
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  SUBPAGESIZE := 512
+  VID_HDR_OFFSET := 2048
+  DEVICE_PACKAGES += $(USB2_PACKAGES) \
+    kmod-leds-bcm6328
+  CFE_WFI_FLASH_TYPE := 3
+  CFE_WFI_VERSION := 0x5732
+endef
+TARGET_DEVICES += comtrend_vr-3032u
+
+define Device/sercomm_h500-s-lowi
+  $(Device/sercomm-nand)
+  DEVICE_VENDOR := Sercomm
+  DEVICE_MODEL := H500-s
+  DEVICE_VARIANT := lowi
+  DEVICE_LOADADDR := $(KERNEL_LOADADDR)
+  KERNEL := kernel-bin | append-dtb | lzma | cfe-jffs2-kernel
+  CHIP_ID := 63268
+  SOC := bcm63167
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  SUBPAGESIZE := 512
+  VID_HDR_OFFSET := 2048
+  DEVICE_PACKAGES += $(USB2_PACKAGES) \
+    kmod-leds-bcm6328
+  SERCOMM_FSVER := 1001
+  SERCOMM_HWVER := 1434b31
+  SERCOMM_SWVER := 3305
+endef
+TARGET_DEVICES += sercomm_h500-s-lowi
+
+define Device/sercomm_h500-s-vfes
+  $(Device/sercomm-nand)
+  DEVICE_VENDOR := Sercomm
+  DEVICE_MODEL := H500-s
+  DEVICE_VARIANT := vfes
+  DEVICE_LOADADDR := $(KERNEL_LOADADDR)
+  KERNEL := kernel-bin | append-dtb | lzma | cfe-jffs2-kernel
+  CHIP_ID := 63268
+  SOC := bcm63167
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  SUBPAGESIZE := 512
+  VID_HDR_OFFSET := 2048
+  DEVICE_PACKAGES += $(USB2_PACKAGES) \
+    kmod-leds-bcm6328
+  SERCOMM_FSVER := 1001
+  SERCOMM_HWVER := 142584b
+  SERCOMM_SWVER := 3417
+endef
+TARGET_DEVICES += sercomm_h500-s-vfes
+
+define Device/sercomm_shg2500
+  $(Device/sercomm-nand)
+  DEVICE_VENDOR := Sercomm
+  DEVICE_MODEL := SHG2500
+  DEVICE_LOADADDR := $(KERNEL_LOADADDR)
+  KERNEL := kernel-bin | append-dtb | lzma | cfe-jffs2-kernel
+  CHIP_ID := 63268
+  SOC := bcm63168
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  SUBPAGESIZE := 512
+  VID_HDR_OFFSET := 2048
+  DEVICE_PACKAGES += $(USB2_PACKAGES) \
+    broadcom-4360-sprom \
+    kmod-i2c-gpio kmod-leds-sercomm-msp430
+  SERCOMM_FSVER := 1001
+  SERCOMM_HWVER := 1424e4a
+  SERCOMM_SWVER := 3207
+endef
+TARGET_DEVICES += sercomm_shg2500
diff --git a/target/linux/bmips/image/bcm6328.mk b/target/linux/bmips/image/bcm6328.mk
new file mode 100644
index 00000000000000..8023ef8fa1eef9
--- /dev/null
+++ b/target/linux/bmips/image/bcm6328.mk
@@ -0,0 +1,58 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+define Device/comtrend_ar-5381u
+  $(Device/bcm63xx-cfe)
+  DEVICE_VENDOR := Comtrend
+  DEVICE_MODEL := AR-5381u
+  CHIP_ID := 6328
+  CFE_BOARD_ID := 96328A-1241N
+  FLASH_MB := 16
+  DEVICE_PACKAGES += $(USB2_PACKAGES) \
+    $(B43_PACKAGES) broadcom-43225-sprom \
+    kmod-leds-bcm6328
+endef
+TARGET_DEVICES += comtrend_ar-5381u
+
+define Device/comtrend_ar-5387un
+  $(Device/bcm63xx-cfe)
+  DEVICE_VENDOR := Comtrend
+  DEVICE_MODEL := AR-5387un
+  CHIP_ID := 6328
+  CFE_BOARD_ID := 96328A-1441N1
+  FLASH_MB := 16
+  DEVICE_PACKAGES += $(USB2_PACKAGES) \
+    $(B43_PACKAGES) broadcom-43225-sprom \
+    kmod-leds-bcm6328
+endef
+TARGET_DEVICES += comtrend_ar-5387un
+
+define Device/nucom_r5010unv2
+  $(Device/bcm63xx-cfe)
+  DEVICE_VENDOR := NuCom
+  DEVICE_MODEL := R5010UNv2
+  CHIP_ID := 6328
+  CFE_BOARD_ID := 96328ang
+  FLASH_MB := 16
+  DEVICE_PACKAGES += $(USB2_PACKAGES) \
+    $(B43_PACKAGES) broadcom-43217-sprom \
+    kmod-leds-bcm6328
+endef
+TARGET_DEVICES += nucom_r5010unv2
+
+define Device/sercomm_ad1018
+  $(Device/sercomm-nand)
+  DEVICE_VENDOR := Sercomm
+  DEVICE_MODEL := AD1018
+  CHIP_ID := 6328
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  SUBPAGESIZE := 512
+  VID_HDR_OFFSET := 2048
+  DEVICE_PACKAGES += $(USB2_PACKAGES) \
+    $(B43_PACKAGES) broadcom-43217-sprom \
+    kmod-leds-bcm6328
+  SERCOMM_FSVER := 1001
+  SERCOMM_HWVER := 1415153
+  SERCOMM_SWVER := 3013
+endef
+TARGET_DEVICES += sercomm_ad1018
diff --git a/target/linux/bmips/image/bcm6358.mk b/target/linux/bmips/image/bcm6358.mk
new file mode 100644
index 00000000000000..33c87f9ce4a3db
--- /dev/null
+++ b/target/linux/bmips/image/bcm6358.mk
@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+define Device/huawei_hg556a-b
+  $(Device/bcm63xx-cfe-legacy)
+  DEVICE_VENDOR := Huawei
+  DEVICE_MODEL := EchoLife HG556a
+  DEVICE_VARIANT := B
+  CHIP_ID := 6358
+  CFE_BOARD_ID := HW556
+  CFE_EXTRAS += --rsa-signature "EchoLife_HG556a" --tag-version 8
+  BLOCKSIZE := 0x20000
+  DEVICE_PACKAGES += $(USB2_PACKAGES) $(ATH9K_PACKAGES) \
+    kmod-leds-gpio
+endef
+TARGET_DEVICES += huawei_hg556a-b
diff --git a/target/linux/bmips/image/bcm6362.mk b/target/linux/bmips/image/bcm6362.mk
new file mode 100644
index 00000000000000..9731973f9fc5a1
--- /dev/null
+++ b/target/linux/bmips/image/bcm6362.mk
@@ -0,0 +1,42 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+define Device/huawei_hg253s-v2
+  $(Device/bcm63xx-nand)
+  IMAGES := flash.bin sysupgrade.bin
+  IMAGE/flash.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | cfe-jffs2-cferam | append-ubi
+  DEVICE_VENDOR := Huawei
+  DEVICE_MODEL := HG253s
+  DEVICE_VARIANT := v2
+  CHIP_ID := 6362
+  CFE_PART_FLAGS := 1
+  CFE_PART_ID := 0x0001EFEE
+  CFE_RAM_FILE := huawei,hg253s-v2/cferam.000
+  CFE_RAM_JFFS2_NAME := cferam.000
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  SUBPAGESIZE := 512
+  VID_HDR_OFFSET := 2048
+  DEVICE_PACKAGES += $(USB2_PACKAGES) \
+    kmod-leds-bcm6328 kmod-leds-gpio
+  CFE_WFI_FLASH_TYPE := 3
+endef
+TARGET_DEVICES += huawei_hg253s-v2
+
+define Device/netgear_dgnd3700-v2
+  $(Device/bcm63xx-nand)
+  DEVICE_VENDOR := NETGEAR
+  DEVICE_MODEL := DGND3700
+  DEVICE_VARIANT := v2
+  CHIP_ID := 6362
+  CFE_RAM_FILE := netgear,dgnd3700-v2/cferam
+  CFE_RAM_JFFS2_NAME := cferam
+  CFE_RAM_JFFS2_PAD := 496k
+  BLOCKSIZE := 16k
+  PAGESIZE := 512
+  DEVICE_PACKAGES += $(USB2_PACKAGES) \
+    $(B43_PACKAGES) \
+    kmod-leds-bcm6328 kmod-leds-gpio
+  CFE_WFI_FLASH_TYPE := 2
+  CFE_WFI_VERSION := 0x5731
+endef
+TARGET_DEVICES += netgear_dgnd3700-v2
diff --git a/target/linux/bmips/image/bcm6368.mk b/target/linux/bmips/image/bcm6368.mk
new file mode 100644
index 00000000000000..39fcb023182542
--- /dev/null
+++ b/target/linux/bmips/image/bcm6368.mk
@@ -0,0 +1,118 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+define Device/actiontec_r1000h
+  $(Device/bcm63xx-cfe)
+  DEVICE_VENDOR := Actiontec
+  DEVICE_MODEL := R1000H
+  CHIP_ID := 6368
+  CFE_BOARD_ID := 96368VVW
+  BLOCKSIZE := 0x20000
+  FLASH_MB := 32
+  CFE_EXTRAS += --signature "$$(DEVICE_VENDOR)"
+  DEVICE_PACKAGES += $(USB2_PACKAGES) \
+    $(B43_PACKAGES) \
+    kmod-leds-gpio
+endef
+TARGET_DEVICES += actiontec_r1000h
+
+define Device/comtrend_vr-3025u
+  $(Device/bcm63xx-cfe)
+  DEVICE_VENDOR := Comtrend
+  DEVICE_MODEL := VR-3025u
+  CHIP_ID := 6368
+  CFE_BOARD_ID := 96368M-1541N
+  BLOCKSIZE := 0x20000
+  FLASH_MB := 32
+  DEVICE_PACKAGES += $(USB2_PACKAGES) \
+    $(B43_PACKAGES) broadcom-43222-sprom \
+    kmod-leds-gpio
+endef
+TARGET_DEVICES += comtrend_vr-3025u
+
+define Device/comtrend_vr-3025un
+  $(Device/bcm63xx-cfe)
+  DEVICE_VENDOR := Comtrend
+  DEVICE_MODEL := VR-3025un
+  CHIP_ID := 6368
+  CFE_BOARD_ID := 96368M-1341N
+  FLASH_MB := 8
+  DEVICE_PACKAGES += $(USB2_PACKAGES) \
+    $(B43_PACKAGES) broadcom-43222-sprom \
+    kmod-leds-gpio
+endef
+TARGET_DEVICES += comtrend_vr-3025un
+
+define Device/comtrend_wap-5813n
+  $(Device/bcm63xx-cfe)
+  DEVICE_VENDOR := Comtrend
+  DEVICE_MODEL := WAP-5813n
+  CHIP_ID := 6368
+  SOC := bcm6369
+  CFE_BOARD_ID := 96369R-1231N
+  FLASH_MB := 8
+  DEVICE_PACKAGES += $(USB2_PACKAGES) \
+    $(B43_PACKAGES) broadcom-4322-sprom \
+    kmod-leds-gpio
+endef
+TARGET_DEVICES += comtrend_wap-5813n
+
+define Device/netgear_dgnd3700-v1
+  $(Device/bcm63xx-netgear)
+  DEVICE_VENDOR := NETGEAR
+  DEVICE_MODEL := DGND3700
+  DEVICE_VARIANT := v1
+  CFE_BOARD_ID := 96368MVWG
+  CHIP_ID := 6368
+  BLOCKSIZE := 0x20000
+  NETGEAR_BOARD_ID := U12L144T01_NETGEAR_NEWLED
+  NETGEAR_REGION := 1
+  DEVICE_PACKAGES += $(USB2_PACKAGES) \
+    $(B43_PACKAGES) \
+    kmod-leds-gpio
+endef
+TARGET_DEVICES += netgear_dgnd3700-v1
+
+define Device/netgear_dgnd3800b
+  $(Device/bcm63xx-netgear)
+  DEVICE_VENDOR := NETGEAR
+  DEVICE_MODEL := DGND3800B
+  CFE_BOARD_ID := 96368MVWG
+  CHIP_ID := 6368
+  BLOCKSIZE := 0x20000
+  NETGEAR_BOARD_ID := U12L144T11_NETGEAR_NEWLED
+  NETGEAR_REGION := 1
+  DEVICE_PACKAGES += $(USB2_PACKAGES) \
+    $(B43_PACKAGES) \
+    kmod-leds-gpio
+endef
+TARGET_DEVICES += netgear_dgnd3800b
+
+define Device/netgear_evg2000
+  $(Device/bcm63xx-netgear)
+  DEVICE_MODEL := EVG2000
+  CFE_BOARD_ID := 96369PVG
+  CHIP_ID := 6368
+  SOC := bcm6369
+  BLOCKSIZE := 0x20000
+  NETGEAR_BOARD_ID := U12H154T90_NETGEAR
+  NETGEAR_REGION := 1
+  DEVICE_PACKAGES += $(USB2_PACKAGES) \
+    $(B43_PACKAGES) broadcom-4322-sprom \
+    kmod-leds-gpio
+endef
+TARGET_DEVICES += netgear_evg2000
+
+define Device/observa_vh4032n
+  $(Device/bcm63xx-cfe)
+  DEVICE_VENDOR := Observa
+  DEVICE_MODEL := VH4032N
+  IMAGES += sysupgrade.bin
+  CFE_BOARD_ID := 96368VVW
+  CHIP_ID := 6368
+  BLOCKSIZE := 0x20000
+  FLASH_MB := 32
+  DEVICE_PACKAGES += $(USB2_PACKAGES) \
+    $(B43_PACKAGES) broadcom-43222-sprom \
+    kmod-leds-gpio
+endef
+TARGET_DEVICES += observa_vh4032n
diff --git a/target/linux/bmips/modules.mk b/target/linux/bmips/modules.mk
new file mode 100644
index 00000000000000..3032dab7099563
--- /dev/null
+++ b/target/linux/bmips/modules.mk
@@ -0,0 +1,46 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+define KernelPackage/leds-bcm6328
+  SUBMENU:=$(LEDS_MENU)
+  TITLE:=BCM6328 LED support
+  KCONFIG:=CONFIG_LEDS_BCM6328
+  FILES:=$(LINUX_DIR)/drivers/leds/leds-bcm6328.ko
+  DEPENDS:=@TARGET_bmips
+  AUTOLOAD:=$(call AutoLoad,60,leds-bcm6328,1)
+endef
+
+define KernelPackage/leds-bcm6328/description
+  Kernel support for the BCM6328 LED controller.
+endef
+
+$(eval $(call KernelPackage,leds-bcm6328))
+
+define KernelPackage/leds-bcm6358
+  SUBMENU:=$(LEDS_MENU)
+  TITLE:=BCM6358 LED support
+  KCONFIG:=CONFIG_LEDS_BCM6358
+  FILES:=$(LINUX_DIR)/drivers/leds/leds-bcm6358.ko
+  DEPENDS:=@TARGET_bmips
+  AUTOLOAD:=$(call AutoLoad,60,leds-bcm6358,1)
+endef
+
+define KernelPackage/leds-bcm6358/description
+  Kernel support for the BCM6358 LED controller.
+endef
+
+$(eval $(call KernelPackage,leds-bcm6358))
+
+define KernelPackage/leds-sercomm-msp430
+  SUBMENU:=$(LEDS_MENU)
+  TITLE:=Sercomm MSP430G2513 LED support
+  KCONFIG:=CONFIG_LEDS_SERCOMM_MSP430
+  FILES:=$(LINUX_DIR)/drivers/leds/leds-sercomm-msp430.ko
+  DEPENDS:=@TARGET_bmips +kmod-ledtrig-pattern
+  AUTOLOAD:=$(call AutoLoad,60,leds-sercomm-msp430,1)
+endef
+
+define KernelPackage/leds-sercomm-msp430/description
+  Kernel support for the Sercomm MSP430G2513 SPI LED controller.
+endef
+
+$(eval $(call KernelPackage,leds-sercomm-msp430))
diff --git a/target/linux/bmips/patches-5.15/100-irqchip-add-support-for-bcm6345-style-external-inter.patch b/target/linux/bmips/patches-5.15/100-irqchip-add-support-for-bcm6345-style-external-inter.patch
index ba55107bb10f04..44cdb068f96597 100644
--- a/target/linux/bmips/patches-5.15/100-irqchip-add-support-for-bcm6345-style-external-inter.patch
+++ b/target/linux/bmips/patches-5.15/100-irqchip-add-support-for-bcm6345-style-external-inter.patch
@@ -1,17 +1,17 @@
 From cf908990d4a8ccdb73ee4484aa8cadad379ca314 Mon Sep 17 00:00:00 2001
 From: Jonas Gorski <jogo@openwrt.org>
 Date: Sun, 30 Nov 2014 14:54:27 +0100
-Subject: [PATCH 2/5] irqchip: add support for bcm6345-style external
- interrupt controller
+Subject: [PATCH] irqchip: add support for bcm6345-style external interrupt
+ controller
 
 Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 ---
- .../interrupt-controller/brcm,bcm6345-ext-intc.txt |   29 ++
- drivers/irqchip/Kconfig                            |    4 +
- drivers/irqchip/Makefile                           |    1 +
- drivers/irqchip/irq-bcm6345-ext.c                  |  287 ++++++++++++++++++++
- include/linux/irqchip/irq-bcm6345-ext.h            |   14 +
- 5 files changed, 335 insertions(+)
+ .../brcm,bcm6345-ext-intc.txt                 |  29 ++
+ drivers/irqchip/Kconfig                       |   4 +
+ drivers/irqchip/Makefile                      |   1 +
+ drivers/irqchip/irq-bcm6345-ext.c             | 280 ++++++++++++++++++
+ include/linux/irqchip/irq-bcm6345-ext.h       |  14 +
+ 5 files changed, 328 insertions(+)
  create mode 100644 Documentation/devicetree/bindings/interrupt-controller/brcm,bcm6345-ext-intc.txt
  create mode 100644 drivers/irqchip/irq-bcm6345-ext.c
  create mode 100644 include/linux/irqchip/irq-bcm6345-ext.h
@@ -73,7 +73,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  obj-$(CONFIG_BCM7120_L2_IRQ)		+= irq-bcm7120-l2.o
 --- /dev/null
 +++ b/drivers/irqchip/irq-bcm6345-ext.c
-@@ -0,0 +1,299 @@
+@@ -0,0 +1,280 @@
 +/*
 + * This file is subject to the terms and conditions of the GNU General Public
 + * License.  See the file "COPYING" in the main directory of this archive
@@ -94,14 +94,6 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 +#include <linux/slab.h>
 +#include <linux/spinlock.h>
 +
-+#ifdef CONFIG_BCM63XX
-+#include <asm/mach-bcm63xx/bcm63xx_irq.h>
-+
-+#define VIRQ_BASE		IRQ_EXTERNAL_BASE
-+#else
-+#define VIRQ_BASE		0
-+#endif
-+
 +#define MAX_IRQS		4
 +
 +#define EXTIRQ_CFG_SENSE	0
@@ -271,7 +263,6 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 +{
 +	struct intc_data *data;
 +	unsigned int i;
-+	int start = VIRQ_BASE;
 +
 +	data = kzalloc(sizeof(*data), GFP_KERNEL);
 +	if (!data)
@@ -296,17 +287,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 +	data->chip.irq_unmask = bcm6345_ext_intc_irq_unmask;
 +	data->chip.irq_set_type = bcm6345_ext_intc_set_type;
 +
-+	/*
-+	 * If we have less than 4 irqs, this is the second controller on
-+	 * bcm63xx. So increase the VIRQ start to not overlap with the first
-+	 * one, but only do so if we actually use a non-zero start.
-+	 *
-+	 * This can be removed when bcm63xx has no legacy users anymore.
-+	 */
-+	if (start && num_irqs < 4)
-+		start += 4;
-+
-+	data->domain = irq_domain_add_simple(node, num_irqs, start,
++	data->domain = irq_domain_add_linear(node, num_irqs,
 +					     &bcm6345_ext_domain_ops, data);
 +	if (!data->domain) {
 +		kfree(data);
diff --git a/target/linux/bmips/patches-5.15/200-mips-bmips-automatically-detect-CPU-frequency.patch b/target/linux/bmips/patches-5.15/200-mips-bmips-automatically-detect-CPU-frequency.patch
index 40c977baf8da2e..e2b73e6ac42fc2 100644
--- a/target/linux/bmips/patches-5.15/200-mips-bmips-automatically-detect-CPU-frequency.patch
+++ b/target/linux/bmips/patches-5.15/200-mips-bmips-automatically-detect-CPU-frequency.patch
@@ -1,7 +1,7 @@
 From 0377ad93031d3e51c2afe44231241185f684b6af Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
 Date: Fri, 5 Mar 2021 15:14:32 +0100
-Subject: [PATCH 1/2] mips: bmips: automatically detect CPU frequency
+Subject: [PATCH] mips: bmips: automatically detect CPU frequency
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -10,12 +10,12 @@ Some BCM63xx SoCs support multiple CPU frequencies depending on HW config.
 
 Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
 ---
- arch/mips/bmips/setup.c | 198 ++++++++++++++++++++++++++++++++++++++--
- 1 file changed, 191 insertions(+), 7 deletions(-)
+ arch/mips/bmips/setup.c | 197 ++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 190 insertions(+), 7 deletions(-)
 
 --- a/arch/mips/bmips/setup.c
 +++ b/arch/mips/bmips/setup.c
-@@ -31,11 +31,51 @@
+@@ -31,13 +31,52 @@
  
  #define RELO_NORMAL_VEC		BIT(18)
  
@@ -55,7 +55,8 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
 +#define REG_BCM63268_MISC_SB	((void __iomem *)CKSEG1ADDR(0x10001814))
 +#define BCM63268_FCVO_SHIFT	21
 +#define BCM63268_FCVO_MASK	(0xf << BCM63268_FCVO_SHIFT)
-+
+ 
+ extern bool bmips_rac_flush_disable;
  
  static const unsigned long kbase = VMLINUX_LOAD_ADDRESS & 0xfff00000;
  
@@ -67,7 +68,7 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
  struct bmips_quirk {
  	const char		*compatible;
  	void			(*quirk_fn)(void);
-@@ -134,17 +174,161 @@ const char *get_system_type(void)
+@@ -142,17 +181,161 @@ const char *get_system_type(void)
  	return "Generic BMIPS kernel";
  }
  
diff --git a/target/linux/bmips/patches-5.15/201-mips-bmips-automatically-detect-RAM-size.patch b/target/linux/bmips/patches-5.15/201-mips-bmips-automatically-detect-RAM-size.patch
index b06795a44e1c76..c0bdb0d5ceb56f 100644
--- a/target/linux/bmips/patches-5.15/201-mips-bmips-automatically-detect-RAM-size.patch
+++ b/target/linux/bmips/patches-5.15/201-mips-bmips-automatically-detect-RAM-size.patch
@@ -1,7 +1,7 @@
 From f9ee3f28ecb979c77423be965ef9dd313bdb9e9b Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
 Date: Mon, 8 Mar 2021 16:58:34 +0100
-Subject: [PATCH 2/2] mips: bmips: automatically detect RAM size
+Subject: [PATCH] mips: bmips: automatically detect RAM size
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -10,8 +10,8 @@ Some devices have different amounts of RAM installed depending on HW revision.
 
 Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
 ---
- arch/mips/bmips/setup.c | 118 ++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 118 insertions(+)
+ arch/mips/bmips/setup.c | 119 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 119 insertions(+)
 
 --- a/arch/mips/bmips/setup.c
 +++ b/arch/mips/bmips/setup.c
@@ -50,12 +50,12 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
  #define REG_BCM6368_DDR_PLLC	((void __iomem *)CKSEG1ADDR(0x100012a0))
  #define BCM6368_PLLC_P1_SHIFT	0
  #define BCM6368_PLLC_P1_MASK	(0xf << BCM6368_PLLC_P1_SHIFT)
-@@ -67,7 +73,21 @@
+@@ -67,6 +73,21 @@
  #define REG_BCM63268_MISC_SB	((void __iomem *)CKSEG1ADDR(0x10001814))
  #define BCM63268_FCVO_SHIFT	21
  #define BCM63268_FCVO_MASK	(0xf << BCM63268_FCVO_SHIFT)
 +#define BCM63268_MEMC_ADDR	((void __iomem *)CKSEG1ADDR(0x10003000))
- 
++
 +#define SDRAM_CFG_REG		0x0
 +#define SDRAM_SPACE_SHIFT	4
 +#define SDRAM_SPACE_MASK	(0xf << SDRAM_SPACE_SHIFT)
@@ -70,9 +70,9 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
 +
 +#define DDR_CSEND_REG		0x8
  
- static const unsigned long kbase = VMLINUX_LOAD_ADDRESS & 0xfff00000;
+ extern bool bmips_rac_flush_disable;
  
-@@ -76,6 +96,11 @@ struct bmips_cpufreq {
+@@ -77,6 +98,11 @@ struct bmips_cpufreq {
  	u32			(*cpu_freq)(void);
  };
  
@@ -84,7 +84,7 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
  struct bmips_quirk {
  	const char		*compatible;
  	void			(*quirk_fn)(void);
-@@ -333,9 +358,90 @@ void __init plat_time_init(void)
+@@ -340,9 +366,90 @@ void __init plat_time_init(void)
  	mips_hpt_frequency = freq;
  }
  
@@ -175,7 +175,7 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
  	const struct bmips_quirk *q;
  
  	set_io_port_base(0);
-@@ -353,6 +459,18 @@ void __init plat_mem_setup(void)
+@@ -360,6 +467,18 @@ void __init plat_mem_setup(void)
  
  	__dt_setup_arch(dtb);
  
diff --git a/target/linux/bmips/patches-5.15/202-mips-bmips-tweak-Kconfig-options.patch b/target/linux/bmips/patches-5.15/202-mips-bmips-tweak-Kconfig-options.patch
new file mode 100644
index 00000000000000..c39df850a03448
--- /dev/null
+++ b/target/linux/bmips/patches-5.15/202-mips-bmips-tweak-Kconfig-options.patch
@@ -0,0 +1,42 @@
+From 20a4b57c0fafd23ae0f6bcab5b5adf4af4c80280 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Thu, 16 Mar 2023 19:31:21 +0100
+Subject: [PATCH] mips: bmips: tweak Kconfig options
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ arch/mips/Kconfig | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -274,25 +274,20 @@ config BMIPS_GENERIC
+ 	select SYNC_R4K
+ 	select COMMON_CLK
+ 	select BCM6345_L1_IRQ
+-	select BCM7038_L1_IRQ
+-	select BCM7120_L2_IRQ
+-	select BRCMSTB_L2_IRQ
+ 	select IRQ_MIPS_CPU
+ 	select DMA_NONCOHERENT
+ 	select SYS_SUPPORTS_32BIT_KERNEL
+-	select SYS_SUPPORTS_LITTLE_ENDIAN
+ 	select SYS_SUPPORTS_BIG_ENDIAN
+-	select SYS_SUPPORTS_HIGHMEM
+ 	select SYS_HAS_CPU_BMIPS32_3300
+ 	select SYS_HAS_CPU_BMIPS4350
+ 	select SYS_HAS_CPU_BMIPS4380
+-	select SYS_HAS_CPU_BMIPS5000
+ 	select SWAP_IO_SPACE
+ 	select USB_EHCI_BIG_ENDIAN_DESC if CPU_BIG_ENDIAN
+ 	select USB_EHCI_BIG_ENDIAN_MMIO if CPU_BIG_ENDIAN
+ 	select USB_OHCI_BIG_ENDIAN_DESC if CPU_BIG_ENDIAN
+ 	select USB_OHCI_BIG_ENDIAN_MMIO if CPU_BIG_ENDIAN
+ 	select HARDIRQS_SW_RESEND
++	select MIPS_L1_CACHE_SHIFT_4
+ 	help
+ 	  Build a generic DT-based kernel image that boots on select
+ 	  BCM33xx cable modem chips, BCM63xx DSL chips, and BCM7xxx set-top
diff --git a/target/linux/bmips/patches-5.15/203-mips-bmips-dma-fix-CBR-address.patch b/target/linux/bmips/patches-5.15/203-mips-bmips-dma-fix-CBR-address.patch
new file mode 100644
index 00000000000000..57bf395e2e0daf
--- /dev/null
+++ b/target/linux/bmips/patches-5.15/203-mips-bmips-dma-fix-CBR-address.patch
@@ -0,0 +1,84 @@
+From 3e4c3863e0cfb8c2abdff6bb494ca69d3d2aed9c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Sat, 10 Jun 2023 17:01:40 +0200
+Subject: [PATCH] mips: bmips: dma: fix CBR address
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Some BCM63xx SoCs may return CBR address as 0.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ arch/mips/bmips/dma.c   | 12 ++++--------
+ arch/mips/bmips/setup.c | 11 ++++-------
+ 2 files changed, 8 insertions(+), 15 deletions(-)
+
+--- a/arch/mips/bmips/dma.c
++++ b/arch/mips/bmips/dma.c
+@@ -64,11 +64,10 @@ phys_addr_t dma_to_phys(struct device *d
+ 	return dma_addr;
+ }
+ 
+-bool bmips_rac_flush_disable;
++void __iomem *bmips_cbr_addr;
+ 
+ void arch_sync_dma_for_cpu_all(void)
+ {
+-	void __iomem *cbr = BMIPS_GET_CBR();
+ 	u32 cfg;
+ 
+ 	if (boot_cpu_type() != CPU_BMIPS3300 &&
+@@ -76,13 +75,10 @@ void arch_sync_dma_for_cpu_all(void)
+ 	    boot_cpu_type() != CPU_BMIPS4380)
+ 		return;
+ 
+-	if (unlikely(bmips_rac_flush_disable))
+-		return;
+-
+ 	/* Flush stale data out of the readahead cache */
+-	cfg = __raw_readl(cbr + BMIPS_RAC_CONFIG);
+-	__raw_writel(cfg | 0x100, cbr + BMIPS_RAC_CONFIG);
+-	__raw_readl(cbr + BMIPS_RAC_CONFIG);
++	cfg = __raw_readl(bmips_cbr_addr + BMIPS_RAC_CONFIG);
++	__raw_writel(cfg | 0x100, bmips_cbr_addr + BMIPS_RAC_CONFIG);
++	__raw_readl(bmips_cbr_addr + BMIPS_RAC_CONFIG);
+ }
+ 
+ static int __init bmips_init_dma_ranges(void)
+--- a/arch/mips/bmips/setup.c
++++ b/arch/mips/bmips/setup.c
+@@ -89,7 +89,7 @@
+ 
+ #define DDR_CSEND_REG		0x8
+ 
+-extern bool bmips_rac_flush_disable;
++extern void __iomem *bmips_cbr_addr;
+ 
+ static const unsigned long kbase = VMLINUX_LOAD_ADDRESS & 0xfff00000;
+ 
+@@ -170,12 +170,6 @@ static void bcm6358_quirks(void)
+ 	 * disable SMP for now
+ 	 */
+ 	bmips_smp_enabled = 0;
+-
+-	/*
+-	 * RAC flush causes kernel panics on BCM6358 when booting from TP1
+-	 * because the bootloader is not initializing it properly.
+-	 */
+-	bmips_rac_flush_disable = !!(read_c0_brcm_cmt_local() & (1 << 31));
+ }
+ 
+ static void bcm6368_quirks(void)
+@@ -198,6 +192,11 @@ static const struct bmips_quirk bmips_qu
+ 
+ void __init prom_init(void)
+ {
++	if (!(read_c0_brcm_cbr() >> 18))
++		bmips_cbr_addr = (void __iomem *)0xff400000;
++	else
++		bmips_cbr_addr = BMIPS_GET_CBR();
++
+ 	bmips_cpu_setup();
+ 	register_bmips_smp_ops();
+ }
diff --git a/target/linux/bmips/patches-5.15/204-mips-bmips-enable-RAC-on-BMIPS4350.patch b/target/linux/bmips/patches-5.15/204-mips-bmips-enable-RAC-on-BMIPS4350.patch
new file mode 100644
index 00000000000000..26bd03e3298af0
--- /dev/null
+++ b/target/linux/bmips/patches-5.15/204-mips-bmips-enable-RAC-on-BMIPS4350.patch
@@ -0,0 +1,42 @@
+From 7f862eaedac56b67972393f0a9affcd2fe53479b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Daniel=20Gonz=C3=A1lez=20Cabanelas?= <dgcbueu@gmail.com>
+Date: Sun, 18 Jun 2023 19:59:25 +0200
+Subject: [PATCH] mips: bmips: enable RAC on BMIPS4350
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The data RAC is left disabled by the bootloader in some SoCs, at least in
+the core it boots from.
+Enabling this feature increases the performance up to +30% depending on the
+task.
+
+Signed-off-by: Daniel González Cabanelas <dgcbueu@gmail.com>
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ arch/mips/kernel/smp-bmips.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/arch/mips/kernel/smp-bmips.c
++++ b/arch/mips/kernel/smp-bmips.c
+@@ -614,6 +614,20 @@ void bmips_cpu_setup(void)
+ 		__raw_readl(cbr + BMIPS_RAC_ADDRESS_RANGE);
+ 		break;
+ 
++	case CPU_BMIPS4350:
++		/* Enable data RAC */
++		if (!(read_c0_brcm_cmt_local() & (1 << 31))) {
++			cfg = __raw_readl(cbr + BMIPS_RAC_CONFIG);
++			__raw_writel(cfg | 0xa, cbr + BMIPS_RAC_CONFIG);
++			__raw_readl(cbr + BMIPS_RAC_CONFIG);
++		} else {
++			cbr = (void __iomem *)0xff400000;
++			cfg = __raw_readl(cbr + BMIPS_RAC_CONFIG_1);
++			__raw_writel(cfg | 0xa, cbr + BMIPS_RAC_CONFIG_1);
++			__raw_readl(cbr + BMIPS_RAC_CONFIG_1);
++		}
++		break;
++
+ 	case CPU_BMIPS4380:
+ 		/* CBG workaround for early BMIPS4380 CPUs */
+ 		switch (read_c0_prid()) {
diff --git a/target/linux/bmips/patches-5.15/210-macronix_nand_block_protection_support.patch b/target/linux/bmips/patches-5.15/210-macronix_nand_block_protection_support.patch
new file mode 100644
index 00000000000000..25a16084efe36f
--- /dev/null
+++ b/target/linux/bmips/patches-5.15/210-macronix_nand_block_protection_support.patch
@@ -0,0 +1,114 @@
+From 5a37811de679bff03e9c5a746f75574910ede964 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Wed, 22 Mar 2023 20:52:13 +0100
+Subject: [PATCH] Revert "mtd: rawnand: Macronix: Add support for block
+ protection"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This reverts commit 03a539c7a118427a6609a26461358c56ac8f3a06.
+
+Macronix block protection doesn't seem to be supported on Sercomm H-500s
+devices since it hangs the device.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ drivers/mtd/nand/raw/nand_macronix.c | 72 ----------------------------
+ 1 file changed, 72 deletions(-)
+
+--- a/drivers/mtd/nand/raw/nand_macronix.c
++++ b/drivers/mtd/nand/raw/nand_macronix.c
+@@ -12,10 +12,6 @@
+ #define MACRONIX_READ_RETRY_BIT BIT(0)
+ #define MACRONIX_NUM_READ_RETRY_MODES 6
+ 
+-#define ONFI_FEATURE_ADDR_MXIC_PROTECTION 0xA0
+-#define MXIC_BLOCK_PROTECTION_ALL_LOCK 0x38
+-#define MXIC_BLOCK_PROTECTION_ALL_UNLOCK 0x0
+-
+ #define ONFI_FEATURE_ADDR_MXIC_RANDOMIZER 0xB0
+ #define MACRONIX_RANDOMIZER_BIT BIT(1)
+ #define MACRONIX_RANDOMIZER_ENPGM BIT(0)
+@@ -179,73 +175,6 @@ static void macronix_nand_fix_broken_get
+ 		     ONFI_FEATURE_ADDR_TIMING_MODE, 1);
+ }
+ 
+-/*
+- * Macronix NAND supports Block Protection by Protectoin(PT) pin;
+- * active high at power-on which protects the entire chip even the #WP is
+- * disabled. Lock/unlock protection area can be partition according to
+- * protection bits, i.e. upper 1/2 locked, upper 1/4 locked and so on.
+- */
+-static int mxic_nand_lock(struct nand_chip *chip, loff_t ofs, uint64_t len)
+-{
+-	u8 feature[ONFI_SUBFEATURE_PARAM_LEN];
+-	int ret;
+-
+-	feature[0] = MXIC_BLOCK_PROTECTION_ALL_LOCK;
+-	nand_select_target(chip, 0);
+-	ret = nand_set_features(chip, ONFI_FEATURE_ADDR_MXIC_PROTECTION,
+-				feature);
+-	nand_deselect_target(chip);
+-	if (ret)
+-		pr_err("%s all blocks failed\n", __func__);
+-
+-	return ret;
+-}
+-
+-static int mxic_nand_unlock(struct nand_chip *chip, loff_t ofs, uint64_t len)
+-{
+-	u8 feature[ONFI_SUBFEATURE_PARAM_LEN];
+-	int ret;
+-
+-	feature[0] = MXIC_BLOCK_PROTECTION_ALL_UNLOCK;
+-	nand_select_target(chip, 0);
+-	ret = nand_set_features(chip, ONFI_FEATURE_ADDR_MXIC_PROTECTION,
+-				feature);
+-	nand_deselect_target(chip);
+-	if (ret)
+-		pr_err("%s all blocks failed\n", __func__);
+-
+-	return ret;
+-}
+-
+-static void macronix_nand_block_protection_support(struct nand_chip *chip)
+-{
+-	u8 feature[ONFI_SUBFEATURE_PARAM_LEN];
+-	int ret;
+-
+-	bitmap_set(chip->parameters.get_feature_list,
+-		   ONFI_FEATURE_ADDR_MXIC_PROTECTION, 1);
+-
+-	feature[0] = MXIC_BLOCK_PROTECTION_ALL_UNLOCK;
+-	nand_select_target(chip, 0);
+-	ret = nand_get_features(chip, ONFI_FEATURE_ADDR_MXIC_PROTECTION,
+-				feature);
+-	nand_deselect_target(chip);
+-	if (ret || feature[0] != MXIC_BLOCK_PROTECTION_ALL_LOCK) {
+-		if (ret)
+-			pr_err("Block protection check failed\n");
+-
+-		bitmap_clear(chip->parameters.get_feature_list,
+-			     ONFI_FEATURE_ADDR_MXIC_PROTECTION, 1);
+-		return;
+-	}
+-
+-	bitmap_set(chip->parameters.set_feature_list,
+-		   ONFI_FEATURE_ADDR_MXIC_PROTECTION, 1);
+-
+-	chip->ops.lock_area = mxic_nand_lock;
+-	chip->ops.unlock_area = mxic_nand_unlock;
+-}
+-
+ static int nand_power_down_op(struct nand_chip *chip)
+ {
+ 	int ret;
+@@ -323,7 +252,6 @@ static int macronix_nand_init(struct nan
+ 
+ 	macronix_nand_fix_broken_get_timings(chip);
+ 	macronix_nand_onfi_init(chip);
+-	macronix_nand_block_protection_support(chip);
+ 	macronix_nand_deep_power_down_support(chip);
+ 
+ 	return 0;
diff --git a/target/linux/bmips/patches-5.15/500-net-broadcom-add-BCM6368-enetsw-controller-driver.patch b/target/linux/bmips/patches-5.15/500-net-broadcom-add-BCM6368-enetsw-controller-driver.patch
index 35a1ccd60de310..71ed53235fc816 100644
--- a/target/linux/bmips/patches-5.15/500-net-broadcom-add-BCM6368-enetsw-controller-driver.patch
+++ b/target/linux/bmips/patches-5.15/500-net-broadcom-add-BCM6368-enetsw-controller-driver.patch
@@ -1,7 +1,7 @@
 From 590b60fb08cb1e70fe02d3f407c6b3dbe9ad06ff Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
 Date: Mon, 1 Mar 2021 07:34:39 +0100
-Subject: [PATCH 3/4] net: broadcom: add BCM6368 enetsw controller driver
+Subject: [PATCH] net: broadcom: add BCM6368 enetsw controller driver
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -11,11 +11,9 @@ SoCs.
 
 Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
 ---
- drivers/net/ethernet/broadcom/Kconfig         |    8 +
- drivers/net/ethernet/broadcom/Makefile        |    1 +
- .../net/ethernet/broadcom/bcm6368-enetsw.c    | 1111 +++++++++++++++++
- 3 files changed, 1120 insertions(+)
- create mode 100644 drivers/net/ethernet/broadcom/bcm6368-enetsw.c
+ drivers/net/ethernet/broadcom/Kconfig  | 8 ++++++++
+ drivers/net/ethernet/broadcom/Makefile | 1 +
+ 2 files changed, 9 insertions(+)
 
 --- a/drivers/net/ethernet/broadcom/Kconfig
 +++ b/drivers/net/ethernet/broadcom/Kconfig
diff --git a/target/linux/bmips/patches-5.15/501-net-broadcom-add-BCM6348-enet-controller-driver.patch b/target/linux/bmips/patches-5.15/501-net-broadcom-add-BCM6348-enet-controller-driver.patch
new file mode 100644
index 00000000000000..af09f4dd4f5f2e
--- /dev/null
+++ b/target/linux/bmips/patches-5.15/501-net-broadcom-add-BCM6348-enet-controller-driver.patch
@@ -0,0 +1,43 @@
+From 590b60fb08cb1e70fe02d3f407c6b3dbe9ad06ff Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Mon, 1 Mar 2021 07:34:39 +0100
+Subject: [PATCH] net: broadcom: add BCM6348 enetsw controller driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This controller is present on BCM6338, BCM6348 and BCM6358 SoCs.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ drivers/net/ethernet/broadcom/Kconfig  | 8 ++++++++
+ drivers/net/ethernet/broadcom/Makefile | 1 +
+ 2 files changed, 9 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/Kconfig
++++ b/drivers/net/ethernet/broadcom/Kconfig
+@@ -68,6 +68,14 @@ config BCM63XX_ENET
+ 	  This driver supports the ethernet MACs in the Broadcom 63xx
+ 	  MIPS chipset family (BCM63XX).
+ 
++config BCM6348_ENET
++	tristate "Broadcom BCM6348 internal mac support"
++	depends on BMIPS_GENERIC || COMPILE_TEST
++	default y
++	help
++	  This driver supports Ethernet controller integrated into Broadcom
++	  BCM6348 family SoCs.
++
+ config BCM6368_ENETSW
+ 	tristate "Broadcom BCM6368 internal mac support"
+ 	depends on BMIPS_GENERIC || COMPILE_TEST
+--- a/drivers/net/ethernet/broadcom/Makefile
++++ b/drivers/net/ethernet/broadcom/Makefile
+@@ -6,6 +6,7 @@
+ obj-$(CONFIG_B44) += b44.o
+ obj-$(CONFIG_BCM4908_ENET) += bcm4908_enet.o
+ obj-$(CONFIG_BCM63XX_ENET) += bcm63xx_enet.o
++obj-$(CONFIG_BCM6348_ENET) += bcm6348-enet.o
+ obj-$(CONFIG_BCM6368_ENETSW) += bcm6368-enetsw.o
+ obj-$(CONFIG_BCMGENET) += genet/
+ obj-$(CONFIG_BNX2) += bnx2.o
diff --git a/target/linux/bmips/patches-5.15/502-net-mdio-mux-bcm6368-allow-disabling.patch b/target/linux/bmips/patches-5.15/502-net-mdio-mux-bcm6368-allow-disabling.patch
new file mode 100644
index 00000000000000..6071bea42d2639
--- /dev/null
+++ b/target/linux/bmips/patches-5.15/502-net-mdio-mux-bcm6368-allow-disabling.patch
@@ -0,0 +1,23 @@
+From 21145a89c79a22c4fb719cce5a2f4e3373d39756 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Wed, 17 May 2023 18:16:46 +0200
+Subject: [PATCH] net: mdio: mux-bcm6368: allow disabling for bmips
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ drivers/net/mdio/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/mdio/Kconfig
++++ b/drivers/net/mdio/Kconfig
+@@ -219,7 +219,6 @@ config MDIO_BUS_MUX_BCM6368
+ 	tristate "Broadcom BCM6368 MDIO bus multiplexers"
+ 	depends on OF && OF_MDIO && (BMIPS_GENERIC || COMPILE_TEST)
+ 	select MDIO_BUS_MUX
+-	default BMIPS_GENERIC
+ 	help
+ 	  This module provides a driver for MDIO bus multiplexers found in
+ 	  BCM6368 based Broadcom SoCs. This multiplexer connects one of several
diff --git a/target/linux/bmips/patches-5.15/600-mips-bmips-add-pci-support.patch b/target/linux/bmips/patches-5.15/600-mips-bmips-add-pci-support.patch
index b10dd8d4329f8e..36b09105b72721 100644
--- a/target/linux/bmips/patches-5.15/600-mips-bmips-add-pci-support.patch
+++ b/target/linux/bmips/patches-5.15/600-mips-bmips-add-pci-support.patch
@@ -1,9 +1,23 @@
+From 7742c1ba191a005a1356ff89b5fe2279d6f0ec4d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Wed, 17 May 2023 18:18:43 +0200
+Subject: [PATCH] mips: bmips: add PCI support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ arch/mips/Kconfig      | 1 +
+ arch/mips/pci/Makefile | 1 +
+ 2 files changed, 2 insertions(+)
+
 --- a/arch/mips/Kconfig
 +++ b/arch/mips/Kconfig
-@@ -277,6 +277,7 @@ config BMIPS_GENERIC
- 	select BCM7038_L1_IRQ
- 	select BCM7120_L2_IRQ
- 	select BRCMSTB_L2_IRQ
+@@ -274,6 +274,7 @@ config BMIPS_GENERIC
+ 	select SYNC_R4K
+ 	select COMMON_CLK
+ 	select BCM6345_L1_IRQ
 +	select HAVE_PCI
  	select IRQ_MIPS_CPU
  	select DMA_NONCOHERENT
diff --git a/target/linux/bmips/patches-5.15/601-pci-controllers-add-bcm6328-pcie-support.patch b/target/linux/bmips/patches-5.15/601-pci-controllers-add-bcm6328-pcie-support.patch
index 4ebc806e1e62ea..c976430fd53f2a 100644
--- a/target/linux/bmips/patches-5.15/601-pci-controllers-add-bcm6328-pcie-support.patch
+++ b/target/linux/bmips/patches-5.15/601-pci-controllers-add-bcm6328-pcie-support.patch
@@ -1,3 +1,17 @@
+From 49133041e0a5770decf1a25f575764d13a0d425c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Wed, 17 May 2023 18:20:10 +0200
+Subject: [PATCH] pci: add bcm6328-pcie support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ drivers/pci/controller/Kconfig  | 5 +++++
+ drivers/pci/controller/Makefile | 1 +
+ 2 files changed, 6 insertions(+)
+
 --- a/drivers/pci/controller/Kconfig
 +++ b/drivers/pci/controller/Kconfig
 @@ -3,6 +3,11 @@
diff --git a/target/linux/bmips/patches-5.15/602-pci-controllers-add-bcm6318-pcie-support.patch b/target/linux/bmips/patches-5.15/602-pci-controllers-add-bcm6318-pcie-support.patch
index 3674028aec0729..1a3ec1db2a66fb 100644
--- a/target/linux/bmips/patches-5.15/602-pci-controllers-add-bcm6318-pcie-support.patch
+++ b/target/linux/bmips/patches-5.15/602-pci-controllers-add-bcm6318-pcie-support.patch
@@ -1,3 +1,17 @@
+From cc3c30bdc98eabbaa07c64302eb5124a0f4a74f0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Wed, 17 May 2023 18:20:46 +0200
+Subject: [PATCH] pci: add bcm6318-pcie support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ drivers/pci/controller/Kconfig  | 5 +++++
+ drivers/pci/controller/Makefile | 1 +
+ 2 files changed, 6 insertions(+)
+
 --- a/drivers/pci/controller/Kconfig
 +++ b/drivers/pci/controller/Kconfig
 @@ -3,6 +3,11 @@
diff --git a/target/linux/bmips/patches-5.15/603-pci-controllers-add-bcm6348-pci-support.patch b/target/linux/bmips/patches-5.15/603-pci-controllers-add-bcm6348-pci-support.patch
index c0572604eeb590..32aeea6a74db99 100644
--- a/target/linux/bmips/patches-5.15/603-pci-controllers-add-bcm6348-pci-support.patch
+++ b/target/linux/bmips/patches-5.15/603-pci-controllers-add-bcm6348-pci-support.patch
@@ -1,3 +1,17 @@
+From 5e7813e5725d79d00e0988472c306490fc48b3e1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Wed, 17 May 2023 18:21:19 +0200
+Subject: [PATCH] pci: add bcm6348-pci support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ drivers/pci/controller/Kconfig  | 5 +++++
+ drivers/pci/controller/Makefile | 1 +
+ 2 files changed, 6 insertions(+)
+
 --- a/drivers/pci/controller/Kconfig
 +++ b/drivers/pci/controller/Kconfig
 @@ -3,6 +3,11 @@
diff --git a/target/linux/bmips/patches-5.15/700-leds-add-support-for-Sercomm-MSP430-LED-controller.patch b/target/linux/bmips/patches-5.15/700-leds-add-support-for-Sercomm-MSP430-LED-controller.patch
new file mode 100644
index 00000000000000..8b91cac173281d
--- /dev/null
+++ b/target/linux/bmips/patches-5.15/700-leds-add-support-for-Sercomm-MSP430-LED-controller.patch
@@ -0,0 +1,45 @@
+From 1a5f2263d388016c88d39e141c7eb8085c9313fc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Wed, 5 Apr 2023 08:07:00 +0200
+Subject: [PATCH] leds: add support for Sercomm MSP430 LED controller
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Sercomm added an external MSP430G2513 for controlling LEDs through SPI on some
+boards.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ drivers/leds/Kconfig  | 9 +++++++++
+ drivers/leds/Makefile | 1 +
+ 2 files changed, 10 insertions(+)
+
+--- a/drivers/leds/Kconfig
++++ b/drivers/leds/Kconfig
+@@ -288,6 +288,15 @@ config LEDS_COBALT_RAQ
+ 	help
+ 	  This option enables support for the Cobalt Raq series LEDs.
+ 
++config LEDS_SERCOMM_MSP430
++	tristate "LED support for Sercomm MSP430 SPI LED controllers"
++	depends on LEDS_CLASS
++	depends on SPI
++	depends on OF
++	help
++          This option enables support for the Sercomm MSP430G2513 SPI LED
++	  controllers.
++
+ config LEDS_SUNFIRE
+ 	tristate "LED support for SunFire servers."
+ 	depends on LEDS_CLASS
+--- a/drivers/leds/Makefile
++++ b/drivers/leds/Makefile
+@@ -77,6 +77,7 @@ obj-$(CONFIG_LEDS_PWM)			+= leds-pwm.o
+ obj-$(CONFIG_LEDS_REGULATOR)		+= leds-regulator.o
+ obj-$(CONFIG_LEDS_S3C24XX)		+= leds-s3c24xx.o
+ obj-$(CONFIG_LEDS_SC27XX_BLTC)		+= leds-sc27xx-bltc.o
++obj-$(CONFIG_LEDS_SERCOMM_MSP430)	+= leds-sercomm-msp430.o
+ obj-$(CONFIG_LEDS_SUNFIRE)		+= leds-sunfire.o
+ obj-$(CONFIG_LEDS_SYSCON)		+= leds-syscon.o
+ obj-$(CONFIG_LEDS_TCA6507)		+= leds-tca6507.o
diff --git a/target/linux/bmips/patches-6.1/100-irqchip-add-support-for-bcm6345-style-external-inter.patch b/target/linux/bmips/patches-6.1/100-irqchip-add-support-for-bcm6345-style-external-inter.patch
new file mode 100644
index 00000000000000..42aec229f9471b
--- /dev/null
+++ b/target/linux/bmips/patches-6.1/100-irqchip-add-support-for-bcm6345-style-external-inter.patch
@@ -0,0 +1,373 @@
+From cf908990d4a8ccdb73ee4484aa8cadad379ca314 Mon Sep 17 00:00:00 2001
+From: Jonas Gorski <jogo@openwrt.org>
+Date: Sun, 30 Nov 2014 14:54:27 +0100
+Subject: [PATCH] irqchip: add support for bcm6345-style external interrupt
+ controller
+
+Signed-off-by: Jonas Gorski <jogo@openwrt.org>
+---
+ .../brcm,bcm6345-ext-intc.txt                 |  29 ++
+ drivers/irqchip/Kconfig                       |   4 +
+ drivers/irqchip/Makefile                      |   1 +
+ drivers/irqchip/irq-bcm6345-ext.c             | 280 ++++++++++++++++++
+ include/linux/irqchip/irq-bcm6345-ext.h       |  14 +
+ 5 files changed, 328 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/interrupt-controller/brcm,bcm6345-ext-intc.txt
+ create mode 100644 drivers/irqchip/irq-bcm6345-ext.c
+ create mode 100644 include/linux/irqchip/irq-bcm6345-ext.h
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/interrupt-controller/brcm,bcm6345-ext-intc.txt
+@@ -0,0 +1,29 @@
++Broadcom BCM6345-style external interrupt controller
++
++Required properties:
++
++- compatible: Should be "brcm,bcm6345-ext-intc" or "brcm,bcm6318-ext-intc".
++- reg: Specifies the base physical addresses and size of the registers.
++- interrupt-controller: identifies the node as an interrupt controller.
++- #interrupt-cells: Specifies the number of cells needed to encode an interrupt
++  source, Should be 2.
++- interrupt-parent: Specifies the phandle to the parent interrupt controller
++  this one is cascaded from.
++- interrupts: Specifies the interrupt line(s) in the interrupt-parent controller
++  node, valid values depend on the type of parent interrupt controller.
++
++Optional properties:
++
++- brcm,field-width: Size of each field (mask, clear, sense, ...) in bits in the
++  register. Defaults to 4.
++
++Example:
++
++ext_intc: interrupt-controller@10000018 {
++	compatible = "brcm,bcm6345-ext-intc";
++	interrupt-parent = <&periph_intc>;
++	#interrupt-cells = <2>;
++	reg = <0x10000018 0x4>;
++	interrupt-controller;
++	interrupts = <24>, <25>, <26>, <27>;
++};
+--- a/drivers/irqchip/Kconfig
++++ b/drivers/irqchip/Kconfig
+@@ -109,6 +109,10 @@ config I8259
+ 	bool
+ 	select IRQ_DOMAIN
+ 
++config BCM6345_EXT_IRQ
++	bool "BCM6345 External IRQ Controller"
++	select IRQ_DOMAIN
++
+ config BCM6345_L1_IRQ
+ 	bool
+ 	select GENERIC_IRQ_CHIP
+--- a/drivers/irqchip/Makefile
++++ b/drivers/irqchip/Makefile
+@@ -63,6 +63,7 @@ obj-$(CONFIG_XTENSA_MX)			+= irq-xtensa-
+ obj-$(CONFIG_XILINX_INTC)		+= irq-xilinx-intc.o
+ obj-$(CONFIG_IRQ_CROSSBAR)		+= irq-crossbar.o
+ obj-$(CONFIG_SOC_VF610)			+= irq-vf610-mscm-ir.o
++obj-$(CONFIG_BCM6345_EXT_IRQ)		+= irq-bcm6345-ext.o
+ obj-$(CONFIG_BCM6345_L1_IRQ)		+= irq-bcm6345-l1.o
+ obj-$(CONFIG_BCM7038_L1_IRQ)		+= irq-bcm7038-l1.o
+ obj-$(CONFIG_BCM7120_L2_IRQ)		+= irq-bcm7120-l2.o
+--- /dev/null
++++ b/drivers/irqchip/irq-bcm6345-ext.c
+@@ -0,0 +1,280 @@
++/*
++ * This file is subject to the terms and conditions of the GNU General Public
++ * License.  See the file "COPYING" in the main directory of this archive
++ * for more details.
++ *
++ * Copyright (C) 2014 Jonas Gorski <jogo@openwrt.org>
++ */
++
++#include <linux/ioport.h>
++#include <linux/irq.h>
++#include <linux/irqchip.h>
++#include <linux/irqchip/chained_irq.h>
++#include <linux/irqchip/irq-bcm6345-ext.h>
++#include <linux/kernel.h>
++#include <linux/of.h>
++#include <linux/of_irq.h>
++#include <linux/of_address.h>
++#include <linux/slab.h>
++#include <linux/spinlock.h>
++
++#define MAX_IRQS		4
++
++#define EXTIRQ_CFG_SENSE	0
++#define EXTIRQ_CFG_STAT		1
++#define EXTIRQ_CFG_CLEAR	2
++#define EXTIRQ_CFG_MASK		3
++#define EXTIRQ_CFG_BOTHEDGE	4
++#define EXTIRQ_CFG_LEVELSENSE	5
++
++struct intc_data {
++	struct irq_chip chip;
++	struct irq_domain *domain;
++	raw_spinlock_t lock;
++
++	int parent_irq[MAX_IRQS];
++	void __iomem *reg;
++	int shift;
++	unsigned int toggle_clear_on_ack:1;
++};
++
++static void bcm6345_ext_intc_irq_handle(struct irq_desc *desc)
++{
++	struct intc_data *data = irq_desc_get_handler_data(desc);
++	struct irq_chip *chip = irq_desc_get_chip(desc);
++	unsigned int irq = irq_desc_get_irq(desc);
++	unsigned int idx;
++
++	chained_irq_enter(chip, desc);
++
++	for (idx = 0; idx < MAX_IRQS; idx++) {
++		if (data->parent_irq[idx] != irq)
++			continue;
++
++		generic_handle_irq(irq_find_mapping(data->domain, idx));
++	}
++
++	chained_irq_exit(chip, desc);
++}
++
++static void bcm6345_ext_intc_irq_ack(struct irq_data *data)
++{
++	struct intc_data *priv = data->domain->host_data;
++	irq_hw_number_t hwirq = irqd_to_hwirq(data);
++	u32 reg;
++
++	raw_spin_lock(&priv->lock);
++	reg = __raw_readl(priv->reg);
++	__raw_writel(reg | (1 << (hwirq + EXTIRQ_CFG_CLEAR * priv->shift)),
++		     priv->reg);
++	if (priv->toggle_clear_on_ack)
++		__raw_writel(reg, priv->reg);
++	raw_spin_unlock(&priv->lock);
++}
++
++static void bcm6345_ext_intc_irq_mask(struct irq_data *data)
++{
++	struct intc_data *priv = data->domain->host_data;
++	irq_hw_number_t hwirq = irqd_to_hwirq(data);
++	u32 reg;
++
++	raw_spin_lock(&priv->lock);
++	reg = __raw_readl(priv->reg);
++	reg &= ~(1 << (hwirq + EXTIRQ_CFG_MASK * priv->shift));
++	__raw_writel(reg, priv->reg);
++	raw_spin_unlock(&priv->lock);
++}
++
++static void bcm6345_ext_intc_irq_unmask(struct irq_data *data)
++{
++	struct intc_data *priv = data->domain->host_data;
++	irq_hw_number_t hwirq = irqd_to_hwirq(data);
++	u32 reg;
++
++	raw_spin_lock(&priv->lock);
++	reg = __raw_readl(priv->reg);
++	reg |= 1 << (hwirq + EXTIRQ_CFG_MASK * priv->shift);
++	__raw_writel(reg, priv->reg);
++	raw_spin_unlock(&priv->lock);
++}
++
++static int bcm6345_ext_intc_set_type(struct irq_data *data,
++				     unsigned int flow_type)
++{
++	struct intc_data *priv = data->domain->host_data;
++	irq_hw_number_t hwirq = irqd_to_hwirq(data);
++	bool levelsense = 0, sense = 0, bothedge = 0;
++	u32 reg;
++
++	flow_type &= IRQ_TYPE_SENSE_MASK;
++
++	if (flow_type == IRQ_TYPE_NONE)
++		flow_type = IRQ_TYPE_LEVEL_LOW;
++
++	switch (flow_type) {
++	case IRQ_TYPE_EDGE_BOTH:
++		bothedge = 1;
++		break;
++
++	case IRQ_TYPE_EDGE_RISING:
++		sense = 1;
++		break;
++
++	case IRQ_TYPE_EDGE_FALLING:
++		break;
++
++	case IRQ_TYPE_LEVEL_HIGH:
++		levelsense = 1;
++		sense = 1;
++		break;
++
++	case IRQ_TYPE_LEVEL_LOW:
++		levelsense = 1;
++		break;
++
++	default:
++		pr_err("bogus flow type combination given!\n");
++		return -EINVAL;
++	}
++
++	raw_spin_lock(&priv->lock);
++	reg = __raw_readl(priv->reg);
++
++	if (levelsense)
++		reg |= 1 << (hwirq + EXTIRQ_CFG_LEVELSENSE * priv->shift);
++	else
++		reg &= ~(1 << (hwirq + EXTIRQ_CFG_LEVELSENSE * priv->shift));
++	if (sense)
++		reg |= 1 << (hwirq + EXTIRQ_CFG_SENSE * priv->shift);
++	else
++		reg &= ~(1 << (hwirq + EXTIRQ_CFG_SENSE * priv->shift));
++	if (bothedge)
++		reg |= 1 << (hwirq + EXTIRQ_CFG_BOTHEDGE * priv->shift);
++	else
++		reg &= ~(1 << (hwirq + EXTIRQ_CFG_BOTHEDGE * priv->shift));
++
++	__raw_writel(reg, priv->reg);
++	raw_spin_unlock(&priv->lock);
++
++	irqd_set_trigger_type(data, flow_type);
++	if (flow_type & (IRQ_TYPE_LEVEL_LOW | IRQ_TYPE_LEVEL_HIGH))
++		irq_set_handler_locked(data, handle_level_irq);
++	else
++		irq_set_handler_locked(data, handle_edge_irq);
++
++	return 0;
++}
++
++static int bcm6345_ext_intc_map(struct irq_domain *d, unsigned int irq,
++				irq_hw_number_t hw)
++{
++	struct intc_data *priv = d->host_data;
++
++	irq_set_chip_and_handler(irq, &priv->chip, handle_level_irq);
++
++	return 0;
++}
++
++static const struct irq_domain_ops bcm6345_ext_domain_ops = {
++	.xlate = irq_domain_xlate_twocell,
++	.map = bcm6345_ext_intc_map,
++};
++
++static int __init __bcm6345_ext_intc_init(struct device_node *node,
++					  int num_irqs, int *irqs,
++					  void __iomem *reg, int shift,
++					  bool toggle_clear_on_ack)
++{
++	struct intc_data *data;
++	unsigned int i;
++
++	data = kzalloc(sizeof(*data), GFP_KERNEL);
++	if (!data)
++		return -ENOMEM;
++
++	raw_spin_lock_init(&data->lock);
++
++	for (i = 0; i < num_irqs; i++) {
++		data->parent_irq[i] = irqs[i];
++
++		irq_set_handler_data(irqs[i], data);
++		irq_set_chained_handler(irqs[i], bcm6345_ext_intc_irq_handle);
++	}
++
++	data->reg = reg;
++	data->shift = shift;
++	data->toggle_clear_on_ack = toggle_clear_on_ack;
++
++	data->chip.name = "bcm6345-ext-intc";
++	data->chip.irq_ack = bcm6345_ext_intc_irq_ack;
++	data->chip.irq_mask = bcm6345_ext_intc_irq_mask;
++	data->chip.irq_unmask = bcm6345_ext_intc_irq_unmask;
++	data->chip.irq_set_type = bcm6345_ext_intc_set_type;
++
++	data->domain = irq_domain_add_linear(node, num_irqs,
++					     &bcm6345_ext_domain_ops, data);
++	if (!data->domain) {
++		kfree(data);
++		return -ENOMEM;
++	}
++
++	return 0;
++}
++
++void __init bcm6345_ext_intc_init(int num_irqs, int *irqs, void __iomem *reg,
++				  int shift)
++{
++	__bcm6345_ext_intc_init(NULL, num_irqs, irqs, reg, shift, false);
++}
++
++#ifdef CONFIG_OF
++static int __init bcm6345_ext_intc_of_init(struct device_node *node,
++					   struct device_node *parent)
++{
++	int num_irqs, ret = -EINVAL;
++	unsigned i;
++	void __iomem *base;
++	int irqs[MAX_IRQS] = { 0 };
++	u32 shift;
++	bool toggle_clear_on_ack = false;
++
++	num_irqs = of_irq_count(node);
++
++	if (!num_irqs || num_irqs > MAX_IRQS)
++		return -EINVAL;
++
++	if (of_property_read_u32(node, "brcm,field-width", &shift))
++		shift = 4;
++
++	/* on BCM6318 setting CLEAR seems to continuously mask interrupts */
++	if (of_device_is_compatible(node, "brcm,bcm6318-ext-intc"))
++		toggle_clear_on_ack = true;
++
++	for (i = 0; i < num_irqs; i++) {
++		irqs[i] = irq_of_parse_and_map(node, i);
++		if (!irqs[i])
++			return -ENOMEM;
++	}
++
++	base = of_iomap(node, 0);
++	if (!base)
++		return -ENXIO;
++
++	ret = __bcm6345_ext_intc_init(node, num_irqs, irqs, base, shift,
++				      toggle_clear_on_ack);
++	if (!ret)
++		return 0;
++
++	iounmap(base);
++
++	for (i = 0; i < num_irqs; i++)
++		irq_dispose_mapping(irqs[i]);
++
++	return ret;
++}
++
++IRQCHIP_DECLARE(bcm6318_ext_intc, "brcm,bcm6318-ext-intc",
++		bcm6345_ext_intc_of_init);
++IRQCHIP_DECLARE(bcm6345_ext_intc, "brcm,bcm6345-ext-intc",
++		bcm6345_ext_intc_of_init);
++#endif
+--- /dev/null
++++ b/include/linux/irqchip/irq-bcm6345-ext.h
+@@ -0,0 +1,14 @@
++/*
++ * This file is subject to the terms and conditions of the GNU General Public
++ * License.  See the file "COPYING" in the main directory of this archive
++ * for more details.
++ *
++ * Copyright (C) 2014 Jonas Gorski <jogo@openwrt.org>
++ */
++
++#ifndef __INCLUDE_LINUX_IRQCHIP_IRQ_BCM6345_EXT_H
++#define __INCLUDE_LINUX_IRQCHIP_IRQ_BCM6345_EXT_H
++
++void bcm6345_ext_intc_init(int n_irqs, int *irqs, void __iomem *reg, int shift);
++
++#endif /* __INCLUDE_LINUX_IRQCHIP_IRQ_BCM6345_EXT_H */
diff --git a/target/linux/bmips/patches-6.1/200-mips-bmips-automatically-detect-CPU-frequency.patch b/target/linux/bmips/patches-6.1/200-mips-bmips-automatically-detect-CPU-frequency.patch
new file mode 100644
index 00000000000000..df553f002e915a
--- /dev/null
+++ b/target/linux/bmips/patches-6.1/200-mips-bmips-automatically-detect-CPU-frequency.patch
@@ -0,0 +1,239 @@
+From 0377ad93031d3e51c2afe44231241185f684b6af Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Fri, 5 Mar 2021 15:14:32 +0100
+Subject: [PATCH] mips: bmips: automatically detect CPU frequency
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Some BCM63xx SoCs support multiple CPU frequencies depending on HW config.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ arch/mips/bmips/setup.c | 197 ++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 190 insertions(+), 7 deletions(-)
+
+--- a/arch/mips/bmips/setup.c
++++ b/arch/mips/bmips/setup.c
+@@ -32,13 +32,52 @@
+ 
+ #define RELO_NORMAL_VEC		BIT(18)
+ 
++#define REG_BCM6318_SOB		((void __iomem *)CKSEG1ADDR(0x10000900))
++#define BCM6318_FREQ_SHIFT	23
++#define BCM6318_FREQ_MASK	(0x3 << BCM6318_FREQ_SHIFT)
++
+ #define REG_BCM6328_OTP		((void __iomem *)CKSEG1ADDR(0x1000062c))
+ #define BCM6328_TP1_DISABLED	BIT(9)
++#define REG_BCM6328_MISC_SB	((void __iomem *)CKSEG1ADDR(0x10001a40))
++#define BCM6328_FCVO_SHIFT	7
++#define BCM6328_FCVO_MASK	(0x1f << BCM6328_FCVO_SHIFT)
++
++#define REG_BCM6358_DDR_PLLC	((void __iomem *)0xfffe12b8)
++#define BCM6358_PLLC_M1_SHIFT	0
++#define BCM6358_PLLC_M1_MASK	(0xff << BCM6358_PLLC_M1_SHIFT)
++#define BCM6358_PLLC_N1_SHIFT	23
++#define BCM6358_PLLC_N1_MASK	(0x3f << BCM6358_PLLC_N1_SHIFT)
++#define BCM6358_PLLC_N2_SHIFT	29
++#define BCM6358_PLLC_N2_MASK	(0x7 << BCM6358_PLLC_N2_SHIFT)
++
++#define REG_BCM6362_MISC_SB	((void __iomem *)CKSEG1ADDR(0x10001814))
++#define BCM6362_FCVO_SHIFT	1
++#define BCM6362_FCVO_MASK	(0x1f << BCM6362_FCVO_SHIFT)
++
++#define REG_BCM6368_DDR_PLLC	((void __iomem *)CKSEG1ADDR(0x100012a0))
++#define BCM6368_PLLC_P1_SHIFT	0
++#define BCM6368_PLLC_P1_MASK	(0xf << BCM6368_PLLC_P1_SHIFT)
++#define BCM6368_PLLC_P2_SHIFT	4
++#define BCM6368_PLLC_P2_MASK	(0xf << BCM6368_PLLC_P2_SHIFT)
++#define BCM6368_PLLC_NDIV_SHIFT	16
++#define BCM6368_PLLC_NDIV_MASK	(0x1ff << BCM6368_PLLC_NDIV_SHIFT)
++#define REG_BCM6368_DDR_PLLD	((void __iomem *)CKSEG1ADDR(0x100012a4))
++#define BCM6368_PLLD_MDIV_SHIFT	0
++#define BCM6368_PLLD_MDIV_MASK	(0xff << BCM6368_PLLD_MDIV_SHIFT)
++
++#define REG_BCM63268_MISC_SB	((void __iomem *)CKSEG1ADDR(0x10001814))
++#define BCM63268_FCVO_SHIFT	21
++#define BCM63268_FCVO_MASK	(0xf << BCM63268_FCVO_SHIFT)
+ 
+ extern bool bmips_rac_flush_disable;
+ 
+ static const unsigned long kbase = VMLINUX_LOAD_ADDRESS & 0xfff00000;
+ 
++struct bmips_cpufreq {
++	const char		*compatible;
++	u32			(*cpu_freq)(void);
++};
++
+ struct bmips_quirk {
+ 	const char		*compatible;
+ 	void			(*quirk_fn)(void);
+@@ -154,17 +193,161 @@ const char *get_system_type(void)
+ 	return "Generic BMIPS kernel";
+ }
+ 
++static u32 bcm6318_cpufreq(void)
++{
++	u32 val = __raw_readl(REG_BCM6318_SOB);
++
++	switch ((val & BCM6318_FREQ_MASK) >> BCM6318_FREQ_SHIFT) {
++	case 0:
++		return 166000000;
++	case 2:
++		return 250000000;
++	case 3:
++		return 333000000;
++	case 1:
++		return 400000000;
++	default:
++		return 0;
++	}
++}
++
++static u32 bcm6328_cpufreq(void)
++{
++	u32 val = __raw_readl(REG_BCM6328_MISC_SB);
++
++	switch ((val & BCM6328_FCVO_MASK) >> BCM6328_FCVO_SHIFT) {
++	case 0x12:
++	case 0x14:
++	case 0x19:
++		return 160000000;
++	case 0x1c:
++		return 192000000;
++	case 0x13:
++	case 0x15:
++		return 200000000;
++	case 0x1a:
++		return 384000000;
++	case 0x16:
++		return 400000000;
++	default:
++		return 320000000;
++	}
++}
++
++static u32 bcm6358_cpufreq(void)
++{
++	u32 val, n1, n2, m1;
++
++	val = __raw_readl(REG_BCM6358_DDR_PLLC);
++	n1 = (val & BCM6358_PLLC_N1_MASK) >> BCM6358_PLLC_N1_SHIFT;
++	n2 = (val & BCM6358_PLLC_N2_MASK) >> BCM6358_PLLC_N2_SHIFT;
++	m1 = (val & BCM6358_PLLC_M1_MASK) >> BCM6358_PLLC_M1_SHIFT;
++
++	return (16 * 1000000 * n1 * n2) / m1;
++}
++
++static u32 bcm6362_cpufreq(void)
++{
++	u32 val = __raw_readl(REG_BCM6362_MISC_SB);
++
++	switch ((val & BCM6362_FCVO_MASK) >> BCM6362_FCVO_SHIFT) {
++	case 0x04:
++	case 0x0c:
++	case 0x14:
++	case 0x1c:
++		return 160000000;
++	case 0x15:
++	case 0x1d:
++		return 200000000;
++	case 0x03:
++	case 0x0b:
++	case 0x13:
++	case 0x1b:
++		return 240000000;
++	case 0x07:
++	case 0x17:
++		return 384000000;
++	case 0x05:
++	case 0x0e:
++	case 0x16:
++	case 0x1e:
++	case 0x1f:
++		return 400000000;
++	case 0x06:
++		return 440000000;
++	default:
++		return 320000000;
++	}
++}
++
++static u32 bcm6368_cpufreq(void)
++{
++	u32 val, p1, p2, ndiv, m1;
++
++	val = __raw_readl(REG_BCM6368_DDR_PLLC);
++	p1 = (val & BCM6368_PLLC_P1_MASK) >> BCM6368_PLLC_P1_SHIFT;
++	p2 = (val & BCM6368_PLLC_P2_MASK) >> BCM6368_PLLC_P2_SHIFT;
++	ndiv = (val & BCM6368_PLLC_NDIV_MASK) >>
++	       BCM6368_PLLC_NDIV_SHIFT;
++
++	val = __raw_readl(REG_BCM6368_DDR_PLLD);
++	m1 = (val & BCM6368_PLLD_MDIV_MASK) >> BCM6368_PLLD_MDIV_SHIFT;
++
++	return (((64 * 1000000) / p1) * p2 * ndiv) / m1;
++}
++
++static u32 bcm63268_cpufreq(void)
++{
++	u32 val = __raw_readl(REG_BCM63268_MISC_SB);
++
++	switch ((val & BCM63268_FCVO_MASK) >> BCM63268_FCVO_SHIFT) {
++	case 0x3:
++	case 0xe:
++		return 320000000;
++	case 0xa:
++		return 333000000;
++	case 0x2:
++	case 0xb:
++	case 0xf:
++		return 400000000;
++	default:
++		return 0;
++	}
++}
++
++static const struct bmips_cpufreq bmips_cpufreq_list[] = {
++	{ "brcm,bcm6318", &bcm6318_cpufreq },
++	{ "brcm,bcm6328", &bcm6328_cpufreq },
++	{ "brcm,bcm6358", &bcm6358_cpufreq },
++	{ "brcm,bcm6362", &bcm6362_cpufreq },
++	{ "brcm,bcm6368", &bcm6368_cpufreq },
++	{ "brcm,bcm63268", &bcm63268_cpufreq },
++	{ /* sentinel */ }
++};
++
+ void __init plat_time_init(void)
+ {
++	const struct bmips_cpufreq *cf;
+ 	struct device_node *np;
+-	u32 freq;
++	u32 freq = 0;
+ 
+-	np = of_find_node_by_name(NULL, "cpus");
+-	if (!np)
+-		panic("missing 'cpus' DT node");
+-	if (of_property_read_u32(np, "mips-hpt-frequency", &freq) < 0)
+-		panic("missing 'mips-hpt-frequency' property");
+-	of_node_put(np);
++	for (cf = bmips_cpufreq_list; cf->cpu_freq; cf++) {
++		if (of_flat_dt_is_compatible(of_get_flat_dt_root(),
++					     cf->compatible)) {
++			freq = cf->cpu_freq() / 2;
++			printk("%s detected @ %u MHz\n", cf->compatible, freq / 500000);
++			break;
++		}
++	}
++
++	if (!freq) {
++		np = of_find_node_by_name(NULL, "cpus");
++		if (!np)
++			panic("missing 'cpus' DT node");
++		if (of_property_read_u32(np, "mips-hpt-frequency", &freq) < 0)
++			panic("missing 'mips-hpt-frequency' property");
++		of_node_put(np);
++	}
+ 
+ 	mips_hpt_frequency = freq;
+ }
diff --git a/target/linux/bmips/patches-6.1/201-mips-bmips-automatically-detect-RAM-size.patch b/target/linux/bmips/patches-6.1/201-mips-bmips-automatically-detect-RAM-size.patch
new file mode 100644
index 00000000000000..68afc39930902b
--- /dev/null
+++ b/target/linux/bmips/patches-6.1/201-mips-bmips-automatically-detect-RAM-size.patch
@@ -0,0 +1,196 @@
+From f9ee3f28ecb979c77423be965ef9dd313bdb9e9b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Mon, 8 Mar 2021 16:58:34 +0100
+Subject: [PATCH] mips: bmips: automatically detect RAM size
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Some devices have different amounts of RAM installed depending on HW revision.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ arch/mips/bmips/setup.c | 119 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 119 insertions(+)
+
+--- a/arch/mips/bmips/setup.c
++++ b/arch/mips/bmips/setup.c
+@@ -19,6 +19,7 @@
+ #include <linux/of_platform.h>
+ #include <linux/libfdt.h>
+ #include <linux/smp.h>
++#include <linux/types.h>
+ #include <asm/addrspace.h>
+ #include <asm/bmips.h>
+ #include <asm/bootinfo.h>
+@@ -35,13 +36,16 @@
+ #define REG_BCM6318_SOB		((void __iomem *)CKSEG1ADDR(0x10000900))
+ #define BCM6318_FREQ_SHIFT	23
+ #define BCM6318_FREQ_MASK	(0x3 << BCM6318_FREQ_SHIFT)
++#define BCM6318_SDRAM_ADDR	((void __iomem *)CKSEG1ADDR(0x10004000))
+ 
+ #define REG_BCM6328_OTP		((void __iomem *)CKSEG1ADDR(0x1000062c))
+ #define BCM6328_TP1_DISABLED	BIT(9)
+ #define REG_BCM6328_MISC_SB	((void __iomem *)CKSEG1ADDR(0x10001a40))
+ #define BCM6328_FCVO_SHIFT	7
+ #define BCM6328_FCVO_MASK	(0x1f << BCM6328_FCVO_SHIFT)
++#define BCM6328_MEMC_ADDR	((void __iomem *)CKSEG1ADDR(0x10003000))
+ 
++#define BCM6358_MEMC_ADDR	((void __iomem *)0xfffe1200)
+ #define REG_BCM6358_DDR_PLLC	((void __iomem *)0xfffe12b8)
+ #define BCM6358_PLLC_M1_SHIFT	0
+ #define BCM6358_PLLC_M1_MASK	(0xff << BCM6358_PLLC_M1_SHIFT)
+@@ -53,7 +57,9 @@
+ #define REG_BCM6362_MISC_SB	((void __iomem *)CKSEG1ADDR(0x10001814))
+ #define BCM6362_FCVO_SHIFT	1
+ #define BCM6362_FCVO_MASK	(0x1f << BCM6362_FCVO_SHIFT)
++#define BCM6362_MEMC_ADDR	((void __iomem *)CKSEG1ADDR(0x10003000))
+ 
++#define BCM6368_MEMC_ADDR	((void __iomem *)CKSEG1ADDR(0x10001200))
+ #define REG_BCM6368_DDR_PLLC	((void __iomem *)CKSEG1ADDR(0x100012a0))
+ #define BCM6368_PLLC_P1_SHIFT	0
+ #define BCM6368_PLLC_P1_MASK	(0xf << BCM6368_PLLC_P1_SHIFT)
+@@ -68,6 +74,21 @@
+ #define REG_BCM63268_MISC_SB	((void __iomem *)CKSEG1ADDR(0x10001814))
+ #define BCM63268_FCVO_SHIFT	21
+ #define BCM63268_FCVO_MASK	(0xf << BCM63268_FCVO_SHIFT)
++#define BCM63268_MEMC_ADDR	((void __iomem *)CKSEG1ADDR(0x10003000))
++
++#define SDRAM_CFG_REG		0x0
++#define SDRAM_SPACE_SHIFT	4
++#define SDRAM_SPACE_MASK	(0xf << SDRAM_SPACE_SHIFT)
++
++#define MEMC_CFG_REG		0x4
++#define MEMC_CFG_32B_SHIFT	1
++#define MEMC_CFG_32B_MASK	(1 << MEMC_CFG_32B_SHIFT)
++#define MEMC_CFG_COL_SHIFT	3
++#define MEMC_CFG_COL_MASK	(0x3 << MEMC_CFG_COL_SHIFT)
++#define MEMC_CFG_ROW_SHIFT	6
++#define MEMC_CFG_ROW_MASK	(0x3 << MEMC_CFG_ROW_SHIFT)
++
++#define DDR_CSEND_REG		0x8
+ 
+ extern bool bmips_rac_flush_disable;
+ 
+@@ -78,6 +99,11 @@ struct bmips_cpufreq {
+ 	u32			(*cpu_freq)(void);
+ };
+ 
++struct bmips_memsize {
++	const char		*compatible;
++	phys_addr_t		(*mem_size)(void);
++};
++
+ struct bmips_quirk {
+ 	const char		*compatible;
+ 	void			(*quirk_fn)(void);
+@@ -352,9 +378,90 @@ void __init plat_time_init(void)
+ 	mips_hpt_frequency = freq;
+ }
+ 
++static inline phys_addr_t bmips_dram_size(unsigned int cols,
++					  unsigned int rows,
++					  unsigned int is_32b,
++					  unsigned int banks)
++{
++	rows += 11; /* 0 => 11 address bits ... 2 => 13 address bits */
++	cols += 8; /* 0 => 8 address bits ... 2 => 10 address bits */
++	is_32b += 1;
++
++	return 1 << (cols + rows + is_32b + banks);
++}
++
++static phys_addr_t _bcm6318_memsize(void __iomem *addr)
++{
++	u32 val;
++
++	val = __raw_readl(addr + SDRAM_CFG_REG);
++	val = (val & SDRAM_SPACE_MASK) >> SDRAM_SPACE_SHIFT;
++
++	return (1 << (val + 20));
++}
++
++static phys_addr_t _bcm6328_memsize(void __iomem *addr)
++{
++	return __raw_readl(addr + DDR_CSEND_REG) << 24;
++}
++
++static phys_addr_t _bcm6358_memsize(void __iomem *addr)
++{
++	unsigned int cols, rows, is_32b;
++	u32 val;
++
++	val = __raw_readl(addr + MEMC_CFG_REG);
++	rows = (val & MEMC_CFG_ROW_MASK) >> MEMC_CFG_ROW_SHIFT;
++	cols = (val & MEMC_CFG_COL_MASK) >> MEMC_CFG_COL_SHIFT;
++	is_32b = (val & MEMC_CFG_32B_MASK) ? 0 : 1;
++
++	return bmips_dram_size(cols, rows, is_32b, 2);
++}
++
++static phys_addr_t bcm6318_memsize(void)
++{
++	return _bcm6318_memsize(BCM6318_SDRAM_ADDR);
++}
++
++static phys_addr_t bcm6328_memsize(void)
++{
++	return _bcm6328_memsize(BCM6328_MEMC_ADDR);
++}
++
++static phys_addr_t bcm6358_memsize(void)
++{
++	return _bcm6358_memsize(BCM6358_MEMC_ADDR);
++}
++
++static phys_addr_t bcm6362_memsize(void)
++{
++	return _bcm6328_memsize(BCM6362_MEMC_ADDR);
++}
++
++static phys_addr_t bcm6368_memsize(void)
++{
++	return _bcm6358_memsize(BCM6368_MEMC_ADDR);
++}
++
++static phys_addr_t bcm63268_memsize(void)
++{
++	return _bcm6328_memsize(BCM63268_MEMC_ADDR);
++}
++
++static const struct bmips_memsize bmips_memsize_list[] = {
++	{ "brcm,bcm6318", &bcm6318_memsize },
++	{ "brcm,bcm6328", &bcm6328_memsize },
++	{ "brcm,bcm6358", &bcm6358_memsize },
++	{ "brcm,bcm6362", &bcm6362_memsize },
++	{ "brcm,bcm6368", &bcm6368_memsize },
++	{ "brcm,bcm63268", &bcm63268_memsize },
++	{ /* sentinel */ }
++};
++
+ void __init plat_mem_setup(void)
+ {
+ 	void *dtb;
++	const struct bmips_memsize *ms;
+ 	const struct bmips_quirk *q;
+ 
+ 	set_io_port_base(0);
+@@ -372,6 +479,18 @@ void __init plat_mem_setup(void)
+ 
+ 	__dt_setup_arch(dtb);
+ 
++	for (ms = bmips_memsize_list; ms->mem_size; ms++) {
++		if (of_flat_dt_is_compatible(of_get_flat_dt_root(),
++					     ms->compatible)) {
++			phys_addr_t mem = ms->mem_size();
++			if (mem) {
++				memblock_add(0, mem);
++				printk("%uMB of RAM installed\n", mem >> 20);
++				break;
++			}
++		}
++	}
++
+ 	for (q = bmips_quirk_list; q->quirk_fn; q++) {
+ 		if (of_flat_dt_is_compatible(of_get_flat_dt_root(),
+ 					     q->compatible)) {
diff --git a/target/linux/bmips/patches-6.1/202-mips-bmips-tweak-Kconfig-options.patch b/target/linux/bmips/patches-6.1/202-mips-bmips-tweak-Kconfig-options.patch
new file mode 100644
index 00000000000000..e85056aee79009
--- /dev/null
+++ b/target/linux/bmips/patches-6.1/202-mips-bmips-tweak-Kconfig-options.patch
@@ -0,0 +1,68 @@
+From 20a4b57c0fafd23ae0f6bcab5b5adf4af4c80280 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Thu, 16 Mar 2023 19:31:21 +0100
+Subject: [PATCH] mips: bmips: tweak Kconfig options
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ arch/mips/Kconfig | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -272,19 +272,13 @@ config BMIPS_GENERIC
+ 	select SYNC_R4K
+ 	select COMMON_CLK
+ 	select BCM6345_L1_IRQ
+-	select BCM7038_L1_IRQ
+-	select BCM7120_L2_IRQ
+-	select BRCMSTB_L2_IRQ
+ 	select IRQ_MIPS_CPU
+ 	select DMA_NONCOHERENT
+ 	select SYS_SUPPORTS_32BIT_KERNEL
+-	select SYS_SUPPORTS_LITTLE_ENDIAN
+ 	select SYS_SUPPORTS_BIG_ENDIAN
+-	select SYS_SUPPORTS_HIGHMEM
+ 	select SYS_HAS_CPU_BMIPS32_3300
+ 	select SYS_HAS_CPU_BMIPS4350
+ 	select SYS_HAS_CPU_BMIPS4380
+-	select SYS_HAS_CPU_BMIPS5000
+ 	select SWAP_IO_SPACE
+ 	select USB_EHCI_BIG_ENDIAN_DESC if CPU_BIG_ENDIAN
+ 	select USB_EHCI_BIG_ENDIAN_MMIO if CPU_BIG_ENDIAN
+@@ -294,6 +288,7 @@ config BMIPS_GENERIC
+ 	select HAVE_PCI
+ 	select PCI_DRIVERS_GENERIC
+ 	select FW_CFE
++	select MIPS_L1_CACHE_SHIFT_4
+ 	help
+ 	  Build a generic DT-based kernel image that boots on select
+ 	  BCM33xx cable modem chips, BCM63xx DSL chips, and BCM7xxx set-top
+--- a/drivers/irqchip/Kconfig
++++ b/drivers/irqchip/Kconfig
+@@ -122,7 +122,6 @@ config BCM6345_L1_IRQ
+ config BCM7038_L1_IRQ
+ 	tristate "Broadcom STB 7038-style L1/L2 interrupt controller driver"
+ 	depends on ARCH_BRCMSTB || BMIPS_GENERIC
+-	default ARCH_BRCMSTB || BMIPS_GENERIC
+ 	select GENERIC_IRQ_CHIP
+ 	select IRQ_DOMAIN
+ 	select GENERIC_IRQ_EFFECTIVE_AFF_MASK if SMP
+@@ -130,14 +129,12 @@ config BCM7038_L1_IRQ
+ config BCM7120_L2_IRQ
+ 	tristate "Broadcom STB 7120-style L2 interrupt controller driver"
+ 	depends on ARCH_BRCMSTB || BMIPS_GENERIC
+-	default ARCH_BRCMSTB || BMIPS_GENERIC
+ 	select GENERIC_IRQ_CHIP
+ 	select IRQ_DOMAIN
+ 
+ config BRCMSTB_L2_IRQ
+ 	tristate "Broadcom STB generic L2 interrupt controller driver"
+ 	depends on ARCH_BCM2835 || ARCH_BRCMSTB || BMIPS_GENERIC
+-	default ARCH_BCM2835 || ARCH_BRCMSTB || BMIPS_GENERIC
+ 	select GENERIC_IRQ_CHIP
+ 	select IRQ_DOMAIN
+ 
diff --git a/target/linux/bmips/patches-6.1/203-mips-bmips-dma-fix-CBR-address.patch b/target/linux/bmips/patches-6.1/203-mips-bmips-dma-fix-CBR-address.patch
new file mode 100644
index 00000000000000..d440b979d5f92a
--- /dev/null
+++ b/target/linux/bmips/patches-6.1/203-mips-bmips-dma-fix-CBR-address.patch
@@ -0,0 +1,82 @@
+From 3e4c3863e0cfb8c2abdff6bb494ca69d3d2aed9c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Sat, 10 Jun 2023 17:01:40 +0200
+Subject: [PATCH] mips: bmips: dma: fix CBR address
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Some BCM63xx SoCs may return CBR address as 0.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ arch/mips/bmips/dma.c   | 12 ++++--------
+ arch/mips/bmips/setup.c | 11 ++++-------
+ 2 files changed, 8 insertions(+), 15 deletions(-)
+
+--- a/arch/mips/bmips/dma.c
++++ b/arch/mips/bmips/dma.c
+@@ -5,11 +5,10 @@
+ #include <asm/bmips.h>
+ #include <asm/io.h>
+ 
+-bool bmips_rac_flush_disable;
++void __iomem *bmips_cbr_addr;
+ 
+ void arch_sync_dma_for_cpu_all(void)
+ {
+-	void __iomem *cbr = BMIPS_GET_CBR();
+ 	u32 cfg;
+ 
+ 	if (boot_cpu_type() != CPU_BMIPS3300 &&
+@@ -17,11 +16,8 @@ void arch_sync_dma_for_cpu_all(void)
+ 	    boot_cpu_type() != CPU_BMIPS4380)
+ 		return;
+ 
+-	if (unlikely(bmips_rac_flush_disable))
+-		return;
+-
+ 	/* Flush stale data out of the readahead cache */
+-	cfg = __raw_readl(cbr + BMIPS_RAC_CONFIG);
+-	__raw_writel(cfg | 0x100, cbr + BMIPS_RAC_CONFIG);
+-	__raw_readl(cbr + BMIPS_RAC_CONFIG);
++	cfg = __raw_readl(bmips_cbr_addr + BMIPS_RAC_CONFIG);
++	__raw_writel(cfg | 0x100, bmips_cbr_addr + BMIPS_RAC_CONFIG);
++	__raw_readl(bmips_cbr_addr + BMIPS_RAC_CONFIG);
+ }
+--- a/arch/mips/bmips/setup.c
++++ b/arch/mips/bmips/setup.c
+@@ -90,7 +90,7 @@
+ 
+ #define DDR_CSEND_REG		0x8
+ 
+-extern bool bmips_rac_flush_disable;
++extern void __iomem *bmips_cbr_addr;
+ 
+ static const unsigned long kbase = VMLINUX_LOAD_ADDRESS & 0xfff00000;
+ 
+@@ -171,12 +171,6 @@ static void bcm6358_quirks(void)
+ 	 * disable SMP for now
+ 	 */
+ 	bmips_smp_enabled = 0;
+-
+-	/*
+-	 * RAC flush causes kernel panics on BCM6358 when booting from TP1
+-	 * because the bootloader is not initializing it properly.
+-	 */
+-	bmips_rac_flush_disable = !!(read_c0_brcm_cmt_local() & (1 << 31));
+ }
+ 
+ static void bcm6368_quirks(void)
+@@ -209,6 +203,11 @@ static void __init bmips_init_cfe(void)
+ 
+ void __init prom_init(void)
+ {
++	if (!(read_c0_brcm_cbr() >> 18))
++		bmips_cbr_addr = (void __iomem *) 0xff400000;
++	else
++		bmips_cbr_addr = BMIPS_GET_CBR();
++
+ 	bmips_init_cfe();
+ 	bmips_cpu_setup();
+ 	register_bmips_smp_ops();
diff --git a/target/linux/bmips/patches-6.1/204-mips-bmips-enable-RAC-on-BMIPS4350.patch b/target/linux/bmips/patches-6.1/204-mips-bmips-enable-RAC-on-BMIPS4350.patch
new file mode 100644
index 00000000000000..8a98e6bedb1971
--- /dev/null
+++ b/target/linux/bmips/patches-6.1/204-mips-bmips-enable-RAC-on-BMIPS4350.patch
@@ -0,0 +1,42 @@
+From 7f862eaedac56b67972393f0a9affcd2fe53479b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Daniel=20Gonz=C3=A1lez=20Cabanelas?= <dgcbueu@gmail.com>
+Date: Sun, 18 Jun 2023 19:59:25 +0200
+Subject: [PATCH] mips: bmips: enable RAC on BMIPS4350
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The data RAC is left disabled by the bootloader in some SoCs, at least in
+the core it boots from.
+Enabling this feature increases the performance up to +30% depending on the
+task.
+
+Signed-off-by: Daniel González Cabanelas <dgcbueu@gmail.com>
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ arch/mips/kernel/smp-bmips.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/arch/mips/kernel/smp-bmips.c
++++ b/arch/mips/kernel/smp-bmips.c
+@@ -615,6 +615,20 @@ void bmips_cpu_setup(void)
+ 		__raw_readl(cbr + BMIPS_RAC_ADDRESS_RANGE);
+ 		break;
+ 
++	case CPU_BMIPS4350:
++		/* Enable data RAC */
++		if (!(read_c0_brcm_cmt_local() & (1 << 31))) {
++			cfg = __raw_readl(cbr + BMIPS_RAC_CONFIG);
++			__raw_writel(cfg | 0xa, cbr + BMIPS_RAC_CONFIG);
++			__raw_readl(cbr + BMIPS_RAC_CONFIG);
++		} else {
++			cbr = (void __iomem *)0xff400000;
++			cfg = __raw_readl(cbr + BMIPS_RAC_CONFIG_1);
++			__raw_writel(cfg | 0xa, cbr + BMIPS_RAC_CONFIG_1);
++			__raw_readl(cbr + BMIPS_RAC_CONFIG_1);
++		}
++		break;
++
+ 	case CPU_BMIPS4380:
+ 		/* CBG workaround for early BMIPS4380 CPUs */
+ 		switch (read_c0_prid()) {
diff --git a/target/linux/bmips/patches-6.1/210-revert-macronix-nand-block-protection.patch b/target/linux/bmips/patches-6.1/210-revert-macronix-nand-block-protection.patch
new file mode 100644
index 00000000000000..25a16084efe36f
--- /dev/null
+++ b/target/linux/bmips/patches-6.1/210-revert-macronix-nand-block-protection.patch
@@ -0,0 +1,114 @@
+From 5a37811de679bff03e9c5a746f75574910ede964 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Wed, 22 Mar 2023 20:52:13 +0100
+Subject: [PATCH] Revert "mtd: rawnand: Macronix: Add support for block
+ protection"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This reverts commit 03a539c7a118427a6609a26461358c56ac8f3a06.
+
+Macronix block protection doesn't seem to be supported on Sercomm H-500s
+devices since it hangs the device.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ drivers/mtd/nand/raw/nand_macronix.c | 72 ----------------------------
+ 1 file changed, 72 deletions(-)
+
+--- a/drivers/mtd/nand/raw/nand_macronix.c
++++ b/drivers/mtd/nand/raw/nand_macronix.c
+@@ -12,10 +12,6 @@
+ #define MACRONIX_READ_RETRY_BIT BIT(0)
+ #define MACRONIX_NUM_READ_RETRY_MODES 6
+ 
+-#define ONFI_FEATURE_ADDR_MXIC_PROTECTION 0xA0
+-#define MXIC_BLOCK_PROTECTION_ALL_LOCK 0x38
+-#define MXIC_BLOCK_PROTECTION_ALL_UNLOCK 0x0
+-
+ #define ONFI_FEATURE_ADDR_MXIC_RANDOMIZER 0xB0
+ #define MACRONIX_RANDOMIZER_BIT BIT(1)
+ #define MACRONIX_RANDOMIZER_ENPGM BIT(0)
+@@ -179,73 +175,6 @@ static void macronix_nand_fix_broken_get
+ 		     ONFI_FEATURE_ADDR_TIMING_MODE, 1);
+ }
+ 
+-/*
+- * Macronix NAND supports Block Protection by Protectoin(PT) pin;
+- * active high at power-on which protects the entire chip even the #WP is
+- * disabled. Lock/unlock protection area can be partition according to
+- * protection bits, i.e. upper 1/2 locked, upper 1/4 locked and so on.
+- */
+-static int mxic_nand_lock(struct nand_chip *chip, loff_t ofs, uint64_t len)
+-{
+-	u8 feature[ONFI_SUBFEATURE_PARAM_LEN];
+-	int ret;
+-
+-	feature[0] = MXIC_BLOCK_PROTECTION_ALL_LOCK;
+-	nand_select_target(chip, 0);
+-	ret = nand_set_features(chip, ONFI_FEATURE_ADDR_MXIC_PROTECTION,
+-				feature);
+-	nand_deselect_target(chip);
+-	if (ret)
+-		pr_err("%s all blocks failed\n", __func__);
+-
+-	return ret;
+-}
+-
+-static int mxic_nand_unlock(struct nand_chip *chip, loff_t ofs, uint64_t len)
+-{
+-	u8 feature[ONFI_SUBFEATURE_PARAM_LEN];
+-	int ret;
+-
+-	feature[0] = MXIC_BLOCK_PROTECTION_ALL_UNLOCK;
+-	nand_select_target(chip, 0);
+-	ret = nand_set_features(chip, ONFI_FEATURE_ADDR_MXIC_PROTECTION,
+-				feature);
+-	nand_deselect_target(chip);
+-	if (ret)
+-		pr_err("%s all blocks failed\n", __func__);
+-
+-	return ret;
+-}
+-
+-static void macronix_nand_block_protection_support(struct nand_chip *chip)
+-{
+-	u8 feature[ONFI_SUBFEATURE_PARAM_LEN];
+-	int ret;
+-
+-	bitmap_set(chip->parameters.get_feature_list,
+-		   ONFI_FEATURE_ADDR_MXIC_PROTECTION, 1);
+-
+-	feature[0] = MXIC_BLOCK_PROTECTION_ALL_UNLOCK;
+-	nand_select_target(chip, 0);
+-	ret = nand_get_features(chip, ONFI_FEATURE_ADDR_MXIC_PROTECTION,
+-				feature);
+-	nand_deselect_target(chip);
+-	if (ret || feature[0] != MXIC_BLOCK_PROTECTION_ALL_LOCK) {
+-		if (ret)
+-			pr_err("Block protection check failed\n");
+-
+-		bitmap_clear(chip->parameters.get_feature_list,
+-			     ONFI_FEATURE_ADDR_MXIC_PROTECTION, 1);
+-		return;
+-	}
+-
+-	bitmap_set(chip->parameters.set_feature_list,
+-		   ONFI_FEATURE_ADDR_MXIC_PROTECTION, 1);
+-
+-	chip->ops.lock_area = mxic_nand_lock;
+-	chip->ops.unlock_area = mxic_nand_unlock;
+-}
+-
+ static int nand_power_down_op(struct nand_chip *chip)
+ {
+ 	int ret;
+@@ -323,7 +252,6 @@ static int macronix_nand_init(struct nan
+ 
+ 	macronix_nand_fix_broken_get_timings(chip);
+ 	macronix_nand_onfi_init(chip);
+-	macronix_nand_block_protection_support(chip);
+ 	macronix_nand_deep_power_down_support(chip);
+ 
+ 	return 0;
diff --git a/target/linux/bmips/patches-6.1/500-net-broadcom-add-BCM6368-enetsw-controller-driver.patch b/target/linux/bmips/patches-6.1/500-net-broadcom-add-BCM6368-enetsw-controller-driver.patch
new file mode 100644
index 00000000000000..71ed53235fc816
--- /dev/null
+++ b/target/linux/bmips/patches-6.1/500-net-broadcom-add-BCM6368-enetsw-controller-driver.patch
@@ -0,0 +1,44 @@
+From 590b60fb08cb1e70fe02d3f407c6b3dbe9ad06ff Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Mon, 1 Mar 2021 07:34:39 +0100
+Subject: [PATCH] net: broadcom: add BCM6368 enetsw controller driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This controller is present on BCM6318, BCM6328, BCM6362, BCM6368 and BCM63268
+SoCs.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ drivers/net/ethernet/broadcom/Kconfig  | 8 ++++++++
+ drivers/net/ethernet/broadcom/Makefile | 1 +
+ 2 files changed, 9 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/Kconfig
++++ b/drivers/net/ethernet/broadcom/Kconfig
+@@ -68,6 +68,14 @@ config BCM63XX_ENET
+ 	  This driver supports the ethernet MACs in the Broadcom 63xx
+ 	  MIPS chipset family (BCM63XX).
+ 
++config BCM6368_ENETSW
++	tristate "Broadcom BCM6368 internal mac support"
++	depends on BMIPS_GENERIC || COMPILE_TEST
++	default y
++	help
++	  This driver supports Ethernet controller integrated into Broadcom
++	  BCM6368 family SoCs.
++
+ config BCMGENET
+ 	tristate "Broadcom GENET internal MAC support"
+ 	depends on HAS_IOMEM
+--- a/drivers/net/ethernet/broadcom/Makefile
++++ b/drivers/net/ethernet/broadcom/Makefile
+@@ -6,6 +6,7 @@
+ obj-$(CONFIG_B44) += b44.o
+ obj-$(CONFIG_BCM4908_ENET) += bcm4908_enet.o
+ obj-$(CONFIG_BCM63XX_ENET) += bcm63xx_enet.o
++obj-$(CONFIG_BCM6368_ENETSW) += bcm6368-enetsw.o
+ obj-$(CONFIG_BCMGENET) += genet/
+ obj-$(CONFIG_BNX2) += bnx2.o
+ obj-$(CONFIG_CNIC) += cnic.o
diff --git a/target/linux/bmips/patches-6.1/501-net-broadcom-add-BCM6348-enet-controller-driver.patch b/target/linux/bmips/patches-6.1/501-net-broadcom-add-BCM6348-enet-controller-driver.patch
new file mode 100644
index 00000000000000..af09f4dd4f5f2e
--- /dev/null
+++ b/target/linux/bmips/patches-6.1/501-net-broadcom-add-BCM6348-enet-controller-driver.patch
@@ -0,0 +1,43 @@
+From 590b60fb08cb1e70fe02d3f407c6b3dbe9ad06ff Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Mon, 1 Mar 2021 07:34:39 +0100
+Subject: [PATCH] net: broadcom: add BCM6348 enetsw controller driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This controller is present on BCM6338, BCM6348 and BCM6358 SoCs.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ drivers/net/ethernet/broadcom/Kconfig  | 8 ++++++++
+ drivers/net/ethernet/broadcom/Makefile | 1 +
+ 2 files changed, 9 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/Kconfig
++++ b/drivers/net/ethernet/broadcom/Kconfig
+@@ -68,6 +68,14 @@ config BCM63XX_ENET
+ 	  This driver supports the ethernet MACs in the Broadcom 63xx
+ 	  MIPS chipset family (BCM63XX).
+ 
++config BCM6348_ENET
++	tristate "Broadcom BCM6348 internal mac support"
++	depends on BMIPS_GENERIC || COMPILE_TEST
++	default y
++	help
++	  This driver supports Ethernet controller integrated into Broadcom
++	  BCM6348 family SoCs.
++
+ config BCM6368_ENETSW
+ 	tristate "Broadcom BCM6368 internal mac support"
+ 	depends on BMIPS_GENERIC || COMPILE_TEST
+--- a/drivers/net/ethernet/broadcom/Makefile
++++ b/drivers/net/ethernet/broadcom/Makefile
+@@ -6,6 +6,7 @@
+ obj-$(CONFIG_B44) += b44.o
+ obj-$(CONFIG_BCM4908_ENET) += bcm4908_enet.o
+ obj-$(CONFIG_BCM63XX_ENET) += bcm63xx_enet.o
++obj-$(CONFIG_BCM6348_ENET) += bcm6348-enet.o
+ obj-$(CONFIG_BCM6368_ENETSW) += bcm6368-enetsw.o
+ obj-$(CONFIG_BCMGENET) += genet/
+ obj-$(CONFIG_BNX2) += bnx2.o
diff --git a/target/linux/bmips/patches-6.1/502-net-mdio-mux-bcm6368-allow-disabling.patch b/target/linux/bmips/patches-6.1/502-net-mdio-mux-bcm6368-allow-disabling.patch
new file mode 100644
index 00000000000000..6071bea42d2639
--- /dev/null
+++ b/target/linux/bmips/patches-6.1/502-net-mdio-mux-bcm6368-allow-disabling.patch
@@ -0,0 +1,23 @@
+From 21145a89c79a22c4fb719cce5a2f4e3373d39756 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Wed, 17 May 2023 18:16:46 +0200
+Subject: [PATCH] net: mdio: mux-bcm6368: allow disabling for bmips
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ drivers/net/mdio/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/mdio/Kconfig
++++ b/drivers/net/mdio/Kconfig
+@@ -219,7 +219,6 @@ config MDIO_BUS_MUX_BCM6368
+ 	tristate "Broadcom BCM6368 MDIO bus multiplexers"
+ 	depends on OF && OF_MDIO && (BMIPS_GENERIC || COMPILE_TEST)
+ 	select MDIO_BUS_MUX
+-	default BMIPS_GENERIC
+ 	help
+ 	  This module provides a driver for MDIO bus multiplexers found in
+ 	  BCM6368 based Broadcom SoCs. This multiplexer connects one of several
diff --git a/target/linux/bmips/patches-6.1/600-mips-bmips-add-pci-support.patch b/target/linux/bmips/patches-6.1/600-mips-bmips-add-pci-support.patch
new file mode 100644
index 00000000000000..f28dda908d7013
--- /dev/null
+++ b/target/linux/bmips/patches-6.1/600-mips-bmips-add-pci-support.patch
@@ -0,0 +1,34 @@
+From 7742c1ba191a005a1356ff89b5fe2279d6f0ec4d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Wed, 17 May 2023 18:18:43 +0200
+Subject: [PATCH] mips: bmips: add PCI support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ arch/mips/Kconfig      | 1 +
+ arch/mips/pci/Makefile | 1 +
+ 2 files changed, 1 insertions(+), 1 deletions(-)
+
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -286,7 +286,6 @@ config BMIPS_GENERIC
+ 	select USB_OHCI_BIG_ENDIAN_MMIO if CPU_BIG_ENDIAN
+ 	select HARDIRQS_SW_RESEND
+ 	select HAVE_PCI
+-	select PCI_DRIVERS_GENERIC
+ 	select FW_CFE
+ 	select MIPS_L1_CACHE_SHIFT_4
+ 	help
+--- a/arch/mips/pci/Makefile
++++ b/arch/mips/pci/Makefile
+@@ -26,6 +26,7 @@ obj-$(CONFIG_PCI_XTALK_BRIDGE)	+= pci-xt
+ # These are still pretty much in the old state, watch, go blind.
+ #
+ obj-$(CONFIG_ATH79)		+= fixup-ath79.o
++obj-$(CONFIG_BMIPS_GENERIC)	+= fixup-bmips.o
+ obj-$(CONFIG_MIPS_COBALT)	+= fixup-cobalt.o
+ obj-$(CONFIG_LEMOTE_FULOONG2E)	+= fixup-fuloong2e.o ops-loongson2.o
+ obj-$(CONFIG_LEMOTE_MACH2F)	+= fixup-lemote2f.o ops-loongson2.o
diff --git a/target/linux/bmips/patches-6.1/601-pci-controllers-add-bcm6328-pcie-support.patch b/target/linux/bmips/patches-6.1/601-pci-controllers-add-bcm6328-pcie-support.patch
new file mode 100644
index 00000000000000..0eb973ce30e1ef
--- /dev/null
+++ b/target/linux/bmips/patches-6.1/601-pci-controllers-add-bcm6328-pcie-support.patch
@@ -0,0 +1,36 @@
+From 49133041e0a5770decf1a25f575764d13a0d425c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Wed, 17 May 2023 18:20:10 +0200
+Subject: [PATCH] pci: add bcm6328-pcie support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ drivers/pci/controller/Kconfig  | 5 +++++
+ drivers/pci/controller/Makefile | 1 +
+ 2 files changed, 6 insertions(+)
+
+--- a/drivers/pci/controller/Kconfig
++++ b/drivers/pci/controller/Kconfig
+@@ -3,6 +3,11 @@
+ menu "PCI controller drivers"
+ 	depends on PCI
+ 
++config PCIE_BCM6328
++	bool "BCM6328 PCIe controller"
++	depends on BMIPS_GENERIC || COMPILE_TEST
++	depends on OF
++
+ config PCI_MVEBU
+ 	tristate "Marvell EBU PCIe controller"
+ 	depends on ARCH_MVEBU || ARCH_DOVE || COMPILE_TEST
+--- a/drivers/pci/controller/Makefile
++++ b/drivers/pci/controller/Makefile
+@@ -1,4 +1,5 @@
+ # SPDX-License-Identifier: GPL-2.0
++obj-$(CONFIG_PCIE_BCM6328) += pcie-bcm6328.o
+ obj-$(CONFIG_PCIE_CADENCE) += cadence/
+ obj-$(CONFIG_PCI_FTPCI100) += pci-ftpci100.o
+ obj-$(CONFIG_PCI_IXP4XX) += pci-ixp4xx.o
diff --git a/target/linux/bmips/patches-6.1/602-pci-controllers-add-bcm6318-pcie-support.patch b/target/linux/bmips/patches-6.1/602-pci-controllers-add-bcm6318-pcie-support.patch
new file mode 100644
index 00000000000000..1a3ec1db2a66fb
--- /dev/null
+++ b/target/linux/bmips/patches-6.1/602-pci-controllers-add-bcm6318-pcie-support.patch
@@ -0,0 +1,36 @@
+From cc3c30bdc98eabbaa07c64302eb5124a0f4a74f0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Wed, 17 May 2023 18:20:46 +0200
+Subject: [PATCH] pci: add bcm6318-pcie support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ drivers/pci/controller/Kconfig  | 5 +++++
+ drivers/pci/controller/Makefile | 1 +
+ 2 files changed, 6 insertions(+)
+
+--- a/drivers/pci/controller/Kconfig
++++ b/drivers/pci/controller/Kconfig
+@@ -3,6 +3,11 @@
+ menu "PCI controller drivers"
+ 	depends on PCI
+ 
++config PCIE_BCM6318
++	bool "BCM6318 PCIe controller"
++	depends on BMIPS_GENERIC || COMPILE_TEST
++	depends on OF
++
+ config PCIE_BCM6328
+ 	bool "BCM6328 PCIe controller"
+ 	depends on BMIPS_GENERIC || COMPILE_TEST
+--- a/drivers/pci/controller/Makefile
++++ b/drivers/pci/controller/Makefile
+@@ -1,4 +1,5 @@
+ # SPDX-License-Identifier: GPL-2.0
++obj-$(CONFIG_PCIE_BCM6318) += pcie-bcm6318.o
+ obj-$(CONFIG_PCIE_BCM6328) += pcie-bcm6328.o
+ obj-$(CONFIG_PCIE_CADENCE) += cadence/
+ obj-$(CONFIG_PCI_FTPCI100) += pci-ftpci100.o
diff --git a/target/linux/bmips/patches-6.1/603-pci-controllers-add-bcm6348-pci-support.patch b/target/linux/bmips/patches-6.1/603-pci-controllers-add-bcm6348-pci-support.patch
new file mode 100644
index 00000000000000..32aeea6a74db99
--- /dev/null
+++ b/target/linux/bmips/patches-6.1/603-pci-controllers-add-bcm6348-pci-support.patch
@@ -0,0 +1,36 @@
+From 5e7813e5725d79d00e0988472c306490fc48b3e1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Wed, 17 May 2023 18:21:19 +0200
+Subject: [PATCH] pci: add bcm6348-pci support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ drivers/pci/controller/Kconfig  | 5 +++++
+ drivers/pci/controller/Makefile | 1 +
+ 2 files changed, 6 insertions(+)
+
+--- a/drivers/pci/controller/Kconfig
++++ b/drivers/pci/controller/Kconfig
+@@ -3,6 +3,11 @@
+ menu "PCI controller drivers"
+ 	depends on PCI
+ 
++config PCI_BCM6348
++	bool "BCM6348 PCI controller"
++	depends on BMIPS_GENERIC || COMPILE_TEST
++	depends on OF
++
+ config PCIE_BCM6318
+ 	bool "BCM6318 PCIe controller"
+ 	depends on BMIPS_GENERIC || COMPILE_TEST
+--- a/drivers/pci/controller/Makefile
++++ b/drivers/pci/controller/Makefile
+@@ -1,4 +1,5 @@
+ # SPDX-License-Identifier: GPL-2.0
++obj-$(CONFIG_PCI_BCM6348) += pci-bcm6348.o
+ obj-$(CONFIG_PCIE_BCM6318) += pcie-bcm6318.o
+ obj-$(CONFIG_PCIE_BCM6328) += pcie-bcm6328.o
+ obj-$(CONFIG_PCIE_CADENCE) += cadence/
diff --git a/target/linux/bmips/patches-6.1/700-leds-add-support-for-Sercomm-MSP430-LED-controller.patch b/target/linux/bmips/patches-6.1/700-leds-add-support-for-Sercomm-MSP430-LED-controller.patch
new file mode 100644
index 00000000000000..ca3c5c74891f4d
--- /dev/null
+++ b/target/linux/bmips/patches-6.1/700-leds-add-support-for-Sercomm-MSP430-LED-controller.patch
@@ -0,0 +1,45 @@
+From 1a5f2263d388016c88d39e141c7eb8085c9313fc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Wed, 5 Apr 2023 08:07:00 +0200
+Subject: [PATCH] leds: add support for Sercomm MSP430 LED controller
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Sercomm added an external MSP430G2513 for controlling LEDs through SPI on some
+boards.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ drivers/leds/Kconfig  | 9 +++++++++
+ drivers/leds/Makefile | 1 +
+ 2 files changed, 10 insertions(+)
+
+--- a/drivers/leds/Kconfig
++++ b/drivers/leds/Kconfig
+@@ -281,6 +281,15 @@ config LEDS_COBALT_RAQ
+ 	help
+ 	  This option enables support for the Cobalt Raq series LEDs.
+ 
++config LEDS_SERCOMM_MSP430
++	tristate "LED support for Sercomm MSP430 SPI LED controllers"
++	depends on LEDS_CLASS
++	depends on SPI
++	depends on OF
++	help
++          This option enables support for the Sercomm MSP430G2513 SPI LED
++	  controllers.
++
+ config LEDS_SUNFIRE
+ 	tristate "LED support for SunFire servers."
+ 	depends on LEDS_CLASS
+--- a/drivers/leds/Makefile
++++ b/drivers/leds/Makefile
+@@ -76,6 +76,7 @@ obj-$(CONFIG_LEDS_PWM)			+= leds-pwm.o
+ obj-$(CONFIG_LEDS_REGULATOR)		+= leds-regulator.o
+ obj-$(CONFIG_LEDS_S3C24XX)		+= leds-s3c24xx.o
+ obj-$(CONFIG_LEDS_SC27XX_BLTC)		+= leds-sc27xx-bltc.o
++obj-$(CONFIG_LEDS_SERCOMM_MSP430)	+= leds-sercomm-msp430.o
+ obj-$(CONFIG_LEDS_SUNFIRE)		+= leds-sunfire.o
+ obj-$(CONFIG_LEDS_SYSCON)		+= leds-syscon.o
+ obj-$(CONFIG_LEDS_TCA6507)		+= leds-tca6507.o
diff --git a/target/linux/bmips/patches-6.1/800-jffs2-work-around-unaligned-accesses-failing-on-bcm6.patch b/target/linux/bmips/patches-6.1/800-jffs2-work-around-unaligned-accesses-failing-on-bcm6.patch
new file mode 100644
index 00000000000000..d98d27c6b43cee
--- /dev/null
+++ b/target/linux/bmips/patches-6.1/800-jffs2-work-around-unaligned-accesses-failing-on-bcm6.patch
@@ -0,0 +1,26 @@
+From ff3409ab17d56450943364ba49a16960e3cdda9b Mon Sep 17 00:00:00 2001
+From: Jonas Gorski <jogo@openwrt.org>
+Date: Sun, 6 Apr 2014 22:33:16 +0200
+Subject: [RFC] jffs2: work around unaligned accesses failing on bcm63xx/smp
+
+Unligned memcpy_fromio randomly fails with an unaligned dst. Work around
+it by ensuring we are always doing aligned copies.
+
+Should fix filename corruption in jffs2 with SMP.
+
+Signed-off-by: Jonas Gorski <jogo@openwrt.org>
+---
+ fs/jffs2/nodelist.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/jffs2/nodelist.h
++++ b/fs/jffs2/nodelist.h
+@@ -259,7 +259,7 @@ struct jffs2_full_dirent
+ 	uint32_t ino; /* == zero for unlink */
+ 	unsigned int nhash;
+ 	unsigned char type;
+-	unsigned char name[];
++	unsigned char name[] __attribute__((aligned((sizeof(long)))));
+ };
+ 
+ /*
diff --git a/target/linux/gemini/Makefile b/target/linux/gemini/Makefile
index d5c9bbad13dfd0..284d1247cb23f4 100644
--- a/target/linux/gemini/Makefile
+++ b/target/linux/gemini/Makefile
@@ -9,8 +9,10 @@ BOARD:=gemini
 BOARDNAME:=Cortina Systems CS351x
 FEATURES:=squashfs pci rtc usb dt gpio display ext4 rootfs-part boot-part
 CPU_TYPE:=fa526
+SUBTARGETS:=generic
 
 KERNEL_PATCHVER:=5.15
+KERNEL_TESTING_PATCHVER:=6.1
 
 define Target/Description
 	Build firmware images for the StorLink/Cortina Gemini CS351x ARM FA526 CPU
diff --git a/target/linux/gemini/base-files/etc/board.d/02_network b/target/linux/gemini/base-files/etc/board.d/02_network
index d6ee5cadfe25a3..93a02a7564efdc 100644
--- a/target/linux/gemini/base-files/etc/board.d/02_network
+++ b/target/linux/gemini/base-files/etc/board.d/02_network
@@ -9,16 +9,31 @@ dlink,dir-685)
 	ucidef_set_interface "eth" device "eth0" protocol "none"
 	ucidef_set_interfaces_lan_wan "lan0 lan1 lan2 lan3" "wan"
 	;;
+dlink,dns-313|\
+edimax,ns-2502|\
+raidsonic,ib-4220-b|\
+wiliboard,wbd111|\
+wiliboard,wbd222)
+	# NAS machines with a single ethernet port
+	ucidef_set_interface_lan "eth0" "dhcp"
+	;;
 itian,sq201)
 	# These are all connected to eth1 thru VSC7395
 	ucidef_set_interface "eth" device "eth1" protocol "none"
 	ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" "eth0"
 	;;
+ssi,1328)
+	ucidef_set_interfaces_lan_wan "eth0" "eth1"
+	;;
 storlink,gemini324)
 	# These are all connected to eth1 thru VSC7385
 	ucidef_set_interface "eth" device "eth1" protocol "none"
 	ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" "eth0"
 	;;
+teltonika,rut1xx)
+	# One ethernet LAN which is offering DHCP
+	ucidef_set_interface_lan "eth0"
+	;;
 esac
 
 board_config_flush
diff --git a/target/linux/gemini/config-5.15 b/target/linux/gemini/config-5.15
index b3b7a7dd127b9f..b0c3afbf9db6f0 100644
--- a/target/linux/gemini/config-5.15
+++ b/target/linux/gemini/config-5.15
@@ -18,6 +18,7 @@ CONFIG_ARM=y
 CONFIG_ARM_AMBA=y
 CONFIG_ARM_APPENDED_DTB=y
 # CONFIG_ARM_ATAG_DTB_COMPAT is not set
+CONFIG_ARM_CRYPTO=y
 CONFIG_ARM_HAS_SG_CHAIN=y
 CONFIG_ARM_L1_CACHE_SHIFT=5
 CONFIG_ARM_PATCH_PHYS_VIRT=y
@@ -74,7 +75,6 @@ CONFIG_CRC32_SLICEBY8=y
 CONFIG_CRC_CCITT=y
 CONFIG_CRC_ITU_T=y
 CONFIG_CROSS_MEMORY_ATTACH=y
-CONFIG_CRYPTO_BLAKE2S=y
 CONFIG_CRYPTO_CMAC=y
 CONFIG_CRYPTO_CRC32C=y
 CONFIG_CRYPTO_DES=y
@@ -217,7 +217,6 @@ CONFIG_INPUT_KEYBOARD=y
 # CONFIG_IOMMU_IO_PGTABLE_ARMV7S is not set
 # CONFIG_IOMMU_IO_PGTABLE_LPAE is not set
 CONFIG_IOMMU_SUPPORT=y
-CONFIG_IO_URING=y
 CONFIG_IPC_NS=y
 CONFIG_IRQCHIP=y
 CONFIG_IRQ_DOMAIN=y
diff --git a/target/linux/gemini/config-6.1 b/target/linux/gemini/config-6.1
new file mode 100644
index 00000000000000..41f7093c1cef1a
--- /dev/null
+++ b/target/linux/gemini/config-6.1
@@ -0,0 +1,427 @@
+CONFIG_ALIGNMENT_TRAP=y
+CONFIG_AMBA_PL08X=y
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_FORCE_MAX_ORDER=11
+CONFIG_ARCH_GEMINI=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+# CONFIG_ARCH_MOXART is not set
+CONFIG_ARCH_MULTIPLATFORM=y
+CONFIG_ARCH_MULTI_V4=y
+# CONFIG_ARCH_MULTI_V4T is not set
+CONFIG_ARCH_MULTI_V4_V5=y
+# CONFIG_ARCH_MULTI_V5 is not set
+CONFIG_ARCH_NR_GPIO=0
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARM=y
+CONFIG_ARM_AMBA=y
+CONFIG_ARM_APPENDED_DTB=y
+# CONFIG_ARM_ATAG_DTB_COMPAT is not set
+CONFIG_ARM_CRYPTO=y
+CONFIG_ARM_HAS_SG_CHAIN=y
+CONFIG_ARM_L1_CACHE_SHIFT=5
+CONFIG_ARM_PATCH_PHYS_VIRT=y
+# CONFIG_ARM_SMMU is not set
+CONFIG_ARM_UNWIND=y
+CONFIG_ATA=y
+CONFIG_ATAGS=y
+CONFIG_ATA_FORCE=y
+CONFIG_ATA_VERBOSE_ERROR=y
+CONFIG_AUTO_ZRELADDR=y
+CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BOUNCE=y
+CONFIG_CLKSRC_MMIO=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CMA=y
+CONFIG_CMA_ALIGNMENT=8
+CONFIG_CMA_AREAS=7
+# CONFIG_CMA_DEBUG is not set
+# CONFIG_CMA_DEBUGFS is not set
+CONFIG_CMA_SIZE_PERCENTAGE=10
+# CONFIG_CMA_SIZE_SEL_MAX is not set
+# CONFIG_CMA_SIZE_SEL_MBYTES is not set
+# CONFIG_CMA_SIZE_SEL_MIN is not set
+CONFIG_CMA_SIZE_SEL_PERCENTAGE=y
+# CONFIG_CMA_SYSFS is not set
+CONFIG_COMMON_CLK=y
+CONFIG_COMMON_CLK_GEMINI=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CONTIG_ALLOC=y
+CONFIG_COREDUMP=y
+CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y
+CONFIG_CPU_32v4=y
+CONFIG_CPU_ABRT_EV4=y
+CONFIG_CPU_CACHE_FA=y
+CONFIG_CPU_CACHE_VIVT=y
+CONFIG_CPU_COPY_FA=y
+CONFIG_CPU_CP15=y
+CONFIG_CPU_CP15_MMU=y
+# CONFIG_CPU_DCACHE_WRITETHROUGH is not set
+CONFIG_CPU_FA526=y
+CONFIG_CPU_NO_EFFICIENT_FFS=y
+CONFIG_CPU_PABRT_LEGACY=y
+CONFIG_CPU_THERMAL=y
+CONFIG_CPU_TLB_FA=y
+CONFIG_CPU_USE_DOMAINS=y
+CONFIG_CRASH_CORE=y
+CONFIG_CRC16=y
+# CONFIG_CRC32_SARWATE is not set
+CONFIG_CRC32_SLICEBY8=y
+CONFIG_CRC_CCITT=y
+CONFIG_CRC_ITU_T=y
+CONFIG_CROSS_MEMORY_ATTACH=y
+CONFIG_CRYPTO_CMAC=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_DES=y
+CONFIG_CRYPTO_DEV_SL3516=y
+# CONFIG_CRYPTO_DEV_SL3516_DEBUG is not set
+CONFIG_CRYPTO_DRBG=y
+CONFIG_CRYPTO_DRBG_HMAC=y
+CONFIG_CRYPTO_DRBG_MENU=y
+CONFIG_CRYPTO_ECB=y
+CONFIG_CRYPTO_ECHAINIV=y
+CONFIG_CRYPTO_ENGINE=y
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_HW=y
+CONFIG_CRYPTO_JITTERENTROPY=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_DES=y
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_MD4=y
+CONFIG_CRYPTO_MD5=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_RNG_DEFAULT=y
+CONFIG_CRYPTO_SEQIV=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_LL_INCLUDE="mach/debug-macro.S"
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_DECOMPRESS_BZIP2=y
+CONFIG_DECOMPRESS_GZIP=y
+CONFIG_DECOMPRESS_LZ4=y
+CONFIG_DECOMPRESS_LZMA=y
+CONFIG_DECOMPRESS_LZO=y
+CONFIG_DECOMPRESS_XZ=y
+CONFIG_DMADEVICES=y
+CONFIG_DMATEST=y
+CONFIG_DMA_CMA=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_ENGINE_RAID=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_OPS=y
+CONFIG_DMA_REMAP=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DMA_VIRTUAL_CHANNELS=y
+CONFIG_DRM=y
+CONFIG_DRM_BRIDGE=y
+CONFIG_DRM_FBDEV_EMULATION=y
+CONFIG_DRM_FBDEV_OVERALLOC=100
+CONFIG_DRM_GEM_CMA_HELPER=y
+CONFIG_DRM_KMS_CMA_HELPER=y
+CONFIG_DRM_KMS_HELPER=y
+CONFIG_DRM_PANEL=y
+CONFIG_DRM_PANEL_BRIDGE=y
+CONFIG_DRM_PANEL_ILITEK_IL9322=y
+CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y
+CONFIG_DRM_TVE200=y
+CONFIG_DTC=y
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_EDAC_ATOMIC_SCRUB=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EEPROM_93CX6=y
+CONFIG_ELF_CORE=y
+# CONFIG_EMBEDDED is not set
+# CONFIG_EXPERT is not set
+CONFIG_EXT4_FS=y
+CONFIG_FARADAY_FTINTC010=y
+CONFIG_FB=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+CONFIG_FB_CMDLINE=y
+CONFIG_FB_DEFERRED_IO=y
+CONFIG_FB_SYS_COPYAREA=y
+CONFIG_FB_SYS_FILLRECT=y
+CONFIG_FB_SYS_FOPS=y
+CONFIG_FB_SYS_IMAGEBLIT=y
+CONFIG_FHANDLE=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FONT_8x16=y
+CONFIG_FONT_8x8=y
+CONFIG_FONT_SUPPORT=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y
+# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FS_POSIX_ACL=y
+CONFIG_FTTMR010_TIMER=y
+CONFIG_FTWDT010_WATCHDOG=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+# CONFIG_FW_LOADER_USER_HELPER_FALLBACK is not set
+CONFIG_GEMINI_ETHERNET=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IRQ_MULTI_HANDLER=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GLOB=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_FTGPIO010=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GRO_CELLS=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HDMI=y
+CONFIG_HIGHMEM=y
+CONFIG_HIGHPTE=y
+CONFIG_HWMON=y
+CONFIG_HW_CONSOLE=y
+CONFIG_HW_RANDOM=y
+CONFIG_HZ_FIXED=0
+CONFIG_I2C=y
+CONFIG_I2C_ALGOBIT=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_COMPAT=y
+CONFIG_I2C_GPIO=y
+CONFIG_I2C_HELPER_AUTO=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_INPUT=y
+CONFIG_INPUT_KEYBOARD=y
+# CONFIG_IOMMU_DEBUGFS is not set
+# CONFIG_IOMMU_IO_PGTABLE_ARMV7S is not set
+# CONFIG_IOMMU_IO_PGTABLE_LPAE is not set
+CONFIG_IOMMU_SUPPORT=y
+CONFIG_IPC_NS=y
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+# CONFIG_ISDN is not set
+CONFIG_JBD2=y
+CONFIG_KALLSYMS=y
+CONFIG_KCMP=y
+CONFIG_KERNEL_LZMA=y
+# CONFIG_KERNEL_XZ is not set
+CONFIG_KEXEC=y
+CONFIG_KEXEC_CORE=y
+CONFIG_KEYBOARD_DLINK_DIR685=y
+CONFIG_KMAP_LOCAL=y
+CONFIG_KMAP_LOCAL_NON_LINEAR_PTE_ARRAY=y
+# CONFIG_LDM_DEBUG is not set
+CONFIG_LDM_PARTITION=y
+CONFIG_LEDS_TRIGGER_DISK=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOGO=y
+CONFIG_LOGO_LINUX_CLUT224=y
+# CONFIG_LOGO_LINUX_MONO is not set
+CONFIG_LOGO_LINUX_VGA16=y
+CONFIG_LZ4_DECOMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MARVELL_PHY=y
+CONFIG_MDIO_BITBANG=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MDIO_GPIO=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MEMORY_ISOLATION=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MODULES_USE_ELF_REL=y
+# CONFIG_MODULE_UNLOAD is not set
+CONFIG_MQ_IOSCHED_DEADLINE=y
+CONFIG_MQ_IOSCHED_KYBER=y
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_PHYSMAP=y
+CONFIG_MTD_PHYSMAP_GEMINI=y
+CONFIG_MTD_REDBOOT_PARTS=y
+CONFIG_MTD_SPLIT_FIRMWARE=y
+CONFIG_MTD_SPLIT_WRGG_FW=y
+CONFIG_NAMESPACES=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_KUSER_HELPERS=y
+CONFIG_NEED_PER_CPU_KM=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_REALTEK_SMI=y
+CONFIG_NET_DSA_TAG_RTL4_A=y
+CONFIG_NET_NS=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NLS=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_OLD_SIGACTION=y
+CONFIG_OLD_SIGSUSPEND3=y
+CONFIG_PAGE_OFFSET=0xC0000000
+# CONFIG_PANIC_ON_OOPS is not set
+CONFIG_PANIC_ON_OOPS_VALUE=0
+CONFIG_PANIC_TIMEOUT=0
+CONFIG_PATA_FTIDE010=y
+CONFIG_PCI=y
+CONFIG_PCIEASPM=y
+CONFIG_PCIEASPM_DEFAULT=y
+# CONFIG_PCIEASPM_PERFORMANCE is not set
+# CONFIG_PCIEASPM_POWERSAVE is not set
+# CONFIG_PCIEASPM_POWER_SUPERSAVE is not set
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PCI_FTPCI100=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PID_NS=y
+CONFIG_PINCTRL=y
+CONFIG_PINCTRL_GEMINI=y
+# CONFIG_PINCTRL_SINGLE is not set
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_GEMINI_POWEROFF=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_PREEMPT=y
+CONFIG_PREEMPTION=y
+CONFIG_PREEMPT_COUNT=y
+# CONFIG_PREEMPT_NONE is not set
+CONFIG_PREEMPT_RCU=y
+CONFIG_PROC_PAGE_MONITOR=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_RATIONAL=y
+CONFIG_RD_BZIP2=y
+CONFIG_RD_GZIP=y
+CONFIG_RD_LZ4=y
+CONFIG_RD_LZMA=y
+CONFIG_RD_LZO=y
+CONFIG_RD_XZ=y
+CONFIG_REALTEK_PHY=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_RELAY=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RSEQ=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_FTRTC010=y
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RTC_MC146818_LIB=y
+CONFIG_RTC_NVMEM=y
+CONFIG_SATA_GEMINI=y
+CONFIG_SATA_HOST=y
+CONFIG_SATA_PMP=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+# CONFIG_SCSI_LOWLEVEL is not set
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_SENSORS_DRIVETEMP=y
+CONFIG_SENSORS_GPIO_FAN=y
+CONFIG_SENSORS_LM75=y
+CONFIG_SERIAL_8250_DEPRECATED_OPTIONS=y
+CONFIG_SERIAL_8250_EXAR=y
+CONFIG_SERIAL_8250_FSL=y
+CONFIG_SERIAL_8250_NR_UARTS=1
+CONFIG_SERIAL_8250_PCI=y
+CONFIG_SERIAL_8250_RUNTIME_UARTS=1
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIO=y
+CONFIG_SERIO_LIBPS2=y
+CONFIG_SERIO_SERPORT=y
+CONFIG_SG_POOL=y
+CONFIG_SLUB_DEBUG=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SPI=y
+CONFIG_SPI_BITBANG=y
+CONFIG_SPI_GPIO=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPLIT_PTLOCK_CPUS=999999
+CONFIG_SRCU=y
+# CONFIG_STRIP_ASM_SYMS is not set
+CONFIG_SWPHY=y
+CONFIG_SYNC_FILE=y
+CONFIG_SYSFS_SYSCALL=y
+CONFIG_SYS_SUPPORTS_APM_EMULATION=y
+CONFIG_THERMAL=y
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_GOV_STEP_WISE=y
+CONFIG_THERMAL_HWMON=y
+CONFIG_THERMAL_OF=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UNCOMPRESS_INCLUDE="debug/uncompress.h"
+CONFIG_UNINLINE_SPIN_UNLOCK=y
+CONFIG_UNUSED_BOARD_FILES=n
+CONFIG_UNWINDER_ARM=y
+CONFIG_USB_FOTG210=m
+CONFIG_USB_FOTG210_HCD=y
+CONFIG_USB_FOTG210_UDC=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_GPIO_VBUS=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USER_NS=y
+CONFIG_USE_OF=y
+CONFIG_UTS_NS=y
+CONFIG_VGA_ARB=y
+CONFIG_VGA_ARB_MAX_GPUS=16
+CONFIG_VITESSE_PHY=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_WATCHDOG_CORE=y
+# CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set
+CONFIG_XZ_DEC_ARM=y
+CONFIG_XZ_DEC_ARMTHUMB=y
+CONFIG_XZ_DEC_BCJ=y
+CONFIG_XZ_DEC_IA64=y
+CONFIG_XZ_DEC_POWERPC=y
+CONFIG_XZ_DEC_SPARC=y
+CONFIG_XZ_DEC_X86=y
+CONFIG_ZBOOT_ROM_BSS=0
+CONFIG_ZBOOT_ROM_TEXT=0
+CONFIG_ZLIB_INFLATE=y
diff --git a/target/linux/gemini/generic/target.mk b/target/linux/gemini/generic/target.mk
new file mode 100644
index 00000000000000..f5cb1fb19b943f
--- /dev/null
+++ b/target/linux/gemini/generic/target.mk
@@ -0,0 +1 @@
+BOARDNAME:=Generic
diff --git a/target/linux/gemini/modules.mk b/target/linux/gemini/modules.mk
new file mode 100644
index 00000000000000..104ad902799e31
--- /dev/null
+++ b/target/linux/gemini/modules.mk
@@ -0,0 +1,14 @@
+define KernelPackage/usb-fotg210
+  TITLE:=Support for FOTG210 USB host and device controllers
+  DEPENDS:=@USB_SUPPORT @TARGET_gemini
+  KCONFIG:=CONFIG_USB_FOTG210 \
+	CONFIG_USB_FOTG210_HCD
+  FILES:=$(if $(CONFIG_USB_FOTG210_HCD),$(LINUX_DIR)/drivers/usb/host/fotg210-hcd.ko@lt6.1) \
+	$(if $(CONFIG_USB_FOTG210),$(LINUX_DIR)/drivers/usb/fotg210/fotg210.ko@ge6.1)
+  AUTOLOAD:=$(call AutoLoad,50, \
+	$(if $(CONFIG_USB_FOTG210_HCD),fotg210-hcd@lt6.1) \
+	$(if $(CONFIG_USB_FOTG210),fotg210@ge6.1),1)
+  $(call AddDepends/usb)
+endef
+
+$(eval $(call KernelPackage,usb-fotg210))
diff --git a/target/linux/gemini/patches-6.1/0001-usb-phy-phy-gpio-vbus-usb-Add-device-tree-probing.patch b/target/linux/gemini/patches-6.1/0001-usb-phy-phy-gpio-vbus-usb-Add-device-tree-probing.patch
new file mode 100644
index 00000000000000..943b166d7e38f4
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0001-usb-phy-phy-gpio-vbus-usb-Add-device-tree-probing.patch
@@ -0,0 +1,67 @@
+From d5a026cc8306ccd3e99e1455c87e38f8e6fa18df Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Mon, 7 Nov 2022 00:05:06 +0100
+Subject: [PATCH 01/29] usb: phy: phy-gpio-vbus-usb: Add device tree probing
+
+Make it possible to probe the GPIO VBUS detection driver
+from the device tree compatible for GPIO USB B connectors.
+
+Since this driver is using the "gpio-usb-b-connector"
+compatible, it is important to discern it from the role
+switch connector driver (which does not provide a phy),
+so we add some Kconfig text and depend on !USB_CONN_GPIO.
+
+Cc: Rob Herring <robh@kernel.org>
+Cc: Prashant Malani <pmalani@chromium.org>
+Cc: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20221106230506.1646101-1-linus.walleij@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/phy/Kconfig
++++ b/drivers/usb/phy/Kconfig
+@@ -93,12 +93,16 @@ config USB_GPIO_VBUS
+ 	tristate "GPIO based peripheral-only VBUS sensing 'transceiver'"
+ 	depends on GPIOLIB || COMPILE_TEST
+ 	depends on USB_GADGET || !USB_GADGET # if USB_GADGET=m, this can't be 'y'
++	depends on !USB_CONN_GPIO
+ 	select USB_PHY
+ 	help
+ 	  Provides simple GPIO VBUS sensing for controllers with an
+ 	  internal transceiver via the usb_phy interface, and
+ 	  optionally control of a D+ pullup GPIO as well as a VBUS
+-	  current limit regulator.
++	  current limit regulator. This driver is for devices that do
++	  NOT support role switch. OTG devices that can do role switch
++	  (master/peripheral) shall use the USB based connection
++	  detection driver USB_CONN_GPIO.
+ 
+ config OMAP_OTG
+ 	tristate "OMAP USB OTG controller driver"
+--- a/drivers/usb/phy/phy-gpio-vbus-usb.c
++++ b/drivers/usb/phy/phy-gpio-vbus-usb.c
+@@ -366,12 +366,24 @@ static const struct dev_pm_ops gpio_vbus
+ 
+ MODULE_ALIAS("platform:gpio-vbus");
+ 
++/*
++ * NOTE: this driver matches against "gpio-usb-b-connector" for
++ * devices that do NOT support role switch.
++ */
++static const struct of_device_id gpio_vbus_of_match[] = {
++	{
++		.compatible = "gpio-usb-b-connector",
++	},
++	{},
++};
++
+ static struct platform_driver gpio_vbus_driver = {
+ 	.driver = {
+ 		.name  = "gpio-vbus",
+ #ifdef CONFIG_PM
+ 		.pm = &gpio_vbus_dev_pm_ops,
+ #endif
++		.of_match_table = gpio_vbus_of_match,
+ 	},
+ 	.probe		= gpio_vbus_probe,
+ 	.remove		= gpio_vbus_remove,
diff --git a/target/linux/gemini/patches-6.1/0002-usb-fotg210-Collect-pieces-of-dual-mode-controller.patch b/target/linux/gemini/patches-6.1/0002-usb-fotg210-Collect-pieces-of-dual-mode-controller.patch
new file mode 100644
index 00000000000000..902bf4c68fe2d5
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0002-usb-fotg210-Collect-pieces-of-dual-mode-controller.patch
@@ -0,0 +1,15993 @@
+From 30367636930864f71b2bd462adedcf8484313864 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Sun, 23 Oct 2022 16:47:06 +0200
+Subject: [PATCH 02/29] usb: fotg210: Collect pieces of dual mode controller
+
+The Faraday FOTG210 is a dual-mode OTG USB controller that can
+act as host, peripheral or both. To be able to probe from one
+hardware description and to follow the pattern of other dual-
+mode controllers such as MUSB or MTU3 we need to collect the
+two, currently completely separate drivers in the same
+directory.
+
+After this, users need to select the main symbol USB_FOTG210
+and then each respective subdriver. We pave the road to
+compile both drivers into the same kernel and select the
+one we want to use at probe() time, and possibly add OTG
+support in the end.
+
+This patch doesn't do much more than create the new symbol
+and collect the drivers in one place. We also add a comment
+for the section of dual-mode controllers in the Kconfig
+file so people can see what these selections are about.
+
+Also add myself as maintainer as there has been little
+response on my patches to these drivers.
+
+Cc: Fabian Vogt <fabian@ritter-vogt.de>
+Cc: Yuan-Hsin Chen <yhchen@faraday-tech.com>
+Cc: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20221023144708.3596563-1-linus.walleij@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/Kconfig
++++ b/drivers/usb/Kconfig
+@@ -111,8 +111,12 @@ source "drivers/usb/usbip/Kconfig"
+ 
+ endif
+ 
++comment "USB dual-mode controller drivers"
++
+ source "drivers/usb/cdns3/Kconfig"
+ 
++source "drivers/usb/fotg210/Kconfig"
++
+ source "drivers/usb/mtu3/Kconfig"
+ 
+ source "drivers/usb/musb/Kconfig"
+--- a/drivers/usb/Makefile
++++ b/drivers/usb/Makefile
+@@ -17,6 +17,8 @@ obj-$(CONFIG_USB_CDNS_SUPPORT)	+= cdns3/
+ obj-$(CONFIG_USB_CDNS3)		+= cdns3/
+ obj-$(CONFIG_USB_CDNSP_PCI)	+= cdns3/
+ 
++obj-$(CONFIG_USB_FOTG210)	+= fotg210/
++
+ obj-$(CONFIG_USB_MON)		+= mon/
+ obj-$(CONFIG_USB_MTU3)		+= mtu3/
+ 
+--- /dev/null
++++ b/drivers/usb/fotg210/Kconfig
+@@ -0,0 +1,36 @@
++# SPDX-License-Identifier: GPL-2.0
++
++config USB_FOTG210
++	tristate "Faraday FOTG210 USB2 Dual Role controller"
++	depends on USB || USB_GADGET
++	depends on HAS_DMA && HAS_IOMEM
++	default ARCH_GEMINI
++	help
++	  Faraday FOTG210 is a dual-mode USB controller that can act
++	  in both host controller and peripheral controller mode.
++
++if USB_FOTG210
++
++config USB_FOTG210_HCD
++	tristate "Faraday FOTG210 USB Host Controller support"
++	depends on USB
++	help
++	  Faraday FOTG210 is an OTG controller which can be configured as
++	  an USB2.0 host. It is designed to meet USB2.0 EHCI specification
++	  with minor modification.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called fotg210-hcd.
++
++config USB_FOTG210_UDC
++	depends on USB_GADGET
++	tristate "Faraday FOTG210 USB Peripheral Controller support"
++	help
++	   Faraday USB2.0 OTG controller which can be configured as
++	   high speed or full speed USB device. This driver suppports
++	   Bulk Transfer so far.
++
++	   Say "y" to link the driver statically, or "m" to build a
++	   dynamically linked module called "fotg210-udc".
++
++endif
+--- /dev/null
++++ b/drivers/usb/fotg210/Makefile
+@@ -0,0 +1,3 @@
++# SPDX-License-Identifier: GPL-2.0
++obj-$(CONFIG_USB_FOTG210_HCD)	+= fotg210-hcd.o
++obj-$(CONFIG_USB_FOTG210_UDC)	+= fotg210-udc.o
+--- a/drivers/usb/host/fotg210-hcd.c
++++ /dev/null
+@@ -1,5727 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0+
+-/* Faraday FOTG210 EHCI-like driver
+- *
+- * Copyright (c) 2013 Faraday Technology Corporation
+- *
+- * Author: Yuan-Hsin Chen <yhchen@faraday-tech.com>
+- *	   Feng-Hsin Chiang <john453@faraday-tech.com>
+- *	   Po-Yu Chuang <ratbert.chuang@gmail.com>
+- *
+- * Most of code borrowed from the Linux-3.7 EHCI driver
+- */
+-#include <linux/module.h>
+-#include <linux/of.h>
+-#include <linux/device.h>
+-#include <linux/dmapool.h>
+-#include <linux/kernel.h>
+-#include <linux/delay.h>
+-#include <linux/ioport.h>
+-#include <linux/sched.h>
+-#include <linux/vmalloc.h>
+-#include <linux/errno.h>
+-#include <linux/init.h>
+-#include <linux/hrtimer.h>
+-#include <linux/list.h>
+-#include <linux/interrupt.h>
+-#include <linux/usb.h>
+-#include <linux/usb/hcd.h>
+-#include <linux/moduleparam.h>
+-#include <linux/dma-mapping.h>
+-#include <linux/debugfs.h>
+-#include <linux/slab.h>
+-#include <linux/uaccess.h>
+-#include <linux/platform_device.h>
+-#include <linux/io.h>
+-#include <linux/iopoll.h>
+-#include <linux/clk.h>
+-
+-#include <asm/byteorder.h>
+-#include <asm/irq.h>
+-#include <asm/unaligned.h>
+-
+-#define DRIVER_AUTHOR "Yuan-Hsin Chen"
+-#define DRIVER_DESC "FOTG210 Host Controller (EHCI) Driver"
+-static const char hcd_name[] = "fotg210_hcd";
+-
+-#undef FOTG210_URB_TRACE
+-#define FOTG210_STATS
+-
+-/* magic numbers that can affect system performance */
+-#define FOTG210_TUNE_CERR	3 /* 0-3 qtd retries; 0 == don't stop */
+-#define FOTG210_TUNE_RL_HS	4 /* nak throttle; see 4.9 */
+-#define FOTG210_TUNE_RL_TT	0
+-#define FOTG210_TUNE_MULT_HS	1 /* 1-3 transactions/uframe; 4.10.3 */
+-#define FOTG210_TUNE_MULT_TT	1
+-
+-/* Some drivers think it's safe to schedule isochronous transfers more than 256
+- * ms into the future (partly as a result of an old bug in the scheduling
+- * code).  In an attempt to avoid trouble, we will use a minimum scheduling
+- * length of 512 frames instead of 256.
+- */
+-#define FOTG210_TUNE_FLS 1 /* (medium) 512-frame schedule */
+-
+-/* Initial IRQ latency:  faster than hw default */
+-static int log2_irq_thresh; /* 0 to 6 */
+-module_param(log2_irq_thresh, int, S_IRUGO);
+-MODULE_PARM_DESC(log2_irq_thresh, "log2 IRQ latency, 1-64 microframes");
+-
+-/* initial park setting:  slower than hw default */
+-static unsigned park;
+-module_param(park, uint, S_IRUGO);
+-MODULE_PARM_DESC(park, "park setting; 1-3 back-to-back async packets");
+-
+-/* for link power management(LPM) feature */
+-static unsigned int hird;
+-module_param(hird, int, S_IRUGO);
+-MODULE_PARM_DESC(hird, "host initiated resume duration, +1 for each 75us");
+-
+-#define INTR_MASK (STS_IAA | STS_FATAL | STS_PCD | STS_ERR | STS_INT)
+-
+-#include "fotg210.h"
+-
+-#define fotg210_dbg(fotg210, fmt, args...) \
+-	dev_dbg(fotg210_to_hcd(fotg210)->self.controller, fmt, ## args)
+-#define fotg210_err(fotg210, fmt, args...) \
+-	dev_err(fotg210_to_hcd(fotg210)->self.controller, fmt, ## args)
+-#define fotg210_info(fotg210, fmt, args...) \
+-	dev_info(fotg210_to_hcd(fotg210)->self.controller, fmt, ## args)
+-#define fotg210_warn(fotg210, fmt, args...) \
+-	dev_warn(fotg210_to_hcd(fotg210)->self.controller, fmt, ## args)
+-
+-/* check the values in the HCSPARAMS register (host controller _Structural_
+- * parameters) see EHCI spec, Table 2-4 for each value
+- */
+-static void dbg_hcs_params(struct fotg210_hcd *fotg210, char *label)
+-{
+-	u32 params = fotg210_readl(fotg210, &fotg210->caps->hcs_params);
+-
+-	fotg210_dbg(fotg210, "%s hcs_params 0x%x ports=%d\n", label, params,
+-			HCS_N_PORTS(params));
+-}
+-
+-/* check the values in the HCCPARAMS register (host controller _Capability_
+- * parameters) see EHCI Spec, Table 2-5 for each value
+- */
+-static void dbg_hcc_params(struct fotg210_hcd *fotg210, char *label)
+-{
+-	u32 params = fotg210_readl(fotg210, &fotg210->caps->hcc_params);
+-
+-	fotg210_dbg(fotg210, "%s hcc_params %04x uframes %s%s\n", label,
+-			params,
+-			HCC_PGM_FRAMELISTLEN(params) ? "256/512/1024" : "1024",
+-			HCC_CANPARK(params) ? " park" : "");
+-}
+-
+-static void __maybe_unused
+-dbg_qtd(const char *label, struct fotg210_hcd *fotg210, struct fotg210_qtd *qtd)
+-{
+-	fotg210_dbg(fotg210, "%s td %p n%08x %08x t%08x p0=%08x\n", label, qtd,
+-			hc32_to_cpup(fotg210, &qtd->hw_next),
+-			hc32_to_cpup(fotg210, &qtd->hw_alt_next),
+-			hc32_to_cpup(fotg210, &qtd->hw_token),
+-			hc32_to_cpup(fotg210, &qtd->hw_buf[0]));
+-	if (qtd->hw_buf[1])
+-		fotg210_dbg(fotg210, "  p1=%08x p2=%08x p3=%08x p4=%08x\n",
+-				hc32_to_cpup(fotg210, &qtd->hw_buf[1]),
+-				hc32_to_cpup(fotg210, &qtd->hw_buf[2]),
+-				hc32_to_cpup(fotg210, &qtd->hw_buf[3]),
+-				hc32_to_cpup(fotg210, &qtd->hw_buf[4]));
+-}
+-
+-static void __maybe_unused
+-dbg_qh(const char *label, struct fotg210_hcd *fotg210, struct fotg210_qh *qh)
+-{
+-	struct fotg210_qh_hw *hw = qh->hw;
+-
+-	fotg210_dbg(fotg210, "%s qh %p n%08x info %x %x qtd %x\n", label, qh,
+-			hw->hw_next, hw->hw_info1, hw->hw_info2,
+-			hw->hw_current);
+-
+-	dbg_qtd("overlay", fotg210, (struct fotg210_qtd *) &hw->hw_qtd_next);
+-}
+-
+-static void __maybe_unused
+-dbg_itd(const char *label, struct fotg210_hcd *fotg210, struct fotg210_itd *itd)
+-{
+-	fotg210_dbg(fotg210, "%s[%d] itd %p, next %08x, urb %p\n", label,
+-			itd->frame, itd, hc32_to_cpu(fotg210, itd->hw_next),
+-			itd->urb);
+-
+-	fotg210_dbg(fotg210,
+-			"  trans: %08x %08x %08x %08x %08x %08x %08x %08x\n",
+-			hc32_to_cpu(fotg210, itd->hw_transaction[0]),
+-			hc32_to_cpu(fotg210, itd->hw_transaction[1]),
+-			hc32_to_cpu(fotg210, itd->hw_transaction[2]),
+-			hc32_to_cpu(fotg210, itd->hw_transaction[3]),
+-			hc32_to_cpu(fotg210, itd->hw_transaction[4]),
+-			hc32_to_cpu(fotg210, itd->hw_transaction[5]),
+-			hc32_to_cpu(fotg210, itd->hw_transaction[6]),
+-			hc32_to_cpu(fotg210, itd->hw_transaction[7]));
+-
+-	fotg210_dbg(fotg210,
+-			"  buf:   %08x %08x %08x %08x %08x %08x %08x\n",
+-			hc32_to_cpu(fotg210, itd->hw_bufp[0]),
+-			hc32_to_cpu(fotg210, itd->hw_bufp[1]),
+-			hc32_to_cpu(fotg210, itd->hw_bufp[2]),
+-			hc32_to_cpu(fotg210, itd->hw_bufp[3]),
+-			hc32_to_cpu(fotg210, itd->hw_bufp[4]),
+-			hc32_to_cpu(fotg210, itd->hw_bufp[5]),
+-			hc32_to_cpu(fotg210, itd->hw_bufp[6]));
+-
+-	fotg210_dbg(fotg210, "  index: %d %d %d %d %d %d %d %d\n",
+-			itd->index[0], itd->index[1], itd->index[2],
+-			itd->index[3], itd->index[4], itd->index[5],
+-			itd->index[6], itd->index[7]);
+-}
+-
+-static int __maybe_unused
+-dbg_status_buf(char *buf, unsigned len, const char *label, u32 status)
+-{
+-	return scnprintf(buf, len, "%s%sstatus %04x%s%s%s%s%s%s%s%s%s%s",
+-			label, label[0] ? " " : "", status,
+-			(status & STS_ASS) ? " Async" : "",
+-			(status & STS_PSS) ? " Periodic" : "",
+-			(status & STS_RECL) ? " Recl" : "",
+-			(status & STS_HALT) ? " Halt" : "",
+-			(status & STS_IAA) ? " IAA" : "",
+-			(status & STS_FATAL) ? " FATAL" : "",
+-			(status & STS_FLR) ? " FLR" : "",
+-			(status & STS_PCD) ? " PCD" : "",
+-			(status & STS_ERR) ? " ERR" : "",
+-			(status & STS_INT) ? " INT" : "");
+-}
+-
+-static int __maybe_unused
+-dbg_intr_buf(char *buf, unsigned len, const char *label, u32 enable)
+-{
+-	return scnprintf(buf, len, "%s%sintrenable %02x%s%s%s%s%s%s",
+-			label, label[0] ? " " : "", enable,
+-			(enable & STS_IAA) ? " IAA" : "",
+-			(enable & STS_FATAL) ? " FATAL" : "",
+-			(enable & STS_FLR) ? " FLR" : "",
+-			(enable & STS_PCD) ? " PCD" : "",
+-			(enable & STS_ERR) ? " ERR" : "",
+-			(enable & STS_INT) ? " INT" : "");
+-}
+-
+-static const char *const fls_strings[] = { "1024", "512", "256", "??" };
+-
+-static int dbg_command_buf(char *buf, unsigned len, const char *label,
+-		u32 command)
+-{
+-	return scnprintf(buf, len,
+-			"%s%scommand %07x %s=%d ithresh=%d%s%s%s period=%s%s %s",
+-			label, label[0] ? " " : "", command,
+-			(command & CMD_PARK) ? " park" : "(park)",
+-			CMD_PARK_CNT(command),
+-			(command >> 16) & 0x3f,
+-			(command & CMD_IAAD) ? " IAAD" : "",
+-			(command & CMD_ASE) ? " Async" : "",
+-			(command & CMD_PSE) ? " Periodic" : "",
+-			fls_strings[(command >> 2) & 0x3],
+-			(command & CMD_RESET) ? " Reset" : "",
+-			(command & CMD_RUN) ? "RUN" : "HALT");
+-}
+-
+-static char *dbg_port_buf(char *buf, unsigned len, const char *label, int port,
+-		u32 status)
+-{
+-	char *sig;
+-
+-	/* signaling state */
+-	switch (status & (3 << 10)) {
+-	case 0 << 10:
+-		sig = "se0";
+-		break;
+-	case 1 << 10:
+-		sig = "k";
+-		break; /* low speed */
+-	case 2 << 10:
+-		sig = "j";
+-		break;
+-	default:
+-		sig = "?";
+-		break;
+-	}
+-
+-	scnprintf(buf, len, "%s%sport:%d status %06x %d sig=%s%s%s%s%s%s%s%s",
+-			label, label[0] ? " " : "", port, status,
+-			status >> 25, /*device address */
+-			sig,
+-			(status & PORT_RESET) ? " RESET" : "",
+-			(status & PORT_SUSPEND) ? " SUSPEND" : "",
+-			(status & PORT_RESUME) ? " RESUME" : "",
+-			(status & PORT_PEC) ? " PEC" : "",
+-			(status & PORT_PE) ? " PE" : "",
+-			(status & PORT_CSC) ? " CSC" : "",
+-			(status & PORT_CONNECT) ? " CONNECT" : "");
+-
+-	return buf;
+-}
+-
+-/* functions have the "wrong" filename when they're output... */
+-#define dbg_status(fotg210, label, status) {			\
+-	char _buf[80];						\
+-	dbg_status_buf(_buf, sizeof(_buf), label, status);	\
+-	fotg210_dbg(fotg210, "%s\n", _buf);			\
+-}
+-
+-#define dbg_cmd(fotg210, label, command) {			\
+-	char _buf[80];						\
+-	dbg_command_buf(_buf, sizeof(_buf), label, command);	\
+-	fotg210_dbg(fotg210, "%s\n", _buf);			\
+-}
+-
+-#define dbg_port(fotg210, label, port, status) {			       \
+-	char _buf[80];							       \
+-	fotg210_dbg(fotg210, "%s\n",					       \
+-			dbg_port_buf(_buf, sizeof(_buf), label, port, status));\
+-}
+-
+-/* troubleshooting help: expose state in debugfs */
+-static int debug_async_open(struct inode *, struct file *);
+-static int debug_periodic_open(struct inode *, struct file *);
+-static int debug_registers_open(struct inode *, struct file *);
+-static int debug_async_open(struct inode *, struct file *);
+-
+-static ssize_t debug_output(struct file*, char __user*, size_t, loff_t*);
+-static int debug_close(struct inode *, struct file *);
+-
+-static const struct file_operations debug_async_fops = {
+-	.owner		= THIS_MODULE,
+-	.open		= debug_async_open,
+-	.read		= debug_output,
+-	.release	= debug_close,
+-	.llseek		= default_llseek,
+-};
+-static const struct file_operations debug_periodic_fops = {
+-	.owner		= THIS_MODULE,
+-	.open		= debug_periodic_open,
+-	.read		= debug_output,
+-	.release	= debug_close,
+-	.llseek		= default_llseek,
+-};
+-static const struct file_operations debug_registers_fops = {
+-	.owner		= THIS_MODULE,
+-	.open		= debug_registers_open,
+-	.read		= debug_output,
+-	.release	= debug_close,
+-	.llseek		= default_llseek,
+-};
+-
+-static struct dentry *fotg210_debug_root;
+-
+-struct debug_buffer {
+-	ssize_t (*fill_func)(struct debug_buffer *);	/* fill method */
+-	struct usb_bus *bus;
+-	struct mutex mutex;	/* protect filling of buffer */
+-	size_t count;		/* number of characters filled into buffer */
+-	char *output_buf;
+-	size_t alloc_size;
+-};
+-
+-static inline char speed_char(u32 scratch)
+-{
+-	switch (scratch & (3 << 12)) {
+-	case QH_FULL_SPEED:
+-		return 'f';
+-
+-	case QH_LOW_SPEED:
+-		return 'l';
+-
+-	case QH_HIGH_SPEED:
+-		return 'h';
+-
+-	default:
+-		return '?';
+-	}
+-}
+-
+-static inline char token_mark(struct fotg210_hcd *fotg210, __hc32 token)
+-{
+-	__u32 v = hc32_to_cpu(fotg210, token);
+-
+-	if (v & QTD_STS_ACTIVE)
+-		return '*';
+-	if (v & QTD_STS_HALT)
+-		return '-';
+-	if (!IS_SHORT_READ(v))
+-		return ' ';
+-	/* tries to advance through hw_alt_next */
+-	return '/';
+-}
+-
+-static void qh_lines(struct fotg210_hcd *fotg210, struct fotg210_qh *qh,
+-		char **nextp, unsigned *sizep)
+-{
+-	u32 scratch;
+-	u32 hw_curr;
+-	struct fotg210_qtd *td;
+-	unsigned temp;
+-	unsigned size = *sizep;
+-	char *next = *nextp;
+-	char mark;
+-	__le32 list_end = FOTG210_LIST_END(fotg210);
+-	struct fotg210_qh_hw *hw = qh->hw;
+-
+-	if (hw->hw_qtd_next == list_end) /* NEC does this */
+-		mark = '@';
+-	else
+-		mark = token_mark(fotg210, hw->hw_token);
+-	if (mark == '/') { /* qh_alt_next controls qh advance? */
+-		if ((hw->hw_alt_next & QTD_MASK(fotg210)) ==
+-		    fotg210->async->hw->hw_alt_next)
+-			mark = '#'; /* blocked */
+-		else if (hw->hw_alt_next == list_end)
+-			mark = '.'; /* use hw_qtd_next */
+-		/* else alt_next points to some other qtd */
+-	}
+-	scratch = hc32_to_cpup(fotg210, &hw->hw_info1);
+-	hw_curr = (mark == '*') ? hc32_to_cpup(fotg210, &hw->hw_current) : 0;
+-	temp = scnprintf(next, size,
+-			"qh/%p dev%d %cs ep%d %08x %08x(%08x%c %s nak%d)",
+-			qh, scratch & 0x007f,
+-			speed_char(scratch),
+-			(scratch >> 8) & 0x000f,
+-			scratch, hc32_to_cpup(fotg210, &hw->hw_info2),
+-			hc32_to_cpup(fotg210, &hw->hw_token), mark,
+-			(cpu_to_hc32(fotg210, QTD_TOGGLE) & hw->hw_token)
+-				? "data1" : "data0",
+-			(hc32_to_cpup(fotg210, &hw->hw_alt_next) >> 1) & 0x0f);
+-	size -= temp;
+-	next += temp;
+-
+-	/* hc may be modifying the list as we read it ... */
+-	list_for_each_entry(td, &qh->qtd_list, qtd_list) {
+-		scratch = hc32_to_cpup(fotg210, &td->hw_token);
+-		mark = ' ';
+-		if (hw_curr == td->qtd_dma)
+-			mark = '*';
+-		else if (hw->hw_qtd_next == cpu_to_hc32(fotg210, td->qtd_dma))
+-			mark = '+';
+-		else if (QTD_LENGTH(scratch)) {
+-			if (td->hw_alt_next == fotg210->async->hw->hw_alt_next)
+-				mark = '#';
+-			else if (td->hw_alt_next != list_end)
+-				mark = '/';
+-		}
+-		temp = snprintf(next, size,
+-				"\n\t%p%c%s len=%d %08x urb %p",
+-				td, mark, ({ char *tmp;
+-				switch ((scratch>>8)&0x03) {
+-				case 0:
+-					tmp = "out";
+-					break;
+-				case 1:
+-					tmp = "in";
+-					break;
+-				case 2:
+-					tmp = "setup";
+-					break;
+-				default:
+-					tmp = "?";
+-					break;
+-				 } tmp; }),
+-				(scratch >> 16) & 0x7fff,
+-				scratch,
+-				td->urb);
+-		if (size < temp)
+-			temp = size;
+-		size -= temp;
+-		next += temp;
+-		if (temp == size)
+-			goto done;
+-	}
+-
+-	temp = snprintf(next, size, "\n");
+-	if (size < temp)
+-		temp = size;
+-
+-	size -= temp;
+-	next += temp;
+-
+-done:
+-	*sizep = size;
+-	*nextp = next;
+-}
+-
+-static ssize_t fill_async_buffer(struct debug_buffer *buf)
+-{
+-	struct usb_hcd *hcd;
+-	struct fotg210_hcd *fotg210;
+-	unsigned long flags;
+-	unsigned temp, size;
+-	char *next;
+-	struct fotg210_qh *qh;
+-
+-	hcd = bus_to_hcd(buf->bus);
+-	fotg210 = hcd_to_fotg210(hcd);
+-	next = buf->output_buf;
+-	size = buf->alloc_size;
+-
+-	*next = 0;
+-
+-	/* dumps a snapshot of the async schedule.
+-	 * usually empty except for long-term bulk reads, or head.
+-	 * one QH per line, and TDs we know about
+-	 */
+-	spin_lock_irqsave(&fotg210->lock, flags);
+-	for (qh = fotg210->async->qh_next.qh; size > 0 && qh;
+-			qh = qh->qh_next.qh)
+-		qh_lines(fotg210, qh, &next, &size);
+-	if (fotg210->async_unlink && size > 0) {
+-		temp = scnprintf(next, size, "\nunlink =\n");
+-		size -= temp;
+-		next += temp;
+-
+-		for (qh = fotg210->async_unlink; size > 0 && qh;
+-				qh = qh->unlink_next)
+-			qh_lines(fotg210, qh, &next, &size);
+-	}
+-	spin_unlock_irqrestore(&fotg210->lock, flags);
+-
+-	return strlen(buf->output_buf);
+-}
+-
+-/* count tds, get ep direction */
+-static unsigned output_buf_tds_dir(char *buf, struct fotg210_hcd *fotg210,
+-		struct fotg210_qh_hw *hw, struct fotg210_qh *qh, unsigned size)
+-{
+-	u32 scratch = hc32_to_cpup(fotg210, &hw->hw_info1);
+-	struct fotg210_qtd *qtd;
+-	char *type = "";
+-	unsigned temp = 0;
+-
+-	/* count tds, get ep direction */
+-	list_for_each_entry(qtd, &qh->qtd_list, qtd_list) {
+-		temp++;
+-		switch ((hc32_to_cpu(fotg210, qtd->hw_token) >> 8) & 0x03) {
+-		case 0:
+-			type = "out";
+-			continue;
+-		case 1:
+-			type = "in";
+-			continue;
+-		}
+-	}
+-
+-	return scnprintf(buf, size, "(%c%d ep%d%s [%d/%d] q%d p%d)",
+-			speed_char(scratch), scratch & 0x007f,
+-			(scratch >> 8) & 0x000f, type, qh->usecs,
+-			qh->c_usecs, temp, (scratch >> 16) & 0x7ff);
+-}
+-
+-#define DBG_SCHED_LIMIT 64
+-static ssize_t fill_periodic_buffer(struct debug_buffer *buf)
+-{
+-	struct usb_hcd *hcd;
+-	struct fotg210_hcd *fotg210;
+-	unsigned long flags;
+-	union fotg210_shadow p, *seen;
+-	unsigned temp, size, seen_count;
+-	char *next;
+-	unsigned i;
+-	__hc32 tag;
+-
+-	seen = kmalloc_array(DBG_SCHED_LIMIT, sizeof(*seen), GFP_ATOMIC);
+-	if (!seen)
+-		return 0;
+-
+-	seen_count = 0;
+-
+-	hcd = bus_to_hcd(buf->bus);
+-	fotg210 = hcd_to_fotg210(hcd);
+-	next = buf->output_buf;
+-	size = buf->alloc_size;
+-
+-	temp = scnprintf(next, size, "size = %d\n", fotg210->periodic_size);
+-	size -= temp;
+-	next += temp;
+-
+-	/* dump a snapshot of the periodic schedule.
+-	 * iso changes, interrupt usually doesn't.
+-	 */
+-	spin_lock_irqsave(&fotg210->lock, flags);
+-	for (i = 0; i < fotg210->periodic_size; i++) {
+-		p = fotg210->pshadow[i];
+-		if (likely(!p.ptr))
+-			continue;
+-
+-		tag = Q_NEXT_TYPE(fotg210, fotg210->periodic[i]);
+-
+-		temp = scnprintf(next, size, "%4d: ", i);
+-		size -= temp;
+-		next += temp;
+-
+-		do {
+-			struct fotg210_qh_hw *hw;
+-
+-			switch (hc32_to_cpu(fotg210, tag)) {
+-			case Q_TYPE_QH:
+-				hw = p.qh->hw;
+-				temp = scnprintf(next, size, " qh%d-%04x/%p",
+-						p.qh->period,
+-						hc32_to_cpup(fotg210,
+-							&hw->hw_info2)
+-							/* uframe masks */
+-							& (QH_CMASK | QH_SMASK),
+-						p.qh);
+-				size -= temp;
+-				next += temp;
+-				/* don't repeat what follows this qh */
+-				for (temp = 0; temp < seen_count; temp++) {
+-					if (seen[temp].ptr != p.ptr)
+-						continue;
+-					if (p.qh->qh_next.ptr) {
+-						temp = scnprintf(next, size,
+-								" ...");
+-						size -= temp;
+-						next += temp;
+-					}
+-					break;
+-				}
+-				/* show more info the first time around */
+-				if (temp == seen_count) {
+-					temp = output_buf_tds_dir(next,
+-							fotg210, hw,
+-							p.qh, size);
+-
+-					if (seen_count < DBG_SCHED_LIMIT)
+-						seen[seen_count++].qh = p.qh;
+-				} else
+-					temp = 0;
+-				tag = Q_NEXT_TYPE(fotg210, hw->hw_next);
+-				p = p.qh->qh_next;
+-				break;
+-			case Q_TYPE_FSTN:
+-				temp = scnprintf(next, size,
+-						" fstn-%8x/%p",
+-						p.fstn->hw_prev, p.fstn);
+-				tag = Q_NEXT_TYPE(fotg210, p.fstn->hw_next);
+-				p = p.fstn->fstn_next;
+-				break;
+-			case Q_TYPE_ITD:
+-				temp = scnprintf(next, size,
+-						" itd/%p", p.itd);
+-				tag = Q_NEXT_TYPE(fotg210, p.itd->hw_next);
+-				p = p.itd->itd_next;
+-				break;
+-			}
+-			size -= temp;
+-			next += temp;
+-		} while (p.ptr);
+-
+-		temp = scnprintf(next, size, "\n");
+-		size -= temp;
+-		next += temp;
+-	}
+-	spin_unlock_irqrestore(&fotg210->lock, flags);
+-	kfree(seen);
+-
+-	return buf->alloc_size - size;
+-}
+-#undef DBG_SCHED_LIMIT
+-
+-static const char *rh_state_string(struct fotg210_hcd *fotg210)
+-{
+-	switch (fotg210->rh_state) {
+-	case FOTG210_RH_HALTED:
+-		return "halted";
+-	case FOTG210_RH_SUSPENDED:
+-		return "suspended";
+-	case FOTG210_RH_RUNNING:
+-		return "running";
+-	case FOTG210_RH_STOPPING:
+-		return "stopping";
+-	}
+-	return "?";
+-}
+-
+-static ssize_t fill_registers_buffer(struct debug_buffer *buf)
+-{
+-	struct usb_hcd *hcd;
+-	struct fotg210_hcd *fotg210;
+-	unsigned long flags;
+-	unsigned temp, size, i;
+-	char *next, scratch[80];
+-	static const char fmt[] = "%*s\n";
+-	static const char label[] = "";
+-
+-	hcd = bus_to_hcd(buf->bus);
+-	fotg210 = hcd_to_fotg210(hcd);
+-	next = buf->output_buf;
+-	size = buf->alloc_size;
+-
+-	spin_lock_irqsave(&fotg210->lock, flags);
+-
+-	if (!HCD_HW_ACCESSIBLE(hcd)) {
+-		size = scnprintf(next, size,
+-				"bus %s, device %s\n"
+-				"%s\n"
+-				"SUSPENDED(no register access)\n",
+-				hcd->self.controller->bus->name,
+-				dev_name(hcd->self.controller),
+-				hcd->product_desc);
+-		goto done;
+-	}
+-
+-	/* Capability Registers */
+-	i = HC_VERSION(fotg210, fotg210_readl(fotg210,
+-			&fotg210->caps->hc_capbase));
+-	temp = scnprintf(next, size,
+-			"bus %s, device %s\n"
+-			"%s\n"
+-			"EHCI %x.%02x, rh state %s\n",
+-			hcd->self.controller->bus->name,
+-			dev_name(hcd->self.controller),
+-			hcd->product_desc,
+-			i >> 8, i & 0x0ff, rh_state_string(fotg210));
+-	size -= temp;
+-	next += temp;
+-
+-	/* FIXME interpret both types of params */
+-	i = fotg210_readl(fotg210, &fotg210->caps->hcs_params);
+-	temp = scnprintf(next, size, "structural params 0x%08x\n", i);
+-	size -= temp;
+-	next += temp;
+-
+-	i = fotg210_readl(fotg210, &fotg210->caps->hcc_params);
+-	temp = scnprintf(next, size, "capability params 0x%08x\n", i);
+-	size -= temp;
+-	next += temp;
+-
+-	/* Operational Registers */
+-	temp = dbg_status_buf(scratch, sizeof(scratch), label,
+-			fotg210_readl(fotg210, &fotg210->regs->status));
+-	temp = scnprintf(next, size, fmt, temp, scratch);
+-	size -= temp;
+-	next += temp;
+-
+-	temp = dbg_command_buf(scratch, sizeof(scratch), label,
+-			fotg210_readl(fotg210, &fotg210->regs->command));
+-	temp = scnprintf(next, size, fmt, temp, scratch);
+-	size -= temp;
+-	next += temp;
+-
+-	temp = dbg_intr_buf(scratch, sizeof(scratch), label,
+-			fotg210_readl(fotg210, &fotg210->regs->intr_enable));
+-	temp = scnprintf(next, size, fmt, temp, scratch);
+-	size -= temp;
+-	next += temp;
+-
+-	temp = scnprintf(next, size, "uframe %04x\n",
+-			fotg210_read_frame_index(fotg210));
+-	size -= temp;
+-	next += temp;
+-
+-	if (fotg210->async_unlink) {
+-		temp = scnprintf(next, size, "async unlink qh %p\n",
+-				fotg210->async_unlink);
+-		size -= temp;
+-		next += temp;
+-	}
+-
+-#ifdef FOTG210_STATS
+-	temp = scnprintf(next, size,
+-			"irq normal %ld err %ld iaa %ld(lost %ld)\n",
+-			fotg210->stats.normal, fotg210->stats.error,
+-			fotg210->stats.iaa, fotg210->stats.lost_iaa);
+-	size -= temp;
+-	next += temp;
+-
+-	temp = scnprintf(next, size, "complete %ld unlink %ld\n",
+-			fotg210->stats.complete, fotg210->stats.unlink);
+-	size -= temp;
+-	next += temp;
+-#endif
+-
+-done:
+-	spin_unlock_irqrestore(&fotg210->lock, flags);
+-
+-	return buf->alloc_size - size;
+-}
+-
+-static struct debug_buffer
+-*alloc_buffer(struct usb_bus *bus, ssize_t (*fill_func)(struct debug_buffer *))
+-{
+-	struct debug_buffer *buf;
+-
+-	buf = kzalloc(sizeof(struct debug_buffer), GFP_KERNEL);
+-
+-	if (buf) {
+-		buf->bus = bus;
+-		buf->fill_func = fill_func;
+-		mutex_init(&buf->mutex);
+-		buf->alloc_size = PAGE_SIZE;
+-	}
+-
+-	return buf;
+-}
+-
+-static int fill_buffer(struct debug_buffer *buf)
+-{
+-	int ret = 0;
+-
+-	if (!buf->output_buf)
+-		buf->output_buf = vmalloc(buf->alloc_size);
+-
+-	if (!buf->output_buf) {
+-		ret = -ENOMEM;
+-		goto out;
+-	}
+-
+-	ret = buf->fill_func(buf);
+-
+-	if (ret >= 0) {
+-		buf->count = ret;
+-		ret = 0;
+-	}
+-
+-out:
+-	return ret;
+-}
+-
+-static ssize_t debug_output(struct file *file, char __user *user_buf,
+-		size_t len, loff_t *offset)
+-{
+-	struct debug_buffer *buf = file->private_data;
+-	int ret = 0;
+-
+-	mutex_lock(&buf->mutex);
+-	if (buf->count == 0) {
+-		ret = fill_buffer(buf);
+-		if (ret != 0) {
+-			mutex_unlock(&buf->mutex);
+-			goto out;
+-		}
+-	}
+-	mutex_unlock(&buf->mutex);
+-
+-	ret = simple_read_from_buffer(user_buf, len, offset,
+-			buf->output_buf, buf->count);
+-
+-out:
+-	return ret;
+-
+-}
+-
+-static int debug_close(struct inode *inode, struct file *file)
+-{
+-	struct debug_buffer *buf = file->private_data;
+-
+-	if (buf) {
+-		vfree(buf->output_buf);
+-		kfree(buf);
+-	}
+-
+-	return 0;
+-}
+-static int debug_async_open(struct inode *inode, struct file *file)
+-{
+-	file->private_data = alloc_buffer(inode->i_private, fill_async_buffer);
+-
+-	return file->private_data ? 0 : -ENOMEM;
+-}
+-
+-static int debug_periodic_open(struct inode *inode, struct file *file)
+-{
+-	struct debug_buffer *buf;
+-
+-	buf = alloc_buffer(inode->i_private, fill_periodic_buffer);
+-	if (!buf)
+-		return -ENOMEM;
+-
+-	buf->alloc_size = (sizeof(void *) == 4 ? 6 : 8)*PAGE_SIZE;
+-	file->private_data = buf;
+-	return 0;
+-}
+-
+-static int debug_registers_open(struct inode *inode, struct file *file)
+-{
+-	file->private_data = alloc_buffer(inode->i_private,
+-			fill_registers_buffer);
+-
+-	return file->private_data ? 0 : -ENOMEM;
+-}
+-
+-static inline void create_debug_files(struct fotg210_hcd *fotg210)
+-{
+-	struct usb_bus *bus = &fotg210_to_hcd(fotg210)->self;
+-	struct dentry *root;
+-
+-	root = debugfs_create_dir(bus->bus_name, fotg210_debug_root);
+-
+-	debugfs_create_file("async", S_IRUGO, root, bus, &debug_async_fops);
+-	debugfs_create_file("periodic", S_IRUGO, root, bus,
+-			    &debug_periodic_fops);
+-	debugfs_create_file("registers", S_IRUGO, root, bus,
+-			    &debug_registers_fops);
+-}
+-
+-static inline void remove_debug_files(struct fotg210_hcd *fotg210)
+-{
+-	struct usb_bus *bus = &fotg210_to_hcd(fotg210)->self;
+-
+-	debugfs_lookup_and_remove(bus->bus_name, fotg210_debug_root);
+-}
+-
+-/* handshake - spin reading hc until handshake completes or fails
+- * @ptr: address of hc register to be read
+- * @mask: bits to look at in result of read
+- * @done: value of those bits when handshake succeeds
+- * @usec: timeout in microseconds
+- *
+- * Returns negative errno, or zero on success
+- *
+- * Success happens when the "mask" bits have the specified value (hardware
+- * handshake done).  There are two failure modes:  "usec" have passed (major
+- * hardware flakeout), or the register reads as all-ones (hardware removed).
+- *
+- * That last failure should_only happen in cases like physical cardbus eject
+- * before driver shutdown. But it also seems to be caused by bugs in cardbus
+- * bridge shutdown:  shutting down the bridge before the devices using it.
+- */
+-static int handshake(struct fotg210_hcd *fotg210, void __iomem *ptr,
+-		u32 mask, u32 done, int usec)
+-{
+-	u32 result;
+-	int ret;
+-
+-	ret = readl_poll_timeout_atomic(ptr, result,
+-					((result & mask) == done ||
+-					 result == U32_MAX), 1, usec);
+-	if (result == U32_MAX)		/* card removed */
+-		return -ENODEV;
+-
+-	return ret;
+-}
+-
+-/* Force HC to halt state from unknown (EHCI spec section 2.3).
+- * Must be called with interrupts enabled and the lock not held.
+- */
+-static int fotg210_halt(struct fotg210_hcd *fotg210)
+-{
+-	u32 temp;
+-
+-	spin_lock_irq(&fotg210->lock);
+-
+-	/* disable any irqs left enabled by previous code */
+-	fotg210_writel(fotg210, 0, &fotg210->regs->intr_enable);
+-
+-	/*
+-	 * This routine gets called during probe before fotg210->command
+-	 * has been initialized, so we can't rely on its value.
+-	 */
+-	fotg210->command &= ~CMD_RUN;
+-	temp = fotg210_readl(fotg210, &fotg210->regs->command);
+-	temp &= ~(CMD_RUN | CMD_IAAD);
+-	fotg210_writel(fotg210, temp, &fotg210->regs->command);
+-
+-	spin_unlock_irq(&fotg210->lock);
+-	synchronize_irq(fotg210_to_hcd(fotg210)->irq);
+-
+-	return handshake(fotg210, &fotg210->regs->status,
+-			STS_HALT, STS_HALT, 16 * 125);
+-}
+-
+-/* Reset a non-running (STS_HALT == 1) controller.
+- * Must be called with interrupts enabled and the lock not held.
+- */
+-static int fotg210_reset(struct fotg210_hcd *fotg210)
+-{
+-	int retval;
+-	u32 command = fotg210_readl(fotg210, &fotg210->regs->command);
+-
+-	/* If the EHCI debug controller is active, special care must be
+-	 * taken before and after a host controller reset
+-	 */
+-	if (fotg210->debug && !dbgp_reset_prep(fotg210_to_hcd(fotg210)))
+-		fotg210->debug = NULL;
+-
+-	command |= CMD_RESET;
+-	dbg_cmd(fotg210, "reset", command);
+-	fotg210_writel(fotg210, command, &fotg210->regs->command);
+-	fotg210->rh_state = FOTG210_RH_HALTED;
+-	fotg210->next_statechange = jiffies;
+-	retval = handshake(fotg210, &fotg210->regs->command,
+-			CMD_RESET, 0, 250 * 1000);
+-
+-	if (retval)
+-		return retval;
+-
+-	if (fotg210->debug)
+-		dbgp_external_startup(fotg210_to_hcd(fotg210));
+-
+-	fotg210->port_c_suspend = fotg210->suspended_ports =
+-			fotg210->resuming_ports = 0;
+-	return retval;
+-}
+-
+-/* Idle the controller (turn off the schedules).
+- * Must be called with interrupts enabled and the lock not held.
+- */
+-static void fotg210_quiesce(struct fotg210_hcd *fotg210)
+-{
+-	u32 temp;
+-
+-	if (fotg210->rh_state != FOTG210_RH_RUNNING)
+-		return;
+-
+-	/* wait for any schedule enables/disables to take effect */
+-	temp = (fotg210->command << 10) & (STS_ASS | STS_PSS);
+-	handshake(fotg210, &fotg210->regs->status, STS_ASS | STS_PSS, temp,
+-			16 * 125);
+-
+-	/* then disable anything that's still active */
+-	spin_lock_irq(&fotg210->lock);
+-	fotg210->command &= ~(CMD_ASE | CMD_PSE);
+-	fotg210_writel(fotg210, fotg210->command, &fotg210->regs->command);
+-	spin_unlock_irq(&fotg210->lock);
+-
+-	/* hardware can take 16 microframes to turn off ... */
+-	handshake(fotg210, &fotg210->regs->status, STS_ASS | STS_PSS, 0,
+-			16 * 125);
+-}
+-
+-static void end_unlink_async(struct fotg210_hcd *fotg210);
+-static void unlink_empty_async(struct fotg210_hcd *fotg210);
+-static void fotg210_work(struct fotg210_hcd *fotg210);
+-static void start_unlink_intr(struct fotg210_hcd *fotg210,
+-			      struct fotg210_qh *qh);
+-static void end_unlink_intr(struct fotg210_hcd *fotg210, struct fotg210_qh *qh);
+-
+-/* Set a bit in the USBCMD register */
+-static void fotg210_set_command_bit(struct fotg210_hcd *fotg210, u32 bit)
+-{
+-	fotg210->command |= bit;
+-	fotg210_writel(fotg210, fotg210->command, &fotg210->regs->command);
+-
+-	/* unblock posted write */
+-	fotg210_readl(fotg210, &fotg210->regs->command);
+-}
+-
+-/* Clear a bit in the USBCMD register */
+-static void fotg210_clear_command_bit(struct fotg210_hcd *fotg210, u32 bit)
+-{
+-	fotg210->command &= ~bit;
+-	fotg210_writel(fotg210, fotg210->command, &fotg210->regs->command);
+-
+-	/* unblock posted write */
+-	fotg210_readl(fotg210, &fotg210->regs->command);
+-}
+-
+-/* EHCI timer support...  Now using hrtimers.
+- *
+- * Lots of different events are triggered from fotg210->hrtimer.  Whenever
+- * the timer routine runs, it checks each possible event; events that are
+- * currently enabled and whose expiration time has passed get handled.
+- * The set of enabled events is stored as a collection of bitflags in
+- * fotg210->enabled_hrtimer_events, and they are numbered in order of
+- * increasing delay values (ranging between 1 ms and 100 ms).
+- *
+- * Rather than implementing a sorted list or tree of all pending events,
+- * we keep track only of the lowest-numbered pending event, in
+- * fotg210->next_hrtimer_event.  Whenever fotg210->hrtimer gets restarted, its
+- * expiration time is set to the timeout value for this event.
+- *
+- * As a result, events might not get handled right away; the actual delay
+- * could be anywhere up to twice the requested delay.  This doesn't
+- * matter, because none of the events are especially time-critical.  The
+- * ones that matter most all have a delay of 1 ms, so they will be
+- * handled after 2 ms at most, which is okay.  In addition to this, we
+- * allow for an expiration range of 1 ms.
+- */
+-
+-/* Delay lengths for the hrtimer event types.
+- * Keep this list sorted by delay length, in the same order as
+- * the event types indexed by enum fotg210_hrtimer_event in fotg210.h.
+- */
+-static unsigned event_delays_ns[] = {
+-	1 * NSEC_PER_MSEC,	/* FOTG210_HRTIMER_POLL_ASS */
+-	1 * NSEC_PER_MSEC,	/* FOTG210_HRTIMER_POLL_PSS */
+-	1 * NSEC_PER_MSEC,	/* FOTG210_HRTIMER_POLL_DEAD */
+-	1125 * NSEC_PER_USEC,	/* FOTG210_HRTIMER_UNLINK_INTR */
+-	2 * NSEC_PER_MSEC,	/* FOTG210_HRTIMER_FREE_ITDS */
+-	6 * NSEC_PER_MSEC,	/* FOTG210_HRTIMER_ASYNC_UNLINKS */
+-	10 * NSEC_PER_MSEC,	/* FOTG210_HRTIMER_IAA_WATCHDOG */
+-	10 * NSEC_PER_MSEC,	/* FOTG210_HRTIMER_DISABLE_PERIODIC */
+-	15 * NSEC_PER_MSEC,	/* FOTG210_HRTIMER_DISABLE_ASYNC */
+-	100 * NSEC_PER_MSEC,	/* FOTG210_HRTIMER_IO_WATCHDOG */
+-};
+-
+-/* Enable a pending hrtimer event */
+-static void fotg210_enable_event(struct fotg210_hcd *fotg210, unsigned event,
+-		bool resched)
+-{
+-	ktime_t *timeout = &fotg210->hr_timeouts[event];
+-
+-	if (resched)
+-		*timeout = ktime_add(ktime_get(), event_delays_ns[event]);
+-	fotg210->enabled_hrtimer_events |= (1 << event);
+-
+-	/* Track only the lowest-numbered pending event */
+-	if (event < fotg210->next_hrtimer_event) {
+-		fotg210->next_hrtimer_event = event;
+-		hrtimer_start_range_ns(&fotg210->hrtimer, *timeout,
+-				NSEC_PER_MSEC, HRTIMER_MODE_ABS);
+-	}
+-}
+-
+-
+-/* Poll the STS_ASS status bit; see when it agrees with CMD_ASE */
+-static void fotg210_poll_ASS(struct fotg210_hcd *fotg210)
+-{
+-	unsigned actual, want;
+-
+-	/* Don't enable anything if the controller isn't running (e.g., died) */
+-	if (fotg210->rh_state != FOTG210_RH_RUNNING)
+-		return;
+-
+-	want = (fotg210->command & CMD_ASE) ? STS_ASS : 0;
+-	actual = fotg210_readl(fotg210, &fotg210->regs->status) & STS_ASS;
+-
+-	if (want != actual) {
+-
+-		/* Poll again later, but give up after about 20 ms */
+-		if (fotg210->ASS_poll_count++ < 20) {
+-			fotg210_enable_event(fotg210, FOTG210_HRTIMER_POLL_ASS,
+-					true);
+-			return;
+-		}
+-		fotg210_dbg(fotg210, "Waited too long for the async schedule status (%x/%x), giving up\n",
+-				want, actual);
+-	}
+-	fotg210->ASS_poll_count = 0;
+-
+-	/* The status is up-to-date; restart or stop the schedule as needed */
+-	if (want == 0) {	/* Stopped */
+-		if (fotg210->async_count > 0)
+-			fotg210_set_command_bit(fotg210, CMD_ASE);
+-
+-	} else {		/* Running */
+-		if (fotg210->async_count == 0) {
+-
+-			/* Turn off the schedule after a while */
+-			fotg210_enable_event(fotg210,
+-					FOTG210_HRTIMER_DISABLE_ASYNC,
+-					true);
+-		}
+-	}
+-}
+-
+-/* Turn off the async schedule after a brief delay */
+-static void fotg210_disable_ASE(struct fotg210_hcd *fotg210)
+-{
+-	fotg210_clear_command_bit(fotg210, CMD_ASE);
+-}
+-
+-
+-/* Poll the STS_PSS status bit; see when it agrees with CMD_PSE */
+-static void fotg210_poll_PSS(struct fotg210_hcd *fotg210)
+-{
+-	unsigned actual, want;
+-
+-	/* Don't do anything if the controller isn't running (e.g., died) */
+-	if (fotg210->rh_state != FOTG210_RH_RUNNING)
+-		return;
+-
+-	want = (fotg210->command & CMD_PSE) ? STS_PSS : 0;
+-	actual = fotg210_readl(fotg210, &fotg210->regs->status) & STS_PSS;
+-
+-	if (want != actual) {
+-
+-		/* Poll again later, but give up after about 20 ms */
+-		if (fotg210->PSS_poll_count++ < 20) {
+-			fotg210_enable_event(fotg210, FOTG210_HRTIMER_POLL_PSS,
+-					true);
+-			return;
+-		}
+-		fotg210_dbg(fotg210, "Waited too long for the periodic schedule status (%x/%x), giving up\n",
+-				want, actual);
+-	}
+-	fotg210->PSS_poll_count = 0;
+-
+-	/* The status is up-to-date; restart or stop the schedule as needed */
+-	if (want == 0) {	/* Stopped */
+-		if (fotg210->periodic_count > 0)
+-			fotg210_set_command_bit(fotg210, CMD_PSE);
+-
+-	} else {		/* Running */
+-		if (fotg210->periodic_count == 0) {
+-
+-			/* Turn off the schedule after a while */
+-			fotg210_enable_event(fotg210,
+-					FOTG210_HRTIMER_DISABLE_PERIODIC,
+-					true);
+-		}
+-	}
+-}
+-
+-/* Turn off the periodic schedule after a brief delay */
+-static void fotg210_disable_PSE(struct fotg210_hcd *fotg210)
+-{
+-	fotg210_clear_command_bit(fotg210, CMD_PSE);
+-}
+-
+-
+-/* Poll the STS_HALT status bit; see when a dead controller stops */
+-static void fotg210_handle_controller_death(struct fotg210_hcd *fotg210)
+-{
+-	if (!(fotg210_readl(fotg210, &fotg210->regs->status) & STS_HALT)) {
+-
+-		/* Give up after a few milliseconds */
+-		if (fotg210->died_poll_count++ < 5) {
+-			/* Try again later */
+-			fotg210_enable_event(fotg210,
+-					FOTG210_HRTIMER_POLL_DEAD, true);
+-			return;
+-		}
+-		fotg210_warn(fotg210, "Waited too long for the controller to stop, giving up\n");
+-	}
+-
+-	/* Clean up the mess */
+-	fotg210->rh_state = FOTG210_RH_HALTED;
+-	fotg210_writel(fotg210, 0, &fotg210->regs->intr_enable);
+-	fotg210_work(fotg210);
+-	end_unlink_async(fotg210);
+-
+-	/* Not in process context, so don't try to reset the controller */
+-}
+-
+-
+-/* Handle unlinked interrupt QHs once they are gone from the hardware */
+-static void fotg210_handle_intr_unlinks(struct fotg210_hcd *fotg210)
+-{
+-	bool stopped = (fotg210->rh_state < FOTG210_RH_RUNNING);
+-
+-	/*
+-	 * Process all the QHs on the intr_unlink list that were added
+-	 * before the current unlink cycle began.  The list is in
+-	 * temporal order, so stop when we reach the first entry in the
+-	 * current cycle.  But if the root hub isn't running then
+-	 * process all the QHs on the list.
+-	 */
+-	fotg210->intr_unlinking = true;
+-	while (fotg210->intr_unlink) {
+-		struct fotg210_qh *qh = fotg210->intr_unlink;
+-
+-		if (!stopped && qh->unlink_cycle == fotg210->intr_unlink_cycle)
+-			break;
+-		fotg210->intr_unlink = qh->unlink_next;
+-		qh->unlink_next = NULL;
+-		end_unlink_intr(fotg210, qh);
+-	}
+-
+-	/* Handle remaining entries later */
+-	if (fotg210->intr_unlink) {
+-		fotg210_enable_event(fotg210, FOTG210_HRTIMER_UNLINK_INTR,
+-				true);
+-		++fotg210->intr_unlink_cycle;
+-	}
+-	fotg210->intr_unlinking = false;
+-}
+-
+-
+-/* Start another free-iTDs/siTDs cycle */
+-static void start_free_itds(struct fotg210_hcd *fotg210)
+-{
+-	if (!(fotg210->enabled_hrtimer_events &
+-			BIT(FOTG210_HRTIMER_FREE_ITDS))) {
+-		fotg210->last_itd_to_free = list_entry(
+-				fotg210->cached_itd_list.prev,
+-				struct fotg210_itd, itd_list);
+-		fotg210_enable_event(fotg210, FOTG210_HRTIMER_FREE_ITDS, true);
+-	}
+-}
+-
+-/* Wait for controller to stop using old iTDs and siTDs */
+-static void end_free_itds(struct fotg210_hcd *fotg210)
+-{
+-	struct fotg210_itd *itd, *n;
+-
+-	if (fotg210->rh_state < FOTG210_RH_RUNNING)
+-		fotg210->last_itd_to_free = NULL;
+-
+-	list_for_each_entry_safe(itd, n, &fotg210->cached_itd_list, itd_list) {
+-		list_del(&itd->itd_list);
+-		dma_pool_free(fotg210->itd_pool, itd, itd->itd_dma);
+-		if (itd == fotg210->last_itd_to_free)
+-			break;
+-	}
+-
+-	if (!list_empty(&fotg210->cached_itd_list))
+-		start_free_itds(fotg210);
+-}
+-
+-
+-/* Handle lost (or very late) IAA interrupts */
+-static void fotg210_iaa_watchdog(struct fotg210_hcd *fotg210)
+-{
+-	if (fotg210->rh_state != FOTG210_RH_RUNNING)
+-		return;
+-
+-	/*
+-	 * Lost IAA irqs wedge things badly; seen first with a vt8235.
+-	 * So we need this watchdog, but must protect it against both
+-	 * (a) SMP races against real IAA firing and retriggering, and
+-	 * (b) clean HC shutdown, when IAA watchdog was pending.
+-	 */
+-	if (fotg210->async_iaa) {
+-		u32 cmd, status;
+-
+-		/* If we get here, IAA is *REALLY* late.  It's barely
+-		 * conceivable that the system is so busy that CMD_IAAD
+-		 * is still legitimately set, so let's be sure it's
+-		 * clear before we read STS_IAA.  (The HC should clear
+-		 * CMD_IAAD when it sets STS_IAA.)
+-		 */
+-		cmd = fotg210_readl(fotg210, &fotg210->regs->command);
+-
+-		/*
+-		 * If IAA is set here it either legitimately triggered
+-		 * after the watchdog timer expired (_way_ late, so we'll
+-		 * still count it as lost) ... or a silicon erratum:
+-		 * - VIA seems to set IAA without triggering the IRQ;
+-		 * - IAAD potentially cleared without setting IAA.
+-		 */
+-		status = fotg210_readl(fotg210, &fotg210->regs->status);
+-		if ((status & STS_IAA) || !(cmd & CMD_IAAD)) {
+-			INCR(fotg210->stats.lost_iaa);
+-			fotg210_writel(fotg210, STS_IAA,
+-					&fotg210->regs->status);
+-		}
+-
+-		fotg210_dbg(fotg210, "IAA watchdog: status %x cmd %x\n",
+-				status, cmd);
+-		end_unlink_async(fotg210);
+-	}
+-}
+-
+-
+-/* Enable the I/O watchdog, if appropriate */
+-static void turn_on_io_watchdog(struct fotg210_hcd *fotg210)
+-{
+-	/* Not needed if the controller isn't running or it's already enabled */
+-	if (fotg210->rh_state != FOTG210_RH_RUNNING ||
+-			(fotg210->enabled_hrtimer_events &
+-			BIT(FOTG210_HRTIMER_IO_WATCHDOG)))
+-		return;
+-
+-	/*
+-	 * Isochronous transfers always need the watchdog.
+-	 * For other sorts we use it only if the flag is set.
+-	 */
+-	if (fotg210->isoc_count > 0 || (fotg210->need_io_watchdog &&
+-			fotg210->async_count + fotg210->intr_count > 0))
+-		fotg210_enable_event(fotg210, FOTG210_HRTIMER_IO_WATCHDOG,
+-				true);
+-}
+-
+-
+-/* Handler functions for the hrtimer event types.
+- * Keep this array in the same order as the event types indexed by
+- * enum fotg210_hrtimer_event in fotg210.h.
+- */
+-static void (*event_handlers[])(struct fotg210_hcd *) = {
+-	fotg210_poll_ASS,			/* FOTG210_HRTIMER_POLL_ASS */
+-	fotg210_poll_PSS,			/* FOTG210_HRTIMER_POLL_PSS */
+-	fotg210_handle_controller_death,	/* FOTG210_HRTIMER_POLL_DEAD */
+-	fotg210_handle_intr_unlinks,	/* FOTG210_HRTIMER_UNLINK_INTR */
+-	end_free_itds,			/* FOTG210_HRTIMER_FREE_ITDS */
+-	unlink_empty_async,		/* FOTG210_HRTIMER_ASYNC_UNLINKS */
+-	fotg210_iaa_watchdog,		/* FOTG210_HRTIMER_IAA_WATCHDOG */
+-	fotg210_disable_PSE,		/* FOTG210_HRTIMER_DISABLE_PERIODIC */
+-	fotg210_disable_ASE,		/* FOTG210_HRTIMER_DISABLE_ASYNC */
+-	fotg210_work,			/* FOTG210_HRTIMER_IO_WATCHDOG */
+-};
+-
+-static enum hrtimer_restart fotg210_hrtimer_func(struct hrtimer *t)
+-{
+-	struct fotg210_hcd *fotg210 =
+-			container_of(t, struct fotg210_hcd, hrtimer);
+-	ktime_t now;
+-	unsigned long events;
+-	unsigned long flags;
+-	unsigned e;
+-
+-	spin_lock_irqsave(&fotg210->lock, flags);
+-
+-	events = fotg210->enabled_hrtimer_events;
+-	fotg210->enabled_hrtimer_events = 0;
+-	fotg210->next_hrtimer_event = FOTG210_HRTIMER_NO_EVENT;
+-
+-	/*
+-	 * Check each pending event.  If its time has expired, handle
+-	 * the event; otherwise re-enable it.
+-	 */
+-	now = ktime_get();
+-	for_each_set_bit(e, &events, FOTG210_HRTIMER_NUM_EVENTS) {
+-		if (ktime_compare(now, fotg210->hr_timeouts[e]) >= 0)
+-			event_handlers[e](fotg210);
+-		else
+-			fotg210_enable_event(fotg210, e, false);
+-	}
+-
+-	spin_unlock_irqrestore(&fotg210->lock, flags);
+-	return HRTIMER_NORESTART;
+-}
+-
+-#define fotg210_bus_suspend NULL
+-#define fotg210_bus_resume NULL
+-
+-static int check_reset_complete(struct fotg210_hcd *fotg210, int index,
+-		u32 __iomem *status_reg, int port_status)
+-{
+-	if (!(port_status & PORT_CONNECT))
+-		return port_status;
+-
+-	/* if reset finished and it's still not enabled -- handoff */
+-	if (!(port_status & PORT_PE))
+-		/* with integrated TT, there's nobody to hand it to! */
+-		fotg210_dbg(fotg210, "Failed to enable port %d on root hub TT\n",
+-				index + 1);
+-	else
+-		fotg210_dbg(fotg210, "port %d reset complete, port enabled\n",
+-				index + 1);
+-
+-	return port_status;
+-}
+-
+-
+-/* build "status change" packet (one or two bytes) from HC registers */
+-
+-static int fotg210_hub_status_data(struct usb_hcd *hcd, char *buf)
+-{
+-	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
+-	u32 temp, status;
+-	u32 mask;
+-	int retval = 1;
+-	unsigned long flags;
+-
+-	/* init status to no-changes */
+-	buf[0] = 0;
+-
+-	/* Inform the core about resumes-in-progress by returning
+-	 * a non-zero value even if there are no status changes.
+-	 */
+-	status = fotg210->resuming_ports;
+-
+-	mask = PORT_CSC | PORT_PEC;
+-	/* PORT_RESUME from hardware ~= PORT_STAT_C_SUSPEND */
+-
+-	/* no hub change reports (bit 0) for now (power, ...) */
+-
+-	/* port N changes (bit N)? */
+-	spin_lock_irqsave(&fotg210->lock, flags);
+-
+-	temp = fotg210_readl(fotg210, &fotg210->regs->port_status);
+-
+-	/*
+-	 * Return status information even for ports with OWNER set.
+-	 * Otherwise hub_wq wouldn't see the disconnect event when a
+-	 * high-speed device is switched over to the companion
+-	 * controller by the user.
+-	 */
+-
+-	if ((temp & mask) != 0 || test_bit(0, &fotg210->port_c_suspend) ||
+-			(fotg210->reset_done[0] &&
+-			time_after_eq(jiffies, fotg210->reset_done[0]))) {
+-		buf[0] |= 1 << 1;
+-		status = STS_PCD;
+-	}
+-	/* FIXME autosuspend idle root hubs */
+-	spin_unlock_irqrestore(&fotg210->lock, flags);
+-	return status ? retval : 0;
+-}
+-
+-static void fotg210_hub_descriptor(struct fotg210_hcd *fotg210,
+-		struct usb_hub_descriptor *desc)
+-{
+-	int ports = HCS_N_PORTS(fotg210->hcs_params);
+-	u16 temp;
+-
+-	desc->bDescriptorType = USB_DT_HUB;
+-	desc->bPwrOn2PwrGood = 10;	/* fotg210 1.0, 2.3.9 says 20ms max */
+-	desc->bHubContrCurrent = 0;
+-
+-	desc->bNbrPorts = ports;
+-	temp = 1 + (ports / 8);
+-	desc->bDescLength = 7 + 2 * temp;
+-
+-	/* two bitmaps:  ports removable, and usb 1.0 legacy PortPwrCtrlMask */
+-	memset(&desc->u.hs.DeviceRemovable[0], 0, temp);
+-	memset(&desc->u.hs.DeviceRemovable[temp], 0xff, temp);
+-
+-	temp = HUB_CHAR_INDV_PORT_OCPM;	/* per-port overcurrent reporting */
+-	temp |= HUB_CHAR_NO_LPSM;	/* no power switching */
+-	desc->wHubCharacteristics = cpu_to_le16(temp);
+-}
+-
+-static int fotg210_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+-		u16 wIndex, char *buf, u16 wLength)
+-{
+-	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
+-	int ports = HCS_N_PORTS(fotg210->hcs_params);
+-	u32 __iomem *status_reg = &fotg210->regs->port_status;
+-	u32 temp, temp1, status;
+-	unsigned long flags;
+-	int retval = 0;
+-	unsigned selector;
+-
+-	/*
+-	 * FIXME:  support SetPortFeatures USB_PORT_FEAT_INDICATOR.
+-	 * HCS_INDICATOR may say we can change LEDs to off/amber/green.
+-	 * (track current state ourselves) ... blink for diagnostics,
+-	 * power, "this is the one", etc.  EHCI spec supports this.
+-	 */
+-
+-	spin_lock_irqsave(&fotg210->lock, flags);
+-	switch (typeReq) {
+-	case ClearHubFeature:
+-		switch (wValue) {
+-		case C_HUB_LOCAL_POWER:
+-		case C_HUB_OVER_CURRENT:
+-			/* no hub-wide feature/status flags */
+-			break;
+-		default:
+-			goto error;
+-		}
+-		break;
+-	case ClearPortFeature:
+-		if (!wIndex || wIndex > ports)
+-			goto error;
+-		wIndex--;
+-		temp = fotg210_readl(fotg210, status_reg);
+-		temp &= ~PORT_RWC_BITS;
+-
+-		/*
+-		 * Even if OWNER is set, so the port is owned by the
+-		 * companion controller, hub_wq needs to be able to clear
+-		 * the port-change status bits (especially
+-		 * USB_PORT_STAT_C_CONNECTION).
+-		 */
+-
+-		switch (wValue) {
+-		case USB_PORT_FEAT_ENABLE:
+-			fotg210_writel(fotg210, temp & ~PORT_PE, status_reg);
+-			break;
+-		case USB_PORT_FEAT_C_ENABLE:
+-			fotg210_writel(fotg210, temp | PORT_PEC, status_reg);
+-			break;
+-		case USB_PORT_FEAT_SUSPEND:
+-			if (temp & PORT_RESET)
+-				goto error;
+-			if (!(temp & PORT_SUSPEND))
+-				break;
+-			if ((temp & PORT_PE) == 0)
+-				goto error;
+-
+-			/* resume signaling for 20 msec */
+-			fotg210_writel(fotg210, temp | PORT_RESUME, status_reg);
+-			fotg210->reset_done[wIndex] = jiffies
+-					+ msecs_to_jiffies(USB_RESUME_TIMEOUT);
+-			break;
+-		case USB_PORT_FEAT_C_SUSPEND:
+-			clear_bit(wIndex, &fotg210->port_c_suspend);
+-			break;
+-		case USB_PORT_FEAT_C_CONNECTION:
+-			fotg210_writel(fotg210, temp | PORT_CSC, status_reg);
+-			break;
+-		case USB_PORT_FEAT_C_OVER_CURRENT:
+-			fotg210_writel(fotg210, temp | OTGISR_OVC,
+-					&fotg210->regs->otgisr);
+-			break;
+-		case USB_PORT_FEAT_C_RESET:
+-			/* GetPortStatus clears reset */
+-			break;
+-		default:
+-			goto error;
+-		}
+-		fotg210_readl(fotg210, &fotg210->regs->command);
+-		break;
+-	case GetHubDescriptor:
+-		fotg210_hub_descriptor(fotg210, (struct usb_hub_descriptor *)
+-				buf);
+-		break;
+-	case GetHubStatus:
+-		/* no hub-wide feature/status flags */
+-		memset(buf, 0, 4);
+-		/*cpu_to_le32s ((u32 *) buf); */
+-		break;
+-	case GetPortStatus:
+-		if (!wIndex || wIndex > ports)
+-			goto error;
+-		wIndex--;
+-		status = 0;
+-		temp = fotg210_readl(fotg210, status_reg);
+-
+-		/* wPortChange bits */
+-		if (temp & PORT_CSC)
+-			status |= USB_PORT_STAT_C_CONNECTION << 16;
+-		if (temp & PORT_PEC)
+-			status |= USB_PORT_STAT_C_ENABLE << 16;
+-
+-		temp1 = fotg210_readl(fotg210, &fotg210->regs->otgisr);
+-		if (temp1 & OTGISR_OVC)
+-			status |= USB_PORT_STAT_C_OVERCURRENT << 16;
+-
+-		/* whoever resumes must GetPortStatus to complete it!! */
+-		if (temp & PORT_RESUME) {
+-
+-			/* Remote Wakeup received? */
+-			if (!fotg210->reset_done[wIndex]) {
+-				/* resume signaling for 20 msec */
+-				fotg210->reset_done[wIndex] = jiffies
+-						+ msecs_to_jiffies(20);
+-				/* check the port again */
+-				mod_timer(&fotg210_to_hcd(fotg210)->rh_timer,
+-						fotg210->reset_done[wIndex]);
+-			}
+-
+-			/* resume completed? */
+-			else if (time_after_eq(jiffies,
+-					fotg210->reset_done[wIndex])) {
+-				clear_bit(wIndex, &fotg210->suspended_ports);
+-				set_bit(wIndex, &fotg210->port_c_suspend);
+-				fotg210->reset_done[wIndex] = 0;
+-
+-				/* stop resume signaling */
+-				temp = fotg210_readl(fotg210, status_reg);
+-				fotg210_writel(fotg210, temp &
+-						~(PORT_RWC_BITS | PORT_RESUME),
+-						status_reg);
+-				clear_bit(wIndex, &fotg210->resuming_ports);
+-				retval = handshake(fotg210, status_reg,
+-						PORT_RESUME, 0, 2000);/* 2ms */
+-				if (retval != 0) {
+-					fotg210_err(fotg210,
+-							"port %d resume error %d\n",
+-							wIndex + 1, retval);
+-					goto error;
+-				}
+-				temp &= ~(PORT_SUSPEND|PORT_RESUME|(3<<10));
+-			}
+-		}
+-
+-		/* whoever resets must GetPortStatus to complete it!! */
+-		if ((temp & PORT_RESET) && time_after_eq(jiffies,
+-				fotg210->reset_done[wIndex])) {
+-			status |= USB_PORT_STAT_C_RESET << 16;
+-			fotg210->reset_done[wIndex] = 0;
+-			clear_bit(wIndex, &fotg210->resuming_ports);
+-
+-			/* force reset to complete */
+-			fotg210_writel(fotg210,
+-					temp & ~(PORT_RWC_BITS | PORT_RESET),
+-					status_reg);
+-			/* REVISIT:  some hardware needs 550+ usec to clear
+-			 * this bit; seems too long to spin routinely...
+-			 */
+-			retval = handshake(fotg210, status_reg,
+-					PORT_RESET, 0, 1000);
+-			if (retval != 0) {
+-				fotg210_err(fotg210, "port %d reset error %d\n",
+-						wIndex + 1, retval);
+-				goto error;
+-			}
+-
+-			/* see what we found out */
+-			temp = check_reset_complete(fotg210, wIndex, status_reg,
+-					fotg210_readl(fotg210, status_reg));
+-
+-			/* restart schedule */
+-			fotg210->command |= CMD_RUN;
+-			fotg210_writel(fotg210, fotg210->command, &fotg210->regs->command);
+-		}
+-
+-		if (!(temp & (PORT_RESUME|PORT_RESET))) {
+-			fotg210->reset_done[wIndex] = 0;
+-			clear_bit(wIndex, &fotg210->resuming_ports);
+-		}
+-
+-		/* transfer dedicated ports to the companion hc */
+-		if ((temp & PORT_CONNECT) &&
+-				test_bit(wIndex, &fotg210->companion_ports)) {
+-			temp &= ~PORT_RWC_BITS;
+-			fotg210_writel(fotg210, temp, status_reg);
+-			fotg210_dbg(fotg210, "port %d --> companion\n",
+-					wIndex + 1);
+-			temp = fotg210_readl(fotg210, status_reg);
+-		}
+-
+-		/*
+-		 * Even if OWNER is set, there's no harm letting hub_wq
+-		 * see the wPortStatus values (they should all be 0 except
+-		 * for PORT_POWER anyway).
+-		 */
+-
+-		if (temp & PORT_CONNECT) {
+-			status |= USB_PORT_STAT_CONNECTION;
+-			status |= fotg210_port_speed(fotg210, temp);
+-		}
+-		if (temp & PORT_PE)
+-			status |= USB_PORT_STAT_ENABLE;
+-
+-		/* maybe the port was unsuspended without our knowledge */
+-		if (temp & (PORT_SUSPEND|PORT_RESUME)) {
+-			status |= USB_PORT_STAT_SUSPEND;
+-		} else if (test_bit(wIndex, &fotg210->suspended_ports)) {
+-			clear_bit(wIndex, &fotg210->suspended_ports);
+-			clear_bit(wIndex, &fotg210->resuming_ports);
+-			fotg210->reset_done[wIndex] = 0;
+-			if (temp & PORT_PE)
+-				set_bit(wIndex, &fotg210->port_c_suspend);
+-		}
+-
+-		temp1 = fotg210_readl(fotg210, &fotg210->regs->otgisr);
+-		if (temp1 & OTGISR_OVC)
+-			status |= USB_PORT_STAT_OVERCURRENT;
+-		if (temp & PORT_RESET)
+-			status |= USB_PORT_STAT_RESET;
+-		if (test_bit(wIndex, &fotg210->port_c_suspend))
+-			status |= USB_PORT_STAT_C_SUSPEND << 16;
+-
+-		if (status & ~0xffff)	/* only if wPortChange is interesting */
+-			dbg_port(fotg210, "GetStatus", wIndex + 1, temp);
+-		put_unaligned_le32(status, buf);
+-		break;
+-	case SetHubFeature:
+-		switch (wValue) {
+-		case C_HUB_LOCAL_POWER:
+-		case C_HUB_OVER_CURRENT:
+-			/* no hub-wide feature/status flags */
+-			break;
+-		default:
+-			goto error;
+-		}
+-		break;
+-	case SetPortFeature:
+-		selector = wIndex >> 8;
+-		wIndex &= 0xff;
+-
+-		if (!wIndex || wIndex > ports)
+-			goto error;
+-		wIndex--;
+-		temp = fotg210_readl(fotg210, status_reg);
+-		temp &= ~PORT_RWC_BITS;
+-		switch (wValue) {
+-		case USB_PORT_FEAT_SUSPEND:
+-			if ((temp & PORT_PE) == 0
+-					|| (temp & PORT_RESET) != 0)
+-				goto error;
+-
+-			/* After above check the port must be connected.
+-			 * Set appropriate bit thus could put phy into low power
+-			 * mode if we have hostpc feature
+-			 */
+-			fotg210_writel(fotg210, temp | PORT_SUSPEND,
+-					status_reg);
+-			set_bit(wIndex, &fotg210->suspended_ports);
+-			break;
+-		case USB_PORT_FEAT_RESET:
+-			if (temp & PORT_RESUME)
+-				goto error;
+-			/* line status bits may report this as low speed,
+-			 * which can be fine if this root hub has a
+-			 * transaction translator built in.
+-			 */
+-			fotg210_dbg(fotg210, "port %d reset\n", wIndex + 1);
+-			temp |= PORT_RESET;
+-			temp &= ~PORT_PE;
+-
+-			/*
+-			 * caller must wait, then call GetPortStatus
+-			 * usb 2.0 spec says 50 ms resets on root
+-			 */
+-			fotg210->reset_done[wIndex] = jiffies
+-					+ msecs_to_jiffies(50);
+-			fotg210_writel(fotg210, temp, status_reg);
+-			break;
+-
+-		/* For downstream facing ports (these):  one hub port is put
+-		 * into test mode according to USB2 11.24.2.13, then the hub
+-		 * must be reset (which for root hub now means rmmod+modprobe,
+-		 * or else system reboot).  See EHCI 2.3.9 and 4.14 for info
+-		 * about the EHCI-specific stuff.
+-		 */
+-		case USB_PORT_FEAT_TEST:
+-			if (!selector || selector > 5)
+-				goto error;
+-			spin_unlock_irqrestore(&fotg210->lock, flags);
+-			fotg210_quiesce(fotg210);
+-			spin_lock_irqsave(&fotg210->lock, flags);
+-
+-			/* Put all enabled ports into suspend */
+-			temp = fotg210_readl(fotg210, status_reg) &
+-				~PORT_RWC_BITS;
+-			if (temp & PORT_PE)
+-				fotg210_writel(fotg210, temp | PORT_SUSPEND,
+-						status_reg);
+-
+-			spin_unlock_irqrestore(&fotg210->lock, flags);
+-			fotg210_halt(fotg210);
+-			spin_lock_irqsave(&fotg210->lock, flags);
+-
+-			temp = fotg210_readl(fotg210, status_reg);
+-			temp |= selector << 16;
+-			fotg210_writel(fotg210, temp, status_reg);
+-			break;
+-
+-		default:
+-			goto error;
+-		}
+-		fotg210_readl(fotg210, &fotg210->regs->command);
+-		break;
+-
+-	default:
+-error:
+-		/* "stall" on error */
+-		retval = -EPIPE;
+-	}
+-	spin_unlock_irqrestore(&fotg210->lock, flags);
+-	return retval;
+-}
+-
+-static void __maybe_unused fotg210_relinquish_port(struct usb_hcd *hcd,
+-		int portnum)
+-{
+-	return;
+-}
+-
+-static int __maybe_unused fotg210_port_handed_over(struct usb_hcd *hcd,
+-		int portnum)
+-{
+-	return 0;
+-}
+-
+-/* There's basically three types of memory:
+- *	- data used only by the HCD ... kmalloc is fine
+- *	- async and periodic schedules, shared by HC and HCD ... these
+- *	  need to use dma_pool or dma_alloc_coherent
+- *	- driver buffers, read/written by HC ... single shot DMA mapped
+- *
+- * There's also "register" data (e.g. PCI or SOC), which is memory mapped.
+- * No memory seen by this driver is pageable.
+- */
+-
+-/* Allocate the key transfer structures from the previously allocated pool */
+-static inline void fotg210_qtd_init(struct fotg210_hcd *fotg210,
+-		struct fotg210_qtd *qtd, dma_addr_t dma)
+-{
+-	memset(qtd, 0, sizeof(*qtd));
+-	qtd->qtd_dma = dma;
+-	qtd->hw_token = cpu_to_hc32(fotg210, QTD_STS_HALT);
+-	qtd->hw_next = FOTG210_LIST_END(fotg210);
+-	qtd->hw_alt_next = FOTG210_LIST_END(fotg210);
+-	INIT_LIST_HEAD(&qtd->qtd_list);
+-}
+-
+-static struct fotg210_qtd *fotg210_qtd_alloc(struct fotg210_hcd *fotg210,
+-		gfp_t flags)
+-{
+-	struct fotg210_qtd *qtd;
+-	dma_addr_t dma;
+-
+-	qtd = dma_pool_alloc(fotg210->qtd_pool, flags, &dma);
+-	if (qtd != NULL)
+-		fotg210_qtd_init(fotg210, qtd, dma);
+-
+-	return qtd;
+-}
+-
+-static inline void fotg210_qtd_free(struct fotg210_hcd *fotg210,
+-		struct fotg210_qtd *qtd)
+-{
+-	dma_pool_free(fotg210->qtd_pool, qtd, qtd->qtd_dma);
+-}
+-
+-
+-static void qh_destroy(struct fotg210_hcd *fotg210, struct fotg210_qh *qh)
+-{
+-	/* clean qtds first, and know this is not linked */
+-	if (!list_empty(&qh->qtd_list) || qh->qh_next.ptr) {
+-		fotg210_dbg(fotg210, "unused qh not empty!\n");
+-		BUG();
+-	}
+-	if (qh->dummy)
+-		fotg210_qtd_free(fotg210, qh->dummy);
+-	dma_pool_free(fotg210->qh_pool, qh->hw, qh->qh_dma);
+-	kfree(qh);
+-}
+-
+-static struct fotg210_qh *fotg210_qh_alloc(struct fotg210_hcd *fotg210,
+-		gfp_t flags)
+-{
+-	struct fotg210_qh *qh;
+-	dma_addr_t dma;
+-
+-	qh = kzalloc(sizeof(*qh), GFP_ATOMIC);
+-	if (!qh)
+-		goto done;
+-	qh->hw = (struct fotg210_qh_hw *)
+-		dma_pool_zalloc(fotg210->qh_pool, flags, &dma);
+-	if (!qh->hw)
+-		goto fail;
+-	qh->qh_dma = dma;
+-	INIT_LIST_HEAD(&qh->qtd_list);
+-
+-	/* dummy td enables safe urb queuing */
+-	qh->dummy = fotg210_qtd_alloc(fotg210, flags);
+-	if (qh->dummy == NULL) {
+-		fotg210_dbg(fotg210, "no dummy td\n");
+-		goto fail1;
+-	}
+-done:
+-	return qh;
+-fail1:
+-	dma_pool_free(fotg210->qh_pool, qh->hw, qh->qh_dma);
+-fail:
+-	kfree(qh);
+-	return NULL;
+-}
+-
+-/* The queue heads and transfer descriptors are managed from pools tied
+- * to each of the "per device" structures.
+- * This is the initialisation and cleanup code.
+- */
+-
+-static void fotg210_mem_cleanup(struct fotg210_hcd *fotg210)
+-{
+-	if (fotg210->async)
+-		qh_destroy(fotg210, fotg210->async);
+-	fotg210->async = NULL;
+-
+-	if (fotg210->dummy)
+-		qh_destroy(fotg210, fotg210->dummy);
+-	fotg210->dummy = NULL;
+-
+-	/* DMA consistent memory and pools */
+-	dma_pool_destroy(fotg210->qtd_pool);
+-	fotg210->qtd_pool = NULL;
+-
+-	dma_pool_destroy(fotg210->qh_pool);
+-	fotg210->qh_pool = NULL;
+-
+-	dma_pool_destroy(fotg210->itd_pool);
+-	fotg210->itd_pool = NULL;
+-
+-	if (fotg210->periodic)
+-		dma_free_coherent(fotg210_to_hcd(fotg210)->self.controller,
+-				fotg210->periodic_size * sizeof(u32),
+-				fotg210->periodic, fotg210->periodic_dma);
+-	fotg210->periodic = NULL;
+-
+-	/* shadow periodic table */
+-	kfree(fotg210->pshadow);
+-	fotg210->pshadow = NULL;
+-}
+-
+-/* remember to add cleanup code (above) if you add anything here */
+-static int fotg210_mem_init(struct fotg210_hcd *fotg210, gfp_t flags)
+-{
+-	int i;
+-
+-	/* QTDs for control/bulk/intr transfers */
+-	fotg210->qtd_pool = dma_pool_create("fotg210_qtd",
+-			fotg210_to_hcd(fotg210)->self.controller,
+-			sizeof(struct fotg210_qtd),
+-			32 /* byte alignment (for hw parts) */,
+-			4096 /* can't cross 4K */);
+-	if (!fotg210->qtd_pool)
+-		goto fail;
+-
+-	/* QHs for control/bulk/intr transfers */
+-	fotg210->qh_pool = dma_pool_create("fotg210_qh",
+-			fotg210_to_hcd(fotg210)->self.controller,
+-			sizeof(struct fotg210_qh_hw),
+-			32 /* byte alignment (for hw parts) */,
+-			4096 /* can't cross 4K */);
+-	if (!fotg210->qh_pool)
+-		goto fail;
+-
+-	fotg210->async = fotg210_qh_alloc(fotg210, flags);
+-	if (!fotg210->async)
+-		goto fail;
+-
+-	/* ITD for high speed ISO transfers */
+-	fotg210->itd_pool = dma_pool_create("fotg210_itd",
+-			fotg210_to_hcd(fotg210)->self.controller,
+-			sizeof(struct fotg210_itd),
+-			64 /* byte alignment (for hw parts) */,
+-			4096 /* can't cross 4K */);
+-	if (!fotg210->itd_pool)
+-		goto fail;
+-
+-	/* Hardware periodic table */
+-	fotg210->periodic =
+-		dma_alloc_coherent(fotg210_to_hcd(fotg210)->self.controller,
+-				fotg210->periodic_size * sizeof(__le32),
+-				&fotg210->periodic_dma, 0);
+-	if (fotg210->periodic == NULL)
+-		goto fail;
+-
+-	for (i = 0; i < fotg210->periodic_size; i++)
+-		fotg210->periodic[i] = FOTG210_LIST_END(fotg210);
+-
+-	/* software shadow of hardware table */
+-	fotg210->pshadow = kcalloc(fotg210->periodic_size, sizeof(void *),
+-			flags);
+-	if (fotg210->pshadow != NULL)
+-		return 0;
+-
+-fail:
+-	fotg210_dbg(fotg210, "couldn't init memory\n");
+-	fotg210_mem_cleanup(fotg210);
+-	return -ENOMEM;
+-}
+-/* EHCI hardware queue manipulation ... the core.  QH/QTD manipulation.
+- *
+- * Control, bulk, and interrupt traffic all use "qh" lists.  They list "qtd"
+- * entries describing USB transactions, max 16-20kB/entry (with 4kB-aligned
+- * buffers needed for the larger number).  We use one QH per endpoint, queue
+- * multiple urbs (all three types) per endpoint.  URBs may need several qtds.
+- *
+- * ISO traffic uses "ISO TD" (itd) records, and (along with
+- * interrupts) needs careful scheduling.  Performance improvements can be
+- * an ongoing challenge.  That's in "ehci-sched.c".
+- *
+- * USB 1.1 devices are handled (a) by "companion" OHCI or UHCI root hubs,
+- * or otherwise through transaction translators (TTs) in USB 2.0 hubs using
+- * (b) special fields in qh entries or (c) split iso entries.  TTs will
+- * buffer low/full speed data so the host collects it at high speed.
+- */
+-
+-/* fill a qtd, returning how much of the buffer we were able to queue up */
+-static int qtd_fill(struct fotg210_hcd *fotg210, struct fotg210_qtd *qtd,
+-		dma_addr_t buf, size_t len, int token, int maxpacket)
+-{
+-	int i, count;
+-	u64 addr = buf;
+-
+-	/* one buffer entry per 4K ... first might be short or unaligned */
+-	qtd->hw_buf[0] = cpu_to_hc32(fotg210, (u32)addr);
+-	qtd->hw_buf_hi[0] = cpu_to_hc32(fotg210, (u32)(addr >> 32));
+-	count = 0x1000 - (buf & 0x0fff);	/* rest of that page */
+-	if (likely(len < count))		/* ... iff needed */
+-		count = len;
+-	else {
+-		buf +=  0x1000;
+-		buf &= ~0x0fff;
+-
+-		/* per-qtd limit: from 16K to 20K (best alignment) */
+-		for (i = 1; count < len && i < 5; i++) {
+-			addr = buf;
+-			qtd->hw_buf[i] = cpu_to_hc32(fotg210, (u32)addr);
+-			qtd->hw_buf_hi[i] = cpu_to_hc32(fotg210,
+-					(u32)(addr >> 32));
+-			buf += 0x1000;
+-			if ((count + 0x1000) < len)
+-				count += 0x1000;
+-			else
+-				count = len;
+-		}
+-
+-		/* short packets may only terminate transfers */
+-		if (count != len)
+-			count -= (count % maxpacket);
+-	}
+-	qtd->hw_token = cpu_to_hc32(fotg210, (count << 16) | token);
+-	qtd->length = count;
+-
+-	return count;
+-}
+-
+-static inline void qh_update(struct fotg210_hcd *fotg210,
+-		struct fotg210_qh *qh, struct fotg210_qtd *qtd)
+-{
+-	struct fotg210_qh_hw *hw = qh->hw;
+-
+-	/* writes to an active overlay are unsafe */
+-	BUG_ON(qh->qh_state != QH_STATE_IDLE);
+-
+-	hw->hw_qtd_next = QTD_NEXT(fotg210, qtd->qtd_dma);
+-	hw->hw_alt_next = FOTG210_LIST_END(fotg210);
+-
+-	/* Except for control endpoints, we make hardware maintain data
+-	 * toggle (like OHCI) ... here (re)initialize the toggle in the QH,
+-	 * and set the pseudo-toggle in udev. Only usb_clear_halt() will
+-	 * ever clear it.
+-	 */
+-	if (!(hw->hw_info1 & cpu_to_hc32(fotg210, QH_TOGGLE_CTL))) {
+-		unsigned is_out, epnum;
+-
+-		is_out = qh->is_out;
+-		epnum = (hc32_to_cpup(fotg210, &hw->hw_info1) >> 8) & 0x0f;
+-		if (unlikely(!usb_gettoggle(qh->dev, epnum, is_out))) {
+-			hw->hw_token &= ~cpu_to_hc32(fotg210, QTD_TOGGLE);
+-			usb_settoggle(qh->dev, epnum, is_out, 1);
+-		}
+-	}
+-
+-	hw->hw_token &= cpu_to_hc32(fotg210, QTD_TOGGLE | QTD_STS_PING);
+-}
+-
+-/* if it weren't for a common silicon quirk (writing the dummy into the qh
+- * overlay, so qh->hw_token wrongly becomes inactive/halted), only fault
+- * recovery (including urb dequeue) would need software changes to a QH...
+- */
+-static void qh_refresh(struct fotg210_hcd *fotg210, struct fotg210_qh *qh)
+-{
+-	struct fotg210_qtd *qtd;
+-
+-	if (list_empty(&qh->qtd_list))
+-		qtd = qh->dummy;
+-	else {
+-		qtd = list_entry(qh->qtd_list.next,
+-				struct fotg210_qtd, qtd_list);
+-		/*
+-		 * first qtd may already be partially processed.
+-		 * If we come here during unlink, the QH overlay region
+-		 * might have reference to the just unlinked qtd. The
+-		 * qtd is updated in qh_completions(). Update the QH
+-		 * overlay here.
+-		 */
+-		if (cpu_to_hc32(fotg210, qtd->qtd_dma) == qh->hw->hw_current) {
+-			qh->hw->hw_qtd_next = qtd->hw_next;
+-			qtd = NULL;
+-		}
+-	}
+-
+-	if (qtd)
+-		qh_update(fotg210, qh, qtd);
+-}
+-
+-static void qh_link_async(struct fotg210_hcd *fotg210, struct fotg210_qh *qh);
+-
+-static void fotg210_clear_tt_buffer_complete(struct usb_hcd *hcd,
+-		struct usb_host_endpoint *ep)
+-{
+-	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
+-	struct fotg210_qh *qh = ep->hcpriv;
+-	unsigned long flags;
+-
+-	spin_lock_irqsave(&fotg210->lock, flags);
+-	qh->clearing_tt = 0;
+-	if (qh->qh_state == QH_STATE_IDLE && !list_empty(&qh->qtd_list)
+-			&& fotg210->rh_state == FOTG210_RH_RUNNING)
+-		qh_link_async(fotg210, qh);
+-	spin_unlock_irqrestore(&fotg210->lock, flags);
+-}
+-
+-static void fotg210_clear_tt_buffer(struct fotg210_hcd *fotg210,
+-		struct fotg210_qh *qh, struct urb *urb, u32 token)
+-{
+-
+-	/* If an async split transaction gets an error or is unlinked,
+-	 * the TT buffer may be left in an indeterminate state.  We
+-	 * have to clear the TT buffer.
+-	 *
+-	 * Note: this routine is never called for Isochronous transfers.
+-	 */
+-	if (urb->dev->tt && !usb_pipeint(urb->pipe) && !qh->clearing_tt) {
+-		struct usb_device *tt = urb->dev->tt->hub;
+-
+-		dev_dbg(&tt->dev,
+-				"clear tt buffer port %d, a%d ep%d t%08x\n",
+-				urb->dev->ttport, urb->dev->devnum,
+-				usb_pipeendpoint(urb->pipe), token);
+-
+-		if (urb->dev->tt->hub !=
+-				fotg210_to_hcd(fotg210)->self.root_hub) {
+-			if (usb_hub_clear_tt_buffer(urb) == 0)
+-				qh->clearing_tt = 1;
+-		}
+-	}
+-}
+-
+-static int qtd_copy_status(struct fotg210_hcd *fotg210, struct urb *urb,
+-		size_t length, u32 token)
+-{
+-	int status = -EINPROGRESS;
+-
+-	/* count IN/OUT bytes, not SETUP (even short packets) */
+-	if (likely(QTD_PID(token) != 2))
+-		urb->actual_length += length - QTD_LENGTH(token);
+-
+-	/* don't modify error codes */
+-	if (unlikely(urb->unlinked))
+-		return status;
+-
+-	/* force cleanup after short read; not always an error */
+-	if (unlikely(IS_SHORT_READ(token)))
+-		status = -EREMOTEIO;
+-
+-	/* serious "can't proceed" faults reported by the hardware */
+-	if (token & QTD_STS_HALT) {
+-		if (token & QTD_STS_BABBLE) {
+-			/* FIXME "must" disable babbling device's port too */
+-			status = -EOVERFLOW;
+-		/* CERR nonzero + halt --> stall */
+-		} else if (QTD_CERR(token)) {
+-			status = -EPIPE;
+-
+-		/* In theory, more than one of the following bits can be set
+-		 * since they are sticky and the transaction is retried.
+-		 * Which to test first is rather arbitrary.
+-		 */
+-		} else if (token & QTD_STS_MMF) {
+-			/* fs/ls interrupt xfer missed the complete-split */
+-			status = -EPROTO;
+-		} else if (token & QTD_STS_DBE) {
+-			status = (QTD_PID(token) == 1) /* IN ? */
+-				? -ENOSR  /* hc couldn't read data */
+-				: -ECOMM; /* hc couldn't write data */
+-		} else if (token & QTD_STS_XACT) {
+-			/* timeout, bad CRC, wrong PID, etc */
+-			fotg210_dbg(fotg210, "devpath %s ep%d%s 3strikes\n",
+-					urb->dev->devpath,
+-					usb_pipeendpoint(urb->pipe),
+-					usb_pipein(urb->pipe) ? "in" : "out");
+-			status = -EPROTO;
+-		} else {	/* unknown */
+-			status = -EPROTO;
+-		}
+-
+-		fotg210_dbg(fotg210,
+-				"dev%d ep%d%s qtd token %08x --> status %d\n",
+-				usb_pipedevice(urb->pipe),
+-				usb_pipeendpoint(urb->pipe),
+-				usb_pipein(urb->pipe) ? "in" : "out",
+-				token, status);
+-	}
+-
+-	return status;
+-}
+-
+-static void fotg210_urb_done(struct fotg210_hcd *fotg210, struct urb *urb,
+-		int status)
+-__releases(fotg210->lock)
+-__acquires(fotg210->lock)
+-{
+-	if (likely(urb->hcpriv != NULL)) {
+-		struct fotg210_qh *qh = (struct fotg210_qh *) urb->hcpriv;
+-
+-		/* S-mask in a QH means it's an interrupt urb */
+-		if ((qh->hw->hw_info2 & cpu_to_hc32(fotg210, QH_SMASK)) != 0) {
+-
+-			/* ... update hc-wide periodic stats (for usbfs) */
+-			fotg210_to_hcd(fotg210)->self.bandwidth_int_reqs--;
+-		}
+-	}
+-
+-	if (unlikely(urb->unlinked)) {
+-		INCR(fotg210->stats.unlink);
+-	} else {
+-		/* report non-error and short read status as zero */
+-		if (status == -EINPROGRESS || status == -EREMOTEIO)
+-			status = 0;
+-		INCR(fotg210->stats.complete);
+-	}
+-
+-#ifdef FOTG210_URB_TRACE
+-	fotg210_dbg(fotg210,
+-			"%s %s urb %p ep%d%s status %d len %d/%d\n",
+-			__func__, urb->dev->devpath, urb,
+-			usb_pipeendpoint(urb->pipe),
+-			usb_pipein(urb->pipe) ? "in" : "out",
+-			status,
+-			urb->actual_length, urb->transfer_buffer_length);
+-#endif
+-
+-	/* complete() can reenter this HCD */
+-	usb_hcd_unlink_urb_from_ep(fotg210_to_hcd(fotg210), urb);
+-	spin_unlock(&fotg210->lock);
+-	usb_hcd_giveback_urb(fotg210_to_hcd(fotg210), urb, status);
+-	spin_lock(&fotg210->lock);
+-}
+-
+-static int qh_schedule(struct fotg210_hcd *fotg210, struct fotg210_qh *qh);
+-
+-/* Process and free completed qtds for a qh, returning URBs to drivers.
+- * Chases up to qh->hw_current.  Returns number of completions called,
+- * indicating how much "real" work we did.
+- */
+-static unsigned qh_completions(struct fotg210_hcd *fotg210,
+-		struct fotg210_qh *qh)
+-{
+-	struct fotg210_qtd *last, *end = qh->dummy;
+-	struct fotg210_qtd *qtd, *tmp;
+-	int last_status;
+-	int stopped;
+-	unsigned count = 0;
+-	u8 state;
+-	struct fotg210_qh_hw *hw = qh->hw;
+-
+-	if (unlikely(list_empty(&qh->qtd_list)))
+-		return count;
+-
+-	/* completions (or tasks on other cpus) must never clobber HALT
+-	 * till we've gone through and cleaned everything up, even when
+-	 * they add urbs to this qh's queue or mark them for unlinking.
+-	 *
+-	 * NOTE:  unlinking expects to be done in queue order.
+-	 *
+-	 * It's a bug for qh->qh_state to be anything other than
+-	 * QH_STATE_IDLE, unless our caller is scan_async() or
+-	 * scan_intr().
+-	 */
+-	state = qh->qh_state;
+-	qh->qh_state = QH_STATE_COMPLETING;
+-	stopped = (state == QH_STATE_IDLE);
+-
+-rescan:
+-	last = NULL;
+-	last_status = -EINPROGRESS;
+-	qh->needs_rescan = 0;
+-
+-	/* remove de-activated QTDs from front of queue.
+-	 * after faults (including short reads), cleanup this urb
+-	 * then let the queue advance.
+-	 * if queue is stopped, handles unlinks.
+-	 */
+-	list_for_each_entry_safe(qtd, tmp, &qh->qtd_list, qtd_list) {
+-		struct urb *urb;
+-		u32 token = 0;
+-
+-		urb = qtd->urb;
+-
+-		/* clean up any state from previous QTD ...*/
+-		if (last) {
+-			if (likely(last->urb != urb)) {
+-				fotg210_urb_done(fotg210, last->urb,
+-						last_status);
+-				count++;
+-				last_status = -EINPROGRESS;
+-			}
+-			fotg210_qtd_free(fotg210, last);
+-			last = NULL;
+-		}
+-
+-		/* ignore urbs submitted during completions we reported */
+-		if (qtd == end)
+-			break;
+-
+-		/* hardware copies qtd out of qh overlay */
+-		rmb();
+-		token = hc32_to_cpu(fotg210, qtd->hw_token);
+-
+-		/* always clean up qtds the hc de-activated */
+-retry_xacterr:
+-		if ((token & QTD_STS_ACTIVE) == 0) {
+-
+-			/* Report Data Buffer Error: non-fatal but useful */
+-			if (token & QTD_STS_DBE)
+-				fotg210_dbg(fotg210,
+-					"detected DataBufferErr for urb %p ep%d%s len %d, qtd %p [qh %p]\n",
+-					urb, usb_endpoint_num(&urb->ep->desc),
+-					usb_endpoint_dir_in(&urb->ep->desc)
+-						? "in" : "out",
+-					urb->transfer_buffer_length, qtd, qh);
+-
+-			/* on STALL, error, and short reads this urb must
+-			 * complete and all its qtds must be recycled.
+-			 */
+-			if ((token & QTD_STS_HALT) != 0) {
+-
+-				/* retry transaction errors until we
+-				 * reach the software xacterr limit
+-				 */
+-				if ((token & QTD_STS_XACT) &&
+-						QTD_CERR(token) == 0 &&
+-						++qh->xacterrs < QH_XACTERR_MAX &&
+-						!urb->unlinked) {
+-					fotg210_dbg(fotg210,
+-						"detected XactErr len %zu/%zu retry %d\n",
+-						qtd->length - QTD_LENGTH(token),
+-						qtd->length,
+-						qh->xacterrs);
+-
+-					/* reset the token in the qtd and the
+-					 * qh overlay (which still contains
+-					 * the qtd) so that we pick up from
+-					 * where we left off
+-					 */
+-					token &= ~QTD_STS_HALT;
+-					token |= QTD_STS_ACTIVE |
+-						 (FOTG210_TUNE_CERR << 10);
+-					qtd->hw_token = cpu_to_hc32(fotg210,
+-							token);
+-					wmb();
+-					hw->hw_token = cpu_to_hc32(fotg210,
+-							token);
+-					goto retry_xacterr;
+-				}
+-				stopped = 1;
+-
+-			/* magic dummy for some short reads; qh won't advance.
+-			 * that silicon quirk can kick in with this dummy too.
+-			 *
+-			 * other short reads won't stop the queue, including
+-			 * control transfers (status stage handles that) or
+-			 * most other single-qtd reads ... the queue stops if
+-			 * URB_SHORT_NOT_OK was set so the driver submitting
+-			 * the urbs could clean it up.
+-			 */
+-			} else if (IS_SHORT_READ(token) &&
+-					!(qtd->hw_alt_next &
+-					FOTG210_LIST_END(fotg210))) {
+-				stopped = 1;
+-			}
+-
+-		/* stop scanning when we reach qtds the hc is using */
+-		} else if (likely(!stopped
+-				&& fotg210->rh_state >= FOTG210_RH_RUNNING)) {
+-			break;
+-
+-		/* scan the whole queue for unlinks whenever it stops */
+-		} else {
+-			stopped = 1;
+-
+-			/* cancel everything if we halt, suspend, etc */
+-			if (fotg210->rh_state < FOTG210_RH_RUNNING)
+-				last_status = -ESHUTDOWN;
+-
+-			/* this qtd is active; skip it unless a previous qtd
+-			 * for its urb faulted, or its urb was canceled.
+-			 */
+-			else if (last_status == -EINPROGRESS && !urb->unlinked)
+-				continue;
+-
+-			/* qh unlinked; token in overlay may be most current */
+-			if (state == QH_STATE_IDLE &&
+-					cpu_to_hc32(fotg210, qtd->qtd_dma)
+-					== hw->hw_current) {
+-				token = hc32_to_cpu(fotg210, hw->hw_token);
+-
+-				/* An unlink may leave an incomplete
+-				 * async transaction in the TT buffer.
+-				 * We have to clear it.
+-				 */
+-				fotg210_clear_tt_buffer(fotg210, qh, urb,
+-						token);
+-			}
+-		}
+-
+-		/* unless we already know the urb's status, collect qtd status
+-		 * and update count of bytes transferred.  in common short read
+-		 * cases with only one data qtd (including control transfers),
+-		 * queue processing won't halt.  but with two or more qtds (for
+-		 * example, with a 32 KB transfer), when the first qtd gets a
+-		 * short read the second must be removed by hand.
+-		 */
+-		if (last_status == -EINPROGRESS) {
+-			last_status = qtd_copy_status(fotg210, urb,
+-					qtd->length, token);
+-			if (last_status == -EREMOTEIO &&
+-					(qtd->hw_alt_next &
+-					FOTG210_LIST_END(fotg210)))
+-				last_status = -EINPROGRESS;
+-
+-			/* As part of low/full-speed endpoint-halt processing
+-			 * we must clear the TT buffer (11.17.5).
+-			 */
+-			if (unlikely(last_status != -EINPROGRESS &&
+-					last_status != -EREMOTEIO)) {
+-				/* The TT's in some hubs malfunction when they
+-				 * receive this request following a STALL (they
+-				 * stop sending isochronous packets).  Since a
+-				 * STALL can't leave the TT buffer in a busy
+-				 * state (if you believe Figures 11-48 - 11-51
+-				 * in the USB 2.0 spec), we won't clear the TT
+-				 * buffer in this case.  Strictly speaking this
+-				 * is a violation of the spec.
+-				 */
+-				if (last_status != -EPIPE)
+-					fotg210_clear_tt_buffer(fotg210, qh,
+-							urb, token);
+-			}
+-		}
+-
+-		/* if we're removing something not at the queue head,
+-		 * patch the hardware queue pointer.
+-		 */
+-		if (stopped && qtd->qtd_list.prev != &qh->qtd_list) {
+-			last = list_entry(qtd->qtd_list.prev,
+-					struct fotg210_qtd, qtd_list);
+-			last->hw_next = qtd->hw_next;
+-		}
+-
+-		/* remove qtd; it's recycled after possible urb completion */
+-		list_del(&qtd->qtd_list);
+-		last = qtd;
+-
+-		/* reinit the xacterr counter for the next qtd */
+-		qh->xacterrs = 0;
+-	}
+-
+-	/* last urb's completion might still need calling */
+-	if (likely(last != NULL)) {
+-		fotg210_urb_done(fotg210, last->urb, last_status);
+-		count++;
+-		fotg210_qtd_free(fotg210, last);
+-	}
+-
+-	/* Do we need to rescan for URBs dequeued during a giveback? */
+-	if (unlikely(qh->needs_rescan)) {
+-		/* If the QH is already unlinked, do the rescan now. */
+-		if (state == QH_STATE_IDLE)
+-			goto rescan;
+-
+-		/* Otherwise we have to wait until the QH is fully unlinked.
+-		 * Our caller will start an unlink if qh->needs_rescan is
+-		 * set.  But if an unlink has already started, nothing needs
+-		 * to be done.
+-		 */
+-		if (state != QH_STATE_LINKED)
+-			qh->needs_rescan = 0;
+-	}
+-
+-	/* restore original state; caller must unlink or relink */
+-	qh->qh_state = state;
+-
+-	/* be sure the hardware's done with the qh before refreshing
+-	 * it after fault cleanup, or recovering from silicon wrongly
+-	 * overlaying the dummy qtd (which reduces DMA chatter).
+-	 */
+-	if (stopped != 0 || hw->hw_qtd_next == FOTG210_LIST_END(fotg210)) {
+-		switch (state) {
+-		case QH_STATE_IDLE:
+-			qh_refresh(fotg210, qh);
+-			break;
+-		case QH_STATE_LINKED:
+-			/* We won't refresh a QH that's linked (after the HC
+-			 * stopped the queue).  That avoids a race:
+-			 *  - HC reads first part of QH;
+-			 *  - CPU updates that first part and the token;
+-			 *  - HC reads rest of that QH, including token
+-			 * Result:  HC gets an inconsistent image, and then
+-			 * DMAs to/from the wrong memory (corrupting it).
+-			 *
+-			 * That should be rare for interrupt transfers,
+-			 * except maybe high bandwidth ...
+-			 */
+-
+-			/* Tell the caller to start an unlink */
+-			qh->needs_rescan = 1;
+-			break;
+-		/* otherwise, unlink already started */
+-		}
+-	}
+-
+-	return count;
+-}
+-
+-/* reverse of qh_urb_transaction:  free a list of TDs.
+- * used for cleanup after errors, before HC sees an URB's TDs.
+- */
+-static void qtd_list_free(struct fotg210_hcd *fotg210, struct urb *urb,
+-		struct list_head *head)
+-{
+-	struct fotg210_qtd *qtd, *temp;
+-
+-	list_for_each_entry_safe(qtd, temp, head, qtd_list) {
+-		list_del(&qtd->qtd_list);
+-		fotg210_qtd_free(fotg210, qtd);
+-	}
+-}
+-
+-/* create a list of filled qtds for this URB; won't link into qh.
+- */
+-static struct list_head *qh_urb_transaction(struct fotg210_hcd *fotg210,
+-		struct urb *urb, struct list_head *head, gfp_t flags)
+-{
+-	struct fotg210_qtd *qtd, *qtd_prev;
+-	dma_addr_t buf;
+-	int len, this_sg_len, maxpacket;
+-	int is_input;
+-	u32 token;
+-	int i;
+-	struct scatterlist *sg;
+-
+-	/*
+-	 * URBs map to sequences of QTDs:  one logical transaction
+-	 */
+-	qtd = fotg210_qtd_alloc(fotg210, flags);
+-	if (unlikely(!qtd))
+-		return NULL;
+-	list_add_tail(&qtd->qtd_list, head);
+-	qtd->urb = urb;
+-
+-	token = QTD_STS_ACTIVE;
+-	token |= (FOTG210_TUNE_CERR << 10);
+-	/* for split transactions, SplitXState initialized to zero */
+-
+-	len = urb->transfer_buffer_length;
+-	is_input = usb_pipein(urb->pipe);
+-	if (usb_pipecontrol(urb->pipe)) {
+-		/* SETUP pid */
+-		qtd_fill(fotg210, qtd, urb->setup_dma,
+-				sizeof(struct usb_ctrlrequest),
+-				token | (2 /* "setup" */ << 8), 8);
+-
+-		/* ... and always at least one more pid */
+-		token ^= QTD_TOGGLE;
+-		qtd_prev = qtd;
+-		qtd = fotg210_qtd_alloc(fotg210, flags);
+-		if (unlikely(!qtd))
+-			goto cleanup;
+-		qtd->urb = urb;
+-		qtd_prev->hw_next = QTD_NEXT(fotg210, qtd->qtd_dma);
+-		list_add_tail(&qtd->qtd_list, head);
+-
+-		/* for zero length DATA stages, STATUS is always IN */
+-		if (len == 0)
+-			token |= (1 /* "in" */ << 8);
+-	}
+-
+-	/*
+-	 * data transfer stage:  buffer setup
+-	 */
+-	i = urb->num_mapped_sgs;
+-	if (len > 0 && i > 0) {
+-		sg = urb->sg;
+-		buf = sg_dma_address(sg);
+-
+-		/* urb->transfer_buffer_length may be smaller than the
+-		 * size of the scatterlist (or vice versa)
+-		 */
+-		this_sg_len = min_t(int, sg_dma_len(sg), len);
+-	} else {
+-		sg = NULL;
+-		buf = urb->transfer_dma;
+-		this_sg_len = len;
+-	}
+-
+-	if (is_input)
+-		token |= (1 /* "in" */ << 8);
+-	/* else it's already initted to "out" pid (0 << 8) */
+-
+-	maxpacket = usb_maxpacket(urb->dev, urb->pipe);
+-
+-	/*
+-	 * buffer gets wrapped in one or more qtds;
+-	 * last one may be "short" (including zero len)
+-	 * and may serve as a control status ack
+-	 */
+-	for (;;) {
+-		int this_qtd_len;
+-
+-		this_qtd_len = qtd_fill(fotg210, qtd, buf, this_sg_len, token,
+-				maxpacket);
+-		this_sg_len -= this_qtd_len;
+-		len -= this_qtd_len;
+-		buf += this_qtd_len;
+-
+-		/*
+-		 * short reads advance to a "magic" dummy instead of the next
+-		 * qtd ... that forces the queue to stop, for manual cleanup.
+-		 * (this will usually be overridden later.)
+-		 */
+-		if (is_input)
+-			qtd->hw_alt_next = fotg210->async->hw->hw_alt_next;
+-
+-		/* qh makes control packets use qtd toggle; maybe switch it */
+-		if ((maxpacket & (this_qtd_len + (maxpacket - 1))) == 0)
+-			token ^= QTD_TOGGLE;
+-
+-		if (likely(this_sg_len <= 0)) {
+-			if (--i <= 0 || len <= 0)
+-				break;
+-			sg = sg_next(sg);
+-			buf = sg_dma_address(sg);
+-			this_sg_len = min_t(int, sg_dma_len(sg), len);
+-		}
+-
+-		qtd_prev = qtd;
+-		qtd = fotg210_qtd_alloc(fotg210, flags);
+-		if (unlikely(!qtd))
+-			goto cleanup;
+-		qtd->urb = urb;
+-		qtd_prev->hw_next = QTD_NEXT(fotg210, qtd->qtd_dma);
+-		list_add_tail(&qtd->qtd_list, head);
+-	}
+-
+-	/*
+-	 * unless the caller requires manual cleanup after short reads,
+-	 * have the alt_next mechanism keep the queue running after the
+-	 * last data qtd (the only one, for control and most other cases).
+-	 */
+-	if (likely((urb->transfer_flags & URB_SHORT_NOT_OK) == 0 ||
+-			usb_pipecontrol(urb->pipe)))
+-		qtd->hw_alt_next = FOTG210_LIST_END(fotg210);
+-
+-	/*
+-	 * control requests may need a terminating data "status" ack;
+-	 * other OUT ones may need a terminating short packet
+-	 * (zero length).
+-	 */
+-	if (likely(urb->transfer_buffer_length != 0)) {
+-		int one_more = 0;
+-
+-		if (usb_pipecontrol(urb->pipe)) {
+-			one_more = 1;
+-			token ^= 0x0100;	/* "in" <--> "out"  */
+-			token |= QTD_TOGGLE;	/* force DATA1 */
+-		} else if (usb_pipeout(urb->pipe)
+-				&& (urb->transfer_flags & URB_ZERO_PACKET)
+-				&& !(urb->transfer_buffer_length % maxpacket)) {
+-			one_more = 1;
+-		}
+-		if (one_more) {
+-			qtd_prev = qtd;
+-			qtd = fotg210_qtd_alloc(fotg210, flags);
+-			if (unlikely(!qtd))
+-				goto cleanup;
+-			qtd->urb = urb;
+-			qtd_prev->hw_next = QTD_NEXT(fotg210, qtd->qtd_dma);
+-			list_add_tail(&qtd->qtd_list, head);
+-
+-			/* never any data in such packets */
+-			qtd_fill(fotg210, qtd, 0, 0, token, 0);
+-		}
+-	}
+-
+-	/* by default, enable interrupt on urb completion */
+-	if (likely(!(urb->transfer_flags & URB_NO_INTERRUPT)))
+-		qtd->hw_token |= cpu_to_hc32(fotg210, QTD_IOC);
+-	return head;
+-
+-cleanup:
+-	qtd_list_free(fotg210, urb, head);
+-	return NULL;
+-}
+-
+-/* Would be best to create all qh's from config descriptors,
+- * when each interface/altsetting is established.  Unlink
+- * any previous qh and cancel its urbs first; endpoints are
+- * implicitly reset then (data toggle too).
+- * That'd mean updating how usbcore talks to HCDs. (2.7?)
+- */
+-
+-
+-/* Each QH holds a qtd list; a QH is used for everything except iso.
+- *
+- * For interrupt urbs, the scheduler must set the microframe scheduling
+- * mask(s) each time the QH gets scheduled.  For highspeed, that's
+- * just one microframe in the s-mask.  For split interrupt transactions
+- * there are additional complications: c-mask, maybe FSTNs.
+- */
+-static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb,
+-		gfp_t flags)
+-{
+-	struct fotg210_qh *qh = fotg210_qh_alloc(fotg210, flags);
+-	struct usb_host_endpoint *ep;
+-	u32 info1 = 0, info2 = 0;
+-	int is_input, type;
+-	int maxp = 0;
+-	int mult;
+-	struct usb_tt *tt = urb->dev->tt;
+-	struct fotg210_qh_hw *hw;
+-
+-	if (!qh)
+-		return qh;
+-
+-	/*
+-	 * init endpoint/device data for this QH
+-	 */
+-	info1 |= usb_pipeendpoint(urb->pipe) << 8;
+-	info1 |= usb_pipedevice(urb->pipe) << 0;
+-
+-	is_input = usb_pipein(urb->pipe);
+-	type = usb_pipetype(urb->pipe);
+-	ep = usb_pipe_endpoint(urb->dev, urb->pipe);
+-	maxp = usb_endpoint_maxp(&ep->desc);
+-	mult = usb_endpoint_maxp_mult(&ep->desc);
+-
+-	/* 1024 byte maxpacket is a hardware ceiling.  High bandwidth
+-	 * acts like up to 3KB, but is built from smaller packets.
+-	 */
+-	if (maxp > 1024) {
+-		fotg210_dbg(fotg210, "bogus qh maxpacket %d\n", maxp);
+-		goto done;
+-	}
+-
+-	/* Compute interrupt scheduling parameters just once, and save.
+-	 * - allowing for high bandwidth, how many nsec/uframe are used?
+-	 * - split transactions need a second CSPLIT uframe; same question
+-	 * - splits also need a schedule gap (for full/low speed I/O)
+-	 * - qh has a polling interval
+-	 *
+-	 * For control/bulk requests, the HC or TT handles these.
+-	 */
+-	if (type == PIPE_INTERRUPT) {
+-		qh->usecs = NS_TO_US(usb_calc_bus_time(USB_SPEED_HIGH,
+-				is_input, 0, mult * maxp));
+-		qh->start = NO_FRAME;
+-
+-		if (urb->dev->speed == USB_SPEED_HIGH) {
+-			qh->c_usecs = 0;
+-			qh->gap_uf = 0;
+-
+-			qh->period = urb->interval >> 3;
+-			if (qh->period == 0 && urb->interval != 1) {
+-				/* NOTE interval 2 or 4 uframes could work.
+-				 * But interval 1 scheduling is simpler, and
+-				 * includes high bandwidth.
+-				 */
+-				urb->interval = 1;
+-			} else if (qh->period > fotg210->periodic_size) {
+-				qh->period = fotg210->periodic_size;
+-				urb->interval = qh->period << 3;
+-			}
+-		} else {
+-			int think_time;
+-
+-			/* gap is f(FS/LS transfer times) */
+-			qh->gap_uf = 1 + usb_calc_bus_time(urb->dev->speed,
+-					is_input, 0, maxp) / (125 * 1000);
+-
+-			/* FIXME this just approximates SPLIT/CSPLIT times */
+-			if (is_input) {		/* SPLIT, gap, CSPLIT+DATA */
+-				qh->c_usecs = qh->usecs + HS_USECS(0);
+-				qh->usecs = HS_USECS(1);
+-			} else {		/* SPLIT+DATA, gap, CSPLIT */
+-				qh->usecs += HS_USECS(1);
+-				qh->c_usecs = HS_USECS(0);
+-			}
+-
+-			think_time = tt ? tt->think_time : 0;
+-			qh->tt_usecs = NS_TO_US(think_time +
+-					usb_calc_bus_time(urb->dev->speed,
+-					is_input, 0, maxp));
+-			qh->period = urb->interval;
+-			if (qh->period > fotg210->periodic_size) {
+-				qh->period = fotg210->periodic_size;
+-				urb->interval = qh->period;
+-			}
+-		}
+-	}
+-
+-	/* support for tt scheduling, and access to toggles */
+-	qh->dev = urb->dev;
+-
+-	/* using TT? */
+-	switch (urb->dev->speed) {
+-	case USB_SPEED_LOW:
+-		info1 |= QH_LOW_SPEED;
+-		fallthrough;
+-
+-	case USB_SPEED_FULL:
+-		/* EPS 0 means "full" */
+-		if (type != PIPE_INTERRUPT)
+-			info1 |= (FOTG210_TUNE_RL_TT << 28);
+-		if (type == PIPE_CONTROL) {
+-			info1 |= QH_CONTROL_EP;		/* for TT */
+-			info1 |= QH_TOGGLE_CTL;		/* toggle from qtd */
+-		}
+-		info1 |= maxp << 16;
+-
+-		info2 |= (FOTG210_TUNE_MULT_TT << 30);
+-
+-		/* Some Freescale processors have an erratum in which the
+-		 * port number in the queue head was 0..N-1 instead of 1..N.
+-		 */
+-		if (fotg210_has_fsl_portno_bug(fotg210))
+-			info2 |= (urb->dev->ttport-1) << 23;
+-		else
+-			info2 |= urb->dev->ttport << 23;
+-
+-		/* set the address of the TT; for TDI's integrated
+-		 * root hub tt, leave it zeroed.
+-		 */
+-		if (tt && tt->hub != fotg210_to_hcd(fotg210)->self.root_hub)
+-			info2 |= tt->hub->devnum << 16;
+-
+-		/* NOTE:  if (PIPE_INTERRUPT) { scheduler sets c-mask } */
+-
+-		break;
+-
+-	case USB_SPEED_HIGH:		/* no TT involved */
+-		info1 |= QH_HIGH_SPEED;
+-		if (type == PIPE_CONTROL) {
+-			info1 |= (FOTG210_TUNE_RL_HS << 28);
+-			info1 |= 64 << 16;	/* usb2 fixed maxpacket */
+-			info1 |= QH_TOGGLE_CTL;	/* toggle from qtd */
+-			info2 |= (FOTG210_TUNE_MULT_HS << 30);
+-		} else if (type == PIPE_BULK) {
+-			info1 |= (FOTG210_TUNE_RL_HS << 28);
+-			/* The USB spec says that high speed bulk endpoints
+-			 * always use 512 byte maxpacket.  But some device
+-			 * vendors decided to ignore that, and MSFT is happy
+-			 * to help them do so.  So now people expect to use
+-			 * such nonconformant devices with Linux too; sigh.
+-			 */
+-			info1 |= maxp << 16;
+-			info2 |= (FOTG210_TUNE_MULT_HS << 30);
+-		} else {		/* PIPE_INTERRUPT */
+-			info1 |= maxp << 16;
+-			info2 |= mult << 30;
+-		}
+-		break;
+-	default:
+-		fotg210_dbg(fotg210, "bogus dev %p speed %d\n", urb->dev,
+-				urb->dev->speed);
+-done:
+-		qh_destroy(fotg210, qh);
+-		return NULL;
+-	}
+-
+-	/* NOTE:  if (PIPE_INTERRUPT) { scheduler sets s-mask } */
+-
+-	/* init as live, toggle clear, advance to dummy */
+-	qh->qh_state = QH_STATE_IDLE;
+-	hw = qh->hw;
+-	hw->hw_info1 = cpu_to_hc32(fotg210, info1);
+-	hw->hw_info2 = cpu_to_hc32(fotg210, info2);
+-	qh->is_out = !is_input;
+-	usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe), !is_input, 1);
+-	qh_refresh(fotg210, qh);
+-	return qh;
+-}
+-
+-static void enable_async(struct fotg210_hcd *fotg210)
+-{
+-	if (fotg210->async_count++)
+-		return;
+-
+-	/* Stop waiting to turn off the async schedule */
+-	fotg210->enabled_hrtimer_events &= ~BIT(FOTG210_HRTIMER_DISABLE_ASYNC);
+-
+-	/* Don't start the schedule until ASS is 0 */
+-	fotg210_poll_ASS(fotg210);
+-	turn_on_io_watchdog(fotg210);
+-}
+-
+-static void disable_async(struct fotg210_hcd *fotg210)
+-{
+-	if (--fotg210->async_count)
+-		return;
+-
+-	/* The async schedule and async_unlink list are supposed to be empty */
+-	WARN_ON(fotg210->async->qh_next.qh || fotg210->async_unlink);
+-
+-	/* Don't turn off the schedule until ASS is 1 */
+-	fotg210_poll_ASS(fotg210);
+-}
+-
+-/* move qh (and its qtds) onto async queue; maybe enable queue.  */
+-
+-static void qh_link_async(struct fotg210_hcd *fotg210, struct fotg210_qh *qh)
+-{
+-	__hc32 dma = QH_NEXT(fotg210, qh->qh_dma);
+-	struct fotg210_qh *head;
+-
+-	/* Don't link a QH if there's a Clear-TT-Buffer pending */
+-	if (unlikely(qh->clearing_tt))
+-		return;
+-
+-	WARN_ON(qh->qh_state != QH_STATE_IDLE);
+-
+-	/* clear halt and/or toggle; and maybe recover from silicon quirk */
+-	qh_refresh(fotg210, qh);
+-
+-	/* splice right after start */
+-	head = fotg210->async;
+-	qh->qh_next = head->qh_next;
+-	qh->hw->hw_next = head->hw->hw_next;
+-	wmb();
+-
+-	head->qh_next.qh = qh;
+-	head->hw->hw_next = dma;
+-
+-	qh->xacterrs = 0;
+-	qh->qh_state = QH_STATE_LINKED;
+-	/* qtd completions reported later by interrupt */
+-
+-	enable_async(fotg210);
+-}
+-
+-/* For control/bulk/interrupt, return QH with these TDs appended.
+- * Allocates and initializes the QH if necessary.
+- * Returns null if it can't allocate a QH it needs to.
+- * If the QH has TDs (urbs) already, that's great.
+- */
+-static struct fotg210_qh *qh_append_tds(struct fotg210_hcd *fotg210,
+-		struct urb *urb, struct list_head *qtd_list,
+-		int epnum, void **ptr)
+-{
+-	struct fotg210_qh *qh = NULL;
+-	__hc32 qh_addr_mask = cpu_to_hc32(fotg210, 0x7f);
+-
+-	qh = (struct fotg210_qh *) *ptr;
+-	if (unlikely(qh == NULL)) {
+-		/* can't sleep here, we have fotg210->lock... */
+-		qh = qh_make(fotg210, urb, GFP_ATOMIC);
+-		*ptr = qh;
+-	}
+-	if (likely(qh != NULL)) {
+-		struct fotg210_qtd *qtd;
+-
+-		if (unlikely(list_empty(qtd_list)))
+-			qtd = NULL;
+-		else
+-			qtd = list_entry(qtd_list->next, struct fotg210_qtd,
+-					qtd_list);
+-
+-		/* control qh may need patching ... */
+-		if (unlikely(epnum == 0)) {
+-			/* usb_reset_device() briefly reverts to address 0 */
+-			if (usb_pipedevice(urb->pipe) == 0)
+-				qh->hw->hw_info1 &= ~qh_addr_mask;
+-		}
+-
+-		/* just one way to queue requests: swap with the dummy qtd.
+-		 * only hc or qh_refresh() ever modify the overlay.
+-		 */
+-		if (likely(qtd != NULL)) {
+-			struct fotg210_qtd *dummy;
+-			dma_addr_t dma;
+-			__hc32 token;
+-
+-			/* to avoid racing the HC, use the dummy td instead of
+-			 * the first td of our list (becomes new dummy).  both
+-			 * tds stay deactivated until we're done, when the
+-			 * HC is allowed to fetch the old dummy (4.10.2).
+-			 */
+-			token = qtd->hw_token;
+-			qtd->hw_token = HALT_BIT(fotg210);
+-
+-			dummy = qh->dummy;
+-
+-			dma = dummy->qtd_dma;
+-			*dummy = *qtd;
+-			dummy->qtd_dma = dma;
+-
+-			list_del(&qtd->qtd_list);
+-			list_add(&dummy->qtd_list, qtd_list);
+-			list_splice_tail(qtd_list, &qh->qtd_list);
+-
+-			fotg210_qtd_init(fotg210, qtd, qtd->qtd_dma);
+-			qh->dummy = qtd;
+-
+-			/* hc must see the new dummy at list end */
+-			dma = qtd->qtd_dma;
+-			qtd = list_entry(qh->qtd_list.prev,
+-					struct fotg210_qtd, qtd_list);
+-			qtd->hw_next = QTD_NEXT(fotg210, dma);
+-
+-			/* let the hc process these next qtds */
+-			wmb();
+-			dummy->hw_token = token;
+-
+-			urb->hcpriv = qh;
+-		}
+-	}
+-	return qh;
+-}
+-
+-static int submit_async(struct fotg210_hcd *fotg210, struct urb *urb,
+-		struct list_head *qtd_list, gfp_t mem_flags)
+-{
+-	int epnum;
+-	unsigned long flags;
+-	struct fotg210_qh *qh = NULL;
+-	int rc;
+-
+-	epnum = urb->ep->desc.bEndpointAddress;
+-
+-#ifdef FOTG210_URB_TRACE
+-	{
+-		struct fotg210_qtd *qtd;
+-
+-		qtd = list_entry(qtd_list->next, struct fotg210_qtd, qtd_list);
+-		fotg210_dbg(fotg210,
+-				"%s %s urb %p ep%d%s len %d, qtd %p [qh %p]\n",
+-				__func__, urb->dev->devpath, urb,
+-				epnum & 0x0f, (epnum & USB_DIR_IN)
+-					? "in" : "out",
+-				urb->transfer_buffer_length,
+-				qtd, urb->ep->hcpriv);
+-	}
+-#endif
+-
+-	spin_lock_irqsave(&fotg210->lock, flags);
+-	if (unlikely(!HCD_HW_ACCESSIBLE(fotg210_to_hcd(fotg210)))) {
+-		rc = -ESHUTDOWN;
+-		goto done;
+-	}
+-	rc = usb_hcd_link_urb_to_ep(fotg210_to_hcd(fotg210), urb);
+-	if (unlikely(rc))
+-		goto done;
+-
+-	qh = qh_append_tds(fotg210, urb, qtd_list, epnum, &urb->ep->hcpriv);
+-	if (unlikely(qh == NULL)) {
+-		usb_hcd_unlink_urb_from_ep(fotg210_to_hcd(fotg210), urb);
+-		rc = -ENOMEM;
+-		goto done;
+-	}
+-
+-	/* Control/bulk operations through TTs don't need scheduling,
+-	 * the HC and TT handle it when the TT has a buffer ready.
+-	 */
+-	if (likely(qh->qh_state == QH_STATE_IDLE))
+-		qh_link_async(fotg210, qh);
+-done:
+-	spin_unlock_irqrestore(&fotg210->lock, flags);
+-	if (unlikely(qh == NULL))
+-		qtd_list_free(fotg210, urb, qtd_list);
+-	return rc;
+-}
+-
+-static void single_unlink_async(struct fotg210_hcd *fotg210,
+-		struct fotg210_qh *qh)
+-{
+-	struct fotg210_qh *prev;
+-
+-	/* Add to the end of the list of QHs waiting for the next IAAD */
+-	qh->qh_state = QH_STATE_UNLINK;
+-	if (fotg210->async_unlink)
+-		fotg210->async_unlink_last->unlink_next = qh;
+-	else
+-		fotg210->async_unlink = qh;
+-	fotg210->async_unlink_last = qh;
+-
+-	/* Unlink it from the schedule */
+-	prev = fotg210->async;
+-	while (prev->qh_next.qh != qh)
+-		prev = prev->qh_next.qh;
+-
+-	prev->hw->hw_next = qh->hw->hw_next;
+-	prev->qh_next = qh->qh_next;
+-	if (fotg210->qh_scan_next == qh)
+-		fotg210->qh_scan_next = qh->qh_next.qh;
+-}
+-
+-static void start_iaa_cycle(struct fotg210_hcd *fotg210, bool nested)
+-{
+-	/*
+-	 * Do nothing if an IAA cycle is already running or
+-	 * if one will be started shortly.
+-	 */
+-	if (fotg210->async_iaa || fotg210->async_unlinking)
+-		return;
+-
+-	/* Do all the waiting QHs at once */
+-	fotg210->async_iaa = fotg210->async_unlink;
+-	fotg210->async_unlink = NULL;
+-
+-	/* If the controller isn't running, we don't have to wait for it */
+-	if (unlikely(fotg210->rh_state < FOTG210_RH_RUNNING)) {
+-		if (!nested)		/* Avoid recursion */
+-			end_unlink_async(fotg210);
+-
+-	/* Otherwise start a new IAA cycle */
+-	} else if (likely(fotg210->rh_state == FOTG210_RH_RUNNING)) {
+-		/* Make sure the unlinks are all visible to the hardware */
+-		wmb();
+-
+-		fotg210_writel(fotg210, fotg210->command | CMD_IAAD,
+-				&fotg210->regs->command);
+-		fotg210_readl(fotg210, &fotg210->regs->command);
+-		fotg210_enable_event(fotg210, FOTG210_HRTIMER_IAA_WATCHDOG,
+-				true);
+-	}
+-}
+-
+-/* the async qh for the qtds being unlinked are now gone from the HC */
+-
+-static void end_unlink_async(struct fotg210_hcd *fotg210)
+-{
+-	struct fotg210_qh *qh;
+-
+-	/* Process the idle QHs */
+-restart:
+-	fotg210->async_unlinking = true;
+-	while (fotg210->async_iaa) {
+-		qh = fotg210->async_iaa;
+-		fotg210->async_iaa = qh->unlink_next;
+-		qh->unlink_next = NULL;
+-
+-		qh->qh_state = QH_STATE_IDLE;
+-		qh->qh_next.qh = NULL;
+-
+-		qh_completions(fotg210, qh);
+-		if (!list_empty(&qh->qtd_list) &&
+-				fotg210->rh_state == FOTG210_RH_RUNNING)
+-			qh_link_async(fotg210, qh);
+-		disable_async(fotg210);
+-	}
+-	fotg210->async_unlinking = false;
+-
+-	/* Start a new IAA cycle if any QHs are waiting for it */
+-	if (fotg210->async_unlink) {
+-		start_iaa_cycle(fotg210, true);
+-		if (unlikely(fotg210->rh_state < FOTG210_RH_RUNNING))
+-			goto restart;
+-	}
+-}
+-
+-static void unlink_empty_async(struct fotg210_hcd *fotg210)
+-{
+-	struct fotg210_qh *qh, *next;
+-	bool stopped = (fotg210->rh_state < FOTG210_RH_RUNNING);
+-	bool check_unlinks_later = false;
+-
+-	/* Unlink all the async QHs that have been empty for a timer cycle */
+-	next = fotg210->async->qh_next.qh;
+-	while (next) {
+-		qh = next;
+-		next = qh->qh_next.qh;
+-
+-		if (list_empty(&qh->qtd_list) &&
+-				qh->qh_state == QH_STATE_LINKED) {
+-			if (!stopped && qh->unlink_cycle ==
+-					fotg210->async_unlink_cycle)
+-				check_unlinks_later = true;
+-			else
+-				single_unlink_async(fotg210, qh);
+-		}
+-	}
+-
+-	/* Start a new IAA cycle if any QHs are waiting for it */
+-	if (fotg210->async_unlink)
+-		start_iaa_cycle(fotg210, false);
+-
+-	/* QHs that haven't been empty for long enough will be handled later */
+-	if (check_unlinks_later) {
+-		fotg210_enable_event(fotg210, FOTG210_HRTIMER_ASYNC_UNLINKS,
+-				true);
+-		++fotg210->async_unlink_cycle;
+-	}
+-}
+-
+-/* makes sure the async qh will become idle */
+-/* caller must own fotg210->lock */
+-
+-static void start_unlink_async(struct fotg210_hcd *fotg210,
+-		struct fotg210_qh *qh)
+-{
+-	/*
+-	 * If the QH isn't linked then there's nothing we can do
+-	 * unless we were called during a giveback, in which case
+-	 * qh_completions() has to deal with it.
+-	 */
+-	if (qh->qh_state != QH_STATE_LINKED) {
+-		if (qh->qh_state == QH_STATE_COMPLETING)
+-			qh->needs_rescan = 1;
+-		return;
+-	}
+-
+-	single_unlink_async(fotg210, qh);
+-	start_iaa_cycle(fotg210, false);
+-}
+-
+-static void scan_async(struct fotg210_hcd *fotg210)
+-{
+-	struct fotg210_qh *qh;
+-	bool check_unlinks_later = false;
+-
+-	fotg210->qh_scan_next = fotg210->async->qh_next.qh;
+-	while (fotg210->qh_scan_next) {
+-		qh = fotg210->qh_scan_next;
+-		fotg210->qh_scan_next = qh->qh_next.qh;
+-rescan:
+-		/* clean any finished work for this qh */
+-		if (!list_empty(&qh->qtd_list)) {
+-			int temp;
+-
+-			/*
+-			 * Unlinks could happen here; completion reporting
+-			 * drops the lock.  That's why fotg210->qh_scan_next
+-			 * always holds the next qh to scan; if the next qh
+-			 * gets unlinked then fotg210->qh_scan_next is adjusted
+-			 * in single_unlink_async().
+-			 */
+-			temp = qh_completions(fotg210, qh);
+-			if (qh->needs_rescan) {
+-				start_unlink_async(fotg210, qh);
+-			} else if (list_empty(&qh->qtd_list)
+-					&& qh->qh_state == QH_STATE_LINKED) {
+-				qh->unlink_cycle = fotg210->async_unlink_cycle;
+-				check_unlinks_later = true;
+-			} else if (temp != 0)
+-				goto rescan;
+-		}
+-	}
+-
+-	/*
+-	 * Unlink empty entries, reducing DMA usage as well
+-	 * as HCD schedule-scanning costs.  Delay for any qh
+-	 * we just scanned, there's a not-unusual case that it
+-	 * doesn't stay idle for long.
+-	 */
+-	if (check_unlinks_later && fotg210->rh_state == FOTG210_RH_RUNNING &&
+-			!(fotg210->enabled_hrtimer_events &
+-			BIT(FOTG210_HRTIMER_ASYNC_UNLINKS))) {
+-		fotg210_enable_event(fotg210,
+-				FOTG210_HRTIMER_ASYNC_UNLINKS, true);
+-		++fotg210->async_unlink_cycle;
+-	}
+-}
+-/* EHCI scheduled transaction support:  interrupt, iso, split iso
+- * These are called "periodic" transactions in the EHCI spec.
+- *
+- * Note that for interrupt transfers, the QH/QTD manipulation is shared
+- * with the "asynchronous" transaction support (control/bulk transfers).
+- * The only real difference is in how interrupt transfers are scheduled.
+- *
+- * For ISO, we make an "iso_stream" head to serve the same role as a QH.
+- * It keeps track of every ITD (or SITD) that's linked, and holds enough
+- * pre-calculated schedule data to make appending to the queue be quick.
+- */
+-static int fotg210_get_frame(struct usb_hcd *hcd);
+-
+-/* periodic_next_shadow - return "next" pointer on shadow list
+- * @periodic: host pointer to qh/itd
+- * @tag: hardware tag for type of this record
+- */
+-static union fotg210_shadow *periodic_next_shadow(struct fotg210_hcd *fotg210,
+-		union fotg210_shadow *periodic, __hc32 tag)
+-{
+-	switch (hc32_to_cpu(fotg210, tag)) {
+-	case Q_TYPE_QH:
+-		return &periodic->qh->qh_next;
+-	case Q_TYPE_FSTN:
+-		return &periodic->fstn->fstn_next;
+-	default:
+-		return &periodic->itd->itd_next;
+-	}
+-}
+-
+-static __hc32 *shadow_next_periodic(struct fotg210_hcd *fotg210,
+-		union fotg210_shadow *periodic, __hc32 tag)
+-{
+-	switch (hc32_to_cpu(fotg210, tag)) {
+-	/* our fotg210_shadow.qh is actually software part */
+-	case Q_TYPE_QH:
+-		return &periodic->qh->hw->hw_next;
+-	/* others are hw parts */
+-	default:
+-		return periodic->hw_next;
+-	}
+-}
+-
+-/* caller must hold fotg210->lock */
+-static void periodic_unlink(struct fotg210_hcd *fotg210, unsigned frame,
+-		void *ptr)
+-{
+-	union fotg210_shadow *prev_p = &fotg210->pshadow[frame];
+-	__hc32 *hw_p = &fotg210->periodic[frame];
+-	union fotg210_shadow here = *prev_p;
+-
+-	/* find predecessor of "ptr"; hw and shadow lists are in sync */
+-	while (here.ptr && here.ptr != ptr) {
+-		prev_p = periodic_next_shadow(fotg210, prev_p,
+-				Q_NEXT_TYPE(fotg210, *hw_p));
+-		hw_p = shadow_next_periodic(fotg210, &here,
+-				Q_NEXT_TYPE(fotg210, *hw_p));
+-		here = *prev_p;
+-	}
+-	/* an interrupt entry (at list end) could have been shared */
+-	if (!here.ptr)
+-		return;
+-
+-	/* update shadow and hardware lists ... the old "next" pointers
+-	 * from ptr may still be in use, the caller updates them.
+-	 */
+-	*prev_p = *periodic_next_shadow(fotg210, &here,
+-			Q_NEXT_TYPE(fotg210, *hw_p));
+-
+-	*hw_p = *shadow_next_periodic(fotg210, &here,
+-			Q_NEXT_TYPE(fotg210, *hw_p));
+-}
+-
+-/* how many of the uframe's 125 usecs are allocated? */
+-static unsigned short periodic_usecs(struct fotg210_hcd *fotg210,
+-		unsigned frame, unsigned uframe)
+-{
+-	__hc32 *hw_p = &fotg210->periodic[frame];
+-	union fotg210_shadow *q = &fotg210->pshadow[frame];
+-	unsigned usecs = 0;
+-	struct fotg210_qh_hw *hw;
+-
+-	while (q->ptr) {
+-		switch (hc32_to_cpu(fotg210, Q_NEXT_TYPE(fotg210, *hw_p))) {
+-		case Q_TYPE_QH:
+-			hw = q->qh->hw;
+-			/* is it in the S-mask? */
+-			if (hw->hw_info2 & cpu_to_hc32(fotg210, 1 << uframe))
+-				usecs += q->qh->usecs;
+-			/* ... or C-mask? */
+-			if (hw->hw_info2 & cpu_to_hc32(fotg210,
+-					1 << (8 + uframe)))
+-				usecs += q->qh->c_usecs;
+-			hw_p = &hw->hw_next;
+-			q = &q->qh->qh_next;
+-			break;
+-		/* case Q_TYPE_FSTN: */
+-		default:
+-			/* for "save place" FSTNs, count the relevant INTR
+-			 * bandwidth from the previous frame
+-			 */
+-			if (q->fstn->hw_prev != FOTG210_LIST_END(fotg210))
+-				fotg210_dbg(fotg210, "ignoring FSTN cost ...\n");
+-
+-			hw_p = &q->fstn->hw_next;
+-			q = &q->fstn->fstn_next;
+-			break;
+-		case Q_TYPE_ITD:
+-			if (q->itd->hw_transaction[uframe])
+-				usecs += q->itd->stream->usecs;
+-			hw_p = &q->itd->hw_next;
+-			q = &q->itd->itd_next;
+-			break;
+-		}
+-	}
+-	if (usecs > fotg210->uframe_periodic_max)
+-		fotg210_err(fotg210, "uframe %d sched overrun: %d usecs\n",
+-				frame * 8 + uframe, usecs);
+-	return usecs;
+-}
+-
+-static int same_tt(struct usb_device *dev1, struct usb_device *dev2)
+-{
+-	if (!dev1->tt || !dev2->tt)
+-		return 0;
+-	if (dev1->tt != dev2->tt)
+-		return 0;
+-	if (dev1->tt->multi)
+-		return dev1->ttport == dev2->ttport;
+-	else
+-		return 1;
+-}
+-
+-/* return true iff the device's transaction translator is available
+- * for a periodic transfer starting at the specified frame, using
+- * all the uframes in the mask.
+- */
+-static int tt_no_collision(struct fotg210_hcd *fotg210, unsigned period,
+-		struct usb_device *dev, unsigned frame, u32 uf_mask)
+-{
+-	if (period == 0)	/* error */
+-		return 0;
+-
+-	/* note bandwidth wastage:  split never follows csplit
+-	 * (different dev or endpoint) until the next uframe.
+-	 * calling convention doesn't make that distinction.
+-	 */
+-	for (; frame < fotg210->periodic_size; frame += period) {
+-		union fotg210_shadow here;
+-		__hc32 type;
+-		struct fotg210_qh_hw *hw;
+-
+-		here = fotg210->pshadow[frame];
+-		type = Q_NEXT_TYPE(fotg210, fotg210->periodic[frame]);
+-		while (here.ptr) {
+-			switch (hc32_to_cpu(fotg210, type)) {
+-			case Q_TYPE_ITD:
+-				type = Q_NEXT_TYPE(fotg210, here.itd->hw_next);
+-				here = here.itd->itd_next;
+-				continue;
+-			case Q_TYPE_QH:
+-				hw = here.qh->hw;
+-				if (same_tt(dev, here.qh->dev)) {
+-					u32 mask;
+-
+-					mask = hc32_to_cpu(fotg210,
+-							hw->hw_info2);
+-					/* "knows" no gap is needed */
+-					mask |= mask >> 8;
+-					if (mask & uf_mask)
+-						break;
+-				}
+-				type = Q_NEXT_TYPE(fotg210, hw->hw_next);
+-				here = here.qh->qh_next;
+-				continue;
+-			/* case Q_TYPE_FSTN: */
+-			default:
+-				fotg210_dbg(fotg210,
+-						"periodic frame %d bogus type %d\n",
+-						frame, type);
+-			}
+-
+-			/* collision or error */
+-			return 0;
+-		}
+-	}
+-
+-	/* no collision */
+-	return 1;
+-}
+-
+-static void enable_periodic(struct fotg210_hcd *fotg210)
+-{
+-	if (fotg210->periodic_count++)
+-		return;
+-
+-	/* Stop waiting to turn off the periodic schedule */
+-	fotg210->enabled_hrtimer_events &=
+-		~BIT(FOTG210_HRTIMER_DISABLE_PERIODIC);
+-
+-	/* Don't start the schedule until PSS is 0 */
+-	fotg210_poll_PSS(fotg210);
+-	turn_on_io_watchdog(fotg210);
+-}
+-
+-static void disable_periodic(struct fotg210_hcd *fotg210)
+-{
+-	if (--fotg210->periodic_count)
+-		return;
+-
+-	/* Don't turn off the schedule until PSS is 1 */
+-	fotg210_poll_PSS(fotg210);
+-}
+-
+-/* periodic schedule slots have iso tds (normal or split) first, then a
+- * sparse tree for active interrupt transfers.
+- *
+- * this just links in a qh; caller guarantees uframe masks are set right.
+- * no FSTN support (yet; fotg210 0.96+)
+- */
+-static void qh_link_periodic(struct fotg210_hcd *fotg210, struct fotg210_qh *qh)
+-{
+-	unsigned i;
+-	unsigned period = qh->period;
+-
+-	dev_dbg(&qh->dev->dev,
+-			"link qh%d-%04x/%p start %d [%d/%d us]\n", period,
+-			hc32_to_cpup(fotg210, &qh->hw->hw_info2) &
+-			(QH_CMASK | QH_SMASK), qh, qh->start, qh->usecs,
+-			qh->c_usecs);
+-
+-	/* high bandwidth, or otherwise every microframe */
+-	if (period == 0)
+-		period = 1;
+-
+-	for (i = qh->start; i < fotg210->periodic_size; i += period) {
+-		union fotg210_shadow *prev = &fotg210->pshadow[i];
+-		__hc32 *hw_p = &fotg210->periodic[i];
+-		union fotg210_shadow here = *prev;
+-		__hc32 type = 0;
+-
+-		/* skip the iso nodes at list head */
+-		while (here.ptr) {
+-			type = Q_NEXT_TYPE(fotg210, *hw_p);
+-			if (type == cpu_to_hc32(fotg210, Q_TYPE_QH))
+-				break;
+-			prev = periodic_next_shadow(fotg210, prev, type);
+-			hw_p = shadow_next_periodic(fotg210, &here, type);
+-			here = *prev;
+-		}
+-
+-		/* sorting each branch by period (slow-->fast)
+-		 * enables sharing interior tree nodes
+-		 */
+-		while (here.ptr && qh != here.qh) {
+-			if (qh->period > here.qh->period)
+-				break;
+-			prev = &here.qh->qh_next;
+-			hw_p = &here.qh->hw->hw_next;
+-			here = *prev;
+-		}
+-		/* link in this qh, unless some earlier pass did that */
+-		if (qh != here.qh) {
+-			qh->qh_next = here;
+-			if (here.qh)
+-				qh->hw->hw_next = *hw_p;
+-			wmb();
+-			prev->qh = qh;
+-			*hw_p = QH_NEXT(fotg210, qh->qh_dma);
+-		}
+-	}
+-	qh->qh_state = QH_STATE_LINKED;
+-	qh->xacterrs = 0;
+-
+-	/* update per-qh bandwidth for usbfs */
+-	fotg210_to_hcd(fotg210)->self.bandwidth_allocated += qh->period
+-		? ((qh->usecs + qh->c_usecs) / qh->period)
+-		: (qh->usecs * 8);
+-
+-	list_add(&qh->intr_node, &fotg210->intr_qh_list);
+-
+-	/* maybe enable periodic schedule processing */
+-	++fotg210->intr_count;
+-	enable_periodic(fotg210);
+-}
+-
+-static void qh_unlink_periodic(struct fotg210_hcd *fotg210,
+-		struct fotg210_qh *qh)
+-{
+-	unsigned i;
+-	unsigned period;
+-
+-	/*
+-	 * If qh is for a low/full-speed device, simply unlinking it
+-	 * could interfere with an ongoing split transaction.  To unlink
+-	 * it safely would require setting the QH_INACTIVATE bit and
+-	 * waiting at least one frame, as described in EHCI 4.12.2.5.
+-	 *
+-	 * We won't bother with any of this.  Instead, we assume that the
+-	 * only reason for unlinking an interrupt QH while the current URB
+-	 * is still active is to dequeue all the URBs (flush the whole
+-	 * endpoint queue).
+-	 *
+-	 * If rebalancing the periodic schedule is ever implemented, this
+-	 * approach will no longer be valid.
+-	 */
+-
+-	/* high bandwidth, or otherwise part of every microframe */
+-	period = qh->period;
+-	if (!period)
+-		period = 1;
+-
+-	for (i = qh->start; i < fotg210->periodic_size; i += period)
+-		periodic_unlink(fotg210, i, qh);
+-
+-	/* update per-qh bandwidth for usbfs */
+-	fotg210_to_hcd(fotg210)->self.bandwidth_allocated -= qh->period
+-		? ((qh->usecs + qh->c_usecs) / qh->period)
+-		: (qh->usecs * 8);
+-
+-	dev_dbg(&qh->dev->dev,
+-			"unlink qh%d-%04x/%p start %d [%d/%d us]\n",
+-			qh->period, hc32_to_cpup(fotg210, &qh->hw->hw_info2) &
+-			(QH_CMASK | QH_SMASK), qh, qh->start, qh->usecs,
+-			qh->c_usecs);
+-
+-	/* qh->qh_next still "live" to HC */
+-	qh->qh_state = QH_STATE_UNLINK;
+-	qh->qh_next.ptr = NULL;
+-
+-	if (fotg210->qh_scan_next == qh)
+-		fotg210->qh_scan_next = list_entry(qh->intr_node.next,
+-				struct fotg210_qh, intr_node);
+-	list_del(&qh->intr_node);
+-}
+-
+-static void start_unlink_intr(struct fotg210_hcd *fotg210,
+-		struct fotg210_qh *qh)
+-{
+-	/* If the QH isn't linked then there's nothing we can do
+-	 * unless we were called during a giveback, in which case
+-	 * qh_completions() has to deal with it.
+-	 */
+-	if (qh->qh_state != QH_STATE_LINKED) {
+-		if (qh->qh_state == QH_STATE_COMPLETING)
+-			qh->needs_rescan = 1;
+-		return;
+-	}
+-
+-	qh_unlink_periodic(fotg210, qh);
+-
+-	/* Make sure the unlinks are visible before starting the timer */
+-	wmb();
+-
+-	/*
+-	 * The EHCI spec doesn't say how long it takes the controller to
+-	 * stop accessing an unlinked interrupt QH.  The timer delay is
+-	 * 9 uframes; presumably that will be long enough.
+-	 */
+-	qh->unlink_cycle = fotg210->intr_unlink_cycle;
+-
+-	/* New entries go at the end of the intr_unlink list */
+-	if (fotg210->intr_unlink)
+-		fotg210->intr_unlink_last->unlink_next = qh;
+-	else
+-		fotg210->intr_unlink = qh;
+-	fotg210->intr_unlink_last = qh;
+-
+-	if (fotg210->intr_unlinking)
+-		;	/* Avoid recursive calls */
+-	else if (fotg210->rh_state < FOTG210_RH_RUNNING)
+-		fotg210_handle_intr_unlinks(fotg210);
+-	else if (fotg210->intr_unlink == qh) {
+-		fotg210_enable_event(fotg210, FOTG210_HRTIMER_UNLINK_INTR,
+-				true);
+-		++fotg210->intr_unlink_cycle;
+-	}
+-}
+-
+-static void end_unlink_intr(struct fotg210_hcd *fotg210, struct fotg210_qh *qh)
+-{
+-	struct fotg210_qh_hw *hw = qh->hw;
+-	int rc;
+-
+-	qh->qh_state = QH_STATE_IDLE;
+-	hw->hw_next = FOTG210_LIST_END(fotg210);
+-
+-	qh_completions(fotg210, qh);
+-
+-	/* reschedule QH iff another request is queued */
+-	if (!list_empty(&qh->qtd_list) &&
+-			fotg210->rh_state == FOTG210_RH_RUNNING) {
+-		rc = qh_schedule(fotg210, qh);
+-
+-		/* An error here likely indicates handshake failure
+-		 * or no space left in the schedule.  Neither fault
+-		 * should happen often ...
+-		 *
+-		 * FIXME kill the now-dysfunctional queued urbs
+-		 */
+-		if (rc != 0)
+-			fotg210_err(fotg210, "can't reschedule qh %p, err %d\n",
+-					qh, rc);
+-	}
+-
+-	/* maybe turn off periodic schedule */
+-	--fotg210->intr_count;
+-	disable_periodic(fotg210);
+-}
+-
+-static int check_period(struct fotg210_hcd *fotg210, unsigned frame,
+-		unsigned uframe, unsigned period, unsigned usecs)
+-{
+-	int claimed;
+-
+-	/* complete split running into next frame?
+-	 * given FSTN support, we could sometimes check...
+-	 */
+-	if (uframe >= 8)
+-		return 0;
+-
+-	/* convert "usecs we need" to "max already claimed" */
+-	usecs = fotg210->uframe_periodic_max - usecs;
+-
+-	/* we "know" 2 and 4 uframe intervals were rejected; so
+-	 * for period 0, check _every_ microframe in the schedule.
+-	 */
+-	if (unlikely(period == 0)) {
+-		do {
+-			for (uframe = 0; uframe < 7; uframe++) {
+-				claimed = periodic_usecs(fotg210, frame,
+-						uframe);
+-				if (claimed > usecs)
+-					return 0;
+-			}
+-		} while ((frame += 1) < fotg210->periodic_size);
+-
+-	/* just check the specified uframe, at that period */
+-	} else {
+-		do {
+-			claimed = periodic_usecs(fotg210, frame, uframe);
+-			if (claimed > usecs)
+-				return 0;
+-		} while ((frame += period) < fotg210->periodic_size);
+-	}
+-
+-	/* success! */
+-	return 1;
+-}
+-
+-static int check_intr_schedule(struct fotg210_hcd *fotg210, unsigned frame,
+-		unsigned uframe, const struct fotg210_qh *qh, __hc32 *c_maskp)
+-{
+-	int retval = -ENOSPC;
+-	u8 mask = 0;
+-
+-	if (qh->c_usecs && uframe >= 6)		/* FSTN territory? */
+-		goto done;
+-
+-	if (!check_period(fotg210, frame, uframe, qh->period, qh->usecs))
+-		goto done;
+-	if (!qh->c_usecs) {
+-		retval = 0;
+-		*c_maskp = 0;
+-		goto done;
+-	}
+-
+-	/* Make sure this tt's buffer is also available for CSPLITs.
+-	 * We pessimize a bit; probably the typical full speed case
+-	 * doesn't need the second CSPLIT.
+-	 *
+-	 * NOTE:  both SPLIT and CSPLIT could be checked in just
+-	 * one smart pass...
+-	 */
+-	mask = 0x03 << (uframe + qh->gap_uf);
+-	*c_maskp = cpu_to_hc32(fotg210, mask << 8);
+-
+-	mask |= 1 << uframe;
+-	if (tt_no_collision(fotg210, qh->period, qh->dev, frame, mask)) {
+-		if (!check_period(fotg210, frame, uframe + qh->gap_uf + 1,
+-				qh->period, qh->c_usecs))
+-			goto done;
+-		if (!check_period(fotg210, frame, uframe + qh->gap_uf,
+-				qh->period, qh->c_usecs))
+-			goto done;
+-		retval = 0;
+-	}
+-done:
+-	return retval;
+-}
+-
+-/* "first fit" scheduling policy used the first time through,
+- * or when the previous schedule slot can't be re-used.
+- */
+-static int qh_schedule(struct fotg210_hcd *fotg210, struct fotg210_qh *qh)
+-{
+-	int status;
+-	unsigned uframe;
+-	__hc32 c_mask;
+-	unsigned frame;	/* 0..(qh->period - 1), or NO_FRAME */
+-	struct fotg210_qh_hw *hw = qh->hw;
+-
+-	qh_refresh(fotg210, qh);
+-	hw->hw_next = FOTG210_LIST_END(fotg210);
+-	frame = qh->start;
+-
+-	/* reuse the previous schedule slots, if we can */
+-	if (frame < qh->period) {
+-		uframe = ffs(hc32_to_cpup(fotg210, &hw->hw_info2) & QH_SMASK);
+-		status = check_intr_schedule(fotg210, frame, --uframe,
+-				qh, &c_mask);
+-	} else {
+-		uframe = 0;
+-		c_mask = 0;
+-		status = -ENOSPC;
+-	}
+-
+-	/* else scan the schedule to find a group of slots such that all
+-	 * uframes have enough periodic bandwidth available.
+-	 */
+-	if (status) {
+-		/* "normal" case, uframing flexible except with splits */
+-		if (qh->period) {
+-			int i;
+-
+-			for (i = qh->period; status && i > 0; --i) {
+-				frame = ++fotg210->random_frame % qh->period;
+-				for (uframe = 0; uframe < 8; uframe++) {
+-					status = check_intr_schedule(fotg210,
+-							frame, uframe, qh,
+-							&c_mask);
+-					if (status == 0)
+-						break;
+-				}
+-			}
+-
+-		/* qh->period == 0 means every uframe */
+-		} else {
+-			frame = 0;
+-			status = check_intr_schedule(fotg210, 0, 0, qh,
+-					&c_mask);
+-		}
+-		if (status)
+-			goto done;
+-		qh->start = frame;
+-
+-		/* reset S-frame and (maybe) C-frame masks */
+-		hw->hw_info2 &= cpu_to_hc32(fotg210, ~(QH_CMASK | QH_SMASK));
+-		hw->hw_info2 |= qh->period
+-			? cpu_to_hc32(fotg210, 1 << uframe)
+-			: cpu_to_hc32(fotg210, QH_SMASK);
+-		hw->hw_info2 |= c_mask;
+-	} else
+-		fotg210_dbg(fotg210, "reused qh %p schedule\n", qh);
+-
+-	/* stuff into the periodic schedule */
+-	qh_link_periodic(fotg210, qh);
+-done:
+-	return status;
+-}
+-
+-static int intr_submit(struct fotg210_hcd *fotg210, struct urb *urb,
+-		struct list_head *qtd_list, gfp_t mem_flags)
+-{
+-	unsigned epnum;
+-	unsigned long flags;
+-	struct fotg210_qh *qh;
+-	int status;
+-	struct list_head empty;
+-
+-	/* get endpoint and transfer/schedule data */
+-	epnum = urb->ep->desc.bEndpointAddress;
+-
+-	spin_lock_irqsave(&fotg210->lock, flags);
+-
+-	if (unlikely(!HCD_HW_ACCESSIBLE(fotg210_to_hcd(fotg210)))) {
+-		status = -ESHUTDOWN;
+-		goto done_not_linked;
+-	}
+-	status = usb_hcd_link_urb_to_ep(fotg210_to_hcd(fotg210), urb);
+-	if (unlikely(status))
+-		goto done_not_linked;
+-
+-	/* get qh and force any scheduling errors */
+-	INIT_LIST_HEAD(&empty);
+-	qh = qh_append_tds(fotg210, urb, &empty, epnum, &urb->ep->hcpriv);
+-	if (qh == NULL) {
+-		status = -ENOMEM;
+-		goto done;
+-	}
+-	if (qh->qh_state == QH_STATE_IDLE) {
+-		status = qh_schedule(fotg210, qh);
+-		if (status)
+-			goto done;
+-	}
+-
+-	/* then queue the urb's tds to the qh */
+-	qh = qh_append_tds(fotg210, urb, qtd_list, epnum, &urb->ep->hcpriv);
+-	BUG_ON(qh == NULL);
+-
+-	/* ... update usbfs periodic stats */
+-	fotg210_to_hcd(fotg210)->self.bandwidth_int_reqs++;
+-
+-done:
+-	if (unlikely(status))
+-		usb_hcd_unlink_urb_from_ep(fotg210_to_hcd(fotg210), urb);
+-done_not_linked:
+-	spin_unlock_irqrestore(&fotg210->lock, flags);
+-	if (status)
+-		qtd_list_free(fotg210, urb, qtd_list);
+-
+-	return status;
+-}
+-
+-static void scan_intr(struct fotg210_hcd *fotg210)
+-{
+-	struct fotg210_qh *qh;
+-
+-	list_for_each_entry_safe(qh, fotg210->qh_scan_next,
+-			&fotg210->intr_qh_list, intr_node) {
+-rescan:
+-		/* clean any finished work for this qh */
+-		if (!list_empty(&qh->qtd_list)) {
+-			int temp;
+-
+-			/*
+-			 * Unlinks could happen here; completion reporting
+-			 * drops the lock.  That's why fotg210->qh_scan_next
+-			 * always holds the next qh to scan; if the next qh
+-			 * gets unlinked then fotg210->qh_scan_next is adjusted
+-			 * in qh_unlink_periodic().
+-			 */
+-			temp = qh_completions(fotg210, qh);
+-			if (unlikely(qh->needs_rescan ||
+-					(list_empty(&qh->qtd_list) &&
+-					qh->qh_state == QH_STATE_LINKED)))
+-				start_unlink_intr(fotg210, qh);
+-			else if (temp != 0)
+-				goto rescan;
+-		}
+-	}
+-}
+-
+-/* fotg210_iso_stream ops work with both ITD and SITD */
+-
+-static struct fotg210_iso_stream *iso_stream_alloc(gfp_t mem_flags)
+-{
+-	struct fotg210_iso_stream *stream;
+-
+-	stream = kzalloc(sizeof(*stream), mem_flags);
+-	if (likely(stream != NULL)) {
+-		INIT_LIST_HEAD(&stream->td_list);
+-		INIT_LIST_HEAD(&stream->free_list);
+-		stream->next_uframe = -1;
+-	}
+-	return stream;
+-}
+-
+-static void iso_stream_init(struct fotg210_hcd *fotg210,
+-		struct fotg210_iso_stream *stream, struct usb_device *dev,
+-		int pipe, unsigned interval)
+-{
+-	u32 buf1;
+-	unsigned epnum, maxp;
+-	int is_input;
+-	long bandwidth;
+-	unsigned multi;
+-	struct usb_host_endpoint *ep;
+-
+-	/*
+-	 * this might be a "high bandwidth" highspeed endpoint,
+-	 * as encoded in the ep descriptor's wMaxPacket field
+-	 */
+-	epnum = usb_pipeendpoint(pipe);
+-	is_input = usb_pipein(pipe) ? USB_DIR_IN : 0;
+-	ep = usb_pipe_endpoint(dev, pipe);
+-	maxp = usb_endpoint_maxp(&ep->desc);
+-	if (is_input)
+-		buf1 = (1 << 11);
+-	else
+-		buf1 = 0;
+-
+-	multi = usb_endpoint_maxp_mult(&ep->desc);
+-	buf1 |= maxp;
+-	maxp *= multi;
+-
+-	stream->buf0 = cpu_to_hc32(fotg210, (epnum << 8) | dev->devnum);
+-	stream->buf1 = cpu_to_hc32(fotg210, buf1);
+-	stream->buf2 = cpu_to_hc32(fotg210, multi);
+-
+-	/* usbfs wants to report the average usecs per frame tied up
+-	 * when transfers on this endpoint are scheduled ...
+-	 */
+-	if (dev->speed == USB_SPEED_FULL) {
+-		interval <<= 3;
+-		stream->usecs = NS_TO_US(usb_calc_bus_time(dev->speed,
+-				is_input, 1, maxp));
+-		stream->usecs /= 8;
+-	} else {
+-		stream->highspeed = 1;
+-		stream->usecs = HS_USECS_ISO(maxp);
+-	}
+-	bandwidth = stream->usecs * 8;
+-	bandwidth /= interval;
+-
+-	stream->bandwidth = bandwidth;
+-	stream->udev = dev;
+-	stream->bEndpointAddress = is_input | epnum;
+-	stream->interval = interval;
+-	stream->maxp = maxp;
+-}
+-
+-static struct fotg210_iso_stream *iso_stream_find(struct fotg210_hcd *fotg210,
+-		struct urb *urb)
+-{
+-	unsigned epnum;
+-	struct fotg210_iso_stream *stream;
+-	struct usb_host_endpoint *ep;
+-	unsigned long flags;
+-
+-	epnum = usb_pipeendpoint(urb->pipe);
+-	if (usb_pipein(urb->pipe))
+-		ep = urb->dev->ep_in[epnum];
+-	else
+-		ep = urb->dev->ep_out[epnum];
+-
+-	spin_lock_irqsave(&fotg210->lock, flags);
+-	stream = ep->hcpriv;
+-
+-	if (unlikely(stream == NULL)) {
+-		stream = iso_stream_alloc(GFP_ATOMIC);
+-		if (likely(stream != NULL)) {
+-			ep->hcpriv = stream;
+-			stream->ep = ep;
+-			iso_stream_init(fotg210, stream, urb->dev, urb->pipe,
+-					urb->interval);
+-		}
+-
+-	/* if dev->ep[epnum] is a QH, hw is set */
+-	} else if (unlikely(stream->hw != NULL)) {
+-		fotg210_dbg(fotg210, "dev %s ep%d%s, not iso??\n",
+-				urb->dev->devpath, epnum,
+-				usb_pipein(urb->pipe) ? "in" : "out");
+-		stream = NULL;
+-	}
+-
+-	spin_unlock_irqrestore(&fotg210->lock, flags);
+-	return stream;
+-}
+-
+-/* fotg210_iso_sched ops can be ITD-only or SITD-only */
+-
+-static struct fotg210_iso_sched *iso_sched_alloc(unsigned packets,
+-		gfp_t mem_flags)
+-{
+-	struct fotg210_iso_sched *iso_sched;
+-
+-	iso_sched = kzalloc(struct_size(iso_sched, packet, packets), mem_flags);
+-	if (likely(iso_sched != NULL))
+-		INIT_LIST_HEAD(&iso_sched->td_list);
+-
+-	return iso_sched;
+-}
+-
+-static inline void itd_sched_init(struct fotg210_hcd *fotg210,
+-		struct fotg210_iso_sched *iso_sched,
+-		struct fotg210_iso_stream *stream, struct urb *urb)
+-{
+-	unsigned i;
+-	dma_addr_t dma = urb->transfer_dma;
+-
+-	/* how many uframes are needed for these transfers */
+-	iso_sched->span = urb->number_of_packets * stream->interval;
+-
+-	/* figure out per-uframe itd fields that we'll need later
+-	 * when we fit new itds into the schedule.
+-	 */
+-	for (i = 0; i < urb->number_of_packets; i++) {
+-		struct fotg210_iso_packet *uframe = &iso_sched->packet[i];
+-		unsigned length;
+-		dma_addr_t buf;
+-		u32 trans;
+-
+-		length = urb->iso_frame_desc[i].length;
+-		buf = dma + urb->iso_frame_desc[i].offset;
+-
+-		trans = FOTG210_ISOC_ACTIVE;
+-		trans |= buf & 0x0fff;
+-		if (unlikely(((i + 1) == urb->number_of_packets))
+-				&& !(urb->transfer_flags & URB_NO_INTERRUPT))
+-			trans |= FOTG210_ITD_IOC;
+-		trans |= length << 16;
+-		uframe->transaction = cpu_to_hc32(fotg210, trans);
+-
+-		/* might need to cross a buffer page within a uframe */
+-		uframe->bufp = (buf & ~(u64)0x0fff);
+-		buf += length;
+-		if (unlikely((uframe->bufp != (buf & ~(u64)0x0fff))))
+-			uframe->cross = 1;
+-	}
+-}
+-
+-static void iso_sched_free(struct fotg210_iso_stream *stream,
+-		struct fotg210_iso_sched *iso_sched)
+-{
+-	if (!iso_sched)
+-		return;
+-	/* caller must hold fotg210->lock!*/
+-	list_splice(&iso_sched->td_list, &stream->free_list);
+-	kfree(iso_sched);
+-}
+-
+-static int itd_urb_transaction(struct fotg210_iso_stream *stream,
+-		struct fotg210_hcd *fotg210, struct urb *urb, gfp_t mem_flags)
+-{
+-	struct fotg210_itd *itd;
+-	dma_addr_t itd_dma;
+-	int i;
+-	unsigned num_itds;
+-	struct fotg210_iso_sched *sched;
+-	unsigned long flags;
+-
+-	sched = iso_sched_alloc(urb->number_of_packets, mem_flags);
+-	if (unlikely(sched == NULL))
+-		return -ENOMEM;
+-
+-	itd_sched_init(fotg210, sched, stream, urb);
+-
+-	if (urb->interval < 8)
+-		num_itds = 1 + (sched->span + 7) / 8;
+-	else
+-		num_itds = urb->number_of_packets;
+-
+-	/* allocate/init ITDs */
+-	spin_lock_irqsave(&fotg210->lock, flags);
+-	for (i = 0; i < num_itds; i++) {
+-
+-		/*
+-		 * Use iTDs from the free list, but not iTDs that may
+-		 * still be in use by the hardware.
+-		 */
+-		if (likely(!list_empty(&stream->free_list))) {
+-			itd = list_first_entry(&stream->free_list,
+-					struct fotg210_itd, itd_list);
+-			if (itd->frame == fotg210->now_frame)
+-				goto alloc_itd;
+-			list_del(&itd->itd_list);
+-			itd_dma = itd->itd_dma;
+-		} else {
+-alloc_itd:
+-			spin_unlock_irqrestore(&fotg210->lock, flags);
+-			itd = dma_pool_alloc(fotg210->itd_pool, mem_flags,
+-					&itd_dma);
+-			spin_lock_irqsave(&fotg210->lock, flags);
+-			if (!itd) {
+-				iso_sched_free(stream, sched);
+-				spin_unlock_irqrestore(&fotg210->lock, flags);
+-				return -ENOMEM;
+-			}
+-		}
+-
+-		memset(itd, 0, sizeof(*itd));
+-		itd->itd_dma = itd_dma;
+-		list_add(&itd->itd_list, &sched->td_list);
+-	}
+-	spin_unlock_irqrestore(&fotg210->lock, flags);
+-
+-	/* temporarily store schedule info in hcpriv */
+-	urb->hcpriv = sched;
+-	urb->error_count = 0;
+-	return 0;
+-}
+-
+-static inline int itd_slot_ok(struct fotg210_hcd *fotg210, u32 mod, u32 uframe,
+-		u8 usecs, u32 period)
+-{
+-	uframe %= period;
+-	do {
+-		/* can't commit more than uframe_periodic_max usec */
+-		if (periodic_usecs(fotg210, uframe >> 3, uframe & 0x7)
+-				> (fotg210->uframe_periodic_max - usecs))
+-			return 0;
+-
+-		/* we know urb->interval is 2^N uframes */
+-		uframe += period;
+-	} while (uframe < mod);
+-	return 1;
+-}
+-
+-/* This scheduler plans almost as far into the future as it has actual
+- * periodic schedule slots.  (Affected by TUNE_FLS, which defaults to
+- * "as small as possible" to be cache-friendlier.)  That limits the size
+- * transfers you can stream reliably; avoid more than 64 msec per urb.
+- * Also avoid queue depths of less than fotg210's worst irq latency (affected
+- * by the per-urb URB_NO_INTERRUPT hint, the log2_irq_thresh module parameter,
+- * and other factors); or more than about 230 msec total (for portability,
+- * given FOTG210_TUNE_FLS and the slop).  Or, write a smarter scheduler!
+- */
+-
+-#define SCHEDULE_SLOP 80 /* microframes */
+-
+-static int iso_stream_schedule(struct fotg210_hcd *fotg210, struct urb *urb,
+-		struct fotg210_iso_stream *stream)
+-{
+-	u32 now, next, start, period, span;
+-	int status;
+-	unsigned mod = fotg210->periodic_size << 3;
+-	struct fotg210_iso_sched *sched = urb->hcpriv;
+-
+-	period = urb->interval;
+-	span = sched->span;
+-
+-	if (span > mod - SCHEDULE_SLOP) {
+-		fotg210_dbg(fotg210, "iso request %p too long\n", urb);
+-		status = -EFBIG;
+-		goto fail;
+-	}
+-
+-	now = fotg210_read_frame_index(fotg210) & (mod - 1);
+-
+-	/* Typical case: reuse current schedule, stream is still active.
+-	 * Hopefully there are no gaps from the host falling behind
+-	 * (irq delays etc), but if there are we'll take the next
+-	 * slot in the schedule, implicitly assuming URB_ISO_ASAP.
+-	 */
+-	if (likely(!list_empty(&stream->td_list))) {
+-		u32 excess;
+-
+-		/* For high speed devices, allow scheduling within the
+-		 * isochronous scheduling threshold.  For full speed devices
+-		 * and Intel PCI-based controllers, don't (work around for
+-		 * Intel ICH9 bug).
+-		 */
+-		if (!stream->highspeed && fotg210->fs_i_thresh)
+-			next = now + fotg210->i_thresh;
+-		else
+-			next = now;
+-
+-		/* Fell behind (by up to twice the slop amount)?
+-		 * We decide based on the time of the last currently-scheduled
+-		 * slot, not the time of the next available slot.
+-		 */
+-		excess = (stream->next_uframe - period - next) & (mod - 1);
+-		if (excess >= mod - 2 * SCHEDULE_SLOP)
+-			start = next + excess - mod + period *
+-					DIV_ROUND_UP(mod - excess, period);
+-		else
+-			start = next + excess + period;
+-		if (start - now >= mod) {
+-			fotg210_dbg(fotg210, "request %p would overflow (%d+%d >= %d)\n",
+-					urb, start - now - period, period,
+-					mod);
+-			status = -EFBIG;
+-			goto fail;
+-		}
+-	}
+-
+-	/* need to schedule; when's the next (u)frame we could start?
+-	 * this is bigger than fotg210->i_thresh allows; scheduling itself
+-	 * isn't free, the slop should handle reasonably slow cpus.  it
+-	 * can also help high bandwidth if the dma and irq loads don't
+-	 * jump until after the queue is primed.
+-	 */
+-	else {
+-		int done = 0;
+-
+-		start = SCHEDULE_SLOP + (now & ~0x07);
+-
+-		/* NOTE:  assumes URB_ISO_ASAP, to limit complexity/bugs */
+-
+-		/* find a uframe slot with enough bandwidth.
+-		 * Early uframes are more precious because full-speed
+-		 * iso IN transfers can't use late uframes,
+-		 * and therefore they should be allocated last.
+-		 */
+-		next = start;
+-		start += period;
+-		do {
+-			start--;
+-			/* check schedule: enough space? */
+-			if (itd_slot_ok(fotg210, mod, start,
+-					stream->usecs, period))
+-				done = 1;
+-		} while (start > next && !done);
+-
+-		/* no room in the schedule */
+-		if (!done) {
+-			fotg210_dbg(fotg210, "iso resched full %p (now %d max %d)\n",
+-					urb, now, now + mod);
+-			status = -ENOSPC;
+-			goto fail;
+-		}
+-	}
+-
+-	/* Tried to schedule too far into the future? */
+-	if (unlikely(start - now + span - period >=
+-			mod - 2 * SCHEDULE_SLOP)) {
+-		fotg210_dbg(fotg210, "request %p would overflow (%d+%d >= %d)\n",
+-				urb, start - now, span - period,
+-				mod - 2 * SCHEDULE_SLOP);
+-		status = -EFBIG;
+-		goto fail;
+-	}
+-
+-	stream->next_uframe = start & (mod - 1);
+-
+-	/* report high speed start in uframes; full speed, in frames */
+-	urb->start_frame = stream->next_uframe;
+-	if (!stream->highspeed)
+-		urb->start_frame >>= 3;
+-
+-	/* Make sure scan_isoc() sees these */
+-	if (fotg210->isoc_count == 0)
+-		fotg210->next_frame = now >> 3;
+-	return 0;
+-
+-fail:
+-	iso_sched_free(stream, sched);
+-	urb->hcpriv = NULL;
+-	return status;
+-}
+-
+-static inline void itd_init(struct fotg210_hcd *fotg210,
+-		struct fotg210_iso_stream *stream, struct fotg210_itd *itd)
+-{
+-	int i;
+-
+-	/* it's been recently zeroed */
+-	itd->hw_next = FOTG210_LIST_END(fotg210);
+-	itd->hw_bufp[0] = stream->buf0;
+-	itd->hw_bufp[1] = stream->buf1;
+-	itd->hw_bufp[2] = stream->buf2;
+-
+-	for (i = 0; i < 8; i++)
+-		itd->index[i] = -1;
+-
+-	/* All other fields are filled when scheduling */
+-}
+-
+-static inline void itd_patch(struct fotg210_hcd *fotg210,
+-		struct fotg210_itd *itd, struct fotg210_iso_sched *iso_sched,
+-		unsigned index, u16 uframe)
+-{
+-	struct fotg210_iso_packet *uf = &iso_sched->packet[index];
+-	unsigned pg = itd->pg;
+-
+-	uframe &= 0x07;
+-	itd->index[uframe] = index;
+-
+-	itd->hw_transaction[uframe] = uf->transaction;
+-	itd->hw_transaction[uframe] |= cpu_to_hc32(fotg210, pg << 12);
+-	itd->hw_bufp[pg] |= cpu_to_hc32(fotg210, uf->bufp & ~(u32)0);
+-	itd->hw_bufp_hi[pg] |= cpu_to_hc32(fotg210, (u32)(uf->bufp >> 32));
+-
+-	/* iso_frame_desc[].offset must be strictly increasing */
+-	if (unlikely(uf->cross)) {
+-		u64 bufp = uf->bufp + 4096;
+-
+-		itd->pg = ++pg;
+-		itd->hw_bufp[pg] |= cpu_to_hc32(fotg210, bufp & ~(u32)0);
+-		itd->hw_bufp_hi[pg] |= cpu_to_hc32(fotg210, (u32)(bufp >> 32));
+-	}
+-}
+-
+-static inline void itd_link(struct fotg210_hcd *fotg210, unsigned frame,
+-		struct fotg210_itd *itd)
+-{
+-	union fotg210_shadow *prev = &fotg210->pshadow[frame];
+-	__hc32 *hw_p = &fotg210->periodic[frame];
+-	union fotg210_shadow here = *prev;
+-	__hc32 type = 0;
+-
+-	/* skip any iso nodes which might belong to previous microframes */
+-	while (here.ptr) {
+-		type = Q_NEXT_TYPE(fotg210, *hw_p);
+-		if (type == cpu_to_hc32(fotg210, Q_TYPE_QH))
+-			break;
+-		prev = periodic_next_shadow(fotg210, prev, type);
+-		hw_p = shadow_next_periodic(fotg210, &here, type);
+-		here = *prev;
+-	}
+-
+-	itd->itd_next = here;
+-	itd->hw_next = *hw_p;
+-	prev->itd = itd;
+-	itd->frame = frame;
+-	wmb();
+-	*hw_p = cpu_to_hc32(fotg210, itd->itd_dma | Q_TYPE_ITD);
+-}
+-
+-/* fit urb's itds into the selected schedule slot; activate as needed */
+-static void itd_link_urb(struct fotg210_hcd *fotg210, struct urb *urb,
+-		unsigned mod, struct fotg210_iso_stream *stream)
+-{
+-	int packet;
+-	unsigned next_uframe, uframe, frame;
+-	struct fotg210_iso_sched *iso_sched = urb->hcpriv;
+-	struct fotg210_itd *itd;
+-
+-	next_uframe = stream->next_uframe & (mod - 1);
+-
+-	if (unlikely(list_empty(&stream->td_list))) {
+-		fotg210_to_hcd(fotg210)->self.bandwidth_allocated
+-				+= stream->bandwidth;
+-		fotg210_dbg(fotg210,
+-			"schedule devp %s ep%d%s-iso period %d start %d.%d\n",
+-			urb->dev->devpath, stream->bEndpointAddress & 0x0f,
+-			(stream->bEndpointAddress & USB_DIR_IN) ? "in" : "out",
+-			urb->interval,
+-			next_uframe >> 3, next_uframe & 0x7);
+-	}
+-
+-	/* fill iTDs uframe by uframe */
+-	for (packet = 0, itd = NULL; packet < urb->number_of_packets;) {
+-		if (itd == NULL) {
+-			/* ASSERT:  we have all necessary itds */
+-
+-			/* ASSERT:  no itds for this endpoint in this uframe */
+-
+-			itd = list_entry(iso_sched->td_list.next,
+-					struct fotg210_itd, itd_list);
+-			list_move_tail(&itd->itd_list, &stream->td_list);
+-			itd->stream = stream;
+-			itd->urb = urb;
+-			itd_init(fotg210, stream, itd);
+-		}
+-
+-		uframe = next_uframe & 0x07;
+-		frame = next_uframe >> 3;
+-
+-		itd_patch(fotg210, itd, iso_sched, packet, uframe);
+-
+-		next_uframe += stream->interval;
+-		next_uframe &= mod - 1;
+-		packet++;
+-
+-		/* link completed itds into the schedule */
+-		if (((next_uframe >> 3) != frame)
+-				|| packet == urb->number_of_packets) {
+-			itd_link(fotg210, frame & (fotg210->periodic_size - 1),
+-					itd);
+-			itd = NULL;
+-		}
+-	}
+-	stream->next_uframe = next_uframe;
+-
+-	/* don't need that schedule data any more */
+-	iso_sched_free(stream, iso_sched);
+-	urb->hcpriv = NULL;
+-
+-	++fotg210->isoc_count;
+-	enable_periodic(fotg210);
+-}
+-
+-#define ISO_ERRS (FOTG210_ISOC_BUF_ERR | FOTG210_ISOC_BABBLE |\
+-		FOTG210_ISOC_XACTERR)
+-
+-/* Process and recycle a completed ITD.  Return true iff its urb completed,
+- * and hence its completion callback probably added things to the hardware
+- * schedule.
+- *
+- * Note that we carefully avoid recycling this descriptor until after any
+- * completion callback runs, so that it won't be reused quickly.  That is,
+- * assuming (a) no more than two urbs per frame on this endpoint, and also
+- * (b) only this endpoint's completions submit URBs.  It seems some silicon
+- * corrupts things if you reuse completed descriptors very quickly...
+- */
+-static bool itd_complete(struct fotg210_hcd *fotg210, struct fotg210_itd *itd)
+-{
+-	struct urb *urb = itd->urb;
+-	struct usb_iso_packet_descriptor *desc;
+-	u32 t;
+-	unsigned uframe;
+-	int urb_index = -1;
+-	struct fotg210_iso_stream *stream = itd->stream;
+-	struct usb_device *dev;
+-	bool retval = false;
+-
+-	/* for each uframe with a packet */
+-	for (uframe = 0; uframe < 8; uframe++) {
+-		if (likely(itd->index[uframe] == -1))
+-			continue;
+-		urb_index = itd->index[uframe];
+-		desc = &urb->iso_frame_desc[urb_index];
+-
+-		t = hc32_to_cpup(fotg210, &itd->hw_transaction[uframe]);
+-		itd->hw_transaction[uframe] = 0;
+-
+-		/* report transfer status */
+-		if (unlikely(t & ISO_ERRS)) {
+-			urb->error_count++;
+-			if (t & FOTG210_ISOC_BUF_ERR)
+-				desc->status = usb_pipein(urb->pipe)
+-					? -ENOSR  /* hc couldn't read */
+-					: -ECOMM; /* hc couldn't write */
+-			else if (t & FOTG210_ISOC_BABBLE)
+-				desc->status = -EOVERFLOW;
+-			else /* (t & FOTG210_ISOC_XACTERR) */
+-				desc->status = -EPROTO;
+-
+-			/* HC need not update length with this error */
+-			if (!(t & FOTG210_ISOC_BABBLE)) {
+-				desc->actual_length = FOTG210_ITD_LENGTH(t);
+-				urb->actual_length += desc->actual_length;
+-			}
+-		} else if (likely((t & FOTG210_ISOC_ACTIVE) == 0)) {
+-			desc->status = 0;
+-			desc->actual_length = FOTG210_ITD_LENGTH(t);
+-			urb->actual_length += desc->actual_length;
+-		} else {
+-			/* URB was too late */
+-			desc->status = -EXDEV;
+-		}
+-	}
+-
+-	/* handle completion now? */
+-	if (likely((urb_index + 1) != urb->number_of_packets))
+-		goto done;
+-
+-	/* ASSERT: it's really the last itd for this urb
+-	 * list_for_each_entry (itd, &stream->td_list, itd_list)
+-	 *	BUG_ON (itd->urb == urb);
+-	 */
+-
+-	/* give urb back to the driver; completion often (re)submits */
+-	dev = urb->dev;
+-	fotg210_urb_done(fotg210, urb, 0);
+-	retval = true;
+-	urb = NULL;
+-
+-	--fotg210->isoc_count;
+-	disable_periodic(fotg210);
+-
+-	if (unlikely(list_is_singular(&stream->td_list))) {
+-		fotg210_to_hcd(fotg210)->self.bandwidth_allocated
+-				-= stream->bandwidth;
+-		fotg210_dbg(fotg210,
+-			"deschedule devp %s ep%d%s-iso\n",
+-			dev->devpath, stream->bEndpointAddress & 0x0f,
+-			(stream->bEndpointAddress & USB_DIR_IN) ? "in" : "out");
+-	}
+-
+-done:
+-	itd->urb = NULL;
+-
+-	/* Add to the end of the free list for later reuse */
+-	list_move_tail(&itd->itd_list, &stream->free_list);
+-
+-	/* Recycle the iTDs when the pipeline is empty (ep no longer in use) */
+-	if (list_empty(&stream->td_list)) {
+-		list_splice_tail_init(&stream->free_list,
+-				&fotg210->cached_itd_list);
+-		start_free_itds(fotg210);
+-	}
+-
+-	return retval;
+-}
+-
+-static int itd_submit(struct fotg210_hcd *fotg210, struct urb *urb,
+-		gfp_t mem_flags)
+-{
+-	int status = -EINVAL;
+-	unsigned long flags;
+-	struct fotg210_iso_stream *stream;
+-
+-	/* Get iso_stream head */
+-	stream = iso_stream_find(fotg210, urb);
+-	if (unlikely(stream == NULL)) {
+-		fotg210_dbg(fotg210, "can't get iso stream\n");
+-		return -ENOMEM;
+-	}
+-	if (unlikely(urb->interval != stream->interval &&
+-			fotg210_port_speed(fotg210, 0) ==
+-			USB_PORT_STAT_HIGH_SPEED)) {
+-		fotg210_dbg(fotg210, "can't change iso interval %d --> %d\n",
+-				stream->interval, urb->interval);
+-		goto done;
+-	}
+-
+-#ifdef FOTG210_URB_TRACE
+-	fotg210_dbg(fotg210,
+-			"%s %s urb %p ep%d%s len %d, %d pkts %d uframes[%p]\n",
+-			__func__, urb->dev->devpath, urb,
+-			usb_pipeendpoint(urb->pipe),
+-			usb_pipein(urb->pipe) ? "in" : "out",
+-			urb->transfer_buffer_length,
+-			urb->number_of_packets, urb->interval,
+-			stream);
+-#endif
+-
+-	/* allocate ITDs w/o locking anything */
+-	status = itd_urb_transaction(stream, fotg210, urb, mem_flags);
+-	if (unlikely(status < 0)) {
+-		fotg210_dbg(fotg210, "can't init itds\n");
+-		goto done;
+-	}
+-
+-	/* schedule ... need to lock */
+-	spin_lock_irqsave(&fotg210->lock, flags);
+-	if (unlikely(!HCD_HW_ACCESSIBLE(fotg210_to_hcd(fotg210)))) {
+-		status = -ESHUTDOWN;
+-		goto done_not_linked;
+-	}
+-	status = usb_hcd_link_urb_to_ep(fotg210_to_hcd(fotg210), urb);
+-	if (unlikely(status))
+-		goto done_not_linked;
+-	status = iso_stream_schedule(fotg210, urb, stream);
+-	if (likely(status == 0))
+-		itd_link_urb(fotg210, urb, fotg210->periodic_size << 3, stream);
+-	else
+-		usb_hcd_unlink_urb_from_ep(fotg210_to_hcd(fotg210), urb);
+-done_not_linked:
+-	spin_unlock_irqrestore(&fotg210->lock, flags);
+-done:
+-	return status;
+-}
+-
+-static inline int scan_frame_queue(struct fotg210_hcd *fotg210, unsigned frame,
+-		unsigned now_frame, bool live)
+-{
+-	unsigned uf;
+-	bool modified;
+-	union fotg210_shadow q, *q_p;
+-	__hc32 type, *hw_p;
+-
+-	/* scan each element in frame's queue for completions */
+-	q_p = &fotg210->pshadow[frame];
+-	hw_p = &fotg210->periodic[frame];
+-	q.ptr = q_p->ptr;
+-	type = Q_NEXT_TYPE(fotg210, *hw_p);
+-	modified = false;
+-
+-	while (q.ptr) {
+-		switch (hc32_to_cpu(fotg210, type)) {
+-		case Q_TYPE_ITD:
+-			/* If this ITD is still active, leave it for
+-			 * later processing ... check the next entry.
+-			 * No need to check for activity unless the
+-			 * frame is current.
+-			 */
+-			if (frame == now_frame && live) {
+-				rmb();
+-				for (uf = 0; uf < 8; uf++) {
+-					if (q.itd->hw_transaction[uf] &
+-							ITD_ACTIVE(fotg210))
+-						break;
+-				}
+-				if (uf < 8) {
+-					q_p = &q.itd->itd_next;
+-					hw_p = &q.itd->hw_next;
+-					type = Q_NEXT_TYPE(fotg210,
+-							q.itd->hw_next);
+-					q = *q_p;
+-					break;
+-				}
+-			}
+-
+-			/* Take finished ITDs out of the schedule
+-			 * and process them:  recycle, maybe report
+-			 * URB completion.  HC won't cache the
+-			 * pointer for much longer, if at all.
+-			 */
+-			*q_p = q.itd->itd_next;
+-			*hw_p = q.itd->hw_next;
+-			type = Q_NEXT_TYPE(fotg210, q.itd->hw_next);
+-			wmb();
+-			modified = itd_complete(fotg210, q.itd);
+-			q = *q_p;
+-			break;
+-		default:
+-			fotg210_dbg(fotg210, "corrupt type %d frame %d shadow %p\n",
+-					type, frame, q.ptr);
+-			fallthrough;
+-		case Q_TYPE_QH:
+-		case Q_TYPE_FSTN:
+-			/* End of the iTDs and siTDs */
+-			q.ptr = NULL;
+-			break;
+-		}
+-
+-		/* assume completion callbacks modify the queue */
+-		if (unlikely(modified && fotg210->isoc_count > 0))
+-			return -EINVAL;
+-	}
+-	return 0;
+-}
+-
+-static void scan_isoc(struct fotg210_hcd *fotg210)
+-{
+-	unsigned uf, now_frame, frame, ret;
+-	unsigned fmask = fotg210->periodic_size - 1;
+-	bool live;
+-
+-	/*
+-	 * When running, scan from last scan point up to "now"
+-	 * else clean up by scanning everything that's left.
+-	 * Touches as few pages as possible:  cache-friendly.
+-	 */
+-	if (fotg210->rh_state >= FOTG210_RH_RUNNING) {
+-		uf = fotg210_read_frame_index(fotg210);
+-		now_frame = (uf >> 3) & fmask;
+-		live = true;
+-	} else  {
+-		now_frame = (fotg210->next_frame - 1) & fmask;
+-		live = false;
+-	}
+-	fotg210->now_frame = now_frame;
+-
+-	frame = fotg210->next_frame;
+-	for (;;) {
+-		ret = 1;
+-		while (ret != 0)
+-			ret = scan_frame_queue(fotg210, frame,
+-					now_frame, live);
+-
+-		/* Stop when we have reached the current frame */
+-		if (frame == now_frame)
+-			break;
+-		frame = (frame + 1) & fmask;
+-	}
+-	fotg210->next_frame = now_frame;
+-}
+-
+-/* Display / Set uframe_periodic_max
+- */
+-static ssize_t uframe_periodic_max_show(struct device *dev,
+-		struct device_attribute *attr, char *buf)
+-{
+-	struct fotg210_hcd *fotg210;
+-	int n;
+-
+-	fotg210 = hcd_to_fotg210(bus_to_hcd(dev_get_drvdata(dev)));
+-	n = scnprintf(buf, PAGE_SIZE, "%d\n", fotg210->uframe_periodic_max);
+-	return n;
+-}
+-
+-
+-static ssize_t uframe_periodic_max_store(struct device *dev,
+-		struct device_attribute *attr, const char *buf, size_t count)
+-{
+-	struct fotg210_hcd *fotg210;
+-	unsigned uframe_periodic_max;
+-	unsigned frame, uframe;
+-	unsigned short allocated_max;
+-	unsigned long flags;
+-	ssize_t ret;
+-
+-	fotg210 = hcd_to_fotg210(bus_to_hcd(dev_get_drvdata(dev)));
+-	if (kstrtouint(buf, 0, &uframe_periodic_max) < 0)
+-		return -EINVAL;
+-
+-	if (uframe_periodic_max < 100 || uframe_periodic_max >= 125) {
+-		fotg210_info(fotg210, "rejecting invalid request for uframe_periodic_max=%u\n",
+-				uframe_periodic_max);
+-		return -EINVAL;
+-	}
+-
+-	ret = -EINVAL;
+-
+-	/*
+-	 * lock, so that our checking does not race with possible periodic
+-	 * bandwidth allocation through submitting new urbs.
+-	 */
+-	spin_lock_irqsave(&fotg210->lock, flags);
+-
+-	/*
+-	 * for request to decrease max periodic bandwidth, we have to check
+-	 * every microframe in the schedule to see whether the decrease is
+-	 * possible.
+-	 */
+-	if (uframe_periodic_max < fotg210->uframe_periodic_max) {
+-		allocated_max = 0;
+-
+-		for (frame = 0; frame < fotg210->periodic_size; ++frame)
+-			for (uframe = 0; uframe < 7; ++uframe)
+-				allocated_max = max(allocated_max,
+-						periodic_usecs(fotg210, frame,
+-						uframe));
+-
+-		if (allocated_max > uframe_periodic_max) {
+-			fotg210_info(fotg210,
+-					"cannot decrease uframe_periodic_max because periodic bandwidth is already allocated (%u > %u)\n",
+-					allocated_max, uframe_periodic_max);
+-			goto out_unlock;
+-		}
+-	}
+-
+-	/* increasing is always ok */
+-
+-	fotg210_info(fotg210,
+-			"setting max periodic bandwidth to %u%% (== %u usec/uframe)\n",
+-			100 * uframe_periodic_max/125, uframe_periodic_max);
+-
+-	if (uframe_periodic_max != 100)
+-		fotg210_warn(fotg210, "max periodic bandwidth set is non-standard\n");
+-
+-	fotg210->uframe_periodic_max = uframe_periodic_max;
+-	ret = count;
+-
+-out_unlock:
+-	spin_unlock_irqrestore(&fotg210->lock, flags);
+-	return ret;
+-}
+-
+-static DEVICE_ATTR_RW(uframe_periodic_max);
+-
+-static inline int create_sysfs_files(struct fotg210_hcd *fotg210)
+-{
+-	struct device *controller = fotg210_to_hcd(fotg210)->self.controller;
+-
+-	return device_create_file(controller, &dev_attr_uframe_periodic_max);
+-}
+-
+-static inline void remove_sysfs_files(struct fotg210_hcd *fotg210)
+-{
+-	struct device *controller = fotg210_to_hcd(fotg210)->self.controller;
+-
+-	device_remove_file(controller, &dev_attr_uframe_periodic_max);
+-}
+-/* On some systems, leaving remote wakeup enabled prevents system shutdown.
+- * The firmware seems to think that powering off is a wakeup event!
+- * This routine turns off remote wakeup and everything else, on all ports.
+- */
+-static void fotg210_turn_off_all_ports(struct fotg210_hcd *fotg210)
+-{
+-	u32 __iomem *status_reg = &fotg210->regs->port_status;
+-
+-	fotg210_writel(fotg210, PORT_RWC_BITS, status_reg);
+-}
+-
+-/* Halt HC, turn off all ports, and let the BIOS use the companion controllers.
+- * Must be called with interrupts enabled and the lock not held.
+- */
+-static void fotg210_silence_controller(struct fotg210_hcd *fotg210)
+-{
+-	fotg210_halt(fotg210);
+-
+-	spin_lock_irq(&fotg210->lock);
+-	fotg210->rh_state = FOTG210_RH_HALTED;
+-	fotg210_turn_off_all_ports(fotg210);
+-	spin_unlock_irq(&fotg210->lock);
+-}
+-
+-/* fotg210_shutdown kick in for silicon on any bus (not just pci, etc).
+- * This forcibly disables dma and IRQs, helping kexec and other cases
+- * where the next system software may expect clean state.
+- */
+-static void fotg210_shutdown(struct usb_hcd *hcd)
+-{
+-	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
+-
+-	spin_lock_irq(&fotg210->lock);
+-	fotg210->shutdown = true;
+-	fotg210->rh_state = FOTG210_RH_STOPPING;
+-	fotg210->enabled_hrtimer_events = 0;
+-	spin_unlock_irq(&fotg210->lock);
+-
+-	fotg210_silence_controller(fotg210);
+-
+-	hrtimer_cancel(&fotg210->hrtimer);
+-}
+-
+-/* fotg210_work is called from some interrupts, timers, and so on.
+- * it calls driver completion functions, after dropping fotg210->lock.
+- */
+-static void fotg210_work(struct fotg210_hcd *fotg210)
+-{
+-	/* another CPU may drop fotg210->lock during a schedule scan while
+-	 * it reports urb completions.  this flag guards against bogus
+-	 * attempts at re-entrant schedule scanning.
+-	 */
+-	if (fotg210->scanning) {
+-		fotg210->need_rescan = true;
+-		return;
+-	}
+-	fotg210->scanning = true;
+-
+-rescan:
+-	fotg210->need_rescan = false;
+-	if (fotg210->async_count)
+-		scan_async(fotg210);
+-	if (fotg210->intr_count > 0)
+-		scan_intr(fotg210);
+-	if (fotg210->isoc_count > 0)
+-		scan_isoc(fotg210);
+-	if (fotg210->need_rescan)
+-		goto rescan;
+-	fotg210->scanning = false;
+-
+-	/* the IO watchdog guards against hardware or driver bugs that
+-	 * misplace IRQs, and should let us run completely without IRQs.
+-	 * such lossage has been observed on both VT6202 and VT8235.
+-	 */
+-	turn_on_io_watchdog(fotg210);
+-}
+-
+-/* Called when the fotg210_hcd module is removed.
+- */
+-static void fotg210_stop(struct usb_hcd *hcd)
+-{
+-	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
+-
+-	fotg210_dbg(fotg210, "stop\n");
+-
+-	/* no more interrupts ... */
+-
+-	spin_lock_irq(&fotg210->lock);
+-	fotg210->enabled_hrtimer_events = 0;
+-	spin_unlock_irq(&fotg210->lock);
+-
+-	fotg210_quiesce(fotg210);
+-	fotg210_silence_controller(fotg210);
+-	fotg210_reset(fotg210);
+-
+-	hrtimer_cancel(&fotg210->hrtimer);
+-	remove_sysfs_files(fotg210);
+-	remove_debug_files(fotg210);
+-
+-	/* root hub is shut down separately (first, when possible) */
+-	spin_lock_irq(&fotg210->lock);
+-	end_free_itds(fotg210);
+-	spin_unlock_irq(&fotg210->lock);
+-	fotg210_mem_cleanup(fotg210);
+-
+-#ifdef FOTG210_STATS
+-	fotg210_dbg(fotg210, "irq normal %ld err %ld iaa %ld (lost %ld)\n",
+-			fotg210->stats.normal, fotg210->stats.error,
+-			fotg210->stats.iaa, fotg210->stats.lost_iaa);
+-	fotg210_dbg(fotg210, "complete %ld unlink %ld\n",
+-			fotg210->stats.complete, fotg210->stats.unlink);
+-#endif
+-
+-	dbg_status(fotg210, "fotg210_stop completed",
+-			fotg210_readl(fotg210, &fotg210->regs->status));
+-}
+-
+-/* one-time init, only for memory state */
+-static int hcd_fotg210_init(struct usb_hcd *hcd)
+-{
+-	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
+-	u32 temp;
+-	int retval;
+-	u32 hcc_params;
+-	struct fotg210_qh_hw *hw;
+-
+-	spin_lock_init(&fotg210->lock);
+-
+-	/*
+-	 * keep io watchdog by default, those good HCDs could turn off it later
+-	 */
+-	fotg210->need_io_watchdog = 1;
+-
+-	hrtimer_init(&fotg210->hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
+-	fotg210->hrtimer.function = fotg210_hrtimer_func;
+-	fotg210->next_hrtimer_event = FOTG210_HRTIMER_NO_EVENT;
+-
+-	hcc_params = fotg210_readl(fotg210, &fotg210->caps->hcc_params);
+-
+-	/*
+-	 * by default set standard 80% (== 100 usec/uframe) max periodic
+-	 * bandwidth as required by USB 2.0
+-	 */
+-	fotg210->uframe_periodic_max = 100;
+-
+-	/*
+-	 * hw default: 1K periodic list heads, one per frame.
+-	 * periodic_size can shrink by USBCMD update if hcc_params allows.
+-	 */
+-	fotg210->periodic_size = DEFAULT_I_TDPS;
+-	INIT_LIST_HEAD(&fotg210->intr_qh_list);
+-	INIT_LIST_HEAD(&fotg210->cached_itd_list);
+-
+-	if (HCC_PGM_FRAMELISTLEN(hcc_params)) {
+-		/* periodic schedule size can be smaller than default */
+-		switch (FOTG210_TUNE_FLS) {
+-		case 0:
+-			fotg210->periodic_size = 1024;
+-			break;
+-		case 1:
+-			fotg210->periodic_size = 512;
+-			break;
+-		case 2:
+-			fotg210->periodic_size = 256;
+-			break;
+-		default:
+-			BUG();
+-		}
+-	}
+-	retval = fotg210_mem_init(fotg210, GFP_KERNEL);
+-	if (retval < 0)
+-		return retval;
+-
+-	/* controllers may cache some of the periodic schedule ... */
+-	fotg210->i_thresh = 2;
+-
+-	/*
+-	 * dedicate a qh for the async ring head, since we couldn't unlink
+-	 * a 'real' qh without stopping the async schedule [4.8].  use it
+-	 * as the 'reclamation list head' too.
+-	 * its dummy is used in hw_alt_next of many tds, to prevent the qh
+-	 * from automatically advancing to the next td after short reads.
+-	 */
+-	fotg210->async->qh_next.qh = NULL;
+-	hw = fotg210->async->hw;
+-	hw->hw_next = QH_NEXT(fotg210, fotg210->async->qh_dma);
+-	hw->hw_info1 = cpu_to_hc32(fotg210, QH_HEAD);
+-	hw->hw_token = cpu_to_hc32(fotg210, QTD_STS_HALT);
+-	hw->hw_qtd_next = FOTG210_LIST_END(fotg210);
+-	fotg210->async->qh_state = QH_STATE_LINKED;
+-	hw->hw_alt_next = QTD_NEXT(fotg210, fotg210->async->dummy->qtd_dma);
+-
+-	/* clear interrupt enables, set irq latency */
+-	if (log2_irq_thresh < 0 || log2_irq_thresh > 6)
+-		log2_irq_thresh = 0;
+-	temp = 1 << (16 + log2_irq_thresh);
+-	if (HCC_CANPARK(hcc_params)) {
+-		/* HW default park == 3, on hardware that supports it (like
+-		 * NVidia and ALI silicon), maximizes throughput on the async
+-		 * schedule by avoiding QH fetches between transfers.
+-		 *
+-		 * With fast usb storage devices and NForce2, "park" seems to
+-		 * make problems:  throughput reduction (!), data errors...
+-		 */
+-		if (park) {
+-			park = min_t(unsigned, park, 3);
+-			temp |= CMD_PARK;
+-			temp |= park << 8;
+-		}
+-		fotg210_dbg(fotg210, "park %d\n", park);
+-	}
+-	if (HCC_PGM_FRAMELISTLEN(hcc_params)) {
+-		/* periodic schedule size can be smaller than default */
+-		temp &= ~(3 << 2);
+-		temp |= (FOTG210_TUNE_FLS << 2);
+-	}
+-	fotg210->command = temp;
+-
+-	/* Accept arbitrarily long scatter-gather lists */
+-	if (!hcd->localmem_pool)
+-		hcd->self.sg_tablesize = ~0;
+-	return 0;
+-}
+-
+-/* start HC running; it's halted, hcd_fotg210_init() has been run (once) */
+-static int fotg210_run(struct usb_hcd *hcd)
+-{
+-	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
+-	u32 temp;
+-
+-	hcd->uses_new_polling = 1;
+-
+-	/* EHCI spec section 4.1 */
+-
+-	fotg210_writel(fotg210, fotg210->periodic_dma,
+-			&fotg210->regs->frame_list);
+-	fotg210_writel(fotg210, (u32)fotg210->async->qh_dma,
+-			&fotg210->regs->async_next);
+-
+-	/*
+-	 * hcc_params controls whether fotg210->regs->segment must (!!!)
+-	 * be used; it constrains QH/ITD/SITD and QTD locations.
+-	 * dma_pool consistent memory always uses segment zero.
+-	 * streaming mappings for I/O buffers, like dma_map_single(),
+-	 * can return segments above 4GB, if the device allows.
+-	 *
+-	 * NOTE:  the dma mask is visible through dev->dma_mask, so
+-	 * drivers can pass this info along ... like NETIF_F_HIGHDMA,
+-	 * Scsi_Host.highmem_io, and so forth.  It's readonly to all
+-	 * host side drivers though.
+-	 */
+-	fotg210_readl(fotg210, &fotg210->caps->hcc_params);
+-
+-	/*
+-	 * Philips, Intel, and maybe others need CMD_RUN before the
+-	 * root hub will detect new devices (why?); NEC doesn't
+-	 */
+-	fotg210->command &= ~(CMD_IAAD|CMD_PSE|CMD_ASE|CMD_RESET);
+-	fotg210->command |= CMD_RUN;
+-	fotg210_writel(fotg210, fotg210->command, &fotg210->regs->command);
+-	dbg_cmd(fotg210, "init", fotg210->command);
+-
+-	/*
+-	 * Start, enabling full USB 2.0 functionality ... usb 1.1 devices
+-	 * are explicitly handed to companion controller(s), so no TT is
+-	 * involved with the root hub.  (Except where one is integrated,
+-	 * and there's no companion controller unless maybe for USB OTG.)
+-	 *
+-	 * Turning on the CF flag will transfer ownership of all ports
+-	 * from the companions to the EHCI controller.  If any of the
+-	 * companions are in the middle of a port reset at the time, it
+-	 * could cause trouble.  Write-locking ehci_cf_port_reset_rwsem
+-	 * guarantees that no resets are in progress.  After we set CF,
+-	 * a short delay lets the hardware catch up; new resets shouldn't
+-	 * be started before the port switching actions could complete.
+-	 */
+-	down_write(&ehci_cf_port_reset_rwsem);
+-	fotg210->rh_state = FOTG210_RH_RUNNING;
+-	/* unblock posted writes */
+-	fotg210_readl(fotg210, &fotg210->regs->command);
+-	usleep_range(5000, 10000);
+-	up_write(&ehci_cf_port_reset_rwsem);
+-	fotg210->last_periodic_enable = ktime_get_real();
+-
+-	temp = HC_VERSION(fotg210,
+-			fotg210_readl(fotg210, &fotg210->caps->hc_capbase));
+-	fotg210_info(fotg210,
+-			"USB %x.%x started, EHCI %x.%02x\n",
+-			((fotg210->sbrn & 0xf0) >> 4), (fotg210->sbrn & 0x0f),
+-			temp >> 8, temp & 0xff);
+-
+-	fotg210_writel(fotg210, INTR_MASK,
+-			&fotg210->regs->intr_enable); /* Turn On Interrupts */
+-
+-	/* GRR this is run-once init(), being done every time the HC starts.
+-	 * So long as they're part of class devices, we can't do it init()
+-	 * since the class device isn't created that early.
+-	 */
+-	create_debug_files(fotg210);
+-	create_sysfs_files(fotg210);
+-
+-	return 0;
+-}
+-
+-static int fotg210_setup(struct usb_hcd *hcd)
+-{
+-	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
+-	int retval;
+-
+-	fotg210->regs = (void __iomem *)fotg210->caps +
+-			HC_LENGTH(fotg210,
+-			fotg210_readl(fotg210, &fotg210->caps->hc_capbase));
+-	dbg_hcs_params(fotg210, "reset");
+-	dbg_hcc_params(fotg210, "reset");
+-
+-	/* cache this readonly data; minimize chip reads */
+-	fotg210->hcs_params = fotg210_readl(fotg210,
+-			&fotg210->caps->hcs_params);
+-
+-	fotg210->sbrn = HCD_USB2;
+-
+-	/* data structure init */
+-	retval = hcd_fotg210_init(hcd);
+-	if (retval)
+-		return retval;
+-
+-	retval = fotg210_halt(fotg210);
+-	if (retval)
+-		return retval;
+-
+-	fotg210_reset(fotg210);
+-
+-	return 0;
+-}
+-
+-static irqreturn_t fotg210_irq(struct usb_hcd *hcd)
+-{
+-	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
+-	u32 status, masked_status, pcd_status = 0, cmd;
+-	int bh;
+-
+-	spin_lock(&fotg210->lock);
+-
+-	status = fotg210_readl(fotg210, &fotg210->regs->status);
+-
+-	/* e.g. cardbus physical eject */
+-	if (status == ~(u32) 0) {
+-		fotg210_dbg(fotg210, "device removed\n");
+-		goto dead;
+-	}
+-
+-	/*
+-	 * We don't use STS_FLR, but some controllers don't like it to
+-	 * remain on, so mask it out along with the other status bits.
+-	 */
+-	masked_status = status & (INTR_MASK | STS_FLR);
+-
+-	/* Shared IRQ? */
+-	if (!masked_status ||
+-			unlikely(fotg210->rh_state == FOTG210_RH_HALTED)) {
+-		spin_unlock(&fotg210->lock);
+-		return IRQ_NONE;
+-	}
+-
+-	/* clear (just) interrupts */
+-	fotg210_writel(fotg210, masked_status, &fotg210->regs->status);
+-	cmd = fotg210_readl(fotg210, &fotg210->regs->command);
+-	bh = 0;
+-
+-	/* unrequested/ignored: Frame List Rollover */
+-	dbg_status(fotg210, "irq", status);
+-
+-	/* INT, ERR, and IAA interrupt rates can be throttled */
+-
+-	/* normal [4.15.1.2] or error [4.15.1.1] completion */
+-	if (likely((status & (STS_INT|STS_ERR)) != 0)) {
+-		if (likely((status & STS_ERR) == 0))
+-			INCR(fotg210->stats.normal);
+-		else
+-			INCR(fotg210->stats.error);
+-		bh = 1;
+-	}
+-
+-	/* complete the unlinking of some qh [4.15.2.3] */
+-	if (status & STS_IAA) {
+-
+-		/* Turn off the IAA watchdog */
+-		fotg210->enabled_hrtimer_events &=
+-			~BIT(FOTG210_HRTIMER_IAA_WATCHDOG);
+-
+-		/*
+-		 * Mild optimization: Allow another IAAD to reset the
+-		 * hrtimer, if one occurs before the next expiration.
+-		 * In theory we could always cancel the hrtimer, but
+-		 * tests show that about half the time it will be reset
+-		 * for some other event anyway.
+-		 */
+-		if (fotg210->next_hrtimer_event == FOTG210_HRTIMER_IAA_WATCHDOG)
+-			++fotg210->next_hrtimer_event;
+-
+-		/* guard against (alleged) silicon errata */
+-		if (cmd & CMD_IAAD)
+-			fotg210_dbg(fotg210, "IAA with IAAD still set?\n");
+-		if (fotg210->async_iaa) {
+-			INCR(fotg210->stats.iaa);
+-			end_unlink_async(fotg210);
+-		} else
+-			fotg210_dbg(fotg210, "IAA with nothing unlinked?\n");
+-	}
+-
+-	/* remote wakeup [4.3.1] */
+-	if (status & STS_PCD) {
+-		int pstatus;
+-		u32 __iomem *status_reg = &fotg210->regs->port_status;
+-
+-		/* kick root hub later */
+-		pcd_status = status;
+-
+-		/* resume root hub? */
+-		if (fotg210->rh_state == FOTG210_RH_SUSPENDED)
+-			usb_hcd_resume_root_hub(hcd);
+-
+-		pstatus = fotg210_readl(fotg210, status_reg);
+-
+-		if (test_bit(0, &fotg210->suspended_ports) &&
+-				((pstatus & PORT_RESUME) ||
+-				!(pstatus & PORT_SUSPEND)) &&
+-				(pstatus & PORT_PE) &&
+-				fotg210->reset_done[0] == 0) {
+-
+-			/* start 20 msec resume signaling from this port,
+-			 * and make hub_wq collect PORT_STAT_C_SUSPEND to
+-			 * stop that signaling.  Use 5 ms extra for safety,
+-			 * like usb_port_resume() does.
+-			 */
+-			fotg210->reset_done[0] = jiffies + msecs_to_jiffies(25);
+-			set_bit(0, &fotg210->resuming_ports);
+-			fotg210_dbg(fotg210, "port 1 remote wakeup\n");
+-			mod_timer(&hcd->rh_timer, fotg210->reset_done[0]);
+-		}
+-	}
+-
+-	/* PCI errors [4.15.2.4] */
+-	if (unlikely((status & STS_FATAL) != 0)) {
+-		fotg210_err(fotg210, "fatal error\n");
+-		dbg_cmd(fotg210, "fatal", cmd);
+-		dbg_status(fotg210, "fatal", status);
+-dead:
+-		usb_hc_died(hcd);
+-
+-		/* Don't let the controller do anything more */
+-		fotg210->shutdown = true;
+-		fotg210->rh_state = FOTG210_RH_STOPPING;
+-		fotg210->command &= ~(CMD_RUN | CMD_ASE | CMD_PSE);
+-		fotg210_writel(fotg210, fotg210->command,
+-				&fotg210->regs->command);
+-		fotg210_writel(fotg210, 0, &fotg210->regs->intr_enable);
+-		fotg210_handle_controller_death(fotg210);
+-
+-		/* Handle completions when the controller stops */
+-		bh = 0;
+-	}
+-
+-	if (bh)
+-		fotg210_work(fotg210);
+-	spin_unlock(&fotg210->lock);
+-	if (pcd_status)
+-		usb_hcd_poll_rh_status(hcd);
+-	return IRQ_HANDLED;
+-}
+-
+-/* non-error returns are a promise to giveback() the urb later
+- * we drop ownership so next owner (or urb unlink) can get it
+- *
+- * urb + dev is in hcd.self.controller.urb_list
+- * we're queueing TDs onto software and hardware lists
+- *
+- * hcd-specific init for hcpriv hasn't been done yet
+- *
+- * NOTE:  control, bulk, and interrupt share the same code to append TDs
+- * to a (possibly active) QH, and the same QH scanning code.
+- */
+-static int fotg210_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
+-		gfp_t mem_flags)
+-{
+-	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
+-	struct list_head qtd_list;
+-
+-	INIT_LIST_HEAD(&qtd_list);
+-
+-	switch (usb_pipetype(urb->pipe)) {
+-	case PIPE_CONTROL:
+-		/* qh_completions() code doesn't handle all the fault cases
+-		 * in multi-TD control transfers.  Even 1KB is rare anyway.
+-		 */
+-		if (urb->transfer_buffer_length > (16 * 1024))
+-			return -EMSGSIZE;
+-		fallthrough;
+-	/* case PIPE_BULK: */
+-	default:
+-		if (!qh_urb_transaction(fotg210, urb, &qtd_list, mem_flags))
+-			return -ENOMEM;
+-		return submit_async(fotg210, urb, &qtd_list, mem_flags);
+-
+-	case PIPE_INTERRUPT:
+-		if (!qh_urb_transaction(fotg210, urb, &qtd_list, mem_flags))
+-			return -ENOMEM;
+-		return intr_submit(fotg210, urb, &qtd_list, mem_flags);
+-
+-	case PIPE_ISOCHRONOUS:
+-		return itd_submit(fotg210, urb, mem_flags);
+-	}
+-}
+-
+-/* remove from hardware lists
+- * completions normally happen asynchronously
+- */
+-
+-static int fotg210_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
+-{
+-	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
+-	struct fotg210_qh *qh;
+-	unsigned long flags;
+-	int rc;
+-
+-	spin_lock_irqsave(&fotg210->lock, flags);
+-	rc = usb_hcd_check_unlink_urb(hcd, urb, status);
+-	if (rc)
+-		goto done;
+-
+-	switch (usb_pipetype(urb->pipe)) {
+-	/* case PIPE_CONTROL: */
+-	/* case PIPE_BULK:*/
+-	default:
+-		qh = (struct fotg210_qh *) urb->hcpriv;
+-		if (!qh)
+-			break;
+-		switch (qh->qh_state) {
+-		case QH_STATE_LINKED:
+-		case QH_STATE_COMPLETING:
+-			start_unlink_async(fotg210, qh);
+-			break;
+-		case QH_STATE_UNLINK:
+-		case QH_STATE_UNLINK_WAIT:
+-			/* already started */
+-			break;
+-		case QH_STATE_IDLE:
+-			/* QH might be waiting for a Clear-TT-Buffer */
+-			qh_completions(fotg210, qh);
+-			break;
+-		}
+-		break;
+-
+-	case PIPE_INTERRUPT:
+-		qh = (struct fotg210_qh *) urb->hcpriv;
+-		if (!qh)
+-			break;
+-		switch (qh->qh_state) {
+-		case QH_STATE_LINKED:
+-		case QH_STATE_COMPLETING:
+-			start_unlink_intr(fotg210, qh);
+-			break;
+-		case QH_STATE_IDLE:
+-			qh_completions(fotg210, qh);
+-			break;
+-		default:
+-			fotg210_dbg(fotg210, "bogus qh %p state %d\n",
+-					qh, qh->qh_state);
+-			goto done;
+-		}
+-		break;
+-
+-	case PIPE_ISOCHRONOUS:
+-		/* itd... */
+-
+-		/* wait till next completion, do it then. */
+-		/* completion irqs can wait up to 1024 msec, */
+-		break;
+-	}
+-done:
+-	spin_unlock_irqrestore(&fotg210->lock, flags);
+-	return rc;
+-}
+-
+-/* bulk qh holds the data toggle */
+-
+-static void fotg210_endpoint_disable(struct usb_hcd *hcd,
+-		struct usb_host_endpoint *ep)
+-{
+-	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
+-	unsigned long flags;
+-	struct fotg210_qh *qh, *tmp;
+-
+-	/* ASSERT:  any requests/urbs are being unlinked */
+-	/* ASSERT:  nobody can be submitting urbs for this any more */
+-
+-rescan:
+-	spin_lock_irqsave(&fotg210->lock, flags);
+-	qh = ep->hcpriv;
+-	if (!qh)
+-		goto done;
+-
+-	/* endpoints can be iso streams.  for now, we don't
+-	 * accelerate iso completions ... so spin a while.
+-	 */
+-	if (qh->hw == NULL) {
+-		struct fotg210_iso_stream *stream = ep->hcpriv;
+-
+-		if (!list_empty(&stream->td_list))
+-			goto idle_timeout;
+-
+-		/* BUG_ON(!list_empty(&stream->free_list)); */
+-		kfree(stream);
+-		goto done;
+-	}
+-
+-	if (fotg210->rh_state < FOTG210_RH_RUNNING)
+-		qh->qh_state = QH_STATE_IDLE;
+-	switch (qh->qh_state) {
+-	case QH_STATE_LINKED:
+-	case QH_STATE_COMPLETING:
+-		for (tmp = fotg210->async->qh_next.qh;
+-				tmp && tmp != qh;
+-				tmp = tmp->qh_next.qh)
+-			continue;
+-		/* periodic qh self-unlinks on empty, and a COMPLETING qh
+-		 * may already be unlinked.
+-		 */
+-		if (tmp)
+-			start_unlink_async(fotg210, qh);
+-		fallthrough;
+-	case QH_STATE_UNLINK:		/* wait for hw to finish? */
+-	case QH_STATE_UNLINK_WAIT:
+-idle_timeout:
+-		spin_unlock_irqrestore(&fotg210->lock, flags);
+-		schedule_timeout_uninterruptible(1);
+-		goto rescan;
+-	case QH_STATE_IDLE:		/* fully unlinked */
+-		if (qh->clearing_tt)
+-			goto idle_timeout;
+-		if (list_empty(&qh->qtd_list)) {
+-			qh_destroy(fotg210, qh);
+-			break;
+-		}
+-		fallthrough;
+-	default:
+-		/* caller was supposed to have unlinked any requests;
+-		 * that's not our job.  just leak this memory.
+-		 */
+-		fotg210_err(fotg210, "qh %p (#%02x) state %d%s\n",
+-				qh, ep->desc.bEndpointAddress, qh->qh_state,
+-				list_empty(&qh->qtd_list) ? "" : "(has tds)");
+-		break;
+-	}
+-done:
+-	ep->hcpriv = NULL;
+-	spin_unlock_irqrestore(&fotg210->lock, flags);
+-}
+-
+-static void fotg210_endpoint_reset(struct usb_hcd *hcd,
+-		struct usb_host_endpoint *ep)
+-{
+-	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
+-	struct fotg210_qh *qh;
+-	int eptype = usb_endpoint_type(&ep->desc);
+-	int epnum = usb_endpoint_num(&ep->desc);
+-	int is_out = usb_endpoint_dir_out(&ep->desc);
+-	unsigned long flags;
+-
+-	if (eptype != USB_ENDPOINT_XFER_BULK && eptype != USB_ENDPOINT_XFER_INT)
+-		return;
+-
+-	spin_lock_irqsave(&fotg210->lock, flags);
+-	qh = ep->hcpriv;
+-
+-	/* For Bulk and Interrupt endpoints we maintain the toggle state
+-	 * in the hardware; the toggle bits in udev aren't used at all.
+-	 * When an endpoint is reset by usb_clear_halt() we must reset
+-	 * the toggle bit in the QH.
+-	 */
+-	if (qh) {
+-		usb_settoggle(qh->dev, epnum, is_out, 0);
+-		if (!list_empty(&qh->qtd_list)) {
+-			WARN_ONCE(1, "clear_halt for a busy endpoint\n");
+-		} else if (qh->qh_state == QH_STATE_LINKED ||
+-				qh->qh_state == QH_STATE_COMPLETING) {
+-
+-			/* The toggle value in the QH can't be updated
+-			 * while the QH is active.  Unlink it now;
+-			 * re-linking will call qh_refresh().
+-			 */
+-			if (eptype == USB_ENDPOINT_XFER_BULK)
+-				start_unlink_async(fotg210, qh);
+-			else
+-				start_unlink_intr(fotg210, qh);
+-		}
+-	}
+-	spin_unlock_irqrestore(&fotg210->lock, flags);
+-}
+-
+-static int fotg210_get_frame(struct usb_hcd *hcd)
+-{
+-	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
+-
+-	return (fotg210_read_frame_index(fotg210) >> 3) %
+-		fotg210->periodic_size;
+-}
+-
+-/* The EHCI in ChipIdea HDRC cannot be a separate module or device,
+- * because its registers (and irq) are shared between host/gadget/otg
+- * functions  and in order to facilitate role switching we cannot
+- * give the fotg210 driver exclusive access to those.
+- */
+-MODULE_DESCRIPTION(DRIVER_DESC);
+-MODULE_AUTHOR(DRIVER_AUTHOR);
+-MODULE_LICENSE("GPL");
+-
+-static const struct hc_driver fotg210_fotg210_hc_driver = {
+-	.description		= hcd_name,
+-	.product_desc		= "Faraday USB2.0 Host Controller",
+-	.hcd_priv_size		= sizeof(struct fotg210_hcd),
+-
+-	/*
+-	 * generic hardware linkage
+-	 */
+-	.irq			= fotg210_irq,
+-	.flags			= HCD_MEMORY | HCD_DMA | HCD_USB2,
+-
+-	/*
+-	 * basic lifecycle operations
+-	 */
+-	.reset			= hcd_fotg210_init,
+-	.start			= fotg210_run,
+-	.stop			= fotg210_stop,
+-	.shutdown		= fotg210_shutdown,
+-
+-	/*
+-	 * managing i/o requests and associated device resources
+-	 */
+-	.urb_enqueue		= fotg210_urb_enqueue,
+-	.urb_dequeue		= fotg210_urb_dequeue,
+-	.endpoint_disable	= fotg210_endpoint_disable,
+-	.endpoint_reset		= fotg210_endpoint_reset,
+-
+-	/*
+-	 * scheduling support
+-	 */
+-	.get_frame_number	= fotg210_get_frame,
+-
+-	/*
+-	 * root hub support
+-	 */
+-	.hub_status_data	= fotg210_hub_status_data,
+-	.hub_control		= fotg210_hub_control,
+-	.bus_suspend		= fotg210_bus_suspend,
+-	.bus_resume		= fotg210_bus_resume,
+-
+-	.relinquish_port	= fotg210_relinquish_port,
+-	.port_handed_over	= fotg210_port_handed_over,
+-
+-	.clear_tt_buffer_complete = fotg210_clear_tt_buffer_complete,
+-};
+-
+-static void fotg210_init(struct fotg210_hcd *fotg210)
+-{
+-	u32 value;
+-
+-	iowrite32(GMIR_MDEV_INT | GMIR_MOTG_INT | GMIR_INT_POLARITY,
+-			&fotg210->regs->gmir);
+-
+-	value = ioread32(&fotg210->regs->otgcsr);
+-	value &= ~OTGCSR_A_BUS_DROP;
+-	value |= OTGCSR_A_BUS_REQ;
+-	iowrite32(value, &fotg210->regs->otgcsr);
+-}
+-
+-/*
+- * fotg210_hcd_probe - initialize faraday FOTG210 HCDs
+- *
+- * Allocates basic resources for this USB host controller, and
+- * then invokes the start() method for the HCD associated with it
+- * through the hotplug entry's driver_data.
+- */
+-static int fotg210_hcd_probe(struct platform_device *pdev)
+-{
+-	struct device *dev = &pdev->dev;
+-	struct usb_hcd *hcd;
+-	struct resource *res;
+-	int irq;
+-	int retval;
+-	struct fotg210_hcd *fotg210;
+-
+-	if (usb_disabled())
+-		return -ENODEV;
+-
+-	pdev->dev.power.power_state = PMSG_ON;
+-
+-	irq = platform_get_irq(pdev, 0);
+-	if (irq < 0)
+-		return irq;
+-
+-	hcd = usb_create_hcd(&fotg210_fotg210_hc_driver, dev,
+-			dev_name(dev));
+-	if (!hcd) {
+-		dev_err(dev, "failed to create hcd\n");
+-		retval = -ENOMEM;
+-		goto fail_create_hcd;
+-	}
+-
+-	hcd->has_tt = 1;
+-
+-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	hcd->regs = devm_ioremap_resource(&pdev->dev, res);
+-	if (IS_ERR(hcd->regs)) {
+-		retval = PTR_ERR(hcd->regs);
+-		goto failed_put_hcd;
+-	}
+-
+-	hcd->rsrc_start = res->start;
+-	hcd->rsrc_len = resource_size(res);
+-
+-	fotg210 = hcd_to_fotg210(hcd);
+-
+-	fotg210->caps = hcd->regs;
+-
+-	/* It's OK not to supply this clock */
+-	fotg210->pclk = clk_get(dev, "PCLK");
+-	if (!IS_ERR(fotg210->pclk)) {
+-		retval = clk_prepare_enable(fotg210->pclk);
+-		if (retval) {
+-			dev_err(dev, "failed to enable PCLK\n");
+-			goto failed_put_hcd;
+-		}
+-	} else if (PTR_ERR(fotg210->pclk) == -EPROBE_DEFER) {
+-		/*
+-		 * Percolate deferrals, for anything else,
+-		 * just live without the clocking.
+-		 */
+-		retval = PTR_ERR(fotg210->pclk);
+-		goto failed_dis_clk;
+-	}
+-
+-	retval = fotg210_setup(hcd);
+-	if (retval)
+-		goto failed_dis_clk;
+-
+-	fotg210_init(fotg210);
+-
+-	retval = usb_add_hcd(hcd, irq, IRQF_SHARED);
+-	if (retval) {
+-		dev_err(dev, "failed to add hcd with err %d\n", retval);
+-		goto failed_dis_clk;
+-	}
+-	device_wakeup_enable(hcd->self.controller);
+-	platform_set_drvdata(pdev, hcd);
+-
+-	return retval;
+-
+-failed_dis_clk:
+-	if (!IS_ERR(fotg210->pclk)) {
+-		clk_disable_unprepare(fotg210->pclk);
+-		clk_put(fotg210->pclk);
+-	}
+-failed_put_hcd:
+-	usb_put_hcd(hcd);
+-fail_create_hcd:
+-	dev_err(dev, "init %s fail, %d\n", dev_name(dev), retval);
+-	return retval;
+-}
+-
+-/*
+- * fotg210_hcd_remove - shutdown processing for EHCI HCDs
+- * @dev: USB Host Controller being removed
+- *
+- */
+-static int fotg210_hcd_remove(struct platform_device *pdev)
+-{
+-	struct usb_hcd *hcd = platform_get_drvdata(pdev);
+-	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
+-
+-	if (!IS_ERR(fotg210->pclk)) {
+-		clk_disable_unprepare(fotg210->pclk);
+-		clk_put(fotg210->pclk);
+-	}
+-
+-	usb_remove_hcd(hcd);
+-	usb_put_hcd(hcd);
+-
+-	return 0;
+-}
+-
+-#ifdef CONFIG_OF
+-static const struct of_device_id fotg210_of_match[] = {
+-	{ .compatible = "faraday,fotg210" },
+-	{},
+-};
+-MODULE_DEVICE_TABLE(of, fotg210_of_match);
+-#endif
+-
+-static struct platform_driver fotg210_hcd_driver = {
+-	.driver = {
+-		.name   = "fotg210-hcd",
+-		.of_match_table = of_match_ptr(fotg210_of_match),
+-	},
+-	.probe  = fotg210_hcd_probe,
+-	.remove = fotg210_hcd_remove,
+-};
+-
+-static int __init fotg210_hcd_init(void)
+-{
+-	int retval = 0;
+-
+-	if (usb_disabled())
+-		return -ENODEV;
+-
+-	set_bit(USB_EHCI_LOADED, &usb_hcds_loaded);
+-	if (test_bit(USB_UHCI_LOADED, &usb_hcds_loaded) ||
+-			test_bit(USB_OHCI_LOADED, &usb_hcds_loaded))
+-		pr_warn("Warning! fotg210_hcd should always be loaded before uhci_hcd and ohci_hcd, not after\n");
+-
+-	pr_debug("%s: block sizes: qh %zd qtd %zd itd %zd\n",
+-			hcd_name, sizeof(struct fotg210_qh),
+-			sizeof(struct fotg210_qtd),
+-			sizeof(struct fotg210_itd));
+-
+-	fotg210_debug_root = debugfs_create_dir("fotg210", usb_debug_root);
+-
+-	retval = platform_driver_register(&fotg210_hcd_driver);
+-	if (retval < 0)
+-		goto clean;
+-	return retval;
+-
+-clean:
+-	debugfs_remove(fotg210_debug_root);
+-	fotg210_debug_root = NULL;
+-
+-	clear_bit(USB_EHCI_LOADED, &usb_hcds_loaded);
+-	return retval;
+-}
+-module_init(fotg210_hcd_init);
+-
+-static void __exit fotg210_hcd_cleanup(void)
+-{
+-	platform_driver_unregister(&fotg210_hcd_driver);
+-	debugfs_remove(fotg210_debug_root);
+-	clear_bit(USB_EHCI_LOADED, &usb_hcds_loaded);
+-}
+-module_exit(fotg210_hcd_cleanup);
+--- /dev/null
++++ b/drivers/usb/fotg210/fotg210-hcd.c
+@@ -0,0 +1,5727 @@
++// SPDX-License-Identifier: GPL-2.0+
++/* Faraday FOTG210 EHCI-like driver
++ *
++ * Copyright (c) 2013 Faraday Technology Corporation
++ *
++ * Author: Yuan-Hsin Chen <yhchen@faraday-tech.com>
++ *	   Feng-Hsin Chiang <john453@faraday-tech.com>
++ *	   Po-Yu Chuang <ratbert.chuang@gmail.com>
++ *
++ * Most of code borrowed from the Linux-3.7 EHCI driver
++ */
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/device.h>
++#include <linux/dmapool.h>
++#include <linux/kernel.h>
++#include <linux/delay.h>
++#include <linux/ioport.h>
++#include <linux/sched.h>
++#include <linux/vmalloc.h>
++#include <linux/errno.h>
++#include <linux/init.h>
++#include <linux/hrtimer.h>
++#include <linux/list.h>
++#include <linux/interrupt.h>
++#include <linux/usb.h>
++#include <linux/usb/hcd.h>
++#include <linux/moduleparam.h>
++#include <linux/dma-mapping.h>
++#include <linux/debugfs.h>
++#include <linux/slab.h>
++#include <linux/uaccess.h>
++#include <linux/platform_device.h>
++#include <linux/io.h>
++#include <linux/iopoll.h>
++#include <linux/clk.h>
++
++#include <asm/byteorder.h>
++#include <asm/irq.h>
++#include <asm/unaligned.h>
++
++#define DRIVER_AUTHOR "Yuan-Hsin Chen"
++#define DRIVER_DESC "FOTG210 Host Controller (EHCI) Driver"
++static const char hcd_name[] = "fotg210_hcd";
++
++#undef FOTG210_URB_TRACE
++#define FOTG210_STATS
++
++/* magic numbers that can affect system performance */
++#define FOTG210_TUNE_CERR	3 /* 0-3 qtd retries; 0 == don't stop */
++#define FOTG210_TUNE_RL_HS	4 /* nak throttle; see 4.9 */
++#define FOTG210_TUNE_RL_TT	0
++#define FOTG210_TUNE_MULT_HS	1 /* 1-3 transactions/uframe; 4.10.3 */
++#define FOTG210_TUNE_MULT_TT	1
++
++/* Some drivers think it's safe to schedule isochronous transfers more than 256
++ * ms into the future (partly as a result of an old bug in the scheduling
++ * code).  In an attempt to avoid trouble, we will use a minimum scheduling
++ * length of 512 frames instead of 256.
++ */
++#define FOTG210_TUNE_FLS 1 /* (medium) 512-frame schedule */
++
++/* Initial IRQ latency:  faster than hw default */
++static int log2_irq_thresh; /* 0 to 6 */
++module_param(log2_irq_thresh, int, S_IRUGO);
++MODULE_PARM_DESC(log2_irq_thresh, "log2 IRQ latency, 1-64 microframes");
++
++/* initial park setting:  slower than hw default */
++static unsigned park;
++module_param(park, uint, S_IRUGO);
++MODULE_PARM_DESC(park, "park setting; 1-3 back-to-back async packets");
++
++/* for link power management(LPM) feature */
++static unsigned int hird;
++module_param(hird, int, S_IRUGO);
++MODULE_PARM_DESC(hird, "host initiated resume duration, +1 for each 75us");
++
++#define INTR_MASK (STS_IAA | STS_FATAL | STS_PCD | STS_ERR | STS_INT)
++
++#include "fotg210-hcd.h"
++
++#define fotg210_dbg(fotg210, fmt, args...) \
++	dev_dbg(fotg210_to_hcd(fotg210)->self.controller, fmt, ## args)
++#define fotg210_err(fotg210, fmt, args...) \
++	dev_err(fotg210_to_hcd(fotg210)->self.controller, fmt, ## args)
++#define fotg210_info(fotg210, fmt, args...) \
++	dev_info(fotg210_to_hcd(fotg210)->self.controller, fmt, ## args)
++#define fotg210_warn(fotg210, fmt, args...) \
++	dev_warn(fotg210_to_hcd(fotg210)->self.controller, fmt, ## args)
++
++/* check the values in the HCSPARAMS register (host controller _Structural_
++ * parameters) see EHCI spec, Table 2-4 for each value
++ */
++static void dbg_hcs_params(struct fotg210_hcd *fotg210, char *label)
++{
++	u32 params = fotg210_readl(fotg210, &fotg210->caps->hcs_params);
++
++	fotg210_dbg(fotg210, "%s hcs_params 0x%x ports=%d\n", label, params,
++			HCS_N_PORTS(params));
++}
++
++/* check the values in the HCCPARAMS register (host controller _Capability_
++ * parameters) see EHCI Spec, Table 2-5 for each value
++ */
++static void dbg_hcc_params(struct fotg210_hcd *fotg210, char *label)
++{
++	u32 params = fotg210_readl(fotg210, &fotg210->caps->hcc_params);
++
++	fotg210_dbg(fotg210, "%s hcc_params %04x uframes %s%s\n", label,
++			params,
++			HCC_PGM_FRAMELISTLEN(params) ? "256/512/1024" : "1024",
++			HCC_CANPARK(params) ? " park" : "");
++}
++
++static void __maybe_unused
++dbg_qtd(const char *label, struct fotg210_hcd *fotg210, struct fotg210_qtd *qtd)
++{
++	fotg210_dbg(fotg210, "%s td %p n%08x %08x t%08x p0=%08x\n", label, qtd,
++			hc32_to_cpup(fotg210, &qtd->hw_next),
++			hc32_to_cpup(fotg210, &qtd->hw_alt_next),
++			hc32_to_cpup(fotg210, &qtd->hw_token),
++			hc32_to_cpup(fotg210, &qtd->hw_buf[0]));
++	if (qtd->hw_buf[1])
++		fotg210_dbg(fotg210, "  p1=%08x p2=%08x p3=%08x p4=%08x\n",
++				hc32_to_cpup(fotg210, &qtd->hw_buf[1]),
++				hc32_to_cpup(fotg210, &qtd->hw_buf[2]),
++				hc32_to_cpup(fotg210, &qtd->hw_buf[3]),
++				hc32_to_cpup(fotg210, &qtd->hw_buf[4]));
++}
++
++static void __maybe_unused
++dbg_qh(const char *label, struct fotg210_hcd *fotg210, struct fotg210_qh *qh)
++{
++	struct fotg210_qh_hw *hw = qh->hw;
++
++	fotg210_dbg(fotg210, "%s qh %p n%08x info %x %x qtd %x\n", label, qh,
++			hw->hw_next, hw->hw_info1, hw->hw_info2,
++			hw->hw_current);
++
++	dbg_qtd("overlay", fotg210, (struct fotg210_qtd *) &hw->hw_qtd_next);
++}
++
++static void __maybe_unused
++dbg_itd(const char *label, struct fotg210_hcd *fotg210, struct fotg210_itd *itd)
++{
++	fotg210_dbg(fotg210, "%s[%d] itd %p, next %08x, urb %p\n", label,
++			itd->frame, itd, hc32_to_cpu(fotg210, itd->hw_next),
++			itd->urb);
++
++	fotg210_dbg(fotg210,
++			"  trans: %08x %08x %08x %08x %08x %08x %08x %08x\n",
++			hc32_to_cpu(fotg210, itd->hw_transaction[0]),
++			hc32_to_cpu(fotg210, itd->hw_transaction[1]),
++			hc32_to_cpu(fotg210, itd->hw_transaction[2]),
++			hc32_to_cpu(fotg210, itd->hw_transaction[3]),
++			hc32_to_cpu(fotg210, itd->hw_transaction[4]),
++			hc32_to_cpu(fotg210, itd->hw_transaction[5]),
++			hc32_to_cpu(fotg210, itd->hw_transaction[6]),
++			hc32_to_cpu(fotg210, itd->hw_transaction[7]));
++
++	fotg210_dbg(fotg210,
++			"  buf:   %08x %08x %08x %08x %08x %08x %08x\n",
++			hc32_to_cpu(fotg210, itd->hw_bufp[0]),
++			hc32_to_cpu(fotg210, itd->hw_bufp[1]),
++			hc32_to_cpu(fotg210, itd->hw_bufp[2]),
++			hc32_to_cpu(fotg210, itd->hw_bufp[3]),
++			hc32_to_cpu(fotg210, itd->hw_bufp[4]),
++			hc32_to_cpu(fotg210, itd->hw_bufp[5]),
++			hc32_to_cpu(fotg210, itd->hw_bufp[6]));
++
++	fotg210_dbg(fotg210, "  index: %d %d %d %d %d %d %d %d\n",
++			itd->index[0], itd->index[1], itd->index[2],
++			itd->index[3], itd->index[4], itd->index[5],
++			itd->index[6], itd->index[7]);
++}
++
++static int __maybe_unused
++dbg_status_buf(char *buf, unsigned len, const char *label, u32 status)
++{
++	return scnprintf(buf, len, "%s%sstatus %04x%s%s%s%s%s%s%s%s%s%s",
++			label, label[0] ? " " : "", status,
++			(status & STS_ASS) ? " Async" : "",
++			(status & STS_PSS) ? " Periodic" : "",
++			(status & STS_RECL) ? " Recl" : "",
++			(status & STS_HALT) ? " Halt" : "",
++			(status & STS_IAA) ? " IAA" : "",
++			(status & STS_FATAL) ? " FATAL" : "",
++			(status & STS_FLR) ? " FLR" : "",
++			(status & STS_PCD) ? " PCD" : "",
++			(status & STS_ERR) ? " ERR" : "",
++			(status & STS_INT) ? " INT" : "");
++}
++
++static int __maybe_unused
++dbg_intr_buf(char *buf, unsigned len, const char *label, u32 enable)
++{
++	return scnprintf(buf, len, "%s%sintrenable %02x%s%s%s%s%s%s",
++			label, label[0] ? " " : "", enable,
++			(enable & STS_IAA) ? " IAA" : "",
++			(enable & STS_FATAL) ? " FATAL" : "",
++			(enable & STS_FLR) ? " FLR" : "",
++			(enable & STS_PCD) ? " PCD" : "",
++			(enable & STS_ERR) ? " ERR" : "",
++			(enable & STS_INT) ? " INT" : "");
++}
++
++static const char *const fls_strings[] = { "1024", "512", "256", "??" };
++
++static int dbg_command_buf(char *buf, unsigned len, const char *label,
++		u32 command)
++{
++	return scnprintf(buf, len,
++			"%s%scommand %07x %s=%d ithresh=%d%s%s%s period=%s%s %s",
++			label, label[0] ? " " : "", command,
++			(command & CMD_PARK) ? " park" : "(park)",
++			CMD_PARK_CNT(command),
++			(command >> 16) & 0x3f,
++			(command & CMD_IAAD) ? " IAAD" : "",
++			(command & CMD_ASE) ? " Async" : "",
++			(command & CMD_PSE) ? " Periodic" : "",
++			fls_strings[(command >> 2) & 0x3],
++			(command & CMD_RESET) ? " Reset" : "",
++			(command & CMD_RUN) ? "RUN" : "HALT");
++}
++
++static char *dbg_port_buf(char *buf, unsigned len, const char *label, int port,
++		u32 status)
++{
++	char *sig;
++
++	/* signaling state */
++	switch (status & (3 << 10)) {
++	case 0 << 10:
++		sig = "se0";
++		break;
++	case 1 << 10:
++		sig = "k";
++		break; /* low speed */
++	case 2 << 10:
++		sig = "j";
++		break;
++	default:
++		sig = "?";
++		break;
++	}
++
++	scnprintf(buf, len, "%s%sport:%d status %06x %d sig=%s%s%s%s%s%s%s%s",
++			label, label[0] ? " " : "", port, status,
++			status >> 25, /*device address */
++			sig,
++			(status & PORT_RESET) ? " RESET" : "",
++			(status & PORT_SUSPEND) ? " SUSPEND" : "",
++			(status & PORT_RESUME) ? " RESUME" : "",
++			(status & PORT_PEC) ? " PEC" : "",
++			(status & PORT_PE) ? " PE" : "",
++			(status & PORT_CSC) ? " CSC" : "",
++			(status & PORT_CONNECT) ? " CONNECT" : "");
++
++	return buf;
++}
++
++/* functions have the "wrong" filename when they're output... */
++#define dbg_status(fotg210, label, status) {			\
++	char _buf[80];						\
++	dbg_status_buf(_buf, sizeof(_buf), label, status);	\
++	fotg210_dbg(fotg210, "%s\n", _buf);			\
++}
++
++#define dbg_cmd(fotg210, label, command) {			\
++	char _buf[80];						\
++	dbg_command_buf(_buf, sizeof(_buf), label, command);	\
++	fotg210_dbg(fotg210, "%s\n", _buf);			\
++}
++
++#define dbg_port(fotg210, label, port, status) {			       \
++	char _buf[80];							       \
++	fotg210_dbg(fotg210, "%s\n",					       \
++			dbg_port_buf(_buf, sizeof(_buf), label, port, status));\
++}
++
++/* troubleshooting help: expose state in debugfs */
++static int debug_async_open(struct inode *, struct file *);
++static int debug_periodic_open(struct inode *, struct file *);
++static int debug_registers_open(struct inode *, struct file *);
++static int debug_async_open(struct inode *, struct file *);
++
++static ssize_t debug_output(struct file*, char __user*, size_t, loff_t*);
++static int debug_close(struct inode *, struct file *);
++
++static const struct file_operations debug_async_fops = {
++	.owner		= THIS_MODULE,
++	.open		= debug_async_open,
++	.read		= debug_output,
++	.release	= debug_close,
++	.llseek		= default_llseek,
++};
++static const struct file_operations debug_periodic_fops = {
++	.owner		= THIS_MODULE,
++	.open		= debug_periodic_open,
++	.read		= debug_output,
++	.release	= debug_close,
++	.llseek		= default_llseek,
++};
++static const struct file_operations debug_registers_fops = {
++	.owner		= THIS_MODULE,
++	.open		= debug_registers_open,
++	.read		= debug_output,
++	.release	= debug_close,
++	.llseek		= default_llseek,
++};
++
++static struct dentry *fotg210_debug_root;
++
++struct debug_buffer {
++	ssize_t (*fill_func)(struct debug_buffer *);	/* fill method */
++	struct usb_bus *bus;
++	struct mutex mutex;	/* protect filling of buffer */
++	size_t count;		/* number of characters filled into buffer */
++	char *output_buf;
++	size_t alloc_size;
++};
++
++static inline char speed_char(u32 scratch)
++{
++	switch (scratch & (3 << 12)) {
++	case QH_FULL_SPEED:
++		return 'f';
++
++	case QH_LOW_SPEED:
++		return 'l';
++
++	case QH_HIGH_SPEED:
++		return 'h';
++
++	default:
++		return '?';
++	}
++}
++
++static inline char token_mark(struct fotg210_hcd *fotg210, __hc32 token)
++{
++	__u32 v = hc32_to_cpu(fotg210, token);
++
++	if (v & QTD_STS_ACTIVE)
++		return '*';
++	if (v & QTD_STS_HALT)
++		return '-';
++	if (!IS_SHORT_READ(v))
++		return ' ';
++	/* tries to advance through hw_alt_next */
++	return '/';
++}
++
++static void qh_lines(struct fotg210_hcd *fotg210, struct fotg210_qh *qh,
++		char **nextp, unsigned *sizep)
++{
++	u32 scratch;
++	u32 hw_curr;
++	struct fotg210_qtd *td;
++	unsigned temp;
++	unsigned size = *sizep;
++	char *next = *nextp;
++	char mark;
++	__le32 list_end = FOTG210_LIST_END(fotg210);
++	struct fotg210_qh_hw *hw = qh->hw;
++
++	if (hw->hw_qtd_next == list_end) /* NEC does this */
++		mark = '@';
++	else
++		mark = token_mark(fotg210, hw->hw_token);
++	if (mark == '/') { /* qh_alt_next controls qh advance? */
++		if ((hw->hw_alt_next & QTD_MASK(fotg210)) ==
++		    fotg210->async->hw->hw_alt_next)
++			mark = '#'; /* blocked */
++		else if (hw->hw_alt_next == list_end)
++			mark = '.'; /* use hw_qtd_next */
++		/* else alt_next points to some other qtd */
++	}
++	scratch = hc32_to_cpup(fotg210, &hw->hw_info1);
++	hw_curr = (mark == '*') ? hc32_to_cpup(fotg210, &hw->hw_current) : 0;
++	temp = scnprintf(next, size,
++			"qh/%p dev%d %cs ep%d %08x %08x(%08x%c %s nak%d)",
++			qh, scratch & 0x007f,
++			speed_char(scratch),
++			(scratch >> 8) & 0x000f,
++			scratch, hc32_to_cpup(fotg210, &hw->hw_info2),
++			hc32_to_cpup(fotg210, &hw->hw_token), mark,
++			(cpu_to_hc32(fotg210, QTD_TOGGLE) & hw->hw_token)
++				? "data1" : "data0",
++			(hc32_to_cpup(fotg210, &hw->hw_alt_next) >> 1) & 0x0f);
++	size -= temp;
++	next += temp;
++
++	/* hc may be modifying the list as we read it ... */
++	list_for_each_entry(td, &qh->qtd_list, qtd_list) {
++		scratch = hc32_to_cpup(fotg210, &td->hw_token);
++		mark = ' ';
++		if (hw_curr == td->qtd_dma)
++			mark = '*';
++		else if (hw->hw_qtd_next == cpu_to_hc32(fotg210, td->qtd_dma))
++			mark = '+';
++		else if (QTD_LENGTH(scratch)) {
++			if (td->hw_alt_next == fotg210->async->hw->hw_alt_next)
++				mark = '#';
++			else if (td->hw_alt_next != list_end)
++				mark = '/';
++		}
++		temp = snprintf(next, size,
++				"\n\t%p%c%s len=%d %08x urb %p",
++				td, mark, ({ char *tmp;
++				switch ((scratch>>8)&0x03) {
++				case 0:
++					tmp = "out";
++					break;
++				case 1:
++					tmp = "in";
++					break;
++				case 2:
++					tmp = "setup";
++					break;
++				default:
++					tmp = "?";
++					break;
++				 } tmp; }),
++				(scratch >> 16) & 0x7fff,
++				scratch,
++				td->urb);
++		if (size < temp)
++			temp = size;
++		size -= temp;
++		next += temp;
++		if (temp == size)
++			goto done;
++	}
++
++	temp = snprintf(next, size, "\n");
++	if (size < temp)
++		temp = size;
++
++	size -= temp;
++	next += temp;
++
++done:
++	*sizep = size;
++	*nextp = next;
++}
++
++static ssize_t fill_async_buffer(struct debug_buffer *buf)
++{
++	struct usb_hcd *hcd;
++	struct fotg210_hcd *fotg210;
++	unsigned long flags;
++	unsigned temp, size;
++	char *next;
++	struct fotg210_qh *qh;
++
++	hcd = bus_to_hcd(buf->bus);
++	fotg210 = hcd_to_fotg210(hcd);
++	next = buf->output_buf;
++	size = buf->alloc_size;
++
++	*next = 0;
++
++	/* dumps a snapshot of the async schedule.
++	 * usually empty except for long-term bulk reads, or head.
++	 * one QH per line, and TDs we know about
++	 */
++	spin_lock_irqsave(&fotg210->lock, flags);
++	for (qh = fotg210->async->qh_next.qh; size > 0 && qh;
++			qh = qh->qh_next.qh)
++		qh_lines(fotg210, qh, &next, &size);
++	if (fotg210->async_unlink && size > 0) {
++		temp = scnprintf(next, size, "\nunlink =\n");
++		size -= temp;
++		next += temp;
++
++		for (qh = fotg210->async_unlink; size > 0 && qh;
++				qh = qh->unlink_next)
++			qh_lines(fotg210, qh, &next, &size);
++	}
++	spin_unlock_irqrestore(&fotg210->lock, flags);
++
++	return strlen(buf->output_buf);
++}
++
++/* count tds, get ep direction */
++static unsigned output_buf_tds_dir(char *buf, struct fotg210_hcd *fotg210,
++		struct fotg210_qh_hw *hw, struct fotg210_qh *qh, unsigned size)
++{
++	u32 scratch = hc32_to_cpup(fotg210, &hw->hw_info1);
++	struct fotg210_qtd *qtd;
++	char *type = "";
++	unsigned temp = 0;
++
++	/* count tds, get ep direction */
++	list_for_each_entry(qtd, &qh->qtd_list, qtd_list) {
++		temp++;
++		switch ((hc32_to_cpu(fotg210, qtd->hw_token) >> 8) & 0x03) {
++		case 0:
++			type = "out";
++			continue;
++		case 1:
++			type = "in";
++			continue;
++		}
++	}
++
++	return scnprintf(buf, size, "(%c%d ep%d%s [%d/%d] q%d p%d)",
++			speed_char(scratch), scratch & 0x007f,
++			(scratch >> 8) & 0x000f, type, qh->usecs,
++			qh->c_usecs, temp, (scratch >> 16) & 0x7ff);
++}
++
++#define DBG_SCHED_LIMIT 64
++static ssize_t fill_periodic_buffer(struct debug_buffer *buf)
++{
++	struct usb_hcd *hcd;
++	struct fotg210_hcd *fotg210;
++	unsigned long flags;
++	union fotg210_shadow p, *seen;
++	unsigned temp, size, seen_count;
++	char *next;
++	unsigned i;
++	__hc32 tag;
++
++	seen = kmalloc_array(DBG_SCHED_LIMIT, sizeof(*seen), GFP_ATOMIC);
++	if (!seen)
++		return 0;
++
++	seen_count = 0;
++
++	hcd = bus_to_hcd(buf->bus);
++	fotg210 = hcd_to_fotg210(hcd);
++	next = buf->output_buf;
++	size = buf->alloc_size;
++
++	temp = scnprintf(next, size, "size = %d\n", fotg210->periodic_size);
++	size -= temp;
++	next += temp;
++
++	/* dump a snapshot of the periodic schedule.
++	 * iso changes, interrupt usually doesn't.
++	 */
++	spin_lock_irqsave(&fotg210->lock, flags);
++	for (i = 0; i < fotg210->periodic_size; i++) {
++		p = fotg210->pshadow[i];
++		if (likely(!p.ptr))
++			continue;
++
++		tag = Q_NEXT_TYPE(fotg210, fotg210->periodic[i]);
++
++		temp = scnprintf(next, size, "%4d: ", i);
++		size -= temp;
++		next += temp;
++
++		do {
++			struct fotg210_qh_hw *hw;
++
++			switch (hc32_to_cpu(fotg210, tag)) {
++			case Q_TYPE_QH:
++				hw = p.qh->hw;
++				temp = scnprintf(next, size, " qh%d-%04x/%p",
++						p.qh->period,
++						hc32_to_cpup(fotg210,
++							&hw->hw_info2)
++							/* uframe masks */
++							& (QH_CMASK | QH_SMASK),
++						p.qh);
++				size -= temp;
++				next += temp;
++				/* don't repeat what follows this qh */
++				for (temp = 0; temp < seen_count; temp++) {
++					if (seen[temp].ptr != p.ptr)
++						continue;
++					if (p.qh->qh_next.ptr) {
++						temp = scnprintf(next, size,
++								" ...");
++						size -= temp;
++						next += temp;
++					}
++					break;
++				}
++				/* show more info the first time around */
++				if (temp == seen_count) {
++					temp = output_buf_tds_dir(next,
++							fotg210, hw,
++							p.qh, size);
++
++					if (seen_count < DBG_SCHED_LIMIT)
++						seen[seen_count++].qh = p.qh;
++				} else
++					temp = 0;
++				tag = Q_NEXT_TYPE(fotg210, hw->hw_next);
++				p = p.qh->qh_next;
++				break;
++			case Q_TYPE_FSTN:
++				temp = scnprintf(next, size,
++						" fstn-%8x/%p",
++						p.fstn->hw_prev, p.fstn);
++				tag = Q_NEXT_TYPE(fotg210, p.fstn->hw_next);
++				p = p.fstn->fstn_next;
++				break;
++			case Q_TYPE_ITD:
++				temp = scnprintf(next, size,
++						" itd/%p", p.itd);
++				tag = Q_NEXT_TYPE(fotg210, p.itd->hw_next);
++				p = p.itd->itd_next;
++				break;
++			}
++			size -= temp;
++			next += temp;
++		} while (p.ptr);
++
++		temp = scnprintf(next, size, "\n");
++		size -= temp;
++		next += temp;
++	}
++	spin_unlock_irqrestore(&fotg210->lock, flags);
++	kfree(seen);
++
++	return buf->alloc_size - size;
++}
++#undef DBG_SCHED_LIMIT
++
++static const char *rh_state_string(struct fotg210_hcd *fotg210)
++{
++	switch (fotg210->rh_state) {
++	case FOTG210_RH_HALTED:
++		return "halted";
++	case FOTG210_RH_SUSPENDED:
++		return "suspended";
++	case FOTG210_RH_RUNNING:
++		return "running";
++	case FOTG210_RH_STOPPING:
++		return "stopping";
++	}
++	return "?";
++}
++
++static ssize_t fill_registers_buffer(struct debug_buffer *buf)
++{
++	struct usb_hcd *hcd;
++	struct fotg210_hcd *fotg210;
++	unsigned long flags;
++	unsigned temp, size, i;
++	char *next, scratch[80];
++	static const char fmt[] = "%*s\n";
++	static const char label[] = "";
++
++	hcd = bus_to_hcd(buf->bus);
++	fotg210 = hcd_to_fotg210(hcd);
++	next = buf->output_buf;
++	size = buf->alloc_size;
++
++	spin_lock_irqsave(&fotg210->lock, flags);
++
++	if (!HCD_HW_ACCESSIBLE(hcd)) {
++		size = scnprintf(next, size,
++				"bus %s, device %s\n"
++				"%s\n"
++				"SUSPENDED(no register access)\n",
++				hcd->self.controller->bus->name,
++				dev_name(hcd->self.controller),
++				hcd->product_desc);
++		goto done;
++	}
++
++	/* Capability Registers */
++	i = HC_VERSION(fotg210, fotg210_readl(fotg210,
++			&fotg210->caps->hc_capbase));
++	temp = scnprintf(next, size,
++			"bus %s, device %s\n"
++			"%s\n"
++			"EHCI %x.%02x, rh state %s\n",
++			hcd->self.controller->bus->name,
++			dev_name(hcd->self.controller),
++			hcd->product_desc,
++			i >> 8, i & 0x0ff, rh_state_string(fotg210));
++	size -= temp;
++	next += temp;
++
++	/* FIXME interpret both types of params */
++	i = fotg210_readl(fotg210, &fotg210->caps->hcs_params);
++	temp = scnprintf(next, size, "structural params 0x%08x\n", i);
++	size -= temp;
++	next += temp;
++
++	i = fotg210_readl(fotg210, &fotg210->caps->hcc_params);
++	temp = scnprintf(next, size, "capability params 0x%08x\n", i);
++	size -= temp;
++	next += temp;
++
++	/* Operational Registers */
++	temp = dbg_status_buf(scratch, sizeof(scratch), label,
++			fotg210_readl(fotg210, &fotg210->regs->status));
++	temp = scnprintf(next, size, fmt, temp, scratch);
++	size -= temp;
++	next += temp;
++
++	temp = dbg_command_buf(scratch, sizeof(scratch), label,
++			fotg210_readl(fotg210, &fotg210->regs->command));
++	temp = scnprintf(next, size, fmt, temp, scratch);
++	size -= temp;
++	next += temp;
++
++	temp = dbg_intr_buf(scratch, sizeof(scratch), label,
++			fotg210_readl(fotg210, &fotg210->regs->intr_enable));
++	temp = scnprintf(next, size, fmt, temp, scratch);
++	size -= temp;
++	next += temp;
++
++	temp = scnprintf(next, size, "uframe %04x\n",
++			fotg210_read_frame_index(fotg210));
++	size -= temp;
++	next += temp;
++
++	if (fotg210->async_unlink) {
++		temp = scnprintf(next, size, "async unlink qh %p\n",
++				fotg210->async_unlink);
++		size -= temp;
++		next += temp;
++	}
++
++#ifdef FOTG210_STATS
++	temp = scnprintf(next, size,
++			"irq normal %ld err %ld iaa %ld(lost %ld)\n",
++			fotg210->stats.normal, fotg210->stats.error,
++			fotg210->stats.iaa, fotg210->stats.lost_iaa);
++	size -= temp;
++	next += temp;
++
++	temp = scnprintf(next, size, "complete %ld unlink %ld\n",
++			fotg210->stats.complete, fotg210->stats.unlink);
++	size -= temp;
++	next += temp;
++#endif
++
++done:
++	spin_unlock_irqrestore(&fotg210->lock, flags);
++
++	return buf->alloc_size - size;
++}
++
++static struct debug_buffer
++*alloc_buffer(struct usb_bus *bus, ssize_t (*fill_func)(struct debug_buffer *))
++{
++	struct debug_buffer *buf;
++
++	buf = kzalloc(sizeof(struct debug_buffer), GFP_KERNEL);
++
++	if (buf) {
++		buf->bus = bus;
++		buf->fill_func = fill_func;
++		mutex_init(&buf->mutex);
++		buf->alloc_size = PAGE_SIZE;
++	}
++
++	return buf;
++}
++
++static int fill_buffer(struct debug_buffer *buf)
++{
++	int ret = 0;
++
++	if (!buf->output_buf)
++		buf->output_buf = vmalloc(buf->alloc_size);
++
++	if (!buf->output_buf) {
++		ret = -ENOMEM;
++		goto out;
++	}
++
++	ret = buf->fill_func(buf);
++
++	if (ret >= 0) {
++		buf->count = ret;
++		ret = 0;
++	}
++
++out:
++	return ret;
++}
++
++static ssize_t debug_output(struct file *file, char __user *user_buf,
++		size_t len, loff_t *offset)
++{
++	struct debug_buffer *buf = file->private_data;
++	int ret = 0;
++
++	mutex_lock(&buf->mutex);
++	if (buf->count == 0) {
++		ret = fill_buffer(buf);
++		if (ret != 0) {
++			mutex_unlock(&buf->mutex);
++			goto out;
++		}
++	}
++	mutex_unlock(&buf->mutex);
++
++	ret = simple_read_from_buffer(user_buf, len, offset,
++			buf->output_buf, buf->count);
++
++out:
++	return ret;
++
++}
++
++static int debug_close(struct inode *inode, struct file *file)
++{
++	struct debug_buffer *buf = file->private_data;
++
++	if (buf) {
++		vfree(buf->output_buf);
++		kfree(buf);
++	}
++
++	return 0;
++}
++static int debug_async_open(struct inode *inode, struct file *file)
++{
++	file->private_data = alloc_buffer(inode->i_private, fill_async_buffer);
++
++	return file->private_data ? 0 : -ENOMEM;
++}
++
++static int debug_periodic_open(struct inode *inode, struct file *file)
++{
++	struct debug_buffer *buf;
++
++	buf = alloc_buffer(inode->i_private, fill_periodic_buffer);
++	if (!buf)
++		return -ENOMEM;
++
++	buf->alloc_size = (sizeof(void *) == 4 ? 6 : 8)*PAGE_SIZE;
++	file->private_data = buf;
++	return 0;
++}
++
++static int debug_registers_open(struct inode *inode, struct file *file)
++{
++	file->private_data = alloc_buffer(inode->i_private,
++			fill_registers_buffer);
++
++	return file->private_data ? 0 : -ENOMEM;
++}
++
++static inline void create_debug_files(struct fotg210_hcd *fotg210)
++{
++	struct usb_bus *bus = &fotg210_to_hcd(fotg210)->self;
++	struct dentry *root;
++
++	root = debugfs_create_dir(bus->bus_name, fotg210_debug_root);
++
++	debugfs_create_file("async", S_IRUGO, root, bus, &debug_async_fops);
++	debugfs_create_file("periodic", S_IRUGO, root, bus,
++			    &debug_periodic_fops);
++	debugfs_create_file("registers", S_IRUGO, root, bus,
++			    &debug_registers_fops);
++}
++
++static inline void remove_debug_files(struct fotg210_hcd *fotg210)
++{
++	struct usb_bus *bus = &fotg210_to_hcd(fotg210)->self;
++
++	debugfs_lookup_and_remove(bus->bus_name, fotg210_debug_root);
++}
++
++/* handshake - spin reading hc until handshake completes or fails
++ * @ptr: address of hc register to be read
++ * @mask: bits to look at in result of read
++ * @done: value of those bits when handshake succeeds
++ * @usec: timeout in microseconds
++ *
++ * Returns negative errno, or zero on success
++ *
++ * Success happens when the "mask" bits have the specified value (hardware
++ * handshake done).  There are two failure modes:  "usec" have passed (major
++ * hardware flakeout), or the register reads as all-ones (hardware removed).
++ *
++ * That last failure should_only happen in cases like physical cardbus eject
++ * before driver shutdown. But it also seems to be caused by bugs in cardbus
++ * bridge shutdown:  shutting down the bridge before the devices using it.
++ */
++static int handshake(struct fotg210_hcd *fotg210, void __iomem *ptr,
++		u32 mask, u32 done, int usec)
++{
++	u32 result;
++	int ret;
++
++	ret = readl_poll_timeout_atomic(ptr, result,
++					((result & mask) == done ||
++					 result == U32_MAX), 1, usec);
++	if (result == U32_MAX)		/* card removed */
++		return -ENODEV;
++
++	return ret;
++}
++
++/* Force HC to halt state from unknown (EHCI spec section 2.3).
++ * Must be called with interrupts enabled and the lock not held.
++ */
++static int fotg210_halt(struct fotg210_hcd *fotg210)
++{
++	u32 temp;
++
++	spin_lock_irq(&fotg210->lock);
++
++	/* disable any irqs left enabled by previous code */
++	fotg210_writel(fotg210, 0, &fotg210->regs->intr_enable);
++
++	/*
++	 * This routine gets called during probe before fotg210->command
++	 * has been initialized, so we can't rely on its value.
++	 */
++	fotg210->command &= ~CMD_RUN;
++	temp = fotg210_readl(fotg210, &fotg210->regs->command);
++	temp &= ~(CMD_RUN | CMD_IAAD);
++	fotg210_writel(fotg210, temp, &fotg210->regs->command);
++
++	spin_unlock_irq(&fotg210->lock);
++	synchronize_irq(fotg210_to_hcd(fotg210)->irq);
++
++	return handshake(fotg210, &fotg210->regs->status,
++			STS_HALT, STS_HALT, 16 * 125);
++}
++
++/* Reset a non-running (STS_HALT == 1) controller.
++ * Must be called with interrupts enabled and the lock not held.
++ */
++static int fotg210_reset(struct fotg210_hcd *fotg210)
++{
++	int retval;
++	u32 command = fotg210_readl(fotg210, &fotg210->regs->command);
++
++	/* If the EHCI debug controller is active, special care must be
++	 * taken before and after a host controller reset
++	 */
++	if (fotg210->debug && !dbgp_reset_prep(fotg210_to_hcd(fotg210)))
++		fotg210->debug = NULL;
++
++	command |= CMD_RESET;
++	dbg_cmd(fotg210, "reset", command);
++	fotg210_writel(fotg210, command, &fotg210->regs->command);
++	fotg210->rh_state = FOTG210_RH_HALTED;
++	fotg210->next_statechange = jiffies;
++	retval = handshake(fotg210, &fotg210->regs->command,
++			CMD_RESET, 0, 250 * 1000);
++
++	if (retval)
++		return retval;
++
++	if (fotg210->debug)
++		dbgp_external_startup(fotg210_to_hcd(fotg210));
++
++	fotg210->port_c_suspend = fotg210->suspended_ports =
++			fotg210->resuming_ports = 0;
++	return retval;
++}
++
++/* Idle the controller (turn off the schedules).
++ * Must be called with interrupts enabled and the lock not held.
++ */
++static void fotg210_quiesce(struct fotg210_hcd *fotg210)
++{
++	u32 temp;
++
++	if (fotg210->rh_state != FOTG210_RH_RUNNING)
++		return;
++
++	/* wait for any schedule enables/disables to take effect */
++	temp = (fotg210->command << 10) & (STS_ASS | STS_PSS);
++	handshake(fotg210, &fotg210->regs->status, STS_ASS | STS_PSS, temp,
++			16 * 125);
++
++	/* then disable anything that's still active */
++	spin_lock_irq(&fotg210->lock);
++	fotg210->command &= ~(CMD_ASE | CMD_PSE);
++	fotg210_writel(fotg210, fotg210->command, &fotg210->regs->command);
++	spin_unlock_irq(&fotg210->lock);
++
++	/* hardware can take 16 microframes to turn off ... */
++	handshake(fotg210, &fotg210->regs->status, STS_ASS | STS_PSS, 0,
++			16 * 125);
++}
++
++static void end_unlink_async(struct fotg210_hcd *fotg210);
++static void unlink_empty_async(struct fotg210_hcd *fotg210);
++static void fotg210_work(struct fotg210_hcd *fotg210);
++static void start_unlink_intr(struct fotg210_hcd *fotg210,
++			      struct fotg210_qh *qh);
++static void end_unlink_intr(struct fotg210_hcd *fotg210, struct fotg210_qh *qh);
++
++/* Set a bit in the USBCMD register */
++static void fotg210_set_command_bit(struct fotg210_hcd *fotg210, u32 bit)
++{
++	fotg210->command |= bit;
++	fotg210_writel(fotg210, fotg210->command, &fotg210->regs->command);
++
++	/* unblock posted write */
++	fotg210_readl(fotg210, &fotg210->regs->command);
++}
++
++/* Clear a bit in the USBCMD register */
++static void fotg210_clear_command_bit(struct fotg210_hcd *fotg210, u32 bit)
++{
++	fotg210->command &= ~bit;
++	fotg210_writel(fotg210, fotg210->command, &fotg210->regs->command);
++
++	/* unblock posted write */
++	fotg210_readl(fotg210, &fotg210->regs->command);
++}
++
++/* EHCI timer support...  Now using hrtimers.
++ *
++ * Lots of different events are triggered from fotg210->hrtimer.  Whenever
++ * the timer routine runs, it checks each possible event; events that are
++ * currently enabled and whose expiration time has passed get handled.
++ * The set of enabled events is stored as a collection of bitflags in
++ * fotg210->enabled_hrtimer_events, and they are numbered in order of
++ * increasing delay values (ranging between 1 ms and 100 ms).
++ *
++ * Rather than implementing a sorted list or tree of all pending events,
++ * we keep track only of the lowest-numbered pending event, in
++ * fotg210->next_hrtimer_event.  Whenever fotg210->hrtimer gets restarted, its
++ * expiration time is set to the timeout value for this event.
++ *
++ * As a result, events might not get handled right away; the actual delay
++ * could be anywhere up to twice the requested delay.  This doesn't
++ * matter, because none of the events are especially time-critical.  The
++ * ones that matter most all have a delay of 1 ms, so they will be
++ * handled after 2 ms at most, which is okay.  In addition to this, we
++ * allow for an expiration range of 1 ms.
++ */
++
++/* Delay lengths for the hrtimer event types.
++ * Keep this list sorted by delay length, in the same order as
++ * the event types indexed by enum fotg210_hrtimer_event in fotg210.h.
++ */
++static unsigned event_delays_ns[] = {
++	1 * NSEC_PER_MSEC,	/* FOTG210_HRTIMER_POLL_ASS */
++	1 * NSEC_PER_MSEC,	/* FOTG210_HRTIMER_POLL_PSS */
++	1 * NSEC_PER_MSEC,	/* FOTG210_HRTIMER_POLL_DEAD */
++	1125 * NSEC_PER_USEC,	/* FOTG210_HRTIMER_UNLINK_INTR */
++	2 * NSEC_PER_MSEC,	/* FOTG210_HRTIMER_FREE_ITDS */
++	6 * NSEC_PER_MSEC,	/* FOTG210_HRTIMER_ASYNC_UNLINKS */
++	10 * NSEC_PER_MSEC,	/* FOTG210_HRTIMER_IAA_WATCHDOG */
++	10 * NSEC_PER_MSEC,	/* FOTG210_HRTIMER_DISABLE_PERIODIC */
++	15 * NSEC_PER_MSEC,	/* FOTG210_HRTIMER_DISABLE_ASYNC */
++	100 * NSEC_PER_MSEC,	/* FOTG210_HRTIMER_IO_WATCHDOG */
++};
++
++/* Enable a pending hrtimer event */
++static void fotg210_enable_event(struct fotg210_hcd *fotg210, unsigned event,
++		bool resched)
++{
++	ktime_t *timeout = &fotg210->hr_timeouts[event];
++
++	if (resched)
++		*timeout = ktime_add(ktime_get(), event_delays_ns[event]);
++	fotg210->enabled_hrtimer_events |= (1 << event);
++
++	/* Track only the lowest-numbered pending event */
++	if (event < fotg210->next_hrtimer_event) {
++		fotg210->next_hrtimer_event = event;
++		hrtimer_start_range_ns(&fotg210->hrtimer, *timeout,
++				NSEC_PER_MSEC, HRTIMER_MODE_ABS);
++	}
++}
++
++
++/* Poll the STS_ASS status bit; see when it agrees with CMD_ASE */
++static void fotg210_poll_ASS(struct fotg210_hcd *fotg210)
++{
++	unsigned actual, want;
++
++	/* Don't enable anything if the controller isn't running (e.g., died) */
++	if (fotg210->rh_state != FOTG210_RH_RUNNING)
++		return;
++
++	want = (fotg210->command & CMD_ASE) ? STS_ASS : 0;
++	actual = fotg210_readl(fotg210, &fotg210->regs->status) & STS_ASS;
++
++	if (want != actual) {
++
++		/* Poll again later, but give up after about 20 ms */
++		if (fotg210->ASS_poll_count++ < 20) {
++			fotg210_enable_event(fotg210, FOTG210_HRTIMER_POLL_ASS,
++					true);
++			return;
++		}
++		fotg210_dbg(fotg210, "Waited too long for the async schedule status (%x/%x), giving up\n",
++				want, actual);
++	}
++	fotg210->ASS_poll_count = 0;
++
++	/* The status is up-to-date; restart or stop the schedule as needed */
++	if (want == 0) {	/* Stopped */
++		if (fotg210->async_count > 0)
++			fotg210_set_command_bit(fotg210, CMD_ASE);
++
++	} else {		/* Running */
++		if (fotg210->async_count == 0) {
++
++			/* Turn off the schedule after a while */
++			fotg210_enable_event(fotg210,
++					FOTG210_HRTIMER_DISABLE_ASYNC,
++					true);
++		}
++	}
++}
++
++/* Turn off the async schedule after a brief delay */
++static void fotg210_disable_ASE(struct fotg210_hcd *fotg210)
++{
++	fotg210_clear_command_bit(fotg210, CMD_ASE);
++}
++
++
++/* Poll the STS_PSS status bit; see when it agrees with CMD_PSE */
++static void fotg210_poll_PSS(struct fotg210_hcd *fotg210)
++{
++	unsigned actual, want;
++
++	/* Don't do anything if the controller isn't running (e.g., died) */
++	if (fotg210->rh_state != FOTG210_RH_RUNNING)
++		return;
++
++	want = (fotg210->command & CMD_PSE) ? STS_PSS : 0;
++	actual = fotg210_readl(fotg210, &fotg210->regs->status) & STS_PSS;
++
++	if (want != actual) {
++
++		/* Poll again later, but give up after about 20 ms */
++		if (fotg210->PSS_poll_count++ < 20) {
++			fotg210_enable_event(fotg210, FOTG210_HRTIMER_POLL_PSS,
++					true);
++			return;
++		}
++		fotg210_dbg(fotg210, "Waited too long for the periodic schedule status (%x/%x), giving up\n",
++				want, actual);
++	}
++	fotg210->PSS_poll_count = 0;
++
++	/* The status is up-to-date; restart or stop the schedule as needed */
++	if (want == 0) {	/* Stopped */
++		if (fotg210->periodic_count > 0)
++			fotg210_set_command_bit(fotg210, CMD_PSE);
++
++	} else {		/* Running */
++		if (fotg210->periodic_count == 0) {
++
++			/* Turn off the schedule after a while */
++			fotg210_enable_event(fotg210,
++					FOTG210_HRTIMER_DISABLE_PERIODIC,
++					true);
++		}
++	}
++}
++
++/* Turn off the periodic schedule after a brief delay */
++static void fotg210_disable_PSE(struct fotg210_hcd *fotg210)
++{
++	fotg210_clear_command_bit(fotg210, CMD_PSE);
++}
++
++
++/* Poll the STS_HALT status bit; see when a dead controller stops */
++static void fotg210_handle_controller_death(struct fotg210_hcd *fotg210)
++{
++	if (!(fotg210_readl(fotg210, &fotg210->regs->status) & STS_HALT)) {
++
++		/* Give up after a few milliseconds */
++		if (fotg210->died_poll_count++ < 5) {
++			/* Try again later */
++			fotg210_enable_event(fotg210,
++					FOTG210_HRTIMER_POLL_DEAD, true);
++			return;
++		}
++		fotg210_warn(fotg210, "Waited too long for the controller to stop, giving up\n");
++	}
++
++	/* Clean up the mess */
++	fotg210->rh_state = FOTG210_RH_HALTED;
++	fotg210_writel(fotg210, 0, &fotg210->regs->intr_enable);
++	fotg210_work(fotg210);
++	end_unlink_async(fotg210);
++
++	/* Not in process context, so don't try to reset the controller */
++}
++
++
++/* Handle unlinked interrupt QHs once they are gone from the hardware */
++static void fotg210_handle_intr_unlinks(struct fotg210_hcd *fotg210)
++{
++	bool stopped = (fotg210->rh_state < FOTG210_RH_RUNNING);
++
++	/*
++	 * Process all the QHs on the intr_unlink list that were added
++	 * before the current unlink cycle began.  The list is in
++	 * temporal order, so stop when we reach the first entry in the
++	 * current cycle.  But if the root hub isn't running then
++	 * process all the QHs on the list.
++	 */
++	fotg210->intr_unlinking = true;
++	while (fotg210->intr_unlink) {
++		struct fotg210_qh *qh = fotg210->intr_unlink;
++
++		if (!stopped && qh->unlink_cycle == fotg210->intr_unlink_cycle)
++			break;
++		fotg210->intr_unlink = qh->unlink_next;
++		qh->unlink_next = NULL;
++		end_unlink_intr(fotg210, qh);
++	}
++
++	/* Handle remaining entries later */
++	if (fotg210->intr_unlink) {
++		fotg210_enable_event(fotg210, FOTG210_HRTIMER_UNLINK_INTR,
++				true);
++		++fotg210->intr_unlink_cycle;
++	}
++	fotg210->intr_unlinking = false;
++}
++
++
++/* Start another free-iTDs/siTDs cycle */
++static void start_free_itds(struct fotg210_hcd *fotg210)
++{
++	if (!(fotg210->enabled_hrtimer_events &
++			BIT(FOTG210_HRTIMER_FREE_ITDS))) {
++		fotg210->last_itd_to_free = list_entry(
++				fotg210->cached_itd_list.prev,
++				struct fotg210_itd, itd_list);
++		fotg210_enable_event(fotg210, FOTG210_HRTIMER_FREE_ITDS, true);
++	}
++}
++
++/* Wait for controller to stop using old iTDs and siTDs */
++static void end_free_itds(struct fotg210_hcd *fotg210)
++{
++	struct fotg210_itd *itd, *n;
++
++	if (fotg210->rh_state < FOTG210_RH_RUNNING)
++		fotg210->last_itd_to_free = NULL;
++
++	list_for_each_entry_safe(itd, n, &fotg210->cached_itd_list, itd_list) {
++		list_del(&itd->itd_list);
++		dma_pool_free(fotg210->itd_pool, itd, itd->itd_dma);
++		if (itd == fotg210->last_itd_to_free)
++			break;
++	}
++
++	if (!list_empty(&fotg210->cached_itd_list))
++		start_free_itds(fotg210);
++}
++
++
++/* Handle lost (or very late) IAA interrupts */
++static void fotg210_iaa_watchdog(struct fotg210_hcd *fotg210)
++{
++	if (fotg210->rh_state != FOTG210_RH_RUNNING)
++		return;
++
++	/*
++	 * Lost IAA irqs wedge things badly; seen first with a vt8235.
++	 * So we need this watchdog, but must protect it against both
++	 * (a) SMP races against real IAA firing and retriggering, and
++	 * (b) clean HC shutdown, when IAA watchdog was pending.
++	 */
++	if (fotg210->async_iaa) {
++		u32 cmd, status;
++
++		/* If we get here, IAA is *REALLY* late.  It's barely
++		 * conceivable that the system is so busy that CMD_IAAD
++		 * is still legitimately set, so let's be sure it's
++		 * clear before we read STS_IAA.  (The HC should clear
++		 * CMD_IAAD when it sets STS_IAA.)
++		 */
++		cmd = fotg210_readl(fotg210, &fotg210->regs->command);
++
++		/*
++		 * If IAA is set here it either legitimately triggered
++		 * after the watchdog timer expired (_way_ late, so we'll
++		 * still count it as lost) ... or a silicon erratum:
++		 * - VIA seems to set IAA without triggering the IRQ;
++		 * - IAAD potentially cleared without setting IAA.
++		 */
++		status = fotg210_readl(fotg210, &fotg210->regs->status);
++		if ((status & STS_IAA) || !(cmd & CMD_IAAD)) {
++			INCR(fotg210->stats.lost_iaa);
++			fotg210_writel(fotg210, STS_IAA,
++					&fotg210->regs->status);
++		}
++
++		fotg210_dbg(fotg210, "IAA watchdog: status %x cmd %x\n",
++				status, cmd);
++		end_unlink_async(fotg210);
++	}
++}
++
++
++/* Enable the I/O watchdog, if appropriate */
++static void turn_on_io_watchdog(struct fotg210_hcd *fotg210)
++{
++	/* Not needed if the controller isn't running or it's already enabled */
++	if (fotg210->rh_state != FOTG210_RH_RUNNING ||
++			(fotg210->enabled_hrtimer_events &
++			BIT(FOTG210_HRTIMER_IO_WATCHDOG)))
++		return;
++
++	/*
++	 * Isochronous transfers always need the watchdog.
++	 * For other sorts we use it only if the flag is set.
++	 */
++	if (fotg210->isoc_count > 0 || (fotg210->need_io_watchdog &&
++			fotg210->async_count + fotg210->intr_count > 0))
++		fotg210_enable_event(fotg210, FOTG210_HRTIMER_IO_WATCHDOG,
++				true);
++}
++
++
++/* Handler functions for the hrtimer event types.
++ * Keep this array in the same order as the event types indexed by
++ * enum fotg210_hrtimer_event in fotg210.h.
++ */
++static void (*event_handlers[])(struct fotg210_hcd *) = {
++	fotg210_poll_ASS,			/* FOTG210_HRTIMER_POLL_ASS */
++	fotg210_poll_PSS,			/* FOTG210_HRTIMER_POLL_PSS */
++	fotg210_handle_controller_death,	/* FOTG210_HRTIMER_POLL_DEAD */
++	fotg210_handle_intr_unlinks,	/* FOTG210_HRTIMER_UNLINK_INTR */
++	end_free_itds,			/* FOTG210_HRTIMER_FREE_ITDS */
++	unlink_empty_async,		/* FOTG210_HRTIMER_ASYNC_UNLINKS */
++	fotg210_iaa_watchdog,		/* FOTG210_HRTIMER_IAA_WATCHDOG */
++	fotg210_disable_PSE,		/* FOTG210_HRTIMER_DISABLE_PERIODIC */
++	fotg210_disable_ASE,		/* FOTG210_HRTIMER_DISABLE_ASYNC */
++	fotg210_work,			/* FOTG210_HRTIMER_IO_WATCHDOG */
++};
++
++static enum hrtimer_restart fotg210_hrtimer_func(struct hrtimer *t)
++{
++	struct fotg210_hcd *fotg210 =
++			container_of(t, struct fotg210_hcd, hrtimer);
++	ktime_t now;
++	unsigned long events;
++	unsigned long flags;
++	unsigned e;
++
++	spin_lock_irqsave(&fotg210->lock, flags);
++
++	events = fotg210->enabled_hrtimer_events;
++	fotg210->enabled_hrtimer_events = 0;
++	fotg210->next_hrtimer_event = FOTG210_HRTIMER_NO_EVENT;
++
++	/*
++	 * Check each pending event.  If its time has expired, handle
++	 * the event; otherwise re-enable it.
++	 */
++	now = ktime_get();
++	for_each_set_bit(e, &events, FOTG210_HRTIMER_NUM_EVENTS) {
++		if (ktime_compare(now, fotg210->hr_timeouts[e]) >= 0)
++			event_handlers[e](fotg210);
++		else
++			fotg210_enable_event(fotg210, e, false);
++	}
++
++	spin_unlock_irqrestore(&fotg210->lock, flags);
++	return HRTIMER_NORESTART;
++}
++
++#define fotg210_bus_suspend NULL
++#define fotg210_bus_resume NULL
++
++static int check_reset_complete(struct fotg210_hcd *fotg210, int index,
++		u32 __iomem *status_reg, int port_status)
++{
++	if (!(port_status & PORT_CONNECT))
++		return port_status;
++
++	/* if reset finished and it's still not enabled -- handoff */
++	if (!(port_status & PORT_PE))
++		/* with integrated TT, there's nobody to hand it to! */
++		fotg210_dbg(fotg210, "Failed to enable port %d on root hub TT\n",
++				index + 1);
++	else
++		fotg210_dbg(fotg210, "port %d reset complete, port enabled\n",
++				index + 1);
++
++	return port_status;
++}
++
++
++/* build "status change" packet (one or two bytes) from HC registers */
++
++static int fotg210_hub_status_data(struct usb_hcd *hcd, char *buf)
++{
++	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
++	u32 temp, status;
++	u32 mask;
++	int retval = 1;
++	unsigned long flags;
++
++	/* init status to no-changes */
++	buf[0] = 0;
++
++	/* Inform the core about resumes-in-progress by returning
++	 * a non-zero value even if there are no status changes.
++	 */
++	status = fotg210->resuming_ports;
++
++	mask = PORT_CSC | PORT_PEC;
++	/* PORT_RESUME from hardware ~= PORT_STAT_C_SUSPEND */
++
++	/* no hub change reports (bit 0) for now (power, ...) */
++
++	/* port N changes (bit N)? */
++	spin_lock_irqsave(&fotg210->lock, flags);
++
++	temp = fotg210_readl(fotg210, &fotg210->regs->port_status);
++
++	/*
++	 * Return status information even for ports with OWNER set.
++	 * Otherwise hub_wq wouldn't see the disconnect event when a
++	 * high-speed device is switched over to the companion
++	 * controller by the user.
++	 */
++
++	if ((temp & mask) != 0 || test_bit(0, &fotg210->port_c_suspend) ||
++			(fotg210->reset_done[0] &&
++			time_after_eq(jiffies, fotg210->reset_done[0]))) {
++		buf[0] |= 1 << 1;
++		status = STS_PCD;
++	}
++	/* FIXME autosuspend idle root hubs */
++	spin_unlock_irqrestore(&fotg210->lock, flags);
++	return status ? retval : 0;
++}
++
++static void fotg210_hub_descriptor(struct fotg210_hcd *fotg210,
++		struct usb_hub_descriptor *desc)
++{
++	int ports = HCS_N_PORTS(fotg210->hcs_params);
++	u16 temp;
++
++	desc->bDescriptorType = USB_DT_HUB;
++	desc->bPwrOn2PwrGood = 10;	/* fotg210 1.0, 2.3.9 says 20ms max */
++	desc->bHubContrCurrent = 0;
++
++	desc->bNbrPorts = ports;
++	temp = 1 + (ports / 8);
++	desc->bDescLength = 7 + 2 * temp;
++
++	/* two bitmaps:  ports removable, and usb 1.0 legacy PortPwrCtrlMask */
++	memset(&desc->u.hs.DeviceRemovable[0], 0, temp);
++	memset(&desc->u.hs.DeviceRemovable[temp], 0xff, temp);
++
++	temp = HUB_CHAR_INDV_PORT_OCPM;	/* per-port overcurrent reporting */
++	temp |= HUB_CHAR_NO_LPSM;	/* no power switching */
++	desc->wHubCharacteristics = cpu_to_le16(temp);
++}
++
++static int fotg210_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
++		u16 wIndex, char *buf, u16 wLength)
++{
++	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
++	int ports = HCS_N_PORTS(fotg210->hcs_params);
++	u32 __iomem *status_reg = &fotg210->regs->port_status;
++	u32 temp, temp1, status;
++	unsigned long flags;
++	int retval = 0;
++	unsigned selector;
++
++	/*
++	 * FIXME:  support SetPortFeatures USB_PORT_FEAT_INDICATOR.
++	 * HCS_INDICATOR may say we can change LEDs to off/amber/green.
++	 * (track current state ourselves) ... blink for diagnostics,
++	 * power, "this is the one", etc.  EHCI spec supports this.
++	 */
++
++	spin_lock_irqsave(&fotg210->lock, flags);
++	switch (typeReq) {
++	case ClearHubFeature:
++		switch (wValue) {
++		case C_HUB_LOCAL_POWER:
++		case C_HUB_OVER_CURRENT:
++			/* no hub-wide feature/status flags */
++			break;
++		default:
++			goto error;
++		}
++		break;
++	case ClearPortFeature:
++		if (!wIndex || wIndex > ports)
++			goto error;
++		wIndex--;
++		temp = fotg210_readl(fotg210, status_reg);
++		temp &= ~PORT_RWC_BITS;
++
++		/*
++		 * Even if OWNER is set, so the port is owned by the
++		 * companion controller, hub_wq needs to be able to clear
++		 * the port-change status bits (especially
++		 * USB_PORT_STAT_C_CONNECTION).
++		 */
++
++		switch (wValue) {
++		case USB_PORT_FEAT_ENABLE:
++			fotg210_writel(fotg210, temp & ~PORT_PE, status_reg);
++			break;
++		case USB_PORT_FEAT_C_ENABLE:
++			fotg210_writel(fotg210, temp | PORT_PEC, status_reg);
++			break;
++		case USB_PORT_FEAT_SUSPEND:
++			if (temp & PORT_RESET)
++				goto error;
++			if (!(temp & PORT_SUSPEND))
++				break;
++			if ((temp & PORT_PE) == 0)
++				goto error;
++
++			/* resume signaling for 20 msec */
++			fotg210_writel(fotg210, temp | PORT_RESUME, status_reg);
++			fotg210->reset_done[wIndex] = jiffies
++					+ msecs_to_jiffies(USB_RESUME_TIMEOUT);
++			break;
++		case USB_PORT_FEAT_C_SUSPEND:
++			clear_bit(wIndex, &fotg210->port_c_suspend);
++			break;
++		case USB_PORT_FEAT_C_CONNECTION:
++			fotg210_writel(fotg210, temp | PORT_CSC, status_reg);
++			break;
++		case USB_PORT_FEAT_C_OVER_CURRENT:
++			fotg210_writel(fotg210, temp | OTGISR_OVC,
++					&fotg210->regs->otgisr);
++			break;
++		case USB_PORT_FEAT_C_RESET:
++			/* GetPortStatus clears reset */
++			break;
++		default:
++			goto error;
++		}
++		fotg210_readl(fotg210, &fotg210->regs->command);
++		break;
++	case GetHubDescriptor:
++		fotg210_hub_descriptor(fotg210, (struct usb_hub_descriptor *)
++				buf);
++		break;
++	case GetHubStatus:
++		/* no hub-wide feature/status flags */
++		memset(buf, 0, 4);
++		/*cpu_to_le32s ((u32 *) buf); */
++		break;
++	case GetPortStatus:
++		if (!wIndex || wIndex > ports)
++			goto error;
++		wIndex--;
++		status = 0;
++		temp = fotg210_readl(fotg210, status_reg);
++
++		/* wPortChange bits */
++		if (temp & PORT_CSC)
++			status |= USB_PORT_STAT_C_CONNECTION << 16;
++		if (temp & PORT_PEC)
++			status |= USB_PORT_STAT_C_ENABLE << 16;
++
++		temp1 = fotg210_readl(fotg210, &fotg210->regs->otgisr);
++		if (temp1 & OTGISR_OVC)
++			status |= USB_PORT_STAT_C_OVERCURRENT << 16;
++
++		/* whoever resumes must GetPortStatus to complete it!! */
++		if (temp & PORT_RESUME) {
++
++			/* Remote Wakeup received? */
++			if (!fotg210->reset_done[wIndex]) {
++				/* resume signaling for 20 msec */
++				fotg210->reset_done[wIndex] = jiffies
++						+ msecs_to_jiffies(20);
++				/* check the port again */
++				mod_timer(&fotg210_to_hcd(fotg210)->rh_timer,
++						fotg210->reset_done[wIndex]);
++			}
++
++			/* resume completed? */
++			else if (time_after_eq(jiffies,
++					fotg210->reset_done[wIndex])) {
++				clear_bit(wIndex, &fotg210->suspended_ports);
++				set_bit(wIndex, &fotg210->port_c_suspend);
++				fotg210->reset_done[wIndex] = 0;
++
++				/* stop resume signaling */
++				temp = fotg210_readl(fotg210, status_reg);
++				fotg210_writel(fotg210, temp &
++						~(PORT_RWC_BITS | PORT_RESUME),
++						status_reg);
++				clear_bit(wIndex, &fotg210->resuming_ports);
++				retval = handshake(fotg210, status_reg,
++						PORT_RESUME, 0, 2000);/* 2ms */
++				if (retval != 0) {
++					fotg210_err(fotg210,
++							"port %d resume error %d\n",
++							wIndex + 1, retval);
++					goto error;
++				}
++				temp &= ~(PORT_SUSPEND|PORT_RESUME|(3<<10));
++			}
++		}
++
++		/* whoever resets must GetPortStatus to complete it!! */
++		if ((temp & PORT_RESET) && time_after_eq(jiffies,
++				fotg210->reset_done[wIndex])) {
++			status |= USB_PORT_STAT_C_RESET << 16;
++			fotg210->reset_done[wIndex] = 0;
++			clear_bit(wIndex, &fotg210->resuming_ports);
++
++			/* force reset to complete */
++			fotg210_writel(fotg210,
++					temp & ~(PORT_RWC_BITS | PORT_RESET),
++					status_reg);
++			/* REVISIT:  some hardware needs 550+ usec to clear
++			 * this bit; seems too long to spin routinely...
++			 */
++			retval = handshake(fotg210, status_reg,
++					PORT_RESET, 0, 1000);
++			if (retval != 0) {
++				fotg210_err(fotg210, "port %d reset error %d\n",
++						wIndex + 1, retval);
++				goto error;
++			}
++
++			/* see what we found out */
++			temp = check_reset_complete(fotg210, wIndex, status_reg,
++					fotg210_readl(fotg210, status_reg));
++
++			/* restart schedule */
++			fotg210->command |= CMD_RUN;
++			fotg210_writel(fotg210, fotg210->command, &fotg210->regs->command);
++		}
++
++		if (!(temp & (PORT_RESUME|PORT_RESET))) {
++			fotg210->reset_done[wIndex] = 0;
++			clear_bit(wIndex, &fotg210->resuming_ports);
++		}
++
++		/* transfer dedicated ports to the companion hc */
++		if ((temp & PORT_CONNECT) &&
++				test_bit(wIndex, &fotg210->companion_ports)) {
++			temp &= ~PORT_RWC_BITS;
++			fotg210_writel(fotg210, temp, status_reg);
++			fotg210_dbg(fotg210, "port %d --> companion\n",
++					wIndex + 1);
++			temp = fotg210_readl(fotg210, status_reg);
++		}
++
++		/*
++		 * Even if OWNER is set, there's no harm letting hub_wq
++		 * see the wPortStatus values (they should all be 0 except
++		 * for PORT_POWER anyway).
++		 */
++
++		if (temp & PORT_CONNECT) {
++			status |= USB_PORT_STAT_CONNECTION;
++			status |= fotg210_port_speed(fotg210, temp);
++		}
++		if (temp & PORT_PE)
++			status |= USB_PORT_STAT_ENABLE;
++
++		/* maybe the port was unsuspended without our knowledge */
++		if (temp & (PORT_SUSPEND|PORT_RESUME)) {
++			status |= USB_PORT_STAT_SUSPEND;
++		} else if (test_bit(wIndex, &fotg210->suspended_ports)) {
++			clear_bit(wIndex, &fotg210->suspended_ports);
++			clear_bit(wIndex, &fotg210->resuming_ports);
++			fotg210->reset_done[wIndex] = 0;
++			if (temp & PORT_PE)
++				set_bit(wIndex, &fotg210->port_c_suspend);
++		}
++
++		temp1 = fotg210_readl(fotg210, &fotg210->regs->otgisr);
++		if (temp1 & OTGISR_OVC)
++			status |= USB_PORT_STAT_OVERCURRENT;
++		if (temp & PORT_RESET)
++			status |= USB_PORT_STAT_RESET;
++		if (test_bit(wIndex, &fotg210->port_c_suspend))
++			status |= USB_PORT_STAT_C_SUSPEND << 16;
++
++		if (status & ~0xffff)	/* only if wPortChange is interesting */
++			dbg_port(fotg210, "GetStatus", wIndex + 1, temp);
++		put_unaligned_le32(status, buf);
++		break;
++	case SetHubFeature:
++		switch (wValue) {
++		case C_HUB_LOCAL_POWER:
++		case C_HUB_OVER_CURRENT:
++			/* no hub-wide feature/status flags */
++			break;
++		default:
++			goto error;
++		}
++		break;
++	case SetPortFeature:
++		selector = wIndex >> 8;
++		wIndex &= 0xff;
++
++		if (!wIndex || wIndex > ports)
++			goto error;
++		wIndex--;
++		temp = fotg210_readl(fotg210, status_reg);
++		temp &= ~PORT_RWC_BITS;
++		switch (wValue) {
++		case USB_PORT_FEAT_SUSPEND:
++			if ((temp & PORT_PE) == 0
++					|| (temp & PORT_RESET) != 0)
++				goto error;
++
++			/* After above check the port must be connected.
++			 * Set appropriate bit thus could put phy into low power
++			 * mode if we have hostpc feature
++			 */
++			fotg210_writel(fotg210, temp | PORT_SUSPEND,
++					status_reg);
++			set_bit(wIndex, &fotg210->suspended_ports);
++			break;
++		case USB_PORT_FEAT_RESET:
++			if (temp & PORT_RESUME)
++				goto error;
++			/* line status bits may report this as low speed,
++			 * which can be fine if this root hub has a
++			 * transaction translator built in.
++			 */
++			fotg210_dbg(fotg210, "port %d reset\n", wIndex + 1);
++			temp |= PORT_RESET;
++			temp &= ~PORT_PE;
++
++			/*
++			 * caller must wait, then call GetPortStatus
++			 * usb 2.0 spec says 50 ms resets on root
++			 */
++			fotg210->reset_done[wIndex] = jiffies
++					+ msecs_to_jiffies(50);
++			fotg210_writel(fotg210, temp, status_reg);
++			break;
++
++		/* For downstream facing ports (these):  one hub port is put
++		 * into test mode according to USB2 11.24.2.13, then the hub
++		 * must be reset (which for root hub now means rmmod+modprobe,
++		 * or else system reboot).  See EHCI 2.3.9 and 4.14 for info
++		 * about the EHCI-specific stuff.
++		 */
++		case USB_PORT_FEAT_TEST:
++			if (!selector || selector > 5)
++				goto error;
++			spin_unlock_irqrestore(&fotg210->lock, flags);
++			fotg210_quiesce(fotg210);
++			spin_lock_irqsave(&fotg210->lock, flags);
++
++			/* Put all enabled ports into suspend */
++			temp = fotg210_readl(fotg210, status_reg) &
++				~PORT_RWC_BITS;
++			if (temp & PORT_PE)
++				fotg210_writel(fotg210, temp | PORT_SUSPEND,
++						status_reg);
++
++			spin_unlock_irqrestore(&fotg210->lock, flags);
++			fotg210_halt(fotg210);
++			spin_lock_irqsave(&fotg210->lock, flags);
++
++			temp = fotg210_readl(fotg210, status_reg);
++			temp |= selector << 16;
++			fotg210_writel(fotg210, temp, status_reg);
++			break;
++
++		default:
++			goto error;
++		}
++		fotg210_readl(fotg210, &fotg210->regs->command);
++		break;
++
++	default:
++error:
++		/* "stall" on error */
++		retval = -EPIPE;
++	}
++	spin_unlock_irqrestore(&fotg210->lock, flags);
++	return retval;
++}
++
++static void __maybe_unused fotg210_relinquish_port(struct usb_hcd *hcd,
++		int portnum)
++{
++	return;
++}
++
++static int __maybe_unused fotg210_port_handed_over(struct usb_hcd *hcd,
++		int portnum)
++{
++	return 0;
++}
++
++/* There's basically three types of memory:
++ *	- data used only by the HCD ... kmalloc is fine
++ *	- async and periodic schedules, shared by HC and HCD ... these
++ *	  need to use dma_pool or dma_alloc_coherent
++ *	- driver buffers, read/written by HC ... single shot DMA mapped
++ *
++ * There's also "register" data (e.g. PCI or SOC), which is memory mapped.
++ * No memory seen by this driver is pageable.
++ */
++
++/* Allocate the key transfer structures from the previously allocated pool */
++static inline void fotg210_qtd_init(struct fotg210_hcd *fotg210,
++		struct fotg210_qtd *qtd, dma_addr_t dma)
++{
++	memset(qtd, 0, sizeof(*qtd));
++	qtd->qtd_dma = dma;
++	qtd->hw_token = cpu_to_hc32(fotg210, QTD_STS_HALT);
++	qtd->hw_next = FOTG210_LIST_END(fotg210);
++	qtd->hw_alt_next = FOTG210_LIST_END(fotg210);
++	INIT_LIST_HEAD(&qtd->qtd_list);
++}
++
++static struct fotg210_qtd *fotg210_qtd_alloc(struct fotg210_hcd *fotg210,
++		gfp_t flags)
++{
++	struct fotg210_qtd *qtd;
++	dma_addr_t dma;
++
++	qtd = dma_pool_alloc(fotg210->qtd_pool, flags, &dma);
++	if (qtd != NULL)
++		fotg210_qtd_init(fotg210, qtd, dma);
++
++	return qtd;
++}
++
++static inline void fotg210_qtd_free(struct fotg210_hcd *fotg210,
++		struct fotg210_qtd *qtd)
++{
++	dma_pool_free(fotg210->qtd_pool, qtd, qtd->qtd_dma);
++}
++
++
++static void qh_destroy(struct fotg210_hcd *fotg210, struct fotg210_qh *qh)
++{
++	/* clean qtds first, and know this is not linked */
++	if (!list_empty(&qh->qtd_list) || qh->qh_next.ptr) {
++		fotg210_dbg(fotg210, "unused qh not empty!\n");
++		BUG();
++	}
++	if (qh->dummy)
++		fotg210_qtd_free(fotg210, qh->dummy);
++	dma_pool_free(fotg210->qh_pool, qh->hw, qh->qh_dma);
++	kfree(qh);
++}
++
++static struct fotg210_qh *fotg210_qh_alloc(struct fotg210_hcd *fotg210,
++		gfp_t flags)
++{
++	struct fotg210_qh *qh;
++	dma_addr_t dma;
++
++	qh = kzalloc(sizeof(*qh), GFP_ATOMIC);
++	if (!qh)
++		goto done;
++	qh->hw = (struct fotg210_qh_hw *)
++		dma_pool_zalloc(fotg210->qh_pool, flags, &dma);
++	if (!qh->hw)
++		goto fail;
++	qh->qh_dma = dma;
++	INIT_LIST_HEAD(&qh->qtd_list);
++
++	/* dummy td enables safe urb queuing */
++	qh->dummy = fotg210_qtd_alloc(fotg210, flags);
++	if (qh->dummy == NULL) {
++		fotg210_dbg(fotg210, "no dummy td\n");
++		goto fail1;
++	}
++done:
++	return qh;
++fail1:
++	dma_pool_free(fotg210->qh_pool, qh->hw, qh->qh_dma);
++fail:
++	kfree(qh);
++	return NULL;
++}
++
++/* The queue heads and transfer descriptors are managed from pools tied
++ * to each of the "per device" structures.
++ * This is the initialisation and cleanup code.
++ */
++
++static void fotg210_mem_cleanup(struct fotg210_hcd *fotg210)
++{
++	if (fotg210->async)
++		qh_destroy(fotg210, fotg210->async);
++	fotg210->async = NULL;
++
++	if (fotg210->dummy)
++		qh_destroy(fotg210, fotg210->dummy);
++	fotg210->dummy = NULL;
++
++	/* DMA consistent memory and pools */
++	dma_pool_destroy(fotg210->qtd_pool);
++	fotg210->qtd_pool = NULL;
++
++	dma_pool_destroy(fotg210->qh_pool);
++	fotg210->qh_pool = NULL;
++
++	dma_pool_destroy(fotg210->itd_pool);
++	fotg210->itd_pool = NULL;
++
++	if (fotg210->periodic)
++		dma_free_coherent(fotg210_to_hcd(fotg210)->self.controller,
++				fotg210->periodic_size * sizeof(u32),
++				fotg210->periodic, fotg210->periodic_dma);
++	fotg210->periodic = NULL;
++
++	/* shadow periodic table */
++	kfree(fotg210->pshadow);
++	fotg210->pshadow = NULL;
++}
++
++/* remember to add cleanup code (above) if you add anything here */
++static int fotg210_mem_init(struct fotg210_hcd *fotg210, gfp_t flags)
++{
++	int i;
++
++	/* QTDs for control/bulk/intr transfers */
++	fotg210->qtd_pool = dma_pool_create("fotg210_qtd",
++			fotg210_to_hcd(fotg210)->self.controller,
++			sizeof(struct fotg210_qtd),
++			32 /* byte alignment (for hw parts) */,
++			4096 /* can't cross 4K */);
++	if (!fotg210->qtd_pool)
++		goto fail;
++
++	/* QHs for control/bulk/intr transfers */
++	fotg210->qh_pool = dma_pool_create("fotg210_qh",
++			fotg210_to_hcd(fotg210)->self.controller,
++			sizeof(struct fotg210_qh_hw),
++			32 /* byte alignment (for hw parts) */,
++			4096 /* can't cross 4K */);
++	if (!fotg210->qh_pool)
++		goto fail;
++
++	fotg210->async = fotg210_qh_alloc(fotg210, flags);
++	if (!fotg210->async)
++		goto fail;
++
++	/* ITD for high speed ISO transfers */
++	fotg210->itd_pool = dma_pool_create("fotg210_itd",
++			fotg210_to_hcd(fotg210)->self.controller,
++			sizeof(struct fotg210_itd),
++			64 /* byte alignment (for hw parts) */,
++			4096 /* can't cross 4K */);
++	if (!fotg210->itd_pool)
++		goto fail;
++
++	/* Hardware periodic table */
++	fotg210->periodic =
++		dma_alloc_coherent(fotg210_to_hcd(fotg210)->self.controller,
++				fotg210->periodic_size * sizeof(__le32),
++				&fotg210->periodic_dma, 0);
++	if (fotg210->periodic == NULL)
++		goto fail;
++
++	for (i = 0; i < fotg210->periodic_size; i++)
++		fotg210->periodic[i] = FOTG210_LIST_END(fotg210);
++
++	/* software shadow of hardware table */
++	fotg210->pshadow = kcalloc(fotg210->periodic_size, sizeof(void *),
++			flags);
++	if (fotg210->pshadow != NULL)
++		return 0;
++
++fail:
++	fotg210_dbg(fotg210, "couldn't init memory\n");
++	fotg210_mem_cleanup(fotg210);
++	return -ENOMEM;
++}
++/* EHCI hardware queue manipulation ... the core.  QH/QTD manipulation.
++ *
++ * Control, bulk, and interrupt traffic all use "qh" lists.  They list "qtd"
++ * entries describing USB transactions, max 16-20kB/entry (with 4kB-aligned
++ * buffers needed for the larger number).  We use one QH per endpoint, queue
++ * multiple urbs (all three types) per endpoint.  URBs may need several qtds.
++ *
++ * ISO traffic uses "ISO TD" (itd) records, and (along with
++ * interrupts) needs careful scheduling.  Performance improvements can be
++ * an ongoing challenge.  That's in "ehci-sched.c".
++ *
++ * USB 1.1 devices are handled (a) by "companion" OHCI or UHCI root hubs,
++ * or otherwise through transaction translators (TTs) in USB 2.0 hubs using
++ * (b) special fields in qh entries or (c) split iso entries.  TTs will
++ * buffer low/full speed data so the host collects it at high speed.
++ */
++
++/* fill a qtd, returning how much of the buffer we were able to queue up */
++static int qtd_fill(struct fotg210_hcd *fotg210, struct fotg210_qtd *qtd,
++		dma_addr_t buf, size_t len, int token, int maxpacket)
++{
++	int i, count;
++	u64 addr = buf;
++
++	/* one buffer entry per 4K ... first might be short or unaligned */
++	qtd->hw_buf[0] = cpu_to_hc32(fotg210, (u32)addr);
++	qtd->hw_buf_hi[0] = cpu_to_hc32(fotg210, (u32)(addr >> 32));
++	count = 0x1000 - (buf & 0x0fff);	/* rest of that page */
++	if (likely(len < count))		/* ... iff needed */
++		count = len;
++	else {
++		buf +=  0x1000;
++		buf &= ~0x0fff;
++
++		/* per-qtd limit: from 16K to 20K (best alignment) */
++		for (i = 1; count < len && i < 5; i++) {
++			addr = buf;
++			qtd->hw_buf[i] = cpu_to_hc32(fotg210, (u32)addr);
++			qtd->hw_buf_hi[i] = cpu_to_hc32(fotg210,
++					(u32)(addr >> 32));
++			buf += 0x1000;
++			if ((count + 0x1000) < len)
++				count += 0x1000;
++			else
++				count = len;
++		}
++
++		/* short packets may only terminate transfers */
++		if (count != len)
++			count -= (count % maxpacket);
++	}
++	qtd->hw_token = cpu_to_hc32(fotg210, (count << 16) | token);
++	qtd->length = count;
++
++	return count;
++}
++
++static inline void qh_update(struct fotg210_hcd *fotg210,
++		struct fotg210_qh *qh, struct fotg210_qtd *qtd)
++{
++	struct fotg210_qh_hw *hw = qh->hw;
++
++	/* writes to an active overlay are unsafe */
++	BUG_ON(qh->qh_state != QH_STATE_IDLE);
++
++	hw->hw_qtd_next = QTD_NEXT(fotg210, qtd->qtd_dma);
++	hw->hw_alt_next = FOTG210_LIST_END(fotg210);
++
++	/* Except for control endpoints, we make hardware maintain data
++	 * toggle (like OHCI) ... here (re)initialize the toggle in the QH,
++	 * and set the pseudo-toggle in udev. Only usb_clear_halt() will
++	 * ever clear it.
++	 */
++	if (!(hw->hw_info1 & cpu_to_hc32(fotg210, QH_TOGGLE_CTL))) {
++		unsigned is_out, epnum;
++
++		is_out = qh->is_out;
++		epnum = (hc32_to_cpup(fotg210, &hw->hw_info1) >> 8) & 0x0f;
++		if (unlikely(!usb_gettoggle(qh->dev, epnum, is_out))) {
++			hw->hw_token &= ~cpu_to_hc32(fotg210, QTD_TOGGLE);
++			usb_settoggle(qh->dev, epnum, is_out, 1);
++		}
++	}
++
++	hw->hw_token &= cpu_to_hc32(fotg210, QTD_TOGGLE | QTD_STS_PING);
++}
++
++/* if it weren't for a common silicon quirk (writing the dummy into the qh
++ * overlay, so qh->hw_token wrongly becomes inactive/halted), only fault
++ * recovery (including urb dequeue) would need software changes to a QH...
++ */
++static void qh_refresh(struct fotg210_hcd *fotg210, struct fotg210_qh *qh)
++{
++	struct fotg210_qtd *qtd;
++
++	if (list_empty(&qh->qtd_list))
++		qtd = qh->dummy;
++	else {
++		qtd = list_entry(qh->qtd_list.next,
++				struct fotg210_qtd, qtd_list);
++		/*
++		 * first qtd may already be partially processed.
++		 * If we come here during unlink, the QH overlay region
++		 * might have reference to the just unlinked qtd. The
++		 * qtd is updated in qh_completions(). Update the QH
++		 * overlay here.
++		 */
++		if (cpu_to_hc32(fotg210, qtd->qtd_dma) == qh->hw->hw_current) {
++			qh->hw->hw_qtd_next = qtd->hw_next;
++			qtd = NULL;
++		}
++	}
++
++	if (qtd)
++		qh_update(fotg210, qh, qtd);
++}
++
++static void qh_link_async(struct fotg210_hcd *fotg210, struct fotg210_qh *qh);
++
++static void fotg210_clear_tt_buffer_complete(struct usb_hcd *hcd,
++		struct usb_host_endpoint *ep)
++{
++	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
++	struct fotg210_qh *qh = ep->hcpriv;
++	unsigned long flags;
++
++	spin_lock_irqsave(&fotg210->lock, flags);
++	qh->clearing_tt = 0;
++	if (qh->qh_state == QH_STATE_IDLE && !list_empty(&qh->qtd_list)
++			&& fotg210->rh_state == FOTG210_RH_RUNNING)
++		qh_link_async(fotg210, qh);
++	spin_unlock_irqrestore(&fotg210->lock, flags);
++}
++
++static void fotg210_clear_tt_buffer(struct fotg210_hcd *fotg210,
++		struct fotg210_qh *qh, struct urb *urb, u32 token)
++{
++
++	/* If an async split transaction gets an error or is unlinked,
++	 * the TT buffer may be left in an indeterminate state.  We
++	 * have to clear the TT buffer.
++	 *
++	 * Note: this routine is never called for Isochronous transfers.
++	 */
++	if (urb->dev->tt && !usb_pipeint(urb->pipe) && !qh->clearing_tt) {
++		struct usb_device *tt = urb->dev->tt->hub;
++
++		dev_dbg(&tt->dev,
++				"clear tt buffer port %d, a%d ep%d t%08x\n",
++				urb->dev->ttport, urb->dev->devnum,
++				usb_pipeendpoint(urb->pipe), token);
++
++		if (urb->dev->tt->hub !=
++				fotg210_to_hcd(fotg210)->self.root_hub) {
++			if (usb_hub_clear_tt_buffer(urb) == 0)
++				qh->clearing_tt = 1;
++		}
++	}
++}
++
++static int qtd_copy_status(struct fotg210_hcd *fotg210, struct urb *urb,
++		size_t length, u32 token)
++{
++	int status = -EINPROGRESS;
++
++	/* count IN/OUT bytes, not SETUP (even short packets) */
++	if (likely(QTD_PID(token) != 2))
++		urb->actual_length += length - QTD_LENGTH(token);
++
++	/* don't modify error codes */
++	if (unlikely(urb->unlinked))
++		return status;
++
++	/* force cleanup after short read; not always an error */
++	if (unlikely(IS_SHORT_READ(token)))
++		status = -EREMOTEIO;
++
++	/* serious "can't proceed" faults reported by the hardware */
++	if (token & QTD_STS_HALT) {
++		if (token & QTD_STS_BABBLE) {
++			/* FIXME "must" disable babbling device's port too */
++			status = -EOVERFLOW;
++		/* CERR nonzero + halt --> stall */
++		} else if (QTD_CERR(token)) {
++			status = -EPIPE;
++
++		/* In theory, more than one of the following bits can be set
++		 * since they are sticky and the transaction is retried.
++		 * Which to test first is rather arbitrary.
++		 */
++		} else if (token & QTD_STS_MMF) {
++			/* fs/ls interrupt xfer missed the complete-split */
++			status = -EPROTO;
++		} else if (token & QTD_STS_DBE) {
++			status = (QTD_PID(token) == 1) /* IN ? */
++				? -ENOSR  /* hc couldn't read data */
++				: -ECOMM; /* hc couldn't write data */
++		} else if (token & QTD_STS_XACT) {
++			/* timeout, bad CRC, wrong PID, etc */
++			fotg210_dbg(fotg210, "devpath %s ep%d%s 3strikes\n",
++					urb->dev->devpath,
++					usb_pipeendpoint(urb->pipe),
++					usb_pipein(urb->pipe) ? "in" : "out");
++			status = -EPROTO;
++		} else {	/* unknown */
++			status = -EPROTO;
++		}
++
++		fotg210_dbg(fotg210,
++				"dev%d ep%d%s qtd token %08x --> status %d\n",
++				usb_pipedevice(urb->pipe),
++				usb_pipeendpoint(urb->pipe),
++				usb_pipein(urb->pipe) ? "in" : "out",
++				token, status);
++	}
++
++	return status;
++}
++
++static void fotg210_urb_done(struct fotg210_hcd *fotg210, struct urb *urb,
++		int status)
++__releases(fotg210->lock)
++__acquires(fotg210->lock)
++{
++	if (likely(urb->hcpriv != NULL)) {
++		struct fotg210_qh *qh = (struct fotg210_qh *) urb->hcpriv;
++
++		/* S-mask in a QH means it's an interrupt urb */
++		if ((qh->hw->hw_info2 & cpu_to_hc32(fotg210, QH_SMASK)) != 0) {
++
++			/* ... update hc-wide periodic stats (for usbfs) */
++			fotg210_to_hcd(fotg210)->self.bandwidth_int_reqs--;
++		}
++	}
++
++	if (unlikely(urb->unlinked)) {
++		INCR(fotg210->stats.unlink);
++	} else {
++		/* report non-error and short read status as zero */
++		if (status == -EINPROGRESS || status == -EREMOTEIO)
++			status = 0;
++		INCR(fotg210->stats.complete);
++	}
++
++#ifdef FOTG210_URB_TRACE
++	fotg210_dbg(fotg210,
++			"%s %s urb %p ep%d%s status %d len %d/%d\n",
++			__func__, urb->dev->devpath, urb,
++			usb_pipeendpoint(urb->pipe),
++			usb_pipein(urb->pipe) ? "in" : "out",
++			status,
++			urb->actual_length, urb->transfer_buffer_length);
++#endif
++
++	/* complete() can reenter this HCD */
++	usb_hcd_unlink_urb_from_ep(fotg210_to_hcd(fotg210), urb);
++	spin_unlock(&fotg210->lock);
++	usb_hcd_giveback_urb(fotg210_to_hcd(fotg210), urb, status);
++	spin_lock(&fotg210->lock);
++}
++
++static int qh_schedule(struct fotg210_hcd *fotg210, struct fotg210_qh *qh);
++
++/* Process and free completed qtds for a qh, returning URBs to drivers.
++ * Chases up to qh->hw_current.  Returns number of completions called,
++ * indicating how much "real" work we did.
++ */
++static unsigned qh_completions(struct fotg210_hcd *fotg210,
++		struct fotg210_qh *qh)
++{
++	struct fotg210_qtd *last, *end = qh->dummy;
++	struct fotg210_qtd *qtd, *tmp;
++	int last_status;
++	int stopped;
++	unsigned count = 0;
++	u8 state;
++	struct fotg210_qh_hw *hw = qh->hw;
++
++	if (unlikely(list_empty(&qh->qtd_list)))
++		return count;
++
++	/* completions (or tasks on other cpus) must never clobber HALT
++	 * till we've gone through and cleaned everything up, even when
++	 * they add urbs to this qh's queue or mark them for unlinking.
++	 *
++	 * NOTE:  unlinking expects to be done in queue order.
++	 *
++	 * It's a bug for qh->qh_state to be anything other than
++	 * QH_STATE_IDLE, unless our caller is scan_async() or
++	 * scan_intr().
++	 */
++	state = qh->qh_state;
++	qh->qh_state = QH_STATE_COMPLETING;
++	stopped = (state == QH_STATE_IDLE);
++
++rescan:
++	last = NULL;
++	last_status = -EINPROGRESS;
++	qh->needs_rescan = 0;
++
++	/* remove de-activated QTDs from front of queue.
++	 * after faults (including short reads), cleanup this urb
++	 * then let the queue advance.
++	 * if queue is stopped, handles unlinks.
++	 */
++	list_for_each_entry_safe(qtd, tmp, &qh->qtd_list, qtd_list) {
++		struct urb *urb;
++		u32 token = 0;
++
++		urb = qtd->urb;
++
++		/* clean up any state from previous QTD ...*/
++		if (last) {
++			if (likely(last->urb != urb)) {
++				fotg210_urb_done(fotg210, last->urb,
++						last_status);
++				count++;
++				last_status = -EINPROGRESS;
++			}
++			fotg210_qtd_free(fotg210, last);
++			last = NULL;
++		}
++
++		/* ignore urbs submitted during completions we reported */
++		if (qtd == end)
++			break;
++
++		/* hardware copies qtd out of qh overlay */
++		rmb();
++		token = hc32_to_cpu(fotg210, qtd->hw_token);
++
++		/* always clean up qtds the hc de-activated */
++retry_xacterr:
++		if ((token & QTD_STS_ACTIVE) == 0) {
++
++			/* Report Data Buffer Error: non-fatal but useful */
++			if (token & QTD_STS_DBE)
++				fotg210_dbg(fotg210,
++					"detected DataBufferErr for urb %p ep%d%s len %d, qtd %p [qh %p]\n",
++					urb, usb_endpoint_num(&urb->ep->desc),
++					usb_endpoint_dir_in(&urb->ep->desc)
++						? "in" : "out",
++					urb->transfer_buffer_length, qtd, qh);
++
++			/* on STALL, error, and short reads this urb must
++			 * complete and all its qtds must be recycled.
++			 */
++			if ((token & QTD_STS_HALT) != 0) {
++
++				/* retry transaction errors until we
++				 * reach the software xacterr limit
++				 */
++				if ((token & QTD_STS_XACT) &&
++						QTD_CERR(token) == 0 &&
++						++qh->xacterrs < QH_XACTERR_MAX &&
++						!urb->unlinked) {
++					fotg210_dbg(fotg210,
++						"detected XactErr len %zu/%zu retry %d\n",
++						qtd->length - QTD_LENGTH(token),
++						qtd->length,
++						qh->xacterrs);
++
++					/* reset the token in the qtd and the
++					 * qh overlay (which still contains
++					 * the qtd) so that we pick up from
++					 * where we left off
++					 */
++					token &= ~QTD_STS_HALT;
++					token |= QTD_STS_ACTIVE |
++						 (FOTG210_TUNE_CERR << 10);
++					qtd->hw_token = cpu_to_hc32(fotg210,
++							token);
++					wmb();
++					hw->hw_token = cpu_to_hc32(fotg210,
++							token);
++					goto retry_xacterr;
++				}
++				stopped = 1;
++
++			/* magic dummy for some short reads; qh won't advance.
++			 * that silicon quirk can kick in with this dummy too.
++			 *
++			 * other short reads won't stop the queue, including
++			 * control transfers (status stage handles that) or
++			 * most other single-qtd reads ... the queue stops if
++			 * URB_SHORT_NOT_OK was set so the driver submitting
++			 * the urbs could clean it up.
++			 */
++			} else if (IS_SHORT_READ(token) &&
++					!(qtd->hw_alt_next &
++					FOTG210_LIST_END(fotg210))) {
++				stopped = 1;
++			}
++
++		/* stop scanning when we reach qtds the hc is using */
++		} else if (likely(!stopped
++				&& fotg210->rh_state >= FOTG210_RH_RUNNING)) {
++			break;
++
++		/* scan the whole queue for unlinks whenever it stops */
++		} else {
++			stopped = 1;
++
++			/* cancel everything if we halt, suspend, etc */
++			if (fotg210->rh_state < FOTG210_RH_RUNNING)
++				last_status = -ESHUTDOWN;
++
++			/* this qtd is active; skip it unless a previous qtd
++			 * for its urb faulted, or its urb was canceled.
++			 */
++			else if (last_status == -EINPROGRESS && !urb->unlinked)
++				continue;
++
++			/* qh unlinked; token in overlay may be most current */
++			if (state == QH_STATE_IDLE &&
++					cpu_to_hc32(fotg210, qtd->qtd_dma)
++					== hw->hw_current) {
++				token = hc32_to_cpu(fotg210, hw->hw_token);
++
++				/* An unlink may leave an incomplete
++				 * async transaction in the TT buffer.
++				 * We have to clear it.
++				 */
++				fotg210_clear_tt_buffer(fotg210, qh, urb,
++						token);
++			}
++		}
++
++		/* unless we already know the urb's status, collect qtd status
++		 * and update count of bytes transferred.  in common short read
++		 * cases with only one data qtd (including control transfers),
++		 * queue processing won't halt.  but with two or more qtds (for
++		 * example, with a 32 KB transfer), when the first qtd gets a
++		 * short read the second must be removed by hand.
++		 */
++		if (last_status == -EINPROGRESS) {
++			last_status = qtd_copy_status(fotg210, urb,
++					qtd->length, token);
++			if (last_status == -EREMOTEIO &&
++					(qtd->hw_alt_next &
++					FOTG210_LIST_END(fotg210)))
++				last_status = -EINPROGRESS;
++
++			/* As part of low/full-speed endpoint-halt processing
++			 * we must clear the TT buffer (11.17.5).
++			 */
++			if (unlikely(last_status != -EINPROGRESS &&
++					last_status != -EREMOTEIO)) {
++				/* The TT's in some hubs malfunction when they
++				 * receive this request following a STALL (they
++				 * stop sending isochronous packets).  Since a
++				 * STALL can't leave the TT buffer in a busy
++				 * state (if you believe Figures 11-48 - 11-51
++				 * in the USB 2.0 spec), we won't clear the TT
++				 * buffer in this case.  Strictly speaking this
++				 * is a violation of the spec.
++				 */
++				if (last_status != -EPIPE)
++					fotg210_clear_tt_buffer(fotg210, qh,
++							urb, token);
++			}
++		}
++
++		/* if we're removing something not at the queue head,
++		 * patch the hardware queue pointer.
++		 */
++		if (stopped && qtd->qtd_list.prev != &qh->qtd_list) {
++			last = list_entry(qtd->qtd_list.prev,
++					struct fotg210_qtd, qtd_list);
++			last->hw_next = qtd->hw_next;
++		}
++
++		/* remove qtd; it's recycled after possible urb completion */
++		list_del(&qtd->qtd_list);
++		last = qtd;
++
++		/* reinit the xacterr counter for the next qtd */
++		qh->xacterrs = 0;
++	}
++
++	/* last urb's completion might still need calling */
++	if (likely(last != NULL)) {
++		fotg210_urb_done(fotg210, last->urb, last_status);
++		count++;
++		fotg210_qtd_free(fotg210, last);
++	}
++
++	/* Do we need to rescan for URBs dequeued during a giveback? */
++	if (unlikely(qh->needs_rescan)) {
++		/* If the QH is already unlinked, do the rescan now. */
++		if (state == QH_STATE_IDLE)
++			goto rescan;
++
++		/* Otherwise we have to wait until the QH is fully unlinked.
++		 * Our caller will start an unlink if qh->needs_rescan is
++		 * set.  But if an unlink has already started, nothing needs
++		 * to be done.
++		 */
++		if (state != QH_STATE_LINKED)
++			qh->needs_rescan = 0;
++	}
++
++	/* restore original state; caller must unlink or relink */
++	qh->qh_state = state;
++
++	/* be sure the hardware's done with the qh before refreshing
++	 * it after fault cleanup, or recovering from silicon wrongly
++	 * overlaying the dummy qtd (which reduces DMA chatter).
++	 */
++	if (stopped != 0 || hw->hw_qtd_next == FOTG210_LIST_END(fotg210)) {
++		switch (state) {
++		case QH_STATE_IDLE:
++			qh_refresh(fotg210, qh);
++			break;
++		case QH_STATE_LINKED:
++			/* We won't refresh a QH that's linked (after the HC
++			 * stopped the queue).  That avoids a race:
++			 *  - HC reads first part of QH;
++			 *  - CPU updates that first part and the token;
++			 *  - HC reads rest of that QH, including token
++			 * Result:  HC gets an inconsistent image, and then
++			 * DMAs to/from the wrong memory (corrupting it).
++			 *
++			 * That should be rare for interrupt transfers,
++			 * except maybe high bandwidth ...
++			 */
++
++			/* Tell the caller to start an unlink */
++			qh->needs_rescan = 1;
++			break;
++		/* otherwise, unlink already started */
++		}
++	}
++
++	return count;
++}
++
++/* reverse of qh_urb_transaction:  free a list of TDs.
++ * used for cleanup after errors, before HC sees an URB's TDs.
++ */
++static void qtd_list_free(struct fotg210_hcd *fotg210, struct urb *urb,
++		struct list_head *head)
++{
++	struct fotg210_qtd *qtd, *temp;
++
++	list_for_each_entry_safe(qtd, temp, head, qtd_list) {
++		list_del(&qtd->qtd_list);
++		fotg210_qtd_free(fotg210, qtd);
++	}
++}
++
++/* create a list of filled qtds for this URB; won't link into qh.
++ */
++static struct list_head *qh_urb_transaction(struct fotg210_hcd *fotg210,
++		struct urb *urb, struct list_head *head, gfp_t flags)
++{
++	struct fotg210_qtd *qtd, *qtd_prev;
++	dma_addr_t buf;
++	int len, this_sg_len, maxpacket;
++	int is_input;
++	u32 token;
++	int i;
++	struct scatterlist *sg;
++
++	/*
++	 * URBs map to sequences of QTDs:  one logical transaction
++	 */
++	qtd = fotg210_qtd_alloc(fotg210, flags);
++	if (unlikely(!qtd))
++		return NULL;
++	list_add_tail(&qtd->qtd_list, head);
++	qtd->urb = urb;
++
++	token = QTD_STS_ACTIVE;
++	token |= (FOTG210_TUNE_CERR << 10);
++	/* for split transactions, SplitXState initialized to zero */
++
++	len = urb->transfer_buffer_length;
++	is_input = usb_pipein(urb->pipe);
++	if (usb_pipecontrol(urb->pipe)) {
++		/* SETUP pid */
++		qtd_fill(fotg210, qtd, urb->setup_dma,
++				sizeof(struct usb_ctrlrequest),
++				token | (2 /* "setup" */ << 8), 8);
++
++		/* ... and always at least one more pid */
++		token ^= QTD_TOGGLE;
++		qtd_prev = qtd;
++		qtd = fotg210_qtd_alloc(fotg210, flags);
++		if (unlikely(!qtd))
++			goto cleanup;
++		qtd->urb = urb;
++		qtd_prev->hw_next = QTD_NEXT(fotg210, qtd->qtd_dma);
++		list_add_tail(&qtd->qtd_list, head);
++
++		/* for zero length DATA stages, STATUS is always IN */
++		if (len == 0)
++			token |= (1 /* "in" */ << 8);
++	}
++
++	/*
++	 * data transfer stage:  buffer setup
++	 */
++	i = urb->num_mapped_sgs;
++	if (len > 0 && i > 0) {
++		sg = urb->sg;
++		buf = sg_dma_address(sg);
++
++		/* urb->transfer_buffer_length may be smaller than the
++		 * size of the scatterlist (or vice versa)
++		 */
++		this_sg_len = min_t(int, sg_dma_len(sg), len);
++	} else {
++		sg = NULL;
++		buf = urb->transfer_dma;
++		this_sg_len = len;
++	}
++
++	if (is_input)
++		token |= (1 /* "in" */ << 8);
++	/* else it's already initted to "out" pid (0 << 8) */
++
++	maxpacket = usb_maxpacket(urb->dev, urb->pipe);
++
++	/*
++	 * buffer gets wrapped in one or more qtds;
++	 * last one may be "short" (including zero len)
++	 * and may serve as a control status ack
++	 */
++	for (;;) {
++		int this_qtd_len;
++
++		this_qtd_len = qtd_fill(fotg210, qtd, buf, this_sg_len, token,
++				maxpacket);
++		this_sg_len -= this_qtd_len;
++		len -= this_qtd_len;
++		buf += this_qtd_len;
++
++		/*
++		 * short reads advance to a "magic" dummy instead of the next
++		 * qtd ... that forces the queue to stop, for manual cleanup.
++		 * (this will usually be overridden later.)
++		 */
++		if (is_input)
++			qtd->hw_alt_next = fotg210->async->hw->hw_alt_next;
++
++		/* qh makes control packets use qtd toggle; maybe switch it */
++		if ((maxpacket & (this_qtd_len + (maxpacket - 1))) == 0)
++			token ^= QTD_TOGGLE;
++
++		if (likely(this_sg_len <= 0)) {
++			if (--i <= 0 || len <= 0)
++				break;
++			sg = sg_next(sg);
++			buf = sg_dma_address(sg);
++			this_sg_len = min_t(int, sg_dma_len(sg), len);
++		}
++
++		qtd_prev = qtd;
++		qtd = fotg210_qtd_alloc(fotg210, flags);
++		if (unlikely(!qtd))
++			goto cleanup;
++		qtd->urb = urb;
++		qtd_prev->hw_next = QTD_NEXT(fotg210, qtd->qtd_dma);
++		list_add_tail(&qtd->qtd_list, head);
++	}
++
++	/*
++	 * unless the caller requires manual cleanup after short reads,
++	 * have the alt_next mechanism keep the queue running after the
++	 * last data qtd (the only one, for control and most other cases).
++	 */
++	if (likely((urb->transfer_flags & URB_SHORT_NOT_OK) == 0 ||
++			usb_pipecontrol(urb->pipe)))
++		qtd->hw_alt_next = FOTG210_LIST_END(fotg210);
++
++	/*
++	 * control requests may need a terminating data "status" ack;
++	 * other OUT ones may need a terminating short packet
++	 * (zero length).
++	 */
++	if (likely(urb->transfer_buffer_length != 0)) {
++		int one_more = 0;
++
++		if (usb_pipecontrol(urb->pipe)) {
++			one_more = 1;
++			token ^= 0x0100;	/* "in" <--> "out"  */
++			token |= QTD_TOGGLE;	/* force DATA1 */
++		} else if (usb_pipeout(urb->pipe)
++				&& (urb->transfer_flags & URB_ZERO_PACKET)
++				&& !(urb->transfer_buffer_length % maxpacket)) {
++			one_more = 1;
++		}
++		if (one_more) {
++			qtd_prev = qtd;
++			qtd = fotg210_qtd_alloc(fotg210, flags);
++			if (unlikely(!qtd))
++				goto cleanup;
++			qtd->urb = urb;
++			qtd_prev->hw_next = QTD_NEXT(fotg210, qtd->qtd_dma);
++			list_add_tail(&qtd->qtd_list, head);
++
++			/* never any data in such packets */
++			qtd_fill(fotg210, qtd, 0, 0, token, 0);
++		}
++	}
++
++	/* by default, enable interrupt on urb completion */
++	if (likely(!(urb->transfer_flags & URB_NO_INTERRUPT)))
++		qtd->hw_token |= cpu_to_hc32(fotg210, QTD_IOC);
++	return head;
++
++cleanup:
++	qtd_list_free(fotg210, urb, head);
++	return NULL;
++}
++
++/* Would be best to create all qh's from config descriptors,
++ * when each interface/altsetting is established.  Unlink
++ * any previous qh and cancel its urbs first; endpoints are
++ * implicitly reset then (data toggle too).
++ * That'd mean updating how usbcore talks to HCDs. (2.7?)
++ */
++
++
++/* Each QH holds a qtd list; a QH is used for everything except iso.
++ *
++ * For interrupt urbs, the scheduler must set the microframe scheduling
++ * mask(s) each time the QH gets scheduled.  For highspeed, that's
++ * just one microframe in the s-mask.  For split interrupt transactions
++ * there are additional complications: c-mask, maybe FSTNs.
++ */
++static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb,
++		gfp_t flags)
++{
++	struct fotg210_qh *qh = fotg210_qh_alloc(fotg210, flags);
++	struct usb_host_endpoint *ep;
++	u32 info1 = 0, info2 = 0;
++	int is_input, type;
++	int maxp = 0;
++	int mult;
++	struct usb_tt *tt = urb->dev->tt;
++	struct fotg210_qh_hw *hw;
++
++	if (!qh)
++		return qh;
++
++	/*
++	 * init endpoint/device data for this QH
++	 */
++	info1 |= usb_pipeendpoint(urb->pipe) << 8;
++	info1 |= usb_pipedevice(urb->pipe) << 0;
++
++	is_input = usb_pipein(urb->pipe);
++	type = usb_pipetype(urb->pipe);
++	ep = usb_pipe_endpoint(urb->dev, urb->pipe);
++	maxp = usb_endpoint_maxp(&ep->desc);
++	mult = usb_endpoint_maxp_mult(&ep->desc);
++
++	/* 1024 byte maxpacket is a hardware ceiling.  High bandwidth
++	 * acts like up to 3KB, but is built from smaller packets.
++	 */
++	if (maxp > 1024) {
++		fotg210_dbg(fotg210, "bogus qh maxpacket %d\n", maxp);
++		goto done;
++	}
++
++	/* Compute interrupt scheduling parameters just once, and save.
++	 * - allowing for high bandwidth, how many nsec/uframe are used?
++	 * - split transactions need a second CSPLIT uframe; same question
++	 * - splits also need a schedule gap (for full/low speed I/O)
++	 * - qh has a polling interval
++	 *
++	 * For control/bulk requests, the HC or TT handles these.
++	 */
++	if (type == PIPE_INTERRUPT) {
++		qh->usecs = NS_TO_US(usb_calc_bus_time(USB_SPEED_HIGH,
++				is_input, 0, mult * maxp));
++		qh->start = NO_FRAME;
++
++		if (urb->dev->speed == USB_SPEED_HIGH) {
++			qh->c_usecs = 0;
++			qh->gap_uf = 0;
++
++			qh->period = urb->interval >> 3;
++			if (qh->period == 0 && urb->interval != 1) {
++				/* NOTE interval 2 or 4 uframes could work.
++				 * But interval 1 scheduling is simpler, and
++				 * includes high bandwidth.
++				 */
++				urb->interval = 1;
++			} else if (qh->period > fotg210->periodic_size) {
++				qh->period = fotg210->periodic_size;
++				urb->interval = qh->period << 3;
++			}
++		} else {
++			int think_time;
++
++			/* gap is f(FS/LS transfer times) */
++			qh->gap_uf = 1 + usb_calc_bus_time(urb->dev->speed,
++					is_input, 0, maxp) / (125 * 1000);
++
++			/* FIXME this just approximates SPLIT/CSPLIT times */
++			if (is_input) {		/* SPLIT, gap, CSPLIT+DATA */
++				qh->c_usecs = qh->usecs + HS_USECS(0);
++				qh->usecs = HS_USECS(1);
++			} else {		/* SPLIT+DATA, gap, CSPLIT */
++				qh->usecs += HS_USECS(1);
++				qh->c_usecs = HS_USECS(0);
++			}
++
++			think_time = tt ? tt->think_time : 0;
++			qh->tt_usecs = NS_TO_US(think_time +
++					usb_calc_bus_time(urb->dev->speed,
++					is_input, 0, maxp));
++			qh->period = urb->interval;
++			if (qh->period > fotg210->periodic_size) {
++				qh->period = fotg210->periodic_size;
++				urb->interval = qh->period;
++			}
++		}
++	}
++
++	/* support for tt scheduling, and access to toggles */
++	qh->dev = urb->dev;
++
++	/* using TT? */
++	switch (urb->dev->speed) {
++	case USB_SPEED_LOW:
++		info1 |= QH_LOW_SPEED;
++		fallthrough;
++
++	case USB_SPEED_FULL:
++		/* EPS 0 means "full" */
++		if (type != PIPE_INTERRUPT)
++			info1 |= (FOTG210_TUNE_RL_TT << 28);
++		if (type == PIPE_CONTROL) {
++			info1 |= QH_CONTROL_EP;		/* for TT */
++			info1 |= QH_TOGGLE_CTL;		/* toggle from qtd */
++		}
++		info1 |= maxp << 16;
++
++		info2 |= (FOTG210_TUNE_MULT_TT << 30);
++
++		/* Some Freescale processors have an erratum in which the
++		 * port number in the queue head was 0..N-1 instead of 1..N.
++		 */
++		if (fotg210_has_fsl_portno_bug(fotg210))
++			info2 |= (urb->dev->ttport-1) << 23;
++		else
++			info2 |= urb->dev->ttport << 23;
++
++		/* set the address of the TT; for TDI's integrated
++		 * root hub tt, leave it zeroed.
++		 */
++		if (tt && tt->hub != fotg210_to_hcd(fotg210)->self.root_hub)
++			info2 |= tt->hub->devnum << 16;
++
++		/* NOTE:  if (PIPE_INTERRUPT) { scheduler sets c-mask } */
++
++		break;
++
++	case USB_SPEED_HIGH:		/* no TT involved */
++		info1 |= QH_HIGH_SPEED;
++		if (type == PIPE_CONTROL) {
++			info1 |= (FOTG210_TUNE_RL_HS << 28);
++			info1 |= 64 << 16;	/* usb2 fixed maxpacket */
++			info1 |= QH_TOGGLE_CTL;	/* toggle from qtd */
++			info2 |= (FOTG210_TUNE_MULT_HS << 30);
++		} else if (type == PIPE_BULK) {
++			info1 |= (FOTG210_TUNE_RL_HS << 28);
++			/* The USB spec says that high speed bulk endpoints
++			 * always use 512 byte maxpacket.  But some device
++			 * vendors decided to ignore that, and MSFT is happy
++			 * to help them do so.  So now people expect to use
++			 * such nonconformant devices with Linux too; sigh.
++			 */
++			info1 |= maxp << 16;
++			info2 |= (FOTG210_TUNE_MULT_HS << 30);
++		} else {		/* PIPE_INTERRUPT */
++			info1 |= maxp << 16;
++			info2 |= mult << 30;
++		}
++		break;
++	default:
++		fotg210_dbg(fotg210, "bogus dev %p speed %d\n", urb->dev,
++				urb->dev->speed);
++done:
++		qh_destroy(fotg210, qh);
++		return NULL;
++	}
++
++	/* NOTE:  if (PIPE_INTERRUPT) { scheduler sets s-mask } */
++
++	/* init as live, toggle clear, advance to dummy */
++	qh->qh_state = QH_STATE_IDLE;
++	hw = qh->hw;
++	hw->hw_info1 = cpu_to_hc32(fotg210, info1);
++	hw->hw_info2 = cpu_to_hc32(fotg210, info2);
++	qh->is_out = !is_input;
++	usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe), !is_input, 1);
++	qh_refresh(fotg210, qh);
++	return qh;
++}
++
++static void enable_async(struct fotg210_hcd *fotg210)
++{
++	if (fotg210->async_count++)
++		return;
++
++	/* Stop waiting to turn off the async schedule */
++	fotg210->enabled_hrtimer_events &= ~BIT(FOTG210_HRTIMER_DISABLE_ASYNC);
++
++	/* Don't start the schedule until ASS is 0 */
++	fotg210_poll_ASS(fotg210);
++	turn_on_io_watchdog(fotg210);
++}
++
++static void disable_async(struct fotg210_hcd *fotg210)
++{
++	if (--fotg210->async_count)
++		return;
++
++	/* The async schedule and async_unlink list are supposed to be empty */
++	WARN_ON(fotg210->async->qh_next.qh || fotg210->async_unlink);
++
++	/* Don't turn off the schedule until ASS is 1 */
++	fotg210_poll_ASS(fotg210);
++}
++
++/* move qh (and its qtds) onto async queue; maybe enable queue.  */
++
++static void qh_link_async(struct fotg210_hcd *fotg210, struct fotg210_qh *qh)
++{
++	__hc32 dma = QH_NEXT(fotg210, qh->qh_dma);
++	struct fotg210_qh *head;
++
++	/* Don't link a QH if there's a Clear-TT-Buffer pending */
++	if (unlikely(qh->clearing_tt))
++		return;
++
++	WARN_ON(qh->qh_state != QH_STATE_IDLE);
++
++	/* clear halt and/or toggle; and maybe recover from silicon quirk */
++	qh_refresh(fotg210, qh);
++
++	/* splice right after start */
++	head = fotg210->async;
++	qh->qh_next = head->qh_next;
++	qh->hw->hw_next = head->hw->hw_next;
++	wmb();
++
++	head->qh_next.qh = qh;
++	head->hw->hw_next = dma;
++
++	qh->xacterrs = 0;
++	qh->qh_state = QH_STATE_LINKED;
++	/* qtd completions reported later by interrupt */
++
++	enable_async(fotg210);
++}
++
++/* For control/bulk/interrupt, return QH with these TDs appended.
++ * Allocates and initializes the QH if necessary.
++ * Returns null if it can't allocate a QH it needs to.
++ * If the QH has TDs (urbs) already, that's great.
++ */
++static struct fotg210_qh *qh_append_tds(struct fotg210_hcd *fotg210,
++		struct urb *urb, struct list_head *qtd_list,
++		int epnum, void **ptr)
++{
++	struct fotg210_qh *qh = NULL;
++	__hc32 qh_addr_mask = cpu_to_hc32(fotg210, 0x7f);
++
++	qh = (struct fotg210_qh *) *ptr;
++	if (unlikely(qh == NULL)) {
++		/* can't sleep here, we have fotg210->lock... */
++		qh = qh_make(fotg210, urb, GFP_ATOMIC);
++		*ptr = qh;
++	}
++	if (likely(qh != NULL)) {
++		struct fotg210_qtd *qtd;
++
++		if (unlikely(list_empty(qtd_list)))
++			qtd = NULL;
++		else
++			qtd = list_entry(qtd_list->next, struct fotg210_qtd,
++					qtd_list);
++
++		/* control qh may need patching ... */
++		if (unlikely(epnum == 0)) {
++			/* usb_reset_device() briefly reverts to address 0 */
++			if (usb_pipedevice(urb->pipe) == 0)
++				qh->hw->hw_info1 &= ~qh_addr_mask;
++		}
++
++		/* just one way to queue requests: swap with the dummy qtd.
++		 * only hc or qh_refresh() ever modify the overlay.
++		 */
++		if (likely(qtd != NULL)) {
++			struct fotg210_qtd *dummy;
++			dma_addr_t dma;
++			__hc32 token;
++
++			/* to avoid racing the HC, use the dummy td instead of
++			 * the first td of our list (becomes new dummy).  both
++			 * tds stay deactivated until we're done, when the
++			 * HC is allowed to fetch the old dummy (4.10.2).
++			 */
++			token = qtd->hw_token;
++			qtd->hw_token = HALT_BIT(fotg210);
++
++			dummy = qh->dummy;
++
++			dma = dummy->qtd_dma;
++			*dummy = *qtd;
++			dummy->qtd_dma = dma;
++
++			list_del(&qtd->qtd_list);
++			list_add(&dummy->qtd_list, qtd_list);
++			list_splice_tail(qtd_list, &qh->qtd_list);
++
++			fotg210_qtd_init(fotg210, qtd, qtd->qtd_dma);
++			qh->dummy = qtd;
++
++			/* hc must see the new dummy at list end */
++			dma = qtd->qtd_dma;
++			qtd = list_entry(qh->qtd_list.prev,
++					struct fotg210_qtd, qtd_list);
++			qtd->hw_next = QTD_NEXT(fotg210, dma);
++
++			/* let the hc process these next qtds */
++			wmb();
++			dummy->hw_token = token;
++
++			urb->hcpriv = qh;
++		}
++	}
++	return qh;
++}
++
++static int submit_async(struct fotg210_hcd *fotg210, struct urb *urb,
++		struct list_head *qtd_list, gfp_t mem_flags)
++{
++	int epnum;
++	unsigned long flags;
++	struct fotg210_qh *qh = NULL;
++	int rc;
++
++	epnum = urb->ep->desc.bEndpointAddress;
++
++#ifdef FOTG210_URB_TRACE
++	{
++		struct fotg210_qtd *qtd;
++
++		qtd = list_entry(qtd_list->next, struct fotg210_qtd, qtd_list);
++		fotg210_dbg(fotg210,
++				"%s %s urb %p ep%d%s len %d, qtd %p [qh %p]\n",
++				__func__, urb->dev->devpath, urb,
++				epnum & 0x0f, (epnum & USB_DIR_IN)
++					? "in" : "out",
++				urb->transfer_buffer_length,
++				qtd, urb->ep->hcpriv);
++	}
++#endif
++
++	spin_lock_irqsave(&fotg210->lock, flags);
++	if (unlikely(!HCD_HW_ACCESSIBLE(fotg210_to_hcd(fotg210)))) {
++		rc = -ESHUTDOWN;
++		goto done;
++	}
++	rc = usb_hcd_link_urb_to_ep(fotg210_to_hcd(fotg210), urb);
++	if (unlikely(rc))
++		goto done;
++
++	qh = qh_append_tds(fotg210, urb, qtd_list, epnum, &urb->ep->hcpriv);
++	if (unlikely(qh == NULL)) {
++		usb_hcd_unlink_urb_from_ep(fotg210_to_hcd(fotg210), urb);
++		rc = -ENOMEM;
++		goto done;
++	}
++
++	/* Control/bulk operations through TTs don't need scheduling,
++	 * the HC and TT handle it when the TT has a buffer ready.
++	 */
++	if (likely(qh->qh_state == QH_STATE_IDLE))
++		qh_link_async(fotg210, qh);
++done:
++	spin_unlock_irqrestore(&fotg210->lock, flags);
++	if (unlikely(qh == NULL))
++		qtd_list_free(fotg210, urb, qtd_list);
++	return rc;
++}
++
++static void single_unlink_async(struct fotg210_hcd *fotg210,
++		struct fotg210_qh *qh)
++{
++	struct fotg210_qh *prev;
++
++	/* Add to the end of the list of QHs waiting for the next IAAD */
++	qh->qh_state = QH_STATE_UNLINK;
++	if (fotg210->async_unlink)
++		fotg210->async_unlink_last->unlink_next = qh;
++	else
++		fotg210->async_unlink = qh;
++	fotg210->async_unlink_last = qh;
++
++	/* Unlink it from the schedule */
++	prev = fotg210->async;
++	while (prev->qh_next.qh != qh)
++		prev = prev->qh_next.qh;
++
++	prev->hw->hw_next = qh->hw->hw_next;
++	prev->qh_next = qh->qh_next;
++	if (fotg210->qh_scan_next == qh)
++		fotg210->qh_scan_next = qh->qh_next.qh;
++}
++
++static void start_iaa_cycle(struct fotg210_hcd *fotg210, bool nested)
++{
++	/*
++	 * Do nothing if an IAA cycle is already running or
++	 * if one will be started shortly.
++	 */
++	if (fotg210->async_iaa || fotg210->async_unlinking)
++		return;
++
++	/* Do all the waiting QHs at once */
++	fotg210->async_iaa = fotg210->async_unlink;
++	fotg210->async_unlink = NULL;
++
++	/* If the controller isn't running, we don't have to wait for it */
++	if (unlikely(fotg210->rh_state < FOTG210_RH_RUNNING)) {
++		if (!nested)		/* Avoid recursion */
++			end_unlink_async(fotg210);
++
++	/* Otherwise start a new IAA cycle */
++	} else if (likely(fotg210->rh_state == FOTG210_RH_RUNNING)) {
++		/* Make sure the unlinks are all visible to the hardware */
++		wmb();
++
++		fotg210_writel(fotg210, fotg210->command | CMD_IAAD,
++				&fotg210->regs->command);
++		fotg210_readl(fotg210, &fotg210->regs->command);
++		fotg210_enable_event(fotg210, FOTG210_HRTIMER_IAA_WATCHDOG,
++				true);
++	}
++}
++
++/* the async qh for the qtds being unlinked are now gone from the HC */
++
++static void end_unlink_async(struct fotg210_hcd *fotg210)
++{
++	struct fotg210_qh *qh;
++
++	/* Process the idle QHs */
++restart:
++	fotg210->async_unlinking = true;
++	while (fotg210->async_iaa) {
++		qh = fotg210->async_iaa;
++		fotg210->async_iaa = qh->unlink_next;
++		qh->unlink_next = NULL;
++
++		qh->qh_state = QH_STATE_IDLE;
++		qh->qh_next.qh = NULL;
++
++		qh_completions(fotg210, qh);
++		if (!list_empty(&qh->qtd_list) &&
++				fotg210->rh_state == FOTG210_RH_RUNNING)
++			qh_link_async(fotg210, qh);
++		disable_async(fotg210);
++	}
++	fotg210->async_unlinking = false;
++
++	/* Start a new IAA cycle if any QHs are waiting for it */
++	if (fotg210->async_unlink) {
++		start_iaa_cycle(fotg210, true);
++		if (unlikely(fotg210->rh_state < FOTG210_RH_RUNNING))
++			goto restart;
++	}
++}
++
++static void unlink_empty_async(struct fotg210_hcd *fotg210)
++{
++	struct fotg210_qh *qh, *next;
++	bool stopped = (fotg210->rh_state < FOTG210_RH_RUNNING);
++	bool check_unlinks_later = false;
++
++	/* Unlink all the async QHs that have been empty for a timer cycle */
++	next = fotg210->async->qh_next.qh;
++	while (next) {
++		qh = next;
++		next = qh->qh_next.qh;
++
++		if (list_empty(&qh->qtd_list) &&
++				qh->qh_state == QH_STATE_LINKED) {
++			if (!stopped && qh->unlink_cycle ==
++					fotg210->async_unlink_cycle)
++				check_unlinks_later = true;
++			else
++				single_unlink_async(fotg210, qh);
++		}
++	}
++
++	/* Start a new IAA cycle if any QHs are waiting for it */
++	if (fotg210->async_unlink)
++		start_iaa_cycle(fotg210, false);
++
++	/* QHs that haven't been empty for long enough will be handled later */
++	if (check_unlinks_later) {
++		fotg210_enable_event(fotg210, FOTG210_HRTIMER_ASYNC_UNLINKS,
++				true);
++		++fotg210->async_unlink_cycle;
++	}
++}
++
++/* makes sure the async qh will become idle */
++/* caller must own fotg210->lock */
++
++static void start_unlink_async(struct fotg210_hcd *fotg210,
++		struct fotg210_qh *qh)
++{
++	/*
++	 * If the QH isn't linked then there's nothing we can do
++	 * unless we were called during a giveback, in which case
++	 * qh_completions() has to deal with it.
++	 */
++	if (qh->qh_state != QH_STATE_LINKED) {
++		if (qh->qh_state == QH_STATE_COMPLETING)
++			qh->needs_rescan = 1;
++		return;
++	}
++
++	single_unlink_async(fotg210, qh);
++	start_iaa_cycle(fotg210, false);
++}
++
++static void scan_async(struct fotg210_hcd *fotg210)
++{
++	struct fotg210_qh *qh;
++	bool check_unlinks_later = false;
++
++	fotg210->qh_scan_next = fotg210->async->qh_next.qh;
++	while (fotg210->qh_scan_next) {
++		qh = fotg210->qh_scan_next;
++		fotg210->qh_scan_next = qh->qh_next.qh;
++rescan:
++		/* clean any finished work for this qh */
++		if (!list_empty(&qh->qtd_list)) {
++			int temp;
++
++			/*
++			 * Unlinks could happen here; completion reporting
++			 * drops the lock.  That's why fotg210->qh_scan_next
++			 * always holds the next qh to scan; if the next qh
++			 * gets unlinked then fotg210->qh_scan_next is adjusted
++			 * in single_unlink_async().
++			 */
++			temp = qh_completions(fotg210, qh);
++			if (qh->needs_rescan) {
++				start_unlink_async(fotg210, qh);
++			} else if (list_empty(&qh->qtd_list)
++					&& qh->qh_state == QH_STATE_LINKED) {
++				qh->unlink_cycle = fotg210->async_unlink_cycle;
++				check_unlinks_later = true;
++			} else if (temp != 0)
++				goto rescan;
++		}
++	}
++
++	/*
++	 * Unlink empty entries, reducing DMA usage as well
++	 * as HCD schedule-scanning costs.  Delay for any qh
++	 * we just scanned, there's a not-unusual case that it
++	 * doesn't stay idle for long.
++	 */
++	if (check_unlinks_later && fotg210->rh_state == FOTG210_RH_RUNNING &&
++			!(fotg210->enabled_hrtimer_events &
++			BIT(FOTG210_HRTIMER_ASYNC_UNLINKS))) {
++		fotg210_enable_event(fotg210,
++				FOTG210_HRTIMER_ASYNC_UNLINKS, true);
++		++fotg210->async_unlink_cycle;
++	}
++}
++/* EHCI scheduled transaction support:  interrupt, iso, split iso
++ * These are called "periodic" transactions in the EHCI spec.
++ *
++ * Note that for interrupt transfers, the QH/QTD manipulation is shared
++ * with the "asynchronous" transaction support (control/bulk transfers).
++ * The only real difference is in how interrupt transfers are scheduled.
++ *
++ * For ISO, we make an "iso_stream" head to serve the same role as a QH.
++ * It keeps track of every ITD (or SITD) that's linked, and holds enough
++ * pre-calculated schedule data to make appending to the queue be quick.
++ */
++static int fotg210_get_frame(struct usb_hcd *hcd);
++
++/* periodic_next_shadow - return "next" pointer on shadow list
++ * @periodic: host pointer to qh/itd
++ * @tag: hardware tag for type of this record
++ */
++static union fotg210_shadow *periodic_next_shadow(struct fotg210_hcd *fotg210,
++		union fotg210_shadow *periodic, __hc32 tag)
++{
++	switch (hc32_to_cpu(fotg210, tag)) {
++	case Q_TYPE_QH:
++		return &periodic->qh->qh_next;
++	case Q_TYPE_FSTN:
++		return &periodic->fstn->fstn_next;
++	default:
++		return &periodic->itd->itd_next;
++	}
++}
++
++static __hc32 *shadow_next_periodic(struct fotg210_hcd *fotg210,
++		union fotg210_shadow *periodic, __hc32 tag)
++{
++	switch (hc32_to_cpu(fotg210, tag)) {
++	/* our fotg210_shadow.qh is actually software part */
++	case Q_TYPE_QH:
++		return &periodic->qh->hw->hw_next;
++	/* others are hw parts */
++	default:
++		return periodic->hw_next;
++	}
++}
++
++/* caller must hold fotg210->lock */
++static void periodic_unlink(struct fotg210_hcd *fotg210, unsigned frame,
++		void *ptr)
++{
++	union fotg210_shadow *prev_p = &fotg210->pshadow[frame];
++	__hc32 *hw_p = &fotg210->periodic[frame];
++	union fotg210_shadow here = *prev_p;
++
++	/* find predecessor of "ptr"; hw and shadow lists are in sync */
++	while (here.ptr && here.ptr != ptr) {
++		prev_p = periodic_next_shadow(fotg210, prev_p,
++				Q_NEXT_TYPE(fotg210, *hw_p));
++		hw_p = shadow_next_periodic(fotg210, &here,
++				Q_NEXT_TYPE(fotg210, *hw_p));
++		here = *prev_p;
++	}
++	/* an interrupt entry (at list end) could have been shared */
++	if (!here.ptr)
++		return;
++
++	/* update shadow and hardware lists ... the old "next" pointers
++	 * from ptr may still be in use, the caller updates them.
++	 */
++	*prev_p = *periodic_next_shadow(fotg210, &here,
++			Q_NEXT_TYPE(fotg210, *hw_p));
++
++	*hw_p = *shadow_next_periodic(fotg210, &here,
++			Q_NEXT_TYPE(fotg210, *hw_p));
++}
++
++/* how many of the uframe's 125 usecs are allocated? */
++static unsigned short periodic_usecs(struct fotg210_hcd *fotg210,
++		unsigned frame, unsigned uframe)
++{
++	__hc32 *hw_p = &fotg210->periodic[frame];
++	union fotg210_shadow *q = &fotg210->pshadow[frame];
++	unsigned usecs = 0;
++	struct fotg210_qh_hw *hw;
++
++	while (q->ptr) {
++		switch (hc32_to_cpu(fotg210, Q_NEXT_TYPE(fotg210, *hw_p))) {
++		case Q_TYPE_QH:
++			hw = q->qh->hw;
++			/* is it in the S-mask? */
++			if (hw->hw_info2 & cpu_to_hc32(fotg210, 1 << uframe))
++				usecs += q->qh->usecs;
++			/* ... or C-mask? */
++			if (hw->hw_info2 & cpu_to_hc32(fotg210,
++					1 << (8 + uframe)))
++				usecs += q->qh->c_usecs;
++			hw_p = &hw->hw_next;
++			q = &q->qh->qh_next;
++			break;
++		/* case Q_TYPE_FSTN: */
++		default:
++			/* for "save place" FSTNs, count the relevant INTR
++			 * bandwidth from the previous frame
++			 */
++			if (q->fstn->hw_prev != FOTG210_LIST_END(fotg210))
++				fotg210_dbg(fotg210, "ignoring FSTN cost ...\n");
++
++			hw_p = &q->fstn->hw_next;
++			q = &q->fstn->fstn_next;
++			break;
++		case Q_TYPE_ITD:
++			if (q->itd->hw_transaction[uframe])
++				usecs += q->itd->stream->usecs;
++			hw_p = &q->itd->hw_next;
++			q = &q->itd->itd_next;
++			break;
++		}
++	}
++	if (usecs > fotg210->uframe_periodic_max)
++		fotg210_err(fotg210, "uframe %d sched overrun: %d usecs\n",
++				frame * 8 + uframe, usecs);
++	return usecs;
++}
++
++static int same_tt(struct usb_device *dev1, struct usb_device *dev2)
++{
++	if (!dev1->tt || !dev2->tt)
++		return 0;
++	if (dev1->tt != dev2->tt)
++		return 0;
++	if (dev1->tt->multi)
++		return dev1->ttport == dev2->ttport;
++	else
++		return 1;
++}
++
++/* return true iff the device's transaction translator is available
++ * for a periodic transfer starting at the specified frame, using
++ * all the uframes in the mask.
++ */
++static int tt_no_collision(struct fotg210_hcd *fotg210, unsigned period,
++		struct usb_device *dev, unsigned frame, u32 uf_mask)
++{
++	if (period == 0)	/* error */
++		return 0;
++
++	/* note bandwidth wastage:  split never follows csplit
++	 * (different dev or endpoint) until the next uframe.
++	 * calling convention doesn't make that distinction.
++	 */
++	for (; frame < fotg210->periodic_size; frame += period) {
++		union fotg210_shadow here;
++		__hc32 type;
++		struct fotg210_qh_hw *hw;
++
++		here = fotg210->pshadow[frame];
++		type = Q_NEXT_TYPE(fotg210, fotg210->periodic[frame]);
++		while (here.ptr) {
++			switch (hc32_to_cpu(fotg210, type)) {
++			case Q_TYPE_ITD:
++				type = Q_NEXT_TYPE(fotg210, here.itd->hw_next);
++				here = here.itd->itd_next;
++				continue;
++			case Q_TYPE_QH:
++				hw = here.qh->hw;
++				if (same_tt(dev, here.qh->dev)) {
++					u32 mask;
++
++					mask = hc32_to_cpu(fotg210,
++							hw->hw_info2);
++					/* "knows" no gap is needed */
++					mask |= mask >> 8;
++					if (mask & uf_mask)
++						break;
++				}
++				type = Q_NEXT_TYPE(fotg210, hw->hw_next);
++				here = here.qh->qh_next;
++				continue;
++			/* case Q_TYPE_FSTN: */
++			default:
++				fotg210_dbg(fotg210,
++						"periodic frame %d bogus type %d\n",
++						frame, type);
++			}
++
++			/* collision or error */
++			return 0;
++		}
++	}
++
++	/* no collision */
++	return 1;
++}
++
++static void enable_periodic(struct fotg210_hcd *fotg210)
++{
++	if (fotg210->periodic_count++)
++		return;
++
++	/* Stop waiting to turn off the periodic schedule */
++	fotg210->enabled_hrtimer_events &=
++		~BIT(FOTG210_HRTIMER_DISABLE_PERIODIC);
++
++	/* Don't start the schedule until PSS is 0 */
++	fotg210_poll_PSS(fotg210);
++	turn_on_io_watchdog(fotg210);
++}
++
++static void disable_periodic(struct fotg210_hcd *fotg210)
++{
++	if (--fotg210->periodic_count)
++		return;
++
++	/* Don't turn off the schedule until PSS is 1 */
++	fotg210_poll_PSS(fotg210);
++}
++
++/* periodic schedule slots have iso tds (normal or split) first, then a
++ * sparse tree for active interrupt transfers.
++ *
++ * this just links in a qh; caller guarantees uframe masks are set right.
++ * no FSTN support (yet; fotg210 0.96+)
++ */
++static void qh_link_periodic(struct fotg210_hcd *fotg210, struct fotg210_qh *qh)
++{
++	unsigned i;
++	unsigned period = qh->period;
++
++	dev_dbg(&qh->dev->dev,
++			"link qh%d-%04x/%p start %d [%d/%d us]\n", period,
++			hc32_to_cpup(fotg210, &qh->hw->hw_info2) &
++			(QH_CMASK | QH_SMASK), qh, qh->start, qh->usecs,
++			qh->c_usecs);
++
++	/* high bandwidth, or otherwise every microframe */
++	if (period == 0)
++		period = 1;
++
++	for (i = qh->start; i < fotg210->periodic_size; i += period) {
++		union fotg210_shadow *prev = &fotg210->pshadow[i];
++		__hc32 *hw_p = &fotg210->periodic[i];
++		union fotg210_shadow here = *prev;
++		__hc32 type = 0;
++
++		/* skip the iso nodes at list head */
++		while (here.ptr) {
++			type = Q_NEXT_TYPE(fotg210, *hw_p);
++			if (type == cpu_to_hc32(fotg210, Q_TYPE_QH))
++				break;
++			prev = periodic_next_shadow(fotg210, prev, type);
++			hw_p = shadow_next_periodic(fotg210, &here, type);
++			here = *prev;
++		}
++
++		/* sorting each branch by period (slow-->fast)
++		 * enables sharing interior tree nodes
++		 */
++		while (here.ptr && qh != here.qh) {
++			if (qh->period > here.qh->period)
++				break;
++			prev = &here.qh->qh_next;
++			hw_p = &here.qh->hw->hw_next;
++			here = *prev;
++		}
++		/* link in this qh, unless some earlier pass did that */
++		if (qh != here.qh) {
++			qh->qh_next = here;
++			if (here.qh)
++				qh->hw->hw_next = *hw_p;
++			wmb();
++			prev->qh = qh;
++			*hw_p = QH_NEXT(fotg210, qh->qh_dma);
++		}
++	}
++	qh->qh_state = QH_STATE_LINKED;
++	qh->xacterrs = 0;
++
++	/* update per-qh bandwidth for usbfs */
++	fotg210_to_hcd(fotg210)->self.bandwidth_allocated += qh->period
++		? ((qh->usecs + qh->c_usecs) / qh->period)
++		: (qh->usecs * 8);
++
++	list_add(&qh->intr_node, &fotg210->intr_qh_list);
++
++	/* maybe enable periodic schedule processing */
++	++fotg210->intr_count;
++	enable_periodic(fotg210);
++}
++
++static void qh_unlink_periodic(struct fotg210_hcd *fotg210,
++		struct fotg210_qh *qh)
++{
++	unsigned i;
++	unsigned period;
++
++	/*
++	 * If qh is for a low/full-speed device, simply unlinking it
++	 * could interfere with an ongoing split transaction.  To unlink
++	 * it safely would require setting the QH_INACTIVATE bit and
++	 * waiting at least one frame, as described in EHCI 4.12.2.5.
++	 *
++	 * We won't bother with any of this.  Instead, we assume that the
++	 * only reason for unlinking an interrupt QH while the current URB
++	 * is still active is to dequeue all the URBs (flush the whole
++	 * endpoint queue).
++	 *
++	 * If rebalancing the periodic schedule is ever implemented, this
++	 * approach will no longer be valid.
++	 */
++
++	/* high bandwidth, or otherwise part of every microframe */
++	period = qh->period;
++	if (!period)
++		period = 1;
++
++	for (i = qh->start; i < fotg210->periodic_size; i += period)
++		periodic_unlink(fotg210, i, qh);
++
++	/* update per-qh bandwidth for usbfs */
++	fotg210_to_hcd(fotg210)->self.bandwidth_allocated -= qh->period
++		? ((qh->usecs + qh->c_usecs) / qh->period)
++		: (qh->usecs * 8);
++
++	dev_dbg(&qh->dev->dev,
++			"unlink qh%d-%04x/%p start %d [%d/%d us]\n",
++			qh->period, hc32_to_cpup(fotg210, &qh->hw->hw_info2) &
++			(QH_CMASK | QH_SMASK), qh, qh->start, qh->usecs,
++			qh->c_usecs);
++
++	/* qh->qh_next still "live" to HC */
++	qh->qh_state = QH_STATE_UNLINK;
++	qh->qh_next.ptr = NULL;
++
++	if (fotg210->qh_scan_next == qh)
++		fotg210->qh_scan_next = list_entry(qh->intr_node.next,
++				struct fotg210_qh, intr_node);
++	list_del(&qh->intr_node);
++}
++
++static void start_unlink_intr(struct fotg210_hcd *fotg210,
++		struct fotg210_qh *qh)
++{
++	/* If the QH isn't linked then there's nothing we can do
++	 * unless we were called during a giveback, in which case
++	 * qh_completions() has to deal with it.
++	 */
++	if (qh->qh_state != QH_STATE_LINKED) {
++		if (qh->qh_state == QH_STATE_COMPLETING)
++			qh->needs_rescan = 1;
++		return;
++	}
++
++	qh_unlink_periodic(fotg210, qh);
++
++	/* Make sure the unlinks are visible before starting the timer */
++	wmb();
++
++	/*
++	 * The EHCI spec doesn't say how long it takes the controller to
++	 * stop accessing an unlinked interrupt QH.  The timer delay is
++	 * 9 uframes; presumably that will be long enough.
++	 */
++	qh->unlink_cycle = fotg210->intr_unlink_cycle;
++
++	/* New entries go at the end of the intr_unlink list */
++	if (fotg210->intr_unlink)
++		fotg210->intr_unlink_last->unlink_next = qh;
++	else
++		fotg210->intr_unlink = qh;
++	fotg210->intr_unlink_last = qh;
++
++	if (fotg210->intr_unlinking)
++		;	/* Avoid recursive calls */
++	else if (fotg210->rh_state < FOTG210_RH_RUNNING)
++		fotg210_handle_intr_unlinks(fotg210);
++	else if (fotg210->intr_unlink == qh) {
++		fotg210_enable_event(fotg210, FOTG210_HRTIMER_UNLINK_INTR,
++				true);
++		++fotg210->intr_unlink_cycle;
++	}
++}
++
++static void end_unlink_intr(struct fotg210_hcd *fotg210, struct fotg210_qh *qh)
++{
++	struct fotg210_qh_hw *hw = qh->hw;
++	int rc;
++
++	qh->qh_state = QH_STATE_IDLE;
++	hw->hw_next = FOTG210_LIST_END(fotg210);
++
++	qh_completions(fotg210, qh);
++
++	/* reschedule QH iff another request is queued */
++	if (!list_empty(&qh->qtd_list) &&
++			fotg210->rh_state == FOTG210_RH_RUNNING) {
++		rc = qh_schedule(fotg210, qh);
++
++		/* An error here likely indicates handshake failure
++		 * or no space left in the schedule.  Neither fault
++		 * should happen often ...
++		 *
++		 * FIXME kill the now-dysfunctional queued urbs
++		 */
++		if (rc != 0)
++			fotg210_err(fotg210, "can't reschedule qh %p, err %d\n",
++					qh, rc);
++	}
++
++	/* maybe turn off periodic schedule */
++	--fotg210->intr_count;
++	disable_periodic(fotg210);
++}
++
++static int check_period(struct fotg210_hcd *fotg210, unsigned frame,
++		unsigned uframe, unsigned period, unsigned usecs)
++{
++	int claimed;
++
++	/* complete split running into next frame?
++	 * given FSTN support, we could sometimes check...
++	 */
++	if (uframe >= 8)
++		return 0;
++
++	/* convert "usecs we need" to "max already claimed" */
++	usecs = fotg210->uframe_periodic_max - usecs;
++
++	/* we "know" 2 and 4 uframe intervals were rejected; so
++	 * for period 0, check _every_ microframe in the schedule.
++	 */
++	if (unlikely(period == 0)) {
++		do {
++			for (uframe = 0; uframe < 7; uframe++) {
++				claimed = periodic_usecs(fotg210, frame,
++						uframe);
++				if (claimed > usecs)
++					return 0;
++			}
++		} while ((frame += 1) < fotg210->periodic_size);
++
++	/* just check the specified uframe, at that period */
++	} else {
++		do {
++			claimed = periodic_usecs(fotg210, frame, uframe);
++			if (claimed > usecs)
++				return 0;
++		} while ((frame += period) < fotg210->periodic_size);
++	}
++
++	/* success! */
++	return 1;
++}
++
++static int check_intr_schedule(struct fotg210_hcd *fotg210, unsigned frame,
++		unsigned uframe, const struct fotg210_qh *qh, __hc32 *c_maskp)
++{
++	int retval = -ENOSPC;
++	u8 mask = 0;
++
++	if (qh->c_usecs && uframe >= 6)		/* FSTN territory? */
++		goto done;
++
++	if (!check_period(fotg210, frame, uframe, qh->period, qh->usecs))
++		goto done;
++	if (!qh->c_usecs) {
++		retval = 0;
++		*c_maskp = 0;
++		goto done;
++	}
++
++	/* Make sure this tt's buffer is also available for CSPLITs.
++	 * We pessimize a bit; probably the typical full speed case
++	 * doesn't need the second CSPLIT.
++	 *
++	 * NOTE:  both SPLIT and CSPLIT could be checked in just
++	 * one smart pass...
++	 */
++	mask = 0x03 << (uframe + qh->gap_uf);
++	*c_maskp = cpu_to_hc32(fotg210, mask << 8);
++
++	mask |= 1 << uframe;
++	if (tt_no_collision(fotg210, qh->period, qh->dev, frame, mask)) {
++		if (!check_period(fotg210, frame, uframe + qh->gap_uf + 1,
++				qh->period, qh->c_usecs))
++			goto done;
++		if (!check_period(fotg210, frame, uframe + qh->gap_uf,
++				qh->period, qh->c_usecs))
++			goto done;
++		retval = 0;
++	}
++done:
++	return retval;
++}
++
++/* "first fit" scheduling policy used the first time through,
++ * or when the previous schedule slot can't be re-used.
++ */
++static int qh_schedule(struct fotg210_hcd *fotg210, struct fotg210_qh *qh)
++{
++	int status;
++	unsigned uframe;
++	__hc32 c_mask;
++	unsigned frame;	/* 0..(qh->period - 1), or NO_FRAME */
++	struct fotg210_qh_hw *hw = qh->hw;
++
++	qh_refresh(fotg210, qh);
++	hw->hw_next = FOTG210_LIST_END(fotg210);
++	frame = qh->start;
++
++	/* reuse the previous schedule slots, if we can */
++	if (frame < qh->period) {
++		uframe = ffs(hc32_to_cpup(fotg210, &hw->hw_info2) & QH_SMASK);
++		status = check_intr_schedule(fotg210, frame, --uframe,
++				qh, &c_mask);
++	} else {
++		uframe = 0;
++		c_mask = 0;
++		status = -ENOSPC;
++	}
++
++	/* else scan the schedule to find a group of slots such that all
++	 * uframes have enough periodic bandwidth available.
++	 */
++	if (status) {
++		/* "normal" case, uframing flexible except with splits */
++		if (qh->period) {
++			int i;
++
++			for (i = qh->period; status && i > 0; --i) {
++				frame = ++fotg210->random_frame % qh->period;
++				for (uframe = 0; uframe < 8; uframe++) {
++					status = check_intr_schedule(fotg210,
++							frame, uframe, qh,
++							&c_mask);
++					if (status == 0)
++						break;
++				}
++			}
++
++		/* qh->period == 0 means every uframe */
++		} else {
++			frame = 0;
++			status = check_intr_schedule(fotg210, 0, 0, qh,
++					&c_mask);
++		}
++		if (status)
++			goto done;
++		qh->start = frame;
++
++		/* reset S-frame and (maybe) C-frame masks */
++		hw->hw_info2 &= cpu_to_hc32(fotg210, ~(QH_CMASK | QH_SMASK));
++		hw->hw_info2 |= qh->period
++			? cpu_to_hc32(fotg210, 1 << uframe)
++			: cpu_to_hc32(fotg210, QH_SMASK);
++		hw->hw_info2 |= c_mask;
++	} else
++		fotg210_dbg(fotg210, "reused qh %p schedule\n", qh);
++
++	/* stuff into the periodic schedule */
++	qh_link_periodic(fotg210, qh);
++done:
++	return status;
++}
++
++static int intr_submit(struct fotg210_hcd *fotg210, struct urb *urb,
++		struct list_head *qtd_list, gfp_t mem_flags)
++{
++	unsigned epnum;
++	unsigned long flags;
++	struct fotg210_qh *qh;
++	int status;
++	struct list_head empty;
++
++	/* get endpoint and transfer/schedule data */
++	epnum = urb->ep->desc.bEndpointAddress;
++
++	spin_lock_irqsave(&fotg210->lock, flags);
++
++	if (unlikely(!HCD_HW_ACCESSIBLE(fotg210_to_hcd(fotg210)))) {
++		status = -ESHUTDOWN;
++		goto done_not_linked;
++	}
++	status = usb_hcd_link_urb_to_ep(fotg210_to_hcd(fotg210), urb);
++	if (unlikely(status))
++		goto done_not_linked;
++
++	/* get qh and force any scheduling errors */
++	INIT_LIST_HEAD(&empty);
++	qh = qh_append_tds(fotg210, urb, &empty, epnum, &urb->ep->hcpriv);
++	if (qh == NULL) {
++		status = -ENOMEM;
++		goto done;
++	}
++	if (qh->qh_state == QH_STATE_IDLE) {
++		status = qh_schedule(fotg210, qh);
++		if (status)
++			goto done;
++	}
++
++	/* then queue the urb's tds to the qh */
++	qh = qh_append_tds(fotg210, urb, qtd_list, epnum, &urb->ep->hcpriv);
++	BUG_ON(qh == NULL);
++
++	/* ... update usbfs periodic stats */
++	fotg210_to_hcd(fotg210)->self.bandwidth_int_reqs++;
++
++done:
++	if (unlikely(status))
++		usb_hcd_unlink_urb_from_ep(fotg210_to_hcd(fotg210), urb);
++done_not_linked:
++	spin_unlock_irqrestore(&fotg210->lock, flags);
++	if (status)
++		qtd_list_free(fotg210, urb, qtd_list);
++
++	return status;
++}
++
++static void scan_intr(struct fotg210_hcd *fotg210)
++{
++	struct fotg210_qh *qh;
++
++	list_for_each_entry_safe(qh, fotg210->qh_scan_next,
++			&fotg210->intr_qh_list, intr_node) {
++rescan:
++		/* clean any finished work for this qh */
++		if (!list_empty(&qh->qtd_list)) {
++			int temp;
++
++			/*
++			 * Unlinks could happen here; completion reporting
++			 * drops the lock.  That's why fotg210->qh_scan_next
++			 * always holds the next qh to scan; if the next qh
++			 * gets unlinked then fotg210->qh_scan_next is adjusted
++			 * in qh_unlink_periodic().
++			 */
++			temp = qh_completions(fotg210, qh);
++			if (unlikely(qh->needs_rescan ||
++					(list_empty(&qh->qtd_list) &&
++					qh->qh_state == QH_STATE_LINKED)))
++				start_unlink_intr(fotg210, qh);
++			else if (temp != 0)
++				goto rescan;
++		}
++	}
++}
++
++/* fotg210_iso_stream ops work with both ITD and SITD */
++
++static struct fotg210_iso_stream *iso_stream_alloc(gfp_t mem_flags)
++{
++	struct fotg210_iso_stream *stream;
++
++	stream = kzalloc(sizeof(*stream), mem_flags);
++	if (likely(stream != NULL)) {
++		INIT_LIST_HEAD(&stream->td_list);
++		INIT_LIST_HEAD(&stream->free_list);
++		stream->next_uframe = -1;
++	}
++	return stream;
++}
++
++static void iso_stream_init(struct fotg210_hcd *fotg210,
++		struct fotg210_iso_stream *stream, struct usb_device *dev,
++		int pipe, unsigned interval)
++{
++	u32 buf1;
++	unsigned epnum, maxp;
++	int is_input;
++	long bandwidth;
++	unsigned multi;
++	struct usb_host_endpoint *ep;
++
++	/*
++	 * this might be a "high bandwidth" highspeed endpoint,
++	 * as encoded in the ep descriptor's wMaxPacket field
++	 */
++	epnum = usb_pipeendpoint(pipe);
++	is_input = usb_pipein(pipe) ? USB_DIR_IN : 0;
++	ep = usb_pipe_endpoint(dev, pipe);
++	maxp = usb_endpoint_maxp(&ep->desc);
++	if (is_input)
++		buf1 = (1 << 11);
++	else
++		buf1 = 0;
++
++	multi = usb_endpoint_maxp_mult(&ep->desc);
++	buf1 |= maxp;
++	maxp *= multi;
++
++	stream->buf0 = cpu_to_hc32(fotg210, (epnum << 8) | dev->devnum);
++	stream->buf1 = cpu_to_hc32(fotg210, buf1);
++	stream->buf2 = cpu_to_hc32(fotg210, multi);
++
++	/* usbfs wants to report the average usecs per frame tied up
++	 * when transfers on this endpoint are scheduled ...
++	 */
++	if (dev->speed == USB_SPEED_FULL) {
++		interval <<= 3;
++		stream->usecs = NS_TO_US(usb_calc_bus_time(dev->speed,
++				is_input, 1, maxp));
++		stream->usecs /= 8;
++	} else {
++		stream->highspeed = 1;
++		stream->usecs = HS_USECS_ISO(maxp);
++	}
++	bandwidth = stream->usecs * 8;
++	bandwidth /= interval;
++
++	stream->bandwidth = bandwidth;
++	stream->udev = dev;
++	stream->bEndpointAddress = is_input | epnum;
++	stream->interval = interval;
++	stream->maxp = maxp;
++}
++
++static struct fotg210_iso_stream *iso_stream_find(struct fotg210_hcd *fotg210,
++		struct urb *urb)
++{
++	unsigned epnum;
++	struct fotg210_iso_stream *stream;
++	struct usb_host_endpoint *ep;
++	unsigned long flags;
++
++	epnum = usb_pipeendpoint(urb->pipe);
++	if (usb_pipein(urb->pipe))
++		ep = urb->dev->ep_in[epnum];
++	else
++		ep = urb->dev->ep_out[epnum];
++
++	spin_lock_irqsave(&fotg210->lock, flags);
++	stream = ep->hcpriv;
++
++	if (unlikely(stream == NULL)) {
++		stream = iso_stream_alloc(GFP_ATOMIC);
++		if (likely(stream != NULL)) {
++			ep->hcpriv = stream;
++			stream->ep = ep;
++			iso_stream_init(fotg210, stream, urb->dev, urb->pipe,
++					urb->interval);
++		}
++
++	/* if dev->ep[epnum] is a QH, hw is set */
++	} else if (unlikely(stream->hw != NULL)) {
++		fotg210_dbg(fotg210, "dev %s ep%d%s, not iso??\n",
++				urb->dev->devpath, epnum,
++				usb_pipein(urb->pipe) ? "in" : "out");
++		stream = NULL;
++	}
++
++	spin_unlock_irqrestore(&fotg210->lock, flags);
++	return stream;
++}
++
++/* fotg210_iso_sched ops can be ITD-only or SITD-only */
++
++static struct fotg210_iso_sched *iso_sched_alloc(unsigned packets,
++		gfp_t mem_flags)
++{
++	struct fotg210_iso_sched *iso_sched;
++
++	iso_sched = kzalloc(struct_size(iso_sched, packet, packets), mem_flags);
++	if (likely(iso_sched != NULL))
++		INIT_LIST_HEAD(&iso_sched->td_list);
++
++	return iso_sched;
++}
++
++static inline void itd_sched_init(struct fotg210_hcd *fotg210,
++		struct fotg210_iso_sched *iso_sched,
++		struct fotg210_iso_stream *stream, struct urb *urb)
++{
++	unsigned i;
++	dma_addr_t dma = urb->transfer_dma;
++
++	/* how many uframes are needed for these transfers */
++	iso_sched->span = urb->number_of_packets * stream->interval;
++
++	/* figure out per-uframe itd fields that we'll need later
++	 * when we fit new itds into the schedule.
++	 */
++	for (i = 0; i < urb->number_of_packets; i++) {
++		struct fotg210_iso_packet *uframe = &iso_sched->packet[i];
++		unsigned length;
++		dma_addr_t buf;
++		u32 trans;
++
++		length = urb->iso_frame_desc[i].length;
++		buf = dma + urb->iso_frame_desc[i].offset;
++
++		trans = FOTG210_ISOC_ACTIVE;
++		trans |= buf & 0x0fff;
++		if (unlikely(((i + 1) == urb->number_of_packets))
++				&& !(urb->transfer_flags & URB_NO_INTERRUPT))
++			trans |= FOTG210_ITD_IOC;
++		trans |= length << 16;
++		uframe->transaction = cpu_to_hc32(fotg210, trans);
++
++		/* might need to cross a buffer page within a uframe */
++		uframe->bufp = (buf & ~(u64)0x0fff);
++		buf += length;
++		if (unlikely((uframe->bufp != (buf & ~(u64)0x0fff))))
++			uframe->cross = 1;
++	}
++}
++
++static void iso_sched_free(struct fotg210_iso_stream *stream,
++		struct fotg210_iso_sched *iso_sched)
++{
++	if (!iso_sched)
++		return;
++	/* caller must hold fotg210->lock!*/
++	list_splice(&iso_sched->td_list, &stream->free_list);
++	kfree(iso_sched);
++}
++
++static int itd_urb_transaction(struct fotg210_iso_stream *stream,
++		struct fotg210_hcd *fotg210, struct urb *urb, gfp_t mem_flags)
++{
++	struct fotg210_itd *itd;
++	dma_addr_t itd_dma;
++	int i;
++	unsigned num_itds;
++	struct fotg210_iso_sched *sched;
++	unsigned long flags;
++
++	sched = iso_sched_alloc(urb->number_of_packets, mem_flags);
++	if (unlikely(sched == NULL))
++		return -ENOMEM;
++
++	itd_sched_init(fotg210, sched, stream, urb);
++
++	if (urb->interval < 8)
++		num_itds = 1 + (sched->span + 7) / 8;
++	else
++		num_itds = urb->number_of_packets;
++
++	/* allocate/init ITDs */
++	spin_lock_irqsave(&fotg210->lock, flags);
++	for (i = 0; i < num_itds; i++) {
++
++		/*
++		 * Use iTDs from the free list, but not iTDs that may
++		 * still be in use by the hardware.
++		 */
++		if (likely(!list_empty(&stream->free_list))) {
++			itd = list_first_entry(&stream->free_list,
++					struct fotg210_itd, itd_list);
++			if (itd->frame == fotg210->now_frame)
++				goto alloc_itd;
++			list_del(&itd->itd_list);
++			itd_dma = itd->itd_dma;
++		} else {
++alloc_itd:
++			spin_unlock_irqrestore(&fotg210->lock, flags);
++			itd = dma_pool_alloc(fotg210->itd_pool, mem_flags,
++					&itd_dma);
++			spin_lock_irqsave(&fotg210->lock, flags);
++			if (!itd) {
++				iso_sched_free(stream, sched);
++				spin_unlock_irqrestore(&fotg210->lock, flags);
++				return -ENOMEM;
++			}
++		}
++
++		memset(itd, 0, sizeof(*itd));
++		itd->itd_dma = itd_dma;
++		list_add(&itd->itd_list, &sched->td_list);
++	}
++	spin_unlock_irqrestore(&fotg210->lock, flags);
++
++	/* temporarily store schedule info in hcpriv */
++	urb->hcpriv = sched;
++	urb->error_count = 0;
++	return 0;
++}
++
++static inline int itd_slot_ok(struct fotg210_hcd *fotg210, u32 mod, u32 uframe,
++		u8 usecs, u32 period)
++{
++	uframe %= period;
++	do {
++		/* can't commit more than uframe_periodic_max usec */
++		if (periodic_usecs(fotg210, uframe >> 3, uframe & 0x7)
++				> (fotg210->uframe_periodic_max - usecs))
++			return 0;
++
++		/* we know urb->interval is 2^N uframes */
++		uframe += period;
++	} while (uframe < mod);
++	return 1;
++}
++
++/* This scheduler plans almost as far into the future as it has actual
++ * periodic schedule slots.  (Affected by TUNE_FLS, which defaults to
++ * "as small as possible" to be cache-friendlier.)  That limits the size
++ * transfers you can stream reliably; avoid more than 64 msec per urb.
++ * Also avoid queue depths of less than fotg210's worst irq latency (affected
++ * by the per-urb URB_NO_INTERRUPT hint, the log2_irq_thresh module parameter,
++ * and other factors); or more than about 230 msec total (for portability,
++ * given FOTG210_TUNE_FLS and the slop).  Or, write a smarter scheduler!
++ */
++
++#define SCHEDULE_SLOP 80 /* microframes */
++
++static int iso_stream_schedule(struct fotg210_hcd *fotg210, struct urb *urb,
++		struct fotg210_iso_stream *stream)
++{
++	u32 now, next, start, period, span;
++	int status;
++	unsigned mod = fotg210->periodic_size << 3;
++	struct fotg210_iso_sched *sched = urb->hcpriv;
++
++	period = urb->interval;
++	span = sched->span;
++
++	if (span > mod - SCHEDULE_SLOP) {
++		fotg210_dbg(fotg210, "iso request %p too long\n", urb);
++		status = -EFBIG;
++		goto fail;
++	}
++
++	now = fotg210_read_frame_index(fotg210) & (mod - 1);
++
++	/* Typical case: reuse current schedule, stream is still active.
++	 * Hopefully there are no gaps from the host falling behind
++	 * (irq delays etc), but if there are we'll take the next
++	 * slot in the schedule, implicitly assuming URB_ISO_ASAP.
++	 */
++	if (likely(!list_empty(&stream->td_list))) {
++		u32 excess;
++
++		/* For high speed devices, allow scheduling within the
++		 * isochronous scheduling threshold.  For full speed devices
++		 * and Intel PCI-based controllers, don't (work around for
++		 * Intel ICH9 bug).
++		 */
++		if (!stream->highspeed && fotg210->fs_i_thresh)
++			next = now + fotg210->i_thresh;
++		else
++			next = now;
++
++		/* Fell behind (by up to twice the slop amount)?
++		 * We decide based on the time of the last currently-scheduled
++		 * slot, not the time of the next available slot.
++		 */
++		excess = (stream->next_uframe - period - next) & (mod - 1);
++		if (excess >= mod - 2 * SCHEDULE_SLOP)
++			start = next + excess - mod + period *
++					DIV_ROUND_UP(mod - excess, period);
++		else
++			start = next + excess + period;
++		if (start - now >= mod) {
++			fotg210_dbg(fotg210, "request %p would overflow (%d+%d >= %d)\n",
++					urb, start - now - period, period,
++					mod);
++			status = -EFBIG;
++			goto fail;
++		}
++	}
++
++	/* need to schedule; when's the next (u)frame we could start?
++	 * this is bigger than fotg210->i_thresh allows; scheduling itself
++	 * isn't free, the slop should handle reasonably slow cpus.  it
++	 * can also help high bandwidth if the dma and irq loads don't
++	 * jump until after the queue is primed.
++	 */
++	else {
++		int done = 0;
++
++		start = SCHEDULE_SLOP + (now & ~0x07);
++
++		/* NOTE:  assumes URB_ISO_ASAP, to limit complexity/bugs */
++
++		/* find a uframe slot with enough bandwidth.
++		 * Early uframes are more precious because full-speed
++		 * iso IN transfers can't use late uframes,
++		 * and therefore they should be allocated last.
++		 */
++		next = start;
++		start += period;
++		do {
++			start--;
++			/* check schedule: enough space? */
++			if (itd_slot_ok(fotg210, mod, start,
++					stream->usecs, period))
++				done = 1;
++		} while (start > next && !done);
++
++		/* no room in the schedule */
++		if (!done) {
++			fotg210_dbg(fotg210, "iso resched full %p (now %d max %d)\n",
++					urb, now, now + mod);
++			status = -ENOSPC;
++			goto fail;
++		}
++	}
++
++	/* Tried to schedule too far into the future? */
++	if (unlikely(start - now + span - period >=
++			mod - 2 * SCHEDULE_SLOP)) {
++		fotg210_dbg(fotg210, "request %p would overflow (%d+%d >= %d)\n",
++				urb, start - now, span - period,
++				mod - 2 * SCHEDULE_SLOP);
++		status = -EFBIG;
++		goto fail;
++	}
++
++	stream->next_uframe = start & (mod - 1);
++
++	/* report high speed start in uframes; full speed, in frames */
++	urb->start_frame = stream->next_uframe;
++	if (!stream->highspeed)
++		urb->start_frame >>= 3;
++
++	/* Make sure scan_isoc() sees these */
++	if (fotg210->isoc_count == 0)
++		fotg210->next_frame = now >> 3;
++	return 0;
++
++fail:
++	iso_sched_free(stream, sched);
++	urb->hcpriv = NULL;
++	return status;
++}
++
++static inline void itd_init(struct fotg210_hcd *fotg210,
++		struct fotg210_iso_stream *stream, struct fotg210_itd *itd)
++{
++	int i;
++
++	/* it's been recently zeroed */
++	itd->hw_next = FOTG210_LIST_END(fotg210);
++	itd->hw_bufp[0] = stream->buf0;
++	itd->hw_bufp[1] = stream->buf1;
++	itd->hw_bufp[2] = stream->buf2;
++
++	for (i = 0; i < 8; i++)
++		itd->index[i] = -1;
++
++	/* All other fields are filled when scheduling */
++}
++
++static inline void itd_patch(struct fotg210_hcd *fotg210,
++		struct fotg210_itd *itd, struct fotg210_iso_sched *iso_sched,
++		unsigned index, u16 uframe)
++{
++	struct fotg210_iso_packet *uf = &iso_sched->packet[index];
++	unsigned pg = itd->pg;
++
++	uframe &= 0x07;
++	itd->index[uframe] = index;
++
++	itd->hw_transaction[uframe] = uf->transaction;
++	itd->hw_transaction[uframe] |= cpu_to_hc32(fotg210, pg << 12);
++	itd->hw_bufp[pg] |= cpu_to_hc32(fotg210, uf->bufp & ~(u32)0);
++	itd->hw_bufp_hi[pg] |= cpu_to_hc32(fotg210, (u32)(uf->bufp >> 32));
++
++	/* iso_frame_desc[].offset must be strictly increasing */
++	if (unlikely(uf->cross)) {
++		u64 bufp = uf->bufp + 4096;
++
++		itd->pg = ++pg;
++		itd->hw_bufp[pg] |= cpu_to_hc32(fotg210, bufp & ~(u32)0);
++		itd->hw_bufp_hi[pg] |= cpu_to_hc32(fotg210, (u32)(bufp >> 32));
++	}
++}
++
++static inline void itd_link(struct fotg210_hcd *fotg210, unsigned frame,
++		struct fotg210_itd *itd)
++{
++	union fotg210_shadow *prev = &fotg210->pshadow[frame];
++	__hc32 *hw_p = &fotg210->periodic[frame];
++	union fotg210_shadow here = *prev;
++	__hc32 type = 0;
++
++	/* skip any iso nodes which might belong to previous microframes */
++	while (here.ptr) {
++		type = Q_NEXT_TYPE(fotg210, *hw_p);
++		if (type == cpu_to_hc32(fotg210, Q_TYPE_QH))
++			break;
++		prev = periodic_next_shadow(fotg210, prev, type);
++		hw_p = shadow_next_periodic(fotg210, &here, type);
++		here = *prev;
++	}
++
++	itd->itd_next = here;
++	itd->hw_next = *hw_p;
++	prev->itd = itd;
++	itd->frame = frame;
++	wmb();
++	*hw_p = cpu_to_hc32(fotg210, itd->itd_dma | Q_TYPE_ITD);
++}
++
++/* fit urb's itds into the selected schedule slot; activate as needed */
++static void itd_link_urb(struct fotg210_hcd *fotg210, struct urb *urb,
++		unsigned mod, struct fotg210_iso_stream *stream)
++{
++	int packet;
++	unsigned next_uframe, uframe, frame;
++	struct fotg210_iso_sched *iso_sched = urb->hcpriv;
++	struct fotg210_itd *itd;
++
++	next_uframe = stream->next_uframe & (mod - 1);
++
++	if (unlikely(list_empty(&stream->td_list))) {
++		fotg210_to_hcd(fotg210)->self.bandwidth_allocated
++				+= stream->bandwidth;
++		fotg210_dbg(fotg210,
++			"schedule devp %s ep%d%s-iso period %d start %d.%d\n",
++			urb->dev->devpath, stream->bEndpointAddress & 0x0f,
++			(stream->bEndpointAddress & USB_DIR_IN) ? "in" : "out",
++			urb->interval,
++			next_uframe >> 3, next_uframe & 0x7);
++	}
++
++	/* fill iTDs uframe by uframe */
++	for (packet = 0, itd = NULL; packet < urb->number_of_packets;) {
++		if (itd == NULL) {
++			/* ASSERT:  we have all necessary itds */
++
++			/* ASSERT:  no itds for this endpoint in this uframe */
++
++			itd = list_entry(iso_sched->td_list.next,
++					struct fotg210_itd, itd_list);
++			list_move_tail(&itd->itd_list, &stream->td_list);
++			itd->stream = stream;
++			itd->urb = urb;
++			itd_init(fotg210, stream, itd);
++		}
++
++		uframe = next_uframe & 0x07;
++		frame = next_uframe >> 3;
++
++		itd_patch(fotg210, itd, iso_sched, packet, uframe);
++
++		next_uframe += stream->interval;
++		next_uframe &= mod - 1;
++		packet++;
++
++		/* link completed itds into the schedule */
++		if (((next_uframe >> 3) != frame)
++				|| packet == urb->number_of_packets) {
++			itd_link(fotg210, frame & (fotg210->periodic_size - 1),
++					itd);
++			itd = NULL;
++		}
++	}
++	stream->next_uframe = next_uframe;
++
++	/* don't need that schedule data any more */
++	iso_sched_free(stream, iso_sched);
++	urb->hcpriv = NULL;
++
++	++fotg210->isoc_count;
++	enable_periodic(fotg210);
++}
++
++#define ISO_ERRS (FOTG210_ISOC_BUF_ERR | FOTG210_ISOC_BABBLE |\
++		FOTG210_ISOC_XACTERR)
++
++/* Process and recycle a completed ITD.  Return true iff its urb completed,
++ * and hence its completion callback probably added things to the hardware
++ * schedule.
++ *
++ * Note that we carefully avoid recycling this descriptor until after any
++ * completion callback runs, so that it won't be reused quickly.  That is,
++ * assuming (a) no more than two urbs per frame on this endpoint, and also
++ * (b) only this endpoint's completions submit URBs.  It seems some silicon
++ * corrupts things if you reuse completed descriptors very quickly...
++ */
++static bool itd_complete(struct fotg210_hcd *fotg210, struct fotg210_itd *itd)
++{
++	struct urb *urb = itd->urb;
++	struct usb_iso_packet_descriptor *desc;
++	u32 t;
++	unsigned uframe;
++	int urb_index = -1;
++	struct fotg210_iso_stream *stream = itd->stream;
++	struct usb_device *dev;
++	bool retval = false;
++
++	/* for each uframe with a packet */
++	for (uframe = 0; uframe < 8; uframe++) {
++		if (likely(itd->index[uframe] == -1))
++			continue;
++		urb_index = itd->index[uframe];
++		desc = &urb->iso_frame_desc[urb_index];
++
++		t = hc32_to_cpup(fotg210, &itd->hw_transaction[uframe]);
++		itd->hw_transaction[uframe] = 0;
++
++		/* report transfer status */
++		if (unlikely(t & ISO_ERRS)) {
++			urb->error_count++;
++			if (t & FOTG210_ISOC_BUF_ERR)
++				desc->status = usb_pipein(urb->pipe)
++					? -ENOSR  /* hc couldn't read */
++					: -ECOMM; /* hc couldn't write */
++			else if (t & FOTG210_ISOC_BABBLE)
++				desc->status = -EOVERFLOW;
++			else /* (t & FOTG210_ISOC_XACTERR) */
++				desc->status = -EPROTO;
++
++			/* HC need not update length with this error */
++			if (!(t & FOTG210_ISOC_BABBLE)) {
++				desc->actual_length = FOTG210_ITD_LENGTH(t);
++				urb->actual_length += desc->actual_length;
++			}
++		} else if (likely((t & FOTG210_ISOC_ACTIVE) == 0)) {
++			desc->status = 0;
++			desc->actual_length = FOTG210_ITD_LENGTH(t);
++			urb->actual_length += desc->actual_length;
++		} else {
++			/* URB was too late */
++			desc->status = -EXDEV;
++		}
++	}
++
++	/* handle completion now? */
++	if (likely((urb_index + 1) != urb->number_of_packets))
++		goto done;
++
++	/* ASSERT: it's really the last itd for this urb
++	 * list_for_each_entry (itd, &stream->td_list, itd_list)
++	 *	BUG_ON (itd->urb == urb);
++	 */
++
++	/* give urb back to the driver; completion often (re)submits */
++	dev = urb->dev;
++	fotg210_urb_done(fotg210, urb, 0);
++	retval = true;
++	urb = NULL;
++
++	--fotg210->isoc_count;
++	disable_periodic(fotg210);
++
++	if (unlikely(list_is_singular(&stream->td_list))) {
++		fotg210_to_hcd(fotg210)->self.bandwidth_allocated
++				-= stream->bandwidth;
++		fotg210_dbg(fotg210,
++			"deschedule devp %s ep%d%s-iso\n",
++			dev->devpath, stream->bEndpointAddress & 0x0f,
++			(stream->bEndpointAddress & USB_DIR_IN) ? "in" : "out");
++	}
++
++done:
++	itd->urb = NULL;
++
++	/* Add to the end of the free list for later reuse */
++	list_move_tail(&itd->itd_list, &stream->free_list);
++
++	/* Recycle the iTDs when the pipeline is empty (ep no longer in use) */
++	if (list_empty(&stream->td_list)) {
++		list_splice_tail_init(&stream->free_list,
++				&fotg210->cached_itd_list);
++		start_free_itds(fotg210);
++	}
++
++	return retval;
++}
++
++static int itd_submit(struct fotg210_hcd *fotg210, struct urb *urb,
++		gfp_t mem_flags)
++{
++	int status = -EINVAL;
++	unsigned long flags;
++	struct fotg210_iso_stream *stream;
++
++	/* Get iso_stream head */
++	stream = iso_stream_find(fotg210, urb);
++	if (unlikely(stream == NULL)) {
++		fotg210_dbg(fotg210, "can't get iso stream\n");
++		return -ENOMEM;
++	}
++	if (unlikely(urb->interval != stream->interval &&
++			fotg210_port_speed(fotg210, 0) ==
++			USB_PORT_STAT_HIGH_SPEED)) {
++		fotg210_dbg(fotg210, "can't change iso interval %d --> %d\n",
++				stream->interval, urb->interval);
++		goto done;
++	}
++
++#ifdef FOTG210_URB_TRACE
++	fotg210_dbg(fotg210,
++			"%s %s urb %p ep%d%s len %d, %d pkts %d uframes[%p]\n",
++			__func__, urb->dev->devpath, urb,
++			usb_pipeendpoint(urb->pipe),
++			usb_pipein(urb->pipe) ? "in" : "out",
++			urb->transfer_buffer_length,
++			urb->number_of_packets, urb->interval,
++			stream);
++#endif
++
++	/* allocate ITDs w/o locking anything */
++	status = itd_urb_transaction(stream, fotg210, urb, mem_flags);
++	if (unlikely(status < 0)) {
++		fotg210_dbg(fotg210, "can't init itds\n");
++		goto done;
++	}
++
++	/* schedule ... need to lock */
++	spin_lock_irqsave(&fotg210->lock, flags);
++	if (unlikely(!HCD_HW_ACCESSIBLE(fotg210_to_hcd(fotg210)))) {
++		status = -ESHUTDOWN;
++		goto done_not_linked;
++	}
++	status = usb_hcd_link_urb_to_ep(fotg210_to_hcd(fotg210), urb);
++	if (unlikely(status))
++		goto done_not_linked;
++	status = iso_stream_schedule(fotg210, urb, stream);
++	if (likely(status == 0))
++		itd_link_urb(fotg210, urb, fotg210->periodic_size << 3, stream);
++	else
++		usb_hcd_unlink_urb_from_ep(fotg210_to_hcd(fotg210), urb);
++done_not_linked:
++	spin_unlock_irqrestore(&fotg210->lock, flags);
++done:
++	return status;
++}
++
++static inline int scan_frame_queue(struct fotg210_hcd *fotg210, unsigned frame,
++		unsigned now_frame, bool live)
++{
++	unsigned uf;
++	bool modified;
++	union fotg210_shadow q, *q_p;
++	__hc32 type, *hw_p;
++
++	/* scan each element in frame's queue for completions */
++	q_p = &fotg210->pshadow[frame];
++	hw_p = &fotg210->periodic[frame];
++	q.ptr = q_p->ptr;
++	type = Q_NEXT_TYPE(fotg210, *hw_p);
++	modified = false;
++
++	while (q.ptr) {
++		switch (hc32_to_cpu(fotg210, type)) {
++		case Q_TYPE_ITD:
++			/* If this ITD is still active, leave it for
++			 * later processing ... check the next entry.
++			 * No need to check for activity unless the
++			 * frame is current.
++			 */
++			if (frame == now_frame && live) {
++				rmb();
++				for (uf = 0; uf < 8; uf++) {
++					if (q.itd->hw_transaction[uf] &
++							ITD_ACTIVE(fotg210))
++						break;
++				}
++				if (uf < 8) {
++					q_p = &q.itd->itd_next;
++					hw_p = &q.itd->hw_next;
++					type = Q_NEXT_TYPE(fotg210,
++							q.itd->hw_next);
++					q = *q_p;
++					break;
++				}
++			}
++
++			/* Take finished ITDs out of the schedule
++			 * and process them:  recycle, maybe report
++			 * URB completion.  HC won't cache the
++			 * pointer for much longer, if at all.
++			 */
++			*q_p = q.itd->itd_next;
++			*hw_p = q.itd->hw_next;
++			type = Q_NEXT_TYPE(fotg210, q.itd->hw_next);
++			wmb();
++			modified = itd_complete(fotg210, q.itd);
++			q = *q_p;
++			break;
++		default:
++			fotg210_dbg(fotg210, "corrupt type %d frame %d shadow %p\n",
++					type, frame, q.ptr);
++			fallthrough;
++		case Q_TYPE_QH:
++		case Q_TYPE_FSTN:
++			/* End of the iTDs and siTDs */
++			q.ptr = NULL;
++			break;
++		}
++
++		/* assume completion callbacks modify the queue */
++		if (unlikely(modified && fotg210->isoc_count > 0))
++			return -EINVAL;
++	}
++	return 0;
++}
++
++static void scan_isoc(struct fotg210_hcd *fotg210)
++{
++	unsigned uf, now_frame, frame, ret;
++	unsigned fmask = fotg210->periodic_size - 1;
++	bool live;
++
++	/*
++	 * When running, scan from last scan point up to "now"
++	 * else clean up by scanning everything that's left.
++	 * Touches as few pages as possible:  cache-friendly.
++	 */
++	if (fotg210->rh_state >= FOTG210_RH_RUNNING) {
++		uf = fotg210_read_frame_index(fotg210);
++		now_frame = (uf >> 3) & fmask;
++		live = true;
++	} else  {
++		now_frame = (fotg210->next_frame - 1) & fmask;
++		live = false;
++	}
++	fotg210->now_frame = now_frame;
++
++	frame = fotg210->next_frame;
++	for (;;) {
++		ret = 1;
++		while (ret != 0)
++			ret = scan_frame_queue(fotg210, frame,
++					now_frame, live);
++
++		/* Stop when we have reached the current frame */
++		if (frame == now_frame)
++			break;
++		frame = (frame + 1) & fmask;
++	}
++	fotg210->next_frame = now_frame;
++}
++
++/* Display / Set uframe_periodic_max
++ */
++static ssize_t uframe_periodic_max_show(struct device *dev,
++		struct device_attribute *attr, char *buf)
++{
++	struct fotg210_hcd *fotg210;
++	int n;
++
++	fotg210 = hcd_to_fotg210(bus_to_hcd(dev_get_drvdata(dev)));
++	n = scnprintf(buf, PAGE_SIZE, "%d\n", fotg210->uframe_periodic_max);
++	return n;
++}
++
++
++static ssize_t uframe_periodic_max_store(struct device *dev,
++		struct device_attribute *attr, const char *buf, size_t count)
++{
++	struct fotg210_hcd *fotg210;
++	unsigned uframe_periodic_max;
++	unsigned frame, uframe;
++	unsigned short allocated_max;
++	unsigned long flags;
++	ssize_t ret;
++
++	fotg210 = hcd_to_fotg210(bus_to_hcd(dev_get_drvdata(dev)));
++	if (kstrtouint(buf, 0, &uframe_periodic_max) < 0)
++		return -EINVAL;
++
++	if (uframe_periodic_max < 100 || uframe_periodic_max >= 125) {
++		fotg210_info(fotg210, "rejecting invalid request for uframe_periodic_max=%u\n",
++				uframe_periodic_max);
++		return -EINVAL;
++	}
++
++	ret = -EINVAL;
++
++	/*
++	 * lock, so that our checking does not race with possible periodic
++	 * bandwidth allocation through submitting new urbs.
++	 */
++	spin_lock_irqsave(&fotg210->lock, flags);
++
++	/*
++	 * for request to decrease max periodic bandwidth, we have to check
++	 * every microframe in the schedule to see whether the decrease is
++	 * possible.
++	 */
++	if (uframe_periodic_max < fotg210->uframe_periodic_max) {
++		allocated_max = 0;
++
++		for (frame = 0; frame < fotg210->periodic_size; ++frame)
++			for (uframe = 0; uframe < 7; ++uframe)
++				allocated_max = max(allocated_max,
++						periodic_usecs(fotg210, frame,
++						uframe));
++
++		if (allocated_max > uframe_periodic_max) {
++			fotg210_info(fotg210,
++					"cannot decrease uframe_periodic_max because periodic bandwidth is already allocated (%u > %u)\n",
++					allocated_max, uframe_periodic_max);
++			goto out_unlock;
++		}
++	}
++
++	/* increasing is always ok */
++
++	fotg210_info(fotg210,
++			"setting max periodic bandwidth to %u%% (== %u usec/uframe)\n",
++			100 * uframe_periodic_max/125, uframe_periodic_max);
++
++	if (uframe_periodic_max != 100)
++		fotg210_warn(fotg210, "max periodic bandwidth set is non-standard\n");
++
++	fotg210->uframe_periodic_max = uframe_periodic_max;
++	ret = count;
++
++out_unlock:
++	spin_unlock_irqrestore(&fotg210->lock, flags);
++	return ret;
++}
++
++static DEVICE_ATTR_RW(uframe_periodic_max);
++
++static inline int create_sysfs_files(struct fotg210_hcd *fotg210)
++{
++	struct device *controller = fotg210_to_hcd(fotg210)->self.controller;
++
++	return device_create_file(controller, &dev_attr_uframe_periodic_max);
++}
++
++static inline void remove_sysfs_files(struct fotg210_hcd *fotg210)
++{
++	struct device *controller = fotg210_to_hcd(fotg210)->self.controller;
++
++	device_remove_file(controller, &dev_attr_uframe_periodic_max);
++}
++/* On some systems, leaving remote wakeup enabled prevents system shutdown.
++ * The firmware seems to think that powering off is a wakeup event!
++ * This routine turns off remote wakeup and everything else, on all ports.
++ */
++static void fotg210_turn_off_all_ports(struct fotg210_hcd *fotg210)
++{
++	u32 __iomem *status_reg = &fotg210->regs->port_status;
++
++	fotg210_writel(fotg210, PORT_RWC_BITS, status_reg);
++}
++
++/* Halt HC, turn off all ports, and let the BIOS use the companion controllers.
++ * Must be called with interrupts enabled and the lock not held.
++ */
++static void fotg210_silence_controller(struct fotg210_hcd *fotg210)
++{
++	fotg210_halt(fotg210);
++
++	spin_lock_irq(&fotg210->lock);
++	fotg210->rh_state = FOTG210_RH_HALTED;
++	fotg210_turn_off_all_ports(fotg210);
++	spin_unlock_irq(&fotg210->lock);
++}
++
++/* fotg210_shutdown kick in for silicon on any bus (not just pci, etc).
++ * This forcibly disables dma and IRQs, helping kexec and other cases
++ * where the next system software may expect clean state.
++ */
++static void fotg210_shutdown(struct usb_hcd *hcd)
++{
++	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
++
++	spin_lock_irq(&fotg210->lock);
++	fotg210->shutdown = true;
++	fotg210->rh_state = FOTG210_RH_STOPPING;
++	fotg210->enabled_hrtimer_events = 0;
++	spin_unlock_irq(&fotg210->lock);
++
++	fotg210_silence_controller(fotg210);
++
++	hrtimer_cancel(&fotg210->hrtimer);
++}
++
++/* fotg210_work is called from some interrupts, timers, and so on.
++ * it calls driver completion functions, after dropping fotg210->lock.
++ */
++static void fotg210_work(struct fotg210_hcd *fotg210)
++{
++	/* another CPU may drop fotg210->lock during a schedule scan while
++	 * it reports urb completions.  this flag guards against bogus
++	 * attempts at re-entrant schedule scanning.
++	 */
++	if (fotg210->scanning) {
++		fotg210->need_rescan = true;
++		return;
++	}
++	fotg210->scanning = true;
++
++rescan:
++	fotg210->need_rescan = false;
++	if (fotg210->async_count)
++		scan_async(fotg210);
++	if (fotg210->intr_count > 0)
++		scan_intr(fotg210);
++	if (fotg210->isoc_count > 0)
++		scan_isoc(fotg210);
++	if (fotg210->need_rescan)
++		goto rescan;
++	fotg210->scanning = false;
++
++	/* the IO watchdog guards against hardware or driver bugs that
++	 * misplace IRQs, and should let us run completely without IRQs.
++	 * such lossage has been observed on both VT6202 and VT8235.
++	 */
++	turn_on_io_watchdog(fotg210);
++}
++
++/* Called when the fotg210_hcd module is removed.
++ */
++static void fotg210_stop(struct usb_hcd *hcd)
++{
++	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
++
++	fotg210_dbg(fotg210, "stop\n");
++
++	/* no more interrupts ... */
++
++	spin_lock_irq(&fotg210->lock);
++	fotg210->enabled_hrtimer_events = 0;
++	spin_unlock_irq(&fotg210->lock);
++
++	fotg210_quiesce(fotg210);
++	fotg210_silence_controller(fotg210);
++	fotg210_reset(fotg210);
++
++	hrtimer_cancel(&fotg210->hrtimer);
++	remove_sysfs_files(fotg210);
++	remove_debug_files(fotg210);
++
++	/* root hub is shut down separately (first, when possible) */
++	spin_lock_irq(&fotg210->lock);
++	end_free_itds(fotg210);
++	spin_unlock_irq(&fotg210->lock);
++	fotg210_mem_cleanup(fotg210);
++
++#ifdef FOTG210_STATS
++	fotg210_dbg(fotg210, "irq normal %ld err %ld iaa %ld (lost %ld)\n",
++			fotg210->stats.normal, fotg210->stats.error,
++			fotg210->stats.iaa, fotg210->stats.lost_iaa);
++	fotg210_dbg(fotg210, "complete %ld unlink %ld\n",
++			fotg210->stats.complete, fotg210->stats.unlink);
++#endif
++
++	dbg_status(fotg210, "fotg210_stop completed",
++			fotg210_readl(fotg210, &fotg210->regs->status));
++}
++
++/* one-time init, only for memory state */
++static int hcd_fotg210_init(struct usb_hcd *hcd)
++{
++	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
++	u32 temp;
++	int retval;
++	u32 hcc_params;
++	struct fotg210_qh_hw *hw;
++
++	spin_lock_init(&fotg210->lock);
++
++	/*
++	 * keep io watchdog by default, those good HCDs could turn off it later
++	 */
++	fotg210->need_io_watchdog = 1;
++
++	hrtimer_init(&fotg210->hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
++	fotg210->hrtimer.function = fotg210_hrtimer_func;
++	fotg210->next_hrtimer_event = FOTG210_HRTIMER_NO_EVENT;
++
++	hcc_params = fotg210_readl(fotg210, &fotg210->caps->hcc_params);
++
++	/*
++	 * by default set standard 80% (== 100 usec/uframe) max periodic
++	 * bandwidth as required by USB 2.0
++	 */
++	fotg210->uframe_periodic_max = 100;
++
++	/*
++	 * hw default: 1K periodic list heads, one per frame.
++	 * periodic_size can shrink by USBCMD update if hcc_params allows.
++	 */
++	fotg210->periodic_size = DEFAULT_I_TDPS;
++	INIT_LIST_HEAD(&fotg210->intr_qh_list);
++	INIT_LIST_HEAD(&fotg210->cached_itd_list);
++
++	if (HCC_PGM_FRAMELISTLEN(hcc_params)) {
++		/* periodic schedule size can be smaller than default */
++		switch (FOTG210_TUNE_FLS) {
++		case 0:
++			fotg210->periodic_size = 1024;
++			break;
++		case 1:
++			fotg210->periodic_size = 512;
++			break;
++		case 2:
++			fotg210->periodic_size = 256;
++			break;
++		default:
++			BUG();
++		}
++	}
++	retval = fotg210_mem_init(fotg210, GFP_KERNEL);
++	if (retval < 0)
++		return retval;
++
++	/* controllers may cache some of the periodic schedule ... */
++	fotg210->i_thresh = 2;
++
++	/*
++	 * dedicate a qh for the async ring head, since we couldn't unlink
++	 * a 'real' qh without stopping the async schedule [4.8].  use it
++	 * as the 'reclamation list head' too.
++	 * its dummy is used in hw_alt_next of many tds, to prevent the qh
++	 * from automatically advancing to the next td after short reads.
++	 */
++	fotg210->async->qh_next.qh = NULL;
++	hw = fotg210->async->hw;
++	hw->hw_next = QH_NEXT(fotg210, fotg210->async->qh_dma);
++	hw->hw_info1 = cpu_to_hc32(fotg210, QH_HEAD);
++	hw->hw_token = cpu_to_hc32(fotg210, QTD_STS_HALT);
++	hw->hw_qtd_next = FOTG210_LIST_END(fotg210);
++	fotg210->async->qh_state = QH_STATE_LINKED;
++	hw->hw_alt_next = QTD_NEXT(fotg210, fotg210->async->dummy->qtd_dma);
++
++	/* clear interrupt enables, set irq latency */
++	if (log2_irq_thresh < 0 || log2_irq_thresh > 6)
++		log2_irq_thresh = 0;
++	temp = 1 << (16 + log2_irq_thresh);
++	if (HCC_CANPARK(hcc_params)) {
++		/* HW default park == 3, on hardware that supports it (like
++		 * NVidia and ALI silicon), maximizes throughput on the async
++		 * schedule by avoiding QH fetches between transfers.
++		 *
++		 * With fast usb storage devices and NForce2, "park" seems to
++		 * make problems:  throughput reduction (!), data errors...
++		 */
++		if (park) {
++			park = min_t(unsigned, park, 3);
++			temp |= CMD_PARK;
++			temp |= park << 8;
++		}
++		fotg210_dbg(fotg210, "park %d\n", park);
++	}
++	if (HCC_PGM_FRAMELISTLEN(hcc_params)) {
++		/* periodic schedule size can be smaller than default */
++		temp &= ~(3 << 2);
++		temp |= (FOTG210_TUNE_FLS << 2);
++	}
++	fotg210->command = temp;
++
++	/* Accept arbitrarily long scatter-gather lists */
++	if (!hcd->localmem_pool)
++		hcd->self.sg_tablesize = ~0;
++	return 0;
++}
++
++/* start HC running; it's halted, hcd_fotg210_init() has been run (once) */
++static int fotg210_run(struct usb_hcd *hcd)
++{
++	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
++	u32 temp;
++
++	hcd->uses_new_polling = 1;
++
++	/* EHCI spec section 4.1 */
++
++	fotg210_writel(fotg210, fotg210->periodic_dma,
++			&fotg210->regs->frame_list);
++	fotg210_writel(fotg210, (u32)fotg210->async->qh_dma,
++			&fotg210->regs->async_next);
++
++	/*
++	 * hcc_params controls whether fotg210->regs->segment must (!!!)
++	 * be used; it constrains QH/ITD/SITD and QTD locations.
++	 * dma_pool consistent memory always uses segment zero.
++	 * streaming mappings for I/O buffers, like dma_map_single(),
++	 * can return segments above 4GB, if the device allows.
++	 *
++	 * NOTE:  the dma mask is visible through dev->dma_mask, so
++	 * drivers can pass this info along ... like NETIF_F_HIGHDMA,
++	 * Scsi_Host.highmem_io, and so forth.  It's readonly to all
++	 * host side drivers though.
++	 */
++	fotg210_readl(fotg210, &fotg210->caps->hcc_params);
++
++	/*
++	 * Philips, Intel, and maybe others need CMD_RUN before the
++	 * root hub will detect new devices (why?); NEC doesn't
++	 */
++	fotg210->command &= ~(CMD_IAAD|CMD_PSE|CMD_ASE|CMD_RESET);
++	fotg210->command |= CMD_RUN;
++	fotg210_writel(fotg210, fotg210->command, &fotg210->regs->command);
++	dbg_cmd(fotg210, "init", fotg210->command);
++
++	/*
++	 * Start, enabling full USB 2.0 functionality ... usb 1.1 devices
++	 * are explicitly handed to companion controller(s), so no TT is
++	 * involved with the root hub.  (Except where one is integrated,
++	 * and there's no companion controller unless maybe for USB OTG.)
++	 *
++	 * Turning on the CF flag will transfer ownership of all ports
++	 * from the companions to the EHCI controller.  If any of the
++	 * companions are in the middle of a port reset at the time, it
++	 * could cause trouble.  Write-locking ehci_cf_port_reset_rwsem
++	 * guarantees that no resets are in progress.  After we set CF,
++	 * a short delay lets the hardware catch up; new resets shouldn't
++	 * be started before the port switching actions could complete.
++	 */
++	down_write(&ehci_cf_port_reset_rwsem);
++	fotg210->rh_state = FOTG210_RH_RUNNING;
++	/* unblock posted writes */
++	fotg210_readl(fotg210, &fotg210->regs->command);
++	usleep_range(5000, 10000);
++	up_write(&ehci_cf_port_reset_rwsem);
++	fotg210->last_periodic_enable = ktime_get_real();
++
++	temp = HC_VERSION(fotg210,
++			fotg210_readl(fotg210, &fotg210->caps->hc_capbase));
++	fotg210_info(fotg210,
++			"USB %x.%x started, EHCI %x.%02x\n",
++			((fotg210->sbrn & 0xf0) >> 4), (fotg210->sbrn & 0x0f),
++			temp >> 8, temp & 0xff);
++
++	fotg210_writel(fotg210, INTR_MASK,
++			&fotg210->regs->intr_enable); /* Turn On Interrupts */
++
++	/* GRR this is run-once init(), being done every time the HC starts.
++	 * So long as they're part of class devices, we can't do it init()
++	 * since the class device isn't created that early.
++	 */
++	create_debug_files(fotg210);
++	create_sysfs_files(fotg210);
++
++	return 0;
++}
++
++static int fotg210_setup(struct usb_hcd *hcd)
++{
++	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
++	int retval;
++
++	fotg210->regs = (void __iomem *)fotg210->caps +
++			HC_LENGTH(fotg210,
++			fotg210_readl(fotg210, &fotg210->caps->hc_capbase));
++	dbg_hcs_params(fotg210, "reset");
++	dbg_hcc_params(fotg210, "reset");
++
++	/* cache this readonly data; minimize chip reads */
++	fotg210->hcs_params = fotg210_readl(fotg210,
++			&fotg210->caps->hcs_params);
++
++	fotg210->sbrn = HCD_USB2;
++
++	/* data structure init */
++	retval = hcd_fotg210_init(hcd);
++	if (retval)
++		return retval;
++
++	retval = fotg210_halt(fotg210);
++	if (retval)
++		return retval;
++
++	fotg210_reset(fotg210);
++
++	return 0;
++}
++
++static irqreturn_t fotg210_irq(struct usb_hcd *hcd)
++{
++	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
++	u32 status, masked_status, pcd_status = 0, cmd;
++	int bh;
++
++	spin_lock(&fotg210->lock);
++
++	status = fotg210_readl(fotg210, &fotg210->regs->status);
++
++	/* e.g. cardbus physical eject */
++	if (status == ~(u32) 0) {
++		fotg210_dbg(fotg210, "device removed\n");
++		goto dead;
++	}
++
++	/*
++	 * We don't use STS_FLR, but some controllers don't like it to
++	 * remain on, so mask it out along with the other status bits.
++	 */
++	masked_status = status & (INTR_MASK | STS_FLR);
++
++	/* Shared IRQ? */
++	if (!masked_status ||
++			unlikely(fotg210->rh_state == FOTG210_RH_HALTED)) {
++		spin_unlock(&fotg210->lock);
++		return IRQ_NONE;
++	}
++
++	/* clear (just) interrupts */
++	fotg210_writel(fotg210, masked_status, &fotg210->regs->status);
++	cmd = fotg210_readl(fotg210, &fotg210->regs->command);
++	bh = 0;
++
++	/* unrequested/ignored: Frame List Rollover */
++	dbg_status(fotg210, "irq", status);
++
++	/* INT, ERR, and IAA interrupt rates can be throttled */
++
++	/* normal [4.15.1.2] or error [4.15.1.1] completion */
++	if (likely((status & (STS_INT|STS_ERR)) != 0)) {
++		if (likely((status & STS_ERR) == 0))
++			INCR(fotg210->stats.normal);
++		else
++			INCR(fotg210->stats.error);
++		bh = 1;
++	}
++
++	/* complete the unlinking of some qh [4.15.2.3] */
++	if (status & STS_IAA) {
++
++		/* Turn off the IAA watchdog */
++		fotg210->enabled_hrtimer_events &=
++			~BIT(FOTG210_HRTIMER_IAA_WATCHDOG);
++
++		/*
++		 * Mild optimization: Allow another IAAD to reset the
++		 * hrtimer, if one occurs before the next expiration.
++		 * In theory we could always cancel the hrtimer, but
++		 * tests show that about half the time it will be reset
++		 * for some other event anyway.
++		 */
++		if (fotg210->next_hrtimer_event == FOTG210_HRTIMER_IAA_WATCHDOG)
++			++fotg210->next_hrtimer_event;
++
++		/* guard against (alleged) silicon errata */
++		if (cmd & CMD_IAAD)
++			fotg210_dbg(fotg210, "IAA with IAAD still set?\n");
++		if (fotg210->async_iaa) {
++			INCR(fotg210->stats.iaa);
++			end_unlink_async(fotg210);
++		} else
++			fotg210_dbg(fotg210, "IAA with nothing unlinked?\n");
++	}
++
++	/* remote wakeup [4.3.1] */
++	if (status & STS_PCD) {
++		int pstatus;
++		u32 __iomem *status_reg = &fotg210->regs->port_status;
++
++		/* kick root hub later */
++		pcd_status = status;
++
++		/* resume root hub? */
++		if (fotg210->rh_state == FOTG210_RH_SUSPENDED)
++			usb_hcd_resume_root_hub(hcd);
++
++		pstatus = fotg210_readl(fotg210, status_reg);
++
++		if (test_bit(0, &fotg210->suspended_ports) &&
++				((pstatus & PORT_RESUME) ||
++				!(pstatus & PORT_SUSPEND)) &&
++				(pstatus & PORT_PE) &&
++				fotg210->reset_done[0] == 0) {
++
++			/* start 20 msec resume signaling from this port,
++			 * and make hub_wq collect PORT_STAT_C_SUSPEND to
++			 * stop that signaling.  Use 5 ms extra for safety,
++			 * like usb_port_resume() does.
++			 */
++			fotg210->reset_done[0] = jiffies + msecs_to_jiffies(25);
++			set_bit(0, &fotg210->resuming_ports);
++			fotg210_dbg(fotg210, "port 1 remote wakeup\n");
++			mod_timer(&hcd->rh_timer, fotg210->reset_done[0]);
++		}
++	}
++
++	/* PCI errors [4.15.2.4] */
++	if (unlikely((status & STS_FATAL) != 0)) {
++		fotg210_err(fotg210, "fatal error\n");
++		dbg_cmd(fotg210, "fatal", cmd);
++		dbg_status(fotg210, "fatal", status);
++dead:
++		usb_hc_died(hcd);
++
++		/* Don't let the controller do anything more */
++		fotg210->shutdown = true;
++		fotg210->rh_state = FOTG210_RH_STOPPING;
++		fotg210->command &= ~(CMD_RUN | CMD_ASE | CMD_PSE);
++		fotg210_writel(fotg210, fotg210->command,
++				&fotg210->regs->command);
++		fotg210_writel(fotg210, 0, &fotg210->regs->intr_enable);
++		fotg210_handle_controller_death(fotg210);
++
++		/* Handle completions when the controller stops */
++		bh = 0;
++	}
++
++	if (bh)
++		fotg210_work(fotg210);
++	spin_unlock(&fotg210->lock);
++	if (pcd_status)
++		usb_hcd_poll_rh_status(hcd);
++	return IRQ_HANDLED;
++}
++
++/* non-error returns are a promise to giveback() the urb later
++ * we drop ownership so next owner (or urb unlink) can get it
++ *
++ * urb + dev is in hcd.self.controller.urb_list
++ * we're queueing TDs onto software and hardware lists
++ *
++ * hcd-specific init for hcpriv hasn't been done yet
++ *
++ * NOTE:  control, bulk, and interrupt share the same code to append TDs
++ * to a (possibly active) QH, and the same QH scanning code.
++ */
++static int fotg210_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
++		gfp_t mem_flags)
++{
++	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
++	struct list_head qtd_list;
++
++	INIT_LIST_HEAD(&qtd_list);
++
++	switch (usb_pipetype(urb->pipe)) {
++	case PIPE_CONTROL:
++		/* qh_completions() code doesn't handle all the fault cases
++		 * in multi-TD control transfers.  Even 1KB is rare anyway.
++		 */
++		if (urb->transfer_buffer_length > (16 * 1024))
++			return -EMSGSIZE;
++		fallthrough;
++	/* case PIPE_BULK: */
++	default:
++		if (!qh_urb_transaction(fotg210, urb, &qtd_list, mem_flags))
++			return -ENOMEM;
++		return submit_async(fotg210, urb, &qtd_list, mem_flags);
++
++	case PIPE_INTERRUPT:
++		if (!qh_urb_transaction(fotg210, urb, &qtd_list, mem_flags))
++			return -ENOMEM;
++		return intr_submit(fotg210, urb, &qtd_list, mem_flags);
++
++	case PIPE_ISOCHRONOUS:
++		return itd_submit(fotg210, urb, mem_flags);
++	}
++}
++
++/* remove from hardware lists
++ * completions normally happen asynchronously
++ */
++
++static int fotg210_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
++{
++	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
++	struct fotg210_qh *qh;
++	unsigned long flags;
++	int rc;
++
++	spin_lock_irqsave(&fotg210->lock, flags);
++	rc = usb_hcd_check_unlink_urb(hcd, urb, status);
++	if (rc)
++		goto done;
++
++	switch (usb_pipetype(urb->pipe)) {
++	/* case PIPE_CONTROL: */
++	/* case PIPE_BULK:*/
++	default:
++		qh = (struct fotg210_qh *) urb->hcpriv;
++		if (!qh)
++			break;
++		switch (qh->qh_state) {
++		case QH_STATE_LINKED:
++		case QH_STATE_COMPLETING:
++			start_unlink_async(fotg210, qh);
++			break;
++		case QH_STATE_UNLINK:
++		case QH_STATE_UNLINK_WAIT:
++			/* already started */
++			break;
++		case QH_STATE_IDLE:
++			/* QH might be waiting for a Clear-TT-Buffer */
++			qh_completions(fotg210, qh);
++			break;
++		}
++		break;
++
++	case PIPE_INTERRUPT:
++		qh = (struct fotg210_qh *) urb->hcpriv;
++		if (!qh)
++			break;
++		switch (qh->qh_state) {
++		case QH_STATE_LINKED:
++		case QH_STATE_COMPLETING:
++			start_unlink_intr(fotg210, qh);
++			break;
++		case QH_STATE_IDLE:
++			qh_completions(fotg210, qh);
++			break;
++		default:
++			fotg210_dbg(fotg210, "bogus qh %p state %d\n",
++					qh, qh->qh_state);
++			goto done;
++		}
++		break;
++
++	case PIPE_ISOCHRONOUS:
++		/* itd... */
++
++		/* wait till next completion, do it then. */
++		/* completion irqs can wait up to 1024 msec, */
++		break;
++	}
++done:
++	spin_unlock_irqrestore(&fotg210->lock, flags);
++	return rc;
++}
++
++/* bulk qh holds the data toggle */
++
++static void fotg210_endpoint_disable(struct usb_hcd *hcd,
++		struct usb_host_endpoint *ep)
++{
++	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
++	unsigned long flags;
++	struct fotg210_qh *qh, *tmp;
++
++	/* ASSERT:  any requests/urbs are being unlinked */
++	/* ASSERT:  nobody can be submitting urbs for this any more */
++
++rescan:
++	spin_lock_irqsave(&fotg210->lock, flags);
++	qh = ep->hcpriv;
++	if (!qh)
++		goto done;
++
++	/* endpoints can be iso streams.  for now, we don't
++	 * accelerate iso completions ... so spin a while.
++	 */
++	if (qh->hw == NULL) {
++		struct fotg210_iso_stream *stream = ep->hcpriv;
++
++		if (!list_empty(&stream->td_list))
++			goto idle_timeout;
++
++		/* BUG_ON(!list_empty(&stream->free_list)); */
++		kfree(stream);
++		goto done;
++	}
++
++	if (fotg210->rh_state < FOTG210_RH_RUNNING)
++		qh->qh_state = QH_STATE_IDLE;
++	switch (qh->qh_state) {
++	case QH_STATE_LINKED:
++	case QH_STATE_COMPLETING:
++		for (tmp = fotg210->async->qh_next.qh;
++				tmp && tmp != qh;
++				tmp = tmp->qh_next.qh)
++			continue;
++		/* periodic qh self-unlinks on empty, and a COMPLETING qh
++		 * may already be unlinked.
++		 */
++		if (tmp)
++			start_unlink_async(fotg210, qh);
++		fallthrough;
++	case QH_STATE_UNLINK:		/* wait for hw to finish? */
++	case QH_STATE_UNLINK_WAIT:
++idle_timeout:
++		spin_unlock_irqrestore(&fotg210->lock, flags);
++		schedule_timeout_uninterruptible(1);
++		goto rescan;
++	case QH_STATE_IDLE:		/* fully unlinked */
++		if (qh->clearing_tt)
++			goto idle_timeout;
++		if (list_empty(&qh->qtd_list)) {
++			qh_destroy(fotg210, qh);
++			break;
++		}
++		fallthrough;
++	default:
++		/* caller was supposed to have unlinked any requests;
++		 * that's not our job.  just leak this memory.
++		 */
++		fotg210_err(fotg210, "qh %p (#%02x) state %d%s\n",
++				qh, ep->desc.bEndpointAddress, qh->qh_state,
++				list_empty(&qh->qtd_list) ? "" : "(has tds)");
++		break;
++	}
++done:
++	ep->hcpriv = NULL;
++	spin_unlock_irqrestore(&fotg210->lock, flags);
++}
++
++static void fotg210_endpoint_reset(struct usb_hcd *hcd,
++		struct usb_host_endpoint *ep)
++{
++	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
++	struct fotg210_qh *qh;
++	int eptype = usb_endpoint_type(&ep->desc);
++	int epnum = usb_endpoint_num(&ep->desc);
++	int is_out = usb_endpoint_dir_out(&ep->desc);
++	unsigned long flags;
++
++	if (eptype != USB_ENDPOINT_XFER_BULK && eptype != USB_ENDPOINT_XFER_INT)
++		return;
++
++	spin_lock_irqsave(&fotg210->lock, flags);
++	qh = ep->hcpriv;
++
++	/* For Bulk and Interrupt endpoints we maintain the toggle state
++	 * in the hardware; the toggle bits in udev aren't used at all.
++	 * When an endpoint is reset by usb_clear_halt() we must reset
++	 * the toggle bit in the QH.
++	 */
++	if (qh) {
++		usb_settoggle(qh->dev, epnum, is_out, 0);
++		if (!list_empty(&qh->qtd_list)) {
++			WARN_ONCE(1, "clear_halt for a busy endpoint\n");
++		} else if (qh->qh_state == QH_STATE_LINKED ||
++				qh->qh_state == QH_STATE_COMPLETING) {
++
++			/* The toggle value in the QH can't be updated
++			 * while the QH is active.  Unlink it now;
++			 * re-linking will call qh_refresh().
++			 */
++			if (eptype == USB_ENDPOINT_XFER_BULK)
++				start_unlink_async(fotg210, qh);
++			else
++				start_unlink_intr(fotg210, qh);
++		}
++	}
++	spin_unlock_irqrestore(&fotg210->lock, flags);
++}
++
++static int fotg210_get_frame(struct usb_hcd *hcd)
++{
++	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
++
++	return (fotg210_read_frame_index(fotg210) >> 3) %
++		fotg210->periodic_size;
++}
++
++/* The EHCI in ChipIdea HDRC cannot be a separate module or device,
++ * because its registers (and irq) are shared between host/gadget/otg
++ * functions  and in order to facilitate role switching we cannot
++ * give the fotg210 driver exclusive access to those.
++ */
++MODULE_DESCRIPTION(DRIVER_DESC);
++MODULE_AUTHOR(DRIVER_AUTHOR);
++MODULE_LICENSE("GPL");
++
++static const struct hc_driver fotg210_fotg210_hc_driver = {
++	.description		= hcd_name,
++	.product_desc		= "Faraday USB2.0 Host Controller",
++	.hcd_priv_size		= sizeof(struct fotg210_hcd),
++
++	/*
++	 * generic hardware linkage
++	 */
++	.irq			= fotg210_irq,
++	.flags			= HCD_MEMORY | HCD_DMA | HCD_USB2,
++
++	/*
++	 * basic lifecycle operations
++	 */
++	.reset			= hcd_fotg210_init,
++	.start			= fotg210_run,
++	.stop			= fotg210_stop,
++	.shutdown		= fotg210_shutdown,
++
++	/*
++	 * managing i/o requests and associated device resources
++	 */
++	.urb_enqueue		= fotg210_urb_enqueue,
++	.urb_dequeue		= fotg210_urb_dequeue,
++	.endpoint_disable	= fotg210_endpoint_disable,
++	.endpoint_reset		= fotg210_endpoint_reset,
++
++	/*
++	 * scheduling support
++	 */
++	.get_frame_number	= fotg210_get_frame,
++
++	/*
++	 * root hub support
++	 */
++	.hub_status_data	= fotg210_hub_status_data,
++	.hub_control		= fotg210_hub_control,
++	.bus_suspend		= fotg210_bus_suspend,
++	.bus_resume		= fotg210_bus_resume,
++
++	.relinquish_port	= fotg210_relinquish_port,
++	.port_handed_over	= fotg210_port_handed_over,
++
++	.clear_tt_buffer_complete = fotg210_clear_tt_buffer_complete,
++};
++
++static void fotg210_init(struct fotg210_hcd *fotg210)
++{
++	u32 value;
++
++	iowrite32(GMIR_MDEV_INT | GMIR_MOTG_INT | GMIR_INT_POLARITY,
++			&fotg210->regs->gmir);
++
++	value = ioread32(&fotg210->regs->otgcsr);
++	value &= ~OTGCSR_A_BUS_DROP;
++	value |= OTGCSR_A_BUS_REQ;
++	iowrite32(value, &fotg210->regs->otgcsr);
++}
++
++/*
++ * fotg210_hcd_probe - initialize faraday FOTG210 HCDs
++ *
++ * Allocates basic resources for this USB host controller, and
++ * then invokes the start() method for the HCD associated with it
++ * through the hotplug entry's driver_data.
++ */
++static int fotg210_hcd_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct usb_hcd *hcd;
++	struct resource *res;
++	int irq;
++	int retval;
++	struct fotg210_hcd *fotg210;
++
++	if (usb_disabled())
++		return -ENODEV;
++
++	pdev->dev.power.power_state = PMSG_ON;
++
++	irq = platform_get_irq(pdev, 0);
++	if (irq < 0)
++		return irq;
++
++	hcd = usb_create_hcd(&fotg210_fotg210_hc_driver, dev,
++			dev_name(dev));
++	if (!hcd) {
++		dev_err(dev, "failed to create hcd\n");
++		retval = -ENOMEM;
++		goto fail_create_hcd;
++	}
++
++	hcd->has_tt = 1;
++
++	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	hcd->regs = devm_ioremap_resource(&pdev->dev, res);
++	if (IS_ERR(hcd->regs)) {
++		retval = PTR_ERR(hcd->regs);
++		goto failed_put_hcd;
++	}
++
++	hcd->rsrc_start = res->start;
++	hcd->rsrc_len = resource_size(res);
++
++	fotg210 = hcd_to_fotg210(hcd);
++
++	fotg210->caps = hcd->regs;
++
++	/* It's OK not to supply this clock */
++	fotg210->pclk = clk_get(dev, "PCLK");
++	if (!IS_ERR(fotg210->pclk)) {
++		retval = clk_prepare_enable(fotg210->pclk);
++		if (retval) {
++			dev_err(dev, "failed to enable PCLK\n");
++			goto failed_put_hcd;
++		}
++	} else if (PTR_ERR(fotg210->pclk) == -EPROBE_DEFER) {
++		/*
++		 * Percolate deferrals, for anything else,
++		 * just live without the clocking.
++		 */
++		retval = PTR_ERR(fotg210->pclk);
++		goto failed_dis_clk;
++	}
++
++	retval = fotg210_setup(hcd);
++	if (retval)
++		goto failed_dis_clk;
++
++	fotg210_init(fotg210);
++
++	retval = usb_add_hcd(hcd, irq, IRQF_SHARED);
++	if (retval) {
++		dev_err(dev, "failed to add hcd with err %d\n", retval);
++		goto failed_dis_clk;
++	}
++	device_wakeup_enable(hcd->self.controller);
++	platform_set_drvdata(pdev, hcd);
++
++	return retval;
++
++failed_dis_clk:
++	if (!IS_ERR(fotg210->pclk)) {
++		clk_disable_unprepare(fotg210->pclk);
++		clk_put(fotg210->pclk);
++	}
++failed_put_hcd:
++	usb_put_hcd(hcd);
++fail_create_hcd:
++	dev_err(dev, "init %s fail, %d\n", dev_name(dev), retval);
++	return retval;
++}
++
++/*
++ * fotg210_hcd_remove - shutdown processing for EHCI HCDs
++ * @dev: USB Host Controller being removed
++ *
++ */
++static int fotg210_hcd_remove(struct platform_device *pdev)
++{
++	struct usb_hcd *hcd = platform_get_drvdata(pdev);
++	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
++
++	if (!IS_ERR(fotg210->pclk)) {
++		clk_disable_unprepare(fotg210->pclk);
++		clk_put(fotg210->pclk);
++	}
++
++	usb_remove_hcd(hcd);
++	usb_put_hcd(hcd);
++
++	return 0;
++}
++
++#ifdef CONFIG_OF
++static const struct of_device_id fotg210_of_match[] = {
++	{ .compatible = "faraday,fotg210" },
++	{},
++};
++MODULE_DEVICE_TABLE(of, fotg210_of_match);
++#endif
++
++static struct platform_driver fotg210_hcd_driver = {
++	.driver = {
++		.name   = "fotg210-hcd",
++		.of_match_table = of_match_ptr(fotg210_of_match),
++	},
++	.probe  = fotg210_hcd_probe,
++	.remove = fotg210_hcd_remove,
++};
++
++static int __init fotg210_hcd_init(void)
++{
++	int retval = 0;
++
++	if (usb_disabled())
++		return -ENODEV;
++
++	set_bit(USB_EHCI_LOADED, &usb_hcds_loaded);
++	if (test_bit(USB_UHCI_LOADED, &usb_hcds_loaded) ||
++			test_bit(USB_OHCI_LOADED, &usb_hcds_loaded))
++		pr_warn("Warning! fotg210_hcd should always be loaded before uhci_hcd and ohci_hcd, not after\n");
++
++	pr_debug("%s: block sizes: qh %zd qtd %zd itd %zd\n",
++			hcd_name, sizeof(struct fotg210_qh),
++			sizeof(struct fotg210_qtd),
++			sizeof(struct fotg210_itd));
++
++	fotg210_debug_root = debugfs_create_dir("fotg210", usb_debug_root);
++
++	retval = platform_driver_register(&fotg210_hcd_driver);
++	if (retval < 0)
++		goto clean;
++	return retval;
++
++clean:
++	debugfs_remove(fotg210_debug_root);
++	fotg210_debug_root = NULL;
++
++	clear_bit(USB_EHCI_LOADED, &usb_hcds_loaded);
++	return retval;
++}
++module_init(fotg210_hcd_init);
++
++static void __exit fotg210_hcd_cleanup(void)
++{
++	platform_driver_unregister(&fotg210_hcd_driver);
++	debugfs_remove(fotg210_debug_root);
++	clear_bit(USB_EHCI_LOADED, &usb_hcds_loaded);
++}
++module_exit(fotg210_hcd_cleanup);
+--- a/drivers/usb/gadget/udc/fotg210-udc.c
++++ /dev/null
+@@ -1,1239 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * FOTG210 UDC Driver supports Bulk transfer so far
+- *
+- * Copyright (C) 2013 Faraday Technology Corporation
+- *
+- * Author : Yuan-Hsin Chen <yhchen@faraday-tech.com>
+- */
+-
+-#include <linux/dma-mapping.h>
+-#include <linux/err.h>
+-#include <linux/interrupt.h>
+-#include <linux/io.h>
+-#include <linux/module.h>
+-#include <linux/platform_device.h>
+-#include <linux/usb/ch9.h>
+-#include <linux/usb/gadget.h>
+-
+-#include "fotg210.h"
+-
+-#define	DRIVER_DESC	"FOTG210 USB Device Controller Driver"
+-#define	DRIVER_VERSION	"30-April-2013"
+-
+-static const char udc_name[] = "fotg210_udc";
+-static const char * const fotg210_ep_name[] = {
+-	"ep0", "ep1", "ep2", "ep3", "ep4"};
+-
+-static void fotg210_disable_fifo_int(struct fotg210_ep *ep)
+-{
+-	u32 value = ioread32(ep->fotg210->reg + FOTG210_DMISGR1);
+-
+-	if (ep->dir_in)
+-		value |= DMISGR1_MF_IN_INT(ep->epnum - 1);
+-	else
+-		value |= DMISGR1_MF_OUTSPK_INT(ep->epnum - 1);
+-	iowrite32(value, ep->fotg210->reg + FOTG210_DMISGR1);
+-}
+-
+-static void fotg210_enable_fifo_int(struct fotg210_ep *ep)
+-{
+-	u32 value = ioread32(ep->fotg210->reg + FOTG210_DMISGR1);
+-
+-	if (ep->dir_in)
+-		value &= ~DMISGR1_MF_IN_INT(ep->epnum - 1);
+-	else
+-		value &= ~DMISGR1_MF_OUTSPK_INT(ep->epnum - 1);
+-	iowrite32(value, ep->fotg210->reg + FOTG210_DMISGR1);
+-}
+-
+-static void fotg210_set_cxdone(struct fotg210_udc *fotg210)
+-{
+-	u32 value = ioread32(fotg210->reg + FOTG210_DCFESR);
+-
+-	value |= DCFESR_CX_DONE;
+-	iowrite32(value, fotg210->reg + FOTG210_DCFESR);
+-}
+-
+-static void fotg210_done(struct fotg210_ep *ep, struct fotg210_request *req,
+-			int status)
+-{
+-	list_del_init(&req->queue);
+-
+-	/* don't modify queue heads during completion callback */
+-	if (ep->fotg210->gadget.speed == USB_SPEED_UNKNOWN)
+-		req->req.status = -ESHUTDOWN;
+-	else
+-		req->req.status = status;
+-
+-	spin_unlock(&ep->fotg210->lock);
+-	usb_gadget_giveback_request(&ep->ep, &req->req);
+-	spin_lock(&ep->fotg210->lock);
+-
+-	if (ep->epnum) {
+-		if (list_empty(&ep->queue))
+-			fotg210_disable_fifo_int(ep);
+-	} else {
+-		fotg210_set_cxdone(ep->fotg210);
+-	}
+-}
+-
+-static void fotg210_fifo_ep_mapping(struct fotg210_ep *ep, u32 epnum,
+-				u32 dir_in)
+-{
+-	struct fotg210_udc *fotg210 = ep->fotg210;
+-	u32 val;
+-
+-	/* Driver should map an ep to a fifo and then map the fifo
+-	 * to the ep. What a brain-damaged design!
+-	 */
+-
+-	/* map a fifo to an ep */
+-	val = ioread32(fotg210->reg + FOTG210_EPMAP);
+-	val &= ~EPMAP_FIFONOMSK(epnum, dir_in);
+-	val |= EPMAP_FIFONO(epnum, dir_in);
+-	iowrite32(val, fotg210->reg + FOTG210_EPMAP);
+-
+-	/* map the ep to the fifo */
+-	val = ioread32(fotg210->reg + FOTG210_FIFOMAP);
+-	val &= ~FIFOMAP_EPNOMSK(epnum);
+-	val |= FIFOMAP_EPNO(epnum);
+-	iowrite32(val, fotg210->reg + FOTG210_FIFOMAP);
+-
+-	/* enable fifo */
+-	val = ioread32(fotg210->reg + FOTG210_FIFOCF);
+-	val |= FIFOCF_FIFO_EN(epnum - 1);
+-	iowrite32(val, fotg210->reg + FOTG210_FIFOCF);
+-}
+-
+-static void fotg210_set_fifo_dir(struct fotg210_ep *ep, u32 epnum, u32 dir_in)
+-{
+-	struct fotg210_udc *fotg210 = ep->fotg210;
+-	u32 val;
+-
+-	val = ioread32(fotg210->reg + FOTG210_FIFOMAP);
+-	val |= (dir_in ? FIFOMAP_DIRIN(epnum - 1) : FIFOMAP_DIROUT(epnum - 1));
+-	iowrite32(val, fotg210->reg + FOTG210_FIFOMAP);
+-}
+-
+-static void fotg210_set_tfrtype(struct fotg210_ep *ep, u32 epnum, u32 type)
+-{
+-	struct fotg210_udc *fotg210 = ep->fotg210;
+-	u32 val;
+-
+-	val = ioread32(fotg210->reg + FOTG210_FIFOCF);
+-	val |= FIFOCF_TYPE(type, epnum - 1);
+-	iowrite32(val, fotg210->reg + FOTG210_FIFOCF);
+-}
+-
+-static void fotg210_set_mps(struct fotg210_ep *ep, u32 epnum, u32 mps,
+-				u32 dir_in)
+-{
+-	struct fotg210_udc *fotg210 = ep->fotg210;
+-	u32 val;
+-	u32 offset = dir_in ? FOTG210_INEPMPSR(epnum) :
+-				FOTG210_OUTEPMPSR(epnum);
+-
+-	val = ioread32(fotg210->reg + offset);
+-	val |= INOUTEPMPSR_MPS(mps);
+-	iowrite32(val, fotg210->reg + offset);
+-}
+-
+-static int fotg210_config_ep(struct fotg210_ep *ep,
+-		     const struct usb_endpoint_descriptor *desc)
+-{
+-	struct fotg210_udc *fotg210 = ep->fotg210;
+-
+-	fotg210_set_fifo_dir(ep, ep->epnum, ep->dir_in);
+-	fotg210_set_tfrtype(ep, ep->epnum, ep->type);
+-	fotg210_set_mps(ep, ep->epnum, ep->ep.maxpacket, ep->dir_in);
+-	fotg210_fifo_ep_mapping(ep, ep->epnum, ep->dir_in);
+-
+-	fotg210->ep[ep->epnum] = ep;
+-
+-	return 0;
+-}
+-
+-static int fotg210_ep_enable(struct usb_ep *_ep,
+-			  const struct usb_endpoint_descriptor *desc)
+-{
+-	struct fotg210_ep *ep;
+-
+-	ep = container_of(_ep, struct fotg210_ep, ep);
+-
+-	ep->desc = desc;
+-	ep->epnum = usb_endpoint_num(desc);
+-	ep->type = usb_endpoint_type(desc);
+-	ep->dir_in = usb_endpoint_dir_in(desc);
+-	ep->ep.maxpacket = usb_endpoint_maxp(desc);
+-
+-	return fotg210_config_ep(ep, desc);
+-}
+-
+-static void fotg210_reset_tseq(struct fotg210_udc *fotg210, u8 epnum)
+-{
+-	struct fotg210_ep *ep = fotg210->ep[epnum];
+-	u32 value;
+-	void __iomem *reg;
+-
+-	reg = (ep->dir_in) ?
+-		fotg210->reg + FOTG210_INEPMPSR(epnum) :
+-		fotg210->reg + FOTG210_OUTEPMPSR(epnum);
+-
+-	/* Note: Driver needs to set and clear INOUTEPMPSR_RESET_TSEQ
+-	 *	 bit. Controller wouldn't clear this bit. WTF!!!
+-	 */
+-
+-	value = ioread32(reg);
+-	value |= INOUTEPMPSR_RESET_TSEQ;
+-	iowrite32(value, reg);
+-
+-	value = ioread32(reg);
+-	value &= ~INOUTEPMPSR_RESET_TSEQ;
+-	iowrite32(value, reg);
+-}
+-
+-static int fotg210_ep_release(struct fotg210_ep *ep)
+-{
+-	if (!ep->epnum)
+-		return 0;
+-	ep->epnum = 0;
+-	ep->stall = 0;
+-	ep->wedged = 0;
+-
+-	fotg210_reset_tseq(ep->fotg210, ep->epnum);
+-
+-	return 0;
+-}
+-
+-static int fotg210_ep_disable(struct usb_ep *_ep)
+-{
+-	struct fotg210_ep *ep;
+-	struct fotg210_request *req;
+-	unsigned long flags;
+-
+-	BUG_ON(!_ep);
+-
+-	ep = container_of(_ep, struct fotg210_ep, ep);
+-
+-	while (!list_empty(&ep->queue)) {
+-		req = list_entry(ep->queue.next,
+-			struct fotg210_request, queue);
+-		spin_lock_irqsave(&ep->fotg210->lock, flags);
+-		fotg210_done(ep, req, -ECONNRESET);
+-		spin_unlock_irqrestore(&ep->fotg210->lock, flags);
+-	}
+-
+-	return fotg210_ep_release(ep);
+-}
+-
+-static struct usb_request *fotg210_ep_alloc_request(struct usb_ep *_ep,
+-						gfp_t gfp_flags)
+-{
+-	struct fotg210_request *req;
+-
+-	req = kzalloc(sizeof(struct fotg210_request), gfp_flags);
+-	if (!req)
+-		return NULL;
+-
+-	INIT_LIST_HEAD(&req->queue);
+-
+-	return &req->req;
+-}
+-
+-static void fotg210_ep_free_request(struct usb_ep *_ep,
+-					struct usb_request *_req)
+-{
+-	struct fotg210_request *req;
+-
+-	req = container_of(_req, struct fotg210_request, req);
+-	kfree(req);
+-}
+-
+-static void fotg210_enable_dma(struct fotg210_ep *ep,
+-			      dma_addr_t d, u32 len)
+-{
+-	u32 value;
+-	struct fotg210_udc *fotg210 = ep->fotg210;
+-
+-	/* set transfer length and direction */
+-	value = ioread32(fotg210->reg + FOTG210_DMACPSR1);
+-	value &= ~(DMACPSR1_DMA_LEN(0xFFFF) | DMACPSR1_DMA_TYPE(1));
+-	value |= DMACPSR1_DMA_LEN(len) | DMACPSR1_DMA_TYPE(ep->dir_in);
+-	iowrite32(value, fotg210->reg + FOTG210_DMACPSR1);
+-
+-	/* set device DMA target FIFO number */
+-	value = ioread32(fotg210->reg + FOTG210_DMATFNR);
+-	if (ep->epnum)
+-		value |= DMATFNR_ACC_FN(ep->epnum - 1);
+-	else
+-		value |= DMATFNR_ACC_CXF;
+-	iowrite32(value, fotg210->reg + FOTG210_DMATFNR);
+-
+-	/* set DMA memory address */
+-	iowrite32(d, fotg210->reg + FOTG210_DMACPSR2);
+-
+-	/* enable MDMA_EROR and MDMA_CMPLT interrupt */
+-	value = ioread32(fotg210->reg + FOTG210_DMISGR2);
+-	value &= ~(DMISGR2_MDMA_CMPLT | DMISGR2_MDMA_ERROR);
+-	iowrite32(value, fotg210->reg + FOTG210_DMISGR2);
+-
+-	/* start DMA */
+-	value = ioread32(fotg210->reg + FOTG210_DMACPSR1);
+-	value |= DMACPSR1_DMA_START;
+-	iowrite32(value, fotg210->reg + FOTG210_DMACPSR1);
+-}
+-
+-static void fotg210_disable_dma(struct fotg210_ep *ep)
+-{
+-	iowrite32(DMATFNR_DISDMA, ep->fotg210->reg + FOTG210_DMATFNR);
+-}
+-
+-static void fotg210_wait_dma_done(struct fotg210_ep *ep)
+-{
+-	u32 value;
+-
+-	do {
+-		value = ioread32(ep->fotg210->reg + FOTG210_DISGR2);
+-		if ((value & DISGR2_USBRST_INT) ||
+-		    (value & DISGR2_DMA_ERROR))
+-			goto dma_reset;
+-	} while (!(value & DISGR2_DMA_CMPLT));
+-
+-	value &= ~DISGR2_DMA_CMPLT;
+-	iowrite32(value, ep->fotg210->reg + FOTG210_DISGR2);
+-	return;
+-
+-dma_reset:
+-	value = ioread32(ep->fotg210->reg + FOTG210_DMACPSR1);
+-	value |= DMACPSR1_DMA_ABORT;
+-	iowrite32(value, ep->fotg210->reg + FOTG210_DMACPSR1);
+-
+-	/* reset fifo */
+-	if (ep->epnum) {
+-		value = ioread32(ep->fotg210->reg +
+-				FOTG210_FIBCR(ep->epnum - 1));
+-		value |= FIBCR_FFRST;
+-		iowrite32(value, ep->fotg210->reg +
+-				FOTG210_FIBCR(ep->epnum - 1));
+-	} else {
+-		value = ioread32(ep->fotg210->reg + FOTG210_DCFESR);
+-		value |= DCFESR_CX_CLR;
+-		iowrite32(value, ep->fotg210->reg + FOTG210_DCFESR);
+-	}
+-}
+-
+-static void fotg210_start_dma(struct fotg210_ep *ep,
+-			struct fotg210_request *req)
+-{
+-	struct device *dev = &ep->fotg210->gadget.dev;
+-	dma_addr_t d;
+-	u8 *buffer;
+-	u32 length;
+-
+-	if (ep->epnum) {
+-		if (ep->dir_in) {
+-			buffer = req->req.buf;
+-			length = req->req.length;
+-		} else {
+-			buffer = req->req.buf + req->req.actual;
+-			length = ioread32(ep->fotg210->reg +
+-					FOTG210_FIBCR(ep->epnum - 1)) & FIBCR_BCFX;
+-			if (length > req->req.length - req->req.actual)
+-				length = req->req.length - req->req.actual;
+-		}
+-	} else {
+-		buffer = req->req.buf + req->req.actual;
+-		if (req->req.length - req->req.actual > ep->ep.maxpacket)
+-			length = ep->ep.maxpacket;
+-		else
+-			length = req->req.length - req->req.actual;
+-	}
+-
+-	d = dma_map_single(dev, buffer, length,
+-			ep->dir_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+-
+-	if (dma_mapping_error(dev, d)) {
+-		pr_err("dma_mapping_error\n");
+-		return;
+-	}
+-
+-	fotg210_enable_dma(ep, d, length);
+-
+-	/* check if dma is done */
+-	fotg210_wait_dma_done(ep);
+-
+-	fotg210_disable_dma(ep);
+-
+-	/* update actual transfer length */
+-	req->req.actual += length;
+-
+-	dma_unmap_single(dev, d, length, DMA_TO_DEVICE);
+-}
+-
+-static void fotg210_ep0_queue(struct fotg210_ep *ep,
+-				struct fotg210_request *req)
+-{
+-	if (!req->req.length) {
+-		fotg210_done(ep, req, 0);
+-		return;
+-	}
+-	if (ep->dir_in) { /* if IN */
+-		fotg210_start_dma(ep, req);
+-		if (req->req.length == req->req.actual)
+-			fotg210_done(ep, req, 0);
+-	} else { /* OUT */
+-		u32 value = ioread32(ep->fotg210->reg + FOTG210_DMISGR0);
+-
+-		value &= ~DMISGR0_MCX_OUT_INT;
+-		iowrite32(value, ep->fotg210->reg + FOTG210_DMISGR0);
+-	}
+-}
+-
+-static int fotg210_ep_queue(struct usb_ep *_ep, struct usb_request *_req,
+-				gfp_t gfp_flags)
+-{
+-	struct fotg210_ep *ep;
+-	struct fotg210_request *req;
+-	unsigned long flags;
+-	int request = 0;
+-
+-	ep = container_of(_ep, struct fotg210_ep, ep);
+-	req = container_of(_req, struct fotg210_request, req);
+-
+-	if (ep->fotg210->gadget.speed == USB_SPEED_UNKNOWN)
+-		return -ESHUTDOWN;
+-
+-	spin_lock_irqsave(&ep->fotg210->lock, flags);
+-
+-	if (list_empty(&ep->queue))
+-		request = 1;
+-
+-	list_add_tail(&req->queue, &ep->queue);
+-
+-	req->req.actual = 0;
+-	req->req.status = -EINPROGRESS;
+-
+-	if (!ep->epnum) /* ep0 */
+-		fotg210_ep0_queue(ep, req);
+-	else if (request && !ep->stall)
+-		fotg210_enable_fifo_int(ep);
+-
+-	spin_unlock_irqrestore(&ep->fotg210->lock, flags);
+-
+-	return 0;
+-}
+-
+-static int fotg210_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
+-{
+-	struct fotg210_ep *ep;
+-	struct fotg210_request *req;
+-	unsigned long flags;
+-
+-	ep = container_of(_ep, struct fotg210_ep, ep);
+-	req = container_of(_req, struct fotg210_request, req);
+-
+-	spin_lock_irqsave(&ep->fotg210->lock, flags);
+-	if (!list_empty(&ep->queue))
+-		fotg210_done(ep, req, -ECONNRESET);
+-	spin_unlock_irqrestore(&ep->fotg210->lock, flags);
+-
+-	return 0;
+-}
+-
+-static void fotg210_set_epnstall(struct fotg210_ep *ep)
+-{
+-	struct fotg210_udc *fotg210 = ep->fotg210;
+-	u32 value;
+-	void __iomem *reg;
+-
+-	/* check if IN FIFO is empty before stall */
+-	if (ep->dir_in) {
+-		do {
+-			value = ioread32(fotg210->reg + FOTG210_DCFESR);
+-		} while (!(value & DCFESR_FIFO_EMPTY(ep->epnum - 1)));
+-	}
+-
+-	reg = (ep->dir_in) ?
+-		fotg210->reg + FOTG210_INEPMPSR(ep->epnum) :
+-		fotg210->reg + FOTG210_OUTEPMPSR(ep->epnum);
+-	value = ioread32(reg);
+-	value |= INOUTEPMPSR_STL_EP;
+-	iowrite32(value, reg);
+-}
+-
+-static void fotg210_clear_epnstall(struct fotg210_ep *ep)
+-{
+-	struct fotg210_udc *fotg210 = ep->fotg210;
+-	u32 value;
+-	void __iomem *reg;
+-
+-	reg = (ep->dir_in) ?
+-		fotg210->reg + FOTG210_INEPMPSR(ep->epnum) :
+-		fotg210->reg + FOTG210_OUTEPMPSR(ep->epnum);
+-	value = ioread32(reg);
+-	value &= ~INOUTEPMPSR_STL_EP;
+-	iowrite32(value, reg);
+-}
+-
+-static int fotg210_set_halt_and_wedge(struct usb_ep *_ep, int value, int wedge)
+-{
+-	struct fotg210_ep *ep;
+-	struct fotg210_udc *fotg210;
+-	unsigned long flags;
+-
+-	ep = container_of(_ep, struct fotg210_ep, ep);
+-
+-	fotg210 = ep->fotg210;
+-
+-	spin_lock_irqsave(&ep->fotg210->lock, flags);
+-
+-	if (value) {
+-		fotg210_set_epnstall(ep);
+-		ep->stall = 1;
+-		if (wedge)
+-			ep->wedged = 1;
+-	} else {
+-		fotg210_reset_tseq(fotg210, ep->epnum);
+-		fotg210_clear_epnstall(ep);
+-		ep->stall = 0;
+-		ep->wedged = 0;
+-		if (!list_empty(&ep->queue))
+-			fotg210_enable_fifo_int(ep);
+-	}
+-
+-	spin_unlock_irqrestore(&ep->fotg210->lock, flags);
+-	return 0;
+-}
+-
+-static int fotg210_ep_set_halt(struct usb_ep *_ep, int value)
+-{
+-	return fotg210_set_halt_and_wedge(_ep, value, 0);
+-}
+-
+-static int fotg210_ep_set_wedge(struct usb_ep *_ep)
+-{
+-	return fotg210_set_halt_and_wedge(_ep, 1, 1);
+-}
+-
+-static void fotg210_ep_fifo_flush(struct usb_ep *_ep)
+-{
+-}
+-
+-static const struct usb_ep_ops fotg210_ep_ops = {
+-	.enable		= fotg210_ep_enable,
+-	.disable	= fotg210_ep_disable,
+-
+-	.alloc_request	= fotg210_ep_alloc_request,
+-	.free_request	= fotg210_ep_free_request,
+-
+-	.queue		= fotg210_ep_queue,
+-	.dequeue	= fotg210_ep_dequeue,
+-
+-	.set_halt	= fotg210_ep_set_halt,
+-	.fifo_flush	= fotg210_ep_fifo_flush,
+-	.set_wedge	= fotg210_ep_set_wedge,
+-};
+-
+-static void fotg210_clear_tx0byte(struct fotg210_udc *fotg210)
+-{
+-	u32 value = ioread32(fotg210->reg + FOTG210_TX0BYTE);
+-
+-	value &= ~(TX0BYTE_EP1 | TX0BYTE_EP2 | TX0BYTE_EP3
+-		   | TX0BYTE_EP4);
+-	iowrite32(value, fotg210->reg + FOTG210_TX0BYTE);
+-}
+-
+-static void fotg210_clear_rx0byte(struct fotg210_udc *fotg210)
+-{
+-	u32 value = ioread32(fotg210->reg + FOTG210_RX0BYTE);
+-
+-	value &= ~(RX0BYTE_EP1 | RX0BYTE_EP2 | RX0BYTE_EP3
+-		   | RX0BYTE_EP4);
+-	iowrite32(value, fotg210->reg + FOTG210_RX0BYTE);
+-}
+-
+-/* read 8-byte setup packet only */
+-static void fotg210_rdsetupp(struct fotg210_udc *fotg210,
+-		   u8 *buffer)
+-{
+-	int i = 0;
+-	u8 *tmp = buffer;
+-	u32 data;
+-	u32 length = 8;
+-
+-	iowrite32(DMATFNR_ACC_CXF, fotg210->reg + FOTG210_DMATFNR);
+-
+-	for (i = (length >> 2); i > 0; i--) {
+-		data = ioread32(fotg210->reg + FOTG210_CXPORT);
+-		*tmp = data & 0xFF;
+-		*(tmp + 1) = (data >> 8) & 0xFF;
+-		*(tmp + 2) = (data >> 16) & 0xFF;
+-		*(tmp + 3) = (data >> 24) & 0xFF;
+-		tmp = tmp + 4;
+-	}
+-
+-	switch (length % 4) {
+-	case 1:
+-		data = ioread32(fotg210->reg + FOTG210_CXPORT);
+-		*tmp = data & 0xFF;
+-		break;
+-	case 2:
+-		data = ioread32(fotg210->reg + FOTG210_CXPORT);
+-		*tmp = data & 0xFF;
+-		*(tmp + 1) = (data >> 8) & 0xFF;
+-		break;
+-	case 3:
+-		data = ioread32(fotg210->reg + FOTG210_CXPORT);
+-		*tmp = data & 0xFF;
+-		*(tmp + 1) = (data >> 8) & 0xFF;
+-		*(tmp + 2) = (data >> 16) & 0xFF;
+-		break;
+-	default:
+-		break;
+-	}
+-
+-	iowrite32(DMATFNR_DISDMA, fotg210->reg + FOTG210_DMATFNR);
+-}
+-
+-static void fotg210_set_configuration(struct fotg210_udc *fotg210)
+-{
+-	u32 value = ioread32(fotg210->reg + FOTG210_DAR);
+-
+-	value |= DAR_AFT_CONF;
+-	iowrite32(value, fotg210->reg + FOTG210_DAR);
+-}
+-
+-static void fotg210_set_dev_addr(struct fotg210_udc *fotg210, u32 addr)
+-{
+-	u32 value = ioread32(fotg210->reg + FOTG210_DAR);
+-
+-	value |= (addr & 0x7F);
+-	iowrite32(value, fotg210->reg + FOTG210_DAR);
+-}
+-
+-static void fotg210_set_cxstall(struct fotg210_udc *fotg210)
+-{
+-	u32 value = ioread32(fotg210->reg + FOTG210_DCFESR);
+-
+-	value |= DCFESR_CX_STL;
+-	iowrite32(value, fotg210->reg + FOTG210_DCFESR);
+-}
+-
+-static void fotg210_request_error(struct fotg210_udc *fotg210)
+-{
+-	fotg210_set_cxstall(fotg210);
+-	pr_err("request error!!\n");
+-}
+-
+-static void fotg210_set_address(struct fotg210_udc *fotg210,
+-				struct usb_ctrlrequest *ctrl)
+-{
+-	if (le16_to_cpu(ctrl->wValue) >= 0x0100) {
+-		fotg210_request_error(fotg210);
+-	} else {
+-		fotg210_set_dev_addr(fotg210, le16_to_cpu(ctrl->wValue));
+-		fotg210_set_cxdone(fotg210);
+-	}
+-}
+-
+-static void fotg210_set_feature(struct fotg210_udc *fotg210,
+-				struct usb_ctrlrequest *ctrl)
+-{
+-	switch (ctrl->bRequestType & USB_RECIP_MASK) {
+-	case USB_RECIP_DEVICE:
+-		fotg210_set_cxdone(fotg210);
+-		break;
+-	case USB_RECIP_INTERFACE:
+-		fotg210_set_cxdone(fotg210);
+-		break;
+-	case USB_RECIP_ENDPOINT: {
+-		u8 epnum;
+-		epnum = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK;
+-		if (epnum)
+-			fotg210_set_epnstall(fotg210->ep[epnum]);
+-		else
+-			fotg210_set_cxstall(fotg210);
+-		fotg210_set_cxdone(fotg210);
+-		}
+-		break;
+-	default:
+-		fotg210_request_error(fotg210);
+-		break;
+-	}
+-}
+-
+-static void fotg210_clear_feature(struct fotg210_udc *fotg210,
+-				struct usb_ctrlrequest *ctrl)
+-{
+-	struct fotg210_ep *ep =
+-		fotg210->ep[ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK];
+-
+-	switch (ctrl->bRequestType & USB_RECIP_MASK) {
+-	case USB_RECIP_DEVICE:
+-		fotg210_set_cxdone(fotg210);
+-		break;
+-	case USB_RECIP_INTERFACE:
+-		fotg210_set_cxdone(fotg210);
+-		break;
+-	case USB_RECIP_ENDPOINT:
+-		if (ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK) {
+-			if (ep->wedged) {
+-				fotg210_set_cxdone(fotg210);
+-				break;
+-			}
+-			if (ep->stall)
+-				fotg210_set_halt_and_wedge(&ep->ep, 0, 0);
+-		}
+-		fotg210_set_cxdone(fotg210);
+-		break;
+-	default:
+-		fotg210_request_error(fotg210);
+-		break;
+-	}
+-}
+-
+-static int fotg210_is_epnstall(struct fotg210_ep *ep)
+-{
+-	struct fotg210_udc *fotg210 = ep->fotg210;
+-	u32 value;
+-	void __iomem *reg;
+-
+-	reg = (ep->dir_in) ?
+-		fotg210->reg + FOTG210_INEPMPSR(ep->epnum) :
+-		fotg210->reg + FOTG210_OUTEPMPSR(ep->epnum);
+-	value = ioread32(reg);
+-	return value & INOUTEPMPSR_STL_EP ? 1 : 0;
+-}
+-
+-/* For EP0 requests triggered by this driver (currently GET_STATUS response) */
+-static void fotg210_ep0_complete(struct usb_ep *_ep, struct usb_request *req)
+-{
+-	struct fotg210_ep *ep;
+-	struct fotg210_udc *fotg210;
+-
+-	ep = container_of(_ep, struct fotg210_ep, ep);
+-	fotg210 = ep->fotg210;
+-
+-	if (req->status || req->actual != req->length) {
+-		dev_warn(&fotg210->gadget.dev, "EP0 request failed: %d\n", req->status);
+-	}
+-}
+-
+-static void fotg210_get_status(struct fotg210_udc *fotg210,
+-				struct usb_ctrlrequest *ctrl)
+-{
+-	u8 epnum;
+-
+-	switch (ctrl->bRequestType & USB_RECIP_MASK) {
+-	case USB_RECIP_DEVICE:
+-		fotg210->ep0_data = cpu_to_le16(1 << USB_DEVICE_SELF_POWERED);
+-		break;
+-	case USB_RECIP_INTERFACE:
+-		fotg210->ep0_data = cpu_to_le16(0);
+-		break;
+-	case USB_RECIP_ENDPOINT:
+-		epnum = ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK;
+-		if (epnum)
+-			fotg210->ep0_data =
+-				cpu_to_le16(fotg210_is_epnstall(fotg210->ep[epnum])
+-					    << USB_ENDPOINT_HALT);
+-		else
+-			fotg210_request_error(fotg210);
+-		break;
+-
+-	default:
+-		fotg210_request_error(fotg210);
+-		return;		/* exit */
+-	}
+-
+-	fotg210->ep0_req->buf = &fotg210->ep0_data;
+-	fotg210->ep0_req->length = 2;
+-
+-	spin_unlock(&fotg210->lock);
+-	fotg210_ep_queue(fotg210->gadget.ep0, fotg210->ep0_req, GFP_ATOMIC);
+-	spin_lock(&fotg210->lock);
+-}
+-
+-static int fotg210_setup_packet(struct fotg210_udc *fotg210,
+-				struct usb_ctrlrequest *ctrl)
+-{
+-	u8 *p = (u8 *)ctrl;
+-	u8 ret = 0;
+-
+-	fotg210_rdsetupp(fotg210, p);
+-
+-	fotg210->ep[0]->dir_in = ctrl->bRequestType & USB_DIR_IN;
+-
+-	if (fotg210->gadget.speed == USB_SPEED_UNKNOWN) {
+-		u32 value = ioread32(fotg210->reg + FOTG210_DMCR);
+-		fotg210->gadget.speed = value & DMCR_HS_EN ?
+-				USB_SPEED_HIGH : USB_SPEED_FULL;
+-	}
+-
+-	/* check request */
+-	if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD) {
+-		switch (ctrl->bRequest) {
+-		case USB_REQ_GET_STATUS:
+-			fotg210_get_status(fotg210, ctrl);
+-			break;
+-		case USB_REQ_CLEAR_FEATURE:
+-			fotg210_clear_feature(fotg210, ctrl);
+-			break;
+-		case USB_REQ_SET_FEATURE:
+-			fotg210_set_feature(fotg210, ctrl);
+-			break;
+-		case USB_REQ_SET_ADDRESS:
+-			fotg210_set_address(fotg210, ctrl);
+-			break;
+-		case USB_REQ_SET_CONFIGURATION:
+-			fotg210_set_configuration(fotg210);
+-			ret = 1;
+-			break;
+-		default:
+-			ret = 1;
+-			break;
+-		}
+-	} else {
+-		ret = 1;
+-	}
+-
+-	return ret;
+-}
+-
+-static void fotg210_ep0out(struct fotg210_udc *fotg210)
+-{
+-	struct fotg210_ep *ep = fotg210->ep[0];
+-
+-	if (!list_empty(&ep->queue) && !ep->dir_in) {
+-		struct fotg210_request *req;
+-
+-		req = list_first_entry(&ep->queue,
+-			struct fotg210_request, queue);
+-
+-		if (req->req.length)
+-			fotg210_start_dma(ep, req);
+-
+-		if ((req->req.length - req->req.actual) < ep->ep.maxpacket)
+-			fotg210_done(ep, req, 0);
+-	} else {
+-		pr_err("%s : empty queue\n", __func__);
+-	}
+-}
+-
+-static void fotg210_ep0in(struct fotg210_udc *fotg210)
+-{
+-	struct fotg210_ep *ep = fotg210->ep[0];
+-
+-	if ((!list_empty(&ep->queue)) && (ep->dir_in)) {
+-		struct fotg210_request *req;
+-
+-		req = list_entry(ep->queue.next,
+-				struct fotg210_request, queue);
+-
+-		if (req->req.length)
+-			fotg210_start_dma(ep, req);
+-
+-		if (req->req.actual == req->req.length)
+-			fotg210_done(ep, req, 0);
+-	} else {
+-		fotg210_set_cxdone(fotg210);
+-	}
+-}
+-
+-static void fotg210_clear_comabt_int(struct fotg210_udc *fotg210)
+-{
+-	u32 value = ioread32(fotg210->reg + FOTG210_DISGR0);
+-
+-	value &= ~DISGR0_CX_COMABT_INT;
+-	iowrite32(value, fotg210->reg + FOTG210_DISGR0);
+-}
+-
+-static void fotg210_in_fifo_handler(struct fotg210_ep *ep)
+-{
+-	struct fotg210_request *req = list_entry(ep->queue.next,
+-					struct fotg210_request, queue);
+-
+-	if (req->req.length)
+-		fotg210_start_dma(ep, req);
+-	fotg210_done(ep, req, 0);
+-}
+-
+-static void fotg210_out_fifo_handler(struct fotg210_ep *ep)
+-{
+-	struct fotg210_request *req = list_entry(ep->queue.next,
+-						 struct fotg210_request, queue);
+-	int disgr1 = ioread32(ep->fotg210->reg + FOTG210_DISGR1);
+-
+-	fotg210_start_dma(ep, req);
+-
+-	/* Complete the request when it's full or a short packet arrived.
+-	 * Like other drivers, short_not_ok isn't handled.
+-	 */
+-
+-	if (req->req.length == req->req.actual ||
+-	    (disgr1 & DISGR1_SPK_INT(ep->epnum - 1)))
+-		fotg210_done(ep, req, 0);
+-}
+-
+-static irqreturn_t fotg210_irq(int irq, void *_fotg210)
+-{
+-	struct fotg210_udc *fotg210 = _fotg210;
+-	u32 int_grp = ioread32(fotg210->reg + FOTG210_DIGR);
+-	u32 int_msk = ioread32(fotg210->reg + FOTG210_DMIGR);
+-
+-	int_grp &= ~int_msk;
+-
+-	spin_lock(&fotg210->lock);
+-
+-	if (int_grp & DIGR_INT_G2) {
+-		void __iomem *reg = fotg210->reg + FOTG210_DISGR2;
+-		u32 int_grp2 = ioread32(reg);
+-		u32 int_msk2 = ioread32(fotg210->reg + FOTG210_DMISGR2);
+-		u32 value;
+-
+-		int_grp2 &= ~int_msk2;
+-
+-		if (int_grp2 & DISGR2_USBRST_INT) {
+-			usb_gadget_udc_reset(&fotg210->gadget,
+-					     fotg210->driver);
+-			value = ioread32(reg);
+-			value &= ~DISGR2_USBRST_INT;
+-			iowrite32(value, reg);
+-			pr_info("fotg210 udc reset\n");
+-		}
+-		if (int_grp2 & DISGR2_SUSP_INT) {
+-			value = ioread32(reg);
+-			value &= ~DISGR2_SUSP_INT;
+-			iowrite32(value, reg);
+-			pr_info("fotg210 udc suspend\n");
+-		}
+-		if (int_grp2 & DISGR2_RESM_INT) {
+-			value = ioread32(reg);
+-			value &= ~DISGR2_RESM_INT;
+-			iowrite32(value, reg);
+-			pr_info("fotg210 udc resume\n");
+-		}
+-		if (int_grp2 & DISGR2_ISO_SEQ_ERR_INT) {
+-			value = ioread32(reg);
+-			value &= ~DISGR2_ISO_SEQ_ERR_INT;
+-			iowrite32(value, reg);
+-			pr_info("fotg210 iso sequence error\n");
+-		}
+-		if (int_grp2 & DISGR2_ISO_SEQ_ABORT_INT) {
+-			value = ioread32(reg);
+-			value &= ~DISGR2_ISO_SEQ_ABORT_INT;
+-			iowrite32(value, reg);
+-			pr_info("fotg210 iso sequence abort\n");
+-		}
+-		if (int_grp2 & DISGR2_TX0BYTE_INT) {
+-			fotg210_clear_tx0byte(fotg210);
+-			value = ioread32(reg);
+-			value &= ~DISGR2_TX0BYTE_INT;
+-			iowrite32(value, reg);
+-			pr_info("fotg210 transferred 0 byte\n");
+-		}
+-		if (int_grp2 & DISGR2_RX0BYTE_INT) {
+-			fotg210_clear_rx0byte(fotg210);
+-			value = ioread32(reg);
+-			value &= ~DISGR2_RX0BYTE_INT;
+-			iowrite32(value, reg);
+-			pr_info("fotg210 received 0 byte\n");
+-		}
+-		if (int_grp2 & DISGR2_DMA_ERROR) {
+-			value = ioread32(reg);
+-			value &= ~DISGR2_DMA_ERROR;
+-			iowrite32(value, reg);
+-		}
+-	}
+-
+-	if (int_grp & DIGR_INT_G0) {
+-		void __iomem *reg = fotg210->reg + FOTG210_DISGR0;
+-		u32 int_grp0 = ioread32(reg);
+-		u32 int_msk0 = ioread32(fotg210->reg + FOTG210_DMISGR0);
+-		struct usb_ctrlrequest ctrl;
+-
+-		int_grp0 &= ~int_msk0;
+-
+-		/* the highest priority in this source register */
+-		if (int_grp0 & DISGR0_CX_COMABT_INT) {
+-			fotg210_clear_comabt_int(fotg210);
+-			pr_info("fotg210 CX command abort\n");
+-		}
+-
+-		if (int_grp0 & DISGR0_CX_SETUP_INT) {
+-			if (fotg210_setup_packet(fotg210, &ctrl)) {
+-				spin_unlock(&fotg210->lock);
+-				if (fotg210->driver->setup(&fotg210->gadget,
+-							   &ctrl) < 0)
+-					fotg210_set_cxstall(fotg210);
+-				spin_lock(&fotg210->lock);
+-			}
+-		}
+-		if (int_grp0 & DISGR0_CX_COMEND_INT)
+-			pr_info("fotg210 cmd end\n");
+-
+-		if (int_grp0 & DISGR0_CX_IN_INT)
+-			fotg210_ep0in(fotg210);
+-
+-		if (int_grp0 & DISGR0_CX_OUT_INT)
+-			fotg210_ep0out(fotg210);
+-
+-		if (int_grp0 & DISGR0_CX_COMFAIL_INT) {
+-			fotg210_set_cxstall(fotg210);
+-			pr_info("fotg210 ep0 fail\n");
+-		}
+-	}
+-
+-	if (int_grp & DIGR_INT_G1) {
+-		void __iomem *reg = fotg210->reg + FOTG210_DISGR1;
+-		u32 int_grp1 = ioread32(reg);
+-		u32 int_msk1 = ioread32(fotg210->reg + FOTG210_DMISGR1);
+-		int fifo;
+-
+-		int_grp1 &= ~int_msk1;
+-
+-		for (fifo = 0; fifo < FOTG210_MAX_FIFO_NUM; fifo++) {
+-			if (int_grp1 & DISGR1_IN_INT(fifo))
+-				fotg210_in_fifo_handler(fotg210->ep[fifo + 1]);
+-
+-			if ((int_grp1 & DISGR1_OUT_INT(fifo)) ||
+-			    (int_grp1 & DISGR1_SPK_INT(fifo)))
+-				fotg210_out_fifo_handler(fotg210->ep[fifo + 1]);
+-		}
+-	}
+-
+-	spin_unlock(&fotg210->lock);
+-
+-	return IRQ_HANDLED;
+-}
+-
+-static void fotg210_disable_unplug(struct fotg210_udc *fotg210)
+-{
+-	u32 reg = ioread32(fotg210->reg + FOTG210_PHYTMSR);
+-
+-	reg &= ~PHYTMSR_UNPLUG;
+-	iowrite32(reg, fotg210->reg + FOTG210_PHYTMSR);
+-}
+-
+-static int fotg210_udc_start(struct usb_gadget *g,
+-		struct usb_gadget_driver *driver)
+-{
+-	struct fotg210_udc *fotg210 = gadget_to_fotg210(g);
+-	u32 value;
+-
+-	/* hook up the driver */
+-	fotg210->driver = driver;
+-
+-	/* enable device global interrupt */
+-	value = ioread32(fotg210->reg + FOTG210_DMCR);
+-	value |= DMCR_GLINT_EN;
+-	iowrite32(value, fotg210->reg + FOTG210_DMCR);
+-
+-	return 0;
+-}
+-
+-static void fotg210_init(struct fotg210_udc *fotg210)
+-{
+-	u32 value;
+-
+-	/* disable global interrupt and set int polarity to active high */
+-	iowrite32(GMIR_MHC_INT | GMIR_MOTG_INT | GMIR_INT_POLARITY,
+-		  fotg210->reg + FOTG210_GMIR);
+-
+-	/* disable device global interrupt */
+-	value = ioread32(fotg210->reg + FOTG210_DMCR);
+-	value &= ~DMCR_GLINT_EN;
+-	iowrite32(value, fotg210->reg + FOTG210_DMCR);
+-
+-	/* enable only grp2 irqs we handle */
+-	iowrite32(~(DISGR2_DMA_ERROR | DISGR2_RX0BYTE_INT | DISGR2_TX0BYTE_INT
+-		    | DISGR2_ISO_SEQ_ABORT_INT | DISGR2_ISO_SEQ_ERR_INT
+-		    | DISGR2_RESM_INT | DISGR2_SUSP_INT | DISGR2_USBRST_INT),
+-		  fotg210->reg + FOTG210_DMISGR2);
+-
+-	/* disable all fifo interrupt */
+-	iowrite32(~(u32)0, fotg210->reg + FOTG210_DMISGR1);
+-
+-	/* disable cmd end */
+-	value = ioread32(fotg210->reg + FOTG210_DMISGR0);
+-	value |= DMISGR0_MCX_COMEND;
+-	iowrite32(value, fotg210->reg + FOTG210_DMISGR0);
+-}
+-
+-static int fotg210_udc_stop(struct usb_gadget *g)
+-{
+-	struct fotg210_udc *fotg210 = gadget_to_fotg210(g);
+-	unsigned long	flags;
+-
+-	spin_lock_irqsave(&fotg210->lock, flags);
+-
+-	fotg210_init(fotg210);
+-	fotg210->driver = NULL;
+-
+-	spin_unlock_irqrestore(&fotg210->lock, flags);
+-
+-	return 0;
+-}
+-
+-static const struct usb_gadget_ops fotg210_gadget_ops = {
+-	.udc_start		= fotg210_udc_start,
+-	.udc_stop		= fotg210_udc_stop,
+-};
+-
+-static int fotg210_udc_remove(struct platform_device *pdev)
+-{
+-	struct fotg210_udc *fotg210 = platform_get_drvdata(pdev);
+-	int i;
+-
+-	usb_del_gadget_udc(&fotg210->gadget);
+-	iounmap(fotg210->reg);
+-	free_irq(platform_get_irq(pdev, 0), fotg210);
+-
+-	fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);
+-	for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
+-		kfree(fotg210->ep[i]);
+-	kfree(fotg210);
+-
+-	return 0;
+-}
+-
+-static int fotg210_udc_probe(struct platform_device *pdev)
+-{
+-	struct resource *res, *ires;
+-	struct fotg210_udc *fotg210 = NULL;
+-	struct fotg210_ep *_ep[FOTG210_MAX_NUM_EP];
+-	int ret = 0;
+-	int i;
+-
+-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	if (!res) {
+-		pr_err("platform_get_resource error.\n");
+-		return -ENODEV;
+-	}
+-
+-	ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+-	if (!ires) {
+-		pr_err("platform_get_resource IORESOURCE_IRQ error.\n");
+-		return -ENODEV;
+-	}
+-
+-	ret = -ENOMEM;
+-
+-	/* initialize udc */
+-	fotg210 = kzalloc(sizeof(struct fotg210_udc), GFP_KERNEL);
+-	if (fotg210 == NULL)
+-		goto err;
+-
+-	for (i = 0; i < FOTG210_MAX_NUM_EP; i++) {
+-		_ep[i] = kzalloc(sizeof(struct fotg210_ep), GFP_KERNEL);
+-		if (_ep[i] == NULL)
+-			goto err_alloc;
+-		fotg210->ep[i] = _ep[i];
+-	}
+-
+-	fotg210->reg = ioremap(res->start, resource_size(res));
+-	if (fotg210->reg == NULL) {
+-		pr_err("ioremap error.\n");
+-		goto err_alloc;
+-	}
+-
+-	spin_lock_init(&fotg210->lock);
+-
+-	platform_set_drvdata(pdev, fotg210);
+-
+-	fotg210->gadget.ops = &fotg210_gadget_ops;
+-
+-	fotg210->gadget.max_speed = USB_SPEED_HIGH;
+-	fotg210->gadget.dev.parent = &pdev->dev;
+-	fotg210->gadget.dev.dma_mask = pdev->dev.dma_mask;
+-	fotg210->gadget.name = udc_name;
+-
+-	INIT_LIST_HEAD(&fotg210->gadget.ep_list);
+-
+-	for (i = 0; i < FOTG210_MAX_NUM_EP; i++) {
+-		struct fotg210_ep *ep = fotg210->ep[i];
+-
+-		if (i) {
+-			INIT_LIST_HEAD(&fotg210->ep[i]->ep.ep_list);
+-			list_add_tail(&fotg210->ep[i]->ep.ep_list,
+-				      &fotg210->gadget.ep_list);
+-		}
+-		ep->fotg210 = fotg210;
+-		INIT_LIST_HEAD(&ep->queue);
+-		ep->ep.name = fotg210_ep_name[i];
+-		ep->ep.ops = &fotg210_ep_ops;
+-		usb_ep_set_maxpacket_limit(&ep->ep, (unsigned short) ~0);
+-
+-		if (i == 0) {
+-			ep->ep.caps.type_control = true;
+-		} else {
+-			ep->ep.caps.type_iso = true;
+-			ep->ep.caps.type_bulk = true;
+-			ep->ep.caps.type_int = true;
+-		}
+-
+-		ep->ep.caps.dir_in = true;
+-		ep->ep.caps.dir_out = true;
+-	}
+-	usb_ep_set_maxpacket_limit(&fotg210->ep[0]->ep, 0x40);
+-	fotg210->gadget.ep0 = &fotg210->ep[0]->ep;
+-	INIT_LIST_HEAD(&fotg210->gadget.ep0->ep_list);
+-
+-	fotg210->ep0_req = fotg210_ep_alloc_request(&fotg210->ep[0]->ep,
+-				GFP_KERNEL);
+-	if (fotg210->ep0_req == NULL)
+-		goto err_map;
+-
+-	fotg210->ep0_req->complete = fotg210_ep0_complete;
+-
+-	fotg210_init(fotg210);
+-
+-	fotg210_disable_unplug(fotg210);
+-
+-	ret = request_irq(ires->start, fotg210_irq, IRQF_SHARED,
+-			  udc_name, fotg210);
+-	if (ret < 0) {
+-		pr_err("request_irq error (%d)\n", ret);
+-		goto err_req;
+-	}
+-
+-	ret = usb_add_gadget_udc(&pdev->dev, &fotg210->gadget);
+-	if (ret)
+-		goto err_add_udc;
+-
+-	dev_info(&pdev->dev, "version %s\n", DRIVER_VERSION);
+-
+-	return 0;
+-
+-err_add_udc:
+-	free_irq(ires->start, fotg210);
+-
+-err_req:
+-	fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);
+-
+-err_map:
+-	iounmap(fotg210->reg);
+-
+-err_alloc:
+-	for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
+-		kfree(fotg210->ep[i]);
+-	kfree(fotg210);
+-
+-err:
+-	return ret;
+-}
+-
+-static struct platform_driver fotg210_driver = {
+-	.driver		= {
+-		.name =	udc_name,
+-	},
+-	.probe		= fotg210_udc_probe,
+-	.remove		= fotg210_udc_remove,
+-};
+-
+-module_platform_driver(fotg210_driver);
+-
+-MODULE_AUTHOR("Yuan-Hsin Chen, Feng-Hsin Chiang <john453@faraday-tech.com>");
+-MODULE_LICENSE("GPL");
+-MODULE_DESCRIPTION(DRIVER_DESC);
+--- /dev/null
++++ b/drivers/usb/fotg210/fotg210-udc.c
+@@ -0,0 +1,1239 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * FOTG210 UDC Driver supports Bulk transfer so far
++ *
++ * Copyright (C) 2013 Faraday Technology Corporation
++ *
++ * Author : Yuan-Hsin Chen <yhchen@faraday-tech.com>
++ */
++
++#include <linux/dma-mapping.h>
++#include <linux/err.h>
++#include <linux/interrupt.h>
++#include <linux/io.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/usb/ch9.h>
++#include <linux/usb/gadget.h>
++
++#include "fotg210-udc.h"
++
++#define	DRIVER_DESC	"FOTG210 USB Device Controller Driver"
++#define	DRIVER_VERSION	"30-April-2013"
++
++static const char udc_name[] = "fotg210_udc";
++static const char * const fotg210_ep_name[] = {
++	"ep0", "ep1", "ep2", "ep3", "ep4"};
++
++static void fotg210_disable_fifo_int(struct fotg210_ep *ep)
++{
++	u32 value = ioread32(ep->fotg210->reg + FOTG210_DMISGR1);
++
++	if (ep->dir_in)
++		value |= DMISGR1_MF_IN_INT(ep->epnum - 1);
++	else
++		value |= DMISGR1_MF_OUTSPK_INT(ep->epnum - 1);
++	iowrite32(value, ep->fotg210->reg + FOTG210_DMISGR1);
++}
++
++static void fotg210_enable_fifo_int(struct fotg210_ep *ep)
++{
++	u32 value = ioread32(ep->fotg210->reg + FOTG210_DMISGR1);
++
++	if (ep->dir_in)
++		value &= ~DMISGR1_MF_IN_INT(ep->epnum - 1);
++	else
++		value &= ~DMISGR1_MF_OUTSPK_INT(ep->epnum - 1);
++	iowrite32(value, ep->fotg210->reg + FOTG210_DMISGR1);
++}
++
++static void fotg210_set_cxdone(struct fotg210_udc *fotg210)
++{
++	u32 value = ioread32(fotg210->reg + FOTG210_DCFESR);
++
++	value |= DCFESR_CX_DONE;
++	iowrite32(value, fotg210->reg + FOTG210_DCFESR);
++}
++
++static void fotg210_done(struct fotg210_ep *ep, struct fotg210_request *req,
++			int status)
++{
++	list_del_init(&req->queue);
++
++	/* don't modify queue heads during completion callback */
++	if (ep->fotg210->gadget.speed == USB_SPEED_UNKNOWN)
++		req->req.status = -ESHUTDOWN;
++	else
++		req->req.status = status;
++
++	spin_unlock(&ep->fotg210->lock);
++	usb_gadget_giveback_request(&ep->ep, &req->req);
++	spin_lock(&ep->fotg210->lock);
++
++	if (ep->epnum) {
++		if (list_empty(&ep->queue))
++			fotg210_disable_fifo_int(ep);
++	} else {
++		fotg210_set_cxdone(ep->fotg210);
++	}
++}
++
++static void fotg210_fifo_ep_mapping(struct fotg210_ep *ep, u32 epnum,
++				u32 dir_in)
++{
++	struct fotg210_udc *fotg210 = ep->fotg210;
++	u32 val;
++
++	/* Driver should map an ep to a fifo and then map the fifo
++	 * to the ep. What a brain-damaged design!
++	 */
++
++	/* map a fifo to an ep */
++	val = ioread32(fotg210->reg + FOTG210_EPMAP);
++	val &= ~EPMAP_FIFONOMSK(epnum, dir_in);
++	val |= EPMAP_FIFONO(epnum, dir_in);
++	iowrite32(val, fotg210->reg + FOTG210_EPMAP);
++
++	/* map the ep to the fifo */
++	val = ioread32(fotg210->reg + FOTG210_FIFOMAP);
++	val &= ~FIFOMAP_EPNOMSK(epnum);
++	val |= FIFOMAP_EPNO(epnum);
++	iowrite32(val, fotg210->reg + FOTG210_FIFOMAP);
++
++	/* enable fifo */
++	val = ioread32(fotg210->reg + FOTG210_FIFOCF);
++	val |= FIFOCF_FIFO_EN(epnum - 1);
++	iowrite32(val, fotg210->reg + FOTG210_FIFOCF);
++}
++
++static void fotg210_set_fifo_dir(struct fotg210_ep *ep, u32 epnum, u32 dir_in)
++{
++	struct fotg210_udc *fotg210 = ep->fotg210;
++	u32 val;
++
++	val = ioread32(fotg210->reg + FOTG210_FIFOMAP);
++	val |= (dir_in ? FIFOMAP_DIRIN(epnum - 1) : FIFOMAP_DIROUT(epnum - 1));
++	iowrite32(val, fotg210->reg + FOTG210_FIFOMAP);
++}
++
++static void fotg210_set_tfrtype(struct fotg210_ep *ep, u32 epnum, u32 type)
++{
++	struct fotg210_udc *fotg210 = ep->fotg210;
++	u32 val;
++
++	val = ioread32(fotg210->reg + FOTG210_FIFOCF);
++	val |= FIFOCF_TYPE(type, epnum - 1);
++	iowrite32(val, fotg210->reg + FOTG210_FIFOCF);
++}
++
++static void fotg210_set_mps(struct fotg210_ep *ep, u32 epnum, u32 mps,
++				u32 dir_in)
++{
++	struct fotg210_udc *fotg210 = ep->fotg210;
++	u32 val;
++	u32 offset = dir_in ? FOTG210_INEPMPSR(epnum) :
++				FOTG210_OUTEPMPSR(epnum);
++
++	val = ioread32(fotg210->reg + offset);
++	val |= INOUTEPMPSR_MPS(mps);
++	iowrite32(val, fotg210->reg + offset);
++}
++
++static int fotg210_config_ep(struct fotg210_ep *ep,
++		     const struct usb_endpoint_descriptor *desc)
++{
++	struct fotg210_udc *fotg210 = ep->fotg210;
++
++	fotg210_set_fifo_dir(ep, ep->epnum, ep->dir_in);
++	fotg210_set_tfrtype(ep, ep->epnum, ep->type);
++	fotg210_set_mps(ep, ep->epnum, ep->ep.maxpacket, ep->dir_in);
++	fotg210_fifo_ep_mapping(ep, ep->epnum, ep->dir_in);
++
++	fotg210->ep[ep->epnum] = ep;
++
++	return 0;
++}
++
++static int fotg210_ep_enable(struct usb_ep *_ep,
++			  const struct usb_endpoint_descriptor *desc)
++{
++	struct fotg210_ep *ep;
++
++	ep = container_of(_ep, struct fotg210_ep, ep);
++
++	ep->desc = desc;
++	ep->epnum = usb_endpoint_num(desc);
++	ep->type = usb_endpoint_type(desc);
++	ep->dir_in = usb_endpoint_dir_in(desc);
++	ep->ep.maxpacket = usb_endpoint_maxp(desc);
++
++	return fotg210_config_ep(ep, desc);
++}
++
++static void fotg210_reset_tseq(struct fotg210_udc *fotg210, u8 epnum)
++{
++	struct fotg210_ep *ep = fotg210->ep[epnum];
++	u32 value;
++	void __iomem *reg;
++
++	reg = (ep->dir_in) ?
++		fotg210->reg + FOTG210_INEPMPSR(epnum) :
++		fotg210->reg + FOTG210_OUTEPMPSR(epnum);
++
++	/* Note: Driver needs to set and clear INOUTEPMPSR_RESET_TSEQ
++	 *	 bit. Controller wouldn't clear this bit. WTF!!!
++	 */
++
++	value = ioread32(reg);
++	value |= INOUTEPMPSR_RESET_TSEQ;
++	iowrite32(value, reg);
++
++	value = ioread32(reg);
++	value &= ~INOUTEPMPSR_RESET_TSEQ;
++	iowrite32(value, reg);
++}
++
++static int fotg210_ep_release(struct fotg210_ep *ep)
++{
++	if (!ep->epnum)
++		return 0;
++	ep->epnum = 0;
++	ep->stall = 0;
++	ep->wedged = 0;
++
++	fotg210_reset_tseq(ep->fotg210, ep->epnum);
++
++	return 0;
++}
++
++static int fotg210_ep_disable(struct usb_ep *_ep)
++{
++	struct fotg210_ep *ep;
++	struct fotg210_request *req;
++	unsigned long flags;
++
++	BUG_ON(!_ep);
++
++	ep = container_of(_ep, struct fotg210_ep, ep);
++
++	while (!list_empty(&ep->queue)) {
++		req = list_entry(ep->queue.next,
++			struct fotg210_request, queue);
++		spin_lock_irqsave(&ep->fotg210->lock, flags);
++		fotg210_done(ep, req, -ECONNRESET);
++		spin_unlock_irqrestore(&ep->fotg210->lock, flags);
++	}
++
++	return fotg210_ep_release(ep);
++}
++
++static struct usb_request *fotg210_ep_alloc_request(struct usb_ep *_ep,
++						gfp_t gfp_flags)
++{
++	struct fotg210_request *req;
++
++	req = kzalloc(sizeof(struct fotg210_request), gfp_flags);
++	if (!req)
++		return NULL;
++
++	INIT_LIST_HEAD(&req->queue);
++
++	return &req->req;
++}
++
++static void fotg210_ep_free_request(struct usb_ep *_ep,
++					struct usb_request *_req)
++{
++	struct fotg210_request *req;
++
++	req = container_of(_req, struct fotg210_request, req);
++	kfree(req);
++}
++
++static void fotg210_enable_dma(struct fotg210_ep *ep,
++			      dma_addr_t d, u32 len)
++{
++	u32 value;
++	struct fotg210_udc *fotg210 = ep->fotg210;
++
++	/* set transfer length and direction */
++	value = ioread32(fotg210->reg + FOTG210_DMACPSR1);
++	value &= ~(DMACPSR1_DMA_LEN(0xFFFF) | DMACPSR1_DMA_TYPE(1));
++	value |= DMACPSR1_DMA_LEN(len) | DMACPSR1_DMA_TYPE(ep->dir_in);
++	iowrite32(value, fotg210->reg + FOTG210_DMACPSR1);
++
++	/* set device DMA target FIFO number */
++	value = ioread32(fotg210->reg + FOTG210_DMATFNR);
++	if (ep->epnum)
++		value |= DMATFNR_ACC_FN(ep->epnum - 1);
++	else
++		value |= DMATFNR_ACC_CXF;
++	iowrite32(value, fotg210->reg + FOTG210_DMATFNR);
++
++	/* set DMA memory address */
++	iowrite32(d, fotg210->reg + FOTG210_DMACPSR2);
++
++	/* enable MDMA_EROR and MDMA_CMPLT interrupt */
++	value = ioread32(fotg210->reg + FOTG210_DMISGR2);
++	value &= ~(DMISGR2_MDMA_CMPLT | DMISGR2_MDMA_ERROR);
++	iowrite32(value, fotg210->reg + FOTG210_DMISGR2);
++
++	/* start DMA */
++	value = ioread32(fotg210->reg + FOTG210_DMACPSR1);
++	value |= DMACPSR1_DMA_START;
++	iowrite32(value, fotg210->reg + FOTG210_DMACPSR1);
++}
++
++static void fotg210_disable_dma(struct fotg210_ep *ep)
++{
++	iowrite32(DMATFNR_DISDMA, ep->fotg210->reg + FOTG210_DMATFNR);
++}
++
++static void fotg210_wait_dma_done(struct fotg210_ep *ep)
++{
++	u32 value;
++
++	do {
++		value = ioread32(ep->fotg210->reg + FOTG210_DISGR2);
++		if ((value & DISGR2_USBRST_INT) ||
++		    (value & DISGR2_DMA_ERROR))
++			goto dma_reset;
++	} while (!(value & DISGR2_DMA_CMPLT));
++
++	value &= ~DISGR2_DMA_CMPLT;
++	iowrite32(value, ep->fotg210->reg + FOTG210_DISGR2);
++	return;
++
++dma_reset:
++	value = ioread32(ep->fotg210->reg + FOTG210_DMACPSR1);
++	value |= DMACPSR1_DMA_ABORT;
++	iowrite32(value, ep->fotg210->reg + FOTG210_DMACPSR1);
++
++	/* reset fifo */
++	if (ep->epnum) {
++		value = ioread32(ep->fotg210->reg +
++				FOTG210_FIBCR(ep->epnum - 1));
++		value |= FIBCR_FFRST;
++		iowrite32(value, ep->fotg210->reg +
++				FOTG210_FIBCR(ep->epnum - 1));
++	} else {
++		value = ioread32(ep->fotg210->reg + FOTG210_DCFESR);
++		value |= DCFESR_CX_CLR;
++		iowrite32(value, ep->fotg210->reg + FOTG210_DCFESR);
++	}
++}
++
++static void fotg210_start_dma(struct fotg210_ep *ep,
++			struct fotg210_request *req)
++{
++	struct device *dev = &ep->fotg210->gadget.dev;
++	dma_addr_t d;
++	u8 *buffer;
++	u32 length;
++
++	if (ep->epnum) {
++		if (ep->dir_in) {
++			buffer = req->req.buf;
++			length = req->req.length;
++		} else {
++			buffer = req->req.buf + req->req.actual;
++			length = ioread32(ep->fotg210->reg +
++					FOTG210_FIBCR(ep->epnum - 1)) & FIBCR_BCFX;
++			if (length > req->req.length - req->req.actual)
++				length = req->req.length - req->req.actual;
++		}
++	} else {
++		buffer = req->req.buf + req->req.actual;
++		if (req->req.length - req->req.actual > ep->ep.maxpacket)
++			length = ep->ep.maxpacket;
++		else
++			length = req->req.length - req->req.actual;
++	}
++
++	d = dma_map_single(dev, buffer, length,
++			ep->dir_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
++
++	if (dma_mapping_error(dev, d)) {
++		pr_err("dma_mapping_error\n");
++		return;
++	}
++
++	fotg210_enable_dma(ep, d, length);
++
++	/* check if dma is done */
++	fotg210_wait_dma_done(ep);
++
++	fotg210_disable_dma(ep);
++
++	/* update actual transfer length */
++	req->req.actual += length;
++
++	dma_unmap_single(dev, d, length, DMA_TO_DEVICE);
++}
++
++static void fotg210_ep0_queue(struct fotg210_ep *ep,
++				struct fotg210_request *req)
++{
++	if (!req->req.length) {
++		fotg210_done(ep, req, 0);
++		return;
++	}
++	if (ep->dir_in) { /* if IN */
++		fotg210_start_dma(ep, req);
++		if (req->req.length == req->req.actual)
++			fotg210_done(ep, req, 0);
++	} else { /* OUT */
++		u32 value = ioread32(ep->fotg210->reg + FOTG210_DMISGR0);
++
++		value &= ~DMISGR0_MCX_OUT_INT;
++		iowrite32(value, ep->fotg210->reg + FOTG210_DMISGR0);
++	}
++}
++
++static int fotg210_ep_queue(struct usb_ep *_ep, struct usb_request *_req,
++				gfp_t gfp_flags)
++{
++	struct fotg210_ep *ep;
++	struct fotg210_request *req;
++	unsigned long flags;
++	int request = 0;
++
++	ep = container_of(_ep, struct fotg210_ep, ep);
++	req = container_of(_req, struct fotg210_request, req);
++
++	if (ep->fotg210->gadget.speed == USB_SPEED_UNKNOWN)
++		return -ESHUTDOWN;
++
++	spin_lock_irqsave(&ep->fotg210->lock, flags);
++
++	if (list_empty(&ep->queue))
++		request = 1;
++
++	list_add_tail(&req->queue, &ep->queue);
++
++	req->req.actual = 0;
++	req->req.status = -EINPROGRESS;
++
++	if (!ep->epnum) /* ep0 */
++		fotg210_ep0_queue(ep, req);
++	else if (request && !ep->stall)
++		fotg210_enable_fifo_int(ep);
++
++	spin_unlock_irqrestore(&ep->fotg210->lock, flags);
++
++	return 0;
++}
++
++static int fotg210_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
++{
++	struct fotg210_ep *ep;
++	struct fotg210_request *req;
++	unsigned long flags;
++
++	ep = container_of(_ep, struct fotg210_ep, ep);
++	req = container_of(_req, struct fotg210_request, req);
++
++	spin_lock_irqsave(&ep->fotg210->lock, flags);
++	if (!list_empty(&ep->queue))
++		fotg210_done(ep, req, -ECONNRESET);
++	spin_unlock_irqrestore(&ep->fotg210->lock, flags);
++
++	return 0;
++}
++
++static void fotg210_set_epnstall(struct fotg210_ep *ep)
++{
++	struct fotg210_udc *fotg210 = ep->fotg210;
++	u32 value;
++	void __iomem *reg;
++
++	/* check if IN FIFO is empty before stall */
++	if (ep->dir_in) {
++		do {
++			value = ioread32(fotg210->reg + FOTG210_DCFESR);
++		} while (!(value & DCFESR_FIFO_EMPTY(ep->epnum - 1)));
++	}
++
++	reg = (ep->dir_in) ?
++		fotg210->reg + FOTG210_INEPMPSR(ep->epnum) :
++		fotg210->reg + FOTG210_OUTEPMPSR(ep->epnum);
++	value = ioread32(reg);
++	value |= INOUTEPMPSR_STL_EP;
++	iowrite32(value, reg);
++}
++
++static void fotg210_clear_epnstall(struct fotg210_ep *ep)
++{
++	struct fotg210_udc *fotg210 = ep->fotg210;
++	u32 value;
++	void __iomem *reg;
++
++	reg = (ep->dir_in) ?
++		fotg210->reg + FOTG210_INEPMPSR(ep->epnum) :
++		fotg210->reg + FOTG210_OUTEPMPSR(ep->epnum);
++	value = ioread32(reg);
++	value &= ~INOUTEPMPSR_STL_EP;
++	iowrite32(value, reg);
++}
++
++static int fotg210_set_halt_and_wedge(struct usb_ep *_ep, int value, int wedge)
++{
++	struct fotg210_ep *ep;
++	struct fotg210_udc *fotg210;
++	unsigned long flags;
++
++	ep = container_of(_ep, struct fotg210_ep, ep);
++
++	fotg210 = ep->fotg210;
++
++	spin_lock_irqsave(&ep->fotg210->lock, flags);
++
++	if (value) {
++		fotg210_set_epnstall(ep);
++		ep->stall = 1;
++		if (wedge)
++			ep->wedged = 1;
++	} else {
++		fotg210_reset_tseq(fotg210, ep->epnum);
++		fotg210_clear_epnstall(ep);
++		ep->stall = 0;
++		ep->wedged = 0;
++		if (!list_empty(&ep->queue))
++			fotg210_enable_fifo_int(ep);
++	}
++
++	spin_unlock_irqrestore(&ep->fotg210->lock, flags);
++	return 0;
++}
++
++static int fotg210_ep_set_halt(struct usb_ep *_ep, int value)
++{
++	return fotg210_set_halt_and_wedge(_ep, value, 0);
++}
++
++static int fotg210_ep_set_wedge(struct usb_ep *_ep)
++{
++	return fotg210_set_halt_and_wedge(_ep, 1, 1);
++}
++
++static void fotg210_ep_fifo_flush(struct usb_ep *_ep)
++{
++}
++
++static const struct usb_ep_ops fotg210_ep_ops = {
++	.enable		= fotg210_ep_enable,
++	.disable	= fotg210_ep_disable,
++
++	.alloc_request	= fotg210_ep_alloc_request,
++	.free_request	= fotg210_ep_free_request,
++
++	.queue		= fotg210_ep_queue,
++	.dequeue	= fotg210_ep_dequeue,
++
++	.set_halt	= fotg210_ep_set_halt,
++	.fifo_flush	= fotg210_ep_fifo_flush,
++	.set_wedge	= fotg210_ep_set_wedge,
++};
++
++static void fotg210_clear_tx0byte(struct fotg210_udc *fotg210)
++{
++	u32 value = ioread32(fotg210->reg + FOTG210_TX0BYTE);
++
++	value &= ~(TX0BYTE_EP1 | TX0BYTE_EP2 | TX0BYTE_EP3
++		   | TX0BYTE_EP4);
++	iowrite32(value, fotg210->reg + FOTG210_TX0BYTE);
++}
++
++static void fotg210_clear_rx0byte(struct fotg210_udc *fotg210)
++{
++	u32 value = ioread32(fotg210->reg + FOTG210_RX0BYTE);
++
++	value &= ~(RX0BYTE_EP1 | RX0BYTE_EP2 | RX0BYTE_EP3
++		   | RX0BYTE_EP4);
++	iowrite32(value, fotg210->reg + FOTG210_RX0BYTE);
++}
++
++/* read 8-byte setup packet only */
++static void fotg210_rdsetupp(struct fotg210_udc *fotg210,
++		   u8 *buffer)
++{
++	int i = 0;
++	u8 *tmp = buffer;
++	u32 data;
++	u32 length = 8;
++
++	iowrite32(DMATFNR_ACC_CXF, fotg210->reg + FOTG210_DMATFNR);
++
++	for (i = (length >> 2); i > 0; i--) {
++		data = ioread32(fotg210->reg + FOTG210_CXPORT);
++		*tmp = data & 0xFF;
++		*(tmp + 1) = (data >> 8) & 0xFF;
++		*(tmp + 2) = (data >> 16) & 0xFF;
++		*(tmp + 3) = (data >> 24) & 0xFF;
++		tmp = tmp + 4;
++	}
++
++	switch (length % 4) {
++	case 1:
++		data = ioread32(fotg210->reg + FOTG210_CXPORT);
++		*tmp = data & 0xFF;
++		break;
++	case 2:
++		data = ioread32(fotg210->reg + FOTG210_CXPORT);
++		*tmp = data & 0xFF;
++		*(tmp + 1) = (data >> 8) & 0xFF;
++		break;
++	case 3:
++		data = ioread32(fotg210->reg + FOTG210_CXPORT);
++		*tmp = data & 0xFF;
++		*(tmp + 1) = (data >> 8) & 0xFF;
++		*(tmp + 2) = (data >> 16) & 0xFF;
++		break;
++	default:
++		break;
++	}
++
++	iowrite32(DMATFNR_DISDMA, fotg210->reg + FOTG210_DMATFNR);
++}
++
++static void fotg210_set_configuration(struct fotg210_udc *fotg210)
++{
++	u32 value = ioread32(fotg210->reg + FOTG210_DAR);
++
++	value |= DAR_AFT_CONF;
++	iowrite32(value, fotg210->reg + FOTG210_DAR);
++}
++
++static void fotg210_set_dev_addr(struct fotg210_udc *fotg210, u32 addr)
++{
++	u32 value = ioread32(fotg210->reg + FOTG210_DAR);
++
++	value |= (addr & 0x7F);
++	iowrite32(value, fotg210->reg + FOTG210_DAR);
++}
++
++static void fotg210_set_cxstall(struct fotg210_udc *fotg210)
++{
++	u32 value = ioread32(fotg210->reg + FOTG210_DCFESR);
++
++	value |= DCFESR_CX_STL;
++	iowrite32(value, fotg210->reg + FOTG210_DCFESR);
++}
++
++static void fotg210_request_error(struct fotg210_udc *fotg210)
++{
++	fotg210_set_cxstall(fotg210);
++	pr_err("request error!!\n");
++}
++
++static void fotg210_set_address(struct fotg210_udc *fotg210,
++				struct usb_ctrlrequest *ctrl)
++{
++	if (le16_to_cpu(ctrl->wValue) >= 0x0100) {
++		fotg210_request_error(fotg210);
++	} else {
++		fotg210_set_dev_addr(fotg210, le16_to_cpu(ctrl->wValue));
++		fotg210_set_cxdone(fotg210);
++	}
++}
++
++static void fotg210_set_feature(struct fotg210_udc *fotg210,
++				struct usb_ctrlrequest *ctrl)
++{
++	switch (ctrl->bRequestType & USB_RECIP_MASK) {
++	case USB_RECIP_DEVICE:
++		fotg210_set_cxdone(fotg210);
++		break;
++	case USB_RECIP_INTERFACE:
++		fotg210_set_cxdone(fotg210);
++		break;
++	case USB_RECIP_ENDPOINT: {
++		u8 epnum;
++		epnum = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK;
++		if (epnum)
++			fotg210_set_epnstall(fotg210->ep[epnum]);
++		else
++			fotg210_set_cxstall(fotg210);
++		fotg210_set_cxdone(fotg210);
++		}
++		break;
++	default:
++		fotg210_request_error(fotg210);
++		break;
++	}
++}
++
++static void fotg210_clear_feature(struct fotg210_udc *fotg210,
++				struct usb_ctrlrequest *ctrl)
++{
++	struct fotg210_ep *ep =
++		fotg210->ep[ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK];
++
++	switch (ctrl->bRequestType & USB_RECIP_MASK) {
++	case USB_RECIP_DEVICE:
++		fotg210_set_cxdone(fotg210);
++		break;
++	case USB_RECIP_INTERFACE:
++		fotg210_set_cxdone(fotg210);
++		break;
++	case USB_RECIP_ENDPOINT:
++		if (ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK) {
++			if (ep->wedged) {
++				fotg210_set_cxdone(fotg210);
++				break;
++			}
++			if (ep->stall)
++				fotg210_set_halt_and_wedge(&ep->ep, 0, 0);
++		}
++		fotg210_set_cxdone(fotg210);
++		break;
++	default:
++		fotg210_request_error(fotg210);
++		break;
++	}
++}
++
++static int fotg210_is_epnstall(struct fotg210_ep *ep)
++{
++	struct fotg210_udc *fotg210 = ep->fotg210;
++	u32 value;
++	void __iomem *reg;
++
++	reg = (ep->dir_in) ?
++		fotg210->reg + FOTG210_INEPMPSR(ep->epnum) :
++		fotg210->reg + FOTG210_OUTEPMPSR(ep->epnum);
++	value = ioread32(reg);
++	return value & INOUTEPMPSR_STL_EP ? 1 : 0;
++}
++
++/* For EP0 requests triggered by this driver (currently GET_STATUS response) */
++static void fotg210_ep0_complete(struct usb_ep *_ep, struct usb_request *req)
++{
++	struct fotg210_ep *ep;
++	struct fotg210_udc *fotg210;
++
++	ep = container_of(_ep, struct fotg210_ep, ep);
++	fotg210 = ep->fotg210;
++
++	if (req->status || req->actual != req->length) {
++		dev_warn(&fotg210->gadget.dev, "EP0 request failed: %d\n", req->status);
++	}
++}
++
++static void fotg210_get_status(struct fotg210_udc *fotg210,
++				struct usb_ctrlrequest *ctrl)
++{
++	u8 epnum;
++
++	switch (ctrl->bRequestType & USB_RECIP_MASK) {
++	case USB_RECIP_DEVICE:
++		fotg210->ep0_data = cpu_to_le16(1 << USB_DEVICE_SELF_POWERED);
++		break;
++	case USB_RECIP_INTERFACE:
++		fotg210->ep0_data = cpu_to_le16(0);
++		break;
++	case USB_RECIP_ENDPOINT:
++		epnum = ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK;
++		if (epnum)
++			fotg210->ep0_data =
++				cpu_to_le16(fotg210_is_epnstall(fotg210->ep[epnum])
++					    << USB_ENDPOINT_HALT);
++		else
++			fotg210_request_error(fotg210);
++		break;
++
++	default:
++		fotg210_request_error(fotg210);
++		return;		/* exit */
++	}
++
++	fotg210->ep0_req->buf = &fotg210->ep0_data;
++	fotg210->ep0_req->length = 2;
++
++	spin_unlock(&fotg210->lock);
++	fotg210_ep_queue(fotg210->gadget.ep0, fotg210->ep0_req, GFP_ATOMIC);
++	spin_lock(&fotg210->lock);
++}
++
++static int fotg210_setup_packet(struct fotg210_udc *fotg210,
++				struct usb_ctrlrequest *ctrl)
++{
++	u8 *p = (u8 *)ctrl;
++	u8 ret = 0;
++
++	fotg210_rdsetupp(fotg210, p);
++
++	fotg210->ep[0]->dir_in = ctrl->bRequestType & USB_DIR_IN;
++
++	if (fotg210->gadget.speed == USB_SPEED_UNKNOWN) {
++		u32 value = ioread32(fotg210->reg + FOTG210_DMCR);
++		fotg210->gadget.speed = value & DMCR_HS_EN ?
++				USB_SPEED_HIGH : USB_SPEED_FULL;
++	}
++
++	/* check request */
++	if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD) {
++		switch (ctrl->bRequest) {
++		case USB_REQ_GET_STATUS:
++			fotg210_get_status(fotg210, ctrl);
++			break;
++		case USB_REQ_CLEAR_FEATURE:
++			fotg210_clear_feature(fotg210, ctrl);
++			break;
++		case USB_REQ_SET_FEATURE:
++			fotg210_set_feature(fotg210, ctrl);
++			break;
++		case USB_REQ_SET_ADDRESS:
++			fotg210_set_address(fotg210, ctrl);
++			break;
++		case USB_REQ_SET_CONFIGURATION:
++			fotg210_set_configuration(fotg210);
++			ret = 1;
++			break;
++		default:
++			ret = 1;
++			break;
++		}
++	} else {
++		ret = 1;
++	}
++
++	return ret;
++}
++
++static void fotg210_ep0out(struct fotg210_udc *fotg210)
++{
++	struct fotg210_ep *ep = fotg210->ep[0];
++
++	if (!list_empty(&ep->queue) && !ep->dir_in) {
++		struct fotg210_request *req;
++
++		req = list_first_entry(&ep->queue,
++			struct fotg210_request, queue);
++
++		if (req->req.length)
++			fotg210_start_dma(ep, req);
++
++		if ((req->req.length - req->req.actual) < ep->ep.maxpacket)
++			fotg210_done(ep, req, 0);
++	} else {
++		pr_err("%s : empty queue\n", __func__);
++	}
++}
++
++static void fotg210_ep0in(struct fotg210_udc *fotg210)
++{
++	struct fotg210_ep *ep = fotg210->ep[0];
++
++	if ((!list_empty(&ep->queue)) && (ep->dir_in)) {
++		struct fotg210_request *req;
++
++		req = list_entry(ep->queue.next,
++				struct fotg210_request, queue);
++
++		if (req->req.length)
++			fotg210_start_dma(ep, req);
++
++		if (req->req.actual == req->req.length)
++			fotg210_done(ep, req, 0);
++	} else {
++		fotg210_set_cxdone(fotg210);
++	}
++}
++
++static void fotg210_clear_comabt_int(struct fotg210_udc *fotg210)
++{
++	u32 value = ioread32(fotg210->reg + FOTG210_DISGR0);
++
++	value &= ~DISGR0_CX_COMABT_INT;
++	iowrite32(value, fotg210->reg + FOTG210_DISGR0);
++}
++
++static void fotg210_in_fifo_handler(struct fotg210_ep *ep)
++{
++	struct fotg210_request *req = list_entry(ep->queue.next,
++					struct fotg210_request, queue);
++
++	if (req->req.length)
++		fotg210_start_dma(ep, req);
++	fotg210_done(ep, req, 0);
++}
++
++static void fotg210_out_fifo_handler(struct fotg210_ep *ep)
++{
++	struct fotg210_request *req = list_entry(ep->queue.next,
++						 struct fotg210_request, queue);
++	int disgr1 = ioread32(ep->fotg210->reg + FOTG210_DISGR1);
++
++	fotg210_start_dma(ep, req);
++
++	/* Complete the request when it's full or a short packet arrived.
++	 * Like other drivers, short_not_ok isn't handled.
++	 */
++
++	if (req->req.length == req->req.actual ||
++	    (disgr1 & DISGR1_SPK_INT(ep->epnum - 1)))
++		fotg210_done(ep, req, 0);
++}
++
++static irqreturn_t fotg210_irq(int irq, void *_fotg210)
++{
++	struct fotg210_udc *fotg210 = _fotg210;
++	u32 int_grp = ioread32(fotg210->reg + FOTG210_DIGR);
++	u32 int_msk = ioread32(fotg210->reg + FOTG210_DMIGR);
++
++	int_grp &= ~int_msk;
++
++	spin_lock(&fotg210->lock);
++
++	if (int_grp & DIGR_INT_G2) {
++		void __iomem *reg = fotg210->reg + FOTG210_DISGR2;
++		u32 int_grp2 = ioread32(reg);
++		u32 int_msk2 = ioread32(fotg210->reg + FOTG210_DMISGR2);
++		u32 value;
++
++		int_grp2 &= ~int_msk2;
++
++		if (int_grp2 & DISGR2_USBRST_INT) {
++			usb_gadget_udc_reset(&fotg210->gadget,
++					     fotg210->driver);
++			value = ioread32(reg);
++			value &= ~DISGR2_USBRST_INT;
++			iowrite32(value, reg);
++			pr_info("fotg210 udc reset\n");
++		}
++		if (int_grp2 & DISGR2_SUSP_INT) {
++			value = ioread32(reg);
++			value &= ~DISGR2_SUSP_INT;
++			iowrite32(value, reg);
++			pr_info("fotg210 udc suspend\n");
++		}
++		if (int_grp2 & DISGR2_RESM_INT) {
++			value = ioread32(reg);
++			value &= ~DISGR2_RESM_INT;
++			iowrite32(value, reg);
++			pr_info("fotg210 udc resume\n");
++		}
++		if (int_grp2 & DISGR2_ISO_SEQ_ERR_INT) {
++			value = ioread32(reg);
++			value &= ~DISGR2_ISO_SEQ_ERR_INT;
++			iowrite32(value, reg);
++			pr_info("fotg210 iso sequence error\n");
++		}
++		if (int_grp2 & DISGR2_ISO_SEQ_ABORT_INT) {
++			value = ioread32(reg);
++			value &= ~DISGR2_ISO_SEQ_ABORT_INT;
++			iowrite32(value, reg);
++			pr_info("fotg210 iso sequence abort\n");
++		}
++		if (int_grp2 & DISGR2_TX0BYTE_INT) {
++			fotg210_clear_tx0byte(fotg210);
++			value = ioread32(reg);
++			value &= ~DISGR2_TX0BYTE_INT;
++			iowrite32(value, reg);
++			pr_info("fotg210 transferred 0 byte\n");
++		}
++		if (int_grp2 & DISGR2_RX0BYTE_INT) {
++			fotg210_clear_rx0byte(fotg210);
++			value = ioread32(reg);
++			value &= ~DISGR2_RX0BYTE_INT;
++			iowrite32(value, reg);
++			pr_info("fotg210 received 0 byte\n");
++		}
++		if (int_grp2 & DISGR2_DMA_ERROR) {
++			value = ioread32(reg);
++			value &= ~DISGR2_DMA_ERROR;
++			iowrite32(value, reg);
++		}
++	}
++
++	if (int_grp & DIGR_INT_G0) {
++		void __iomem *reg = fotg210->reg + FOTG210_DISGR0;
++		u32 int_grp0 = ioread32(reg);
++		u32 int_msk0 = ioread32(fotg210->reg + FOTG210_DMISGR0);
++		struct usb_ctrlrequest ctrl;
++
++		int_grp0 &= ~int_msk0;
++
++		/* the highest priority in this source register */
++		if (int_grp0 & DISGR0_CX_COMABT_INT) {
++			fotg210_clear_comabt_int(fotg210);
++			pr_info("fotg210 CX command abort\n");
++		}
++
++		if (int_grp0 & DISGR0_CX_SETUP_INT) {
++			if (fotg210_setup_packet(fotg210, &ctrl)) {
++				spin_unlock(&fotg210->lock);
++				if (fotg210->driver->setup(&fotg210->gadget,
++							   &ctrl) < 0)
++					fotg210_set_cxstall(fotg210);
++				spin_lock(&fotg210->lock);
++			}
++		}
++		if (int_grp0 & DISGR0_CX_COMEND_INT)
++			pr_info("fotg210 cmd end\n");
++
++		if (int_grp0 & DISGR0_CX_IN_INT)
++			fotg210_ep0in(fotg210);
++
++		if (int_grp0 & DISGR0_CX_OUT_INT)
++			fotg210_ep0out(fotg210);
++
++		if (int_grp0 & DISGR0_CX_COMFAIL_INT) {
++			fotg210_set_cxstall(fotg210);
++			pr_info("fotg210 ep0 fail\n");
++		}
++	}
++
++	if (int_grp & DIGR_INT_G1) {
++		void __iomem *reg = fotg210->reg + FOTG210_DISGR1;
++		u32 int_grp1 = ioread32(reg);
++		u32 int_msk1 = ioread32(fotg210->reg + FOTG210_DMISGR1);
++		int fifo;
++
++		int_grp1 &= ~int_msk1;
++
++		for (fifo = 0; fifo < FOTG210_MAX_FIFO_NUM; fifo++) {
++			if (int_grp1 & DISGR1_IN_INT(fifo))
++				fotg210_in_fifo_handler(fotg210->ep[fifo + 1]);
++
++			if ((int_grp1 & DISGR1_OUT_INT(fifo)) ||
++			    (int_grp1 & DISGR1_SPK_INT(fifo)))
++				fotg210_out_fifo_handler(fotg210->ep[fifo + 1]);
++		}
++	}
++
++	spin_unlock(&fotg210->lock);
++
++	return IRQ_HANDLED;
++}
++
++static void fotg210_disable_unplug(struct fotg210_udc *fotg210)
++{
++	u32 reg = ioread32(fotg210->reg + FOTG210_PHYTMSR);
++
++	reg &= ~PHYTMSR_UNPLUG;
++	iowrite32(reg, fotg210->reg + FOTG210_PHYTMSR);
++}
++
++static int fotg210_udc_start(struct usb_gadget *g,
++		struct usb_gadget_driver *driver)
++{
++	struct fotg210_udc *fotg210 = gadget_to_fotg210(g);
++	u32 value;
++
++	/* hook up the driver */
++	fotg210->driver = driver;
++
++	/* enable device global interrupt */
++	value = ioread32(fotg210->reg + FOTG210_DMCR);
++	value |= DMCR_GLINT_EN;
++	iowrite32(value, fotg210->reg + FOTG210_DMCR);
++
++	return 0;
++}
++
++static void fotg210_init(struct fotg210_udc *fotg210)
++{
++	u32 value;
++
++	/* disable global interrupt and set int polarity to active high */
++	iowrite32(GMIR_MHC_INT | GMIR_MOTG_INT | GMIR_INT_POLARITY,
++		  fotg210->reg + FOTG210_GMIR);
++
++	/* disable device global interrupt */
++	value = ioread32(fotg210->reg + FOTG210_DMCR);
++	value &= ~DMCR_GLINT_EN;
++	iowrite32(value, fotg210->reg + FOTG210_DMCR);
++
++	/* enable only grp2 irqs we handle */
++	iowrite32(~(DISGR2_DMA_ERROR | DISGR2_RX0BYTE_INT | DISGR2_TX0BYTE_INT
++		    | DISGR2_ISO_SEQ_ABORT_INT | DISGR2_ISO_SEQ_ERR_INT
++		    | DISGR2_RESM_INT | DISGR2_SUSP_INT | DISGR2_USBRST_INT),
++		  fotg210->reg + FOTG210_DMISGR2);
++
++	/* disable all fifo interrupt */
++	iowrite32(~(u32)0, fotg210->reg + FOTG210_DMISGR1);
++
++	/* disable cmd end */
++	value = ioread32(fotg210->reg + FOTG210_DMISGR0);
++	value |= DMISGR0_MCX_COMEND;
++	iowrite32(value, fotg210->reg + FOTG210_DMISGR0);
++}
++
++static int fotg210_udc_stop(struct usb_gadget *g)
++{
++	struct fotg210_udc *fotg210 = gadget_to_fotg210(g);
++	unsigned long	flags;
++
++	spin_lock_irqsave(&fotg210->lock, flags);
++
++	fotg210_init(fotg210);
++	fotg210->driver = NULL;
++
++	spin_unlock_irqrestore(&fotg210->lock, flags);
++
++	return 0;
++}
++
++static const struct usb_gadget_ops fotg210_gadget_ops = {
++	.udc_start		= fotg210_udc_start,
++	.udc_stop		= fotg210_udc_stop,
++};
++
++static int fotg210_udc_remove(struct platform_device *pdev)
++{
++	struct fotg210_udc *fotg210 = platform_get_drvdata(pdev);
++	int i;
++
++	usb_del_gadget_udc(&fotg210->gadget);
++	iounmap(fotg210->reg);
++	free_irq(platform_get_irq(pdev, 0), fotg210);
++
++	fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);
++	for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
++		kfree(fotg210->ep[i]);
++	kfree(fotg210);
++
++	return 0;
++}
++
++static int fotg210_udc_probe(struct platform_device *pdev)
++{
++	struct resource *res, *ires;
++	struct fotg210_udc *fotg210 = NULL;
++	struct fotg210_ep *_ep[FOTG210_MAX_NUM_EP];
++	int ret = 0;
++	int i;
++
++	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if (!res) {
++		pr_err("platform_get_resource error.\n");
++		return -ENODEV;
++	}
++
++	ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
++	if (!ires) {
++		pr_err("platform_get_resource IORESOURCE_IRQ error.\n");
++		return -ENODEV;
++	}
++
++	ret = -ENOMEM;
++
++	/* initialize udc */
++	fotg210 = kzalloc(sizeof(struct fotg210_udc), GFP_KERNEL);
++	if (fotg210 == NULL)
++		goto err;
++
++	for (i = 0; i < FOTG210_MAX_NUM_EP; i++) {
++		_ep[i] = kzalloc(sizeof(struct fotg210_ep), GFP_KERNEL);
++		if (_ep[i] == NULL)
++			goto err_alloc;
++		fotg210->ep[i] = _ep[i];
++	}
++
++	fotg210->reg = ioremap(res->start, resource_size(res));
++	if (fotg210->reg == NULL) {
++		pr_err("ioremap error.\n");
++		goto err_alloc;
++	}
++
++	spin_lock_init(&fotg210->lock);
++
++	platform_set_drvdata(pdev, fotg210);
++
++	fotg210->gadget.ops = &fotg210_gadget_ops;
++
++	fotg210->gadget.max_speed = USB_SPEED_HIGH;
++	fotg210->gadget.dev.parent = &pdev->dev;
++	fotg210->gadget.dev.dma_mask = pdev->dev.dma_mask;
++	fotg210->gadget.name = udc_name;
++
++	INIT_LIST_HEAD(&fotg210->gadget.ep_list);
++
++	for (i = 0; i < FOTG210_MAX_NUM_EP; i++) {
++		struct fotg210_ep *ep = fotg210->ep[i];
++
++		if (i) {
++			INIT_LIST_HEAD(&fotg210->ep[i]->ep.ep_list);
++			list_add_tail(&fotg210->ep[i]->ep.ep_list,
++				      &fotg210->gadget.ep_list);
++		}
++		ep->fotg210 = fotg210;
++		INIT_LIST_HEAD(&ep->queue);
++		ep->ep.name = fotg210_ep_name[i];
++		ep->ep.ops = &fotg210_ep_ops;
++		usb_ep_set_maxpacket_limit(&ep->ep, (unsigned short) ~0);
++
++		if (i == 0) {
++			ep->ep.caps.type_control = true;
++		} else {
++			ep->ep.caps.type_iso = true;
++			ep->ep.caps.type_bulk = true;
++			ep->ep.caps.type_int = true;
++		}
++
++		ep->ep.caps.dir_in = true;
++		ep->ep.caps.dir_out = true;
++	}
++	usb_ep_set_maxpacket_limit(&fotg210->ep[0]->ep, 0x40);
++	fotg210->gadget.ep0 = &fotg210->ep[0]->ep;
++	INIT_LIST_HEAD(&fotg210->gadget.ep0->ep_list);
++
++	fotg210->ep0_req = fotg210_ep_alloc_request(&fotg210->ep[0]->ep,
++				GFP_KERNEL);
++	if (fotg210->ep0_req == NULL)
++		goto err_map;
++
++	fotg210->ep0_req->complete = fotg210_ep0_complete;
++
++	fotg210_init(fotg210);
++
++	fotg210_disable_unplug(fotg210);
++
++	ret = request_irq(ires->start, fotg210_irq, IRQF_SHARED,
++			  udc_name, fotg210);
++	if (ret < 0) {
++		pr_err("request_irq error (%d)\n", ret);
++		goto err_req;
++	}
++
++	ret = usb_add_gadget_udc(&pdev->dev, &fotg210->gadget);
++	if (ret)
++		goto err_add_udc;
++
++	dev_info(&pdev->dev, "version %s\n", DRIVER_VERSION);
++
++	return 0;
++
++err_add_udc:
++	free_irq(ires->start, fotg210);
++
++err_req:
++	fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);
++
++err_map:
++	iounmap(fotg210->reg);
++
++err_alloc:
++	for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
++		kfree(fotg210->ep[i]);
++	kfree(fotg210);
++
++err:
++	return ret;
++}
++
++static struct platform_driver fotg210_driver = {
++	.driver		= {
++		.name =	udc_name,
++	},
++	.probe		= fotg210_udc_probe,
++	.remove		= fotg210_udc_remove,
++};
++
++module_platform_driver(fotg210_driver);
++
++MODULE_AUTHOR("Yuan-Hsin Chen, Feng-Hsin Chiang <john453@faraday-tech.com>");
++MODULE_LICENSE("GPL");
++MODULE_DESCRIPTION(DRIVER_DESC);
+--- a/drivers/usb/gadget/udc/Kconfig
++++ b/drivers/usb/gadget/udc/Kconfig
+@@ -108,17 +108,6 @@ config USB_FUSB300
+ 	help
+ 	   Faraday usb device controller FUSB300 driver
+ 
+-config USB_FOTG210_UDC
+-	depends on HAS_DMA
+-	tristate "Faraday FOTG210 USB Peripheral Controller"
+-	help
+-	   Faraday USB2.0 OTG controller which can be configured as
+-	   high speed or full speed USB device. This driver supppors
+-	   Bulk Transfer so far.
+-
+-	   Say "y" to link the driver statically, or "m" to build a
+-	   dynamically linked module called "fotg210_udc".
+-
+ config USB_GR_UDC
+ 	tristate "Aeroflex Gaisler GRUSBDC USB Peripheral Controller Driver"
+ 	depends on HAS_DMA
+--- a/drivers/usb/gadget/udc/Makefile
++++ b/drivers/usb/gadget/udc/Makefile
+@@ -34,7 +34,6 @@ obj-$(CONFIG_USB_EG20T)		+= pch_udc.o
+ obj-$(CONFIG_USB_MV_UDC)	+= mv_udc.o
+ mv_udc-y			:= mv_udc_core.o
+ obj-$(CONFIG_USB_FUSB300)	+= fusb300_udc.o
+-obj-$(CONFIG_USB_FOTG210_UDC)	+= fotg210-udc.o
+ obj-$(CONFIG_USB_MV_U3D)	+= mv_u3d_core.o
+ obj-$(CONFIG_USB_GR_UDC)	+= gr_udc.o
+ obj-$(CONFIG_USB_GADGET_XILINX)	+= udc-xilinx.o
+--- a/drivers/usb/host/Kconfig
++++ b/drivers/usb/host/Kconfig
+@@ -389,17 +389,6 @@ config USB_ISP1362_HCD
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called isp1362-hcd.
+ 
+-config USB_FOTG210_HCD
+-	tristate "FOTG210 HCD support"
+-	depends on USB && HAS_DMA && HAS_IOMEM
+-	help
+-	  Faraday FOTG210 is an OTG controller which can be configured as
+-	  an USB2.0 host. It is designed to meet USB2.0 EHCI specification
+-	  with minor modification.
+-
+-	  To compile this driver as a module, choose M here: the
+-	  module will be called fotg210-hcd.
+-
+ config USB_MAX3421_HCD
+ 	tristate "MAX3421 HCD (USB-over-SPI) support"
+ 	depends on USB && SPI
+--- a/drivers/usb/host/Makefile
++++ b/drivers/usb/host/Makefile
+@@ -84,6 +84,5 @@ obj-$(CONFIG_USB_EHCI_FSL)	+= ehci-fsl.o
+ obj-$(CONFIG_USB_EHCI_MV)	+= ehci-mv.o
+ obj-$(CONFIG_USB_HCD_BCMA)	+= bcma-hcd.o
+ obj-$(CONFIG_USB_HCD_SSB)	+= ssb-hcd.o
+-obj-$(CONFIG_USB_FOTG210_HCD)	+= fotg210-hcd.o
+ obj-$(CONFIG_USB_MAX3421_HCD)	+= max3421-hcd.o
+ obj-$(CONFIG_USB_XEN_HCD)	+= xen-hcd.o
+--- /dev/null
++++ b/drivers/usb/fotg210/fotg210-hcd.h
+@@ -0,0 +1,688 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef __LINUX_FOTG210_H
++#define __LINUX_FOTG210_H
++
++#include <linux/usb/ehci-dbgp.h>
++
++/* definitions used for the EHCI driver */
++
++/*
++ * __hc32 and __hc16 are "Host Controller" types, they may be equivalent to
++ * __leXX (normally) or __beXX (given FOTG210_BIG_ENDIAN_DESC), depending on
++ * the host controller implementation.
++ *
++ * To facilitate the strongest possible byte-order checking from "sparse"
++ * and so on, we use __leXX unless that's not practical.
++ */
++#define __hc32	__le32
++#define __hc16	__le16
++
++/* statistics can be kept for tuning/monitoring */
++struct fotg210_stats {
++	/* irq usage */
++	unsigned long		normal;
++	unsigned long		error;
++	unsigned long		iaa;
++	unsigned long		lost_iaa;
++
++	/* termination of urbs from core */
++	unsigned long		complete;
++	unsigned long		unlink;
++};
++
++/* fotg210_hcd->lock guards shared data against other CPUs:
++ *   fotg210_hcd:	async, unlink, periodic (and shadow), ...
++ *   usb_host_endpoint: hcpriv
++ *   fotg210_qh:	qh_next, qtd_list
++ *   fotg210_qtd:	qtd_list
++ *
++ * Also, hold this lock when talking to HC registers or
++ * when updating hw_* fields in shared qh/qtd/... structures.
++ */
++
++#define	FOTG210_MAX_ROOT_PORTS	1		/* see HCS_N_PORTS */
++
++/*
++ * fotg210_rh_state values of FOTG210_RH_RUNNING or above mean that the
++ * controller may be doing DMA.  Lower values mean there's no DMA.
++ */
++enum fotg210_rh_state {
++	FOTG210_RH_HALTED,
++	FOTG210_RH_SUSPENDED,
++	FOTG210_RH_RUNNING,
++	FOTG210_RH_STOPPING
++};
++
++/*
++ * Timer events, ordered by increasing delay length.
++ * Always update event_delays_ns[] and event_handlers[] (defined in
++ * ehci-timer.c) in parallel with this list.
++ */
++enum fotg210_hrtimer_event {
++	FOTG210_HRTIMER_POLL_ASS,	/* Poll for async schedule off */
++	FOTG210_HRTIMER_POLL_PSS,	/* Poll for periodic schedule off */
++	FOTG210_HRTIMER_POLL_DEAD,	/* Wait for dead controller to stop */
++	FOTG210_HRTIMER_UNLINK_INTR,	/* Wait for interrupt QH unlink */
++	FOTG210_HRTIMER_FREE_ITDS,	/* Wait for unused iTDs and siTDs */
++	FOTG210_HRTIMER_ASYNC_UNLINKS,	/* Unlink empty async QHs */
++	FOTG210_HRTIMER_IAA_WATCHDOG,	/* Handle lost IAA interrupts */
++	FOTG210_HRTIMER_DISABLE_PERIODIC, /* Wait to disable periodic sched */
++	FOTG210_HRTIMER_DISABLE_ASYNC,	/* Wait to disable async sched */
++	FOTG210_HRTIMER_IO_WATCHDOG,	/* Check for missing IRQs */
++	FOTG210_HRTIMER_NUM_EVENTS	/* Must come last */
++};
++#define FOTG210_HRTIMER_NO_EVENT	99
++
++struct fotg210_hcd {			/* one per controller */
++	/* timing support */
++	enum fotg210_hrtimer_event	next_hrtimer_event;
++	unsigned		enabled_hrtimer_events;
++	ktime_t			hr_timeouts[FOTG210_HRTIMER_NUM_EVENTS];
++	struct hrtimer		hrtimer;
++
++	int			PSS_poll_count;
++	int			ASS_poll_count;
++	int			died_poll_count;
++
++	/* glue to PCI and HCD framework */
++	struct fotg210_caps __iomem *caps;
++	struct fotg210_regs __iomem *regs;
++	struct ehci_dbg_port __iomem *debug;
++
++	__u32			hcs_params;	/* cached register copy */
++	spinlock_t		lock;
++	enum fotg210_rh_state	rh_state;
++
++	/* general schedule support */
++	bool			scanning:1;
++	bool			need_rescan:1;
++	bool			intr_unlinking:1;
++	bool			async_unlinking:1;
++	bool			shutdown:1;
++	struct fotg210_qh		*qh_scan_next;
++
++	/* async schedule support */
++	struct fotg210_qh		*async;
++	struct fotg210_qh		*dummy;		/* For AMD quirk use */
++	struct fotg210_qh		*async_unlink;
++	struct fotg210_qh		*async_unlink_last;
++	struct fotg210_qh		*async_iaa;
++	unsigned		async_unlink_cycle;
++	unsigned		async_count;	/* async activity count */
++
++	/* periodic schedule support */
++#define	DEFAULT_I_TDPS		1024		/* some HCs can do less */
++	unsigned		periodic_size;
++	__hc32			*periodic;	/* hw periodic table */
++	dma_addr_t		periodic_dma;
++	struct list_head	intr_qh_list;
++	unsigned		i_thresh;	/* uframes HC might cache */
++
++	union fotg210_shadow	*pshadow;	/* mirror hw periodic table */
++	struct fotg210_qh		*intr_unlink;
++	struct fotg210_qh		*intr_unlink_last;
++	unsigned		intr_unlink_cycle;
++	unsigned		now_frame;	/* frame from HC hardware */
++	unsigned		next_frame;	/* scan periodic, start here */
++	unsigned		intr_count;	/* intr activity count */
++	unsigned		isoc_count;	/* isoc activity count */
++	unsigned		periodic_count;	/* periodic activity count */
++	/* max periodic time per uframe */
++	unsigned		uframe_periodic_max;
++
++
++	/* list of itds completed while now_frame was still active */
++	struct list_head	cached_itd_list;
++	struct fotg210_itd	*last_itd_to_free;
++
++	/* per root hub port */
++	unsigned long		reset_done[FOTG210_MAX_ROOT_PORTS];
++
++	/* bit vectors (one bit per port)
++	 * which ports were already suspended at the start of a bus suspend
++	 */
++	unsigned long		bus_suspended;
++
++	/* which ports are edicated to the companion controller */
++	unsigned long		companion_ports;
++
++	/* which ports are owned by the companion during a bus suspend */
++	unsigned long		owned_ports;
++
++	/* which ports have the change-suspend feature turned on */
++	unsigned long		port_c_suspend;
++
++	/* which ports are suspended */
++	unsigned long		suspended_ports;
++
++	/* which ports have started to resume */
++	unsigned long		resuming_ports;
++
++	/* per-HC memory pools (could be per-bus, but ...) */
++	struct dma_pool		*qh_pool;	/* qh per active urb */
++	struct dma_pool		*qtd_pool;	/* one or more per qh */
++	struct dma_pool		*itd_pool;	/* itd per iso urb */
++
++	unsigned		random_frame;
++	unsigned long		next_statechange;
++	ktime_t			last_periodic_enable;
++	u32			command;
++
++	/* SILICON QUIRKS */
++	unsigned		need_io_watchdog:1;
++	unsigned		fs_i_thresh:1;	/* Intel iso scheduling */
++
++	u8			sbrn;		/* packed release number */
++
++	/* irq statistics */
++#ifdef FOTG210_STATS
++	struct fotg210_stats	stats;
++#	define INCR(x) ((x)++)
++#else
++#	define INCR(x) do {} while (0)
++#endif
++
++	/* silicon clock */
++	struct clk		*pclk;
++};
++
++/* convert between an HCD pointer and the corresponding FOTG210_HCD */
++static inline struct fotg210_hcd *hcd_to_fotg210(struct usb_hcd *hcd)
++{
++	return (struct fotg210_hcd *)(hcd->hcd_priv);
++}
++static inline struct usb_hcd *fotg210_to_hcd(struct fotg210_hcd *fotg210)
++{
++	return container_of((void *) fotg210, struct usb_hcd, hcd_priv);
++}
++
++/*-------------------------------------------------------------------------*/
++
++/* EHCI register interface, corresponds to EHCI Revision 0.95 specification */
++
++/* Section 2.2 Host Controller Capability Registers */
++struct fotg210_caps {
++	/* these fields are specified as 8 and 16 bit registers,
++	 * but some hosts can't perform 8 or 16 bit PCI accesses.
++	 * some hosts treat caplength and hciversion as parts of a 32-bit
++	 * register, others treat them as two separate registers, this
++	 * affects the memory map for big endian controllers.
++	 */
++	u32		hc_capbase;
++#define HC_LENGTH(fotg210, p)	(0x00ff&((p) >> /* bits 7:0 / offset 00h */ \
++				(fotg210_big_endian_capbase(fotg210) ? 24 : 0)))
++#define HC_VERSION(fotg210, p)	(0xffff&((p) >> /* bits 31:16 / offset 02h */ \
++				(fotg210_big_endian_capbase(fotg210) ? 0 : 16)))
++	u32		hcs_params;     /* HCSPARAMS - offset 0x4 */
++#define HCS_N_PORTS(p)		(((p)>>0)&0xf)	/* bits 3:0, ports on HC */
++
++	u32		hcc_params;	/* HCCPARAMS - offset 0x8 */
++#define HCC_CANPARK(p)		((p)&(1 << 2))  /* true: can park on async qh */
++#define HCC_PGM_FRAMELISTLEN(p) ((p)&(1 << 1))  /* true: periodic_size changes*/
++	u8		portroute[8];	 /* nibbles for routing - offset 0xC */
++};
++
++
++/* Section 2.3 Host Controller Operational Registers */
++struct fotg210_regs {
++
++	/* USBCMD: offset 0x00 */
++	u32		command;
++
++/* EHCI 1.1 addendum */
++/* 23:16 is r/w intr rate, in microframes; default "8" == 1/msec */
++#define CMD_PARK	(1<<11)		/* enable "park" on async qh */
++#define CMD_PARK_CNT(c)	(((c)>>8)&3)	/* how many transfers to park for */
++#define CMD_IAAD	(1<<6)		/* "doorbell" interrupt async advance */
++#define CMD_ASE		(1<<5)		/* async schedule enable */
++#define CMD_PSE		(1<<4)		/* periodic schedule enable */
++/* 3:2 is periodic frame list size */
++#define CMD_RESET	(1<<1)		/* reset HC not bus */
++#define CMD_RUN		(1<<0)		/* start/stop HC */
++
++	/* USBSTS: offset 0x04 */
++	u32		status;
++#define STS_ASS		(1<<15)		/* Async Schedule Status */
++#define STS_PSS		(1<<14)		/* Periodic Schedule Status */
++#define STS_RECL	(1<<13)		/* Reclamation */
++#define STS_HALT	(1<<12)		/* Not running (any reason) */
++/* some bits reserved */
++	/* these STS_* flags are also intr_enable bits (USBINTR) */
++#define STS_IAA		(1<<5)		/* Interrupted on async advance */
++#define STS_FATAL	(1<<4)		/* such as some PCI access errors */
++#define STS_FLR		(1<<3)		/* frame list rolled over */
++#define STS_PCD		(1<<2)		/* port change detect */
++#define STS_ERR		(1<<1)		/* "error" completion (overflow, ...) */
++#define STS_INT		(1<<0)		/* "normal" completion (short, ...) */
++
++	/* USBINTR: offset 0x08 */
++	u32		intr_enable;
++
++	/* FRINDEX: offset 0x0C */
++	u32		frame_index;	/* current microframe number */
++	/* CTRLDSSEGMENT: offset 0x10 */
++	u32		segment;	/* address bits 63:32 if needed */
++	/* PERIODICLISTBASE: offset 0x14 */
++	u32		frame_list;	/* points to periodic list */
++	/* ASYNCLISTADDR: offset 0x18 */
++	u32		async_next;	/* address of next async queue head */
++
++	u32	reserved1;
++	/* PORTSC: offset 0x20 */
++	u32	port_status;
++/* 31:23 reserved */
++#define PORT_USB11(x) (((x)&(3<<10)) == (1<<10))	/* USB 1.1 device */
++#define PORT_RESET	(1<<8)		/* reset port */
++#define PORT_SUSPEND	(1<<7)		/* suspend port */
++#define PORT_RESUME	(1<<6)		/* resume it */
++#define PORT_PEC	(1<<3)		/* port enable change */
++#define PORT_PE		(1<<2)		/* port enable */
++#define PORT_CSC	(1<<1)		/* connect status change */
++#define PORT_CONNECT	(1<<0)		/* device connected */
++#define PORT_RWC_BITS   (PORT_CSC | PORT_PEC)
++	u32     reserved2[19];
++
++	/* OTGCSR: offet 0x70 */
++	u32     otgcsr;
++#define OTGCSR_HOST_SPD_TYP     (3 << 22)
++#define OTGCSR_A_BUS_DROP	(1 << 5)
++#define OTGCSR_A_BUS_REQ	(1 << 4)
++
++	/* OTGISR: offset 0x74 */
++	u32     otgisr;
++#define OTGISR_OVC	(1 << 10)
++
++	u32     reserved3[15];
++
++	/* GMIR: offset 0xB4 */
++	u32     gmir;
++#define GMIR_INT_POLARITY	(1 << 3) /*Active High*/
++#define GMIR_MHC_INT		(1 << 2)
++#define GMIR_MOTG_INT		(1 << 1)
++#define GMIR_MDEV_INT	(1 << 0)
++};
++
++/*-------------------------------------------------------------------------*/
++
++#define	QTD_NEXT(fotg210, dma)	cpu_to_hc32(fotg210, (u32)dma)
++
++/*
++ * EHCI Specification 0.95 Section 3.5
++ * QTD: describe data transfer components (buffer, direction, ...)
++ * See Fig 3-6 "Queue Element Transfer Descriptor Block Diagram".
++ *
++ * These are associated only with "QH" (Queue Head) structures,
++ * used with control, bulk, and interrupt transfers.
++ */
++struct fotg210_qtd {
++	/* first part defined by EHCI spec */
++	__hc32			hw_next;	/* see EHCI 3.5.1 */
++	__hc32			hw_alt_next;    /* see EHCI 3.5.2 */
++	__hc32			hw_token;	/* see EHCI 3.5.3 */
++#define	QTD_TOGGLE	(1 << 31)	/* data toggle */
++#define	QTD_LENGTH(tok)	(((tok)>>16) & 0x7fff)
++#define	QTD_IOC		(1 << 15)	/* interrupt on complete */
++#define	QTD_CERR(tok)	(((tok)>>10) & 0x3)
++#define	QTD_PID(tok)	(((tok)>>8) & 0x3)
++#define	QTD_STS_ACTIVE	(1 << 7)	/* HC may execute this */
++#define	QTD_STS_HALT	(1 << 6)	/* halted on error */
++#define	QTD_STS_DBE	(1 << 5)	/* data buffer error (in HC) */
++#define	QTD_STS_BABBLE	(1 << 4)	/* device was babbling (qtd halted) */
++#define	QTD_STS_XACT	(1 << 3)	/* device gave illegal response */
++#define	QTD_STS_MMF	(1 << 2)	/* incomplete split transaction */
++#define	QTD_STS_STS	(1 << 1)	/* split transaction state */
++#define	QTD_STS_PING	(1 << 0)	/* issue PING? */
++
++#define ACTIVE_BIT(fotg210)	cpu_to_hc32(fotg210, QTD_STS_ACTIVE)
++#define HALT_BIT(fotg210)		cpu_to_hc32(fotg210, QTD_STS_HALT)
++#define STATUS_BIT(fotg210)	cpu_to_hc32(fotg210, QTD_STS_STS)
++
++	__hc32			hw_buf[5];	/* see EHCI 3.5.4 */
++	__hc32			hw_buf_hi[5];	/* Appendix B */
++
++	/* the rest is HCD-private */
++	dma_addr_t		qtd_dma;		/* qtd address */
++	struct list_head	qtd_list;		/* sw qtd list */
++	struct urb		*urb;			/* qtd's urb */
++	size_t			length;			/* length of buffer */
++} __aligned(32);
++
++/* mask NakCnt+T in qh->hw_alt_next */
++#define QTD_MASK(fotg210)	cpu_to_hc32(fotg210, ~0x1f)
++
++#define IS_SHORT_READ(token) (QTD_LENGTH(token) != 0 && QTD_PID(token) == 1)
++
++/*-------------------------------------------------------------------------*/
++
++/* type tag from {qh,itd,fstn}->hw_next */
++#define Q_NEXT_TYPE(fotg210, dma)	((dma) & cpu_to_hc32(fotg210, 3 << 1))
++
++/*
++ * Now the following defines are not converted using the
++ * cpu_to_le32() macro anymore, since we have to support
++ * "dynamic" switching between be and le support, so that the driver
++ * can be used on one system with SoC EHCI controller using big-endian
++ * descriptors as well as a normal little-endian PCI EHCI controller.
++ */
++/* values for that type tag */
++#define Q_TYPE_ITD	(0 << 1)
++#define Q_TYPE_QH	(1 << 1)
++#define Q_TYPE_SITD	(2 << 1)
++#define Q_TYPE_FSTN	(3 << 1)
++
++/* next async queue entry, or pointer to interrupt/periodic QH */
++#define QH_NEXT(fotg210, dma) \
++	(cpu_to_hc32(fotg210, (((u32)dma)&~0x01f)|Q_TYPE_QH))
++
++/* for periodic/async schedules and qtd lists, mark end of list */
++#define FOTG210_LIST_END(fotg210) \
++	cpu_to_hc32(fotg210, 1) /* "null pointer" to hw */
++
++/*
++ * Entries in periodic shadow table are pointers to one of four kinds
++ * of data structure.  That's dictated by the hardware; a type tag is
++ * encoded in the low bits of the hardware's periodic schedule.  Use
++ * Q_NEXT_TYPE to get the tag.
++ *
++ * For entries in the async schedule, the type tag always says "qh".
++ */
++union fotg210_shadow {
++	struct fotg210_qh	*qh;		/* Q_TYPE_QH */
++	struct fotg210_itd	*itd;		/* Q_TYPE_ITD */
++	struct fotg210_fstn	*fstn;		/* Q_TYPE_FSTN */
++	__hc32			*hw_next;	/* (all types) */
++	void			*ptr;
++};
++
++/*-------------------------------------------------------------------------*/
++
++/*
++ * EHCI Specification 0.95 Section 3.6
++ * QH: describes control/bulk/interrupt endpoints
++ * See Fig 3-7 "Queue Head Structure Layout".
++ *
++ * These appear in both the async and (for interrupt) periodic schedules.
++ */
++
++/* first part defined by EHCI spec */
++struct fotg210_qh_hw {
++	__hc32			hw_next;	/* see EHCI 3.6.1 */
++	__hc32			hw_info1;	/* see EHCI 3.6.2 */
++#define	QH_CONTROL_EP	(1 << 27)	/* FS/LS control endpoint */
++#define	QH_HEAD		(1 << 15)	/* Head of async reclamation list */
++#define	QH_TOGGLE_CTL	(1 << 14)	/* Data toggle control */
++#define	QH_HIGH_SPEED	(2 << 12)	/* Endpoint speed */
++#define	QH_LOW_SPEED	(1 << 12)
++#define	QH_FULL_SPEED	(0 << 12)
++#define	QH_INACTIVATE	(1 << 7)	/* Inactivate on next transaction */
++	__hc32			hw_info2;	/* see EHCI 3.6.2 */
++#define	QH_SMASK	0x000000ff
++#define	QH_CMASK	0x0000ff00
++#define	QH_HUBADDR	0x007f0000
++#define	QH_HUBPORT	0x3f800000
++#define	QH_MULT		0xc0000000
++	__hc32			hw_current;	/* qtd list - see EHCI 3.6.4 */
++
++	/* qtd overlay (hardware parts of a struct fotg210_qtd) */
++	__hc32			hw_qtd_next;
++	__hc32			hw_alt_next;
++	__hc32			hw_token;
++	__hc32			hw_buf[5];
++	__hc32			hw_buf_hi[5];
++} __aligned(32);
++
++struct fotg210_qh {
++	struct fotg210_qh_hw	*hw;		/* Must come first */
++	/* the rest is HCD-private */
++	dma_addr_t		qh_dma;		/* address of qh */
++	union fotg210_shadow	qh_next;	/* ptr to qh; or periodic */
++	struct list_head	qtd_list;	/* sw qtd list */
++	struct list_head	intr_node;	/* list of intr QHs */
++	struct fotg210_qtd	*dummy;
++	struct fotg210_qh	*unlink_next;	/* next on unlink list */
++
++	unsigned		unlink_cycle;
++
++	u8			needs_rescan;	/* Dequeue during giveback */
++	u8			qh_state;
++#define	QH_STATE_LINKED		1		/* HC sees this */
++#define	QH_STATE_UNLINK		2		/* HC may still see this */
++#define	QH_STATE_IDLE		3		/* HC doesn't see this */
++#define	QH_STATE_UNLINK_WAIT	4		/* LINKED and on unlink q */
++#define	QH_STATE_COMPLETING	5		/* don't touch token.HALT */
++
++	u8			xacterrs;	/* XactErr retry counter */
++#define	QH_XACTERR_MAX		32		/* XactErr retry limit */
++
++	/* periodic schedule info */
++	u8			usecs;		/* intr bandwidth */
++	u8			gap_uf;		/* uframes split/csplit gap */
++	u8			c_usecs;	/* ... split completion bw */
++	u16			tt_usecs;	/* tt downstream bandwidth */
++	unsigned short		period;		/* polling interval */
++	unsigned short		start;		/* where polling starts */
++#define NO_FRAME ((unsigned short)~0)			/* pick new start */
++
++	struct usb_device	*dev;		/* access to TT */
++	unsigned		is_out:1;	/* bulk or intr OUT */
++	unsigned		clearing_tt:1;	/* Clear-TT-Buf in progress */
++};
++
++/*-------------------------------------------------------------------------*/
++
++/* description of one iso transaction (up to 3 KB data if highspeed) */
++struct fotg210_iso_packet {
++	/* These will be copied to iTD when scheduling */
++	u64			bufp;		/* itd->hw_bufp{,_hi}[pg] |= */
++	__hc32			transaction;	/* itd->hw_transaction[i] |= */
++	u8			cross;		/* buf crosses pages */
++	/* for full speed OUT splits */
++	u32			buf1;
++};
++
++/* temporary schedule data for packets from iso urbs (both speeds)
++ * each packet is one logical usb transaction to the device (not TT),
++ * beginning at stream->next_uframe
++ */
++struct fotg210_iso_sched {
++	struct list_head	td_list;
++	unsigned		span;
++	struct fotg210_iso_packet	packet[];
++};
++
++/*
++ * fotg210_iso_stream - groups all (s)itds for this endpoint.
++ * acts like a qh would, if EHCI had them for ISO.
++ */
++struct fotg210_iso_stream {
++	/* first field matches fotg210_hq, but is NULL */
++	struct fotg210_qh_hw	*hw;
++
++	u8			bEndpointAddress;
++	u8			highspeed;
++	struct list_head	td_list;	/* queued itds */
++	struct list_head	free_list;	/* list of unused itds */
++	struct usb_device	*udev;
++	struct usb_host_endpoint *ep;
++
++	/* output of (re)scheduling */
++	int			next_uframe;
++	__hc32			splits;
++
++	/* the rest is derived from the endpoint descriptor,
++	 * trusting urb->interval == f(epdesc->bInterval) and
++	 * including the extra info for hw_bufp[0..2]
++	 */
++	u8			usecs, c_usecs;
++	u16			interval;
++	u16			tt_usecs;
++	u16			maxp;
++	u16			raw_mask;
++	unsigned		bandwidth;
++
++	/* This is used to initialize iTD's hw_bufp fields */
++	__hc32			buf0;
++	__hc32			buf1;
++	__hc32			buf2;
++
++	/* this is used to initialize sITD's tt info */
++	__hc32			address;
++};
++
++/*-------------------------------------------------------------------------*/
++
++/*
++ * EHCI Specification 0.95 Section 3.3
++ * Fig 3-4 "Isochronous Transaction Descriptor (iTD)"
++ *
++ * Schedule records for high speed iso xfers
++ */
++struct fotg210_itd {
++	/* first part defined by EHCI spec */
++	__hc32			hw_next;	/* see EHCI 3.3.1 */
++	__hc32			hw_transaction[8]; /* see EHCI 3.3.2 */
++#define FOTG210_ISOC_ACTIVE	(1<<31)	/* activate transfer this slot */
++#define FOTG210_ISOC_BUF_ERR	(1<<30)	/* Data buffer error */
++#define FOTG210_ISOC_BABBLE	(1<<29)	/* babble detected */
++#define FOTG210_ISOC_XACTERR	(1<<28)	/* XactErr - transaction error */
++#define	FOTG210_ITD_LENGTH(tok)	(((tok)>>16) & 0x0fff)
++#define	FOTG210_ITD_IOC		(1 << 15)	/* interrupt on complete */
++
++#define ITD_ACTIVE(fotg210)	cpu_to_hc32(fotg210, FOTG210_ISOC_ACTIVE)
++
++	__hc32			hw_bufp[7];	/* see EHCI 3.3.3 */
++	__hc32			hw_bufp_hi[7];	/* Appendix B */
++
++	/* the rest is HCD-private */
++	dma_addr_t		itd_dma;	/* for this itd */
++	union fotg210_shadow	itd_next;	/* ptr to periodic q entry */
++
++	struct urb		*urb;
++	struct fotg210_iso_stream	*stream;	/* endpoint's queue */
++	struct list_head	itd_list;	/* list of stream's itds */
++
++	/* any/all hw_transactions here may be used by that urb */
++	unsigned		frame;		/* where scheduled */
++	unsigned		pg;
++	unsigned		index[8];	/* in urb->iso_frame_desc */
++} __aligned(32);
++
++/*-------------------------------------------------------------------------*/
++
++/*
++ * EHCI Specification 0.96 Section 3.7
++ * Periodic Frame Span Traversal Node (FSTN)
++ *
++ * Manages split interrupt transactions (using TT) that span frame boundaries
++ * into uframes 0/1; see 4.12.2.2.  In those uframes, a "save place" FSTN
++ * makes the HC jump (back) to a QH to scan for fs/ls QH completions until
++ * it hits a "restore" FSTN; then it returns to finish other uframe 0/1 work.
++ */
++struct fotg210_fstn {
++	__hc32			hw_next;	/* any periodic q entry */
++	__hc32			hw_prev;	/* qh or FOTG210_LIST_END */
++
++	/* the rest is HCD-private */
++	dma_addr_t		fstn_dma;
++	union fotg210_shadow	fstn_next;	/* ptr to periodic q entry */
++} __aligned(32);
++
++/*-------------------------------------------------------------------------*/
++
++/* Prepare the PORTSC wakeup flags during controller suspend/resume */
++
++#define fotg210_prepare_ports_for_controller_suspend(fotg210, do_wakeup) \
++		fotg210_adjust_port_wakeup_flags(fotg210, true, do_wakeup)
++
++#define fotg210_prepare_ports_for_controller_resume(fotg210)		\
++		fotg210_adjust_port_wakeup_flags(fotg210, false, false)
++
++/*-------------------------------------------------------------------------*/
++
++/*
++ * Some EHCI controllers have a Transaction Translator built into the
++ * root hub. This is a non-standard feature.  Each controller will need
++ * to add code to the following inline functions, and call them as
++ * needed (mostly in root hub code).
++ */
++
++static inline unsigned int
++fotg210_get_speed(struct fotg210_hcd *fotg210, unsigned int portsc)
++{
++	return (readl(&fotg210->regs->otgcsr)
++		& OTGCSR_HOST_SPD_TYP) >> 22;
++}
++
++/* Returns the speed of a device attached to a port on the root hub. */
++static inline unsigned int
++fotg210_port_speed(struct fotg210_hcd *fotg210, unsigned int portsc)
++{
++	switch (fotg210_get_speed(fotg210, portsc)) {
++	case 0:
++		return 0;
++	case 1:
++		return USB_PORT_STAT_LOW_SPEED;
++	case 2:
++	default:
++		return USB_PORT_STAT_HIGH_SPEED;
++	}
++}
++
++/*-------------------------------------------------------------------------*/
++
++#define	fotg210_has_fsl_portno_bug(e)		(0)
++
++/*
++ * While most USB host controllers implement their registers in
++ * little-endian format, a minority (celleb companion chip) implement
++ * them in big endian format.
++ *
++ * This attempts to support either format at compile time without a
++ * runtime penalty, or both formats with the additional overhead
++ * of checking a flag bit.
++ *
++ */
++
++#define fotg210_big_endian_mmio(e)	0
++#define fotg210_big_endian_capbase(e)	0
++
++static inline unsigned int fotg210_readl(const struct fotg210_hcd *fotg210,
++		__u32 __iomem *regs)
++{
++	return readl(regs);
++}
++
++static inline void fotg210_writel(const struct fotg210_hcd *fotg210,
++		const unsigned int val, __u32 __iomem *regs)
++{
++	writel(val, regs);
++}
++
++/* cpu to fotg210 */
++static inline __hc32 cpu_to_hc32(const struct fotg210_hcd *fotg210, const u32 x)
++{
++	return cpu_to_le32(x);
++}
++
++/* fotg210 to cpu */
++static inline u32 hc32_to_cpu(const struct fotg210_hcd *fotg210, const __hc32 x)
++{
++	return le32_to_cpu(x);
++}
++
++static inline u32 hc32_to_cpup(const struct fotg210_hcd *fotg210,
++			       const __hc32 *x)
++{
++	return le32_to_cpup(x);
++}
++
++/*-------------------------------------------------------------------------*/
++
++static inline unsigned fotg210_read_frame_index(struct fotg210_hcd *fotg210)
++{
++	return fotg210_readl(fotg210, &fotg210->regs->frame_index);
++}
++
++/*-------------------------------------------------------------------------*/
++
++#endif /* __LINUX_FOTG210_H */
+--- /dev/null
++++ b/drivers/usb/fotg210/fotg210-udc.h
+@@ -0,0 +1,249 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Faraday FOTG210 USB OTG controller
++ *
++ * Copyright (C) 2013 Faraday Technology Corporation
++ * Author: Yuan-Hsin Chen <yhchen@faraday-tech.com>
++ */
++
++#include <linux/kernel.h>
++
++#define FOTG210_MAX_NUM_EP	5 /* ep0...ep4 */
++#define FOTG210_MAX_FIFO_NUM	4 /* fifo0...fifo4 */
++
++/* Global Mask of HC/OTG/DEV interrupt Register(0xC4) */
++#define FOTG210_GMIR		0xC4
++#define GMIR_INT_POLARITY	0x8 /*Active High*/
++#define GMIR_MHC_INT		0x4
++#define GMIR_MOTG_INT		0x2
++#define GMIR_MDEV_INT		0x1
++
++/*  Device Main Control Register(0x100) */
++#define FOTG210_DMCR		0x100
++#define DMCR_HS_EN		(1 << 6)
++#define DMCR_CHIP_EN		(1 << 5)
++#define DMCR_SFRST		(1 << 4)
++#define DMCR_GOSUSP		(1 << 3)
++#define DMCR_GLINT_EN		(1 << 2)
++#define DMCR_HALF_SPEED		(1 << 1)
++#define DMCR_CAP_RMWAKUP	(1 << 0)
++
++/* Device Address Register(0x104) */
++#define FOTG210_DAR		0x104
++#define DAR_AFT_CONF		(1 << 7)
++
++/* Device Test Register(0x108) */
++#define FOTG210_DTR		0x108
++#define DTR_TST_CLRFF		(1 << 0)
++
++/* PHY Test Mode Selector register(0x114) */
++#define FOTG210_PHYTMSR		0x114
++#define PHYTMSR_TST_PKT		(1 << 4)
++#define PHYTMSR_TST_SE0NAK	(1 << 3)
++#define PHYTMSR_TST_KSTA	(1 << 2)
++#define PHYTMSR_TST_JSTA	(1 << 1)
++#define PHYTMSR_UNPLUG		(1 << 0)
++
++/* Cx configuration and FIFO Empty Status register(0x120) */
++#define FOTG210_DCFESR		0x120
++#define DCFESR_FIFO_EMPTY(fifo)	(1 << 8 << (fifo))
++#define DCFESR_CX_EMP		(1 << 5)
++#define DCFESR_CX_CLR		(1 << 3)
++#define DCFESR_CX_STL		(1 << 2)
++#define DCFESR_TST_PKDONE	(1 << 1)
++#define DCFESR_CX_DONE		(1 << 0)
++
++/* Device IDLE Counter Register(0x124) */
++#define FOTG210_DICR		0x124
++
++/* Device Mask of Interrupt Group Register (0x130) */
++#define FOTG210_DMIGR		0x130
++#define DMIGR_MINT_G0		(1 << 0)
++
++/* Device Mask of Interrupt Source Group 0(0x134) */
++#define FOTG210_DMISGR0		0x134
++#define DMISGR0_MCX_COMEND	(1 << 3)
++#define DMISGR0_MCX_OUT_INT	(1 << 2)
++#define DMISGR0_MCX_IN_INT	(1 << 1)
++#define DMISGR0_MCX_SETUP_INT	(1 << 0)
++
++/* Device Mask of Interrupt Source Group 1 Register(0x138)*/
++#define FOTG210_DMISGR1		0x138
++#define DMISGR1_MF3_IN_INT	(1 << 19)
++#define DMISGR1_MF2_IN_INT	(1 << 18)
++#define DMISGR1_MF1_IN_INT	(1 << 17)
++#define DMISGR1_MF0_IN_INT	(1 << 16)
++#define DMISGR1_MF_IN_INT(fifo)	(1 << (16 + (fifo)))
++#define DMISGR1_MF3_SPK_INT	(1 << 7)
++#define DMISGR1_MF3_OUT_INT	(1 << 6)
++#define DMISGR1_MF2_SPK_INT	(1 << 5)
++#define DMISGR1_MF2_OUT_INT	(1 << 4)
++#define DMISGR1_MF1_SPK_INT	(1 << 3)
++#define DMISGR1_MF1_OUT_INT	(1 << 2)
++#define DMISGR1_MF0_SPK_INT	(1 << 1)
++#define DMISGR1_MF0_OUT_INT	(1 << 0)
++#define DMISGR1_MF_OUTSPK_INT(fifo)	(0x3 << (fifo) * 2)
++
++/* Device Mask of Interrupt Source Group 2 Register (0x13C) */
++#define FOTG210_DMISGR2		0x13C
++#define DMISGR2_MDMA_ERROR	(1 << 8)
++#define DMISGR2_MDMA_CMPLT	(1 << 7)
++
++/* Device Interrupt group Register (0x140) */
++#define FOTG210_DIGR		0x140
++#define DIGR_INT_G2		(1 << 2)
++#define DIGR_INT_G1		(1 << 1)
++#define DIGR_INT_G0		(1 << 0)
++
++/* Device Interrupt Source Group 0 Register (0x144) */
++#define FOTG210_DISGR0		0x144
++#define DISGR0_CX_COMABT_INT	(1 << 5)
++#define DISGR0_CX_COMFAIL_INT	(1 << 4)
++#define DISGR0_CX_COMEND_INT	(1 << 3)
++#define DISGR0_CX_OUT_INT	(1 << 2)
++#define DISGR0_CX_IN_INT	(1 << 1)
++#define DISGR0_CX_SETUP_INT	(1 << 0)
++
++/* Device Interrupt Source Group 1 Register (0x148) */
++#define FOTG210_DISGR1		0x148
++#define DISGR1_OUT_INT(fifo)	(1 << ((fifo) * 2))
++#define DISGR1_SPK_INT(fifo)	(1 << 1 << ((fifo) * 2))
++#define DISGR1_IN_INT(fifo)	(1 << 16 << (fifo))
++
++/* Device Interrupt Source Group 2 Register (0x14C) */
++#define FOTG210_DISGR2		0x14C
++#define DISGR2_DMA_ERROR	(1 << 8)
++#define DISGR2_DMA_CMPLT	(1 << 7)
++#define DISGR2_RX0BYTE_INT	(1 << 6)
++#define DISGR2_TX0BYTE_INT	(1 << 5)
++#define DISGR2_ISO_SEQ_ABORT_INT	(1 << 4)
++#define DISGR2_ISO_SEQ_ERR_INT	(1 << 3)
++#define DISGR2_RESM_INT		(1 << 2)
++#define DISGR2_SUSP_INT		(1 << 1)
++#define DISGR2_USBRST_INT	(1 << 0)
++
++/* Device Receive Zero-Length Data Packet Register (0x150)*/
++#define FOTG210_RX0BYTE		0x150
++#define RX0BYTE_EP8		(1 << 7)
++#define RX0BYTE_EP7		(1 << 6)
++#define RX0BYTE_EP6		(1 << 5)
++#define RX0BYTE_EP5		(1 << 4)
++#define RX0BYTE_EP4		(1 << 3)
++#define RX0BYTE_EP3		(1 << 2)
++#define RX0BYTE_EP2		(1 << 1)
++#define RX0BYTE_EP1		(1 << 0)
++
++/* Device Transfer Zero-Length Data Packet Register (0x154)*/
++#define FOTG210_TX0BYTE		0x154
++#define TX0BYTE_EP8		(1 << 7)
++#define TX0BYTE_EP7		(1 << 6)
++#define TX0BYTE_EP6		(1 << 5)
++#define TX0BYTE_EP5		(1 << 4)
++#define TX0BYTE_EP4		(1 << 3)
++#define TX0BYTE_EP3		(1 << 2)
++#define TX0BYTE_EP2		(1 << 1)
++#define TX0BYTE_EP1		(1 << 0)
++
++/* Device IN Endpoint x MaxPacketSize Register(0x160+4*(x-1)) */
++#define FOTG210_INEPMPSR(ep)	(0x160 + 4 * ((ep) - 1))
++#define INOUTEPMPSR_MPS(mps)	((mps) & 0x2FF)
++#define INOUTEPMPSR_STL_EP	(1 << 11)
++#define INOUTEPMPSR_RESET_TSEQ	(1 << 12)
++
++/* Device OUT Endpoint x MaxPacketSize Register(0x180+4*(x-1)) */
++#define FOTG210_OUTEPMPSR(ep)	(0x180 + 4 * ((ep) - 1))
++
++/* Device Endpoint 1~4 Map Register (0x1A0) */
++#define FOTG210_EPMAP		0x1A0
++#define EPMAP_FIFONO(ep, dir)		\
++	((((ep) - 1) << ((ep) - 1) * 8) << ((dir) ? 0 : 4))
++#define EPMAP_FIFONOMSK(ep, dir)	\
++	((3 << ((ep) - 1) * 8) << ((dir) ? 0 : 4))
++
++/* Device FIFO Map Register (0x1A8) */
++#define FOTG210_FIFOMAP		0x1A8
++#define FIFOMAP_DIROUT(fifo)	(0x0 << 4 << (fifo) * 8)
++#define FIFOMAP_DIRIN(fifo)	(0x1 << 4 << (fifo) * 8)
++#define FIFOMAP_BIDIR(fifo)	(0x2 << 4 << (fifo) * 8)
++#define FIFOMAP_NA(fifo)	(0x3 << 4 << (fifo) * 8)
++#define FIFOMAP_EPNO(ep)	((ep) << ((ep) - 1) * 8)
++#define FIFOMAP_EPNOMSK(ep)	(0xF << ((ep) - 1) * 8)
++
++/* Device FIFO Confuguration Register (0x1AC) */
++#define FOTG210_FIFOCF		0x1AC
++#define FIFOCF_TYPE(type, fifo)	((type) << (fifo) * 8)
++#define FIFOCF_BLK_SIN(fifo)	(0x0 << (fifo) * 8 << 2)
++#define FIFOCF_BLK_DUB(fifo)	(0x1 << (fifo) * 8 << 2)
++#define FIFOCF_BLK_TRI(fifo)	(0x2 << (fifo) * 8 << 2)
++#define FIFOCF_BLKSZ_512(fifo)	(0x0 << (fifo) * 8 << 4)
++#define FIFOCF_BLKSZ_1024(fifo)	(0x1 << (fifo) * 8 << 4)
++#define FIFOCF_FIFO_EN(fifo)	(0x1 << (fifo) * 8 << 5)
++
++/* Device FIFO n Instruction and Byte Count Register (0x1B0+4*n) */
++#define FOTG210_FIBCR(fifo)	(0x1B0 + (fifo) * 4)
++#define FIBCR_BCFX		0x7FF
++#define FIBCR_FFRST		(1 << 12)
++
++/* Device DMA Target FIFO Number Register (0x1C0) */
++#define FOTG210_DMATFNR		0x1C0
++#define DMATFNR_ACC_CXF		(1 << 4)
++#define DMATFNR_ACC_F3		(1 << 3)
++#define DMATFNR_ACC_F2		(1 << 2)
++#define DMATFNR_ACC_F1		(1 << 1)
++#define DMATFNR_ACC_F0		(1 << 0)
++#define DMATFNR_ACC_FN(fifo)	(1 << (fifo))
++#define DMATFNR_DISDMA		0
++
++/* Device DMA Controller Parameter setting 1 Register (0x1C8) */
++#define FOTG210_DMACPSR1	0x1C8
++#define DMACPSR1_DMA_LEN(len)	(((len) & 0xFFFF) << 8)
++#define DMACPSR1_DMA_ABORT	(1 << 3)
++#define DMACPSR1_DMA_TYPE(dir_in)	(((dir_in) ? 1 : 0) << 1)
++#define DMACPSR1_DMA_START	(1 << 0)
++
++/* Device DMA Controller Parameter setting 2 Register (0x1CC) */
++#define FOTG210_DMACPSR2	0x1CC
++
++/* Device DMA Controller Parameter setting 3 Register (0x1CC) */
++#define FOTG210_CXPORT		0x1D0
++
++struct fotg210_request {
++	struct usb_request	req;
++	struct list_head	queue;
++};
++
++struct fotg210_ep {
++	struct usb_ep		ep;
++	struct fotg210_udc	*fotg210;
++
++	struct list_head	queue;
++	unsigned		stall:1;
++	unsigned		wedged:1;
++	unsigned		use_dma:1;
++
++	unsigned char		epnum;
++	unsigned char		type;
++	unsigned char		dir_in;
++	unsigned int		maxp;
++	const struct usb_endpoint_descriptor	*desc;
++};
++
++struct fotg210_udc {
++	spinlock_t		lock; /* protect the struct */
++	void __iomem		*reg;
++
++	unsigned long		irq_trigger;
++
++	struct usb_gadget		gadget;
++	struct usb_gadget_driver	*driver;
++
++	struct fotg210_ep	*ep[FOTG210_MAX_NUM_EP];
++
++	struct usb_request	*ep0_req;	/* for internal request */
++	__le16			ep0_data;
++	u8			ep0_dir;	/* 0/0x80  out/in */
++
++	u8			reenum;		/* if re-enumeration */
++};
++
++#define gadget_to_fotg210(g)	container_of((g), struct fotg210_udc, gadget)
+--- a/drivers/usb/gadget/udc/fotg210.h
++++ /dev/null
+@@ -1,249 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0+
+-/*
+- * Faraday FOTG210 USB OTG controller
+- *
+- * Copyright (C) 2013 Faraday Technology Corporation
+- * Author: Yuan-Hsin Chen <yhchen@faraday-tech.com>
+- */
+-
+-#include <linux/kernel.h>
+-
+-#define FOTG210_MAX_NUM_EP	5 /* ep0...ep4 */
+-#define FOTG210_MAX_FIFO_NUM	4 /* fifo0...fifo4 */
+-
+-/* Global Mask of HC/OTG/DEV interrupt Register(0xC4) */
+-#define FOTG210_GMIR		0xC4
+-#define GMIR_INT_POLARITY	0x8 /*Active High*/
+-#define GMIR_MHC_INT		0x4
+-#define GMIR_MOTG_INT		0x2
+-#define GMIR_MDEV_INT		0x1
+-
+-/*  Device Main Control Register(0x100) */
+-#define FOTG210_DMCR		0x100
+-#define DMCR_HS_EN		(1 << 6)
+-#define DMCR_CHIP_EN		(1 << 5)
+-#define DMCR_SFRST		(1 << 4)
+-#define DMCR_GOSUSP		(1 << 3)
+-#define DMCR_GLINT_EN		(1 << 2)
+-#define DMCR_HALF_SPEED		(1 << 1)
+-#define DMCR_CAP_RMWAKUP	(1 << 0)
+-
+-/* Device Address Register(0x104) */
+-#define FOTG210_DAR		0x104
+-#define DAR_AFT_CONF		(1 << 7)
+-
+-/* Device Test Register(0x108) */
+-#define FOTG210_DTR		0x108
+-#define DTR_TST_CLRFF		(1 << 0)
+-
+-/* PHY Test Mode Selector register(0x114) */
+-#define FOTG210_PHYTMSR		0x114
+-#define PHYTMSR_TST_PKT		(1 << 4)
+-#define PHYTMSR_TST_SE0NAK	(1 << 3)
+-#define PHYTMSR_TST_KSTA	(1 << 2)
+-#define PHYTMSR_TST_JSTA	(1 << 1)
+-#define PHYTMSR_UNPLUG		(1 << 0)
+-
+-/* Cx configuration and FIFO Empty Status register(0x120) */
+-#define FOTG210_DCFESR		0x120
+-#define DCFESR_FIFO_EMPTY(fifo)	(1 << 8 << (fifo))
+-#define DCFESR_CX_EMP		(1 << 5)
+-#define DCFESR_CX_CLR		(1 << 3)
+-#define DCFESR_CX_STL		(1 << 2)
+-#define DCFESR_TST_PKDONE	(1 << 1)
+-#define DCFESR_CX_DONE		(1 << 0)
+-
+-/* Device IDLE Counter Register(0x124) */
+-#define FOTG210_DICR		0x124
+-
+-/* Device Mask of Interrupt Group Register (0x130) */
+-#define FOTG210_DMIGR		0x130
+-#define DMIGR_MINT_G0		(1 << 0)
+-
+-/* Device Mask of Interrupt Source Group 0(0x134) */
+-#define FOTG210_DMISGR0		0x134
+-#define DMISGR0_MCX_COMEND	(1 << 3)
+-#define DMISGR0_MCX_OUT_INT	(1 << 2)
+-#define DMISGR0_MCX_IN_INT	(1 << 1)
+-#define DMISGR0_MCX_SETUP_INT	(1 << 0)
+-
+-/* Device Mask of Interrupt Source Group 1 Register(0x138)*/
+-#define FOTG210_DMISGR1		0x138
+-#define DMISGR1_MF3_IN_INT	(1 << 19)
+-#define DMISGR1_MF2_IN_INT	(1 << 18)
+-#define DMISGR1_MF1_IN_INT	(1 << 17)
+-#define DMISGR1_MF0_IN_INT	(1 << 16)
+-#define DMISGR1_MF_IN_INT(fifo)	(1 << (16 + (fifo)))
+-#define DMISGR1_MF3_SPK_INT	(1 << 7)
+-#define DMISGR1_MF3_OUT_INT	(1 << 6)
+-#define DMISGR1_MF2_SPK_INT	(1 << 5)
+-#define DMISGR1_MF2_OUT_INT	(1 << 4)
+-#define DMISGR1_MF1_SPK_INT	(1 << 3)
+-#define DMISGR1_MF1_OUT_INT	(1 << 2)
+-#define DMISGR1_MF0_SPK_INT	(1 << 1)
+-#define DMISGR1_MF0_OUT_INT	(1 << 0)
+-#define DMISGR1_MF_OUTSPK_INT(fifo)	(0x3 << (fifo) * 2)
+-
+-/* Device Mask of Interrupt Source Group 2 Register (0x13C) */
+-#define FOTG210_DMISGR2		0x13C
+-#define DMISGR2_MDMA_ERROR	(1 << 8)
+-#define DMISGR2_MDMA_CMPLT	(1 << 7)
+-
+-/* Device Interrupt group Register (0x140) */
+-#define FOTG210_DIGR		0x140
+-#define DIGR_INT_G2		(1 << 2)
+-#define DIGR_INT_G1		(1 << 1)
+-#define DIGR_INT_G0		(1 << 0)
+-
+-/* Device Interrupt Source Group 0 Register (0x144) */
+-#define FOTG210_DISGR0		0x144
+-#define DISGR0_CX_COMABT_INT	(1 << 5)
+-#define DISGR0_CX_COMFAIL_INT	(1 << 4)
+-#define DISGR0_CX_COMEND_INT	(1 << 3)
+-#define DISGR0_CX_OUT_INT	(1 << 2)
+-#define DISGR0_CX_IN_INT	(1 << 1)
+-#define DISGR0_CX_SETUP_INT	(1 << 0)
+-
+-/* Device Interrupt Source Group 1 Register (0x148) */
+-#define FOTG210_DISGR1		0x148
+-#define DISGR1_OUT_INT(fifo)	(1 << ((fifo) * 2))
+-#define DISGR1_SPK_INT(fifo)	(1 << 1 << ((fifo) * 2))
+-#define DISGR1_IN_INT(fifo)	(1 << 16 << (fifo))
+-
+-/* Device Interrupt Source Group 2 Register (0x14C) */
+-#define FOTG210_DISGR2		0x14C
+-#define DISGR2_DMA_ERROR	(1 << 8)
+-#define DISGR2_DMA_CMPLT	(1 << 7)
+-#define DISGR2_RX0BYTE_INT	(1 << 6)
+-#define DISGR2_TX0BYTE_INT	(1 << 5)
+-#define DISGR2_ISO_SEQ_ABORT_INT	(1 << 4)
+-#define DISGR2_ISO_SEQ_ERR_INT	(1 << 3)
+-#define DISGR2_RESM_INT		(1 << 2)
+-#define DISGR2_SUSP_INT		(1 << 1)
+-#define DISGR2_USBRST_INT	(1 << 0)
+-
+-/* Device Receive Zero-Length Data Packet Register (0x150)*/
+-#define FOTG210_RX0BYTE		0x150
+-#define RX0BYTE_EP8		(1 << 7)
+-#define RX0BYTE_EP7		(1 << 6)
+-#define RX0BYTE_EP6		(1 << 5)
+-#define RX0BYTE_EP5		(1 << 4)
+-#define RX0BYTE_EP4		(1 << 3)
+-#define RX0BYTE_EP3		(1 << 2)
+-#define RX0BYTE_EP2		(1 << 1)
+-#define RX0BYTE_EP1		(1 << 0)
+-
+-/* Device Transfer Zero-Length Data Packet Register (0x154)*/
+-#define FOTG210_TX0BYTE		0x154
+-#define TX0BYTE_EP8		(1 << 7)
+-#define TX0BYTE_EP7		(1 << 6)
+-#define TX0BYTE_EP6		(1 << 5)
+-#define TX0BYTE_EP5		(1 << 4)
+-#define TX0BYTE_EP4		(1 << 3)
+-#define TX0BYTE_EP3		(1 << 2)
+-#define TX0BYTE_EP2		(1 << 1)
+-#define TX0BYTE_EP1		(1 << 0)
+-
+-/* Device IN Endpoint x MaxPacketSize Register(0x160+4*(x-1)) */
+-#define FOTG210_INEPMPSR(ep)	(0x160 + 4 * ((ep) - 1))
+-#define INOUTEPMPSR_MPS(mps)	((mps) & 0x2FF)
+-#define INOUTEPMPSR_STL_EP	(1 << 11)
+-#define INOUTEPMPSR_RESET_TSEQ	(1 << 12)
+-
+-/* Device OUT Endpoint x MaxPacketSize Register(0x180+4*(x-1)) */
+-#define FOTG210_OUTEPMPSR(ep)	(0x180 + 4 * ((ep) - 1))
+-
+-/* Device Endpoint 1~4 Map Register (0x1A0) */
+-#define FOTG210_EPMAP		0x1A0
+-#define EPMAP_FIFONO(ep, dir)		\
+-	((((ep) - 1) << ((ep) - 1) * 8) << ((dir) ? 0 : 4))
+-#define EPMAP_FIFONOMSK(ep, dir)	\
+-	((3 << ((ep) - 1) * 8) << ((dir) ? 0 : 4))
+-
+-/* Device FIFO Map Register (0x1A8) */
+-#define FOTG210_FIFOMAP		0x1A8
+-#define FIFOMAP_DIROUT(fifo)	(0x0 << 4 << (fifo) * 8)
+-#define FIFOMAP_DIRIN(fifo)	(0x1 << 4 << (fifo) * 8)
+-#define FIFOMAP_BIDIR(fifo)	(0x2 << 4 << (fifo) * 8)
+-#define FIFOMAP_NA(fifo)	(0x3 << 4 << (fifo) * 8)
+-#define FIFOMAP_EPNO(ep)	((ep) << ((ep) - 1) * 8)
+-#define FIFOMAP_EPNOMSK(ep)	(0xF << ((ep) - 1) * 8)
+-
+-/* Device FIFO Confuguration Register (0x1AC) */
+-#define FOTG210_FIFOCF		0x1AC
+-#define FIFOCF_TYPE(type, fifo)	((type) << (fifo) * 8)
+-#define FIFOCF_BLK_SIN(fifo)	(0x0 << (fifo) * 8 << 2)
+-#define FIFOCF_BLK_DUB(fifo)	(0x1 << (fifo) * 8 << 2)
+-#define FIFOCF_BLK_TRI(fifo)	(0x2 << (fifo) * 8 << 2)
+-#define FIFOCF_BLKSZ_512(fifo)	(0x0 << (fifo) * 8 << 4)
+-#define FIFOCF_BLKSZ_1024(fifo)	(0x1 << (fifo) * 8 << 4)
+-#define FIFOCF_FIFO_EN(fifo)	(0x1 << (fifo) * 8 << 5)
+-
+-/* Device FIFO n Instruction and Byte Count Register (0x1B0+4*n) */
+-#define FOTG210_FIBCR(fifo)	(0x1B0 + (fifo) * 4)
+-#define FIBCR_BCFX		0x7FF
+-#define FIBCR_FFRST		(1 << 12)
+-
+-/* Device DMA Target FIFO Number Register (0x1C0) */
+-#define FOTG210_DMATFNR		0x1C0
+-#define DMATFNR_ACC_CXF		(1 << 4)
+-#define DMATFNR_ACC_F3		(1 << 3)
+-#define DMATFNR_ACC_F2		(1 << 2)
+-#define DMATFNR_ACC_F1		(1 << 1)
+-#define DMATFNR_ACC_F0		(1 << 0)
+-#define DMATFNR_ACC_FN(fifo)	(1 << (fifo))
+-#define DMATFNR_DISDMA		0
+-
+-/* Device DMA Controller Parameter setting 1 Register (0x1C8) */
+-#define FOTG210_DMACPSR1	0x1C8
+-#define DMACPSR1_DMA_LEN(len)	(((len) & 0xFFFF) << 8)
+-#define DMACPSR1_DMA_ABORT	(1 << 3)
+-#define DMACPSR1_DMA_TYPE(dir_in)	(((dir_in) ? 1 : 0) << 1)
+-#define DMACPSR1_DMA_START	(1 << 0)
+-
+-/* Device DMA Controller Parameter setting 2 Register (0x1CC) */
+-#define FOTG210_DMACPSR2	0x1CC
+-
+-/* Device DMA Controller Parameter setting 3 Register (0x1CC) */
+-#define FOTG210_CXPORT		0x1D0
+-
+-struct fotg210_request {
+-	struct usb_request	req;
+-	struct list_head	queue;
+-};
+-
+-struct fotg210_ep {
+-	struct usb_ep		ep;
+-	struct fotg210_udc	*fotg210;
+-
+-	struct list_head	queue;
+-	unsigned		stall:1;
+-	unsigned		wedged:1;
+-	unsigned		use_dma:1;
+-
+-	unsigned char		epnum;
+-	unsigned char		type;
+-	unsigned char		dir_in;
+-	unsigned int		maxp;
+-	const struct usb_endpoint_descriptor	*desc;
+-};
+-
+-struct fotg210_udc {
+-	spinlock_t		lock; /* protect the struct */
+-	void __iomem		*reg;
+-
+-	unsigned long		irq_trigger;
+-
+-	struct usb_gadget		gadget;
+-	struct usb_gadget_driver	*driver;
+-
+-	struct fotg210_ep	*ep[FOTG210_MAX_NUM_EP];
+-
+-	struct usb_request	*ep0_req;	/* for internal request */
+-	__le16			ep0_data;
+-	u8			ep0_dir;	/* 0/0x80  out/in */
+-
+-	u8			reenum;		/* if re-enumeration */
+-};
+-
+-#define gadget_to_fotg210(g)	container_of((g), struct fotg210_udc, gadget)
+--- a/drivers/usb/host/fotg210.h
++++ /dev/null
+@@ -1,688 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-#ifndef __LINUX_FOTG210_H
+-#define __LINUX_FOTG210_H
+-
+-#include <linux/usb/ehci-dbgp.h>
+-
+-/* definitions used for the EHCI driver */
+-
+-/*
+- * __hc32 and __hc16 are "Host Controller" types, they may be equivalent to
+- * __leXX (normally) or __beXX (given FOTG210_BIG_ENDIAN_DESC), depending on
+- * the host controller implementation.
+- *
+- * To facilitate the strongest possible byte-order checking from "sparse"
+- * and so on, we use __leXX unless that's not practical.
+- */
+-#define __hc32	__le32
+-#define __hc16	__le16
+-
+-/* statistics can be kept for tuning/monitoring */
+-struct fotg210_stats {
+-	/* irq usage */
+-	unsigned long		normal;
+-	unsigned long		error;
+-	unsigned long		iaa;
+-	unsigned long		lost_iaa;
+-
+-	/* termination of urbs from core */
+-	unsigned long		complete;
+-	unsigned long		unlink;
+-};
+-
+-/* fotg210_hcd->lock guards shared data against other CPUs:
+- *   fotg210_hcd:	async, unlink, periodic (and shadow), ...
+- *   usb_host_endpoint: hcpriv
+- *   fotg210_qh:	qh_next, qtd_list
+- *   fotg210_qtd:	qtd_list
+- *
+- * Also, hold this lock when talking to HC registers or
+- * when updating hw_* fields in shared qh/qtd/... structures.
+- */
+-
+-#define	FOTG210_MAX_ROOT_PORTS	1		/* see HCS_N_PORTS */
+-
+-/*
+- * fotg210_rh_state values of FOTG210_RH_RUNNING or above mean that the
+- * controller may be doing DMA.  Lower values mean there's no DMA.
+- */
+-enum fotg210_rh_state {
+-	FOTG210_RH_HALTED,
+-	FOTG210_RH_SUSPENDED,
+-	FOTG210_RH_RUNNING,
+-	FOTG210_RH_STOPPING
+-};
+-
+-/*
+- * Timer events, ordered by increasing delay length.
+- * Always update event_delays_ns[] and event_handlers[] (defined in
+- * ehci-timer.c) in parallel with this list.
+- */
+-enum fotg210_hrtimer_event {
+-	FOTG210_HRTIMER_POLL_ASS,	/* Poll for async schedule off */
+-	FOTG210_HRTIMER_POLL_PSS,	/* Poll for periodic schedule off */
+-	FOTG210_HRTIMER_POLL_DEAD,	/* Wait for dead controller to stop */
+-	FOTG210_HRTIMER_UNLINK_INTR,	/* Wait for interrupt QH unlink */
+-	FOTG210_HRTIMER_FREE_ITDS,	/* Wait for unused iTDs and siTDs */
+-	FOTG210_HRTIMER_ASYNC_UNLINKS,	/* Unlink empty async QHs */
+-	FOTG210_HRTIMER_IAA_WATCHDOG,	/* Handle lost IAA interrupts */
+-	FOTG210_HRTIMER_DISABLE_PERIODIC, /* Wait to disable periodic sched */
+-	FOTG210_HRTIMER_DISABLE_ASYNC,	/* Wait to disable async sched */
+-	FOTG210_HRTIMER_IO_WATCHDOG,	/* Check for missing IRQs */
+-	FOTG210_HRTIMER_NUM_EVENTS	/* Must come last */
+-};
+-#define FOTG210_HRTIMER_NO_EVENT	99
+-
+-struct fotg210_hcd {			/* one per controller */
+-	/* timing support */
+-	enum fotg210_hrtimer_event	next_hrtimer_event;
+-	unsigned		enabled_hrtimer_events;
+-	ktime_t			hr_timeouts[FOTG210_HRTIMER_NUM_EVENTS];
+-	struct hrtimer		hrtimer;
+-
+-	int			PSS_poll_count;
+-	int			ASS_poll_count;
+-	int			died_poll_count;
+-
+-	/* glue to PCI and HCD framework */
+-	struct fotg210_caps __iomem *caps;
+-	struct fotg210_regs __iomem *regs;
+-	struct ehci_dbg_port __iomem *debug;
+-
+-	__u32			hcs_params;	/* cached register copy */
+-	spinlock_t		lock;
+-	enum fotg210_rh_state	rh_state;
+-
+-	/* general schedule support */
+-	bool			scanning:1;
+-	bool			need_rescan:1;
+-	bool			intr_unlinking:1;
+-	bool			async_unlinking:1;
+-	bool			shutdown:1;
+-	struct fotg210_qh		*qh_scan_next;
+-
+-	/* async schedule support */
+-	struct fotg210_qh		*async;
+-	struct fotg210_qh		*dummy;		/* For AMD quirk use */
+-	struct fotg210_qh		*async_unlink;
+-	struct fotg210_qh		*async_unlink_last;
+-	struct fotg210_qh		*async_iaa;
+-	unsigned		async_unlink_cycle;
+-	unsigned		async_count;	/* async activity count */
+-
+-	/* periodic schedule support */
+-#define	DEFAULT_I_TDPS		1024		/* some HCs can do less */
+-	unsigned		periodic_size;
+-	__hc32			*periodic;	/* hw periodic table */
+-	dma_addr_t		periodic_dma;
+-	struct list_head	intr_qh_list;
+-	unsigned		i_thresh;	/* uframes HC might cache */
+-
+-	union fotg210_shadow	*pshadow;	/* mirror hw periodic table */
+-	struct fotg210_qh		*intr_unlink;
+-	struct fotg210_qh		*intr_unlink_last;
+-	unsigned		intr_unlink_cycle;
+-	unsigned		now_frame;	/* frame from HC hardware */
+-	unsigned		next_frame;	/* scan periodic, start here */
+-	unsigned		intr_count;	/* intr activity count */
+-	unsigned		isoc_count;	/* isoc activity count */
+-	unsigned		periodic_count;	/* periodic activity count */
+-	/* max periodic time per uframe */
+-	unsigned		uframe_periodic_max;
+-
+-
+-	/* list of itds completed while now_frame was still active */
+-	struct list_head	cached_itd_list;
+-	struct fotg210_itd	*last_itd_to_free;
+-
+-	/* per root hub port */
+-	unsigned long		reset_done[FOTG210_MAX_ROOT_PORTS];
+-
+-	/* bit vectors (one bit per port)
+-	 * which ports were already suspended at the start of a bus suspend
+-	 */
+-	unsigned long		bus_suspended;
+-
+-	/* which ports are edicated to the companion controller */
+-	unsigned long		companion_ports;
+-
+-	/* which ports are owned by the companion during a bus suspend */
+-	unsigned long		owned_ports;
+-
+-	/* which ports have the change-suspend feature turned on */
+-	unsigned long		port_c_suspend;
+-
+-	/* which ports are suspended */
+-	unsigned long		suspended_ports;
+-
+-	/* which ports have started to resume */
+-	unsigned long		resuming_ports;
+-
+-	/* per-HC memory pools (could be per-bus, but ...) */
+-	struct dma_pool		*qh_pool;	/* qh per active urb */
+-	struct dma_pool		*qtd_pool;	/* one or more per qh */
+-	struct dma_pool		*itd_pool;	/* itd per iso urb */
+-
+-	unsigned		random_frame;
+-	unsigned long		next_statechange;
+-	ktime_t			last_periodic_enable;
+-	u32			command;
+-
+-	/* SILICON QUIRKS */
+-	unsigned		need_io_watchdog:1;
+-	unsigned		fs_i_thresh:1;	/* Intel iso scheduling */
+-
+-	u8			sbrn;		/* packed release number */
+-
+-	/* irq statistics */
+-#ifdef FOTG210_STATS
+-	struct fotg210_stats	stats;
+-#	define INCR(x) ((x)++)
+-#else
+-#	define INCR(x) do {} while (0)
+-#endif
+-
+-	/* silicon clock */
+-	struct clk		*pclk;
+-};
+-
+-/* convert between an HCD pointer and the corresponding FOTG210_HCD */
+-static inline struct fotg210_hcd *hcd_to_fotg210(struct usb_hcd *hcd)
+-{
+-	return (struct fotg210_hcd *)(hcd->hcd_priv);
+-}
+-static inline struct usb_hcd *fotg210_to_hcd(struct fotg210_hcd *fotg210)
+-{
+-	return container_of((void *) fotg210, struct usb_hcd, hcd_priv);
+-}
+-
+-/*-------------------------------------------------------------------------*/
+-
+-/* EHCI register interface, corresponds to EHCI Revision 0.95 specification */
+-
+-/* Section 2.2 Host Controller Capability Registers */
+-struct fotg210_caps {
+-	/* these fields are specified as 8 and 16 bit registers,
+-	 * but some hosts can't perform 8 or 16 bit PCI accesses.
+-	 * some hosts treat caplength and hciversion as parts of a 32-bit
+-	 * register, others treat them as two separate registers, this
+-	 * affects the memory map for big endian controllers.
+-	 */
+-	u32		hc_capbase;
+-#define HC_LENGTH(fotg210, p)	(0x00ff&((p) >> /* bits 7:0 / offset 00h */ \
+-				(fotg210_big_endian_capbase(fotg210) ? 24 : 0)))
+-#define HC_VERSION(fotg210, p)	(0xffff&((p) >> /* bits 31:16 / offset 02h */ \
+-				(fotg210_big_endian_capbase(fotg210) ? 0 : 16)))
+-	u32		hcs_params;     /* HCSPARAMS - offset 0x4 */
+-#define HCS_N_PORTS(p)		(((p)>>0)&0xf)	/* bits 3:0, ports on HC */
+-
+-	u32		hcc_params;	/* HCCPARAMS - offset 0x8 */
+-#define HCC_CANPARK(p)		((p)&(1 << 2))  /* true: can park on async qh */
+-#define HCC_PGM_FRAMELISTLEN(p) ((p)&(1 << 1))  /* true: periodic_size changes*/
+-	u8		portroute[8];	 /* nibbles for routing - offset 0xC */
+-};
+-
+-
+-/* Section 2.3 Host Controller Operational Registers */
+-struct fotg210_regs {
+-
+-	/* USBCMD: offset 0x00 */
+-	u32		command;
+-
+-/* EHCI 1.1 addendum */
+-/* 23:16 is r/w intr rate, in microframes; default "8" == 1/msec */
+-#define CMD_PARK	(1<<11)		/* enable "park" on async qh */
+-#define CMD_PARK_CNT(c)	(((c)>>8)&3)	/* how many transfers to park for */
+-#define CMD_IAAD	(1<<6)		/* "doorbell" interrupt async advance */
+-#define CMD_ASE		(1<<5)		/* async schedule enable */
+-#define CMD_PSE		(1<<4)		/* periodic schedule enable */
+-/* 3:2 is periodic frame list size */
+-#define CMD_RESET	(1<<1)		/* reset HC not bus */
+-#define CMD_RUN		(1<<0)		/* start/stop HC */
+-
+-	/* USBSTS: offset 0x04 */
+-	u32		status;
+-#define STS_ASS		(1<<15)		/* Async Schedule Status */
+-#define STS_PSS		(1<<14)		/* Periodic Schedule Status */
+-#define STS_RECL	(1<<13)		/* Reclamation */
+-#define STS_HALT	(1<<12)		/* Not running (any reason) */
+-/* some bits reserved */
+-	/* these STS_* flags are also intr_enable bits (USBINTR) */
+-#define STS_IAA		(1<<5)		/* Interrupted on async advance */
+-#define STS_FATAL	(1<<4)		/* such as some PCI access errors */
+-#define STS_FLR		(1<<3)		/* frame list rolled over */
+-#define STS_PCD		(1<<2)		/* port change detect */
+-#define STS_ERR		(1<<1)		/* "error" completion (overflow, ...) */
+-#define STS_INT		(1<<0)		/* "normal" completion (short, ...) */
+-
+-	/* USBINTR: offset 0x08 */
+-	u32		intr_enable;
+-
+-	/* FRINDEX: offset 0x0C */
+-	u32		frame_index;	/* current microframe number */
+-	/* CTRLDSSEGMENT: offset 0x10 */
+-	u32		segment;	/* address bits 63:32 if needed */
+-	/* PERIODICLISTBASE: offset 0x14 */
+-	u32		frame_list;	/* points to periodic list */
+-	/* ASYNCLISTADDR: offset 0x18 */
+-	u32		async_next;	/* address of next async queue head */
+-
+-	u32	reserved1;
+-	/* PORTSC: offset 0x20 */
+-	u32	port_status;
+-/* 31:23 reserved */
+-#define PORT_USB11(x) (((x)&(3<<10)) == (1<<10))	/* USB 1.1 device */
+-#define PORT_RESET	(1<<8)		/* reset port */
+-#define PORT_SUSPEND	(1<<7)		/* suspend port */
+-#define PORT_RESUME	(1<<6)		/* resume it */
+-#define PORT_PEC	(1<<3)		/* port enable change */
+-#define PORT_PE		(1<<2)		/* port enable */
+-#define PORT_CSC	(1<<1)		/* connect status change */
+-#define PORT_CONNECT	(1<<0)		/* device connected */
+-#define PORT_RWC_BITS   (PORT_CSC | PORT_PEC)
+-	u32     reserved2[19];
+-
+-	/* OTGCSR: offet 0x70 */
+-	u32     otgcsr;
+-#define OTGCSR_HOST_SPD_TYP     (3 << 22)
+-#define OTGCSR_A_BUS_DROP	(1 << 5)
+-#define OTGCSR_A_BUS_REQ	(1 << 4)
+-
+-	/* OTGISR: offset 0x74 */
+-	u32     otgisr;
+-#define OTGISR_OVC	(1 << 10)
+-
+-	u32     reserved3[15];
+-
+-	/* GMIR: offset 0xB4 */
+-	u32     gmir;
+-#define GMIR_INT_POLARITY	(1 << 3) /*Active High*/
+-#define GMIR_MHC_INT		(1 << 2)
+-#define GMIR_MOTG_INT		(1 << 1)
+-#define GMIR_MDEV_INT	(1 << 0)
+-};
+-
+-/*-------------------------------------------------------------------------*/
+-
+-#define	QTD_NEXT(fotg210, dma)	cpu_to_hc32(fotg210, (u32)dma)
+-
+-/*
+- * EHCI Specification 0.95 Section 3.5
+- * QTD: describe data transfer components (buffer, direction, ...)
+- * See Fig 3-6 "Queue Element Transfer Descriptor Block Diagram".
+- *
+- * These are associated only with "QH" (Queue Head) structures,
+- * used with control, bulk, and interrupt transfers.
+- */
+-struct fotg210_qtd {
+-	/* first part defined by EHCI spec */
+-	__hc32			hw_next;	/* see EHCI 3.5.1 */
+-	__hc32			hw_alt_next;    /* see EHCI 3.5.2 */
+-	__hc32			hw_token;	/* see EHCI 3.5.3 */
+-#define	QTD_TOGGLE	(1 << 31)	/* data toggle */
+-#define	QTD_LENGTH(tok)	(((tok)>>16) & 0x7fff)
+-#define	QTD_IOC		(1 << 15)	/* interrupt on complete */
+-#define	QTD_CERR(tok)	(((tok)>>10) & 0x3)
+-#define	QTD_PID(tok)	(((tok)>>8) & 0x3)
+-#define	QTD_STS_ACTIVE	(1 << 7)	/* HC may execute this */
+-#define	QTD_STS_HALT	(1 << 6)	/* halted on error */
+-#define	QTD_STS_DBE	(1 << 5)	/* data buffer error (in HC) */
+-#define	QTD_STS_BABBLE	(1 << 4)	/* device was babbling (qtd halted) */
+-#define	QTD_STS_XACT	(1 << 3)	/* device gave illegal response */
+-#define	QTD_STS_MMF	(1 << 2)	/* incomplete split transaction */
+-#define	QTD_STS_STS	(1 << 1)	/* split transaction state */
+-#define	QTD_STS_PING	(1 << 0)	/* issue PING? */
+-
+-#define ACTIVE_BIT(fotg210)	cpu_to_hc32(fotg210, QTD_STS_ACTIVE)
+-#define HALT_BIT(fotg210)		cpu_to_hc32(fotg210, QTD_STS_HALT)
+-#define STATUS_BIT(fotg210)	cpu_to_hc32(fotg210, QTD_STS_STS)
+-
+-	__hc32			hw_buf[5];	/* see EHCI 3.5.4 */
+-	__hc32			hw_buf_hi[5];	/* Appendix B */
+-
+-	/* the rest is HCD-private */
+-	dma_addr_t		qtd_dma;		/* qtd address */
+-	struct list_head	qtd_list;		/* sw qtd list */
+-	struct urb		*urb;			/* qtd's urb */
+-	size_t			length;			/* length of buffer */
+-} __aligned(32);
+-
+-/* mask NakCnt+T in qh->hw_alt_next */
+-#define QTD_MASK(fotg210)	cpu_to_hc32(fotg210, ~0x1f)
+-
+-#define IS_SHORT_READ(token) (QTD_LENGTH(token) != 0 && QTD_PID(token) == 1)
+-
+-/*-------------------------------------------------------------------------*/
+-
+-/* type tag from {qh,itd,fstn}->hw_next */
+-#define Q_NEXT_TYPE(fotg210, dma)	((dma) & cpu_to_hc32(fotg210, 3 << 1))
+-
+-/*
+- * Now the following defines are not converted using the
+- * cpu_to_le32() macro anymore, since we have to support
+- * "dynamic" switching between be and le support, so that the driver
+- * can be used on one system with SoC EHCI controller using big-endian
+- * descriptors as well as a normal little-endian PCI EHCI controller.
+- */
+-/* values for that type tag */
+-#define Q_TYPE_ITD	(0 << 1)
+-#define Q_TYPE_QH	(1 << 1)
+-#define Q_TYPE_SITD	(2 << 1)
+-#define Q_TYPE_FSTN	(3 << 1)
+-
+-/* next async queue entry, or pointer to interrupt/periodic QH */
+-#define QH_NEXT(fotg210, dma) \
+-	(cpu_to_hc32(fotg210, (((u32)dma)&~0x01f)|Q_TYPE_QH))
+-
+-/* for periodic/async schedules and qtd lists, mark end of list */
+-#define FOTG210_LIST_END(fotg210) \
+-	cpu_to_hc32(fotg210, 1) /* "null pointer" to hw */
+-
+-/*
+- * Entries in periodic shadow table are pointers to one of four kinds
+- * of data structure.  That's dictated by the hardware; a type tag is
+- * encoded in the low bits of the hardware's periodic schedule.  Use
+- * Q_NEXT_TYPE to get the tag.
+- *
+- * For entries in the async schedule, the type tag always says "qh".
+- */
+-union fotg210_shadow {
+-	struct fotg210_qh	*qh;		/* Q_TYPE_QH */
+-	struct fotg210_itd	*itd;		/* Q_TYPE_ITD */
+-	struct fotg210_fstn	*fstn;		/* Q_TYPE_FSTN */
+-	__hc32			*hw_next;	/* (all types) */
+-	void			*ptr;
+-};
+-
+-/*-------------------------------------------------------------------------*/
+-
+-/*
+- * EHCI Specification 0.95 Section 3.6
+- * QH: describes control/bulk/interrupt endpoints
+- * See Fig 3-7 "Queue Head Structure Layout".
+- *
+- * These appear in both the async and (for interrupt) periodic schedules.
+- */
+-
+-/* first part defined by EHCI spec */
+-struct fotg210_qh_hw {
+-	__hc32			hw_next;	/* see EHCI 3.6.1 */
+-	__hc32			hw_info1;	/* see EHCI 3.6.2 */
+-#define	QH_CONTROL_EP	(1 << 27)	/* FS/LS control endpoint */
+-#define	QH_HEAD		(1 << 15)	/* Head of async reclamation list */
+-#define	QH_TOGGLE_CTL	(1 << 14)	/* Data toggle control */
+-#define	QH_HIGH_SPEED	(2 << 12)	/* Endpoint speed */
+-#define	QH_LOW_SPEED	(1 << 12)
+-#define	QH_FULL_SPEED	(0 << 12)
+-#define	QH_INACTIVATE	(1 << 7)	/* Inactivate on next transaction */
+-	__hc32			hw_info2;	/* see EHCI 3.6.2 */
+-#define	QH_SMASK	0x000000ff
+-#define	QH_CMASK	0x0000ff00
+-#define	QH_HUBADDR	0x007f0000
+-#define	QH_HUBPORT	0x3f800000
+-#define	QH_MULT		0xc0000000
+-	__hc32			hw_current;	/* qtd list - see EHCI 3.6.4 */
+-
+-	/* qtd overlay (hardware parts of a struct fotg210_qtd) */
+-	__hc32			hw_qtd_next;
+-	__hc32			hw_alt_next;
+-	__hc32			hw_token;
+-	__hc32			hw_buf[5];
+-	__hc32			hw_buf_hi[5];
+-} __aligned(32);
+-
+-struct fotg210_qh {
+-	struct fotg210_qh_hw	*hw;		/* Must come first */
+-	/* the rest is HCD-private */
+-	dma_addr_t		qh_dma;		/* address of qh */
+-	union fotg210_shadow	qh_next;	/* ptr to qh; or periodic */
+-	struct list_head	qtd_list;	/* sw qtd list */
+-	struct list_head	intr_node;	/* list of intr QHs */
+-	struct fotg210_qtd	*dummy;
+-	struct fotg210_qh	*unlink_next;	/* next on unlink list */
+-
+-	unsigned		unlink_cycle;
+-
+-	u8			needs_rescan;	/* Dequeue during giveback */
+-	u8			qh_state;
+-#define	QH_STATE_LINKED		1		/* HC sees this */
+-#define	QH_STATE_UNLINK		2		/* HC may still see this */
+-#define	QH_STATE_IDLE		3		/* HC doesn't see this */
+-#define	QH_STATE_UNLINK_WAIT	4		/* LINKED and on unlink q */
+-#define	QH_STATE_COMPLETING	5		/* don't touch token.HALT */
+-
+-	u8			xacterrs;	/* XactErr retry counter */
+-#define	QH_XACTERR_MAX		32		/* XactErr retry limit */
+-
+-	/* periodic schedule info */
+-	u8			usecs;		/* intr bandwidth */
+-	u8			gap_uf;		/* uframes split/csplit gap */
+-	u8			c_usecs;	/* ... split completion bw */
+-	u16			tt_usecs;	/* tt downstream bandwidth */
+-	unsigned short		period;		/* polling interval */
+-	unsigned short		start;		/* where polling starts */
+-#define NO_FRAME ((unsigned short)~0)			/* pick new start */
+-
+-	struct usb_device	*dev;		/* access to TT */
+-	unsigned		is_out:1;	/* bulk or intr OUT */
+-	unsigned		clearing_tt:1;	/* Clear-TT-Buf in progress */
+-};
+-
+-/*-------------------------------------------------------------------------*/
+-
+-/* description of one iso transaction (up to 3 KB data if highspeed) */
+-struct fotg210_iso_packet {
+-	/* These will be copied to iTD when scheduling */
+-	u64			bufp;		/* itd->hw_bufp{,_hi}[pg] |= */
+-	__hc32			transaction;	/* itd->hw_transaction[i] |= */
+-	u8			cross;		/* buf crosses pages */
+-	/* for full speed OUT splits */
+-	u32			buf1;
+-};
+-
+-/* temporary schedule data for packets from iso urbs (both speeds)
+- * each packet is one logical usb transaction to the device (not TT),
+- * beginning at stream->next_uframe
+- */
+-struct fotg210_iso_sched {
+-	struct list_head	td_list;
+-	unsigned		span;
+-	struct fotg210_iso_packet	packet[];
+-};
+-
+-/*
+- * fotg210_iso_stream - groups all (s)itds for this endpoint.
+- * acts like a qh would, if EHCI had them for ISO.
+- */
+-struct fotg210_iso_stream {
+-	/* first field matches fotg210_hq, but is NULL */
+-	struct fotg210_qh_hw	*hw;
+-
+-	u8			bEndpointAddress;
+-	u8			highspeed;
+-	struct list_head	td_list;	/* queued itds */
+-	struct list_head	free_list;	/* list of unused itds */
+-	struct usb_device	*udev;
+-	struct usb_host_endpoint *ep;
+-
+-	/* output of (re)scheduling */
+-	int			next_uframe;
+-	__hc32			splits;
+-
+-	/* the rest is derived from the endpoint descriptor,
+-	 * trusting urb->interval == f(epdesc->bInterval) and
+-	 * including the extra info for hw_bufp[0..2]
+-	 */
+-	u8			usecs, c_usecs;
+-	u16			interval;
+-	u16			tt_usecs;
+-	u16			maxp;
+-	u16			raw_mask;
+-	unsigned		bandwidth;
+-
+-	/* This is used to initialize iTD's hw_bufp fields */
+-	__hc32			buf0;
+-	__hc32			buf1;
+-	__hc32			buf2;
+-
+-	/* this is used to initialize sITD's tt info */
+-	__hc32			address;
+-};
+-
+-/*-------------------------------------------------------------------------*/
+-
+-/*
+- * EHCI Specification 0.95 Section 3.3
+- * Fig 3-4 "Isochronous Transaction Descriptor (iTD)"
+- *
+- * Schedule records for high speed iso xfers
+- */
+-struct fotg210_itd {
+-	/* first part defined by EHCI spec */
+-	__hc32			hw_next;	/* see EHCI 3.3.1 */
+-	__hc32			hw_transaction[8]; /* see EHCI 3.3.2 */
+-#define FOTG210_ISOC_ACTIVE	(1<<31)	/* activate transfer this slot */
+-#define FOTG210_ISOC_BUF_ERR	(1<<30)	/* Data buffer error */
+-#define FOTG210_ISOC_BABBLE	(1<<29)	/* babble detected */
+-#define FOTG210_ISOC_XACTERR	(1<<28)	/* XactErr - transaction error */
+-#define	FOTG210_ITD_LENGTH(tok)	(((tok)>>16) & 0x0fff)
+-#define	FOTG210_ITD_IOC		(1 << 15)	/* interrupt on complete */
+-
+-#define ITD_ACTIVE(fotg210)	cpu_to_hc32(fotg210, FOTG210_ISOC_ACTIVE)
+-
+-	__hc32			hw_bufp[7];	/* see EHCI 3.3.3 */
+-	__hc32			hw_bufp_hi[7];	/* Appendix B */
+-
+-	/* the rest is HCD-private */
+-	dma_addr_t		itd_dma;	/* for this itd */
+-	union fotg210_shadow	itd_next;	/* ptr to periodic q entry */
+-
+-	struct urb		*urb;
+-	struct fotg210_iso_stream	*stream;	/* endpoint's queue */
+-	struct list_head	itd_list;	/* list of stream's itds */
+-
+-	/* any/all hw_transactions here may be used by that urb */
+-	unsigned		frame;		/* where scheduled */
+-	unsigned		pg;
+-	unsigned		index[8];	/* in urb->iso_frame_desc */
+-} __aligned(32);
+-
+-/*-------------------------------------------------------------------------*/
+-
+-/*
+- * EHCI Specification 0.96 Section 3.7
+- * Periodic Frame Span Traversal Node (FSTN)
+- *
+- * Manages split interrupt transactions (using TT) that span frame boundaries
+- * into uframes 0/1; see 4.12.2.2.  In those uframes, a "save place" FSTN
+- * makes the HC jump (back) to a QH to scan for fs/ls QH completions until
+- * it hits a "restore" FSTN; then it returns to finish other uframe 0/1 work.
+- */
+-struct fotg210_fstn {
+-	__hc32			hw_next;	/* any periodic q entry */
+-	__hc32			hw_prev;	/* qh or FOTG210_LIST_END */
+-
+-	/* the rest is HCD-private */
+-	dma_addr_t		fstn_dma;
+-	union fotg210_shadow	fstn_next;	/* ptr to periodic q entry */
+-} __aligned(32);
+-
+-/*-------------------------------------------------------------------------*/
+-
+-/* Prepare the PORTSC wakeup flags during controller suspend/resume */
+-
+-#define fotg210_prepare_ports_for_controller_suspend(fotg210, do_wakeup) \
+-		fotg210_adjust_port_wakeup_flags(fotg210, true, do_wakeup)
+-
+-#define fotg210_prepare_ports_for_controller_resume(fotg210)		\
+-		fotg210_adjust_port_wakeup_flags(fotg210, false, false)
+-
+-/*-------------------------------------------------------------------------*/
+-
+-/*
+- * Some EHCI controllers have a Transaction Translator built into the
+- * root hub. This is a non-standard feature.  Each controller will need
+- * to add code to the following inline functions, and call them as
+- * needed (mostly in root hub code).
+- */
+-
+-static inline unsigned int
+-fotg210_get_speed(struct fotg210_hcd *fotg210, unsigned int portsc)
+-{
+-	return (readl(&fotg210->regs->otgcsr)
+-		& OTGCSR_HOST_SPD_TYP) >> 22;
+-}
+-
+-/* Returns the speed of a device attached to a port on the root hub. */
+-static inline unsigned int
+-fotg210_port_speed(struct fotg210_hcd *fotg210, unsigned int portsc)
+-{
+-	switch (fotg210_get_speed(fotg210, portsc)) {
+-	case 0:
+-		return 0;
+-	case 1:
+-		return USB_PORT_STAT_LOW_SPEED;
+-	case 2:
+-	default:
+-		return USB_PORT_STAT_HIGH_SPEED;
+-	}
+-}
+-
+-/*-------------------------------------------------------------------------*/
+-
+-#define	fotg210_has_fsl_portno_bug(e)		(0)
+-
+-/*
+- * While most USB host controllers implement their registers in
+- * little-endian format, a minority (celleb companion chip) implement
+- * them in big endian format.
+- *
+- * This attempts to support either format at compile time without a
+- * runtime penalty, or both formats with the additional overhead
+- * of checking a flag bit.
+- *
+- */
+-
+-#define fotg210_big_endian_mmio(e)	0
+-#define fotg210_big_endian_capbase(e)	0
+-
+-static inline unsigned int fotg210_readl(const struct fotg210_hcd *fotg210,
+-		__u32 __iomem *regs)
+-{
+-	return readl(regs);
+-}
+-
+-static inline void fotg210_writel(const struct fotg210_hcd *fotg210,
+-		const unsigned int val, __u32 __iomem *regs)
+-{
+-	writel(val, regs);
+-}
+-
+-/* cpu to fotg210 */
+-static inline __hc32 cpu_to_hc32(const struct fotg210_hcd *fotg210, const u32 x)
+-{
+-	return cpu_to_le32(x);
+-}
+-
+-/* fotg210 to cpu */
+-static inline u32 hc32_to_cpu(const struct fotg210_hcd *fotg210, const __hc32 x)
+-{
+-	return le32_to_cpu(x);
+-}
+-
+-static inline u32 hc32_to_cpup(const struct fotg210_hcd *fotg210,
+-			       const __hc32 *x)
+-{
+-	return le32_to_cpup(x);
+-}
+-
+-/*-------------------------------------------------------------------------*/
+-
+-static inline unsigned fotg210_read_frame_index(struct fotg210_hcd *fotg210)
+-{
+-	return fotg210_readl(fotg210, &fotg210->regs->frame_index);
+-}
+-
+-/*-------------------------------------------------------------------------*/
+-
+-#endif /* __LINUX_FOTG210_H */
diff --git a/target/linux/gemini/patches-6.1/0003-usb-fotg210-Compile-into-one-module.patch b/target/linux/gemini/patches-6.1/0003-usb-fotg210-Compile-into-one-module.patch
new file mode 100644
index 00000000000000..5c7b4ff9c79443
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0003-usb-fotg210-Compile-into-one-module.patch
@@ -0,0 +1,332 @@
+From 0dbc77a99267a5efef0603a4b49ac02ece6a3f23 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Sun, 23 Oct 2022 16:47:07 +0200
+Subject: [PATCH 03/29] usb: fotg210: Compile into one module
+
+It is since ages perfectly possible to compile both of these
+modules into the same kernel, which makes no sense since it
+is one piece of hardware.
+
+Compile one module named "fotg210.ko" for both HCD and UDC
+drivers by collecting the init calls into a fotg210-core.c
+file and start to centralize things handling one and the same
+piece of hardware.
+
+Stub out the initcalls if one or the other part of the driver
+was not selected.
+
+Tested by compiling one or the other or both of the drivers
+into the kernel and as modules.
+
+Cc: Fabian Vogt <fabian@ritter-vogt.de>
+Cc: Yuan-Hsin Chen <yhchen@faraday-tech.com>
+Cc: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20221023144708.3596563-2-linus.walleij@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/Kconfig
++++ b/drivers/usb/fotg210/Kconfig
+@@ -12,7 +12,7 @@ config USB_FOTG210
+ if USB_FOTG210
+ 
+ config USB_FOTG210_HCD
+-	tristate "Faraday FOTG210 USB Host Controller support"
++	bool "Faraday FOTG210 USB Host Controller support"
+ 	depends on USB
+ 	help
+ 	  Faraday FOTG210 is an OTG controller which can be configured as
+@@ -24,7 +24,7 @@ config USB_FOTG210_HCD
+ 
+ config USB_FOTG210_UDC
+ 	depends on USB_GADGET
+-	tristate "Faraday FOTG210 USB Peripheral Controller support"
++	bool "Faraday FOTG210 USB Peripheral Controller support"
+ 	help
+ 	   Faraday USB2.0 OTG controller which can be configured as
+ 	   high speed or full speed USB device. This driver suppports
+--- a/drivers/usb/fotg210/Makefile
++++ b/drivers/usb/fotg210/Makefile
+@@ -1,3 +1,10 @@
+ # SPDX-License-Identifier: GPL-2.0
+-obj-$(CONFIG_USB_FOTG210_HCD)	+= fotg210-hcd.o
+-obj-$(CONFIG_USB_FOTG210_UDC)	+= fotg210-udc.o
++
++# This setup links the different object files into one single
++# module so we don't have to EXPORT() a lot of internal symbols
++# or create unnecessary submodules.
++fotg210-objs-y				+= fotg210-core.o
++fotg210-objs-$(CONFIG_USB_FOTG210_HCD)	+= fotg210-hcd.o
++fotg210-objs-$(CONFIG_USB_FOTG210_UDC)	+= fotg210-udc.o
++fotg210-objs				:= $(fotg210-objs-y)
++obj-$(CONFIG_USB_FOTG210)		+= fotg210.o
+--- /dev/null
++++ b/drivers/usb/fotg210/fotg210-core.c
+@@ -0,0 +1,79 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Central probing code for the FOTG210 dual role driver
++ * We register one driver for the hardware and then we decide
++ * whether to proceed with probing the host or the peripheral
++ * driver.
++ */
++#include <linux/device.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/usb.h>
++
++#include "fotg210.h"
++
++static int fotg210_probe(struct platform_device *pdev)
++{
++	int ret;
++
++	if (IS_ENABLED(CONFIG_USB_FOTG210_HCD)) {
++		ret = fotg210_hcd_probe(pdev);
++		if (ret)
++			return ret;
++	}
++	if (IS_ENABLED(CONFIG_USB_FOTG210_UDC))
++		ret = fotg210_udc_probe(pdev);
++
++	return ret;
++}
++
++static int fotg210_remove(struct platform_device *pdev)
++{
++	if (IS_ENABLED(CONFIG_USB_FOTG210_HCD))
++		fotg210_hcd_remove(pdev);
++	if (IS_ENABLED(CONFIG_USB_FOTG210_UDC))
++		fotg210_udc_remove(pdev);
++
++	return 0;
++}
++
++#ifdef CONFIG_OF
++static const struct of_device_id fotg210_of_match[] = {
++	{ .compatible = "faraday,fotg210" },
++	{},
++};
++MODULE_DEVICE_TABLE(of, fotg210_of_match);
++#endif
++
++static struct platform_driver fotg210_driver = {
++	.driver = {
++		.name   = "fotg210",
++		.of_match_table = of_match_ptr(fotg210_of_match),
++	},
++	.probe  = fotg210_probe,
++	.remove = fotg210_remove,
++};
++
++static int __init fotg210_init(void)
++{
++	if (usb_disabled())
++		return -ENODEV;
++
++	if (IS_ENABLED(CONFIG_USB_FOTG210_HCD))
++		fotg210_hcd_init();
++	return platform_driver_register(&fotg210_driver);
++}
++module_init(fotg210_init);
++
++static void __exit fotg210_cleanup(void)
++{
++	platform_driver_unregister(&fotg210_driver);
++	if (IS_ENABLED(CONFIG_USB_FOTG210_HCD))
++		fotg210_hcd_cleanup();
++}
++module_exit(fotg210_cleanup);
++
++MODULE_AUTHOR("Yuan-Hsin Chen, Feng-Hsin Chiang");
++MODULE_LICENSE("GPL");
++MODULE_DESCRIPTION("FOTG210 Dual Role Controller Driver");
+--- a/drivers/usb/fotg210/fotg210-hcd.c
++++ b/drivers/usb/fotg210/fotg210-hcd.c
+@@ -39,8 +39,8 @@
+ #include <asm/irq.h>
+ #include <asm/unaligned.h>
+ 
+-#define DRIVER_AUTHOR "Yuan-Hsin Chen"
+-#define DRIVER_DESC "FOTG210 Host Controller (EHCI) Driver"
++#include "fotg210.h"
++
+ static const char hcd_name[] = "fotg210_hcd";
+ 
+ #undef FOTG210_URB_TRACE
+@@ -5490,9 +5490,6 @@ static int fotg210_get_frame(struct usb_
+  * functions  and in order to facilitate role switching we cannot
+  * give the fotg210 driver exclusive access to those.
+  */
+-MODULE_DESCRIPTION(DRIVER_DESC);
+-MODULE_AUTHOR(DRIVER_AUTHOR);
+-MODULE_LICENSE("GPL");
+ 
+ static const struct hc_driver fotg210_fotg210_hc_driver = {
+ 	.description		= hcd_name,
+@@ -5560,7 +5557,7 @@ static void fotg210_init(struct fotg210_
+  * then invokes the start() method for the HCD associated with it
+  * through the hotplug entry's driver_data.
+  */
+-static int fotg210_hcd_probe(struct platform_device *pdev)
++int fotg210_hcd_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
+ 	struct usb_hcd *hcd;
+@@ -5652,7 +5649,7 @@ fail_create_hcd:
+  * @dev: USB Host Controller being removed
+  *
+  */
+-static int fotg210_hcd_remove(struct platform_device *pdev)
++int fotg210_hcd_remove(struct platform_device *pdev)
+ {
+ 	struct usb_hcd *hcd = platform_get_drvdata(pdev);
+ 	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
+@@ -5668,27 +5665,8 @@ static int fotg210_hcd_remove(struct pla
+ 	return 0;
+ }
+ 
+-#ifdef CONFIG_OF
+-static const struct of_device_id fotg210_of_match[] = {
+-	{ .compatible = "faraday,fotg210" },
+-	{},
+-};
+-MODULE_DEVICE_TABLE(of, fotg210_of_match);
+-#endif
+-
+-static struct platform_driver fotg210_hcd_driver = {
+-	.driver = {
+-		.name   = "fotg210-hcd",
+-		.of_match_table = of_match_ptr(fotg210_of_match),
+-	},
+-	.probe  = fotg210_hcd_probe,
+-	.remove = fotg210_hcd_remove,
+-};
+-
+-static int __init fotg210_hcd_init(void)
++int __init fotg210_hcd_init(void)
+ {
+-	int retval = 0;
+-
+ 	if (usb_disabled())
+ 		return -ENODEV;
+ 
+@@ -5704,24 +5682,11 @@ static int __init fotg210_hcd_init(void)
+ 
+ 	fotg210_debug_root = debugfs_create_dir("fotg210", usb_debug_root);
+ 
+-	retval = platform_driver_register(&fotg210_hcd_driver);
+-	if (retval < 0)
+-		goto clean;
+-	return retval;
+-
+-clean:
+-	debugfs_remove(fotg210_debug_root);
+-	fotg210_debug_root = NULL;
+-
+-	clear_bit(USB_EHCI_LOADED, &usb_hcds_loaded);
+-	return retval;
++	return 0;
+ }
+-module_init(fotg210_hcd_init);
+ 
+-static void __exit fotg210_hcd_cleanup(void)
++void __exit fotg210_hcd_cleanup(void)
+ {
+-	platform_driver_unregister(&fotg210_hcd_driver);
+ 	debugfs_remove(fotg210_debug_root);
+ 	clear_bit(USB_EHCI_LOADED, &usb_hcds_loaded);
+ }
+-module_exit(fotg210_hcd_cleanup);
+--- a/drivers/usb/fotg210/fotg210-udc.c
++++ b/drivers/usb/fotg210/fotg210-udc.c
+@@ -16,6 +16,7 @@
+ #include <linux/usb/ch9.h>
+ #include <linux/usb/gadget.h>
+ 
++#include "fotg210.h"
+ #include "fotg210-udc.h"
+ 
+ #define	DRIVER_DESC	"FOTG210 USB Device Controller Driver"
+@@ -1081,7 +1082,7 @@ static const struct usb_gadget_ops fotg2
+ 	.udc_stop		= fotg210_udc_stop,
+ };
+ 
+-static int fotg210_udc_remove(struct platform_device *pdev)
++int fotg210_udc_remove(struct platform_device *pdev)
+ {
+ 	struct fotg210_udc *fotg210 = platform_get_drvdata(pdev);
+ 	int i;
+@@ -1098,7 +1099,7 @@ static int fotg210_udc_remove(struct pla
+ 	return 0;
+ }
+ 
+-static int fotg210_udc_probe(struct platform_device *pdev)
++int fotg210_udc_probe(struct platform_device *pdev)
+ {
+ 	struct resource *res, *ires;
+ 	struct fotg210_udc *fotg210 = NULL;
+@@ -1223,17 +1224,3 @@ err_alloc:
+ err:
+ 	return ret;
+ }
+-
+-static struct platform_driver fotg210_driver = {
+-	.driver		= {
+-		.name =	udc_name,
+-	},
+-	.probe		= fotg210_udc_probe,
+-	.remove		= fotg210_udc_remove,
+-};
+-
+-module_platform_driver(fotg210_driver);
+-
+-MODULE_AUTHOR("Yuan-Hsin Chen, Feng-Hsin Chiang <john453@faraday-tech.com>");
+-MODULE_LICENSE("GPL");
+-MODULE_DESCRIPTION(DRIVER_DESC);
+--- /dev/null
++++ b/drivers/usb/fotg210/fotg210.h
+@@ -0,0 +1,42 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef __FOTG210_H
++#define __FOTG210_H
++
++#ifdef CONFIG_USB_FOTG210_HCD
++int fotg210_hcd_probe(struct platform_device *pdev);
++int fotg210_hcd_remove(struct platform_device *pdev);
++int fotg210_hcd_init(void);
++void fotg210_hcd_cleanup(void);
++#else
++static inline int fotg210_hcd_probe(struct platform_device *pdev)
++{
++	return 0;
++}
++static inline int fotg210_hcd_remove(struct platform_device *pdev)
++{
++	return 0;
++}
++static inline int fotg210_hcd_init(void)
++{
++	return 0;
++}
++static inline void fotg210_hcd_cleanup(void)
++{
++}
++#endif
++
++#ifdef CONFIG_USB_FOTG210_UDC
++int fotg210_udc_probe(struct platform_device *pdev);
++int fotg210_udc_remove(struct platform_device *pdev);
++#else
++static inline int fotg210_udc_probe(struct platform_device *pdev)
++{
++	return 0;
++}
++static inline int fotg210_udc_remove(struct platform_device *pdev)
++{
++	return 0;
++}
++#endif
++
++#endif /* __FOTG210_H */
diff --git a/target/linux/gemini/patches-6.1/0004-usb-fotg210-Select-subdriver-by-mode.patch b/target/linux/gemini/patches-6.1/0004-usb-fotg210-Select-subdriver-by-mode.patch
new file mode 100644
index 00000000000000..6a19a0aa4d9cb2
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0004-usb-fotg210-Select-subdriver-by-mode.patch
@@ -0,0 +1,68 @@
+From 7c0b661926097e935f2711857596fc2277b2304a Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Sun, 23 Oct 2022 16:47:08 +0200
+Subject: [PATCH 04/29] usb: fotg210: Select subdriver by mode
+
+Check which mode the hardware is in, and selecte the peripheral
+driver if the hardware is in explicit peripheral mode, otherwise
+select host mode.
+
+This should solve the immediate problem that both subdrivers
+can get probed.
+
+Cc: Fabian Vogt <fabian@ritter-vogt.de>
+Cc: Yuan-Hsin Chen <yhchen@faraday-tech.com>
+Cc: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20221023144708.3596563-3-linus.walleij@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/fotg210-core.c
++++ b/drivers/usb/fotg210/fotg210-core.c
+@@ -10,30 +10,37 @@
+ #include <linux/of.h>
+ #include <linux/platform_device.h>
+ #include <linux/usb.h>
++#include <linux/usb/otg.h>
+ 
+ #include "fotg210.h"
+ 
+ static int fotg210_probe(struct platform_device *pdev)
+ {
++	struct device *dev = &pdev->dev;
++	enum usb_dr_mode mode;
+ 	int ret;
+ 
+-	if (IS_ENABLED(CONFIG_USB_FOTG210_HCD)) {
+-		ret = fotg210_hcd_probe(pdev);
+-		if (ret)
+-			return ret;
+-	}
+-	if (IS_ENABLED(CONFIG_USB_FOTG210_UDC))
++	mode = usb_get_dr_mode(dev);
++
++	if (mode == USB_DR_MODE_PERIPHERAL)
+ 		ret = fotg210_udc_probe(pdev);
++	else
++		ret = fotg210_hcd_probe(pdev);
+ 
+ 	return ret;
+ }
+ 
+ static int fotg210_remove(struct platform_device *pdev)
+ {
+-	if (IS_ENABLED(CONFIG_USB_FOTG210_HCD))
+-		fotg210_hcd_remove(pdev);
+-	if (IS_ENABLED(CONFIG_USB_FOTG210_UDC))
++	struct device *dev = &pdev->dev;
++	enum usb_dr_mode mode;
++
++	mode = usb_get_dr_mode(dev);
++
++	if (mode == USB_DR_MODE_PERIPHERAL)
+ 		fotg210_udc_remove(pdev);
++	else
++		fotg210_hcd_remove(pdev);
+ 
+ 	return 0;
+ }
diff --git a/target/linux/gemini/patches-6.1/0005-usb-fotg2-add-Gemini-specific-handling.patch b/target/linux/gemini/patches-6.1/0005-usb-fotg2-add-Gemini-specific-handling.patch
new file mode 100644
index 00000000000000..daf8d856117003
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0005-usb-fotg2-add-Gemini-specific-handling.patch
@@ -0,0 +1,135 @@
+From f7f6c8aca91093e2f886ec97910b1a7d9a69bf9b Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Wed, 9 Nov 2022 21:05:54 +0100
+Subject: [PATCH 05/29] usb: fotg2: add Gemini-specific handling
+
+The Cortina Systems Gemini has bolted on a PHY inside the
+silicon that can be handled by six bits in a MISC register in
+the system controller.
+
+If we are running on Gemini, look up a syscon regmap through
+a phandle and enable VBUS and optionally the Mini-B connector.
+
+If the device is flagged as "wakeup-source" using the standard
+DT bindings, we also enable this in the global controller for
+respective port.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20221109200554.1957185-1-linus.walleij@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/Kconfig
++++ b/drivers/usb/fotg210/Kconfig
+@@ -5,6 +5,7 @@ config USB_FOTG210
+ 	depends on USB || USB_GADGET
+ 	depends on HAS_DMA && HAS_IOMEM
+ 	default ARCH_GEMINI
++	select MFD_SYSCON
+ 	help
+ 	  Faraday FOTG210 is a dual-mode USB controller that can act
+ 	  in both host controller and peripheral controller mode.
+--- a/drivers/usb/fotg210/fotg210-core.c
++++ b/drivers/usb/fotg210/fotg210-core.c
+@@ -5,15 +5,86 @@
+  * whether to proceed with probing the host or the peripheral
+  * driver.
+  */
++#include <linux/bitops.h>
+ #include <linux/device.h>
++#include <linux/mfd/syscon.h>
+ #include <linux/module.h>
+ #include <linux/of.h>
+ #include <linux/platform_device.h>
++#include <linux/regmap.h>
+ #include <linux/usb.h>
+ #include <linux/usb/otg.h>
+ 
+ #include "fotg210.h"
+ 
++/*
++ * Gemini-specific initialization function, only executed on the
++ * Gemini SoC using the global misc control register.
++ *
++ * The gemini USB blocks are connected to either Mini-A (host mode) or
++ * Mini-B (peripheral mode) plugs. There is no role switch support on the
++ * Gemini SoC, just either-or.
++ */
++#define GEMINI_GLOBAL_MISC_CTRL		0x30
++#define GEMINI_MISC_USB0_WAKEUP		BIT(14)
++#define GEMINI_MISC_USB1_WAKEUP		BIT(15)
++#define GEMINI_MISC_USB0_VBUS_ON	BIT(22)
++#define GEMINI_MISC_USB1_VBUS_ON	BIT(23)
++#define GEMINI_MISC_USB0_MINI_B		BIT(29)
++#define GEMINI_MISC_USB1_MINI_B		BIT(30)
++
++static int fotg210_gemini_init(struct device *dev, struct resource *res,
++			       enum usb_dr_mode mode)
++{
++	struct device_node *np = dev->of_node;
++	struct regmap *map;
++	bool wakeup;
++	u32 mask, val;
++	int ret;
++
++	map = syscon_regmap_lookup_by_phandle(np, "syscon");
++	if (IS_ERR(map)) {
++		dev_err(dev, "no syscon\n");
++		return PTR_ERR(map);
++	}
++	wakeup = of_property_read_bool(np, "wakeup-source");
++
++	/*
++	 * Figure out if this is USB0 or USB1 by simply checking the
++	 * physical base address.
++	 */
++	mask = 0;
++	if (res->start == 0x69000000) {
++		mask = GEMINI_MISC_USB1_VBUS_ON | GEMINI_MISC_USB1_MINI_B |
++			GEMINI_MISC_USB1_WAKEUP;
++		if (mode == USB_DR_MODE_HOST)
++			val = GEMINI_MISC_USB1_VBUS_ON;
++		else
++			val = GEMINI_MISC_USB1_MINI_B;
++		if (wakeup)
++			val |= GEMINI_MISC_USB1_WAKEUP;
++	} else {
++		mask = GEMINI_MISC_USB0_VBUS_ON | GEMINI_MISC_USB0_MINI_B |
++			GEMINI_MISC_USB0_WAKEUP;
++		if (mode == USB_DR_MODE_HOST)
++			val = GEMINI_MISC_USB0_VBUS_ON;
++		else
++			val = GEMINI_MISC_USB0_MINI_B;
++		if (wakeup)
++			val |= GEMINI_MISC_USB0_WAKEUP;
++	}
++
++	ret = regmap_update_bits(map, GEMINI_GLOBAL_MISC_CTRL, mask, val);
++	if (ret) {
++		dev_err(dev, "failed to initialize Gemini PHY\n");
++		return ret;
++	}
++
++	dev_info(dev, "initialized Gemini PHY in %s mode\n",
++		 (mode == USB_DR_MODE_HOST) ? "host" : "gadget");
++	return 0;
++}
++
+ static int fotg210_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
+@@ -22,6 +93,15 @@ static int fotg210_probe(struct platform
+ 
+ 	mode = usb_get_dr_mode(dev);
+ 
++	if (of_device_is_compatible(dev->of_node, "cortina,gemini-usb")) {
++		struct resource *res;
++
++		res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++		ret = fotg210_gemini_init(dev, res, mode);
++		if (ret)
++			return ret;
++	}
++
+ 	if (mode == USB_DR_MODE_PERIPHERAL)
+ 		ret = fotg210_udc_probe(pdev);
+ 	else
diff --git a/target/linux/gemini/patches-6.1/0006-usb-fotg210-Fix-Kconfig-for-USB-host-modules.patch b/target/linux/gemini/patches-6.1/0006-usb-fotg210-Fix-Kconfig-for-USB-host-modules.patch
new file mode 100644
index 00000000000000..bd3a42415a412c
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0006-usb-fotg210-Fix-Kconfig-for-USB-host-modules.patch
@@ -0,0 +1,51 @@
+From 6e002d41889bc52213a26ff91338d340505e0336 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Fri, 11 Nov 2022 15:48:21 +0100
+Subject: [PATCH 06/29] usb: fotg210: Fix Kconfig for USB host modules
+
+The kernel robot reports a link failure when activating the
+FOTG210 host subdriver with =y on a system where the USB host
+core is a module (CONFIG_USB=m).
+
+This is a bit of special case, so mimic the Kconfig incantations
+from DWC3: let the subdrivers for host or peripheral depend
+on the host or gadget support being =y or the same as the
+FOTG210 core itself.
+
+This should ensure that either:
+
+- The host (CONFIG_USB) or gadget (CONFIG_GADGET) is compiled
+  in and then the FOTG210 can be either module or compiled
+  in.
+
+- The host or gadget is modular, and then the FOTG210 module
+  must be a module too, or we cannot resolve the symbols
+  at link time.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Link: https://lore.kernel.org/linux-usb/202211112132.0BUPGKCd-lkp@intel.com/
+Cc: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20221111144821.113665-1-linus.walleij@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/Kconfig
++++ b/drivers/usb/fotg210/Kconfig
+@@ -14,7 +14,7 @@ if USB_FOTG210
+ 
+ config USB_FOTG210_HCD
+ 	bool "Faraday FOTG210 USB Host Controller support"
+-	depends on USB
++	depends on USB=y || USB=USB_FOTG210
+ 	help
+ 	  Faraday FOTG210 is an OTG controller which can be configured as
+ 	  an USB2.0 host. It is designed to meet USB2.0 EHCI specification
+@@ -24,7 +24,7 @@ config USB_FOTG210_HCD
+ 	  module will be called fotg210-hcd.
+ 
+ config USB_FOTG210_UDC
+-	depends on USB_GADGET
++	depends on USB_GADGET=y || USB_GADGET=USB_FOTG210
+ 	bool "Faraday FOTG210 USB Peripheral Controller support"
+ 	help
+ 	   Faraday USB2.0 OTG controller which can be configured as
diff --git a/target/linux/gemini/patches-6.1/0007-usb-USB_FOTG210-should-depend-on-ARCH_GEMINI.patch b/target/linux/gemini/patches-6.1/0007-usb-USB_FOTG210-should-depend-on-ARCH_GEMINI.patch
new file mode 100644
index 00000000000000..6afef0d8200098
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0007-usb-USB_FOTG210-should-depend-on-ARCH_GEMINI.patch
@@ -0,0 +1,26 @@
+From 466b10510add46afd21ca19505b29d35ad853370 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Mon, 21 Nov 2022 16:22:19 +0100
+Subject: [PATCH 07/29] usb: USB_FOTG210 should depend on ARCH_GEMINI
+
+The Faraday Technology FOTG210 USB2 Dual Role Controller is only present
+on Cortina Systems Gemini SoCs.  Hence add a dependency on ARCH_GEMINI,
+to prevent asking the user about its drivers when configuring a kernel
+without Cortina Systems Gemini SoC support.
+
+Fixes: 1dd33a9f1b95ab59 ("usb: fotg210: Collect pieces of dual mode controller")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/a989b3b798ecaf3b45f35160e30e605636d66a77.1669044086.git.geert+renesas@glider.be
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/Kconfig
++++ b/drivers/usb/fotg210/Kconfig
+@@ -4,6 +4,7 @@ config USB_FOTG210
+ 	tristate "Faraday FOTG210 USB2 Dual Role controller"
+ 	depends on USB || USB_GADGET
+ 	depends on HAS_DMA && HAS_IOMEM
++	depends on ARCH_GEMINI || COMPILE_TEST
+ 	default ARCH_GEMINI
+ 	select MFD_SYSCON
+ 	help
diff --git a/target/linux/gemini/patches-6.1/0008-fotg210-udc-Use-dev-pointer-in-probe-and-dev_message.patch b/target/linux/gemini/patches-6.1/0008-fotg210-udc-Use-dev-pointer-in-probe-and-dev_message.patch
new file mode 100644
index 00000000000000..2a595e885d1753
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0008-fotg210-udc-Use-dev-pointer-in-probe-and-dev_message.patch
@@ -0,0 +1,61 @@
+From 27cd321a365fecac857e41ad1681062994142e4a Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Mon, 14 Nov 2022 12:51:58 +0100
+Subject: [PATCH 08/29] fotg210-udc: Use dev pointer in probe and dev_messages
+
+Add a local struct device *dev pointer and use dev_err()
+etc to report status.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20221114115201.302887-1-linus.walleij@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/fotg210-udc.c
++++ b/drivers/usb/fotg210/fotg210-udc.c
+@@ -1104,6 +1104,7 @@ int fotg210_udc_probe(struct platform_de
+ 	struct resource *res, *ires;
+ 	struct fotg210_udc *fotg210 = NULL;
+ 	struct fotg210_ep *_ep[FOTG210_MAX_NUM_EP];
++	struct device *dev = &pdev->dev;
+ 	int ret = 0;
+ 	int i;
+ 
+@@ -1135,7 +1136,7 @@ int fotg210_udc_probe(struct platform_de
+ 
+ 	fotg210->reg = ioremap(res->start, resource_size(res));
+ 	if (fotg210->reg == NULL) {
+-		pr_err("ioremap error.\n");
++		dev_err(dev, "ioremap error\n");
+ 		goto err_alloc;
+ 	}
+ 
+@@ -1146,8 +1147,8 @@ int fotg210_udc_probe(struct platform_de
+ 	fotg210->gadget.ops = &fotg210_gadget_ops;
+ 
+ 	fotg210->gadget.max_speed = USB_SPEED_HIGH;
+-	fotg210->gadget.dev.parent = &pdev->dev;
+-	fotg210->gadget.dev.dma_mask = pdev->dev.dma_mask;
++	fotg210->gadget.dev.parent = dev;
++	fotg210->gadget.dev.dma_mask = dev->dma_mask;
+ 	fotg210->gadget.name = udc_name;
+ 
+ 	INIT_LIST_HEAD(&fotg210->gadget.ep_list);
+@@ -1195,15 +1196,15 @@ int fotg210_udc_probe(struct platform_de
+ 	ret = request_irq(ires->start, fotg210_irq, IRQF_SHARED,
+ 			  udc_name, fotg210);
+ 	if (ret < 0) {
+-		pr_err("request_irq error (%d)\n", ret);
++		dev_err(dev, "request_irq error (%d)\n", ret);
+ 		goto err_req;
+ 	}
+ 
+-	ret = usb_add_gadget_udc(&pdev->dev, &fotg210->gadget);
++	ret = usb_add_gadget_udc(dev, &fotg210->gadget);
+ 	if (ret)
+ 		goto err_add_udc;
+ 
+-	dev_info(&pdev->dev, "version %s\n", DRIVER_VERSION);
++	dev_info(dev, "version %s\n", DRIVER_VERSION);
+ 
+ 	return 0;
+ 
diff --git a/target/linux/gemini/patches-6.1/0009-fotg210-udc-Support-optional-external-PHY.patch b/target/linux/gemini/patches-6.1/0009-fotg210-udc-Support-optional-external-PHY.patch
new file mode 100644
index 00000000000000..498875c5356663
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0009-fotg210-udc-Support-optional-external-PHY.patch
@@ -0,0 +1,158 @@
+From 03e4b585ac947e2d422bedf03179bbfec3aca3cf Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Mon, 14 Nov 2022 12:51:59 +0100
+Subject: [PATCH 09/29] fotg210-udc: Support optional external PHY
+
+This adds support for an optional external PHY to the FOTG210
+UDC driver.
+
+Tested with the GPIO VBUS PHY driver on the Gemini SoC.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20221114115201.302887-2-linus.walleij@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/fotg210-udc.c
++++ b/drivers/usb/fotg210/fotg210-udc.c
+@@ -15,6 +15,8 @@
+ #include <linux/platform_device.h>
+ #include <linux/usb/ch9.h>
+ #include <linux/usb/gadget.h>
++#include <linux/usb/otg.h>
++#include <linux/usb/phy.h>
+ 
+ #include "fotg210.h"
+ #include "fotg210-udc.h"
+@@ -1022,10 +1024,18 @@ static int fotg210_udc_start(struct usb_
+ {
+ 	struct fotg210_udc *fotg210 = gadget_to_fotg210(g);
+ 	u32 value;
++	int ret;
+ 
+ 	/* hook up the driver */
+ 	fotg210->driver = driver;
+ 
++	if (!IS_ERR_OR_NULL(fotg210->phy)) {
++		ret = otg_set_peripheral(fotg210->phy->otg,
++					 &fotg210->gadget);
++		if (ret)
++			dev_err(fotg210->dev, "can't bind to phy\n");
++	}
++
+ 	/* enable device global interrupt */
+ 	value = ioread32(fotg210->reg + FOTG210_DMCR);
+ 	value |= DMCR_GLINT_EN;
+@@ -1067,6 +1077,9 @@ static int fotg210_udc_stop(struct usb_g
+ 	struct fotg210_udc *fotg210 = gadget_to_fotg210(g);
+ 	unsigned long	flags;
+ 
++	if (!IS_ERR_OR_NULL(fotg210->phy))
++		return otg_set_peripheral(fotg210->phy->otg, NULL);
++
+ 	spin_lock_irqsave(&fotg210->lock, flags);
+ 
+ 	fotg210_init(fotg210);
+@@ -1082,12 +1095,50 @@ static const struct usb_gadget_ops fotg2
+ 	.udc_stop		= fotg210_udc_stop,
+ };
+ 
++/**
++ * fotg210_phy_event - Called by phy upon VBus event
++ * @nb: notifier block
++ * @action: phy action, is vbus connect or disconnect
++ * @data: the usb_gadget structure in fotg210
++ *
++ * Called by the USB Phy when a cable connect or disconnect is sensed.
++ *
++ * Returns NOTIFY_OK or NOTIFY_DONE
++ */
++static int fotg210_phy_event(struct notifier_block *nb, unsigned long action,
++			     void *data)
++{
++	struct usb_gadget *gadget = data;
++
++	if (!gadget)
++		return NOTIFY_DONE;
++
++	switch (action) {
++	case USB_EVENT_VBUS:
++		usb_gadget_vbus_connect(gadget);
++		return NOTIFY_OK;
++	case USB_EVENT_NONE:
++		usb_gadget_vbus_disconnect(gadget);
++		return NOTIFY_OK;
++	default:
++		return NOTIFY_DONE;
++	}
++}
++
++static struct notifier_block fotg210_phy_notifier = {
++	.notifier_call = fotg210_phy_event,
++};
++
+ int fotg210_udc_remove(struct platform_device *pdev)
+ {
+ 	struct fotg210_udc *fotg210 = platform_get_drvdata(pdev);
+ 	int i;
+ 
+ 	usb_del_gadget_udc(&fotg210->gadget);
++	if (!IS_ERR_OR_NULL(fotg210->phy)) {
++		usb_unregister_notifier(fotg210->phy, &fotg210_phy_notifier);
++		usb_put_phy(fotg210->phy);
++	}
+ 	iounmap(fotg210->reg);
+ 	free_irq(platform_get_irq(pdev, 0), fotg210);
+ 
+@@ -1127,6 +1178,22 @@ int fotg210_udc_probe(struct platform_de
+ 	if (fotg210 == NULL)
+ 		goto err;
+ 
++	fotg210->dev = dev;
++
++	fotg210->phy = devm_usb_get_phy_by_phandle(dev->parent, "usb-phy", 0);
++	if (IS_ERR(fotg210->phy)) {
++		ret = PTR_ERR(fotg210->phy);
++		if (ret == -EPROBE_DEFER)
++			goto err;
++		dev_info(dev, "no PHY found\n");
++		fotg210->phy = NULL;
++	} else {
++		ret = usb_phy_init(fotg210->phy);
++		if (ret)
++			goto err;
++		dev_info(dev, "found and initialized PHY\n");
++	}
++
+ 	for (i = 0; i < FOTG210_MAX_NUM_EP; i++) {
+ 		_ep[i] = kzalloc(sizeof(struct fotg210_ep), GFP_KERNEL);
+ 		if (_ep[i] == NULL)
+@@ -1200,6 +1267,9 @@ int fotg210_udc_probe(struct platform_de
+ 		goto err_req;
+ 	}
+ 
++	if (!IS_ERR_OR_NULL(fotg210->phy))
++		usb_register_notifier(fotg210->phy, &fotg210_phy_notifier);
++
+ 	ret = usb_add_gadget_udc(dev, &fotg210->gadget);
+ 	if (ret)
+ 		goto err_add_udc;
+@@ -1209,6 +1279,8 @@ int fotg210_udc_probe(struct platform_de
+ 	return 0;
+ 
+ err_add_udc:
++	if (!IS_ERR_OR_NULL(fotg210->phy))
++		usb_unregister_notifier(fotg210->phy, &fotg210_phy_notifier);
+ 	free_irq(ires->start, fotg210);
+ 
+ err_req:
+--- a/drivers/usb/fotg210/fotg210-udc.h
++++ b/drivers/usb/fotg210/fotg210-udc.h
+@@ -234,6 +234,8 @@ struct fotg210_udc {
+ 
+ 	unsigned long		irq_trigger;
+ 
++	struct device			*dev;
++	struct usb_phy			*phy;
+ 	struct usb_gadget		gadget;
+ 	struct usb_gadget_driver	*driver;
+ 
diff --git a/target/linux/gemini/patches-6.1/0010-fotg210-udc-Handle-PCLK.patch b/target/linux/gemini/patches-6.1/0010-fotg210-udc-Handle-PCLK.patch
new file mode 100644
index 00000000000000..8da3de3b47674a
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0010-fotg210-udc-Handle-PCLK.patch
@@ -0,0 +1,90 @@
+From 772ea3ec2b9363b45ef9a4768ea205f758c3debc Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Mon, 14 Nov 2022 12:52:00 +0100
+Subject: [PATCH 10/29] fotg210-udc: Handle PCLK
+
+This adds optional handling of the peripheral clock PCLK.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20221114115201.302887-3-linus.walleij@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/fotg210-udc.c
++++ b/drivers/usb/fotg210/fotg210-udc.c
+@@ -15,6 +15,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/usb/ch9.h>
+ #include <linux/usb/gadget.h>
++#include <linux/clk.h>
+ #include <linux/usb/otg.h>
+ #include <linux/usb/phy.h>
+ 
+@@ -1145,6 +1146,10 @@ int fotg210_udc_remove(struct platform_d
+ 	fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);
+ 	for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
+ 		kfree(fotg210->ep[i]);
++
++	if (!IS_ERR(fotg210->pclk))
++		clk_disable_unprepare(fotg210->pclk);
++
+ 	kfree(fotg210);
+ 
+ 	return 0;
+@@ -1180,17 +1185,34 @@ int fotg210_udc_probe(struct platform_de
+ 
+ 	fotg210->dev = dev;
+ 
++	/* It's OK not to supply this clock */
++	fotg210->pclk = devm_clk_get(dev, "PCLK");
++	if (!IS_ERR(fotg210->pclk)) {
++		ret = clk_prepare_enable(fotg210->pclk);
++		if (ret) {
++			dev_err(dev, "failed to enable PCLK\n");
++			return ret;
++		}
++	} else if (PTR_ERR(fotg210->pclk) == -EPROBE_DEFER) {
++		/*
++		 * Percolate deferrals, for anything else,
++		 * just live without the clocking.
++		 */
++		ret = -EPROBE_DEFER;
++		goto err;
++	}
++
+ 	fotg210->phy = devm_usb_get_phy_by_phandle(dev->parent, "usb-phy", 0);
+ 	if (IS_ERR(fotg210->phy)) {
+ 		ret = PTR_ERR(fotg210->phy);
+ 		if (ret == -EPROBE_DEFER)
+-			goto err;
++			goto err_pclk;
+ 		dev_info(dev, "no PHY found\n");
+ 		fotg210->phy = NULL;
+ 	} else {
+ 		ret = usb_phy_init(fotg210->phy);
+ 		if (ret)
+-			goto err;
++			goto err_pclk;
+ 		dev_info(dev, "found and initialized PHY\n");
+ 	}
+ 
+@@ -1292,6 +1314,10 @@ err_map:
+ err_alloc:
+ 	for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
+ 		kfree(fotg210->ep[i]);
++err_pclk:
++	if (!IS_ERR(fotg210->pclk))
++		clk_disable_unprepare(fotg210->pclk);
++
+ 	kfree(fotg210);
+ 
+ err:
+--- a/drivers/usb/fotg210/fotg210-udc.h
++++ b/drivers/usb/fotg210/fotg210-udc.h
+@@ -231,6 +231,7 @@ struct fotg210_ep {
+ struct fotg210_udc {
+ 	spinlock_t		lock; /* protect the struct */
+ 	void __iomem		*reg;
++	struct clk		*pclk;
+ 
+ 	unsigned long		irq_trigger;
+ 
diff --git a/target/linux/gemini/patches-6.1/0011-fotg210-udc-Get-IRQ-using-platform_get_irq.patch b/target/linux/gemini/patches-6.1/0011-fotg210-udc-Get-IRQ-using-platform_get_irq.patch
new file mode 100644
index 00000000000000..9544de7cb07416
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0011-fotg210-udc-Get-IRQ-using-platform_get_irq.patch
@@ -0,0 +1,69 @@
+From eda686d41e298a9d16708d2ec8d12d8e682dd7ca Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Mon, 14 Nov 2022 12:52:01 +0100
+Subject: [PATCH 11/29] fotg210-udc: Get IRQ using platform_get_irq()
+
+The platform_get_irq() is necessary to use to get dynamic
+IRQ resolution when instantiating the device from the
+device tree. IRQs are not passed as resources in that
+case.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20221114115201.302887-4-linus.walleij@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/fotg210-udc.c
++++ b/drivers/usb/fotg210/fotg210-udc.c
+@@ -1157,10 +1157,11 @@ int fotg210_udc_remove(struct platform_d
+ 
+ int fotg210_udc_probe(struct platform_device *pdev)
+ {
+-	struct resource *res, *ires;
++	struct resource *res;
+ 	struct fotg210_udc *fotg210 = NULL;
+ 	struct fotg210_ep *_ep[FOTG210_MAX_NUM_EP];
+ 	struct device *dev = &pdev->dev;
++	int irq;
+ 	int ret = 0;
+ 	int i;
+ 
+@@ -1170,9 +1171,9 @@ int fotg210_udc_probe(struct platform_de
+ 		return -ENODEV;
+ 	}
+ 
+-	ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+-	if (!ires) {
+-		pr_err("platform_get_resource IORESOURCE_IRQ error.\n");
++	irq = platform_get_irq(pdev, 0);
++	if (irq < 0) {
++		pr_err("could not get irq\n");
+ 		return -ENODEV;
+ 	}
+ 
+@@ -1202,7 +1203,7 @@ int fotg210_udc_probe(struct platform_de
+ 		goto err;
+ 	}
+ 
+-	fotg210->phy = devm_usb_get_phy_by_phandle(dev->parent, "usb-phy", 0);
++	fotg210->phy = devm_usb_get_phy_by_phandle(dev, "usb-phy", 0);
+ 	if (IS_ERR(fotg210->phy)) {
+ 		ret = PTR_ERR(fotg210->phy);
+ 		if (ret == -EPROBE_DEFER)
+@@ -1282,7 +1283,7 @@ int fotg210_udc_probe(struct platform_de
+ 
+ 	fotg210_disable_unplug(fotg210);
+ 
+-	ret = request_irq(ires->start, fotg210_irq, IRQF_SHARED,
++	ret = request_irq(irq, fotg210_irq, IRQF_SHARED,
+ 			  udc_name, fotg210);
+ 	if (ret < 0) {
+ 		dev_err(dev, "request_irq error (%d)\n", ret);
+@@ -1303,7 +1304,7 @@ int fotg210_udc_probe(struct platform_de
+ err_add_udc:
+ 	if (!IS_ERR_OR_NULL(fotg210->phy))
+ 		usb_unregister_notifier(fotg210->phy, &fotg210_phy_notifier);
+-	free_irq(ires->start, fotg210);
++	free_irq(irq, fotg210);
+ 
+ err_req:
+ 	fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);
diff --git a/target/linux/gemini/patches-6.1/0012-usb-fotg210-udc-Remove-a-useless-assignment.patch b/target/linux/gemini/patches-6.1/0012-usb-fotg210-udc-Remove-a-useless-assignment.patch
new file mode 100644
index 00000000000000..8c33c50b2cb824
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0012-usb-fotg210-udc-Remove-a-useless-assignment.patch
@@ -0,0 +1,39 @@
+From 7889a2f0256c55e0184dffd0001d0782f9e4cb83 Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Mon, 14 Nov 2022 21:38:04 +0100
+Subject: [PATCH 12/29] usb: fotg210-udc: Remove a useless assignment
+
+There is no need to use an intermediate array for these memory allocations,
+so, axe it.
+
+While at it, turn a '== NULL' into a shorter '!' when testing memory
+allocation failure.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/deab9696fc4000499470e7ccbca7c36fca17bd4e.1668458274.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/fotg210-udc.c
++++ b/drivers/usb/fotg210/fotg210-udc.c
+@@ -1159,7 +1159,6 @@ int fotg210_udc_probe(struct platform_de
+ {
+ 	struct resource *res;
+ 	struct fotg210_udc *fotg210 = NULL;
+-	struct fotg210_ep *_ep[FOTG210_MAX_NUM_EP];
+ 	struct device *dev = &pdev->dev;
+ 	int irq;
+ 	int ret = 0;
+@@ -1218,10 +1217,9 @@ int fotg210_udc_probe(struct platform_de
+ 	}
+ 
+ 	for (i = 0; i < FOTG210_MAX_NUM_EP; i++) {
+-		_ep[i] = kzalloc(sizeof(struct fotg210_ep), GFP_KERNEL);
+-		if (_ep[i] == NULL)
++		fotg210->ep[i] = kzalloc(sizeof(struct fotg210_ep), GFP_KERNEL);
++		if (!fotg210->ep[i])
+ 			goto err_alloc;
+-		fotg210->ep[i] = _ep[i];
+ 	}
+ 
+ 	fotg210->reg = ioremap(res->start, resource_size(res));
diff --git a/target/linux/gemini/patches-6.1/0013-usb-fotg210-udc-fix-potential-memory-leak-in-fotg210.patch b/target/linux/gemini/patches-6.1/0013-usb-fotg210-udc-fix-potential-memory-leak-in-fotg210.patch
new file mode 100644
index 00000000000000..178135662f5ef8
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0013-usb-fotg210-udc-fix-potential-memory-leak-in-fotg210.patch
@@ -0,0 +1,58 @@
+From 7b95ade85ac18eec63e81ac58a482b3e88361ffd Mon Sep 17 00:00:00 2001
+From: Yi Yang <yiyang13@huawei.com>
+Date: Fri, 2 Dec 2022 09:21:26 +0800
+Subject: [PATCH 13/29] usb: fotg210-udc: fix potential memory leak in
+ fotg210_udc_probe()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+In fotg210_udc_probe(), if devm_clk_get() or clk_prepare_enable()
+fails, 'fotg210' will not be freed, which will lead to a memory leak.
+Fix it by moving kfree() to a proper location.
+
+In addition，we can use "return -ENOMEM" instead of "goto err"
+to simplify the code.
+
+Fixes: 718a38d092ec ("fotg210-udc: Handle PCLK")
+Reviewed-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Yi Yang <yiyang13@huawei.com>
+Link: https://lore.kernel.org/r/20221202012126.246953-1-yiyang13@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/fotg210-udc.c
++++ b/drivers/usb/fotg210/fotg210-udc.c
+@@ -1176,12 +1176,10 @@ int fotg210_udc_probe(struct platform_de
+ 		return -ENODEV;
+ 	}
+ 
+-	ret = -ENOMEM;
+-
+ 	/* initialize udc */
+ 	fotg210 = kzalloc(sizeof(struct fotg210_udc), GFP_KERNEL);
+ 	if (fotg210 == NULL)
+-		goto err;
++		return -ENOMEM;
+ 
+ 	fotg210->dev = dev;
+ 
+@@ -1191,7 +1189,7 @@ int fotg210_udc_probe(struct platform_de
+ 		ret = clk_prepare_enable(fotg210->pclk);
+ 		if (ret) {
+ 			dev_err(dev, "failed to enable PCLK\n");
+-			return ret;
++			goto err;
+ 		}
+ 	} else if (PTR_ERR(fotg210->pclk) == -EPROBE_DEFER) {
+ 		/*
+@@ -1317,8 +1315,7 @@ err_pclk:
+ 	if (!IS_ERR(fotg210->pclk))
+ 		clk_disable_unprepare(fotg210->pclk);
+ 
+-	kfree(fotg210);
+-
+ err:
++	kfree(fotg210);
+ 	return ret;
+ }
diff --git a/target/linux/gemini/patches-6.1/0014-usb-fotg210-fix-OTG-only-build.patch b/target/linux/gemini/patches-6.1/0014-usb-fotg210-fix-OTG-only-build.patch
new file mode 100644
index 00000000000000..acdf1796f3bf1a
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0014-usb-fotg210-fix-OTG-only-build.patch
@@ -0,0 +1,39 @@
+From d8eed400495029ba551704ff0fae1dad87332291 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 15 Dec 2022 17:57:20 +0100
+Subject: [PATCH 14/29] usb: fotg210: fix OTG-only build
+
+The fotg210 module combines the HCD and OTG drivers, which then
+fails to build when only the USB gadget support is enabled
+in the kernel but host support is not:
+
+aarch64-linux-ld: drivers/usb/fotg210/fotg210-core.o: in function `fotg210_init':
+fotg210-core.c:(.init.text+0xc): undefined reference to `usb_disabled'
+
+Move the check for usb_disabled() after the check for the HCD module,
+and let the OTG driver still be probed in this configuration.
+
+A nicer approach might be to have the common portion built as a
+library module, with the two platform other files registering
+their own platform_driver instances separately.
+
+Fixes: ddacd6ef44ca ("usb: fotg210: Fix Kconfig for USB host modules")
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20221215165728.2062984-1-arnd@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/fotg210-core.c
++++ b/drivers/usb/fotg210/fotg210-core.c
+@@ -144,10 +144,7 @@ static struct platform_driver fotg210_dr
+ 
+ static int __init fotg210_init(void)
+ {
+-	if (usb_disabled())
+-		return -ENODEV;
+-
+-	if (IS_ENABLED(CONFIG_USB_FOTG210_HCD))
++	if (IS_ENABLED(CONFIG_USB_FOTG210_HCD) && !usb_disabled())
+ 		fotg210_hcd_init();
+ 	return platform_driver_register(&fotg210_driver);
+ }
diff --git a/target/linux/gemini/patches-6.1/0015-usb-fotg210-udc-fix-error-return-code-in-fotg210_udc.patch b/target/linux/gemini/patches-6.1/0015-usb-fotg210-udc-fix-error-return-code-in-fotg210_udc.patch
new file mode 100644
index 00000000000000..a9bbca58b4abed
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0015-usb-fotg210-udc-fix-error-return-code-in-fotg210_udc.patch
@@ -0,0 +1,28 @@
+From eaaa85d907fe27852dd960b2bc5d7bcf11bc3ebd Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Fri, 30 Dec 2022 14:54:27 +0800
+Subject: [PATCH 15/29] usb: fotg210-udc: fix error return code in
+ fotg210_udc_probe()
+
+After commit  5f217ccd520f ("fotg210-udc: Support optional external PHY"),
+the error code is re-assigned to 0 in fotg210_udc_probe(), if allocate or
+map memory fails after the assignment, it can't return an error code. Set
+the error code to -ENOMEM to fix this problem.
+
+Fixes: 5f217ccd520f ("fotg210-udc: Support optional external PHY")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20221230065427.944586-1-yangyingliang@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/fotg210-udc.c
++++ b/drivers/usb/fotg210/fotg210-udc.c
+@@ -1214,6 +1214,8 @@ int fotg210_udc_probe(struct platform_de
+ 		dev_info(dev, "found and initialized PHY\n");
+ 	}
+ 
++	ret = -ENOMEM;
++
+ 	for (i = 0; i < FOTG210_MAX_NUM_EP; i++) {
+ 		fotg210->ep[i] = kzalloc(sizeof(struct fotg210_ep), GFP_KERNEL);
+ 		if (!fotg210->ep[i])
diff --git a/target/linux/gemini/patches-6.1/0016-usb-fotg210-List-different-variants.patch b/target/linux/gemini/patches-6.1/0016-usb-fotg210-List-different-variants.patch
new file mode 100644
index 00000000000000..6ff6d28ad3f4a2
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0016-usb-fotg210-List-different-variants.patch
@@ -0,0 +1,25 @@
+From 407577548b2fcd41cc72ee05df1f05a430ed30a0 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Wed, 18 Jan 2023 08:09:16 +0100
+Subject: [PATCH 16/29] usb: fotg210: List different variants
+
+There are at least two variants of the FOTG: FOTG200 and
+FOTG210. Handle them in this driver and let's add
+more quirks as we go along.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20230103-gemini-fotg210-usb-v2-2-100388af9810@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/fotg210-core.c
++++ b/drivers/usb/fotg210/fotg210-core.c
+@@ -127,7 +127,9 @@ static int fotg210_remove(struct platfor
+ 
+ #ifdef CONFIG_OF
+ static const struct of_device_id fotg210_of_match[] = {
++	{ .compatible = "faraday,fotg200" },
+ 	{ .compatible = "faraday,fotg210" },
++	/* TODO: can we also handle FUSB220? */
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(of, fotg210_of_match);
diff --git a/target/linux/gemini/patches-6.1/0017-usb-fotg210-Acquire-memory-resource-in-core.patch b/target/linux/gemini/patches-6.1/0017-usb-fotg210-Acquire-memory-resource-in-core.patch
new file mode 100644
index 00000000000000..7dbd511ecbedc8
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0017-usb-fotg210-Acquire-memory-resource-in-core.patch
@@ -0,0 +1,245 @@
+From fa735ad1afeb5791d5562617b9bbed74574d3e81 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Wed, 18 Jan 2023 08:09:17 +0100
+Subject: [PATCH 17/29] usb: fotg210: Acquire memory resource in core
+
+The subdrivers are obtaining and mapping the memory resource
+separately. Create a common state container for the shared
+resources and start populating this by acquiring the IO
+memory resource and remap it and pass this to the subdrivers
+for host and peripheral.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20230103-gemini-fotg210-usb-v2-3-100388af9810@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/fotg210-core.c
++++ b/drivers/usb/fotg210/fotg210-core.c
+@@ -33,9 +33,10 @@
+ #define GEMINI_MISC_USB0_MINI_B		BIT(29)
+ #define GEMINI_MISC_USB1_MINI_B		BIT(30)
+ 
+-static int fotg210_gemini_init(struct device *dev, struct resource *res,
++static int fotg210_gemini_init(struct fotg210 *fotg, struct resource *res,
+ 			       enum usb_dr_mode mode)
+ {
++	struct device *dev = fotg->dev;
+ 	struct device_node *np = dev->of_node;
+ 	struct regmap *map;
+ 	bool wakeup;
+@@ -47,6 +48,7 @@ static int fotg210_gemini_init(struct de
+ 		dev_err(dev, "no syscon\n");
+ 		return PTR_ERR(map);
+ 	}
++	fotg->map = map;
+ 	wakeup = of_property_read_bool(np, "wakeup-source");
+ 
+ 	/*
+@@ -55,6 +57,7 @@ static int fotg210_gemini_init(struct de
+ 	 */
+ 	mask = 0;
+ 	if (res->start == 0x69000000) {
++		fotg->port = GEMINI_PORT_1;
+ 		mask = GEMINI_MISC_USB1_VBUS_ON | GEMINI_MISC_USB1_MINI_B |
+ 			GEMINI_MISC_USB1_WAKEUP;
+ 		if (mode == USB_DR_MODE_HOST)
+@@ -64,6 +67,7 @@ static int fotg210_gemini_init(struct de
+ 		if (wakeup)
+ 			val |= GEMINI_MISC_USB1_WAKEUP;
+ 	} else {
++		fotg->port = GEMINI_PORT_0;
+ 		mask = GEMINI_MISC_USB0_VBUS_ON | GEMINI_MISC_USB0_MINI_B |
+ 			GEMINI_MISC_USB0_WAKEUP;
+ 		if (mode == USB_DR_MODE_HOST)
+@@ -89,23 +93,34 @@ static int fotg210_probe(struct platform
+ {
+ 	struct device *dev = &pdev->dev;
+ 	enum usb_dr_mode mode;
++	struct fotg210 *fotg;
+ 	int ret;
+ 
++	fotg = devm_kzalloc(dev, sizeof(*fotg), GFP_KERNEL);
++	if (!fotg)
++		return -ENOMEM;
++	fotg->dev = dev;
++
++	fotg->res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if (!fotg->res)
++		return -ENODEV;
++
++	fotg->base = devm_ioremap_resource(dev, fotg->res);
++	if (!fotg->base)
++		return -ENOMEM;
++
+ 	mode = usb_get_dr_mode(dev);
+ 
+ 	if (of_device_is_compatible(dev->of_node, "cortina,gemini-usb")) {
+-		struct resource *res;
+-
+-		res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-		ret = fotg210_gemini_init(dev, res, mode);
++		ret = fotg210_gemini_init(fotg, fotg->res, mode);
+ 		if (ret)
+ 			return ret;
+ 	}
+ 
+ 	if (mode == USB_DR_MODE_PERIPHERAL)
+-		ret = fotg210_udc_probe(pdev);
++		ret = fotg210_udc_probe(pdev, fotg);
+ 	else
+-		ret = fotg210_hcd_probe(pdev);
++		ret = fotg210_hcd_probe(pdev, fotg);
+ 
+ 	return ret;
+ }
+--- a/drivers/usb/fotg210/fotg210-hcd.c
++++ b/drivers/usb/fotg210/fotg210-hcd.c
+@@ -5557,11 +5557,10 @@ static void fotg210_init(struct fotg210_
+  * then invokes the start() method for the HCD associated with it
+  * through the hotplug entry's driver_data.
+  */
+-int fotg210_hcd_probe(struct platform_device *pdev)
++int fotg210_hcd_probe(struct platform_device *pdev, struct fotg210 *fotg)
+ {
+ 	struct device *dev = &pdev->dev;
+ 	struct usb_hcd *hcd;
+-	struct resource *res;
+ 	int irq;
+ 	int retval;
+ 	struct fotg210_hcd *fotg210;
+@@ -5585,18 +5584,14 @@ int fotg210_hcd_probe(struct platform_de
+ 
+ 	hcd->has_tt = 1;
+ 
+-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	hcd->regs = devm_ioremap_resource(&pdev->dev, res);
+-	if (IS_ERR(hcd->regs)) {
+-		retval = PTR_ERR(hcd->regs);
+-		goto failed_put_hcd;
+-	}
++	hcd->regs = fotg->base;
+ 
+-	hcd->rsrc_start = res->start;
+-	hcd->rsrc_len = resource_size(res);
++	hcd->rsrc_start = fotg->res->start;
++	hcd->rsrc_len = resource_size(fotg->res);
+ 
+ 	fotg210 = hcd_to_fotg210(hcd);
+ 
++	fotg210->fotg = fotg;
+ 	fotg210->caps = hcd->regs;
+ 
+ 	/* It's OK not to supply this clock */
+--- a/drivers/usb/fotg210/fotg210-hcd.h
++++ b/drivers/usb/fotg210/fotg210-hcd.h
+@@ -182,6 +182,7 @@ struct fotg210_hcd {			/* one per contro
+ #	define INCR(x) do {} while (0)
+ #endif
+ 
++	struct fotg210		*fotg;		/* Overarching FOTG210 device */
+ 	/* silicon clock */
+ 	struct clk		*pclk;
+ };
+--- a/drivers/usb/fotg210/fotg210-udc.c
++++ b/drivers/usb/fotg210/fotg210-udc.c
+@@ -1155,21 +1155,14 @@ int fotg210_udc_remove(struct platform_d
+ 	return 0;
+ }
+ 
+-int fotg210_udc_probe(struct platform_device *pdev)
++int fotg210_udc_probe(struct platform_device *pdev, struct fotg210 *fotg)
+ {
+-	struct resource *res;
+ 	struct fotg210_udc *fotg210 = NULL;
+ 	struct device *dev = &pdev->dev;
+ 	int irq;
+ 	int ret = 0;
+ 	int i;
+ 
+-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	if (!res) {
+-		pr_err("platform_get_resource error.\n");
+-		return -ENODEV;
+-	}
+-
+ 	irq = platform_get_irq(pdev, 0);
+ 	if (irq < 0) {
+ 		pr_err("could not get irq\n");
+@@ -1182,6 +1175,7 @@ int fotg210_udc_probe(struct platform_de
+ 		return -ENOMEM;
+ 
+ 	fotg210->dev = dev;
++	fotg210->fotg = fotg;
+ 
+ 	/* It's OK not to supply this clock */
+ 	fotg210->pclk = devm_clk_get(dev, "PCLK");
+@@ -1222,11 +1216,7 @@ int fotg210_udc_probe(struct platform_de
+ 			goto err_alloc;
+ 	}
+ 
+-	fotg210->reg = ioremap(res->start, resource_size(res));
+-	if (fotg210->reg == NULL) {
+-		dev_err(dev, "ioremap error\n");
+-		goto err_alloc;
+-	}
++	fotg210->reg = fotg->base;
+ 
+ 	spin_lock_init(&fotg210->lock);
+ 
+--- a/drivers/usb/fotg210/fotg210-udc.h
++++ b/drivers/usb/fotg210/fotg210-udc.h
+@@ -236,6 +236,7 @@ struct fotg210_udc {
+ 	unsigned long		irq_trigger;
+ 
+ 	struct device			*dev;
++	struct fotg210			*fotg;
+ 	struct usb_phy			*phy;
+ 	struct usb_gadget		gadget;
+ 	struct usb_gadget_driver	*driver;
+--- a/drivers/usb/fotg210/fotg210.h
++++ b/drivers/usb/fotg210/fotg210.h
+@@ -2,13 +2,28 @@
+ #ifndef __FOTG210_H
+ #define __FOTG210_H
+ 
++enum gemini_port {
++	GEMINI_PORT_NONE = 0,
++	GEMINI_PORT_0,
++	GEMINI_PORT_1,
++};
++
++struct fotg210 {
++	struct device *dev;
++	struct resource *res;
++	void __iomem *base;
++	struct regmap *map;
++	enum gemini_port port;
++};
++
+ #ifdef CONFIG_USB_FOTG210_HCD
+-int fotg210_hcd_probe(struct platform_device *pdev);
++int fotg210_hcd_probe(struct platform_device *pdev, struct fotg210 *fotg);
+ int fotg210_hcd_remove(struct platform_device *pdev);
+ int fotg210_hcd_init(void);
+ void fotg210_hcd_cleanup(void);
+ #else
+-static inline int fotg210_hcd_probe(struct platform_device *pdev)
++static inline int fotg210_hcd_probe(struct platform_device *pdev,
++				    struct fotg210 *fotg)
+ {
+ 	return 0;
+ }
+@@ -26,10 +41,11 @@ static inline void fotg210_hcd_cleanup(v
+ #endif
+ 
+ #ifdef CONFIG_USB_FOTG210_UDC
+-int fotg210_udc_probe(struct platform_device *pdev);
++int fotg210_udc_probe(struct platform_device *pdev, struct fotg210 *fotg);
+ int fotg210_udc_remove(struct platform_device *pdev);
+ #else
+-static inline int fotg210_udc_probe(struct platform_device *pdev)
++static inline int fotg210_udc_probe(struct platform_device *pdev,
++				    struct fotg210 *fotg)
+ {
+ 	return 0;
+ }
diff --git a/target/linux/gemini/patches-6.1/0018-usb-fotg210-Move-clock-handling-to-core.patch b/target/linux/gemini/patches-6.1/0018-usb-fotg210-Move-clock-handling-to-core.patch
new file mode 100644
index 00000000000000..9894f4dc66d651
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0018-usb-fotg210-Move-clock-handling-to-core.patch
@@ -0,0 +1,196 @@
+From fb8e1e8dbc47e7aff7624b47adaa0a84d2983802 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Wed, 18 Jan 2023 08:09:18 +0100
+Subject: [PATCH 18/29] usb: fotg210: Move clock handling to core
+
+Grab the optional silicon block clock, prepare and enable it in
+the core before proceeding to prepare the host or peripheral
+driver. This saves duplicate code and also uses the simple
+devm_clk_get_optional_enabled() to do everything we really
+want to do.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20230103-gemini-fotg210-usb-v2-4-100388af9810@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/fotg210-core.c
++++ b/drivers/usb/fotg210/fotg210-core.c
+@@ -6,6 +6,7 @@
+  * driver.
+  */
+ #include <linux/bitops.h>
++#include <linux/clk.h>
+ #include <linux/device.h>
+ #include <linux/mfd/syscon.h>
+ #include <linux/module.h>
+@@ -109,6 +110,10 @@ static int fotg210_probe(struct platform
+ 	if (!fotg->base)
+ 		return -ENOMEM;
+ 
++	fotg->pclk = devm_clk_get_optional_enabled(dev, "PCLK");
++	if (IS_ERR(fotg->pclk))
++		return PTR_ERR(fotg->pclk);
++
+ 	mode = usb_get_dr_mode(dev);
+ 
+ 	if (of_device_is_compatible(dev->of_node, "cortina,gemini-usb")) {
+--- a/drivers/usb/fotg210/fotg210-hcd.c
++++ b/drivers/usb/fotg210/fotg210-hcd.c
+@@ -33,7 +33,6 @@
+ #include <linux/platform_device.h>
+ #include <linux/io.h>
+ #include <linux/iopoll.h>
+-#include <linux/clk.h>
+ 
+ #include <asm/byteorder.h>
+ #include <asm/irq.h>
+@@ -5594,44 +5593,22 @@ int fotg210_hcd_probe(struct platform_de
+ 	fotg210->fotg = fotg;
+ 	fotg210->caps = hcd->regs;
+ 
+-	/* It's OK not to supply this clock */
+-	fotg210->pclk = clk_get(dev, "PCLK");
+-	if (!IS_ERR(fotg210->pclk)) {
+-		retval = clk_prepare_enable(fotg210->pclk);
+-		if (retval) {
+-			dev_err(dev, "failed to enable PCLK\n");
+-			goto failed_put_hcd;
+-		}
+-	} else if (PTR_ERR(fotg210->pclk) == -EPROBE_DEFER) {
+-		/*
+-		 * Percolate deferrals, for anything else,
+-		 * just live without the clocking.
+-		 */
+-		retval = PTR_ERR(fotg210->pclk);
+-		goto failed_dis_clk;
+-	}
+-
+ 	retval = fotg210_setup(hcd);
+ 	if (retval)
+-		goto failed_dis_clk;
++		goto failed_put_hcd;
+ 
+ 	fotg210_init(fotg210);
+ 
+ 	retval = usb_add_hcd(hcd, irq, IRQF_SHARED);
+ 	if (retval) {
+ 		dev_err(dev, "failed to add hcd with err %d\n", retval);
+-		goto failed_dis_clk;
++		goto failed_put_hcd;
+ 	}
+ 	device_wakeup_enable(hcd->self.controller);
+ 	platform_set_drvdata(pdev, hcd);
+ 
+ 	return retval;
+ 
+-failed_dis_clk:
+-	if (!IS_ERR(fotg210->pclk)) {
+-		clk_disable_unprepare(fotg210->pclk);
+-		clk_put(fotg210->pclk);
+-	}
+ failed_put_hcd:
+ 	usb_put_hcd(hcd);
+ fail_create_hcd:
+@@ -5647,12 +5624,6 @@ fail_create_hcd:
+ int fotg210_hcd_remove(struct platform_device *pdev)
+ {
+ 	struct usb_hcd *hcd = platform_get_drvdata(pdev);
+-	struct fotg210_hcd *fotg210 = hcd_to_fotg210(hcd);
+-
+-	if (!IS_ERR(fotg210->pclk)) {
+-		clk_disable_unprepare(fotg210->pclk);
+-		clk_put(fotg210->pclk);
+-	}
+ 
+ 	usb_remove_hcd(hcd);
+ 	usb_put_hcd(hcd);
+--- a/drivers/usb/fotg210/fotg210-udc.c
++++ b/drivers/usb/fotg210/fotg210-udc.c
+@@ -15,7 +15,6 @@
+ #include <linux/platform_device.h>
+ #include <linux/usb/ch9.h>
+ #include <linux/usb/gadget.h>
+-#include <linux/clk.h>
+ #include <linux/usb/otg.h>
+ #include <linux/usb/phy.h>
+ 
+@@ -1147,9 +1146,6 @@ int fotg210_udc_remove(struct platform_d
+ 	for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
+ 		kfree(fotg210->ep[i]);
+ 
+-	if (!IS_ERR(fotg210->pclk))
+-		clk_disable_unprepare(fotg210->pclk);
+-
+ 	kfree(fotg210);
+ 
+ 	return 0;
+@@ -1177,34 +1173,17 @@ int fotg210_udc_probe(struct platform_de
+ 	fotg210->dev = dev;
+ 	fotg210->fotg = fotg;
+ 
+-	/* It's OK not to supply this clock */
+-	fotg210->pclk = devm_clk_get(dev, "PCLK");
+-	if (!IS_ERR(fotg210->pclk)) {
+-		ret = clk_prepare_enable(fotg210->pclk);
+-		if (ret) {
+-			dev_err(dev, "failed to enable PCLK\n");
+-			goto err;
+-		}
+-	} else if (PTR_ERR(fotg210->pclk) == -EPROBE_DEFER) {
+-		/*
+-		 * Percolate deferrals, for anything else,
+-		 * just live without the clocking.
+-		 */
+-		ret = -EPROBE_DEFER;
+-		goto err;
+-	}
+-
+ 	fotg210->phy = devm_usb_get_phy_by_phandle(dev, "usb-phy", 0);
+ 	if (IS_ERR(fotg210->phy)) {
+ 		ret = PTR_ERR(fotg210->phy);
+ 		if (ret == -EPROBE_DEFER)
+-			goto err_pclk;
++			goto err_free;
+ 		dev_info(dev, "no PHY found\n");
+ 		fotg210->phy = NULL;
+ 	} else {
+ 		ret = usb_phy_init(fotg210->phy);
+ 		if (ret)
+-			goto err_pclk;
++			goto err_free;
+ 		dev_info(dev, "found and initialized PHY\n");
+ 	}
+ 
+@@ -1303,11 +1282,8 @@ err_map:
+ err_alloc:
+ 	for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
+ 		kfree(fotg210->ep[i]);
+-err_pclk:
+-	if (!IS_ERR(fotg210->pclk))
+-		clk_disable_unprepare(fotg210->pclk);
+ 
+-err:
++err_free:
+ 	kfree(fotg210);
+ 	return ret;
+ }
+--- a/drivers/usb/fotg210/fotg210-udc.h
++++ b/drivers/usb/fotg210/fotg210-udc.h
+@@ -231,7 +231,6 @@ struct fotg210_ep {
+ struct fotg210_udc {
+ 	spinlock_t		lock; /* protect the struct */
+ 	void __iomem		*reg;
+-	struct clk		*pclk;
+ 
+ 	unsigned long		irq_trigger;
+ 
+--- a/drivers/usb/fotg210/fotg210.h
++++ b/drivers/usb/fotg210/fotg210.h
+@@ -12,6 +12,7 @@ struct fotg210 {
+ 	struct device *dev;
+ 	struct resource *res;
+ 	void __iomem *base;
++	struct clk *pclk;
+ 	struct regmap *map;
+ 	enum gemini_port port;
+ };
diff --git a/target/linux/gemini/patches-6.1/0019-usb-fotg210-Check-role-register-in-core.patch b/target/linux/gemini/patches-6.1/0019-usb-fotg210-Check-role-register-in-core.patch
new file mode 100644
index 00000000000000..892b0d31af05f3
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0019-usb-fotg210-Check-role-register-in-core.patch
@@ -0,0 +1,54 @@
+From b1b07abb598211de3ce7f52abdf8dcb24384341e Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Wed, 18 Jan 2023 08:09:19 +0100
+Subject: [PATCH 19/29] usb: fotg210: Check role register in core
+
+Read the role register and check that we are in host/peripheral
+mode and issue warnings if we're not in the right role when
+probing respective driver.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20230103-gemini-fotg210-usb-v2-5-100388af9810@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/fotg210-core.c
++++ b/drivers/usb/fotg210/fotg210-core.c
+@@ -18,6 +18,11 @@
+ 
+ #include "fotg210.h"
+ 
++/* Role Register 0x80 */
++#define FOTG210_RR			0x80
++#define FOTG210_RR_ID			BIT(21) /* 1 = B-device, 0 = A-device */
++#define FOTG210_RR_CROLE		BIT(20) /* 1 = device, 0 = host */
++
+ /*
+  * Gemini-specific initialization function, only executed on the
+  * Gemini SoC using the global misc control register.
+@@ -95,6 +100,7 @@ static int fotg210_probe(struct platform
+ 	struct device *dev = &pdev->dev;
+ 	enum usb_dr_mode mode;
+ 	struct fotg210 *fotg;
++	u32 val;
+ 	int ret;
+ 
+ 	fotg = devm_kzalloc(dev, sizeof(*fotg), GFP_KERNEL);
+@@ -122,10 +128,16 @@ static int fotg210_probe(struct platform
+ 			return ret;
+ 	}
+ 
+-	if (mode == USB_DR_MODE_PERIPHERAL)
++	val = readl(fotg->base + FOTG210_RR);
++	if (mode == USB_DR_MODE_PERIPHERAL) {
++		if (!(val & FOTG210_RR_CROLE))
++			dev_err(dev, "block not in device role\n");
+ 		ret = fotg210_udc_probe(pdev, fotg);
+-	else
++	} else {
++		if (val & FOTG210_RR_CROLE)
++			dev_err(dev, "block not in host role\n");
+ 		ret = fotg210_hcd_probe(pdev, fotg);
++	}
+ 
+ 	return ret;
+ }
diff --git a/target/linux/gemini/patches-6.1/0020-usb-fotg210-udc-Assign-of_node-and-speed-on-start.patch b/target/linux/gemini/patches-6.1/0020-usb-fotg210-udc-Assign-of_node-and-speed-on-start.patch
new file mode 100644
index 00000000000000..20f8f943501f51
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0020-usb-fotg210-udc-Assign-of_node-and-speed-on-start.patch
@@ -0,0 +1,34 @@
+From d7c2b0b6da75b86cf5ddbcd51a74d74e19bbf178 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Wed, 18 Jan 2023 08:09:20 +0100
+Subject: [PATCH 20/29] usb: fotg210-udc: Assign of_node and speed on start
+
+Follow the example set by other drivers to assign of_node
+and speed to the driver when binding, also print bound
+info akin to other UDC drivers.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20230103-gemini-fotg210-usb-v2-6-100388af9810@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/fotg210-udc.c
++++ b/drivers/usb/fotg210/fotg210-udc.c
+@@ -1028,6 +1028,10 @@ static int fotg210_udc_start(struct usb_
+ 
+ 	/* hook up the driver */
+ 	fotg210->driver = driver;
++	fotg210->gadget.dev.of_node = fotg210->dev->of_node;
++	fotg210->gadget.speed = USB_SPEED_UNKNOWN;
++
++	dev_info(fotg210->dev, "bound driver %s\n", driver->driver.name);
+ 
+ 	if (!IS_ERR_OR_NULL(fotg210->phy)) {
+ 		ret = otg_set_peripheral(fotg210->phy->otg,
+@@ -1084,6 +1088,7 @@ static int fotg210_udc_stop(struct usb_g
+ 
+ 	fotg210_init(fotg210);
+ 	fotg210->driver = NULL;
++	fotg210->gadget.speed = USB_SPEED_UNKNOWN;
+ 
+ 	spin_unlock_irqrestore(&fotg210->lock, flags);
+ 
diff --git a/target/linux/gemini/patches-6.1/0021-usb-fotg210-udc-Implement-VBUS-session.patch b/target/linux/gemini/patches-6.1/0021-usb-fotg210-udc-Implement-VBUS-session.patch
new file mode 100644
index 00000000000000..d98561f0d4c324
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0021-usb-fotg210-udc-Implement-VBUS-session.patch
@@ -0,0 +1,96 @@
+From 2fbbfb2c556944945639b17b13fcb1e05272b646 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Wed, 18 Jan 2023 08:09:21 +0100
+Subject: [PATCH 21/29] usb: fotg210-udc: Implement VBUS session
+
+Implement VBUS session handling for FOTG210. This is
+mainly used by the UDC driver which needs to call down to
+the FOTG210 core and enable/disable VBUS, as this needs to be
+handled outside of the HCD and UDC drivers, by platform
+specific glue code.
+
+The Gemini has a special bit in a system register to turn
+VBUS on and off so we implement this in the FOTG210 core.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20230103-gemini-fotg210-usb-v2-7-100388af9810@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/fotg210-core.c
++++ b/drivers/usb/fotg210/fotg210-core.c
+@@ -95,6 +95,35 @@ static int fotg210_gemini_init(struct fo
+ 	return 0;
+ }
+ 
++/**
++ * fotg210_vbus() - Called by gadget driver to enable/disable VBUS
++ * @enable: true to enable VBUS, false to disable VBUS
++ */
++void fotg210_vbus(struct fotg210 *fotg, bool enable)
++{
++	u32 mask;
++	u32 val;
++	int ret;
++
++	switch (fotg->port) {
++	case GEMINI_PORT_0:
++		mask = GEMINI_MISC_USB0_VBUS_ON;
++		val = enable ? GEMINI_MISC_USB0_VBUS_ON : 0;
++		break;
++	case GEMINI_PORT_1:
++		mask = GEMINI_MISC_USB1_VBUS_ON;
++		val = enable ? GEMINI_MISC_USB1_VBUS_ON : 0;
++		break;
++	default:
++		return;
++	}
++	ret = regmap_update_bits(fotg->map, GEMINI_GLOBAL_MISC_CTRL, mask, val);
++	if (ret)
++		dev_err(fotg->dev, "failed to %s VBUS\n",
++			enable ? "enable" : "disable");
++	dev_info(fotg->dev, "%s: %s VBUS\n", __func__, enable ? "enable" : "disable");
++}
++
+ static int fotg210_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
+--- a/drivers/usb/fotg210/fotg210-udc.c
++++ b/drivers/usb/fotg210/fotg210-udc.c
+@@ -1095,9 +1095,26 @@ static int fotg210_udc_stop(struct usb_g
+ 	return 0;
+ }
+ 
++/**
++ * fotg210_vbus_session - Called by external transceiver to enable/disable udc
++ * @_gadget: usb gadget
++ * @is_active: 0 if should disable UDC VBUS, 1 if should enable
++ *
++ * Returns 0
++ */
++static int fotg210_vbus_session(struct usb_gadget *g, int is_active)
++{
++	struct fotg210_udc *fotg210 = gadget_to_fotg210(g);
++
++	/* Call down to core integration layer to drive or disable VBUS */
++	fotg210_vbus(fotg210->fotg, is_active);
++	return 0;
++}
++
+ static const struct usb_gadget_ops fotg210_gadget_ops = {
+ 	.udc_start		= fotg210_udc_start,
+ 	.udc_stop		= fotg210_udc_stop,
++	.vbus_session		= fotg210_vbus_session,
+ };
+ 
+ /**
+--- a/drivers/usb/fotg210/fotg210.h
++++ b/drivers/usb/fotg210/fotg210.h
+@@ -17,6 +17,8 @@ struct fotg210 {
+ 	enum gemini_port port;
+ };
+ 
++void fotg210_vbus(struct fotg210 *fotg, bool enable);
++
+ #ifdef CONFIG_USB_FOTG210_HCD
+ int fotg210_hcd_probe(struct platform_device *pdev, struct fotg210 *fotg);
+ int fotg210_hcd_remove(struct platform_device *pdev);
diff --git a/target/linux/gemini/patches-6.1/0022-fotg210-udc-Introduce-and-use-a-fotg210_ack_int-func.patch b/target/linux/gemini/patches-6.1/0022-fotg210-udc-Introduce-and-use-a-fotg210_ack_int-func.patch
new file mode 100644
index 00000000000000..fc5831eb23b760
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0022-fotg210-udc-Introduce-and-use-a-fotg210_ack_int-func.patch
@@ -0,0 +1,134 @@
+From f011d1eab23f4c063c5441c0d5a22898adf9145c Mon Sep 17 00:00:00 2001
+From: Fabian Vogt <fabian@ritter-vogt.de>
+Date: Mon, 23 Jan 2023 08:35:07 +0100
+Subject: [PATCH 22/29] fotg210-udc: Introduce and use a fotg210_ack_int
+ function
+
+This is in preparation of support for devices where interrupts are acked
+differently.
+
+Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20230123073508.2350402-3-linus.walleij@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/fotg210-udc.c
++++ b/drivers/usb/fotg210/fotg210-udc.c
+@@ -28,6 +28,14 @@ static const char udc_name[] = "fotg210_
+ static const char * const fotg210_ep_name[] = {
+ 	"ep0", "ep1", "ep2", "ep3", "ep4"};
+ 
++static void fotg210_ack_int(struct fotg210_udc *fotg210, u32 offset, u32 mask)
++{
++	u32 value = ioread32(fotg210->reg + offset);
++
++	value &= ~mask;
++	iowrite32(value, fotg210->reg + offset);
++}
++
+ static void fotg210_disable_fifo_int(struct fotg210_ep *ep)
+ {
+ 	u32 value = ioread32(ep->fotg210->reg + FOTG210_DMISGR1);
+@@ -303,8 +311,7 @@ static void fotg210_wait_dma_done(struct
+ 			goto dma_reset;
+ 	} while (!(value & DISGR2_DMA_CMPLT));
+ 
+-	value &= ~DISGR2_DMA_CMPLT;
+-	iowrite32(value, ep->fotg210->reg + FOTG210_DISGR2);
++	fotg210_ack_int(ep->fotg210, FOTG210_DISGR2, DISGR2_DMA_CMPLT);
+ 	return;
+ 
+ dma_reset:
+@@ -844,14 +851,6 @@ static void fotg210_ep0in(struct fotg210
+ 	}
+ }
+ 
+-static void fotg210_clear_comabt_int(struct fotg210_udc *fotg210)
+-{
+-	u32 value = ioread32(fotg210->reg + FOTG210_DISGR0);
+-
+-	value &= ~DISGR0_CX_COMABT_INT;
+-	iowrite32(value, fotg210->reg + FOTG210_DISGR0);
+-}
+-
+ static void fotg210_in_fifo_handler(struct fotg210_ep *ep)
+ {
+ 	struct fotg210_request *req = list_entry(ep->queue.next,
+@@ -893,60 +892,43 @@ static irqreturn_t fotg210_irq(int irq,
+ 		void __iomem *reg = fotg210->reg + FOTG210_DISGR2;
+ 		u32 int_grp2 = ioread32(reg);
+ 		u32 int_msk2 = ioread32(fotg210->reg + FOTG210_DMISGR2);
+-		u32 value;
+ 
+ 		int_grp2 &= ~int_msk2;
+ 
+ 		if (int_grp2 & DISGR2_USBRST_INT) {
+ 			usb_gadget_udc_reset(&fotg210->gadget,
+ 					     fotg210->driver);
+-			value = ioread32(reg);
+-			value &= ~DISGR2_USBRST_INT;
+-			iowrite32(value, reg);
++			fotg210_ack_int(fotg210, FOTG210_DISGR2, DISGR2_USBRST_INT);
+ 			pr_info("fotg210 udc reset\n");
+ 		}
+ 		if (int_grp2 & DISGR2_SUSP_INT) {
+-			value = ioread32(reg);
+-			value &= ~DISGR2_SUSP_INT;
+-			iowrite32(value, reg);
++			fotg210_ack_int(fotg210, FOTG210_DISGR2, DISGR2_SUSP_INT);
+ 			pr_info("fotg210 udc suspend\n");
+ 		}
+ 		if (int_grp2 & DISGR2_RESM_INT) {
+-			value = ioread32(reg);
+-			value &= ~DISGR2_RESM_INT;
+-			iowrite32(value, reg);
++			fotg210_ack_int(fotg210, FOTG210_DISGR2, DISGR2_RESM_INT);
+ 			pr_info("fotg210 udc resume\n");
+ 		}
+ 		if (int_grp2 & DISGR2_ISO_SEQ_ERR_INT) {
+-			value = ioread32(reg);
+-			value &= ~DISGR2_ISO_SEQ_ERR_INT;
+-			iowrite32(value, reg);
++			fotg210_ack_int(fotg210, FOTG210_DISGR2, DISGR2_ISO_SEQ_ERR_INT);
+ 			pr_info("fotg210 iso sequence error\n");
+ 		}
+ 		if (int_grp2 & DISGR2_ISO_SEQ_ABORT_INT) {
+-			value = ioread32(reg);
+-			value &= ~DISGR2_ISO_SEQ_ABORT_INT;
+-			iowrite32(value, reg);
++			fotg210_ack_int(fotg210, FOTG210_DISGR2, DISGR2_ISO_SEQ_ABORT_INT);
+ 			pr_info("fotg210 iso sequence abort\n");
+ 		}
+ 		if (int_grp2 & DISGR2_TX0BYTE_INT) {
+ 			fotg210_clear_tx0byte(fotg210);
+-			value = ioread32(reg);
+-			value &= ~DISGR2_TX0BYTE_INT;
+-			iowrite32(value, reg);
++			fotg210_ack_int(fotg210, FOTG210_DISGR2, DISGR2_TX0BYTE_INT);
+ 			pr_info("fotg210 transferred 0 byte\n");
+ 		}
+ 		if (int_grp2 & DISGR2_RX0BYTE_INT) {
+ 			fotg210_clear_rx0byte(fotg210);
+-			value = ioread32(reg);
+-			value &= ~DISGR2_RX0BYTE_INT;
+-			iowrite32(value, reg);
++			fotg210_ack_int(fotg210, FOTG210_DISGR2, DISGR2_RX0BYTE_INT);
+ 			pr_info("fotg210 received 0 byte\n");
+ 		}
+ 		if (int_grp2 & DISGR2_DMA_ERROR) {
+-			value = ioread32(reg);
+-			value &= ~DISGR2_DMA_ERROR;
+-			iowrite32(value, reg);
++			fotg210_ack_int(fotg210, FOTG210_DISGR2, DISGR2_DMA_ERROR);
+ 		}
+ 	}
+ 
+@@ -960,7 +942,7 @@ static irqreturn_t fotg210_irq(int irq,
+ 
+ 		/* the highest priority in this source register */
+ 		if (int_grp0 & DISGR0_CX_COMABT_INT) {
+-			fotg210_clear_comabt_int(fotg210);
++			fotg210_ack_int(fotg210, FOTG210_DISGR0, DISGR0_CX_COMABT_INT);
+ 			pr_info("fotg210 CX command abort\n");
+ 		}
+ 
diff --git a/target/linux/gemini/patches-6.1/0023-fotg210-udc-Improve-device-initialization.patch b/target/linux/gemini/patches-6.1/0023-fotg210-udc-Improve-device-initialization.patch
new file mode 100644
index 00000000000000..fde17a48b3d47b
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0023-fotg210-udc-Improve-device-initialization.patch
@@ -0,0 +1,62 @@
+From 367747c7813cecf19b46ef7134691f903ab76dc9 Mon Sep 17 00:00:00 2001
+From: Fabian Vogt <fabian@ritter-vogt.de>
+Date: Mon, 23 Jan 2023 08:35:08 +0100
+Subject: [PATCH 23/29] fotg210-udc: Improve device initialization
+
+Reset the device explicitly to get into a known state and also set the chip
+enable bit. Additionally, mask interrupts which aren't handled.
+
+Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20230123073508.2350402-4-linus.walleij@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/fotg210-udc.c
++++ b/drivers/usb/fotg210/fotg210-udc.c
+@@ -7,6 +7,7 @@
+  * Author : Yuan-Hsin Chen <yhchen@faraday-tech.com>
+  */
+ 
++#include <linux/delay.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/err.h>
+ #include <linux/interrupt.h>
+@@ -1022,6 +1023,11 @@ static int fotg210_udc_start(struct usb_
+ 			dev_err(fotg210->dev, "can't bind to phy\n");
+ 	}
+ 
++	/* chip enable */
++	value = ioread32(fotg210->reg + FOTG210_DMCR);
++	value |= DMCR_CHIP_EN;
++	iowrite32(value, fotg210->reg + FOTG210_DMCR);
++
+ 	/* enable device global interrupt */
+ 	value = ioread32(fotg210->reg + FOTG210_DMCR);
+ 	value |= DMCR_GLINT_EN;
+@@ -1038,6 +1044,15 @@ static void fotg210_init(struct fotg210_
+ 	iowrite32(GMIR_MHC_INT | GMIR_MOTG_INT | GMIR_INT_POLARITY,
+ 		  fotg210->reg + FOTG210_GMIR);
+ 
++	/* mask interrupts for groups other than 0-2 */
++	iowrite32(~(DMIGR_MINT_G0 | DMIGR_MINT_G1 | DMIGR_MINT_G2),
++		  fotg210->reg + FOTG210_DMIGR);
++
++	/* udc software reset */
++	iowrite32(DMCR_SFRST, fotg210->reg + FOTG210_DMCR);
++	/* Better wait a bit, but without a datasheet, no idea how long. */
++	usleep_range(100, 200);
++
+ 	/* disable device global interrupt */
+ 	value = ioread32(fotg210->reg + FOTG210_DMCR);
+ 	value &= ~DMCR_GLINT_EN;
+--- a/drivers/usb/fotg210/fotg210-udc.h
++++ b/drivers/usb/fotg210/fotg210-udc.h
+@@ -58,6 +58,8 @@
+ 
+ /* Device Mask of Interrupt Group Register (0x130) */
+ #define FOTG210_DMIGR		0x130
++#define DMIGR_MINT_G2		(1 << 2)
++#define DMIGR_MINT_G1		(1 << 1)
+ #define DMIGR_MINT_G0		(1 << 0)
+ 
+ /* Device Mask of Interrupt Source Group 0(0x134) */
diff --git a/target/linux/gemini/patches-6.1/0024-usb-fotg210-hcd-use-sysfs_emit-to-instead-of-scnprin.patch b/target/linux/gemini/patches-6.1/0024-usb-fotg210-hcd-use-sysfs_emit-to-instead-of-scnprin.patch
new file mode 100644
index 00000000000000..680836110a0b7b
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0024-usb-fotg210-hcd-use-sysfs_emit-to-instead-of-scnprin.patch
@@ -0,0 +1,32 @@
+From 482830a70408a5d30af264b3d6706f818c78b2b2 Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Fri, 20 Jan 2023 17:44:33 +0200
+Subject: [PATCH 24/29] usb: fotg210-hcd: use sysfs_emit() to instead of
+ scnprintf()
+
+Follow the advice of the Documentation/filesystems/sysfs.rst and show()
+should only use sysfs_emit() or sysfs_emit_at() when formatting the
+value to be returned to user space.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20230120154437.22025-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+--- a/drivers/usb/fotg210/fotg210-hcd.c
++++ b/drivers/usb/fotg210/fotg210-hcd.c
+@@ -4686,14 +4686,11 @@ static ssize_t uframe_periodic_max_show(
+ 		struct device_attribute *attr, char *buf)
+ {
+ 	struct fotg210_hcd *fotg210;
+-	int n;
+ 
+ 	fotg210 = hcd_to_fotg210(bus_to_hcd(dev_get_drvdata(dev)));
+-	n = scnprintf(buf, PAGE_SIZE, "%d\n", fotg210->uframe_periodic_max);
+-	return n;
++	return sysfs_emit(buf, "%d\n", fotg210->uframe_periodic_max);
+ }
+ 
+-
+ static ssize_t uframe_periodic_max_store(struct device *dev,
+ 		struct device_attribute *attr, const char *buf, size_t count)
+ {
diff --git a/target/linux/gemini/patches-6.1/0025-ARM-dts-gemini-Push-down-flash-address-size-cells.patch b/target/linux/gemini/patches-6.1/0025-ARM-dts-gemini-Push-down-flash-address-size-cells.patch
new file mode 100644
index 00000000000000..1e031f1d4ff9ae
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0025-ARM-dts-gemini-Push-down-flash-address-size-cells.patch
@@ -0,0 +1,62 @@
+From 6b84aa39a063eec883d410a9893cec70fce56163 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Sun, 4 Dec 2022 20:02:28 +0100
+Subject: [PATCH 25/29] ARM: dts: gemini: Push down flash address/size cells
+
+The platforms not defining any OF partions complain like
+this:
+
+../arch/arm/boot/dts/gemini.dtsi:19.25-28.5: Warning
+ (avoid_unnecessary_addr_size): /soc/flash@30000000: unnecessary
+ #address-cells/#size-cells without "ranges" or child "reg" property
+
+Get rid of this by only defining the address-cells and
+size-cells where it is actually used by OF partitions.
+
+Link: https://lore.kernel.org/r/20221204190230.3345590-1-linus.walleij@linaro.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+---
+--- a/arch/arm/boot/dts/gemini-dlink-dns-313.dts
++++ b/arch/arm/boot/dts/gemini-dlink-dns-313.dts
+@@ -164,6 +164,8 @@
+ 			compatible = "cortina,gemini-flash", "jedec-flash";
+ 			status = "okay";
+ 			reg = <0x30000000 0x00080000>;
++			#address-cells = <1>;
++			#size-cells = <1>;
+ 
+ 			/*
+ 			 * This "RedBoot" is the Storlink derivative.
+--- a/arch/arm/boot/dts/gemini-wbd111.dts
++++ b/arch/arm/boot/dts/gemini-wbd111.dts
+@@ -86,6 +86,8 @@
+ 			status = "okay";
+ 			/* 8MB of flash */
+ 			reg = <0x30000000 0x00800000>;
++			#address-cells = <1>;
++			#size-cells = <1>;
+ 
+ 			partition@0 {
+ 				label = "RedBoot";
+--- a/arch/arm/boot/dts/gemini-wbd222.dts
++++ b/arch/arm/boot/dts/gemini-wbd222.dts
+@@ -90,6 +90,8 @@
+ 			status = "okay";
+ 			/* 8MB of flash */
+ 			reg = <0x30000000 0x00800000>;
++			#address-cells = <1>;
++			#size-cells = <1>;
+ 
+ 			partition@0 {
+ 				label = "RedBoot";
+--- a/arch/arm/boot/dts/gemini.dtsi
++++ b/arch/arm/boot/dts/gemini.dtsi
+@@ -22,8 +22,6 @@
+ 			pinctrl-names = "default";
+ 			pinctrl-0 = <&pflash_default_pins>;
+ 			bank-width = <2>;
+-			#address-cells = <1>;
+-			#size-cells = <1>;
+ 			status = "disabled";
+ 		};
+ 
diff --git a/target/linux/gemini/patches-6.1/0026-ARM-dts-gemini-wbd111-Use-RedBoot-partion-parser.patch b/target/linux/gemini/patches-6.1/0026-ARM-dts-gemini-wbd111-Use-RedBoot-partion-parser.patch
new file mode 100644
index 00000000000000..1aff23ed1bad68
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0026-ARM-dts-gemini-wbd111-Use-RedBoot-partion-parser.patch
@@ -0,0 +1,54 @@
+From 0e733f5af628210f372585e431504a7024e7b571 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Sun, 4 Dec 2022 20:02:29 +0100
+Subject: [PATCH 26/29] ARM: dts: gemini: wbd111: Use RedBoot partion parser
+
+This is clearly a RedBoot partitioned device with 0x20000
+sized erase blocks.
+
+Link: https://lore.kernel.org/r/20221204190230.3345590-2-linus.walleij@linaro.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+---
+--- a/arch/arm/boot/dts/gemini-wbd111.dts
++++ b/arch/arm/boot/dts/gemini-wbd111.dts
+@@ -86,36 +86,11 @@
+ 			status = "okay";
+ 			/* 8MB of flash */
+ 			reg = <0x30000000 0x00800000>;
+-			#address-cells = <1>;
+-			#size-cells = <1>;
+ 
+-			partition@0 {
+-				label = "RedBoot";
+-				reg = <0x00000000 0x00020000>;
+-				read-only;
+-			};
+-			partition@20000 {
+-				label = "kernel";
+-				reg = <0x00020000 0x00100000>;
+-			};
+-			partition@120000 {
+-				label = "rootfs";
+-				reg = <0x00120000 0x006a0000>;
+-			};
+-			partition@7c0000 {
+-				label = "VCTL";
+-				reg = <0x007c0000 0x00010000>;
+-				read-only;
+-			};
+-			partition@7d0000 {
+-				label = "cfg";
+-				reg = <0x007d0000 0x00010000>;
+-				read-only;
+-			};
+-			partition@7e0000 {
+-				label = "FIS";
+-				reg = <0x007e0000 0x00010000>;
+-				read-only;
++			partitions {
++				compatible = "redboot-fis";
++				/* Eraseblock at 0x7e0000 */
++				fis-index-block = <0x3f>;
+ 			};
+ 		};
+ 
diff --git a/target/linux/gemini/patches-6.1/0027-ARM-dts-gemini-wbd222-Use-RedBoot-partion-parser.patch b/target/linux/gemini/patches-6.1/0027-ARM-dts-gemini-wbd222-Use-RedBoot-partion-parser.patch
new file mode 100644
index 00000000000000..8cafeaa0dfef02
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0027-ARM-dts-gemini-wbd222-Use-RedBoot-partion-parser.patch
@@ -0,0 +1,54 @@
+From 8558e2e1110a5daa4ac9e1c5b5c15e1651a8fb94 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Sun, 4 Dec 2022 20:02:30 +0100
+Subject: [PATCH 27/29] ARM: dts: gemini: wbd222: Use RedBoot partion parser
+
+This is clearly a RedBoot partitioned device with 0x20000
+sized erase blocks.
+
+Link: https://lore.kernel.org/r/20221204190230.3345590-3-linus.walleij@linaro.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+---
+--- a/arch/arm/boot/dts/gemini-wbd222.dts
++++ b/arch/arm/boot/dts/gemini-wbd222.dts
+@@ -90,36 +90,11 @@
+ 			status = "okay";
+ 			/* 8MB of flash */
+ 			reg = <0x30000000 0x00800000>;
+-			#address-cells = <1>;
+-			#size-cells = <1>;
+ 
+-			partition@0 {
+-				label = "RedBoot";
+-				reg = <0x00000000 0x00020000>;
+-				read-only;
+-			};
+-			partition@20000 {
+-				label = "kernel";
+-				reg = <0x00020000 0x00100000>;
+-			};
+-			partition@120000 {
+-				label = "rootfs";
+-				reg = <0x00120000 0x006a0000>;
+-			};
+-			partition@7c0000 {
+-				label = "VCTL";
+-				reg = <0x007c0000 0x00010000>;
+-				read-only;
+-			};
+-			partition@7d0000 {
+-				label = "cfg";
+-				reg = <0x007d0000 0x00010000>;
+-				read-only;
+-			};
+-			partition@7e0000 {
+-				label = "FIS";
+-				reg = <0x007e0000 0x00010000>;
+-				read-only;
++			partitions {
++				compatible = "redboot-fis";
++				/* Eraseblock at 0x7e0000 */
++				fis-index-block = <0x3f>;
+ 			};
+ 		};
+ 
diff --git a/target/linux/gemini/patches-6.1/0028-ARM-dts-gemini-Fix-USB-block-version.patch b/target/linux/gemini/patches-6.1/0028-ARM-dts-gemini-Fix-USB-block-version.patch
new file mode 100644
index 00000000000000..fb93b70a3130ee
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0028-ARM-dts-gemini-Fix-USB-block-version.patch
@@ -0,0 +1,31 @@
+From d5c01ce4a1016507c69682894cf6b66301abca3d Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Mon, 23 Jan 2023 08:39:15 +0100
+Subject: [PATCH 28/29] ARM: dts: gemini: Fix USB block version
+
+The FOTG version in the Gemini is the FOTG200, fix this
+up.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20230123073916.2350839-1-linus.walleij@linaro.org
+---
+--- a/arch/arm/boot/dts/gemini.dtsi
++++ b/arch/arm/boot/dts/gemini.dtsi
+@@ -439,7 +439,7 @@
+ 		};
+ 
+ 		usb0: usb@68000000 {
+-			compatible = "cortina,gemini-usb", "faraday,fotg210";
++			compatible = "cortina,gemini-usb", "faraday,fotg200";
+ 			reg = <0x68000000 0x1000>;
+ 			interrupts = <10 IRQ_TYPE_LEVEL_HIGH>;
+ 			resets = <&syscon GEMINI_RESET_USB0>;
+@@ -460,7 +460,7 @@
+ 		};
+ 
+ 		usb1: usb@69000000 {
+-			compatible = "cortina,gemini-usb", "faraday,fotg210";
++			compatible = "cortina,gemini-usb", "faraday,fotg200";
+ 			reg = <0x69000000 0x1000>;
+ 			interrupts = <11 IRQ_TYPE_LEVEL_HIGH>;
+ 			resets = <&syscon GEMINI_RESET_USB1>;
diff --git a/target/linux/gemini/patches-6.1/0029-ARM-dts-gemini-Enable-DNS313-FOTG210-as-periph.patch b/target/linux/gemini/patches-6.1/0029-ARM-dts-gemini-Enable-DNS313-FOTG210-as-periph.patch
new file mode 100644
index 00000000000000..667878170b7c27
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/0029-ARM-dts-gemini-Enable-DNS313-FOTG210-as-periph.patch
@@ -0,0 +1,54 @@
+From 296184694ae7a4e388603c95499e98d30b21cc09 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Mon, 23 Jan 2023 08:39:16 +0100
+Subject: [PATCH 29/29] ARM: dts: gemini: Enable DNS313 FOTG210 as periph
+
+Add the GPIO-based VBUS phy, and enable the FOTG210
+USB1 block for use as peripheral.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20230123073916.2350839-2-linus.walleij@linaro.org
+---
+--- a/arch/arm/boot/dts/gemini-dlink-dns-313.dts
++++ b/arch/arm/boot/dts/gemini-dlink-dns-313.dts
+@@ -80,6 +80,15 @@
+ 		#cooling-cells = <2>;
+ 	};
+ 
++	/*
++	 * This is the type B USB connector on the device,
++	 * a GPIO-controlled USB VBUS detect
++	 */
++	usb1_phy: phy {
++		compatible = "gpio-usb-b-connector", "usb-b-connector";
++		#phy-cells = <0>;
++		vbus-gpios = <&gpio0 18 GPIO_ACTIVE_LOW>;
++	};
+ 
+ 	/* Global Mixed-Mode Technology G751 mounted on GPIO I2C */
+ 	i2c {
+@@ -302,5 +311,13 @@
+ 		ide@63000000 {
+ 			status = "okay";
+ 		};
++
++		usb@69000000 {
++			status = "okay";
++			dr_mode = "peripheral";
++			usb-phy = <&usb1_phy>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&usb_default_pins>;
++		};
+ 	};
+ };
+--- a/arch/arm/boot/dts/gemini.dtsi
++++ b/arch/arm/boot/dts/gemini.dtsi
+@@ -455,6 +455,8 @@
+ 			 */
+ 			pinctrl-names = "default";
+ 			pinctrl-0 = <&usb_default_pins>;
++			/* Default to host mode */
++			dr_mode = "host";
+ 			syscon = <&syscon>;
+ 			status = "disabled";
+ 		};
diff --git a/target/linux/gemini/patches-6.1/300-ARM-dts-Augment-DIR-685-partition-table-for-OpenWrt.patch b/target/linux/gemini/patches-6.1/300-ARM-dts-Augment-DIR-685-partition-table-for-OpenWrt.patch
new file mode 100644
index 00000000000000..99e0d2731da488
--- /dev/null
+++ b/target/linux/gemini/patches-6.1/300-ARM-dts-Augment-DIR-685-partition-table-for-OpenWrt.patch
@@ -0,0 +1,34 @@
+From 36ee838bf83c01cff7cb47c7b07be278d2950ac0 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Mon, 11 Mar 2019 15:44:29 +0100
+Subject: [PATCH 2/2] ARM: dts: Augment DIR-685 partition table for OpenWrt
+
+Rename the firmware partition so that the firmware MTD
+splitter will do its job, drop the rootfs arguments as
+the MTD splitter will set this up automatically.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+---
+--- a/arch/arm/boot/dts/gemini-dlink-dir-685.dts
++++ b/arch/arm/boot/dts/gemini-dlink-dir-685.dts
+@@ -20,7 +20,7 @@
+ 	};
+ 
+ 	chosen {
+-		bootargs = "console=ttyS0,19200n8 root=/dev/sda1 rw rootwait consoleblank=300";
++		bootargs = "console=ttyS0,19200n8 consoleblank=300";
+ 		stdout-path = "uart0:19200n8";
+ 	};
+ 
+@@ -317,9 +317,9 @@
+ 				 * this is called "upgrade" on the vendor system.
+ 				 */
+ 				partition@40000 {
+-					label = "upgrade";
++					compatible = "wrg";
++					label = "firmware";
+ 					reg = <0x00040000 0x01f40000>;
+-					read-only;
+ 				};
+ 				/* RGDB, Residental Gateway Database? */
+ 				partition@1f80000 {
diff --git a/target/linux/generic/backport-5.15/005-v5.17-01-Kbuild-use-Wdeclaration-after-statement.patch b/target/linux/generic/backport-5.15/005-v5.17-01-Kbuild-use-Wdeclaration-after-statement.patch
new file mode 100644
index 00000000000000..b481dd306179cd
--- /dev/null
+++ b/target/linux/generic/backport-5.15/005-v5.17-01-Kbuild-use-Wdeclaration-after-statement.patch
@@ -0,0 +1,73 @@
+From 2fd7e7f9317d3048a14026816d081b08ba98ea8e Mon Sep 17 00:00:00 2001
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 8 Mar 2022 22:56:13 +0100
+Subject: [PATCH 1/3] Kbuild: use -Wdeclaration-after-statement
+
+The kernel is moving from using `-std=gnu89` to `-std=gnu11`, permitting
+the use of additional C11 features such as for-loop initial declarations.
+
+One contentious aspect of C99 is that it permits mixed declarations and
+code, and for now at least, it seems preferable to enforce that
+declarations must come first.
+
+These warnings were already enabled in the kernel itself, but not
+for KBUILD_USERCFLAGS or the compat VDSO on arch/arm64, which uses
+a separate set of CFLAGS.
+
+This patch fixes an existing violation in modpost.c, which is not
+reported because of the missing flag in KBUILD_USERCFLAGS:
+
+| scripts/mod/modpost.c: In function ‘match’:
+| scripts/mod/modpost.c:837:3: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement]
+|   837 |   const char *endp = p + strlen(p) - 1;
+|       |   ^~~~~
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+[arnd: don't add a duplicate flag to the default set, update changelog]
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nathan Chancellor <nathan@kernel.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Tested-by: Sedat Dilek <sedat.dilek@gmail.com> # LLVM/Clang v13.0.0 (x86-64)
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+---
+ Makefile                          | 3 ++-
+ arch/arm64/kernel/vdso32/Makefile | 1 +
+ scripts/mod/modpost.c             | 4 +++-
+ 3 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/Makefile
++++ b/Makefile
+@@ -440,7 +440,8 @@ endif
+ HOSTPKG_CONFIG	= pkg-config
+ 
+ export KBUILD_USERCFLAGS := -Wall -Wmissing-prototypes -Wstrict-prototypes \
+-			      -O2 -fomit-frame-pointer -std=gnu89
++			      -O2 -fomit-frame-pointer -std=gnu89 \
++			      -Wdeclaration-after-statement
+ export KBUILD_USERLDFLAGS :=
+ 
+ KBUILD_HOSTCFLAGS   := $(KBUILD_USERCFLAGS) $(HOST_LFS_CFLAGS) $(HOSTCFLAGS)
+--- a/arch/arm64/kernel/vdso32/Makefile
++++ b/arch/arm64/kernel/vdso32/Makefile
+@@ -76,6 +76,7 @@ VDSO_CFLAGS += -Wall -Wundef -Wstrict-pr
+                -fno-strict-aliasing -fno-common \
+                -Werror-implicit-function-declaration \
+                -Wno-format-security \
++               -Wdeclaration-after-statement \
+                -std=gnu89
+ VDSO_CFLAGS  += -O2
+ # Some useful compiler-dependent flags from top-level Makefile
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -833,8 +833,10 @@ static int match(const char *sym, const
+ {
+ 	const char *p;
+ 	while (*pat) {
++		const char *endp;
++
+ 		p = *pat++;
+-		const char *endp = p + strlen(p) - 1;
++		endp = p + strlen(p) - 1;
+ 
+ 		/* "*foo*" */
+ 		if (*p == '*' && *endp == '*') {
diff --git a/target/linux/generic/backport-5.15/005-v5.17-02-Kbuild-move-to-std-gnu11.patch b/target/linux/generic/backport-5.15/005-v5.17-02-Kbuild-move-to-std-gnu11.patch
new file mode 100644
index 00000000000000..94fc52fd8e039a
--- /dev/null
+++ b/target/linux/generic/backport-5.15/005-v5.17-02-Kbuild-move-to-std-gnu11.patch
@@ -0,0 +1,60 @@
+From b810c8e719ea082e47c7a8f7cf878bc84fa2455d Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Tue, 8 Mar 2022 22:56:14 +0100
+Subject: [PATCH 2/3] Kbuild: move to -std=gnu11
+
+During a patch discussion, Linus brought up the option of changing
+the C standard version from gnu89 to gnu99, which allows using variable
+declaration inside of a for() loop. While the C99, C11 and later standards
+introduce many other features, most of these are already available in
+gnu89 as GNU extensions as well.
+
+An earlier attempt to do this when gcc-5 started defaulting to
+-std=gnu11 failed because at the time that caused warnings about
+designated initializers with older compilers. Now that gcc-5.1 is
+the minimum compiler version used for building kernels, that is no
+longer a concern. Similarly, the behavior of 'inline' functions changes
+between gnu89 using gnu_inline behavior and gnu11 using standard c99+
+behavior, but this was taken care of by defining 'inline' to include
+__attribute__((gnu_inline)) in order to allow building with clang a
+while ago.
+
+Nathan Chancellor reported a new -Wdeclaration-after-statement
+warning that appears in a system header on arm, this still needs a
+workaround.
+
+The differences between gnu99, gnu11, gnu1x and gnu17 are fairly
+minimal and mainly impact warnings at the -Wpedantic level that the
+kernel never enables. Between these, gnu11 is the newest version
+that is supported by all supported compiler versions, though it is
+only the default on gcc-5, while all other supported versions of
+gcc or clang default to gnu1x/gnu17.
+
+Link: https://lore.kernel.org/lkml/CAHk-=wiyCH7xeHcmiFJ-YgXUy2Jaj7pnkdKpcovt8fYbVFW3TA@mail.gmail.com/
+Link: https://github.com/ClangBuiltLinux/linux/issues/1603
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Marco Elver <elver@google.com>
+Acked-by: Jani Nikula <jani.nikula@intel.com>
+Acked-by: David Sterba <dsterba@suse.com>
+Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
+Reviewed-by: Alex Shi <alexs@kernel.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Makefile
++++ b/Makefile
+@@ -524,7 +524,7 @@ KBUILD_CFLAGS   := -Wall -Wundef -Werror
+ 		   -fno-strict-aliasing -fno-common -fshort-wchar -fno-PIE \
+ 		   -Werror=implicit-function-declaration -Werror=implicit-int \
+ 		   -Werror=return-type -Wno-format-security \
+-		   -std=gnu89
++		   -std=gnu11
+ KBUILD_CPPFLAGS := -D__KERNEL__
+ KBUILD_AFLAGS_KERNEL :=
+ KBUILD_CFLAGS_KERNEL :=
diff --git a/target/linux/generic/backport-5.15/005-v5.17-03-Kbuild-use-std-gnu11-for-KBUILD_USERCFLAGS.patch b/target/linux/generic/backport-5.15/005-v5.17-03-Kbuild-use-std-gnu11-for-KBUILD_USERCFLAGS.patch
new file mode 100644
index 00000000000000..e34acbba171635
--- /dev/null
+++ b/target/linux/generic/backport-5.15/005-v5.17-03-Kbuild-use-std-gnu11-for-KBUILD_USERCFLAGS.patch
@@ -0,0 +1,43 @@
+From 40337d6f3d677aee7ad3052ae662d3f53dd4d5cb Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Tue, 8 Mar 2022 22:56:15 +0100
+Subject: [PATCH 3/3] Kbuild: use -std=gnu11 for KBUILD_USERCFLAGS
+
+As we change the C language standard for the kernel from gnu89 to
+gnu11, it makes sense to also update the version for user space
+compilation.
+
+Some users have older native compilers than what they use for
+kernel builds, so I considered using gnu99 as the default version
+for wider compatibility with gcc-4.6 and earlier.
+
+However, testing with older compilers showed that we already require
+HOSTCC version 5.1 as well because a lot of host tools include
+linux/compiler.h that uses __has_attribute():
+
+  CC      tools/objtool/exec-cmd.o
+In file included from tools/include/linux/compiler_types.h:36:0,
+                 from tools/include/linux/compiler.h:5,
+                 from exec-cmd.c:2:
+tools/include/linux/compiler-gcc.h:19:5: error: "__has_attribute" is not defined [-Werror=undef]
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nathan Chancellor <nathan@kernel.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Makefile
++++ b/Makefile
+@@ -440,7 +440,7 @@ endif
+ HOSTPKG_CONFIG	= pkg-config
+ 
+ export KBUILD_USERCFLAGS := -Wall -Wmissing-prototypes -Wstrict-prototypes \
+-			      -O2 -fomit-frame-pointer -std=gnu89 \
++			      -O2 -fomit-frame-pointer -std=gnu11 \
+ 			      -Wdeclaration-after-statement
+ export KBUILD_USERLDFLAGS :=
+ 
diff --git a/target/linux/generic/backport-5.15/020-v6.1-01-mm-x86-arm64-add-arch_has_hw_pte_young.patch b/target/linux/generic/backport-5.15/020-v6.1-01-mm-x86-arm64-add-arch_has_hw_pte_young.patch
new file mode 100644
index 00000000000000..df854ffd3d81a5
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.1-01-mm-x86-arm64-add-arch_has_hw_pte_young.patch
@@ -0,0 +1,425 @@
+From a4103262b01a1b8704b37c01c7c813df91b7b119 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Sun, 18 Sep 2022 01:59:58 -0600
+Subject: [PATCH 01/29] mm: x86, arm64: add arch_has_hw_pte_young()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Patch series "Multi-Gen LRU Framework", v14.
+
+What's new
+==========
+1. OpenWrt, in addition to Android, Arch Linux Zen, Armbian, ChromeOS,
+   Liquorix, post-factum and XanMod, is now shipping MGLRU on 5.15.
+2. Fixed long-tailed direct reclaim latency seen on high-memory (TBs)
+   machines. The old direct reclaim backoff, which tries to enforce a
+   minimum fairness among all eligible memcgs, over-swapped by about
+   (total_mem>>DEF_PRIORITY)-nr_to_reclaim. The new backoff, which
+   pulls the plug on swapping once the target is met, trades some
+   fairness for curtailed latency:
+   https://lore.kernel.org/r/20220918080010.2920238-10-yuzhao@google.com/
+3. Fixed minior build warnings and conflicts. More comments and nits.
+
+TLDR
+====
+The current page reclaim is too expensive in terms of CPU usage and it
+often makes poor choices about what to evict. This patchset offers an
+alternative solution that is performant, versatile and
+straightforward.
+
+Patchset overview
+=================
+The design and implementation overview is in patch 14:
+https://lore.kernel.org/r/20220918080010.2920238-15-yuzhao@google.com/
+
+01. mm: x86, arm64: add arch_has_hw_pte_young()
+02. mm: x86: add CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG
+Take advantage of hardware features when trying to clear the accessed
+bit in many PTEs.
+
+03. mm/vmscan.c: refactor shrink_node()
+04. Revert "include/linux/mm_inline.h: fold __update_lru_size() into
+    its sole caller"
+Minor refactors to improve readability for the following patches.
+
+05. mm: multi-gen LRU: groundwork
+Adds the basic data structure and the functions that insert pages to
+and remove pages from the multi-gen LRU (MGLRU) lists.
+
+06. mm: multi-gen LRU: minimal implementation
+A minimal implementation without optimizations.
+
+07. mm: multi-gen LRU: exploit locality in rmap
+Exploits spatial locality to improve efficiency when using the rmap.
+
+08. mm: multi-gen LRU: support page table walks
+Further exploits spatial locality by optionally scanning page tables.
+
+09. mm: multi-gen LRU: optimize multiple memcgs
+Optimizes the overall performance for multiple memcgs running mixed
+types of workloads.
+
+10. mm: multi-gen LRU: kill switch
+Adds a kill switch to enable or disable MGLRU at runtime.
+
+11. mm: multi-gen LRU: thrashing prevention
+12. mm: multi-gen LRU: debugfs interface
+Provide userspace with features like thrashing prevention, working set
+estimation and proactive reclaim.
+
+13. mm: multi-gen LRU: admin guide
+14. mm: multi-gen LRU: design doc
+Add an admin guide and a design doc.
+
+Benchmark results
+=================
+Independent lab results
+-----------------------
+Based on the popularity of searches [01] and the memory usage in
+Google's public cloud, the most popular open-source memory-hungry
+applications, in alphabetical order, are:
+      Apache Cassandra      Memcached
+      Apache Hadoop         MongoDB
+      Apache Spark          PostgreSQL
+      MariaDB (MySQL)       Redis
+
+An independent lab evaluated MGLRU with the most widely used benchmark
+suites for the above applications. They posted 960 data points along
+with kernel metrics and perf profiles collected over more than 500
+hours of total benchmark time. Their final reports show that, with 95%
+confidence intervals (CIs), the above applications all performed
+significantly better for at least part of their benchmark matrices.
+
+On 5.14:
+1. Apache Spark [02] took 95% CIs [9.28, 11.19]% and [12.20, 14.93]%
+   less wall time to sort three billion random integers, respectively,
+   under the medium- and the high-concurrency conditions, when
+   overcommitting memory. There were no statistically significant
+   changes in wall time for the rest of the benchmark matrix.
+2. MariaDB [03] achieved 95% CIs [5.24, 10.71]% and [20.22, 25.97]%
+   more transactions per minute (TPM), respectively, under the medium-
+   and the high-concurrency conditions, when overcommitting memory.
+   There were no statistically significant changes in TPM for the rest
+   of the benchmark matrix.
+3. Memcached [04] achieved 95% CIs [23.54, 32.25]%, [20.76, 41.61]%
+   and [21.59, 30.02]% more operations per second (OPS), respectively,
+   for sequential access, random access and Gaussian (distribution)
+   access, when THP=always; 95% CIs [13.85, 15.97]% and
+   [23.94, 29.92]% more OPS, respectively, for random access and
+   Gaussian access, when THP=never. There were no statistically
+   significant changes in OPS for the rest of the benchmark matrix.
+4. MongoDB [05] achieved 95% CIs [2.23, 3.44]%, [6.97, 9.73]% and
+   [2.16, 3.55]% more operations per second (OPS), respectively, for
+   exponential (distribution) access, random access and Zipfian
+   (distribution) access, when underutilizing memory; 95% CIs
+   [8.83, 10.03]%, [21.12, 23.14]% and [5.53, 6.46]% more OPS,
+   respectively, for exponential access, random access and Zipfian
+   access, when overcommitting memory.
+
+On 5.15:
+5. Apache Cassandra [06] achieved 95% CIs [1.06, 4.10]%, [1.94, 5.43]%
+   and [4.11, 7.50]% more operations per second (OPS), respectively,
+   for exponential (distribution) access, random access and Zipfian
+   (distribution) access, when swap was off; 95% CIs [0.50, 2.60]%,
+   [6.51, 8.77]% and [3.29, 6.75]% more OPS, respectively, for
+   exponential access, random access and Zipfian access, when swap was
+   on.
+6. Apache Hadoop [07] took 95% CIs [5.31, 9.69]% and [2.02, 7.86]%
+   less average wall time to finish twelve parallel TeraSort jobs,
+   respectively, under the medium- and the high-concurrency
+   conditions, when swap was on. There were no statistically
+   significant changes in average wall time for the rest of the
+   benchmark matrix.
+7. PostgreSQL [08] achieved 95% CI [1.75, 6.42]% more transactions per
+   minute (TPM) under the high-concurrency condition, when swap was
+   off; 95% CIs [12.82, 18.69]% and [22.70, 46.86]% more TPM,
+   respectively, under the medium- and the high-concurrency
+   conditions, when swap was on. There were no statistically
+   significant changes in TPM for the rest of the benchmark matrix.
+8. Redis [09] achieved 95% CIs [0.58, 5.94]%, [6.55, 14.58]% and
+   [11.47, 19.36]% more total operations per second (OPS),
+   respectively, for sequential access, random access and Gaussian
+   (distribution) access, when THP=always; 95% CIs [1.27, 3.54]%,
+   [10.11, 14.81]% and [8.75, 13.64]% more total OPS, respectively,
+   for sequential access, random access and Gaussian access, when
+   THP=never.
+
+Our lab results
+---------------
+To supplement the above results, we ran the following benchmark suites
+on 5.16-rc7 and found no regressions [10].
+      fs_fio_bench_hdd_mq      pft
+      fs_lmbench               pgsql-hammerdb
+      fs_parallelio            redis
+      fs_postmark              stream
+      hackbench                sysbenchthread
+      kernbench                tpcc_spark
+      memcached                unixbench
+      multichase               vm-scalability
+      mutilate                 will-it-scale
+      nginx
+
+[01] https://trends.google.com
+[02] https://lore.kernel.org/r/20211102002002.92051-1-bot@edi.works/
+[03] https://lore.kernel.org/r/20211009054315.47073-1-bot@edi.works/
+[04] https://lore.kernel.org/r/20211021194103.65648-1-bot@edi.works/
+[05] https://lore.kernel.org/r/20211109021346.50266-1-bot@edi.works/
+[06] https://lore.kernel.org/r/20211202062806.80365-1-bot@edi.works/
+[07] https://lore.kernel.org/r/20211209072416.33606-1-bot@edi.works/
+[08] https://lore.kernel.org/r/20211218071041.24077-1-bot@edi.works/
+[09] https://lore.kernel.org/r/20211122053248.57311-1-bot@edi.works/
+[10] https://lore.kernel.org/r/20220104202247.2903702-1-yuzhao@google.com/
+
+Read-world applications
+=======================
+Third-party testimonials
+------------------------
+Konstantin reported [11]:
+   I have Archlinux with 8G RAM + zswap + swap. While developing, I
+   have lots of apps opened such as multiple LSP-servers for different
+   langs, chats, two browsers, etc... Usually, my system gets quickly
+   to a point of SWAP-storms, where I have to kill LSP-servers,
+   restart browsers to free memory, etc, otherwise the system lags
+   heavily and is barely usable.
+
+   1.5 day ago I migrated from 5.11.15 kernel to 5.12 + the LRU
+   patchset, and I started up by opening lots of apps to create memory
+   pressure, and worked for a day like this. Till now I had not a
+   single SWAP-storm, and mind you I got 3.4G in SWAP. I was never
+   getting to the point of 3G in SWAP before without a single
+   SWAP-storm.
+
+Vaibhav from IBM reported [12]:
+   In a synthetic MongoDB Benchmark, seeing an average of ~19%
+   throughput improvement on POWER10(Radix MMU + 64K Page Size) with
+   MGLRU patches on top of 5.16 kernel for MongoDB + YCSB across
+   three different request distributions, namely, Exponential, Uniform
+   and Zipfan.
+
+Shuang from U of Rochester reported [13]:
+   With the MGLRU, fio achieved 95% CIs [38.95, 40.26]%, [4.12, 6.64]%
+   and [9.26, 10.36]% higher throughput, respectively, for random
+   access, Zipfian (distribution) access and Gaussian (distribution)
+   access, when the average number of jobs per CPU is 1; 95% CIs
+   [42.32, 49.15]%, [9.44, 9.89]% and [20.99, 22.86]% higher
+   throughput, respectively, for random access, Zipfian access and
+   Gaussian access, when the average number of jobs per CPU is 2.
+
+Daniel from Michigan Tech reported [14]:
+   With Memcached allocating ~100GB of byte-addressable Optante,
+   performance improvement in terms of throughput (measured as queries
+   per second) was about 10% for a series of workloads.
+
+Large-scale deployments
+-----------------------
+We've rolled out MGLRU to tens of millions of ChromeOS users and
+about a million Android users. Google's fleetwide profiling [15] shows
+an overall 40% decrease in kswapd CPU usage, in addition to
+improvements in other UX metrics, e.g., an 85% decrease in the number
+of low-memory kills at the 75th percentile and an 18% decrease in
+app launch time at the 50th percentile.
+
+The downstream kernels that have been using MGLRU include:
+1. Android [16]
+2. Arch Linux Zen [17]
+3. Armbian [18]
+4. ChromeOS [19]
+5. Liquorix [20]
+6. OpenWrt [21]
+7. post-factum [22]
+8. XanMod [23]
+
+[11] https://lore.kernel.org/r/140226722f2032c86301fbd326d91baefe3d7d23.camel@yandex.ru/
+[12] https://lore.kernel.org/r/87czj3mux0.fsf@vajain21.in.ibm.com/
+[13] https://lore.kernel.org/r/20220105024423.26409-1-szhai2@cs.rochester.edu/
+[14] https://lore.kernel.org/r/CA+4-3vksGvKd18FgRinxhqHetBS1hQekJE2gwco8Ja-bJWKtFw@mail.gmail.com/
+[15] https://dl.acm.org/doi/10.1145/2749469.2750392
+[16] https://android.com
+[17] https://archlinux.org
+[18] https://armbian.com
+[19] https://chromium.org
+[20] https://liquorix.net
+[21] https://openwrt.org
+[22] https://codeberg.org/pf-kernel
+[23] https://xanmod.org
+
+Summary
+=======
+The facts are:
+1. The independent lab results and the real-world applications
+   indicate substantial improvements; there are no known regressions.
+2. Thrashing prevention, working set estimation and proactive reclaim
+   work out of the box; there are no equivalent solutions.
+3. There is a lot of new code; no smaller changes have been
+   demonstrated similar effects.
+
+Our options, accordingly, are:
+1. Given the amount of evidence, the reported improvements will likely
+   materialize for a wide range of workloads.
+2. Gauging the interest from the past discussions, the new features
+   will likely be put to use for both personal computers and data
+   centers.
+3. Based on Google's track record, the new code will likely be well
+   maintained in the long term. It'd be more difficult if not
+   impossible to achieve similar effects with other approaches.
+
+This patch (of 14):
+
+Some architectures automatically set the accessed bit in PTEs, e.g., x86
+and arm64 v8.2.  On architectures that do not have this capability,
+clearing the accessed bit in a PTE usually triggers a page fault following
+the TLB miss of this PTE (to emulate the accessed bit).
+
+Being aware of this capability can help make better decisions, e.g.,
+whether to spread the work out over a period of time to reduce bursty page
+faults when trying to clear the accessed bit in many PTEs.
+
+Note that theoretically this capability can be unreliable, e.g.,
+hotplugged CPUs might be different from builtin ones.  Therefore it should
+not be used in architecture-independent code that involves correctness,
+e.g., to determine whether TLB flushes are required (in combination with
+the accessed bit).
+
+Link: https://lkml.kernel.org/r/20220918080010.2920238-1-yuzhao@google.com
+Link: https://lkml.kernel.org/r/20220918080010.2920238-2-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Reviewed-by: Barry Song <baohua@kernel.org>
+Acked-by: Brian Geffon <bgeffon@google.com>
+Acked-by: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
+Acked-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Acked-by: Steven Barrett <steven@liquorix.net>
+Acked-by: Suleiman Souhlal <suleiman@google.com>
+Acked-by: Will Deacon <will@kernel.org>
+Tested-by: Daniel Byrne <djbyrne@mtu.edu>
+Tested-by: Donald Carr <d@chaos-reins.com>
+Tested-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+Tested-by: Konstantin Kharlamov <Hi-Angel@yandex.ru>
+Tested-by: Shuang Zhai <szhai2@cs.rochester.edu>
+Tested-by: Sofia Trinh <sofia.trinh@edi.works>
+Tested-by: Vaibhav Jain <vaibhav@linux.ibm.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Hillf Danton <hdanton@sina.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Miaohe Lin <linmiaohe@huawei.com>
+Cc: Mike Rapoport <rppt@linux.ibm.com>
+Cc: Qi Zheng <zhengqi.arch@bytedance.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ arch/arm64/include/asm/pgtable.h | 14 ++------------
+ arch/x86/include/asm/pgtable.h   |  6 +++---
+ include/linux/pgtable.h          | 13 +++++++++++++
+ mm/memory.c                      | 14 +-------------
+ 4 files changed, 19 insertions(+), 28 deletions(-)
+
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -999,23 +999,13 @@ static inline void update_mmu_cache(stru
+  * page after fork() + CoW for pfn mappings. We don't always have a
+  * hardware-managed access flag on arm64.
+  */
+-static inline bool arch_faults_on_old_pte(void)
+-{
+-	WARN_ON(preemptible());
+-
+-	return !cpu_has_hw_af();
+-}
+-#define arch_faults_on_old_pte		arch_faults_on_old_pte
++#define arch_has_hw_pte_young		cpu_has_hw_af
+ 
+ /*
+  * Experimentally, it's cheap to set the access flag in hardware and we
+  * benefit from prefaulting mappings as 'old' to start with.
+  */
+-static inline bool arch_wants_old_prefaulted_pte(void)
+-{
+-	return !arch_faults_on_old_pte();
+-}
+-#define arch_wants_old_prefaulted_pte	arch_wants_old_prefaulted_pte
++#define arch_wants_old_prefaulted_pte	cpu_has_hw_af
+ 
+ #endif /* !__ASSEMBLY__ */
+ 
+--- a/arch/x86/include/asm/pgtable.h
++++ b/arch/x86/include/asm/pgtable.h
+@@ -1397,10 +1397,10 @@ static inline bool arch_has_pfn_modify_c
+ 	return boot_cpu_has_bug(X86_BUG_L1TF);
+ }
+ 
+-#define arch_faults_on_old_pte arch_faults_on_old_pte
+-static inline bool arch_faults_on_old_pte(void)
++#define arch_has_hw_pte_young arch_has_hw_pte_young
++static inline bool arch_has_hw_pte_young(void)
+ {
+-	return false;
++	return true;
+ }
+ 
+ #endif	/* __ASSEMBLY__ */
+--- a/include/linux/pgtable.h
++++ b/include/linux/pgtable.h
+@@ -259,6 +259,19 @@ static inline int pmdp_clear_flush_young
+ #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
+ #endif
+ 
++#ifndef arch_has_hw_pte_young
++/*
++ * Return whether the accessed bit is supported on the local CPU.
++ *
++ * This stub assumes accessing through an old PTE triggers a page fault.
++ * Architectures that automatically set the access bit should overwrite it.
++ */
++static inline bool arch_has_hw_pte_young(void)
++{
++	return false;
++}
++#endif
++
+ #ifndef __HAVE_ARCH_PTEP_GET_AND_CLEAR
+ static inline pte_t ptep_get_and_clear(struct mm_struct *mm,
+ 				       unsigned long address,
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -121,18 +121,6 @@ int randomize_va_space __read_mostly =
+ 					2;
+ #endif
+ 
+-#ifndef arch_faults_on_old_pte
+-static inline bool arch_faults_on_old_pte(void)
+-{
+-	/*
+-	 * Those arches which don't have hw access flag feature need to
+-	 * implement their own helper. By default, "true" means pagefault
+-	 * will be hit on old pte.
+-	 */
+-	return true;
+-}
+-#endif
+-
+ #ifndef arch_wants_old_prefaulted_pte
+ static inline bool arch_wants_old_prefaulted_pte(void)
+ {
+@@ -2782,7 +2770,7 @@ static inline bool cow_user_page(struct
+ 	 * On architectures with software "accessed" bits, we would
+ 	 * take a double page fault, so mark it accessed here.
+ 	 */
+-	if (arch_faults_on_old_pte() && !pte_young(vmf->orig_pte)) {
++	if (!arch_has_hw_pte_young() && !pte_young(vmf->orig_pte)) {
+ 		pte_t entry;
+ 
+ 		vmf->pte = pte_offset_map_lock(mm, vmf->pmd, addr, &vmf->ptl);
diff --git a/target/linux/generic/backport-5.15/020-v6.1-02-mm-x86-add-CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG.patch b/target/linux/generic/backport-5.15/020-v6.1-02-mm-x86-add-CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG.patch
new file mode 100644
index 00000000000000..9e0430ea2aacee
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.1-02-mm-x86-add-CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG.patch
@@ -0,0 +1,153 @@
+From 493de1c4b0f2cd909169401da8c445f6c8a7e29d Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Sun, 18 Sep 2022 01:59:59 -0600
+Subject: [PATCH 02/29] mm: x86: add CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Some architectures support the accessed bit in non-leaf PMD entries, e.g.,
+x86 sets the accessed bit in a non-leaf PMD entry when using it as part of
+linear address translation [1].  Page table walkers that clear the
+accessed bit may use this capability to reduce their search space.
+
+Note that:
+1. Although an inline function is preferable, this capability is added
+   as a configuration option for consistency with the existing macros.
+2. Due to the little interest in other varieties, this capability was
+   only tested on Intel and AMD CPUs.
+
+Thanks to the following developers for their efforts [2][3].
+  Randy Dunlap <rdunlap@infradead.org>
+  Stephen Rothwell <sfr@canb.auug.org.au>
+
+[1]: Intel 64 and IA-32 Architectures Software Developer's Manual
+     Volume 3 (June 2021), section 4.8
+[2] https://lore.kernel.org/r/bfdcc7c8-922f-61a9-aa15-7e7250f04af7@infradead.org/
+[3] https://lore.kernel.org/r/20220413151513.5a0d7a7e@canb.auug.org.au/
+
+Link: https://lkml.kernel.org/r/20220918080010.2920238-3-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Reviewed-by: Barry Song <baohua@kernel.org>
+Acked-by: Brian Geffon <bgeffon@google.com>
+Acked-by: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
+Acked-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Acked-by: Steven Barrett <steven@liquorix.net>
+Acked-by: Suleiman Souhlal <suleiman@google.com>
+Tested-by: Daniel Byrne <djbyrne@mtu.edu>
+Tested-by: Donald Carr <d@chaos-reins.com>
+Tested-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+Tested-by: Konstantin Kharlamov <Hi-Angel@yandex.ru>
+Tested-by: Shuang Zhai <szhai2@cs.rochester.edu>
+Tested-by: Sofia Trinh <sofia.trinh@edi.works>
+Tested-by: Vaibhav Jain <vaibhav@linux.ibm.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Hillf Danton <hdanton@sina.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Miaohe Lin <linmiaohe@huawei.com>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Mike Rapoport <rppt@linux.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Qi Zheng <zhengqi.arch@bytedance.com>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ arch/Kconfig                   | 8 ++++++++
+ arch/x86/Kconfig               | 1 +
+ arch/x86/include/asm/pgtable.h | 3 ++-
+ arch/x86/mm/pgtable.c          | 5 ++++-
+ include/linux/pgtable.h        | 4 ++--
+ 5 files changed, 17 insertions(+), 4 deletions(-)
+
+--- a/arch/Kconfig
++++ b/arch/Kconfig
+@@ -1295,6 +1295,14 @@ config ARCH_HAS_ELFCORE_COMPAT
+ config ARCH_HAS_PARANOID_L1D_FLUSH
+ 	bool
+ 
++config ARCH_HAS_NONLEAF_PMD_YOUNG
++	bool
++	help
++	  Architectures that select this option are capable of setting the
++	  accessed bit in non-leaf PMD entries when using them as part of linear
++	  address translations. Page table walkers that clear the accessed bit
++	  may use this capability to reduce their search space.
++
+ source "kernel/gcov/Kconfig"
+ 
+ source "scripts/gcc-plugins/Kconfig"
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -84,6 +84,7 @@ config X86
+ 	select ARCH_HAS_PMEM_API		if X86_64
+ 	select ARCH_HAS_PTE_DEVMAP		if X86_64
+ 	select ARCH_HAS_PTE_SPECIAL
++	select ARCH_HAS_NONLEAF_PMD_YOUNG	if PGTABLE_LEVELS > 2
+ 	select ARCH_HAS_UACCESS_FLUSHCACHE	if X86_64
+ 	select ARCH_HAS_COPY_MC			if X86_64
+ 	select ARCH_HAS_SET_MEMORY
+--- a/arch/x86/include/asm/pgtable.h
++++ b/arch/x86/include/asm/pgtable.h
+@@ -817,7 +817,8 @@ static inline unsigned long pmd_page_vad
+ 
+ static inline int pmd_bad(pmd_t pmd)
+ {
+-	return (pmd_flags(pmd) & ~_PAGE_USER) != _KERNPG_TABLE;
++	return (pmd_flags(pmd) & ~(_PAGE_USER | _PAGE_ACCESSED)) !=
++	       (_KERNPG_TABLE & ~_PAGE_ACCESSED);
+ }
+ 
+ static inline unsigned long pages_to_mb(unsigned long npg)
+--- a/arch/x86/mm/pgtable.c
++++ b/arch/x86/mm/pgtable.c
+@@ -550,7 +550,7 @@ int ptep_test_and_clear_young(struct vm_
+ 	return ret;
+ }
+ 
+-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
++#if defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined(CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG)
+ int pmdp_test_and_clear_young(struct vm_area_struct *vma,
+ 			      unsigned long addr, pmd_t *pmdp)
+ {
+@@ -562,6 +562,9 @@ int pmdp_test_and_clear_young(struct vm_
+ 
+ 	return ret;
+ }
++#endif
++
++#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+ int pudp_test_and_clear_young(struct vm_area_struct *vma,
+ 			      unsigned long addr, pud_t *pudp)
+ {
+--- a/include/linux/pgtable.h
++++ b/include/linux/pgtable.h
+@@ -212,7 +212,7 @@ static inline int ptep_test_and_clear_yo
+ #endif
+ 
+ #ifndef __HAVE_ARCH_PMDP_TEST_AND_CLEAR_YOUNG
+-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
++#if defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined(CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG)
+ static inline int pmdp_test_and_clear_young(struct vm_area_struct *vma,
+ 					    unsigned long address,
+ 					    pmd_t *pmdp)
+@@ -233,7 +233,7 @@ static inline int pmdp_test_and_clear_yo
+ 	BUILD_BUG();
+ 	return 0;
+ }
+-#endif /* CONFIG_TRANSPARENT_HUGEPAGE */
++#endif /* CONFIG_TRANSPARENT_HUGEPAGE || CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG */
+ #endif
+ 
+ #ifndef __HAVE_ARCH_PTEP_CLEAR_YOUNG_FLUSH
diff --git a/target/linux/generic/backport-5.15/020-v6.1-03-mm-vmscan.c-refactor-shrink_node.patch b/target/linux/generic/backport-5.15/020-v6.1-03-mm-vmscan.c-refactor-shrink_node.patch
new file mode 100644
index 00000000000000..b8d2917d26cea8
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.1-03-mm-vmscan.c-refactor-shrink_node.patch
@@ -0,0 +1,275 @@
+From 9e17efd11450d3d2069adaa3c58db9ac8ebd1c66 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Sun, 18 Sep 2022 02:00:00 -0600
+Subject: [PATCH 03/29] mm/vmscan.c: refactor shrink_node()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This patch refactors shrink_node() to improve readability for the upcoming
+changes to mm/vmscan.c.
+
+Link: https://lkml.kernel.org/r/20220918080010.2920238-4-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Reviewed-by: Barry Song <baohua@kernel.org>
+Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
+Acked-by: Brian Geffon <bgeffon@google.com>
+Acked-by: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
+Acked-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Acked-by: Steven Barrett <steven@liquorix.net>
+Acked-by: Suleiman Souhlal <suleiman@google.com>
+Tested-by: Daniel Byrne <djbyrne@mtu.edu>
+Tested-by: Donald Carr <d@chaos-reins.com>
+Tested-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+Tested-by: Konstantin Kharlamov <Hi-Angel@yandex.ru>
+Tested-by: Shuang Zhai <szhai2@cs.rochester.edu>
+Tested-by: Sofia Trinh <sofia.trinh@edi.works>
+Tested-by: Vaibhav Jain <vaibhav@linux.ibm.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Hillf Danton <hdanton@sina.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Mike Rapoport <rppt@linux.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Qi Zheng <zhengqi.arch@bytedance.com>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ mm/vmscan.c | 198 +++++++++++++++++++++++++++-------------------------
+ 1 file changed, 104 insertions(+), 94 deletions(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2497,6 +2497,109 @@ enum scan_balance {
+ 	SCAN_FILE,
+ };
+ 
++static void prepare_scan_count(pg_data_t *pgdat, struct scan_control *sc)
++{
++	unsigned long file;
++	struct lruvec *target_lruvec;
++
++	target_lruvec = mem_cgroup_lruvec(sc->target_mem_cgroup, pgdat);
++
++	/*
++	 * Flush the memory cgroup stats, so that we read accurate per-memcg
++	 * lruvec stats for heuristics.
++	 */
++	mem_cgroup_flush_stats();
++
++	/*
++	 * Determine the scan balance between anon and file LRUs.
++	 */
++	spin_lock_irq(&target_lruvec->lru_lock);
++	sc->anon_cost = target_lruvec->anon_cost;
++	sc->file_cost = target_lruvec->file_cost;
++	spin_unlock_irq(&target_lruvec->lru_lock);
++
++	/*
++	 * Target desirable inactive:active list ratios for the anon
++	 * and file LRU lists.
++	 */
++	if (!sc->force_deactivate) {
++		unsigned long refaults;
++
++		refaults = lruvec_page_state(target_lruvec,
++				WORKINGSET_ACTIVATE_ANON);
++		if (refaults != target_lruvec->refaults[0] ||
++			inactive_is_low(target_lruvec, LRU_INACTIVE_ANON))
++			sc->may_deactivate |= DEACTIVATE_ANON;
++		else
++			sc->may_deactivate &= ~DEACTIVATE_ANON;
++
++		/*
++		 * When refaults are being observed, it means a new
++		 * workingset is being established. Deactivate to get
++		 * rid of any stale active pages quickly.
++		 */
++		refaults = lruvec_page_state(target_lruvec,
++				WORKINGSET_ACTIVATE_FILE);
++		if (refaults != target_lruvec->refaults[1] ||
++		    inactive_is_low(target_lruvec, LRU_INACTIVE_FILE))
++			sc->may_deactivate |= DEACTIVATE_FILE;
++		else
++			sc->may_deactivate &= ~DEACTIVATE_FILE;
++	} else
++		sc->may_deactivate = DEACTIVATE_ANON | DEACTIVATE_FILE;
++
++	/*
++	 * If we have plenty of inactive file pages that aren't
++	 * thrashing, try to reclaim those first before touching
++	 * anonymous pages.
++	 */
++	file = lruvec_page_state(target_lruvec, NR_INACTIVE_FILE);
++	if (file >> sc->priority && !(sc->may_deactivate & DEACTIVATE_FILE))
++		sc->cache_trim_mode = 1;
++	else
++		sc->cache_trim_mode = 0;
++
++	/*
++	 * Prevent the reclaimer from falling into the cache trap: as
++	 * cache pages start out inactive, every cache fault will tip
++	 * the scan balance towards the file LRU.  And as the file LRU
++	 * shrinks, so does the window for rotation from references.
++	 * This means we have a runaway feedback loop where a tiny
++	 * thrashing file LRU becomes infinitely more attractive than
++	 * anon pages.  Try to detect this based on file LRU size.
++	 */
++	if (!cgroup_reclaim(sc)) {
++		unsigned long total_high_wmark = 0;
++		unsigned long free, anon;
++		int z;
++
++		free = sum_zone_node_page_state(pgdat->node_id, NR_FREE_PAGES);
++		file = node_page_state(pgdat, NR_ACTIVE_FILE) +
++			   node_page_state(pgdat, NR_INACTIVE_FILE);
++
++		for (z = 0; z < MAX_NR_ZONES; z++) {
++			struct zone *zone = &pgdat->node_zones[z];
++
++			if (!managed_zone(zone))
++				continue;
++
++			total_high_wmark += high_wmark_pages(zone);
++		}
++
++		/*
++		 * Consider anon: if that's low too, this isn't a
++		 * runaway file reclaim problem, but rather just
++		 * extreme pressure. Reclaim as per usual then.
++		 */
++		anon = node_page_state(pgdat, NR_INACTIVE_ANON);
++
++		sc->file_is_tiny =
++			file + free <= total_high_wmark &&
++			!(sc->may_deactivate & DEACTIVATE_ANON) &&
++			anon >> sc->priority;
++	}
++}
++
+ /*
+  * Determine how aggressively the anon and file LRU lists should be
+  * scanned.  The relative value of each set of LRU lists is determined
+@@ -2965,109 +3068,16 @@ static void shrink_node(pg_data_t *pgdat
+ 	unsigned long nr_reclaimed, nr_scanned;
+ 	struct lruvec *target_lruvec;
+ 	bool reclaimable = false;
+-	unsigned long file;
+ 
+ 	target_lruvec = mem_cgroup_lruvec(sc->target_mem_cgroup, pgdat);
+ 
+ again:
+-	/*
+-	 * Flush the memory cgroup stats, so that we read accurate per-memcg
+-	 * lruvec stats for heuristics.
+-	 */
+-	mem_cgroup_flush_stats();
+-
+ 	memset(&sc->nr, 0, sizeof(sc->nr));
+ 
+ 	nr_reclaimed = sc->nr_reclaimed;
+ 	nr_scanned = sc->nr_scanned;
+ 
+-	/*
+-	 * Determine the scan balance between anon and file LRUs.
+-	 */
+-	spin_lock_irq(&target_lruvec->lru_lock);
+-	sc->anon_cost = target_lruvec->anon_cost;
+-	sc->file_cost = target_lruvec->file_cost;
+-	spin_unlock_irq(&target_lruvec->lru_lock);
+-
+-	/*
+-	 * Target desirable inactive:active list ratios for the anon
+-	 * and file LRU lists.
+-	 */
+-	if (!sc->force_deactivate) {
+-		unsigned long refaults;
+-
+-		refaults = lruvec_page_state(target_lruvec,
+-				WORKINGSET_ACTIVATE_ANON);
+-		if (refaults != target_lruvec->refaults[0] ||
+-			inactive_is_low(target_lruvec, LRU_INACTIVE_ANON))
+-			sc->may_deactivate |= DEACTIVATE_ANON;
+-		else
+-			sc->may_deactivate &= ~DEACTIVATE_ANON;
+-
+-		/*
+-		 * When refaults are being observed, it means a new
+-		 * workingset is being established. Deactivate to get
+-		 * rid of any stale active pages quickly.
+-		 */
+-		refaults = lruvec_page_state(target_lruvec,
+-				WORKINGSET_ACTIVATE_FILE);
+-		if (refaults != target_lruvec->refaults[1] ||
+-		    inactive_is_low(target_lruvec, LRU_INACTIVE_FILE))
+-			sc->may_deactivate |= DEACTIVATE_FILE;
+-		else
+-			sc->may_deactivate &= ~DEACTIVATE_FILE;
+-	} else
+-		sc->may_deactivate = DEACTIVATE_ANON | DEACTIVATE_FILE;
+-
+-	/*
+-	 * If we have plenty of inactive file pages that aren't
+-	 * thrashing, try to reclaim those first before touching
+-	 * anonymous pages.
+-	 */
+-	file = lruvec_page_state(target_lruvec, NR_INACTIVE_FILE);
+-	if (file >> sc->priority && !(sc->may_deactivate & DEACTIVATE_FILE))
+-		sc->cache_trim_mode = 1;
+-	else
+-		sc->cache_trim_mode = 0;
+-
+-	/*
+-	 * Prevent the reclaimer from falling into the cache trap: as
+-	 * cache pages start out inactive, every cache fault will tip
+-	 * the scan balance towards the file LRU.  And as the file LRU
+-	 * shrinks, so does the window for rotation from references.
+-	 * This means we have a runaway feedback loop where a tiny
+-	 * thrashing file LRU becomes infinitely more attractive than
+-	 * anon pages.  Try to detect this based on file LRU size.
+-	 */
+-	if (!cgroup_reclaim(sc)) {
+-		unsigned long total_high_wmark = 0;
+-		unsigned long free, anon;
+-		int z;
+-
+-		free = sum_zone_node_page_state(pgdat->node_id, NR_FREE_PAGES);
+-		file = node_page_state(pgdat, NR_ACTIVE_FILE) +
+-			   node_page_state(pgdat, NR_INACTIVE_FILE);
+-
+-		for (z = 0; z < MAX_NR_ZONES; z++) {
+-			struct zone *zone = &pgdat->node_zones[z];
+-			if (!managed_zone(zone))
+-				continue;
+-
+-			total_high_wmark += high_wmark_pages(zone);
+-		}
+-
+-		/*
+-		 * Consider anon: if that's low too, this isn't a
+-		 * runaway file reclaim problem, but rather just
+-		 * extreme pressure. Reclaim as per usual then.
+-		 */
+-		anon = node_page_state(pgdat, NR_INACTIVE_ANON);
+-
+-		sc->file_is_tiny =
+-			file + free <= total_high_wmark &&
+-			!(sc->may_deactivate & DEACTIVATE_ANON) &&
+-			anon >> sc->priority;
+-	}
++	prepare_scan_count(pgdat, sc);
+ 
+ 	shrink_node_memcgs(pgdat, sc);
+ 
diff --git a/target/linux/generic/backport-5.15/020-v6.1-04-Revert-include-linux-mm_inline.h-fold-__update_lru_s.patch b/target/linux/generic/backport-5.15/020-v6.1-04-Revert-include-linux-mm_inline.h-fold-__update_lru_s.patch
new file mode 100644
index 00000000000000..2f277a56e1c83f
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.1-04-Revert-include-linux-mm_inline.h-fold-__update_lru_s.patch
@@ -0,0 +1,82 @@
+From 03705be42114db7cc5bd6eb7bf7e8703c94d4880 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Sun, 18 Sep 2022 02:00:01 -0600
+Subject: [PATCH 04/29] Revert "include/linux/mm_inline.h: fold
+ __update_lru_size() into its sole caller"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This patch undoes the following refactor: commit 289ccba18af4
+("include/linux/mm_inline.h: fold __update_lru_size() into its sole
+caller")
+
+The upcoming changes to include/linux/mm_inline.h will reuse
+__update_lru_size().
+
+Link: https://lkml.kernel.org/r/20220918080010.2920238-5-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
+Acked-by: Brian Geffon <bgeffon@google.com>
+Acked-by: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
+Acked-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Acked-by: Steven Barrett <steven@liquorix.net>
+Acked-by: Suleiman Souhlal <suleiman@google.com>
+Tested-by: Daniel Byrne <djbyrne@mtu.edu>
+Tested-by: Donald Carr <d@chaos-reins.com>
+Tested-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+Tested-by: Konstantin Kharlamov <Hi-Angel@yandex.ru>
+Tested-by: Shuang Zhai <szhai2@cs.rochester.edu>
+Tested-by: Sofia Trinh <sofia.trinh@edi.works>
+Tested-by: Vaibhav Jain <vaibhav@linux.ibm.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Cc: Barry Song <baohua@kernel.org>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Hillf Danton <hdanton@sina.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Mike Rapoport <rppt@linux.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Qi Zheng <zhengqi.arch@bytedance.com>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ include/linux/mm_inline.h | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/include/linux/mm_inline.h
++++ b/include/linux/mm_inline.h
+@@ -24,7 +24,7 @@ static inline int page_is_file_lru(struc
+ 	return !PageSwapBacked(page);
+ }
+ 
+-static __always_inline void update_lru_size(struct lruvec *lruvec,
++static __always_inline void __update_lru_size(struct lruvec *lruvec,
+ 				enum lru_list lru, enum zone_type zid,
+ 				int nr_pages)
+ {
+@@ -33,6 +33,13 @@ static __always_inline void update_lru_s
+ 	__mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages);
+ 	__mod_zone_page_state(&pgdat->node_zones[zid],
+ 				NR_ZONE_LRU_BASE + lru, nr_pages);
++}
++
++static __always_inline void update_lru_size(struct lruvec *lruvec,
++				enum lru_list lru, enum zone_type zid,
++				long nr_pages)
++{
++	__update_lru_size(lruvec, lru, zid, nr_pages);
+ #ifdef CONFIG_MEMCG
+ 	mem_cgroup_update_lru_size(lruvec, lru, zid, nr_pages);
+ #endif
diff --git a/target/linux/generic/backport-5.15/020-v6.1-05-mm-multi-gen-LRU-groundwork.patch b/target/linux/generic/backport-5.15/020-v6.1-05-mm-multi-gen-LRU-groundwork.patch
new file mode 100644
index 00000000000000..237bd84875dbc2
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.1-05-mm-multi-gen-LRU-groundwork.patch
@@ -0,0 +1,807 @@
+From a9b328add8422921a0dbbef162730800e16e8cfd Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Sun, 18 Sep 2022 02:00:02 -0600
+Subject: [PATCH 05/29] mm: multi-gen LRU: groundwork
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Evictable pages are divided into multiple generations for each lruvec.
+The youngest generation number is stored in lrugen->max_seq for both
+anon and file types as they are aged on an equal footing. The oldest
+generation numbers are stored in lrugen->min_seq[] separately for anon
+and file types as clean file pages can be evicted regardless of swap
+constraints. These three variables are monotonically increasing.
+
+Generation numbers are truncated into order_base_2(MAX_NR_GENS+1) bits
+in order to fit into the gen counter in page->flags. Each truncated
+generation number is an index to lrugen->lists[]. The sliding window
+technique is used to track at least MIN_NR_GENS and at most
+MAX_NR_GENS generations. The gen counter stores a value within [1,
+MAX_NR_GENS] while a page is on one of lrugen->lists[]. Otherwise it
+stores 0.
+
+There are two conceptually independent procedures: "the aging", which
+produces young generations, and "the eviction", which consumes old
+generations.  They form a closed-loop system, i.e., "the page reclaim".
+Both procedures can be invoked from userspace for the purposes of working
+set estimation and proactive reclaim.  These techniques are commonly used
+to optimize job scheduling (bin packing) in data centers [1][2].
+
+To avoid confusion, the terms "hot" and "cold" will be applied to the
+multi-gen LRU, as a new convention; the terms "active" and "inactive" will
+be applied to the active/inactive LRU, as usual.
+
+The protection of hot pages and the selection of cold pages are based
+on page access channels and patterns. There are two access channels:
+one through page tables and the other through file descriptors. The
+protection of the former channel is by design stronger because:
+1. The uncertainty in determining the access patterns of the former
+   channel is higher due to the approximation of the accessed bit.
+2. The cost of evicting the former channel is higher due to the TLB
+   flushes required and the likelihood of encountering the dirty bit.
+3. The penalty of underprotecting the former channel is higher because
+   applications usually do not prepare themselves for major page
+   faults like they do for blocked I/O. E.g., GUI applications
+   commonly use dedicated I/O threads to avoid blocking rendering
+   threads.
+
+There are also two access patterns: one with temporal locality and the
+other without.  For the reasons listed above, the former channel is
+assumed to follow the former pattern unless VM_SEQ_READ or VM_RAND_READ is
+present; the latter channel is assumed to follow the latter pattern unless
+outlying refaults have been observed [3][4].
+
+The next patch will address the "outlying refaults".  Three macros, i.e.,
+LRU_REFS_WIDTH, LRU_REFS_PGOFF and LRU_REFS_MASK, used later are added in
+this patch to make the entire patchset less diffy.
+
+A page is added to the youngest generation on faulting.  The aging needs
+to check the accessed bit at least twice before handing this page over to
+the eviction.  The first check takes care of the accessed bit set on the
+initial fault; the second check makes sure this page has not been used
+since then.  This protocol, AKA second chance, requires a minimum of two
+generations, hence MIN_NR_GENS.
+
+[1] https://dl.acm.org/doi/10.1145/3297858.3304053
+[2] https://dl.acm.org/doi/10.1145/3503222.3507731
+[3] https://lwn.net/Articles/495543/
+[4] https://lwn.net/Articles/815342/
+
+Link: https://lkml.kernel.org/r/20220918080010.2920238-6-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Acked-by: Brian Geffon <bgeffon@google.com>
+Acked-by: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
+Acked-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Acked-by: Steven Barrett <steven@liquorix.net>
+Acked-by: Suleiman Souhlal <suleiman@google.com>
+Tested-by: Daniel Byrne <djbyrne@mtu.edu>
+Tested-by: Donald Carr <d@chaos-reins.com>
+Tested-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+Tested-by: Konstantin Kharlamov <Hi-Angel@yandex.ru>
+Tested-by: Shuang Zhai <szhai2@cs.rochester.edu>
+Tested-by: Sofia Trinh <sofia.trinh@edi.works>
+Tested-by: Vaibhav Jain <vaibhav@linux.ibm.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Cc: Barry Song <baohua@kernel.org>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Hillf Danton <hdanton@sina.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Miaohe Lin <linmiaohe@huawei.com>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Mike Rapoport <rppt@linux.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Qi Zheng <zhengqi.arch@bytedance.com>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ fs/fuse/dev.c                     |   3 +-
+ include/linux/mm.h                |   2 +
+ include/linux/mm_inline.h         | 177 +++++++++++++++++++++++++++++-
+ include/linux/mmzone.h            | 100 +++++++++++++++++
+ include/linux/page-flags-layout.h |  13 ++-
+ include/linux/page-flags.h        |   4 +-
+ include/linux/sched.h             |   4 +
+ kernel/bounds.c                   |   5 +
+ mm/Kconfig                        |   8 ++
+ mm/huge_memory.c                  |   3 +-
+ mm/memcontrol.c                   |   2 +
+ mm/memory.c                       |  25 +++++
+ mm/mm_init.c                      |   6 +-
+ mm/mmzone.c                       |   2 +
+ mm/swap.c                         |  10 +-
+ mm/vmscan.c                       |  75 +++++++++++++
+ 16 files changed, 425 insertions(+), 14 deletions(-)
+
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -785,7 +785,8 @@ static int fuse_check_page(struct page *
+ 	       1 << PG_active |
+ 	       1 << PG_workingset |
+ 	       1 << PG_reclaim |
+-	       1 << PG_waiters))) {
++	       1 << PG_waiters |
++	       LRU_GEN_MASK | LRU_REFS_MASK))) {
+ 		dump_page(page, "fuse: trying to steal weird page");
+ 		return 1;
+ 	}
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -1093,6 +1093,8 @@ vm_fault_t finish_mkwrite_fault(struct v
+ #define ZONES_PGOFF		(NODES_PGOFF - ZONES_WIDTH)
+ #define LAST_CPUPID_PGOFF	(ZONES_PGOFF - LAST_CPUPID_WIDTH)
+ #define KASAN_TAG_PGOFF		(LAST_CPUPID_PGOFF - KASAN_TAG_WIDTH)
++#define LRU_GEN_PGOFF		(KASAN_TAG_PGOFF - LRU_GEN_WIDTH)
++#define LRU_REFS_PGOFF		(LRU_GEN_PGOFF - LRU_REFS_WIDTH)
+ 
+ /*
+  * Define the bit shifts to access each section.  For non-existent
+--- a/include/linux/mm_inline.h
++++ b/include/linux/mm_inline.h
+@@ -26,10 +26,13 @@ static inline int page_is_file_lru(struc
+ 
+ static __always_inline void __update_lru_size(struct lruvec *lruvec,
+ 				enum lru_list lru, enum zone_type zid,
+-				int nr_pages)
++				long nr_pages)
+ {
+ 	struct pglist_data *pgdat = lruvec_pgdat(lruvec);
+ 
++	lockdep_assert_held(&lruvec->lru_lock);
++	WARN_ON_ONCE(nr_pages != (int)nr_pages);
++
+ 	__mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages);
+ 	__mod_zone_page_state(&pgdat->node_zones[zid],
+ 				NR_ZONE_LRU_BASE + lru, nr_pages);
+@@ -86,11 +89,177 @@ static __always_inline enum lru_list pag
+ 	return lru;
+ }
+ 
++#ifdef CONFIG_LRU_GEN
++
++static inline bool lru_gen_enabled(void)
++{
++	return true;
++}
++
++static inline bool lru_gen_in_fault(void)
++{
++	return current->in_lru_fault;
++}
++
++static inline int lru_gen_from_seq(unsigned long seq)
++{
++	return seq % MAX_NR_GENS;
++}
++
++static inline int page_lru_gen(struct page *page)
++{
++	unsigned long flags = READ_ONCE(page->flags);
++
++	return ((flags & LRU_GEN_MASK) >> LRU_GEN_PGOFF) - 1;
++}
++
++static inline bool lru_gen_is_active(struct lruvec *lruvec, int gen)
++{
++	unsigned long max_seq = lruvec->lrugen.max_seq;
++
++	VM_WARN_ON_ONCE(gen >= MAX_NR_GENS);
++
++	/* see the comment on MIN_NR_GENS */
++	return gen == lru_gen_from_seq(max_seq) || gen == lru_gen_from_seq(max_seq - 1);
++}
++
++static inline void lru_gen_update_size(struct lruvec *lruvec, struct page *page,
++				       int old_gen, int new_gen)
++{
++	int type = page_is_file_lru(page);
++	int zone = page_zonenum(page);
++	int delta = thp_nr_pages(page);
++	enum lru_list lru = type * LRU_INACTIVE_FILE;
++	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++
++	VM_WARN_ON_ONCE(old_gen != -1 && old_gen >= MAX_NR_GENS);
++	VM_WARN_ON_ONCE(new_gen != -1 && new_gen >= MAX_NR_GENS);
++	VM_WARN_ON_ONCE(old_gen == -1 && new_gen == -1);
++
++	if (old_gen >= 0)
++		WRITE_ONCE(lrugen->nr_pages[old_gen][type][zone],
++			   lrugen->nr_pages[old_gen][type][zone] - delta);
++	if (new_gen >= 0)
++		WRITE_ONCE(lrugen->nr_pages[new_gen][type][zone],
++			   lrugen->nr_pages[new_gen][type][zone] + delta);
++
++	/* addition */
++	if (old_gen < 0) {
++		if (lru_gen_is_active(lruvec, new_gen))
++			lru += LRU_ACTIVE;
++		__update_lru_size(lruvec, lru, zone, delta);
++		return;
++	}
++
++	/* deletion */
++	if (new_gen < 0) {
++		if (lru_gen_is_active(lruvec, old_gen))
++			lru += LRU_ACTIVE;
++		__update_lru_size(lruvec, lru, zone, -delta);
++		return;
++	}
++}
++
++static inline bool lru_gen_add_page(struct lruvec *lruvec, struct page *page, bool reclaiming)
++{
++	unsigned long seq;
++	unsigned long flags;
++	int gen = page_lru_gen(page);
++	int type = page_is_file_lru(page);
++	int zone = page_zonenum(page);
++	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++
++	VM_WARN_ON_ONCE_PAGE(gen != -1, page);
++
++	if (PageUnevictable(page))
++		return false;
++	/*
++	 * There are three common cases for this page:
++	 * 1. If it's hot, e.g., freshly faulted in or previously hot and
++	 *    migrated, add it to the youngest generation.
++	 * 2. If it's cold but can't be evicted immediately, i.e., an anon page
++	 *    not in swapcache or a dirty page pending writeback, add it to the
++	 *    second oldest generation.
++	 * 3. Everything else (clean, cold) is added to the oldest generation.
++	 */
++	if (PageActive(page))
++		seq = lrugen->max_seq;
++	else if ((type == LRU_GEN_ANON && !PageSwapCache(page)) ||
++		 (PageReclaim(page) &&
++		  (PageDirty(page) || PageWriteback(page))))
++		seq = lrugen->min_seq[type] + 1;
++	else
++		seq = lrugen->min_seq[type];
++
++	gen = lru_gen_from_seq(seq);
++	flags = (gen + 1UL) << LRU_GEN_PGOFF;
++	/* see the comment on MIN_NR_GENS about PG_active */
++	set_mask_bits(&page->flags, LRU_GEN_MASK | BIT(PG_active), flags);
++
++	lru_gen_update_size(lruvec, page, -1, gen);
++	/* for rotate_reclaimable_page() */
++	if (reclaiming)
++		list_add_tail(&page->lru, &lrugen->lists[gen][type][zone]);
++	else
++		list_add(&page->lru, &lrugen->lists[gen][type][zone]);
++
++	return true;
++}
++
++static inline bool lru_gen_del_page(struct lruvec *lruvec, struct page *page, bool reclaiming)
++{
++	unsigned long flags;
++	int gen = page_lru_gen(page);
++
++	if (gen < 0)
++		return false;
++
++	VM_WARN_ON_ONCE_PAGE(PageActive(page), page);
++	VM_WARN_ON_ONCE_PAGE(PageUnevictable(page), page);
++
++	/* for migrate_page_states() */
++	flags = !reclaiming && lru_gen_is_active(lruvec, gen) ? BIT(PG_active) : 0;
++	flags = set_mask_bits(&page->flags, LRU_GEN_MASK, flags);
++	gen = ((flags & LRU_GEN_MASK) >> LRU_GEN_PGOFF) - 1;
++
++	lru_gen_update_size(lruvec, page, gen, -1);
++	list_del(&page->lru);
++
++	return true;
++}
++
++#else /* !CONFIG_LRU_GEN */
++
++static inline bool lru_gen_enabled(void)
++{
++	return false;
++}
++
++static inline bool lru_gen_in_fault(void)
++{
++	return false;
++}
++
++static inline bool lru_gen_add_page(struct lruvec *lruvec, struct page *page, bool reclaiming)
++{
++	return false;
++}
++
++static inline bool lru_gen_del_page(struct lruvec *lruvec, struct page *page, bool reclaiming)
++{
++	return false;
++}
++
++#endif /* CONFIG_LRU_GEN */
++
+ static __always_inline void add_page_to_lru_list(struct page *page,
+ 				struct lruvec *lruvec)
+ {
+ 	enum lru_list lru = page_lru(page);
+ 
++	if (lru_gen_add_page(lruvec, page, false))
++		return;
++
+ 	update_lru_size(lruvec, lru, page_zonenum(page), thp_nr_pages(page));
+ 	list_add(&page->lru, &lruvec->lists[lru]);
+ }
+@@ -100,6 +269,9 @@ static __always_inline void add_page_to_
+ {
+ 	enum lru_list lru = page_lru(page);
+ 
++	if (lru_gen_add_page(lruvec, page, true))
++		return;
++
+ 	update_lru_size(lruvec, lru, page_zonenum(page), thp_nr_pages(page));
+ 	list_add_tail(&page->lru, &lruvec->lists[lru]);
+ }
+@@ -107,6 +279,9 @@ static __always_inline void add_page_to_
+ static __always_inline void del_page_from_lru_list(struct page *page,
+ 				struct lruvec *lruvec)
+ {
++	if (lru_gen_del_page(lruvec, page, false))
++		return;
++
+ 	list_del(&page->lru);
+ 	update_lru_size(lruvec, page_lru(page), page_zonenum(page),
+ 			-thp_nr_pages(page));
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -294,6 +294,102 @@ enum lruvec_flags {
+ 					 */
+ };
+ 
++#endif /* !__GENERATING_BOUNDS_H */
++
++/*
++ * Evictable pages are divided into multiple generations. The youngest and the
++ * oldest generation numbers, max_seq and min_seq, are monotonically increasing.
++ * They form a sliding window of a variable size [MIN_NR_GENS, MAX_NR_GENS]. An
++ * offset within MAX_NR_GENS, i.e., gen, indexes the LRU list of the
++ * corresponding generation. The gen counter in page->flags stores gen+1 while
++ * a page is on one of lrugen->lists[]. Otherwise it stores 0.
++ *
++ * A page is added to the youngest generation on faulting. The aging needs to
++ * check the accessed bit at least twice before handing this page over to the
++ * eviction. The first check takes care of the accessed bit set on the initial
++ * fault; the second check makes sure this page hasn't been used since then.
++ * This process, AKA second chance, requires a minimum of two generations,
++ * hence MIN_NR_GENS. And to maintain ABI compatibility with the active/inactive
++ * LRU, e.g., /proc/vmstat, these two generations are considered active; the
++ * rest of generations, if they exist, are considered inactive. See
++ * lru_gen_is_active().
++ *
++ * PG_active is always cleared while a page is on one of lrugen->lists[] so that
++ * the aging needs not to worry about it. And it's set again when a page
++ * considered active is isolated for non-reclaiming purposes, e.g., migration.
++ * See lru_gen_add_page() and lru_gen_del_page().
++ *
++ * MAX_NR_GENS is set to 4 so that the multi-gen LRU can support twice the
++ * number of categories of the active/inactive LRU when keeping track of
++ * accesses through page tables. This requires order_base_2(MAX_NR_GENS+1) bits
++ * in page->flags.
++ */
++#define MIN_NR_GENS		2U
++#define MAX_NR_GENS		4U
++
++#ifndef __GENERATING_BOUNDS_H
++
++struct lruvec;
++
++#define LRU_GEN_MASK		((BIT(LRU_GEN_WIDTH) - 1) << LRU_GEN_PGOFF)
++#define LRU_REFS_MASK		((BIT(LRU_REFS_WIDTH) - 1) << LRU_REFS_PGOFF)
++
++#ifdef CONFIG_LRU_GEN
++
++enum {
++	LRU_GEN_ANON,
++	LRU_GEN_FILE,
++};
++
++/*
++ * The youngest generation number is stored in max_seq for both anon and file
++ * types as they are aged on an equal footing. The oldest generation numbers are
++ * stored in min_seq[] separately for anon and file types as clean file pages
++ * can be evicted regardless of swap constraints.
++ *
++ * Normally anon and file min_seq are in sync. But if swapping is constrained,
++ * e.g., out of swap space, file min_seq is allowed to advance and leave anon
++ * min_seq behind.
++ *
++ * The number of pages in each generation is eventually consistent and therefore
++ * can be transiently negative.
++ */
++struct lru_gen_struct {
++	/* the aging increments the youngest generation number */
++	unsigned long max_seq;
++	/* the eviction increments the oldest generation numbers */
++	unsigned long min_seq[ANON_AND_FILE];
++	/* the multi-gen LRU lists, lazily sorted on eviction */
++	struct list_head lists[MAX_NR_GENS][ANON_AND_FILE][MAX_NR_ZONES];
++	/* the multi-gen LRU sizes, eventually consistent */
++	long nr_pages[MAX_NR_GENS][ANON_AND_FILE][MAX_NR_ZONES];
++};
++
++void lru_gen_init_lruvec(struct lruvec *lruvec);
++
++#ifdef CONFIG_MEMCG
++void lru_gen_init_memcg(struct mem_cgroup *memcg);
++void lru_gen_exit_memcg(struct mem_cgroup *memcg);
++#endif
++
++#else /* !CONFIG_LRU_GEN */
++
++static inline void lru_gen_init_lruvec(struct lruvec *lruvec)
++{
++}
++
++#ifdef CONFIG_MEMCG
++static inline void lru_gen_init_memcg(struct mem_cgroup *memcg)
++{
++}
++
++static inline void lru_gen_exit_memcg(struct mem_cgroup *memcg)
++{
++}
++#endif
++
++#endif /* CONFIG_LRU_GEN */
++
+ struct lruvec {
+ 	struct list_head		lists[NR_LRU_LISTS];
+ 	/* per lruvec lru_lock for memcg */
+@@ -311,6 +407,10 @@ struct lruvec {
+ 	unsigned long			refaults[ANON_AND_FILE];
+ 	/* Various lruvec state flags (enum lruvec_flags) */
+ 	unsigned long			flags;
++#ifdef CONFIG_LRU_GEN
++	/* evictable pages divided into generations */
++	struct lru_gen_struct		lrugen;
++#endif
+ #ifdef CONFIG_MEMCG
+ 	struct pglist_data *pgdat;
+ #endif
+--- a/include/linux/page-flags-layout.h
++++ b/include/linux/page-flags-layout.h
+@@ -55,7 +55,8 @@
+ #define SECTIONS_WIDTH		0
+ #endif
+ 
+-#if ZONES_WIDTH + SECTIONS_WIDTH + NODES_SHIFT <= BITS_PER_LONG - NR_PAGEFLAGS
++#if ZONES_WIDTH + LRU_GEN_WIDTH + SECTIONS_WIDTH + NODES_SHIFT \
++	<= BITS_PER_LONG - NR_PAGEFLAGS
+ #define NODES_WIDTH		NODES_SHIFT
+ #elif defined(CONFIG_SPARSEMEM_VMEMMAP)
+ #error "Vmemmap: No space for nodes field in page flags"
+@@ -89,8 +90,8 @@
+ #define LAST_CPUPID_SHIFT 0
+ #endif
+ 
+-#if ZONES_WIDTH + SECTIONS_WIDTH + NODES_WIDTH + KASAN_TAG_WIDTH + LAST_CPUPID_SHIFT \
+-	<= BITS_PER_LONG - NR_PAGEFLAGS
++#if ZONES_WIDTH + LRU_GEN_WIDTH + SECTIONS_WIDTH + NODES_WIDTH + \
++	KASAN_TAG_WIDTH + LAST_CPUPID_SHIFT <= BITS_PER_LONG - NR_PAGEFLAGS
+ #define LAST_CPUPID_WIDTH LAST_CPUPID_SHIFT
+ #else
+ #define LAST_CPUPID_WIDTH 0
+@@ -100,10 +101,12 @@
+ #define LAST_CPUPID_NOT_IN_PAGE_FLAGS
+ #endif
+ 
+-#if ZONES_WIDTH + SECTIONS_WIDTH + NODES_WIDTH + KASAN_TAG_WIDTH + LAST_CPUPID_WIDTH \
+-	> BITS_PER_LONG - NR_PAGEFLAGS
++#if ZONES_WIDTH + LRU_GEN_WIDTH + SECTIONS_WIDTH + NODES_WIDTH + \
++	KASAN_TAG_WIDTH + LAST_CPUPID_WIDTH > BITS_PER_LONG - NR_PAGEFLAGS
+ #error "Not enough bits in page flags"
+ #endif
+ 
++#define LRU_REFS_WIDTH	0
++
+ #endif
+ #endif /* _LINUX_PAGE_FLAGS_LAYOUT */
+--- a/include/linux/page-flags.h
++++ b/include/linux/page-flags.h
+@@ -845,7 +845,7 @@ static inline void ClearPageSlabPfmemall
+ 	 1UL << PG_private	| 1UL << PG_private_2	|	\
+ 	 1UL << PG_writeback	| 1UL << PG_reserved	|	\
+ 	 1UL << PG_slab		| 1UL << PG_active 	|	\
+-	 1UL << PG_unevictable	| __PG_MLOCKED)
++	 1UL << PG_unevictable	| __PG_MLOCKED | LRU_GEN_MASK)
+ 
+ /*
+  * Flags checked when a page is prepped for return by the page allocator.
+@@ -856,7 +856,7 @@ static inline void ClearPageSlabPfmemall
+  * alloc-free cycle to prevent from reusing the page.
+  */
+ #define PAGE_FLAGS_CHECK_AT_PREP	\
+-	(PAGEFLAGS_MASK & ~__PG_HWPOISON)
++	((PAGEFLAGS_MASK & ~__PG_HWPOISON) | LRU_GEN_MASK | LRU_REFS_MASK)
+ 
+ #define PAGE_FLAGS_PRIVATE				\
+ 	(1UL << PG_private | 1UL << PG_private_2)
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -911,6 +911,10 @@ struct task_struct {
+ #ifdef CONFIG_MEMCG
+ 	unsigned			in_user_fault:1;
+ #endif
++#ifdef CONFIG_LRU_GEN
++	/* whether the LRU algorithm may apply to this access */
++	unsigned			in_lru_fault:1;
++#endif
+ #ifdef CONFIG_COMPAT_BRK
+ 	unsigned			brk_randomized:1;
+ #endif
+--- a/kernel/bounds.c
++++ b/kernel/bounds.c
+@@ -22,6 +22,11 @@ int main(void)
+ 	DEFINE(NR_CPUS_BITS, ilog2(CONFIG_NR_CPUS));
+ #endif
+ 	DEFINE(SPINLOCK_SIZE, sizeof(spinlock_t));
++#ifdef CONFIG_LRU_GEN
++	DEFINE(LRU_GEN_WIDTH, order_base_2(MAX_NR_GENS + 1));
++#else
++	DEFINE(LRU_GEN_WIDTH, 0);
++#endif
+ 	/* End of constants */
+ 
+ 	return 0;
+--- a/mm/Kconfig
++++ b/mm/Kconfig
+@@ -897,6 +897,14 @@ config IO_MAPPING
+ config SECRETMEM
+ 	def_bool ARCH_HAS_SET_DIRECT_MAP && !EMBEDDED
+ 
++config LRU_GEN
++	bool "Multi-Gen LRU"
++	depends on MMU
++	# make sure page->flags has enough spare bits
++	depends on 64BIT || !SPARSEMEM || SPARSEMEM_VMEMMAP
++	help
++	  A high performance LRU implementation to overcommit memory.
++
+ source "mm/damon/Kconfig"
+ 
+ endmenu
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2366,7 +2366,8 @@ static void __split_huge_page_tail(struc
+ #ifdef CONFIG_64BIT
+ 			 (1L << PG_arch_2) |
+ #endif
+-			 (1L << PG_dirty)));
++			 (1L << PG_dirty) |
++			 LRU_GEN_MASK | LRU_REFS_MASK));
+ 
+ 	/* ->mapping in first tail page is compound_mapcount */
+ 	VM_BUG_ON_PAGE(tail > 2 && page_tail->mapping != TAIL_MAPPING,
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -5178,6 +5178,7 @@ static void __mem_cgroup_free(struct mem
+ 
+ static void mem_cgroup_free(struct mem_cgroup *memcg)
+ {
++	lru_gen_exit_memcg(memcg);
+ 	memcg_wb_domain_exit(memcg);
+ 	__mem_cgroup_free(memcg);
+ }
+@@ -5241,6 +5242,7 @@ static struct mem_cgroup *mem_cgroup_all
+ 	memcg->deferred_split_queue.split_queue_len = 0;
+ #endif
+ 	idr_replace(&mem_cgroup_idr, memcg, memcg->id.id);
++	lru_gen_init_memcg(memcg);
+ 	return memcg;
+ fail:
+ 	mem_cgroup_id_remove(memcg);
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -4792,6 +4792,27 @@ static inline void mm_account_fault(stru
+ 		perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs, address);
+ }
+ 
++#ifdef CONFIG_LRU_GEN
++static void lru_gen_enter_fault(struct vm_area_struct *vma)
++{
++	/* the LRU algorithm doesn't apply to sequential or random reads */
++	current->in_lru_fault = !(vma->vm_flags & (VM_SEQ_READ | VM_RAND_READ));
++}
++
++static void lru_gen_exit_fault(void)
++{
++	current->in_lru_fault = false;
++}
++#else
++static void lru_gen_enter_fault(struct vm_area_struct *vma)
++{
++}
++
++static void lru_gen_exit_fault(void)
++{
++}
++#endif /* CONFIG_LRU_GEN */
++
+ /*
+  * By the time we get here, we already hold the mm semaphore
+  *
+@@ -4823,11 +4844,15 @@ vm_fault_t handle_mm_fault(struct vm_are
+ 	if (flags & FAULT_FLAG_USER)
+ 		mem_cgroup_enter_user_fault();
+ 
++	lru_gen_enter_fault(vma);
++
+ 	if (unlikely(is_vm_hugetlb_page(vma)))
+ 		ret = hugetlb_fault(vma->vm_mm, vma, address, flags);
+ 	else
+ 		ret = __handle_mm_fault(vma, address, flags);
+ 
++	lru_gen_exit_fault();
++
+ 	if (flags & FAULT_FLAG_USER) {
+ 		mem_cgroup_exit_user_fault();
+ 		/*
+--- a/mm/mm_init.c
++++ b/mm/mm_init.c
+@@ -65,14 +65,16 @@ void __init mminit_verify_pageflags_layo
+ 
+ 	shift = 8 * sizeof(unsigned long);
+ 	width = shift - SECTIONS_WIDTH - NODES_WIDTH - ZONES_WIDTH
+-		- LAST_CPUPID_SHIFT - KASAN_TAG_WIDTH;
++		- LAST_CPUPID_SHIFT - KASAN_TAG_WIDTH - LRU_GEN_WIDTH - LRU_REFS_WIDTH;
+ 	mminit_dprintk(MMINIT_TRACE, "pageflags_layout_widths",
+-		"Section %d Node %d Zone %d Lastcpupid %d Kasantag %d Flags %d\n",
++		"Section %d Node %d Zone %d Lastcpupid %d Kasantag %d Gen %d Tier %d Flags %d\n",
+ 		SECTIONS_WIDTH,
+ 		NODES_WIDTH,
+ 		ZONES_WIDTH,
+ 		LAST_CPUPID_WIDTH,
+ 		KASAN_TAG_WIDTH,
++		LRU_GEN_WIDTH,
++		LRU_REFS_WIDTH,
+ 		NR_PAGEFLAGS);
+ 	mminit_dprintk(MMINIT_TRACE, "pageflags_layout_shifts",
+ 		"Section %d Node %d Zone %d Lastcpupid %d Kasantag %d\n",
+--- a/mm/mmzone.c
++++ b/mm/mmzone.c
+@@ -81,6 +81,8 @@ void lruvec_init(struct lruvec *lruvec)
+ 
+ 	for_each_lru(lru)
+ 		INIT_LIST_HEAD(&lruvec->lists[lru]);
++
++	lru_gen_init_lruvec(lruvec);
+ }
+ 
+ #if defined(CONFIG_NUMA_BALANCING) && !defined(LAST_CPUPID_NOT_IN_PAGE_FLAGS)
+--- a/mm/swap.c
++++ b/mm/swap.c
+@@ -446,6 +446,11 @@ void lru_cache_add(struct page *page)
+ 	VM_BUG_ON_PAGE(PageActive(page) && PageUnevictable(page), page);
+ 	VM_BUG_ON_PAGE(PageLRU(page), page);
+ 
++	/* see the comment in lru_gen_add_page() */
++	if (lru_gen_enabled() && !PageUnevictable(page) &&
++	    lru_gen_in_fault() && !(current->flags & PF_MEMALLOC))
++		SetPageActive(page);
++
+ 	get_page(page);
+ 	local_lock(&lru_pvecs.lock);
+ 	pvec = this_cpu_ptr(&lru_pvecs.lru_add);
+@@ -547,7 +552,7 @@ static void lru_deactivate_file_fn(struc
+ 
+ static void lru_deactivate_fn(struct page *page, struct lruvec *lruvec)
+ {
+-	if (PageActive(page) && !PageUnevictable(page)) {
++	if (!PageUnevictable(page) && (PageActive(page) || lru_gen_enabled())) {
+ 		int nr_pages = thp_nr_pages(page);
+ 
+ 		del_page_from_lru_list(page, lruvec);
+@@ -661,7 +666,8 @@ void deactivate_file_page(struct page *p
+  */
+ void deactivate_page(struct page *page)
+ {
+-	if (PageLRU(page) && PageActive(page) && !PageUnevictable(page)) {
++	if (PageLRU(page) && !PageUnevictable(page) &&
++	    (PageActive(page) || lru_gen_enabled())) {
+ 		struct pagevec *pvec;
+ 
+ 		local_lock(&lru_pvecs.lock);
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2821,6 +2821,81 @@ static bool can_age_anon_pages(struct pg
+ 	return can_demote(pgdat->node_id, sc);
+ }
+ 
++#ifdef CONFIG_LRU_GEN
++
++/******************************************************************************
++ *                          shorthand helpers
++ ******************************************************************************/
++
++#define for_each_gen_type_zone(gen, type, zone)				\
++	for ((gen) = 0; (gen) < MAX_NR_GENS; (gen)++)			\
++		for ((type) = 0; (type) < ANON_AND_FILE; (type)++)	\
++			for ((zone) = 0; (zone) < MAX_NR_ZONES; (zone)++)
++
++static struct lruvec __maybe_unused *get_lruvec(struct mem_cgroup *memcg, int nid)
++{
++	struct pglist_data *pgdat = NODE_DATA(nid);
++
++#ifdef CONFIG_MEMCG
++	if (memcg) {
++		struct lruvec *lruvec = &memcg->nodeinfo[nid]->lruvec;
++
++		/* for hotadd_new_pgdat() */
++		if (!lruvec->pgdat)
++			lruvec->pgdat = pgdat;
++
++		return lruvec;
++	}
++#endif
++	VM_WARN_ON_ONCE(!mem_cgroup_disabled());
++
++	return pgdat ? &pgdat->__lruvec : NULL;
++}
++
++/******************************************************************************
++ *                          initialization
++ ******************************************************************************/
++
++void lru_gen_init_lruvec(struct lruvec *lruvec)
++{
++	int gen, type, zone;
++	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++
++	lrugen->max_seq = MIN_NR_GENS + 1;
++
++	for_each_gen_type_zone(gen, type, zone)
++		INIT_LIST_HEAD(&lrugen->lists[gen][type][zone]);
++}
++
++#ifdef CONFIG_MEMCG
++void lru_gen_init_memcg(struct mem_cgroup *memcg)
++{
++}
++
++void lru_gen_exit_memcg(struct mem_cgroup *memcg)
++{
++	int nid;
++
++	for_each_node(nid) {
++		struct lruvec *lruvec = get_lruvec(memcg, nid);
++
++		VM_WARN_ON_ONCE(memchr_inv(lruvec->lrugen.nr_pages, 0,
++					   sizeof(lruvec->lrugen.nr_pages)));
++	}
++}
++#endif
++
++static int __init init_lru_gen(void)
++{
++	BUILD_BUG_ON(MIN_NR_GENS + 1 >= MAX_NR_GENS);
++	BUILD_BUG_ON(BIT(LRU_GEN_WIDTH) <= MAX_NR_GENS);
++
++	return 0;
++};
++late_initcall(init_lru_gen);
++
++#endif /* CONFIG_LRU_GEN */
++
+ static void shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
+ {
+ 	unsigned long nr[NR_LRU_LISTS];
diff --git a/target/linux/generic/backport-5.15/020-v6.1-06-mm-multi-gen-LRU-minimal-implementation.patch b/target/linux/generic/backport-5.15/020-v6.1-06-mm-multi-gen-LRU-minimal-implementation.patch
new file mode 100644
index 00000000000000..f8a7d9bd7f6747
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.1-06-mm-multi-gen-LRU-minimal-implementation.patch
@@ -0,0 +1,1447 @@
+From b564b9471cd60ef1ee3961a224898ce4a9620d84 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Sun, 18 Sep 2022 02:00:03 -0600
+Subject: [PATCH 06/29] mm: multi-gen LRU: minimal implementation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+To avoid confusion, the terms "promotion" and "demotion" will be applied
+to the multi-gen LRU, as a new convention; the terms "activation" and
+"deactivation" will be applied to the active/inactive LRU, as usual.
+
+The aging produces young generations.  Given an lruvec, it increments
+max_seq when max_seq-min_seq+1 approaches MIN_NR_GENS.  The aging promotes
+hot pages to the youngest generation when it finds them accessed through
+page tables; the demotion of cold pages happens consequently when it
+increments max_seq.  Promotion in the aging path does not involve any LRU
+list operations, only the updates of the gen counter and
+lrugen->nr_pages[]; demotion, unless as the result of the increment of
+max_seq, requires LRU list operations, e.g., lru_deactivate_fn().  The
+aging has the complexity O(nr_hot_pages), since it is only interested in
+hot pages.
+
+The eviction consumes old generations.  Given an lruvec, it increments
+min_seq when lrugen->lists[] indexed by min_seq%MAX_NR_GENS becomes empty.
+A feedback loop modeled after the PID controller monitors refaults over
+anon and file types and decides which type to evict when both types are
+available from the same generation.
+
+The protection of pages accessed multiple times through file descriptors
+takes place in the eviction path.  Each generation is divided into
+multiple tiers.  A page accessed N times through file descriptors is in
+tier order_base_2(N).  Tiers do not have dedicated lrugen->lists[], only
+bits in page->flags.  The aforementioned feedback loop also monitors
+refaults over all tiers and decides when to protect pages in which tiers
+(N>1), using the first tier (N=0,1) as a baseline.  The first tier
+contains single-use unmapped clean pages, which are most likely the best
+choices.  In contrast to promotion in the aging path, the protection of a
+page in the eviction path is achieved by moving this page to the next
+generation, i.e., min_seq+1, if the feedback loop decides so.  This
+approach has the following advantages:
+
+1. It removes the cost of activation in the buffered access path by
+   inferring whether pages accessed multiple times through file
+   descriptors are statistically hot and thus worth protecting in the
+   eviction path.
+2. It takes pages accessed through page tables into account and avoids
+   overprotecting pages accessed multiple times through file
+   descriptors. (Pages accessed through page tables are in the first
+   tier, since N=0.)
+3. More tiers provide better protection for pages accessed more than
+   twice through file descriptors, when under heavy buffered I/O
+   workloads.
+
+Server benchmark results:
+  Single workload:
+    fio (buffered I/O): +[30, 32]%
+                IOPS         BW
+      5.19-rc1: 2673k        10.2GiB/s
+      patch1-6: 3491k        13.3GiB/s
+
+  Single workload:
+    memcached (anon): -[4, 6]%
+                Ops/sec      KB/sec
+      5.19-rc1: 1161501.04   45177.25
+      patch1-6: 1106168.46   43025.04
+
+  Configurations:
+    CPU: two Xeon 6154
+    Mem: total 256G
+
+    Node 1 was only used as a ram disk to reduce the variance in the
+    results.
+
+    patch drivers/block/brd.c <<EOF
+    99,100c99,100
+    < 	gfp_flags = GFP_NOIO | __GFP_ZERO | __GFP_HIGHMEM;
+    < 	page = alloc_page(gfp_flags);
+    ---
+    > 	gfp_flags = GFP_NOIO | __GFP_ZERO | __GFP_HIGHMEM | __GFP_THISNODE;
+    > 	page = alloc_pages_node(1, gfp_flags, 0);
+    EOF
+
+    cat >>/etc/systemd/system.conf <<EOF
+    CPUAffinity=numa
+    NUMAPolicy=bind
+    NUMAMask=0
+    EOF
+
+    cat >>/etc/memcached.conf <<EOF
+    -m 184320
+    -s /var/run/memcached/memcached.sock
+    -a 0766
+    -t 36
+    -B binary
+    EOF
+
+    cat fio.sh
+    modprobe brd rd_nr=1 rd_size=113246208
+    swapoff -a
+    mkfs.ext4 /dev/ram0
+    mount -t ext4 /dev/ram0 /mnt
+
+    mkdir /sys/fs/cgroup/user.slice/test
+    echo 38654705664 >/sys/fs/cgroup/user.slice/test/memory.max
+    echo $$ >/sys/fs/cgroup/user.slice/test/cgroup.procs
+    fio -name=mglru --numjobs=72 --directory=/mnt --size=1408m \
+      --buffered=1 --ioengine=io_uring --iodepth=128 \
+      --iodepth_batch_submit=32 --iodepth_batch_complete=32 \
+      --rw=randread --random_distribution=random --norandommap \
+      --time_based --ramp_time=10m --runtime=5m --group_reporting
+
+    cat memcached.sh
+    modprobe brd rd_nr=1 rd_size=113246208
+    swapoff -a
+    mkswap /dev/ram0
+    swapon /dev/ram0
+
+    memtier_benchmark -S /var/run/memcached/memcached.sock \
+      -P memcache_binary -n allkeys --key-minimum=1 \
+      --key-maximum=65000000 --key-pattern=P:P -c 1 -t 36 \
+      --ratio 1:0 --pipeline 8 -d 2000
+
+    memtier_benchmark -S /var/run/memcached/memcached.sock \
+      -P memcache_binary -n allkeys --key-minimum=1 \
+      --key-maximum=65000000 --key-pattern=R:R -c 1 -t 36 \
+      --ratio 0:1 --pipeline 8 --randomize --distinct-client-seed
+
+Client benchmark results:
+  kswapd profiles:
+    5.19-rc1
+      40.33%  page_vma_mapped_walk (overhead)
+      21.80%  lzo1x_1_do_compress (real work)
+       7.53%  do_raw_spin_lock
+       3.95%  _raw_spin_unlock_irq
+       2.52%  vma_interval_tree_iter_next
+       2.37%  page_referenced_one
+       2.28%  vma_interval_tree_subtree_search
+       1.97%  anon_vma_interval_tree_iter_first
+       1.60%  ptep_clear_flush
+       1.06%  __zram_bvec_write
+
+    patch1-6
+      39.03%  lzo1x_1_do_compress (real work)
+      18.47%  page_vma_mapped_walk (overhead)
+       6.74%  _raw_spin_unlock_irq
+       3.97%  do_raw_spin_lock
+       2.49%  ptep_clear_flush
+       2.48%  anon_vma_interval_tree_iter_first
+       1.92%  page_referenced_one
+       1.88%  __zram_bvec_write
+       1.48%  memmove
+       1.31%  vma_interval_tree_iter_next
+
+  Configurations:
+    CPU: single Snapdragon 7c
+    Mem: total 4G
+
+    ChromeOS MemoryPressure [1]
+
+[1] https://chromium.googlesource.com/chromiumos/platform/tast-tests/
+
+Link: https://lkml.kernel.org/r/20220918080010.2920238-7-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Acked-by: Brian Geffon <bgeffon@google.com>
+Acked-by: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
+Acked-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Acked-by: Steven Barrett <steven@liquorix.net>
+Acked-by: Suleiman Souhlal <suleiman@google.com>
+Tested-by: Daniel Byrne <djbyrne@mtu.edu>
+Tested-by: Donald Carr <d@chaos-reins.com>
+Tested-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+Tested-by: Konstantin Kharlamov <Hi-Angel@yandex.ru>
+Tested-by: Shuang Zhai <szhai2@cs.rochester.edu>
+Tested-by: Sofia Trinh <sofia.trinh@edi.works>
+Tested-by: Vaibhav Jain <vaibhav@linux.ibm.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Cc: Barry Song <baohua@kernel.org>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Hillf Danton <hdanton@sina.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Miaohe Lin <linmiaohe@huawei.com>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Mike Rapoport <rppt@linux.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Qi Zheng <zhengqi.arch@bytedance.com>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ include/linux/mm_inline.h         |  36 ++
+ include/linux/mmzone.h            |  41 ++
+ include/linux/page-flags-layout.h |   5 +-
+ kernel/bounds.c                   |   2 +
+ mm/Kconfig                        |  11 +
+ mm/swap.c                         |  39 ++
+ mm/vmscan.c                       | 792 +++++++++++++++++++++++++++++-
+ mm/workingset.c                   | 110 ++++-
+ 8 files changed, 1025 insertions(+), 11 deletions(-)
+
+--- a/include/linux/mm_inline.h
++++ b/include/linux/mm_inline.h
+@@ -106,6 +106,33 @@ static inline int lru_gen_from_seq(unsig
+ 	return seq % MAX_NR_GENS;
+ }
+ 
++static inline int lru_hist_from_seq(unsigned long seq)
++{
++	return seq % NR_HIST_GENS;
++}
++
++static inline int lru_tier_from_refs(int refs)
++{
++	VM_WARN_ON_ONCE(refs > BIT(LRU_REFS_WIDTH));
++
++	/* see the comment in page_lru_refs() */
++	return order_base_2(refs + 1);
++}
++
++static inline int page_lru_refs(struct page *page)
++{
++	unsigned long flags = READ_ONCE(page->flags);
++	bool workingset = flags & BIT(PG_workingset);
++
++	/*
++	 * Return the number of accesses beyond PG_referenced, i.e., N-1 if the
++	 * total number of accesses is N>1, since N=0,1 both map to the first
++	 * tier. lru_tier_from_refs() will account for this off-by-one. Also see
++	 * the comment on MAX_NR_TIERS.
++	 */
++	return ((flags & LRU_REFS_MASK) >> LRU_REFS_PGOFF) + workingset;
++}
++
+ static inline int page_lru_gen(struct page *page)
+ {
+ 	unsigned long flags = READ_ONCE(page->flags);
+@@ -158,6 +185,15 @@ static inline void lru_gen_update_size(s
+ 		__update_lru_size(lruvec, lru, zone, -delta);
+ 		return;
+ 	}
++
++	/* promotion */
++	if (!lru_gen_is_active(lruvec, old_gen) && lru_gen_is_active(lruvec, new_gen)) {
++		__update_lru_size(lruvec, lru, zone, -delta);
++		__update_lru_size(lruvec, lru + LRU_ACTIVE, zone, delta);
++	}
++
++	/* demotion requires isolation, e.g., lru_deactivate_fn() */
++	VM_WARN_ON_ONCE(lru_gen_is_active(lruvec, old_gen) && !lru_gen_is_active(lruvec, new_gen));
+ }
+ 
+ static inline bool lru_gen_add_page(struct lruvec *lruvec, struct page *page, bool reclaiming)
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -327,6 +327,28 @@ enum lruvec_flags {
+ #define MIN_NR_GENS		2U
+ #define MAX_NR_GENS		4U
+ 
++/*
++ * Each generation is divided into multiple tiers. A page accessed N times
++ * through file descriptors is in tier order_base_2(N). A page in the first tier
++ * (N=0,1) is marked by PG_referenced unless it was faulted in through page
++ * tables or read ahead. A page in any other tier (N>1) is marked by
++ * PG_referenced and PG_workingset. This implies a minimum of two tiers is
++ * supported without using additional bits in page->flags.
++ *
++ * In contrast to moving across generations which requires the LRU lock, moving
++ * across tiers only involves atomic operations on page->flags and therefore
++ * has a negligible cost in the buffered access path. In the eviction path,
++ * comparisons of refaulted/(evicted+protected) from the first tier and the
++ * rest infer whether pages accessed multiple times through file descriptors
++ * are statistically hot and thus worth protecting.
++ *
++ * MAX_NR_TIERS is set to 4 so that the multi-gen LRU can support twice the
++ * number of categories of the active/inactive LRU when keeping track of
++ * accesses through file descriptors. This uses MAX_NR_TIERS-2 spare bits in
++ * page->flags.
++ */
++#define MAX_NR_TIERS		4U
++
+ #ifndef __GENERATING_BOUNDS_H
+ 
+ struct lruvec;
+@@ -341,6 +363,16 @@ enum {
+ 	LRU_GEN_FILE,
+ };
+ 
++#define MIN_LRU_BATCH		BITS_PER_LONG
++#define MAX_LRU_BATCH		(MIN_LRU_BATCH * 64)
++
++/* whether to keep historical stats from evicted generations */
++#ifdef CONFIG_LRU_GEN_STATS
++#define NR_HIST_GENS		MAX_NR_GENS
++#else
++#define NR_HIST_GENS		1U
++#endif
++
+ /*
+  * The youngest generation number is stored in max_seq for both anon and file
+  * types as they are aged on an equal footing. The oldest generation numbers are
+@@ -363,6 +395,15 @@ struct lru_gen_struct {
+ 	struct list_head lists[MAX_NR_GENS][ANON_AND_FILE][MAX_NR_ZONES];
+ 	/* the multi-gen LRU sizes, eventually consistent */
+ 	long nr_pages[MAX_NR_GENS][ANON_AND_FILE][MAX_NR_ZONES];
++	/* the exponential moving average of refaulted */
++	unsigned long avg_refaulted[ANON_AND_FILE][MAX_NR_TIERS];
++	/* the exponential moving average of evicted+protected */
++	unsigned long avg_total[ANON_AND_FILE][MAX_NR_TIERS];
++	/* the first tier doesn't need protection, hence the minus one */
++	unsigned long protected[NR_HIST_GENS][ANON_AND_FILE][MAX_NR_TIERS - 1];
++	/* can be modified without holding the LRU lock */
++	atomic_long_t evicted[NR_HIST_GENS][ANON_AND_FILE][MAX_NR_TIERS];
++	atomic_long_t refaulted[NR_HIST_GENS][ANON_AND_FILE][MAX_NR_TIERS];
+ };
+ 
+ void lru_gen_init_lruvec(struct lruvec *lruvec);
+--- a/include/linux/page-flags-layout.h
++++ b/include/linux/page-flags-layout.h
+@@ -106,7 +106,10 @@
+ #error "Not enough bits in page flags"
+ #endif
+ 
+-#define LRU_REFS_WIDTH	0
++/* see the comment on MAX_NR_TIERS */
++#define LRU_REFS_WIDTH	min(__LRU_REFS_WIDTH, BITS_PER_LONG - NR_PAGEFLAGS - \
++			    ZONES_WIDTH - LRU_GEN_WIDTH - SECTIONS_WIDTH - \
++			    NODES_WIDTH - KASAN_TAG_WIDTH - LAST_CPUPID_WIDTH)
+ 
+ #endif
+ #endif /* _LINUX_PAGE_FLAGS_LAYOUT */
+--- a/kernel/bounds.c
++++ b/kernel/bounds.c
+@@ -24,8 +24,10 @@ int main(void)
+ 	DEFINE(SPINLOCK_SIZE, sizeof(spinlock_t));
+ #ifdef CONFIG_LRU_GEN
+ 	DEFINE(LRU_GEN_WIDTH, order_base_2(MAX_NR_GENS + 1));
++	DEFINE(__LRU_REFS_WIDTH, MAX_NR_TIERS - 2);
+ #else
+ 	DEFINE(LRU_GEN_WIDTH, 0);
++	DEFINE(__LRU_REFS_WIDTH, 0);
+ #endif
+ 	/* End of constants */
+ 
+--- a/mm/Kconfig
++++ b/mm/Kconfig
+@@ -897,6 +897,7 @@ config IO_MAPPING
+ config SECRETMEM
+ 	def_bool ARCH_HAS_SET_DIRECT_MAP && !EMBEDDED
+ 
++# multi-gen LRU {
+ config LRU_GEN
+ 	bool "Multi-Gen LRU"
+ 	depends on MMU
+@@ -905,6 +906,16 @@ config LRU_GEN
+ 	help
+ 	  A high performance LRU implementation to overcommit memory.
+ 
++config LRU_GEN_STATS
++	bool "Full stats for debugging"
++	depends on LRU_GEN
++	help
++	  Do not enable this option unless you plan to look at historical stats
++	  from evicted generations for debugging purpose.
++
++	  This option has a per-memcg and per-node memory overhead.
++# }
++
+ source "mm/damon/Kconfig"
+ 
+ endmenu
+--- a/mm/swap.c
++++ b/mm/swap.c
+@@ -389,6 +389,40 @@ static void __lru_cache_activate_page(st
+ 	local_unlock(&lru_pvecs.lock);
+ }
+ 
++#ifdef CONFIG_LRU_GEN
++static void page_inc_refs(struct page *page)
++{
++	unsigned long new_flags, old_flags = READ_ONCE(page->flags);
++
++	if (PageUnevictable(page))
++		return;
++
++	if (!PageReferenced(page)) {
++		SetPageReferenced(page);
++		return;
++	}
++
++	if (!PageWorkingset(page)) {
++		SetPageWorkingset(page);
++		return;
++	}
++
++	/* see the comment on MAX_NR_TIERS */
++	do {
++		new_flags = old_flags & LRU_REFS_MASK;
++		if (new_flags == LRU_REFS_MASK)
++			break;
++
++		new_flags += BIT(LRU_REFS_PGOFF);
++		new_flags |= old_flags & ~LRU_REFS_MASK;
++	} while (!try_cmpxchg(&page->flags, &old_flags, new_flags));
++}
++#else
++static void page_inc_refs(struct page *page)
++{
++}
++#endif /* CONFIG_LRU_GEN */
++
+ /*
+  * Mark a page as having seen activity.
+  *
+@@ -403,6 +437,11 @@ void mark_page_accessed(struct page *pag
+ {
+ 	page = compound_head(page);
+ 
++	if (lru_gen_enabled()) {
++		page_inc_refs(page);
++		return;
++	}
++
+ 	if (!PageReferenced(page)) {
+ 		SetPageReferenced(page);
+ 	} else if (PageUnevictable(page)) {
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -1142,9 +1142,11 @@ static int __remove_mapping(struct addre
+ 
+ 	if (PageSwapCache(page)) {
+ 		swp_entry_t swap = { .val = page_private(page) };
+-		mem_cgroup_swapout(page, swap);
++
++		/* get a shadow entry before mem_cgroup_swapout() clears page_memcg() */
+ 		if (reclaimed && !mapping_exiting(mapping))
+ 			shadow = workingset_eviction(page, target_memcg);
++		mem_cgroup_swapout(page, swap);
+ 		__delete_from_swap_cache(page, swap, shadow);
+ 		xa_unlock_irq(&mapping->i_pages);
+ 		put_swap_page(page, swap);
+@@ -2502,6 +2504,9 @@ static void prepare_scan_count(pg_data_t
+ 	unsigned long file;
+ 	struct lruvec *target_lruvec;
+ 
++	if (lru_gen_enabled())
++		return;
++
+ 	target_lruvec = mem_cgroup_lruvec(sc->target_mem_cgroup, pgdat);
+ 
+ 	/*
+@@ -2827,6 +2832,17 @@ static bool can_age_anon_pages(struct pg
+  *                          shorthand helpers
+  ******************************************************************************/
+ 
++#define LRU_REFS_FLAGS	(BIT(PG_referenced) | BIT(PG_workingset))
++
++#define DEFINE_MAX_SEQ(lruvec)						\
++	unsigned long max_seq = READ_ONCE((lruvec)->lrugen.max_seq)
++
++#define DEFINE_MIN_SEQ(lruvec)						\
++	unsigned long min_seq[ANON_AND_FILE] = {			\
++		READ_ONCE((lruvec)->lrugen.min_seq[LRU_GEN_ANON]),	\
++		READ_ONCE((lruvec)->lrugen.min_seq[LRU_GEN_FILE]),	\
++	}
++
+ #define for_each_gen_type_zone(gen, type, zone)				\
+ 	for ((gen) = 0; (gen) < MAX_NR_GENS; (gen)++)			\
+ 		for ((type) = 0; (type) < ANON_AND_FILE; (type)++)	\
+@@ -2852,6 +2868,745 @@ static struct lruvec __maybe_unused *get
+ 	return pgdat ? &pgdat->__lruvec : NULL;
+ }
+ 
++static int get_swappiness(struct lruvec *lruvec, struct scan_control *sc)
++{
++	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
++	struct pglist_data *pgdat = lruvec_pgdat(lruvec);
++
++	if (!can_demote(pgdat->node_id, sc) &&
++	    mem_cgroup_get_nr_swap_pages(memcg) < MIN_LRU_BATCH)
++		return 0;
++
++	return mem_cgroup_swappiness(memcg);
++}
++
++static int get_nr_gens(struct lruvec *lruvec, int type)
++{
++	return lruvec->lrugen.max_seq - lruvec->lrugen.min_seq[type] + 1;
++}
++
++static bool __maybe_unused seq_is_valid(struct lruvec *lruvec)
++{
++	/* see the comment on lru_gen_struct */
++	return get_nr_gens(lruvec, LRU_GEN_FILE) >= MIN_NR_GENS &&
++	       get_nr_gens(lruvec, LRU_GEN_FILE) <= get_nr_gens(lruvec, LRU_GEN_ANON) &&
++	       get_nr_gens(lruvec, LRU_GEN_ANON) <= MAX_NR_GENS;
++}
++
++/******************************************************************************
++ *                          refault feedback loop
++ ******************************************************************************/
++
++/*
++ * A feedback loop based on Proportional-Integral-Derivative (PID) controller.
++ *
++ * The P term is refaulted/(evicted+protected) from a tier in the generation
++ * currently being evicted; the I term is the exponential moving average of the
++ * P term over the generations previously evicted, using the smoothing factor
++ * 1/2; the D term isn't supported.
++ *
++ * The setpoint (SP) is always the first tier of one type; the process variable
++ * (PV) is either any tier of the other type or any other tier of the same
++ * type.
++ *
++ * The error is the difference between the SP and the PV; the correction is to
++ * turn off protection when SP>PV or turn on protection when SP<PV.
++ *
++ * For future optimizations:
++ * 1. The D term may discount the other two terms over time so that long-lived
++ *    generations can resist stale information.
++ */
++struct ctrl_pos {
++	unsigned long refaulted;
++	unsigned long total;
++	int gain;
++};
++
++static void read_ctrl_pos(struct lruvec *lruvec, int type, int tier, int gain,
++			  struct ctrl_pos *pos)
++{
++	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	int hist = lru_hist_from_seq(lrugen->min_seq[type]);
++
++	pos->refaulted = lrugen->avg_refaulted[type][tier] +
++			 atomic_long_read(&lrugen->refaulted[hist][type][tier]);
++	pos->total = lrugen->avg_total[type][tier] +
++		     atomic_long_read(&lrugen->evicted[hist][type][tier]);
++	if (tier)
++		pos->total += lrugen->protected[hist][type][tier - 1];
++	pos->gain = gain;
++}
++
++static void reset_ctrl_pos(struct lruvec *lruvec, int type, bool carryover)
++{
++	int hist, tier;
++	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	bool clear = carryover ? NR_HIST_GENS == 1 : NR_HIST_GENS > 1;
++	unsigned long seq = carryover ? lrugen->min_seq[type] : lrugen->max_seq + 1;
++
++	lockdep_assert_held(&lruvec->lru_lock);
++
++	if (!carryover && !clear)
++		return;
++
++	hist = lru_hist_from_seq(seq);
++
++	for (tier = 0; tier < MAX_NR_TIERS; tier++) {
++		if (carryover) {
++			unsigned long sum;
++
++			sum = lrugen->avg_refaulted[type][tier] +
++			      atomic_long_read(&lrugen->refaulted[hist][type][tier]);
++			WRITE_ONCE(lrugen->avg_refaulted[type][tier], sum / 2);
++
++			sum = lrugen->avg_total[type][tier] +
++			      atomic_long_read(&lrugen->evicted[hist][type][tier]);
++			if (tier)
++				sum += lrugen->protected[hist][type][tier - 1];
++			WRITE_ONCE(lrugen->avg_total[type][tier], sum / 2);
++		}
++
++		if (clear) {
++			atomic_long_set(&lrugen->refaulted[hist][type][tier], 0);
++			atomic_long_set(&lrugen->evicted[hist][type][tier], 0);
++			if (tier)
++				WRITE_ONCE(lrugen->protected[hist][type][tier - 1], 0);
++		}
++	}
++}
++
++static bool positive_ctrl_err(struct ctrl_pos *sp, struct ctrl_pos *pv)
++{
++	/*
++	 * Return true if the PV has a limited number of refaults or a lower
++	 * refaulted/total than the SP.
++	 */
++	return pv->refaulted < MIN_LRU_BATCH ||
++	       pv->refaulted * (sp->total + MIN_LRU_BATCH) * sp->gain <=
++	       (sp->refaulted + 1) * pv->total * pv->gain;
++}
++
++/******************************************************************************
++ *                          the aging
++ ******************************************************************************/
++
++/* protect pages accessed multiple times through file descriptors */
++static int page_inc_gen(struct lruvec *lruvec, struct page *page, bool reclaiming)
++{
++	int type = page_is_file_lru(page);
++	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	int new_gen, old_gen = lru_gen_from_seq(lrugen->min_seq[type]);
++	unsigned long new_flags, old_flags = READ_ONCE(page->flags);
++
++	VM_WARN_ON_ONCE_PAGE(!(old_flags & LRU_GEN_MASK), page);
++
++	do {
++		new_gen = (old_gen + 1) % MAX_NR_GENS;
++
++		new_flags = old_flags & ~(LRU_GEN_MASK | LRU_REFS_MASK | LRU_REFS_FLAGS);
++		new_flags |= (new_gen + 1UL) << LRU_GEN_PGOFF;
++		/* for end_page_writeback() */
++		if (reclaiming)
++			new_flags |= BIT(PG_reclaim);
++	} while (!try_cmpxchg(&page->flags, &old_flags, new_flags));
++
++	lru_gen_update_size(lruvec, page, old_gen, new_gen);
++
++	return new_gen;
++}
++
++static void inc_min_seq(struct lruvec *lruvec, int type)
++{
++	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++
++	reset_ctrl_pos(lruvec, type, true);
++	WRITE_ONCE(lrugen->min_seq[type], lrugen->min_seq[type] + 1);
++}
++
++static bool try_to_inc_min_seq(struct lruvec *lruvec, bool can_swap)
++{
++	int gen, type, zone;
++	bool success = false;
++	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	DEFINE_MIN_SEQ(lruvec);
++
++	VM_WARN_ON_ONCE(!seq_is_valid(lruvec));
++
++	/* find the oldest populated generation */
++	for (type = !can_swap; type < ANON_AND_FILE; type++) {
++		while (min_seq[type] + MIN_NR_GENS <= lrugen->max_seq) {
++			gen = lru_gen_from_seq(min_seq[type]);
++
++			for (zone = 0; zone < MAX_NR_ZONES; zone++) {
++				if (!list_empty(&lrugen->lists[gen][type][zone]))
++					goto next;
++			}
++
++			min_seq[type]++;
++		}
++next:
++		;
++	}
++
++	/* see the comment on lru_gen_struct */
++	if (can_swap) {
++		min_seq[LRU_GEN_ANON] = min(min_seq[LRU_GEN_ANON], min_seq[LRU_GEN_FILE]);
++		min_seq[LRU_GEN_FILE] = max(min_seq[LRU_GEN_ANON], lrugen->min_seq[LRU_GEN_FILE]);
++	}
++
++	for (type = !can_swap; type < ANON_AND_FILE; type++) {
++		if (min_seq[type] == lrugen->min_seq[type])
++			continue;
++
++		reset_ctrl_pos(lruvec, type, true);
++		WRITE_ONCE(lrugen->min_seq[type], min_seq[type]);
++		success = true;
++	}
++
++	return success;
++}
++
++static void inc_max_seq(struct lruvec *lruvec, unsigned long max_seq, bool can_swap)
++{
++	int prev, next;
++	int type, zone;
++	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++
++	spin_lock_irq(&lruvec->lru_lock);
++
++	VM_WARN_ON_ONCE(!seq_is_valid(lruvec));
++
++	if (max_seq != lrugen->max_seq)
++		goto unlock;
++
++	for (type = ANON_AND_FILE - 1; type >= 0; type--) {
++		if (get_nr_gens(lruvec, type) != MAX_NR_GENS)
++			continue;
++
++		VM_WARN_ON_ONCE(type == LRU_GEN_FILE || can_swap);
++
++		inc_min_seq(lruvec, type);
++	}
++
++	/*
++	 * Update the active/inactive LRU sizes for compatibility. Both sides of
++	 * the current max_seq need to be covered, since max_seq+1 can overlap
++	 * with min_seq[LRU_GEN_ANON] if swapping is constrained. And if they do
++	 * overlap, cold/hot inversion happens.
++	 */
++	prev = lru_gen_from_seq(lrugen->max_seq - 1);
++	next = lru_gen_from_seq(lrugen->max_seq + 1);
++
++	for (type = 0; type < ANON_AND_FILE; type++) {
++		for (zone = 0; zone < MAX_NR_ZONES; zone++) {
++			enum lru_list lru = type * LRU_INACTIVE_FILE;
++			long delta = lrugen->nr_pages[prev][type][zone] -
++				     lrugen->nr_pages[next][type][zone];
++
++			if (!delta)
++				continue;
++
++			__update_lru_size(lruvec, lru, zone, delta);
++			__update_lru_size(lruvec, lru + LRU_ACTIVE, zone, -delta);
++		}
++	}
++
++	for (type = 0; type < ANON_AND_FILE; type++)
++		reset_ctrl_pos(lruvec, type, false);
++
++	/* make sure preceding modifications appear */
++	smp_store_release(&lrugen->max_seq, lrugen->max_seq + 1);
++unlock:
++	spin_unlock_irq(&lruvec->lru_lock);
++}
++
++static bool should_run_aging(struct lruvec *lruvec, unsigned long max_seq, unsigned long *min_seq,
++			     struct scan_control *sc, bool can_swap, unsigned long *nr_to_scan)
++{
++	int gen, type, zone;
++	unsigned long old = 0;
++	unsigned long young = 0;
++	unsigned long total = 0;
++	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
++
++	for (type = !can_swap; type < ANON_AND_FILE; type++) {
++		unsigned long seq;
++
++		for (seq = min_seq[type]; seq <= max_seq; seq++) {
++			unsigned long size = 0;
++
++			gen = lru_gen_from_seq(seq);
++
++			for (zone = 0; zone < MAX_NR_ZONES; zone++)
++				size += max(READ_ONCE(lrugen->nr_pages[gen][type][zone]), 0L);
++
++			total += size;
++			if (seq == max_seq)
++				young += size;
++			else if (seq + MIN_NR_GENS == max_seq)
++				old += size;
++		}
++	}
++
++	/* try to scrape all its memory if this memcg was deleted */
++	*nr_to_scan = mem_cgroup_online(memcg) ? (total >> sc->priority) : total;
++
++	/*
++	 * The aging tries to be lazy to reduce the overhead, while the eviction
++	 * stalls when the number of generations reaches MIN_NR_GENS. Hence, the
++	 * ideal number of generations is MIN_NR_GENS+1.
++	 */
++	if (min_seq[!can_swap] + MIN_NR_GENS > max_seq)
++		return true;
++	if (min_seq[!can_swap] + MIN_NR_GENS < max_seq)
++		return false;
++
++	/*
++	 * It's also ideal to spread pages out evenly, i.e., 1/(MIN_NR_GENS+1)
++	 * of the total number of pages for each generation. A reasonable range
++	 * for this average portion is [1/MIN_NR_GENS, 1/(MIN_NR_GENS+2)]. The
++	 * aging cares about the upper bound of hot pages, while the eviction
++	 * cares about the lower bound of cold pages.
++	 */
++	if (young * MIN_NR_GENS > total)
++		return true;
++	if (old * (MIN_NR_GENS + 2) < total)
++		return true;
++
++	return false;
++}
++
++static void age_lruvec(struct lruvec *lruvec, struct scan_control *sc)
++{
++	bool need_aging;
++	unsigned long nr_to_scan;
++	int swappiness = get_swappiness(lruvec, sc);
++	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
++	DEFINE_MAX_SEQ(lruvec);
++	DEFINE_MIN_SEQ(lruvec);
++
++	VM_WARN_ON_ONCE(sc->memcg_low_reclaim);
++
++	mem_cgroup_calculate_protection(NULL, memcg);
++
++	if (mem_cgroup_below_min(memcg))
++		return;
++
++	need_aging = should_run_aging(lruvec, max_seq, min_seq, sc, swappiness, &nr_to_scan);
++	if (need_aging)
++		inc_max_seq(lruvec, max_seq, swappiness);
++}
++
++static void lru_gen_age_node(struct pglist_data *pgdat, struct scan_control *sc)
++{
++	struct mem_cgroup *memcg;
++
++	VM_WARN_ON_ONCE(!current_is_kswapd());
++
++	memcg = mem_cgroup_iter(NULL, NULL, NULL);
++	do {
++		struct lruvec *lruvec = mem_cgroup_lruvec(memcg, pgdat);
++
++		age_lruvec(lruvec, sc);
++
++		cond_resched();
++	} while ((memcg = mem_cgroup_iter(NULL, memcg, NULL)));
++}
++
++/******************************************************************************
++ *                          the eviction
++ ******************************************************************************/
++
++static bool sort_page(struct lruvec *lruvec, struct page *page, int tier_idx)
++{
++	bool success;
++	int gen = page_lru_gen(page);
++	int type = page_is_file_lru(page);
++	int zone = page_zonenum(page);
++	int delta = thp_nr_pages(page);
++	int refs = page_lru_refs(page);
++	int tier = lru_tier_from_refs(refs);
++	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++
++	VM_WARN_ON_ONCE_PAGE(gen >= MAX_NR_GENS, page);
++
++	/* unevictable */
++	if (!page_evictable(page)) {
++		success = lru_gen_del_page(lruvec, page, true);
++		VM_WARN_ON_ONCE_PAGE(!success, page);
++		SetPageUnevictable(page);
++		add_page_to_lru_list(page, lruvec);
++		__count_vm_events(UNEVICTABLE_PGCULLED, delta);
++		return true;
++	}
++
++	/* dirty lazyfree */
++	if (type == LRU_GEN_FILE && PageAnon(page) && PageDirty(page)) {
++		success = lru_gen_del_page(lruvec, page, true);
++		VM_WARN_ON_ONCE_PAGE(!success, page);
++		SetPageSwapBacked(page);
++		add_page_to_lru_list_tail(page, lruvec);
++		return true;
++	}
++
++	/* protected */
++	if (tier > tier_idx) {
++		int hist = lru_hist_from_seq(lrugen->min_seq[type]);
++
++		gen = page_inc_gen(lruvec, page, false);
++		list_move_tail(&page->lru, &lrugen->lists[gen][type][zone]);
++
++		WRITE_ONCE(lrugen->protected[hist][type][tier - 1],
++			   lrugen->protected[hist][type][tier - 1] + delta);
++		__mod_lruvec_state(lruvec, WORKINGSET_ACTIVATE_BASE + type, delta);
++		return true;
++	}
++
++	/* waiting for writeback */
++	if (PageLocked(page) || PageWriteback(page) ||
++	    (type == LRU_GEN_FILE && PageDirty(page))) {
++		gen = page_inc_gen(lruvec, page, true);
++		list_move(&page->lru, &lrugen->lists[gen][type][zone]);
++		return true;
++	}
++
++	return false;
++}
++
++static bool isolate_page(struct lruvec *lruvec, struct page *page, struct scan_control *sc)
++{
++	bool success;
++
++	/* unmapping inhibited */
++	if (!sc->may_unmap && page_mapped(page))
++		return false;
++
++	/* swapping inhibited */
++	if (!(sc->may_writepage && (sc->gfp_mask & __GFP_IO)) &&
++	    (PageDirty(page) ||
++	     (PageAnon(page) && !PageSwapCache(page))))
++		return false;
++
++	/* raced with release_pages() */
++	if (!get_page_unless_zero(page))
++		return false;
++
++	/* raced with another isolation */
++	if (!TestClearPageLRU(page)) {
++		put_page(page);
++		return false;
++	}
++
++	/* see the comment on MAX_NR_TIERS */
++	if (!PageReferenced(page))
++		set_mask_bits(&page->flags, LRU_REFS_MASK | LRU_REFS_FLAGS, 0);
++
++	/* for shrink_page_list() */
++	ClearPageReclaim(page);
++	ClearPageReferenced(page);
++
++	success = lru_gen_del_page(lruvec, page, true);
++	VM_WARN_ON_ONCE_PAGE(!success, page);
++
++	return true;
++}
++
++static int scan_pages(struct lruvec *lruvec, struct scan_control *sc,
++		      int type, int tier, struct list_head *list)
++{
++	int gen, zone;
++	enum vm_event_item item;
++	int sorted = 0;
++	int scanned = 0;
++	int isolated = 0;
++	int remaining = MAX_LRU_BATCH;
++	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
++
++	VM_WARN_ON_ONCE(!list_empty(list));
++
++	if (get_nr_gens(lruvec, type) == MIN_NR_GENS)
++		return 0;
++
++	gen = lru_gen_from_seq(lrugen->min_seq[type]);
++
++	for (zone = sc->reclaim_idx; zone >= 0; zone--) {
++		LIST_HEAD(moved);
++		int skipped = 0;
++		struct list_head *head = &lrugen->lists[gen][type][zone];
++
++		while (!list_empty(head)) {
++			struct page *page = lru_to_page(head);
++			int delta = thp_nr_pages(page);
++
++			VM_WARN_ON_ONCE_PAGE(PageUnevictable(page), page);
++			VM_WARN_ON_ONCE_PAGE(PageActive(page), page);
++			VM_WARN_ON_ONCE_PAGE(page_is_file_lru(page) != type, page);
++			VM_WARN_ON_ONCE_PAGE(page_zonenum(page) != zone, page);
++
++			scanned += delta;
++
++			if (sort_page(lruvec, page, tier))
++				sorted += delta;
++			else if (isolate_page(lruvec, page, sc)) {
++				list_add(&page->lru, list);
++				isolated += delta;
++			} else {
++				list_move(&page->lru, &moved);
++				skipped += delta;
++			}
++
++			if (!--remaining || max(isolated, skipped) >= MIN_LRU_BATCH)
++				break;
++		}
++
++		if (skipped) {
++			list_splice(&moved, head);
++			__count_zid_vm_events(PGSCAN_SKIP, zone, skipped);
++		}
++
++		if (!remaining || isolated >= MIN_LRU_BATCH)
++			break;
++	}
++
++	item = current_is_kswapd() ? PGSCAN_KSWAPD : PGSCAN_DIRECT;
++	if (!cgroup_reclaim(sc)) {
++		__count_vm_events(item, isolated);
++		__count_vm_events(PGREFILL, sorted);
++	}
++	__count_memcg_events(memcg, item, isolated);
++	__count_memcg_events(memcg, PGREFILL, sorted);
++	__count_vm_events(PGSCAN_ANON + type, isolated);
++
++	/*
++	 * There might not be eligible pages due to reclaim_idx, may_unmap and
++	 * may_writepage. Check the remaining to prevent livelock if it's not
++	 * making progress.
++	 */
++	return isolated || !remaining ? scanned : 0;
++}
++
++static int get_tier_idx(struct lruvec *lruvec, int type)
++{
++	int tier;
++	struct ctrl_pos sp, pv;
++
++	/*
++	 * To leave a margin for fluctuations, use a larger gain factor (1:2).
++	 * This value is chosen because any other tier would have at least twice
++	 * as many refaults as the first tier.
++	 */
++	read_ctrl_pos(lruvec, type, 0, 1, &sp);
++	for (tier = 1; tier < MAX_NR_TIERS; tier++) {
++		read_ctrl_pos(lruvec, type, tier, 2, &pv);
++		if (!positive_ctrl_err(&sp, &pv))
++			break;
++	}
++
++	return tier - 1;
++}
++
++static int get_type_to_scan(struct lruvec *lruvec, int swappiness, int *tier_idx)
++{
++	int type, tier;
++	struct ctrl_pos sp, pv;
++	int gain[ANON_AND_FILE] = { swappiness, 200 - swappiness };
++
++	/*
++	 * Compare the first tier of anon with that of file to determine which
++	 * type to scan. Also need to compare other tiers of the selected type
++	 * with the first tier of the other type to determine the last tier (of
++	 * the selected type) to evict.
++	 */
++	read_ctrl_pos(lruvec, LRU_GEN_ANON, 0, gain[LRU_GEN_ANON], &sp);
++	read_ctrl_pos(lruvec, LRU_GEN_FILE, 0, gain[LRU_GEN_FILE], &pv);
++	type = positive_ctrl_err(&sp, &pv);
++
++	read_ctrl_pos(lruvec, !type, 0, gain[!type], &sp);
++	for (tier = 1; tier < MAX_NR_TIERS; tier++) {
++		read_ctrl_pos(lruvec, type, tier, gain[type], &pv);
++		if (!positive_ctrl_err(&sp, &pv))
++			break;
++	}
++
++	*tier_idx = tier - 1;
++
++	return type;
++}
++
++static int isolate_pages(struct lruvec *lruvec, struct scan_control *sc, int swappiness,
++			 int *type_scanned, struct list_head *list)
++{
++	int i;
++	int type;
++	int scanned;
++	int tier = -1;
++	DEFINE_MIN_SEQ(lruvec);
++
++	/*
++	 * Try to make the obvious choice first. When anon and file are both
++	 * available from the same generation, interpret swappiness 1 as file
++	 * first and 200 as anon first.
++	 */
++	if (!swappiness)
++		type = LRU_GEN_FILE;
++	else if (min_seq[LRU_GEN_ANON] < min_seq[LRU_GEN_FILE])
++		type = LRU_GEN_ANON;
++	else if (swappiness == 1)
++		type = LRU_GEN_FILE;
++	else if (swappiness == 200)
++		type = LRU_GEN_ANON;
++	else
++		type = get_type_to_scan(lruvec, swappiness, &tier);
++
++	for (i = !swappiness; i < ANON_AND_FILE; i++) {
++		if (tier < 0)
++			tier = get_tier_idx(lruvec, type);
++
++		scanned = scan_pages(lruvec, sc, type, tier, list);
++		if (scanned)
++			break;
++
++		type = !type;
++		tier = -1;
++	}
++
++	*type_scanned = type;
++
++	return scanned;
++}
++
++static int evict_pages(struct lruvec *lruvec, struct scan_control *sc, int swappiness)
++{
++	int type;
++	int scanned;
++	int reclaimed;
++	LIST_HEAD(list);
++	struct page *page;
++	enum vm_event_item item;
++	struct reclaim_stat stat;
++	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
++	struct pglist_data *pgdat = lruvec_pgdat(lruvec);
++
++	spin_lock_irq(&lruvec->lru_lock);
++
++	scanned = isolate_pages(lruvec, sc, swappiness, &type, &list);
++
++	scanned += try_to_inc_min_seq(lruvec, swappiness);
++
++	if (get_nr_gens(lruvec, !swappiness) == MIN_NR_GENS)
++		scanned = 0;
++
++	spin_unlock_irq(&lruvec->lru_lock);
++
++	if (list_empty(&list))
++		return scanned;
++
++	reclaimed = shrink_page_list(&list, pgdat, sc, &stat, false);
++
++	list_for_each_entry(page, &list, lru) {
++		/* restore LRU_REFS_FLAGS cleared by isolate_page() */
++		if (PageWorkingset(page))
++			SetPageReferenced(page);
++
++		/* don't add rejected pages to the oldest generation */
++		if (PageReclaim(page) &&
++		    (PageDirty(page) || PageWriteback(page)))
++			ClearPageActive(page);
++		else
++			SetPageActive(page);
++	}
++
++	spin_lock_irq(&lruvec->lru_lock);
++
++	move_pages_to_lru(lruvec, &list);
++
++	item = current_is_kswapd() ? PGSTEAL_KSWAPD : PGSTEAL_DIRECT;
++	if (!cgroup_reclaim(sc))
++		__count_vm_events(item, reclaimed);
++	__count_memcg_events(memcg, item, reclaimed);
++	__count_vm_events(PGSTEAL_ANON + type, reclaimed);
++
++	spin_unlock_irq(&lruvec->lru_lock);
++
++	mem_cgroup_uncharge_list(&list);
++	free_unref_page_list(&list);
++
++	sc->nr_reclaimed += reclaimed;
++
++	return scanned;
++}
++
++static unsigned long get_nr_to_scan(struct lruvec *lruvec, struct scan_control *sc,
++				    bool can_swap)
++{
++	bool need_aging;
++	unsigned long nr_to_scan;
++	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
++	DEFINE_MAX_SEQ(lruvec);
++	DEFINE_MIN_SEQ(lruvec);
++
++	if (mem_cgroup_below_min(memcg) ||
++	    (mem_cgroup_below_low(memcg) && !sc->memcg_low_reclaim))
++		return 0;
++
++	need_aging = should_run_aging(lruvec, max_seq, min_seq, sc, can_swap, &nr_to_scan);
++	if (!need_aging)
++		return nr_to_scan;
++
++	/* skip the aging path at the default priority */
++	if (sc->priority == DEF_PRIORITY)
++		goto done;
++
++	/* leave the work to lru_gen_age_node() */
++	if (current_is_kswapd())
++		return 0;
++
++	inc_max_seq(lruvec, max_seq, can_swap);
++done:
++	return min_seq[!can_swap] + MIN_NR_GENS <= max_seq ? nr_to_scan : 0;
++}
++
++static void lru_gen_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
++{
++	struct blk_plug plug;
++	unsigned long scanned = 0;
++
++	lru_add_drain();
++
++	blk_start_plug(&plug);
++
++	while (true) {
++		int delta;
++		int swappiness;
++		unsigned long nr_to_scan;
++
++		if (sc->may_swap)
++			swappiness = get_swappiness(lruvec, sc);
++		else if (!cgroup_reclaim(sc) && get_swappiness(lruvec, sc))
++			swappiness = 1;
++		else
++			swappiness = 0;
++
++		nr_to_scan = get_nr_to_scan(lruvec, sc, swappiness);
++		if (!nr_to_scan)
++			break;
++
++		delta = evict_pages(lruvec, sc, swappiness);
++		if (!delta)
++			break;
++
++		scanned += delta;
++		if (scanned >= nr_to_scan)
++			break;
++
++		cond_resched();
++	}
++
++	blk_finish_plug(&plug);
++}
++
+ /******************************************************************************
+  *                          initialization
+  ******************************************************************************/
+@@ -2894,6 +3649,16 @@ static int __init init_lru_gen(void)
+ };
+ late_initcall(init_lru_gen);
+ 
++#else /* !CONFIG_LRU_GEN */
++
++static void lru_gen_age_node(struct pglist_data *pgdat, struct scan_control *sc)
++{
++}
++
++static void lru_gen_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
++{
++}
++
+ #endif /* CONFIG_LRU_GEN */
+ 
+ static void shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
+@@ -2907,6 +3672,11 @@ static void shrink_lruvec(struct lruvec
+ 	bool proportional_reclaim;
+ 	struct blk_plug plug;
+ 
++	if (lru_gen_enabled()) {
++		lru_gen_shrink_lruvec(lruvec, sc);
++		return;
++	}
++
+ 	get_scan_count(lruvec, sc, nr);
+ 
+ 	/* Record the original scan target for proportional adjustments later */
+@@ -3372,6 +4142,9 @@ static void snapshot_refaults(struct mem
+ 	struct lruvec *target_lruvec;
+ 	unsigned long refaults;
+ 
++	if (lru_gen_enabled())
++		return;
++
+ 	target_lruvec = mem_cgroup_lruvec(target_memcg, pgdat);
+ 	refaults = lruvec_page_state(target_lruvec, WORKINGSET_ACTIVATE_ANON);
+ 	target_lruvec->refaults[0] = refaults;
+@@ -3736,12 +4509,16 @@ unsigned long try_to_free_mem_cgroup_pag
+ }
+ #endif
+ 
+-static void age_active_anon(struct pglist_data *pgdat,
+-				struct scan_control *sc)
++static void kswapd_age_node(struct pglist_data *pgdat, struct scan_control *sc)
+ {
+ 	struct mem_cgroup *memcg;
+ 	struct lruvec *lruvec;
+ 
++	if (lru_gen_enabled()) {
++		lru_gen_age_node(pgdat, sc);
++		return;
++	}
++
+ 	if (!can_age_anon_pages(pgdat, sc))
+ 		return;
+ 
+@@ -4058,12 +4835,11 @@ restart:
+ 		sc.may_swap = !nr_boost_reclaim;
+ 
+ 		/*
+-		 * Do some background aging of the anon list, to give
+-		 * pages a chance to be referenced before reclaiming. All
+-		 * pages are rotated regardless of classzone as this is
+-		 * about consistent aging.
++		 * Do some background aging, to give pages a chance to be
++		 * referenced before reclaiming. All pages are rotated
++		 * regardless of classzone as this is about consistent aging.
+ 		 */
+-		age_active_anon(pgdat, &sc);
++		kswapd_age_node(pgdat, &sc);
+ 
+ 		/*
+ 		 * If we're getting trouble reclaiming, start doing writepage
+--- a/mm/workingset.c
++++ b/mm/workingset.c
+@@ -187,7 +187,6 @@ static unsigned int bucket_order __read_
+ static void *pack_shadow(int memcgid, pg_data_t *pgdat, unsigned long eviction,
+ 			 bool workingset)
+ {
+-	eviction >>= bucket_order;
+ 	eviction &= EVICTION_MASK;
+ 	eviction = (eviction << MEM_CGROUP_ID_SHIFT) | memcgid;
+ 	eviction = (eviction << NODES_SHIFT) | pgdat->node_id;
+@@ -212,10 +211,107 @@ static void unpack_shadow(void *shadow,
+ 
+ 	*memcgidp = memcgid;
+ 	*pgdat = NODE_DATA(nid);
+-	*evictionp = entry << bucket_order;
++	*evictionp = entry;
+ 	*workingsetp = workingset;
+ }
+ 
++#ifdef CONFIG_LRU_GEN
++
++static void *lru_gen_eviction(struct page *page)
++{
++	int hist;
++	unsigned long token;
++	unsigned long min_seq;
++	struct lruvec *lruvec;
++	struct lru_gen_struct *lrugen;
++	int type = page_is_file_lru(page);
++	int delta = thp_nr_pages(page);
++	int refs = page_lru_refs(page);
++	int tier = lru_tier_from_refs(refs);
++	struct mem_cgroup *memcg = page_memcg(page);
++	struct pglist_data *pgdat = page_pgdat(page);
++
++	BUILD_BUG_ON(LRU_GEN_WIDTH + LRU_REFS_WIDTH > BITS_PER_LONG - EVICTION_SHIFT);
++
++	lruvec = mem_cgroup_lruvec(memcg, pgdat);
++	lrugen = &lruvec->lrugen;
++	min_seq = READ_ONCE(lrugen->min_seq[type]);
++	token = (min_seq << LRU_REFS_WIDTH) | max(refs - 1, 0);
++
++	hist = lru_hist_from_seq(min_seq);
++	atomic_long_add(delta, &lrugen->evicted[hist][type][tier]);
++
++	return pack_shadow(mem_cgroup_id(memcg), pgdat, token, refs);
++}
++
++static void lru_gen_refault(struct page *page, void *shadow)
++{
++	int hist, tier, refs;
++	int memcg_id;
++	bool workingset;
++	unsigned long token;
++	unsigned long min_seq;
++	struct lruvec *lruvec;
++	struct lru_gen_struct *lrugen;
++	struct mem_cgroup *memcg;
++	struct pglist_data *pgdat;
++	int type = page_is_file_lru(page);
++	int delta = thp_nr_pages(page);
++
++	unpack_shadow(shadow, &memcg_id, &pgdat, &token, &workingset);
++
++	if (pgdat != page_pgdat(page))
++		return;
++
++	rcu_read_lock();
++
++	memcg = page_memcg_rcu(page);
++	if (memcg_id != mem_cgroup_id(memcg))
++		goto unlock;
++
++	lruvec = mem_cgroup_lruvec(memcg, pgdat);
++	lrugen = &lruvec->lrugen;
++
++	min_seq = READ_ONCE(lrugen->min_seq[type]);
++	if ((token >> LRU_REFS_WIDTH) != (min_seq & (EVICTION_MASK >> LRU_REFS_WIDTH)))
++		goto unlock;
++
++	hist = lru_hist_from_seq(min_seq);
++	/* see the comment in page_lru_refs() */
++	refs = (token & (BIT(LRU_REFS_WIDTH) - 1)) + workingset;
++	tier = lru_tier_from_refs(refs);
++
++	atomic_long_add(delta, &lrugen->refaulted[hist][type][tier]);
++	mod_lruvec_state(lruvec, WORKINGSET_REFAULT_BASE + type, delta);
++
++	/*
++	 * Count the following two cases as stalls:
++	 * 1. For pages accessed through page tables, hotter pages pushed out
++	 *    hot pages which refaulted immediately.
++	 * 2. For pages accessed multiple times through file descriptors,
++	 *    numbers of accesses might have been out of the range.
++	 */
++	if (lru_gen_in_fault() || refs == BIT(LRU_REFS_WIDTH)) {
++		SetPageWorkingset(page);
++		mod_lruvec_state(lruvec, WORKINGSET_RESTORE_BASE + type, delta);
++	}
++unlock:
++	rcu_read_unlock();
++}
++
++#else /* !CONFIG_LRU_GEN */
++
++static void *lru_gen_eviction(struct page *page)
++{
++	return NULL;
++}
++
++static void lru_gen_refault(struct page *page, void *shadow)
++{
++}
++
++#endif /* CONFIG_LRU_GEN */
++
+ /**
+  * workingset_age_nonresident - age non-resident entries as LRU ages
+  * @lruvec: the lruvec that was aged
+@@ -264,10 +360,14 @@ void *workingset_eviction(struct page *p
+ 	VM_BUG_ON_PAGE(page_count(page), page);
+ 	VM_BUG_ON_PAGE(!PageLocked(page), page);
+ 
++	if (lru_gen_enabled())
++		return lru_gen_eviction(page);
++
+ 	lruvec = mem_cgroup_lruvec(target_memcg, pgdat);
+ 	/* XXX: target_memcg can be NULL, go through lruvec */
+ 	memcgid = mem_cgroup_id(lruvec_memcg(lruvec));
+ 	eviction = atomic_long_read(&lruvec->nonresident_age);
++	eviction >>= bucket_order;
+ 	workingset_age_nonresident(lruvec, thp_nr_pages(page));
+ 	return pack_shadow(memcgid, pgdat, eviction, PageWorkingset(page));
+ }
+@@ -296,7 +396,13 @@ void workingset_refault(struct page *pag
+ 	bool workingset;
+ 	int memcgid;
+ 
++	if (lru_gen_enabled()) {
++		lru_gen_refault(page, shadow);
++		return;
++	}
++
+ 	unpack_shadow(shadow, &memcgid, &pgdat, &eviction, &workingset);
++	eviction <<= bucket_order;
+ 
+ 	rcu_read_lock();
+ 	/*
diff --git a/target/linux/generic/backport-5.15/020-v6.1-07-mm-multi-gen-LRU-exploit-locality-in-rmap.patch b/target/linux/generic/backport-5.15/020-v6.1-07-mm-multi-gen-LRU-exploit-locality-in-rmap.patch
new file mode 100644
index 00000000000000..5cd6e03dc60779
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.1-07-mm-multi-gen-LRU-exploit-locality-in-rmap.patch
@@ -0,0 +1,491 @@
+From e4277535f6d6708bb19b88c4bad155832671d69b Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Sun, 18 Sep 2022 02:00:04 -0600
+Subject: [PATCH 07/29] mm: multi-gen LRU: exploit locality in rmap
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Searching the rmap for PTEs mapping each page on an LRU list (to test and
+clear the accessed bit) can be expensive because pages from different VMAs
+(PA space) are not cache friendly to the rmap (VA space).  For workloads
+mostly using mapped pages, searching the rmap can incur the highest CPU
+cost in the reclaim path.
+
+This patch exploits spatial locality to reduce the trips into the rmap.
+When shrink_page_list() walks the rmap and finds a young PTE, a new
+function lru_gen_look_around() scans at most BITS_PER_LONG-1 adjacent
+PTEs.  On finding another young PTE, it clears the accessed bit and
+updates the gen counter of the page mapped by this PTE to
+(max_seq%MAX_NR_GENS)+1.
+
+Server benchmark results:
+  Single workload:
+    fio (buffered I/O): no change
+
+  Single workload:
+    memcached (anon): +[3, 5]%
+                Ops/sec      KB/sec
+      patch1-6: 1106168.46   43025.04
+      patch1-7: 1147696.57   44640.29
+
+  Configurations:
+    no change
+
+Client benchmark results:
+  kswapd profiles:
+    patch1-6
+      39.03%  lzo1x_1_do_compress (real work)
+      18.47%  page_vma_mapped_walk (overhead)
+       6.74%  _raw_spin_unlock_irq
+       3.97%  do_raw_spin_lock
+       2.49%  ptep_clear_flush
+       2.48%  anon_vma_interval_tree_iter_first
+       1.92%  page_referenced_one
+       1.88%  __zram_bvec_write
+       1.48%  memmove
+       1.31%  vma_interval_tree_iter_next
+
+    patch1-7
+      48.16%  lzo1x_1_do_compress (real work)
+       8.20%  page_vma_mapped_walk (overhead)
+       7.06%  _raw_spin_unlock_irq
+       2.92%  ptep_clear_flush
+       2.53%  __zram_bvec_write
+       2.11%  do_raw_spin_lock
+       2.02%  memmove
+       1.93%  lru_gen_look_around
+       1.56%  free_unref_page_list
+       1.40%  memset
+
+  Configurations:
+    no change
+
+Link: https://lkml.kernel.org/r/20220918080010.2920238-8-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Acked-by: Barry Song <baohua@kernel.org>
+Acked-by: Brian Geffon <bgeffon@google.com>
+Acked-by: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
+Acked-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Acked-by: Steven Barrett <steven@liquorix.net>
+Acked-by: Suleiman Souhlal <suleiman@google.com>
+Tested-by: Daniel Byrne <djbyrne@mtu.edu>
+Tested-by: Donald Carr <d@chaos-reins.com>
+Tested-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+Tested-by: Konstantin Kharlamov <Hi-Angel@yandex.ru>
+Tested-by: Shuang Zhai <szhai2@cs.rochester.edu>
+Tested-by: Sofia Trinh <sofia.trinh@edi.works>
+Tested-by: Vaibhav Jain <vaibhav@linux.ibm.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Hillf Danton <hdanton@sina.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Miaohe Lin <linmiaohe@huawei.com>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Mike Rapoport <rppt@linux.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Qi Zheng <zhengqi.arch@bytedance.com>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ include/linux/memcontrol.h |  31 +++++++
+ include/linux/mmzone.h     |   6 ++
+ mm/internal.h              |   1 +
+ mm/memcontrol.c            |   1 +
+ mm/rmap.c                  |   7 ++
+ mm/swap.c                  |   4 +-
+ mm/vmscan.c                | 184 +++++++++++++++++++++++++++++++++++++
+ 7 files changed, 232 insertions(+), 2 deletions(-)
+
+--- a/include/linux/memcontrol.h
++++ b/include/linux/memcontrol.h
+@@ -442,6 +442,7 @@ static inline struct obj_cgroup *__page_
+  * - LRU isolation
+  * - lock_page_memcg()
+  * - exclusive reference
++ * - mem_cgroup_trylock_pages()
+  *
+  * For a kmem page a caller should hold an rcu read lock to protect memcg
+  * associated with a kmem page from being released.
+@@ -497,6 +498,7 @@ static inline struct mem_cgroup *page_me
+  * - LRU isolation
+  * - lock_page_memcg()
+  * - exclusive reference
++ * - mem_cgroup_trylock_pages()
+  *
+  * For a kmem page a caller should hold an rcu read lock to protect memcg
+  * associated with a kmem page from being released.
+@@ -953,6 +955,23 @@ void unlock_page_memcg(struct page *page
+ 
+ void __mod_memcg_state(struct mem_cgroup *memcg, int idx, int val);
+ 
++/* try to stablize page_memcg() for all the pages in a memcg */
++static inline bool mem_cgroup_trylock_pages(struct mem_cgroup *memcg)
++{
++	rcu_read_lock();
++
++	if (mem_cgroup_disabled() || !atomic_read(&memcg->moving_account))
++		return true;
++
++	rcu_read_unlock();
++	return false;
++}
++
++static inline void mem_cgroup_unlock_pages(void)
++{
++	rcu_read_unlock();
++}
++
+ /* idx can be of type enum memcg_stat_item or node_stat_item */
+ static inline void mod_memcg_state(struct mem_cgroup *memcg,
+ 				   int idx, int val)
+@@ -1369,6 +1388,18 @@ static inline void unlock_page_memcg(str
+ {
+ }
+ 
++static inline bool mem_cgroup_trylock_pages(struct mem_cgroup *memcg)
++{
++	/* to match page_memcg_rcu() */
++	rcu_read_lock();
++	return true;
++}
++
++static inline void mem_cgroup_unlock_pages(void)
++{
++	rcu_read_unlock();
++}
++
+ static inline void mem_cgroup_handle_over_high(void)
+ {
+ }
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -352,6 +352,7 @@ enum lruvec_flags {
+ #ifndef __GENERATING_BOUNDS_H
+ 
+ struct lruvec;
++struct page_vma_mapped_walk;
+ 
+ #define LRU_GEN_MASK		((BIT(LRU_GEN_WIDTH) - 1) << LRU_GEN_PGOFF)
+ #define LRU_REFS_MASK		((BIT(LRU_REFS_WIDTH) - 1) << LRU_REFS_PGOFF)
+@@ -407,6 +408,7 @@ struct lru_gen_struct {
+ };
+ 
+ void lru_gen_init_lruvec(struct lruvec *lruvec);
++void lru_gen_look_around(struct page_vma_mapped_walk *pvmw);
+ 
+ #ifdef CONFIG_MEMCG
+ void lru_gen_init_memcg(struct mem_cgroup *memcg);
+@@ -419,6 +421,10 @@ static inline void lru_gen_init_lruvec(s
+ {
+ }
+ 
++static inline void lru_gen_look_around(struct page_vma_mapped_walk *pvmw)
++{
++}
++
+ #ifdef CONFIG_MEMCG
+ static inline void lru_gen_init_memcg(struct mem_cgroup *memcg)
+ {
+--- a/mm/internal.h
++++ b/mm/internal.h
+@@ -35,6 +35,7 @@
+ void page_writeback_init(void);
+ 
+ vm_fault_t do_swap_page(struct vm_fault *vmf);
++void activate_page(struct page *page);
+ 
+ void free_pgtables(struct mmu_gather *tlb, struct vm_area_struct *start_vma,
+ 		unsigned long floor, unsigned long ceiling);
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -2798,6 +2798,7 @@ static void commit_charge(struct page *p
+ 	 * - LRU isolation
+ 	 * - lock_page_memcg()
+ 	 * - exclusive reference
++	 * - mem_cgroup_trylock_pages()
+ 	 */
+ 	page->memcg_data = (unsigned long)memcg;
+ }
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -73,6 +73,7 @@
+ #include <linux/page_idle.h>
+ #include <linux/memremap.h>
+ #include <linux/userfaultfd_k.h>
++#include <linux/mm_inline.h>
+ 
+ #include <asm/tlbflush.h>
+ 
+@@ -793,6 +794,12 @@ static bool page_referenced_one(struct p
+ 		}
+ 
+ 		if (pvmw.pte) {
++			if (lru_gen_enabled() && pte_young(*pvmw.pte) &&
++			    !(vma->vm_flags & (VM_SEQ_READ | VM_RAND_READ))) {
++				lru_gen_look_around(&pvmw);
++				referenced++;
++			}
++
+ 			if (ptep_clear_flush_young_notify(vma, address,
+ 						pvmw.pte)) {
+ 				/*
+--- a/mm/swap.c
++++ b/mm/swap.c
+@@ -325,7 +325,7 @@ static bool need_activate_page_drain(int
+ 	return pagevec_count(&per_cpu(lru_pvecs.activate_page, cpu)) != 0;
+ }
+ 
+-static void activate_page(struct page *page)
++void activate_page(struct page *page)
+ {
+ 	page = compound_head(page);
+ 	if (PageLRU(page) && !PageActive(page) && !PageUnevictable(page)) {
+@@ -345,7 +345,7 @@ static inline void activate_page_drain(i
+ {
+ }
+ 
+-static void activate_page(struct page *page)
++void activate_page(struct page *page)
+ {
+ 	struct lruvec *lruvec;
+ 
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -1409,6 +1409,11 @@ retry:
+ 		if (!sc->may_unmap && page_mapped(page))
+ 			goto keep_locked;
+ 
++		/* page_update_gen() tried to promote this page? */
++		if (lru_gen_enabled() && !ignore_references &&
++		    page_mapped(page) && PageReferenced(page))
++			goto keep_locked;
++
+ 		may_enter_fs = (sc->gfp_mask & __GFP_FS) ||
+ 			(PageSwapCache(page) && (sc->gfp_mask & __GFP_IO));
+ 
+@@ -2990,6 +2995,29 @@ static bool positive_ctrl_err(struct ctr
+  *                          the aging
+  ******************************************************************************/
+ 
++/* promote pages accessed through page tables */
++static int page_update_gen(struct page *page, int gen)
++{
++	unsigned long new_flags, old_flags = READ_ONCE(page->flags);
++
++	VM_WARN_ON_ONCE(gen >= MAX_NR_GENS);
++	VM_WARN_ON_ONCE(!rcu_read_lock_held());
++
++	do {
++		/* lru_gen_del_page() has isolated this page? */
++		if (!(old_flags & LRU_GEN_MASK)) {
++			/* for shrink_page_list() */
++			new_flags = old_flags | BIT(PG_referenced);
++			continue;
++		}
++
++		new_flags = old_flags & ~(LRU_GEN_MASK | LRU_REFS_MASK | LRU_REFS_FLAGS);
++		new_flags |= (gen + 1UL) << LRU_GEN_PGOFF;
++	} while (!try_cmpxchg(&page->flags, &old_flags, new_flags));
++
++	return ((old_flags & LRU_GEN_MASK) >> LRU_GEN_PGOFF) - 1;
++}
++
+ /* protect pages accessed multiple times through file descriptors */
+ static int page_inc_gen(struct lruvec *lruvec, struct page *page, bool reclaiming)
+ {
+@@ -3001,6 +3029,11 @@ static int page_inc_gen(struct lruvec *l
+ 	VM_WARN_ON_ONCE_PAGE(!(old_flags & LRU_GEN_MASK), page);
+ 
+ 	do {
++		new_gen = ((old_flags & LRU_GEN_MASK) >> LRU_GEN_PGOFF) - 1;
++		/* page_update_gen() has promoted this page? */
++		if (new_gen >= 0 && new_gen != old_gen)
++			return new_gen;
++
+ 		new_gen = (old_gen + 1) % MAX_NR_GENS;
+ 
+ 		new_flags = old_flags & ~(LRU_GEN_MASK | LRU_REFS_MASK | LRU_REFS_FLAGS);
+@@ -3015,6 +3048,43 @@ static int page_inc_gen(struct lruvec *l
+ 	return new_gen;
+ }
+ 
++static unsigned long get_pte_pfn(pte_t pte, struct vm_area_struct *vma, unsigned long addr)
++{
++	unsigned long pfn = pte_pfn(pte);
++
++	VM_WARN_ON_ONCE(addr < vma->vm_start || addr >= vma->vm_end);
++
++	if (!pte_present(pte) || is_zero_pfn(pfn))
++		return -1;
++
++	if (WARN_ON_ONCE(pte_devmap(pte) || pte_special(pte)))
++		return -1;
++
++	if (WARN_ON_ONCE(!pfn_valid(pfn)))
++		return -1;
++
++	return pfn;
++}
++
++static struct page *get_pfn_page(unsigned long pfn, struct mem_cgroup *memcg,
++				 struct pglist_data *pgdat)
++{
++	struct page *page;
++
++	/* try to avoid unnecessary memory loads */
++	if (pfn < pgdat->node_start_pfn || pfn >= pgdat_end_pfn(pgdat))
++		return NULL;
++
++	page = compound_head(pfn_to_page(pfn));
++	if (page_to_nid(page) != pgdat->node_id)
++		return NULL;
++
++	if (page_memcg_rcu(page) != memcg)
++		return NULL;
++
++	return page;
++}
++
+ static void inc_min_seq(struct lruvec *lruvec, int type)
+ {
+ 	struct lru_gen_struct *lrugen = &lruvec->lrugen;
+@@ -3214,6 +3284,114 @@ static void lru_gen_age_node(struct pgli
+ 	} while ((memcg = mem_cgroup_iter(NULL, memcg, NULL)));
+ }
+ 
++/*
++ * This function exploits spatial locality when shrink_page_list() walks the
++ * rmap. It scans the adjacent PTEs of a young PTE and promotes hot pages.
++ */
++void lru_gen_look_around(struct page_vma_mapped_walk *pvmw)
++{
++	int i;
++	pte_t *pte;
++	unsigned long start;
++	unsigned long end;
++	unsigned long addr;
++	unsigned long bitmap[BITS_TO_LONGS(MIN_LRU_BATCH)] = {};
++	struct page *page = pvmw->page;
++	struct mem_cgroup *memcg = page_memcg(page);
++	struct pglist_data *pgdat = page_pgdat(page);
++	struct lruvec *lruvec = mem_cgroup_lruvec(memcg, pgdat);
++	DEFINE_MAX_SEQ(lruvec);
++	int old_gen, new_gen = lru_gen_from_seq(max_seq);
++
++	lockdep_assert_held(pvmw->ptl);
++	VM_WARN_ON_ONCE_PAGE(PageLRU(page), page);
++
++	if (spin_is_contended(pvmw->ptl))
++		return;
++
++	start = max(pvmw->address & PMD_MASK, pvmw->vma->vm_start);
++	end = min(pvmw->address | ~PMD_MASK, pvmw->vma->vm_end - 1) + 1;
++
++	if (end - start > MIN_LRU_BATCH * PAGE_SIZE) {
++		if (pvmw->address - start < MIN_LRU_BATCH * PAGE_SIZE / 2)
++			end = start + MIN_LRU_BATCH * PAGE_SIZE;
++		else if (end - pvmw->address < MIN_LRU_BATCH * PAGE_SIZE / 2)
++			start = end - MIN_LRU_BATCH * PAGE_SIZE;
++		else {
++			start = pvmw->address - MIN_LRU_BATCH * PAGE_SIZE / 2;
++			end = pvmw->address + MIN_LRU_BATCH * PAGE_SIZE / 2;
++		}
++	}
++
++	pte = pvmw->pte - (pvmw->address - start) / PAGE_SIZE;
++
++	rcu_read_lock();
++	arch_enter_lazy_mmu_mode();
++
++	for (i = 0, addr = start; addr != end; i++, addr += PAGE_SIZE) {
++		unsigned long pfn;
++
++		pfn = get_pte_pfn(pte[i], pvmw->vma, addr);
++		if (pfn == -1)
++			continue;
++
++		if (!pte_young(pte[i]))
++			continue;
++
++		page = get_pfn_page(pfn, memcg, pgdat);
++		if (!page)
++			continue;
++
++		if (!ptep_test_and_clear_young(pvmw->vma, addr, pte + i))
++			VM_WARN_ON_ONCE(true);
++
++		if (pte_dirty(pte[i]) && !PageDirty(page) &&
++		    !(PageAnon(page) && PageSwapBacked(page) &&
++		      !PageSwapCache(page)))
++			set_page_dirty(page);
++
++		old_gen = page_lru_gen(page);
++		if (old_gen < 0)
++			SetPageReferenced(page);
++		else if (old_gen != new_gen)
++			__set_bit(i, bitmap);
++	}
++
++	arch_leave_lazy_mmu_mode();
++	rcu_read_unlock();
++
++	if (bitmap_weight(bitmap, MIN_LRU_BATCH) < PAGEVEC_SIZE) {
++		for_each_set_bit(i, bitmap, MIN_LRU_BATCH) {
++			page = pte_page(pte[i]);
++			activate_page(page);
++		}
++		return;
++	}
++
++	/* page_update_gen() requires stable page_memcg() */
++	if (!mem_cgroup_trylock_pages(memcg))
++		return;
++
++	spin_lock_irq(&lruvec->lru_lock);
++	new_gen = lru_gen_from_seq(lruvec->lrugen.max_seq);
++
++	for_each_set_bit(i, bitmap, MIN_LRU_BATCH) {
++		page = compound_head(pte_page(pte[i]));
++		if (page_memcg_rcu(page) != memcg)
++			continue;
++
++		old_gen = page_update_gen(page, new_gen);
++		if (old_gen < 0 || old_gen == new_gen)
++			continue;
++
++		lru_gen_update_size(lruvec, page, old_gen, new_gen);
++	}
++
++	spin_unlock_irq(&lruvec->lru_lock);
++
++	mem_cgroup_unlock_pages();
++}
++
+ /******************************************************************************
+  *                          the eviction
+  ******************************************************************************/
+@@ -3250,6 +3428,12 @@ static bool sort_page(struct lruvec *lru
+ 		return true;
+ 	}
+ 
++	/* promoted */
++	if (gen != lru_gen_from_seq(lrugen->min_seq[type])) {
++		list_move(&page->lru, &lrugen->lists[gen][type][zone]);
++		return true;
++	}
++
+ 	/* protected */
+ 	if (tier > tier_idx) {
+ 		int hist = lru_hist_from_seq(lrugen->min_seq[type]);
diff --git a/target/linux/generic/backport-5.15/020-v6.1-08-mm-multi-gen-LRU-support-page-table-walks.patch b/target/linux/generic/backport-5.15/020-v6.1-08-mm-multi-gen-LRU-support-page-table-walks.patch
new file mode 100644
index 00000000000000..dad21dccb58eb6
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.1-08-mm-multi-gen-LRU-support-page-table-walks.patch
@@ -0,0 +1,1687 @@
+From 05223c4e80b34e29f2255c04ffebc2c4475e7593 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Sun, 18 Sep 2022 02:00:05 -0600
+Subject: [PATCH 08/29] mm: multi-gen LRU: support page table walks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+To further exploit spatial locality, the aging prefers to walk page tables
+to search for young PTEs and promote hot pages.  A kill switch will be
+added in the next patch to disable this behavior.  When disabled, the
+aging relies on the rmap only.
+
+NB: this behavior has nothing similar with the page table scanning in the
+2.4 kernel [1], which searches page tables for old PTEs, adds cold pages
+to swapcache and unmaps them.
+
+To avoid confusion, the term "iteration" specifically means the traversal
+of an entire mm_struct list; the term "walk" will be applied to page
+tables and the rmap, as usual.
+
+An mm_struct list is maintained for each memcg, and an mm_struct follows
+its owner task to the new memcg when this task is migrated.  Given an
+lruvec, the aging iterates lruvec_memcg()->mm_list and calls
+walk_page_range() with each mm_struct on this list to promote hot pages
+before it increments max_seq.
+
+When multiple page table walkers iterate the same list, each of them gets
+a unique mm_struct; therefore they can run concurrently.  Page table
+walkers ignore any misplaced pages, e.g., if an mm_struct was migrated,
+pages it left in the previous memcg will not be promoted when its current
+memcg is under reclaim.  Similarly, page table walkers will not promote
+pages from nodes other than the one under reclaim.
+
+This patch uses the following optimizations when walking page tables:
+1. It tracks the usage of mm_struct's between context switches so that
+   page table walkers can skip processes that have been sleeping since
+   the last iteration.
+2. It uses generational Bloom filters to record populated branches so
+   that page table walkers can reduce their search space based on the
+   query results, e.g., to skip page tables containing mostly holes or
+   misplaced pages.
+3. It takes advantage of the accessed bit in non-leaf PMD entries when
+   CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG=y.
+4. It does not zigzag between a PGD table and the same PMD table
+   spanning multiple VMAs. IOW, it finishes all the VMAs within the
+   range of the same PMD table before it returns to a PGD table. This
+   improves the cache performance for workloads that have large
+   numbers of tiny VMAs [2], especially when CONFIG_PGTABLE_LEVELS=5.
+
+Server benchmark results:
+  Single workload:
+    fio (buffered I/O): no change
+
+  Single workload:
+    memcached (anon): +[8, 10]%
+                Ops/sec      KB/sec
+      patch1-7: 1147696.57   44640.29
+      patch1-8: 1245274.91   48435.66
+
+  Configurations:
+    no change
+
+Client benchmark results:
+  kswapd profiles:
+    patch1-7
+      48.16%  lzo1x_1_do_compress (real work)
+       8.20%  page_vma_mapped_walk (overhead)
+       7.06%  _raw_spin_unlock_irq
+       2.92%  ptep_clear_flush
+       2.53%  __zram_bvec_write
+       2.11%  do_raw_spin_lock
+       2.02%  memmove
+       1.93%  lru_gen_look_around
+       1.56%  free_unref_page_list
+       1.40%  memset
+
+    patch1-8
+      49.44%  lzo1x_1_do_compress (real work)
+       6.19%  page_vma_mapped_walk (overhead)
+       5.97%  _raw_spin_unlock_irq
+       3.13%  get_pfn_page
+       2.85%  ptep_clear_flush
+       2.42%  __zram_bvec_write
+       2.08%  do_raw_spin_lock
+       1.92%  memmove
+       1.44%  alloc_zspage
+       1.36%  memset
+
+  Configurations:
+    no change
+
+Thanks to the following developers for their efforts [3].
+  kernel test robot <lkp@intel.com>
+
+[1] https://lwn.net/Articles/23732/
+[2] https://llvm.org/docs/ScudoHardenedAllocator.html
+[3] https://lore.kernel.org/r/202204160827.ekEARWQo-lkp@intel.com/
+
+Link: https://lkml.kernel.org/r/20220918080010.2920238-9-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Acked-by: Brian Geffon <bgeffon@google.com>
+Acked-by: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
+Acked-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Acked-by: Steven Barrett <steven@liquorix.net>
+Acked-by: Suleiman Souhlal <suleiman@google.com>
+Tested-by: Daniel Byrne <djbyrne@mtu.edu>
+Tested-by: Donald Carr <d@chaos-reins.com>
+Tested-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+Tested-by: Konstantin Kharlamov <Hi-Angel@yandex.ru>
+Tested-by: Shuang Zhai <szhai2@cs.rochester.edu>
+Tested-by: Sofia Trinh <sofia.trinh@edi.works>
+Tested-by: Vaibhav Jain <vaibhav@linux.ibm.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Cc: Barry Song <baohua@kernel.org>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Hillf Danton <hdanton@sina.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Miaohe Lin <linmiaohe@huawei.com>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Mike Rapoport <rppt@linux.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Qi Zheng <zhengqi.arch@bytedance.com>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ fs/exec.c                  |    2 +
+ include/linux/memcontrol.h |    5 +
+ include/linux/mm_types.h   |   76 +++
+ include/linux/mmzone.h     |   56 +-
+ include/linux/swap.h       |    4 +
+ kernel/exit.c              |    1 +
+ kernel/fork.c              |    9 +
+ kernel/sched/core.c        |    1 +
+ mm/memcontrol.c            |   25 +
+ mm/vmscan.c                | 1010 +++++++++++++++++++++++++++++++++++-
+ 10 files changed, 1172 insertions(+), 17 deletions(-)
+
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1013,6 +1013,7 @@ static int exec_mmap(struct mm_struct *m
+ 	active_mm = tsk->active_mm;
+ 	tsk->active_mm = mm;
+ 	tsk->mm = mm;
++	lru_gen_add_mm(mm);
+ 	/*
+ 	 * This prevents preemption while active_mm is being loaded and
+ 	 * it and mm are being updated, which could cause problems for
+@@ -1028,6 +1029,7 @@ static int exec_mmap(struct mm_struct *m
+ 	tsk->mm->vmacache_seqnum = 0;
+ 	vmacache_flush(tsk);
+ 	task_unlock(tsk);
++	lru_gen_use_mm(mm);
+ 	if (old_mm) {
+ 		mmap_read_unlock(old_mm);
+ 		BUG_ON(active_mm != old_mm);
+--- a/include/linux/memcontrol.h
++++ b/include/linux/memcontrol.h
+@@ -348,6 +348,11 @@ struct mem_cgroup {
+ 	struct deferred_split deferred_split_queue;
+ #endif
+ 
++#ifdef CONFIG_LRU_GEN
++	/* per-memcg mm_struct list */
++	struct lru_gen_mm_list mm_list;
++#endif
++
+ 	struct mem_cgroup_per_node *nodeinfo[];
+ };
+ 
+--- a/include/linux/mm_types.h
++++ b/include/linux/mm_types.h
+@@ -580,6 +580,22 @@ struct mm_struct {
+ #ifdef CONFIG_IOMMU_SUPPORT
+ 		u32 pasid;
+ #endif
++#ifdef CONFIG_LRU_GEN
++		struct {
++			/* this mm_struct is on lru_gen_mm_list */
++			struct list_head list;
++			/*
++			 * Set when switching to this mm_struct, as a hint of
++			 * whether it has been used since the last time per-node
++			 * page table walkers cleared the corresponding bits.
++			 */
++			unsigned long bitmap;
++#ifdef CONFIG_MEMCG
++			/* points to the memcg of "owner" above */
++			struct mem_cgroup *memcg;
++#endif
++		} lru_gen;
++#endif /* CONFIG_LRU_GEN */
+ 	} __randomize_layout;
+ 
+ 	/*
+@@ -606,6 +622,66 @@ static inline cpumask_t *mm_cpumask(stru
+ 	return (struct cpumask *)&mm->cpu_bitmap;
+ }
+ 
++#ifdef CONFIG_LRU_GEN
++
++struct lru_gen_mm_list {
++	/* mm_struct list for page table walkers */
++	struct list_head fifo;
++	/* protects the list above */
++	spinlock_t lock;
++};
++
++void lru_gen_add_mm(struct mm_struct *mm);
++void lru_gen_del_mm(struct mm_struct *mm);
++#ifdef CONFIG_MEMCG
++void lru_gen_migrate_mm(struct mm_struct *mm);
++#endif
++
++static inline void lru_gen_init_mm(struct mm_struct *mm)
++{
++	INIT_LIST_HEAD(&mm->lru_gen.list);
++	mm->lru_gen.bitmap = 0;
++#ifdef CONFIG_MEMCG
++	mm->lru_gen.memcg = NULL;
++#endif
++}
++
++static inline void lru_gen_use_mm(struct mm_struct *mm)
++{
++	/*
++	 * When the bitmap is set, page reclaim knows this mm_struct has been
++	 * used since the last time it cleared the bitmap. So it might be worth
++	 * walking the page tables of this mm_struct to clear the accessed bit.
++	 */
++	WRITE_ONCE(mm->lru_gen.bitmap, -1);
++}
++
++#else /* !CONFIG_LRU_GEN */
++
++static inline void lru_gen_add_mm(struct mm_struct *mm)
++{
++}
++
++static inline void lru_gen_del_mm(struct mm_struct *mm)
++{
++}
++
++#ifdef CONFIG_MEMCG
++static inline void lru_gen_migrate_mm(struct mm_struct *mm)
++{
++}
++#endif
++
++static inline void lru_gen_init_mm(struct mm_struct *mm)
++{
++}
++
++static inline void lru_gen_use_mm(struct mm_struct *mm)
++{
++}
++
++#endif /* CONFIG_LRU_GEN */
++
+ struct mmu_gather;
+ extern void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm);
+ extern void tlb_gather_mmu_fullmm(struct mmu_gather *tlb, struct mm_struct *mm);
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -385,7 +385,7 @@ enum {
+  * min_seq behind.
+  *
+  * The number of pages in each generation is eventually consistent and therefore
+- * can be transiently negative.
++ * can be transiently negative when reset_batch_size() is pending.
+  */
+ struct lru_gen_struct {
+ 	/* the aging increments the youngest generation number */
+@@ -407,6 +407,53 @@ struct lru_gen_struct {
+ 	atomic_long_t refaulted[NR_HIST_GENS][ANON_AND_FILE][MAX_NR_TIERS];
+ };
+ 
++enum {
++	MM_LEAF_TOTAL,		/* total leaf entries */
++	MM_LEAF_OLD,		/* old leaf entries */
++	MM_LEAF_YOUNG,		/* young leaf entries */
++	MM_NONLEAF_TOTAL,	/* total non-leaf entries */
++	MM_NONLEAF_FOUND,	/* non-leaf entries found in Bloom filters */
++	MM_NONLEAF_ADDED,	/* non-leaf entries added to Bloom filters */
++	NR_MM_STATS
++};
++
++/* double-buffering Bloom filters */
++#define NR_BLOOM_FILTERS	2
++
++struct lru_gen_mm_state {
++	/* set to max_seq after each iteration */
++	unsigned long seq;
++	/* where the current iteration continues (inclusive) */
++	struct list_head *head;
++	/* where the last iteration ended (exclusive) */
++	struct list_head *tail;
++	/* to wait for the last page table walker to finish */
++	struct wait_queue_head wait;
++	/* Bloom filters flip after each iteration */
++	unsigned long *filters[NR_BLOOM_FILTERS];
++	/* the mm stats for debugging */
++	unsigned long stats[NR_HIST_GENS][NR_MM_STATS];
++	/* the number of concurrent page table walkers */
++	int nr_walkers;
++};
++
++struct lru_gen_mm_walk {
++	/* the lruvec under reclaim */
++	struct lruvec *lruvec;
++	/* unstable max_seq from lru_gen_struct */
++	unsigned long max_seq;
++	/* the next address within an mm to scan */
++	unsigned long next_addr;
++	/* to batch promoted pages */
++	int nr_pages[MAX_NR_GENS][ANON_AND_FILE][MAX_NR_ZONES];
++	/* to batch the mm stats */
++	int mm_stats[NR_MM_STATS];
++	/* total batched items */
++	int batched;
++	bool can_swap;
++	bool force_scan;
++};
++
+ void lru_gen_init_lruvec(struct lruvec *lruvec);
+ void lru_gen_look_around(struct page_vma_mapped_walk *pvmw);
+ 
+@@ -457,6 +504,8 @@ struct lruvec {
+ #ifdef CONFIG_LRU_GEN
+ 	/* evictable pages divided into generations */
+ 	struct lru_gen_struct		lrugen;
++	/* to concurrently iterate lru_gen_mm_list */
++	struct lru_gen_mm_state		mm_state;
+ #endif
+ #ifdef CONFIG_MEMCG
+ 	struct pglist_data *pgdat;
+@@ -1042,6 +1091,11 @@ typedef struct pglist_data {
+ 
+ 	unsigned long		flags;
+ 
++#ifdef CONFIG_LRU_GEN
++	/* kswap mm walk data */
++	struct lru_gen_mm_walk	mm_walk;
++#endif
++
+ 	ZONE_PADDING(_pad2_)
+ 
+ 	/* Per-node vmstats */
+--- a/include/linux/swap.h
++++ b/include/linux/swap.h
+@@ -137,6 +137,10 @@ union swap_header {
+  */
+ struct reclaim_state {
+ 	unsigned long reclaimed_slab;
++#ifdef CONFIG_LRU_GEN
++	/* per-thread mm walk data */
++	struct lru_gen_mm_walk *mm_walk;
++#endif
+ };
+ 
+ #ifdef __KERNEL__
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -469,6 +469,7 @@ assign_new_owner:
+ 		goto retry;
+ 	}
+ 	WRITE_ONCE(mm->owner, c);
++	lru_gen_migrate_mm(mm);
+ 	task_unlock(c);
+ 	put_task_struct(c);
+ }
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1083,6 +1083,7 @@ static struct mm_struct *mm_init(struct
+ 		goto fail_nocontext;
+ 
+ 	mm->user_ns = get_user_ns(user_ns);
++	lru_gen_init_mm(mm);
+ 	return mm;
+ 
+ fail_nocontext:
+@@ -1125,6 +1126,7 @@ static inline void __mmput(struct mm_str
+ 	}
+ 	if (mm->binfmt)
+ 		module_put(mm->binfmt->module);
++	lru_gen_del_mm(mm);
+ 	mmdrop(mm);
+ }
+ 
+@@ -2622,6 +2624,13 @@ pid_t kernel_clone(struct kernel_clone_a
+ 		get_task_struct(p);
+ 	}
+ 
++	if (IS_ENABLED(CONFIG_LRU_GEN) && !(clone_flags & CLONE_VM)) {
++		/* lock the task to synchronize with memcg migration */
++		task_lock(p);
++		lru_gen_add_mm(p->mm);
++		task_unlock(p);
++	}
++
+ 	wake_up_new_task(p);
+ 
+ 	/* forking complete and child started to run, tell ptracer */
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -5010,6 +5010,7 @@ context_switch(struct rq *rq, struct tas
+ 		 * finish_task_switch()'s mmdrop().
+ 		 */
+ 		switch_mm_irqs_off(prev->active_mm, next->mm, next);
++		lru_gen_use_mm(next->mm);
+ 
+ 		if (!prev->mm) {                        // from kernel
+ 			/* will mmdrop() in finish_task_switch(). */
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -6212,6 +6212,30 @@ static void mem_cgroup_move_task(void)
+ }
+ #endif
+ 
++#ifdef CONFIG_LRU_GEN
++static void mem_cgroup_attach(struct cgroup_taskset *tset)
++{
++	struct task_struct *task;
++	struct cgroup_subsys_state *css;
++
++	/* find the first leader if there is any */
++	cgroup_taskset_for_each_leader(task, css, tset)
++		break;
++
++	if (!task)
++		return;
++
++	task_lock(task);
++	if (task->mm && READ_ONCE(task->mm->owner) == task)
++		lru_gen_migrate_mm(task->mm);
++	task_unlock(task);
++}
++#else
++static void mem_cgroup_attach(struct cgroup_taskset *tset)
++{
++}
++#endif /* CONFIG_LRU_GEN */
++
+ static int seq_puts_memcg_tunable(struct seq_file *m, unsigned long value)
+ {
+ 	if (value == PAGE_COUNTER_MAX)
+@@ -6555,6 +6579,7 @@ struct cgroup_subsys memory_cgrp_subsys
+ 	.css_reset = mem_cgroup_css_reset,
+ 	.css_rstat_flush = mem_cgroup_css_rstat_flush,
+ 	.can_attach = mem_cgroup_can_attach,
++	.attach = mem_cgroup_attach,
+ 	.cancel_attach = mem_cgroup_cancel_attach,
+ 	.post_attach = mem_cgroup_move_task,
+ 	.dfl_cftypes = memory_files,
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -50,6 +50,8 @@
+ #include <linux/printk.h>
+ #include <linux/dax.h>
+ #include <linux/psi.h>
++#include <linux/pagewalk.h>
++#include <linux/shmem_fs.h>
+ 
+ #include <asm/tlbflush.h>
+ #include <asm/div64.h>
+@@ -2853,7 +2855,7 @@ static bool can_age_anon_pages(struct pg
+ 		for ((type) = 0; (type) < ANON_AND_FILE; (type)++)	\
+ 			for ((zone) = 0; (zone) < MAX_NR_ZONES; (zone)++)
+ 
+-static struct lruvec __maybe_unused *get_lruvec(struct mem_cgroup *memcg, int nid)
++static struct lruvec *get_lruvec(struct mem_cgroup *memcg, int nid)
+ {
+ 	struct pglist_data *pgdat = NODE_DATA(nid);
+ 
+@@ -2899,6 +2901,371 @@ static bool __maybe_unused seq_is_valid(
+ }
+ 
+ /******************************************************************************
++ *                          mm_struct list
++ ******************************************************************************/
++
++static struct lru_gen_mm_list *get_mm_list(struct mem_cgroup *memcg)
++{
++	static struct lru_gen_mm_list mm_list = {
++		.fifo = LIST_HEAD_INIT(mm_list.fifo),
++		.lock = __SPIN_LOCK_UNLOCKED(mm_list.lock),
++	};
++
++#ifdef CONFIG_MEMCG
++	if (memcg)
++		return &memcg->mm_list;
++#endif
++	VM_WARN_ON_ONCE(!mem_cgroup_disabled());
++
++	return &mm_list;
++}
++
++void lru_gen_add_mm(struct mm_struct *mm)
++{
++	int nid;
++	struct mem_cgroup *memcg = get_mem_cgroup_from_mm(mm);
++	struct lru_gen_mm_list *mm_list = get_mm_list(memcg);
++
++	VM_WARN_ON_ONCE(!list_empty(&mm->lru_gen.list));
++#ifdef CONFIG_MEMCG
++	VM_WARN_ON_ONCE(mm->lru_gen.memcg);
++	mm->lru_gen.memcg = memcg;
++#endif
++	spin_lock(&mm_list->lock);
++
++	for_each_node_state(nid, N_MEMORY) {
++		struct lruvec *lruvec = get_lruvec(memcg, nid);
++
++		if (!lruvec)
++			continue;
++
++		/* the first addition since the last iteration */
++		if (lruvec->mm_state.tail == &mm_list->fifo)
++			lruvec->mm_state.tail = &mm->lru_gen.list;
++	}
++
++	list_add_tail(&mm->lru_gen.list, &mm_list->fifo);
++
++	spin_unlock(&mm_list->lock);
++}
++
++void lru_gen_del_mm(struct mm_struct *mm)
++{
++	int nid;
++	struct lru_gen_mm_list *mm_list;
++	struct mem_cgroup *memcg = NULL;
++
++	if (list_empty(&mm->lru_gen.list))
++		return;
++
++#ifdef CONFIG_MEMCG
++	memcg = mm->lru_gen.memcg;
++#endif
++	mm_list = get_mm_list(memcg);
++
++	spin_lock(&mm_list->lock);
++
++	for_each_node(nid) {
++		struct lruvec *lruvec = get_lruvec(memcg, nid);
++
++		if (!lruvec)
++			continue;
++
++		/* where the last iteration ended (exclusive) */
++		if (lruvec->mm_state.tail == &mm->lru_gen.list)
++			lruvec->mm_state.tail = lruvec->mm_state.tail->next;
++
++		/* where the current iteration continues (inclusive) */
++		if (lruvec->mm_state.head != &mm->lru_gen.list)
++			continue;
++
++		lruvec->mm_state.head = lruvec->mm_state.head->next;
++		/* the deletion ends the current iteration */
++		if (lruvec->mm_state.head == &mm_list->fifo)
++			WRITE_ONCE(lruvec->mm_state.seq, lruvec->mm_state.seq + 1);
++	}
++
++	list_del_init(&mm->lru_gen.list);
++
++	spin_unlock(&mm_list->lock);
++
++#ifdef CONFIG_MEMCG
++	mem_cgroup_put(mm->lru_gen.memcg);
++	mm->lru_gen.memcg = NULL;
++#endif
++}
++
++#ifdef CONFIG_MEMCG
++void lru_gen_migrate_mm(struct mm_struct *mm)
++{
++	struct mem_cgroup *memcg;
++	struct task_struct *task = rcu_dereference_protected(mm->owner, true);
++
++	VM_WARN_ON_ONCE(task->mm != mm);
++	lockdep_assert_held(&task->alloc_lock);
++
++	/* for mm_update_next_owner() */
++	if (mem_cgroup_disabled())
++		return;
++
++	rcu_read_lock();
++	memcg = mem_cgroup_from_task(task);
++	rcu_read_unlock();
++	if (memcg == mm->lru_gen.memcg)
++		return;
++
++	VM_WARN_ON_ONCE(!mm->lru_gen.memcg);
++	VM_WARN_ON_ONCE(list_empty(&mm->lru_gen.list));
++
++	lru_gen_del_mm(mm);
++	lru_gen_add_mm(mm);
++}
++#endif
++
++/*
++ * Bloom filters with m=1<<15, k=2 and the false positive rates of ~1/5 when
++ * n=10,000 and ~1/2 when n=20,000, where, conventionally, m is the number of
++ * bits in a bitmap, k is the number of hash functions and n is the number of
++ * inserted items.
++ *
++ * Page table walkers use one of the two filters to reduce their search space.
++ * To get rid of non-leaf entries that no longer have enough leaf entries, the
++ * aging uses the double-buffering technique to flip to the other filter each
++ * time it produces a new generation. For non-leaf entries that have enough
++ * leaf entries, the aging carries them over to the next generation in
++ * walk_pmd_range(); the eviction also report them when walking the rmap
++ * in lru_gen_look_around().
++ *
++ * For future optimizations:
++ * 1. It's not necessary to keep both filters all the time. The spare one can be
++ *    freed after the RCU grace period and reallocated if needed again.
++ * 2. And when reallocating, it's worth scaling its size according to the number
++ *    of inserted entries in the other filter, to reduce the memory overhead on
++ *    small systems and false positives on large systems.
++ * 3. Jenkins' hash function is an alternative to Knuth's.
++ */
++#define BLOOM_FILTER_SHIFT	15
++
++static inline int filter_gen_from_seq(unsigned long seq)
++{
++	return seq % NR_BLOOM_FILTERS;
++}
++
++static void get_item_key(void *item, int *key)
++{
++	u32 hash = hash_ptr(item, BLOOM_FILTER_SHIFT * 2);
++
++	BUILD_BUG_ON(BLOOM_FILTER_SHIFT * 2 > BITS_PER_TYPE(u32));
++
++	key[0] = hash & (BIT(BLOOM_FILTER_SHIFT) - 1);
++	key[1] = hash >> BLOOM_FILTER_SHIFT;
++}
++
++static void reset_bloom_filter(struct lruvec *lruvec, unsigned long seq)
++{
++	unsigned long *filter;
++	int gen = filter_gen_from_seq(seq);
++
++	filter = lruvec->mm_state.filters[gen];
++	if (filter) {
++		bitmap_clear(filter, 0, BIT(BLOOM_FILTER_SHIFT));
++		return;
++	}
++
++	filter = bitmap_zalloc(BIT(BLOOM_FILTER_SHIFT),
++			       __GFP_HIGH | __GFP_NOMEMALLOC | __GFP_NOWARN);
++	WRITE_ONCE(lruvec->mm_state.filters[gen], filter);
++}
++
++static void update_bloom_filter(struct lruvec *lruvec, unsigned long seq, void *item)
++{
++	int key[2];
++	unsigned long *filter;
++	int gen = filter_gen_from_seq(seq);
++
++	filter = READ_ONCE(lruvec->mm_state.filters[gen]);
++	if (!filter)
++		return;
++
++	get_item_key(item, key);
++
++	if (!test_bit(key[0], filter))
++		set_bit(key[0], filter);
++	if (!test_bit(key[1], filter))
++		set_bit(key[1], filter);
++}
++
++static bool test_bloom_filter(struct lruvec *lruvec, unsigned long seq, void *item)
++{
++	int key[2];
++	unsigned long *filter;
++	int gen = filter_gen_from_seq(seq);
++
++	filter = READ_ONCE(lruvec->mm_state.filters[gen]);
++	if (!filter)
++		return true;
++
++	get_item_key(item, key);
++
++	return test_bit(key[0], filter) && test_bit(key[1], filter);
++}
++
++static void reset_mm_stats(struct lruvec *lruvec, struct lru_gen_mm_walk *walk, bool last)
++{
++	int i;
++	int hist;
++
++	lockdep_assert_held(&get_mm_list(lruvec_memcg(lruvec))->lock);
++
++	if (walk) {
++		hist = lru_hist_from_seq(walk->max_seq);
++
++		for (i = 0; i < NR_MM_STATS; i++) {
++			WRITE_ONCE(lruvec->mm_state.stats[hist][i],
++				   lruvec->mm_state.stats[hist][i] + walk->mm_stats[i]);
++			walk->mm_stats[i] = 0;
++		}
++	}
++
++	if (NR_HIST_GENS > 1 && last) {
++		hist = lru_hist_from_seq(lruvec->mm_state.seq + 1);
++
++		for (i = 0; i < NR_MM_STATS; i++)
++			WRITE_ONCE(lruvec->mm_state.stats[hist][i], 0);
++	}
++}
++
++static bool should_skip_mm(struct mm_struct *mm, struct lru_gen_mm_walk *walk)
++{
++	int type;
++	unsigned long size = 0;
++	struct pglist_data *pgdat = lruvec_pgdat(walk->lruvec);
++	int key = pgdat->node_id % BITS_PER_TYPE(mm->lru_gen.bitmap);
++
++	if (!walk->force_scan && !test_bit(key, &mm->lru_gen.bitmap))
++		return true;
++
++	clear_bit(key, &mm->lru_gen.bitmap);
++
++	for (type = !walk->can_swap; type < ANON_AND_FILE; type++) {
++		size += type ? get_mm_counter(mm, MM_FILEPAGES) :
++			       get_mm_counter(mm, MM_ANONPAGES) +
++			       get_mm_counter(mm, MM_SHMEMPAGES);
++	}
++
++	if (size < MIN_LRU_BATCH)
++		return true;
++
++	return !mmget_not_zero(mm);
++}
++
++static bool iterate_mm_list(struct lruvec *lruvec, struct lru_gen_mm_walk *walk,
++			    struct mm_struct **iter)
++{
++	bool first = false;
++	bool last = true;
++	struct mm_struct *mm = NULL;
++	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
++	struct lru_gen_mm_list *mm_list = get_mm_list(memcg);
++	struct lru_gen_mm_state *mm_state = &lruvec->mm_state;
++
++	/*
++	 * There are four interesting cases for this page table walker:
++	 * 1. It tries to start a new iteration of mm_list with a stale max_seq;
++	 *    there is nothing left to do.
++	 * 2. It's the first of the current generation, and it needs to reset
++	 *    the Bloom filter for the next generation.
++	 * 3. It reaches the end of mm_list, and it needs to increment
++	 *    mm_state->seq; the iteration is done.
++	 * 4. It's the last of the current generation, and it needs to reset the
++	 *    mm stats counters for the next generation.
++	 */
++	spin_lock(&mm_list->lock);
++
++	VM_WARN_ON_ONCE(mm_state->seq + 1 < walk->max_seq);
++	VM_WARN_ON_ONCE(*iter && mm_state->seq > walk->max_seq);
++	VM_WARN_ON_ONCE(*iter && !mm_state->nr_walkers);
++
++	if (walk->max_seq <= mm_state->seq) {
++		if (!*iter)
++			last = false;
++		goto done;
++	}
++
++	if (!mm_state->nr_walkers) {
++		VM_WARN_ON_ONCE(mm_state->head && mm_state->head != &mm_list->fifo);
++
++		mm_state->head = mm_list->fifo.next;
++		first = true;
++	}
++
++	while (!mm && mm_state->head != &mm_list->fifo) {
++		mm = list_entry(mm_state->head, struct mm_struct, lru_gen.list);
++
++		mm_state->head = mm_state->head->next;
++
++		/* force scan for those added after the last iteration */
++		if (!mm_state->tail || mm_state->tail == &mm->lru_gen.list) {
++			mm_state->tail = mm_state->head;
++			walk->force_scan = true;
++		}
++
++		if (should_skip_mm(mm, walk))
++			mm = NULL;
++	}
++
++	if (mm_state->head == &mm_list->fifo)
++		WRITE_ONCE(mm_state->seq, mm_state->seq + 1);
++done:
++	if (*iter && !mm)
++		mm_state->nr_walkers--;
++	if (!*iter && mm)
++		mm_state->nr_walkers++;
++
++	if (mm_state->nr_walkers)
++		last = false;
++
++	if (*iter || last)
++		reset_mm_stats(lruvec, walk, last);
++
++	spin_unlock(&mm_list->lock);
++
++	if (mm && first)
++		reset_bloom_filter(lruvec, walk->max_seq + 1);
++
++	if (*iter)
++		mmput_async(*iter);
++
++	*iter = mm;
++
++	return last;
++}
++
++static bool iterate_mm_list_nowalk(struct lruvec *lruvec, unsigned long max_seq)
++{
++	bool success = false;
++	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
++	struct lru_gen_mm_list *mm_list = get_mm_list(memcg);
++	struct lru_gen_mm_state *mm_state = &lruvec->mm_state;
++
++	spin_lock(&mm_list->lock);
++
++	VM_WARN_ON_ONCE(mm_state->seq + 1 < max_seq);
++
++	if (max_seq > mm_state->seq && !mm_state->nr_walkers) {
++		VM_WARN_ON_ONCE(mm_state->head && mm_state->head != &mm_list->fifo);
++
++		WRITE_ONCE(mm_state->seq, mm_state->seq + 1);
++		reset_mm_stats(lruvec, NULL, true);
++		success = true;
++	}
++
++	spin_unlock(&mm_list->lock);
++
++	return success;
++}
++
++/******************************************************************************
+  *                          refault feedback loop
+  ******************************************************************************/
+ 
+@@ -3048,6 +3415,118 @@ static int page_inc_gen(struct lruvec *l
+ 	return new_gen;
+ }
+ 
++static void update_batch_size(struct lru_gen_mm_walk *walk, struct page *page,
++			      int old_gen, int new_gen)
++{
++	int type = page_is_file_lru(page);
++	int zone = page_zonenum(page);
++	int delta = thp_nr_pages(page);
++
++	VM_WARN_ON_ONCE(old_gen >= MAX_NR_GENS);
++	VM_WARN_ON_ONCE(new_gen >= MAX_NR_GENS);
++
++	walk->batched++;
++
++	walk->nr_pages[old_gen][type][zone] -= delta;
++	walk->nr_pages[new_gen][type][zone] += delta;
++}
++
++static void reset_batch_size(struct lruvec *lruvec, struct lru_gen_mm_walk *walk)
++{
++	int gen, type, zone;
++	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++
++	walk->batched = 0;
++
++	for_each_gen_type_zone(gen, type, zone) {
++		enum lru_list lru = type * LRU_INACTIVE_FILE;
++		int delta = walk->nr_pages[gen][type][zone];
++
++		if (!delta)
++			continue;
++
++		walk->nr_pages[gen][type][zone] = 0;
++		WRITE_ONCE(lrugen->nr_pages[gen][type][zone],
++			   lrugen->nr_pages[gen][type][zone] + delta);
++
++		if (lru_gen_is_active(lruvec, gen))
++			lru += LRU_ACTIVE;
++		__update_lru_size(lruvec, lru, zone, delta);
++	}
++}
++
++static int should_skip_vma(unsigned long start, unsigned long end, struct mm_walk *args)
++{
++	struct address_space *mapping;
++	struct vm_area_struct *vma = args->vma;
++	struct lru_gen_mm_walk *walk = args->private;
++
++	if (!vma_is_accessible(vma))
++		return true;
++
++	if (is_vm_hugetlb_page(vma))
++		return true;
++
++	if (vma->vm_flags & (VM_LOCKED | VM_SPECIAL | VM_SEQ_READ | VM_RAND_READ))
++		return true;
++
++	if (vma == get_gate_vma(vma->vm_mm))
++		return true;
++
++	if (vma_is_anonymous(vma))
++		return !walk->can_swap;
++
++	if (WARN_ON_ONCE(!vma->vm_file || !vma->vm_file->f_mapping))
++		return true;
++
++	mapping = vma->vm_file->f_mapping;
++	if (mapping_unevictable(mapping))
++		return true;
++
++	if (shmem_mapping(mapping))
++		return !walk->can_swap;
++
++	/* to exclude special mappings like dax, etc. */
++	return !mapping->a_ops->readpage;
++}
++
++/*
++ * Some userspace memory allocators map many single-page VMAs. Instead of
++ * returning back to the PGD table for each of such VMAs, finish an entire PMD
++ * table to reduce zigzags and improve cache performance.
++ */
++static bool get_next_vma(unsigned long mask, unsigned long size, struct mm_walk *args,
++			 unsigned long *vm_start, unsigned long *vm_end)
++{
++	unsigned long start = round_up(*vm_end, size);
++	unsigned long end = (start | ~mask) + 1;
++
++	VM_WARN_ON_ONCE(mask & size);
++	VM_WARN_ON_ONCE((start & mask) != (*vm_start & mask));
++
++	while (args->vma) {
++		if (start >= args->vma->vm_end) {
++			args->vma = args->vma->vm_next;
++			continue;
++		}
++
++		if (end && end <= args->vma->vm_start)
++			return false;
++
++		if (should_skip_vma(args->vma->vm_start, args->vma->vm_end, args)) {
++			args->vma = args->vma->vm_next;
++			continue;
++		}
++
++		*vm_start = max(start, args->vma->vm_start);
++		*vm_end = min(end - 1, args->vma->vm_end - 1) + 1;
++
++		return true;
++	}
++
++	return false;
++}
++
+ static unsigned long get_pte_pfn(pte_t pte, struct vm_area_struct *vma, unsigned long addr)
+ {
+ 	unsigned long pfn = pte_pfn(pte);
+@@ -3066,8 +3545,28 @@ static unsigned long get_pte_pfn(pte_t p
+ 	return pfn;
+ }
+ 
++#if defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined(CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG)
++static unsigned long get_pmd_pfn(pmd_t pmd, struct vm_area_struct *vma, unsigned long addr)
++{
++	unsigned long pfn = pmd_pfn(pmd);
++
++	VM_WARN_ON_ONCE(addr < vma->vm_start || addr >= vma->vm_end);
++
++	if (!pmd_present(pmd) || is_huge_zero_pmd(pmd))
++		return -1;
++
++	if (WARN_ON_ONCE(pmd_devmap(pmd)))
++		return -1;
++
++	if (WARN_ON_ONCE(!pfn_valid(pfn)))
++		return -1;
++
++	return pfn;
++}
++#endif
++
+ static struct page *get_pfn_page(unsigned long pfn, struct mem_cgroup *memcg,
+-				 struct pglist_data *pgdat)
++				 struct pglist_data *pgdat, bool can_swap)
+ {
+ 	struct page *page;
+ 
+@@ -3082,9 +3581,375 @@ static struct page *get_pfn_page(unsigne
+ 	if (page_memcg_rcu(page) != memcg)
+ 		return NULL;
+ 
++	/* file VMAs can contain anon pages from COW */
++	if (!page_is_file_lru(page) && !can_swap)
++		return NULL;
++
+ 	return page;
+ }
+ 
++static bool suitable_to_scan(int total, int young)
++{
++	int n = clamp_t(int, cache_line_size() / sizeof(pte_t), 2, 8);
++
++	/* suitable if the average number of young PTEs per cacheline is >=1 */
++	return young * n >= total;
++}
++
++static bool walk_pte_range(pmd_t *pmd, unsigned long start, unsigned long end,
++			   struct mm_walk *args)
++{
++	int i;
++	pte_t *pte;
++	spinlock_t *ptl;
++	unsigned long addr;
++	int total = 0;
++	int young = 0;
++	struct lru_gen_mm_walk *walk = args->private;
++	struct mem_cgroup *memcg = lruvec_memcg(walk->lruvec);
++	struct pglist_data *pgdat = lruvec_pgdat(walk->lruvec);
++	int old_gen, new_gen = lru_gen_from_seq(walk->max_seq);
++
++	VM_WARN_ON_ONCE(pmd_leaf(*pmd));
++
++	ptl = pte_lockptr(args->mm, pmd);
++	if (!spin_trylock(ptl))
++		return false;
++
++	arch_enter_lazy_mmu_mode();
++
++	pte = pte_offset_map(pmd, start & PMD_MASK);
++restart:
++	for (i = pte_index(start), addr = start; addr != end; i++, addr += PAGE_SIZE) {
++		unsigned long pfn;
++		struct page *page;
++
++		total++;
++		walk->mm_stats[MM_LEAF_TOTAL]++;
++
++		pfn = get_pte_pfn(pte[i], args->vma, addr);
++		if (pfn == -1)
++			continue;
++
++		if (!pte_young(pte[i])) {
++			walk->mm_stats[MM_LEAF_OLD]++;
++			continue;
++		}
++
++		page = get_pfn_page(pfn, memcg, pgdat, walk->can_swap);
++		if (!page)
++			continue;
++
++		if (!ptep_test_and_clear_young(args->vma, addr, pte + i))
++			VM_WARN_ON_ONCE(true);
++
++		young++;
++		walk->mm_stats[MM_LEAF_YOUNG]++;
++
++		if (pte_dirty(pte[i]) && !PageDirty(page) &&
++		    !(PageAnon(page) && PageSwapBacked(page) &&
++		      !PageSwapCache(page)))
++			set_page_dirty(page);
++
++		old_gen = page_update_gen(page, new_gen);
++		if (old_gen >= 0 && old_gen != new_gen)
++			update_batch_size(walk, page, old_gen, new_gen);
++	}
++
++	if (i < PTRS_PER_PTE && get_next_vma(PMD_MASK, PAGE_SIZE, args, &start, &end))
++		goto restart;
++
++	pte_unmap(pte);
++
++	arch_leave_lazy_mmu_mode();
++	spin_unlock(ptl);
++
++	return suitable_to_scan(total, young);
++}
++
++#if defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined(CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG)
++static void walk_pmd_range_locked(pud_t *pud, unsigned long next, struct vm_area_struct *vma,
++				  struct mm_walk *args, unsigned long *bitmap, unsigned long *start)
++{
++	int i;
++	pmd_t *pmd;
++	spinlock_t *ptl;
++	struct lru_gen_mm_walk *walk = args->private;
++	struct mem_cgroup *memcg = lruvec_memcg(walk->lruvec);
++	struct pglist_data *pgdat = lruvec_pgdat(walk->lruvec);
++	int old_gen, new_gen = lru_gen_from_seq(walk->max_seq);
++
++	VM_WARN_ON_ONCE(pud_leaf(*pud));
++
++	/* try to batch at most 1+MIN_LRU_BATCH+1 entries */
++	if (*start == -1) {
++		*start = next;
++		return;
++	}
++
++	i = next == -1 ? 0 : pmd_index(next) - pmd_index(*start);
++	if (i && i <= MIN_LRU_BATCH) {
++		__set_bit(i - 1, bitmap);
++		return;
++	}
++
++	pmd = pmd_offset(pud, *start);
++
++	ptl = pmd_lockptr(args->mm, pmd);
++	if (!spin_trylock(ptl))
++		goto done;
++
++	arch_enter_lazy_mmu_mode();
++
++	do {
++		unsigned long pfn;
++		struct page *page;
++		unsigned long addr = i ? (*start & PMD_MASK) + i * PMD_SIZE : *start;
++
++		pfn = get_pmd_pfn(pmd[i], vma, addr);
++		if (pfn == -1)
++			goto next;
++
++		if (!pmd_trans_huge(pmd[i])) {
++			if (IS_ENABLED(CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG))
++				pmdp_test_and_clear_young(vma, addr, pmd + i);
++			goto next;
++		}
++
++		page = get_pfn_page(pfn, memcg, pgdat, walk->can_swap);
++		if (!page)
++			goto next;
++
++		if (!pmdp_test_and_clear_young(vma, addr, pmd + i))
++			goto next;
++
++		walk->mm_stats[MM_LEAF_YOUNG]++;
++
++		if (pmd_dirty(pmd[i]) && !PageDirty(page) &&
++		    !(PageAnon(page) && PageSwapBacked(page) &&
++		      !PageSwapCache(page)))
++			set_page_dirty(page);
++
++		old_gen = page_update_gen(page, new_gen);
++		if (old_gen >= 0 && old_gen != new_gen)
++			update_batch_size(walk, page, old_gen, new_gen);
++next:
++		i = i > MIN_LRU_BATCH ? 0 : find_next_bit(bitmap, MIN_LRU_BATCH, i) + 1;
++	} while (i <= MIN_LRU_BATCH);
++
++	arch_leave_lazy_mmu_mode();
++	spin_unlock(ptl);
++done:
++	*start = -1;
++	bitmap_zero(bitmap, MIN_LRU_BATCH);
++}
++#else
++static void walk_pmd_range_locked(pud_t *pud, unsigned long next, struct vm_area_struct *vma,
++				  struct mm_walk *args, unsigned long *bitmap, unsigned long *start)
++{
++}
++#endif
++
++static void walk_pmd_range(pud_t *pud, unsigned long start, unsigned long end,
++			   struct mm_walk *args)
++{
++	int i;
++	pmd_t *pmd;
++	unsigned long next;
++	unsigned long addr;
++	struct vm_area_struct *vma;
++	unsigned long pos = -1;
++	struct lru_gen_mm_walk *walk = args->private;
++	unsigned long bitmap[BITS_TO_LONGS(MIN_LRU_BATCH)] = {};
++
++	VM_WARN_ON_ONCE(pud_leaf(*pud));
++
++	/*
++	 * Finish an entire PMD in two passes: the first only reaches to PTE
++	 * tables to avoid taking the PMD lock; the second, if necessary, takes
++	 * the PMD lock to clear the accessed bit in PMD entries.
++	 */
++	pmd = pmd_offset(pud, start & PUD_MASK);
++restart:
++	/* walk_pte_range() may call get_next_vma() */
++	vma = args->vma;
++	for (i = pmd_index(start), addr = start; addr != end; i++, addr = next) {
++		pmd_t val = pmd_read_atomic(pmd + i);
++
++		/* for pmd_read_atomic() */
++		barrier();
++
++		next = pmd_addr_end(addr, end);
++
++		if (!pmd_present(val) || is_huge_zero_pmd(val)) {
++			walk->mm_stats[MM_LEAF_TOTAL]++;
++			continue;
++		}
++
++#ifdef CONFIG_TRANSPARENT_HUGEPAGE
++		if (pmd_trans_huge(val)) {
++			unsigned long pfn = pmd_pfn(val);
++			struct pglist_data *pgdat = lruvec_pgdat(walk->lruvec);
++
++			walk->mm_stats[MM_LEAF_TOTAL]++;
++
++			if (!pmd_young(val)) {
++				walk->mm_stats[MM_LEAF_OLD]++;
++				continue;
++			}
++
++			/* try to avoid unnecessary memory loads */
++			if (pfn < pgdat->node_start_pfn || pfn >= pgdat_end_pfn(pgdat))
++				continue;
++
++			walk_pmd_range_locked(pud, addr, vma, args, bitmap, &pos);
++			continue;
++		}
++#endif
++		walk->mm_stats[MM_NONLEAF_TOTAL]++;
++
++#ifdef CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG
++		if (!pmd_young(val))
++			continue;
++
++		walk_pmd_range_locked(pud, addr, vma, args, bitmap, &pos);
++#endif
++		if (!walk->force_scan && !test_bloom_filter(walk->lruvec, walk->max_seq, pmd + i))
++			continue;
++
++		walk->mm_stats[MM_NONLEAF_FOUND]++;
++
++		if (!walk_pte_range(&val, addr, next, args))
++			continue;
++
++		walk->mm_stats[MM_NONLEAF_ADDED]++;
++
++		/* carry over to the next generation */
++		update_bloom_filter(walk->lruvec, walk->max_seq + 1, pmd + i);
++	}
++
++	walk_pmd_range_locked(pud, -1, vma, args, bitmap, &pos);
++
++	if (i < PTRS_PER_PMD && get_next_vma(PUD_MASK, PMD_SIZE, args, &start, &end))
++		goto restart;
++}
++
++static int walk_pud_range(p4d_t *p4d, unsigned long start, unsigned long end,
++			  struct mm_walk *args)
++{
++	int i;
++	pud_t *pud;
++	unsigned long addr;
++	unsigned long next;
++	struct lru_gen_mm_walk *walk = args->private;
++
++	VM_WARN_ON_ONCE(p4d_leaf(*p4d));
++
++	pud = pud_offset(p4d, start & P4D_MASK);
++restart:
++	for (i = pud_index(start), addr = start; addr != end; i++, addr = next) {
++		pud_t val = READ_ONCE(pud[i]);
++
++		next = pud_addr_end(addr, end);
++
++		if (!pud_present(val) || WARN_ON_ONCE(pud_leaf(val)))
++			continue;
++
++		walk_pmd_range(&val, addr, next, args);
++
++		/* a racy check to curtail the waiting time */
++		if (wq_has_sleeper(&walk->lruvec->mm_state.wait))
++			return 1;
++
++		if (need_resched() || walk->batched >= MAX_LRU_BATCH) {
++			end = (addr | ~PUD_MASK) + 1;
++			goto done;
++		}
++	}
++
++	if (i < PTRS_PER_PUD && get_next_vma(P4D_MASK, PUD_SIZE, args, &start, &end))
++		goto restart;
++
++	end = round_up(end, P4D_SIZE);
++done:
++	if (!end || !args->vma)
++		return 1;
++
++	walk->next_addr = max(end, args->vma->vm_start);
++
++	return -EAGAIN;
++}
++
++static void walk_mm(struct lruvec *lruvec, struct mm_struct *mm, struct lru_gen_mm_walk *walk)
++{
++	static const struct mm_walk_ops mm_walk_ops = {
++		.test_walk = should_skip_vma,
++		.p4d_entry = walk_pud_range,
++	};
++
++	int err;
++	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
++
++	walk->next_addr = FIRST_USER_ADDRESS;
++
++	do {
++		err = -EBUSY;
++
++		/* page_update_gen() requires stable page_memcg() */
++		if (!mem_cgroup_trylock_pages(memcg))
++			break;
++
++		/* the caller might be holding the lock for write */
++		if (mmap_read_trylock(mm)) {
++			err = walk_page_range(mm, walk->next_addr, ULONG_MAX, &mm_walk_ops, walk);
++
++			mmap_read_unlock(mm);
++		}
++
++		mem_cgroup_unlock_pages();
++
++		if (walk->batched) {
++			spin_lock_irq(&lruvec->lru_lock);
++			reset_batch_size(lruvec, walk);
++			spin_unlock_irq(&lruvec->lru_lock);
++		}
++
++		cond_resched();
++	} while (err == -EAGAIN);
++}
++
++static struct lru_gen_mm_walk *set_mm_walk(struct pglist_data *pgdat)
++{
++	struct lru_gen_mm_walk *walk = current->reclaim_state->mm_walk;
++
++	if (pgdat && current_is_kswapd()) {
++		VM_WARN_ON_ONCE(walk);
++
++		walk = &pgdat->mm_walk;
++	} else if (!pgdat && !walk) {
++		VM_WARN_ON_ONCE(current_is_kswapd());
++
++		walk = kzalloc(sizeof(*walk), __GFP_HIGH | __GFP_NOMEMALLOC | __GFP_NOWARN);
++	}
++
++	current->reclaim_state->mm_walk = walk;
++
++	return walk;
++}
++
++static void clear_mm_walk(void)
++{
++	struct lru_gen_mm_walk *walk = current->reclaim_state->mm_walk;
++
++	VM_WARN_ON_ONCE(walk && memchr_inv(walk->nr_pages, 0, sizeof(walk->nr_pages)));
++	VM_WARN_ON_ONCE(walk && memchr_inv(walk->mm_stats, 0, sizeof(walk->mm_stats)));
++
++	current->reclaim_state->mm_walk = NULL;
++
++	if (!current_is_kswapd())
++		kfree(walk);
++}
++
+ static void inc_min_seq(struct lruvec *lruvec, int type)
+ {
+ 	struct lru_gen_struct *lrugen = &lruvec->lrugen;
+@@ -3136,7 +4001,7 @@ next:
+ 	return success;
+ }
+ 
+-static void inc_max_seq(struct lruvec *lruvec, unsigned long max_seq, bool can_swap)
++static void inc_max_seq(struct lruvec *lruvec, bool can_swap)
+ {
+ 	int prev, next;
+ 	int type, zone;
+@@ -3146,9 +4011,6 @@ static void inc_max_seq(struct lruvec *l
+ 
+ 	VM_WARN_ON_ONCE(!seq_is_valid(lruvec));
+ 
+-	if (max_seq != lrugen->max_seq)
+-		goto unlock;
+-
+ 	for (type = ANON_AND_FILE - 1; type >= 0; type--) {
+ 		if (get_nr_gens(lruvec, type) != MAX_NR_GENS)
+ 			continue;
+@@ -3186,10 +4048,76 @@ static void inc_max_seq(struct lruvec *l
+ 
+ 	/* make sure preceding modifications appear */
+ 	smp_store_release(&lrugen->max_seq, lrugen->max_seq + 1);
+-unlock:
++
+ 	spin_unlock_irq(&lruvec->lru_lock);
+ }
+ 
++static bool try_to_inc_max_seq(struct lruvec *lruvec, unsigned long max_seq,
++			       struct scan_control *sc, bool can_swap)
++{
++	bool success;
++	struct lru_gen_mm_walk *walk;
++	struct mm_struct *mm = NULL;
++	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++
++	VM_WARN_ON_ONCE(max_seq > READ_ONCE(lrugen->max_seq));
++
++	/* see the comment in iterate_mm_list() */
++	if (max_seq <= READ_ONCE(lruvec->mm_state.seq)) {
++		success = false;
++		goto done;
++	}
++
++	/*
++	 * If the hardware doesn't automatically set the accessed bit, fallback
++	 * to lru_gen_look_around(), which only clears the accessed bit in a
++	 * handful of PTEs. Spreading the work out over a period of time usually
++	 * is less efficient, but it avoids bursty page faults.
++	 */
++	if (!arch_has_hw_pte_young()) {
++		success = iterate_mm_list_nowalk(lruvec, max_seq);
++		goto done;
++	}
++
++	walk = set_mm_walk(NULL);
++	if (!walk) {
++		success = iterate_mm_list_nowalk(lruvec, max_seq);
++		goto done;
++	}
++
++	walk->lruvec = lruvec;
++	walk->max_seq = max_seq;
++	walk->can_swap = can_swap;
++	walk->force_scan = false;
++
++	do {
++		success = iterate_mm_list(lruvec, walk, &mm);
++		if (mm)
++			walk_mm(lruvec, mm, walk);
++
++		cond_resched();
++	} while (mm);
++done:
++	if (!success) {
++		if (sc->priority <= DEF_PRIORITY - 2)
++			wait_event_killable(lruvec->mm_state.wait,
++					    max_seq < READ_ONCE(lrugen->max_seq));
++
++		return max_seq < READ_ONCE(lrugen->max_seq);
++	}
++
++	VM_WARN_ON_ONCE(max_seq != READ_ONCE(lrugen->max_seq));
++
++	inc_max_seq(lruvec, can_swap);
++	/* either this sees any waiters or they will see updated max_seq */
++	if (wq_has_sleeper(&lruvec->mm_state.wait))
++		wake_up_all(&lruvec->mm_state.wait);
++
++	wakeup_flusher_threads(WB_REASON_VMSCAN);
++
++	return true;
++}
++
+ static bool should_run_aging(struct lruvec *lruvec, unsigned long max_seq, unsigned long *min_seq,
+ 			     struct scan_control *sc, bool can_swap, unsigned long *nr_to_scan)
+ {
+@@ -3265,7 +4193,7 @@ static void age_lruvec(struct lruvec *lr
+ 
+ 	need_aging = should_run_aging(lruvec, max_seq, min_seq, sc, swappiness, &nr_to_scan);
+ 	if (need_aging)
+-		inc_max_seq(lruvec, max_seq, swappiness);
++		try_to_inc_max_seq(lruvec, max_seq, sc, swappiness);
+ }
+ 
+ static void lru_gen_age_node(struct pglist_data *pgdat, struct scan_control *sc)
+@@ -3274,6 +4202,8 @@ static void lru_gen_age_node(struct pgli
+ 
+ 	VM_WARN_ON_ONCE(!current_is_kswapd());
+ 
++	set_mm_walk(pgdat);
++
+ 	memcg = mem_cgroup_iter(NULL, NULL, NULL);
+ 	do {
+ 		struct lruvec *lruvec = mem_cgroup_lruvec(memcg, pgdat);
+@@ -3282,11 +4212,16 @@ static void lru_gen_age_node(struct pgli
+ 
+ 		cond_resched();
+ 	} while ((memcg = mem_cgroup_iter(NULL, memcg, NULL)));
++
++	clear_mm_walk();
+ }
+ 
+ /*
+  * This function exploits spatial locality when shrink_page_list() walks the
+- * rmap. It scans the adjacent PTEs of a young PTE and promotes hot pages.
++ * rmap. It scans the adjacent PTEs of a young PTE and promotes hot pages. If
++ * the scan was done cacheline efficiently, it adds the PMD entry pointing to
++ * the PTE table to the Bloom filter. This forms a feedback loop between the
++ * eviction and the aging.
+  */
+ void lru_gen_look_around(struct page_vma_mapped_walk *pvmw)
+ {
+@@ -3295,6 +4230,8 @@ void lru_gen_look_around(struct page_vma
+ 	unsigned long start;
+ 	unsigned long end;
+ 	unsigned long addr;
++	struct lru_gen_mm_walk *walk;
++	int young = 0;
+ 	unsigned long bitmap[BITS_TO_LONGS(MIN_LRU_BATCH)] = {};
+ 	struct page *page = pvmw->page;
+ 	struct mem_cgroup *memcg = page_memcg(page);
+@@ -3309,6 +4246,9 @@ void lru_gen_look_around(struct page_vma
+ 	if (spin_is_contended(pvmw->ptl))
+ 		return;
+ 
++	/* avoid taking the LRU lock under the PTL when possible */
++	walk = current->reclaim_state ? current->reclaim_state->mm_walk : NULL;
++
+ 	start = max(pvmw->address & PMD_MASK, pvmw->vma->vm_start);
+ 	end = min(pvmw->address | ~PMD_MASK, pvmw->vma->vm_end - 1) + 1;
+ 
+@@ -3338,13 +4278,15 @@ void lru_gen_look_around(struct page_vma
+ 		if (!pte_young(pte[i]))
+ 			continue;
+ 
+-		page = get_pfn_page(pfn, memcg, pgdat);
++		page = get_pfn_page(pfn, memcg, pgdat, !walk || walk->can_swap);
+ 		if (!page)
+ 			continue;
+ 
+ 		if (!ptep_test_and_clear_young(pvmw->vma, addr, pte + i))
+ 			VM_WARN_ON_ONCE(true);
+ 
++		young++;
++
+ 		if (pte_dirty(pte[i]) && !PageDirty(page) &&
+ 		    !(PageAnon(page) && PageSwapBacked(page) &&
+ 		      !PageSwapCache(page)))
+@@ -3360,7 +4302,11 @@ void lru_gen_look_around(struct page_vma
+ 	arch_leave_lazy_mmu_mode();
+ 	rcu_read_unlock();
+ 
+-	if (bitmap_weight(bitmap, MIN_LRU_BATCH) < PAGEVEC_SIZE) {
++	/* feedback from rmap walkers to page table walkers */
++	if (suitable_to_scan(i, young))
++		update_bloom_filter(lruvec, max_seq, pvmw->pmd);
++
++	if (!walk && bitmap_weight(bitmap, MIN_LRU_BATCH) < PAGEVEC_SIZE) {
+ 		for_each_set_bit(i, bitmap, MIN_LRU_BATCH) {
+ 			page = pte_page(pte[i]);
+ 			activate_page(page);
+@@ -3372,8 +4318,10 @@ void lru_gen_look_around(struct page_vma
+ 	if (!mem_cgroup_trylock_pages(memcg))
+ 		return;
+ 
+-	spin_lock_irq(&lruvec->lru_lock);
+-	new_gen = lru_gen_from_seq(lruvec->lrugen.max_seq);
++	if (!walk) {
++		spin_lock_irq(&lruvec->lru_lock);
++		new_gen = lru_gen_from_seq(lruvec->lrugen.max_seq);
++	}
+ 
+ 	for_each_set_bit(i, bitmap, MIN_LRU_BATCH) {
+ 		page = compound_head(pte_page(pte[i]));
+@@ -3384,10 +4332,14 @@ void lru_gen_look_around(struct page_vma
+ 		if (old_gen < 0 || old_gen == new_gen)
+ 			continue;
+ 
+-		lru_gen_update_size(lruvec, page, old_gen, new_gen);
++		if (walk)
++			update_batch_size(walk, page, old_gen, new_gen);
++		else
++			lru_gen_update_size(lruvec, page, old_gen, new_gen);
+ 	}
+ 
+-	spin_unlock_irq(&lruvec->lru_lock);
++	if (!walk)
++		spin_unlock_irq(&lruvec->lru_lock);
+ 
+ 	mem_cgroup_unlock_pages();
+ }
+@@ -3670,6 +4622,7 @@ static int evict_pages(struct lruvec *lr
+ 	struct page *page;
+ 	enum vm_event_item item;
+ 	struct reclaim_stat stat;
++	struct lru_gen_mm_walk *walk;
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+ 	struct pglist_data *pgdat = lruvec_pgdat(lruvec);
+ 
+@@ -3706,6 +4659,10 @@ static int evict_pages(struct lruvec *lr
+ 
+ 	move_pages_to_lru(lruvec, &list);
+ 
++	walk = current->reclaim_state->mm_walk;
++	if (walk && walk->batched)
++		reset_batch_size(lruvec, walk);
++
+ 	item = current_is_kswapd() ? PGSTEAL_KSWAPD : PGSTEAL_DIRECT;
+ 	if (!cgroup_reclaim(sc))
+ 		__count_vm_events(item, reclaimed);
+@@ -3722,6 +4679,11 @@ static int evict_pages(struct lruvec *lr
+ 	return scanned;
+ }
+ 
++/*
++ * For future optimizations:
++ * 1. Defer try_to_inc_max_seq() to workqueues to reduce latency for memcg
++ *    reclaim.
++ */
+ static unsigned long get_nr_to_scan(struct lruvec *lruvec, struct scan_control *sc,
+ 				    bool can_swap)
+ {
+@@ -3747,7 +4709,8 @@ static unsigned long get_nr_to_scan(stru
+ 	if (current_is_kswapd())
+ 		return 0;
+ 
+-	inc_max_seq(lruvec, max_seq, can_swap);
++	if (try_to_inc_max_seq(lruvec, max_seq, sc, can_swap))
++		return nr_to_scan;
+ done:
+ 	return min_seq[!can_swap] + MIN_NR_GENS <= max_seq ? nr_to_scan : 0;
+ }
+@@ -3761,6 +4724,8 @@ static void lru_gen_shrink_lruvec(struct
+ 
+ 	blk_start_plug(&plug);
+ 
++	set_mm_walk(lruvec_pgdat(lruvec));
++
+ 	while (true) {
+ 		int delta;
+ 		int swappiness;
+@@ -3788,6 +4753,8 @@ static void lru_gen_shrink_lruvec(struct
+ 		cond_resched();
+ 	}
+ 
++	clear_mm_walk();
++
+ 	blk_finish_plug(&plug);
+ }
+ 
+@@ -3804,15 +4771,21 @@ void lru_gen_init_lruvec(struct lruvec *
+ 
+ 	for_each_gen_type_zone(gen, type, zone)
+ 		INIT_LIST_HEAD(&lrugen->lists[gen][type][zone]);
++
++	lruvec->mm_state.seq = MIN_NR_GENS;
++	init_waitqueue_head(&lruvec->mm_state.wait);
+ }
+ 
+ #ifdef CONFIG_MEMCG
+ void lru_gen_init_memcg(struct mem_cgroup *memcg)
+ {
++	INIT_LIST_HEAD(&memcg->mm_list.fifo);
++	spin_lock_init(&memcg->mm_list.lock);
+ }
+ 
+ void lru_gen_exit_memcg(struct mem_cgroup *memcg)
+ {
++	int i;
+ 	int nid;
+ 
+ 	for_each_node(nid) {
+@@ -3820,6 +4793,11 @@ void lru_gen_exit_memcg(struct mem_cgrou
+ 
+ 		VM_WARN_ON_ONCE(memchr_inv(lruvec->lrugen.nr_pages, 0,
+ 					   sizeof(lruvec->lrugen.nr_pages)));
++
++		for (i = 0; i < NR_BLOOM_FILTERS; i++) {
++			bitmap_free(lruvec->mm_state.filters[i]);
++			lruvec->mm_state.filters[i] = NULL;
++		}
+ 	}
+ }
+ #endif
diff --git a/target/linux/generic/backport-5.15/020-v6.1-09-mm-multi-gen-LRU-optimize-multiple-memcgs.patch b/target/linux/generic/backport-5.15/020-v6.1-09-mm-multi-gen-LRU-optimize-multiple-memcgs.patch
new file mode 100644
index 00000000000000..b5fb1951514d00
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.1-09-mm-multi-gen-LRU-optimize-multiple-memcgs.patch
@@ -0,0 +1,315 @@
+From 36a18a68ea458e8f4db2ca86b00091daf32c6c74 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Sun, 18 Sep 2022 02:00:06 -0600
+Subject: [PATCH 09/29] mm: multi-gen LRU: optimize multiple memcgs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When multiple memcgs are available, it is possible to use generations as a
+frame of reference to make better choices and improve overall performance
+under global memory pressure.  This patch adds a basic optimization to
+select memcgs that can drop single-use unmapped clean pages first.  Doing
+so reduces the chance of going into the aging path or swapping, which can
+be costly.
+
+A typical example that benefits from this optimization is a server running
+mixed types of workloads, e.g., heavy anon workload in one memcg and heavy
+buffered I/O workload in the other.
+
+Though this optimization can be applied to both kswapd and direct reclaim,
+it is only added to kswapd to keep the patchset manageable.  Later
+improvements may cover the direct reclaim path.
+
+While ensuring certain fairness to all eligible memcgs, proportional scans
+of individual memcgs also require proper backoff to avoid overshooting
+their aggregate reclaim target by too much.  Otherwise it can cause high
+direct reclaim latency.  The conditions for backoff are:
+
+1. At low priorities, for direct reclaim, if aging fairness or direct
+   reclaim latency is at risk, i.e., aging one memcg multiple times or
+   swapping after the target is met.
+2. At high priorities, for global reclaim, if per-zone free pages are
+   above respective watermarks.
+
+Server benchmark results:
+  Mixed workloads:
+    fio (buffered I/O): +[19, 21]%
+                IOPS         BW
+      patch1-8: 1880k        7343MiB/s
+      patch1-9: 2252k        8796MiB/s
+
+    memcached (anon): +[119, 123]%
+                Ops/sec      KB/sec
+      patch1-8: 862768.65    33514.68
+      patch1-9: 1911022.12   74234.54
+
+  Mixed workloads:
+    fio (buffered I/O): +[75, 77]%
+                IOPS         BW
+      5.19-rc1: 1279k        4996MiB/s
+      patch1-9: 2252k        8796MiB/s
+
+    memcached (anon): +[13, 15]%
+                Ops/sec      KB/sec
+      5.19-rc1: 1673524.04   65008.87
+      patch1-9: 1911022.12   74234.54
+
+  Configurations:
+    (changes since patch 6)
+
+    cat mixed.sh
+    modprobe brd rd_nr=2 rd_size=56623104
+
+    swapoff -a
+    mkswap /dev/ram0
+    swapon /dev/ram0
+
+    mkfs.ext4 /dev/ram1
+    mount -t ext4 /dev/ram1 /mnt
+
+    memtier_benchmark -S /var/run/memcached/memcached.sock \
+      -P memcache_binary -n allkeys --key-minimum=1 \
+      --key-maximum=50000000 --key-pattern=P:P -c 1 -t 36 \
+      --ratio 1:0 --pipeline 8 -d 2000
+
+    fio -name=mglru --numjobs=36 --directory=/mnt --size=1408m \
+      --buffered=1 --ioengine=io_uring --iodepth=128 \
+      --iodepth_batch_submit=32 --iodepth_batch_complete=32 \
+      --rw=randread --random_distribution=random --norandommap \
+      --time_based --ramp_time=10m --runtime=90m --group_reporting &
+    pid=$!
+
+    sleep 200
+
+    memtier_benchmark -S /var/run/memcached/memcached.sock \
+      -P memcache_binary -n allkeys --key-minimum=1 \
+      --key-maximum=50000000 --key-pattern=R:R -c 1 -t 36 \
+      --ratio 0:1 --pipeline 8 --randomize --distinct-client-seed
+
+    kill -INT $pid
+    wait
+
+Client benchmark results:
+  no change (CONFIG_MEMCG=n)
+
+Link: https://lkml.kernel.org/r/20220918080010.2920238-10-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Acked-by: Brian Geffon <bgeffon@google.com>
+Acked-by: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
+Acked-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Acked-by: Steven Barrett <steven@liquorix.net>
+Acked-by: Suleiman Souhlal <suleiman@google.com>
+Tested-by: Daniel Byrne <djbyrne@mtu.edu>
+Tested-by: Donald Carr <d@chaos-reins.com>
+Tested-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+Tested-by: Konstantin Kharlamov <Hi-Angel@yandex.ru>
+Tested-by: Shuang Zhai <szhai2@cs.rochester.edu>
+Tested-by: Sofia Trinh <sofia.trinh@edi.works>
+Tested-by: Vaibhav Jain <vaibhav@linux.ibm.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Cc: Barry Song <baohua@kernel.org>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Hillf Danton <hdanton@sina.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Miaohe Lin <linmiaohe@huawei.com>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Mike Rapoport <rppt@linux.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Qi Zheng <zhengqi.arch@bytedance.com>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ mm/vmscan.c | 105 +++++++++++++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 96 insertions(+), 9 deletions(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -127,6 +127,12 @@ struct scan_control {
+ 	/* Always discard instead of demoting to lower tier memory */
+ 	unsigned int no_demotion:1;
+ 
++#ifdef CONFIG_LRU_GEN
++	/* help kswapd make better choices among multiple memcgs */
++	unsigned int memcgs_need_aging:1;
++	unsigned long last_reclaimed;
++#endif
++
+ 	/* Allocation order */
+ 	s8 order;
+ 
+@@ -4202,6 +4208,19 @@ static void lru_gen_age_node(struct pgli
+ 
+ 	VM_WARN_ON_ONCE(!current_is_kswapd());
+ 
++	sc->last_reclaimed = sc->nr_reclaimed;
++
++	/*
++	 * To reduce the chance of going into the aging path, which can be
++	 * costly, optimistically skip it if the flag below was cleared in the
++	 * eviction path. This improves the overall performance when multiple
++	 * memcgs are available.
++	 */
++	if (!sc->memcgs_need_aging) {
++		sc->memcgs_need_aging = true;
++		return;
++	}
++
+ 	set_mm_walk(pgdat);
+ 
+ 	memcg = mem_cgroup_iter(NULL, NULL, NULL);
+@@ -4613,7 +4632,8 @@ static int isolate_pages(struct lruvec *
+ 	return scanned;
+ }
+ 
+-static int evict_pages(struct lruvec *lruvec, struct scan_control *sc, int swappiness)
++static int evict_pages(struct lruvec *lruvec, struct scan_control *sc, int swappiness,
++		       bool *need_swapping)
+ {
+ 	int type;
+ 	int scanned;
+@@ -4676,6 +4696,9 @@ static int evict_pages(struct lruvec *lr
+ 
+ 	sc->nr_reclaimed += reclaimed;
+ 
++	if (need_swapping && type == LRU_GEN_ANON)
++		*need_swapping = true;
++
+ 	return scanned;
+ }
+ 
+@@ -4685,9 +4708,8 @@ static int evict_pages(struct lruvec *lr
+  *    reclaim.
+  */
+ static unsigned long get_nr_to_scan(struct lruvec *lruvec, struct scan_control *sc,
+-				    bool can_swap)
++				    bool can_swap, bool *need_aging)
+ {
+-	bool need_aging;
+ 	unsigned long nr_to_scan;
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+ 	DEFINE_MAX_SEQ(lruvec);
+@@ -4697,8 +4719,8 @@ static unsigned long get_nr_to_scan(stru
+ 	    (mem_cgroup_below_low(memcg) && !sc->memcg_low_reclaim))
+ 		return 0;
+ 
+-	need_aging = should_run_aging(lruvec, max_seq, min_seq, sc, can_swap, &nr_to_scan);
+-	if (!need_aging)
++	*need_aging = should_run_aging(lruvec, max_seq, min_seq, sc, can_swap, &nr_to_scan);
++	if (!*need_aging)
+ 		return nr_to_scan;
+ 
+ 	/* skip the aging path at the default priority */
+@@ -4715,10 +4737,68 @@ done:
+ 	return min_seq[!can_swap] + MIN_NR_GENS <= max_seq ? nr_to_scan : 0;
+ }
+ 
++static bool should_abort_scan(struct lruvec *lruvec, unsigned long seq,
++			      struct scan_control *sc, bool need_swapping)
++{
++	int i;
++	DEFINE_MAX_SEQ(lruvec);
++
++	if (!current_is_kswapd()) {
++		/* age each memcg once to ensure fairness */
++		if (max_seq - seq > 1)
++			return true;
++
++		/* over-swapping can increase allocation latency */
++		if (sc->nr_reclaimed >= sc->nr_to_reclaim && need_swapping)
++			return true;
++
++		/* give this thread a chance to exit and free its memory */
++		if (fatal_signal_pending(current)) {
++			sc->nr_reclaimed += MIN_LRU_BATCH;
++			return true;
++		}
++
++		if (cgroup_reclaim(sc))
++			return false;
++	} else if (sc->nr_reclaimed - sc->last_reclaimed < sc->nr_to_reclaim)
++		return false;
++
++	/* keep scanning at low priorities to ensure fairness */
++	if (sc->priority > DEF_PRIORITY - 2)
++		return false;
++
++	/*
++	 * A minimum amount of work was done under global memory pressure. For
++	 * kswapd, it may be overshooting. For direct reclaim, the target isn't
++	 * met, and yet the allocation may still succeed, since kswapd may have
++	 * caught up. In either case, it's better to stop now, and restart if
++	 * necessary.
++	 */
++	for (i = 0; i <= sc->reclaim_idx; i++) {
++		unsigned long wmark;
++		struct zone *zone = lruvec_pgdat(lruvec)->node_zones + i;
++
++		if (!managed_zone(zone))
++			continue;
++
++		wmark = current_is_kswapd() ? high_wmark_pages(zone) : low_wmark_pages(zone);
++		if (wmark > zone_page_state(zone, NR_FREE_PAGES))
++			return false;
++	}
++
++	sc->nr_reclaimed += MIN_LRU_BATCH;
++
++	return true;
++}
++
+ static void lru_gen_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
+ {
+ 	struct blk_plug plug;
++	bool need_aging = false;
++	bool need_swapping = false;
+ 	unsigned long scanned = 0;
++	unsigned long reclaimed = sc->nr_reclaimed;
++	DEFINE_MAX_SEQ(lruvec);
+ 
+ 	lru_add_drain();
+ 
+@@ -4738,21 +4818,28 @@ static void lru_gen_shrink_lruvec(struct
+ 		else
+ 			swappiness = 0;
+ 
+-		nr_to_scan = get_nr_to_scan(lruvec, sc, swappiness);
++		nr_to_scan = get_nr_to_scan(lruvec, sc, swappiness, &need_aging);
+ 		if (!nr_to_scan)
+-			break;
++			goto done;
+ 
+-		delta = evict_pages(lruvec, sc, swappiness);
++		delta = evict_pages(lruvec, sc, swappiness, &need_swapping);
+ 		if (!delta)
+-			break;
++			goto done;
+ 
+ 		scanned += delta;
+ 		if (scanned >= nr_to_scan)
+ 			break;
+ 
++		if (should_abort_scan(lruvec, max_seq, sc, need_swapping))
++			break;
++
+ 		cond_resched();
+ 	}
+ 
++	/* see the comment in lru_gen_age_node() */
++	if (sc->nr_reclaimed - reclaimed >= MIN_LRU_BATCH && !need_aging)
++		sc->memcgs_need_aging = false;
++done:
+ 	clear_mm_walk();
+ 
+ 	blk_finish_plug(&plug);
diff --git a/target/linux/generic/backport-5.15/020-v6.1-10-mm-multi-gen-LRU-kill-switch.patch b/target/linux/generic/backport-5.15/020-v6.1-10-mm-multi-gen-LRU-kill-switch.patch
new file mode 100644
index 00000000000000..cf5b8f0e9f78db
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.1-10-mm-multi-gen-LRU-kill-switch.patch
@@ -0,0 +1,498 @@
+From 640db3a029dca909af47157ca18f52b29d34a1b9 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Sun, 18 Sep 2022 02:00:07 -0600
+Subject: [PATCH 10/29] mm: multi-gen LRU: kill switch
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Add /sys/kernel/mm/lru_gen/enabled as a kill switch. Components that
+can be disabled include:
+  0x0001: the multi-gen LRU core
+  0x0002: walking page table, when arch_has_hw_pte_young() returns
+          true
+  0x0004: clearing the accessed bit in non-leaf PMD entries, when
+          CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG=y
+  [yYnN]: apply to all the components above
+E.g.,
+  echo y >/sys/kernel/mm/lru_gen/enabled
+  cat /sys/kernel/mm/lru_gen/enabled
+  0x0007
+  echo 5 >/sys/kernel/mm/lru_gen/enabled
+  cat /sys/kernel/mm/lru_gen/enabled
+  0x0005
+
+NB: the page table walks happen on the scale of seconds under heavy memory
+pressure, in which case the mmap_lock contention is a lesser concern,
+compared with the LRU lock contention and the I/O congestion.  So far the
+only well-known case of the mmap_lock contention happens on Android, due
+to Scudo [1] which allocates several thousand VMAs for merely a few
+hundred MBs.  The SPF and the Maple Tree also have provided their own
+assessments [2][3].  However, if walking page tables does worsen the
+mmap_lock contention, the kill switch can be used to disable it.  In this
+case the multi-gen LRU will suffer a minor performance degradation, as
+shown previously.
+
+Clearing the accessed bit in non-leaf PMD entries can also be disabled,
+since this behavior was not tested on x86 varieties other than Intel and
+AMD.
+
+[1] https://source.android.com/devices/tech/debug/scudo
+[2] https://lore.kernel.org/r/20220128131006.67712-1-michel@lespinasse.org/
+[3] https://lore.kernel.org/r/20220426150616.3937571-1-Liam.Howlett@oracle.com/
+
+Link: https://lkml.kernel.org/r/20220918080010.2920238-11-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Acked-by: Brian Geffon <bgeffon@google.com>
+Acked-by: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
+Acked-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Acked-by: Steven Barrett <steven@liquorix.net>
+Acked-by: Suleiman Souhlal <suleiman@google.com>
+Tested-by: Daniel Byrne <djbyrne@mtu.edu>
+Tested-by: Donald Carr <d@chaos-reins.com>
+Tested-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+Tested-by: Konstantin Kharlamov <Hi-Angel@yandex.ru>
+Tested-by: Shuang Zhai <szhai2@cs.rochester.edu>
+Tested-by: Sofia Trinh <sofia.trinh@edi.works>
+Tested-by: Vaibhav Jain <vaibhav@linux.ibm.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Cc: Barry Song <baohua@kernel.org>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Hillf Danton <hdanton@sina.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Miaohe Lin <linmiaohe@huawei.com>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Mike Rapoport <rppt@linux.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Qi Zheng <zhengqi.arch@bytedance.com>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ include/linux/cgroup.h          |  15 ++-
+ include/linux/mm_inline.h       |  15 ++-
+ include/linux/mmzone.h          |   9 ++
+ kernel/cgroup/cgroup-internal.h |   1 -
+ mm/Kconfig                      |   6 +
+ mm/vmscan.c                     | 228 +++++++++++++++++++++++++++++++-
+ 6 files changed, 265 insertions(+), 9 deletions(-)
+
+--- a/include/linux/cgroup.h
++++ b/include/linux/cgroup.h
+@@ -433,6 +433,18 @@ static inline void cgroup_put(struct cgr
+ 	css_put(&cgrp->self);
+ }
+ 
++extern struct mutex cgroup_mutex;
++
++static inline void cgroup_lock(void)
++{
++	mutex_lock(&cgroup_mutex);
++}
++
++static inline void cgroup_unlock(void)
++{
++	mutex_unlock(&cgroup_mutex);
++}
++
+ /**
+  * task_css_set_check - obtain a task's css_set with extra access conditions
+  * @task: the task to obtain css_set for
+@@ -447,7 +459,6 @@ static inline void cgroup_put(struct cgr
+  * as locks used during the cgroup_subsys::attach() methods.
+  */
+ #ifdef CONFIG_PROVE_RCU
+-extern struct mutex cgroup_mutex;
+ extern spinlock_t css_set_lock;
+ #define task_css_set_check(task, __c)					\
+ 	rcu_dereference_check((task)->cgroups,				\
+@@ -708,6 +719,8 @@ struct cgroup;
+ static inline u64 cgroup_id(const struct cgroup *cgrp) { return 1; }
+ static inline void css_get(struct cgroup_subsys_state *css) {}
+ static inline void css_put(struct cgroup_subsys_state *css) {}
++static inline void cgroup_lock(void) {}
++static inline void cgroup_unlock(void) {}
+ static inline int cgroup_attach_task_all(struct task_struct *from,
+ 					 struct task_struct *t) { return 0; }
+ static inline int cgroupstats_build(struct cgroupstats *stats,
+--- a/include/linux/mm_inline.h
++++ b/include/linux/mm_inline.h
+@@ -91,10 +91,21 @@ static __always_inline enum lru_list pag
+ 
+ #ifdef CONFIG_LRU_GEN
+ 
++#ifdef CONFIG_LRU_GEN_ENABLED
+ static inline bool lru_gen_enabled(void)
+ {
+-	return true;
++	DECLARE_STATIC_KEY_TRUE(lru_gen_caps[NR_LRU_GEN_CAPS]);
++
++	return static_branch_likely(&lru_gen_caps[LRU_GEN_CORE]);
++}
++#else
++static inline bool lru_gen_enabled(void)
++{
++	DECLARE_STATIC_KEY_FALSE(lru_gen_caps[NR_LRU_GEN_CAPS]);
++
++	return static_branch_unlikely(&lru_gen_caps[LRU_GEN_CORE]);
+ }
++#endif
+ 
+ static inline bool lru_gen_in_fault(void)
+ {
+@@ -207,7 +218,7 @@ static inline bool lru_gen_add_page(stru
+ 
+ 	VM_WARN_ON_ONCE_PAGE(gen != -1, page);
+ 
+-	if (PageUnevictable(page))
++	if (PageUnevictable(page) || !lrugen->enabled)
+ 		return false;
+ 	/*
+ 	 * There are three common cases for this page:
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -364,6 +364,13 @@ enum {
+ 	LRU_GEN_FILE,
+ };
+ 
++enum {
++	LRU_GEN_CORE,
++	LRU_GEN_MM_WALK,
++	LRU_GEN_NONLEAF_YOUNG,
++	NR_LRU_GEN_CAPS
++};
++
+ #define MIN_LRU_BATCH		BITS_PER_LONG
+ #define MAX_LRU_BATCH		(MIN_LRU_BATCH * 64)
+ 
+@@ -405,6 +412,8 @@ struct lru_gen_struct {
+ 	/* can be modified without holding the LRU lock */
+ 	atomic_long_t evicted[NR_HIST_GENS][ANON_AND_FILE][MAX_NR_TIERS];
+ 	atomic_long_t refaulted[NR_HIST_GENS][ANON_AND_FILE][MAX_NR_TIERS];
++	/* whether the multi-gen LRU is enabled */
++	bool enabled;
+ };
+ 
+ enum {
+--- a/kernel/cgroup/cgroup-internal.h
++++ b/kernel/cgroup/cgroup-internal.h
+@@ -165,7 +165,6 @@ struct cgroup_mgctx {
+ #define DEFINE_CGROUP_MGCTX(name)						\
+ 	struct cgroup_mgctx name = CGROUP_MGCTX_INIT(name)
+ 
+-extern struct mutex cgroup_mutex;
+ extern spinlock_t css_set_lock;
+ extern struct cgroup_subsys *cgroup_subsys[];
+ extern struct list_head cgroup_roots;
+--- a/mm/Kconfig
++++ b/mm/Kconfig
+@@ -906,6 +906,12 @@ config LRU_GEN
+ 	help
+ 	  A high performance LRU implementation to overcommit memory.
+ 
++config LRU_GEN_ENABLED
++	bool "Enable by default"
++	depends on LRU_GEN
++	help
++	  This option enables the multi-gen LRU by default.
++
+ config LRU_GEN_STATS
+ 	bool "Full stats for debugging"
+ 	depends on LRU_GEN
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -52,6 +52,7 @@
+ #include <linux/psi.h>
+ #include <linux/pagewalk.h>
+ #include <linux/shmem_fs.h>
++#include <linux/ctype.h>
+ 
+ #include <asm/tlbflush.h>
+ #include <asm/div64.h>
+@@ -2841,6 +2842,14 @@ static bool can_age_anon_pages(struct pg
+ 
+ #ifdef CONFIG_LRU_GEN
+ 
++#ifdef CONFIG_LRU_GEN_ENABLED
++DEFINE_STATIC_KEY_ARRAY_TRUE(lru_gen_caps, NR_LRU_GEN_CAPS);
++#define get_cap(cap)	static_branch_likely(&lru_gen_caps[cap])
++#else
++DEFINE_STATIC_KEY_ARRAY_FALSE(lru_gen_caps, NR_LRU_GEN_CAPS);
++#define get_cap(cap)	static_branch_unlikely(&lru_gen_caps[cap])
++#endif
++
+ /******************************************************************************
+  *                          shorthand helpers
+  ******************************************************************************/
+@@ -3717,7 +3726,8 @@ static void walk_pmd_range_locked(pud_t
+ 			goto next;
+ 
+ 		if (!pmd_trans_huge(pmd[i])) {
+-			if (IS_ENABLED(CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG))
++			if (IS_ENABLED(CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG) &&
++			    get_cap(LRU_GEN_NONLEAF_YOUNG))
+ 				pmdp_test_and_clear_young(vma, addr, pmd + i);
+ 			goto next;
+ 		}
+@@ -3815,10 +3825,12 @@ restart:
+ 		walk->mm_stats[MM_NONLEAF_TOTAL]++;
+ 
+ #ifdef CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG
+-		if (!pmd_young(val))
+-			continue;
++		if (get_cap(LRU_GEN_NONLEAF_YOUNG)) {
++			if (!pmd_young(val))
++				continue;
+ 
+-		walk_pmd_range_locked(pud, addr, vma, args, bitmap, &pos);
++			walk_pmd_range_locked(pud, addr, vma, args, bitmap, &pos);
++		}
+ #endif
+ 		if (!walk->force_scan && !test_bloom_filter(walk->lruvec, walk->max_seq, pmd + i))
+ 			continue;
+@@ -4080,7 +4092,7 @@ static bool try_to_inc_max_seq(struct lr
+ 	 * handful of PTEs. Spreading the work out over a period of time usually
+ 	 * is less efficient, but it avoids bursty page faults.
+ 	 */
+-	if (!arch_has_hw_pte_young()) {
++	if (!(arch_has_hw_pte_young() && get_cap(LRU_GEN_MM_WALK))) {
+ 		success = iterate_mm_list_nowalk(lruvec, max_seq);
+ 		goto done;
+ 	}
+@@ -4846,6 +4858,208 @@ done:
+ }
+ 
+ /******************************************************************************
++ *                          state change
++ ******************************************************************************/
++
++static bool __maybe_unused state_is_valid(struct lruvec *lruvec)
++{
++	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++
++	if (lrugen->enabled) {
++		enum lru_list lru;
++
++		for_each_evictable_lru(lru) {
++			if (!list_empty(&lruvec->lists[lru]))
++				return false;
++		}
++	} else {
++		int gen, type, zone;
++
++		for_each_gen_type_zone(gen, type, zone) {
++			if (!list_empty(&lrugen->lists[gen][type][zone]))
++				return false;
++		}
++	}
++
++	return true;
++}
++
++static bool fill_evictable(struct lruvec *lruvec)
++{
++	enum lru_list lru;
++	int remaining = MAX_LRU_BATCH;
++
++	for_each_evictable_lru(lru) {
++		int type = is_file_lru(lru);
++		bool active = is_active_lru(lru);
++		struct list_head *head = &lruvec->lists[lru];
++
++		while (!list_empty(head)) {
++			bool success;
++			struct page *page = lru_to_page(head);
++
++			VM_WARN_ON_ONCE_PAGE(PageUnevictable(page), page);
++			VM_WARN_ON_ONCE_PAGE(PageActive(page) != active, page);
++			VM_WARN_ON_ONCE_PAGE(page_is_file_lru(page) != type, page);
++			VM_WARN_ON_ONCE_PAGE(page_lru_gen(page) != -1, page);
++
++			del_page_from_lru_list(page, lruvec);
++			success = lru_gen_add_page(lruvec, page, false);
++			VM_WARN_ON_ONCE(!success);
++
++			if (!--remaining)
++				return false;
++		}
++	}
++
++	return true;
++}
++
++static bool drain_evictable(struct lruvec *lruvec)
++{
++	int gen, type, zone;
++	int remaining = MAX_LRU_BATCH;
++
++	for_each_gen_type_zone(gen, type, zone) {
++		struct list_head *head = &lruvec->lrugen.lists[gen][type][zone];
++
++		while (!list_empty(head)) {
++			bool success;
++			struct page *page = lru_to_page(head);
++
++			VM_WARN_ON_ONCE_PAGE(PageUnevictable(page), page);
++			VM_WARN_ON_ONCE_PAGE(PageActive(page), page);
++			VM_WARN_ON_ONCE_PAGE(page_is_file_lru(page) != type, page);
++			VM_WARN_ON_ONCE_PAGE(page_zonenum(page) != zone, page);
++
++			success = lru_gen_del_page(lruvec, page, false);
++			VM_WARN_ON_ONCE(!success);
++			add_page_to_lru_list(page, lruvec);
++
++			if (!--remaining)
++				return false;
++		}
++	}
++
++	return true;
++}
++
++static void lru_gen_change_state(bool enabled)
++{
++	static DEFINE_MUTEX(state_mutex);
++
++	struct mem_cgroup *memcg;
++
++	cgroup_lock();
++	cpus_read_lock();
++	get_online_mems();
++	mutex_lock(&state_mutex);
++
++	if (enabled == lru_gen_enabled())
++		goto unlock;
++
++	if (enabled)
++		static_branch_enable_cpuslocked(&lru_gen_caps[LRU_GEN_CORE]);
++	else
++		static_branch_disable_cpuslocked(&lru_gen_caps[LRU_GEN_CORE]);
++
++	memcg = mem_cgroup_iter(NULL, NULL, NULL);
++	do {
++		int nid;
++
++		for_each_node(nid) {
++			struct lruvec *lruvec = get_lruvec(memcg, nid);
++
++			if (!lruvec)
++				continue;
++
++			spin_lock_irq(&lruvec->lru_lock);
++
++			VM_WARN_ON_ONCE(!seq_is_valid(lruvec));
++			VM_WARN_ON_ONCE(!state_is_valid(lruvec));
++
++			lruvec->lrugen.enabled = enabled;
++
++			while (!(enabled ? fill_evictable(lruvec) : drain_evictable(lruvec))) {
++				spin_unlock_irq(&lruvec->lru_lock);
++				cond_resched();
++				spin_lock_irq(&lruvec->lru_lock);
++			}
++
++			spin_unlock_irq(&lruvec->lru_lock);
++		}
++
++		cond_resched();
++	} while ((memcg = mem_cgroup_iter(NULL, memcg, NULL)));
++unlock:
++	mutex_unlock(&state_mutex);
++	put_online_mems();
++	cpus_read_unlock();
++	cgroup_unlock();
++}
++
++/******************************************************************************
++ *                          sysfs interface
++ ******************************************************************************/
++
++static ssize_t show_enabled(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
++{
++	unsigned int caps = 0;
++
++	if (get_cap(LRU_GEN_CORE))
++		caps |= BIT(LRU_GEN_CORE);
++
++	if (arch_has_hw_pte_young() && get_cap(LRU_GEN_MM_WALK))
++		caps |= BIT(LRU_GEN_MM_WALK);
++
++	if (IS_ENABLED(CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG) && get_cap(LRU_GEN_NONLEAF_YOUNG))
++		caps |= BIT(LRU_GEN_NONLEAF_YOUNG);
++
++	return snprintf(buf, PAGE_SIZE, "0x%04x\n", caps);
++}
++
++static ssize_t store_enabled(struct kobject *kobj, struct kobj_attribute *attr,
++			     const char *buf, size_t len)
++{
++	int i;
++	unsigned int caps;
++
++	if (tolower(*buf) == 'n')
++		caps = 0;
++	else if (tolower(*buf) == 'y')
++		caps = -1;
++	else if (kstrtouint(buf, 0, &caps))
++		return -EINVAL;
++
++	for (i = 0; i < NR_LRU_GEN_CAPS; i++) {
++		bool enabled = caps & BIT(i);
++
++		if (i == LRU_GEN_CORE)
++			lru_gen_change_state(enabled);
++		else if (enabled)
++			static_branch_enable(&lru_gen_caps[i]);
++		else
++			static_branch_disable(&lru_gen_caps[i]);
++	}
++
++	return len;
++}
++
++static struct kobj_attribute lru_gen_enabled_attr = __ATTR(
++	enabled, 0644, show_enabled, store_enabled
++);
++
++static struct attribute *lru_gen_attrs[] = {
++	&lru_gen_enabled_attr.attr,
++	NULL
++};
++
++static struct attribute_group lru_gen_attr_group = {
++	.name = "lru_gen",
++	.attrs = lru_gen_attrs,
++};
++
++/******************************************************************************
+  *                          initialization
+  ******************************************************************************/
+ 
+@@ -4855,6 +5069,7 @@ void lru_gen_init_lruvec(struct lruvec *
+ 	struct lru_gen_struct *lrugen = &lruvec->lrugen;
+ 
+ 	lrugen->max_seq = MIN_NR_GENS + 1;
++	lrugen->enabled = lru_gen_enabled();
+ 
+ 	for_each_gen_type_zone(gen, type, zone)
+ 		INIT_LIST_HEAD(&lrugen->lists[gen][type][zone]);
+@@ -4894,6 +5109,9 @@ static int __init init_lru_gen(void)
+ 	BUILD_BUG_ON(MIN_NR_GENS + 1 >= MAX_NR_GENS);
+ 	BUILD_BUG_ON(BIT(LRU_GEN_WIDTH) <= MAX_NR_GENS);
+ 
++	if (sysfs_create_group(mm_kobj, &lru_gen_attr_group))
++		pr_err("lru_gen: failed to create sysfs group\n");
++
+ 	return 0;
+ };
+ late_initcall(init_lru_gen);
diff --git a/target/linux/generic/backport-5.15/020-v6.1-11-mm-multi-gen-LRU-thrashing-prevention.patch b/target/linux/generic/backport-5.15/020-v6.1-11-mm-multi-gen-LRU-thrashing-prevention.patch
new file mode 100644
index 00000000000000..30e20aff6edce7
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.1-11-mm-multi-gen-LRU-thrashing-prevention.patch
@@ -0,0 +1,226 @@
+From 73d1ff551760f0c79c47ab70faa4c2ca91413f5c Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Sun, 18 Sep 2022 02:00:08 -0600
+Subject: [PATCH 11/29] mm: multi-gen LRU: thrashing prevention
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Add /sys/kernel/mm/lru_gen/min_ttl_ms for thrashing prevention, as
+requested by many desktop users [1].
+
+When set to value N, it prevents the working set of N milliseconds from
+getting evicted.  The OOM killer is triggered if this working set cannot
+be kept in memory.  Based on the average human detectable lag (~100ms),
+N=1000 usually eliminates intolerable lags due to thrashing.  Larger
+values like N=3000 make lags less noticeable at the risk of premature OOM
+kills.
+
+Compared with the size-based approach [2], this time-based approach
+has the following advantages:
+
+1. It is easier to configure because it is agnostic to applications
+   and memory sizes.
+2. It is more reliable because it is directly wired to the OOM killer.
+
+[1] https://lore.kernel.org/r/Ydza%2FzXKY9ATRoh6@google.com/
+[2] https://lore.kernel.org/r/20101028191523.GA14972@google.com/
+
+Link: https://lkml.kernel.org/r/20220918080010.2920238-12-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Acked-by: Brian Geffon <bgeffon@google.com>
+Acked-by: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
+Acked-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Acked-by: Steven Barrett <steven@liquorix.net>
+Acked-by: Suleiman Souhlal <suleiman@google.com>
+Tested-by: Daniel Byrne <djbyrne@mtu.edu>
+Tested-by: Donald Carr <d@chaos-reins.com>
+Tested-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+Tested-by: Konstantin Kharlamov <Hi-Angel@yandex.ru>
+Tested-by: Shuang Zhai <szhai2@cs.rochester.edu>
+Tested-by: Sofia Trinh <sofia.trinh@edi.works>
+Tested-by: Vaibhav Jain <vaibhav@linux.ibm.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Cc: Barry Song <baohua@kernel.org>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Hillf Danton <hdanton@sina.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Miaohe Lin <linmiaohe@huawei.com>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Mike Rapoport <rppt@linux.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Qi Zheng <zhengqi.arch@bytedance.com>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ include/linux/mmzone.h |  2 ++
+ mm/vmscan.c            | 74 ++++++++++++++++++++++++++++++++++++++++--
+ 2 files changed, 73 insertions(+), 3 deletions(-)
+
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -399,6 +399,8 @@ struct lru_gen_struct {
+ 	unsigned long max_seq;
+ 	/* the eviction increments the oldest generation numbers */
+ 	unsigned long min_seq[ANON_AND_FILE];
++	/* the birth time of each generation in jiffies */
++	unsigned long timestamps[MAX_NR_GENS];
+ 	/* the multi-gen LRU lists, lazily sorted on eviction */
+ 	struct list_head lists[MAX_NR_GENS][ANON_AND_FILE][MAX_NR_ZONES];
+ 	/* the multi-gen LRU sizes, eventually consistent */
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -4064,6 +4064,7 @@ static void inc_max_seq(struct lruvec *l
+ 	for (type = 0; type < ANON_AND_FILE; type++)
+ 		reset_ctrl_pos(lruvec, type, false);
+ 
++	WRITE_ONCE(lrugen->timestamps[next], jiffies);
+ 	/* make sure preceding modifications appear */
+ 	smp_store_release(&lrugen->max_seq, lrugen->max_seq + 1);
+ 
+@@ -4193,7 +4194,7 @@ static bool should_run_aging(struct lruv
+ 	return false;
+ }
+ 
+-static void age_lruvec(struct lruvec *lruvec, struct scan_control *sc)
++static bool age_lruvec(struct lruvec *lruvec, struct scan_control *sc, unsigned long min_ttl)
+ {
+ 	bool need_aging;
+ 	unsigned long nr_to_scan;
+@@ -4207,16 +4208,36 @@ static void age_lruvec(struct lruvec *lr
+ 	mem_cgroup_calculate_protection(NULL, memcg);
+ 
+ 	if (mem_cgroup_below_min(memcg))
+-		return;
++		return false;
+ 
+ 	need_aging = should_run_aging(lruvec, max_seq, min_seq, sc, swappiness, &nr_to_scan);
++
++	if (min_ttl) {
++		int gen = lru_gen_from_seq(min_seq[LRU_GEN_FILE]);
++		unsigned long birth = READ_ONCE(lruvec->lrugen.timestamps[gen]);
++
++		if (time_is_after_jiffies(birth + min_ttl))
++			return false;
++
++		/* the size is likely too small to be helpful */
++		if (!nr_to_scan && sc->priority != DEF_PRIORITY)
++			return false;
++	}
++
+ 	if (need_aging)
+ 		try_to_inc_max_seq(lruvec, max_seq, sc, swappiness);
++
++	return true;
+ }
+ 
++/* to protect the working set of the last N jiffies */
++static unsigned long lru_gen_min_ttl __read_mostly;
++
+ static void lru_gen_age_node(struct pglist_data *pgdat, struct scan_control *sc)
+ {
+ 	struct mem_cgroup *memcg;
++	bool success = false;
++	unsigned long min_ttl = READ_ONCE(lru_gen_min_ttl);
+ 
+ 	VM_WARN_ON_ONCE(!current_is_kswapd());
+ 
+@@ -4239,12 +4260,32 @@ static void lru_gen_age_node(struct pgli
+ 	do {
+ 		struct lruvec *lruvec = mem_cgroup_lruvec(memcg, pgdat);
+ 
+-		age_lruvec(lruvec, sc);
++		if (age_lruvec(lruvec, sc, min_ttl))
++			success = true;
+ 
+ 		cond_resched();
+ 	} while ((memcg = mem_cgroup_iter(NULL, memcg, NULL)));
+ 
+ 	clear_mm_walk();
++
++	/* check the order to exclude compaction-induced reclaim */
++	if (success || !min_ttl || sc->order)
++		return;
++
++	/*
++	 * The main goal is to OOM kill if every generation from all memcgs is
++	 * younger than min_ttl. However, another possibility is all memcgs are
++	 * either below min or empty.
++	 */
++	if (mutex_trylock(&oom_lock)) {
++		struct oom_control oc = {
++			.gfp_mask = sc->gfp_mask,
++		};
++
++		out_of_memory(&oc);
++
++		mutex_unlock(&oom_lock);
++	}
+ }
+ 
+ /*
+@@ -5002,6 +5043,28 @@ unlock:
+  *                          sysfs interface
+  ******************************************************************************/
+ 
++static ssize_t show_min_ttl(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
++{
++	return sprintf(buf, "%u\n", jiffies_to_msecs(READ_ONCE(lru_gen_min_ttl)));
++}
++
++static ssize_t store_min_ttl(struct kobject *kobj, struct kobj_attribute *attr,
++			     const char *buf, size_t len)
++{
++	unsigned int msecs;
++
++	if (kstrtouint(buf, 0, &msecs))
++		return -EINVAL;
++
++	WRITE_ONCE(lru_gen_min_ttl, msecs_to_jiffies(msecs));
++
++	return len;
++}
++
++static struct kobj_attribute lru_gen_min_ttl_attr = __ATTR(
++	min_ttl_ms, 0644, show_min_ttl, store_min_ttl
++);
++
+ static ssize_t show_enabled(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
+ {
+ 	unsigned int caps = 0;
+@@ -5050,6 +5113,7 @@ static struct kobj_attribute lru_gen_ena
+ );
+ 
+ static struct attribute *lru_gen_attrs[] = {
++	&lru_gen_min_ttl_attr.attr,
+ 	&lru_gen_enabled_attr.attr,
+ 	NULL
+ };
+@@ -5065,12 +5129,16 @@ static struct attribute_group lru_gen_at
+ 
+ void lru_gen_init_lruvec(struct lruvec *lruvec)
+ {
++	int i;
+ 	int gen, type, zone;
+ 	struct lru_gen_struct *lrugen = &lruvec->lrugen;
+ 
+ 	lrugen->max_seq = MIN_NR_GENS + 1;
+ 	lrugen->enabled = lru_gen_enabled();
+ 
++	for (i = 0; i <= MIN_NR_GENS + 1; i++)
++		lrugen->timestamps[i] = jiffies;
++
+ 	for_each_gen_type_zone(gen, type, zone)
+ 		INIT_LIST_HEAD(&lrugen->lists[gen][type][zone]);
+ 
diff --git a/target/linux/generic/backport-5.15/020-v6.1-12-mm-multi-gen-LRU-debugfs-interface.patch b/target/linux/generic/backport-5.15/020-v6.1-12-mm-multi-gen-LRU-debugfs-interface.patch
new file mode 100644
index 00000000000000..482e714bb6aace
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.1-12-mm-multi-gen-LRU-debugfs-interface.patch
@@ -0,0 +1,579 @@
+From 530716d008ca26315f246cd70dc1cefc636beaa4 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Sun, 18 Sep 2022 02:00:09 -0600
+Subject: [PATCH 12/29] mm: multi-gen LRU: debugfs interface
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Add /sys/kernel/debug/lru_gen for working set estimation and proactive
+reclaim.  These techniques are commonly used to optimize job scheduling
+(bin packing) in data centers [1][2].
+
+Compared with the page table-based approach and the PFN-based
+approach, this lruvec-based approach has the following advantages:
+1. It offers better choices because it is aware of memcgs, NUMA nodes,
+   shared mappings and unmapped page cache.
+2. It is more scalable because it is O(nr_hot_pages), whereas the
+   PFN-based approach is O(nr_total_pages).
+
+Add /sys/kernel/debug/lru_gen_full for debugging.
+
+[1] https://dl.acm.org/doi/10.1145/3297858.3304053
+[2] https://dl.acm.org/doi/10.1145/3503222.3507731
+
+Link: https://lkml.kernel.org/r/20220918080010.2920238-13-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Reviewed-by: Qi Zheng <zhengqi.arch@bytedance.com>
+Acked-by: Brian Geffon <bgeffon@google.com>
+Acked-by: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
+Acked-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Acked-by: Steven Barrett <steven@liquorix.net>
+Acked-by: Suleiman Souhlal <suleiman@google.com>
+Tested-by: Daniel Byrne <djbyrne@mtu.edu>
+Tested-by: Donald Carr <d@chaos-reins.com>
+Tested-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+Tested-by: Konstantin Kharlamov <Hi-Angel@yandex.ru>
+Tested-by: Shuang Zhai <szhai2@cs.rochester.edu>
+Tested-by: Sofia Trinh <sofia.trinh@edi.works>
+Tested-by: Vaibhav Jain <vaibhav@linux.ibm.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Cc: Barry Song <baohua@kernel.org>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Hillf Danton <hdanton@sina.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Miaohe Lin <linmiaohe@huawei.com>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Mike Rapoport <rppt@linux.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ include/linux/nodemask.h |   1 +
+ mm/vmscan.c              | 411 ++++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 402 insertions(+), 10 deletions(-)
+
+--- a/include/linux/nodemask.h
++++ b/include/linux/nodemask.h
+@@ -485,6 +485,7 @@ static inline int num_node_state(enum no
+ #define first_online_node	0
+ #define first_memory_node	0
+ #define next_online_node(nid)	(MAX_NUMNODES)
++#define next_memory_node(nid)	(MAX_NUMNODES)
+ #define nr_node_ids		1U
+ #define nr_online_nodes		1U
+ 
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -53,6 +53,7 @@
+ #include <linux/pagewalk.h>
+ #include <linux/shmem_fs.h>
+ #include <linux/ctype.h>
++#include <linux/debugfs.h>
+ 
+ #include <asm/tlbflush.h>
+ #include <asm/div64.h>
+@@ -3968,12 +3969,40 @@ static void clear_mm_walk(void)
+ 		kfree(walk);
+ }
+ 
+-static void inc_min_seq(struct lruvec *lruvec, int type)
++static bool inc_min_seq(struct lruvec *lruvec, int type, bool can_swap)
+ {
++	int zone;
++	int remaining = MAX_LRU_BATCH;
+ 	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	int new_gen, old_gen = lru_gen_from_seq(lrugen->min_seq[type]);
++
++	if (type == LRU_GEN_ANON && !can_swap)
++		goto done;
++
++	/* prevent cold/hot inversion if force_scan is true */
++	for (zone = 0; zone < MAX_NR_ZONES; zone++) {
++		struct list_head *head = &lrugen->lists[old_gen][type][zone];
++
++		while (!list_empty(head)) {
++			struct page *page = lru_to_page(head);
++
++			VM_WARN_ON_ONCE_PAGE(PageUnevictable(page), page);
++			VM_WARN_ON_ONCE_PAGE(PageActive(page), page);
++			VM_WARN_ON_ONCE_PAGE(page_is_file_lru(page) != type, page);
++			VM_WARN_ON_ONCE_PAGE(page_zonenum(page) != zone, page);
+ 
++			new_gen = page_inc_gen(lruvec, page, false);
++			list_move_tail(&page->lru, &lrugen->lists[new_gen][type][zone]);
++
++			if (!--remaining)
++				return false;
++		}
++	}
++done:
+ 	reset_ctrl_pos(lruvec, type, true);
+ 	WRITE_ONCE(lrugen->min_seq[type], lrugen->min_seq[type] + 1);
++
++	return true;
+ }
+ 
+ static bool try_to_inc_min_seq(struct lruvec *lruvec, bool can_swap)
+@@ -4019,7 +4048,7 @@ next:
+ 	return success;
+ }
+ 
+-static void inc_max_seq(struct lruvec *lruvec, bool can_swap)
++static void inc_max_seq(struct lruvec *lruvec, bool can_swap, bool force_scan)
+ {
+ 	int prev, next;
+ 	int type, zone;
+@@ -4033,9 +4062,13 @@ static void inc_max_seq(struct lruvec *l
+ 		if (get_nr_gens(lruvec, type) != MAX_NR_GENS)
+ 			continue;
+ 
+-		VM_WARN_ON_ONCE(type == LRU_GEN_FILE || can_swap);
++		VM_WARN_ON_ONCE(!force_scan && (type == LRU_GEN_FILE || can_swap));
+ 
+-		inc_min_seq(lruvec, type);
++		while (!inc_min_seq(lruvec, type, can_swap)) {
++			spin_unlock_irq(&lruvec->lru_lock);
++			cond_resched();
++			spin_lock_irq(&lruvec->lru_lock);
++		}
+ 	}
+ 
+ 	/*
+@@ -4072,7 +4105,7 @@ static void inc_max_seq(struct lruvec *l
+ }
+ 
+ static bool try_to_inc_max_seq(struct lruvec *lruvec, unsigned long max_seq,
+-			       struct scan_control *sc, bool can_swap)
++			       struct scan_control *sc, bool can_swap, bool force_scan)
+ {
+ 	bool success;
+ 	struct lru_gen_mm_walk *walk;
+@@ -4093,7 +4126,7 @@ static bool try_to_inc_max_seq(struct lr
+ 	 * handful of PTEs. Spreading the work out over a period of time usually
+ 	 * is less efficient, but it avoids bursty page faults.
+ 	 */
+-	if (!(arch_has_hw_pte_young() && get_cap(LRU_GEN_MM_WALK))) {
++	if (!force_scan && !(arch_has_hw_pte_young() && get_cap(LRU_GEN_MM_WALK))) {
+ 		success = iterate_mm_list_nowalk(lruvec, max_seq);
+ 		goto done;
+ 	}
+@@ -4107,7 +4140,7 @@ static bool try_to_inc_max_seq(struct lr
+ 	walk->lruvec = lruvec;
+ 	walk->max_seq = max_seq;
+ 	walk->can_swap = can_swap;
+-	walk->force_scan = false;
++	walk->force_scan = force_scan;
+ 
+ 	do {
+ 		success = iterate_mm_list(lruvec, walk, &mm);
+@@ -4127,7 +4160,7 @@ done:
+ 
+ 	VM_WARN_ON_ONCE(max_seq != READ_ONCE(lrugen->max_seq));
+ 
+-	inc_max_seq(lruvec, can_swap);
++	inc_max_seq(lruvec, can_swap, force_scan);
+ 	/* either this sees any waiters or they will see updated max_seq */
+ 	if (wq_has_sleeper(&lruvec->mm_state.wait))
+ 		wake_up_all(&lruvec->mm_state.wait);
+@@ -4225,7 +4258,7 @@ static bool age_lruvec(struct lruvec *lr
+ 	}
+ 
+ 	if (need_aging)
+-		try_to_inc_max_seq(lruvec, max_seq, sc, swappiness);
++		try_to_inc_max_seq(lruvec, max_seq, sc, swappiness, false);
+ 
+ 	return true;
+ }
+@@ -4784,7 +4817,7 @@ static unsigned long get_nr_to_scan(stru
+ 	if (current_is_kswapd())
+ 		return 0;
+ 
+-	if (try_to_inc_max_seq(lruvec, max_seq, sc, can_swap))
++	if (try_to_inc_max_seq(lruvec, max_seq, sc, can_swap, false))
+ 		return nr_to_scan;
+ done:
+ 	return min_seq[!can_swap] + MIN_NR_GENS <= max_seq ? nr_to_scan : 0;
+@@ -5124,6 +5157,361 @@ static struct attribute_group lru_gen_at
+ };
+ 
+ /******************************************************************************
++ *                          debugfs interface
++ ******************************************************************************/
++
++static void *lru_gen_seq_start(struct seq_file *m, loff_t *pos)
++{
++	struct mem_cgroup *memcg;
++	loff_t nr_to_skip = *pos;
++
++	m->private = kvmalloc(PATH_MAX, GFP_KERNEL);
++	if (!m->private)
++		return ERR_PTR(-ENOMEM);
++
++	memcg = mem_cgroup_iter(NULL, NULL, NULL);
++	do {
++		int nid;
++
++		for_each_node_state(nid, N_MEMORY) {
++			if (!nr_to_skip--)
++				return get_lruvec(memcg, nid);
++		}
++	} while ((memcg = mem_cgroup_iter(NULL, memcg, NULL)));
++
++	return NULL;
++}
++
++static void lru_gen_seq_stop(struct seq_file *m, void *v)
++{
++	if (!IS_ERR_OR_NULL(v))
++		mem_cgroup_iter_break(NULL, lruvec_memcg(v));
++
++	kvfree(m->private);
++	m->private = NULL;
++}
++
++static void *lru_gen_seq_next(struct seq_file *m, void *v, loff_t *pos)
++{
++	int nid = lruvec_pgdat(v)->node_id;
++	struct mem_cgroup *memcg = lruvec_memcg(v);
++
++	++*pos;
++
++	nid = next_memory_node(nid);
++	if (nid == MAX_NUMNODES) {
++		memcg = mem_cgroup_iter(NULL, memcg, NULL);
++		if (!memcg)
++			return NULL;
++
++		nid = first_memory_node;
++	}
++
++	return get_lruvec(memcg, nid);
++}
++
++static void lru_gen_seq_show_full(struct seq_file *m, struct lruvec *lruvec,
++				  unsigned long max_seq, unsigned long *min_seq,
++				  unsigned long seq)
++{
++	int i;
++	int type, tier;
++	int hist = lru_hist_from_seq(seq);
++	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++
++	for (tier = 0; tier < MAX_NR_TIERS; tier++) {
++		seq_printf(m, "            %10d", tier);
++		for (type = 0; type < ANON_AND_FILE; type++) {
++			const char *s = "   ";
++			unsigned long n[3] = {};
++
++			if (seq == max_seq) {
++				s = "RT ";
++				n[0] = READ_ONCE(lrugen->avg_refaulted[type][tier]);
++				n[1] = READ_ONCE(lrugen->avg_total[type][tier]);
++			} else if (seq == min_seq[type] || NR_HIST_GENS > 1) {
++				s = "rep";
++				n[0] = atomic_long_read(&lrugen->refaulted[hist][type][tier]);
++				n[1] = atomic_long_read(&lrugen->evicted[hist][type][tier]);
++				if (tier)
++					n[2] = READ_ONCE(lrugen->protected[hist][type][tier - 1]);
++			}
++
++			for (i = 0; i < 3; i++)
++				seq_printf(m, " %10lu%c", n[i], s[i]);
++		}
++		seq_putc(m, '\n');
++	}
++
++	seq_puts(m, "                      ");
++	for (i = 0; i < NR_MM_STATS; i++) {
++		const char *s = "      ";
++		unsigned long n = 0;
++
++		if (seq == max_seq && NR_HIST_GENS == 1) {
++			s = "LOYNFA";
++			n = READ_ONCE(lruvec->mm_state.stats[hist][i]);
++		} else if (seq != max_seq && NR_HIST_GENS > 1) {
++			s = "loynfa";
++			n = READ_ONCE(lruvec->mm_state.stats[hist][i]);
++		}
++
++		seq_printf(m, " %10lu%c", n, s[i]);
++	}
++	seq_putc(m, '\n');
++}
++
++static int lru_gen_seq_show(struct seq_file *m, void *v)
++{
++	unsigned long seq;
++	bool full = !debugfs_real_fops(m->file)->write;
++	struct lruvec *lruvec = v;
++	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	int nid = lruvec_pgdat(lruvec)->node_id;
++	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
++	DEFINE_MAX_SEQ(lruvec);
++	DEFINE_MIN_SEQ(lruvec);
++
++	if (nid == first_memory_node) {
++		const char *path = memcg ? m->private : "";
++
++#ifdef CONFIG_MEMCG
++		if (memcg)
++			cgroup_path(memcg->css.cgroup, m->private, PATH_MAX);
++#endif
++		seq_printf(m, "memcg %5hu %s\n", mem_cgroup_id(memcg), path);
++	}
++
++	seq_printf(m, " node %5d\n", nid);
++
++	if (!full)
++		seq = min_seq[LRU_GEN_ANON];
++	else if (max_seq >= MAX_NR_GENS)
++		seq = max_seq - MAX_NR_GENS + 1;
++	else
++		seq = 0;
++
++	for (; seq <= max_seq; seq++) {
++		int type, zone;
++		int gen = lru_gen_from_seq(seq);
++		unsigned long birth = READ_ONCE(lruvec->lrugen.timestamps[gen]);
++
++		seq_printf(m, " %10lu %10u", seq, jiffies_to_msecs(jiffies - birth));
++
++		for (type = 0; type < ANON_AND_FILE; type++) {
++			unsigned long size = 0;
++			char mark = full && seq < min_seq[type] ? 'x' : ' ';
++
++			for (zone = 0; zone < MAX_NR_ZONES; zone++)
++				size += max(READ_ONCE(lrugen->nr_pages[gen][type][zone]), 0L);
++
++			seq_printf(m, " %10lu%c", size, mark);
++		}
++
++		seq_putc(m, '\n');
++
++		if (full)
++			lru_gen_seq_show_full(m, lruvec, max_seq, min_seq, seq);
++	}
++
++	return 0;
++}
++
++static const struct seq_operations lru_gen_seq_ops = {
++	.start = lru_gen_seq_start,
++	.stop = lru_gen_seq_stop,
++	.next = lru_gen_seq_next,
++	.show = lru_gen_seq_show,
++};
++
++static int run_aging(struct lruvec *lruvec, unsigned long seq, struct scan_control *sc,
++		     bool can_swap, bool force_scan)
++{
++	DEFINE_MAX_SEQ(lruvec);
++	DEFINE_MIN_SEQ(lruvec);
++
++	if (seq < max_seq)
++		return 0;
++
++	if (seq > max_seq)
++		return -EINVAL;
++
++	if (!force_scan && min_seq[!can_swap] + MAX_NR_GENS - 1 <= max_seq)
++		return -ERANGE;
++
++	try_to_inc_max_seq(lruvec, max_seq, sc, can_swap, force_scan);
++
++	return 0;
++}
++
++static int run_eviction(struct lruvec *lruvec, unsigned long seq, struct scan_control *sc,
++			int swappiness, unsigned long nr_to_reclaim)
++{
++	DEFINE_MAX_SEQ(lruvec);
++
++	if (seq + MIN_NR_GENS > max_seq)
++		return -EINVAL;
++
++	sc->nr_reclaimed = 0;
++
++	while (!signal_pending(current)) {
++		DEFINE_MIN_SEQ(lruvec);
++
++		if (seq < min_seq[!swappiness])
++			return 0;
++
++		if (sc->nr_reclaimed >= nr_to_reclaim)
++			return 0;
++
++		if (!evict_pages(lruvec, sc, swappiness, NULL))
++			return 0;
++
++		cond_resched();
++	}
++
++	return -EINTR;
++}
++
++static int run_cmd(char cmd, int memcg_id, int nid, unsigned long seq,
++		   struct scan_control *sc, int swappiness, unsigned long opt)
++{
++	struct lruvec *lruvec;
++	int err = -EINVAL;
++	struct mem_cgroup *memcg = NULL;
++
++	if (nid < 0 || nid >= MAX_NUMNODES || !node_state(nid, N_MEMORY))
++		return -EINVAL;
++
++	if (!mem_cgroup_disabled()) {
++		rcu_read_lock();
++		memcg = mem_cgroup_from_id(memcg_id);
++#ifdef CONFIG_MEMCG
++		if (memcg && !css_tryget(&memcg->css))
++			memcg = NULL;
++#endif
++		rcu_read_unlock();
++
++		if (!memcg)
++			return -EINVAL;
++	}
++
++	if (memcg_id != mem_cgroup_id(memcg))
++		goto done;
++
++	lruvec = get_lruvec(memcg, nid);
++
++	if (swappiness < 0)
++		swappiness = get_swappiness(lruvec, sc);
++	else if (swappiness > 200)
++		goto done;
++
++	switch (cmd) {
++	case '+':
++		err = run_aging(lruvec, seq, sc, swappiness, opt);
++		break;
++	case '-':
++		err = run_eviction(lruvec, seq, sc, swappiness, opt);
++		break;
++	}
++done:
++	mem_cgroup_put(memcg);
++
++	return err;
++}
++
++static ssize_t lru_gen_seq_write(struct file *file, const char __user *src,
++				 size_t len, loff_t *pos)
++{
++	void *buf;
++	char *cur, *next;
++	unsigned int flags;
++	struct blk_plug plug;
++	int err = -EINVAL;
++	struct scan_control sc = {
++		.may_writepage = true,
++		.may_unmap = true,
++		.may_swap = true,
++		.reclaim_idx = MAX_NR_ZONES - 1,
++		.gfp_mask = GFP_KERNEL,
++	};
++
++	buf = kvmalloc(len + 1, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	if (copy_from_user(buf, src, len)) {
++		kvfree(buf);
++		return -EFAULT;
++	}
++
++	set_task_reclaim_state(current, &sc.reclaim_state);
++	flags = memalloc_noreclaim_save();
++	blk_start_plug(&plug);
++	if (!set_mm_walk(NULL)) {
++		err = -ENOMEM;
++		goto done;
++	}
++
++	next = buf;
++	next[len] = '\0';
++
++	while ((cur = strsep(&next, ",;\n"))) {
++		int n;
++		int end;
++		char cmd;
++		unsigned int memcg_id;
++		unsigned int nid;
++		unsigned long seq;
++		unsigned int swappiness = -1;
++		unsigned long opt = -1;
++
++		cur = skip_spaces(cur);
++		if (!*cur)
++			continue;
++
++		n = sscanf(cur, "%c %u %u %lu %n %u %n %lu %n", &cmd, &memcg_id, &nid,
++			   &seq, &end, &swappiness, &end, &opt, &end);
++		if (n < 4 || cur[end]) {
++			err = -EINVAL;
++			break;
++		}
++
++		err = run_cmd(cmd, memcg_id, nid, seq, &sc, swappiness, opt);
++		if (err)
++			break;
++	}
++done:
++	clear_mm_walk();
++	blk_finish_plug(&plug);
++	memalloc_noreclaim_restore(flags);
++	set_task_reclaim_state(current, NULL);
++
++	kvfree(buf);
++
++	return err ? : len;
++}
++
++static int lru_gen_seq_open(struct inode *inode, struct file *file)
++{
++	return seq_open(file, &lru_gen_seq_ops);
++}
++
++static const struct file_operations lru_gen_rw_fops = {
++	.open = lru_gen_seq_open,
++	.read = seq_read,
++	.write = lru_gen_seq_write,
++	.llseek = seq_lseek,
++	.release = seq_release,
++};
++
++static const struct file_operations lru_gen_ro_fops = {
++	.open = lru_gen_seq_open,
++	.read = seq_read,
++	.llseek = seq_lseek,
++	.release = seq_release,
++};
++
++/******************************************************************************
+  *                          initialization
+  ******************************************************************************/
+ 
+@@ -5180,6 +5568,9 @@ static int __init init_lru_gen(void)
+ 	if (sysfs_create_group(mm_kobj, &lru_gen_attr_group))
+ 		pr_err("lru_gen: failed to create sysfs group\n");
+ 
++	debugfs_create_file("lru_gen", 0644, NULL, NULL, &lru_gen_rw_fops);
++	debugfs_create_file("lru_gen_full", 0444, NULL, NULL, &lru_gen_ro_fops);
++
+ 	return 0;
+ };
+ late_initcall(init_lru_gen);
diff --git a/target/linux/generic/backport-5.15/020-v6.1-13-mm-mglru-don-t-sync-disk-for-each-aging-cycle.patch b/target/linux/generic/backport-5.15/020-v6.1-13-mm-mglru-don-t-sync-disk-for-each-aging-cycle.patch
new file mode 100644
index 00000000000000..fd4aa72747320f
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.1-13-mm-mglru-don-t-sync-disk-for-each-aging-cycle.patch
@@ -0,0 +1,32 @@
+From 92d430e8955c976eacb7cc91d7ff849c0dd009af Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Wed, 28 Sep 2022 13:36:58 -0600
+Subject: [PATCH 13/29] mm/mglru: don't sync disk for each aging cycle
+
+wakeup_flusher_threads() was added under the assumption that if a system
+runs out of clean cold pages, it might want to write back dirty pages more
+aggressively so that they can become clean and be dropped.
+
+However, doing so can breach the rate limit a system wants to impose on
+writeback, resulting in early SSD wearout.
+
+Link: https://lkml.kernel.org/r/YzSiWq9UEER5LKup@google.com
+Fixes: bd74fdaea146 ("mm: multi-gen LRU: support page table walks")
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Reported-by: Axel Rasmussen <axelrasmussen@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ mm/vmscan.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -4165,8 +4165,6 @@ done:
+ 	if (wq_has_sleeper(&lruvec->mm_state.wait))
+ 		wake_up_all(&lruvec->mm_state.wait);
+ 
+-	wakeup_flusher_threads(WB_REASON_VMSCAN);
+-
+ 	return true;
+ }
+ 
diff --git a/target/linux/generic/backport-5.15/020-v6.1-14-mm-multi-gen-LRU-retry-pages-written-back-while-isol.patch b/target/linux/generic/backport-5.15/020-v6.1-14-mm-multi-gen-LRU-retry-pages-written-back-while-isol.patch
new file mode 100644
index 00000000000000..31b35cbc4b69fb
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.1-14-mm-multi-gen-LRU-retry-pages-written-back-while-isol.patch
@@ -0,0 +1,124 @@
+From 6f315879ad750391a0b1fab8c9170bc054a5f5d7 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Tue, 15 Nov 2022 18:38:07 -0700
+Subject: [PATCH 14/29] mm: multi-gen LRU: retry pages written back while
+ isolated
+
+The page reclaim isolates a batch of pages from the tail of one of the
+LRU lists and works on those pages one by one.  For a suitable
+swap-backed page, if the swap device is async, it queues that page for
+writeback.  After the page reclaim finishes an entire batch, it puts back
+the pages it queued for writeback to the head of the original LRU list.
+
+In the meantime, the page writeback flushes the queued pages also by
+batches.  Its batching logic is independent from that of the page reclaim.
+For each of the pages it writes back, the page writeback calls
+rotate_reclaimable_page() which tries to rotate a page to the tail.
+
+rotate_reclaimable_page() only works for a page after the page reclaim
+has put it back.  If an async swap device is fast enough, the page
+writeback can finish with that page while the page reclaim is still
+working on the rest of the batch containing it.  In this case, that page
+will remain at the head and the page reclaim will not retry it before
+reaching there.
+
+This patch adds a retry to evict_pages().  After evict_pages() has
+finished an entire batch and before it puts back pages it cannot free
+immediately, it retries those that may have missed the rotation.
+
+Before this patch, ~60% of pages swapped to an Intel Optane missed
+rotate_reclaimable_page().  After this patch, ~99% of missed pages were
+reclaimed upon retry.
+
+This problem affects relatively slow async swap devices like Samsung 980
+Pro much less and does not affect sync swap devices like zram or zswap at
+all.
+
+Link: https://lkml.kernel.org/r/20221116013808.3995280-1-yuzhao@google.com
+Fixes: ac35a4902374 ("mm: multi-gen LRU: minimal implementation")
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Cc: "Yin, Fengwei" <fengwei.yin@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ mm/vmscan.c | 48 +++++++++++++++++++++++++++++++++++++-----------
+ 1 file changed, 37 insertions(+), 11 deletions(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -4723,10 +4723,13 @@ static int evict_pages(struct lruvec *lr
+ 	int scanned;
+ 	int reclaimed;
+ 	LIST_HEAD(list);
++	LIST_HEAD(clean);
+ 	struct page *page;
++	struct page *next;
+ 	enum vm_event_item item;
+ 	struct reclaim_stat stat;
+ 	struct lru_gen_mm_walk *walk;
++	bool skip_retry = false;
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+ 	struct pglist_data *pgdat = lruvec_pgdat(lruvec);
+ 
+@@ -4743,20 +4746,37 @@ static int evict_pages(struct lruvec *lr
+ 
+ 	if (list_empty(&list))
+ 		return scanned;
+-
++retry:
+ 	reclaimed = shrink_page_list(&list, pgdat, sc, &stat, false);
++	sc->nr_reclaimed += reclaimed;
+ 
+-	list_for_each_entry(page, &list, lru) {
+-		/* restore LRU_REFS_FLAGS cleared by isolate_page() */
+-		if (PageWorkingset(page))
+-			SetPageReferenced(page);
++	list_for_each_entry_safe_reverse(page, next, &list, lru) {
++		if (!page_evictable(page)) {
++			list_del(&page->lru);
++			putback_lru_page(page);
++			continue;
++		}
+ 
+-		/* don't add rejected pages to the oldest generation */
+ 		if (PageReclaim(page) &&
+-		    (PageDirty(page) || PageWriteback(page)))
+-			ClearPageActive(page);
+-		else
+-			SetPageActive(page);
++		    (PageDirty(page) || PageWriteback(page))) {
++			/* restore LRU_REFS_FLAGS cleared by isolate_page() */
++			if (PageWorkingset(page))
++				SetPageReferenced(page);
++			continue;
++		}
++
++		if (skip_retry || PageActive(page) || PageReferenced(page) ||
++		    page_mapped(page) || PageLocked(page) ||
++		    PageDirty(page) || PageWriteback(page)) {
++			/* don't add rejected pages to the oldest generation */
++			set_mask_bits(&page->flags, LRU_REFS_MASK | LRU_REFS_FLAGS,
++				      BIT(PG_active));
++			continue;
++		}
++
++		/* retry pages that may have missed rotate_reclaimable_page() */
++		list_move(&page->lru, &clean);
++		sc->nr_scanned -= thp_nr_pages(page);
+ 	}
+ 
+ 	spin_lock_irq(&lruvec->lru_lock);
+@@ -4778,7 +4798,13 @@ static int evict_pages(struct lruvec *lr
+ 	mem_cgroup_uncharge_list(&list);
+ 	free_unref_page_list(&list);
+ 
+-	sc->nr_reclaimed += reclaimed;
++	INIT_LIST_HEAD(&list);
++	list_splice_init(&clean, &list);
++
++	if (!list_empty(&list)) {
++		skip_retry = true;
++		goto retry;
++	}
+ 
+ 	if (need_swapping && type == LRU_GEN_ANON)
+ 		*need_swapping = true;
diff --git a/target/linux/generic/backport-5.15/020-v6.1-15-mm-multi-gen-LRU-move-lru_gen_add_mm-out-of-IRQ-off-.patch b/target/linux/generic/backport-5.15/020-v6.1-15-mm-multi-gen-LRU-move-lru_gen_add_mm-out-of-IRQ-off-.patch
new file mode 100644
index 00000000000000..5b1d378504a800
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.1-15-mm-multi-gen-LRU-move-lru_gen_add_mm-out-of-IRQ-off-.patch
@@ -0,0 +1,49 @@
+From 255bb0ac393f1c2818cd75af45a9226300ab3daf Mon Sep 17 00:00:00 2001
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Wed, 26 Oct 2022 15:48:30 +0200
+Subject: [PATCH 15/29] mm: multi-gen LRU: move lru_gen_add_mm() out of IRQ-off
+ region
+
+lru_gen_add_mm() has been added within an IRQ-off region in the commit
+mentioned below.  The other invocations of lru_gen_add_mm() are not within
+an IRQ-off region.
+
+The invocation within IRQ-off region is problematic on PREEMPT_RT because
+the function is using a spin_lock_t which must not be used within
+IRQ-disabled regions.
+
+The other invocations of lru_gen_add_mm() occur while
+task_struct::alloc_lock is acquired.  Move lru_gen_add_mm() after
+interrupts are enabled and before task_unlock().
+
+Link: https://lkml.kernel.org/r/20221026134830.711887-1-bigeasy@linutronix.de
+Fixes: bd74fdaea1460 ("mm: multi-gen LRU: support page table walks")
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Acked-by: Yu Zhao <yuzhao@google.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: "Eric W . Biederman" <ebiederm@xmission.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ fs/exec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1013,7 +1013,6 @@ static int exec_mmap(struct mm_struct *m
+ 	active_mm = tsk->active_mm;
+ 	tsk->active_mm = mm;
+ 	tsk->mm = mm;
+-	lru_gen_add_mm(mm);
+ 	/*
+ 	 * This prevents preemption while active_mm is being loaded and
+ 	 * it and mm are being updated, which could cause problems for
+@@ -1028,6 +1027,7 @@ static int exec_mmap(struct mm_struct *m
+ 		local_irq_enable();
+ 	tsk->mm->vmacache_seqnum = 0;
+ 	vmacache_flush(tsk);
++	lru_gen_add_mm(mm);
+ 	task_unlock(tsk);
+ 	lru_gen_use_mm(mm);
+ 	if (old_mm) {
diff --git a/target/linux/generic/backport-5.15/020-v6.1-17-mm-add-dummy-pmd_young-for-architectures-not-having-.patch b/target/linux/generic/backport-5.15/020-v6.1-17-mm-add-dummy-pmd_young-for-architectures-not-having-.patch
new file mode 100644
index 00000000000000..1c10c168a50c18
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.1-17-mm-add-dummy-pmd_young-for-architectures-not-having-.patch
@@ -0,0 +1,96 @@
+From c5ec455ebd2b488d91de9d8915a0c8036a2a04dd Mon Sep 17 00:00:00 2001
+From: Juergen Gross <jgross@suse.com>
+Date: Wed, 30 Nov 2022 14:49:41 -0800
+Subject: [PATCH 17/29] mm: add dummy pmd_young() for architectures not having
+ it
+
+In order to avoid #ifdeffery add a dummy pmd_young() implementation as a
+fallback.  This is required for the later patch "mm: introduce
+arch_has_hw_nonleaf_pmd_young()".
+
+Link: https://lkml.kernel.org/r/fd3ac3cd-7349-6bbd-890a-71a9454ca0b3@suse.com
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Acked-by: Yu Zhao <yuzhao@google.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Geert Uytterhoeven <geert@linux-m68k.org>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Sander Eikelenboom <linux@eikelenboom.it>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ arch/mips/include/asm/pgtable.h     | 1 +
+ arch/riscv/include/asm/pgtable.h    | 1 +
+ arch/s390/include/asm/pgtable.h     | 1 +
+ arch/sparc/include/asm/pgtable_64.h | 1 +
+ arch/x86/include/asm/pgtable.h      | 1 +
+ include/linux/pgtable.h             | 7 +++++++
+ 6 files changed, 12 insertions(+)
+
+--- a/arch/mips/include/asm/pgtable.h
++++ b/arch/mips/include/asm/pgtable.h
+@@ -632,6 +632,7 @@ static inline pmd_t pmd_mkdirty(pmd_t pm
+ 	return pmd;
+ }
+ 
++#define pmd_young pmd_young
+ static inline int pmd_young(pmd_t pmd)
+ {
+ 	return !!(pmd_val(pmd) & _PAGE_ACCESSED);
+--- a/arch/riscv/include/asm/pgtable.h
++++ b/arch/riscv/include/asm/pgtable.h
+@@ -535,6 +535,7 @@ static inline int pmd_dirty(pmd_t pmd)
+ 	return pte_dirty(pmd_pte(pmd));
+ }
+ 
++#define pmd_young pmd_young
+ static inline int pmd_young(pmd_t pmd)
+ {
+ 	return pte_young(pmd_pte(pmd));
+--- a/arch/s390/include/asm/pgtable.h
++++ b/arch/s390/include/asm/pgtable.h
+@@ -748,6 +748,7 @@ static inline int pmd_dirty(pmd_t pmd)
+ 	return (pmd_val(pmd) & _SEGMENT_ENTRY_DIRTY) != 0;
+ }
+ 
++#define pmd_young pmd_young
+ static inline int pmd_young(pmd_t pmd)
+ {
+ 	return (pmd_val(pmd) & _SEGMENT_ENTRY_YOUNG) != 0;
+--- a/arch/sparc/include/asm/pgtable_64.h
++++ b/arch/sparc/include/asm/pgtable_64.h
+@@ -712,6 +712,7 @@ static inline unsigned long pmd_dirty(pm
+ 	return pte_dirty(pte);
+ }
+ 
++#define pmd_young pmd_young
+ static inline unsigned long pmd_young(pmd_t pmd)
+ {
+ 	pte_t pte = __pte(pmd_val(pmd));
+--- a/arch/x86/include/asm/pgtable.h
++++ b/arch/x86/include/asm/pgtable.h
+@@ -136,6 +136,7 @@ static inline int pmd_dirty(pmd_t pmd)
+ 	return pmd_flags(pmd) & _PAGE_DIRTY;
+ }
+ 
++#define pmd_young pmd_young
+ static inline int pmd_young(pmd_t pmd)
+ {
+ 	return pmd_flags(pmd) & _PAGE_ACCESSED;
+--- a/include/linux/pgtable.h
++++ b/include/linux/pgtable.h
+@@ -164,6 +164,13 @@ static inline pte_t *virt_to_kpte(unsign
+ 	return pmd_none(*pmd) ? NULL : pte_offset_kernel(pmd, vaddr);
+ }
+ 
++#ifndef pmd_young
++static inline int pmd_young(pmd_t pmd)
++{
++	return 0;
++}
++#endif
++
+ #ifndef __HAVE_ARCH_PTEP_SET_ACCESS_FLAGS
+ extern int ptep_set_access_flags(struct vm_area_struct *vma,
+ 				 unsigned long address, pte_t *ptep,
diff --git a/target/linux/generic/backport-5.15/020-v6.1-18-mm-introduce-arch_has_hw_nonleaf_pmd_young.patch b/target/linux/generic/backport-5.15/020-v6.1-18-mm-introduce-arch_has_hw_nonleaf_pmd_young.patch
new file mode 100644
index 00000000000000..9a1f9bead6cbc4
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.1-18-mm-introduce-arch_has_hw_nonleaf_pmd_young.patch
@@ -0,0 +1,113 @@
+From 46cbda7b65998a5af4493f745d94417af697bd68 Mon Sep 17 00:00:00 2001
+From: Juergen Gross <jgross@suse.com>
+Date: Wed, 23 Nov 2022 07:45:10 +0100
+Subject: [PATCH 18/29] mm: introduce arch_has_hw_nonleaf_pmd_young()
+
+When running as a Xen PV guests commit eed9a328aa1a ("mm: x86: add
+CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG") can cause a protection violation in
+pmdp_test_and_clear_young():
+
+ BUG: unable to handle page fault for address: ffff8880083374d0
+ #PF: supervisor write access in kernel mode
+ #PF: error_code(0x0003) - permissions violation
+ PGD 3026067 P4D 3026067 PUD 3027067 PMD 7fee5067 PTE 8010000008337065
+ Oops: 0003 [#1] PREEMPT SMP NOPTI
+ CPU: 7 PID: 158 Comm: kswapd0 Not tainted 6.1.0-rc5-20221118-doflr+ #1
+ RIP: e030:pmdp_test_and_clear_young+0x25/0x40
+
+This happens because the Xen hypervisor can't emulate direct writes to
+page table entries other than PTEs.
+
+This can easily be fixed by introducing arch_has_hw_nonleaf_pmd_young()
+similar to arch_has_hw_pte_young() and test that instead of
+CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG.
+
+Link: https://lkml.kernel.org/r/20221123064510.16225-1-jgross@suse.com
+Fixes: eed9a328aa1a ("mm: x86: add CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG")
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reported-by: Sander Eikelenboom <linux@eikelenboom.it>
+Acked-by: Yu Zhao <yuzhao@google.com>
+Tested-by: Sander Eikelenboom <linux@eikelenboom.it>
+Acked-by: David Hildenbrand <david@redhat.com>	[core changes]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ arch/x86/include/asm/pgtable.h |  8 ++++++++
+ include/linux/pgtable.h        | 11 +++++++++++
+ mm/vmscan.c                    | 10 +++++-----
+ 3 files changed, 24 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/include/asm/pgtable.h
++++ b/arch/x86/include/asm/pgtable.h
+@@ -1405,6 +1405,14 @@ static inline bool arch_has_hw_pte_young
+ 	return true;
+ }
+ 
++#ifdef CONFIG_XEN_PV
++#define arch_has_hw_nonleaf_pmd_young arch_has_hw_nonleaf_pmd_young
++static inline bool arch_has_hw_nonleaf_pmd_young(void)
++{
++	return !cpu_feature_enabled(X86_FEATURE_XENPV);
++}
++#endif
++
+ #endif	/* __ASSEMBLY__ */
+ 
+ #endif /* _ASM_X86_PGTABLE_H */
+--- a/include/linux/pgtable.h
++++ b/include/linux/pgtable.h
+@@ -266,6 +266,17 @@ static inline int pmdp_clear_flush_young
+ #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
+ #endif
+ 
++#ifndef arch_has_hw_nonleaf_pmd_young
++/*
++ * Return whether the accessed bit in non-leaf PMD entries is supported on the
++ * local CPU.
++ */
++static inline bool arch_has_hw_nonleaf_pmd_young(void)
++{
++	return IS_ENABLED(CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG);
++}
++#endif
++
+ #ifndef arch_has_hw_pte_young
+ /*
+  * Return whether the accessed bit is supported on the local CPU.
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -3727,7 +3727,7 @@ static void walk_pmd_range_locked(pud_t
+ 			goto next;
+ 
+ 		if (!pmd_trans_huge(pmd[i])) {
+-			if (IS_ENABLED(CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG) &&
++			if (arch_has_hw_nonleaf_pmd_young() &&
+ 			    get_cap(LRU_GEN_NONLEAF_YOUNG))
+ 				pmdp_test_and_clear_young(vma, addr, pmd + i);
+ 			goto next;
+@@ -3825,14 +3825,14 @@ restart:
+ #endif
+ 		walk->mm_stats[MM_NONLEAF_TOTAL]++;
+ 
+-#ifdef CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG
+-		if (get_cap(LRU_GEN_NONLEAF_YOUNG)) {
++		if (arch_has_hw_nonleaf_pmd_young() &&
++		    get_cap(LRU_GEN_NONLEAF_YOUNG)) {
+ 			if (!pmd_young(val))
+ 				continue;
+ 
+ 			walk_pmd_range_locked(pud, addr, vma, args, bitmap, &pos);
+ 		}
+-#endif
++
+ 		if (!walk->force_scan && !test_bloom_filter(walk->lruvec, walk->max_seq, pmd + i))
+ 			continue;
+ 
+@@ -5132,7 +5132,7 @@ static ssize_t show_enabled(struct kobje
+ 	if (arch_has_hw_pte_young() && get_cap(LRU_GEN_MM_WALK))
+ 		caps |= BIT(LRU_GEN_MM_WALK);
+ 
+-	if (IS_ENABLED(CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG) && get_cap(LRU_GEN_NONLEAF_YOUNG))
++	if (arch_has_hw_nonleaf_pmd_young() && get_cap(LRU_GEN_NONLEAF_YOUNG))
+ 		caps |= BIT(LRU_GEN_NONLEAF_YOUNG);
+ 
+ 	return snprintf(buf, PAGE_SIZE, "0x%04x\n", caps);
diff --git a/target/linux/generic/backport-5.15/020-v6.2-16-mm-multi-gen-LRU-fix-crash-during-cgroup-migration.patch b/target/linux/generic/backport-5.15/020-v6.2-16-mm-multi-gen-LRU-fix-crash-during-cgroup-migration.patch
new file mode 100644
index 00000000000000..e37386abdf1967
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.2-16-mm-multi-gen-LRU-fix-crash-during-cgroup-migration.patch
@@ -0,0 +1,56 @@
+From c7dfefd4bdfba3d5171038d1cc2d4160288e6ee4 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Sun, 15 Jan 2023 20:44:05 -0700
+Subject: [PATCH 16/29] mm: multi-gen LRU: fix crash during cgroup migration
+
+lru_gen_migrate_mm() assumes lru_gen_add_mm() runs prior to itself.  This
+isn't true for the following scenario:
+
+    CPU 1                         CPU 2
+
+  clone()
+    cgroup_can_fork()
+                                cgroup_procs_write()
+    cgroup_post_fork()
+                                  task_lock()
+                                  lru_gen_migrate_mm()
+                                  task_unlock()
+    task_lock()
+    lru_gen_add_mm()
+    task_unlock()
+
+And when the above happens, kernel crashes because of linked list
+corruption (mm_struct->lru_gen.list).
+
+Link: https://lore.kernel.org/r/20230115134651.30028-1-msizanoen@qtmlabs.xyz/
+Link: https://lkml.kernel.org/r/20230116034405.2960276-1-yuzhao@google.com
+Fixes: bd74fdaea146 ("mm: multi-gen LRU: support page table walks")
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Reported-by: msizanoen <msizanoen@qtmlabs.xyz>
+Tested-by: msizanoen <msizanoen@qtmlabs.xyz>
+Cc: <stable@vger.kernel.org>	[6.1+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ mm/vmscan.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -3024,13 +3024,16 @@ void lru_gen_migrate_mm(struct mm_struct
+ 	if (mem_cgroup_disabled())
+ 		return;
+ 
++	/* migration can happen before addition */
++	if (!mm->lru_gen.memcg)
++		return;
++
+ 	rcu_read_lock();
+ 	memcg = mem_cgroup_from_task(task);
+ 	rcu_read_unlock();
+ 	if (memcg == mm->lru_gen.memcg)
+ 		return;
+ 
+-	VM_WARN_ON_ONCE(!mm->lru_gen.memcg);
+ 	VM_WARN_ON_ONCE(list_empty(&mm->lru_gen.list));
+ 
+ 	lru_gen_del_mm(mm);
diff --git a/target/linux/generic/backport-5.15/020-v6.3-19-mm-add-vma_has_recency.patch b/target/linux/generic/backport-5.15/020-v6.3-19-mm-add-vma_has_recency.patch
new file mode 100644
index 00000000000000..d740c5bd1d5183
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.3-19-mm-add-vma_has_recency.patch
@@ -0,0 +1,196 @@
+From 6c7f552a48b49a8612786a28a2239fbc24fac289 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Fri, 30 Dec 2022 14:52:51 -0700
+Subject: [PATCH 19/29] mm: add vma_has_recency()
+
+Add vma_has_recency() to indicate whether a VMA may exhibit temporal
+locality that the LRU algorithm relies on.
+
+This function returns false for VMAs marked by VM_SEQ_READ or
+VM_RAND_READ.  While the former flag indicates linear access, i.e., a
+special case of spatial locality, both flags indicate a lack of temporal
+locality, i.e., the reuse of an area within a relatively small duration.
+
+"Recency" is chosen over "locality" to avoid confusion between temporal
+and spatial localities.
+
+Before this patch, the active/inactive LRU only ignored the accessed bit
+from VMAs marked by VM_SEQ_READ.  After this patch, the active/inactive
+LRU and MGLRU share the same logic: they both ignore the accessed bit if
+vma_has_recency() returns false.
+
+For the active/inactive LRU, the following fio test showed a [6, 8]%
+increase in IOPS when randomly accessing mapped files under memory
+pressure.
+
+  kb=$(awk '/MemTotal/ { print $2 }' /proc/meminfo)
+  kb=$((kb - 8*1024*1024))
+
+  modprobe brd rd_nr=1 rd_size=$kb
+  dd if=/dev/zero of=/dev/ram0 bs=1M
+
+  mkfs.ext4 /dev/ram0
+  mount /dev/ram0 /mnt/
+  swapoff -a
+
+  fio --name=test --directory=/mnt/ --ioengine=mmap --numjobs=8 \
+      --size=8G --rw=randrw --time_based --runtime=10m \
+      --group_reporting
+
+The discussion that led to this patch is here [1].  Additional test
+results are available in that thread.
+
+[1] https://lore.kernel.org/r/Y31s%2FK8T85jh05wH@google.com/
+
+Link: https://lkml.kernel.org/r/20221230215252.2628425-1-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: Andrea Righi <andrea.righi@canonical.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ include/linux/mm_inline.h |  9 +++++++++
+ mm/memory.c               |  8 ++++----
+ mm/rmap.c                 | 42 +++++++++++++++++----------------------
+ mm/vmscan.c               |  5 ++++-
+ 4 files changed, 35 insertions(+), 29 deletions(-)
+
+--- a/include/linux/mm_inline.h
++++ b/include/linux/mm_inline.h
+@@ -333,4 +333,13 @@ static __always_inline void del_page_fro
+ 	update_lru_size(lruvec, page_lru(page), page_zonenum(page),
+ 			-thp_nr_pages(page));
+ }
++
++static inline bool vma_has_recency(struct vm_area_struct *vma)
++{
++	if (vma->vm_flags & (VM_SEQ_READ | VM_RAND_READ))
++		return false;
++
++	return true;
++}
++
+ #endif
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -41,6 +41,7 @@
+ 
+ #include <linux/kernel_stat.h>
+ #include <linux/mm.h>
++#include <linux/mm_inline.h>
+ #include <linux/sched/mm.h>
+ #include <linux/sched/coredump.h>
+ #include <linux/sched/numa_balancing.h>
+@@ -1353,8 +1354,7 @@ again:
+ 					force_flush = 1;
+ 					set_page_dirty(page);
+ 				}
+-				if (pte_young(ptent) &&
+-				    likely(!(vma->vm_flags & VM_SEQ_READ)))
++				if (pte_young(ptent) && likely(vma_has_recency(vma)))
+ 					mark_page_accessed(page);
+ 			}
+ 			rss[mm_counter(page)]--;
+@@ -4795,8 +4795,8 @@ static inline void mm_account_fault(stru
+ #ifdef CONFIG_LRU_GEN
+ static void lru_gen_enter_fault(struct vm_area_struct *vma)
+ {
+-	/* the LRU algorithm doesn't apply to sequential or random reads */
+-	current->in_lru_fault = !(vma->vm_flags & (VM_SEQ_READ | VM_RAND_READ));
++	/* the LRU algorithm only applies to accesses with recency */
++	current->in_lru_fault = vma_has_recency(vma);
+ }
+ 
+ static void lru_gen_exit_fault(void)
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -794,25 +794,14 @@ static bool page_referenced_one(struct p
+ 		}
+ 
+ 		if (pvmw.pte) {
+-			if (lru_gen_enabled() && pte_young(*pvmw.pte) &&
+-			    !(vma->vm_flags & (VM_SEQ_READ | VM_RAND_READ))) {
++			if (lru_gen_enabled() && pte_young(*pvmw.pte)) {
+ 				lru_gen_look_around(&pvmw);
+ 				referenced++;
+ 			}
+ 
+ 			if (ptep_clear_flush_young_notify(vma, address,
+-						pvmw.pte)) {
+-				/*
+-				 * Don't treat a reference through
+-				 * a sequentially read mapping as such.
+-				 * If the page has been used in another mapping,
+-				 * we will catch it; if this other mapping is
+-				 * already gone, the unmap path will have set
+-				 * PG_referenced or activated the page.
+-				 */
+-				if (likely(!(vma->vm_flags & VM_SEQ_READ)))
+-					referenced++;
+-			}
++						pvmw.pte))
++				referenced++;
+ 		} else if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE)) {
+ 			if (pmdp_clear_flush_young_notify(vma, address,
+ 						pvmw.pmd))
+@@ -846,7 +835,20 @@ static bool invalid_page_referenced_vma(
+ 	struct page_referenced_arg *pra = arg;
+ 	struct mem_cgroup *memcg = pra->memcg;
+ 
+-	if (!mm_match_cgroup(vma->vm_mm, memcg))
++	/*
++	 * Ignore references from this mapping if it has no recency. If the
++	 * page has been used in another mapping, we will catch it; if this
++	 * other mapping is already gone, the unmap path will have set the
++	 * referenced flag or activated the page in zap_pte_range().
++	 */
++	if (!vma_has_recency(vma))
++		return true;
++
++	/*
++	 * If we are reclaiming on behalf of a cgroup, skip counting on behalf
++	 * of references from different cgroups.
++	 */
++	if (memcg && !mm_match_cgroup(vma->vm_mm, memcg))
+ 		return true;
+ 
+ 	return false;
+@@ -876,6 +878,7 @@ int page_referenced(struct page *page,
+ 		.rmap_one = page_referenced_one,
+ 		.arg = (void *)&pra,
+ 		.anon_lock = page_lock_anon_vma_read,
++		.invalid_vma = invalid_page_referenced_vma,
+ 	};
+ 
+ 	*vm_flags = 0;
+@@ -891,15 +894,6 @@ int page_referenced(struct page *page,
+ 			return 1;
+ 	}
+ 
+-	/*
+-	 * If we are reclaiming on behalf of a cgroup, skip
+-	 * counting on behalf of references from different
+-	 * cgroups
+-	 */
+-	if (memcg) {
+-		rwc.invalid_vma = invalid_page_referenced_vma;
+-	}
+-
+ 	rmap_walk(page, &rwc);
+ 	*vm_flags = pra.vm_flags;
+ 
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -3486,7 +3486,10 @@ static int should_skip_vma(unsigned long
+ 	if (is_vm_hugetlb_page(vma))
+ 		return true;
+ 
+-	if (vma->vm_flags & (VM_LOCKED | VM_SPECIAL | VM_SEQ_READ | VM_RAND_READ))
++	if (!vma_has_recency(vma))
++		return true;
++
++	if (vma->vm_flags & (VM_LOCKED | VM_SPECIAL))
+ 		return true;
+ 
+ 	if (vma == get_gate_vma(vma->vm_mm))
diff --git a/target/linux/generic/backport-5.15/020-v6.3-20-mm-support-POSIX_FADV_NOREUSE.patch b/target/linux/generic/backport-5.15/020-v6.3-20-mm-support-POSIX_FADV_NOREUSE.patch
new file mode 100644
index 00000000000000..3bb075bf367a91
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.3-20-mm-support-POSIX_FADV_NOREUSE.patch
@@ -0,0 +1,125 @@
+From 686c3d4f71de9e0e7a27f03a5617a712385f90cd Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Fri, 30 Dec 2022 14:52:52 -0700
+Subject: [PATCH 20/29] mm: support POSIX_FADV_NOREUSE
+
+This patch adds POSIX_FADV_NOREUSE to vma_has_recency() so that the LRU
+algorithm can ignore access to mapped files marked by this flag.
+
+The advantages of POSIX_FADV_NOREUSE are:
+1. Unlike MADV_SEQUENTIAL and MADV_RANDOM, it does not alter the
+   default readahead behavior.
+2. Unlike MADV_SEQUENTIAL and MADV_RANDOM, it does not split VMAs and
+   therefore does not take mmap_lock.
+3. Unlike MADV_COLD, setting it has a negligible cost, regardless of
+   how many pages it affects.
+
+Its limitations are:
+1. Like POSIX_FADV_RANDOM and POSIX_FADV_SEQUENTIAL, it currently does
+   not support range. IOW, its scope is the entire file.
+2. It currently does not ignore access through file descriptors.
+   Specifically, for the active/inactive LRU, given a file page shared
+   by two users and one of them having set POSIX_FADV_NOREUSE on the
+   file, this page will be activated upon the second user accessing
+   it. This corner case can be covered by checking POSIX_FADV_NOREUSE
+   before calling mark_page_accessed() on the read path. But it is
+   considered not worth the effort.
+
+There have been a few attempts to support POSIX_FADV_NOREUSE, e.g., [1].
+This time the goal is to fill a niche: a few desktop applications, e.g.,
+large file transferring and video encoding/decoding, want fast file
+streaming with mmap() rather than direct IO.  Among those applications, an
+SVT-AV1 regression was reported when running with MGLRU [2].  The
+following test can reproduce that regression.
+
+  kb=$(awk '/MemTotal/ { print $2 }' /proc/meminfo)
+  kb=$((kb - 8*1024*1024))
+
+  modprobe brd rd_nr=1 rd_size=$kb
+  dd if=/dev/zero of=/dev/ram0 bs=1M
+
+  mkfs.ext4 /dev/ram0
+  mount /dev/ram0 /mnt/
+  swapoff -a
+
+  fallocate -l 8G /mnt/swapfile
+  mkswap /mnt/swapfile
+  swapon /mnt/swapfile
+
+  wget http://ultravideo.cs.tut.fi/video/Bosphorus_3840x2160_120fps_420_8bit_YUV_Y4M.7z
+  7z e -o/mnt/ Bosphorus_3840x2160_120fps_420_8bit_YUV_Y4M.7z
+  SvtAv1EncApp --preset 12 -w 3840 -h 2160 \
+               -i /mnt/Bosphorus_3840x2160.y4m
+
+For MGLRU, the following change showed a [9-11]% increase in FPS,
+which makes it on par with the active/inactive LRU.
+
+  patch Source/App/EncApp/EbAppMain.c <<EOF
+  31a32
+  > #include <fcntl.h>
+  35d35
+  < #include <fcntl.h> /* _O_BINARY */
+  117a118
+  >             posix_fadvise(config->mmap.fd, 0, 0, POSIX_FADV_NOREUSE);
+  EOF
+
+[1] https://lore.kernel.org/r/1308923350-7932-1-git-send-email-andrea@betterlinux.com/
+[2] https://openbenchmarking.org/result/2209259-PTS-MGLRU8GB57
+
+Link: https://lkml.kernel.org/r/20221230215252.2628425-2-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: Andrea Righi <andrea.righi@canonical.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ include/linux/fs.h        | 2 ++
+ include/linux/mm_inline.h | 3 +++
+ mm/fadvise.c              | 5 ++++-
+ 3 files changed, 9 insertions(+), 1 deletion(-)
+
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -167,6 +167,8 @@ typedef int (dio_iodone_t)(struct kiocb
+ /* File is stream-like */
+ #define FMODE_STREAM		((__force fmode_t)0x200000)
+ 
++#define	FMODE_NOREUSE		((__force fmode_t)0x400000)
++
+ /* File was opened by fanotify and shouldn't generate fanotify events */
+ #define FMODE_NONOTIFY		((__force fmode_t)0x4000000)
+ 
+--- a/include/linux/mm_inline.h
++++ b/include/linux/mm_inline.h
+@@ -339,6 +339,9 @@ static inline bool vma_has_recency(struc
+ 	if (vma->vm_flags & (VM_SEQ_READ | VM_RAND_READ))
+ 		return false;
+ 
++	if (vma->vm_file && (vma->vm_file->f_mode & FMODE_NOREUSE))
++		return false;
++
+ 	return true;
+ }
+ 
+--- a/mm/fadvise.c
++++ b/mm/fadvise.c
+@@ -80,7 +80,7 @@ int generic_fadvise(struct file *file, l
+ 	case POSIX_FADV_NORMAL:
+ 		file->f_ra.ra_pages = bdi->ra_pages;
+ 		spin_lock(&file->f_lock);
+-		file->f_mode &= ~FMODE_RANDOM;
++		file->f_mode &= ~(FMODE_RANDOM | FMODE_NOREUSE);
+ 		spin_unlock(&file->f_lock);
+ 		break;
+ 	case POSIX_FADV_RANDOM:
+@@ -107,6 +107,9 @@ int generic_fadvise(struct file *file, l
+ 		force_page_cache_readahead(mapping, file, start_index, nrpages);
+ 		break;
+ 	case POSIX_FADV_NOREUSE:
++		spin_lock(&file->f_lock);
++		file->f_mode |= FMODE_NOREUSE;
++		spin_unlock(&file->f_lock);
+ 		break;
+ 	case POSIX_FADV_DONTNEED:
+ 		if (!inode_write_congested(mapping->host))
diff --git a/target/linux/generic/backport-5.15/020-v6.3-21-mm-multi-gen-LRU-rename-lru_gen_struct-to-lru_gen_pa.patch b/target/linux/generic/backport-5.15/020-v6.3-21-mm-multi-gen-LRU-rename-lru_gen_struct-to-lru_gen_pa.patch
new file mode 100644
index 00000000000000..4e09173681fbe1
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.3-21-mm-multi-gen-LRU-rename-lru_gen_struct-to-lru_gen_pa.patch
@@ -0,0 +1,348 @@
+From 348fdbada9fb3f0bf1a53651be46319105af187f Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Wed, 21 Dec 2022 21:18:59 -0700
+Subject: [PATCH 21/29] mm: multi-gen LRU: rename lru_gen_struct to
+ lru_gen_page
+
+Patch series "mm: multi-gen LRU: memcg LRU", v3.
+
+Overview
+========
+
+An memcg LRU is a per-node LRU of memcgs.  It is also an LRU of LRUs,
+since each node and memcg combination has an LRU of pages (see
+mem_cgroup_lruvec()).
+
+Its goal is to improve the scalability of global reclaim, which is
+critical to system-wide memory overcommit in data centers.  Note that
+memcg reclaim is currently out of scope.
+
+Its memory bloat is a pointer to each lruvec and negligible to each
+pglist_data.  In terms of traversing memcgs during global reclaim, it
+improves the best-case complexity from O(n) to O(1) and does not affect
+the worst-case complexity O(n).  Therefore, on average, it has a sublinear
+complexity in contrast to the current linear complexity.
+
+The basic structure of an memcg LRU can be understood by an analogy to
+the active/inactive LRU (of pages):
+1. It has the young and the old (generations), i.e., the counterparts
+   to the active and the inactive;
+2. The increment of max_seq triggers promotion, i.e., the counterpart
+   to activation;
+3. Other events trigger similar operations, e.g., offlining an memcg
+   triggers demotion, i.e., the counterpart to deactivation.
+
+In terms of global reclaim, it has two distinct features:
+1. Sharding, which allows each thread to start at a random memcg (in
+   the old generation) and improves parallelism;
+2. Eventual fairness, which allows direct reclaim to bail out at will
+   and reduces latency without affecting fairness over some time.
+
+The commit message in patch 6 details the workflow:
+https://lore.kernel.org/r/20221222041905.2431096-7-yuzhao@google.com/
+
+The following is a simple test to quickly verify its effectiveness.
+
+  Test design:
+  1. Create multiple memcgs.
+  2. Each memcg contains a job (fio).
+  3. All jobs access the same amount of memory randomly.
+  4. The system does not experience global memory pressure.
+  5. Periodically write to the root memory.reclaim.
+
+  Desired outcome:
+  1. All memcgs have similar pgsteal counts, i.e., stddev(pgsteal)
+     over mean(pgsteal) is close to 0%.
+  2. The total pgsteal is close to the total requested through
+     memory.reclaim, i.e., sum(pgsteal) over sum(requested) is close
+     to 100%.
+
+  Actual outcome [1]:
+                                     MGLRU off    MGLRU on
+  stddev(pgsteal) / mean(pgsteal)    75%          20%
+  sum(pgsteal) / sum(requested)      425%         95%
+
+  ####################################################################
+  MEMCGS=128
+
+  for ((memcg = 0; memcg < $MEMCGS; memcg++)); do
+      mkdir /sys/fs/cgroup/memcg$memcg
+  done
+
+  start() {
+      echo $BASHPID > /sys/fs/cgroup/memcg$memcg/cgroup.procs
+
+      fio -name=memcg$memcg --numjobs=1 --ioengine=mmap \
+          --filename=/dev/zero --size=1920M --rw=randrw \
+          --rate=64m,64m --random_distribution=random \
+          --fadvise_hint=0 --time_based --runtime=10h \
+          --group_reporting --minimal
+  }
+
+  for ((memcg = 0; memcg < $MEMCGS; memcg++)); do
+      start &
+  done
+
+  sleep 600
+
+  for ((i = 0; i < 600; i++)); do
+      echo 256m >/sys/fs/cgroup/memory.reclaim
+      sleep 6
+  done
+
+  for ((memcg = 0; memcg < $MEMCGS; memcg++)); do
+      grep "pgsteal " /sys/fs/cgroup/memcg$memcg/memory.stat
+  done
+  ####################################################################
+
+[1]: This was obtained from running the above script (touches less
+     than 256GB memory) on an EPYC 7B13 with 512GB DRAM for over an
+     hour.
+
+This patch (of 8):
+
+The new name lru_gen_page will be more distinct from the coming
+lru_gen_memcg.
+
+Link: https://lkml.kernel.org/r/20221222041905.2431096-1-yuzhao@google.com
+Link: https://lkml.kernel.org/r/20221222041905.2431096-2-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Roman Gushchin <roman.gushchin@linux.dev>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ include/linux/mm_inline.h |  4 ++--
+ include/linux/mmzone.h    |  6 +++---
+ mm/vmscan.c               | 34 +++++++++++++++++-----------------
+ mm/workingset.c           |  4 ++--
+ 4 files changed, 24 insertions(+), 24 deletions(-)
+
+--- a/include/linux/mm_inline.h
++++ b/include/linux/mm_inline.h
+@@ -168,7 +168,7 @@ static inline void lru_gen_update_size(s
+ 	int zone = page_zonenum(page);
+ 	int delta = thp_nr_pages(page);
+ 	enum lru_list lru = type * LRU_INACTIVE_FILE;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_page *lrugen = &lruvec->lrugen;
+ 
+ 	VM_WARN_ON_ONCE(old_gen != -1 && old_gen >= MAX_NR_GENS);
+ 	VM_WARN_ON_ONCE(new_gen != -1 && new_gen >= MAX_NR_GENS);
+@@ -214,7 +214,7 @@ static inline bool lru_gen_add_page(stru
+ 	int gen = page_lru_gen(page);
+ 	int type = page_is_file_lru(page);
+ 	int zone = page_zonenum(page);
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_page *lrugen = &lruvec->lrugen;
+ 
+ 	VM_WARN_ON_ONCE_PAGE(gen != -1, page);
+ 
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -394,7 +394,7 @@ enum {
+  * The number of pages in each generation is eventually consistent and therefore
+  * can be transiently negative when reset_batch_size() is pending.
+  */
+-struct lru_gen_struct {
++struct lru_gen_page {
+ 	/* the aging increments the youngest generation number */
+ 	unsigned long max_seq;
+ 	/* the eviction increments the oldest generation numbers */
+@@ -451,7 +451,7 @@ struct lru_gen_mm_state {
+ struct lru_gen_mm_walk {
+ 	/* the lruvec under reclaim */
+ 	struct lruvec *lruvec;
+-	/* unstable max_seq from lru_gen_struct */
++	/* unstable max_seq from lru_gen_page */
+ 	unsigned long max_seq;
+ 	/* the next address within an mm to scan */
+ 	unsigned long next_addr;
+@@ -514,7 +514,7 @@ struct lruvec {
+ 	unsigned long			flags;
+ #ifdef CONFIG_LRU_GEN
+ 	/* evictable pages divided into generations */
+-	struct lru_gen_struct		lrugen;
++	struct lru_gen_page		lrugen;
+ 	/* to concurrently iterate lru_gen_mm_list */
+ 	struct lru_gen_mm_state		mm_state;
+ #endif
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2910,7 +2910,7 @@ static int get_nr_gens(struct lruvec *lr
+ 
+ static bool __maybe_unused seq_is_valid(struct lruvec *lruvec)
+ {
+-	/* see the comment on lru_gen_struct */
++	/* see the comment on lru_gen_page */
+ 	return get_nr_gens(lruvec, LRU_GEN_FILE) >= MIN_NR_GENS &&
+ 	       get_nr_gens(lruvec, LRU_GEN_FILE) <= get_nr_gens(lruvec, LRU_GEN_ANON) &&
+ 	       get_nr_gens(lruvec, LRU_GEN_ANON) <= MAX_NR_GENS;
+@@ -3316,7 +3316,7 @@ struct ctrl_pos {
+ static void read_ctrl_pos(struct lruvec *lruvec, int type, int tier, int gain,
+ 			  struct ctrl_pos *pos)
+ {
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_page *lrugen = &lruvec->lrugen;
+ 	int hist = lru_hist_from_seq(lrugen->min_seq[type]);
+ 
+ 	pos->refaulted = lrugen->avg_refaulted[type][tier] +
+@@ -3331,7 +3331,7 @@ static void read_ctrl_pos(struct lruvec
+ static void reset_ctrl_pos(struct lruvec *lruvec, int type, bool carryover)
+ {
+ 	int hist, tier;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_page *lrugen = &lruvec->lrugen;
+ 	bool clear = carryover ? NR_HIST_GENS == 1 : NR_HIST_GENS > 1;
+ 	unsigned long seq = carryover ? lrugen->min_seq[type] : lrugen->max_seq + 1;
+ 
+@@ -3408,7 +3408,7 @@ static int page_update_gen(struct page *
+ static int page_inc_gen(struct lruvec *lruvec, struct page *page, bool reclaiming)
+ {
+ 	int type = page_is_file_lru(page);
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_page *lrugen = &lruvec->lrugen;
+ 	int new_gen, old_gen = lru_gen_from_seq(lrugen->min_seq[type]);
+ 	unsigned long new_flags, old_flags = READ_ONCE(page->flags);
+ 
+@@ -3453,7 +3453,7 @@ static void update_batch_size(struct lru
+ static void reset_batch_size(struct lruvec *lruvec, struct lru_gen_mm_walk *walk)
+ {
+ 	int gen, type, zone;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_page *lrugen = &lruvec->lrugen;
+ 
+ 	walk->batched = 0;
+ 
+@@ -3979,7 +3979,7 @@ static bool inc_min_seq(struct lruvec *l
+ {
+ 	int zone;
+ 	int remaining = MAX_LRU_BATCH;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_page *lrugen = &lruvec->lrugen;
+ 	int new_gen, old_gen = lru_gen_from_seq(lrugen->min_seq[type]);
+ 
+ 	if (type == LRU_GEN_ANON && !can_swap)
+@@ -4015,7 +4015,7 @@ static bool try_to_inc_min_seq(struct lr
+ {
+ 	int gen, type, zone;
+ 	bool success = false;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_page *lrugen = &lruvec->lrugen;
+ 	DEFINE_MIN_SEQ(lruvec);
+ 
+ 	VM_WARN_ON_ONCE(!seq_is_valid(lruvec));
+@@ -4036,7 +4036,7 @@ next:
+ 		;
+ 	}
+ 
+-	/* see the comment on lru_gen_struct */
++	/* see the comment on lru_gen_page */
+ 	if (can_swap) {
+ 		min_seq[LRU_GEN_ANON] = min(min_seq[LRU_GEN_ANON], min_seq[LRU_GEN_FILE]);
+ 		min_seq[LRU_GEN_FILE] = max(min_seq[LRU_GEN_ANON], lrugen->min_seq[LRU_GEN_FILE]);
+@@ -4058,7 +4058,7 @@ static void inc_max_seq(struct lruvec *l
+ {
+ 	int prev, next;
+ 	int type, zone;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_page *lrugen = &lruvec->lrugen;
+ 
+ 	spin_lock_irq(&lruvec->lru_lock);
+ 
+@@ -4116,7 +4116,7 @@ static bool try_to_inc_max_seq(struct lr
+ 	bool success;
+ 	struct lru_gen_mm_walk *walk;
+ 	struct mm_struct *mm = NULL;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_page *lrugen = &lruvec->lrugen;
+ 
+ 	VM_WARN_ON_ONCE(max_seq > READ_ONCE(lrugen->max_seq));
+ 
+@@ -4181,7 +4181,7 @@ static bool should_run_aging(struct lruv
+ 	unsigned long old = 0;
+ 	unsigned long young = 0;
+ 	unsigned long total = 0;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_page *lrugen = &lruvec->lrugen;
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+ 
+ 	for (type = !can_swap; type < ANON_AND_FILE; type++) {
+@@ -4466,7 +4466,7 @@ static bool sort_page(struct lruvec *lru
+ 	int delta = thp_nr_pages(page);
+ 	int refs = page_lru_refs(page);
+ 	int tier = lru_tier_from_refs(refs);
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_page *lrugen = &lruvec->lrugen;
+ 
+ 	VM_WARN_ON_ONCE_PAGE(gen >= MAX_NR_GENS, page);
+ 
+@@ -4566,7 +4566,7 @@ static int scan_pages(struct lruvec *lru
+ 	int scanned = 0;
+ 	int isolated = 0;
+ 	int remaining = MAX_LRU_BATCH;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_page *lrugen = &lruvec->lrugen;
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+ 
+ 	VM_WARN_ON_ONCE(!list_empty(list));
+@@ -4967,7 +4967,7 @@ done:
+ 
+ static bool __maybe_unused state_is_valid(struct lruvec *lruvec)
+ {
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_page *lrugen = &lruvec->lrugen;
+ 
+ 	if (lrugen->enabled) {
+ 		enum lru_list lru;
+@@ -5247,7 +5247,7 @@ static void lru_gen_seq_show_full(struct
+ 	int i;
+ 	int type, tier;
+ 	int hist = lru_hist_from_seq(seq);
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_page *lrugen = &lruvec->lrugen;
+ 
+ 	for (tier = 0; tier < MAX_NR_TIERS; tier++) {
+ 		seq_printf(m, "            %10d", tier);
+@@ -5296,7 +5296,7 @@ static int lru_gen_seq_show(struct seq_f
+ 	unsigned long seq;
+ 	bool full = !debugfs_real_fops(m->file)->write;
+ 	struct lruvec *lruvec = v;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_page *lrugen = &lruvec->lrugen;
+ 	int nid = lruvec_pgdat(lruvec)->node_id;
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+ 	DEFINE_MAX_SEQ(lruvec);
+@@ -5549,7 +5549,7 @@ void lru_gen_init_lruvec(struct lruvec *
+ {
+ 	int i;
+ 	int gen, type, zone;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_page *lrugen = &lruvec->lrugen;
+ 
+ 	lrugen->max_seq = MIN_NR_GENS + 1;
+ 	lrugen->enabled = lru_gen_enabled();
+--- a/mm/workingset.c
++++ b/mm/workingset.c
+@@ -223,7 +223,7 @@ static void *lru_gen_eviction(struct pag
+ 	unsigned long token;
+ 	unsigned long min_seq;
+ 	struct lruvec *lruvec;
+-	struct lru_gen_struct *lrugen;
++	struct lru_gen_page *lrugen;
+ 	int type = page_is_file_lru(page);
+ 	int delta = thp_nr_pages(page);
+ 	int refs = page_lru_refs(page);
+@@ -252,7 +252,7 @@ static void lru_gen_refault(struct page
+ 	unsigned long token;
+ 	unsigned long min_seq;
+ 	struct lruvec *lruvec;
+-	struct lru_gen_struct *lrugen;
++	struct lru_gen_page *lrugen;
+ 	struct mem_cgroup *memcg;
+ 	struct pglist_data *pgdat;
+ 	int type = page_is_file_lru(page);
diff --git a/target/linux/generic/backport-5.15/020-v6.3-22-mm-multi-gen-LRU-rename-lrugen-lists-to-lrugen-pages.patch b/target/linux/generic/backport-5.15/020-v6.3-22-mm-multi-gen-LRU-rename-lrugen-lists-to-lrugen-pages.patch
new file mode 100644
index 00000000000000..b548c1c8b3de67
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.3-22-mm-multi-gen-LRU-rename-lrugen-lists-to-lrugen-pages.patch
@@ -0,0 +1,162 @@
+From afd37e73db04c7e6b47411120ac5f6a7eca51fec Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Wed, 21 Dec 2022 21:19:00 -0700
+Subject: [PATCH 22/29] mm: multi-gen LRU: rename lrugen->lists[] to
+ lrugen->pages[]
+
+lru_gen_page will be chained into per-node lists by the coming
+lrugen->list.
+
+Link: https://lkml.kernel.org/r/20221222041905.2431096-3-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Roman Gushchin <roman.gushchin@linux.dev>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ include/linux/mm_inline.h |  4 ++--
+ include/linux/mmzone.h    |  8 ++++----
+ mm/vmscan.c               | 20 ++++++++++----------
+ 3 files changed, 16 insertions(+), 16 deletions(-)
+
+--- a/include/linux/mm_inline.h
++++ b/include/linux/mm_inline.h
+@@ -246,9 +246,9 @@ static inline bool lru_gen_add_page(stru
+ 	lru_gen_update_size(lruvec, page, -1, gen);
+ 	/* for rotate_reclaimable_page() */
+ 	if (reclaiming)
+-		list_add_tail(&page->lru, &lrugen->lists[gen][type][zone]);
++		list_add_tail(&page->lru, &lrugen->pages[gen][type][zone]);
+ 	else
+-		list_add(&page->lru, &lrugen->lists[gen][type][zone]);
++		list_add(&page->lru, &lrugen->pages[gen][type][zone]);
+ 
+ 	return true;
+ }
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -302,7 +302,7 @@ enum lruvec_flags {
+  * They form a sliding window of a variable size [MIN_NR_GENS, MAX_NR_GENS]. An
+  * offset within MAX_NR_GENS, i.e., gen, indexes the LRU list of the
+  * corresponding generation. The gen counter in page->flags stores gen+1 while
+- * a page is on one of lrugen->lists[]. Otherwise it stores 0.
++ * a page is on one of lrugen->pages[]. Otherwise it stores 0.
+  *
+  * A page is added to the youngest generation on faulting. The aging needs to
+  * check the accessed bit at least twice before handing this page over to the
+@@ -314,8 +314,8 @@ enum lruvec_flags {
+  * rest of generations, if they exist, are considered inactive. See
+  * lru_gen_is_active().
+  *
+- * PG_active is always cleared while a page is on one of lrugen->lists[] so that
+- * the aging needs not to worry about it. And it's set again when a page
++ * PG_active is always cleared while a page is on one of lrugen->pages[] so
++ * that the aging needs not to worry about it. And it's set again when a page
+  * considered active is isolated for non-reclaiming purposes, e.g., migration.
+  * See lru_gen_add_page() and lru_gen_del_page().
+  *
+@@ -402,7 +402,7 @@ struct lru_gen_page {
+ 	/* the birth time of each generation in jiffies */
+ 	unsigned long timestamps[MAX_NR_GENS];
+ 	/* the multi-gen LRU lists, lazily sorted on eviction */
+-	struct list_head lists[MAX_NR_GENS][ANON_AND_FILE][MAX_NR_ZONES];
++	struct list_head pages[MAX_NR_GENS][ANON_AND_FILE][MAX_NR_ZONES];
+ 	/* the multi-gen LRU sizes, eventually consistent */
+ 	long nr_pages[MAX_NR_GENS][ANON_AND_FILE][MAX_NR_ZONES];
+ 	/* the exponential moving average of refaulted */
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -3987,7 +3987,7 @@ static bool inc_min_seq(struct lruvec *l
+ 
+ 	/* prevent cold/hot inversion if force_scan is true */
+ 	for (zone = 0; zone < MAX_NR_ZONES; zone++) {
+-		struct list_head *head = &lrugen->lists[old_gen][type][zone];
++		struct list_head *head = &lrugen->pages[old_gen][type][zone];
+ 
+ 		while (!list_empty(head)) {
+ 			struct page *page = lru_to_page(head);
+@@ -3998,7 +3998,7 @@ static bool inc_min_seq(struct lruvec *l
+ 			VM_WARN_ON_ONCE_PAGE(page_zonenum(page) != zone, page);
+ 
+ 			new_gen = page_inc_gen(lruvec, page, false);
+-			list_move_tail(&page->lru, &lrugen->lists[new_gen][type][zone]);
++			list_move_tail(&page->lru, &lrugen->pages[new_gen][type][zone]);
+ 
+ 			if (!--remaining)
+ 				return false;
+@@ -4026,7 +4026,7 @@ static bool try_to_inc_min_seq(struct lr
+ 			gen = lru_gen_from_seq(min_seq[type]);
+ 
+ 			for (zone = 0; zone < MAX_NR_ZONES; zone++) {
+-				if (!list_empty(&lrugen->lists[gen][type][zone]))
++				if (!list_empty(&lrugen->pages[gen][type][zone]))
+ 					goto next;
+ 			}
+ 
+@@ -4491,7 +4491,7 @@ static bool sort_page(struct lruvec *lru
+ 
+ 	/* promoted */
+ 	if (gen != lru_gen_from_seq(lrugen->min_seq[type])) {
+-		list_move(&page->lru, &lrugen->lists[gen][type][zone]);
++		list_move(&page->lru, &lrugen->pages[gen][type][zone]);
+ 		return true;
+ 	}
+ 
+@@ -4500,7 +4500,7 @@ static bool sort_page(struct lruvec *lru
+ 		int hist = lru_hist_from_seq(lrugen->min_seq[type]);
+ 
+ 		gen = page_inc_gen(lruvec, page, false);
+-		list_move_tail(&page->lru, &lrugen->lists[gen][type][zone]);
++		list_move_tail(&page->lru, &lrugen->pages[gen][type][zone]);
+ 
+ 		WRITE_ONCE(lrugen->protected[hist][type][tier - 1],
+ 			   lrugen->protected[hist][type][tier - 1] + delta);
+@@ -4512,7 +4512,7 @@ static bool sort_page(struct lruvec *lru
+ 	if (PageLocked(page) || PageWriteback(page) ||
+ 	    (type == LRU_GEN_FILE && PageDirty(page))) {
+ 		gen = page_inc_gen(lruvec, page, true);
+-		list_move(&page->lru, &lrugen->lists[gen][type][zone]);
++		list_move(&page->lru, &lrugen->pages[gen][type][zone]);
+ 		return true;
+ 	}
+ 
+@@ -4579,7 +4579,7 @@ static int scan_pages(struct lruvec *lru
+ 	for (zone = sc->reclaim_idx; zone >= 0; zone--) {
+ 		LIST_HEAD(moved);
+ 		int skipped = 0;
+-		struct list_head *head = &lrugen->lists[gen][type][zone];
++		struct list_head *head = &lrugen->pages[gen][type][zone];
+ 
+ 		while (!list_empty(head)) {
+ 			struct page *page = lru_to_page(head);
+@@ -4980,7 +4980,7 @@ static bool __maybe_unused state_is_vali
+ 		int gen, type, zone;
+ 
+ 		for_each_gen_type_zone(gen, type, zone) {
+-			if (!list_empty(&lrugen->lists[gen][type][zone]))
++			if (!list_empty(&lrugen->pages[gen][type][zone]))
+ 				return false;
+ 		}
+ 	}
+@@ -5025,7 +5025,7 @@ static bool drain_evictable(struct lruve
+ 	int remaining = MAX_LRU_BATCH;
+ 
+ 	for_each_gen_type_zone(gen, type, zone) {
+-		struct list_head *head = &lruvec->lrugen.lists[gen][type][zone];
++		struct list_head *head = &lruvec->lrugen.pages[gen][type][zone];
+ 
+ 		while (!list_empty(head)) {
+ 			bool success;
+@@ -5558,7 +5558,7 @@ void lru_gen_init_lruvec(struct lruvec *
+ 		lrugen->timestamps[i] = jiffies;
+ 
+ 	for_each_gen_type_zone(gen, type, zone)
+-		INIT_LIST_HEAD(&lrugen->lists[gen][type][zone]);
++		INIT_LIST_HEAD(&lrugen->pages[gen][type][zone]);
+ 
+ 	lruvec->mm_state.seq = MIN_NR_GENS;
+ 	init_waitqueue_head(&lruvec->mm_state.wait);
diff --git a/target/linux/generic/backport-5.15/020-v6.3-23-mm-multi-gen-LRU-remove-eviction-fairness-safeguard.patch b/target/linux/generic/backport-5.15/020-v6.3-23-mm-multi-gen-LRU-remove-eviction-fairness-safeguard.patch
new file mode 100644
index 00000000000000..2bb6e12a5ae163
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.3-23-mm-multi-gen-LRU-remove-eviction-fairness-safeguard.patch
@@ -0,0 +1,188 @@
+From ce45f1c4b32cf69b166f56ef5bc6c761e06ed4e5 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Wed, 21 Dec 2022 21:19:01 -0700
+Subject: [PATCH 23/29] mm: multi-gen LRU: remove eviction fairness safeguard
+
+Recall that the eviction consumes the oldest generation: first it
+bucket-sorts pages whose gen counters were updated by the aging and
+reclaims the rest; then it increments lrugen->min_seq.
+
+The current eviction fairness safeguard for global reclaim has a
+dilemma: when there are multiple eligible memcgs, should it continue
+or stop upon meeting the reclaim goal? If it continues, it overshoots
+and increases direct reclaim latency; if it stops, it loses fairness
+between memcgs it has taken memory away from and those it has yet to.
+
+With memcg LRU, the eviction, while ensuring eventual fairness, will
+stop upon meeting its goal. Therefore the current eviction fairness
+safeguard for global reclaim will not be needed.
+
+Note that memcg LRU only applies to global reclaim. For memcg reclaim,
+the eviction will continue, even if it is overshooting. This becomes
+unconditional due to code simplification.
+
+Link: https://lkml.kernel.org/r/20221222041905.2431096-4-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Roman Gushchin <roman.gushchin@linux.dev>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ mm/vmscan.c | 82 +++++++++++++++--------------------------------------
+ 1 file changed, 23 insertions(+), 59 deletions(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -443,6 +443,11 @@ static bool cgroup_reclaim(struct scan_c
+ 	return sc->target_mem_cgroup;
+ }
+ 
++static bool global_reclaim(struct scan_control *sc)
++{
++	return !sc->target_mem_cgroup || mem_cgroup_is_root(sc->target_mem_cgroup);
++}
++
+ /**
+  * writeback_throttling_sane - is the usual dirty throttling mechanism available?
+  * @sc: scan_control in question
+@@ -493,6 +498,11 @@ static bool cgroup_reclaim(struct scan_c
+ 	return false;
+ }
+ 
++static bool global_reclaim(struct scan_control *sc)
++{
++	return true;
++}
++
+ static bool writeback_throttling_sane(struct scan_control *sc)
+ {
+ 	return true;
+@@ -4722,8 +4732,7 @@ static int isolate_pages(struct lruvec *
+ 	return scanned;
+ }
+ 
+-static int evict_pages(struct lruvec *lruvec, struct scan_control *sc, int swappiness,
+-		       bool *need_swapping)
++static int evict_pages(struct lruvec *lruvec, struct scan_control *sc, int swappiness)
+ {
+ 	int type;
+ 	int scanned;
+@@ -4812,9 +4821,6 @@ retry:
+ 		goto retry;
+ 	}
+ 
+-	if (need_swapping && type == LRU_GEN_ANON)
+-		*need_swapping = true;
+-
+ 	return scanned;
+ }
+ 
+@@ -4853,68 +4859,26 @@ done:
+ 	return min_seq[!can_swap] + MIN_NR_GENS <= max_seq ? nr_to_scan : 0;
+ }
+ 
+-static bool should_abort_scan(struct lruvec *lruvec, unsigned long seq,
+-			      struct scan_control *sc, bool need_swapping)
++static unsigned long get_nr_to_reclaim(struct scan_control *sc)
+ {
+-	int i;
+-	DEFINE_MAX_SEQ(lruvec);
+-
+-	if (!current_is_kswapd()) {
+-		/* age each memcg once to ensure fairness */
+-		if (max_seq - seq > 1)
+-			return true;
+-
+-		/* over-swapping can increase allocation latency */
+-		if (sc->nr_reclaimed >= sc->nr_to_reclaim && need_swapping)
+-			return true;
+-
+-		/* give this thread a chance to exit and free its memory */
+-		if (fatal_signal_pending(current)) {
+-			sc->nr_reclaimed += MIN_LRU_BATCH;
+-			return true;
+-		}
+-
+-		if (cgroup_reclaim(sc))
+-			return false;
+-	} else if (sc->nr_reclaimed - sc->last_reclaimed < sc->nr_to_reclaim)
+-		return false;
+-
+-	/* keep scanning at low priorities to ensure fairness */
+-	if (sc->priority > DEF_PRIORITY - 2)
+-		return false;
+-
+-	/*
+-	 * A minimum amount of work was done under global memory pressure. For
+-	 * kswapd, it may be overshooting. For direct reclaim, the target isn't
+-	 * met, and yet the allocation may still succeed, since kswapd may have
+-	 * caught up. In either case, it's better to stop now, and restart if
+-	 * necessary.
+-	 */
+-	for (i = 0; i <= sc->reclaim_idx; i++) {
+-		unsigned long wmark;
+-		struct zone *zone = lruvec_pgdat(lruvec)->node_zones + i;
+-
+-		if (!managed_zone(zone))
+-			continue;
+-
+-		wmark = current_is_kswapd() ? high_wmark_pages(zone) : low_wmark_pages(zone);
+-		if (wmark > zone_page_state(zone, NR_FREE_PAGES))
+-			return false;
+-	}
++	/* don't abort memcg reclaim to ensure fairness */
++	if (!global_reclaim(sc))
++		return -1;
+ 
+-	sc->nr_reclaimed += MIN_LRU_BATCH;
++	/* discount the previous progress for kswapd */
++	if (current_is_kswapd())
++		return sc->nr_to_reclaim + sc->last_reclaimed;
+ 
+-	return true;
++	return max(sc->nr_to_reclaim, compact_gap(sc->order));
+ }
+ 
+ static void lru_gen_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
+ {
+ 	struct blk_plug plug;
+ 	bool need_aging = false;
+-	bool need_swapping = false;
+ 	unsigned long scanned = 0;
+ 	unsigned long reclaimed = sc->nr_reclaimed;
+-	DEFINE_MAX_SEQ(lruvec);
++	unsigned long nr_to_reclaim = get_nr_to_reclaim(sc);
+ 
+ 	lru_add_drain();
+ 
+@@ -4938,7 +4902,7 @@ static void lru_gen_shrink_lruvec(struct
+ 		if (!nr_to_scan)
+ 			goto done;
+ 
+-		delta = evict_pages(lruvec, sc, swappiness, &need_swapping);
++		delta = evict_pages(lruvec, sc, swappiness);
+ 		if (!delta)
+ 			goto done;
+ 
+@@ -4946,7 +4910,7 @@ static void lru_gen_shrink_lruvec(struct
+ 		if (scanned >= nr_to_scan)
+ 			break;
+ 
+-		if (should_abort_scan(lruvec, max_seq, sc, need_swapping))
++		if (sc->nr_reclaimed >= nr_to_reclaim)
+ 			break;
+ 
+ 		cond_resched();
+@@ -5393,7 +5357,7 @@ static int run_eviction(struct lruvec *l
+ 		if (sc->nr_reclaimed >= nr_to_reclaim)
+ 			return 0;
+ 
+-		if (!evict_pages(lruvec, sc, swappiness, NULL))
++		if (!evict_pages(lruvec, sc, swappiness))
+ 			return 0;
+ 
+ 		cond_resched();
diff --git a/target/linux/generic/backport-5.15/020-v6.3-24-mm-multi-gen-LRU-remove-aging-fairness-safeguard.patch b/target/linux/generic/backport-5.15/020-v6.3-24-mm-multi-gen-LRU-remove-aging-fairness-safeguard.patch
new file mode 100644
index 00000000000000..316217ed028d25
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.3-24-mm-multi-gen-LRU-remove-aging-fairness-safeguard.patch
@@ -0,0 +1,287 @@
+From e20b7386fccc18c791796eb1dc1a91eee3ccf801 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Wed, 21 Dec 2022 21:19:02 -0700
+Subject: [PATCH 24/29] mm: multi-gen LRU: remove aging fairness safeguard
+
+Recall that the aging produces the youngest generation: first it scans
+for accessed pages and updates their gen counters; then it increments
+lrugen->max_seq.
+
+The current aging fairness safeguard for kswapd uses two passes to
+ensure the fairness to multiple eligible memcgs. On the first pass,
+which is shared with the eviction, it checks whether all eligible
+memcgs are low on cold pages. If so, it requires a second pass, on
+which it ages all those memcgs at the same time.
+
+With memcg LRU, the aging, while ensuring eventual fairness, will run
+when necessary. Therefore the current aging fairness safeguard for
+kswapd will not be needed.
+
+Note that memcg LRU only applies to global reclaim. For memcg reclaim,
+the aging can be unfair to different memcgs, i.e., their
+lrugen->max_seq can be incremented at different paces.
+
+Link: https://lkml.kernel.org/r/20221222041905.2431096-5-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Roman Gushchin <roman.gushchin@linux.dev>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ mm/vmscan.c | 126 ++++++++++++++++++++++++----------------------------
+ 1 file changed, 59 insertions(+), 67 deletions(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -131,7 +131,6 @@ struct scan_control {
+ 
+ #ifdef CONFIG_LRU_GEN
+ 	/* help kswapd make better choices among multiple memcgs */
+-	unsigned int memcgs_need_aging:1;
+ 	unsigned long last_reclaimed;
+ #endif
+ 
+@@ -4184,7 +4183,7 @@ done:
+ 	return true;
+ }
+ 
+-static bool should_run_aging(struct lruvec *lruvec, unsigned long max_seq, unsigned long *min_seq,
++static bool should_run_aging(struct lruvec *lruvec, unsigned long max_seq,
+ 			     struct scan_control *sc, bool can_swap, unsigned long *nr_to_scan)
+ {
+ 	int gen, type, zone;
+@@ -4193,6 +4192,13 @@ static bool should_run_aging(struct lruv
+ 	unsigned long total = 0;
+ 	struct lru_gen_page *lrugen = &lruvec->lrugen;
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
++	DEFINE_MIN_SEQ(lruvec);
++
++	/* whether this lruvec is completely out of cold pages */
++	if (min_seq[!can_swap] + MIN_NR_GENS > max_seq) {
++		*nr_to_scan = 0;
++		return true;
++	}
+ 
+ 	for (type = !can_swap; type < ANON_AND_FILE; type++) {
+ 		unsigned long seq;
+@@ -4221,8 +4227,6 @@ static bool should_run_aging(struct lruv
+ 	 * stalls when the number of generations reaches MIN_NR_GENS. Hence, the
+ 	 * ideal number of generations is MIN_NR_GENS+1.
+ 	 */
+-	if (min_seq[!can_swap] + MIN_NR_GENS > max_seq)
+-		return true;
+ 	if (min_seq[!can_swap] + MIN_NR_GENS < max_seq)
+ 		return false;
+ 
+@@ -4241,40 +4245,54 @@ static bool should_run_aging(struct lruv
+ 	return false;
+ }
+ 
+-static bool age_lruvec(struct lruvec *lruvec, struct scan_control *sc, unsigned long min_ttl)
++static bool lruvec_is_sizable(struct lruvec *lruvec, struct scan_control *sc)
+ {
+-	bool need_aging;
+-	unsigned long nr_to_scan;
+-	int swappiness = get_swappiness(lruvec, sc);
++	int gen, type, zone;
++	unsigned long total = 0;
++	bool can_swap = get_swappiness(lruvec, sc);
++	struct lru_gen_page *lrugen = &lruvec->lrugen;
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+ 	DEFINE_MAX_SEQ(lruvec);
+ 	DEFINE_MIN_SEQ(lruvec);
+ 
+-	VM_WARN_ON_ONCE(sc->memcg_low_reclaim);
++	for (type = !can_swap; type < ANON_AND_FILE; type++) {
++		unsigned long seq;
+ 
+-	mem_cgroup_calculate_protection(NULL, memcg);
++		for (seq = min_seq[type]; seq <= max_seq; seq++) {
++			gen = lru_gen_from_seq(seq);
+ 
+-	if (mem_cgroup_below_min(memcg))
+-		return false;
++			for (zone = 0; zone < MAX_NR_ZONES; zone++)
++				total += max(READ_ONCE(lrugen->nr_pages[gen][type][zone]), 0L);
++		}
++	}
+ 
+-	need_aging = should_run_aging(lruvec, max_seq, min_seq, sc, swappiness, &nr_to_scan);
++	/* whether the size is big enough to be helpful */
++	return mem_cgroup_online(memcg) ? (total >> sc->priority) : total;
++}
+ 
+-	if (min_ttl) {
+-		int gen = lru_gen_from_seq(min_seq[LRU_GEN_FILE]);
+-		unsigned long birth = READ_ONCE(lruvec->lrugen.timestamps[gen]);
++static bool lruvec_is_reclaimable(struct lruvec *lruvec, struct scan_control *sc,
++				  unsigned long min_ttl)
++{
++	int gen;
++	unsigned long birth;
++	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
++	DEFINE_MIN_SEQ(lruvec);
+ 
+-		if (time_is_after_jiffies(birth + min_ttl))
+-			return false;
++	VM_WARN_ON_ONCE(sc->memcg_low_reclaim);
+ 
+-		/* the size is likely too small to be helpful */
+-		if (!nr_to_scan && sc->priority != DEF_PRIORITY)
+-			return false;
+-	}
++	/* see the comment on lru_gen_page */
++	gen = lru_gen_from_seq(min_seq[LRU_GEN_FILE]);
++	birth = READ_ONCE(lruvec->lrugen.timestamps[gen]);
+ 
+-	if (need_aging)
+-		try_to_inc_max_seq(lruvec, max_seq, sc, swappiness, false);
++	if (time_is_after_jiffies(birth + min_ttl))
++		return false;
+ 
+-	return true;
++	if (!lruvec_is_sizable(lruvec, sc))
++		return false;
++
++	mem_cgroup_calculate_protection(NULL, memcg);
++
++	return !mem_cgroup_below_min(memcg);
+ }
+ 
+ /* to protect the working set of the last N jiffies */
+@@ -4283,46 +4301,32 @@ static unsigned long lru_gen_min_ttl __r
+ static void lru_gen_age_node(struct pglist_data *pgdat, struct scan_control *sc)
+ {
+ 	struct mem_cgroup *memcg;
+-	bool success = false;
+ 	unsigned long min_ttl = READ_ONCE(lru_gen_min_ttl);
+ 
+ 	VM_WARN_ON_ONCE(!current_is_kswapd());
+ 
+ 	sc->last_reclaimed = sc->nr_reclaimed;
+ 
+-	/*
+-	 * To reduce the chance of going into the aging path, which can be
+-	 * costly, optimistically skip it if the flag below was cleared in the
+-	 * eviction path. This improves the overall performance when multiple
+-	 * memcgs are available.
+-	 */
+-	if (!sc->memcgs_need_aging) {
+-		sc->memcgs_need_aging = true;
++	/* check the order to exclude compaction-induced reclaim */
++	if (!min_ttl || sc->order || sc->priority == DEF_PRIORITY)
+ 		return;
+-	}
+-
+-	set_mm_walk(pgdat);
+ 
+ 	memcg = mem_cgroup_iter(NULL, NULL, NULL);
+ 	do {
+ 		struct lruvec *lruvec = mem_cgroup_lruvec(memcg, pgdat);
+ 
+-		if (age_lruvec(lruvec, sc, min_ttl))
+-			success = true;
++		if (lruvec_is_reclaimable(lruvec, sc, min_ttl)) {
++			mem_cgroup_iter_break(NULL, memcg);
++			return;
++		}
+ 
+ 		cond_resched();
+ 	} while ((memcg = mem_cgroup_iter(NULL, memcg, NULL)));
+ 
+-	clear_mm_walk();
+-
+-	/* check the order to exclude compaction-induced reclaim */
+-	if (success || !min_ttl || sc->order)
+-		return;
+-
+ 	/*
+ 	 * The main goal is to OOM kill if every generation from all memcgs is
+ 	 * younger than min_ttl. However, another possibility is all memcgs are
+-	 * either below min or empty.
++	 * either too small or below min.
+ 	 */
+ 	if (mutex_trylock(&oom_lock)) {
+ 		struct oom_control oc = {
+@@ -4830,33 +4834,27 @@ retry:
+  *    reclaim.
+  */
+ static unsigned long get_nr_to_scan(struct lruvec *lruvec, struct scan_control *sc,
+-				    bool can_swap, bool *need_aging)
++				    bool can_swap)
+ {
+ 	unsigned long nr_to_scan;
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+ 	DEFINE_MAX_SEQ(lruvec);
+-	DEFINE_MIN_SEQ(lruvec);
+ 
+ 	if (mem_cgroup_below_min(memcg) ||
+ 	    (mem_cgroup_below_low(memcg) && !sc->memcg_low_reclaim))
+ 		return 0;
+ 
+-	*need_aging = should_run_aging(lruvec, max_seq, min_seq, sc, can_swap, &nr_to_scan);
+-	if (!*need_aging)
++	if (!should_run_aging(lruvec, max_seq, sc, can_swap, &nr_to_scan))
+ 		return nr_to_scan;
+ 
+ 	/* skip the aging path at the default priority */
+ 	if (sc->priority == DEF_PRIORITY)
+-		goto done;
++		return nr_to_scan;
+ 
+-	/* leave the work to lru_gen_age_node() */
+-	if (current_is_kswapd())
+-		return 0;
++	try_to_inc_max_seq(lruvec, max_seq, sc, can_swap, false);
+ 
+-	if (try_to_inc_max_seq(lruvec, max_seq, sc, can_swap, false))
+-		return nr_to_scan;
+-done:
+-	return min_seq[!can_swap] + MIN_NR_GENS <= max_seq ? nr_to_scan : 0;
++	/* skip this lruvec as it's low on cold pages */
++	return 0;
+ }
+ 
+ static unsigned long get_nr_to_reclaim(struct scan_control *sc)
+@@ -4875,9 +4873,7 @@ static unsigned long get_nr_to_reclaim(s
+ static void lru_gen_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
+ {
+ 	struct blk_plug plug;
+-	bool need_aging = false;
+ 	unsigned long scanned = 0;
+-	unsigned long reclaimed = sc->nr_reclaimed;
+ 	unsigned long nr_to_reclaim = get_nr_to_reclaim(sc);
+ 
+ 	lru_add_drain();
+@@ -4898,13 +4894,13 @@ static void lru_gen_shrink_lruvec(struct
+ 		else
+ 			swappiness = 0;
+ 
+-		nr_to_scan = get_nr_to_scan(lruvec, sc, swappiness, &need_aging);
++		nr_to_scan = get_nr_to_scan(lruvec, sc, swappiness);
+ 		if (!nr_to_scan)
+-			goto done;
++			break;
+ 
+ 		delta = evict_pages(lruvec, sc, swappiness);
+ 		if (!delta)
+-			goto done;
++			break;
+ 
+ 		scanned += delta;
+ 		if (scanned >= nr_to_scan)
+@@ -4916,10 +4912,6 @@ static void lru_gen_shrink_lruvec(struct
+ 		cond_resched();
+ 	}
+ 
+-	/* see the comment in lru_gen_age_node() */
+-	if (sc->nr_reclaimed - reclaimed >= MIN_LRU_BATCH && !need_aging)
+-		sc->memcgs_need_aging = false;
+-done:
+ 	clear_mm_walk();
+ 
+ 	blk_finish_plug(&plug);
diff --git a/target/linux/generic/backport-5.15/020-v6.3-25-mm-multi-gen-LRU-shuffle-should_run_aging.patch b/target/linux/generic/backport-5.15/020-v6.3-25-mm-multi-gen-LRU-shuffle-should_run_aging.patch
new file mode 100644
index 00000000000000..391ee6e67cea48
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.3-25-mm-multi-gen-LRU-shuffle-should_run_aging.patch
@@ -0,0 +1,161 @@
+From 107d54931df3c28d81648122e219bf0034ef4e99 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Wed, 21 Dec 2022 21:19:03 -0700
+Subject: [PATCH 25/29] mm: multi-gen LRU: shuffle should_run_aging()
+
+Move should_run_aging() next to its only caller left.
+
+Link: https://lkml.kernel.org/r/20221222041905.2431096-6-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Roman Gushchin <roman.gushchin@linux.dev>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ mm/vmscan.c | 124 ++++++++++++++++++++++++++--------------------------
+ 1 file changed, 62 insertions(+), 62 deletions(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -4183,68 +4183,6 @@ done:
+ 	return true;
+ }
+ 
+-static bool should_run_aging(struct lruvec *lruvec, unsigned long max_seq,
+-			     struct scan_control *sc, bool can_swap, unsigned long *nr_to_scan)
+-{
+-	int gen, type, zone;
+-	unsigned long old = 0;
+-	unsigned long young = 0;
+-	unsigned long total = 0;
+-	struct lru_gen_page *lrugen = &lruvec->lrugen;
+-	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+-	DEFINE_MIN_SEQ(lruvec);
+-
+-	/* whether this lruvec is completely out of cold pages */
+-	if (min_seq[!can_swap] + MIN_NR_GENS > max_seq) {
+-		*nr_to_scan = 0;
+-		return true;
+-	}
+-
+-	for (type = !can_swap; type < ANON_AND_FILE; type++) {
+-		unsigned long seq;
+-
+-		for (seq = min_seq[type]; seq <= max_seq; seq++) {
+-			unsigned long size = 0;
+-
+-			gen = lru_gen_from_seq(seq);
+-
+-			for (zone = 0; zone < MAX_NR_ZONES; zone++)
+-				size += max(READ_ONCE(lrugen->nr_pages[gen][type][zone]), 0L);
+-
+-			total += size;
+-			if (seq == max_seq)
+-				young += size;
+-			else if (seq + MIN_NR_GENS == max_seq)
+-				old += size;
+-		}
+-	}
+-
+-	/* try to scrape all its memory if this memcg was deleted */
+-	*nr_to_scan = mem_cgroup_online(memcg) ? (total >> sc->priority) : total;
+-
+-	/*
+-	 * The aging tries to be lazy to reduce the overhead, while the eviction
+-	 * stalls when the number of generations reaches MIN_NR_GENS. Hence, the
+-	 * ideal number of generations is MIN_NR_GENS+1.
+-	 */
+-	if (min_seq[!can_swap] + MIN_NR_GENS < max_seq)
+-		return false;
+-
+-	/*
+-	 * It's also ideal to spread pages out evenly, i.e., 1/(MIN_NR_GENS+1)
+-	 * of the total number of pages for each generation. A reasonable range
+-	 * for this average portion is [1/MIN_NR_GENS, 1/(MIN_NR_GENS+2)]. The
+-	 * aging cares about the upper bound of hot pages, while the eviction
+-	 * cares about the lower bound of cold pages.
+-	 */
+-	if (young * MIN_NR_GENS > total)
+-		return true;
+-	if (old * (MIN_NR_GENS + 2) < total)
+-		return true;
+-
+-	return false;
+-}
+-
+ static bool lruvec_is_sizable(struct lruvec *lruvec, struct scan_control *sc)
+ {
+ 	int gen, type, zone;
+@@ -4828,6 +4766,68 @@ retry:
+ 	return scanned;
+ }
+ 
++static bool should_run_aging(struct lruvec *lruvec, unsigned long max_seq,
++			     struct scan_control *sc, bool can_swap, unsigned long *nr_to_scan)
++{
++	int gen, type, zone;
++	unsigned long old = 0;
++	unsigned long young = 0;
++	unsigned long total = 0;
++	struct lru_gen_page *lrugen = &lruvec->lrugen;
++	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
++	DEFINE_MIN_SEQ(lruvec);
++
++	/* whether this lruvec is completely out of cold pages */
++	if (min_seq[!can_swap] + MIN_NR_GENS > max_seq) {
++		*nr_to_scan = 0;
++		return true;
++	}
++
++	for (type = !can_swap; type < ANON_AND_FILE; type++) {
++		unsigned long seq;
++
++		for (seq = min_seq[type]; seq <= max_seq; seq++) {
++			unsigned long size = 0;
++
++			gen = lru_gen_from_seq(seq);
++
++			for (zone = 0; zone < MAX_NR_ZONES; zone++)
++				size += max(READ_ONCE(lrugen->nr_pages[gen][type][zone]), 0L);
++
++			total += size;
++			if (seq == max_seq)
++				young += size;
++			else if (seq + MIN_NR_GENS == max_seq)
++				old += size;
++		}
++	}
++
++	/* try to scrape all its memory if this memcg was deleted */
++	*nr_to_scan = mem_cgroup_online(memcg) ? (total >> sc->priority) : total;
++
++	/*
++	 * The aging tries to be lazy to reduce the overhead, while the eviction
++	 * stalls when the number of generations reaches MIN_NR_GENS. Hence, the
++	 * ideal number of generations is MIN_NR_GENS+1.
++	 */
++	if (min_seq[!can_swap] + MIN_NR_GENS < max_seq)
++		return false;
++
++	/*
++	 * It's also ideal to spread pages out evenly, i.e., 1/(MIN_NR_GENS+1)
++	 * of the total number of pages for each generation. A reasonable range
++	 * for this average portion is [1/MIN_NR_GENS, 1/(MIN_NR_GENS+2)]. The
++	 * aging cares about the upper bound of hot pages, while the eviction
++	 * cares about the lower bound of cold pages.
++	 */
++	if (young * MIN_NR_GENS > total)
++		return true;
++	if (old * (MIN_NR_GENS + 2) < total)
++		return true;
++
++	return false;
++}
++
+ /*
+  * For future optimizations:
+  * 1. Defer try_to_inc_max_seq() to workqueues to reduce latency for memcg
diff --git a/target/linux/generic/backport-5.15/020-v6.3-26-mm-multi-gen-LRU-per-node-lru_gen_page-lists.patch b/target/linux/generic/backport-5.15/020-v6.3-26-mm-multi-gen-LRU-per-node-lru_gen_page-lists.patch
new file mode 100644
index 00000000000000..f54e828de10600
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.3-26-mm-multi-gen-LRU-per-node-lru_gen_page-lists.patch
@@ -0,0 +1,868 @@
+From fa6363828d314e837c5f79e97ea5e8c0d2f7f062 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Wed, 21 Dec 2022 21:19:04 -0700
+Subject: [PATCH 26/29] mm: multi-gen LRU: per-node lru_gen_page lists
+
+For each node, memcgs are divided into two generations: the old and
+the young. For each generation, memcgs are randomly sharded into
+multiple bins to improve scalability. For each bin, an RCU hlist_nulls
+is virtually divided into three segments: the head, the tail and the
+default.
+
+An onlining memcg is added to the tail of a random bin in the old
+generation. The eviction starts at the head of a random bin in the old
+generation. The per-node memcg generation counter, whose reminder (mod
+2) indexes the old generation, is incremented when all its bins become
+empty.
+
+There are four operations:
+1. MEMCG_LRU_HEAD, which moves an memcg to the head of a random bin in
+   its current generation (old or young) and updates its "seg" to
+   "head";
+2. MEMCG_LRU_TAIL, which moves an memcg to the tail of a random bin in
+   its current generation (old or young) and updates its "seg" to
+   "tail";
+3. MEMCG_LRU_OLD, which moves an memcg to the head of a random bin in
+   the old generation, updates its "gen" to "old" and resets its "seg"
+   to "default";
+4. MEMCG_LRU_YOUNG, which moves an memcg to the tail of a random bin
+   in the young generation, updates its "gen" to "young" and resets
+   its "seg" to "default".
+
+The events that trigger the above operations are:
+1. Exceeding the soft limit, which triggers MEMCG_LRU_HEAD;
+2. The first attempt to reclaim an memcg below low, which triggers
+   MEMCG_LRU_TAIL;
+3. The first attempt to reclaim an memcg below reclaimable size
+   threshold, which triggers MEMCG_LRU_TAIL;
+4. The second attempt to reclaim an memcg below reclaimable size
+   threshold, which triggers MEMCG_LRU_YOUNG;
+5. Attempting to reclaim an memcg below min, which triggers
+   MEMCG_LRU_YOUNG;
+6. Finishing the aging on the eviction path, which triggers
+   MEMCG_LRU_YOUNG;
+7. Offlining an memcg, which triggers MEMCG_LRU_OLD.
+
+Note that memcg LRU only applies to global reclaim, and the
+round-robin incrementing of their max_seq counters ensures the
+eventual fairness to all eligible memcgs. For memcg reclaim, it still
+relies on mem_cgroup_iter().
+
+Link: https://lkml.kernel.org/r/20221222041905.2431096-7-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Roman Gushchin <roman.gushchin@linux.dev>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ include/linux/memcontrol.h |  10 +
+ include/linux/mm_inline.h  |  17 ++
+ include/linux/mmzone.h     | 117 +++++++++++-
+ mm/memcontrol.c            |  16 ++
+ mm/page_alloc.c            |   1 +
+ mm/vmscan.c                | 373 +++++++++++++++++++++++++++++++++----
+ 6 files changed, 499 insertions(+), 35 deletions(-)
+
+--- a/include/linux/memcontrol.h
++++ b/include/linux/memcontrol.h
+@@ -818,6 +818,11 @@ static inline void obj_cgroup_put(struct
+ 	percpu_ref_put(&objcg->refcnt);
+ }
+ 
++static inline bool mem_cgroup_tryget(struct mem_cgroup *memcg)
++{
++	return !memcg || css_tryget(&memcg->css);
++}
++
+ static inline void mem_cgroup_put(struct mem_cgroup *memcg)
+ {
+ 	if (memcg)
+@@ -1283,6 +1288,11 @@ struct mem_cgroup *mem_cgroup_from_css(s
+ 	return NULL;
+ }
+ 
++static inline bool mem_cgroup_tryget(struct mem_cgroup *memcg)
++{
++	return true;
++}
++
+ static inline void mem_cgroup_put(struct mem_cgroup *memcg)
+ {
+ }
+--- a/include/linux/mm_inline.h
++++ b/include/linux/mm_inline.h
+@@ -112,6 +112,18 @@ static inline bool lru_gen_in_fault(void
+ 	return current->in_lru_fault;
+ }
+ 
++#ifdef CONFIG_MEMCG
++static inline int lru_gen_memcg_seg(struct lruvec *lruvec)
++{
++	return READ_ONCE(lruvec->lrugen.seg);
++}
++#else
++static inline int lru_gen_memcg_seg(struct lruvec *lruvec)
++{
++	return 0;
++}
++#endif
++
+ static inline int lru_gen_from_seq(unsigned long seq)
+ {
+ 	return seq % MAX_NR_GENS;
+@@ -287,6 +299,11 @@ static inline bool lru_gen_in_fault(void
+ 	return false;
+ }
+ 
++static inline int lru_gen_memcg_seg(struct lruvec *lruvec)
++{
++	return 0;
++}
++
+ static inline bool lru_gen_add_page(struct lruvec *lruvec, struct page *page, bool reclaiming)
+ {
+ 	return false;
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -7,6 +7,7 @@
+ 
+ #include <linux/spinlock.h>
+ #include <linux/list.h>
++#include <linux/list_nulls.h>
+ #include <linux/wait.h>
+ #include <linux/bitops.h>
+ #include <linux/cache.h>
+@@ -357,6 +358,15 @@ struct page_vma_mapped_walk;
+ #define LRU_GEN_MASK		((BIT(LRU_GEN_WIDTH) - 1) << LRU_GEN_PGOFF)
+ #define LRU_REFS_MASK		((BIT(LRU_REFS_WIDTH) - 1) << LRU_REFS_PGOFF)
+ 
++/* see the comment on MEMCG_NR_GENS */
++enum {
++	MEMCG_LRU_NOP,
++	MEMCG_LRU_HEAD,
++	MEMCG_LRU_TAIL,
++	MEMCG_LRU_OLD,
++	MEMCG_LRU_YOUNG,
++};
++
+ #ifdef CONFIG_LRU_GEN
+ 
+ enum {
+@@ -416,6 +426,14 @@ struct lru_gen_page {
+ 	atomic_long_t refaulted[NR_HIST_GENS][ANON_AND_FILE][MAX_NR_TIERS];
+ 	/* whether the multi-gen LRU is enabled */
+ 	bool enabled;
++#ifdef CONFIG_MEMCG
++	/* the memcg generation this lru_gen_page belongs to */
++	u8 gen;
++	/* the list segment this lru_gen_page belongs to */
++	u8 seg;
++	/* per-node lru_gen_page list for global reclaim */
++	struct hlist_nulls_node list;
++#endif
+ };
+ 
+ enum {
+@@ -469,12 +487,87 @@ void lru_gen_init_lruvec(struct lruvec *
+ void lru_gen_look_around(struct page_vma_mapped_walk *pvmw);
+ 
+ #ifdef CONFIG_MEMCG
++
++/*
++ * For each node, memcgs are divided into two generations: the old and the
++ * young. For each generation, memcgs are randomly sharded into multiple bins
++ * to improve scalability. For each bin, the hlist_nulls is virtually divided
++ * into three segments: the head, the tail and the default.
++ *
++ * An onlining memcg is added to the tail of a random bin in the old generation.
++ * The eviction starts at the head of a random bin in the old generation. The
++ * per-node memcg generation counter, whose reminder (mod MEMCG_NR_GENS) indexes
++ * the old generation, is incremented when all its bins become empty.
++ *
++ * There are four operations:
++ * 1. MEMCG_LRU_HEAD, which moves an memcg to the head of a random bin in its
++ *    current generation (old or young) and updates its "seg" to "head";
++ * 2. MEMCG_LRU_TAIL, which moves an memcg to the tail of a random bin in its
++ *    current generation (old or young) and updates its "seg" to "tail";
++ * 3. MEMCG_LRU_OLD, which moves an memcg to the head of a random bin in the old
++ *    generation, updates its "gen" to "old" and resets its "seg" to "default";
++ * 4. MEMCG_LRU_YOUNG, which moves an memcg to the tail of a random bin in the
++ *    young generation, updates its "gen" to "young" and resets its "seg" to
++ *    "default".
++ *
++ * The events that trigger the above operations are:
++ * 1. Exceeding the soft limit, which triggers MEMCG_LRU_HEAD;
++ * 2. The first attempt to reclaim an memcg below low, which triggers
++ *    MEMCG_LRU_TAIL;
++ * 3. The first attempt to reclaim an memcg below reclaimable size threshold,
++ *    which triggers MEMCG_LRU_TAIL;
++ * 4. The second attempt to reclaim an memcg below reclaimable size threshold,
++ *    which triggers MEMCG_LRU_YOUNG;
++ * 5. Attempting to reclaim an memcg below min, which triggers MEMCG_LRU_YOUNG;
++ * 6. Finishing the aging on the eviction path, which triggers MEMCG_LRU_YOUNG;
++ * 7. Offlining an memcg, which triggers MEMCG_LRU_OLD.
++ *
++ * Note that memcg LRU only applies to global reclaim, and the round-robin
++ * incrementing of their max_seq counters ensures the eventual fairness to all
++ * eligible memcgs. For memcg reclaim, it still relies on mem_cgroup_iter().
++ */
++#define MEMCG_NR_GENS	2
++#define MEMCG_NR_BINS	8
++
++struct lru_gen_memcg {
++	/* the per-node memcg generation counter */
++	unsigned long seq;
++	/* each memcg has one lru_gen_page per node */
++	unsigned long nr_memcgs[MEMCG_NR_GENS];
++	/* per-node lru_gen_page list for global reclaim */
++	struct hlist_nulls_head	fifo[MEMCG_NR_GENS][MEMCG_NR_BINS];
++	/* protects the above */
++	spinlock_t lock;
++};
++
++void lru_gen_init_pgdat(struct pglist_data *pgdat);
++
+ void lru_gen_init_memcg(struct mem_cgroup *memcg);
+ void lru_gen_exit_memcg(struct mem_cgroup *memcg);
+-#endif
++void lru_gen_online_memcg(struct mem_cgroup *memcg);
++void lru_gen_offline_memcg(struct mem_cgroup *memcg);
++void lru_gen_release_memcg(struct mem_cgroup *memcg);
++void lru_gen_rotate_memcg(struct lruvec *lruvec, int op);
++
++#else /* !CONFIG_MEMCG */
++
++#define MEMCG_NR_GENS	1
++
++struct lru_gen_memcg {
++};
++
++static inline void lru_gen_init_pgdat(struct pglist_data *pgdat)
++{
++}
++
++#endif /* CONFIG_MEMCG */
+ 
+ #else /* !CONFIG_LRU_GEN */
+ 
++static inline void lru_gen_init_pgdat(struct pglist_data *pgdat)
++{
++}
++
+ static inline void lru_gen_init_lruvec(struct lruvec *lruvec)
+ {
+ }
+@@ -484,6 +577,7 @@ static inline void lru_gen_look_around(s
+ }
+ 
+ #ifdef CONFIG_MEMCG
++
+ static inline void lru_gen_init_memcg(struct mem_cgroup *memcg)
+ {
+ }
+@@ -491,7 +585,24 @@ static inline void lru_gen_init_memcg(st
+ static inline void lru_gen_exit_memcg(struct mem_cgroup *memcg)
+ {
+ }
+-#endif
++
++static inline void lru_gen_online_memcg(struct mem_cgroup *memcg)
++{
++}
++
++static inline void lru_gen_offline_memcg(struct mem_cgroup *memcg)
++{
++}
++
++static inline void lru_gen_release_memcg(struct mem_cgroup *memcg)
++{
++}
++
++static inline void lru_gen_rotate_memcg(struct lruvec *lruvec, int op)
++{
++}
++
++#endif /* CONFIG_MEMCG */
+ 
+ #endif /* CONFIG_LRU_GEN */
+ 
+@@ -1105,6 +1216,8 @@ typedef struct pglist_data {
+ #ifdef CONFIG_LRU_GEN
+ 	/* kswap mm walk data */
+ 	struct lru_gen_mm_walk	mm_walk;
++	/* lru_gen_page list */
++	struct lru_gen_memcg memcg_lru;
+ #endif
+ 
+ 	ZONE_PADDING(_pad2_)
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -549,6 +549,16 @@ static void mem_cgroup_update_tree(struc
+ 	struct mem_cgroup_per_node *mz;
+ 	struct mem_cgroup_tree_per_node *mctz;
+ 
++	if (lru_gen_enabled()) {
++		struct lruvec *lruvec = &mem_cgroup_page_nodeinfo(memcg, page)->lruvec;
++
++		/* see the comment on MEMCG_NR_GENS */
++		if (soft_limit_excess(memcg) && lru_gen_memcg_seg(lruvec) != MEMCG_LRU_HEAD)
++			lru_gen_rotate_memcg(lruvec, MEMCG_LRU_HEAD);
++
++		return;
++	}
++
+ 	mctz = soft_limit_tree_from_page(page);
+ 	if (!mctz)
+ 		return;
+@@ -3433,6 +3443,9 @@ unsigned long mem_cgroup_soft_limit_recl
+ 	unsigned long excess;
+ 	unsigned long nr_scanned;
+ 
++	if (lru_gen_enabled())
++		return 0;
++
+ 	if (order > 0)
+ 		return 0;
+ 
+@@ -5321,6 +5334,7 @@ static int mem_cgroup_css_online(struct
+ 	if (unlikely(mem_cgroup_is_root(memcg)))
+ 		queue_delayed_work(system_unbound_wq, &stats_flush_dwork,
+ 				   2UL*HZ);
++	lru_gen_online_memcg(memcg);
+ 	return 0;
+ }
+ 
+@@ -5347,6 +5361,7 @@ static void mem_cgroup_css_offline(struc
+ 	memcg_offline_kmem(memcg);
+ 	reparent_shrinker_deferred(memcg);
+ 	wb_memcg_offline(memcg);
++	lru_gen_offline_memcg(memcg);
+ 
+ 	drain_all_stock(memcg);
+ 
+@@ -5358,6 +5373,7 @@ static void mem_cgroup_css_released(stru
+ 	struct mem_cgroup *memcg = mem_cgroup_from_css(css);
+ 
+ 	invalidate_reclaim_iterators(memcg);
++	lru_gen_release_memcg(memcg);
+ }
+ 
+ static void mem_cgroup_css_free(struct cgroup_subsys_state *css)
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -7661,6 +7661,7 @@ static void __init free_area_init_node(i
+ 	pgdat_set_deferred_range(pgdat);
+ 
+ 	free_area_init_core(pgdat);
++	lru_gen_init_pgdat(pgdat);
+ }
+ 
+ void __init free_area_init_memoryless_node(int nid)
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -54,6 +54,8 @@
+ #include <linux/shmem_fs.h>
+ #include <linux/ctype.h>
+ #include <linux/debugfs.h>
++#include <linux/rculist_nulls.h>
++#include <linux/random.h>
+ 
+ #include <asm/tlbflush.h>
+ #include <asm/div64.h>
+@@ -129,11 +131,6 @@ struct scan_control {
+ 	/* Always discard instead of demoting to lower tier memory */
+ 	unsigned int no_demotion:1;
+ 
+-#ifdef CONFIG_LRU_GEN
+-	/* help kswapd make better choices among multiple memcgs */
+-	unsigned long last_reclaimed;
+-#endif
+-
+ 	/* Allocation order */
+ 	s8 order;
+ 
+@@ -2880,6 +2877,9 @@ DEFINE_STATIC_KEY_ARRAY_FALSE(lru_gen_ca
+ 		for ((type) = 0; (type) < ANON_AND_FILE; (type)++)	\
+ 			for ((zone) = 0; (zone) < MAX_NR_ZONES; (zone)++)
+ 
++#define get_memcg_gen(seq)	((seq) % MEMCG_NR_GENS)
++#define get_memcg_bin(bin)	((bin) % MEMCG_NR_BINS)
++
+ static struct lruvec *get_lruvec(struct mem_cgroup *memcg, int nid)
+ {
+ 	struct pglist_data *pgdat = NODE_DATA(nid);
+@@ -4169,8 +4169,7 @@ done:
+ 		if (sc->priority <= DEF_PRIORITY - 2)
+ 			wait_event_killable(lruvec->mm_state.wait,
+ 					    max_seq < READ_ONCE(lrugen->max_seq));
+-
+-		return max_seq < READ_ONCE(lrugen->max_seq);
++		return false;
+ 	}
+ 
+ 	VM_WARN_ON_ONCE(max_seq != READ_ONCE(lrugen->max_seq));
+@@ -4243,8 +4242,6 @@ static void lru_gen_age_node(struct pgli
+ 
+ 	VM_WARN_ON_ONCE(!current_is_kswapd());
+ 
+-	sc->last_reclaimed = sc->nr_reclaimed;
+-
+ 	/* check the order to exclude compaction-induced reclaim */
+ 	if (!min_ttl || sc->order || sc->priority == DEF_PRIORITY)
+ 		return;
+@@ -4833,8 +4830,7 @@ static bool should_run_aging(struct lruv
+  * 1. Defer try_to_inc_max_seq() to workqueues to reduce latency for memcg
+  *    reclaim.
+  */
+-static unsigned long get_nr_to_scan(struct lruvec *lruvec, struct scan_control *sc,
+-				    bool can_swap)
++static long get_nr_to_scan(struct lruvec *lruvec, struct scan_control *sc, bool can_swap)
+ {
+ 	unsigned long nr_to_scan;
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+@@ -4851,10 +4847,8 @@ static unsigned long get_nr_to_scan(stru
+ 	if (sc->priority == DEF_PRIORITY)
+ 		return nr_to_scan;
+ 
+-	try_to_inc_max_seq(lruvec, max_seq, sc, can_swap, false);
+-
+ 	/* skip this lruvec as it's low on cold pages */
+-	return 0;
++	return try_to_inc_max_seq(lruvec, max_seq, sc, can_swap, false) ? -1 : 0;
+ }
+ 
+ static unsigned long get_nr_to_reclaim(struct scan_control *sc)
+@@ -4863,29 +4857,18 @@ static unsigned long get_nr_to_reclaim(s
+ 	if (!global_reclaim(sc))
+ 		return -1;
+ 
+-	/* discount the previous progress for kswapd */
+-	if (current_is_kswapd())
+-		return sc->nr_to_reclaim + sc->last_reclaimed;
+-
+ 	return max(sc->nr_to_reclaim, compact_gap(sc->order));
+ }
+ 
+-static void lru_gen_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
++static bool try_to_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
+ {
+-	struct blk_plug plug;
++	long nr_to_scan;
+ 	unsigned long scanned = 0;
+ 	unsigned long nr_to_reclaim = get_nr_to_reclaim(sc);
+ 
+-	lru_add_drain();
+-
+-	blk_start_plug(&plug);
+-
+-	set_mm_walk(lruvec_pgdat(lruvec));
+-
+ 	while (true) {
+ 		int delta;
+ 		int swappiness;
+-		unsigned long nr_to_scan;
+ 
+ 		if (sc->may_swap)
+ 			swappiness = get_swappiness(lruvec, sc);
+@@ -4895,7 +4878,7 @@ static void lru_gen_shrink_lruvec(struct
+ 			swappiness = 0;
+ 
+ 		nr_to_scan = get_nr_to_scan(lruvec, sc, swappiness);
+-		if (!nr_to_scan)
++		if (nr_to_scan <= 0)
+ 			break;
+ 
+ 		delta = evict_pages(lruvec, sc, swappiness);
+@@ -4912,10 +4895,250 @@ static void lru_gen_shrink_lruvec(struct
+ 		cond_resched();
+ 	}
+ 
++	/* whether try_to_inc_max_seq() was successful */
++	return nr_to_scan < 0;
++}
++
++static int shrink_one(struct lruvec *lruvec, struct scan_control *sc)
++{
++	bool success;
++	unsigned long scanned = sc->nr_scanned;
++	unsigned long reclaimed = sc->nr_reclaimed;
++	int seg = lru_gen_memcg_seg(lruvec);
++	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
++	struct pglist_data *pgdat = lruvec_pgdat(lruvec);
++
++	/* see the comment on MEMCG_NR_GENS */
++	if (!lruvec_is_sizable(lruvec, sc))
++		return seg != MEMCG_LRU_TAIL ? MEMCG_LRU_TAIL : MEMCG_LRU_YOUNG;
++
++	mem_cgroup_calculate_protection(NULL, memcg);
++
++	if (mem_cgroup_below_min(memcg))
++		return MEMCG_LRU_YOUNG;
++
++	if (mem_cgroup_below_low(memcg)) {
++		/* see the comment on MEMCG_NR_GENS */
++		if (seg != MEMCG_LRU_TAIL)
++			return MEMCG_LRU_TAIL;
++
++		memcg_memory_event(memcg, MEMCG_LOW);
++	}
++
++	success = try_to_shrink_lruvec(lruvec, sc);
++
++	shrink_slab(sc->gfp_mask, pgdat->node_id, memcg, sc->priority);
++
++	vmpressure(sc->gfp_mask, memcg, false, sc->nr_scanned - scanned,
++		   sc->nr_reclaimed - reclaimed);
++
++	sc->nr_reclaimed += current->reclaim_state->reclaimed_slab;
++	current->reclaim_state->reclaimed_slab = 0;
++
++	return success ? MEMCG_LRU_YOUNG : 0;
++}
++
++#ifdef CONFIG_MEMCG
++
++static void shrink_many(struct pglist_data *pgdat, struct scan_control *sc)
++{
++	int gen;
++	int bin;
++	int first_bin;
++	struct lruvec *lruvec;
++	struct lru_gen_page *lrugen;
++	const struct hlist_nulls_node *pos;
++	int op = 0;
++	struct mem_cgroup *memcg = NULL;
++	unsigned long nr_to_reclaim = get_nr_to_reclaim(sc);
++
++	bin = first_bin = prandom_u32_max(MEMCG_NR_BINS);
++restart:
++	gen = get_memcg_gen(READ_ONCE(pgdat->memcg_lru.seq));
++
++	rcu_read_lock();
++
++	hlist_nulls_for_each_entry_rcu(lrugen, pos, &pgdat->memcg_lru.fifo[gen][bin], list) {
++		if (op)
++			lru_gen_rotate_memcg(lruvec, op);
++
++		mem_cgroup_put(memcg);
++
++		lruvec = container_of(lrugen, struct lruvec, lrugen);
++		memcg = lruvec_memcg(lruvec);
++
++		if (!mem_cgroup_tryget(memcg)) {
++			op = 0;
++			memcg = NULL;
++			continue;
++		}
++
++		rcu_read_unlock();
++
++		op = shrink_one(lruvec, sc);
++
++		if (sc->nr_reclaimed >= nr_to_reclaim)
++			goto success;
++
++		rcu_read_lock();
++	}
++
++	rcu_read_unlock();
++
++	/* restart if raced with lru_gen_rotate_memcg() */
++	if (gen != get_nulls_value(pos))
++		goto restart;
++
++	/* try the rest of the bins of the current generation */
++	bin = get_memcg_bin(bin + 1);
++	if (bin != first_bin)
++		goto restart;
++success:
++	if (op)
++		lru_gen_rotate_memcg(lruvec, op);
++
++	mem_cgroup_put(memcg);
++}
++
++static void lru_gen_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
++{
++	struct blk_plug plug;
++
++	VM_WARN_ON_ONCE(global_reclaim(sc));
++
++	lru_add_drain();
++
++	blk_start_plug(&plug);
++
++	set_mm_walk(lruvec_pgdat(lruvec));
++
++	if (try_to_shrink_lruvec(lruvec, sc))
++		lru_gen_rotate_memcg(lruvec, MEMCG_LRU_YOUNG);
++
++	clear_mm_walk();
++
++	blk_finish_plug(&plug);
++}
++
++#else /* !CONFIG_MEMCG */
++
++static void shrink_many(struct pglist_data *pgdat, struct scan_control *sc)
++{
++	BUILD_BUG();
++}
++
++static void lru_gen_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
++{
++	BUILD_BUG();
++}
++
++#endif
++
++static void set_initial_priority(struct pglist_data *pgdat, struct scan_control *sc)
++{
++	int priority;
++	unsigned long reclaimable;
++	struct lruvec *lruvec = mem_cgroup_lruvec(NULL, pgdat);
++
++	if (sc->priority != DEF_PRIORITY || sc->nr_to_reclaim < MIN_LRU_BATCH)
++		return;
++	/*
++	 * Determine the initial priority based on ((total / MEMCG_NR_GENS) >>
++	 * priority) * reclaimed_to_scanned_ratio = nr_to_reclaim, where the
++	 * estimated reclaimed_to_scanned_ratio = inactive / total.
++	 */
++	reclaimable = node_page_state(pgdat, NR_INACTIVE_FILE);
++	if (get_swappiness(lruvec, sc))
++		reclaimable += node_page_state(pgdat, NR_INACTIVE_ANON);
++
++	reclaimable /= MEMCG_NR_GENS;
++
++	/* round down reclaimable and round up sc->nr_to_reclaim */
++	priority = fls_long(reclaimable) - 1 - fls_long(sc->nr_to_reclaim - 1);
++
++	sc->priority = clamp(priority, 0, DEF_PRIORITY);
++}
++
++static void lru_gen_shrink_node(struct pglist_data *pgdat, struct scan_control *sc)
++{
++	struct blk_plug plug;
++	unsigned long reclaimed = sc->nr_reclaimed;
++
++	VM_WARN_ON_ONCE(!global_reclaim(sc));
++
++	lru_add_drain();
++
++	blk_start_plug(&plug);
++
++	set_mm_walk(pgdat);
++
++	set_initial_priority(pgdat, sc);
++
++	if (current_is_kswapd())
++		sc->nr_reclaimed = 0;
++
++	if (mem_cgroup_disabled())
++		shrink_one(&pgdat->__lruvec, sc);
++	else
++		shrink_many(pgdat, sc);
++
++	if (current_is_kswapd())
++		sc->nr_reclaimed += reclaimed;
++
+ 	clear_mm_walk();
+ 
+ 	blk_finish_plug(&plug);
++
++	/* kswapd should never fail */
++	pgdat->kswapd_failures = 0;
++}
++
++#ifdef CONFIG_MEMCG
++void lru_gen_rotate_memcg(struct lruvec *lruvec, int op)
++{
++	int seg;
++	int old, new;
++	int bin = prandom_u32_max(MEMCG_NR_BINS);
++	struct pglist_data *pgdat = lruvec_pgdat(lruvec);
++
++	spin_lock(&pgdat->memcg_lru.lock);
++
++	VM_WARN_ON_ONCE(hlist_nulls_unhashed(&lruvec->lrugen.list));
++
++	seg = 0;
++	new = old = lruvec->lrugen.gen;
++
++	/* see the comment on MEMCG_NR_GENS */
++	if (op == MEMCG_LRU_HEAD)
++		seg = MEMCG_LRU_HEAD;
++	else if (op == MEMCG_LRU_TAIL)
++		seg = MEMCG_LRU_TAIL;
++	else if (op == MEMCG_LRU_OLD)
++		new = get_memcg_gen(pgdat->memcg_lru.seq);
++	else if (op == MEMCG_LRU_YOUNG)
++		new = get_memcg_gen(pgdat->memcg_lru.seq + 1);
++	else
++		VM_WARN_ON_ONCE(true);
++
++	hlist_nulls_del_rcu(&lruvec->lrugen.list);
++
++	if (op == MEMCG_LRU_HEAD || op == MEMCG_LRU_OLD)
++		hlist_nulls_add_head_rcu(&lruvec->lrugen.list, &pgdat->memcg_lru.fifo[new][bin]);
++	else
++		hlist_nulls_add_tail_rcu(&lruvec->lrugen.list, &pgdat->memcg_lru.fifo[new][bin]);
++
++	pgdat->memcg_lru.nr_memcgs[old]--;
++	pgdat->memcg_lru.nr_memcgs[new]++;
++
++	lruvec->lrugen.gen = new;
++	WRITE_ONCE(lruvec->lrugen.seg, seg);
++
++	if (!pgdat->memcg_lru.nr_memcgs[old] && old == get_memcg_gen(pgdat->memcg_lru.seq))
++		WRITE_ONCE(pgdat->memcg_lru.seq, pgdat->memcg_lru.seq + 1);
++
++	spin_unlock(&pgdat->memcg_lru.lock);
+ }
++#endif
+ 
+ /******************************************************************************
+  *                          state change
+@@ -5370,11 +5593,11 @@ static int run_cmd(char cmd, int memcg_i
+ 
+ 	if (!mem_cgroup_disabled()) {
+ 		rcu_read_lock();
++
+ 		memcg = mem_cgroup_from_id(memcg_id);
+-#ifdef CONFIG_MEMCG
+-		if (memcg && !css_tryget(&memcg->css))
++		if (!mem_cgroup_tryget(memcg))
+ 			memcg = NULL;
+-#endif
++
+ 		rcu_read_unlock();
+ 
+ 		if (!memcg)
+@@ -5521,6 +5744,19 @@ void lru_gen_init_lruvec(struct lruvec *
+ }
+ 
+ #ifdef CONFIG_MEMCG
++
++void lru_gen_init_pgdat(struct pglist_data *pgdat)
++{
++	int i, j;
++
++	spin_lock_init(&pgdat->memcg_lru.lock);
++
++	for (i = 0; i < MEMCG_NR_GENS; i++) {
++		for (j = 0; j < MEMCG_NR_BINS; j++)
++			INIT_HLIST_NULLS_HEAD(&pgdat->memcg_lru.fifo[i][j], i);
++	}
++}
++
+ void lru_gen_init_memcg(struct mem_cgroup *memcg)
+ {
+ 	INIT_LIST_HEAD(&memcg->mm_list.fifo);
+@@ -5544,7 +5780,69 @@ void lru_gen_exit_memcg(struct mem_cgrou
+ 		}
+ 	}
+ }
+-#endif
++
++void lru_gen_online_memcg(struct mem_cgroup *memcg)
++{
++	int gen;
++	int nid;
++	int bin = prandom_u32_max(MEMCG_NR_BINS);
++
++	for_each_node(nid) {
++		struct pglist_data *pgdat = NODE_DATA(nid);
++		struct lruvec *lruvec = get_lruvec(memcg, nid);
++
++		spin_lock(&pgdat->memcg_lru.lock);
++
++		VM_WARN_ON_ONCE(!hlist_nulls_unhashed(&lruvec->lrugen.list));
++
++		gen = get_memcg_gen(pgdat->memcg_lru.seq);
++
++		hlist_nulls_add_tail_rcu(&lruvec->lrugen.list, &pgdat->memcg_lru.fifo[gen][bin]);
++		pgdat->memcg_lru.nr_memcgs[gen]++;
++
++		lruvec->lrugen.gen = gen;
++
++		spin_unlock(&pgdat->memcg_lru.lock);
++	}
++}
++
++void lru_gen_offline_memcg(struct mem_cgroup *memcg)
++{
++	int nid;
++
++	for_each_node(nid) {
++		struct lruvec *lruvec = get_lruvec(memcg, nid);
++
++		lru_gen_rotate_memcg(lruvec, MEMCG_LRU_OLD);
++	}
++}
++
++void lru_gen_release_memcg(struct mem_cgroup *memcg)
++{
++	int gen;
++	int nid;
++
++	for_each_node(nid) {
++		struct pglist_data *pgdat = NODE_DATA(nid);
++		struct lruvec *lruvec = get_lruvec(memcg, nid);
++
++		spin_lock(&pgdat->memcg_lru.lock);
++
++		VM_WARN_ON_ONCE(hlist_nulls_unhashed(&lruvec->lrugen.list));
++
++		gen = lruvec->lrugen.gen;
++
++		hlist_nulls_del_rcu(&lruvec->lrugen.list);
++		pgdat->memcg_lru.nr_memcgs[gen]--;
++
++		if (!pgdat->memcg_lru.nr_memcgs[gen] && gen == get_memcg_gen(pgdat->memcg_lru.seq))
++			WRITE_ONCE(pgdat->memcg_lru.seq, pgdat->memcg_lru.seq + 1);
++
++		spin_unlock(&pgdat->memcg_lru.lock);
++	}
++}
++
++#endif /* CONFIG_MEMCG */
+ 
+ static int __init init_lru_gen(void)
+ {
+@@ -5571,6 +5869,10 @@ static void lru_gen_shrink_lruvec(struct
+ {
+ }
+ 
++static void lru_gen_shrink_node(struct pglist_data *pgdat, struct scan_control *sc)
++{
++}
++
+ #endif /* CONFIG_LRU_GEN */
+ 
+ static void shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
+@@ -5584,7 +5886,7 @@ static void shrink_lruvec(struct lruvec
+ 	bool proportional_reclaim;
+ 	struct blk_plug plug;
+ 
+-	if (lru_gen_enabled()) {
++	if (lru_gen_enabled() && !global_reclaim(sc)) {
+ 		lru_gen_shrink_lruvec(lruvec, sc);
+ 		return;
+ 	}
+@@ -5826,6 +6128,11 @@ static void shrink_node(pg_data_t *pgdat
+ 	struct lruvec *target_lruvec;
+ 	bool reclaimable = false;
+ 
++	if (lru_gen_enabled() && global_reclaim(sc)) {
++		lru_gen_shrink_node(pgdat, sc);
++		return;
++	}
++
+ 	target_lruvec = mem_cgroup_lruvec(sc->target_mem_cgroup, pgdat);
+ 
+ again:
diff --git a/target/linux/generic/backport-5.15/020-v6.3-27-mm-multi-gen-LRU-clarify-scan_control-flags.patch b/target/linux/generic/backport-5.15/020-v6.3-27-mm-multi-gen-LRU-clarify-scan_control-flags.patch
new file mode 100644
index 00000000000000..882f29e98922d4
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.3-27-mm-multi-gen-LRU-clarify-scan_control-flags.patch
@@ -0,0 +1,196 @@
+From 93147736b5b3a21bea24313bfc7a696829932009 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Wed, 21 Dec 2022 21:19:05 -0700
+Subject: [PATCH 27/29] mm: multi-gen LRU: clarify scan_control flags
+
+Among the flags in scan_control:
+1. sc->may_swap, which indicates swap constraint due to memsw.max, is
+   supported as usual.
+2. sc->proactive, which indicates reclaim by memory.reclaim, may not
+   opportunistically skip the aging path, since it is considered less
+   latency sensitive.
+3. !(sc->gfp_mask & __GFP_IO), which indicates IO constraint, lowers
+   swappiness to prioritize file LRU, since clean file pages are more
+   likely to exist.
+4. sc->may_writepage and sc->may_unmap, which indicates opportunistic
+   reclaim, are rejected, since unmapped clean pages are already
+   prioritized. Scanning for more of them is likely futile and can
+   cause high reclaim latency when there is a large number of memcgs.
+
+The rest are handled by the existing code.
+
+Link: https://lkml.kernel.org/r/20221222041905.2431096-8-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Roman Gushchin <roman.gushchin@linux.dev>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ mm/vmscan.c | 55 +++++++++++++++++++++++++++--------------------------
+ 1 file changed, 28 insertions(+), 27 deletions(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2905,6 +2905,9 @@ static int get_swappiness(struct lruvec
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+ 	struct pglist_data *pgdat = lruvec_pgdat(lruvec);
+ 
++	if (!sc->may_swap)
++		return 0;
++
+ 	if (!can_demote(pgdat->node_id, sc) &&
+ 	    mem_cgroup_get_nr_swap_pages(memcg) < MIN_LRU_BATCH)
+ 		return 0;
+@@ -3952,7 +3955,7 @@ static void walk_mm(struct lruvec *lruve
+ 	} while (err == -EAGAIN);
+ }
+ 
+-static struct lru_gen_mm_walk *set_mm_walk(struct pglist_data *pgdat)
++static struct lru_gen_mm_walk *set_mm_walk(struct pglist_data *pgdat, bool force_alloc)
+ {
+ 	struct lru_gen_mm_walk *walk = current->reclaim_state->mm_walk;
+ 
+@@ -3960,7 +3963,7 @@ static struct lru_gen_mm_walk *set_mm_wa
+ 		VM_WARN_ON_ONCE(walk);
+ 
+ 		walk = &pgdat->mm_walk;
+-	} else if (!pgdat && !walk) {
++	} else if (!walk && force_alloc) {
+ 		VM_WARN_ON_ONCE(current_is_kswapd());
+ 
+ 		walk = kzalloc(sizeof(*walk), __GFP_HIGH | __GFP_NOMEMALLOC | __GFP_NOWARN);
+@@ -4146,7 +4149,7 @@ static bool try_to_inc_max_seq(struct lr
+ 		goto done;
+ 	}
+ 
+-	walk = set_mm_walk(NULL);
++	walk = set_mm_walk(NULL, true);
+ 	if (!walk) {
+ 		success = iterate_mm_list_nowalk(lruvec, max_seq);
+ 		goto done;
+@@ -4215,8 +4218,6 @@ static bool lruvec_is_reclaimable(struct
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+ 	DEFINE_MIN_SEQ(lruvec);
+ 
+-	VM_WARN_ON_ONCE(sc->memcg_low_reclaim);
+-
+ 	/* see the comment on lru_gen_page */
+ 	gen = lru_gen_from_seq(min_seq[LRU_GEN_FILE]);
+ 	birth = READ_ONCE(lruvec->lrugen.timestamps[gen]);
+@@ -4472,12 +4473,8 @@ static bool isolate_page(struct lruvec *
+ {
+ 	bool success;
+ 
+-	/* unmapping inhibited */
+-	if (!sc->may_unmap && page_mapped(page))
+-		return false;
+-
+ 	/* swapping inhibited */
+-	if (!(sc->may_writepage && (sc->gfp_mask & __GFP_IO)) &&
++	if (!(sc->gfp_mask & __GFP_IO) &&
+ 	    (PageDirty(page) ||
+ 	     (PageAnon(page) && !PageSwapCache(page))))
+ 		return false;
+@@ -4574,9 +4571,8 @@ static int scan_pages(struct lruvec *lru
+ 	__count_vm_events(PGSCAN_ANON + type, isolated);
+ 
+ 	/*
+-	 * There might not be eligible pages due to reclaim_idx, may_unmap and
+-	 * may_writepage. Check the remaining to prevent livelock if it's not
+-	 * making progress.
++	 * There might not be eligible pages due to reclaim_idx. Check the
++	 * remaining to prevent livelock if it's not making progress.
+ 	 */
+ 	return isolated || !remaining ? scanned : 0;
+ }
+@@ -4836,8 +4832,7 @@ static long get_nr_to_scan(struct lruvec
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+ 	DEFINE_MAX_SEQ(lruvec);
+ 
+-	if (mem_cgroup_below_min(memcg) ||
+-	    (mem_cgroup_below_low(memcg) && !sc->memcg_low_reclaim))
++	if (mem_cgroup_below_min(memcg))
+ 		return 0;
+ 
+ 	if (!should_run_aging(lruvec, max_seq, sc, can_swap, &nr_to_scan))
+@@ -4865,17 +4860,14 @@ static bool try_to_shrink_lruvec(struct
+ 	long nr_to_scan;
+ 	unsigned long scanned = 0;
+ 	unsigned long nr_to_reclaim = get_nr_to_reclaim(sc);
++	int swappiness = get_swappiness(lruvec, sc);
++
++	/* clean file pages are more likely to exist */
++	if (swappiness && !(sc->gfp_mask & __GFP_IO))
++		swappiness = 1;
+ 
+ 	while (true) {
+ 		int delta;
+-		int swappiness;
+-
+-		if (sc->may_swap)
+-			swappiness = get_swappiness(lruvec, sc);
+-		else if (!cgroup_reclaim(sc) && get_swappiness(lruvec, sc))
+-			swappiness = 1;
+-		else
+-			swappiness = 0;
+ 
+ 		nr_to_scan = get_nr_to_scan(lruvec, sc, swappiness);
+ 		if (nr_to_scan <= 0)
+@@ -5005,12 +4997,13 @@ static void lru_gen_shrink_lruvec(struct
+ 	struct blk_plug plug;
+ 
+ 	VM_WARN_ON_ONCE(global_reclaim(sc));
++	VM_WARN_ON_ONCE(!sc->may_writepage || !sc->may_unmap);
+ 
+ 	lru_add_drain();
+ 
+ 	blk_start_plug(&plug);
+ 
+-	set_mm_walk(lruvec_pgdat(lruvec));
++	set_mm_walk(NULL, false);
+ 
+ 	if (try_to_shrink_lruvec(lruvec, sc))
+ 		lru_gen_rotate_memcg(lruvec, MEMCG_LRU_YOUNG);
+@@ -5066,11 +5059,19 @@ static void lru_gen_shrink_node(struct p
+ 
+ 	VM_WARN_ON_ONCE(!global_reclaim(sc));
+ 
++	/*
++	 * Unmapped clean pages are already prioritized. Scanning for more of
++	 * them is likely futile and can cause high reclaim latency when there
++	 * is a large number of memcgs.
++	 */
++	if (!sc->may_writepage || !sc->may_unmap)
++		goto done;
++
+ 	lru_add_drain();
+ 
+ 	blk_start_plug(&plug);
+ 
+-	set_mm_walk(pgdat);
++	set_mm_walk(pgdat, false);
+ 
+ 	set_initial_priority(pgdat, sc);
+ 
+@@ -5088,7 +5089,7 @@ static void lru_gen_shrink_node(struct p
+ 	clear_mm_walk();
+ 
+ 	blk_finish_plug(&plug);
+-
++done:
+ 	/* kswapd should never fail */
+ 	pgdat->kswapd_failures = 0;
+ }
+@@ -5656,7 +5657,7 @@ static ssize_t lru_gen_seq_write(struct
+ 	set_task_reclaim_state(current, &sc.reclaim_state);
+ 	flags = memalloc_noreclaim_save();
+ 	blk_start_plug(&plug);
+-	if (!set_mm_walk(NULL)) {
++	if (!set_mm_walk(NULL, true)) {
+ 		err = -ENOMEM;
+ 		goto done;
+ 	}
diff --git a/target/linux/generic/backport-5.15/020-v6.3-28-mm-multi-gen-LRU-simplify-arch_has_hw_pte_young-chec.patch b/target/linux/generic/backport-5.15/020-v6.3-28-mm-multi-gen-LRU-simplify-arch_has_hw_pte_young-chec.patch
new file mode 100644
index 00000000000000..38d0e5496ccf92
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.3-28-mm-multi-gen-LRU-simplify-arch_has_hw_pte_young-chec.patch
@@ -0,0 +1,34 @@
+From cf3297e4c7a928da8b2b2f0baff2f9c69ea57952 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Wed, 21 Dec 2022 21:19:06 -0700
+Subject: [PATCH 28/29] mm: multi-gen LRU: simplify arch_has_hw_pte_young()
+ check
+
+Scanning page tables when hardware does not set the accessed bit has
+no real use cases.
+
+Link: https://lkml.kernel.org/r/20221222041905.2431096-9-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Roman Gushchin <roman.gushchin@linux.dev>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ mm/vmscan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -4144,7 +4144,7 @@ static bool try_to_inc_max_seq(struct lr
+ 	 * handful of PTEs. Spreading the work out over a period of time usually
+ 	 * is less efficient, but it avoids bursty page faults.
+ 	 */
+-	if (!force_scan && !(arch_has_hw_pte_young() && get_cap(LRU_GEN_MM_WALK))) {
++	if (!arch_has_hw_pte_young() || !get_cap(LRU_GEN_MM_WALK)) {
+ 		success = iterate_mm_list_nowalk(lruvec, max_seq);
+ 		goto done;
+ 	}
diff --git a/target/linux/generic/backport-5.15/020-v6.3-29-mm-multi-gen-LRU-avoid-futile-retries.patch b/target/linux/generic/backport-5.15/020-v6.3-29-mm-multi-gen-LRU-avoid-futile-retries.patch
new file mode 100644
index 00000000000000..2d19d0d7da1871
--- /dev/null
+++ b/target/linux/generic/backport-5.15/020-v6.3-29-mm-multi-gen-LRU-avoid-futile-retries.patch
@@ -0,0 +1,88 @@
+From cc67f962cc53f6e1dfa92eb85b7b26fe83a3c66f Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Mon, 13 Feb 2023 00:53:22 -0700
+Subject: [PATCH 29/29] mm: multi-gen LRU: avoid futile retries
+
+Recall that the per-node memcg LRU has two generations and they alternate
+when the last memcg (of a given node) is moved from one to the other.
+Each generation is also sharded into multiple bins to improve scalability.
+A reclaimer starts with a random bin (in the old generation) and, if it
+fails, it will retry, i.e., to try the rest of the bins.
+
+If a reclaimer fails with the last memcg, it should move this memcg to the
+young generation first, which causes the generations to alternate, and
+then retry.  Otherwise, the retries will be futile because all other bins
+are empty.
+
+Link: https://lkml.kernel.org/r/20230213075322.1416966-1-yuzhao@google.com
+Fixes: e4dde56cd208 ("mm: multi-gen LRU: per-node lru_gen_folio lists")
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Reported-by: T.J. Mercier <tjmercier@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ mm/vmscan.c | 25 +++++++++++++++----------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -4934,18 +4934,20 @@ static int shrink_one(struct lruvec *lru
+ 
+ static void shrink_many(struct pglist_data *pgdat, struct scan_control *sc)
+ {
++	int op;
+ 	int gen;
+ 	int bin;
+ 	int first_bin;
+ 	struct lruvec *lruvec;
+ 	struct lru_gen_page *lrugen;
++	struct mem_cgroup *memcg;
+ 	const struct hlist_nulls_node *pos;
+-	int op = 0;
+-	struct mem_cgroup *memcg = NULL;
+ 	unsigned long nr_to_reclaim = get_nr_to_reclaim(sc);
+ 
+ 	bin = first_bin = prandom_u32_max(MEMCG_NR_BINS);
+ restart:
++	op = 0;
++	memcg = NULL;
+ 	gen = get_memcg_gen(READ_ONCE(pgdat->memcg_lru.seq));
+ 
+ 	rcu_read_lock();
+@@ -4969,14 +4971,22 @@ restart:
+ 
+ 		op = shrink_one(lruvec, sc);
+ 
+-		if (sc->nr_reclaimed >= nr_to_reclaim)
+-			goto success;
+-
+ 		rcu_read_lock();
++
++		if (sc->nr_reclaimed >= nr_to_reclaim)
++			break;
+ 	}
+ 
+ 	rcu_read_unlock();
+ 
++	if (op)
++		lru_gen_rotate_memcg(lruvec, op);
++
++	mem_cgroup_put(memcg);
++
++	if (sc->nr_reclaimed >= nr_to_reclaim)
++		return;
++
+ 	/* restart if raced with lru_gen_rotate_memcg() */
+ 	if (gen != get_nulls_value(pos))
+ 		goto restart;
+@@ -4985,11 +4995,6 @@ restart:
+ 	bin = get_memcg_bin(bin + 1);
+ 	if (bin != first_bin)
+ 		goto restart;
+-success:
+-	if (op)
+-		lru_gen_rotate_memcg(lruvec, op);
+-
+-	mem_cgroup_put(memcg);
+ }
+ 
+ static void lru_gen_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
diff --git a/target/linux/generic/backport-5.15/021-v6.4-mm-Multi-gen-LRU-remove-wait_event_killable.patch b/target/linux/generic/backport-5.15/021-v6.4-mm-Multi-gen-LRU-remove-wait_event_killable.patch
new file mode 100644
index 00000000000000..e154494a51e06c
--- /dev/null
+++ b/target/linux/generic/backport-5.15/021-v6.4-mm-Multi-gen-LRU-remove-wait_event_killable.patch
@@ -0,0 +1,266 @@
+From 087ed25eaf5a78a678508e893f80addab9b1c103 Mon Sep 17 00:00:00 2001
+From: Kalesh Singh <kaleshsingh@google.com>
+Date: Thu, 13 Apr 2023 14:43:26 -0700
+Subject: [PATCH] mm: Multi-gen LRU: remove wait_event_killable()
+
+Android 14 and later default to MGLRU [1] and field telemetry showed
+occasional long tail latency (>100ms) in the reclaim path.
+
+Tracing revealed priority inversion in the reclaim path.  In
+try_to_inc_max_seq(), when high priority tasks were blocked on
+wait_event_killable(), the preemption of the low priority task to call
+wake_up_all() caused those high priority tasks to wait longer than
+necessary.  In general, this problem is not different from others of its
+kind, e.g., one caused by mutex_lock().  However, it is specific to MGLRU
+because it introduced the new wait queue lruvec->mm_state.wait.
+
+The purpose of this new wait queue is to avoid the thundering herd
+problem.  If many direct reclaimers rush into try_to_inc_max_seq(), only
+one can succeed, i.e., the one to wake up the rest, and the rest who
+failed might cause premature OOM kills if they do not wait.  So far there
+is no evidence supporting this scenario, based on how often the wait has
+been hit.  And this begs the question how useful the wait queue is in
+practice.
+
+Based on Minchan's recommendation, which is in line with his commit
+6d4675e60135 ("mm: don't be stuck to rmap lock on reclaim path") and the
+rest of the MGLRU code which also uses trylock when possible, remove the
+wait queue.
+
+[1] https://android-review.googlesource.com/q/I7ed7fbfd6ef9ce10053347528125dd98c39e50bf
+
+Link: https://lkml.kernel.org/r/20230413214326.2147568-1-kaleshsingh@google.com
+Fixes: bd74fdaea146 ("mm: multi-gen LRU: support page table walks")
+Change-Id: I911f3968fd1adb25171279cc5b6f48ccb7efc8de
+Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
+Suggested-by: Minchan Kim <minchan@kernel.org>
+Reported-by: Wei Wang <wvw@google.com>
+Acked-by: Yu Zhao <yuzhao@google.com>
+Cc: Minchan Kim <minchan@kernel.org>
+Cc: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
+Cc: Oleksandr Natalenko <oleksandr@natalenko.name>
+Cc: Suleiman Souhlal <suleiman@google.com>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ include/linux/mmzone.h |   8 +--
+ mm/vmscan.c            | 111 +++++++++++++++--------------------------
+ 2 files changed, 42 insertions(+), 77 deletions(-)
+
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -452,18 +452,14 @@ enum {
+ struct lru_gen_mm_state {
+ 	/* set to max_seq after each iteration */
+ 	unsigned long seq;
+-	/* where the current iteration continues (inclusive) */
++	/* where the current iteration continues after */
+ 	struct list_head *head;
+-	/* where the last iteration ended (exclusive) */
++	/* where the last iteration ended before */
+ 	struct list_head *tail;
+-	/* to wait for the last page table walker to finish */
+-	struct wait_queue_head wait;
+ 	/* Bloom filters flip after each iteration */
+ 	unsigned long *filters[NR_BLOOM_FILTERS];
+ 	/* the mm stats for debugging */
+ 	unsigned long stats[NR_HIST_GENS][NR_MM_STATS];
+-	/* the number of concurrent page table walkers */
+-	int nr_walkers;
+ };
+ 
+ struct lru_gen_mm_walk {
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2999,18 +2999,13 @@ void lru_gen_del_mm(struct mm_struct *mm
+ 		if (!lruvec)
+ 			continue;
+ 
+-		/* where the last iteration ended (exclusive) */
++		/* where the current iteration continues after */
++		if (lruvec->mm_state.head == &mm->lru_gen.list)
++			lruvec->mm_state.head = lruvec->mm_state.head->prev;
++
++		/* where the last iteration ended before */
+ 		if (lruvec->mm_state.tail == &mm->lru_gen.list)
+ 			lruvec->mm_state.tail = lruvec->mm_state.tail->next;
+-
+-		/* where the current iteration continues (inclusive) */
+-		if (lruvec->mm_state.head != &mm->lru_gen.list)
+-			continue;
+-
+-		lruvec->mm_state.head = lruvec->mm_state.head->next;
+-		/* the deletion ends the current iteration */
+-		if (lruvec->mm_state.head == &mm_list->fifo)
+-			WRITE_ONCE(lruvec->mm_state.seq, lruvec->mm_state.seq + 1);
+ 	}
+ 
+ 	list_del_init(&mm->lru_gen.list);
+@@ -3194,68 +3189,54 @@ static bool iterate_mm_list(struct lruve
+ 			    struct mm_struct **iter)
+ {
+ 	bool first = false;
+-	bool last = true;
++	bool last = false;
+ 	struct mm_struct *mm = NULL;
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+ 	struct lru_gen_mm_list *mm_list = get_mm_list(memcg);
+ 	struct lru_gen_mm_state *mm_state = &lruvec->mm_state;
+ 
+ 	/*
+-	 * There are four interesting cases for this page table walker:
+-	 * 1. It tries to start a new iteration of mm_list with a stale max_seq;
+-	 *    there is nothing left to do.
+-	 * 2. It's the first of the current generation, and it needs to reset
+-	 *    the Bloom filter for the next generation.
+-	 * 3. It reaches the end of mm_list, and it needs to increment
+-	 *    mm_state->seq; the iteration is done.
+-	 * 4. It's the last of the current generation, and it needs to reset the
+-	 *    mm stats counters for the next generation.
++	 * mm_state->seq is incremented after each iteration of mm_list. There
++	 * are three interesting cases for this page table walker:
++	 * 1. It tries to start a new iteration with a stale max_seq: there is
++	 *    nothing left to do.
++	 * 2. It started the next iteration: it needs to reset the Bloom filter
++	 *    so that a fresh set of PTE tables can be recorded.
++	 * 3. It ended the current iteration: it needs to reset the mm stats
++	 *    counters and tell its caller to increment max_seq.
+ 	 */
+ 	spin_lock(&mm_list->lock);
+ 
+ 	VM_WARN_ON_ONCE(mm_state->seq + 1 < walk->max_seq);
+-	VM_WARN_ON_ONCE(*iter && mm_state->seq > walk->max_seq);
+-	VM_WARN_ON_ONCE(*iter && !mm_state->nr_walkers);
+ 
+-	if (walk->max_seq <= mm_state->seq) {
+-		if (!*iter)
+-			last = false;
++	if (walk->max_seq <= mm_state->seq)
+ 		goto done;
+-	}
+ 
+-	if (!mm_state->nr_walkers) {
+-		VM_WARN_ON_ONCE(mm_state->head && mm_state->head != &mm_list->fifo);
++	if (!mm_state->head)
++		mm_state->head = &mm_list->fifo;
+ 
+-		mm_state->head = mm_list->fifo.next;
++	if (mm_state->head == &mm_list->fifo)
+ 		first = true;
+-	}
+-
+-	while (!mm && mm_state->head != &mm_list->fifo) {
+-		mm = list_entry(mm_state->head, struct mm_struct, lru_gen.list);
+ 
++	do {
+ 		mm_state->head = mm_state->head->next;
++		if (mm_state->head == &mm_list->fifo) {
++			WRITE_ONCE(mm_state->seq, mm_state->seq + 1);
++			last = true;
++			break;
++		}
+ 
+ 		/* force scan for those added after the last iteration */
+-		if (!mm_state->tail || mm_state->tail == &mm->lru_gen.list) {
+-			mm_state->tail = mm_state->head;
++		if (!mm_state->tail || mm_state->tail == mm_state->head) {
++			mm_state->tail = mm_state->head->next;
+ 			walk->force_scan = true;
+ 		}
+ 
++		mm = list_entry(mm_state->head, struct mm_struct, lru_gen.list);
+ 		if (should_skip_mm(mm, walk))
+ 			mm = NULL;
+-	}
+-
+-	if (mm_state->head == &mm_list->fifo)
+-		WRITE_ONCE(mm_state->seq, mm_state->seq + 1);
++	} while (!mm);
+ done:
+-	if (*iter && !mm)
+-		mm_state->nr_walkers--;
+-	if (!*iter && mm)
+-		mm_state->nr_walkers++;
+-
+-	if (mm_state->nr_walkers)
+-		last = false;
+-
+ 	if (*iter || last)
+ 		reset_mm_stats(lruvec, walk, last);
+ 
+@@ -3283,9 +3264,9 @@ static bool iterate_mm_list_nowalk(struc
+ 
+ 	VM_WARN_ON_ONCE(mm_state->seq + 1 < max_seq);
+ 
+-	if (max_seq > mm_state->seq && !mm_state->nr_walkers) {
+-		VM_WARN_ON_ONCE(mm_state->head && mm_state->head != &mm_list->fifo);
+-
++	if (max_seq > mm_state->seq) {
++		mm_state->head = NULL;
++		mm_state->tail = NULL;
+ 		WRITE_ONCE(mm_state->seq, mm_state->seq + 1);
+ 		reset_mm_stats(lruvec, NULL, true);
+ 		success = true;
+@@ -3894,10 +3875,6 @@ restart:
+ 
+ 		walk_pmd_range(&val, addr, next, args);
+ 
+-		/* a racy check to curtail the waiting time */
+-		if (wq_has_sleeper(&walk->lruvec->mm_state.wait))
+-			return 1;
+-
+ 		if (need_resched() || walk->batched >= MAX_LRU_BATCH) {
+ 			end = (addr | ~PUD_MASK) + 1;
+ 			goto done;
+@@ -3930,8 +3907,14 @@ static void walk_mm(struct lruvec *lruve
+ 	walk->next_addr = FIRST_USER_ADDRESS;
+ 
+ 	do {
++		DEFINE_MAX_SEQ(lruvec);
++
+ 		err = -EBUSY;
+ 
++		/* another thread might have called inc_max_seq() */
++		if (walk->max_seq != max_seq)
++			break;
++
+ 		/* page_update_gen() requires stable page_memcg() */
+ 		if (!mem_cgroup_trylock_pages(memcg))
+ 			break;
+@@ -4164,25 +4147,12 @@ static bool try_to_inc_max_seq(struct lr
+ 		success = iterate_mm_list(lruvec, walk, &mm);
+ 		if (mm)
+ 			walk_mm(lruvec, mm, walk);
+-
+-		cond_resched();
+ 	} while (mm);
+ done:
+-	if (!success) {
+-		if (sc->priority <= DEF_PRIORITY - 2)
+-			wait_event_killable(lruvec->mm_state.wait,
+-					    max_seq < READ_ONCE(lrugen->max_seq));
+-		return false;
+-	}
++	if (success)
++		inc_max_seq(lruvec, can_swap, force_scan);
+ 
+-	VM_WARN_ON_ONCE(max_seq != READ_ONCE(lrugen->max_seq));
+-
+-	inc_max_seq(lruvec, can_swap, force_scan);
+-	/* either this sees any waiters or they will see updated max_seq */
+-	if (wq_has_sleeper(&lruvec->mm_state.wait))
+-		wake_up_all(&lruvec->mm_state.wait);
+-
+-	return true;
++	return success;
+ }
+ 
+ static bool lruvec_is_sizable(struct lruvec *lruvec, struct scan_control *sc)
+@@ -5746,7 +5716,6 @@ void lru_gen_init_lruvec(struct lruvec *
+ 		INIT_LIST_HEAD(&lrugen->pages[gen][type][zone]);
+ 
+ 	lruvec->mm_state.seq = MIN_NR_GENS;
+-	init_waitqueue_head(&lruvec->mm_state.wait);
+ }
+ 
+ #ifdef CONFIG_MEMCG
diff --git a/target/linux/generic/backport-5.15/050-v5.16-05-mips-bpf-Enable-eBPF-JITs.patch b/target/linux/generic/backport-5.15/050-v5.16-05-mips-bpf-Enable-eBPF-JITs.patch
index 41b3d8139fd3c8..14763c1211ea5e 100644
--- a/target/linux/generic/backport-5.15/050-v5.16-05-mips-bpf-Enable-eBPF-JITs.patch
+++ b/target/linux/generic/backport-5.15/050-v5.16-05-mips-bpf-Enable-eBPF-JITs.patch
@@ -14,7 +14,7 @@ Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
 
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -3430,6 +3430,7 @@ S:	Supported
+@@ -3431,6 +3431,7 @@ S:	Supported
  F:	arch/arm64/net/
  
  BPF JIT for MIPS (32-BIT AND 64-BIT)
diff --git a/target/linux/generic/backport-5.15/060-v5.18-01-bpf-selftests-Add-helpers-to-directly-use-the-capget.patch b/target/linux/generic/backport-5.15/060-v5.18-01-bpf-selftests-Add-helpers-to-directly-use-the-capget.patch
new file mode 100644
index 00000000000000..4d544a30f59774
--- /dev/null
+++ b/target/linux/generic/backport-5.15/060-v5.18-01-bpf-selftests-Add-helpers-to-directly-use-the-capget.patch
@@ -0,0 +1,123 @@
+From 5287acc6f097c0c18e54401b611a877a3083b68c Mon Sep 17 00:00:00 2001
+From: Martin KaFai Lau <kafai@fb.com>
+Date: Wed, 16 Mar 2022 10:38:23 -0700
+Subject: [PATCH 1/3] bpf: selftests: Add helpers to directly use the capget
+ and capset syscall
+
+After upgrading to the newer libcap (>= 2.60),
+the libcap commit aca076443591 ("Make cap_t operations thread safe.")
+added a "__u8 mutex;" to the "struct _cap_struct".  It caused a few byte
+shift that breaks the assumption made in the "struct libcap" definition
+in test_verifier.c.
+
+The bpf selftest usage only needs to enable and disable the effective
+caps of the running task.  It is easier to directly syscall the
+capget and capset instead.  It can also remove the libcap
+library dependency.
+
+The cap_helpers.{c,h} is added.  One __u64 is used for all CAP_*
+bits instead of two __u32.
+
+Signed-off-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20220316173823.2036955-1-kafai@fb.com
+---
+ tools/testing/selftests/bpf/cap_helpers.c | 67 +++++++++++++++++++++++
+ tools/testing/selftests/bpf/cap_helpers.h | 19 +++++++
+ 2 files changed, 86 insertions(+)
+ create mode 100644 tools/testing/selftests/bpf/cap_helpers.c
+ create mode 100644 tools/testing/selftests/bpf/cap_helpers.h
+
+--- /dev/null
++++ b/tools/testing/selftests/bpf/cap_helpers.c
+@@ -0,0 +1,67 @@
++// SPDX-License-Identifier: GPL-2.0
++#include "cap_helpers.h"
++
++/* Avoid including <sys/capability.h> from the libcap-devel package,
++ * so directly declare them here and use them from glibc.
++ */
++int capget(cap_user_header_t header, cap_user_data_t data);
++int capset(cap_user_header_t header, const cap_user_data_t data);
++
++int cap_enable_effective(__u64 caps, __u64 *old_caps)
++{
++	struct __user_cap_data_struct data[_LINUX_CAPABILITY_U32S_3];
++	struct __user_cap_header_struct hdr = {
++		.version = _LINUX_CAPABILITY_VERSION_3,
++	};
++	__u32 cap0 = caps;
++	__u32 cap1 = caps >> 32;
++	int err;
++
++	err = capget(&hdr, data);
++	if (err)
++		return err;
++
++	if (old_caps)
++		*old_caps = (__u64)(data[1].effective) << 32 | data[0].effective;
++
++	if ((data[0].effective & cap0) == cap0 &&
++	    (data[1].effective & cap1) == cap1)
++		return 0;
++
++	data[0].effective |= cap0;
++	data[1].effective |= cap1;
++	err = capset(&hdr, data);
++	if (err)
++		return err;
++
++	return 0;
++}
++
++int cap_disable_effective(__u64 caps, __u64 *old_caps)
++{
++	struct __user_cap_data_struct data[_LINUX_CAPABILITY_U32S_3];
++	struct __user_cap_header_struct hdr = {
++		.version = _LINUX_CAPABILITY_VERSION_3,
++	};
++	__u32 cap0 = caps;
++	__u32 cap1 = caps >> 32;
++	int err;
++
++	err = capget(&hdr, data);
++	if (err)
++		return err;
++
++	if (old_caps)
++		*old_caps = (__u64)(data[1].effective) << 32 | data[0].effective;
++
++	if (!(data[0].effective & cap0) && !(data[1].effective & cap1))
++		return 0;
++
++	data[0].effective &= ~cap0;
++	data[1].effective &= ~cap1;
++	err = capset(&hdr, data);
++	if (err)
++		return err;
++
++	return 0;
++}
+--- /dev/null
++++ b/tools/testing/selftests/bpf/cap_helpers.h
+@@ -0,0 +1,19 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef __CAP_HELPERS_H
++#define __CAP_HELPERS_H
++
++#include <linux/types.h>
++#include <linux/capability.h>
++
++#ifndef CAP_PERFMON
++#define CAP_PERFMON		38
++#endif
++
++#ifndef CAP_BPF
++#define CAP_BPF			39
++#endif
++
++int cap_enable_effective(__u64 caps, __u64 *old_caps);
++int cap_disable_effective(__u64 caps, __u64 *old_caps);
++
++#endif
diff --git a/target/linux/generic/backport-5.15/060-v5.18-02-bpf-selftests-Remove-libcap-usage-from-test_verifier.patch b/target/linux/generic/backport-5.15/060-v5.18-02-bpf-selftests-Remove-libcap-usage-from-test_verifier.patch
new file mode 100644
index 00000000000000..cc60b54340156e
--- /dev/null
+++ b/target/linux/generic/backport-5.15/060-v5.18-02-bpf-selftests-Remove-libcap-usage-from-test_verifier.patch
@@ -0,0 +1,188 @@
+From 847a6b7ee906be874f0cae279c8de902a7d3f092 Mon Sep 17 00:00:00 2001
+From: Martin KaFai Lau <kafai@fb.com>
+Date: Wed, 16 Mar 2022 10:38:29 -0700
+Subject: [PATCH 2/3] bpf: selftests: Remove libcap usage from test_verifier
+
+This patch removes the libcap usage from test_verifier.
+The cap_*_effective() helpers added in the earlier patch are
+used instead.
+
+Signed-off-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20220316173829.2038682-1-kafai@fb.com
+---
+ tools/testing/selftests/bpf/Makefile        | 31 +++++---
+ tools/testing/selftests/bpf/test_verifier.c | 88 ++++++---------------
+ 2 files changed, 46 insertions(+), 73 deletions(-)
+
+--- a/tools/testing/selftests/bpf/Makefile
++++ b/tools/testing/selftests/bpf/Makefile
+@@ -189,16 +189,27 @@ TEST_GEN_PROGS_EXTENDED += $(DEFAULT_BPF
+ 
+ $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED): $(OUTPUT)/test_stub.o $(BPFOBJ)
+ 
+-$(OUTPUT)/test_dev_cgroup: cgroup_helpers.c
+-$(OUTPUT)/test_skb_cgroup_id_user: cgroup_helpers.c
+-$(OUTPUT)/test_sock: cgroup_helpers.c
+-$(OUTPUT)/test_sock_addr: cgroup_helpers.c
+-$(OUTPUT)/test_sockmap: cgroup_helpers.c
+-$(OUTPUT)/test_tcpnotify_user: cgroup_helpers.c trace_helpers.c
+-$(OUTPUT)/get_cgroup_id_user: cgroup_helpers.c
+-$(OUTPUT)/test_cgroup_storage: cgroup_helpers.c
+-$(OUTPUT)/test_sock_fields: cgroup_helpers.c
+-$(OUTPUT)/test_sysctl: cgroup_helpers.c
++CGROUP_HELPERS	:= $(OUTPUT)/cgroup_helpers.o
++TESTING_HELPERS	:= $(OUTPUT)/testing_helpers.o
++TRACE_HELPERS	:= $(OUTPUT)/trace_helpers.o
++CAP_HELPERS	:= $(OUTPUT)/cap_helpers.o
++
++$(OUTPUT)/test_dev_cgroup: $(CGROUP_HELPERS) $(TESTING_HELPERS)
++$(OUTPUT)/test_skb_cgroup_id_user: $(CGROUP_HELPERS) $(TESTING_HELPERS)
++$(OUTPUT)/test_sock: $(CGROUP_HELPERS) $(TESTING_HELPERS)
++$(OUTPUT)/test_sock_addr: $(CGROUP_HELPERS) $(TESTING_HELPERS)
++$(OUTPUT)/test_sockmap: $(CGROUP_HELPERS) $(TESTING_HELPERS)
++$(OUTPUT)/test_tcpnotify_user: $(CGROUP_HELPERS) $(TESTING_HELPERS) $(TRACE_HELPERS)
++$(OUTPUT)/get_cgroup_id_user: $(CGROUP_HELPERS) $(TESTING_HELPERS)
++$(OUTPUT)/test_cgroup_storage: $(CGROUP_HELPERS) $(TESTING_HELPERS)
++$(OUTPUT)/test_sock_fields: $(CGROUP_HELPERS) $(TESTING_HELPERS)
++$(OUTPUT)/test_sysctl: $(CGROUP_HELPERS) $(TESTING_HELPERS)
++$(OUTPUT)/test_tag: $(TESTING_HELPERS)
++$(OUTPUT)/test_lirc_mode2_user: $(TESTING_HELPERS)
++$(OUTPUT)/xdping: $(TESTING_HELPERS)
++$(OUTPUT)/flow_dissector_load: $(TESTING_HELPERS)
++$(OUTPUT)/test_maps: $(TESTING_HELPERS)
++$(OUTPUT)/test_verifier: $(TESTING_HELPERS) $(CAP_HELPERS)
+ 
+ BPFTOOL ?= $(DEFAULT_BPFTOOL)
+ $(DEFAULT_BPFTOOL): $(wildcard $(BPFTOOLDIR)/*.[ch] $(BPFTOOLDIR)/Makefile)    \
+--- a/tools/testing/selftests/bpf/test_verifier.c
++++ b/tools/testing/selftests/bpf/test_verifier.c
+@@ -22,8 +22,6 @@
+ #include <limits.h>
+ #include <assert.h>
+ 
+-#include <sys/capability.h>
+-
+ #include <linux/unistd.h>
+ #include <linux/filter.h>
+ #include <linux/bpf_perf_event.h>
+@@ -43,6 +41,7 @@
+ # endif
+ #endif
+ #include "bpf_rlimit.h"
++#include "cap_helpers.h"
+ #include "bpf_rand.h"
+ #include "bpf_util.h"
+ #include "test_btf.h"
+@@ -59,6 +58,10 @@
+ #define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS	(1 << 0)
+ #define F_LOAD_WITH_STRICT_ALIGNMENT		(1 << 1)
+ 
++/* need CAP_BPF, CAP_NET_ADMIN, CAP_PERFMON to load progs */
++#define ADMIN_CAPS (1ULL << CAP_NET_ADMIN |	\
++		    1ULL << CAP_PERFMON |	\
++		    1ULL << CAP_BPF)
+ #define UNPRIV_SYSCTL "kernel/unprivileged_bpf_disabled"
+ static bool unpriv_disabled = false;
+ static int skips;
+@@ -940,47 +943,19 @@ struct libcap {
+ 
+ static int set_admin(bool admin)
+ {
+-	cap_t caps;
+-	/* need CAP_BPF, CAP_NET_ADMIN, CAP_PERFMON to load progs */
+-	const cap_value_t cap_net_admin = CAP_NET_ADMIN;
+-	const cap_value_t cap_sys_admin = CAP_SYS_ADMIN;
+-	struct libcap *cap;
+-	int ret = -1;
+-
+-	caps = cap_get_proc();
+-	if (!caps) {
+-		perror("cap_get_proc");
+-		return -1;
+-	}
+-	cap = (struct libcap *)caps;
+-	if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_sys_admin, CAP_CLEAR)) {
+-		perror("cap_set_flag clear admin");
+-		goto out;
+-	}
+-	if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_net_admin,
+-				admin ? CAP_SET : CAP_CLEAR)) {
+-		perror("cap_set_flag set_or_clear net");
+-		goto out;
+-	}
+-	/* libcap is likely old and simply ignores CAP_BPF and CAP_PERFMON,
+-	 * so update effective bits manually
+-	 */
++	int err;
++
+ 	if (admin) {
+-		cap->data[1].effective |= 1 << (38 /* CAP_PERFMON */ - 32);
+-		cap->data[1].effective |= 1 << (39 /* CAP_BPF */ - 32);
++		err = cap_enable_effective(ADMIN_CAPS, NULL);
++		if (err)
++			perror("cap_enable_effective(ADMIN_CAPS)");
+ 	} else {
+-		cap->data[1].effective &= ~(1 << (38 - 32));
+-		cap->data[1].effective &= ~(1 << (39 - 32));
++		err = cap_disable_effective(ADMIN_CAPS, NULL);
++		if (err)
++			perror("cap_disable_effective(ADMIN_CAPS)");
+ 	}
+-	if (cap_set_proc(caps)) {
+-		perror("cap_set_proc");
+-		goto out;
+-	}
+-	ret = 0;
+-out:
+-	if (cap_free(caps))
+-		perror("cap_free");
+-	return ret;
++
++	return err;
+ }
+ 
+ static int do_prog_test_run(int fd_prog, bool unpriv, uint32_t expected_val,
+@@ -1246,31 +1221,18 @@ fail_log:
+ 
+ static bool is_admin(void)
+ {
+-	cap_flag_value_t net_priv = CAP_CLEAR;
+-	bool perfmon_priv = false;
+-	bool bpf_priv = false;
+-	struct libcap *cap;
+-	cap_t caps;
+-
+-#ifdef CAP_IS_SUPPORTED
+-	if (!CAP_IS_SUPPORTED(CAP_SETFCAP)) {
+-		perror("cap_get_flag");
+-		return false;
+-	}
+-#endif
+-	caps = cap_get_proc();
+-	if (!caps) {
+-		perror("cap_get_proc");
++	__u64 caps;
++
++	/* The test checks for finer cap as CAP_NET_ADMIN,
++	 * CAP_PERFMON, and CAP_BPF instead of CAP_SYS_ADMIN.
++	 * Thus, disable CAP_SYS_ADMIN at the beginning.
++	 */
++	if (cap_disable_effective(1ULL << CAP_SYS_ADMIN, &caps)) {
++		perror("cap_disable_effective(CAP_SYS_ADMIN)");
+ 		return false;
+ 	}
+-	cap = (struct libcap *)caps;
+-	bpf_priv = cap->data[1].effective & (1 << (39/* CAP_BPF */ - 32));
+-	perfmon_priv = cap->data[1].effective & (1 << (38/* CAP_PERFMON */ - 32));
+-	if (cap_get_flag(caps, CAP_NET_ADMIN, CAP_EFFECTIVE, &net_priv))
+-		perror("cap_get_flag NET");
+-	if (cap_free(caps))
+-		perror("cap_free");
+-	return bpf_priv && perfmon_priv && net_priv == CAP_SET;
++
++	return (caps & ADMIN_CAPS) == ADMIN_CAPS;
+ }
+ 
+ static void get_unpriv_disabled()
diff --git a/target/linux/generic/backport-5.15/060-v5.18-03-bpf-selftests-Remove-libcap-usage-from-test_progs.patch b/target/linux/generic/backport-5.15/060-v5.18-03-bpf-selftests-Remove-libcap-usage-from-test_progs.patch
new file mode 100644
index 00000000000000..9badba7f8eaa36
--- /dev/null
+++ b/target/linux/generic/backport-5.15/060-v5.18-03-bpf-selftests-Remove-libcap-usage-from-test_progs.patch
@@ -0,0 +1,122 @@
+From 1ac00fea13c576e2b13dabf9a72ad3034e3bb804 Mon Sep 17 00:00:00 2001
+From: Martin KaFai Lau <kafai@fb.com>
+Date: Wed, 16 Mar 2022 10:38:35 -0700
+Subject: [PATCH 3/3] bpf: selftests: Remove libcap usage from test_progs
+
+This patch removes the libcap usage from test_progs.
+bind_perm.c is the only user.  cap_*_effective() helpers added in the
+earlier patch are directly used instead.
+
+No other selftest binary is using libcap, so '-lcap' is also removed
+from the Makefile.
+
+Signed-off-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Reviewed-by: Stanislav Fomichev <sdf@google.com>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20220316173835.2039334-1-kafai@fb.com
+---
+ tools/testing/selftests/bpf/Makefile          |  5 ++-
+ .../selftests/bpf/prog_tests/bind_perm.c      | 44 ++++---------------
+ 2 files changed, 11 insertions(+), 38 deletions(-)
+
+--- a/tools/testing/selftests/bpf/Makefile
++++ b/tools/testing/selftests/bpf/Makefile
+@@ -26,7 +26,7 @@ CFLAGS += -g -O0 -rdynamic -Wall $(GENFL
+ 	  -I$(TOOLSINCDIR) -I$(APIDIR) -I$(OUTPUT)			\
+ 	  -Dbpf_prog_load=bpf_prog_test_load				\
+ 	  -Dbpf_load_program=bpf_test_load_program
+-LDLIBS += -lcap -lelf -lz -lrt -lpthread
++LDLIBS += -lelf -lz -lrt -lpthread
+ 
+ # Silence some warnings when compiled with clang
+ ifneq ($(LLVM),)
+@@ -471,7 +471,8 @@ TRUNNER_TESTS_DIR := prog_tests
+ TRUNNER_BPF_PROGS_DIR := progs
+ TRUNNER_EXTRA_SOURCES := test_progs.c cgroup_helpers.c trace_helpers.c	\
+ 			 network_helpers.c testing_helpers.c		\
+-			 btf_helpers.c	flow_dissector_load.h
++			 btf_helpers.c flow_dissector_load.h		\
++			 cap_helpers.c
+ TRUNNER_EXTRA_FILES := $(OUTPUT)/urandom_read $(OUTPUT)/bpf_testmod.ko	\
+ 		       ima_setup.sh					\
+ 		       $(wildcard progs/btf_dump_test_case_*.c)
+--- a/tools/testing/selftests/bpf/prog_tests/bind_perm.c
++++ b/tools/testing/selftests/bpf/prog_tests/bind_perm.c
+@@ -4,9 +4,9 @@
+ #include <stdlib.h>
+ #include <sys/types.h>
+ #include <sys/socket.h>
+-#include <sys/capability.h>
+ 
+ #include "test_progs.h"
++#include "cap_helpers.h"
+ #include "bind_perm.skel.h"
+ 
+ static int duration;
+@@ -49,41 +49,11 @@ close_socket:
+ 		close(fd);
+ }
+ 
+-bool cap_net_bind_service(cap_flag_value_t flag)
+-{
+-	const cap_value_t cap_net_bind_service = CAP_NET_BIND_SERVICE;
+-	cap_flag_value_t original_value;
+-	bool was_effective = false;
+-	cap_t caps;
+-
+-	caps = cap_get_proc();
+-	if (CHECK(!caps, "cap_get_proc", "errno %d", errno))
+-		goto free_caps;
+-
+-	if (CHECK(cap_get_flag(caps, CAP_NET_BIND_SERVICE, CAP_EFFECTIVE,
+-			       &original_value),
+-		  "cap_get_flag", "errno %d", errno))
+-		goto free_caps;
+-
+-	was_effective = (original_value == CAP_SET);
+-
+-	if (CHECK(cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_net_bind_service,
+-			       flag),
+-		  "cap_set_flag", "errno %d", errno))
+-		goto free_caps;
+-
+-	if (CHECK(cap_set_proc(caps), "cap_set_proc", "errno %d", errno))
+-		goto free_caps;
+-
+-free_caps:
+-	CHECK(cap_free(caps), "cap_free", "errno %d", errno);
+-	return was_effective;
+-}
+-
+ void test_bind_perm(void)
+ {
+-	bool cap_was_effective;
++	const __u64 net_bind_svc_cap = 1ULL << CAP_NET_BIND_SERVICE;
+ 	struct bind_perm *skel;
++	__u64 old_caps = 0;
+ 	int cgroup_fd;
+ 
+ 	if (create_netns())
+@@ -105,7 +75,8 @@ void test_bind_perm(void)
+ 	if (!ASSERT_OK_PTR(skel, "bind_v6_prog"))
+ 		goto close_skeleton;
+ 
+-	cap_was_effective = cap_net_bind_service(CAP_CLEAR);
++	ASSERT_OK(cap_disable_effective(net_bind_svc_cap, &old_caps),
++		  "cap_disable_effective");
+ 
+ 	try_bind(AF_INET, 110, EACCES);
+ 	try_bind(AF_INET6, 110, EACCES);
+@@ -113,8 +84,9 @@ void test_bind_perm(void)
+ 	try_bind(AF_INET, 111, 0);
+ 	try_bind(AF_INET6, 111, 0);
+ 
+-	if (cap_was_effective)
+-		cap_net_bind_service(CAP_SET);
++	if (old_caps & net_bind_svc_cap)
++		ASSERT_OK(cap_enable_effective(net_bind_svc_cap, NULL),
++			  "cap_enable_effective");
+ 
+ close_skeleton:
+ 	bind_perm__destroy(skel);
diff --git a/target/linux/generic/backport-5.15/080-v5.17-clk-gate-Add-devm_clk_hw_register_gate.patch b/target/linux/generic/backport-5.15/080-v5.17-clk-gate-Add-devm_clk_hw_register_gate.patch
new file mode 100644
index 00000000000000..51c23b6e349501
--- /dev/null
+++ b/target/linux/generic/backport-5.15/080-v5.17-clk-gate-Add-devm_clk_hw_register_gate.patch
@@ -0,0 +1,105 @@
+From 815f0e738a8d5663a02350e2580706829144a722 Mon Sep 17 00:00:00 2001
+From: Horatiu Vultur <horatiu.vultur@microchip.com>
+Date: Wed, 3 Nov 2021 09:50:59 +0100
+Subject: [PATCH] clk: gate: Add devm_clk_hw_register_gate()
+
+Add devm_clk_hw_register_gate() - devres-managed version of
+clk_hw_register_gate()
+
+Suggested-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Link: https://lore.kernel.org/r/20211103085102.1656081-2-horatiu.vultur@microchip.com
+---
+ drivers/clk/clk-gate.c       | 35 +++++++++++++++++++++++++++++++++++
+ include/linux/clk-provider.h | 23 +++++++++++++++++++++++
+ 2 files changed, 58 insertions(+)
+
+--- a/drivers/clk/clk-gate.c
++++ b/drivers/clk/clk-gate.c
+@@ -7,6 +7,7 @@
+  */
+ 
+ #include <linux/clk-provider.h>
++#include <linux/device.h>
+ #include <linux/module.h>
+ #include <linux/slab.h>
+ #include <linux/io.h>
+@@ -222,3 +223,37 @@ void clk_hw_unregister_gate(struct clk_h
+ 	kfree(gate);
+ }
+ EXPORT_SYMBOL_GPL(clk_hw_unregister_gate);
++
++static void devm_clk_hw_release_gate(struct device *dev, void *res)
++{
++	clk_hw_unregister_gate(*(struct clk_hw **)res);
++}
++
++struct clk_hw *__devm_clk_hw_register_gate(struct device *dev,
++		struct device_node *np, const char *name,
++		const char *parent_name, const struct clk_hw *parent_hw,
++		const struct clk_parent_data *parent_data,
++		unsigned long flags,
++		void __iomem *reg, u8 bit_idx,
++		u8 clk_gate_flags, spinlock_t *lock)
++{
++	struct clk_hw **ptr, *hw;
++
++	ptr = devres_alloc(devm_clk_hw_release_gate, sizeof(*ptr), GFP_KERNEL);
++	if (!ptr)
++		return ERR_PTR(-ENOMEM);
++
++	hw = __clk_hw_register_gate(dev, np, name, parent_name, parent_hw,
++				    parent_data, flags, reg, bit_idx,
++				    clk_gate_flags, lock);
++
++	if (!IS_ERR(hw)) {
++		*ptr = hw;
++		devres_add(dev, ptr);
++	} else {
++		devres_free(ptr);
++	}
++
++	return hw;
++}
++EXPORT_SYMBOL_GPL(__devm_clk_hw_register_gate);
+--- a/include/linux/clk-provider.h
++++ b/include/linux/clk-provider.h
+@@ -490,6 +490,13 @@ struct clk_hw *__clk_hw_register_gate(st
+ 		unsigned long flags,
+ 		void __iomem *reg, u8 bit_idx,
+ 		u8 clk_gate_flags, spinlock_t *lock);
++struct clk_hw *__devm_clk_hw_register_gate(struct device *dev,
++		struct device_node *np, const char *name,
++		const char *parent_name, const struct clk_hw *parent_hw,
++		const struct clk_parent_data *parent_data,
++		unsigned long flags,
++		void __iomem *reg, u8 bit_idx,
++		u8 clk_gate_flags, spinlock_t *lock);
+ struct clk *clk_register_gate(struct device *dev, const char *name,
+ 		const char *parent_name, unsigned long flags,
+ 		void __iomem *reg, u8 bit_idx,
+@@ -544,6 +551,22 @@ struct clk *clk_register_gate(struct dev
+ 	__clk_hw_register_gate((dev), NULL, (name), NULL, NULL, (parent_data), \
+ 			       (flags), (reg), (bit_idx),		      \
+ 			       (clk_gate_flags), (lock))
++/**
++ * devm_clk_hw_register_gate - register a gate clock with the clock framework
++ * @dev: device that is registering this clock
++ * @name: name of this clock
++ * @parent_name: name of this clock's parent
++ * @flags: framework-specific flags for this clock
++ * @reg: register address to control gating of this clock
++ * @bit_idx: which bit in the register controls gating of this clock
++ * @clk_gate_flags: gate-specific flags for this clock
++ * @lock: shared register lock for this clock
++ */
++#define devm_clk_hw_register_gate(dev, name, parent_name, flags, reg, bit_idx,\
++				  clk_gate_flags, lock)			      \
++	__devm_clk_hw_register_gate((dev), NULL, (name), (parent_name), NULL, \
++			       NULL, (flags), (reg), (bit_idx),		      \
++			       (clk_gate_flags), (lock))
+ void clk_unregister_gate(struct clk *clk);
+ void clk_hw_unregister_gate(struct clk_hw *hw);
+ int clk_gate_is_enabled(struct clk_hw *hw);
diff --git a/target/linux/generic/backport-5.15/081-v5.17-regmap-allow-to-define-reg_update_bits-for-no-bus.patch b/target/linux/generic/backport-5.15/081-v5.17-regmap-allow-to-define-reg_update_bits-for-no-bus.patch
new file mode 100644
index 00000000000000..e4c0833ae75f35
--- /dev/null
+++ b/target/linux/generic/backport-5.15/081-v5.17-regmap-allow-to-define-reg_update_bits-for-no-bus.patch
@@ -0,0 +1,52 @@
+From 02d6fdecb9c38de19065f6bed8d5214556fd061d Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Thu, 4 Nov 2021 16:00:40 +0100
+Subject: regmap: allow to define reg_update_bits for no bus configuration
+
+Some device requires a special handling for reg_update_bits and can't use
+the normal regmap read write logic. An example is when locking is
+handled by the device and rmw operations requires to do atomic operations.
+Allow to declare a dedicated function in regmap_config for
+reg_update_bits in no bus configuration.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Link: https://lore.kernel.org/r/20211104150040.1260-1-ansuelsmth@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+---
+ drivers/base/regmap/regmap.c | 1 +
+ include/linux/regmap.h       | 7 +++++++
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -877,6 +877,7 @@ struct regmap *__regmap_init(struct devi
+ 	if (!bus) {
+ 		map->reg_read  = config->reg_read;
+ 		map->reg_write = config->reg_write;
++		map->reg_update_bits = config->reg_update_bits;
+ 
+ 		map->defer_caching = false;
+ 		goto skip_format_initialization;
+--- a/include/linux/regmap.h
++++ b/include/linux/regmap.h
+@@ -290,6 +290,11 @@ typedef void (*regmap_unlock)(void *);
+  *		  read operation on a bus such as SPI, I2C, etc. Most of the
+  *		  devices do not need this.
+  * @reg_write:	  Same as above for writing.
++ * @reg_update_bits: Optional callback that if filled will be used to perform
++ *		     all the update_bits(rmw) operation. Should only be provided
++ *		     if the function require special handling with lock and reg
++ *		     handling and the operation cannot be represented as a simple
++ *		     update_bits operation on a bus such as SPI, I2C, etc.
+  * @fast_io:	  Register IO is fast. Use a spinlock instead of a mutex
+  *	     	  to perform locking. This field is ignored if custom lock/unlock
+  *	     	  functions are used (see fields lock/unlock of struct regmap_config).
+@@ -372,6 +377,8 @@ struct regmap_config {
+ 
+ 	int (*reg_read)(void *context, unsigned int reg, unsigned int *val);
+ 	int (*reg_write)(void *context, unsigned int reg, unsigned int val);
++	int (*reg_update_bits)(void *context, unsigned int reg,
++			       unsigned int mask, unsigned int val);
+ 
+ 	bool fast_io;
+ 
diff --git a/target/linux/generic/backport-5.15/201-v5.16-scripts-dtc-Update-to-upstream-version-v1.6.1-19-g0a.patch b/target/linux/generic/backport-5.15/201-v5.16-scripts-dtc-Update-to-upstream-version-v1.6.1-19-g0a.patch
new file mode 100644
index 00000000000000..d1bef74f327aee
--- /dev/null
+++ b/target/linux/generic/backport-5.15/201-v5.16-scripts-dtc-Update-to-upstream-version-v1.6.1-19-g0a.patch
@@ -0,0 +1,997 @@
+From a77725a9a3c5924e2fd4cd5b3557dd92a8e46f87 Mon Sep 17 00:00:00 2001
+From: Rob Herring <robh@kernel.org>
+Date: Mon, 25 Oct 2021 11:05:45 -0500
+Subject: [PATCH 1/1] scripts/dtc: Update to upstream version
+ v1.6.1-19-g0a3a9d3449c8
+
+This adds the following commits from upstream:
+
+0a3a9d3449c8 checks: Add an interrupt-map check
+8fd24744e361 checks: Ensure '#interrupt-cells' only exists in interrupt providers
+d8d1a9a77863 checks: Drop interrupt provider '#address-cells' check
+52a16fd72824 checks: Make interrupt_provider check dependent on interrupts_extended_is_cell
+37fd700685da treesource: Maintain phandle label/path on output
+e33ce1d6a8c7 flattree: Use '\n', not ';' to separate asm pseudo-ops
+d24cc189dca6 asm: Use assembler macros instead of cpp macros
+ff3a30c115ad asm: Use .asciz and .ascii instead of .string
+5eb5927d81ee fdtdump: fix -Werror=int-to-pointer-cast
+0869f8269161 libfdt: Add ALIGNMENT error string
+69595a167f06 checks: Fix bus-range check
+72d09e2682a4 Makefile: add -Wsign-compare to warning options
+b587787ef388 checks: Fix signedness comparisons warnings
+69bed6c2418f dtc: Wrap phandle validity check
+910221185560 fdtget: Fix signedness comparisons warnings
+d966f08fcd21 tests: Fix signedness comparisons warnings
+ecfb438c07fa dtc: Fix signedness comparisons warnings: pointer diff
+5bec74a6d135 dtc: Fix signedness comparisons warnings: reservednum
+24e7f511fd4a fdtdump: Fix signedness comparisons warnings
+b6910bec1161 Bump version to v1.6.1
+21d61d18f968 Fix CID 1461557
+4c2ef8f4d14c checks: Introduce is_multiple_of()
+e59ca36fb70e Make handling of cpp line information more tolerant
+0c3fd9b6aceb checks: Drop interrupt_cells_is_cell check
+6b3081abc4ac checks: Add check_is_cell() for all phandle+arg properties
+2dffc192a77f yamltree: Remove marker ordering dependency
+61e513439e40 pylibfdt: Rework "avoid unused variable warning" lines
+c8bddd106095 tests: add a positive gpio test case
+ad4abfadb687 checks: replace strstr and strrchr with strends
+09c6a6e88718 dtc.h: add strends for suffix matching
+9bb9b8d0b4a0 checks: tigthen up nr-gpios prop exception
+b07b62ee3342 libfdt: Add FDT alignment check to fdt_check_header()
+a2def5479950 libfdt: Check that the root-node name is empty
+4ca61f84dc21 libfdt: Check that there is only one root node
+34d708249a91 dtc: Remove -O dtbo support
+8e7ff260f755 libfdt: Fix a possible "unchecked return value" warning
+88875268c05c checks: Warn on node-name and property name being the same
+9d2279e7e6ee checks: Change node-name check to match devicetree spec
+f527c867a8c6 util: limit gnu_printf format attribute to gcc >= 4.4.0
+
+Reviewed-by: Frank Rowand <frank.rowand@sony.com>
+Tested-by: Frank Rowand <frank.rowand@sony.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+---
+ scripts/dtc/checks.c              | 222 ++++++++++++++++++++++--------
+ scripts/dtc/dtc-lexer.l           |   2 +-
+ scripts/dtc/dtc.c                 |   6 +-
+ scripts/dtc/dtc.h                 |  40 +++++-
+ scripts/dtc/flattree.c            |  11 +-
+ scripts/dtc/libfdt/fdt.c          |   4 +
+ scripts/dtc/libfdt/fdt_rw.c       |  18 ++-
+ scripts/dtc/libfdt/fdt_strerror.c |   1 +
+ scripts/dtc/libfdt/libfdt.h       |   7 +
+ scripts/dtc/livetree.c            |   6 +-
+ scripts/dtc/treesource.c          |  48 +++----
+ scripts/dtc/util.h                |   6 +-
+ scripts/dtc/version_gen.h         |   2 +-
+ scripts/dtc/yamltree.c            |  16 ++-
+ 14 files changed, 275 insertions(+), 114 deletions(-)
+
+--- a/scripts/dtc/checks.c
++++ b/scripts/dtc/checks.c
+@@ -143,6 +143,14 @@ static void check_nodes_props(struct che
+ 		check_nodes_props(c, dti, child);
+ }
+ 
++static bool is_multiple_of(int multiple, int divisor)
++{
++	if (divisor == 0)
++		return multiple == 0;
++	else
++		return (multiple % divisor) == 0;
++}
++
+ static bool run_check(struct check *c, struct dt_info *dti)
+ {
+ 	struct node *dt = dti->dt;
+@@ -297,19 +305,20 @@ ERROR(duplicate_property_names, check_du
+ #define LOWERCASE	"abcdefghijklmnopqrstuvwxyz"
+ #define UPPERCASE	"ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+ #define DIGITS		"0123456789"
+-#define PROPNODECHARS	LOWERCASE UPPERCASE DIGITS ",._+*#?-"
++#define NODECHARS	LOWERCASE UPPERCASE DIGITS ",._+-@"
++#define PROPCHARS	LOWERCASE UPPERCASE DIGITS ",._+*#?-"
+ #define PROPNODECHARSSTRICT	LOWERCASE UPPERCASE DIGITS ",-"
+ 
+ static void check_node_name_chars(struct check *c, struct dt_info *dti,
+ 				  struct node *node)
+ {
+-	int n = strspn(node->name, c->data);
++	size_t n = strspn(node->name, c->data);
+ 
+ 	if (n < strlen(node->name))
+ 		FAIL(c, dti, node, "Bad character '%c' in node name",
+ 		     node->name[n]);
+ }
+-ERROR(node_name_chars, check_node_name_chars, PROPNODECHARS "@");
++ERROR(node_name_chars, check_node_name_chars, NODECHARS);
+ 
+ static void check_node_name_chars_strict(struct check *c, struct dt_info *dti,
+ 					 struct node *node)
+@@ -330,6 +339,20 @@ static void check_node_name_format(struc
+ }
+ ERROR(node_name_format, check_node_name_format, NULL, &node_name_chars);
+ 
++static void check_node_name_vs_property_name(struct check *c,
++					     struct dt_info *dti,
++					     struct node *node)
++{
++	if (!node->parent)
++		return;
++
++	if (get_property(node->parent, node->name)) {
++		FAIL(c, dti, node, "node name and property name conflict");
++	}
++}
++WARNING(node_name_vs_property_name, check_node_name_vs_property_name,
++	NULL, &node_name_chars);
++
+ static void check_unit_address_vs_reg(struct check *c, struct dt_info *dti,
+ 				      struct node *node)
+ {
+@@ -363,14 +386,14 @@ static void check_property_name_chars(st
+ 	struct property *prop;
+ 
+ 	for_each_property(node, prop) {
+-		int n = strspn(prop->name, c->data);
++		size_t n = strspn(prop->name, c->data);
+ 
+ 		if (n < strlen(prop->name))
+ 			FAIL_PROP(c, dti, node, prop, "Bad character '%c' in property name",
+ 				  prop->name[n]);
+ 	}
+ }
+-ERROR(property_name_chars, check_property_name_chars, PROPNODECHARS);
++ERROR(property_name_chars, check_property_name_chars, PROPCHARS);
+ 
+ static void check_property_name_chars_strict(struct check *c,
+ 					     struct dt_info *dti,
+@@ -380,7 +403,7 @@ static void check_property_name_chars_st
+ 
+ 	for_each_property(node, prop) {
+ 		const char *name = prop->name;
+-		int n = strspn(name, c->data);
++		size_t n = strspn(name, c->data);
+ 
+ 		if (n == strlen(prop->name))
+ 			continue;
+@@ -497,7 +520,7 @@ static cell_t check_phandle_prop(struct
+ 
+ 	phandle = propval_cell(prop);
+ 
+-	if ((phandle == 0) || (phandle == -1)) {
++	if (!phandle_is_valid(phandle)) {
+ 		FAIL_PROP(c, dti, node, prop, "bad value (0x%x) in %s property",
+ 		     phandle, prop->name);
+ 		return 0;
+@@ -556,7 +579,7 @@ static void check_name_properties(struct
+ 	if (!prop)
+ 		return; /* No name property, that's fine */
+ 
+-	if ((prop->val.len != node->basenamelen+1)
++	if ((prop->val.len != node->basenamelen + 1U)
+ 	    || (memcmp(prop->val.val, node->name, node->basenamelen) != 0)) {
+ 		FAIL(c, dti, node, "\"name\" property is incorrect (\"%s\" instead"
+ 		     " of base node name)", prop->val.val);
+@@ -657,7 +680,6 @@ ERROR(omit_unused_nodes, fixup_omit_unus
+  */
+ WARNING_IF_NOT_CELL(address_cells_is_cell, "#address-cells");
+ WARNING_IF_NOT_CELL(size_cells_is_cell, "#size-cells");
+-WARNING_IF_NOT_CELL(interrupt_cells_is_cell, "#interrupt-cells");
+ 
+ WARNING_IF_NOT_STRING(device_type_is_string, "device_type");
+ WARNING_IF_NOT_STRING(model_is_string, "model");
+@@ -672,8 +694,7 @@ static void check_names_is_string_list(s
+ 	struct property *prop;
+ 
+ 	for_each_property(node, prop) {
+-		const char *s = strrchr(prop->name, '-');
+-		if (!s || !streq(s, "-names"))
++		if (!strends(prop->name, "-names"))
+ 			continue;
+ 
+ 		c->data = prop->name;
+@@ -753,7 +774,7 @@ static void check_reg_format(struct chec
+ 	size_cells = node_size_cells(node->parent);
+ 	entrylen = (addr_cells + size_cells) * sizeof(cell_t);
+ 
+-	if (!entrylen || (prop->val.len % entrylen) != 0)
++	if (!is_multiple_of(prop->val.len, entrylen))
+ 		FAIL_PROP(c, dti, node, prop, "property has invalid length (%d bytes) "
+ 			  "(#address-cells == %d, #size-cells == %d)",
+ 			  prop->val.len, addr_cells, size_cells);
+@@ -794,7 +815,7 @@ static void check_ranges_format(struct c
+ 				  "#size-cells (%d) differs from %s (%d)",
+ 				  ranges, c_size_cells, node->parent->fullpath,
+ 				  p_size_cells);
+-	} else if ((prop->val.len % entrylen) != 0) {
++	} else if (!is_multiple_of(prop->val.len, entrylen)) {
+ 		FAIL_PROP(c, dti, node, prop, "\"%s\" property has invalid length (%d bytes) "
+ 			  "(parent #address-cells == %d, child #address-cells == %d, "
+ 			  "#size-cells == %d)", ranges, prop->val.len,
+@@ -871,7 +892,7 @@ static void check_pci_device_bus_num(str
+ 	} else {
+ 		cells = (cell_t *)prop->val.val;
+ 		min_bus = fdt32_to_cpu(cells[0]);
+-		max_bus = fdt32_to_cpu(cells[0]);
++		max_bus = fdt32_to_cpu(cells[1]);
+ 	}
+ 	if ((bus_num < min_bus) || (bus_num > max_bus))
+ 		FAIL_PROP(c, dti, node, prop, "PCI bus number %d out of range, expected (%d - %d)",
+@@ -1367,9 +1388,9 @@ static void check_property_phandle_args(
+ 				          const struct provider *provider)
+ {
+ 	struct node *root = dti->dt;
+-	int cell, cellsize = 0;
++	unsigned int cell, cellsize = 0;
+ 
+-	if (prop->val.len % sizeof(cell_t)) {
++	if (!is_multiple_of(prop->val.len, sizeof(cell_t))) {
+ 		FAIL_PROP(c, dti, node, prop,
+ 			  "property size (%d) is invalid, expected multiple of %zu",
+ 			  prop->val.len, sizeof(cell_t));
+@@ -1379,14 +1400,14 @@ static void check_property_phandle_args(
+ 	for (cell = 0; cell < prop->val.len / sizeof(cell_t); cell += cellsize + 1) {
+ 		struct node *provider_node;
+ 		struct property *cellprop;
+-		int phandle;
++		cell_t phandle;
+ 
+ 		phandle = propval_cell_n(prop, cell);
+ 		/*
+ 		 * Some bindings use a cell value 0 or -1 to skip over optional
+ 		 * entries when each index position has a specific definition.
+ 		 */
+-		if (phandle == 0 || phandle == -1) {
++		if (!phandle_is_valid(phandle)) {
+ 			/* Give up if this is an overlay with external references */
+ 			if (dti->dtsflags & DTSF_PLUGIN)
+ 				break;
+@@ -1452,7 +1473,8 @@ static void check_provider_cells_propert
+ }
+ #define WARNING_PROPERTY_PHANDLE_CELLS(nm, propname, cells_name, ...) \
+ 	static struct provider nm##_provider = { (propname), (cells_name), __VA_ARGS__ }; \
+-	WARNING(nm##_property, check_provider_cells_property, &nm##_provider, &phandle_references);
++	WARNING_IF_NOT_CELL(nm##_is_cell, cells_name); \
++	WARNING(nm##_property, check_provider_cells_property, &nm##_provider, &nm##_is_cell, &phandle_references);
+ 
+ WARNING_PROPERTY_PHANDLE_CELLS(clocks, "clocks", "#clock-cells");
+ WARNING_PROPERTY_PHANDLE_CELLS(cooling_device, "cooling-device", "#cooling-cells");
+@@ -1473,24 +1495,17 @@ WARNING_PROPERTY_PHANDLE_CELLS(thermal_s
+ 
+ static bool prop_is_gpio(struct property *prop)
+ {
+-	char *str;
+-
+ 	/*
+ 	 * *-gpios and *-gpio can appear in property names,
+ 	 * so skip over any false matches (only one known ATM)
+ 	 */
+-	if (strstr(prop->name, "nr-gpio"))
++	if (strends(prop->name, ",nr-gpios"))
+ 		return false;
+ 
+-	str = strrchr(prop->name, '-');
+-	if (str)
+-		str++;
+-	else
+-		str = prop->name;
+-	if (!(streq(str, "gpios") || streq(str, "gpio")))
+-		return false;
+-
+-	return true;
++	return strends(prop->name, "-gpios") ||
++		streq(prop->name, "gpios") ||
++		strends(prop->name, "-gpio") ||
++		streq(prop->name, "gpio");
+ }
+ 
+ static void check_gpios_property(struct check *c,
+@@ -1525,13 +1540,10 @@ static void check_deprecated_gpio_proper
+ 	struct property *prop;
+ 
+ 	for_each_property(node, prop) {
+-		char *str;
+-
+ 		if (!prop_is_gpio(prop))
+ 			continue;
+ 
+-		str = strstr(prop->name, "gpio");
+-		if (!streq(str, "gpio"))
++		if (!strends(prop->name, "gpio"))
+ 			continue;
+ 
+ 		FAIL_PROP(c, dti, node, prop,
+@@ -1561,21 +1573,106 @@ static void check_interrupt_provider(str
+ 				     struct node *node)
+ {
+ 	struct property *prop;
++	bool irq_provider = node_is_interrupt_provider(node);
+ 
+-	if (!node_is_interrupt_provider(node))
++	prop = get_property(node, "#interrupt-cells");
++	if (irq_provider && !prop) {
++		FAIL(c, dti, node,
++		     "Missing '#interrupt-cells' in interrupt provider");
+ 		return;
++	}
+ 
+-	prop = get_property(node, "#interrupt-cells");
+-	if (!prop)
++	if (!irq_provider && prop) {
+ 		FAIL(c, dti, node,
+-		     "Missing #interrupt-cells in interrupt provider");
++		     "'#interrupt-cells' found, but node is not an interrupt provider");
++		return;
++	}
++}
++WARNING(interrupt_provider, check_interrupt_provider, NULL, &interrupts_extended_is_cell);
+ 
+-	prop = get_property(node, "#address-cells");
+-	if (!prop)
++static void check_interrupt_map(struct check *c,
++				struct dt_info *dti,
++				struct node *node)
++{
++	struct node *root = dti->dt;
++	struct property *prop, *irq_map_prop;
++	size_t cellsize, cell, map_cells;
++
++	irq_map_prop = get_property(node, "interrupt-map");
++	if (!irq_map_prop)
++		return;
++
++	if (node->addr_cells < 0) {
+ 		FAIL(c, dti, node,
+-		     "Missing #address-cells in interrupt provider");
++		     "Missing '#address-cells' in interrupt-map provider");
++		return;
++	}
++	cellsize = node_addr_cells(node);
++	cellsize += propval_cell(get_property(node, "#interrupt-cells"));
++
++	prop = get_property(node, "interrupt-map-mask");
++	if (prop && (prop->val.len != (cellsize * sizeof(cell_t))))
++		FAIL_PROP(c, dti, node, prop,
++			  "property size (%d) is invalid, expected %zu",
++			  prop->val.len, cellsize * sizeof(cell_t));
++
++	if (!is_multiple_of(irq_map_prop->val.len, sizeof(cell_t))) {
++		FAIL_PROP(c, dti, node, irq_map_prop,
++			  "property size (%d) is invalid, expected multiple of %zu",
++			  irq_map_prop->val.len, sizeof(cell_t));
++		return;
++	}
++
++	map_cells = irq_map_prop->val.len / sizeof(cell_t);
++	for (cell = 0; cell < map_cells; ) {
++		struct node *provider_node;
++		struct property *cellprop;
++		int phandle;
++		size_t parent_cellsize;
++
++		if ((cell + cellsize) >= map_cells) {
++			FAIL_PROP(c, dti, node, irq_map_prop,
++				  "property size (%d) too small, expected > %zu",
++				  irq_map_prop->val.len, (cell + cellsize) * sizeof(cell_t));
++			break;
++		}
++		cell += cellsize;
++
++		phandle = propval_cell_n(irq_map_prop, cell);
++		if (!phandle_is_valid(phandle)) {
++			/* Give up if this is an overlay with external references */
++			if (!(dti->dtsflags & DTSF_PLUGIN))
++				FAIL_PROP(c, dti, node, irq_map_prop,
++					  "Cell %zu is not a phandle(%d)",
++					  cell, phandle);
++			break;
++		}
++
++		provider_node = get_node_by_phandle(root, phandle);
++		if (!provider_node) {
++			FAIL_PROP(c, dti, node, irq_map_prop,
++				  "Could not get phandle(%d) node for (cell %zu)",
++				  phandle, cell);
++			break;
++		}
++
++		cellprop = get_property(provider_node, "#interrupt-cells");
++		if (cellprop) {
++			parent_cellsize = propval_cell(cellprop);
++		} else {
++			FAIL(c, dti, node, "Missing property '#interrupt-cells' in node %s or bad phandle (referred from interrupt-map[%zu])",
++			     provider_node->fullpath, cell);
++			break;
++		}
++
++		cellprop = get_property(provider_node, "#address-cells");
++		if (cellprop)
++			parent_cellsize += propval_cell(cellprop);
++
++		cell += 1 + parent_cellsize;
++	}
+ }
+-WARNING(interrupt_provider, check_interrupt_provider, NULL);
++WARNING(interrupt_map, check_interrupt_map, NULL, &phandle_references, &addr_size_cells, &interrupt_provider);
+ 
+ static void check_interrupts_property(struct check *c,
+ 				      struct dt_info *dti,
+@@ -1584,13 +1681,13 @@ static void check_interrupts_property(st
+ 	struct node *root = dti->dt;
+ 	struct node *irq_node = NULL, *parent = node;
+ 	struct property *irq_prop, *prop = NULL;
+-	int irq_cells, phandle;
++	cell_t irq_cells, phandle;
+ 
+ 	irq_prop = get_property(node, "interrupts");
+ 	if (!irq_prop)
+ 		return;
+ 
+-	if (irq_prop->val.len % sizeof(cell_t))
++	if (!is_multiple_of(irq_prop->val.len, sizeof(cell_t)))
+ 		FAIL_PROP(c, dti, node, irq_prop, "size (%d) is invalid, expected multiple of %zu",
+ 		     irq_prop->val.len, sizeof(cell_t));
+ 
+@@ -1603,7 +1700,7 @@ static void check_interrupts_property(st
+ 		prop = get_property(parent, "interrupt-parent");
+ 		if (prop) {
+ 			phandle = propval_cell(prop);
+-			if ((phandle == 0) || (phandle == -1)) {
++			if (!phandle_is_valid(phandle)) {
+ 				/* Give up if this is an overlay with
+ 				 * external references */
+ 				if (dti->dtsflags & DTSF_PLUGIN)
+@@ -1639,7 +1736,7 @@ static void check_interrupts_property(st
+ 	}
+ 
+ 	irq_cells = propval_cell(prop);
+-	if (irq_prop->val.len % (irq_cells * sizeof(cell_t))) {
++	if (!is_multiple_of(irq_prop->val.len, irq_cells * sizeof(cell_t))) {
+ 		FAIL_PROP(c, dti, node, prop,
+ 			  "size is (%d), expected multiple of %d",
+ 			  irq_prop->val.len, (int)(irq_cells * sizeof(cell_t)));
+@@ -1750,7 +1847,7 @@ WARNING(graph_port, check_graph_port, NU
+ static struct node *get_remote_endpoint(struct check *c, struct dt_info *dti,
+ 					struct node *endpoint)
+ {
+-	int phandle;
++	cell_t phandle;
+ 	struct node *node;
+ 	struct property *prop;
+ 
+@@ -1760,7 +1857,7 @@ static struct node *get_remote_endpoint(
+ 
+ 	phandle = propval_cell(prop);
+ 	/* Give up if this is an overlay with external references */
+-	if (phandle == 0 || phandle == -1)
++	if (!phandle_is_valid(phandle))
+ 		return NULL;
+ 
+ 	node = get_node_by_phandle(dti->dt, phandle);
+@@ -1796,7 +1893,7 @@ WARNING(graph_endpoint, check_graph_endp
+ static struct check *check_table[] = {
+ 	&duplicate_node_names, &duplicate_property_names,
+ 	&node_name_chars, &node_name_format, &property_name_chars,
+-	&name_is_string, &name_properties,
++	&name_is_string, &name_properties, &node_name_vs_property_name,
+ 
+ 	&duplicate_label,
+ 
+@@ -1804,7 +1901,7 @@ static struct check *check_table[] = {
+ 	&phandle_references, &path_references,
+ 	&omit_unused_nodes,
+ 
+-	&address_cells_is_cell, &size_cells_is_cell, &interrupt_cells_is_cell,
++	&address_cells_is_cell, &size_cells_is_cell,
+ 	&device_type_is_string, &model_is_string, &status_is_string,
+ 	&label_is_string,
+ 
+@@ -1839,26 +1936,43 @@ static struct check *check_table[] = {
+ 	&chosen_node_is_root, &chosen_node_bootargs, &chosen_node_stdout_path,
+ 
+ 	&clocks_property,
++	&clocks_is_cell,
+ 	&cooling_device_property,
++	&cooling_device_is_cell,
+ 	&dmas_property,
++	&dmas_is_cell,
+ 	&hwlocks_property,
++	&hwlocks_is_cell,
+ 	&interrupts_extended_property,
++	&interrupts_extended_is_cell,
+ 	&io_channels_property,
++	&io_channels_is_cell,
+ 	&iommus_property,
++	&iommus_is_cell,
+ 	&mboxes_property,
++	&mboxes_is_cell,
+ 	&msi_parent_property,
++	&msi_parent_is_cell,
+ 	&mux_controls_property,
++	&mux_controls_is_cell,
+ 	&phys_property,
++	&phys_is_cell,
+ 	&power_domains_property,
++	&power_domains_is_cell,
+ 	&pwms_property,
++	&pwms_is_cell,
+ 	&resets_property,
++	&resets_is_cell,
+ 	&sound_dai_property,
++	&sound_dai_is_cell,
+ 	&thermal_sensors_property,
++	&thermal_sensors_is_cell,
+ 
+ 	&deprecated_gpio_property,
+ 	&gpios_property,
+ 	&interrupts_property,
+ 	&interrupt_provider,
++	&interrupt_map,
+ 
+ 	&alias_paths,
+ 
+@@ -1882,7 +1996,7 @@ static void enable_warning_error(struct
+ 
+ static void disable_warning_error(struct check *c, bool warn, bool error)
+ {
+-	int i;
++	unsigned int i;
+ 
+ 	/* Lowering level, also lower it for things this is the prereq
+ 	 * for */
+@@ -1903,7 +2017,7 @@ static void disable_warning_error(struct
+ 
+ void parse_checks_option(bool warn, bool error, const char *arg)
+ {
+-	int i;
++	unsigned int i;
+ 	const char *name = arg;
+ 	bool enable = true;
+ 
+@@ -1930,7 +2044,7 @@ void parse_checks_option(bool warn, bool
+ 
+ void process_checks(bool force, struct dt_info *dti)
+ {
+-	int i;
++	unsigned int i;
+ 	int error = 0;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(check_table); i++) {
+--- a/scripts/dtc/dtc-lexer.l
++++ b/scripts/dtc/dtc-lexer.l
+@@ -57,7 +57,7 @@ static void PRINTF(1, 2) lexical_error(c
+ 			push_input_file(name);
+ 		}
+ 
+-<*>^"#"(line)?[ \t]+[0-9]+[ \t]+{STRING}([ \t]+[0-9]+)? {
++<*>^"#"(line)?[ \t]+[0-9]+[ \t]+{STRING}([ \t]+[0-9]+)* {
+ 			char *line, *fnstart, *fnend;
+ 			struct data fn;
+ 			/* skip text before line # */
+--- a/scripts/dtc/dtc.c
++++ b/scripts/dtc/dtc.c
+@@ -12,7 +12,7 @@
+  * Command line options
+  */
+ int quiet;		/* Level of quietness */
+-int reservenum;		/* Number of memory reservation slots */
++unsigned int reservenum;/* Number of memory reservation slots */
+ int minsize;		/* Minimum blob size */
+ int padsize;		/* Additional padding to blob */
+ int alignsize;		/* Additional padding to blob accroding to the alignsize */
+@@ -197,7 +197,7 @@ int main(int argc, char *argv[])
+ 			depname = optarg;
+ 			break;
+ 		case 'R':
+-			reservenum = strtol(optarg, NULL, 0);
++			reservenum = strtoul(optarg, NULL, 0);
+ 			break;
+ 		case 'S':
+ 			minsize = strtol(optarg, NULL, 0);
+@@ -359,8 +359,6 @@ int main(int argc, char *argv[])
+ #endif
+ 	} else if (streq(outform, "dtb")) {
+ 		dt_to_blob(outf, dti, outversion);
+-	} else if (streq(outform, "dtbo")) {
+-		dt_to_blob(outf, dti, outversion);
+ 	} else if (streq(outform, "asm")) {
+ 		dt_to_asm(outf, dti, outversion);
+ 	} else if (streq(outform, "null")) {
+--- a/scripts/dtc/dtc.h
++++ b/scripts/dtc/dtc.h
+@@ -35,7 +35,7 @@
+  * Command line options
+  */
+ extern int quiet;		/* Level of quietness */
+-extern int reservenum;		/* Number of memory reservation slots */
++extern unsigned int reservenum;	/* Number of memory reservation slots */
+ extern int minsize;		/* Minimum blob size */
+ extern int padsize;		/* Additional padding to blob */
+ extern int alignsize;		/* Additional padding to blob accroding to the alignsize */
+@@ -51,6 +51,11 @@ extern int annotate;		/* annotate .dts w
+ 
+ typedef uint32_t cell_t;
+ 
++static inline bool phandle_is_valid(cell_t phandle)
++{
++	return phandle != 0 && phandle != ~0U;
++}
++
+ static inline uint16_t dtb_ld16(const void *p)
+ {
+ 	const uint8_t *bp = (const uint8_t *)p;
+@@ -86,6 +91,16 @@ static inline uint64_t dtb_ld64(const vo
+ #define streq(a, b)	(strcmp((a), (b)) == 0)
+ #define strstarts(s, prefix)	(strncmp((s), (prefix), strlen(prefix)) == 0)
+ #define strprefixeq(a, n, b)	(strlen(b) == (n) && (memcmp(a, b, n) == 0))
++static inline bool strends(const char *str, const char *suffix)
++{
++	unsigned int len, suffix_len;
++
++	len = strlen(str);
++	suffix_len = strlen(suffix);
++	if (len < suffix_len)
++		return false;
++	return streq(str + len - suffix_len, suffix);
++}
+ 
+ #define ALIGN(x, a)	(((x) + (a) - 1) & ~((a) - 1))
+ 
+@@ -101,6 +116,12 @@ enum markertype {
+ 	TYPE_UINT64,
+ 	TYPE_STRING,
+ };
++
++static inline bool is_type_marker(enum markertype type)
++{
++	return type >= TYPE_UINT8;
++}
++
+ extern const char *markername(enum markertype markertype);
+ 
+ struct  marker {
+@@ -125,7 +146,22 @@ struct data {
+ 	for_each_marker(m) \
+ 		if ((m)->type == (t))
+ 
+-size_t type_marker_length(struct marker *m);
++static inline struct marker *next_type_marker(struct marker *m)
++{
++	for_each_marker(m)
++		if (is_type_marker(m->type))
++			break;
++	return m;
++}
++
++static inline size_t type_marker_length(struct marker *m)
++{
++	struct marker *next = next_type_marker(m->next);
++
++	if (next)
++		return next->offset - m->offset;
++	return 0;
++}
+ 
+ void data_free(struct data d);
+ 
+--- a/scripts/dtc/flattree.c
++++ b/scripts/dtc/flattree.c
+@@ -124,7 +124,8 @@ static void asm_emit_cell(void *e, cell_
+ {
+ 	FILE *f = e;
+ 
+-	fprintf(f, "\t.byte 0x%02x; .byte 0x%02x; .byte 0x%02x; .byte 0x%02x\n",
++	fprintf(f, "\t.byte\t0x%02x\n" "\t.byte\t0x%02x\n"
++		"\t.byte\t0x%02x\n" "\t.byte\t0x%02x\n",
+ 		(val >> 24) & 0xff, (val >> 16) & 0xff,
+ 		(val >> 8) & 0xff, val & 0xff);
+ }
+@@ -134,9 +135,9 @@ static void asm_emit_string(void *e, con
+ 	FILE *f = e;
+ 
+ 	if (len != 0)
+-		fprintf(f, "\t.string\t\"%.*s\"\n", len, str);
++		fprintf(f, "\t.asciz\t\"%.*s\"\n", len, str);
+ 	else
+-		fprintf(f, "\t.string\t\"%s\"\n", str);
++		fprintf(f, "\t.asciz\t\"%s\"\n", str);
+ }
+ 
+ static void asm_emit_align(void *e, int a)
+@@ -295,7 +296,7 @@ static struct data flatten_reserve_list(
+ {
+ 	struct reserve_info *re;
+ 	struct data d = empty_data;
+-	int    j;
++	unsigned int j;
+ 
+ 	for (re = reservelist; re; re = re->next) {
+ 		d = data_append_re(d, re->address, re->size);
+@@ -438,7 +439,7 @@ static void dump_stringtable_asm(FILE *f
+ 
+ 	while (p < (strbuf.val + strbuf.len)) {
+ 		len = strlen(p);
+-		fprintf(f, "\t.string \"%s\"\n", p);
++		fprintf(f, "\t.asciz \"%s\"\n", p);
+ 		p += len+1;
+ 	}
+ }
+--- a/scripts/dtc/libfdt/fdt.c
++++ b/scripts/dtc/libfdt/fdt.c
+@@ -90,6 +90,10 @@ int fdt_check_header(const void *fdt)
+ {
+ 	size_t hdrsize;
+ 
++	/* The device tree must be at an 8-byte aligned address */
++	if ((uintptr_t)fdt & 7)
++		return -FDT_ERR_ALIGNMENT;
++
+ 	if (fdt_magic(fdt) != FDT_MAGIC)
+ 		return -FDT_ERR_BADMAGIC;
+ 	if (!can_assume(LATEST)) {
+--- a/scripts/dtc/libfdt/fdt_rw.c
++++ b/scripts/dtc/libfdt/fdt_rw.c
+@@ -349,7 +349,10 @@ int fdt_add_subnode_namelen(void *fdt, i
+ 		return offset;
+ 
+ 	/* Try to place the new node after the parent's properties */
+-	fdt_next_tag(fdt, parentoffset, &nextoffset); /* skip the BEGIN_NODE */
++	tag = fdt_next_tag(fdt, parentoffset, &nextoffset);
++	/* the fdt_subnode_offset_namelen() should ensure this never hits */
++	if (!can_assume(LIBFDT_FLAWLESS) && (tag != FDT_BEGIN_NODE))
++		return -FDT_ERR_INTERNAL;
+ 	do {
+ 		offset = nextoffset;
+ 		tag = fdt_next_tag(fdt, offset, &nextoffset);
+@@ -391,7 +394,9 @@ int fdt_del_node(void *fdt, int nodeoffs
+ }
+ 
+ static void fdt_packblocks_(const char *old, char *new,
+-			    int mem_rsv_size, int struct_size)
++			    int mem_rsv_size,
++			    int struct_size,
++			    int strings_size)
+ {
+ 	int mem_rsv_off, struct_off, strings_off;
+ 
+@@ -406,8 +411,7 @@ static void fdt_packblocks_(const char *
+ 	fdt_set_off_dt_struct(new, struct_off);
+ 	fdt_set_size_dt_struct(new, struct_size);
+ 
+-	memmove(new + strings_off, old + fdt_off_dt_strings(old),
+-		fdt_size_dt_strings(old));
++	memmove(new + strings_off, old + fdt_off_dt_strings(old), strings_size);
+ 	fdt_set_off_dt_strings(new, strings_off);
+ 	fdt_set_size_dt_strings(new, fdt_size_dt_strings(old));
+ }
+@@ -467,7 +471,8 @@ int fdt_open_into(const void *fdt, void
+ 			return -FDT_ERR_NOSPACE;
+ 	}
+ 
+-	fdt_packblocks_(fdt, tmp, mem_rsv_size, struct_size);
++	fdt_packblocks_(fdt, tmp, mem_rsv_size, struct_size,
++			fdt_size_dt_strings(fdt));
+ 	memmove(buf, tmp, newsize);
+ 
+ 	fdt_set_magic(buf, FDT_MAGIC);
+@@ -487,7 +492,8 @@ int fdt_pack(void *fdt)
+ 
+ 	mem_rsv_size = (fdt_num_mem_rsv(fdt)+1)
+ 		* sizeof(struct fdt_reserve_entry);
+-	fdt_packblocks_(fdt, fdt, mem_rsv_size, fdt_size_dt_struct(fdt));
++	fdt_packblocks_(fdt, fdt, mem_rsv_size, fdt_size_dt_struct(fdt),
++			fdt_size_dt_strings(fdt));
+ 	fdt_set_totalsize(fdt, fdt_data_size_(fdt));
+ 
+ 	return 0;
+--- a/scripts/dtc/libfdt/fdt_strerror.c
++++ b/scripts/dtc/libfdt/fdt_strerror.c
+@@ -39,6 +39,7 @@ static struct fdt_errtabent fdt_errtable
+ 	FDT_ERRTABENT(FDT_ERR_BADOVERLAY),
+ 	FDT_ERRTABENT(FDT_ERR_NOPHANDLES),
+ 	FDT_ERRTABENT(FDT_ERR_BADFLAGS),
++	FDT_ERRTABENT(FDT_ERR_ALIGNMENT),
+ };
+ #define FDT_ERRTABSIZE	((int)(sizeof(fdt_errtable) / sizeof(fdt_errtable[0])))
+ 
+--- a/scripts/dtc/libfdt/libfdt.h
++++ b/scripts/dtc/libfdt/libfdt.h
+@@ -131,6 +131,13 @@ uint32_t fdt_next_tag(const void *fdt, i
+  * to work even with unaligned pointers on platforms (such as ARMv5) that don't
+  * like unaligned loads and stores.
+  */
++static inline uint16_t fdt16_ld(const fdt16_t *p)
++{
++	const uint8_t *bp = (const uint8_t *)p;
++
++	return ((uint16_t)bp[0] << 8) | bp[1];
++}
++
+ static inline uint32_t fdt32_ld(const fdt32_t *p)
+ {
+ 	const uint8_t *bp = (const uint8_t *)p;
+--- a/scripts/dtc/livetree.c
++++ b/scripts/dtc/livetree.c
+@@ -526,7 +526,7 @@ struct node *get_node_by_path(struct nod
+ 	p = strchr(path, '/');
+ 
+ 	for_each_child(tree, child) {
+-		if (p && strprefixeq(path, p - path, child->name))
++		if (p && strprefixeq(path, (size_t)(p - path), child->name))
+ 			return get_node_by_path(child, p+1);
+ 		else if (!p && streq(path, child->name))
+ 			return child;
+@@ -559,7 +559,7 @@ struct node *get_node_by_phandle(struct
+ {
+ 	struct node *child, *node;
+ 
+-	if ((phandle == 0) || (phandle == -1)) {
++	if (!phandle_is_valid(phandle)) {
+ 		assert(generate_fixups);
+ 		return NULL;
+ 	}
+@@ -594,7 +594,7 @@ cell_t get_node_phandle(struct node *roo
+ 	static cell_t phandle = 1; /* FIXME: ick, static local */
+ 	struct data d = empty_data;
+ 
+-	if ((node->phandle != 0) && (node->phandle != -1))
++	if (phandle_is_valid(node->phandle))
+ 		return node->phandle;
+ 
+ 	while (get_node_by_phandle(root, phandle))
+--- a/scripts/dtc/treesource.c
++++ b/scripts/dtc/treesource.c
+@@ -124,27 +124,6 @@ static void write_propval_int(FILE *f, c
+ 	}
+ }
+ 
+-static bool has_data_type_information(struct marker *m)
+-{
+-	return m->type >= TYPE_UINT8;
+-}
+-
+-static struct marker *next_type_marker(struct marker *m)
+-{
+-	while (m && !has_data_type_information(m))
+-		m = m->next;
+-	return m;
+-}
+-
+-size_t type_marker_length(struct marker *m)
+-{
+-	struct marker *next = next_type_marker(m->next);
+-
+-	if (next)
+-		return next->offset - m->offset;
+-	return 0;
+-}
+-
+ static const char *delim_start[] = {
+ 	[TYPE_UINT8] = "[",
+ 	[TYPE_UINT16] = "/bits/ 16 <",
+@@ -229,26 +208,39 @@ static void write_propval(FILE *f, struc
+ 		size_t chunk_len = (m->next ? m->next->offset : len) - m->offset;
+ 		size_t data_len = type_marker_length(m) ? : len - m->offset;
+ 		const char *p = &prop->val.val[m->offset];
++		struct marker *m_phandle;
+ 
+-		if (has_data_type_information(m)) {
++		if (is_type_marker(m->type)) {
+ 			emit_type = m->type;
+ 			fprintf(f, " %s", delim_start[emit_type]);
+ 		} else if (m->type == LABEL)
+ 			fprintf(f, " %s:", m->ref);
+-		else if (m->offset)
+-			fputc(' ', f);
+ 
+-		if (emit_type == TYPE_NONE) {
+-			assert(chunk_len == 0);
++		if (emit_type == TYPE_NONE || chunk_len == 0)
+ 			continue;
+-		}
+ 
+ 		switch(emit_type) {
+ 		case TYPE_UINT16:
+ 			write_propval_int(f, p, chunk_len, 2);
+ 			break;
+ 		case TYPE_UINT32:
+-			write_propval_int(f, p, chunk_len, 4);
++			m_phandle = prop->val.markers;
++			for_each_marker_of_type(m_phandle, REF_PHANDLE)
++				if (m->offset == m_phandle->offset)
++					break;
++
++			if (m_phandle) {
++				if (m_phandle->ref[0] == '/')
++					fprintf(f, "&{%s}", m_phandle->ref);
++				else
++					fprintf(f, "&%s", m_phandle->ref);
++				if (chunk_len > 4) {
++					fputc(' ', f);
++					write_propval_int(f, p + 4, chunk_len - 4, 4);
++				}
++			} else {
++				write_propval_int(f, p, chunk_len, 4);
++			}
+ 			break;
+ 		case TYPE_UINT64:
+ 			write_propval_int(f, p, chunk_len, 8);
+--- a/scripts/dtc/util.h
++++ b/scripts/dtc/util.h
+@@ -13,10 +13,10 @@
+  */
+ 
+ #ifdef __GNUC__
+-#ifdef __clang__
+-#define PRINTF(i, j)	__attribute__((format (printf, i, j)))
+-#else
++#if __GNUC__ >= 5 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 4)
+ #define PRINTF(i, j)	__attribute__((format (gnu_printf, i, j)))
++#else
++#define PRINTF(i, j)	__attribute__((format (printf, i, j)))
+ #endif
+ #define NORETURN	__attribute__((noreturn))
+ #else
+--- a/scripts/dtc/version_gen.h
++++ b/scripts/dtc/version_gen.h
+@@ -1 +1 @@
+-#define DTC_VERSION "DTC 1.6.0-g183df9e9"
++#define DTC_VERSION "DTC 1.6.1-g0a3a9d34"
+--- a/scripts/dtc/yamltree.c
++++ b/scripts/dtc/yamltree.c
+@@ -29,11 +29,12 @@ char *yaml_error_name[] = {
+ 		    (emitter)->problem, __func__, __LINE__);		\
+ })
+ 
+-static void yaml_propval_int(yaml_emitter_t *emitter, struct marker *markers, char *data, unsigned int len, int width)
++static void yaml_propval_int(yaml_emitter_t *emitter, struct marker *markers,
++	char *data, unsigned int seq_offset, unsigned int len, int width)
+ {
+ 	yaml_event_t event;
+ 	void *tag;
+-	unsigned int off, start_offset = markers->offset;
++	unsigned int off;
+ 
+ 	switch(width) {
+ 		case 1: tag = "!u8"; break;
+@@ -66,7 +67,7 @@ static void yaml_propval_int(yaml_emitte
+ 			m = markers;
+ 			is_phandle = false;
+ 			for_each_marker_of_type(m, REF_PHANDLE) {
+-				if (m->offset == (start_offset + off)) {
++				if (m->offset == (seq_offset + off)) {
+ 					is_phandle = true;
+ 					break;
+ 				}
+@@ -114,6 +115,7 @@ static void yaml_propval(yaml_emitter_t
+ 	yaml_event_t event;
+ 	unsigned int len = prop->val.len;
+ 	struct marker *m = prop->val.markers;
++	struct marker *markers = prop->val.markers;
+ 
+ 	/* Emit the property name */
+ 	yaml_scalar_event_initialize(&event, NULL,
+@@ -151,19 +153,19 @@ static void yaml_propval(yaml_emitter_t
+ 
+ 		switch(m->type) {
+ 		case TYPE_UINT16:
+-			yaml_propval_int(emitter, m, data, chunk_len, 2);
++			yaml_propval_int(emitter, markers, data, m->offset, chunk_len, 2);
+ 			break;
+ 		case TYPE_UINT32:
+-			yaml_propval_int(emitter, m, data, chunk_len, 4);
++			yaml_propval_int(emitter, markers, data, m->offset, chunk_len, 4);
+ 			break;
+ 		case TYPE_UINT64:
+-			yaml_propval_int(emitter, m, data, chunk_len, 8);
++			yaml_propval_int(emitter, markers, data, m->offset, chunk_len, 8);
+ 			break;
+ 		case TYPE_STRING:
+ 			yaml_propval_string(emitter, data, chunk_len);
+ 			break;
+ 		default:
+-			yaml_propval_int(emitter, m, data, chunk_len, 1);
++			yaml_propval_int(emitter, markers, data, m->offset, chunk_len, 1);
+ 			break;
+ 		}
+ 	}
diff --git a/target/linux/generic/backport-5.15/202-v6.1-kallsyms-support-big-kernel-symbols.patch b/target/linux/generic/backport-5.15/202-v6.1-kallsyms-support-big-kernel-symbols.patch
new file mode 100644
index 00000000000000..786a2d93b50d5e
--- /dev/null
+++ b/target/linux/generic/backport-5.15/202-v6.1-kallsyms-support-big-kernel-symbols.patch
@@ -0,0 +1,128 @@
+From 73bbb94466fd3f8b313eeb0b0467314a262dddb3 Mon Sep 17 00:00:00 2001
+From: Miguel Ojeda <ojeda@kernel.org>
+Date: Mon, 5 Apr 2021 04:58:39 +0200
+Subject: [PATCH] kallsyms: support "big" kernel symbols
+
+Rust symbols can become quite long due to namespacing introduced
+by modules, types, traits, generics, etc.
+
+Increasing to 255 is not enough in some cases, therefore
+introduce longer lengths to the symbol table.
+
+In order to avoid increasing all lengths to 2 bytes (since most
+of them are small, including many Rust ones), use ULEB128 to
+keep smaller symbols in 1 byte, with the rest in 2 bytes.
+
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Co-developed-by: Alex Gaynor <alex.gaynor@gmail.com>
+Signed-off-by: Alex Gaynor <alex.gaynor@gmail.com>
+Co-developed-by: Wedson Almeida Filho <wedsonaf@google.com>
+Signed-off-by: Wedson Almeida Filho <wedsonaf@google.com>
+Co-developed-by: Gary Guo <gary@garyguo.net>
+Signed-off-by: Gary Guo <gary@garyguo.net>
+Co-developed-by: Boqun Feng <boqun.feng@gmail.com>
+Signed-off-by: Boqun Feng <boqun.feng@gmail.com>
+Co-developed-by: Matthew Wilcox <willy@infradead.org>
+Signed-off-by: Matthew Wilcox <willy@infradead.org>
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+---
+ kernel/kallsyms.c  | 26 ++++++++++++++++++++++----
+ scripts/kallsyms.c | 29 ++++++++++++++++++++++++++---
+ 2 files changed, 48 insertions(+), 7 deletions(-)
+
+--- a/kernel/kallsyms.c
++++ b/kernel/kallsyms.c
+@@ -69,12 +69,20 @@ static unsigned int kallsyms_expand_symb
+ 	data = &kallsyms_names[off];
+ 	len = *data;
+ 	data++;
++	off++;
++
++	/* If MSB is 1, it is a "big" symbol, so needs an additional byte. */
++	if ((len & 0x80) != 0) {
++		len = (len & 0x7F) | (*data << 7);
++		data++;
++		off++;
++	}
+ 
+ 	/*
+ 	 * Update the offset to return the offset for the next symbol on
+ 	 * the compressed stream.
+ 	 */
+-	off += len + 1;
++	off += len;
+ 
+ 	/*
+ 	 * For every byte on the compressed symbol data, copy the table
+@@ -127,7 +135,7 @@ static char kallsyms_get_symbol_type(uns
+ static unsigned int get_symbol_offset(unsigned long pos)
+ {
+ 	const u8 *name;
+-	int i;
++	int i, len;
+ 
+ 	/*
+ 	 * Use the closest marker we have. We have markers every 256 positions,
+@@ -141,8 +149,18 @@ static unsigned int get_symbol_offset(un
+ 	 * so we just need to add the len to the current pointer for every
+ 	 * symbol we wish to skip.
+ 	 */
+-	for (i = 0; i < (pos & 0xFF); i++)
+-		name = name + (*name) + 1;
++	for (i = 0; i < (pos & 0xFF); i++) {
++		len = *name;
++
++		/*
++		 * If MSB is 1, it is a "big" symbol, so we need to look into
++		 * the next byte (and skip it, too).
++		 */
++		if ((len & 0x80) != 0)
++			len = ((len & 0x7F) | (name[1] << 7)) + 1;
++
++		name = name + len + 1;
++	}
+ 
+ 	return name - kallsyms_names;
+ }
+--- a/scripts/kallsyms.c
++++ b/scripts/kallsyms.c
+@@ -470,12 +470,35 @@ static void write_src(void)
+ 		if ((i & 0xFF) == 0)
+ 			markers[i >> 8] = off;
+ 
+-		printf("\t.byte 0x%02x", table[i]->len);
++		/* There cannot be any symbol of length zero. */
++		if (table[i]->len == 0) {
++			fprintf(stderr, "kallsyms failure: "
++				"unexpected zero symbol length\n");
++			exit(EXIT_FAILURE);
++		}
++
++		/* Only lengths that fit in up-to-two-byte ULEB128 are supported. */
++		if (table[i]->len > 0x3FFF) {
++			fprintf(stderr, "kallsyms failure: "
++				"unexpected huge symbol length\n");
++			exit(EXIT_FAILURE);
++		}
++
++		/* Encode length with ULEB128. */
++		if (table[i]->len <= 0x7F) {
++			/* Most symbols use a single byte for the length. */
++			printf("\t.byte 0x%02x", table[i]->len);
++			off += table[i]->len + 1;
++		} else {
++			/* "Big" symbols use two bytes. */
++			printf("\t.byte 0x%02x, 0x%02x",
++				(table[i]->len & 0x7F) | 0x80,
++				(table[i]->len >> 7) & 0x7F);
++			off += table[i]->len + 2;
++		}
+ 		for (k = 0; k < table[i]->len; k++)
+ 			printf(", 0x%02x", table[i]->sym[k]);
+ 		printf("\n");
+-
+-		off += table[i]->len + 1;
+ 	}
+ 	printf("\n");
+ 
diff --git a/target/linux/generic/backport-5.15/301-v5.16-soc-qcom-smem-Support-reserved-memory-description.patch b/target/linux/generic/backport-5.15/301-v5.16-soc-qcom-smem-Support-reserved-memory-description.patch
new file mode 100644
index 00000000000000..ee0bf9309ff841
--- /dev/null
+++ b/target/linux/generic/backport-5.15/301-v5.16-soc-qcom-smem-Support-reserved-memory-description.patch
@@ -0,0 +1,166 @@
+From b5af64fceb04dc298c5e69c517b4d83893ff060b Mon Sep 17 00:00:00 2001
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+Date: Thu, 30 Sep 2021 11:21:10 -0700
+Subject: [PATCH 1/1] soc: qcom: smem: Support reserved-memory description
+
+Practically all modern Qualcomm platforms has a single reserved-memory
+region for SMEM. So rather than having to describe SMEM in the form of a
+node with a reference to a reserved-memory node, allow the SMEM device
+to be instantiated directly from the reserved-memory node.
+
+The current means of falling back to dereferencing the "memory-region"
+is kept as a fallback, if it's determined that the SMEM node is a
+reserved-memory node.
+
+The "qcom,smem" compatible is added to the reserved_mem_matches list, to
+allow the reserved-memory device to be probed.
+
+In order to retain the readability of the code, the resolution of
+resources is split from the actual ioremapping.
+
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Acked-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Link: https://lore.kernel.org/r/20210930182111.57353-4-bjorn.andersson@linaro.org
+---
+ drivers/of/platform.c   |  1 +
+ drivers/soc/qcom/smem.c | 57 ++++++++++++++++++++++++++++-------------
+ 2 files changed, 40 insertions(+), 18 deletions(-)
+
+--- a/drivers/of/platform.c
++++ b/drivers/of/platform.c
+@@ -509,6 +509,7 @@ EXPORT_SYMBOL_GPL(of_platform_default_po
+ static const struct of_device_id reserved_mem_matches[] = {
+ 	{ .compatible = "qcom,rmtfs-mem" },
+ 	{ .compatible = "qcom,cmd-db" },
++	{ .compatible = "qcom,smem" },
+ 	{ .compatible = "ramoops" },
+ 	{ .compatible = "nvmem-rmem" },
+ 	{}
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -9,6 +9,7 @@
+ #include <linux/module.h>
+ #include <linux/of.h>
+ #include <linux/of_address.h>
++#include <linux/of_reserved_mem.h>
+ #include <linux/platform_device.h>
+ #include <linux/sizes.h>
+ #include <linux/slab.h>
+@@ -240,7 +241,7 @@ static const u8 SMEM_INFO_MAGIC[] = { 0x
+  * @size:	size of the memory region
+  */
+ struct smem_region {
+-	u32 aux_base;
++	phys_addr_t aux_base;
+ 	void __iomem *virt_base;
+ 	size_t size;
+ };
+@@ -499,7 +500,7 @@ static void *qcom_smem_get_global(struct
+ 	for (i = 0; i < smem->num_regions; i++) {
+ 		region = &smem->regions[i];
+ 
+-		if (region->aux_base == aux_base || !aux_base) {
++		if ((u32)region->aux_base == aux_base || !aux_base) {
+ 			if (size != NULL)
+ 				*size = le32_to_cpu(entry->size);
+ 			return region->virt_base + le32_to_cpu(entry->offset);
+@@ -664,7 +665,7 @@ phys_addr_t qcom_smem_virt_to_phys(void
+ 		if (p < region->virt_base + region->size) {
+ 			u64 offset = p - region->virt_base;
+ 
+-			return (phys_addr_t)region->aux_base + offset;
++			return region->aux_base + offset;
+ 		}
+ 	}
+ 
+@@ -863,12 +864,12 @@ qcom_smem_enumerate_partitions(struct qc
+ 	return 0;
+ }
+ 
+-static int qcom_smem_map_memory(struct qcom_smem *smem, struct device *dev,
+-				const char *name, int i)
++static int qcom_smem_resolve_mem(struct qcom_smem *smem, const char *name,
++				 struct smem_region *region)
+ {
++	struct device *dev = smem->dev;
+ 	struct device_node *np;
+ 	struct resource r;
+-	resource_size_t size;
+ 	int ret;
+ 
+ 	np = of_parse_phandle(dev->of_node, name, 0);
+@@ -881,13 +882,9 @@ static int qcom_smem_map_memory(struct q
+ 	of_node_put(np);
+ 	if (ret)
+ 		return ret;
+-	size = resource_size(&r);
+ 
+-	smem->regions[i].virt_base = devm_ioremap_wc(dev, r.start, size);
+-	if (!smem->regions[i].virt_base)
+-		return -ENOMEM;
+-	smem->regions[i].aux_base = (u32)r.start;
+-	smem->regions[i].size = size;
++	region->aux_base = r.start;
++	region->size = resource_size(&r);
+ 
+ 	return 0;
+ }
+@@ -895,12 +892,14 @@ static int qcom_smem_map_memory(struct q
+ static int qcom_smem_probe(struct platform_device *pdev)
+ {
+ 	struct smem_header *header;
++	struct reserved_mem *rmem;
+ 	struct qcom_smem *smem;
+ 	size_t array_size;
+ 	int num_regions;
+ 	int hwlock_id;
+ 	u32 version;
+ 	int ret;
++	int i;
+ 
+ 	num_regions = 1;
+ 	if (of_find_property(pdev->dev.of_node, "qcom,rpm-msg-ram", NULL))
+@@ -914,13 +913,35 @@ static int qcom_smem_probe(struct platfo
+ 	smem->dev = &pdev->dev;
+ 	smem->num_regions = num_regions;
+ 
+-	ret = qcom_smem_map_memory(smem, &pdev->dev, "memory-region", 0);
+-	if (ret)
+-		return ret;
+-
+-	if (num_regions > 1 && (ret = qcom_smem_map_memory(smem, &pdev->dev,
+-					"qcom,rpm-msg-ram", 1)))
+-		return ret;
++	rmem = of_reserved_mem_lookup(pdev->dev.of_node);
++	if (rmem) {
++		smem->regions[0].aux_base = rmem->base;
++		smem->regions[0].size = rmem->size;
++	} else {
++		/*
++		 * Fall back to the memory-region reference, if we're not a
++		 * reserved-memory node.
++		 */
++		ret = qcom_smem_resolve_mem(smem, "memory-region", &smem->regions[0]);
++		if (ret)
++			return ret;
++	}
++
++	if (num_regions > 1) {
++		ret = qcom_smem_resolve_mem(smem, "qcom,rpm-msg-ram", &smem->regions[1]);
++		if (ret)
++			return ret;
++	}
++
++	for (i = 0; i < num_regions; i++) {
++		smem->regions[i].virt_base = devm_ioremap_wc(&pdev->dev,
++							     smem->regions[i].aux_base,
++							     smem->regions[i].size);
++		if (!smem->regions[i].virt_base) {
++			dev_err(&pdev->dev, "failed to remap %pa\n", &smem->regions[i].aux_base);
++			return -ENOMEM;
++		}
++	}
+ 
+ 	header = smem->regions[0].virt_base;
+ 	if (le32_to_cpu(header->initialized) != 1 ||
diff --git a/target/linux/generic/backport-5.15/302-v5.16-watchdog-bcm63xx_wdt-fix-fallthrough-warning.patch b/target/linux/generic/backport-5.15/302-v5.16-watchdog-bcm63xx_wdt-fix-fallthrough-warning.patch
new file mode 100644
index 00000000000000..84ae5a7fc73b13
--- /dev/null
+++ b/target/linux/generic/backport-5.15/302-v5.16-watchdog-bcm63xx_wdt-fix-fallthrough-warning.patch
@@ -0,0 +1,33 @@
+From ee1a0696934a8b77a6a2098f92832c46d34ec5da Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 27 Oct 2021 14:31:35 +0200
+Subject: [PATCH] watchdog: bcm63xx_wdt: fix fallthrough warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This fixes:
+drivers/watchdog/bcm63xx_wdt.c: In function 'bcm63xx_wdt_ioctl':
+drivers/watchdog/bcm63xx_wdt.c:208:17: warning: this statement may fall through [-Wimplicit-fallthrough=]
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20211027123135.27458-1-zajec5@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+---
+ drivers/watchdog/bcm63xx_wdt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/watchdog/bcm63xx_wdt.c
++++ b/drivers/watchdog/bcm63xx_wdt.c
+@@ -207,6 +207,8 @@ static long bcm63xx_wdt_ioctl(struct fil
+ 
+ 		bcm63xx_wdt_pet();
+ 
++		fallthrough;
++
+ 	case WDIOC_GETTIMEOUT:
+ 		return put_user(wdt_time, p);
+ 
diff --git a/target/linux/generic/backport-5.15/303-v6.2-powerpc-suppress-some-linker-warnings-in-recent-link.patch b/target/linux/generic/backport-5.15/303-v6.2-powerpc-suppress-some-linker-warnings-in-recent-link.patch
new file mode 100644
index 00000000000000..7c1507bba7e8ca
--- /dev/null
+++ b/target/linux/generic/backport-5.15/303-v6.2-powerpc-suppress-some-linker-warnings-in-recent-link.patch
@@ -0,0 +1,63 @@
+From 579aee9fc594af94c242068c011b0233563d4bbf Mon Sep 17 00:00:00 2001
+From: Stephen Rothwell <sfr@canb.auug.org.au>
+Date: Mon, 10 Oct 2022 16:57:21 +1100
+Subject: [PATCH] powerpc: suppress some linker warnings in recent linker
+ versions
+
+This is a follow on from commit
+
+  0d362be5b142 ("Makefile: link with -z noexecstack --no-warn-rwx-segments")
+
+for arch/powerpc/boot to address wanrings like:
+
+  ld: warning: opal-calls.o: missing .note.GNU-stack section implies executable stack
+  ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
+  ld: warning: arch/powerpc/boot/zImage.epapr has a LOAD segment with RWX permissions
+
+This fixes issue https://github.com/linuxppc/issues/issues/417
+
+Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20221010165721.106267e6@canb.auug.org.au
+---
+ arch/powerpc/boot/wrapper | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/arch/powerpc/boot/wrapper
++++ b/arch/powerpc/boot/wrapper
+@@ -213,6 +213,11 @@ ld_version()
+     }'
+ }
+ 
++ld_is_lld()
++{
++	${CROSS}ld -V 2>&1 | grep -q LLD
++}
++
+ # Do not include PT_INTERP segment when linking pie. Non-pie linking
+ # just ignores this option.
+ LD_VERSION=$(${CROSS}ld --version | ld_version)
+@@ -221,6 +226,14 @@ if [ "$LD_VERSION" -ge "$LD_NO_DL_MIN_VE
+ 	nodl="--no-dynamic-linker"
+ fi
+ 
++# suppress some warnings in recent ld versions
++nowarn="-z noexecstack"
++if ! ld_is_lld; then
++	if [ "$LD_VERSION" -ge "$(echo 2.39 | ld_version)" ]; then
++		nowarn="$nowarn --no-warn-rwx-segments"
++	fi
++fi
++
+ platformo=$object/"$platform".o
+ lds=$object/zImage.lds
+ ext=strip
+@@ -502,7 +515,7 @@ if [ "$platform" != "miboot" ]; then
+         text_start="-Ttext $link_address"
+     fi
+ #link everything
+-    ${CROSS}ld -m $format -T $lds $text_start $pie $nodl $rodynamic $notext -o "$ofile" $map \
++    ${CROSS}ld -m $format -T $lds $text_start $pie $nodl $nowarn $rodynamic $notext -o "$ofile" $map \
+ 	$platformo $tmp $object/wrapper.a
+     rm $tmp
+ fi
diff --git a/target/linux/generic/backport-5.15/330-v5.16-01-MIPS-kernel-proc-add-CPU-option-reporting.patch b/target/linux/generic/backport-5.15/330-v5.16-01-MIPS-kernel-proc-add-CPU-option-reporting.patch
new file mode 100644
index 00000000000000..c66a3f11b4b489
--- /dev/null
+++ b/target/linux/generic/backport-5.15/330-v5.16-01-MIPS-kernel-proc-add-CPU-option-reporting.patch
@@ -0,0 +1,162 @@
+From 626bfa03729959ea9917181fb3d8ffaa1594d02a Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Wed, 13 Oct 2021 22:40:18 -0700
+Subject: [PATCH 1/1] MIPS: kernel: proc: add CPU option reporting
+
+Many MIPS CPUs have optional CPU features which are not activated for
+all CPU cores. Print the CPU options, which are implemented in the core,
+in /proc/cpuinfo. This makes it possible to see which features are
+supported and which are not supported. This should cover all standard
+MIPS extensions. Before, it only printed information about the main MIPS
+ASEs.
+
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+
+Changes from original patch[0]:
+- Remove cpu_has_6k_cache and cpu_has_8k_cache due to commit 6ce91ba8589a
+  ("MIPS: Remove cpu_has_6k_cache and cpu_has_8k_cache in cpu_cache_init()")
+- Add new options: mac2008_only, ftlbparex, gsexcex, mmid, mm_sysad,
+  mm_full
+- Use seq_puts instead of seq_printf as suggested by checkpatch
+- Minor commit message reword
+
+[0]: https://lore.kernel.org/linux-mips/20181223225224.23042-1-hauke@hauke-m.de/
+
+Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+---
+ arch/mips/kernel/proc.c | 122 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 122 insertions(+)
+
+--- a/arch/mips/kernel/proc.c
++++ b/arch/mips/kernel/proc.c
+@@ -138,6 +138,128 @@ static int show_cpuinfo(struct seq_file
+ 		seq_printf(m, "micromips kernel\t: %s\n",
+ 		      (read_c0_config3() & MIPS_CONF3_ISA_OE) ?  "yes" : "no");
+ 	}
++
++	seq_puts(m, "Options implemented\t:");
++	if (cpu_has_tlb)
++		seq_puts(m, " tlb");
++	if (cpu_has_ftlb)
++		seq_puts(m, " ftlb");
++	if (cpu_has_tlbinv)
++		seq_puts(m, " tlbinv");
++	if (cpu_has_segments)
++		seq_puts(m, " segments");
++	if (cpu_has_rixiex)
++		seq_puts(m, " rixiex");
++	if (cpu_has_ldpte)
++		seq_puts(m, " ldpte");
++	if (cpu_has_maar)
++		seq_puts(m, " maar");
++	if (cpu_has_rw_llb)
++		seq_puts(m, " rw_llb");
++	if (cpu_has_4kex)
++		seq_puts(m, " 4kex");
++	if (cpu_has_3k_cache)
++		seq_puts(m, " 3k_cache");
++	if (cpu_has_4k_cache)
++		seq_puts(m, " 4k_cache");
++	if (cpu_has_tx39_cache)
++		seq_puts(m, " tx39_cache");
++	if (cpu_has_octeon_cache)
++		seq_puts(m, " octeon_cache");
++	if (cpu_has_fpu)
++		seq_puts(m, " fpu");
++	if (cpu_has_32fpr)
++		seq_puts(m, " 32fpr");
++	if (cpu_has_cache_cdex_p)
++		seq_puts(m, " cache_cdex_p");
++	if (cpu_has_cache_cdex_s)
++		seq_puts(m, " cache_cdex_s");
++	if (cpu_has_prefetch)
++		seq_puts(m, " prefetch");
++	if (cpu_has_mcheck)
++		seq_puts(m, " mcheck");
++	if (cpu_has_ejtag)
++		seq_puts(m, " ejtag");
++	if (cpu_has_llsc)
++		seq_puts(m, " llsc");
++	if (cpu_has_guestctl0ext)
++		seq_puts(m, " guestctl0ext");
++	if (cpu_has_guestctl1)
++		seq_puts(m, " guestctl1");
++	if (cpu_has_guestctl2)
++		seq_puts(m, " guestctl2");
++	if (cpu_has_guestid)
++		seq_puts(m, " guestid");
++	if (cpu_has_drg)
++		seq_puts(m, " drg");
++	if (cpu_has_rixi)
++		seq_puts(m, " rixi");
++	if (cpu_has_lpa)
++		seq_puts(m, " lpa");
++	if (cpu_has_mvh)
++		seq_puts(m, " mvh");
++	if (cpu_has_vtag_icache)
++		seq_puts(m, " vtag_icache");
++	if (cpu_has_dc_aliases)
++		seq_puts(m, " dc_aliases");
++	if (cpu_has_ic_fills_f_dc)
++		seq_puts(m, " ic_fills_f_dc");
++	if (cpu_has_pindexed_dcache)
++		seq_puts(m, " pindexed_dcache");
++	if (cpu_has_userlocal)
++		seq_puts(m, " userlocal");
++	if (cpu_has_nofpuex)
++		seq_puts(m, " nofpuex");
++	if (cpu_has_vint)
++		seq_puts(m, " vint");
++	if (cpu_has_veic)
++		seq_puts(m, " veic");
++	if (cpu_has_inclusive_pcaches)
++		seq_puts(m, " inclusive_pcaches");
++	if (cpu_has_perf_cntr_intr_bit)
++		seq_puts(m, " perf_cntr_intr_bit");
++	if (cpu_has_ufr)
++		seq_puts(m, " ufr");
++	if (cpu_has_fre)
++		seq_puts(m, " fre");
++	if (cpu_has_cdmm)
++		seq_puts(m, " cdmm");
++	if (cpu_has_small_pages)
++		seq_puts(m, " small_pages");
++	if (cpu_has_nan_legacy)
++		seq_puts(m, " nan_legacy");
++	if (cpu_has_nan_2008)
++		seq_puts(m, " nan_2008");
++	if (cpu_has_ebase_wg)
++		seq_puts(m, " ebase_wg");
++	if (cpu_has_badinstr)
++		seq_puts(m, " badinstr");
++	if (cpu_has_badinstrp)
++		seq_puts(m, " badinstrp");
++	if (cpu_has_contextconfig)
++		seq_puts(m, " contextconfig");
++	if (cpu_has_perf)
++		seq_puts(m, " perf");
++	if (cpu_has_mac2008_only)
++		seq_puts(m, " mac2008_only");
++	if (cpu_has_ftlbparex)
++		seq_puts(m, " ftlbparex");
++	if (cpu_has_gsexcex)
++		seq_puts(m, " gsexcex");
++	if (cpu_has_shared_ftlb_ram)
++		seq_puts(m, " shared_ftlb_ram");
++	if (cpu_has_shared_ftlb_entries)
++		seq_puts(m, " shared_ftlb_entries");
++	if (cpu_has_mipsmt_pertccounters)
++		seq_puts(m, " mipsmt_pertccounters");
++	if (cpu_has_mmid)
++		seq_puts(m, " mmid");
++	if (cpu_has_mm_sysad)
++		seq_puts(m, " mm_sysad");
++	if (cpu_has_mm_full)
++		seq_puts(m, " mm_full");
++	seq_puts(m, "\n");
++
+ 	seq_printf(m, "shadow register sets\t: %d\n",
+ 		      cpu_data[n].srsets);
+ 	seq_printf(m, "kscratch registers\t: %d\n",
diff --git a/target/linux/generic/backport-5.15/330-v5.16-02-MIPS-Fix-using-smp_processor_id-in-preemptible-in-sh.patch b/target/linux/generic/backport-5.15/330-v5.16-02-MIPS-Fix-using-smp_processor_id-in-preemptible-in-sh.patch
new file mode 100644
index 00000000000000..6caf7d06d4ec8a
--- /dev/null
+++ b/target/linux/generic/backport-5.15/330-v5.16-02-MIPS-Fix-using-smp_processor_id-in-preemptible-in-sh.patch
@@ -0,0 +1,62 @@
+From 1cab5bd69eb1f995ced2d7576cb15f8a8941fd85 Mon Sep 17 00:00:00 2001
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+Date: Thu, 25 Nov 2021 19:39:32 +0800
+Subject: [PATCH 1/1] MIPS: Fix using smp_processor_id() in preemptible in
+ show_cpuinfo()
+
+There exists the following issue under DEBUG_PREEMPT:
+
+ BUG: using smp_processor_id() in preemptible [00000000] code: systemd/1
+ caller is show_cpuinfo+0x460/0xea0
+ ...
+ Call Trace:
+ [<ffffffff8020f0dc>] show_stack+0x94/0x128
+ [<ffffffff80e6cab4>] dump_stack_lvl+0x94/0xd8
+ [<ffffffff80e74c5c>] check_preemption_disabled+0x104/0x110
+ [<ffffffff802209c8>] show_cpuinfo+0x460/0xea0
+ [<ffffffff80539d54>] seq_read_iter+0xfc/0x4f8
+ [<ffffffff804fcc10>] new_sync_read+0x110/0x1b8
+ [<ffffffff804ff57c>] vfs_read+0x1b4/0x1d0
+ [<ffffffff804ffb18>] ksys_read+0xd0/0x110
+ [<ffffffff8021c090>] syscall_common+0x34/0x58
+
+We can see the following call trace:
+ show_cpuinfo()
+   cpu_has_fpu
+     current_cpu_data
+       smp_processor_id()
+
+ $ addr2line -f -e vmlinux 0xffffffff802209c8
+ show_cpuinfo
+ arch/mips/kernel/proc.c:188
+
+ $ head -188 arch/mips/kernel/proc.c | tail -1
+	 if (cpu_has_fpu)
+
+ arch/mips/include/asm/cpu-features.h
+ #  define cpu_has_fpu		(current_cpu_data.options & MIPS_CPU_FPU)
+
+ arch/mips/include/asm/cpu-info.h
+ #define current_cpu_data cpu_data[smp_processor_id()]
+
+Based on the above analysis, fix the issue by using raw_cpu_has_fpu
+which calls raw_smp_processor_id() in show_cpuinfo().
+
+Fixes: 626bfa037299 ("MIPS: kernel: proc: add CPU option reporting")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+---
+ arch/mips/kernel/proc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/mips/kernel/proc.c
++++ b/arch/mips/kernel/proc.c
+@@ -166,7 +166,7 @@ static int show_cpuinfo(struct seq_file
+ 		seq_puts(m, " tx39_cache");
+ 	if (cpu_has_octeon_cache)
+ 		seq_puts(m, " octeon_cache");
+-	if (cpu_has_fpu)
++	if (raw_cpu_has_fpu)
+ 		seq_puts(m, " fpu");
+ 	if (cpu_has_32fpr)
+ 		seq_puts(m, " 32fpr");
diff --git a/target/linux/generic/backport-5.15/331-v5.19-mtd-spinand-Add-support-for-XTX-XT26G0xA.patch b/target/linux/generic/backport-5.15/331-v5.19-mtd-spinand-Add-support-for-XTX-XT26G0xA.patch
new file mode 100644
index 00000000000000..541d247542b678
--- /dev/null
+++ b/target/linux/generic/backport-5.15/331-v5.19-mtd-spinand-Add-support-for-XTX-XT26G0xA.patch
@@ -0,0 +1,186 @@
+From f4c5c7f9d2e5ab005d57826b740b694b042a737c Mon Sep 17 00:00:00 2001
+From: Felix Matouschek <felix@matouschek.org>
+Date: Mon, 18 Apr 2022 15:28:03 +0200
+Subject: [PATCH 1/1] mtd: spinand: Add support for XTX XT26G0xA
+
+Add support for XTX Technology XT26G01AXXXXX, XTX26G02AXXXXX and
+XTX26G04AXXXXX SPI NAND.
+
+These are 3V, 1G/2G/4Gbit serial SLC NAND flash devices with on-die ECC
+(8bit strength per 512bytes).
+
+Tested on Teltonika RUTX10 flashed with OpenWrt.
+
+Links:
+  - http://www.xtxtech.com/download/?AId=225
+  - https://datasheet.lcsc.com/szlcsc/2005251034_XTX-XT26G01AWSEGA_C558841.pdf
+Signed-off-by: Felix Matouschek <felix@matouschek.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220418132803.664103-1-felix@matouschek.org
+---
+ drivers/mtd/nand/spi/Makefile |   2 +-
+ drivers/mtd/nand/spi/core.c   |   1 +
+ drivers/mtd/nand/spi/xtx.c    | 129 ++++++++++++++++++++++++++++++++++
+ include/linux/mtd/spinand.h   |   1 +
+ 4 files changed, 132 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/mtd/nand/spi/xtx.c
+
+--- a/drivers/mtd/nand/spi/Makefile
++++ b/drivers/mtd/nand/spi/Makefile
+@@ -1,3 +1,3 @@
+ # SPDX-License-Identifier: GPL-2.0
+-spinand-objs := core.o gigadevice.o macronix.o micron.o paragon.o toshiba.o winbond.o
++spinand-objs := core.o gigadevice.o macronix.o micron.o paragon.o toshiba.o winbond.o xtx.o
+ obj-$(CONFIG_MTD_SPI_NAND) += spinand.o
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -902,6 +902,7 @@ static const struct spinand_manufacturer
+ 	&paragon_spinand_manufacturer,
+ 	&toshiba_spinand_manufacturer,
+ 	&winbond_spinand_manufacturer,
++	&xtx_spinand_manufacturer,
+ };
+ 
+ static int spinand_manufacturer_match(struct spinand_device *spinand,
+--- /dev/null
++++ b/drivers/mtd/nand/spi/xtx.c
+@@ -0,0 +1,129 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Author:
++ * Felix Matouschek <felix@matouschek.org>
++ */
++
++#include <linux/device.h>
++#include <linux/kernel.h>
++#include <linux/mtd/spinand.h>
++
++#define SPINAND_MFR_XTX	0x0B
++
++#define XT26G0XA_STATUS_ECC_MASK	GENMASK(5, 2)
++#define XT26G0XA_STATUS_ECC_NO_DETECTED	(0 << 2)
++#define XT26G0XA_STATUS_ECC_8_CORRECTED	(3 << 4)
++#define XT26G0XA_STATUS_ECC_UNCOR_ERROR	(2 << 4)
++
++static SPINAND_OP_VARIANTS(read_cache_variants,
++		SPINAND_PAGE_READ_FROM_CACHE_QUADIO_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_X4_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_DUALIO_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_X2_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_OP(true, 0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_OP(false, 0, 1, NULL, 0));
++
++static SPINAND_OP_VARIANTS(write_cache_variants,
++		SPINAND_PROG_LOAD_X4(true, 0, NULL, 0),
++		SPINAND_PROG_LOAD(true, 0, NULL, 0));
++
++static SPINAND_OP_VARIANTS(update_cache_variants,
++		SPINAND_PROG_LOAD_X4(false, 0, NULL, 0),
++		SPINAND_PROG_LOAD(false, 0, NULL, 0));
++
++static int xt26g0xa_ooblayout_ecc(struct mtd_info *mtd, int section,
++				   struct mtd_oob_region *region)
++{
++	if (section)
++		return -ERANGE;
++
++	region->offset = 48;
++	region->length = 16;
++
++	return 0;
++}
++
++static int xt26g0xa_ooblayout_free(struct mtd_info *mtd, int section,
++				   struct mtd_oob_region *region)
++{
++	if (section)
++		return -ERANGE;
++
++	region->offset = 1;
++	region->length = 47;
++
++	return 0;
++}
++
++static const struct mtd_ooblayout_ops xt26g0xa_ooblayout = {
++	.ecc = xt26g0xa_ooblayout_ecc,
++	.free = xt26g0xa_ooblayout_free,
++};
++
++static int xt26g0xa_ecc_get_status(struct spinand_device *spinand,
++					 u8 status)
++{
++	status = status & XT26G0XA_STATUS_ECC_MASK;
++
++	switch (status) {
++	case XT26G0XA_STATUS_ECC_NO_DETECTED:
++		return 0;
++	case XT26G0XA_STATUS_ECC_8_CORRECTED:
++		return 8;
++	case XT26G0XA_STATUS_ECC_UNCOR_ERROR:
++		return -EBADMSG;
++	default:
++		break;
++	}
++
++	/* At this point values greater than (2 << 4) are invalid  */
++	if (status > XT26G0XA_STATUS_ECC_UNCOR_ERROR)
++		return -EINVAL;
++
++	/* (1 << 2) through (7 << 2) are 1-7 corrected errors */
++	return status >> 2;
++}
++
++static const struct spinand_info xtx_spinand_table[] = {
++	SPINAND_INFO("XT26G01A",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_ADDR, 0xE1),
++		     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&xt26g0xa_ooblayout,
++				     xt26g0xa_ecc_get_status)),
++	SPINAND_INFO("XT26G02A",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_ADDR, 0xE2),
++		     NAND_MEMORG(1, 2048, 64, 64, 2048, 40, 1, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&xt26g0xa_ooblayout,
++				     xt26g0xa_ecc_get_status)),
++	SPINAND_INFO("XT26G04A",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_ADDR, 0xE3),
++		     NAND_MEMORG(1, 2048, 64, 128, 2048, 40, 1, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&xt26g0xa_ooblayout,
++				     xt26g0xa_ecc_get_status)),
++};
++
++static const struct spinand_manufacturer_ops xtx_spinand_manuf_ops = {
++};
++
++const struct spinand_manufacturer xtx_spinand_manufacturer = {
++	.id = SPINAND_MFR_XTX,
++	.name = "XTX",
++	.chips = xtx_spinand_table,
++	.nchips = ARRAY_SIZE(xtx_spinand_table),
++	.ops = &xtx_spinand_manuf_ops,
++};
+--- a/include/linux/mtd/spinand.h
++++ b/include/linux/mtd/spinand.h
+@@ -266,6 +266,7 @@ extern const struct spinand_manufacturer
+ extern const struct spinand_manufacturer paragon_spinand_manufacturer;
+ extern const struct spinand_manufacturer toshiba_spinand_manufacturer;
+ extern const struct spinand_manufacturer winbond_spinand_manufacturer;
++extern const struct spinand_manufacturer xtx_spinand_manufacturer;
+ 
+ /**
+  * struct spinand_op_variants - SPI NAND operation variants
diff --git a/target/linux/generic/backport-5.15/344-v5.18-01-phy-marvell-phy-mvebu-a3700-comphy-Remove-port-from-.patch b/target/linux/generic/backport-5.15/344-v5.18-01-phy-marvell-phy-mvebu-a3700-comphy-Remove-port-from-.patch
new file mode 100644
index 00000000000000..d6c4b4fd1ee2fc
--- /dev/null
+++ b/target/linux/generic/backport-5.15/344-v5.18-01-phy-marvell-phy-mvebu-a3700-comphy-Remove-port-from-.patch
@@ -0,0 +1,219 @@
+From 4bf18d5a2dd02db8c5b16a2cfae513510506df5b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
+Date: Thu, 3 Feb 2022 22:44:40 +0100
+Subject: [PATCH 1/2] phy: marvell: phy-mvebu-a3700-comphy: Remove port from
+ driver configuration
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Port number is encoded into argument for SMC call. It is zero for SATA,
+PCIe and also both USB 3.0 PHYs. It is non-zero only for Ethernet PHY
+(incorrectly called SGMII) on lane 0. Ethernet PHY on lane 1 also uses zero
+port number.
+
+So construct "port" bits for SMC call argument can be constructed directly
+from PHY type and lane number.
+
+Change driver code to always pass zero port number for non-ethernet PHYs
+and for ethernet PHYs determinate port number from lane number. This
+simplifies the driver.
+
+As port number from DT PHY configuration is not used anymore, remove whole
+driver code which parses it. This also simplifies the driver.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/r/20220203214444.1508-2-kabel@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+---
+ drivers/phy/marvell/phy-mvebu-a3700-comphy.c | 62 +++++++++-----------
+ 1 file changed, 29 insertions(+), 33 deletions(-)
+
+--- a/drivers/phy/marvell/phy-mvebu-a3700-comphy.c
++++ b/drivers/phy/marvell/phy-mvebu-a3700-comphy.c
+@@ -20,7 +20,6 @@
+ #include <linux/platform_device.h>
+ 
+ #define MVEBU_A3700_COMPHY_LANES		3
+-#define MVEBU_A3700_COMPHY_PORTS		2
+ 
+ /* COMPHY Fast SMC function identifiers */
+ #define COMPHY_SIP_POWER_ON			0x82000001
+@@ -45,51 +44,47 @@
+ #define COMPHY_FW_NET(mode, idx, speed)		(COMPHY_FW_MODE(mode) | \
+ 						 ((idx) << 8) |	\
+ 						 ((speed) << 2))
+-#define COMPHY_FW_PCIE(mode, idx, speed, width)	(COMPHY_FW_NET(mode, idx, speed) | \
++#define COMPHY_FW_PCIE(mode, speed, width)	(COMPHY_FW_NET(mode, 0, speed) | \
+ 						 ((width) << 18))
+ 
+ struct mvebu_a3700_comphy_conf {
+ 	unsigned int lane;
+ 	enum phy_mode mode;
+ 	int submode;
+-	unsigned int port;
+ 	u32 fw_mode;
+ };
+ 
+-#define MVEBU_A3700_COMPHY_CONF(_lane, _mode, _smode, _port, _fw)	\
++#define MVEBU_A3700_COMPHY_CONF(_lane, _mode, _smode, _fw)		\
+ 	{								\
+ 		.lane = _lane,						\
+ 		.mode = _mode,						\
+ 		.submode = _smode,					\
+-		.port = _port,						\
+ 		.fw_mode = _fw,						\
+ 	}
+ 
+-#define MVEBU_A3700_COMPHY_CONF_GEN(_lane, _mode, _port, _fw) \
+-	MVEBU_A3700_COMPHY_CONF(_lane, _mode, PHY_INTERFACE_MODE_NA, _port, _fw)
++#define MVEBU_A3700_COMPHY_CONF_GEN(_lane, _mode, _fw) \
++	MVEBU_A3700_COMPHY_CONF(_lane, _mode, PHY_INTERFACE_MODE_NA, _fw)
+ 
+-#define MVEBU_A3700_COMPHY_CONF_ETH(_lane, _smode, _port, _fw) \
+-	MVEBU_A3700_COMPHY_CONF(_lane, PHY_MODE_ETHERNET, _smode, _port, _fw)
++#define MVEBU_A3700_COMPHY_CONF_ETH(_lane, _smode, _fw) \
++	MVEBU_A3700_COMPHY_CONF(_lane, PHY_MODE_ETHERNET, _smode, _fw)
+ 
+ static const struct mvebu_a3700_comphy_conf mvebu_a3700_comphy_modes[] = {
+ 	/* lane 0 */
+-	MVEBU_A3700_COMPHY_CONF_GEN(0, PHY_MODE_USB_HOST_SS, 0,
++	MVEBU_A3700_COMPHY_CONF_GEN(0, PHY_MODE_USB_HOST_SS,
+ 				    COMPHY_FW_MODE_USB3H),
+-	MVEBU_A3700_COMPHY_CONF_ETH(0, PHY_INTERFACE_MODE_SGMII, 1,
++	MVEBU_A3700_COMPHY_CONF_ETH(0, PHY_INTERFACE_MODE_SGMII,
+ 				    COMPHY_FW_MODE_SGMII),
+-	MVEBU_A3700_COMPHY_CONF_ETH(0, PHY_INTERFACE_MODE_2500BASEX, 1,
++	MVEBU_A3700_COMPHY_CONF_ETH(0, PHY_INTERFACE_MODE_2500BASEX,
+ 				    COMPHY_FW_MODE_2500BASEX),
+ 	/* lane 1 */
+-	MVEBU_A3700_COMPHY_CONF_GEN(1, PHY_MODE_PCIE, 0,
+-				    COMPHY_FW_MODE_PCIE),
+-	MVEBU_A3700_COMPHY_CONF_ETH(1, PHY_INTERFACE_MODE_SGMII, 0,
++	MVEBU_A3700_COMPHY_CONF_GEN(1, PHY_MODE_PCIE, COMPHY_FW_MODE_PCIE),
++	MVEBU_A3700_COMPHY_CONF_ETH(1, PHY_INTERFACE_MODE_SGMII,
+ 				    COMPHY_FW_MODE_SGMII),
+-	MVEBU_A3700_COMPHY_CONF_ETH(1, PHY_INTERFACE_MODE_2500BASEX, 0,
++	MVEBU_A3700_COMPHY_CONF_ETH(1, PHY_INTERFACE_MODE_2500BASEX,
+ 				    COMPHY_FW_MODE_2500BASEX),
+ 	/* lane 2 */
+-	MVEBU_A3700_COMPHY_CONF_GEN(2, PHY_MODE_SATA, 0,
+-				    COMPHY_FW_MODE_SATA),
+-	MVEBU_A3700_COMPHY_CONF_GEN(2, PHY_MODE_USB_HOST_SS, 0,
++	MVEBU_A3700_COMPHY_CONF_GEN(2, PHY_MODE_SATA, COMPHY_FW_MODE_SATA),
++	MVEBU_A3700_COMPHY_CONF_GEN(2, PHY_MODE_USB_HOST_SS,
+ 				    COMPHY_FW_MODE_USB3H),
+ };
+ 
+@@ -98,7 +93,6 @@ struct mvebu_a3700_comphy_lane {
+ 	unsigned int id;
+ 	enum phy_mode mode;
+ 	int submode;
+-	int port;
+ };
+ 
+ static int mvebu_a3700_comphy_smc(unsigned long function, unsigned long lane,
+@@ -120,7 +114,7 @@ static int mvebu_a3700_comphy_smc(unsign
+ 	}
+ }
+ 
+-static int mvebu_a3700_comphy_get_fw_mode(int lane, int port,
++static int mvebu_a3700_comphy_get_fw_mode(int lane,
+ 					  enum phy_mode mode,
+ 					  int submode)
+ {
+@@ -132,7 +126,6 @@ static int mvebu_a3700_comphy_get_fw_mod
+ 
+ 	for (i = 0; i < n; i++) {
+ 		if (mvebu_a3700_comphy_modes[i].lane == lane &&
+-		    mvebu_a3700_comphy_modes[i].port == port &&
+ 		    mvebu_a3700_comphy_modes[i].mode == mode &&
+ 		    mvebu_a3700_comphy_modes[i].submode == submode)
+ 			break;
+@@ -153,7 +146,7 @@ static int mvebu_a3700_comphy_set_mode(s
+ 	if (submode == PHY_INTERFACE_MODE_1000BASEX)
+ 		submode = PHY_INTERFACE_MODE_SGMII;
+ 
+-	fw_mode = mvebu_a3700_comphy_get_fw_mode(lane->id, lane->port, mode,
++	fw_mode = mvebu_a3700_comphy_get_fw_mode(lane->id, mode,
+ 						 submode);
+ 	if (fw_mode < 0) {
+ 		dev_err(lane->dev, "invalid COMPHY mode\n");
+@@ -172,9 +165,10 @@ static int mvebu_a3700_comphy_power_on(s
+ 	struct mvebu_a3700_comphy_lane *lane = phy_get_drvdata(phy);
+ 	u32 fw_param;
+ 	int fw_mode;
++	int fw_port;
+ 	int ret;
+ 
+-	fw_mode = mvebu_a3700_comphy_get_fw_mode(lane->id, lane->port,
++	fw_mode = mvebu_a3700_comphy_get_fw_mode(lane->id,
+ 						 lane->mode, lane->submode);
+ 	if (fw_mode < 0) {
+ 		dev_err(lane->dev, "invalid COMPHY mode\n");
+@@ -191,17 +185,18 @@ static int mvebu_a3700_comphy_power_on(s
+ 		fw_param = COMPHY_FW_MODE(fw_mode);
+ 		break;
+ 	case PHY_MODE_ETHERNET:
++		fw_port = (lane->id == 0) ? 1 : 0;
+ 		switch (lane->submode) {
+ 		case PHY_INTERFACE_MODE_SGMII:
+ 			dev_dbg(lane->dev, "set lane %d to SGMII mode\n",
+ 				lane->id);
+-			fw_param = COMPHY_FW_NET(fw_mode, lane->port,
++			fw_param = COMPHY_FW_NET(fw_mode, fw_port,
+ 						 COMPHY_FW_SPEED_1_25G);
+ 			break;
+ 		case PHY_INTERFACE_MODE_2500BASEX:
+ 			dev_dbg(lane->dev, "set lane %d to 2500BASEX mode\n",
+ 				lane->id);
+-			fw_param = COMPHY_FW_NET(fw_mode, lane->port,
++			fw_param = COMPHY_FW_NET(fw_mode, fw_port,
+ 						 COMPHY_FW_SPEED_3_125G);
+ 			break;
+ 		default:
+@@ -212,8 +207,7 @@ static int mvebu_a3700_comphy_power_on(s
+ 		break;
+ 	case PHY_MODE_PCIE:
+ 		dev_dbg(lane->dev, "set lane %d to PCIe mode\n", lane->id);
+-		fw_param = COMPHY_FW_PCIE(fw_mode, lane->port,
+-					  COMPHY_FW_SPEED_5G,
++		fw_param = COMPHY_FW_PCIE(fw_mode, COMPHY_FW_SPEED_5G,
+ 					  phy->attrs.bus_width);
+ 		break;
+ 	default:
+@@ -247,17 +241,20 @@ static struct phy *mvebu_a3700_comphy_xl
+ 					    struct of_phandle_args *args)
+ {
+ 	struct mvebu_a3700_comphy_lane *lane;
++	unsigned int port;
+ 	struct phy *phy;
+ 
+-	if (WARN_ON(args->args[0] >= MVEBU_A3700_COMPHY_PORTS))
+-		return ERR_PTR(-EINVAL);
+-
+ 	phy = of_phy_simple_xlate(dev, args);
+ 	if (IS_ERR(phy))
+ 		return phy;
+ 
+ 	lane = phy_get_drvdata(phy);
+-	lane->port = args->args[0];
++
++	port = args->args[0];
++	if (port != 0 && (port != 1 || lane->id != 0)) {
++		dev_err(lane->dev, "invalid port number %u\n", port);
++		return ERR_PTR(-EINVAL);
++	}
+ 
+ 	return phy;
+ }
+@@ -302,7 +299,6 @@ static int mvebu_a3700_comphy_probe(stru
+ 		lane->mode = PHY_MODE_INVALID;
+ 		lane->submode = PHY_INTERFACE_MODE_NA;
+ 		lane->id = lane_id;
+-		lane->port = -1;
+ 		phy_set_drvdata(phy, lane);
+ 	}
+ 
diff --git a/target/linux/generic/backport-5.15/344-v5.18-02-phy-marvell-phy-mvebu-a3700-comphy-Add-native-kernel.patch b/target/linux/generic/backport-5.15/344-v5.18-02-phy-marvell-phy-mvebu-a3700-comphy-Add-native-kernel.patch
new file mode 100644
index 00000000000000..4593d14bfe6aef
--- /dev/null
+++ b/target/linux/generic/backport-5.15/344-v5.18-02-phy-marvell-phy-mvebu-a3700-comphy-Add-native-kernel.patch
@@ -0,0 +1,1552 @@
+From 934337080c6c59b75db76b180b509f218640ad48 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
+Date: Thu, 3 Feb 2022 22:44:41 +0100
+Subject: [PATCH 2/2] phy: marvell: phy-mvebu-a3700-comphy: Add native kernel
+ implementation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Remove old RPC implementation and add a new native kernel implementation.
+
+The old implementation uses ARM SMC API to issue RPC calls to ARM Trusted
+Firmware which provides real implementation of PHY configuration.
+
+But older versions of ARM Trusted Firmware do not provide this PHY
+configuration functionality, simply returning: operation not supported; or
+worse, some versions provide the configuration functionality incorrectly.
+
+For example the firmware shipped in ESPRESSObin board has this older
+version of ARM Trusted Firmware and therefore SATA, USB 3.0 and PCIe
+functionality do not work with newer versions of Linux kernel.
+
+Due to the above reasons, the following commits were introduced into Linux,
+to workaround these issues by ignoring -EOPNOTSUPP error code from
+phy-mvebu-a3700-comphy driver function phy_power_on():
+
+commit 45aefe3d2251 ("ata: ahci: mvebu: Make SATA PHY optional for Armada
+3720")
+commit 3241929b67d2 ("usb: host: xhci: mvebu: make USB 3.0 PHY optional for
+Armada 3720")
+commit b0c6ae0f8948 ("PCI: aardvark: Fix initialization with old Marvell's
+Arm Trusted Firmware")
+
+Replace this RPC implementation with proper native kernel implementation,
+which is independent on the firmware. Never return -EOPNOTSUPP for proper
+arguments.
+
+This should solve multiple issues with real-world boards, where it is not
+possible or really inconvenient to change the firmware. Let's eliminate
+these issues.
+
+This implementation is ported directly from Armada 3720 comphy driver found
+in newest version of ARM Trusted Firmware source code, but with various
+fixes of register names, some added comments, some refactoring due to the
+original code not conforming to kernel standards. Also PCIe mode poweroff
+support was added here, and PHY reset support. These changes are also going
+to be sent to ARM Trusted Firmware.
+
+[ Pali did the porting from ATF.
+  I (Marek) then fixed some register names, some various other things,
+  added some comments and refactored the code to kernel standards. Also
+  fixed PHY poweroff and added PHY reset. ]
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Acked-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Link: https://lore.kernel.org/r/20220203214444.1508-3-kabel@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+---
+ drivers/phy/marvell/phy-mvebu-a3700-comphy.c | 1332 ++++++++++++++++--
+ 1 file changed, 1215 insertions(+), 117 deletions(-)
+
+--- a/drivers/phy/marvell/phy-mvebu-a3700-comphy.c
++++ b/drivers/phy/marvell/phy-mvebu-a3700-comphy.c
+@@ -5,12 +5,16 @@
+  * Authors:
+  *   Evan Wang <xswang@marvell.com>
+  *   Miquèl Raynal <miquel.raynal@bootlin.com>
++ *   Pali Rohár <pali@kernel.org>
++ *   Marek Behún <kabel@kernel.org>
+  *
+  * Structure inspired from phy-mvebu-cp110-comphy.c written by Antoine Tenart.
+- * SMC call initial support done by Grzegorz Jaszczyk.
++ * Comphy code from ARM Trusted Firmware ported by Pali Rohár <pali@kernel.org>
++ * and Marek Behún <kabel@kernel.org>.
+  */
+ 
+-#include <linux/arm-smccc.h>
++#include <linux/bitfield.h>
++#include <linux/clk.h>
+ #include <linux/io.h>
+ #include <linux/iopoll.h>
+ #include <linux/mfd/syscon.h>
+@@ -18,103 +22,1118 @@
+ #include <linux/phy.h>
+ #include <linux/phy/phy.h>
+ #include <linux/platform_device.h>
++#include <linux/spinlock.h>
+ 
+-#define MVEBU_A3700_COMPHY_LANES		3
++#define PLL_SET_DELAY_US		600
++#define COMPHY_PLL_SLEEP		1000
++#define COMPHY_PLL_TIMEOUT		150000
++
++/* Comphy lane2 indirect access register offset */
++#define COMPHY_LANE2_INDIR_ADDR		0x0
++#define COMPHY_LANE2_INDIR_DATA		0x4
++
++/* SATA and USB3 PHY offset compared to SATA PHY */
++#define COMPHY_LANE2_REGS_BASE		0x200
++
++/*
++ * When accessing common PHY lane registers directly, we need to shift by 1,
++ * since the registers are 16-bit.
++ */
++#define COMPHY_LANE_REG_DIRECT(reg)	(((reg) & 0x7FF) << 1)
++
++/* COMPHY registers */
++#define COMPHY_POWER_PLL_CTRL		0x01
++#define PU_IVREF_BIT			BIT(15)
++#define PU_PLL_BIT			BIT(14)
++#define PU_RX_BIT			BIT(13)
++#define PU_TX_BIT			BIT(12)
++#define PU_TX_INTP_BIT			BIT(11)
++#define PU_DFE_BIT			BIT(10)
++#define RESET_DTL_RX_BIT		BIT(9)
++#define PLL_LOCK_BIT			BIT(8)
++#define REF_FREF_SEL_MASK		GENMASK(4, 0)
++#define REF_FREF_SEL_SERDES_25MHZ	FIELD_PREP(REF_FREF_SEL_MASK, 0x1)
++#define REF_FREF_SEL_SERDES_40MHZ	FIELD_PREP(REF_FREF_SEL_MASK, 0x3)
++#define REF_FREF_SEL_SERDES_50MHZ	FIELD_PREP(REF_FREF_SEL_MASK, 0x4)
++#define REF_FREF_SEL_PCIE_USB3_25MHZ	FIELD_PREP(REF_FREF_SEL_MASK, 0x2)
++#define REF_FREF_SEL_PCIE_USB3_40MHZ	FIELD_PREP(REF_FREF_SEL_MASK, 0x3)
++#define COMPHY_MODE_MASK		GENMASK(7, 5)
++#define COMPHY_MODE_SATA		FIELD_PREP(COMPHY_MODE_MASK, 0x0)
++#define COMPHY_MODE_PCIE		FIELD_PREP(COMPHY_MODE_MASK, 0x3)
++#define COMPHY_MODE_SERDES		FIELD_PREP(COMPHY_MODE_MASK, 0x4)
++#define COMPHY_MODE_USB3		FIELD_PREP(COMPHY_MODE_MASK, 0x5)
++
++#define COMPHY_KVCO_CAL_CTRL		0x02
++#define USE_MAX_PLL_RATE_BIT		BIT(12)
++#define SPEED_PLL_MASK			GENMASK(7, 2)
++#define SPEED_PLL_VALUE_16		FIELD_PREP(SPEED_PLL_MASK, 0x10)
++
++#define COMPHY_DIG_LOOPBACK_EN		0x23
++#define SEL_DATA_WIDTH_MASK		GENMASK(11, 10)
++#define DATA_WIDTH_10BIT		FIELD_PREP(SEL_DATA_WIDTH_MASK, 0x0)
++#define DATA_WIDTH_20BIT		FIELD_PREP(SEL_DATA_WIDTH_MASK, 0x1)
++#define DATA_WIDTH_40BIT		FIELD_PREP(SEL_DATA_WIDTH_MASK, 0x2)
++#define PLL_READY_TX_BIT		BIT(4)
++
++#define COMPHY_SYNC_PATTERN		0x24
++#define TXD_INVERT_BIT			BIT(10)
++#define RXD_INVERT_BIT			BIT(11)
++
++#define COMPHY_SYNC_MASK_GEN		0x25
++#define PHY_GEN_MAX_MASK		GENMASK(11, 10)
++#define PHY_GEN_MAX_USB3_5G		FIELD_PREP(PHY_GEN_MAX_MASK, 0x1)
++
++#define COMPHY_ISOLATION_CTRL		0x26
++#define PHY_ISOLATE_MODE		BIT(15)
++
++#define COMPHY_GEN2_SET2		0x3e
++#define GS2_TX_SSC_AMP_MASK		GENMASK(15, 9)
++#define GS2_TX_SSC_AMP_4128		FIELD_PREP(GS2_TX_SSC_AMP_MASK, 0x20)
++#define GS2_VREG_RXTX_MAS_ISET_MASK	GENMASK(8, 7)
++#define GS2_VREG_RXTX_MAS_ISET_60U	FIELD_PREP(GS2_VREG_RXTX_MAS_ISET_MASK,\
++						   0x0)
++#define GS2_VREG_RXTX_MAS_ISET_80U	FIELD_PREP(GS2_VREG_RXTX_MAS_ISET_MASK,\
++						   0x1)
++#define GS2_VREG_RXTX_MAS_ISET_100U	FIELD_PREP(GS2_VREG_RXTX_MAS_ISET_MASK,\
++						   0x2)
++#define GS2_VREG_RXTX_MAS_ISET_120U	FIELD_PREP(GS2_VREG_RXTX_MAS_ISET_MASK,\
++						   0x3)
++#define GS2_RSVD_6_0_MASK		GENMASK(6, 0)
++
++#define COMPHY_GEN3_SET2		0x3f
++
++#define COMPHY_IDLE_SYNC_EN		0x48
++#define IDLE_SYNC_EN			BIT(12)
++
++#define COMPHY_MISC_CTRL0		0x4F
++#define CLK100M_125M_EN			BIT(4)
++#define TXDCLK_2X_SEL			BIT(6)
++#define CLK500M_EN			BIT(7)
++#define PHY_REF_CLK_SEL			BIT(10)
++
++#define COMPHY_SFT_RESET		0x52
++#define SFT_RST				BIT(9)
++#define SFT_RST_NO_REG			BIT(10)
++
++#define COMPHY_MISC_CTRL1		0x73
++#define SEL_BITS_PCIE_FORCE		BIT(15)
++
++#define COMPHY_GEN2_SET3		0x112
++#define GS3_FFE_CAP_SEL_MASK		GENMASK(3, 0)
++#define GS3_FFE_CAP_SEL_VALUE		FIELD_PREP(GS3_FFE_CAP_SEL_MASK, 0xF)
++
++/* PIPE registers */
++#define COMPHY_PIPE_LANE_CFG0		0x180
++#define PRD_TXDEEMPH0_MASK		BIT(0)
++#define PRD_TXMARGIN_MASK		GENMASK(3, 1)
++#define PRD_TXSWING_MASK		BIT(4)
++#define CFG_TX_ALIGN_POS_MASK		GENMASK(8, 5)
++
++#define COMPHY_PIPE_LANE_CFG1		0x181
++#define PRD_TXDEEMPH1_MASK		BIT(15)
++#define USE_MAX_PLL_RATE_EN		BIT(9)
++#define TX_DET_RX_MODE			BIT(6)
++#define GEN2_TX_DATA_DLY_MASK		GENMASK(4, 3)
++#define GEN2_TX_DATA_DLY_DEFT		FIELD_PREP(GEN2_TX_DATA_DLY_MASK, 2)
++#define TX_ELEC_IDLE_MODE_EN		BIT(0)
++
++#define COMPHY_PIPE_LANE_STAT1		0x183
++#define TXDCLK_PCLK_EN			BIT(0)
++
++#define COMPHY_PIPE_LANE_CFG4		0x188
++#define SPREAD_SPECTRUM_CLK_EN		BIT(7)
++
++#define COMPHY_PIPE_RST_CLK_CTRL	0x1C1
++#define PIPE_SOFT_RESET			BIT(0)
++#define PIPE_REG_RESET			BIT(1)
++#define MODE_CORE_CLK_FREQ_SEL		BIT(9)
++#define MODE_PIPE_WIDTH_32		BIT(3)
++#define MODE_REFDIV_MASK		GENMASK(5, 4)
++#define MODE_REFDIV_BY_4		FIELD_PREP(MODE_REFDIV_MASK, 0x2)
++
++#define COMPHY_PIPE_TEST_MODE_CTRL	0x1C2
++#define MODE_MARGIN_OVERRIDE		BIT(2)
++
++#define COMPHY_PIPE_CLK_SRC_LO		0x1C3
++#define MODE_CLK_SRC			BIT(0)
++#define BUNDLE_PERIOD_SEL		BIT(1)
++#define BUNDLE_PERIOD_SCALE_MASK	GENMASK(3, 2)
++#define BUNDLE_SAMPLE_CTRL		BIT(4)
++#define PLL_READY_DLY_MASK		GENMASK(7, 5)
++#define CFG_SEL_20B			BIT(15)
++
++#define COMPHY_PIPE_PWR_MGM_TIM1	0x1D0
++#define CFG_PM_OSCCLK_WAIT_MASK		GENMASK(15, 12)
++#define CFG_PM_RXDEN_WAIT_MASK		GENMASK(11, 8)
++#define CFG_PM_RXDEN_WAIT_1_UNIT	FIELD_PREP(CFG_PM_RXDEN_WAIT_MASK, 0x1)
++#define CFG_PM_RXDLOZ_WAIT_MASK		GENMASK(7, 0)
++#define CFG_PM_RXDLOZ_WAIT_7_UNIT	FIELD_PREP(CFG_PM_RXDLOZ_WAIT_MASK, 0x7)
++#define CFG_PM_RXDLOZ_WAIT_12_UNIT	FIELD_PREP(CFG_PM_RXDLOZ_WAIT_MASK, 0xC)
++
++/*
++ * This register is not from PHY lane register space. It only exists in the
++ * indirect register space, before the actual PHY lane 2 registers. So the
++ * offset is absolute, not relative to COMPHY_LANE2_REGS_BASE.
++ * It is used only for SATA PHY initialization.
++ */
++#define COMPHY_RESERVED_REG		0x0E
++#define PHYCTRL_FRM_PIN_BIT		BIT(13)
+ 
+-/* COMPHY Fast SMC function identifiers */
+-#define COMPHY_SIP_POWER_ON			0x82000001
+-#define COMPHY_SIP_POWER_OFF			0x82000002
+-#define COMPHY_SIP_PLL_LOCK			0x82000003
+-
+-#define COMPHY_FW_MODE_SATA			0x1
+-#define COMPHY_FW_MODE_SGMII			0x2
+-#define COMPHY_FW_MODE_2500BASEX		0x3
+-#define COMPHY_FW_MODE_USB3H			0x4
+-#define COMPHY_FW_MODE_USB3D			0x5
+-#define COMPHY_FW_MODE_PCIE			0x6
+-#define COMPHY_FW_MODE_USB3			0xa
+-
+-#define COMPHY_FW_SPEED_1_25G			0 /* SGMII 1G */
+-#define COMPHY_FW_SPEED_2_5G			1
+-#define COMPHY_FW_SPEED_3_125G			2 /* 2500BASE-X */
+-#define COMPHY_FW_SPEED_5G			3
+-#define COMPHY_FW_SPEED_MAX			0x3F
+-
+-#define COMPHY_FW_MODE(mode)			((mode) << 12)
+-#define COMPHY_FW_NET(mode, idx, speed)		(COMPHY_FW_MODE(mode) | \
+-						 ((idx) << 8) |	\
+-						 ((speed) << 2))
+-#define COMPHY_FW_PCIE(mode, speed, width)	(COMPHY_FW_NET(mode, 0, speed) | \
+-						 ((width) << 18))
++/* South Bridge PHY Configuration Registers */
++#define COMPHY_PHY_REG(lane, reg)	(((1 - (lane)) * 0x28) + ((reg) & 0x3f))
++
++/*
++ * lane0: USB3/GbE1 PHY Configuration 1
++ * lane1: PCIe/GbE0 PHY Configuration 1
++ * (used only by SGMII code)
++ */
++#define COMPHY_PHY_CFG1			0x0
++#define PIN_PU_IVREF_BIT		BIT(1)
++#define PIN_RESET_CORE_BIT		BIT(11)
++#define PIN_RESET_COMPHY_BIT		BIT(12)
++#define PIN_PU_PLL_BIT			BIT(16)
++#define PIN_PU_RX_BIT			BIT(17)
++#define PIN_PU_TX_BIT			BIT(18)
++#define PIN_TX_IDLE_BIT			BIT(19)
++#define GEN_RX_SEL_MASK			GENMASK(25, 22)
++#define GEN_RX_SEL_VALUE(val)		FIELD_PREP(GEN_RX_SEL_MASK, (val))
++#define GEN_TX_SEL_MASK			GENMASK(29, 26)
++#define GEN_TX_SEL_VALUE(val)		FIELD_PREP(GEN_TX_SEL_MASK, (val))
++#define SERDES_SPEED_1_25_G		0x6
++#define SERDES_SPEED_3_125_G		0x8
++#define PHY_RX_INIT_BIT			BIT(30)
++
++/*
++ * lane0: USB3/GbE1 PHY Status 1
++ * lane1: PCIe/GbE0 PHY Status 1
++ * (used only by SGMII code)
++ */
++#define COMPHY_PHY_STAT1		0x18
++#define PHY_RX_INIT_DONE_BIT		BIT(0)
++#define PHY_PLL_READY_RX_BIT		BIT(2)
++#define PHY_PLL_READY_TX_BIT		BIT(3)
++
++/* PHY Selector */
++#define COMPHY_SELECTOR_PHY_REG			0xFC
++/* bit0: 0: Lane1 is GbE0; 1: Lane1 is PCIe */
++#define COMPHY_SELECTOR_PCIE_GBE0_SEL_BIT	BIT(0)
++/* bit4: 0: Lane0 is GbE1; 1: Lane0 is USB3 */
++#define COMPHY_SELECTOR_USB3_GBE1_SEL_BIT	BIT(4)
++/* bit8: 0: Lane0 is USB3 instead of GbE1, Lane2 is SATA; 1: Lane2 is USB3 */
++#define COMPHY_SELECTOR_USB3_PHY_SEL_BIT	BIT(8)
+ 
+ struct mvebu_a3700_comphy_conf {
+ 	unsigned int lane;
+ 	enum phy_mode mode;
+ 	int submode;
+-	u32 fw_mode;
+ };
+ 
+-#define MVEBU_A3700_COMPHY_CONF(_lane, _mode, _smode, _fw)		\
++#define MVEBU_A3700_COMPHY_CONF(_lane, _mode, _smode)			\
+ 	{								\
+ 		.lane = _lane,						\
+ 		.mode = _mode,						\
+ 		.submode = _smode,					\
+-		.fw_mode = _fw,						\
+ 	}
+ 
+-#define MVEBU_A3700_COMPHY_CONF_GEN(_lane, _mode, _fw) \
+-	MVEBU_A3700_COMPHY_CONF(_lane, _mode, PHY_INTERFACE_MODE_NA, _fw)
++#define MVEBU_A3700_COMPHY_CONF_GEN(_lane, _mode) \
++	MVEBU_A3700_COMPHY_CONF(_lane, _mode, PHY_INTERFACE_MODE_NA)
+ 
+-#define MVEBU_A3700_COMPHY_CONF_ETH(_lane, _smode, _fw) \
+-	MVEBU_A3700_COMPHY_CONF(_lane, PHY_MODE_ETHERNET, _smode, _fw)
++#define MVEBU_A3700_COMPHY_CONF_ETH(_lane, _smode) \
++	MVEBU_A3700_COMPHY_CONF(_lane, PHY_MODE_ETHERNET, _smode)
+ 
+ static const struct mvebu_a3700_comphy_conf mvebu_a3700_comphy_modes[] = {
+ 	/* lane 0 */
+-	MVEBU_A3700_COMPHY_CONF_GEN(0, PHY_MODE_USB_HOST_SS,
+-				    COMPHY_FW_MODE_USB3H),
+-	MVEBU_A3700_COMPHY_CONF_ETH(0, PHY_INTERFACE_MODE_SGMII,
+-				    COMPHY_FW_MODE_SGMII),
+-	MVEBU_A3700_COMPHY_CONF_ETH(0, PHY_INTERFACE_MODE_2500BASEX,
+-				    COMPHY_FW_MODE_2500BASEX),
++	MVEBU_A3700_COMPHY_CONF_GEN(0, PHY_MODE_USB_HOST_SS),
++	MVEBU_A3700_COMPHY_CONF_ETH(0, PHY_INTERFACE_MODE_SGMII),
++	MVEBU_A3700_COMPHY_CONF_ETH(0, PHY_INTERFACE_MODE_1000BASEX),
++	MVEBU_A3700_COMPHY_CONF_ETH(0, PHY_INTERFACE_MODE_2500BASEX),
+ 	/* lane 1 */
+-	MVEBU_A3700_COMPHY_CONF_GEN(1, PHY_MODE_PCIE, COMPHY_FW_MODE_PCIE),
+-	MVEBU_A3700_COMPHY_CONF_ETH(1, PHY_INTERFACE_MODE_SGMII,
+-				    COMPHY_FW_MODE_SGMII),
+-	MVEBU_A3700_COMPHY_CONF_ETH(1, PHY_INTERFACE_MODE_2500BASEX,
+-				    COMPHY_FW_MODE_2500BASEX),
++	MVEBU_A3700_COMPHY_CONF_GEN(1, PHY_MODE_PCIE),
++	MVEBU_A3700_COMPHY_CONF_ETH(1, PHY_INTERFACE_MODE_SGMII),
++	MVEBU_A3700_COMPHY_CONF_ETH(1, PHY_INTERFACE_MODE_1000BASEX),
++	MVEBU_A3700_COMPHY_CONF_ETH(1, PHY_INTERFACE_MODE_2500BASEX),
+ 	/* lane 2 */
+-	MVEBU_A3700_COMPHY_CONF_GEN(2, PHY_MODE_SATA, COMPHY_FW_MODE_SATA),
+-	MVEBU_A3700_COMPHY_CONF_GEN(2, PHY_MODE_USB_HOST_SS,
+-				    COMPHY_FW_MODE_USB3H),
++	MVEBU_A3700_COMPHY_CONF_GEN(2, PHY_MODE_SATA),
++	MVEBU_A3700_COMPHY_CONF_GEN(2, PHY_MODE_USB_HOST_SS),
++};
++
++struct mvebu_a3700_comphy_priv {
++	void __iomem *comphy_regs;
++	void __iomem *lane0_phy_regs; /* USB3 and GbE1 */
++	void __iomem *lane1_phy_regs; /* PCIe and GbE0 */
++	void __iomem *lane2_phy_indirect; /* SATA and USB3 */
++	spinlock_t lock; /* for PHY selector access */
++	bool xtal_is_40m;
+ };
+ 
+ struct mvebu_a3700_comphy_lane {
++	struct mvebu_a3700_comphy_priv *priv;
+ 	struct device *dev;
+ 	unsigned int id;
+ 	enum phy_mode mode;
+ 	int submode;
++	bool invert_tx;
++	bool invert_rx;
++	bool needs_reset;
++};
++
++struct gbe_phy_init_data_fix {
++	u16 addr;
++	u16 value;
++};
++
++/* Changes to 40M1G25 mode data required for running 40M3G125 init mode */
++static struct gbe_phy_init_data_fix gbe_phy_init_fix[] = {
++	{ 0x005, 0x07CC }, { 0x015, 0x0000 }, { 0x01B, 0x0000 },
++	{ 0x01D, 0x0000 }, { 0x01E, 0x0000 }, { 0x01F, 0x0000 },
++	{ 0x020, 0x0000 }, { 0x021, 0x0030 }, { 0x026, 0x0888 },
++	{ 0x04D, 0x0152 }, { 0x04F, 0xA020 }, { 0x050, 0x07CC },
++	{ 0x053, 0xE9CA }, { 0x055, 0xBD97 }, { 0x071, 0x3015 },
++	{ 0x076, 0x03AA }, { 0x07C, 0x0FDF }, { 0x0C2, 0x3030 },
++	{ 0x0C3, 0x8000 }, { 0x0E2, 0x5550 }, { 0x0E3, 0x12A4 },
++	{ 0x0E4, 0x7D00 }, { 0x0E6, 0x0C83 }, { 0x101, 0xFCC0 },
++	{ 0x104, 0x0C10 }
+ };
+ 
+-static int mvebu_a3700_comphy_smc(unsigned long function, unsigned long lane,
+-				  unsigned long mode)
++/* 40M1G25 mode init data */
++static u16 gbe_phy_init[512] = {
++	/* 0       1       2       3       4       5       6       7 */
++	/*-----------------------------------------------------------*/
++	/* 8       9       A       B       C       D       E       F */
++	0x3110, 0xFD83, 0x6430, 0x412F, 0x82C0, 0x06FA, 0x4500, 0x6D26,	/* 00 */
++	0xAFC0, 0x8000, 0xC000, 0x0000, 0x2000, 0x49CC, 0x0BC9, 0x2A52,	/* 08 */
++	0x0BD2, 0x0CDE, 0x13D2, 0x0CE8, 0x1149, 0x10E0, 0x0000, 0x0000,	/* 10 */
++	0x0000, 0x0000, 0x0000, 0x0001, 0x0000, 0x4134, 0x0D2D, 0xFFFF,	/* 18 */
++	0xFFE0, 0x4030, 0x1016, 0x0030, 0x0000, 0x0800, 0x0866, 0x0000,	/* 20 */
++	0x0000, 0x0000, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF,	/* 28 */
++	0xFFFF, 0xFFFF, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/* 30 */
++	0x0000, 0x0000, 0x000F, 0x6A62, 0x1988, 0x3100, 0x3100, 0x3100,	/* 38 */
++	0x3100, 0xA708, 0x2430, 0x0830, 0x1030, 0x4610, 0xFF00, 0xFF00,	/* 40 */
++	0x0060, 0x1000, 0x0400, 0x0040, 0x00F0, 0x0155, 0x1100, 0xA02A,	/* 48 */
++	0x06FA, 0x0080, 0xB008, 0xE3ED, 0x5002, 0xB592, 0x7A80, 0x0001,	/* 50 */
++	0x020A, 0x8820, 0x6014, 0x8054, 0xACAA, 0xFC88, 0x2A02, 0x45CF,	/* 58 */
++	0x000F, 0x1817, 0x2860, 0x064F, 0x0000, 0x0204, 0x1800, 0x6000,	/* 60 */
++	0x810F, 0x4F23, 0x4000, 0x4498, 0x0850, 0x0000, 0x000E, 0x1002,	/* 68 */
++	0x9D3A, 0x3009, 0xD066, 0x0491, 0x0001, 0x6AB0, 0x0399, 0x3780,	/* 70 */
++	0x0040, 0x5AC0, 0x4A80, 0x0000, 0x01DF, 0x0000, 0x0007, 0x0000,	/* 78 */
++	0x2D54, 0x00A1, 0x4000, 0x0100, 0xA20A, 0x0000, 0x0000, 0x0000,	/* 80 */
++	0x0000, 0x0000, 0x0000, 0x7400, 0x0E81, 0x1000, 0x1242, 0x0210,	/* 88 */
++	0x80DF, 0x0F1F, 0x2F3F, 0x4F5F, 0x6F7F, 0x0F1F, 0x2F3F, 0x4F5F,	/* 90 */
++	0x6F7F, 0x4BAD, 0x0000, 0x0000, 0x0800, 0x0000, 0x2400, 0xB651,	/* 98 */
++	0xC9E0, 0x4247, 0x0A24, 0x0000, 0xAF19, 0x1004, 0x0000, 0x0000,	/* A0 */
++	0x0000, 0x0013, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/* A8 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/* B0 */
++	0x0000, 0x0000, 0x0000, 0x0060, 0x0000, 0x0000, 0x0000, 0x0000,	/* B8 */
++	0x0000, 0x0000, 0x3010, 0xFA00, 0x0000, 0x0000, 0x0000, 0x0003,	/* C0 */
++	0x1618, 0x8200, 0x8000, 0x0400, 0x050F, 0x0000, 0x0000, 0x0000,	/* C8 */
++	0x4C93, 0x0000, 0x1000, 0x1120, 0x0010, 0x1242, 0x1242, 0x1E00,	/* D0 */
++	0x0000, 0x0000, 0x0000, 0x00F8, 0x0000, 0x0041, 0x0800, 0x0000,	/* D8 */
++	0x82A0, 0x572E, 0x2490, 0x14A9, 0x4E00, 0x0000, 0x0803, 0x0541,	/* E0 */
++	0x0C15, 0x0000, 0x0000, 0x0400, 0x2626, 0x0000, 0x0000, 0x4200,	/* E8 */
++	0x0000, 0xAA55, 0x1020, 0x0000, 0x0000, 0x5010, 0x0000, 0x0000,	/* F0 */
++	0x0000, 0x0000, 0x5000, 0x0000, 0x0000, 0x0000, 0x02F2, 0x0000,	/* F8 */
++	0x101F, 0xFDC0, 0x4000, 0x8010, 0x0110, 0x0006, 0x0000, 0x0000,	/*100 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*108 */
++	0x04CF, 0x0000, 0x04CF, 0x0000, 0x04CF, 0x0000, 0x04C6, 0x0000,	/*110 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*118 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*120 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*128 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*130 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*138 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*140 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*148 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*150 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*158 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*160 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*168 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*170 */
++	0x0000, 0x0000, 0x0000, 0x00F0, 0x08A2, 0x3112, 0x0A14, 0x0000,	/*178 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*180 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*188 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*190 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*198 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*1A0 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*1A8 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*1B0 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*1B8 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*1C0 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*1C8 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*1D0 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*1D8 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*1E0 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*1E8 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,	/*1F0 */
++	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000	/*1F8 */
++};
++
++static inline void comphy_reg_set(void __iomem *addr, u32 data, u32 mask)
+ {
+-	struct arm_smccc_res res;
+-	s32 ret;
++	u32 val;
++
++	val = readl(addr);
++	val = (val & ~mask) | (data & mask);
++	writel(val, addr);
++}
+ 
+-	arm_smccc_smc(function, lane, mode, 0, 0, 0, 0, 0, &res);
+-	ret = res.a0;
++static inline void comphy_reg_set16(void __iomem *addr, u16 data, u16 mask)
++{
++	u16 val;
+ 
+-	switch (ret) {
+-	case SMCCC_RET_SUCCESS:
+-		return 0;
+-	case SMCCC_RET_NOT_SUPPORTED:
+-		return -EOPNOTSUPP;
++	val = readw(addr);
++	val = (val & ~mask) | (data & mask);
++	writew(val, addr);
++}
++
++/* Used for accessing lane 2 registers (SATA/USB3 PHY) */
++static void comphy_set_indirect(struct mvebu_a3700_comphy_priv *priv,
++				u32 offset, u16 data, u16 mask)
++{
++	writel(offset,
++	       priv->lane2_phy_indirect + COMPHY_LANE2_INDIR_ADDR);
++	comphy_reg_set(priv->lane2_phy_indirect + COMPHY_LANE2_INDIR_DATA,
++		       data, mask);
++}
++
++static void comphy_lane_reg_set(struct mvebu_a3700_comphy_lane *lane,
++				u16 reg, u16 data, u16 mask)
++{
++	if (lane->id == 2) {
++		/* lane 2 PHY registers are accessed indirectly */
++		comphy_set_indirect(lane->priv,
++				    reg + COMPHY_LANE2_REGS_BASE,
++				    data, mask);
++	} else {
++		void __iomem *base = lane->id == 1 ?
++				     lane->priv->lane1_phy_regs :
++				     lane->priv->lane0_phy_regs;
++
++		comphy_reg_set16(base + COMPHY_LANE_REG_DIRECT(reg),
++				 data, mask);
++	}
++}
++
++static int comphy_lane_reg_poll(struct mvebu_a3700_comphy_lane *lane,
++				u16 reg, u16 bits,
++				ulong sleep_us, ulong timeout_us)
++{
++	int ret;
++
++	if (lane->id == 2) {
++		u32 data;
++
++		/* lane 2 PHY registers are accessed indirectly */
++		writel(reg + COMPHY_LANE2_REGS_BASE,
++		       lane->priv->lane2_phy_indirect +
++		       COMPHY_LANE2_INDIR_ADDR);
++
++		ret = readl_poll_timeout(lane->priv->lane2_phy_indirect +
++					 COMPHY_LANE2_INDIR_DATA,
++					 data, (data & bits) == bits,
++					 sleep_us, timeout_us);
++	} else {
++		void __iomem *base = lane->id == 1 ?
++				     lane->priv->lane1_phy_regs :
++				     lane->priv->lane0_phy_regs;
++		u16 data;
++
++		ret = readw_poll_timeout(base + COMPHY_LANE_REG_DIRECT(reg),
++					 data, (data & bits) == bits,
++					 sleep_us, timeout_us);
++	}
++
++	return ret;
++}
++
++static void comphy_periph_reg_set(struct mvebu_a3700_comphy_lane *lane,
++				  u8 reg, u32 data, u32 mask)
++{
++	comphy_reg_set(lane->priv->comphy_regs + COMPHY_PHY_REG(lane->id, reg),
++		       data, mask);
++}
++
++static int comphy_periph_reg_poll(struct mvebu_a3700_comphy_lane *lane,
++				  u8 reg, u32 bits,
++				  ulong sleep_us, ulong timeout_us)
++{
++	u32 data;
++
++	return readl_poll_timeout(lane->priv->comphy_regs +
++				  COMPHY_PHY_REG(lane->id, reg),
++				  data, (data & bits) == bits,
++				  sleep_us, timeout_us);
++}
++
++/* PHY selector configures with corresponding modes */
++static int
++mvebu_a3700_comphy_set_phy_selector(struct mvebu_a3700_comphy_lane *lane)
++{
++	u32 old, new, clr = 0, set = 0;
++	unsigned long flags;
++
++	switch (lane->mode) {
++	case PHY_MODE_SATA:
++		/* SATA must be in Lane2 */
++		if (lane->id == 2)
++			clr = COMPHY_SELECTOR_USB3_PHY_SEL_BIT;
++		else
++			goto error;
++		break;
++
++	case PHY_MODE_ETHERNET:
++		if (lane->id == 0)
++			clr = COMPHY_SELECTOR_USB3_GBE1_SEL_BIT;
++		else if (lane->id == 1)
++			clr = COMPHY_SELECTOR_PCIE_GBE0_SEL_BIT;
++		else
++			goto error;
++		break;
++
++	case PHY_MODE_USB_HOST_SS:
++		if (lane->id == 2)
++			set = COMPHY_SELECTOR_USB3_PHY_SEL_BIT;
++		else if (lane->id == 0)
++			set = COMPHY_SELECTOR_USB3_GBE1_SEL_BIT;
++		else
++			goto error;
++		break;
++
++	case PHY_MODE_PCIE:
++		/* PCIE must be in Lane1 */
++		if (lane->id == 1)
++			set = COMPHY_SELECTOR_PCIE_GBE0_SEL_BIT;
++		else
++			goto error;
++		break;
++
++	default:
++		goto error;
++	}
++
++	spin_lock_irqsave(&lane->priv->lock, flags);
++
++	old = readl(lane->priv->comphy_regs + COMPHY_SELECTOR_PHY_REG);
++	new = (old & ~clr) | set;
++	writel(new, lane->priv->comphy_regs + COMPHY_SELECTOR_PHY_REG);
++
++	spin_unlock_irqrestore(&lane->priv->lock, flags);
++
++	dev_dbg(lane->dev,
++		"COMPHY[%d] mode[%d] changed PHY selector 0x%08x -> 0x%08x\n",
++		lane->id, lane->mode, old, new);
++
++	return 0;
++error:
++	dev_err(lane->dev, "COMPHY[%d] mode[%d] is invalid\n", lane->id,
++		lane->mode);
++	return -EINVAL;
++}
++
++static int
++mvebu_a3700_comphy_sata_power_on(struct mvebu_a3700_comphy_lane *lane)
++{
++	u32 mask, data, ref_clk;
++	int ret;
++
++	/* Configure phy selector for SATA */
++	ret = mvebu_a3700_comphy_set_phy_selector(lane);
++	if (ret)
++		return ret;
++
++	/* Clear phy isolation mode to make it work in normal mode */
++	comphy_lane_reg_set(lane, COMPHY_ISOLATION_CTRL,
++			    0x0, PHY_ISOLATE_MODE);
++
++	/* 0. Check the Polarity invert bits */
++	data = 0x0;
++	if (lane->invert_tx)
++		data |= TXD_INVERT_BIT;
++	if (lane->invert_rx)
++		data |= RXD_INVERT_BIT;
++	mask = TXD_INVERT_BIT | RXD_INVERT_BIT;
++	comphy_lane_reg_set(lane, COMPHY_SYNC_PATTERN, data, mask);
++
++	/* 1. Select 40-bit data width */
++	comphy_lane_reg_set(lane, COMPHY_DIG_LOOPBACK_EN,
++			    DATA_WIDTH_40BIT, SEL_DATA_WIDTH_MASK);
++
++	/* 2. Select reference clock(25M) and PHY mode (SATA) */
++	if (lane->priv->xtal_is_40m)
++		ref_clk = REF_FREF_SEL_SERDES_40MHZ;
++	else
++		ref_clk = REF_FREF_SEL_SERDES_25MHZ;
++
++	data = ref_clk | COMPHY_MODE_SATA;
++	mask = REF_FREF_SEL_MASK | COMPHY_MODE_MASK;
++	comphy_lane_reg_set(lane, COMPHY_POWER_PLL_CTRL, data, mask);
++
++	/* 3. Use maximum PLL rate (no power save) */
++	comphy_lane_reg_set(lane, COMPHY_KVCO_CAL_CTRL,
++			    USE_MAX_PLL_RATE_BIT, USE_MAX_PLL_RATE_BIT);
++
++	/* 4. Reset reserved bit */
++	comphy_set_indirect(lane->priv, COMPHY_RESERVED_REG,
++			    0x0, PHYCTRL_FRM_PIN_BIT);
++
++	/* 5. Set vendor-specific configuration (It is done in sata driver) */
++	/* XXX: in U-Boot below sequence was executed in this place, in Linux
++	 * not.  Now it is done only in U-Boot before this comphy
++	 * initialization - tests shows that it works ok, but in case of any
++	 * future problem it is left for reference.
++	 *   reg_set(MVEBU_REGS_BASE + 0xe00a0, 0, 0xffffffff);
++	 *   reg_set(MVEBU_REGS_BASE + 0xe00a4, BIT(6), BIT(6));
++	 */
++
++	/* Wait for > 55 us to allow PLL be enabled */
++	udelay(PLL_SET_DELAY_US);
++
++	/* Polling status */
++	ret = comphy_lane_reg_poll(lane, COMPHY_DIG_LOOPBACK_EN,
++				   PLL_READY_TX_BIT, COMPHY_PLL_SLEEP,
++				   COMPHY_PLL_TIMEOUT);
++	if (ret)
++		dev_err(lane->dev, "Failed to lock SATA PLL\n");
++
++	return ret;
++}
++
++static void comphy_gbe_phy_init(struct mvebu_a3700_comphy_lane *lane,
++				bool is_1gbps)
++{
++	int addr, fix_idx;
++	u16 val;
++
++	fix_idx = 0;
++	for (addr = 0; addr < 512; addr++) {
++		/*
++		 * All PHY register values are defined in full for 3.125Gbps
++		 * SERDES speed. The values required for 1.25 Gbps are almost
++		 * the same and only few registers should be "fixed" in
++		 * comparison to 3.125 Gbps values. These register values are
++		 * stored in "gbe_phy_init_fix" array.
++		 */
++		if (!is_1gbps && gbe_phy_init_fix[fix_idx].addr == addr) {
++			/* Use new value */
++			val = gbe_phy_init_fix[fix_idx].value;
++			if (fix_idx < ARRAY_SIZE(gbe_phy_init_fix))
++				fix_idx++;
++		} else {
++			val = gbe_phy_init[addr];
++		}
++
++		comphy_lane_reg_set(lane, addr, val, 0xFFFF);
++	}
++}
++
++static int
++mvebu_a3700_comphy_ethernet_power_on(struct mvebu_a3700_comphy_lane *lane)
++{
++	u32 mask, data, speed_sel;
++	int ret;
++
++	/* Set selector */
++	ret = mvebu_a3700_comphy_set_phy_selector(lane);
++	if (ret)
++		return ret;
++
++	/*
++	 * 1. Reset PHY by setting PHY input port PIN_RESET=1.
++	 * 2. Set PHY input port PIN_TX_IDLE=1, PIN_PU_IVREF=1 to keep
++	 *    PHY TXP/TXN output to idle state during PHY initialization
++	 * 3. Set PHY input port PIN_PU_PLL=0, PIN_PU_RX=0, PIN_PU_TX=0.
++	 */
++	data = PIN_PU_IVREF_BIT | PIN_TX_IDLE_BIT | PIN_RESET_COMPHY_BIT;
++	mask = data | PIN_RESET_CORE_BIT | PIN_PU_PLL_BIT | PIN_PU_RX_BIT |
++	       PIN_PU_TX_BIT | PHY_RX_INIT_BIT;
++	comphy_periph_reg_set(lane, COMPHY_PHY_CFG1, data, mask);
++
++	/* 4. Release reset to the PHY by setting PIN_RESET=0. */
++	data = 0x0;
++	mask = PIN_RESET_COMPHY_BIT;
++	comphy_periph_reg_set(lane, COMPHY_PHY_CFG1, data, mask);
++
++	/*
++	 * 5. Set PIN_PHY_GEN_TX[3:0] and PIN_PHY_GEN_RX[3:0] to decide COMPHY
++	 * bit rate
++	 */
++	switch (lane->submode) {
++	case PHY_INTERFACE_MODE_SGMII:
++	case PHY_INTERFACE_MODE_1000BASEX:
++		/* SGMII 1G, SerDes speed 1.25G */
++		speed_sel = SERDES_SPEED_1_25_G;
++		break;
++	case PHY_INTERFACE_MODE_2500BASEX:
++		/* 2500Base-X, SerDes speed 3.125G */
++		speed_sel = SERDES_SPEED_3_125_G;
++		break;
+ 	default:
++		/* Other rates are not supported */
++		dev_err(lane->dev,
++			"unsupported phy speed %d on comphy lane%d\n",
++			lane->submode, lane->id);
+ 		return -EINVAL;
+ 	}
++	data = GEN_RX_SEL_VALUE(speed_sel) | GEN_TX_SEL_VALUE(speed_sel);
++	mask = GEN_RX_SEL_MASK | GEN_TX_SEL_MASK;
++	comphy_periph_reg_set(lane, COMPHY_PHY_CFG1, data, mask);
++
++	/*
++	 * 6. Wait 10mS for bandgap and reference clocks to stabilize; then
++	 * start SW programming.
++	 */
++	mdelay(10);
++
++	/* 7. Program COMPHY register PHY_MODE */
++	data = COMPHY_MODE_SERDES;
++	mask = COMPHY_MODE_MASK;
++	comphy_lane_reg_set(lane, COMPHY_POWER_PLL_CTRL, data, mask);
++
++	/*
++	 * 8. Set COMPHY register REFCLK_SEL to select the correct REFCLK
++	 * source
++	 */
++	data = 0x0;
++	mask = PHY_REF_CLK_SEL;
++	comphy_lane_reg_set(lane, COMPHY_MISC_CTRL0, data, mask);
++
++	/*
++	 * 9. Set correct reference clock frequency in COMPHY register
++	 * REF_FREF_SEL.
++	 */
++	if (lane->priv->xtal_is_40m)
++		data = REF_FREF_SEL_SERDES_50MHZ;
++	else
++		data = REF_FREF_SEL_SERDES_25MHZ;
++
++	mask = REF_FREF_SEL_MASK;
++	comphy_lane_reg_set(lane, COMPHY_POWER_PLL_CTRL, data, mask);
++
++	/*
++	 * 10. Program COMPHY register PHY_GEN_MAX[1:0]
++	 * This step is mentioned in the flow received from verification team.
++	 * However the PHY_GEN_MAX value is only meaningful for other interfaces
++	 * (not SERDES). For instance, it selects SATA speed 1.5/3/6 Gbps or
++	 * PCIe speed 2.5/5 Gbps
++	 */
++
++	/*
++	 * 11. Program COMPHY register SEL_BITS to set correct parallel data
++	 * bus width
++	 */
++	data = DATA_WIDTH_10BIT;
++	mask = SEL_DATA_WIDTH_MASK;
++	comphy_lane_reg_set(lane, COMPHY_DIG_LOOPBACK_EN, data, mask);
++
++	/*
++	 * 12. As long as DFE function needs to be enabled in any mode,
++	 * COMPHY register DFE_UPDATE_EN[5:0] shall be programmed to 0x3F
++	 * for real chip during COMPHY power on.
++	 * The value of the DFE_UPDATE_EN already is 0x3F, because it is the
++	 * default value after reset of the PHY.
++	 */
++
++	/*
++	 * 13. Program COMPHY GEN registers.
++	 * These registers should be programmed based on the lab testing result
++	 * to achieve optimal performance. Please contact the CEA group to get
++	 * the related GEN table during real chip bring-up. We only required to
++	 * run though the entire registers programming flow defined by
++	 * "comphy_gbe_phy_init" when the REF clock is 40 MHz. For REF clock
++	 * 25 MHz the default values stored in PHY registers are OK.
++	 */
++	dev_dbg(lane->dev, "Running C-DPI phy init %s mode\n",
++		lane->submode == PHY_INTERFACE_MODE_2500BASEX ? "2G5" : "1G");
++	if (lane->priv->xtal_is_40m)
++		comphy_gbe_phy_init(lane,
++				    lane->submode != PHY_INTERFACE_MODE_2500BASEX);
++
++	/*
++	 * 14. Check the PHY Polarity invert bit
++	 */
++	data = 0x0;
++	if (lane->invert_tx)
++		data |= TXD_INVERT_BIT;
++	if (lane->invert_rx)
++		data |= RXD_INVERT_BIT;
++	mask = TXD_INVERT_BIT | RXD_INVERT_BIT;
++	comphy_lane_reg_set(lane, COMPHY_SYNC_PATTERN, data, mask);
++
++	/*
++	 * 15. Set PHY input ports PIN_PU_PLL, PIN_PU_TX and PIN_PU_RX to 1 to
++	 * start PHY power up sequence. All the PHY register programming should
++	 * be done before PIN_PU_PLL=1. There should be no register programming
++	 * for normal PHY operation from this point.
++	 */
++	data = PIN_PU_PLL_BIT | PIN_PU_RX_BIT | PIN_PU_TX_BIT;
++	mask = data;
++	comphy_periph_reg_set(lane, COMPHY_PHY_CFG1, data, mask);
++
++	/*
++	 * 16. Wait for PHY power up sequence to finish by checking output ports
++	 * PIN_PLL_READY_TX=1 and PIN_PLL_READY_RX=1.
++	 */
++	ret = comphy_periph_reg_poll(lane, COMPHY_PHY_STAT1,
++				     PHY_PLL_READY_TX_BIT |
++				     PHY_PLL_READY_RX_BIT,
++				     COMPHY_PLL_SLEEP, COMPHY_PLL_TIMEOUT);
++	if (ret) {
++		dev_err(lane->dev, "Failed to lock PLL for SERDES PHY %d\n",
++			lane->id);
++		return ret;
++	}
++
++	/*
++	 * 17. Set COMPHY input port PIN_TX_IDLE=0
++	 */
++	comphy_periph_reg_set(lane, COMPHY_PHY_CFG1, 0x0, PIN_TX_IDLE_BIT);
++
++	/*
++	 * 18. After valid data appear on PIN_RXDATA bus, set PIN_RX_INIT=1. To
++	 * start RX initialization. PIN_RX_INIT_DONE will be cleared to 0 by the
++	 * PHY After RX initialization is done, PIN_RX_INIT_DONE will be set to
++	 * 1 by COMPHY Set PIN_RX_INIT=0 after PIN_RX_INIT_DONE= 1. Please
++	 * refer to RX initialization part for details.
++	 */
++	comphy_periph_reg_set(lane, COMPHY_PHY_CFG1,
++			      PHY_RX_INIT_BIT, PHY_RX_INIT_BIT);
++
++	ret = comphy_periph_reg_poll(lane, COMPHY_PHY_STAT1,
++				     PHY_PLL_READY_TX_BIT |
++				     PHY_PLL_READY_RX_BIT,
++				     COMPHY_PLL_SLEEP, COMPHY_PLL_TIMEOUT);
++	if (ret) {
++		dev_err(lane->dev, "Failed to lock PLL for SERDES PHY %d\n",
++			lane->id);
++		return ret;
++	}
++
++	ret = comphy_periph_reg_poll(lane, COMPHY_PHY_STAT1,
++				     PHY_RX_INIT_DONE_BIT,
++				     COMPHY_PLL_SLEEP, COMPHY_PLL_TIMEOUT);
++	if (ret)
++		dev_err(lane->dev, "Failed to init RX of SERDES PHY %d\n",
++			lane->id);
++
++	return ret;
+ }
+ 
+-static int mvebu_a3700_comphy_get_fw_mode(int lane,
++static int
++mvebu_a3700_comphy_usb3_power_on(struct mvebu_a3700_comphy_lane *lane)
++{
++	u32 mask, data, cfg, ref_clk;
++	int ret;
++
++	/* Set phy seclector */
++	ret = mvebu_a3700_comphy_set_phy_selector(lane);
++	if (ret)
++		return ret;
++
++	/*
++	 * 0. Set PHY OTG Control(0x5d034), bit 4, Power up OTG module The
++	 * register belong to UTMI module, so it is set in UTMI phy driver.
++	 */
++
++	/*
++	 * 1. Set PRD_TXDEEMPH (3.5db de-emph)
++	 */
++	data = PRD_TXDEEMPH0_MASK;
++	mask = PRD_TXDEEMPH0_MASK | PRD_TXMARGIN_MASK | PRD_TXSWING_MASK |
++	       CFG_TX_ALIGN_POS_MASK;
++	comphy_lane_reg_set(lane, COMPHY_PIPE_LANE_CFG0, data, mask);
++
++	/*
++	 * 2. Set BIT0: enable transmitter in high impedance mode
++	 *    Set BIT[3:4]: delay 2 clock cycles for HiZ off latency
++	 *    Set BIT6: Tx detect Rx at HiZ mode
++	 *    Unset BIT15: set to 0 to set USB3 De-emphasize level to -3.5db
++	 *            together with bit 0 of COMPHY_PIPE_LANE_CFG0 register
++	 */
++	data = TX_DET_RX_MODE | GEN2_TX_DATA_DLY_DEFT | TX_ELEC_IDLE_MODE_EN;
++	mask = PRD_TXDEEMPH1_MASK | TX_DET_RX_MODE | GEN2_TX_DATA_DLY_MASK |
++	       TX_ELEC_IDLE_MODE_EN;
++	comphy_lane_reg_set(lane, COMPHY_PIPE_LANE_CFG1, data, mask);
++
++	/*
++	 * 3. Set Spread Spectrum Clock Enabled
++	 */
++	comphy_lane_reg_set(lane, COMPHY_PIPE_LANE_CFG4,
++			    SPREAD_SPECTRUM_CLK_EN, SPREAD_SPECTRUM_CLK_EN);
++
++	/*
++	 * 4. Set Override Margining Controls From the MAC:
++	 *    Use margining signals from lane configuration
++	 */
++	comphy_lane_reg_set(lane, COMPHY_PIPE_TEST_MODE_CTRL,
++			    MODE_MARGIN_OVERRIDE, 0xFFFF);
++
++	/*
++	 * 5. Set Lane-to-Lane Bundle Clock Sampling Period = per PCLK cycles
++	 *    set Mode Clock Source = PCLK is generated from REFCLK
++	 */
++	data = 0x0;
++	mask = MODE_CLK_SRC | BUNDLE_PERIOD_SEL | BUNDLE_PERIOD_SCALE_MASK |
++	       BUNDLE_SAMPLE_CTRL | PLL_READY_DLY_MASK;
++	comphy_lane_reg_set(lane, COMPHY_PIPE_CLK_SRC_LO, data, mask);
++
++	/*
++	 * 6. Set G2 Spread Spectrum Clock Amplitude at 4K
++	 */
++	comphy_lane_reg_set(lane, COMPHY_GEN2_SET2,
++			    GS2_TX_SSC_AMP_4128, GS2_TX_SSC_AMP_MASK);
++
++	/*
++	 * 7. Unset G3 Spread Spectrum Clock Amplitude
++	 *    set G3 TX and RX Register Master Current Select
++	 */
++	data = GS2_VREG_RXTX_MAS_ISET_60U;
++	mask = GS2_TX_SSC_AMP_MASK | GS2_VREG_RXTX_MAS_ISET_MASK |
++	       GS2_RSVD_6_0_MASK;
++	comphy_lane_reg_set(lane, COMPHY_GEN3_SET2, data, mask);
++
++	/*
++	 * 8. Check crystal jumper setting and program the Power and PLL Control
++	 * accordingly Change RX wait
++	 */
++	if (lane->priv->xtal_is_40m) {
++		ref_clk = REF_FREF_SEL_PCIE_USB3_40MHZ;
++		cfg = CFG_PM_RXDLOZ_WAIT_12_UNIT;
++	} else {
++		ref_clk = REF_FREF_SEL_PCIE_USB3_25MHZ;
++		cfg = CFG_PM_RXDLOZ_WAIT_7_UNIT;
++	}
++
++	data = PU_IVREF_BIT | PU_PLL_BIT | PU_RX_BIT | PU_TX_BIT |
++	       PU_TX_INTP_BIT | PU_DFE_BIT | COMPHY_MODE_USB3 | ref_clk;
++	mask = PU_IVREF_BIT | PU_PLL_BIT | PU_RX_BIT | PU_TX_BIT |
++	       PU_TX_INTP_BIT | PU_DFE_BIT | PLL_LOCK_BIT | COMPHY_MODE_MASK |
++	       REF_FREF_SEL_MASK;
++	comphy_lane_reg_set(lane, COMPHY_POWER_PLL_CTRL, data, mask);
++
++	data = CFG_PM_RXDEN_WAIT_1_UNIT | cfg;
++	mask = CFG_PM_OSCCLK_WAIT_MASK | CFG_PM_RXDEN_WAIT_MASK |
++	       CFG_PM_RXDLOZ_WAIT_MASK;
++	comphy_lane_reg_set(lane, COMPHY_PIPE_PWR_MGM_TIM1, data, mask);
++
++	/*
++	 * 9. Enable idle sync
++	 */
++	comphy_lane_reg_set(lane, COMPHY_IDLE_SYNC_EN,
++			    IDLE_SYNC_EN, IDLE_SYNC_EN);
++
++	/*
++	 * 10. Enable the output of 500M clock
++	 */
++	comphy_lane_reg_set(lane, COMPHY_MISC_CTRL0, CLK500M_EN, CLK500M_EN);
++
++	/*
++	 * 11. Set 20-bit data width
++	 */
++	comphy_lane_reg_set(lane, COMPHY_DIG_LOOPBACK_EN,
++			    DATA_WIDTH_20BIT, 0xFFFF);
++
++	/*
++	 * 12. Override Speed_PLL value and use MAC PLL
++	 */
++	data = SPEED_PLL_VALUE_16 | USE_MAX_PLL_RATE_BIT;
++	mask = 0xFFFF;
++	comphy_lane_reg_set(lane, COMPHY_KVCO_CAL_CTRL, data, mask);
++
++	/*
++	 * 13. Check the Polarity invert bit
++	 */
++	data = 0x0;
++	if (lane->invert_tx)
++		data |= TXD_INVERT_BIT;
++	if (lane->invert_rx)
++		data |= RXD_INVERT_BIT;
++	mask = TXD_INVERT_BIT | RXD_INVERT_BIT;
++	comphy_lane_reg_set(lane, COMPHY_SYNC_PATTERN, data, mask);
++
++	/*
++	 * 14. Set max speed generation to USB3.0 5Gbps
++	 */
++	comphy_lane_reg_set(lane, COMPHY_SYNC_MASK_GEN,
++			    PHY_GEN_MAX_USB3_5G, PHY_GEN_MAX_MASK);
++
++	/*
++	 * 15. Set capacitor value for FFE gain peaking to 0xF
++	 */
++	comphy_lane_reg_set(lane, COMPHY_GEN2_SET3,
++			    GS3_FFE_CAP_SEL_VALUE, GS3_FFE_CAP_SEL_MASK);
++
++	/*
++	 * 16. Release SW reset
++	 */
++	data = MODE_CORE_CLK_FREQ_SEL | MODE_PIPE_WIDTH_32 | MODE_REFDIV_BY_4;
++	mask = 0xFFFF;
++	comphy_lane_reg_set(lane, COMPHY_PIPE_RST_CLK_CTRL, data, mask);
++
++	/* Wait for > 55 us to allow PCLK be enabled */
++	udelay(PLL_SET_DELAY_US);
++
++	ret = comphy_lane_reg_poll(lane, COMPHY_PIPE_LANE_STAT1, TXDCLK_PCLK_EN,
++				   COMPHY_PLL_SLEEP, COMPHY_PLL_TIMEOUT);
++	if (ret)
++		dev_err(lane->dev, "Failed to lock USB3 PLL\n");
++
++	return ret;
++}
++
++static int
++mvebu_a3700_comphy_pcie_power_on(struct mvebu_a3700_comphy_lane *lane)
++{
++	u32 mask, data, ref_clk;
++	int ret;
++
++	/* Configure phy selector for PCIe */
++	ret = mvebu_a3700_comphy_set_phy_selector(lane);
++	if (ret)
++		return ret;
++
++	/* 1. Enable max PLL. */
++	comphy_lane_reg_set(lane, COMPHY_PIPE_LANE_CFG1,
++			    USE_MAX_PLL_RATE_EN, USE_MAX_PLL_RATE_EN);
++
++	/* 2. Select 20 bit SERDES interface. */
++	comphy_lane_reg_set(lane, COMPHY_PIPE_CLK_SRC_LO,
++			    CFG_SEL_20B, CFG_SEL_20B);
++
++	/* 3. Force to use reg setting for PCIe mode */
++	comphy_lane_reg_set(lane, COMPHY_MISC_CTRL1,
++			    SEL_BITS_PCIE_FORCE, SEL_BITS_PCIE_FORCE);
++
++	/* 4. Change RX wait */
++	data = CFG_PM_RXDEN_WAIT_1_UNIT | CFG_PM_RXDLOZ_WAIT_12_UNIT;
++	mask = CFG_PM_OSCCLK_WAIT_MASK | CFG_PM_RXDEN_WAIT_MASK |
++	       CFG_PM_RXDLOZ_WAIT_MASK;
++	comphy_lane_reg_set(lane, COMPHY_PIPE_PWR_MGM_TIM1, data, mask);
++
++	/* 5. Enable idle sync */
++	comphy_lane_reg_set(lane, COMPHY_IDLE_SYNC_EN,
++			    IDLE_SYNC_EN, IDLE_SYNC_EN);
++
++	/* 6. Enable the output of 100M/125M/500M clock */
++	data = CLK500M_EN | TXDCLK_2X_SEL | CLK100M_125M_EN;
++	mask = data;
++	comphy_lane_reg_set(lane, COMPHY_MISC_CTRL0, data, mask);
++
++	/*
++	 * 7. Enable TX, PCIE global register, 0xd0074814, it is done in
++	 * PCI-E driver
++	 */
++
++	/*
++	 * 8. Check crystal jumper setting and program the Power and PLL
++	 * Control accordingly
++	 */
++
++	if (lane->priv->xtal_is_40m)
++		ref_clk = REF_FREF_SEL_PCIE_USB3_40MHZ;
++	else
++		ref_clk = REF_FREF_SEL_PCIE_USB3_25MHZ;
++
++	data = PU_IVREF_BIT | PU_PLL_BIT | PU_RX_BIT | PU_TX_BIT |
++	       PU_TX_INTP_BIT | PU_DFE_BIT | COMPHY_MODE_PCIE | ref_clk;
++	mask = 0xFFFF;
++	comphy_lane_reg_set(lane, COMPHY_POWER_PLL_CTRL, data, mask);
++
++	/* 9. Override Speed_PLL value and use MAC PLL */
++	comphy_lane_reg_set(lane, COMPHY_KVCO_CAL_CTRL,
++			    SPEED_PLL_VALUE_16 | USE_MAX_PLL_RATE_BIT,
++			    0xFFFF);
++
++	/* 10. Check the Polarity invert bit */
++	data = 0x0;
++	if (lane->invert_tx)
++		data |= TXD_INVERT_BIT;
++	if (lane->invert_rx)
++		data |= RXD_INVERT_BIT;
++	mask = TXD_INVERT_BIT | RXD_INVERT_BIT;
++	comphy_lane_reg_set(lane, COMPHY_SYNC_PATTERN, data, mask);
++
++	/* 11. Release SW reset */
++	data = MODE_CORE_CLK_FREQ_SEL | MODE_PIPE_WIDTH_32;
++	mask = data | PIPE_SOFT_RESET | MODE_REFDIV_MASK;
++	comphy_lane_reg_set(lane, COMPHY_PIPE_RST_CLK_CTRL, data, mask);
++
++	/* Wait for > 55 us to allow PCLK be enabled */
++	udelay(PLL_SET_DELAY_US);
++
++	ret = comphy_lane_reg_poll(lane, COMPHY_PIPE_LANE_STAT1, TXDCLK_PCLK_EN,
++				   COMPHY_PLL_SLEEP, COMPHY_PLL_TIMEOUT);
++	if (ret)
++		dev_err(lane->dev, "Failed to lock PCIE PLL\n");
++
++	return ret;
++}
++
++static void
++mvebu_a3700_comphy_sata_power_off(struct mvebu_a3700_comphy_lane *lane)
++{
++	/* Set phy isolation mode */
++	comphy_lane_reg_set(lane, COMPHY_ISOLATION_CTRL,
++			    PHY_ISOLATE_MODE, PHY_ISOLATE_MODE);
++
++	/* Power off PLL, Tx, Rx */
++	comphy_lane_reg_set(lane, COMPHY_POWER_PLL_CTRL,
++			    0x0, PU_PLL_BIT | PU_RX_BIT | PU_TX_BIT);
++}
++
++static void
++mvebu_a3700_comphy_ethernet_power_off(struct mvebu_a3700_comphy_lane *lane)
++{
++	u32 mask, data;
++
++	data = PIN_RESET_CORE_BIT | PIN_RESET_COMPHY_BIT | PIN_PU_IVREF_BIT |
++	       PHY_RX_INIT_BIT;
++	mask = data;
++	comphy_periph_reg_set(lane, COMPHY_PHY_CFG1, data, mask);
++}
++
++static void
++mvebu_a3700_comphy_pcie_power_off(struct mvebu_a3700_comphy_lane *lane)
++{
++	/* Power off PLL, Tx, Rx */
++	comphy_lane_reg_set(lane, COMPHY_POWER_PLL_CTRL,
++			    0x0, PU_PLL_BIT | PU_RX_BIT | PU_TX_BIT);
++}
++
++static int mvebu_a3700_comphy_reset(struct phy *phy)
++{
++	struct mvebu_a3700_comphy_lane *lane = phy_get_drvdata(phy);
++	u16 mask, data;
++
++	dev_dbg(lane->dev, "resetting lane %d\n", lane->id);
++
++	/* COMPHY reset for internal logic */
++	comphy_lane_reg_set(lane, COMPHY_SFT_RESET,
++			    SFT_RST_NO_REG, SFT_RST_NO_REG);
++
++	/* COMPHY register reset (cleared automatically) */
++	comphy_lane_reg_set(lane, COMPHY_SFT_RESET, SFT_RST, SFT_RST);
++
++	/* PIPE soft and register reset */
++	data = PIPE_SOFT_RESET | PIPE_REG_RESET;
++	mask = data;
++	comphy_lane_reg_set(lane, COMPHY_PIPE_RST_CLK_CTRL, data, mask);
++
++	/* Release PIPE register reset */
++	comphy_lane_reg_set(lane, COMPHY_PIPE_RST_CLK_CTRL,
++			    0x0, PIPE_REG_RESET);
++
++	/* Reset SB configuration register (only for lanes 0 and 1) */
++	if (lane->id == 0 || lane->id == 1) {
++		u32 mask, data;
++
++		data = PIN_RESET_CORE_BIT | PIN_RESET_COMPHY_BIT |
++		       PIN_PU_PLL_BIT | PIN_PU_RX_BIT | PIN_PU_TX_BIT;
++		mask = data | PIN_PU_IVREF_BIT | PIN_TX_IDLE_BIT;
++		comphy_periph_reg_set(lane, COMPHY_PHY_CFG1, data, mask);
++	}
++
++	return 0;
++}
++
++static bool mvebu_a3700_comphy_check_mode(int lane,
+ 					  enum phy_mode mode,
+ 					  int submode)
+ {
+@@ -122,7 +1141,7 @@ static int mvebu_a3700_comphy_get_fw_mod
+ 
+ 	/* Unused PHY mux value is 0x0 */
+ 	if (mode == PHY_MODE_INVALID)
+-		return -EINVAL;
++		return false;
+ 
+ 	for (i = 0; i < n; i++) {
+ 		if (mvebu_a3700_comphy_modes[i].lane == lane &&
+@@ -132,27 +1151,30 @@ static int mvebu_a3700_comphy_get_fw_mod
+ 	}
+ 
+ 	if (i == n)
+-		return -EINVAL;
++		return false;
+ 
+-	return mvebu_a3700_comphy_modes[i].fw_mode;
++	return true;
+ }
+ 
+ static int mvebu_a3700_comphy_set_mode(struct phy *phy, enum phy_mode mode,
+ 				       int submode)
+ {
+ 	struct mvebu_a3700_comphy_lane *lane = phy_get_drvdata(phy);
+-	int fw_mode;
+ 
+-	if (submode == PHY_INTERFACE_MODE_1000BASEX)
+-		submode = PHY_INTERFACE_MODE_SGMII;
+-
+-	fw_mode = mvebu_a3700_comphy_get_fw_mode(lane->id, mode,
+-						 submode);
+-	if (fw_mode < 0) {
++	if (!mvebu_a3700_comphy_check_mode(lane->id, mode, submode)) {
+ 		dev_err(lane->dev, "invalid COMPHY mode\n");
+-		return fw_mode;
++		return -EINVAL;
+ 	}
+ 
++	/* Mode cannot be changed while the PHY is powered on */
++	if (phy->power_count &&
++	    (lane->mode != mode || lane->submode != submode))
++		return -EBUSY;
++
++	/* If changing mode, ensure reset is called */
++	if (lane->mode != PHY_MODE_INVALID && lane->mode != mode)
++		lane->needs_reset = true;
++
+ 	/* Just remember the mode, ->power_on() will do the real setup */
+ 	lane->mode = mode;
+ 	lane->submode = submode;
+@@ -163,76 +1185,77 @@ static int mvebu_a3700_comphy_set_mode(s
+ static int mvebu_a3700_comphy_power_on(struct phy *phy)
+ {
+ 	struct mvebu_a3700_comphy_lane *lane = phy_get_drvdata(phy);
+-	u32 fw_param;
+-	int fw_mode;
+-	int fw_port;
+ 	int ret;
+ 
+-	fw_mode = mvebu_a3700_comphy_get_fw_mode(lane->id,
+-						 lane->mode, lane->submode);
+-	if (fw_mode < 0) {
++	if (!mvebu_a3700_comphy_check_mode(lane->id, lane->mode,
++					   lane->submode)) {
+ 		dev_err(lane->dev, "invalid COMPHY mode\n");
+-		return fw_mode;
++		return -EINVAL;
++	}
++
++	if (lane->needs_reset) {
++		ret = mvebu_a3700_comphy_reset(phy);
++		if (ret)
++			return ret;
++
++		lane->needs_reset = false;
+ 	}
+ 
+ 	switch (lane->mode) {
+ 	case PHY_MODE_USB_HOST_SS:
+ 		dev_dbg(lane->dev, "set lane %d to USB3 host mode\n", lane->id);
+-		fw_param = COMPHY_FW_MODE(fw_mode);
+-		break;
++		return mvebu_a3700_comphy_usb3_power_on(lane);
+ 	case PHY_MODE_SATA:
+ 		dev_dbg(lane->dev, "set lane %d to SATA mode\n", lane->id);
+-		fw_param = COMPHY_FW_MODE(fw_mode);
+-		break;
++		return mvebu_a3700_comphy_sata_power_on(lane);
+ 	case PHY_MODE_ETHERNET:
+-		fw_port = (lane->id == 0) ? 1 : 0;
+-		switch (lane->submode) {
+-		case PHY_INTERFACE_MODE_SGMII:
+-			dev_dbg(lane->dev, "set lane %d to SGMII mode\n",
+-				lane->id);
+-			fw_param = COMPHY_FW_NET(fw_mode, fw_port,
+-						 COMPHY_FW_SPEED_1_25G);
+-			break;
+-		case PHY_INTERFACE_MODE_2500BASEX:
+-			dev_dbg(lane->dev, "set lane %d to 2500BASEX mode\n",
+-				lane->id);
+-			fw_param = COMPHY_FW_NET(fw_mode, fw_port,
+-						 COMPHY_FW_SPEED_3_125G);
+-			break;
+-		default:
+-			dev_err(lane->dev, "unsupported PHY submode (%d)\n",
+-				lane->submode);
+-			return -ENOTSUPP;
+-		}
+-		break;
++		dev_dbg(lane->dev, "set lane %d to Ethernet mode\n", lane->id);
++		return mvebu_a3700_comphy_ethernet_power_on(lane);
+ 	case PHY_MODE_PCIE:
+ 		dev_dbg(lane->dev, "set lane %d to PCIe mode\n", lane->id);
+-		fw_param = COMPHY_FW_PCIE(fw_mode, COMPHY_FW_SPEED_5G,
+-					  phy->attrs.bus_width);
+-		break;
++		return mvebu_a3700_comphy_pcie_power_on(lane);
+ 	default:
+ 		dev_err(lane->dev, "unsupported PHY mode (%d)\n", lane->mode);
+-		return -ENOTSUPP;
++		return -EOPNOTSUPP;
+ 	}
+-
+-	ret = mvebu_a3700_comphy_smc(COMPHY_SIP_POWER_ON, lane->id, fw_param);
+-	if (ret == -EOPNOTSUPP)
+-		dev_err(lane->dev,
+-			"unsupported SMC call, try updating your firmware\n");
+-
+-	return ret;
+ }
+ 
+ static int mvebu_a3700_comphy_power_off(struct phy *phy)
+ {
+ 	struct mvebu_a3700_comphy_lane *lane = phy_get_drvdata(phy);
+ 
+-	return mvebu_a3700_comphy_smc(COMPHY_SIP_POWER_OFF, lane->id, 0);
++	switch (lane->mode) {
++	case PHY_MODE_USB_HOST_SS:
++		/*
++		 * The USB3 MAC sets the USB3 PHY to low state, so we do not
++		 * need to power off USB3 PHY again.
++		 */
++		break;
++
++	case PHY_MODE_SATA:
++		mvebu_a3700_comphy_sata_power_off(lane);
++		break;
++
++	case PHY_MODE_ETHERNET:
++		mvebu_a3700_comphy_ethernet_power_off(lane);
++		break;
++
++	case PHY_MODE_PCIE:
++		mvebu_a3700_comphy_pcie_power_off(lane);
++		break;
++
++	default:
++		dev_err(lane->dev, "invalid COMPHY mode\n");
++		return -EINVAL;
++	}
++
++	return 0;
+ }
+ 
+ static const struct phy_ops mvebu_a3700_comphy_ops = {
+ 	.power_on	= mvebu_a3700_comphy_power_on,
+ 	.power_off	= mvebu_a3700_comphy_power_off,
++	.reset		= mvebu_a3700_comphy_reset,
+ 	.set_mode	= mvebu_a3700_comphy_set_mode,
+ 	.owner		= THIS_MODULE,
+ };
+@@ -256,13 +1279,75 @@ static struct phy *mvebu_a3700_comphy_xl
+ 		return ERR_PTR(-EINVAL);
+ 	}
+ 
++	lane->invert_tx = args->args[1] & BIT(0);
++	lane->invert_rx = args->args[1] & BIT(1);
++
+ 	return phy;
+ }
+ 
+ static int mvebu_a3700_comphy_probe(struct platform_device *pdev)
+ {
++	struct mvebu_a3700_comphy_priv *priv;
+ 	struct phy_provider *provider;
+ 	struct device_node *child;
++	struct resource *res;
++	struct clk *clk;
++	int ret;
++
++	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	spin_lock_init(&priv->lock);
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "comphy");
++	priv->comphy_regs = devm_ioremap_resource(&pdev->dev, res);
++	if (IS_ERR(priv->comphy_regs))
++		return PTR_ERR(priv->comphy_regs);
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
++					   "lane1_pcie_gbe");
++	priv->lane1_phy_regs = devm_ioremap_resource(&pdev->dev, res);
++	if (IS_ERR(priv->lane1_phy_regs))
++		return PTR_ERR(priv->lane1_phy_regs);
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
++					   "lane0_usb3_gbe");
++	priv->lane0_phy_regs = devm_ioremap_resource(&pdev->dev, res);
++	if (IS_ERR(priv->lane0_phy_regs))
++		return PTR_ERR(priv->lane0_phy_regs);
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
++					   "lane2_sata_usb3");
++	priv->lane2_phy_indirect = devm_ioremap_resource(&pdev->dev, res);
++	if (IS_ERR(priv->lane2_phy_indirect))
++		return PTR_ERR(priv->lane2_phy_indirect);
++
++	/*
++	 * Driver needs to know if reference xtal clock is 40MHz or 25MHz.
++	 * Old DT bindings do not have xtal clk present. So do not fail here
++	 * and expects that default 25MHz reference clock is used.
++	 */
++	clk = clk_get(&pdev->dev, "xtal");
++	if (IS_ERR(clk)) {
++		if (PTR_ERR(clk) == -EPROBE_DEFER)
++			return -EPROBE_DEFER;
++		dev_warn(&pdev->dev, "missing 'xtal' clk (%ld)\n",
++			 PTR_ERR(clk));
++	} else {
++		ret = clk_prepare_enable(clk);
++		if (ret) {
++			dev_warn(&pdev->dev, "enabling xtal clk failed (%d)\n",
++				 ret);
++		} else {
++			if (clk_get_rate(clk) == 40000000)
++				priv->xtal_is_40m = true;
++			clk_disable_unprepare(clk);
++		}
++		clk_put(clk);
++	}
++
++	dev_set_drvdata(&pdev->dev, priv);
+ 
+ 	for_each_available_child_of_node(pdev->dev.of_node, child) {
+ 		struct mvebu_a3700_comphy_lane *lane;
+@@ -277,7 +1362,7 @@ static int mvebu_a3700_comphy_probe(stru
+ 			continue;
+ 		}
+ 
+-		if (lane_id >= MVEBU_A3700_COMPHY_LANES) {
++		if (lane_id >= 3) {
+ 			dev_err(&pdev->dev, "invalid 'reg' property\n");
+ 			continue;
+ 		}
+@@ -295,15 +1380,26 @@ static int mvebu_a3700_comphy_probe(stru
+ 			return PTR_ERR(phy);
+ 		}
+ 
++		lane->priv = priv;
+ 		lane->dev = &pdev->dev;
+ 		lane->mode = PHY_MODE_INVALID;
+ 		lane->submode = PHY_INTERFACE_MODE_NA;
+ 		lane->id = lane_id;
++		lane->invert_tx = false;
++		lane->invert_rx = false;
+ 		phy_set_drvdata(phy, lane);
++
++		/*
++		 * To avoid relying on the bootloader/firmware configuration,
++		 * power off all comphys.
++		 */
++		mvebu_a3700_comphy_reset(phy);
++		lane->needs_reset = false;
+ 	}
+ 
+ 	provider = devm_of_phy_provider_register(&pdev->dev,
+ 						 mvebu_a3700_comphy_xlate);
++
+ 	return PTR_ERR_OR_ZERO(provider);
+ }
+ 
+@@ -323,5 +1419,7 @@ static struct platform_driver mvebu_a370
+ module_platform_driver(mvebu_a3700_comphy_driver);
+ 
+ MODULE_AUTHOR("Miquèl Raynal <miquel.raynal@bootlin.com>");
++MODULE_AUTHOR("Pali Rohár <pali@kernel.org>");
++MODULE_AUTHOR("Marek Behún <kabel@kernel.org>");
+ MODULE_DESCRIPTION("Common PHY driver for A3700");
+ MODULE_LICENSE("GPL v2");
diff --git a/target/linux/generic/backport-5.15/345-v5.17-arm64-dts-marvell-armada-37xx-Add-xtal-clock-to-comp.patch b/target/linux/generic/backport-5.15/345-v5.17-arm64-dts-marvell-armada-37xx-Add-xtal-clock-to-comp.patch
new file mode 100644
index 00000000000000..03b6a5754d96fc
--- /dev/null
+++ b/target/linux/generic/backport-5.15/345-v5.17-arm64-dts-marvell-armada-37xx-Add-xtal-clock-to-comp.patch
@@ -0,0 +1,32 @@
+From 73a78b6130d9e13daca22b86ad52f063b9403e03 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
+Date: Wed, 8 Dec 2021 03:40:35 +0100
+Subject: [PATCH 1/1] arm64: dts: marvell: armada-37xx: Add xtal clock to
+ comphy node
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Kernel driver phy-mvebu-a3700-comphy.c needs to know the rate of the
+reference xtal clock. So add missing xtal clock source into comphy device
+tree node. If the property is not present, the driver defaults to 25 MHz
+xtal rate (which, as far as we know, is used by all the existing boards).
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+---
+ arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
++++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+@@ -265,6 +265,8 @@
+ 					    "lane2_sata_usb3";
+ 				#address-cells = <1>;
+ 				#size-cells = <0>;
++				clocks = <&xtalclk>;
++				clock-names = "xtal";
+ 
+ 				comphy0: phy@0 {
+ 					reg = <0>;
diff --git a/target/linux/generic/backport-5.15/346-v5.18-01-Revert-ata-ahci-mvebu-Make-SATA-PHY-optional-for-Arm.patch b/target/linux/generic/backport-5.15/346-v5.18-01-Revert-ata-ahci-mvebu-Make-SATA-PHY-optional-for-Arm.patch
new file mode 100644
index 00000000000000..f225a210570194
--- /dev/null
+++ b/target/linux/generic/backport-5.15/346-v5.18-01-Revert-ata-ahci-mvebu-Make-SATA-PHY-optional-for-Arm.patch
@@ -0,0 +1,64 @@
+From ee995101fde67f85a3cd4c74f4f92fc4592e726b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
+Date: Thu, 3 Feb 2022 22:44:42 +0100
+Subject: [PATCH 1/3] Revert "ata: ahci: mvebu: Make SATA PHY optional for
+ Armada 3720"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This reverts commit 45aefe3d2251e4e229d7662052739f96ad1d08d9.
+
+Armada 3720 PHY driver (phy-mvebu-a3700-comphy.c) does not return
+-EOPNOTSUPP from phy_power_on() callback anymore.
+
+So remove AHCI_HFLAG_IGN_NOTSUPP_POWER_ON flag from Armada 3720 plat data.
+
+AHCI_HFLAG_IGN_NOTSUPP_POWER_ON is not used by any other ahci driver, so
+remove this flag completely.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Acked-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Acked-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Link: https://lore.kernel.org/r/20220203214444.1508-4-kabel@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+---
+ drivers/ata/ahci.h             | 2 --
+ drivers/ata/ahci_mvebu.c       | 2 +-
+ drivers/ata/libahci_platform.c | 2 +-
+ 3 files changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/ata/ahci.h
++++ b/drivers/ata/ahci.h
+@@ -241,8 +241,6 @@ enum {
+ 						      as default lpm_policy */
+ 	AHCI_HFLAG_SUSPEND_PHYS		= BIT(26), /* handle PHYs during
+ 						      suspend/resume */
+-	AHCI_HFLAG_IGN_NOTSUPP_POWER_ON	= BIT(27), /* ignore -EOPNOTSUPP
+-						      from phy_power_on() */
+ 	AHCI_HFLAG_NO_SXS		= BIT(28), /* SXS not supported */
+ 
+ 	/* ap->flags bits */
+--- a/drivers/ata/ahci_mvebu.c
++++ b/drivers/ata/ahci_mvebu.c
+@@ -227,7 +227,7 @@ static const struct ahci_mvebu_plat_data
+ 
+ static const struct ahci_mvebu_plat_data ahci_mvebu_armada_3700_plat_data = {
+ 	.plat_config = ahci_mvebu_armada_3700_config,
+-	.flags = AHCI_HFLAG_SUSPEND_PHYS | AHCI_HFLAG_IGN_NOTSUPP_POWER_ON,
++	.flags = AHCI_HFLAG_SUSPEND_PHYS,
+ };
+ 
+ static const struct of_device_id ahci_mvebu_of_match[] = {
+--- a/drivers/ata/libahci_platform.c
++++ b/drivers/ata/libahci_platform.c
+@@ -59,7 +59,7 @@ int ahci_platform_enable_phys(struct ahc
+ 		}
+ 
+ 		rc = phy_power_on(hpriv->phys[i]);
+-		if (rc && !(rc == -EOPNOTSUPP && (hpriv->flags & AHCI_HFLAG_IGN_NOTSUPP_POWER_ON))) {
++		if (rc) {
+ 			phy_exit(hpriv->phys[i]);
+ 			goto disable_phys;
+ 		}
diff --git a/target/linux/generic/backport-5.15/346-v5.18-02-Revert-usb-host-xhci-mvebu-make-USB-3.0-PHY-optional.patch b/target/linux/generic/backport-5.15/346-v5.18-02-Revert-usb-host-xhci-mvebu-make-USB-3.0-PHY-optional.patch
new file mode 100644
index 00000000000000..1e8afb7bbf574f
--- /dev/null
+++ b/target/linux/generic/backport-5.15/346-v5.18-02-Revert-usb-host-xhci-mvebu-make-USB-3.0-PHY-optional.patch
@@ -0,0 +1,166 @@
+From 8e10548f7f4814e530857d2049d6af6bc78add53 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
+Date: Thu, 3 Feb 2022 22:44:43 +0100
+Subject: [PATCH 2/3] Revert "usb: host: xhci: mvebu: make USB 3.0 PHY optional
+ for Armada 3720"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This reverts commit 3241929b67d28c83945d3191c6816a3271fd6b85.
+
+Armada 3720 phy driver (phy-mvebu-a3700-comphy.c) does not return
+-EOPNOTSUPP from phy_power_on() callback anymore.
+
+So remove XHCI_SKIP_PHY_INIT flag from xhci_mvebu_a3700_plat_setup() and
+then also whole xhci_mvebu_a3700_plat_setup() function which is there just
+to handle -EOPNOTSUPP for XHCI_SKIP_PHY_INIT.
+
+xhci plat_setup callback is not used by any other xhci plat driver, so
+remove this callback completely.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Acked-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20220203214444.1508-5-kabel@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+---
+ drivers/usb/host/xhci-mvebu.c | 42 -----------------------------------
+ drivers/usb/host/xhci-mvebu.h |  6 -----
+ drivers/usb/host/xhci-plat.c  | 20 +----------------
+ drivers/usb/host/xhci-plat.h  |  1 -
+ 4 files changed, 1 insertion(+), 68 deletions(-)
+
+--- a/drivers/usb/host/xhci-mvebu.c
++++ b/drivers/usb/host/xhci-mvebu.c
+@@ -8,7 +8,6 @@
+ #include <linux/mbus.h>
+ #include <linux/of.h>
+ #include <linux/platform_device.h>
+-#include <linux/phy/phy.h>
+ 
+ #include <linux/usb.h>
+ #include <linux/usb/hcd.h>
+@@ -74,47 +73,6 @@ int xhci_mvebu_mbus_init_quirk(struct us
+ 
+ 	return 0;
+ }
+-
+-int xhci_mvebu_a3700_plat_setup(struct usb_hcd *hcd)
+-{
+-	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+-	struct device *dev = hcd->self.controller;
+-	struct phy *phy;
+-	int ret;
+-
+-	/* Old bindings miss the PHY handle */
+-	phy = of_phy_get(dev->of_node, "usb3-phy");
+-	if (IS_ERR(phy) && PTR_ERR(phy) == -EPROBE_DEFER)
+-		return -EPROBE_DEFER;
+-	else if (IS_ERR(phy))
+-		goto phy_out;
+-
+-	ret = phy_init(phy);
+-	if (ret)
+-		goto phy_put;
+-
+-	ret = phy_set_mode(phy, PHY_MODE_USB_HOST_SS);
+-	if (ret)
+-		goto phy_exit;
+-
+-	ret = phy_power_on(phy);
+-	if (ret == -EOPNOTSUPP) {
+-		/* Skip initializatin of XHCI PHY when it is unsupported by firmware */
+-		dev_warn(dev, "PHY unsupported by firmware\n");
+-		xhci->quirks |= XHCI_SKIP_PHY_INIT;
+-	}
+-	if (ret)
+-		goto phy_exit;
+-
+-	phy_power_off(phy);
+-phy_exit:
+-	phy_exit(phy);
+-phy_put:
+-	of_phy_put(phy);
+-phy_out:
+-
+-	return 0;
+-}
+ 
+ int xhci_mvebu_a3700_init_quirk(struct usb_hcd *hcd)
+ {
+--- a/drivers/usb/host/xhci-mvebu.h
++++ b/drivers/usb/host/xhci-mvebu.h
+@@ -12,18 +12,12 @@ struct usb_hcd;
+ 
+ #if IS_ENABLED(CONFIG_USB_XHCI_MVEBU)
+ int xhci_mvebu_mbus_init_quirk(struct usb_hcd *hcd);
+-int xhci_mvebu_a3700_plat_setup(struct usb_hcd *hcd);
+ int xhci_mvebu_a3700_init_quirk(struct usb_hcd *hcd);
+ #else
+ static inline int xhci_mvebu_mbus_init_quirk(struct usb_hcd *hcd)
+ {
+ 	return 0;
+ }
+-
+-static inline int xhci_mvebu_a3700_plat_setup(struct usb_hcd *hcd)
+-{
+-	return 0;
+-}
+ 
+ static inline int xhci_mvebu_a3700_init_quirk(struct usb_hcd *hcd)
+ {
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -44,16 +44,6 @@ static void xhci_priv_plat_start(struct
+ 		priv->plat_start(hcd);
+ }
+ 
+-static int xhci_priv_plat_setup(struct usb_hcd *hcd)
+-{
+-	struct xhci_plat_priv *priv = hcd_to_xhci_priv(hcd);
+-
+-	if (!priv->plat_setup)
+-		return 0;
+-
+-	return priv->plat_setup(hcd);
+-}
+-
+ static int xhci_priv_init_quirk(struct usb_hcd *hcd)
+ {
+ 	struct xhci_plat_priv *priv = hcd_to_xhci_priv(hcd);
+@@ -121,7 +111,6 @@ static const struct xhci_plat_priv xhci_
+ };
+ 
+ static const struct xhci_plat_priv xhci_plat_marvell_armada3700 = {
+-	.plat_setup = xhci_mvebu_a3700_plat_setup,
+ 	.init_quirk = xhci_mvebu_a3700_init_quirk,
+ };
+ 
+@@ -341,14 +330,7 @@ static int xhci_plat_probe(struct platfo
+ 
+ 	hcd->tpl_support = of_usb_host_tpl_support(sysdev->of_node);
+ 	xhci->shared_hcd->tpl_support = hcd->tpl_support;
+-
+-	if (priv) {
+-		ret = xhci_priv_plat_setup(hcd);
+-		if (ret)
+-			goto disable_usb_phy;
+-	}
+-
+-	if ((xhci->quirks & XHCI_SKIP_PHY_INIT) || (priv && (priv->quirks & XHCI_SKIP_PHY_INIT)))
++	if (priv && (priv->quirks & XHCI_SKIP_PHY_INIT))
+ 		hcd->skip_phy_initialization = 1;
+ 
+ 	if (priv && (priv->quirks & XHCI_SG_TRB_CACHE_SIZE_QUIRK))
+--- a/drivers/usb/host/xhci-plat.h
++++ b/drivers/usb/host/xhci-plat.h
+@@ -13,7 +13,6 @@
+ struct xhci_plat_priv {
+ 	const char *firmware_name;
+ 	unsigned long long quirks;
+-	int (*plat_setup)(struct usb_hcd *);
+ 	void (*plat_start)(struct usb_hcd *);
+ 	int (*init_quirk)(struct usb_hcd *);
+ 	int (*suspend_quirk)(struct usb_hcd *);
diff --git a/target/linux/generic/backport-5.15/346-v5.18-03-Revert-PCI-aardvark-Fix-initialization-with-old-Marv.patch b/target/linux/generic/backport-5.15/346-v5.18-03-Revert-PCI-aardvark-Fix-initialization-with-old-Marv.patch
new file mode 100644
index 00000000000000..fcfb02d35a1f22
--- /dev/null
+++ b/target/linux/generic/backport-5.15/346-v5.18-03-Revert-PCI-aardvark-Fix-initialization-with-old-Marv.patch
@@ -0,0 +1,39 @@
+From 9a4556dad7bd0a6b8339cb72e169f5c76f2af6f1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
+Date: Thu, 3 Feb 2022 22:44:44 +0100
+Subject: [PATCH 3/3] Revert "PCI: aardvark: Fix initialization with old
+ Marvell's Arm Trusted Firmware"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This reverts commit b0c6ae0f8948a2be6bf4e8b4bbab9ca1343289b6.
+
+Armada 3720 phy driver (phy-mvebu-a3700-comphy.c) does not return
+-EOPNOTSUPP from phy_power_on() callback anymore.
+
+So remove dead code which handles -EOPNOTSUPP return value.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Acked-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Acked-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Link: https://lore.kernel.org/r/20220203214444.1508-6-kabel@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+---
+ drivers/pci/controller/pci-aardvark.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/pci/controller/pci-aardvark.c
++++ b/drivers/pci/controller/pci-aardvark.c
+@@ -1642,9 +1642,7 @@ static int advk_pcie_enable_phy(struct a
+ 	}
+ 
+ 	ret = phy_power_on(pcie->phy);
+-	if (ret == -EOPNOTSUPP) {
+-		dev_warn(&pcie->pdev->dev, "PHY unsupported by firmware\n");
+-	} else if (ret) {
++	if (ret) {
+ 		phy_exit(pcie->phy);
+ 		return ret;
+ 	}
diff --git a/target/linux/generic/backport-5.15/347-v6.0-phy-marvell-phy-mvebu-a3700-comphy-Remove-broken-res.patch b/target/linux/generic/backport-5.15/347-v6.0-phy-marvell-phy-mvebu-a3700-comphy-Remove-broken-res.patch
new file mode 100644
index 00000000000000..a2c897b7a9aada
--- /dev/null
+++ b/target/linux/generic/backport-5.15/347-v6.0-phy-marvell-phy-mvebu-a3700-comphy-Remove-broken-res.patch
@@ -0,0 +1,194 @@
+From 0a6fc70d76bddf98278af2ac000379c82aec8f11 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
+Date: Mon, 29 Aug 2022 10:30:46 +0200
+Subject: [PATCH] phy: marvell: phy-mvebu-a3700-comphy: Remove broken reset
+ support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reset support for SATA PHY is somehow broken and after calling it, kernel
+is not able to detect and initialize SATA disk Samsung SSD 850 EMT0 [1].
+
+Reset support was introduced in commit 934337080c6c ("phy: marvell:
+phy-mvebu-a3700-comphy: Add native kernel implementation") as part of
+complete rewrite of this driver. v1 patch series of that commit [2] did
+not contain reset support and was tested that is working fine with
+Ethernet, SATA and USB PHYs without issues too.
+
+So for now remove broken reset support and change implementation of
+power_off callback to power off all functions on specified lane (and not
+only selected function) because during startup kernel does not know which
+function was selected and configured by bootloader. Same logic was used
+also in v1 patch series of that commit.
+
+This change fixes issues with initialization of SATA disk Samsung SSD 850
+and disk is working again, like before mentioned commit.
+
+Once problem with PHY reset callback is solved its functionality could be
+re-introduced. But for now it is unknown why it does not work.
+
+[1] - https://lore.kernel.org/r/20220531124159.3e4lgn2v462irbtz@shindev/
+[2] - https://lore.kernel.org/r/20211028184242.22105-1-kabel@kernel.org/
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Fixes: 934337080c6c ("phy: marvell: phy-mvebu-a3700-comphy: Add native kernel implementation")
+Cc: stable@vger.kernel.org # v5.18+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Tested-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Link: https://lore.kernel.org/r/20220829083046.15082-1-pali@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+---
+ drivers/phy/marvell/phy-mvebu-a3700-comphy.c | 87 ++++----------------
+ 1 file changed, 17 insertions(+), 70 deletions(-)
+
+--- a/drivers/phy/marvell/phy-mvebu-a3700-comphy.c
++++ b/drivers/phy/marvell/phy-mvebu-a3700-comphy.c
+@@ -274,7 +274,6 @@ struct mvebu_a3700_comphy_lane {
+ 	int submode;
+ 	bool invert_tx;
+ 	bool invert_rx;
+-	bool needs_reset;
+ };
+ 
+ struct gbe_phy_init_data_fix {
+@@ -1097,40 +1096,12 @@ mvebu_a3700_comphy_pcie_power_off(struct
+ 			    0x0, PU_PLL_BIT | PU_RX_BIT | PU_TX_BIT);
+ }
+ 
+-static int mvebu_a3700_comphy_reset(struct phy *phy)
++static void mvebu_a3700_comphy_usb3_power_off(struct mvebu_a3700_comphy_lane *lane)
+ {
+-	struct mvebu_a3700_comphy_lane *lane = phy_get_drvdata(phy);
+-	u16 mask, data;
+-
+-	dev_dbg(lane->dev, "resetting lane %d\n", lane->id);
+-
+-	/* COMPHY reset for internal logic */
+-	comphy_lane_reg_set(lane, COMPHY_SFT_RESET,
+-			    SFT_RST_NO_REG, SFT_RST_NO_REG);
+-
+-	/* COMPHY register reset (cleared automatically) */
+-	comphy_lane_reg_set(lane, COMPHY_SFT_RESET, SFT_RST, SFT_RST);
+-
+-	/* PIPE soft and register reset */
+-	data = PIPE_SOFT_RESET | PIPE_REG_RESET;
+-	mask = data;
+-	comphy_lane_reg_set(lane, COMPHY_PIPE_RST_CLK_CTRL, data, mask);
+-
+-	/* Release PIPE register reset */
+-	comphy_lane_reg_set(lane, COMPHY_PIPE_RST_CLK_CTRL,
+-			    0x0, PIPE_REG_RESET);
+-
+-	/* Reset SB configuration register (only for lanes 0 and 1) */
+-	if (lane->id == 0 || lane->id == 1) {
+-		u32 mask, data;
+-
+-		data = PIN_RESET_CORE_BIT | PIN_RESET_COMPHY_BIT |
+-		       PIN_PU_PLL_BIT | PIN_PU_RX_BIT | PIN_PU_TX_BIT;
+-		mask = data | PIN_PU_IVREF_BIT | PIN_TX_IDLE_BIT;
+-		comphy_periph_reg_set(lane, COMPHY_PHY_CFG1, data, mask);
+-	}
+-
+-	return 0;
++	/*
++	 * The USB3 MAC sets the USB3 PHY to low state, so we do not
++	 * need to power off USB3 PHY again.
++	 */
+ }
+ 
+ static bool mvebu_a3700_comphy_check_mode(int lane,
+@@ -1171,10 +1142,6 @@ static int mvebu_a3700_comphy_set_mode(s
+ 	    (lane->mode != mode || lane->submode != submode))
+ 		return -EBUSY;
+ 
+-	/* If changing mode, ensure reset is called */
+-	if (lane->mode != PHY_MODE_INVALID && lane->mode != mode)
+-		lane->needs_reset = true;
+-
+ 	/* Just remember the mode, ->power_on() will do the real setup */
+ 	lane->mode = mode;
+ 	lane->submode = submode;
+@@ -1185,7 +1152,6 @@ static int mvebu_a3700_comphy_set_mode(s
+ static int mvebu_a3700_comphy_power_on(struct phy *phy)
+ {
+ 	struct mvebu_a3700_comphy_lane *lane = phy_get_drvdata(phy);
+-	int ret;
+ 
+ 	if (!mvebu_a3700_comphy_check_mode(lane->id, lane->mode,
+ 					   lane->submode)) {
+@@ -1193,14 +1159,6 @@ static int mvebu_a3700_comphy_power_on(s
+ 		return -EINVAL;
+ 	}
+ 
+-	if (lane->needs_reset) {
+-		ret = mvebu_a3700_comphy_reset(phy);
+-		if (ret)
+-			return ret;
+-
+-		lane->needs_reset = false;
+-	}
+-
+ 	switch (lane->mode) {
+ 	case PHY_MODE_USB_HOST_SS:
+ 		dev_dbg(lane->dev, "set lane %d to USB3 host mode\n", lane->id);
+@@ -1224,38 +1182,28 @@ static int mvebu_a3700_comphy_power_off(
+ {
+ 	struct mvebu_a3700_comphy_lane *lane = phy_get_drvdata(phy);
+ 
+-	switch (lane->mode) {
+-	case PHY_MODE_USB_HOST_SS:
+-		/*
+-		 * The USB3 MAC sets the USB3 PHY to low state, so we do not
+-		 * need to power off USB3 PHY again.
+-		 */
+-		break;
+-
+-	case PHY_MODE_SATA:
+-		mvebu_a3700_comphy_sata_power_off(lane);
+-		break;
+-
+-	case PHY_MODE_ETHERNET:
++	switch (lane->id) {
++	case 0:
++		mvebu_a3700_comphy_usb3_power_off(lane);
+ 		mvebu_a3700_comphy_ethernet_power_off(lane);
+-		break;
+-
+-	case PHY_MODE_PCIE:
++		return 0;
++	case 1:
+ 		mvebu_a3700_comphy_pcie_power_off(lane);
+-		break;
+-
++		mvebu_a3700_comphy_ethernet_power_off(lane);
++		return 0;
++	case 2:
++		mvebu_a3700_comphy_usb3_power_off(lane);
++		mvebu_a3700_comphy_sata_power_off(lane);
++		return 0;
+ 	default:
+ 		dev_err(lane->dev, "invalid COMPHY mode\n");
+ 		return -EINVAL;
+ 	}
+-
+-	return 0;
+ }
+ 
+ static const struct phy_ops mvebu_a3700_comphy_ops = {
+ 	.power_on	= mvebu_a3700_comphy_power_on,
+ 	.power_off	= mvebu_a3700_comphy_power_off,
+-	.reset		= mvebu_a3700_comphy_reset,
+ 	.set_mode	= mvebu_a3700_comphy_set_mode,
+ 	.owner		= THIS_MODULE,
+ };
+@@ -1393,8 +1341,7 @@ static int mvebu_a3700_comphy_probe(stru
+ 		 * To avoid relying on the bootloader/firmware configuration,
+ 		 * power off all comphys.
+ 		 */
+-		mvebu_a3700_comphy_reset(phy);
+-		lane->needs_reset = false;
++		mvebu_a3700_comphy_power_off(phy);
+ 	}
+ 
+ 	provider = devm_of_phy_provider_register(&pdev->dev,
diff --git a/target/linux/generic/backport-5.15/350-v5.18-regmap-add-configurable-downshift-for-addresses.patch b/target/linux/generic/backport-5.15/350-v5.18-regmap-add-configurable-downshift-for-addresses.patch
new file mode 100644
index 00000000000000..690e85d34bec4f
--- /dev/null
+++ b/target/linux/generic/backport-5.15/350-v5.18-regmap-add-configurable-downshift-for-addresses.patch
@@ -0,0 +1,90 @@
+From 86fc59ef818beb0e1945d17f8e734898baba7e4e Mon Sep 17 00:00:00 2001
+From: Colin Foster <colin.foster@in-advantage.com>
+Date: Sun, 13 Mar 2022 15:45:23 -0700
+Subject: [PATCH 1/2] regmap: add configurable downshift for addresses
+
+Add an additional reg_downshift to be applied to register addresses before
+any register accesses. An example of a device that uses this is a VSC7514
+chip, which require each register address to be downshifted by two if the
+access is performed over a SPI bus.
+
+Signed-off-by: Colin Foster <colin.foster@in-advantage.com>
+Link: https://lore.kernel.org/r/20220313224524.399947-2-colin.foster@in-advantage.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+---
+ drivers/base/regmap/internal.h | 1 +
+ drivers/base/regmap/regmap.c   | 5 +++++
+ include/linux/regmap.h         | 3 +++
+ 3 files changed, 9 insertions(+)
+
+--- a/drivers/base/regmap/internal.h
++++ b/drivers/base/regmap/internal.h
+@@ -31,6 +31,7 @@ struct regmap_format {
+ 	size_t buf_size;
+ 	size_t reg_bytes;
+ 	size_t pad_bytes;
++	size_t reg_downshift;
+ 	size_t val_bytes;
+ 	void (*format_write)(struct regmap *map,
+ 			     unsigned int reg, unsigned int val);
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -823,6 +823,7 @@ struct regmap *__regmap_init(struct devi
+ 
+ 	map->format.reg_bytes = DIV_ROUND_UP(config->reg_bits, 8);
+ 	map->format.pad_bytes = config->pad_bits / 8;
++	map->format.reg_downshift = config->reg_downshift;
+ 	map->format.val_bytes = DIV_ROUND_UP(config->val_bits, 8);
+ 	map->format.buf_size = DIV_ROUND_UP(config->reg_bits +
+ 			config->val_bits + config->pad_bits, 8);
+@@ -1735,6 +1736,7 @@ static int _regmap_raw_write_impl(struct
+ 			return ret;
+ 	}
+ 
++	reg >>= map->format.reg_downshift;
+ 	map->format.format_reg(map->work_buf, reg, map->reg_shift);
+ 	regmap_set_work_buf_flag_mask(map, map->format.reg_bytes,
+ 				      map->write_flag_mask);
+@@ -1905,6 +1907,7 @@ static int _regmap_bus_formatted_write(v
+ 			return ret;
+ 	}
+ 
++	reg >>= map->format.reg_downshift;
+ 	map->format.format_write(map, reg, val);
+ 
+ 	trace_regmap_hw_write_start(map, reg, 1);
+@@ -2348,6 +2351,7 @@ static int _regmap_raw_multi_reg_write(s
+ 		unsigned int reg = regs[i].reg;
+ 		unsigned int val = regs[i].def;
+ 		trace_regmap_hw_write_start(map, reg, 1);
++		reg >>= map->format.reg_downshift;
+ 		map->format.format_reg(u8, reg, map->reg_shift);
+ 		u8 += reg_bytes + pad_bytes;
+ 		map->format.format_val(u8, val, 0);
+@@ -2675,6 +2679,7 @@ static int _regmap_raw_read(struct regma
+ 			return ret;
+ 	}
+ 
++	reg >>= map->format.reg_downshift;
+ 	map->format.format_reg(map->work_buf, reg, map->reg_shift);
+ 	regmap_set_work_buf_flag_mask(map, map->format.reg_bytes,
+ 				      map->read_flag_mask);
+--- a/include/linux/regmap.h
++++ b/include/linux/regmap.h
+@@ -237,6 +237,8 @@ typedef void (*regmap_unlock)(void *);
+  * @reg_stride: The register address stride. Valid register addresses are a
+  *              multiple of this value. If set to 0, a value of 1 will be
+  *              used.
++ * @reg_downshift: The number of bits to downshift the register before
++ *		   performing any operations.
+  * @pad_bits: Number of bits of padding between register and value.
+  * @val_bits: Number of bits in a register value, mandatory.
+  *
+@@ -360,6 +362,7 @@ struct regmap_config {
+ 
+ 	int reg_bits;
+ 	int reg_stride;
++	int reg_downshift;
+ 	int pad_bits;
+ 	int val_bits;
+ 
diff --git a/target/linux/generic/backport-5.15/351-v5.18-regmap-allow-a-defined-reg_base-to-be-added-to-every.patch b/target/linux/generic/backport-5.15/351-v5.18-regmap-allow-a-defined-reg_base-to-be-added-to-every.patch
new file mode 100644
index 00000000000000..ffde9e5d0c53d7
--- /dev/null
+++ b/target/linux/generic/backport-5.15/351-v5.18-regmap-allow-a-defined-reg_base-to-be-added-to-every.patch
@@ -0,0 +1,95 @@
+From 0074f3f2b1e43d3cedd97e47fb6980db6d2ba79e Mon Sep 17 00:00:00 2001
+From: Colin Foster <colin.foster@in-advantage.com>
+Date: Sun, 13 Mar 2022 15:45:24 -0700
+Subject: [PATCH 2/2] regmap: allow a defined reg_base to be added to every
+ address
+
+There's an inconsistency that arises when a register set can be accessed
+internally via MMIO, or externally via SPI. The VSC7514 chip allows both
+modes of operation. When internally accessed, the system utilizes __iomem,
+devm_ioremap_resource, and devm_regmap_init_mmio.
+
+For SPI it isn't possible to utilize memory-mapped IO. To properly operate,
+the resource base must be added to the register before every operation.
+
+Signed-off-by: Colin Foster <colin.foster@in-advantage.com>
+Link: https://lore.kernel.org/r/20220313224524.399947-3-colin.foster@in-advantage.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+---
+ drivers/base/regmap/internal.h | 1 +
+ drivers/base/regmap/regmap.c   | 6 ++++++
+ include/linux/regmap.h         | 3 +++
+ 3 files changed, 10 insertions(+)
+
+--- a/drivers/base/regmap/internal.h
++++ b/drivers/base/regmap/internal.h
+@@ -63,6 +63,7 @@ struct regmap {
+ 	regmap_unlock unlock;
+ 	void *lock_arg; /* This is passed to lock/unlock functions */
+ 	gfp_t alloc_flags;
++	unsigned int reg_base;
+ 
+ 	struct device *dev; /* Device we do I/O on */
+ 	void *work_buf;     /* Scratch buffer used to format I/O */
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -821,6 +821,8 @@ struct regmap *__regmap_init(struct devi
+ 	else
+ 		map->alloc_flags = GFP_KERNEL;
+ 
++	map->reg_base = config->reg_base;
++
+ 	map->format.reg_bytes = DIV_ROUND_UP(config->reg_bits, 8);
+ 	map->format.pad_bytes = config->pad_bits / 8;
+ 	map->format.reg_downshift = config->reg_downshift;
+@@ -1736,6 +1738,7 @@ static int _regmap_raw_write_impl(struct
+ 			return ret;
+ 	}
+ 
++	reg += map->reg_base;
+ 	reg >>= map->format.reg_downshift;
+ 	map->format.format_reg(map->work_buf, reg, map->reg_shift);
+ 	regmap_set_work_buf_flag_mask(map, map->format.reg_bytes,
+@@ -1907,6 +1910,7 @@ static int _regmap_bus_formatted_write(v
+ 			return ret;
+ 	}
+ 
++	reg += map->reg_base;
+ 	reg >>= map->format.reg_downshift;
+ 	map->format.format_write(map, reg, val);
+ 
+@@ -2351,6 +2355,7 @@ static int _regmap_raw_multi_reg_write(s
+ 		unsigned int reg = regs[i].reg;
+ 		unsigned int val = regs[i].def;
+ 		trace_regmap_hw_write_start(map, reg, 1);
++		reg += map->reg_base;
+ 		reg >>= map->format.reg_downshift;
+ 		map->format.format_reg(u8, reg, map->reg_shift);
+ 		u8 += reg_bytes + pad_bytes;
+@@ -2679,6 +2684,7 @@ static int _regmap_raw_read(struct regma
+ 			return ret;
+ 	}
+ 
++	reg += map->reg_base;
+ 	reg >>= map->format.reg_downshift;
+ 	map->format.format_reg(map->work_buf, reg, map->reg_shift);
+ 	regmap_set_work_buf_flag_mask(map, map->format.reg_bytes,
+--- a/include/linux/regmap.h
++++ b/include/linux/regmap.h
+@@ -239,6 +239,8 @@ typedef void (*regmap_unlock)(void *);
+  *              used.
+  * @reg_downshift: The number of bits to downshift the register before
+  *		   performing any operations.
++ * @reg_base: Value to be added to every register address before performing any
++ *	      operation.
+  * @pad_bits: Number of bits of padding between register and value.
+  * @val_bits: Number of bits in a register value, mandatory.
+  *
+@@ -363,6 +365,7 @@ struct regmap_config {
+ 	int reg_bits;
+ 	int reg_stride;
+ 	int reg_downshift;
++	unsigned int reg_base;
+ 	int pad_bits;
+ 	int val_bits;
+ 
diff --git a/target/linux/generic/backport-5.15/352-v6.3-regmap-apply-reg_base-and-reg_downshift-for-single-r.patch b/target/linux/generic/backport-5.15/352-v6.3-regmap-apply-reg_base-and-reg_downshift-for-single-r.patch
new file mode 100644
index 00000000000000..34b587f5582118
--- /dev/null
+++ b/target/linux/generic/backport-5.15/352-v6.3-regmap-apply-reg_base-and-reg_downshift-for-single-r.patch
@@ -0,0 +1,57 @@
+From 697c3892d825fb78f42ec8e53bed065dd728db3e Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 30 Jan 2023 02:04:57 +0000
+Subject: [PATCH] regmap: apply reg_base and reg_downshift for single register
+ ops
+
+reg_base and reg_downshift currently don't have any effect if used with
+a regmap_bus or regmap_config which only offers single register
+operations (ie. reg_read, reg_write and optionally reg_update_bits).
+
+Fix that and take them into account also for regmap_bus with only
+reg_read and read_write operations by applying reg_base and
+reg_downshift in _regmap_bus_reg_write, _regmap_bus_reg_read.
+
+Also apply reg_base and reg_downshift in _regmap_update_bits, but only
+in case the operation is carried out with a reg_update_bits call
+defined in either regmap_bus or regmap_config.
+
+Fixes: 0074f3f2b1e43d ("regmap: allow a defined reg_base to be added to every address")
+Fixes: 86fc59ef818beb ("regmap: add configurable downshift for addresses")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Tested-by: Colin Foster <colin.foster@in-advantage.com>
+Link: https://lore.kernel.org/r/Y9clyVS3tQEHlUhA@makrotopia.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+---
+ drivers/base/regmap/regmap.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1929,6 +1929,8 @@ static int _regmap_bus_reg_write(void *c
+ {
+ 	struct regmap *map = context;
+ 
++	reg += map->reg_base;
++	reg >>= map->format.reg_downshift;
+ 	return map->bus->reg_write(map->bus_context, reg, val);
+ }
+ 
+@@ -2705,6 +2707,8 @@ static int _regmap_bus_reg_read(void *co
+ {
+ 	struct regmap *map = context;
+ 
++	reg += map->reg_base;
++	reg >>= map->format.reg_downshift;
+ 	return map->bus->reg_read(map->bus_context, reg, val);
+ }
+ 
+@@ -3080,6 +3084,8 @@ static int _regmap_update_bits(struct re
+ 		*change = false;
+ 
+ 	if (regmap_volatile(map, reg) && map->reg_update_bits) {
++		reg += map->reg_base;
++		reg >>= map->format.reg_downshift;
+ 		ret = map->reg_update_bits(map->bus_context, reg, mask, val);
+ 		if (ret == 0 && change)
+ 			*change = true;
diff --git a/target/linux/generic/backport-5.15/360-v6.1-powerpc-vdso-link-with-z-noexecstack.patch b/target/linux/generic/backport-5.15/360-v6.1-powerpc-vdso-link-with-z-noexecstack.patch
new file mode 100644
index 00000000000000..82e712e20a53b2
--- /dev/null
+++ b/target/linux/generic/backport-5.15/360-v6.1-powerpc-vdso-link-with-z-noexecstack.patch
@@ -0,0 +1,49 @@
+From 78391fb5b1b5318900725c72f1db25b2ae92894f Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+Date: Wed, 7 Jun 2023 09:50:52 +0200
+Subject: [PATCH] powerpc/vdso: link with -z noexecstack
+
+With recent binutils, the following warning appears:
+
+  VDSO32L arch/powerpc/kernel/vdso/vdso32.so.dbg
+/opt/gcc-12.2.0-nolibc/powerpc64-linux/bin/../lib/gcc/powerpc64-linux/12.2.0/../../../../powerpc64-linux/bin/ld: warning: arch/powerpc/kernel/vdso/getcpu-32.o: missing .note.GNU-stack section implies executable stack
+/opt/gcc-12.2.0-nolibc/powerpc64-linux/bin/../lib/gcc/powerpc64-linux/12.2.0/../../../../powerpc64-linux/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
+
+To avoid that, explicitly tell the linker we don't want executable
+stack.
+
+For more explanations, see commit ffcf9c5700e4 ("x86: link vdso
+and boot with -z noexecstack --no-warn-rwx-segments")
+
+Commit was adapted for 5.15 as VDSO32 and VDSO64 were merged later so it
+does not directly apply.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/b95f2e3216a574837dd61208444e9515c3423da4.1662132312.git.christophe.leroy@csgroup.eu
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+[Adapt to 5.15 as it has VDSO split for 32 and 64bit]
+---
+ arch/powerpc/kernel/vdso32/Makefile | 2 +-
+ arch/powerpc/kernel/vdso64/Makefile | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/kernel/vdso32/Makefile
++++ b/arch/powerpc/kernel/vdso32/Makefile
+@@ -66,7 +66,7 @@ include/generated/vdso32-offsets.h: $(ob
+ 
+ # actual build commands
+ quiet_cmd_vdso32ld_and_check = VDSO32L $@
+-      cmd_vdso32ld_and_check = $(VDSOCC) $(c_flags) $(CC32FLAGS) -o $@ -Wl,-T$(filter %.lds,$^) $(filter %.o,$^) ; $(cmd_vdso_check)
++      cmd_vdso32ld_and_check = $(VDSOCC) $(c_flags) $(CC32FLAGS) -o $@ -Wl,-T$(filter %.lds,$^) $(filter %.o,$^) -z noexecstack ; $(cmd_vdso_check)
+ quiet_cmd_vdso32as = VDSO32A $@
+       cmd_vdso32as = $(VDSOCC) $(a_flags) $(CC32FLAGS) -c -o $@ $<
+ quiet_cmd_vdso32cc = VDSO32C $@
+--- a/arch/powerpc/kernel/vdso64/Makefile
++++ b/arch/powerpc/kernel/vdso64/Makefile
+@@ -53,4 +53,4 @@ include/generated/vdso64-offsets.h: $(ob
+ 
+ # actual build commands
+ quiet_cmd_vdso64ld_and_check = VDSO64L $@
+-      cmd_vdso64ld_and_check = $(CC) $(c_flags) -o $@ -Wl,-T$(filter %.lds,$^) $(filter %.o,$^); $(cmd_vdso_check)
++      cmd_vdso64ld_and_check = $(CC) $(c_flags) -o $@ -Wl,-T$(filter %.lds,$^) $(filter %.o,$^) -z noexecstack ; $(cmd_vdso_check)
diff --git a/target/linux/generic/backport-5.15/402-v6.0-mtd-next-mtd-core-introduce-of-support-for-dynamic-partitions.patch b/target/linux/generic/backport-5.15/402-v6.0-mtd-next-mtd-core-introduce-of-support-for-dynamic-partitions.patch
index 8b8e478b005ca5..ee385416d1d0f4 100644
--- a/target/linux/generic/backport-5.15/402-v6.0-mtd-next-mtd-core-introduce-of-support-for-dynamic-partitions.patch
+++ b/target/linux/generic/backport-5.15/402-v6.0-mtd-next-mtd-core-introduce-of-support-for-dynamic-partitions.patch
@@ -103,4 +103,4 @@ Link: https://lore.kernel.org/linux-mtd/20220622010628.30414-4-ansuelsmth@gmail.
 +	mtd_check_of_node(mtd);
  	of_node_get(mtd_get_of_node(mtd));
  	error = device_register(&mtd->dev);
- 	if (error)
+ 	if (error) {
diff --git a/target/linux/generic/backport-5.15/403-v6.1-mtd-allow-getting-MTD-device-associated-with-a-speci.patch b/target/linux/generic/backport-5.15/403-v6.1-mtd-allow-getting-MTD-device-associated-with-a-speci.patch
index be1aa9cfb84fff..3039eabea502d4 100644
--- a/target/linux/generic/backport-5.15/403-v6.1-mtd-allow-getting-MTD-device-associated-with-a-speci.patch
+++ b/target/linux/generic/backport-5.15/403-v6.1-mtd-allow-getting-MTD-device-associated-with-a-speci.patch
@@ -25,7 +25,7 @@ Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
 
 --- a/drivers/mtd/mtdcore.c
 +++ b/drivers/mtd/mtdcore.c
-@@ -1227,6 +1227,34 @@ int __get_mtd_device(struct mtd_info *mt
+@@ -1236,6 +1236,34 @@ int __get_mtd_device(struct mtd_info *mt
  EXPORT_SYMBOL_GPL(__get_mtd_device);
  
  /**
diff --git a/target/linux/generic/backport-5.15/404-v6.0-mtd-core-check-partition-before-dereference.patch b/target/linux/generic/backport-5.15/404-v6.0-mtd-core-check-partition-before-dereference.patch
new file mode 100644
index 00000000000000..e45e2ab48e394b
--- /dev/null
+++ b/target/linux/generic/backport-5.15/404-v6.0-mtd-core-check-partition-before-dereference.patch
@@ -0,0 +1,30 @@
+From 7ec4cdb321738d44ae5d405e7b6ac73dfbf99caa Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Mon, 25 Jul 2022 22:49:25 +0900
+Subject: [PATCH] mtd: core: check partition before dereference
+
+syzbot is reporting NULL pointer dereference at mtd_check_of_node() [1],
+for mtdram test device (CONFIG_MTD_MTDRAM) is not partition.
+
+Link: https://syzkaller.appspot.com/bug?extid=fe013f55a2814a9e8cfd [1]
+Reported-by: syzbot <syzbot+fe013f55a2814a9e8cfd@syzkaller.appspotmail.com>
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Fixes: ad9b10d1eaada169 ("mtd: core: introduce of support for dynamic partitions")
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+CC: stable@vger.kernel.org
+Signed-off-by: Richard Weinberger <richard@nod.at>
+---
+ drivers/mtd/mtdcore.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -577,6 +577,8 @@ static void mtd_check_of_node(struct mtd
+ 		return;
+ 
+ 	/* Check if a partitions node exist */
++	if (!mtd_is_partition(mtd))
++		return;
+ 	parent = mtd->parent;
+ 	parent_dn = dev_of_node(&parent->dev);
+ 	if (!parent_dn)
diff --git a/target/linux/generic/backport-5.15/405-v6.1-mtd-core-add-missing-of_node_get-in-dynamic-partitio.patch b/target/linux/generic/backport-5.15/405-v6.1-mtd-core-add-missing-of_node_get-in-dynamic-partitio.patch
new file mode 100644
index 00000000000000..9399a00aa165cc
--- /dev/null
+++ b/target/linux/generic/backport-5.15/405-v6.1-mtd-core-add-missing-of_node_get-in-dynamic-partitio.patch
@@ -0,0 +1,101 @@
+From 12b58961de0bd88b3c7dfa5d21f6d67f4678b780 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 18 Oct 2022 07:18:22 +0200
+Subject: [PATCH] mtd: core: add missing of_node_get() in dynamic partitions
+ code
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This fixes unbalanced of_node_put():
+[    1.078910] 6 cmdlinepart partitions found on MTD device gpmi-nand
+[    1.085116] Creating 6 MTD partitions on "gpmi-nand":
+[    1.090181] 0x000000000000-0x000008000000 : "nandboot"
+[    1.096952] 0x000008000000-0x000009000000 : "nandfit"
+[    1.103547] 0x000009000000-0x00000b000000 : "nandkernel"
+[    1.110317] 0x00000b000000-0x00000c000000 : "nanddtb"
+[    1.115525] ------------[ cut here ]------------
+[    1.120141] refcount_t: addition on 0; use-after-free.
+[    1.125328] WARNING: CPU: 0 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0xdc/0x148
+[    1.133528] Modules linked in:
+[    1.136589] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc7-next-20220930-04543-g8cf3f7
+[    1.146342] Hardware name: Freescale i.MX8DXL DDR3L EVK (DT)
+[    1.151999] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[    1.158965] pc : refcount_warn_saturate+0xdc/0x148
+[    1.163760] lr : refcount_warn_saturate+0xdc/0x148
+[    1.168556] sp : ffff800009ddb080
+[    1.171866] x29: ffff800009ddb080 x28: ffff800009ddb35a x27: 0000000000000002
+[    1.179015] x26: ffff8000098b06ad x25: ffffffffffffffff x24: ffff0a00ffffff05
+[    1.186165] x23: ffff00001fdf6470 x22: ffff800009ddb367 x21: 0000000000000000
+[    1.193314] x20: ffff00001fdfebe8 x19: ffff00001fdfec50 x18: ffffffffffffffff
+[    1.200464] x17: 0000000000000000 x16: 0000000000000118 x15: 0000000000000004
+[    1.207614] x14: 0000000000000fff x13: ffff800009bca248 x12: 0000000000000003
+[    1.214764] x11: 00000000ffffefff x10: c0000000ffffefff x9 : 4762cb2ccb52de00
+[    1.221914] x8 : 4762cb2ccb52de00 x7 : 205d313431303231 x6 : 312e31202020205b
+[    1.229063] x5 : ffff800009d55c1f x4 : 0000000000000001 x3 : 0000000000000000
+[    1.236213] x2 : 0000000000000000 x1 : ffff800009954be6 x0 : 000000000000002a
+[    1.243365] Call trace:
+[    1.245806]  refcount_warn_saturate+0xdc/0x148
+[    1.250253]  kobject_get+0x98/0x9c
+[    1.253658]  of_node_get+0x20/0x34
+[    1.257072]  of_fwnode_get+0x3c/0x54
+[    1.260652]  fwnode_get_nth_parent+0xd8/0xf4
+[    1.264926]  fwnode_full_name_string+0x3c/0xb4
+[    1.269373]  device_node_string+0x498/0x5b4
+[    1.273561]  pointer+0x41c/0x5d0
+[    1.276793]  vsnprintf+0x4d8/0x694
+[    1.280198]  vprintk_store+0x164/0x528
+[    1.283951]  vprintk_emit+0x98/0x164
+[    1.287530]  vprintk_default+0x44/0x6c
+[    1.291284]  vprintk+0xf0/0x134
+[    1.294428]  _printk+0x54/0x7c
+[    1.297486]  of_node_release+0xe8/0x128
+[    1.301326]  kobject_put+0x98/0xfc
+[    1.304732]  of_node_put+0x1c/0x28
+[    1.308137]  add_mtd_device+0x484/0x6d4
+[    1.311977]  add_mtd_partitions+0xf0/0x1d0
+[    1.316078]  parse_mtd_partitions+0x45c/0x518
+[    1.320439]  mtd_device_parse_register+0xb0/0x274
+[    1.325147]  gpmi_nand_probe+0x51c/0x650
+[    1.329074]  platform_probe+0xa8/0xd0
+[    1.332740]  really_probe+0x130/0x334
+[    1.336406]  __driver_probe_device+0xb4/0xe0
+[    1.340681]  driver_probe_device+0x3c/0x1f8
+[    1.344869]  __driver_attach+0xdc/0x1a4
+[    1.348708]  bus_for_each_dev+0x80/0xcc
+[    1.352548]  driver_attach+0x24/0x30
+[    1.356127]  bus_add_driver+0x108/0x1f4
+[    1.359967]  driver_register+0x78/0x114
+[    1.363807]  __platform_driver_register+0x24/0x30
+[    1.368515]  gpmi_nand_driver_init+0x1c/0x28
+[    1.372798]  do_one_initcall+0xbc/0x238
+[    1.376638]  do_initcall_level+0x94/0xb4
+[    1.380565]  do_initcalls+0x54/0x94
+[    1.384058]  do_basic_setup+0x1c/0x28
+[    1.387724]  kernel_init_freeable+0x110/0x188
+[    1.392084]  kernel_init+0x20/0x1a0
+[    1.395578]  ret_from_fork+0x10/0x20
+[    1.399157] ---[ end trace 0000000000000000 ]---
+[    1.403782] ------------[ cut here ]------------
+
+Reported-by: Han Xu <han.xu@nxp.com>
+Fixes: ad9b10d1eaada169 ("mtd: core: introduce of support for dynamic partitions")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Tested-by: Han Xu <han.xu@nxp.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20221018051822.28685-1-zajec5@gmail.com
+---
+ drivers/mtd/mtdcore.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -580,7 +580,7 @@ static void mtd_check_of_node(struct mtd
+ 	if (!mtd_is_partition(mtd))
+ 		return;
+ 	parent = mtd->parent;
+-	parent_dn = dev_of_node(&parent->dev);
++	parent_dn = of_node_get(dev_of_node(&parent->dev));
+ 	if (!parent_dn)
+ 		return;
+ 
diff --git a/target/linux/generic/backport-5.15/406-v6.2-0001-mtd-core-simplify-a-bit-code-find-partition-matching.patch b/target/linux/generic/backport-5.15/406-v6.2-0001-mtd-core-simplify-a-bit-code-find-partition-matching.patch
new file mode 100644
index 00000000000000..7e9645ea98d6a9
--- /dev/null
+++ b/target/linux/generic/backport-5.15/406-v6.2-0001-mtd-core-simplify-a-bit-code-find-partition-matching.patch
@@ -0,0 +1,65 @@
+From 63db0cb35e1cb3b3c134906d1062f65513fdda2d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 4 Oct 2022 10:37:09 +0200
+Subject: [PATCH] mtd: core: simplify (a bit) code find partition-matching
+ dynamic OF node
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+1. Don't hardcode "partition-" string twice
+2. Use simpler logic & use ->name to avoid of_property_read_string()
+3. Use mtd_get_of_node() helper
+
+Cc: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20221004083710.27704-1-zajec5@gmail.com
+---
+ drivers/mtd/mtdcore.c | 16 +++++++---------
+ 1 file changed, 7 insertions(+), 9 deletions(-)
+
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -569,18 +569,16 @@ static void mtd_check_of_node(struct mtd
+ 	struct device_node *partitions, *parent_dn, *mtd_dn = NULL;
+ 	const char *pname, *prefix = "partition-";
+ 	int plen, mtd_name_len, offset, prefix_len;
+-	struct mtd_info *parent;
+ 	bool found = false;
+ 
+ 	/* Check if MTD already has a device node */
+-	if (dev_of_node(&mtd->dev))
++	if (mtd_get_of_node(mtd))
+ 		return;
+ 
+ 	/* Check if a partitions node exist */
+ 	if (!mtd_is_partition(mtd))
+ 		return;
+-	parent = mtd->parent;
+-	parent_dn = of_node_get(dev_of_node(&parent->dev));
++	parent_dn = of_node_get(mtd_get_of_node(mtd->parent));
+ 	if (!parent_dn)
+ 		return;
+ 
+@@ -593,15 +591,15 @@ static void mtd_check_of_node(struct mtd
+ 
+ 	/* Search if a partition is defined with the same name */
+ 	for_each_child_of_node(partitions, mtd_dn) {
+-		offset = 0;
+-
+ 		/* Skip partition with no/wrong prefix */
+-		if (!of_node_name_prefix(mtd_dn, "partition-"))
++		if (!of_node_name_prefix(mtd_dn, prefix))
+ 			continue;
+ 
+ 		/* Label have priority. Check that first */
+-		if (of_property_read_string(mtd_dn, "label", &pname)) {
+-			of_property_read_string(mtd_dn, "name", &pname);
++		if (!of_property_read_string(mtd_dn, "label", &pname)) {
++			offset = 0;
++		} else {
++			pname = mtd_dn->name;
+ 			offset = prefix_len;
+ 		}
+ 
diff --git a/target/linux/generic/backport-5.15/406-v6.2-0002-mtd-core-try-to-find-OF-node-for-every-MTD-partition.patch b/target/linux/generic/backport-5.15/406-v6.2-0002-mtd-core-try-to-find-OF-node-for-every-MTD-partition.patch
new file mode 100644
index 00000000000000..48a7c13cd013a3
--- /dev/null
+++ b/target/linux/generic/backport-5.15/406-v6.2-0002-mtd-core-try-to-find-OF-node-for-every-MTD-partition.patch
@@ -0,0 +1,84 @@
+From ddb8cefb7af288950447ca6eeeafb09977dab56f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 4 Oct 2022 10:37:10 +0200
+Subject: [PATCH] mtd: core: try to find OF node for every MTD partition
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+So far this feature was limited to the top-level "nvmem-cells" node.
+There are multiple parsers creating partitions and subpartitions
+dynamically. Extend that code to handle them too.
+
+This allows finding partition-* node for every MTD (sub)partition.
+
+Random example:
+
+partitions {
+	compatible = "brcm,bcm947xx-cfe-partitions";
+
+	partition-firmware {
+		compatible = "brcm,trx";
+
+		partition-loader {
+		};
+	};
+};
+
+Cc: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20221004083710.27704-2-zajec5@gmail.com
+---
+ drivers/mtd/mtdcore.c | 18 ++++++------------
+ 1 file changed, 6 insertions(+), 12 deletions(-)
+
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -569,20 +569,22 @@ static void mtd_check_of_node(struct mtd
+ 	struct device_node *partitions, *parent_dn, *mtd_dn = NULL;
+ 	const char *pname, *prefix = "partition-";
+ 	int plen, mtd_name_len, offset, prefix_len;
+-	bool found = false;
+ 
+ 	/* Check if MTD already has a device node */
+ 	if (mtd_get_of_node(mtd))
+ 		return;
+ 
+-	/* Check if a partitions node exist */
+ 	if (!mtd_is_partition(mtd))
+ 		return;
++
+ 	parent_dn = of_node_get(mtd_get_of_node(mtd->parent));
+ 	if (!parent_dn)
+ 		return;
+ 
+-	partitions = of_get_child_by_name(parent_dn, "partitions");
++	if (mtd_is_partition(mtd->parent))
++		partitions = of_node_get(parent_dn);
++	else
++		partitions = of_get_child_by_name(parent_dn, "partitions");
+ 	if (!partitions)
+ 		goto exit_parent;
+ 
+@@ -606,19 +608,11 @@ static void mtd_check_of_node(struct mtd
+ 		plen = strlen(pname) - offset;
+ 		if (plen == mtd_name_len &&
+ 		    !strncmp(mtd->name, pname + offset, plen)) {
+-			found = true;
++			mtd_set_of_node(mtd, mtd_dn);
+ 			break;
+ 		}
+ 	}
+ 
+-	if (!found)
+-		goto exit_partitions;
+-
+-	/* Set of_node only for nvmem */
+-	if (of_device_is_compatible(mtd_dn, "nvmem-cells"))
+-		mtd_set_of_node(mtd, mtd_dn);
+-
+-exit_partitions:
+ 	of_node_put(partitions);
+ exit_parent:
+ 	of_node_put(parent_dn);
diff --git a/target/linux/generic/backport-5.15/407-v5.17-mtd-parsers-qcom-Don-t-print-error-message-on-EPROBE.patch b/target/linux/generic/backport-5.15/407-v5.17-mtd-parsers-qcom-Don-t-print-error-message-on-EPROBE.patch
new file mode 100644
index 00000000000000..0efad99157a621
--- /dev/null
+++ b/target/linux/generic/backport-5.15/407-v5.17-mtd-parsers-qcom-Don-t-print-error-message-on-EPROBE.patch
@@ -0,0 +1,32 @@
+From 26bccc9671ba5e01f7153addbe94e7dc3f677375 Mon Sep 17 00:00:00 2001
+From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Date: Mon, 3 Jan 2022 03:03:16 +0000
+Subject: [PATCH 13/14] mtd: parsers: qcom: Don't print error message on
+ -EPROBE_DEFER
+
+Its possible for the main smem driver to not be loaded by the time we come
+along to parse the smem partition description but, this is a perfectly
+normal thing.
+
+No need to print out an error message in this case.
+
+Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220103030316.58301-3-bryan.odonoghue@linaro.org
+---
+ drivers/mtd/parsers/qcomsmempart.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/parsers/qcomsmempart.c
++++ b/drivers/mtd/parsers/qcomsmempart.c
+@@ -75,7 +75,8 @@ static int parse_qcomsmem_part(struct mt
+ 	pr_debug("Parsing partition table info from SMEM\n");
+ 	ptable = qcom_smem_get(SMEM_APPS, SMEM_AARM_PARTITION_TABLE, &len);
+ 	if (IS_ERR(ptable)) {
+-		pr_err("Error reading partition table header\n");
++		if (PTR_ERR(ptable) != -EPROBE_DEFER)
++			pr_err("Error reading partition table header\n");
+ 		return PTR_ERR(ptable);
+ 	}
+ 
diff --git a/target/linux/generic/backport-5.15/408-v6.2-mtd-core-set-ROOT_DEV-for-partitions-marked-as-rootf.patch b/target/linux/generic/backport-5.15/408-v6.2-mtd-core-set-ROOT_DEV-for-partitions-marked-as-rootf.patch
new file mode 100644
index 00000000000000..505e347e40ebcb
--- /dev/null
+++ b/target/linux/generic/backport-5.15/408-v6.2-mtd-core-set-ROOT_DEV-for-partitions-marked-as-rootf.patch
@@ -0,0 +1,47 @@
+From 26422ac78e9d8767bd4aabfbae616b15edbf6a1b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Sat, 22 Oct 2022 23:13:18 +0200
+Subject: [PATCH] mtd: core: set ROOT_DEV for partitions marked as rootfs in DT
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This adds support for "linux,rootfs" binding that is used to mark flash
+partition containing rootfs. It's useful for devices using device tree
+that don't have bootloader passing root info in cmdline.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20221022211318.32009-2-zajec5@gmail.com
+---
+ drivers/mtd/mtdcore.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -28,6 +28,7 @@
+ #include <linux/leds.h>
+ #include <linux/debugfs.h>
+ #include <linux/nvmem-provider.h>
++#include <linux/root_dev.h>
+ 
+ #include <linux/mtd/mtd.h>
+ #include <linux/mtd/partitions.h>
+@@ -748,6 +749,17 @@ int add_mtd_device(struct mtd_info *mtd)
+ 		not->add(mtd);
+ 
+ 	mutex_unlock(&mtd_table_mutex);
++
++	if (of_find_property(mtd_get_of_node(mtd), "linux,rootfs", NULL)) {
++		if (IS_BUILTIN(CONFIG_MTD)) {
++			pr_info("mtd: setting mtd%d (%s) as root device\n", mtd->index, mtd->name);
++			ROOT_DEV = MKDEV(MTD_BLOCK_MAJOR, mtd->index);
++		} else {
++			pr_warn("mtd: can't set mtd%d (%s) as root device - mtd must be builtin\n",
++				mtd->index, mtd->name);
++		}
++	}
++
+ 	/* We _know_ we aren't being removed, because
+ 	   our caller is still holding us here. So none
+ 	   of this try_ nonsense, and no bitching about it
diff --git a/target/linux/generic/backport-5.15/410-v5.18-mtd-parsers-trx-allow-to-use-on-MediaTek-MIPS-SoCs.patch b/target/linux/generic/backport-5.15/410-v5.18-mtd-parsers-trx-allow-to-use-on-MediaTek-MIPS-SoCs.patch
new file mode 100644
index 00000000000000..5c49841760f16f
--- /dev/null
+++ b/target/linux/generic/backport-5.15/410-v5.18-mtd-parsers-trx-allow-to-use-on-MediaTek-MIPS-SoCs.patch
@@ -0,0 +1,33 @@
+From 2365f91c861cbfeef7141c69842848c7b2d3c2db Mon Sep 17 00:00:00 2001
+From: INAGAKI Hiroshi <musashino.open@gmail.com>
+Date: Sun, 13 Feb 2022 15:40:44 +0900
+Subject: [PATCH] mtd: parsers: trx: allow to use on MediaTek MIPS SoCs
+
+Buffalo sells some router devices which have trx-formatted firmware,
+based on MediaTek MIPS SoCs. To use parser_trx on those devices, add
+"RALINK" to dependency and allow to compile for MediaTek MIPS SoCs.
+
+examples:
+
+- WCR-1166DS  (MT7628)
+- WSR-1166DHP (MT7621)
+- WSR-2533DHP (MT7621)
+
+Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220213064045.1781-1-musashino.open@gmail.com
+---
+ drivers/mtd/parsers/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/parsers/Kconfig
++++ b/drivers/mtd/parsers/Kconfig
+@@ -115,7 +115,7 @@ config MTD_AFS_PARTS
+ 
+ config MTD_PARSER_TRX
+ 	tristate "Parser for TRX format partitions"
+-	depends on MTD && (BCM47XX || ARCH_BCM_5301X || ARCH_MEDIATEK || COMPILE_TEST)
++	depends on MTD && (BCM47XX || ARCH_BCM_5301X || ARCH_MEDIATEK || RALINK || COMPILE_TEST)
+ 	help
+ 	  TRX is a firmware format used by Broadcom on their devices. It
+ 	  may contain up to 3/4 partitions (depending on the version).
diff --git a/target/linux/generic/backport-5.15/421-v6.2-mtd-parsers-add-TP-Link-SafeLoader-partitions-table-.patch b/target/linux/generic/backport-5.15/421-v6.2-mtd-parsers-add-TP-Link-SafeLoader-partitions-table-.patch
new file mode 100644
index 00000000000000..9f543365a572fa
--- /dev/null
+++ b/target/linux/generic/backport-5.15/421-v6.2-mtd-parsers-add-TP-Link-SafeLoader-partitions-table-.patch
@@ -0,0 +1,229 @@
+From aec4d5f5ffd0f0092bd9dc21ea90e0bc237d4b74 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Sat, 15 Oct 2022 11:29:50 +0200
+Subject: [PATCH] mtd: parsers: add TP-Link SafeLoader partitions table parser
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This parser deals with most TP-Link home routers. It reads info about
+partitions and registers them in the MTD subsystem.
+
+Example from TP-Link Archer C5 V2:
+
+spi-nor spi0.0: s25fl128s1 (16384 Kbytes)
+15 tplink-safeloader partitions found on MTD device spi0.0
+Creating 15 MTD partitions on "spi0.0":
+0x000000000000-0x000000040000 : "fs-uboot"
+0x000000040000-0x000000440000 : "os-image"
+0x000000440000-0x000000e40000 : "rootfs"
+0x000000e40000-0x000000e40200 : "default-mac"
+0x000000e40200-0x000000e40400 : "pin"
+0x000000e40400-0x000000e40600 : "product-info"
+0x000000e50000-0x000000e60000 : "partition-table"
+0x000000e60000-0x000000e60200 : "soft-version"
+0x000000e61000-0x000000e70000 : "support-list"
+0x000000e70000-0x000000e80000 : "profile"
+0x000000e80000-0x000000e90000 : "default-config"
+0x000000e90000-0x000000ee0000 : "user-config"
+0x000000ee0000-0x000000fe0000 : "log"
+0x000000fe0000-0x000000ff0000 : "radio_bk"
+0x000000ff0000-0x000001000000 : "radio"
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20221015092950.27467-2-zajec5@gmail.com
+---
+ drivers/mtd/parsers/Kconfig             |  15 +++
+ drivers/mtd/parsers/Makefile            |   1 +
+ drivers/mtd/parsers/tplink_safeloader.c | 150 ++++++++++++++++++++++++
+ 3 files changed, 166 insertions(+)
+ create mode 100644 drivers/mtd/parsers/tplink_safeloader.c
+
+--- a/drivers/mtd/parsers/Kconfig
++++ b/drivers/mtd/parsers/Kconfig
+@@ -113,6 +113,21 @@ config MTD_AFS_PARTS
+ 	  for your particular device. It won't happen automatically. The
+ 	  'physmap' map driver (CONFIG_MTD_PHYSMAP) does this, for example.
+ 
++config MTD_PARSER_TPLINK_SAFELOADER
++	tristate "TP-Link Safeloader partitions parser"
++	depends on MTD && (ARCH_BCM_5301X || ATH79 || SOC_MT7620 || SOC_MT7621 || COMPILE_TEST)
++	help
++	  TP-Link home routers use flash partitions to store various data. Info
++	  about flash space layout is stored in a partitions table using a
++	  custom ASCII-based format.
++
++	  That format was first found in devices with SafeLoader bootloader and
++	  was named after it. Later it was adapted to CFE and U-Boot
++	  bootloaders.
++
++	  This driver reads partitions table, parses it and creates MTD
++	  partitions.
++
+ config MTD_PARSER_TRX
+ 	tristate "Parser for TRX format partitions"
+ 	depends on MTD && (BCM47XX || ARCH_BCM_5301X || ARCH_MEDIATEK || RALINK || COMPILE_TEST)
+--- a/drivers/mtd/parsers/Makefile
++++ b/drivers/mtd/parsers/Makefile
+@@ -9,6 +9,7 @@ ofpart-$(CONFIG_MTD_OF_PARTS_BCM4908)	+=
+ ofpart-$(CONFIG_MTD_OF_PARTS_LINKSYS_NS)+= ofpart_linksys_ns.o
+ obj-$(CONFIG_MTD_PARSER_IMAGETAG)	+= parser_imagetag.o
+ obj-$(CONFIG_MTD_AFS_PARTS)		+= afs.o
++obj-$(CONFIG_MTD_PARSER_TPLINK_SAFELOADER)	+= tplink_safeloader.o
+ obj-$(CONFIG_MTD_PARSER_TRX)		+= parser_trx.o
+ obj-$(CONFIG_MTD_SERCOMM_PARTS)		+= scpart.o
+ obj-$(CONFIG_MTD_SHARPSL_PARTS)		+= sharpslpart.o
+--- /dev/null
++++ b/drivers/mtd/parsers/tplink_safeloader.c
+@@ -0,0 +1,150 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Copyright © 2022 Rafał Miłecki <rafal@milecki.pl>
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/mtd/mtd.h>
++#include <linux/mtd/partitions.h>
++#include <linux/of.h>
++#include <linux/slab.h>
++
++#define TPLINK_SAFELOADER_DATA_OFFSET		4
++#define TPLINK_SAFELOADER_MAX_PARTS		32
++
++struct safeloader_cmn_header {
++	__be32 size;
++	uint32_t unused;
++} __packed;
++
++static void *mtd_parser_tplink_safeloader_read_table(struct mtd_info *mtd)
++{
++	struct safeloader_cmn_header hdr;
++	struct device_node *np;
++	size_t bytes_read;
++	size_t offset;
++	size_t size;
++	char *buf;
++	int err;
++
++	np = mtd_get_of_node(mtd);
++	if (mtd_is_partition(mtd))
++		of_node_get(np);
++	else
++		np = of_get_child_by_name(np, "partitions");
++
++	if (of_property_read_u32(np, "partitions-table-offset", (u32 *)&offset)) {
++		pr_err("Failed to get partitions table offset\n");
++		goto err_put;
++	}
++
++	err = mtd_read(mtd, offset, sizeof(hdr), &bytes_read, (uint8_t *)&hdr);
++	if (err && !mtd_is_bitflip(err)) {
++		pr_err("Failed to read from %s at 0x%zx\n", mtd->name, offset);
++		goto err_put;
++	}
++
++	size = be32_to_cpu(hdr.size);
++
++	buf = kmalloc(size + 1, GFP_KERNEL);
++	if (!buf)
++		goto err_put;
++
++	err = mtd_read(mtd, offset + sizeof(hdr), size, &bytes_read, buf);
++	if (err && !mtd_is_bitflip(err)) {
++		pr_err("Failed to read from %s at 0x%zx\n", mtd->name, offset + sizeof(hdr));
++		goto err_kfree;
++	}
++
++	buf[size] = '\0';
++
++	of_node_put(np);
++
++	return buf;
++
++err_kfree:
++	kfree(buf);
++err_put:
++	of_node_put(np);
++	return NULL;
++}
++
++static int mtd_parser_tplink_safeloader_parse(struct mtd_info *mtd,
++					      const struct mtd_partition **pparts,
++					      struct mtd_part_parser_data *data)
++{
++	struct mtd_partition *parts;
++	char name[65];
++	size_t offset;
++	size_t bytes;
++	char *buf;
++	int idx;
++	int err;
++
++	parts = kcalloc(TPLINK_SAFELOADER_MAX_PARTS, sizeof(*parts), GFP_KERNEL);
++	if (!parts) {
++		err = -ENOMEM;
++		goto err_out;
++	}
++
++	buf = mtd_parser_tplink_safeloader_read_table(mtd);
++	if (!buf) {
++		err = -ENOENT;
++		goto err_out;
++	}
++
++	for (idx = 0, offset = TPLINK_SAFELOADER_DATA_OFFSET;
++	     idx < TPLINK_SAFELOADER_MAX_PARTS &&
++	     sscanf(buf + offset, "partition %64s base 0x%llx size 0x%llx%zn\n",
++		    name, &parts[idx].offset, &parts[idx].size, &bytes) == 3;
++	     idx++, offset += bytes + 1) {
++		parts[idx].name = kstrdup(name, GFP_KERNEL);
++		if (!parts[idx].name) {
++			err = -ENOMEM;
++			goto err_free;
++		}
++	}
++
++	if (idx == TPLINK_SAFELOADER_MAX_PARTS)
++		pr_warn("Reached maximum number of partitions!\n");
++
++	kfree(buf);
++
++	*pparts = parts;
++
++	return idx;
++
++err_free:
++	for (idx -= 1; idx >= 0; idx--)
++		kfree(parts[idx].name);
++err_out:
++	return err;
++};
++
++static void mtd_parser_tplink_safeloader_cleanup(const struct mtd_partition *pparts,
++						 int nr_parts)
++{
++	int i;
++
++	for (i = 0; i < nr_parts; i++)
++		kfree(pparts[i].name);
++
++	kfree(pparts);
++}
++
++static const struct of_device_id mtd_parser_tplink_safeloader_of_match_table[] = {
++	{ .compatible = "tplink,safeloader-partitions" },
++	{},
++};
++MODULE_DEVICE_TABLE(of, mtd_parser_tplink_safeloader_of_match_table);
++
++static struct mtd_part_parser mtd_parser_tplink_safeloader = {
++	.parse_fn = mtd_parser_tplink_safeloader_parse,
++	.cleanup = mtd_parser_tplink_safeloader_cleanup,
++	.name = "tplink-safeloader",
++	.of_match_table = mtd_parser_tplink_safeloader_of_match_table,
++};
++module_mtd_part_parser(mtd_parser_tplink_safeloader);
++
++MODULE_LICENSE("GPL");
diff --git a/target/linux/generic/backport-5.15/422-v5.19-mtd-spi-nor-support-eon-en25qh256a.patch b/target/linux/generic/backport-5.15/422-v5.19-mtd-spi-nor-support-eon-en25qh256a.patch
new file mode 100644
index 00000000000000..2358352e93c914
--- /dev/null
+++ b/target/linux/generic/backport-5.15/422-v5.19-mtd-spi-nor-support-eon-en25qh256a.patch
@@ -0,0 +1,49 @@
+From 6abef37d16d0c570ef5a149e63762fba2a30804b Mon Sep 17 00:00:00 2001
+From: "Leon M. George" <leon@georgemail.eu>
+Date: Wed, 30 Mar 2022 16:16:56 +0200
+Subject: [PATCH] mtd: spi-nor: support eon en25qh256a variant
+
+The EN25QH256A variant of the EN25QH256 doesn't initialize correctly from SFDP
+alone and only accesses memory below 8m (addr_width is 4 but read_opcode takes
+only 3 bytes).
+
+Set SNOR_F_4B_OPCODES if the flash chip variant was detected using hwcaps.
+
+The fix submitted upstream uses the PARSE_SFDP initializer that is not
+available in the kernel used with Openwrt.
+
+Signed-off-by: Leon M. George <leon@georgemail.eu>
+---
+ drivers/mtd/spi-nor/eon.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/mtd/spi-nor/eon.c
++++ b/drivers/mtd/spi-nor/eon.c
+@@ -8,6 +8,16 @@
+ 
+ #include "core.h"
+ 
++static void en25qh256_post_sfdp_fixups(struct spi_nor *nor)
++{
++	if (nor->params->hwcaps.mask & SNOR_HWCAPS_READ_1_1_4)
++		nor->flags |= SNOR_F_4B_OPCODES;
++}
++
++static const struct spi_nor_fixups en25qh256_fixups = {
++	.post_sfdp = en25qh256_post_sfdp_fixups,
++};
++
+ static const struct flash_info eon_parts[] = {
+ 	/* EON -- en25xxx */
+ 	{ "en25f32",    INFO(0x1c3116, 0, 64 * 1024,   64, SECT_4K) },
+@@ -23,7 +33,9 @@ static const struct flash_info eon_parts
+ 	{ "en25qh64",   INFO(0x1c7017, 0, 64 * 1024,  128,
+ 			     SECT_4K | SPI_NOR_DUAL_READ) },
+ 	{ "en25qh128",  INFO(0x1c7018, 0, 64 * 1024,  256, 0) },
+-	{ "en25qh256",  INFO(0x1c7019, 0, 64 * 1024,  512, 0) },
++	{ "en25qh256",  INFO(0x1c7019, 0, 64 * 1024,  512,
++		SPI_NOR_DUAL_READ)
++		.fixups = &en25qh256_fixups },
+ 	{ "en25s64",	INFO(0x1c3817, 0, 64 * 1024,  128, SECT_4K) },
+ };
+ 
diff --git a/target/linux/generic/backport-5.15/423-v6.1-0001-mtd-track-maximum-number-of-bitflips-for-each-read-r.patch b/target/linux/generic/backport-5.15/423-v6.1-0001-mtd-track-maximum-number-of-bitflips-for-each-read-r.patch
new file mode 100644
index 00000000000000..9f1757caa79793
--- /dev/null
+++ b/target/linux/generic/backport-5.15/423-v6.1-0001-mtd-track-maximum-number-of-bitflips-for-each-read-r.patch
@@ -0,0 +1,73 @@
+From e237285113963bd1dd2e925770aa8b3aa8a1894c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= <kernel@kempniu.pl>
+Date: Wed, 29 Jun 2022 14:57:34 +0200
+Subject: [PATCH 1/4] mtd: track maximum number of bitflips for each read
+ request
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+mtd_read_oob() callers are currently oblivious to the details of ECC
+errors detected during the read operation - they only learn (through the
+return value) whether any corrected bitflips or uncorrectable errors
+occurred.  More detailed ECC information can be useful to user-space
+applications for making better-informed choices about moving data
+around.
+
+Extend struct mtd_oob_ops with a pointer to a newly-introduced struct
+mtd_req_stats and set its 'max_bitflips' field to the maximum number of
+bitflips found in a single ECC step during the read operation performed
+by mtd_read_oob().  This is a prerequisite for ultimately passing that
+value back to user space.
+
+Suggested-by: Boris Brezillon <boris.brezillon@collabora.com>
+Signed-off-by: Michał Kępień <kernel@kempniu.pl>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220629125737.14418-2-kernel@kempniu.pl
+---
+ drivers/mtd/mtdcore.c   | 5 +++++
+ include/linux/mtd/mtd.h | 5 +++++
+ 2 files changed, 10 insertions(+)
+
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -1676,6 +1676,9 @@ int mtd_read_oob(struct mtd_info *mtd, l
+ 	if (!master->_read_oob && (!master->_read || ops->oobbuf))
+ 		return -EOPNOTSUPP;
+ 
++	if (ops->stats)
++		memset(ops->stats, 0, sizeof(*ops->stats));
++
+ 	if (mtd->flags & MTD_SLC_ON_MLC_EMULATION)
+ 		ret_code = mtd_io_emulated_slc(mtd, from, true, ops);
+ 	else
+@@ -1693,6 +1696,8 @@ int mtd_read_oob(struct mtd_info *mtd, l
+ 		return ret_code;
+ 	if (mtd->ecc_strength == 0)
+ 		return 0;	/* device lacks ecc */
++	if (ops->stats)
++		ops->stats->max_bitflips = ret_code;
+ 	return ret_code >= mtd->bitflip_threshold ? -EUCLEAN : 0;
+ }
+ EXPORT_SYMBOL_GPL(mtd_read_oob);
+--- a/include/linux/mtd/mtd.h
++++ b/include/linux/mtd/mtd.h
+@@ -40,6 +40,10 @@ struct mtd_erase_region_info {
+ 	unsigned long *lockmap;		/* If keeping bitmap of locks */
+ };
+ 
++struct mtd_req_stats {
++	unsigned int max_bitflips;
++};
++
+ /**
+  * struct mtd_oob_ops - oob operation operands
+  * @mode:	operation mode
+@@ -70,6 +74,7 @@ struct mtd_oob_ops {
+ 	uint32_t	ooboffs;
+ 	uint8_t		*datbuf;
+ 	uint8_t		*oobbuf;
++	struct mtd_req_stats *stats;
+ };
+ 
+ #define MTD_MAX_OOBFREE_ENTRIES_LARGE	32
diff --git a/target/linux/generic/backport-5.15/423-v6.1-0002-mtd-always-initialize-stats-in-struct-mtd_oob_ops.patch b/target/linux/generic/backport-5.15/423-v6.1-0002-mtd-always-initialize-stats-in-struct-mtd_oob_ops.patch
new file mode 100644
index 00000000000000..1484624e4e5194
--- /dev/null
+++ b/target/linux/generic/backport-5.15/423-v6.1-0002-mtd-always-initialize-stats-in-struct-mtd_oob_ops.patch
@@ -0,0 +1,325 @@
+From e97709c9d18903f5acd5fbe2985dd054da0432b1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= <kernel@kempniu.pl>
+Date: Wed, 29 Jun 2022 14:57:35 +0200
+Subject: [PATCH 2/4] mtd: always initialize 'stats' in struct mtd_oob_ops
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+As the 'stats' field in struct mtd_oob_ops is used in conditional
+expressions, ensure it is always zero-initialized in all such structures
+to prevent random stack garbage from being interpreted as a pointer.
+
+Strictly speaking, this problem currently only needs to be fixed for
+struct mtd_oob_ops structures subsequently passed to mtd_read_oob().
+However, this commit goes a step further and makes all instances of
+struct mtd_oob_ops in the tree zero-initialized, in hope of preventing
+future problems, e.g. if struct mtd_req_stats gets extended with write
+statistics at some point.
+
+Signed-off-by: Michał Kępień <kernel@kempniu.pl>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220629125737.14418-3-kernel@kempniu.pl
+---
+ drivers/mtd/inftlcore.c                 | 6 +++---
+ drivers/mtd/mtdswap.c                   | 6 +++---
+ drivers/mtd/nand/onenand/onenand_base.c | 4 ++--
+ drivers/mtd/nand/onenand/onenand_bbt.c  | 2 +-
+ drivers/mtd/nand/raw/nand_bbt.c         | 8 ++++----
+ drivers/mtd/nand/raw/sm_common.c        | 2 +-
+ drivers/mtd/nftlcore.c                  | 6 +++---
+ drivers/mtd/sm_ftl.c                    | 4 ++--
+ drivers/mtd/ssfdc.c                     | 2 +-
+ drivers/mtd/tests/nandbiterrs.c         | 2 +-
+ drivers/mtd/tests/oobtest.c             | 8 ++++----
+ drivers/mtd/tests/readtest.c            | 2 +-
+ fs/jffs2/wbuf.c                         | 6 +++---
+ 13 files changed, 29 insertions(+), 29 deletions(-)
+
+--- a/drivers/mtd/inftlcore.c
++++ b/drivers/mtd/inftlcore.c
+@@ -136,7 +136,7 @@ static void inftl_remove_dev(struct mtd_
+ int inftl_read_oob(struct mtd_info *mtd, loff_t offs, size_t len,
+ 		   size_t *retlen, uint8_t *buf)
+ {
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 	int res;
+ 
+ 	ops.mode = MTD_OPS_PLACE_OOB;
+@@ -156,7 +156,7 @@ int inftl_read_oob(struct mtd_info *mtd,
+ int inftl_write_oob(struct mtd_info *mtd, loff_t offs, size_t len,
+ 		    size_t *retlen, uint8_t *buf)
+ {
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 	int res;
+ 
+ 	ops.mode = MTD_OPS_PLACE_OOB;
+@@ -176,7 +176,7 @@ int inftl_write_oob(struct mtd_info *mtd
+ static int inftl_write(struct mtd_info *mtd, loff_t offs, size_t len,
+ 		       size_t *retlen, uint8_t *buf, uint8_t *oob)
+ {
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 	int res;
+ 
+ 	ops.mode = MTD_OPS_PLACE_OOB;
+--- a/drivers/mtd/mtdswap.c
++++ b/drivers/mtd/mtdswap.c
+@@ -323,7 +323,7 @@ static int mtdswap_read_markers(struct m
+ 	struct mtdswap_oobdata *data, *data2;
+ 	int ret;
+ 	loff_t offset;
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 
+ 	offset = mtdswap_eb_offset(d, eb);
+ 
+@@ -370,7 +370,7 @@ static int mtdswap_write_marker(struct m
+ 	struct mtdswap_oobdata n;
+ 	int ret;
+ 	loff_t offset;
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 
+ 	ops.ooboffs = 0;
+ 	ops.oobbuf = (uint8_t *)&n;
+@@ -879,7 +879,7 @@ static unsigned int mtdswap_eblk_passes(
+ 	loff_t base, pos;
+ 	unsigned int *p1 = (unsigned int *)d->page_buf;
+ 	unsigned char *p2 = (unsigned char *)d->oob_buf;
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 	int ret;
+ 
+ 	ops.mode = MTD_OPS_AUTO_OOB;
+--- a/drivers/mtd/nand/onenand/onenand_base.c
++++ b/drivers/mtd/nand/onenand/onenand_base.c
+@@ -2935,7 +2935,7 @@ static int do_otp_write(struct mtd_info
+ 	struct onenand_chip *this = mtd->priv;
+ 	unsigned char *pbuf = buf;
+ 	int ret;
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 
+ 	/* Force buffer page aligned */
+ 	if (len < mtd->writesize) {
+@@ -2977,7 +2977,7 @@ static int do_otp_lock(struct mtd_info *
+ 		size_t *retlen, u_char *buf)
+ {
+ 	struct onenand_chip *this = mtd->priv;
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 	int ret;
+ 
+ 	if (FLEXONENAND(this)) {
+--- a/drivers/mtd/nand/onenand/onenand_bbt.c
++++ b/drivers/mtd/nand/onenand/onenand_bbt.c
+@@ -61,7 +61,7 @@ static int create_bbt(struct mtd_info *m
+ 	int startblock;
+ 	loff_t from;
+ 	size_t readlen, ooblen;
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 	int rgn;
+ 
+ 	printk(KERN_INFO "Scanning device for bad blocks\n");
+--- a/drivers/mtd/nand/raw/nand_bbt.c
++++ b/drivers/mtd/nand/raw/nand_bbt.c
+@@ -313,7 +313,7 @@ static int scan_read_oob(struct nand_chi
+ 			 size_t len)
+ {
+ 	struct mtd_info *mtd = nand_to_mtd(this);
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 	int res, ret = 0;
+ 
+ 	ops.mode = MTD_OPS_PLACE_OOB;
+@@ -354,7 +354,7 @@ static int scan_write_bbt(struct nand_ch
+ 			  uint8_t *buf, uint8_t *oob)
+ {
+ 	struct mtd_info *mtd = nand_to_mtd(this);
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 
+ 	ops.mode = MTD_OPS_PLACE_OOB;
+ 	ops.ooboffs = 0;
+@@ -416,7 +416,7 @@ static int scan_block_fast(struct nand_c
+ {
+ 	struct mtd_info *mtd = nand_to_mtd(this);
+ 
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 	int ret, page_offset;
+ 
+ 	ops.ooblen = mtd->oobsize;
+@@ -756,7 +756,7 @@ static int write_bbt(struct nand_chip *t
+ 	uint8_t rcode = td->reserved_block_code;
+ 	size_t retlen, len = 0;
+ 	loff_t to;
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 
+ 	ops.ooblen = mtd->oobsize;
+ 	ops.ooboffs = 0;
+--- a/drivers/mtd/nand/raw/sm_common.c
++++ b/drivers/mtd/nand/raw/sm_common.c
+@@ -99,7 +99,7 @@ static const struct mtd_ooblayout_ops oo
+ static int sm_block_markbad(struct nand_chip *chip, loff_t ofs)
+ {
+ 	struct mtd_info *mtd = nand_to_mtd(chip);
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 	struct sm_oob oob;
+ 	int ret;
+ 
+--- a/drivers/mtd/nftlcore.c
++++ b/drivers/mtd/nftlcore.c
+@@ -124,7 +124,7 @@ int nftl_read_oob(struct mtd_info *mtd,
+ 		  size_t *retlen, uint8_t *buf)
+ {
+ 	loff_t mask = mtd->writesize - 1;
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 	int res;
+ 
+ 	ops.mode = MTD_OPS_PLACE_OOB;
+@@ -145,7 +145,7 @@ int nftl_write_oob(struct mtd_info *mtd,
+ 		   size_t *retlen, uint8_t *buf)
+ {
+ 	loff_t mask = mtd->writesize - 1;
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 	int res;
+ 
+ 	ops.mode = MTD_OPS_PLACE_OOB;
+@@ -168,7 +168,7 @@ static int nftl_write(struct mtd_info *m
+ 		      size_t *retlen, uint8_t *buf, uint8_t *oob)
+ {
+ 	loff_t mask = mtd->writesize - 1;
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 	int res;
+ 
+ 	ops.mode = MTD_OPS_PLACE_OOB;
+--- a/drivers/mtd/sm_ftl.c
++++ b/drivers/mtd/sm_ftl.c
+@@ -239,7 +239,7 @@ static int sm_read_sector(struct sm_ftl
+ 			  uint8_t *buffer, struct sm_oob *oob)
+ {
+ 	struct mtd_info *mtd = ftl->trans->mtd;
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 	struct sm_oob tmp_oob;
+ 	int ret = -EIO;
+ 	int try = 0;
+@@ -323,7 +323,7 @@ static int sm_write_sector(struct sm_ftl
+ 			   int zone, int block, int boffset,
+ 			   uint8_t *buffer, struct sm_oob *oob)
+ {
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 	struct mtd_info *mtd = ftl->trans->mtd;
+ 	int ret;
+ 
+--- a/drivers/mtd/ssfdc.c
++++ b/drivers/mtd/ssfdc.c
+@@ -163,7 +163,7 @@ static int read_physical_sector(struct m
+ /* Read redundancy area (wrapper to MTD_READ_OOB */
+ static int read_raw_oob(struct mtd_info *mtd, loff_t offs, uint8_t *buf)
+ {
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 	int ret;
+ 
+ 	ops.mode = MTD_OPS_RAW;
+--- a/drivers/mtd/tests/nandbiterrs.c
++++ b/drivers/mtd/tests/nandbiterrs.c
+@@ -99,7 +99,7 @@ static int write_page(int log)
+ static int rewrite_page(int log)
+ {
+ 	int err = 0;
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 
+ 	if (log)
+ 		pr_info("rewrite page\n");
+--- a/drivers/mtd/tests/oobtest.c
++++ b/drivers/mtd/tests/oobtest.c
+@@ -56,7 +56,7 @@ static void do_vary_offset(void)
+ static int write_eraseblock(int ebnum)
+ {
+ 	int i;
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 	int err = 0;
+ 	loff_t addr = (loff_t)ebnum * mtd->erasesize;
+ 
+@@ -165,7 +165,7 @@ static size_t memffshow(loff_t addr, lof
+ static int verify_eraseblock(int ebnum)
+ {
+ 	int i;
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 	int err = 0;
+ 	loff_t addr = (loff_t)ebnum * mtd->erasesize;
+ 	size_t bitflips;
+@@ -260,7 +260,7 @@ static int verify_eraseblock(int ebnum)
+ 
+ static int verify_eraseblock_in_one_go(int ebnum)
+ {
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 	int err = 0;
+ 	loff_t addr = (loff_t)ebnum * mtd->erasesize;
+ 	size_t len = mtd->oobavail * pgcnt;
+@@ -338,7 +338,7 @@ static int __init mtd_oobtest_init(void)
+ 	int err = 0;
+ 	unsigned int i;
+ 	uint64_t tmp;
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 	loff_t addr = 0, addr0;
+ 
+ 	printk(KERN_INFO "\n");
+--- a/drivers/mtd/tests/readtest.c
++++ b/drivers/mtd/tests/readtest.c
+@@ -47,7 +47,7 @@ static int read_eraseblock_by_page(int e
+ 				err = ret;
+ 		}
+ 		if (mtd->oobsize) {
+-			struct mtd_oob_ops ops;
++			struct mtd_oob_ops ops = { };
+ 
+ 			ops.mode      = MTD_OPS_PLACE_OOB;
+ 			ops.len       = 0;
+--- a/fs/jffs2/wbuf.c
++++ b/fs/jffs2/wbuf.c
+@@ -1035,7 +1035,7 @@ int jffs2_check_oob_empty(struct jffs2_s
+ {
+ 	int i, ret;
+ 	int cmlen = min_t(int, c->oobavail, OOB_CM_SIZE);
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 
+ 	ops.mode = MTD_OPS_AUTO_OOB;
+ 	ops.ooblen = NR_OOB_SCAN_PAGES * c->oobavail;
+@@ -1076,7 +1076,7 @@ int jffs2_check_oob_empty(struct jffs2_s
+ int jffs2_check_nand_cleanmarker(struct jffs2_sb_info *c,
+ 				 struct jffs2_eraseblock *jeb)
+ {
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 	int ret, cmlen = min_t(int, c->oobavail, OOB_CM_SIZE);
+ 
+ 	ops.mode = MTD_OPS_AUTO_OOB;
+@@ -1101,7 +1101,7 @@ int jffs2_write_nand_cleanmarker(struct
+ 				 struct jffs2_eraseblock *jeb)
+ {
+ 	int ret;
+-	struct mtd_oob_ops ops;
++	struct mtd_oob_ops ops = { };
+ 	int cmlen = min_t(int, c->oobavail, OOB_CM_SIZE);
+ 
+ 	ops.mode = MTD_OPS_AUTO_OOB;
diff --git a/target/linux/generic/backport-5.15/423-v6.1-0003-mtd-add-ECC-error-accounting-for-each-read-request.patch b/target/linux/generic/backport-5.15/423-v6.1-0003-mtd-add-ECC-error-accounting-for-each-read-request.patch
new file mode 100644
index 00000000000000..f2f45eb7bc7ad9
--- /dev/null
+++ b/target/linux/generic/backport-5.15/423-v6.1-0003-mtd-add-ECC-error-accounting-for-each-read-request.patch
@@ -0,0 +1,172 @@
+From 2ed18d818d1f7492172f8dd5904344c7d367e8ed Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= <kernel@kempniu.pl>
+Date: Wed, 29 Jun 2022 14:57:36 +0200
+Subject: [PATCH 3/4] mtd: add ECC error accounting for each read request
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Extend struct mtd_req_stats with two new fields holding the number of
+corrected bitflips and uncorrectable errors detected during a read
+operation.  This is a prerequisite for ultimately passing those counters
+to user space, where they can be useful to applications for making
+better-informed choices about moving data around.
+
+Unlike 'max_bitflips' (which is set - in a common code path - to the
+return value of a function called while the MTD device's mutex is held),
+these counters have to be maintained in each MTD driver which defines
+the '_read_oob' callback because the statistics need to be calculated
+while the MTD device's mutex is held.
+
+Suggested-by: Boris Brezillon <boris.brezillon@collabora.com>
+Signed-off-by: Michał Kępień <kernel@kempniu.pl>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220629125737.14418-4-kernel@kempniu.pl
+---
+ drivers/mtd/devices/docg3.c             |  8 ++++++++
+ drivers/mtd/nand/onenand/onenand_base.c | 12 ++++++++++++
+ drivers/mtd/nand/raw/nand_base.c        | 10 ++++++++++
+ drivers/mtd/nand/spi/core.c             | 10 ++++++++++
+ include/linux/mtd/mtd.h                 |  2 ++
+ 5 files changed, 42 insertions(+)
+
+--- a/drivers/mtd/devices/docg3.c
++++ b/drivers/mtd/devices/docg3.c
+@@ -871,6 +871,7 @@ static int doc_read_oob(struct mtd_info
+ 	u8 *buf = ops->datbuf;
+ 	size_t len, ooblen, nbdata, nboob;
+ 	u8 hwecc[DOC_ECC_BCH_SIZE], eccconf1;
++	struct mtd_ecc_stats old_stats;
+ 	int max_bitflips = 0;
+ 
+ 	if (buf)
+@@ -895,6 +896,7 @@ static int doc_read_oob(struct mtd_info
+ 	ret = 0;
+ 	skip = from % DOC_LAYOUT_PAGE_SIZE;
+ 	mutex_lock(&docg3->cascade->lock);
++	old_stats = mtd->ecc_stats;
+ 	while (ret >= 0 && (len > 0 || ooblen > 0)) {
+ 		calc_block_sector(from - skip, &block0, &block1, &page, &ofs,
+ 			docg3->reliable);
+@@ -966,6 +968,12 @@ static int doc_read_oob(struct mtd_info
+ 	}
+ 
+ out:
++	if (ops->stats) {
++		ops->stats->uncorrectable_errors +=
++			mtd->ecc_stats.failed - old_stats.failed;
++		ops->stats->corrected_bitflips +=
++			mtd->ecc_stats.corrected - old_stats.corrected;
++	}
+ 	mutex_unlock(&docg3->cascade->lock);
+ 	return ret;
+ err_in_read:
+--- a/drivers/mtd/nand/onenand/onenand_base.c
++++ b/drivers/mtd/nand/onenand/onenand_base.c
+@@ -1440,6 +1440,7 @@ static int onenand_read_oob(struct mtd_i
+ 			    struct mtd_oob_ops *ops)
+ {
+ 	struct onenand_chip *this = mtd->priv;
++	struct mtd_ecc_stats old_stats;
+ 	int ret;
+ 
+ 	switch (ops->mode) {
+@@ -1453,12 +1454,23 @@ static int onenand_read_oob(struct mtd_i
+ 	}
+ 
+ 	onenand_get_device(mtd, FL_READING);
++
++	old_stats = mtd->ecc_stats;
++
+ 	if (ops->datbuf)
+ 		ret = ONENAND_IS_4KB_PAGE(this) ?
+ 			onenand_mlc_read_ops_nolock(mtd, from, ops) :
+ 			onenand_read_ops_nolock(mtd, from, ops);
+ 	else
+ 		ret = onenand_read_oob_nolock(mtd, from, ops);
++
++	if (ops->stats) {
++		ops->stats->uncorrectable_errors +=
++			mtd->ecc_stats.failed - old_stats.failed;
++		ops->stats->corrected_bitflips +=
++			mtd->ecc_stats.corrected - old_stats.corrected;
++	}
++
+ 	onenand_release_device(mtd);
+ 
+ 	return ret;
+--- a/drivers/mtd/nand/raw/nand_base.c
++++ b/drivers/mtd/nand/raw/nand_base.c
+@@ -3815,6 +3815,7 @@ static int nand_read_oob(struct mtd_info
+ 			 struct mtd_oob_ops *ops)
+ {
+ 	struct nand_chip *chip = mtd_to_nand(mtd);
++	struct mtd_ecc_stats old_stats;
+ 	int ret;
+ 
+ 	ops->retlen = 0;
+@@ -3826,11 +3827,20 @@ static int nand_read_oob(struct mtd_info
+ 
+ 	nand_get_device(chip);
+ 
++	old_stats = mtd->ecc_stats;
++
+ 	if (!ops->datbuf)
+ 		ret = nand_do_read_oob(chip, from, ops);
+ 	else
+ 		ret = nand_do_read_ops(chip, from, ops);
+ 
++	if (ops->stats) {
++		ops->stats->uncorrectable_errors +=
++			mtd->ecc_stats.failed - old_stats.failed;
++		ops->stats->corrected_bitflips +=
++			mtd->ecc_stats.corrected - old_stats.corrected;
++	}
++
+ 	nand_release_device(chip);
+ 	return ret;
+ }
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -629,6 +629,7 @@ static int spinand_mtd_read(struct mtd_i
+ {
+ 	struct spinand_device *spinand = mtd_to_spinand(mtd);
+ 	struct nand_device *nand = mtd_to_nanddev(mtd);
++	struct mtd_ecc_stats old_stats;
+ 	unsigned int max_bitflips = 0;
+ 	struct nand_io_iter iter;
+ 	bool disable_ecc = false;
+@@ -640,6 +641,8 @@ static int spinand_mtd_read(struct mtd_i
+ 
+ 	mutex_lock(&spinand->lock);
+ 
++	old_stats = mtd->ecc_stats;
++
+ 	nanddev_io_for_each_page(nand, NAND_PAGE_READ, from, ops, &iter) {
+ 		if (disable_ecc)
+ 			iter.req.mode = MTD_OPS_RAW;
+@@ -662,6 +665,13 @@ static int spinand_mtd_read(struct mtd_i
+ 		ops->oobretlen += iter.req.ooblen;
+ 	}
+ 
++	if (ops->stats) {
++		ops->stats->uncorrectable_errors +=
++			mtd->ecc_stats.failed - old_stats.failed;
++		ops->stats->corrected_bitflips +=
++			mtd->ecc_stats.corrected - old_stats.corrected;
++	}
++
+ 	mutex_unlock(&spinand->lock);
+ 
+ 	if (ecc_failed && !ret)
+--- a/include/linux/mtd/mtd.h
++++ b/include/linux/mtd/mtd.h
+@@ -41,6 +41,8 @@ struct mtd_erase_region_info {
+ };
+ 
+ struct mtd_req_stats {
++	unsigned int uncorrectable_errors;
++	unsigned int corrected_bitflips;
+ 	unsigned int max_bitflips;
+ };
+ 
diff --git a/target/linux/generic/backport-5.15/423-v6.1-0004-mtdchar-add-MEMREAD-ioctl.patch b/target/linux/generic/backport-5.15/423-v6.1-0004-mtdchar-add-MEMREAD-ioctl.patch
new file mode 100644
index 00000000000000..182e4f6ab5685c
--- /dev/null
+++ b/target/linux/generic/backport-5.15/423-v6.1-0004-mtdchar-add-MEMREAD-ioctl.patch
@@ -0,0 +1,321 @@
+From 2c9745d36e04ac27161acd78514f647b9b587ad4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= <kernel@kempniu.pl>
+Date: Wed, 29 Jun 2022 14:57:37 +0200
+Subject: [PATCH 4/4] mtdchar: add MEMREAD ioctl
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+User-space applications making use of MTD devices via /dev/mtd*
+character devices currently have limited capabilities for reading data:
+
+  - only deprecated methods of accessing OOB layout information exist,
+
+  - there is no way to explicitly specify MTD operation mode to use; it
+    is auto-selected based on the MTD file mode (MTD_FILE_MODE_*) set
+    for the character device; in particular, this prevents using
+    MTD_OPS_AUTO_OOB for reads,
+
+  - all existing user-space interfaces which cause mtd_read() or
+    mtd_read_oob() to be called (via mtdchar_read() and
+    mtdchar_read_oob(), respectively) return success even when those
+    functions return -EUCLEAN or -EBADMSG; this renders user-space
+    applications using these interfaces unaware of any corrected
+    bitflips or uncorrectable ECC errors detected during reads.
+
+Note that the existing MEMWRITE ioctl allows the MTD operation mode to
+be explicitly set, allowing user-space applications to write page data
+and OOB data without requiring them to know anything about the OOB
+layout of the MTD device they are writing to (MTD_OPS_AUTO_OOB).  Also,
+the MEMWRITE ioctl does not mangle the return value of mtd_write_oob().
+
+Add a new ioctl, MEMREAD, which addresses the above issues.  It is
+intended to be a read-side counterpart of the existing MEMWRITE ioctl.
+Similarly to the latter, the read operation is performed in a loop which
+processes at most mtd->erasesize bytes in each iteration.  This is done
+to prevent unbounded memory allocations caused by calling kmalloc() with
+the 'size' argument taken directly from the struct mtd_read_req provided
+by user space.  However, the new ioctl is implemented so that the values
+it returns match those that would have been returned if just a single
+mtd_read_oob() call was issued to handle the entire read operation in
+one go.
+
+Note that while just returning -EUCLEAN or -EBADMSG to user space would
+already be a valid and useful indication of the ECC algorithm detecting
+errors during a read operation, that signal would not be granular enough
+to cover all use cases.  For example, knowing the maximum number of
+bitflips detected in a single ECC step during a read operation performed
+on a given page may be useful when dealing with an MTD partition whose
+ECC layout varies across pages (e.g. a partition consisting of a
+bootloader area using a "custom" ECC layout followed by data pages using
+a "standard" ECC layout).  To address that, include ECC statistics in
+the structure returned to user space by the new MEMREAD ioctl.
+
+Link: https://www.infradead.org/pipermail/linux-mtd/2016-April/067085.html
+
+Suggested-by: Boris Brezillon <boris.brezillon@collabora.com>
+Signed-off-by: Michał Kępień <kernel@kempniu.pl>
+Acked-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220629125737.14418-5-kernel@kempniu.pl
+---
+ drivers/mtd/mtdchar.c      | 139 +++++++++++++++++++++++++++++++++++++
+ include/uapi/mtd/mtd-abi.h |  64 +++++++++++++++--
+ 2 files changed, 198 insertions(+), 5 deletions(-)
+
+--- a/drivers/mtd/mtdchar.c
++++ b/drivers/mtd/mtdchar.c
+@@ -621,6 +621,137 @@ static int mtdchar_write_ioctl(struct mt
+ 	return ret;
+ }
+ 
++static int mtdchar_read_ioctl(struct mtd_info *mtd,
++		struct mtd_read_req __user *argp)
++{
++	struct mtd_info *master = mtd_get_master(mtd);
++	struct mtd_read_req req;
++	void __user *usr_data, *usr_oob;
++	uint8_t *datbuf = NULL, *oobbuf = NULL;
++	size_t datbuf_len, oobbuf_len;
++	size_t orig_len, orig_ooblen;
++	int ret = 0;
++
++	if (copy_from_user(&req, argp, sizeof(req)))
++		return -EFAULT;
++
++	orig_len = req.len;
++	orig_ooblen = req.ooblen;
++
++	usr_data = (void __user *)(uintptr_t)req.usr_data;
++	usr_oob = (void __user *)(uintptr_t)req.usr_oob;
++
++	if (!master->_read_oob)
++		return -EOPNOTSUPP;
++
++	if (!usr_data)
++		req.len = 0;
++
++	if (!usr_oob)
++		req.ooblen = 0;
++
++	req.ecc_stats.uncorrectable_errors = 0;
++	req.ecc_stats.corrected_bitflips = 0;
++	req.ecc_stats.max_bitflips = 0;
++
++	req.len &= 0xffffffff;
++	req.ooblen &= 0xffffffff;
++
++	if (req.start + req.len > mtd->size) {
++		ret = -EINVAL;
++		goto out;
++	}
++
++	datbuf_len = min_t(size_t, req.len, mtd->erasesize);
++	if (datbuf_len > 0) {
++		datbuf = kvmalloc(datbuf_len, GFP_KERNEL);
++		if (!datbuf) {
++			ret = -ENOMEM;
++			goto out;
++		}
++	}
++
++	oobbuf_len = min_t(size_t, req.ooblen, mtd->erasesize);
++	if (oobbuf_len > 0) {
++		oobbuf = kvmalloc(oobbuf_len, GFP_KERNEL);
++		if (!oobbuf) {
++			ret = -ENOMEM;
++			goto out;
++		}
++	}
++
++	while (req.len > 0 || (!usr_data && req.ooblen > 0)) {
++		struct mtd_req_stats stats;
++		struct mtd_oob_ops ops = {
++			.mode = req.mode,
++			.len = min_t(size_t, req.len, datbuf_len),
++			.ooblen = min_t(size_t, req.ooblen, oobbuf_len),
++			.datbuf = datbuf,
++			.oobbuf = oobbuf,
++			.stats = &stats,
++		};
++
++		/*
++		 * Shorten non-page-aligned, eraseblock-sized reads so that the
++		 * read ends on an eraseblock boundary.  This is necessary in
++		 * order to prevent OOB data for some pages from being
++		 * duplicated in the output of non-page-aligned reads requiring
++		 * multiple mtd_read_oob() calls to be completed.
++		 */
++		if (ops.len == mtd->erasesize)
++			ops.len -= mtd_mod_by_ws(req.start + ops.len, mtd);
++
++		ret = mtd_read_oob(mtd, (loff_t)req.start, &ops);
++
++		req.ecc_stats.uncorrectable_errors +=
++			stats.uncorrectable_errors;
++		req.ecc_stats.corrected_bitflips += stats.corrected_bitflips;
++		req.ecc_stats.max_bitflips =
++			max(req.ecc_stats.max_bitflips, stats.max_bitflips);
++
++		if (ret && !mtd_is_bitflip_or_eccerr(ret))
++			break;
++
++		if (copy_to_user(usr_data, ops.datbuf, ops.retlen) ||
++		    copy_to_user(usr_oob, ops.oobbuf, ops.oobretlen)) {
++			ret = -EFAULT;
++			break;
++		}
++
++		req.start += ops.retlen;
++		req.len -= ops.retlen;
++		usr_data += ops.retlen;
++
++		req.ooblen -= ops.oobretlen;
++		usr_oob += ops.oobretlen;
++	}
++
++	/*
++	 * As multiple iterations of the above loop (and therefore multiple
++	 * mtd_read_oob() calls) may be necessary to complete the read request,
++	 * adjust the final return code to ensure it accounts for all detected
++	 * ECC errors.
++	 */
++	if (!ret || mtd_is_bitflip(ret)) {
++		if (req.ecc_stats.uncorrectable_errors > 0)
++			ret = -EBADMSG;
++		else if (req.ecc_stats.corrected_bitflips > 0)
++			ret = -EUCLEAN;
++	}
++
++out:
++	req.len = orig_len - req.len;
++	req.ooblen = orig_ooblen - req.ooblen;
++
++	if (copy_to_user(argp, &req, sizeof(req)))
++		ret = -EFAULT;
++
++	kvfree(datbuf);
++	kvfree(oobbuf);
++
++	return ret;
++}
++
+ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
+ {
+ 	struct mtd_file_info *mfi = file->private_data;
+@@ -643,6 +774,7 @@ static int mtdchar_ioctl(struct file *fi
+ 	case MEMGETINFO:
+ 	case MEMREADOOB:
+ 	case MEMREADOOB64:
++	case MEMREAD:
+ 	case MEMISLOCKED:
+ 	case MEMGETOOBSEL:
+ 	case MEMGETBADBLOCK:
+@@ -817,6 +949,13 @@ static int mtdchar_ioctl(struct file *fi
+ 		break;
+ 	}
+ 
++	case MEMREAD:
++	{
++		ret = mtdchar_read_ioctl(mtd,
++		      (struct mtd_read_req __user *)arg);
++		break;
++	}
++
+ 	case MEMLOCK:
+ 	{
+ 		struct erase_info_user einfo;
+--- a/include/uapi/mtd/mtd-abi.h
++++ b/include/uapi/mtd/mtd-abi.h
+@@ -55,9 +55,9 @@ struct mtd_oob_buf64 {
+  * @MTD_OPS_RAW:	data are transferred as-is, with no error correction;
+  *			this mode implies %MTD_OPS_PLACE_OOB
+  *
+- * These modes can be passed to ioctl(MEMWRITE) and are also used internally.
+- * See notes on "MTD file modes" for discussion on %MTD_OPS_RAW vs.
+- * %MTD_FILE_MODE_RAW.
++ * These modes can be passed to ioctl(MEMWRITE) and ioctl(MEMREAD); they are
++ * also used internally. See notes on "MTD file modes" for discussion on
++ * %MTD_OPS_RAW vs. %MTD_FILE_MODE_RAW.
+  */
+ enum {
+ 	MTD_OPS_PLACE_OOB = 0,
+@@ -91,6 +91,53 @@ struct mtd_write_req {
+ 	__u8 padding[7];
+ };
+ 
++/**
++ * struct mtd_read_req_ecc_stats - ECC statistics for a read operation
++ *
++ * @uncorrectable_errors: the number of uncorrectable errors that happened
++ *			  during the read operation
++ * @corrected_bitflips: the number of bitflips corrected during the read
++ *			operation
++ * @max_bitflips: the maximum number of bitflips detected in any single ECC
++ *		  step for the data read during the operation; this information
++ *		  can be used to decide whether the data stored in a specific
++ *		  region of the MTD device should be moved somewhere else to
++ *		  avoid data loss.
++ */
++struct mtd_read_req_ecc_stats {
++	__u32 uncorrectable_errors;
++	__u32 corrected_bitflips;
++	__u32 max_bitflips;
++};
++
++/**
++ * struct mtd_read_req - data structure for requesting a read operation
++ *
++ * @start:	start address
++ * @len:	length of data buffer (only lower 32 bits are used)
++ * @ooblen:	length of OOB buffer (only lower 32 bits are used)
++ * @usr_data:	user-provided data buffer
++ * @usr_oob:	user-provided OOB buffer
++ * @mode:	MTD mode (see "MTD operation modes")
++ * @padding:	reserved, must be set to 0
++ * @ecc_stats:	ECC statistics for the read operation
++ *
++ * This structure supports ioctl(MEMREAD) operations, allowing data and/or OOB
++ * reads in various modes. To read from OOB-only, set @usr_data == NULL, and to
++ * read data-only, set @usr_oob == NULL. However, setting both @usr_data and
++ * @usr_oob to NULL is not allowed.
++ */
++struct mtd_read_req {
++	__u64 start;
++	__u64 len;
++	__u64 ooblen;
++	__u64 usr_data;
++	__u64 usr_oob;
++	__u8 mode;
++	__u8 padding[7];
++	struct mtd_read_req_ecc_stats ecc_stats;
++};
++
+ #define MTD_ABSENT		0
+ #define MTD_RAM			1
+ #define MTD_ROM			2
+@@ -207,6 +254,12 @@ struct otp_info {
+ #define MEMWRITE		_IOWR('M', 24, struct mtd_write_req)
+ /* Erase a given range of user data (must be in mode %MTD_FILE_MODE_OTP_USER) */
+ #define OTPERASE		_IOW('M', 25, struct otp_info)
++/*
++ * Most generic read interface; can read in-band and/or out-of-band in various
++ * modes (see "struct mtd_read_req"). This ioctl is not supported for flashes
++ * without OOB, e.g., NOR flash.
++ */
++#define MEMREAD			_IOWR('M', 26, struct mtd_read_req)
+ 
+ /*
+  * Obsolete legacy interface. Keep it in order not to break userspace
+@@ -270,8 +323,9 @@ struct mtd_ecc_stats {
+  * Note: %MTD_FILE_MODE_RAW provides the same functionality as %MTD_OPS_RAW -
+  * raw access to the flash, without error correction or autoplacement schemes.
+  * Wherever possible, the MTD_OPS_* mode will override the MTD_FILE_MODE_* mode
+- * (e.g., when using ioctl(MEMWRITE)), but in some cases, the MTD_FILE_MODE is
+- * used out of necessity (e.g., `write()', ioctl(MEMWRITEOOB64)).
++ * (e.g., when using ioctl(MEMWRITE) or ioctl(MEMREAD)), but in some cases, the
++ * MTD_FILE_MODE is used out of necessity (e.g., `write()',
++ * ioctl(MEMWRITEOOB64)).
+  */
+ enum mtd_file_modes {
+ 	MTD_FILE_MODE_NORMAL = MTD_OTP_OFF,
diff --git a/target/linux/generic/backport-5.15/423-v6.3-mtd-spinand-macronix-use-scratch-buffer-for-DMA-oper.patch b/target/linux/generic/backport-5.15/423-v6.3-mtd-spinand-macronix-use-scratch-buffer-for-DMA-oper.patch
new file mode 100644
index 00000000000000..7dbc2717250bfc
--- /dev/null
+++ b/target/linux/generic/backport-5.15/423-v6.3-mtd-spinand-macronix-use-scratch-buffer-for-DMA-oper.patch
@@ -0,0 +1,35 @@
+From ebed787a0becb9354f0a23620a5130cccd6c730c Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 19 Jan 2023 03:45:43 +0000
+Subject: [PATCH] mtd: spinand: macronix: use scratch buffer for DMA operation
+
+The mx35lf1ge4ab_get_eccsr() function uses an SPI DMA operation to
+read the eccsr, hence the buffer should not be on stack. Since commit
+380583227c0c7f ("spi: spi-mem: Add extra sanity checks on the op param")
+the kernel emmits a warning and blocks such operations.
+
+Use the scratch buffer to get eccsr instead of trying to directly read
+into a stack-allocated variable.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Dhruva Gole <d-gole@ti.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/Y8i85zM0u4XdM46z@makrotopia.org
+---
+ drivers/mtd/nand/spi/macronix.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/spi/macronix.c
++++ b/drivers/mtd/nand/spi/macronix.c
+@@ -83,9 +83,10 @@ static int mx35lf1ge4ab_ecc_get_status(s
+ 		 * in order to avoid forcing the wear-leveling layer to move
+ 		 * data around if it's not necessary.
+ 		 */
+-		if (mx35lf1ge4ab_get_eccsr(spinand, &eccsr))
++		if (mx35lf1ge4ab_get_eccsr(spinand, spinand->scratchbuf))
+ 			return nanddev_get_ecc_conf(nand)->strength;
+ 
++		eccsr = *spinand->scratchbuf;
+ 		if (WARN_ON(eccsr > nanddev_get_ecc_conf(nand)->strength ||
+ 			    !eccsr))
+ 			return nanddev_get_ecc_conf(nand)->strength;
diff --git a/target/linux/generic/backport-5.15/424-v6.4-0004-mtd-core-prepare-mtd_otp_nvmem_add-to-handle-EPROBE_.patch b/target/linux/generic/backport-5.15/424-v6.4-0004-mtd-core-prepare-mtd_otp_nvmem_add-to-handle-EPROBE_.patch
new file mode 100644
index 00000000000000..2d89a5db1266ed
--- /dev/null
+++ b/target/linux/generic/backport-5.15/424-v6.4-0004-mtd-core-prepare-mtd_otp_nvmem_add-to-handle-EPROBE_.patch
@@ -0,0 +1,47 @@
+From 281f7a6c1a33fffcde32001bacbb4f672140fbf9 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Wed, 8 Mar 2023 09:20:21 +0100
+Subject: [PATCH] mtd: core: prepare mtd_otp_nvmem_add() to handle
+ -EPROBE_DEFER
+
+NVMEM soon will get the ability for nvmem layouts and these might
+not be ready when nvmem_register() is called and thus it might
+return -EPROBE_DEFER. Don't print the error message in this case.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20230308082021.870459-4-michael@walle.cc
+---
+ drivers/mtd/mtdcore.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -960,8 +960,8 @@ static int mtd_otp_nvmem_add(struct mtd_
+ 			nvmem = mtd_otp_nvmem_register(mtd, "user-otp", size,
+ 						       mtd_nvmem_user_otp_reg_read);
+ 			if (IS_ERR(nvmem)) {
+-				dev_err(dev, "Failed to register OTP NVMEM device\n");
+-				return PTR_ERR(nvmem);
++				err = PTR_ERR(nvmem);
++				goto err;
+ 			}
+ 			mtd->otp_user_nvmem = nvmem;
+ 		}
+@@ -978,7 +978,6 @@ static int mtd_otp_nvmem_add(struct mtd_
+ 			nvmem = mtd_otp_nvmem_register(mtd, "factory-otp", size,
+ 						       mtd_nvmem_fact_otp_reg_read);
+ 			if (IS_ERR(nvmem)) {
+-				dev_err(dev, "Failed to register OTP NVMEM device\n");
+ 				err = PTR_ERR(nvmem);
+ 				goto err;
+ 			}
+@@ -991,7 +990,7 @@ static int mtd_otp_nvmem_add(struct mtd_
+ err:
+ 	if (mtd->otp_user_nvmem)
+ 		nvmem_unregister(mtd->otp_user_nvmem);
+-	return err;
++	return dev_err_probe(dev, err, "Failed to register OTP NVMEM device\n");
+ }
+ 
+ /**
diff --git a/target/linux/generic/backport-5.15/600-v5.18-page_pool-Add-allocation-stats.patch b/target/linux/generic/backport-5.15/600-v5.18-page_pool-Add-allocation-stats.patch
new file mode 100644
index 00000000000000..f4c5b9afee4dd9
--- /dev/null
+++ b/target/linux/generic/backport-5.15/600-v5.18-page_pool-Add-allocation-stats.patch
@@ -0,0 +1,165 @@
+From 8610037e8106b48c79cfe0afb92b2b2466e51c3d Mon Sep 17 00:00:00 2001
+From: Joe Damato <jdamato@fastly.com>
+Date: Tue, 1 Mar 2022 23:55:47 -0800
+Subject: [PATCH] page_pool: Add allocation stats
+
+Add per-pool statistics counters for the allocation path of a page pool.
+These stats are incremented in softirq context, so no locking or per-cpu
+variables are needed.
+
+This code is disabled by default and a kernel config option is provided for
+users who wish to enable them.
+
+The statistics added are:
+	- fast: successful fast path allocations
+	- slow: slow path order-0 allocations
+	- slow_high_order: slow path high order allocations
+	- empty: ptr ring is empty, so a slow path allocation was forced.
+	- refill: an allocation which triggered a refill of the cache
+	- waive: pages obtained from the ptr ring that cannot be added to
+	  the cache due to a NUMA mismatch.
+
+Signed-off-by: Joe Damato <jdamato@fastly.com>
+Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/net/page_pool.h | 18 ++++++++++++++++++
+ net/Kconfig             | 13 +++++++++++++
+ net/core/page_pool.c    | 24 ++++++++++++++++++++----
+ 3 files changed, 51 insertions(+), 4 deletions(-)
+
+--- a/include/net/page_pool.h
++++ b/include/net/page_pool.h
+@@ -82,6 +82,19 @@ struct page_pool_params {
+ 	unsigned int	offset;  /* DMA addr offset */
+ };
+ 
++#ifdef CONFIG_PAGE_POOL_STATS
++struct page_pool_alloc_stats {
++	u64 fast; /* fast path allocations */
++	u64 slow; /* slow-path order 0 allocations */
++	u64 slow_high_order; /* slow-path high order allocations */
++	u64 empty; /* failed refills due to empty ptr ring, forcing
++		    * slow path allocation
++		    */
++	u64 refill; /* allocations via successful refill */
++	u64 waive;  /* failed refills due to numa zone mismatch */
++};
++#endif
++
+ struct page_pool {
+ 	struct page_pool_params p;
+ 
+@@ -132,6 +145,11 @@ struct page_pool {
+ 	refcount_t user_cnt;
+ 
+ 	u64 destroy_cnt;
++
++#ifdef CONFIG_PAGE_POOL_STATS
++	/* these stats are incremented while in softirq context */
++	struct page_pool_alloc_stats alloc_stats;
++#endif
+ };
+ 
+ struct page *page_pool_alloc_pages(struct page_pool *pool, gfp_t gfp);
+--- a/net/Kconfig
++++ b/net/Kconfig
+@@ -434,6 +434,19 @@ config NET_DEVLINK
+ config PAGE_POOL
+ 	bool
+ 
++config PAGE_POOL_STATS
++	default n
++	bool "Page pool stats"
++	depends on PAGE_POOL
++	help
++	  Enable page pool statistics to track page allocation and recycling
++	  in page pools. This option incurs additional CPU cost in allocation
++	  and recycle paths and additional memory cost to store the statistics.
++	  These statistics are only available if this option is enabled and if
++	  the driver using the page pool supports exporting this data.
++
++	  If unsure, say N.
++
+ config FAILOVER
+ 	tristate "Generic failover module"
+ 	help
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -49,6 +49,13 @@ static void page_pool_producer_unlock(st
+ 		spin_unlock_bh(&pool->ring.producer_lock);
+ }
+ 
++#ifdef CONFIG_PAGE_POOL_STATS
++/* alloc_stat_inc is intended to be used in softirq context */
++#define alloc_stat_inc(pool, __stat)	(pool->alloc_stats.__stat++)
++#else
++#define alloc_stat_inc(pool, __stat)
++#endif
++
+ static int page_pool_init(struct page_pool *pool,
+ 			  const struct page_pool_params *params)
+ {
+@@ -140,8 +147,10 @@ static struct page *page_pool_refill_all
+ 	int pref_nid; /* preferred NUMA node */
+ 
+ 	/* Quicker fallback, avoid locks when ring is empty */
+-	if (__ptr_ring_empty(r))
++	if (__ptr_ring_empty(r)) {
++		alloc_stat_inc(pool, empty);
+ 		return NULL;
++	}
+ 
+ 	/* Softirq guarantee CPU and thus NUMA node is stable. This,
+ 	 * assumes CPU refilling driver RX-ring will also run RX-NAPI.
+@@ -171,14 +180,17 @@ static struct page *page_pool_refill_all
+ 			 * This limit stress on page buddy alloactor.
+ 			 */
+ 			page_pool_return_page(pool, page);
++			alloc_stat_inc(pool, waive);
+ 			page = NULL;
+ 			break;
+ 		}
+ 	} while (pool->alloc.count < PP_ALLOC_CACHE_REFILL);
+ 
+ 	/* Return last page */
+-	if (likely(pool->alloc.count > 0))
++	if (likely(pool->alloc.count > 0)) {
+ 		page = pool->alloc.cache[--pool->alloc.count];
++		alloc_stat_inc(pool, refill);
++	}
+ 
+ 	spin_unlock(&r->consumer_lock);
+ 	return page;
+@@ -193,6 +205,7 @@ static struct page *__page_pool_get_cach
+ 	if (likely(pool->alloc.count)) {
+ 		/* Fast-path */
+ 		page = pool->alloc.cache[--pool->alloc.count];
++		alloc_stat_inc(pool, fast);
+ 	} else {
+ 		page = page_pool_refill_alloc_cache(pool);
+ 	}
+@@ -264,6 +277,7 @@ static struct page *__page_pool_alloc_pa
+ 		return NULL;
+ 	}
+ 
++	alloc_stat_inc(pool, slow_high_order);
+ 	page_pool_set_pp_info(pool, page);
+ 
+ 	/* Track how many pages are held 'in-flight' */
+@@ -318,10 +332,12 @@ static struct page *__page_pool_alloc_pa
+ 	}
+ 
+ 	/* Return last page */
+-	if (likely(pool->alloc.count > 0))
++	if (likely(pool->alloc.count > 0)) {
+ 		page = pool->alloc.cache[--pool->alloc.count];
+-	else
++		alloc_stat_inc(pool, slow);
++	} else {
+ 		page = NULL;
++	}
+ 
+ 	/* When page just alloc'ed is should/must have refcnt 1. */
+ 	return page;
diff --git a/target/linux/generic/backport-5.15/601-v5.18-page_pool-Add-recycle-stats.patch b/target/linux/generic/backport-5.15/601-v5.18-page_pool-Add-recycle-stats.patch
new file mode 100644
index 00000000000000..b425b78c7530c5
--- /dev/null
+++ b/target/linux/generic/backport-5.15/601-v5.18-page_pool-Add-recycle-stats.patch
@@ -0,0 +1,140 @@
+From ad6fa1e1ab1b8164f1ba296b1b4dc556a483bcad Mon Sep 17 00:00:00 2001
+From: Joe Damato <jdamato@fastly.com>
+Date: Tue, 1 Mar 2022 23:55:48 -0800
+Subject: [PATCH 2/3] page_pool: Add recycle stats
+
+Add per-cpu stats tracking page pool recycling events:
+	- cached: recycling placed page in the page pool cache
+	- cache_full: page pool cache was full
+	- ring: page placed into the ptr ring
+	- ring_full: page released from page pool because the ptr ring was full
+	- released_refcnt: page released (and not recycled) because refcnt > 1
+
+Signed-off-by: Joe Damato <jdamato@fastly.com>
+Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/net/page_pool.h | 16 ++++++++++++++++
+ net/core/page_pool.c    | 30 ++++++++++++++++++++++++++++--
+ 2 files changed, 44 insertions(+), 2 deletions(-)
+
+--- a/include/net/page_pool.h
++++ b/include/net/page_pool.h
+@@ -93,6 +93,18 @@ struct page_pool_alloc_stats {
+ 	u64 refill; /* allocations via successful refill */
+ 	u64 waive;  /* failed refills due to numa zone mismatch */
+ };
++
++struct page_pool_recycle_stats {
++	u64 cached;	/* recycling placed page in the cache. */
++	u64 cache_full; /* cache was full */
++	u64 ring;	/* recycling placed page back into ptr ring */
++	u64 ring_full;	/* page was released from page-pool because
++			 * PTR ring was full.
++			 */
++	u64 released_refcnt; /* page released because of elevated
++			      * refcnt
++			      */
++};
+ #endif
+ 
+ struct page_pool {
+@@ -136,6 +148,10 @@ struct page_pool {
+ 	 */
+ 	struct ptr_ring ring;
+ 
++#ifdef CONFIG_PAGE_POOL_STATS
++	/* recycle stats are per-cpu to avoid locking */
++	struct page_pool_recycle_stats __percpu *recycle_stats;
++#endif
+ 	atomic_t pages_state_release_cnt;
+ 
+ 	/* A page_pool is strictly tied to a single RX-queue being
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -52,8 +52,15 @@ static void page_pool_producer_unlock(st
+ #ifdef CONFIG_PAGE_POOL_STATS
+ /* alloc_stat_inc is intended to be used in softirq context */
+ #define alloc_stat_inc(pool, __stat)	(pool->alloc_stats.__stat++)
++/* recycle_stat_inc is safe to use when preemption is possible. */
++#define recycle_stat_inc(pool, __stat)							\
++	do {										\
++		struct page_pool_recycle_stats __percpu *s = pool->recycle_stats;	\
++		this_cpu_inc(s->__stat);						\
++	} while (0)
+ #else
+ #define alloc_stat_inc(pool, __stat)
++#define recycle_stat_inc(pool, __stat)
+ #endif
+ 
+ static int page_pool_init(struct page_pool *pool,
+@@ -103,6 +110,12 @@ static int page_pool_init(struct page_po
+ 	    pool->p.flags & PP_FLAG_PAGE_FRAG)
+ 		return -EINVAL;
+ 
++#ifdef CONFIG_PAGE_POOL_STATS
++	pool->recycle_stats = alloc_percpu(struct page_pool_recycle_stats);
++	if (!pool->recycle_stats)
++		return -ENOMEM;
++#endif
++
+ 	if (ptr_ring_init(&pool->ring, ring_qsize, GFP_KERNEL) < 0)
+ 		return -ENOMEM;
+ 
+@@ -435,7 +448,12 @@ static bool page_pool_recycle_in_ring(st
+ 	else
+ 		ret = ptr_ring_produce_bh(&pool->ring, page);
+ 
+-	return (ret == 0) ? true : false;
++	if (!ret) {
++		recycle_stat_inc(pool, ring);
++		return true;
++	}
++
++	return false;
+ }
+ 
+ /* Only allow direct recycling in special circumstances, into the
+@@ -446,11 +464,14 @@ static bool page_pool_recycle_in_ring(st
+ static bool page_pool_recycle_in_cache(struct page *page,
+ 				       struct page_pool *pool)
+ {
+-	if (unlikely(pool->alloc.count == PP_ALLOC_CACHE_SIZE))
++	if (unlikely(pool->alloc.count == PP_ALLOC_CACHE_SIZE)) {
++		recycle_stat_inc(pool, cache_full);
+ 		return false;
++	}
+ 
+ 	/* Caller MUST have verified/know (page_ref_count(page) == 1) */
+ 	pool->alloc.cache[pool->alloc.count++] = page;
++	recycle_stat_inc(pool, cached);
+ 	return true;
+ }
+ 
+@@ -505,6 +526,7 @@ __page_pool_put_page(struct page_pool *p
+ 	 * doing refcnt based recycle tricks, meaning another process
+ 	 * will be invoking put_page.
+ 	 */
++	recycle_stat_inc(pool, released_refcnt);
+ 	/* Do not replace this with page_pool_return_page() */
+ 	page_pool_release_page(pool, page);
+ 	put_page(page);
+@@ -518,6 +540,7 @@ void page_pool_put_page(struct page_pool
+ 	page = __page_pool_put_page(pool, page, dma_sync_size, allow_direct);
+ 	if (page && !page_pool_recycle_in_ring(pool, page)) {
+ 		/* Cache full, fallback to free pages */
++		recycle_stat_inc(pool, ring_full);
+ 		page_pool_return_page(pool, page);
+ 	}
+ }
+@@ -665,6 +688,9 @@ static void page_pool_free(struct page_p
+ 	if (pool->p.flags & PP_FLAG_DMA_MAP)
+ 		put_device(pool->p.dev);
+ 
++#ifdef CONFIG_PAGE_POOL_STATS
++	free_percpu(pool->recycle_stats);
++#endif
+ 	kfree(pool);
+ }
+ 
diff --git a/target/linux/generic/backport-5.15/602-v5.18-page_pool-Add-function-to-batch-and-return-stats.patch b/target/linux/generic/backport-5.15/602-v5.18-page_pool-Add-function-to-batch-and-return-stats.patch
new file mode 100644
index 00000000000000..e1a7635133cd15
--- /dev/null
+++ b/target/linux/generic/backport-5.15/602-v5.18-page_pool-Add-function-to-batch-and-return-stats.patch
@@ -0,0 +1,77 @@
+From 6b95e3388b1ea0ca63500c5a6e39162dbf828433 Mon Sep 17 00:00:00 2001
+From: Joe Damato <jdamato@fastly.com>
+Date: Tue, 1 Mar 2022 23:55:49 -0800
+Subject: [PATCH 3/3] page_pool: Add function to batch and return stats
+
+Adds a function page_pool_get_stats which can be used by drivers to obtain
+stats for a specified page_pool.
+
+Signed-off-by: Joe Damato <jdamato@fastly.com>
+Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/net/page_pool.h | 17 +++++++++++++++++
+ net/core/page_pool.c    | 25 +++++++++++++++++++++++++
+ 2 files changed, 42 insertions(+)
+
+--- a/include/net/page_pool.h
++++ b/include/net/page_pool.h
+@@ -105,6 +105,23 @@ struct page_pool_recycle_stats {
+ 			      * refcnt
+ 			      */
+ };
++
++/* This struct wraps the above stats structs so users of the
++ * page_pool_get_stats API can pass a single argument when requesting the
++ * stats for the page pool.
++ */
++struct page_pool_stats {
++	struct page_pool_alloc_stats alloc_stats;
++	struct page_pool_recycle_stats recycle_stats;
++};
++
++/*
++ * Drivers that wish to harvest page pool stats and report them to users
++ * (perhaps via ethtool, debugfs, or another mechanism) can allocate a
++ * struct page_pool_stats call page_pool_get_stats to get stats for the specified pool.
++ */
++bool page_pool_get_stats(struct page_pool *pool,
++			 struct page_pool_stats *stats);
+ #endif
+ 
+ struct page_pool {
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -58,6 +58,31 @@ static void page_pool_producer_unlock(st
+ 		struct page_pool_recycle_stats __percpu *s = pool->recycle_stats;	\
+ 		this_cpu_inc(s->__stat);						\
+ 	} while (0)
++
++bool page_pool_get_stats(struct page_pool *pool,
++			 struct page_pool_stats *stats)
++{
++	int cpu = 0;
++
++	if (!stats)
++		return false;
++
++	memcpy(&stats->alloc_stats, &pool->alloc_stats, sizeof(pool->alloc_stats));
++
++	for_each_possible_cpu(cpu) {
++		const struct page_pool_recycle_stats *pcpu =
++			per_cpu_ptr(pool->recycle_stats, cpu);
++
++		stats->recycle_stats.cached += pcpu->cached;
++		stats->recycle_stats.cache_full += pcpu->cache_full;
++		stats->recycle_stats.ring += pcpu->ring;
++		stats->recycle_stats.ring_full += pcpu->ring_full;
++		stats->recycle_stats.released_refcnt += pcpu->released_refcnt;
++	}
++
++	return true;
++}
++EXPORT_SYMBOL(page_pool_get_stats);
+ #else
+ #define alloc_stat_inc(pool, __stat)
+ #define recycle_stat_inc(pool, __stat)
diff --git a/target/linux/generic/backport-5.15/603-v5.19-page_pool-Add-recycle-stats-to-page_pool_put_page_bu.patch b/target/linux/generic/backport-5.15/603-v5.19-page_pool-Add-recycle-stats-to-page_pool_put_page_bu.patch
new file mode 100644
index 00000000000000..f438ef3a599794
--- /dev/null
+++ b/target/linux/generic/backport-5.15/603-v5.19-page_pool-Add-recycle-stats-to-page_pool_put_page_bu.patch
@@ -0,0 +1,55 @@
+From 590032a4d2133ecc10d3078a8db1d85a4842f12c Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Mon, 11 Apr 2022 16:05:26 +0200
+Subject: [PATCH] page_pool: Add recycle stats to page_pool_put_page_bulk
+
+Add missing recycle stats to page_pool_put_page_bulk routine.
+
+Reviewed-by: Joe Damato <jdamato@fastly.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Link: https://lore.kernel.org/r/3712178b51c007cfaed910ea80e68f00c916b1fa.1649685634.git.lorenzo@kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ net/core/page_pool.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -59,6 +59,12 @@ static void page_pool_producer_unlock(st
+ 		this_cpu_inc(s->__stat);						\
+ 	} while (0)
+ 
++#define recycle_stat_add(pool, __stat, val)						\
++	do {										\
++		struct page_pool_recycle_stats __percpu *s = pool->recycle_stats;	\
++		this_cpu_add(s->__stat, val);						\
++	} while (0)
++
+ bool page_pool_get_stats(struct page_pool *pool,
+ 			 struct page_pool_stats *stats)
+ {
+@@ -86,6 +92,7 @@ EXPORT_SYMBOL(page_pool_get_stats);
+ #else
+ #define alloc_stat_inc(pool, __stat)
+ #define recycle_stat_inc(pool, __stat)
++#define recycle_stat_add(pool, __stat, val)
+ #endif
+ 
+ static int page_pool_init(struct page_pool *pool,
+@@ -593,9 +600,13 @@ void page_pool_put_page_bulk(struct page
+ 	/* Bulk producer into ptr_ring page_pool cache */
+ 	in_softirq = page_pool_producer_lock(pool);
+ 	for (i = 0; i < bulk_len; i++) {
+-		if (__ptr_ring_produce(&pool->ring, data[i]))
+-			break; /* ring full */
++		if (__ptr_ring_produce(&pool->ring, data[i])) {
++			/* ring full */
++			recycle_stat_inc(pool, ring_full);
++			break;
++		}
+ 	}
++	recycle_stat_add(pool, ring, i);
+ 	page_pool_producer_unlock(pool, in_softirq);
+ 
+ 	/* Hopefully all pages was return into ptr_ring */
diff --git a/target/linux/generic/backport-5.15/604-v5.19-net-page_pool-introduce-ethtool-stats.patch b/target/linux/generic/backport-5.15/604-v5.19-net-page_pool-introduce-ethtool-stats.patch
new file mode 100644
index 00000000000000..3ff136b084265a
--- /dev/null
+++ b/target/linux/generic/backport-5.15/604-v5.19-net-page_pool-introduce-ethtool-stats.patch
@@ -0,0 +1,147 @@
+From f3c5264f452a5b0ac1de1f2f657efbabdea3c76a Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 12 Apr 2022 18:31:58 +0200
+Subject: [PATCH] net: page_pool: introduce ethtool stats
+
+Introduce page_pool APIs to report stats through ethtool and reduce
+duplicated code in each driver.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/net/page_pool.h | 21 ++++++++++++++
+ net/core/page_pool.c    | 63 ++++++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 83 insertions(+), 1 deletion(-)
+
+--- a/include/net/page_pool.h
++++ b/include/net/page_pool.h
+@@ -115,6 +115,10 @@ struct page_pool_stats {
+ 	struct page_pool_recycle_stats recycle_stats;
+ };
+ 
++int page_pool_ethtool_stats_get_count(void);
++u8 *page_pool_ethtool_stats_get_strings(u8 *data);
++u64 *page_pool_ethtool_stats_get(u64 *data, void *stats);
++
+ /*
+  * Drivers that wish to harvest page pool stats and report them to users
+  * (perhaps via ethtool, debugfs, or another mechanism) can allocate a
+@@ -122,6 +126,23 @@ struct page_pool_stats {
+  */
+ bool page_pool_get_stats(struct page_pool *pool,
+ 			 struct page_pool_stats *stats);
++#else
++
++static inline int page_pool_ethtool_stats_get_count(void)
++{
++	return 0;
++}
++
++static inline u8 *page_pool_ethtool_stats_get_strings(u8 *data)
++{
++	return data;
++}
++
++static inline u64 *page_pool_ethtool_stats_get(u64 *data, void *stats)
++{
++	return data;
++}
++
+ #endif
+ 
+ struct page_pool {
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -18,6 +18,7 @@
+ #include <linux/page-flags.h>
+ #include <linux/mm.h> /* for __put_page() */
+ #include <linux/poison.h>
++#include <linux/ethtool.h>
+ 
+ #include <trace/events/page_pool.h>
+ 
+@@ -65,6 +66,20 @@ static void page_pool_producer_unlock(st
+ 		this_cpu_add(s->__stat, val);						\
+ 	} while (0)
+ 
++static const char pp_stats[][ETH_GSTRING_LEN] = {
++	"rx_pp_alloc_fast",
++	"rx_pp_alloc_slow",
++	"rx_pp_alloc_slow_ho",
++	"rx_pp_alloc_empty",
++	"rx_pp_alloc_refill",
++	"rx_pp_alloc_waive",
++	"rx_pp_recycle_cached",
++	"rx_pp_recycle_cache_full",
++	"rx_pp_recycle_ring",
++	"rx_pp_recycle_ring_full",
++	"rx_pp_recycle_released_ref",
++};
++
+ bool page_pool_get_stats(struct page_pool *pool,
+ 			 struct page_pool_stats *stats)
+ {
+@@ -73,7 +88,13 @@ bool page_pool_get_stats(struct page_poo
+ 	if (!stats)
+ 		return false;
+ 
+-	memcpy(&stats->alloc_stats, &pool->alloc_stats, sizeof(pool->alloc_stats));
++	/* The caller is responsible to initialize stats. */
++	stats->alloc_stats.fast += pool->alloc_stats.fast;
++	stats->alloc_stats.slow += pool->alloc_stats.slow;
++	stats->alloc_stats.slow_high_order += pool->alloc_stats.slow_high_order;
++	stats->alloc_stats.empty += pool->alloc_stats.empty;
++	stats->alloc_stats.refill += pool->alloc_stats.refill;
++	stats->alloc_stats.waive += pool->alloc_stats.waive;
+ 
+ 	for_each_possible_cpu(cpu) {
+ 		const struct page_pool_recycle_stats *pcpu =
+@@ -89,6 +110,46 @@ bool page_pool_get_stats(struct page_poo
+ 	return true;
+ }
+ EXPORT_SYMBOL(page_pool_get_stats);
++
++u8 *page_pool_ethtool_stats_get_strings(u8 *data)
++{
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(pp_stats); i++) {
++		memcpy(data, pp_stats[i], ETH_GSTRING_LEN);
++		data += ETH_GSTRING_LEN;
++	}
++
++	return data;
++}
++EXPORT_SYMBOL(page_pool_ethtool_stats_get_strings);
++
++int page_pool_ethtool_stats_get_count(void)
++{
++	return ARRAY_SIZE(pp_stats);
++}
++EXPORT_SYMBOL(page_pool_ethtool_stats_get_count);
++
++u64 *page_pool_ethtool_stats_get(u64 *data, void *stats)
++{
++	struct page_pool_stats *pool_stats = stats;
++
++	*data++ = pool_stats->alloc_stats.fast;
++	*data++ = pool_stats->alloc_stats.slow;
++	*data++ = pool_stats->alloc_stats.slow_high_order;
++	*data++ = pool_stats->alloc_stats.empty;
++	*data++ = pool_stats->alloc_stats.refill;
++	*data++ = pool_stats->alloc_stats.waive;
++	*data++ = pool_stats->recycle_stats.cached;
++	*data++ = pool_stats->recycle_stats.cache_full;
++	*data++ = pool_stats->recycle_stats.ring;
++	*data++ = pool_stats->recycle_stats.ring_full;
++	*data++ = pool_stats->recycle_stats.released_refcnt;
++
++	return data;
++}
++EXPORT_SYMBOL(page_pool_ethtool_stats_get);
++
+ #else
+ #define alloc_stat_inc(pool, __stat)
+ #define recycle_stat_inc(pool, __stat)
diff --git a/target/linux/generic/backport-5.15/605-v5.18-xdp-introduce-flags-field-in-xdp_buff-xdp_frame.patch b/target/linux/generic/backport-5.15/605-v5.18-xdp-introduce-flags-field-in-xdp_buff-xdp_frame.patch
new file mode 100644
index 00000000000000..4a914404a2f9ec
--- /dev/null
+++ b/target/linux/generic/backport-5.15/605-v5.18-xdp-introduce-flags-field-in-xdp_buff-xdp_frame.patch
@@ -0,0 +1,99 @@
+From 2e88d4ff03013937028f5397268b21e10cf68713 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 21 Jan 2022 11:09:45 +0100
+Subject: [PATCH] xdp: introduce flags field in xdp_buff/xdp_frame
+
+Introduce flags field in xdp_frame and xdp_buffer data structures
+to define additional buffer features. At the moment the only
+supported buffer feature is frags bit (XDP_FLAGS_HAS_FRAGS).
+frags bit is used to specify if this is a linear buffer
+(XDP_FLAGS_HAS_FRAGS not set) or a frags frame (XDP_FLAGS_HAS_FRAGS
+set). In the latter case the driver is expected to initialize the
+skb_shared_info structure at the end of the first buffer to link together
+subsequent buffers belonging to the same frame.
+
+Acked-by: Toke Hoiland-Jorgensen <toke@redhat.com>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/e389f14f3a162c0a5bc6a2e1aa8dd01a90be117d.1642758637.git.lorenzo@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+---
+ include/net/xdp.h | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+--- a/include/net/xdp.h
++++ b/include/net/xdp.h
+@@ -66,6 +66,10 @@ struct xdp_txq_info {
+ 	struct net_device *dev;
+ };
+ 
++enum xdp_buff_flags {
++	XDP_FLAGS_HAS_FRAGS	= BIT(0), /* non-linear xdp buff */
++};
++
+ struct xdp_buff {
+ 	void *data;
+ 	void *data_end;
+@@ -74,13 +78,30 @@ struct xdp_buff {
+ 	struct xdp_rxq_info *rxq;
+ 	struct xdp_txq_info *txq;
+ 	u32 frame_sz; /* frame size to deduce data_hard_end/reserved tailroom*/
++	u32 flags; /* supported values defined in xdp_buff_flags */
+ };
+ 
++static __always_inline bool xdp_buff_has_frags(struct xdp_buff *xdp)
++{
++	return !!(xdp->flags & XDP_FLAGS_HAS_FRAGS);
++}
++
++static __always_inline void xdp_buff_set_frags_flag(struct xdp_buff *xdp)
++{
++	xdp->flags |= XDP_FLAGS_HAS_FRAGS;
++}
++
++static __always_inline void xdp_buff_clear_frags_flag(struct xdp_buff *xdp)
++{
++	xdp->flags &= ~XDP_FLAGS_HAS_FRAGS;
++}
++
+ static __always_inline void
+ xdp_init_buff(struct xdp_buff *xdp, u32 frame_sz, struct xdp_rxq_info *rxq)
+ {
+ 	xdp->frame_sz = frame_sz;
+ 	xdp->rxq = rxq;
++	xdp->flags = 0;
+ }
+ 
+ static __always_inline void
+@@ -122,8 +143,14 @@ struct xdp_frame {
+ 	 */
+ 	struct xdp_mem_info mem;
+ 	struct net_device *dev_rx; /* used by cpumap */
++	u32 flags; /* supported values defined in xdp_buff_flags */
+ };
+ 
++static __always_inline bool xdp_frame_has_frags(struct xdp_frame *frame)
++{
++	return !!(frame->flags & XDP_FLAGS_HAS_FRAGS);
++}
++
+ #define XDP_BULK_QUEUE_SIZE	16
+ struct xdp_frame_bulk {
+ 	int count;
+@@ -180,6 +207,7 @@ void xdp_convert_frame_to_buff(struct xd
+ 	xdp->data_end = frame->data + frame->len;
+ 	xdp->data_meta = frame->data - frame->metasize;
+ 	xdp->frame_sz = frame->frame_sz;
++	xdp->flags = frame->flags;
+ }
+ 
+ static inline
+@@ -206,6 +234,7 @@ int xdp_update_frame_from_buff(struct xd
+ 	xdp_frame->headroom = headroom - sizeof(*xdp_frame);
+ 	xdp_frame->metasize = metasize;
+ 	xdp_frame->frame_sz = xdp->frame_sz;
++	xdp_frame->flags = xdp->flags;
+ 
+ 	return 0;
+ }
diff --git a/target/linux/generic/backport-5.15/606-v5.18-xdp-add-frags-support-to-xdp_return_-buff-frame.patch b/target/linux/generic/backport-5.15/606-v5.18-xdp-add-frags-support-to-xdp_return_-buff-frame.patch
new file mode 100644
index 00000000000000..e126b21417f192
--- /dev/null
+++ b/target/linux/generic/backport-5.15/606-v5.18-xdp-add-frags-support-to-xdp_return_-buff-frame.patch
@@ -0,0 +1,137 @@
+From 7c48cb0176c6d6d3b55029f7ff4ffa05faee6446 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 21 Jan 2022 11:09:50 +0100
+Subject: [PATCH] xdp: add frags support to xdp_return_{buff/frame}
+
+Take into account if the received xdp_buff/xdp_frame is non-linear
+recycling/returning the frame memory to the allocator or into
+xdp_frame_bulk.
+
+Acked-by: Toke Hoiland-Jorgensen <toke@redhat.com>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/a961069febc868508ce1bdf5e53a343eb4e57cb2.1642758637.git.lorenzo@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+---
+ include/net/xdp.h | 18 ++++++++++++++--
+ net/core/xdp.c    | 54 ++++++++++++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 69 insertions(+), 3 deletions(-)
+
+--- a/include/net/xdp.h
++++ b/include/net/xdp.h
+@@ -275,10 +275,24 @@ void __xdp_release_frame(void *data, str
+ static inline void xdp_release_frame(struct xdp_frame *xdpf)
+ {
+ 	struct xdp_mem_info *mem = &xdpf->mem;
++	struct skb_shared_info *sinfo;
++	int i;
+ 
+ 	/* Curr only page_pool needs this */
+-	if (mem->type == MEM_TYPE_PAGE_POOL)
+-		__xdp_release_frame(xdpf->data, mem);
++	if (mem->type != MEM_TYPE_PAGE_POOL)
++		return;
++
++	if (likely(!xdp_frame_has_frags(xdpf)))
++		goto out;
++
++	sinfo = xdp_get_shared_info_from_frame(xdpf);
++	for (i = 0; i < sinfo->nr_frags; i++) {
++		struct page *page = skb_frag_page(&sinfo->frags[i]);
++
++		__xdp_release_frame(page_address(page), mem);
++	}
++out:
++	__xdp_release_frame(xdpf->data, mem);
+ }
+ 
+ int xdp_rxq_info_reg(struct xdp_rxq_info *xdp_rxq,
+--- a/net/core/xdp.c
++++ b/net/core/xdp.c
+@@ -409,12 +409,38 @@ static void __xdp_return(void *data, str
+ 
+ void xdp_return_frame(struct xdp_frame *xdpf)
+ {
++	struct skb_shared_info *sinfo;
++	int i;
++
++	if (likely(!xdp_frame_has_frags(xdpf)))
++		goto out;
++
++	sinfo = xdp_get_shared_info_from_frame(xdpf);
++	for (i = 0; i < sinfo->nr_frags; i++) {
++		struct page *page = skb_frag_page(&sinfo->frags[i]);
++
++		__xdp_return(page_address(page), &xdpf->mem, false, NULL);
++	}
++out:
+ 	__xdp_return(xdpf->data, &xdpf->mem, false, NULL);
+ }
+ EXPORT_SYMBOL_GPL(xdp_return_frame);
+ 
+ void xdp_return_frame_rx_napi(struct xdp_frame *xdpf)
+ {
++	struct skb_shared_info *sinfo;
++	int i;
++
++	if (likely(!xdp_frame_has_frags(xdpf)))
++		goto out;
++
++	sinfo = xdp_get_shared_info_from_frame(xdpf);
++	for (i = 0; i < sinfo->nr_frags; i++) {
++		struct page *page = skb_frag_page(&sinfo->frags[i]);
++
++		__xdp_return(page_address(page), &xdpf->mem, true, NULL);
++	}
++out:
+ 	__xdp_return(xdpf->data, &xdpf->mem, true, NULL);
+ }
+ EXPORT_SYMBOL_GPL(xdp_return_frame_rx_napi);
+@@ -450,7 +476,7 @@ void xdp_return_frame_bulk(struct xdp_fr
+ 	struct xdp_mem_allocator *xa;
+ 
+ 	if (mem->type != MEM_TYPE_PAGE_POOL) {
+-		__xdp_return(xdpf->data, &xdpf->mem, false, NULL);
++		xdp_return_frame(xdpf);
+ 		return;
+ 	}
+ 
+@@ -469,12 +495,38 @@ void xdp_return_frame_bulk(struct xdp_fr
+ 		bq->xa = rhashtable_lookup(mem_id_ht, &mem->id, mem_id_rht_params);
+ 	}
+ 
++	if (unlikely(xdp_frame_has_frags(xdpf))) {
++		struct skb_shared_info *sinfo;
++		int i;
++
++		sinfo = xdp_get_shared_info_from_frame(xdpf);
++		for (i = 0; i < sinfo->nr_frags; i++) {
++			skb_frag_t *frag = &sinfo->frags[i];
++
++			bq->q[bq->count++] = skb_frag_address(frag);
++			if (bq->count == XDP_BULK_QUEUE_SIZE)
++				xdp_flush_frame_bulk(bq);
++		}
++	}
+ 	bq->q[bq->count++] = xdpf->data;
+ }
+ EXPORT_SYMBOL_GPL(xdp_return_frame_bulk);
+ 
+ void xdp_return_buff(struct xdp_buff *xdp)
+ {
++	struct skb_shared_info *sinfo;
++	int i;
++
++	if (likely(!xdp_buff_has_frags(xdp)))
++		goto out;
++
++	sinfo = xdp_get_shared_info_from_buff(xdp);
++	for (i = 0; i < sinfo->nr_frags; i++) {
++		struct page *page = skb_frag_page(&sinfo->frags[i]);
++
++		__xdp_return(page_address(page), &xdp->rxq->mem, true, xdp);
++	}
++out:
+ 	__xdp_return(xdp->data, &xdp->rxq->mem, true, xdp);
+ }
+ 
diff --git a/target/linux/generic/backport-5.15/607-v5.18-net-skbuff-add-size-metadata-to-skb_shared_info-for-.patch b/target/linux/generic/backport-5.15/607-v5.18-net-skbuff-add-size-metadata-to-skb_shared_info-for-.patch
new file mode 100644
index 00000000000000..36f55d511ad92a
--- /dev/null
+++ b/target/linux/generic/backport-5.15/607-v5.18-net-skbuff-add-size-metadata-to-skb_shared_info-for-.patch
@@ -0,0 +1,31 @@
+From d16697cb6261d4cc23422e6b1cb2759df8aa76d0 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 21 Jan 2022 11:09:44 +0100
+Subject: [PATCH] net: skbuff: add size metadata to skb_shared_info for xdp
+
+Introduce xdp_frags_size field in skb_shared_info data structure
+to store xdp_buff/xdp_frame frame paged size (xdp_frags_size will
+be used in xdp frags support). In order to not increase
+skb_shared_info size we will use a hole due to skb_shared_info
+alignment.
+
+Acked-by: Toke Hoiland-Jorgensen <toke@redhat.com>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/8a849819a3e0a143d540f78a3a5add76e17e980d.1642758637.git.lorenzo@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+---
+ include/linux/skbuff.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -568,6 +568,7 @@ struct skb_shared_info {
+ 	 * Warning : all fields before dataref are cleared in __alloc_skb()
+ 	 */
+ 	atomic_t	dataref;
++	unsigned int	xdp_frags_size;
+ 
+ 	/* Intermediate layers must ensure that destructor_arg
+ 	 * remains valid until skb destructor */
diff --git a/target/linux/generic/backport-5.15/608-v5.18-net-veth-Account-total-xdp_frame-len-running-ndo_xdp.patch b/target/linux/generic/backport-5.15/608-v5.18-net-veth-Account-total-xdp_frame-len-running-ndo_xdp.patch
new file mode 100644
index 00000000000000..3bdba8728cfade
--- /dev/null
+++ b/target/linux/generic/backport-5.15/608-v5.18-net-veth-Account-total-xdp_frame-len-running-ndo_xdp.patch
@@ -0,0 +1,65 @@
+From 5142239a22219921a7863cf00c9ab853c00689d8 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 11 Mar 2022 10:14:18 +0100
+Subject: [PATCH] net: veth: Account total xdp_frame len running ndo_xdp_xmit
+
+Even if this is a theoretical issue since it is not possible to perform
+XDP_REDIRECT on a non-linear xdp_frame, veth driver does not account
+paged area in ndo_xdp_xmit function pointer.
+Introduce xdp_get_frame_len utility routine to get the xdp_frame full
+length and account total frame size running XDP_REDIRECT of a
+non-linear xdp frame into a veth device.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Toke Hoiland-Jorgensen <toke@redhat.com>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/54f9fd3bb65d190daf2c0bbae2f852ff16cfbaa0.1646989407.git.lorenzo@kernel.org
+---
+ drivers/net/veth.c |  4 ++--
+ include/net/xdp.h  | 14 ++++++++++++++
+ 2 files changed, 16 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/veth.c
++++ b/drivers/net/veth.c
+@@ -501,7 +501,7 @@ static int veth_xdp_xmit(struct net_devi
+ 		struct xdp_frame *frame = frames[i];
+ 		void *ptr = veth_xdp_to_ptr(frame);
+ 
+-		if (unlikely(frame->len > max_len ||
++		if (unlikely(xdp_get_frame_len(frame) > max_len ||
+ 			     __ptr_ring_produce(&rq->xdp_ring, ptr)))
+ 			break;
+ 		nxmit++;
+@@ -862,7 +862,7 @@ static int veth_xdp_rcv(struct veth_rq *
+ 			/* ndo_xdp_xmit */
+ 			struct xdp_frame *frame = veth_ptr_to_xdp(ptr);
+ 
+-			stats->xdp_bytes += frame->len;
++			stats->xdp_bytes += xdp_get_frame_len(frame);
+ 			frame = veth_xdp_rcv_one(rq, frame, bq, stats);
+ 			if (frame) {
+ 				/* XDP_PASS */
+--- a/include/net/xdp.h
++++ b/include/net/xdp.h
+@@ -295,6 +295,20 @@ out:
+ 	__xdp_release_frame(xdpf->data, mem);
+ }
+ 
++static __always_inline unsigned int xdp_get_frame_len(struct xdp_frame *xdpf)
++{
++	struct skb_shared_info *sinfo;
++	unsigned int len = xdpf->len;
++
++	if (likely(!xdp_frame_has_frags(xdpf)))
++		goto out;
++
++	sinfo = xdp_get_shared_info_from_frame(xdpf);
++	len += sinfo->xdp_frags_size;
++out:
++	return len;
++}
++
+ int xdp_rxq_info_reg(struct xdp_rxq_info *xdp_rxq,
+ 		     struct net_device *dev, u32 queue_index, unsigned int napi_id);
+ void xdp_rxq_info_unreg(struct xdp_rxq_info *xdp_rxq);
diff --git a/target/linux/generic/backport-5.15/609-v5.18-veth-Allow-jumbo-frames-in-xdp-mode.patch b/target/linux/generic/backport-5.15/609-v5.18-veth-Allow-jumbo-frames-in-xdp-mode.patch
new file mode 100644
index 00000000000000..31b44f117079b2
--- /dev/null
+++ b/target/linux/generic/backport-5.15/609-v5.18-veth-Allow-jumbo-frames-in-xdp-mode.patch
@@ -0,0 +1,40 @@
+From 7cda76d858a4e71ac4a04066c093679a12e1312c Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 11 Mar 2022 10:14:20 +0100
+Subject: [PATCH] veth: Allow jumbo frames in xdp mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Allow increasing the MTU over page boundaries on veth devices
+if the attached xdp program declares to support xdp fragments.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/d5dc039c3d4123426e7023a488c449181a7bc57f.1646989407.git.lorenzo@kernel.org
+---
+ drivers/net/veth.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/veth.c
++++ b/drivers/net/veth.c
+@@ -1471,9 +1471,14 @@ static int veth_xdp_set(struct net_devic
+ 			goto err;
+ 		}
+ 
+-		max_mtu = PAGE_SIZE - VETH_XDP_HEADROOM -
+-			  peer->hard_header_len -
+-			  SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
++		max_mtu = SKB_WITH_OVERHEAD(PAGE_SIZE - VETH_XDP_HEADROOM) -
++			  peer->hard_header_len;
++		/* Allow increasing the max_mtu if the program supports
++		 * XDP fragments.
++		 */
++		//if (prog->aux->xdp_has_frags)
++		max_mtu += PAGE_SIZE * MAX_SKB_FRAGS;
++
+ 		if (peer->mtu > max_mtu) {
+ 			NL_SET_ERR_MSG_MOD(extack, "Peer MTU is too large to set XDP");
+ 			err = -ERANGE;
diff --git a/target/linux/generic/backport-5.15/611-v6.3-net-add-helper-eth_addr_add.patch b/target/linux/generic/backport-5.15/611-v6.3-net-add-helper-eth_addr_add.patch
new file mode 100644
index 00000000000000..c5d5d2c3a9c6ad
--- /dev/null
+++ b/target/linux/generic/backport-5.15/611-v6.3-net-add-helper-eth_addr_add.patch
@@ -0,0 +1,41 @@
+From 7390609b0121a1b982c5ecdfcd72dc328e5784ee Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Mon, 6 Feb 2023 13:43:42 +0000
+Subject: [PATCH] net: add helper eth_addr_add()
+
+Add a helper to add an offset to a ethernet address. This comes in handy
+if you have a base ethernet address for multiple interfaces.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Acked-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-9-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/etherdevice.h | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/include/linux/etherdevice.h
++++ b/include/linux/etherdevice.h
+@@ -478,6 +478,20 @@ static inline void eth_addr_inc(u8 *addr
+ }
+ 
+ /**
++ * eth_addr_add() - Add (or subtract) an offset to/from the given MAC address.
++ *
++ * @offset: Offset to add.
++ * @addr: Pointer to a six-byte array containing Ethernet address to increment.
++ */
++static inline void eth_addr_add(u8 *addr, long offset)
++{
++	u64 u = ether_addr_to_u64(addr);
++
++	u += offset;
++	u64_to_ether_addr(u, addr);
++}
++
++/**
+  * is_etherdev_addr - Tell if given Ethernet address belongs to the device.
+  * @dev: Pointer to a device structure
+  * @addr: Pointer to a six-byte array containing the Ethernet address
diff --git a/target/linux/generic/backport-5.15/700-v5.17-net-dsa-introduce-tagger-owned-storage-for-private.patch b/target/linux/generic/backport-5.15/700-v5.17-net-dsa-introduce-tagger-owned-storage-for-private.patch
new file mode 100644
index 00000000000000..f56a9685895691
--- /dev/null
+++ b/target/linux/generic/backport-5.15/700-v5.17-net-dsa-introduce-tagger-owned-storage-for-private.patch
@@ -0,0 +1,279 @@
+From dc452a471dbae8aca8257c565174212620880093 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Fri, 10 Dec 2021 01:34:37 +0200
+Subject: net: dsa: introduce tagger-owned storage for private and shared data
+
+Ansuel is working on register access over Ethernet for the qca8k switch
+family. This requires the qca8k tagging protocol driver to receive
+frames which aren't intended for the network stack, but instead for the
+qca8k switch driver itself.
+
+The dp->priv is currently the prevailing method for passing data back
+and forth between the tagging protocol driver and the switch driver.
+However, this method is riddled with caveats.
+
+The DSA design allows in principle for any switch driver to return any
+protocol it desires in ->get_tag_protocol(). The dsa_loop driver can be
+modified to do just that. But in the current design, the memory behind
+dp->priv has to be allocated by the switch driver, so if the tagging
+protocol is paired to an unexpected switch driver, we may end up in NULL
+pointer dereferences inside the kernel, or worse (a switch driver may
+allocate dp->priv according to the expectations of a different tagger).
+
+The latter possibility is even more plausible considering that DSA
+switches can dynamically change tagging protocols in certain cases
+(dsa <-> edsa, ocelot <-> ocelot-8021q), and the current design lends
+itself to mistakes that are all too easy to make.
+
+This patch proposes that the tagging protocol driver should manage its
+own memory, instead of relying on the switch driver to do so.
+After analyzing the different in-tree needs, it can be observed that the
+required tagger storage is per switch, therefore a ds->tagger_data
+pointer is introduced. In principle, per-port storage could also be
+introduced, although there is no need for it at the moment. Future
+changes will replace the current usage of dp->priv with ds->tagger_data.
+
+We define a "binding" event between the DSA switch tree and the tagging
+protocol. During this binding event, the tagging protocol's ->connect()
+method is called first, and this may allocate some memory for each
+switch of the tree. Then a cross-chip notifier is emitted for the
+switches within that tree, and they are given the opportunity to fix up
+the tagger's memory (for example, they might set up some function
+pointers that represent virtual methods for consuming packets).
+Because the memory is owned by the tagger, there exists a ->disconnect()
+method for the tagger (which is the place to free the resources), but
+there doesn't exist a ->disconnect() method for the switch driver.
+This is part of the design. The switch driver should make minimal use of
+the public part of the tagger data, and only after type-checking it
+using the supplied "proto" argument.
+
+In the code there are in fact two binding events, one is the initial
+event in dsa_switch_setup_tag_protocol(). At this stage, the cross chip
+notifier chains aren't initialized, so we call each switch's connect()
+method by hand. Then there is dsa_tree_bind_tag_proto() during
+dsa_tree_change_tag_proto(), and here we have an old protocol and a new
+one. We first connect to the new one before disconnecting from the old
+one, to simplify error handling a bit and to ensure we remain in a valid
+state at all times.
+
+Co-developed-by: Ansuel Smith <ansuelsmth@gmail.com>
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/net/dsa.h  | 12 +++++++++
+ net/dsa/dsa2.c     | 73 +++++++++++++++++++++++++++++++++++++++++++++++++++---
+ net/dsa/dsa_priv.h |  1 +
+ net/dsa/switch.c   | 14 +++++++++++
+ 4 files changed, 96 insertions(+), 4 deletions(-)
+
+--- a/include/net/dsa.h
++++ b/include/net/dsa.h
+@@ -80,12 +80,15 @@ enum dsa_tag_protocol {
+ };
+ 
+ struct dsa_switch;
++struct dsa_switch_tree;
+ 
+ struct dsa_device_ops {
+ 	struct sk_buff *(*xmit)(struct sk_buff *skb, struct net_device *dev);
+ 	struct sk_buff *(*rcv)(struct sk_buff *skb, struct net_device *dev);
+ 	void (*flow_dissect)(const struct sk_buff *skb, __be16 *proto,
+ 			     int *offset);
++	int (*connect)(struct dsa_switch_tree *dst);
++	void (*disconnect)(struct dsa_switch_tree *dst);
+ 	unsigned int needed_headroom;
+ 	unsigned int needed_tailroom;
+ 	const char *name;
+@@ -329,6 +332,8 @@ struct dsa_switch {
+ 	 */
+ 	void *priv;
+ 
++	void *tagger_data;
++
+ 	/*
+ 	 * Configuration data for this switch.
+ 	 */
+@@ -612,6 +617,13 @@ struct dsa_switch_ops {
+ 						  enum dsa_tag_protocol mprot);
+ 	int	(*change_tag_protocol)(struct dsa_switch *ds, int port,
+ 				       enum dsa_tag_protocol proto);
++	/*
++	 * Method for switch drivers to connect to the tagging protocol driver
++	 * in current use. The switch driver can provide handlers for certain
++	 * types of packets for switch management.
++	 */
++	int	(*connect_tag_protocol)(struct dsa_switch *ds,
++					enum dsa_tag_protocol proto);
+ 
+ 	/* Optional switch-wide initialization and destruction methods */
+ 	int	(*setup)(struct dsa_switch *ds);
+--- a/net/dsa/dsa2.c
++++ b/net/dsa/dsa2.c
+@@ -230,8 +230,12 @@ static struct dsa_switch_tree *dsa_tree_
+ 
+ static void dsa_tree_free(struct dsa_switch_tree *dst)
+ {
+-	if (dst->tag_ops)
++	if (dst->tag_ops) {
++		if (dst->tag_ops->disconnect)
++			dst->tag_ops->disconnect(dst);
++
+ 		dsa_tag_driver_put(dst->tag_ops);
++	}
+ 	list_del(&dst->list);
+ 	kfree(dst);
+ }
+@@ -805,7 +809,7 @@ static int dsa_switch_setup_tag_protocol
+ 	int port, err;
+ 
+ 	if (tag_ops->proto == dst->default_proto)
+-		return 0;
++		goto connect;
+ 
+ 	for (port = 0; port < ds->num_ports; port++) {
+ 		if (!dsa_is_cpu_port(ds, port))
+@@ -821,6 +825,17 @@ static int dsa_switch_setup_tag_protocol
+ 		}
+ 	}
+ 
++connect:
++	if (ds->ops->connect_tag_protocol) {
++		err = ds->ops->connect_tag_protocol(ds, tag_ops->proto);
++		if (err) {
++			dev_err(ds->dev,
++				"Unable to connect to tag protocol \"%s\": %pe\n",
++				tag_ops->name, ERR_PTR(err));
++			return err;
++		}
++	}
++
+ 	return 0;
+ }
+ 
+@@ -1132,6 +1147,46 @@ static void dsa_tree_teardown(struct dsa
+ 	dst->setup = false;
+ }
+ 
++static int dsa_tree_bind_tag_proto(struct dsa_switch_tree *dst,
++				   const struct dsa_device_ops *tag_ops)
++{
++	const struct dsa_device_ops *old_tag_ops = dst->tag_ops;
++	struct dsa_notifier_tag_proto_info info;
++	int err;
++
++	dst->tag_ops = tag_ops;
++
++	/* Notify the new tagger about the connection to this tree */
++	if (tag_ops->connect) {
++		err = tag_ops->connect(dst);
++		if (err)
++			goto out_revert;
++	}
++
++	/* Notify the switches from this tree about the connection
++	 * to the new tagger
++	 */
++	info.tag_ops = tag_ops;
++	err = dsa_tree_notify(dst, DSA_NOTIFIER_TAG_PROTO_CONNECT, &info);
++	if (err && err != -EOPNOTSUPP)
++		goto out_disconnect;
++
++	/* Notify the old tagger about the disconnection from this tree */
++	if (old_tag_ops->disconnect)
++		old_tag_ops->disconnect(dst);
++
++	return 0;
++
++out_disconnect:
++	/* Revert the new tagger's connection to this tree */
++	if (tag_ops->disconnect)
++		tag_ops->disconnect(dst);
++out_revert:
++	dst->tag_ops = old_tag_ops;
++
++	return err;
++}
++
+ /* Since the dsa/tagging sysfs device attribute is per master, the assumption
+  * is that all DSA switches within a tree share the same tagger, otherwise
+  * they would have formed disjoint trees (different "dsa,member" values).
+@@ -1164,12 +1219,15 @@ int dsa_tree_change_tag_proto(struct dsa
+ 			goto out_unlock;
+ 	}
+ 
++	/* Notify the tag protocol change */
+ 	info.tag_ops = tag_ops;
+ 	err = dsa_tree_notify(dst, DSA_NOTIFIER_TAG_PROTO, &info);
+ 	if (err)
+-		goto out_unwind_tagger;
++		return err;
+ 
+-	dst->tag_ops = tag_ops;
++	err = dsa_tree_bind_tag_proto(dst, tag_ops);
++	if (err)
++		goto out_unwind_tagger;
+ 
+ 	rtnl_unlock();
+ 
+@@ -1257,6 +1315,7 @@ static int dsa_port_parse_cpu(struct dsa
+ 	struct dsa_switch *ds = dp->ds;
+ 	struct dsa_switch_tree *dst = ds->dst;
+ 	enum dsa_tag_protocol default_proto;
++	int err;
+ 
+ 	/* Find out which protocol the switch would prefer. */
+ 	default_proto = dsa_get_tag_protocol(dp, master);
+@@ -1311,6 +1370,12 @@ static int dsa_port_parse_cpu(struct dsa
+ 		 */
+ 		dsa_tag_driver_put(tag_ops);
+ 	} else {
++		if (tag_ops->connect) {
++			err = tag_ops->connect(dst);
++			if (err)
++				return err;
++		}
++
+ 		dst->tag_ops = tag_ops;
+ 	}
+ 
+--- a/net/dsa/dsa_priv.h
++++ b/net/dsa/dsa_priv.h
+@@ -37,6 +37,7 @@ enum {
+ 	DSA_NOTIFIER_VLAN_DEL,
+ 	DSA_NOTIFIER_MTU,
+ 	DSA_NOTIFIER_TAG_PROTO,
++	DSA_NOTIFIER_TAG_PROTO_CONNECT,
+ 	DSA_NOTIFIER_MRP_ADD,
+ 	DSA_NOTIFIER_MRP_DEL,
+ 	DSA_NOTIFIER_MRP_ADD_RING_ROLE,
+--- a/net/dsa/switch.c
++++ b/net/dsa/switch.c
+@@ -616,6 +616,17 @@ static int dsa_switch_change_tag_proto(s
+ 	return 0;
+ }
+ 
++static int dsa_switch_connect_tag_proto(struct dsa_switch *ds,
++					struct dsa_notifier_tag_proto_info *info)
++{
++	const struct dsa_device_ops *tag_ops = info->tag_ops;
++
++	if (!ds->ops->connect_tag_protocol)
++		return -EOPNOTSUPP;
++
++	return ds->ops->connect_tag_protocol(ds, tag_ops->proto);
++}
++
+ static int dsa_switch_mrp_add(struct dsa_switch *ds,
+ 			      struct dsa_notifier_mrp_info *info)
+ {
+@@ -735,6 +746,9 @@ static int dsa_switch_event(struct notif
+ 	case DSA_NOTIFIER_TAG_PROTO:
+ 		err = dsa_switch_change_tag_proto(ds, info);
+ 		break;
++	case DSA_NOTIFIER_TAG_PROTO_CONNECT:
++		err = dsa_switch_connect_tag_proto(ds, info);
++		break;
+ 	case DSA_NOTIFIER_MRP_ADD:
+ 		err = dsa_switch_mrp_add(ds, info);
+ 		break;
diff --git a/target/linux/generic/backport-5.15/701-v5.17-dsa-make-tagging-protocols-connect-to-individual-switches.patch b/target/linux/generic/backport-5.15/701-v5.17-dsa-make-tagging-protocols-connect-to-individual-switches.patch
new file mode 100644
index 00000000000000..0c50ae6fb9de9e
--- /dev/null
+++ b/target/linux/generic/backport-5.15/701-v5.17-dsa-make-tagging-protocols-connect-to-individual-switches.patch
@@ -0,0 +1,274 @@
+From 7f2973149c22e7a6fee4c0c9fa6b8e4108e9c208 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Tue, 14 Dec 2021 03:45:36 +0200
+Subject: net: dsa: make tagging protocols connect to individual switches from
+ a tree
+
+On the NXP Bluebox 3 board which uses a multi-switch setup with sja1105,
+the mechanism through which the tagger connects to the switch tree is
+broken, due to improper DSA code design. At the time when tag_ops->connect()
+is called in dsa_port_parse_cpu(), DSA hasn't finished "touching" all
+the ports, so it doesn't know how large the tree is and how many ports
+it has. It has just seen the first CPU port by this time. As a result,
+this function will call the tagger's ->connect method too early, and the
+tagger will connect only to the first switch from the tree.
+
+This could be perhaps addressed a bit more simply by just moving the
+tag_ops->connect(dst) call a bit later (for example in dsa_tree_setup),
+but there is already a design inconsistency at present: on the switch
+side, the notification is on a per-switch basis, but on the tagger side,
+it is on a per-tree basis. Furthermore, the persistent storage itself is
+per switch (ds->tagger_data). And the tagger connect and disconnect
+procedures (at least the ones that exist currently) could see a fair bit
+of simplification if they didn't have to iterate through the switches of
+a tree.
+
+To fix the issue, this change transforms tag_ops->connect(dst) into
+tag_ops->connect(ds) and moves it somewhere where we already iterate
+over all switches of a tree. That is in dsa_switch_setup_tag_protocol(),
+which is a good placement because we already have there the connection
+call to the switch side of things.
+
+As for the dsa_tree_bind_tag_proto() method (called from the code path
+that changes the tag protocol), things are a bit more complicated
+because we receive the tree as argument, yet when we unwind on errors,
+it would be nice to not call tag_ops->disconnect(ds) where we didn't
+previously call tag_ops->connect(ds). We didn't have this problem before
+because the tag_ops connection operations passed the entire dst before,
+and this is more fine grained now. To solve the error rewind case using
+the new API, we have to create yet one more cross-chip notifier for
+disconnection, and stay connected with the old tag protocol to all the
+switches in the tree until we've succeeded to connect with the new one
+as well. So if something fails half way, the whole tree is still
+connected to the old tagger. But there may still be leaks if the tagger
+fails to connect to the 2nd out of 3 switches in a tree: somebody needs
+to tell the tagger to disconnect from the first switch. Nothing comes
+for free, and this was previously handled privately by the tagging
+protocol driver before, but now we need to emit a disconnect cross-chip
+notifier for that, because DSA has to take care of the unwind path. We
+assume that the tagging protocol has connected to a switch if it has set
+ds->tagger_data to something, otherwise we avoid calling its
+disconnection method in the error rewind path.
+
+The rest of the changes are in the tagging protocol drivers, and have to
+do with the replacement of dst with ds. The iteration is removed and the
+error unwind path is simplified, as mentioned above.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/net/dsa.h          |  5 ++--
+ net/dsa/dsa2.c             | 44 +++++++++++++-----------------
+ net/dsa/dsa_priv.h         |  1 +
+ net/dsa/switch.c           | 52 ++++++++++++++++++++++++++++++++---
+ net/dsa/tag_ocelot_8021q.c | 53 +++++++++++-------------------------
+ net/dsa/tag_sja1105.c      | 67 ++++++++++++++++------------------------------
+ 6 files changed, 109 insertions(+), 113 deletions(-)
+
+--- a/include/net/dsa.h
++++ b/include/net/dsa.h
+@@ -80,15 +80,14 @@ enum dsa_tag_protocol {
+ };
+ 
+ struct dsa_switch;
+-struct dsa_switch_tree;
+ 
+ struct dsa_device_ops {
+ 	struct sk_buff *(*xmit)(struct sk_buff *skb, struct net_device *dev);
+ 	struct sk_buff *(*rcv)(struct sk_buff *skb, struct net_device *dev);
+ 	void (*flow_dissect)(const struct sk_buff *skb, __be16 *proto,
+ 			     int *offset);
+-	int (*connect)(struct dsa_switch_tree *dst);
+-	void (*disconnect)(struct dsa_switch_tree *dst);
++	int (*connect)(struct dsa_switch *ds);
++	void (*disconnect)(struct dsa_switch *ds);
+ 	unsigned int needed_headroom;
+ 	unsigned int needed_tailroom;
+ 	const char *name;
+--- a/net/dsa/dsa2.c
++++ b/net/dsa/dsa2.c
+@@ -230,12 +230,8 @@ static struct dsa_switch_tree *dsa_tree_
+ 
+ static void dsa_tree_free(struct dsa_switch_tree *dst)
+ {
+-	if (dst->tag_ops) {
+-		if (dst->tag_ops->disconnect)
+-			dst->tag_ops->disconnect(dst);
+-
++	if (dst->tag_ops)
+ 		dsa_tag_driver_put(dst->tag_ops);
+-	}
+ 	list_del(&dst->list);
+ 	kfree(dst);
+ }
+@@ -826,17 +822,29 @@ static int dsa_switch_setup_tag_protocol
+ 	}
+ 
+ connect:
++	if (tag_ops->connect) {
++		err = tag_ops->connect(ds);
++		if (err)
++			return err;
++	}
++
+ 	if (ds->ops->connect_tag_protocol) {
+ 		err = ds->ops->connect_tag_protocol(ds, tag_ops->proto);
+ 		if (err) {
+ 			dev_err(ds->dev,
+ 				"Unable to connect to tag protocol \"%s\": %pe\n",
+ 				tag_ops->name, ERR_PTR(err));
+-			return err;
++			goto disconnect;
+ 		}
+ 	}
+ 
+ 	return 0;
++
++disconnect:
++	if (tag_ops->disconnect)
++		tag_ops->disconnect(ds);
++
++	return err;
+ }
+ 
+ static int dsa_switch_setup(struct dsa_switch *ds)
+@@ -1156,13 +1164,6 @@ static int dsa_tree_bind_tag_proto(struc
+ 
+ 	dst->tag_ops = tag_ops;
+ 
+-	/* Notify the new tagger about the connection to this tree */
+-	if (tag_ops->connect) {
+-		err = tag_ops->connect(dst);
+-		if (err)
+-			goto out_revert;
+-	}
+-
+ 	/* Notify the switches from this tree about the connection
+ 	 * to the new tagger
+ 	 */
+@@ -1172,16 +1173,14 @@ static int dsa_tree_bind_tag_proto(struc
+ 		goto out_disconnect;
+ 
+ 	/* Notify the old tagger about the disconnection from this tree */
+-	if (old_tag_ops->disconnect)
+-		old_tag_ops->disconnect(dst);
++	info.tag_ops = old_tag_ops;
++	dsa_tree_notify(dst, DSA_NOTIFIER_TAG_PROTO_DISCONNECT, &info);
+ 
+ 	return 0;
+ 
+ out_disconnect:
+-	/* Revert the new tagger's connection to this tree */
+-	if (tag_ops->disconnect)
+-		tag_ops->disconnect(dst);
+-out_revert:
++	info.tag_ops = tag_ops;
++	dsa_tree_notify(dst, DSA_NOTIFIER_TAG_PROTO_DISCONNECT, &info);
+ 	dst->tag_ops = old_tag_ops;
+ 
+ 	return err;
+@@ -1315,7 +1314,6 @@ static int dsa_port_parse_cpu(struct dsa
+ 	struct dsa_switch *ds = dp->ds;
+ 	struct dsa_switch_tree *dst = ds->dst;
+ 	enum dsa_tag_protocol default_proto;
+-	int err;
+ 
+ 	/* Find out which protocol the switch would prefer. */
+ 	default_proto = dsa_get_tag_protocol(dp, master);
+@@ -1370,12 +1368,6 @@ static int dsa_port_parse_cpu(struct dsa
+ 		 */
+ 		dsa_tag_driver_put(tag_ops);
+ 	} else {
+-		if (tag_ops->connect) {
+-			err = tag_ops->connect(dst);
+-			if (err)
+-				return err;
+-		}
+-
+ 		dst->tag_ops = tag_ops;
+ 	}
+ 
+--- a/net/dsa/dsa_priv.h
++++ b/net/dsa/dsa_priv.h
+@@ -38,6 +38,7 @@ enum {
+ 	DSA_NOTIFIER_MTU,
+ 	DSA_NOTIFIER_TAG_PROTO,
+ 	DSA_NOTIFIER_TAG_PROTO_CONNECT,
++	DSA_NOTIFIER_TAG_PROTO_DISCONNECT,
+ 	DSA_NOTIFIER_MRP_ADD,
+ 	DSA_NOTIFIER_MRP_DEL,
+ 	DSA_NOTIFIER_MRP_ADD_RING_ROLE,
+--- a/net/dsa/switch.c
++++ b/net/dsa/switch.c
+@@ -616,15 +616,58 @@ static int dsa_switch_change_tag_proto(s
+ 	return 0;
+ }
+ 
+-static int dsa_switch_connect_tag_proto(struct dsa_switch *ds,
+-					struct dsa_notifier_tag_proto_info *info)
++/* We use the same cross-chip notifiers to inform both the tagger side, as well
++ * as the switch side, of connection and disconnection events.
++ * Since ds->tagger_data is owned by the tagger, it isn't a hard error if the
++ * switch side doesn't support connecting to this tagger, and therefore, the
++ * fact that we don't disconnect the tagger side doesn't constitute a memory
++ * leak: the tagger will still operate with persistent per-switch memory, just
++ * with the switch side unconnected to it. What does constitute a hard error is
++ * when the switch side supports connecting but fails.
++ */
++static int
++dsa_switch_connect_tag_proto(struct dsa_switch *ds,
++			     struct dsa_notifier_tag_proto_info *info)
+ {
+ 	const struct dsa_device_ops *tag_ops = info->tag_ops;
++	int err;
++
++	/* Notify the new tagger about the connection to this switch */
++	if (tag_ops->connect) {
++		err = tag_ops->connect(ds);
++		if (err)
++			return err;
++	}
+ 
+ 	if (!ds->ops->connect_tag_protocol)
+ 		return -EOPNOTSUPP;
+ 
+-	return ds->ops->connect_tag_protocol(ds, tag_ops->proto);
++	/* Notify the switch about the connection to the new tagger */
++	err = ds->ops->connect_tag_protocol(ds, tag_ops->proto);
++	if (err) {
++		/* Revert the new tagger's connection to this tree */
++		if (tag_ops->disconnect)
++			tag_ops->disconnect(ds);
++		return err;
++	}
++
++	return 0;
++}
++
++static int
++dsa_switch_disconnect_tag_proto(struct dsa_switch *ds,
++				struct dsa_notifier_tag_proto_info *info)
++{
++	const struct dsa_device_ops *tag_ops = info->tag_ops;
++
++	/* Notify the tagger about the disconnection from this switch */
++	if (tag_ops->disconnect && ds->tagger_data)
++		tag_ops->disconnect(ds);
++
++	/* No need to notify the switch, since it shouldn't have any
++	 * resources to tear down
++	 */
++	return 0;
+ }
+ 
+ static int dsa_switch_mrp_add(struct dsa_switch *ds,
+@@ -749,6 +792,9 @@ static int dsa_switch_event(struct notif
+ 	case DSA_NOTIFIER_TAG_PROTO_CONNECT:
+ 		err = dsa_switch_connect_tag_proto(ds, info);
+ 		break;
++	case DSA_NOTIFIER_TAG_PROTO_DISCONNECT:
++		err = dsa_switch_disconnect_tag_proto(ds, info);
++		break;
+ 	case DSA_NOTIFIER_MRP_ADD:
+ 		err = dsa_switch_mrp_add(ds, info);
+ 		break;
diff --git a/target/linux/generic/backport-5.15/702-v5.19-00-net-ethernet-mtk_eth_soc-add-support-for-coherent-DM.patch b/target/linux/generic/backport-5.15/702-v5.19-00-net-ethernet-mtk_eth_soc-add-support-for-coherent-DM.patch
index afd78fdda29930..c83d659d1c06de 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-00-net-ethernet-mtk_eth_soc-add-support-for-coherent-DM.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-00-net-ethernet-mtk_eth_soc-add-support-for-coherent-DM.patch
@@ -20,7 +20,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #include <linux/mfd/syscon.h>
  #include <linux/regmap.h>
  #include <linux/clk.h>
-@@ -839,7 +840,7 @@ static int mtk_init_fq_dma(struct mtk_et
+@@ -840,7 +841,7 @@ static int mtk_init_fq_dma(struct mtk_et
  	dma_addr_t dma_addr;
  	int i;
  
@@ -29,7 +29,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  					       cnt * sizeof(struct mtk_tx_dma),
  					       &eth->phy_scratch_ring,
  					       GFP_ATOMIC);
-@@ -851,10 +852,10 @@ static int mtk_init_fq_dma(struct mtk_et
+@@ -852,10 +853,10 @@ static int mtk_init_fq_dma(struct mtk_et
  	if (unlikely(!eth->scratch_head))
  		return -ENOMEM;
  
@@ -42,7 +42,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		return -ENOMEM;
  
  	phy_ring_tail = eth->phy_scratch_ring +
-@@ -908,26 +909,26 @@ static void mtk_tx_unmap(struct mtk_eth
+@@ -909,26 +910,26 @@ static void mtk_tx_unmap(struct mtk_eth
  {
  	if (MTK_HAS_CAPS(eth->soc->caps, MTK_QDMA)) {
  		if (tx_buf->flags & MTK_TX_FLAGS_SINGLE0) {
@@ -73,7 +73,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  				       dma_unmap_addr(tx_buf, dma_addr1),
  				       dma_unmap_len(tx_buf, dma_len1),
  				       DMA_TO_DEVICE);
-@@ -1005,9 +1006,9 @@ static int mtk_tx_map(struct sk_buff *sk
+@@ -1006,9 +1007,9 @@ static int mtk_tx_map(struct sk_buff *sk
  	if (skb_vlan_tag_present(skb))
  		txd4 |= TX_DMA_INS_VLAN | skb_vlan_tag_get(skb);
  
@@ -85,7 +85,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		return -ENOMEM;
  
  	WRITE_ONCE(itxd->txd1, mapped_addr);
-@@ -1046,10 +1047,10 @@ static int mtk_tx_map(struct sk_buff *sk
+@@ -1047,10 +1048,10 @@ static int mtk_tx_map(struct sk_buff *sk
  
  
  			frag_map_size = min(frag_size, MTK_TX_DMA_BUF_LEN);
@@ -98,7 +98,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  				goto err_dma;
  
  			if (i == nr_frags - 1 &&
-@@ -1330,18 +1331,18 @@ static int mtk_poll_rx(struct napi_struc
+@@ -1331,18 +1332,18 @@ static int mtk_poll_rx(struct napi_struc
  			netdev->stats.rx_dropped++;
  			goto release_desc;
  		}
@@ -120,7 +120,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  				 ring->buf_size, DMA_FROM_DEVICE);
  
  		/* receive data */
-@@ -1614,7 +1615,7 @@ static int mtk_tx_alloc(struct mtk_eth *
+@@ -1615,7 +1616,7 @@ static int mtk_tx_alloc(struct mtk_eth *
  	if (!ring->buf)
  		goto no_tx_mem;
  
@@ -129,7 +129,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  				       &ring->phys, GFP_ATOMIC);
  	if (!ring->dma)
  		goto no_tx_mem;
-@@ -1632,7 +1633,7 @@ static int mtk_tx_alloc(struct mtk_eth *
+@@ -1633,7 +1634,7 @@ static int mtk_tx_alloc(struct mtk_eth *
  	 * descriptors in ring->dma_pdma.
  	 */
  	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_QDMA)) {
@@ -138,7 +138,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  						    &ring->phys_pdma,
  						    GFP_ATOMIC);
  		if (!ring->dma_pdma)
-@@ -1691,7 +1692,7 @@ static void mtk_tx_clean(struct mtk_eth
+@@ -1692,7 +1693,7 @@ static void mtk_tx_clean(struct mtk_eth
  	}
  
  	if (ring->dma) {
@@ -147,7 +147,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  				  MTK_DMA_SIZE * sizeof(*ring->dma),
  				  ring->dma,
  				  ring->phys);
-@@ -1699,7 +1700,7 @@ static void mtk_tx_clean(struct mtk_eth
+@@ -1700,7 +1701,7 @@ static void mtk_tx_clean(struct mtk_eth
  	}
  
  	if (ring->dma_pdma) {
@@ -156,7 +156,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  				  MTK_DMA_SIZE * sizeof(*ring->dma_pdma),
  				  ring->dma_pdma,
  				  ring->phys_pdma);
-@@ -1747,18 +1748,18 @@ static int mtk_rx_alloc(struct mtk_eth *
+@@ -1748,18 +1749,18 @@ static int mtk_rx_alloc(struct mtk_eth *
  			return -ENOMEM;
  	}
  
@@ -178,7 +178,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			return -ENOMEM;
  		ring->dma[i].rxd1 = (unsigned int)dma_addr;
  
-@@ -1794,7 +1795,7 @@ static void mtk_rx_clean(struct mtk_eth
+@@ -1795,7 +1796,7 @@ static void mtk_rx_clean(struct mtk_eth
  				continue;
  			if (!ring->dma[i].rxd1)
  				continue;
@@ -187,7 +187,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  					 ring->dma[i].rxd1,
  					 ring->buf_size,
  					 DMA_FROM_DEVICE);
-@@ -1805,7 +1806,7 @@ static void mtk_rx_clean(struct mtk_eth
+@@ -1806,7 +1807,7 @@ static void mtk_rx_clean(struct mtk_eth
  	}
  
  	if (ring->dma) {
@@ -196,7 +196,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  				  ring->dma_size * sizeof(*ring->dma),
  				  ring->dma,
  				  ring->phys);
-@@ -2161,7 +2162,7 @@ static void mtk_dma_free(struct mtk_eth
+@@ -2162,7 +2163,7 @@ static void mtk_dma_free(struct mtk_eth
  		if (eth->netdev[i])
  			netdev_reset_queue(eth->netdev[i]);
  	if (eth->scratch_ring) {
@@ -205,7 +205,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  				  MTK_DMA_SIZE * sizeof(struct mtk_tx_dma),
  				  eth->scratch_ring,
  				  eth->phy_scratch_ring);
-@@ -2511,6 +2512,8 @@ static void mtk_dim_tx(struct work_struc
+@@ -2514,6 +2515,8 @@ static void mtk_dim_tx(struct work_struc
  
  static int mtk_hw_init(struct mtk_eth *eth)
  {
@@ -214,7 +214,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	int i, val, ret;
  
  	if (test_and_set_bit(MTK_HW_INIT, &eth->state))
-@@ -2523,6 +2526,10 @@ static int mtk_hw_init(struct mtk_eth *e
+@@ -2526,6 +2529,10 @@ static int mtk_hw_init(struct mtk_eth *e
  	if (ret)
  		goto err_disable_pm;
  
@@ -225,7 +225,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628)) {
  		ret = device_reset(eth->dev);
  		if (ret) {
-@@ -3076,6 +3083,35 @@ free_netdev:
+@@ -3079,6 +3086,35 @@ free_netdev:
  	return err;
  }
  
@@ -261,7 +261,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static int mtk_probe(struct platform_device *pdev)
  {
  	struct device_node *mac_np;
-@@ -3089,6 +3125,7 @@ static int mtk_probe(struct platform_dev
+@@ -3092,6 +3128,7 @@ static int mtk_probe(struct platform_dev
  	eth->soc = of_device_get_match_data(&pdev->dev);
  
  	eth->dev = &pdev->dev;
@@ -269,7 +269,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	eth->base = devm_platform_ioremap_resource(pdev, 0);
  	if (IS_ERR(eth->base))
  		return PTR_ERR(eth->base);
-@@ -3137,6 +3174,16 @@ static int mtk_probe(struct platform_dev
+@@ -3140,6 +3177,16 @@ static int mtk_probe(struct platform_dev
  		}
  	}
  
@@ -288,7 +288,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  					  GFP_KERNEL);
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -462,6 +462,12 @@
+@@ -463,6 +463,12 @@
  #define RSTCTRL_FE		BIT(6)
  #define RSTCTRL_PPE		BIT(31)
  
@@ -301,7 +301,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  /* SGMII subsystem config registers */
  /* Register to auto-negotiation restart */
  #define SGMSYS_PCS_CONTROL_1	0x0
-@@ -879,6 +885,7 @@ struct mtk_sgmii {
+@@ -880,6 +886,7 @@ struct mtk_sgmii {
  /* struct mtk_eth -	This is the main datasructure for holding the state
   *			of the driver
   * @dev:		The device pointer
@@ -309,7 +309,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
   * @base:		The mapped register i/o base
   * @page_lock:		Make sure that register operations are atomic
   * @tx_irq__lock:	Make sure that IRQ register operations are atomic
-@@ -922,6 +929,7 @@ struct mtk_sgmii {
+@@ -923,6 +930,7 @@ struct mtk_sgmii {
  
  struct mtk_eth {
  	struct device			*dev;
@@ -317,7 +317,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	void __iomem			*base;
  	spinlock_t			page_lock;
  	spinlock_t			tx_irq_lock;
-@@ -1020,6 +1028,7 @@ int mtk_gmac_rgmii_path_setup(struct mtk
+@@ -1021,6 +1029,7 @@ int mtk_gmac_rgmii_path_setup(struct mtk
  int mtk_eth_offload_init(struct mtk_eth *eth);
  int mtk_eth_setup_tc(struct net_device *dev, enum tc_setup_type type,
  		     void *type_data);
diff --git a/target/linux/generic/backport-5.15/702-v5.19-01-arm64-dts-mediatek-mt7622-add-support-for-coherent-D.patch b/target/linux/generic/backport-5.15/702-v5.19-01-arm64-dts-mediatek-mt7622-add-support-for-coherent-D.patch
index d9015d4805da13..9f2512a1d050aa 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-01-arm64-dts-mediatek-mt7622-add-support-for-coherent-D.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-01-arm64-dts-mediatek-mt7622-add-support-for-coherent-D.patch
@@ -19,7 +19,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			interface-type = "ace";
  			reg = <0x5000 0x1000>;
  		};
-@@ -937,6 +937,8 @@
+@@ -938,6 +938,8 @@
  		power-domains = <&scpsys MT7622_POWER_DOMAIN_ETHSYS>;
  		mediatek,ethsys = <&ethsys>;
  		mediatek,sgmiisys = <&sgmiisys>;
diff --git a/target/linux/generic/backport-5.15/702-v5.19-02-net-ethernet-mtk_eth_soc-add-support-for-Wireless-Et.patch b/target/linux/generic/backport-5.15/702-v5.19-02-net-ethernet-mtk_eth_soc-add-support-for-Wireless-Et.patch
index 502d1d0e9b5175..2f3a0827fe455b 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-02-net-ethernet-mtk_eth_soc-add-support-for-Wireless-Et.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-02-net-ethernet-mtk_eth_soc-add-support-for-Wireless-Et.patch
@@ -56,7 +56,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  static int mtk_msg_level = -1;
  module_param_named(msg_level, mtk_msg_level, int, 0);
-@@ -3206,6 +3207,22 @@ static int mtk_probe(struct platform_dev
+@@ -3209,6 +3210,22 @@ static int mtk_probe(struct platform_dev
  		}
  	}
  
diff --git a/target/linux/generic/backport-5.15/702-v5.19-03-net-ethernet-mtk_eth_soc-implement-flow-offloading-t.patch b/target/linux/generic/backport-5.15/702-v5.19-03-net-ethernet-mtk_eth_soc-implement-flow-offloading-t.patch
index 2f93518e157ab0..ef2f53aa3847d7 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-03-net-ethernet-mtk_eth_soc-implement-flow-offloading-t.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-03-net-ethernet-mtk_eth_soc-implement-flow-offloading-t.patch
@@ -233,7 +233,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static inline void
 --- a/include/linux/netdevice.h
 +++ b/include/linux/netdevice.h
-@@ -863,6 +863,7 @@ enum net_device_path_type {
+@@ -875,6 +875,7 @@ enum net_device_path_type {
  	DEV_PATH_BRIDGE,
  	DEV_PATH_PPPOE,
  	DEV_PATH_DSA,
@@ -241,7 +241,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  };
  
  struct net_device_path {
-@@ -888,6 +889,12 @@ struct net_device_path {
+@@ -900,6 +901,12 @@ struct net_device_path {
  			int port;
  			u16 proto;
  		} dsa;
diff --git a/target/linux/generic/backport-5.15/702-v5.19-04-arm64-dts-mediatek-mt7622-introduce-nodes-for-Wirele.patch b/target/linux/generic/backport-5.15/702-v5.19-04-arm64-dts-mediatek-mt7622-introduce-nodes-for-Wirele.patch
index f59a364a736f2e..2c6e3fd3cd3eff 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-04-arm64-dts-mediatek-mt7622-introduce-nodes-for-Wirele.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-04-arm64-dts-mediatek-mt7622-introduce-nodes-for-Wirele.patch
@@ -11,7 +11,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
 +++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
-@@ -893,6 +893,11 @@
+@@ -894,6 +894,11 @@
  		};
  	};
  
@@ -23,7 +23,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	ethsys: syscon@1b000000 {
  		compatible = "mediatek,mt7622-ethsys",
  			     "syscon";
-@@ -911,6 +916,26 @@
+@@ -912,6 +917,26 @@
  		#dma-cells = <1>;
  	};
  
@@ -50,7 +50,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	eth: ethernet@1b100000 {
  		compatible = "mediatek,mt7622-eth",
  			     "mediatek,mt2701-eth",
-@@ -938,6 +963,9 @@
+@@ -939,6 +964,9 @@
  		mediatek,ethsys = <&ethsys>;
  		mediatek,sgmiisys = <&sgmiisys>;
  		mediatek,cci-control = <&cci_control2>;
diff --git a/target/linux/generic/backport-5.15/702-v5.19-06-net-ethernet-mtk_eth_soc-support-TC_SETUP_BLOCK-for-.patch b/target/linux/generic/backport-5.15/702-v5.19-06-net-ethernet-mtk_eth_soc-support-TC_SETUP_BLOCK-for-.patch
index 72c6d281723963..1950d81ebbacfd 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-06-net-ethernet-mtk_eth_soc-support-TC_SETUP_BLOCK-for-.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-06-net-ethernet-mtk_eth_soc-support-TC_SETUP_BLOCK-for-.patch
@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
 +++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
-@@ -563,10 +563,13 @@ mtk_eth_setup_tc_block(struct net_device
+@@ -564,10 +564,13 @@ mtk_eth_setup_tc_block(struct net_device
  int mtk_eth_setup_tc(struct net_device *dev, enum tc_setup_type type,
  		     void *type_data)
  {
diff --git a/target/linux/generic/backport-5.15/702-v5.19-07-net-ethernet-mtk_eth_soc-allocate-struct-mtk_ppe-sep.patch b/target/linux/generic/backport-5.15/702-v5.19-07-net-ethernet-mtk_eth_soc-allocate-struct-mtk_ppe-sep.patch
index a17d49cac11ec9..f18a816b7030d4 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-07-net-ethernet-mtk_eth_soc-allocate-struct-mtk_ppe-sep.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-07-net-ethernet-mtk_eth_soc-allocate-struct-mtk_ppe-sep.patch
@@ -10,16 +10,16 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -2332,7 +2332,7 @@ static int mtk_open(struct net_device *d
- 		if (err)
+@@ -2335,7 +2335,7 @@ static int mtk_open(struct net_device *d
  			return err;
+ 		}
  
 -		if (eth->soc->offload_version && mtk_ppe_start(&eth->ppe) == 0)
 +		if (eth->soc->offload_version && mtk_ppe_start(eth->ppe) == 0)
  			gdm_config = MTK_GDMA_TO_PPE;
  
  		mtk_gdm_config(eth, gdm_config);
-@@ -2406,7 +2406,7 @@ static int mtk_stop(struct net_device *d
+@@ -2409,7 +2409,7 @@ static int mtk_stop(struct net_device *d
  	mtk_dma_free(eth);
  
  	if (eth->soc->offload_version)
@@ -28,7 +28,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	return 0;
  }
-@@ -3298,10 +3298,11 @@ static int mtk_probe(struct platform_dev
+@@ -3301,10 +3301,11 @@ static int mtk_probe(struct platform_dev
  	}
  
  	if (eth->soc->offload_version) {
@@ -45,7 +45,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		if (err)
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -982,7 +982,7 @@ struct mtk_eth {
+@@ -983,7 +983,7 @@ struct mtk_eth {
  	u32				rx_dma_l4_valid;
  	int				ip_align;
  
@@ -148,7 +148,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		return -EOPNOTSUPP;
  
  	if (f->binder_type != FLOW_BLOCK_BINDER_TYPE_CLSACT_INGRESS)
-@@ -574,7 +574,7 @@ int mtk_eth_setup_tc(struct net_device *
+@@ -575,7 +575,7 @@ int mtk_eth_setup_tc(struct net_device *
  
  int mtk_eth_offload_init(struct mtk_eth *eth)
  {
diff --git a/target/linux/generic/backport-5.15/702-v5.19-08-net-ethernet-mtk_eth_soc-rework-hardware-flow-table-.patch b/target/linux/generic/backport-5.15/702-v5.19-08-net-ethernet-mtk_eth_soc-rework-hardware-flow-table-.patch
index 76e8eb11fd586a..2609cbedec2e8e 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-08-net-ethernet-mtk_eth_soc-rework-hardware-flow-table-.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-08-net-ethernet-mtk_eth_soc-rework-hardware-flow-table-.patch
@@ -33,7 +33,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #include <net/dsa.h>
  
  #include "mtk_eth_soc.h"
-@@ -1292,7 +1293,7 @@ static int mtk_poll_rx(struct napi_struc
+@@ -1293,7 +1294,7 @@ static int mtk_poll_rx(struct napi_struc
  		struct net_device *netdev;
  		unsigned int pktlen;
  		dma_addr_t dma_addr;
@@ -42,7 +42,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		int mac;
  
  		ring = mtk_get_rx_ring(eth);
-@@ -1371,6 +1372,11 @@ static int mtk_poll_rx(struct napi_struc
+@@ -1372,6 +1373,11 @@ static int mtk_poll_rx(struct napi_struc
  			skb_set_hash(skb, hash, PKT_HASH_TYPE_L4);
  		}
  
@@ -54,7 +54,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		if (netdev->features & NETIF_F_HW_VLAN_CTAG_RX &&
  		    (trxd.rxd2 & RX_DMA_VTAG))
  			__vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q),
-@@ -3298,7 +3304,7 @@ static int mtk_probe(struct platform_dev
+@@ -3301,7 +3307,7 @@ static int mtk_probe(struct platform_dev
  	}
  
  	if (eth->soc->offload_version) {
diff --git a/target/linux/generic/backport-5.15/702-v5.19-13-net-ethernet-mtk_eth_soc-use-standard-property-for-c.patch b/target/linux/generic/backport-5.15/702-v5.19-13-net-ethernet-mtk_eth_soc-use-standard-property-for-c.patch
index d87022fce43e05..a7c5f08f100dd5 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-13-net-ethernet-mtk_eth_soc-use-standard-property-for-c.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-13-net-ethernet-mtk_eth_soc-use-standard-property-for-c.patch
@@ -13,7 +13,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
 +++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
-@@ -962,7 +962,7 @@
+@@ -963,7 +963,7 @@
  		power-domains = <&scpsys MT7622_POWER_DOMAIN_ETHSYS>;
  		mediatek,ethsys = <&ethsys>;
  		mediatek,sgmiisys = <&sgmiisys>;
@@ -24,7 +24,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		mediatek,hifsys = <&hifsys>;
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -3185,7 +3185,7 @@ static int mtk_probe(struct platform_dev
+@@ -3188,7 +3188,7 @@ static int mtk_probe(struct platform_dev
  		struct regmap *cci;
  
  		cci = syscon_regmap_lookup_by_phandle(pdev->dev.of_node,
diff --git a/target/linux/generic/backport-5.15/702-v5.19-17-net-ethernet-mtk_eth_soc-rely-on-GFP_KERNEL-for-dma_.patch b/target/linux/generic/backport-5.15/702-v5.19-17-net-ethernet-mtk_eth_soc-rely-on-GFP_KERNEL-for-dma_.patch
index 97677670cc1a59..9b6321f1dafbdd 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-17-net-ethernet-mtk_eth_soc-rely-on-GFP_KERNEL-for-dma_.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-17-net-ethernet-mtk_eth_soc-rely-on-GFP_KERNEL-for-dma_.patch
@@ -13,7 +13,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -845,7 +845,7 @@ static int mtk_init_fq_dma(struct mtk_et
+@@ -846,7 +846,7 @@ static int mtk_init_fq_dma(struct mtk_et
  	eth->scratch_ring = dma_alloc_coherent(eth->dma_dev,
  					       cnt * sizeof(struct mtk_tx_dma),
  					       &eth->phy_scratch_ring,
@@ -22,7 +22,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	if (unlikely(!eth->scratch_ring))
  		return -ENOMEM;
  
-@@ -1623,7 +1623,7 @@ static int mtk_tx_alloc(struct mtk_eth *
+@@ -1624,7 +1624,7 @@ static int mtk_tx_alloc(struct mtk_eth *
  		goto no_tx_mem;
  
  	ring->dma = dma_alloc_coherent(eth->dma_dev, MTK_DMA_SIZE * sz,
@@ -31,7 +31,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	if (!ring->dma)
  		goto no_tx_mem;
  
-@@ -1641,8 +1641,7 @@ static int mtk_tx_alloc(struct mtk_eth *
+@@ -1642,8 +1642,7 @@ static int mtk_tx_alloc(struct mtk_eth *
  	 */
  	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_QDMA)) {
  		ring->dma_pdma = dma_alloc_coherent(eth->dma_dev, MTK_DMA_SIZE * sz,
@@ -41,7 +41,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		if (!ring->dma_pdma)
  			goto no_tx_mem;
  
-@@ -1757,7 +1756,7 @@ static int mtk_rx_alloc(struct mtk_eth *
+@@ -1758,7 +1757,7 @@ static int mtk_rx_alloc(struct mtk_eth *
  
  	ring->dma = dma_alloc_coherent(eth->dma_dev,
  				       rx_dma_size * sizeof(*ring->dma),
diff --git a/target/linux/generic/backport-5.15/702-v5.19-18-net-ethernet-mtk_eth_soc-move-tx-dma-desc-configurat.patch b/target/linux/generic/backport-5.15/702-v5.19-18-net-ethernet-mtk_eth_soc-move-tx-dma-desc-configurat.patch
index 95f122f730f724..8e16ea2556695c 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-18-net-ethernet-mtk_eth_soc-move-tx-dma-desc-configurat.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-18-net-ethernet-mtk_eth_soc-move-tx-dma-desc-configurat.patch
@@ -14,7 +14,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -971,18 +971,51 @@ static void setup_tx_buf(struct mtk_eth
+@@ -972,18 +972,51 @@ static void setup_tx_buf(struct mtk_eth
  	}
  }
  
@@ -69,7 +69,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	int k = 0;
  
  	itxd = ring->next_free;
-@@ -990,49 +1023,32 @@ static int mtk_tx_map(struct sk_buff *sk
+@@ -991,49 +1024,32 @@ static int mtk_tx_map(struct sk_buff *sk
  	if (itxd == ring->last_free)
  		return -ENOMEM;
  
@@ -126,7 +126,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  			bool new_desc = true;
  
  			if (MTK_HAS_CAPS(eth->soc->caps, MTK_QDMA) ||
-@@ -1047,23 +1063,17 @@ static int mtk_tx_map(struct sk_buff *sk
+@@ -1048,23 +1064,17 @@ static int mtk_tx_map(struct sk_buff *sk
  				new_desc = false;
  			}
  
@@ -159,7 +159,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  			tx_buf = mtk_desc_to_tx_buf(ring, txd);
  			if (new_desc)
-@@ -1073,20 +1083,17 @@ static int mtk_tx_map(struct sk_buff *sk
+@@ -1074,20 +1084,17 @@ static int mtk_tx_map(struct sk_buff *sk
  			tx_buf->flags |= (!mac->id) ? MTK_TX_FLAGS_FPORT0 :
  					 MTK_TX_FLAGS_FPORT1;
  
@@ -186,7 +186,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  			txd_pdma->txd2 |= TX_DMA_LS0;
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -842,6 +842,17 @@ enum mkt_eth_capabilities {
+@@ -843,6 +843,17 @@ enum mkt_eth_capabilities {
  		      MTK_MUX_U3_GMAC2_TO_QPHY | \
  		      MTK_MUX_GMAC12_TO_GEPHY_SGMII | MTK_QDMA)
  
diff --git a/target/linux/generic/backport-5.15/702-v5.19-19-net-ethernet-mtk_eth_soc-add-txd_size-to-mtk_soc_dat.patch b/target/linux/generic/backport-5.15/702-v5.19-19-net-ethernet-mtk_eth_soc-add-txd_size-to-mtk_soc_dat.patch
index 7aeeda0ba06591..f5206bba00b39c 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-19-net-ethernet-mtk_eth_soc-add-txd_size-to-mtk_soc_dat.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-19-net-ethernet-mtk_eth_soc-add-txd_size-to-mtk_soc_dat.patch
@@ -14,7 +14,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -837,20 +837,20 @@ static void *mtk_max_lro_buf_alloc(gfp_t
+@@ -838,20 +838,20 @@ static void *mtk_max_lro_buf_alloc(gfp_t
  /* the qdma core needs scratch memory to be setup */
  static int mtk_init_fq_dma(struct mtk_eth *eth)
  {
@@ -38,7 +38,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	if (unlikely(!eth->scratch_head))
  		return -ENOMEM;
  
-@@ -860,16 +860,19 @@ static int mtk_init_fq_dma(struct mtk_et
+@@ -861,16 +861,19 @@ static int mtk_init_fq_dma(struct mtk_et
  	if (unlikely(dma_mapping_error(eth->dma_dev, dma_addr)))
  		return -ENOMEM;
  
@@ -65,7 +65,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	}
  
  	mtk_w32(eth, eth->phy_scratch_ring, MTK_QDMA_FQ_HEAD);
-@@ -2169,6 +2172,7 @@ static int mtk_dma_init(struct mtk_eth *
+@@ -2170,6 +2173,7 @@ static int mtk_dma_init(struct mtk_eth *
  
  static void mtk_dma_free(struct mtk_eth *eth)
  {
@@ -73,7 +73,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	int i;
  
  	for (i = 0; i < MTK_MAC_COUNT; i++)
-@@ -2176,9 +2180,8 @@ static void mtk_dma_free(struct mtk_eth
+@@ -2177,9 +2181,8 @@ static void mtk_dma_free(struct mtk_eth
  			netdev_reset_queue(eth->netdev[i]);
  	if (eth->scratch_ring) {
  		dma_free_coherent(eth->dma_dev,
@@ -85,7 +85,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		eth->scratch_ring = NULL;
  		eth->phy_scratch_ring = 0;
  	}
-@@ -3388,6 +3391,9 @@ static const struct mtk_soc_data mt2701_
+@@ -3391,6 +3394,9 @@ static const struct mtk_soc_data mt2701_
  	.hw_features = MTK_HW_FEATURES,
  	.required_clks = MT7623_CLKS_BITMAP,
  	.required_pctl = true,
@@ -95,7 +95,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  };
  
  static const struct mtk_soc_data mt7621_data = {
-@@ -3396,6 +3402,9 @@ static const struct mtk_soc_data mt7621_
+@@ -3399,6 +3405,9 @@ static const struct mtk_soc_data mt7621_
  	.required_clks = MT7621_CLKS_BITMAP,
  	.required_pctl = false,
  	.offload_version = 2,
@@ -105,7 +105,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  };
  
  static const struct mtk_soc_data mt7622_data = {
-@@ -3405,6 +3414,9 @@ static const struct mtk_soc_data mt7622_
+@@ -3408,6 +3417,9 @@ static const struct mtk_soc_data mt7622_
  	.required_clks = MT7622_CLKS_BITMAP,
  	.required_pctl = false,
  	.offload_version = 2,
@@ -115,7 +115,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  };
  
  static const struct mtk_soc_data mt7623_data = {
-@@ -3413,6 +3425,9 @@ static const struct mtk_soc_data mt7623_
+@@ -3416,6 +3428,9 @@ static const struct mtk_soc_data mt7623_
  	.required_clks = MT7623_CLKS_BITMAP,
  	.required_pctl = true,
  	.offload_version = 2,
@@ -125,7 +125,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  };
  
  static const struct mtk_soc_data mt7629_data = {
-@@ -3421,6 +3436,9 @@ static const struct mtk_soc_data mt7629_
+@@ -3424,6 +3439,9 @@ static const struct mtk_soc_data mt7629_
  	.hw_features = MTK_HW_FEATURES,
  	.required_clks = MT7629_CLKS_BITMAP,
  	.required_pctl = false,
@@ -135,7 +135,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  };
  
  static const struct mtk_soc_data rt5350_data = {
-@@ -3428,6 +3446,9 @@ static const struct mtk_soc_data rt5350_
+@@ -3431,6 +3449,9 @@ static const struct mtk_soc_data rt5350_
  	.hw_features = MTK_HW_FEATURES_MT7628,
  	.required_clks = MT7628_CLKS_BITMAP,
  	.required_pctl = false,
@@ -147,7 +147,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  const struct of_device_id of_mtk_match[] = {
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -863,6 +863,7 @@ struct mtk_tx_dma_desc_info {
+@@ -864,6 +864,7 @@ struct mtk_tx_dma_desc_info {
   *				the target SoC
   * @required_pctl		A bool value to show whether the SoC requires
   *				the extra setup for those pins used by GMAC.
@@ -155,7 +155,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
   */
  struct mtk_soc_data {
  	u32             ana_rgc3;
-@@ -871,6 +872,9 @@ struct mtk_soc_data {
+@@ -872,6 +873,9 @@ struct mtk_soc_data {
  	bool		required_pctl;
  	u8		offload_version;
  	netdev_features_t hw_features;
diff --git a/target/linux/generic/backport-5.15/702-v5.19-20-net-ethernet-mtk_eth_soc-rely-on-txd_size-in-mtk_tx_.patch b/target/linux/generic/backport-5.15/702-v5.19-20-net-ethernet-mtk_eth_soc-rely-on-txd_size-in-mtk_tx_.patch
index 01dbca0753bb0f..ebe1ee3d59a45c 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-20-net-ethernet-mtk_eth_soc-rely-on-txd_size-in-mtk_tx_.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-20-net-ethernet-mtk_eth_soc-rely-on-txd_size-in-mtk_tx_.patch
@@ -12,7 +12,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -1624,8 +1624,10 @@ static int mtk_napi_rx(struct napi_struc
+@@ -1625,8 +1625,10 @@ static int mtk_napi_rx(struct napi_struc
  
  static int mtk_tx_alloc(struct mtk_eth *eth)
  {
@@ -24,7 +24,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	ring->buf = kcalloc(MTK_DMA_SIZE, sizeof(*ring->buf),
  			       GFP_KERNEL);
-@@ -1641,8 +1643,10 @@ static int mtk_tx_alloc(struct mtk_eth *
+@@ -1642,8 +1644,10 @@ static int mtk_tx_alloc(struct mtk_eth *
  		int next = (i + 1) % MTK_DMA_SIZE;
  		u32 next_ptr = ring->phys + next * sz;
  
@@ -37,7 +37,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	}
  
  	/* On MT7688 (PDMA only) this driver uses the ring->dma structs
-@@ -1664,7 +1668,7 @@ static int mtk_tx_alloc(struct mtk_eth *
+@@ -1665,7 +1669,7 @@ static int mtk_tx_alloc(struct mtk_eth *
  	ring->dma_size = MTK_DMA_SIZE;
  	atomic_set(&ring->free_count, MTK_DMA_SIZE - 2);
  	ring->next_free = &ring->dma[0];
@@ -46,7 +46,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	ring->last_free_ptr = (u32)(ring->phys + ((MTK_DMA_SIZE - 1) * sz));
  	ring->thresh = MAX_SKB_FRAGS;
  
-@@ -1697,6 +1701,7 @@ no_tx_mem:
+@@ -1698,6 +1702,7 @@ no_tx_mem:
  
  static void mtk_tx_clean(struct mtk_eth *eth)
  {
@@ -54,7 +54,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	struct mtk_tx_ring *ring = &eth->tx_ring;
  	int i;
  
-@@ -1709,17 +1714,15 @@ static void mtk_tx_clean(struct mtk_eth
+@@ -1710,17 +1715,15 @@ static void mtk_tx_clean(struct mtk_eth
  
  	if (ring->dma) {
  		dma_free_coherent(eth->dma_dev,
diff --git a/target/linux/generic/backport-5.15/702-v5.19-21-net-ethernet-mtk_eth_soc-rely-on-txd_size-in-mtk_des.patch b/target/linux/generic/backport-5.15/702-v5.19-21-net-ethernet-mtk_eth_soc-rely-on-txd_size-in-mtk_des.patch
index 1d23a178b4be0a..053412e7490a7c 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-21-net-ethernet-mtk_eth_soc-rely-on-txd_size-in-mtk_des.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-21-net-ethernet-mtk_eth_soc-rely-on-txd_size-in-mtk_des.patch
@@ -12,7 +12,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -890,10 +890,11 @@ static inline void *mtk_qdma_phys_to_vir
+@@ -891,10 +891,11 @@ static inline void *mtk_qdma_phys_to_vir
  	return ret + (desc - ring->phys);
  }
  
@@ -27,7 +27,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	return &ring->buf[idx];
  }
-@@ -1015,6 +1016,7 @@ static int mtk_tx_map(struct sk_buff *sk
+@@ -1016,6 +1017,7 @@ static int mtk_tx_map(struct sk_buff *sk
  	};
  	struct mtk_mac *mac = netdev_priv(dev);
  	struct mtk_eth *eth = mac->hw;
@@ -35,7 +35,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	struct mtk_tx_dma *itxd, *txd;
  	struct mtk_tx_dma *itxd_pdma, *txd_pdma;
  	struct mtk_tx_buf *itx_buf, *tx_buf;
-@@ -1026,7 +1028,7 @@ static int mtk_tx_map(struct sk_buff *sk
+@@ -1027,7 +1029,7 @@ static int mtk_tx_map(struct sk_buff *sk
  	if (itxd == ring->last_free)
  		return -ENOMEM;
  
@@ -44,7 +44,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	memset(itx_buf, 0, sizeof(*itx_buf));
  
  	txd_info.addr = dma_map_single(eth->dma_dev, skb->data, txd_info.size,
-@@ -1054,7 +1056,7 @@ static int mtk_tx_map(struct sk_buff *sk
+@@ -1055,7 +1057,7 @@ static int mtk_tx_map(struct sk_buff *sk
  		while (frag_size) {
  			bool new_desc = true;
  
@@ -53,7 +53,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  			    (i & 0x1)) {
  				txd = mtk_qdma_phys_to_virt(ring, txd->txd2);
  				txd_pdma = qdma_to_pdma(ring, txd);
-@@ -1078,7 +1080,8 @@ static int mtk_tx_map(struct sk_buff *sk
+@@ -1079,7 +1081,8 @@ static int mtk_tx_map(struct sk_buff *sk
  
  			mtk_tx_set_dma_desc(dev, txd, &txd_info);
  
@@ -63,7 +63,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  			if (new_desc)
  				memset(tx_buf, 0, sizeof(*tx_buf));
  			tx_buf->skb = (struct sk_buff *)MTK_DMA_DUMMY_DESC;
-@@ -1097,7 +1100,7 @@ static int mtk_tx_map(struct sk_buff *sk
+@@ -1098,7 +1101,7 @@ static int mtk_tx_map(struct sk_buff *sk
  	/* store skb to cleanup */
  	itx_buf->skb = skb;
  
@@ -72,7 +72,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		if (k & 0x1)
  			txd_pdma->txd2 |= TX_DMA_LS0;
  		else
-@@ -1115,7 +1118,7 @@ static int mtk_tx_map(struct sk_buff *sk
+@@ -1116,7 +1119,7 @@ static int mtk_tx_map(struct sk_buff *sk
  	 */
  	wmb();
  
@@ -81,7 +81,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		if (netif_xmit_stopped(netdev_get_tx_queue(dev, 0)) ||
  		    !netdev_xmit_more())
  			mtk_w32(eth, txd->txd2, MTK_QTX_CTX_PTR);
-@@ -1129,13 +1132,13 @@ static int mtk_tx_map(struct sk_buff *sk
+@@ -1130,13 +1133,13 @@ static int mtk_tx_map(struct sk_buff *sk
  
  err_dma:
  	do {
@@ -97,7 +97,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  			itxd_pdma->txd2 = TX_DMA_DESP2_DEF;
  
  		itxd = mtk_qdma_phys_to_virt(ring, itxd->txd2);
-@@ -1449,7 +1452,8 @@ static int mtk_poll_tx_qdma(struct mtk_e
+@@ -1450,7 +1453,8 @@ static int mtk_poll_tx_qdma(struct mtk_e
  		if ((desc->txd3 & TX_DMA_OWNER_CPU) == 0)
  			break;
  
diff --git a/target/linux/generic/backport-5.15/702-v5.19-22-net-ethernet-mtk_eth_soc-rely-on-txd_size-in-txd_to_.patch b/target/linux/generic/backport-5.15/702-v5.19-22-net-ethernet-mtk_eth_soc-rely-on-txd_size-in-txd_to_.patch
index 2989d190d828ca..251d583f2966e9 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-22-net-ethernet-mtk_eth_soc-rely-on-txd_size-in-txd_to_.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-22-net-ethernet-mtk_eth_soc-rely-on-txd_size-in-txd_to_.patch
@@ -11,7 +11,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -905,9 +905,10 @@ static struct mtk_tx_dma *qdma_to_pdma(s
+@@ -906,9 +906,10 @@ static struct mtk_tx_dma *qdma_to_pdma(s
  	return ring->dma_pdma - ring->dma + dma;
  }
  
@@ -24,7 +24,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  }
  
  static void mtk_tx_unmap(struct mtk_eth *eth, struct mtk_tx_buf *tx_buf,
-@@ -1123,8 +1124,10 @@ static int mtk_tx_map(struct sk_buff *sk
+@@ -1124,8 +1125,10 @@ static int mtk_tx_map(struct sk_buff *sk
  		    !netdev_xmit_more())
  			mtk_w32(eth, txd->txd2, MTK_QTX_CTX_PTR);
  	} else {
diff --git a/target/linux/generic/backport-5.15/702-v5.19-23-net-ethernet-mtk_eth_soc-add-rxd_size-to-mtk_soc_dat.patch b/target/linux/generic/backport-5.15/702-v5.19-23-net-ethernet-mtk_eth_soc-add-rxd_size-to-mtk_soc_dat.patch
index be258da75a9e1a..ec206f28d64c5a 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-23-net-ethernet-mtk_eth_soc-add-rxd_size-to-mtk_soc_dat.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-23-net-ethernet-mtk_eth_soc-add-rxd_size-to-mtk_soc_dat.patch
@@ -13,7 +13,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -1775,7 +1775,7 @@ static int mtk_rx_alloc(struct mtk_eth *
+@@ -1776,7 +1776,7 @@ static int mtk_rx_alloc(struct mtk_eth *
  	}
  
  	ring->dma = dma_alloc_coherent(eth->dma_dev,
@@ -22,7 +22,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  				       &ring->phys, GFP_KERNEL);
  	if (!ring->dma)
  		return -ENOMEM;
-@@ -1833,9 +1833,8 @@ static void mtk_rx_clean(struct mtk_eth
+@@ -1834,9 +1834,8 @@ static void mtk_rx_clean(struct mtk_eth
  
  	if (ring->dma) {
  		dma_free_coherent(eth->dma_dev,
@@ -34,7 +34,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		ring->dma = NULL;
  	}
  }
-@@ -3403,6 +3402,7 @@ static const struct mtk_soc_data mt2701_
+@@ -3406,6 +3405,7 @@ static const struct mtk_soc_data mt2701_
  	.required_pctl = true,
  	.txrx = {
  		.txd_size = sizeof(struct mtk_tx_dma),
@@ -42,7 +42,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	},
  };
  
-@@ -3414,6 +3414,7 @@ static const struct mtk_soc_data mt7621_
+@@ -3417,6 +3417,7 @@ static const struct mtk_soc_data mt7621_
  	.offload_version = 2,
  	.txrx = {
  		.txd_size = sizeof(struct mtk_tx_dma),
@@ -50,7 +50,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	},
  };
  
-@@ -3426,6 +3427,7 @@ static const struct mtk_soc_data mt7622_
+@@ -3429,6 +3430,7 @@ static const struct mtk_soc_data mt7622_
  	.offload_version = 2,
  	.txrx = {
  		.txd_size = sizeof(struct mtk_tx_dma),
@@ -58,7 +58,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	},
  };
  
-@@ -3437,6 +3439,7 @@ static const struct mtk_soc_data mt7623_
+@@ -3440,6 +3442,7 @@ static const struct mtk_soc_data mt7623_
  	.offload_version = 2,
  	.txrx = {
  		.txd_size = sizeof(struct mtk_tx_dma),
@@ -66,7 +66,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	},
  };
  
-@@ -3448,6 +3451,7 @@ static const struct mtk_soc_data mt7629_
+@@ -3451,6 +3454,7 @@ static const struct mtk_soc_data mt7629_
  	.required_pctl = false,
  	.txrx = {
  		.txd_size = sizeof(struct mtk_tx_dma),
@@ -74,7 +74,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	},
  };
  
-@@ -3458,6 +3462,7 @@ static const struct mtk_soc_data rt5350_
+@@ -3461,6 +3465,7 @@ static const struct mtk_soc_data rt5350_
  	.required_pctl = false,
  	.txrx = {
  		.txd_size = sizeof(struct mtk_tx_dma),
@@ -84,7 +84,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -864,6 +864,7 @@ struct mtk_tx_dma_desc_info {
+@@ -865,6 +865,7 @@ struct mtk_tx_dma_desc_info {
   * @required_pctl		A bool value to show whether the SoC requires
   *				the extra setup for those pins used by GMAC.
   * @txd_size			Tx DMA descriptor size.
@@ -92,7 +92,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
   */
  struct mtk_soc_data {
  	u32             ana_rgc3;
-@@ -874,6 +875,7 @@ struct mtk_soc_data {
+@@ -875,6 +876,7 @@ struct mtk_soc_data {
  	netdev_features_t hw_features;
  	struct {
  		u32	txd_size;
diff --git a/target/linux/generic/backport-5.15/702-v5.19-24-net-ethernet-mtk_eth_soc-rely-on-txd_size-field-in-m.patch b/target/linux/generic/backport-5.15/702-v5.19-24-net-ethernet-mtk_eth_soc-rely-on-txd_size-field-in-m.patch
index 53af586b6c0fc9..eb92b8c7a22e8d 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-24-net-ethernet-mtk_eth_soc-rely-on-txd_size-field-in-m.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-24-net-ethernet-mtk_eth_soc-rely-on-txd_size-field-in-m.patch
@@ -12,7 +12,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -1264,9 +1264,12 @@ static struct mtk_rx_ring *mtk_get_rx_ri
+@@ -1265,9 +1265,12 @@ static struct mtk_rx_ring *mtk_get_rx_ri
  		return &eth->rx_ring[0];
  
  	for (i = 0; i < MTK_MAX_RX_RING_NUM; i++) {
@@ -26,7 +26,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  			ring->calc_idx_update = true;
  			return ring;
  		}
-@@ -1317,7 +1320,7 @@ static int mtk_poll_rx(struct napi_struc
+@@ -1318,7 +1321,7 @@ static int mtk_poll_rx(struct napi_struc
  			goto rx_done;
  
  		idx = NEXT_DESP_IDX(ring->calc_idx, ring->dma_size);
@@ -35,7 +35,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		data = ring->data[idx];
  
  		if (!mtk_rx_get_desc(&trxd, rxd))
-@@ -1509,7 +1512,7 @@ static int mtk_poll_tx_pdma(struct mtk_e
+@@ -1510,7 +1513,7 @@ static int mtk_poll_tx_pdma(struct mtk_e
  
  		mtk_tx_unmap(eth, tx_buf, true);
  
diff --git a/target/linux/generic/backport-5.15/702-v5.19-25-net-ethernet-mtk_eth_soc-rely-on-rxd_size-field-in-m.patch b/target/linux/generic/backport-5.15/702-v5.19-25-net-ethernet-mtk_eth_soc-rely-on-rxd_size-field-in-m.patch
index 1f4fa1dfb50e3b..456eec247c59a4 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-25-net-ethernet-mtk_eth_soc-rely-on-rxd_size-field-in-m.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-25-net-ethernet-mtk_eth_soc-rely-on-rxd_size-field-in-m.patch
@@ -14,7 +14,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -1784,18 +1784,25 @@ static int mtk_rx_alloc(struct mtk_eth *
+@@ -1785,18 +1785,25 @@ static int mtk_rx_alloc(struct mtk_eth *
  		return -ENOMEM;
  
  	for (i = 0; i < rx_dma_size; i++) {
@@ -43,7 +43,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	}
  	ring->dma_size = rx_dma_size;
  	ring->calc_idx_update = false;
-@@ -1820,14 +1827,17 @@ static void mtk_rx_clean(struct mtk_eth
+@@ -1821,14 +1828,17 @@ static void mtk_rx_clean(struct mtk_eth
  
  	if (ring->data && ring->dma) {
  		for (i = 0; i < ring->dma_size; i++) {
diff --git a/target/linux/generic/backport-5.15/702-v5.19-26-net-ethernet-mtk_eth_soc-introduce-device-register-m.patch b/target/linux/generic/backport-5.15/702-v5.19-26-net-ethernet-mtk_eth_soc-introduce-device-register-m.patch
index 99f482c418fce6..272f782877f788 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-26-net-ethernet-mtk_eth_soc-introduce-device-register-m.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-26-net-ethernet-mtk_eth_soc-introduce-device-register-m.patch
@@ -73,7 +73,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  /* strings used by ethtool */
  static const struct mtk_ethtool_stats {
  	char str[ETH_GSTRING_LEN];
-@@ -618,8 +671,8 @@ static inline void mtk_tx_irq_disable(st
+@@ -619,8 +672,8 @@ static inline void mtk_tx_irq_disable(st
  	u32 val;
  
  	spin_lock_irqsave(&eth->tx_irq_lock, flags);
@@ -84,7 +84,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	spin_unlock_irqrestore(&eth->tx_irq_lock, flags);
  }
  
-@@ -629,8 +682,8 @@ static inline void mtk_tx_irq_enable(str
+@@ -630,8 +683,8 @@ static inline void mtk_tx_irq_enable(str
  	u32 val;
  
  	spin_lock_irqsave(&eth->tx_irq_lock, flags);
@@ -95,7 +95,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	spin_unlock_irqrestore(&eth->tx_irq_lock, flags);
  }
  
-@@ -640,8 +693,8 @@ static inline void mtk_rx_irq_disable(st
+@@ -641,8 +694,8 @@ static inline void mtk_rx_irq_disable(st
  	u32 val;
  
  	spin_lock_irqsave(&eth->rx_irq_lock, flags);
@@ -106,7 +106,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	spin_unlock_irqrestore(&eth->rx_irq_lock, flags);
  }
  
-@@ -651,8 +704,8 @@ static inline void mtk_rx_irq_enable(str
+@@ -652,8 +705,8 @@ static inline void mtk_rx_irq_enable(str
  	u32 val;
  
  	spin_lock_irqsave(&eth->rx_irq_lock, flags);
@@ -117,7 +117,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	spin_unlock_irqrestore(&eth->rx_irq_lock, flags);
  }
  
-@@ -703,39 +756,39 @@ void mtk_stats_update_mac(struct mtk_mac
+@@ -704,39 +757,39 @@ void mtk_stats_update_mac(struct mtk_mac
  		hw_stats->rx_checksum_errors +=
  			mtk_r32(mac->hw, MT7628_SDM_CS_ERR);
  	} else {
@@ -172,7 +172,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	}
  
  	u64_stats_update_end(&hw_stats->syncp);
-@@ -875,10 +928,10 @@ static int mtk_init_fq_dma(struct mtk_et
+@@ -876,10 +929,10 @@ static int mtk_init_fq_dma(struct mtk_et
  		txd->txd4 = 0;
  	}
  
@@ -187,7 +187,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	return 0;
  }
-@@ -1122,7 +1175,7 @@ static int mtk_tx_map(struct sk_buff *sk
+@@ -1123,7 +1176,7 @@ static int mtk_tx_map(struct sk_buff *sk
  	if (MTK_HAS_CAPS(soc->caps, MTK_QDMA)) {
  		if (netif_xmit_stopped(netdev_get_tx_queue(dev, 0)) ||
  		    !netdev_xmit_more())
@@ -196,7 +196,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	} else {
  		int next_idx;
  
-@@ -1439,6 +1492,7 @@ rx_done:
+@@ -1440,6 +1493,7 @@ rx_done:
  static int mtk_poll_tx_qdma(struct mtk_eth *eth, int budget,
  			    unsigned int *done, unsigned int *bytes)
  {
@@ -204,7 +204,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	struct mtk_tx_ring *ring = &eth->tx_ring;
  	struct mtk_tx_dma *desc;
  	struct sk_buff *skb;
-@@ -1446,7 +1500,7 @@ static int mtk_poll_tx_qdma(struct mtk_e
+@@ -1447,7 +1501,7 @@ static int mtk_poll_tx_qdma(struct mtk_e
  	u32 cpu, dma;
  
  	cpu = ring->last_free_ptr;
@@ -213,7 +213,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	desc = mtk_qdma_phys_to_virt(ring, cpu);
  
-@@ -1481,7 +1535,7 @@ static int mtk_poll_tx_qdma(struct mtk_e
+@@ -1482,7 +1536,7 @@ static int mtk_poll_tx_qdma(struct mtk_e
  	}
  
  	ring->last_free_ptr = cpu;
@@ -222,7 +222,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	return budget;
  }
-@@ -1574,24 +1628,25 @@ static void mtk_handle_status_irq(struct
+@@ -1575,24 +1629,25 @@ static void mtk_handle_status_irq(struct
  static int mtk_napi_tx(struct napi_struct *napi, int budget)
  {
  	struct mtk_eth *eth = container_of(napi, struct mtk_eth, tx_napi);
@@ -252,7 +252,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		return budget;
  
  	if (napi_complete_done(napi, tx_done))
-@@ -1603,6 +1658,7 @@ static int mtk_napi_tx(struct napi_struc
+@@ -1604,6 +1659,7 @@ static int mtk_napi_tx(struct napi_struc
  static int mtk_napi_rx(struct napi_struct *napi, int budget)
  {
  	struct mtk_eth *eth = container_of(napi, struct mtk_eth, rx_napi);
@@ -260,7 +260,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	int rx_done_total = 0;
  
  	mtk_handle_status_irq(eth);
-@@ -1610,21 +1666,21 @@ static int mtk_napi_rx(struct napi_struc
+@@ -1611,21 +1667,21 @@ static int mtk_napi_rx(struct napi_struc
  	do {
  		int rx_done;
  
@@ -286,7 +286,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	if (napi_complete_done(napi, rx_done_total))
  		mtk_rx_irq_enable(eth, MTK_RX_DONE_INT);
-@@ -1687,20 +1743,20 @@ static int mtk_tx_alloc(struct mtk_eth *
+@@ -1688,20 +1744,20 @@ static int mtk_tx_alloc(struct mtk_eth *
  	 */
  	wmb();
  
@@ -314,7 +314,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	}
  
  	return 0;
-@@ -1739,6 +1795,7 @@ static void mtk_tx_clean(struct mtk_eth
+@@ -1740,6 +1796,7 @@ static void mtk_tx_clean(struct mtk_eth
  
  static int mtk_rx_alloc(struct mtk_eth *eth, int ring_no, int rx_flag)
  {
@@ -322,7 +322,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	struct mtk_rx_ring *ring;
  	int rx_data_len, rx_dma_size;
  	int i;
-@@ -1807,16 +1864,18 @@ static int mtk_rx_alloc(struct mtk_eth *
+@@ -1808,16 +1865,18 @@ static int mtk_rx_alloc(struct mtk_eth *
  	ring->dma_size = rx_dma_size;
  	ring->calc_idx_update = false;
  	ring->calc_idx = rx_dma_size - 1;
@@ -345,7 +345,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	return 0;
  }
-@@ -2125,9 +2184,9 @@ static int mtk_dma_busy_wait(struct mtk_
+@@ -2126,9 +2185,9 @@ static int mtk_dma_busy_wait(struct mtk_
  	u32 val;
  
  	if (MTK_HAS_CAPS(eth->soc->caps, MTK_QDMA))
@@ -357,7 +357,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	ret = readx_poll_timeout_atomic(__raw_readl, eth->base + reg, val,
  					!(val & (MTK_RX_DMA_BUSY | MTK_TX_DMA_BUSY)),
-@@ -2185,8 +2244,8 @@ static int mtk_dma_init(struct mtk_eth *
+@@ -2186,8 +2245,8 @@ static int mtk_dma_init(struct mtk_eth *
  		 * automatically
  		 */
  		mtk_w32(eth, FC_THRES_DROP_MODE | FC_THRES_DROP_EN |
@@ -368,7 +368,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	}
  
  	return 0;
-@@ -2260,13 +2319,14 @@ static irqreturn_t mtk_handle_irq_tx(int
+@@ -2261,13 +2320,14 @@ static irqreturn_t mtk_handle_irq_tx(int
  static irqreturn_t mtk_handle_irq(int irq, void *_eth)
  {
  	struct mtk_eth *eth = _eth;
@@ -387,7 +387,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  			mtk_handle_irq_tx(irq, _eth);
  	}
  
-@@ -2290,6 +2350,7 @@ static void mtk_poll_controller(struct n
+@@ -2291,6 +2351,7 @@ static void mtk_poll_controller(struct n
  static int mtk_start_dma(struct mtk_eth *eth)
  {
  	u32 rx_2b_offset = (NET_IP_ALIGN == 2) ? MTK_RX_2B_OFFSET : 0;
@@ -395,7 +395,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	int err;
  
  	err = mtk_dma_init(eth);
-@@ -2304,16 +2365,15 @@ static int mtk_start_dma(struct mtk_eth
+@@ -2305,16 +2366,15 @@ static int mtk_start_dma(struct mtk_eth
  			MTK_TX_BT_32DWORDS | MTK_NDP_CO_PRO |
  			MTK_RX_DMA_EN | MTK_RX_2B_OFFSET |
  			MTK_RX_BT_32DWORDS,
@@ -415,7 +415,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	}
  
  	return 0;
-@@ -2437,8 +2497,8 @@ static int mtk_stop(struct net_device *d
+@@ -2440,8 +2500,8 @@ static int mtk_stop(struct net_device *d
  	cancel_work_sync(&eth->tx_dim.work);
  
  	if (MTK_HAS_CAPS(eth->soc->caps, MTK_QDMA))
@@ -426,7 +426,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	mtk_dma_free(eth);
  
-@@ -2492,6 +2552,7 @@ static void mtk_dim_rx(struct work_struc
+@@ -2495,6 +2555,7 @@ static void mtk_dim_rx(struct work_struc
  {
  	struct dim *dim = container_of(work, struct dim, work);
  	struct mtk_eth *eth = container_of(dim, struct mtk_eth, rx_dim);
@@ -434,7 +434,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	struct dim_cq_moder cur_profile;
  	u32 val, cur;
  
-@@ -2499,7 +2560,7 @@ static void mtk_dim_rx(struct work_struc
+@@ -2502,7 +2563,7 @@ static void mtk_dim_rx(struct work_struc
  						dim->profile_ix);
  	spin_lock_bh(&eth->dim_lock);
  
@@ -443,7 +443,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	val &= MTK_PDMA_DELAY_TX_MASK;
  	val |= MTK_PDMA_DELAY_RX_EN;
  
-@@ -2509,9 +2570,9 @@ static void mtk_dim_rx(struct work_struc
+@@ -2512,9 +2573,9 @@ static void mtk_dim_rx(struct work_struc
  	cur = min_t(u32, cur_profile.pkts, MTK_PDMA_DELAY_PINT_MASK);
  	val |= cur << MTK_PDMA_DELAY_RX_PINT_SHIFT;
  
@@ -455,7 +455,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	spin_unlock_bh(&eth->dim_lock);
  
-@@ -2522,6 +2583,7 @@ static void mtk_dim_tx(struct work_struc
+@@ -2525,6 +2586,7 @@ static void mtk_dim_tx(struct work_struc
  {
  	struct dim *dim = container_of(work, struct dim, work);
  	struct mtk_eth *eth = container_of(dim, struct mtk_eth, tx_dim);
@@ -463,7 +463,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	struct dim_cq_moder cur_profile;
  	u32 val, cur;
  
-@@ -2529,7 +2591,7 @@ static void mtk_dim_tx(struct work_struc
+@@ -2532,7 +2594,7 @@ static void mtk_dim_tx(struct work_struc
  						dim->profile_ix);
  	spin_lock_bh(&eth->dim_lock);
  
@@ -472,7 +472,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	val &= MTK_PDMA_DELAY_RX_MASK;
  	val |= MTK_PDMA_DELAY_TX_EN;
  
-@@ -2539,9 +2601,9 @@ static void mtk_dim_tx(struct work_struc
+@@ -2542,9 +2604,9 @@ static void mtk_dim_tx(struct work_struc
  	cur = min_t(u32, cur_profile.pkts, MTK_PDMA_DELAY_PINT_MASK);
  	val |= cur << MTK_PDMA_DELAY_TX_PINT_SHIFT;
  
@@ -484,7 +484,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	spin_unlock_bh(&eth->dim_lock);
  
-@@ -2552,6 +2614,7 @@ static int mtk_hw_init(struct mtk_eth *e
+@@ -2555,6 +2617,7 @@ static int mtk_hw_init(struct mtk_eth *e
  {
  	u32 dma_mask = ETHSYS_DMA_AG_MAP_PDMA | ETHSYS_DMA_AG_MAP_QDMA |
  		       ETHSYS_DMA_AG_MAP_PPE;
@@ -492,7 +492,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	int i, val, ret;
  
  	if (test_and_set_bit(MTK_HW_INIT, &eth->state))
-@@ -2626,10 +2689,10 @@ static int mtk_hw_init(struct mtk_eth *e
+@@ -2629,10 +2692,10 @@ static int mtk_hw_init(struct mtk_eth *e
  	mtk_rx_irq_disable(eth, ~0);
  
  	/* FE int grouping */
@@ -507,7 +507,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	mtk_w32(eth, 0x21021000, MTK_FE_INT_GRP);
  
  	return 0;
-@@ -3168,14 +3231,6 @@ static int mtk_probe(struct platform_dev
+@@ -3171,14 +3234,6 @@ static int mtk_probe(struct platform_dev
  	if (IS_ERR(eth->base))
  		return PTR_ERR(eth->base);
  
@@ -522,7 +522,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	if (MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628)) {
  		eth->rx_dma_l4_valid = RX_DMA_L4_VALID_PDMA;
  		eth->ip_align = NET_IP_ALIGN;
-@@ -3409,6 +3464,7 @@ static int mtk_remove(struct platform_de
+@@ -3412,6 +3467,7 @@ static int mtk_remove(struct platform_de
  }
  
  static const struct mtk_soc_data mt2701_data = {
@@ -530,7 +530,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	.caps = MT7623_CAPS | MTK_HWLRO,
  	.hw_features = MTK_HW_FEATURES,
  	.required_clks = MT7623_CLKS_BITMAP,
-@@ -3420,6 +3476,7 @@ static const struct mtk_soc_data mt2701_
+@@ -3423,6 +3479,7 @@ static const struct mtk_soc_data mt2701_
  };
  
  static const struct mtk_soc_data mt7621_data = {
@@ -538,7 +538,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	.caps = MT7621_CAPS,
  	.hw_features = MTK_HW_FEATURES,
  	.required_clks = MT7621_CLKS_BITMAP,
-@@ -3432,6 +3489,7 @@ static const struct mtk_soc_data mt7621_
+@@ -3435,6 +3492,7 @@ static const struct mtk_soc_data mt7621_
  };
  
  static const struct mtk_soc_data mt7622_data = {
@@ -546,7 +546,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	.ana_rgc3 = 0x2028,
  	.caps = MT7622_CAPS | MTK_HWLRO,
  	.hw_features = MTK_HW_FEATURES,
-@@ -3445,6 +3503,7 @@ static const struct mtk_soc_data mt7622_
+@@ -3448,6 +3506,7 @@ static const struct mtk_soc_data mt7622_
  };
  
  static const struct mtk_soc_data mt7623_data = {
@@ -554,7 +554,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	.caps = MT7623_CAPS | MTK_HWLRO,
  	.hw_features = MTK_HW_FEATURES,
  	.required_clks = MT7623_CLKS_BITMAP,
-@@ -3457,6 +3516,7 @@ static const struct mtk_soc_data mt7623_
+@@ -3460,6 +3519,7 @@ static const struct mtk_soc_data mt7623_
  };
  
  static const struct mtk_soc_data mt7629_data = {
@@ -562,7 +562,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	.ana_rgc3 = 0x128,
  	.caps = MT7629_CAPS | MTK_HWLRO,
  	.hw_features = MTK_HW_FEATURES,
-@@ -3469,6 +3529,7 @@ static const struct mtk_soc_data mt7629_
+@@ -3472,6 +3532,7 @@ static const struct mtk_soc_data mt7629_
  };
  
  static const struct mtk_soc_data rt5350_data = {
@@ -748,7 +748,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  #define MTK_STAT_OFFSET		0x40
  
  #define MTK_WDMA0_BASE		0x2800
-@@ -853,8 +762,46 @@ struct mtk_tx_dma_desc_info {
+@@ -854,8 +763,46 @@ struct mtk_tx_dma_desc_info {
  	u8		last:1;
  };
  
@@ -795,7 +795,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
   * @ana_rgc3:                   The offset for register ANA_RGC3 related to
   *				sgmiisys syscon
   * @caps			Flags shown the extra capability for the SoC
-@@ -867,6 +814,7 @@ struct mtk_tx_dma_desc_info {
+@@ -868,6 +815,7 @@ struct mtk_tx_dma_desc_info {
   * @rxd_size			Rx DMA descriptor size.
   */
  struct mtk_soc_data {
@@ -803,7 +803,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	u32             ana_rgc3;
  	u32		caps;
  	u32		required_clks;
-@@ -994,8 +942,6 @@ struct mtk_eth {
+@@ -995,8 +943,6 @@ struct mtk_eth {
  	u32				tx_bytes;
  	struct dim			tx_dim;
  
diff --git a/target/linux/generic/backport-5.15/702-v5.19-27-net-ethernet-mtk_eth_soc-introduce-MTK_NETSYS_V2-sup.patch b/target/linux/generic/backport-5.15/702-v5.19-27-net-ethernet-mtk_eth_soc-introduce-MTK_NETSYS_V2-sup.patch
index e15854ecad14bf..4d6c94b13b8e80 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-27-net-ethernet-mtk_eth_soc-introduce-MTK_NETSYS_V2-sup.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-27-net-ethernet-mtk_eth_soc-introduce-MTK_NETSYS_V2-sup.patch
@@ -13,7 +13,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -862,8 +862,8 @@ static inline int mtk_max_buf_size(int f
+@@ -863,8 +863,8 @@ static inline int mtk_max_buf_size(int f
  	return buf_size;
  }
  
@@ -24,7 +24,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  {
  	rxd->rxd2 = READ_ONCE(dma_rxd->rxd2);
  	if (!(rxd->rxd2 & RX_DMA_DONE))
-@@ -872,6 +872,10 @@ static inline bool mtk_rx_get_desc(struc
+@@ -873,6 +873,10 @@ static inline bool mtk_rx_get_desc(struc
  	rxd->rxd1 = READ_ONCE(dma_rxd->rxd1);
  	rxd->rxd3 = READ_ONCE(dma_rxd->rxd3);
  	rxd->rxd4 = READ_ONCE(dma_rxd->rxd4);
@@ -35,7 +35,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	return true;
  }
-@@ -916,7 +920,7 @@ static int mtk_init_fq_dma(struct mtk_et
+@@ -917,7 +921,7 @@ static int mtk_init_fq_dma(struct mtk_et
  	phy_ring_tail = eth->phy_scratch_ring + soc->txrx.txd_size * (cnt - 1);
  
  	for (i = 0; i < cnt; i++) {
@@ -44,7 +44,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  		txd = (void *)eth->scratch_ring + i * soc->txrx.txd_size;
  		txd->txd1 = dma_addr + i * MTK_QDMA_PAGE_SIZE;
-@@ -926,6 +930,12 @@ static int mtk_init_fq_dma(struct mtk_et
+@@ -927,6 +931,12 @@ static int mtk_init_fq_dma(struct mtk_et
  
  		txd->txd3 = TX_DMA_PLEN0(MTK_QDMA_PAGE_SIZE);
  		txd->txd4 = 0;
@@ -57,7 +57,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	}
  
  	mtk_w32(eth, eth->phy_scratch_ring, soc->reg_map->qdma.fq_head);
-@@ -1029,10 +1039,12 @@ static void setup_tx_buf(struct mtk_eth
+@@ -1030,10 +1040,12 @@ static void setup_tx_buf(struct mtk_eth
  	}
  }
  
@@ -72,7 +72,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	u32 data;
  
  	WRITE_ONCE(desc->txd1, info->addr);
-@@ -1056,6 +1068,59 @@ static void mtk_tx_set_dma_desc(struct n
+@@ -1057,6 +1069,59 @@ static void mtk_tx_set_dma_desc(struct n
  	WRITE_ONCE(desc->txd4, data);
  }
  
@@ -132,7 +132,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
  		      int tx_num, struct mtk_tx_ring *ring, bool gso)
  {
-@@ -1064,6 +1129,7 @@ static int mtk_tx_map(struct sk_buff *sk
+@@ -1065,6 +1130,7 @@ static int mtk_tx_map(struct sk_buff *sk
  		.gso = gso,
  		.csum = skb->ip_summed == CHECKSUM_PARTIAL,
  		.vlan = skb_vlan_tag_present(skb),
@@ -140,7 +140,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		.vlan_tci = skb_vlan_tag_get(skb),
  		.first = true,
  		.last = !skb_is_nonlinear(skb),
-@@ -1123,7 +1189,9 @@ static int mtk_tx_map(struct sk_buff *sk
+@@ -1124,7 +1190,9 @@ static int mtk_tx_map(struct sk_buff *sk
  			}
  
  			memset(&txd_info, 0, sizeof(struct mtk_tx_dma_desc_info));
@@ -151,7 +151,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  			txd_info.last = i == skb_shinfo(skb)->nr_frags - 1 &&
  					!(frag_size - txd_info.size);
  			txd_info.addr = skb_frag_dma_map(eth->dma_dev, frag,
-@@ -1204,17 +1272,16 @@ err_dma:
+@@ -1205,17 +1273,16 @@ err_dma:
  	return -ENOMEM;
  }
  
@@ -172,7 +172,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		}
  	} else {
  		nfrags += skb_shinfo(skb)->nr_frags;
-@@ -1266,7 +1333,7 @@ static netdev_tx_t mtk_start_xmit(struct
+@@ -1267,7 +1334,7 @@ static netdev_tx_t mtk_start_xmit(struct
  	if (unlikely(test_bit(MTK_RESETTING, &eth->state)))
  		goto drop;
  
@@ -181,7 +181,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	if (unlikely(atomic_read(&ring->free_count) <= tx_num)) {
  		netif_stop_queue(dev);
  		netif_err(eth, tx_queued, dev,
-@@ -1358,7 +1425,7 @@ static int mtk_poll_rx(struct napi_struc
+@@ -1359,7 +1426,7 @@ static int mtk_poll_rx(struct napi_struc
  	int idx;
  	struct sk_buff *skb;
  	u8 *data, *new_data;
@@ -190,7 +190,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	int done = 0, bytes = 0;
  
  	while (done < budget) {
-@@ -1366,7 +1433,7 @@ static int mtk_poll_rx(struct napi_struc
+@@ -1367,7 +1434,7 @@ static int mtk_poll_rx(struct napi_struc
  		unsigned int pktlen;
  		dma_addr_t dma_addr;
  		u32 hash, reason;
@@ -199,7 +199,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  		ring = mtk_get_rx_ring(eth);
  		if (unlikely(!ring))
-@@ -1376,16 +1443,15 @@ static int mtk_poll_rx(struct napi_struc
+@@ -1377,16 +1444,15 @@ static int mtk_poll_rx(struct napi_struc
  		rxd = (void *)ring->dma + idx * eth->soc->txrx.rxd_size;
  		data = ring->data[idx];
  
@@ -222,7 +222,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  		if (unlikely(mac < 0 || mac >= MTK_MAC_COUNT ||
  			     !eth->netdev[mac]))
-@@ -1431,7 +1497,7 @@ static int mtk_poll_rx(struct napi_struc
+@@ -1432,7 +1498,7 @@ static int mtk_poll_rx(struct napi_struc
  		pktlen = RX_DMA_GET_PLEN0(trxd.rxd2);
  		skb->dev = netdev;
  		skb_put(skb, pktlen);
@@ -231,7 +231,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  			skb->ip_summed = CHECKSUM_UNNECESSARY;
  		else
  			skb_checksum_none_assert(skb);
-@@ -1449,10 +1515,25 @@ static int mtk_poll_rx(struct napi_struc
+@@ -1450,10 +1516,25 @@ static int mtk_poll_rx(struct napi_struc
  			mtk_ppe_check_skb(eth->ppe, skb,
  					  trxd.rxd4 & MTK_RXD4_FOE_ENTRY);
  
@@ -261,7 +261,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		skb_record_rx_queue(skb, 0);
  		napi_gro_receive(napi, skb);
  
-@@ -1464,7 +1545,7 @@ release_desc:
+@@ -1465,7 +1546,7 @@ release_desc:
  		if (MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628))
  			rxd->rxd2 = RX_DMA_LSO;
  		else
@@ -270,7 +270,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  		ring->calc_idx = idx;
  
-@@ -1666,7 +1747,8 @@ static int mtk_napi_rx(struct napi_struc
+@@ -1667,7 +1748,8 @@ static int mtk_napi_rx(struct napi_struc
  	do {
  		int rx_done;
  
@@ -280,7 +280,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		rx_done = mtk_poll_rx(napi, budget - rx_done_total, eth);
  		rx_done_total += rx_done;
  
-@@ -1680,10 +1762,11 @@ static int mtk_napi_rx(struct napi_struc
+@@ -1681,10 +1763,11 @@ static int mtk_napi_rx(struct napi_struc
  		if (rx_done_total == budget)
  			return budget;
  
@@ -294,7 +294,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	return rx_done_total;
  }
-@@ -1693,7 +1776,7 @@ static int mtk_tx_alloc(struct mtk_eth *
+@@ -1694,7 +1777,7 @@ static int mtk_tx_alloc(struct mtk_eth *
  	const struct mtk_soc_data *soc = eth->soc;
  	struct mtk_tx_ring *ring = &eth->tx_ring;
  	int i, sz = soc->txrx.txd_size;
@@ -303,7 +303,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	ring->buf = kcalloc(MTK_DMA_SIZE, sizeof(*ring->buf),
  			       GFP_KERNEL);
-@@ -1713,13 +1796,19 @@ static int mtk_tx_alloc(struct mtk_eth *
+@@ -1714,13 +1797,19 @@ static int mtk_tx_alloc(struct mtk_eth *
  		txd->txd2 = next_ptr;
  		txd->txd3 = TX_DMA_LS0 | TX_DMA_OWNER_CPU;
  		txd->txd4 = 0;
@@ -324,7 +324,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		ring->dma_pdma = dma_alloc_coherent(eth->dma_dev, MTK_DMA_SIZE * sz,
  						    &ring->phys_pdma, GFP_KERNEL);
  		if (!ring->dma_pdma)
-@@ -1799,13 +1888,11 @@ static int mtk_rx_alloc(struct mtk_eth *
+@@ -1800,13 +1889,11 @@ static int mtk_rx_alloc(struct mtk_eth *
  	struct mtk_rx_ring *ring;
  	int rx_data_len, rx_dma_size;
  	int i;
@@ -338,7 +338,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	} else {
  		ring = &eth->rx_ring[ring_no];
  	}
-@@ -1841,7 +1928,7 @@ static int mtk_rx_alloc(struct mtk_eth *
+@@ -1842,7 +1929,7 @@ static int mtk_rx_alloc(struct mtk_eth *
  		return -ENOMEM;
  
  	for (i = 0; i < rx_dma_size; i++) {
@@ -347,7 +347,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  		dma_addr_t dma_addr = dma_map_single(eth->dma_dev,
  				ring->data[i] + NET_SKB_PAD + eth->ip_align,
-@@ -1856,26 +1943,47 @@ static int mtk_rx_alloc(struct mtk_eth *
+@@ -1857,26 +1944,47 @@ static int mtk_rx_alloc(struct mtk_eth *
  		if (MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628))
  			rxd->rxd2 = RX_DMA_LSO;
  		else
@@ -403,7 +403,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	return 0;
  }
-@@ -2297,7 +2405,7 @@ static irqreturn_t mtk_handle_irq_rx(int
+@@ -2298,7 +2406,7 @@ static irqreturn_t mtk_handle_irq_rx(int
  	eth->rx_events++;
  	if (likely(napi_schedule_prep(&eth->rx_napi))) {
  		__napi_schedule(&eth->rx_napi);
@@ -412,7 +412,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	}
  
  	return IRQ_HANDLED;
-@@ -2321,8 +2429,10 @@ static irqreturn_t mtk_handle_irq(int ir
+@@ -2322,8 +2430,10 @@ static irqreturn_t mtk_handle_irq(int ir
  	struct mtk_eth *eth = _eth;
  	const struct mtk_reg_map *reg_map = eth->soc->reg_map;
  
@@ -425,7 +425,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  			mtk_handle_irq_rx(irq, _eth);
  	}
  	if (mtk_r32(eth, reg_map->tx_irq_mask) & MTK_TX_DONE_INT) {
-@@ -2340,16 +2450,16 @@ static void mtk_poll_controller(struct n
+@@ -2341,16 +2451,16 @@ static void mtk_poll_controller(struct n
  	struct mtk_eth *eth = mac->hw;
  
  	mtk_tx_irq_disable(eth, MTK_TX_DONE_INT);
@@ -445,7 +445,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	const struct mtk_reg_map *reg_map = eth->soc->reg_map;
  	int err;
  
-@@ -2360,12 +2470,19 @@ static int mtk_start_dma(struct mtk_eth
+@@ -2361,12 +2471,19 @@ static int mtk_start_dma(struct mtk_eth
  	}
  
  	if (MTK_HAS_CAPS(eth->soc->caps, MTK_QDMA)) {
@@ -471,7 +471,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		mtk_w32(eth,
  			MTK_RX_DMA_EN | rx_2b_offset |
  			MTK_RX_BT_32DWORDS | MTK_MULTI_EN,
-@@ -2437,7 +2554,7 @@ static int mtk_open(struct net_device *d
+@@ -2440,7 +2557,7 @@ static int mtk_open(struct net_device *d
  		napi_enable(&eth->tx_napi);
  		napi_enable(&eth->rx_napi);
  		mtk_tx_irq_enable(eth, MTK_TX_DONE_INT);
@@ -480,7 +480,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		refcount_set(&eth->dma_refcnt, 1);
  	}
  	else
-@@ -2489,7 +2606,7 @@ static int mtk_stop(struct net_device *d
+@@ -2492,7 +2609,7 @@ static int mtk_stop(struct net_device *d
  	mtk_gdm_config(eth, MTK_GDMA_DROP_ALL);
  
  	mtk_tx_irq_disable(eth, MTK_TX_DONE_INT);
@@ -489,7 +489,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	napi_disable(&eth->tx_napi);
  	napi_disable(&eth->rx_napi);
  
-@@ -2649,9 +2766,25 @@ static int mtk_hw_init(struct mtk_eth *e
+@@ -2652,9 +2769,25 @@ static int mtk_hw_init(struct mtk_eth *e
  		return 0;
  	}
  
@@ -518,7 +518,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	if (eth->pctl) {
  		/* Set GE2 driving and slew rate */
-@@ -2690,11 +2823,47 @@ static int mtk_hw_init(struct mtk_eth *e
+@@ -2693,11 +2826,47 @@ static int mtk_hw_init(struct mtk_eth *e
  
  	/* FE int grouping */
  	mtk_w32(eth, MTK_TX_DONE_INT, reg_map->pdma.int_grp);
@@ -568,7 +568,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	return 0;
  
  err_disable_pm:
-@@ -3231,12 +3400,8 @@ static int mtk_probe(struct platform_dev
+@@ -3234,12 +3403,8 @@ static int mtk_probe(struct platform_dev
  	if (IS_ERR(eth->base))
  		return PTR_ERR(eth->base);
  
@@ -582,7 +582,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	spin_lock_init(&eth->page_lock);
  	spin_lock_init(&eth->tx_irq_lock);
-@@ -3472,6 +3637,10 @@ static const struct mtk_soc_data mt2701_
+@@ -3475,6 +3640,10 @@ static const struct mtk_soc_data mt2701_
  	.txrx = {
  		.txd_size = sizeof(struct mtk_tx_dma),
  		.rxd_size = sizeof(struct mtk_rx_dma),
@@ -593,7 +593,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	},
  };
  
-@@ -3485,6 +3654,10 @@ static const struct mtk_soc_data mt7621_
+@@ -3488,6 +3657,10 @@ static const struct mtk_soc_data mt7621_
  	.txrx = {
  		.txd_size = sizeof(struct mtk_tx_dma),
  		.rxd_size = sizeof(struct mtk_rx_dma),
@@ -604,7 +604,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	},
  };
  
-@@ -3499,6 +3672,10 @@ static const struct mtk_soc_data mt7622_
+@@ -3502,6 +3675,10 @@ static const struct mtk_soc_data mt7622_
  	.txrx = {
  		.txd_size = sizeof(struct mtk_tx_dma),
  		.rxd_size = sizeof(struct mtk_rx_dma),
@@ -615,7 +615,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	},
  };
  
-@@ -3512,6 +3689,10 @@ static const struct mtk_soc_data mt7623_
+@@ -3515,6 +3692,10 @@ static const struct mtk_soc_data mt7623_
  	.txrx = {
  		.txd_size = sizeof(struct mtk_tx_dma),
  		.rxd_size = sizeof(struct mtk_rx_dma),
@@ -626,7 +626,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	},
  };
  
-@@ -3525,6 +3706,10 @@ static const struct mtk_soc_data mt7629_
+@@ -3528,6 +3709,10 @@ static const struct mtk_soc_data mt7629_
  	.txrx = {
  		.txd_size = sizeof(struct mtk_tx_dma),
  		.rxd_size = sizeof(struct mtk_rx_dma),
@@ -637,7 +637,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	},
  };
  
-@@ -3537,6 +3722,10 @@ static const struct mtk_soc_data rt5350_
+@@ -3540,6 +3725,10 @@ static const struct mtk_soc_data rt5350_
  	.txrx = {
  		.txd_size = sizeof(struct mtk_tx_dma),
  		.rxd_size = sizeof(struct mtk_rx_dma),
@@ -804,7 +804,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  /* PHY Indirect Access Control registers */
  #define MTK_PHY_IAC		0x10004
  #define PHY_IAC_ACCESS		BIT(31)
-@@ -370,6 +434,16 @@
+@@ -371,6 +435,16 @@
  #define ETHSYS_TRGMII_MT7621_DDR_PLL	BIT(5)
  
  /* ethernet reset control register */
@@ -821,7 +821,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  #define ETHSYS_RSTCTRL		0x34
  #define RSTCTRL_FE		BIT(6)
  #define RSTCTRL_PPE		BIT(31)
-@@ -453,6 +527,17 @@ struct mtk_rx_dma {
+@@ -454,6 +528,17 @@ struct mtk_rx_dma {
  	unsigned int rxd4;
  } __packed __aligned(4);
  
@@ -839,7 +839,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  struct mtk_tx_dma {
  	unsigned int txd1;
  	unsigned int txd2;
-@@ -460,6 +545,17 @@ struct mtk_tx_dma {
+@@ -461,6 +546,17 @@ struct mtk_tx_dma {
  	unsigned int txd4;
  } __packed __aligned(4);
  
@@ -857,7 +857,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  struct mtk_eth;
  struct mtk_mac;
  
-@@ -646,7 +742,9 @@ enum mkt_eth_capabilities {
+@@ -647,7 +743,9 @@ enum mkt_eth_capabilities {
  	MTK_SHARED_INT_BIT,
  	MTK_TRGMII_MT7621_CLK_BIT,
  	MTK_QDMA_BIT,
@@ -867,7 +867,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	/* MUX BITS*/
  	MTK_ETH_MUX_GDM1_TO_GMAC1_ESW_BIT,
-@@ -678,7 +776,9 @@ enum mkt_eth_capabilities {
+@@ -679,7 +777,9 @@ enum mkt_eth_capabilities {
  #define MTK_SHARED_INT		BIT(MTK_SHARED_INT_BIT)
  #define MTK_TRGMII_MT7621_CLK	BIT(MTK_TRGMII_MT7621_CLK_BIT)
  #define MTK_QDMA		BIT(MTK_QDMA_BIT)
@@ -877,7 +877,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  #define MTK_ETH_MUX_GDM1_TO_GMAC1_ESW		\
  	BIT(MTK_ETH_MUX_GDM1_TO_GMAC1_ESW_BIT)
-@@ -755,6 +855,7 @@ struct mtk_tx_dma_desc_info {
+@@ -756,6 +856,7 @@ struct mtk_tx_dma_desc_info {
  	dma_addr_t	addr;
  	u32		size;
  	u16		vlan_tci;
@@ -885,7 +885,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	u8		gso:1;
  	u8		csum:1;
  	u8		vlan:1;
-@@ -812,6 +913,10 @@ struct mtk_reg_map {
+@@ -813,6 +914,10 @@ struct mtk_reg_map {
   *				the extra setup for those pins used by GMAC.
   * @txd_size			Tx DMA descriptor size.
   * @rxd_size			Rx DMA descriptor size.
@@ -896,7 +896,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
   */
  struct mtk_soc_data {
  	const struct mtk_reg_map *reg_map;
-@@ -824,6 +929,10 @@ struct mtk_soc_data {
+@@ -825,6 +930,10 @@ struct mtk_soc_data {
  	struct {
  		u32	txd_size;
  		u32	rxd_size;
@@ -907,7 +907,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	} txrx;
  };
  
-@@ -942,7 +1051,6 @@ struct mtk_eth {
+@@ -943,7 +1052,6 @@ struct mtk_eth {
  	u32				tx_bytes;
  	struct dim			tx_dim;
  
diff --git a/target/linux/generic/backport-5.15/702-v5.19-28-net-ethernet-mtk_eth_soc-convert-ring-dma-pointer-to.patch b/target/linux/generic/backport-5.15/702-v5.19-28-net-ethernet-mtk_eth_soc-convert-ring-dma-pointer-to.patch
index a95663923914fe..1ecb5e71b3a700 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-28-net-ethernet-mtk_eth_soc-convert-ring-dma-pointer-to.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-28-net-ethernet-mtk_eth_soc-convert-ring-dma-pointer-to.patch
@@ -10,7 +10,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -946,18 +946,15 @@ static int mtk_init_fq_dma(struct mtk_et
+@@ -947,18 +947,15 @@ static int mtk_init_fq_dma(struct mtk_et
  	return 0;
  }
  
@@ -33,7 +33,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	return &ring->buf[idx];
  }
-@@ -965,13 +962,12 @@ static struct mtk_tx_buf *mtk_desc_to_tx
+@@ -966,13 +963,12 @@ static struct mtk_tx_buf *mtk_desc_to_tx
  static struct mtk_tx_dma *qdma_to_pdma(struct mtk_tx_ring *ring,
  				       struct mtk_tx_dma *dma)
  {
@@ -50,7 +50,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  }
  
  static void mtk_tx_unmap(struct mtk_eth *eth, struct mtk_tx_buf *tx_buf,
-@@ -1388,7 +1384,7 @@ static struct mtk_rx_ring *mtk_get_rx_ri
+@@ -1389,7 +1385,7 @@ static struct mtk_rx_ring *mtk_get_rx_ri
  
  		ring = &eth->rx_ring[i];
  		idx = NEXT_DESP_IDX(ring->calc_idx, ring->dma_size);
@@ -59,7 +59,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		if (rxd->rxd2 & RX_DMA_DONE) {
  			ring->calc_idx_update = true;
  			return ring;
-@@ -1440,7 +1436,7 @@ static int mtk_poll_rx(struct napi_struc
+@@ -1441,7 +1437,7 @@ static int mtk_poll_rx(struct napi_struc
  			goto rx_done;
  
  		idx = NEXT_DESP_IDX(ring->calc_idx, ring->dma_size);
@@ -68,7 +68,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		data = ring->data[idx];
  
  		if (!mtk_rx_get_desc(eth, &trxd, rxd))
-@@ -1647,7 +1643,7 @@ static int mtk_poll_tx_pdma(struct mtk_e
+@@ -1648,7 +1644,7 @@ static int mtk_poll_tx_pdma(struct mtk_e
  
  		mtk_tx_unmap(eth, tx_buf, true);
  
@@ -77,7 +77,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		ring->last_free = desc;
  		atomic_inc(&ring->free_count);
  
-@@ -1792,7 +1788,7 @@ static int mtk_tx_alloc(struct mtk_eth *
+@@ -1793,7 +1789,7 @@ static int mtk_tx_alloc(struct mtk_eth *
  		int next = (i + 1) % MTK_DMA_SIZE;
  		u32 next_ptr = ring->phys + next * sz;
  
@@ -86,7 +86,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		txd->txd2 = next_ptr;
  		txd->txd3 = TX_DMA_LS0 | TX_DMA_OWNER_CPU;
  		txd->txd4 = 0;
-@@ -1822,7 +1818,7 @@ static int mtk_tx_alloc(struct mtk_eth *
+@@ -1823,7 +1819,7 @@ static int mtk_tx_alloc(struct mtk_eth *
  
  	ring->dma_size = MTK_DMA_SIZE;
  	atomic_set(&ring->free_count, MTK_DMA_SIZE - 2);
@@ -95,7 +95,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	ring->last_free = (void *)txd;
  	ring->last_free_ptr = (u32)(ring->phys + ((MTK_DMA_SIZE - 1) * sz));
  	ring->thresh = MAX_SKB_FRAGS;
-@@ -1937,7 +1933,7 @@ static int mtk_rx_alloc(struct mtk_eth *
+@@ -1938,7 +1934,7 @@ static int mtk_rx_alloc(struct mtk_eth *
  		if (unlikely(dma_mapping_error(eth->dma_dev, dma_addr)))
  			return -ENOMEM;
  
@@ -104,7 +104,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		rxd->rxd1 = (unsigned int)dma_addr;
  
  		if (MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628))
-@@ -1999,7 +1995,7 @@ static void mtk_rx_clean(struct mtk_eth
+@@ -2000,7 +1996,7 @@ static void mtk_rx_clean(struct mtk_eth
  			if (!ring->data[i])
  				continue;
  
@@ -115,7 +115,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -688,7 +688,7 @@ struct mtk_tx_buf {
+@@ -689,7 +689,7 @@ struct mtk_tx_buf {
   *			are present
   */
  struct mtk_tx_ring {
@@ -124,7 +124,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	struct mtk_tx_buf *buf;
  	dma_addr_t phys;
  	struct mtk_tx_dma *next_free;
-@@ -718,7 +718,7 @@ enum mtk_rx_flags {
+@@ -719,7 +719,7 @@ enum mtk_rx_flags {
   * @calc_idx:		The current head of ring
   */
  struct mtk_rx_ring {
diff --git a/target/linux/generic/backport-5.15/702-v5.19-29-net-ethernet-mtk_eth_soc-convert-scratch_ring-pointe.patch b/target/linux/generic/backport-5.15/702-v5.19-29-net-ethernet-mtk_eth_soc-convert-scratch_ring-pointe.patch
index 459ffd540673dd..f7318e68bbdd17 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-29-net-ethernet-mtk_eth_soc-convert-scratch_ring-pointe.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-29-net-ethernet-mtk_eth_soc-convert-scratch_ring-pointe.patch
@@ -11,7 +11,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -922,7 +922,7 @@ static int mtk_init_fq_dma(struct mtk_et
+@@ -923,7 +923,7 @@ static int mtk_init_fq_dma(struct mtk_et
  	for (i = 0; i < cnt; i++) {
  		struct mtk_tx_dma_v2 *txd;
  
@@ -22,7 +22,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  			txd->txd2 = eth->phy_scratch_ring +
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -1028,7 +1028,7 @@ struct mtk_eth {
+@@ -1029,7 +1029,7 @@ struct mtk_eth {
  	struct mtk_rx_ring		rx_ring_qdma;
  	struct napi_struct		tx_napi;
  	struct napi_struct		rx_napi;
diff --git a/target/linux/generic/backport-5.15/702-v5.19-30-net-ethernet-mtk_eth_soc-introduce-support-for-mt798.patch b/target/linux/generic/backport-5.15/702-v5.19-30-net-ethernet-mtk_eth_soc-introduce-support-for-mt798.patch
index 4baeb2244f086e..a4698d7814d971 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-30-net-ethernet-mtk_eth_soc-introduce-support-for-mt798.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-30-net-ethernet-mtk_eth_soc-introduce-support-for-mt798.patch
@@ -65,7 +65,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  };
  
  void mtk_w32(struct mtk_eth *eth, u32 val, unsigned reg)
-@@ -3709,6 +3746,21 @@ static const struct mtk_soc_data mt7629_
+@@ -3712,6 +3749,21 @@ static const struct mtk_soc_data mt7629_
  	},
  };
  
@@ -87,7 +87,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static const struct mtk_soc_data rt5350_data = {
  	.reg_map = &mt7628_reg_map,
  	.caps = MT7628_CAPS,
-@@ -3731,6 +3783,7 @@ const struct of_device_id of_mtk_match[]
+@@ -3734,6 +3786,7 @@ const struct of_device_id of_mtk_match[]
  	{ .compatible = "mediatek,mt7622-eth", .data = &mt7622_data},
  	{ .compatible = "mediatek,mt7623-eth", .data = &mt7623_data},
  	{ .compatible = "mediatek,mt7629-eth", .data = &mt7629_data},
@@ -97,7 +97,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  };
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -623,6 +623,10 @@ enum mtk_clks_map {
+@@ -624,6 +624,10 @@ enum mtk_clks_map {
  	MTK_CLK_SGMII2_CDR_FB,
  	MTK_CLK_SGMII_CK,
  	MTK_CLK_ETH2PLL,
@@ -108,7 +108,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	MTK_CLK_MAX
  };
  
-@@ -653,6 +657,16 @@ enum mtk_clks_map {
+@@ -654,6 +658,16 @@ enum mtk_clks_map {
  				 BIT(MTK_CLK_SGMII2_CDR_FB) | \
  				 BIT(MTK_CLK_SGMII_CK) | \
  				 BIT(MTK_CLK_ETH2PLL) | BIT(MTK_CLK_SGMIITOP))
@@ -125,7 +125,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  enum mtk_dev_state {
  	MTK_HW_INIT,
-@@ -851,6 +865,10 @@ enum mkt_eth_capabilities {
+@@ -852,6 +866,10 @@ enum mkt_eth_capabilities {
  		      MTK_MUX_U3_GMAC2_TO_QPHY | \
  		      MTK_MUX_GMAC12_TO_GEPHY_SGMII | MTK_QDMA)
  
diff --git a/target/linux/generic/backport-5.15/702-v5.19-33-net-ethernet-mtk_eth_soc-enable-rx-cksum-offload-for.patch b/target/linux/generic/backport-5.15/702-v5.19-33-net-ethernet-mtk_eth_soc-enable-rx-cksum-offload-for.patch
index 2e3ad698b55d46..d76df75dda8e71 100644
--- a/target/linux/generic/backport-5.15/702-v5.19-33-net-ethernet-mtk_eth_soc-enable-rx-cksum-offload-for.patch
+++ b/target/linux/generic/backport-5.15/702-v5.19-33-net-ethernet-mtk_eth_soc-enable-rx-cksum-offload-for.patch
@@ -12,7 +12,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -1462,8 +1462,8 @@ static int mtk_poll_rx(struct napi_struc
+@@ -1463,8 +1463,8 @@ static int mtk_poll_rx(struct napi_struc
  	int done = 0, bytes = 0;
  
  	while (done < budget) {
@@ -22,7 +22,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		dma_addr_t dma_addr;
  		u32 hash, reason;
  		int mac = 0;
-@@ -1530,7 +1530,13 @@ static int mtk_poll_rx(struct napi_struc
+@@ -1531,7 +1531,13 @@ static int mtk_poll_rx(struct napi_struc
  		pktlen = RX_DMA_GET_PLEN0(trxd.rxd2);
  		skb->dev = netdev;
  		skb_put(skb, pktlen);
@@ -37,7 +37,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  			skb->ip_summed = CHECKSUM_UNNECESSARY;
  		else
  			skb_checksum_none_assert(skb);
-@@ -3756,6 +3762,7 @@ static const struct mtk_soc_data mt7986_
+@@ -3759,6 +3765,7 @@ static const struct mtk_soc_data mt7986_
  		.txd_size = sizeof(struct mtk_tx_dma_v2),
  		.rxd_size = sizeof(struct mtk_rx_dma_v2),
  		.rx_irq_done_mask = MTK_RX_DONE_INT_V2,
diff --git a/target/linux/generic/backport-5.15/703-00-v5.16-net-convert-users-of-bitmap_foo-to-linkmode_foo.patch b/target/linux/generic/backport-5.15/703-00-v5.16-net-convert-users-of-bitmap_foo-to-linkmode_foo.patch
index 8063d20270928e..919da4d1ef198f 100644
--- a/target/linux/generic/backport-5.15/703-00-v5.16-net-convert-users-of-bitmap_foo-to-linkmode_foo.patch
+++ b/target/linux/generic/backport-5.15/703-00-v5.16-net-convert-users-of-bitmap_foo-to-linkmode_foo.patch
@@ -637,7 +637,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static void macb_usx_pcs_link_up(struct phylink_pcs *pcs, unsigned int mode,
 --- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c
 +++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
-@@ -940,7 +940,7 @@ static void enetc_pl_mac_validate(struct
+@@ -965,7 +965,7 @@ static void enetc_pl_mac_validate(struct
  	    state->interface != PHY_INTERFACE_MODE_2500BASEX &&
  	    state->interface != PHY_INTERFACE_MODE_USXGMII &&
  	    !phy_interface_mode_is_rgmii(state->interface)) {
@@ -646,7 +646,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		return;
  	}
  
-@@ -963,10 +963,8 @@ static void enetc_pl_mac_validate(struct
+@@ -988,10 +988,8 @@ static void enetc_pl_mac_validate(struct
  		phylink_set(mask, 2500baseX_Full);
  	}
  
@@ -901,7 +901,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static void axienet_mac_pcs_get_state(struct phylink_config *config,
 --- a/drivers/net/pcs/pcs-xpcs.c
 +++ b/drivers/net/pcs/pcs-xpcs.c
-@@ -646,7 +646,7 @@ void xpcs_validate(struct dw_xpcs *xpcs,
+@@ -637,7 +637,7 @@ void xpcs_validate(struct dw_xpcs *xpcs,
  	if (state->interface == PHY_INTERFACE_MODE_NA)
  		return;
  
diff --git a/target/linux/generic/backport-5.15/703-01-v5.16-net-phylink-add-MAC-phy_interface_t-bitmap.patch b/target/linux/generic/backport-5.15/703-01-v5.16-net-phylink-add-MAC-phy_interface_t-bitmap.patch
index b72faec8d958ae..885c2fcf25272c 100644
--- a/target/linux/generic/backport-5.15/703-01-v5.16-net-phylink-add-MAC-phy_interface_t-bitmap.patch
+++ b/target/linux/generic/backport-5.15/703-01-v5.16-net-phylink-add-MAC-phy_interface_t-bitmap.patch
@@ -14,7 +14,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/include/linux/phylink.h
 +++ b/include/linux/phylink.h
-@@ -76,6 +76,7 @@ struct phylink_config {
+@@ -78,6 +78,7 @@ struct phylink_config {
  	bool ovr_an_inband;
  	void (*get_fixed_state)(struct phylink_config *config,
  				struct phylink_link_state *state);
diff --git a/target/linux/generic/backport-5.15/703-02-v5.16-net-phylink-use-supported_interfaces-for-phylink-val.patch b/target/linux/generic/backport-5.15/703-02-v5.16-net-phylink-use-supported_interfaces-for-phylink-val.patch
index 8996fc8d45486b..9800884f6e9a1e 100644
--- a/target/linux/generic/backport-5.15/703-02-v5.16-net-phylink-use-supported_interfaces-for-phylink-val.patch
+++ b/target/linux/generic/backport-5.15/703-02-v5.16-net-phylink-use-supported_interfaces-for-phylink-val.patch
@@ -70,7 +70,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	return phylink_is_empty_linkmode(supported) ? -EINVAL : 0;
 --- a/include/linux/phylink.h
 +++ b/include/linux/phylink.h
-@@ -67,6 +67,8 @@ enum phylink_op_type {
+@@ -68,6 +68,8 @@ enum phylink_op_type {
   * @ovr_an_inband: if true, override PCS to MLO_AN_INBAND
   * @get_fixed_state: callback to execute to determine the fixed link state,
   *		     if MAC link is at %MLO_AN_FIXED mode.
@@ -79,7 +79,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
   */
  struct phylink_config {
  	struct device *dev;
-@@ -134,8 +136,14 @@ struct phylink_mac_ops {
+@@ -136,8 +138,14 @@ struct phylink_mac_ops {
   * based on @state->advertising and/or @state->speed and update
   * @state->interface accordingly. See phylink_helper_basex_speed().
   *
diff --git a/target/linux/generic/backport-5.15/703-03-v5.16-net-dsa-populate-supported_interfaces-member.patch b/target/linux/generic/backport-5.15/703-03-v5.16-net-dsa-populate-supported_interfaces-member.patch
index 83d1f7ee7c0ab5..b4387865363f71 100644
--- a/target/linux/generic/backport-5.15/703-03-v5.16-net-dsa-populate-supported_interfaces-member.patch
+++ b/target/linux/generic/backport-5.15/703-03-v5.16-net-dsa-populate-supported_interfaces-member.patch
@@ -26,7 +26,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/include/net/dsa.h
 +++ b/include/net/dsa.h
-@@ -626,6 +626,8 @@ struct dsa_switch_ops {
+@@ -654,6 +654,8 @@ struct dsa_switch_ops {
  	/*
  	 * PHYLINK integration
  	 */
@@ -37,7 +37,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  				    struct phylink_link_state *state);
 --- a/net/dsa/port.c
 +++ b/net/dsa/port.c
-@@ -1172,6 +1172,10 @@ static int dsa_port_phylink_register(str
+@@ -1188,6 +1188,10 @@ static int dsa_port_phylink_register(str
  	dp->pl_config.type = PHYLINK_DEV;
  	dp->pl_config.pcs_poll = ds->pcs_poll;
  
diff --git a/target/linux/generic/backport-5.15/703-04-v5.17-net-dsa-consolidate-phylink-creation.patch b/target/linux/generic/backport-5.15/703-04-v5.17-net-dsa-consolidate-phylink-creation.patch
index 8b58c8331230be..9b67a8a5185781 100644
--- a/target/linux/generic/backport-5.15/703-04-v5.17-net-dsa-consolidate-phylink-creation.patch
+++ b/target/linux/generic/backport-5.15/703-04-v5.17-net-dsa-consolidate-phylink-creation.patch
@@ -21,7 +21,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/net/dsa/dsa_priv.h
 +++ b/net/dsa/dsa_priv.h
-@@ -260,13 +260,13 @@ int dsa_port_mrp_add_ring_role(const str
+@@ -261,13 +261,13 @@ int dsa_port_mrp_add_ring_role(const str
  			       const struct switchdev_obj_ring_role_mrp *mrp);
  int dsa_port_mrp_del_ring_role(const struct dsa_port *dp,
  			       const struct switchdev_obj_ring_role_mrp *mrp);
@@ -38,7 +38,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  						 const struct net_device *dev)
 --- a/net/dsa/port.c
 +++ b/net/dsa/port.c
-@@ -1076,7 +1076,7 @@ static void dsa_port_phylink_mac_link_up
+@@ -1092,7 +1092,7 @@ static void dsa_port_phylink_mac_link_up
  				     speed, duplex, tx_pause, rx_pause);
  }
  
@@ -47,7 +47,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	.validate = dsa_port_phylink_validate,
  	.mac_pcs_get_state = dsa_port_phylink_mac_pcs_get_state,
  	.mac_config = dsa_port_phylink_mac_config,
-@@ -1085,6 +1085,30 @@ const struct phylink_mac_ops dsa_port_ph
+@@ -1101,6 +1101,30 @@ const struct phylink_mac_ops dsa_port_ph
  	.mac_link_up = dsa_port_phylink_mac_link_up,
  };
  
@@ -78,7 +78,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  static int dsa_port_setup_phy_of(struct dsa_port *dp, bool enable)
  {
  	struct dsa_switch *ds = dp->ds;
-@@ -1161,27 +1185,15 @@ static int dsa_port_phylink_register(str
+@@ -1177,27 +1201,15 @@ static int dsa_port_phylink_register(str
  {
  	struct dsa_switch *ds = dp->ds;
  	struct device_node *port_dn = dp->dn;
diff --git a/target/linux/generic/backport-5.15/703-05-v5.17-net-dsa-replace-phylink_get_interfaces-with-phylink_.patch b/target/linux/generic/backport-5.15/703-05-v5.17-net-dsa-replace-phylink_get_interfaces-with-phylink_.patch
index 4cea5994da2dc5..1d9616c0db7f7b 100644
--- a/target/linux/generic/backport-5.15/703-05-v5.17-net-dsa-replace-phylink_get_interfaces-with-phylink_.patch
+++ b/target/linux/generic/backport-5.15/703-05-v5.17-net-dsa-replace-phylink_get_interfaces-with-phylink_.patch
@@ -24,7 +24,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/include/net/dsa.h
 +++ b/include/net/dsa.h
-@@ -626,8 +626,8 @@ struct dsa_switch_ops {
+@@ -654,8 +654,8 @@ struct dsa_switch_ops {
  	/*
  	 * PHYLINK integration
  	 */
@@ -37,7 +37,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  				    struct phylink_link_state *state);
 --- a/net/dsa/port.c
 +++ b/net/dsa/port.c
-@@ -1095,9 +1095,8 @@ int dsa_port_phylink_create(struct dsa_p
+@@ -1111,9 +1111,8 @@ int dsa_port_phylink_create(struct dsa_p
  	if (err)
  		mode = PHY_INTERFACE_MODE_NA;
  
diff --git a/target/linux/generic/backport-5.15/703-06-v5.18-net-dsa-add-support-for-phylink-mac_select_pcs.patch b/target/linux/generic/backport-5.15/703-06-v5.18-net-dsa-add-support-for-phylink-mac_select_pcs.patch
index a28d14d27a3c2a..9791ad2ac9189a 100644
--- a/target/linux/generic/backport-5.15/703-06-v5.18-net-dsa-add-support-for-phylink-mac_select_pcs.patch
+++ b/target/linux/generic/backport-5.15/703-06-v5.18-net-dsa-add-support-for-phylink-mac_select_pcs.patch
@@ -16,7 +16,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/include/net/dsa.h
 +++ b/include/net/dsa.h
-@@ -631,6 +631,9 @@ struct dsa_switch_ops {
+@@ -659,6 +659,9 @@ struct dsa_switch_ops {
  	void	(*phylink_validate)(struct dsa_switch *ds, int port,
  				    unsigned long *supported,
  				    struct phylink_link_state *state);
@@ -28,7 +28,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	void	(*phylink_mac_config)(struct dsa_switch *ds, int port,
 --- a/net/dsa/port.c
 +++ b/net/dsa/port.c
-@@ -1012,6 +1012,20 @@ static void dsa_port_phylink_mac_pcs_get
+@@ -1028,6 +1028,20 @@ static void dsa_port_phylink_mac_pcs_get
  	}
  }
  
@@ -49,7 +49,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static void dsa_port_phylink_mac_config(struct phylink_config *config,
  					unsigned int mode,
  					const struct phylink_link_state *state)
-@@ -1078,6 +1092,7 @@ static void dsa_port_phylink_mac_link_up
+@@ -1094,6 +1108,7 @@ static void dsa_port_phylink_mac_link_up
  
  static const struct phylink_mac_ops dsa_port_phylink_mac_ops = {
  	.validate = dsa_port_phylink_validate,
diff --git a/target/linux/generic/backport-5.15/703-08-v5.17-net-phylink-add-mac_select_pcs-method-to-phylink_mac.patch b/target/linux/generic/backport-5.15/703-08-v5.17-net-phylink-add-mac_select_pcs-method-to-phylink_mac.patch
index e1cfc3f4397a5d..d826877e7dc693 100644
--- a/target/linux/generic/backport-5.15/703-08-v5.17-net-phylink-add-mac_select_pcs-method-to-phylink_mac.patch
+++ b/target/linux/generic/backport-5.15/703-08-v5.17-net-phylink-add-mac_select_pcs-method-to-phylink_mac.patch
@@ -156,7 +156,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
 --- a/include/linux/phylink.h
 +++ b/include/linux/phylink.h
-@@ -84,6 +84,7 @@ struct phylink_config {
+@@ -86,6 +86,7 @@ struct phylink_config {
  /**
   * struct phylink_mac_ops - MAC operations structure.
   * @validate: Validate and update the link configuration.
@@ -164,7 +164,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
   * @mac_pcs_get_state: Read the current link state from the hardware.
   * @mac_prepare: prepare for a major reconfiguration of the interface.
   * @mac_config: configure the MAC for the selected mode and state.
-@@ -98,6 +99,8 @@ struct phylink_mac_ops {
+@@ -100,6 +101,8 @@ struct phylink_mac_ops {
  	void (*validate)(struct phylink_config *config,
  			 unsigned long *supported,
  			 struct phylink_link_state *state);
@@ -173,7 +173,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	void (*mac_pcs_get_state)(struct phylink_config *config,
  				  struct phylink_link_state *state);
  	int (*mac_prepare)(struct phylink_config *config, unsigned int mode,
-@@ -150,6 +153,21 @@ struct phylink_mac_ops {
+@@ -152,6 +155,21 @@ struct phylink_mac_ops {
   */
  void validate(struct phylink_config *config, unsigned long *supported,
  	      struct phylink_link_state *state);
diff --git a/target/linux/generic/backport-5.15/703-09-v5.17-net-phylink-add-generic-validate-implementation.patch b/target/linux/generic/backport-5.15/703-09-v5.17-net-phylink-add-generic-validate-implementation.patch
index 73c8b414da5fdf..f30a566c81e906 100644
--- a/target/linux/generic/backport-5.15/703-09-v5.17-net-phylink-add-generic-validate-implementation.patch
+++ b/target/linux/generic/backport-5.15/703-09-v5.17-net-phylink-add-generic-validate-implementation.patch
@@ -310,7 +310,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  };
  
  static inline bool phylink_autoneg_inband(unsigned int mode)
-@@ -69,6 +92,7 @@ enum phylink_op_type {
+@@ -70,6 +93,7 @@ enum phylink_op_type {
   *		     if MAC link is at %MLO_AN_FIXED mode.
   * @supported_interfaces: bitmap describing which PHY_INTERFACE_MODE_xxx
   *                        are supported by the MAC/PCS.
@@ -318,7 +318,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
   */
  struct phylink_config {
  	struct device *dev;
-@@ -79,6 +103,7 @@ struct phylink_config {
+@@ -81,6 +105,7 @@ struct phylink_config {
  	void (*get_fixed_state)(struct phylink_config *config,
  				struct phylink_link_state *state);
  	DECLARE_PHY_INTERFACE_MASK(supported_interfaces);
@@ -326,7 +326,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  };
  
  /**
-@@ -460,6 +485,12 @@ void pcs_link_up(struct phylink_pcs *pcs
+@@ -462,6 +487,12 @@ void pcs_link_up(struct phylink_pcs *pcs
  		 phy_interface_t interface, int speed, int duplex);
  #endif
  
diff --git a/target/linux/generic/backport-5.15/703-11-v5.17-net-phylink-add-pcs_validate-method.patch b/target/linux/generic/backport-5.15/703-11-v5.17-net-phylink-add-pcs_validate-method.patch
index add2e6e352ba05..524ce9bd92656a 100644
--- a/target/linux/generic/backport-5.15/703-11-v5.17-net-phylink-add-pcs_validate-method.patch
+++ b/target/linux/generic/backport-5.15/703-11-v5.17-net-phylink-add-pcs_validate-method.patch
@@ -63,7 +63,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	return phylink_is_empty_linkmode(supported) ? -EINVAL : 0;
 --- a/include/linux/phylink.h
 +++ b/include/linux/phylink.h
-@@ -396,6 +396,7 @@ struct phylink_pcs {
+@@ -398,6 +398,7 @@ struct phylink_pcs {
  
  /**
   * struct phylink_pcs_ops - MAC PCS operations structure.
@@ -71,7 +71,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
   * @pcs_get_state: read the current MAC PCS link state from the hardware.
   * @pcs_config: configure the MAC PCS for the selected mode and state.
   * @pcs_an_restart: restart 802.3z BaseX autonegotiation.
-@@ -403,6 +404,8 @@ struct phylink_pcs {
+@@ -405,6 +406,8 @@ struct phylink_pcs {
   *               (where necessary).
   */
  struct phylink_pcs_ops {
@@ -80,7 +80,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	void (*pcs_get_state)(struct phylink_pcs *pcs,
  			      struct phylink_link_state *state);
  	int (*pcs_config)(struct phylink_pcs *pcs, unsigned int mode,
-@@ -416,6 +419,23 @@ struct phylink_pcs_ops {
+@@ -418,6 +421,23 @@ struct phylink_pcs_ops {
  
  #if 0 /* For kernel-doc purposes only. */
  /**
diff --git a/target/linux/generic/backport-5.15/703-12-v5.17-net-phylink-add-legacy_pre_march2020-indicator.patch b/target/linux/generic/backport-5.15/703-12-v5.17-net-phylink-add-legacy_pre_march2020-indicator.patch
index 6fbde1250784a6..16d5da9c70e3b5 100644
--- a/target/linux/generic/backport-5.15/703-12-v5.17-net-phylink-add-legacy_pre_march2020-indicator.patch
+++ b/target/linux/generic/backport-5.15/703-12-v5.17-net-phylink-add-legacy_pre_march2020-indicator.patch
@@ -33,11 +33,11 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
   * @pcs_poll: MAC PCS cannot provide link change interrupt
   * @poll_fixed_state: if true, starts link_poll,
   *		      if MAC link is at %MLO_AN_FIXED mode.
-@@ -97,6 +99,7 @@ enum phylink_op_type {
+@@ -98,6 +100,7 @@ enum phylink_op_type {
  struct phylink_config {
  	struct device *dev;
  	enum phylink_op_type type;
 +	bool legacy_pre_march2020;
  	bool pcs_poll;
  	bool poll_fixed_state;
- 	bool ovr_an_inband;
+ 	bool mac_managed_pm;
diff --git a/target/linux/generic/backport-5.15/703-13-v5.17-net-dsa-mark-DSA-phylink-as-legacy_pre_march2020.patch b/target/linux/generic/backport-5.15/703-13-v5.17-net-dsa-mark-DSA-phylink-as-legacy_pre_march2020.patch
index dff0db5db659ff..849881942e1a03 100644
--- a/target/linux/generic/backport-5.15/703-13-v5.17-net-dsa-mark-DSA-phylink-as-legacy_pre_march2020.patch
+++ b/target/linux/generic/backport-5.15/703-13-v5.17-net-dsa-mark-DSA-phylink-as-legacy_pre_march2020.patch
@@ -20,7 +20,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/net/dsa/port.c
 +++ b/net/dsa/port.c
-@@ -1110,6 +1110,13 @@ int dsa_port_phylink_create(struct dsa_p
+@@ -1126,6 +1126,13 @@ int dsa_port_phylink_create(struct dsa_p
  	if (err)
  		mode = PHY_INTERFACE_MODE_NA;
  
diff --git a/target/linux/generic/backport-5.15/703-14-v5.17-net-phylink-use-legacy_pre_march2020.patch b/target/linux/generic/backport-5.15/703-14-v5.17-net-phylink-use-legacy_pre_march2020.patch
index 361fa10d4d59ae..73e53068b8a1c0 100644
--- a/target/linux/generic/backport-5.15/703-14-v5.17-net-phylink-use-legacy_pre_march2020.patch
+++ b/target/linux/generic/backport-5.15/703-14-v5.17-net-phylink-use-legacy_pre_march2020.patch
@@ -75,7 +75,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		}
 --- a/include/linux/phylink.h
 +++ b/include/linux/phylink.h
-@@ -208,6 +208,10 @@ struct phylink_pcs *mac_select_pcs(struc
+@@ -210,6 +210,10 @@ struct phylink_pcs *mac_select_pcs(struc
   * negotiation completion state in @state->an_complete, and link up state
   * in @state->link. If possible, @state->lp_advertising should also be
   * populated.
@@ -86,7 +86,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
   */
  void mac_pcs_get_state(struct phylink_config *config,
  		       struct phylink_link_state *state);
-@@ -248,6 +252,15 @@ int mac_prepare(struct phylink_config *c
+@@ -250,6 +254,15 @@ int mac_prepare(struct phylink_config *c
   * guaranteed to be correct, and so any mac_config() implementation must
   * never reference these fields.
   *
@@ -102,7 +102,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
   * (this requires a rewrite - please refer to mac_link_up() for situations
   *  where the PCS and MAC are not tightly integrated.)
   *
-@@ -332,6 +345,10 @@ int mac_finish(struct phylink_config *co
+@@ -334,6 +347,10 @@ int mac_finish(struct phylink_config *co
  /**
   * mac_an_restart() - restart 802.3z BaseX autonegotiation
   * @config: a pointer to a &struct phylink_config.
diff --git a/target/linux/generic/backport-5.15/703-15-v5.18-net-phy-phylink-fix-DSA-mac_select_pcs-introduction.patch b/target/linux/generic/backport-5.15/703-15-v5.18-net-phy-phylink-fix-DSA-mac_select_pcs-introduction.patch
index 4ab90fafe1da76..9e5061aaed832b 100644
--- a/target/linux/generic/backport-5.15/703-15-v5.18-net-phy-phylink-fix-DSA-mac_select_pcs-introduction.patch
+++ b/target/linux/generic/backport-5.15/703-15-v5.18-net-phy-phylink-fix-DSA-mac_select_pcs-introduction.patch
@@ -76,7 +76,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	if (iface == PHY_INTERFACE_MODE_MOCA)
 --- a/net/dsa/port.c
 +++ b/net/dsa/port.c
-@@ -1017,8 +1017,8 @@ dsa_port_phylink_mac_select_pcs(struct p
+@@ -1033,8 +1033,8 @@ dsa_port_phylink_mac_select_pcs(struct p
  				phy_interface_t interface)
  {
  	struct dsa_port *dp = container_of(config, struct dsa_port, pl_config);
diff --git a/target/linux/generic/backport-5.15/704-01-v5.17-net-mtk_eth_soc-populate-supported_interfaces-member.patch b/target/linux/generic/backport-5.15/704-01-v5.17-net-mtk_eth_soc-populate-supported_interfaces-member.patch
index 43e1f9cc31bb96..b6fe0dad4c8702 100644
--- a/target/linux/generic/backport-5.15/704-01-v5.17-net-mtk_eth_soc-populate-supported_interfaces-member.patch
+++ b/target/linux/generic/backport-5.15/704-01-v5.17-net-mtk_eth_soc-populate-supported_interfaces-member.patch
@@ -14,7 +14,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -3352,6 +3352,26 @@ static int mtk_add_mac(struct mtk_eth *e
+@@ -3355,6 +3355,26 @@ static int mtk_add_mac(struct mtk_eth *e
  
  	mac->phylink_config.dev = &eth->netdev[id]->dev;
  	mac->phylink_config.type = PHYLINK_NETDEV;
diff --git a/target/linux/generic/backport-5.15/704-02-v5.17-net-mtk_eth_soc-remove-interface-checks-in-mtk_valid.patch b/target/linux/generic/backport-5.15/704-02-v5.17-net-mtk_eth_soc-remove-interface-checks-in-mtk_valid.patch
index 05a84c4f67956e..0a33ab0093406c 100644
--- a/target/linux/generic/backport-5.15/704-02-v5.17-net-mtk_eth_soc-remove-interface-checks-in-mtk_valid.patch
+++ b/target/linux/generic/backport-5.15/704-02-v5.17-net-mtk_eth_soc-remove-interface-checks-in-mtk_valid.patch
@@ -16,7 +16,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -567,24 +567,8 @@ static void mtk_validate(struct phylink_
+@@ -568,24 +568,8 @@ static void mtk_validate(struct phylink_
  			 unsigned long *supported,
  			 struct phylink_link_state *state)
  {
@@ -41,7 +41,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	phylink_set_port_modes(mask);
  	phylink_set(mask, Autoneg);
  
-@@ -611,7 +595,6 @@ static void mtk_validate(struct phylink_
+@@ -612,7 +596,6 @@ static void mtk_validate(struct phylink_
  	case PHY_INTERFACE_MODE_MII:
  	case PHY_INTERFACE_MODE_RMII:
  	case PHY_INTERFACE_MODE_REVMII:
@@ -49,7 +49,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	default:
  		phylink_set(mask, 10baseT_Half);
  		phylink_set(mask, 10baseT_Full);
-@@ -620,23 +603,6 @@ static void mtk_validate(struct phylink_
+@@ -621,23 +604,6 @@ static void mtk_validate(struct phylink_
  		break;
  	}
  
diff --git a/target/linux/generic/backport-5.15/704-03-v5.17-net-mtk_eth_soc-drop-use-of-phylink_helper_basex_spe.patch b/target/linux/generic/backport-5.15/704-03-v5.17-net-mtk_eth_soc-drop-use-of-phylink_helper_basex_spe.patch
index a3cfab7f881f72..f8cc8105a4c06b 100644
--- a/target/linux/generic/backport-5.15/704-03-v5.17-net-mtk_eth_soc-drop-use-of-phylink_helper_basex_spe.patch
+++ b/target/linux/generic/backport-5.15/704-03-v5.17-net-mtk_eth_soc-drop-use-of-phylink_helper_basex_spe.patch
@@ -17,7 +17,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -577,8 +577,9 @@ static void mtk_validate(struct phylink_
+@@ -578,8 +578,9 @@ static void mtk_validate(struct phylink_
  		phylink_set(mask, 1000baseT_Full);
  		break;
  	case PHY_INTERFACE_MODE_1000BASEX:
@@ -28,7 +28,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		phylink_set(mask, 2500baseX_Full);
  		break;
  	case PHY_INTERFACE_MODE_GMII:
-@@ -608,11 +609,6 @@ static void mtk_validate(struct phylink_
+@@ -609,11 +610,6 @@ static void mtk_validate(struct phylink_
  
  	linkmode_and(supported, supported, mask);
  	linkmode_and(state->advertising, state->advertising, mask);
diff --git a/target/linux/generic/backport-5.15/704-04-v5.17-net-mtk_eth_soc-use-phylink_generic_validate.patch b/target/linux/generic/backport-5.15/704-04-v5.17-net-mtk_eth_soc-use-phylink_generic_validate.patch
index 7f3734a76546ab..f695991ec1ff40 100644
--- a/target/linux/generic/backport-5.15/704-04-v5.17-net-mtk_eth_soc-use-phylink_generic_validate.patch
+++ b/target/linux/generic/backport-5.15/704-04-v5.17-net-mtk_eth_soc-use-phylink_generic_validate.patch
@@ -14,7 +14,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -563,56 +563,8 @@ static void mtk_mac_link_up(struct phyli
+@@ -564,56 +564,8 @@ static void mtk_mac_link_up(struct phyli
  	mtk_w32(mac->hw, mcr, MTK_MAC_MCR(mac->id));
  }
  
@@ -72,7 +72,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	.mac_pcs_get_state = mtk_mac_pcs_get_state,
  	.mac_an_restart = mtk_mac_an_restart,
  	.mac_config = mtk_mac_config,
-@@ -3314,6 +3266,9 @@ static int mtk_add_mac(struct mtk_eth *e
+@@ -3317,6 +3269,9 @@ static int mtk_add_mac(struct mtk_eth *e
  
  	mac->phylink_config.dev = &eth->netdev[id]->dev;
  	mac->phylink_config.type = PHYLINK_NETDEV;
diff --git a/target/linux/generic/backport-5.15/704-05-v5.17-net-mtk_eth_soc-mark-as-a-legacy_pre_march2020-drive.patch b/target/linux/generic/backport-5.15/704-05-v5.17-net-mtk_eth_soc-mark-as-a-legacy_pre_march2020-drive.patch
index 6aa99acf77d86d..cbff1bfbbc4c6b 100644
--- a/target/linux/generic/backport-5.15/704-05-v5.17-net-mtk_eth_soc-mark-as-a-legacy_pre_march2020-drive.patch
+++ b/target/linux/generic/backport-5.15/704-05-v5.17-net-mtk_eth_soc-mark-as-a-legacy_pre_march2020-drive.patch
@@ -16,7 +16,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -3266,6 +3266,10 @@ static int mtk_add_mac(struct mtk_eth *e
+@@ -3269,6 +3269,10 @@ static int mtk_add_mac(struct mtk_eth *e
  
  	mac->phylink_config.dev = &eth->netdev[id]->dev;
  	mac->phylink_config.type = PHYLINK_NETDEV;
diff --git a/target/linux/generic/backport-5.15/704-06-v5.19-eth-mtk_eth_soc-remove-a-copy-of-the-NAPI_POLL_WEIGH.patch b/target/linux/generic/backport-5.15/704-06-v5.19-eth-mtk_eth_soc-remove-a-copy-of-the-NAPI_POLL_WEIGH.patch
index e5f70e36f0bb97..c0b4a61cb6e13d 100644
--- a/target/linux/generic/backport-5.15/704-06-v5.19-eth-mtk_eth_soc-remove-a-copy-of-the-NAPI_POLL_WEIGH.patch
+++ b/target/linux/generic/backport-5.15/704-06-v5.19-eth-mtk_eth_soc-remove-a-copy-of-the-NAPI_POLL_WEIGH.patch
@@ -16,7 +16,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -3565,9 +3565,9 @@ static int mtk_probe(struct platform_dev
+@@ -3568,9 +3568,9 @@ static int mtk_probe(struct platform_dev
  	 */
  	init_dummy_netdev(&eth->dummy_dev);
  	netif_napi_add(&eth->dummy_dev, &eth->tx_napi, mtk_napi_tx,
diff --git a/target/linux/generic/backport-5.15/704-07-v5.19-mtk_eth_soc-remove-unused-mac-mode.patch b/target/linux/generic/backport-5.15/704-07-v5.19-mtk_eth_soc-remove-unused-mac-mode.patch
index 4d896cdf39273d..5940ac27df9c43 100644
--- a/target/linux/generic/backport-5.15/704-07-v5.19-mtk_eth_soc-remove-unused-mac-mode.patch
+++ b/target/linux/generic/backport-5.15/704-07-v5.19-mtk_eth_soc-remove-unused-mac-mode.patch
@@ -15,7 +15,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -3261,7 +3261,6 @@ static int mtk_add_mac(struct mtk_eth *e
+@@ -3264,7 +3264,6 @@ static int mtk_add_mac(struct mtk_eth *e
  
  	/* mac config is not set */
  	mac->interface = PHY_INTERFACE_MODE_NA;
@@ -25,7 +25,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	mac->phylink_config.dev = &eth->netdev[id]->dev;
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -1085,7 +1085,6 @@ struct mtk_eth {
+@@ -1086,7 +1086,6 @@ struct mtk_eth {
  struct mtk_mac {
  	int				id;
  	phy_interface_t			interface;
diff --git a/target/linux/generic/backport-5.15/704-08-v5.19-net-mtk_eth_soc-remove-unused-sgmii-flags.patch b/target/linux/generic/backport-5.15/704-08-v5.19-net-mtk_eth_soc-remove-unused-sgmii-flags.patch
index 39aa24157edaf3..a15914bd553157 100644
--- a/target/linux/generic/backport-5.15/704-08-v5.19-net-mtk_eth_soc-remove-unused-sgmii-flags.patch
+++ b/target/linux/generic/backport-5.15/704-08-v5.19-net-mtk_eth_soc-remove-unused-sgmii-flags.patch
@@ -14,7 +14,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -956,23 +956,15 @@ struct mtk_soc_data {
+@@ -957,23 +957,15 @@ struct mtk_soc_data {
  /* currently no SoC has more than 2 macs */
  #define MTK_MAX_DEVS			2
  
diff --git a/target/linux/generic/backport-5.15/704-09-v5.19-net-mtk_eth_soc-add-mask-and-update-PCS-speed-defini.patch b/target/linux/generic/backport-5.15/704-09-v5.19-net-mtk_eth_soc-add-mask-and-update-PCS-speed-defini.patch
index f2e1f86bacf139..e16bc875e52333 100644
--- a/target/linux/generic/backport-5.15/704-09-v5.19-net-mtk_eth_soc-add-mask-and-update-PCS-speed-defini.patch
+++ b/target/linux/generic/backport-5.15/704-09-v5.19-net-mtk_eth_soc-add-mask-and-update-PCS-speed-defini.patch
@@ -24,7 +24,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  #include "mtk_ppe.h"
  
  #define MTK_QDMA_PAGE_SIZE	2048
-@@ -473,9 +474,10 @@
+@@ -474,9 +475,10 @@
  #define SGMSYS_SGMII_MODE		0x20
  #define SGMII_IF_MODE_BIT0		BIT(0)
  #define SGMII_SPEED_DUPLEX_AN		BIT(1)
diff --git a/target/linux/generic/backport-5.15/704-11-v5.19-net-mtk_eth_soc-correct-802.3z-duplex-setting.patch b/target/linux/generic/backport-5.15/704-11-v5.19-net-mtk_eth_soc-correct-802.3z-duplex-setting.patch
index 140ff3cab5e1a6..78444903a8c20b 100644
--- a/target/linux/generic/backport-5.15/704-11-v5.19-net-mtk_eth_soc-correct-802.3z-duplex-setting.patch
+++ b/target/linux/generic/backport-5.15/704-11-v5.19-net-mtk_eth_soc-correct-802.3z-duplex-setting.patch
@@ -18,7 +18,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -532,8 +532,18 @@ static void mtk_mac_link_up(struct phyli
+@@ -533,8 +533,18 @@ static void mtk_mac_link_up(struct phyli
  {
  	struct mtk_mac *mac = container_of(config, struct mtk_mac,
  					   phylink_config);
@@ -38,7 +38,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	mcr &= ~(MAC_MCR_SPEED_100 | MAC_MCR_SPEED_1000 |
  		 MAC_MCR_FORCE_DPX | MAC_MCR_FORCE_TX_FC |
  		 MAC_MCR_FORCE_RX_FC);
-@@ -3265,9 +3275,7 @@ static int mtk_add_mac(struct mtk_eth *e
+@@ -3268,9 +3278,7 @@ static int mtk_add_mac(struct mtk_eth *e
  
  	mac->phylink_config.dev = &eth->netdev[id]->dev;
  	mac->phylink_config.type = PHYLINK_NETDEV;
@@ -51,7 +51,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		MAC_10 | MAC_100 | MAC_1000 | MAC_2500FD;
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -1103,6 +1103,7 @@ int mtk_sgmii_init(struct mtk_sgmii *ss,
+@@ -1104,6 +1104,7 @@ int mtk_sgmii_init(struct mtk_sgmii *ss,
  int mtk_sgmii_setup_mode_an(struct mtk_sgmii *ss, int id);
  int mtk_sgmii_setup_mode_force(struct mtk_sgmii *ss, int id,
  			       const struct phylink_link_state *state);
diff --git a/target/linux/generic/backport-5.15/704-12-v5.19-net-mtk_eth_soc-stop-passing-phylink-state-to-sgmii-.patch b/target/linux/generic/backport-5.15/704-12-v5.19-net-mtk_eth_soc-stop-passing-phylink-state-to-sgmii-.patch
index 56b5e43e532647..6556bb7d07d6dd 100644
--- a/target/linux/generic/backport-5.15/704-12-v5.19-net-mtk_eth_soc-stop-passing-phylink-state-to-sgmii-.patch
+++ b/target/linux/generic/backport-5.15/704-12-v5.19-net-mtk_eth_soc-stop-passing-phylink-state-to-sgmii-.patch
@@ -29,7 +29,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -1102,7 +1102,7 @@ int mtk_sgmii_init(struct mtk_sgmii *ss,
+@@ -1103,7 +1103,7 @@ int mtk_sgmii_init(struct mtk_sgmii *ss,
  		   u32 ana_rgc3);
  int mtk_sgmii_setup_mode_an(struct mtk_sgmii *ss, int id);
  int mtk_sgmii_setup_mode_force(struct mtk_sgmii *ss, int id,
diff --git a/target/linux/generic/backport-5.15/704-13-v5.19-net-mtk_eth_soc-provide-mtk_sgmii_config.patch b/target/linux/generic/backport-5.15/704-13-v5.19-net-mtk_eth_soc-provide-mtk_sgmii_config.patch
index 4c91cf68f4ca53..0e22c7fd674109 100644
--- a/target/linux/generic/backport-5.15/704-13-v5.19-net-mtk_eth_soc-provide-mtk_sgmii_config.patch
+++ b/target/linux/generic/backport-5.15/704-13-v5.19-net-mtk_eth_soc-provide-mtk_sgmii_config.patch
@@ -32,7 +32,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -1100,9 +1100,8 @@ u32 mtk_r32(struct mtk_eth *eth, unsigne
+@@ -1101,9 +1101,8 @@ u32 mtk_r32(struct mtk_eth *eth, unsigne
  
  int mtk_sgmii_init(struct mtk_sgmii *ss, struct device_node *np,
  		   u32 ana_rgc3);
diff --git a/target/linux/generic/backport-5.15/704-15-v5.19-net-mtk_eth_soc-move-MAC_MCR-setting-to-mac_finish.patch b/target/linux/generic/backport-5.15/704-15-v5.19-net-mtk_eth_soc-move-MAC_MCR-setting-to-mac_finish.patch
index 368db4cca26ddb..337c6112d66f68 100644
--- a/target/linux/generic/backport-5.15/704-15-v5.19-net-mtk_eth_soc-move-MAC_MCR-setting-to-mac_finish.patch
+++ b/target/linux/generic/backport-5.15/704-15-v5.19-net-mtk_eth_soc-move-MAC_MCR-setting-to-mac_finish.patch
@@ -25,27 +25,22 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  
  	/* MT76x8 has no hardware settings between for the MAC */
  	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628) &&
-@@ -455,16 +455,6 @@ static void mtk_mac_config(struct phylin
+@@ -455,6 +455,25 @@ static void mtk_mac_config(struct phylin
  		return;
  	}
  
--	/* Setup gmac */
--	mcr_cur = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id));
--	mcr_new = mcr_cur;
--	mcr_new |= MAC_MCR_IPG_CFG | MAC_MCR_FORCE_MODE |
--		   MAC_MCR_BACKOFF_EN | MAC_MCR_BACKPR_EN | MAC_MCR_FORCE_LINK;
--
--	/* Only update control register when needed! */
--	if (mcr_new != mcr_cur)
--		mtk_w32(mac->hw, mcr_new, MTK_MAC_MCR(mac->id));
--
- 	return;
- 
- err_phy:
-@@ -477,6 +467,26 @@ init_err:
- 		mac->id, phy_modes(state->interface), err);
- }
- 
++	return;
++
++err_phy:
++	dev_err(eth->dev, "%s: GMAC%d mode %s not supported!\n", __func__,
++		mac->id, phy_modes(state->interface));
++	return;
++
++init_err:
++	dev_err(eth->dev, "%s: GMAC%d mode %s err: %d!\n", __func__,
++		mac->id, phy_modes(state->interface), err);
++}
++
 +static int mtk_mac_finish(struct phylink_config *config, unsigned int mode,
 +			  phy_interface_t interface)
 +{
@@ -53,23 +48,28 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 +					   phylink_config);
 +	u32 mcr_cur, mcr_new;
 +
-+	/* Setup gmac */
-+	mcr_cur = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id));
-+	mcr_new = mcr_cur;
-+	mcr_new |= MAC_MCR_IPG_CFG | MAC_MCR_FORCE_MODE |
-+		   MAC_MCR_BACKOFF_EN | MAC_MCR_BACKPR_EN | MAC_MCR_FORCE_LINK;
-+
-+	/* Only update control register when needed! */
-+	if (mcr_new != mcr_cur)
-+		mtk_w32(mac->hw, mcr_new, MTK_MAC_MCR(mac->id));
-+
+ 	/* Setup gmac */
+ 	mcr_cur = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id));
+ 	mcr_new = mcr_cur;
+@@ -466,16 +485,7 @@ static void mtk_mac_config(struct phylin
+ 	if (mcr_new != mcr_cur)
+ 		mtk_w32(mac->hw, mcr_new, MTK_MAC_MCR(mac->id));
+ 
+-	return;
+-
+-err_phy:
+-	dev_err(eth->dev, "%s: GMAC%d mode %s not supported!\n", __func__,
+-		mac->id, phy_modes(state->interface));
+-	return;
+-
+-init_err:
+-	dev_err(eth->dev, "%s: GMAC%d mode %s err: %d!\n", __func__,
+-		mac->id, phy_modes(state->interface), err);
 +	return 0;
-+}
-+
+ }
+ 
  static void mtk_mac_pcs_get_state(struct phylink_config *config,
- 				  struct phylink_link_state *state)
- {
-@@ -581,6 +591,7 @@ static const struct phylink_mac_ops mtk_
+@@ -582,6 +592,7 @@ static const struct phylink_mac_ops mtk_
  	.mac_pcs_get_state = mtk_mac_pcs_get_state,
  	.mac_an_restart = mtk_mac_an_restart,
  	.mac_config = mtk_mac_config,
diff --git a/target/linux/generic/backport-5.15/704-16-v5.19-net-mtk_eth_soc-move-restoration-of-SYSCFG0-to-mac_f.patch b/target/linux/generic/backport-5.15/704-16-v5.19-net-mtk_eth_soc-move-restoration-of-SYSCFG0-to-mac_f.patch
index ad6ec60288faab..b03ef436bdbb57 100644
--- a/target/linux/generic/backport-5.15/704-16-v5.19-net-mtk_eth_soc-move-restoration-of-SYSCFG0-to-mac_f.patch
+++ b/target/linux/generic/backport-5.15/704-16-v5.19-net-mtk_eth_soc-move-restoration-of-SYSCFG0-to-mac_f.patch
@@ -47,7 +47,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	mcr_new = mcr_cur;
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -1087,6 +1087,7 @@ struct mtk_mac {
+@@ -1088,6 +1088,7 @@ struct mtk_mac {
  	struct mtk_hw_stats		*hw_stats;
  	__be32				hwlro_ip[MTK_MAX_LRO_IP_CNT];
  	int				hwlro_ip_cnt;
diff --git a/target/linux/generic/backport-5.15/704-17-v5.19-net-mtk_eth_soc-convert-code-structure-to-suit-split.patch b/target/linux/generic/backport-5.15/704-17-v5.19-net-mtk_eth_soc-convert-code-structure-to-suit-split.patch
index 623658f459c78a..4c84703cd94c07 100644
--- a/target/linux/generic/backport-5.15/704-17-v5.19-net-mtk_eth_soc-convert-code-structure-to-suit-split.patch
+++ b/target/linux/generic/backport-5.15/704-17-v5.19-net-mtk_eth_soc-convert-code-structure-to-suit-split.patch
@@ -18,7 +18,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -958,16 +958,23 @@ struct mtk_soc_data {
+@@ -959,16 +959,23 @@ struct mtk_soc_data {
  /* currently no SoC has more than 2 macs */
  #define MTK_MAX_DEVS			2
  
diff --git a/target/linux/generic/backport-5.15/704-18-v5.19-net-mtk_eth_soc-partially-convert-to-phylink_pcs.patch b/target/linux/generic/backport-5.15/704-18-v5.19-net-mtk_eth_soc-partially-convert-to-phylink_pcs.patch
index df675e289995f4..b585867935e324 100644
--- a/target/linux/generic/backport-5.15/704-18-v5.19-net-mtk_eth_soc-partially-convert-to-phylink_pcs.patch
+++ b/target/linux/generic/backport-5.15/704-18-v5.19-net-mtk_eth_soc-partially-convert-to-phylink_pcs.patch
@@ -69,7 +69,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		/* Save the syscfg0 value for mac_finish */
  		mac->syscfg0 = val;
  	} else if (phylink_autoneg_inband(mode)) {
-@@ -526,14 +536,6 @@ static void mtk_mac_pcs_get_state(struct
+@@ -527,14 +537,6 @@ static void mtk_mac_pcs_get_state(struct
  		state->pause |= MLO_PAUSE_TX;
  }
  
@@ -84,7 +84,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  static void mtk_mac_link_down(struct phylink_config *config, unsigned int mode,
  			      phy_interface_t interface)
  {
-@@ -554,15 +556,6 @@ static void mtk_mac_link_up(struct phyli
+@@ -555,15 +557,6 @@ static void mtk_mac_link_up(struct phyli
  					   phylink_config);
  	u32 mcr;
  
@@ -100,7 +100,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	mcr = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id));
  	mcr &= ~(MAC_MCR_SPEED_100 | MAC_MCR_SPEED_1000 |
  		 MAC_MCR_FORCE_DPX | MAC_MCR_FORCE_TX_FC |
-@@ -595,8 +588,8 @@ static void mtk_mac_link_up(struct phyli
+@@ -596,8 +589,8 @@ static void mtk_mac_link_up(struct phyli
  
  static const struct phylink_mac_ops mtk_phylink_ops = {
  	.validate = phylink_generic_validate,
@@ -112,7 +112,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	.mac_link_down = mtk_mac_link_down,
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -963,10 +963,12 @@ struct mtk_soc_data {
+@@ -964,10 +964,12 @@ struct mtk_soc_data {
   * @regmap:            The register map pointing at the range used to setup
   *                     SGMII modes
   * @ana_rgc3:          The offset refers to register ANA_RGC3 related to regmap
@@ -125,7 +125,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  };
  
  /* struct mtk_sgmii -  This is the structure holding sgmii regmap and its
-@@ -1106,12 +1108,9 @@ void mtk_stats_update_mac(struct mtk_mac
+@@ -1107,12 +1109,9 @@ void mtk_stats_update_mac(struct mtk_mac
  void mtk_w32(struct mtk_eth *eth, u32 val, unsigned reg);
  u32 mtk_r32(struct mtk_eth *eth, unsigned reg);
  
diff --git a/target/linux/generic/backport-5.15/705-01-v5.17-net-dsa-mt7530-iterate-using-dsa_switch_for_each_use.patch b/target/linux/generic/backport-5.15/705-01-v5.17-net-dsa-mt7530-iterate-using-dsa_switch_for_each_use.patch
index 74567109c57a12..4142fd1d5081ff 100644
--- a/target/linux/generic/backport-5.15/705-01-v5.17-net-dsa-mt7530-iterate-using-dsa_switch_for_each_use.patch
+++ b/target/linux/generic/backport-5.15/705-01-v5.17-net-dsa-mt7530-iterate-using-dsa_switch_for_each_use.patch
@@ -21,7 +21,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -1188,27 +1188,31 @@ static int
+@@ -1190,27 +1190,31 @@ static int
  mt7530_port_bridge_join(struct dsa_switch *ds, int port,
  			struct net_device *bridge)
  {
@@ -65,7 +65,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	}
  
  	/* Add the all other ports to this port matrix. */
-@@ -1301,24 +1305,28 @@ static void
+@@ -1315,24 +1319,28 @@ static void
  mt7530_port_bridge_leave(struct dsa_switch *ds, int port,
  			 struct net_device *bridge)
  {
diff --git a/target/linux/generic/backport-5.15/705-02-v5.19-net-dsa-mt7530-populate-supported_interfaces-and-mac.patch b/target/linux/generic/backport-5.15/705-02-v5.19-net-dsa-mt7530-populate-supported_interfaces-and-mac.patch
index 690cc78fb5aa96..f2ead18c36e1f9 100644
--- a/target/linux/generic/backport-5.15/705-02-v5.19-net-dsa-mt7530-populate-supported_interfaces-and-mac.patch
+++ b/target/linux/generic/backport-5.15/705-02-v5.19-net-dsa-mt7530-populate-supported_interfaces-and-mac.patch
@@ -23,7 +23,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2385,6 +2385,32 @@ mt7531_setup(struct dsa_switch *ds)
+@@ -2444,6 +2444,32 @@ mt7531_setup(struct dsa_switch *ds)
  	return 0;
  }
  
@@ -56,7 +56,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  static bool
  mt7530_phy_mode_supported(struct dsa_switch *ds, int port,
  			  const struct phylink_link_state *state)
-@@ -2421,6 +2447,37 @@ static bool mt7531_is_rgmii_port(struct
+@@ -2480,6 +2506,37 @@ static bool mt7531_is_rgmii_port(struct
  	return (port == 5) && (priv->p5_intf_sel != P5_INTF_SEL_GMAC5_SGMII);
  }
  
@@ -94,7 +94,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  static bool
  mt7531_phy_mode_supported(struct dsa_switch *ds, int port,
  			  const struct phylink_link_state *state)
-@@ -2899,6 +2956,18 @@ mt7531_cpu_port_config(struct dsa_switch
+@@ -2956,6 +3013,18 @@ mt7531_cpu_port_config(struct dsa_switch
  	return 0;
  }
  
@@ -113,7 +113,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  static void
  mt7530_mac_port_validate(struct dsa_switch *ds, int port,
  			 unsigned long *supported)
-@@ -3134,6 +3203,7 @@ static const struct dsa_switch_ops mt753
+@@ -3191,6 +3260,7 @@ static const struct dsa_switch_ops mt753
  	.port_vlan_del		= mt7530_port_vlan_del,
  	.port_mirror_add	= mt753x_port_mirror_add,
  	.port_mirror_del	= mt753x_port_mirror_del,
@@ -121,7 +121,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	.phylink_validate	= mt753x_phylink_validate,
  	.phylink_mac_link_state	= mt753x_phylink_mac_link_state,
  	.phylink_mac_config	= mt753x_phylink_mac_config,
-@@ -3151,6 +3221,7 @@ static const struct mt753x_info mt753x_t
+@@ -3208,6 +3278,7 @@ static const struct mt753x_info mt753x_t
  		.phy_read = mt7530_phy_read,
  		.phy_write = mt7530_phy_write,
  		.pad_setup = mt7530_pad_clk_setup,
@@ -129,7 +129,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		.phy_mode_supported = mt7530_phy_mode_supported,
  		.mac_port_validate = mt7530_mac_port_validate,
  		.mac_port_get_state = mt7530_phylink_mac_link_state,
-@@ -3162,6 +3233,7 @@ static const struct mt753x_info mt753x_t
+@@ -3219,6 +3290,7 @@ static const struct mt753x_info mt753x_t
  		.phy_read = mt7530_phy_read,
  		.phy_write = mt7530_phy_write,
  		.pad_setup = mt7530_pad_clk_setup,
@@ -137,7 +137,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		.phy_mode_supported = mt7530_phy_mode_supported,
  		.mac_port_validate = mt7530_mac_port_validate,
  		.mac_port_get_state = mt7530_phylink_mac_link_state,
-@@ -3174,6 +3246,7 @@ static const struct mt753x_info mt753x_t
+@@ -3231,6 +3303,7 @@ static const struct mt753x_info mt753x_t
  		.phy_write = mt7531_ind_phy_write,
  		.pad_setup = mt7531_pad_setup,
  		.cpu_port_config = mt7531_cpu_port_config,
@@ -145,7 +145,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		.phy_mode_supported = mt7531_phy_mode_supported,
  		.mac_port_validate = mt7531_mac_port_validate,
  		.mac_port_get_state = mt7531_phylink_mac_link_state,
-@@ -3236,6 +3309,7 @@ mt7530_probe(struct mdio_device *mdiodev
+@@ -3293,6 +3366,7 @@ mt7530_probe(struct mdio_device *mdiodev
  	 */
  	if (!priv->info->sw_setup || !priv->info->pad_setup ||
  	    !priv->info->phy_read || !priv->info->phy_write ||
diff --git a/target/linux/generic/backport-5.15/705-03-v5.19-net-dsa-mt7530-remove-interface-checks.patch b/target/linux/generic/backport-5.15/705-03-v5.19-net-dsa-mt7530-remove-interface-checks.patch
index 60eee013d1a393..228016383d936d 100644
--- a/target/linux/generic/backport-5.15/705-03-v5.19-net-dsa-mt7530-remove-interface-checks.patch
+++ b/target/linux/generic/backport-5.15/705-03-v5.19-net-dsa-mt7530-remove-interface-checks.patch
@@ -21,7 +21,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2411,37 +2411,6 @@ static void mt7530_mac_port_get_caps(str
+@@ -2470,37 +2470,6 @@ static void mt7530_mac_port_get_caps(str
  	}
  }
  
@@ -59,7 +59,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  static bool mt7531_is_rgmii_port(struct mt7530_priv *priv, u32 port)
  {
  	return (port == 5) && (priv->p5_intf_sel != P5_INTF_SEL_GMAC5_SGMII);
-@@ -2478,44 +2447,6 @@ static void mt7531_mac_port_get_caps(str
+@@ -2537,44 +2506,6 @@ static void mt7531_mac_port_get_caps(str
  	}
  }
  
@@ -104,7 +104,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  static int
  mt753x_pad_setup(struct dsa_switch *ds, const struct phylink_link_state *state)
  {
-@@ -2770,9 +2701,6 @@ mt753x_phylink_mac_config(struct dsa_swi
+@@ -2829,9 +2760,6 @@ mt753x_phylink_mac_config(struct dsa_swi
  	struct mt7530_priv *priv = ds->priv;
  	u32 mcr_cur, mcr_new;
  
@@ -114,7 +114,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	switch (port) {
  	case 0 ... 4: /* Internal phy */
  		if (state->interface != PHY_INTERFACE_MODE_GMII)
-@@ -2990,12 +2918,6 @@ mt753x_phylink_validate(struct dsa_switc
+@@ -3047,12 +2975,6 @@ mt753x_phylink_validate(struct dsa_switc
  	__ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
  	struct mt7530_priv *priv = ds->priv;
  
@@ -127,7 +127,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	phylink_set_port_modes(mask);
  
  	if (state->interface != PHY_INTERFACE_MODE_TRGMII &&
-@@ -3222,7 +3144,6 @@ static const struct mt753x_info mt753x_t
+@@ -3279,7 +3201,6 @@ static const struct mt753x_info mt753x_t
  		.phy_write = mt7530_phy_write,
  		.pad_setup = mt7530_pad_clk_setup,
  		.mac_port_get_caps = mt7530_mac_port_get_caps,
@@ -135,7 +135,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		.mac_port_validate = mt7530_mac_port_validate,
  		.mac_port_get_state = mt7530_phylink_mac_link_state,
  		.mac_port_config = mt7530_mac_config,
-@@ -3234,7 +3155,6 @@ static const struct mt753x_info mt753x_t
+@@ -3291,7 +3212,6 @@ static const struct mt753x_info mt753x_t
  		.phy_write = mt7530_phy_write,
  		.pad_setup = mt7530_pad_clk_setup,
  		.mac_port_get_caps = mt7530_mac_port_get_caps,
@@ -143,7 +143,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		.mac_port_validate = mt7530_mac_port_validate,
  		.mac_port_get_state = mt7530_phylink_mac_link_state,
  		.mac_port_config = mt7530_mac_config,
-@@ -3247,7 +3167,6 @@ static const struct mt753x_info mt753x_t
+@@ -3304,7 +3224,6 @@ static const struct mt753x_info mt753x_t
  		.pad_setup = mt7531_pad_setup,
  		.cpu_port_config = mt7531_cpu_port_config,
  		.mac_port_get_caps = mt7531_mac_port_get_caps,
@@ -151,7 +151,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		.mac_port_validate = mt7531_mac_port_validate,
  		.mac_port_get_state = mt7531_phylink_mac_link_state,
  		.mac_port_config = mt7531_mac_config,
-@@ -3310,7 +3229,6 @@ mt7530_probe(struct mdio_device *mdiodev
+@@ -3367,7 +3286,6 @@ mt7530_probe(struct mdio_device *mdiodev
  	if (!priv->info->sw_setup || !priv->info->pad_setup ||
  	    !priv->info->phy_read || !priv->info->phy_write ||
  	    !priv->info->mac_port_get_caps ||
diff --git a/target/linux/generic/backport-5.15/705-04-v5.19-net-dsa-mt7530-drop-use-of-phylink_helper_basex_spee.patch b/target/linux/generic/backport-5.15/705-04-v5.19-net-dsa-mt7530-drop-use-of-phylink_helper_basex_spee.patch
index 22bb2068de0a61..1a1802a1670470 100644
--- a/target/linux/generic/backport-5.15/705-04-v5.19-net-dsa-mt7530-drop-use-of-phylink_helper_basex_spee.patch
+++ b/target/linux/generic/backport-5.15/705-04-v5.19-net-dsa-mt7530-drop-use-of-phylink_helper_basex_spee.patch
@@ -20,7 +20,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2942,11 +2942,6 @@ mt753x_phylink_validate(struct dsa_switc
+@@ -2999,11 +2999,6 @@ mt753x_phylink_validate(struct dsa_switc
  
  	linkmode_and(supported, supported, mask);
  	linkmode_and(state->advertising, state->advertising, mask);
diff --git a/target/linux/generic/backport-5.15/705-05-v5.19-net-dsa-mt7530-only-indicate-linkmodes-that-can-be-s.patch b/target/linux/generic/backport-5.15/705-05-v5.19-net-dsa-mt7530-only-indicate-linkmodes-that-can-be-s.patch
index d5d7c54974632f..636353c2d64640 100644
--- a/target/linux/generic/backport-5.15/705-05-v5.19-net-dsa-mt7530-only-indicate-linkmodes-that-can-be-s.patch
+++ b/target/linux/generic/backport-5.15/705-05-v5.19-net-dsa-mt7530-only-indicate-linkmodes-that-can-be-s.patch
@@ -23,7 +23,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2518,12 +2518,13 @@ static int mt7531_rgmii_setup(struct mt7
+@@ -2577,12 +2577,13 @@ static int mt7531_rgmii_setup(struct mt7
  }
  
  static void mt7531_sgmii_validate(struct mt7530_priv *priv, int port,
@@ -38,7 +38,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		phylink_set(supported, 2500baseX_Full);
  		phylink_set(supported, 2500baseT_Full);
  	}
-@@ -2898,16 +2899,18 @@ static void mt753x_phylink_get_caps(stru
+@@ -2955,16 +2956,18 @@ static void mt753x_phylink_get_caps(stru
  
  static void
  mt7530_mac_port_validate(struct dsa_switch *ds, int port,
@@ -58,7 +58,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  }
  
  static void
-@@ -2930,12 +2933,13 @@ mt753x_phylink_validate(struct dsa_switc
+@@ -2987,12 +2990,13 @@ mt753x_phylink_validate(struct dsa_switc
  	}
  
  	/* This switch only supports 1G full-duplex. */
diff --git a/target/linux/generic/backport-5.15/705-06-v5.19-net-dsa-mt7530-switch-to-use-phylink_get_linkmodes.patch b/target/linux/generic/backport-5.15/705-06-v5.19-net-dsa-mt7530-switch-to-use-phylink_get_linkmodes.patch
index 4a2c2f151d5f6f..4d7569b4ce374c 100644
--- a/target/linux/generic/backport-5.15/705-06-v5.19-net-dsa-mt7530-switch-to-use-phylink_get_linkmodes.patch
+++ b/target/linux/generic/backport-5.15/705-06-v5.19-net-dsa-mt7530-switch-to-use-phylink_get_linkmodes.patch
@@ -20,7 +20,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2517,19 +2517,6 @@ static int mt7531_rgmii_setup(struct mt7
+@@ -2576,19 +2576,6 @@ static int mt7531_rgmii_setup(struct mt7
  	return 0;
  }
  
@@ -40,7 +40,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  static void
  mt7531_sgmii_link_up_force(struct dsa_switch *ds, int port,
  			   unsigned int mode, phy_interface_t interface,
-@@ -2898,51 +2885,21 @@ static void mt753x_phylink_get_caps(stru
+@@ -2955,51 +2942,21 @@ static void mt753x_phylink_get_caps(stru
  }
  
  static void
@@ -97,7 +97,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  
  	linkmode_and(supported, supported, mask);
  	linkmode_and(state->advertising, state->advertising, mask);
-@@ -3143,7 +3100,6 @@ static const struct mt753x_info mt753x_t
+@@ -3200,7 +3157,6 @@ static const struct mt753x_info mt753x_t
  		.phy_write = mt7530_phy_write,
  		.pad_setup = mt7530_pad_clk_setup,
  		.mac_port_get_caps = mt7530_mac_port_get_caps,
@@ -105,7 +105,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		.mac_port_get_state = mt7530_phylink_mac_link_state,
  		.mac_port_config = mt7530_mac_config,
  	},
-@@ -3154,7 +3110,6 @@ static const struct mt753x_info mt753x_t
+@@ -3211,7 +3167,6 @@ static const struct mt753x_info mt753x_t
  		.phy_write = mt7530_phy_write,
  		.pad_setup = mt7530_pad_clk_setup,
  		.mac_port_get_caps = mt7530_mac_port_get_caps,
@@ -113,7 +113,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		.mac_port_get_state = mt7530_phylink_mac_link_state,
  		.mac_port_config = mt7530_mac_config,
  	},
-@@ -3166,7 +3121,6 @@ static const struct mt753x_info mt753x_t
+@@ -3223,7 +3178,6 @@ static const struct mt753x_info mt753x_t
  		.pad_setup = mt7531_pad_setup,
  		.cpu_port_config = mt7531_cpu_port_config,
  		.mac_port_get_caps = mt7531_mac_port_get_caps,
@@ -121,7 +121,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		.mac_port_get_state = mt7531_phylink_mac_link_state,
  		.mac_port_config = mt7531_mac_config,
  		.mac_pcs_an_restart = mt7531_sgmii_restart_an,
-@@ -3228,7 +3182,6 @@ mt7530_probe(struct mdio_device *mdiodev
+@@ -3285,7 +3239,6 @@ mt7530_probe(struct mdio_device *mdiodev
  	if (!priv->info->sw_setup || !priv->info->pad_setup ||
  	    !priv->info->phy_read || !priv->info->phy_write ||
  	    !priv->info->mac_port_get_caps ||
diff --git a/target/linux/generic/backport-5.15/705-07-v5.19-net-dsa-mt7530-partially-convert-to-phylink_pcs.patch b/target/linux/generic/backport-5.15/705-07-v5.19-net-dsa-mt7530-partially-convert-to-phylink_pcs.patch
index 8a66b7fb0bbeed..fdf2a964ccfce4 100644
--- a/target/linux/generic/backport-5.15/705-07-v5.19-net-dsa-mt7530-partially-convert-to-phylink_pcs.patch
+++ b/target/linux/generic/backport-5.15/705-07-v5.19-net-dsa-mt7530-partially-convert-to-phylink_pcs.patch
@@ -33,7 +33,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  /* String, offset, and register size in bytes if different from 4 bytes */
  static const struct mt7530_mib_desc mt7530_mib[] = {
  	MIB_DESC(1, 0x00, "TxDrop"),
-@@ -2517,12 +2522,11 @@ static int mt7531_rgmii_setup(struct mt7
+@@ -2576,12 +2581,11 @@ static int mt7531_rgmii_setup(struct mt7
  	return 0;
  }
  
@@ -50,7 +50,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	unsigned int val;
  
  	/* For adjusting speed and duplex of SGMII force mode. */
-@@ -2548,6 +2552,9 @@ mt7531_sgmii_link_up_force(struct dsa_sw
+@@ -2607,6 +2611,9 @@ mt7531_sgmii_link_up_force(struct dsa_sw
  
  	/* MT7531 SGMII 1G force mode can only work in full duplex mode,
  	 * no matter MT7531_SGMII_FORCE_HALF_DUPLEX is set or not.
@@ -60,7 +60,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	 */
  	if ((speed == SPEED_10 || speed == SPEED_100) &&
  	    duplex != DUPLEX_FULL)
-@@ -2623,9 +2630,10 @@ static int mt7531_sgmii_setup_mode_an(st
+@@ -2682,9 +2689,10 @@ static int mt7531_sgmii_setup_mode_an(st
  	return 0;
  }
  
@@ -73,7 +73,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	u32 val;
  
  	/* Only restart AN when AN is enabled */
-@@ -2682,6 +2690,24 @@ mt753x_mac_config(struct dsa_switch *ds,
+@@ -2741,6 +2749,24 @@ mt753x_mac_config(struct dsa_switch *ds,
  	return priv->info->mac_port_config(ds, port, mode, state->interface);
  }
  
@@ -98,7 +98,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  static void
  mt753x_phylink_mac_config(struct dsa_switch *ds, int port, unsigned int mode,
  			  const struct phylink_link_state *state)
-@@ -2743,17 +2769,6 @@ unsupported:
+@@ -2802,17 +2828,6 @@ unsupported:
  		mt7530_write(priv, MT7530_PMCR_P(port), mcr_new);
  }
  
@@ -116,7 +116,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  static void mt753x_phylink_mac_link_down(struct dsa_switch *ds, int port,
  					 unsigned int mode,
  					 phy_interface_t interface)
-@@ -2763,16 +2778,13 @@ static void mt753x_phylink_mac_link_down
+@@ -2822,16 +2837,13 @@ static void mt753x_phylink_mac_link_down
  	mt7530_clear(priv, MT7530_PMCR_P(port), PMCR_LINK_SETTINGS_MASK);
  }
  
@@ -139,7 +139,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  }
  
  static void mt753x_phylink_mac_link_up(struct dsa_switch *ds, int port,
-@@ -2785,8 +2797,6 @@ static void mt753x_phylink_mac_link_up(s
+@@ -2844,8 +2856,6 @@ static void mt753x_phylink_mac_link_up(s
  	struct mt7530_priv *priv = ds->priv;
  	u32 mcr;
  
@@ -148,7 +148,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	mcr = PMCR_RX_EN | PMCR_TX_EN | PMCR_FORCE_LNK;
  
  	/* MT753x MAC works in 1G full duplex mode for all up-clocked
-@@ -2866,6 +2876,8 @@ mt7531_cpu_port_config(struct dsa_switch
+@@ -2923,6 +2933,8 @@ mt7531_cpu_port_config(struct dsa_switch
  		return ret;
  	mt7530_write(priv, MT7530_PMCR_P(port),
  		     PMCR_CPU_PORT_SETTING(priv->id));
@@ -157,7 +157,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	mt753x_phylink_mac_link_up(ds, port, MLO_AN_FIXED, interface, NULL,
  				   speed, DUPLEX_FULL, true, true);
  
-@@ -2905,16 +2917,13 @@ mt753x_phylink_validate(struct dsa_switc
+@@ -2962,16 +2974,13 @@ mt753x_phylink_validate(struct dsa_switc
  	linkmode_and(state->advertising, state->advertising, mask);
  }
  
@@ -178,7 +178,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	pmsr = mt7530_read(priv, MT7530_PMSR_P(port));
  
  	state->link = (pmsr & PMSR_LINK);
-@@ -2941,8 +2950,6 @@ mt7530_phylink_mac_link_state(struct dsa
+@@ -2998,8 +3007,6 @@ mt7530_phylink_mac_link_state(struct dsa
  		state->pause |= MLO_PAUSE_RX;
  	if (pmsr & PMSR_TX_FC)
  		state->pause |= MLO_PAUSE_TX;
@@ -187,7 +187,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  }
  
  static int
-@@ -2984,32 +2991,49 @@ mt7531_sgmii_pcs_get_state_an(struct mt7
+@@ -3041,32 +3048,49 @@ mt7531_sgmii_pcs_get_state_an(struct mt7
  	return 0;
  }
  
@@ -249,7 +249,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  
  	if (ret)
  		return ret;
-@@ -3022,6 +3046,13 @@ mt753x_setup(struct dsa_switch *ds)
+@@ -3079,6 +3103,13 @@ mt753x_setup(struct dsa_switch *ds)
  	if (ret && priv->irq)
  		mt7530_free_irq_common(priv);
  
@@ -263,7 +263,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	return ret;
  }
  
-@@ -3083,9 +3114,8 @@ static const struct dsa_switch_ops mt753
+@@ -3140,9 +3171,8 @@ static const struct dsa_switch_ops mt753
  	.port_mirror_del	= mt753x_port_mirror_del,
  	.phylink_get_caps	= mt753x_phylink_get_caps,
  	.phylink_validate	= mt753x_phylink_validate,
@@ -274,7 +274,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	.phylink_mac_link_down	= mt753x_phylink_mac_link_down,
  	.phylink_mac_link_up	= mt753x_phylink_mac_link_up,
  	.get_mac_eee		= mt753x_get_mac_eee,
-@@ -3095,36 +3125,34 @@ static const struct dsa_switch_ops mt753
+@@ -3152,36 +3182,34 @@ static const struct dsa_switch_ops mt753
  static const struct mt753x_info mt753x_table[] = {
  	[ID_MT7621] = {
  		.id = ID_MT7621,
@@ -314,7 +314,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	},
  };
  
-@@ -3182,7 +3210,7 @@ mt7530_probe(struct mdio_device *mdiodev
+@@ -3239,7 +3267,7 @@ mt7530_probe(struct mdio_device *mdiodev
  	if (!priv->info->sw_setup || !priv->info->pad_setup ||
  	    !priv->info->phy_read || !priv->info->phy_write ||
  	    !priv->info->mac_port_get_caps ||
diff --git a/target/linux/generic/backport-5.15/705-08-v5.19-net-dsa-mt7530-move-autoneg-handling-to-PCS-validati.patch b/target/linux/generic/backport-5.15/705-08-v5.19-net-dsa-mt7530-move-autoneg-handling-to-PCS-validati.patch
index 2d8b4d5d571242..7b2fa36699bf67 100644
--- a/target/linux/generic/backport-5.15/705-08-v5.19-net-dsa-mt7530-move-autoneg-handling-to-PCS-validati.patch
+++ b/target/linux/generic/backport-5.15/705-08-v5.19-net-dsa-mt7530-move-autoneg-handling-to-PCS-validati.patch
@@ -20,7 +20,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2896,25 +2896,16 @@ static void mt753x_phylink_get_caps(stru
+@@ -2953,25 +2953,16 @@ static void mt753x_phylink_get_caps(stru
  	priv->info->mac_port_get_caps(ds, port, config);
  }
  
@@ -55,7 +55,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  }
  
  static void mt7530_pcs_get_state(struct phylink_pcs *pcs,
-@@ -3016,12 +3007,14 @@ static void mt7530_pcs_an_restart(struct
+@@ -3073,12 +3064,14 @@ static void mt7530_pcs_an_restart(struct
  }
  
  static const struct phylink_pcs_ops mt7530_pcs_ops = {
@@ -70,7 +70,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	.pcs_get_state = mt7531_pcs_get_state,
  	.pcs_config = mt753x_pcs_config,
  	.pcs_an_restart = mt7531_pcs_an_restart,
-@@ -3113,7 +3106,6 @@ static const struct dsa_switch_ops mt753
+@@ -3170,7 +3163,6 @@ static const struct dsa_switch_ops mt753
  	.port_mirror_add	= mt753x_port_mirror_add,
  	.port_mirror_del	= mt753x_port_mirror_del,
  	.phylink_get_caps	= mt753x_phylink_get_caps,
diff --git a/target/linux/generic/backport-5.15/705-09-v5.19-net-dsa-mt7530-mark-as-non-legacy.patch b/target/linux/generic/backport-5.15/705-09-v5.19-net-dsa-mt7530-mark-as-non-legacy.patch
index 849a9925a157f3..8bb587f5f57d69 100644
--- a/target/linux/generic/backport-5.15/705-09-v5.19-net-dsa-mt7530-mark-as-non-legacy.patch
+++ b/target/linux/generic/backport-5.15/705-09-v5.19-net-dsa-mt7530-mark-as-non-legacy.patch
@@ -19,7 +19,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2893,6 +2893,12 @@ static void mt753x_phylink_get_caps(stru
+@@ -2950,6 +2950,12 @@ static void mt753x_phylink_get_caps(stru
  	config->mac_capabilities = MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
  				   MAC_10 | MAC_100 | MAC_1000FD;
  
diff --git a/target/linux/generic/backport-5.15/705-10-v5.19-net-dsa-mt753x-fix-pcs-conversion-regression.patch b/target/linux/generic/backport-5.15/705-10-v5.19-net-dsa-mt753x-fix-pcs-conversion-regression.patch
index 89f6e7509b2180..438c02ade6fcae 100644
--- a/target/linux/generic/backport-5.15/705-10-v5.19-net-dsa-mt753x-fix-pcs-conversion-regression.patch
+++ b/target/linux/generic/backport-5.15/705-10-v5.19-net-dsa-mt753x-fix-pcs-conversion-regression.patch
@@ -81,7 +81,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -3031,9 +3031,16 @@ static int
+@@ -3088,9 +3088,16 @@ static int
  mt753x_setup(struct dsa_switch *ds)
  {
  	struct mt7530_priv *priv = ds->priv;
@@ -100,7 +100,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	if (ret)
  		return ret;
  
-@@ -3045,13 +3052,6 @@ mt753x_setup(struct dsa_switch *ds)
+@@ -3102,13 +3109,6 @@ mt753x_setup(struct dsa_switch *ds)
  	if (ret && priv->irq)
  		mt7530_free_irq_common(priv);
  
diff --git a/target/linux/generic/backport-5.15/705-11-v6.0-net-dsa-mt7530-rework-mt7530_hw_vlan_-add-del.patch b/target/linux/generic/backport-5.15/705-11-v6.0-net-dsa-mt7530-rework-mt7530_hw_vlan_-add-del.patch
index 77b4fa11023d34..26d207ca6ab75f 100644
--- a/target/linux/generic/backport-5.15/705-11-v6.0-net-dsa-mt7530-rework-mt7530_hw_vlan_-add-del.patch
+++ b/target/linux/generic/backport-5.15/705-11-v6.0-net-dsa-mt7530-rework-mt7530_hw_vlan_-add-del.patch
@@ -26,7 +26,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -1522,11 +1522,11 @@ static void
+@@ -1536,11 +1536,11 @@ static void
  mt7530_hw_vlan_add(struct mt7530_priv *priv,
  		   struct mt7530_hw_vlan_entry *entry)
  {
@@ -40,7 +40,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  
  	/* Validate the entry with independent learning, create egress tag per
  	 * VLAN and joining the port as one of the port members.
-@@ -1537,22 +1537,20 @@ mt7530_hw_vlan_add(struct mt7530_priv *p
+@@ -1551,22 +1551,20 @@ mt7530_hw_vlan_add(struct mt7530_priv *p
  
  	/* Decide whether adding tag or not for those outgoing packets from the
  	 * port inside the VLAN.
@@ -72,7 +72,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  }
  
  static void
-@@ -1571,11 +1569,7 @@ mt7530_hw_vlan_del(struct mt7530_priv *p
+@@ -1585,11 +1583,7 @@ mt7530_hw_vlan_del(struct mt7530_priv *p
  		return;
  	}
  
diff --git a/target/linux/generic/backport-5.15/705-13-v6.0-net-dsa-mt7530-get-cpu-port-via-dp-cpu_dp-instead-of.patch b/target/linux/generic/backport-5.15/705-13-v6.0-net-dsa-mt7530-get-cpu-port-via-dp-cpu_dp-instead-of.patch
index 3b5ce7363fcc37..2bfa1ef438e732 100644
--- a/target/linux/generic/backport-5.15/705-13-v6.0-net-dsa-mt7530-get-cpu-port-via-dp-cpu_dp-instead-of.patch
+++ b/target/linux/generic/backport-5.15/705-13-v6.0-net-dsa-mt7530-get-cpu-port-via-dp-cpu_dp-instead-of.patch
@@ -21,7 +21,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -1038,6 +1038,7 @@ static int
+@@ -1040,6 +1040,7 @@ static int
  mt7530_port_enable(struct dsa_switch *ds, int port,
  		   struct phy_device *phy)
  {
@@ -29,7 +29,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	struct mt7530_priv *priv = ds->priv;
  
  	mutex_lock(&priv->reg_mutex);
-@@ -1046,7 +1047,11 @@ mt7530_port_enable(struct dsa_switch *ds
+@@ -1048,7 +1049,11 @@ mt7530_port_enable(struct dsa_switch *ds
  	 * restore the port matrix if the port is the member of a certain
  	 * bridge.
  	 */
@@ -42,7 +42,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	priv->ports[port].enable = true;
  	mt7530_rmw(priv, MT7530_PCR_P(port), PCR_MATRIX_MASK,
  		   priv->ports[port].pm);
-@@ -1194,7 +1199,8 @@ mt7530_port_bridge_join(struct dsa_switc
+@@ -1196,7 +1201,8 @@ mt7530_port_bridge_join(struct dsa_switc
  			struct net_device *bridge)
  {
  	struct dsa_port *dp = dsa_to_port(ds, port), *other_dp;
@@ -52,7 +52,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	struct mt7530_priv *priv = ds->priv;
  
  	mutex_lock(&priv->reg_mutex);
-@@ -1271,9 +1277,12 @@ mt7530_port_set_vlan_unaware(struct dsa_
+@@ -1273,9 +1279,12 @@ mt7530_port_set_vlan_unaware(struct dsa_
  	 * the CPU port get out of VLAN filtering mode.
  	 */
  	if (all_user_ports_removed) {
@@ -67,7 +67,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  			     | PVC_EG_TAG(MT7530_VLAN_EG_CONSISTENT));
  	}
  }
-@@ -1311,6 +1320,7 @@ mt7530_port_bridge_leave(struct dsa_swit
+@@ -1325,6 +1334,7 @@ mt7530_port_bridge_leave(struct dsa_swit
  			 struct net_device *bridge)
  {
  	struct dsa_port *dp = dsa_to_port(ds, port), *other_dp;
@@ -75,7 +75,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	struct mt7530_priv *priv = ds->priv;
  
  	mutex_lock(&priv->reg_mutex);
-@@ -1339,8 +1349,8 @@ mt7530_port_bridge_leave(struct dsa_swit
+@@ -1353,8 +1363,8 @@ mt7530_port_bridge_leave(struct dsa_swit
  	 */
  	if (priv->ports[port].enable)
  		mt7530_rmw(priv, MT7530_PCR_P(port), PCR_MATRIX_MASK,
@@ -86,7 +86,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  
  	/* When a port is removed from the bridge, the port would be set up
  	 * back to the default as is at initial boot which is a VLAN-unaware
-@@ -1503,6 +1513,9 @@ static int
+@@ -1517,6 +1527,9 @@ static int
  mt7530_port_vlan_filtering(struct dsa_switch *ds, int port, bool vlan_filtering,
  			   struct netlink_ext_ack *extack)
  {
@@ -96,7 +96,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	if (vlan_filtering) {
  		/* The port is being kept as VLAN-unaware port when bridge is
  		 * set up with vlan_filtering not being set, Otherwise, the
-@@ -1510,7 +1523,7 @@ mt7530_port_vlan_filtering(struct dsa_sw
+@@ -1524,7 +1537,7 @@ mt7530_port_vlan_filtering(struct dsa_sw
  		 * for becoming a VLAN-aware port.
  		 */
  		mt7530_port_set_vlan_aware(ds, port);
diff --git a/target/linux/generic/backport-5.15/706-00-v6.0-net-ethernet-mtk_eth_soc-rely-on-page_pool-for-singl.patch b/target/linux/generic/backport-5.15/706-00-v6.0-net-ethernet-mtk_eth_soc-rely-on-page_pool-for-singl.patch
new file mode 100644
index 00000000000000..c5501fb04023da
--- /dev/null
+++ b/target/linux/generic/backport-5.15/706-00-v6.0-net-ethernet-mtk_eth_soc-rely-on-page_pool-for-singl.patch
@@ -0,0 +1,330 @@
+From 23233e577ef973c2c5d0dd757a0a4605e34ecb57 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 22 Jul 2022 09:19:36 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: rely on page_pool for single page
+ buffers
+
+Rely on page_pool allocator for single page buffers in order to keep
+them dma mapped and add skb recycling support.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/mediatek/Kconfig       |   1 +
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 185 +++++++++++++++-----
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h |  10 ++
+ 3 files changed, 156 insertions(+), 40 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/Kconfig
++++ b/drivers/net/ethernet/mediatek/Kconfig
+@@ -16,6 +16,7 @@ config NET_MEDIATEK_SOC
+ 	depends on NET_DSA || !NET_DSA
+ 	select PHYLINK
+ 	select DIMLIB
++	select PAGE_POOL
+ 	help
+ 	  This driver supports the gigabit ethernet MACs in the
+ 	  MediaTek SoC family.
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1389,6 +1389,68 @@ static void mtk_update_rx_cpu_idx(struct
+ 	}
+ }
+ 
++static struct page_pool *mtk_create_page_pool(struct mtk_eth *eth,
++					      struct xdp_rxq_info *xdp_q,
++					      int id, int size)
++{
++	struct page_pool_params pp_params = {
++		.order = 0,
++		.flags = PP_FLAG_DMA_MAP | PP_FLAG_DMA_SYNC_DEV,
++		.pool_size = size,
++		.nid = NUMA_NO_NODE,
++		.dev = eth->dma_dev,
++		.dma_dir = DMA_FROM_DEVICE,
++		.offset = MTK_PP_HEADROOM,
++		.max_len = MTK_PP_MAX_BUF_SIZE,
++	};
++	struct page_pool *pp;
++	int err;
++
++	pp = page_pool_create(&pp_params);
++	if (IS_ERR(pp))
++		return pp;
++
++	err = xdp_rxq_info_reg(xdp_q, &eth->dummy_dev, id,
++				eth->rx_napi.napi_id);
++	if (err < 0)
++		goto err_free_pp;
++
++	err = xdp_rxq_info_reg_mem_model(xdp_q, MEM_TYPE_PAGE_POOL, pp);
++	if (err)
++		goto err_unregister_rxq;
++
++	return pp;
++
++err_unregister_rxq:
++	xdp_rxq_info_unreg(xdp_q);
++err_free_pp:
++	page_pool_destroy(pp);
++
++	return ERR_PTR(err);
++}
++
++static void *mtk_page_pool_get_buff(struct page_pool *pp, dma_addr_t *dma_addr,
++				    gfp_t gfp_mask)
++{
++	struct page *page;
++
++	page = page_pool_alloc_pages(pp, gfp_mask | __GFP_NOWARN);
++	if (!page)
++		return NULL;
++
++	*dma_addr = page_pool_get_dma_addr(page) + MTK_PP_HEADROOM;
++	return page_address(page);
++}
++
++static void mtk_rx_put_buff(struct mtk_rx_ring *ring, void *data, bool napi)
++{
++	if (ring->page_pool)
++		page_pool_put_full_page(ring->page_pool,
++					virt_to_head_page(data), napi);
++	else
++		skb_free_frag(data);
++}
++
+ static int mtk_poll_rx(struct napi_struct *napi, int budget,
+ 		       struct mtk_eth *eth)
+ {
+@@ -1402,9 +1464,9 @@ static int mtk_poll_rx(struct napi_struc
+ 
+ 	while (done < budget) {
+ 		unsigned int pktlen, *rxdcsum;
++		u32 hash, reason, reserve_len;
+ 		struct net_device *netdev;
+ 		dma_addr_t dma_addr;
+-		u32 hash, reason;
+ 		int mac = 0;
+ 
+ 		ring = mtk_get_rx_ring(eth);
+@@ -1435,36 +1497,54 @@ static int mtk_poll_rx(struct napi_struc
+ 			goto release_desc;
+ 
+ 		/* alloc new buffer */
+-		if (ring->frag_size <= PAGE_SIZE)
+-			new_data = napi_alloc_frag(ring->frag_size);
+-		else
+-			new_data = mtk_max_lro_buf_alloc(GFP_ATOMIC);
+-		if (unlikely(!new_data)) {
+-			netdev->stats.rx_dropped++;
+-			goto release_desc;
+-		}
+-		dma_addr = dma_map_single(eth->dma_dev,
+-					  new_data + NET_SKB_PAD +
+-					  eth->ip_align,
+-					  ring->buf_size,
+-					  DMA_FROM_DEVICE);
+-		if (unlikely(dma_mapping_error(eth->dma_dev, dma_addr))) {
+-			skb_free_frag(new_data);
+-			netdev->stats.rx_dropped++;
+-			goto release_desc;
+-		}
++		if (ring->page_pool) {
++			new_data = mtk_page_pool_get_buff(ring->page_pool,
++							  &dma_addr,
++							  GFP_ATOMIC);
++			if (unlikely(!new_data)) {
++				netdev->stats.rx_dropped++;
++				goto release_desc;
++			}
++		} else {
++			if (ring->frag_size <= PAGE_SIZE)
++				new_data = napi_alloc_frag(ring->frag_size);
++			else
++				new_data = mtk_max_lro_buf_alloc(GFP_ATOMIC);
++
++			if (unlikely(!new_data)) {
++				netdev->stats.rx_dropped++;
++				goto release_desc;
++			}
+ 
+-		dma_unmap_single(eth->dma_dev, trxd.rxd1,
+-				 ring->buf_size, DMA_FROM_DEVICE);
++			dma_addr = dma_map_single(eth->dma_dev,
++				new_data + NET_SKB_PAD + eth->ip_align,
++				ring->buf_size, DMA_FROM_DEVICE);
++			if (unlikely(dma_mapping_error(eth->dma_dev,
++						       dma_addr))) {
++				skb_free_frag(new_data);
++				netdev->stats.rx_dropped++;
++				goto release_desc;
++			}
++
++			dma_unmap_single(eth->dma_dev, trxd.rxd1,
++					 ring->buf_size, DMA_FROM_DEVICE);
++		}
+ 
+ 		/* receive data */
+ 		skb = build_skb(data, ring->frag_size);
+ 		if (unlikely(!skb)) {
+-			skb_free_frag(data);
++			mtk_rx_put_buff(ring, data, true);
+ 			netdev->stats.rx_dropped++;
+ 			goto skip_rx;
+ 		}
+-		skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN);
++
++		if (ring->page_pool) {
++			reserve_len = MTK_PP_HEADROOM;
++			skb_mark_for_recycle(skb);
++		} else {
++			reserve_len = NET_SKB_PAD + NET_IP_ALIGN;
++		}
++		skb_reserve(skb, reserve_len);
+ 
+ 		pktlen = RX_DMA_GET_PLEN0(trxd.rxd2);
+ 		skb->dev = netdev;
+@@ -1518,7 +1598,6 @@ static int mtk_poll_rx(struct napi_struc
+ skip_rx:
+ 		ring->data[idx] = new_data;
+ 		rxd->rxd1 = (unsigned int)dma_addr;
+-
+ release_desc:
+ 		if (MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628))
+ 			rxd->rxd2 = RX_DMA_LSO;
+@@ -1526,7 +1605,6 @@ release_desc:
+ 			rxd->rxd2 = RX_DMA_PREP_PLEN0(ring->buf_size);
+ 
+ 		ring->calc_idx = idx;
+-
+ 		done++;
+ 	}
+ 
+@@ -1890,13 +1968,15 @@ static int mtk_rx_alloc(struct mtk_eth *
+ 	if (!ring->data)
+ 		return -ENOMEM;
+ 
+-	for (i = 0; i < rx_dma_size; i++) {
+-		if (ring->frag_size <= PAGE_SIZE)
+-			ring->data[i] = netdev_alloc_frag(ring->frag_size);
+-		else
+-			ring->data[i] = mtk_max_lro_buf_alloc(GFP_KERNEL);
+-		if (!ring->data[i])
+-			return -ENOMEM;
++	if (!eth->hwlro) {
++		struct page_pool *pp;
++
++		pp = mtk_create_page_pool(eth, &ring->xdp_q, ring_no,
++					  rx_dma_size);
++		if (IS_ERR(pp))
++			return PTR_ERR(pp);
++
++		ring->page_pool = pp;
+ 	}
+ 
+ 	ring->dma = dma_alloc_coherent(eth->dma_dev,
+@@ -1907,16 +1987,33 @@ static int mtk_rx_alloc(struct mtk_eth *
+ 
+ 	for (i = 0; i < rx_dma_size; i++) {
+ 		struct mtk_rx_dma_v2 *rxd;
+-
+-		dma_addr_t dma_addr = dma_map_single(eth->dma_dev,
+-				ring->data[i] + NET_SKB_PAD + eth->ip_align,
+-				ring->buf_size,
+-				DMA_FROM_DEVICE);
+-		if (unlikely(dma_mapping_error(eth->dma_dev, dma_addr)))
+-			return -ENOMEM;
++		dma_addr_t dma_addr;
++		void *data;
+ 
+ 		rxd = ring->dma + i * eth->soc->txrx.rxd_size;
++		if (ring->page_pool) {
++			data = mtk_page_pool_get_buff(ring->page_pool,
++						      &dma_addr, GFP_KERNEL);
++			if (!data)
++				return -ENOMEM;
++		} else {
++			if (ring->frag_size <= PAGE_SIZE)
++				data = netdev_alloc_frag(ring->frag_size);
++			else
++				data = mtk_max_lro_buf_alloc(GFP_KERNEL);
++
++			if (!data)
++				return -ENOMEM;
++
++			dma_addr = dma_map_single(eth->dma_dev,
++				data + NET_SKB_PAD + eth->ip_align,
++				ring->buf_size, DMA_FROM_DEVICE);
++			if (unlikely(dma_mapping_error(eth->dma_dev,
++						       dma_addr)))
++				return -ENOMEM;
++		}
+ 		rxd->rxd1 = (unsigned int)dma_addr;
++		ring->data[i] = data;
+ 
+ 		if (MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628))
+ 			rxd->rxd2 = RX_DMA_LSO;
+@@ -1932,6 +2029,7 @@ static int mtk_rx_alloc(struct mtk_eth *
+ 			rxd->rxd8 = 0;
+ 		}
+ 	}
++
+ 	ring->dma_size = rx_dma_size;
+ 	ring->calc_idx_update = false;
+ 	ring->calc_idx = rx_dma_size - 1;
+@@ -1983,7 +2081,7 @@ static void mtk_rx_clean(struct mtk_eth
+ 
+ 			dma_unmap_single(eth->dma_dev, rxd->rxd1,
+ 					 ring->buf_size, DMA_FROM_DEVICE);
+-			skb_free_frag(ring->data[i]);
++			mtk_rx_put_buff(ring, ring->data[i], false);
+ 		}
+ 		kfree(ring->data);
+ 		ring->data = NULL;
+@@ -1995,6 +2093,13 @@ static void mtk_rx_clean(struct mtk_eth
+ 				  ring->dma, ring->phys);
+ 		ring->dma = NULL;
+ 	}
++
++	if (ring->page_pool) {
++		if (xdp_rxq_info_is_reg(&ring->xdp_q))
++			xdp_rxq_info_unreg(&ring->xdp_q);
++		page_pool_destroy(ring->page_pool);
++		ring->page_pool = NULL;
++	}
+ }
+ 
+ static int mtk_hwlro_rx_init(struct mtk_eth *eth)
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -18,6 +18,8 @@
+ #include <linux/rhashtable.h>
+ #include <linux/dim.h>
+ #include <linux/bitfield.h>
++#include <net/page_pool.h>
++#include <linux/bpf_trace.h>
+ #include "mtk_ppe.h"
+ 
+ #define MTK_QDMA_PAGE_SIZE	2048
+@@ -49,6 +51,11 @@
+ #define MTK_HW_FEATURES_MT7628	(NETIF_F_SG | NETIF_F_RXCSUM)
+ #define NEXT_DESP_IDX(X, Y)	(((X) + 1) & ((Y) - 1))
+ 
++#define MTK_PP_HEADROOM		XDP_PACKET_HEADROOM
++#define MTK_PP_PAD		(MTK_PP_HEADROOM + \
++				 SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
++#define MTK_PP_MAX_BUF_SIZE	(PAGE_SIZE - MTK_PP_PAD)
++
+ #define MTK_QRX_OFFSET		0x10
+ 
+ #define MTK_MAX_RX_RING_NUM	4
+@@ -743,6 +750,9 @@ struct mtk_rx_ring {
+ 	bool calc_idx_update;
+ 	u16 calc_idx;
+ 	u32 crx_idx_reg;
++	/* page_pool */
++	struct page_pool *page_pool;
++	struct xdp_rxq_info xdp_q;
+ };
+ 
+ enum mkt_eth_capabilities {
diff --git a/target/linux/generic/backport-5.15/706-01-v6.0-net-ethernet-mtk_eth_soc-add-basic-XDP-support.patch b/target/linux/generic/backport-5.15/706-01-v6.0-net-ethernet-mtk_eth_soc-add-basic-XDP-support.patch
new file mode 100644
index 00000000000000..d94bdabd714f15
--- /dev/null
+++ b/target/linux/generic/backport-5.15/706-01-v6.0-net-ethernet-mtk_eth_soc-add-basic-XDP-support.patch
@@ -0,0 +1,291 @@
+From 7c26c20da5d420cde55618263be4aa2f6de53056 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 22 Jul 2022 09:19:37 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: add basic XDP support
+
+Introduce basic XDP support to mtk_eth_soc driver.
+Supported XDP verdicts:
+- XDP_PASS
+- XDP_DROP
+- XDP_REDIRECT
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 162 +++++++++++++++++---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h |   2 +
+ 2 files changed, 145 insertions(+), 19 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1389,6 +1389,11 @@ static void mtk_update_rx_cpu_idx(struct
+ 	}
+ }
+ 
++static bool mtk_page_pool_enabled(struct mtk_eth *eth)
++{
++	return !eth->hwlro;
++}
++
+ static struct page_pool *mtk_create_page_pool(struct mtk_eth *eth,
+ 					      struct xdp_rxq_info *xdp_q,
+ 					      int id, int size)
+@@ -1451,11 +1456,52 @@ static void mtk_rx_put_buff(struct mtk_r
+ 		skb_free_frag(data);
+ }
+ 
++static u32 mtk_xdp_run(struct mtk_eth *eth, struct mtk_rx_ring *ring,
++		       struct xdp_buff *xdp, struct net_device *dev)
++{
++	struct bpf_prog *prog;
++	u32 act = XDP_PASS;
++
++	rcu_read_lock();
++
++	prog = rcu_dereference(eth->prog);
++	if (!prog)
++		goto out;
++
++	act = bpf_prog_run_xdp(prog, xdp);
++	switch (act) {
++	case XDP_PASS:
++		goto out;
++	case XDP_REDIRECT:
++		if (unlikely(xdp_do_redirect(dev, xdp, prog))) {
++			act = XDP_DROP;
++			break;
++		}
++		goto out;
++	default:
++		bpf_warn_invalid_xdp_action(act);
++		fallthrough;
++	case XDP_ABORTED:
++		trace_xdp_exception(dev, prog, act);
++		fallthrough;
++	case XDP_DROP:
++		break;
++	}
++
++	page_pool_put_full_page(ring->page_pool,
++				virt_to_head_page(xdp->data), true);
++out:
++	rcu_read_unlock();
++
++	return act;
++}
++
+ static int mtk_poll_rx(struct napi_struct *napi, int budget,
+ 		       struct mtk_eth *eth)
+ {
+ 	struct dim_sample dim_sample = {};
+ 	struct mtk_rx_ring *ring;
++	bool xdp_flush = false;
+ 	int idx;
+ 	struct sk_buff *skb;
+ 	u8 *data, *new_data;
+@@ -1464,9 +1510,9 @@ static int mtk_poll_rx(struct napi_struc
+ 
+ 	while (done < budget) {
+ 		unsigned int pktlen, *rxdcsum;
+-		u32 hash, reason, reserve_len;
+ 		struct net_device *netdev;
+ 		dma_addr_t dma_addr;
++		u32 hash, reason;
+ 		int mac = 0;
+ 
+ 		ring = mtk_get_rx_ring(eth);
+@@ -1496,8 +1542,14 @@ static int mtk_poll_rx(struct napi_struc
+ 		if (unlikely(test_bit(MTK_RESETTING, &eth->state)))
+ 			goto release_desc;
+ 
++		pktlen = RX_DMA_GET_PLEN0(trxd.rxd2);
++
+ 		/* alloc new buffer */
+ 		if (ring->page_pool) {
++			struct page *page = virt_to_head_page(data);
++			struct xdp_buff xdp;
++			u32 ret;
++
+ 			new_data = mtk_page_pool_get_buff(ring->page_pool,
+ 							  &dma_addr,
+ 							  GFP_ATOMIC);
+@@ -1505,6 +1557,34 @@ static int mtk_poll_rx(struct napi_struc
+ 				netdev->stats.rx_dropped++;
+ 				goto release_desc;
+ 			}
++
++			dma_sync_single_for_cpu(eth->dma_dev,
++				page_pool_get_dma_addr(page) + MTK_PP_HEADROOM,
++				pktlen, page_pool_get_dma_dir(ring->page_pool));
++
++			xdp_init_buff(&xdp, PAGE_SIZE, &ring->xdp_q);
++			xdp_prepare_buff(&xdp, data, MTK_PP_HEADROOM, pktlen,
++					 false);
++			xdp_buff_clear_frags_flag(&xdp);
++
++			ret = mtk_xdp_run(eth, ring, &xdp, netdev);
++			if (ret == XDP_REDIRECT)
++				xdp_flush = true;
++
++			if (ret != XDP_PASS)
++				goto skip_rx;
++
++			skb = build_skb(data, PAGE_SIZE);
++			if (unlikely(!skb)) {
++				page_pool_put_full_page(ring->page_pool,
++							page, true);
++				netdev->stats.rx_dropped++;
++				goto skip_rx;
++			}
++
++			skb_reserve(skb, xdp.data - xdp.data_hard_start);
++			skb_put(skb, xdp.data_end - xdp.data);
++			skb_mark_for_recycle(skb);
+ 		} else {
+ 			if (ring->frag_size <= PAGE_SIZE)
+ 				new_data = napi_alloc_frag(ring->frag_size);
+@@ -1528,27 +1608,20 @@ static int mtk_poll_rx(struct napi_struc
+ 
+ 			dma_unmap_single(eth->dma_dev, trxd.rxd1,
+ 					 ring->buf_size, DMA_FROM_DEVICE);
+-		}
+ 
+-		/* receive data */
+-		skb = build_skb(data, ring->frag_size);
+-		if (unlikely(!skb)) {
+-			mtk_rx_put_buff(ring, data, true);
+-			netdev->stats.rx_dropped++;
+-			goto skip_rx;
+-		}
++			skb = build_skb(data, ring->frag_size);
++			if (unlikely(!skb)) {
++				netdev->stats.rx_dropped++;
++				skb_free_frag(data);
++				goto skip_rx;
++			}
+ 
+-		if (ring->page_pool) {
+-			reserve_len = MTK_PP_HEADROOM;
+-			skb_mark_for_recycle(skb);
+-		} else {
+-			reserve_len = NET_SKB_PAD + NET_IP_ALIGN;
++			skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN);
++			skb_put(skb, pktlen);
+ 		}
+-		skb_reserve(skb, reserve_len);
+ 
+-		pktlen = RX_DMA_GET_PLEN0(trxd.rxd2);
+ 		skb->dev = netdev;
+-		skb_put(skb, pktlen);
++		bytes += skb->len;
+ 
+ 		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
+ 			rxdcsum = &trxd.rxd3;
+@@ -1560,7 +1633,6 @@ static int mtk_poll_rx(struct napi_struc
+ 		else
+ 			skb_checksum_none_assert(skb);
+ 		skb->protocol = eth_type_trans(skb, netdev);
+-		bytes += pktlen;
+ 
+ 		hash = trxd.rxd4 & MTK_RXD4_FOE_ENTRY;
+ 		if (hash != MTK_RXD4_FOE_ENTRY) {
+@@ -1623,6 +1695,9 @@ rx_done:
+ 			  &dim_sample);
+ 	net_dim(&eth->rx_dim, dim_sample);
+ 
++	if (xdp_flush)
++		xdp_do_flush_map();
++
+ 	return done;
+ }
+ 
+@@ -1968,7 +2043,7 @@ static int mtk_rx_alloc(struct mtk_eth *
+ 	if (!ring->data)
+ 		return -ENOMEM;
+ 
+-	if (!eth->hwlro) {
++	if (mtk_page_pool_enabled(eth)) {
+ 		struct page_pool *pp;
+ 
+ 		pp = mtk_create_page_pool(eth, &ring->xdp_q, ring_no,
+@@ -2710,6 +2785,48 @@ static int mtk_stop(struct net_device *d
+ 	return 0;
+ }
+ 
++static int mtk_xdp_setup(struct net_device *dev, struct bpf_prog *prog,
++			 struct netlink_ext_ack *extack)
++{
++	struct mtk_mac *mac = netdev_priv(dev);
++	struct mtk_eth *eth = mac->hw;
++	struct bpf_prog *old_prog;
++	bool need_update;
++
++	if (eth->hwlro) {
++		NL_SET_ERR_MSG_MOD(extack, "XDP not supported with HWLRO");
++		return -EOPNOTSUPP;
++	}
++
++	if (dev->mtu > MTK_PP_MAX_BUF_SIZE) {
++		NL_SET_ERR_MSG_MOD(extack, "MTU too large for XDP");
++		return -EOPNOTSUPP;
++	}
++
++	need_update = !!eth->prog != !!prog;
++	if (netif_running(dev) && need_update)
++		mtk_stop(dev);
++
++	old_prog = rcu_replace_pointer(eth->prog, prog, lockdep_rtnl_is_held());
++	if (old_prog)
++		bpf_prog_put(old_prog);
++
++	if (netif_running(dev) && need_update)
++		return mtk_open(dev);
++
++	return 0;
++}
++
++static int mtk_xdp(struct net_device *dev, struct netdev_bpf *xdp)
++{
++	switch (xdp->command) {
++	case XDP_SETUP_PROG:
++		return mtk_xdp_setup(dev, xdp->prog, xdp->extack);
++	default:
++		return -EINVAL;
++	}
++}
++
+ static void ethsys_reset(struct mtk_eth *eth, u32 reset_bits)
+ {
+ 	regmap_update_bits(eth->ethsys, ETHSYS_RSTCTRL,
+@@ -3005,6 +3122,12 @@ static int mtk_change_mtu(struct net_dev
+ 	struct mtk_eth *eth = mac->hw;
+ 	u32 mcr_cur, mcr_new;
+ 
++	if (rcu_access_pointer(eth->prog) &&
++	    length > MTK_PP_MAX_BUF_SIZE) {
++		netdev_err(dev, "Invalid MTU for XDP mode\n");
++		return -EINVAL;
++	}
++
+ 	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628)) {
+ 		mcr_cur = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id));
+ 		mcr_new = mcr_cur & ~MAC_MCR_MAX_RX_MASK;
+@@ -3332,6 +3455,7 @@ static const struct net_device_ops mtk_n
+ 	.ndo_poll_controller	= mtk_poll_controller,
+ #endif
+ 	.ndo_setup_tc		= mtk_eth_setup_tc,
++	.ndo_bpf		= mtk_xdp,
+ };
+ 
+ static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np)
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -1086,6 +1086,8 @@ struct mtk_eth {
+ 
+ 	struct mtk_ppe			*ppe;
+ 	struct rhashtable		flow_table;
++
++	struct bpf_prog			__rcu *prog;
+ };
+ 
+ /* struct mtk_mac -	the structure that holds the info about the MACs of the
diff --git a/target/linux/generic/backport-5.15/706-02-v6.0-net-ethernet-mtk_eth_soc-introduce-xdp-ethtool-count.patch b/target/linux/generic/backport-5.15/706-02-v6.0-net-ethernet-mtk_eth_soc-introduce-xdp-ethtool-count.patch
new file mode 100644
index 00000000000000..cf4d658684ba82
--- /dev/null
+++ b/target/linux/generic/backport-5.15/706-02-v6.0-net-ethernet-mtk_eth_soc-introduce-xdp-ethtool-count.patch
@@ -0,0 +1,110 @@
+From 916a6ee836d6b7b8ef1ed5f0515e256ca60e9968 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 22 Jul 2022 09:19:38 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: introduce xdp ethtool counters
+
+Report xdp stats through ethtool
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 26 +++++++++++++++++++--
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h | 12 ++++++++++
+ 2 files changed, 36 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -34,6 +34,10 @@ MODULE_PARM_DESC(msg_level, "Message lev
+ #define MTK_ETHTOOL_STAT(x) { #x, \
+ 			      offsetof(struct mtk_hw_stats, x) / sizeof(u64) }
+ 
++#define MTK_ETHTOOL_XDP_STAT(x) { #x, \
++				  offsetof(struct mtk_hw_stats, xdp_stats.x) / \
++				  sizeof(u64) }
++
+ static const struct mtk_reg_map mtk_reg_map = {
+ 	.tx_irq_mask		= 0x1a1c,
+ 	.tx_irq_status		= 0x1a18,
+@@ -141,6 +145,13 @@ static const struct mtk_ethtool_stats {
+ 	MTK_ETHTOOL_STAT(rx_long_errors),
+ 	MTK_ETHTOOL_STAT(rx_checksum_errors),
+ 	MTK_ETHTOOL_STAT(rx_flow_control_packets),
++	MTK_ETHTOOL_XDP_STAT(rx_xdp_redirect),
++	MTK_ETHTOOL_XDP_STAT(rx_xdp_pass),
++	MTK_ETHTOOL_XDP_STAT(rx_xdp_drop),
++	MTK_ETHTOOL_XDP_STAT(rx_xdp_tx),
++	MTK_ETHTOOL_XDP_STAT(rx_xdp_tx_errors),
++	MTK_ETHTOOL_XDP_STAT(tx_xdp_xmit),
++	MTK_ETHTOOL_XDP_STAT(tx_xdp_xmit_errors),
+ };
+ 
+ static const char * const mtk_clks_source_name[] = {
+@@ -1459,6 +1470,9 @@ static void mtk_rx_put_buff(struct mtk_r
+ static u32 mtk_xdp_run(struct mtk_eth *eth, struct mtk_rx_ring *ring,
+ 		       struct xdp_buff *xdp, struct net_device *dev)
+ {
++	struct mtk_mac *mac = netdev_priv(dev);
++	struct mtk_hw_stats *hw_stats = mac->hw_stats;
++	u64 *count = &hw_stats->xdp_stats.rx_xdp_drop;
+ 	struct bpf_prog *prog;
+ 	u32 act = XDP_PASS;
+ 
+@@ -1471,13 +1485,16 @@ static u32 mtk_xdp_run(struct mtk_eth *e
+ 	act = bpf_prog_run_xdp(prog, xdp);
+ 	switch (act) {
+ 	case XDP_PASS:
+-		goto out;
++		count = &hw_stats->xdp_stats.rx_xdp_pass;
++		goto update_stats;
+ 	case XDP_REDIRECT:
+ 		if (unlikely(xdp_do_redirect(dev, xdp, prog))) {
+ 			act = XDP_DROP;
+ 			break;
+ 		}
+-		goto out;
++
++		count = &hw_stats->xdp_stats.rx_xdp_redirect;
++		goto update_stats;
+ 	default:
+ 		bpf_warn_invalid_xdp_action(act);
+ 		fallthrough;
+@@ -1490,6 +1507,11 @@ static u32 mtk_xdp_run(struct mtk_eth *e
+ 
+ 	page_pool_put_full_page(ring->page_pool,
+ 				virt_to_head_page(xdp->data), true);
++
++update_stats:
++	u64_stats_update_begin(&hw_stats->syncp);
++	*count = *count + 1;
++	u64_stats_update_end(&hw_stats->syncp);
+ out:
+ 	rcu_read_unlock();
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -568,6 +568,16 @@ struct mtk_tx_dma_v2 {
+ struct mtk_eth;
+ struct mtk_mac;
+ 
++struct mtk_xdp_stats {
++	u64 rx_xdp_redirect;
++	u64 rx_xdp_pass;
++	u64 rx_xdp_drop;
++	u64 rx_xdp_tx;
++	u64 rx_xdp_tx_errors;
++	u64 tx_xdp_xmit;
++	u64 tx_xdp_xmit_errors;
++};
++
+ /* struct mtk_hw_stats - the structure that holds the traffic statistics.
+  * @stats_lock:		make sure that stats operations are atomic
+  * @reg_offset:		the status register offset of the SoC
+@@ -591,6 +601,8 @@ struct mtk_hw_stats {
+ 	u64 rx_checksum_errors;
+ 	u64 rx_flow_control_packets;
+ 
++	struct mtk_xdp_stats	xdp_stats;
++
+ 	spinlock_t		stats_lock;
+ 	u32			reg_offset;
+ 	struct u64_stats_sync	syncp;
diff --git a/target/linux/generic/backport-5.15/706-03-v6.0-net-ethernet-mtk_eth_soc-add-xmit-XDP-support.patch b/target/linux/generic/backport-5.15/706-03-v6.0-net-ethernet-mtk_eth_soc-add-xmit-XDP-support.patch
new file mode 100644
index 00000000000000..58b49f28a25f46
--- /dev/null
+++ b/target/linux/generic/backport-5.15/706-03-v6.0-net-ethernet-mtk_eth_soc-add-xmit-XDP-support.patch
@@ -0,0 +1,340 @@
+From 5886d26fd25bbe26130e3e5f7474b9b3e98a3469 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 22 Jul 2022 09:19:39 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: add xmit XDP support
+
+Introduce XDP support for XDP_TX verdict and ndo_xdp_xmit function
+pointer.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 192 +++++++++++++++++---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h |  10 +-
+ 2 files changed, 180 insertions(+), 22 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -988,15 +988,26 @@ static void mtk_tx_unmap(struct mtk_eth
+ 		}
+ 	}
+ 
+-	tx_buf->flags = 0;
+-	if (tx_buf->skb &&
+-	    (tx_buf->skb != (struct sk_buff *)MTK_DMA_DUMMY_DESC)) {
+-		if (napi)
+-			napi_consume_skb(tx_buf->skb, napi);
++	if (tx_buf->type == MTK_TYPE_SKB) {
++		if (tx_buf->data &&
++		    tx_buf->data != (void *)MTK_DMA_DUMMY_DESC) {
++			struct sk_buff *skb = tx_buf->data;
++
++			if (napi)
++				napi_consume_skb(skb, napi);
++			else
++				dev_kfree_skb_any(skb);
++		}
++	} else if (tx_buf->data) {
++		struct xdp_frame *xdpf = tx_buf->data;
++
++		if (napi && tx_buf->type == MTK_TYPE_XDP_TX)
++			xdp_return_frame_rx_napi(xdpf);
+ 		else
+-			dev_kfree_skb_any(tx_buf->skb);
++			xdp_return_frame(xdpf);
+ 	}
+-	tx_buf->skb = NULL;
++	tx_buf->flags = 0;
++	tx_buf->data = NULL;
+ }
+ 
+ static void setup_tx_buf(struct mtk_eth *eth, struct mtk_tx_buf *tx_buf,
+@@ -1013,7 +1024,7 @@ static void setup_tx_buf(struct mtk_eth
+ 			dma_unmap_addr_set(tx_buf, dma_addr1, mapped_addr);
+ 			dma_unmap_len_set(tx_buf, dma_len1, size);
+ 		} else {
+-			tx_buf->skb = (struct sk_buff *)MTK_DMA_DUMMY_DESC;
++			tx_buf->data = (void *)MTK_DMA_DUMMY_DESC;
+ 			txd->txd1 = mapped_addr;
+ 			txd->txd2 = TX_DMA_PLEN0(size);
+ 			dma_unmap_addr_set(tx_buf, dma_addr0, mapped_addr);
+@@ -1189,7 +1200,7 @@ static int mtk_tx_map(struct sk_buff *sk
+ 						    soc->txrx.txd_size);
+ 			if (new_desc)
+ 				memset(tx_buf, 0, sizeof(*tx_buf));
+-			tx_buf->skb = (struct sk_buff *)MTK_DMA_DUMMY_DESC;
++			tx_buf->data = (void *)MTK_DMA_DUMMY_DESC;
+ 			tx_buf->flags |= MTK_TX_FLAGS_PAGE0;
+ 			tx_buf->flags |= (!mac->id) ? MTK_TX_FLAGS_FPORT0 :
+ 					 MTK_TX_FLAGS_FPORT1;
+@@ -1203,7 +1214,8 @@ static int mtk_tx_map(struct sk_buff *sk
+ 	}
+ 
+ 	/* store skb to cleanup */
+-	itx_buf->skb = skb;
++	itx_buf->type = MTK_TYPE_SKB;
++	itx_buf->data = skb;
+ 
+ 	if (!MTK_HAS_CAPS(soc->caps, MTK_QDMA)) {
+ 		if (k & 0x1)
+@@ -1415,13 +1427,14 @@ static struct page_pool *mtk_create_page
+ 		.pool_size = size,
+ 		.nid = NUMA_NO_NODE,
+ 		.dev = eth->dma_dev,
+-		.dma_dir = DMA_FROM_DEVICE,
+ 		.offset = MTK_PP_HEADROOM,
+ 		.max_len = MTK_PP_MAX_BUF_SIZE,
+ 	};
+ 	struct page_pool *pp;
+ 	int err;
+ 
++	pp_params.dma_dir = rcu_access_pointer(eth->prog) ? DMA_BIDIRECTIONAL
++							  : DMA_FROM_DEVICE;
+ 	pp = page_pool_create(&pp_params);
+ 	if (IS_ERR(pp))
+ 		return pp;
+@@ -1467,6 +1480,122 @@ static void mtk_rx_put_buff(struct mtk_r
+ 		skb_free_frag(data);
+ }
+ 
++static int mtk_xdp_submit_frame(struct mtk_eth *eth, struct xdp_frame *xdpf,
++				struct net_device *dev, bool dma_map)
++{
++	const struct mtk_soc_data *soc = eth->soc;
++	struct mtk_tx_ring *ring = &eth->tx_ring;
++	struct mtk_tx_dma_desc_info txd_info = {
++		.size	= xdpf->len,
++		.first	= true,
++		.last	= true,
++	};
++	struct mtk_mac *mac = netdev_priv(dev);
++	struct mtk_tx_dma *txd, *txd_pdma;
++	int err = 0, index = 0, n_desc = 1;
++	struct mtk_tx_buf *tx_buf;
++
++	if (unlikely(test_bit(MTK_RESETTING, &eth->state)))
++		return -EBUSY;
++
++	if (unlikely(atomic_read(&ring->free_count) <= 1))
++		return -EBUSY;
++
++	spin_lock(&eth->page_lock);
++
++	txd = ring->next_free;
++	if (txd == ring->last_free) {
++		err = -ENOMEM;
++		goto out;
++	}
++
++	tx_buf = mtk_desc_to_tx_buf(ring, txd, soc->txrx.txd_size);
++	memset(tx_buf, 0, sizeof(*tx_buf));
++
++	if (dma_map) {  /* ndo_xdp_xmit */
++		txd_info.addr = dma_map_single(eth->dma_dev, xdpf->data,
++					       txd_info.size, DMA_TO_DEVICE);
++		if (unlikely(dma_mapping_error(eth->dma_dev, txd_info.addr))) {
++			err = -ENOMEM;
++			goto out;
++		}
++		tx_buf->flags |= MTK_TX_FLAGS_SINGLE0;
++	} else {
++		struct page *page = virt_to_head_page(xdpf->data);
++
++		txd_info.addr = page_pool_get_dma_addr(page) +
++				sizeof(*xdpf) + xdpf->headroom;
++		dma_sync_single_for_device(eth->dma_dev, txd_info.addr,
++					   txd_info.size,
++					   DMA_BIDIRECTIONAL);
++	}
++	mtk_tx_set_dma_desc(dev, txd, &txd_info);
++
++	tx_buf->flags |= !mac->id ? MTK_TX_FLAGS_FPORT0 : MTK_TX_FLAGS_FPORT1;
++
++	txd_pdma = qdma_to_pdma(ring, txd);
++	setup_tx_buf(eth, tx_buf, txd_pdma, txd_info.addr, txd_info.size,
++		     index++);
++
++	/* store xdpf for cleanup */
++	tx_buf->type = dma_map ? MTK_TYPE_XDP_NDO : MTK_TYPE_XDP_TX;
++	tx_buf->data = xdpf;
++
++	if (!MTK_HAS_CAPS(soc->caps, MTK_QDMA)) {
++		if (index & 1)
++			txd_pdma->txd2 |= TX_DMA_LS0;
++		else
++			txd_pdma->txd2 |= TX_DMA_LS1;
++	}
++
++	ring->next_free = mtk_qdma_phys_to_virt(ring, txd->txd2);
++	atomic_sub(n_desc, &ring->free_count);
++
++	/* make sure that all changes to the dma ring are flushed before we
++	 * continue
++	 */
++	wmb();
++
++	if (MTK_HAS_CAPS(soc->caps, MTK_QDMA)) {
++		mtk_w32(eth, txd->txd2, soc->reg_map->qdma.ctx_ptr);
++	} else {
++		int idx;
++
++		idx = txd_to_idx(ring, txd, soc->txrx.txd_size);
++		mtk_w32(eth, NEXT_DESP_IDX(idx, ring->dma_size),
++			MT7628_TX_CTX_IDX0);
++	}
++out:
++	spin_unlock(&eth->page_lock);
++
++	return err;
++}
++
++static int mtk_xdp_xmit(struct net_device *dev, int num_frame,
++			struct xdp_frame **frames, u32 flags)
++{
++	struct mtk_mac *mac = netdev_priv(dev);
++	struct mtk_hw_stats *hw_stats = mac->hw_stats;
++	struct mtk_eth *eth = mac->hw;
++	int i, nxmit = 0;
++
++	if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK))
++		return -EINVAL;
++
++	for (i = 0; i < num_frame; i++) {
++		if (mtk_xdp_submit_frame(eth, frames[i], dev, true))
++			break;
++		nxmit++;
++	}
++
++	u64_stats_update_begin(&hw_stats->syncp);
++	hw_stats->xdp_stats.tx_xdp_xmit += nxmit;
++	hw_stats->xdp_stats.tx_xdp_xmit_errors += num_frame - nxmit;
++	u64_stats_update_end(&hw_stats->syncp);
++
++	return nxmit;
++}
++
+ static u32 mtk_xdp_run(struct mtk_eth *eth, struct mtk_rx_ring *ring,
+ 		       struct xdp_buff *xdp, struct net_device *dev)
+ {
+@@ -1495,6 +1624,18 @@ static u32 mtk_xdp_run(struct mtk_eth *e
+ 
+ 		count = &hw_stats->xdp_stats.rx_xdp_redirect;
+ 		goto update_stats;
++	case XDP_TX: {
++		struct xdp_frame *xdpf = xdp_convert_buff_to_frame(xdp);
++
++		if (mtk_xdp_submit_frame(eth, xdpf, dev, false)) {
++			count = &hw_stats->xdp_stats.rx_xdp_tx_errors;
++			act = XDP_DROP;
++			break;
++		}
++
++		count = &hw_stats->xdp_stats.rx_xdp_tx;
++		goto update_stats;
++	}
+ 	default:
+ 		bpf_warn_invalid_xdp_action(act);
+ 		fallthrough;
+@@ -1728,9 +1869,8 @@ static int mtk_poll_tx_qdma(struct mtk_e
+ {
+ 	const struct mtk_reg_map *reg_map = eth->soc->reg_map;
+ 	struct mtk_tx_ring *ring = &eth->tx_ring;
+-	struct mtk_tx_dma *desc;
+-	struct sk_buff *skb;
+ 	struct mtk_tx_buf *tx_buf;
++	struct mtk_tx_dma *desc;
+ 	u32 cpu, dma;
+ 
+ 	cpu = ring->last_free_ptr;
+@@ -1751,15 +1891,21 @@ static int mtk_poll_tx_qdma(struct mtk_e
+ 		if (tx_buf->flags & MTK_TX_FLAGS_FPORT1)
+ 			mac = 1;
+ 
+-		skb = tx_buf->skb;
+-		if (!skb)
++		if (!tx_buf->data)
+ 			break;
+ 
+-		if (skb != (struct sk_buff *)MTK_DMA_DUMMY_DESC) {
++		if (tx_buf->type == MTK_TYPE_SKB &&
++		    tx_buf->data != (void *)MTK_DMA_DUMMY_DESC) {
++			struct sk_buff *skb = tx_buf->data;
++
+ 			bytes[mac] += skb->len;
+ 			done[mac]++;
+ 			budget--;
++		} else if (tx_buf->type == MTK_TYPE_XDP_TX ||
++			   tx_buf->type == MTK_TYPE_XDP_NDO) {
++			budget--;
+ 		}
++
+ 		mtk_tx_unmap(eth, tx_buf, true);
+ 
+ 		ring->last_free = desc;
+@@ -1778,9 +1924,8 @@ static int mtk_poll_tx_pdma(struct mtk_e
+ 			    unsigned int *done, unsigned int *bytes)
+ {
+ 	struct mtk_tx_ring *ring = &eth->tx_ring;
+-	struct mtk_tx_dma *desc;
+-	struct sk_buff *skb;
+ 	struct mtk_tx_buf *tx_buf;
++	struct mtk_tx_dma *desc;
+ 	u32 cpu, dma;
+ 
+ 	cpu = ring->cpu_idx;
+@@ -1788,14 +1933,18 @@ static int mtk_poll_tx_pdma(struct mtk_e
+ 
+ 	while ((cpu != dma) && budget) {
+ 		tx_buf = &ring->buf[cpu];
+-		skb = tx_buf->skb;
+-		if (!skb)
++		if (!tx_buf->data)
+ 			break;
+ 
+-		if (skb != (struct sk_buff *)MTK_DMA_DUMMY_DESC) {
++		if (tx_buf->type == MTK_TYPE_SKB &&
++		    tx_buf->data != (void *)MTK_DMA_DUMMY_DESC) {
++			struct sk_buff *skb = tx_buf->data;
+ 			bytes[0] += skb->len;
+ 			done[0]++;
+ 			budget--;
++		} else if (tx_buf->type == MTK_TYPE_XDP_TX ||
++			   tx_buf->type == MTK_TYPE_XDP_NDO) {
++			budget--;
+ 		}
+ 
+ 		mtk_tx_unmap(eth, tx_buf, true);
+@@ -3478,6 +3627,7 @@ static const struct net_device_ops mtk_n
+ #endif
+ 	.ndo_setup_tc		= mtk_eth_setup_tc,
+ 	.ndo_bpf		= mtk_xdp,
++	.ndo_xdp_xmit		= mtk_xdp_xmit,
+ };
+ 
+ static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np)
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -694,6 +694,12 @@ enum mtk_dev_state {
+ 	MTK_RESETTING
+ };
+ 
++enum mtk_tx_buf_type {
++	MTK_TYPE_SKB,
++	MTK_TYPE_XDP_TX,
++	MTK_TYPE_XDP_NDO,
++};
++
+ /* struct mtk_tx_buf -	This struct holds the pointers to the memory pointed at
+  *			by the TX descriptor	s
+  * @skb:		The SKB pointer of the packet being sent
+@@ -703,7 +709,9 @@ enum mtk_dev_state {
+  * @dma_len1:		The length of the second segment
+  */
+ struct mtk_tx_buf {
+-	struct sk_buff *skb;
++	enum mtk_tx_buf_type type;
++	void *data;
++
+ 	u32 flags;
+ 	DEFINE_DMA_UNMAP_ADDR(dma_addr0);
+ 	DEFINE_DMA_UNMAP_LEN(dma_len0);
diff --git a/target/linux/generic/backport-5.15/706-04-v6.0-net-ethernet-mtk_eth_soc-add-support-for-page_pool_g.patch b/target/linux/generic/backport-5.15/706-04-v6.0-net-ethernet-mtk_eth_soc-add-support-for-page_pool_g.patch
new file mode 100644
index 00000000000000..e93e0df544ac4d
--- /dev/null
+++ b/target/linux/generic/backport-5.15/706-04-v6.0-net-ethernet-mtk_eth_soc-add-support-for-page_pool_g.patch
@@ -0,0 +1,95 @@
+From 84b9cd389036d4a262d8cee794d56c04095358a7 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 22 Jul 2022 09:19:40 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: add support for
+ page_pool_get_stats
+
+Introduce support for the page_pool stats API into mtk_eth_soc driver.
+Report page_pool stats through ethtool.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/mediatek/Kconfig       |  1 +
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 37 +++++++++++++++++++--
+ 2 files changed, 35 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/Kconfig
++++ b/drivers/net/ethernet/mediatek/Kconfig
+@@ -17,6 +17,7 @@ config NET_MEDIATEK_SOC
+ 	select PHYLINK
+ 	select DIMLIB
+ 	select PAGE_POOL
++	select PAGE_POOL_STATS
+ 	help
+ 	  This driver supports the gigabit ethernet MACs in the
+ 	  MediaTek SoC family.
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3488,11 +3488,18 @@ static void mtk_get_strings(struct net_d
+ 	int i;
+ 
+ 	switch (stringset) {
+-	case ETH_SS_STATS:
++	case ETH_SS_STATS: {
++		struct mtk_mac *mac = netdev_priv(dev);
++
+ 		for (i = 0; i < ARRAY_SIZE(mtk_ethtool_stats); i++) {
+ 			memcpy(data, mtk_ethtool_stats[i].str, ETH_GSTRING_LEN);
+ 			data += ETH_GSTRING_LEN;
+ 		}
++		if (mtk_page_pool_enabled(mac->hw))
++			page_pool_ethtool_stats_get_strings(data);
++		break;
++	}
++	default:
+ 		break;
+ 	}
+ }
+@@ -3500,13 +3507,35 @@ static void mtk_get_strings(struct net_d
+ static int mtk_get_sset_count(struct net_device *dev, int sset)
+ {
+ 	switch (sset) {
+-	case ETH_SS_STATS:
+-		return ARRAY_SIZE(mtk_ethtool_stats);
++	case ETH_SS_STATS: {
++		int count = ARRAY_SIZE(mtk_ethtool_stats);
++		struct mtk_mac *mac = netdev_priv(dev);
++
++		if (mtk_page_pool_enabled(mac->hw))
++			count += page_pool_ethtool_stats_get_count();
++		return count;
++	}
+ 	default:
+ 		return -EOPNOTSUPP;
+ 	}
+ }
+ 
++static void mtk_ethtool_pp_stats(struct mtk_eth *eth, u64 *data)
++{
++	struct page_pool_stats stats = {};
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(eth->rx_ring); i++) {
++		struct mtk_rx_ring *ring = &eth->rx_ring[i];
++
++		if (!ring->page_pool)
++			continue;
++
++		page_pool_get_stats(ring->page_pool, &stats);
++	}
++	page_pool_ethtool_stats_get(data, &stats);
++}
++
+ static void mtk_get_ethtool_stats(struct net_device *dev,
+ 				  struct ethtool_stats *stats, u64 *data)
+ {
+@@ -3534,6 +3563,8 @@ static void mtk_get_ethtool_stats(struct
+ 
+ 		for (i = 0; i < ARRAY_SIZE(mtk_ethtool_stats); i++)
+ 			*data_dst++ = *(data_src + mtk_ethtool_stats[i].offset);
++		if (mtk_page_pool_enabled(mac->hw))
++			mtk_ethtool_pp_stats(mac->hw, data_dst);
+ 	} while (u64_stats_fetch_retry_irq(&hwstats->syncp, start));
+ }
+ 
diff --git a/target/linux/generic/backport-5.15/706-05-v6.0-net-ethernet-mtk_eth_soc-introduce-mtk_xdp_frame_map.patch b/target/linux/generic/backport-5.15/706-05-v6.0-net-ethernet-mtk_eth_soc-introduce-mtk_xdp_frame_map.patch
new file mode 100644
index 00000000000000..8e6895fe97fcf6
--- /dev/null
+++ b/target/linux/generic/backport-5.15/706-05-v6.0-net-ethernet-mtk_eth_soc-introduce-mtk_xdp_frame_map.patch
@@ -0,0 +1,113 @@
+From b16fe6d82b71fa0dd5c957bc22d66a694976d6eb Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Wed, 27 Jul 2022 23:20:50 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: introduce mtk_xdp_frame_map
+ utility routine
+
+This is a preliminary patch to add xdp multi-frag support to mtk_eth_soc
+driver
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 68 +++++++++++++--------
+ 1 file changed, 42 insertions(+), 26 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1480,6 +1480,41 @@ static void mtk_rx_put_buff(struct mtk_r
+ 		skb_free_frag(data);
+ }
+ 
++static int mtk_xdp_frame_map(struct mtk_eth *eth, struct net_device *dev,
++			     struct mtk_tx_dma_desc_info *txd_info,
++			     struct mtk_tx_dma *txd, struct mtk_tx_buf *tx_buf,
++			     void *data, u16 headroom, int index, bool dma_map)
++{
++	struct mtk_tx_ring *ring = &eth->tx_ring;
++	struct mtk_mac *mac = netdev_priv(dev);
++	struct mtk_tx_dma *txd_pdma;
++
++	if (dma_map) {  /* ndo_xdp_xmit */
++		txd_info->addr = dma_map_single(eth->dma_dev, data,
++						txd_info->size, DMA_TO_DEVICE);
++		if (unlikely(dma_mapping_error(eth->dma_dev, txd_info->addr)))
++			return -ENOMEM;
++
++		tx_buf->flags |= MTK_TX_FLAGS_SINGLE0;
++	} else {
++		struct page *page = virt_to_head_page(data);
++
++		txd_info->addr = page_pool_get_dma_addr(page) +
++				 sizeof(struct xdp_frame) + headroom;
++		dma_sync_single_for_device(eth->dma_dev, txd_info->addr,
++					   txd_info->size, DMA_BIDIRECTIONAL);
++	}
++	mtk_tx_set_dma_desc(dev, txd, txd_info);
++
++	tx_buf->flags |= !mac->id ? MTK_TX_FLAGS_FPORT0 : MTK_TX_FLAGS_FPORT1;
++
++	txd_pdma = qdma_to_pdma(ring, txd);
++	setup_tx_buf(eth, tx_buf, txd_pdma, txd_info->addr, txd_info->size,
++		     index);
++
++	return 0;
++}
++
+ static int mtk_xdp_submit_frame(struct mtk_eth *eth, struct xdp_frame *xdpf,
+ 				struct net_device *dev, bool dma_map)
+ {
+@@ -1490,9 +1525,8 @@ static int mtk_xdp_submit_frame(struct m
+ 		.first	= true,
+ 		.last	= true,
+ 	};
+-	struct mtk_mac *mac = netdev_priv(dev);
+-	struct mtk_tx_dma *txd, *txd_pdma;
+ 	int err = 0, index = 0, n_desc = 1;
++	struct mtk_tx_dma *txd, *txd_pdma;
+ 	struct mtk_tx_buf *tx_buf;
+ 
+ 	if (unlikely(test_bit(MTK_RESETTING, &eth->state)))
+@@ -1512,36 +1546,18 @@ static int mtk_xdp_submit_frame(struct m
+ 	tx_buf = mtk_desc_to_tx_buf(ring, txd, soc->txrx.txd_size);
+ 	memset(tx_buf, 0, sizeof(*tx_buf));
+ 
+-	if (dma_map) {  /* ndo_xdp_xmit */
+-		txd_info.addr = dma_map_single(eth->dma_dev, xdpf->data,
+-					       txd_info.size, DMA_TO_DEVICE);
+-		if (unlikely(dma_mapping_error(eth->dma_dev, txd_info.addr))) {
+-			err = -ENOMEM;
+-			goto out;
+-		}
+-		tx_buf->flags |= MTK_TX_FLAGS_SINGLE0;
+-	} else {
+-		struct page *page = virt_to_head_page(xdpf->data);
+-
+-		txd_info.addr = page_pool_get_dma_addr(page) +
+-				sizeof(*xdpf) + xdpf->headroom;
+-		dma_sync_single_for_device(eth->dma_dev, txd_info.addr,
+-					   txd_info.size,
+-					   DMA_BIDIRECTIONAL);
+-	}
+-	mtk_tx_set_dma_desc(dev, txd, &txd_info);
+-
+-	tx_buf->flags |= !mac->id ? MTK_TX_FLAGS_FPORT0 : MTK_TX_FLAGS_FPORT1;
+-
+-	txd_pdma = qdma_to_pdma(ring, txd);
+-	setup_tx_buf(eth, tx_buf, txd_pdma, txd_info.addr, txd_info.size,
+-		     index++);
++	err = mtk_xdp_frame_map(eth, dev, &txd_info, txd, tx_buf,
++				xdpf->data, xdpf->headroom, index,
++				dma_map);
++	if (err < 0)
++		goto out;
+ 
+ 	/* store xdpf for cleanup */
+ 	tx_buf->type = dma_map ? MTK_TYPE_XDP_NDO : MTK_TYPE_XDP_TX;
+ 	tx_buf->data = xdpf;
+ 
+ 	if (!MTK_HAS_CAPS(soc->caps, MTK_QDMA)) {
++		txd_pdma = qdma_to_pdma(ring, txd);
+ 		if (index & 1)
+ 			txd_pdma->txd2 |= TX_DMA_LS0;
+ 		else
diff --git a/target/linux/generic/backport-5.15/706-06-v6.0-net-ethernet-mtk_eth_soc-introduce-xdp-multi-frag-su.patch b/target/linux/generic/backport-5.15/706-06-v6.0-net-ethernet-mtk_eth_soc-introduce-xdp-multi-frag-su.patch
new file mode 100644
index 00000000000000..23e4a4dfcbf412
--- /dev/null
+++ b/target/linux/generic/backport-5.15/706-06-v6.0-net-ethernet-mtk_eth_soc-introduce-xdp-multi-frag-su.patch
@@ -0,0 +1,218 @@
+From 155738a4f319538a09f734ce1f5a2eac3ada1de2 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Wed, 27 Jul 2022 23:20:51 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: introduce xdp multi-frag support
+
+Add the capability to map non-linear xdp frames in XDP_TX and
+ndo_xdp_xmit callback.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 125 +++++++++++++-------
+ 1 file changed, 82 insertions(+), 43 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -988,23 +988,22 @@ static void mtk_tx_unmap(struct mtk_eth
+ 		}
+ 	}
+ 
+-	if (tx_buf->type == MTK_TYPE_SKB) {
+-		if (tx_buf->data &&
+-		    tx_buf->data != (void *)MTK_DMA_DUMMY_DESC) {
++	if (tx_buf->data && tx_buf->data != (void *)MTK_DMA_DUMMY_DESC) {
++		if (tx_buf->type == MTK_TYPE_SKB) {
+ 			struct sk_buff *skb = tx_buf->data;
+ 
+ 			if (napi)
+ 				napi_consume_skb(skb, napi);
+ 			else
+ 				dev_kfree_skb_any(skb);
+-		}
+-	} else if (tx_buf->data) {
+-		struct xdp_frame *xdpf = tx_buf->data;
++		} else {
++			struct xdp_frame *xdpf = tx_buf->data;
+ 
+-		if (napi && tx_buf->type == MTK_TYPE_XDP_TX)
+-			xdp_return_frame_rx_napi(xdpf);
+-		else
+-			xdp_return_frame(xdpf);
++			if (napi && tx_buf->type == MTK_TYPE_XDP_TX)
++				xdp_return_frame_rx_napi(xdpf);
++			else
++				xdp_return_frame(xdpf);
++		}
+ 	}
+ 	tx_buf->flags = 0;
+ 	tx_buf->data = NULL;
+@@ -1507,6 +1506,8 @@ static int mtk_xdp_frame_map(struct mtk_
+ 	mtk_tx_set_dma_desc(dev, txd, txd_info);
+ 
+ 	tx_buf->flags |= !mac->id ? MTK_TX_FLAGS_FPORT0 : MTK_TX_FLAGS_FPORT1;
++	tx_buf->type = dma_map ? MTK_TYPE_XDP_NDO : MTK_TYPE_XDP_TX;
++	tx_buf->data = (void *)MTK_DMA_DUMMY_DESC;
+ 
+ 	txd_pdma = qdma_to_pdma(ring, txd);
+ 	setup_tx_buf(eth, tx_buf, txd_pdma, txd_info->addr, txd_info->size,
+@@ -1518,43 +1519,69 @@ static int mtk_xdp_frame_map(struct mtk_
+ static int mtk_xdp_submit_frame(struct mtk_eth *eth, struct xdp_frame *xdpf,
+ 				struct net_device *dev, bool dma_map)
+ {
++	struct skb_shared_info *sinfo = xdp_get_shared_info_from_frame(xdpf);
+ 	const struct mtk_soc_data *soc = eth->soc;
+ 	struct mtk_tx_ring *ring = &eth->tx_ring;
+ 	struct mtk_tx_dma_desc_info txd_info = {
+ 		.size	= xdpf->len,
+ 		.first	= true,
+-		.last	= true,
++		.last	= !xdp_frame_has_frags(xdpf),
+ 	};
+-	int err = 0, index = 0, n_desc = 1;
+-	struct mtk_tx_dma *txd, *txd_pdma;
+-	struct mtk_tx_buf *tx_buf;
++	int err, index = 0, n_desc = 1, nr_frags;
++	struct mtk_tx_dma *htxd, *txd, *txd_pdma;
++	struct mtk_tx_buf *htx_buf, *tx_buf;
++	void *data = xdpf->data;
+ 
+ 	if (unlikely(test_bit(MTK_RESETTING, &eth->state)))
+ 		return -EBUSY;
+ 
+-	if (unlikely(atomic_read(&ring->free_count) <= 1))
++	nr_frags = unlikely(xdp_frame_has_frags(xdpf)) ? sinfo->nr_frags : 0;
++	if (unlikely(atomic_read(&ring->free_count) <= 1 + nr_frags))
+ 		return -EBUSY;
+ 
+ 	spin_lock(&eth->page_lock);
+ 
+ 	txd = ring->next_free;
+ 	if (txd == ring->last_free) {
+-		err = -ENOMEM;
+-		goto out;
++		spin_unlock(&eth->page_lock);
++		return -ENOMEM;
+ 	}
++	htxd = txd;
+ 
+ 	tx_buf = mtk_desc_to_tx_buf(ring, txd, soc->txrx.txd_size);
+ 	memset(tx_buf, 0, sizeof(*tx_buf));
++	htx_buf = tx_buf;
+ 
+-	err = mtk_xdp_frame_map(eth, dev, &txd_info, txd, tx_buf,
+-				xdpf->data, xdpf->headroom, index,
+-				dma_map);
+-	if (err < 0)
+-		goto out;
++	for (;;) {
++		err = mtk_xdp_frame_map(eth, dev, &txd_info, txd, tx_buf,
++					data, xdpf->headroom, index, dma_map);
++		if (err < 0)
++			goto unmap;
++
++		if (txd_info.last)
++			break;
+ 
++		if (MTK_HAS_CAPS(soc->caps, MTK_QDMA) || (index & 0x1)) {
++			txd = mtk_qdma_phys_to_virt(ring, txd->txd2);
++			txd_pdma = qdma_to_pdma(ring, txd);
++			if (txd == ring->last_free)
++				goto unmap;
++
++			tx_buf = mtk_desc_to_tx_buf(ring, txd,
++						    soc->txrx.txd_size);
++			memset(tx_buf, 0, sizeof(*tx_buf));
++			n_desc++;
++		}
++
++		memset(&txd_info, 0, sizeof(struct mtk_tx_dma_desc_info));
++		txd_info.size = skb_frag_size(&sinfo->frags[index]);
++		txd_info.last = index + 1 == nr_frags;
++		data = skb_frag_address(&sinfo->frags[index]);
++
++		index++;
++	}
+ 	/* store xdpf for cleanup */
+-	tx_buf->type = dma_map ? MTK_TYPE_XDP_NDO : MTK_TYPE_XDP_TX;
+-	tx_buf->data = xdpf;
++	htx_buf->data = xdpf;
+ 
+ 	if (!MTK_HAS_CAPS(soc->caps, MTK_QDMA)) {
+ 		txd_pdma = qdma_to_pdma(ring, txd);
+@@ -1581,7 +1608,24 @@ static int mtk_xdp_submit_frame(struct m
+ 		mtk_w32(eth, NEXT_DESP_IDX(idx, ring->dma_size),
+ 			MT7628_TX_CTX_IDX0);
+ 	}
+-out:
++
++	spin_unlock(&eth->page_lock);
++
++	return 0;
++
++unmap:
++	while (htxd != txd) {
++		txd_pdma = qdma_to_pdma(ring, htxd);
++		tx_buf = mtk_desc_to_tx_buf(ring, htxd, soc->txrx.txd_size);
++		mtk_tx_unmap(eth, tx_buf, false);
++
++		htxd->txd3 = TX_DMA_LS0 | TX_DMA_OWNER_CPU;
++		if (!MTK_HAS_CAPS(soc->caps, MTK_QDMA))
++			txd_pdma->txd2 = TX_DMA_DESP2_DEF;
++
++		htxd = mtk_qdma_phys_to_virt(ring, htxd->txd2);
++	}
++
+ 	spin_unlock(&eth->page_lock);
+ 
+ 	return err;
+@@ -1910,18 +1954,15 @@ static int mtk_poll_tx_qdma(struct mtk_e
+ 		if (!tx_buf->data)
+ 			break;
+ 
+-		if (tx_buf->type == MTK_TYPE_SKB &&
+-		    tx_buf->data != (void *)MTK_DMA_DUMMY_DESC) {
+-			struct sk_buff *skb = tx_buf->data;
++		if (tx_buf->data != (void *)MTK_DMA_DUMMY_DESC) {
++			if (tx_buf->type == MTK_TYPE_SKB) {
++				struct sk_buff *skb = tx_buf->data;
+ 
+-			bytes[mac] += skb->len;
+-			done[mac]++;
+-			budget--;
+-		} else if (tx_buf->type == MTK_TYPE_XDP_TX ||
+-			   tx_buf->type == MTK_TYPE_XDP_NDO) {
++				bytes[mac] += skb->len;
++				done[mac]++;
++			}
+ 			budget--;
+ 		}
+-
+ 		mtk_tx_unmap(eth, tx_buf, true);
+ 
+ 		ring->last_free = desc;
+@@ -1952,17 +1993,15 @@ static int mtk_poll_tx_pdma(struct mtk_e
+ 		if (!tx_buf->data)
+ 			break;
+ 
+-		if (tx_buf->type == MTK_TYPE_SKB &&
+-		    tx_buf->data != (void *)MTK_DMA_DUMMY_DESC) {
+-			struct sk_buff *skb = tx_buf->data;
+-			bytes[0] += skb->len;
+-			done[0]++;
+-			budget--;
+-		} else if (tx_buf->type == MTK_TYPE_XDP_TX ||
+-			   tx_buf->type == MTK_TYPE_XDP_NDO) {
++		if (tx_buf->data != (void *)MTK_DMA_DUMMY_DESC) {
++			if (tx_buf->type == MTK_TYPE_SKB) {
++				struct sk_buff *skb = tx_buf->data;
++
++				bytes[0] += skb->len;
++				done[0]++;
++			}
+ 			budget--;
+ 		}
+-
+ 		mtk_tx_unmap(eth, tx_buf, true);
+ 
+ 		desc = ring->dma + cpu * eth->soc->txrx.txd_size;
diff --git a/target/linux/generic/backport-5.15/707-v6.3-net-pcs-add-driver-for-MediaTek-SGMII-PCS.patch b/target/linux/generic/backport-5.15/707-v6.3-net-pcs-add-driver-for-MediaTek-SGMII-PCS.patch
new file mode 100644
index 00000000000000..9743a3f2062fb2
--- /dev/null
+++ b/target/linux/generic/backport-5.15/707-v6.3-net-pcs-add-driver-for-MediaTek-SGMII-PCS.patch
@@ -0,0 +1,394 @@
+From 4765a9722e09765866e131ec31f7b9cf4c1f4854 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sun, 19 Mar 2023 12:57:50 +0000
+Subject: [PATCH] net: pcs: add driver for MediaTek SGMII PCS
+
+The SGMII core found in several MediaTek SoCs is identical to what can
+also be found in MediaTek's MT7531 Ethernet switch IC.
+As this has not always been clear, both drivers developed different
+implementations to deal with the PCS.
+Recently Alexander Couzens pointed out this fact which lead to the
+development of this shared driver.
+
+Add a dedicated driver, mostly by copying the code now found in the
+Ethernet driver. The now redundant code will be removed by a follow-up
+commit.
+
+Suggested-by: Alexander Couzens <lynxis@fe80.eu>
+Suggested-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Tested-by: Frank Wunderlich <frank-w@public-files.de>
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ MAINTAINERS                       |   8 +
+ drivers/net/pcs/Kconfig           |   7 +
+ drivers/net/pcs/Makefile          |   1 +
+ drivers/net/pcs/pcs-mtk-lynxi.c   | 305 ++++++++++++++++++++++++++++++
+ include/linux/pcs/pcs-mtk-lynxi.h |  13 ++
+ 5 files changed, 334 insertions(+)
+ create mode 100644 drivers/net/pcs/pcs-mtk-lynxi.c
+ create mode 100644 include/linux/pcs/pcs-mtk-lynxi.h
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -11789,6 +11789,14 @@ L:	netdev@vger.kernel.org
+ S:	Maintained
+ F:	drivers/net/ethernet/mediatek/
+ 
++MEDIATEK ETHERNET PCS DRIVER
++M:	Alexander Couzens <lynxis@fe80.eu>
++M:	Daniel Golle <daniel@makrotopia.org>
++L:	netdev@vger.kernel.org
++S:	Maintained
++F:	drivers/net/pcs/pcs-mtk-lynxi.c
++F:	include/linux/pcs/pcs-mtk-lynxi.h
++
+ MEDIATEK I2C CONTROLLER DRIVER
+ M:	Qii Wang <qii.wang@mediatek.com>
+ L:	linux-i2c@vger.kernel.org
+--- a/drivers/net/pcs/Kconfig
++++ b/drivers/net/pcs/Kconfig
+@@ -18,4 +18,11 @@ config PCS_LYNX
+ 	  This module provides helpers to phylink for managing the Lynx PCS
+ 	  which is part of the Layerscape and QorIQ Ethernet SERDES.
+ 
++config PCS_MTK_LYNXI
++	tristate
++	select REGMAP
++	help
++	  This module provides helpers to phylink for managing the LynxI PCS
++	  which is part of MediaTek's SoC and Ethernet switch ICs.
++
+ endmenu
+--- a/drivers/net/pcs/Makefile
++++ b/drivers/net/pcs/Makefile
+@@ -5,3 +5,4 @@ pcs_xpcs-$(CONFIG_PCS_XPCS)	:= pcs-xpcs.
+ 
+ obj-$(CONFIG_PCS_XPCS)		+= pcs_xpcs.o
+ obj-$(CONFIG_PCS_LYNX)		+= pcs-lynx.o
++obj-$(CONFIG_PCS_MTK_LYNXI)	+= pcs-mtk-lynxi.o
+--- /dev/null
++++ b/drivers/net/pcs/pcs-mtk-lynxi.c
+@@ -0,0 +1,305 @@
++// SPDX-License-Identifier: GPL-2.0
++// Copyright (c) 2018-2019 MediaTek Inc.
++/* A library for MediaTek SGMII circuit
++ *
++ * Author: Sean Wang <sean.wang@mediatek.com>
++ * Author: Alexander Couzens <lynxis@fe80.eu>
++ * Author: Daniel Golle <daniel@makrotopia.org>
++ *
++ */
++
++#include <linux/mdio.h>
++#include <linux/of.h>
++#include <linux/pcs/pcs-mtk-lynxi.h>
++#include <linux/phylink.h>
++#include <linux/regmap.h>
++
++/* SGMII subsystem config registers */
++/* BMCR (low 16) BMSR (high 16) */
++#define SGMSYS_PCS_CONTROL_1		0x0
++#define SGMII_BMCR			GENMASK(15, 0)
++#define SGMII_BMSR			GENMASK(31, 16)
++
++#define SGMSYS_PCS_DEVICE_ID		0x4
++#define SGMII_LYNXI_DEV_ID		0x4d544950
++
++#define SGMSYS_PCS_ADVERTISE		0x8
++#define SGMII_ADVERTISE			GENMASK(15, 0)
++#define SGMII_LPA			GENMASK(31, 16)
++
++#define SGMSYS_PCS_SCRATCH		0x14
++#define SGMII_DEV_VERSION		GENMASK(31, 16)
++
++/* Register to programmable link timer, the unit in 2 * 8ns */
++#define SGMSYS_PCS_LINK_TIMER		0x18
++#define SGMII_LINK_TIMER_MASK		GENMASK(19, 0)
++#define SGMII_LINK_TIMER_VAL(ns)	FIELD_PREP(SGMII_LINK_TIMER_MASK, \
++						   ((ns) / 2 / 8))
++
++/* Register to control remote fault */
++#define SGMSYS_SGMII_MODE		0x20
++#define SGMII_IF_MODE_SGMII		BIT(0)
++#define SGMII_SPEED_DUPLEX_AN		BIT(1)
++#define SGMII_SPEED_MASK		GENMASK(3, 2)
++#define SGMII_SPEED_10			FIELD_PREP(SGMII_SPEED_MASK, 0)
++#define SGMII_SPEED_100			FIELD_PREP(SGMII_SPEED_MASK, 1)
++#define SGMII_SPEED_1000		FIELD_PREP(SGMII_SPEED_MASK, 2)
++#define SGMII_DUPLEX_HALF		BIT(4)
++#define SGMII_REMOTE_FAULT_DIS		BIT(8)
++
++/* Register to reset SGMII design */
++#define SGMSYS_RESERVED_0		0x34
++#define SGMII_SW_RESET			BIT(0)
++
++/* Register to set SGMII speed, ANA RG_ Control Signals III */
++#define SGMII_PHY_SPEED_MASK		GENMASK(3, 2)
++#define SGMII_PHY_SPEED_1_25G		FIELD_PREP(SGMII_PHY_SPEED_MASK, 0)
++#define SGMII_PHY_SPEED_3_125G		FIELD_PREP(SGMII_PHY_SPEED_MASK, 1)
++
++/* Register to power up QPHY */
++#define SGMSYS_QPHY_PWR_STATE_CTRL	0xe8
++#define	SGMII_PHYA_PWD			BIT(4)
++
++/* Register to QPHY wrapper control */
++#define SGMSYS_QPHY_WRAP_CTRL		0xec
++#define SGMII_PN_SWAP_MASK		GENMASK(1, 0)
++#define SGMII_PN_SWAP_TX_RX		(BIT(0) | BIT(1))
++
++/* struct mtk_pcs_lynxi -  This structure holds each sgmii regmap andassociated
++ *                         data
++ * @regmap:                The register map pointing at the range used to setup
++ *                         SGMII modes
++ * @dev:                   Pointer to device owning the PCS
++ * @ana_rgc3:              The offset of register ANA_RGC3 relative to regmap
++ * @interface:             Currently configured interface mode
++ * @pcs:                   Phylink PCS structure
++ * @flags:                 Flags indicating hardware properties
++ */
++struct mtk_pcs_lynxi {
++	struct regmap		*regmap;
++	u32			ana_rgc3;
++	phy_interface_t		interface;
++	struct			phylink_pcs pcs;
++	u32			flags;
++};
++
++static struct mtk_pcs_lynxi *pcs_to_mtk_pcs_lynxi(struct phylink_pcs *pcs)
++{
++	return container_of(pcs, struct mtk_pcs_lynxi, pcs);
++}
++
++static void mtk_pcs_lynxi_get_state(struct phylink_pcs *pcs,
++				    struct phylink_link_state *state)
++{
++	struct mtk_pcs_lynxi *mpcs = pcs_to_mtk_pcs_lynxi(pcs);
++	unsigned int bm, adv;
++
++	/* Read the BMSR and LPA */
++	regmap_read(mpcs->regmap, SGMSYS_PCS_CONTROL_1, &bm);
++	regmap_read(mpcs->regmap, SGMSYS_PCS_ADVERTISE, &adv);
++
++	phylink_mii_c22_pcs_decode_state(state, FIELD_GET(SGMII_BMSR, bm),
++					 FIELD_GET(SGMII_LPA, adv));
++}
++
++static int mtk_pcs_lynxi_config(struct phylink_pcs *pcs, unsigned int mode,
++				phy_interface_t interface,
++				const unsigned long *advertising,
++				bool permit_pause_to_mac)
++{
++	struct mtk_pcs_lynxi *mpcs = pcs_to_mtk_pcs_lynxi(pcs);
++	bool mode_changed = false, changed, use_an;
++	unsigned int rgc3, sgm_mode, bmcr;
++	int advertise, link_timer;
++
++	advertise = phylink_mii_c22_pcs_encode_advertisement(interface,
++							     advertising);
++	if (advertise < 0)
++		return advertise;
++
++	/* Clearing IF_MODE_BIT0 switches the PCS to BASE-X mode, and
++	 * we assume that fixes it's speed at bitrate = line rate (in
++	 * other words, 1000Mbps or 2500Mbps).
++	 */
++	if (interface == PHY_INTERFACE_MODE_SGMII) {
++		sgm_mode = SGMII_IF_MODE_SGMII;
++		if (phylink_autoneg_inband(mode)) {
++			sgm_mode |= SGMII_REMOTE_FAULT_DIS |
++				    SGMII_SPEED_DUPLEX_AN;
++			use_an = true;
++		} else {
++			use_an = false;
++		}
++	} else if (phylink_autoneg_inband(mode)) {
++		/* 1000base-X or 2500base-X autoneg */
++		sgm_mode = SGMII_REMOTE_FAULT_DIS;
++		use_an = linkmode_test_bit(ETHTOOL_LINK_MODE_Autoneg_BIT,
++					   advertising);
++	} else {
++		/* 1000base-X or 2500base-X without autoneg */
++		sgm_mode = 0;
++		use_an = false;
++	}
++
++	if (use_an)
++		bmcr = BMCR_ANENABLE;
++	else
++		bmcr = 0;
++
++	if (mpcs->interface != interface) {
++		link_timer = phylink_get_link_timer_ns(interface);
++		if (link_timer < 0)
++			return link_timer;
++
++		/* PHYA power down */
++		regmap_set_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
++				SGMII_PHYA_PWD);
++
++		/* Reset SGMII PCS state */
++		regmap_set_bits(mpcs->regmap, SGMSYS_RESERVED_0,
++				SGMII_SW_RESET);
++
++		if (mpcs->flags & MTK_SGMII_FLAG_PN_SWAP)
++			regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_WRAP_CTRL,
++					   SGMII_PN_SWAP_MASK,
++					   SGMII_PN_SWAP_TX_RX);
++
++		if (interface == PHY_INTERFACE_MODE_2500BASEX)
++			rgc3 = SGMII_PHY_SPEED_3_125G;
++		else
++			rgc3 = SGMII_PHY_SPEED_1_25G;
++
++		/* Configure the underlying interface speed */
++		regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
++				   SGMII_PHY_SPEED_MASK, rgc3);
++
++		/* Setup the link timer */
++		regmap_write(mpcs->regmap, SGMSYS_PCS_LINK_TIMER,
++			     SGMII_LINK_TIMER_VAL(link_timer));
++
++		mpcs->interface = interface;
++		mode_changed = true;
++	}
++
++	/* Update the advertisement, noting whether it has changed */
++	regmap_update_bits_check(mpcs->regmap, SGMSYS_PCS_ADVERTISE,
++				 SGMII_ADVERTISE, advertise, &changed);
++
++	/* Update the sgmsys mode register */
++	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
++			   SGMII_REMOTE_FAULT_DIS | SGMII_SPEED_DUPLEX_AN |
++			   SGMII_IF_MODE_SGMII, sgm_mode);
++
++	/* Update the BMCR */
++	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
++			   BMCR_ANENABLE, bmcr);
++
++	/* Release PHYA power down state
++	 * Only removing bit SGMII_PHYA_PWD isn't enough.
++	 * There are cases when the SGMII_PHYA_PWD register contains 0x9 which
++	 * prevents SGMII from working. The SGMII still shows link but no traffic
++	 * can flow. Writing 0x0 to the PHYA_PWD register fix the issue. 0x0 was
++	 * taken from a good working state of the SGMII interface.
++	 * Unknown how much the QPHY needs but it is racy without a sleep.
++	 * Tested on mt7622 & mt7986.
++	 */
++	usleep_range(50, 100);
++	regmap_write(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, 0);
++
++	return changed || mode_changed;
++}
++
++static void mtk_pcs_lynxi_restart_an(struct phylink_pcs *pcs)
++{
++	struct mtk_pcs_lynxi *mpcs = pcs_to_mtk_pcs_lynxi(pcs);
++
++	regmap_set_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1, BMCR_ANRESTART);
++}
++
++static void mtk_pcs_lynxi_link_up(struct phylink_pcs *pcs, unsigned int mode,
++				  phy_interface_t interface, int speed,
++				  int duplex)
++{
++	struct mtk_pcs_lynxi *mpcs = pcs_to_mtk_pcs_lynxi(pcs);
++	unsigned int sgm_mode;
++
++	if (!phylink_autoneg_inband(mode)) {
++		/* Force the speed and duplex setting */
++		if (speed == SPEED_10)
++			sgm_mode = SGMII_SPEED_10;
++		else if (speed == SPEED_100)
++			sgm_mode = SGMII_SPEED_100;
++		else
++			sgm_mode = SGMII_SPEED_1000;
++
++		if (duplex != DUPLEX_FULL)
++			sgm_mode |= SGMII_DUPLEX_HALF;
++
++		regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
++				   SGMII_DUPLEX_HALF | SGMII_SPEED_MASK,
++				   sgm_mode);
++	}
++}
++
++static const struct phylink_pcs_ops mtk_pcs_lynxi_ops = {
++	.pcs_get_state = mtk_pcs_lynxi_get_state,
++	.pcs_config = mtk_pcs_lynxi_config,
++	.pcs_an_restart = mtk_pcs_lynxi_restart_an,
++	.pcs_link_up = mtk_pcs_lynxi_link_up,
++};
++
++struct phylink_pcs *mtk_pcs_lynxi_create(struct device *dev,
++					 struct regmap *regmap, u32 ana_rgc3,
++					 u32 flags)
++{
++	struct mtk_pcs_lynxi *mpcs;
++	u32 id, ver;
++	int ret;
++
++	ret = regmap_read(regmap, SGMSYS_PCS_DEVICE_ID, &id);
++	if (ret < 0)
++		return NULL;
++
++	if (id != SGMII_LYNXI_DEV_ID) {
++		dev_err(dev, "unknown PCS device id %08x\n", id);
++		return NULL;
++	}
++
++	ret = regmap_read(regmap, SGMSYS_PCS_SCRATCH, &ver);
++	if (ret < 0)
++		return NULL;
++
++	ver = FIELD_GET(SGMII_DEV_VERSION, ver);
++	if (ver != 0x1) {
++		dev_err(dev, "unknown PCS device version %04x\n", ver);
++		return NULL;
++	}
++
++	dev_dbg(dev, "MediaTek LynxI SGMII PCS (id 0x%08x, ver 0x%04x)\n", id,
++		ver);
++
++	mpcs = kzalloc(sizeof(*mpcs), GFP_KERNEL);
++	if (!mpcs)
++		return NULL;
++
++	mpcs->ana_rgc3 = ana_rgc3;
++	mpcs->regmap = regmap;
++	mpcs->flags = flags;
++	mpcs->pcs.ops = &mtk_pcs_lynxi_ops;
++	mpcs->pcs.poll = true;
++	mpcs->interface = PHY_INTERFACE_MODE_NA;
++
++	return &mpcs->pcs;
++}
++EXPORT_SYMBOL(mtk_pcs_lynxi_create);
++
++void mtk_pcs_lynxi_destroy(struct phylink_pcs *pcs)
++{
++	if (!pcs)
++		return;
++
++	kfree(pcs_to_mtk_pcs_lynxi(pcs));
++}
++EXPORT_SYMBOL(mtk_pcs_lynxi_destroy);
++
++MODULE_LICENSE("GPL");
+--- /dev/null
++++ b/include/linux/pcs/pcs-mtk-lynxi.h
+@@ -0,0 +1,13 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef __LINUX_PCS_MTK_LYNXI_H
++#define __LINUX_PCS_MTK_LYNXI_H
++
++#include <linux/phylink.h>
++#include <linux/regmap.h>
++
++#define MTK_SGMII_FLAG_PN_SWAP BIT(0)
++struct phylink_pcs *mtk_pcs_lynxi_create(struct device *dev,
++					 struct regmap *regmap,
++					 u32 ana_rgc3, u32 flags);
++void mtk_pcs_lynxi_destroy(struct phylink_pcs *pcs);
++#endif
diff --git a/target/linux/generic/backport-5.15/708-01-v5.16-net-mvneta-Delete-unused-variable.patch b/target/linux/generic/backport-5.15/708-01-v5.16-net-mvneta-Delete-unused-variable.patch
new file mode 100644
index 00000000000000..421563ef08cf9d
--- /dev/null
+++ b/target/linux/generic/backport-5.15/708-01-v5.16-net-mvneta-Delete-unused-variable.patch
@@ -0,0 +1,62 @@
+From 43ed6fff01333868a1d0e19876f67c22d9939952 Mon Sep 17 00:00:00 2001
+From: Yuval Shaia <yshaia@marvell.com>
+Date: Wed, 13 Oct 2021 09:49:21 +0300
+Subject: [PATCH] net: mvneta: Delete unused variable
+
+The variable pp is not in use - delete it.
+
+Signed-off-by: Yuval Shaia <yshaia@marvell.com>
+Link: https://lore.kernel.org/r/20211013064921.26346-1-yshaia@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -1914,7 +1914,7 @@ static int mvneta_rx_refill(struct mvnet
+ }
+ 
+ /* Handle tx checksum */
+-static u32 mvneta_skb_tx_csum(struct mvneta_port *pp, struct sk_buff *skb)
++static u32 mvneta_skb_tx_csum(struct sk_buff *skb)
+ {
+ 	if (skb->ip_summed == CHECKSUM_PARTIAL) {
+ 		int ip_hdr_len = 0;
+@@ -2595,8 +2595,7 @@ err_drop_frame:
+ }
+ 
+ static inline void
+-mvneta_tso_put_hdr(struct sk_buff *skb,
+-		   struct mvneta_port *pp, struct mvneta_tx_queue *txq)
++mvneta_tso_put_hdr(struct sk_buff *skb, struct mvneta_tx_queue *txq)
+ {
+ 	int hdr_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
+ 	struct mvneta_tx_buf *buf = &txq->buf[txq->txq_put_index];
+@@ -2604,7 +2603,7 @@ mvneta_tso_put_hdr(struct sk_buff *skb,
+ 
+ 	tx_desc = mvneta_txq_next_desc_get(txq);
+ 	tx_desc->data_size = hdr_len;
+-	tx_desc->command = mvneta_skb_tx_csum(pp, skb);
++	tx_desc->command = mvneta_skb_tx_csum(skb);
+ 	tx_desc->command |= MVNETA_TXD_F_DESC;
+ 	tx_desc->buf_phys_addr = txq->tso_hdrs_phys +
+ 				 txq->txq_put_index * TSO_HEADER_SIZE;
+@@ -2681,7 +2680,7 @@ static int mvneta_tx_tso(struct sk_buff
+ 		hdr = txq->tso_hdrs + txq->txq_put_index * TSO_HEADER_SIZE;
+ 		tso_build_hdr(skb, hdr, &tso, data_left, total_len == 0);
+ 
+-		mvneta_tso_put_hdr(skb, pp, txq);
++		mvneta_tso_put_hdr(skb, txq);
+ 
+ 		while (data_left > 0) {
+ 			int size;
+@@ -2799,7 +2798,7 @@ static netdev_tx_t mvneta_tx(struct sk_b
+ 	/* Get a descriptor for the first part of the packet */
+ 	tx_desc = mvneta_txq_next_desc_get(txq);
+ 
+-	tx_cmd = mvneta_skb_tx_csum(pp, skb);
++	tx_cmd = mvneta_skb_tx_csum(skb);
+ 
+ 	tx_desc->data_size = skb_headlen(skb);
+ 
diff --git a/target/linux/generic/backport-5.15/708-02-v6.3-net-mvneta-fix-potential-double-frees-in-mvneta_txq_.patch b/target/linux/generic/backport-5.15/708-02-v6.3-net-mvneta-fix-potential-double-frees-in-mvneta_txq_.patch
new file mode 100644
index 00000000000000..a16e68ee4fd9c5
--- /dev/null
+++ b/target/linux/generic/backport-5.15/708-02-v6.3-net-mvneta-fix-potential-double-frees-in-mvneta_txq_.patch
@@ -0,0 +1,37 @@
+From 0cf39c6543469aae4a30cba354243125514ed568 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Wed, 29 Mar 2023 13:11:17 +0100
+Subject: [PATCH] net: mvneta: fix potential double-frees in
+ mvneta_txq_sw_deinit()
+
+Reported on the Turris forum, mvneta provokes kernel warnings in the
+architecture DMA mapping code when mvneta_setup_txqs() fails to
+allocate memory. This happens because when mvneta_cleanup_txqs() is
+called in the mvneta_stop() path, we leave pointers in the structure
+that have been freed.
+
+Then on mvneta_open(), we call mvneta_setup_txqs(), which starts
+allocating memory. On memory allocation failure, mvneta_cleanup_txqs()
+will walk all the queues freeing any non-NULL pointers - which includes
+pointers that were previously freed in mvneta_stop().
+
+Fix this by setting these pointers to NULL to prevent double-freeing
+of the same memory.
+
+Link: https://forum.turris.cz/t/random-kernel-exceptions-on-hbl-tos-7-0/18865/8
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -3481,6 +3481,8 @@ static void mvneta_txq_sw_deinit(struct
+ 
+ 	netdev_tx_reset_queue(nq);
+ 
++	txq->buf               = NULL;
++	txq->tso_hdrs          = NULL;
+ 	txq->descs             = NULL;
+ 	txq->last_desc         = 0;
+ 	txq->next_desc_to_proc = 0;
diff --git a/target/linux/generic/backport-5.15/710-v6.0-net-ethernet-mtk_eth_soc-fix-hw-hash-reporting-for-M.patch b/target/linux/generic/backport-5.15/710-v6.0-net-ethernet-mtk_eth_soc-fix-hw-hash-reporting-for-M.patch
index 87941ef766a42c..817b3e10fdf155 100644
--- a/target/linux/generic/backport-5.15/710-v6.0-net-ethernet-mtk_eth_soc-fix-hw-hash-reporting-for-M.patch
+++ b/target/linux/generic/backport-5.15/710-v6.0-net-ethernet-mtk_eth_soc-fix-hw-hash-reporting-for-M.patch
@@ -18,9 +18,9 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -1469,10 +1469,19 @@ static int mtk_poll_rx(struct napi_struc
+@@ -1846,10 +1846,19 @@ static int mtk_poll_rx(struct napi_struc
  		skb->dev = netdev;
- 		skb_put(skb, pktlen);
+ 		bytes += skb->len;
  
 -		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
 +		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
@@ -40,9 +40,9 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  
  		if (*rxdcsum & eth->soc->txrx.rx_dma_l4_valid)
  			skb->ip_summed = CHECKSUM_UNNECESSARY;
-@@ -1481,16 +1490,9 @@ static int mtk_poll_rx(struct napi_struc
+@@ -1857,16 +1866,9 @@ static int mtk_poll_rx(struct napi_struc
+ 			skb_checksum_none_assert(skb);
  		skb->protocol = eth_type_trans(skb, netdev);
- 		bytes += pktlen;
  
 -		hash = trxd.rxd4 & MTK_RXD4_FOE_ENTRY;
 -		if (hash != MTK_RXD4_FOE_ENTRY) {
@@ -60,7 +60,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  			if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -307,6 +307,11 @@
+@@ -314,6 +314,11 @@
  #define RX_DMA_L4_VALID_PDMA	BIT(30)		/* when PDMA is used */
  #define RX_DMA_SPECIAL_TAG	BIT(22)
  
diff --git a/target/linux/generic/backport-5.15/711-v6.0-01-net-ethernet-mtk_eth_soc-fix-off-by-one-check-of-ARR.patch b/target/linux/generic/backport-5.15/711-v6.0-01-net-ethernet-mtk_eth_soc-fix-off-by-one-check-of-ARR.patch
new file mode 100644
index 00000000000000..0de8ab4376c066
--- /dev/null
+++ b/target/linux/generic/backport-5.15/711-v6.0-01-net-ethernet-mtk_eth_soc-fix-off-by-one-check-of-ARR.patch
@@ -0,0 +1,31 @@
+From: Tom Rix <trix@redhat.com>
+Date: Sat, 16 Jul 2022 17:46:54 -0400
+Subject: [PATCH] net: ethernet: mtk_eth_soc: fix off by one check of
+ ARRAY_SIZE
+
+In mtk_wed_tx_ring_setup(.., int idx, ..), idx is used as an index here
+  struct mtk_wed_ring *ring = &dev->tx_ring[idx];
+
+The bounds of idx are checked here
+  BUG_ON(idx > ARRAY_SIZE(dev->tx_ring));
+
+If idx is the size of the array, it will pass this check and overflow.
+So change the check to >= .
+
+Fixes: 804775dfc288 ("net: ethernet: mtk_eth_soc: add support for Wireless Ethernet Dispatch (WED)")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Link: https://lore.kernel.org/r/20220716214654.1540240-1-trix@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -651,7 +651,7 @@ mtk_wed_tx_ring_setup(struct mtk_wed_dev
+ 	 * WDMA RX.
+ 	 */
+ 
+-	BUG_ON(idx > ARRAY_SIZE(dev->tx_ring));
++	BUG_ON(idx >= ARRAY_SIZE(dev->tx_ring));
+ 
+ 	if (mtk_wed_ring_alloc(dev, ring, MTK_WED_TX_RING_SIZE))
+ 		return -ENOMEM;
diff --git a/target/linux/generic/backport-5.15/711-v6.0-02-net-ethernet-mtk_ppe-fix-possible-NULL-pointer-deref.patch b/target/linux/generic/backport-5.15/711-v6.0-02-net-ethernet-mtk_ppe-fix-possible-NULL-pointer-deref.patch
new file mode 100644
index 00000000000000..fc6e2464688cc3
--- /dev/null
+++ b/target/linux/generic/backport-5.15/711-v6.0-02-net-ethernet-mtk_ppe-fix-possible-NULL-pointer-deref.patch
@@ -0,0 +1,27 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Mon, 18 Jul 2022 11:51:53 +0200
+Subject: [PATCH] net: ethernet: mtk_ppe: fix possible NULL pointer dereference
+ in mtk_flow_get_wdma_info
+
+odev pointer can be NULL in mtk_flow_offload_replace routine according
+to the flower action rules. Fix possible NULL pointer dereference in
+mtk_flow_get_wdma_info.
+
+Fixes: a333215e10cb5 ("net: ethernet: mtk_eth_soc: implement flow offloading to WED devices")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/4e1685bc4976e21e364055f6bee86261f8f9ee93.1658137753.git.lorenzo@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
+@@ -93,6 +93,9 @@ mtk_flow_get_wdma_info(struct net_device
+ 	};
+ 	struct net_device_path path = {};
+ 
++	if (!ctx.dev)
++		return -ENODEV;
++
+ 	memcpy(ctx.daddr, addr, sizeof(ctx.daddr));
+ 
+ 	if (!IS_ENABLED(CONFIG_NET_MEDIATEK_SOC_WED))
diff --git a/target/linux/generic/backport-5.15/711-v6.0-03-net-ethernet-mtk-ppe-fix-traffic-offload-with-bridge.patch b/target/linux/generic/backport-5.15/711-v6.0-03-net-ethernet-mtk-ppe-fix-traffic-offload-with-bridge.patch
new file mode 100644
index 00000000000000..c0720152d65ddf
--- /dev/null
+++ b/target/linux/generic/backport-5.15/711-v6.0-03-net-ethernet-mtk-ppe-fix-traffic-offload-with-bridge.patch
@@ -0,0 +1,64 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 22 Jul 2022 09:06:19 +0200
+Subject: [PATCH] net: ethernet: mtk-ppe: fix traffic offload with bridged wlan
+
+A typical flow offload scenario for OpenWrt users is routed traffic
+received by the wan interface that is redirected to a wlan device
+belonging to the lan bridge. Current implementation fails to
+fill wdma offload info in mtk_flow_get_wdma_info() since odev device is
+the local bridge. Fix the issue running dev_fill_forward_path routine in
+mtk_flow_get_wdma_info in order to identify the wlan device.
+
+Tested-by: Paolo Valerio <pvalerio@redhat.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
+@@ -88,32 +88,28 @@ mtk_flow_offload_mangle_eth(const struct
+ static int
+ mtk_flow_get_wdma_info(struct net_device *dev, const u8 *addr, struct mtk_wdma_info *info)
+ {
+-	struct net_device_path_ctx ctx = {
+-		.dev = dev,
+-	};
+-	struct net_device_path path = {};
++	struct net_device_path_stack stack;
++	struct net_device_path *path;
++	int err;
+ 
+-	if (!ctx.dev)
++	if (!dev)
+ 		return -ENODEV;
+ 
+-	memcpy(ctx.daddr, addr, sizeof(ctx.daddr));
+-
+ 	if (!IS_ENABLED(CONFIG_NET_MEDIATEK_SOC_WED))
+ 		return -1;
+ 
+-	if (!dev->netdev_ops->ndo_fill_forward_path)
+-		return -1;
+-
+-	if (dev->netdev_ops->ndo_fill_forward_path(&ctx, &path))
+-		return -1;
++	err = dev_fill_forward_path(dev, addr, &stack);
++	if (err)
++		return err;
+ 
+-	if (path.type != DEV_PATH_MTK_WDMA)
++	path = &stack.path[stack.num_paths - 1];
++	if (path->type != DEV_PATH_MTK_WDMA)
+ 		return -1;
+ 
+-	info->wdma_idx = path.mtk_wdma.wdma_idx;
+-	info->queue = path.mtk_wdma.queue;
+-	info->bss = path.mtk_wdma.bss;
+-	info->wcid = path.mtk_wdma.wcid;
++	info->wdma_idx = path->mtk_wdma.wdma_idx;
++	info->queue = path->mtk_wdma.queue;
++	info->bss = path->mtk_wdma.bss;
++	info->wcid = path->mtk_wdma.wcid;
+ 
+ 	return 0;
+ }
diff --git a/target/linux/generic/backport-5.15/711-v6.0-04-net-ethernet-mtk_eth_soc-remove-mtk_foe_entry_timest.patch b/target/linux/generic/backport-5.15/711-v6.0-04-net-ethernet-mtk_eth_soc-remove-mtk_foe_entry_timest.patch
new file mode 100644
index 00000000000000..3c28e835518243
--- /dev/null
+++ b/target/linux/generic/backport-5.15/711-v6.0-04-net-ethernet-mtk_eth_soc-remove-mtk_foe_entry_timest.patch
@@ -0,0 +1,33 @@
+From c9daab322313087afde8c46f41df3c628410ae20 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Mon, 5 Sep 2022 14:46:01 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: remove mtk_foe_entry_timestamp
+
+Get rid of mtk_foe_entry_timestamp routine since it is no longer used.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/mediatek/mtk_ppe.h | 11 -----------
+ 1 file changed, 11 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h
+@@ -302,17 +302,6 @@ mtk_ppe_check_skb(struct mtk_ppe *ppe, s
+ 	__mtk_ppe_check_skb(ppe, skb, hash);
+ }
+ 
+-static inline int
+-mtk_foe_entry_timestamp(struct mtk_ppe *ppe, u16 hash)
+-{
+-	u32 ib1 = READ_ONCE(ppe->foe_table[hash].ib1);
+-
+-	if (FIELD_GET(MTK_FOE_IB1_STATE, ib1) != MTK_FOE_STATE_BIND)
+-		return -1;
+-
+-	return FIELD_GET(MTK_FOE_IB1_BIND_TIMESTAMP, ib1);
+-}
+-
+ int mtk_foe_entry_prepare(struct mtk_foe_entry *entry, int type, int l4proto,
+ 			  u8 pse_port, u8 *src_mac, u8 *dest_mac);
+ int mtk_foe_entry_set_pse_port(struct mtk_foe_entry *entry, u8 port);
diff --git a/target/linux/generic/backport-5.15/712-v6.0-net-ethernet-mtk_eth_soc-enable-XDP-support-just-for.patch b/target/linux/generic/backport-5.15/712-v6.0-net-ethernet-mtk_eth_soc-enable-XDP-support-just-for.patch
new file mode 100644
index 00000000000000..f6fc7340794bcd
--- /dev/null
+++ b/target/linux/generic/backport-5.15/712-v6.0-net-ethernet-mtk_eth_soc-enable-XDP-support-just-for.patch
@@ -0,0 +1,35 @@
+From 5e69163d3b9931098922b3fc2f8e786af8c1f37e Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 13 Sep 2022 15:03:05 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: enable XDP support just for
+ MT7986 SoC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Disable page_pool/XDP support for MT7621 SoC in order fix a regression
+introduce adding XDP for MT7986 SoC. There is no a real use case for XDP
+on MT7621 since it is a low-end cpu. Moreover this patch reduces the
+memory footprint.
+
+Tested-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Tested-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Fixes: 23233e577ef9 ("net: ethernet: mtk_eth_soc: rely on page_pool for single page buffers")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/2bf31e27b888c43228b0d84dd2ef5033338269e2.1663074002.git.lorenzo@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1413,7 +1413,7 @@ static void mtk_update_rx_cpu_idx(struct
+ 
+ static bool mtk_page_pool_enabled(struct mtk_eth *eth)
+ {
+-	return !eth->hwlro;
++	return MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2);
+ }
+ 
+ static struct page_pool *mtk_create_page_pool(struct mtk_eth *eth,
diff --git a/target/linux/generic/backport-5.15/713-v6.0-net-ethernet-mtk_eth_soc-move-gdma_to_ppe-and-ppe_ba.patch b/target/linux/generic/backport-5.15/713-v6.0-net-ethernet-mtk_eth_soc-move-gdma_to_ppe-and-ppe_ba.patch
new file mode 100644
index 00000000000000..f8bbea6c8586c6
--- /dev/null
+++ b/target/linux/generic/backport-5.15/713-v6.0-net-ethernet-mtk_eth_soc-move-gdma_to_ppe-and-ppe_ba.patch
@@ -0,0 +1,127 @@
+From patchwork Thu Sep  8 19:33:38 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Lorenzo Bianconi <lorenzo@kernel.org>
+X-Patchwork-Id: 12970556
+X-Patchwork-Delegate: kuba@kernel.org
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+To: netdev@vger.kernel.org
+Cc: nbd@nbd.name, john@phrozen.org, sean.wang@mediatek.com,
+        Mark-MC.Lee@mediatek.com, davem@davemloft.net, edumazet@google.com,
+        kuba@kernel.org, pabeni@redhat.com, matthias.bgg@gmail.com,
+        linux-mediatek@lists.infradead.org, lorenzo.bianconi@redhat.com,
+        Bo.Jiao@mediatek.com, sujuan.chen@mediatek.com,
+        ryder.Lee@mediatek.com, evelyn.tsai@mediatek.com,
+        devicetree@vger.kernel.org, robh@kernel.org
+Subject: [PATCH net-next 03/12] net: ethernet: mtk_eth_soc: move gdma_to_ppe
+ and ppe_base definitions in mtk register map
+Date: Thu,  8 Sep 2022 21:33:37 +0200
+Message-Id: 
+ <95938fc9cbe0223714be2658a49ca58e9baace00.1662661555.git.lorenzo@kernel.org>
+X-Mailer: git-send-email 2.37.3
+In-Reply-To: <cover.1662661555.git.lorenzo@kernel.org>
+References: <cover.1662661555.git.lorenzo@kernel.org>
+MIME-Version: 1.0
+Precedence: bulk
+List-ID: <netdev.vger.kernel.org>
+X-Mailing-List: netdev@vger.kernel.org
+X-Patchwork-Delegate: kuba@kernel.org
+
+This is a preliminary patch to introduce mt7986 hw packet engine.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 15 +++++++++++----
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h |  3 ++-
+ drivers/net/ethernet/mediatek/mtk_ppe.h     |  2 --
+ 3 files changed, 13 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -73,6 +73,8 @@ static const struct mtk_reg_map mtk_reg_
+ 		.fq_blen	= 0x1b2c,
+ 	},
+ 	.gdm1_cnt		= 0x2400,
++	.gdma_to_ppe0		= 0x4444,
++	.ppe_base		= 0x0c00,
+ };
+ 
+ static const struct mtk_reg_map mt7628_reg_map = {
+@@ -126,6 +128,8 @@ static const struct mtk_reg_map mt7986_r
+ 		.fq_blen	= 0x472c,
+ 	},
+ 	.gdm1_cnt		= 0x1c00,
++	.gdma_to_ppe0		= 0x3333,
++	.ppe_base		= 0x2000,
+ };
+ 
+ /* strings used by ethtool */
+@@ -2925,6 +2929,7 @@ static int mtk_open(struct net_device *d
+ 
+ 	/* we run 2 netdevs on the same dma ring so we only bring it up once */
+ 	if (!refcount_read(&eth->dma_refcnt)) {
++		const struct mtk_soc_data *soc = eth->soc;
+ 		u32 gdm_config = MTK_GDMA_TO_PDMA;
+ 		int err;
+ 
+@@ -2934,15 +2939,15 @@ static int mtk_open(struct net_device *d
+ 			return err;
+ 		}
+ 
+-		if (eth->soc->offload_version && mtk_ppe_start(eth->ppe) == 0)
+-			gdm_config = MTK_GDMA_TO_PPE;
++		if (soc->offload_version && mtk_ppe_start(eth->ppe) == 0)
++			gdm_config = soc->reg_map->gdma_to_ppe0;
+ 
+ 		mtk_gdm_config(eth, gdm_config);
+ 
+ 		napi_enable(&eth->tx_napi);
+ 		napi_enable(&eth->rx_napi);
+ 		mtk_tx_irq_enable(eth, MTK_TX_DONE_INT);
+-		mtk_rx_irq_enable(eth, eth->soc->txrx.rx_irq_done_mask);
++		mtk_rx_irq_enable(eth, soc->txrx.rx_irq_done_mask);
+ 		refcount_set(&eth->dma_refcnt, 1);
+ 	}
+ 	else
+@@ -4048,7 +4053,9 @@ static int mtk_probe(struct platform_dev
+ 	}
+ 
+ 	if (eth->soc->offload_version) {
+-		eth->ppe = mtk_ppe_init(eth, eth->base + MTK_ETH_PPE_BASE, 2);
++		u32 ppe_addr = eth->soc->reg_map->ppe_base;
++
++		eth->ppe = mtk_ppe_init(eth, eth->base + ppe_addr, 2);
+ 		if (!eth->ppe) {
+ 			err = -ENOMEM;
+ 			goto err_free_dev;
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -105,7 +105,6 @@
+ #define MTK_GDMA_TCS_EN		BIT(21)
+ #define MTK_GDMA_UCS_EN		BIT(20)
+ #define MTK_GDMA_TO_PDMA	0x0
+-#define MTK_GDMA_TO_PPE		0x4444
+ #define MTK_GDMA_DROP_ALL       0x7777
+ 
+ /* Unicast Filter MAC Address Register - Low */
+@@ -953,6 +952,8 @@ struct mtk_reg_map {
+ 		u32	fq_blen;	/* fq free page buffer length */
+ 	} qdma;
+ 	u32	gdm1_cnt;
++	u32	gdma_to_ppe0;
++	u32	ppe_base;
+ };
+ 
+ /* struct mtk_eth_data -	This is the structure holding all differences
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h
+@@ -8,8 +8,6 @@
+ #include <linux/bitfield.h>
+ #include <linux/rhashtable.h>
+ 
+-#define MTK_ETH_PPE_BASE		0xc00
+-
+ #define MTK_PPE_ENTRIES_SHIFT		3
+ #define MTK_PPE_ENTRIES			(1024 << MTK_PPE_ENTRIES_SHIFT)
+ #define MTK_PPE_HASH_MASK		(MTK_PPE_ENTRIES - 1)
diff --git a/target/linux/generic/backport-5.15/714-v6.0-net-ethernet-mtk_eth_soc-move-ppe-table-hash-offset-.patch b/target/linux/generic/backport-5.15/714-v6.0-net-ethernet-mtk_eth_soc-move-ppe-table-hash-offset-.patch
new file mode 100644
index 00000000000000..7bed2785c99b01
--- /dev/null
+++ b/target/linux/generic/backport-5.15/714-v6.0-net-ethernet-mtk_eth_soc-move-ppe-table-hash-offset-.patch
@@ -0,0 +1,199 @@
+From patchwork Thu Sep  8 19:33:38 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Lorenzo Bianconi <lorenzo@kernel.org>
+X-Patchwork-Id: 12970557
+X-Patchwork-Delegate: kuba@kernel.org
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+To: netdev@vger.kernel.org
+Cc: nbd@nbd.name, john@phrozen.org, sean.wang@mediatek.com,
+        Mark-MC.Lee@mediatek.com, davem@davemloft.net, edumazet@google.com,
+        kuba@kernel.org, pabeni@redhat.com, matthias.bgg@gmail.com,
+        linux-mediatek@lists.infradead.org, lorenzo.bianconi@redhat.com,
+        Bo.Jiao@mediatek.com, sujuan.chen@mediatek.com,
+        ryder.Lee@mediatek.com, evelyn.tsai@mediatek.com,
+        devicetree@vger.kernel.org, robh@kernel.org
+Subject: [PATCH net-next 04/12] net: ethernet: mtk_eth_soc: move ppe table
+ hash offset to mtk_soc_data structure
+Date: Thu,  8 Sep 2022 21:33:38 +0200
+Message-Id: 
+ <cc263ffeaa3e1d7314e36a4f941e96d38e41a6bf.1662661555.git.lorenzo@kernel.org>
+X-Mailer: git-send-email 2.37.3
+In-Reply-To: <cover.1662661555.git.lorenzo@kernel.org>
+References: <cover.1662661555.git.lorenzo@kernel.org>
+MIME-Version: 1.0
+Precedence: bulk
+List-ID: <netdev.vger.kernel.org>
+X-Mailing-List: netdev@vger.kernel.org
+X-Patchwork-Delegate: kuba@kernel.org
+
+This is a preliminary patch to introduce mt7986 hw packet engine.
+
+Co-developed-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c |  4 ++++
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h |  2 ++
+ drivers/net/ethernet/mediatek/mtk_ppe.c     | 24 +++++++++++++++------
+ drivers/net/ethernet/mediatek/mtk_ppe.h     |  2 +-
+ 4 files changed, 25 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -4151,6 +4151,7 @@ static const struct mtk_soc_data mt7621_
+ 	.required_clks = MT7621_CLKS_BITMAP,
+ 	.required_pctl = false,
+ 	.offload_version = 2,
++	.hash_offset = 2,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+ 		.rxd_size = sizeof(struct mtk_rx_dma),
+@@ -4169,6 +4170,7 @@ static const struct mtk_soc_data mt7622_
+ 	.required_clks = MT7622_CLKS_BITMAP,
+ 	.required_pctl = false,
+ 	.offload_version = 2,
++	.hash_offset = 2,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+ 		.rxd_size = sizeof(struct mtk_rx_dma),
+@@ -4186,6 +4188,7 @@ static const struct mtk_soc_data mt7623_
+ 	.required_clks = MT7623_CLKS_BITMAP,
+ 	.required_pctl = true,
+ 	.offload_version = 2,
++	.hash_offset = 2,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+ 		.rxd_size = sizeof(struct mtk_rx_dma),
+@@ -4219,6 +4222,7 @@ static const struct mtk_soc_data mt7986_
+ 	.caps = MT7986_CAPS,
+ 	.required_clks = MT7986_CLKS_BITMAP,
+ 	.required_pctl = false,
++	.hash_offset = 4,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma_v2),
+ 		.rxd_size = sizeof(struct mtk_rx_dma_v2),
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -967,6 +967,7 @@ struct mtk_reg_map {
+  *				the target SoC
+  * @required_pctl		A bool value to show whether the SoC requires
+  *				the extra setup for those pins used by GMAC.
++ * @hash_offset			Flow table hash offset.
+  * @txd_size			Tx DMA descriptor size.
+  * @rxd_size			Rx DMA descriptor size.
+  * @rx_irq_done_mask		Rx irq done register mask.
+@@ -981,6 +982,7 @@ struct mtk_soc_data {
+ 	u32		required_clks;
+ 	bool		required_pctl;
+ 	u8		offload_version;
++	u8		hash_offset;
+ 	netdev_features_t hw_features;
+ 	struct {
+ 		u32	txd_size;
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -88,7 +88,7 @@ static void mtk_ppe_cache_enable(struct
+ 		enable * MTK_PPE_CACHE_CTL_EN);
+ }
+ 
+-static u32 mtk_ppe_hash_entry(struct mtk_foe_entry *e)
++static u32 mtk_ppe_hash_entry(struct mtk_eth *eth, struct mtk_foe_entry *e)
+ {
+ 	u32 hv1, hv2, hv3;
+ 	u32 hash;
+@@ -122,7 +122,7 @@ static u32 mtk_ppe_hash_entry(struct mtk
+ 	hash = (hash >> 24) | ((hash & 0xffffff) << 8);
+ 	hash ^= hv1 ^ hv2 ^ hv3;
+ 	hash ^= hash >> 16;
+-	hash <<= 1;
++	hash <<= (ffs(eth->soc->hash_offset) - 1);
+ 	hash &= MTK_PPE_ENTRIES - 1;
+ 
+ 	return hash;
+@@ -540,15 +540,16 @@ mtk_foe_entry_commit_l2(struct mtk_ppe *
+ int mtk_foe_entry_commit(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
+ {
+ 	int type = FIELD_GET(MTK_FOE_IB1_PACKET_TYPE, entry->data.ib1);
++	const struct mtk_soc_data *soc = ppe->eth->soc;
+ 	u32 hash;
+ 
+ 	if (type == MTK_PPE_PKT_TYPE_BRIDGE)
+ 		return mtk_foe_entry_commit_l2(ppe, entry);
+ 
+-	hash = mtk_ppe_hash_entry(&entry->data);
++	hash = mtk_ppe_hash_entry(ppe->eth, &entry->data);
+ 	entry->hash = 0xffff;
+ 	spin_lock_bh(&ppe_lock);
+-	hlist_add_head(&entry->list, &ppe->foe_flow[hash / 2]);
++	hlist_add_head(&entry->list, &ppe->foe_flow[hash / soc->hash_offset]);
+ 	spin_unlock_bh(&ppe_lock);
+ 
+ 	return 0;
+@@ -558,6 +559,7 @@ static void
+ mtk_foe_entry_commit_subflow(struct mtk_ppe *ppe, struct mtk_flow_entry *entry,
+ 			     u16 hash)
+ {
++	const struct mtk_soc_data *soc = ppe->eth->soc;
+ 	struct mtk_flow_entry *flow_info;
+ 	struct mtk_foe_entry foe, *hwe;
+ 	struct mtk_foe_mac_info *l2;
+@@ -572,7 +574,8 @@ mtk_foe_entry_commit_subflow(struct mtk_
+ 	flow_info->l2_data.base_flow = entry;
+ 	flow_info->type = MTK_FLOW_TYPE_L2_SUBFLOW;
+ 	flow_info->hash = hash;
+-	hlist_add_head(&flow_info->list, &ppe->foe_flow[hash / 2]);
++	hlist_add_head(&flow_info->list,
++		       &ppe->foe_flow[hash / soc->hash_offset]);
+ 	hlist_add_head(&flow_info->l2_data.list, &entry->l2_flows);
+ 
+ 	hwe = &ppe->foe_table[hash];
+@@ -596,7 +599,8 @@ mtk_foe_entry_commit_subflow(struct mtk_
+ 
+ void __mtk_ppe_check_skb(struct mtk_ppe *ppe, struct sk_buff *skb, u16 hash)
+ {
+-	struct hlist_head *head = &ppe->foe_flow[hash / 2];
++	const struct mtk_soc_data *soc = ppe->eth->soc;
++	struct hlist_head *head = &ppe->foe_flow[hash / soc->hash_offset];
+ 	struct mtk_foe_entry *hwe = &ppe->foe_table[hash];
+ 	struct mtk_flow_entry *entry;
+ 	struct mtk_foe_bridge key = {};
+@@ -680,9 +684,11 @@ int mtk_foe_entry_idle_time(struct mtk_p
+ struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base,
+ 		 int version)
+ {
++	const struct mtk_soc_data *soc = eth->soc;
+ 	struct device *dev = eth->dev;
+ 	struct mtk_foe_entry *foe;
+ 	struct mtk_ppe *ppe;
++	u32 foe_flow_size;
+ 
+ 	ppe = devm_kzalloc(dev, sizeof(*ppe), GFP_KERNEL);
+ 	if (!ppe)
+@@ -705,6 +711,12 @@ struct mtk_ppe *mtk_ppe_init(struct mtk_
+ 
+ 	ppe->foe_table = foe;
+ 
++	foe_flow_size = (MTK_PPE_ENTRIES / soc->hash_offset) *
++			sizeof(*ppe->foe_flow);
++	ppe->foe_flow = devm_kzalloc(dev, foe_flow_size, GFP_KERNEL);
++	if (!ppe->foe_flow)
++		return NULL;
++
+ 	mtk_ppe_debugfs_init(ppe);
+ 
+ 	return ppe;
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h
+@@ -270,7 +270,7 @@ struct mtk_ppe {
+ 	dma_addr_t foe_phys;
+ 
+ 	u16 foe_check_time[MTK_PPE_ENTRIES];
+-	struct hlist_head foe_flow[MTK_PPE_ENTRIES / 2];
++	struct hlist_head *foe_flow;
+ 
+ 	struct rhashtable l2_flows;
+ 
diff --git a/target/linux/generic/backport-5.15/715-v6.0-net-ethernet-mtk_eth_soc-add-the-capability-to-run-m.patch b/target/linux/generic/backport-5.15/715-v6.0-net-ethernet-mtk_eth_soc-add-the-capability-to-run-m.patch
new file mode 100644
index 00000000000000..93860e414573a4
--- /dev/null
+++ b/target/linux/generic/backport-5.15/715-v6.0-net-ethernet-mtk_eth_soc-add-the-capability-to-run-m.patch
@@ -0,0 +1,318 @@
+From patchwork Thu Sep  8 19:33:39 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Lorenzo Bianconi <lorenzo@kernel.org>
+X-Patchwork-Id: 12970559
+X-Patchwork-Delegate: kuba@kernel.org
+Return-Path: <netdev-owner@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+To: netdev@vger.kernel.org
+Cc: nbd@nbd.name, john@phrozen.org, sean.wang@mediatek.com,
+        Mark-MC.Lee@mediatek.com, davem@davemloft.net, edumazet@google.com,
+        kuba@kernel.org, pabeni@redhat.com, matthias.bgg@gmail.com,
+        linux-mediatek@lists.infradead.org, lorenzo.bianconi@redhat.com,
+        Bo.Jiao@mediatek.com, sujuan.chen@mediatek.com,
+        ryder.Lee@mediatek.com, evelyn.tsai@mediatek.com,
+        devicetree@vger.kernel.org, robh@kernel.org
+Subject: [PATCH net-next 05/12] net: ethernet: mtk_eth_soc: add the capability
+ to run multiple ppe
+Date: Thu,  8 Sep 2022 21:33:39 +0200
+Message-Id: 
+ <dd0254775390eb031c67c448df8b19e87df58558.1662661555.git.lorenzo@kernel.org>
+X-Mailer: git-send-email 2.37.3
+In-Reply-To: <cover.1662661555.git.lorenzo@kernel.org>
+References: <cover.1662661555.git.lorenzo@kernel.org>
+MIME-Version: 1.0
+Precedence: bulk
+List-ID: <netdev.vger.kernel.org>
+X-Mailing-List: netdev@vger.kernel.org
+X-Patchwork-Delegate: kuba@kernel.org
+
+mt7986 chipset support multiple packet engines for wlan <-> eth
+packet forwarding.
+
+Co-developed-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c   | 35 ++++++++++++-------
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h   |  2 +-
+ drivers/net/ethernet/mediatek/mtk_ppe.c       | 14 +++++---
+ drivers/net/ethernet/mediatek/mtk_ppe.h       |  9 +++--
+ .../net/ethernet/mediatek/mtk_ppe_debugfs.c   |  8 ++---
+ .../net/ethernet/mediatek/mtk_ppe_offload.c   | 13 +++----
+ 6 files changed, 48 insertions(+), 33 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1872,7 +1872,7 @@ static int mtk_poll_rx(struct napi_struc
+ 
+ 		reason = FIELD_GET(MTK_RXD4_PPE_CPU_REASON, trxd.rxd4);
+ 		if (reason == MTK_PPE_CPU_REASON_HIT_UNBIND_RATE_REACHED)
+-			mtk_ppe_check_skb(eth->ppe, skb, hash);
++			mtk_ppe_check_skb(eth->ppe[0], skb, hash);
+ 
+ 		if (netdev->features & NETIF_F_HW_VLAN_CTAG_RX) {
+ 			if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+@@ -2930,7 +2930,8 @@ static int mtk_open(struct net_device *d
+ 	/* we run 2 netdevs on the same dma ring so we only bring it up once */
+ 	if (!refcount_read(&eth->dma_refcnt)) {
+ 		const struct mtk_soc_data *soc = eth->soc;
+-		u32 gdm_config = MTK_GDMA_TO_PDMA;
++		u32 gdm_config;
++		int i;
+ 		int err;
+ 
+ 		err = mtk_start_dma(eth);
+@@ -2939,8 +2940,11 @@ static int mtk_open(struct net_device *d
+ 			return err;
+ 		}
+ 
+-		if (soc->offload_version && mtk_ppe_start(eth->ppe) == 0)
+-			gdm_config = soc->reg_map->gdma_to_ppe0;
++		for (i = 0; i < ARRAY_SIZE(eth->ppe); i++)
++			mtk_ppe_start(eth->ppe[i]);
++
++		gdm_config = soc->offload_version ? soc->reg_map->gdma_to_ppe0
++			: MTK_GDMA_TO_PDMA;
+ 
+ 		mtk_gdm_config(eth, gdm_config);
+ 
+@@ -2985,6 +2989,7 @@ static int mtk_stop(struct net_device *d
+ {
+ 	struct mtk_mac *mac = netdev_priv(dev);
+ 	struct mtk_eth *eth = mac->hw;
++	int i;
+ 
+ 	phylink_stop(mac->phylink);
+ 
+@@ -3012,8 +3017,8 @@ static int mtk_stop(struct net_device *d
+ 
+ 	mtk_dma_free(eth);
+ 
+-	if (eth->soc->offload_version)
+-		mtk_ppe_stop(eth->ppe);
++	for (i = 0; i < ARRAY_SIZE(eth->ppe); i++)
++		mtk_ppe_stop(eth->ppe[i]);
+ 
+ 	return 0;
+ }
+@@ -4053,12 +4058,19 @@ static int mtk_probe(struct platform_dev
+ 	}
+ 
+ 	if (eth->soc->offload_version) {
+-		u32 ppe_addr = eth->soc->reg_map->ppe_base;
++		u32 num_ppe;
+ 
+-		eth->ppe = mtk_ppe_init(eth, eth->base + ppe_addr, 2);
+-		if (!eth->ppe) {
+-			err = -ENOMEM;
+-			goto err_free_dev;
++		num_ppe = MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2) ? 2 : 1;
++		num_ppe = min_t(u32, ARRAY_SIZE(eth->ppe), num_ppe);
++		for (i = 0; i < num_ppe; i++) {
++			u32 ppe_addr = eth->soc->reg_map->ppe_base + i * 0x400;
++
++			eth->ppe[i] = mtk_ppe_init(eth, eth->base + ppe_addr,
++						   eth->soc->offload_version, i);
++			if (!eth->ppe[i]) {
++				err = -ENOMEM;
++				goto err_free_dev;
++			}
+ 		}
+ 
+ 		err = mtk_eth_offload_init(eth);
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -1112,7 +1112,7 @@ struct mtk_eth {
+ 
+ 	int				ip_align;
+ 
+-	struct mtk_ppe			*ppe;
++	struct mtk_ppe			*ppe[2];
+ 	struct rhashtable		flow_table;
+ 
+ 	struct bpf_prog			__rcu *prog;
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -682,7 +682,7 @@ int mtk_foe_entry_idle_time(struct mtk_p
+ }
+ 
+ struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base,
+-		 int version)
++			     int version, int index)
+ {
+ 	const struct mtk_soc_data *soc = eth->soc;
+ 	struct device *dev = eth->dev;
+@@ -717,7 +717,7 @@ struct mtk_ppe *mtk_ppe_init(struct mtk_
+ 	if (!ppe->foe_flow)
+ 		return NULL;
+ 
+-	mtk_ppe_debugfs_init(ppe);
++	mtk_ppe_debugfs_init(ppe, index);
+ 
+ 	return ppe;
+ }
+@@ -738,10 +738,13 @@ static void mtk_ppe_init_foe_table(struc
+ 			ppe->foe_table[i + skip[k]].ib1 |= MTK_FOE_IB1_STATIC;
+ }
+ 
+-int mtk_ppe_start(struct mtk_ppe *ppe)
++void mtk_ppe_start(struct mtk_ppe *ppe)
+ {
+ 	u32 val;
+ 
++	if (!ppe)
++		return;
++
+ 	mtk_ppe_init_foe_table(ppe);
+ 	ppe_w32(ppe, MTK_PPE_TB_BASE, ppe->foe_phys);
+ 
+@@ -809,8 +812,6 @@ int mtk_ppe_start(struct mtk_ppe *ppe)
+ 	ppe_w32(ppe, MTK_PPE_GLO_CFG, val);
+ 
+ 	ppe_w32(ppe, MTK_PPE_DEFAULT_CPU_PORT, 0);
+-
+-	return 0;
+ }
+ 
+ int mtk_ppe_stop(struct mtk_ppe *ppe)
+@@ -818,6 +819,9 @@ int mtk_ppe_stop(struct mtk_ppe *ppe)
+ 	u32 val;
+ 	int i;
+ 
++	if (!ppe)
++		return 0;
++
+ 	for (i = 0; i < MTK_PPE_ENTRIES; i++)
+ 		ppe->foe_table[i].ib1 = FIELD_PREP(MTK_FOE_IB1_STATE,
+ 						   MTK_FOE_STATE_INVALID);
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h
+@@ -247,6 +247,7 @@ struct mtk_flow_entry {
+ 	};
+ 	u8 type;
+ 	s8 wed_index;
++	u8 ppe_index;
+ 	u16 hash;
+ 	union {
+ 		struct mtk_foe_entry data;
+@@ -265,6 +266,7 @@ struct mtk_ppe {
+ 	struct device *dev;
+ 	void __iomem *base;
+ 	int version;
++	char dirname[5];
+ 
+ 	struct mtk_foe_entry *foe_table;
+ 	dma_addr_t foe_phys;
+@@ -277,8 +279,9 @@ struct mtk_ppe {
+ 	void *acct_table;
+ };
+ 
+-struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base, int version);
+-int mtk_ppe_start(struct mtk_ppe *ppe);
++struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base,
++			     int version, int index);
++void mtk_ppe_start(struct mtk_ppe *ppe);
+ int mtk_ppe_stop(struct mtk_ppe *ppe);
+ 
+ void __mtk_ppe_check_skb(struct mtk_ppe *ppe, struct sk_buff *skb, u16 hash);
+@@ -317,6 +320,6 @@ int mtk_foe_entry_set_wdma(struct mtk_fo
+ int mtk_foe_entry_commit(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+ void mtk_foe_entry_clear(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+ int mtk_foe_entry_idle_time(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+-int mtk_ppe_debugfs_init(struct mtk_ppe *ppe);
++int mtk_ppe_debugfs_init(struct mtk_ppe *ppe, int index);
+ 
+ #endif
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_debugfs.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_debugfs.c
+@@ -187,7 +187,7 @@ mtk_ppe_debugfs_foe_open_bind(struct ino
+ 			   inode->i_private);
+ }
+ 
+-int mtk_ppe_debugfs_init(struct mtk_ppe *ppe)
++int mtk_ppe_debugfs_init(struct mtk_ppe *ppe, int index)
+ {
+ 	static const struct file_operations fops_all = {
+ 		.open = mtk_ppe_debugfs_foe_open_all,
+@@ -195,17 +195,17 @@ int mtk_ppe_debugfs_init(struct mtk_ppe
+ 		.llseek = seq_lseek,
+ 		.release = single_release,
+ 	};
+-
+ 	static const struct file_operations fops_bind = {
+ 		.open = mtk_ppe_debugfs_foe_open_bind,
+ 		.read = seq_read,
+ 		.llseek = seq_lseek,
+ 		.release = single_release,
+ 	};
+-
+ 	struct dentry *root;
+ 
+-	root = debugfs_create_dir("mtk_ppe", NULL);
++	snprintf(ppe->dirname, sizeof(ppe->dirname), "ppe%d", index);
++
++	root = debugfs_create_dir(ppe->dirname, NULL);
+ 	if (!root)
+ 		return -ENOMEM;
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
+@@ -434,7 +434,7 @@ mtk_flow_offload_replace(struct mtk_eth
+ 	memcpy(&entry->data, &foe, sizeof(entry->data));
+ 	entry->wed_index = wed_index;
+ 
+-	err = mtk_foe_entry_commit(eth->ppe, entry);
++	err = mtk_foe_entry_commit(eth->ppe[entry->ppe_index], entry);
+ 	if (err < 0)
+ 		goto free;
+ 
+@@ -446,7 +446,7 @@ mtk_flow_offload_replace(struct mtk_eth
+ 	return 0;
+ 
+ clear:
+-	mtk_foe_entry_clear(eth->ppe, entry);
++	mtk_foe_entry_clear(eth->ppe[entry->ppe_index], entry);
+ free:
+ 	kfree(entry);
+ 	if (wed_index >= 0)
+@@ -464,7 +464,7 @@ mtk_flow_offload_destroy(struct mtk_eth
+ 	if (!entry)
+ 		return -ENOENT;
+ 
+-	mtk_foe_entry_clear(eth->ppe, entry);
++	mtk_foe_entry_clear(eth->ppe[entry->ppe_index], entry);
+ 	rhashtable_remove_fast(&eth->flow_table, &entry->node,
+ 			       mtk_flow_ht_params);
+ 	if (entry->wed_index >= 0)
+@@ -485,7 +485,7 @@ mtk_flow_offload_stats(struct mtk_eth *e
+ 	if (!entry)
+ 		return -ENOENT;
+ 
+-	idle = mtk_foe_entry_idle_time(eth->ppe, entry);
++	idle = mtk_foe_entry_idle_time(eth->ppe[entry->ppe_index], entry);
+ 	f->stats.lastused = jiffies - idle * HZ;
+ 
+ 	return 0;
+@@ -537,7 +537,7 @@ mtk_eth_setup_tc_block(struct net_device
+ 	struct flow_block_cb *block_cb;
+ 	flow_setup_cb_t *cb;
+ 
+-	if (!eth->ppe || !eth->ppe->foe_table)
++	if (!eth->soc->offload_version)
+ 		return -EOPNOTSUPP;
+ 
+ 	if (f->binder_type != FLOW_BLOCK_BINDER_TYPE_CLSACT_INGRESS)
+@@ -590,8 +590,5 @@ int mtk_eth_setup_tc(struct net_device *
+ 
+ int mtk_eth_offload_init(struct mtk_eth *eth)
+ {
+-	if (!eth->ppe || !eth->ppe->foe_table)
+-		return 0;
+-
+ 	return rhashtable_init(&eth->flow_table, &mtk_flow_ht_params);
+ }
diff --git a/target/linux/generic/backport-5.15/716-v6.0-net-ethernet-mtk_eth_soc-move-wdma_base-definitions-.patch b/target/linux/generic/backport-5.15/716-v6.0-net-ethernet-mtk_eth_soc-move-wdma_base-definitions-.patch
new file mode 100644
index 00000000000000..a4b285632e1a13
--- /dev/null
+++ b/target/linux/generic/backport-5.15/716-v6.0-net-ethernet-mtk_eth_soc-move-wdma_base-definitions-.patch
@@ -0,0 +1,80 @@
+From 0dcbe607cec32ccae23b02a641b8bd6191a328ae Mon Sep 17 00:00:00 2001
+Message-Id: <0dcbe607cec32ccae23b02a641b8bd6191a328ae.1662243796.git.lorenzo@kernel.org>
+In-Reply-To: <43a21841ce0175d29f23c34a65ceaaf9dd7eb8b7.1662243796.git.lorenzo@kernel.org>
+References: <43a21841ce0175d29f23c34a65ceaaf9dd7eb8b7.1662243796.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 23 Aug 2022 23:09:05 +0200
+Subject: [PATCH net-next 2/4] net: ethernet: mtk_eth_soc: move wdma_base
+ definitions in mtk register map
+
+This is a preliminary patch to introduce mt7986 wed support.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 16 ++++++++++------
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h |  4 +---
+ 2 files changed, 11 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -75,6 +75,10 @@ static const struct mtk_reg_map mtk_reg_
+ 	.gdm1_cnt		= 0x2400,
+ 	.gdma_to_ppe0		= 0x4444,
+ 	.ppe_base		= 0x0c00,
++	.wdma_base = {
++		[0]		= 0x2800,
++		[1]		= 0x2c00,
++	},
+ };
+ 
+ static const struct mtk_reg_map mt7628_reg_map = {
+@@ -130,6 +134,10 @@ static const struct mtk_reg_map mt7986_r
+ 	.gdm1_cnt		= 0x1c00,
+ 	.gdma_to_ppe0		= 0x3333,
+ 	.ppe_base		= 0x2000,
++	.wdma_base = {
++		[0]		= 0x4800,
++		[1]		= 0x4c00,
++	},
+ };
+ 
+ /* strings used by ethtool */
+@@ -3970,16 +3978,12 @@ static int mtk_probe(struct platform_dev
+ 	for (i = 0;; i++) {
+ 		struct device_node *np = of_parse_phandle(pdev->dev.of_node,
+ 							  "mediatek,wed", i);
+-		static const u32 wdma_regs[] = {
+-			MTK_WDMA0_BASE,
+-			MTK_WDMA1_BASE
+-		};
+ 		void __iomem *wdma;
+ 
+-		if (!np || i >= ARRAY_SIZE(wdma_regs))
++		if (!np || i >= ARRAY_SIZE(eth->soc->reg_map->wdma_base))
+ 			break;
+ 
+-		wdma = eth->base + wdma_regs[i];
++		wdma = eth->base + eth->soc->reg_map->wdma_base[i];
+ 		mtk_wed_add_hw(np, eth, wdma, i);
+ 	}
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -268,9 +268,6 @@
+ #define TX_DMA_FPORT_MASK_V2	0xf
+ #define TX_DMA_SWC_V2		BIT(30)
+ 
+-#define MTK_WDMA0_BASE		0x2800
+-#define MTK_WDMA1_BASE		0x2c00
+-
+ /* QDMA descriptor txd4 */
+ #define TX_DMA_CHKSUM		(0x7 << 29)
+ #define TX_DMA_TSO		BIT(28)
+@@ -954,6 +951,7 @@ struct mtk_reg_map {
+ 	u32	gdm1_cnt;
+ 	u32	gdma_to_ppe0;
+ 	u32	ppe_base;
++	u32	wdma_base[2];
+ };
+ 
+ /* struct mtk_eth_data -	This is the structure holding all differences
diff --git a/target/linux/generic/backport-5.15/717-v6.0-net-ethernet-mtk_eth_soc-add-foe_entry_size-to-mtk_e.patch b/target/linux/generic/backport-5.15/717-v6.0-net-ethernet-mtk_eth_soc-add-foe_entry_size-to-mtk_e.patch
new file mode 100644
index 00000000000000..2bce63c4c01b13
--- /dev/null
+++ b/target/linux/generic/backport-5.15/717-v6.0-net-ethernet-mtk_eth_soc-add-foe_entry_size-to-mtk_e.patch
@@ -0,0 +1,251 @@
+From e3c27d869fccc1f2b8d0b4cde4763ab223874e8c Mon Sep 17 00:00:00 2001
+Message-Id: <e3c27d869fccc1f2b8d0b4cde4763ab223874e8c.1662243796.git.lorenzo@kernel.org>
+In-Reply-To: <43a21841ce0175d29f23c34a65ceaaf9dd7eb8b7.1662243796.git.lorenzo@kernel.org>
+References: <43a21841ce0175d29f23c34a65ceaaf9dd7eb8b7.1662243796.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sun, 21 Aug 2022 17:51:17 +0200
+Subject: [PATCH net-next 3/4] net: ethernet: mtk_eth_soc: add foe_entry_size
+ to mtk_eth_soc
+
+Introduce foe_entry_size to mtk_eth_soc data structure since mt7986
+relies on a bigger mtk_foe_entry data structure.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c   |  3 +
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h   | 10 ++++
+ drivers/net/ethernet/mediatek/mtk_ppe.c       | 55 +++++++++++--------
+ drivers/net/ethernet/mediatek/mtk_ppe.h       |  2 +-
+ .../net/ethernet/mediatek/mtk_ppe_debugfs.c   |  2 +-
+ 5 files changed, 48 insertions(+), 24 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -4168,6 +4168,7 @@ static const struct mtk_soc_data mt7621_
+ 	.required_pctl = false,
+ 	.offload_version = 2,
+ 	.hash_offset = 2,
++	.foe_entry_size = sizeof(struct mtk_foe_entry),
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+ 		.rxd_size = sizeof(struct mtk_rx_dma),
+@@ -4187,6 +4188,7 @@ static const struct mtk_soc_data mt7622_
+ 	.required_pctl = false,
+ 	.offload_version = 2,
+ 	.hash_offset = 2,
++	.foe_entry_size = sizeof(struct mtk_foe_entry),
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+ 		.rxd_size = sizeof(struct mtk_rx_dma),
+@@ -4205,6 +4207,7 @@ static const struct mtk_soc_data mt7623_
+ 	.required_pctl = true,
+ 	.offload_version = 2,
+ 	.hash_offset = 2,
++	.foe_entry_size = sizeof(struct mtk_foe_entry),
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+ 		.rxd_size = sizeof(struct mtk_rx_dma),
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -966,6 +966,7 @@ struct mtk_reg_map {
+  * @required_pctl		A bool value to show whether the SoC requires
+  *				the extra setup for those pins used by GMAC.
+  * @hash_offset			Flow table hash offset.
++ * @foe_entry_size		Foe table entry size.
+  * @txd_size			Tx DMA descriptor size.
+  * @rxd_size			Rx DMA descriptor size.
+  * @rx_irq_done_mask		Rx irq done register mask.
+@@ -981,6 +982,7 @@ struct mtk_soc_data {
+ 	bool		required_pctl;
+ 	u8		offload_version;
+ 	u8		hash_offset;
++	u16		foe_entry_size;
+ 	netdev_features_t hw_features;
+ 	struct {
+ 		u32	txd_size;
+@@ -1141,6 +1143,14 @@ struct mtk_mac {
+ /* the struct describing the SoC. these are declared in the soc_xyz.c files */
+ extern const struct of_device_id of_mtk_match[];
+ 
++static inline struct mtk_foe_entry *
++mtk_foe_get_entry(struct mtk_ppe *ppe, u16 hash)
++{
++	const struct mtk_soc_data *soc = ppe->eth->soc;
++
++	return ppe->foe_table + hash * soc->foe_entry_size;
++}
++
+ /* read the hardware status register */
+ void mtk_stats_update_mac(struct mtk_mac *mac);
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -410,9 +410,10 @@ __mtk_foe_entry_clear(struct mtk_ppe *pp
+ 
+ 	hlist_del_init(&entry->list);
+ 	if (entry->hash != 0xffff) {
+-		ppe->foe_table[entry->hash].ib1 &= ~MTK_FOE_IB1_STATE;
+-		ppe->foe_table[entry->hash].ib1 |= FIELD_PREP(MTK_FOE_IB1_STATE,
+-							      MTK_FOE_STATE_BIND);
++		struct mtk_foe_entry *hwe = mtk_foe_get_entry(ppe, entry->hash);
++
++		hwe->ib1 &= ~MTK_FOE_IB1_STATE;
++		hwe->ib1 |= FIELD_PREP(MTK_FOE_IB1_STATE, MTK_FOE_STATE_BIND);
+ 		dma_wmb();
+ 	}
+ 	entry->hash = 0xffff;
+@@ -451,7 +452,7 @@ mtk_flow_entry_update_l2(struct mtk_ppe
+ 		int cur_idle;
+ 		u32 ib1;
+ 
+-		hwe = &ppe->foe_table[cur->hash];
++		hwe = mtk_foe_get_entry(ppe, cur->hash);
+ 		ib1 = READ_ONCE(hwe->ib1);
+ 
+ 		if (FIELD_GET(MTK_FOE_IB1_STATE, ib1) != MTK_FOE_STATE_BIND) {
+@@ -473,8 +474,8 @@ mtk_flow_entry_update_l2(struct mtk_ppe
+ static void
+ mtk_flow_entry_update(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
+ {
++	struct mtk_foe_entry foe = {};
+ 	struct mtk_foe_entry *hwe;
+-	struct mtk_foe_entry foe;
+ 
+ 	spin_lock_bh(&ppe_lock);
+ 
+@@ -486,8 +487,8 @@ mtk_flow_entry_update(struct mtk_ppe *pp
+ 	if (entry->hash == 0xffff)
+ 		goto out;
+ 
+-	hwe = &ppe->foe_table[entry->hash];
+-	memcpy(&foe, hwe, sizeof(foe));
++	hwe = mtk_foe_get_entry(ppe, entry->hash);
++	memcpy(&foe, hwe, ppe->eth->soc->foe_entry_size);
+ 	if (!mtk_flow_entry_match(entry, &foe)) {
+ 		entry->hash = 0xffff;
+ 		goto out;
+@@ -511,8 +512,8 @@ __mtk_foe_entry_commit(struct mtk_ppe *p
+ 	entry->ib1 &= ~MTK_FOE_IB1_BIND_TIMESTAMP;
+ 	entry->ib1 |= FIELD_PREP(MTK_FOE_IB1_BIND_TIMESTAMP, timestamp);
+ 
+-	hwe = &ppe->foe_table[hash];
+-	memcpy(&hwe->data, &entry->data, sizeof(hwe->data));
++	hwe = mtk_foe_get_entry(ppe, hash);
++	memcpy(&hwe->data, &entry->data, ppe->eth->soc->foe_entry_size);
+ 	wmb();
+ 	hwe->ib1 = entry->ib1;
+ 
+@@ -561,7 +562,7 @@ mtk_foe_entry_commit_subflow(struct mtk_
+ {
+ 	const struct mtk_soc_data *soc = ppe->eth->soc;
+ 	struct mtk_flow_entry *flow_info;
+-	struct mtk_foe_entry foe, *hwe;
++	struct mtk_foe_entry foe = {}, *hwe;
+ 	struct mtk_foe_mac_info *l2;
+ 	u32 ib1_mask = MTK_FOE_IB1_PACKET_TYPE | MTK_FOE_IB1_UDP;
+ 	int type;
+@@ -578,8 +579,8 @@ mtk_foe_entry_commit_subflow(struct mtk_
+ 		       &ppe->foe_flow[hash / soc->hash_offset]);
+ 	hlist_add_head(&flow_info->l2_data.list, &entry->l2_flows);
+ 
+-	hwe = &ppe->foe_table[hash];
+-	memcpy(&foe, hwe, sizeof(foe));
++	hwe = mtk_foe_get_entry(ppe, hash);
++	memcpy(&foe, hwe, soc->foe_entry_size);
+ 	foe.ib1 &= ib1_mask;
+ 	foe.ib1 |= entry->data.ib1 & ~ib1_mask;
+ 
+@@ -601,7 +602,7 @@ void __mtk_ppe_check_skb(struct mtk_ppe
+ {
+ 	const struct mtk_soc_data *soc = ppe->eth->soc;
+ 	struct hlist_head *head = &ppe->foe_flow[hash / soc->hash_offset];
+-	struct mtk_foe_entry *hwe = &ppe->foe_table[hash];
++	struct mtk_foe_entry *hwe = mtk_foe_get_entry(ppe, hash);
+ 	struct mtk_flow_entry *entry;
+ 	struct mtk_foe_bridge key = {};
+ 	struct hlist_node *n;
+@@ -686,9 +687,9 @@ struct mtk_ppe *mtk_ppe_init(struct mtk_
+ {
+ 	const struct mtk_soc_data *soc = eth->soc;
+ 	struct device *dev = eth->dev;
+-	struct mtk_foe_entry *foe;
+ 	struct mtk_ppe *ppe;
+ 	u32 foe_flow_size;
++	void *foe;
+ 
+ 	ppe = devm_kzalloc(dev, sizeof(*ppe), GFP_KERNEL);
+ 	if (!ppe)
+@@ -704,7 +705,8 @@ struct mtk_ppe *mtk_ppe_init(struct mtk_
+ 	ppe->dev = dev;
+ 	ppe->version = version;
+ 
+-	foe = dmam_alloc_coherent(ppe->dev, MTK_PPE_ENTRIES * sizeof(*foe),
++	foe = dmam_alloc_coherent(ppe->dev,
++				  MTK_PPE_ENTRIES * soc->foe_entry_size,
+ 				  &ppe->foe_phys, GFP_KERNEL);
+ 	if (!foe)
+ 		return NULL;
+@@ -727,15 +729,21 @@ static void mtk_ppe_init_foe_table(struc
+ 	static const u8 skip[] = { 12, 25, 38, 51, 76, 89, 102 };
+ 	int i, k;
+ 
+-	memset(ppe->foe_table, 0, MTK_PPE_ENTRIES * sizeof(*ppe->foe_table));
++	memset(ppe->foe_table, 0,
++	       MTK_PPE_ENTRIES * ppe->eth->soc->foe_entry_size);
+ 
+ 	if (!IS_ENABLED(CONFIG_SOC_MT7621))
+ 		return;
+ 
+ 	/* skip all entries that cross the 1024 byte boundary */
+-	for (i = 0; i < MTK_PPE_ENTRIES; i += 128)
+-		for (k = 0; k < ARRAY_SIZE(skip); k++)
+-			ppe->foe_table[i + skip[k]].ib1 |= MTK_FOE_IB1_STATIC;
++	for (i = 0; i < MTK_PPE_ENTRIES; i += 128) {
++		for (k = 0; k < ARRAY_SIZE(skip); k++) {
++			struct mtk_foe_entry *hwe;
++
++			hwe = mtk_foe_get_entry(ppe, i + skip[k]);
++			hwe->ib1 |= MTK_FOE_IB1_STATIC;
++		}
++	}
+ }
+ 
+ void mtk_ppe_start(struct mtk_ppe *ppe)
+@@ -822,9 +830,12 @@ int mtk_ppe_stop(struct mtk_ppe *ppe)
+ 	if (!ppe)
+ 		return 0;
+ 
+-	for (i = 0; i < MTK_PPE_ENTRIES; i++)
+-		ppe->foe_table[i].ib1 = FIELD_PREP(MTK_FOE_IB1_STATE,
+-						   MTK_FOE_STATE_INVALID);
++	for (i = 0; i < MTK_PPE_ENTRIES; i++) {
++		struct mtk_foe_entry *hwe = mtk_foe_get_entry(ppe, i);
++
++		hwe->ib1 = FIELD_PREP(MTK_FOE_IB1_STATE,
++				      MTK_FOE_STATE_INVALID);
++	}
+ 
+ 	mtk_ppe_cache_enable(ppe, false);
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h
+@@ -268,7 +268,7 @@ struct mtk_ppe {
+ 	int version;
+ 	char dirname[5];
+ 
+-	struct mtk_foe_entry *foe_table;
++	void *foe_table;
+ 	dma_addr_t foe_phys;
+ 
+ 	u16 foe_check_time[MTK_PPE_ENTRIES];
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_debugfs.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_debugfs.c
+@@ -79,7 +79,7 @@ mtk_ppe_debugfs_foe_show(struct seq_file
+ 	int i;
+ 
+ 	for (i = 0; i < MTK_PPE_ENTRIES; i++) {
+-		struct mtk_foe_entry *entry = &ppe->foe_table[i];
++		struct mtk_foe_entry *entry = mtk_foe_get_entry(ppe, i);
+ 		struct mtk_foe_mac_info *l2;
+ 		struct mtk_flow_addr_info ai = {};
+ 		unsigned char h_source[ETH_ALEN];
diff --git a/target/linux/generic/backport-5.15/718-v6.0-net-ethernet-mtk_eth_soc-fix-typo-in-__mtk_foe_entry.patch b/target/linux/generic/backport-5.15/718-v6.0-net-ethernet-mtk_eth_soc-fix-typo-in-__mtk_foe_entry.patch
new file mode 100644
index 00000000000000..77daf6c8bfe4b0
--- /dev/null
+++ b/target/linux/generic/backport-5.15/718-v6.0-net-ethernet-mtk_eth_soc-fix-typo-in-__mtk_foe_entry.patch
@@ -0,0 +1,27 @@
+From 12ff69304c83c679ca01ef3db963ab0db9de19fb Mon Sep 17 00:00:00 2001
+Message-Id: <12ff69304c83c679ca01ef3db963ab0db9de19fb.1662332102.git.lorenzo@kernel.org>
+In-Reply-To: <2a60545635c2705312299384f4e9fec2f2a3acd6.1662332102.git.lorenzo@kernel.org>
+References: <2a60545635c2705312299384f4e9fec2f2a3acd6.1662332102.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Mon, 5 Sep 2022 00:43:43 +0200
+Subject: [PATCH net-next 2/6] net: ethernet: mtk_eth_soc: fix typo in
+ __mtk_foe_entry_clear
+
+Set ib1 state to MTK_FOE_STATE_UNBIND in __mtk_foe_entry_clear routine.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_ppe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -413,7 +413,7 @@ __mtk_foe_entry_clear(struct mtk_ppe *pp
+ 		struct mtk_foe_entry *hwe = mtk_foe_get_entry(ppe, entry->hash);
+ 
+ 		hwe->ib1 &= ~MTK_FOE_IB1_STATE;
+-		hwe->ib1 |= FIELD_PREP(MTK_FOE_IB1_STATE, MTK_FOE_STATE_BIND);
++		hwe->ib1 |= FIELD_PREP(MTK_FOE_IB1_STATE, MTK_FOE_STATE_UNBIND);
+ 		dma_wmb();
+ 	}
+ 	entry->hash = 0xffff;
diff --git a/target/linux/generic/backport-5.15/719-v6.0-net-ethernet-mtk_eth_soc-check-max-allowed-value-in-.patch b/target/linux/generic/backport-5.15/719-v6.0-net-ethernet-mtk_eth_soc-check-max-allowed-value-in-.patch
new file mode 100644
index 00000000000000..7ab6d486b2256e
--- /dev/null
+++ b/target/linux/generic/backport-5.15/719-v6.0-net-ethernet-mtk_eth_soc-check-max-allowed-value-in-.patch
@@ -0,0 +1,28 @@
+From 4253e6e2b795a18ab534adcd5c313d3fc4150975 Mon Sep 17 00:00:00 2001
+Message-Id: <4253e6e2b795a18ab534adcd5c313d3fc4150975.1662332102.git.lorenzo@kernel.org>
+In-Reply-To: <2a60545635c2705312299384f4e9fec2f2a3acd6.1662332102.git.lorenzo@kernel.org>
+References: <2a60545635c2705312299384f4e9fec2f2a3acd6.1662332102.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Mon, 5 Sep 2022 00:48:52 +0200
+Subject: [PATCH net-next 3/6] net: ethernet: mtk_eth_soc: check max allowed
+ value in mtk_ppe_check_skb
+
+Check theoretical OOB accesses in mtk_ppe_check_skb routine
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_ppe.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h
+@@ -294,6 +294,9 @@ mtk_ppe_check_skb(struct mtk_ppe *ppe, s
+ 	if (!ppe)
+ 		return;
+ 
++	if (hash > MTK_PPE_HASH_MASK)
++		return;
++
+ 	now = (u16)jiffies;
+ 	diff = now - ppe->foe_check_time[hash];
+ 	if (diff < HZ / 10)
diff --git a/target/linux/generic/backport-5.15/720-v6.0-net-ethernet-mtk_eth_wed-add-mtk_wed_configure_irq-a.patch b/target/linux/generic/backport-5.15/720-v6.0-net-ethernet-mtk_eth_wed-add-mtk_wed_configure_irq-a.patch
new file mode 100644
index 00000000000000..a8c88daf1ffc7d
--- /dev/null
+++ b/target/linux/generic/backport-5.15/720-v6.0-net-ethernet-mtk_eth_wed-add-mtk_wed_configure_irq-a.patch
@@ -0,0 +1,189 @@
+From e5ecb4f619197b93fa682d722452dc8412864cdb Mon Sep 17 00:00:00 2001
+Message-Id: <e5ecb4f619197b93fa682d722452dc8412864cdb.1662886033.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 26 Aug 2022 01:12:57 +0200
+Subject: [PATCH net-next 1/5] net: ethernet: mtk_eth_wed: add
+ mtk_wed_configure_irq and mtk_wed_dma_{enable/disable}
+
+Introduce mtk_wed_configure_irq, mtk_wed_dma_enable and mtk_wed_dma_disable
+utility routines.
+This is a preliminary patch to introduce mt7986 wed support.
+
+Co-developed-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_wed.c      | 87 +++++++++++++-------
+ drivers/net/ethernet/mediatek/mtk_wed_regs.h |  6 +-
+ 2 files changed, 64 insertions(+), 29 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -237,9 +237,30 @@ mtk_wed_set_ext_int(struct mtk_wed_devic
+ }
+ 
+ static void
+-mtk_wed_stop(struct mtk_wed_device *dev)
++mtk_wed_dma_disable(struct mtk_wed_device *dev)
+ {
++	wed_clr(dev, MTK_WED_WPDMA_GLO_CFG,
++		MTK_WED_WPDMA_GLO_CFG_TX_DRV_EN |
++		MTK_WED_WPDMA_GLO_CFG_RX_DRV_EN);
++
++	wed_clr(dev, MTK_WED_WDMA_GLO_CFG, MTK_WED_WDMA_GLO_CFG_RX_DRV_EN);
++
++	wed_clr(dev, MTK_WED_GLO_CFG,
++		MTK_WED_GLO_CFG_TX_DMA_EN |
++		MTK_WED_GLO_CFG_RX_DMA_EN);
++
+ 	regmap_write(dev->hw->mirror, dev->hw->index * 4, 0);
++	wdma_m32(dev, MTK_WDMA_GLO_CFG,
++		 MTK_WDMA_GLO_CFG_TX_DMA_EN |
++		 MTK_WDMA_GLO_CFG_RX_INFO1_PRERES |
++		 MTK_WDMA_GLO_CFG_RX_INFO2_PRERES |
++		 MTK_WDMA_GLO_CFG_RX_INFO3_PRERES, 0);
++}
++
++static void
++mtk_wed_stop(struct mtk_wed_device *dev)
++{
++	mtk_wed_dma_disable(dev);
+ 	mtk_wed_set_ext_int(dev, false);
+ 
+ 	wed_clr(dev, MTK_WED_CTRL,
+@@ -252,15 +273,6 @@ mtk_wed_stop(struct mtk_wed_device *dev)
+ 	wdma_w32(dev, MTK_WDMA_INT_MASK, 0);
+ 	wdma_w32(dev, MTK_WDMA_INT_GRP2, 0);
+ 	wed_w32(dev, MTK_WED_WPDMA_INT_MASK, 0);
+-
+-	wed_clr(dev, MTK_WED_GLO_CFG,
+-		MTK_WED_GLO_CFG_TX_DMA_EN |
+-		MTK_WED_GLO_CFG_RX_DMA_EN);
+-	wed_clr(dev, MTK_WED_WPDMA_GLO_CFG,
+-		MTK_WED_WPDMA_GLO_CFG_TX_DRV_EN |
+-		MTK_WED_WPDMA_GLO_CFG_RX_DRV_EN);
+-	wed_clr(dev, MTK_WED_WDMA_GLO_CFG,
+-		MTK_WED_WDMA_GLO_CFG_RX_DRV_EN);
+ }
+ 
+ static void
+@@ -313,7 +325,10 @@ mtk_wed_hw_init_early(struct mtk_wed_dev
+ 	      MTK_WED_WDMA_GLO_CFG_IDLE_DMAD_SUPPLY;
+ 	wed_m32(dev, MTK_WED_WDMA_GLO_CFG, mask, set);
+ 
+-	wdma_set(dev, MTK_WDMA_GLO_CFG, MTK_WDMA_GLO_CFG_RX_INFO_PRERES);
++	wdma_set(dev, MTK_WDMA_GLO_CFG,
++		 MTK_WDMA_GLO_CFG_RX_INFO1_PRERES |
++		 MTK_WDMA_GLO_CFG_RX_INFO2_PRERES |
++		 MTK_WDMA_GLO_CFG_RX_INFO3_PRERES);
+ 
+ 	offset = dev->hw->index ? 0x04000400 : 0;
+ 	wed_w32(dev, MTK_WED_WDMA_OFFSET0, 0x2a042a20 + offset);
+@@ -520,43 +535,38 @@ mtk_wed_wdma_ring_setup(struct mtk_wed_d
+ }
+ 
+ static void
+-mtk_wed_start(struct mtk_wed_device *dev, u32 irq_mask)
++mtk_wed_configure_irq(struct mtk_wed_device *dev, u32 irq_mask)
+ {
+-	u32 wdma_mask;
+-	u32 val;
+-	int i;
+-
+-	for (i = 0; i < ARRAY_SIZE(dev->tx_wdma); i++)
+-		if (!dev->tx_wdma[i].desc)
+-			mtk_wed_wdma_ring_setup(dev, i, 16);
+-
+-	wdma_mask = FIELD_PREP(MTK_WDMA_INT_MASK_RX_DONE, GENMASK(1, 0));
+-
+-	mtk_wed_hw_init(dev);
++	u32 wdma_mask = FIELD_PREP(MTK_WDMA_INT_MASK_RX_DONE, GENMASK(1, 0));
+ 
++	/* wed control cr set */
+ 	wed_set(dev, MTK_WED_CTRL,
+ 		MTK_WED_CTRL_WDMA_INT_AGENT_EN |
+ 		MTK_WED_CTRL_WPDMA_INT_AGENT_EN |
+ 		MTK_WED_CTRL_WED_TX_BM_EN |
+ 		MTK_WED_CTRL_WED_TX_FREE_AGENT_EN);
+ 
+-	wed_w32(dev, MTK_WED_PCIE_INT_TRIGGER, MTK_WED_PCIE_INT_TRIGGER_STATUS);
++	wed_w32(dev, MTK_WED_PCIE_INT_TRIGGER,
++		MTK_WED_PCIE_INT_TRIGGER_STATUS);
+ 
+ 	wed_w32(dev, MTK_WED_WPDMA_INT_TRIGGER,
+ 		MTK_WED_WPDMA_INT_TRIGGER_RX_DONE |
+ 		MTK_WED_WPDMA_INT_TRIGGER_TX_DONE);
+ 
+-	wed_set(dev, MTK_WED_WPDMA_INT_CTRL,
+-		MTK_WED_WPDMA_INT_CTRL_SUBRT_ADV);
+-
++	/* initail wdma interrupt agent */
+ 	wed_w32(dev, MTK_WED_WDMA_INT_TRIGGER, wdma_mask);
+ 	wed_clr(dev, MTK_WED_WDMA_INT_CTRL, wdma_mask);
+ 
+ 	wdma_w32(dev, MTK_WDMA_INT_MASK, wdma_mask);
+ 	wdma_w32(dev, MTK_WDMA_INT_GRP2, wdma_mask);
+-
+ 	wed_w32(dev, MTK_WED_WPDMA_INT_MASK, irq_mask);
+ 	wed_w32(dev, MTK_WED_INT_MASK, irq_mask);
++}
++
++static void
++mtk_wed_dma_enable(struct mtk_wed_device *dev)
++{
++	wed_set(dev, MTK_WED_WPDMA_INT_CTRL, MTK_WED_WPDMA_INT_CTRL_SUBRT_ADV);
+ 
+ 	wed_set(dev, MTK_WED_GLO_CFG,
+ 		MTK_WED_GLO_CFG_TX_DMA_EN |
+@@ -567,6 +577,26 @@ mtk_wed_start(struct mtk_wed_device *dev
+ 	wed_set(dev, MTK_WED_WDMA_GLO_CFG,
+ 		MTK_WED_WDMA_GLO_CFG_RX_DRV_EN);
+ 
++	wdma_set(dev, MTK_WDMA_GLO_CFG,
++		 MTK_WDMA_GLO_CFG_TX_DMA_EN |
++		 MTK_WDMA_GLO_CFG_RX_INFO1_PRERES |
++		 MTK_WDMA_GLO_CFG_RX_INFO2_PRERES |
++		 MTK_WDMA_GLO_CFG_RX_INFO3_PRERES);
++}
++
++static void
++mtk_wed_start(struct mtk_wed_device *dev, u32 irq_mask)
++{
++	u32 val;
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(dev->tx_wdma); i++)
++		if (!dev->tx_wdma[i].desc)
++			mtk_wed_wdma_ring_setup(dev, i, 16);
++
++	mtk_wed_hw_init(dev);
++	mtk_wed_configure_irq(dev, irq_mask);
++
+ 	mtk_wed_set_ext_int(dev, true);
+ 	val = dev->wlan.wpdma_phys |
+ 	      MTK_PCIE_MIRROR_MAP_EN |
+@@ -577,6 +607,7 @@ mtk_wed_start(struct mtk_wed_device *dev
+ 	val |= BIT(0);
+ 	regmap_write(dev->hw->mirror, dev->hw->index * 4, val);
+ 
++	mtk_wed_dma_enable(dev);
+ 	dev->running = true;
+ }
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_wed_regs.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_regs.h
+@@ -224,7 +224,11 @@ struct mtk_wdma_desc {
+ #define MTK_WDMA_RING_RX(_n)				(0x100 + (_n) * 0x10)
+ 
+ #define MTK_WDMA_GLO_CFG				0x204
+-#define MTK_WDMA_GLO_CFG_RX_INFO_PRERES			GENMASK(28, 26)
++#define MTK_WDMA_GLO_CFG_TX_DMA_EN			BIT(0)
++#define MTK_WDMA_GLO_CFG_RX_DMA_EN			BIT(2)
++#define MTK_WDMA_GLO_CFG_RX_INFO3_PRERES		BIT(26)
++#define MTK_WDMA_GLO_CFG_RX_INFO2_PRERES		BIT(27)
++#define MTK_WDMA_GLO_CFG_RX_INFO1_PRERES		BIT(28)
+ 
+ #define MTK_WDMA_RESET_IDX				0x208
+ #define MTK_WDMA_RESET_IDX_TX				GENMASK(3, 0)
diff --git a/target/linux/generic/backport-5.15/721-v6.0-net-ethernet-mtk_eth_wed-add-wed-support-for-mt7986-.patch b/target/linux/generic/backport-5.15/721-v6.0-net-ethernet-mtk_eth_wed-add-wed-support-for-mt7986-.patch
new file mode 100644
index 00000000000000..bfca7b20e453e9
--- /dev/null
+++ b/target/linux/generic/backport-5.15/721-v6.0-net-ethernet-mtk_eth_wed-add-wed-support-for-mt7986-.patch
@@ -0,0 +1,942 @@
+From 463a71af080fbc77339bee2037fb1e081e3824f7 Mon Sep 17 00:00:00 2001
+Message-Id: <463a71af080fbc77339bee2037fb1e081e3824f7.1662886034.git.lorenzo@kernel.org>
+In-Reply-To: <e5ecb4f619197b93fa682d722452dc8412864cdb.1662886033.git.lorenzo@kernel.org>
+References: <e5ecb4f619197b93fa682d722452dc8412864cdb.1662886033.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 27 Aug 2022 16:15:14 +0200
+Subject: [PATCH net-next 2/5] net: ethernet: mtk_eth_wed: add wed support for
+ mt7986 chipset
+
+Introduce Wireless Etherne Dispatcher support on transmission side
+for mt7986 chipset
+
+Co-developed-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c   |  34 +-
+ drivers/net/ethernet/mediatek/mtk_wed.c       | 371 ++++++++++++++----
+ drivers/net/ethernet/mediatek/mtk_wed.h       |   8 +-
+ .../net/ethernet/mediatek/mtk_wed_debugfs.c   |   3 +
+ drivers/net/ethernet/mediatek/mtk_wed_regs.h  |  81 +++-
+ include/linux/soc/mediatek/mtk_wed.h          |   8 +
+ 6 files changed, 408 insertions(+), 97 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3895,6 +3895,7 @@ void mtk_eth_set_dma_device(struct mtk_e
+ 
+ static int mtk_probe(struct platform_device *pdev)
+ {
++	struct resource *res = NULL;
+ 	struct device_node *mac_np;
+ 	struct mtk_eth *eth;
+ 	int err, i;
+@@ -3975,16 +3976,31 @@ static int mtk_probe(struct platform_dev
+ 		}
+ 	}
+ 
+-	for (i = 0;; i++) {
+-		struct device_node *np = of_parse_phandle(pdev->dev.of_node,
+-							  "mediatek,wed", i);
+-		void __iomem *wdma;
+-
+-		if (!np || i >= ARRAY_SIZE(eth->soc->reg_map->wdma_base))
+-			break;
+-
+-		wdma = eth->base + eth->soc->reg_map->wdma_base[i];
+-		mtk_wed_add_hw(np, eth, wdma, i);
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++		res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++		if (!res)
++			return -EINVAL;
++	}
++
++	if (eth->soc->offload_version) {
++		for (i = 0;; i++) {
++			struct device_node *np;
++			phys_addr_t wdma_phy;
++			u32 wdma_base;
++
++			if (i >= ARRAY_SIZE(eth->soc->reg_map->wdma_base))
++				break;
++
++			np = of_parse_phandle(pdev->dev.of_node,
++					      "mediatek,wed", i);
++			if (!np)
++				break;
++
++			wdma_base = eth->soc->reg_map->wdma_base[i];
++			wdma_phy = res ? res->start + wdma_base : 0;
++			mtk_wed_add_hw(np, eth, eth->base + wdma_base,
++				       wdma_phy, i);
++		}
+ 	}
+ 
+ 	for (i = 0; i < 3; i++) {
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -25,6 +25,11 @@
+ 
+ #define MTK_WED_TX_RING_SIZE		2048
+ #define MTK_WED_WDMA_RING_SIZE		1024
++#define MTK_WED_MAX_GROUP_SIZE		0x100
++#define MTK_WED_VLD_GROUP_SIZE		0x40
++#define MTK_WED_PER_GROUP_PKT		128
++
++#define MTK_WED_FBUF_SIZE		128
+ 
+ static struct mtk_wed_hw *hw_list[2];
+ static DEFINE_MUTEX(hw_lock);
+@@ -150,10 +155,17 @@ mtk_wed_buffer_alloc(struct mtk_wed_devi
+ 
+ 			desc->buf0 = cpu_to_le32(buf_phys);
+ 			desc->buf1 = cpu_to_le32(buf_phys + txd_size);
+-			ctrl = FIELD_PREP(MTK_WDMA_DESC_CTRL_LEN0, txd_size) |
+-			       FIELD_PREP(MTK_WDMA_DESC_CTRL_LEN1,
+-					  MTK_WED_BUF_SIZE - txd_size) |
+-			       MTK_WDMA_DESC_CTRL_LAST_SEG1;
++
++			if (dev->hw->version == 1)
++				ctrl = FIELD_PREP(MTK_WDMA_DESC_CTRL_LEN0, txd_size) |
++				       FIELD_PREP(MTK_WDMA_DESC_CTRL_LEN1,
++						  MTK_WED_BUF_SIZE - txd_size) |
++				       MTK_WDMA_DESC_CTRL_LAST_SEG1;
++			else
++				ctrl = FIELD_PREP(MTK_WDMA_DESC_CTRL_LEN0, txd_size) |
++				       FIELD_PREP(MTK_WDMA_DESC_CTRL_LEN1_V2,
++						  MTK_WED_BUF_SIZE - txd_size) |
++				       MTK_WDMA_DESC_CTRL_LAST_SEG0;
+ 			desc->ctrl = cpu_to_le32(ctrl);
+ 			desc->info = 0;
+ 			desc++;
+@@ -209,7 +221,7 @@ mtk_wed_free_ring(struct mtk_wed_device
+ 	if (!ring->desc)
+ 		return;
+ 
+-	dma_free_coherent(dev->hw->dev, ring->size * sizeof(*ring->desc),
++	dma_free_coherent(dev->hw->dev, ring->size * ring->desc_size,
+ 			  ring->desc, ring->desc_phys);
+ }
+ 
+@@ -229,6 +241,14 @@ mtk_wed_set_ext_int(struct mtk_wed_devic
+ {
+ 	u32 mask = MTK_WED_EXT_INT_STATUS_ERROR_MASK;
+ 
++	if (dev->hw->version == 1)
++		mask |= MTK_WED_EXT_INT_STATUS_TX_DRV_R_RESP_ERR;
++	else
++		mask |= MTK_WED_EXT_INT_STATUS_RX_FBUF_LO_TH |
++			MTK_WED_EXT_INT_STATUS_RX_FBUF_HI_TH |
++			MTK_WED_EXT_INT_STATUS_RX_DRV_COHERENT |
++			MTK_WED_EXT_INT_STATUS_TX_DMA_W_RESP_ERR;
++
+ 	if (!dev->hw->num_flows)
+ 		mask &= ~MTK_WED_EXT_INT_STATUS_TKID_WO_PYLD;
+ 
+@@ -237,6 +257,20 @@ mtk_wed_set_ext_int(struct mtk_wed_devic
+ }
+ 
+ static void
++mtk_wed_set_512_support(struct mtk_wed_device *dev, bool enable)
++{
++	if (enable) {
++		wed_w32(dev, MTK_WED_TXDP_CTRL, MTK_WED_TXDP_DW9_OVERWR);
++		wed_w32(dev, MTK_WED_TXP_DW1,
++			FIELD_PREP(MTK_WED_WPDMA_WRITE_TXP, 0x0103));
++	} else {
++		wed_w32(dev, MTK_WED_TXP_DW1,
++			FIELD_PREP(MTK_WED_WPDMA_WRITE_TXP, 0x0100));
++		wed_clr(dev, MTK_WED_TXDP_CTRL, MTK_WED_TXDP_DW9_OVERWR);
++	}
++}
++
++static void
+ mtk_wed_dma_disable(struct mtk_wed_device *dev)
+ {
+ 	wed_clr(dev, MTK_WED_WPDMA_GLO_CFG,
+@@ -249,12 +283,22 @@ mtk_wed_dma_disable(struct mtk_wed_devic
+ 		MTK_WED_GLO_CFG_TX_DMA_EN |
+ 		MTK_WED_GLO_CFG_RX_DMA_EN);
+ 
+-	regmap_write(dev->hw->mirror, dev->hw->index * 4, 0);
+ 	wdma_m32(dev, MTK_WDMA_GLO_CFG,
+ 		 MTK_WDMA_GLO_CFG_TX_DMA_EN |
+ 		 MTK_WDMA_GLO_CFG_RX_INFO1_PRERES |
+-		 MTK_WDMA_GLO_CFG_RX_INFO2_PRERES |
+-		 MTK_WDMA_GLO_CFG_RX_INFO3_PRERES, 0);
++		 MTK_WDMA_GLO_CFG_RX_INFO2_PRERES, 0);
++
++	if (dev->hw->version == 1) {
++		regmap_write(dev->hw->mirror, dev->hw->index * 4, 0);
++		wdma_m32(dev, MTK_WDMA_GLO_CFG,
++			 MTK_WDMA_GLO_CFG_RX_INFO3_PRERES, 0);
++	} else {
++		wed_clr(dev, MTK_WED_WPDMA_GLO_CFG,
++			MTK_WED_WPDMA_GLO_CFG_RX_DRV_R0_PKT_PROC |
++			MTK_WED_WPDMA_GLO_CFG_RX_DRV_R0_CRX_SYNC);
++
++		mtk_wed_set_512_support(dev, false);
++	}
+ }
+ 
+ static void
+@@ -293,7 +337,7 @@ mtk_wed_detach(struct mtk_wed_device *de
+ 	mtk_wed_free_buffer(dev);
+ 	mtk_wed_free_tx_rings(dev);
+ 
+-	if (of_dma_is_coherent(wlan_node))
++	if (of_dma_is_coherent(wlan_node) && hw->hifsys)
+ 		regmap_update_bits(hw->hifsys, HIFSYS_DMA_AG_MAP,
+ 				   BIT(hw->index), BIT(hw->index));
+ 
+@@ -308,14 +352,69 @@ mtk_wed_detach(struct mtk_wed_device *de
+ 	mutex_unlock(&hw_lock);
+ }
+ 
++#define PCIE_BASE_ADDR0		0x11280000
++static void
++mtk_wed_bus_init(struct mtk_wed_device *dev)
++{
++	struct device_node *np = dev->hw->eth->dev->of_node;
++	struct regmap *regs;
++	u32 val;
++
++	regs = syscon_regmap_lookup_by_phandle(np, "mediatek,wed-pcie");
++	if (IS_ERR(regs))
++		return;
++
++	regmap_update_bits(regs, 0, BIT(0), BIT(0));
++
++	wed_w32(dev, MTK_WED_PCIE_INT_CTRL,
++		FIELD_PREP(MTK_WED_PCIE_INT_CTRL_POLL_EN, 2));
++
++	/* pcie interrupt control: pola/source selection */
++	wed_set(dev, MTK_WED_PCIE_INT_CTRL,
++		MTK_WED_PCIE_INT_CTRL_MSK_EN_POLA |
++		FIELD_PREP(MTK_WED_PCIE_INT_CTRL_SRC_SEL, 1));
++	wed_r32(dev, MTK_WED_PCIE_INT_CTRL);
++
++	val = wed_r32(dev, MTK_WED_PCIE_CFG_INTM);
++	val = wed_r32(dev, MTK_WED_PCIE_CFG_BASE);
++	wed_w32(dev, MTK_WED_PCIE_CFG_INTM, PCIE_BASE_ADDR0 | 0x180);
++	wed_w32(dev, MTK_WED_PCIE_CFG_BASE, PCIE_BASE_ADDR0 | 0x184);
++
++	val = wed_r32(dev, MTK_WED_PCIE_CFG_INTM);
++	val = wed_r32(dev, MTK_WED_PCIE_CFG_BASE);
++
++	/* pcie interrupt status trigger register */
++	wed_w32(dev, MTK_WED_PCIE_INT_TRIGGER, BIT(24));
++	wed_r32(dev, MTK_WED_PCIE_INT_TRIGGER);
++
++	/* pola setting */
++	val = wed_r32(dev, MTK_WED_PCIE_INT_CTRL);
++	wed_set(dev, MTK_WED_PCIE_INT_CTRL, MTK_WED_PCIE_INT_CTRL_MSK_EN_POLA);
++}
++
++static void
++mtk_wed_set_wpdma(struct mtk_wed_device *dev)
++{
++	if (dev->hw->version == 1) {
++		wed_w32(dev, MTK_WED_WPDMA_CFG_BASE,  dev->wlan.wpdma_phys);
++	} else {
++		mtk_wed_bus_init(dev);
++
++		wed_w32(dev, MTK_WED_WPDMA_CFG_BASE,  dev->wlan.wpdma_int);
++		wed_w32(dev, MTK_WED_WPDMA_CFG_INT_MASK,  dev->wlan.wpdma_mask);
++		wed_w32(dev, MTK_WED_WPDMA_CFG_TX,  dev->wlan.wpdma_tx);
++		wed_w32(dev, MTK_WED_WPDMA_CFG_TX_FREE,  dev->wlan.wpdma_txfree);
++	}
++}
++
+ static void
+ mtk_wed_hw_init_early(struct mtk_wed_device *dev)
+ {
+ 	u32 mask, set;
+-	u32 offset;
+ 
+ 	mtk_wed_stop(dev);
+ 	mtk_wed_reset(dev, MTK_WED_RESET_WED);
++	mtk_wed_set_wpdma(dev);
+ 
+ 	mask = MTK_WED_WDMA_GLO_CFG_BT_SIZE |
+ 	       MTK_WED_WDMA_GLO_CFG_DYNAMIC_DMAD_RECYCLE |
+@@ -325,17 +424,33 @@ mtk_wed_hw_init_early(struct mtk_wed_dev
+ 	      MTK_WED_WDMA_GLO_CFG_IDLE_DMAD_SUPPLY;
+ 	wed_m32(dev, MTK_WED_WDMA_GLO_CFG, mask, set);
+ 
+-	wdma_set(dev, MTK_WDMA_GLO_CFG,
+-		 MTK_WDMA_GLO_CFG_RX_INFO1_PRERES |
+-		 MTK_WDMA_GLO_CFG_RX_INFO2_PRERES |
+-		 MTK_WDMA_GLO_CFG_RX_INFO3_PRERES);
+-
+-	offset = dev->hw->index ? 0x04000400 : 0;
+-	wed_w32(dev, MTK_WED_WDMA_OFFSET0, 0x2a042a20 + offset);
+-	wed_w32(dev, MTK_WED_WDMA_OFFSET1, 0x29002800 + offset);
++	if (dev->hw->version == 1) {
++		u32 offset = dev->hw->index ? 0x04000400 : 0;
+ 
+-	wed_w32(dev, MTK_WED_PCIE_CFG_BASE, MTK_PCIE_BASE(dev->hw->index));
+-	wed_w32(dev, MTK_WED_WPDMA_CFG_BASE, dev->wlan.wpdma_phys);
++		wdma_set(dev, MTK_WDMA_GLO_CFG,
++			 MTK_WDMA_GLO_CFG_RX_INFO1_PRERES |
++			 MTK_WDMA_GLO_CFG_RX_INFO2_PRERES |
++			 MTK_WDMA_GLO_CFG_RX_INFO3_PRERES);
++
++		wed_w32(dev, MTK_WED_WDMA_OFFSET0, 0x2a042a20 + offset);
++		wed_w32(dev, MTK_WED_WDMA_OFFSET1, 0x29002800 + offset);
++		wed_w32(dev, MTK_WED_PCIE_CFG_BASE,
++			MTK_PCIE_BASE(dev->hw->index));
++	} else {
++		wed_w32(dev, MTK_WED_WDMA_CFG_BASE, dev->hw->wdma_phy);
++		wed_set(dev, MTK_WED_CTRL, MTK_WED_CTRL_ETH_DMAD_FMT);
++		wed_w32(dev, MTK_WED_WDMA_OFFSET0,
++			FIELD_PREP(MTK_WED_WDMA_OFST0_GLO_INTS,
++				   MTK_WDMA_INT_STATUS) |
++			FIELD_PREP(MTK_WED_WDMA_OFST0_GLO_CFG,
++				   MTK_WDMA_GLO_CFG));
++
++		wed_w32(dev, MTK_WED_WDMA_OFFSET1,
++			FIELD_PREP(MTK_WED_WDMA_OFST1_TX_CTRL,
++				   MTK_WDMA_RING_TX(0)) |
++			FIELD_PREP(MTK_WED_WDMA_OFST1_RX_CTRL,
++				   MTK_WDMA_RING_RX(0)));
++	}
+ }
+ 
+ static void
+@@ -355,37 +470,65 @@ mtk_wed_hw_init(struct mtk_wed_device *d
+ 
+ 	wed_w32(dev, MTK_WED_TX_BM_BASE, dev->buf_ring.desc_phys);
+ 
+-	wed_w32(dev, MTK_WED_TX_BM_TKID,
+-		FIELD_PREP(MTK_WED_TX_BM_TKID_START,
+-			   dev->wlan.token_start) |
+-		FIELD_PREP(MTK_WED_TX_BM_TKID_END,
+-			   dev->wlan.token_start + dev->wlan.nbuf - 1));
+-
+ 	wed_w32(dev, MTK_WED_TX_BM_BUF_LEN, MTK_WED_PKT_SIZE);
+ 
+-	wed_w32(dev, MTK_WED_TX_BM_DYN_THR,
+-		FIELD_PREP(MTK_WED_TX_BM_DYN_THR_LO, 1) |
+-		MTK_WED_TX_BM_DYN_THR_HI);
++	if (dev->hw->version == 1) {
++		wed_w32(dev, MTK_WED_TX_BM_TKID,
++			FIELD_PREP(MTK_WED_TX_BM_TKID_START,
++				   dev->wlan.token_start) |
++			FIELD_PREP(MTK_WED_TX_BM_TKID_END,
++				   dev->wlan.token_start +
++				   dev->wlan.nbuf - 1));
++		wed_w32(dev, MTK_WED_TX_BM_DYN_THR,
++			FIELD_PREP(MTK_WED_TX_BM_DYN_THR_LO, 1) |
++			MTK_WED_TX_BM_DYN_THR_HI);
++	} else {
++		wed_w32(dev, MTK_WED_TX_BM_TKID_V2,
++			FIELD_PREP(MTK_WED_TX_BM_TKID_START,
++				   dev->wlan.token_start) |
++			FIELD_PREP(MTK_WED_TX_BM_TKID_END,
++				   dev->wlan.token_start +
++				   dev->wlan.nbuf - 1));
++		wed_w32(dev, MTK_WED_TX_BM_DYN_THR,
++			FIELD_PREP(MTK_WED_TX_BM_DYN_THR_LO_V2, 0) |
++			MTK_WED_TX_BM_DYN_THR_HI_V2);
++		wed_w32(dev, MTK_WED_TX_TKID_CTRL,
++			MTK_WED_TX_TKID_CTRL_PAUSE |
++			FIELD_PREP(MTK_WED_TX_TKID_CTRL_VLD_GRP_NUM,
++				   dev->buf_ring.size / 128) |
++			FIELD_PREP(MTK_WED_TX_TKID_CTRL_RSV_GRP_NUM,
++				   dev->buf_ring.size / 128));
++		wed_w32(dev, MTK_WED_TX_TKID_DYN_THR,
++			FIELD_PREP(MTK_WED_TX_TKID_DYN_THR_LO, 0) |
++			MTK_WED_TX_TKID_DYN_THR_HI);
++	}
+ 
+ 	mtk_wed_reset(dev, MTK_WED_RESET_TX_BM);
+ 
+-	wed_set(dev, MTK_WED_CTRL,
+-		MTK_WED_CTRL_WED_TX_BM_EN |
+-		MTK_WED_CTRL_WED_TX_FREE_AGENT_EN);
++	if (dev->hw->version == 1)
++		wed_set(dev, MTK_WED_CTRL,
++			MTK_WED_CTRL_WED_TX_BM_EN |
++			MTK_WED_CTRL_WED_TX_FREE_AGENT_EN);
++	else
++		wed_clr(dev, MTK_WED_TX_TKID_CTRL, MTK_WED_TX_TKID_CTRL_PAUSE);
+ 
+ 	wed_clr(dev, MTK_WED_TX_BM_CTRL, MTK_WED_TX_BM_CTRL_PAUSE);
+ }
+ 
+ static void
+-mtk_wed_ring_reset(struct mtk_wdma_desc *desc, int size)
++mtk_wed_ring_reset(struct mtk_wed_ring *ring, int size)
+ {
++	void *head = (void *)ring->desc;
+ 	int i;
+ 
+ 	for (i = 0; i < size; i++) {
+-		desc[i].buf0 = 0;
+-		desc[i].ctrl = cpu_to_le32(MTK_WDMA_DESC_CTRL_DMA_DONE);
+-		desc[i].buf1 = 0;
+-		desc[i].info = 0;
++		struct mtk_wdma_desc *desc;
++
++		desc = (struct mtk_wdma_desc *)(head + i * ring->desc_size);
++		desc->buf0 = 0;
++		desc->ctrl = cpu_to_le32(MTK_WDMA_DESC_CTRL_DMA_DONE);
++		desc->buf1 = 0;
++		desc->info = 0;
+ 	}
+ }
+ 
+@@ -436,12 +579,10 @@ mtk_wed_reset_dma(struct mtk_wed_device
+ 	int i;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(dev->tx_ring); i++) {
+-		struct mtk_wdma_desc *desc = dev->tx_ring[i].desc;
+-
+-		if (!desc)
++		if (!dev->tx_ring[i].desc)
+ 			continue;
+ 
+-		mtk_wed_ring_reset(desc, MTK_WED_TX_RING_SIZE);
++		mtk_wed_ring_reset(&dev->tx_ring[i], MTK_WED_TX_RING_SIZE);
+ 	}
+ 
+ 	if (mtk_wed_poll_busy(dev))
+@@ -498,16 +639,16 @@ mtk_wed_reset_dma(struct mtk_wed_device
+ 
+ static int
+ mtk_wed_ring_alloc(struct mtk_wed_device *dev, struct mtk_wed_ring *ring,
+-		   int size)
++		   int size, u32 desc_size)
+ {
+-	ring->desc = dma_alloc_coherent(dev->hw->dev,
+-					size * sizeof(*ring->desc),
++	ring->desc = dma_alloc_coherent(dev->hw->dev, size * desc_size,
+ 					&ring->desc_phys, GFP_KERNEL);
+ 	if (!ring->desc)
+ 		return -ENOMEM;
+ 
++	ring->desc_size = desc_size;
+ 	ring->size = size;
+-	mtk_wed_ring_reset(ring->desc, size);
++	mtk_wed_ring_reset(ring, size);
+ 
+ 	return 0;
+ }
+@@ -515,9 +656,10 @@ mtk_wed_ring_alloc(struct mtk_wed_device
+ static int
+ mtk_wed_wdma_ring_setup(struct mtk_wed_device *dev, int idx, int size)
+ {
++	u32 desc_size = sizeof(struct mtk_wdma_desc) * dev->hw->version;
+ 	struct mtk_wed_ring *wdma = &dev->tx_wdma[idx];
+ 
+-	if (mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE))
++	if (mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE, desc_size))
+ 		return -ENOMEM;
+ 
+ 	wdma_w32(dev, MTK_WDMA_RING_RX(idx) + MTK_WED_RING_OFS_BASE,
+@@ -546,16 +688,41 @@ mtk_wed_configure_irq(struct mtk_wed_dev
+ 		MTK_WED_CTRL_WED_TX_BM_EN |
+ 		MTK_WED_CTRL_WED_TX_FREE_AGENT_EN);
+ 
+-	wed_w32(dev, MTK_WED_PCIE_INT_TRIGGER,
+-		MTK_WED_PCIE_INT_TRIGGER_STATUS);
++	if (dev->hw->version == 1) {
++		wed_w32(dev, MTK_WED_PCIE_INT_TRIGGER,
++			MTK_WED_PCIE_INT_TRIGGER_STATUS);
++
++		wed_w32(dev, MTK_WED_WPDMA_INT_TRIGGER,
++			MTK_WED_WPDMA_INT_TRIGGER_RX_DONE |
++			MTK_WED_WPDMA_INT_TRIGGER_TX_DONE);
+ 
+-	wed_w32(dev, MTK_WED_WPDMA_INT_TRIGGER,
+-		MTK_WED_WPDMA_INT_TRIGGER_RX_DONE |
+-		MTK_WED_WPDMA_INT_TRIGGER_TX_DONE);
++		wed_clr(dev, MTK_WED_WDMA_INT_CTRL, wdma_mask);
++	} else {
++		/* initail tx interrupt trigger */
++		wed_w32(dev, MTK_WED_WPDMA_INT_CTRL_TX,
++			MTK_WED_WPDMA_INT_CTRL_TX0_DONE_EN |
++			MTK_WED_WPDMA_INT_CTRL_TX0_DONE_CLR |
++			MTK_WED_WPDMA_INT_CTRL_TX1_DONE_EN |
++			MTK_WED_WPDMA_INT_CTRL_TX1_DONE_CLR |
++			FIELD_PREP(MTK_WED_WPDMA_INT_CTRL_TX0_DONE_TRIG,
++				   dev->wlan.tx_tbit[0]) |
++			FIELD_PREP(MTK_WED_WPDMA_INT_CTRL_TX1_DONE_TRIG,
++				   dev->wlan.tx_tbit[1]));
++
++		/* initail txfree interrupt trigger */
++		wed_w32(dev, MTK_WED_WPDMA_INT_CTRL_TX_FREE,
++			MTK_WED_WPDMA_INT_CTRL_TX_FREE_DONE_EN |
++			MTK_WED_WPDMA_INT_CTRL_TX_FREE_DONE_CLR |
++			FIELD_PREP(MTK_WED_WPDMA_INT_CTRL_TX_FREE_DONE_TRIG,
++				   dev->wlan.txfree_tbit));
++
++		wed_w32(dev, MTK_WED_WDMA_INT_CLR, wdma_mask);
++		wed_set(dev, MTK_WED_WDMA_INT_CTRL,
++			FIELD_PREP(MTK_WED_WDMA_INT_CTRL_POLL_SRC_SEL,
++				   dev->wdma_idx));
++	}
+ 
+-	/* initail wdma interrupt agent */
+ 	wed_w32(dev, MTK_WED_WDMA_INT_TRIGGER, wdma_mask);
+-	wed_clr(dev, MTK_WED_WDMA_INT_CTRL, wdma_mask);
+ 
+ 	wdma_w32(dev, MTK_WDMA_INT_MASK, wdma_mask);
+ 	wdma_w32(dev, MTK_WDMA_INT_GRP2, wdma_mask);
+@@ -580,14 +747,28 @@ mtk_wed_dma_enable(struct mtk_wed_device
+ 	wdma_set(dev, MTK_WDMA_GLO_CFG,
+ 		 MTK_WDMA_GLO_CFG_TX_DMA_EN |
+ 		 MTK_WDMA_GLO_CFG_RX_INFO1_PRERES |
+-		 MTK_WDMA_GLO_CFG_RX_INFO2_PRERES |
+-		 MTK_WDMA_GLO_CFG_RX_INFO3_PRERES);
++		 MTK_WDMA_GLO_CFG_RX_INFO2_PRERES);
++
++	if (dev->hw->version == 1) {
++		wdma_set(dev, MTK_WDMA_GLO_CFG,
++			 MTK_WDMA_GLO_CFG_RX_INFO3_PRERES);
++	} else {
++		wed_set(dev, MTK_WED_WPDMA_CTRL,
++			MTK_WED_WPDMA_CTRL_SDL1_FIXED);
++
++		wed_set(dev, MTK_WED_WPDMA_GLO_CFG,
++			MTK_WED_WPDMA_GLO_CFG_RX_DRV_R0_PKT_PROC |
++			MTK_WED_WPDMA_GLO_CFG_RX_DRV_R0_CRX_SYNC);
++
++		wed_clr(dev, MTK_WED_WPDMA_GLO_CFG,
++			MTK_WED_WPDMA_GLO_CFG_TX_TKID_KEEP |
++			MTK_WED_WPDMA_GLO_CFG_TX_DMAD_DW3_PREV);
++	}
+ }
+ 
+ static void
+ mtk_wed_start(struct mtk_wed_device *dev, u32 irq_mask)
+ {
+-	u32 val;
+ 	int i;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(dev->tx_wdma); i++)
+@@ -598,14 +779,17 @@ mtk_wed_start(struct mtk_wed_device *dev
+ 	mtk_wed_configure_irq(dev, irq_mask);
+ 
+ 	mtk_wed_set_ext_int(dev, true);
+-	val = dev->wlan.wpdma_phys |
+-	      MTK_PCIE_MIRROR_MAP_EN |
+-	      FIELD_PREP(MTK_PCIE_MIRROR_MAP_WED_ID, dev->hw->index);
+-
+-	if (dev->hw->index)
+-		val |= BIT(1);
+-	val |= BIT(0);
+-	regmap_write(dev->hw->mirror, dev->hw->index * 4, val);
++
++	if (dev->hw->version == 1) {
++		u32 val = dev->wlan.wpdma_phys | MTK_PCIE_MIRROR_MAP_EN |
++			  FIELD_PREP(MTK_PCIE_MIRROR_MAP_WED_ID,
++				     dev->hw->index);
++
++		val |= BIT(0) | (BIT(1) * !!dev->hw->index);
++		regmap_write(dev->hw->mirror, dev->hw->index * 4, val);
++	} else {
++		mtk_wed_set_512_support(dev, true);
++	}
+ 
+ 	mtk_wed_dma_enable(dev);
+ 	dev->running = true;
+@@ -639,7 +823,9 @@ mtk_wed_attach(struct mtk_wed_device *de
+ 		goto out;
+ 	}
+ 
+-	dev_info(&dev->wlan.pci_dev->dev, "attaching wed device %d\n", hw->index);
++	dev_info(&dev->wlan.pci_dev->dev,
++		 "attaching wed device %d version %d\n",
++		 hw->index, hw->version);
+ 
+ 	dev->hw = hw;
+ 	dev->dev = hw->dev;
+@@ -657,7 +843,9 @@ mtk_wed_attach(struct mtk_wed_device *de
+ 	}
+ 
+ 	mtk_wed_hw_init_early(dev);
+-	regmap_update_bits(hw->hifsys, HIFSYS_DMA_AG_MAP, BIT(hw->index), 0);
++	if (hw->hifsys)
++		regmap_update_bits(hw->hifsys, HIFSYS_DMA_AG_MAP,
++				   BIT(hw->index), 0);
+ 
+ out:
+ 	mutex_unlock(&hw_lock);
+@@ -684,7 +872,8 @@ mtk_wed_tx_ring_setup(struct mtk_wed_dev
+ 
+ 	BUG_ON(idx >= ARRAY_SIZE(dev->tx_ring));
+ 
+-	if (mtk_wed_ring_alloc(dev, ring, MTK_WED_TX_RING_SIZE))
++	if (mtk_wed_ring_alloc(dev, ring, MTK_WED_TX_RING_SIZE,
++			       sizeof(*ring->desc)))
+ 		return -ENOMEM;
+ 
+ 	if (mtk_wed_wdma_ring_setup(dev, idx, MTK_WED_WDMA_RING_SIZE))
+@@ -711,21 +900,21 @@ static int
+ mtk_wed_txfree_ring_setup(struct mtk_wed_device *dev, void __iomem *regs)
+ {
+ 	struct mtk_wed_ring *ring = &dev->txfree_ring;
+-	int i;
++	int i, index = dev->hw->version == 1;
+ 
+ 	/*
+ 	 * For txfree event handling, the same DMA ring is shared between WED
+ 	 * and WLAN. The WLAN driver accesses the ring index registers through
+ 	 * WED
+ 	 */
+-	ring->reg_base = MTK_WED_RING_RX(1);
++	ring->reg_base = MTK_WED_RING_RX(index);
+ 	ring->wpdma = regs;
+ 
+ 	for (i = 0; i < 12; i += 4) {
+ 		u32 val = readl(regs + i);
+ 
+-		wed_w32(dev, MTK_WED_RING_RX(1) + i, val);
+-		wed_w32(dev, MTK_WED_WPDMA_RING_RX(1) + i, val);
++		wed_w32(dev, MTK_WED_RING_RX(index) + i, val);
++		wed_w32(dev, MTK_WED_WPDMA_RING_RX(index) + i, val);
+ 	}
+ 
+ 	return 0;
+@@ -734,11 +923,19 @@ mtk_wed_txfree_ring_setup(struct mtk_wed
+ static u32
+ mtk_wed_irq_get(struct mtk_wed_device *dev, u32 mask)
+ {
+-	u32 val;
++	u32 val, ext_mask = MTK_WED_EXT_INT_STATUS_ERROR_MASK;
++
++	if (dev->hw->version == 1)
++		ext_mask |= MTK_WED_EXT_INT_STATUS_TX_DRV_R_RESP_ERR;
++	else
++		ext_mask |= MTK_WED_EXT_INT_STATUS_RX_FBUF_LO_TH |
++			    MTK_WED_EXT_INT_STATUS_RX_FBUF_HI_TH |
++			    MTK_WED_EXT_INT_STATUS_RX_DRV_COHERENT |
++			    MTK_WED_EXT_INT_STATUS_TX_DMA_W_RESP_ERR;
+ 
+ 	val = wed_r32(dev, MTK_WED_EXT_INT_STATUS);
+ 	wed_w32(dev, MTK_WED_EXT_INT_STATUS, val);
+-	val &= MTK_WED_EXT_INT_STATUS_ERROR_MASK;
++	val &= ext_mask;
+ 	if (!dev->hw->num_flows)
+ 		val &= ~MTK_WED_EXT_INT_STATUS_TKID_WO_PYLD;
+ 	if (val && net_ratelimit())
+@@ -813,7 +1010,8 @@ out:
+ }
+ 
+ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
+-		    void __iomem *wdma, int index)
++		    void __iomem *wdma, phys_addr_t wdma_phy,
++		    int index)
+ {
+ 	static const struct mtk_wed_ops wed_ops = {
+ 		.attach = mtk_wed_attach,
+@@ -860,26 +1058,33 @@ void mtk_wed_add_hw(struct device_node *
+ 	hw = kzalloc(sizeof(*hw), GFP_KERNEL);
+ 	if (!hw)
+ 		goto unlock;
++
+ 	hw->node = np;
+ 	hw->regs = regs;
+ 	hw->eth = eth;
+ 	hw->dev = &pdev->dev;
++	hw->wdma_phy = wdma_phy;
+ 	hw->wdma = wdma;
+ 	hw->index = index;
+ 	hw->irq = irq;
+-	hw->mirror = syscon_regmap_lookup_by_phandle(eth_np,
+-						     "mediatek,pcie-mirror");
+-	hw->hifsys = syscon_regmap_lookup_by_phandle(eth_np,
+-						     "mediatek,hifsys");
+-	if (IS_ERR(hw->mirror) || IS_ERR(hw->hifsys)) {
+-		kfree(hw);
+-		goto unlock;
+-	}
++	hw->version = MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2) ? 2 : 1;
+ 
+-	if (!index) {
+-		regmap_write(hw->mirror, 0, 0);
+-		regmap_write(hw->mirror, 4, 0);
++	if (hw->version == 1) {
++		hw->mirror = syscon_regmap_lookup_by_phandle(eth_np,
++				"mediatek,pcie-mirror");
++		hw->hifsys = syscon_regmap_lookup_by_phandle(eth_np,
++				"mediatek,hifsys");
++		if (IS_ERR(hw->mirror) || IS_ERR(hw->hifsys)) {
++			kfree(hw);
++			goto unlock;
++		}
++
++		if (!index) {
++			regmap_write(hw->mirror, 0, 0);
++			regmap_write(hw->mirror, 4, 0);
++		}
+ 	}
++
+ 	mtk_wed_hw_add_debugfs(hw);
+ 
+ 	hw_list[index] = hw;
+--- a/drivers/net/ethernet/mediatek/mtk_wed.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed.h
+@@ -18,11 +18,13 @@ struct mtk_wed_hw {
+ 	struct regmap *hifsys;
+ 	struct device *dev;
+ 	void __iomem *wdma;
++	phys_addr_t wdma_phy;
+ 	struct regmap *mirror;
+ 	struct dentry *debugfs_dir;
+ 	struct mtk_wed_device *wed_dev;
+ 	u32 debugfs_reg;
+ 	u32 num_flows;
++	u8 version;
+ 	char dirname[5];
+ 	int irq;
+ 	int index;
+@@ -101,14 +103,16 @@ wpdma_txfree_w32(struct mtk_wed_device *
+ }
+ 
+ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
+-		    void __iomem *wdma, int index);
++		    void __iomem *wdma, phys_addr_t wdma_phy,
++		    int index);
+ void mtk_wed_exit(void);
+ int mtk_wed_flow_add(int index);
+ void mtk_wed_flow_remove(int index);
+ #else
+ static inline void
+ mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
+-	       void __iomem *wdma, int index)
++	       void __iomem *wdma, phys_addr_t wdma_phy,
++	       int index)
+ {
+ }
+ static inline void
+--- a/drivers/net/ethernet/mediatek/mtk_wed_debugfs.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_debugfs.c
+@@ -116,6 +116,9 @@ wed_txinfo_show(struct seq_file *s, void
+ 		DUMP_WDMA(WDMA_GLO_CFG),
+ 		DUMP_WDMA_RING(WDMA_RING_RX(0)),
+ 		DUMP_WDMA_RING(WDMA_RING_RX(1)),
++
++		DUMP_STR("TX FREE"),
++		DUMP_WED(WED_RX_MIB(0)),
+ 	};
+ 	struct mtk_wed_hw *hw = s->private;
+ 	struct mtk_wed_device *dev = hw->wed_dev;
+--- a/drivers/net/ethernet/mediatek/mtk_wed_regs.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_regs.h
+@@ -5,6 +5,7 @@
+ #define __MTK_WED_REGS_H
+ 
+ #define MTK_WDMA_DESC_CTRL_LEN1			GENMASK(14, 0)
++#define MTK_WDMA_DESC_CTRL_LEN1_V2		GENMASK(13, 0)
+ #define MTK_WDMA_DESC_CTRL_LAST_SEG1		BIT(15)
+ #define MTK_WDMA_DESC_CTRL_BURST		BIT(16)
+ #define MTK_WDMA_DESC_CTRL_LEN0			GENMASK(29, 16)
+@@ -41,6 +42,7 @@ struct mtk_wdma_desc {
+ #define MTK_WED_CTRL_RESERVE_EN				BIT(12)
+ #define MTK_WED_CTRL_RESERVE_BUSY			BIT(13)
+ #define MTK_WED_CTRL_FINAL_DIDX_READ			BIT(24)
++#define MTK_WED_CTRL_ETH_DMAD_FMT			BIT(25)
+ #define MTK_WED_CTRL_MIB_READ_CLEAR			BIT(28)
+ 
+ #define MTK_WED_EXT_INT_STATUS				0x020
+@@ -57,7 +59,8 @@ struct mtk_wdma_desc {
+ #define MTK_WED_EXT_INT_STATUS_RX_DRV_INIT_WDMA_EN	BIT(19)
+ #define MTK_WED_EXT_INT_STATUS_RX_DRV_BM_DMAD_COHERENT	BIT(20)
+ #define MTK_WED_EXT_INT_STATUS_TX_DRV_R_RESP_ERR	BIT(21)
+-#define MTK_WED_EXT_INT_STATUS_TX_DRV_W_RESP_ERR	BIT(22)
++#define MTK_WED_EXT_INT_STATUS_TX_DMA_R_RESP_ERR	BIT(22)
++#define MTK_WED_EXT_INT_STATUS_TX_DMA_W_RESP_ERR	BIT(23)
+ #define MTK_WED_EXT_INT_STATUS_RX_DRV_DMA_RECYCLE	BIT(24)
+ #define MTK_WED_EXT_INT_STATUS_ERROR_MASK		(MTK_WED_EXT_INT_STATUS_TF_LEN_ERR | \
+ 							 MTK_WED_EXT_INT_STATUS_TKID_WO_PYLD | \
+@@ -65,8 +68,7 @@ struct mtk_wdma_desc {
+ 							 MTK_WED_EXT_INT_STATUS_RX_DRV_R_RESP_ERR | \
+ 							 MTK_WED_EXT_INT_STATUS_RX_DRV_W_RESP_ERR | \
+ 							 MTK_WED_EXT_INT_STATUS_RX_DRV_INIT_WDMA_EN | \
+-							 MTK_WED_EXT_INT_STATUS_TX_DRV_R_RESP_ERR | \
+-							 MTK_WED_EXT_INT_STATUS_TX_DRV_W_RESP_ERR)
++							 MTK_WED_EXT_INT_STATUS_TX_DMA_R_RESP_ERR)
+ 
+ #define MTK_WED_EXT_INT_MASK				0x028
+ 
+@@ -81,6 +83,7 @@ struct mtk_wdma_desc {
+ #define MTK_WED_TX_BM_BASE				0x084
+ 
+ #define MTK_WED_TX_BM_TKID				0x088
++#define MTK_WED_TX_BM_TKID_V2				0x0c8
+ #define MTK_WED_TX_BM_TKID_START			GENMASK(15, 0)
+ #define MTK_WED_TX_BM_TKID_END				GENMASK(31, 16)
+ 
+@@ -94,7 +97,25 @@ struct mtk_wdma_desc {
+ 
+ #define MTK_WED_TX_BM_DYN_THR				0x0a0
+ #define MTK_WED_TX_BM_DYN_THR_LO			GENMASK(6, 0)
++#define MTK_WED_TX_BM_DYN_THR_LO_V2			GENMASK(8, 0)
+ #define MTK_WED_TX_BM_DYN_THR_HI			GENMASK(22, 16)
++#define MTK_WED_TX_BM_DYN_THR_HI_V2			GENMASK(24, 16)
++
++#define MTK_WED_TX_TKID_CTRL				0x0c0
++#define MTK_WED_TX_TKID_CTRL_VLD_GRP_NUM		GENMASK(6, 0)
++#define MTK_WED_TX_TKID_CTRL_RSV_GRP_NUM		GENMASK(22, 16)
++#define MTK_WED_TX_TKID_CTRL_PAUSE			BIT(28)
++
++#define MTK_WED_TX_TKID_DYN_THR				0x0e0
++#define MTK_WED_TX_TKID_DYN_THR_LO			GENMASK(6, 0)
++#define MTK_WED_TX_TKID_DYN_THR_HI			GENMASK(22, 16)
++
++#define MTK_WED_TXP_DW0					0x120
++#define MTK_WED_TXP_DW1					0x124
++#define MTK_WED_WPDMA_WRITE_TXP				GENMASK(31, 16)
++#define MTK_WED_TXDP_CTRL				0x130
++#define MTK_WED_TXDP_DW9_OVERWR				BIT(9)
++#define MTK_WED_RX_BM_TKID_MIB				0x1cc
+ 
+ #define MTK_WED_INT_STATUS				0x200
+ #define MTK_WED_INT_MASK				0x204
+@@ -125,6 +146,7 @@ struct mtk_wdma_desc {
+ #define MTK_WED_RESET_IDX_RX				GENMASK(17, 16)
+ 
+ #define MTK_WED_TX_MIB(_n)				(0x2a0 + (_n) * 4)
++#define MTK_WED_RX_MIB(_n)				(0x2e0 + (_n) * 4)
+ 
+ #define MTK_WED_RING_TX(_n)				(0x300 + (_n) * 0x10)
+ 
+@@ -155,21 +177,62 @@ struct mtk_wdma_desc {
+ #define MTK_WED_WPDMA_GLO_CFG_BYTE_SWAP			BIT(29)
+ #define MTK_WED_WPDMA_GLO_CFG_RX_2B_OFFSET		BIT(31)
+ 
++/* CONFIG_MEDIATEK_NETSYS_V2 */
++#define MTK_WED_WPDMA_GLO_CFG_RX_DRV_R0_PKT_PROC	BIT(4)
++#define MTK_WED_WPDMA_GLO_CFG_RX_DRV_R1_PKT_PROC	BIT(5)
++#define MTK_WED_WPDMA_GLO_CFG_RX_DRV_R0_CRX_SYNC	BIT(6)
++#define MTK_WED_WPDMA_GLO_CFG_RX_DRV_R1_CRX_SYNC	BIT(7)
++#define MTK_WED_WPDMA_GLO_CFG_RX_DRV_EVENT_PKT_FMT_VER	GENMASK(18, 16)
++#define MTK_WED_WPDMA_GLO_CFG_RX_DRV_UNSUPPORT_FMT	BIT(19)
++#define MTK_WED_WPDMA_GLO_CFG_RX_DRV_UEVENT_PKT_FMT_CHK BIT(20)
++#define MTK_WED_WPDMA_GLO_CFG_RX_DDONE2_WR		BIT(21)
++#define MTK_WED_WPDMA_GLO_CFG_TX_TKID_KEEP		BIT(24)
++#define MTK_WED_WPDMA_GLO_CFG_TX_DMAD_DW3_PREV		BIT(28)
++
+ #define MTK_WED_WPDMA_RESET_IDX				0x50c
+ #define MTK_WED_WPDMA_RESET_IDX_TX			GENMASK(3, 0)
+ #define MTK_WED_WPDMA_RESET_IDX_RX			GENMASK(17, 16)
+ 
++#define MTK_WED_WPDMA_CTRL				0x518
++#define MTK_WED_WPDMA_CTRL_SDL1_FIXED			BIT(31)
++
+ #define MTK_WED_WPDMA_INT_CTRL				0x520
+ #define MTK_WED_WPDMA_INT_CTRL_SUBRT_ADV		BIT(21)
+ 
+ #define MTK_WED_WPDMA_INT_MASK				0x524
+ 
++#define MTK_WED_WPDMA_INT_CTRL_TX			0x530
++#define MTK_WED_WPDMA_INT_CTRL_TX0_DONE_EN		BIT(0)
++#define MTK_WED_WPDMA_INT_CTRL_TX0_DONE_CLR		BIT(1)
++#define MTK_WED_WPDMA_INT_CTRL_TX0_DONE_TRIG		GENMASK(6, 2)
++#define MTK_WED_WPDMA_INT_CTRL_TX1_DONE_EN		BIT(8)
++#define MTK_WED_WPDMA_INT_CTRL_TX1_DONE_CLR		BIT(9)
++#define MTK_WED_WPDMA_INT_CTRL_TX1_DONE_TRIG		GENMASK(14, 10)
++
++#define MTK_WED_WPDMA_INT_CTRL_RX			0x534
++
++#define MTK_WED_WPDMA_INT_CTRL_TX_FREE			0x538
++#define MTK_WED_WPDMA_INT_CTRL_TX_FREE_DONE_EN		BIT(0)
++#define MTK_WED_WPDMA_INT_CTRL_TX_FREE_DONE_CLR		BIT(1)
++#define MTK_WED_WPDMA_INT_CTRL_TX_FREE_DONE_TRIG	GENMASK(6, 2)
++
+ #define MTK_WED_PCIE_CFG_BASE				0x560
+ 
++#define MTK_WED_PCIE_CFG_BASE				0x560
++#define MTK_WED_PCIE_CFG_INTM				0x564
++#define MTK_WED_PCIE_CFG_MSIS				0x568
+ #define MTK_WED_PCIE_INT_TRIGGER			0x570
+ #define MTK_WED_PCIE_INT_TRIGGER_STATUS			BIT(16)
+ 
++#define MTK_WED_PCIE_INT_CTRL				0x57c
++#define MTK_WED_PCIE_INT_CTRL_MSK_EN_POLA		BIT(20)
++#define MTK_WED_PCIE_INT_CTRL_SRC_SEL			GENMASK(17, 16)
++#define MTK_WED_PCIE_INT_CTRL_POLL_EN			GENMASK(13, 12)
++
+ #define MTK_WED_WPDMA_CFG_BASE				0x580
++#define MTK_WED_WPDMA_CFG_INT_MASK			0x584
++#define MTK_WED_WPDMA_CFG_TX				0x588
++#define MTK_WED_WPDMA_CFG_TX_FREE			0x58c
+ 
+ #define MTK_WED_WPDMA_TX_MIB(_n)			(0x5a0 + (_n) * 4)
+ #define MTK_WED_WPDMA_TX_COHERENT_MIB(_n)		(0x5d0 + (_n) * 4)
+@@ -203,15 +266,24 @@ struct mtk_wdma_desc {
+ #define MTK_WED_WDMA_RESET_IDX_RX			GENMASK(17, 16)
+ #define MTK_WED_WDMA_RESET_IDX_DRV			GENMASK(25, 24)
+ 
++#define MTK_WED_WDMA_INT_CLR				0xa24
++#define MTK_WED_WDMA_INT_CLR_RX_DONE			GENMASK(17, 16)
++
+ #define MTK_WED_WDMA_INT_TRIGGER			0xa28
+ #define MTK_WED_WDMA_INT_TRIGGER_RX_DONE		GENMASK(17, 16)
+ 
+ #define MTK_WED_WDMA_INT_CTRL				0xa2c
+ #define MTK_WED_WDMA_INT_CTRL_POLL_SRC_SEL		GENMASK(17, 16)
+ 
++#define MTK_WED_WDMA_CFG_BASE				0xaa0
+ #define MTK_WED_WDMA_OFFSET0				0xaa4
+ #define MTK_WED_WDMA_OFFSET1				0xaa8
+ 
++#define MTK_WED_WDMA_OFST0_GLO_INTS			GENMASK(15, 0)
++#define MTK_WED_WDMA_OFST0_GLO_CFG			GENMASK(31, 16)
++#define MTK_WED_WDMA_OFST1_TX_CTRL			GENMASK(15, 0)
++#define MTK_WED_WDMA_OFST1_RX_CTRL			GENMASK(31, 16)
++
+ #define MTK_WED_WDMA_RX_MIB(_n)				(0xae0 + (_n) * 4)
+ #define MTK_WED_WDMA_RX_RECYCLE_MIB(_n)			(0xae8 + (_n) * 4)
+ #define MTK_WED_WDMA_RX_PROCESSED_MIB(_n)		(0xaf0 + (_n) * 4)
+@@ -221,6 +293,7 @@ struct mtk_wdma_desc {
+ #define MTK_WED_RING_OFS_CPU_IDX			0x08
+ #define MTK_WED_RING_OFS_DMA_IDX			0x0c
+ 
++#define MTK_WDMA_RING_TX(_n)				(0x000 + (_n) * 0x10)
+ #define MTK_WDMA_RING_RX(_n)				(0x100 + (_n) * 0x10)
+ 
+ #define MTK_WDMA_GLO_CFG				0x204
+@@ -234,6 +307,8 @@ struct mtk_wdma_desc {
+ #define MTK_WDMA_RESET_IDX_TX				GENMASK(3, 0)
+ #define MTK_WDMA_RESET_IDX_RX				GENMASK(17, 16)
+ 
++#define MTK_WDMA_INT_STATUS				0x220
++
+ #define MTK_WDMA_INT_MASK				0x228
+ #define MTK_WDMA_INT_MASK_TX_DONE			GENMASK(3, 0)
+ #define MTK_WDMA_INT_MASK_RX_DONE			GENMASK(17, 16)
+--- a/include/linux/soc/mediatek/mtk_wed.h
++++ b/include/linux/soc/mediatek/mtk_wed.h
+@@ -14,6 +14,7 @@ struct mtk_wdma_desc;
+ struct mtk_wed_ring {
+ 	struct mtk_wdma_desc *desc;
+ 	dma_addr_t desc_phys;
++	u32 desc_size;
+ 	int size;
+ 
+ 	u32 reg_base;
+@@ -45,10 +46,17 @@ struct mtk_wed_device {
+ 		struct pci_dev *pci_dev;
+ 
+ 		u32 wpdma_phys;
++		u32 wpdma_int;
++		u32 wpdma_mask;
++		u32 wpdma_tx;
++		u32 wpdma_txfree;
+ 
+ 		u16 token_start;
+ 		unsigned int nbuf;
+ 
++		u8 tx_tbit[MTK_WED_TX_QUEUES];
++		u8 txfree_tbit;
++
+ 		u32 (*init_buf)(void *ptr, dma_addr_t phys, int token_id);
+ 		int (*offload_enable)(struct mtk_wed_device *wed);
+ 		void (*offload_disable)(struct mtk_wed_device *wed);
diff --git a/target/linux/generic/backport-5.15/722-v6.0-net-ethernet-mtk_eth_wed-add-axi-bus-support.patch b/target/linux/generic/backport-5.15/722-v6.0-net-ethernet-mtk_eth_wed-add-axi-bus-support.patch
new file mode 100644
index 00000000000000..70b7bad31f2dfe
--- /dev/null
+++ b/target/linux/generic/backport-5.15/722-v6.0-net-ethernet-mtk_eth_wed-add-axi-bus-support.patch
@@ -0,0 +1,237 @@
+From 6e1df49f330dce7c58a39d6772f1385b6887bb03 Mon Sep 17 00:00:00 2001
+Message-Id: <6e1df49f330dce7c58a39d6772f1385b6887bb03.1662990860.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 8 Sep 2022 11:26:10 +0200
+Subject: [PATCH net-next] net: ethernet: mtk_eth_wed: add axi bus support
+
+Other than pcie bus, introduce support for axi bus to mtk wed driver.
+Axi bus is used to connect mt7986-wmac soc chip available on mt7986
+device.
+
+Co-developed-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_wed.c      | 116 +++++++++++++------
+ drivers/net/ethernet/mediatek/mtk_wed_regs.h |   2 +
+ include/linux/soc/mediatek/mtk_wed.h         |  11 +-
+ 3 files changed, 91 insertions(+), 38 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -85,11 +85,31 @@ static struct mtk_wed_hw *
+ mtk_wed_assign(struct mtk_wed_device *dev)
+ {
+ 	struct mtk_wed_hw *hw;
++	int i;
++
++	if (dev->wlan.bus_type == MTK_WED_BUS_PCIE) {
++		hw = hw_list[pci_domain_nr(dev->wlan.pci_dev->bus)];
++		if (!hw)
++			return NULL;
++
++		if (!hw->wed_dev)
++			goto out;
++
++		if (hw->version == 1)
++			return NULL;
++
++		/* MT7986 WED devices do not have any pcie slot restrictions */
++	}
++	/* MT7986 PCIE or AXI */
++	for (i = 0; i < ARRAY_SIZE(hw_list); i++) {
++		hw = hw_list[i];
++		if (hw && !hw->wed_dev)
++			goto out;
++	}
+ 
+-	hw = hw_list[pci_domain_nr(dev->wlan.pci_dev->bus)];
+-	if (!hw || hw->wed_dev)
+-		return NULL;
++	return NULL;
+ 
++out:
+ 	hw->wed_dev = dev;
+ 	return hw;
+ }
+@@ -322,7 +342,6 @@ mtk_wed_stop(struct mtk_wed_device *dev)
+ static void
+ mtk_wed_detach(struct mtk_wed_device *dev)
+ {
+-	struct device_node *wlan_node = dev->wlan.pci_dev->dev.of_node;
+ 	struct mtk_wed_hw *hw = dev->hw;
+ 
+ 	mutex_lock(&hw_lock);
+@@ -337,9 +356,14 @@ mtk_wed_detach(struct mtk_wed_device *de
+ 	mtk_wed_free_buffer(dev);
+ 	mtk_wed_free_tx_rings(dev);
+ 
+-	if (of_dma_is_coherent(wlan_node) && hw->hifsys)
+-		regmap_update_bits(hw->hifsys, HIFSYS_DMA_AG_MAP,
+-				   BIT(hw->index), BIT(hw->index));
++	if (dev->wlan.bus_type == MTK_WED_BUS_PCIE) {
++		struct device_node *wlan_node;
++
++		wlan_node = dev->wlan.pci_dev->dev.of_node;
++		if (of_dma_is_coherent(wlan_node) && hw->hifsys)
++			regmap_update_bits(hw->hifsys, HIFSYS_DMA_AG_MAP,
++					   BIT(hw->index), BIT(hw->index));
++	}
+ 
+ 	if (!hw_list[!hw->index]->wed_dev &&
+ 	    hw->eth->dma_dev != hw->eth->dev)
+@@ -356,40 +380,54 @@ mtk_wed_detach(struct mtk_wed_device *de
+ static void
+ mtk_wed_bus_init(struct mtk_wed_device *dev)
+ {
+-	struct device_node *np = dev->hw->eth->dev->of_node;
+-	struct regmap *regs;
+-	u32 val;
+-
+-	regs = syscon_regmap_lookup_by_phandle(np, "mediatek,wed-pcie");
+-	if (IS_ERR(regs))
+-		return;
++	switch (dev->wlan.bus_type) {
++	case MTK_WED_BUS_PCIE: {
++		struct device_node *np = dev->hw->eth->dev->of_node;
++		struct regmap *regs;
++		u32 val;
++
++		regs = syscon_regmap_lookup_by_phandle(np,
++						       "mediatek,wed-pcie");
++		if (IS_ERR(regs))
++			break;
+ 
+-	regmap_update_bits(regs, 0, BIT(0), BIT(0));
++		regmap_update_bits(regs, 0, BIT(0), BIT(0));
+ 
+-	wed_w32(dev, MTK_WED_PCIE_INT_CTRL,
+-		FIELD_PREP(MTK_WED_PCIE_INT_CTRL_POLL_EN, 2));
++		wed_w32(dev, MTK_WED_PCIE_INT_CTRL,
++			FIELD_PREP(MTK_WED_PCIE_INT_CTRL_POLL_EN, 2));
+ 
+-	/* pcie interrupt control: pola/source selection */
+-	wed_set(dev, MTK_WED_PCIE_INT_CTRL,
+-		MTK_WED_PCIE_INT_CTRL_MSK_EN_POLA |
+-		FIELD_PREP(MTK_WED_PCIE_INT_CTRL_SRC_SEL, 1));
+-	wed_r32(dev, MTK_WED_PCIE_INT_CTRL);
+-
+-	val = wed_r32(dev, MTK_WED_PCIE_CFG_INTM);
+-	val = wed_r32(dev, MTK_WED_PCIE_CFG_BASE);
+-	wed_w32(dev, MTK_WED_PCIE_CFG_INTM, PCIE_BASE_ADDR0 | 0x180);
+-	wed_w32(dev, MTK_WED_PCIE_CFG_BASE, PCIE_BASE_ADDR0 | 0x184);
+-
+-	val = wed_r32(dev, MTK_WED_PCIE_CFG_INTM);
+-	val = wed_r32(dev, MTK_WED_PCIE_CFG_BASE);
+-
+-	/* pcie interrupt status trigger register */
+-	wed_w32(dev, MTK_WED_PCIE_INT_TRIGGER, BIT(24));
+-	wed_r32(dev, MTK_WED_PCIE_INT_TRIGGER);
+-
+-	/* pola setting */
+-	val = wed_r32(dev, MTK_WED_PCIE_INT_CTRL);
+-	wed_set(dev, MTK_WED_PCIE_INT_CTRL, MTK_WED_PCIE_INT_CTRL_MSK_EN_POLA);
++		/* pcie interrupt control: pola/source selection */
++		wed_set(dev, MTK_WED_PCIE_INT_CTRL,
++			MTK_WED_PCIE_INT_CTRL_MSK_EN_POLA |
++			FIELD_PREP(MTK_WED_PCIE_INT_CTRL_SRC_SEL, 1));
++		wed_r32(dev, MTK_WED_PCIE_INT_CTRL);
++
++		val = wed_r32(dev, MTK_WED_PCIE_CFG_INTM);
++		val = wed_r32(dev, MTK_WED_PCIE_CFG_BASE);
++		wed_w32(dev, MTK_WED_PCIE_CFG_INTM, PCIE_BASE_ADDR0 | 0x180);
++		wed_w32(dev, MTK_WED_PCIE_CFG_BASE, PCIE_BASE_ADDR0 | 0x184);
++
++		val = wed_r32(dev, MTK_WED_PCIE_CFG_INTM);
++		val = wed_r32(dev, MTK_WED_PCIE_CFG_BASE);
++
++		/* pcie interrupt status trigger register */
++		wed_w32(dev, MTK_WED_PCIE_INT_TRIGGER, BIT(24));
++		wed_r32(dev, MTK_WED_PCIE_INT_TRIGGER);
++
++		/* pola setting */
++		val = wed_r32(dev, MTK_WED_PCIE_INT_CTRL);
++		wed_set(dev, MTK_WED_PCIE_INT_CTRL,
++			MTK_WED_PCIE_INT_CTRL_MSK_EN_POLA);
++		break;
++	}
++	case MTK_WED_BUS_AXI:
++		wed_set(dev, MTK_WED_WPDMA_INT_CTRL,
++			MTK_WED_WPDMA_INT_CTRL_SIG_SRC |
++			FIELD_PREP(MTK_WED_WPDMA_INT_CTRL_SRC_SEL, 0));
++		break;
++	default:
++		break;
++	}
+ }
+ 
+ static void
+@@ -800,12 +838,14 @@ mtk_wed_attach(struct mtk_wed_device *de
+ 	__releases(RCU)
+ {
+ 	struct mtk_wed_hw *hw;
++	struct device *device;
+ 	int ret = 0;
+ 
+ 	RCU_LOCKDEP_WARN(!rcu_read_lock_held(),
+ 			 "mtk_wed_attach without holding the RCU read lock");
+ 
+-	if (pci_domain_nr(dev->wlan.pci_dev->bus) > 1 ||
++	if ((dev->wlan.bus_type == MTK_WED_BUS_PCIE &&
++	     pci_domain_nr(dev->wlan.pci_dev->bus) > 1) ||
+ 	    !try_module_get(THIS_MODULE))
+ 		ret = -ENODEV;
+ 
+@@ -823,8 +863,10 @@ mtk_wed_attach(struct mtk_wed_device *de
+ 		goto out;
+ 	}
+ 
+-	dev_info(&dev->wlan.pci_dev->dev,
+-		 "attaching wed device %d version %d\n",
++	device = dev->wlan.bus_type == MTK_WED_BUS_PCIE
++		? &dev->wlan.pci_dev->dev
++		: &dev->wlan.platform_dev->dev;
++	dev_info(device, "attaching wed device %d version %d\n",
+ 		 hw->index, hw->version);
+ 
+ 	dev->hw = hw;
+--- a/drivers/net/ethernet/mediatek/mtk_wed_regs.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_regs.h
+@@ -198,6 +198,8 @@ struct mtk_wdma_desc {
+ 
+ #define MTK_WED_WPDMA_INT_CTRL				0x520
+ #define MTK_WED_WPDMA_INT_CTRL_SUBRT_ADV		BIT(21)
++#define MTK_WED_WPDMA_INT_CTRL_SIG_SRC			BIT(22)
++#define MTK_WED_WPDMA_INT_CTRL_SRC_SEL			GENMASK(17, 16)
+ 
+ #define MTK_WED_WPDMA_INT_MASK				0x524
+ 
+--- a/include/linux/soc/mediatek/mtk_wed.h
++++ b/include/linux/soc/mediatek/mtk_wed.h
+@@ -11,6 +11,11 @@
+ struct mtk_wed_hw;
+ struct mtk_wdma_desc;
+ 
++enum mtk_wed_bus_tye {
++	MTK_WED_BUS_PCIE,
++	MTK_WED_BUS_AXI,
++};
++
+ struct mtk_wed_ring {
+ 	struct mtk_wdma_desc *desc;
+ 	dma_addr_t desc_phys;
+@@ -43,7 +48,11 @@ struct mtk_wed_device {
+ 
+ 	/* filled by driver: */
+ 	struct {
+-		struct pci_dev *pci_dev;
++		union {
++			struct platform_device *platform_dev;
++			struct pci_dev *pci_dev;
++		};
++		enum mtk_wed_bus_tye bus_type;
+ 
+ 		u32 wpdma_phys;
+ 		u32 wpdma_int;
diff --git a/target/linux/generic/backport-5.15/723-v6.0-net-ethernet-mtk_eth_soc-introduce-flow-offloading-s.patch b/target/linux/generic/backport-5.15/723-v6.0-net-ethernet-mtk_eth_soc-introduce-flow-offloading-s.patch
new file mode 100644
index 00000000000000..fedcb6ccd89953
--- /dev/null
+++ b/target/linux/generic/backport-5.15/723-v6.0-net-ethernet-mtk_eth_soc-introduce-flow-offloading-s.patch
@@ -0,0 +1,882 @@
+From 93408c858e5dc01d97c55efa721268f63fde2ae5 Mon Sep 17 00:00:00 2001
+Message-Id: <93408c858e5dc01d97c55efa721268f63fde2ae5.1662886034.git.lorenzo@kernel.org>
+In-Reply-To: <e5ecb4f619197b93fa682d722452dc8412864cdb.1662886033.git.lorenzo@kernel.org>
+References: <e5ecb4f619197b93fa682d722452dc8412864cdb.1662886033.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 3 Sep 2022 18:34:09 +0200
+Subject: [PATCH net-next 4/5] net: ethernet: mtk_eth_soc: introduce flow
+ offloading support for mt7986
+
+Introduce hw flow offload support for mt7986 chipset. PPE is not enabled
+yet in mt7986 since mt76 support is not available yet.
+
+Co-developed-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c   |  11 +-
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h   |  72 ++++++
+ drivers/net/ethernet/mediatek/mtk_ppe.c       | 213 +++++++++++-------
+ drivers/net/ethernet/mediatek/mtk_ppe.h       |  52 ++++-
+ .../net/ethernet/mediatek/mtk_ppe_offload.c   |  49 ++--
+ drivers/net/ethernet/mediatek/mtk_ppe_regs.h  |   8 +
+ 6 files changed, 289 insertions(+), 116 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1859,12 +1859,14 @@ static int mtk_poll_rx(struct napi_struc
+ 		bytes += skb->len;
+ 
+ 		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++			reason = FIELD_GET(MTK_RXD5_PPE_CPU_REASON, trxd.rxd5);
+ 			hash = trxd.rxd5 & MTK_RXD5_FOE_ENTRY;
+ 			if (hash != MTK_RXD5_FOE_ENTRY)
+ 				skb_set_hash(skb, jhash_1word(hash, 0),
+ 					     PKT_HASH_TYPE_L4);
+ 			rxdcsum = &trxd.rxd3;
+ 		} else {
++			reason = FIELD_GET(MTK_RXD4_PPE_CPU_REASON, trxd.rxd4);
+ 			hash = trxd.rxd4 & MTK_RXD4_FOE_ENTRY;
+ 			if (hash != MTK_RXD4_FOE_ENTRY)
+ 				skb_set_hash(skb, jhash_1word(hash, 0),
+@@ -1878,7 +1880,6 @@ static int mtk_poll_rx(struct napi_struc
+ 			skb_checksum_none_assert(skb);
+ 		skb->protocol = eth_type_trans(skb, netdev);
+ 
+-		reason = FIELD_GET(MTK_RXD4_PPE_CPU_REASON, trxd.rxd4);
+ 		if (reason == MTK_PPE_CPU_REASON_HIT_UNBIND_RATE_REACHED)
+ 			mtk_ppe_check_skb(eth->ppe[0], skb, hash);
+ 
+@@ -4184,7 +4185,7 @@ static const struct mtk_soc_data mt7621_
+ 	.required_pctl = false,
+ 	.offload_version = 2,
+ 	.hash_offset = 2,
+-	.foe_entry_size = sizeof(struct mtk_foe_entry),
++	.foe_entry_size = sizeof(struct mtk_foe_entry) - 16,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+ 		.rxd_size = sizeof(struct mtk_rx_dma),
+@@ -4204,7 +4205,7 @@ static const struct mtk_soc_data mt7622_
+ 	.required_pctl = false,
+ 	.offload_version = 2,
+ 	.hash_offset = 2,
+-	.foe_entry_size = sizeof(struct mtk_foe_entry),
++	.foe_entry_size = sizeof(struct mtk_foe_entry) - 16,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+ 		.rxd_size = sizeof(struct mtk_rx_dma),
+@@ -4223,7 +4224,7 @@ static const struct mtk_soc_data mt7623_
+ 	.required_pctl = true,
+ 	.offload_version = 2,
+ 	.hash_offset = 2,
+-	.foe_entry_size = sizeof(struct mtk_foe_entry),
++	.foe_entry_size = sizeof(struct mtk_foe_entry) - 16,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+ 		.rxd_size = sizeof(struct mtk_rx_dma),
+@@ -4255,9 +4256,11 @@ static const struct mtk_soc_data mt7986_
+ 	.reg_map = &mt7986_reg_map,
+ 	.ana_rgc3 = 0x128,
+ 	.caps = MT7986_CAPS,
++	.hw_features = MTK_HW_FEATURES,
+ 	.required_clks = MT7986_CLKS_BITMAP,
+ 	.required_pctl = false,
+ 	.hash_offset = 4,
++	.foe_entry_size = sizeof(struct mtk_foe_entry),
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma_v2),
+ 		.rxd_size = sizeof(struct mtk_rx_dma_v2),
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -1151,6 +1151,78 @@ mtk_foe_get_entry(struct mtk_ppe *ppe, u
+ 	return ppe->foe_table + hash * soc->foe_entry_size;
+ }
+ 
++static inline u32 mtk_get_ib1_ts_mask(struct mtk_eth *eth)
++{
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++		return MTK_FOE_IB1_BIND_TIMESTAMP_V2;
++
++	return MTK_FOE_IB1_BIND_TIMESTAMP;
++}
++
++static inline u32 mtk_get_ib1_ppoe_mask(struct mtk_eth *eth)
++{
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++		return MTK_FOE_IB1_BIND_PPPOE_V2;
++
++	return MTK_FOE_IB1_BIND_PPPOE;
++}
++
++static inline u32 mtk_get_ib1_vlan_tag_mask(struct mtk_eth *eth)
++{
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++		return MTK_FOE_IB1_BIND_VLAN_TAG_V2;
++
++	return MTK_FOE_IB1_BIND_VLAN_TAG;
++}
++
++static inline u32 mtk_get_ib1_vlan_layer_mask(struct mtk_eth *eth)
++{
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++		return MTK_FOE_IB1_BIND_VLAN_LAYER_V2;
++
++	return MTK_FOE_IB1_BIND_VLAN_LAYER;
++}
++
++static inline u32 mtk_prep_ib1_vlan_layer(struct mtk_eth *eth, u32 val)
++{
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++		return FIELD_PREP(MTK_FOE_IB1_BIND_VLAN_LAYER_V2, val);
++
++	return FIELD_PREP(MTK_FOE_IB1_BIND_VLAN_LAYER, val);
++}
++
++static inline u32 mtk_get_ib1_vlan_layer(struct mtk_eth *eth, u32 val)
++{
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++		return FIELD_GET(MTK_FOE_IB1_BIND_VLAN_LAYER_V2, val);
++
++	return FIELD_GET(MTK_FOE_IB1_BIND_VLAN_LAYER, val);
++}
++
++static inline u32 mtk_get_ib1_pkt_type_mask(struct mtk_eth *eth)
++{
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++		return MTK_FOE_IB1_PACKET_TYPE_V2;
++
++	return MTK_FOE_IB1_PACKET_TYPE;
++}
++
++static inline u32 mtk_get_ib1_pkt_type(struct mtk_eth *eth, u32 val)
++{
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++		return FIELD_GET(MTK_FOE_IB1_PACKET_TYPE_V2, val);
++
++	return FIELD_GET(MTK_FOE_IB1_PACKET_TYPE, val);
++}
++
++static inline u32 mtk_get_ib2_multicast_mask(struct mtk_eth *eth)
++{
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++		return MTK_FOE_IB2_MULTICAST_V2;
++
++	return MTK_FOE_IB2_MULTICAST;
++}
++
+ /* read the hardware status register */
+ void mtk_stats_update_mac(struct mtk_mac *mac);
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -56,7 +56,7 @@ static u32 ppe_clear(struct mtk_ppe *ppe
+ 
+ static u32 mtk_eth_timestamp(struct mtk_eth *eth)
+ {
+-	return mtk_r32(eth, 0x0010) & MTK_FOE_IB1_BIND_TIMESTAMP;
++	return mtk_r32(eth, 0x0010) & mtk_get_ib1_ts_mask(eth);
+ }
+ 
+ static int mtk_ppe_wait_busy(struct mtk_ppe *ppe)
+@@ -93,7 +93,7 @@ static u32 mtk_ppe_hash_entry(struct mtk
+ 	u32 hv1, hv2, hv3;
+ 	u32 hash;
+ 
+-	switch (FIELD_GET(MTK_FOE_IB1_PACKET_TYPE, e->ib1)) {
++	switch (mtk_get_ib1_pkt_type(eth, e->ib1)) {
+ 		case MTK_PPE_PKT_TYPE_IPV4_ROUTE:
+ 		case MTK_PPE_PKT_TYPE_IPV4_HNAPT:
+ 			hv1 = e->ipv4.orig.ports;
+@@ -129,9 +129,9 @@ static u32 mtk_ppe_hash_entry(struct mtk
+ }
+ 
+ static inline struct mtk_foe_mac_info *
+-mtk_foe_entry_l2(struct mtk_foe_entry *entry)
++mtk_foe_entry_l2(struct mtk_eth *eth, struct mtk_foe_entry *entry)
+ {
+-	int type = FIELD_GET(MTK_FOE_IB1_PACKET_TYPE, entry->ib1);
++	int type = mtk_get_ib1_pkt_type(eth, entry->ib1);
+ 
+ 	if (type == MTK_PPE_PKT_TYPE_BRIDGE)
+ 		return &entry->bridge.l2;
+@@ -143,9 +143,9 @@ mtk_foe_entry_l2(struct mtk_foe_entry *e
+ }
+ 
+ static inline u32 *
+-mtk_foe_entry_ib2(struct mtk_foe_entry *entry)
++mtk_foe_entry_ib2(struct mtk_eth *eth, struct mtk_foe_entry *entry)
+ {
+-	int type = FIELD_GET(MTK_FOE_IB1_PACKET_TYPE, entry->ib1);
++	int type = mtk_get_ib1_pkt_type(eth, entry->ib1);
+ 
+ 	if (type == MTK_PPE_PKT_TYPE_BRIDGE)
+ 		return &entry->bridge.ib2;
+@@ -156,27 +156,38 @@ mtk_foe_entry_ib2(struct mtk_foe_entry *
+ 	return &entry->ipv4.ib2;
+ }
+ 
+-int mtk_foe_entry_prepare(struct mtk_foe_entry *entry, int type, int l4proto,
+-			  u8 pse_port, u8 *src_mac, u8 *dest_mac)
++int mtk_foe_entry_prepare(struct mtk_eth *eth, struct mtk_foe_entry *entry,
++			  int type, int l4proto, u8 pse_port, u8 *src_mac,
++			  u8 *dest_mac)
+ {
+ 	struct mtk_foe_mac_info *l2;
+ 	u32 ports_pad, val;
+ 
+ 	memset(entry, 0, sizeof(*entry));
+ 
+-	val = FIELD_PREP(MTK_FOE_IB1_STATE, MTK_FOE_STATE_BIND) |
+-	      FIELD_PREP(MTK_FOE_IB1_PACKET_TYPE, type) |
+-	      FIELD_PREP(MTK_FOE_IB1_UDP, l4proto == IPPROTO_UDP) |
+-	      MTK_FOE_IB1_BIND_TTL |
+-	      MTK_FOE_IB1_BIND_CACHE;
+-	entry->ib1 = val;
+-
+-	val = FIELD_PREP(MTK_FOE_IB2_PORT_MG, 0x3f) |
+-	      FIELD_PREP(MTK_FOE_IB2_PORT_AG, 0x1f) |
+-	      FIELD_PREP(MTK_FOE_IB2_DEST_PORT, pse_port);
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++		val = FIELD_PREP(MTK_FOE_IB1_STATE, MTK_FOE_STATE_BIND) |
++		      FIELD_PREP(MTK_FOE_IB1_PACKET_TYPE_V2, type) |
++		      FIELD_PREP(MTK_FOE_IB1_UDP, l4proto == IPPROTO_UDP) |
++		      MTK_FOE_IB1_BIND_CACHE_V2 | MTK_FOE_IB1_BIND_TTL_V2;
++		entry->ib1 = val;
++
++		val = FIELD_PREP(MTK_FOE_IB2_DEST_PORT_V2, pse_port) |
++		      FIELD_PREP(MTK_FOE_IB2_PORT_AG_V2, 0xf);
++	} else {
++		val = FIELD_PREP(MTK_FOE_IB1_STATE, MTK_FOE_STATE_BIND) |
++		      FIELD_PREP(MTK_FOE_IB1_PACKET_TYPE, type) |
++		      FIELD_PREP(MTK_FOE_IB1_UDP, l4proto == IPPROTO_UDP) |
++		      MTK_FOE_IB1_BIND_CACHE | MTK_FOE_IB1_BIND_TTL;
++		entry->ib1 = val;
++
++		val = FIELD_PREP(MTK_FOE_IB2_DEST_PORT, pse_port) |
++		      FIELD_PREP(MTK_FOE_IB2_PORT_MG, 0x3f) |
++		      FIELD_PREP(MTK_FOE_IB2_PORT_AG, 0x1f);
++	}
+ 
+ 	if (is_multicast_ether_addr(dest_mac))
+-		val |= MTK_FOE_IB2_MULTICAST;
++		val |= mtk_get_ib2_multicast_mask(eth);
+ 
+ 	ports_pad = 0xa5a5a500 | (l4proto & 0xff);
+ 	if (type == MTK_PPE_PKT_TYPE_IPV4_ROUTE)
+@@ -210,24 +221,30 @@ int mtk_foe_entry_prepare(struct mtk_foe
+ 	return 0;
+ }
+ 
+-int mtk_foe_entry_set_pse_port(struct mtk_foe_entry *entry, u8 port)
++int mtk_foe_entry_set_pse_port(struct mtk_eth *eth,
++			       struct mtk_foe_entry *entry, u8 port)
+ {
+-	u32 *ib2 = mtk_foe_entry_ib2(entry);
+-	u32 val;
++	u32 *ib2 = mtk_foe_entry_ib2(eth, entry);
++	u32 val = *ib2;
+ 
+-	val = *ib2;
+-	val &= ~MTK_FOE_IB2_DEST_PORT;
+-	val |= FIELD_PREP(MTK_FOE_IB2_DEST_PORT, port);
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++		val &= ~MTK_FOE_IB2_DEST_PORT_V2;
++		val |= FIELD_PREP(MTK_FOE_IB2_DEST_PORT_V2, port);
++	} else {
++		val &= ~MTK_FOE_IB2_DEST_PORT;
++		val |= FIELD_PREP(MTK_FOE_IB2_DEST_PORT, port);
++	}
+ 	*ib2 = val;
+ 
+ 	return 0;
+ }
+ 
+-int mtk_foe_entry_set_ipv4_tuple(struct mtk_foe_entry *entry, bool egress,
++int mtk_foe_entry_set_ipv4_tuple(struct mtk_eth *eth,
++				 struct mtk_foe_entry *entry, bool egress,
+ 				 __be32 src_addr, __be16 src_port,
+ 				 __be32 dest_addr, __be16 dest_port)
+ {
+-	int type = FIELD_GET(MTK_FOE_IB1_PACKET_TYPE, entry->ib1);
++	int type = mtk_get_ib1_pkt_type(eth, entry->ib1);
+ 	struct mtk_ipv4_tuple *t;
+ 
+ 	switch (type) {
+@@ -262,11 +279,12 @@ int mtk_foe_entry_set_ipv4_tuple(struct
+ 	return 0;
+ }
+ 
+-int mtk_foe_entry_set_ipv6_tuple(struct mtk_foe_entry *entry,
++int mtk_foe_entry_set_ipv6_tuple(struct mtk_eth *eth,
++				 struct mtk_foe_entry *entry,
+ 				 __be32 *src_addr, __be16 src_port,
+ 				 __be32 *dest_addr, __be16 dest_port)
+ {
+-	int type = FIELD_GET(MTK_FOE_IB1_PACKET_TYPE, entry->ib1);
++	int type = mtk_get_ib1_pkt_type(eth, entry->ib1);
+ 	u32 *src, *dest;
+ 	int i;
+ 
+@@ -297,39 +315,41 @@ int mtk_foe_entry_set_ipv6_tuple(struct
+ 	return 0;
+ }
+ 
+-int mtk_foe_entry_set_dsa(struct mtk_foe_entry *entry, int port)
++int mtk_foe_entry_set_dsa(struct mtk_eth *eth, struct mtk_foe_entry *entry,
++			  int port)
+ {
+-	struct mtk_foe_mac_info *l2 = mtk_foe_entry_l2(entry);
++	struct mtk_foe_mac_info *l2 = mtk_foe_entry_l2(eth, entry);
+ 
+ 	l2->etype = BIT(port);
+ 
+-	if (!(entry->ib1 & MTK_FOE_IB1_BIND_VLAN_LAYER))
+-		entry->ib1 |= FIELD_PREP(MTK_FOE_IB1_BIND_VLAN_LAYER, 1);
++	if (!(entry->ib1 & mtk_get_ib1_vlan_layer_mask(eth)))
++		entry->ib1 |= mtk_prep_ib1_vlan_layer(eth, 1);
+ 	else
+ 		l2->etype |= BIT(8);
+ 
+-	entry->ib1 &= ~MTK_FOE_IB1_BIND_VLAN_TAG;
++	entry->ib1 &= ~mtk_get_ib1_vlan_tag_mask(eth);
+ 
+ 	return 0;
+ }
+ 
+-int mtk_foe_entry_set_vlan(struct mtk_foe_entry *entry, int vid)
++int mtk_foe_entry_set_vlan(struct mtk_eth *eth, struct mtk_foe_entry *entry,
++			   int vid)
+ {
+-	struct mtk_foe_mac_info *l2 = mtk_foe_entry_l2(entry);
++	struct mtk_foe_mac_info *l2 = mtk_foe_entry_l2(eth, entry);
+ 
+-	switch (FIELD_GET(MTK_FOE_IB1_BIND_VLAN_LAYER, entry->ib1)) {
++	switch (mtk_prep_ib1_vlan_layer(eth, entry->ib1)) {
+ 	case 0:
+-		entry->ib1 |= MTK_FOE_IB1_BIND_VLAN_TAG |
+-			      FIELD_PREP(MTK_FOE_IB1_BIND_VLAN_LAYER, 1);
++		entry->ib1 |= mtk_get_ib1_vlan_tag_mask(eth) |
++			      mtk_prep_ib1_vlan_layer(eth, 1);
+ 		l2->vlan1 = vid;
+ 		return 0;
+ 	case 1:
+-		if (!(entry->ib1 & MTK_FOE_IB1_BIND_VLAN_TAG)) {
++		if (!(entry->ib1 & mtk_get_ib1_vlan_tag_mask(eth))) {
+ 			l2->vlan1 = vid;
+ 			l2->etype |= BIT(8);
+ 		} else {
+ 			l2->vlan2 = vid;
+-			entry->ib1 += FIELD_PREP(MTK_FOE_IB1_BIND_VLAN_LAYER, 1);
++			entry->ib1 += mtk_prep_ib1_vlan_layer(eth, 1);
+ 		}
+ 		return 0;
+ 	default:
+@@ -337,34 +357,42 @@ int mtk_foe_entry_set_vlan(struct mtk_fo
+ 	}
+ }
+ 
+-int mtk_foe_entry_set_pppoe(struct mtk_foe_entry *entry, int sid)
++int mtk_foe_entry_set_pppoe(struct mtk_eth *eth, struct mtk_foe_entry *entry,
++			    int sid)
+ {
+-	struct mtk_foe_mac_info *l2 = mtk_foe_entry_l2(entry);
++	struct mtk_foe_mac_info *l2 = mtk_foe_entry_l2(eth, entry);
+ 
+-	if (!(entry->ib1 & MTK_FOE_IB1_BIND_VLAN_LAYER) ||
+-	    (entry->ib1 & MTK_FOE_IB1_BIND_VLAN_TAG))
++	if (!(entry->ib1 & mtk_get_ib1_vlan_layer_mask(eth)) ||
++	    (entry->ib1 & mtk_get_ib1_vlan_tag_mask(eth)))
+ 		l2->etype = ETH_P_PPP_SES;
+ 
+-	entry->ib1 |= MTK_FOE_IB1_BIND_PPPOE;
++	entry->ib1 |= mtk_get_ib1_ppoe_mask(eth);
+ 	l2->pppoe_id = sid;
+ 
+ 	return 0;
+ }
+ 
+-int mtk_foe_entry_set_wdma(struct mtk_foe_entry *entry, int wdma_idx, int txq,
+-			   int bss, int wcid)
++int mtk_foe_entry_set_wdma(struct mtk_eth *eth, struct mtk_foe_entry *entry,
++			   int wdma_idx, int txq, int bss, int wcid)
+ {
+-	struct mtk_foe_mac_info *l2 = mtk_foe_entry_l2(entry);
+-	u32 *ib2 = mtk_foe_entry_ib2(entry);
++	struct mtk_foe_mac_info *l2 = mtk_foe_entry_l2(eth, entry);
++	u32 *ib2 = mtk_foe_entry_ib2(eth, entry);
+ 
+-	*ib2 &= ~MTK_FOE_IB2_PORT_MG;
+-	*ib2 |= MTK_FOE_IB2_WDMA_WINFO;
+-	if (wdma_idx)
+-		*ib2 |= MTK_FOE_IB2_WDMA_DEVIDX;
+-
+-	l2->vlan2 = FIELD_PREP(MTK_FOE_VLAN2_WINFO_BSS, bss) |
+-		    FIELD_PREP(MTK_FOE_VLAN2_WINFO_WCID, wcid) |
+-		    FIELD_PREP(MTK_FOE_VLAN2_WINFO_RING, txq);
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++		*ib2 &= ~MTK_FOE_IB2_PORT_MG_V2;
++		*ib2 |=  FIELD_PREP(MTK_FOE_IB2_RX_IDX, txq) |
++			 MTK_FOE_IB2_WDMA_WINFO_V2;
++		l2->winfo = FIELD_PREP(MTK_FOE_WINFO_WCID, wcid) |
++			    FIELD_PREP(MTK_FOE_WINFO_BSS, bss);
++	} else {
++		*ib2 &= ~MTK_FOE_IB2_PORT_MG;
++		*ib2 |= MTK_FOE_IB2_WDMA_WINFO;
++		if (wdma_idx)
++			*ib2 |= MTK_FOE_IB2_WDMA_DEVIDX;
++		l2->vlan2 = FIELD_PREP(MTK_FOE_VLAN2_WINFO_BSS, bss) |
++			    FIELD_PREP(MTK_FOE_VLAN2_WINFO_WCID, wcid) |
++			    FIELD_PREP(MTK_FOE_VLAN2_WINFO_RING, txq);
++	}
+ 
+ 	return 0;
+ }
+@@ -376,14 +404,15 @@ static inline bool mtk_foe_entry_usable(
+ }
+ 
+ static bool
+-mtk_flow_entry_match(struct mtk_flow_entry *entry, struct mtk_foe_entry *data)
++mtk_flow_entry_match(struct mtk_eth *eth, struct mtk_flow_entry *entry,
++		     struct mtk_foe_entry *data)
+ {
+ 	int type, len;
+ 
+ 	if ((data->ib1 ^ entry->data.ib1) & MTK_FOE_IB1_UDP)
+ 		return false;
+ 
+-	type = FIELD_GET(MTK_FOE_IB1_PACKET_TYPE, entry->data.ib1);
++	type = mtk_get_ib1_pkt_type(eth, entry->data.ib1);
+ 	if (type > MTK_PPE_PKT_TYPE_IPV4_DSLITE)
+ 		len = offsetof(struct mtk_foe_entry, ipv6._rsv);
+ 	else
+@@ -427,14 +456,12 @@ __mtk_foe_entry_clear(struct mtk_ppe *pp
+ 
+ static int __mtk_foe_entry_idle_time(struct mtk_ppe *ppe, u32 ib1)
+ {
+-	u16 timestamp;
+-	u16 now;
+-
+-	now = mtk_eth_timestamp(ppe->eth) & MTK_FOE_IB1_BIND_TIMESTAMP;
+-	timestamp = ib1 & MTK_FOE_IB1_BIND_TIMESTAMP;
++	u32 ib1_ts_mask = mtk_get_ib1_ts_mask(ppe->eth);
++	u16 now = mtk_eth_timestamp(ppe->eth);
++	u16 timestamp = ib1 & ib1_ts_mask;
+ 
+ 	if (timestamp > now)
+-		return MTK_FOE_IB1_BIND_TIMESTAMP + 1 - timestamp + now;
++		return ib1_ts_mask + 1 - timestamp + now;
+ 	else
+ 		return now - timestamp;
+ }
+@@ -442,6 +469,7 @@ static int __mtk_foe_entry_idle_time(str
+ static void
+ mtk_flow_entry_update_l2(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
+ {
++	u32 ib1_ts_mask = mtk_get_ib1_ts_mask(ppe->eth);
+ 	struct mtk_flow_entry *cur;
+ 	struct mtk_foe_entry *hwe;
+ 	struct hlist_node *tmp;
+@@ -466,8 +494,8 @@ mtk_flow_entry_update_l2(struct mtk_ppe
+ 			continue;
+ 
+ 		idle = cur_idle;
+-		entry->data.ib1 &= ~MTK_FOE_IB1_BIND_TIMESTAMP;
+-		entry->data.ib1 |= hwe->ib1 & MTK_FOE_IB1_BIND_TIMESTAMP;
++		entry->data.ib1 &= ~ib1_ts_mask;
++		entry->data.ib1 |= hwe->ib1 & ib1_ts_mask;
+ 	}
+ }
+ 
+@@ -489,7 +517,7 @@ mtk_flow_entry_update(struct mtk_ppe *pp
+ 
+ 	hwe = mtk_foe_get_entry(ppe, entry->hash);
+ 	memcpy(&foe, hwe, ppe->eth->soc->foe_entry_size);
+-	if (!mtk_flow_entry_match(entry, &foe)) {
++	if (!mtk_flow_entry_match(ppe->eth, entry, &foe)) {
+ 		entry->hash = 0xffff;
+ 		goto out;
+ 	}
+@@ -504,16 +532,22 @@ static void
+ __mtk_foe_entry_commit(struct mtk_ppe *ppe, struct mtk_foe_entry *entry,
+ 		       u16 hash)
+ {
++	struct mtk_eth *eth = ppe->eth;
++	u16 timestamp = mtk_eth_timestamp(eth);
+ 	struct mtk_foe_entry *hwe;
+-	u16 timestamp;
+ 
+-	timestamp = mtk_eth_timestamp(ppe->eth);
+-	timestamp &= MTK_FOE_IB1_BIND_TIMESTAMP;
+-	entry->ib1 &= ~MTK_FOE_IB1_BIND_TIMESTAMP;
+-	entry->ib1 |= FIELD_PREP(MTK_FOE_IB1_BIND_TIMESTAMP, timestamp);
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++		entry->ib1 &= ~MTK_FOE_IB1_BIND_TIMESTAMP_V2;
++		entry->ib1 |= FIELD_PREP(MTK_FOE_IB1_BIND_TIMESTAMP_V2,
++					 timestamp);
++	} else {
++		entry->ib1 &= ~MTK_FOE_IB1_BIND_TIMESTAMP;
++		entry->ib1 |= FIELD_PREP(MTK_FOE_IB1_BIND_TIMESTAMP,
++					 timestamp);
++	}
+ 
+ 	hwe = mtk_foe_get_entry(ppe, hash);
+-	memcpy(&hwe->data, &entry->data, ppe->eth->soc->foe_entry_size);
++	memcpy(&hwe->data, &entry->data, eth->soc->foe_entry_size);
+ 	wmb();
+ 	hwe->ib1 = entry->ib1;
+ 
+@@ -540,8 +574,8 @@ mtk_foe_entry_commit_l2(struct mtk_ppe *
+ 
+ int mtk_foe_entry_commit(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
+ {
+-	int type = FIELD_GET(MTK_FOE_IB1_PACKET_TYPE, entry->data.ib1);
+ 	const struct mtk_soc_data *soc = ppe->eth->soc;
++	int type = mtk_get_ib1_pkt_type(ppe->eth, entry->data.ib1);
+ 	u32 hash;
+ 
+ 	if (type == MTK_PPE_PKT_TYPE_BRIDGE)
+@@ -564,7 +598,7 @@ mtk_foe_entry_commit_subflow(struct mtk_
+ 	struct mtk_flow_entry *flow_info;
+ 	struct mtk_foe_entry foe = {}, *hwe;
+ 	struct mtk_foe_mac_info *l2;
+-	u32 ib1_mask = MTK_FOE_IB1_PACKET_TYPE | MTK_FOE_IB1_UDP;
++	u32 ib1_mask = mtk_get_ib1_pkt_type_mask(ppe->eth) | MTK_FOE_IB1_UDP;
+ 	int type;
+ 
+ 	flow_info = kzalloc(offsetof(struct mtk_flow_entry, l2_data.end),
+@@ -584,16 +618,16 @@ mtk_foe_entry_commit_subflow(struct mtk_
+ 	foe.ib1 &= ib1_mask;
+ 	foe.ib1 |= entry->data.ib1 & ~ib1_mask;
+ 
+-	l2 = mtk_foe_entry_l2(&foe);
++	l2 = mtk_foe_entry_l2(ppe->eth, &foe);
+ 	memcpy(l2, &entry->data.bridge.l2, sizeof(*l2));
+ 
+-	type = FIELD_GET(MTK_FOE_IB1_PACKET_TYPE, foe.ib1);
++	type = mtk_get_ib1_pkt_type(ppe->eth, foe.ib1);
+ 	if (type == MTK_PPE_PKT_TYPE_IPV4_HNAPT)
+ 		memcpy(&foe.ipv4.new, &foe.ipv4.orig, sizeof(foe.ipv4.new));
+ 	else if (type >= MTK_PPE_PKT_TYPE_IPV6_ROUTE_3T && l2->etype == ETH_P_IP)
+ 		l2->etype = ETH_P_IPV6;
+ 
+-	*mtk_foe_entry_ib2(&foe) = entry->data.bridge.ib2;
++	*mtk_foe_entry_ib2(ppe->eth, &foe) = entry->data.bridge.ib2;
+ 
+ 	__mtk_foe_entry_commit(ppe, &foe, hash);
+ }
+@@ -626,7 +660,7 @@ void __mtk_ppe_check_skb(struct mtk_ppe
+ 			continue;
+ 		}
+ 
+-		if (found || !mtk_flow_entry_match(entry, hwe)) {
++		if (found || !mtk_flow_entry_match(ppe->eth, entry, hwe)) {
+ 			if (entry->hash != 0xffff)
+ 				entry->hash = 0xffff;
+ 			continue;
+@@ -771,6 +805,8 @@ void mtk_ppe_start(struct mtk_ppe *ppe)
+ 			 MTK_PPE_SCAN_MODE_KEEPALIVE_AGE) |
+ 	      FIELD_PREP(MTK_PPE_TB_CFG_ENTRY_NUM,
+ 			 MTK_PPE_ENTRIES_SHIFT);
++	if (MTK_HAS_CAPS(ppe->eth->soc->caps, MTK_NETSYS_V2))
++		val |= MTK_PPE_TB_CFG_INFO_SEL;
+ 	ppe_w32(ppe, MTK_PPE_TB_CFG, val);
+ 
+ 	ppe_w32(ppe, MTK_PPE_IP_PROTO_CHK,
+@@ -778,15 +814,21 @@ void mtk_ppe_start(struct mtk_ppe *ppe)
+ 
+ 	mtk_ppe_cache_enable(ppe, true);
+ 
+-	val = MTK_PPE_FLOW_CFG_IP4_TCP_FRAG |
+-	      MTK_PPE_FLOW_CFG_IP4_UDP_FRAG |
+-	      MTK_PPE_FLOW_CFG_IP6_3T_ROUTE |
++	val = MTK_PPE_FLOW_CFG_IP6_3T_ROUTE |
+ 	      MTK_PPE_FLOW_CFG_IP6_5T_ROUTE |
+ 	      MTK_PPE_FLOW_CFG_IP6_6RD |
+ 	      MTK_PPE_FLOW_CFG_IP4_NAT |
+ 	      MTK_PPE_FLOW_CFG_IP4_NAPT |
+ 	      MTK_PPE_FLOW_CFG_IP4_DSLITE |
+ 	      MTK_PPE_FLOW_CFG_IP4_NAT_FRAG;
++	if (MTK_HAS_CAPS(ppe->eth->soc->caps, MTK_NETSYS_V2))
++		val |= MTK_PPE_MD_TOAP_BYP_CRSN0 |
++		       MTK_PPE_MD_TOAP_BYP_CRSN1 |
++		       MTK_PPE_MD_TOAP_BYP_CRSN2 |
++		       MTK_PPE_FLOW_CFG_IP4_HASH_GRE_KEY;
++	else
++		val |= MTK_PPE_FLOW_CFG_IP4_TCP_FRAG |
++		       MTK_PPE_FLOW_CFG_IP4_UDP_FRAG;
+ 	ppe_w32(ppe, MTK_PPE_FLOW_CFG, val);
+ 
+ 	val = FIELD_PREP(MTK_PPE_UNBIND_AGE_MIN_PACKETS, 1000) |
+@@ -820,6 +862,11 @@ void mtk_ppe_start(struct mtk_ppe *ppe)
+ 	ppe_w32(ppe, MTK_PPE_GLO_CFG, val);
+ 
+ 	ppe_w32(ppe, MTK_PPE_DEFAULT_CPU_PORT, 0);
++
++	if (MTK_HAS_CAPS(ppe->eth->soc->caps, MTK_NETSYS_V2)) {
++		ppe_w32(ppe, MTK_PPE_DEFAULT_CPU_PORT1, 0xcb777);
++		ppe_w32(ppe, MTK_PPE_SBW_CTRL, 0x7f);
++	}
+ }
+ 
+ int mtk_ppe_stop(struct mtk_ppe *ppe)
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h
+@@ -32,6 +32,15 @@
+ #define MTK_FOE_IB1_UDP			BIT(30)
+ #define MTK_FOE_IB1_STATIC		BIT(31)
+ 
++/* CONFIG_MEDIATEK_NETSYS_V2 */
++#define MTK_FOE_IB1_BIND_TIMESTAMP_V2	GENMASK(7, 0)
++#define MTK_FOE_IB1_BIND_VLAN_LAYER_V2	GENMASK(16, 14)
++#define MTK_FOE_IB1_BIND_PPPOE_V2	BIT(17)
++#define MTK_FOE_IB1_BIND_VLAN_TAG_V2	BIT(18)
++#define MTK_FOE_IB1_BIND_CACHE_V2	BIT(20)
++#define MTK_FOE_IB1_BIND_TTL_V2		BIT(22)
++#define MTK_FOE_IB1_PACKET_TYPE_V2	GENMASK(27, 23)
++
+ enum {
+ 	MTK_PPE_PKT_TYPE_IPV4_HNAPT = 0,
+ 	MTK_PPE_PKT_TYPE_IPV4_ROUTE = 1,
+@@ -53,14 +62,25 @@ enum {
+ 
+ #define MTK_FOE_IB2_PORT_MG		GENMASK(17, 12)
+ 
++#define MTK_FOE_IB2_RX_IDX		GENMASK(18, 17)
+ #define MTK_FOE_IB2_PORT_AG		GENMASK(23, 18)
+ 
+ #define MTK_FOE_IB2_DSCP		GENMASK(31, 24)
+ 
++/* CONFIG_MEDIATEK_NETSYS_V2 */
++#define MTK_FOE_IB2_PORT_MG_V2		BIT(7)
++#define MTK_FOE_IB2_DEST_PORT_V2	GENMASK(12, 9)
++#define MTK_FOE_IB2_MULTICAST_V2	BIT(13)
++#define MTK_FOE_IB2_WDMA_WINFO_V2	BIT(19)
++#define MTK_FOE_IB2_PORT_AG_V2		GENMASK(23, 20)
++
+ #define MTK_FOE_VLAN2_WINFO_BSS		GENMASK(5, 0)
+ #define MTK_FOE_VLAN2_WINFO_WCID	GENMASK(13, 6)
+ #define MTK_FOE_VLAN2_WINFO_RING	GENMASK(15, 14)
+ 
++#define MTK_FOE_WINFO_BSS		GENMASK(5, 0)
++#define MTK_FOE_WINFO_WCID		GENMASK(15, 6)
++
+ enum {
+ 	MTK_FOE_STATE_INVALID,
+ 	MTK_FOE_STATE_UNBIND,
+@@ -81,6 +101,9 @@ struct mtk_foe_mac_info {
+ 
+ 	u16 pppoe_id;
+ 	u16 src_mac_lo;
++
++	u16 minfo;
++	u16 winfo;
+ };
+ 
+ /* software-only entry type */
+@@ -198,7 +221,7 @@ struct mtk_foe_entry {
+ 		struct mtk_foe_ipv4_dslite dslite;
+ 		struct mtk_foe_ipv6 ipv6;
+ 		struct mtk_foe_ipv6_6rd ipv6_6rd;
+-		u32 data[19];
++		u32 data[23];
+ 	};
+ };
+ 
+@@ -306,20 +329,27 @@ mtk_ppe_check_skb(struct mtk_ppe *ppe, s
+ 	__mtk_ppe_check_skb(ppe, skb, hash);
+ }
+ 
+-int mtk_foe_entry_prepare(struct mtk_foe_entry *entry, int type, int l4proto,
+-			  u8 pse_port, u8 *src_mac, u8 *dest_mac);
+-int mtk_foe_entry_set_pse_port(struct mtk_foe_entry *entry, u8 port);
+-int mtk_foe_entry_set_ipv4_tuple(struct mtk_foe_entry *entry, bool orig,
++int mtk_foe_entry_prepare(struct mtk_eth *eth, struct mtk_foe_entry *entry,
++			  int type, int l4proto, u8 pse_port, u8 *src_mac,
++			  u8 *dest_mac);
++int mtk_foe_entry_set_pse_port(struct mtk_eth *eth,
++			       struct mtk_foe_entry *entry, u8 port);
++int mtk_foe_entry_set_ipv4_tuple(struct mtk_eth *eth,
++				 struct mtk_foe_entry *entry, bool orig,
+ 				 __be32 src_addr, __be16 src_port,
+ 				 __be32 dest_addr, __be16 dest_port);
+-int mtk_foe_entry_set_ipv6_tuple(struct mtk_foe_entry *entry,
++int mtk_foe_entry_set_ipv6_tuple(struct mtk_eth *eth,
++				 struct mtk_foe_entry *entry,
+ 				 __be32 *src_addr, __be16 src_port,
+ 				 __be32 *dest_addr, __be16 dest_port);
+-int mtk_foe_entry_set_dsa(struct mtk_foe_entry *entry, int port);
+-int mtk_foe_entry_set_vlan(struct mtk_foe_entry *entry, int vid);
+-int mtk_foe_entry_set_pppoe(struct mtk_foe_entry *entry, int sid);
+-int mtk_foe_entry_set_wdma(struct mtk_foe_entry *entry, int wdma_idx, int txq,
+-			   int bss, int wcid);
++int mtk_foe_entry_set_dsa(struct mtk_eth *eth, struct mtk_foe_entry *entry,
++			  int port);
++int mtk_foe_entry_set_vlan(struct mtk_eth *eth, struct mtk_foe_entry *entry,
++			   int vid);
++int mtk_foe_entry_set_pppoe(struct mtk_eth *eth, struct mtk_foe_entry *entry,
++			    int sid);
++int mtk_foe_entry_set_wdma(struct mtk_eth *eth, struct mtk_foe_entry *entry,
++			   int wdma_idx, int txq, int bss, int wcid);
+ int mtk_foe_entry_commit(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+ void mtk_foe_entry_clear(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+ int mtk_foe_entry_idle_time(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
+@@ -52,18 +52,19 @@ static const struct rhashtable_params mt
+ };
+ 
+ static int
+-mtk_flow_set_ipv4_addr(struct mtk_foe_entry *foe, struct mtk_flow_data *data,
+-		       bool egress)
++mtk_flow_set_ipv4_addr(struct mtk_eth *eth, struct mtk_foe_entry *foe,
++		       struct mtk_flow_data *data, bool egress)
+ {
+-	return mtk_foe_entry_set_ipv4_tuple(foe, egress,
++	return mtk_foe_entry_set_ipv4_tuple(eth, foe, egress,
+ 					    data->v4.src_addr, data->src_port,
+ 					    data->v4.dst_addr, data->dst_port);
+ }
+ 
+ static int
+-mtk_flow_set_ipv6_addr(struct mtk_foe_entry *foe, struct mtk_flow_data *data)
++mtk_flow_set_ipv6_addr(struct mtk_eth *eth, struct mtk_foe_entry *foe,
++		       struct mtk_flow_data *data)
+ {
+-	return mtk_foe_entry_set_ipv6_tuple(foe,
++	return mtk_foe_entry_set_ipv6_tuple(eth, foe,
+ 					    data->v6.src_addr.s6_addr32, data->src_port,
+ 					    data->v6.dst_addr.s6_addr32, data->dst_port);
+ }
+@@ -190,16 +191,29 @@ mtk_flow_set_output_device(struct mtk_et
+ 	int pse_port, dsa_port;
+ 
+ 	if (mtk_flow_get_wdma_info(dev, dest_mac, &info) == 0) {
+-		mtk_foe_entry_set_wdma(foe, info.wdma_idx, info.queue, info.bss,
+-				       info.wcid);
+-		pse_port = 3;
++		mtk_foe_entry_set_wdma(eth, foe, info.wdma_idx, info.queue,
++				       info.bss, info.wcid);
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++			switch (info.wdma_idx) {
++			case 0:
++				pse_port = 8;
++				break;
++			case 1:
++				pse_port = 9;
++				break;
++			default:
++				return -EINVAL;
++			}
++		} else {
++			pse_port = 3;
++		}
+ 		*wed_index = info.wdma_idx;
+ 		goto out;
+ 	}
+ 
+ 	dsa_port = mtk_flow_get_dsa_port(&dev);
+ 	if (dsa_port >= 0)
+-		mtk_foe_entry_set_dsa(foe, dsa_port);
++		mtk_foe_entry_set_dsa(eth, foe, dsa_port);
+ 
+ 	if (dev == eth->netdev[0])
+ 		pse_port = 1;
+@@ -209,7 +223,7 @@ mtk_flow_set_output_device(struct mtk_et
+ 		return -EOPNOTSUPP;
+ 
+ out:
+-	mtk_foe_entry_set_pse_port(foe, pse_port);
++	mtk_foe_entry_set_pse_port(eth, foe, pse_port);
+ 
+ 	return 0;
+ }
+@@ -333,9 +347,8 @@ mtk_flow_offload_replace(struct mtk_eth
+ 	    !is_valid_ether_addr(data.eth.h_dest))
+ 		return -EINVAL;
+ 
+-	err = mtk_foe_entry_prepare(&foe, offload_type, l4proto, 0,
+-				    data.eth.h_source,
+-				    data.eth.h_dest);
++	err = mtk_foe_entry_prepare(eth, &foe, offload_type, l4proto, 0,
++				    data.eth.h_source, data.eth.h_dest);
+ 	if (err)
+ 		return err;
+ 
+@@ -360,7 +373,7 @@ mtk_flow_offload_replace(struct mtk_eth
+ 		data.v4.src_addr = addrs.key->src;
+ 		data.v4.dst_addr = addrs.key->dst;
+ 
+-		mtk_flow_set_ipv4_addr(&foe, &data, false);
++		mtk_flow_set_ipv4_addr(eth, &foe, &data, false);
+ 	}
+ 
+ 	if (addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS) {
+@@ -371,7 +384,7 @@ mtk_flow_offload_replace(struct mtk_eth
+ 		data.v6.src_addr = addrs.key->src;
+ 		data.v6.dst_addr = addrs.key->dst;
+ 
+-		mtk_flow_set_ipv6_addr(&foe, &data);
++		mtk_flow_set_ipv6_addr(eth, &foe, &data);
+ 	}
+ 
+ 	flow_action_for_each(i, act, &rule->action) {
+@@ -401,7 +414,7 @@ mtk_flow_offload_replace(struct mtk_eth
+ 	}
+ 
+ 	if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS) {
+-		err = mtk_flow_set_ipv4_addr(&foe, &data, true);
++		err = mtk_flow_set_ipv4_addr(eth, &foe, &data, true);
+ 		if (err)
+ 			return err;
+ 	}
+@@ -413,10 +426,10 @@ mtk_flow_offload_replace(struct mtk_eth
+ 		if (data.vlan.proto != htons(ETH_P_8021Q))
+ 			return -EOPNOTSUPP;
+ 
+-		mtk_foe_entry_set_vlan(&foe, data.vlan.id);
++		mtk_foe_entry_set_vlan(eth, &foe, data.vlan.id);
+ 	}
+ 	if (data.pppoe.num == 1)
+-		mtk_foe_entry_set_pppoe(&foe, data.pppoe.sid);
++		mtk_foe_entry_set_pppoe(eth, &foe, data.pppoe.sid);
+ 
+ 	err = mtk_flow_set_output_device(eth, &foe, odev, data.eth.h_dest,
+ 					 &wed_index);
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_regs.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_regs.h
+@@ -21,6 +21,9 @@
+ #define MTK_PPE_GLO_CFG_BUSY			BIT(31)
+ 
+ #define MTK_PPE_FLOW_CFG			0x204
++#define MTK_PPE_MD_TOAP_BYP_CRSN0		BIT(1)
++#define MTK_PPE_MD_TOAP_BYP_CRSN1		BIT(2)
++#define MTK_PPE_MD_TOAP_BYP_CRSN2		BIT(3)
+ #define MTK_PPE_FLOW_CFG_IP4_TCP_FRAG		BIT(6)
+ #define MTK_PPE_FLOW_CFG_IP4_UDP_FRAG		BIT(7)
+ #define MTK_PPE_FLOW_CFG_IP6_3T_ROUTE		BIT(8)
+@@ -54,6 +57,7 @@
+ #define MTK_PPE_TB_CFG_HASH_MODE		GENMASK(15, 14)
+ #define MTK_PPE_TB_CFG_SCAN_MODE		GENMASK(17, 16)
+ #define MTK_PPE_TB_CFG_HASH_DEBUG		GENMASK(19, 18)
++#define MTK_PPE_TB_CFG_INFO_SEL			BIT(20)
+ 
+ enum {
+ 	MTK_PPE_SCAN_MODE_DISABLED,
+@@ -112,6 +116,8 @@ enum {
+ #define MTK_PPE_DEFAULT_CPU_PORT		0x248
+ #define MTK_PPE_DEFAULT_CPU_PORT_MASK(_n)	(GENMASK(2, 0) << ((_n) * 4))
+ 
++#define MTK_PPE_DEFAULT_CPU_PORT1		0x24c
++
+ #define MTK_PPE_MTU_DROP			0x308
+ 
+ #define MTK_PPE_VLAN_MTU0			0x30c
+@@ -141,4 +147,6 @@ enum {
+ #define MTK_PPE_MIB_CACHE_CTL_EN		BIT(0)
+ #define MTK_PPE_MIB_CACHE_CTL_FLUSH		BIT(2)
+ 
++#define MTK_PPE_SBW_CTRL			0x374
++
+ #endif
diff --git a/target/linux/generic/backport-5.15/724-v6.0-net-ethernet-mtk_eth_soc-enable-flow-offloading-supp.patch b/target/linux/generic/backport-5.15/724-v6.0-net-ethernet-mtk_eth_soc-enable-flow-offloading-supp.patch
new file mode 100644
index 00000000000000..e8bb85ac940eef
--- /dev/null
+++ b/target/linux/generic/backport-5.15/724-v6.0-net-ethernet-mtk_eth_soc-enable-flow-offloading-supp.patch
@@ -0,0 +1,26 @@
+From b94b02a270471337bef73c44fa3493a521e31a61 Mon Sep 17 00:00:00 2001
+Message-Id: <b94b02a270471337bef73c44fa3493a521e31a61.1662886034.git.lorenzo@kernel.org>
+In-Reply-To: <e5ecb4f619197b93fa682d722452dc8412864cdb.1662886033.git.lorenzo@kernel.org>
+References: <e5ecb4f619197b93fa682d722452dc8412864cdb.1662886033.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Mon, 5 Sep 2022 13:56:13 +0200
+Subject: [PATCH net-next 5/5] net: ethernet: mtk_eth_soc: enable flow
+ offloading support for mt7986
+
+Enable hw packet engine and wireless packet dispatcher for mt7986
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -4259,6 +4259,7 @@ static const struct mtk_soc_data mt7986_
+ 	.hw_features = MTK_HW_FEATURES,
+ 	.required_clks = MT7986_CLKS_BITMAP,
+ 	.required_pctl = false,
++	.offload_version = 2,
+ 	.hash_offset = 4,
+ 	.foe_entry_size = sizeof(struct mtk_foe_entry),
+ 	.txrx = {
diff --git a/target/linux/generic/backport-5.15/724-v6.0-net-ethernet-mtk_eth_soc-fix-wrong-use-of-new-helper.patch b/target/linux/generic/backport-5.15/724-v6.0-net-ethernet-mtk_eth_soc-fix-wrong-use-of-new-helper.patch
new file mode 100644
index 00000000000000..c4bd29365c7ad3
--- /dev/null
+++ b/target/linux/generic/backport-5.15/724-v6.0-net-ethernet-mtk_eth_soc-fix-wrong-use-of-new-helper.patch
@@ -0,0 +1,46 @@
+From 40350ce3ae8701146aafd79c5f7b5582d9955e58 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sun, 25 Sep 2022 15:12:35 +0100
+Subject: [PATCH 1/2] net: ethernet: mtk_eth_soc: fix wrong use of new helper
+ function
+To: linux-mediatek@lists.infradead.org,
+    netdev@vger.kernel.org,
+    Lorenzo Bianconi <lorenzo@kernel.org>
+Cc: Sujuan Chen <sujuan.chen@mediatek.com>,
+    Bo Jiao <Bo.Jiao@mediatek.com>,
+    Felix Fietkau <nbd@nbd.name>,
+    John Crispin <john@phrozen.org>,
+    Sean Wang <sean.wang@mediatek.com>,
+    Mark Lee <Mark-MC.Lee@mediatek.com>,
+    David S. Miller <davem@davemloft.net>,
+    Eric Dumazet <edumazet@google.com>,
+    Jakub Kicinski <kuba@kernel.org>,
+    Paolo Abeni <pabeni@redhat.com>,
+    Matthias Brugger <matthias.bgg@gmail.com>,
+    Chen Minqiang <ptpt52@gmail.com>
+
+In function mtk_foe_entry_set_vlan() the call to field accessor macro
+FIELD_GET(MTK_FOE_IB1_BIND_VLAN_LAYER, entry->ib1)
+has been wrongly replaced by
+mtk_prep_ib1_vlan_layer(eth, entry->ib1)
+
+Use correct helper function mtk_get_ib1_vlan_layer instead.
+
+Reported-by: Chen Minqiang <ptpt52@gmail.com>
+Fixes: 03a3180e5c09e1 ("net: ethernet: mtk_eth_soc: introduce flow offloading support for mt7986")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/ethernet/mediatek/mtk_ppe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -337,7 +337,7 @@ int mtk_foe_entry_set_vlan(struct mtk_et
+ {
+ 	struct mtk_foe_mac_info *l2 = mtk_foe_entry_l2(eth, entry);
+ 
+-	switch (mtk_prep_ib1_vlan_layer(eth, entry->ib1)) {
++	switch (mtk_get_ib1_vlan_layer(eth, entry->ib1)) {
+ 	case 0:
+ 		entry->ib1 |= mtk_get_ib1_vlan_tag_mask(eth) |
+ 			      mtk_prep_ib1_vlan_layer(eth, 1);
diff --git a/target/linux/generic/backport-5.15/725-v6.0-net-ethernet-mtk_eth_soc-fix-usage-of-foe_entry_size.patch b/target/linux/generic/backport-5.15/725-v6.0-net-ethernet-mtk_eth_soc-fix-usage-of-foe_entry_size.patch
new file mode 100644
index 00000000000000..bb02f401a2d6fa
--- /dev/null
+++ b/target/linux/generic/backport-5.15/725-v6.0-net-ethernet-mtk_eth_soc-fix-usage-of-foe_entry_size.patch
@@ -0,0 +1,49 @@
+From fcf14c2c5deae8f8c3d25530bab10856f63f8a63 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sun, 25 Sep 2022 15:18:54 +0100
+Subject: [PATCH 2/2] net: ethernet: mtk_eth_soc: fix usage of foe_entry_size
+To: linux-mediatek@lists.infradead.org,
+    netdev@vger.kernel.org,
+    Lorenzo Bianconi <lorenzo@kernel.org>
+Cc: Sujuan Chen <sujuan.chen@mediatek.com>,
+    Bo Jiao <Bo.Jiao@mediatek.com>,
+    Felix Fietkau <nbd@nbd.name>,
+    John Crispin <john@phrozen.org>,
+    Sean Wang <sean.wang@mediatek.com>,
+    Mark Lee <Mark-MC.Lee@mediatek.com>,
+    David S. Miller <davem@davemloft.net>,
+    Eric Dumazet <edumazet@google.com>,
+    Jakub Kicinski <kuba@kernel.org>,
+    Paolo Abeni <pabeni@redhat.com>,
+    Matthias Brugger <matthias.bgg@gmail.com>,
+    Chen Minqiang <ptpt52@gmail.com>
+
+As sizeof(hwe->data) can now longer be used as the actual size depends
+on foe_entry_size, in commit 9d8cb4c096ab02
+("net: ethernet: mtk_eth_soc: add foe_entry_size to mtk_eth_soc") the
+use of sizeof(hwe->data) is hence replaced.
+However, replacing it with ppe->eth->soc->foe_entry_size is wrong as
+foe_entry_size represents the size of the whole descriptor and not just
+the 'data' field.
+Fix this by subtracing the size of the only other field in the struct
+'ib1', so we actually end up with the correct size to be copied to the
+data field.
+
+Reported-by: Chen Minqiang <ptpt52@gmail.com>
+Fixes: 9d8cb4c096ab02 ("net: ethernet: mtk_eth_soc: add foe_entry_size to mtk_eth_soc")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/ethernet/mediatek/mtk_ppe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -547,7 +547,7 @@ __mtk_foe_entry_commit(struct mtk_ppe *p
+ 	}
+ 
+ 	hwe = mtk_foe_get_entry(ppe, hash);
+-	memcpy(&hwe->data, &entry->data, eth->soc->foe_entry_size);
++	memcpy(&hwe->data, &entry->data, eth->soc->foe_entry_size - sizeof(hwe->ib1));
+ 	wmb();
+ 	hwe->ib1 = entry->ib1;
+ 
diff --git a/target/linux/generic/backport-5.15/726-v6.0-net-ethernet-mtk_eth_soc-fix-mask-of-RX_DMA_GET_SPOR.patch b/target/linux/generic/backport-5.15/726-v6.0-net-ethernet-mtk_eth_soc-fix-mask-of-RX_DMA_GET_SPOR.patch
new file mode 100644
index 00000000000000..27c719b66353fe
--- /dev/null
+++ b/target/linux/generic/backport-5.15/726-v6.0-net-ethernet-mtk_eth_soc-fix-mask-of-RX_DMA_GET_SPOR.patch
@@ -0,0 +1,32 @@
+From c9da02bfb1112461e048d3b736afb1873f6f4ccf Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Tue, 27 Sep 2022 16:30:02 +0100
+Subject: [PATCH 1/1] net: ethernet: mtk_eth_soc: fix mask of
+ RX_DMA_GET_SPORT{,_V2}
+
+The bitmasks applied in RX_DMA_GET_SPORT and RX_DMA_GET_SPORT_V2 macros
+were swapped. Fix that.
+
+Reported-by: Chen Minqiang <ptpt52@gmail.com>
+Fixes: 160d3a9b192985 ("net: ethernet: mtk_eth_soc: introduce MTK_NETSYS_V2 support")
+Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Link: https://lore.kernel.org/r/YzMW+mg9UsaCdKRQ@makrotopia.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -315,8 +315,8 @@
+ #define MTK_RXD5_PPE_CPU_REASON	GENMASK(22, 18)
+ #define MTK_RXD5_SRC_PORT	GENMASK(29, 26)
+ 
+-#define RX_DMA_GET_SPORT(x)	(((x) >> 19) & 0xf)
+-#define RX_DMA_GET_SPORT_V2(x)	(((x) >> 26) & 0x7)
++#define RX_DMA_GET_SPORT(x)	(((x) >> 19) & 0x7)
++#define RX_DMA_GET_SPORT_V2(x)	(((x) >> 26) & 0xf)
+ 
+ /* PDMA V2 descriptor rxd3 */
+ #define RX_DMA_VTAG_V2		BIT(0)
diff --git a/target/linux/generic/backport-5.15/727-v6.1-net-ethernet-mtk_eth_soc-fix-state-in-__mtk_foe_entr.patch b/target/linux/generic/backport-5.15/727-v6.1-net-ethernet-mtk_eth_soc-fix-state-in-__mtk_foe_entr.patch
new file mode 100644
index 00000000000000..11465c1c5b71c9
--- /dev/null
+++ b/target/linux/generic/backport-5.15/727-v6.1-net-ethernet-mtk_eth_soc-fix-state-in-__mtk_foe_entr.patch
@@ -0,0 +1,37 @@
+From ae3ed15da5889263de372ff9df2e83e16acca4cb Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Fri, 30 Sep 2022 01:56:53 +0100
+Subject: [PATCH 1/1] net: ethernet: mtk_eth_soc: fix state in
+ __mtk_foe_entry_clear
+
+Setting ib1 state to MTK_FOE_STATE_UNBIND in __mtk_foe_entry_clear
+routine as done by commit 0e80707d94e4c8 ("net: ethernet: mtk_eth_soc:
+fix typo in __mtk_foe_entry_clear") breaks flow offloading, at least
+on older MTK_NETSYS_V1 SoCs, OpenWrt users have confirmed the bug on
+MT7622 and MT7621 systems.
+Felix Fietkau suggested to use MTK_FOE_STATE_INVALID instead which
+works well on both, MTK_NETSYS_V1 and MTK_NETSYS_V2.
+
+Tested on MT7622 (Linksys E8450) and MT7986 (BananaPi BPI-R3).
+
+Suggested-by: Felix Fietkau <nbd@nbd.name>
+Fixes: 0e80707d94e4c8 ("net: ethernet: mtk_eth_soc: fix typo in __mtk_foe_entry_clear")
+Fixes: 33fc42de33278b ("net: ethernet: mtk_eth_soc: support creating mac address based offload entries")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Link: https://lore.kernel.org/r/YzY+1Yg0FBXcnrtc@makrotopia.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_ppe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -442,7 +442,7 @@ __mtk_foe_entry_clear(struct mtk_ppe *pp
+ 		struct mtk_foe_entry *hwe = mtk_foe_get_entry(ppe, entry->hash);
+ 
+ 		hwe->ib1 &= ~MTK_FOE_IB1_STATE;
+-		hwe->ib1 |= FIELD_PREP(MTK_FOE_IB1_STATE, MTK_FOE_STATE_UNBIND);
++		hwe->ib1 |= FIELD_PREP(MTK_FOE_IB1_STATE, MTK_FOE_STATE_INVALID);
+ 		dma_wmb();
+ 	}
+ 	entry->hash = 0xffff;
diff --git a/target/linux/generic/backport-5.15/728-v6.1-01-net-ethernet-mtk_eth_soc-fix-possible-memory-leak-in.patch b/target/linux/generic/backport-5.15/728-v6.1-01-net-ethernet-mtk_eth_soc-fix-possible-memory-leak-in.patch
new file mode 100644
index 00000000000000..b41318afd76de5
--- /dev/null
+++ b/target/linux/generic/backport-5.15/728-v6.1-01-net-ethernet-mtk_eth_soc-fix-possible-memory-leak-in.patch
@@ -0,0 +1,73 @@
+From b3d0d98179d62f9d55635a600679c4fa362baf8d Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Mon, 17 Oct 2022 11:51:54 +0800
+Subject: [PATCH 1/3] net: ethernet: mtk_eth_soc: fix possible memory leak in
+ mtk_probe()
+
+If mtk_wed_add_hw() has been called, mtk_wed_exit() needs be called
+in error path or removing module to free the memory allocated in
+mtk_wed_add_hw().
+
+Fixes: 804775dfc288 ("net: ethernet: mtk_eth_soc: add support for Wireless Ethernet Dispatch (WED)")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -4011,19 +4011,23 @@ static int mtk_probe(struct platform_dev
+ 			eth->irq[i] = platform_get_irq(pdev, i);
+ 		if (eth->irq[i] < 0) {
+ 			dev_err(&pdev->dev, "no IRQ%d resource found\n", i);
+-			return -ENXIO;
++			err = -ENXIO;
++			goto err_wed_exit;
+ 		}
+ 	}
+ 	for (i = 0; i < ARRAY_SIZE(eth->clks); i++) {
+ 		eth->clks[i] = devm_clk_get(eth->dev,
+ 					    mtk_clks_source_name[i]);
+ 		if (IS_ERR(eth->clks[i])) {
+-			if (PTR_ERR(eth->clks[i]) == -EPROBE_DEFER)
+-				return -EPROBE_DEFER;
++			if (PTR_ERR(eth->clks[i]) == -EPROBE_DEFER) {
++				err = -EPROBE_DEFER;
++				goto err_wed_exit;
++			}
+ 			if (eth->soc->required_clks & BIT(i)) {
+ 				dev_err(&pdev->dev, "clock %s not found\n",
+ 					mtk_clks_source_name[i]);
+-				return -EINVAL;
++				err = -EINVAL;
++				goto err_wed_exit;
+ 			}
+ 			eth->clks[i] = NULL;
+ 		}
+@@ -4034,7 +4038,7 @@ static int mtk_probe(struct platform_dev
+ 
+ 	err = mtk_hw_init(eth);
+ 	if (err)
+-		return err;
++		goto err_wed_exit;
+ 
+ 	eth->hwlro = MTK_HAS_CAPS(eth->soc->caps, MTK_HWLRO);
+ 
+@@ -4132,6 +4136,8 @@ err_free_dev:
+ 	mtk_free_dev(eth);
+ err_deinit_hw:
+ 	mtk_hw_deinit(eth);
++err_wed_exit:
++	mtk_wed_exit();
+ 
+ 	return err;
+ }
+@@ -4151,6 +4157,7 @@ static int mtk_remove(struct platform_de
+ 		phylink_disconnect_phy(mac->phylink);
+ 	}
+ 
++	mtk_wed_exit();
+ 	mtk_hw_deinit(eth);
+ 
+ 	netif_napi_del(&eth->tx_napi);
diff --git a/target/linux/generic/backport-5.15/728-v6.1-02-net-ethernet-mtk_eth_wed-add-missing-put_device-in-m.patch b/target/linux/generic/backport-5.15/728-v6.1-02-net-ethernet-mtk_eth_wed-add-missing-put_device-in-m.patch
new file mode 100644
index 00000000000000..ef5374dcc574ef
--- /dev/null
+++ b/target/linux/generic/backport-5.15/728-v6.1-02-net-ethernet-mtk_eth_wed-add-missing-put_device-in-m.patch
@@ -0,0 +1,47 @@
+From 9d4f20a476ca57e4c9246eb1fa2a61bea2354720 Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Mon, 17 Oct 2022 11:51:55 +0800
+Subject: [PATCH 2/3] net: ethernet: mtk_eth_wed: add missing put_device() in
+ mtk_wed_add_hw()
+
+After calling get_device() in mtk_wed_add_hw(), in error path, put_device()
+needs be called.
+
+Fixes: 804775dfc288 ("net: ethernet: mtk_eth_soc: add support for Wireless Ethernet Dispatch (WED)")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/mediatek/mtk_wed.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -1084,11 +1084,11 @@ void mtk_wed_add_hw(struct device_node *
+ 	get_device(&pdev->dev);
+ 	irq = platform_get_irq(pdev, 0);
+ 	if (irq < 0)
+-		return;
++		goto err_put_device;
+ 
+ 	regs = syscon_regmap_lookup_by_phandle(np, NULL);
+ 	if (IS_ERR(regs))
+-		return;
++		goto err_put_device;
+ 
+ 	rcu_assign_pointer(mtk_soc_wed_ops, &wed_ops);
+ 
+@@ -1131,8 +1131,14 @@ void mtk_wed_add_hw(struct device_node *
+ 
+ 	hw_list[index] = hw;
+ 
++	mutex_unlock(&hw_lock);
++
++	return;
++
+ unlock:
+ 	mutex_unlock(&hw_lock);
++err_put_device:
++	put_device(&pdev->dev);
+ }
+ 
+ void mtk_wed_exit(void)
diff --git a/target/linux/generic/backport-5.15/728-v6.1-03-net-ethernet-mtk_eth_wed-add-missing-of_node_put.patch b/target/linux/generic/backport-5.15/728-v6.1-03-net-ethernet-mtk_eth_wed-add-missing-of_node_put.patch
new file mode 100644
index 00000000000000..0a452d4a7d46a5
--- /dev/null
+++ b/target/linux/generic/backport-5.15/728-v6.1-03-net-ethernet-mtk_eth_wed-add-missing-of_node_put.patch
@@ -0,0 +1,43 @@
+From e0bb4659e235770e6f53b3692e958591f49448f5 Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Mon, 17 Oct 2022 11:51:56 +0800
+Subject: [PATCH 3/3] net: ethernet: mtk_eth_wed: add missing of_node_put()
+
+The device_node pointer returned by of_parse_phandle() with refcount
+incremented, when finish using it, the refcount need be decreased.
+
+Fixes: 804775dfc288 ("net: ethernet: mtk_eth_soc: add support for Wireless Ethernet Dispatch (WED)")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/mediatek/mtk_wed.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -1079,7 +1079,7 @@ void mtk_wed_add_hw(struct device_node *
+ 
+ 	pdev = of_find_device_by_node(np);
+ 	if (!pdev)
+-		return;
++		goto err_of_node_put;
+ 
+ 	get_device(&pdev->dev);
+ 	irq = platform_get_irq(pdev, 0);
+@@ -1139,6 +1139,8 @@ unlock:
+ 	mutex_unlock(&hw_lock);
+ err_put_device:
+ 	put_device(&pdev->dev);
++err_of_node_put:
++	of_node_put(np);
+ }
+ 
+ void mtk_wed_exit(void)
+@@ -1159,6 +1161,7 @@ void mtk_wed_exit(void)
+ 		hw_list[i] = NULL;
+ 		debugfs_remove(hw->debugfs_dir);
+ 		put_device(hw->dev);
++		of_node_put(hw->node);
+ 		kfree(hw);
+ 	}
+ }
diff --git a/target/linux/generic/backport-5.15/729-01-v6.1-net-ethernet-mtk_wed-introduce-wed-mcu-support.patch b/target/linux/generic/backport-5.15/729-01-v6.1-net-ethernet-mtk_wed-introduce-wed-mcu-support.patch
new file mode 100644
index 00000000000000..c48613929d1272
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-01-v6.1-net-ethernet-mtk_wed-introduce-wed-mcu-support.patch
@@ -0,0 +1,591 @@
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Sat, 5 Nov 2022 23:36:18 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: introduce wed mcu support
+
+Introduce WED mcu support used to configure WED WO chip.
+This is a preliminary patch in order to add RX Wireless
+Ethernet Dispatch available on MT7986 SoC.
+
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ create mode 100644 drivers/net/ethernet/mediatek/mtk_wed_mcu.c
+ create mode 100644 drivers/net/ethernet/mediatek/mtk_wed_wo.h
+
+--- a/drivers/net/ethernet/mediatek/Makefile
++++ b/drivers/net/ethernet/mediatek/Makefile
+@@ -5,7 +5,7 @@
+ 
+ obj-$(CONFIG_NET_MEDIATEK_SOC) += mtk_eth.o
+ mtk_eth-y := mtk_eth_soc.o mtk_sgmii.o mtk_eth_path.o mtk_ppe.o mtk_ppe_debugfs.o mtk_ppe_offload.o
+-mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed.o
++mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed.o mtk_wed_mcu.o
+ ifdef CONFIG_DEBUG_FS
+ mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed_debugfs.o
+ endif
+--- /dev/null
++++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
+@@ -0,0 +1,359 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/* Copyright (C) 2022 MediaTek Inc.
++ *
++ * Author: Lorenzo Bianconi <lorenzo@kernel.org>
++ *	   Sujuan Chen <sujuan.chen@mediatek.com>
++ */
++
++#include <linux/firmware.h>
++#include <linux/of_address.h>
++#include <linux/of_reserved_mem.h>
++#include <linux/mfd/syscon.h>
++#include <linux/soc/mediatek/mtk_wed.h>
++
++#include "mtk_wed_regs.h"
++#include "mtk_wed_wo.h"
++#include "mtk_wed.h"
++
++static u32 wo_r32(struct mtk_wed_wo *wo, u32 reg)
++{
++	return readl(wo->boot.addr + reg);
++}
++
++static void wo_w32(struct mtk_wed_wo *wo, u32 reg, u32 val)
++{
++	writel(val, wo->boot.addr + reg);
++}
++
++static struct sk_buff *
++mtk_wed_mcu_msg_alloc(const void *data, int data_len)
++{
++	int length = sizeof(struct mtk_wed_mcu_hdr) + data_len;
++	struct sk_buff *skb;
++
++	skb = alloc_skb(length, GFP_KERNEL);
++	if (!skb)
++		return NULL;
++
++	memset(skb->head, 0, length);
++	skb_reserve(skb, sizeof(struct mtk_wed_mcu_hdr));
++	if (data && data_len)
++		skb_put_data(skb, data, data_len);
++
++	return skb;
++}
++
++static struct sk_buff *
++mtk_wed_mcu_get_response(struct mtk_wed_wo *wo, unsigned long expires)
++{
++	if (!time_is_after_jiffies(expires))
++		return NULL;
++
++	wait_event_timeout(wo->mcu.wait, !skb_queue_empty(&wo->mcu.res_q),
++			   expires - jiffies);
++	return skb_dequeue(&wo->mcu.res_q);
++}
++
++void mtk_wed_mcu_rx_event(struct mtk_wed_wo *wo, struct sk_buff *skb)
++{
++	skb_queue_tail(&wo->mcu.res_q, skb);
++	wake_up(&wo->mcu.wait);
++}
++
++void mtk_wed_mcu_rx_unsolicited_event(struct mtk_wed_wo *wo,
++				      struct sk_buff *skb)
++{
++	struct mtk_wed_mcu_hdr *hdr = (struct mtk_wed_mcu_hdr *)skb->data;
++
++	switch (hdr->cmd) {
++	case MTK_WED_WO_EVT_LOG_DUMP: {
++		const char *msg = (const char *)(skb->data + sizeof(*hdr));
++
++		dev_notice(wo->hw->dev, "%s\n", msg);
++		break;
++	}
++	case MTK_WED_WO_EVT_PROFILING: {
++		struct mtk_wed_wo_log_info *info;
++		u32 count = (skb->len - sizeof(*hdr)) / sizeof(*info);
++		int i;
++
++		info = (struct mtk_wed_wo_log_info *)(skb->data + sizeof(*hdr));
++		for (i = 0 ; i < count ; i++)
++			dev_notice(wo->hw->dev,
++				   "SN:%u latency: total=%u, rro:%u, mod:%u\n",
++				   le32_to_cpu(info[i].sn),
++				   le32_to_cpu(info[i].total),
++				   le32_to_cpu(info[i].rro),
++				   le32_to_cpu(info[i].mod));
++		break;
++	}
++	case MTK_WED_WO_EVT_RXCNT_INFO:
++		break;
++	default:
++		break;
++	}
++
++	dev_kfree_skb(skb);
++}
++
++static int
++mtk_wed_mcu_skb_send_msg(struct mtk_wed_wo *wo, struct sk_buff *skb,
++			 int id, int cmd, u16 *wait_seq, bool wait_resp)
++{
++	struct mtk_wed_mcu_hdr *hdr;
++
++	/* TODO: make it dynamic based on cmd */
++	wo->mcu.timeout = 20 * HZ;
++
++	hdr = (struct mtk_wed_mcu_hdr *)skb_push(skb, sizeof(*hdr));
++	hdr->cmd = cmd;
++	hdr->length = cpu_to_le16(skb->len);
++
++	if (wait_resp && wait_seq) {
++		u16 seq = ++wo->mcu.seq;
++
++		if (!seq)
++			seq = ++wo->mcu.seq;
++		*wait_seq = seq;
++
++		hdr->flag |= cpu_to_le16(MTK_WED_WARP_CMD_FLAG_NEED_RSP);
++		hdr->seq = cpu_to_le16(seq);
++	}
++	if (id == MTK_WED_MODULE_ID_WO)
++		hdr->flag |= cpu_to_le16(MTK_WED_WARP_CMD_FLAG_FROM_TO_WO);
++
++	dev_kfree_skb(skb);
++	return 0;
++}
++
++static int
++mtk_wed_mcu_parse_response(struct mtk_wed_wo *wo, struct sk_buff *skb,
++			   int cmd, int seq)
++{
++	struct mtk_wed_mcu_hdr *hdr;
++
++	if (!skb) {
++		dev_err(wo->hw->dev, "Message %08x (seq %d) timeout\n",
++			cmd, seq);
++		return -ETIMEDOUT;
++	}
++
++	hdr = (struct mtk_wed_mcu_hdr *)skb->data;
++	if (le16_to_cpu(hdr->seq) != seq)
++		return -EAGAIN;
++
++	skb_pull(skb, sizeof(*hdr));
++	switch (cmd) {
++	case MTK_WED_WO_CMD_RXCNT_INFO:
++	default:
++		break;
++	}
++
++	return 0;
++}
++
++int mtk_wed_mcu_send_msg(struct mtk_wed_wo *wo, int id, int cmd,
++			 const void *data, int len, bool wait_resp)
++{
++	unsigned long expires;
++	struct sk_buff *skb;
++	u16 seq;
++	int ret;
++
++	skb = mtk_wed_mcu_msg_alloc(data, len);
++	if (!skb)
++		return -ENOMEM;
++
++	mutex_lock(&wo->mcu.mutex);
++
++	ret = mtk_wed_mcu_skb_send_msg(wo, skb, id, cmd, &seq, wait_resp);
++	if (ret || !wait_resp)
++		goto unlock;
++
++	expires = jiffies + wo->mcu.timeout;
++	do {
++		skb = mtk_wed_mcu_get_response(wo, expires);
++		ret = mtk_wed_mcu_parse_response(wo, skb, cmd, seq);
++		dev_kfree_skb(skb);
++	} while (ret == -EAGAIN);
++
++unlock:
++	mutex_unlock(&wo->mcu.mutex);
++
++	return ret;
++}
++
++static int
++mtk_wed_get_memory_region(struct mtk_wed_wo *wo,
++			  struct mtk_wed_wo_memory_region *region)
++{
++	struct reserved_mem *rmem;
++	struct device_node *np;
++	int index;
++
++	index = of_property_match_string(wo->hw->node, "memory-region-names",
++					 region->name);
++	if (index < 0)
++		return index;
++
++	np = of_parse_phandle(wo->hw->node, "memory-region", index);
++	if (!np)
++		return -ENODEV;
++
++	rmem = of_reserved_mem_lookup(np);
++	of_node_put(np);
++
++	if (!rmem)
++		return -ENODEV;
++
++	region->phy_addr = rmem->base;
++	region->size = rmem->size;
++	region->addr = devm_ioremap(wo->hw->dev, region->phy_addr, region->size);
++
++	return !region->addr ? -EINVAL : 0;
++}
++
++static int
++mtk_wed_mcu_run_firmware(struct mtk_wed_wo *wo, const struct firmware *fw,
++			 struct mtk_wed_wo_memory_region *region)
++{
++	const u8 *first_region_ptr, *region_ptr, *trailer_ptr, *ptr = fw->data;
++	const struct mtk_wed_fw_trailer *trailer;
++	const struct mtk_wed_fw_region *fw_region;
++
++	trailer_ptr = fw->data + fw->size - sizeof(*trailer);
++	trailer = (const struct mtk_wed_fw_trailer *)trailer_ptr;
++	region_ptr = trailer_ptr - trailer->num_region * sizeof(*fw_region);
++	first_region_ptr = region_ptr;
++
++	while (region_ptr < trailer_ptr) {
++		u32 length;
++
++		fw_region = (const struct mtk_wed_fw_region *)region_ptr;
++		length = le32_to_cpu(fw_region->len);
++
++		if (region->phy_addr != le32_to_cpu(fw_region->addr))
++			goto next;
++
++		if (region->size < length)
++			goto next;
++
++		if (first_region_ptr < ptr + length)
++			goto next;
++
++		if (region->shared && region->consumed)
++			return 0;
++
++		if (!region->shared || !region->consumed) {
++			memcpy_toio(region->addr, ptr, length);
++			region->consumed = true;
++			return 0;
++		}
++next:
++		region_ptr += sizeof(*fw_region);
++		ptr += length;
++	}
++
++	return -EINVAL;
++}
++
++static int
++mtk_wed_mcu_load_firmware(struct mtk_wed_wo *wo)
++{
++	static struct mtk_wed_wo_memory_region mem_region[] = {
++		[MTK_WED_WO_REGION_EMI] = {
++			.name = "wo-emi",
++		},
++		[MTK_WED_WO_REGION_ILM] = {
++			.name = "wo-ilm",
++		},
++		[MTK_WED_WO_REGION_DATA] = {
++			.name = "wo-data",
++			.shared = true,
++		},
++	};
++	const struct mtk_wed_fw_trailer *trailer;
++	const struct firmware *fw;
++	const char *fw_name;
++	u32 val, boot_cr;
++	int ret, i;
++
++	/* load firmware region metadata */
++	for (i = 0; i < ARRAY_SIZE(mem_region); i++) {
++		ret = mtk_wed_get_memory_region(wo, &mem_region[i]);
++		if (ret)
++			return ret;
++	}
++
++	wo->boot.name = "wo-boot";
++	ret = mtk_wed_get_memory_region(wo, &wo->boot);
++	if (ret)
++		return ret;
++
++	/* set dummy cr */
++	wed_w32(wo->hw->wed_dev, MTK_WED_SCR0 + 4 * MTK_WED_DUMMY_CR_FWDL,
++		wo->hw->index + 1);
++
++	/* load firmware */
++	fw_name = wo->hw->index ? MT7986_FIRMWARE_WO1 : MT7986_FIRMWARE_WO0;
++	ret = request_firmware(&fw, fw_name, wo->hw->dev);
++	if (ret)
++		return ret;
++
++	trailer = (void *)(fw->data + fw->size -
++			   sizeof(struct mtk_wed_fw_trailer));
++	dev_info(wo->hw->dev,
++		 "MTK WED WO Firmware Version: %.10s, Build Time: %.15s\n",
++		 trailer->fw_ver, trailer->build_date);
++	dev_info(wo->hw->dev, "MTK WED WO Chip ID %02x Region %d\n",
++		 trailer->chip_id, trailer->num_region);
++
++	for (i = 0; i < ARRAY_SIZE(mem_region); i++) {
++		ret = mtk_wed_mcu_run_firmware(wo, fw, &mem_region[i]);
++		if (ret)
++			goto out;
++	}
++
++	/* set the start address */
++	boot_cr = wo->hw->index ? MTK_WO_MCU_CFG_LS_WA_BOOT_ADDR_ADDR
++				: MTK_WO_MCU_CFG_LS_WM_BOOT_ADDR_ADDR;
++	wo_w32(wo, boot_cr, mem_region[MTK_WED_WO_REGION_EMI].phy_addr >> 16);
++	/* wo firmware reset */
++	wo_w32(wo, MTK_WO_MCU_CFG_LS_WF_MCCR_CLR_ADDR, 0xc00);
++
++	val = wo_r32(wo, MTK_WO_MCU_CFG_LS_WF_MCU_CFG_WM_WA_ADDR);
++	val |= wo->hw->index ? MTK_WO_MCU_CFG_LS_WF_WM_WA_WA_CPU_RSTB_MASK
++			     : MTK_WO_MCU_CFG_LS_WF_WM_WA_WM_CPU_RSTB_MASK;
++	wo_w32(wo, MTK_WO_MCU_CFG_LS_WF_MCU_CFG_WM_WA_ADDR, val);
++out:
++	release_firmware(fw);
++
++	return ret;
++}
++
++static u32
++mtk_wed_mcu_read_fw_dl(struct mtk_wed_wo *wo)
++{
++	return wed_r32(wo->hw->wed_dev,
++		       MTK_WED_SCR0 + 4 * MTK_WED_DUMMY_CR_FWDL);
++}
++
++int mtk_wed_mcu_init(struct mtk_wed_wo *wo)
++{
++	u32 val;
++	int ret;
++
++	skb_queue_head_init(&wo->mcu.res_q);
++	init_waitqueue_head(&wo->mcu.wait);
++	mutex_init(&wo->mcu.mutex);
++
++	ret = mtk_wed_mcu_load_firmware(wo);
++	if (ret)
++		return ret;
++
++	return readx_poll_timeout(mtk_wed_mcu_read_fw_dl, wo, val, !val,
++				  100, MTK_FW_DL_TIMEOUT);
++}
++
++MODULE_FIRMWARE(MT7986_FIRMWARE_WO0);
++MODULE_FIRMWARE(MT7986_FIRMWARE_WO1);
+--- a/drivers/net/ethernet/mediatek/mtk_wed_regs.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_regs.h
+@@ -152,6 +152,7 @@ struct mtk_wdma_desc {
+ 
+ #define MTK_WED_RING_RX(_n)				(0x400 + (_n) * 0x10)
+ 
++#define MTK_WED_SCR0					0x3c0
+ #define MTK_WED_WPDMA_INT_TRIGGER			0x504
+ #define MTK_WED_WPDMA_INT_TRIGGER_RX_DONE		BIT(1)
+ #define MTK_WED_WPDMA_INT_TRIGGER_TX_DONE		GENMASK(5, 4)
+--- /dev/null
++++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.h
+@@ -0,0 +1,150 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++/* Copyright (C) 2022 Lorenzo Bianconi <lorenzo@kernel.org>  */
++
++#ifndef __MTK_WED_WO_H
++#define __MTK_WED_WO_H
++
++#include <linux/skbuff.h>
++#include <linux/netdevice.h>
++
++struct mtk_wed_hw;
++
++struct mtk_wed_mcu_hdr {
++	/* DW0 */
++	u8 version;
++	u8 cmd;
++	__le16 length;
++
++	/* DW1 */
++	__le16 seq;
++	__le16 flag;
++
++	/* DW2 */
++	__le32 status;
++
++	/* DW3 */
++	u8 rsv[20];
++};
++
++struct mtk_wed_wo_log_info {
++	__le32 sn;
++	__le32 total;
++	__le32 rro;
++	__le32 mod;
++};
++
++enum mtk_wed_wo_event {
++	MTK_WED_WO_EVT_LOG_DUMP		= 0x1,
++	MTK_WED_WO_EVT_PROFILING	= 0x2,
++	MTK_WED_WO_EVT_RXCNT_INFO	= 0x3,
++};
++
++#define MTK_WED_MODULE_ID_WO		1
++#define MTK_FW_DL_TIMEOUT		4000000 /* us */
++#define MTK_WOCPU_TIMEOUT		2000000 /* us */
++
++enum {
++	MTK_WED_WARP_CMD_FLAG_RSP		= BIT(0),
++	MTK_WED_WARP_CMD_FLAG_NEED_RSP		= BIT(1),
++	MTK_WED_WARP_CMD_FLAG_FROM_TO_WO	= BIT(2),
++};
++
++enum {
++	MTK_WED_WO_REGION_EMI,
++	MTK_WED_WO_REGION_ILM,
++	MTK_WED_WO_REGION_DATA,
++	MTK_WED_WO_REGION_BOOT,
++	__MTK_WED_WO_REGION_MAX,
++};
++
++enum mtk_wed_dummy_cr_idx {
++	MTK_WED_DUMMY_CR_FWDL,
++	MTK_WED_DUMMY_CR_WO_STATUS,
++};
++
++#define MT7986_FIRMWARE_WO0	"mediatek/mt7986_wo_0.bin"
++#define MT7986_FIRMWARE_WO1	"mediatek/mt7986_wo_1.bin"
++
++#define MTK_WO_MCU_CFG_LS_BASE				0
++#define MTK_WO_MCU_CFG_LS_HW_VER_ADDR			(MTK_WO_MCU_CFG_LS_BASE + 0x000)
++#define MTK_WO_MCU_CFG_LS_FW_VER_ADDR			(MTK_WO_MCU_CFG_LS_BASE + 0x004)
++#define MTK_WO_MCU_CFG_LS_CFG_DBG1_ADDR			(MTK_WO_MCU_CFG_LS_BASE + 0x00c)
++#define MTK_WO_MCU_CFG_LS_CFG_DBG2_ADDR			(MTK_WO_MCU_CFG_LS_BASE + 0x010)
++#define MTK_WO_MCU_CFG_LS_WF_MCCR_ADDR			(MTK_WO_MCU_CFG_LS_BASE + 0x014)
++#define MTK_WO_MCU_CFG_LS_WF_MCCR_SET_ADDR		(MTK_WO_MCU_CFG_LS_BASE + 0x018)
++#define MTK_WO_MCU_CFG_LS_WF_MCCR_CLR_ADDR		(MTK_WO_MCU_CFG_LS_BASE + 0x01c)
++#define MTK_WO_MCU_CFG_LS_WF_MCU_CFG_WM_WA_ADDR		(MTK_WO_MCU_CFG_LS_BASE + 0x050)
++#define MTK_WO_MCU_CFG_LS_WM_BOOT_ADDR_ADDR		(MTK_WO_MCU_CFG_LS_BASE + 0x060)
++#define MTK_WO_MCU_CFG_LS_WA_BOOT_ADDR_ADDR		(MTK_WO_MCU_CFG_LS_BASE + 0x064)
++
++#define MTK_WO_MCU_CFG_LS_WF_WM_WA_WM_CPU_RSTB_MASK	BIT(5)
++#define MTK_WO_MCU_CFG_LS_WF_WM_WA_WA_CPU_RSTB_MASK	BIT(0)
++
++struct mtk_wed_wo_memory_region {
++	const char *name;
++	void __iomem *addr;
++	phys_addr_t phy_addr;
++	u32 size;
++	bool shared:1;
++	bool consumed:1;
++};
++
++struct mtk_wed_fw_region {
++	__le32 decomp_crc;
++	__le32 decomp_len;
++	__le32 decomp_blk_sz;
++	u8 rsv0[4];
++	__le32 addr;
++	__le32 len;
++	u8 feature_set;
++	u8 rsv1[15];
++} __packed;
++
++struct mtk_wed_fw_trailer {
++	u8 chip_id;
++	u8 eco_code;
++	u8 num_region;
++	u8 format_ver;
++	u8 format_flag;
++	u8 rsv[2];
++	char fw_ver[10];
++	char build_date[15];
++	u32 crc;
++};
++
++struct mtk_wed_wo {
++	struct mtk_wed_hw *hw;
++	struct mtk_wed_wo_memory_region boot;
++
++	struct {
++		struct mutex mutex;
++		int timeout;
++		u16 seq;
++
++		struct sk_buff_head res_q;
++		wait_queue_head_t wait;
++	} mcu;
++};
++
++static inline int
++mtk_wed_mcu_check_msg(struct mtk_wed_wo *wo, struct sk_buff *skb)
++{
++	struct mtk_wed_mcu_hdr *hdr = (struct mtk_wed_mcu_hdr *)skb->data;
++
++	if (hdr->version)
++		return -EINVAL;
++
++	if (skb->len < sizeof(*hdr) || skb->len != le16_to_cpu(hdr->length))
++		return -EINVAL;
++
++	return 0;
++}
++
++void mtk_wed_mcu_rx_event(struct mtk_wed_wo *wo, struct sk_buff *skb);
++void mtk_wed_mcu_rx_unsolicited_event(struct mtk_wed_wo *wo,
++				      struct sk_buff *skb);
++int mtk_wed_mcu_send_msg(struct mtk_wed_wo *wo, int id, int cmd,
++			 const void *data, int len, bool wait_resp);
++int mtk_wed_mcu_init(struct mtk_wed_wo *wo);
++
++#endif /* __MTK_WED_WO_H */
+--- a/include/linux/soc/mediatek/mtk_wed.h
++++ b/include/linux/soc/mediatek/mtk_wed.h
+@@ -11,6 +11,35 @@
+ struct mtk_wed_hw;
+ struct mtk_wdma_desc;
+ 
++enum mtk_wed_wo_cmd {
++	MTK_WED_WO_CMD_WED_CFG,
++	MTK_WED_WO_CMD_WED_RX_STAT,
++	MTK_WED_WO_CMD_RRO_SER,
++	MTK_WED_WO_CMD_DBG_INFO,
++	MTK_WED_WO_CMD_DEV_INFO,
++	MTK_WED_WO_CMD_BSS_INFO,
++	MTK_WED_WO_CMD_STA_REC,
++	MTK_WED_WO_CMD_DEV_INFO_DUMP,
++	MTK_WED_WO_CMD_BSS_INFO_DUMP,
++	MTK_WED_WO_CMD_STA_REC_DUMP,
++	MTK_WED_WO_CMD_BA_INFO_DUMP,
++	MTK_WED_WO_CMD_FBCMD_Q_DUMP,
++	MTK_WED_WO_CMD_FW_LOG_CTRL,
++	MTK_WED_WO_CMD_LOG_FLUSH,
++	MTK_WED_WO_CMD_CHANGE_STATE,
++	MTK_WED_WO_CMD_CPU_STATS_ENABLE,
++	MTK_WED_WO_CMD_CPU_STATS_DUMP,
++	MTK_WED_WO_CMD_EXCEPTION_INIT,
++	MTK_WED_WO_CMD_PROF_CTRL,
++	MTK_WED_WO_CMD_STA_BA_DUMP,
++	MTK_WED_WO_CMD_BA_CTRL_DUMP,
++	MTK_WED_WO_CMD_RXCNT_CTRL,
++	MTK_WED_WO_CMD_RXCNT_INFO,
++	MTK_WED_WO_CMD_SET_CAP,
++	MTK_WED_WO_CMD_CCIF_RING_DUMP,
++	MTK_WED_WO_CMD_WED_END
++};
++
+ enum mtk_wed_bus_tye {
+ 	MTK_WED_BUS_PCIE,
+ 	MTK_WED_BUS_AXI,
diff --git a/target/linux/generic/backport-5.15/729-02-v6.1-net-ethernet-mtk_wed-introduce-wed-wo-support.patch b/target/linux/generic/backport-5.15/729-02-v6.1-net-ethernet-mtk_wed-introduce-wed-wo-support.patch
new file mode 100644
index 00000000000000..dbd7e30fbb8a0d
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-02-v6.1-net-ethernet-mtk_wed-introduce-wed-wo-support.patch
@@ -0,0 +1,737 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 5 Nov 2022 23:36:19 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: introduce wed wo support
+
+Introduce WO chip support to mtk wed driver. MTK WED WO is used to
+implement RX Wireless Ethernet Dispatch and offload traffic received by
+wlan nic to the wired interface.
+
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ create mode 100644 drivers/net/ethernet/mediatek/mtk_wed_wo.c
+
+--- a/drivers/net/ethernet/mediatek/Makefile
++++ b/drivers/net/ethernet/mediatek/Makefile
+@@ -5,7 +5,7 @@
+ 
+ obj-$(CONFIG_NET_MEDIATEK_SOC) += mtk_eth.o
+ mtk_eth-y := mtk_eth_soc.o mtk_sgmii.o mtk_eth_path.o mtk_ppe.o mtk_ppe_debugfs.o mtk_ppe_offload.o
+-mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed.o mtk_wed_mcu.o
++mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed.o mtk_wed_mcu.o mtk_wed_wo.o
+ ifdef CONFIG_DEBUG_FS
+ mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed_debugfs.o
+ endif
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -16,6 +16,7 @@
+ #include "mtk_wed_regs.h"
+ #include "mtk_wed.h"
+ #include "mtk_ppe.h"
++#include "mtk_wed_wo.h"
+ 
+ #define MTK_PCIE_BASE(n)		(0x1a143000 + (n) * 0x2000)
+ 
+@@ -355,6 +356,8 @@ mtk_wed_detach(struct mtk_wed_device *de
+ 
+ 	mtk_wed_free_buffer(dev);
+ 	mtk_wed_free_tx_rings(dev);
++	if (hw->version != 1)
++		mtk_wed_wo_deinit(hw);
+ 
+ 	if (dev->wlan.bus_type == MTK_WED_BUS_PCIE) {
+ 		struct device_node *wlan_node;
+@@ -885,9 +888,11 @@ mtk_wed_attach(struct mtk_wed_device *de
+ 	}
+ 
+ 	mtk_wed_hw_init_early(dev);
+-	if (hw->hifsys)
++	if (hw->version == 1)
+ 		regmap_update_bits(hw->hifsys, HIFSYS_DMA_AG_MAP,
+ 				   BIT(hw->index), 0);
++	else
++		ret = mtk_wed_wo_init(hw);
+ 
+ out:
+ 	mutex_unlock(&hw_lock);
+--- a/drivers/net/ethernet/mediatek/mtk_wed.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed.h
+@@ -10,6 +10,7 @@
+ #include <linux/netdevice.h>
+ 
+ struct mtk_eth;
++struct mtk_wed_wo;
+ 
+ struct mtk_wed_hw {
+ 	struct device_node *node;
+@@ -22,6 +23,7 @@ struct mtk_wed_hw {
+ 	struct regmap *mirror;
+ 	struct dentry *debugfs_dir;
+ 	struct mtk_wed_device *wed_dev;
++	struct mtk_wed_wo *wed_wo;
+ 	u32 debugfs_reg;
+ 	u32 num_flows;
+ 	u8 version;
+--- a/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
+@@ -122,8 +122,7 @@ mtk_wed_mcu_skb_send_msg(struct mtk_wed_
+ 	if (id == MTK_WED_MODULE_ID_WO)
+ 		hdr->flag |= cpu_to_le16(MTK_WED_WARP_CMD_FLAG_FROM_TO_WO);
+ 
+-	dev_kfree_skb(skb);
+-	return 0;
++	return mtk_wed_wo_queue_tx_skb(wo, &wo->q_tx, skb);
+ }
+ 
+ static int
+--- /dev/null
++++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.c
+@@ -0,0 +1,508 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/* Copyright (C) 2022 MediaTek Inc.
++ *
++ * Author: Lorenzo Bianconi <lorenzo@kernel.org>
++ *	   Sujuan Chen <sujuan.chen@mediatek.com>
++ */
++
++#include <linux/kernel.h>
++#include <linux/dma-mapping.h>
++#include <linux/of_platform.h>
++#include <linux/interrupt.h>
++#include <linux/of_address.h>
++#include <linux/mfd/syscon.h>
++#include <linux/of_irq.h>
++#include <linux/bitfield.h>
++
++#include "mtk_wed.h"
++#include "mtk_wed_regs.h"
++#include "mtk_wed_wo.h"
++
++static u32
++mtk_wed_mmio_r32(struct mtk_wed_wo *wo, u32 reg)
++{
++	u32 val;
++
++	if (regmap_read(wo->mmio.regs, reg, &val))
++		val = ~0;
++
++	return val;
++}
++
++static void
++mtk_wed_mmio_w32(struct mtk_wed_wo *wo, u32 reg, u32 val)
++{
++	regmap_write(wo->mmio.regs, reg, val);
++}
++
++static u32
++mtk_wed_wo_get_isr(struct mtk_wed_wo *wo)
++{
++	u32 val = mtk_wed_mmio_r32(wo, MTK_WED_WO_CCIF_RCHNUM);
++
++	return val & MTK_WED_WO_CCIF_RCHNUM_MASK;
++}
++
++static void
++mtk_wed_wo_set_isr(struct mtk_wed_wo *wo, u32 mask)
++{
++	mtk_wed_mmio_w32(wo, MTK_WED_WO_CCIF_IRQ0_MASK, mask);
++}
++
++static void
++mtk_wed_wo_set_ack(struct mtk_wed_wo *wo, u32 mask)
++{
++	mtk_wed_mmio_w32(wo, MTK_WED_WO_CCIF_ACK, mask);
++}
++
++static void
++mtk_wed_wo_set_isr_mask(struct mtk_wed_wo *wo, u32 mask, u32 val, bool set)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&wo->mmio.lock, flags);
++	wo->mmio.irq_mask &= ~mask;
++	wo->mmio.irq_mask |= val;
++	if (set)
++		mtk_wed_wo_set_isr(wo, wo->mmio.irq_mask);
++	spin_unlock_irqrestore(&wo->mmio.lock, flags);
++}
++
++static void
++mtk_wed_wo_irq_enable(struct mtk_wed_wo *wo, u32 mask)
++{
++	mtk_wed_wo_set_isr_mask(wo, 0, mask, false);
++	tasklet_schedule(&wo->mmio.irq_tasklet);
++}
++
++static void
++mtk_wed_wo_irq_disable(struct mtk_wed_wo *wo, u32 mask)
++{
++	mtk_wed_wo_set_isr_mask(wo, mask, 0, true);
++}
++
++static void
++mtk_wed_wo_kickout(struct mtk_wed_wo *wo)
++{
++	mtk_wed_mmio_w32(wo, MTK_WED_WO_CCIF_BUSY, 1 << MTK_WED_WO_TXCH_NUM);
++	mtk_wed_mmio_w32(wo, MTK_WED_WO_CCIF_TCHNUM, MTK_WED_WO_TXCH_NUM);
++}
++
++static void
++mtk_wed_wo_queue_kick(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q,
++		      u32 val)
++{
++	wmb();
++	mtk_wed_mmio_w32(wo, q->regs.cpu_idx, val);
++}
++
++static void *
++mtk_wed_wo_dequeue(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q, u32 *len,
++		   bool flush)
++{
++	int buf_len = SKB_WITH_OVERHEAD(q->buf_size);
++	int index = (q->tail + 1) % q->n_desc;
++	struct mtk_wed_wo_queue_entry *entry;
++	struct mtk_wed_wo_queue_desc *desc;
++	void *buf;
++
++	if (!q->queued)
++		return NULL;
++
++	if (flush)
++		q->desc[index].ctrl |= cpu_to_le32(MTK_WED_WO_CTL_DMA_DONE);
++	else if (!(q->desc[index].ctrl & cpu_to_le32(MTK_WED_WO_CTL_DMA_DONE)))
++		return NULL;
++
++	q->tail = index;
++	q->queued--;
++
++	desc = &q->desc[index];
++	entry = &q->entry[index];
++	buf = entry->buf;
++	if (len)
++		*len = FIELD_GET(MTK_WED_WO_CTL_SD_LEN0,
++				 le32_to_cpu(READ_ONCE(desc->ctrl)));
++	if (buf)
++		dma_unmap_single(wo->hw->dev, entry->addr, buf_len,
++				 DMA_FROM_DEVICE);
++	entry->buf = NULL;
++
++	return buf;
++}
++
++static int
++mtk_wed_wo_queue_refill(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q,
++			gfp_t gfp, bool rx)
++{
++	enum dma_data_direction dir = rx ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
++	int n_buf = 0;
++
++	spin_lock_bh(&q->lock);
++	while (q->queued < q->n_desc) {
++		void *buf = page_frag_alloc(&q->cache, q->buf_size, gfp);
++		struct mtk_wed_wo_queue_entry *entry;
++		dma_addr_t addr;
++
++		if (!buf)
++			break;
++
++		addr = dma_map_single(wo->hw->dev, buf, q->buf_size, dir);
++		if (unlikely(dma_mapping_error(wo->hw->dev, addr))) {
++			skb_free_frag(buf);
++			break;
++		}
++
++		q->head = (q->head + 1) % q->n_desc;
++		entry = &q->entry[q->head];
++		entry->addr = addr;
++		entry->len = q->buf_size;
++		q->entry[q->head].buf = buf;
++
++		if (rx) {
++			struct mtk_wed_wo_queue_desc *desc = &q->desc[q->head];
++			u32 ctrl = MTK_WED_WO_CTL_LAST_SEC0 |
++				   FIELD_PREP(MTK_WED_WO_CTL_SD_LEN0,
++					      entry->len);
++
++			WRITE_ONCE(desc->buf0, cpu_to_le32(addr));
++			WRITE_ONCE(desc->ctrl, cpu_to_le32(ctrl));
++		}
++		q->queued++;
++		n_buf++;
++	}
++	spin_unlock_bh(&q->lock);
++
++	return n_buf;
++}
++
++static void
++mtk_wed_wo_rx_complete(struct mtk_wed_wo *wo)
++{
++	mtk_wed_wo_set_ack(wo, MTK_WED_WO_RXCH_INT_MASK);
++	mtk_wed_wo_irq_enable(wo, MTK_WED_WO_RXCH_INT_MASK);
++}
++
++static void
++mtk_wed_wo_rx_run_queue(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q)
++{
++	for (;;) {
++		struct mtk_wed_mcu_hdr *hdr;
++		struct sk_buff *skb;
++		void *data;
++		u32 len;
++
++		data = mtk_wed_wo_dequeue(wo, q, &len, false);
++		if (!data)
++			break;
++
++		skb = build_skb(data, q->buf_size);
++		if (!skb) {
++			skb_free_frag(data);
++			continue;
++		}
++
++		__skb_put(skb, len);
++		if (mtk_wed_mcu_check_msg(wo, skb)) {
++			dev_kfree_skb(skb);
++			continue;
++		}
++
++		hdr = (struct mtk_wed_mcu_hdr *)skb->data;
++		if (hdr->flag & cpu_to_le16(MTK_WED_WARP_CMD_FLAG_RSP))
++			mtk_wed_mcu_rx_event(wo, skb);
++		else
++			mtk_wed_mcu_rx_unsolicited_event(wo, skb);
++	}
++
++	if (mtk_wed_wo_queue_refill(wo, q, GFP_ATOMIC, true)) {
++		u32 index = (q->head - 1) % q->n_desc;
++
++		mtk_wed_wo_queue_kick(wo, q, index);
++	}
++}
++
++static irqreturn_t
++mtk_wed_wo_irq_handler(int irq, void *data)
++{
++	struct mtk_wed_wo *wo = data;
++
++	mtk_wed_wo_set_isr(wo, 0);
++	tasklet_schedule(&wo->mmio.irq_tasklet);
++
++	return IRQ_HANDLED;
++}
++
++static void mtk_wed_wo_irq_tasklet(struct tasklet_struct *t)
++{
++	struct mtk_wed_wo *wo = from_tasklet(wo, t, mmio.irq_tasklet);
++	u32 intr, mask;
++
++	/* disable interrupts */
++	mtk_wed_wo_set_isr(wo, 0);
++
++	intr = mtk_wed_wo_get_isr(wo);
++	intr &= wo->mmio.irq_mask;
++	mask = intr & (MTK_WED_WO_RXCH_INT_MASK | MTK_WED_WO_EXCEPTION_INT_MASK);
++	mtk_wed_wo_irq_disable(wo, mask);
++
++	if (intr & MTK_WED_WO_RXCH_INT_MASK) {
++		mtk_wed_wo_rx_run_queue(wo, &wo->q_rx);
++		mtk_wed_wo_rx_complete(wo);
++	}
++}
++
++/* mtk wed wo hw queues */
++
++static int
++mtk_wed_wo_queue_alloc(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q,
++		       int n_desc, int buf_size, int index,
++		       struct mtk_wed_wo_queue_regs *regs)
++{
++	spin_lock_init(&q->lock);
++	q->regs = *regs;
++	q->n_desc = n_desc;
++	q->buf_size = buf_size;
++
++	q->desc = dmam_alloc_coherent(wo->hw->dev, n_desc * sizeof(*q->desc),
++				      &q->desc_dma, GFP_KERNEL);
++	if (!q->desc)
++		return -ENOMEM;
++
++	q->entry = devm_kzalloc(wo->hw->dev, n_desc * sizeof(*q->entry),
++				GFP_KERNEL);
++	if (!q->entry)
++		return -ENOMEM;
++
++	return 0;
++}
++
++static void
++mtk_wed_wo_queue_free(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q)
++{
++	mtk_wed_mmio_w32(wo, q->regs.cpu_idx, 0);
++	dma_free_coherent(wo->hw->dev, q->n_desc * sizeof(*q->desc), q->desc,
++			  q->desc_dma);
++}
++
++static void
++mtk_wed_wo_queue_tx_clean(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q)
++{
++	struct page *page;
++	int i;
++
++	spin_lock_bh(&q->lock);
++	for (i = 0; i < q->n_desc; i++) {
++		struct mtk_wed_wo_queue_entry *entry = &q->entry[i];
++
++		dma_unmap_single(wo->hw->dev, entry->addr, entry->len,
++				 DMA_TO_DEVICE);
++		skb_free_frag(entry->buf);
++		entry->buf = NULL;
++	}
++	spin_unlock_bh(&q->lock);
++
++	if (!q->cache.va)
++		return;
++
++	page = virt_to_page(q->cache.va);
++	__page_frag_cache_drain(page, q->cache.pagecnt_bias);
++	memset(&q->cache, 0, sizeof(q->cache));
++}
++
++static void
++mtk_wed_wo_queue_rx_clean(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q)
++{
++	struct page *page;
++
++	spin_lock_bh(&q->lock);
++	for (;;) {
++		void *buf = mtk_wed_wo_dequeue(wo, q, NULL, true);
++
++		if (!buf)
++			break;
++
++		skb_free_frag(buf);
++	}
++	spin_unlock_bh(&q->lock);
++
++	if (!q->cache.va)
++		return;
++
++	page = virt_to_page(q->cache.va);
++	__page_frag_cache_drain(page, q->cache.pagecnt_bias);
++	memset(&q->cache, 0, sizeof(q->cache));
++}
++
++static void
++mtk_wed_wo_queue_reset(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q)
++{
++	mtk_wed_mmio_w32(wo, q->regs.cpu_idx, 0);
++	mtk_wed_mmio_w32(wo, q->regs.desc_base, q->desc_dma);
++	mtk_wed_mmio_w32(wo, q->regs.ring_size, q->n_desc);
++}
++
++int mtk_wed_wo_queue_tx_skb(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q,
++			    struct sk_buff *skb)
++{
++	struct mtk_wed_wo_queue_entry *entry;
++	struct mtk_wed_wo_queue_desc *desc;
++	int ret = 0, index;
++	u32 ctrl;
++
++	spin_lock_bh(&q->lock);
++
++	q->tail = mtk_wed_mmio_r32(wo, q->regs.dma_idx);
++	index = (q->head + 1) % q->n_desc;
++	if (q->tail == index) {
++		ret = -ENOMEM;
++		goto out;
++	}
++
++	entry = &q->entry[index];
++	if (skb->len > entry->len) {
++		ret = -ENOMEM;
++		goto out;
++	}
++
++	desc = &q->desc[index];
++	q->head = index;
++
++	dma_sync_single_for_cpu(wo->hw->dev, entry->addr, skb->len,
++				DMA_TO_DEVICE);
++	memcpy(entry->buf, skb->data, skb->len);
++	dma_sync_single_for_device(wo->hw->dev, entry->addr, skb->len,
++				   DMA_TO_DEVICE);
++
++	ctrl = FIELD_PREP(MTK_WED_WO_CTL_SD_LEN0, skb->len) |
++	       MTK_WED_WO_CTL_LAST_SEC0 | MTK_WED_WO_CTL_DMA_DONE;
++	WRITE_ONCE(desc->buf0, cpu_to_le32(entry->addr));
++	WRITE_ONCE(desc->ctrl, cpu_to_le32(ctrl));
++
++	mtk_wed_wo_queue_kick(wo, q, q->head);
++	mtk_wed_wo_kickout(wo);
++out:
++	spin_unlock_bh(&q->lock);
++
++	dev_kfree_skb(skb);
++
++	return ret;
++}
++
++static int
++mtk_wed_wo_exception_init(struct mtk_wed_wo *wo)
++{
++	return 0;
++}
++
++static int
++mtk_wed_wo_hardware_init(struct mtk_wed_wo *wo)
++{
++	struct mtk_wed_wo_queue_regs regs;
++	struct device_node *np;
++	int ret;
++
++	np = of_parse_phandle(wo->hw->node, "mediatek,wo-ccif", 0);
++	if (!np)
++		return -ENODEV;
++
++	wo->mmio.regs = syscon_regmap_lookup_by_phandle(np, NULL);
++	if (IS_ERR_OR_NULL(wo->mmio.regs))
++		return PTR_ERR(wo->mmio.regs);
++
++	wo->mmio.irq = irq_of_parse_and_map(np, 0);
++	wo->mmio.irq_mask = MTK_WED_WO_ALL_INT_MASK;
++	spin_lock_init(&wo->mmio.lock);
++	tasklet_setup(&wo->mmio.irq_tasklet, mtk_wed_wo_irq_tasklet);
++
++	ret = devm_request_irq(wo->hw->dev, wo->mmio.irq,
++			       mtk_wed_wo_irq_handler, IRQF_TRIGGER_HIGH,
++			       KBUILD_MODNAME, wo);
++	if (ret)
++		goto error;
++
++	regs.desc_base = MTK_WED_WO_CCIF_DUMMY1;
++	regs.ring_size = MTK_WED_WO_CCIF_DUMMY2;
++	regs.dma_idx = MTK_WED_WO_CCIF_SHADOW4;
++	regs.cpu_idx = MTK_WED_WO_CCIF_DUMMY3;
++
++	ret = mtk_wed_wo_queue_alloc(wo, &wo->q_tx, MTK_WED_WO_RING_SIZE,
++				     MTK_WED_WO_CMD_LEN, MTK_WED_WO_TXCH_NUM,
++				     &regs);
++	if (ret)
++		goto error;
++
++	mtk_wed_wo_queue_refill(wo, &wo->q_tx, GFP_KERNEL, false);
++	mtk_wed_wo_queue_reset(wo, &wo->q_tx);
++
++	regs.desc_base = MTK_WED_WO_CCIF_DUMMY5;
++	regs.ring_size = MTK_WED_WO_CCIF_DUMMY6;
++	regs.dma_idx = MTK_WED_WO_CCIF_SHADOW8;
++	regs.cpu_idx = MTK_WED_WO_CCIF_DUMMY7;
++
++	ret = mtk_wed_wo_queue_alloc(wo, &wo->q_rx, MTK_WED_WO_RING_SIZE,
++				     MTK_WED_WO_CMD_LEN, MTK_WED_WO_RXCH_NUM,
++				     &regs);
++	if (ret)
++		goto error;
++
++	mtk_wed_wo_queue_refill(wo, &wo->q_rx, GFP_KERNEL, true);
++	mtk_wed_wo_queue_reset(wo, &wo->q_rx);
++
++	/* rx queue irqmask */
++	mtk_wed_wo_set_isr(wo, wo->mmio.irq_mask);
++
++	return 0;
++
++error:
++	devm_free_irq(wo->hw->dev, wo->mmio.irq, wo);
++
++	return ret;
++}
++
++static void
++mtk_wed_wo_hw_deinit(struct mtk_wed_wo *wo)
++{
++	/* disable interrupts */
++	mtk_wed_wo_set_isr(wo, 0);
++
++	tasklet_disable(&wo->mmio.irq_tasklet);
++
++	disable_irq(wo->mmio.irq);
++	devm_free_irq(wo->hw->dev, wo->mmio.irq, wo);
++
++	mtk_wed_wo_queue_tx_clean(wo, &wo->q_tx);
++	mtk_wed_wo_queue_rx_clean(wo, &wo->q_rx);
++	mtk_wed_wo_queue_free(wo, &wo->q_tx);
++	mtk_wed_wo_queue_free(wo, &wo->q_rx);
++}
++
++int mtk_wed_wo_init(struct mtk_wed_hw *hw)
++{
++	struct mtk_wed_wo *wo;
++	int ret;
++
++	wo = devm_kzalloc(hw->dev, sizeof(*wo), GFP_KERNEL);
++	if (!wo)
++		return -ENOMEM;
++
++	hw->wed_wo = wo;
++	wo->hw = hw;
++
++	ret = mtk_wed_wo_hardware_init(wo);
++	if (ret)
++		return ret;
++
++	ret = mtk_wed_mcu_init(wo);
++	if (ret)
++		return ret;
++
++	return mtk_wed_wo_exception_init(wo);
++}
++
++void mtk_wed_wo_deinit(struct mtk_wed_hw *hw)
++{
++	struct mtk_wed_wo *wo = hw->wed_wo;
++
++	mtk_wed_wo_hw_deinit(wo);
++}
+--- a/drivers/net/ethernet/mediatek/mtk_wed_wo.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.h
+@@ -80,6 +80,54 @@ enum mtk_wed_dummy_cr_idx {
+ #define MTK_WO_MCU_CFG_LS_WF_WM_WA_WM_CPU_RSTB_MASK	BIT(5)
+ #define MTK_WO_MCU_CFG_LS_WF_WM_WA_WA_CPU_RSTB_MASK	BIT(0)
+ 
++#define MTK_WED_WO_RING_SIZE	256
++#define MTK_WED_WO_CMD_LEN	1504
++
++#define MTK_WED_WO_TXCH_NUM		0
++#define MTK_WED_WO_RXCH_NUM		1
++#define MTK_WED_WO_RXCH_WO_EXCEPTION	7
++
++#define MTK_WED_WO_TXCH_INT_MASK	BIT(0)
++#define MTK_WED_WO_RXCH_INT_MASK	BIT(1)
++#define MTK_WED_WO_EXCEPTION_INT_MASK	BIT(7)
++#define MTK_WED_WO_ALL_INT_MASK		(MTK_WED_WO_RXCH_INT_MASK | \
++					 MTK_WED_WO_EXCEPTION_INT_MASK)
++
++#define MTK_WED_WO_CCIF_BUSY		0x004
++#define MTK_WED_WO_CCIF_START		0x008
++#define MTK_WED_WO_CCIF_TCHNUM		0x00c
++#define MTK_WED_WO_CCIF_RCHNUM		0x010
++#define MTK_WED_WO_CCIF_RCHNUM_MASK	GENMASK(7, 0)
++
++#define MTK_WED_WO_CCIF_ACK		0x014
++#define MTK_WED_WO_CCIF_IRQ0_MASK	0x018
++#define MTK_WED_WO_CCIF_IRQ1_MASK	0x01c
++#define MTK_WED_WO_CCIF_DUMMY1		0x020
++#define MTK_WED_WO_CCIF_DUMMY2		0x024
++#define MTK_WED_WO_CCIF_DUMMY3		0x028
++#define MTK_WED_WO_CCIF_DUMMY4		0x02c
++#define MTK_WED_WO_CCIF_SHADOW1		0x030
++#define MTK_WED_WO_CCIF_SHADOW2		0x034
++#define MTK_WED_WO_CCIF_SHADOW3		0x038
++#define MTK_WED_WO_CCIF_SHADOW4		0x03c
++#define MTK_WED_WO_CCIF_DUMMY5		0x050
++#define MTK_WED_WO_CCIF_DUMMY6		0x054
++#define MTK_WED_WO_CCIF_DUMMY7		0x058
++#define MTK_WED_WO_CCIF_DUMMY8		0x05c
++#define MTK_WED_WO_CCIF_SHADOW5		0x060
++#define MTK_WED_WO_CCIF_SHADOW6		0x064
++#define MTK_WED_WO_CCIF_SHADOW7		0x068
++#define MTK_WED_WO_CCIF_SHADOW8		0x06c
++
++#define MTK_WED_WO_CTL_SD_LEN1		GENMASK(13, 0)
++#define MTK_WED_WO_CTL_LAST_SEC1	BIT(14)
++#define MTK_WED_WO_CTL_BURST		BIT(15)
++#define MTK_WED_WO_CTL_SD_LEN0_SHIFT	16
++#define MTK_WED_WO_CTL_SD_LEN0		GENMASK(29, 16)
++#define MTK_WED_WO_CTL_LAST_SEC0	BIT(30)
++#define MTK_WED_WO_CTL_DMA_DONE		BIT(31)
++#define MTK_WED_WO_INFO_WINFO		GENMASK(15, 0)
++
+ struct mtk_wed_wo_memory_region {
+ 	const char *name;
+ 	void __iomem *addr;
+@@ -112,10 +160,53 @@ struct mtk_wed_fw_trailer {
+ 	u32 crc;
+ };
+ 
++struct mtk_wed_wo_queue_regs {
++	u32 desc_base;
++	u32 ring_size;
++	u32 cpu_idx;
++	u32 dma_idx;
++};
++
++struct mtk_wed_wo_queue_desc {
++	__le32 buf0;
++	__le32 ctrl;
++	__le32 buf1;
++	__le32 info;
++	__le32 reserved[4];
++} __packed __aligned(32);
++
++struct mtk_wed_wo_queue_entry {
++	dma_addr_t addr;
++	void *buf;
++	u32 len;
++};
++
++struct mtk_wed_wo_queue {
++	struct mtk_wed_wo_queue_regs regs;
++
++	struct page_frag_cache cache;
++	spinlock_t lock;
++
++	struct mtk_wed_wo_queue_desc *desc;
++	dma_addr_t desc_dma;
++
++	struct mtk_wed_wo_queue_entry *entry;
++
++	u16 head;
++	u16 tail;
++	int n_desc;
++	int queued;
++	int buf_size;
++
++};
++
+ struct mtk_wed_wo {
+ 	struct mtk_wed_hw *hw;
+ 	struct mtk_wed_wo_memory_region boot;
+ 
++	struct mtk_wed_wo_queue q_tx;
++	struct mtk_wed_wo_queue q_rx;
++
+ 	struct {
+ 		struct mutex mutex;
+ 		int timeout;
+@@ -124,6 +215,15 @@ struct mtk_wed_wo {
+ 		struct sk_buff_head res_q;
+ 		wait_queue_head_t wait;
+ 	} mcu;
++
++	struct {
++		struct regmap *regs;
++
++		spinlock_t lock;
++		struct tasklet_struct irq_tasklet;
++		int irq;
++		u32 irq_mask;
++	} mmio;
+ };
+ 
+ static inline int
+@@ -146,5 +246,9 @@ void mtk_wed_mcu_rx_unsolicited_event(st
+ int mtk_wed_mcu_send_msg(struct mtk_wed_wo *wo, int id, int cmd,
+ 			 const void *data, int len, bool wait_resp);
+ int mtk_wed_mcu_init(struct mtk_wed_wo *wo);
++int mtk_wed_wo_init(struct mtk_wed_hw *hw);
++void mtk_wed_wo_deinit(struct mtk_wed_hw *hw);
++int mtk_wed_wo_queue_tx_skb(struct mtk_wed_wo *dev, struct mtk_wed_wo_queue *q,
++			    struct sk_buff *skb);
+ 
+ #endif /* __MTK_WED_WO_H */
diff --git a/target/linux/generic/backport-5.15/729-03-v6.1-net-ethernet-mtk_wed-rename-tx_wdma-array-in-rx_wdma.patch b/target/linux/generic/backport-5.15/729-03-v6.1-net-ethernet-mtk_wed-rename-tx_wdma-array-in-rx_wdma.patch
new file mode 100644
index 00000000000000..ffd6bc3589d97b
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-03-v6.1-net-ethernet-mtk_wed-rename-tx_wdma-array-in-rx_wdma.patch
@@ -0,0 +1,79 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 5 Nov 2022 23:36:20 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: rename tx_wdma array in rx_wdma
+
+Rename tx_wdma queue array in rx_wdma since this is rx side of wdma soc.
+Moreover rename mtk_wed_wdma_ring_setup routine in
+mtk_wed_wdma_rx_ring_setup()
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -253,8 +253,8 @@ mtk_wed_free_tx_rings(struct mtk_wed_dev
+ 
+ 	for (i = 0; i < ARRAY_SIZE(dev->tx_ring); i++)
+ 		mtk_wed_free_ring(dev, &dev->tx_ring[i]);
+-	for (i = 0; i < ARRAY_SIZE(dev->tx_wdma); i++)
+-		mtk_wed_free_ring(dev, &dev->tx_wdma[i]);
++	for (i = 0; i < ARRAY_SIZE(dev->rx_wdma); i++)
++		mtk_wed_free_ring(dev, &dev->rx_wdma[i]);
+ }
+ 
+ static void
+@@ -695,10 +695,10 @@ mtk_wed_ring_alloc(struct mtk_wed_device
+ }
+ 
+ static int
+-mtk_wed_wdma_ring_setup(struct mtk_wed_device *dev, int idx, int size)
++mtk_wed_wdma_rx_ring_setup(struct mtk_wed_device *dev, int idx, int size)
+ {
+ 	u32 desc_size = sizeof(struct mtk_wdma_desc) * dev->hw->version;
+-	struct mtk_wed_ring *wdma = &dev->tx_wdma[idx];
++	struct mtk_wed_ring *wdma = &dev->rx_wdma[idx];
+ 
+ 	if (mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE, desc_size))
+ 		return -ENOMEM;
+@@ -812,9 +812,9 @@ mtk_wed_start(struct mtk_wed_device *dev
+ {
+ 	int i;
+ 
+-	for (i = 0; i < ARRAY_SIZE(dev->tx_wdma); i++)
+-		if (!dev->tx_wdma[i].desc)
+-			mtk_wed_wdma_ring_setup(dev, i, 16);
++	for (i = 0; i < ARRAY_SIZE(dev->rx_wdma); i++)
++		if (!dev->rx_wdma[i].desc)
++			mtk_wed_wdma_rx_ring_setup(dev, i, 16);
+ 
+ 	mtk_wed_hw_init(dev);
+ 	mtk_wed_configure_irq(dev, irq_mask);
+@@ -923,7 +923,7 @@ mtk_wed_tx_ring_setup(struct mtk_wed_dev
+ 			       sizeof(*ring->desc)))
+ 		return -ENOMEM;
+ 
+-	if (mtk_wed_wdma_ring_setup(dev, idx, MTK_WED_WDMA_RING_SIZE))
++	if (mtk_wed_wdma_rx_ring_setup(dev, idx, MTK_WED_WDMA_RING_SIZE))
+ 		return -ENOMEM;
+ 
+ 	ring->reg_base = MTK_WED_RING_TX(idx);
+--- a/include/linux/soc/mediatek/mtk_wed.h
++++ b/include/linux/soc/mediatek/mtk_wed.h
+@@ -7,6 +7,7 @@
+ #include <linux/pci.h>
+ 
+ #define MTK_WED_TX_QUEUES		2
++#define MTK_WED_RX_QUEUES		2
+ 
+ struct mtk_wed_hw;
+ struct mtk_wdma_desc;
+@@ -66,7 +67,7 @@ struct mtk_wed_device {
+ 
+ 	struct mtk_wed_ring tx_ring[MTK_WED_TX_QUEUES];
+ 	struct mtk_wed_ring txfree_ring;
+-	struct mtk_wed_ring tx_wdma[MTK_WED_TX_QUEUES];
++	struct mtk_wed_ring rx_wdma[MTK_WED_RX_QUEUES];
+ 
+ 	struct {
+ 		int size;
diff --git a/target/linux/generic/backport-5.15/729-04-v6.1-net-ethernet-mtk_wed-add-configure-wed-wo-support.patch b/target/linux/generic/backport-5.15/729-04-v6.1-net-ethernet-mtk_wed-add-configure-wed-wo-support.patch
new file mode 100644
index 00000000000000..4c34d0cb33b490
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-04-v6.1-net-ethernet-mtk_wed-add-configure-wed-wo-support.patch
@@ -0,0 +1,1521 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 5 Nov 2022 23:36:21 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: add configure wed wo support
+
+Enable RX Wireless Ethernet Dispatch available on MT7986 Soc.
+
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -9,6 +9,7 @@
+ #include <linux/skbuff.h>
+ #include <linux/of_platform.h>
+ #include <linux/of_address.h>
++#include <linux/of_reserved_mem.h>
+ #include <linux/mfd/syscon.h>
+ #include <linux/debugfs.h>
+ #include <linux/soc/mediatek/mtk_wed.h>
+@@ -23,6 +24,7 @@
+ #define MTK_WED_PKT_SIZE		1900
+ #define MTK_WED_BUF_SIZE		2048
+ #define MTK_WED_BUF_PER_PAGE		(PAGE_SIZE / 2048)
++#define MTK_WED_RX_RING_SIZE		1536
+ 
+ #define MTK_WED_TX_RING_SIZE		2048
+ #define MTK_WED_WDMA_RING_SIZE		1024
+@@ -31,6 +33,10 @@
+ #define MTK_WED_PER_GROUP_PKT		128
+ 
+ #define MTK_WED_FBUF_SIZE		128
++#define MTK_WED_MIOD_CNT		16
++#define MTK_WED_FB_CMD_CNT		1024
++#define MTK_WED_RRO_QUE_CNT		8192
++#define MTK_WED_MIOD_ENTRY_CNT		128
+ 
+ static struct mtk_wed_hw *hw_list[2];
+ static DEFINE_MUTEX(hw_lock);
+@@ -65,12 +71,76 @@ wdma_set(struct mtk_wed_device *dev, u32
+ 	wdma_m32(dev, reg, 0, mask);
+ }
+ 
++static void
++wdma_clr(struct mtk_wed_device *dev, u32 reg, u32 mask)
++{
++	wdma_m32(dev, reg, mask, 0);
++}
++
++static u32
++wifi_r32(struct mtk_wed_device *dev, u32 reg)
++{
++	return readl(dev->wlan.base + reg);
++}
++
++static void
++wifi_w32(struct mtk_wed_device *dev, u32 reg, u32 val)
++{
++	writel(val, dev->wlan.base + reg);
++}
++
+ static u32
+ mtk_wed_read_reset(struct mtk_wed_device *dev)
+ {
+ 	return wed_r32(dev, MTK_WED_RESET);
+ }
+ 
++static u32
++mtk_wdma_read_reset(struct mtk_wed_device *dev)
++{
++	return wdma_r32(dev, MTK_WDMA_GLO_CFG);
++}
++
++static void
++mtk_wdma_rx_reset(struct mtk_wed_device *dev)
++{
++	u32 status, mask = MTK_WDMA_GLO_CFG_RX_DMA_BUSY;
++	int i;
++
++	wdma_clr(dev, MTK_WDMA_GLO_CFG, MTK_WDMA_GLO_CFG_RX_DMA_EN);
++	if (readx_poll_timeout(mtk_wdma_read_reset, dev, status,
++			       !(status & mask), 0, 1000))
++		dev_err(dev->hw->dev, "rx reset failed\n");
++
++	for (i = 0; i < ARRAY_SIZE(dev->rx_wdma); i++) {
++		if (dev->rx_wdma[i].desc)
++			continue;
++
++		wdma_w32(dev,
++			 MTK_WDMA_RING_RX(i) + MTK_WED_RING_OFS_CPU_IDX, 0);
++	}
++}
++
++static void
++mtk_wdma_tx_reset(struct mtk_wed_device *dev)
++{
++	u32 status, mask = MTK_WDMA_GLO_CFG_TX_DMA_BUSY;
++	int i;
++
++	wdma_clr(dev, MTK_WDMA_GLO_CFG, MTK_WDMA_GLO_CFG_TX_DMA_EN);
++	if (readx_poll_timeout(mtk_wdma_read_reset, dev, status,
++			       !(status & mask), 0, 1000))
++		dev_err(dev->hw->dev, "tx reset failed\n");
++
++	for (i = 0; i < ARRAY_SIZE(dev->tx_wdma); i++) {
++		if (dev->tx_wdma[i].desc)
++			continue;
++
++		wdma_w32(dev,
++			 MTK_WDMA_RING_TX(i) + MTK_WED_RING_OFS_CPU_IDX, 0);
++	}
++}
++
+ static void
+ mtk_wed_reset(struct mtk_wed_device *dev, u32 mask)
+ {
+@@ -82,6 +152,54 @@ mtk_wed_reset(struct mtk_wed_device *dev
+ 		WARN_ON_ONCE(1);
+ }
+ 
++static u32
++mtk_wed_wo_read_status(struct mtk_wed_device *dev)
++{
++	return wed_r32(dev, MTK_WED_SCR0 + 4 * MTK_WED_DUMMY_CR_WO_STATUS);
++}
++
++static void
++mtk_wed_wo_reset(struct mtk_wed_device *dev)
++{
++	struct mtk_wed_wo *wo = dev->hw->wed_wo;
++	u8 state = MTK_WED_WO_STATE_DISABLE;
++	void __iomem *reg;
++	u32 val;
++
++	mtk_wdma_tx_reset(dev);
++	mtk_wed_reset(dev, MTK_WED_RESET_WED);
++
++	mtk_wed_mcu_send_msg(wo, MTK_WED_MODULE_ID_WO,
++			     MTK_WED_WO_CMD_CHANGE_STATE, &state,
++			     sizeof(state), false);
++
++	if (readx_poll_timeout(mtk_wed_wo_read_status, dev, val,
++			       val == MTK_WED_WOIF_DISABLE_DONE,
++			       100, MTK_WOCPU_TIMEOUT))
++		dev_err(dev->hw->dev, "failed to disable wed-wo\n");
++
++	reg = ioremap(MTK_WED_WO_CPU_MCUSYS_RESET_ADDR, 4);
++
++	val = readl(reg);
++	switch (dev->hw->index) {
++	case 0:
++		val |= MTK_WED_WO_CPU_WO0_MCUSYS_RESET_MASK;
++		writel(val, reg);
++		val &= ~MTK_WED_WO_CPU_WO0_MCUSYS_RESET_MASK;
++		writel(val, reg);
++		break;
++	case 1:
++		val |= MTK_WED_WO_CPU_WO1_MCUSYS_RESET_MASK;
++		writel(val, reg);
++		val &= ~MTK_WED_WO_CPU_WO1_MCUSYS_RESET_MASK;
++		writel(val, reg);
++		break;
++	default:
++		break;
++	}
++	iounmap(reg);
++}
++
+ static struct mtk_wed_hw *
+ mtk_wed_assign(struct mtk_wed_device *dev)
+ {
+@@ -116,7 +234,7 @@ out:
+ }
+ 
+ static int
+-mtk_wed_buffer_alloc(struct mtk_wed_device *dev)
++mtk_wed_tx_buffer_alloc(struct mtk_wed_device *dev)
+ {
+ 	struct mtk_wdma_desc *desc;
+ 	dma_addr_t desc_phys;
+@@ -133,16 +251,16 @@ mtk_wed_buffer_alloc(struct mtk_wed_devi
+ 	if (!page_list)
+ 		return -ENOMEM;
+ 
+-	dev->buf_ring.size = ring_size;
+-	dev->buf_ring.pages = page_list;
++	dev->tx_buf_ring.size = ring_size;
++	dev->tx_buf_ring.pages = page_list;
+ 
+ 	desc = dma_alloc_coherent(dev->hw->dev, ring_size * sizeof(*desc),
+ 				  &desc_phys, GFP_KERNEL);
+ 	if (!desc)
+ 		return -ENOMEM;
+ 
+-	dev->buf_ring.desc = desc;
+-	dev->buf_ring.desc_phys = desc_phys;
++	dev->tx_buf_ring.desc = desc;
++	dev->tx_buf_ring.desc_phys = desc_phys;
+ 
+ 	for (i = 0, page_idx = 0; i < ring_size; i += MTK_WED_BUF_PER_PAGE) {
+ 		dma_addr_t page_phys, buf_phys;
+@@ -203,10 +321,10 @@ mtk_wed_buffer_alloc(struct mtk_wed_devi
+ }
+ 
+ static void
+-mtk_wed_free_buffer(struct mtk_wed_device *dev)
++mtk_wed_free_tx_buffer(struct mtk_wed_device *dev)
+ {
+-	struct mtk_wdma_desc *desc = dev->buf_ring.desc;
+-	void **page_list = dev->buf_ring.pages;
++	struct mtk_wdma_desc *desc = dev->tx_buf_ring.desc;
++	void **page_list = dev->tx_buf_ring.pages;
+ 	int page_idx;
+ 	int i;
+ 
+@@ -216,7 +334,8 @@ mtk_wed_free_buffer(struct mtk_wed_devic
+ 	if (!desc)
+ 		goto free_pagelist;
+ 
+-	for (i = 0, page_idx = 0; i < dev->buf_ring.size; i += MTK_WED_BUF_PER_PAGE) {
++	for (i = 0, page_idx = 0; i < dev->tx_buf_ring.size;
++	     i += MTK_WED_BUF_PER_PAGE) {
+ 		void *page = page_list[page_idx++];
+ 		dma_addr_t buf_addr;
+ 
+@@ -229,13 +348,59 @@ mtk_wed_free_buffer(struct mtk_wed_devic
+ 		__free_page(page);
+ 	}
+ 
+-	dma_free_coherent(dev->hw->dev, dev->buf_ring.size * sizeof(*desc),
+-			  desc, dev->buf_ring.desc_phys);
++	dma_free_coherent(dev->hw->dev, dev->tx_buf_ring.size * sizeof(*desc),
++			  desc, dev->tx_buf_ring.desc_phys);
+ 
+ free_pagelist:
+ 	kfree(page_list);
+ }
+ 
++static int
++mtk_wed_rx_buffer_alloc(struct mtk_wed_device *dev)
++{
++	struct mtk_rxbm_desc *desc;
++	dma_addr_t desc_phys;
++
++	dev->rx_buf_ring.size = dev->wlan.rx_nbuf;
++	desc = dma_alloc_coherent(dev->hw->dev,
++				  dev->wlan.rx_nbuf * sizeof(*desc),
++				  &desc_phys, GFP_KERNEL);
++	if (!desc)
++		return -ENOMEM;
++
++	dev->rx_buf_ring.desc = desc;
++	dev->rx_buf_ring.desc_phys = desc_phys;
++	dev->wlan.init_rx_buf(dev, dev->wlan.rx_npkt);
++
++	return 0;
++}
++
++static void
++mtk_wed_free_rx_buffer(struct mtk_wed_device *dev)
++{
++	struct mtk_rxbm_desc *desc = dev->rx_buf_ring.desc;
++
++	if (!desc)
++		return;
++
++	dev->wlan.release_rx_buf(dev);
++	dma_free_coherent(dev->hw->dev, dev->rx_buf_ring.size * sizeof(*desc),
++			  desc, dev->rx_buf_ring.desc_phys);
++}
++
++static void
++mtk_wed_rx_buffer_hw_init(struct mtk_wed_device *dev)
++{
++	wed_w32(dev, MTK_WED_RX_BM_RX_DMAD,
++		FIELD_PREP(MTK_WED_RX_BM_RX_DMAD_SDL0, dev->wlan.rx_size));
++	wed_w32(dev, MTK_WED_RX_BM_BASE, dev->rx_buf_ring.desc_phys);
++	wed_w32(dev, MTK_WED_RX_BM_INIT_PTR, MTK_WED_RX_BM_INIT_SW_TAIL |
++		FIELD_PREP(MTK_WED_RX_BM_SW_TAIL, dev->wlan.rx_npkt));
++	wed_w32(dev, MTK_WED_RX_BM_DYN_ALLOC_TH,
++		FIELD_PREP(MTK_WED_RX_BM_DYN_ALLOC_TH_H, 0xffff));
++	wed_set(dev, MTK_WED_CTRL, MTK_WED_CTRL_WED_RX_BM_EN);
++}
++
+ static void
+ mtk_wed_free_ring(struct mtk_wed_device *dev, struct mtk_wed_ring *ring)
+ {
+@@ -247,6 +412,13 @@ mtk_wed_free_ring(struct mtk_wed_device
+ }
+ 
+ static void
++mtk_wed_free_rx_rings(struct mtk_wed_device *dev)
++{
++	mtk_wed_free_rx_buffer(dev);
++	mtk_wed_free_ring(dev, &dev->rro.ring);
++}
++
++static void
+ mtk_wed_free_tx_rings(struct mtk_wed_device *dev)
+ {
+ 	int i;
+@@ -291,6 +463,38 @@ mtk_wed_set_512_support(struct mtk_wed_d
+ 	}
+ }
+ 
++#define MTK_WFMDA_RX_DMA_EN	BIT(2)
++static void
++mtk_wed_check_wfdma_rx_fill(struct mtk_wed_device *dev, int idx)
++{
++	u32 val;
++	int i;
++
++	if (!(dev->rx_ring[idx].flags & MTK_WED_RING_CONFIGURED))
++		return; /* queue is not configured by mt76 */
++
++	for (i = 0; i < 3; i++) {
++		u32 cur_idx;
++
++		cur_idx = wed_r32(dev,
++				  MTK_WED_WPDMA_RING_RX_DATA(idx) +
++				  MTK_WED_RING_OFS_CPU_IDX);
++		if (cur_idx == MTK_WED_RX_RING_SIZE - 1)
++			break;
++
++		usleep_range(100000, 200000);
++	}
++
++	if (i == 3) {
++		dev_err(dev->hw->dev, "rx dma enable failed\n");
++		return;
++	}
++
++	val = wifi_r32(dev, dev->wlan.wpdma_rx_glo - dev->wlan.phy_base) |
++	      MTK_WFMDA_RX_DMA_EN;
++	wifi_w32(dev, dev->wlan.wpdma_rx_glo - dev->wlan.phy_base, val);
++}
++
+ static void
+ mtk_wed_dma_disable(struct mtk_wed_device *dev)
+ {
+@@ -304,20 +508,25 @@ mtk_wed_dma_disable(struct mtk_wed_devic
+ 		MTK_WED_GLO_CFG_TX_DMA_EN |
+ 		MTK_WED_GLO_CFG_RX_DMA_EN);
+ 
+-	wdma_m32(dev, MTK_WDMA_GLO_CFG,
++	wdma_clr(dev, MTK_WDMA_GLO_CFG,
+ 		 MTK_WDMA_GLO_CFG_TX_DMA_EN |
+ 		 MTK_WDMA_GLO_CFG_RX_INFO1_PRERES |
+-		 MTK_WDMA_GLO_CFG_RX_INFO2_PRERES, 0);
++		 MTK_WDMA_GLO_CFG_RX_INFO2_PRERES);
+ 
+ 	if (dev->hw->version == 1) {
+ 		regmap_write(dev->hw->mirror, dev->hw->index * 4, 0);
+-		wdma_m32(dev, MTK_WDMA_GLO_CFG,
+-			 MTK_WDMA_GLO_CFG_RX_INFO3_PRERES, 0);
++		wdma_clr(dev, MTK_WDMA_GLO_CFG,
++			 MTK_WDMA_GLO_CFG_RX_INFO3_PRERES);
+ 	} else {
+ 		wed_clr(dev, MTK_WED_WPDMA_GLO_CFG,
+ 			MTK_WED_WPDMA_GLO_CFG_RX_DRV_R0_PKT_PROC |
+ 			MTK_WED_WPDMA_GLO_CFG_RX_DRV_R0_CRX_SYNC);
+ 
++		wed_clr(dev, MTK_WED_WPDMA_RX_D_GLO_CFG,
++			MTK_WED_WPDMA_RX_D_RX_DRV_EN);
++		wed_clr(dev, MTK_WED_WDMA_GLO_CFG,
++			MTK_WED_WDMA_GLO_CFG_TX_DDONE_CHK);
++
+ 		mtk_wed_set_512_support(dev, false);
+ 	}
+ }
+@@ -338,6 +547,13 @@ mtk_wed_stop(struct mtk_wed_device *dev)
+ 	wdma_w32(dev, MTK_WDMA_INT_MASK, 0);
+ 	wdma_w32(dev, MTK_WDMA_INT_GRP2, 0);
+ 	wed_w32(dev, MTK_WED_WPDMA_INT_MASK, 0);
++
++	if (dev->hw->version == 1)
++		return;
++
++	wed_w32(dev, MTK_WED_EXT_INT_MASK1, 0);
++	wed_w32(dev, MTK_WED_EXT_INT_MASK2, 0);
++	wed_clr(dev, MTK_WED_CTRL, MTK_WED_CTRL_WED_RX_BM_EN);
+ }
+ 
+ static void
+@@ -353,11 +569,21 @@ mtk_wed_detach(struct mtk_wed_device *de
+ 	wdma_w32(dev, MTK_WDMA_RESET_IDX, 0);
+ 
+ 	mtk_wed_reset(dev, MTK_WED_RESET_WED);
++	if (mtk_wed_get_rx_capa(dev)) {
++		wdma_clr(dev, MTK_WDMA_GLO_CFG, MTK_WDMA_GLO_CFG_TX_DMA_EN);
++		wdma_w32(dev, MTK_WDMA_RESET_IDX, MTK_WDMA_RESET_IDX_TX);
++		wdma_w32(dev, MTK_WDMA_RESET_IDX, 0);
++	}
+ 
+-	mtk_wed_free_buffer(dev);
++	mtk_wed_free_tx_buffer(dev);
+ 	mtk_wed_free_tx_rings(dev);
+-	if (hw->version != 1)
++
++	if (mtk_wed_get_rx_capa(dev)) {
++		mtk_wed_wo_reset(dev);
++		mtk_wed_free_rx_rings(dev);
+ 		mtk_wed_wo_deinit(hw);
++		mtk_wdma_rx_reset(dev);
++	}
+ 
+ 	if (dev->wlan.bus_type == MTK_WED_BUS_PCIE) {
+ 		struct device_node *wlan_node;
+@@ -441,10 +667,12 @@ mtk_wed_set_wpdma(struct mtk_wed_device
+ 	} else {
+ 		mtk_wed_bus_init(dev);
+ 
+-		wed_w32(dev, MTK_WED_WPDMA_CFG_BASE,  dev->wlan.wpdma_int);
+-		wed_w32(dev, MTK_WED_WPDMA_CFG_INT_MASK,  dev->wlan.wpdma_mask);
+-		wed_w32(dev, MTK_WED_WPDMA_CFG_TX,  dev->wlan.wpdma_tx);
+-		wed_w32(dev, MTK_WED_WPDMA_CFG_TX_FREE,  dev->wlan.wpdma_txfree);
++		wed_w32(dev, MTK_WED_WPDMA_CFG_BASE, dev->wlan.wpdma_int);
++		wed_w32(dev, MTK_WED_WPDMA_CFG_INT_MASK, dev->wlan.wpdma_mask);
++		wed_w32(dev, MTK_WED_WPDMA_CFG_TX, dev->wlan.wpdma_tx);
++		wed_w32(dev, MTK_WED_WPDMA_CFG_TX_FREE, dev->wlan.wpdma_txfree);
++		wed_w32(dev, MTK_WED_WPDMA_RX_GLO_CFG, dev->wlan.wpdma_rx_glo);
++		wed_w32(dev, MTK_WED_WPDMA_RX_RING, dev->wlan.wpdma_rx);
+ 	}
+ }
+ 
+@@ -494,6 +722,132 @@ mtk_wed_hw_init_early(struct mtk_wed_dev
+ 	}
+ }
+ 
++static int
++mtk_wed_rro_ring_alloc(struct mtk_wed_device *dev, struct mtk_wed_ring *ring,
++		       int size)
++{
++	ring->desc = dma_alloc_coherent(dev->hw->dev,
++					size * sizeof(*ring->desc),
++					&ring->desc_phys, GFP_KERNEL);
++	if (!ring->desc)
++		return -ENOMEM;
++
++	ring->desc_size = sizeof(*ring->desc);
++	ring->size = size;
++	memset(ring->desc, 0, size);
++
++	return 0;
++}
++
++#define MTK_WED_MIOD_COUNT	(MTK_WED_MIOD_ENTRY_CNT * MTK_WED_MIOD_CNT)
++static int
++mtk_wed_rro_alloc(struct mtk_wed_device *dev)
++{
++	struct reserved_mem *rmem;
++	struct device_node *np;
++	int index;
++
++	index = of_property_match_string(dev->hw->node, "memory-region-names",
++					 "wo-dlm");
++	if (index < 0)
++		return index;
++
++	np = of_parse_phandle(dev->hw->node, "memory-region", index);
++	if (!np)
++		return -ENODEV;
++
++	rmem = of_reserved_mem_lookup(np);
++	of_node_put(np);
++
++	if (!rmem)
++		return -ENODEV;
++
++	dev->rro.miod_phys = rmem->base;
++	dev->rro.fdbk_phys = MTK_WED_MIOD_COUNT + dev->rro.miod_phys;
++
++	return mtk_wed_rro_ring_alloc(dev, &dev->rro.ring,
++				      MTK_WED_RRO_QUE_CNT);
++}
++
++static int
++mtk_wed_rro_cfg(struct mtk_wed_device *dev)
++{
++	struct mtk_wed_wo *wo = dev->hw->wed_wo;
++	struct {
++		struct {
++			__le32 base;
++			__le32 cnt;
++			__le32 unit;
++		} ring[2];
++		__le32 wed;
++		u8 version;
++	} req = {
++		.ring[0] = {
++			.base = cpu_to_le32(MTK_WED_WOCPU_VIEW_MIOD_BASE),
++			.cnt = cpu_to_le32(MTK_WED_MIOD_CNT),
++			.unit = cpu_to_le32(MTK_WED_MIOD_ENTRY_CNT),
++		},
++		.ring[1] = {
++			.base = cpu_to_le32(MTK_WED_WOCPU_VIEW_MIOD_BASE +
++					    MTK_WED_MIOD_COUNT),
++			.cnt = cpu_to_le32(MTK_WED_FB_CMD_CNT),
++			.unit = cpu_to_le32(4),
++		},
++	};
++
++	return mtk_wed_mcu_send_msg(wo, MTK_WED_MODULE_ID_WO,
++				    MTK_WED_WO_CMD_WED_CFG,
++				    &req, sizeof(req), true);
++}
++
++static void
++mtk_wed_rro_hw_init(struct mtk_wed_device *dev)
++{
++	wed_w32(dev, MTK_WED_RROQM_MIOD_CFG,
++		FIELD_PREP(MTK_WED_RROQM_MIOD_MID_DW, 0x70 >> 2) |
++		FIELD_PREP(MTK_WED_RROQM_MIOD_MOD_DW, 0x10 >> 2) |
++		FIELD_PREP(MTK_WED_RROQM_MIOD_ENTRY_DW,
++			   MTK_WED_MIOD_ENTRY_CNT >> 2));
++
++	wed_w32(dev, MTK_WED_RROQM_MIOD_CTRL0, dev->rro.miod_phys);
++	wed_w32(dev, MTK_WED_RROQM_MIOD_CTRL1,
++		FIELD_PREP(MTK_WED_RROQM_MIOD_CNT, MTK_WED_MIOD_CNT));
++	wed_w32(dev, MTK_WED_RROQM_FDBK_CTRL0, dev->rro.fdbk_phys);
++	wed_w32(dev, MTK_WED_RROQM_FDBK_CTRL1,
++		FIELD_PREP(MTK_WED_RROQM_FDBK_CNT, MTK_WED_FB_CMD_CNT));
++	wed_w32(dev, MTK_WED_RROQM_FDBK_CTRL2, 0);
++	wed_w32(dev, MTK_WED_RROQ_BASE_L, dev->rro.ring.desc_phys);
++
++	wed_set(dev, MTK_WED_RROQM_RST_IDX,
++		MTK_WED_RROQM_RST_IDX_MIOD |
++		MTK_WED_RROQM_RST_IDX_FDBK);
++
++	wed_w32(dev, MTK_WED_RROQM_RST_IDX, 0);
++	wed_w32(dev, MTK_WED_RROQM_MIOD_CTRL2, MTK_WED_MIOD_CNT - 1);
++	wed_set(dev, MTK_WED_CTRL, MTK_WED_CTRL_RX_RRO_QM_EN);
++}
++
++static void
++mtk_wed_route_qm_hw_init(struct mtk_wed_device *dev)
++{
++	wed_w32(dev, MTK_WED_RESET, MTK_WED_RESET_RX_ROUTE_QM);
++
++	for (;;) {
++		usleep_range(100, 200);
++		if (!(wed_r32(dev, MTK_WED_RESET) & MTK_WED_RESET_RX_ROUTE_QM))
++			break;
++	}
++
++	/* configure RX_ROUTE_QM */
++	wed_clr(dev, MTK_WED_RTQM_GLO_CFG, MTK_WED_RTQM_Q_RST);
++	wed_clr(dev, MTK_WED_RTQM_GLO_CFG, MTK_WED_RTQM_TXDMAD_FPORT);
++	wed_set(dev, MTK_WED_RTQM_GLO_CFG,
++		FIELD_PREP(MTK_WED_RTQM_TXDMAD_FPORT, 0x3 + dev->hw->index));
++	wed_clr(dev, MTK_WED_RTQM_GLO_CFG, MTK_WED_RTQM_Q_RST);
++	/* enable RX_ROUTE_QM */
++	wed_set(dev, MTK_WED_CTRL, MTK_WED_CTRL_RX_ROUTE_QM_EN);
++}
++
+ static void
+ mtk_wed_hw_init(struct mtk_wed_device *dev)
+ {
+@@ -505,11 +859,11 @@ mtk_wed_hw_init(struct mtk_wed_device *d
+ 	wed_w32(dev, MTK_WED_TX_BM_CTRL,
+ 		MTK_WED_TX_BM_CTRL_PAUSE |
+ 		FIELD_PREP(MTK_WED_TX_BM_CTRL_VLD_GRP_NUM,
+-			   dev->buf_ring.size / 128) |
++			   dev->tx_buf_ring.size / 128) |
+ 		FIELD_PREP(MTK_WED_TX_BM_CTRL_RSV_GRP_NUM,
+ 			   MTK_WED_TX_RING_SIZE / 256));
+ 
+-	wed_w32(dev, MTK_WED_TX_BM_BASE, dev->buf_ring.desc_phys);
++	wed_w32(dev, MTK_WED_TX_BM_BASE, dev->tx_buf_ring.desc_phys);
+ 
+ 	wed_w32(dev, MTK_WED_TX_BM_BUF_LEN, MTK_WED_PKT_SIZE);
+ 
+@@ -536,9 +890,9 @@ mtk_wed_hw_init(struct mtk_wed_device *d
+ 		wed_w32(dev, MTK_WED_TX_TKID_CTRL,
+ 			MTK_WED_TX_TKID_CTRL_PAUSE |
+ 			FIELD_PREP(MTK_WED_TX_TKID_CTRL_VLD_GRP_NUM,
+-				   dev->buf_ring.size / 128) |
++				   dev->tx_buf_ring.size / 128) |
+ 			FIELD_PREP(MTK_WED_TX_TKID_CTRL_RSV_GRP_NUM,
+-				   dev->buf_ring.size / 128));
++				   dev->tx_buf_ring.size / 128));
+ 		wed_w32(dev, MTK_WED_TX_TKID_DYN_THR,
+ 			FIELD_PREP(MTK_WED_TX_TKID_DYN_THR_LO, 0) |
+ 			MTK_WED_TX_TKID_DYN_THR_HI);
+@@ -546,18 +900,28 @@ mtk_wed_hw_init(struct mtk_wed_device *d
+ 
+ 	mtk_wed_reset(dev, MTK_WED_RESET_TX_BM);
+ 
+-	if (dev->hw->version == 1)
++	if (dev->hw->version == 1) {
+ 		wed_set(dev, MTK_WED_CTRL,
+ 			MTK_WED_CTRL_WED_TX_BM_EN |
+ 			MTK_WED_CTRL_WED_TX_FREE_AGENT_EN);
+-	else
++	} else {
+ 		wed_clr(dev, MTK_WED_TX_TKID_CTRL, MTK_WED_TX_TKID_CTRL_PAUSE);
++		/* rx hw init */
++		wed_w32(dev, MTK_WED_WPDMA_RX_D_RST_IDX,
++			MTK_WED_WPDMA_RX_D_RST_CRX_IDX |
++			MTK_WED_WPDMA_RX_D_RST_DRV_IDX);
++		wed_w32(dev, MTK_WED_WPDMA_RX_D_RST_IDX, 0);
++
++		mtk_wed_rx_buffer_hw_init(dev);
++		mtk_wed_rro_hw_init(dev);
++		mtk_wed_route_qm_hw_init(dev);
++	}
+ 
+ 	wed_clr(dev, MTK_WED_TX_BM_CTRL, MTK_WED_TX_BM_CTRL_PAUSE);
+ }
+ 
+ static void
+-mtk_wed_ring_reset(struct mtk_wed_ring *ring, int size)
++mtk_wed_ring_reset(struct mtk_wed_ring *ring, int size, bool tx)
+ {
+ 	void *head = (void *)ring->desc;
+ 	int i;
+@@ -567,7 +931,10 @@ mtk_wed_ring_reset(struct mtk_wed_ring *
+ 
+ 		desc = (struct mtk_wdma_desc *)(head + i * ring->desc_size);
+ 		desc->buf0 = 0;
+-		desc->ctrl = cpu_to_le32(MTK_WDMA_DESC_CTRL_DMA_DONE);
++		if (tx)
++			desc->ctrl = cpu_to_le32(MTK_WDMA_DESC_CTRL_DMA_DONE);
++		else
++			desc->ctrl = cpu_to_le32(MTK_WFDMA_DESC_CTRL_TO_HOST);
+ 		desc->buf1 = 0;
+ 		desc->info = 0;
+ 	}
+@@ -623,7 +990,8 @@ mtk_wed_reset_dma(struct mtk_wed_device
+ 		if (!dev->tx_ring[i].desc)
+ 			continue;
+ 
+-		mtk_wed_ring_reset(&dev->tx_ring[i], MTK_WED_TX_RING_SIZE);
++		mtk_wed_ring_reset(&dev->tx_ring[i], MTK_WED_TX_RING_SIZE,
++				   true);
+ 	}
+ 
+ 	if (mtk_wed_poll_busy(dev))
+@@ -641,6 +1009,9 @@ mtk_wed_reset_dma(struct mtk_wed_device
+ 	wdma_w32(dev, MTK_WDMA_RESET_IDX, MTK_WDMA_RESET_IDX_RX);
+ 	wdma_w32(dev, MTK_WDMA_RESET_IDX, 0);
+ 
++	if (mtk_wed_get_rx_capa(dev))
++		mtk_wdma_rx_reset(dev);
++
+ 	if (busy) {
+ 		mtk_wed_reset(dev, MTK_WED_RESET_WDMA_INT_AGENT);
+ 		mtk_wed_reset(dev, MTK_WED_RESET_WDMA_RX_DRV);
+@@ -675,12 +1046,11 @@ mtk_wed_reset_dma(struct mtk_wed_device
+ 			MTK_WED_WPDMA_RESET_IDX_RX);
+ 		wed_w32(dev, MTK_WED_WPDMA_RESET_IDX, 0);
+ 	}
+-
+ }
+ 
+ static int
+ mtk_wed_ring_alloc(struct mtk_wed_device *dev, struct mtk_wed_ring *ring,
+-		   int size, u32 desc_size)
++		   int size, u32 desc_size, bool tx)
+ {
+ 	ring->desc = dma_alloc_coherent(dev->hw->dev, size * desc_size,
+ 					&ring->desc_phys, GFP_KERNEL);
+@@ -689,7 +1059,7 @@ mtk_wed_ring_alloc(struct mtk_wed_device
+ 
+ 	ring->desc_size = desc_size;
+ 	ring->size = size;
+-	mtk_wed_ring_reset(ring, size);
++	mtk_wed_ring_reset(ring, size, tx);
+ 
+ 	return 0;
+ }
+@@ -698,9 +1068,14 @@ static int
+ mtk_wed_wdma_rx_ring_setup(struct mtk_wed_device *dev, int idx, int size)
+ {
+ 	u32 desc_size = sizeof(struct mtk_wdma_desc) * dev->hw->version;
+-	struct mtk_wed_ring *wdma = &dev->rx_wdma[idx];
++	struct mtk_wed_ring *wdma;
+ 
+-	if (mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE, desc_size))
++	if (idx >= ARRAY_SIZE(dev->rx_wdma))
++		return -EINVAL;
++
++	wdma = &dev->rx_wdma[idx];
++	if (mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE, desc_size,
++			       true))
+ 		return -ENOMEM;
+ 
+ 	wdma_w32(dev, MTK_WDMA_RING_RX(idx) + MTK_WED_RING_OFS_BASE,
+@@ -717,6 +1092,60 @@ mtk_wed_wdma_rx_ring_setup(struct mtk_we
+ 	return 0;
+ }
+ 
++static int
++mtk_wed_wdma_tx_ring_setup(struct mtk_wed_device *dev, int idx, int size)
++{
++	u32 desc_size = sizeof(struct mtk_wdma_desc) * dev->hw->version;
++	struct mtk_wed_ring *wdma;
++
++	if (idx >= ARRAY_SIZE(dev->tx_wdma))
++		return -EINVAL;
++
++	wdma = &dev->tx_wdma[idx];
++	if (mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE, desc_size,
++			       true))
++		return -ENOMEM;
++
++	wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_BASE,
++		 wdma->desc_phys);
++	wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_COUNT,
++		 size);
++	wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_CPU_IDX, 0);
++	wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_DMA_IDX, 0);
++
++	if (!idx)  {
++		wed_w32(dev, MTK_WED_WDMA_RING_TX + MTK_WED_RING_OFS_BASE,
++			wdma->desc_phys);
++		wed_w32(dev, MTK_WED_WDMA_RING_TX + MTK_WED_RING_OFS_COUNT,
++			size);
++		wed_w32(dev, MTK_WED_WDMA_RING_TX + MTK_WED_RING_OFS_CPU_IDX,
++			0);
++		wed_w32(dev, MTK_WED_WDMA_RING_TX + MTK_WED_RING_OFS_DMA_IDX,
++			0);
++	}
++
++	return 0;
++}
++
++static void
++mtk_wed_ppe_check(struct mtk_wed_device *dev, struct sk_buff *skb,
++		  u32 reason, u32 hash)
++{
++	struct mtk_eth *eth = dev->hw->eth;
++	struct ethhdr *eh;
++
++	if (!skb)
++		return;
++
++	if (reason != MTK_PPE_CPU_REASON_HIT_UNBIND_RATE_REACHED)
++		return;
++
++	skb_set_mac_header(skb, 0);
++	eh = eth_hdr(skb);
++	skb->protocol = eh->h_proto;
++	mtk_ppe_check_skb(eth->ppe[dev->hw->index], skb, hash);
++}
++
+ static void
+ mtk_wed_configure_irq(struct mtk_wed_device *dev, u32 irq_mask)
+ {
+@@ -739,6 +1168,8 @@ mtk_wed_configure_irq(struct mtk_wed_dev
+ 
+ 		wed_clr(dev, MTK_WED_WDMA_INT_CTRL, wdma_mask);
+ 	} else {
++		wdma_mask |= FIELD_PREP(MTK_WDMA_INT_MASK_TX_DONE,
++					GENMASK(1, 0));
+ 		/* initail tx interrupt trigger */
+ 		wed_w32(dev, MTK_WED_WPDMA_INT_CTRL_TX,
+ 			MTK_WED_WPDMA_INT_CTRL_TX0_DONE_EN |
+@@ -757,6 +1188,16 @@ mtk_wed_configure_irq(struct mtk_wed_dev
+ 			FIELD_PREP(MTK_WED_WPDMA_INT_CTRL_TX_FREE_DONE_TRIG,
+ 				   dev->wlan.txfree_tbit));
+ 
++		wed_w32(dev, MTK_WED_WPDMA_INT_CTRL_RX,
++			MTK_WED_WPDMA_INT_CTRL_RX0_EN |
++			MTK_WED_WPDMA_INT_CTRL_RX0_CLR |
++			MTK_WED_WPDMA_INT_CTRL_RX1_EN |
++			MTK_WED_WPDMA_INT_CTRL_RX1_CLR |
++			FIELD_PREP(MTK_WED_WPDMA_INT_CTRL_RX0_DONE_TRIG,
++				   dev->wlan.rx_tbit[0]) |
++			FIELD_PREP(MTK_WED_WPDMA_INT_CTRL_RX1_DONE_TRIG,
++				   dev->wlan.rx_tbit[1]));
++
+ 		wed_w32(dev, MTK_WED_WDMA_INT_CLR, wdma_mask);
+ 		wed_set(dev, MTK_WED_WDMA_INT_CTRL,
+ 			FIELD_PREP(MTK_WED_WDMA_INT_CTRL_POLL_SRC_SEL,
+@@ -794,9 +1235,15 @@ mtk_wed_dma_enable(struct mtk_wed_device
+ 		wdma_set(dev, MTK_WDMA_GLO_CFG,
+ 			 MTK_WDMA_GLO_CFG_RX_INFO3_PRERES);
+ 	} else {
++		int i;
++
+ 		wed_set(dev, MTK_WED_WPDMA_CTRL,
+ 			MTK_WED_WPDMA_CTRL_SDL1_FIXED);
+ 
++		wed_set(dev, MTK_WED_WDMA_GLO_CFG,
++			MTK_WED_WDMA_GLO_CFG_TX_DRV_EN |
++			MTK_WED_WDMA_GLO_CFG_TX_DDONE_CHK);
++
+ 		wed_set(dev, MTK_WED_WPDMA_GLO_CFG,
+ 			MTK_WED_WPDMA_GLO_CFG_RX_DRV_R0_PKT_PROC |
+ 			MTK_WED_WPDMA_GLO_CFG_RX_DRV_R0_CRX_SYNC);
+@@ -804,6 +1251,15 @@ mtk_wed_dma_enable(struct mtk_wed_device
+ 		wed_clr(dev, MTK_WED_WPDMA_GLO_CFG,
+ 			MTK_WED_WPDMA_GLO_CFG_TX_TKID_KEEP |
+ 			MTK_WED_WPDMA_GLO_CFG_TX_DMAD_DW3_PREV);
++
++		wed_set(dev, MTK_WED_WPDMA_RX_D_GLO_CFG,
++			MTK_WED_WPDMA_RX_D_RX_DRV_EN |
++			FIELD_PREP(MTK_WED_WPDMA_RX_D_RXD_READ_LEN, 0x18) |
++			FIELD_PREP(MTK_WED_WPDMA_RX_D_INIT_PHASE_RXEN_SEL,
++				   0x2));
++
++		for (i = 0; i < MTK_WED_RX_QUEUES; i++)
++			mtk_wed_check_wfdma_rx_fill(dev, i);
+ 	}
+ }
+ 
+@@ -829,7 +1285,19 @@ mtk_wed_start(struct mtk_wed_device *dev
+ 		val |= BIT(0) | (BIT(1) * !!dev->hw->index);
+ 		regmap_write(dev->hw->mirror, dev->hw->index * 4, val);
+ 	} else {
+-		mtk_wed_set_512_support(dev, true);
++		/* driver set mid ready and only once */
++		wed_w32(dev, MTK_WED_EXT_INT_MASK1,
++			MTK_WED_EXT_INT_STATUS_WPDMA_MID_RDY);
++		wed_w32(dev, MTK_WED_EXT_INT_MASK2,
++			MTK_WED_EXT_INT_STATUS_WPDMA_MID_RDY);
++
++		wed_r32(dev, MTK_WED_EXT_INT_MASK1);
++		wed_r32(dev, MTK_WED_EXT_INT_MASK2);
++
++		if (mtk_wed_rro_cfg(dev))
++			return;
++
++		mtk_wed_set_512_support(dev, dev->wlan.wcid_512);
+ 	}
+ 
+ 	mtk_wed_dma_enable(dev);
+@@ -863,7 +1331,7 @@ mtk_wed_attach(struct mtk_wed_device *de
+ 	if (!hw) {
+ 		module_put(THIS_MODULE);
+ 		ret = -ENODEV;
+-		goto out;
++		goto unlock;
+ 	}
+ 
+ 	device = dev->wlan.bus_type == MTK_WED_BUS_PCIE
+@@ -876,15 +1344,24 @@ mtk_wed_attach(struct mtk_wed_device *de
+ 	dev->dev = hw->dev;
+ 	dev->irq = hw->irq;
+ 	dev->wdma_idx = hw->index;
++	dev->version = hw->version;
+ 
+ 	if (hw->eth->dma_dev == hw->eth->dev &&
+ 	    of_dma_is_coherent(hw->eth->dev->of_node))
+ 		mtk_eth_set_dma_device(hw->eth, hw->dev);
+ 
+-	ret = mtk_wed_buffer_alloc(dev);
+-	if (ret) {
+-		mtk_wed_detach(dev);
++	ret = mtk_wed_tx_buffer_alloc(dev);
++	if (ret)
+ 		goto out;
++
++	if (mtk_wed_get_rx_capa(dev)) {
++		ret = mtk_wed_rx_buffer_alloc(dev);
++		if (ret)
++			goto out;
++
++		ret = mtk_wed_rro_alloc(dev);
++		if (ret)
++			goto out;
+ 	}
+ 
+ 	mtk_wed_hw_init_early(dev);
+@@ -893,8 +1370,10 @@ mtk_wed_attach(struct mtk_wed_device *de
+ 				   BIT(hw->index), 0);
+ 	else
+ 		ret = mtk_wed_wo_init(hw);
+-
+ out:
++	if (ret)
++		mtk_wed_detach(dev);
++unlock:
+ 	mutex_unlock(&hw_lock);
+ 
+ 	return ret;
+@@ -917,10 +1396,11 @@ mtk_wed_tx_ring_setup(struct mtk_wed_dev
+ 	 * WDMA RX.
+ 	 */
+ 
+-	BUG_ON(idx >= ARRAY_SIZE(dev->tx_ring));
++	if (WARN_ON(idx >= ARRAY_SIZE(dev->tx_ring)))
++		return -EINVAL;
+ 
+ 	if (mtk_wed_ring_alloc(dev, ring, MTK_WED_TX_RING_SIZE,
+-			       sizeof(*ring->desc)))
++			       sizeof(*ring->desc), true))
+ 		return -ENOMEM;
+ 
+ 	if (mtk_wed_wdma_rx_ring_setup(dev, idx, MTK_WED_WDMA_RING_SIZE))
+@@ -967,6 +1447,37 @@ mtk_wed_txfree_ring_setup(struct mtk_wed
+ 	return 0;
+ }
+ 
++static int
++mtk_wed_rx_ring_setup(struct mtk_wed_device *dev, int idx, void __iomem *regs)
++{
++	struct mtk_wed_ring *ring = &dev->rx_ring[idx];
++
++	if (WARN_ON(idx >= ARRAY_SIZE(dev->rx_ring)))
++		return -EINVAL;
++
++	if (mtk_wed_ring_alloc(dev, ring, MTK_WED_RX_RING_SIZE,
++			       sizeof(*ring->desc), false))
++		return -ENOMEM;
++
++	if (mtk_wed_wdma_tx_ring_setup(dev, idx, MTK_WED_WDMA_RING_SIZE))
++		return -ENOMEM;
++
++	ring->reg_base = MTK_WED_RING_RX_DATA(idx);
++	ring->wpdma = regs;
++	ring->flags |= MTK_WED_RING_CONFIGURED;
++
++	/* WPDMA ->  WED */
++	wpdma_rx_w32(dev, idx, MTK_WED_RING_OFS_BASE, ring->desc_phys);
++	wpdma_rx_w32(dev, idx, MTK_WED_RING_OFS_COUNT, MTK_WED_RX_RING_SIZE);
++
++	wed_w32(dev, MTK_WED_WPDMA_RING_RX_DATA(idx) + MTK_WED_RING_OFS_BASE,
++		ring->desc_phys);
++	wed_w32(dev, MTK_WED_WPDMA_RING_RX_DATA(idx) + MTK_WED_RING_OFS_COUNT,
++		MTK_WED_RX_RING_SIZE);
++
++	return 0;
++}
++
+ static u32
+ mtk_wed_irq_get(struct mtk_wed_device *dev, u32 mask)
+ {
+@@ -1063,7 +1574,9 @@ void mtk_wed_add_hw(struct device_node *
+ 	static const struct mtk_wed_ops wed_ops = {
+ 		.attach = mtk_wed_attach,
+ 		.tx_ring_setup = mtk_wed_tx_ring_setup,
++		.rx_ring_setup = mtk_wed_rx_ring_setup,
+ 		.txfree_ring_setup = mtk_wed_txfree_ring_setup,
++		.msg_update = mtk_wed_mcu_msg_update,
+ 		.start = mtk_wed_start,
+ 		.stop = mtk_wed_stop,
+ 		.reset_dma = mtk_wed_reset_dma,
+@@ -1072,6 +1585,7 @@ void mtk_wed_add_hw(struct device_node *
+ 		.irq_get = mtk_wed_irq_get,
+ 		.irq_set_mask = mtk_wed_irq_set_mask,
+ 		.detach = mtk_wed_detach,
++		.ppe_check = mtk_wed_ppe_check,
+ 	};
+ 	struct device_node *eth_np = eth->dev->of_node;
+ 	struct platform_device *pdev;
+--- a/drivers/net/ethernet/mediatek/mtk_wed.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed.h
+@@ -87,6 +87,24 @@ wpdma_tx_w32(struct mtk_wed_device *dev,
+ }
+ 
+ static inline u32
++wpdma_rx_r32(struct mtk_wed_device *dev, int ring, u32 reg)
++{
++	if (!dev->rx_ring[ring].wpdma)
++		return 0;
++
++	return readl(dev->rx_ring[ring].wpdma + reg);
++}
++
++static inline void
++wpdma_rx_w32(struct mtk_wed_device *dev, int ring, u32 reg, u32 val)
++{
++	if (!dev->rx_ring[ring].wpdma)
++		return;
++
++	writel(val, dev->rx_ring[ring].wpdma + reg);
++}
++
++static inline u32
+ wpdma_txfree_r32(struct mtk_wed_device *dev, u32 reg)
+ {
+ 	if (!dev->txfree_ring.wpdma)
+@@ -128,6 +146,7 @@ static inline int mtk_wed_flow_add(int i
+ static inline void mtk_wed_flow_remove(int index)
+ {
+ }
++
+ #endif
+ 
+ #ifdef CONFIG_DEBUG_FS
+--- a/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
+@@ -10,6 +10,7 @@
+ #include <linux/of_reserved_mem.h>
+ #include <linux/mfd/syscon.h>
+ #include <linux/soc/mediatek/mtk_wed.h>
++#include <asm/unaligned.h>
+ 
+ #include "mtk_wed_regs.h"
+ #include "mtk_wed_wo.h"
+@@ -60,24 +61,37 @@ void mtk_wed_mcu_rx_event(struct mtk_wed
+ 	wake_up(&wo->mcu.wait);
+ }
+ 
++static void
++mtk_wed_update_rx_stats(struct mtk_wed_device *wed, struct sk_buff *skb)
++{
++	u32 count = get_unaligned_le32(skb->data);
++	struct mtk_wed_wo_rx_stats *stats;
++	int i;
++
++	if (count * sizeof(*stats) > skb->len - sizeof(u32))
++		return;
++
++	stats = (struct mtk_wed_wo_rx_stats *)(skb->data + sizeof(u32));
++	for (i = 0 ; i < count ; i++)
++		wed->wlan.update_wo_rx_stats(wed, &stats[i]);
++}
++
+ void mtk_wed_mcu_rx_unsolicited_event(struct mtk_wed_wo *wo,
+ 				      struct sk_buff *skb)
+ {
+ 	struct mtk_wed_mcu_hdr *hdr = (struct mtk_wed_mcu_hdr *)skb->data;
+ 
+-	switch (hdr->cmd) {
+-	case MTK_WED_WO_EVT_LOG_DUMP: {
+-		const char *msg = (const char *)(skb->data + sizeof(*hdr));
++	skb_pull(skb, sizeof(*hdr));
+ 
+-		dev_notice(wo->hw->dev, "%s\n", msg);
++	switch (hdr->cmd) {
++	case MTK_WED_WO_EVT_LOG_DUMP:
++		dev_notice(wo->hw->dev, "%s\n", skb->data);
+ 		break;
+-	}
+ 	case MTK_WED_WO_EVT_PROFILING: {
+-		struct mtk_wed_wo_log_info *info;
+-		u32 count = (skb->len - sizeof(*hdr)) / sizeof(*info);
++		struct mtk_wed_wo_log_info *info = (void *)skb->data;
++		u32 count = skb->len / sizeof(*info);
+ 		int i;
+ 
+-		info = (struct mtk_wed_wo_log_info *)(skb->data + sizeof(*hdr));
+ 		for (i = 0 ; i < count ; i++)
+ 			dev_notice(wo->hw->dev,
+ 				   "SN:%u latency: total=%u, rro:%u, mod:%u\n",
+@@ -88,6 +102,7 @@ void mtk_wed_mcu_rx_unsolicited_event(st
+ 		break;
+ 	}
+ 	case MTK_WED_WO_EVT_RXCNT_INFO:
++		mtk_wed_update_rx_stats(wo->hw->wed_dev, skb);
+ 		break;
+ 	default:
+ 		break;
+@@ -144,6 +159,8 @@ mtk_wed_mcu_parse_response(struct mtk_we
+ 	skb_pull(skb, sizeof(*hdr));
+ 	switch (cmd) {
+ 	case MTK_WED_WO_CMD_RXCNT_INFO:
++		mtk_wed_update_rx_stats(wo->hw->wed_dev, skb);
++		break;
+ 	default:
+ 		break;
+ 	}
+@@ -182,6 +199,18 @@ unlock:
+ 	return ret;
+ }
+ 
++int mtk_wed_mcu_msg_update(struct mtk_wed_device *dev, int id, void *data,
++			   int len)
++{
++	struct mtk_wed_wo *wo = dev->hw->wed_wo;
++
++	if (dev->hw->version == 1)
++		return 0;
++
++	return mtk_wed_mcu_send_msg(wo, MTK_WED_MODULE_ID_WO, id, data, len,
++				    true);
++}
++
+ static int
+ mtk_wed_get_memory_region(struct mtk_wed_wo *wo,
+ 			  struct mtk_wed_wo_memory_region *region)
+--- a/drivers/net/ethernet/mediatek/mtk_wed_regs.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_regs.h
+@@ -4,6 +4,7 @@
+ #ifndef __MTK_WED_REGS_H
+ #define __MTK_WED_REGS_H
+ 
++#define MTK_WFDMA_DESC_CTRL_TO_HOST		BIT(8)
+ #define MTK_WDMA_DESC_CTRL_LEN1			GENMASK(14, 0)
+ #define MTK_WDMA_DESC_CTRL_LEN1_V2		GENMASK(13, 0)
+ #define MTK_WDMA_DESC_CTRL_LAST_SEG1		BIT(15)
+@@ -28,6 +29,8 @@ struct mtk_wdma_desc {
+ #define MTK_WED_RESET_WED_TX_DMA			BIT(12)
+ #define MTK_WED_RESET_WDMA_RX_DRV			BIT(17)
+ #define MTK_WED_RESET_WDMA_INT_AGENT			BIT(19)
++#define MTK_WED_RESET_RX_RRO_QM				BIT(20)
++#define MTK_WED_RESET_RX_ROUTE_QM			BIT(21)
+ #define MTK_WED_RESET_WED				BIT(31)
+ 
+ #define MTK_WED_CTRL					0x00c
+@@ -39,8 +42,12 @@ struct mtk_wdma_desc {
+ #define MTK_WED_CTRL_WED_TX_BM_BUSY			BIT(9)
+ #define MTK_WED_CTRL_WED_TX_FREE_AGENT_EN		BIT(10)
+ #define MTK_WED_CTRL_WED_TX_FREE_AGENT_BUSY		BIT(11)
+-#define MTK_WED_CTRL_RESERVE_EN				BIT(12)
+-#define MTK_WED_CTRL_RESERVE_BUSY			BIT(13)
++#define MTK_WED_CTRL_WED_RX_BM_EN			BIT(12)
++#define MTK_WED_CTRL_WED_RX_BM_BUSY			BIT(13)
++#define MTK_WED_CTRL_RX_RRO_QM_EN			BIT(14)
++#define MTK_WED_CTRL_RX_RRO_QM_BUSY			BIT(15)
++#define MTK_WED_CTRL_RX_ROUTE_QM_EN			BIT(16)
++#define MTK_WED_CTRL_RX_ROUTE_QM_BUSY			BIT(17)
+ #define MTK_WED_CTRL_FINAL_DIDX_READ			BIT(24)
+ #define MTK_WED_CTRL_ETH_DMAD_FMT			BIT(25)
+ #define MTK_WED_CTRL_MIB_READ_CLEAR			BIT(28)
+@@ -62,6 +69,9 @@ struct mtk_wdma_desc {
+ #define MTK_WED_EXT_INT_STATUS_TX_DMA_R_RESP_ERR	BIT(22)
+ #define MTK_WED_EXT_INT_STATUS_TX_DMA_W_RESP_ERR	BIT(23)
+ #define MTK_WED_EXT_INT_STATUS_RX_DRV_DMA_RECYCLE	BIT(24)
++#define MTK_WED_EXT_INT_STATUS_RX_DRV_GET_BM_DMAD_SKIP	BIT(25)
++#define MTK_WED_EXT_INT_STATUS_WPDMA_RX_D_DRV_ERR	BIT(26)
++#define MTK_WED_EXT_INT_STATUS_WPDMA_MID_RDY		BIT(27)
+ #define MTK_WED_EXT_INT_STATUS_ERROR_MASK		(MTK_WED_EXT_INT_STATUS_TF_LEN_ERR | \
+ 							 MTK_WED_EXT_INT_STATUS_TKID_WO_PYLD | \
+ 							 MTK_WED_EXT_INT_STATUS_TKID_TITO_INVALID | \
+@@ -71,6 +81,8 @@ struct mtk_wdma_desc {
+ 							 MTK_WED_EXT_INT_STATUS_TX_DMA_R_RESP_ERR)
+ 
+ #define MTK_WED_EXT_INT_MASK				0x028
++#define MTK_WED_EXT_INT_MASK1				0x02c
++#define MTK_WED_EXT_INT_MASK2				0x030
+ 
+ #define MTK_WED_STATUS					0x060
+ #define MTK_WED_STATUS_TX				GENMASK(15, 8)
+@@ -151,6 +163,7 @@ struct mtk_wdma_desc {
+ #define MTK_WED_RING_TX(_n)				(0x300 + (_n) * 0x10)
+ 
+ #define MTK_WED_RING_RX(_n)				(0x400 + (_n) * 0x10)
++#define MTK_WED_RING_RX_DATA(_n)			(0x420 + (_n) * 0x10)
+ 
+ #define MTK_WED_SCR0					0x3c0
+ #define MTK_WED_WPDMA_INT_TRIGGER			0x504
+@@ -213,6 +226,12 @@ struct mtk_wdma_desc {
+ #define MTK_WED_WPDMA_INT_CTRL_TX1_DONE_TRIG		GENMASK(14, 10)
+ 
+ #define MTK_WED_WPDMA_INT_CTRL_RX			0x534
++#define MTK_WED_WPDMA_INT_CTRL_RX0_EN			BIT(0)
++#define MTK_WED_WPDMA_INT_CTRL_RX0_CLR			BIT(1)
++#define MTK_WED_WPDMA_INT_CTRL_RX0_DONE_TRIG		GENMASK(6, 2)
++#define MTK_WED_WPDMA_INT_CTRL_RX1_EN			BIT(8)
++#define MTK_WED_WPDMA_INT_CTRL_RX1_CLR			BIT(9)
++#define MTK_WED_WPDMA_INT_CTRL_RX1_DONE_TRIG		GENMASK(14, 10)
+ 
+ #define MTK_WED_WPDMA_INT_CTRL_TX_FREE			0x538
+ #define MTK_WED_WPDMA_INT_CTRL_TX_FREE_DONE_EN		BIT(0)
+@@ -242,11 +261,34 @@ struct mtk_wdma_desc {
+ 
+ #define MTK_WED_WPDMA_RING_TX(_n)			(0x600 + (_n) * 0x10)
+ #define MTK_WED_WPDMA_RING_RX(_n)			(0x700 + (_n) * 0x10)
++#define MTK_WED_WPDMA_RING_RX_DATA(_n)			(0x730 + (_n) * 0x10)
++
++#define MTK_WED_WPDMA_RX_D_GLO_CFG			0x75c
++#define MTK_WED_WPDMA_RX_D_RX_DRV_EN			BIT(0)
++#define MTK_WED_WPDMA_RX_D_INIT_PHASE_RXEN_SEL		GENMASK(11, 7)
++#define MTK_WED_WPDMA_RX_D_RXD_READ_LEN			GENMASK(31, 24)
++
++#define MTK_WED_WPDMA_RX_D_RST_IDX			0x760
++#define MTK_WED_WPDMA_RX_D_RST_CRX_IDX			GENMASK(17, 16)
++#define MTK_WED_WPDMA_RX_D_RST_DRV_IDX			GENMASK(25, 24)
++
++#define MTK_WED_WPDMA_RX_GLO_CFG			0x76c
++#define MTK_WED_WPDMA_RX_RING				0x770
++
++#define MTK_WED_WPDMA_RX_D_MIB(_n)			(0x774 + (_n) * 4)
++#define MTK_WED_WPDMA_RX_D_PROCESSED_MIB(_n)		(0x784 + (_n) * 4)
++#define MTK_WED_WPDMA_RX_D_COHERENT_MIB			0x78c
++
++#define MTK_WED_WDMA_RING_TX				0x800
++
++#define MTK_WED_WDMA_TX_MIB				0x810
++
+ #define MTK_WED_WDMA_RING_RX(_n)			(0x900 + (_n) * 0x10)
+ #define MTK_WED_WDMA_RX_THRES(_n)			(0x940 + (_n) * 0x4)
+ 
+ #define MTK_WED_WDMA_GLO_CFG				0xa04
+ #define MTK_WED_WDMA_GLO_CFG_TX_DRV_EN			BIT(0)
++#define MTK_WED_WDMA_GLO_CFG_TX_DDONE_CHK		BIT(1)
+ #define MTK_WED_WDMA_GLO_CFG_RX_DRV_EN			BIT(2)
+ #define MTK_WED_WDMA_GLO_CFG_RX_DRV_BUSY		BIT(3)
+ #define MTK_WED_WDMA_GLO_CFG_BT_SIZE			GENMASK(5, 4)
+@@ -291,6 +333,20 @@ struct mtk_wdma_desc {
+ #define MTK_WED_WDMA_RX_RECYCLE_MIB(_n)			(0xae8 + (_n) * 4)
+ #define MTK_WED_WDMA_RX_PROCESSED_MIB(_n)		(0xaf0 + (_n) * 4)
+ 
++#define MTK_WED_RX_BM_RX_DMAD				0xd80
++#define MTK_WED_RX_BM_RX_DMAD_SDL0			GENMASK(13, 0)
++
++#define MTK_WED_RX_BM_BASE				0xd84
++#define MTK_WED_RX_BM_INIT_PTR				0xd88
++#define MTK_WED_RX_BM_SW_TAIL				GENMASK(15, 0)
++#define MTK_WED_RX_BM_INIT_SW_TAIL			BIT(16)
++
++#define MTK_WED_RX_PTR					0xd8c
++
++#define MTK_WED_RX_BM_DYN_ALLOC_TH			0xdb4
++#define MTK_WED_RX_BM_DYN_ALLOC_TH_H			GENMASK(31, 16)
++#define MTK_WED_RX_BM_DYN_ALLOC_TH_L			GENMASK(15, 0)
++
+ #define MTK_WED_RING_OFS_BASE				0x00
+ #define MTK_WED_RING_OFS_COUNT				0x04
+ #define MTK_WED_RING_OFS_CPU_IDX			0x08
+@@ -301,7 +357,9 @@ struct mtk_wdma_desc {
+ 
+ #define MTK_WDMA_GLO_CFG				0x204
+ #define MTK_WDMA_GLO_CFG_TX_DMA_EN			BIT(0)
++#define MTK_WDMA_GLO_CFG_TX_DMA_BUSY			BIT(1)
+ #define MTK_WDMA_GLO_CFG_RX_DMA_EN			BIT(2)
++#define MTK_WDMA_GLO_CFG_RX_DMA_BUSY			BIT(3)
+ #define MTK_WDMA_GLO_CFG_RX_INFO3_PRERES		BIT(26)
+ #define MTK_WDMA_GLO_CFG_RX_INFO2_PRERES		BIT(27)
+ #define MTK_WDMA_GLO_CFG_RX_INFO1_PRERES		BIT(28)
+@@ -330,4 +388,70 @@ struct mtk_wdma_desc {
+ /* DMA channel mapping */
+ #define HIFSYS_DMA_AG_MAP				0x008
+ 
++#define MTK_WED_RTQM_GLO_CFG				0xb00
++#define MTK_WED_RTQM_BUSY				BIT(1)
++#define MTK_WED_RTQM_Q_RST				BIT(2)
++#define MTK_WED_RTQM_Q_DBG_BYPASS			BIT(5)
++#define MTK_WED_RTQM_TXDMAD_FPORT			GENMASK(23, 20)
++
++#define MTK_WED_RTQM_R2H_MIB(_n)			(0xb70 + (_n) * 0x4)
++#define MTK_WED_RTQM_R2Q_MIB(_n)			(0xb78 + (_n) * 0x4)
++#define MTK_WED_RTQM_Q2N_MIB				0xb80
++#define MTK_WED_RTQM_Q2H_MIB(_n)			(0xb84 + (_n) * 0x4)
++
++#define MTK_WED_RTQM_Q2B_MIB				0xb8c
++#define MTK_WED_RTQM_PFDBK_MIB				0xb90
++
++#define MTK_WED_RROQM_GLO_CFG				0xc04
++#define MTK_WED_RROQM_RST_IDX				0xc08
++#define MTK_WED_RROQM_RST_IDX_MIOD			BIT(0)
++#define MTK_WED_RROQM_RST_IDX_FDBK			BIT(4)
++
++#define MTK_WED_RROQM_MIOD_CTRL0			0xc40
++#define MTK_WED_RROQM_MIOD_CTRL1			0xc44
++#define MTK_WED_RROQM_MIOD_CNT				GENMASK(11, 0)
++
++#define MTK_WED_RROQM_MIOD_CTRL2			0xc48
++#define MTK_WED_RROQM_MIOD_CTRL3			0xc4c
++
++#define MTK_WED_RROQM_FDBK_CTRL0			0xc50
++#define MTK_WED_RROQM_FDBK_CTRL1			0xc54
++#define MTK_WED_RROQM_FDBK_CNT				GENMASK(11, 0)
++
++#define MTK_WED_RROQM_FDBK_CTRL2			0xc58
++
++#define MTK_WED_RROQ_BASE_L				0xc80
++#define MTK_WED_RROQ_BASE_H				0xc84
++
++#define MTK_WED_RROQM_MIOD_CFG				0xc8c
++#define MTK_WED_RROQM_MIOD_MID_DW			GENMASK(5, 0)
++#define MTK_WED_RROQM_MIOD_MOD_DW			GENMASK(13, 8)
++#define MTK_WED_RROQM_MIOD_ENTRY_DW			GENMASK(22, 16)
++
++#define MTK_WED_RROQM_MID_MIB				0xcc0
++#define MTK_WED_RROQM_MOD_MIB				0xcc4
++#define MTK_WED_RROQM_MOD_COHERENT_MIB			0xcc8
++#define MTK_WED_RROQM_FDBK_MIB				0xcd0
++#define MTK_WED_RROQM_FDBK_COHERENT_MIB			0xcd4
++#define MTK_WED_RROQM_FDBK_IND_MIB			0xce0
++#define MTK_WED_RROQM_FDBK_ENQ_MIB			0xce4
++#define MTK_WED_RROQM_FDBK_ANC_MIB			0xce8
++#define MTK_WED_RROQM_FDBK_ANC2H_MIB			0xcec
++
++#define MTK_WED_RX_BM_RX_DMAD				0xd80
++#define MTK_WED_RX_BM_BASE				0xd84
++#define MTK_WED_RX_BM_INIT_PTR				0xd88
++#define MTK_WED_RX_BM_PTR				0xd8c
++#define MTK_WED_RX_BM_PTR_HEAD				GENMASK(32, 16)
++#define MTK_WED_RX_BM_PTR_TAIL				GENMASK(15, 0)
++
++#define MTK_WED_RX_BM_BLEN				0xd90
++#define MTK_WED_RX_BM_STS				0xd94
++#define MTK_WED_RX_BM_INTF2				0xd98
++#define MTK_WED_RX_BM_INTF				0xd9c
++#define MTK_WED_RX_BM_ERR_STS				0xda8
++
++#define MTK_WED_WOCPU_VIEW_MIOD_BASE			0x8000
++#define MTK_WED_PCIE_INT_MASK				0x0
++
+ #endif
+--- a/drivers/net/ethernet/mediatek/mtk_wed_wo.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.h
+@@ -49,6 +49,10 @@ enum {
+ 	MTK_WED_WARP_CMD_FLAG_FROM_TO_WO	= BIT(2),
+ };
+ 
++#define MTK_WED_WO_CPU_MCUSYS_RESET_ADDR	0x15194050
++#define MTK_WED_WO_CPU_WO0_MCUSYS_RESET_MASK	0x20
++#define MTK_WED_WO_CPU_WO1_MCUSYS_RESET_MASK	0x1
++
+ enum {
+ 	MTK_WED_WO_REGION_EMI,
+ 	MTK_WED_WO_REGION_ILM,
+@@ -57,6 +61,28 @@ enum {
+ 	__MTK_WED_WO_REGION_MAX,
+ };
+ 
++enum mtk_wed_wo_state {
++	MTK_WED_WO_STATE_UNDEFINED,
++	MTK_WED_WO_STATE_INIT,
++	MTK_WED_WO_STATE_ENABLE,
++	MTK_WED_WO_STATE_DISABLE,
++	MTK_WED_WO_STATE_HALT,
++	MTK_WED_WO_STATE_GATING,
++	MTK_WED_WO_STATE_SER_RESET,
++	MTK_WED_WO_STATE_WF_RESET,
++};
++
++enum mtk_wed_wo_done_state {
++	MTK_WED_WOIF_UNDEFINED,
++	MTK_WED_WOIF_DISABLE_DONE,
++	MTK_WED_WOIF_TRIGGER_ENABLE,
++	MTK_WED_WOIF_ENABLE_DONE,
++	MTK_WED_WOIF_TRIGGER_GATING,
++	MTK_WED_WOIF_GATING_DONE,
++	MTK_WED_WOIF_TRIGGER_HALT,
++	MTK_WED_WOIF_HALT_DONE,
++};
++
+ enum mtk_wed_dummy_cr_idx {
+ 	MTK_WED_DUMMY_CR_FWDL,
+ 	MTK_WED_DUMMY_CR_WO_STATUS,
+@@ -245,6 +271,8 @@ void mtk_wed_mcu_rx_unsolicited_event(st
+ 				      struct sk_buff *skb);
+ int mtk_wed_mcu_send_msg(struct mtk_wed_wo *wo, int id, int cmd,
+ 			 const void *data, int len, bool wait_resp);
++int mtk_wed_mcu_msg_update(struct mtk_wed_device *dev, int id, void *data,
++			   int len);
+ int mtk_wed_mcu_init(struct mtk_wed_wo *wo);
+ int mtk_wed_wo_init(struct mtk_wed_hw *hw);
+ void mtk_wed_wo_deinit(struct mtk_wed_hw *hw);
+--- a/include/linux/soc/mediatek/mtk_wed.h
++++ b/include/linux/soc/mediatek/mtk_wed.h
+@@ -5,10 +5,13 @@
+ #include <linux/rcupdate.h>
+ #include <linux/regmap.h>
+ #include <linux/pci.h>
++#include <linux/skbuff.h>
+ 
+ #define MTK_WED_TX_QUEUES		2
+ #define MTK_WED_RX_QUEUES		2
+ 
++#define WED_WO_STA_REC			0x6
++
+ struct mtk_wed_hw;
+ struct mtk_wdma_desc;
+ 
+@@ -41,21 +44,37 @@ enum mtk_wed_wo_cmd {
+ 	MTK_WED_WO_CMD_WED_END
+ };
+ 
++struct mtk_rxbm_desc {
++	__le32 buf0;
++	__le32 token;
++} __packed __aligned(4);
++
+ enum mtk_wed_bus_tye {
+ 	MTK_WED_BUS_PCIE,
+ 	MTK_WED_BUS_AXI,
+ };
+ 
++#define MTK_WED_RING_CONFIGURED		BIT(0)
+ struct mtk_wed_ring {
+ 	struct mtk_wdma_desc *desc;
+ 	dma_addr_t desc_phys;
+ 	u32 desc_size;
+ 	int size;
++	u32 flags;
+ 
+ 	u32 reg_base;
+ 	void __iomem *wpdma;
+ };
+ 
++struct mtk_wed_wo_rx_stats {
++	__le16 wlan_idx;
++	__le16 tid;
++	__le32 rx_pkt_cnt;
++	__le32 rx_byte_cnt;
++	__le32 rx_err_cnt;
++	__le32 rx_drop_cnt;
++};
++
+ struct mtk_wed_device {
+ #ifdef CONFIG_NET_MEDIATEK_SOC_WED
+ 	const struct mtk_wed_ops *ops;
+@@ -64,9 +83,12 @@ struct mtk_wed_device {
+ 	bool init_done, running;
+ 	int wdma_idx;
+ 	int irq;
++	u8 version;
+ 
+ 	struct mtk_wed_ring tx_ring[MTK_WED_TX_QUEUES];
++	struct mtk_wed_ring rx_ring[MTK_WED_RX_QUEUES];
+ 	struct mtk_wed_ring txfree_ring;
++	struct mtk_wed_ring tx_wdma[MTK_WED_TX_QUEUES];
+ 	struct mtk_wed_ring rx_wdma[MTK_WED_RX_QUEUES];
+ 
+ 	struct {
+@@ -74,7 +96,20 @@ struct mtk_wed_device {
+ 		void **pages;
+ 		struct mtk_wdma_desc *desc;
+ 		dma_addr_t desc_phys;
+-	} buf_ring;
++	} tx_buf_ring;
++
++	struct {
++		int size;
++		struct page_frag_cache rx_page;
++		struct mtk_rxbm_desc *desc;
++		dma_addr_t desc_phys;
++	} rx_buf_ring;
++
++	struct {
++		struct mtk_wed_ring ring;
++		dma_addr_t miod_phys;
++		dma_addr_t fdbk_phys;
++	} rro;
+ 
+ 	/* filled by driver: */
+ 	struct {
+@@ -83,22 +118,36 @@ struct mtk_wed_device {
+ 			struct pci_dev *pci_dev;
+ 		};
+ 		enum mtk_wed_bus_tye bus_type;
++		void __iomem *base;
++		u32 phy_base;
+ 
+ 		u32 wpdma_phys;
+ 		u32 wpdma_int;
+ 		u32 wpdma_mask;
+ 		u32 wpdma_tx;
+ 		u32 wpdma_txfree;
++		u32 wpdma_rx_glo;
++		u32 wpdma_rx;
++
++		bool wcid_512;
+ 
+ 		u16 token_start;
+ 		unsigned int nbuf;
++		unsigned int rx_nbuf;
++		unsigned int rx_npkt;
++		unsigned int rx_size;
+ 
+ 		u8 tx_tbit[MTK_WED_TX_QUEUES];
++		u8 rx_tbit[MTK_WED_RX_QUEUES];
+ 		u8 txfree_tbit;
+ 
+ 		u32 (*init_buf)(void *ptr, dma_addr_t phys, int token_id);
+ 		int (*offload_enable)(struct mtk_wed_device *wed);
+ 		void (*offload_disable)(struct mtk_wed_device *wed);
++		u32 (*init_rx_buf)(struct mtk_wed_device *wed, int size);
++		void (*release_rx_buf)(struct mtk_wed_device *wed);
++		void (*update_wo_rx_stats)(struct mtk_wed_device *wed,
++					   struct mtk_wed_wo_rx_stats *stats);
+ 	} wlan;
+ #endif
+ };
+@@ -107,9 +156,15 @@ struct mtk_wed_ops {
+ 	int (*attach)(struct mtk_wed_device *dev);
+ 	int (*tx_ring_setup)(struct mtk_wed_device *dev, int ring,
+ 			     void __iomem *regs);
++	int (*rx_ring_setup)(struct mtk_wed_device *dev, int ring,
++			     void __iomem *regs);
+ 	int (*txfree_ring_setup)(struct mtk_wed_device *dev,
+ 				 void __iomem *regs);
++	int (*msg_update)(struct mtk_wed_device *dev, int cmd_id,
++			  void *data, int len);
+ 	void (*detach)(struct mtk_wed_device *dev);
++	void (*ppe_check)(struct mtk_wed_device *dev, struct sk_buff *skb,
++			  u32 reason, u32 hash);
+ 
+ 	void (*stop)(struct mtk_wed_device *dev);
+ 	void (*start)(struct mtk_wed_device *dev, u32 irq_mask);
+@@ -144,6 +199,16 @@ mtk_wed_device_attach(struct mtk_wed_dev
+ 	return ret;
+ }
+ 
++static inline bool
++mtk_wed_get_rx_capa(struct mtk_wed_device *dev)
++{
++#ifdef CONFIG_NET_MEDIATEK_SOC_WED
++	return dev->version != 1;
++#else
++	return false;
++#endif
++}
++
+ #ifdef CONFIG_NET_MEDIATEK_SOC_WED
+ #define mtk_wed_device_active(_dev) !!(_dev)->ops
+ #define mtk_wed_device_detach(_dev) (_dev)->ops->detach(_dev)
+@@ -160,6 +225,12 @@ mtk_wed_device_attach(struct mtk_wed_dev
+ 	(_dev)->ops->irq_get(_dev, _mask)
+ #define mtk_wed_device_irq_set_mask(_dev, _mask) \
+ 	(_dev)->ops->irq_set_mask(_dev, _mask)
++#define mtk_wed_device_rx_ring_setup(_dev, _ring, _regs) \
++	(_dev)->ops->rx_ring_setup(_dev, _ring, _regs)
++#define mtk_wed_device_ppe_check(_dev, _skb, _reason, _hash) \
++	(_dev)->ops->ppe_check(_dev, _skb, _reason, _hash)
++#define mtk_wed_device_update_msg(_dev, _id, _msg, _len) \
++	(_dev)->ops->msg_update(_dev, _id, _msg, _len)
+ #else
+ static inline bool mtk_wed_device_active(struct mtk_wed_device *dev)
+ {
+@@ -173,6 +244,9 @@ static inline bool mtk_wed_device_active
+ #define mtk_wed_device_reg_write(_dev, _reg, _val) do {} while (0)
+ #define mtk_wed_device_irq_get(_dev, _mask) 0
+ #define mtk_wed_device_irq_set_mask(_dev, _mask) do {} while (0)
++#define mtk_wed_device_rx_ring_setup(_dev, _ring, _regs) -ENODEV
++#define mtk_wed_device_ppe_check(_dev, _skb, _reason, _hash)  do {} while (0)
++#define mtk_wed_device_update_msg(_dev, _id, _msg, _len) -ENODEV
+ #endif
+ 
+ #endif
diff --git a/target/linux/generic/backport-5.15/729-05-v6.1-net-ethernet-mtk_wed-add-rx-mib-counters.patch b/target/linux/generic/backport-5.15/729-05-v6.1-net-ethernet-mtk_wed-add-rx-mib-counters.patch
new file mode 100644
index 00000000000000..bb1066deceaa46
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-05-v6.1-net-ethernet-mtk_wed-add-rx-mib-counters.patch
@@ -0,0 +1,149 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 5 Nov 2022 23:36:22 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: add rx mib counters
+
+Introduce WED RX MIB counters support available on MT7986a SoC.
+
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed_debugfs.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_debugfs.c
+@@ -2,6 +2,7 @@
+ /* Copyright (C) 2021 Felix Fietkau <nbd@nbd.name> */
+ 
+ #include <linux/seq_file.h>
++#include <linux/soc/mediatek/mtk_wed.h>
+ #include "mtk_wed.h"
+ #include "mtk_wed_regs.h"
+ 
+@@ -18,6 +19,8 @@ enum {
+ 	DUMP_TYPE_WDMA,
+ 	DUMP_TYPE_WPDMA_TX,
+ 	DUMP_TYPE_WPDMA_TXFREE,
++	DUMP_TYPE_WPDMA_RX,
++	DUMP_TYPE_WED_RRO,
+ };
+ 
+ #define DUMP_STR(_str) { _str, 0, DUMP_TYPE_STRING }
+@@ -36,6 +39,9 @@ enum {
+ 
+ #define DUMP_WPDMA_TX_RING(_n) DUMP_RING("WPDMA_TX" #_n, 0, DUMP_TYPE_WPDMA_TX, _n)
+ #define DUMP_WPDMA_TXFREE_RING DUMP_RING("WPDMA_RX1", 0, DUMP_TYPE_WPDMA_TXFREE)
++#define DUMP_WPDMA_RX_RING(_n)	DUMP_RING("WPDMA_RX" #_n, 0, DUMP_TYPE_WPDMA_RX, _n)
++#define DUMP_WED_RRO_RING(_base)DUMP_RING("WED_RRO_MIOD", MTK_##_base, DUMP_TYPE_WED_RRO)
++#define DUMP_WED_RRO_FDBK(_base)DUMP_RING("WED_RRO_FDBK", MTK_##_base, DUMP_TYPE_WED_RRO)
+ 
+ static void
+ print_reg_val(struct seq_file *s, const char *name, u32 val)
+@@ -57,6 +63,7 @@ dump_wed_regs(struct seq_file *s, struct
+ 				   cur > regs ? "\n" : "",
+ 				   cur->name);
+ 			continue;
++		case DUMP_TYPE_WED_RRO:
+ 		case DUMP_TYPE_WED:
+ 			val = wed_r32(dev, cur->offset);
+ 			break;
+@@ -69,6 +76,9 @@ dump_wed_regs(struct seq_file *s, struct
+ 		case DUMP_TYPE_WPDMA_TXFREE:
+ 			val = wpdma_txfree_r32(dev, cur->offset);
+ 			break;
++		case DUMP_TYPE_WPDMA_RX:
++			val = wpdma_rx_r32(dev, cur->base, cur->offset);
++			break;
+ 		}
+ 		print_reg_val(s, cur->name, val);
+ 	}
+@@ -132,6 +142,80 @@ wed_txinfo_show(struct seq_file *s, void
+ }
+ DEFINE_SHOW_ATTRIBUTE(wed_txinfo);
+ 
++static int
++wed_rxinfo_show(struct seq_file *s, void *data)
++{
++	static const struct reg_dump regs[] = {
++		DUMP_STR("WPDMA RX"),
++		DUMP_WPDMA_RX_RING(0),
++		DUMP_WPDMA_RX_RING(1),
++
++		DUMP_STR("WPDMA RX"),
++		DUMP_WED(WED_WPDMA_RX_D_MIB(0)),
++		DUMP_WED_RING(WED_WPDMA_RING_RX_DATA(0)),
++		DUMP_WED(WED_WPDMA_RX_D_PROCESSED_MIB(0)),
++		DUMP_WED(WED_WPDMA_RX_D_MIB(1)),
++		DUMP_WED_RING(WED_WPDMA_RING_RX_DATA(1)),
++		DUMP_WED(WED_WPDMA_RX_D_PROCESSED_MIB(1)),
++		DUMP_WED(WED_WPDMA_RX_D_COHERENT_MIB),
++
++		DUMP_STR("WED RX"),
++		DUMP_WED_RING(WED_RING_RX_DATA(0)),
++		DUMP_WED_RING(WED_RING_RX_DATA(1)),
++
++		DUMP_STR("WED RRO"),
++		DUMP_WED_RRO_RING(WED_RROQM_MIOD_CTRL0),
++		DUMP_WED(WED_RROQM_MID_MIB),
++		DUMP_WED(WED_RROQM_MOD_MIB),
++		DUMP_WED(WED_RROQM_MOD_COHERENT_MIB),
++		DUMP_WED_RRO_FDBK(WED_RROQM_FDBK_CTRL0),
++		DUMP_WED(WED_RROQM_FDBK_IND_MIB),
++		DUMP_WED(WED_RROQM_FDBK_ENQ_MIB),
++		DUMP_WED(WED_RROQM_FDBK_ANC_MIB),
++		DUMP_WED(WED_RROQM_FDBK_ANC2H_MIB),
++
++		DUMP_STR("WED Route QM"),
++		DUMP_WED(WED_RTQM_R2H_MIB(0)),
++		DUMP_WED(WED_RTQM_R2Q_MIB(0)),
++		DUMP_WED(WED_RTQM_Q2H_MIB(0)),
++		DUMP_WED(WED_RTQM_R2H_MIB(1)),
++		DUMP_WED(WED_RTQM_R2Q_MIB(1)),
++		DUMP_WED(WED_RTQM_Q2H_MIB(1)),
++		DUMP_WED(WED_RTQM_Q2N_MIB),
++		DUMP_WED(WED_RTQM_Q2B_MIB),
++		DUMP_WED(WED_RTQM_PFDBK_MIB),
++
++		DUMP_STR("WED WDMA TX"),
++		DUMP_WED(WED_WDMA_TX_MIB),
++		DUMP_WED_RING(WED_WDMA_RING_TX),
++
++		DUMP_STR("WDMA TX"),
++		DUMP_WDMA(WDMA_GLO_CFG),
++		DUMP_WDMA_RING(WDMA_RING_TX(0)),
++		DUMP_WDMA_RING(WDMA_RING_TX(1)),
++
++		DUMP_STR("WED RX BM"),
++		DUMP_WED(WED_RX_BM_BASE),
++		DUMP_WED(WED_RX_BM_RX_DMAD),
++		DUMP_WED(WED_RX_BM_PTR),
++		DUMP_WED(WED_RX_BM_TKID_MIB),
++		DUMP_WED(WED_RX_BM_BLEN),
++		DUMP_WED(WED_RX_BM_STS),
++		DUMP_WED(WED_RX_BM_INTF2),
++		DUMP_WED(WED_RX_BM_INTF),
++		DUMP_WED(WED_RX_BM_ERR_STS),
++	};
++	struct mtk_wed_hw *hw = s->private;
++	struct mtk_wed_device *dev = hw->wed_dev;
++
++	if (!dev)
++		return 0;
++
++	dump_wed_regs(s, dev, regs, ARRAY_SIZE(regs));
++
++	return 0;
++}
++DEFINE_SHOW_ATTRIBUTE(wed_rxinfo);
+ 
+ static int
+ mtk_wed_reg_set(void *data, u64 val)
+@@ -175,4 +259,7 @@ void mtk_wed_hw_add_debugfs(struct mtk_w
+ 	debugfs_create_u32("regidx", 0600, dir, &hw->debugfs_reg);
+ 	debugfs_create_file_unsafe("regval", 0600, dir, hw, &fops_regval);
+ 	debugfs_create_file_unsafe("txinfo", 0400, dir, hw, &wed_txinfo_fops);
++	if (hw->version != 1)
++		debugfs_create_file_unsafe("rxinfo", 0400, dir, hw,
++					   &wed_rxinfo_fops);
+ }
diff --git a/target/linux/generic/backport-5.15/729-06-v6.1-net-ethernet-mtk_eth_soc-do-not-overwrite-mtu-config.patch b/target/linux/generic/backport-5.15/729-06-v6.1-net-ethernet-mtk_eth_soc-do-not-overwrite-mtu-config.patch
new file mode 100644
index 00000000000000..003ca9bae69969
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-06-v6.1-net-ethernet-mtk_eth_soc-do-not-overwrite-mtu-config.patch
@@ -0,0 +1,98 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 17 Nov 2022 00:35:04 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: do not overwrite mtu
+ configuration running reset routine
+
+Restore user configured MTU running mtk_hw_init() during tx timeout routine
+since it will be overwritten after a hw reset.
+
+Reported-by: Felix Fietkau <nbd@nbd.name>
+Fixes: 9ea4d311509f ("net: ethernet: mediatek: add the whole ethernet reset into the reset process")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3176,6 +3176,30 @@ static void mtk_dim_tx(struct work_struc
+ 	dim->state = DIM_START_MEASURE;
+ }
+ 
++static void mtk_set_mcr_max_rx(struct mtk_mac *mac, u32 val)
++{
++	struct mtk_eth *eth = mac->hw;
++	u32 mcr_cur, mcr_new;
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628))
++		return;
++
++	mcr_cur = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id));
++	mcr_new = mcr_cur & ~MAC_MCR_MAX_RX_MASK;
++
++	if (val <= 1518)
++		mcr_new |= MAC_MCR_MAX_RX(MAC_MCR_MAX_RX_1518);
++	else if (val <= 1536)
++		mcr_new |= MAC_MCR_MAX_RX(MAC_MCR_MAX_RX_1536);
++	else if (val <= 1552)
++		mcr_new |= MAC_MCR_MAX_RX(MAC_MCR_MAX_RX_1552);
++	else
++		mcr_new |= MAC_MCR_MAX_RX(MAC_MCR_MAX_RX_2048);
++
++	if (mcr_new != mcr_cur)
++		mtk_w32(mac->hw, mcr_new, MTK_MAC_MCR(mac->id));
++}
++
+ static int mtk_hw_init(struct mtk_eth *eth)
+ {
+ 	u32 dma_mask = ETHSYS_DMA_AG_MAP_PDMA | ETHSYS_DMA_AG_MAP_QDMA |
+@@ -3250,8 +3274,16 @@ static int mtk_hw_init(struct mtk_eth *e
+ 	 * up with the more appropriate value when mtk_mac_config call is being
+ 	 * invoked.
+ 	 */
+-	for (i = 0; i < MTK_MAC_COUNT; i++)
++	for (i = 0; i < MTK_MAC_COUNT; i++) {
++		struct net_device *dev = eth->netdev[i];
++
+ 		mtk_w32(eth, MAC_MCR_FORCE_LINK_DOWN, MTK_MAC_MCR(i));
++		if (dev) {
++			struct mtk_mac *mac = netdev_priv(dev);
++
++			mtk_set_mcr_max_rx(mac, dev->mtu + MTK_RX_ETH_HLEN);
++		}
++	}
+ 
+ 	/* Indicates CDM to parse the MTK special tag from CPU
+ 	 * which also is working out for untag packets.
+@@ -3367,7 +3399,6 @@ static int mtk_change_mtu(struct net_dev
+ 	int length = new_mtu + MTK_RX_ETH_HLEN;
+ 	struct mtk_mac *mac = netdev_priv(dev);
+ 	struct mtk_eth *eth = mac->hw;
+-	u32 mcr_cur, mcr_new;
+ 
+ 	if (rcu_access_pointer(eth->prog) &&
+ 	    length > MTK_PP_MAX_BUF_SIZE) {
+@@ -3375,23 +3406,7 @@ static int mtk_change_mtu(struct net_dev
+ 		return -EINVAL;
+ 	}
+ 
+-	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628)) {
+-		mcr_cur = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id));
+-		mcr_new = mcr_cur & ~MAC_MCR_MAX_RX_MASK;
+-
+-		if (length <= 1518)
+-			mcr_new |= MAC_MCR_MAX_RX(MAC_MCR_MAX_RX_1518);
+-		else if (length <= 1536)
+-			mcr_new |= MAC_MCR_MAX_RX(MAC_MCR_MAX_RX_1536);
+-		else if (length <= 1552)
+-			mcr_new |= MAC_MCR_MAX_RX(MAC_MCR_MAX_RX_1552);
+-		else
+-			mcr_new |= MAC_MCR_MAX_RX(MAC_MCR_MAX_RX_2048);
+-
+-		if (mcr_new != mcr_cur)
+-			mtk_w32(mac->hw, mcr_new, MTK_MAC_MCR(mac->id));
+-	}
+-
++	mtk_set_mcr_max_rx(mac, length);
+ 	dev->mtu = new_mtu;
+ 
+ 	return 0;
diff --git a/target/linux/generic/backport-5.15/729-07-v6.1-net-ethernet-mtk_eth_soc-remove-cpu_relax-in-mtk_pen.patch b/target/linux/generic/backport-5.15/729-07-v6.1-net-ethernet-mtk_eth_soc-remove-cpu_relax-in-mtk_pen.patch
new file mode 100644
index 00000000000000..342ffb99d2f643
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-07-v6.1-net-ethernet-mtk_eth_soc-remove-cpu_relax-in-mtk_pen.patch
@@ -0,0 +1,36 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 17 Nov 2022 00:58:46 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: remove cpu_relax in
+ mtk_pending_work
+
+Get rid of cpu_relax in mtk_pending_work routine since MTK_RESETTING is
+set only in mtk_pending_work() and it runs holding rtnl lock
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3437,11 +3437,8 @@ static void mtk_pending_work(struct work
+ 	rtnl_lock();
+ 
+ 	dev_dbg(eth->dev, "[%s][%d] reset\n", __func__, __LINE__);
++	set_bit(MTK_RESETTING, &eth->state);
+ 
+-	while (test_and_set_bit_lock(MTK_RESETTING, &eth->state))
+-		cpu_relax();
+-
+-	dev_dbg(eth->dev, "[%s][%d] mtk_stop starts\n", __func__, __LINE__);
+ 	/* stop all devices to make sure that dma is properly shut down */
+ 	for (i = 0; i < MTK_MAC_COUNT; i++) {
+ 		if (!eth->netdev[i])
+@@ -3475,7 +3472,7 @@ static void mtk_pending_work(struct work
+ 
+ 	dev_dbg(eth->dev, "[%s][%d] reset done\n", __func__, __LINE__);
+ 
+-	clear_bit_unlock(MTK_RESETTING, &eth->state);
++	clear_bit(MTK_RESETTING, &eth->state);
+ 
+ 	rtnl_unlock();
+ }
diff --git a/target/linux/generic/backport-5.15/729-08-v6.2-net-ethernet-mtk_eth_soc-fix-RSTCTRL_PPE-0-1-definit.patch b/target/linux/generic/backport-5.15/729-08-v6.2-net-ethernet-mtk_eth_soc-fix-RSTCTRL_PPE-0-1-definit.patch
new file mode 100644
index 00000000000000..12aa3ebf6a7cef
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-08-v6.2-net-ethernet-mtk_eth_soc-fix-RSTCTRL_PPE-0-1-definit.patch
@@ -0,0 +1,63 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 17 Nov 2022 15:29:53 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: fix RSTCTRL_PPE{0,1} definitions
+
+Fix RSTCTRL_PPE0 and RSTCTRL_PPE1 register mask definitions for
+MTK_NETSYS_V2.
+Remove duplicated definitions.
+
+Fixes: 160d3a9b1929 ("net: ethernet: mtk_eth_soc: introduce MTK_NETSYS_V2 support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3239,16 +3239,17 @@ static int mtk_hw_init(struct mtk_eth *e
+ 		return 0;
+ 	}
+ 
+-	val = RSTCTRL_FE | RSTCTRL_PPE;
+ 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+ 		regmap_write(eth->ethsys, ETHSYS_FE_RST_CHK_IDLE_EN, 0);
+-
+-		val |= RSTCTRL_ETH;
+-		if (MTK_HAS_CAPS(eth->soc->caps, MTK_RSTCTRL_PPE1))
+-			val |= RSTCTRL_PPE1;
++		val = RSTCTRL_PPE0_V2;
++	} else {
++		val = RSTCTRL_PPE0;
+ 	}
+ 
+-	ethsys_reset(eth, val);
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_RSTCTRL_PPE1))
++		val |= RSTCTRL_PPE1;
++
++	ethsys_reset(eth, RSTCTRL_ETH | RSTCTRL_FE | val);
+ 
+ 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+ 		regmap_write(eth->ethsys, ETHSYS_FE_RST_CHK_IDLE_EN,
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -445,18 +445,14 @@
+ /* ethernet reset control register */
+ #define ETHSYS_RSTCTRL			0x34
+ #define RSTCTRL_FE			BIT(6)
+-#define RSTCTRL_PPE			BIT(31)
+-#define RSTCTRL_PPE1			BIT(30)
++#define RSTCTRL_PPE0			BIT(31)
++#define RSTCTRL_PPE0_V2			BIT(30)
++#define RSTCTRL_PPE1			BIT(31)
+ #define RSTCTRL_ETH			BIT(23)
+ 
+ /* ethernet reset check idle register */
+ #define ETHSYS_FE_RST_CHK_IDLE_EN	0x28
+ 
+-/* ethernet reset control register */
+-#define ETHSYS_RSTCTRL		0x34
+-#define RSTCTRL_FE		BIT(6)
+-#define RSTCTRL_PPE		BIT(31)
+-
+ /* ethernet dma channel agent map */
+ #define ETHSYS_DMA_AG_MAP	0x408
+ #define ETHSYS_DMA_AG_MAP_PDMA	BIT(0)
diff --git a/target/linux/generic/backport-5.15/729-09-v6.2-net-ethernet-mtk_wed-add-wcid-overwritten-support-fo.patch b/target/linux/generic/backport-5.15/729-09-v6.2-net-ethernet-mtk_wed-add-wcid-overwritten-support-fo.patch
new file mode 100644
index 00000000000000..d91d8299111f29
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-09-v6.2-net-ethernet-mtk_wed-add-wcid-overwritten-support-fo.patch
@@ -0,0 +1,80 @@
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Thu, 24 Nov 2022 11:18:14 +0800
+Subject: [PATCH] net: ethernet: mtk_wed: add wcid overwritten support for wed
+ v1
+
+All wed versions should enable the wcid overwritten feature,
+since the wcid size is controlled by the wlan driver.
+
+Tested-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Co-developed-by: Bo Jiao <bo.jiao@mediatek.com>
+Signed-off-by: Bo Jiao <bo.jiao@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -526,9 +526,9 @@ mtk_wed_dma_disable(struct mtk_wed_devic
+ 			MTK_WED_WPDMA_RX_D_RX_DRV_EN);
+ 		wed_clr(dev, MTK_WED_WDMA_GLO_CFG,
+ 			MTK_WED_WDMA_GLO_CFG_TX_DDONE_CHK);
+-
+-		mtk_wed_set_512_support(dev, false);
+ 	}
++
++	mtk_wed_set_512_support(dev, false);
+ }
+ 
+ static void
+@@ -1297,9 +1297,10 @@ mtk_wed_start(struct mtk_wed_device *dev
+ 		if (mtk_wed_rro_cfg(dev))
+ 			return;
+ 
+-		mtk_wed_set_512_support(dev, dev->wlan.wcid_512);
+ 	}
+ 
++	mtk_wed_set_512_support(dev, dev->wlan.wcid_512);
++
+ 	mtk_wed_dma_enable(dev);
+ 	dev->running = true;
+ }
+@@ -1365,11 +1366,13 @@ mtk_wed_attach(struct mtk_wed_device *de
+ 	}
+ 
+ 	mtk_wed_hw_init_early(dev);
+-	if (hw->version == 1)
++	if (hw->version == 1) {
+ 		regmap_update_bits(hw->hifsys, HIFSYS_DMA_AG_MAP,
+ 				   BIT(hw->index), 0);
+-	else
++	} else {
++		dev->rev_id = wed_r32(dev, MTK_WED_REV_ID);
+ 		ret = mtk_wed_wo_init(hw);
++	}
+ out:
+ 	if (ret)
+ 		mtk_wed_detach(dev);
+--- a/drivers/net/ethernet/mediatek/mtk_wed_regs.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_regs.h
+@@ -20,6 +20,8 @@ struct mtk_wdma_desc {
+ 	__le32 info;
+ } __packed __aligned(4);
+ 
++#define MTK_WED_REV_ID					0x004
++
+ #define MTK_WED_RESET					0x008
+ #define MTK_WED_RESET_TX_BM				BIT(0)
+ #define MTK_WED_RESET_TX_FREE_AGENT			BIT(4)
+--- a/include/linux/soc/mediatek/mtk_wed.h
++++ b/include/linux/soc/mediatek/mtk_wed.h
+@@ -85,6 +85,9 @@ struct mtk_wed_device {
+ 	int irq;
+ 	u8 version;
+ 
++	/* used by wlan driver */
++	u32 rev_id;
++
+ 	struct mtk_wed_ring tx_ring[MTK_WED_TX_QUEUES];
+ 	struct mtk_wed_ring rx_ring[MTK_WED_RX_QUEUES];
+ 	struct mtk_wed_ring txfree_ring;
diff --git a/target/linux/generic/backport-5.15/729-10-v6.2-net-ethernet-mtk_wed-return-status-value-in-mtk_wdma.patch b/target/linux/generic/backport-5.15/729-10-v6.2-net-ethernet-mtk_wed-return-status-value-in-mtk_wdma.patch
new file mode 100644
index 00000000000000..d97bb715e0f3d5
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-10-v6.2-net-ethernet-mtk_wed-return-status-value-in-mtk_wdma.patch
@@ -0,0 +1,85 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 24 Nov 2022 16:22:51 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: return status value in
+ mtk_wdma_rx_reset
+
+Move MTK_WDMA_RESET_IDX configuration in mtk_wdma_rx_reset routine.
+Increase poll timeout to 10ms in order to be aligned with vendor sdk.
+This is a preliminary patch to add Wireless Ethernet Dispatcher reset
+support.
+
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -101,17 +101,21 @@ mtk_wdma_read_reset(struct mtk_wed_devic
+ 	return wdma_r32(dev, MTK_WDMA_GLO_CFG);
+ }
+ 
+-static void
++static int
+ mtk_wdma_rx_reset(struct mtk_wed_device *dev)
+ {
+ 	u32 status, mask = MTK_WDMA_GLO_CFG_RX_DMA_BUSY;
+-	int i;
++	int i, ret;
+ 
+ 	wdma_clr(dev, MTK_WDMA_GLO_CFG, MTK_WDMA_GLO_CFG_RX_DMA_EN);
+-	if (readx_poll_timeout(mtk_wdma_read_reset, dev, status,
+-			       !(status & mask), 0, 1000))
++	ret = readx_poll_timeout(mtk_wdma_read_reset, dev, status,
++				 !(status & mask), 0, 10000);
++	if (ret)
+ 		dev_err(dev->hw->dev, "rx reset failed\n");
+ 
++	wdma_w32(dev, MTK_WDMA_RESET_IDX, MTK_WDMA_RESET_IDX_RX);
++	wdma_w32(dev, MTK_WDMA_RESET_IDX, 0);
++
+ 	for (i = 0; i < ARRAY_SIZE(dev->rx_wdma); i++) {
+ 		if (dev->rx_wdma[i].desc)
+ 			continue;
+@@ -119,6 +123,8 @@ mtk_wdma_rx_reset(struct mtk_wed_device
+ 		wdma_w32(dev,
+ 			 MTK_WDMA_RING_RX(i) + MTK_WED_RING_OFS_CPU_IDX, 0);
+ 	}
++
++	return ret;
+ }
+ 
+ static void
+@@ -565,9 +571,7 @@ mtk_wed_detach(struct mtk_wed_device *de
+ 
+ 	mtk_wed_stop(dev);
+ 
+-	wdma_w32(dev, MTK_WDMA_RESET_IDX, MTK_WDMA_RESET_IDX_RX);
+-	wdma_w32(dev, MTK_WDMA_RESET_IDX, 0);
+-
++	mtk_wdma_rx_reset(dev);
+ 	mtk_wed_reset(dev, MTK_WED_RESET_WED);
+ 	if (mtk_wed_get_rx_capa(dev)) {
+ 		wdma_clr(dev, MTK_WDMA_GLO_CFG, MTK_WDMA_GLO_CFG_TX_DMA_EN);
+@@ -582,7 +586,6 @@ mtk_wed_detach(struct mtk_wed_device *de
+ 		mtk_wed_wo_reset(dev);
+ 		mtk_wed_free_rx_rings(dev);
+ 		mtk_wed_wo_deinit(hw);
+-		mtk_wdma_rx_reset(dev);
+ 	}
+ 
+ 	if (dev->wlan.bus_type == MTK_WED_BUS_PCIE) {
+@@ -1006,11 +1009,7 @@ mtk_wed_reset_dma(struct mtk_wed_device
+ 		wed_w32(dev, MTK_WED_RESET_IDX, 0);
+ 	}
+ 
+-	wdma_w32(dev, MTK_WDMA_RESET_IDX, MTK_WDMA_RESET_IDX_RX);
+-	wdma_w32(dev, MTK_WDMA_RESET_IDX, 0);
+-
+-	if (mtk_wed_get_rx_capa(dev))
+-		mtk_wdma_rx_reset(dev);
++	mtk_wdma_rx_reset(dev);
+ 
+ 	if (busy) {
+ 		mtk_wed_reset(dev, MTK_WED_RESET_WDMA_INT_AGENT);
diff --git a/target/linux/generic/backport-5.15/729-11-v6.2-net-ethernet-mtk_wed-move-MTK_WDMA_RESET_IDX_TX-conf.patch b/target/linux/generic/backport-5.15/729-11-v6.2-net-ethernet-mtk_wed-move-MTK_WDMA_RESET_IDX_TX-conf.patch
new file mode 100644
index 00000000000000..10c1732c969a9b
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-11-v6.2-net-ethernet-mtk_wed-move-MTK_WDMA_RESET_IDX_TX-conf.patch
@@ -0,0 +1,52 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 24 Nov 2022 16:22:52 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: move MTK_WDMA_RESET_IDX_TX
+ configuration in mtk_wdma_tx_reset
+
+Remove duplicated code. Increase poll timeout to 10ms in order to be
+aligned with vendor sdk.
+This is a preliminary patch to add Wireless Ethernet Dispatcher reset
+support.
+
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -135,16 +135,15 @@ mtk_wdma_tx_reset(struct mtk_wed_device
+ 
+ 	wdma_clr(dev, MTK_WDMA_GLO_CFG, MTK_WDMA_GLO_CFG_TX_DMA_EN);
+ 	if (readx_poll_timeout(mtk_wdma_read_reset, dev, status,
+-			       !(status & mask), 0, 1000))
++			       !(status & mask), 0, 10000))
+ 		dev_err(dev->hw->dev, "tx reset failed\n");
+ 
+-	for (i = 0; i < ARRAY_SIZE(dev->tx_wdma); i++) {
+-		if (dev->tx_wdma[i].desc)
+-			continue;
++	wdma_w32(dev, MTK_WDMA_RESET_IDX, MTK_WDMA_RESET_IDX_TX);
++	wdma_w32(dev, MTK_WDMA_RESET_IDX, 0);
+ 
++	for (i = 0; i < ARRAY_SIZE(dev->tx_wdma); i++)
+ 		wdma_w32(dev,
+ 			 MTK_WDMA_RING_TX(i) + MTK_WED_RING_OFS_CPU_IDX, 0);
+-	}
+ }
+ 
+ static void
+@@ -573,12 +572,6 @@ mtk_wed_detach(struct mtk_wed_device *de
+ 
+ 	mtk_wdma_rx_reset(dev);
+ 	mtk_wed_reset(dev, MTK_WED_RESET_WED);
+-	if (mtk_wed_get_rx_capa(dev)) {
+-		wdma_clr(dev, MTK_WDMA_GLO_CFG, MTK_WDMA_GLO_CFG_TX_DMA_EN);
+-		wdma_w32(dev, MTK_WDMA_RESET_IDX, MTK_WDMA_RESET_IDX_TX);
+-		wdma_w32(dev, MTK_WDMA_RESET_IDX, 0);
+-	}
+-
+ 	mtk_wed_free_tx_buffer(dev);
+ 	mtk_wed_free_tx_rings(dev);
+ 
diff --git a/target/linux/generic/backport-5.15/729-12-v6.2-net-ethernet-mtk_wed-update-mtk_wed_stop.patch b/target/linux/generic/backport-5.15/729-12-v6.2-net-ethernet-mtk_wed-update-mtk_wed_stop.patch
new file mode 100644
index 00000000000000..dfc0f8c3f382b8
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-12-v6.2-net-ethernet-mtk_wed-update-mtk_wed_stop.patch
@@ -0,0 +1,98 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 24 Nov 2022 16:22:53 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: update mtk_wed_stop
+
+Update mtk_wed_stop routine and rename old mtk_wed_stop() to
+mtk_wed_deinit(). This is a preliminary patch to add Wireless Ethernet
+Dispatcher reset support.
+
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -539,14 +539,8 @@ mtk_wed_dma_disable(struct mtk_wed_devic
+ static void
+ mtk_wed_stop(struct mtk_wed_device *dev)
+ {
+-	mtk_wed_dma_disable(dev);
+ 	mtk_wed_set_ext_int(dev, false);
+ 
+-	wed_clr(dev, MTK_WED_CTRL,
+-		MTK_WED_CTRL_WDMA_INT_AGENT_EN |
+-		MTK_WED_CTRL_WPDMA_INT_AGENT_EN |
+-		MTK_WED_CTRL_WED_TX_BM_EN |
+-		MTK_WED_CTRL_WED_TX_FREE_AGENT_EN);
+ 	wed_w32(dev, MTK_WED_WPDMA_INT_TRIGGER, 0);
+ 	wed_w32(dev, MTK_WED_WDMA_INT_TRIGGER, 0);
+ 	wdma_w32(dev, MTK_WDMA_INT_MASK, 0);
+@@ -558,7 +552,27 @@ mtk_wed_stop(struct mtk_wed_device *dev)
+ 
+ 	wed_w32(dev, MTK_WED_EXT_INT_MASK1, 0);
+ 	wed_w32(dev, MTK_WED_EXT_INT_MASK2, 0);
+-	wed_clr(dev, MTK_WED_CTRL, MTK_WED_CTRL_WED_RX_BM_EN);
++}
++
++static void
++mtk_wed_deinit(struct mtk_wed_device *dev)
++{
++	mtk_wed_stop(dev);
++	mtk_wed_dma_disable(dev);
++
++	wed_clr(dev, MTK_WED_CTRL,
++		MTK_WED_CTRL_WDMA_INT_AGENT_EN |
++		MTK_WED_CTRL_WPDMA_INT_AGENT_EN |
++		MTK_WED_CTRL_WED_TX_BM_EN |
++		MTK_WED_CTRL_WED_TX_FREE_AGENT_EN);
++
++	if (dev->hw->version == 1)
++		return;
++
++	wed_clr(dev, MTK_WED_CTRL,
++		MTK_WED_CTRL_RX_ROUTE_QM_EN |
++		MTK_WED_CTRL_WED_RX_BM_EN |
++		MTK_WED_CTRL_RX_RRO_QM_EN);
+ }
+ 
+ static void
+@@ -568,7 +582,7 @@ mtk_wed_detach(struct mtk_wed_device *de
+ 
+ 	mutex_lock(&hw_lock);
+ 
+-	mtk_wed_stop(dev);
++	mtk_wed_deinit(dev);
+ 
+ 	mtk_wdma_rx_reset(dev);
+ 	mtk_wed_reset(dev, MTK_WED_RESET_WED);
+@@ -677,7 +691,7 @@ mtk_wed_hw_init_early(struct mtk_wed_dev
+ {
+ 	u32 mask, set;
+ 
+-	mtk_wed_stop(dev);
++	mtk_wed_deinit(dev);
+ 	mtk_wed_reset(dev, MTK_WED_RESET_WED);
+ 	mtk_wed_set_wpdma(dev);
+ 
+--- a/include/linux/soc/mediatek/mtk_wed.h
++++ b/include/linux/soc/mediatek/mtk_wed.h
+@@ -234,6 +234,8 @@ mtk_wed_get_rx_capa(struct mtk_wed_devic
+ 	(_dev)->ops->ppe_check(_dev, _skb, _reason, _hash)
+ #define mtk_wed_device_update_msg(_dev, _id, _msg, _len) \
+ 	(_dev)->ops->msg_update(_dev, _id, _msg, _len)
++#define mtk_wed_device_stop(_dev) (_dev)->ops->stop(_dev)
++#define mtk_wed_device_dma_reset(_dev) (_dev)->ops->reset_dma(_dev)
+ #else
+ static inline bool mtk_wed_device_active(struct mtk_wed_device *dev)
+ {
+@@ -250,6 +252,8 @@ static inline bool mtk_wed_device_active
+ #define mtk_wed_device_rx_ring_setup(_dev, _ring, _regs) -ENODEV
+ #define mtk_wed_device_ppe_check(_dev, _skb, _reason, _hash)  do {} while (0)
+ #define mtk_wed_device_update_msg(_dev, _id, _msg, _len) -ENODEV
++#define mtk_wed_device_stop(_dev) do {} while (0)
++#define mtk_wed_device_dma_reset(_dev) do {} while (0)
+ #endif
+ 
+ #endif
diff --git a/target/linux/generic/backport-5.15/729-13-v6.2-net-ethernet-mtk_wed-add-mtk_wed_rx_reset-routine.patch b/target/linux/generic/backport-5.15/729-13-v6.2-net-ethernet-mtk_wed-add-mtk_wed_rx_reset-routine.patch
new file mode 100644
index 00000000000000..2205fea513d857
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-13-v6.2-net-ethernet-mtk_wed-add-mtk_wed_rx_reset-routine.patch
@@ -0,0 +1,309 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 24 Nov 2022 16:22:54 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: add mtk_wed_rx_reset routine
+
+Introduce mtk_wed_rx_reset routine in order to reset rx DMA for Wireless
+Ethernet Dispatcher available on MT7986 SoC.
+
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -951,42 +951,130 @@ mtk_wed_ring_reset(struct mtk_wed_ring *
+ }
+ 
+ static u32
+-mtk_wed_check_busy(struct mtk_wed_device *dev)
++mtk_wed_check_busy(struct mtk_wed_device *dev, u32 reg, u32 mask)
+ {
+-	if (wed_r32(dev, MTK_WED_GLO_CFG) & MTK_WED_GLO_CFG_TX_DMA_BUSY)
+-		return true;
+-
+-	if (wed_r32(dev, MTK_WED_WPDMA_GLO_CFG) &
+-	    MTK_WED_WPDMA_GLO_CFG_TX_DRV_BUSY)
+-		return true;
+-
+-	if (wed_r32(dev, MTK_WED_CTRL) & MTK_WED_CTRL_WDMA_INT_AGENT_BUSY)
+-		return true;
+-
+-	if (wed_r32(dev, MTK_WED_WDMA_GLO_CFG) &
+-	    MTK_WED_WDMA_GLO_CFG_RX_DRV_BUSY)
+-		return true;
+-
+-	if (wdma_r32(dev, MTK_WDMA_GLO_CFG) &
+-	    MTK_WED_WDMA_GLO_CFG_RX_DRV_BUSY)
+-		return true;
+-
+-	if (wed_r32(dev, MTK_WED_CTRL) &
+-	    (MTK_WED_CTRL_WED_TX_BM_BUSY | MTK_WED_CTRL_WED_TX_FREE_AGENT_BUSY))
+-		return true;
+-
+-	return false;
++	return !!(wed_r32(dev, reg) & mask);
+ }
+ 
+ static int
+-mtk_wed_poll_busy(struct mtk_wed_device *dev)
++mtk_wed_poll_busy(struct mtk_wed_device *dev, u32 reg, u32 mask)
+ {
+ 	int sleep = 15000;
+ 	int timeout = 100 * sleep;
+ 	u32 val;
+ 
+ 	return read_poll_timeout(mtk_wed_check_busy, val, !val, sleep,
+-				 timeout, false, dev);
++				 timeout, false, dev, reg, mask);
++}
++
++static int
++mtk_wed_rx_reset(struct mtk_wed_device *dev)
++{
++	struct mtk_wed_wo *wo = dev->hw->wed_wo;
++	u8 val = MTK_WED_WO_STATE_SER_RESET;
++	int i, ret;
++
++	ret = mtk_wed_mcu_send_msg(wo, MTK_WED_MODULE_ID_WO,
++				   MTK_WED_WO_CMD_CHANGE_STATE, &val,
++				   sizeof(val), true);
++	if (ret)
++		return ret;
++
++	wed_clr(dev, MTK_WED_WPDMA_RX_D_GLO_CFG, MTK_WED_WPDMA_RX_D_RX_DRV_EN);
++	ret = mtk_wed_poll_busy(dev, MTK_WED_WPDMA_RX_D_GLO_CFG,
++				MTK_WED_WPDMA_RX_D_RX_DRV_BUSY);
++	if (ret) {
++		mtk_wed_reset(dev, MTK_WED_RESET_WPDMA_INT_AGENT);
++		mtk_wed_reset(dev, MTK_WED_RESET_WPDMA_RX_D_DRV);
++	} else {
++		wed_w32(dev, MTK_WED_WPDMA_RX_D_RST_IDX,
++			MTK_WED_WPDMA_RX_D_RST_CRX_IDX |
++			MTK_WED_WPDMA_RX_D_RST_DRV_IDX);
++
++		wed_set(dev, MTK_WED_WPDMA_RX_D_GLO_CFG,
++			MTK_WED_WPDMA_RX_D_RST_INIT_COMPLETE |
++			MTK_WED_WPDMA_RX_D_FSM_RETURN_IDLE);
++		wed_clr(dev, MTK_WED_WPDMA_RX_D_GLO_CFG,
++			MTK_WED_WPDMA_RX_D_RST_INIT_COMPLETE |
++			MTK_WED_WPDMA_RX_D_FSM_RETURN_IDLE);
++
++		wed_w32(dev, MTK_WED_WPDMA_RX_D_RST_IDX, 0);
++	}
++
++	/* reset rro qm */
++	wed_clr(dev, MTK_WED_CTRL, MTK_WED_CTRL_RX_RRO_QM_EN);
++	ret = mtk_wed_poll_busy(dev, MTK_WED_CTRL,
++				MTK_WED_CTRL_RX_RRO_QM_BUSY);
++	if (ret) {
++		mtk_wed_reset(dev, MTK_WED_RESET_RX_RRO_QM);
++	} else {
++		wed_set(dev, MTK_WED_RROQM_RST_IDX,
++			MTK_WED_RROQM_RST_IDX_MIOD |
++			MTK_WED_RROQM_RST_IDX_FDBK);
++		wed_w32(dev, MTK_WED_RROQM_RST_IDX, 0);
++	}
++
++	/* reset route qm */
++	wed_clr(dev, MTK_WED_CTRL, MTK_WED_CTRL_RX_ROUTE_QM_EN);
++	ret = mtk_wed_poll_busy(dev, MTK_WED_CTRL,
++				MTK_WED_CTRL_RX_ROUTE_QM_BUSY);
++	if (ret)
++		mtk_wed_reset(dev, MTK_WED_RESET_RX_ROUTE_QM);
++	else
++		wed_set(dev, MTK_WED_RTQM_GLO_CFG,
++			MTK_WED_RTQM_Q_RST);
++
++	/* reset tx wdma */
++	mtk_wdma_tx_reset(dev);
++
++	/* reset tx wdma drv */
++	wed_clr(dev, MTK_WED_WDMA_GLO_CFG, MTK_WED_WDMA_GLO_CFG_TX_DRV_EN);
++	mtk_wed_poll_busy(dev, MTK_WED_CTRL,
++			  MTK_WED_CTRL_WDMA_INT_AGENT_BUSY);
++	mtk_wed_reset(dev, MTK_WED_RESET_WDMA_TX_DRV);
++
++	/* reset wed rx dma */
++	ret = mtk_wed_poll_busy(dev, MTK_WED_GLO_CFG,
++				MTK_WED_GLO_CFG_RX_DMA_BUSY);
++	wed_clr(dev, MTK_WED_GLO_CFG, MTK_WED_GLO_CFG_RX_DMA_EN);
++	if (ret) {
++		mtk_wed_reset(dev, MTK_WED_RESET_WED_RX_DMA);
++	} else {
++		struct mtk_eth *eth = dev->hw->eth;
++
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++			wed_set(dev, MTK_WED_RESET_IDX,
++				MTK_WED_RESET_IDX_RX_V2);
++		else
++			wed_set(dev, MTK_WED_RESET_IDX, MTK_WED_RESET_IDX_RX);
++		wed_w32(dev, MTK_WED_RESET_IDX, 0);
++	}
++
++	/* reset rx bm */
++	wed_clr(dev, MTK_WED_CTRL, MTK_WED_CTRL_WED_RX_BM_EN);
++	mtk_wed_poll_busy(dev, MTK_WED_CTRL,
++			  MTK_WED_CTRL_WED_RX_BM_BUSY);
++	mtk_wed_reset(dev, MTK_WED_RESET_RX_BM);
++
++	/* wo change to enable state */
++	val = MTK_WED_WO_STATE_ENABLE;
++	ret = mtk_wed_mcu_send_msg(wo, MTK_WED_MODULE_ID_WO,
++				   MTK_WED_WO_CMD_CHANGE_STATE, &val,
++				   sizeof(val), true);
++	if (ret)
++		return ret;
++
++	/* wed_rx_ring_reset */
++	for (i = 0; i < ARRAY_SIZE(dev->rx_ring); i++) {
++		if (!dev->rx_ring[i].desc)
++			continue;
++
++		mtk_wed_ring_reset(&dev->rx_ring[i], MTK_WED_RX_RING_SIZE,
++				   false);
++	}
++	mtk_wed_free_rx_buffer(dev);
++
++	return 0;
+ }
+ 
+ static void
+@@ -1004,19 +1092,23 @@ mtk_wed_reset_dma(struct mtk_wed_device
+ 				   true);
+ 	}
+ 
+-	if (mtk_wed_poll_busy(dev))
+-		busy = mtk_wed_check_busy(dev);
+-
++	/* 1. reset WED tx DMA */
++	wed_clr(dev, MTK_WED_GLO_CFG, MTK_WED_GLO_CFG_TX_DMA_EN);
++	busy = mtk_wed_poll_busy(dev, MTK_WED_GLO_CFG,
++				 MTK_WED_GLO_CFG_TX_DMA_BUSY);
+ 	if (busy) {
+ 		mtk_wed_reset(dev, MTK_WED_RESET_WED_TX_DMA);
+ 	} else {
+-		wed_w32(dev, MTK_WED_RESET_IDX,
+-			MTK_WED_RESET_IDX_TX |
+-			MTK_WED_RESET_IDX_RX);
++		wed_w32(dev, MTK_WED_RESET_IDX, MTK_WED_RESET_IDX_TX);
+ 		wed_w32(dev, MTK_WED_RESET_IDX, 0);
+ 	}
+ 
+-	mtk_wdma_rx_reset(dev);
++	/* 2. reset WDMA rx DMA */
++	busy = !!mtk_wdma_rx_reset(dev);
++	wed_clr(dev, MTK_WED_WDMA_GLO_CFG, MTK_WED_WDMA_GLO_CFG_RX_DRV_EN);
++	if (!busy)
++		busy = mtk_wed_poll_busy(dev, MTK_WED_WDMA_GLO_CFG,
++					 MTK_WED_WDMA_GLO_CFG_RX_DRV_BUSY);
+ 
+ 	if (busy) {
+ 		mtk_wed_reset(dev, MTK_WED_RESET_WDMA_INT_AGENT);
+@@ -1033,6 +1125,9 @@ mtk_wed_reset_dma(struct mtk_wed_device
+ 			MTK_WED_WDMA_GLO_CFG_RST_INIT_COMPLETE);
+ 	}
+ 
++	/* 3. reset WED WPDMA tx */
++	wed_clr(dev, MTK_WED_CTRL, MTK_WED_CTRL_WED_TX_FREE_AGENT_EN);
++
+ 	for (i = 0; i < 100; i++) {
+ 		val = wed_r32(dev, MTK_WED_TX_BM_INTF);
+ 		if (FIELD_GET(MTK_WED_TX_BM_INTF_TKFIFO_FDEP, val) == 0x40)
+@@ -1040,8 +1135,19 @@ mtk_wed_reset_dma(struct mtk_wed_device
+ 	}
+ 
+ 	mtk_wed_reset(dev, MTK_WED_RESET_TX_FREE_AGENT);
++	wed_clr(dev, MTK_WED_CTRL, MTK_WED_CTRL_WED_TX_BM_EN);
+ 	mtk_wed_reset(dev, MTK_WED_RESET_TX_BM);
+ 
++	/* 4. reset WED WPDMA tx */
++	busy = mtk_wed_poll_busy(dev, MTK_WED_WPDMA_GLO_CFG,
++				 MTK_WED_WPDMA_GLO_CFG_TX_DRV_BUSY);
++	wed_clr(dev, MTK_WED_WPDMA_GLO_CFG,
++		MTK_WED_WPDMA_GLO_CFG_TX_DRV_EN |
++		MTK_WED_WPDMA_GLO_CFG_RX_DRV_EN);
++	if (!busy)
++		busy = mtk_wed_poll_busy(dev, MTK_WED_WPDMA_GLO_CFG,
++					 MTK_WED_WPDMA_GLO_CFG_RX_DRV_BUSY);
++
+ 	if (busy) {
+ 		mtk_wed_reset(dev, MTK_WED_RESET_WPDMA_INT_AGENT);
+ 		mtk_wed_reset(dev, MTK_WED_RESET_WPDMA_TX_DRV);
+@@ -1052,6 +1158,17 @@ mtk_wed_reset_dma(struct mtk_wed_device
+ 			MTK_WED_WPDMA_RESET_IDX_RX);
+ 		wed_w32(dev, MTK_WED_WPDMA_RESET_IDX, 0);
+ 	}
++
++	dev->init_done = false;
++	if (dev->hw->version == 1)
++		return;
++
++	if (!busy) {
++		wed_w32(dev, MTK_WED_RESET_IDX, MTK_WED_RESET_WPDMA_IDX_RX);
++		wed_w32(dev, MTK_WED_RESET_IDX, 0);
++	}
++
++	mtk_wed_rx_reset(dev);
+ }
+ 
+ static int
+@@ -1274,6 +1391,9 @@ mtk_wed_start(struct mtk_wed_device *dev
+ {
+ 	int i;
+ 
++	if (mtk_wed_get_rx_capa(dev) && mtk_wed_rx_buffer_alloc(dev))
++		return;
++
+ 	for (i = 0; i < ARRAY_SIZE(dev->rx_wdma); i++)
+ 		if (!dev->rx_wdma[i].desc)
+ 			mtk_wed_wdma_rx_ring_setup(dev, i, 16);
+@@ -1362,10 +1482,6 @@ mtk_wed_attach(struct mtk_wed_device *de
+ 		goto out;
+ 
+ 	if (mtk_wed_get_rx_capa(dev)) {
+-		ret = mtk_wed_rx_buffer_alloc(dev);
+-		if (ret)
+-			goto out;
+-
+ 		ret = mtk_wed_rro_alloc(dev);
+ 		if (ret)
+ 			goto out;
+--- a/drivers/net/ethernet/mediatek/mtk_wed_regs.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_regs.h
+@@ -24,11 +24,15 @@ struct mtk_wdma_desc {
+ 
+ #define MTK_WED_RESET					0x008
+ #define MTK_WED_RESET_TX_BM				BIT(0)
++#define MTK_WED_RESET_RX_BM				BIT(1)
+ #define MTK_WED_RESET_TX_FREE_AGENT			BIT(4)
+ #define MTK_WED_RESET_WPDMA_TX_DRV			BIT(8)
+ #define MTK_WED_RESET_WPDMA_RX_DRV			BIT(9)
++#define MTK_WED_RESET_WPDMA_RX_D_DRV			BIT(10)
+ #define MTK_WED_RESET_WPDMA_INT_AGENT			BIT(11)
+ #define MTK_WED_RESET_WED_TX_DMA			BIT(12)
++#define MTK_WED_RESET_WED_RX_DMA			BIT(13)
++#define MTK_WED_RESET_WDMA_TX_DRV			BIT(16)
+ #define MTK_WED_RESET_WDMA_RX_DRV			BIT(17)
+ #define MTK_WED_RESET_WDMA_INT_AGENT			BIT(19)
+ #define MTK_WED_RESET_RX_RRO_QM				BIT(20)
+@@ -158,6 +162,8 @@ struct mtk_wdma_desc {
+ #define MTK_WED_RESET_IDX				0x20c
+ #define MTK_WED_RESET_IDX_TX				GENMASK(3, 0)
+ #define MTK_WED_RESET_IDX_RX				GENMASK(17, 16)
++#define MTK_WED_RESET_IDX_RX_V2				GENMASK(7, 6)
++#define MTK_WED_RESET_WPDMA_IDX_RX			GENMASK(31, 30)
+ 
+ #define MTK_WED_TX_MIB(_n)				(0x2a0 + (_n) * 4)
+ #define MTK_WED_RX_MIB(_n)				(0x2e0 + (_n) * 4)
+@@ -267,6 +273,9 @@ struct mtk_wdma_desc {
+ 
+ #define MTK_WED_WPDMA_RX_D_GLO_CFG			0x75c
+ #define MTK_WED_WPDMA_RX_D_RX_DRV_EN			BIT(0)
++#define MTK_WED_WPDMA_RX_D_RX_DRV_BUSY			BIT(1)
++#define MTK_WED_WPDMA_RX_D_FSM_RETURN_IDLE		BIT(3)
++#define MTK_WED_WPDMA_RX_D_RST_INIT_COMPLETE		BIT(4)
+ #define MTK_WED_WPDMA_RX_D_INIT_PHASE_RXEN_SEL		GENMASK(11, 7)
+ #define MTK_WED_WPDMA_RX_D_RXD_READ_LEN			GENMASK(31, 24)
+ 
diff --git a/target/linux/generic/backport-5.15/729-14-v6.2-net-ethernet-mtk_wed-add-reset-to-tx_ring_setup-call.patch b/target/linux/generic/backport-5.15/729-14-v6.2-net-ethernet-mtk_wed-add-reset-to-tx_ring_setup-call.patch
new file mode 100644
index 00000000000000..602483bcb8d393
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-14-v6.2-net-ethernet-mtk_wed-add-reset-to-tx_ring_setup-call.patch
@@ -0,0 +1,103 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 24 Nov 2022 16:22:55 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: add reset to tx_ring_setup callback
+
+Introduce reset parameter to mtk_wed_tx_ring_setup signature.
+This is a preliminary patch to add Wireless Ethernet Dispatcher reset
+support.
+
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -1188,7 +1188,8 @@ mtk_wed_ring_alloc(struct mtk_wed_device
+ }
+ 
+ static int
+-mtk_wed_wdma_rx_ring_setup(struct mtk_wed_device *dev, int idx, int size)
++mtk_wed_wdma_rx_ring_setup(struct mtk_wed_device *dev, int idx, int size,
++			   bool reset)
+ {
+ 	u32 desc_size = sizeof(struct mtk_wdma_desc) * dev->hw->version;
+ 	struct mtk_wed_ring *wdma;
+@@ -1197,8 +1198,8 @@ mtk_wed_wdma_rx_ring_setup(struct mtk_we
+ 		return -EINVAL;
+ 
+ 	wdma = &dev->rx_wdma[idx];
+-	if (mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE, desc_size,
+-			       true))
++	if (!reset && mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE,
++					 desc_size, true))
+ 		return -ENOMEM;
+ 
+ 	wdma_w32(dev, MTK_WDMA_RING_RX(idx) + MTK_WED_RING_OFS_BASE,
+@@ -1396,7 +1397,7 @@ mtk_wed_start(struct mtk_wed_device *dev
+ 
+ 	for (i = 0; i < ARRAY_SIZE(dev->rx_wdma); i++)
+ 		if (!dev->rx_wdma[i].desc)
+-			mtk_wed_wdma_rx_ring_setup(dev, i, 16);
++			mtk_wed_wdma_rx_ring_setup(dev, i, 16, false);
+ 
+ 	mtk_wed_hw_init(dev);
+ 	mtk_wed_configure_irq(dev, irq_mask);
+@@ -1505,7 +1506,8 @@ unlock:
+ }
+ 
+ static int
+-mtk_wed_tx_ring_setup(struct mtk_wed_device *dev, int idx, void __iomem *regs)
++mtk_wed_tx_ring_setup(struct mtk_wed_device *dev, int idx, void __iomem *regs,
++		      bool reset)
+ {
+ 	struct mtk_wed_ring *ring = &dev->tx_ring[idx];
+ 
+@@ -1524,11 +1526,12 @@ mtk_wed_tx_ring_setup(struct mtk_wed_dev
+ 	if (WARN_ON(idx >= ARRAY_SIZE(dev->tx_ring)))
+ 		return -EINVAL;
+ 
+-	if (mtk_wed_ring_alloc(dev, ring, MTK_WED_TX_RING_SIZE,
+-			       sizeof(*ring->desc), true))
++	if (!reset && mtk_wed_ring_alloc(dev, ring, MTK_WED_TX_RING_SIZE,
++					 sizeof(*ring->desc), true))
+ 		return -ENOMEM;
+ 
+-	if (mtk_wed_wdma_rx_ring_setup(dev, idx, MTK_WED_WDMA_RING_SIZE))
++	if (mtk_wed_wdma_rx_ring_setup(dev, idx, MTK_WED_WDMA_RING_SIZE,
++				       reset))
+ 		return -ENOMEM;
+ 
+ 	ring->reg_base = MTK_WED_RING_TX(idx);
+--- a/include/linux/soc/mediatek/mtk_wed.h
++++ b/include/linux/soc/mediatek/mtk_wed.h
+@@ -158,7 +158,7 @@ struct mtk_wed_device {
+ struct mtk_wed_ops {
+ 	int (*attach)(struct mtk_wed_device *dev);
+ 	int (*tx_ring_setup)(struct mtk_wed_device *dev, int ring,
+-			     void __iomem *regs);
++			     void __iomem *regs, bool reset);
+ 	int (*rx_ring_setup)(struct mtk_wed_device *dev, int ring,
+ 			     void __iomem *regs);
+ 	int (*txfree_ring_setup)(struct mtk_wed_device *dev,
+@@ -216,8 +216,8 @@ mtk_wed_get_rx_capa(struct mtk_wed_devic
+ #define mtk_wed_device_active(_dev) !!(_dev)->ops
+ #define mtk_wed_device_detach(_dev) (_dev)->ops->detach(_dev)
+ #define mtk_wed_device_start(_dev, _mask) (_dev)->ops->start(_dev, _mask)
+-#define mtk_wed_device_tx_ring_setup(_dev, _ring, _regs) \
+-	(_dev)->ops->tx_ring_setup(_dev, _ring, _regs)
++#define mtk_wed_device_tx_ring_setup(_dev, _ring, _regs, _reset) \
++	(_dev)->ops->tx_ring_setup(_dev, _ring, _regs, _reset)
+ #define mtk_wed_device_txfree_ring_setup(_dev, _regs) \
+ 	(_dev)->ops->txfree_ring_setup(_dev, _regs)
+ #define mtk_wed_device_reg_read(_dev, _reg) \
+@@ -243,7 +243,7 @@ static inline bool mtk_wed_device_active
+ }
+ #define mtk_wed_device_detach(_dev) do {} while (0)
+ #define mtk_wed_device_start(_dev, _mask) do {} while (0)
+-#define mtk_wed_device_tx_ring_setup(_dev, _ring, _regs) -ENODEV
++#define mtk_wed_device_tx_ring_setup(_dev, _ring, _regs, _reset) -ENODEV
+ #define mtk_wed_device_txfree_ring_setup(_dev, _ring, _regs) -ENODEV
+ #define mtk_wed_device_reg_read(_dev, _reg) 0
+ #define mtk_wed_device_reg_write(_dev, _reg, _val) do {} while (0)
diff --git a/target/linux/generic/backport-5.15/729-15-v6.2-net-ethernet-mtk_wed-fix-sleep-while-atomic-in-mtk_w.patch b/target/linux/generic/backport-5.15/729-15-v6.2-net-ethernet-mtk_wed-fix-sleep-while-atomic-in-mtk_w.patch
new file mode 100644
index 00000000000000..f9b11326b1c88e
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-15-v6.2-net-ethernet-mtk_wed-fix-sleep-while-atomic-in-mtk_w.patch
@@ -0,0 +1,103 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 1 Dec 2022 16:26:53 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: fix sleep while atomic in
+ mtk_wed_wo_queue_refill
+
+In order to fix the following sleep while atomic bug always alloc pages
+with GFP_ATOMIC in mtk_wed_wo_queue_refill since page_frag_alloc runs in
+spin_lock critical section.
+
+[    9.049719] Hardware name: MediaTek MT7986a RFB (DT)
+[    9.054665] Call trace:
+[    9.057096]  dump_backtrace+0x0/0x154
+[    9.060751]  show_stack+0x14/0x1c
+[    9.064052]  dump_stack_lvl+0x64/0x7c
+[    9.067702]  dump_stack+0x14/0x2c
+[    9.071001]  ___might_sleep+0xec/0x120
+[    9.074736]  __might_sleep+0x4c/0x9c
+[    9.078296]  __alloc_pages+0x184/0x2e4
+[    9.082030]  page_frag_alloc_align+0x98/0x1ac
+[    9.086369]  mtk_wed_wo_queue_refill+0x134/0x234
+[    9.090974]  mtk_wed_wo_init+0x174/0x2c0
+[    9.094881]  mtk_wed_attach+0x7c8/0x7e0
+[    9.098701]  mt7915_mmio_wed_init+0x1f0/0x3a0 [mt7915e]
+[    9.103940]  mt7915_pci_probe+0xec/0x3bc [mt7915e]
+[    9.108727]  pci_device_probe+0xac/0x13c
+[    9.112638]  really_probe.part.0+0x98/0x2f4
+[    9.116807]  __driver_probe_device+0x94/0x13c
+[    9.121147]  driver_probe_device+0x40/0x114
+[    9.125314]  __driver_attach+0x7c/0x180
+[    9.129133]  bus_for_each_dev+0x5c/0x90
+[    9.132953]  driver_attach+0x20/0x2c
+[    9.136513]  bus_add_driver+0x104/0x1fc
+[    9.140333]  driver_register+0x74/0x120
+[    9.144153]  __pci_register_driver+0x40/0x50
+[    9.148407]  mt7915_init+0x5c/0x1000 [mt7915e]
+[    9.152848]  do_one_initcall+0x40/0x25c
+[    9.156669]  do_init_module+0x44/0x230
+[    9.160403]  load_module+0x1f30/0x2750
+[    9.164135]  __do_sys_init_module+0x150/0x200
+[    9.168475]  __arm64_sys_init_module+0x18/0x20
+[    9.172901]  invoke_syscall.constprop.0+0x4c/0xe0
+[    9.177589]  do_el0_svc+0x48/0xe0
+[    9.180889]  el0_svc+0x14/0x50
+[    9.183929]  el0t_64_sync_handler+0x9c/0x120
+[    9.188183]  el0t_64_sync+0x158/0x15c
+
+Fixes: 799684448e3e ("net: ethernet: mtk_wed: introduce wed wo support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Link: https://lore.kernel.org/r/67ca94bdd3d9eaeb86e52b3050fbca0bcf7bb02f.1669908312.git.lorenzo@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed_wo.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.c
+@@ -133,17 +133,18 @@ mtk_wed_wo_dequeue(struct mtk_wed_wo *wo
+ 
+ static int
+ mtk_wed_wo_queue_refill(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q,
+-			gfp_t gfp, bool rx)
++			bool rx)
+ {
+ 	enum dma_data_direction dir = rx ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
+ 	int n_buf = 0;
+ 
+ 	spin_lock_bh(&q->lock);
+ 	while (q->queued < q->n_desc) {
+-		void *buf = page_frag_alloc(&q->cache, q->buf_size, gfp);
+ 		struct mtk_wed_wo_queue_entry *entry;
+ 		dma_addr_t addr;
++		void *buf;
+ 
++		buf = page_frag_alloc(&q->cache, q->buf_size, GFP_ATOMIC);
+ 		if (!buf)
+ 			break;
+ 
+@@ -215,7 +216,7 @@ mtk_wed_wo_rx_run_queue(struct mtk_wed_w
+ 			mtk_wed_mcu_rx_unsolicited_event(wo, skb);
+ 	}
+ 
+-	if (mtk_wed_wo_queue_refill(wo, q, GFP_ATOMIC, true)) {
++	if (mtk_wed_wo_queue_refill(wo, q, true)) {
+ 		u32 index = (q->head - 1) % q->n_desc;
+ 
+ 		mtk_wed_wo_queue_kick(wo, q, index);
+@@ -432,7 +433,7 @@ mtk_wed_wo_hardware_init(struct mtk_wed_
+ 	if (ret)
+ 		goto error;
+ 
+-	mtk_wed_wo_queue_refill(wo, &wo->q_tx, GFP_KERNEL, false);
++	mtk_wed_wo_queue_refill(wo, &wo->q_tx, false);
+ 	mtk_wed_wo_queue_reset(wo, &wo->q_tx);
+ 
+ 	regs.desc_base = MTK_WED_WO_CCIF_DUMMY5;
+@@ -446,7 +447,7 @@ mtk_wed_wo_hardware_init(struct mtk_wed_
+ 	if (ret)
+ 		goto error;
+ 
+-	mtk_wed_wo_queue_refill(wo, &wo->q_rx, GFP_KERNEL, true);
++	mtk_wed_wo_queue_refill(wo, &wo->q_rx, true);
+ 	mtk_wed_wo_queue_reset(wo, &wo->q_rx);
+ 
+ 	/* rx queue irqmask */
diff --git a/target/linux/generic/backport-5.15/729-16-v6.3-net-ethernet-mtk_wed-get-rid-of-queue-lock-for-rx-qu.patch b/target/linux/generic/backport-5.15/729-16-v6.3-net-ethernet-mtk_wed-get-rid-of-queue-lock-for-rx-qu.patch
new file mode 100644
index 00000000000000..fa6f56dbe7249d
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-16-v6.3-net-ethernet-mtk_wed-get-rid-of-queue-lock-for-rx-qu.patch
@@ -0,0 +1,52 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 10 Jan 2023 10:31:26 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: get rid of queue lock for rx queue
+
+Queue spinlock is currently held in mtk_wed_wo_queue_rx_clean and
+mtk_wed_wo_queue_refill routines for MTK Wireless Ethernet Dispatcher
+MCU rx queue. mtk_wed_wo_queue_refill() is running during initialization
+and in rx tasklet while mtk_wed_wo_queue_rx_clean() is running in
+mtk_wed_wo_hw_deinit() during hw de-init phase after rx tasklet has been
+disabled. Since mtk_wed_wo_queue_rx_clean and mtk_wed_wo_queue_refill
+routines can't run concurrently get rid of spinlock for mcu rx queue.
+
+Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/36ec3b729542ea60898471d890796f745479ba32.1673342990.git.lorenzo@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed_wo.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.c
+@@ -138,7 +138,6 @@ mtk_wed_wo_queue_refill(struct mtk_wed_w
+ 	enum dma_data_direction dir = rx ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
+ 	int n_buf = 0;
+ 
+-	spin_lock_bh(&q->lock);
+ 	while (q->queued < q->n_desc) {
+ 		struct mtk_wed_wo_queue_entry *entry;
+ 		dma_addr_t addr;
+@@ -172,7 +171,6 @@ mtk_wed_wo_queue_refill(struct mtk_wed_w
+ 		q->queued++;
+ 		n_buf++;
+ 	}
+-	spin_unlock_bh(&q->lock);
+ 
+ 	return n_buf;
+ }
+@@ -316,7 +314,6 @@ mtk_wed_wo_queue_rx_clean(struct mtk_wed
+ {
+ 	struct page *page;
+ 
+-	spin_lock_bh(&q->lock);
+ 	for (;;) {
+ 		void *buf = mtk_wed_wo_dequeue(wo, q, NULL, true);
+ 
+@@ -325,7 +322,6 @@ mtk_wed_wo_queue_rx_clean(struct mtk_wed
+ 
+ 		skb_free_frag(buf);
+ 	}
+-	spin_unlock_bh(&q->lock);
+ 
+ 	if (!q->cache.va)
+ 		return;
diff --git a/target/linux/generic/backport-5.15/729-17-v6.3-net-ethernet-mtk_wed-get-rid-of-queue-lock-for-tx-qu.patch b/target/linux/generic/backport-5.15/729-17-v6.3-net-ethernet-mtk_wed-get-rid-of-queue-lock-for-tx-qu.patch
new file mode 100644
index 00000000000000..9b1e4c3250705f
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-17-v6.3-net-ethernet-mtk_wed-get-rid-of-queue-lock-for-tx-qu.patch
@@ -0,0 +1,75 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 12 Jan 2023 10:21:29 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: get rid of queue lock for tx queue
+
+Similar to MTK Wireless Ethernet Dispatcher (WED) MCU rx queue,
+we do not need to protect WED MCU tx queue with a spin lock since
+the tx queue is accessed in the two following routines:
+- mtk_wed_wo_queue_tx_skb():
+  it is run at initialization and during mt7915 normal operation.
+  Moreover MCU messages are serialized through MCU mutex.
+- mtk_wed_wo_queue_tx_clean():
+  it runs just at mt7915 driver module unload when no more messages
+  are sent to the MCU.
+
+Remove tx queue spinlock.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/7bd0337b2a13ab1a63673b7c03fd35206b3b284e.1673515140.git.lorenzo@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed_wo.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.c
+@@ -258,7 +258,6 @@ mtk_wed_wo_queue_alloc(struct mtk_wed_wo
+ 		       int n_desc, int buf_size, int index,
+ 		       struct mtk_wed_wo_queue_regs *regs)
+ {
+-	spin_lock_init(&q->lock);
+ 	q->regs = *regs;
+ 	q->n_desc = n_desc;
+ 	q->buf_size = buf_size;
+@@ -290,7 +289,6 @@ mtk_wed_wo_queue_tx_clean(struct mtk_wed
+ 	struct page *page;
+ 	int i;
+ 
+-	spin_lock_bh(&q->lock);
+ 	for (i = 0; i < q->n_desc; i++) {
+ 		struct mtk_wed_wo_queue_entry *entry = &q->entry[i];
+ 
+@@ -299,7 +297,6 @@ mtk_wed_wo_queue_tx_clean(struct mtk_wed
+ 		skb_free_frag(entry->buf);
+ 		entry->buf = NULL;
+ 	}
+-	spin_unlock_bh(&q->lock);
+ 
+ 	if (!q->cache.va)
+ 		return;
+@@ -347,8 +344,6 @@ int mtk_wed_wo_queue_tx_skb(struct mtk_w
+ 	int ret = 0, index;
+ 	u32 ctrl;
+ 
+-	spin_lock_bh(&q->lock);
+-
+ 	q->tail = mtk_wed_mmio_r32(wo, q->regs.dma_idx);
+ 	index = (q->head + 1) % q->n_desc;
+ 	if (q->tail == index) {
+@@ -379,8 +374,6 @@ int mtk_wed_wo_queue_tx_skb(struct mtk_w
+ 	mtk_wed_wo_queue_kick(wo, q, q->head);
+ 	mtk_wed_wo_kickout(wo);
+ out:
+-	spin_unlock_bh(&q->lock);
+-
+ 	dev_kfree_skb(skb);
+ 
+ 	return ret;
+--- a/drivers/net/ethernet/mediatek/mtk_wed_wo.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.h
+@@ -211,7 +211,6 @@ struct mtk_wed_wo_queue {
+ 	struct mtk_wed_wo_queue_regs regs;
+ 
+ 	struct page_frag_cache cache;
+-	spinlock_t lock;
+ 
+ 	struct mtk_wed_wo_queue_desc *desc;
+ 	dma_addr_t desc_dma;
diff --git a/target/linux/generic/backport-5.15/729-18-v6.3-net-ethernet-mtk_eth_soc-introduce-mtk_hw_reset-util.patch b/target/linux/generic/backport-5.15/729-18-v6.3-net-ethernet-mtk_eth_soc-introduce-mtk_hw_reset-util.patch
new file mode 100644
index 00000000000000..45b85c06cb529d
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-18-v6.3-net-ethernet-mtk_eth_soc-introduce-mtk_hw_reset-util.patch
@@ -0,0 +1,70 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 14 Jan 2023 18:01:28 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: introduce mtk_hw_reset utility
+ routine
+
+This is a preliminary patch to add Wireless Ethernet Dispatcher reset
+support.
+
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3200,6 +3200,27 @@ static void mtk_set_mcr_max_rx(struct mt
+ 		mtk_w32(mac->hw, mcr_new, MTK_MAC_MCR(mac->id));
+ }
+ 
++static void mtk_hw_reset(struct mtk_eth *eth)
++{
++	u32 val;
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++		regmap_write(eth->ethsys, ETHSYS_FE_RST_CHK_IDLE_EN, 0);
++		val = RSTCTRL_PPE0_V2;
++	} else {
++		val = RSTCTRL_PPE0;
++	}
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_RSTCTRL_PPE1))
++		val |= RSTCTRL_PPE1;
++
++	ethsys_reset(eth, RSTCTRL_ETH | RSTCTRL_FE | val);
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++		regmap_write(eth->ethsys, ETHSYS_FE_RST_CHK_IDLE_EN,
++			     0x3ffffff);
++}
++
+ static int mtk_hw_init(struct mtk_eth *eth)
+ {
+ 	u32 dma_mask = ETHSYS_DMA_AG_MAP_PDMA | ETHSYS_DMA_AG_MAP_QDMA |
+@@ -3239,22 +3260,9 @@ static int mtk_hw_init(struct mtk_eth *e
+ 		return 0;
+ 	}
+ 
+-	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+-		regmap_write(eth->ethsys, ETHSYS_FE_RST_CHK_IDLE_EN, 0);
+-		val = RSTCTRL_PPE0_V2;
+-	} else {
+-		val = RSTCTRL_PPE0;
+-	}
+-
+-	if (MTK_HAS_CAPS(eth->soc->caps, MTK_RSTCTRL_PPE1))
+-		val |= RSTCTRL_PPE1;
+-
+-	ethsys_reset(eth, RSTCTRL_ETH | RSTCTRL_FE | val);
++	mtk_hw_reset(eth);
+ 
+ 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+-		regmap_write(eth->ethsys, ETHSYS_FE_RST_CHK_IDLE_EN,
+-			     0x3ffffff);
+-
+ 		/* Set FE to PDMAv2 if necessary */
+ 		val = mtk_r32(eth, MTK_FE_GLO_MISC);
+ 		mtk_w32(eth,  val | BIT(4), MTK_FE_GLO_MISC);
diff --git a/target/linux/generic/backport-5.15/729-19-v6.3-net-ethernet-mtk_eth_soc-introduce-mtk_hw_warm_reset.patch b/target/linux/generic/backport-5.15/729-19-v6.3-net-ethernet-mtk_eth_soc-introduce-mtk_hw_warm_reset.patch
new file mode 100644
index 00000000000000..c34e30c773e0a4
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-19-v6.3-net-ethernet-mtk_eth_soc-introduce-mtk_hw_warm_reset.patch
@@ -0,0 +1,107 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 14 Jan 2023 18:01:29 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: introduce mtk_hw_warm_reset
+ support
+
+Introduce mtk_hw_warm_reset utility routine. This is a preliminary patch
+to align reset procedure to vendor sdk and avoid to power down the chip
+during hw reset.
+
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3221,7 +3221,54 @@ static void mtk_hw_reset(struct mtk_eth
+ 			     0x3ffffff);
+ }
+ 
+-static int mtk_hw_init(struct mtk_eth *eth)
++static u32 mtk_hw_reset_read(struct mtk_eth *eth)
++{
++	u32 val;
++
++	regmap_read(eth->ethsys, ETHSYS_RSTCTRL, &val);
++	return val;
++}
++
++static void mtk_hw_warm_reset(struct mtk_eth *eth)
++{
++	u32 rst_mask, val;
++
++	regmap_update_bits(eth->ethsys, ETHSYS_RSTCTRL, RSTCTRL_FE,
++			   RSTCTRL_FE);
++	if (readx_poll_timeout_atomic(mtk_hw_reset_read, eth, val,
++				      val & RSTCTRL_FE, 1, 1000)) {
++		dev_err(eth->dev, "warm reset failed\n");
++		mtk_hw_reset(eth);
++		return;
++	}
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++		rst_mask = RSTCTRL_ETH | RSTCTRL_PPE0_V2;
++	else
++		rst_mask = RSTCTRL_ETH | RSTCTRL_PPE0;
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_RSTCTRL_PPE1))
++		rst_mask |= RSTCTRL_PPE1;
++
++	regmap_update_bits(eth->ethsys, ETHSYS_RSTCTRL, rst_mask, rst_mask);
++
++	udelay(1);
++	val = mtk_hw_reset_read(eth);
++	if (!(val & rst_mask))
++		dev_err(eth->dev, "warm reset stage0 failed %08x (%08x)\n",
++			val, rst_mask);
++
++	rst_mask |= RSTCTRL_FE;
++	regmap_update_bits(eth->ethsys, ETHSYS_RSTCTRL, rst_mask, ~rst_mask);
++
++	udelay(1);
++	val = mtk_hw_reset_read(eth);
++	if (val & rst_mask)
++		dev_err(eth->dev, "warm reset stage1 failed %08x (%08x)\n",
++			val, rst_mask);
++}
++
++static int mtk_hw_init(struct mtk_eth *eth, bool reset)
+ {
+ 	u32 dma_mask = ETHSYS_DMA_AG_MAP_PDMA | ETHSYS_DMA_AG_MAP_QDMA |
+ 		       ETHSYS_DMA_AG_MAP_PPE;
+@@ -3260,7 +3307,12 @@ static int mtk_hw_init(struct mtk_eth *e
+ 		return 0;
+ 	}
+ 
+-	mtk_hw_reset(eth);
++	msleep(100);
++
++	if (reset)
++		mtk_hw_warm_reset(eth);
++	else
++		mtk_hw_reset(eth);
+ 
+ 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+ 		/* Set FE to PDMAv2 if necessary */
+@@ -3465,7 +3517,7 @@ static void mtk_pending_work(struct work
+ 	if (eth->dev->pins)
+ 		pinctrl_select_state(eth->dev->pins->p,
+ 				     eth->dev->pins->default_state);
+-	mtk_hw_init(eth);
++	mtk_hw_init(eth, true);
+ 
+ 	/* restart DMA and enable IRQs */
+ 	for (i = 0; i < MTK_MAC_COUNT; i++) {
+@@ -4057,7 +4109,7 @@ static int mtk_probe(struct platform_dev
+ 	eth->msg_enable = netif_msg_init(mtk_msg_level, MTK_DEFAULT_MSG_ENABLE);
+ 	INIT_WORK(&eth->pending_work, mtk_pending_work);
+ 
+-	err = mtk_hw_init(eth);
++	err = mtk_hw_init(eth, false);
+ 	if (err)
+ 		goto err_wed_exit;
+ 
diff --git a/target/linux/generic/backport-5.15/729-20-v6.3-net-ethernet-mtk_eth_soc-align-reset-procedure-to-ve.patch b/target/linux/generic/backport-5.15/729-20-v6.3-net-ethernet-mtk_eth_soc-align-reset-procedure-to-ve.patch
new file mode 100644
index 00000000000000..29a5b6273900b2
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-20-v6.3-net-ethernet-mtk_eth_soc-align-reset-procedure-to-ve.patch
@@ -0,0 +1,262 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 14 Jan 2023 18:01:30 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: align reset procedure to vendor
+ sdk
+
+Avoid to power-down the ethernet chip during hw reset and align reset
+procedure to vendor sdk.
+
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -2786,14 +2786,29 @@ static void mtk_dma_free(struct mtk_eth
+ 	kfree(eth->scratch_head);
+ }
+ 
++static bool mtk_hw_reset_check(struct mtk_eth *eth)
++{
++	u32 val = mtk_r32(eth, MTK_INT_STATUS2);
++
++	return (val & MTK_FE_INT_FQ_EMPTY) || (val & MTK_FE_INT_RFIFO_UF) ||
++	       (val & MTK_FE_INT_RFIFO_OV) || (val & MTK_FE_INT_TSO_FAIL) ||
++	       (val & MTK_FE_INT_TSO_ALIGN) || (val & MTK_FE_INT_TSO_ILLEGAL);
++}
++
+ static void mtk_tx_timeout(struct net_device *dev, unsigned int txqueue)
+ {
+ 	struct mtk_mac *mac = netdev_priv(dev);
+ 	struct mtk_eth *eth = mac->hw;
+ 
++	if (test_bit(MTK_RESETTING, &eth->state))
++		return;
++
++	if (!mtk_hw_reset_check(eth))
++		return;
++
+ 	eth->netdev[mac->id]->stats.tx_errors++;
+-	netif_err(eth, tx_err, dev,
+-		  "transmit timed out\n");
++	netif_err(eth, tx_err, dev, "transmit timed out\n");
++
+ 	schedule_work(&eth->pending_work);
+ }
+ 
+@@ -3275,15 +3290,17 @@ static int mtk_hw_init(struct mtk_eth *e
+ 	const struct mtk_reg_map *reg_map = eth->soc->reg_map;
+ 	int i, val, ret;
+ 
+-	if (test_and_set_bit(MTK_HW_INIT, &eth->state))
++	if (!reset && test_and_set_bit(MTK_HW_INIT, &eth->state))
+ 		return 0;
+ 
+-	pm_runtime_enable(eth->dev);
+-	pm_runtime_get_sync(eth->dev);
++	if (!reset) {
++		pm_runtime_enable(eth->dev);
++		pm_runtime_get_sync(eth->dev);
+ 
+-	ret = mtk_clk_enable(eth);
+-	if (ret)
+-		goto err_disable_pm;
++		ret = mtk_clk_enable(eth);
++		if (ret)
++			goto err_disable_pm;
++	}
+ 
+ 	if (eth->ethsys)
+ 		regmap_update_bits(eth->ethsys, ETHSYS_DMA_AG_MAP, dma_mask,
+@@ -3409,8 +3426,10 @@ static int mtk_hw_init(struct mtk_eth *e
+ 	return 0;
+ 
+ err_disable_pm:
+-	pm_runtime_put_sync(eth->dev);
+-	pm_runtime_disable(eth->dev);
++	if (!reset) {
++		pm_runtime_put_sync(eth->dev);
++		pm_runtime_disable(eth->dev);
++	}
+ 
+ 	return ret;
+ }
+@@ -3489,30 +3508,53 @@ static int mtk_do_ioctl(struct net_devic
+ 	return -EOPNOTSUPP;
+ }
+ 
++static void mtk_prepare_for_reset(struct mtk_eth *eth)
++{
++	u32 val;
++	int i;
++
++	/* disabe FE P3 and P4 */
++	val = mtk_r32(eth, MTK_FE_GLO_CFG) | MTK_FE_LINK_DOWN_P3;
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_RSTCTRL_PPE1))
++		val |= MTK_FE_LINK_DOWN_P4;
++	mtk_w32(eth, val, MTK_FE_GLO_CFG);
++
++	/* adjust PPE configurations to prepare for reset */
++	for (i = 0; i < ARRAY_SIZE(eth->ppe); i++)
++		mtk_ppe_prepare_reset(eth->ppe[i]);
++
++	/* disable NETSYS interrupts */
++	mtk_w32(eth, 0, MTK_FE_INT_ENABLE);
++
++	/* force link down GMAC */
++	for (i = 0; i < 2; i++) {
++		val = mtk_r32(eth, MTK_MAC_MCR(i)) & ~MAC_MCR_FORCE_LINK;
++		mtk_w32(eth, val, MTK_MAC_MCR(i));
++	}
++}
++
+ static void mtk_pending_work(struct work_struct *work)
+ {
+ 	struct mtk_eth *eth = container_of(work, struct mtk_eth, pending_work);
+-	int err, i;
+ 	unsigned long restart = 0;
++	u32 val;
++	int i;
+ 
+ 	rtnl_lock();
+-
+-	dev_dbg(eth->dev, "[%s][%d] reset\n", __func__, __LINE__);
+ 	set_bit(MTK_RESETTING, &eth->state);
+ 
++	mtk_prepare_for_reset(eth);
++
+ 	/* stop all devices to make sure that dma is properly shut down */
+ 	for (i = 0; i < MTK_MAC_COUNT; i++) {
+-		if (!eth->netdev[i])
++		if (!eth->netdev[i] || !netif_running(eth->netdev[i]))
+ 			continue;
++
+ 		mtk_stop(eth->netdev[i]);
+ 		__set_bit(i, &restart);
+ 	}
+-	dev_dbg(eth->dev, "[%s][%d] mtk_stop ends\n", __func__, __LINE__);
+ 
+-	/* restart underlying hardware such as power, clock, pin mux
+-	 * and the connected phy
+-	 */
+-	mtk_hw_deinit(eth);
++	usleep_range(15000, 16000);
+ 
+ 	if (eth->dev->pins)
+ 		pinctrl_select_state(eth->dev->pins->p,
+@@ -3523,15 +3565,19 @@ static void mtk_pending_work(struct work
+ 	for (i = 0; i < MTK_MAC_COUNT; i++) {
+ 		if (!test_bit(i, &restart))
+ 			continue;
+-		err = mtk_open(eth->netdev[i]);
+-		if (err) {
++
++		if (mtk_open(eth->netdev[i])) {
+ 			netif_alert(eth, ifup, eth->netdev[i],
+-			      "Driver up/down cycle failed, closing device.\n");
++				    "Driver up/down cycle failed\n");
+ 			dev_close(eth->netdev[i]);
+ 		}
+ 	}
+ 
+-	dev_dbg(eth->dev, "[%s][%d] reset done\n", __func__, __LINE__);
++	/* enabe FE P3 and P4 */
++	val = mtk_r32(eth, MTK_FE_GLO_CFG) & ~MTK_FE_LINK_DOWN_P3;
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_RSTCTRL_PPE1))
++		val &= ~MTK_FE_LINK_DOWN_P4;
++	mtk_w32(eth, val, MTK_FE_GLO_CFG);
+ 
+ 	clear_bit(MTK_RESETTING, &eth->state);
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -72,12 +72,24 @@
+ #define	MTK_HW_LRO_REPLACE_DELTA	1000
+ #define	MTK_HW_LRO_SDL_REMAIN_ROOM	1522
+ 
++/* Frame Engine Global Configuration */
++#define MTK_FE_GLO_CFG		0x00
++#define MTK_FE_LINK_DOWN_P3	BIT(11)
++#define MTK_FE_LINK_DOWN_P4	BIT(12)
++
+ /* Frame Engine Global Reset Register */
+ #define MTK_RST_GL		0x04
+ #define RST_GL_PSE		BIT(0)
+ 
+ /* Frame Engine Interrupt Status Register */
+ #define MTK_INT_STATUS2		0x08
++#define MTK_FE_INT_ENABLE	0x0c
++#define MTK_FE_INT_FQ_EMPTY	BIT(8)
++#define MTK_FE_INT_TSO_FAIL	BIT(12)
++#define MTK_FE_INT_TSO_ILLEGAL	BIT(13)
++#define MTK_FE_INT_TSO_ALIGN	BIT(14)
++#define MTK_FE_INT_RFIFO_OV	BIT(18)
++#define MTK_FE_INT_RFIFO_UF	BIT(19)
+ #define MTK_GDM1_AF		BIT(28)
+ #define MTK_GDM2_AF		BIT(29)
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -716,6 +716,33 @@ int mtk_foe_entry_idle_time(struct mtk_p
+ 	return __mtk_foe_entry_idle_time(ppe, entry->data.ib1);
+ }
+ 
++int mtk_ppe_prepare_reset(struct mtk_ppe *ppe)
++{
++	if (!ppe)
++		return -EINVAL;
++
++	/* disable KA */
++	ppe_clear(ppe, MTK_PPE_TB_CFG, MTK_PPE_TB_CFG_KEEPALIVE);
++	ppe_clear(ppe, MTK_PPE_BIND_LMT1, MTK_PPE_NTU_KEEPALIVE);
++	ppe_w32(ppe, MTK_PPE_KEEPALIVE, 0);
++	usleep_range(10000, 11000);
++
++	/* set KA timer to maximum */
++	ppe_set(ppe, MTK_PPE_BIND_LMT1, MTK_PPE_NTU_KEEPALIVE);
++	ppe_w32(ppe, MTK_PPE_KEEPALIVE, 0xffffffff);
++
++	/* set KA tick select */
++	ppe_set(ppe, MTK_PPE_TB_CFG, MTK_PPE_TB_TICK_SEL);
++	ppe_set(ppe, MTK_PPE_TB_CFG, MTK_PPE_TB_CFG_KEEPALIVE);
++	usleep_range(10000, 11000);
++
++	/* disable scan mode */
++	ppe_clear(ppe, MTK_PPE_TB_CFG, MTK_PPE_TB_CFG_SCAN_MODE);
++	usleep_range(10000, 11000);
++
++	return mtk_ppe_wait_busy(ppe);
++}
++
+ struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base,
+ 			     int version, int index)
+ {
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h
+@@ -306,6 +306,7 @@ struct mtk_ppe *mtk_ppe_init(struct mtk_
+ 			     int version, int index);
+ void mtk_ppe_start(struct mtk_ppe *ppe);
+ int mtk_ppe_stop(struct mtk_ppe *ppe);
++int mtk_ppe_prepare_reset(struct mtk_ppe *ppe);
+ 
+ void __mtk_ppe_check_skb(struct mtk_ppe *ppe, struct sk_buff *skb, u16 hash);
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_regs.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_regs.h
+@@ -58,6 +58,12 @@
+ #define MTK_PPE_TB_CFG_SCAN_MODE		GENMASK(17, 16)
+ #define MTK_PPE_TB_CFG_HASH_DEBUG		GENMASK(19, 18)
+ #define MTK_PPE_TB_CFG_INFO_SEL			BIT(20)
++#define MTK_PPE_TB_TICK_SEL			BIT(24)
++
++#define MTK_PPE_BIND_LMT1			0x230
++#define MTK_PPE_NTU_KEEPALIVE			GENMASK(23, 16)
++
++#define MTK_PPE_KEEPALIVE			0x234
+ 
+ enum {
+ 	MTK_PPE_SCAN_MODE_DISABLED,
diff --git a/target/linux/generic/backport-5.15/729-21-v6.3-net-ethernet-mtk_eth_soc-add-dma-checks-to-mtk_hw_re.patch b/target/linux/generic/backport-5.15/729-21-v6.3-net-ethernet-mtk_eth_soc-add-dma-checks-to-mtk_hw_re.patch
new file mode 100644
index 00000000000000..cebb750bf64e39
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-21-v6.3-net-ethernet-mtk_eth_soc-add-dma-checks-to-mtk_hw_re.patch
@@ -0,0 +1,249 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 14 Jan 2023 18:01:31 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: add dma checks to
+ mtk_hw_reset_check
+
+Introduce mtk_hw_check_dma_hang routine to monitor possible dma hangs.
+
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -50,6 +50,7 @@ static const struct mtk_reg_map mtk_reg_
+ 		.delay_irq	= 0x0a0c,
+ 		.irq_status	= 0x0a20,
+ 		.irq_mask	= 0x0a28,
++		.adma_rx_dbg0	= 0x0a38,
+ 		.int_grp	= 0x0a50,
+ 	},
+ 	.qdma = {
+@@ -79,6 +80,8 @@ static const struct mtk_reg_map mtk_reg_
+ 		[0]		= 0x2800,
+ 		[1]		= 0x2c00,
+ 	},
++	.pse_iq_sta		= 0x0110,
++	.pse_oq_sta		= 0x0118,
+ };
+ 
+ static const struct mtk_reg_map mt7628_reg_map = {
+@@ -109,6 +112,7 @@ static const struct mtk_reg_map mt7986_r
+ 		.delay_irq	= 0x620c,
+ 		.irq_status	= 0x6220,
+ 		.irq_mask	= 0x6228,
++		.adma_rx_dbg0	= 0x6238,
+ 		.int_grp	= 0x6250,
+ 	},
+ 	.qdma = {
+@@ -138,6 +142,8 @@ static const struct mtk_reg_map mt7986_r
+ 		[0]		= 0x4800,
+ 		[1]		= 0x4c00,
+ 	},
++	.pse_iq_sta		= 0x0180,
++	.pse_oq_sta		= 0x01a0,
+ };
+ 
+ /* strings used by ethtool */
+@@ -3283,6 +3289,102 @@ static void mtk_hw_warm_reset(struct mtk
+ 			val, rst_mask);
+ }
+ 
++static bool mtk_hw_check_dma_hang(struct mtk_eth *eth)
++{
++	const struct mtk_reg_map *reg_map = eth->soc->reg_map;
++	bool gmac1_tx, gmac2_tx, gdm1_tx, gdm2_tx;
++	bool oq_hang, cdm1_busy, adma_busy;
++	bool wtx_busy, cdm_full, oq_free;
++	u32 wdidx, val, gdm1_fc, gdm2_fc;
++	bool qfsm_hang, qfwd_hang;
++	bool ret = false;
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628))
++		return false;
++
++	/* WDMA sanity checks */
++	wdidx = mtk_r32(eth, reg_map->wdma_base[0] + 0xc);
++
++	val = mtk_r32(eth, reg_map->wdma_base[0] + 0x204);
++	wtx_busy = FIELD_GET(MTK_TX_DMA_BUSY, val);
++
++	val = mtk_r32(eth, reg_map->wdma_base[0] + 0x230);
++	cdm_full = !FIELD_GET(MTK_CDM_TXFIFO_RDY, val);
++
++	oq_free  = (!(mtk_r32(eth, reg_map->pse_oq_sta) & GENMASK(24, 16)) &&
++		    !(mtk_r32(eth, reg_map->pse_oq_sta + 0x4) & GENMASK(8, 0)) &&
++		    !(mtk_r32(eth, reg_map->pse_oq_sta + 0x10) & GENMASK(24, 16)));
++
++	if (wdidx == eth->reset.wdidx && wtx_busy && cdm_full && oq_free) {
++		if (++eth->reset.wdma_hang_count > 2) {
++			eth->reset.wdma_hang_count = 0;
++			ret = true;
++		}
++		goto out;
++	}
++
++	/* QDMA sanity checks */
++	qfsm_hang = !!mtk_r32(eth, reg_map->qdma.qtx_cfg + 0x234);
++	qfwd_hang = !mtk_r32(eth, reg_map->qdma.qtx_cfg + 0x308);
++
++	gdm1_tx = FIELD_GET(GENMASK(31, 16), mtk_r32(eth, MTK_FE_GDM1_FSM)) > 0;
++	gdm2_tx = FIELD_GET(GENMASK(31, 16), mtk_r32(eth, MTK_FE_GDM2_FSM)) > 0;
++	gmac1_tx = FIELD_GET(GENMASK(31, 24), mtk_r32(eth, MTK_MAC_FSM(0))) != 1;
++	gmac2_tx = FIELD_GET(GENMASK(31, 24), mtk_r32(eth, MTK_MAC_FSM(1))) != 1;
++	gdm1_fc = mtk_r32(eth, reg_map->gdm1_cnt + 0x24);
++	gdm2_fc = mtk_r32(eth, reg_map->gdm1_cnt + 0x64);
++
++	if (qfsm_hang && qfwd_hang &&
++	    ((gdm1_tx && gmac1_tx && gdm1_fc < 1) ||
++	     (gdm2_tx && gmac2_tx && gdm2_fc < 1))) {
++		if (++eth->reset.qdma_hang_count > 2) {
++			eth->reset.qdma_hang_count = 0;
++			ret = true;
++		}
++		goto out;
++	}
++
++	/* ADMA sanity checks */
++	oq_hang = !!(mtk_r32(eth, reg_map->pse_oq_sta) & GENMASK(8, 0));
++	cdm1_busy = !!(mtk_r32(eth, MTK_FE_CDM1_FSM) & GENMASK(31, 16));
++	adma_busy = !(mtk_r32(eth, reg_map->pdma.adma_rx_dbg0) & GENMASK(4, 0)) &&
++		    !(mtk_r32(eth, reg_map->pdma.adma_rx_dbg0) & BIT(6));
++
++	if (oq_hang && cdm1_busy && adma_busy) {
++		if (++eth->reset.adma_hang_count > 2) {
++			eth->reset.adma_hang_count = 0;
++			ret = true;
++		}
++		goto out;
++	}
++
++	eth->reset.wdma_hang_count = 0;
++	eth->reset.qdma_hang_count = 0;
++	eth->reset.adma_hang_count = 0;
++out:
++	eth->reset.wdidx = wdidx;
++
++	return ret;
++}
++
++static void mtk_hw_reset_monitor_work(struct work_struct *work)
++{
++	struct delayed_work *del_work = to_delayed_work(work);
++	struct mtk_eth *eth = container_of(del_work, struct mtk_eth,
++					   reset.monitor_work);
++
++	if (test_bit(MTK_RESETTING, &eth->state))
++		goto out;
++
++	/* DMA stuck checks */
++	if (mtk_hw_check_dma_hang(eth))
++		schedule_work(&eth->pending_work);
++
++out:
++	schedule_delayed_work(&eth->reset.monitor_work,
++			      MTK_DMA_MONITOR_TIMEOUT);
++}
++
+ static int mtk_hw_init(struct mtk_eth *eth, bool reset)
+ {
+ 	u32 dma_mask = ETHSYS_DMA_AG_MAP_PDMA | ETHSYS_DMA_AG_MAP_QDMA |
+@@ -3615,6 +3717,7 @@ static int mtk_cleanup(struct mtk_eth *e
+ 	mtk_unreg_dev(eth);
+ 	mtk_free_dev(eth);
+ 	cancel_work_sync(&eth->pending_work);
++	cancel_delayed_work_sync(&eth->reset.monitor_work);
+ 
+ 	return 0;
+ }
+@@ -4042,6 +4145,7 @@ static int mtk_probe(struct platform_dev
+ 
+ 	eth->rx_dim.mode = DIM_CQ_PERIOD_MODE_START_FROM_EQE;
+ 	INIT_WORK(&eth->rx_dim.work, mtk_dim_rx);
++	INIT_DELAYED_WORK(&eth->reset.monitor_work, mtk_hw_reset_monitor_work);
+ 
+ 	eth->tx_dim.mode = DIM_CQ_PERIOD_MODE_START_FROM_EQE;
+ 	INIT_WORK(&eth->tx_dim.work, mtk_dim_tx);
+@@ -4246,6 +4350,8 @@ static int mtk_probe(struct platform_dev
+ 		       NAPI_POLL_WEIGHT);
+ 
+ 	platform_set_drvdata(pdev, eth);
++	schedule_delayed_work(&eth->reset.monitor_work,
++			      MTK_DMA_MONITOR_TIMEOUT);
+ 
+ 	return 0;
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -256,6 +256,8 @@
+ 
+ #define MTK_RX_DONE_INT_V2	BIT(14)
+ 
++#define MTK_CDM_TXFIFO_RDY	BIT(7)
++
+ /* QDMA Interrupt grouping registers */
+ #define MTK_RLS_DONE_INT	BIT(0)
+ 
+@@ -538,6 +540,17 @@
+ #define MT7628_SDM_RBCNT	(MT7628_SDM_OFFSET + 0x10c)
+ #define MT7628_SDM_CS_ERR	(MT7628_SDM_OFFSET + 0x110)
+ 
++#define MTK_FE_CDM1_FSM		0x220
++#define MTK_FE_CDM2_FSM		0x224
++#define MTK_FE_CDM3_FSM		0x238
++#define MTK_FE_CDM4_FSM		0x298
++#define MTK_FE_CDM5_FSM		0x318
++#define MTK_FE_CDM6_FSM		0x328
++#define MTK_FE_GDM1_FSM		0x228
++#define MTK_FE_GDM2_FSM		0x22C
++
++#define MTK_MAC_FSM(x)		(0x1010C + ((x) * 0x100))
++
+ struct mtk_rx_dma {
+ 	unsigned int rxd1;
+ 	unsigned int rxd2;
+@@ -934,6 +947,7 @@ struct mtk_reg_map {
+ 		u32	delay_irq;	/* delay interrupt */
+ 		u32	irq_status;	/* interrupt status */
+ 		u32	irq_mask;	/* interrupt mask */
++		u32	adma_rx_dbg0;
+ 		u32	int_grp;
+ 	} pdma;
+ 	struct {
+@@ -960,6 +974,8 @@ struct mtk_reg_map {
+ 	u32	gdma_to_ppe0;
+ 	u32	ppe_base;
+ 	u32	wdma_base[2];
++	u32	pse_iq_sta;
++	u32	pse_oq_sta;
+ };
+ 
+ /* struct mtk_eth_data -	This is the structure holding all differences
+@@ -1002,6 +1018,8 @@ struct mtk_soc_data {
+ 	} txrx;
+ };
+ 
++#define MTK_DMA_MONITOR_TIMEOUT		msecs_to_jiffies(1000)
++
+ /* currently no SoC has more than 2 macs */
+ #define MTK_MAX_DEVS			2
+ 
+@@ -1124,6 +1142,14 @@ struct mtk_eth {
+ 	struct rhashtable		flow_table;
+ 
+ 	struct bpf_prog			__rcu *prog;
++
++	struct {
++		struct delayed_work monitor_work;
++		u32 wdidx;
++		u8 wdma_hang_count;
++		u8 qdma_hang_count;
++		u8 adma_hang_count;
++	} reset;
+ };
+ 
+ /* struct mtk_mac -	the structure that holds the info about the MACs of the
diff --git a/target/linux/generic/backport-5.15/729-22-v6.3-net-ethernet-mtk_wed-add-reset-reset_complete-callba.patch b/target/linux/generic/backport-5.15/729-22-v6.3-net-ethernet-mtk_wed-add-reset-reset_complete-callba.patch
new file mode 100644
index 00000000000000..2eca26867088b6
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-22-v6.3-net-ethernet-mtk_wed-add-reset-reset_complete-callba.patch
@@ -0,0 +1,124 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 14 Jan 2023 18:01:32 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: add reset/reset_complete callbacks
+
+Introduce reset and reset_complete wlan callback to schedule WLAN driver
+reset when ethernet/wed driver is resetting.
+
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3646,6 +3646,11 @@ static void mtk_pending_work(struct work
+ 	set_bit(MTK_RESETTING, &eth->state);
+ 
+ 	mtk_prepare_for_reset(eth);
++	mtk_wed_fe_reset();
++	/* Run again reset preliminary configuration in order to avoid any
++	 * possible race during FE reset since it can run releasing RTNL lock.
++	 */
++	mtk_prepare_for_reset(eth);
+ 
+ 	/* stop all devices to make sure that dma is properly shut down */
+ 	for (i = 0; i < MTK_MAC_COUNT; i++) {
+@@ -3683,6 +3688,8 @@ static void mtk_pending_work(struct work
+ 
+ 	clear_bit(MTK_RESETTING, &eth->state);
+ 
++	mtk_wed_fe_reset_complete();
++
+ 	rtnl_unlock();
+ }
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -205,6 +205,48 @@ mtk_wed_wo_reset(struct mtk_wed_device *
+ 	iounmap(reg);
+ }
+ 
++void mtk_wed_fe_reset(void)
++{
++	int i;
++
++	mutex_lock(&hw_lock);
++
++	for (i = 0; i < ARRAY_SIZE(hw_list); i++) {
++		struct mtk_wed_hw *hw = hw_list[i];
++		struct mtk_wed_device *dev = hw->wed_dev;
++		int err;
++
++		if (!dev || !dev->wlan.reset)
++			continue;
++
++		/* reset callback blocks until WLAN reset is completed */
++		err = dev->wlan.reset(dev);
++		if (err)
++			dev_err(dev->dev, "wlan reset failed: %d\n", err);
++	}
++
++	mutex_unlock(&hw_lock);
++}
++
++void mtk_wed_fe_reset_complete(void)
++{
++	int i;
++
++	mutex_lock(&hw_lock);
++
++	for (i = 0; i < ARRAY_SIZE(hw_list); i++) {
++		struct mtk_wed_hw *hw = hw_list[i];
++		struct mtk_wed_device *dev = hw->wed_dev;
++
++		if (!dev || !dev->wlan.reset_complete)
++			continue;
++
++		dev->wlan.reset_complete(dev);
++	}
++
++	mutex_unlock(&hw_lock);
++}
++
+ static struct mtk_wed_hw *
+ mtk_wed_assign(struct mtk_wed_device *dev)
+ {
+--- a/drivers/net/ethernet/mediatek/mtk_wed.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed.h
+@@ -128,6 +128,8 @@ void mtk_wed_add_hw(struct device_node *
+ void mtk_wed_exit(void);
+ int mtk_wed_flow_add(int index);
+ void mtk_wed_flow_remove(int index);
++void mtk_wed_fe_reset(void);
++void mtk_wed_fe_reset_complete(void);
+ #else
+ static inline void
+ mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
+@@ -147,6 +149,13 @@ static inline void mtk_wed_flow_remove(i
+ {
+ }
+ 
++static inline void mtk_wed_fe_reset(void)
++{
++}
++
++static inline void mtk_wed_fe_reset_complete(void)
++{
++}
+ #endif
+ 
+ #ifdef CONFIG_DEBUG_FS
+--- a/include/linux/soc/mediatek/mtk_wed.h
++++ b/include/linux/soc/mediatek/mtk_wed.h
+@@ -151,6 +151,8 @@ struct mtk_wed_device {
+ 		void (*release_rx_buf)(struct mtk_wed_device *wed);
+ 		void (*update_wo_rx_stats)(struct mtk_wed_device *wed,
+ 					   struct mtk_wed_wo_rx_stats *stats);
++		int (*reset)(struct mtk_wed_device *wed);
++		void (*reset_complete)(struct mtk_wed_device *wed);
+ 	} wlan;
+ #endif
+ };
diff --git a/target/linux/generic/backport-5.15/729-23-v6.3-net-ethernet-mtk_wed-add-reset-to-rx_ring_setup-call.patch b/target/linux/generic/backport-5.15/729-23-v6.3-net-ethernet-mtk_wed-add-reset-to-rx_ring_setup-call.patch
new file mode 100644
index 00000000000000..cf81acf491915c
--- /dev/null
+++ b/target/linux/generic/backport-5.15/729-23-v6.3-net-ethernet-mtk_wed-add-reset-to-rx_ring_setup-call.patch
@@ -0,0 +1,106 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Mon, 5 Dec 2022 12:34:42 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: add reset to rx_ring_setup callback
+
+This patch adds reset parameter to mtk_wed_rx_ring_setup signature
+in order to align rx_ring_setup callback to tx_ring_setup one introduced
+in 'commit 23dca7a90017 ("net: ethernet: mtk_wed: add reset to
+tx_ring_setup callback")'
+
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Link: https://lore.kernel.org/r/29c6e7a5469e784406cf3e2920351d1207713d05.1670239984.git.lorenzo@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -1259,7 +1259,8 @@ mtk_wed_wdma_rx_ring_setup(struct mtk_we
+ }
+ 
+ static int
+-mtk_wed_wdma_tx_ring_setup(struct mtk_wed_device *dev, int idx, int size)
++mtk_wed_wdma_tx_ring_setup(struct mtk_wed_device *dev, int idx, int size,
++			   bool reset)
+ {
+ 	u32 desc_size = sizeof(struct mtk_wdma_desc) * dev->hw->version;
+ 	struct mtk_wed_ring *wdma;
+@@ -1268,8 +1269,8 @@ mtk_wed_wdma_tx_ring_setup(struct mtk_we
+ 		return -EINVAL;
+ 
+ 	wdma = &dev->tx_wdma[idx];
+-	if (mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE, desc_size,
+-			       true))
++	if (!reset && mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE,
++					 desc_size, true))
+ 		return -ENOMEM;
+ 
+ 	wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_BASE,
+@@ -1279,6 +1280,9 @@ mtk_wed_wdma_tx_ring_setup(struct mtk_we
+ 	wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_CPU_IDX, 0);
+ 	wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_DMA_IDX, 0);
+ 
++	if (reset)
++		mtk_wed_ring_reset(wdma, MTK_WED_WDMA_RING_SIZE, true);
++
+ 	if (!idx)  {
+ 		wed_w32(dev, MTK_WED_WDMA_RING_TX + MTK_WED_RING_OFS_BASE,
+ 			wdma->desc_phys);
+@@ -1618,18 +1622,20 @@ mtk_wed_txfree_ring_setup(struct mtk_wed
+ }
+ 
+ static int
+-mtk_wed_rx_ring_setup(struct mtk_wed_device *dev, int idx, void __iomem *regs)
++mtk_wed_rx_ring_setup(struct mtk_wed_device *dev, int idx, void __iomem *regs,
++		      bool reset)
+ {
+ 	struct mtk_wed_ring *ring = &dev->rx_ring[idx];
+ 
+ 	if (WARN_ON(idx >= ARRAY_SIZE(dev->rx_ring)))
+ 		return -EINVAL;
+ 
+-	if (mtk_wed_ring_alloc(dev, ring, MTK_WED_RX_RING_SIZE,
+-			       sizeof(*ring->desc), false))
++	if (!reset && mtk_wed_ring_alloc(dev, ring, MTK_WED_RX_RING_SIZE,
++					 sizeof(*ring->desc), false))
+ 		return -ENOMEM;
+ 
+-	if (mtk_wed_wdma_tx_ring_setup(dev, idx, MTK_WED_WDMA_RING_SIZE))
++	if (mtk_wed_wdma_tx_ring_setup(dev, idx, MTK_WED_WDMA_RING_SIZE,
++				       reset))
+ 		return -ENOMEM;
+ 
+ 	ring->reg_base = MTK_WED_RING_RX_DATA(idx);
+--- a/include/linux/soc/mediatek/mtk_wed.h
++++ b/include/linux/soc/mediatek/mtk_wed.h
+@@ -162,7 +162,7 @@ struct mtk_wed_ops {
+ 	int (*tx_ring_setup)(struct mtk_wed_device *dev, int ring,
+ 			     void __iomem *regs, bool reset);
+ 	int (*rx_ring_setup)(struct mtk_wed_device *dev, int ring,
+-			     void __iomem *regs);
++			     void __iomem *regs, bool reset);
+ 	int (*txfree_ring_setup)(struct mtk_wed_device *dev,
+ 				 void __iomem *regs);
+ 	int (*msg_update)(struct mtk_wed_device *dev, int cmd_id,
+@@ -230,8 +230,8 @@ mtk_wed_get_rx_capa(struct mtk_wed_devic
+ 	(_dev)->ops->irq_get(_dev, _mask)
+ #define mtk_wed_device_irq_set_mask(_dev, _mask) \
+ 	(_dev)->ops->irq_set_mask(_dev, _mask)
+-#define mtk_wed_device_rx_ring_setup(_dev, _ring, _regs) \
+-	(_dev)->ops->rx_ring_setup(_dev, _ring, _regs)
++#define mtk_wed_device_rx_ring_setup(_dev, _ring, _regs, _reset) \
++	(_dev)->ops->rx_ring_setup(_dev, _ring, _regs, _reset)
+ #define mtk_wed_device_ppe_check(_dev, _skb, _reason, _hash) \
+ 	(_dev)->ops->ppe_check(_dev, _skb, _reason, _hash)
+ #define mtk_wed_device_update_msg(_dev, _id, _msg, _len) \
+@@ -251,7 +251,7 @@ static inline bool mtk_wed_device_active
+ #define mtk_wed_device_reg_write(_dev, _reg, _val) do {} while (0)
+ #define mtk_wed_device_irq_get(_dev, _mask) 0
+ #define mtk_wed_device_irq_set_mask(_dev, _mask) do {} while (0)
+-#define mtk_wed_device_rx_ring_setup(_dev, _ring, _regs) -ENODEV
++#define mtk_wed_device_rx_ring_setup(_dev, _ring, _regs, _reset) -ENODEV
+ #define mtk_wed_device_ppe_check(_dev, _skb, _reason, _hash)  do {} while (0)
+ #define mtk_wed_device_update_msg(_dev, _id, _msg, _len) -ENODEV
+ #define mtk_wed_device_stop(_dev) do {} while (0)
diff --git a/target/linux/generic/backport-5.15/730-01-v6.3-net-ethernet-mtk_eth_soc-account-for-vlan-in-rx-head.patch b/target/linux/generic/backport-5.15/730-01-v6.3-net-ethernet-mtk_eth_soc-account-for-vlan-in-rx-head.patch
new file mode 100644
index 00000000000000..45af898cf003b8
--- /dev/null
+++ b/target/linux/generic/backport-5.15/730-01-v6.3-net-ethernet-mtk_eth_soc-account-for-vlan-in-rx-head.patch
@@ -0,0 +1,22 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 27 Oct 2022 19:50:31 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: account for vlan in rx
+ header length
+
+The network stack assumes that devices can handle an extra VLAN tag without
+increasing the MTU
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -29,7 +29,7 @@
+ #define MTK_TX_DMA_BUF_LEN_V2	0xffff
+ #define MTK_DMA_SIZE		512
+ #define MTK_MAC_COUNT		2
+-#define MTK_RX_ETH_HLEN		(ETH_HLEN + ETH_FCS_LEN)
++#define MTK_RX_ETH_HLEN		(VLAN_ETH_HLEN + ETH_FCS_LEN)
+ #define MTK_RX_HLEN		(NET_SKB_PAD + MTK_RX_ETH_HLEN + NET_IP_ALIGN)
+ #define MTK_DMA_DUMMY_DESC	0xffffffff
+ #define MTK_DEFAULT_MSG_ENABLE	(NETIF_MSG_DRV | \
diff --git a/target/linux/generic/backport-5.15/730-02-v6.3-net-ethernet-mtk_eth_soc-increase-tx-ring-side-for-Q.patch b/target/linux/generic/backport-5.15/730-02-v6.3-net-ethernet-mtk_eth_soc-increase-tx-ring-side-for-Q.patch
new file mode 100644
index 00000000000000..b3412df9e0ccef
--- /dev/null
+++ b/target/linux/generic/backport-5.15/730-02-v6.3-net-ethernet-mtk_eth_soc-increase-tx-ring-side-for-Q.patch
@@ -0,0 +1,143 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 27 Oct 2022 19:53:57 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: increase tx ring side for
+ QDMA devices
+
+In order to use the hardware traffic shaper feature, a larger tx ring is
+needed, especially for the scratch ring, which the hardware shaper uses to
+reorder packets.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -901,7 +901,7 @@ static int mtk_init_fq_dma(struct mtk_et
+ {
+ 	const struct mtk_soc_data *soc = eth->soc;
+ 	dma_addr_t phy_ring_tail;
+-	int cnt = MTK_DMA_SIZE;
++	int cnt = MTK_QDMA_RING_SIZE;
+ 	dma_addr_t dma_addr;
+ 	int i;
+ 
+@@ -2155,19 +2155,25 @@ static int mtk_tx_alloc(struct mtk_eth *
+ 	struct mtk_tx_ring *ring = &eth->tx_ring;
+ 	int i, sz = soc->txrx.txd_size;
+ 	struct mtk_tx_dma_v2 *txd;
++	int ring_size;
+ 
+-	ring->buf = kcalloc(MTK_DMA_SIZE, sizeof(*ring->buf),
++	if (MTK_HAS_CAPS(soc->caps, MTK_QDMA))
++		ring_size = MTK_QDMA_RING_SIZE;
++	else
++		ring_size = MTK_DMA_SIZE;
++
++	ring->buf = kcalloc(ring_size, sizeof(*ring->buf),
+ 			       GFP_KERNEL);
+ 	if (!ring->buf)
+ 		goto no_tx_mem;
+ 
+-	ring->dma = dma_alloc_coherent(eth->dma_dev, MTK_DMA_SIZE * sz,
++	ring->dma = dma_alloc_coherent(eth->dma_dev, ring_size * sz,
+ 				       &ring->phys, GFP_KERNEL);
+ 	if (!ring->dma)
+ 		goto no_tx_mem;
+ 
+-	for (i = 0; i < MTK_DMA_SIZE; i++) {
+-		int next = (i + 1) % MTK_DMA_SIZE;
++	for (i = 0; i < ring_size; i++) {
++		int next = (i + 1) % ring_size;
+ 		u32 next_ptr = ring->phys + next * sz;
+ 
+ 		txd = ring->dma + i * sz;
+@@ -2187,22 +2193,22 @@ static int mtk_tx_alloc(struct mtk_eth *
+ 	 * descriptors in ring->dma_pdma.
+ 	 */
+ 	if (!MTK_HAS_CAPS(soc->caps, MTK_QDMA)) {
+-		ring->dma_pdma = dma_alloc_coherent(eth->dma_dev, MTK_DMA_SIZE * sz,
++		ring->dma_pdma = dma_alloc_coherent(eth->dma_dev, ring_size * sz,
+ 						    &ring->phys_pdma, GFP_KERNEL);
+ 		if (!ring->dma_pdma)
+ 			goto no_tx_mem;
+ 
+-		for (i = 0; i < MTK_DMA_SIZE; i++) {
++		for (i = 0; i < ring_size; i++) {
+ 			ring->dma_pdma[i].txd2 = TX_DMA_DESP2_DEF;
+ 			ring->dma_pdma[i].txd4 = 0;
+ 		}
+ 	}
+ 
+-	ring->dma_size = MTK_DMA_SIZE;
+-	atomic_set(&ring->free_count, MTK_DMA_SIZE - 2);
++	ring->dma_size = ring_size;
++	atomic_set(&ring->free_count, ring_size - 2);
+ 	ring->next_free = ring->dma;
+ 	ring->last_free = (void *)txd;
+-	ring->last_free_ptr = (u32)(ring->phys + ((MTK_DMA_SIZE - 1) * sz));
++	ring->last_free_ptr = (u32)(ring->phys + ((ring_size - 1) * sz));
+ 	ring->thresh = MAX_SKB_FRAGS;
+ 
+ 	/* make sure that all changes to the dma ring are flushed before we
+@@ -2214,14 +2220,14 @@ static int mtk_tx_alloc(struct mtk_eth *
+ 		mtk_w32(eth, ring->phys, soc->reg_map->qdma.ctx_ptr);
+ 		mtk_w32(eth, ring->phys, soc->reg_map->qdma.dtx_ptr);
+ 		mtk_w32(eth,
+-			ring->phys + ((MTK_DMA_SIZE - 1) * sz),
++			ring->phys + ((ring_size - 1) * sz),
+ 			soc->reg_map->qdma.crx_ptr);
+ 		mtk_w32(eth, ring->last_free_ptr, soc->reg_map->qdma.drx_ptr);
+ 		mtk_w32(eth, (QDMA_RES_THRES << 8) | QDMA_RES_THRES,
+ 			soc->reg_map->qdma.qtx_cfg);
+ 	} else {
+ 		mtk_w32(eth, ring->phys_pdma, MT7628_TX_BASE_PTR0);
+-		mtk_w32(eth, MTK_DMA_SIZE, MT7628_TX_MAX_CNT0);
++		mtk_w32(eth, ring_size, MT7628_TX_MAX_CNT0);
+ 		mtk_w32(eth, 0, MT7628_TX_CTX_IDX0);
+ 		mtk_w32(eth, MT7628_PST_DTX_IDX0, soc->reg_map->pdma.rst_idx);
+ 	}
+@@ -2239,7 +2245,7 @@ static void mtk_tx_clean(struct mtk_eth
+ 	int i;
+ 
+ 	if (ring->buf) {
+-		for (i = 0; i < MTK_DMA_SIZE; i++)
++		for (i = 0; i < ring->dma_size; i++)
+ 			mtk_tx_unmap(eth, &ring->buf[i], false);
+ 		kfree(ring->buf);
+ 		ring->buf = NULL;
+@@ -2247,14 +2253,14 @@ static void mtk_tx_clean(struct mtk_eth
+ 
+ 	if (ring->dma) {
+ 		dma_free_coherent(eth->dma_dev,
+-				  MTK_DMA_SIZE * soc->txrx.txd_size,
++				  ring->dma_size * soc->txrx.txd_size,
+ 				  ring->dma, ring->phys);
+ 		ring->dma = NULL;
+ 	}
+ 
+ 	if (ring->dma_pdma) {
+ 		dma_free_coherent(eth->dma_dev,
+-				  MTK_DMA_SIZE * soc->txrx.txd_size,
++				  ring->dma_size * soc->txrx.txd_size,
+ 				  ring->dma_pdma, ring->phys_pdma);
+ 		ring->dma_pdma = NULL;
+ 	}
+@@ -2774,7 +2780,7 @@ static void mtk_dma_free(struct mtk_eth
+ 			netdev_reset_queue(eth->netdev[i]);
+ 	if (eth->scratch_ring) {
+ 		dma_free_coherent(eth->dma_dev,
+-				  MTK_DMA_SIZE * soc->txrx.txd_size,
++				  MTK_QDMA_RING_SIZE * soc->txrx.txd_size,
+ 				  eth->scratch_ring, eth->phy_scratch_ring);
+ 		eth->scratch_ring = NULL;
+ 		eth->phy_scratch_ring = 0;
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -27,6 +27,7 @@
+ #define MTK_MAX_RX_LENGTH_2K	2048
+ #define MTK_TX_DMA_BUF_LEN	0x3fff
+ #define MTK_TX_DMA_BUF_LEN_V2	0xffff
++#define MTK_QDMA_RING_SIZE	2048
+ #define MTK_DMA_SIZE		512
+ #define MTK_MAC_COUNT		2
+ #define MTK_RX_ETH_HLEN		(VLAN_ETH_HLEN + ETH_FCS_LEN)
diff --git a/target/linux/generic/backport-5.15/730-03-v6.3-net-ethernet-mtk_eth_soc-avoid-port_mg-assignment-on.patch b/target/linux/generic/backport-5.15/730-03-v6.3-net-ethernet-mtk_eth_soc-avoid-port_mg-assignment-on.patch
new file mode 100644
index 00000000000000..32dc5c37832c99
--- /dev/null
+++ b/target/linux/generic/backport-5.15/730-03-v6.3-net-ethernet-mtk_eth_soc-avoid-port_mg-assignment-on.patch
@@ -0,0 +1,52 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 4 Nov 2022 19:49:08 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: avoid port_mg assignment on
+ MT7622 and newer
+
+On newer chips, this field is unused and contains some bits related to queue
+assignment. Initialize it to 0 in those cases.
+Fix offload_version on MT7621 and MT7623, which still need the previous value.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -4428,7 +4428,7 @@ static const struct mtk_soc_data mt7621_
+ 	.hw_features = MTK_HW_FEATURES,
+ 	.required_clks = MT7621_CLKS_BITMAP,
+ 	.required_pctl = false,
+-	.offload_version = 2,
++	.offload_version = 1,
+ 	.hash_offset = 2,
+ 	.foe_entry_size = sizeof(struct mtk_foe_entry) - 16,
+ 	.txrx = {
+@@ -4467,7 +4467,7 @@ static const struct mtk_soc_data mt7623_
+ 	.hw_features = MTK_HW_FEATURES,
+ 	.required_clks = MT7623_CLKS_BITMAP,
+ 	.required_pctl = true,
+-	.offload_version = 2,
++	.offload_version = 1,
+ 	.hash_offset = 2,
+ 	.foe_entry_size = sizeof(struct mtk_foe_entry) - 16,
+ 	.txrx = {
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -175,6 +175,8 @@ int mtk_foe_entry_prepare(struct mtk_eth
+ 		val = FIELD_PREP(MTK_FOE_IB2_DEST_PORT_V2, pse_port) |
+ 		      FIELD_PREP(MTK_FOE_IB2_PORT_AG_V2, 0xf);
+ 	} else {
++		int port_mg = eth->soc->offload_version > 1 ? 0 : 0x3f;
++
+ 		val = FIELD_PREP(MTK_FOE_IB1_STATE, MTK_FOE_STATE_BIND) |
+ 		      FIELD_PREP(MTK_FOE_IB1_PACKET_TYPE, type) |
+ 		      FIELD_PREP(MTK_FOE_IB1_UDP, l4proto == IPPROTO_UDP) |
+@@ -182,7 +184,7 @@ int mtk_foe_entry_prepare(struct mtk_eth
+ 		entry->ib1 = val;
+ 
+ 		val = FIELD_PREP(MTK_FOE_IB2_DEST_PORT, pse_port) |
+-		      FIELD_PREP(MTK_FOE_IB2_PORT_MG, 0x3f) |
++		      FIELD_PREP(MTK_FOE_IB2_PORT_MG, port_mg) |
+ 		      FIELD_PREP(MTK_FOE_IB2_PORT_AG, 0x1f);
+ 	}
+ 
diff --git a/target/linux/generic/backport-5.15/730-04-v6.3-net-ethernet-mtk_eth_soc-implement-multi-queue-suppo.patch b/target/linux/generic/backport-5.15/730-04-v6.3-net-ethernet-mtk_eth_soc-implement-multi-queue-suppo.patch
new file mode 100644
index 00000000000000..cfbd510c8f2ef7
--- /dev/null
+++ b/target/linux/generic/backport-5.15/730-04-v6.3-net-ethernet-mtk_eth_soc-implement-multi-queue-suppo.patch
@@ -0,0 +1,654 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 27 Oct 2022 20:17:27 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: implement multi-queue
+ support for per-port queues
+
+When sending traffic to multiple ports with different link speeds, queued
+packets to one port can drown out tx to other ports.
+In order to better handle transmission to multiple ports, use the hardware
+shaper feature to implement weighted fair queueing between ports.
+Weight and maximum rate are automatically adjusted based on the link speed
+of the port.
+The first 3 queues are unrestricted and reserved for non-DSA direct tx on
+GMAC ports. The following queues are automatically assigned by the MTK DSA
+tag driver based on the target port number.
+The PPE offload code configures the queues for offloaded traffic in the same
+way.
+This feature is only supported on devices supporting QDMA. All queues still
+share the same DMA ring and descriptor pool.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -55,6 +55,7 @@ static const struct mtk_reg_map mtk_reg_
+ 	},
+ 	.qdma = {
+ 		.qtx_cfg	= 0x1800,
++		.qtx_sch	= 0x1804,
+ 		.rx_ptr		= 0x1900,
+ 		.rx_cnt_cfg	= 0x1904,
+ 		.qcrx_ptr	= 0x1908,
+@@ -62,6 +63,7 @@ static const struct mtk_reg_map mtk_reg_
+ 		.rst_idx	= 0x1a08,
+ 		.delay_irq	= 0x1a0c,
+ 		.fc_th		= 0x1a10,
++		.tx_sch_rate	= 0x1a14,
+ 		.int_grp	= 0x1a20,
+ 		.hred		= 0x1a44,
+ 		.ctx_ptr	= 0x1b00,
+@@ -117,6 +119,7 @@ static const struct mtk_reg_map mt7986_r
+ 	},
+ 	.qdma = {
+ 		.qtx_cfg	= 0x4400,
++		.qtx_sch	= 0x4404,
+ 		.rx_ptr		= 0x4500,
+ 		.rx_cnt_cfg	= 0x4504,
+ 		.qcrx_ptr	= 0x4508,
+@@ -134,6 +137,7 @@ static const struct mtk_reg_map mt7986_r
+ 		.fq_tail	= 0x4724,
+ 		.fq_count	= 0x4728,
+ 		.fq_blen	= 0x472c,
++		.tx_sch_rate	= 0x4798,
+ 	},
+ 	.gdm1_cnt		= 0x1c00,
+ 	.gdma_to_ppe0		= 0x3333,
+@@ -577,6 +581,75 @@ static void mtk_mac_link_down(struct phy
+ 	mtk_w32(mac->hw, mcr, MTK_MAC_MCR(mac->id));
+ }
+ 
++static void mtk_set_queue_speed(struct mtk_eth *eth, unsigned int idx,
++				int speed)
++{
++	const struct mtk_soc_data *soc = eth->soc;
++	u32 ofs, val;
++
++	if (!MTK_HAS_CAPS(soc->caps, MTK_QDMA))
++		return;
++
++	val = MTK_QTX_SCH_MIN_RATE_EN |
++	      /* minimum: 10 Mbps */
++	      FIELD_PREP(MTK_QTX_SCH_MIN_RATE_MAN, 1) |
++	      FIELD_PREP(MTK_QTX_SCH_MIN_RATE_EXP, 4) |
++	      MTK_QTX_SCH_LEAKY_BUCKET_SIZE;
++	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++		val |= MTK_QTX_SCH_LEAKY_BUCKET_EN;
++
++	if (IS_ENABLED(CONFIG_SOC_MT7621)) {
++		switch (speed) {
++		case SPEED_10:
++			val |= MTK_QTX_SCH_MAX_RATE_EN |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 103) |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 2) |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_WEIGHT, 1);
++			break;
++		case SPEED_100:
++			val |= MTK_QTX_SCH_MAX_RATE_EN |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 103) |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 3);
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_WEIGHT, 1);
++			break;
++		case SPEED_1000:
++			val |= MTK_QTX_SCH_MAX_RATE_EN |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 105) |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 4) |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_WEIGHT, 10);
++			break;
++		default:
++			break;
++		}
++	} else {
++		switch (speed) {
++		case SPEED_10:
++			val |= MTK_QTX_SCH_MAX_RATE_EN |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 1) |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 4) |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_WEIGHT, 1);
++			break;
++		case SPEED_100:
++			val |= MTK_QTX_SCH_MAX_RATE_EN |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 1) |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 5);
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_WEIGHT, 1);
++			break;
++		case SPEED_1000:
++			val |= MTK_QTX_SCH_MAX_RATE_EN |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 10) |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 5) |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_WEIGHT, 10);
++			break;
++		default:
++			break;
++		}
++	}
++
++	ofs = MTK_QTX_OFFSET * idx;
++	mtk_w32(eth, val, soc->reg_map->qdma.qtx_sch + ofs);
++}
++
+ static void mtk_mac_link_up(struct phylink_config *config,
+ 			    struct phy_device *phy,
+ 			    unsigned int mode, phy_interface_t interface,
+@@ -602,6 +675,8 @@ static void mtk_mac_link_up(struct phyli
+ 		break;
+ 	}
+ 
++	mtk_set_queue_speed(mac->hw, mac->id, speed);
++
+ 	/* Configure duplex */
+ 	if (duplex == DUPLEX_FULL)
+ 		mcr |= MAC_MCR_FORCE_DPX;
+@@ -1060,7 +1135,8 @@ static void mtk_tx_set_dma_desc_v1(struc
+ 
+ 	WRITE_ONCE(desc->txd1, info->addr);
+ 
+-	data = TX_DMA_SWC | TX_DMA_PLEN0(info->size);
++	data = TX_DMA_SWC | TX_DMA_PLEN0(info->size) |
++	       FIELD_PREP(TX_DMA_PQID, info->qid);
+ 	if (info->last)
+ 		data |= TX_DMA_LS0;
+ 	WRITE_ONCE(desc->txd3, data);
+@@ -1094,9 +1170,6 @@ static void mtk_tx_set_dma_desc_v2(struc
+ 		data |= TX_DMA_LS0;
+ 	WRITE_ONCE(desc->txd3, data);
+ 
+-	if (!info->qid && mac->id)
+-		info->qid = MTK_QDMA_GMAC2_QID;
+-
+ 	data = (mac->id + 1) << TX_DMA_FPORT_SHIFT_V2; /* forward port */
+ 	data |= TX_DMA_SWC_V2 | QID_BITS_V2(info->qid);
+ 	WRITE_ONCE(desc->txd4, data);
+@@ -1140,11 +1213,12 @@ static int mtk_tx_map(struct sk_buff *sk
+ 		.gso = gso,
+ 		.csum = skb->ip_summed == CHECKSUM_PARTIAL,
+ 		.vlan = skb_vlan_tag_present(skb),
+-		.qid = skb->mark & MTK_QDMA_TX_MASK,
++		.qid = skb_get_queue_mapping(skb),
+ 		.vlan_tci = skb_vlan_tag_get(skb),
+ 		.first = true,
+ 		.last = !skb_is_nonlinear(skb),
+ 	};
++	struct netdev_queue *txq;
+ 	struct mtk_mac *mac = netdev_priv(dev);
+ 	struct mtk_eth *eth = mac->hw;
+ 	const struct mtk_soc_data *soc = eth->soc;
+@@ -1152,8 +1226,10 @@ static int mtk_tx_map(struct sk_buff *sk
+ 	struct mtk_tx_dma *itxd_pdma, *txd_pdma;
+ 	struct mtk_tx_buf *itx_buf, *tx_buf;
+ 	int i, n_desc = 1;
++	int queue = skb_get_queue_mapping(skb);
+ 	int k = 0;
+ 
++	txq = netdev_get_tx_queue(dev, queue);
+ 	itxd = ring->next_free;
+ 	itxd_pdma = qdma_to_pdma(ring, itxd);
+ 	if (itxd == ring->last_free)
+@@ -1202,7 +1278,7 @@ static int mtk_tx_map(struct sk_buff *sk
+ 			memset(&txd_info, 0, sizeof(struct mtk_tx_dma_desc_info));
+ 			txd_info.size = min_t(unsigned int, frag_size,
+ 					      soc->txrx.dma_max_len);
+-			txd_info.qid = skb->mark & MTK_QDMA_TX_MASK;
++			txd_info.qid = queue;
+ 			txd_info.last = i == skb_shinfo(skb)->nr_frags - 1 &&
+ 					!(frag_size - txd_info.size);
+ 			txd_info.addr = skb_frag_dma_map(eth->dma_dev, frag,
+@@ -1241,7 +1317,7 @@ static int mtk_tx_map(struct sk_buff *sk
+ 			txd_pdma->txd2 |= TX_DMA_LS1;
+ 	}
+ 
+-	netdev_sent_queue(dev, skb->len);
++	netdev_tx_sent_queue(txq, skb->len);
+ 	skb_tx_timestamp(skb);
+ 
+ 	ring->next_free = mtk_qdma_phys_to_virt(ring, txd->txd2);
+@@ -1253,8 +1329,7 @@ static int mtk_tx_map(struct sk_buff *sk
+ 	wmb();
+ 
+ 	if (MTK_HAS_CAPS(soc->caps, MTK_QDMA)) {
+-		if (netif_xmit_stopped(netdev_get_tx_queue(dev, 0)) ||
+-		    !netdev_xmit_more())
++		if (netif_xmit_stopped(txq) || !netdev_xmit_more())
+ 			mtk_w32(eth, txd->txd2, soc->reg_map->qdma.ctx_ptr);
+ 	} else {
+ 		int next_idx;
+@@ -1323,7 +1398,7 @@ static void mtk_wake_queue(struct mtk_et
+ 	for (i = 0; i < MTK_MAC_COUNT; i++) {
+ 		if (!eth->netdev[i])
+ 			continue;
+-		netif_wake_queue(eth->netdev[i]);
++		netif_tx_wake_all_queues(eth->netdev[i]);
+ 	}
+ }
+ 
+@@ -1347,7 +1422,7 @@ static netdev_tx_t mtk_start_xmit(struct
+ 
+ 	tx_num = mtk_cal_txd_req(eth, skb);
+ 	if (unlikely(atomic_read(&ring->free_count) <= tx_num)) {
+-		netif_stop_queue(dev);
++		netif_tx_stop_all_queues(dev);
+ 		netif_err(eth, tx_queued, dev,
+ 			  "Tx Ring full when queue awake!\n");
+ 		spin_unlock(&eth->page_lock);
+@@ -1373,7 +1448,7 @@ static netdev_tx_t mtk_start_xmit(struct
+ 		goto drop;
+ 
+ 	if (unlikely(atomic_read(&ring->free_count) <= ring->thresh))
+-		netif_stop_queue(dev);
++		netif_tx_stop_all_queues(dev);
+ 
+ 	spin_unlock(&eth->page_lock);
+ 
+@@ -1540,10 +1615,12 @@ static int mtk_xdp_submit_frame(struct m
+ 	struct skb_shared_info *sinfo = xdp_get_shared_info_from_frame(xdpf);
+ 	const struct mtk_soc_data *soc = eth->soc;
+ 	struct mtk_tx_ring *ring = &eth->tx_ring;
++	struct mtk_mac *mac = netdev_priv(dev);
+ 	struct mtk_tx_dma_desc_info txd_info = {
+ 		.size	= xdpf->len,
+ 		.first	= true,
+ 		.last	= !xdp_frame_has_frags(xdpf),
++		.qid	= mac->id,
+ 	};
+ 	int err, index = 0, n_desc = 1, nr_frags;
+ 	struct mtk_tx_dma *htxd, *txd, *txd_pdma;
+@@ -1594,6 +1671,7 @@ static int mtk_xdp_submit_frame(struct m
+ 		memset(&txd_info, 0, sizeof(struct mtk_tx_dma_desc_info));
+ 		txd_info.size = skb_frag_size(&sinfo->frags[index]);
+ 		txd_info.last = index + 1 == nr_frags;
++		txd_info.qid = mac->id;
+ 		data = skb_frag_address(&sinfo->frags[index]);
+ 
+ 		index++;
+@@ -1945,8 +2023,46 @@ rx_done:
+ 	return done;
+ }
+ 
++struct mtk_poll_state {
++    struct netdev_queue *txq;
++    unsigned int total;
++    unsigned int done;
++    unsigned int bytes;
++};
++
++static void
++mtk_poll_tx_done(struct mtk_eth *eth, struct mtk_poll_state *state, u8 mac,
++		 struct sk_buff *skb)
++{
++	struct netdev_queue *txq;
++	struct net_device *dev;
++	unsigned int bytes = skb->len;
++
++	state->total++;
++	eth->tx_packets++;
++	eth->tx_bytes += bytes;
++
++	dev = eth->netdev[mac];
++	if (!dev)
++		return;
++
++	txq = netdev_get_tx_queue(dev, skb_get_queue_mapping(skb));
++	if (state->txq == txq) {
++		state->done++;
++		state->bytes += bytes;
++		return;
++	}
++
++	if (state->txq)
++		netdev_tx_completed_queue(state->txq, state->done, state->bytes);
++
++	state->txq = txq;
++	state->done = 1;
++	state->bytes = bytes;
++}
++
+ static int mtk_poll_tx_qdma(struct mtk_eth *eth, int budget,
+-			    unsigned int *done, unsigned int *bytes)
++			    struct mtk_poll_state *state)
+ {
+ 	const struct mtk_reg_map *reg_map = eth->soc->reg_map;
+ 	struct mtk_tx_ring *ring = &eth->tx_ring;
+@@ -1976,12 +2092,9 @@ static int mtk_poll_tx_qdma(struct mtk_e
+ 			break;
+ 
+ 		if (tx_buf->data != (void *)MTK_DMA_DUMMY_DESC) {
+-			if (tx_buf->type == MTK_TYPE_SKB) {
+-				struct sk_buff *skb = tx_buf->data;
++			if (tx_buf->type == MTK_TYPE_SKB)
++				mtk_poll_tx_done(eth, state, mac, tx_buf->data);
+ 
+-				bytes[mac] += skb->len;
+-				done[mac]++;
+-			}
+ 			budget--;
+ 		}
+ 		mtk_tx_unmap(eth, tx_buf, true);
+@@ -1999,7 +2112,7 @@ static int mtk_poll_tx_qdma(struct mtk_e
+ }
+ 
+ static int mtk_poll_tx_pdma(struct mtk_eth *eth, int budget,
+-			    unsigned int *done, unsigned int *bytes)
++			    struct mtk_poll_state *state)
+ {
+ 	struct mtk_tx_ring *ring = &eth->tx_ring;
+ 	struct mtk_tx_buf *tx_buf;
+@@ -2015,12 +2128,8 @@ static int mtk_poll_tx_pdma(struct mtk_e
+ 			break;
+ 
+ 		if (tx_buf->data != (void *)MTK_DMA_DUMMY_DESC) {
+-			if (tx_buf->type == MTK_TYPE_SKB) {
+-				struct sk_buff *skb = tx_buf->data;
+-
+-				bytes[0] += skb->len;
+-				done[0]++;
+-			}
++			if (tx_buf->type == MTK_TYPE_SKB)
++				mtk_poll_tx_done(eth, state, 0, tx_buf->data);
+ 			budget--;
+ 		}
+ 		mtk_tx_unmap(eth, tx_buf, true);
+@@ -2041,26 +2150,15 @@ static int mtk_poll_tx(struct mtk_eth *e
+ {
+ 	struct mtk_tx_ring *ring = &eth->tx_ring;
+ 	struct dim_sample dim_sample = {};
+-	unsigned int done[MTK_MAX_DEVS];
+-	unsigned int bytes[MTK_MAX_DEVS];
+-	int total = 0, i;
+-
+-	memset(done, 0, sizeof(done));
+-	memset(bytes, 0, sizeof(bytes));
++	struct mtk_poll_state state = {};
+ 
+ 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_QDMA))
+-		budget = mtk_poll_tx_qdma(eth, budget, done, bytes);
++		budget = mtk_poll_tx_qdma(eth, budget, &state);
+ 	else
+-		budget = mtk_poll_tx_pdma(eth, budget, done, bytes);
++		budget = mtk_poll_tx_pdma(eth, budget, &state);
+ 
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
+-		if (!eth->netdev[i] || !done[i])
+-			continue;
+-		netdev_completed_queue(eth->netdev[i], done[i], bytes[i]);
+-		total += done[i];
+-		eth->tx_packets += done[i];
+-		eth->tx_bytes += bytes[i];
+-	}
++	if (state.txq)
++		netdev_tx_completed_queue(state.txq, state.done, state.bytes);
+ 
+ 	dim_update_sample(eth->tx_events, eth->tx_packets, eth->tx_bytes,
+ 			  &dim_sample);
+@@ -2070,7 +2168,7 @@ static int mtk_poll_tx(struct mtk_eth *e
+ 	    (atomic_read(&ring->free_count) > ring->thresh))
+ 		mtk_wake_queue(eth);
+ 
+-	return total;
++	return state.total;
+ }
+ 
+ static void mtk_handle_status_irq(struct mtk_eth *eth)
+@@ -2156,6 +2254,7 @@ static int mtk_tx_alloc(struct mtk_eth *
+ 	int i, sz = soc->txrx.txd_size;
+ 	struct mtk_tx_dma_v2 *txd;
+ 	int ring_size;
++	u32 ofs, val;
+ 
+ 	if (MTK_HAS_CAPS(soc->caps, MTK_QDMA))
+ 		ring_size = MTK_QDMA_RING_SIZE;
+@@ -2223,8 +2322,25 @@ static int mtk_tx_alloc(struct mtk_eth *
+ 			ring->phys + ((ring_size - 1) * sz),
+ 			soc->reg_map->qdma.crx_ptr);
+ 		mtk_w32(eth, ring->last_free_ptr, soc->reg_map->qdma.drx_ptr);
+-		mtk_w32(eth, (QDMA_RES_THRES << 8) | QDMA_RES_THRES,
+-			soc->reg_map->qdma.qtx_cfg);
++
++		for (i = 0, ofs = 0; i < MTK_QDMA_NUM_QUEUES; i++) {
++			val = (QDMA_RES_THRES << 8) | QDMA_RES_THRES;
++			mtk_w32(eth, val, soc->reg_map->qdma.qtx_cfg + ofs);
++
++			val = MTK_QTX_SCH_MIN_RATE_EN |
++			      /* minimum: 10 Mbps */
++			      FIELD_PREP(MTK_QTX_SCH_MIN_RATE_MAN, 1) |
++			      FIELD_PREP(MTK_QTX_SCH_MIN_RATE_EXP, 4) |
++			      MTK_QTX_SCH_LEAKY_BUCKET_SIZE;
++			if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++				val |= MTK_QTX_SCH_LEAKY_BUCKET_EN;
++			mtk_w32(eth, val, soc->reg_map->qdma.qtx_sch + ofs);
++			ofs += MTK_QTX_OFFSET;
++		}
++		val = MTK_QDMA_TX_SCH_MAX_WFQ | (MTK_QDMA_TX_SCH_MAX_WFQ << 16);
++		mtk_w32(eth, val, soc->reg_map->qdma.tx_sch_rate);
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++			mtk_w32(eth, val, soc->reg_map->qdma.tx_sch_rate + 4);
+ 	} else {
+ 		mtk_w32(eth, ring->phys_pdma, MT7628_TX_BASE_PTR0);
+ 		mtk_w32(eth, ring_size, MT7628_TX_MAX_CNT0);
+@@ -2904,7 +3020,7 @@ static int mtk_start_dma(struct mtk_eth
+ 		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
+ 			val |= MTK_MUTLI_CNT | MTK_RESV_BUF |
+ 			       MTK_WCOMP_EN | MTK_DMAD_WR_WDONE |
+-			       MTK_CHK_DDONE_EN;
++			       MTK_CHK_DDONE_EN | MTK_LEAKY_BUCKET_EN;
+ 		else
+ 			val |= MTK_RX_BT_32DWORDS;
+ 		mtk_w32(eth, val, reg_map->qdma.glo_cfg);
+@@ -2950,6 +3066,45 @@ static void mtk_gdm_config(struct mtk_et
+ 	mtk_w32(eth, 0, MTK_RST_GL);
+ }
+ 
++static int mtk_device_event(struct notifier_block *n, unsigned long event, void *ptr)
++{
++	struct mtk_mac *mac = container_of(n, struct mtk_mac, device_notifier);
++	struct mtk_eth *eth = mac->hw;
++	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
++	struct ethtool_link_ksettings s;
++	struct net_device *ldev;
++	struct list_head *iter;
++	struct dsa_port *dp;
++
++	if (event != NETDEV_CHANGE)
++		return NOTIFY_DONE;
++
++	netdev_for_each_lower_dev(dev, ldev, iter) {
++		if (netdev_priv(ldev) == mac)
++			goto found;
++	}
++
++	return NOTIFY_DONE;
++
++found:
++	if (!dsa_slave_dev_check(dev))
++		return NOTIFY_DONE;
++
++	if (__ethtool_get_link_ksettings(dev, &s))
++		return NOTIFY_DONE;
++
++	if (s.base.speed == 0 || s.base.speed == ((__u32)-1))
++		return NOTIFY_DONE;
++
++	dp = dsa_port_from_netdev(dev);
++	if (dp->index >= MTK_QDMA_NUM_QUEUES)
++		return NOTIFY_DONE;
++
++	mtk_set_queue_speed(eth, dp->index + 3, s.base.speed);
++
++	return NOTIFY_DONE;
++}
++
+ static int mtk_open(struct net_device *dev)
+ {
+ 	struct mtk_mac *mac = netdev_priv(dev);
+@@ -2994,7 +3149,8 @@ static int mtk_open(struct net_device *d
+ 		refcount_inc(&eth->dma_refcnt);
+ 
+ 	phylink_start(mac->phylink);
+-	netif_start_queue(dev);
++	netif_tx_start_all_queues(dev);
++
+ 	return 0;
+ }
+ 
+@@ -3717,8 +3873,12 @@ static int mtk_unreg_dev(struct mtk_eth
+ 	int i;
+ 
+ 	for (i = 0; i < MTK_MAC_COUNT; i++) {
++		struct mtk_mac *mac;
+ 		if (!eth->netdev[i])
+ 			continue;
++		mac = netdev_priv(eth->netdev[i]);
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_QDMA))
++			unregister_netdevice_notifier(&mac->device_notifier);
+ 		unregister_netdev(eth->netdev[i]);
+ 	}
+ 
+@@ -3935,6 +4095,23 @@ static int mtk_set_rxnfc(struct net_devi
+ 	return ret;
+ }
+ 
++static u16 mtk_select_queue(struct net_device *dev, struct sk_buff *skb,
++			    struct net_device *sb_dev)
++{
++	struct mtk_mac *mac = netdev_priv(dev);
++	unsigned int queue = 0;
++
++	if (netdev_uses_dsa(dev))
++		queue = skb_get_queue_mapping(skb) + 3;
++	else
++		queue = mac->id;
++
++	if (queue >= dev->num_tx_queues)
++		queue = 0;
++
++	return queue;
++}
++
+ static const struct ethtool_ops mtk_ethtool_ops = {
+ 	.get_link_ksettings	= mtk_get_link_ksettings,
+ 	.set_link_ksettings	= mtk_set_link_ksettings,
+@@ -3970,6 +4147,7 @@ static const struct net_device_ops mtk_n
+ 	.ndo_setup_tc		= mtk_eth_setup_tc,
+ 	.ndo_bpf		= mtk_xdp,
+ 	.ndo_xdp_xmit		= mtk_xdp_xmit,
++	.ndo_select_queue	= mtk_select_queue,
+ };
+ 
+ static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np)
+@@ -3979,6 +4157,7 @@ static int mtk_add_mac(struct mtk_eth *e
+ 	struct phylink *phylink;
+ 	struct mtk_mac *mac;
+ 	int id, err;
++	int txqs = 1;
+ 
+ 	if (!_id) {
+ 		dev_err(eth->dev, "missing mac id\n");
+@@ -3996,7 +4175,10 @@ static int mtk_add_mac(struct mtk_eth *e
+ 		return -EINVAL;
+ 	}
+ 
+-	eth->netdev[id] = alloc_etherdev(sizeof(*mac));
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_QDMA))
++		txqs = MTK_QDMA_NUM_QUEUES;
++
++	eth->netdev[id] = alloc_etherdev_mqs(sizeof(*mac), txqs, 1);
+ 	if (!eth->netdev[id]) {
+ 		dev_err(eth->dev, "alloc_etherdev failed\n");
+ 		return -ENOMEM;
+@@ -4093,6 +4275,11 @@ static int mtk_add_mac(struct mtk_eth *e
+ 	else
+ 		eth->netdev[id]->max_mtu = MTK_MAX_RX_LENGTH_2K - MTK_RX_ETH_HLEN;
+ 
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_QDMA)) {
++		mac->device_notifier.notifier_call = mtk_device_event;
++		register_netdevice_notifier(&mac->device_notifier);
++	}
++
+ 	return 0;
+ 
+ free_netdev:
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -22,6 +22,7 @@
+ #include <linux/bpf_trace.h>
+ #include "mtk_ppe.h"
+ 
++#define MTK_QDMA_NUM_QUEUES	16
+ #define MTK_QDMA_PAGE_SIZE	2048
+ #define MTK_MAX_RX_LENGTH	1536
+ #define MTK_MAX_RX_LENGTH_2K	2048
+@@ -215,8 +216,26 @@
+ #define MTK_RING_MAX_AGG_CNT_H		((MTK_HW_LRO_MAX_AGG_CNT >> 6) & 0x3)
+ 
+ /* QDMA TX Queue Configuration Registers */
++#define MTK_QTX_OFFSET		0x10
+ #define QDMA_RES_THRES		4
+ 
++/* QDMA Tx Queue Scheduler Configuration Registers */
++#define MTK_QTX_SCH_TX_SEL		BIT(31)
++#define MTK_QTX_SCH_TX_SEL_V2		GENMASK(31, 30)
++
++#define MTK_QTX_SCH_LEAKY_BUCKET_EN	BIT(30)
++#define MTK_QTX_SCH_LEAKY_BUCKET_SIZE	GENMASK(29, 28)
++#define MTK_QTX_SCH_MIN_RATE_EN		BIT(27)
++#define MTK_QTX_SCH_MIN_RATE_MAN	GENMASK(26, 20)
++#define MTK_QTX_SCH_MIN_RATE_EXP	GENMASK(19, 16)
++#define MTK_QTX_SCH_MAX_RATE_WEIGHT	GENMASK(15, 12)
++#define MTK_QTX_SCH_MAX_RATE_EN		BIT(11)
++#define MTK_QTX_SCH_MAX_RATE_MAN	GENMASK(10, 4)
++#define MTK_QTX_SCH_MAX_RATE_EXP	GENMASK(3, 0)
++
++/* QDMA TX Scheduler Rate Control Register */
++#define MTK_QDMA_TX_SCH_MAX_WFQ		BIT(15)
++
+ /* QDMA Global Configuration Register */
+ #define MTK_RX_2B_OFFSET	BIT(31)
+ #define MTK_RX_BT_32DWORDS	(3 << 11)
+@@ -235,6 +254,7 @@
+ #define MTK_WCOMP_EN		BIT(24)
+ #define MTK_RESV_BUF		(0x40 << 16)
+ #define MTK_MUTLI_CNT		(0x4 << 12)
++#define MTK_LEAKY_BUCKET_EN	BIT(11)
+ 
+ /* QDMA Flow Control Register */
+ #define FC_THRES_DROP_MODE	BIT(20)
+@@ -265,8 +285,6 @@
+ #define MTK_STAT_OFFSET		0x40
+ 
+ /* QDMA TX NUM */
+-#define MTK_QDMA_TX_NUM		16
+-#define MTK_QDMA_TX_MASK	(MTK_QDMA_TX_NUM - 1)
+ #define QID_BITS_V2(x)		(((x) & 0x3f) << 16)
+ #define MTK_QDMA_GMAC2_QID	8
+ 
+@@ -296,6 +314,7 @@
+ #define TX_DMA_PLEN0(x)		(((x) & eth->soc->txrx.dma_max_len) << eth->soc->txrx.dma_len_offset)
+ #define TX_DMA_PLEN1(x)		((x) & eth->soc->txrx.dma_max_len)
+ #define TX_DMA_SWC		BIT(14)
++#define TX_DMA_PQID		GENMASK(3, 0)
+ 
+ /* PDMA on MT7628 */
+ #define TX_DMA_DONE		BIT(31)
+@@ -953,6 +972,7 @@ struct mtk_reg_map {
+ 	} pdma;
+ 	struct {
+ 		u32	qtx_cfg;	/* tx queue configuration */
++		u32	qtx_sch;	/* tx queue scheduler configuration */
+ 		u32	rx_ptr;		/* rx base pointer */
+ 		u32	rx_cnt_cfg;	/* rx max count configuration */
+ 		u32	qcrx_ptr;	/* rx cpu pointer */
+@@ -970,6 +990,7 @@ struct mtk_reg_map {
+ 		u32	fq_tail;	/* fq tail pointer */
+ 		u32	fq_count;	/* fq free page count */
+ 		u32	fq_blen;	/* fq free page buffer length */
++		u32	tx_sch_rate;	/* tx scheduler rate control registers */
+ 	} qdma;
+ 	u32	gdm1_cnt;
+ 	u32	gdma_to_ppe0;
+@@ -1173,6 +1194,7 @@ struct mtk_mac {
+ 	__be32				hwlro_ip[MTK_MAX_LRO_IP_CNT];
+ 	int				hwlro_ip_cnt;
+ 	unsigned int			syscfg0;
++	struct notifier_block		device_notifier;
+ };
+ 
+ /* the struct describing the SoC. these are declared in the soc_xyz.c files */
diff --git a/target/linux/generic/backport-5.15/730-05-v6.3-net-dsa-tag_mtk-assign-per-port-queues.patch b/target/linux/generic/backport-5.15/730-05-v6.3-net-dsa-tag_mtk-assign-per-port-queues.patch
new file mode 100644
index 00000000000000..186df4bdc924d4
--- /dev/null
+++ b/target/linux/generic/backport-5.15/730-05-v6.3-net-dsa-tag_mtk-assign-per-port-queues.patch
@@ -0,0 +1,20 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 28 Oct 2022 18:16:03 +0200
+Subject: [PATCH] net: dsa: tag_mtk: assign per-port queues
+
+Keeps traffic sent to the switch within link speed limits
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/dsa/tag_mtk.c
++++ b/net/dsa/tag_mtk.c
+@@ -25,6 +25,8 @@ static struct sk_buff *mtk_tag_xmit(stru
+ 	u8 xmit_tpid;
+ 	u8 *mtk_tag;
+ 
++	skb_set_queue_mapping(skb, dp->index);
++
+ 	/* Build the special tag after the MAC Source Address. If VLAN header
+ 	 * is present, it's required that VLAN header and special tag is
+ 	 * being combined. Only in this way we can allow the switch can parse
diff --git a/target/linux/generic/backport-5.15/730-06-v6.3-net-ethernet-mediatek-ppe-assign-per-port-queues-for.patch b/target/linux/generic/backport-5.15/730-06-v6.3-net-ethernet-mediatek-ppe-assign-per-port-queues-for.patch
new file mode 100644
index 00000000000000..8935eb673ae56c
--- /dev/null
+++ b/target/linux/generic/backport-5.15/730-06-v6.3-net-ethernet-mediatek-ppe-assign-per-port-queues-for.patch
@@ -0,0 +1,93 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 3 Nov 2022 17:49:44 +0100
+Subject: [PATCH] net: ethernet: mediatek: ppe: assign per-port queues
+ for offloaded traffic
+
+Keeps traffic sent to the switch within link speed limits
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -405,6 +405,24 @@ static inline bool mtk_foe_entry_usable(
+ 	       FIELD_GET(MTK_FOE_IB1_STATE, entry->ib1) != MTK_FOE_STATE_BIND;
+ }
+ 
++int mtk_foe_entry_set_queue(struct mtk_eth *eth, struct mtk_foe_entry *entry,
++			    unsigned int queue)
++{
++	u32 *ib2 = mtk_foe_entry_ib2(eth, entry);
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++		*ib2 &= ~MTK_FOE_IB2_QID_V2;
++		*ib2 |= FIELD_PREP(MTK_FOE_IB2_QID_V2, queue);
++		*ib2 |= MTK_FOE_IB2_PSE_QOS_V2;
++	} else {
++		*ib2 &= ~MTK_FOE_IB2_QID;
++		*ib2 |= FIELD_PREP(MTK_FOE_IB2_QID, queue);
++		*ib2 |= MTK_FOE_IB2_PSE_QOS;
++	}
++
++	return 0;
++}
++
+ static bool
+ mtk_flow_entry_match(struct mtk_eth *eth, struct mtk_flow_entry *entry,
+ 		     struct mtk_foe_entry *data)
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h
+@@ -68,7 +68,9 @@ enum {
+ #define MTK_FOE_IB2_DSCP		GENMASK(31, 24)
+ 
+ /* CONFIG_MEDIATEK_NETSYS_V2 */
++#define MTK_FOE_IB2_QID_V2			GENMASK(6, 0)
+ #define MTK_FOE_IB2_PORT_MG_V2		BIT(7)
++#define MTK_FOE_IB2_PSE_QOS_V2		BIT(8)
+ #define MTK_FOE_IB2_DEST_PORT_V2	GENMASK(12, 9)
+ #define MTK_FOE_IB2_MULTICAST_V2	BIT(13)
+ #define MTK_FOE_IB2_WDMA_WINFO_V2	BIT(19)
+@@ -351,6 +353,8 @@ int mtk_foe_entry_set_pppoe(struct mtk_e
+ 			    int sid);
+ int mtk_foe_entry_set_wdma(struct mtk_eth *eth, struct mtk_foe_entry *entry,
+ 			   int wdma_idx, int txq, int bss, int wcid);
++int mtk_foe_entry_set_queue(struct mtk_eth *eth, struct mtk_foe_entry *entry,
++			    unsigned int queue);
+ int mtk_foe_entry_commit(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+ void mtk_foe_entry_clear(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+ int mtk_foe_entry_idle_time(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
+@@ -188,7 +188,7 @@ mtk_flow_set_output_device(struct mtk_et
+ 			   int *wed_index)
+ {
+ 	struct mtk_wdma_info info = {};
+-	int pse_port, dsa_port;
++	int pse_port, dsa_port, queue;
+ 
+ 	if (mtk_flow_get_wdma_info(dev, dest_mac, &info) == 0) {
+ 		mtk_foe_entry_set_wdma(eth, foe, info.wdma_idx, info.queue,
+@@ -212,8 +212,6 @@ mtk_flow_set_output_device(struct mtk_et
+ 	}
+ 
+ 	dsa_port = mtk_flow_get_dsa_port(&dev);
+-	if (dsa_port >= 0)
+-		mtk_foe_entry_set_dsa(eth, foe, dsa_port);
+ 
+ 	if (dev == eth->netdev[0])
+ 		pse_port = 1;
+@@ -222,6 +220,14 @@ mtk_flow_set_output_device(struct mtk_et
+ 	else
+ 		return -EOPNOTSUPP;
+ 
++	if (dsa_port >= 0) {
++		mtk_foe_entry_set_dsa(eth, foe, dsa_port);
++		queue = 3 + dsa_port;
++	} else {
++		queue = pse_port - 1;
++	}
++	mtk_foe_entry_set_queue(eth, foe, queue);
++
+ out:
+ 	mtk_foe_entry_set_pse_port(eth, foe, pse_port);
+ 
diff --git a/target/linux/generic/backport-5.15/730-07-v6.3-net-ethernet-mtk_eth_soc-compile-out-netsys-v2-code-.patch b/target/linux/generic/backport-5.15/730-07-v6.3-net-ethernet-mtk_eth_soc-compile-out-netsys-v2-code-.patch
new file mode 100644
index 00000000000000..44af9128b7501f
--- /dev/null
+++ b/target/linux/generic/backport-5.15/730-07-v6.3-net-ethernet-mtk_eth_soc-compile-out-netsys-v2-code-.patch
@@ -0,0 +1,28 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 27 Oct 2022 23:39:52 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: compile out netsys v2 code
+ on mt7621
+
+Avoid some branches in the hot path on low-end devices with limited CPU power,
+and reduce code size
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -917,7 +917,13 @@ enum mkt_eth_capabilities {
+ #define MTK_MUX_GMAC12_TO_GEPHY_SGMII   \
+ 	(MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII | MTK_MUX)
+ 
+-#define MTK_HAS_CAPS(caps, _x)		(((caps) & (_x)) == (_x))
++#ifdef CONFIG_SOC_MT7621
++#define MTK_CAP_MASK MTK_NETSYS_V2
++#else
++#define MTK_CAP_MASK 0
++#endif
++
++#define MTK_HAS_CAPS(caps, _x)		(((caps) & (_x) & ~(MTK_CAP_MASK)) == (_x))
+ 
+ #define MT7621_CAPS  (MTK_GMAC1_RGMII | MTK_GMAC1_TRGMII | \
+ 		      MTK_GMAC2_RGMII | MTK_SHARED_INT | \
diff --git a/target/linux/generic/backport-5.15/730-08-v6.3-net-dsa-add-support-for-DSA-rx-offloading-via-metada.patch b/target/linux/generic/backport-5.15/730-08-v6.3-net-dsa-add-support-for-DSA-rx-offloading-via-metada.patch
new file mode 100644
index 00000000000000..0478cb528e2d1c
--- /dev/null
+++ b/target/linux/generic/backport-5.15/730-08-v6.3-net-dsa-add-support-for-DSA-rx-offloading-via-metada.patch
@@ -0,0 +1,72 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 8 Nov 2022 15:03:15 +0100
+Subject: [PATCH] net: dsa: add support for DSA rx offloading via
+ metadata dst
+
+If a metadata dst is present with the type METADATA_HW_PORT_MUX on a dsa cpu
+port netdev, assume that it carries the port number and that there is no DSA
+tag present in the skb data.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/core/flow_dissector.c
++++ b/net/core/flow_dissector.c
+@@ -940,12 +940,14 @@ bool __skb_flow_dissect(const struct net
+ #if IS_ENABLED(CONFIG_NET_DSA)
+ 		if (unlikely(skb->dev && netdev_uses_dsa(skb->dev) &&
+ 			     proto == htons(ETH_P_XDSA))) {
++			struct metadata_dst *md_dst = skb_metadata_dst(skb);
+ 			const struct dsa_device_ops *ops;
+ 			int offset = 0;
+ 
+ 			ops = skb->dev->dsa_ptr->tag_ops;
+ 			/* Only DSA header taggers break flow dissection */
+-			if (ops->needed_headroom) {
++			if (ops->needed_headroom &&
++			    (!md_dst || md_dst->type != METADATA_HW_PORT_MUX)) {
+ 				if (ops->flow_dissect)
+ 					ops->flow_dissect(skb, &proto, &offset);
+ 				else
+--- a/net/dsa/dsa.c
++++ b/net/dsa/dsa.c
+@@ -20,6 +20,7 @@
+ #include <linux/phy_fixed.h>
+ #include <linux/ptp_classify.h>
+ #include <linux/etherdevice.h>
++#include <net/dst_metadata.h>
+ 
+ #include "dsa_priv.h"
+ 
+@@ -225,6 +226,7 @@ static bool dsa_skb_defer_rx_timestamp(s
+ static int dsa_switch_rcv(struct sk_buff *skb, struct net_device *dev,
+ 			  struct packet_type *pt, struct net_device *unused)
+ {
++	struct metadata_dst *md_dst = skb_metadata_dst(skb);
+ 	struct dsa_port *cpu_dp = dev->dsa_ptr;
+ 	struct sk_buff *nskb = NULL;
+ 	struct dsa_slave_priv *p;
+@@ -238,7 +240,22 @@ static int dsa_switch_rcv(struct sk_buff
+ 	if (!skb)
+ 		return 0;
+ 
+-	nskb = cpu_dp->rcv(skb, dev);
++	if (md_dst && md_dst->type == METADATA_HW_PORT_MUX) {
++		unsigned int port = md_dst->u.port_info.port_id;
++
++		skb_dst_drop(skb);
++		if (!skb_has_extensions(skb))
++			skb->slow_gro = 0;
++
++		skb->dev = dsa_master_find_slave(dev, 0, port);
++		if (likely(skb->dev)) {
++			dsa_default_offload_fwd_mark(skb);
++			nskb = skb;
++		}
++	} else {
++		nskb = cpu_dp->rcv(skb, dev);
++	}
++
+ 	if (!nskb) {
+ 		kfree_skb(skb);
+ 		return 0;
diff --git a/target/linux/generic/backport-5.15/730-09-v6.3-net-ethernet-mtk_eth_soc-fix-VLAN-rx-hardware-accele.patch b/target/linux/generic/backport-5.15/730-09-v6.3-net-ethernet-mtk_eth_soc-fix-VLAN-rx-hardware-accele.patch
new file mode 100644
index 00000000000000..beba07238fdb7d
--- /dev/null
+++ b/target/linux/generic/backport-5.15/730-09-v6.3-net-ethernet-mtk_eth_soc-fix-VLAN-rx-hardware-accele.patch
@@ -0,0 +1,192 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 28 Oct 2022 11:01:12 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: fix VLAN rx hardware
+ acceleration
+
+- enable VLAN untagging for PDMA rx
+- make it possible to disable the feature via ethtool
+- pass VLAN tag to the DSA driver
+- untag special tag on PDMA only if no non-DSA devices are in use
+- disable special tag untagging on 7986 for now, since it's not working yet
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -23,6 +23,7 @@
+ #include <linux/jhash.h>
+ #include <linux/bitfield.h>
+ #include <net/dsa.h>
++#include <net/dst_metadata.h>
+ 
+ #include "mtk_eth_soc.h"
+ #include "mtk_wed.h"
+@@ -1974,16 +1975,22 @@ static int mtk_poll_rx(struct napi_struc
+ 						htons(RX_DMA_VPID(trxd.rxd4)),
+ 						RX_DMA_VID(trxd.rxd4));
+ 			} else if (trxd.rxd2 & RX_DMA_VTAG) {
+-				__vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q),
++				__vlan_hwaccel_put_tag(skb, htons(RX_DMA_VPID(trxd.rxd3)),
+ 						       RX_DMA_VID(trxd.rxd3));
+ 			}
++		}
++
++		/* When using VLAN untagging in combination with DSA, the
++		 * hardware treats the MTK special tag as a VLAN and untags it.
++		 */
++		if (skb_vlan_tag_present(skb) && netdev_uses_dsa(netdev)) {
++			unsigned int port = ntohs(skb->vlan_proto) & GENMASK(2, 0);
+ 
+-			/* If the device is attached to a dsa switch, the special
+-			 * tag inserted in VLAN field by hw switch can * be offloaded
+-			 * by RX HW VLAN offload. Clear vlan info.
+-			 */
+-			if (netdev_uses_dsa(netdev))
+-				__vlan_hwaccel_clear_tag(skb);
++			if (port < ARRAY_SIZE(eth->dsa_meta) &&
++			    eth->dsa_meta[port])
++				skb_dst_set_noref(skb, &eth->dsa_meta[port]->dst);
++
++			__vlan_hwaccel_clear_tag(skb);
+ 		}
+ 
+ 		skb_record_rx_queue(skb, 0);
+@@ -2800,15 +2807,30 @@ static netdev_features_t mtk_fix_feature
+ 
+ static int mtk_set_features(struct net_device *dev, netdev_features_t features)
+ {
+-	int err = 0;
++	struct mtk_mac *mac = netdev_priv(dev);
++	struct mtk_eth *eth = mac->hw;
++	netdev_features_t diff = dev->features ^ features;
++	int i;
++
++	if ((diff & NETIF_F_LRO) && !(features & NETIF_F_LRO))
++		mtk_hwlro_netdev_disable(dev);
+ 
+-	if (!((dev->features ^ features) & NETIF_F_LRO))
++	/* Set RX VLAN offloading */
++	if (!(diff & NETIF_F_HW_VLAN_CTAG_RX))
+ 		return 0;
+ 
+-	if (!(features & NETIF_F_LRO))
+-		mtk_hwlro_netdev_disable(dev);
++	mtk_w32(eth, !!(features & NETIF_F_HW_VLAN_CTAG_RX),
++		MTK_CDMP_EG_CTRL);
+ 
+-	return err;
++	/* sync features with other MAC */
++	for (i = 0; i < MTK_MAC_COUNT; i++) {
++		if (!eth->netdev[i] || eth->netdev[i] == dev)
++			continue;
++		eth->netdev[i]->features &= ~NETIF_F_HW_VLAN_CTAG_RX;
++		eth->netdev[i]->features |= features & NETIF_F_HW_VLAN_CTAG_RX;
++	}
++
++	return 0;
+ }
+ 
+ /* wait for DMA to finish whatever it is doing before we start using it again */
+@@ -3105,11 +3127,45 @@ found:
+ 	return NOTIFY_DONE;
+ }
+ 
++static bool mtk_uses_dsa(struct net_device *dev)
++{
++#if IS_ENABLED(CONFIG_NET_DSA)
++	return netdev_uses_dsa(dev) &&
++	       dev->dsa_ptr->tag_ops->proto == DSA_TAG_PROTO_MTK;
++#else
++	return false;
++#endif
++}
++
+ static int mtk_open(struct net_device *dev)
+ {
+ 	struct mtk_mac *mac = netdev_priv(dev);
+ 	struct mtk_eth *eth = mac->hw;
+-	int err;
++	int i, err;
++
++	if (mtk_uses_dsa(dev) && !eth->prog) {
++		for (i = 0; i < ARRAY_SIZE(eth->dsa_meta); i++) {
++			struct metadata_dst *md_dst = eth->dsa_meta[i];
++
++			if (md_dst)
++				continue;
++
++			md_dst = metadata_dst_alloc(0, METADATA_HW_PORT_MUX,
++						    GFP_KERNEL);
++			if (!md_dst)
++				return -ENOMEM;
++
++			md_dst->u.port_info.port_id = i;
++			eth->dsa_meta[i] = md_dst;
++		}
++	} else {
++		/* Hardware special tag parsing needs to be disabled if at least
++		 * one MAC does not use DSA.
++		 */
++		u32 val = mtk_r32(eth, MTK_CDMP_IG_CTRL);
++		val &= ~MTK_CDMP_STAG_EN;
++		mtk_w32(eth, val, MTK_CDMP_IG_CTRL);
++	}
+ 
+ 	err = phylink_of_phy_connect(mac->phylink, mac->of_node, 0);
+ 	if (err) {
+@@ -3632,6 +3688,10 @@ static int mtk_hw_init(struct mtk_eth *e
+ 	 */
+ 	val = mtk_r32(eth, MTK_CDMQ_IG_CTRL);
+ 	mtk_w32(eth, val | MTK_CDMQ_STAG_EN, MTK_CDMQ_IG_CTRL);
++	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++		val = mtk_r32(eth, MTK_CDMP_IG_CTRL);
++		mtk_w32(eth, val | MTK_CDMP_STAG_EN, MTK_CDMP_IG_CTRL);
++	}
+ 
+ 	/* Enable RX VLan Offloading */
+ 	mtk_w32(eth, 1, MTK_CDMP_EG_CTRL);
+@@ -3865,6 +3925,12 @@ static int mtk_free_dev(struct mtk_eth *
+ 		free_netdev(eth->netdev[i]);
+ 	}
+ 
++	for (i = 0; i < ARRAY_SIZE(eth->dsa_meta); i++) {
++		if (!eth->dsa_meta[i])
++			break;
++		metadata_dst_free(eth->dsa_meta[i]);
++	}
++
+ 	return 0;
+ }
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -22,6 +22,9 @@
+ #include <linux/bpf_trace.h>
+ #include "mtk_ppe.h"
+ 
++#define MTK_MAX_DSA_PORTS	7
++#define MTK_DSA_PORT_MASK	GENMASK(2, 0)
++
+ #define MTK_QDMA_NUM_QUEUES	16
+ #define MTK_QDMA_PAGE_SIZE	2048
+ #define MTK_MAX_RX_LENGTH	1536
+@@ -105,6 +108,9 @@
+ #define MTK_CDMQ_IG_CTRL	0x1400
+ #define MTK_CDMQ_STAG_EN	BIT(0)
+ 
++/* CDMQ Exgress Control Register */
++#define MTK_CDMQ_EG_CTRL	0x1404
++
+ /* CDMP Ingress Control Register */
+ #define MTK_CDMP_IG_CTRL	0x400
+ #define MTK_CDMP_STAG_EN	BIT(0)
+@@ -1166,6 +1172,8 @@ struct mtk_eth {
+ 
+ 	int				ip_align;
+ 
++	struct metadata_dst		*dsa_meta[MTK_MAX_DSA_PORTS];
++
+ 	struct mtk_ppe			*ppe[2];
+ 	struct rhashtable		flow_table;
+ 
diff --git a/target/linux/generic/backport-5.15/730-10-v6.3-net-ethernet-mtk_eth_soc-drop-packets-to-WDMA-if-the.patch b/target/linux/generic/backport-5.15/730-10-v6.3-net-ethernet-mtk_eth_soc-drop-packets-to-WDMA-if-the.patch
new file mode 100644
index 00000000000000..0bf48b07800132
--- /dev/null
+++ b/target/linux/generic/backport-5.15/730-10-v6.3-net-ethernet-mtk_eth_soc-drop-packets-to-WDMA-if-the.patch
@@ -0,0 +1,37 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 3 Nov 2022 17:46:25 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: drop packets to WDMA if the
+ ring is full
+
+Improves handling of DMA ring overflow.
+Clarify other WDMA drop related comment.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3712,9 +3712,12 @@ static int mtk_hw_init(struct mtk_eth *e
+ 	mtk_w32(eth, 0x21021000, MTK_FE_INT_GRP);
+ 
+ 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+-		/* PSE should not drop port8 and port9 packets */
++		/* PSE should not drop port8 and port9 packets from WDMA Tx */
+ 		mtk_w32(eth, 0x00000300, PSE_DROP_CFG);
+ 
++		/* PSE should drop packets to port 8/9 on WDMA Rx ring full */
++		mtk_w32(eth, 0x00000300, PSE_PPE0_DROP);
++
+ 		/* PSE Free Queue Flow Control  */
+ 		mtk_w32(eth, 0x01fa01f4, PSE_FQFC_CFG2);
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -140,6 +140,7 @@
+ #define PSE_FQFC_CFG1		0x100
+ #define PSE_FQFC_CFG2		0x104
+ #define PSE_DROP_CFG		0x108
++#define PSE_PPE0_DROP		0x110
+ 
+ /* PSE Input Queue Reservation Register*/
+ #define PSE_IQ_REV(x)		(0x140 + (((x) - 1) << 2))
diff --git a/target/linux/generic/backport-5.15/730-12-v6.3-net-ethernet-mtk_eth_soc-disable-hardware-DSA-untagg.patch b/target/linux/generic/backport-5.15/730-12-v6.3-net-ethernet-mtk_eth_soc-disable-hardware-DSA-untagg.patch
new file mode 100644
index 00000000000000..08bf608bc1217b
--- /dev/null
+++ b/target/linux/generic/backport-5.15/730-12-v6.3-net-ethernet-mtk_eth_soc-disable-hardware-DSA-untagg.patch
@@ -0,0 +1,42 @@
+From: =?UTF-8?q?Ar=C4=B1n=C3=A7=20=C3=9CNAL?= <arinc.unal@arinc9.com>
+Date: Sat, 28 Jan 2023 12:42:32 +0300
+Subject: [PATCH] net: ethernet: mtk_eth_soc: disable hardware DSA untagging
+ for second MAC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+According to my tests on MT7621AT and MT7623NI SoCs, hardware DSA untagging
+won't work on the second MAC. Therefore, disable this feature when the
+second MAC of the MT7621 and MT7623 SoCs is being used.
+
+Fixes: 2d7605a72906 ("net: ethernet: mtk_eth_soc: enable hardware DSA untagging")
+Link: https://lore.kernel.org/netdev/6249fc14-b38a-c770-36b4-5af6d41c21d3@arinc9.com/
+Tested-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Link: https://lore.kernel.org/r/20230128094232.2451947-1-arinc.unal@arinc9.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3143,7 +3143,8 @@ static int mtk_open(struct net_device *d
+ 	struct mtk_eth *eth = mac->hw;
+ 	int i, err;
+ 
+-	if (mtk_uses_dsa(dev) && !eth->prog) {
++	if ((mtk_uses_dsa(dev) && !eth->prog) &&
++	    !(mac->id == 1 && MTK_HAS_CAPS(eth->soc->caps, MTK_GMAC1_TRGMII))) {
+ 		for (i = 0; i < ARRAY_SIZE(eth->dsa_meta); i++) {
+ 			struct metadata_dst *md_dst = eth->dsa_meta[i];
+ 
+@@ -3160,7 +3161,8 @@ static int mtk_open(struct net_device *d
+ 		}
+ 	} else {
+ 		/* Hardware special tag parsing needs to be disabled if at least
+-		 * one MAC does not use DSA.
++		 * one MAC does not use DSA, or the second MAC of the MT7621 and
++		 * MT7623 SoCs is being used.
+ 		 */
+ 		u32 val = mtk_r32(eth, MTK_CDMP_IG_CTRL);
+ 		val &= ~MTK_CDMP_STAG_EN;
diff --git a/target/linux/generic/backport-5.15/730-13-v6.3-net-ethernet-mtk_eth_soc-enable-special-tag-when-any.patch b/target/linux/generic/backport-5.15/730-13-v6.3-net-ethernet-mtk_eth_soc-enable-special-tag-when-any.patch
new file mode 100644
index 00000000000000..efab99ada006ef
--- /dev/null
+++ b/target/linux/generic/backport-5.15/730-13-v6.3-net-ethernet-mtk_eth_soc-enable-special-tag-when-any.patch
@@ -0,0 +1,54 @@
+From: =?UTF-8?q?Ar=C4=B1n=C3=A7=20=C3=9CNAL?= <arinc.unal@arinc9.com>
+Date: Sun, 5 Feb 2023 20:53:31 +0300
+Subject: [PATCH] net: ethernet: mtk_eth_soc: enable special tag when any MAC
+ uses DSA
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The special tag is only enabled when the first MAC uses DSA. However, it
+must be enabled when any MAC uses DSA. Change the check accordingly.
+
+This fixes hardware DSA untagging not working on the second MAC of the
+MT7621 and MT7623 SoCs, and likely other SoCs too. Therefore, remove the
+check that disables hardware DSA untagging for the second MAC of the MT7621
+and MT7623 SoCs.
+
+Fixes: a1f47752fd62 ("net: ethernet: mtk_eth_soc: disable hardware DSA untagging for second MAC")
+Co-developed-by: Richard van Schagen <richard@routerhints.com>
+Signed-off-by: Richard van Schagen <richard@routerhints.com>
+Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3078,7 +3078,7 @@ static void mtk_gdm_config(struct mtk_et
+ 
+ 		val |= config;
+ 
+-		if (!i && eth->netdev[0] && netdev_uses_dsa(eth->netdev[0]))
++		if (eth->netdev[i] && netdev_uses_dsa(eth->netdev[i]))
+ 			val |= MTK_GDMA_SPECIAL_TAG;
+ 
+ 		mtk_w32(eth, val, MTK_GDMA_FWD_CFG(i));
+@@ -3143,8 +3143,7 @@ static int mtk_open(struct net_device *d
+ 	struct mtk_eth *eth = mac->hw;
+ 	int i, err;
+ 
+-	if ((mtk_uses_dsa(dev) && !eth->prog) &&
+-	    !(mac->id == 1 && MTK_HAS_CAPS(eth->soc->caps, MTK_GMAC1_TRGMII))) {
++	if (mtk_uses_dsa(dev) && !eth->prog) {
+ 		for (i = 0; i < ARRAY_SIZE(eth->dsa_meta); i++) {
+ 			struct metadata_dst *md_dst = eth->dsa_meta[i];
+ 
+@@ -3161,8 +3160,7 @@ static int mtk_open(struct net_device *d
+ 		}
+ 	} else {
+ 		/* Hardware special tag parsing needs to be disabled if at least
+-		 * one MAC does not use DSA, or the second MAC of the MT7621 and
+-		 * MT7623 SoCs is being used.
++		 * one MAC does not use DSA.
+ 		 */
+ 		u32 val = mtk_r32(eth, MTK_CDMP_IG_CTRL);
+ 		val &= ~MTK_CDMP_STAG_EN;
diff --git a/target/linux/generic/backport-5.15/730-14-v6.3-net-ethernet-mtk_eth_soc-fix-DSA-TX-tag-hwaccel-for-.patch b/target/linux/generic/backport-5.15/730-14-v6.3-net-ethernet-mtk_eth_soc-fix-DSA-TX-tag-hwaccel-for-.patch
new file mode 100644
index 00000000000000..c392429b887478
--- /dev/null
+++ b/target/linux/generic/backport-5.15/730-14-v6.3-net-ethernet-mtk_eth_soc-fix-DSA-TX-tag-hwaccel-for-.patch
@@ -0,0 +1,129 @@
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Tue, 7 Feb 2023 12:30:27 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: fix DSA TX tag hwaccel for switch
+ port 0
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Arınç reports that on his MT7621AT Unielec U7621-06 board and MT7623NI
+Bananapi BPI-R2, packets received by the CPU over mt7530 switch port 0
+(of which this driver acts as the DSA master) are not processed
+correctly by software. More precisely, they arrive without a DSA tag
+(in packet or in the hwaccel area - skb_metadata_dst()), so DSA cannot
+demux them towards the switch's interface for port 0. Traffic from other
+ports receives a skb_metadata_dst() with the correct port and is demuxed
+properly.
+
+Looking at mtk_poll_rx(), it becomes apparent that this driver uses the
+skb vlan hwaccel area:
+
+	union {
+		u32		vlan_all;
+		struct {
+			__be16	vlan_proto;
+			__u16	vlan_tci;
+		};
+	};
+
+as a temporary storage for the VLAN hwaccel tag, or the DSA hwaccel tag.
+If this is a DSA master it's a DSA hwaccel tag, and finally clears up
+the skb VLAN hwaccel header.
+
+I'm guessing that the problem is the (mis)use of API.
+skb_vlan_tag_present() looks like this:
+
+ #define skb_vlan_tag_present(__skb)	(!!(__skb)->vlan_all)
+
+So if both vlan_proto and vlan_tci are zeroes, skb_vlan_tag_present()
+returns precisely false. I don't know for sure what is the format of the
+DSA hwaccel tag, but I surely know that lowermost 3 bits of vlan_proto
+are 0 when receiving from port 0:
+
+	unsigned int port = vlan_proto & GENMASK(2, 0);
+
+If the RX descriptor has no other bits set to non-zero values in
+RX_DMA_VTAG, then the call to __vlan_hwaccel_put_tag() will not, in
+fact, make the subsequent skb_vlan_tag_present() return true, because
+it's implemented like this:
+
+static inline void __vlan_hwaccel_put_tag(struct sk_buff *skb,
+					  __be16 vlan_proto, u16 vlan_tci)
+{
+	skb->vlan_proto = vlan_proto;
+	skb->vlan_tci = vlan_tci;
+}
+
+What we need to do to fix this problem (assuming this is the problem) is
+to stop using skb->vlan_all as temporary storage for driver affairs, and
+just create some local variables that serve the same purpose, but
+hopefully better. Instead of calling skb_vlan_tag_present(), let's look
+at a boolean has_hwaccel_tag which we set to true when the RX DMA
+descriptors have something. Disambiguate based on netdev_uses_dsa()
+whether this is a VLAN or DSA hwaccel tag, and only call
+__vlan_hwaccel_put_tag() if we're certain it's a VLAN tag.
+
+Arınç confirms that the treatment works, so this validates the
+assumption.
+
+Link: https://lore.kernel.org/netdev/704f3a72-fc9e-714a-db54-272e17612637@arinc9.com/
+Fixes: 2d7605a72906 ("net: ethernet: mtk_eth_soc: enable hardware DSA untagging")
+Reported-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Tested-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1830,7 +1830,9 @@ static int mtk_poll_rx(struct napi_struc
+ 
+ 	while (done < budget) {
+ 		unsigned int pktlen, *rxdcsum;
++		bool has_hwaccel_tag = false;
+ 		struct net_device *netdev;
++		u16 vlan_proto, vlan_tci;
+ 		dma_addr_t dma_addr;
+ 		u32 hash, reason;
+ 		int mac = 0;
+@@ -1970,27 +1972,29 @@ static int mtk_poll_rx(struct napi_struc
+ 
+ 		if (netdev->features & NETIF_F_HW_VLAN_CTAG_RX) {
+ 			if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+-				if (trxd.rxd3 & RX_DMA_VTAG_V2)
+-					__vlan_hwaccel_put_tag(skb,
+-						htons(RX_DMA_VPID(trxd.rxd4)),
+-						RX_DMA_VID(trxd.rxd4));
++				if (trxd.rxd3 & RX_DMA_VTAG_V2) {
++					vlan_proto = RX_DMA_VPID(trxd.rxd4);
++					vlan_tci = RX_DMA_VID(trxd.rxd4);
++					has_hwaccel_tag = true;
++				}
+ 			} else if (trxd.rxd2 & RX_DMA_VTAG) {
+-				__vlan_hwaccel_put_tag(skb, htons(RX_DMA_VPID(trxd.rxd3)),
+-						       RX_DMA_VID(trxd.rxd3));
++				vlan_proto = RX_DMA_VPID(trxd.rxd3);
++				vlan_tci = RX_DMA_VID(trxd.rxd3);
++				has_hwaccel_tag = true;
+ 			}
+ 		}
+ 
+ 		/* When using VLAN untagging in combination with DSA, the
+ 		 * hardware treats the MTK special tag as a VLAN and untags it.
+ 		 */
+-		if (skb_vlan_tag_present(skb) && netdev_uses_dsa(netdev)) {
+-			unsigned int port = ntohs(skb->vlan_proto) & GENMASK(2, 0);
++		if (has_hwaccel_tag && netdev_uses_dsa(netdev)) {
++			unsigned int port = vlan_proto & GENMASK(2, 0);
+ 
+ 			if (port < ARRAY_SIZE(eth->dsa_meta) &&
+ 			    eth->dsa_meta[port])
+ 				skb_dst_set_noref(skb, &eth->dsa_meta[port]->dst);
+-
+-			__vlan_hwaccel_clear_tag(skb);
++		} else if (has_hwaccel_tag) {
++			__vlan_hwaccel_put_tag(skb, htons(vlan_proto), vlan_tci);
+ 		}
+ 
+ 		skb_record_rx_queue(skb, 0);
diff --git a/target/linux/generic/backport-5.15/730-15-v6.3-net-ethernet-mtk_wed-No-need-to-clear-memory-after-a.patch b/target/linux/generic/backport-5.15/730-15-v6.3-net-ethernet-mtk_wed-No-need-to-clear-memory-after-a.patch
new file mode 100644
index 00000000000000..74a77ddaca2beb
--- /dev/null
+++ b/target/linux/generic/backport-5.15/730-15-v6.3-net-ethernet-mtk_wed-No-need-to-clear-memory-after-a.patch
@@ -0,0 +1,26 @@
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Sun, 12 Feb 2023 07:51:51 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: No need to clear memory after a
+ dma_alloc_coherent() call
+
+dma_alloc_coherent() already clears the allocated memory, there is no need
+to explicitly call memset().
+
+Moreover, it is likely that the size in the memset() is incorrect and
+should be "size * sizeof(*ring->desc)".
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/d5acce7dd108887832c9719f62c7201b4c83b3fb.1676184599.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -786,7 +786,6 @@ mtk_wed_rro_ring_alloc(struct mtk_wed_de
+ 
+ 	ring->desc_size = sizeof(*ring->desc);
+ 	ring->size = size;
+-	memset(ring->desc, 0, size);
+ 
+ 	return 0;
+ }
diff --git a/target/linux/generic/backport-5.15/730-16-v6.3-net-ethernet-mtk_wed-fix-some-possible-NULL-pointer-.patch b/target/linux/generic/backport-5.15/730-16-v6.3-net-ethernet-mtk_wed-fix-some-possible-NULL-pointer-.patch
new file mode 100644
index 00000000000000..e043a681da40f6
--- /dev/null
+++ b/target/linux/generic/backport-5.15/730-16-v6.3-net-ethernet-mtk_wed-fix-some-possible-NULL-pointer-.patch
@@ -0,0 +1,61 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Wed, 7 Dec 2022 15:04:54 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: fix some possible NULL pointer
+ dereferences
+
+Fix possible NULL pointer dereference in mtk_wed_detach routine checking
+wo pointer is properly allocated before running mtk_wed_wo_reset() and
+mtk_wed_wo_deinit().
+Even if it is just a theoretical issue at the moment check wo pointer is
+not NULL in mtk_wed_mcu_msg_update.
+Moreover, honor mtk_wed_mcu_send_msg return value in mtk_wed_wo_reset()
+
+Fixes: 799684448e3e ("net: ethernet: mtk_wed: introduce wed wo support")
+Fixes: 4c5de09eb0d0 ("net: ethernet: mtk_wed: add configure wed wo support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -174,9 +174,10 @@ mtk_wed_wo_reset(struct mtk_wed_device *
+ 	mtk_wdma_tx_reset(dev);
+ 	mtk_wed_reset(dev, MTK_WED_RESET_WED);
+ 
+-	mtk_wed_mcu_send_msg(wo, MTK_WED_MODULE_ID_WO,
+-			     MTK_WED_WO_CMD_CHANGE_STATE, &state,
+-			     sizeof(state), false);
++	if (mtk_wed_mcu_send_msg(wo, MTK_WED_MODULE_ID_WO,
++				 MTK_WED_WO_CMD_CHANGE_STATE, &state,
++				 sizeof(state), false))
++		return;
+ 
+ 	if (readx_poll_timeout(mtk_wed_wo_read_status, dev, val,
+ 			       val == MTK_WED_WOIF_DISABLE_DONE,
+@@ -632,9 +633,11 @@ mtk_wed_detach(struct mtk_wed_device *de
+ 	mtk_wed_free_tx_rings(dev);
+ 
+ 	if (mtk_wed_get_rx_capa(dev)) {
+-		mtk_wed_wo_reset(dev);
++		if (hw->wed_wo)
++			mtk_wed_wo_reset(dev);
+ 		mtk_wed_free_rx_rings(dev);
+-		mtk_wed_wo_deinit(hw);
++		if (hw->wed_wo)
++			mtk_wed_wo_deinit(hw);
+ 	}
+ 
+ 	if (dev->wlan.bus_type == MTK_WED_BUS_PCIE) {
+--- a/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
+@@ -207,6 +207,9 @@ int mtk_wed_mcu_msg_update(struct mtk_we
+ 	if (dev->hw->version == 1)
+ 		return 0;
+ 
++	if (WARN_ON(!wo))
++		return -ENODEV;
++
+ 	return mtk_wed_mcu_send_msg(wo, MTK_WED_MODULE_ID_WO, id, data, len,
+ 				    true);
+ }
diff --git a/target/linux/generic/backport-5.15/730-17-v6.3-net-ethernet-mtk_wed-fix-possible-deadlock-if-mtk_we.patch b/target/linux/generic/backport-5.15/730-17-v6.3-net-ethernet-mtk_wed-fix-possible-deadlock-if-mtk_we.patch
new file mode 100644
index 00000000000000..d1c5fb6656db54
--- /dev/null
+++ b/target/linux/generic/backport-5.15/730-17-v6.3-net-ethernet-mtk_wed-fix-possible-deadlock-if-mtk_we.patch
@@ -0,0 +1,58 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Wed, 7 Dec 2022 15:04:55 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: fix possible deadlock if
+ mtk_wed_wo_init fails
+
+Introduce __mtk_wed_detach() in order to avoid a deadlock in
+mtk_wed_attach routine if mtk_wed_wo_init fails since both
+mtk_wed_attach and mtk_wed_detach run holding hw_lock mutex.
+
+Fixes: 4c5de09eb0d0 ("net: ethernet: mtk_wed: add configure wed wo support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -619,12 +619,10 @@ mtk_wed_deinit(struct mtk_wed_device *de
+ }
+ 
+ static void
+-mtk_wed_detach(struct mtk_wed_device *dev)
++__mtk_wed_detach(struct mtk_wed_device *dev)
+ {
+ 	struct mtk_wed_hw *hw = dev->hw;
+ 
+-	mutex_lock(&hw_lock);
+-
+ 	mtk_wed_deinit(dev);
+ 
+ 	mtk_wdma_rx_reset(dev);
+@@ -657,6 +655,13 @@ mtk_wed_detach(struct mtk_wed_device *de
+ 	module_put(THIS_MODULE);
+ 
+ 	hw->wed_dev = NULL;
++}
++
++static void
++mtk_wed_detach(struct mtk_wed_device *dev)
++{
++	mutex_lock(&hw_lock);
++	__mtk_wed_detach(dev);
+ 	mutex_unlock(&hw_lock);
+ }
+ 
+@@ -1545,8 +1550,10 @@ mtk_wed_attach(struct mtk_wed_device *de
+ 		ret = mtk_wed_wo_init(hw);
+ 	}
+ out:
+-	if (ret)
+-		mtk_wed_detach(dev);
++	if (ret) {
++		dev_err(dev->hw->dev, "failed to attach wed device\n");
++		__mtk_wed_detach(dev);
++	}
+ unlock:
+ 	mutex_unlock(&hw_lock);
+ 
diff --git a/target/linux/generic/backport-5.15/730-18-v6.3-net-ethernet-mtk_eth_soc-fix-tx-throughput-regressio.patch b/target/linux/generic/backport-5.15/730-18-v6.3-net-ethernet-mtk_eth_soc-fix-tx-throughput-regressio.patch
new file mode 100644
index 00000000000000..e633f6f1fb809a
--- /dev/null
+++ b/target/linux/generic/backport-5.15/730-18-v6.3-net-ethernet-mtk_eth_soc-fix-tx-throughput-regressio.patch
@@ -0,0 +1,31 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 24 Mar 2023 14:56:58 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: fix tx throughput regression with
+ direct 1G links
+
+Using the QDMA tx scheduler to throttle tx to line speed works fine for
+switch ports, but apparently caused a regression on non-switch ports.
+
+Based on a number of tests, it seems that this throttling can be safely
+dropped without re-introducing the issues on switch ports that the
+tx scheduling changes resolved.
+
+Link: https://lore.kernel.org/netdev/trinity-92c3826f-c2c8-40af-8339-bc6d0d3ffea4-1678213958520@3c-app-gmx-bs16/
+Fixes: f63959c7eec3 ("net: ethernet: mtk_eth_soc: implement multi-queue support for per-port queues")
+Reported-by: Frank Wunderlich <frank-w@public-files.de>
+Reported-by: Daniel Golle <daniel@makrotopia.org>
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -676,8 +676,6 @@ static void mtk_mac_link_up(struct phyli
+ 		break;
+ 	}
+ 
+-	mtk_set_queue_speed(mac->hw, mac->id, speed);
+-
+ 	/* Configure duplex */
+ 	if (duplex == DUPLEX_FULL)
+ 		mcr |= MAC_MCR_FORCE_DPX;
diff --git a/target/linux/generic/backport-5.15/733-v6.2-01-net-ethernet-mtk_eth_soc-Avoid-truncating-allocation.patch b/target/linux/generic/backport-5.15/733-v6.2-01-net-ethernet-mtk_eth_soc-Avoid-truncating-allocation.patch
new file mode 100644
index 00000000000000..460c5c23178991
--- /dev/null
+++ b/target/linux/generic/backport-5.15/733-v6.2-01-net-ethernet-mtk_eth_soc-Avoid-truncating-allocation.patch
@@ -0,0 +1,60 @@
+From f3eceaed9edd7c0e0d9fb057613131f92973626f Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Fri, 27 Jan 2023 14:38:54 -0800
+Subject: [PATCH] net: ethernet: mtk_eth_soc: Avoid truncating allocation
+
+There doesn't appear to be a reason to truncate the allocation used for
+flow_info, so do a full allocation and remove the unused empty struct.
+GCC does not like having a reference to an object that has been
+partially allocated, as bounds checking may become impossible when
+such an object is passed to other code. Seen with GCC 13:
+
+../drivers/net/ethernet/mediatek/mtk_ppe.c: In function 'mtk_foe_entry_commit_subflow':
+../drivers/net/ethernet/mediatek/mtk_ppe.c:623:18: warning: array subscript 'struct mtk_flow_entry[0]' is partly outside array bounds of 'unsigned char[48]' [-Warray-bounds=]
+  623 |         flow_info->l2_data.base_flow = entry;
+      |                  ^~
+
+Cc: Felix Fietkau <nbd@nbd.name>
+Cc: John Crispin <john@phrozen.org>
+Cc: Sean Wang <sean.wang@mediatek.com>
+Cc: Mark Lee <Mark-MC.Lee@mediatek.com>
+Cc: Lorenzo Bianconi <lorenzo@kernel.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: Matthias Brugger <matthias.bgg@gmail.com>
+Cc: netdev@vger.kernel.org
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-mediatek@lists.infradead.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/20230127223853.never.014-kees@kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/mediatek/mtk_ppe.c | 3 +--
+ drivers/net/ethernet/mediatek/mtk_ppe.h | 1 -
+ 2 files changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -621,8 +621,7 @@ mtk_foe_entry_commit_subflow(struct mtk_
+ 	u32 ib1_mask = mtk_get_ib1_pkt_type_mask(ppe->eth) | MTK_FOE_IB1_UDP;
+ 	int type;
+ 
+-	flow_info = kzalloc(offsetof(struct mtk_flow_entry, l2_data.end),
+-			    GFP_ATOMIC);
++	flow_info = kzalloc(sizeof(*flow_info), GFP_ATOMIC);
+ 	if (!flow_info)
+ 		return;
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h
+@@ -279,7 +279,6 @@ struct mtk_flow_entry {
+ 		struct {
+ 			struct mtk_flow_entry *base_flow;
+ 			struct hlist_node list;
+-			struct {} end;
+ 		} l2_data;
+ 	};
+ 	struct rhash_head node;
diff --git a/target/linux/generic/backport-5.15/733-v6.2-02-net-mtk_eth_soc-add-definitions-for-PCS.patch b/target/linux/generic/backport-5.15/733-v6.2-02-net-mtk_eth_soc-add-definitions-for-PCS.patch
new file mode 100644
index 00000000000000..68f3659367a32e
--- /dev/null
+++ b/target/linux/generic/backport-5.15/733-v6.2-02-net-mtk_eth_soc-add-definitions-for-PCS.patch
@@ -0,0 +1,55 @@
+From b6a709cb51f7bdc55c01cec886098a9753ce8c28 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 27 Oct 2022 14:10:42 +0100
+Subject: [PATCH 01/10] net: mtk_eth_soc: add definitions for PCS
+
+As a result of help from Frank Wunderlich to investigate and test, we
+know a bit more about the PCS on the Mediatek platforms. Update the
+definitions from this investigation.
+
+This PCS appears similar, but not identical to the Lynx PCS.
+
+Although not included in this patch, but for future reference, the PHY
+ID registers at offset 4 read as 0x4d544950 'MTIP'.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -501,8 +501,10 @@
+ #define ETHSYS_DMA_AG_MAP_PPE	BIT(2)
+ 
+ /* SGMII subsystem config registers */
+-/* Register to auto-negotiation restart */
++/* BMCR (low 16) BMSR (high 16) */
+ #define SGMSYS_PCS_CONTROL_1	0x0
++#define SGMII_BMCR		GENMASK(15, 0)
++#define SGMII_BMSR		GENMASK(31, 16)
+ #define SGMII_AN_RESTART	BIT(9)
+ #define SGMII_ISOLATE		BIT(10)
+ #define SGMII_AN_ENABLE		BIT(12)
+@@ -512,13 +514,18 @@
+ #define SGMII_PCS_FAULT		BIT(23)
+ #define SGMII_AN_EXPANSION_CLR	BIT(30)
+ 
++#define SGMSYS_PCS_ADVERTISE	0x8
++#define SGMII_ADVERTISE		GENMASK(15, 0)
++#define SGMII_LPA		GENMASK(31, 16)
++
+ /* Register to programmable link timer, the unit in 2 * 8ns */
+ #define SGMSYS_PCS_LINK_TIMER	0x18
+-#define SGMII_LINK_TIMER_DEFAULT	(0x186a0 & GENMASK(19, 0))
++#define SGMII_LINK_TIMER_MASK	GENMASK(19, 0)
++#define SGMII_LINK_TIMER_DEFAULT	(0x186a0 & SGMII_LINK_TIMER_MASK)
+ 
+ /* Register to control remote fault */
+ #define SGMSYS_SGMII_MODE		0x20
+-#define SGMII_IF_MODE_BIT0		BIT(0)
++#define SGMII_IF_MODE_SGMII		BIT(0)
+ #define SGMII_SPEED_DUPLEX_AN		BIT(1)
+ #define SGMII_SPEED_MASK		GENMASK(3, 2)
+ #define SGMII_SPEED_10			FIELD_PREP(SGMII_SPEED_MASK, 0)
diff --git a/target/linux/generic/backport-5.15/733-v6.2-03-net-mtk_eth_soc-eliminate-unnecessary-error-handling.patch b/target/linux/generic/backport-5.15/733-v6.2-03-net-mtk_eth_soc-eliminate-unnecessary-error-handling.patch
new file mode 100644
index 00000000000000..4ea428c9d6b1c2
--- /dev/null
+++ b/target/linux/generic/backport-5.15/733-v6.2-03-net-mtk_eth_soc-eliminate-unnecessary-error-handling.patch
@@ -0,0 +1,74 @@
+From 5cf7797526ee81bea0f627bccaa3d887f48f53e0 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 27 Oct 2022 14:10:47 +0100
+Subject: [PATCH 02/10] net: mtk_eth_soc: eliminate unnecessary error handling
+
+The functions called by the pcs_config() method always return zero, so
+there is no point trying to handle an error from these functions. Make
+these functions void, eliminate the "err" variable and simply return
+zero from the pcs_config() function itself.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 18 ++++++------------
+ 1 file changed, 6 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -20,7 +20,7 @@ static struct mtk_pcs *pcs_to_mtk_pcs(st
+ }
+ 
+ /* For SGMII interface mode */
+-static int mtk_pcs_setup_mode_an(struct mtk_pcs *mpcs)
++static void mtk_pcs_setup_mode_an(struct mtk_pcs *mpcs)
+ {
+ 	unsigned int val;
+ 
+@@ -39,16 +39,13 @@ static int mtk_pcs_setup_mode_an(struct
+ 	regmap_read(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, &val);
+ 	val &= ~SGMII_PHYA_PWD;
+ 	regmap_write(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, val);
+-
+-	return 0;
+-
+ }
+ 
+ /* For 1000BASE-X and 2500BASE-X interface modes, which operate at a
+  * fixed speed.
+  */
+-static int mtk_pcs_setup_mode_force(struct mtk_pcs *mpcs,
+-				    phy_interface_t interface)
++static void mtk_pcs_setup_mode_force(struct mtk_pcs *mpcs,
++				     phy_interface_t interface)
+ {
+ 	unsigned int val;
+ 
+@@ -73,8 +70,6 @@ static int mtk_pcs_setup_mode_force(stru
+ 	regmap_read(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, &val);
+ 	val &= ~SGMII_PHYA_PWD;
+ 	regmap_write(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, val);
+-
+-	return 0;
+ }
+ 
+ static int mtk_pcs_config(struct phylink_pcs *pcs, unsigned int mode,
+@@ -83,15 +78,14 @@ static int mtk_pcs_config(struct phylink
+ 			  bool permit_pause_to_mac)
+ {
+ 	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+-	int err = 0;
+ 
+ 	/* Setup SGMIISYS with the determined property */
+ 	if (interface != PHY_INTERFACE_MODE_SGMII)
+-		err = mtk_pcs_setup_mode_force(mpcs, interface);
++		mtk_pcs_setup_mode_force(mpcs, interface);
+ 	else if (phylink_autoneg_inband(mode))
+-		err = mtk_pcs_setup_mode_an(mpcs);
++		mtk_pcs_setup_mode_an(mpcs);
+ 
+-	return err;
++	return 0;
+ }
+ 
+ static void mtk_pcs_restart_an(struct phylink_pcs *pcs)
diff --git a/target/linux/generic/backport-5.15/733-v6.2-04-net-mtk_eth_soc-add-pcs_get_state-implementation.patch b/target/linux/generic/backport-5.15/733-v6.2-04-net-mtk_eth_soc-add-pcs_get_state-implementation.patch
new file mode 100644
index 00000000000000..64a4a72fa6ae96
--- /dev/null
+++ b/target/linux/generic/backport-5.15/733-v6.2-04-net-mtk_eth_soc-add-pcs_get_state-implementation.patch
@@ -0,0 +1,46 @@
+From c000dca098002da193b98099df051c9ead0cacb4 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 27 Oct 2022 14:10:52 +0100
+Subject: [PATCH 03/10] net: mtk_eth_soc: add pcs_get_state() implementation
+
+Add a pcs_get_state() implementation which uses the advertisements
+to compute the resulting link modes, and BMSR contents to determine
+negotiation and link status.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -19,6 +19,20 @@ static struct mtk_pcs *pcs_to_mtk_pcs(st
+ 	return container_of(pcs, struct mtk_pcs, pcs);
+ }
+ 
++static void mtk_pcs_get_state(struct phylink_pcs *pcs,
++			      struct phylink_link_state *state)
++{
++	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
++	unsigned int bm, adv;
++
++	/* Read the BMSR and LPA */
++	regmap_read(mpcs->regmap, SGMSYS_PCS_CONTROL_1, &bm);
++	regmap_read(mpcs->regmap, SGMSYS_PCS_ADVERTISE, &adv);
++
++	phylink_mii_c22_pcs_decode_state(state, FIELD_GET(SGMII_BMSR, bm),
++					 FIELD_GET(SGMII_LPA, adv));
++}
++
+ /* For SGMII interface mode */
+ static void mtk_pcs_setup_mode_an(struct mtk_pcs *mpcs)
+ {
+@@ -117,6 +131,7 @@ static void mtk_pcs_link_up(struct phyli
+ }
+ 
+ static const struct phylink_pcs_ops mtk_pcs_ops = {
++	.pcs_get_state = mtk_pcs_get_state,
+ 	.pcs_config = mtk_pcs_config,
+ 	.pcs_an_restart = mtk_pcs_restart_an,
+ 	.pcs_link_up = mtk_pcs_link_up,
diff --git a/target/linux/generic/backport-5.15/733-v6.2-05-net-mtk_eth_soc-convert-mtk_sgmii-to-use-regmap_upda.patch b/target/linux/generic/backport-5.15/733-v6.2-05-net-mtk_eth_soc-convert-mtk_sgmii-to-use-regmap_upda.patch
new file mode 100644
index 00000000000000..24610fe11e1f4d
--- /dev/null
+++ b/target/linux/generic/backport-5.15/733-v6.2-05-net-mtk_eth_soc-convert-mtk_sgmii-to-use-regmap_upda.patch
@@ -0,0 +1,130 @@
+From 0d2351dc2768061689abd4de1529fa206bbd574e Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 27 Oct 2022 14:10:58 +0100
+Subject: [PATCH 04/10] net: mtk_eth_soc: convert mtk_sgmii to use
+ regmap_update_bits()
+
+mtk_sgmii does a lot of read-modify-write operations, for which there
+is a specific regmap function. Use this function instead of open-coding
+the operations.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 61 ++++++++++-------------
+ 1 file changed, 26 insertions(+), 35 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -36,23 +36,18 @@ static void mtk_pcs_get_state(struct phy
+ /* For SGMII interface mode */
+ static void mtk_pcs_setup_mode_an(struct mtk_pcs *mpcs)
+ {
+-	unsigned int val;
+-
+ 	/* Setup the link timer and QPHY power up inside SGMIISYS */
+ 	regmap_write(mpcs->regmap, SGMSYS_PCS_LINK_TIMER,
+ 		     SGMII_LINK_TIMER_DEFAULT);
+ 
+-	regmap_read(mpcs->regmap, SGMSYS_SGMII_MODE, &val);
+-	val |= SGMII_REMOTE_FAULT_DIS;
+-	regmap_write(mpcs->regmap, SGMSYS_SGMII_MODE, val);
+-
+-	regmap_read(mpcs->regmap, SGMSYS_PCS_CONTROL_1, &val);
+-	val |= SGMII_AN_RESTART;
+-	regmap_write(mpcs->regmap, SGMSYS_PCS_CONTROL_1, val);
+-
+-	regmap_read(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, &val);
+-	val &= ~SGMII_PHYA_PWD;
+-	regmap_write(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, val);
++	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
++			   SGMII_REMOTE_FAULT_DIS, SGMII_REMOTE_FAULT_DIS);
++
++	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
++			   SGMII_AN_RESTART, SGMII_AN_RESTART);
++
++	regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
++			   SGMII_PHYA_PWD, 0);
+ }
+ 
+ /* For 1000BASE-X and 2500BASE-X interface modes, which operate at a
+@@ -61,29 +56,26 @@ static void mtk_pcs_setup_mode_an(struct
+ static void mtk_pcs_setup_mode_force(struct mtk_pcs *mpcs,
+ 				     phy_interface_t interface)
+ {
+-	unsigned int val;
++	unsigned int rgc3;
+ 
+-	regmap_read(mpcs->regmap, mpcs->ana_rgc3, &val);
+-	val &= ~RG_PHY_SPEED_MASK;
+ 	if (interface == PHY_INTERFACE_MODE_2500BASEX)
+-		val |= RG_PHY_SPEED_3_125G;
+-	regmap_write(mpcs->regmap, mpcs->ana_rgc3, val);
++		rgc3 = RG_PHY_SPEED_3_125G;
++
++	regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
++			   RG_PHY_SPEED_3_125G, rgc3);
+ 
+ 	/* Disable SGMII AN */
+-	regmap_read(mpcs->regmap, SGMSYS_PCS_CONTROL_1, &val);
+-	val &= ~SGMII_AN_ENABLE;
+-	regmap_write(mpcs->regmap, SGMSYS_PCS_CONTROL_1, val);
++	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
++			   SGMII_AN_ENABLE, 0);
+ 
+ 	/* Set the speed etc but leave the duplex unchanged */
+-	regmap_read(mpcs->regmap, SGMSYS_SGMII_MODE, &val);
+-	val &= SGMII_DUPLEX_FULL | ~SGMII_IF_MODE_MASK;
+-	val |= SGMII_SPEED_1000;
+-	regmap_write(mpcs->regmap, SGMSYS_SGMII_MODE, val);
++	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
++			   SGMII_IF_MODE_MASK & ~SGMII_DUPLEX_FULL,
++			   SGMII_SPEED_1000);
+ 
+ 	/* Release PHYA power down state */
+-	regmap_read(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, &val);
+-	val &= ~SGMII_PHYA_PWD;
+-	regmap_write(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, val);
++	regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
++			   SGMII_PHYA_PWD, 0);
+ }
+ 
+ static int mtk_pcs_config(struct phylink_pcs *pcs, unsigned int mode,
+@@ -105,29 +97,28 @@ static int mtk_pcs_config(struct phylink
+ static void mtk_pcs_restart_an(struct phylink_pcs *pcs)
+ {
+ 	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+-	unsigned int val;
+ 
+-	regmap_read(mpcs->regmap, SGMSYS_PCS_CONTROL_1, &val);
+-	val |= SGMII_AN_RESTART;
+-	regmap_write(mpcs->regmap, SGMSYS_PCS_CONTROL_1, val);
++	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
++			   SGMII_AN_RESTART, SGMII_AN_RESTART);
+ }
+ 
+ static void mtk_pcs_link_up(struct phylink_pcs *pcs, unsigned int mode,
+ 			    phy_interface_t interface, int speed, int duplex)
+ {
+ 	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+-	unsigned int val;
++	unsigned int sgm_mode;
+ 
+ 	if (!phy_interface_mode_is_8023z(interface))
+ 		return;
+ 
+ 	/* SGMII force duplex setting */
+-	regmap_read(mpcs->regmap, SGMSYS_SGMII_MODE, &val);
+-	val &= ~SGMII_DUPLEX_FULL;
+ 	if (duplex == DUPLEX_FULL)
+-		val |= SGMII_DUPLEX_FULL;
++		sgm_mode = SGMII_DUPLEX_FULL;
++	else
++		sgm_mode = 0;
+ 
+-	regmap_write(mpcs->regmap, SGMSYS_SGMII_MODE, val);
++	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
++			   SGMII_DUPLEX_FULL, sgm_mode);
+ }
+ 
+ static const struct phylink_pcs_ops mtk_pcs_ops = {
diff --git a/target/linux/generic/backport-5.15/733-v6.2-06-net-mtk_eth_soc-add-out-of-band-forcing-of-speed-and.patch b/target/linux/generic/backport-5.15/733-v6.2-06-net-mtk_eth_soc-add-out-of-band-forcing-of-speed-and.patch
new file mode 100644
index 00000000000000..ba76ca40ffaaa8
--- /dev/null
+++ b/target/linux/generic/backport-5.15/733-v6.2-06-net-mtk_eth_soc-add-out-of-band-forcing-of-speed-and.patch
@@ -0,0 +1,52 @@
+From 12198c3a410fe69843e335c1bbf6d4c2a4d48e4e Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 27 Oct 2022 14:11:03 +0100
+Subject: [PATCH 05/10] net: mtk_eth_soc: add out of band forcing of speed and
+ duplex in pcs_link_up
+
+Add support for forcing the link speed and duplex setting in the
+pcs_link_up() method for out of band modes, which will be useful when
+we finish converting the pcs_config() method. Until then, we still have
+to force duplex for 802.3z modes to work correctly.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 28 ++++++++++++++---------
+ 1 file changed, 17 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -108,17 +108,23 @@ static void mtk_pcs_link_up(struct phyli
+ 	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+ 	unsigned int sgm_mode;
+ 
+-	if (!phy_interface_mode_is_8023z(interface))
+-		return;
++	if (!phylink_autoneg_inband(mode) ||
++	    phy_interface_mode_is_8023z(interface)) {
++		/* Force the speed and duplex setting */
++		if (speed == SPEED_10)
++			sgm_mode = SGMII_SPEED_10;
++		else if (speed == SPEED_100)
++			sgm_mode = SGMII_SPEED_100;
++		else
++			sgm_mode = SGMII_SPEED_1000;
+ 
+-	/* SGMII force duplex setting */
+-	if (duplex == DUPLEX_FULL)
+-		sgm_mode = SGMII_DUPLEX_FULL;
+-	else
+-		sgm_mode = 0;
++		if (duplex == DUPLEX_FULL)
++			sgm_mode |= SGMII_DUPLEX_FULL;
+ 
+-	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
+-			   SGMII_DUPLEX_FULL, sgm_mode);
++		regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
++				   SGMII_DUPLEX_FULL | SGMII_SPEED_MASK,
++				   sgm_mode);
++	}
+ }
+ 
+ static const struct phylink_pcs_ops mtk_pcs_ops = {
diff --git a/target/linux/generic/backport-5.15/733-v6.2-07-net-mtk_eth_soc-move-PHY-power-up.patch b/target/linux/generic/backport-5.15/733-v6.2-07-net-mtk_eth_soc-move-PHY-power-up.patch
new file mode 100644
index 00000000000000..b76e15927505cb
--- /dev/null
+++ b/target/linux/generic/backport-5.15/733-v6.2-07-net-mtk_eth_soc-move-PHY-power-up.patch
@@ -0,0 +1,48 @@
+From 6f38fffe2179dd29612aea2c67c46ed6682b4e46 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 27 Oct 2022 14:11:08 +0100
+Subject: [PATCH 06/10] net: mtk_eth_soc: move PHY power up
+
+The PHY power up is common to both configuration paths, so move it into
+the parent function. We need to do this for all serdes modes.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -45,9 +45,6 @@ static void mtk_pcs_setup_mode_an(struct
+ 
+ 	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
+ 			   SGMII_AN_RESTART, SGMII_AN_RESTART);
+-
+-	regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
+-			   SGMII_PHYA_PWD, 0);
+ }
+ 
+ /* For 1000BASE-X and 2500BASE-X interface modes, which operate at a
+@@ -72,10 +69,6 @@ static void mtk_pcs_setup_mode_force(str
+ 	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
+ 			   SGMII_IF_MODE_MASK & ~SGMII_DUPLEX_FULL,
+ 			   SGMII_SPEED_1000);
+-
+-	/* Release PHYA power down state */
+-	regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
+-			   SGMII_PHYA_PWD, 0);
+ }
+ 
+ static int mtk_pcs_config(struct phylink_pcs *pcs, unsigned int mode,
+@@ -91,6 +84,10 @@ static int mtk_pcs_config(struct phylink
+ 	else if (phylink_autoneg_inband(mode))
+ 		mtk_pcs_setup_mode_an(mpcs);
+ 
++	/* Release PHYA power down state */
++	regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
++			   SGMII_PHYA_PWD, 0);
++
+ 	return 0;
+ }
+ 
diff --git a/target/linux/generic/backport-5.15/733-v6.2-08-net-mtk_eth_soc-move-interface-speed-selection.patch b/target/linux/generic/backport-5.15/733-v6.2-08-net-mtk_eth_soc-move-interface-speed-selection.patch
new file mode 100644
index 00000000000000..cd9f0699b3ebc7
--- /dev/null
+++ b/target/linux/generic/backport-5.15/733-v6.2-08-net-mtk_eth_soc-move-interface-speed-selection.patch
@@ -0,0 +1,48 @@
+From f752c0df13dfeb721c11d3debb79f08cf437344f Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 27 Oct 2022 14:11:13 +0100
+Subject: [PATCH 07/10] net: mtk_eth_soc: move interface speed selection
+
+Move the selection of the underlying interface speed to the pcs_config
+function, so we always program the interface speed.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -53,14 +53,6 @@ static void mtk_pcs_setup_mode_an(struct
+ static void mtk_pcs_setup_mode_force(struct mtk_pcs *mpcs,
+ 				     phy_interface_t interface)
+ {
+-	unsigned int rgc3;
+-
+-	if (interface == PHY_INTERFACE_MODE_2500BASEX)
+-		rgc3 = RG_PHY_SPEED_3_125G;
+-
+-	regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
+-			   RG_PHY_SPEED_3_125G, rgc3);
+-
+ 	/* Disable SGMII AN */
+ 	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
+ 			   SGMII_AN_ENABLE, 0);
+@@ -77,6 +69,16 @@ static int mtk_pcs_config(struct phylink
+ 			  bool permit_pause_to_mac)
+ {
+ 	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
++	unsigned int rgc3;
++
++	if (interface == PHY_INTERFACE_MODE_2500BASEX)
++		rgc3 = RG_PHY_SPEED_3_125G;
++	else
++		rgc3 = 0;
++
++	/* Configure the underlying interface speed */
++	regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
++			   RG_PHY_SPEED_3_125G, rgc3);
+ 
+ 	/* Setup SGMIISYS with the determined property */
+ 	if (interface != PHY_INTERFACE_MODE_SGMII)
diff --git a/target/linux/generic/backport-5.15/733-v6.2-09-net-mtk_eth_soc-add-advertisement-programming.patch b/target/linux/generic/backport-5.15/733-v6.2-09-net-mtk_eth_soc-add-advertisement-programming.patch
new file mode 100644
index 00000000000000..f08358e963d53a
--- /dev/null
+++ b/target/linux/generic/backport-5.15/733-v6.2-09-net-mtk_eth_soc-add-advertisement-programming.patch
@@ -0,0 +1,52 @@
+From c125c66ea71b9377ae2478c4f1b87b180cc5c6ef Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 27 Oct 2022 14:11:18 +0100
+Subject: [PATCH 08/10] net: mtk_eth_soc: add advertisement programming
+
+Program the advertisement into the mtk PCS block.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -70,16 +70,27 @@ static int mtk_pcs_config(struct phylink
+ {
+ 	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+ 	unsigned int rgc3;
++	int advertise;
++	bool changed;
+ 
+ 	if (interface == PHY_INTERFACE_MODE_2500BASEX)
+ 		rgc3 = RG_PHY_SPEED_3_125G;
+ 	else
+ 		rgc3 = 0;
+ 
++	advertise = phylink_mii_c22_pcs_encode_advertisement(interface,
++							     advertising);
++	if (advertise < 0)
++		return advertise;
++
+ 	/* Configure the underlying interface speed */
+ 	regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
+ 			   RG_PHY_SPEED_3_125G, rgc3);
+ 
++	/* Update the advertisement, noting whether it has changed */
++	regmap_update_bits_check(mpcs->regmap, SGMSYS_PCS_ADVERTISE,
++				 SGMII_ADVERTISE, advertise, &changed);
++
+ 	/* Setup SGMIISYS with the determined property */
+ 	if (interface != PHY_INTERFACE_MODE_SGMII)
+ 		mtk_pcs_setup_mode_force(mpcs, interface);
+@@ -90,7 +101,7 @@ static int mtk_pcs_config(struct phylink
+ 	regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
+ 			   SGMII_PHYA_PWD, 0);
+ 
+-	return 0;
++	return changed;
+ }
+ 
+ static void mtk_pcs_restart_an(struct phylink_pcs *pcs)
diff --git a/target/linux/generic/backport-5.15/733-v6.2-10-net-mtk_eth_soc-move-and-correct-link-timer-programm.patch b/target/linux/generic/backport-5.15/733-v6.2-10-net-mtk_eth_soc-move-and-correct-link-timer-programm.patch
new file mode 100644
index 00000000000000..602d52c6f46a3a
--- /dev/null
+++ b/target/linux/generic/backport-5.15/733-v6.2-10-net-mtk_eth_soc-move-and-correct-link-timer-programm.patch
@@ -0,0 +1,63 @@
+From 3027d89f87707e7f3e5b683e0d37a32afb5bde96 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 27 Oct 2022 14:11:23 +0100
+Subject: [PATCH 09/10] net: mtk_eth_soc: move and correct link timer
+ programming
+
+Program the link timer appropriately for the interface mode being
+used, using the newly introduced phylink helper that provides the
+nanosecond link timer interval.
+
+The intervals are 1.6ms for SGMII based protocols and 10ms for
+802.3z based protocols.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -36,10 +36,6 @@ static void mtk_pcs_get_state(struct phy
+ /* For SGMII interface mode */
+ static void mtk_pcs_setup_mode_an(struct mtk_pcs *mpcs)
+ {
+-	/* Setup the link timer and QPHY power up inside SGMIISYS */
+-	regmap_write(mpcs->regmap, SGMSYS_PCS_LINK_TIMER,
+-		     SGMII_LINK_TIMER_DEFAULT);
+-
+ 	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
+ 			   SGMII_REMOTE_FAULT_DIS, SGMII_REMOTE_FAULT_DIS);
+ 
+@@ -69,8 +65,8 @@ static int mtk_pcs_config(struct phylink
+ 			  bool permit_pause_to_mac)
+ {
+ 	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
++	int advertise, link_timer;
+ 	unsigned int rgc3;
+-	int advertise;
+ 	bool changed;
+ 
+ 	if (interface == PHY_INTERFACE_MODE_2500BASEX)
+@@ -83,6 +79,10 @@ static int mtk_pcs_config(struct phylink
+ 	if (advertise < 0)
+ 		return advertise;
+ 
++	link_timer = phylink_get_link_timer_ns(interface);
++	if (link_timer < 0)
++		return link_timer;
++
+ 	/* Configure the underlying interface speed */
+ 	regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
+ 			   RG_PHY_SPEED_3_125G, rgc3);
+@@ -91,6 +91,9 @@ static int mtk_pcs_config(struct phylink
+ 	regmap_update_bits_check(mpcs->regmap, SGMSYS_PCS_ADVERTISE,
+ 				 SGMII_ADVERTISE, advertise, &changed);
+ 
++	/* Setup the link timer and QPHY power up inside SGMIISYS */
++	regmap_write(mpcs->regmap, SGMSYS_PCS_LINK_TIMER, link_timer / 2 / 8);
++
+ 	/* Setup SGMIISYS with the determined property */
+ 	if (interface != PHY_INTERFACE_MODE_SGMII)
+ 		mtk_pcs_setup_mode_force(mpcs, interface);
diff --git a/target/linux/generic/backport-5.15/733-v6.2-11-net-mtk_eth_soc-add-support-for-in-band-802.3z-negot.patch b/target/linux/generic/backport-5.15/733-v6.2-11-net-mtk_eth_soc-add-support-for-in-band-802.3z-negot.patch
new file mode 100644
index 00000000000000..0e9a0535a7b260
--- /dev/null
+++ b/target/linux/generic/backport-5.15/733-v6.2-11-net-mtk_eth_soc-add-support-for-in-band-802.3z-negot.patch
@@ -0,0 +1,132 @@
+From 81b0f12a2a8a1699a7d49c3995e5f71e4ec018e6 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 27 Oct 2022 14:11:28 +0100
+Subject: [PATCH 10/10] net: mtk_eth_soc: add support for in-band 802.3z
+ negotiation
+
+As a result of help from Frank Wunderlich to investigate and test, we
+now know how to program this PCS for in-band 802.3z negotiation. Add
+support for this by moving the contents of the two functions into the
+common mtk_pcs_config() function and adding the register settings for
+802.3z negotiation.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 77 ++++++++++++-----------
+ 1 file changed, 42 insertions(+), 35 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -33,41 +33,15 @@ static void mtk_pcs_get_state(struct phy
+ 					 FIELD_GET(SGMII_LPA, adv));
+ }
+ 
+-/* For SGMII interface mode */
+-static void mtk_pcs_setup_mode_an(struct mtk_pcs *mpcs)
+-{
+-	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
+-			   SGMII_REMOTE_FAULT_DIS, SGMII_REMOTE_FAULT_DIS);
+-
+-	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
+-			   SGMII_AN_RESTART, SGMII_AN_RESTART);
+-}
+-
+-/* For 1000BASE-X and 2500BASE-X interface modes, which operate at a
+- * fixed speed.
+- */
+-static void mtk_pcs_setup_mode_force(struct mtk_pcs *mpcs,
+-				     phy_interface_t interface)
+-{
+-	/* Disable SGMII AN */
+-	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
+-			   SGMII_AN_ENABLE, 0);
+-
+-	/* Set the speed etc but leave the duplex unchanged */
+-	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
+-			   SGMII_IF_MODE_MASK & ~SGMII_DUPLEX_FULL,
+-			   SGMII_SPEED_1000);
+-}
+-
+ static int mtk_pcs_config(struct phylink_pcs *pcs, unsigned int mode,
+ 			  phy_interface_t interface,
+ 			  const unsigned long *advertising,
+ 			  bool permit_pause_to_mac)
+ {
+ 	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
++	unsigned int rgc3, sgm_mode, bmcr;
+ 	int advertise, link_timer;
+-	unsigned int rgc3;
+-	bool changed;
++	bool changed, use_an;
+ 
+ 	if (interface == PHY_INTERFACE_MODE_2500BASEX)
+ 		rgc3 = RG_PHY_SPEED_3_125G;
+@@ -83,6 +57,37 @@ static int mtk_pcs_config(struct phylink
+ 	if (link_timer < 0)
+ 		return link_timer;
+ 
++	/* Clearing IF_MODE_BIT0 switches the PCS to BASE-X mode, and
++	 * we assume that fixes it's speed at bitrate = line rate (in
++	 * other words, 1000Mbps or 2500Mbps).
++	 */
++	if (interface == PHY_INTERFACE_MODE_SGMII) {
++		sgm_mode = SGMII_IF_MODE_SGMII;
++		if (phylink_autoneg_inband(mode)) {
++			sgm_mode |= SGMII_REMOTE_FAULT_DIS |
++				    SGMII_SPEED_DUPLEX_AN;
++			use_an = true;
++		} else {
++			use_an = false;
++		}
++	} else if (phylink_autoneg_inband(mode)) {
++		/* 1000base-X or 2500base-X autoneg */
++		sgm_mode = SGMII_REMOTE_FAULT_DIS;
++		use_an = linkmode_test_bit(ETHTOOL_LINK_MODE_Autoneg_BIT,
++					   advertising);
++	} else {
++		/* 1000base-X or 2500base-X without autoneg */
++		sgm_mode = 0;
++		use_an = false;
++	}
++
++	if (use_an) {
++		/* FIXME: Do we need to set AN_RESTART here? */
++		bmcr = SGMII_AN_RESTART | SGMII_AN_ENABLE;
++	} else {
++		bmcr = 0;
++	}
++
+ 	/* Configure the underlying interface speed */
+ 	regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
+ 			   RG_PHY_SPEED_3_125G, rgc3);
+@@ -94,11 +99,14 @@ static int mtk_pcs_config(struct phylink
+ 	/* Setup the link timer and QPHY power up inside SGMIISYS */
+ 	regmap_write(mpcs->regmap, SGMSYS_PCS_LINK_TIMER, link_timer / 2 / 8);
+ 
+-	/* Setup SGMIISYS with the determined property */
+-	if (interface != PHY_INTERFACE_MODE_SGMII)
+-		mtk_pcs_setup_mode_force(mpcs, interface);
+-	else if (phylink_autoneg_inband(mode))
+-		mtk_pcs_setup_mode_an(mpcs);
++	/* Update the sgmsys mode register */
++	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
++			   SGMII_REMOTE_FAULT_DIS | SGMII_SPEED_DUPLEX_AN |
++			   SGMII_IF_MODE_SGMII, sgm_mode);
++
++	/* Update the BMCR */
++	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
++			   SGMII_AN_RESTART | SGMII_AN_ENABLE, bmcr);
+ 
+ 	/* Release PHYA power down state */
+ 	regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
+@@ -121,8 +129,7 @@ static void mtk_pcs_link_up(struct phyli
+ 	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+ 	unsigned int sgm_mode;
+ 
+-	if (!phylink_autoneg_inband(mode) ||
+-	    phy_interface_mode_is_8023z(interface)) {
++	if (!phylink_autoneg_inband(mode)) {
+ 		/* Force the speed and duplex setting */
+ 		if (speed == SPEED_10)
+ 			sgm_mode = SGMII_SPEED_10;
diff --git a/target/linux/generic/backport-5.15/733-v6.2-12-net-mediatek-sgmii-ensure-the-SGMII-PHY-is-powered-d.patch b/target/linux/generic/backport-5.15/733-v6.2-12-net-mediatek-sgmii-ensure-the-SGMII-PHY-is-powered-d.patch
new file mode 100644
index 00000000000000..8d2991f450013b
--- /dev/null
+++ b/target/linux/generic/backport-5.15/733-v6.2-12-net-mediatek-sgmii-ensure-the-SGMII-PHY-is-powered-d.patch
@@ -0,0 +1,119 @@
+From 7ff82416de8295c61423ef6fd75f052d3837d2f7 Mon Sep 17 00:00:00 2001
+From: Alexander Couzens <lynxis@fe80.eu>
+Date: Wed, 1 Feb 2023 19:23:29 +0100
+Subject: [PATCH 11/13] net: mediatek: sgmii: ensure the SGMII PHY is powered
+ down on configuration
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The code expect the PHY to be in power down which is only true after reset.
+Allow changes of the SGMII parameters more than once.
+
+Only power down when reconfiguring to avoid bouncing the link when there's
+no reason to - based on code from Russell King.
+
+There are cases when the SGMII_PHYA_PWD register contains 0x9 which
+prevents SGMII from working. The SGMII still shows link but no traffic
+can flow. Writing 0x0 to the PHYA_PWD register fix the issue. 0x0 was
+taken from a good working state of the SGMII interface.
+
+Fixes: 42c03844e93d ("net-next: mediatek: add support for MediaTek MT7622 SoC")
+Suggested-by: Russell King (Oracle) <linux@armlinux.org.uk>
+Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
+[ bmork: rebased and squashed into one patch ]
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Acked-by: Daniel Golle <daniel@makrotopia.org>
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h |  2 ++
+ drivers/net/ethernet/mediatek/mtk_sgmii.c   | 39 +++++++++++++++------
+ 2 files changed, 30 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -1070,11 +1070,13 @@ struct mtk_soc_data {
+  * @regmap:            The register map pointing at the range used to setup
+  *                     SGMII modes
+  * @ana_rgc3:          The offset refers to register ANA_RGC3 related to regmap
++ * @interface:         Currently configured interface mode
+  * @pcs:               Phylink PCS structure
+  */
+ struct mtk_pcs {
+ 	struct regmap	*regmap;
+ 	u32             ana_rgc3;
++	phy_interface_t	interface;
+ 	struct phylink_pcs pcs;
+ };
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -43,11 +43,6 @@ static int mtk_pcs_config(struct phylink
+ 	int advertise, link_timer;
+ 	bool changed, use_an;
+ 
+-	if (interface == PHY_INTERFACE_MODE_2500BASEX)
+-		rgc3 = RG_PHY_SPEED_3_125G;
+-	else
+-		rgc3 = 0;
+-
+ 	advertise = phylink_mii_c22_pcs_encode_advertisement(interface,
+ 							     advertising);
+ 	if (advertise < 0)
+@@ -88,9 +83,22 @@ static int mtk_pcs_config(struct phylink
+ 		bmcr = 0;
+ 	}
+ 
+-	/* Configure the underlying interface speed */
+-	regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
+-			   RG_PHY_SPEED_3_125G, rgc3);
++	if (mpcs->interface != interface) {
++		/* PHYA power down */
++		regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
++				   SGMII_PHYA_PWD, SGMII_PHYA_PWD);
++
++		if (interface == PHY_INTERFACE_MODE_2500BASEX)
++			rgc3 = RG_PHY_SPEED_3_125G;
++		else
++			rgc3 = 0;
++
++		/* Configure the underlying interface speed */
++		regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
++				   RG_PHY_SPEED_3_125G, rgc3);
++
++		mpcs->interface = interface;
++	}
+ 
+ 	/* Update the advertisement, noting whether it has changed */
+ 	regmap_update_bits_check(mpcs->regmap, SGMSYS_PCS_ADVERTISE,
+@@ -108,9 +116,17 @@ static int mtk_pcs_config(struct phylink
+ 	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
+ 			   SGMII_AN_RESTART | SGMII_AN_ENABLE, bmcr);
+ 
+-	/* Release PHYA power down state */
+-	regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
+-			   SGMII_PHYA_PWD, 0);
++	/* Release PHYA power down state
++	 * Only removing bit SGMII_PHYA_PWD isn't enough.
++	 * There are cases when the SGMII_PHYA_PWD register contains 0x9 which
++	 * prevents SGMII from working. The SGMII still shows link but no traffic
++	 * can flow. Writing 0x0 to the PHYA_PWD register fix the issue. 0x0 was
++	 * taken from a good working state of the SGMII interface.
++	 * Unknown how much the QPHY needs but it is racy without a sleep.
++	 * Tested on mt7622 & mt7986.
++	 */
++	usleep_range(50, 100);
++	regmap_write(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, 0);
+ 
+ 	return changed;
+ }
+@@ -171,6 +187,7 @@ int mtk_sgmii_init(struct mtk_sgmii *ss,
+ 			return PTR_ERR(ss->pcs[i].regmap);
+ 
+ 		ss->pcs[i].pcs.ops = &mtk_pcs_ops;
++		ss->pcs[i].interface = PHY_INTERFACE_MODE_NA;
+ 	}
+ 
+ 	return 0;
diff --git a/target/linux/generic/backport-5.15/733-v6.2-13-net-mediatek-sgmii-fix-duplex-configuration.patch b/target/linux/generic/backport-5.15/733-v6.2-13-net-mediatek-sgmii-fix-duplex-configuration.patch
new file mode 100644
index 00000000000000..79e5ad147ced77
--- /dev/null
+++ b/target/linux/generic/backport-5.15/733-v6.2-13-net-mediatek-sgmii-fix-duplex-configuration.patch
@@ -0,0 +1,52 @@
+From 9d32637122de88f1ef614c29703f0e050cad342e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Wed, 1 Feb 2023 19:23:30 +0100
+Subject: [PATCH 12/13] net: mediatek: sgmii: fix duplex configuration
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The logic of the duplex bit is inverted.  Setting it means half
+duplex, not full duplex.
+
+Fix and rename macro to avoid confusion.
+
+Fixes: 7e538372694b ("net: ethernet: mediatek: Re-add support SGMII")
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Acked-by: Daniel Golle <daniel@makrotopia.org>
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h | 2 +-
+ drivers/net/ethernet/mediatek/mtk_sgmii.c   | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -531,7 +531,7 @@
+ #define SGMII_SPEED_10			FIELD_PREP(SGMII_SPEED_MASK, 0)
+ #define SGMII_SPEED_100			FIELD_PREP(SGMII_SPEED_MASK, 1)
+ #define SGMII_SPEED_1000		FIELD_PREP(SGMII_SPEED_MASK, 2)
+-#define SGMII_DUPLEX_FULL		BIT(4)
++#define SGMII_DUPLEX_HALF		BIT(4)
+ #define SGMII_IF_MODE_BIT5		BIT(5)
+ #define SGMII_REMOTE_FAULT_DIS		BIT(8)
+ #define SGMII_CODE_SYNC_SET_VAL		BIT(9)
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -154,11 +154,11 @@ static void mtk_pcs_link_up(struct phyli
+ 		else
+ 			sgm_mode = SGMII_SPEED_1000;
+ 
+-		if (duplex == DUPLEX_FULL)
+-			sgm_mode |= SGMII_DUPLEX_FULL;
++		if (duplex != DUPLEX_FULL)
++			sgm_mode |= SGMII_DUPLEX_HALF;
+ 
+ 		regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
+-				   SGMII_DUPLEX_FULL | SGMII_SPEED_MASK,
++				   SGMII_DUPLEX_HALF | SGMII_SPEED_MASK,
+ 				   sgm_mode);
+ 	}
+ }
diff --git a/target/linux/generic/backport-5.15/733-v6.2-14-mtk_sgmii-enable-PCS-polling-to-allow-SFP-work.patch b/target/linux/generic/backport-5.15/733-v6.2-14-mtk_sgmii-enable-PCS-polling-to-allow-SFP-work.patch
new file mode 100644
index 00000000000000..56d7a1348fb17d
--- /dev/null
+++ b/target/linux/generic/backport-5.15/733-v6.2-14-mtk_sgmii-enable-PCS-polling-to-allow-SFP-work.patch
@@ -0,0 +1,33 @@
+From 3337a6e04ddf2923a1bdcf3d31b3b52412bf82dd Mon Sep 17 00:00:00 2001
+From: Alexander Couzens <lynxis@fe80.eu>
+Date: Wed, 1 Feb 2023 19:23:31 +0100
+Subject: [PATCH 13/13] mtk_sgmii: enable PCS polling to allow SFP work
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Currently there is no IRQ handling (even the SGMII supports it).
+Enable polling to support SFP ports.
+
+Fixes: 14a44ab0330d ("net: mtk_eth_soc: partially convert to phylink_pcs")
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
+[ bmork: changed "1" => "true" ]
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Acked-by: Daniel Golle <daniel@makrotopia.org>
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -187,6 +187,7 @@ int mtk_sgmii_init(struct mtk_sgmii *ss,
+ 			return PTR_ERR(ss->pcs[i].regmap);
+ 
+ 		ss->pcs[i].pcs.ops = &mtk_pcs_ops;
++		ss->pcs[i].pcs.poll = true;
+ 		ss->pcs[i].interface = PHY_INTERFACE_MODE_NA;
+ 	}
+ 
diff --git a/target/linux/generic/backport-5.15/733-v6.3-15-net-ethernet-mtk_eth_soc-reset-PCS-state.patch b/target/linux/generic/backport-5.15/733-v6.3-15-net-ethernet-mtk_eth_soc-reset-PCS-state.patch
new file mode 100644
index 00000000000000..a63b110914b08f
--- /dev/null
+++ b/target/linux/generic/backport-5.15/733-v6.3-15-net-ethernet-mtk_eth_soc-reset-PCS-state.patch
@@ -0,0 +1,48 @@
+From 611e2dabb4b3243d176739fd6a5a34d007fa3f86 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Tue, 14 Mar 2023 00:34:26 +0000
+Subject: [PATCH 1/2] net: ethernet: mtk_eth_soc: reset PCS state
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reset the internal PCS state machine when changing interface mode.
+This prevents confusing the state machine when changing interface
+modes, e.g. from SGMII to 2500Base-X or vice-versa.
+
+Fixes: 7e538372694b ("net: ethernet: mediatek: Re-add support SGMII")
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Tested-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h | 4 ++++
+ drivers/net/ethernet/mediatek/mtk_sgmii.c   | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -539,6 +539,10 @@
+ #define SGMII_SEND_AN_ERROR_EN		BIT(11)
+ #define SGMII_IF_MODE_MASK		GENMASK(5, 1)
+ 
++/* Register to reset SGMII design */
++#define SGMII_RESERVED_0	0x34
++#define SGMII_SW_RESET		BIT(0)
++
+ /* Register to set SGMII speed, ANA RG_ Control Signals III*/
+ #define SGMSYS_ANA_RG_CS3	0x2028
+ #define RG_PHY_SPEED_MASK	(BIT(2) | BIT(3))
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -88,6 +88,10 @@ static int mtk_pcs_config(struct phylink
+ 		regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
+ 				   SGMII_PHYA_PWD, SGMII_PHYA_PWD);
+ 
++		/* Reset SGMII PCS state */
++		regmap_update_bits(mpcs->regmap, SGMII_RESERVED_0,
++				   SGMII_SW_RESET, SGMII_SW_RESET);
++
+ 		if (interface == PHY_INTERFACE_MODE_2500BASEX)
+ 			rgc3 = RG_PHY_SPEED_3_125G;
+ 		else
diff --git a/target/linux/generic/backport-5.15/733-v6.3-16-net-ethernet-mtk_eth_soc-only-write-values-if-needed.patch b/target/linux/generic/backport-5.15/733-v6.3-16-net-ethernet-mtk_eth_soc-only-write-values-if-needed.patch
new file mode 100644
index 00000000000000..0fabeea20c07ae
--- /dev/null
+++ b/target/linux/generic/backport-5.15/733-v6.3-16-net-ethernet-mtk_eth_soc-only-write-values-if-needed.patch
@@ -0,0 +1,103 @@
+From 6e933a804c7db8be64f367f33e63cd7dcc302ebb Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Tue, 14 Mar 2023 00:34:45 +0000
+Subject: [PATCH 2/2] net: ethernet: mtk_eth_soc: only write values if needed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Only restart auto-negotiation and write link timer if actually
+necessary. This prevents losing the link in case of minor
+changes.
+
+Fixes: 7e538372694b ("net: ethernet: mediatek: Re-add support SGMII")
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Tested-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 24 +++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -38,20 +38,16 @@ static int mtk_pcs_config(struct phylink
+ 			  const unsigned long *advertising,
+ 			  bool permit_pause_to_mac)
+ {
++	bool mode_changed = false, changed, use_an;
+ 	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+ 	unsigned int rgc3, sgm_mode, bmcr;
+ 	int advertise, link_timer;
+-	bool changed, use_an;
+ 
+ 	advertise = phylink_mii_c22_pcs_encode_advertisement(interface,
+ 							     advertising);
+ 	if (advertise < 0)
+ 		return advertise;
+ 
+-	link_timer = phylink_get_link_timer_ns(interface);
+-	if (link_timer < 0)
+-		return link_timer;
+-
+ 	/* Clearing IF_MODE_BIT0 switches the PCS to BASE-X mode, and
+ 	 * we assume that fixes it's speed at bitrate = line rate (in
+ 	 * other words, 1000Mbps or 2500Mbps).
+@@ -77,13 +73,16 @@ static int mtk_pcs_config(struct phylink
+ 	}
+ 
+ 	if (use_an) {
+-		/* FIXME: Do we need to set AN_RESTART here? */
+-		bmcr = SGMII_AN_RESTART | SGMII_AN_ENABLE;
++		bmcr = SGMII_AN_ENABLE;
+ 	} else {
+ 		bmcr = 0;
+ 	}
+ 
+ 	if (mpcs->interface != interface) {
++		link_timer = phylink_get_link_timer_ns(interface);
++		if (link_timer < 0)
++			return link_timer;
++
+ 		/* PHYA power down */
+ 		regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
+ 				   SGMII_PHYA_PWD, SGMII_PHYA_PWD);
+@@ -101,16 +100,17 @@ static int mtk_pcs_config(struct phylink
+ 		regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
+ 				   RG_PHY_SPEED_3_125G, rgc3);
+ 
++		/* Setup the link timer */
++		regmap_write(mpcs->regmap, SGMSYS_PCS_LINK_TIMER, link_timer / 2 / 8);
++
+ 		mpcs->interface = interface;
++		mode_changed = true;
+ 	}
+ 
+ 	/* Update the advertisement, noting whether it has changed */
+ 	regmap_update_bits_check(mpcs->regmap, SGMSYS_PCS_ADVERTISE,
+ 				 SGMII_ADVERTISE, advertise, &changed);
+ 
+-	/* Setup the link timer and QPHY power up inside SGMIISYS */
+-	regmap_write(mpcs->regmap, SGMSYS_PCS_LINK_TIMER, link_timer / 2 / 8);
+-
+ 	/* Update the sgmsys mode register */
+ 	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
+ 			   SGMII_REMOTE_FAULT_DIS | SGMII_SPEED_DUPLEX_AN |
+@@ -118,7 +118,7 @@ static int mtk_pcs_config(struct phylink
+ 
+ 	/* Update the BMCR */
+ 	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
+-			   SGMII_AN_RESTART | SGMII_AN_ENABLE, bmcr);
++			   SGMII_AN_ENABLE, bmcr);
+ 
+ 	/* Release PHYA power down state
+ 	 * Only removing bit SGMII_PHYA_PWD isn't enough.
+@@ -132,7 +132,7 @@ static int mtk_pcs_config(struct phylink
+ 	usleep_range(50, 100);
+ 	regmap_write(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, 0);
+ 
+-	return changed;
++	return changed || mode_changed;
+ }
+ 
+ static void mtk_pcs_restart_an(struct phylink_pcs *pcs)
diff --git a/target/linux/generic/backport-5.15/733-v6.3-18-net-ethernet-mtk_eth_soc-add-support-for-MT7981.patch b/target/linux/generic/backport-5.15/733-v6.3-18-net-ethernet-mtk_eth_soc-add-support-for-MT7981.patch
new file mode 100644
index 00000000000000..c1cf323800c36e
--- /dev/null
+++ b/target/linux/generic/backport-5.15/733-v6.3-18-net-ethernet-mtk_eth_soc-add-support-for-MT7981.patch
@@ -0,0 +1,200 @@
+From f5d43ddd334b7c32fcaed9ba46afbd85cb467f1f Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sun, 19 Mar 2023 12:56:28 +0000
+Subject: [PATCH] net: ethernet: mtk_eth_soc: add support for MT7981 SoC
+
+The MediaTek MT7981 SoC comes with two 1G/2.5G SGMII ports, just like
+MT7986.
+
+In addition MT7981 is equipped with a built-in 1000Base-T PHY which can
+be used with GMAC1.
+
+As many MT7981 boards make use of inverting SGMII signal polarity, add
+new device-tree attribute 'mediatek,pn_swap' to support them.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_path.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_path.c
+@@ -96,12 +96,20 @@ static int set_mux_gmac2_gmac0_to_gephy(
+ 
+ static int set_mux_u3_gmac2_to_qphy(struct mtk_eth *eth, int path)
+ {
+-	unsigned int val = 0;
++	unsigned int val = 0, mask = 0, reg = 0;
+ 	bool updated = true;
+ 
+ 	switch (path) {
+ 	case MTK_ETH_PATH_GMAC2_SGMII:
+-		val = CO_QPHY_SEL;
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_U3_COPHY_V2)) {
++			reg = USB_PHY_SWITCH_REG;
++			val = SGMII_QPHY_SEL;
++			mask = QPHY_SEL_MASK;
++		} else {
++			reg = INFRA_MISC2;
++			val = CO_QPHY_SEL;
++			mask = val;
++		}
+ 		break;
+ 	default:
+ 		updated = false;
+@@ -109,7 +117,7 @@ static int set_mux_u3_gmac2_to_qphy(stru
+ 	}
+ 
+ 	if (updated)
+-		regmap_update_bits(eth->infra, INFRA_MISC2, CO_QPHY_SEL, val);
++		regmap_update_bits(eth->infra, reg, mask, val);
+ 
+ 	dev_dbg(eth->dev, "path %s in %s updated = %d\n",
+ 		mtk_eth_path_name(path), __func__, updated);
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -4755,6 +4755,26 @@ static const struct mtk_soc_data mt7629_
+ 	},
+ };
+ 
++static const struct mtk_soc_data mt7981_data = {
++	.reg_map = &mt7986_reg_map,
++	.ana_rgc3 = 0x128,
++	.caps = MT7981_CAPS,
++	.hw_features = MTK_HW_FEATURES,
++	.required_clks = MT7981_CLKS_BITMAP,
++	.required_pctl = false,
++	.offload_version = 2,
++	.hash_offset = 4,
++	.foe_entry_size = sizeof(struct mtk_foe_entry),
++	.txrx = {
++		.txd_size = sizeof(struct mtk_tx_dma_v2),
++		.rxd_size = sizeof(struct mtk_rx_dma_v2),
++		.rx_irq_done_mask = MTK_RX_DONE_INT_V2,
++		.rx_dma_l4_valid = RX_DMA_L4_VALID_V2,
++		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
++		.dma_len_offset = 8,
++	},
++};
++
+ static const struct mtk_soc_data mt7986_data = {
+ 	.reg_map = &mt7986_reg_map,
+ 	.ana_rgc3 = 0x128,
+@@ -4797,6 +4817,7 @@ const struct of_device_id of_mtk_match[]
+ 	{ .compatible = "mediatek,mt7622-eth", .data = &mt7622_data},
+ 	{ .compatible = "mediatek,mt7623-eth", .data = &mt7623_data},
+ 	{ .compatible = "mediatek,mt7629-eth", .data = &mt7629_data},
++	{ .compatible = "mediatek,mt7981-eth", .data = &mt7981_data},
+ 	{ .compatible = "mediatek,mt7986-eth", .data = &mt7986_data},
+ 	{ .compatible = "ralink,rt5350-eth", .data = &rt5350_data},
+ 	{},
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -553,11 +553,22 @@
+ #define SGMSYS_QPHY_PWR_STATE_CTRL 0xe8
+ #define	SGMII_PHYA_PWD		BIT(4)
+ 
++/* Register to QPHY wrapper control */
++#define SGMSYS_QPHY_WRAP_CTRL	0xec
++#define SGMII_PN_SWAP_MASK	GENMASK(1, 0)
++#define SGMII_PN_SWAP_TX_RX	(BIT(0) | BIT(1))
++#define MTK_SGMII_FLAG_PN_SWAP	BIT(0)
++
+ /* Infrasys subsystem config registers */
+ #define INFRA_MISC2            0x70c
+ #define CO_QPHY_SEL            BIT(0)
+ #define GEPHY_MAC_SEL          BIT(1)
+ 
++/* Top misc registers */
++#define USB_PHY_SWITCH_REG	0x218
++#define QPHY_SEL_MASK		GENMASK(1, 0)
++#define SGMII_QPHY_SEL		0x2
++
+ /* MT7628/88 specific stuff */
+ #define MT7628_PDMA_OFFSET	0x0800
+ #define MT7628_SDM_OFFSET	0x0c00
+@@ -738,6 +749,17 @@ enum mtk_clks_map {
+ 				 BIT(MTK_CLK_SGMII2_CDR_FB) | \
+ 				 BIT(MTK_CLK_SGMII_CK) | \
+ 				 BIT(MTK_CLK_ETH2PLL) | BIT(MTK_CLK_SGMIITOP))
++#define MT7981_CLKS_BITMAP	(BIT(MTK_CLK_FE) | BIT(MTK_CLK_GP2) | BIT(MTK_CLK_GP1) | \
++				 BIT(MTK_CLK_WOCPU0) | \
++				 BIT(MTK_CLK_SGMII_TX_250M) | \
++				 BIT(MTK_CLK_SGMII_RX_250M) | \
++				 BIT(MTK_CLK_SGMII_CDR_REF) | \
++				 BIT(MTK_CLK_SGMII_CDR_FB) | \
++				 BIT(MTK_CLK_SGMII2_TX_250M) | \
++				 BIT(MTK_CLK_SGMII2_RX_250M) | \
++				 BIT(MTK_CLK_SGMII2_CDR_REF) | \
++				 BIT(MTK_CLK_SGMII2_CDR_FB) | \
++				 BIT(MTK_CLK_SGMII_CK))
+ #define MT7986_CLKS_BITMAP	(BIT(MTK_CLK_FE) | BIT(MTK_CLK_GP2) | BIT(MTK_CLK_GP1) | \
+ 				 BIT(MTK_CLK_WOCPU1) | BIT(MTK_CLK_WOCPU0) | \
+ 				 BIT(MTK_CLK_SGMII_TX_250M) | \
+@@ -851,6 +873,7 @@ enum mkt_eth_capabilities {
+ 	MTK_NETSYS_V2_BIT,
+ 	MTK_SOC_MT7628_BIT,
+ 	MTK_RSTCTRL_PPE1_BIT,
++	MTK_U3_COPHY_V2_BIT,
+ 
+ 	/* MUX BITS*/
+ 	MTK_ETH_MUX_GDM1_TO_GMAC1_ESW_BIT,
+@@ -885,6 +908,7 @@ enum mkt_eth_capabilities {
+ #define MTK_NETSYS_V2		BIT(MTK_NETSYS_V2_BIT)
+ #define MTK_SOC_MT7628		BIT(MTK_SOC_MT7628_BIT)
+ #define MTK_RSTCTRL_PPE1	BIT(MTK_RSTCTRL_PPE1_BIT)
++#define MTK_U3_COPHY_V2		BIT(MTK_U3_COPHY_V2_BIT)
+ 
+ #define MTK_ETH_MUX_GDM1_TO_GMAC1_ESW		\
+ 	BIT(MTK_ETH_MUX_GDM1_TO_GMAC1_ESW_BIT)
+@@ -963,6 +987,11 @@ enum mkt_eth_capabilities {
+ 		      MTK_MUX_U3_GMAC2_TO_QPHY | \
+ 		      MTK_MUX_GMAC12_TO_GEPHY_SGMII | MTK_QDMA)
+ 
++#define MT7981_CAPS  (MTK_GMAC1_SGMII | MTK_GMAC2_SGMII | MTK_GMAC2_GEPHY | \
++		      MTK_MUX_GMAC12_TO_GEPHY_SGMII | MTK_QDMA | \
++		      MTK_MUX_U3_GMAC2_TO_QPHY | MTK_U3_COPHY_V2 | \
++		      MTK_NETSYS_V2 | MTK_RSTCTRL_PPE1)
++
+ #define MT7986_CAPS  (MTK_GMAC1_SGMII | MTK_GMAC2_SGMII | \
+ 		      MTK_MUX_GMAC12_TO_GEPHY_SGMII | MTK_QDMA | \
+ 		      MTK_NETSYS_V2 | MTK_RSTCTRL_PPE1)
+@@ -1076,12 +1105,14 @@ struct mtk_soc_data {
+  * @ana_rgc3:          The offset refers to register ANA_RGC3 related to regmap
+  * @interface:         Currently configured interface mode
+  * @pcs:               Phylink PCS structure
++ * @flags:             Flags indicating hardware properties
+  */
+ struct mtk_pcs {
+ 	struct regmap	*regmap;
+ 	u32             ana_rgc3;
+ 	phy_interface_t	interface;
+ 	struct phylink_pcs pcs;
++	u32		flags;
+ };
+ 
+ /* struct mtk_sgmii -  This is the structure holding sgmii regmap and its
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -87,6 +87,11 @@ static int mtk_pcs_config(struct phylink
+ 		regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
+ 				   SGMII_PHYA_PWD, SGMII_PHYA_PWD);
+ 
++		if (mpcs->flags & MTK_SGMII_FLAG_PN_SWAP)
++			regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_WRAP_CTRL,
++					   SGMII_PN_SWAP_MASK,
++					   SGMII_PN_SWAP_TX_RX);
++
+ 		/* Reset SGMII PCS state */
+ 		regmap_update_bits(mpcs->regmap, SGMII_RESERVED_0,
+ 				   SGMII_SW_RESET, SGMII_SW_RESET);
+@@ -186,6 +191,11 @@ int mtk_sgmii_init(struct mtk_sgmii *ss,
+ 
+ 		ss->pcs[i].ana_rgc3 = ana_rgc3;
+ 		ss->pcs[i].regmap = syscon_node_to_regmap(np);
++
++		ss->pcs[i].flags = 0;
++		if (of_property_read_bool(np, "mediatek,pnswap"))
++			ss->pcs[i].flags |= MTK_SGMII_FLAG_PN_SWAP;
++
+ 		of_node_put(np);
+ 		if (IS_ERR(ss->pcs[i].regmap))
+ 			return PTR_ERR(ss->pcs[i].regmap);
diff --git a/target/linux/generic/backport-5.15/733-v6.3-19-net-ethernet-mtk_eth_soc-set-MDIO-bus-clock-frequenc.patch b/target/linux/generic/backport-5.15/733-v6.3-19-net-ethernet-mtk_eth_soc-set-MDIO-bus-clock-frequenc.patch
new file mode 100644
index 00000000000000..9def19d67eb303
--- /dev/null
+++ b/target/linux/generic/backport-5.15/733-v6.3-19-net-ethernet-mtk_eth_soc-set-MDIO-bus-clock-frequenc.patch
@@ -0,0 +1,76 @@
+From c0a440031d4314d1023c1b87f43a4233634eebdb Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sun, 19 Mar 2023 12:57:15 +0000
+Subject: [PATCH] net: ethernet: mtk_eth_soc: set MDIO bus clock frequency
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Set MDIO bus clock frequency and allow setting a custom maximum
+frequency from device tree.
+
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Tested-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 21 +++++++++++++++++++++
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h |  7 +++++++
+ 2 files changed, 28 insertions(+)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -702,8 +702,10 @@ static const struct phylink_mac_ops mtk_
+ 
+ static int mtk_mdio_init(struct mtk_eth *eth)
+ {
++	unsigned int max_clk = 2500000, divider;
+ 	struct device_node *mii_np;
+ 	int ret;
++	u32 val;
+ 
+ 	mii_np = of_get_child_by_name(eth->dev->of_node, "mdio-bus");
+ 	if (!mii_np) {
+@@ -729,6 +731,25 @@ static int mtk_mdio_init(struct mtk_eth
+ 	eth->mii_bus->parent = eth->dev;
+ 
+ 	snprintf(eth->mii_bus->id, MII_BUS_ID_SIZE, "%pOFn", mii_np);
++
++	if (!of_property_read_u32(mii_np, "clock-frequency", &val)) {
++		if (val > MDC_MAX_FREQ || val < MDC_MAX_FREQ / MDC_MAX_DIVIDER) {
++			dev_err(eth->dev, "MDIO clock frequency out of range");
++			ret = -EINVAL;
++			goto err_put_node;
++		}
++		max_clk = val;
++	}
++	divider = min_t(unsigned int, DIV_ROUND_UP(MDC_MAX_FREQ, max_clk), 63);
++
++	/* Configure MDC Divider */
++	val = mtk_r32(eth, MTK_PPSC);
++	val &= ~PPSC_MDC_CFG;
++	val |= FIELD_PREP(PPSC_MDC_CFG, divider) | PPSC_MDC_TURBO;
++	mtk_w32(eth, val, MTK_PPSC);
++
++	dev_dbg(eth->dev, "MDC is running on %d Hz\n", MDC_MAX_FREQ / divider);
++
+ 	ret = of_mdiobus_register(eth->mii_bus, mii_np);
+ 
+ err_put_node:
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -363,6 +363,13 @@
+ #define RX_DMA_VTAG_V2		BIT(0)
+ #define RX_DMA_L4_VALID_V2	BIT(2)
+ 
++/* PHY Polling and SMI Master Control registers */
++#define MTK_PPSC		0x10000
++#define PPSC_MDC_CFG		GENMASK(29, 24)
++#define PPSC_MDC_TURBO		BIT(20)
++#define MDC_MAX_FREQ		25000000
++#define MDC_MAX_DIVIDER		63
++
+ /* PHY Indirect Access Control registers */
+ #define MTK_PHY_IAC		0x10004
+ #define PHY_IAC_ACCESS		BIT(31)
diff --git a/target/linux/generic/backport-5.15/733-v6.3-20-net-ethernet-mtk_eth_soc-switch-to-external-PCS-driv.patch b/target/linux/generic/backport-5.15/733-v6.3-20-net-ethernet-mtk_eth_soc-switch-to-external-PCS-driv.patch
new file mode 100644
index 00000000000000..203c5dc48bb0fc
--- /dev/null
+++ b/target/linux/generic/backport-5.15/733-v6.3-20-net-ethernet-mtk_eth_soc-switch-to-external-PCS-driv.patch
@@ -0,0 +1,512 @@
+From 2a3ec7ae313310c1092e4256208cc04d1958e469 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sun, 19 Mar 2023 12:58:02 +0000
+Subject: [PATCH] net: ethernet: mtk_eth_soc: switch to external PCS driver
+
+Now that we got a PCS driver, use it and remove the now redundant
+PCS code and it's header macros from the Ethernet driver.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Tested-by: Frank Wunderlich <frank-w@public-files.de>
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/Kconfig       |   2 +
+ drivers/net/ethernet/mediatek/Makefile      |   2 +-
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c |  61 +++++-
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h |  93 +--------
+ drivers/net/ethernet/mediatek/mtk_sgmii.c   | 217 --------------------
+ 5 files changed, 56 insertions(+), 319 deletions(-)
+ delete mode 100644 drivers/net/ethernet/mediatek/mtk_sgmii.c
+
+--- a/drivers/net/ethernet/mediatek/Kconfig
++++ b/drivers/net/ethernet/mediatek/Kconfig
+@@ -18,6 +18,8 @@ config NET_MEDIATEK_SOC
+ 	select DIMLIB
+ 	select PAGE_POOL
+ 	select PAGE_POOL_STATS
++	select PCS_MTK_LYNXI
++	select REGMAP_MMIO
+ 	help
+ 	  This driver supports the gigabit ethernet MACs in the
+ 	  MediaTek SoC family.
+--- a/drivers/net/ethernet/mediatek/Makefile
++++ b/drivers/net/ethernet/mediatek/Makefile
+@@ -4,7 +4,7 @@
+ #
+ 
+ obj-$(CONFIG_NET_MEDIATEK_SOC) += mtk_eth.o
+-mtk_eth-y := mtk_eth_soc.o mtk_sgmii.o mtk_eth_path.o mtk_ppe.o mtk_ppe_debugfs.o mtk_ppe_offload.o
++mtk_eth-y := mtk_eth_soc.o mtk_eth_path.o mtk_ppe.o mtk_ppe_debugfs.o mtk_ppe_offload.o
+ mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed.o mtk_wed_mcu.o mtk_wed_wo.o
+ ifdef CONFIG_DEBUG_FS
+ mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed_debugfs.o
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -20,6 +20,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/pinctrl/devinfo.h>
+ #include <linux/phylink.h>
++#include <linux/pcs/pcs-mtk-lynxi.h>
+ #include <linux/jhash.h>
+ #include <linux/bitfield.h>
+ #include <net/dsa.h>
+@@ -357,7 +358,7 @@ static struct phylink_pcs *mtk_mac_selec
+ 		sid = (MTK_HAS_CAPS(eth->soc->caps, MTK_SHARED_SGMII)) ?
+ 		       0 : mac->id;
+ 
+-		return mtk_sgmii_select_pcs(eth->sgmii, sid);
++		return eth->sgmii_pcs[sid];
+ 	}
+ 
+ 	return NULL;
+@@ -3977,8 +3978,17 @@ static int mtk_unreg_dev(struct mtk_eth
+ 	return 0;
+ }
+ 
++static void mtk_sgmii_destroy(struct mtk_eth *eth)
++{
++	int i;
++
++	for (i = 0; i < MTK_MAX_DEVS; i++)
++		mtk_pcs_lynxi_destroy(eth->sgmii_pcs[i]);
++}
++
+ static int mtk_cleanup(struct mtk_eth *eth)
+ {
++	mtk_sgmii_destroy(eth);
+ 	mtk_unreg_dev(eth);
+ 	mtk_free_dev(eth);
+ 	cancel_work_sync(&eth->pending_work);
+@@ -4408,6 +4418,36 @@ void mtk_eth_set_dma_device(struct mtk_e
+ 	rtnl_unlock();
+ }
+ 
++static int mtk_sgmii_init(struct mtk_eth *eth)
++{
++	struct device_node *np;
++	struct regmap *regmap;
++	u32 flags;
++	int i;
++
++	for (i = 0; i < MTK_MAX_DEVS; i++) {
++		np = of_parse_phandle(eth->dev->of_node, "mediatek,sgmiisys", i);
++		if (!np)
++			break;
++
++		regmap = syscon_node_to_regmap(np);
++		flags = 0;
++		if (of_property_read_bool(np, "mediatek,pnswap"))
++			flags |= MTK_SGMII_FLAG_PN_SWAP;
++
++		of_node_put(np);
++
++		if (IS_ERR(regmap))
++			return PTR_ERR(regmap);
++
++		eth->sgmii_pcs[i] = mtk_pcs_lynxi_create(eth->dev, regmap,
++							 eth->soc->ana_rgc3,
++							 flags);
++	}
++
++	return 0;
++}
++
+ static int mtk_probe(struct platform_device *pdev)
+ {
+ 	struct resource *res = NULL;
+@@ -4471,13 +4511,7 @@ static int mtk_probe(struct platform_dev
+ 	}
+ 
+ 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_SGMII)) {
+-		eth->sgmii = devm_kzalloc(eth->dev, sizeof(*eth->sgmii),
+-					  GFP_KERNEL);
+-		if (!eth->sgmii)
+-			return -ENOMEM;
+-
+-		err = mtk_sgmii_init(eth->sgmii, pdev->dev.of_node,
+-				     eth->soc->ana_rgc3);
++		err = mtk_sgmii_init(eth);
+ 
+ 		if (err)
+ 			return err;
+@@ -4488,14 +4522,17 @@ static int mtk_probe(struct platform_dev
+ 							    "mediatek,pctl");
+ 		if (IS_ERR(eth->pctl)) {
+ 			dev_err(&pdev->dev, "no pctl regmap found\n");
+-			return PTR_ERR(eth->pctl);
++			err = PTR_ERR(eth->pctl);
++			goto err_destroy_sgmii;
+ 		}
+ 	}
+ 
+ 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+ 		res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-		if (!res)
+-			return -EINVAL;
++		if (!res) {
++			err = -EINVAL;
++			goto err_destroy_sgmii;
++		}
+ 	}
+ 
+ 	if (eth->soc->offload_version) {
+@@ -4655,6 +4692,8 @@ err_deinit_hw:
+ 	mtk_hw_deinit(eth);
+ err_wed_exit:
+ 	mtk_wed_exit();
++err_destroy_sgmii:
++	mtk_sgmii_destroy(eth);
+ 
+ 	return err;
+ }
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -507,65 +507,6 @@
+ #define ETHSYS_DMA_AG_MAP_QDMA	BIT(1)
+ #define ETHSYS_DMA_AG_MAP_PPE	BIT(2)
+ 
+-/* SGMII subsystem config registers */
+-/* BMCR (low 16) BMSR (high 16) */
+-#define SGMSYS_PCS_CONTROL_1	0x0
+-#define SGMII_BMCR		GENMASK(15, 0)
+-#define SGMII_BMSR		GENMASK(31, 16)
+-#define SGMII_AN_RESTART	BIT(9)
+-#define SGMII_ISOLATE		BIT(10)
+-#define SGMII_AN_ENABLE		BIT(12)
+-#define SGMII_LINK_STATYS	BIT(18)
+-#define SGMII_AN_ABILITY	BIT(19)
+-#define SGMII_AN_COMPLETE	BIT(21)
+-#define SGMII_PCS_FAULT		BIT(23)
+-#define SGMII_AN_EXPANSION_CLR	BIT(30)
+-
+-#define SGMSYS_PCS_ADVERTISE	0x8
+-#define SGMII_ADVERTISE		GENMASK(15, 0)
+-#define SGMII_LPA		GENMASK(31, 16)
+-
+-/* Register to programmable link timer, the unit in 2 * 8ns */
+-#define SGMSYS_PCS_LINK_TIMER	0x18
+-#define SGMII_LINK_TIMER_MASK	GENMASK(19, 0)
+-#define SGMII_LINK_TIMER_DEFAULT	(0x186a0 & SGMII_LINK_TIMER_MASK)
+-
+-/* Register to control remote fault */
+-#define SGMSYS_SGMII_MODE		0x20
+-#define SGMII_IF_MODE_SGMII		BIT(0)
+-#define SGMII_SPEED_DUPLEX_AN		BIT(1)
+-#define SGMII_SPEED_MASK		GENMASK(3, 2)
+-#define SGMII_SPEED_10			FIELD_PREP(SGMII_SPEED_MASK, 0)
+-#define SGMII_SPEED_100			FIELD_PREP(SGMII_SPEED_MASK, 1)
+-#define SGMII_SPEED_1000		FIELD_PREP(SGMII_SPEED_MASK, 2)
+-#define SGMII_DUPLEX_HALF		BIT(4)
+-#define SGMII_IF_MODE_BIT5		BIT(5)
+-#define SGMII_REMOTE_FAULT_DIS		BIT(8)
+-#define SGMII_CODE_SYNC_SET_VAL		BIT(9)
+-#define SGMII_CODE_SYNC_SET_EN		BIT(10)
+-#define SGMII_SEND_AN_ERROR_EN		BIT(11)
+-#define SGMII_IF_MODE_MASK		GENMASK(5, 1)
+-
+-/* Register to reset SGMII design */
+-#define SGMII_RESERVED_0	0x34
+-#define SGMII_SW_RESET		BIT(0)
+-
+-/* Register to set SGMII speed, ANA RG_ Control Signals III*/
+-#define SGMSYS_ANA_RG_CS3	0x2028
+-#define RG_PHY_SPEED_MASK	(BIT(2) | BIT(3))
+-#define RG_PHY_SPEED_1_25G	0x0
+-#define RG_PHY_SPEED_3_125G	BIT(2)
+-
+-/* Register to power up QPHY */
+-#define SGMSYS_QPHY_PWR_STATE_CTRL 0xe8
+-#define	SGMII_PHYA_PWD		BIT(4)
+-
+-/* Register to QPHY wrapper control */
+-#define SGMSYS_QPHY_WRAP_CTRL	0xec
+-#define SGMII_PN_SWAP_MASK	GENMASK(1, 0)
+-#define SGMII_PN_SWAP_TX_RX	(BIT(0) | BIT(1))
+-#define MTK_SGMII_FLAG_PN_SWAP	BIT(0)
+-
+ /* Infrasys subsystem config registers */
+ #define INFRA_MISC2            0x70c
+ #define CO_QPHY_SEL            BIT(0)
+@@ -1105,31 +1046,6 @@ struct mtk_soc_data {
+ /* currently no SoC has more than 2 macs */
+ #define MTK_MAX_DEVS			2
+ 
+-/* struct mtk_pcs -    This structure holds each sgmii regmap and associated
+- *                     data
+- * @regmap:            The register map pointing at the range used to setup
+- *                     SGMII modes
+- * @ana_rgc3:          The offset refers to register ANA_RGC3 related to regmap
+- * @interface:         Currently configured interface mode
+- * @pcs:               Phylink PCS structure
+- * @flags:             Flags indicating hardware properties
+- */
+-struct mtk_pcs {
+-	struct regmap	*regmap;
+-	u32             ana_rgc3;
+-	phy_interface_t	interface;
+-	struct phylink_pcs pcs;
+-	u32		flags;
+-};
+-
+-/* struct mtk_sgmii -  This is the structure holding sgmii regmap and its
+- *                     characteristics
+- * @pcs                Array of individual PCS structures
+- */
+-struct mtk_sgmii {
+-	struct mtk_pcs	pcs[MTK_MAX_DEVS];
+-};
+-
+ /* struct mtk_eth -	This is the main datasructure for holding the state
+  *			of the driver
+  * @dev:		The device pointer
+@@ -1149,6 +1065,7 @@ struct mtk_sgmii {
+  *			MII modes
+  * @infra:              The register map pointing at the range used to setup
+  *                      SGMII and GePHY path
++ * @sgmii_pcs:		Pointers to mtk-pcs-lynxi phylink_pcs instances
+  * @pctl:		The register map pointing at the range used to setup
+  *			GMAC port drive/slew values
+  * @dma_refcnt:		track how many netdevs are using the DMA engine
+@@ -1189,8 +1106,8 @@ struct mtk_eth {
+ 	u32				msg_enable;
+ 	unsigned long			sysclk;
+ 	struct regmap			*ethsys;
+-	struct regmap                   *infra;
+-	struct mtk_sgmii                *sgmii;
++	struct regmap			*infra;
++	struct phylink_pcs		*sgmii_pcs[MTK_MAX_DEVS];
+ 	struct regmap			*pctl;
+ 	bool				hwlro;
+ 	refcount_t			dma_refcnt;
+@@ -1352,10 +1269,6 @@ void mtk_stats_update_mac(struct mtk_mac
+ void mtk_w32(struct mtk_eth *eth, u32 val, unsigned reg);
+ u32 mtk_r32(struct mtk_eth *eth, unsigned reg);
+ 
+-struct phylink_pcs *mtk_sgmii_select_pcs(struct mtk_sgmii *ss, int id);
+-int mtk_sgmii_init(struct mtk_sgmii *ss, struct device_node *np,
+-		   u32 ana_rgc3);
+-
+ int mtk_gmac_sgmii_path_setup(struct mtk_eth *eth, int mac_id);
+ int mtk_gmac_gephy_path_setup(struct mtk_eth *eth, int mac_id);
+ int mtk_gmac_rgmii_path_setup(struct mtk_eth *eth, int mac_id);
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ /dev/null
+@@ -1,217 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-// Copyright (c) 2018-2019 MediaTek Inc.
+-
+-/* A library for MediaTek SGMII circuit
+- *
+- * Author: Sean Wang <sean.wang@mediatek.com>
+- *
+- */
+-
+-#include <linux/mfd/syscon.h>
+-#include <linux/of.h>
+-#include <linux/phylink.h>
+-#include <linux/regmap.h>
+-
+-#include "mtk_eth_soc.h"
+-
+-static struct mtk_pcs *pcs_to_mtk_pcs(struct phylink_pcs *pcs)
+-{
+-	return container_of(pcs, struct mtk_pcs, pcs);
+-}
+-
+-static void mtk_pcs_get_state(struct phylink_pcs *pcs,
+-			      struct phylink_link_state *state)
+-{
+-	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+-	unsigned int bm, adv;
+-
+-	/* Read the BMSR and LPA */
+-	regmap_read(mpcs->regmap, SGMSYS_PCS_CONTROL_1, &bm);
+-	regmap_read(mpcs->regmap, SGMSYS_PCS_ADVERTISE, &adv);
+-
+-	phylink_mii_c22_pcs_decode_state(state, FIELD_GET(SGMII_BMSR, bm),
+-					 FIELD_GET(SGMII_LPA, adv));
+-}
+-
+-static int mtk_pcs_config(struct phylink_pcs *pcs, unsigned int mode,
+-			  phy_interface_t interface,
+-			  const unsigned long *advertising,
+-			  bool permit_pause_to_mac)
+-{
+-	bool mode_changed = false, changed, use_an;
+-	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+-	unsigned int rgc3, sgm_mode, bmcr;
+-	int advertise, link_timer;
+-
+-	advertise = phylink_mii_c22_pcs_encode_advertisement(interface,
+-							     advertising);
+-	if (advertise < 0)
+-		return advertise;
+-
+-	/* Clearing IF_MODE_BIT0 switches the PCS to BASE-X mode, and
+-	 * we assume that fixes it's speed at bitrate = line rate (in
+-	 * other words, 1000Mbps or 2500Mbps).
+-	 */
+-	if (interface == PHY_INTERFACE_MODE_SGMII) {
+-		sgm_mode = SGMII_IF_MODE_SGMII;
+-		if (phylink_autoneg_inband(mode)) {
+-			sgm_mode |= SGMII_REMOTE_FAULT_DIS |
+-				    SGMII_SPEED_DUPLEX_AN;
+-			use_an = true;
+-		} else {
+-			use_an = false;
+-		}
+-	} else if (phylink_autoneg_inband(mode)) {
+-		/* 1000base-X or 2500base-X autoneg */
+-		sgm_mode = SGMII_REMOTE_FAULT_DIS;
+-		use_an = linkmode_test_bit(ETHTOOL_LINK_MODE_Autoneg_BIT,
+-					   advertising);
+-	} else {
+-		/* 1000base-X or 2500base-X without autoneg */
+-		sgm_mode = 0;
+-		use_an = false;
+-	}
+-
+-	if (use_an) {
+-		bmcr = SGMII_AN_ENABLE;
+-	} else {
+-		bmcr = 0;
+-	}
+-
+-	if (mpcs->interface != interface) {
+-		link_timer = phylink_get_link_timer_ns(interface);
+-		if (link_timer < 0)
+-			return link_timer;
+-
+-		/* PHYA power down */
+-		regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
+-				   SGMII_PHYA_PWD, SGMII_PHYA_PWD);
+-
+-		if (mpcs->flags & MTK_SGMII_FLAG_PN_SWAP)
+-			regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_WRAP_CTRL,
+-					   SGMII_PN_SWAP_MASK,
+-					   SGMII_PN_SWAP_TX_RX);
+-
+-		/* Reset SGMII PCS state */
+-		regmap_update_bits(mpcs->regmap, SGMII_RESERVED_0,
+-				   SGMII_SW_RESET, SGMII_SW_RESET);
+-
+-		if (interface == PHY_INTERFACE_MODE_2500BASEX)
+-			rgc3 = RG_PHY_SPEED_3_125G;
+-		else
+-			rgc3 = 0;
+-
+-		/* Configure the underlying interface speed */
+-		regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
+-				   RG_PHY_SPEED_3_125G, rgc3);
+-
+-		/* Setup the link timer */
+-		regmap_write(mpcs->regmap, SGMSYS_PCS_LINK_TIMER, link_timer / 2 / 8);
+-
+-		mpcs->interface = interface;
+-		mode_changed = true;
+-	}
+-
+-	/* Update the advertisement, noting whether it has changed */
+-	regmap_update_bits_check(mpcs->regmap, SGMSYS_PCS_ADVERTISE,
+-				 SGMII_ADVERTISE, advertise, &changed);
+-
+-	/* Update the sgmsys mode register */
+-	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
+-			   SGMII_REMOTE_FAULT_DIS | SGMII_SPEED_DUPLEX_AN |
+-			   SGMII_IF_MODE_SGMII, sgm_mode);
+-
+-	/* Update the BMCR */
+-	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
+-			   SGMII_AN_ENABLE, bmcr);
+-
+-	/* Release PHYA power down state
+-	 * Only removing bit SGMII_PHYA_PWD isn't enough.
+-	 * There are cases when the SGMII_PHYA_PWD register contains 0x9 which
+-	 * prevents SGMII from working. The SGMII still shows link but no traffic
+-	 * can flow. Writing 0x0 to the PHYA_PWD register fix the issue. 0x0 was
+-	 * taken from a good working state of the SGMII interface.
+-	 * Unknown how much the QPHY needs but it is racy without a sleep.
+-	 * Tested on mt7622 & mt7986.
+-	 */
+-	usleep_range(50, 100);
+-	regmap_write(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, 0);
+-
+-	return changed || mode_changed;
+-}
+-
+-static void mtk_pcs_restart_an(struct phylink_pcs *pcs)
+-{
+-	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+-
+-	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
+-			   SGMII_AN_RESTART, SGMII_AN_RESTART);
+-}
+-
+-static void mtk_pcs_link_up(struct phylink_pcs *pcs, unsigned int mode,
+-			    phy_interface_t interface, int speed, int duplex)
+-{
+-	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+-	unsigned int sgm_mode;
+-
+-	if (!phylink_autoneg_inband(mode)) {
+-		/* Force the speed and duplex setting */
+-		if (speed == SPEED_10)
+-			sgm_mode = SGMII_SPEED_10;
+-		else if (speed == SPEED_100)
+-			sgm_mode = SGMII_SPEED_100;
+-		else
+-			sgm_mode = SGMII_SPEED_1000;
+-
+-		if (duplex != DUPLEX_FULL)
+-			sgm_mode |= SGMII_DUPLEX_HALF;
+-
+-		regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
+-				   SGMII_DUPLEX_HALF | SGMII_SPEED_MASK,
+-				   sgm_mode);
+-	}
+-}
+-
+-static const struct phylink_pcs_ops mtk_pcs_ops = {
+-	.pcs_get_state = mtk_pcs_get_state,
+-	.pcs_config = mtk_pcs_config,
+-	.pcs_an_restart = mtk_pcs_restart_an,
+-	.pcs_link_up = mtk_pcs_link_up,
+-};
+-
+-int mtk_sgmii_init(struct mtk_sgmii *ss, struct device_node *r, u32 ana_rgc3)
+-{
+-	struct device_node *np;
+-	int i;
+-
+-	for (i = 0; i < MTK_MAX_DEVS; i++) {
+-		np = of_parse_phandle(r, "mediatek,sgmiisys", i);
+-		if (!np)
+-			break;
+-
+-		ss->pcs[i].ana_rgc3 = ana_rgc3;
+-		ss->pcs[i].regmap = syscon_node_to_regmap(np);
+-
+-		ss->pcs[i].flags = 0;
+-		if (of_property_read_bool(np, "mediatek,pnswap"))
+-			ss->pcs[i].flags |= MTK_SGMII_FLAG_PN_SWAP;
+-
+-		of_node_put(np);
+-		if (IS_ERR(ss->pcs[i].regmap))
+-			return PTR_ERR(ss->pcs[i].regmap);
+-
+-		ss->pcs[i].pcs.ops = &mtk_pcs_ops;
+-		ss->pcs[i].pcs.poll = true;
+-		ss->pcs[i].interface = PHY_INTERFACE_MODE_NA;
+-	}
+-
+-	return 0;
+-}
+-
+-struct phylink_pcs *mtk_sgmii_select_pcs(struct mtk_sgmii *ss, int id)
+-{
+-	if (!ss->pcs[id].regmap)
+-		return NULL;
+-
+-	return &ss->pcs[id].pcs;
+-}
diff --git a/target/linux/generic/backport-5.15/733-v6.4-21-net-mtk_eth_soc-use-WO-firmware-for-MT7981.patch b/target/linux/generic/backport-5.15/733-v6.4-21-net-mtk_eth_soc-use-WO-firmware-for-MT7981.patch
new file mode 100644
index 00000000000000..9ce2735951c897
--- /dev/null
+++ b/target/linux/generic/backport-5.15/733-v6.4-21-net-mtk_eth_soc-use-WO-firmware-for-MT7981.patch
@@ -0,0 +1,46 @@
+From f5af7931d2a2cae66d0f9dad4ba517b1b00620b3 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Wed, 19 Apr 2023 19:07:23 +0100
+Subject: [PATCH] net: mtk_eth_soc: use WO firmware for MT7981
+
+In order to support wireless offloading on MT7981 we need to load the
+appropriate firmware. Recognize MT7981 and load mt7981_wo.bin.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/ethernet/mediatek/mtk_wed_mcu.c | 7 ++++++-
+ drivers/net/ethernet/mediatek/mtk_wed_wo.h  | 1 +
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
+@@ -326,7 +326,11 @@ mtk_wed_mcu_load_firmware(struct mtk_wed
+ 		wo->hw->index + 1);
+ 
+ 	/* load firmware */
+-	fw_name = wo->hw->index ? MT7986_FIRMWARE_WO1 : MT7986_FIRMWARE_WO0;
++	if (of_device_is_compatible(wo->hw->node, "mediatek,mt7981-wed"))
++		fw_name = MT7981_FIRMWARE_WO;
++	else
++		fw_name = wo->hw->index ? MT7986_FIRMWARE_WO1 : MT7986_FIRMWARE_WO0;
++
+ 	ret = request_firmware(&fw, fw_name, wo->hw->dev);
+ 	if (ret)
+ 		return ret;
+@@ -386,5 +390,6 @@ int mtk_wed_mcu_init(struct mtk_wed_wo *
+ 				  100, MTK_FW_DL_TIMEOUT);
+ }
+ 
++MODULE_FIRMWARE(MT7981_FIRMWARE_WO);
+ MODULE_FIRMWARE(MT7986_FIRMWARE_WO0);
+ MODULE_FIRMWARE(MT7986_FIRMWARE_WO1);
+--- a/drivers/net/ethernet/mediatek/mtk_wed_wo.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.h
+@@ -88,6 +88,7 @@ enum mtk_wed_dummy_cr_idx {
+ 	MTK_WED_DUMMY_CR_WO_STATUS,
+ };
+ 
++#define MT7981_FIRMWARE_WO	"mediatek/mt7981_wo.bin"
+ #define MT7986_FIRMWARE_WO0	"mediatek/mt7986_wo_0.bin"
+ #define MT7986_FIRMWARE_WO1	"mediatek/mt7986_wo_1.bin"
+ 
diff --git a/target/linux/generic/backport-5.15/733-v6.4-22-net-ethernet-mtk_eth_soc-fix-NULL-pointer-dereferenc.patch b/target/linux/generic/backport-5.15/733-v6.4-22-net-ethernet-mtk_eth_soc-fix-NULL-pointer-dereferenc.patch
new file mode 100644
index 00000000000000..d715c4aa6867b9
--- /dev/null
+++ b/target/linux/generic/backport-5.15/733-v6.4-22-net-ethernet-mtk_eth_soc-fix-NULL-pointer-dereferenc.patch
@@ -0,0 +1,28 @@
+From 7c83e28f10830aa5105c25eaabe890e3adac36aa Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Tue, 9 May 2023 03:20:06 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: fix NULL pointer dereference
+
+Check for NULL pointer to avoid kernel crashing in case of missing WO
+firmware in case only a single WEDv2 device has been initialized, e.g. on
+MT7981 which can connect just one wireless frontend.
+
+Fixes: 86ce0d09e424 ("net: ethernet: mtk_eth_soc: use WO firmware for MT7981")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/mediatek/mtk_wed.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -647,7 +647,7 @@ __mtk_wed_detach(struct mtk_wed_device *
+ 					   BIT(hw->index), BIT(hw->index));
+ 	}
+ 
+-	if (!hw_list[!hw->index]->wed_dev &&
++	if ((!hw_list[!hw->index] || !hw_list[!hw->index]->wed_dev) &&
+ 	    hw->eth->dma_dev != hw->eth->dev)
+ 		mtk_eth_set_dma_device(hw->eth, hw->eth->dev);
+ 
diff --git a/target/linux/generic/backport-5.15/753-v5.17-net-next-net-dsa-qca8k-remove-redundant-check-in-parse_port_config.patch b/target/linux/generic/backport-5.15/753-v5.17-net-next-net-dsa-qca8k-remove-redundant-check-in-parse_port_config.patch
new file mode 100644
index 00000000000000..f477b1b92985d9
--- /dev/null
+++ b/target/linux/generic/backport-5.15/753-v5.17-net-next-net-dsa-qca8k-remove-redundant-check-in-parse_port_config.patch
@@ -0,0 +1,29 @@
+From b9133f3ef5a2659730cf47a74bd0a9259f1cf8ff Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Mon, 22 Nov 2021 16:23:40 +0100
+Subject: net: dsa: qca8k: remove redundant check in parse_port_config
+
+The very next check for port 0 and 6 already makes sure we don't go out
+of bounds with the ports_config delay table.
+Remove the redundant check.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -983,7 +983,7 @@ qca8k_parse_port_config(struct qca8k_pri
+ 	u32 delay;
+ 
+ 	/* We have 2 CPU port. Check them */
+-	for (port = 0; port < QCA8K_NUM_PORTS && cpu_port_index < QCA8K_NUM_CPU_PORTS; port++) {
++	for (port = 0; port < QCA8K_NUM_PORTS; port++) {
+ 		/* Skip every other port */
+ 		if (port != 0 && port != 6)
+ 			continue;
diff --git a/target/linux/generic/backport-5.15/754-v5.17-net-next-net-dsa-qca8k-convert-to-GENMASK_FIELD_PREP_FIELD_GET.patch b/target/linux/generic/backport-5.15/754-v5.17-net-next-net-dsa-qca8k-convert-to-GENMASK_FIELD_PREP_FIELD_GET.patch
new file mode 100644
index 00000000000000..2cea88089dbba5
--- /dev/null
+++ b/target/linux/generic/backport-5.15/754-v5.17-net-next-net-dsa-qca8k-convert-to-GENMASK_FIELD_PREP_FIELD_GET.patch
@@ -0,0 +1,507 @@
+From 90ae68bfc2ffcb54a4ba4f64edbeb84a80cbb57c Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Mon, 22 Nov 2021 16:23:41 +0100
+Subject: net: dsa: qca8k: convert to GENMASK/FIELD_PREP/FIELD_GET
+
+Convert and try to standardize bit fields using
+GENMASK/FIELD_PREP/FIELD_GET macros. Rework some logic to support the
+standard macro and tidy things up. No functional change intended.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c |  98 +++++++++++++++----------------
+ drivers/net/dsa/qca8k.h | 153 ++++++++++++++++++++++++++----------------------
+ 2 files changed, 130 insertions(+), 121 deletions(-)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -9,6 +9,7 @@
+ #include <linux/module.h>
+ #include <linux/phy.h>
+ #include <linux/netdevice.h>
++#include <linux/bitfield.h>
+ #include <net/dsa.h>
+ #include <linux/of_net.h>
+ #include <linux/of_mdio.h>
+@@ -319,18 +320,18 @@ qca8k_fdb_read(struct qca8k_priv *priv,
+ 	}
+ 
+ 	/* vid - 83:72 */
+-	fdb->vid = (reg[2] >> QCA8K_ATU_VID_S) & QCA8K_ATU_VID_M;
++	fdb->vid = FIELD_GET(QCA8K_ATU_VID_MASK, reg[2]);
+ 	/* aging - 67:64 */
+-	fdb->aging = reg[2] & QCA8K_ATU_STATUS_M;
++	fdb->aging = FIELD_GET(QCA8K_ATU_STATUS_MASK, reg[2]);
+ 	/* portmask - 54:48 */
+-	fdb->port_mask = (reg[1] >> QCA8K_ATU_PORT_S) & QCA8K_ATU_PORT_M;
++	fdb->port_mask = FIELD_GET(QCA8K_ATU_PORT_MASK, reg[1]);
+ 	/* mac - 47:0 */
+-	fdb->mac[0] = (reg[1] >> QCA8K_ATU_ADDR0_S) & 0xff;
+-	fdb->mac[1] = reg[1] & 0xff;
+-	fdb->mac[2] = (reg[0] >> QCA8K_ATU_ADDR2_S) & 0xff;
+-	fdb->mac[3] = (reg[0] >> QCA8K_ATU_ADDR3_S) & 0xff;
+-	fdb->mac[4] = (reg[0] >> QCA8K_ATU_ADDR4_S) & 0xff;
+-	fdb->mac[5] = reg[0] & 0xff;
++	fdb->mac[0] = FIELD_GET(QCA8K_ATU_ADDR0_MASK, reg[1]);
++	fdb->mac[1] = FIELD_GET(QCA8K_ATU_ADDR1_MASK, reg[1]);
++	fdb->mac[2] = FIELD_GET(QCA8K_ATU_ADDR2_MASK, reg[0]);
++	fdb->mac[3] = FIELD_GET(QCA8K_ATU_ADDR3_MASK, reg[0]);
++	fdb->mac[4] = FIELD_GET(QCA8K_ATU_ADDR4_MASK, reg[0]);
++	fdb->mac[5] = FIELD_GET(QCA8K_ATU_ADDR5_MASK, reg[0]);
+ 
+ 	return 0;
+ }
+@@ -343,18 +344,18 @@ qca8k_fdb_write(struct qca8k_priv *priv,
+ 	int i;
+ 
+ 	/* vid - 83:72 */
+-	reg[2] = (vid & QCA8K_ATU_VID_M) << QCA8K_ATU_VID_S;
++	reg[2] = FIELD_PREP(QCA8K_ATU_VID_MASK, vid);
+ 	/* aging - 67:64 */
+-	reg[2] |= aging & QCA8K_ATU_STATUS_M;
++	reg[2] |= FIELD_PREP(QCA8K_ATU_STATUS_MASK, aging);
+ 	/* portmask - 54:48 */
+-	reg[1] = (port_mask & QCA8K_ATU_PORT_M) << QCA8K_ATU_PORT_S;
++	reg[1] = FIELD_PREP(QCA8K_ATU_PORT_MASK, port_mask);
+ 	/* mac - 47:0 */
+-	reg[1] |= mac[0] << QCA8K_ATU_ADDR0_S;
+-	reg[1] |= mac[1];
+-	reg[0] |= mac[2] << QCA8K_ATU_ADDR2_S;
+-	reg[0] |= mac[3] << QCA8K_ATU_ADDR3_S;
+-	reg[0] |= mac[4] << QCA8K_ATU_ADDR4_S;
+-	reg[0] |= mac[5];
++	reg[1] |= FIELD_PREP(QCA8K_ATU_ADDR0_MASK, mac[0]);
++	reg[1] |= FIELD_PREP(QCA8K_ATU_ADDR1_MASK, mac[1]);
++	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR2_MASK, mac[2]);
++	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR3_MASK, mac[3]);
++	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR4_MASK, mac[4]);
++	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR5_MASK, mac[5]);
+ 
+ 	/* load the array into the ARL table */
+ 	for (i = 0; i < 3; i++)
+@@ -372,7 +373,7 @@ qca8k_fdb_access(struct qca8k_priv *priv
+ 	reg |= cmd;
+ 	if (port >= 0) {
+ 		reg |= QCA8K_ATU_FUNC_PORT_EN;
+-		reg |= (port & QCA8K_ATU_FUNC_PORT_M) << QCA8K_ATU_FUNC_PORT_S;
++		reg |= FIELD_PREP(QCA8K_ATU_FUNC_PORT_MASK, port);
+ 	}
+ 
+ 	/* Write the function register triggering the table access */
+@@ -454,7 +455,7 @@ qca8k_vlan_access(struct qca8k_priv *pri
+ 	/* Set the command and VLAN index */
+ 	reg = QCA8K_VTU_FUNC1_BUSY;
+ 	reg |= cmd;
+-	reg |= vid << QCA8K_VTU_FUNC1_VID_S;
++	reg |= FIELD_PREP(QCA8K_VTU_FUNC1_VID_MASK, vid);
+ 
+ 	/* Write the function register triggering the table access */
+ 	ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC1, reg);
+@@ -500,13 +501,11 @@ qca8k_vlan_add(struct qca8k_priv *priv,
+ 	if (ret < 0)
+ 		goto out;
+ 	reg |= QCA8K_VTU_FUNC0_VALID | QCA8K_VTU_FUNC0_IVL_EN;
+-	reg &= ~(QCA8K_VTU_FUNC0_EG_MODE_MASK << QCA8K_VTU_FUNC0_EG_MODE_S(port));
++	reg &= ~QCA8K_VTU_FUNC0_EG_MODE_PORT_MASK(port);
+ 	if (untagged)
+-		reg |= QCA8K_VTU_FUNC0_EG_MODE_UNTAG <<
+-				QCA8K_VTU_FUNC0_EG_MODE_S(port);
++		reg |= QCA8K_VTU_FUNC0_EG_MODE_PORT_UNTAG(port);
+ 	else
+-		reg |= QCA8K_VTU_FUNC0_EG_MODE_TAG <<
+-				QCA8K_VTU_FUNC0_EG_MODE_S(port);
++		reg |= QCA8K_VTU_FUNC0_EG_MODE_PORT_TAG(port);
+ 
+ 	ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC0, reg);
+ 	if (ret)
+@@ -534,15 +533,13 @@ qca8k_vlan_del(struct qca8k_priv *priv,
+ 	ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC0, &reg);
+ 	if (ret < 0)
+ 		goto out;
+-	reg &= ~(3 << QCA8K_VTU_FUNC0_EG_MODE_S(port));
+-	reg |= QCA8K_VTU_FUNC0_EG_MODE_NOT <<
+-			QCA8K_VTU_FUNC0_EG_MODE_S(port);
++	reg &= ~QCA8K_VTU_FUNC0_EG_MODE_PORT_MASK(port);
++	reg |= QCA8K_VTU_FUNC0_EG_MODE_PORT_NOT(port);
+ 
+ 	/* Check if we're the last member to be removed */
+ 	del = true;
+ 	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+-		mask = QCA8K_VTU_FUNC0_EG_MODE_NOT;
+-		mask <<= QCA8K_VTU_FUNC0_EG_MODE_S(i);
++		mask = QCA8K_VTU_FUNC0_EG_MODE_PORT_NOT(i);
+ 
+ 		if ((reg & mask) != mask) {
+ 			del = false;
+@@ -1014,7 +1011,7 @@ qca8k_parse_port_config(struct qca8k_pri
+ 				 mode == PHY_INTERFACE_MODE_RGMII_TXID)
+ 				delay = 1;
+ 
+-			if (delay > QCA8K_MAX_DELAY) {
++			if (!FIELD_FIT(QCA8K_PORT_PAD_RGMII_TX_DELAY_MASK, delay)) {
+ 				dev_err(priv->dev, "rgmii tx delay is limited to a max value of 3ns, setting to the max value");
+ 				delay = 3;
+ 			}
+@@ -1030,7 +1027,7 @@ qca8k_parse_port_config(struct qca8k_pri
+ 				 mode == PHY_INTERFACE_MODE_RGMII_RXID)
+ 				delay = 2;
+ 
+-			if (delay > QCA8K_MAX_DELAY) {
++			if (!FIELD_FIT(QCA8K_PORT_PAD_RGMII_RX_DELAY_MASK, delay)) {
+ 				dev_err(priv->dev, "rgmii rx delay is limited to a max value of 3ns, setting to the max value");
+ 				delay = 3;
+ 			}
+@@ -1141,8 +1138,8 @@ qca8k_setup(struct dsa_switch *ds)
+ 		/* Enable QCA header mode on all cpu ports */
+ 		if (dsa_is_cpu_port(ds, i)) {
+ 			ret = qca8k_write(priv, QCA8K_REG_PORT_HDR_CTRL(i),
+-					  QCA8K_PORT_HDR_CTRL_ALL << QCA8K_PORT_HDR_CTRL_TX_S |
+-					  QCA8K_PORT_HDR_CTRL_ALL << QCA8K_PORT_HDR_CTRL_RX_S);
++					  FIELD_PREP(QCA8K_PORT_HDR_CTRL_TX_MASK, QCA8K_PORT_HDR_CTRL_ALL) |
++					  FIELD_PREP(QCA8K_PORT_HDR_CTRL_RX_MASK, QCA8K_PORT_HDR_CTRL_ALL));
+ 			if (ret) {
+ 				dev_err(priv->dev, "failed enabling QCA header mode");
+ 				return ret;
+@@ -1159,10 +1156,10 @@ qca8k_setup(struct dsa_switch *ds)
+ 	 * for igmp, unknown, multicast and broadcast packet
+ 	 */
+ 	ret = qca8k_write(priv, QCA8K_REG_GLOBAL_FW_CTRL1,
+-			  BIT(cpu_port) << QCA8K_GLOBAL_FW_CTRL1_IGMP_DP_S |
+-			  BIT(cpu_port) << QCA8K_GLOBAL_FW_CTRL1_BC_DP_S |
+-			  BIT(cpu_port) << QCA8K_GLOBAL_FW_CTRL1_MC_DP_S |
+-			  BIT(cpu_port) << QCA8K_GLOBAL_FW_CTRL1_UC_DP_S);
++			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_IGMP_DP_MASK, BIT(cpu_port)) |
++			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_BC_DP_MASK, BIT(cpu_port)) |
++			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_MC_DP_MASK, BIT(cpu_port)) |
++			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_UC_DP_MASK, BIT(cpu_port)));
+ 	if (ret)
+ 		return ret;
+ 
+@@ -1180,8 +1177,6 @@ qca8k_setup(struct dsa_switch *ds)
+ 
+ 		/* Individual user ports get connected to CPU port only */
+ 		if (dsa_is_user_port(ds, i)) {
+-			int shift = 16 * (i % 2);
+-
+ 			ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(i),
+ 					QCA8K_PORT_LOOKUP_MEMBER,
+ 					BIT(cpu_port));
+@@ -1198,8 +1193,8 @@ qca8k_setup(struct dsa_switch *ds)
+ 			 * default egress vid
+ 			 */
+ 			ret = qca8k_rmw(priv, QCA8K_EGRESS_VLAN(i),
+-					0xfff << shift,
+-					QCA8K_PORT_VID_DEF << shift);
++					QCA8K_EGREES_VLAN_PORT_MASK(i),
++					QCA8K_EGREES_VLAN_PORT(i, QCA8K_PORT_VID_DEF));
+ 			if (ret)
+ 				return ret;
+ 
+@@ -1246,7 +1241,7 @@ qca8k_setup(struct dsa_switch *ds)
+ 			QCA8K_PORT_HOL_CTRL1_EG_PORT_BUF_EN |
+ 			QCA8K_PORT_HOL_CTRL1_WRED_EN;
+ 			qca8k_rmw(priv, QCA8K_REG_PORT_HOL_CTRL1(i),
+-				  QCA8K_PORT_HOL_CTRL1_ING_BUF |
++				  QCA8K_PORT_HOL_CTRL1_ING_BUF_MASK |
+ 				  QCA8K_PORT_HOL_CTRL1_EG_PRI_BUF_EN |
+ 				  QCA8K_PORT_HOL_CTRL1_EG_PORT_BUF_EN |
+ 				  QCA8K_PORT_HOL_CTRL1_WRED_EN,
+@@ -1269,8 +1264,8 @@ qca8k_setup(struct dsa_switch *ds)
+ 		mask = QCA8K_GLOBAL_FC_GOL_XON_THRES(288) |
+ 		       QCA8K_GLOBAL_FC_GOL_XOFF_THRES(496);
+ 		qca8k_rmw(priv, QCA8K_REG_GLOBAL_FC_THRESH,
+-			  QCA8K_GLOBAL_FC_GOL_XON_THRES_S |
+-			  QCA8K_GLOBAL_FC_GOL_XOFF_THRES_S,
++			  QCA8K_GLOBAL_FC_GOL_XON_THRES_MASK |
++			  QCA8K_GLOBAL_FC_GOL_XOFF_THRES_MASK,
+ 			  mask);
+ 	}
+ 
+@@ -1935,11 +1930,11 @@ qca8k_port_vlan_filtering(struct dsa_swi
+ 
+ 	if (vlan_filtering) {
+ 		ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+-				QCA8K_PORT_LOOKUP_VLAN_MODE,
++				QCA8K_PORT_LOOKUP_VLAN_MODE_MASK,
+ 				QCA8K_PORT_LOOKUP_VLAN_MODE_SECURE);
+ 	} else {
+ 		ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+-				QCA8K_PORT_LOOKUP_VLAN_MODE,
++				QCA8K_PORT_LOOKUP_VLAN_MODE_MASK,
+ 				QCA8K_PORT_LOOKUP_VLAN_MODE_NONE);
+ 	}
+ 
+@@ -1963,10 +1958,9 @@ qca8k_port_vlan_add(struct dsa_switch *d
+ 	}
+ 
+ 	if (pvid) {
+-		int shift = 16 * (port % 2);
+-
+ 		ret = qca8k_rmw(priv, QCA8K_EGRESS_VLAN(port),
+-				0xfff << shift, vlan->vid << shift);
++				QCA8K_EGREES_VLAN_PORT_MASK(port),
++				QCA8K_EGREES_VLAN_PORT(port, vlan->vid));
+ 		if (ret)
+ 			return ret;
+ 
+@@ -2060,7 +2054,7 @@ static int qca8k_read_switch_id(struct q
+ 	if (ret < 0)
+ 		return -ENODEV;
+ 
+-	id = QCA8K_MASK_CTRL_DEVICE_ID(val & QCA8K_MASK_CTRL_DEVICE_ID_MASK);
++	id = QCA8K_MASK_CTRL_DEVICE_ID(val);
+ 	if (id != data->id) {
+ 		dev_err(priv->dev, "Switch id detected %x but expected %x", id, data->id);
+ 		return -ENODEV;
+@@ -2069,7 +2063,7 @@ static int qca8k_read_switch_id(struct q
+ 	priv->switch_id = id;
+ 
+ 	/* Save revision to communicate to the internal PHY driver */
+-	priv->switch_revision = (val & QCA8K_MASK_CTRL_REV_ID_MASK);
++	priv->switch_revision = QCA8K_MASK_CTRL_REV_ID(val);
+ 
+ 	return 0;
+ }
+--- a/drivers/net/dsa/qca8k.h
++++ b/drivers/net/dsa/qca8k.h
+@@ -30,9 +30,9 @@
+ /* Global control registers */
+ #define QCA8K_REG_MASK_CTRL				0x000
+ #define   QCA8K_MASK_CTRL_REV_ID_MASK			GENMASK(7, 0)
+-#define   QCA8K_MASK_CTRL_REV_ID(x)			((x) >> 0)
++#define   QCA8K_MASK_CTRL_REV_ID(x)			FIELD_GET(QCA8K_MASK_CTRL_REV_ID_MASK, x)
+ #define   QCA8K_MASK_CTRL_DEVICE_ID_MASK		GENMASK(15, 8)
+-#define   QCA8K_MASK_CTRL_DEVICE_ID(x)			((x) >> 8)
++#define   QCA8K_MASK_CTRL_DEVICE_ID(x)			FIELD_GET(QCA8K_MASK_CTRL_DEVICE_ID_MASK, x)
+ #define QCA8K_REG_PORT0_PAD_CTRL			0x004
+ #define   QCA8K_PORT0_PAD_MAC06_EXCHANGE_EN		BIT(31)
+ #define   QCA8K_PORT0_PAD_SGMII_RXCLK_FALLING_EDGE	BIT(19)
+@@ -41,12 +41,11 @@
+ #define QCA8K_REG_PORT6_PAD_CTRL			0x00c
+ #define   QCA8K_PORT_PAD_RGMII_EN			BIT(26)
+ #define   QCA8K_PORT_PAD_RGMII_TX_DELAY_MASK		GENMASK(23, 22)
+-#define   QCA8K_PORT_PAD_RGMII_TX_DELAY(x)		((x) << 22)
++#define   QCA8K_PORT_PAD_RGMII_TX_DELAY(x)		FIELD_PREP(QCA8K_PORT_PAD_RGMII_TX_DELAY_MASK, x)
+ #define   QCA8K_PORT_PAD_RGMII_RX_DELAY_MASK		GENMASK(21, 20)
+-#define   QCA8K_PORT_PAD_RGMII_RX_DELAY(x)		((x) << 20)
++#define   QCA8K_PORT_PAD_RGMII_RX_DELAY(x)		FIELD_PREP(QCA8K_PORT_PAD_RGMII_RX_DELAY_MASK, x)
+ #define	  QCA8K_PORT_PAD_RGMII_TX_DELAY_EN		BIT(25)
+ #define   QCA8K_PORT_PAD_RGMII_RX_DELAY_EN		BIT(24)
+-#define   QCA8K_MAX_DELAY				3
+ #define   QCA8K_PORT_PAD_SGMII_EN			BIT(7)
+ #define QCA8K_REG_PWS					0x010
+ #define   QCA8K_PWS_POWER_ON_SEL			BIT(31)
+@@ -68,10 +67,12 @@
+ #define   QCA8K_MDIO_MASTER_READ			BIT(27)
+ #define   QCA8K_MDIO_MASTER_WRITE			0
+ #define   QCA8K_MDIO_MASTER_SUP_PRE			BIT(26)
+-#define   QCA8K_MDIO_MASTER_PHY_ADDR(x)			((x) << 21)
+-#define   QCA8K_MDIO_MASTER_REG_ADDR(x)			((x) << 16)
+-#define   QCA8K_MDIO_MASTER_DATA(x)			(x)
++#define   QCA8K_MDIO_MASTER_PHY_ADDR_MASK		GENMASK(25, 21)
++#define   QCA8K_MDIO_MASTER_PHY_ADDR(x)			FIELD_PREP(QCA8K_MDIO_MASTER_PHY_ADDR_MASK, x)
++#define   QCA8K_MDIO_MASTER_REG_ADDR_MASK		GENMASK(20, 16)
++#define   QCA8K_MDIO_MASTER_REG_ADDR(x)			FIELD_PREP(QCA8K_MDIO_MASTER_REG_ADDR_MASK, x)
+ #define   QCA8K_MDIO_MASTER_DATA_MASK			GENMASK(15, 0)
++#define   QCA8K_MDIO_MASTER_DATA(x)			FIELD_PREP(QCA8K_MDIO_MASTER_DATA_MASK, x)
+ #define   QCA8K_MDIO_MASTER_MAX_PORTS			5
+ #define   QCA8K_MDIO_MASTER_MAX_REG			32
+ #define QCA8K_GOL_MAC_ADDR0				0x60
+@@ -93,9 +94,7 @@
+ #define   QCA8K_PORT_STATUS_FLOW_AUTO			BIT(12)
+ #define QCA8K_REG_PORT_HDR_CTRL(_i)			(0x9c + (_i * 4))
+ #define   QCA8K_PORT_HDR_CTRL_RX_MASK			GENMASK(3, 2)
+-#define   QCA8K_PORT_HDR_CTRL_RX_S			2
+ #define   QCA8K_PORT_HDR_CTRL_TX_MASK			GENMASK(1, 0)
+-#define   QCA8K_PORT_HDR_CTRL_TX_S			0
+ #define   QCA8K_PORT_HDR_CTRL_ALL			2
+ #define   QCA8K_PORT_HDR_CTRL_MGMT			1
+ #define   QCA8K_PORT_HDR_CTRL_NONE			0
+@@ -105,10 +104,11 @@
+ #define   QCA8K_SGMII_EN_TX				BIT(3)
+ #define   QCA8K_SGMII_EN_SD				BIT(4)
+ #define   QCA8K_SGMII_CLK125M_DELAY			BIT(7)
+-#define   QCA8K_SGMII_MODE_CTRL_MASK			(BIT(22) | BIT(23))
+-#define   QCA8K_SGMII_MODE_CTRL_BASEX			(0 << 22)
+-#define   QCA8K_SGMII_MODE_CTRL_PHY			(1 << 22)
+-#define   QCA8K_SGMII_MODE_CTRL_MAC			(2 << 22)
++#define   QCA8K_SGMII_MODE_CTRL_MASK			GENMASK(23, 22)
++#define   QCA8K_SGMII_MODE_CTRL(x)			FIELD_PREP(QCA8K_SGMII_MODE_CTRL_MASK, x)
++#define   QCA8K_SGMII_MODE_CTRL_BASEX			QCA8K_SGMII_MODE_CTRL(0x0)
++#define   QCA8K_SGMII_MODE_CTRL_PHY			QCA8K_SGMII_MODE_CTRL(0x1)
++#define   QCA8K_SGMII_MODE_CTRL_MAC			QCA8K_SGMII_MODE_CTRL(0x2)
+ 
+ /* MAC_PWR_SEL registers */
+ #define QCA8K_REG_MAC_PWR_SEL				0x0e4
+@@ -121,100 +121,115 @@
+ 
+ /* ACL registers */
+ #define QCA8K_REG_PORT_VLAN_CTRL0(_i)			(0x420 + (_i * 8))
+-#define   QCA8K_PORT_VLAN_CVID(x)			(x << 16)
+-#define   QCA8K_PORT_VLAN_SVID(x)			x
++#define   QCA8K_PORT_VLAN_CVID_MASK			GENMASK(27, 16)
++#define   QCA8K_PORT_VLAN_CVID(x)			FIELD_PREP(QCA8K_PORT_VLAN_CVID_MASK, x)
++#define   QCA8K_PORT_VLAN_SVID_MASK			GENMASK(11, 0)
++#define   QCA8K_PORT_VLAN_SVID(x)			FIELD_PREP(QCA8K_PORT_VLAN_SVID_MASK, x)
+ #define QCA8K_REG_PORT_VLAN_CTRL1(_i)			(0x424 + (_i * 8))
+ #define QCA8K_REG_IPV4_PRI_BASE_ADDR			0x470
+ #define QCA8K_REG_IPV4_PRI_ADDR_MASK			0x474
+ 
+ /* Lookup registers */
+ #define QCA8K_REG_ATU_DATA0				0x600
+-#define   QCA8K_ATU_ADDR2_S				24
+-#define   QCA8K_ATU_ADDR3_S				16
+-#define   QCA8K_ATU_ADDR4_S				8
++#define   QCA8K_ATU_ADDR2_MASK				GENMASK(31, 24)
++#define   QCA8K_ATU_ADDR3_MASK				GENMASK(23, 16)
++#define   QCA8K_ATU_ADDR4_MASK				GENMASK(15, 8)
++#define   QCA8K_ATU_ADDR5_MASK				GENMASK(7, 0)
+ #define QCA8K_REG_ATU_DATA1				0x604
+-#define   QCA8K_ATU_PORT_M				0x7f
+-#define   QCA8K_ATU_PORT_S				16
+-#define   QCA8K_ATU_ADDR0_S				8
++#define   QCA8K_ATU_PORT_MASK				GENMASK(22, 16)
++#define   QCA8K_ATU_ADDR0_MASK				GENMASK(15, 8)
++#define   QCA8K_ATU_ADDR1_MASK				GENMASK(7, 0)
+ #define QCA8K_REG_ATU_DATA2				0x608
+-#define   QCA8K_ATU_VID_M				0xfff
+-#define   QCA8K_ATU_VID_S				8
+-#define   QCA8K_ATU_STATUS_M				0xf
++#define   QCA8K_ATU_VID_MASK				GENMASK(19, 8)
++#define   QCA8K_ATU_STATUS_MASK				GENMASK(3, 0)
+ #define   QCA8K_ATU_STATUS_STATIC			0xf
+ #define QCA8K_REG_ATU_FUNC				0x60c
+ #define   QCA8K_ATU_FUNC_BUSY				BIT(31)
+ #define   QCA8K_ATU_FUNC_PORT_EN			BIT(14)
+ #define   QCA8K_ATU_FUNC_MULTI_EN			BIT(13)
+ #define   QCA8K_ATU_FUNC_FULL				BIT(12)
+-#define   QCA8K_ATU_FUNC_PORT_M				0xf
+-#define   QCA8K_ATU_FUNC_PORT_S				8
++#define   QCA8K_ATU_FUNC_PORT_MASK			GENMASK(11, 8)
+ #define QCA8K_REG_VTU_FUNC0				0x610
+ #define   QCA8K_VTU_FUNC0_VALID				BIT(20)
+ #define   QCA8K_VTU_FUNC0_IVL_EN			BIT(19)
+-#define   QCA8K_VTU_FUNC0_EG_MODE_S(_i)			(4 + (_i) * 2)
+-#define   QCA8K_VTU_FUNC0_EG_MODE_MASK			3
+-#define   QCA8K_VTU_FUNC0_EG_MODE_UNMOD			0
+-#define   QCA8K_VTU_FUNC0_EG_MODE_UNTAG			1
+-#define   QCA8K_VTU_FUNC0_EG_MODE_TAG			2
+-#define   QCA8K_VTU_FUNC0_EG_MODE_NOT			3
++/*        QCA8K_VTU_FUNC0_EG_MODE_MASK			GENMASK(17, 4)
++ *          It does contain VLAN_MODE for each port [5:4] for port0,
++ *          [7:6] for port1 ... [17:16] for port6. Use virtual port
++ *          define to handle this.
++ */
++#define   QCA8K_VTU_FUNC0_EG_MODE_PORT_SHIFT(_i)	(4 + (_i) * 2)
++#define   QCA8K_VTU_FUNC0_EG_MODE_MASK			GENMASK(1, 0)
++#define   QCA8K_VTU_FUNC0_EG_MODE_PORT_MASK(_i)		(GENMASK(1, 0) << QCA8K_VTU_FUNC0_EG_MODE_PORT_SHIFT(_i))
++#define   QCA8K_VTU_FUNC0_EG_MODE_UNMOD			FIELD_PREP(QCA8K_VTU_FUNC0_EG_MODE_MASK, 0x0)
++#define   QCA8K_VTU_FUNC0_EG_MODE_PORT_UNMOD(_i)	(QCA8K_VTU_FUNC0_EG_MODE_UNMOD << QCA8K_VTU_FUNC0_EG_MODE_PORT_SHIFT(_i))
++#define   QCA8K_VTU_FUNC0_EG_MODE_UNTAG			FIELD_PREP(QCA8K_VTU_FUNC0_EG_MODE_MASK, 0x1)
++#define   QCA8K_VTU_FUNC0_EG_MODE_PORT_UNTAG(_i)	(QCA8K_VTU_FUNC0_EG_MODE_UNTAG << QCA8K_VTU_FUNC0_EG_MODE_PORT_SHIFT(_i))
++#define   QCA8K_VTU_FUNC0_EG_MODE_TAG			FIELD_PREP(QCA8K_VTU_FUNC0_EG_MODE_MASK, 0x2)
++#define   QCA8K_VTU_FUNC0_EG_MODE_PORT_TAG(_i)		(QCA8K_VTU_FUNC0_EG_MODE_TAG << QCA8K_VTU_FUNC0_EG_MODE_PORT_SHIFT(_i))
++#define   QCA8K_VTU_FUNC0_EG_MODE_NOT			FIELD_PREP(QCA8K_VTU_FUNC0_EG_MODE_MASK, 0x3)
++#define   QCA8K_VTU_FUNC0_EG_MODE_PORT_NOT(_i)		(QCA8K_VTU_FUNC0_EG_MODE_NOT << QCA8K_VTU_FUNC0_EG_MODE_PORT_SHIFT(_i))
+ #define QCA8K_REG_VTU_FUNC1				0x614
+ #define   QCA8K_VTU_FUNC1_BUSY				BIT(31)
+-#define   QCA8K_VTU_FUNC1_VID_S				16
++#define   QCA8K_VTU_FUNC1_VID_MASK			GENMASK(27, 16)
+ #define   QCA8K_VTU_FUNC1_FULL				BIT(4)
+ #define QCA8K_REG_GLOBAL_FW_CTRL0			0x620
+ #define   QCA8K_GLOBAL_FW_CTRL0_CPU_PORT_EN		BIT(10)
+ #define QCA8K_REG_GLOBAL_FW_CTRL1			0x624
+-#define   QCA8K_GLOBAL_FW_CTRL1_IGMP_DP_S		24
+-#define   QCA8K_GLOBAL_FW_CTRL1_BC_DP_S			16
+-#define   QCA8K_GLOBAL_FW_CTRL1_MC_DP_S			8
+-#define   QCA8K_GLOBAL_FW_CTRL1_UC_DP_S			0
++#define   QCA8K_GLOBAL_FW_CTRL1_IGMP_DP_MASK		GENMASK(30, 24)
++#define   QCA8K_GLOBAL_FW_CTRL1_BC_DP_MASK		GENMASK(22, 16)
++#define   QCA8K_GLOBAL_FW_CTRL1_MC_DP_MASK		GENMASK(14, 8)
++#define   QCA8K_GLOBAL_FW_CTRL1_UC_DP_MASK		GENMASK(6, 0)
+ #define QCA8K_PORT_LOOKUP_CTRL(_i)			(0x660 + (_i) * 0xc)
+ #define   QCA8K_PORT_LOOKUP_MEMBER			GENMASK(6, 0)
+-#define   QCA8K_PORT_LOOKUP_VLAN_MODE			GENMASK(9, 8)
+-#define   QCA8K_PORT_LOOKUP_VLAN_MODE_NONE		(0 << 8)
+-#define   QCA8K_PORT_LOOKUP_VLAN_MODE_FALLBACK		(1 << 8)
+-#define   QCA8K_PORT_LOOKUP_VLAN_MODE_CHECK		(2 << 8)
+-#define   QCA8K_PORT_LOOKUP_VLAN_MODE_SECURE		(3 << 8)
++#define   QCA8K_PORT_LOOKUP_VLAN_MODE_MASK		GENMASK(9, 8)
++#define   QCA8K_PORT_LOOKUP_VLAN_MODE(x)		FIELD_PREP(QCA8K_PORT_LOOKUP_VLAN_MODE_MASK, x)
++#define   QCA8K_PORT_LOOKUP_VLAN_MODE_NONE		QCA8K_PORT_LOOKUP_VLAN_MODE(0x0)
++#define   QCA8K_PORT_LOOKUP_VLAN_MODE_FALLBACK		QCA8K_PORT_LOOKUP_VLAN_MODE(0x1)
++#define   QCA8K_PORT_LOOKUP_VLAN_MODE_CHECK		QCA8K_PORT_LOOKUP_VLAN_MODE(0x2)
++#define   QCA8K_PORT_LOOKUP_VLAN_MODE_SECURE		QCA8K_PORT_LOOKUP_VLAN_MODE(0x3)
+ #define   QCA8K_PORT_LOOKUP_STATE_MASK			GENMASK(18, 16)
+-#define   QCA8K_PORT_LOOKUP_STATE_DISABLED		(0 << 16)
+-#define   QCA8K_PORT_LOOKUP_STATE_BLOCKING		(1 << 16)
+-#define   QCA8K_PORT_LOOKUP_STATE_LISTENING		(2 << 16)
+-#define   QCA8K_PORT_LOOKUP_STATE_LEARNING		(3 << 16)
+-#define   QCA8K_PORT_LOOKUP_STATE_FORWARD		(4 << 16)
+-#define   QCA8K_PORT_LOOKUP_STATE			GENMASK(18, 16)
++#define   QCA8K_PORT_LOOKUP_STATE(x)			FIELD_PREP(QCA8K_PORT_LOOKUP_STATE_MASK, x)
++#define   QCA8K_PORT_LOOKUP_STATE_DISABLED		QCA8K_PORT_LOOKUP_STATE(0x0)
++#define   QCA8K_PORT_LOOKUP_STATE_BLOCKING		QCA8K_PORT_LOOKUP_STATE(0x1)
++#define   QCA8K_PORT_LOOKUP_STATE_LISTENING		QCA8K_PORT_LOOKUP_STATE(0x2)
++#define   QCA8K_PORT_LOOKUP_STATE_LEARNING		QCA8K_PORT_LOOKUP_STATE(0x3)
++#define   QCA8K_PORT_LOOKUP_STATE_FORWARD		QCA8K_PORT_LOOKUP_STATE(0x4)
+ #define   QCA8K_PORT_LOOKUP_LEARN			BIT(20)
+ 
+ #define QCA8K_REG_GLOBAL_FC_THRESH			0x800
+-#define   QCA8K_GLOBAL_FC_GOL_XON_THRES(x)		((x) << 16)
+-#define   QCA8K_GLOBAL_FC_GOL_XON_THRES_S		GENMASK(24, 16)
+-#define   QCA8K_GLOBAL_FC_GOL_XOFF_THRES(x)		((x) << 0)
+-#define   QCA8K_GLOBAL_FC_GOL_XOFF_THRES_S		GENMASK(8, 0)
++#define   QCA8K_GLOBAL_FC_GOL_XON_THRES_MASK		GENMASK(24, 16)
++#define   QCA8K_GLOBAL_FC_GOL_XON_THRES(x)		FIELD_PREP(QCA8K_GLOBAL_FC_GOL_XON_THRES_MASK, x)
++#define   QCA8K_GLOBAL_FC_GOL_XOFF_THRES_MASK		GENMASK(8, 0)
++#define   QCA8K_GLOBAL_FC_GOL_XOFF_THRES(x)		FIELD_PREP(QCA8K_GLOBAL_FC_GOL_XOFF_THRES_MASK, x)
+ 
+ #define QCA8K_REG_PORT_HOL_CTRL0(_i)			(0x970 + (_i) * 0x8)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI0_BUF		GENMASK(3, 0)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI0(x)		((x) << 0)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI1_BUF		GENMASK(7, 4)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI1(x)		((x) << 4)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI2_BUF		GENMASK(11, 8)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI2(x)		((x) << 8)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI3_BUF		GENMASK(15, 12)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI3(x)		((x) << 12)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI4_BUF		GENMASK(19, 16)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI4(x)		((x) << 16)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI5_BUF		GENMASK(23, 20)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI5(x)		((x) << 20)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PORT_BUF		GENMASK(29, 24)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PORT(x)		((x) << 24)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI0_BUF_MASK		GENMASK(3, 0)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI0(x)		FIELD_PREP(QCA8K_PORT_HOL_CTRL0_EG_PRI0_BUF_MASK, x)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI1_BUF_MASK		GENMASK(7, 4)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI1(x)		FIELD_PREP(QCA8K_PORT_HOL_CTRL0_EG_PRI1_BUF_MASK, x)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI2_BUF_MASK		GENMASK(11, 8)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI2(x)		FIELD_PREP(QCA8K_PORT_HOL_CTRL0_EG_PRI2_BUF_MASK, x)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI3_BUF_MASK		GENMASK(15, 12)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI3(x)		FIELD_PREP(QCA8K_PORT_HOL_CTRL0_EG_PRI3_BUF_MASK, x)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI4_BUF_MASK		GENMASK(19, 16)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI4(x)		FIELD_PREP(QCA8K_PORT_HOL_CTRL0_EG_PRI4_BUF_MASK, x)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI5_BUF_MASK		GENMASK(23, 20)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI5(x)		FIELD_PREP(QCA8K_PORT_HOL_CTRL0_EG_PRI5_BUF_MASK, x)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PORT_BUF_MASK		GENMASK(29, 24)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PORT(x)		FIELD_PREP(QCA8K_PORT_HOL_CTRL0_EG_PORT_BUF_MASK, x)
+ 
+ #define QCA8K_REG_PORT_HOL_CTRL1(_i)			(0x974 + (_i) * 0x8)
+-#define   QCA8K_PORT_HOL_CTRL1_ING_BUF			GENMASK(3, 0)
+-#define   QCA8K_PORT_HOL_CTRL1_ING(x)			((x) << 0)
++#define   QCA8K_PORT_HOL_CTRL1_ING_BUF_MASK		GENMASK(3, 0)
++#define   QCA8K_PORT_HOL_CTRL1_ING(x)			FIELD_PREP(QCA8K_PORT_HOL_CTRL1_ING_BUF_MASK, x)
+ #define   QCA8K_PORT_HOL_CTRL1_EG_PRI_BUF_EN		BIT(6)
+ #define   QCA8K_PORT_HOL_CTRL1_EG_PORT_BUF_EN		BIT(7)
+ #define   QCA8K_PORT_HOL_CTRL1_WRED_EN			BIT(8)
+ #define   QCA8K_PORT_HOL_CTRL1_EG_MIRROR_EN		BIT(16)
+ 
+ /* Pkt edit registers */
++#define QCA8K_EGREES_VLAN_PORT_SHIFT(_i)		(16 * ((_i) % 2))
++#define QCA8K_EGREES_VLAN_PORT_MASK(_i)			(GENMASK(11, 0) << QCA8K_EGREES_VLAN_PORT_SHIFT(_i))
++#define QCA8K_EGREES_VLAN_PORT(_i, x)			((x) << QCA8K_EGREES_VLAN_PORT_SHIFT(_i))
+ #define QCA8K_EGRESS_VLAN(x)				(0x0c70 + (4 * (x / 2)))
+ 
+ /* L3 registers */
diff --git a/target/linux/generic/backport-5.15/755-v5.17-net-next-net-dsa-qca8k-remove-extra-mutex_init-in-qca8k_setup.patch b/target/linux/generic/backport-5.15/755-v5.17-net-next-net-dsa-qca8k-remove-extra-mutex_init-in-qca8k_setup.patch
new file mode 100644
index 00000000000000..8c39b8ea295a43
--- /dev/null
+++ b/target/linux/generic/backport-5.15/755-v5.17-net-next-net-dsa-qca8k-remove-extra-mutex_init-in-qca8k_setup.patch
@@ -0,0 +1,25 @@
+From 994c28b6f971fa5db8ae977daea37eee87d93d51 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Mon, 22 Nov 2021 16:23:42 +0100
+Subject: net: dsa: qca8k: remove extra mutex_init in qca8k_setup
+
+Mutex is already init in sw_probe. Remove the extra init in qca8k_setup.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -1086,8 +1086,6 @@ qca8k_setup(struct dsa_switch *ds)
+ 	if (ret)
+ 		return ret;
+ 
+-	mutex_init(&priv->reg_mutex);
+-
+ 	/* Start by setting up the register mapping */
+ 	priv->regmap = devm_regmap_init(ds->dev, NULL, priv,
+ 					&qca8k_regmap_config);
diff --git a/target/linux/generic/backport-5.15/756-v5.17-net-next-net-dsa-qca8k-move-regmap-init-in-probe-and-set-it.patch b/target/linux/generic/backport-5.15/756-v5.17-net-next-net-dsa-qca8k-move-regmap-init-in-probe-and-set-it.patch
new file mode 100644
index 00000000000000..44d938c53e85e0
--- /dev/null
+++ b/target/linux/generic/backport-5.15/756-v5.17-net-next-net-dsa-qca8k-move-regmap-init-in-probe-and-set-it.patch
@@ -0,0 +1,46 @@
+From 36b8af12f424e7a7f60a935c60a0fd4aa0822378 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Mon, 22 Nov 2021 16:23:43 +0100
+Subject: net: dsa: qca8k: move regmap init in probe and set it mandatory
+
+In preparation for regmap conversion, move regmap init in the probe
+function and make it mandatory as any read/write/rmw operation will be
+converted to regmap API.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -1086,12 +1086,6 @@ qca8k_setup(struct dsa_switch *ds)
+ 	if (ret)
+ 		return ret;
+ 
+-	/* Start by setting up the register mapping */
+-	priv->regmap = devm_regmap_init(ds->dev, NULL, priv,
+-					&qca8k_regmap_config);
+-	if (IS_ERR(priv->regmap))
+-		dev_warn(priv->dev, "regmap initialization failed");
+-
+ 	ret = qca8k_setup_mdio_bus(priv);
+ 	if (ret)
+ 		return ret;
+@@ -2096,6 +2090,14 @@ qca8k_sw_probe(struct mdio_device *mdiod
+ 		gpiod_set_value_cansleep(priv->reset_gpio, 0);
+ 	}
+ 
++	/* Start by setting up the register mapping */
++	priv->regmap = devm_regmap_init(&mdiodev->dev, NULL, priv,
++					&qca8k_regmap_config);
++	if (IS_ERR(priv->regmap)) {
++		dev_err(priv->dev, "regmap initialization failed");
++		return PTR_ERR(priv->regmap);
++	}
++
+ 	/* Check the detected switch id */
+ 	ret = qca8k_read_switch_id(priv);
+ 	if (ret)
diff --git a/target/linux/generic/backport-5.15/757-v5.17-net-next-net-dsa-qca8k-initial-conversion-to-regmap-heper.patch b/target/linux/generic/backport-5.15/757-v5.17-net-next-net-dsa-qca8k-initial-conversion-to-regmap-heper.patch
new file mode 100644
index 00000000000000..4ca9c8ba41d684
--- /dev/null
+++ b/target/linux/generic/backport-5.15/757-v5.17-net-next-net-dsa-qca8k-initial-conversion-to-regmap-heper.patch
@@ -0,0 +1,249 @@
+From 8b5f3f29a81a71934d004e21a1292c1148b05926 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Mon, 22 Nov 2021 16:23:44 +0100
+Subject: net: dsa: qca8k: initial conversion to regmap helper
+
+Convert any qca8k set/clear/pool to regmap helper and add
+missing config to regmap_config struct.
+Read/write/rmw operation are reworked to use the regmap helper
+internally to keep the delta of this patch low. These additional
+function will then be dropped when the code split will be proposed.
+
+Ipq40xx SoC have the internal switch based on the qca8k regmap but use
+mmio for read/write/rmw operation instead of mdio.
+In preparation for the support of this internal switch, convert the
+driver to regmap API to later split the driver to common and specific
+code. The overhead introduced by the use of regamp API is marginal as the
+internal mdio will bypass it by using its direct access and regmap will be
+used only by configuration functions or fdb access.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 107 +++++++++++++++++++++---------------------------
+ 1 file changed, 47 insertions(+), 60 deletions(-)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -10,6 +10,7 @@
+ #include <linux/phy.h>
+ #include <linux/netdevice.h>
+ #include <linux/bitfield.h>
++#include <linux/regmap.h>
+ #include <net/dsa.h>
+ #include <linux/of_net.h>
+ #include <linux/of_mdio.h>
+@@ -152,6 +153,25 @@ qca8k_set_page(struct mii_bus *bus, u16
+ static int
+ qca8k_read(struct qca8k_priv *priv, u32 reg, u32 *val)
+ {
++	return regmap_read(priv->regmap, reg, val);
++}
++
++static int
++qca8k_write(struct qca8k_priv *priv, u32 reg, u32 val)
++{
++	return regmap_write(priv->regmap, reg, val);
++}
++
++static int
++qca8k_rmw(struct qca8k_priv *priv, u32 reg, u32 mask, u32 write_val)
++{
++	return regmap_update_bits(priv->regmap, reg, mask, write_val);
++}
++
++static int
++qca8k_regmap_read(void *ctx, uint32_t reg, uint32_t *val)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ctx;
+ 	struct mii_bus *bus = priv->bus;
+ 	u16 r1, r2, page;
+ 	int ret;
+@@ -172,8 +192,9 @@ exit:
+ }
+ 
+ static int
+-qca8k_write(struct qca8k_priv *priv, u32 reg, u32 val)
++qca8k_regmap_write(void *ctx, uint32_t reg, uint32_t val)
+ {
++	struct qca8k_priv *priv = (struct qca8k_priv *)ctx;
+ 	struct mii_bus *bus = priv->bus;
+ 	u16 r1, r2, page;
+ 	int ret;
+@@ -194,8 +215,9 @@ exit:
+ }
+ 
+ static int
+-qca8k_rmw(struct qca8k_priv *priv, u32 reg, u32 mask, u32 write_val)
++qca8k_regmap_update_bits(void *ctx, uint32_t reg, uint32_t mask, uint32_t write_val)
+ {
++	struct qca8k_priv *priv = (struct qca8k_priv *)ctx;
+ 	struct mii_bus *bus = priv->bus;
+ 	u16 r1, r2, page;
+ 	u32 val;
+@@ -223,34 +245,6 @@ exit:
+ 	return ret;
+ }
+ 
+-static int
+-qca8k_reg_set(struct qca8k_priv *priv, u32 reg, u32 val)
+-{
+-	return qca8k_rmw(priv, reg, 0, val);
+-}
+-
+-static int
+-qca8k_reg_clear(struct qca8k_priv *priv, u32 reg, u32 val)
+-{
+-	return qca8k_rmw(priv, reg, val, 0);
+-}
+-
+-static int
+-qca8k_regmap_read(void *ctx, uint32_t reg, uint32_t *val)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ctx;
+-
+-	return qca8k_read(priv, reg, val);
+-}
+-
+-static int
+-qca8k_regmap_write(void *ctx, uint32_t reg, uint32_t val)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ctx;
+-
+-	return qca8k_write(priv, reg, val);
+-}
+-
+ static const struct regmap_range qca8k_readable_ranges[] = {
+ 	regmap_reg_range(0x0000, 0x00e4), /* Global control */
+ 	regmap_reg_range(0x0100, 0x0168), /* EEE control */
+@@ -282,26 +276,19 @@ static struct regmap_config qca8k_regmap
+ 	.max_register = 0x16ac, /* end MIB - Port6 range */
+ 	.reg_read = qca8k_regmap_read,
+ 	.reg_write = qca8k_regmap_write,
++	.reg_update_bits = qca8k_regmap_update_bits,
+ 	.rd_table = &qca8k_readable_table,
++	.disable_locking = true, /* Locking is handled by qca8k read/write */
++	.cache_type = REGCACHE_NONE, /* Explicitly disable CACHE */
+ };
+ 
+ static int
+ qca8k_busy_wait(struct qca8k_priv *priv, u32 reg, u32 mask)
+ {
+-	int ret, ret1;
+ 	u32 val;
+ 
+-	ret = read_poll_timeout(qca8k_read, ret1, !(val & mask),
+-				0, QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC, false,
+-				priv, reg, &val);
+-
+-	/* Check if qca8k_read has failed for a different reason
+-	 * before returning -ETIMEDOUT
+-	 */
+-	if (ret < 0 && ret1 < 0)
+-		return ret1;
+-
+-	return ret;
++	return regmap_read_poll_timeout(priv->regmap, reg, val, !(val & mask), 0,
++				       QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC);
+ }
+ 
+ static int
+@@ -568,7 +555,7 @@ qca8k_mib_init(struct qca8k_priv *priv)
+ 	int ret;
+ 
+ 	mutex_lock(&priv->reg_mutex);
+-	ret = qca8k_reg_set(priv, QCA8K_REG_MIB, QCA8K_MIB_FLUSH | QCA8K_MIB_BUSY);
++	ret = regmap_set_bits(priv->regmap, QCA8K_REG_MIB, QCA8K_MIB_FLUSH | QCA8K_MIB_BUSY);
+ 	if (ret)
+ 		goto exit;
+ 
+@@ -576,7 +563,7 @@ qca8k_mib_init(struct qca8k_priv *priv)
+ 	if (ret)
+ 		goto exit;
+ 
+-	ret = qca8k_reg_set(priv, QCA8K_REG_MIB, QCA8K_MIB_CPU_KEEP);
++	ret = regmap_set_bits(priv->regmap, QCA8K_REG_MIB, QCA8K_MIB_CPU_KEEP);
+ 	if (ret)
+ 		goto exit;
+ 
+@@ -597,9 +584,9 @@ qca8k_port_set_status(struct qca8k_priv
+ 		mask |= QCA8K_PORT_STATUS_LINK_AUTO;
+ 
+ 	if (enable)
+-		qca8k_reg_set(priv, QCA8K_REG_PORT_STATUS(port), mask);
++		regmap_set_bits(priv->regmap, QCA8K_REG_PORT_STATUS(port), mask);
+ 	else
+-		qca8k_reg_clear(priv, QCA8K_REG_PORT_STATUS(port), mask);
++		regmap_clear_bits(priv->regmap, QCA8K_REG_PORT_STATUS(port), mask);
+ }
+ 
+ static u32
+@@ -861,8 +848,8 @@ qca8k_setup_mdio_bus(struct qca8k_priv *
+ 		 * a dt-overlay and driver reload changed the configuration
+ 		 */
+ 
+-		return qca8k_reg_clear(priv, QCA8K_MDIO_MASTER_CTRL,
+-				       QCA8K_MDIO_MASTER_EN);
++		return regmap_clear_bits(priv->regmap, QCA8K_MDIO_MASTER_CTRL,
++					 QCA8K_MDIO_MASTER_EN);
+ 	}
+ 
+ 	/* Check if the devicetree declare the port:phy mapping */
+@@ -1099,16 +1086,16 @@ qca8k_setup(struct dsa_switch *ds)
+ 		return ret;
+ 
+ 	/* Make sure MAC06 is disabled */
+-	ret = qca8k_reg_clear(priv, QCA8K_REG_PORT0_PAD_CTRL,
+-			      QCA8K_PORT0_PAD_MAC06_EXCHANGE_EN);
++	ret = regmap_clear_bits(priv->regmap, QCA8K_REG_PORT0_PAD_CTRL,
++				QCA8K_PORT0_PAD_MAC06_EXCHANGE_EN);
+ 	if (ret) {
+ 		dev_err(priv->dev, "failed disabling MAC06 exchange");
+ 		return ret;
+ 	}
+ 
+ 	/* Enable CPU Port */
+-	ret = qca8k_reg_set(priv, QCA8K_REG_GLOBAL_FW_CTRL0,
+-			    QCA8K_GLOBAL_FW_CTRL0_CPU_PORT_EN);
++	ret = regmap_set_bits(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0,
++			      QCA8K_GLOBAL_FW_CTRL0_CPU_PORT_EN);
+ 	if (ret) {
+ 		dev_err(priv->dev, "failed enabling CPU port");
+ 		return ret;
+@@ -1176,8 +1163,8 @@ qca8k_setup(struct dsa_switch *ds)
+ 				return ret;
+ 
+ 			/* Enable ARP Auto-learning by default */
+-			ret = qca8k_reg_set(priv, QCA8K_PORT_LOOKUP_CTRL(i),
+-					    QCA8K_PORT_LOOKUP_LEARN);
++			ret = regmap_set_bits(priv->regmap, QCA8K_PORT_LOOKUP_CTRL(i),
++					      QCA8K_PORT_LOOKUP_LEARN);
+ 			if (ret)
+ 				return ret;
+ 
+@@ -1745,9 +1732,9 @@ qca8k_port_bridge_join(struct dsa_switch
+ 		/* Add this port to the portvlan mask of the other ports
+ 		 * in the bridge
+ 		 */
+-		ret = qca8k_reg_set(priv,
+-				    QCA8K_PORT_LOOKUP_CTRL(i),
+-				    BIT(port));
++		ret = regmap_set_bits(priv->regmap,
++				      QCA8K_PORT_LOOKUP_CTRL(i),
++				      BIT(port));
+ 		if (ret)
+ 			return ret;
+ 		if (i != port)
+@@ -1777,9 +1764,9 @@ qca8k_port_bridge_leave(struct dsa_switc
+ 		/* Remove this port to the portvlan mask of the other ports
+ 		 * in the bridge
+ 		 */
+-		qca8k_reg_clear(priv,
+-				QCA8K_PORT_LOOKUP_CTRL(i),
+-				BIT(port));
++		regmap_clear_bits(priv->regmap,
++				  QCA8K_PORT_LOOKUP_CTRL(i),
++				  BIT(port));
+ 	}
+ 
+ 	/* Set the cpu port to be the only one in the portvlan mask of
diff --git a/target/linux/generic/backport-5.15/758-v5.17-net-next-net-dsa-qca8k-add-additional-MIB-counter-and-.patch b/target/linux/generic/backport-5.15/758-v5.17-net-next-net-dsa-qca8k-add-additional-MIB-counter-and-.patch
new file mode 100644
index 00000000000000..c8c050933b687b
--- /dev/null
+++ b/target/linux/generic/backport-5.15/758-v5.17-net-next-net-dsa-qca8k-add-additional-MIB-counter-and-.patch
@@ -0,0 +1,120 @@
+From c126f118b330ccf0db0dda4a4bd6c729865a205f Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Mon, 22 Nov 2021 16:23:45 +0100
+Subject: net: dsa: qca8k: add additional MIB counter and make it dynamic
+
+We are currently missing 2 additionals MIB counter present in QCA833x
+switch.
+QC832x switch have 39 MIB counter and QCA833X have 41 MIB counter.
+Add the additional MIB counter and rework the MIB function to print the
+correct supported counter from the match_data struct.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 23 ++++++++++++++++++++---
+ drivers/net/dsa/qca8k.h |  4 ++++
+ 2 files changed, 24 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -70,6 +70,8 @@ static const struct qca8k_mib_desc ar832
+ 	MIB_DESC(1, 0x9c, "TxExcDefer"),
+ 	MIB_DESC(1, 0xa0, "TxDefer"),
+ 	MIB_DESC(1, 0xa4, "TxLateCol"),
++	MIB_DESC(1, 0xa8, "RXUnicast"),
++	MIB_DESC(1, 0xac, "TXUnicast"),
+ };
+ 
+ /* The 32bit switch registers are accessed indirectly. To achieve this we need
+@@ -1605,12 +1607,16 @@ qca8k_phylink_mac_link_up(struct dsa_swi
+ static void
+ qca8k_get_strings(struct dsa_switch *ds, int port, u32 stringset, uint8_t *data)
+ {
++	const struct qca8k_match_data *match_data;
++	struct qca8k_priv *priv = ds->priv;
+ 	int i;
+ 
+ 	if (stringset != ETH_SS_STATS)
+ 		return;
+ 
+-	for (i = 0; i < ARRAY_SIZE(ar8327_mib); i++)
++	match_data = of_device_get_match_data(priv->dev);
++
++	for (i = 0; i < match_data->mib_count; i++)
+ 		strncpy(data + i * ETH_GSTRING_LEN, ar8327_mib[i].name,
+ 			ETH_GSTRING_LEN);
+ }
+@@ -1620,12 +1626,15 @@ qca8k_get_ethtool_stats(struct dsa_switc
+ 			uint64_t *data)
+ {
+ 	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	const struct qca8k_match_data *match_data;
+ 	const struct qca8k_mib_desc *mib;
+ 	u32 reg, i, val;
+ 	u32 hi = 0;
+ 	int ret;
+ 
+-	for (i = 0; i < ARRAY_SIZE(ar8327_mib); i++) {
++	match_data = of_device_get_match_data(priv->dev);
++
++	for (i = 0; i < match_data->mib_count; i++) {
+ 		mib = &ar8327_mib[i];
+ 		reg = QCA8K_PORT_MIB_COUNTER(port) + mib->offset;
+ 
+@@ -1648,10 +1657,15 @@ qca8k_get_ethtool_stats(struct dsa_switc
+ static int
+ qca8k_get_sset_count(struct dsa_switch *ds, int port, int sset)
+ {
++	const struct qca8k_match_data *match_data;
++	struct qca8k_priv *priv = ds->priv;
++
+ 	if (sset != ETH_SS_STATS)
+ 		return 0;
+ 
+-	return ARRAY_SIZE(ar8327_mib);
++	match_data = of_device_get_match_data(priv->dev);
++
++	return match_data->mib_count;
+ }
+ 
+ static int
+@@ -2173,14 +2187,17 @@ static SIMPLE_DEV_PM_OPS(qca8k_pm_ops,
+ static const struct qca8k_match_data qca8327 = {
+ 	.id = QCA8K_ID_QCA8327,
+ 	.reduced_package = true,
++	.mib_count = QCA8K_QCA832X_MIB_COUNT,
+ };
+ 
+ static const struct qca8k_match_data qca8328 = {
+ 	.id = QCA8K_ID_QCA8327,
++	.mib_count = QCA8K_QCA832X_MIB_COUNT,
+ };
+ 
+ static const struct qca8k_match_data qca833x = {
+ 	.id = QCA8K_ID_QCA8337,
++	.mib_count = QCA8K_QCA833X_MIB_COUNT,
+ };
+ 
+ static const struct of_device_id qca8k_of_match[] = {
+--- a/drivers/net/dsa/qca8k.h
++++ b/drivers/net/dsa/qca8k.h
+@@ -21,6 +21,9 @@
+ #define PHY_ID_QCA8337					0x004dd036
+ #define QCA8K_ID_QCA8337				0x13
+ 
++#define QCA8K_QCA832X_MIB_COUNT				39
++#define QCA8K_QCA833X_MIB_COUNT				41
++
+ #define QCA8K_BUSY_WAIT_TIMEOUT				2000
+ 
+ #define QCA8K_NUM_FDB_RECORDS				2048
+@@ -279,6 +282,7 @@ struct ar8xxx_port_status {
+ struct qca8k_match_data {
+ 	u8 id;
+ 	bool reduced_package;
++	u8 mib_count;
+ };
+ 
+ enum {
diff --git a/target/linux/generic/backport-5.15/759-v5.17-net-next-net-dsa-qca8k-add-support-for-port-fast-aging.patch b/target/linux/generic/backport-5.15/759-v5.17-net-next-net-dsa-qca8k-add-support-for-port-fast-aging.patch
new file mode 100644
index 00000000000000..8ad7ab472d4f9a
--- /dev/null
+++ b/target/linux/generic/backport-5.15/759-v5.17-net-next-net-dsa-qca8k-add-support-for-port-fast-aging.patch
@@ -0,0 +1,53 @@
+From 4592538bfb0d5d3c3c8a1d7071724d081412ac91 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Mon, 22 Nov 2021 16:23:46 +0100
+Subject: net: dsa: qca8k: add support for port fast aging
+
+The switch supports fast aging by flushing any rule in the ARL
+table for a specific port.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 11 +++++++++++
+ drivers/net/dsa/qca8k.h |  1 +
+ 2 files changed, 12 insertions(+)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -1790,6 +1790,16 @@ qca8k_port_bridge_leave(struct dsa_switc
+ 		  QCA8K_PORT_LOOKUP_MEMBER, BIT(cpu_port));
+ }
+ 
++static void
++qca8k_port_fast_age(struct dsa_switch *ds, int port)
++{
++	struct qca8k_priv *priv = ds->priv;
++
++	mutex_lock(&priv->reg_mutex);
++	qca8k_fdb_access(priv, QCA8K_FDB_FLUSH_PORT, port);
++	mutex_unlock(&priv->reg_mutex);
++}
++
+ static int
+ qca8k_port_enable(struct dsa_switch *ds, int port,
+ 		  struct phy_device *phy)
+@@ -2017,6 +2027,7 @@ static const struct dsa_switch_ops qca8k
+ 	.port_stp_state_set	= qca8k_port_stp_state_set,
+ 	.port_bridge_join	= qca8k_port_bridge_join,
+ 	.port_bridge_leave	= qca8k_port_bridge_leave,
++	.port_fast_age		= qca8k_port_fast_age,
+ 	.port_fdb_add		= qca8k_port_fdb_add,
+ 	.port_fdb_del		= qca8k_port_fdb_del,
+ 	.port_fdb_dump		= qca8k_port_fdb_dump,
+--- a/drivers/net/dsa/qca8k.h
++++ b/drivers/net/dsa/qca8k.h
+@@ -262,6 +262,7 @@ enum qca8k_fdb_cmd {
+ 	QCA8K_FDB_FLUSH	= 1,
+ 	QCA8K_FDB_LOAD = 2,
+ 	QCA8K_FDB_PURGE = 3,
++	QCA8K_FDB_FLUSH_PORT = 5,
+ 	QCA8K_FDB_NEXT = 6,
+ 	QCA8K_FDB_SEARCH = 7,
+ };
diff --git a/target/linux/generic/backport-5.15/760-v5.17-net-next-net-dsa-qca8k-add-set_ageing_time-support.patch b/target/linux/generic/backport-5.15/760-v5.17-net-next-net-dsa-qca8k-add-set_ageing_time-support.patch
new file mode 100644
index 00000000000000..659e482405a55a
--- /dev/null
+++ b/target/linux/generic/backport-5.15/760-v5.17-net-next-net-dsa-qca8k-add-set_ageing_time-support.patch
@@ -0,0 +1,78 @@
+From 6a3bdc5209f45d2af83aa92433ab6e5cf2297aa4 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Mon, 22 Nov 2021 16:23:47 +0100
+Subject: net: dsa: qca8k: add set_ageing_time support
+
+qca8k support setting ageing time in step of 7s. Add support for it and
+set the max value accepted of 7645m.
+Documentation talks about support for 10000m but that values doesn't
+make sense as the value doesn't match the max value in the reg.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 25 +++++++++++++++++++++++++
+ drivers/net/dsa/qca8k.h |  3 +++
+ 2 files changed, 28 insertions(+)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -1261,6 +1261,10 @@ qca8k_setup(struct dsa_switch *ds)
+ 	/* We don't have interrupts for link changes, so we need to poll */
+ 	ds->pcs_poll = true;
+ 
++	/* Set min a max ageing value supported */
++	ds->ageing_time_min = 7000;
++	ds->ageing_time_max = 458745000;
++
+ 	return 0;
+ }
+ 
+@@ -1801,6 +1805,26 @@ qca8k_port_fast_age(struct dsa_switch *d
+ }
+ 
+ static int
++qca8k_set_ageing_time(struct dsa_switch *ds, unsigned int msecs)
++{
++	struct qca8k_priv *priv = ds->priv;
++	unsigned int secs = msecs / 1000;
++	u32 val;
++
++	/* AGE_TIME reg is set in 7s step */
++	val = secs / 7;
++
++	/* Handle case with 0 as val to NOT disable
++	 * learning
++	 */
++	if (!val)
++		val = 1;
++
++	return regmap_update_bits(priv->regmap, QCA8K_REG_ATU_CTRL, QCA8K_ATU_AGE_TIME_MASK,
++				  QCA8K_ATU_AGE_TIME(val));
++}
++
++static int
+ qca8k_port_enable(struct dsa_switch *ds, int port,
+ 		  struct phy_device *phy)
+ {
+@@ -2018,6 +2042,7 @@ static const struct dsa_switch_ops qca8k
+ 	.get_strings		= qca8k_get_strings,
+ 	.get_ethtool_stats	= qca8k_get_ethtool_stats,
+ 	.get_sset_count		= qca8k_get_sset_count,
++	.set_ageing_time	= qca8k_set_ageing_time,
+ 	.get_mac_eee		= qca8k_get_mac_eee,
+ 	.set_mac_eee		= qca8k_set_mac_eee,
+ 	.port_enable		= qca8k_port_enable,
+--- a/drivers/net/dsa/qca8k.h
++++ b/drivers/net/dsa/qca8k.h
+@@ -175,6 +175,9 @@
+ #define   QCA8K_VTU_FUNC1_BUSY				BIT(31)
+ #define   QCA8K_VTU_FUNC1_VID_MASK			GENMASK(27, 16)
+ #define   QCA8K_VTU_FUNC1_FULL				BIT(4)
++#define QCA8K_REG_ATU_CTRL				0x618
++#define   QCA8K_ATU_AGE_TIME_MASK			GENMASK(15, 0)
++#define   QCA8K_ATU_AGE_TIME(x)				FIELD_PREP(QCA8K_ATU_AGE_TIME_MASK, (x))
+ #define QCA8K_REG_GLOBAL_FW_CTRL0			0x620
+ #define   QCA8K_GLOBAL_FW_CTRL0_CPU_PORT_EN		BIT(10)
+ #define QCA8K_REG_GLOBAL_FW_CTRL1			0x624
diff --git a/target/linux/generic/backport-5.15/761-v5.17-net-next-net-dsa-qca8k-add-support-for-mdb_add-del.patch b/target/linux/generic/backport-5.15/761-v5.17-net-next-net-dsa-qca8k-add-support-for-mdb_add-del.patch
new file mode 100644
index 00000000000000..8b97939ecb290f
--- /dev/null
+++ b/target/linux/generic/backport-5.15/761-v5.17-net-next-net-dsa-qca8k-add-support-for-mdb_add-del.patch
@@ -0,0 +1,142 @@
+From ba8f870dfa635113ce6e8095a5eb1835ecde2e9e Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Mon, 22 Nov 2021 16:23:48 +0100
+Subject: net: dsa: qca8k: add support for mdb_add/del
+
+Add support for mdb add/del function. The ARL table is used to insert
+the rule. The rule will be searched, deleted and reinserted with the
+port mask updated. The function will check if the rule has to be updated
+or insert directly with no deletion of the old rule.
+If every port is removed from the port mask, the rule is removed.
+The rule is set STATIC in the ARL table (aka it doesn't age) to not be
+flushed by fast age function.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 99 +++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 99 insertions(+)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -436,6 +436,81 @@ qca8k_fdb_flush(struct qca8k_priv *priv)
+ }
+ 
+ static int
++qca8k_fdb_search_and_insert(struct qca8k_priv *priv, u8 port_mask,
++			    const u8 *mac, u16 vid)
++{
++	struct qca8k_fdb fdb = { 0 };
++	int ret;
++
++	mutex_lock(&priv->reg_mutex);
++
++	qca8k_fdb_write(priv, vid, 0, mac, 0);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_SEARCH, -1);
++	if (ret < 0)
++		goto exit;
++
++	ret = qca8k_fdb_read(priv, &fdb);
++	if (ret < 0)
++		goto exit;
++
++	/* Rule exist. Delete first */
++	if (!fdb.aging) {
++		ret = qca8k_fdb_access(priv, QCA8K_FDB_PURGE, -1);
++		if (ret)
++			goto exit;
++	}
++
++	/* Add port to fdb portmask */
++	fdb.port_mask |= port_mask;
++
++	qca8k_fdb_write(priv, vid, fdb.port_mask, mac, fdb.aging);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_LOAD, -1);
++
++exit:
++	mutex_unlock(&priv->reg_mutex);
++	return ret;
++}
++
++static int
++qca8k_fdb_search_and_del(struct qca8k_priv *priv, u8 port_mask,
++			 const u8 *mac, u16 vid)
++{
++	struct qca8k_fdb fdb = { 0 };
++	int ret;
++
++	mutex_lock(&priv->reg_mutex);
++
++	qca8k_fdb_write(priv, vid, 0, mac, 0);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_SEARCH, -1);
++	if (ret < 0)
++		goto exit;
++
++	/* Rule doesn't exist. Why delete? */
++	if (!fdb.aging) {
++		ret = -EINVAL;
++		goto exit;
++	}
++
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_PURGE, -1);
++	if (ret)
++		goto exit;
++
++	/* Only port in the rule is this port. Don't re insert */
++	if (fdb.port_mask == port_mask)
++		goto exit;
++
++	/* Remove port from port mask */
++	fdb.port_mask &= ~port_mask;
++
++	qca8k_fdb_write(priv, vid, fdb.port_mask, mac, fdb.aging);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_LOAD, -1);
++
++exit:
++	mutex_unlock(&priv->reg_mutex);
++	return ret;
++}
++
++static int
+ qca8k_vlan_access(struct qca8k_priv *priv, enum qca8k_vlan_cmd cmd, u16 vid)
+ {
+ 	u32 reg;
+@@ -1949,6 +2024,28 @@ qca8k_port_fdb_dump(struct dsa_switch *d
+ }
+ 
+ static int
++qca8k_port_mdb_add(struct dsa_switch *ds, int port,
++		   const struct switchdev_obj_port_mdb *mdb)
++{
++	struct qca8k_priv *priv = ds->priv;
++	const u8 *addr = mdb->addr;
++	u16 vid = mdb->vid;
++
++	return qca8k_fdb_search_and_insert(priv, BIT(port), addr, vid);
++}
++
++static int
++qca8k_port_mdb_del(struct dsa_switch *ds, int port,
++		   const struct switchdev_obj_port_mdb *mdb)
++{
++	struct qca8k_priv *priv = ds->priv;
++	const u8 *addr = mdb->addr;
++	u16 vid = mdb->vid;
++
++	return qca8k_fdb_search_and_del(priv, BIT(port), addr, vid);
++}
++
++static int
+ qca8k_port_vlan_filtering(struct dsa_switch *ds, int port, bool vlan_filtering,
+ 			  struct netlink_ext_ack *extack)
+ {
+@@ -2056,6 +2153,8 @@ static const struct dsa_switch_ops qca8k
+ 	.port_fdb_add		= qca8k_port_fdb_add,
+ 	.port_fdb_del		= qca8k_port_fdb_del,
+ 	.port_fdb_dump		= qca8k_port_fdb_dump,
++	.port_mdb_add		= qca8k_port_mdb_add,
++	.port_mdb_del		= qca8k_port_mdb_del,
+ 	.port_vlan_filtering	= qca8k_port_vlan_filtering,
+ 	.port_vlan_add		= qca8k_port_vlan_add,
+ 	.port_vlan_del		= qca8k_port_vlan_del,
diff --git a/target/linux/generic/backport-5.15/762-v5.17-net-next-net-dsa-qca8k-add-support-for-mirror-mode.patch b/target/linux/generic/backport-5.15/762-v5.17-net-next-net-dsa-qca8k-add-support-for-mirror-mode.patch
new file mode 100644
index 00000000000000..dc5a22935f1da5
--- /dev/null
+++ b/target/linux/generic/backport-5.15/762-v5.17-net-next-net-dsa-qca8k-add-support-for-mirror-mode.patch
@@ -0,0 +1,155 @@
+From 2c1bdbc7e7560d7de754cad277d968d56bb1899e Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Tue, 23 Nov 2021 03:59:10 +0100
+Subject: net: dsa: qca8k: add support for mirror mode
+
+The switch supports mirror mode. Only one port can set as mirror port and
+every other port can set to both ingress and egress mode. The mirror
+port is disabled and reverted to normal operation once every port is
+removed from sending packet to it.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 95 +++++++++++++++++++++++++++++++++++++++++++++++++
+ drivers/net/dsa/qca8k.h |  4 +++
+ 2 files changed, 99 insertions(+)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -2046,6 +2046,99 @@ qca8k_port_mdb_del(struct dsa_switch *ds
+ }
+ 
+ static int
++qca8k_port_mirror_add(struct dsa_switch *ds, int port,
++		      struct dsa_mall_mirror_tc_entry *mirror,
++		      bool ingress)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int monitor_port, ret;
++	u32 reg, val;
++
++	/* Check for existent entry */
++	if ((ingress ? priv->mirror_rx : priv->mirror_tx) & BIT(port))
++		return -EEXIST;
++
++	ret = regmap_read(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0, &val);
++	if (ret)
++		return ret;
++
++	/* QCA83xx can have only one port set to mirror mode.
++	 * Check that the correct port is requested and return error otherwise.
++	 * When no mirror port is set, the values is set to 0xF
++	 */
++	monitor_port = FIELD_GET(QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, val);
++	if (monitor_port != 0xF && monitor_port != mirror->to_local_port)
++		return -EEXIST;
++
++	/* Set the monitor port */
++	val = FIELD_PREP(QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM,
++			 mirror->to_local_port);
++	ret = regmap_update_bits(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0,
++				 QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, val);
++	if (ret)
++		return ret;
++
++	if (ingress) {
++		reg = QCA8K_PORT_LOOKUP_CTRL(port);
++		val = QCA8K_PORT_LOOKUP_ING_MIRROR_EN;
++	} else {
++		reg = QCA8K_REG_PORT_HOL_CTRL1(port);
++		val = QCA8K_PORT_HOL_CTRL1_EG_MIRROR_EN;
++	}
++
++	ret = regmap_update_bits(priv->regmap, reg, val, val);
++	if (ret)
++		return ret;
++
++	/* Track mirror port for tx and rx to decide when the
++	 * mirror port has to be disabled.
++	 */
++	if (ingress)
++		priv->mirror_rx |= BIT(port);
++	else
++		priv->mirror_tx |= BIT(port);
++
++	return 0;
++}
++
++static void
++qca8k_port_mirror_del(struct dsa_switch *ds, int port,
++		      struct dsa_mall_mirror_tc_entry *mirror)
++{
++	struct qca8k_priv *priv = ds->priv;
++	u32 reg, val;
++	int ret;
++
++	if (mirror->ingress) {
++		reg = QCA8K_PORT_LOOKUP_CTRL(port);
++		val = QCA8K_PORT_LOOKUP_ING_MIRROR_EN;
++	} else {
++		reg = QCA8K_REG_PORT_HOL_CTRL1(port);
++		val = QCA8K_PORT_HOL_CTRL1_EG_MIRROR_EN;
++	}
++
++	ret = regmap_clear_bits(priv->regmap, reg, val);
++	if (ret)
++		goto err;
++
++	if (mirror->ingress)
++		priv->mirror_rx &= ~BIT(port);
++	else
++		priv->mirror_tx &= ~BIT(port);
++
++	/* No port set to send packet to mirror port. Disable mirror port */
++	if (!priv->mirror_rx && !priv->mirror_tx) {
++		val = FIELD_PREP(QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, 0xF);
++		ret = regmap_update_bits(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0,
++					 QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, val);
++		if (ret)
++			goto err;
++	}
++err:
++	dev_err(priv->dev, "Failed to del mirror port from %d", port);
++}
++
++static int
+ qca8k_port_vlan_filtering(struct dsa_switch *ds, int port, bool vlan_filtering,
+ 			  struct netlink_ext_ack *extack)
+ {
+@@ -2155,6 +2248,8 @@ static const struct dsa_switch_ops qca8k
+ 	.port_fdb_dump		= qca8k_port_fdb_dump,
+ 	.port_mdb_add		= qca8k_port_mdb_add,
+ 	.port_mdb_del		= qca8k_port_mdb_del,
++	.port_mirror_add	= qca8k_port_mirror_add,
++	.port_mirror_del	= qca8k_port_mirror_del,
+ 	.port_vlan_filtering	= qca8k_port_vlan_filtering,
+ 	.port_vlan_add		= qca8k_port_vlan_add,
+ 	.port_vlan_del		= qca8k_port_vlan_del,
+--- a/drivers/net/dsa/qca8k.h
++++ b/drivers/net/dsa/qca8k.h
+@@ -180,6 +180,7 @@
+ #define   QCA8K_ATU_AGE_TIME(x)				FIELD_PREP(QCA8K_ATU_AGE_TIME_MASK, (x))
+ #define QCA8K_REG_GLOBAL_FW_CTRL0			0x620
+ #define   QCA8K_GLOBAL_FW_CTRL0_CPU_PORT_EN		BIT(10)
++#define   QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM		GENMASK(7, 4)
+ #define QCA8K_REG_GLOBAL_FW_CTRL1			0x624
+ #define   QCA8K_GLOBAL_FW_CTRL1_IGMP_DP_MASK		GENMASK(30, 24)
+ #define   QCA8K_GLOBAL_FW_CTRL1_BC_DP_MASK		GENMASK(22, 16)
+@@ -201,6 +202,7 @@
+ #define   QCA8K_PORT_LOOKUP_STATE_LEARNING		QCA8K_PORT_LOOKUP_STATE(0x3)
+ #define   QCA8K_PORT_LOOKUP_STATE_FORWARD		QCA8K_PORT_LOOKUP_STATE(0x4)
+ #define   QCA8K_PORT_LOOKUP_LEARN			BIT(20)
++#define   QCA8K_PORT_LOOKUP_ING_MIRROR_EN		BIT(25)
+ 
+ #define QCA8K_REG_GLOBAL_FC_THRESH			0x800
+ #define   QCA8K_GLOBAL_FC_GOL_XON_THRES_MASK		GENMASK(24, 16)
+@@ -305,6 +307,8 @@ struct qca8k_ports_config {
+ struct qca8k_priv {
+ 	u8 switch_id;
+ 	u8 switch_revision;
++	u8 mirror_rx;
++	u8 mirror_tx;
+ 	bool legacy_phy_port_mapping;
+ 	struct qca8k_ports_config ports_config;
+ 	struct regmap *regmap;
diff --git a/target/linux/generic/backport-5.15/763-v5.17-net-next-net-dsa-qca8k-add-LAG-support.patch b/target/linux/generic/backport-5.15/763-v5.17-net-next-net-dsa-qca8k-add-LAG-support.patch
new file mode 100644
index 00000000000000..b53f1288d5a0ec
--- /dev/null
+++ b/target/linux/generic/backport-5.15/763-v5.17-net-next-net-dsa-qca8k-add-LAG-support.patch
@@ -0,0 +1,288 @@
+From def975307c01191b6f0170048c3724b0ed3348af Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Tue, 23 Nov 2021 03:59:11 +0100
+Subject: net: dsa: qca8k: add LAG support
+
+Add LAG support to this switch. In Documentation this is described as
+trunk mode. A max of 4 LAGs are supported and each can support up to 4
+port. The current tx mode supported is Hash mode with both L2 and L2+3
+mode.
+When no port are present in the trunk, the trunk is disabled in the
+switch.
+When a port is disconnected, the traffic is redirected to the other
+available port.
+The hash mode is global and each LAG require to have the same hash mode
+set. To change the hash mode when multiple LAG are configured, it's
+required to remove each LAG and set the desired hash mode to the last.
+An error is printed when it's asked to set a not supported hadh mode.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 177 ++++++++++++++++++++++++++++++++++++++++++++++++
+ drivers/net/dsa/qca8k.h |  33 +++++++++
+ 2 files changed, 210 insertions(+)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -1340,6 +1340,9 @@ qca8k_setup(struct dsa_switch *ds)
+ 	ds->ageing_time_min = 7000;
+ 	ds->ageing_time_max = 458745000;
+ 
++	/* Set max number of LAGs supported */
++	ds->num_lag_ids = QCA8K_NUM_LAGS;
++
+ 	return 0;
+ }
+ 
+@@ -2226,6 +2229,178 @@ qca8k_get_tag_protocol(struct dsa_switch
+ 	return DSA_TAG_PROTO_QCA;
+ }
+ 
++static bool
++qca8k_lag_can_offload(struct dsa_switch *ds,
++		      struct net_device *lag,
++		      struct netdev_lag_upper_info *info)
++{
++	struct dsa_port *dp;
++	int id, members = 0;
++
++	id = dsa_lag_id(ds->dst, lag);
++	if (id < 0 || id >= ds->num_lag_ids)
++		return false;
++
++	dsa_lag_foreach_port(dp, ds->dst, lag)
++		/* Includes the port joining the LAG */
++		members++;
++
++	if (members > QCA8K_NUM_PORTS_FOR_LAG)
++		return false;
++
++	if (info->tx_type != NETDEV_LAG_TX_TYPE_HASH)
++		return false;
++
++	if (info->hash_type != NETDEV_LAG_HASH_L2 ||
++	    info->hash_type != NETDEV_LAG_HASH_L23)
++		return false;
++
++	return true;
++}
++
++static int
++qca8k_lag_setup_hash(struct dsa_switch *ds,
++		     struct net_device *lag,
++		     struct netdev_lag_upper_info *info)
++{
++	struct qca8k_priv *priv = ds->priv;
++	bool unique_lag = true;
++	int i, id;
++	u32 hash;
++
++	id = dsa_lag_id(ds->dst, lag);
++
++	switch (info->hash_type) {
++	case NETDEV_LAG_HASH_L23:
++		hash |= QCA8K_TRUNK_HASH_SIP_EN;
++		hash |= QCA8K_TRUNK_HASH_DIP_EN;
++		fallthrough;
++	case NETDEV_LAG_HASH_L2:
++		hash |= QCA8K_TRUNK_HASH_SA_EN;
++		hash |= QCA8K_TRUNK_HASH_DA_EN;
++		break;
++	default: /* We should NEVER reach this */
++		return -EOPNOTSUPP;
++	}
++
++	/* Check if we are the unique configured LAG */
++	dsa_lags_foreach_id(i, ds->dst)
++		if (i != id && dsa_lag_dev(ds->dst, i)) {
++			unique_lag = false;
++			break;
++		}
++
++	/* Hash Mode is global. Make sure the same Hash Mode
++	 * is set to all the 4 possible lag.
++	 * If we are the unique LAG we can set whatever hash
++	 * mode we want.
++	 * To change hash mode it's needed to remove all LAG
++	 * and change the mode with the latest.
++	 */
++	if (unique_lag) {
++		priv->lag_hash_mode = hash;
++	} else if (priv->lag_hash_mode != hash) {
++		netdev_err(lag, "Error: Mismateched Hash Mode across different lag is not supported\n");
++		return -EOPNOTSUPP;
++	}
++
++	return regmap_update_bits(priv->regmap, QCA8K_TRUNK_HASH_EN_CTRL,
++				  QCA8K_TRUNK_HASH_MASK, hash);
++}
++
++static int
++qca8k_lag_refresh_portmap(struct dsa_switch *ds, int port,
++			  struct net_device *lag, bool delete)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int ret, id, i;
++	u32 val;
++
++	id = dsa_lag_id(ds->dst, lag);
++
++	/* Read current port member */
++	ret = regmap_read(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL0, &val);
++	if (ret)
++		return ret;
++
++	/* Shift val to the correct trunk */
++	val >>= QCA8K_REG_GOL_TRUNK_SHIFT(id);
++	val &= QCA8K_REG_GOL_TRUNK_MEMBER_MASK;
++	if (delete)
++		val &= ~BIT(port);
++	else
++		val |= BIT(port);
++
++	/* Update port member. With empty portmap disable trunk */
++	ret = regmap_update_bits(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL0,
++				 QCA8K_REG_GOL_TRUNK_MEMBER(id) |
++				 QCA8K_REG_GOL_TRUNK_EN(id),
++				 !val << QCA8K_REG_GOL_TRUNK_SHIFT(id) |
++				 val << QCA8K_REG_GOL_TRUNK_SHIFT(id));
++
++	/* Search empty member if adding or port on deleting */
++	for (i = 0; i < QCA8K_NUM_PORTS_FOR_LAG; i++) {
++		ret = regmap_read(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL(id), &val);
++		if (ret)
++			return ret;
++
++		val >>= QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(id, i);
++		val &= QCA8K_REG_GOL_TRUNK_ID_MEM_ID_MASK;
++
++		if (delete) {
++			/* If port flagged to be disabled assume this member is
++			 * empty
++			 */
++			if (val != QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN_MASK)
++				continue;
++
++			val &= QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT_MASK;
++			if (val != port)
++				continue;
++		} else {
++			/* If port flagged to be enabled assume this member is
++			 * already set
++			 */
++			if (val == QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN_MASK)
++				continue;
++		}
++
++		/* We have found the member to add/remove */
++		break;
++	}
++
++	/* Set port in the correct port mask or disable port if in delete mode */
++	return regmap_update_bits(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL(id),
++				  QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN(id, i) |
++				  QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT(id, i),
++				  !delete << QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(id, i) |
++				  port << QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(id, i));
++}
++
++static int
++qca8k_port_lag_join(struct dsa_switch *ds, int port,
++		    struct net_device *lag,
++		    struct netdev_lag_upper_info *info)
++{
++	int ret;
++
++	if (!qca8k_lag_can_offload(ds, lag, info))
++		return -EOPNOTSUPP;
++
++	ret = qca8k_lag_setup_hash(ds, lag, info);
++	if (ret)
++		return ret;
++
++	return qca8k_lag_refresh_portmap(ds, port, lag, false);
++}
++
++static int
++qca8k_port_lag_leave(struct dsa_switch *ds, int port,
++		     struct net_device *lag)
++{
++	return qca8k_lag_refresh_portmap(ds, port, lag, true);
++}
++
+ static const struct dsa_switch_ops qca8k_switch_ops = {
+ 	.get_tag_protocol	= qca8k_get_tag_protocol,
+ 	.setup			= qca8k_setup,
+@@ -2259,6 +2434,8 @@ static const struct dsa_switch_ops qca8k
+ 	.phylink_mac_link_down	= qca8k_phylink_mac_link_down,
+ 	.phylink_mac_link_up	= qca8k_phylink_mac_link_up,
+ 	.get_phy_flags		= qca8k_get_phy_flags,
++	.port_lag_join		= qca8k_port_lag_join,
++	.port_lag_leave		= qca8k_port_lag_leave,
+ };
+ 
+ static int qca8k_read_switch_id(struct qca8k_priv *priv)
+--- a/drivers/net/dsa/qca8k.h
++++ b/drivers/net/dsa/qca8k.h
+@@ -15,6 +15,8 @@
+ #define QCA8K_NUM_PORTS					7
+ #define QCA8K_NUM_CPU_PORTS				2
+ #define QCA8K_MAX_MTU					9000
++#define QCA8K_NUM_LAGS					4
++#define QCA8K_NUM_PORTS_FOR_LAG				4
+ 
+ #define PHY_ID_QCA8327					0x004dd034
+ #define QCA8K_ID_QCA8327				0x12
+@@ -122,6 +124,14 @@
+ #define QCA8K_REG_EEE_CTRL				0x100
+ #define  QCA8K_REG_EEE_CTRL_LPI_EN(_i)			((_i + 1) * 2)
+ 
++/* TRUNK_HASH_EN registers */
++#define QCA8K_TRUNK_HASH_EN_CTRL			0x270
++#define   QCA8K_TRUNK_HASH_SIP_EN			BIT(3)
++#define   QCA8K_TRUNK_HASH_DIP_EN			BIT(2)
++#define   QCA8K_TRUNK_HASH_SA_EN			BIT(1)
++#define   QCA8K_TRUNK_HASH_DA_EN			BIT(0)
++#define   QCA8K_TRUNK_HASH_MASK				GENMASK(3, 0)
++
+ /* ACL registers */
+ #define QCA8K_REG_PORT_VLAN_CTRL0(_i)			(0x420 + (_i * 8))
+ #define   QCA8K_PORT_VLAN_CVID_MASK			GENMASK(27, 16)
+@@ -204,6 +214,28 @@
+ #define   QCA8K_PORT_LOOKUP_LEARN			BIT(20)
+ #define   QCA8K_PORT_LOOKUP_ING_MIRROR_EN		BIT(25)
+ 
++#define QCA8K_REG_GOL_TRUNK_CTRL0			0x700
++/* 4 max trunk first
++ * first 6 bit for member bitmap
++ * 7th bit is to enable trunk port
++ */
++#define QCA8K_REG_GOL_TRUNK_SHIFT(_i)			((_i) * 8)
++#define QCA8K_REG_GOL_TRUNK_EN_MASK			BIT(7)
++#define QCA8K_REG_GOL_TRUNK_EN(_i)			(QCA8K_REG_GOL_TRUNK_EN_MASK << QCA8K_REG_GOL_TRUNK_SHIFT(_i))
++#define QCA8K_REG_GOL_TRUNK_MEMBER_MASK			GENMASK(6, 0)
++#define QCA8K_REG_GOL_TRUNK_MEMBER(_i)			(QCA8K_REG_GOL_TRUNK_MEMBER_MASK << QCA8K_REG_GOL_TRUNK_SHIFT(_i))
++/* 0x704 for TRUNK 0-1 --- 0x708 for TRUNK 2-3 */
++#define QCA8K_REG_GOL_TRUNK_CTRL(_i)			(0x704 + (((_i) / 2) * 4))
++#define QCA8K_REG_GOL_TRUNK_ID_MEM_ID_MASK		GENMASK(3, 0)
++#define QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN_MASK		BIT(3)
++#define QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT_MASK		GENMASK(2, 0)
++#define QCA8K_REG_GOL_TRUNK_ID_SHIFT(_i)		(((_i) / 2) * 16)
++#define QCA8K_REG_GOL_MEM_ID_SHIFT(_i)			((_i) * 4)
++/* Complex shift: FIRST shift for port THEN shift for trunk */
++#define QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(_i, _j)	(QCA8K_REG_GOL_MEM_ID_SHIFT(_j) + QCA8K_REG_GOL_TRUNK_ID_SHIFT(_i))
++#define QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN(_i, _j)	(QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN_MASK << QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(_i, _j))
++#define QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT(_i, _j)	(QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT_MASK << QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(_i, _j))
++
+ #define QCA8K_REG_GLOBAL_FC_THRESH			0x800
+ #define   QCA8K_GLOBAL_FC_GOL_XON_THRES_MASK		GENMASK(24, 16)
+ #define   QCA8K_GLOBAL_FC_GOL_XON_THRES(x)		FIELD_PREP(QCA8K_GLOBAL_FC_GOL_XON_THRES_MASK, x)
+@@ -309,6 +341,7 @@ struct qca8k_priv {
+ 	u8 switch_revision;
+ 	u8 mirror_rx;
+ 	u8 mirror_tx;
++	u8 lag_hash_mode;
+ 	bool legacy_phy_port_mapping;
+ 	struct qca8k_ports_config ports_config;
+ 	struct regmap *regmap;
diff --git a/target/linux/generic/backport-5.15/764-v5.17-net-next-net-dsa-qca8k-fix-warning-in-LAG-feature.patch b/target/linux/generic/backport-5.15/764-v5.17-net-next-net-dsa-qca8k-fix-warning-in-LAG-feature.patch
new file mode 100644
index 00000000000000..7d811be11ce9c4
--- /dev/null
+++ b/target/linux/generic/backport-5.15/764-v5.17-net-next-net-dsa-qca8k-fix-warning-in-LAG-feature.patch
@@ -0,0 +1,40 @@
+From 0898ca67b86e14207d4feb3f3fea8b87cec5aab1 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Tue, 23 Nov 2021 16:44:46 +0100
+Subject: net: dsa: qca8k: fix warning in LAG feature
+
+Fix warning reported by bot.
+Make sure hash is init to 0 and fix wrong logic for hash_type in
+qca8k_lag_can_offload.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Fixes: def975307c01 ("net: dsa: qca8k: add LAG support")
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20211123154446.31019-1-ansuelsmth@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/qca8k.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -2251,7 +2251,7 @@ qca8k_lag_can_offload(struct dsa_switch
+ 	if (info->tx_type != NETDEV_LAG_TX_TYPE_HASH)
+ 		return false;
+ 
+-	if (info->hash_type != NETDEV_LAG_HASH_L2 ||
++	if (info->hash_type != NETDEV_LAG_HASH_L2 &&
+ 	    info->hash_type != NETDEV_LAG_HASH_L23)
+ 		return false;
+ 
+@@ -2265,8 +2265,8 @@ qca8k_lag_setup_hash(struct dsa_switch *
+ {
+ 	struct qca8k_priv *priv = ds->priv;
+ 	bool unique_lag = true;
++	u32 hash = 0;
+ 	int i, id;
+-	u32 hash;
+ 
+ 	id = dsa_lag_id(ds->dst, lag);
+ 
diff --git a/target/linux/generic/backport-5.15/765-v5.17-01-net-next-net-dsa-reorder-PHY-initialization-with-MTU-setup-in.patch b/target/linux/generic/backport-5.15/765-v5.17-01-net-next-net-dsa-reorder-PHY-initialization-with-MTU-setup-in.patch
new file mode 100644
index 00000000000000..77cf63b809be20
--- /dev/null
+++ b/target/linux/generic/backport-5.15/765-v5.17-01-net-next-net-dsa-reorder-PHY-initialization-with-MTU-setup-in.patch
@@ -0,0 +1,52 @@
+From 904e112ad431492b34f235f59738e8312802bbf9 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Thu, 6 Jan 2022 01:11:12 +0200
+Subject: [PATCH 1/6] net: dsa: reorder PHY initialization with MTU setup in
+ slave.c
+
+In dsa_slave_create() there are 2 sections that take rtnl_lock():
+MTU change and netdev registration. They are separated by PHY
+initialization.
+
+There isn't any strict ordering requirement except for the fact that
+netdev registration should be last. Therefore, we can perform the MTU
+change a bit later, after the PHY setup. A future change will then be
+able to merge the two rtnl_lock sections into one.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/dsa/slave.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/net/dsa/slave.c
++++ b/net/dsa/slave.c
+@@ -1977,13 +1977,6 @@ int dsa_slave_create(struct dsa_port *po
+ 	port->slave = slave_dev;
+ 	dsa_slave_setup_tagger(slave_dev);
+ 
+-	rtnl_lock();
+-	ret = dsa_slave_change_mtu(slave_dev, ETH_DATA_LEN);
+-	rtnl_unlock();
+-	if (ret && ret != -EOPNOTSUPP)
+-		dev_warn(ds->dev, "nonfatal error %d setting MTU to %d on port %d\n",
+-			 ret, ETH_DATA_LEN, port->index);
+-
+ 	netif_carrier_off(slave_dev);
+ 
+ 	ret = dsa_slave_phy_setup(slave_dev);
+@@ -1995,6 +1988,13 @@ int dsa_slave_create(struct dsa_port *po
+ 	}
+ 
+ 	rtnl_lock();
++	ret = dsa_slave_change_mtu(slave_dev, ETH_DATA_LEN);
++	rtnl_unlock();
++	if (ret && ret != -EOPNOTSUPP)
++		dev_warn(ds->dev, "nonfatal error %d setting MTU to %d on port %d\n",
++			 ret, ETH_DATA_LEN, port->index);
++
++	rtnl_lock();
+ 
+ 	ret = register_netdevice(slave_dev);
+ 	if (ret) {
diff --git a/target/linux/generic/backport-5.15/765-v5.17-02-net-next-net-dsa-merge-rtnl_lock-sections-in-dsa_slave_create.patch b/target/linux/generic/backport-5.15/765-v5.17-02-net-next-net-dsa-merge-rtnl_lock-sections-in-dsa_slave_create.patch
new file mode 100644
index 00000000000000..50aa5d8f0dd534
--- /dev/null
+++ b/target/linux/generic/backport-5.15/765-v5.17-02-net-next-net-dsa-merge-rtnl_lock-sections-in-dsa_slave_create.patch
@@ -0,0 +1,34 @@
+From e31dbd3b6aba585231cd84a87adeb22e7c6a8c19 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Thu, 6 Jan 2022 01:11:13 +0200
+Subject: [PATCH 2/6] net: dsa: merge rtnl_lock sections in dsa_slave_create
+
+Currently dsa_slave_create() has two sequences of rtnl_lock/rtnl_unlock
+in a row. Remove the rtnl_unlock() and rtnl_lock() in between, such that
+the operation can execute slighly faster.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/dsa/slave.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/net/dsa/slave.c
++++ b/net/dsa/slave.c
+@@ -1988,14 +1988,12 @@ int dsa_slave_create(struct dsa_port *po
+ 	}
+ 
+ 	rtnl_lock();
++
+ 	ret = dsa_slave_change_mtu(slave_dev, ETH_DATA_LEN);
+-	rtnl_unlock();
+ 	if (ret && ret != -EOPNOTSUPP)
+ 		dev_warn(ds->dev, "nonfatal error %d setting MTU to %d on port %d\n",
+ 			 ret, ETH_DATA_LEN, port->index);
+ 
+-	rtnl_lock();
+-
+ 	ret = register_netdevice(slave_dev);
+ 	if (ret) {
+ 		netdev_err(master, "error %d registering interface %s\n",
diff --git a/target/linux/generic/backport-5.15/765-v5.17-03-net-next-net-dsa-stop-updating-master-MTU-from-master.c.patch b/target/linux/generic/backport-5.15/765-v5.17-03-net-next-net-dsa-stop-updating-master-MTU-from-master.c.patch
new file mode 100644
index 00000000000000..6c7aad692885e7
--- /dev/null
+++ b/target/linux/generic/backport-5.15/765-v5.17-03-net-next-net-dsa-stop-updating-master-MTU-from-master.c.patch
@@ -0,0 +1,91 @@
+From a1ff94c2973c43bc1e2677ac63ebb15b1d1ff846 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Thu, 6 Jan 2022 01:11:14 +0200
+Subject: [PATCH 3/6] net: dsa: stop updating master MTU from master.c
+
+At present there are two paths for changing the MTU of the DSA master.
+
+The first is:
+
+dsa_tree_setup
+-> dsa_tree_setup_ports
+   -> dsa_port_setup
+      -> dsa_slave_create
+         -> dsa_slave_change_mtu
+            -> dev_set_mtu(master)
+
+The second is:
+
+dsa_tree_setup
+-> dsa_tree_setup_master
+   -> dsa_master_setup
+      -> dev_set_mtu(dev)
+
+So the dev_set_mtu() call from dsa_master_setup() has been effectively
+superseded by the dsa_slave_change_mtu(slave_dev, ETH_DATA_LEN) that is
+done from dsa_slave_create() for each user port. The later function also
+updates the master MTU according to the largest user port MTU from the
+tree. Therefore, updating the master MTU through a separate code path
+isn't needed.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/dsa/master.c | 25 +------------------------
+ 1 file changed, 1 insertion(+), 24 deletions(-)
+
+--- a/net/dsa/master.c
++++ b/net/dsa/master.c
+@@ -329,28 +329,13 @@ static const struct attribute_group dsa_
+ 	.attrs	= dsa_slave_attrs,
+ };
+ 
+-static void dsa_master_reset_mtu(struct net_device *dev)
+-{
+-	int err;
+-
+-	rtnl_lock();
+-	err = dev_set_mtu(dev, ETH_DATA_LEN);
+-	if (err)
+-		netdev_dbg(dev,
+-			   "Unable to reset MTU to exclude DSA overheads\n");
+-	rtnl_unlock();
+-}
+-
+ static struct lock_class_key dsa_master_addr_list_lock_key;
+ 
+ int dsa_master_setup(struct net_device *dev, struct dsa_port *cpu_dp)
+ {
+-	const struct dsa_device_ops *tag_ops = cpu_dp->tag_ops;
+ 	struct dsa_switch *ds = cpu_dp->ds;
+ 	struct device_link *consumer_link;
+-	int mtu, ret;
+-
+-	mtu = ETH_DATA_LEN + dsa_tag_protocol_overhead(tag_ops);
++	int ret;
+ 
+ 	/* The DSA master must use SET_NETDEV_DEV for this to work. */
+ 	consumer_link = device_link_add(ds->dev, dev->dev.parent,
+@@ -360,13 +345,6 @@ int dsa_master_setup(struct net_device *
+ 			   "Failed to create a device link to DSA switch %s\n",
+ 			   dev_name(ds->dev));
+ 
+-	rtnl_lock();
+-	ret = dev_set_mtu(dev, mtu);
+-	rtnl_unlock();
+-	if (ret)
+-		netdev_warn(dev, "error %d setting MTU to %d to include DSA overhead\n",
+-			    ret, mtu);
+-
+ 	/* If we use a tagging format that doesn't have an ethertype
+ 	 * field, make sure that all packets from this point on get
+ 	 * sent to the tag format's receive function.
+@@ -404,7 +382,6 @@ void dsa_master_teardown(struct net_devi
+ 	sysfs_remove_group(&dev->dev.kobj, &dsa_group);
+ 	dsa_netdev_ops_set(dev, NULL);
+ 	dsa_master_ethtool_teardown(dev);
+-	dsa_master_reset_mtu(dev);
+ 	dsa_master_set_promiscuity(dev, -1);
+ 
+ 	dev->dsa_ptr = NULL;
diff --git a/target/linux/generic/backport-5.15/765-v5.17-04-net-next-net-dsa-hold-rtnl_mutex-when-calling-dsa_master_-set.patch b/target/linux/generic/backport-5.15/765-v5.17-04-net-next-net-dsa-hold-rtnl_mutex-when-calling-dsa_master_-set.patch
new file mode 100644
index 00000000000000..e331226fc41d09
--- /dev/null
+++ b/target/linux/generic/backport-5.15/765-v5.17-04-net-next-net-dsa-hold-rtnl_mutex-when-calling-dsa_master_-set.patch
@@ -0,0 +1,78 @@
+From c146f9bc195a9dc3ad7fd000a14540e7c9df952d Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Thu, 6 Jan 2022 01:11:15 +0200
+Subject: [PATCH 4/6] net: dsa: hold rtnl_mutex when calling
+ dsa_master_{setup,teardown}
+
+DSA needs to simulate master tracking events when a binding is first
+with a DSA master established and torn down, in order to give drivers
+the simplifying guarantee that ->master_state_change calls are made
+only when the master's readiness state to pass traffic changes.
+master_state_change() provide a operational bool that DSA driver can use
+to understand if DSA master is operational or not.
+To avoid races, we need to block the reception of
+NETDEV_UP/NETDEV_CHANGE/NETDEV_GOING_DOWN events in the netdev notifier
+chain while we are changing the master's dev->dsa_ptr (this changes what
+netdev_uses_dsa(dev) reports).
+
+The dsa_master_setup() and dsa_master_teardown() functions optionally
+require the rtnl_mutex to be held, if the tagger needs the master to be
+promiscuous, these functions call dev_set_promiscuity(). Move the
+rtnl_lock() from that function and make it top-level.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/dsa/dsa2.c   | 8 ++++++++
+ net/dsa/master.c | 4 ++--
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+--- a/net/dsa/dsa2.c
++++ b/net/dsa/dsa2.c
+@@ -1034,6 +1034,8 @@ static int dsa_tree_setup_master(struct
+ 	struct dsa_port *dp;
+ 	int err;
+ 
++	rtnl_lock();
++
+ 	list_for_each_entry(dp, &dst->ports, list) {
+ 		if (dsa_port_is_cpu(dp)) {
+ 			err = dsa_master_setup(dp->master, dp);
+@@ -1042,6 +1044,8 @@ static int dsa_tree_setup_master(struct
+ 		}
+ 	}
+ 
++	rtnl_unlock();
++
+ 	return 0;
+ }
+ 
+@@ -1049,9 +1053,13 @@ static void dsa_tree_teardown_master(str
+ {
+ 	struct dsa_port *dp;
+ 
++	rtnl_lock();
++
+ 	list_for_each_entry(dp, &dst->ports, list)
+ 		if (dsa_port_is_cpu(dp))
+ 			dsa_master_teardown(dp->master);
++
++	rtnl_unlock();
+ }
+ 
+ static int dsa_tree_setup_lags(struct dsa_switch_tree *dst)
+--- a/net/dsa/master.c
++++ b/net/dsa/master.c
+@@ -266,9 +266,9 @@ static void dsa_master_set_promiscuity(s
+ 	if (!ops->promisc_on_master)
+ 		return;
+ 
+-	rtnl_lock();
++	ASSERT_RTNL();
++
+ 	dev_set_promiscuity(dev, inc);
+-	rtnl_unlock();
+ }
+ 
+ static ssize_t tagging_show(struct device *d, struct device_attribute *attr,
diff --git a/target/linux/generic/backport-5.15/765-v5.17-05-net-next-net-dsa-first-set-up-shared-ports-then-non-shared-po.patch b/target/linux/generic/backport-5.15/765-v5.17-05-net-next-net-dsa-first-set-up-shared-ports-then-non-shared-po.patch
new file mode 100644
index 00000000000000..e6472c61da67b9
--- /dev/null
+++ b/target/linux/generic/backport-5.15/765-v5.17-05-net-next-net-dsa-first-set-up-shared-ports-then-non-shared-po.patch
@@ -0,0 +1,118 @@
+From 1e3f407f3cacc5dcfe27166c412ed9bc263d82bf Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Thu, 6 Jan 2022 01:11:16 +0200
+Subject: [PATCH 5/6] net: dsa: first set up shared ports, then non-shared
+ ports
+
+After commit a57d8c217aad ("net: dsa: flush switchdev workqueue before
+tearing down CPU/DSA ports"), the port setup and teardown procedure
+became asymmetric.
+
+The fact of the matter is that user ports need the shared ports to be up
+before they can be used for CPU-initiated termination. And since we
+register net devices for the user ports, those won't be functional until
+we also call the setup for the shared (CPU, DSA) ports. But we may do
+that later, depending on the port numbering scheme of the hardware we
+are dealing with.
+
+It just makes sense that all shared ports are brought up before any user
+port is. I can't pinpoint any issue due to the current behavior, but
+let's change it nonetheless, for consistency's sake.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/dsa/dsa2.c | 50 +++++++++++++++++++++++++++++++++++++-------------
+ 1 file changed, 37 insertions(+), 13 deletions(-)
+
+--- a/net/dsa/dsa2.c
++++ b/net/dsa/dsa2.c
+@@ -999,23 +999,28 @@ static void dsa_tree_teardown_switches(s
+ 		dsa_switch_teardown(dp->ds);
+ }
+ 
+-static int dsa_tree_setup_switches(struct dsa_switch_tree *dst)
++/* Bring shared ports up first, then non-shared ports */
++static int dsa_tree_setup_ports(struct dsa_switch_tree *dst)
+ {
+ 	struct dsa_port *dp;
+-	int err;
++	int err = 0;
+ 
+ 	list_for_each_entry(dp, &dst->ports, list) {
+-		err = dsa_switch_setup(dp->ds);
+-		if (err)
+-			goto teardown;
++		if (dsa_port_is_dsa(dp) || dsa_port_is_cpu(dp)) {
++			err = dsa_port_setup(dp);
++			if (err)
++				goto teardown;
++		}
+ 	}
+ 
+ 	list_for_each_entry(dp, &dst->ports, list) {
+-		err = dsa_port_setup(dp);
+-		if (err) {
+-			err = dsa_port_reinit_as_unused(dp);
+-			if (err)
+-				goto teardown;
++		if (dsa_port_is_user(dp) || dsa_port_is_unused(dp)) {
++			err = dsa_port_setup(dp);
++			if (err) {
++				err = dsa_port_reinit_as_unused(dp);
++				if (err)
++					goto teardown;
++			}
+ 		}
+ 	}
+ 
+@@ -1024,7 +1029,21 @@ static int dsa_tree_setup_switches(struc
+ teardown:
+ 	dsa_tree_teardown_ports(dst);
+ 
+-	dsa_tree_teardown_switches(dst);
++	return err;
++}
++
++static int dsa_tree_setup_switches(struct dsa_switch_tree *dst)
++{
++	struct dsa_port *dp;
++	int err = 0;
++
++	list_for_each_entry(dp, &dst->ports, list) {
++		err = dsa_switch_setup(dp->ds);
++		if (err) {
++			dsa_tree_teardown_switches(dst);
++			break;
++		}
++	}
+ 
+ 	return err;
+ }
+@@ -1111,10 +1130,14 @@ static int dsa_tree_setup(struct dsa_swi
+ 	if (err)
+ 		goto teardown_cpu_ports;
+ 
+-	err = dsa_tree_setup_master(dst);
++	err = dsa_tree_setup_ports(dst);
+ 	if (err)
+ 		goto teardown_switches;
+ 
++	err = dsa_tree_setup_master(dst);
++	if (err)
++		goto teardown_ports;
++
+ 	err = dsa_tree_setup_lags(dst);
+ 	if (err)
+ 		goto teardown_master;
+@@ -1127,8 +1150,9 @@ static int dsa_tree_setup(struct dsa_swi
+ 
+ teardown_master:
+ 	dsa_tree_teardown_master(dst);
+-teardown_switches:
++teardown_ports:
+ 	dsa_tree_teardown_ports(dst);
++teardown_switches:
+ 	dsa_tree_teardown_switches(dst);
+ teardown_cpu_ports:
+ 	dsa_tree_teardown_cpu_ports(dst);
diff --git a/target/linux/generic/backport-5.15/765-v5.17-06-net-next-net-dsa-setup-master-before-ports.patch b/target/linux/generic/backport-5.15/765-v5.17-06-net-next-net-dsa-setup-master-before-ports.patch
new file mode 100644
index 00000000000000..93cad0c98aa080
--- /dev/null
+++ b/target/linux/generic/backport-5.15/765-v5.17-06-net-next-net-dsa-setup-master-before-ports.patch
@@ -0,0 +1,115 @@
+From 11fd667dac315ea3f2469961f6d2869271a46cae Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Thu, 6 Jan 2022 01:11:17 +0200
+Subject: [PATCH 6/6] net: dsa: setup master before ports
+
+It is said that as soon as a network interface is registered, all its
+resources should have already been prepared, so that it is available for
+sending and receiving traffic. One of the resources needed by a DSA
+slave interface is the master.
+
+dsa_tree_setup
+-> dsa_tree_setup_ports
+   -> dsa_port_setup
+      -> dsa_slave_create
+         -> register_netdevice
+-> dsa_tree_setup_master
+   -> dsa_master_setup
+      -> sets up master->dsa_ptr, which enables reception
+
+Therefore, there is a short period of time after register_netdevice()
+during which the master isn't prepared to pass traffic to the DSA layer
+(master->dsa_ptr is checked by eth_type_trans). Same thing during
+unregistration, there is a time frame in which packets might be missed.
+
+Note that this change opens us to another race: dsa_master_find_slave()
+will get invoked potentially earlier than the slave creation, and later
+than the slave deletion. Since dp->slave starts off as a NULL pointer,
+the earlier calls aren't a problem, but the later calls are. To avoid
+use-after-free, we should zeroize dp->slave before calling
+dsa_slave_destroy().
+
+In practice I cannot really test real life improvements brought by this
+change, since in my systems, netdevice creation races with PHY autoneg
+which takes a few seconds to complete, and that masks quite a few races.
+Effects might be noticeable in a setup with fixed links all the way to
+an external system.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/dsa/dsa2.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+--- a/net/dsa/dsa2.c
++++ b/net/dsa/dsa2.c
+@@ -545,6 +545,7 @@ static void dsa_port_teardown(struct dsa
+ 	struct devlink_port *dlp = &dp->devlink_port;
+ 	struct dsa_switch *ds = dp->ds;
+ 	struct dsa_mac_addr *a, *tmp;
++	struct net_device *slave;
+ 
+ 	if (!dp->setup)
+ 		return;
+@@ -566,9 +567,11 @@ static void dsa_port_teardown(struct dsa
+ 		dsa_port_link_unregister_of(dp);
+ 		break;
+ 	case DSA_PORT_TYPE_USER:
+-		if (dp->slave) {
+-			dsa_slave_destroy(dp->slave);
++		slave = dp->slave;
++
++		if (slave) {
+ 			dp->slave = NULL;
++			dsa_slave_destroy(slave);
+ 		}
+ 		break;
+ 	}
+@@ -1130,17 +1133,17 @@ static int dsa_tree_setup(struct dsa_swi
+ 	if (err)
+ 		goto teardown_cpu_ports;
+ 
+-	err = dsa_tree_setup_ports(dst);
++	err = dsa_tree_setup_master(dst);
+ 	if (err)
+ 		goto teardown_switches;
+ 
+-	err = dsa_tree_setup_master(dst);
++	err = dsa_tree_setup_ports(dst);
+ 	if (err)
+-		goto teardown_ports;
++		goto teardown_master;
+ 
+ 	err = dsa_tree_setup_lags(dst);
+ 	if (err)
+-		goto teardown_master;
++		goto teardown_ports;
+ 
+ 	dst->setup = true;
+ 
+@@ -1148,10 +1151,10 @@ static int dsa_tree_setup(struct dsa_swi
+ 
+ 	return 0;
+ 
+-teardown_master:
+-	dsa_tree_teardown_master(dst);
+ teardown_ports:
+ 	dsa_tree_teardown_ports(dst);
++teardown_master:
++	dsa_tree_teardown_master(dst);
+ teardown_switches:
+ 	dsa_tree_teardown_switches(dst);
+ teardown_cpu_ports:
+@@ -1169,10 +1172,10 @@ static void dsa_tree_teardown(struct dsa
+ 
+ 	dsa_tree_teardown_lags(dst);
+ 
+-	dsa_tree_teardown_master(dst);
+-
+ 	dsa_tree_teardown_ports(dst);
+ 
++	dsa_tree_teardown_master(dst);
++
+ 	dsa_tree_teardown_switches(dst);
+ 
+ 	dsa_tree_teardown_cpu_ports(dst);
diff --git a/target/linux/generic/backport-5.15/766-v5.18-01-net-dsa-provide-switch-operations-for-tracking-the-m.patch b/target/linux/generic/backport-5.15/766-v5.18-01-net-dsa-provide-switch-operations-for-tracking-the-m.patch
new file mode 100644
index 00000000000000..bffdcb28819fbf
--- /dev/null
+++ b/target/linux/generic/backport-5.15/766-v5.18-01-net-dsa-provide-switch-operations-for-tracking-the-m.patch
@@ -0,0 +1,254 @@
+From 295ab96f478d0fa56393e85406f19a867e26ce22 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Wed, 2 Feb 2022 01:03:20 +0100
+Subject: [PATCH 01/16] net: dsa: provide switch operations for tracking the
+ master state
+
+Certain drivers may need to send management traffic to the switch for
+things like register access, FDB dump, etc, to accelerate what their
+slow bus (SPI, I2C, MDIO) can already do.
+
+Ethernet is faster (especially in bulk transactions) but is also more
+unreliable, since the user may decide to bring the DSA master down (or
+not bring it up), therefore severing the link between the host and the
+attached switch.
+
+Drivers needing Ethernet-based register access already should have
+fallback logic to the slow bus if the Ethernet method fails, but that
+fallback may be based on a timeout, and the I/O to the switch may slow
+down to a halt if the master is down, because every Ethernet packet will
+have to time out. The driver also doesn't have the option to turn off
+Ethernet-based I/O momentarily, because it wouldn't know when to turn it
+back on.
+
+Which is where this change comes in. By tracking NETDEV_CHANGE,
+NETDEV_UP and NETDEV_GOING_DOWN events on the DSA master, we should know
+the exact interval of time during which this interface is reliably
+available for traffic. Provide this information to switches so they can
+use it as they wish.
+
+An helper is added dsa_port_master_is_operational() to check if a master
+port is operational.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/net/dsa.h  | 17 +++++++++++++++++
+ net/dsa/dsa2.c     | 46 ++++++++++++++++++++++++++++++++++++++++++++++
+ net/dsa/dsa_priv.h | 13 +++++++++++++
+ net/dsa/slave.c    | 32 ++++++++++++++++++++++++++++++++
+ net/dsa/switch.c   | 15 +++++++++++++++
+ 5 files changed, 123 insertions(+)
+
+--- a/include/net/dsa.h
++++ b/include/net/dsa.h
+@@ -291,6 +291,10 @@ struct dsa_port {
+ 	struct list_head	mdbs;
+ 
+ 	bool setup;
++	/* Master state bits, valid only on CPU ports */
++	u8			master_admin_up:1;
++	u8			master_oper_up:1;
++
+ };
+ 
+ /* TODO: ideally DSA ports would have a single dp->link_dp member,
+@@ -456,6 +460,12 @@ static inline bool dsa_port_is_unused(st
+ 	return dp->type == DSA_PORT_TYPE_UNUSED;
+ }
+ 
++static inline bool dsa_port_master_is_operational(struct dsa_port *dp)
++{
++	return dsa_port_is_cpu(dp) && dp->master_admin_up &&
++	       dp->master_oper_up;
++}
++
+ static inline bool dsa_is_unused_port(struct dsa_switch *ds, int p)
+ {
+ 	return dsa_to_port(ds, p)->type == DSA_PORT_TYPE_UNUSED;
+@@ -949,6 +959,13 @@ struct dsa_switch_ops {
+ 	int	(*tag_8021q_vlan_add)(struct dsa_switch *ds, int port, u16 vid,
+ 				      u16 flags);
+ 	int	(*tag_8021q_vlan_del)(struct dsa_switch *ds, int port, u16 vid);
++
++	/*
++	 * DSA master tracking operations
++	 */
++	void	(*master_state_change)(struct dsa_switch *ds,
++				       const struct net_device *master,
++				       bool operational);
+ };
+ 
+ #define DSA_DEVLINK_PARAM_DRIVER(_id, _name, _type, _cmodes)		\
+--- a/net/dsa/dsa2.c
++++ b/net/dsa/dsa2.c
+@@ -1275,6 +1275,52 @@ out_unlock:
+ 	return err;
+ }
+ 
++static void dsa_tree_master_state_change(struct dsa_switch_tree *dst,
++					 struct net_device *master)
++{
++	struct dsa_notifier_master_state_info info;
++	struct dsa_port *cpu_dp = master->dsa_ptr;
++
++	info.master = master;
++	info.operational = dsa_port_master_is_operational(cpu_dp);
++
++	dsa_tree_notify(dst, DSA_NOTIFIER_MASTER_STATE_CHANGE, &info);
++}
++
++void dsa_tree_master_admin_state_change(struct dsa_switch_tree *dst,
++					struct net_device *master,
++					bool up)
++{
++	struct dsa_port *cpu_dp = master->dsa_ptr;
++	bool notify = false;
++
++	if ((dsa_port_master_is_operational(cpu_dp)) !=
++	    (up && cpu_dp->master_oper_up))
++		notify = true;
++
++	cpu_dp->master_admin_up = up;
++
++	if (notify)
++		dsa_tree_master_state_change(dst, master);
++}
++
++void dsa_tree_master_oper_state_change(struct dsa_switch_tree *dst,
++				       struct net_device *master,
++				       bool up)
++{
++	struct dsa_port *cpu_dp = master->dsa_ptr;
++	bool notify = false;
++
++	if ((dsa_port_master_is_operational(cpu_dp)) !=
++	    (cpu_dp->master_admin_up && up))
++		notify = true;
++
++	cpu_dp->master_oper_up = up;
++
++	if (notify)
++		dsa_tree_master_state_change(dst, master);
++}
++
+ static struct dsa_port *dsa_port_touch(struct dsa_switch *ds, int index)
+ {
+ 	struct dsa_switch_tree *dst = ds->dst;
+--- a/net/dsa/dsa_priv.h
++++ b/net/dsa/dsa_priv.h
+@@ -45,6 +45,7 @@ enum {
+ 	DSA_NOTIFIER_MRP_DEL_RING_ROLE,
+ 	DSA_NOTIFIER_TAG_8021Q_VLAN_ADD,
+ 	DSA_NOTIFIER_TAG_8021Q_VLAN_DEL,
++	DSA_NOTIFIER_MASTER_STATE_CHANGE,
+ };
+ 
+ /* DSA_NOTIFIER_AGEING_TIME */
+@@ -127,6 +128,12 @@ struct dsa_notifier_tag_8021q_vlan_info
+ 	u16 vid;
+ };
+ 
++/* DSA_NOTIFIER_MASTER_STATE_CHANGE */
++struct dsa_notifier_master_state_info {
++	const struct net_device *master;
++	bool operational;
++};
++
+ struct dsa_switchdev_event_work {
+ 	struct dsa_switch *ds;
+ 	int port;
+@@ -549,6 +556,12 @@ int dsa_tree_change_tag_proto(struct dsa
+ 			      struct net_device *master,
+ 			      const struct dsa_device_ops *tag_ops,
+ 			      const struct dsa_device_ops *old_tag_ops);
++void dsa_tree_master_admin_state_change(struct dsa_switch_tree *dst,
++					struct net_device *master,
++					bool up);
++void dsa_tree_master_oper_state_change(struct dsa_switch_tree *dst,
++				       struct net_device *master,
++				       bool up);
+ int dsa_bridge_num_get(const struct net_device *bridge_dev, int max);
+ void dsa_bridge_num_put(const struct net_device *bridge_dev, int bridge_num);
+ 
+--- a/net/dsa/slave.c
++++ b/net/dsa/slave.c
+@@ -2311,6 +2311,36 @@ static int dsa_slave_netdevice_event(str
+ 		err = dsa_port_lag_change(dp, info->lower_state_info);
+ 		return notifier_from_errno(err);
+ 	}
++	case NETDEV_CHANGE:
++	case NETDEV_UP: {
++		/* Track state of master port.
++		 * DSA driver may require the master port (and indirectly
++		 * the tagger) to be available for some special operation.
++		 */
++		if (netdev_uses_dsa(dev)) {
++			struct dsa_port *cpu_dp = dev->dsa_ptr;
++			struct dsa_switch_tree *dst = cpu_dp->ds->dst;
++
++			/* Track when the master port is UP */
++			dsa_tree_master_oper_state_change(dst, dev,
++							  netif_oper_up(dev));
++
++			/* Track when the master port is ready and can accept
++			 * packet.
++			 * NETDEV_UP event is not enough to flag a port as ready.
++			 * We also have to wait for linkwatch_do_dev to dev_activate
++			 * and emit a NETDEV_CHANGE event.
++			 * We check if a master port is ready by checking if the dev
++			 * have a qdisc assigned and is not noop.
++			 */
++			dsa_tree_master_admin_state_change(dst, dev,
++							   !qdisc_tx_is_noop(dev));
++
++			return NOTIFY_OK;
++		}
++
++		return NOTIFY_DONE;
++	}
+ 	case NETDEV_GOING_DOWN: {
+ 		struct dsa_port *dp, *cpu_dp;
+ 		struct dsa_switch_tree *dst;
+@@ -2322,6 +2352,8 @@ static int dsa_slave_netdevice_event(str
+ 		cpu_dp = dev->dsa_ptr;
+ 		dst = cpu_dp->ds->dst;
+ 
++		dsa_tree_master_admin_state_change(dst, dev, false);
++
+ 		list_for_each_entry(dp, &dst->ports, list) {
+ 			if (!dsa_is_user_port(dp->ds, dp->index))
+ 				continue;
+--- a/net/dsa/switch.c
++++ b/net/dsa/switch.c
+@@ -722,6 +722,18 @@ dsa_switch_mrp_del_ring_role(struct dsa_
+ 	return 0;
+ }
+ 
++static int
++dsa_switch_master_state_change(struct dsa_switch *ds,
++			       struct dsa_notifier_master_state_info *info)
++{
++	if (!ds->ops->master_state_change)
++		return 0;
++
++	ds->ops->master_state_change(ds, info->master, info->operational);
++
++	return 0;
++}
++
+ static int dsa_switch_event(struct notifier_block *nb,
+ 			    unsigned long event, void *info)
+ {
+@@ -813,6 +825,9 @@ static int dsa_switch_event(struct notif
+ 	case DSA_NOTIFIER_TAG_8021Q_VLAN_DEL:
+ 		err = dsa_switch_tag_8021q_vlan_del(ds, info);
+ 		break;
++	case DSA_NOTIFIER_MASTER_STATE_CHANGE:
++		err = dsa_switch_master_state_change(ds, info);
++		break;
+ 	default:
+ 		err = -EOPNOTSUPP;
+ 		break;
diff --git a/target/linux/generic/backport-5.15/766-v5.18-02-net-dsa-replay-master-state-events-in-dsa_tree_-setu.patch b/target/linux/generic/backport-5.15/766-v5.18-02-net-dsa-replay-master-state-events-in-dsa_tree_-setu.patch
new file mode 100644
index 00000000000000..6478d580c01701
--- /dev/null
+++ b/target/linux/generic/backport-5.15/766-v5.18-02-net-dsa-replay-master-state-events-in-dsa_tree_-setu.patch
@@ -0,0 +1,89 @@
+From e83d56537859849f2223b90749e554831b1f3c27 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Wed, 2 Feb 2022 01:03:21 +0100
+Subject: [PATCH 02/16] net: dsa: replay master state events in
+ dsa_tree_{setup,teardown}_master
+
+In order for switch driver to be able to make simple and reliable use of
+the master tracking operations, they must also be notified of the
+initial state of the DSA master, not just of the changes. This is
+because they might enable certain features only during the time when
+they know that the DSA master is up and running.
+
+Therefore, this change explicitly checks the state of the DSA master
+under the same rtnl_mutex as we were holding during the
+dsa_master_setup() and dsa_master_teardown() call. The idea being that
+if the DSA master became operational in between the moment in which it
+became a DSA master (dsa_master_setup set dev->dsa_ptr) and the moment
+when we checked for the master being up, there is a chance that we
+would emit a ->master_state_change() call with no actual state change.
+We need to avoid that by serializing the concurrent netdevice event with
+us. If the netdevice event started before, we force it to finish before
+we begin, because we take rtnl_lock before making netdev_uses_dsa()
+return true. So we also handle that early event and do nothing on it.
+Similarly, if the dev_open() attempt is concurrent with us, it will
+attempt to take the rtnl_mutex, but we're holding it. We'll see that
+the master flag IFF_UP isn't set, then when we release the rtnl_mutex
+we'll process the NETDEV_UP notifier.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/dsa/dsa2.c | 28 ++++++++++++++++++++++++----
+ 1 file changed, 24 insertions(+), 4 deletions(-)
+
+--- a/net/dsa/dsa2.c
++++ b/net/dsa/dsa2.c
+@@ -15,6 +15,7 @@
+ #include <linux/of.h>
+ #include <linux/of_net.h>
+ #include <net/devlink.h>
++#include <net/sch_generic.h>
+ 
+ #include "dsa_priv.h"
+ 
+@@ -1060,9 +1061,18 @@ static int dsa_tree_setup_master(struct
+ 
+ 	list_for_each_entry(dp, &dst->ports, list) {
+ 		if (dsa_port_is_cpu(dp)) {
+-			err = dsa_master_setup(dp->master, dp);
++			struct net_device *master = dp->master;
++			bool admin_up = (master->flags & IFF_UP) &&
++					!qdisc_tx_is_noop(master);
++
++			err = dsa_master_setup(master, dp);
+ 			if (err)
+ 				return err;
++
++			/* Replay master state event */
++			dsa_tree_master_admin_state_change(dst, master, admin_up);
++			dsa_tree_master_oper_state_change(dst, master,
++							  netif_oper_up(master));
+ 		}
+ 	}
+ 
+@@ -1077,9 +1087,19 @@ static void dsa_tree_teardown_master(str
+ 
+ 	rtnl_lock();
+ 
+-	list_for_each_entry(dp, &dst->ports, list)
+-		if (dsa_port_is_cpu(dp))
+-			dsa_master_teardown(dp->master);
++	list_for_each_entry(dp, &dst->ports, list) {
++		if (dsa_port_is_cpu(dp)) {
++			struct net_device *master = dp->master;
++
++			/* Synthesizing an "admin down" state is sufficient for
++			 * the switches to get a notification if the master is
++			 * currently up and running.
++			 */
++			dsa_tree_master_admin_state_change(dst, master, false);
++
++			dsa_master_teardown(master);
++		}
++	}
+ 
+ 	rtnl_unlock();
+ }
diff --git a/target/linux/generic/backport-5.15/766-v5.18-03-net-dsa-tag_qca-convert-to-FIELD-macro.patch b/target/linux/generic/backport-5.15/766-v5.18-03-net-dsa-tag_qca-convert-to-FIELD-macro.patch
new file mode 100644
index 00000000000000..82c94b385b5f53
--- /dev/null
+++ b/target/linux/generic/backport-5.15/766-v5.18-03-net-dsa-tag_qca-convert-to-FIELD-macro.patch
@@ -0,0 +1,86 @@
+From 6b0458299297ca4ab6fb295800e29a4e501d50c1 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Wed, 2 Feb 2022 01:03:22 +0100
+Subject: [PATCH 03/16] net: dsa: tag_qca: convert to FIELD macro
+
+Convert driver to FIELD macro to drop redundant define.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/dsa/tag_qca.c | 34 +++++++++++++++-------------------
+ 1 file changed, 15 insertions(+), 19 deletions(-)
+
+--- a/net/dsa/tag_qca.c
++++ b/net/dsa/tag_qca.c
+@@ -4,29 +4,24 @@
+  */
+ 
+ #include <linux/etherdevice.h>
++#include <linux/bitfield.h>
+ 
+ #include "dsa_priv.h"
+ 
+ #define QCA_HDR_LEN	2
+ #define QCA_HDR_VERSION	0x2
+ 
+-#define QCA_HDR_RECV_VERSION_MASK	GENMASK(15, 14)
+-#define QCA_HDR_RECV_VERSION_S		14
+-#define QCA_HDR_RECV_PRIORITY_MASK	GENMASK(13, 11)
+-#define QCA_HDR_RECV_PRIORITY_S		11
+-#define QCA_HDR_RECV_TYPE_MASK		GENMASK(10, 6)
+-#define QCA_HDR_RECV_TYPE_S		6
++#define QCA_HDR_RECV_VERSION		GENMASK(15, 14)
++#define QCA_HDR_RECV_PRIORITY		GENMASK(13, 11)
++#define QCA_HDR_RECV_TYPE		GENMASK(10, 6)
+ #define QCA_HDR_RECV_FRAME_IS_TAGGED	BIT(3)
+-#define QCA_HDR_RECV_SOURCE_PORT_MASK	GENMASK(2, 0)
++#define QCA_HDR_RECV_SOURCE_PORT	GENMASK(2, 0)
+ 
+-#define QCA_HDR_XMIT_VERSION_MASK	GENMASK(15, 14)
+-#define QCA_HDR_XMIT_VERSION_S		14
+-#define QCA_HDR_XMIT_PRIORITY_MASK	GENMASK(13, 11)
+-#define QCA_HDR_XMIT_PRIORITY_S		11
+-#define QCA_HDR_XMIT_CONTROL_MASK	GENMASK(10, 8)
+-#define QCA_HDR_XMIT_CONTROL_S		8
++#define QCA_HDR_XMIT_VERSION		GENMASK(15, 14)
++#define QCA_HDR_XMIT_PRIORITY		GENMASK(13, 11)
++#define QCA_HDR_XMIT_CONTROL		GENMASK(10, 8)
+ #define QCA_HDR_XMIT_FROM_CPU		BIT(7)
+-#define QCA_HDR_XMIT_DP_BIT_MASK	GENMASK(6, 0)
++#define QCA_HDR_XMIT_DP_BIT		GENMASK(6, 0)
+ 
+ static struct sk_buff *qca_tag_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+@@ -40,8 +35,9 @@ static struct sk_buff *qca_tag_xmit(stru
+ 	phdr = dsa_etype_header_pos_tx(skb);
+ 
+ 	/* Set the version field, and set destination port information */
+-	hdr = QCA_HDR_VERSION << QCA_HDR_XMIT_VERSION_S |
+-		QCA_HDR_XMIT_FROM_CPU | BIT(dp->index);
++	hdr = FIELD_PREP(QCA_HDR_XMIT_VERSION, QCA_HDR_VERSION);
++	hdr |= QCA_HDR_XMIT_FROM_CPU;
++	hdr |= FIELD_PREP(QCA_HDR_XMIT_DP_BIT, BIT(dp->index));
+ 
+ 	*phdr = htons(hdr);
+ 
+@@ -62,7 +58,7 @@ static struct sk_buff *qca_tag_rcv(struc
+ 	hdr = ntohs(*phdr);
+ 
+ 	/* Make sure the version is correct */
+-	ver = (hdr & QCA_HDR_RECV_VERSION_MASK) >> QCA_HDR_RECV_VERSION_S;
++	ver = FIELD_GET(QCA_HDR_RECV_VERSION, hdr);
+ 	if (unlikely(ver != QCA_HDR_VERSION))
+ 		return NULL;
+ 
+@@ -71,7 +67,7 @@ static struct sk_buff *qca_tag_rcv(struc
+ 	dsa_strip_etype_header(skb, QCA_HDR_LEN);
+ 
+ 	/* Get source port information */
+-	port = (hdr & QCA_HDR_RECV_SOURCE_PORT_MASK);
++	port = FIELD_GET(QCA_HDR_RECV_SOURCE_PORT, hdr);
+ 
+ 	skb->dev = dsa_master_find_slave(dev, 0, port);
+ 	if (!skb->dev)
diff --git a/target/linux/generic/backport-5.15/766-v5.18-04-net-dsa-tag_qca-move-define-to-include-linux-dsa.patch b/target/linux/generic/backport-5.15/766-v5.18-04-net-dsa-tag_qca-move-define-to-include-linux-dsa.patch
new file mode 100644
index 00000000000000..c1e74ceeeb5bf9
--- /dev/null
+++ b/target/linux/generic/backport-5.15/766-v5.18-04-net-dsa-tag_qca-move-define-to-include-linux-dsa.patch
@@ -0,0 +1,71 @@
+From 3ec762fb13c7e7273800b94c80db1c2cc37590d1 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Wed, 2 Feb 2022 01:03:23 +0100
+Subject: [PATCH 04/16] net: dsa: tag_qca: move define to include linux/dsa
+
+Move tag_qca define to include dir linux/dsa as the qca8k require access
+to the tagger define to support in-band mdio read/write using ethernet
+packet.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/linux/dsa/tag_qca.h | 21 +++++++++++++++++++++
+ net/dsa/tag_qca.c           | 16 +---------------
+ 2 files changed, 22 insertions(+), 15 deletions(-)
+ create mode 100644 include/linux/dsa/tag_qca.h
+
+--- /dev/null
++++ b/include/linux/dsa/tag_qca.h
+@@ -0,0 +1,21 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++
++#ifndef __TAG_QCA_H
++#define __TAG_QCA_H
++
++#define QCA_HDR_LEN	2
++#define QCA_HDR_VERSION	0x2
++
++#define QCA_HDR_RECV_VERSION		GENMASK(15, 14)
++#define QCA_HDR_RECV_PRIORITY		GENMASK(13, 11)
++#define QCA_HDR_RECV_TYPE		GENMASK(10, 6)
++#define QCA_HDR_RECV_FRAME_IS_TAGGED	BIT(3)
++#define QCA_HDR_RECV_SOURCE_PORT	GENMASK(2, 0)
++
++#define QCA_HDR_XMIT_VERSION		GENMASK(15, 14)
++#define QCA_HDR_XMIT_PRIORITY		GENMASK(13, 11)
++#define QCA_HDR_XMIT_CONTROL		GENMASK(10, 8)
++#define QCA_HDR_XMIT_FROM_CPU		BIT(7)
++#define QCA_HDR_XMIT_DP_BIT		GENMASK(6, 0)
++
++#endif /* __TAG_QCA_H */
+--- a/net/dsa/tag_qca.c
++++ b/net/dsa/tag_qca.c
+@@ -5,24 +5,10 @@
+ 
+ #include <linux/etherdevice.h>
+ #include <linux/bitfield.h>
++#include <linux/dsa/tag_qca.h>
+ 
+ #include "dsa_priv.h"
+ 
+-#define QCA_HDR_LEN	2
+-#define QCA_HDR_VERSION	0x2
+-
+-#define QCA_HDR_RECV_VERSION		GENMASK(15, 14)
+-#define QCA_HDR_RECV_PRIORITY		GENMASK(13, 11)
+-#define QCA_HDR_RECV_TYPE		GENMASK(10, 6)
+-#define QCA_HDR_RECV_FRAME_IS_TAGGED	BIT(3)
+-#define QCA_HDR_RECV_SOURCE_PORT	GENMASK(2, 0)
+-
+-#define QCA_HDR_XMIT_VERSION		GENMASK(15, 14)
+-#define QCA_HDR_XMIT_PRIORITY		GENMASK(13, 11)
+-#define QCA_HDR_XMIT_CONTROL		GENMASK(10, 8)
+-#define QCA_HDR_XMIT_FROM_CPU		BIT(7)
+-#define QCA_HDR_XMIT_DP_BIT		GENMASK(6, 0)
+-
+ static struct sk_buff *qca_tag_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ 	struct dsa_port *dp = dsa_slave_to_port(dev);
diff --git a/target/linux/generic/backport-5.15/766-v5.18-05-net-dsa-tag_qca-enable-promisc_on_master-flag.patch b/target/linux/generic/backport-5.15/766-v5.18-05-net-dsa-tag_qca-enable-promisc_on_master-flag.patch
new file mode 100644
index 00000000000000..9394a0dabbe6a9
--- /dev/null
+++ b/target/linux/generic/backport-5.15/766-v5.18-05-net-dsa-tag_qca-enable-promisc_on_master-flag.patch
@@ -0,0 +1,27 @@
+From 101c04c3463b87061e6a3d4f72c1bc57670685a6 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Wed, 2 Feb 2022 01:03:24 +0100
+Subject: [PATCH 05/16] net: dsa: tag_qca: enable promisc_on_master flag
+
+Ethernet MDIO packets are non-standard and DSA master expects the first
+6 octets to be the MAC DA. To address these kind of packet, enable
+promisc_on_master flag for the tagger.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/dsa/tag_qca.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/dsa/tag_qca.c
++++ b/net/dsa/tag_qca.c
+@@ -68,6 +68,7 @@ static const struct dsa_device_ops qca_n
+ 	.xmit	= qca_tag_xmit,
+ 	.rcv	= qca_tag_rcv,
+ 	.needed_headroom = QCA_HDR_LEN,
++	.promisc_on_master = true,
+ };
+ 
+ MODULE_LICENSE("GPL");
diff --git a/target/linux/generic/backport-5.15/766-v5.18-06-net-dsa-tag_qca-add-define-for-handling-mgmt-Etherne.patch b/target/linux/generic/backport-5.15/766-v5.18-06-net-dsa-tag_qca-add-define-for-handling-mgmt-Etherne.patch
new file mode 100644
index 00000000000000..459454e03ba50a
--- /dev/null
+++ b/target/linux/generic/backport-5.15/766-v5.18-06-net-dsa-tag_qca-add-define-for-handling-mgmt-Etherne.patch
@@ -0,0 +1,110 @@
+From c2ee8181fddb293d296477f60b3eb4fa3ce4e1a6 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Wed, 2 Feb 2022 01:03:25 +0100
+Subject: [PATCH 06/16] net: dsa: tag_qca: add define for handling mgmt
+ Ethernet packet
+
+Add all the required define to prepare support for mgmt read/write in
+Ethernet packet. Any packet of this type has to be dropped as the only
+use of these special packet is receive ack for an mgmt write request or
+receive data for an mgmt read request.
+A struct is used that emulates the Ethernet header but is used for a
+different purpose.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/linux/dsa/tag_qca.h | 44 +++++++++++++++++++++++++++++++++++++
+ net/dsa/tag_qca.c           | 15 ++++++++++---
+ 2 files changed, 56 insertions(+), 3 deletions(-)
+
+--- a/include/linux/dsa/tag_qca.h
++++ b/include/linux/dsa/tag_qca.h
+@@ -12,10 +12,54 @@
+ #define QCA_HDR_RECV_FRAME_IS_TAGGED	BIT(3)
+ #define QCA_HDR_RECV_SOURCE_PORT	GENMASK(2, 0)
+ 
++/* Packet type for recv */
++#define QCA_HDR_RECV_TYPE_NORMAL	0x0
++#define QCA_HDR_RECV_TYPE_MIB		0x1
++#define QCA_HDR_RECV_TYPE_RW_REG_ACK	0x2
++
+ #define QCA_HDR_XMIT_VERSION		GENMASK(15, 14)
+ #define QCA_HDR_XMIT_PRIORITY		GENMASK(13, 11)
+ #define QCA_HDR_XMIT_CONTROL		GENMASK(10, 8)
+ #define QCA_HDR_XMIT_FROM_CPU		BIT(7)
+ #define QCA_HDR_XMIT_DP_BIT		GENMASK(6, 0)
+ 
++/* Packet type for xmit */
++#define QCA_HDR_XMIT_TYPE_NORMAL	0x0
++#define QCA_HDR_XMIT_TYPE_RW_REG	0x1
++
++/* Check code for a valid mgmt packet. Switch will ignore the packet
++ * with this wrong.
++ */
++#define QCA_HDR_MGMT_CHECK_CODE_VAL	0x5
++
++/* Specific define for in-band MDIO read/write with Ethernet packet */
++#define QCA_HDR_MGMT_SEQ_LEN		4 /* 4 byte for the seq */
++#define QCA_HDR_MGMT_COMMAND_LEN	4 /* 4 byte for the command */
++#define QCA_HDR_MGMT_DATA1_LEN		4 /* First 4 byte for the mdio data */
++#define QCA_HDR_MGMT_HEADER_LEN		(QCA_HDR_MGMT_SEQ_LEN + \
++					QCA_HDR_MGMT_COMMAND_LEN + \
++					QCA_HDR_MGMT_DATA1_LEN)
++
++#define QCA_HDR_MGMT_DATA2_LEN		12 /* Other 12 byte for the mdio data */
++#define QCA_HDR_MGMT_PADDING_LEN	34 /* Padding to reach the min Ethernet packet */
++
++#define QCA_HDR_MGMT_PKT_LEN		(QCA_HDR_MGMT_HEADER_LEN + \
++					QCA_HDR_LEN + \
++					QCA_HDR_MGMT_DATA2_LEN + \
++					QCA_HDR_MGMT_PADDING_LEN)
++
++#define QCA_HDR_MGMT_SEQ_NUM		GENMASK(31, 0)  /* 63, 32 */
++#define QCA_HDR_MGMT_CHECK_CODE		GENMASK(31, 29) /* 31, 29 */
++#define QCA_HDR_MGMT_CMD		BIT(28)		/* 28 */
++#define QCA_HDR_MGMT_LENGTH		GENMASK(23, 20) /* 23, 20 */
++#define QCA_HDR_MGMT_ADDR		GENMASK(18, 0)  /* 18, 0 */
++
++/* Special struct emulating a Ethernet header */
++struct qca_mgmt_ethhdr {
++	u32 command;		/* command bit 31:0 */
++	u32 seq;		/* seq 63:32 */
++	u32 mdio_data;		/* first 4byte mdio */
++	__be16 hdr;		/* qca hdr */
++} __packed;
++
+ #endif /* __TAG_QCA_H */
+--- a/net/dsa/tag_qca.c
++++ b/net/dsa/tag_qca.c
+@@ -32,10 +32,12 @@ static struct sk_buff *qca_tag_xmit(stru
+ 
+ static struct sk_buff *qca_tag_rcv(struct sk_buff *skb, struct net_device *dev)
+ {
+-	u8 ver;
+-	u16  hdr;
+-	int port;
++	u8 ver, pk_type;
+ 	__be16 *phdr;
++	int port;
++	u16 hdr;
++
++	BUILD_BUG_ON(sizeof(struct qca_mgmt_ethhdr) != QCA_HDR_MGMT_HEADER_LEN + QCA_HDR_LEN);
+ 
+ 	if (unlikely(!pskb_may_pull(skb, QCA_HDR_LEN)))
+ 		return NULL;
+@@ -48,6 +50,13 @@ static struct sk_buff *qca_tag_rcv(struc
+ 	if (unlikely(ver != QCA_HDR_VERSION))
+ 		return NULL;
+ 
++	/* Get pk type */
++	pk_type = FIELD_GET(QCA_HDR_RECV_TYPE, hdr);
++
++	/* Ethernet MDIO read/write packet */
++	if (pk_type == QCA_HDR_RECV_TYPE_RW_REG_ACK)
++		return NULL;
++
+ 	/* Remove QCA tag and recalculate checksum */
+ 	skb_pull_rcsum(skb, QCA_HDR_LEN);
+ 	dsa_strip_etype_header(skb, QCA_HDR_LEN);
diff --git a/target/linux/generic/backport-5.15/766-v5.18-07-net-dsa-tag_qca-add-define-for-handling-MIB-packet.patch b/target/linux/generic/backport-5.15/766-v5.18-07-net-dsa-tag_qca-add-define-for-handling-MIB-packet.patch
new file mode 100644
index 00000000000000..7e5dc657306836
--- /dev/null
+++ b/target/linux/generic/backport-5.15/766-v5.18-07-net-dsa-tag_qca-add-define-for-handling-MIB-packet.patch
@@ -0,0 +1,45 @@
+From 18be654a4345f7d937b4bfbad74bea8093e3a93c Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Wed, 2 Feb 2022 01:03:26 +0100
+Subject: [PATCH 07/16] net: dsa: tag_qca: add define for handling MIB packet
+
+Add struct to correctly parse a mib Ethernet packet.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/linux/dsa/tag_qca.h | 10 ++++++++++
+ net/dsa/tag_qca.c           |  4 ++++
+ 2 files changed, 14 insertions(+)
+
+--- a/include/linux/dsa/tag_qca.h
++++ b/include/linux/dsa/tag_qca.h
+@@ -62,4 +62,14 @@ struct qca_mgmt_ethhdr {
+ 	__be16 hdr;		/* qca hdr */
+ } __packed;
+ 
++enum mdio_cmd {
++	MDIO_WRITE = 0x0,
++	MDIO_READ
++};
++
++struct mib_ethhdr {
++	u32 data[3];		/* first 3 mib counter */
++	__be16 hdr;		/* qca hdr */
++} __packed;
++
+ #endif /* __TAG_QCA_H */
+--- a/net/dsa/tag_qca.c
++++ b/net/dsa/tag_qca.c
+@@ -57,6 +57,10 @@ static struct sk_buff *qca_tag_rcv(struc
+ 	if (pk_type == QCA_HDR_RECV_TYPE_RW_REG_ACK)
+ 		return NULL;
+ 
++	/* Ethernet MIB counter packet */
++	if (pk_type == QCA_HDR_RECV_TYPE_MIB)
++		return NULL;
++
+ 	/* Remove QCA tag and recalculate checksum */
+ 	skb_pull_rcsum(skb, QCA_HDR_LEN);
+ 	dsa_strip_etype_header(skb, QCA_HDR_LEN);
diff --git a/target/linux/generic/backport-5.15/766-v5.18-08-net-dsa-tag_qca-add-support-for-handling-mgmt-and-MI.patch b/target/linux/generic/backport-5.15/766-v5.18-08-net-dsa-tag_qca-add-support-for-handling-mgmt-and-MI.patch
new file mode 100644
index 00000000000000..ad25da30e6d884
--- /dev/null
+++ b/target/linux/generic/backport-5.15/766-v5.18-08-net-dsa-tag_qca-add-support-for-handling-mgmt-and-MI.patch
@@ -0,0 +1,116 @@
+From 31eb6b4386ad91930417e3f5c8157a4b5e31cbd5 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Wed, 2 Feb 2022 01:03:27 +0100
+Subject: [PATCH 08/16] net: dsa: tag_qca: add support for handling mgmt and
+ MIB Ethernet packet
+
+Add connect/disconnect helper to assign private struct to the DSA switch.
+Add support for Ethernet mgmt and MIB if the DSA driver provide an handler
+to correctly parse and elaborate the data.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/linux/dsa/tag_qca.h |  7 +++++++
+ net/dsa/tag_qca.c           | 39 ++++++++++++++++++++++++++++++++++---
+ 2 files changed, 43 insertions(+), 3 deletions(-)
+
+--- a/include/linux/dsa/tag_qca.h
++++ b/include/linux/dsa/tag_qca.h
+@@ -72,4 +72,11 @@ struct mib_ethhdr {
+ 	__be16 hdr;		/* qca hdr */
+ } __packed;
+ 
++struct qca_tagger_data {
++	void (*rw_reg_ack_handler)(struct dsa_switch *ds,
++				   struct sk_buff *skb);
++	void (*mib_autocast_handler)(struct dsa_switch *ds,
++				     struct sk_buff *skb);
++};
++
+ #endif /* __TAG_QCA_H */
+--- a/net/dsa/tag_qca.c
++++ b/net/dsa/tag_qca.c
+@@ -5,6 +5,7 @@
+ 
+ #include <linux/etherdevice.h>
+ #include <linux/bitfield.h>
++#include <net/dsa.h>
+ #include <linux/dsa/tag_qca.h>
+ 
+ #include "dsa_priv.h"
+@@ -32,6 +33,9 @@ static struct sk_buff *qca_tag_xmit(stru
+ 
+ static struct sk_buff *qca_tag_rcv(struct sk_buff *skb, struct net_device *dev)
+ {
++	struct qca_tagger_data *tagger_data;
++	struct dsa_port *dp = dev->dsa_ptr;
++	struct dsa_switch *ds = dp->ds;
+ 	u8 ver, pk_type;
+ 	__be16 *phdr;
+ 	int port;
+@@ -39,6 +43,8 @@ static struct sk_buff *qca_tag_rcv(struc
+ 
+ 	BUILD_BUG_ON(sizeof(struct qca_mgmt_ethhdr) != QCA_HDR_MGMT_HEADER_LEN + QCA_HDR_LEN);
+ 
++	tagger_data = ds->tagger_data;
++
+ 	if (unlikely(!pskb_may_pull(skb, QCA_HDR_LEN)))
+ 		return NULL;
+ 
+@@ -53,13 +59,19 @@ static struct sk_buff *qca_tag_rcv(struc
+ 	/* Get pk type */
+ 	pk_type = FIELD_GET(QCA_HDR_RECV_TYPE, hdr);
+ 
+-	/* Ethernet MDIO read/write packet */
+-	if (pk_type == QCA_HDR_RECV_TYPE_RW_REG_ACK)
++	/* Ethernet mgmt read/write packet */
++	if (pk_type == QCA_HDR_RECV_TYPE_RW_REG_ACK) {
++		if (likely(tagger_data->rw_reg_ack_handler))
++			tagger_data->rw_reg_ack_handler(ds, skb);
+ 		return NULL;
++	}
+ 
+ 	/* Ethernet MIB counter packet */
+-	if (pk_type == QCA_HDR_RECV_TYPE_MIB)
++	if (pk_type == QCA_HDR_RECV_TYPE_MIB) {
++		if (likely(tagger_data->mib_autocast_handler))
++			tagger_data->mib_autocast_handler(ds, skb);
+ 		return NULL;
++	}
+ 
+ 	/* Remove QCA tag and recalculate checksum */
+ 	skb_pull_rcsum(skb, QCA_HDR_LEN);
+@@ -75,9 +87,30 @@ static struct sk_buff *qca_tag_rcv(struc
+ 	return skb;
+ }
+ 
++static int qca_tag_connect(struct dsa_switch *ds)
++{
++	struct qca_tagger_data *tagger_data;
++
++	tagger_data = kzalloc(sizeof(*tagger_data), GFP_KERNEL);
++	if (!tagger_data)
++		return -ENOMEM;
++
++	ds->tagger_data = tagger_data;
++
++	return 0;
++}
++
++static void qca_tag_disconnect(struct dsa_switch *ds)
++{
++	kfree(ds->tagger_data);
++	ds->tagger_data = NULL;
++}
++
+ static const struct dsa_device_ops qca_netdev_ops = {
+ 	.name	= "qca",
+ 	.proto	= DSA_TAG_PROTO_QCA,
++	.connect = qca_tag_connect,
++	.disconnect = qca_tag_disconnect,
+ 	.xmit	= qca_tag_xmit,
+ 	.rcv	= qca_tag_rcv,
+ 	.needed_headroom = QCA_HDR_LEN,
diff --git a/target/linux/generic/backport-5.15/766-v5.18-09-net-dsa-qca8k-add-tracking-state-of-master-port.patch b/target/linux/generic/backport-5.15/766-v5.18-09-net-dsa-qca8k-add-tracking-state-of-master-port.patch
new file mode 100644
index 00000000000000..eb21cc3912461c
--- /dev/null
+++ b/target/linux/generic/backport-5.15/766-v5.18-09-net-dsa-qca8k-add-tracking-state-of-master-port.patch
@@ -0,0 +1,67 @@
+From cddbec19466a1dfb4d45ddd507d9f09f991d54ae Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Wed, 2 Feb 2022 01:03:28 +0100
+Subject: [PATCH 09/16] net: dsa: qca8k: add tracking state of master port
+
+MDIO/MIB Ethernet require the master port and the tagger availabale to
+correctly work. Use the new api master_state_change to track when master
+is operational or not and set a bool in qca8k_priv.
+We cache the first cached master available and we check if other cpu
+port are operational when the cached one goes down.
+This cached master will later be used by mdio read/write and mib request to
+correctly use the working function.
+
+qca8k implementation for MDIO/MIB Ethernet is bad. CPU port0 is the only
+one that answers with the ack packet or sends MIB Ethernet packets. For
+this reason the master_state_change ignore CPU port6 and only checks
+CPU port0 if it's operational and enables this mode.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 15 +++++++++++++++
+ drivers/net/dsa/qca8k.h |  1 +
+ 2 files changed, 16 insertions(+)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -2401,6 +2401,20 @@ qca8k_port_lag_leave(struct dsa_switch *
+ 	return qca8k_lag_refresh_portmap(ds, port, lag, true);
+ }
+ 
++static void
++qca8k_master_change(struct dsa_switch *ds, const struct net_device *master,
++		    bool operational)
++{
++	struct dsa_port *dp = master->dsa_ptr;
++	struct qca8k_priv *priv = ds->priv;
++
++	/* Ethernet MIB/MDIO is only supported for CPU port 0 */
++	if (dp->index != 0)
++		return;
++
++	priv->mgmt_master = operational ? (struct net_device *)master : NULL;
++}
++
+ static const struct dsa_switch_ops qca8k_switch_ops = {
+ 	.get_tag_protocol	= qca8k_get_tag_protocol,
+ 	.setup			= qca8k_setup,
+@@ -2436,6 +2450,7 @@ static const struct dsa_switch_ops qca8k
+ 	.get_phy_flags		= qca8k_get_phy_flags,
+ 	.port_lag_join		= qca8k_port_lag_join,
+ 	.port_lag_leave		= qca8k_port_lag_leave,
++	.master_state_change	= qca8k_master_change,
+ };
+ 
+ static int qca8k_read_switch_id(struct qca8k_priv *priv)
+--- a/drivers/net/dsa/qca8k.h
++++ b/drivers/net/dsa/qca8k.h
+@@ -353,6 +353,7 @@ struct qca8k_priv {
+ 	struct dsa_switch_ops ops;
+ 	struct gpio_desc *reset_gpio;
+ 	unsigned int port_mtu[QCA8K_NUM_PORTS];
++	struct net_device *mgmt_master; /* Track if mdio/mib Ethernet is available */
+ };
+ 
+ struct qca8k_mib_desc {
diff --git a/target/linux/generic/backport-5.15/766-v5.18-10-net-dsa-qca8k-add-support-for-mgmt-read-write-in-Eth.patch b/target/linux/generic/backport-5.15/766-v5.18-10-net-dsa-qca8k-add-support-for-mgmt-read-write-in-Eth.patch
new file mode 100644
index 00000000000000..07c5ba46210057
--- /dev/null
+++ b/target/linux/generic/backport-5.15/766-v5.18-10-net-dsa-qca8k-add-support-for-mgmt-read-write-in-Eth.patch
@@ -0,0 +1,363 @@
+From 5950c7c0a68c915b336c70f79388626e2d576ab7 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Wed, 2 Feb 2022 01:03:29 +0100
+Subject: [PATCH 10/16] net: dsa: qca8k: add support for mgmt read/write in
+ Ethernet packet
+
+Add qca8k side support for mgmt read/write in Ethernet packet.
+qca8k supports some specially crafted Ethernet packet that can be used
+for mgmt read/write instead of the legacy method uart/internal mdio.
+This add support for the qca8k side to craft the packet and enqueue it.
+Each port and the qca8k_priv have a special struct to put data in it.
+The completion API is used to wait for the packet to be received back
+with the requested data.
+
+The various steps are:
+1. Craft the special packet with the qca hdr set to mgmt read/write
+   mode.
+2. Set the lock in the dedicated mgmt struct.
+3. Increment the seq number and set it in the mgmt pkt
+4. Reinit the completion.
+5. Enqueue the packet.
+6. Wait the packet to be received.
+7. Use the data set by the tagger to complete the mdio operation.
+
+If the completion timeouts or the ack value is not true, the legacy
+mdio way is used.
+
+It has to be considered that in the initial setup mdio is still used and
+mdio is still used until DSA is ready to accept and tag packet.
+
+tag_proto_connect() is used to fill the required handler for the tagger
+to correctly parse and elaborate the special Ethernet mdio packet.
+
+Locking is added to qca8k_master_change() to make sure no mgmt Ethernet
+are in progress.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 225 ++++++++++++++++++++++++++++++++++++++++
+ drivers/net/dsa/qca8k.h |  13 +++
+ 2 files changed, 238 insertions(+)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -20,6 +20,7 @@
+ #include <linux/phylink.h>
+ #include <linux/gpio/consumer.h>
+ #include <linux/etherdevice.h>
++#include <linux/dsa/tag_qca.h>
+ 
+ #include "qca8k.h"
+ 
+@@ -170,6 +171,194 @@ qca8k_rmw(struct qca8k_priv *priv, u32 r
+ 	return regmap_update_bits(priv->regmap, reg, mask, write_val);
+ }
+ 
++static void qca8k_rw_reg_ack_handler(struct dsa_switch *ds, struct sk_buff *skb)
++{
++	struct qca8k_mgmt_eth_data *mgmt_eth_data;
++	struct qca8k_priv *priv = ds->priv;
++	struct qca_mgmt_ethhdr *mgmt_ethhdr;
++	u8 len, cmd;
++
++	mgmt_ethhdr = (struct qca_mgmt_ethhdr *)skb_mac_header(skb);
++	mgmt_eth_data = &priv->mgmt_eth_data;
++
++	cmd = FIELD_GET(QCA_HDR_MGMT_CMD, mgmt_ethhdr->command);
++	len = FIELD_GET(QCA_HDR_MGMT_LENGTH, mgmt_ethhdr->command);
++
++	/* Make sure the seq match the requested packet */
++	if (mgmt_ethhdr->seq == mgmt_eth_data->seq)
++		mgmt_eth_data->ack = true;
++
++	if (cmd == MDIO_READ) {
++		mgmt_eth_data->data[0] = mgmt_ethhdr->mdio_data;
++
++		/* Get the rest of the 12 byte of data */
++		if (len > QCA_HDR_MGMT_DATA1_LEN)
++			memcpy(mgmt_eth_data->data + 1, skb->data,
++			       QCA_HDR_MGMT_DATA2_LEN);
++	}
++
++	complete(&mgmt_eth_data->rw_done);
++}
++
++static struct sk_buff *qca8k_alloc_mdio_header(enum mdio_cmd cmd, u32 reg, u32 *val,
++					       int priority)
++{
++	struct qca_mgmt_ethhdr *mgmt_ethhdr;
++	struct sk_buff *skb;
++	u16 hdr;
++
++	skb = dev_alloc_skb(QCA_HDR_MGMT_PKT_LEN);
++	if (!skb)
++		return NULL;
++
++	skb_reset_mac_header(skb);
++	skb_set_network_header(skb, skb->len);
++
++	mgmt_ethhdr = skb_push(skb, QCA_HDR_MGMT_HEADER_LEN + QCA_HDR_LEN);
++
++	hdr = FIELD_PREP(QCA_HDR_XMIT_VERSION, QCA_HDR_VERSION);
++	hdr |= FIELD_PREP(QCA_HDR_XMIT_PRIORITY, priority);
++	hdr |= QCA_HDR_XMIT_FROM_CPU;
++	hdr |= FIELD_PREP(QCA_HDR_XMIT_DP_BIT, BIT(0));
++	hdr |= FIELD_PREP(QCA_HDR_XMIT_CONTROL, QCA_HDR_XMIT_TYPE_RW_REG);
++
++	mgmt_ethhdr->command = FIELD_PREP(QCA_HDR_MGMT_ADDR, reg);
++	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_LENGTH, 4);
++	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_CMD, cmd);
++	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_CHECK_CODE,
++					   QCA_HDR_MGMT_CHECK_CODE_VAL);
++
++	if (cmd == MDIO_WRITE)
++		mgmt_ethhdr->mdio_data = *val;
++
++	mgmt_ethhdr->hdr = htons(hdr);
++
++	skb_put_zero(skb, QCA_HDR_MGMT_DATA2_LEN + QCA_HDR_MGMT_PADDING_LEN);
++
++	return skb;
++}
++
++static void qca8k_mdio_header_fill_seq_num(struct sk_buff *skb, u32 seq_num)
++{
++	struct qca_mgmt_ethhdr *mgmt_ethhdr;
++
++	mgmt_ethhdr = (struct qca_mgmt_ethhdr *)skb->data;
++	mgmt_ethhdr->seq = FIELD_PREP(QCA_HDR_MGMT_SEQ_NUM, seq_num);
++}
++
++static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val)
++{
++	struct qca8k_mgmt_eth_data *mgmt_eth_data = &priv->mgmt_eth_data;
++	struct sk_buff *skb;
++	bool ack;
++	int ret;
++
++	skb = qca8k_alloc_mdio_header(MDIO_READ, reg, NULL,
++				      QCA8K_ETHERNET_MDIO_PRIORITY);
++	if (!skb)
++		return -ENOMEM;
++
++	mutex_lock(&mgmt_eth_data->mutex);
++
++	/* Check mgmt_master if is operational */
++	if (!priv->mgmt_master) {
++		kfree_skb(skb);
++		mutex_unlock(&mgmt_eth_data->mutex);
++		return -EINVAL;
++	}
++
++	skb->dev = priv->mgmt_master;
++
++	reinit_completion(&mgmt_eth_data->rw_done);
++
++	/* Increment seq_num and set it in the mdio pkt */
++	mgmt_eth_data->seq++;
++	qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
++	mgmt_eth_data->ack = false;
++
++	dev_queue_xmit(skb);
++
++	ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
++					  msecs_to_jiffies(QCA8K_ETHERNET_TIMEOUT));
++
++	*val = mgmt_eth_data->data[0];
++	ack = mgmt_eth_data->ack;
++
++	mutex_unlock(&mgmt_eth_data->mutex);
++
++	if (ret <= 0)
++		return -ETIMEDOUT;
++
++	if (!ack)
++		return -EINVAL;
++
++	return 0;
++}
++
++static int qca8k_write_eth(struct qca8k_priv *priv, u32 reg, u32 val)
++{
++	struct qca8k_mgmt_eth_data *mgmt_eth_data = &priv->mgmt_eth_data;
++	struct sk_buff *skb;
++	bool ack;
++	int ret;
++
++	skb = qca8k_alloc_mdio_header(MDIO_WRITE, reg, &val,
++				      QCA8K_ETHERNET_MDIO_PRIORITY);
++	if (!skb)
++		return -ENOMEM;
++
++	mutex_lock(&mgmt_eth_data->mutex);
++
++	/* Check mgmt_master if is operational */
++	if (!priv->mgmt_master) {
++		kfree_skb(skb);
++		mutex_unlock(&mgmt_eth_data->mutex);
++		return -EINVAL;
++	}
++
++	skb->dev = priv->mgmt_master;
++
++	reinit_completion(&mgmt_eth_data->rw_done);
++
++	/* Increment seq_num and set it in the mdio pkt */
++	mgmt_eth_data->seq++;
++	qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
++	mgmt_eth_data->ack = false;
++
++	dev_queue_xmit(skb);
++
++	ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
++					  msecs_to_jiffies(QCA8K_ETHERNET_TIMEOUT));
++
++	ack = mgmt_eth_data->ack;
++
++	mutex_unlock(&mgmt_eth_data->mutex);
++
++	if (ret <= 0)
++		return -ETIMEDOUT;
++
++	if (!ack)
++		return -EINVAL;
++
++	return 0;
++}
++
++static int
++qca8k_regmap_update_bits_eth(struct qca8k_priv *priv, u32 reg, u32 mask, u32 write_val)
++{
++	u32 val = 0;
++	int ret;
++
++	ret = qca8k_read_eth(priv, reg, &val);
++	if (ret)
++		return ret;
++
++	val &= ~mask;
++	val |= write_val;
++
++	return qca8k_write_eth(priv, reg, val);
++}
++
+ static int
+ qca8k_regmap_read(void *ctx, uint32_t reg, uint32_t *val)
+ {
+@@ -178,6 +367,9 @@ qca8k_regmap_read(void *ctx, uint32_t re
+ 	u16 r1, r2, page;
+ 	int ret;
+ 
++	if (!qca8k_read_eth(priv, reg, val))
++		return 0;
++
+ 	qca8k_split_addr(reg, &r1, &r2, &page);
+ 
+ 	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+@@ -201,6 +393,9 @@ qca8k_regmap_write(void *ctx, uint32_t r
+ 	u16 r1, r2, page;
+ 	int ret;
+ 
++	if (!qca8k_write_eth(priv, reg, val))
++		return 0;
++
+ 	qca8k_split_addr(reg, &r1, &r2, &page);
+ 
+ 	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+@@ -225,6 +420,9 @@ qca8k_regmap_update_bits(void *ctx, uint
+ 	u32 val;
+ 	int ret;
+ 
++	if (!qca8k_regmap_update_bits_eth(priv, reg, mask, write_val))
++		return 0;
++
+ 	qca8k_split_addr(reg, &r1, &r2, &page);
+ 
+ 	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+@@ -2412,7 +2610,30 @@ qca8k_master_change(struct dsa_switch *d
+ 	if (dp->index != 0)
+ 		return;
+ 
++	mutex_lock(&priv->mgmt_eth_data.mutex);
++
+ 	priv->mgmt_master = operational ? (struct net_device *)master : NULL;
++
++	mutex_unlock(&priv->mgmt_eth_data.mutex);
++}
++
++static int qca8k_connect_tag_protocol(struct dsa_switch *ds,
++				      enum dsa_tag_protocol proto)
++{
++	struct qca_tagger_data *tagger_data;
++
++	switch (proto) {
++	case DSA_TAG_PROTO_QCA:
++		tagger_data = ds->tagger_data;
++
++		tagger_data->rw_reg_ack_handler = qca8k_rw_reg_ack_handler;
++
++		break;
++	default:
++		return -EOPNOTSUPP;
++	}
++
++	return 0;
+ }
+ 
+ static const struct dsa_switch_ops qca8k_switch_ops = {
+@@ -2451,6 +2672,7 @@ static const struct dsa_switch_ops qca8k
+ 	.port_lag_join		= qca8k_port_lag_join,
+ 	.port_lag_leave		= qca8k_port_lag_leave,
+ 	.master_state_change	= qca8k_master_change,
++	.connect_tag_protocol	= qca8k_connect_tag_protocol,
+ };
+ 
+ static int qca8k_read_switch_id(struct qca8k_priv *priv)
+@@ -2530,6 +2752,9 @@ qca8k_sw_probe(struct mdio_device *mdiod
+ 	if (!priv->ds)
+ 		return -ENOMEM;
+ 
++	mutex_init(&priv->mgmt_eth_data.mutex);
++	init_completion(&priv->mgmt_eth_data.rw_done);
++
+ 	priv->ds->dev = &mdiodev->dev;
+ 	priv->ds->num_ports = QCA8K_NUM_PORTS;
+ 	priv->ds->priv = priv;
+--- a/drivers/net/dsa/qca8k.h
++++ b/drivers/net/dsa/qca8k.h
+@@ -11,6 +11,10 @@
+ #include <linux/delay.h>
+ #include <linux/regmap.h>
+ #include <linux/gpio.h>
++#include <linux/dsa/tag_qca.h>
++
++#define QCA8K_ETHERNET_MDIO_PRIORITY			7
++#define QCA8K_ETHERNET_TIMEOUT				100
+ 
+ #define QCA8K_NUM_PORTS					7
+ #define QCA8K_NUM_CPU_PORTS				2
+@@ -328,6 +332,14 @@ enum {
+ 	QCA8K_CPU_PORT6,
+ };
+ 
++struct qca8k_mgmt_eth_data {
++	struct completion rw_done;
++	struct mutex mutex; /* Enforce one mdio read/write at time */
++	bool ack;
++	u32 seq;
++	u32 data[4];
++};
++
+ struct qca8k_ports_config {
+ 	bool sgmii_rx_clk_falling_edge;
+ 	bool sgmii_tx_clk_falling_edge;
+@@ -354,6 +366,7 @@ struct qca8k_priv {
+ 	struct gpio_desc *reset_gpio;
+ 	unsigned int port_mtu[QCA8K_NUM_PORTS];
+ 	struct net_device *mgmt_master; /* Track if mdio/mib Ethernet is available */
++	struct qca8k_mgmt_eth_data mgmt_eth_data;
+ };
+ 
+ struct qca8k_mib_desc {
diff --git a/target/linux/generic/backport-5.15/766-v5.18-11-net-dsa-qca8k-add-support-for-mib-autocast-in-Ethern.patch b/target/linux/generic/backport-5.15/766-v5.18-11-net-dsa-qca8k-add-support-for-mib-autocast-in-Ethern.patch
new file mode 100644
index 00000000000000..0dcf279433837d
--- /dev/null
+++ b/target/linux/generic/backport-5.15/766-v5.18-11-net-dsa-qca8k-add-support-for-mib-autocast-in-Ethern.patch
@@ -0,0 +1,226 @@
+From 5c957c7ca78cce5e4b96866722b0115bd758d945 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Wed, 2 Feb 2022 01:03:30 +0100
+Subject: [PATCH 11/16] net: dsa: qca8k: add support for mib autocast in
+ Ethernet packet
+
+The switch can autocast MIB counter using Ethernet packet.
+Add support for this and provide a handler for the tagger.
+The switch will send packet with MIB counter for each port, the switch
+will use completion API to wait for the correct packet to be received
+and will complete the task only when each packet is received.
+Although the handler will drop all the other packet, we still have to
+consume each MIB packet to complete the request. This is done to prevent
+mixed data with concurrent ethtool request.
+
+connect_tag_protocol() is used to add the handler to the tag_qca tagger,
+master_state_change() use the MIB lock to make sure no MIB Ethernet is
+in progress.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 106 +++++++++++++++++++++++++++++++++++++++-
+ drivers/net/dsa/qca8k.h |  17 ++++++-
+ 2 files changed, 121 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -830,7 +830,10 @@ qca8k_mib_init(struct qca8k_priv *priv)
+ 	int ret;
+ 
+ 	mutex_lock(&priv->reg_mutex);
+-	ret = regmap_set_bits(priv->regmap, QCA8K_REG_MIB, QCA8K_MIB_FLUSH | QCA8K_MIB_BUSY);
++	ret = regmap_update_bits(priv->regmap, QCA8K_REG_MIB,
++				 QCA8K_MIB_FUNC | QCA8K_MIB_BUSY,
++				 FIELD_PREP(QCA8K_MIB_FUNC, QCA8K_MIB_FLUSH) |
++				 QCA8K_MIB_BUSY);
+ 	if (ret)
+ 		goto exit;
+ 
+@@ -1901,6 +1904,97 @@ qca8k_get_strings(struct dsa_switch *ds,
+ 			ETH_GSTRING_LEN);
+ }
+ 
++static void qca8k_mib_autocast_handler(struct dsa_switch *ds, struct sk_buff *skb)
++{
++	const struct qca8k_match_data *match_data;
++	struct qca8k_mib_eth_data *mib_eth_data;
++	struct qca8k_priv *priv = ds->priv;
++	const struct qca8k_mib_desc *mib;
++	struct mib_ethhdr *mib_ethhdr;
++	int i, mib_len, offset = 0;
++	u64 *data;
++	u8 port;
++
++	mib_ethhdr = (struct mib_ethhdr *)skb_mac_header(skb);
++	mib_eth_data = &priv->mib_eth_data;
++
++	/* The switch autocast every port. Ignore other packet and
++	 * parse only the requested one.
++	 */
++	port = FIELD_GET(QCA_HDR_RECV_SOURCE_PORT, ntohs(mib_ethhdr->hdr));
++	if (port != mib_eth_data->req_port)
++		goto exit;
++
++	match_data = device_get_match_data(priv->dev);
++	data = mib_eth_data->data;
++
++	for (i = 0; i < match_data->mib_count; i++) {
++		mib = &ar8327_mib[i];
++
++		/* First 3 mib are present in the skb head */
++		if (i < 3) {
++			data[i] = mib_ethhdr->data[i];
++			continue;
++		}
++
++		mib_len = sizeof(uint32_t);
++
++		/* Some mib are 64 bit wide */
++		if (mib->size == 2)
++			mib_len = sizeof(uint64_t);
++
++		/* Copy the mib value from packet to the */
++		memcpy(data + i, skb->data + offset, mib_len);
++
++		/* Set the offset for the next mib */
++		offset += mib_len;
++	}
++
++exit:
++	/* Complete on receiving all the mib packet */
++	if (refcount_dec_and_test(&mib_eth_data->port_parsed))
++		complete(&mib_eth_data->rw_done);
++}
++
++static int
++qca8k_get_ethtool_stats_eth(struct dsa_switch *ds, int port, u64 *data)
++{
++	struct dsa_port *dp = dsa_to_port(ds, port);
++	struct qca8k_mib_eth_data *mib_eth_data;
++	struct qca8k_priv *priv = ds->priv;
++	int ret;
++
++	mib_eth_data = &priv->mib_eth_data;
++
++	mutex_lock(&mib_eth_data->mutex);
++
++	reinit_completion(&mib_eth_data->rw_done);
++
++	mib_eth_data->req_port = dp->index;
++	mib_eth_data->data = data;
++	refcount_set(&mib_eth_data->port_parsed, QCA8K_NUM_PORTS);
++
++	mutex_lock(&priv->reg_mutex);
++
++	/* Send mib autocast request */
++	ret = regmap_update_bits(priv->regmap, QCA8K_REG_MIB,
++				 QCA8K_MIB_FUNC | QCA8K_MIB_BUSY,
++				 FIELD_PREP(QCA8K_MIB_FUNC, QCA8K_MIB_CAST) |
++				 QCA8K_MIB_BUSY);
++
++	mutex_unlock(&priv->reg_mutex);
++
++	if (ret)
++		goto exit;
++
++	ret = wait_for_completion_timeout(&mib_eth_data->rw_done, QCA8K_ETHERNET_TIMEOUT);
++
++exit:
++	mutex_unlock(&mib_eth_data->mutex);
++
++	return ret;
++}
++
+ static void
+ qca8k_get_ethtool_stats(struct dsa_switch *ds, int port,
+ 			uint64_t *data)
+@@ -1912,6 +2006,10 @@ qca8k_get_ethtool_stats(struct dsa_switc
+ 	u32 hi = 0;
+ 	int ret;
+ 
++	if (priv->mgmt_master &&
++	    qca8k_get_ethtool_stats_eth(ds, port, data) > 0)
++		return;
++
+ 	match_data = of_device_get_match_data(priv->dev);
+ 
+ 	for (i = 0; i < match_data->mib_count; i++) {
+@@ -2611,9 +2709,11 @@ qca8k_master_change(struct dsa_switch *d
+ 		return;
+ 
+ 	mutex_lock(&priv->mgmt_eth_data.mutex);
++	mutex_lock(&priv->mib_eth_data.mutex);
+ 
+ 	priv->mgmt_master = operational ? (struct net_device *)master : NULL;
+ 
++	mutex_unlock(&priv->mib_eth_data.mutex);
+ 	mutex_unlock(&priv->mgmt_eth_data.mutex);
+ }
+ 
+@@ -2627,6 +2727,7 @@ static int qca8k_connect_tag_protocol(st
+ 		tagger_data = ds->tagger_data;
+ 
+ 		tagger_data->rw_reg_ack_handler = qca8k_rw_reg_ack_handler;
++		tagger_data->mib_autocast_handler = qca8k_mib_autocast_handler;
+ 
+ 		break;
+ 	default:
+@@ -2755,6 +2856,9 @@ qca8k_sw_probe(struct mdio_device *mdiod
+ 	mutex_init(&priv->mgmt_eth_data.mutex);
+ 	init_completion(&priv->mgmt_eth_data.rw_done);
+ 
++	mutex_init(&priv->mib_eth_data.mutex);
++	init_completion(&priv->mib_eth_data.rw_done);
++
+ 	priv->ds->dev = &mdiodev->dev;
+ 	priv->ds->num_ports = QCA8K_NUM_PORTS;
+ 	priv->ds->priv = priv;
+--- a/drivers/net/dsa/qca8k.h
++++ b/drivers/net/dsa/qca8k.h
+@@ -67,7 +67,7 @@
+ #define QCA8K_REG_MODULE_EN				0x030
+ #define   QCA8K_MODULE_EN_MIB				BIT(0)
+ #define QCA8K_REG_MIB					0x034
+-#define   QCA8K_MIB_FLUSH				BIT(24)
++#define   QCA8K_MIB_FUNC				GENMASK(26, 24)
+ #define   QCA8K_MIB_CPU_KEEP				BIT(20)
+ #define   QCA8K_MIB_BUSY				BIT(17)
+ #define QCA8K_MDIO_MASTER_CTRL				0x3c
+@@ -317,6 +317,12 @@ enum qca8k_vlan_cmd {
+ 	QCA8K_VLAN_READ = 6,
+ };
+ 
++enum qca8k_mid_cmd {
++	QCA8K_MIB_FLUSH = 1,
++	QCA8K_MIB_FLUSH_PORT = 2,
++	QCA8K_MIB_CAST = 3,
++};
++
+ struct ar8xxx_port_status {
+ 	int enabled;
+ };
+@@ -340,6 +346,14 @@ struct qca8k_mgmt_eth_data {
+ 	u32 data[4];
+ };
+ 
++struct qca8k_mib_eth_data {
++	struct completion rw_done;
++	struct mutex mutex; /* Process one command at time */
++	refcount_t port_parsed; /* Counter to track parsed port */
++	u8 req_port;
++	u64 *data; /* pointer to ethtool data */
++};
++
+ struct qca8k_ports_config {
+ 	bool sgmii_rx_clk_falling_edge;
+ 	bool sgmii_tx_clk_falling_edge;
+@@ -367,6 +381,7 @@ struct qca8k_priv {
+ 	unsigned int port_mtu[QCA8K_NUM_PORTS];
+ 	struct net_device *mgmt_master; /* Track if mdio/mib Ethernet is available */
+ 	struct qca8k_mgmt_eth_data mgmt_eth_data;
++	struct qca8k_mib_eth_data mib_eth_data;
+ };
+ 
+ struct qca8k_mib_desc {
diff --git a/target/linux/generic/backport-5.15/766-v5.18-12-net-dsa-qca8k-add-support-for-phy-read-write-with-mg.patch b/target/linux/generic/backport-5.15/766-v5.18-12-net-dsa-qca8k-add-support-for-phy-read-write-with-mg.patch
new file mode 100644
index 00000000000000..f5899eb5901a19
--- /dev/null
+++ b/target/linux/generic/backport-5.15/766-v5.18-12-net-dsa-qca8k-add-support-for-phy-read-write-with-mg.patch
@@ -0,0 +1,287 @@
+From 2cd5485663847d468dc207b3ff85fb1fab44d97f Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Wed, 2 Feb 2022 01:03:31 +0100
+Subject: [PATCH 12/16] net: dsa: qca8k: add support for phy read/write with
+ mgmt Ethernet
+
+Use mgmt Ethernet also for phy read/write if availabale. Use a different
+seq number to make sure we receive the correct packet.
+On any error, we fallback to the legacy mdio read/write.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 216 ++++++++++++++++++++++++++++++++++++++++
+ drivers/net/dsa/qca8k.h |   1 +
+ 2 files changed, 217 insertions(+)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -867,6 +867,199 @@ qca8k_port_set_status(struct qca8k_priv
+ 		regmap_clear_bits(priv->regmap, QCA8K_REG_PORT_STATUS(port), mask);
+ }
+ 
++static int
++qca8k_phy_eth_busy_wait(struct qca8k_mgmt_eth_data *mgmt_eth_data,
++			struct sk_buff *read_skb, u32 *val)
++{
++	struct sk_buff *skb = skb_copy(read_skb, GFP_KERNEL);
++	bool ack;
++	int ret;
++
++	reinit_completion(&mgmt_eth_data->rw_done);
++
++	/* Increment seq_num and set it in the copy pkt */
++	mgmt_eth_data->seq++;
++	qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
++	mgmt_eth_data->ack = false;
++
++	dev_queue_xmit(skb);
++
++	ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
++					  QCA8K_ETHERNET_TIMEOUT);
++
++	ack = mgmt_eth_data->ack;
++
++	if (ret <= 0)
++		return -ETIMEDOUT;
++
++	if (!ack)
++		return -EINVAL;
++
++	*val = mgmt_eth_data->data[0];
++
++	return 0;
++}
++
++static int
++qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
++		      int regnum, u16 data)
++{
++	struct sk_buff *write_skb, *clear_skb, *read_skb;
++	struct qca8k_mgmt_eth_data *mgmt_eth_data;
++	u32 write_val, clear_val = 0, val;
++	struct net_device *mgmt_master;
++	int ret, ret1;
++	bool ack;
++
++	if (regnum >= QCA8K_MDIO_MASTER_MAX_REG)
++		return -EINVAL;
++
++	mgmt_eth_data = &priv->mgmt_eth_data;
++
++	write_val = QCA8K_MDIO_MASTER_BUSY | QCA8K_MDIO_MASTER_EN |
++		    QCA8K_MDIO_MASTER_PHY_ADDR(phy) |
++		    QCA8K_MDIO_MASTER_REG_ADDR(regnum);
++
++	if (read) {
++		write_val |= QCA8K_MDIO_MASTER_READ;
++	} else {
++		write_val |= QCA8K_MDIO_MASTER_WRITE;
++		write_val |= QCA8K_MDIO_MASTER_DATA(data);
++	}
++
++	/* Prealloc all the needed skb before the lock */
++	write_skb = qca8k_alloc_mdio_header(MDIO_WRITE, QCA8K_MDIO_MASTER_CTRL,
++					    &write_val, QCA8K_ETHERNET_PHY_PRIORITY);
++	if (!write_skb)
++		return -ENOMEM;
++
++	clear_skb = qca8k_alloc_mdio_header(MDIO_WRITE, QCA8K_MDIO_MASTER_CTRL,
++					    &clear_val, QCA8K_ETHERNET_PHY_PRIORITY);
++	if (!write_skb) {
++		ret = -ENOMEM;
++		goto err_clear_skb;
++	}
++
++	read_skb = qca8k_alloc_mdio_header(MDIO_READ, QCA8K_MDIO_MASTER_CTRL,
++					   &clear_val, QCA8K_ETHERNET_PHY_PRIORITY);
++	if (!write_skb) {
++		ret = -ENOMEM;
++		goto err_read_skb;
++	}
++
++	/* Actually start the request:
++	 * 1. Send mdio master packet
++	 * 2. Busy Wait for mdio master command
++	 * 3. Get the data if we are reading
++	 * 4. Reset the mdio master (even with error)
++	 */
++	mutex_lock(&mgmt_eth_data->mutex);
++
++	/* Check if mgmt_master is operational */
++	mgmt_master = priv->mgmt_master;
++	if (!mgmt_master) {
++		mutex_unlock(&mgmt_eth_data->mutex);
++		ret = -EINVAL;
++		goto err_mgmt_master;
++	}
++
++	read_skb->dev = mgmt_master;
++	clear_skb->dev = mgmt_master;
++	write_skb->dev = mgmt_master;
++
++	reinit_completion(&mgmt_eth_data->rw_done);
++
++	/* Increment seq_num and set it in the write pkt */
++	mgmt_eth_data->seq++;
++	qca8k_mdio_header_fill_seq_num(write_skb, mgmt_eth_data->seq);
++	mgmt_eth_data->ack = false;
++
++	dev_queue_xmit(write_skb);
++
++	ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
++					  QCA8K_ETHERNET_TIMEOUT);
++
++	ack = mgmt_eth_data->ack;
++
++	if (ret <= 0) {
++		ret = -ETIMEDOUT;
++		kfree_skb(read_skb);
++		goto exit;
++	}
++
++	if (!ack) {
++		ret = -EINVAL;
++		kfree_skb(read_skb);
++		goto exit;
++	}
++
++	ret = read_poll_timeout(qca8k_phy_eth_busy_wait, ret1,
++				!(val & QCA8K_MDIO_MASTER_BUSY), 0,
++				QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC, false,
++				mgmt_eth_data, read_skb, &val);
++
++	if (ret < 0 && ret1 < 0) {
++		ret = ret1;
++		goto exit;
++	}
++
++	if (read) {
++		reinit_completion(&mgmt_eth_data->rw_done);
++
++		/* Increment seq_num and set it in the read pkt */
++		mgmt_eth_data->seq++;
++		qca8k_mdio_header_fill_seq_num(read_skb, mgmt_eth_data->seq);
++		mgmt_eth_data->ack = false;
++
++		dev_queue_xmit(read_skb);
++
++		ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
++						  QCA8K_ETHERNET_TIMEOUT);
++
++		ack = mgmt_eth_data->ack;
++
++		if (ret <= 0) {
++			ret = -ETIMEDOUT;
++			goto exit;
++		}
++
++		if (!ack) {
++			ret = -EINVAL;
++			goto exit;
++		}
++
++		ret = mgmt_eth_data->data[0] & QCA8K_MDIO_MASTER_DATA_MASK;
++	} else {
++		kfree_skb(read_skb);
++	}
++exit:
++	reinit_completion(&mgmt_eth_data->rw_done);
++
++	/* Increment seq_num and set it in the clear pkt */
++	mgmt_eth_data->seq++;
++	qca8k_mdio_header_fill_seq_num(clear_skb, mgmt_eth_data->seq);
++	mgmt_eth_data->ack = false;
++
++	dev_queue_xmit(clear_skb);
++
++	wait_for_completion_timeout(&mgmt_eth_data->rw_done,
++				    QCA8K_ETHERNET_TIMEOUT);
++
++	mutex_unlock(&mgmt_eth_data->mutex);
++
++	return ret;
++
++	/* Error handling before lock */
++err_mgmt_master:
++	kfree_skb(read_skb);
++err_read_skb:
++	kfree_skb(clear_skb);
++err_clear_skb:
++	kfree_skb(write_skb);
++
++	return ret;
++}
++
+ static u32
+ qca8k_port_to_phy(int port)
+ {
+@@ -989,6 +1182,12 @@ qca8k_internal_mdio_write(struct mii_bus
+ {
+ 	struct qca8k_priv *priv = slave_bus->priv;
+ 	struct mii_bus *bus = priv->bus;
++	int ret;
++
++	/* Use mdio Ethernet when available, fallback to legacy one on error */
++	ret = qca8k_phy_eth_command(priv, false, phy, regnum, data);
++	if (!ret)
++		return 0;
+ 
+ 	return qca8k_mdio_write(bus, phy, regnum, data);
+ }
+@@ -998,6 +1197,12 @@ qca8k_internal_mdio_read(struct mii_bus
+ {
+ 	struct qca8k_priv *priv = slave_bus->priv;
+ 	struct mii_bus *bus = priv->bus;
++	int ret;
++
++	/* Use mdio Ethernet when available, fallback to legacy one on error */
++	ret = qca8k_phy_eth_command(priv, true, phy, regnum, 0);
++	if (ret >= 0)
++		return ret;
+ 
+ 	return qca8k_mdio_read(bus, phy, regnum);
+ }
+@@ -1006,6 +1211,7 @@ static int
+ qca8k_phy_write(struct dsa_switch *ds, int port, int regnum, u16 data)
+ {
+ 	struct qca8k_priv *priv = ds->priv;
++	int ret;
+ 
+ 	/* Check if the legacy mapping should be used and the
+ 	 * port is not correctly mapped to the right PHY in the
+@@ -1014,6 +1220,11 @@ qca8k_phy_write(struct dsa_switch *ds, i
+ 	if (priv->legacy_phy_port_mapping)
+ 		port = qca8k_port_to_phy(port) % PHY_MAX_ADDR;
+ 
++	/* Use mdio Ethernet when available, fallback to legacy one on error */
++	ret = qca8k_phy_eth_command(priv, false, port, regnum, 0);
++	if (!ret)
++		return ret;
++
+ 	return qca8k_mdio_write(priv->bus, port, regnum, data);
+ }
+ 
+@@ -1030,6 +1241,11 @@ qca8k_phy_read(struct dsa_switch *ds, in
+ 	if (priv->legacy_phy_port_mapping)
+ 		port = qca8k_port_to_phy(port) % PHY_MAX_ADDR;
+ 
++	/* Use mdio Ethernet when available, fallback to legacy one on error */
++	ret = qca8k_phy_eth_command(priv, true, port, regnum, 0);
++	if (ret >= 0)
++		return ret;
++
+ 	ret = qca8k_mdio_read(priv->bus, port, regnum);
+ 
+ 	if (ret < 0)
+--- a/drivers/net/dsa/qca8k.h
++++ b/drivers/net/dsa/qca8k.h
+@@ -14,6 +14,7 @@
+ #include <linux/dsa/tag_qca.h>
+ 
+ #define QCA8K_ETHERNET_MDIO_PRIORITY			7
++#define QCA8K_ETHERNET_PHY_PRIORITY			6
+ #define QCA8K_ETHERNET_TIMEOUT				100
+ 
+ #define QCA8K_NUM_PORTS					7
diff --git a/target/linux/generic/backport-5.15/766-v5.18-13-net-dsa-qca8k-move-page-cache-to-driver-priv.patch b/target/linux/generic/backport-5.15/766-v5.18-13-net-dsa-qca8k-move-page-cache-to-driver-priv.patch
new file mode 100644
index 00000000000000..4ac0bc32fdbead
--- /dev/null
+++ b/target/linux/generic/backport-5.15/766-v5.18-13-net-dsa-qca8k-move-page-cache-to-driver-priv.patch
@@ -0,0 +1,208 @@
+From 4264350acb75430d5021a1d7de56a33faf69a097 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Wed, 2 Feb 2022 01:03:32 +0100
+Subject: [PATCH 13/16] net: dsa: qca8k: move page cache to driver priv
+
+There can be multiple qca8k switch on the same system. Move the static
+qca8k_current_page to qca8k_priv and make it specific for each switch.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 42 ++++++++++++++++++++---------------------
+ drivers/net/dsa/qca8k.h |  9 +++++++++
+ 2 files changed, 29 insertions(+), 22 deletions(-)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -75,12 +75,6 @@ static const struct qca8k_mib_desc ar832
+ 	MIB_DESC(1, 0xac, "TXUnicast"),
+ };
+ 
+-/* The 32bit switch registers are accessed indirectly. To achieve this we need
+- * to set the page of the register. Track the last page that was set to reduce
+- * mdio writes
+- */
+-static u16 qca8k_current_page = 0xffff;
+-
+ static void
+ qca8k_split_addr(u32 regaddr, u16 *r1, u16 *r2, u16 *page)
+ {
+@@ -134,11 +128,13 @@ qca8k_mii_write32(struct mii_bus *bus, i
+ }
+ 
+ static int
+-qca8k_set_page(struct mii_bus *bus, u16 page)
++qca8k_set_page(struct qca8k_priv *priv, u16 page)
+ {
++	u16 *cached_page = &priv->mdio_cache.page;
++	struct mii_bus *bus = priv->bus;
+ 	int ret;
+ 
+-	if (page == qca8k_current_page)
++	if (page == *cached_page)
+ 		return 0;
+ 
+ 	ret = bus->write(bus, 0x18, 0, page);
+@@ -148,7 +144,7 @@ qca8k_set_page(struct mii_bus *bus, u16
+ 		return ret;
+ 	}
+ 
+-	qca8k_current_page = page;
++	*cached_page = page;
+ 	usleep_range(1000, 2000);
+ 	return 0;
+ }
+@@ -374,7 +370,7 @@ qca8k_regmap_read(void *ctx, uint32_t re
+ 
+ 	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+ 
+-	ret = qca8k_set_page(bus, page);
++	ret = qca8k_set_page(priv, page);
+ 	if (ret < 0)
+ 		goto exit;
+ 
+@@ -400,7 +396,7 @@ qca8k_regmap_write(void *ctx, uint32_t r
+ 
+ 	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+ 
+-	ret = qca8k_set_page(bus, page);
++	ret = qca8k_set_page(priv, page);
+ 	if (ret < 0)
+ 		goto exit;
+ 
+@@ -427,7 +423,7 @@ qca8k_regmap_update_bits(void *ctx, uint
+ 
+ 	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+ 
+-	ret = qca8k_set_page(bus, page);
++	ret = qca8k_set_page(priv, page);
+ 	if (ret < 0)
+ 		goto exit;
+ 
+@@ -1098,8 +1094,9 @@ qca8k_mdio_busy_wait(struct mii_bus *bus
+ }
+ 
+ static int
+-qca8k_mdio_write(struct mii_bus *bus, int phy, int regnum, u16 data)
++qca8k_mdio_write(struct qca8k_priv *priv, int phy, int regnum, u16 data)
+ {
++	struct mii_bus *bus = priv->bus;
+ 	u16 r1, r2, page;
+ 	u32 val;
+ 	int ret;
+@@ -1116,7 +1113,7 @@ qca8k_mdio_write(struct mii_bus *bus, in
+ 
+ 	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+ 
+-	ret = qca8k_set_page(bus, page);
++	ret = qca8k_set_page(priv, page);
+ 	if (ret)
+ 		goto exit;
+ 
+@@ -1135,8 +1132,9 @@ exit:
+ }
+ 
+ static int
+-qca8k_mdio_read(struct mii_bus *bus, int phy, int regnum)
++qca8k_mdio_read(struct qca8k_priv *priv, int phy, int regnum)
+ {
++	struct mii_bus *bus = priv->bus;
+ 	u16 r1, r2, page;
+ 	u32 val;
+ 	int ret;
+@@ -1152,7 +1150,7 @@ qca8k_mdio_read(struct mii_bus *bus, int
+ 
+ 	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+ 
+-	ret = qca8k_set_page(bus, page);
++	ret = qca8k_set_page(priv, page);
+ 	if (ret)
+ 		goto exit;
+ 
+@@ -1181,7 +1179,6 @@ static int
+ qca8k_internal_mdio_write(struct mii_bus *slave_bus, int phy, int regnum, u16 data)
+ {
+ 	struct qca8k_priv *priv = slave_bus->priv;
+-	struct mii_bus *bus = priv->bus;
+ 	int ret;
+ 
+ 	/* Use mdio Ethernet when available, fallback to legacy one on error */
+@@ -1189,14 +1186,13 @@ qca8k_internal_mdio_write(struct mii_bus
+ 	if (!ret)
+ 		return 0;
+ 
+-	return qca8k_mdio_write(bus, phy, regnum, data);
++	return qca8k_mdio_write(priv, phy, regnum, data);
+ }
+ 
+ static int
+ qca8k_internal_mdio_read(struct mii_bus *slave_bus, int phy, int regnum)
+ {
+ 	struct qca8k_priv *priv = slave_bus->priv;
+-	struct mii_bus *bus = priv->bus;
+ 	int ret;
+ 
+ 	/* Use mdio Ethernet when available, fallback to legacy one on error */
+@@ -1204,7 +1200,7 @@ qca8k_internal_mdio_read(struct mii_bus
+ 	if (ret >= 0)
+ 		return ret;
+ 
+-	return qca8k_mdio_read(bus, phy, regnum);
++	return qca8k_mdio_read(priv, phy, regnum);
+ }
+ 
+ static int
+@@ -1225,7 +1221,7 @@ qca8k_phy_write(struct dsa_switch *ds, i
+ 	if (!ret)
+ 		return ret;
+ 
+-	return qca8k_mdio_write(priv->bus, port, regnum, data);
++	return qca8k_mdio_write(priv, port, regnum, data);
+ }
+ 
+ static int
+@@ -1246,7 +1242,7 @@ qca8k_phy_read(struct dsa_switch *ds, in
+ 	if (ret >= 0)
+ 		return ret;
+ 
+-	ret = qca8k_mdio_read(priv->bus, port, regnum);
++	ret = qca8k_mdio_read(priv, port, regnum);
+ 
+ 	if (ret < 0)
+ 		return 0xffff;
+@@ -3060,6 +3056,8 @@ qca8k_sw_probe(struct mdio_device *mdiod
+ 		return PTR_ERR(priv->regmap);
+ 	}
+ 
++	priv->mdio_cache.page = 0xffff;
++
+ 	/* Check the detected switch id */
+ 	ret = qca8k_read_switch_id(priv);
+ 	if (ret)
+--- a/drivers/net/dsa/qca8k.h
++++ b/drivers/net/dsa/qca8k.h
+@@ -363,6 +363,14 @@ struct qca8k_ports_config {
+ 	u8 rgmii_tx_delay[QCA8K_NUM_CPU_PORTS]; /* 0: CPU port0, 1: CPU port6 */
+ };
+ 
++struct qca8k_mdio_cache {
++/* The 32bit switch registers are accessed indirectly. To achieve this we need
++ * to set the page of the register. Track the last page that was set to reduce
++ * mdio writes
++ */
++	u16 page;
++};
++
+ struct qca8k_priv {
+ 	u8 switch_id;
+ 	u8 switch_revision;
+@@ -383,6 +391,7 @@ struct qca8k_priv {
+ 	struct net_device *mgmt_master; /* Track if mdio/mib Ethernet is available */
+ 	struct qca8k_mgmt_eth_data mgmt_eth_data;
+ 	struct qca8k_mib_eth_data mib_eth_data;
++	struct qca8k_mdio_cache mdio_cache;
+ };
+ 
+ struct qca8k_mib_desc {
diff --git a/target/linux/generic/backport-5.15/766-v5.18-14-net-dsa-qca8k-cache-lo-and-hi-for-mdio-write.patch b/target/linux/generic/backport-5.15/766-v5.18-14-net-dsa-qca8k-cache-lo-and-hi-for-mdio-write.patch
new file mode 100644
index 00000000000000..e2cb2721ce92cb
--- /dev/null
+++ b/target/linux/generic/backport-5.15/766-v5.18-14-net-dsa-qca8k-cache-lo-and-hi-for-mdio-write.patch
@@ -0,0 +1,164 @@
+From 2481d206fae7884cd07014fd1318e63af35e99eb Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Wed, 2 Feb 2022 01:03:33 +0100
+Subject: [PATCH 14/16] net: dsa: qca8k: cache lo and hi for mdio write
+
+From Documentation, we can cache lo and hi the same way we do with the
+page. This massively reduce the mdio write as 3/4 of the time as we only
+require to write the lo or hi part for a mdio write.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 61 +++++++++++++++++++++++++++++++++--------
+ drivers/net/dsa/qca8k.h |  5 ++++
+ 2 files changed, 54 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -89,6 +89,44 @@ qca8k_split_addr(u32 regaddr, u16 *r1, u
+ }
+ 
+ static int
++qca8k_set_lo(struct qca8k_priv *priv, int phy_id, u32 regnum, u16 lo)
++{
++	u16 *cached_lo = &priv->mdio_cache.lo;
++	struct mii_bus *bus = priv->bus;
++	int ret;
++
++	if (lo == *cached_lo)
++		return 0;
++
++	ret = bus->write(bus, phy_id, regnum, lo);
++	if (ret < 0)
++		dev_err_ratelimited(&bus->dev,
++				    "failed to write qca8k 32bit lo register\n");
++
++	*cached_lo = lo;
++	return 0;
++}
++
++static int
++qca8k_set_hi(struct qca8k_priv *priv, int phy_id, u32 regnum, u16 hi)
++{
++	u16 *cached_hi = &priv->mdio_cache.hi;
++	struct mii_bus *bus = priv->bus;
++	int ret;
++
++	if (hi == *cached_hi)
++		return 0;
++
++	ret = bus->write(bus, phy_id, regnum, hi);
++	if (ret < 0)
++		dev_err_ratelimited(&bus->dev,
++				    "failed to write qca8k 32bit hi register\n");
++
++	*cached_hi = hi;
++	return 0;
++}
++
++static int
+ qca8k_mii_read32(struct mii_bus *bus, int phy_id, u32 regnum, u32 *val)
+ {
+ 	int ret;
+@@ -111,7 +149,7 @@ qca8k_mii_read32(struct mii_bus *bus, in
+ }
+ 
+ static void
+-qca8k_mii_write32(struct mii_bus *bus, int phy_id, u32 regnum, u32 val)
++qca8k_mii_write32(struct qca8k_priv *priv, int phy_id, u32 regnum, u32 val)
+ {
+ 	u16 lo, hi;
+ 	int ret;
+@@ -119,12 +157,9 @@ qca8k_mii_write32(struct mii_bus *bus, i
+ 	lo = val & 0xffff;
+ 	hi = (u16)(val >> 16);
+ 
+-	ret = bus->write(bus, phy_id, regnum, lo);
++	ret = qca8k_set_lo(priv, phy_id, regnum, lo);
+ 	if (ret >= 0)
+-		ret = bus->write(bus, phy_id, regnum + 1, hi);
+-	if (ret < 0)
+-		dev_err_ratelimited(&bus->dev,
+-				    "failed to write qca8k 32bit register\n");
++		ret = qca8k_set_hi(priv, phy_id, regnum + 1, hi);
+ }
+ 
+ static int
+@@ -400,7 +435,7 @@ qca8k_regmap_write(void *ctx, uint32_t r
+ 	if (ret < 0)
+ 		goto exit;
+ 
+-	qca8k_mii_write32(bus, 0x10 | r2, r1, val);
++	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
+ 
+ exit:
+ 	mutex_unlock(&bus->mdio_lock);
+@@ -433,7 +468,7 @@ qca8k_regmap_update_bits(void *ctx, uint
+ 
+ 	val &= ~mask;
+ 	val |= write_val;
+-	qca8k_mii_write32(bus, 0x10 | r2, r1, val);
++	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
+ 
+ exit:
+ 	mutex_unlock(&bus->mdio_lock);
+@@ -1117,14 +1152,14 @@ qca8k_mdio_write(struct qca8k_priv *priv
+ 	if (ret)
+ 		goto exit;
+ 
+-	qca8k_mii_write32(bus, 0x10 | r2, r1, val);
++	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
+ 
+ 	ret = qca8k_mdio_busy_wait(bus, QCA8K_MDIO_MASTER_CTRL,
+ 				   QCA8K_MDIO_MASTER_BUSY);
+ 
+ exit:
+ 	/* even if the busy_wait timeouts try to clear the MASTER_EN */
+-	qca8k_mii_write32(bus, 0x10 | r2, r1, 0);
++	qca8k_mii_write32(priv, 0x10 | r2, r1, 0);
+ 
+ 	mutex_unlock(&bus->mdio_lock);
+ 
+@@ -1154,7 +1189,7 @@ qca8k_mdio_read(struct qca8k_priv *priv,
+ 	if (ret)
+ 		goto exit;
+ 
+-	qca8k_mii_write32(bus, 0x10 | r2, r1, val);
++	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
+ 
+ 	ret = qca8k_mdio_busy_wait(bus, QCA8K_MDIO_MASTER_CTRL,
+ 				   QCA8K_MDIO_MASTER_BUSY);
+@@ -1165,7 +1200,7 @@ qca8k_mdio_read(struct qca8k_priv *priv,
+ 
+ exit:
+ 	/* even if the busy_wait timeouts try to clear the MASTER_EN */
+-	qca8k_mii_write32(bus, 0x10 | r2, r1, 0);
++	qca8k_mii_write32(priv, 0x10 | r2, r1, 0);
+ 
+ 	mutex_unlock(&bus->mdio_lock);
+ 
+@@ -3057,6 +3092,8 @@ qca8k_sw_probe(struct mdio_device *mdiod
+ 	}
+ 
+ 	priv->mdio_cache.page = 0xffff;
++	priv->mdio_cache.lo = 0xffff;
++	priv->mdio_cache.hi = 0xffff;
+ 
+ 	/* Check the detected switch id */
+ 	ret = qca8k_read_switch_id(priv);
+--- a/drivers/net/dsa/qca8k.h
++++ b/drivers/net/dsa/qca8k.h
+@@ -369,6 +369,11 @@ struct qca8k_mdio_cache {
+  * mdio writes
+  */
+ 	u16 page;
++/* lo and hi can also be cached and from Documentation we can skip one
++ * extra mdio write if lo or hi is didn't change.
++ */
++	u16 lo;
++	u16 hi;
+ };
+ 
+ struct qca8k_priv {
diff --git a/target/linux/generic/backport-5.15/766-v5.18-15-net-dsa-qca8k-add-support-for-larger-read-write-size.patch b/target/linux/generic/backport-5.15/766-v5.18-15-net-dsa-qca8k-add-support-for-larger-read-write-size.patch
new file mode 100644
index 00000000000000..5acd13dbad8e84
--- /dev/null
+++ b/target/linux/generic/backport-5.15/766-v5.18-15-net-dsa-qca8k-add-support-for-larger-read-write-size.patch
@@ -0,0 +1,206 @@
+From 90386223f44e2a751d7e9e9ac8f78ea33358a891 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Wed, 2 Feb 2022 01:03:34 +0100
+Subject: [PATCH 15/16] net: dsa: qca8k: add support for larger read/write size
+ with mgmt Ethernet
+
+mgmt Ethernet packet can read/write up to 16byte at times. The len reg
+is limited to 15 (0xf). The switch actually sends and accepts data in 4
+different steps of len values.
+Len steps:
+- 0: nothing
+- 1-4: first 4 byte
+- 5-6: first 12 byte
+- 7-15: all 16 byte
+
+In the alloc skb function we check if the len is 16 and we fix it to a
+len of 15. It the read/write function interest to extract the real asked
+data. The tagger handler will always copy the fully 16byte with a READ
+command. This is useful for some big regs like the fdb reg that are
+more than 4byte of data. This permits to introduce a bulk function that
+will send and request the entire entry in one go.
+Write function is changed and it does now require to pass the pointer to
+val to also handle array val.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 61 +++++++++++++++++++++++++++--------------
+ 1 file changed, 41 insertions(+), 20 deletions(-)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -222,7 +222,9 @@ static void qca8k_rw_reg_ack_handler(str
+ 	if (cmd == MDIO_READ) {
+ 		mgmt_eth_data->data[0] = mgmt_ethhdr->mdio_data;
+ 
+-		/* Get the rest of the 12 byte of data */
++		/* Get the rest of the 12 byte of data.
++		 * The read/write function will extract the requested data.
++		 */
+ 		if (len > QCA_HDR_MGMT_DATA1_LEN)
+ 			memcpy(mgmt_eth_data->data + 1, skb->data,
+ 			       QCA_HDR_MGMT_DATA2_LEN);
+@@ -232,16 +234,30 @@ static void qca8k_rw_reg_ack_handler(str
+ }
+ 
+ static struct sk_buff *qca8k_alloc_mdio_header(enum mdio_cmd cmd, u32 reg, u32 *val,
+-					       int priority)
++					       int priority, unsigned int len)
+ {
+ 	struct qca_mgmt_ethhdr *mgmt_ethhdr;
++	unsigned int real_len;
+ 	struct sk_buff *skb;
++	u32 *data2;
+ 	u16 hdr;
+ 
+ 	skb = dev_alloc_skb(QCA_HDR_MGMT_PKT_LEN);
+ 	if (!skb)
+ 		return NULL;
+ 
++	/* Max value for len reg is 15 (0xf) but the switch actually return 16 byte
++	 * Actually for some reason the steps are:
++	 * 0: nothing
++	 * 1-4: first 4 byte
++	 * 5-6: first 12 byte
++	 * 7-15: all 16 byte
++	 */
++	if (len == 16)
++		real_len = 15;
++	else
++		real_len = len;
++
+ 	skb_reset_mac_header(skb);
+ 	skb_set_network_header(skb, skb->len);
+ 
+@@ -254,7 +270,7 @@ static struct sk_buff *qca8k_alloc_mdio_
+ 	hdr |= FIELD_PREP(QCA_HDR_XMIT_CONTROL, QCA_HDR_XMIT_TYPE_RW_REG);
+ 
+ 	mgmt_ethhdr->command = FIELD_PREP(QCA_HDR_MGMT_ADDR, reg);
+-	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_LENGTH, 4);
++	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_LENGTH, real_len);
+ 	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_CMD, cmd);
+ 	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_CHECK_CODE,
+ 					   QCA_HDR_MGMT_CHECK_CODE_VAL);
+@@ -264,7 +280,9 @@ static struct sk_buff *qca8k_alloc_mdio_
+ 
+ 	mgmt_ethhdr->hdr = htons(hdr);
+ 
+-	skb_put_zero(skb, QCA_HDR_MGMT_DATA2_LEN + QCA_HDR_MGMT_PADDING_LEN);
++	data2 = skb_put_zero(skb, QCA_HDR_MGMT_DATA2_LEN + QCA_HDR_MGMT_PADDING_LEN);
++	if (cmd == MDIO_WRITE && len > QCA_HDR_MGMT_DATA1_LEN)
++		memcpy(data2, val + 1, len - QCA_HDR_MGMT_DATA1_LEN);
+ 
+ 	return skb;
+ }
+@@ -277,7 +295,7 @@ static void qca8k_mdio_header_fill_seq_n
+ 	mgmt_ethhdr->seq = FIELD_PREP(QCA_HDR_MGMT_SEQ_NUM, seq_num);
+ }
+ 
+-static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val)
++static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
+ {
+ 	struct qca8k_mgmt_eth_data *mgmt_eth_data = &priv->mgmt_eth_data;
+ 	struct sk_buff *skb;
+@@ -285,7 +303,7 @@ static int qca8k_read_eth(struct qca8k_p
+ 	int ret;
+ 
+ 	skb = qca8k_alloc_mdio_header(MDIO_READ, reg, NULL,
+-				      QCA8K_ETHERNET_MDIO_PRIORITY);
++				      QCA8K_ETHERNET_MDIO_PRIORITY, len);
+ 	if (!skb)
+ 		return -ENOMEM;
+ 
+@@ -313,6 +331,9 @@ static int qca8k_read_eth(struct qca8k_p
+ 					  msecs_to_jiffies(QCA8K_ETHERNET_TIMEOUT));
+ 
+ 	*val = mgmt_eth_data->data[0];
++	if (len > QCA_HDR_MGMT_DATA1_LEN)
++		memcpy(val + 1, mgmt_eth_data->data + 1, len - QCA_HDR_MGMT_DATA1_LEN);
++
+ 	ack = mgmt_eth_data->ack;
+ 
+ 	mutex_unlock(&mgmt_eth_data->mutex);
+@@ -326,15 +347,15 @@ static int qca8k_read_eth(struct qca8k_p
+ 	return 0;
+ }
+ 
+-static int qca8k_write_eth(struct qca8k_priv *priv, u32 reg, u32 val)
++static int qca8k_write_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
+ {
+ 	struct qca8k_mgmt_eth_data *mgmt_eth_data = &priv->mgmt_eth_data;
+ 	struct sk_buff *skb;
+ 	bool ack;
+ 	int ret;
+ 
+-	skb = qca8k_alloc_mdio_header(MDIO_WRITE, reg, &val,
+-				      QCA8K_ETHERNET_MDIO_PRIORITY);
++	skb = qca8k_alloc_mdio_header(MDIO_WRITE, reg, val,
++				      QCA8K_ETHERNET_MDIO_PRIORITY, len);
+ 	if (!skb)
+ 		return -ENOMEM;
+ 
+@@ -380,14 +401,14 @@ qca8k_regmap_update_bits_eth(struct qca8
+ 	u32 val = 0;
+ 	int ret;
+ 
+-	ret = qca8k_read_eth(priv, reg, &val);
++	ret = qca8k_read_eth(priv, reg, &val, sizeof(val));
+ 	if (ret)
+ 		return ret;
+ 
+ 	val &= ~mask;
+ 	val |= write_val;
+ 
+-	return qca8k_write_eth(priv, reg, val);
++	return qca8k_write_eth(priv, reg, &val, sizeof(val));
+ }
+ 
+ static int
+@@ -398,7 +419,7 @@ qca8k_regmap_read(void *ctx, uint32_t re
+ 	u16 r1, r2, page;
+ 	int ret;
+ 
+-	if (!qca8k_read_eth(priv, reg, val))
++	if (!qca8k_read_eth(priv, reg, val, sizeof(val)))
+ 		return 0;
+ 
+ 	qca8k_split_addr(reg, &r1, &r2, &page);
+@@ -424,7 +445,7 @@ qca8k_regmap_write(void *ctx, uint32_t r
+ 	u16 r1, r2, page;
+ 	int ret;
+ 
+-	if (!qca8k_write_eth(priv, reg, val))
++	if (!qca8k_write_eth(priv, reg, &val, sizeof(val)))
+ 		return 0;
+ 
+ 	qca8k_split_addr(reg, &r1, &r2, &page);
+@@ -959,21 +980,21 @@ qca8k_phy_eth_command(struct qca8k_priv
+ 	}
+ 
+ 	/* Prealloc all the needed skb before the lock */
+-	write_skb = qca8k_alloc_mdio_header(MDIO_WRITE, QCA8K_MDIO_MASTER_CTRL,
+-					    &write_val, QCA8K_ETHERNET_PHY_PRIORITY);
++	write_skb = qca8k_alloc_mdio_header(MDIO_WRITE, QCA8K_MDIO_MASTER_CTRL, &write_val,
++					    QCA8K_ETHERNET_PHY_PRIORITY, sizeof(write_val));
+ 	if (!write_skb)
+ 		return -ENOMEM;
+ 
+-	clear_skb = qca8k_alloc_mdio_header(MDIO_WRITE, QCA8K_MDIO_MASTER_CTRL,
+-					    &clear_val, QCA8K_ETHERNET_PHY_PRIORITY);
++	clear_skb = qca8k_alloc_mdio_header(MDIO_WRITE, QCA8K_MDIO_MASTER_CTRL, &clear_val,
++					    QCA8K_ETHERNET_PHY_PRIORITY, sizeof(clear_val));
+ 	if (!write_skb) {
+ 		ret = -ENOMEM;
+ 		goto err_clear_skb;
+ 	}
+ 
+-	read_skb = qca8k_alloc_mdio_header(MDIO_READ, QCA8K_MDIO_MASTER_CTRL,
+-					   &clear_val, QCA8K_ETHERNET_PHY_PRIORITY);
+-	if (!write_skb) {
++	read_skb = qca8k_alloc_mdio_header(MDIO_READ, QCA8K_MDIO_MASTER_CTRL, &clear_val,
++					   QCA8K_ETHERNET_PHY_PRIORITY, sizeof(clear_val));
++	if (!read_skb) {
+ 		ret = -ENOMEM;
+ 		goto err_read_skb;
+ 	}
diff --git a/target/linux/generic/backport-5.15/766-v5.18-16-net-dsa-qca8k-introduce-qca8k_bulk_read-write-functi.patch b/target/linux/generic/backport-5.15/766-v5.18-16-net-dsa-qca8k-introduce-qca8k_bulk_read-write-functi.patch
new file mode 100644
index 00000000000000..f26c6b91ac5998
--- /dev/null
+++ b/target/linux/generic/backport-5.15/766-v5.18-16-net-dsa-qca8k-introduce-qca8k_bulk_read-write-functi.patch
@@ -0,0 +1,104 @@
+From 4f3701fc599820568ba4395070d34e4248800fc0 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Wed, 2 Feb 2022 01:03:35 +0100
+Subject: [PATCH 16/16] net: dsa: qca8k: introduce qca8k_bulk_read/write
+ function
+
+Introduce qca8k_bulk_read/write() function to use mgmt Ethernet way to
+read/write packet in bulk. Make use of this new function in the fdb
+function and while at it reduce the reg for fdb_read from 4 to 3 as the
+max bit for the ARL(fdb) table is 83 bits.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 55 ++++++++++++++++++++++++++++++++---------
+ 1 file changed, 43 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -412,6 +412,43 @@ qca8k_regmap_update_bits_eth(struct qca8
+ }
+ 
+ static int
++qca8k_bulk_read(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
++{
++	int i, count = len / sizeof(u32), ret;
++
++	if (priv->mgmt_master && !qca8k_read_eth(priv, reg, val, len))
++		return 0;
++
++	for (i = 0; i < count; i++) {
++		ret = regmap_read(priv->regmap, reg + (i * 4), val + i);
++		if (ret < 0)
++			return ret;
++	}
++
++	return 0;
++}
++
++static int
++qca8k_bulk_write(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
++{
++	int i, count = len / sizeof(u32), ret;
++	u32 tmp;
++
++	if (priv->mgmt_master && !qca8k_write_eth(priv, reg, val, len))
++		return 0;
++
++	for (i = 0; i < count; i++) {
++		tmp = val[i];
++
++		ret = regmap_write(priv->regmap, reg + (i * 4), tmp);
++		if (ret < 0)
++			return ret;
++	}
++
++	return 0;
++}
++
++static int
+ qca8k_regmap_read(void *ctx, uint32_t reg, uint32_t *val)
+ {
+ 	struct qca8k_priv *priv = (struct qca8k_priv *)ctx;
+@@ -546,17 +583,13 @@ qca8k_busy_wait(struct qca8k_priv *priv,
+ static int
+ qca8k_fdb_read(struct qca8k_priv *priv, struct qca8k_fdb *fdb)
+ {
+-	u32 reg[4], val;
+-	int i, ret;
++	u32 reg[3];
++	int ret;
+ 
+ 	/* load the ARL table into an array */
+-	for (i = 0; i < 4; i++) {
+-		ret = qca8k_read(priv, QCA8K_REG_ATU_DATA0 + (i * 4), &val);
+-		if (ret < 0)
+-			return ret;
+-
+-		reg[i] = val;
+-	}
++	ret = qca8k_bulk_read(priv, QCA8K_REG_ATU_DATA0, reg, sizeof(reg));
++	if (ret)
++		return ret;
+ 
+ 	/* vid - 83:72 */
+ 	fdb->vid = FIELD_GET(QCA8K_ATU_VID_MASK, reg[2]);
+@@ -580,7 +613,6 @@ qca8k_fdb_write(struct qca8k_priv *priv,
+ 		u8 aging)
+ {
+ 	u32 reg[3] = { 0 };
+-	int i;
+ 
+ 	/* vid - 83:72 */
+ 	reg[2] = FIELD_PREP(QCA8K_ATU_VID_MASK, vid);
+@@ -597,8 +629,7 @@ qca8k_fdb_write(struct qca8k_priv *priv,
+ 	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR5_MASK, mac[5]);
+ 
+ 	/* load the array into the ARL table */
+-	for (i = 0; i < 3; i++)
+-		qca8k_write(priv, QCA8K_REG_ATU_DATA0 + (i * 4), reg[i]);
++	qca8k_bulk_write(priv, QCA8K_REG_ATU_DATA0, reg, sizeof(reg));
+ }
+ 
+ static int
diff --git a/target/linux/generic/backport-5.15/767-v5.18-net-dsa-qca8k-check-correct-variable-in-qca8k_phy_et.patch b/target/linux/generic/backport-5.15/767-v5.18-net-dsa-qca8k-check-correct-variable-in-qca8k_phy_et.patch
new file mode 100644
index 00000000000000..34607c223ce492
--- /dev/null
+++ b/target/linux/generic/backport-5.15/767-v5.18-net-dsa-qca8k-check-correct-variable-in-qca8k_phy_et.patch
@@ -0,0 +1,28 @@
+From c3664d913dc115cab4a5fdb5634df4887048000e Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 4 Feb 2022 13:03:36 +0300
+Subject: [PATCH 1/1] net: dsa: qca8k: check correct variable in
+ qca8k_phy_eth_command()
+
+This is a copy and paste bug.  It was supposed to check "clear_skb"
+instead of "write_skb".
+
+Fixes: 2cd548566384 ("net: dsa: qca8k: add support for phy read/write with mgmt Ethernet")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -1018,7 +1018,7 @@ qca8k_phy_eth_command(struct qca8k_priv
+ 
+ 	clear_skb = qca8k_alloc_mdio_header(MDIO_WRITE, QCA8K_MDIO_MASTER_CTRL, &clear_val,
+ 					    QCA8K_ETHERNET_PHY_PRIORITY, sizeof(clear_val));
+-	if (!write_skb) {
++	if (!clear_skb) {
+ 		ret = -ENOMEM;
+ 		goto err_clear_skb;
+ 	}
diff --git a/target/linux/generic/backport-5.15/768-v5.18-net-dsa-qca8k-fix-noderef.cocci-warnings.patch b/target/linux/generic/backport-5.15/768-v5.18-net-dsa-qca8k-fix-noderef.cocci-warnings.patch
new file mode 100644
index 00000000000000..d8cf2663090622
--- /dev/null
+++ b/target/linux/generic/backport-5.15/768-v5.18-net-dsa-qca8k-fix-noderef.cocci-warnings.patch
@@ -0,0 +1,34 @@
+From 4f5e483b8c7a644733db941a1ae00173baa7b463 Mon Sep 17 00:00:00 2001
+From: kernel test robot <lkp@intel.com>
+Date: Thu, 10 Feb 2022 06:13:04 +0800
+Subject: [PATCH 1/1] net: dsa: qca8k: fix noderef.cocci warnings
+
+drivers/net/dsa/qca8k.c:422:37-43: ERROR: application of sizeof to pointer
+
+ sizeof when applied to a pointer typed expression gives the size of
+ the pointer
+
+Generated by: scripts/coccinelle/misc/noderef.cocci
+
+Fixes: 90386223f44e ("net: dsa: qca8k: add support for larger read/write size with mgmt Ethernet")
+CC: Ansuel Smith <ansuelsmth@gmail.com>
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: kernel test robot <lkp@intel.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20220209221304.GA17529@d2214a582157
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/qca8k.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -456,7 +456,7 @@ qca8k_regmap_read(void *ctx, uint32_t re
+ 	u16 r1, r2, page;
+ 	int ret;
+ 
+-	if (!qca8k_read_eth(priv, reg, val, sizeof(val)))
++	if (!qca8k_read_eth(priv, reg, val, sizeof(*val)))
+ 		return 0;
+ 
+ 	qca8k_split_addr(reg, &r1, &r2, &page);
diff --git a/target/linux/generic/backport-5.15/769-v5.19-01-net-dsa-qca8k-drop-MTU-tracking-from-qca8k_priv.patch b/target/linux/generic/backport-5.15/769-v5.19-01-net-dsa-qca8k-drop-MTU-tracking-from-qca8k_priv.patch
new file mode 100644
index 00000000000000..57df4c126e4937
--- /dev/null
+++ b/target/linux/generic/backport-5.15/769-v5.19-01-net-dsa-qca8k-drop-MTU-tracking-from-qca8k_priv.patch
@@ -0,0 +1,79 @@
+From 69fd055957a02309ffdc23d887a01988b6e5bab1 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sat, 16 Apr 2022 01:30:12 +0200
+Subject: [PATCH 1/6] net: dsa: qca8k: drop MTU tracking from qca8k_priv
+
+DSA set the CPU port based on the largest MTU of all the slave ports.
+Based on this we can drop the MTU array from qca8k_priv and set the
+port_change_mtu logic on DSA changing MTU of the CPU port as the switch
+have a global MTU settingfor each port.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 26 +++++++++-----------------
+ drivers/net/dsa/qca8k.h |  1 -
+ 2 files changed, 9 insertions(+), 18 deletions(-)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -1803,16 +1803,6 @@ qca8k_setup(struct dsa_switch *ds)
+ 				  QCA8K_PORT_HOL_CTRL1_WRED_EN,
+ 				  mask);
+ 		}
+-
+-		/* Set initial MTU for every port.
+-		 * We have only have a general MTU setting. So track
+-		 * every port and set the max across all port.
+-		 * Set per port MTU to 1500 as the MTU change function
+-		 * will add the overhead and if its set to 1518 then it
+-		 * will apply the overhead again and we will end up with
+-		 * MTU of 1536 instead of 1518
+-		 */
+-		priv->port_mtu[i] = ETH_DATA_LEN;
+ 	}
+ 
+ 	/* Special GLOBAL_FC_THRESH value are needed for ar8327 switch */
+@@ -2525,13 +2515,16 @@ static int
+ qca8k_port_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
+ {
+ 	struct qca8k_priv *priv = ds->priv;
+-	int ret, i, mtu = 0;
+-
+-	priv->port_mtu[port] = new_mtu;
++	int ret;
+ 
+-	for (i = 0; i < QCA8K_NUM_PORTS; i++)
+-		if (priv->port_mtu[i] > mtu)
+-			mtu = priv->port_mtu[i];
++	/* We have only have a general MTU setting.
++	 * DSA always set the CPU port's MTU to the largest MTU of the slave
++	 * ports.
++	 * Setting MTU just for the CPU port is sufficient to correctly set a
++	 * value for every port.
++	 */
++	if (!dsa_is_cpu_port(ds, port))
++		return 0;
+ 
+ 	/* To change the MAX_FRAME_SIZE the cpu ports must be off or
+ 	 * the switch panics.
+@@ -2545,7 +2538,7 @@ qca8k_port_change_mtu(struct dsa_switch
+ 		qca8k_port_set_status(priv, 6, 0);
+ 
+ 	/* Include L2 header / FCS length */
+-	ret = qca8k_write(priv, QCA8K_MAX_FRAME_SIZE, mtu + ETH_HLEN + ETH_FCS_LEN);
++	ret = qca8k_write(priv, QCA8K_MAX_FRAME_SIZE, new_mtu + ETH_HLEN + ETH_FCS_LEN);
+ 
+ 	if (priv->port_sts[0].enabled)
+ 		qca8k_port_set_status(priv, 0, 1);
+--- a/drivers/net/dsa/qca8k.h
++++ b/drivers/net/dsa/qca8k.h
+@@ -392,7 +392,6 @@ struct qca8k_priv {
+ 	struct device *dev;
+ 	struct dsa_switch_ops ops;
+ 	struct gpio_desc *reset_gpio;
+-	unsigned int port_mtu[QCA8K_NUM_PORTS];
+ 	struct net_device *mgmt_master; /* Track if mdio/mib Ethernet is available */
+ 	struct qca8k_mgmt_eth_data mgmt_eth_data;
+ 	struct qca8k_mib_eth_data mib_eth_data;
diff --git a/target/linux/generic/backport-5.15/769-v5.19-02-net-dsa-qca8k-drop-port_sts-from-qca8k_priv.patch b/target/linux/generic/backport-5.15/769-v5.19-02-net-dsa-qca8k-drop-port_sts-from-qca8k_priv.patch
new file mode 100644
index 00000000000000..3cacd7e4fdb7b0
--- /dev/null
+++ b/target/linux/generic/backport-5.15/769-v5.19-02-net-dsa-qca8k-drop-port_sts-from-qca8k_priv.patch
@@ -0,0 +1,116 @@
+From 2b8fd87af7f156942971789abac8ee2bb60c03bc Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sat, 16 Apr 2022 01:30:13 +0200
+Subject: [PATCH 2/6] net: dsa: qca8k: drop port_sts from qca8k_priv
+
+Port_sts is a thing of the past for this driver. It was something
+present on the initial implementation of this driver and parts of the
+original struct were dropped over time. Using an array of int to store if
+a port is enabled or not to handle PM operation seems overkill. Switch
+and use a simple u8 to store the port status where each bit correspond
+to a port. (bit is set port is enabled, bit is not set, port is disabled)
+Also add some comments to better describe why we need to track port
+status.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 15 +++++++++------
+ drivers/net/dsa/qca8k.h |  9 ++++-----
+ 2 files changed, 13 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -2494,7 +2494,7 @@ qca8k_port_enable(struct dsa_switch *ds,
+ 	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+ 
+ 	qca8k_port_set_status(priv, port, 1);
+-	priv->port_sts[port].enabled = 1;
++	priv->port_enabled_map |= BIT(port);
+ 
+ 	if (dsa_is_user_port(ds, port))
+ 		phy_support_asym_pause(phy);
+@@ -2508,7 +2508,7 @@ qca8k_port_disable(struct dsa_switch *ds
+ 	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+ 
+ 	qca8k_port_set_status(priv, port, 0);
+-	priv->port_sts[port].enabled = 0;
++	priv->port_enabled_map &= ~BIT(port);
+ }
+ 
+ static int
+@@ -2531,19 +2531,19 @@ qca8k_port_change_mtu(struct dsa_switch
+ 	 * Turn off both cpu ports before applying the new value to prevent
+ 	 * this.
+ 	 */
+-	if (priv->port_sts[0].enabled)
++	if (priv->port_enabled_map & BIT(0))
+ 		qca8k_port_set_status(priv, 0, 0);
+ 
+-	if (priv->port_sts[6].enabled)
++	if (priv->port_enabled_map & BIT(6))
+ 		qca8k_port_set_status(priv, 6, 0);
+ 
+ 	/* Include L2 header / FCS length */
+ 	ret = qca8k_write(priv, QCA8K_MAX_FRAME_SIZE, new_mtu + ETH_HLEN + ETH_FCS_LEN);
+ 
+-	if (priv->port_sts[0].enabled)
++	if (priv->port_enabled_map & BIT(0))
+ 		qca8k_port_set_status(priv, 0, 1);
+ 
+-	if (priv->port_sts[6].enabled)
++	if (priv->port_enabled_map & BIT(6))
+ 		qca8k_port_set_status(priv, 6, 1);
+ 
+ 	return ret;
+@@ -3199,13 +3199,16 @@ static void qca8k_sw_shutdown(struct mdi
+ static void
+ qca8k_set_pm(struct qca8k_priv *priv, int enable)
+ {
+-	int i;
++	int port;
+ 
+-	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+-		if (!priv->port_sts[i].enabled)
++	for (port = 0; port < QCA8K_NUM_PORTS; port++) {
++		/* Do not enable on resume if the port was
++		 * disabled before.
++		 */
++		if (!(priv->port_enabled_map & BIT(port)))
+ 			continue;
+ 
+-		qca8k_port_set_status(priv, i, enable);
++		qca8k_port_set_status(priv, port, enable);
+ 	}
+ }
+ 
+--- a/drivers/net/dsa/qca8k.h
++++ b/drivers/net/dsa/qca8k.h
+@@ -324,10 +324,6 @@ enum qca8k_mid_cmd {
+ 	QCA8K_MIB_CAST = 3,
+ };
+ 
+-struct ar8xxx_port_status {
+-	int enabled;
+-};
+-
+ struct qca8k_match_data {
+ 	u8 id;
+ 	bool reduced_package;
+@@ -382,11 +378,14 @@ struct qca8k_priv {
+ 	u8 mirror_rx;
+ 	u8 mirror_tx;
+ 	u8 lag_hash_mode;
++	/* Each bit correspond to a port. This switch can support a max of 7 port.
++	 * Bit 1: port enabled. Bit 0: port disabled.
++	 */
++	u8 port_enabled_map;
+ 	bool legacy_phy_port_mapping;
+ 	struct qca8k_ports_config ports_config;
+ 	struct regmap *regmap;
+ 	struct mii_bus *bus;
+-	struct ar8xxx_port_status port_sts[QCA8K_NUM_PORTS];
+ 	struct dsa_switch *ds;
+ 	struct mutex reg_mutex;
+ 	struct device *dev;
diff --git a/target/linux/generic/backport-5.15/769-v5.19-03-net-dsa-qca8k-rework-and-simplify-mdiobus-logic.patch b/target/linux/generic/backport-5.15/769-v5.19-03-net-dsa-qca8k-rework-and-simplify-mdiobus-logic.patch
new file mode 100644
index 00000000000000..12c3221077ca7c
--- /dev/null
+++ b/target/linux/generic/backport-5.15/769-v5.19-03-net-dsa-qca8k-rework-and-simplify-mdiobus-logic.patch
@@ -0,0 +1,173 @@
+From 8255212e4130bd2dc1463286a3dddb74797bbdc1 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sat, 16 Apr 2022 01:30:14 +0200
+Subject: [PATCH 3/6] net: dsa: qca8k: rework and simplify mdiobus logic
+
+In an attempt to reduce qca8k_priv space, rework and simplify mdiobus
+logic.
+We now declare a mdiobus instead of relying on DSA phy_read/write even
+if a mdio node is not present. This is all to make the qca8k ops static
+and not switch specific. With a legacy implementation where port doesn't
+have a phy map declared in the dts with a mdio node, we declare a
+'qca8k-legacy' mdiobus. The conversion logic is used as legacy read and
+write ops are used instead of the internal one.
+Also drop the legacy_phy_port_mapping as we now declare mdiobus with ops
+that already address the workaround.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 95 +++++++++++++----------------------------
+ drivers/net/dsa/qca8k.h |  1 -
+ 2 files changed, 29 insertions(+), 67 deletions(-)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -1291,83 +1291,63 @@ qca8k_internal_mdio_read(struct mii_bus
+ }
+ 
+ static int
+-qca8k_phy_write(struct dsa_switch *ds, int port, int regnum, u16 data)
++qca8k_legacy_mdio_write(struct mii_bus *slave_bus, int port, int regnum, u16 data)
+ {
+-	struct qca8k_priv *priv = ds->priv;
+-	int ret;
++	port = qca8k_port_to_phy(port) % PHY_MAX_ADDR;
+ 
+-	/* Check if the legacy mapping should be used and the
+-	 * port is not correctly mapped to the right PHY in the
+-	 * devicetree
+-	 */
+-	if (priv->legacy_phy_port_mapping)
+-		port = qca8k_port_to_phy(port) % PHY_MAX_ADDR;
+-
+-	/* Use mdio Ethernet when available, fallback to legacy one on error */
+-	ret = qca8k_phy_eth_command(priv, false, port, regnum, 0);
+-	if (!ret)
+-		return ret;
+-
+-	return qca8k_mdio_write(priv, port, regnum, data);
++	return qca8k_internal_mdio_write(slave_bus, port, regnum, data);
+ }
+ 
+ static int
+-qca8k_phy_read(struct dsa_switch *ds, int port, int regnum)
++qca8k_legacy_mdio_read(struct mii_bus *slave_bus, int port, int regnum)
+ {
+-	struct qca8k_priv *priv = ds->priv;
+-	int ret;
+-
+-	/* Check if the legacy mapping should be used and the
+-	 * port is not correctly mapped to the right PHY in the
+-	 * devicetree
+-	 */
+-	if (priv->legacy_phy_port_mapping)
+-		port = qca8k_port_to_phy(port) % PHY_MAX_ADDR;
+-
+-	/* Use mdio Ethernet when available, fallback to legacy one on error */
+-	ret = qca8k_phy_eth_command(priv, true, port, regnum, 0);
+-	if (ret >= 0)
+-		return ret;
+-
+-	ret = qca8k_mdio_read(priv, port, regnum);
+-
+-	if (ret < 0)
+-		return 0xffff;
++	port = qca8k_port_to_phy(port) % PHY_MAX_ADDR;
+ 
+-	return ret;
++	return qca8k_internal_mdio_read(slave_bus, port, regnum);
+ }
+ 
+ static int
+-qca8k_mdio_register(struct qca8k_priv *priv, struct device_node *mdio)
++qca8k_mdio_register(struct qca8k_priv *priv)
+ {
+ 	struct dsa_switch *ds = priv->ds;
++	struct device_node *mdio;
+ 	struct mii_bus *bus;
+ 
+ 	bus = devm_mdiobus_alloc(ds->dev);
+-
+ 	if (!bus)
+ 		return -ENOMEM;
+ 
+ 	bus->priv = (void *)priv;
+-	bus->name = "qca8k slave mii";
+-	bus->read = qca8k_internal_mdio_read;
+-	bus->write = qca8k_internal_mdio_write;
+-	snprintf(bus->id, MII_BUS_ID_SIZE, "qca8k-%d",
+-		 ds->index);
+-
+ 	bus->parent = ds->dev;
+ 	bus->phy_mask = ~ds->phys_mii_mask;
+-
+ 	ds->slave_mii_bus = bus;
+ 
+-	return devm_of_mdiobus_register(priv->dev, bus, mdio);
++	/* Check if the devicetree declare the port:phy mapping */
++	mdio = of_get_child_by_name(priv->dev->of_node, "mdio");
++	if (of_device_is_available(mdio)) {
++		snprintf(bus->id, MII_BUS_ID_SIZE, "qca8k-%d", ds->index);
++		bus->name = "qca8k slave mii";
++		bus->read = qca8k_internal_mdio_read;
++		bus->write = qca8k_internal_mdio_write;
++		return devm_of_mdiobus_register(priv->dev, bus, mdio);
++	}
++
++	/* If a mapping can't be found the legacy mapping is used,
++	 * using the qca8k_port_to_phy function
++	 */
++	snprintf(bus->id, MII_BUS_ID_SIZE, "qca8k-%d.%d",
++		 ds->dst->index, ds->index);
++	bus->name = "qca8k-legacy slave mii";
++	bus->read = qca8k_legacy_mdio_read;
++	bus->write = qca8k_legacy_mdio_write;
++	return devm_mdiobus_register(priv->dev, bus);
+ }
+ 
+ static int
+ qca8k_setup_mdio_bus(struct qca8k_priv *priv)
+ {
+ 	u32 internal_mdio_mask = 0, external_mdio_mask = 0, reg;
+-	struct device_node *ports, *port, *mdio;
++	struct device_node *ports, *port;
+ 	phy_interface_t mode;
+ 	int err;
+ 
+@@ -1429,24 +1409,7 @@ qca8k_setup_mdio_bus(struct qca8k_priv *
+ 					 QCA8K_MDIO_MASTER_EN);
+ 	}
+ 
+-	/* Check if the devicetree declare the port:phy mapping */
+-	mdio = of_get_child_by_name(priv->dev->of_node, "mdio");
+-	if (of_device_is_available(mdio)) {
+-		err = qca8k_mdio_register(priv, mdio);
+-		if (err)
+-			of_node_put(mdio);
+-
+-		return err;
+-	}
+-
+-	/* If a mapping can't be found the legacy mapping is used,
+-	 * using the qca8k_port_to_phy function
+-	 */
+-	priv->legacy_phy_port_mapping = true;
+-	priv->ops.phy_read = qca8k_phy_read;
+-	priv->ops.phy_write = qca8k_phy_write;
+-
+-	return 0;
++	return qca8k_mdio_register(priv);
+ }
+ 
+ static int
+--- a/drivers/net/dsa/qca8k.h
++++ b/drivers/net/dsa/qca8k.h
+@@ -382,7 +382,6 @@ struct qca8k_priv {
+ 	 * Bit 1: port enabled. Bit 0: port disabled.
+ 	 */
+ 	u8 port_enabled_map;
+-	bool legacy_phy_port_mapping;
+ 	struct qca8k_ports_config ports_config;
+ 	struct regmap *regmap;
+ 	struct mii_bus *bus;
diff --git a/target/linux/generic/backport-5.15/769-v5.19-04-net-dsa-qca8k-drop-dsa_switch_ops-from-qca8k_priv.patch b/target/linux/generic/backport-5.15/769-v5.19-04-net-dsa-qca8k-drop-dsa_switch_ops-from-qca8k_priv.patch
new file mode 100644
index 00000000000000..8641000abbc642
--- /dev/null
+++ b/target/linux/generic/backport-5.15/769-v5.19-04-net-dsa-qca8k-drop-dsa_switch_ops-from-qca8k_priv.patch
@@ -0,0 +1,39 @@
+From 2349b83a2486c55b9dd225326f0172a84a43c5e4 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sat, 16 Apr 2022 01:30:15 +0200
+Subject: [PATCH 4/6] net: dsa: qca8k: drop dsa_switch_ops from qca8k_priv
+
+Now that dsa_switch_ops is not switch specific anymore, we can drop it
+from qca8k_priv and use the static ops directly for the dsa_switch
+pointer.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 3 +--
+ drivers/net/dsa/qca8k.h | 1 -
+ 2 files changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -3121,8 +3121,7 @@ qca8k_sw_probe(struct mdio_device *mdiod
+ 	priv->ds->dev = &mdiodev->dev;
+ 	priv->ds->num_ports = QCA8K_NUM_PORTS;
+ 	priv->ds->priv = priv;
+-	priv->ops = qca8k_switch_ops;
+-	priv->ds->ops = &priv->ops;
++	priv->ds->ops = &qca8k_switch_ops;
+ 	mutex_init(&priv->reg_mutex);
+ 	dev_set_drvdata(&mdiodev->dev, priv);
+ 
+--- a/drivers/net/dsa/qca8k.h
++++ b/drivers/net/dsa/qca8k.h
+@@ -388,7 +388,6 @@ struct qca8k_priv {
+ 	struct dsa_switch *ds;
+ 	struct mutex reg_mutex;
+ 	struct device *dev;
+-	struct dsa_switch_ops ops;
+ 	struct gpio_desc *reset_gpio;
+ 	struct net_device *mgmt_master; /* Track if mdio/mib Ethernet is available */
+ 	struct qca8k_mgmt_eth_data mgmt_eth_data;
diff --git a/target/linux/generic/backport-5.15/769-v5.19-05-net-dsa-qca8k-correctly-handle-mdio-read-error.patch b/target/linux/generic/backport-5.15/769-v5.19-05-net-dsa-qca8k-correctly-handle-mdio-read-error.patch
new file mode 100644
index 00000000000000..b14b22091bc103
--- /dev/null
+++ b/target/linux/generic/backport-5.15/769-v5.19-05-net-dsa-qca8k-correctly-handle-mdio-read-error.patch
@@ -0,0 +1,33 @@
+From 6cfc03b602200c5cbbd8d906fd905547814e83df Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sat, 16 Apr 2022 01:30:16 +0200
+Subject: [PATCH 5/6] net: dsa: qca8k: correctly handle mdio read error
+
+Restore original way to handle mdio read error by returning 0xffff.
+This was wrongly changed when the internal_mdio_read was introduced,
+now that both legacy and internal use the same function, make sure that
+they behave the same way.
+
+Fixes: ce062a0adbfe ("net: dsa: qca8k: fix kernel panic with legacy mdio mapping")
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -1287,7 +1287,12 @@ qca8k_internal_mdio_read(struct mii_bus
+ 	if (ret >= 0)
+ 		return ret;
+ 
+-	return qca8k_mdio_read(priv, phy, regnum);
++	ret = qca8k_mdio_read(priv, phy, regnum);
++
++	if (ret < 0)
++		return 0xffff;
++
++	return ret;
+ }
+ 
+ static int
diff --git a/target/linux/generic/backport-5.15/769-v5.19-06-net-dsa-qca8k-unify-bus-id-naming-with-legacy-and-OF.patch b/target/linux/generic/backport-5.15/769-v5.19-06-net-dsa-qca8k-unify-bus-id-naming-with-legacy-and-OF.patch
new file mode 100644
index 00000000000000..094686f11bef54
--- /dev/null
+++ b/target/linux/generic/backport-5.15/769-v5.19-06-net-dsa-qca8k-unify-bus-id-naming-with-legacy-and-OF.patch
@@ -0,0 +1,44 @@
+From 8d1af50842bf2774f4edc57054206e909117469b Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sat, 16 Apr 2022 01:30:17 +0200
+Subject: [PATCH 6/6] net: dsa: qca8k: unify bus id naming with legacy and OF
+ mdio bus
+
+Add support for multiple switch with OF mdio bus declaration.
+Unify the bus id naming and use the same logic for both legacy and OF
+mdio bus.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca8k.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -1323,6 +1323,8 @@ qca8k_mdio_register(struct qca8k_priv *p
+ 		return -ENOMEM;
+ 
+ 	bus->priv = (void *)priv;
++	snprintf(bus->id, MII_BUS_ID_SIZE, "qca8k-%d.%d",
++		 ds->dst->index, ds->index);
+ 	bus->parent = ds->dev;
+ 	bus->phy_mask = ~ds->phys_mii_mask;
+ 	ds->slave_mii_bus = bus;
+@@ -1330,7 +1332,6 @@ qca8k_mdio_register(struct qca8k_priv *p
+ 	/* Check if the devicetree declare the port:phy mapping */
+ 	mdio = of_get_child_by_name(priv->dev->of_node, "mdio");
+ 	if (of_device_is_available(mdio)) {
+-		snprintf(bus->id, MII_BUS_ID_SIZE, "qca8k-%d", ds->index);
+ 		bus->name = "qca8k slave mii";
+ 		bus->read = qca8k_internal_mdio_read;
+ 		bus->write = qca8k_internal_mdio_write;
+@@ -1340,8 +1341,6 @@ qca8k_mdio_register(struct qca8k_priv *p
+ 	/* If a mapping can't be found the legacy mapping is used,
+ 	 * using the qca8k_port_to_phy function
+ 	 */
+-	snprintf(bus->id, MII_BUS_ID_SIZE, "qca8k-%d.%d",
+-		 ds->dst->index, ds->index);
+ 	bus->name = "qca8k-legacy slave mii";
+ 	bus->read = qca8k_legacy_mdio_read;
+ 	bus->write = qca8k_legacy_mdio_write;
diff --git a/target/linux/generic/backport-5.15/770-v6.0-net-dsa-qca8k-move-driver-to-qca-dir.patch b/target/linux/generic/backport-5.15/770-v6.0-net-dsa-qca8k-move-driver-to-qca-dir.patch
new file mode 100644
index 00000000000000..1534113f1df603
--- /dev/null
+++ b/target/linux/generic/backport-5.15/770-v6.0-net-dsa-qca8k-move-driver-to-qca-dir.patch
@@ -0,0 +1,7389 @@
+From 4bbaf764e1e1786eb937fdb62172f656f512e116 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 13 Jul 2022 22:53:50 +0200
+Subject: [PATCH 1/1] net: dsa: qca8k: move driver to qca dir
+
+Move qca8k driver to qca dir in preparation for code split and
+introduction of ipq4019 switch based on qca8k.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/Kconfig           | 8 --------
+ drivers/net/dsa/Makefile          | 1 -
+ drivers/net/dsa/qca/Kconfig       | 8 ++++++++
+ drivers/net/dsa/qca/Makefile      | 1 +
+ drivers/net/dsa/{ => qca}/qca8k.c | 0
+ drivers/net/dsa/{ => qca}/qca8k.h | 0
+ 6 files changed, 9 insertions(+), 9 deletions(-)
+ rename drivers/net/dsa/{ => qca}/qca8k.c (100%)
+ rename drivers/net/dsa/{ => qca}/qca8k.h (100%)
+
+--- a/drivers/net/dsa/Kconfig
++++ b/drivers/net/dsa/Kconfig
+@@ -60,14 +60,6 @@ source "drivers/net/dsa/sja1105/Kconfig"
+ 
+ source "drivers/net/dsa/xrs700x/Kconfig"
+ 
+-config NET_DSA_QCA8K
+-	tristate "Qualcomm Atheros QCA8K Ethernet switch family support"
+-	select NET_DSA_TAG_QCA
+-	select REGMAP
+-	help
+-	  This enables support for the Qualcomm Atheros QCA8K Ethernet
+-	  switch chips.
+-
+ config NET_DSA_REALTEK_SMI
+ 	tristate "Realtek SMI Ethernet switch family support"
+ 	select NET_DSA_TAG_RTL4_A
+--- a/drivers/net/dsa/Makefile
++++ b/drivers/net/dsa/Makefile
+@@ -8,7 +8,6 @@ endif
+ obj-$(CONFIG_NET_DSA_LANTIQ_GSWIP) += lantiq_gswip.o
+ obj-$(CONFIG_NET_DSA_MT7530)	+= mt7530.o
+ obj-$(CONFIG_NET_DSA_MV88E6060) += mv88e6060.o
+-obj-$(CONFIG_NET_DSA_QCA8K)	+= qca8k.o
+ obj-$(CONFIG_NET_DSA_REALTEK_SMI) += realtek-smi.o
+ realtek-smi-objs		:= realtek-smi-core.o rtl8366.o rtl8366rb.o
+ obj-$(CONFIG_NET_DSA_SMSC_LAN9303) += lan9303-core.o
+--- a/drivers/net/dsa/qca/Kconfig
++++ b/drivers/net/dsa/qca/Kconfig
+@@ -7,3 +7,11 @@ config NET_DSA_AR9331
+ 	help
+ 	  This enables support for the Qualcomm Atheros AR9331 built-in Ethernet
+ 	  switch.
++
++config NET_DSA_QCA8K
++	tristate "Qualcomm Atheros QCA8K Ethernet switch family support"
++	select NET_DSA_TAG_QCA
++	select REGMAP
++	help
++	  This enables support for the Qualcomm Atheros QCA8K Ethernet
++	  switch chips.
+--- a/drivers/net/dsa/qca/Makefile
++++ b/drivers/net/dsa/qca/Makefile
+@@ -1,2 +1,3 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ obj-$(CONFIG_NET_DSA_AR9331)	+= ar9331.o
++obj-$(CONFIG_NET_DSA_QCA8K)	+= qca8k.o
+--- /dev/null
++++ b/drivers/net/dsa/qca/qca8k.c
+@@ -0,0 +1,3243 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (C) 2009 Felix Fietkau <nbd@nbd.name>
++ * Copyright (C) 2011-2012 Gabor Juhos <juhosg@openwrt.org>
++ * Copyright (c) 2015, 2019, The Linux Foundation. All rights reserved.
++ * Copyright (c) 2016 John Crispin <john@phrozen.org>
++ */
++
++#include <linux/module.h>
++#include <linux/phy.h>
++#include <linux/netdevice.h>
++#include <linux/bitfield.h>
++#include <linux/regmap.h>
++#include <net/dsa.h>
++#include <linux/of_net.h>
++#include <linux/of_mdio.h>
++#include <linux/of_platform.h>
++#include <linux/if_bridge.h>
++#include <linux/mdio.h>
++#include <linux/phylink.h>
++#include <linux/gpio/consumer.h>
++#include <linux/etherdevice.h>
++#include <linux/dsa/tag_qca.h>
++
++#include "qca8k.h"
++
++#define MIB_DESC(_s, _o, _n)	\
++	{			\
++		.size = (_s),	\
++		.offset = (_o),	\
++		.name = (_n),	\
++	}
++
++static const struct qca8k_mib_desc ar8327_mib[] = {
++	MIB_DESC(1, 0x00, "RxBroad"),
++	MIB_DESC(1, 0x04, "RxPause"),
++	MIB_DESC(1, 0x08, "RxMulti"),
++	MIB_DESC(1, 0x0c, "RxFcsErr"),
++	MIB_DESC(1, 0x10, "RxAlignErr"),
++	MIB_DESC(1, 0x14, "RxRunt"),
++	MIB_DESC(1, 0x18, "RxFragment"),
++	MIB_DESC(1, 0x1c, "Rx64Byte"),
++	MIB_DESC(1, 0x20, "Rx128Byte"),
++	MIB_DESC(1, 0x24, "Rx256Byte"),
++	MIB_DESC(1, 0x28, "Rx512Byte"),
++	MIB_DESC(1, 0x2c, "Rx1024Byte"),
++	MIB_DESC(1, 0x30, "Rx1518Byte"),
++	MIB_DESC(1, 0x34, "RxMaxByte"),
++	MIB_DESC(1, 0x38, "RxTooLong"),
++	MIB_DESC(2, 0x3c, "RxGoodByte"),
++	MIB_DESC(2, 0x44, "RxBadByte"),
++	MIB_DESC(1, 0x4c, "RxOverFlow"),
++	MIB_DESC(1, 0x50, "Filtered"),
++	MIB_DESC(1, 0x54, "TxBroad"),
++	MIB_DESC(1, 0x58, "TxPause"),
++	MIB_DESC(1, 0x5c, "TxMulti"),
++	MIB_DESC(1, 0x60, "TxUnderRun"),
++	MIB_DESC(1, 0x64, "Tx64Byte"),
++	MIB_DESC(1, 0x68, "Tx128Byte"),
++	MIB_DESC(1, 0x6c, "Tx256Byte"),
++	MIB_DESC(1, 0x70, "Tx512Byte"),
++	MIB_DESC(1, 0x74, "Tx1024Byte"),
++	MIB_DESC(1, 0x78, "Tx1518Byte"),
++	MIB_DESC(1, 0x7c, "TxMaxByte"),
++	MIB_DESC(1, 0x80, "TxOverSize"),
++	MIB_DESC(2, 0x84, "TxByte"),
++	MIB_DESC(1, 0x8c, "TxCollision"),
++	MIB_DESC(1, 0x90, "TxAbortCol"),
++	MIB_DESC(1, 0x94, "TxMultiCol"),
++	MIB_DESC(1, 0x98, "TxSingleCol"),
++	MIB_DESC(1, 0x9c, "TxExcDefer"),
++	MIB_DESC(1, 0xa0, "TxDefer"),
++	MIB_DESC(1, 0xa4, "TxLateCol"),
++	MIB_DESC(1, 0xa8, "RXUnicast"),
++	MIB_DESC(1, 0xac, "TXUnicast"),
++};
++
++static void
++qca8k_split_addr(u32 regaddr, u16 *r1, u16 *r2, u16 *page)
++{
++	regaddr >>= 1;
++	*r1 = regaddr & 0x1e;
++
++	regaddr >>= 5;
++	*r2 = regaddr & 0x7;
++
++	regaddr >>= 3;
++	*page = regaddr & 0x3ff;
++}
++
++static int
++qca8k_set_lo(struct qca8k_priv *priv, int phy_id, u32 regnum, u16 lo)
++{
++	u16 *cached_lo = &priv->mdio_cache.lo;
++	struct mii_bus *bus = priv->bus;
++	int ret;
++
++	if (lo == *cached_lo)
++		return 0;
++
++	ret = bus->write(bus, phy_id, regnum, lo);
++	if (ret < 0)
++		dev_err_ratelimited(&bus->dev,
++				    "failed to write qca8k 32bit lo register\n");
++
++	*cached_lo = lo;
++	return 0;
++}
++
++static int
++qca8k_set_hi(struct qca8k_priv *priv, int phy_id, u32 regnum, u16 hi)
++{
++	u16 *cached_hi = &priv->mdio_cache.hi;
++	struct mii_bus *bus = priv->bus;
++	int ret;
++
++	if (hi == *cached_hi)
++		return 0;
++
++	ret = bus->write(bus, phy_id, regnum, hi);
++	if (ret < 0)
++		dev_err_ratelimited(&bus->dev,
++				    "failed to write qca8k 32bit hi register\n");
++
++	*cached_hi = hi;
++	return 0;
++}
++
++static int
++qca8k_mii_read32(struct mii_bus *bus, int phy_id, u32 regnum, u32 *val)
++{
++	int ret;
++
++	ret = bus->read(bus, phy_id, regnum);
++	if (ret >= 0) {
++		*val = ret;
++		ret = bus->read(bus, phy_id, regnum + 1);
++		*val |= ret << 16;
++	}
++
++	if (ret < 0) {
++		dev_err_ratelimited(&bus->dev,
++				    "failed to read qca8k 32bit register\n");
++		*val = 0;
++		return ret;
++	}
++
++	return 0;
++}
++
++static void
++qca8k_mii_write32(struct qca8k_priv *priv, int phy_id, u32 regnum, u32 val)
++{
++	u16 lo, hi;
++	int ret;
++
++	lo = val & 0xffff;
++	hi = (u16)(val >> 16);
++
++	ret = qca8k_set_lo(priv, phy_id, regnum, lo);
++	if (ret >= 0)
++		ret = qca8k_set_hi(priv, phy_id, regnum + 1, hi);
++}
++
++static int
++qca8k_set_page(struct qca8k_priv *priv, u16 page)
++{
++	u16 *cached_page = &priv->mdio_cache.page;
++	struct mii_bus *bus = priv->bus;
++	int ret;
++
++	if (page == *cached_page)
++		return 0;
++
++	ret = bus->write(bus, 0x18, 0, page);
++	if (ret < 0) {
++		dev_err_ratelimited(&bus->dev,
++				    "failed to set qca8k page\n");
++		return ret;
++	}
++
++	*cached_page = page;
++	usleep_range(1000, 2000);
++	return 0;
++}
++
++static int
++qca8k_read(struct qca8k_priv *priv, u32 reg, u32 *val)
++{
++	return regmap_read(priv->regmap, reg, val);
++}
++
++static int
++qca8k_write(struct qca8k_priv *priv, u32 reg, u32 val)
++{
++	return regmap_write(priv->regmap, reg, val);
++}
++
++static int
++qca8k_rmw(struct qca8k_priv *priv, u32 reg, u32 mask, u32 write_val)
++{
++	return regmap_update_bits(priv->regmap, reg, mask, write_val);
++}
++
++static void qca8k_rw_reg_ack_handler(struct dsa_switch *ds, struct sk_buff *skb)
++{
++	struct qca8k_mgmt_eth_data *mgmt_eth_data;
++	struct qca8k_priv *priv = ds->priv;
++	struct qca_mgmt_ethhdr *mgmt_ethhdr;
++	u8 len, cmd;
++
++	mgmt_ethhdr = (struct qca_mgmt_ethhdr *)skb_mac_header(skb);
++	mgmt_eth_data = &priv->mgmt_eth_data;
++
++	cmd = FIELD_GET(QCA_HDR_MGMT_CMD, mgmt_ethhdr->command);
++	len = FIELD_GET(QCA_HDR_MGMT_LENGTH, mgmt_ethhdr->command);
++
++	/* Make sure the seq match the requested packet */
++	if (mgmt_ethhdr->seq == mgmt_eth_data->seq)
++		mgmt_eth_data->ack = true;
++
++	if (cmd == MDIO_READ) {
++		mgmt_eth_data->data[0] = mgmt_ethhdr->mdio_data;
++
++		/* Get the rest of the 12 byte of data.
++		 * The read/write function will extract the requested data.
++		 */
++		if (len > QCA_HDR_MGMT_DATA1_LEN)
++			memcpy(mgmt_eth_data->data + 1, skb->data,
++			       QCA_HDR_MGMT_DATA2_LEN);
++	}
++
++	complete(&mgmt_eth_data->rw_done);
++}
++
++static struct sk_buff *qca8k_alloc_mdio_header(enum mdio_cmd cmd, u32 reg, u32 *val,
++					       int priority, unsigned int len)
++{
++	struct qca_mgmt_ethhdr *mgmt_ethhdr;
++	unsigned int real_len;
++	struct sk_buff *skb;
++	u32 *data2;
++	u16 hdr;
++
++	skb = dev_alloc_skb(QCA_HDR_MGMT_PKT_LEN);
++	if (!skb)
++		return NULL;
++
++	/* Max value for len reg is 15 (0xf) but the switch actually return 16 byte
++	 * Actually for some reason the steps are:
++	 * 0: nothing
++	 * 1-4: first 4 byte
++	 * 5-6: first 12 byte
++	 * 7-15: all 16 byte
++	 */
++	if (len == 16)
++		real_len = 15;
++	else
++		real_len = len;
++
++	skb_reset_mac_header(skb);
++	skb_set_network_header(skb, skb->len);
++
++	mgmt_ethhdr = skb_push(skb, QCA_HDR_MGMT_HEADER_LEN + QCA_HDR_LEN);
++
++	hdr = FIELD_PREP(QCA_HDR_XMIT_VERSION, QCA_HDR_VERSION);
++	hdr |= FIELD_PREP(QCA_HDR_XMIT_PRIORITY, priority);
++	hdr |= QCA_HDR_XMIT_FROM_CPU;
++	hdr |= FIELD_PREP(QCA_HDR_XMIT_DP_BIT, BIT(0));
++	hdr |= FIELD_PREP(QCA_HDR_XMIT_CONTROL, QCA_HDR_XMIT_TYPE_RW_REG);
++
++	mgmt_ethhdr->command = FIELD_PREP(QCA_HDR_MGMT_ADDR, reg);
++	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_LENGTH, real_len);
++	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_CMD, cmd);
++	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_CHECK_CODE,
++					   QCA_HDR_MGMT_CHECK_CODE_VAL);
++
++	if (cmd == MDIO_WRITE)
++		mgmt_ethhdr->mdio_data = *val;
++
++	mgmt_ethhdr->hdr = htons(hdr);
++
++	data2 = skb_put_zero(skb, QCA_HDR_MGMT_DATA2_LEN + QCA_HDR_MGMT_PADDING_LEN);
++	if (cmd == MDIO_WRITE && len > QCA_HDR_MGMT_DATA1_LEN)
++		memcpy(data2, val + 1, len - QCA_HDR_MGMT_DATA1_LEN);
++
++	return skb;
++}
++
++static void qca8k_mdio_header_fill_seq_num(struct sk_buff *skb, u32 seq_num)
++{
++	struct qca_mgmt_ethhdr *mgmt_ethhdr;
++
++	mgmt_ethhdr = (struct qca_mgmt_ethhdr *)skb->data;
++	mgmt_ethhdr->seq = FIELD_PREP(QCA_HDR_MGMT_SEQ_NUM, seq_num);
++}
++
++static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
++{
++	struct qca8k_mgmt_eth_data *mgmt_eth_data = &priv->mgmt_eth_data;
++	struct sk_buff *skb;
++	bool ack;
++	int ret;
++
++	skb = qca8k_alloc_mdio_header(MDIO_READ, reg, NULL,
++				      QCA8K_ETHERNET_MDIO_PRIORITY, len);
++	if (!skb)
++		return -ENOMEM;
++
++	mutex_lock(&mgmt_eth_data->mutex);
++
++	/* Check mgmt_master if is operational */
++	if (!priv->mgmt_master) {
++		kfree_skb(skb);
++		mutex_unlock(&mgmt_eth_data->mutex);
++		return -EINVAL;
++	}
++
++	skb->dev = priv->mgmt_master;
++
++	reinit_completion(&mgmt_eth_data->rw_done);
++
++	/* Increment seq_num and set it in the mdio pkt */
++	mgmt_eth_data->seq++;
++	qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
++	mgmt_eth_data->ack = false;
++
++	dev_queue_xmit(skb);
++
++	ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
++					  msecs_to_jiffies(QCA8K_ETHERNET_TIMEOUT));
++
++	*val = mgmt_eth_data->data[0];
++	if (len > QCA_HDR_MGMT_DATA1_LEN)
++		memcpy(val + 1, mgmt_eth_data->data + 1, len - QCA_HDR_MGMT_DATA1_LEN);
++
++	ack = mgmt_eth_data->ack;
++
++	mutex_unlock(&mgmt_eth_data->mutex);
++
++	if (ret <= 0)
++		return -ETIMEDOUT;
++
++	if (!ack)
++		return -EINVAL;
++
++	return 0;
++}
++
++static int qca8k_write_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
++{
++	struct qca8k_mgmt_eth_data *mgmt_eth_data = &priv->mgmt_eth_data;
++	struct sk_buff *skb;
++	bool ack;
++	int ret;
++
++	skb = qca8k_alloc_mdio_header(MDIO_WRITE, reg, val,
++				      QCA8K_ETHERNET_MDIO_PRIORITY, len);
++	if (!skb)
++		return -ENOMEM;
++
++	mutex_lock(&mgmt_eth_data->mutex);
++
++	/* Check mgmt_master if is operational */
++	if (!priv->mgmt_master) {
++		kfree_skb(skb);
++		mutex_unlock(&mgmt_eth_data->mutex);
++		return -EINVAL;
++	}
++
++	skb->dev = priv->mgmt_master;
++
++	reinit_completion(&mgmt_eth_data->rw_done);
++
++	/* Increment seq_num and set it in the mdio pkt */
++	mgmt_eth_data->seq++;
++	qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
++	mgmt_eth_data->ack = false;
++
++	dev_queue_xmit(skb);
++
++	ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
++					  msecs_to_jiffies(QCA8K_ETHERNET_TIMEOUT));
++
++	ack = mgmt_eth_data->ack;
++
++	mutex_unlock(&mgmt_eth_data->mutex);
++
++	if (ret <= 0)
++		return -ETIMEDOUT;
++
++	if (!ack)
++		return -EINVAL;
++
++	return 0;
++}
++
++static int
++qca8k_regmap_update_bits_eth(struct qca8k_priv *priv, u32 reg, u32 mask, u32 write_val)
++{
++	u32 val = 0;
++	int ret;
++
++	ret = qca8k_read_eth(priv, reg, &val, sizeof(val));
++	if (ret)
++		return ret;
++
++	val &= ~mask;
++	val |= write_val;
++
++	return qca8k_write_eth(priv, reg, &val, sizeof(val));
++}
++
++static int
++qca8k_bulk_read(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
++{
++	int i, count = len / sizeof(u32), ret;
++
++	if (priv->mgmt_master && !qca8k_read_eth(priv, reg, val, len))
++		return 0;
++
++	for (i = 0; i < count; i++) {
++		ret = regmap_read(priv->regmap, reg + (i * 4), val + i);
++		if (ret < 0)
++			return ret;
++	}
++
++	return 0;
++}
++
++static int
++qca8k_bulk_write(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
++{
++	int i, count = len / sizeof(u32), ret;
++	u32 tmp;
++
++	if (priv->mgmt_master && !qca8k_write_eth(priv, reg, val, len))
++		return 0;
++
++	for (i = 0; i < count; i++) {
++		tmp = val[i];
++
++		ret = regmap_write(priv->regmap, reg + (i * 4), tmp);
++		if (ret < 0)
++			return ret;
++	}
++
++	return 0;
++}
++
++static int
++qca8k_regmap_read(void *ctx, uint32_t reg, uint32_t *val)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ctx;
++	struct mii_bus *bus = priv->bus;
++	u16 r1, r2, page;
++	int ret;
++
++	if (!qca8k_read_eth(priv, reg, val, sizeof(*val)))
++		return 0;
++
++	qca8k_split_addr(reg, &r1, &r2, &page);
++
++	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++
++	ret = qca8k_set_page(priv, page);
++	if (ret < 0)
++		goto exit;
++
++	ret = qca8k_mii_read32(bus, 0x10 | r2, r1, val);
++
++exit:
++	mutex_unlock(&bus->mdio_lock);
++	return ret;
++}
++
++static int
++qca8k_regmap_write(void *ctx, uint32_t reg, uint32_t val)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ctx;
++	struct mii_bus *bus = priv->bus;
++	u16 r1, r2, page;
++	int ret;
++
++	if (!qca8k_write_eth(priv, reg, &val, sizeof(val)))
++		return 0;
++
++	qca8k_split_addr(reg, &r1, &r2, &page);
++
++	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++
++	ret = qca8k_set_page(priv, page);
++	if (ret < 0)
++		goto exit;
++
++	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
++
++exit:
++	mutex_unlock(&bus->mdio_lock);
++	return ret;
++}
++
++static int
++qca8k_regmap_update_bits(void *ctx, uint32_t reg, uint32_t mask, uint32_t write_val)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ctx;
++	struct mii_bus *bus = priv->bus;
++	u16 r1, r2, page;
++	u32 val;
++	int ret;
++
++	if (!qca8k_regmap_update_bits_eth(priv, reg, mask, write_val))
++		return 0;
++
++	qca8k_split_addr(reg, &r1, &r2, &page);
++
++	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++
++	ret = qca8k_set_page(priv, page);
++	if (ret < 0)
++		goto exit;
++
++	ret = qca8k_mii_read32(bus, 0x10 | r2, r1, &val);
++	if (ret < 0)
++		goto exit;
++
++	val &= ~mask;
++	val |= write_val;
++	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
++
++exit:
++	mutex_unlock(&bus->mdio_lock);
++
++	return ret;
++}
++
++static const struct regmap_range qca8k_readable_ranges[] = {
++	regmap_reg_range(0x0000, 0x00e4), /* Global control */
++	regmap_reg_range(0x0100, 0x0168), /* EEE control */
++	regmap_reg_range(0x0200, 0x0270), /* Parser control */
++	regmap_reg_range(0x0400, 0x0454), /* ACL */
++	regmap_reg_range(0x0600, 0x0718), /* Lookup */
++	regmap_reg_range(0x0800, 0x0b70), /* QM */
++	regmap_reg_range(0x0c00, 0x0c80), /* PKT */
++	regmap_reg_range(0x0e00, 0x0e98), /* L3 */
++	regmap_reg_range(0x1000, 0x10ac), /* MIB - Port0 */
++	regmap_reg_range(0x1100, 0x11ac), /* MIB - Port1 */
++	regmap_reg_range(0x1200, 0x12ac), /* MIB - Port2 */
++	regmap_reg_range(0x1300, 0x13ac), /* MIB - Port3 */
++	regmap_reg_range(0x1400, 0x14ac), /* MIB - Port4 */
++	regmap_reg_range(0x1500, 0x15ac), /* MIB - Port5 */
++	regmap_reg_range(0x1600, 0x16ac), /* MIB - Port6 */
++
++};
++
++static const struct regmap_access_table qca8k_readable_table = {
++	.yes_ranges = qca8k_readable_ranges,
++	.n_yes_ranges = ARRAY_SIZE(qca8k_readable_ranges),
++};
++
++static struct regmap_config qca8k_regmap_config = {
++	.reg_bits = 16,
++	.val_bits = 32,
++	.reg_stride = 4,
++	.max_register = 0x16ac, /* end MIB - Port6 range */
++	.reg_read = qca8k_regmap_read,
++	.reg_write = qca8k_regmap_write,
++	.reg_update_bits = qca8k_regmap_update_bits,
++	.rd_table = &qca8k_readable_table,
++	.disable_locking = true, /* Locking is handled by qca8k read/write */
++	.cache_type = REGCACHE_NONE, /* Explicitly disable CACHE */
++};
++
++static int
++qca8k_busy_wait(struct qca8k_priv *priv, u32 reg, u32 mask)
++{
++	u32 val;
++
++	return regmap_read_poll_timeout(priv->regmap, reg, val, !(val & mask), 0,
++				       QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC);
++}
++
++static int
++qca8k_fdb_read(struct qca8k_priv *priv, struct qca8k_fdb *fdb)
++{
++	u32 reg[3];
++	int ret;
++
++	/* load the ARL table into an array */
++	ret = qca8k_bulk_read(priv, QCA8K_REG_ATU_DATA0, reg, sizeof(reg));
++	if (ret)
++		return ret;
++
++	/* vid - 83:72 */
++	fdb->vid = FIELD_GET(QCA8K_ATU_VID_MASK, reg[2]);
++	/* aging - 67:64 */
++	fdb->aging = FIELD_GET(QCA8K_ATU_STATUS_MASK, reg[2]);
++	/* portmask - 54:48 */
++	fdb->port_mask = FIELD_GET(QCA8K_ATU_PORT_MASK, reg[1]);
++	/* mac - 47:0 */
++	fdb->mac[0] = FIELD_GET(QCA8K_ATU_ADDR0_MASK, reg[1]);
++	fdb->mac[1] = FIELD_GET(QCA8K_ATU_ADDR1_MASK, reg[1]);
++	fdb->mac[2] = FIELD_GET(QCA8K_ATU_ADDR2_MASK, reg[0]);
++	fdb->mac[3] = FIELD_GET(QCA8K_ATU_ADDR3_MASK, reg[0]);
++	fdb->mac[4] = FIELD_GET(QCA8K_ATU_ADDR4_MASK, reg[0]);
++	fdb->mac[5] = FIELD_GET(QCA8K_ATU_ADDR5_MASK, reg[0]);
++
++	return 0;
++}
++
++static void
++qca8k_fdb_write(struct qca8k_priv *priv, u16 vid, u8 port_mask, const u8 *mac,
++		u8 aging)
++{
++	u32 reg[3] = { 0 };
++
++	/* vid - 83:72 */
++	reg[2] = FIELD_PREP(QCA8K_ATU_VID_MASK, vid);
++	/* aging - 67:64 */
++	reg[2] |= FIELD_PREP(QCA8K_ATU_STATUS_MASK, aging);
++	/* portmask - 54:48 */
++	reg[1] = FIELD_PREP(QCA8K_ATU_PORT_MASK, port_mask);
++	/* mac - 47:0 */
++	reg[1] |= FIELD_PREP(QCA8K_ATU_ADDR0_MASK, mac[0]);
++	reg[1] |= FIELD_PREP(QCA8K_ATU_ADDR1_MASK, mac[1]);
++	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR2_MASK, mac[2]);
++	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR3_MASK, mac[3]);
++	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR4_MASK, mac[4]);
++	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR5_MASK, mac[5]);
++
++	/* load the array into the ARL table */
++	qca8k_bulk_write(priv, QCA8K_REG_ATU_DATA0, reg, sizeof(reg));
++}
++
++static int
++qca8k_fdb_access(struct qca8k_priv *priv, enum qca8k_fdb_cmd cmd, int port)
++{
++	u32 reg;
++	int ret;
++
++	/* Set the command and FDB index */
++	reg = QCA8K_ATU_FUNC_BUSY;
++	reg |= cmd;
++	if (port >= 0) {
++		reg |= QCA8K_ATU_FUNC_PORT_EN;
++		reg |= FIELD_PREP(QCA8K_ATU_FUNC_PORT_MASK, port);
++	}
++
++	/* Write the function register triggering the table access */
++	ret = qca8k_write(priv, QCA8K_REG_ATU_FUNC, reg);
++	if (ret)
++		return ret;
++
++	/* wait for completion */
++	ret = qca8k_busy_wait(priv, QCA8K_REG_ATU_FUNC, QCA8K_ATU_FUNC_BUSY);
++	if (ret)
++		return ret;
++
++	/* Check for table full violation when adding an entry */
++	if (cmd == QCA8K_FDB_LOAD) {
++		ret = qca8k_read(priv, QCA8K_REG_ATU_FUNC, &reg);
++		if (ret < 0)
++			return ret;
++		if (reg & QCA8K_ATU_FUNC_FULL)
++			return -1;
++	}
++
++	return 0;
++}
++
++static int
++qca8k_fdb_next(struct qca8k_priv *priv, struct qca8k_fdb *fdb, int port)
++{
++	int ret;
++
++	qca8k_fdb_write(priv, fdb->vid, fdb->port_mask, fdb->mac, fdb->aging);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_NEXT, port);
++	if (ret < 0)
++		return ret;
++
++	return qca8k_fdb_read(priv, fdb);
++}
++
++static int
++qca8k_fdb_add(struct qca8k_priv *priv, const u8 *mac, u16 port_mask,
++	      u16 vid, u8 aging)
++{
++	int ret;
++
++	mutex_lock(&priv->reg_mutex);
++	qca8k_fdb_write(priv, vid, port_mask, mac, aging);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_LOAD, -1);
++	mutex_unlock(&priv->reg_mutex);
++
++	return ret;
++}
++
++static int
++qca8k_fdb_del(struct qca8k_priv *priv, const u8 *mac, u16 port_mask, u16 vid)
++{
++	int ret;
++
++	mutex_lock(&priv->reg_mutex);
++	qca8k_fdb_write(priv, vid, port_mask, mac, 0);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_PURGE, -1);
++	mutex_unlock(&priv->reg_mutex);
++
++	return ret;
++}
++
++static void
++qca8k_fdb_flush(struct qca8k_priv *priv)
++{
++	mutex_lock(&priv->reg_mutex);
++	qca8k_fdb_access(priv, QCA8K_FDB_FLUSH, -1);
++	mutex_unlock(&priv->reg_mutex);
++}
++
++static int
++qca8k_fdb_search_and_insert(struct qca8k_priv *priv, u8 port_mask,
++			    const u8 *mac, u16 vid)
++{
++	struct qca8k_fdb fdb = { 0 };
++	int ret;
++
++	mutex_lock(&priv->reg_mutex);
++
++	qca8k_fdb_write(priv, vid, 0, mac, 0);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_SEARCH, -1);
++	if (ret < 0)
++		goto exit;
++
++	ret = qca8k_fdb_read(priv, &fdb);
++	if (ret < 0)
++		goto exit;
++
++	/* Rule exist. Delete first */
++	if (!fdb.aging) {
++		ret = qca8k_fdb_access(priv, QCA8K_FDB_PURGE, -1);
++		if (ret)
++			goto exit;
++	}
++
++	/* Add port to fdb portmask */
++	fdb.port_mask |= port_mask;
++
++	qca8k_fdb_write(priv, vid, fdb.port_mask, mac, fdb.aging);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_LOAD, -1);
++
++exit:
++	mutex_unlock(&priv->reg_mutex);
++	return ret;
++}
++
++static int
++qca8k_fdb_search_and_del(struct qca8k_priv *priv, u8 port_mask,
++			 const u8 *mac, u16 vid)
++{
++	struct qca8k_fdb fdb = { 0 };
++	int ret;
++
++	mutex_lock(&priv->reg_mutex);
++
++	qca8k_fdb_write(priv, vid, 0, mac, 0);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_SEARCH, -1);
++	if (ret < 0)
++		goto exit;
++
++	/* Rule doesn't exist. Why delete? */
++	if (!fdb.aging) {
++		ret = -EINVAL;
++		goto exit;
++	}
++
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_PURGE, -1);
++	if (ret)
++		goto exit;
++
++	/* Only port in the rule is this port. Don't re insert */
++	if (fdb.port_mask == port_mask)
++		goto exit;
++
++	/* Remove port from port mask */
++	fdb.port_mask &= ~port_mask;
++
++	qca8k_fdb_write(priv, vid, fdb.port_mask, mac, fdb.aging);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_LOAD, -1);
++
++exit:
++	mutex_unlock(&priv->reg_mutex);
++	return ret;
++}
++
++static int
++qca8k_vlan_access(struct qca8k_priv *priv, enum qca8k_vlan_cmd cmd, u16 vid)
++{
++	u32 reg;
++	int ret;
++
++	/* Set the command and VLAN index */
++	reg = QCA8K_VTU_FUNC1_BUSY;
++	reg |= cmd;
++	reg |= FIELD_PREP(QCA8K_VTU_FUNC1_VID_MASK, vid);
++
++	/* Write the function register triggering the table access */
++	ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC1, reg);
++	if (ret)
++		return ret;
++
++	/* wait for completion */
++	ret = qca8k_busy_wait(priv, QCA8K_REG_VTU_FUNC1, QCA8K_VTU_FUNC1_BUSY);
++	if (ret)
++		return ret;
++
++	/* Check for table full violation when adding an entry */
++	if (cmd == QCA8K_VLAN_LOAD) {
++		ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC1, &reg);
++		if (ret < 0)
++			return ret;
++		if (reg & QCA8K_VTU_FUNC1_FULL)
++			return -ENOMEM;
++	}
++
++	return 0;
++}
++
++static int
++qca8k_vlan_add(struct qca8k_priv *priv, u8 port, u16 vid, bool untagged)
++{
++	u32 reg;
++	int ret;
++
++	/*
++	   We do the right thing with VLAN 0 and treat it as untagged while
++	   preserving the tag on egress.
++	 */
++	if (vid == 0)
++		return 0;
++
++	mutex_lock(&priv->reg_mutex);
++	ret = qca8k_vlan_access(priv, QCA8K_VLAN_READ, vid);
++	if (ret < 0)
++		goto out;
++
++	ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC0, &reg);
++	if (ret < 0)
++		goto out;
++	reg |= QCA8K_VTU_FUNC0_VALID | QCA8K_VTU_FUNC0_IVL_EN;
++	reg &= ~QCA8K_VTU_FUNC0_EG_MODE_PORT_MASK(port);
++	if (untagged)
++		reg |= QCA8K_VTU_FUNC0_EG_MODE_PORT_UNTAG(port);
++	else
++		reg |= QCA8K_VTU_FUNC0_EG_MODE_PORT_TAG(port);
++
++	ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC0, reg);
++	if (ret)
++		goto out;
++	ret = qca8k_vlan_access(priv, QCA8K_VLAN_LOAD, vid);
++
++out:
++	mutex_unlock(&priv->reg_mutex);
++
++	return ret;
++}
++
++static int
++qca8k_vlan_del(struct qca8k_priv *priv, u8 port, u16 vid)
++{
++	u32 reg, mask;
++	int ret, i;
++	bool del;
++
++	mutex_lock(&priv->reg_mutex);
++	ret = qca8k_vlan_access(priv, QCA8K_VLAN_READ, vid);
++	if (ret < 0)
++		goto out;
++
++	ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC0, &reg);
++	if (ret < 0)
++		goto out;
++	reg &= ~QCA8K_VTU_FUNC0_EG_MODE_PORT_MASK(port);
++	reg |= QCA8K_VTU_FUNC0_EG_MODE_PORT_NOT(port);
++
++	/* Check if we're the last member to be removed */
++	del = true;
++	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
++		mask = QCA8K_VTU_FUNC0_EG_MODE_PORT_NOT(i);
++
++		if ((reg & mask) != mask) {
++			del = false;
++			break;
++		}
++	}
++
++	if (del) {
++		ret = qca8k_vlan_access(priv, QCA8K_VLAN_PURGE, vid);
++	} else {
++		ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC0, reg);
++		if (ret)
++			goto out;
++		ret = qca8k_vlan_access(priv, QCA8K_VLAN_LOAD, vid);
++	}
++
++out:
++	mutex_unlock(&priv->reg_mutex);
++
++	return ret;
++}
++
++static int
++qca8k_mib_init(struct qca8k_priv *priv)
++{
++	int ret;
++
++	mutex_lock(&priv->reg_mutex);
++	ret = regmap_update_bits(priv->regmap, QCA8K_REG_MIB,
++				 QCA8K_MIB_FUNC | QCA8K_MIB_BUSY,
++				 FIELD_PREP(QCA8K_MIB_FUNC, QCA8K_MIB_FLUSH) |
++				 QCA8K_MIB_BUSY);
++	if (ret)
++		goto exit;
++
++	ret = qca8k_busy_wait(priv, QCA8K_REG_MIB, QCA8K_MIB_BUSY);
++	if (ret)
++		goto exit;
++
++	ret = regmap_set_bits(priv->regmap, QCA8K_REG_MIB, QCA8K_MIB_CPU_KEEP);
++	if (ret)
++		goto exit;
++
++	ret = qca8k_write(priv, QCA8K_REG_MODULE_EN, QCA8K_MODULE_EN_MIB);
++
++exit:
++	mutex_unlock(&priv->reg_mutex);
++	return ret;
++}
++
++static void
++qca8k_port_set_status(struct qca8k_priv *priv, int port, int enable)
++{
++	u32 mask = QCA8K_PORT_STATUS_TXMAC | QCA8K_PORT_STATUS_RXMAC;
++
++	/* Port 0 and 6 have no internal PHY */
++	if (port > 0 && port < 6)
++		mask |= QCA8K_PORT_STATUS_LINK_AUTO;
++
++	if (enable)
++		regmap_set_bits(priv->regmap, QCA8K_REG_PORT_STATUS(port), mask);
++	else
++		regmap_clear_bits(priv->regmap, QCA8K_REG_PORT_STATUS(port), mask);
++}
++
++static int
++qca8k_phy_eth_busy_wait(struct qca8k_mgmt_eth_data *mgmt_eth_data,
++			struct sk_buff *read_skb, u32 *val)
++{
++	struct sk_buff *skb = skb_copy(read_skb, GFP_KERNEL);
++	bool ack;
++	int ret;
++
++	reinit_completion(&mgmt_eth_data->rw_done);
++
++	/* Increment seq_num and set it in the copy pkt */
++	mgmt_eth_data->seq++;
++	qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
++	mgmt_eth_data->ack = false;
++
++	dev_queue_xmit(skb);
++
++	ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
++					  QCA8K_ETHERNET_TIMEOUT);
++
++	ack = mgmt_eth_data->ack;
++
++	if (ret <= 0)
++		return -ETIMEDOUT;
++
++	if (!ack)
++		return -EINVAL;
++
++	*val = mgmt_eth_data->data[0];
++
++	return 0;
++}
++
++static int
++qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
++		      int regnum, u16 data)
++{
++	struct sk_buff *write_skb, *clear_skb, *read_skb;
++	struct qca8k_mgmt_eth_data *mgmt_eth_data;
++	u32 write_val, clear_val = 0, val;
++	struct net_device *mgmt_master;
++	int ret, ret1;
++	bool ack;
++
++	if (regnum >= QCA8K_MDIO_MASTER_MAX_REG)
++		return -EINVAL;
++
++	mgmt_eth_data = &priv->mgmt_eth_data;
++
++	write_val = QCA8K_MDIO_MASTER_BUSY | QCA8K_MDIO_MASTER_EN |
++		    QCA8K_MDIO_MASTER_PHY_ADDR(phy) |
++		    QCA8K_MDIO_MASTER_REG_ADDR(regnum);
++
++	if (read) {
++		write_val |= QCA8K_MDIO_MASTER_READ;
++	} else {
++		write_val |= QCA8K_MDIO_MASTER_WRITE;
++		write_val |= QCA8K_MDIO_MASTER_DATA(data);
++	}
++
++	/* Prealloc all the needed skb before the lock */
++	write_skb = qca8k_alloc_mdio_header(MDIO_WRITE, QCA8K_MDIO_MASTER_CTRL, &write_val,
++					    QCA8K_ETHERNET_PHY_PRIORITY, sizeof(write_val));
++	if (!write_skb)
++		return -ENOMEM;
++
++	clear_skb = qca8k_alloc_mdio_header(MDIO_WRITE, QCA8K_MDIO_MASTER_CTRL, &clear_val,
++					    QCA8K_ETHERNET_PHY_PRIORITY, sizeof(clear_val));
++	if (!clear_skb) {
++		ret = -ENOMEM;
++		goto err_clear_skb;
++	}
++
++	read_skb = qca8k_alloc_mdio_header(MDIO_READ, QCA8K_MDIO_MASTER_CTRL, &clear_val,
++					   QCA8K_ETHERNET_PHY_PRIORITY, sizeof(clear_val));
++	if (!read_skb) {
++		ret = -ENOMEM;
++		goto err_read_skb;
++	}
++
++	/* Actually start the request:
++	 * 1. Send mdio master packet
++	 * 2. Busy Wait for mdio master command
++	 * 3. Get the data if we are reading
++	 * 4. Reset the mdio master (even with error)
++	 */
++	mutex_lock(&mgmt_eth_data->mutex);
++
++	/* Check if mgmt_master is operational */
++	mgmt_master = priv->mgmt_master;
++	if (!mgmt_master) {
++		mutex_unlock(&mgmt_eth_data->mutex);
++		ret = -EINVAL;
++		goto err_mgmt_master;
++	}
++
++	read_skb->dev = mgmt_master;
++	clear_skb->dev = mgmt_master;
++	write_skb->dev = mgmt_master;
++
++	reinit_completion(&mgmt_eth_data->rw_done);
++
++	/* Increment seq_num and set it in the write pkt */
++	mgmt_eth_data->seq++;
++	qca8k_mdio_header_fill_seq_num(write_skb, mgmt_eth_data->seq);
++	mgmt_eth_data->ack = false;
++
++	dev_queue_xmit(write_skb);
++
++	ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
++					  QCA8K_ETHERNET_TIMEOUT);
++
++	ack = mgmt_eth_data->ack;
++
++	if (ret <= 0) {
++		ret = -ETIMEDOUT;
++		kfree_skb(read_skb);
++		goto exit;
++	}
++
++	if (!ack) {
++		ret = -EINVAL;
++		kfree_skb(read_skb);
++		goto exit;
++	}
++
++	ret = read_poll_timeout(qca8k_phy_eth_busy_wait, ret1,
++				!(val & QCA8K_MDIO_MASTER_BUSY), 0,
++				QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC, false,
++				mgmt_eth_data, read_skb, &val);
++
++	if (ret < 0 && ret1 < 0) {
++		ret = ret1;
++		goto exit;
++	}
++
++	if (read) {
++		reinit_completion(&mgmt_eth_data->rw_done);
++
++		/* Increment seq_num and set it in the read pkt */
++		mgmt_eth_data->seq++;
++		qca8k_mdio_header_fill_seq_num(read_skb, mgmt_eth_data->seq);
++		mgmt_eth_data->ack = false;
++
++		dev_queue_xmit(read_skb);
++
++		ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
++						  QCA8K_ETHERNET_TIMEOUT);
++
++		ack = mgmt_eth_data->ack;
++
++		if (ret <= 0) {
++			ret = -ETIMEDOUT;
++			goto exit;
++		}
++
++		if (!ack) {
++			ret = -EINVAL;
++			goto exit;
++		}
++
++		ret = mgmt_eth_data->data[0] & QCA8K_MDIO_MASTER_DATA_MASK;
++	} else {
++		kfree_skb(read_skb);
++	}
++exit:
++	reinit_completion(&mgmt_eth_data->rw_done);
++
++	/* Increment seq_num and set it in the clear pkt */
++	mgmt_eth_data->seq++;
++	qca8k_mdio_header_fill_seq_num(clear_skb, mgmt_eth_data->seq);
++	mgmt_eth_data->ack = false;
++
++	dev_queue_xmit(clear_skb);
++
++	wait_for_completion_timeout(&mgmt_eth_data->rw_done,
++				    QCA8K_ETHERNET_TIMEOUT);
++
++	mutex_unlock(&mgmt_eth_data->mutex);
++
++	return ret;
++
++	/* Error handling before lock */
++err_mgmt_master:
++	kfree_skb(read_skb);
++err_read_skb:
++	kfree_skb(clear_skb);
++err_clear_skb:
++	kfree_skb(write_skb);
++
++	return ret;
++}
++
++static u32
++qca8k_port_to_phy(int port)
++{
++	/* From Andrew Lunn:
++	 * Port 0 has no internal phy.
++	 * Port 1 has an internal PHY at MDIO address 0.
++	 * Port 2 has an internal PHY at MDIO address 1.
++	 * ...
++	 * Port 5 has an internal PHY at MDIO address 4.
++	 * Port 6 has no internal PHY.
++	 */
++
++	return port - 1;
++}
++
++static int
++qca8k_mdio_busy_wait(struct mii_bus *bus, u32 reg, u32 mask)
++{
++	u16 r1, r2, page;
++	u32 val;
++	int ret, ret1;
++
++	qca8k_split_addr(reg, &r1, &r2, &page);
++
++	ret = read_poll_timeout(qca8k_mii_read32, ret1, !(val & mask), 0,
++				QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC, false,
++				bus, 0x10 | r2, r1, &val);
++
++	/* Check if qca8k_read has failed for a different reason
++	 * before returnting -ETIMEDOUT
++	 */
++	if (ret < 0 && ret1 < 0)
++		return ret1;
++
++	return ret;
++}
++
++static int
++qca8k_mdio_write(struct qca8k_priv *priv, int phy, int regnum, u16 data)
++{
++	struct mii_bus *bus = priv->bus;
++	u16 r1, r2, page;
++	u32 val;
++	int ret;
++
++	if (regnum >= QCA8K_MDIO_MASTER_MAX_REG)
++		return -EINVAL;
++
++	val = QCA8K_MDIO_MASTER_BUSY | QCA8K_MDIO_MASTER_EN |
++	      QCA8K_MDIO_MASTER_WRITE | QCA8K_MDIO_MASTER_PHY_ADDR(phy) |
++	      QCA8K_MDIO_MASTER_REG_ADDR(regnum) |
++	      QCA8K_MDIO_MASTER_DATA(data);
++
++	qca8k_split_addr(QCA8K_MDIO_MASTER_CTRL, &r1, &r2, &page);
++
++	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++
++	ret = qca8k_set_page(priv, page);
++	if (ret)
++		goto exit;
++
++	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
++
++	ret = qca8k_mdio_busy_wait(bus, QCA8K_MDIO_MASTER_CTRL,
++				   QCA8K_MDIO_MASTER_BUSY);
++
++exit:
++	/* even if the busy_wait timeouts try to clear the MASTER_EN */
++	qca8k_mii_write32(priv, 0x10 | r2, r1, 0);
++
++	mutex_unlock(&bus->mdio_lock);
++
++	return ret;
++}
++
++static int
++qca8k_mdio_read(struct qca8k_priv *priv, int phy, int regnum)
++{
++	struct mii_bus *bus = priv->bus;
++	u16 r1, r2, page;
++	u32 val;
++	int ret;
++
++	if (regnum >= QCA8K_MDIO_MASTER_MAX_REG)
++		return -EINVAL;
++
++	val = QCA8K_MDIO_MASTER_BUSY | QCA8K_MDIO_MASTER_EN |
++	      QCA8K_MDIO_MASTER_READ | QCA8K_MDIO_MASTER_PHY_ADDR(phy) |
++	      QCA8K_MDIO_MASTER_REG_ADDR(regnum);
++
++	qca8k_split_addr(QCA8K_MDIO_MASTER_CTRL, &r1, &r2, &page);
++
++	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++
++	ret = qca8k_set_page(priv, page);
++	if (ret)
++		goto exit;
++
++	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
++
++	ret = qca8k_mdio_busy_wait(bus, QCA8K_MDIO_MASTER_CTRL,
++				   QCA8K_MDIO_MASTER_BUSY);
++	if (ret)
++		goto exit;
++
++	ret = qca8k_mii_read32(bus, 0x10 | r2, r1, &val);
++
++exit:
++	/* even if the busy_wait timeouts try to clear the MASTER_EN */
++	qca8k_mii_write32(priv, 0x10 | r2, r1, 0);
++
++	mutex_unlock(&bus->mdio_lock);
++
++	if (ret >= 0)
++		ret = val & QCA8K_MDIO_MASTER_DATA_MASK;
++
++	return ret;
++}
++
++static int
++qca8k_internal_mdio_write(struct mii_bus *slave_bus, int phy, int regnum, u16 data)
++{
++	struct qca8k_priv *priv = slave_bus->priv;
++	int ret;
++
++	/* Use mdio Ethernet when available, fallback to legacy one on error */
++	ret = qca8k_phy_eth_command(priv, false, phy, regnum, data);
++	if (!ret)
++		return 0;
++
++	return qca8k_mdio_write(priv, phy, regnum, data);
++}
++
++static int
++qca8k_internal_mdio_read(struct mii_bus *slave_bus, int phy, int regnum)
++{
++	struct qca8k_priv *priv = slave_bus->priv;
++	int ret;
++
++	/* Use mdio Ethernet when available, fallback to legacy one on error */
++	ret = qca8k_phy_eth_command(priv, true, phy, regnum, 0);
++	if (ret >= 0)
++		return ret;
++
++	ret = qca8k_mdio_read(priv, phy, regnum);
++
++	if (ret < 0)
++		return 0xffff;
++
++	return ret;
++}
++
++static int
++qca8k_legacy_mdio_write(struct mii_bus *slave_bus, int port, int regnum, u16 data)
++{
++	port = qca8k_port_to_phy(port) % PHY_MAX_ADDR;
++
++	return qca8k_internal_mdio_write(slave_bus, port, regnum, data);
++}
++
++static int
++qca8k_legacy_mdio_read(struct mii_bus *slave_bus, int port, int regnum)
++{
++	port = qca8k_port_to_phy(port) % PHY_MAX_ADDR;
++
++	return qca8k_internal_mdio_read(slave_bus, port, regnum);
++}
++
++static int
++qca8k_mdio_register(struct qca8k_priv *priv)
++{
++	struct dsa_switch *ds = priv->ds;
++	struct device_node *mdio;
++	struct mii_bus *bus;
++
++	bus = devm_mdiobus_alloc(ds->dev);
++	if (!bus)
++		return -ENOMEM;
++
++	bus->priv = (void *)priv;
++	snprintf(bus->id, MII_BUS_ID_SIZE, "qca8k-%d.%d",
++		 ds->dst->index, ds->index);
++	bus->parent = ds->dev;
++	bus->phy_mask = ~ds->phys_mii_mask;
++	ds->slave_mii_bus = bus;
++
++	/* Check if the devicetree declare the port:phy mapping */
++	mdio = of_get_child_by_name(priv->dev->of_node, "mdio");
++	if (of_device_is_available(mdio)) {
++		bus->name = "qca8k slave mii";
++		bus->read = qca8k_internal_mdio_read;
++		bus->write = qca8k_internal_mdio_write;
++		return devm_of_mdiobus_register(priv->dev, bus, mdio);
++	}
++
++	/* If a mapping can't be found the legacy mapping is used,
++	 * using the qca8k_port_to_phy function
++	 */
++	bus->name = "qca8k-legacy slave mii";
++	bus->read = qca8k_legacy_mdio_read;
++	bus->write = qca8k_legacy_mdio_write;
++	return devm_mdiobus_register(priv->dev, bus);
++}
++
++static int
++qca8k_setup_mdio_bus(struct qca8k_priv *priv)
++{
++	u32 internal_mdio_mask = 0, external_mdio_mask = 0, reg;
++	struct device_node *ports, *port;
++	phy_interface_t mode;
++	int err;
++
++	ports = of_get_child_by_name(priv->dev->of_node, "ports");
++	if (!ports)
++		ports = of_get_child_by_name(priv->dev->of_node, "ethernet-ports");
++
++	if (!ports)
++		return -EINVAL;
++
++	for_each_available_child_of_node(ports, port) {
++		err = of_property_read_u32(port, "reg", &reg);
++		if (err) {
++			of_node_put(port);
++			of_node_put(ports);
++			return err;
++		}
++
++		if (!dsa_is_user_port(priv->ds, reg))
++			continue;
++
++		of_get_phy_mode(port, &mode);
++
++		if (of_property_read_bool(port, "phy-handle") &&
++		    mode != PHY_INTERFACE_MODE_INTERNAL)
++			external_mdio_mask |= BIT(reg);
++		else
++			internal_mdio_mask |= BIT(reg);
++	}
++
++	of_node_put(ports);
++	if (!external_mdio_mask && !internal_mdio_mask) {
++		dev_err(priv->dev, "no PHYs are defined.\n");
++		return -EINVAL;
++	}
++
++	/* The QCA8K_MDIO_MASTER_EN Bit, which grants access to PHYs through
++	 * the MDIO_MASTER register also _disconnects_ the external MDC
++	 * passthrough to the internal PHYs. It's not possible to use both
++	 * configurations at the same time!
++	 *
++	 * Because this came up during the review process:
++	 * If the external mdio-bus driver is capable magically disabling
++	 * the QCA8K_MDIO_MASTER_EN and mutex/spin-locking out the qca8k's
++	 * accessors for the time being, it would be possible to pull this
++	 * off.
++	 */
++	if (!!external_mdio_mask && !!internal_mdio_mask) {
++		dev_err(priv->dev, "either internal or external mdio bus configuration is supported.\n");
++		return -EINVAL;
++	}
++
++	if (external_mdio_mask) {
++		/* Make sure to disable the internal mdio bus in cases
++		 * a dt-overlay and driver reload changed the configuration
++		 */
++
++		return regmap_clear_bits(priv->regmap, QCA8K_MDIO_MASTER_CTRL,
++					 QCA8K_MDIO_MASTER_EN);
++	}
++
++	return qca8k_mdio_register(priv);
++}
++
++static int
++qca8k_setup_mac_pwr_sel(struct qca8k_priv *priv)
++{
++	u32 mask = 0;
++	int ret = 0;
++
++	/* SoC specific settings for ipq8064.
++	 * If more device require this consider adding
++	 * a dedicated binding.
++	 */
++	if (of_machine_is_compatible("qcom,ipq8064"))
++		mask |= QCA8K_MAC_PWR_RGMII0_1_8V;
++
++	/* SoC specific settings for ipq8065 */
++	if (of_machine_is_compatible("qcom,ipq8065"))
++		mask |= QCA8K_MAC_PWR_RGMII1_1_8V;
++
++	if (mask) {
++		ret = qca8k_rmw(priv, QCA8K_REG_MAC_PWR_SEL,
++				QCA8K_MAC_PWR_RGMII0_1_8V |
++				QCA8K_MAC_PWR_RGMII1_1_8V,
++				mask);
++	}
++
++	return ret;
++}
++
++static int qca8k_find_cpu_port(struct dsa_switch *ds)
++{
++	struct qca8k_priv *priv = ds->priv;
++
++	/* Find the connected cpu port. Valid port are 0 or 6 */
++	if (dsa_is_cpu_port(ds, 0))
++		return 0;
++
++	dev_dbg(priv->dev, "port 0 is not the CPU port. Checking port 6");
++
++	if (dsa_is_cpu_port(ds, 6))
++		return 6;
++
++	return -EINVAL;
++}
++
++static int
++qca8k_setup_of_pws_reg(struct qca8k_priv *priv)
++{
++	struct device_node *node = priv->dev->of_node;
++	const struct qca8k_match_data *data;
++	u32 val = 0;
++	int ret;
++
++	/* QCA8327 require to set to the correct mode.
++	 * His bigger brother QCA8328 have the 172 pin layout.
++	 * Should be applied by default but we set this just to make sure.
++	 */
++	if (priv->switch_id == QCA8K_ID_QCA8327) {
++		data = of_device_get_match_data(priv->dev);
++
++		/* Set the correct package of 148 pin for QCA8327 */
++		if (data->reduced_package)
++			val |= QCA8327_PWS_PACKAGE148_EN;
++
++		ret = qca8k_rmw(priv, QCA8K_REG_PWS, QCA8327_PWS_PACKAGE148_EN,
++				val);
++		if (ret)
++			return ret;
++	}
++
++	if (of_property_read_bool(node, "qca,ignore-power-on-sel"))
++		val |= QCA8K_PWS_POWER_ON_SEL;
++
++	if (of_property_read_bool(node, "qca,led-open-drain")) {
++		if (!(val & QCA8K_PWS_POWER_ON_SEL)) {
++			dev_err(priv->dev, "qca,led-open-drain require qca,ignore-power-on-sel to be set.");
++			return -EINVAL;
++		}
++
++		val |= QCA8K_PWS_LED_OPEN_EN_CSR;
++	}
++
++	return qca8k_rmw(priv, QCA8K_REG_PWS,
++			QCA8K_PWS_LED_OPEN_EN_CSR | QCA8K_PWS_POWER_ON_SEL,
++			val);
++}
++
++static int
++qca8k_parse_port_config(struct qca8k_priv *priv)
++{
++	int port, cpu_port_index = -1, ret;
++	struct device_node *port_dn;
++	phy_interface_t mode;
++	struct dsa_port *dp;
++	u32 delay;
++
++	/* We have 2 CPU port. Check them */
++	for (port = 0; port < QCA8K_NUM_PORTS; port++) {
++		/* Skip every other port */
++		if (port != 0 && port != 6)
++			continue;
++
++		dp = dsa_to_port(priv->ds, port);
++		port_dn = dp->dn;
++		cpu_port_index++;
++
++		if (!of_device_is_available(port_dn))
++			continue;
++
++		ret = of_get_phy_mode(port_dn, &mode);
++		if (ret)
++			continue;
++
++		switch (mode) {
++		case PHY_INTERFACE_MODE_RGMII:
++		case PHY_INTERFACE_MODE_RGMII_ID:
++		case PHY_INTERFACE_MODE_RGMII_TXID:
++		case PHY_INTERFACE_MODE_RGMII_RXID:
++		case PHY_INTERFACE_MODE_SGMII:
++			delay = 0;
++
++			if (!of_property_read_u32(port_dn, "tx-internal-delay-ps", &delay))
++				/* Switch regs accept value in ns, convert ps to ns */
++				delay = delay / 1000;
++			else if (mode == PHY_INTERFACE_MODE_RGMII_ID ||
++				 mode == PHY_INTERFACE_MODE_RGMII_TXID)
++				delay = 1;
++
++			if (!FIELD_FIT(QCA8K_PORT_PAD_RGMII_TX_DELAY_MASK, delay)) {
++				dev_err(priv->dev, "rgmii tx delay is limited to a max value of 3ns, setting to the max value");
++				delay = 3;
++			}
++
++			priv->ports_config.rgmii_tx_delay[cpu_port_index] = delay;
++
++			delay = 0;
++
++			if (!of_property_read_u32(port_dn, "rx-internal-delay-ps", &delay))
++				/* Switch regs accept value in ns, convert ps to ns */
++				delay = delay / 1000;
++			else if (mode == PHY_INTERFACE_MODE_RGMII_ID ||
++				 mode == PHY_INTERFACE_MODE_RGMII_RXID)
++				delay = 2;
++
++			if (!FIELD_FIT(QCA8K_PORT_PAD_RGMII_RX_DELAY_MASK, delay)) {
++				dev_err(priv->dev, "rgmii rx delay is limited to a max value of 3ns, setting to the max value");
++				delay = 3;
++			}
++
++			priv->ports_config.rgmii_rx_delay[cpu_port_index] = delay;
++
++			/* Skip sgmii parsing for rgmii* mode */
++			if (mode == PHY_INTERFACE_MODE_RGMII ||
++			    mode == PHY_INTERFACE_MODE_RGMII_ID ||
++			    mode == PHY_INTERFACE_MODE_RGMII_TXID ||
++			    mode == PHY_INTERFACE_MODE_RGMII_RXID)
++				break;
++
++			if (of_property_read_bool(port_dn, "qca,sgmii-txclk-falling-edge"))
++				priv->ports_config.sgmii_tx_clk_falling_edge = true;
++
++			if (of_property_read_bool(port_dn, "qca,sgmii-rxclk-falling-edge"))
++				priv->ports_config.sgmii_rx_clk_falling_edge = true;
++
++			if (of_property_read_bool(port_dn, "qca,sgmii-enable-pll")) {
++				priv->ports_config.sgmii_enable_pll = true;
++
++				if (priv->switch_id == QCA8K_ID_QCA8327) {
++					dev_err(priv->dev, "SGMII PLL should NOT be enabled for qca8327. Aborting enabling");
++					priv->ports_config.sgmii_enable_pll = false;
++				}
++
++				if (priv->switch_revision < 2)
++					dev_warn(priv->dev, "SGMII PLL should NOT be enabled for qca8337 with revision 2 or more.");
++			}
++
++			break;
++		default:
++			continue;
++		}
++	}
++
++	return 0;
++}
++
++static int
++qca8k_setup(struct dsa_switch *ds)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	int cpu_port, ret, i;
++	u32 mask;
++
++	cpu_port = qca8k_find_cpu_port(ds);
++	if (cpu_port < 0) {
++		dev_err(priv->dev, "No cpu port configured in both cpu port0 and port6");
++		return cpu_port;
++	}
++
++	/* Parse CPU port config to be later used in phy_link mac_config */
++	ret = qca8k_parse_port_config(priv);
++	if (ret)
++		return ret;
++
++	ret = qca8k_setup_mdio_bus(priv);
++	if (ret)
++		return ret;
++
++	ret = qca8k_setup_of_pws_reg(priv);
++	if (ret)
++		return ret;
++
++	ret = qca8k_setup_mac_pwr_sel(priv);
++	if (ret)
++		return ret;
++
++	/* Make sure MAC06 is disabled */
++	ret = regmap_clear_bits(priv->regmap, QCA8K_REG_PORT0_PAD_CTRL,
++				QCA8K_PORT0_PAD_MAC06_EXCHANGE_EN);
++	if (ret) {
++		dev_err(priv->dev, "failed disabling MAC06 exchange");
++		return ret;
++	}
++
++	/* Enable CPU Port */
++	ret = regmap_set_bits(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0,
++			      QCA8K_GLOBAL_FW_CTRL0_CPU_PORT_EN);
++	if (ret) {
++		dev_err(priv->dev, "failed enabling CPU port");
++		return ret;
++	}
++
++	/* Enable MIB counters */
++	ret = qca8k_mib_init(priv);
++	if (ret)
++		dev_warn(priv->dev, "mib init failed");
++
++	/* Initial setup of all ports */
++	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
++		/* Disable forwarding by default on all ports */
++		ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(i),
++				QCA8K_PORT_LOOKUP_MEMBER, 0);
++		if (ret)
++			return ret;
++
++		/* Enable QCA header mode on all cpu ports */
++		if (dsa_is_cpu_port(ds, i)) {
++			ret = qca8k_write(priv, QCA8K_REG_PORT_HDR_CTRL(i),
++					  FIELD_PREP(QCA8K_PORT_HDR_CTRL_TX_MASK, QCA8K_PORT_HDR_CTRL_ALL) |
++					  FIELD_PREP(QCA8K_PORT_HDR_CTRL_RX_MASK, QCA8K_PORT_HDR_CTRL_ALL));
++			if (ret) {
++				dev_err(priv->dev, "failed enabling QCA header mode");
++				return ret;
++			}
++		}
++
++		/* Disable MAC by default on all user ports */
++		if (dsa_is_user_port(ds, i))
++			qca8k_port_set_status(priv, i, 0);
++	}
++
++	/* Forward all unknown frames to CPU port for Linux processing
++	 * Notice that in multi-cpu config only one port should be set
++	 * for igmp, unknown, multicast and broadcast packet
++	 */
++	ret = qca8k_write(priv, QCA8K_REG_GLOBAL_FW_CTRL1,
++			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_IGMP_DP_MASK, BIT(cpu_port)) |
++			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_BC_DP_MASK, BIT(cpu_port)) |
++			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_MC_DP_MASK, BIT(cpu_port)) |
++			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_UC_DP_MASK, BIT(cpu_port)));
++	if (ret)
++		return ret;
++
++	/* Setup connection between CPU port & user ports
++	 * Configure specific switch configuration for ports
++	 */
++	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
++		/* CPU port gets connected to all user ports of the switch */
++		if (dsa_is_cpu_port(ds, i)) {
++			ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(i),
++					QCA8K_PORT_LOOKUP_MEMBER, dsa_user_ports(ds));
++			if (ret)
++				return ret;
++		}
++
++		/* Individual user ports get connected to CPU port only */
++		if (dsa_is_user_port(ds, i)) {
++			ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(i),
++					QCA8K_PORT_LOOKUP_MEMBER,
++					BIT(cpu_port));
++			if (ret)
++				return ret;
++
++			/* Enable ARP Auto-learning by default */
++			ret = regmap_set_bits(priv->regmap, QCA8K_PORT_LOOKUP_CTRL(i),
++					      QCA8K_PORT_LOOKUP_LEARN);
++			if (ret)
++				return ret;
++
++			/* For port based vlans to work we need to set the
++			 * default egress vid
++			 */
++			ret = qca8k_rmw(priv, QCA8K_EGRESS_VLAN(i),
++					QCA8K_EGREES_VLAN_PORT_MASK(i),
++					QCA8K_EGREES_VLAN_PORT(i, QCA8K_PORT_VID_DEF));
++			if (ret)
++				return ret;
++
++			ret = qca8k_write(priv, QCA8K_REG_PORT_VLAN_CTRL0(i),
++					  QCA8K_PORT_VLAN_CVID(QCA8K_PORT_VID_DEF) |
++					  QCA8K_PORT_VLAN_SVID(QCA8K_PORT_VID_DEF));
++			if (ret)
++				return ret;
++		}
++
++		/* The port 5 of the qca8337 have some problem in flood condition. The
++		 * original legacy driver had some specific buffer and priority settings
++		 * for the different port suggested by the QCA switch team. Add this
++		 * missing settings to improve switch stability under load condition.
++		 * This problem is limited to qca8337 and other qca8k switch are not affected.
++		 */
++		if (priv->switch_id == QCA8K_ID_QCA8337) {
++			switch (i) {
++			/* The 2 CPU port and port 5 requires some different
++			 * priority than any other ports.
++			 */
++			case 0:
++			case 5:
++			case 6:
++				mask = QCA8K_PORT_HOL_CTRL0_EG_PRI0(0x3) |
++					QCA8K_PORT_HOL_CTRL0_EG_PRI1(0x4) |
++					QCA8K_PORT_HOL_CTRL0_EG_PRI2(0x4) |
++					QCA8K_PORT_HOL_CTRL0_EG_PRI3(0x4) |
++					QCA8K_PORT_HOL_CTRL0_EG_PRI4(0x6) |
++					QCA8K_PORT_HOL_CTRL0_EG_PRI5(0x8) |
++					QCA8K_PORT_HOL_CTRL0_EG_PORT(0x1e);
++				break;
++			default:
++				mask = QCA8K_PORT_HOL_CTRL0_EG_PRI0(0x3) |
++					QCA8K_PORT_HOL_CTRL0_EG_PRI1(0x4) |
++					QCA8K_PORT_HOL_CTRL0_EG_PRI2(0x6) |
++					QCA8K_PORT_HOL_CTRL0_EG_PRI3(0x8) |
++					QCA8K_PORT_HOL_CTRL0_EG_PORT(0x19);
++			}
++			qca8k_write(priv, QCA8K_REG_PORT_HOL_CTRL0(i), mask);
++
++			mask = QCA8K_PORT_HOL_CTRL1_ING(0x6) |
++			QCA8K_PORT_HOL_CTRL1_EG_PRI_BUF_EN |
++			QCA8K_PORT_HOL_CTRL1_EG_PORT_BUF_EN |
++			QCA8K_PORT_HOL_CTRL1_WRED_EN;
++			qca8k_rmw(priv, QCA8K_REG_PORT_HOL_CTRL1(i),
++				  QCA8K_PORT_HOL_CTRL1_ING_BUF_MASK |
++				  QCA8K_PORT_HOL_CTRL1_EG_PRI_BUF_EN |
++				  QCA8K_PORT_HOL_CTRL1_EG_PORT_BUF_EN |
++				  QCA8K_PORT_HOL_CTRL1_WRED_EN,
++				  mask);
++		}
++	}
++
++	/* Special GLOBAL_FC_THRESH value are needed for ar8327 switch */
++	if (priv->switch_id == QCA8K_ID_QCA8327) {
++		mask = QCA8K_GLOBAL_FC_GOL_XON_THRES(288) |
++		       QCA8K_GLOBAL_FC_GOL_XOFF_THRES(496);
++		qca8k_rmw(priv, QCA8K_REG_GLOBAL_FC_THRESH,
++			  QCA8K_GLOBAL_FC_GOL_XON_THRES_MASK |
++			  QCA8K_GLOBAL_FC_GOL_XOFF_THRES_MASK,
++			  mask);
++	}
++
++	/* Setup our port MTUs to match power on defaults */
++	ret = qca8k_write(priv, QCA8K_MAX_FRAME_SIZE, ETH_FRAME_LEN + ETH_FCS_LEN);
++	if (ret)
++		dev_warn(priv->dev, "failed setting MTU settings");
++
++	/* Flush the FDB table */
++	qca8k_fdb_flush(priv);
++
++	/* We don't have interrupts for link changes, so we need to poll */
++	ds->pcs_poll = true;
++
++	/* Set min a max ageing value supported */
++	ds->ageing_time_min = 7000;
++	ds->ageing_time_max = 458745000;
++
++	/* Set max number of LAGs supported */
++	ds->num_lag_ids = QCA8K_NUM_LAGS;
++
++	return 0;
++}
++
++static void
++qca8k_mac_config_setup_internal_delay(struct qca8k_priv *priv, int cpu_port_index,
++				      u32 reg)
++{
++	u32 delay, val = 0;
++	int ret;
++
++	/* Delay can be declared in 3 different way.
++	 * Mode to rgmii and internal-delay standard binding defined
++	 * rgmii-id or rgmii-tx/rx phy mode set.
++	 * The parse logic set a delay different than 0 only when one
++	 * of the 3 different way is used. In all other case delay is
++	 * not enabled. With ID or TX/RXID delay is enabled and set
++	 * to the default and recommended value.
++	 */
++	if (priv->ports_config.rgmii_tx_delay[cpu_port_index]) {
++		delay = priv->ports_config.rgmii_tx_delay[cpu_port_index];
++
++		val |= QCA8K_PORT_PAD_RGMII_TX_DELAY(delay) |
++			QCA8K_PORT_PAD_RGMII_TX_DELAY_EN;
++	}
++
++	if (priv->ports_config.rgmii_rx_delay[cpu_port_index]) {
++		delay = priv->ports_config.rgmii_rx_delay[cpu_port_index];
++
++		val |= QCA8K_PORT_PAD_RGMII_RX_DELAY(delay) |
++			QCA8K_PORT_PAD_RGMII_RX_DELAY_EN;
++	}
++
++	/* Set RGMII delay based on the selected values */
++	ret = qca8k_rmw(priv, reg,
++			QCA8K_PORT_PAD_RGMII_TX_DELAY_MASK |
++			QCA8K_PORT_PAD_RGMII_RX_DELAY_MASK |
++			QCA8K_PORT_PAD_RGMII_TX_DELAY_EN |
++			QCA8K_PORT_PAD_RGMII_RX_DELAY_EN,
++			val);
++	if (ret)
++		dev_err(priv->dev, "Failed to set internal delay for CPU port%d",
++			cpu_port_index == QCA8K_CPU_PORT0 ? 0 : 6);
++}
++
++static void
++qca8k_phylink_mac_config(struct dsa_switch *ds, int port, unsigned int mode,
++			 const struct phylink_link_state *state)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int cpu_port_index, ret;
++	u32 reg, val;
++
++	switch (port) {
++	case 0: /* 1st CPU port */
++		if (state->interface != PHY_INTERFACE_MODE_RGMII &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_ID &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_TXID &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_RXID &&
++		    state->interface != PHY_INTERFACE_MODE_SGMII)
++			return;
++
++		reg = QCA8K_REG_PORT0_PAD_CTRL;
++		cpu_port_index = QCA8K_CPU_PORT0;
++		break;
++	case 1:
++	case 2:
++	case 3:
++	case 4:
++	case 5:
++		/* Internal PHY, nothing to do */
++		return;
++	case 6: /* 2nd CPU port / external PHY */
++		if (state->interface != PHY_INTERFACE_MODE_RGMII &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_ID &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_TXID &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_RXID &&
++		    state->interface != PHY_INTERFACE_MODE_SGMII &&
++		    state->interface != PHY_INTERFACE_MODE_1000BASEX)
++			return;
++
++		reg = QCA8K_REG_PORT6_PAD_CTRL;
++		cpu_port_index = QCA8K_CPU_PORT6;
++		break;
++	default:
++		dev_err(ds->dev, "%s: unsupported port: %i\n", __func__, port);
++		return;
++	}
++
++	if (port != 6 && phylink_autoneg_inband(mode)) {
++		dev_err(ds->dev, "%s: in-band negotiation unsupported\n",
++			__func__);
++		return;
++	}
++
++	switch (state->interface) {
++	case PHY_INTERFACE_MODE_RGMII:
++	case PHY_INTERFACE_MODE_RGMII_ID:
++	case PHY_INTERFACE_MODE_RGMII_TXID:
++	case PHY_INTERFACE_MODE_RGMII_RXID:
++		qca8k_write(priv, reg, QCA8K_PORT_PAD_RGMII_EN);
++
++		/* Configure rgmii delay */
++		qca8k_mac_config_setup_internal_delay(priv, cpu_port_index, reg);
++
++		/* QCA8337 requires to set rgmii rx delay for all ports.
++		 * This is enabled through PORT5_PAD_CTRL for all ports,
++		 * rather than individual port registers.
++		 */
++		if (priv->switch_id == QCA8K_ID_QCA8337)
++			qca8k_write(priv, QCA8K_REG_PORT5_PAD_CTRL,
++				    QCA8K_PORT_PAD_RGMII_RX_DELAY_EN);
++		break;
++	case PHY_INTERFACE_MODE_SGMII:
++	case PHY_INTERFACE_MODE_1000BASEX:
++		/* Enable SGMII on the port */
++		qca8k_write(priv, reg, QCA8K_PORT_PAD_SGMII_EN);
++
++		/* Enable/disable SerDes auto-negotiation as necessary */
++		ret = qca8k_read(priv, QCA8K_REG_PWS, &val);
++		if (ret)
++			return;
++		if (phylink_autoneg_inband(mode))
++			val &= ~QCA8K_PWS_SERDES_AEN_DIS;
++		else
++			val |= QCA8K_PWS_SERDES_AEN_DIS;
++		qca8k_write(priv, QCA8K_REG_PWS, val);
++
++		/* Configure the SGMII parameters */
++		ret = qca8k_read(priv, QCA8K_REG_SGMII_CTRL, &val);
++		if (ret)
++			return;
++
++		val |= QCA8K_SGMII_EN_SD;
++
++		if (priv->ports_config.sgmii_enable_pll)
++			val |= QCA8K_SGMII_EN_PLL | QCA8K_SGMII_EN_RX |
++			       QCA8K_SGMII_EN_TX;
++
++		if (dsa_is_cpu_port(ds, port)) {
++			/* CPU port, we're talking to the CPU MAC, be a PHY */
++			val &= ~QCA8K_SGMII_MODE_CTRL_MASK;
++			val |= QCA8K_SGMII_MODE_CTRL_PHY;
++		} else if (state->interface == PHY_INTERFACE_MODE_SGMII) {
++			val &= ~QCA8K_SGMII_MODE_CTRL_MASK;
++			val |= QCA8K_SGMII_MODE_CTRL_MAC;
++		} else if (state->interface == PHY_INTERFACE_MODE_1000BASEX) {
++			val &= ~QCA8K_SGMII_MODE_CTRL_MASK;
++			val |= QCA8K_SGMII_MODE_CTRL_BASEX;
++		}
++
++		qca8k_write(priv, QCA8K_REG_SGMII_CTRL, val);
++
++		/* From original code is reported port instability as SGMII also
++		 * require delay set. Apply advised values here or take them from DT.
++		 */
++		if (state->interface == PHY_INTERFACE_MODE_SGMII)
++			qca8k_mac_config_setup_internal_delay(priv, cpu_port_index, reg);
++
++		/* For qca8327/qca8328/qca8334/qca8338 sgmii is unique and
++		 * falling edge is set writing in the PORT0 PAD reg
++		 */
++		if (priv->switch_id == QCA8K_ID_QCA8327 ||
++		    priv->switch_id == QCA8K_ID_QCA8337)
++			reg = QCA8K_REG_PORT0_PAD_CTRL;
++
++		val = 0;
++
++		/* SGMII Clock phase configuration */
++		if (priv->ports_config.sgmii_rx_clk_falling_edge)
++			val |= QCA8K_PORT0_PAD_SGMII_RXCLK_FALLING_EDGE;
++
++		if (priv->ports_config.sgmii_tx_clk_falling_edge)
++			val |= QCA8K_PORT0_PAD_SGMII_TXCLK_FALLING_EDGE;
++
++		if (val)
++			ret = qca8k_rmw(priv, reg,
++					QCA8K_PORT0_PAD_SGMII_RXCLK_FALLING_EDGE |
++					QCA8K_PORT0_PAD_SGMII_TXCLK_FALLING_EDGE,
++					val);
++
++		break;
++	default:
++		dev_err(ds->dev, "xMII mode %s not supported for port %d\n",
++			phy_modes(state->interface), port);
++		return;
++	}
++}
++
++static void
++qca8k_phylink_validate(struct dsa_switch *ds, int port,
++		       unsigned long *supported,
++		       struct phylink_link_state *state)
++{
++	__ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
++
++	switch (port) {
++	case 0: /* 1st CPU port */
++		if (state->interface != PHY_INTERFACE_MODE_NA &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_ID &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_TXID &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_RXID &&
++		    state->interface != PHY_INTERFACE_MODE_SGMII)
++			goto unsupported;
++		break;
++	case 1:
++	case 2:
++	case 3:
++	case 4:
++	case 5:
++		/* Internal PHY */
++		if (state->interface != PHY_INTERFACE_MODE_NA &&
++		    state->interface != PHY_INTERFACE_MODE_GMII &&
++		    state->interface != PHY_INTERFACE_MODE_INTERNAL)
++			goto unsupported;
++		break;
++	case 6: /* 2nd CPU port / external PHY */
++		if (state->interface != PHY_INTERFACE_MODE_NA &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_ID &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_TXID &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_RXID &&
++		    state->interface != PHY_INTERFACE_MODE_SGMII &&
++		    state->interface != PHY_INTERFACE_MODE_1000BASEX)
++			goto unsupported;
++		break;
++	default:
++unsupported:
++		linkmode_zero(supported);
++		return;
++	}
++
++	phylink_set_port_modes(mask);
++	phylink_set(mask, Autoneg);
++
++	phylink_set(mask, 1000baseT_Full);
++	phylink_set(mask, 10baseT_Half);
++	phylink_set(mask, 10baseT_Full);
++	phylink_set(mask, 100baseT_Half);
++	phylink_set(mask, 100baseT_Full);
++
++	if (state->interface == PHY_INTERFACE_MODE_1000BASEX)
++		phylink_set(mask, 1000baseX_Full);
++
++	phylink_set(mask, Pause);
++	phylink_set(mask, Asym_Pause);
++
++	linkmode_and(supported, supported, mask);
++	linkmode_and(state->advertising, state->advertising, mask);
++}
++
++static int
++qca8k_phylink_mac_link_state(struct dsa_switch *ds, int port,
++			     struct phylink_link_state *state)
++{
++	struct qca8k_priv *priv = ds->priv;
++	u32 reg;
++	int ret;
++
++	ret = qca8k_read(priv, QCA8K_REG_PORT_STATUS(port), &reg);
++	if (ret < 0)
++		return ret;
++
++	state->link = !!(reg & QCA8K_PORT_STATUS_LINK_UP);
++	state->an_complete = state->link;
++	state->an_enabled = !!(reg & QCA8K_PORT_STATUS_LINK_AUTO);
++	state->duplex = (reg & QCA8K_PORT_STATUS_DUPLEX) ? DUPLEX_FULL :
++							   DUPLEX_HALF;
++
++	switch (reg & QCA8K_PORT_STATUS_SPEED) {
++	case QCA8K_PORT_STATUS_SPEED_10:
++		state->speed = SPEED_10;
++		break;
++	case QCA8K_PORT_STATUS_SPEED_100:
++		state->speed = SPEED_100;
++		break;
++	case QCA8K_PORT_STATUS_SPEED_1000:
++		state->speed = SPEED_1000;
++		break;
++	default:
++		state->speed = SPEED_UNKNOWN;
++		break;
++	}
++
++	state->pause = MLO_PAUSE_NONE;
++	if (reg & QCA8K_PORT_STATUS_RXFLOW)
++		state->pause |= MLO_PAUSE_RX;
++	if (reg & QCA8K_PORT_STATUS_TXFLOW)
++		state->pause |= MLO_PAUSE_TX;
++
++	return 1;
++}
++
++static void
++qca8k_phylink_mac_link_down(struct dsa_switch *ds, int port, unsigned int mode,
++			    phy_interface_t interface)
++{
++	struct qca8k_priv *priv = ds->priv;
++
++	qca8k_port_set_status(priv, port, 0);
++}
++
++static void
++qca8k_phylink_mac_link_up(struct dsa_switch *ds, int port, unsigned int mode,
++			  phy_interface_t interface, struct phy_device *phydev,
++			  int speed, int duplex, bool tx_pause, bool rx_pause)
++{
++	struct qca8k_priv *priv = ds->priv;
++	u32 reg;
++
++	if (phylink_autoneg_inband(mode)) {
++		reg = QCA8K_PORT_STATUS_LINK_AUTO;
++	} else {
++		switch (speed) {
++		case SPEED_10:
++			reg = QCA8K_PORT_STATUS_SPEED_10;
++			break;
++		case SPEED_100:
++			reg = QCA8K_PORT_STATUS_SPEED_100;
++			break;
++		case SPEED_1000:
++			reg = QCA8K_PORT_STATUS_SPEED_1000;
++			break;
++		default:
++			reg = QCA8K_PORT_STATUS_LINK_AUTO;
++			break;
++		}
++
++		if (duplex == DUPLEX_FULL)
++			reg |= QCA8K_PORT_STATUS_DUPLEX;
++
++		if (rx_pause || dsa_is_cpu_port(ds, port))
++			reg |= QCA8K_PORT_STATUS_RXFLOW;
++
++		if (tx_pause || dsa_is_cpu_port(ds, port))
++			reg |= QCA8K_PORT_STATUS_TXFLOW;
++	}
++
++	reg |= QCA8K_PORT_STATUS_TXMAC | QCA8K_PORT_STATUS_RXMAC;
++
++	qca8k_write(priv, QCA8K_REG_PORT_STATUS(port), reg);
++}
++
++static void
++qca8k_get_strings(struct dsa_switch *ds, int port, u32 stringset, uint8_t *data)
++{
++	const struct qca8k_match_data *match_data;
++	struct qca8k_priv *priv = ds->priv;
++	int i;
++
++	if (stringset != ETH_SS_STATS)
++		return;
++
++	match_data = of_device_get_match_data(priv->dev);
++
++	for (i = 0; i < match_data->mib_count; i++)
++		strncpy(data + i * ETH_GSTRING_LEN, ar8327_mib[i].name,
++			ETH_GSTRING_LEN);
++}
++
++static void qca8k_mib_autocast_handler(struct dsa_switch *ds, struct sk_buff *skb)
++{
++	const struct qca8k_match_data *match_data;
++	struct qca8k_mib_eth_data *mib_eth_data;
++	struct qca8k_priv *priv = ds->priv;
++	const struct qca8k_mib_desc *mib;
++	struct mib_ethhdr *mib_ethhdr;
++	int i, mib_len, offset = 0;
++	u64 *data;
++	u8 port;
++
++	mib_ethhdr = (struct mib_ethhdr *)skb_mac_header(skb);
++	mib_eth_data = &priv->mib_eth_data;
++
++	/* The switch autocast every port. Ignore other packet and
++	 * parse only the requested one.
++	 */
++	port = FIELD_GET(QCA_HDR_RECV_SOURCE_PORT, ntohs(mib_ethhdr->hdr));
++	if (port != mib_eth_data->req_port)
++		goto exit;
++
++	match_data = device_get_match_data(priv->dev);
++	data = mib_eth_data->data;
++
++	for (i = 0; i < match_data->mib_count; i++) {
++		mib = &ar8327_mib[i];
++
++		/* First 3 mib are present in the skb head */
++		if (i < 3) {
++			data[i] = mib_ethhdr->data[i];
++			continue;
++		}
++
++		mib_len = sizeof(uint32_t);
++
++		/* Some mib are 64 bit wide */
++		if (mib->size == 2)
++			mib_len = sizeof(uint64_t);
++
++		/* Copy the mib value from packet to the */
++		memcpy(data + i, skb->data + offset, mib_len);
++
++		/* Set the offset for the next mib */
++		offset += mib_len;
++	}
++
++exit:
++	/* Complete on receiving all the mib packet */
++	if (refcount_dec_and_test(&mib_eth_data->port_parsed))
++		complete(&mib_eth_data->rw_done);
++}
++
++static int
++qca8k_get_ethtool_stats_eth(struct dsa_switch *ds, int port, u64 *data)
++{
++	struct dsa_port *dp = dsa_to_port(ds, port);
++	struct qca8k_mib_eth_data *mib_eth_data;
++	struct qca8k_priv *priv = ds->priv;
++	int ret;
++
++	mib_eth_data = &priv->mib_eth_data;
++
++	mutex_lock(&mib_eth_data->mutex);
++
++	reinit_completion(&mib_eth_data->rw_done);
++
++	mib_eth_data->req_port = dp->index;
++	mib_eth_data->data = data;
++	refcount_set(&mib_eth_data->port_parsed, QCA8K_NUM_PORTS);
++
++	mutex_lock(&priv->reg_mutex);
++
++	/* Send mib autocast request */
++	ret = regmap_update_bits(priv->regmap, QCA8K_REG_MIB,
++				 QCA8K_MIB_FUNC | QCA8K_MIB_BUSY,
++				 FIELD_PREP(QCA8K_MIB_FUNC, QCA8K_MIB_CAST) |
++				 QCA8K_MIB_BUSY);
++
++	mutex_unlock(&priv->reg_mutex);
++
++	if (ret)
++		goto exit;
++
++	ret = wait_for_completion_timeout(&mib_eth_data->rw_done, QCA8K_ETHERNET_TIMEOUT);
++
++exit:
++	mutex_unlock(&mib_eth_data->mutex);
++
++	return ret;
++}
++
++static void
++qca8k_get_ethtool_stats(struct dsa_switch *ds, int port,
++			uint64_t *data)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	const struct qca8k_match_data *match_data;
++	const struct qca8k_mib_desc *mib;
++	u32 reg, i, val;
++	u32 hi = 0;
++	int ret;
++
++	if (priv->mgmt_master &&
++	    qca8k_get_ethtool_stats_eth(ds, port, data) > 0)
++		return;
++
++	match_data = of_device_get_match_data(priv->dev);
++
++	for (i = 0; i < match_data->mib_count; i++) {
++		mib = &ar8327_mib[i];
++		reg = QCA8K_PORT_MIB_COUNTER(port) + mib->offset;
++
++		ret = qca8k_read(priv, reg, &val);
++		if (ret < 0)
++			continue;
++
++		if (mib->size == 2) {
++			ret = qca8k_read(priv, reg + 4, &hi);
++			if (ret < 0)
++				continue;
++		}
++
++		data[i] = val;
++		if (mib->size == 2)
++			data[i] |= (u64)hi << 32;
++	}
++}
++
++static int
++qca8k_get_sset_count(struct dsa_switch *ds, int port, int sset)
++{
++	const struct qca8k_match_data *match_data;
++	struct qca8k_priv *priv = ds->priv;
++
++	if (sset != ETH_SS_STATS)
++		return 0;
++
++	match_data = of_device_get_match_data(priv->dev);
++
++	return match_data->mib_count;
++}
++
++static int
++qca8k_set_mac_eee(struct dsa_switch *ds, int port, struct ethtool_eee *eee)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	u32 lpi_en = QCA8K_REG_EEE_CTRL_LPI_EN(port);
++	u32 reg;
++	int ret;
++
++	mutex_lock(&priv->reg_mutex);
++	ret = qca8k_read(priv, QCA8K_REG_EEE_CTRL, &reg);
++	if (ret < 0)
++		goto exit;
++
++	if (eee->eee_enabled)
++		reg |= lpi_en;
++	else
++		reg &= ~lpi_en;
++	ret = qca8k_write(priv, QCA8K_REG_EEE_CTRL, reg);
++
++exit:
++	mutex_unlock(&priv->reg_mutex);
++	return ret;
++}
++
++static int
++qca8k_get_mac_eee(struct dsa_switch *ds, int port, struct ethtool_eee *e)
++{
++	/* Nothing to do on the port's MAC */
++	return 0;
++}
++
++static void
++qca8k_port_stp_state_set(struct dsa_switch *ds, int port, u8 state)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	u32 stp_state;
++
++	switch (state) {
++	case BR_STATE_DISABLED:
++		stp_state = QCA8K_PORT_LOOKUP_STATE_DISABLED;
++		break;
++	case BR_STATE_BLOCKING:
++		stp_state = QCA8K_PORT_LOOKUP_STATE_BLOCKING;
++		break;
++	case BR_STATE_LISTENING:
++		stp_state = QCA8K_PORT_LOOKUP_STATE_LISTENING;
++		break;
++	case BR_STATE_LEARNING:
++		stp_state = QCA8K_PORT_LOOKUP_STATE_LEARNING;
++		break;
++	case BR_STATE_FORWARDING:
++	default:
++		stp_state = QCA8K_PORT_LOOKUP_STATE_FORWARD;
++		break;
++	}
++
++	qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
++		  QCA8K_PORT_LOOKUP_STATE_MASK, stp_state);
++}
++
++static int
++qca8k_port_bridge_join(struct dsa_switch *ds, int port, struct net_device *br)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	int port_mask, cpu_port;
++	int i, ret;
++
++	cpu_port = dsa_to_port(ds, port)->cpu_dp->index;
++	port_mask = BIT(cpu_port);
++
++	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
++		if (dsa_is_cpu_port(ds, i))
++			continue;
++		if (dsa_to_port(ds, i)->bridge_dev != br)
++			continue;
++		/* Add this port to the portvlan mask of the other ports
++		 * in the bridge
++		 */
++		ret = regmap_set_bits(priv->regmap,
++				      QCA8K_PORT_LOOKUP_CTRL(i),
++				      BIT(port));
++		if (ret)
++			return ret;
++		if (i != port)
++			port_mask |= BIT(i);
++	}
++
++	/* Add all other ports to this ports portvlan mask */
++	ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
++			QCA8K_PORT_LOOKUP_MEMBER, port_mask);
++
++	return ret;
++}
++
++static void
++qca8k_port_bridge_leave(struct dsa_switch *ds, int port, struct net_device *br)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	int cpu_port, i;
++
++	cpu_port = dsa_to_port(ds, port)->cpu_dp->index;
++
++	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
++		if (dsa_is_cpu_port(ds, i))
++			continue;
++		if (dsa_to_port(ds, i)->bridge_dev != br)
++			continue;
++		/* Remove this port to the portvlan mask of the other ports
++		 * in the bridge
++		 */
++		regmap_clear_bits(priv->regmap,
++				  QCA8K_PORT_LOOKUP_CTRL(i),
++				  BIT(port));
++	}
++
++	/* Set the cpu port to be the only one in the portvlan mask of
++	 * this port
++	 */
++	qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
++		  QCA8K_PORT_LOOKUP_MEMBER, BIT(cpu_port));
++}
++
++static void
++qca8k_port_fast_age(struct dsa_switch *ds, int port)
++{
++	struct qca8k_priv *priv = ds->priv;
++
++	mutex_lock(&priv->reg_mutex);
++	qca8k_fdb_access(priv, QCA8K_FDB_FLUSH_PORT, port);
++	mutex_unlock(&priv->reg_mutex);
++}
++
++static int
++qca8k_set_ageing_time(struct dsa_switch *ds, unsigned int msecs)
++{
++	struct qca8k_priv *priv = ds->priv;
++	unsigned int secs = msecs / 1000;
++	u32 val;
++
++	/* AGE_TIME reg is set in 7s step */
++	val = secs / 7;
++
++	/* Handle case with 0 as val to NOT disable
++	 * learning
++	 */
++	if (!val)
++		val = 1;
++
++	return regmap_update_bits(priv->regmap, QCA8K_REG_ATU_CTRL, QCA8K_ATU_AGE_TIME_MASK,
++				  QCA8K_ATU_AGE_TIME(val));
++}
++
++static int
++qca8k_port_enable(struct dsa_switch *ds, int port,
++		  struct phy_device *phy)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++
++	qca8k_port_set_status(priv, port, 1);
++	priv->port_enabled_map |= BIT(port);
++
++	if (dsa_is_user_port(ds, port))
++		phy_support_asym_pause(phy);
++
++	return 0;
++}
++
++static void
++qca8k_port_disable(struct dsa_switch *ds, int port)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++
++	qca8k_port_set_status(priv, port, 0);
++	priv->port_enabled_map &= ~BIT(port);
++}
++
++static int
++qca8k_port_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int ret;
++
++	/* We have only have a general MTU setting.
++	 * DSA always set the CPU port's MTU to the largest MTU of the slave
++	 * ports.
++	 * Setting MTU just for the CPU port is sufficient to correctly set a
++	 * value for every port.
++	 */
++	if (!dsa_is_cpu_port(ds, port))
++		return 0;
++
++	/* To change the MAX_FRAME_SIZE the cpu ports must be off or
++	 * the switch panics.
++	 * Turn off both cpu ports before applying the new value to prevent
++	 * this.
++	 */
++	if (priv->port_enabled_map & BIT(0))
++		qca8k_port_set_status(priv, 0, 0);
++
++	if (priv->port_enabled_map & BIT(6))
++		qca8k_port_set_status(priv, 6, 0);
++
++	/* Include L2 header / FCS length */
++	ret = qca8k_write(priv, QCA8K_MAX_FRAME_SIZE, new_mtu + ETH_HLEN + ETH_FCS_LEN);
++
++	if (priv->port_enabled_map & BIT(0))
++		qca8k_port_set_status(priv, 0, 1);
++
++	if (priv->port_enabled_map & BIT(6))
++		qca8k_port_set_status(priv, 6, 1);
++
++	return ret;
++}
++
++static int
++qca8k_port_max_mtu(struct dsa_switch *ds, int port)
++{
++	return QCA8K_MAX_MTU;
++}
++
++static int
++qca8k_port_fdb_insert(struct qca8k_priv *priv, const u8 *addr,
++		      u16 port_mask, u16 vid)
++{
++	/* Set the vid to the port vlan id if no vid is set */
++	if (!vid)
++		vid = QCA8K_PORT_VID_DEF;
++
++	return qca8k_fdb_add(priv, addr, port_mask, vid,
++			     QCA8K_ATU_STATUS_STATIC);
++}
++
++static int
++qca8k_port_fdb_add(struct dsa_switch *ds, int port,
++		   const unsigned char *addr, u16 vid)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	u16 port_mask = BIT(port);
++
++	return qca8k_port_fdb_insert(priv, addr, port_mask, vid);
++}
++
++static int
++qca8k_port_fdb_del(struct dsa_switch *ds, int port,
++		   const unsigned char *addr, u16 vid)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	u16 port_mask = BIT(port);
++
++	if (!vid)
++		vid = QCA8K_PORT_VID_DEF;
++
++	return qca8k_fdb_del(priv, addr, port_mask, vid);
++}
++
++static int
++qca8k_port_fdb_dump(struct dsa_switch *ds, int port,
++		    dsa_fdb_dump_cb_t *cb, void *data)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	struct qca8k_fdb _fdb = { 0 };
++	int cnt = QCA8K_NUM_FDB_RECORDS;
++	bool is_static;
++	int ret = 0;
++
++	mutex_lock(&priv->reg_mutex);
++	while (cnt-- && !qca8k_fdb_next(priv, &_fdb, port)) {
++		if (!_fdb.aging)
++			break;
++		is_static = (_fdb.aging == QCA8K_ATU_STATUS_STATIC);
++		ret = cb(_fdb.mac, _fdb.vid, is_static, data);
++		if (ret)
++			break;
++	}
++	mutex_unlock(&priv->reg_mutex);
++
++	return 0;
++}
++
++static int
++qca8k_port_mdb_add(struct dsa_switch *ds, int port,
++		   const struct switchdev_obj_port_mdb *mdb)
++{
++	struct qca8k_priv *priv = ds->priv;
++	const u8 *addr = mdb->addr;
++	u16 vid = mdb->vid;
++
++	return qca8k_fdb_search_and_insert(priv, BIT(port), addr, vid);
++}
++
++static int
++qca8k_port_mdb_del(struct dsa_switch *ds, int port,
++		   const struct switchdev_obj_port_mdb *mdb)
++{
++	struct qca8k_priv *priv = ds->priv;
++	const u8 *addr = mdb->addr;
++	u16 vid = mdb->vid;
++
++	return qca8k_fdb_search_and_del(priv, BIT(port), addr, vid);
++}
++
++static int
++qca8k_port_mirror_add(struct dsa_switch *ds, int port,
++		      struct dsa_mall_mirror_tc_entry *mirror,
++		      bool ingress)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int monitor_port, ret;
++	u32 reg, val;
++
++	/* Check for existent entry */
++	if ((ingress ? priv->mirror_rx : priv->mirror_tx) & BIT(port))
++		return -EEXIST;
++
++	ret = regmap_read(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0, &val);
++	if (ret)
++		return ret;
++
++	/* QCA83xx can have only one port set to mirror mode.
++	 * Check that the correct port is requested and return error otherwise.
++	 * When no mirror port is set, the values is set to 0xF
++	 */
++	monitor_port = FIELD_GET(QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, val);
++	if (monitor_port != 0xF && monitor_port != mirror->to_local_port)
++		return -EEXIST;
++
++	/* Set the monitor port */
++	val = FIELD_PREP(QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM,
++			 mirror->to_local_port);
++	ret = regmap_update_bits(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0,
++				 QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, val);
++	if (ret)
++		return ret;
++
++	if (ingress) {
++		reg = QCA8K_PORT_LOOKUP_CTRL(port);
++		val = QCA8K_PORT_LOOKUP_ING_MIRROR_EN;
++	} else {
++		reg = QCA8K_REG_PORT_HOL_CTRL1(port);
++		val = QCA8K_PORT_HOL_CTRL1_EG_MIRROR_EN;
++	}
++
++	ret = regmap_update_bits(priv->regmap, reg, val, val);
++	if (ret)
++		return ret;
++
++	/* Track mirror port for tx and rx to decide when the
++	 * mirror port has to be disabled.
++	 */
++	if (ingress)
++		priv->mirror_rx |= BIT(port);
++	else
++		priv->mirror_tx |= BIT(port);
++
++	return 0;
++}
++
++static void
++qca8k_port_mirror_del(struct dsa_switch *ds, int port,
++		      struct dsa_mall_mirror_tc_entry *mirror)
++{
++	struct qca8k_priv *priv = ds->priv;
++	u32 reg, val;
++	int ret;
++
++	if (mirror->ingress) {
++		reg = QCA8K_PORT_LOOKUP_CTRL(port);
++		val = QCA8K_PORT_LOOKUP_ING_MIRROR_EN;
++	} else {
++		reg = QCA8K_REG_PORT_HOL_CTRL1(port);
++		val = QCA8K_PORT_HOL_CTRL1_EG_MIRROR_EN;
++	}
++
++	ret = regmap_clear_bits(priv->regmap, reg, val);
++	if (ret)
++		goto err;
++
++	if (mirror->ingress)
++		priv->mirror_rx &= ~BIT(port);
++	else
++		priv->mirror_tx &= ~BIT(port);
++
++	/* No port set to send packet to mirror port. Disable mirror port */
++	if (!priv->mirror_rx && !priv->mirror_tx) {
++		val = FIELD_PREP(QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, 0xF);
++		ret = regmap_update_bits(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0,
++					 QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, val);
++		if (ret)
++			goto err;
++	}
++err:
++	dev_err(priv->dev, "Failed to del mirror port from %d", port);
++}
++
++static int
++qca8k_port_vlan_filtering(struct dsa_switch *ds, int port, bool vlan_filtering,
++			  struct netlink_ext_ack *extack)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int ret;
++
++	if (vlan_filtering) {
++		ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
++				QCA8K_PORT_LOOKUP_VLAN_MODE_MASK,
++				QCA8K_PORT_LOOKUP_VLAN_MODE_SECURE);
++	} else {
++		ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
++				QCA8K_PORT_LOOKUP_VLAN_MODE_MASK,
++				QCA8K_PORT_LOOKUP_VLAN_MODE_NONE);
++	}
++
++	return ret;
++}
++
++static int
++qca8k_port_vlan_add(struct dsa_switch *ds, int port,
++		    const struct switchdev_obj_port_vlan *vlan,
++		    struct netlink_ext_ack *extack)
++{
++	bool untagged = vlan->flags & BRIDGE_VLAN_INFO_UNTAGGED;
++	bool pvid = vlan->flags & BRIDGE_VLAN_INFO_PVID;
++	struct qca8k_priv *priv = ds->priv;
++	int ret;
++
++	ret = qca8k_vlan_add(priv, port, vlan->vid, untagged);
++	if (ret) {
++		dev_err(priv->dev, "Failed to add VLAN to port %d (%d)", port, ret);
++		return ret;
++	}
++
++	if (pvid) {
++		ret = qca8k_rmw(priv, QCA8K_EGRESS_VLAN(port),
++				QCA8K_EGREES_VLAN_PORT_MASK(port),
++				QCA8K_EGREES_VLAN_PORT(port, vlan->vid));
++		if (ret)
++			return ret;
++
++		ret = qca8k_write(priv, QCA8K_REG_PORT_VLAN_CTRL0(port),
++				  QCA8K_PORT_VLAN_CVID(vlan->vid) |
++				  QCA8K_PORT_VLAN_SVID(vlan->vid));
++	}
++
++	return ret;
++}
++
++static int
++qca8k_port_vlan_del(struct dsa_switch *ds, int port,
++		    const struct switchdev_obj_port_vlan *vlan)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int ret;
++
++	ret = qca8k_vlan_del(priv, port, vlan->vid);
++	if (ret)
++		dev_err(priv->dev, "Failed to delete VLAN from port %d (%d)", port, ret);
++
++	return ret;
++}
++
++static u32 qca8k_get_phy_flags(struct dsa_switch *ds, int port)
++{
++	struct qca8k_priv *priv = ds->priv;
++
++	/* Communicate to the phy internal driver the switch revision.
++	 * Based on the switch revision different values needs to be
++	 * set to the dbg and mmd reg on the phy.
++	 * The first 2 bit are used to communicate the switch revision
++	 * to the phy driver.
++	 */
++	if (port > 0 && port < 6)
++		return priv->switch_revision;
++
++	return 0;
++}
++
++static enum dsa_tag_protocol
++qca8k_get_tag_protocol(struct dsa_switch *ds, int port,
++		       enum dsa_tag_protocol mp)
++{
++	return DSA_TAG_PROTO_QCA;
++}
++
++static bool
++qca8k_lag_can_offload(struct dsa_switch *ds,
++		      struct net_device *lag,
++		      struct netdev_lag_upper_info *info)
++{
++	struct dsa_port *dp;
++	int id, members = 0;
++
++	id = dsa_lag_id(ds->dst, lag);
++	if (id < 0 || id >= ds->num_lag_ids)
++		return false;
++
++	dsa_lag_foreach_port(dp, ds->dst, lag)
++		/* Includes the port joining the LAG */
++		members++;
++
++	if (members > QCA8K_NUM_PORTS_FOR_LAG)
++		return false;
++
++	if (info->tx_type != NETDEV_LAG_TX_TYPE_HASH)
++		return false;
++
++	if (info->hash_type != NETDEV_LAG_HASH_L2 &&
++	    info->hash_type != NETDEV_LAG_HASH_L23)
++		return false;
++
++	return true;
++}
++
++static int
++qca8k_lag_setup_hash(struct dsa_switch *ds,
++		     struct net_device *lag,
++		     struct netdev_lag_upper_info *info)
++{
++	struct qca8k_priv *priv = ds->priv;
++	bool unique_lag = true;
++	u32 hash = 0;
++	int i, id;
++
++	id = dsa_lag_id(ds->dst, lag);
++
++	switch (info->hash_type) {
++	case NETDEV_LAG_HASH_L23:
++		hash |= QCA8K_TRUNK_HASH_SIP_EN;
++		hash |= QCA8K_TRUNK_HASH_DIP_EN;
++		fallthrough;
++	case NETDEV_LAG_HASH_L2:
++		hash |= QCA8K_TRUNK_HASH_SA_EN;
++		hash |= QCA8K_TRUNK_HASH_DA_EN;
++		break;
++	default: /* We should NEVER reach this */
++		return -EOPNOTSUPP;
++	}
++
++	/* Check if we are the unique configured LAG */
++	dsa_lags_foreach_id(i, ds->dst)
++		if (i != id && dsa_lag_dev(ds->dst, i)) {
++			unique_lag = false;
++			break;
++		}
++
++	/* Hash Mode is global. Make sure the same Hash Mode
++	 * is set to all the 4 possible lag.
++	 * If we are the unique LAG we can set whatever hash
++	 * mode we want.
++	 * To change hash mode it's needed to remove all LAG
++	 * and change the mode with the latest.
++	 */
++	if (unique_lag) {
++		priv->lag_hash_mode = hash;
++	} else if (priv->lag_hash_mode != hash) {
++		netdev_err(lag, "Error: Mismateched Hash Mode across different lag is not supported\n");
++		return -EOPNOTSUPP;
++	}
++
++	return regmap_update_bits(priv->regmap, QCA8K_TRUNK_HASH_EN_CTRL,
++				  QCA8K_TRUNK_HASH_MASK, hash);
++}
++
++static int
++qca8k_lag_refresh_portmap(struct dsa_switch *ds, int port,
++			  struct net_device *lag, bool delete)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int ret, id, i;
++	u32 val;
++
++	id = dsa_lag_id(ds->dst, lag);
++
++	/* Read current port member */
++	ret = regmap_read(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL0, &val);
++	if (ret)
++		return ret;
++
++	/* Shift val to the correct trunk */
++	val >>= QCA8K_REG_GOL_TRUNK_SHIFT(id);
++	val &= QCA8K_REG_GOL_TRUNK_MEMBER_MASK;
++	if (delete)
++		val &= ~BIT(port);
++	else
++		val |= BIT(port);
++
++	/* Update port member. With empty portmap disable trunk */
++	ret = regmap_update_bits(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL0,
++				 QCA8K_REG_GOL_TRUNK_MEMBER(id) |
++				 QCA8K_REG_GOL_TRUNK_EN(id),
++				 !val << QCA8K_REG_GOL_TRUNK_SHIFT(id) |
++				 val << QCA8K_REG_GOL_TRUNK_SHIFT(id));
++
++	/* Search empty member if adding or port on deleting */
++	for (i = 0; i < QCA8K_NUM_PORTS_FOR_LAG; i++) {
++		ret = regmap_read(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL(id), &val);
++		if (ret)
++			return ret;
++
++		val >>= QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(id, i);
++		val &= QCA8K_REG_GOL_TRUNK_ID_MEM_ID_MASK;
++
++		if (delete) {
++			/* If port flagged to be disabled assume this member is
++			 * empty
++			 */
++			if (val != QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN_MASK)
++				continue;
++
++			val &= QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT_MASK;
++			if (val != port)
++				continue;
++		} else {
++			/* If port flagged to be enabled assume this member is
++			 * already set
++			 */
++			if (val == QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN_MASK)
++				continue;
++		}
++
++		/* We have found the member to add/remove */
++		break;
++	}
++
++	/* Set port in the correct port mask or disable port if in delete mode */
++	return regmap_update_bits(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL(id),
++				  QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN(id, i) |
++				  QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT(id, i),
++				  !delete << QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(id, i) |
++				  port << QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(id, i));
++}
++
++static int
++qca8k_port_lag_join(struct dsa_switch *ds, int port,
++		    struct net_device *lag,
++		    struct netdev_lag_upper_info *info)
++{
++	int ret;
++
++	if (!qca8k_lag_can_offload(ds, lag, info))
++		return -EOPNOTSUPP;
++
++	ret = qca8k_lag_setup_hash(ds, lag, info);
++	if (ret)
++		return ret;
++
++	return qca8k_lag_refresh_portmap(ds, port, lag, false);
++}
++
++static int
++qca8k_port_lag_leave(struct dsa_switch *ds, int port,
++		     struct net_device *lag)
++{
++	return qca8k_lag_refresh_portmap(ds, port, lag, true);
++}
++
++static void
++qca8k_master_change(struct dsa_switch *ds, const struct net_device *master,
++		    bool operational)
++{
++	struct dsa_port *dp = master->dsa_ptr;
++	struct qca8k_priv *priv = ds->priv;
++
++	/* Ethernet MIB/MDIO is only supported for CPU port 0 */
++	if (dp->index != 0)
++		return;
++
++	mutex_lock(&priv->mgmt_eth_data.mutex);
++	mutex_lock(&priv->mib_eth_data.mutex);
++
++	priv->mgmt_master = operational ? (struct net_device *)master : NULL;
++
++	mutex_unlock(&priv->mib_eth_data.mutex);
++	mutex_unlock(&priv->mgmt_eth_data.mutex);
++}
++
++static int qca8k_connect_tag_protocol(struct dsa_switch *ds,
++				      enum dsa_tag_protocol proto)
++{
++	struct qca_tagger_data *tagger_data;
++
++	switch (proto) {
++	case DSA_TAG_PROTO_QCA:
++		tagger_data = ds->tagger_data;
++
++		tagger_data->rw_reg_ack_handler = qca8k_rw_reg_ack_handler;
++		tagger_data->mib_autocast_handler = qca8k_mib_autocast_handler;
++
++		break;
++	default:
++		return -EOPNOTSUPP;
++	}
++
++	return 0;
++}
++
++static const struct dsa_switch_ops qca8k_switch_ops = {
++	.get_tag_protocol	= qca8k_get_tag_protocol,
++	.setup			= qca8k_setup,
++	.get_strings		= qca8k_get_strings,
++	.get_ethtool_stats	= qca8k_get_ethtool_stats,
++	.get_sset_count		= qca8k_get_sset_count,
++	.set_ageing_time	= qca8k_set_ageing_time,
++	.get_mac_eee		= qca8k_get_mac_eee,
++	.set_mac_eee		= qca8k_set_mac_eee,
++	.port_enable		= qca8k_port_enable,
++	.port_disable		= qca8k_port_disable,
++	.port_change_mtu	= qca8k_port_change_mtu,
++	.port_max_mtu		= qca8k_port_max_mtu,
++	.port_stp_state_set	= qca8k_port_stp_state_set,
++	.port_bridge_join	= qca8k_port_bridge_join,
++	.port_bridge_leave	= qca8k_port_bridge_leave,
++	.port_fast_age		= qca8k_port_fast_age,
++	.port_fdb_add		= qca8k_port_fdb_add,
++	.port_fdb_del		= qca8k_port_fdb_del,
++	.port_fdb_dump		= qca8k_port_fdb_dump,
++	.port_mdb_add		= qca8k_port_mdb_add,
++	.port_mdb_del		= qca8k_port_mdb_del,
++	.port_mirror_add	= qca8k_port_mirror_add,
++	.port_mirror_del	= qca8k_port_mirror_del,
++	.port_vlan_filtering	= qca8k_port_vlan_filtering,
++	.port_vlan_add		= qca8k_port_vlan_add,
++	.port_vlan_del		= qca8k_port_vlan_del,
++	.phylink_validate	= qca8k_phylink_validate,
++	.phylink_mac_link_state	= qca8k_phylink_mac_link_state,
++	.phylink_mac_config	= qca8k_phylink_mac_config,
++	.phylink_mac_link_down	= qca8k_phylink_mac_link_down,
++	.phylink_mac_link_up	= qca8k_phylink_mac_link_up,
++	.get_phy_flags		= qca8k_get_phy_flags,
++	.port_lag_join		= qca8k_port_lag_join,
++	.port_lag_leave		= qca8k_port_lag_leave,
++	.master_state_change	= qca8k_master_change,
++	.connect_tag_protocol	= qca8k_connect_tag_protocol,
++};
++
++static int qca8k_read_switch_id(struct qca8k_priv *priv)
++{
++	const struct qca8k_match_data *data;
++	u32 val;
++	u8 id;
++	int ret;
++
++	/* get the switches ID from the compatible */
++	data = of_device_get_match_data(priv->dev);
++	if (!data)
++		return -ENODEV;
++
++	ret = qca8k_read(priv, QCA8K_REG_MASK_CTRL, &val);
++	if (ret < 0)
++		return -ENODEV;
++
++	id = QCA8K_MASK_CTRL_DEVICE_ID(val);
++	if (id != data->id) {
++		dev_err(priv->dev, "Switch id detected %x but expected %x", id, data->id);
++		return -ENODEV;
++	}
++
++	priv->switch_id = id;
++
++	/* Save revision to communicate to the internal PHY driver */
++	priv->switch_revision = QCA8K_MASK_CTRL_REV_ID(val);
++
++	return 0;
++}
++
++static int
++qca8k_sw_probe(struct mdio_device *mdiodev)
++{
++	struct qca8k_priv *priv;
++	int ret;
++
++	/* allocate the private data struct so that we can probe the switches
++	 * ID register
++	 */
++	priv = devm_kzalloc(&mdiodev->dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	priv->bus = mdiodev->bus;
++	priv->dev = &mdiodev->dev;
++
++	priv->reset_gpio = devm_gpiod_get_optional(priv->dev, "reset",
++						   GPIOD_ASIS);
++	if (IS_ERR(priv->reset_gpio))
++		return PTR_ERR(priv->reset_gpio);
++
++	if (priv->reset_gpio) {
++		gpiod_set_value_cansleep(priv->reset_gpio, 1);
++		/* The active low duration must be greater than 10 ms
++		 * and checkpatch.pl wants 20 ms.
++		 */
++		msleep(20);
++		gpiod_set_value_cansleep(priv->reset_gpio, 0);
++	}
++
++	/* Start by setting up the register mapping */
++	priv->regmap = devm_regmap_init(&mdiodev->dev, NULL, priv,
++					&qca8k_regmap_config);
++	if (IS_ERR(priv->regmap)) {
++		dev_err(priv->dev, "regmap initialization failed");
++		return PTR_ERR(priv->regmap);
++	}
++
++	priv->mdio_cache.page = 0xffff;
++	priv->mdio_cache.lo = 0xffff;
++	priv->mdio_cache.hi = 0xffff;
++
++	/* Check the detected switch id */
++	ret = qca8k_read_switch_id(priv);
++	if (ret)
++		return ret;
++
++	priv->ds = devm_kzalloc(&mdiodev->dev, sizeof(*priv->ds), GFP_KERNEL);
++	if (!priv->ds)
++		return -ENOMEM;
++
++	mutex_init(&priv->mgmt_eth_data.mutex);
++	init_completion(&priv->mgmt_eth_data.rw_done);
++
++	mutex_init(&priv->mib_eth_data.mutex);
++	init_completion(&priv->mib_eth_data.rw_done);
++
++	priv->ds->dev = &mdiodev->dev;
++	priv->ds->num_ports = QCA8K_NUM_PORTS;
++	priv->ds->priv = priv;
++	priv->ds->ops = &qca8k_switch_ops;
++	mutex_init(&priv->reg_mutex);
++	dev_set_drvdata(&mdiodev->dev, priv);
++
++	return dsa_register_switch(priv->ds);
++}
++
++static void
++qca8k_sw_remove(struct mdio_device *mdiodev)
++{
++	struct qca8k_priv *priv = dev_get_drvdata(&mdiodev->dev);
++	int i;
++
++	if (!priv)
++		return;
++
++	for (i = 0; i < QCA8K_NUM_PORTS; i++)
++		qca8k_port_set_status(priv, i, 0);
++
++	dsa_unregister_switch(priv->ds);
++
++	dev_set_drvdata(&mdiodev->dev, NULL);
++}
++
++static void qca8k_sw_shutdown(struct mdio_device *mdiodev)
++{
++	struct qca8k_priv *priv = dev_get_drvdata(&mdiodev->dev);
++
++	if (!priv)
++		return;
++
++	dsa_switch_shutdown(priv->ds);
++
++	dev_set_drvdata(&mdiodev->dev, NULL);
++}
++
++#ifdef CONFIG_PM_SLEEP
++static void
++qca8k_set_pm(struct qca8k_priv *priv, int enable)
++{
++	int port;
++
++	for (port = 0; port < QCA8K_NUM_PORTS; port++) {
++		/* Do not enable on resume if the port was
++		 * disabled before.
++		 */
++		if (!(priv->port_enabled_map & BIT(port)))
++			continue;
++
++		qca8k_port_set_status(priv, port, enable);
++	}
++}
++
++static int qca8k_suspend(struct device *dev)
++{
++	struct qca8k_priv *priv = dev_get_drvdata(dev);
++
++	qca8k_set_pm(priv, 0);
++
++	return dsa_switch_suspend(priv->ds);
++}
++
++static int qca8k_resume(struct device *dev)
++{
++	struct qca8k_priv *priv = dev_get_drvdata(dev);
++
++	qca8k_set_pm(priv, 1);
++
++	return dsa_switch_resume(priv->ds);
++}
++#endif /* CONFIG_PM_SLEEP */
++
++static SIMPLE_DEV_PM_OPS(qca8k_pm_ops,
++			 qca8k_suspend, qca8k_resume);
++
++static const struct qca8k_match_data qca8327 = {
++	.id = QCA8K_ID_QCA8327,
++	.reduced_package = true,
++	.mib_count = QCA8K_QCA832X_MIB_COUNT,
++};
++
++static const struct qca8k_match_data qca8328 = {
++	.id = QCA8K_ID_QCA8327,
++	.mib_count = QCA8K_QCA832X_MIB_COUNT,
++};
++
++static const struct qca8k_match_data qca833x = {
++	.id = QCA8K_ID_QCA8337,
++	.mib_count = QCA8K_QCA833X_MIB_COUNT,
++};
++
++static const struct of_device_id qca8k_of_match[] = {
++	{ .compatible = "qca,qca8327", .data = &qca8327 },
++	{ .compatible = "qca,qca8328", .data = &qca8328 },
++	{ .compatible = "qca,qca8334", .data = &qca833x },
++	{ .compatible = "qca,qca8337", .data = &qca833x },
++	{ /* sentinel */ },
++};
++
++static struct mdio_driver qca8kmdio_driver = {
++	.probe  = qca8k_sw_probe,
++	.remove = qca8k_sw_remove,
++	.shutdown = qca8k_sw_shutdown,
++	.mdiodrv.driver = {
++		.name = "qca8k",
++		.of_match_table = qca8k_of_match,
++		.pm = &qca8k_pm_ops,
++	},
++};
++
++mdio_module_driver(qca8kmdio_driver);
++
++MODULE_AUTHOR("Mathieu Olivari, John Crispin <john@phrozen.org>");
++MODULE_DESCRIPTION("Driver for QCA8K ethernet switch family");
++MODULE_LICENSE("GPL v2");
++MODULE_ALIAS("platform:qca8k");
+--- /dev/null
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -0,0 +1,411 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++/*
++ * Copyright (C) 2009 Felix Fietkau <nbd@nbd.name>
++ * Copyright (C) 2011-2012 Gabor Juhos <juhosg@openwrt.org>
++ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
++ */
++
++#ifndef __QCA8K_H
++#define __QCA8K_H
++
++#include <linux/delay.h>
++#include <linux/regmap.h>
++#include <linux/gpio.h>
++#include <linux/dsa/tag_qca.h>
++
++#define QCA8K_ETHERNET_MDIO_PRIORITY			7
++#define QCA8K_ETHERNET_PHY_PRIORITY			6
++#define QCA8K_ETHERNET_TIMEOUT				100
++
++#define QCA8K_NUM_PORTS					7
++#define QCA8K_NUM_CPU_PORTS				2
++#define QCA8K_MAX_MTU					9000
++#define QCA8K_NUM_LAGS					4
++#define QCA8K_NUM_PORTS_FOR_LAG				4
++
++#define PHY_ID_QCA8327					0x004dd034
++#define QCA8K_ID_QCA8327				0x12
++#define PHY_ID_QCA8337					0x004dd036
++#define QCA8K_ID_QCA8337				0x13
++
++#define QCA8K_QCA832X_MIB_COUNT				39
++#define QCA8K_QCA833X_MIB_COUNT				41
++
++#define QCA8K_BUSY_WAIT_TIMEOUT				2000
++
++#define QCA8K_NUM_FDB_RECORDS				2048
++
++#define QCA8K_PORT_VID_DEF				1
++
++/* Global control registers */
++#define QCA8K_REG_MASK_CTRL				0x000
++#define   QCA8K_MASK_CTRL_REV_ID_MASK			GENMASK(7, 0)
++#define   QCA8K_MASK_CTRL_REV_ID(x)			FIELD_GET(QCA8K_MASK_CTRL_REV_ID_MASK, x)
++#define   QCA8K_MASK_CTRL_DEVICE_ID_MASK		GENMASK(15, 8)
++#define   QCA8K_MASK_CTRL_DEVICE_ID(x)			FIELD_GET(QCA8K_MASK_CTRL_DEVICE_ID_MASK, x)
++#define QCA8K_REG_PORT0_PAD_CTRL			0x004
++#define   QCA8K_PORT0_PAD_MAC06_EXCHANGE_EN		BIT(31)
++#define   QCA8K_PORT0_PAD_SGMII_RXCLK_FALLING_EDGE	BIT(19)
++#define   QCA8K_PORT0_PAD_SGMII_TXCLK_FALLING_EDGE	BIT(18)
++#define QCA8K_REG_PORT5_PAD_CTRL			0x008
++#define QCA8K_REG_PORT6_PAD_CTRL			0x00c
++#define   QCA8K_PORT_PAD_RGMII_EN			BIT(26)
++#define   QCA8K_PORT_PAD_RGMII_TX_DELAY_MASK		GENMASK(23, 22)
++#define   QCA8K_PORT_PAD_RGMII_TX_DELAY(x)		FIELD_PREP(QCA8K_PORT_PAD_RGMII_TX_DELAY_MASK, x)
++#define   QCA8K_PORT_PAD_RGMII_RX_DELAY_MASK		GENMASK(21, 20)
++#define   QCA8K_PORT_PAD_RGMII_RX_DELAY(x)		FIELD_PREP(QCA8K_PORT_PAD_RGMII_RX_DELAY_MASK, x)
++#define	  QCA8K_PORT_PAD_RGMII_TX_DELAY_EN		BIT(25)
++#define   QCA8K_PORT_PAD_RGMII_RX_DELAY_EN		BIT(24)
++#define   QCA8K_PORT_PAD_SGMII_EN			BIT(7)
++#define QCA8K_REG_PWS					0x010
++#define   QCA8K_PWS_POWER_ON_SEL			BIT(31)
++/* This reg is only valid for QCA832x and toggle the package
++ * type from 176 pin (by default) to 148 pin used on QCA8327
++ */
++#define   QCA8327_PWS_PACKAGE148_EN			BIT(30)
++#define   QCA8K_PWS_LED_OPEN_EN_CSR			BIT(24)
++#define   QCA8K_PWS_SERDES_AEN_DIS			BIT(7)
++#define QCA8K_REG_MODULE_EN				0x030
++#define   QCA8K_MODULE_EN_MIB				BIT(0)
++#define QCA8K_REG_MIB					0x034
++#define   QCA8K_MIB_FUNC				GENMASK(26, 24)
++#define   QCA8K_MIB_CPU_KEEP				BIT(20)
++#define   QCA8K_MIB_BUSY				BIT(17)
++#define QCA8K_MDIO_MASTER_CTRL				0x3c
++#define   QCA8K_MDIO_MASTER_BUSY			BIT(31)
++#define   QCA8K_MDIO_MASTER_EN				BIT(30)
++#define   QCA8K_MDIO_MASTER_READ			BIT(27)
++#define   QCA8K_MDIO_MASTER_WRITE			0
++#define   QCA8K_MDIO_MASTER_SUP_PRE			BIT(26)
++#define   QCA8K_MDIO_MASTER_PHY_ADDR_MASK		GENMASK(25, 21)
++#define   QCA8K_MDIO_MASTER_PHY_ADDR(x)			FIELD_PREP(QCA8K_MDIO_MASTER_PHY_ADDR_MASK, x)
++#define   QCA8K_MDIO_MASTER_REG_ADDR_MASK		GENMASK(20, 16)
++#define   QCA8K_MDIO_MASTER_REG_ADDR(x)			FIELD_PREP(QCA8K_MDIO_MASTER_REG_ADDR_MASK, x)
++#define   QCA8K_MDIO_MASTER_DATA_MASK			GENMASK(15, 0)
++#define   QCA8K_MDIO_MASTER_DATA(x)			FIELD_PREP(QCA8K_MDIO_MASTER_DATA_MASK, x)
++#define   QCA8K_MDIO_MASTER_MAX_PORTS			5
++#define   QCA8K_MDIO_MASTER_MAX_REG			32
++#define QCA8K_GOL_MAC_ADDR0				0x60
++#define QCA8K_GOL_MAC_ADDR1				0x64
++#define QCA8K_MAX_FRAME_SIZE				0x78
++#define QCA8K_REG_PORT_STATUS(_i)			(0x07c + (_i) * 4)
++#define   QCA8K_PORT_STATUS_SPEED			GENMASK(1, 0)
++#define   QCA8K_PORT_STATUS_SPEED_10			0
++#define   QCA8K_PORT_STATUS_SPEED_100			0x1
++#define   QCA8K_PORT_STATUS_SPEED_1000			0x2
++#define   QCA8K_PORT_STATUS_TXMAC			BIT(2)
++#define   QCA8K_PORT_STATUS_RXMAC			BIT(3)
++#define   QCA8K_PORT_STATUS_TXFLOW			BIT(4)
++#define   QCA8K_PORT_STATUS_RXFLOW			BIT(5)
++#define   QCA8K_PORT_STATUS_DUPLEX			BIT(6)
++#define   QCA8K_PORT_STATUS_LINK_UP			BIT(8)
++#define   QCA8K_PORT_STATUS_LINK_AUTO			BIT(9)
++#define   QCA8K_PORT_STATUS_LINK_PAUSE			BIT(10)
++#define   QCA8K_PORT_STATUS_FLOW_AUTO			BIT(12)
++#define QCA8K_REG_PORT_HDR_CTRL(_i)			(0x9c + (_i * 4))
++#define   QCA8K_PORT_HDR_CTRL_RX_MASK			GENMASK(3, 2)
++#define   QCA8K_PORT_HDR_CTRL_TX_MASK			GENMASK(1, 0)
++#define   QCA8K_PORT_HDR_CTRL_ALL			2
++#define   QCA8K_PORT_HDR_CTRL_MGMT			1
++#define   QCA8K_PORT_HDR_CTRL_NONE			0
++#define QCA8K_REG_SGMII_CTRL				0x0e0
++#define   QCA8K_SGMII_EN_PLL				BIT(1)
++#define   QCA8K_SGMII_EN_RX				BIT(2)
++#define   QCA8K_SGMII_EN_TX				BIT(3)
++#define   QCA8K_SGMII_EN_SD				BIT(4)
++#define   QCA8K_SGMII_CLK125M_DELAY			BIT(7)
++#define   QCA8K_SGMII_MODE_CTRL_MASK			GENMASK(23, 22)
++#define   QCA8K_SGMII_MODE_CTRL(x)			FIELD_PREP(QCA8K_SGMII_MODE_CTRL_MASK, x)
++#define   QCA8K_SGMII_MODE_CTRL_BASEX			QCA8K_SGMII_MODE_CTRL(0x0)
++#define   QCA8K_SGMII_MODE_CTRL_PHY			QCA8K_SGMII_MODE_CTRL(0x1)
++#define   QCA8K_SGMII_MODE_CTRL_MAC			QCA8K_SGMII_MODE_CTRL(0x2)
++
++/* MAC_PWR_SEL registers */
++#define QCA8K_REG_MAC_PWR_SEL				0x0e4
++#define   QCA8K_MAC_PWR_RGMII1_1_8V			BIT(18)
++#define   QCA8K_MAC_PWR_RGMII0_1_8V			BIT(19)
++
++/* EEE control registers */
++#define QCA8K_REG_EEE_CTRL				0x100
++#define  QCA8K_REG_EEE_CTRL_LPI_EN(_i)			((_i + 1) * 2)
++
++/* TRUNK_HASH_EN registers */
++#define QCA8K_TRUNK_HASH_EN_CTRL			0x270
++#define   QCA8K_TRUNK_HASH_SIP_EN			BIT(3)
++#define   QCA8K_TRUNK_HASH_DIP_EN			BIT(2)
++#define   QCA8K_TRUNK_HASH_SA_EN			BIT(1)
++#define   QCA8K_TRUNK_HASH_DA_EN			BIT(0)
++#define   QCA8K_TRUNK_HASH_MASK				GENMASK(3, 0)
++
++/* ACL registers */
++#define QCA8K_REG_PORT_VLAN_CTRL0(_i)			(0x420 + (_i * 8))
++#define   QCA8K_PORT_VLAN_CVID_MASK			GENMASK(27, 16)
++#define   QCA8K_PORT_VLAN_CVID(x)			FIELD_PREP(QCA8K_PORT_VLAN_CVID_MASK, x)
++#define   QCA8K_PORT_VLAN_SVID_MASK			GENMASK(11, 0)
++#define   QCA8K_PORT_VLAN_SVID(x)			FIELD_PREP(QCA8K_PORT_VLAN_SVID_MASK, x)
++#define QCA8K_REG_PORT_VLAN_CTRL1(_i)			(0x424 + (_i * 8))
++#define QCA8K_REG_IPV4_PRI_BASE_ADDR			0x470
++#define QCA8K_REG_IPV4_PRI_ADDR_MASK			0x474
++
++/* Lookup registers */
++#define QCA8K_REG_ATU_DATA0				0x600
++#define   QCA8K_ATU_ADDR2_MASK				GENMASK(31, 24)
++#define   QCA8K_ATU_ADDR3_MASK				GENMASK(23, 16)
++#define   QCA8K_ATU_ADDR4_MASK				GENMASK(15, 8)
++#define   QCA8K_ATU_ADDR5_MASK				GENMASK(7, 0)
++#define QCA8K_REG_ATU_DATA1				0x604
++#define   QCA8K_ATU_PORT_MASK				GENMASK(22, 16)
++#define   QCA8K_ATU_ADDR0_MASK				GENMASK(15, 8)
++#define   QCA8K_ATU_ADDR1_MASK				GENMASK(7, 0)
++#define QCA8K_REG_ATU_DATA2				0x608
++#define   QCA8K_ATU_VID_MASK				GENMASK(19, 8)
++#define   QCA8K_ATU_STATUS_MASK				GENMASK(3, 0)
++#define   QCA8K_ATU_STATUS_STATIC			0xf
++#define QCA8K_REG_ATU_FUNC				0x60c
++#define   QCA8K_ATU_FUNC_BUSY				BIT(31)
++#define   QCA8K_ATU_FUNC_PORT_EN			BIT(14)
++#define   QCA8K_ATU_FUNC_MULTI_EN			BIT(13)
++#define   QCA8K_ATU_FUNC_FULL				BIT(12)
++#define   QCA8K_ATU_FUNC_PORT_MASK			GENMASK(11, 8)
++#define QCA8K_REG_VTU_FUNC0				0x610
++#define   QCA8K_VTU_FUNC0_VALID				BIT(20)
++#define   QCA8K_VTU_FUNC0_IVL_EN			BIT(19)
++/*        QCA8K_VTU_FUNC0_EG_MODE_MASK			GENMASK(17, 4)
++ *          It does contain VLAN_MODE for each port [5:4] for port0,
++ *          [7:6] for port1 ... [17:16] for port6. Use virtual port
++ *          define to handle this.
++ */
++#define   QCA8K_VTU_FUNC0_EG_MODE_PORT_SHIFT(_i)	(4 + (_i) * 2)
++#define   QCA8K_VTU_FUNC0_EG_MODE_MASK			GENMASK(1, 0)
++#define   QCA8K_VTU_FUNC0_EG_MODE_PORT_MASK(_i)		(GENMASK(1, 0) << QCA8K_VTU_FUNC0_EG_MODE_PORT_SHIFT(_i))
++#define   QCA8K_VTU_FUNC0_EG_MODE_UNMOD			FIELD_PREP(QCA8K_VTU_FUNC0_EG_MODE_MASK, 0x0)
++#define   QCA8K_VTU_FUNC0_EG_MODE_PORT_UNMOD(_i)	(QCA8K_VTU_FUNC0_EG_MODE_UNMOD << QCA8K_VTU_FUNC0_EG_MODE_PORT_SHIFT(_i))
++#define   QCA8K_VTU_FUNC0_EG_MODE_UNTAG			FIELD_PREP(QCA8K_VTU_FUNC0_EG_MODE_MASK, 0x1)
++#define   QCA8K_VTU_FUNC0_EG_MODE_PORT_UNTAG(_i)	(QCA8K_VTU_FUNC0_EG_MODE_UNTAG << QCA8K_VTU_FUNC0_EG_MODE_PORT_SHIFT(_i))
++#define   QCA8K_VTU_FUNC0_EG_MODE_TAG			FIELD_PREP(QCA8K_VTU_FUNC0_EG_MODE_MASK, 0x2)
++#define   QCA8K_VTU_FUNC0_EG_MODE_PORT_TAG(_i)		(QCA8K_VTU_FUNC0_EG_MODE_TAG << QCA8K_VTU_FUNC0_EG_MODE_PORT_SHIFT(_i))
++#define   QCA8K_VTU_FUNC0_EG_MODE_NOT			FIELD_PREP(QCA8K_VTU_FUNC0_EG_MODE_MASK, 0x3)
++#define   QCA8K_VTU_FUNC0_EG_MODE_PORT_NOT(_i)		(QCA8K_VTU_FUNC0_EG_MODE_NOT << QCA8K_VTU_FUNC0_EG_MODE_PORT_SHIFT(_i))
++#define QCA8K_REG_VTU_FUNC1				0x614
++#define   QCA8K_VTU_FUNC1_BUSY				BIT(31)
++#define   QCA8K_VTU_FUNC1_VID_MASK			GENMASK(27, 16)
++#define   QCA8K_VTU_FUNC1_FULL				BIT(4)
++#define QCA8K_REG_ATU_CTRL				0x618
++#define   QCA8K_ATU_AGE_TIME_MASK			GENMASK(15, 0)
++#define   QCA8K_ATU_AGE_TIME(x)				FIELD_PREP(QCA8K_ATU_AGE_TIME_MASK, (x))
++#define QCA8K_REG_GLOBAL_FW_CTRL0			0x620
++#define   QCA8K_GLOBAL_FW_CTRL0_CPU_PORT_EN		BIT(10)
++#define   QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM		GENMASK(7, 4)
++#define QCA8K_REG_GLOBAL_FW_CTRL1			0x624
++#define   QCA8K_GLOBAL_FW_CTRL1_IGMP_DP_MASK		GENMASK(30, 24)
++#define   QCA8K_GLOBAL_FW_CTRL1_BC_DP_MASK		GENMASK(22, 16)
++#define   QCA8K_GLOBAL_FW_CTRL1_MC_DP_MASK		GENMASK(14, 8)
++#define   QCA8K_GLOBAL_FW_CTRL1_UC_DP_MASK		GENMASK(6, 0)
++#define QCA8K_PORT_LOOKUP_CTRL(_i)			(0x660 + (_i) * 0xc)
++#define   QCA8K_PORT_LOOKUP_MEMBER			GENMASK(6, 0)
++#define   QCA8K_PORT_LOOKUP_VLAN_MODE_MASK		GENMASK(9, 8)
++#define   QCA8K_PORT_LOOKUP_VLAN_MODE(x)		FIELD_PREP(QCA8K_PORT_LOOKUP_VLAN_MODE_MASK, x)
++#define   QCA8K_PORT_LOOKUP_VLAN_MODE_NONE		QCA8K_PORT_LOOKUP_VLAN_MODE(0x0)
++#define   QCA8K_PORT_LOOKUP_VLAN_MODE_FALLBACK		QCA8K_PORT_LOOKUP_VLAN_MODE(0x1)
++#define   QCA8K_PORT_LOOKUP_VLAN_MODE_CHECK		QCA8K_PORT_LOOKUP_VLAN_MODE(0x2)
++#define   QCA8K_PORT_LOOKUP_VLAN_MODE_SECURE		QCA8K_PORT_LOOKUP_VLAN_MODE(0x3)
++#define   QCA8K_PORT_LOOKUP_STATE_MASK			GENMASK(18, 16)
++#define   QCA8K_PORT_LOOKUP_STATE(x)			FIELD_PREP(QCA8K_PORT_LOOKUP_STATE_MASK, x)
++#define   QCA8K_PORT_LOOKUP_STATE_DISABLED		QCA8K_PORT_LOOKUP_STATE(0x0)
++#define   QCA8K_PORT_LOOKUP_STATE_BLOCKING		QCA8K_PORT_LOOKUP_STATE(0x1)
++#define   QCA8K_PORT_LOOKUP_STATE_LISTENING		QCA8K_PORT_LOOKUP_STATE(0x2)
++#define   QCA8K_PORT_LOOKUP_STATE_LEARNING		QCA8K_PORT_LOOKUP_STATE(0x3)
++#define   QCA8K_PORT_LOOKUP_STATE_FORWARD		QCA8K_PORT_LOOKUP_STATE(0x4)
++#define   QCA8K_PORT_LOOKUP_LEARN			BIT(20)
++#define   QCA8K_PORT_LOOKUP_ING_MIRROR_EN		BIT(25)
++
++#define QCA8K_REG_GOL_TRUNK_CTRL0			0x700
++/* 4 max trunk first
++ * first 6 bit for member bitmap
++ * 7th bit is to enable trunk port
++ */
++#define QCA8K_REG_GOL_TRUNK_SHIFT(_i)			((_i) * 8)
++#define QCA8K_REG_GOL_TRUNK_EN_MASK			BIT(7)
++#define QCA8K_REG_GOL_TRUNK_EN(_i)			(QCA8K_REG_GOL_TRUNK_EN_MASK << QCA8K_REG_GOL_TRUNK_SHIFT(_i))
++#define QCA8K_REG_GOL_TRUNK_MEMBER_MASK			GENMASK(6, 0)
++#define QCA8K_REG_GOL_TRUNK_MEMBER(_i)			(QCA8K_REG_GOL_TRUNK_MEMBER_MASK << QCA8K_REG_GOL_TRUNK_SHIFT(_i))
++/* 0x704 for TRUNK 0-1 --- 0x708 for TRUNK 2-3 */
++#define QCA8K_REG_GOL_TRUNK_CTRL(_i)			(0x704 + (((_i) / 2) * 4))
++#define QCA8K_REG_GOL_TRUNK_ID_MEM_ID_MASK		GENMASK(3, 0)
++#define QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN_MASK		BIT(3)
++#define QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT_MASK		GENMASK(2, 0)
++#define QCA8K_REG_GOL_TRUNK_ID_SHIFT(_i)		(((_i) / 2) * 16)
++#define QCA8K_REG_GOL_MEM_ID_SHIFT(_i)			((_i) * 4)
++/* Complex shift: FIRST shift for port THEN shift for trunk */
++#define QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(_i, _j)	(QCA8K_REG_GOL_MEM_ID_SHIFT(_j) + QCA8K_REG_GOL_TRUNK_ID_SHIFT(_i))
++#define QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN(_i, _j)	(QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN_MASK << QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(_i, _j))
++#define QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT(_i, _j)	(QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT_MASK << QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(_i, _j))
++
++#define QCA8K_REG_GLOBAL_FC_THRESH			0x800
++#define   QCA8K_GLOBAL_FC_GOL_XON_THRES_MASK		GENMASK(24, 16)
++#define   QCA8K_GLOBAL_FC_GOL_XON_THRES(x)		FIELD_PREP(QCA8K_GLOBAL_FC_GOL_XON_THRES_MASK, x)
++#define   QCA8K_GLOBAL_FC_GOL_XOFF_THRES_MASK		GENMASK(8, 0)
++#define   QCA8K_GLOBAL_FC_GOL_XOFF_THRES(x)		FIELD_PREP(QCA8K_GLOBAL_FC_GOL_XOFF_THRES_MASK, x)
++
++#define QCA8K_REG_PORT_HOL_CTRL0(_i)			(0x970 + (_i) * 0x8)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI0_BUF_MASK		GENMASK(3, 0)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI0(x)		FIELD_PREP(QCA8K_PORT_HOL_CTRL0_EG_PRI0_BUF_MASK, x)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI1_BUF_MASK		GENMASK(7, 4)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI1(x)		FIELD_PREP(QCA8K_PORT_HOL_CTRL0_EG_PRI1_BUF_MASK, x)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI2_BUF_MASK		GENMASK(11, 8)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI2(x)		FIELD_PREP(QCA8K_PORT_HOL_CTRL0_EG_PRI2_BUF_MASK, x)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI3_BUF_MASK		GENMASK(15, 12)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI3(x)		FIELD_PREP(QCA8K_PORT_HOL_CTRL0_EG_PRI3_BUF_MASK, x)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI4_BUF_MASK		GENMASK(19, 16)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI4(x)		FIELD_PREP(QCA8K_PORT_HOL_CTRL0_EG_PRI4_BUF_MASK, x)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI5_BUF_MASK		GENMASK(23, 20)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PRI5(x)		FIELD_PREP(QCA8K_PORT_HOL_CTRL0_EG_PRI5_BUF_MASK, x)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PORT_BUF_MASK		GENMASK(29, 24)
++#define   QCA8K_PORT_HOL_CTRL0_EG_PORT(x)		FIELD_PREP(QCA8K_PORT_HOL_CTRL0_EG_PORT_BUF_MASK, x)
++
++#define QCA8K_REG_PORT_HOL_CTRL1(_i)			(0x974 + (_i) * 0x8)
++#define   QCA8K_PORT_HOL_CTRL1_ING_BUF_MASK		GENMASK(3, 0)
++#define   QCA8K_PORT_HOL_CTRL1_ING(x)			FIELD_PREP(QCA8K_PORT_HOL_CTRL1_ING_BUF_MASK, x)
++#define   QCA8K_PORT_HOL_CTRL1_EG_PRI_BUF_EN		BIT(6)
++#define   QCA8K_PORT_HOL_CTRL1_EG_PORT_BUF_EN		BIT(7)
++#define   QCA8K_PORT_HOL_CTRL1_WRED_EN			BIT(8)
++#define   QCA8K_PORT_HOL_CTRL1_EG_MIRROR_EN		BIT(16)
++
++/* Pkt edit registers */
++#define QCA8K_EGREES_VLAN_PORT_SHIFT(_i)		(16 * ((_i) % 2))
++#define QCA8K_EGREES_VLAN_PORT_MASK(_i)			(GENMASK(11, 0) << QCA8K_EGREES_VLAN_PORT_SHIFT(_i))
++#define QCA8K_EGREES_VLAN_PORT(_i, x)			((x) << QCA8K_EGREES_VLAN_PORT_SHIFT(_i))
++#define QCA8K_EGRESS_VLAN(x)				(0x0c70 + (4 * (x / 2)))
++
++/* L3 registers */
++#define QCA8K_HROUTER_CONTROL				0xe00
++#define   QCA8K_HROUTER_CONTROL_GLB_LOCKTIME_M		GENMASK(17, 16)
++#define   QCA8K_HROUTER_CONTROL_GLB_LOCKTIME_S		16
++#define   QCA8K_HROUTER_CONTROL_ARP_AGE_MODE		1
++#define QCA8K_HROUTER_PBASED_CONTROL1			0xe08
++#define QCA8K_HROUTER_PBASED_CONTROL2			0xe0c
++#define QCA8K_HNAT_CONTROL				0xe38
++
++/* MIB registers */
++#define QCA8K_PORT_MIB_COUNTER(_i)			(0x1000 + (_i) * 0x100)
++
++/* QCA specific MII registers */
++#define MII_ATH_MMD_ADDR				0x0d
++#define MII_ATH_MMD_DATA				0x0e
++
++enum {
++	QCA8K_PORT_SPEED_10M = 0,
++	QCA8K_PORT_SPEED_100M = 1,
++	QCA8K_PORT_SPEED_1000M = 2,
++	QCA8K_PORT_SPEED_ERR = 3,
++};
++
++enum qca8k_fdb_cmd {
++	QCA8K_FDB_FLUSH	= 1,
++	QCA8K_FDB_LOAD = 2,
++	QCA8K_FDB_PURGE = 3,
++	QCA8K_FDB_FLUSH_PORT = 5,
++	QCA8K_FDB_NEXT = 6,
++	QCA8K_FDB_SEARCH = 7,
++};
++
++enum qca8k_vlan_cmd {
++	QCA8K_VLAN_FLUSH = 1,
++	QCA8K_VLAN_LOAD = 2,
++	QCA8K_VLAN_PURGE = 3,
++	QCA8K_VLAN_REMOVE_PORT = 4,
++	QCA8K_VLAN_NEXT = 5,
++	QCA8K_VLAN_READ = 6,
++};
++
++enum qca8k_mid_cmd {
++	QCA8K_MIB_FLUSH = 1,
++	QCA8K_MIB_FLUSH_PORT = 2,
++	QCA8K_MIB_CAST = 3,
++};
++
++struct qca8k_match_data {
++	u8 id;
++	bool reduced_package;
++	u8 mib_count;
++};
++
++enum {
++	QCA8K_CPU_PORT0,
++	QCA8K_CPU_PORT6,
++};
++
++struct qca8k_mgmt_eth_data {
++	struct completion rw_done;
++	struct mutex mutex; /* Enforce one mdio read/write at time */
++	bool ack;
++	u32 seq;
++	u32 data[4];
++};
++
++struct qca8k_mib_eth_data {
++	struct completion rw_done;
++	struct mutex mutex; /* Process one command at time */
++	refcount_t port_parsed; /* Counter to track parsed port */
++	u8 req_port;
++	u64 *data; /* pointer to ethtool data */
++};
++
++struct qca8k_ports_config {
++	bool sgmii_rx_clk_falling_edge;
++	bool sgmii_tx_clk_falling_edge;
++	bool sgmii_enable_pll;
++	u8 rgmii_rx_delay[QCA8K_NUM_CPU_PORTS]; /* 0: CPU port0, 1: CPU port6 */
++	u8 rgmii_tx_delay[QCA8K_NUM_CPU_PORTS]; /* 0: CPU port0, 1: CPU port6 */
++};
++
++struct qca8k_mdio_cache {
++/* The 32bit switch registers are accessed indirectly. To achieve this we need
++ * to set the page of the register. Track the last page that was set to reduce
++ * mdio writes
++ */
++	u16 page;
++/* lo and hi can also be cached and from Documentation we can skip one
++ * extra mdio write if lo or hi is didn't change.
++ */
++	u16 lo;
++	u16 hi;
++};
++
++struct qca8k_priv {
++	u8 switch_id;
++	u8 switch_revision;
++	u8 mirror_rx;
++	u8 mirror_tx;
++	u8 lag_hash_mode;
++	/* Each bit correspond to a port. This switch can support a max of 7 port.
++	 * Bit 1: port enabled. Bit 0: port disabled.
++	 */
++	u8 port_enabled_map;
++	struct qca8k_ports_config ports_config;
++	struct regmap *regmap;
++	struct mii_bus *bus;
++	struct dsa_switch *ds;
++	struct mutex reg_mutex;
++	struct device *dev;
++	struct gpio_desc *reset_gpio;
++	struct net_device *mgmt_master; /* Track if mdio/mib Ethernet is available */
++	struct qca8k_mgmt_eth_data mgmt_eth_data;
++	struct qca8k_mib_eth_data mib_eth_data;
++	struct qca8k_mdio_cache mdio_cache;
++};
++
++struct qca8k_mib_desc {
++	unsigned int size;
++	unsigned int offset;
++	const char *name;
++};
++
++struct qca8k_fdb {
++	u16 vid;
++	u8 port_mask;
++	u8 aging;
++	u8 mac[6];
++};
++
++#endif /* __QCA8K_H */
+--- a/drivers/net/dsa/qca8k.c
++++ /dev/null
+@@ -1,3243 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * Copyright (C) 2009 Felix Fietkau <nbd@nbd.name>
+- * Copyright (C) 2011-2012 Gabor Juhos <juhosg@openwrt.org>
+- * Copyright (c) 2015, 2019, The Linux Foundation. All rights reserved.
+- * Copyright (c) 2016 John Crispin <john@phrozen.org>
+- */
+-
+-#include <linux/module.h>
+-#include <linux/phy.h>
+-#include <linux/netdevice.h>
+-#include <linux/bitfield.h>
+-#include <linux/regmap.h>
+-#include <net/dsa.h>
+-#include <linux/of_net.h>
+-#include <linux/of_mdio.h>
+-#include <linux/of_platform.h>
+-#include <linux/if_bridge.h>
+-#include <linux/mdio.h>
+-#include <linux/phylink.h>
+-#include <linux/gpio/consumer.h>
+-#include <linux/etherdevice.h>
+-#include <linux/dsa/tag_qca.h>
+-
+-#include "qca8k.h"
+-
+-#define MIB_DESC(_s, _o, _n)	\
+-	{			\
+-		.size = (_s),	\
+-		.offset = (_o),	\
+-		.name = (_n),	\
+-	}
+-
+-static const struct qca8k_mib_desc ar8327_mib[] = {
+-	MIB_DESC(1, 0x00, "RxBroad"),
+-	MIB_DESC(1, 0x04, "RxPause"),
+-	MIB_DESC(1, 0x08, "RxMulti"),
+-	MIB_DESC(1, 0x0c, "RxFcsErr"),
+-	MIB_DESC(1, 0x10, "RxAlignErr"),
+-	MIB_DESC(1, 0x14, "RxRunt"),
+-	MIB_DESC(1, 0x18, "RxFragment"),
+-	MIB_DESC(1, 0x1c, "Rx64Byte"),
+-	MIB_DESC(1, 0x20, "Rx128Byte"),
+-	MIB_DESC(1, 0x24, "Rx256Byte"),
+-	MIB_DESC(1, 0x28, "Rx512Byte"),
+-	MIB_DESC(1, 0x2c, "Rx1024Byte"),
+-	MIB_DESC(1, 0x30, "Rx1518Byte"),
+-	MIB_DESC(1, 0x34, "RxMaxByte"),
+-	MIB_DESC(1, 0x38, "RxTooLong"),
+-	MIB_DESC(2, 0x3c, "RxGoodByte"),
+-	MIB_DESC(2, 0x44, "RxBadByte"),
+-	MIB_DESC(1, 0x4c, "RxOverFlow"),
+-	MIB_DESC(1, 0x50, "Filtered"),
+-	MIB_DESC(1, 0x54, "TxBroad"),
+-	MIB_DESC(1, 0x58, "TxPause"),
+-	MIB_DESC(1, 0x5c, "TxMulti"),
+-	MIB_DESC(1, 0x60, "TxUnderRun"),
+-	MIB_DESC(1, 0x64, "Tx64Byte"),
+-	MIB_DESC(1, 0x68, "Tx128Byte"),
+-	MIB_DESC(1, 0x6c, "Tx256Byte"),
+-	MIB_DESC(1, 0x70, "Tx512Byte"),
+-	MIB_DESC(1, 0x74, "Tx1024Byte"),
+-	MIB_DESC(1, 0x78, "Tx1518Byte"),
+-	MIB_DESC(1, 0x7c, "TxMaxByte"),
+-	MIB_DESC(1, 0x80, "TxOverSize"),
+-	MIB_DESC(2, 0x84, "TxByte"),
+-	MIB_DESC(1, 0x8c, "TxCollision"),
+-	MIB_DESC(1, 0x90, "TxAbortCol"),
+-	MIB_DESC(1, 0x94, "TxMultiCol"),
+-	MIB_DESC(1, 0x98, "TxSingleCol"),
+-	MIB_DESC(1, 0x9c, "TxExcDefer"),
+-	MIB_DESC(1, 0xa0, "TxDefer"),
+-	MIB_DESC(1, 0xa4, "TxLateCol"),
+-	MIB_DESC(1, 0xa8, "RXUnicast"),
+-	MIB_DESC(1, 0xac, "TXUnicast"),
+-};
+-
+-static void
+-qca8k_split_addr(u32 regaddr, u16 *r1, u16 *r2, u16 *page)
+-{
+-	regaddr >>= 1;
+-	*r1 = regaddr & 0x1e;
+-
+-	regaddr >>= 5;
+-	*r2 = regaddr & 0x7;
+-
+-	regaddr >>= 3;
+-	*page = regaddr & 0x3ff;
+-}
+-
+-static int
+-qca8k_set_lo(struct qca8k_priv *priv, int phy_id, u32 regnum, u16 lo)
+-{
+-	u16 *cached_lo = &priv->mdio_cache.lo;
+-	struct mii_bus *bus = priv->bus;
+-	int ret;
+-
+-	if (lo == *cached_lo)
+-		return 0;
+-
+-	ret = bus->write(bus, phy_id, regnum, lo);
+-	if (ret < 0)
+-		dev_err_ratelimited(&bus->dev,
+-				    "failed to write qca8k 32bit lo register\n");
+-
+-	*cached_lo = lo;
+-	return 0;
+-}
+-
+-static int
+-qca8k_set_hi(struct qca8k_priv *priv, int phy_id, u32 regnum, u16 hi)
+-{
+-	u16 *cached_hi = &priv->mdio_cache.hi;
+-	struct mii_bus *bus = priv->bus;
+-	int ret;
+-
+-	if (hi == *cached_hi)
+-		return 0;
+-
+-	ret = bus->write(bus, phy_id, regnum, hi);
+-	if (ret < 0)
+-		dev_err_ratelimited(&bus->dev,
+-				    "failed to write qca8k 32bit hi register\n");
+-
+-	*cached_hi = hi;
+-	return 0;
+-}
+-
+-static int
+-qca8k_mii_read32(struct mii_bus *bus, int phy_id, u32 regnum, u32 *val)
+-{
+-	int ret;
+-
+-	ret = bus->read(bus, phy_id, regnum);
+-	if (ret >= 0) {
+-		*val = ret;
+-		ret = bus->read(bus, phy_id, regnum + 1);
+-		*val |= ret << 16;
+-	}
+-
+-	if (ret < 0) {
+-		dev_err_ratelimited(&bus->dev,
+-				    "failed to read qca8k 32bit register\n");
+-		*val = 0;
+-		return ret;
+-	}
+-
+-	return 0;
+-}
+-
+-static void
+-qca8k_mii_write32(struct qca8k_priv *priv, int phy_id, u32 regnum, u32 val)
+-{
+-	u16 lo, hi;
+-	int ret;
+-
+-	lo = val & 0xffff;
+-	hi = (u16)(val >> 16);
+-
+-	ret = qca8k_set_lo(priv, phy_id, regnum, lo);
+-	if (ret >= 0)
+-		ret = qca8k_set_hi(priv, phy_id, regnum + 1, hi);
+-}
+-
+-static int
+-qca8k_set_page(struct qca8k_priv *priv, u16 page)
+-{
+-	u16 *cached_page = &priv->mdio_cache.page;
+-	struct mii_bus *bus = priv->bus;
+-	int ret;
+-
+-	if (page == *cached_page)
+-		return 0;
+-
+-	ret = bus->write(bus, 0x18, 0, page);
+-	if (ret < 0) {
+-		dev_err_ratelimited(&bus->dev,
+-				    "failed to set qca8k page\n");
+-		return ret;
+-	}
+-
+-	*cached_page = page;
+-	usleep_range(1000, 2000);
+-	return 0;
+-}
+-
+-static int
+-qca8k_read(struct qca8k_priv *priv, u32 reg, u32 *val)
+-{
+-	return regmap_read(priv->regmap, reg, val);
+-}
+-
+-static int
+-qca8k_write(struct qca8k_priv *priv, u32 reg, u32 val)
+-{
+-	return regmap_write(priv->regmap, reg, val);
+-}
+-
+-static int
+-qca8k_rmw(struct qca8k_priv *priv, u32 reg, u32 mask, u32 write_val)
+-{
+-	return regmap_update_bits(priv->regmap, reg, mask, write_val);
+-}
+-
+-static void qca8k_rw_reg_ack_handler(struct dsa_switch *ds, struct sk_buff *skb)
+-{
+-	struct qca8k_mgmt_eth_data *mgmt_eth_data;
+-	struct qca8k_priv *priv = ds->priv;
+-	struct qca_mgmt_ethhdr *mgmt_ethhdr;
+-	u8 len, cmd;
+-
+-	mgmt_ethhdr = (struct qca_mgmt_ethhdr *)skb_mac_header(skb);
+-	mgmt_eth_data = &priv->mgmt_eth_data;
+-
+-	cmd = FIELD_GET(QCA_HDR_MGMT_CMD, mgmt_ethhdr->command);
+-	len = FIELD_GET(QCA_HDR_MGMT_LENGTH, mgmt_ethhdr->command);
+-
+-	/* Make sure the seq match the requested packet */
+-	if (mgmt_ethhdr->seq == mgmt_eth_data->seq)
+-		mgmt_eth_data->ack = true;
+-
+-	if (cmd == MDIO_READ) {
+-		mgmt_eth_data->data[0] = mgmt_ethhdr->mdio_data;
+-
+-		/* Get the rest of the 12 byte of data.
+-		 * The read/write function will extract the requested data.
+-		 */
+-		if (len > QCA_HDR_MGMT_DATA1_LEN)
+-			memcpy(mgmt_eth_data->data + 1, skb->data,
+-			       QCA_HDR_MGMT_DATA2_LEN);
+-	}
+-
+-	complete(&mgmt_eth_data->rw_done);
+-}
+-
+-static struct sk_buff *qca8k_alloc_mdio_header(enum mdio_cmd cmd, u32 reg, u32 *val,
+-					       int priority, unsigned int len)
+-{
+-	struct qca_mgmt_ethhdr *mgmt_ethhdr;
+-	unsigned int real_len;
+-	struct sk_buff *skb;
+-	u32 *data2;
+-	u16 hdr;
+-
+-	skb = dev_alloc_skb(QCA_HDR_MGMT_PKT_LEN);
+-	if (!skb)
+-		return NULL;
+-
+-	/* Max value for len reg is 15 (0xf) but the switch actually return 16 byte
+-	 * Actually for some reason the steps are:
+-	 * 0: nothing
+-	 * 1-4: first 4 byte
+-	 * 5-6: first 12 byte
+-	 * 7-15: all 16 byte
+-	 */
+-	if (len == 16)
+-		real_len = 15;
+-	else
+-		real_len = len;
+-
+-	skb_reset_mac_header(skb);
+-	skb_set_network_header(skb, skb->len);
+-
+-	mgmt_ethhdr = skb_push(skb, QCA_HDR_MGMT_HEADER_LEN + QCA_HDR_LEN);
+-
+-	hdr = FIELD_PREP(QCA_HDR_XMIT_VERSION, QCA_HDR_VERSION);
+-	hdr |= FIELD_PREP(QCA_HDR_XMIT_PRIORITY, priority);
+-	hdr |= QCA_HDR_XMIT_FROM_CPU;
+-	hdr |= FIELD_PREP(QCA_HDR_XMIT_DP_BIT, BIT(0));
+-	hdr |= FIELD_PREP(QCA_HDR_XMIT_CONTROL, QCA_HDR_XMIT_TYPE_RW_REG);
+-
+-	mgmt_ethhdr->command = FIELD_PREP(QCA_HDR_MGMT_ADDR, reg);
+-	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_LENGTH, real_len);
+-	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_CMD, cmd);
+-	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_CHECK_CODE,
+-					   QCA_HDR_MGMT_CHECK_CODE_VAL);
+-
+-	if (cmd == MDIO_WRITE)
+-		mgmt_ethhdr->mdio_data = *val;
+-
+-	mgmt_ethhdr->hdr = htons(hdr);
+-
+-	data2 = skb_put_zero(skb, QCA_HDR_MGMT_DATA2_LEN + QCA_HDR_MGMT_PADDING_LEN);
+-	if (cmd == MDIO_WRITE && len > QCA_HDR_MGMT_DATA1_LEN)
+-		memcpy(data2, val + 1, len - QCA_HDR_MGMT_DATA1_LEN);
+-
+-	return skb;
+-}
+-
+-static void qca8k_mdio_header_fill_seq_num(struct sk_buff *skb, u32 seq_num)
+-{
+-	struct qca_mgmt_ethhdr *mgmt_ethhdr;
+-
+-	mgmt_ethhdr = (struct qca_mgmt_ethhdr *)skb->data;
+-	mgmt_ethhdr->seq = FIELD_PREP(QCA_HDR_MGMT_SEQ_NUM, seq_num);
+-}
+-
+-static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
+-{
+-	struct qca8k_mgmt_eth_data *mgmt_eth_data = &priv->mgmt_eth_data;
+-	struct sk_buff *skb;
+-	bool ack;
+-	int ret;
+-
+-	skb = qca8k_alloc_mdio_header(MDIO_READ, reg, NULL,
+-				      QCA8K_ETHERNET_MDIO_PRIORITY, len);
+-	if (!skb)
+-		return -ENOMEM;
+-
+-	mutex_lock(&mgmt_eth_data->mutex);
+-
+-	/* Check mgmt_master if is operational */
+-	if (!priv->mgmt_master) {
+-		kfree_skb(skb);
+-		mutex_unlock(&mgmt_eth_data->mutex);
+-		return -EINVAL;
+-	}
+-
+-	skb->dev = priv->mgmt_master;
+-
+-	reinit_completion(&mgmt_eth_data->rw_done);
+-
+-	/* Increment seq_num and set it in the mdio pkt */
+-	mgmt_eth_data->seq++;
+-	qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
+-	mgmt_eth_data->ack = false;
+-
+-	dev_queue_xmit(skb);
+-
+-	ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
+-					  msecs_to_jiffies(QCA8K_ETHERNET_TIMEOUT));
+-
+-	*val = mgmt_eth_data->data[0];
+-	if (len > QCA_HDR_MGMT_DATA1_LEN)
+-		memcpy(val + 1, mgmt_eth_data->data + 1, len - QCA_HDR_MGMT_DATA1_LEN);
+-
+-	ack = mgmt_eth_data->ack;
+-
+-	mutex_unlock(&mgmt_eth_data->mutex);
+-
+-	if (ret <= 0)
+-		return -ETIMEDOUT;
+-
+-	if (!ack)
+-		return -EINVAL;
+-
+-	return 0;
+-}
+-
+-static int qca8k_write_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
+-{
+-	struct qca8k_mgmt_eth_data *mgmt_eth_data = &priv->mgmt_eth_data;
+-	struct sk_buff *skb;
+-	bool ack;
+-	int ret;
+-
+-	skb = qca8k_alloc_mdio_header(MDIO_WRITE, reg, val,
+-				      QCA8K_ETHERNET_MDIO_PRIORITY, len);
+-	if (!skb)
+-		return -ENOMEM;
+-
+-	mutex_lock(&mgmt_eth_data->mutex);
+-
+-	/* Check mgmt_master if is operational */
+-	if (!priv->mgmt_master) {
+-		kfree_skb(skb);
+-		mutex_unlock(&mgmt_eth_data->mutex);
+-		return -EINVAL;
+-	}
+-
+-	skb->dev = priv->mgmt_master;
+-
+-	reinit_completion(&mgmt_eth_data->rw_done);
+-
+-	/* Increment seq_num and set it in the mdio pkt */
+-	mgmt_eth_data->seq++;
+-	qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
+-	mgmt_eth_data->ack = false;
+-
+-	dev_queue_xmit(skb);
+-
+-	ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
+-					  msecs_to_jiffies(QCA8K_ETHERNET_TIMEOUT));
+-
+-	ack = mgmt_eth_data->ack;
+-
+-	mutex_unlock(&mgmt_eth_data->mutex);
+-
+-	if (ret <= 0)
+-		return -ETIMEDOUT;
+-
+-	if (!ack)
+-		return -EINVAL;
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_regmap_update_bits_eth(struct qca8k_priv *priv, u32 reg, u32 mask, u32 write_val)
+-{
+-	u32 val = 0;
+-	int ret;
+-
+-	ret = qca8k_read_eth(priv, reg, &val, sizeof(val));
+-	if (ret)
+-		return ret;
+-
+-	val &= ~mask;
+-	val |= write_val;
+-
+-	return qca8k_write_eth(priv, reg, &val, sizeof(val));
+-}
+-
+-static int
+-qca8k_bulk_read(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
+-{
+-	int i, count = len / sizeof(u32), ret;
+-
+-	if (priv->mgmt_master && !qca8k_read_eth(priv, reg, val, len))
+-		return 0;
+-
+-	for (i = 0; i < count; i++) {
+-		ret = regmap_read(priv->regmap, reg + (i * 4), val + i);
+-		if (ret < 0)
+-			return ret;
+-	}
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_bulk_write(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
+-{
+-	int i, count = len / sizeof(u32), ret;
+-	u32 tmp;
+-
+-	if (priv->mgmt_master && !qca8k_write_eth(priv, reg, val, len))
+-		return 0;
+-
+-	for (i = 0; i < count; i++) {
+-		tmp = val[i];
+-
+-		ret = regmap_write(priv->regmap, reg + (i * 4), tmp);
+-		if (ret < 0)
+-			return ret;
+-	}
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_regmap_read(void *ctx, uint32_t reg, uint32_t *val)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ctx;
+-	struct mii_bus *bus = priv->bus;
+-	u16 r1, r2, page;
+-	int ret;
+-
+-	if (!qca8k_read_eth(priv, reg, val, sizeof(*val)))
+-		return 0;
+-
+-	qca8k_split_addr(reg, &r1, &r2, &page);
+-
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+-
+-	ret = qca8k_set_page(priv, page);
+-	if (ret < 0)
+-		goto exit;
+-
+-	ret = qca8k_mii_read32(bus, 0x10 | r2, r1, val);
+-
+-exit:
+-	mutex_unlock(&bus->mdio_lock);
+-	return ret;
+-}
+-
+-static int
+-qca8k_regmap_write(void *ctx, uint32_t reg, uint32_t val)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ctx;
+-	struct mii_bus *bus = priv->bus;
+-	u16 r1, r2, page;
+-	int ret;
+-
+-	if (!qca8k_write_eth(priv, reg, &val, sizeof(val)))
+-		return 0;
+-
+-	qca8k_split_addr(reg, &r1, &r2, &page);
+-
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+-
+-	ret = qca8k_set_page(priv, page);
+-	if (ret < 0)
+-		goto exit;
+-
+-	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
+-
+-exit:
+-	mutex_unlock(&bus->mdio_lock);
+-	return ret;
+-}
+-
+-static int
+-qca8k_regmap_update_bits(void *ctx, uint32_t reg, uint32_t mask, uint32_t write_val)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ctx;
+-	struct mii_bus *bus = priv->bus;
+-	u16 r1, r2, page;
+-	u32 val;
+-	int ret;
+-
+-	if (!qca8k_regmap_update_bits_eth(priv, reg, mask, write_val))
+-		return 0;
+-
+-	qca8k_split_addr(reg, &r1, &r2, &page);
+-
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+-
+-	ret = qca8k_set_page(priv, page);
+-	if (ret < 0)
+-		goto exit;
+-
+-	ret = qca8k_mii_read32(bus, 0x10 | r2, r1, &val);
+-	if (ret < 0)
+-		goto exit;
+-
+-	val &= ~mask;
+-	val |= write_val;
+-	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
+-
+-exit:
+-	mutex_unlock(&bus->mdio_lock);
+-
+-	return ret;
+-}
+-
+-static const struct regmap_range qca8k_readable_ranges[] = {
+-	regmap_reg_range(0x0000, 0x00e4), /* Global control */
+-	regmap_reg_range(0x0100, 0x0168), /* EEE control */
+-	regmap_reg_range(0x0200, 0x0270), /* Parser control */
+-	regmap_reg_range(0x0400, 0x0454), /* ACL */
+-	regmap_reg_range(0x0600, 0x0718), /* Lookup */
+-	regmap_reg_range(0x0800, 0x0b70), /* QM */
+-	regmap_reg_range(0x0c00, 0x0c80), /* PKT */
+-	regmap_reg_range(0x0e00, 0x0e98), /* L3 */
+-	regmap_reg_range(0x1000, 0x10ac), /* MIB - Port0 */
+-	regmap_reg_range(0x1100, 0x11ac), /* MIB - Port1 */
+-	regmap_reg_range(0x1200, 0x12ac), /* MIB - Port2 */
+-	regmap_reg_range(0x1300, 0x13ac), /* MIB - Port3 */
+-	regmap_reg_range(0x1400, 0x14ac), /* MIB - Port4 */
+-	regmap_reg_range(0x1500, 0x15ac), /* MIB - Port5 */
+-	regmap_reg_range(0x1600, 0x16ac), /* MIB - Port6 */
+-
+-};
+-
+-static const struct regmap_access_table qca8k_readable_table = {
+-	.yes_ranges = qca8k_readable_ranges,
+-	.n_yes_ranges = ARRAY_SIZE(qca8k_readable_ranges),
+-};
+-
+-static struct regmap_config qca8k_regmap_config = {
+-	.reg_bits = 16,
+-	.val_bits = 32,
+-	.reg_stride = 4,
+-	.max_register = 0x16ac, /* end MIB - Port6 range */
+-	.reg_read = qca8k_regmap_read,
+-	.reg_write = qca8k_regmap_write,
+-	.reg_update_bits = qca8k_regmap_update_bits,
+-	.rd_table = &qca8k_readable_table,
+-	.disable_locking = true, /* Locking is handled by qca8k read/write */
+-	.cache_type = REGCACHE_NONE, /* Explicitly disable CACHE */
+-};
+-
+-static int
+-qca8k_busy_wait(struct qca8k_priv *priv, u32 reg, u32 mask)
+-{
+-	u32 val;
+-
+-	return regmap_read_poll_timeout(priv->regmap, reg, val, !(val & mask), 0,
+-				       QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC);
+-}
+-
+-static int
+-qca8k_fdb_read(struct qca8k_priv *priv, struct qca8k_fdb *fdb)
+-{
+-	u32 reg[3];
+-	int ret;
+-
+-	/* load the ARL table into an array */
+-	ret = qca8k_bulk_read(priv, QCA8K_REG_ATU_DATA0, reg, sizeof(reg));
+-	if (ret)
+-		return ret;
+-
+-	/* vid - 83:72 */
+-	fdb->vid = FIELD_GET(QCA8K_ATU_VID_MASK, reg[2]);
+-	/* aging - 67:64 */
+-	fdb->aging = FIELD_GET(QCA8K_ATU_STATUS_MASK, reg[2]);
+-	/* portmask - 54:48 */
+-	fdb->port_mask = FIELD_GET(QCA8K_ATU_PORT_MASK, reg[1]);
+-	/* mac - 47:0 */
+-	fdb->mac[0] = FIELD_GET(QCA8K_ATU_ADDR0_MASK, reg[1]);
+-	fdb->mac[1] = FIELD_GET(QCA8K_ATU_ADDR1_MASK, reg[1]);
+-	fdb->mac[2] = FIELD_GET(QCA8K_ATU_ADDR2_MASK, reg[0]);
+-	fdb->mac[3] = FIELD_GET(QCA8K_ATU_ADDR3_MASK, reg[0]);
+-	fdb->mac[4] = FIELD_GET(QCA8K_ATU_ADDR4_MASK, reg[0]);
+-	fdb->mac[5] = FIELD_GET(QCA8K_ATU_ADDR5_MASK, reg[0]);
+-
+-	return 0;
+-}
+-
+-static void
+-qca8k_fdb_write(struct qca8k_priv *priv, u16 vid, u8 port_mask, const u8 *mac,
+-		u8 aging)
+-{
+-	u32 reg[3] = { 0 };
+-
+-	/* vid - 83:72 */
+-	reg[2] = FIELD_PREP(QCA8K_ATU_VID_MASK, vid);
+-	/* aging - 67:64 */
+-	reg[2] |= FIELD_PREP(QCA8K_ATU_STATUS_MASK, aging);
+-	/* portmask - 54:48 */
+-	reg[1] = FIELD_PREP(QCA8K_ATU_PORT_MASK, port_mask);
+-	/* mac - 47:0 */
+-	reg[1] |= FIELD_PREP(QCA8K_ATU_ADDR0_MASK, mac[0]);
+-	reg[1] |= FIELD_PREP(QCA8K_ATU_ADDR1_MASK, mac[1]);
+-	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR2_MASK, mac[2]);
+-	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR3_MASK, mac[3]);
+-	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR4_MASK, mac[4]);
+-	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR5_MASK, mac[5]);
+-
+-	/* load the array into the ARL table */
+-	qca8k_bulk_write(priv, QCA8K_REG_ATU_DATA0, reg, sizeof(reg));
+-}
+-
+-static int
+-qca8k_fdb_access(struct qca8k_priv *priv, enum qca8k_fdb_cmd cmd, int port)
+-{
+-	u32 reg;
+-	int ret;
+-
+-	/* Set the command and FDB index */
+-	reg = QCA8K_ATU_FUNC_BUSY;
+-	reg |= cmd;
+-	if (port >= 0) {
+-		reg |= QCA8K_ATU_FUNC_PORT_EN;
+-		reg |= FIELD_PREP(QCA8K_ATU_FUNC_PORT_MASK, port);
+-	}
+-
+-	/* Write the function register triggering the table access */
+-	ret = qca8k_write(priv, QCA8K_REG_ATU_FUNC, reg);
+-	if (ret)
+-		return ret;
+-
+-	/* wait for completion */
+-	ret = qca8k_busy_wait(priv, QCA8K_REG_ATU_FUNC, QCA8K_ATU_FUNC_BUSY);
+-	if (ret)
+-		return ret;
+-
+-	/* Check for table full violation when adding an entry */
+-	if (cmd == QCA8K_FDB_LOAD) {
+-		ret = qca8k_read(priv, QCA8K_REG_ATU_FUNC, &reg);
+-		if (ret < 0)
+-			return ret;
+-		if (reg & QCA8K_ATU_FUNC_FULL)
+-			return -1;
+-	}
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_fdb_next(struct qca8k_priv *priv, struct qca8k_fdb *fdb, int port)
+-{
+-	int ret;
+-
+-	qca8k_fdb_write(priv, fdb->vid, fdb->port_mask, fdb->mac, fdb->aging);
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_NEXT, port);
+-	if (ret < 0)
+-		return ret;
+-
+-	return qca8k_fdb_read(priv, fdb);
+-}
+-
+-static int
+-qca8k_fdb_add(struct qca8k_priv *priv, const u8 *mac, u16 port_mask,
+-	      u16 vid, u8 aging)
+-{
+-	int ret;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	qca8k_fdb_write(priv, vid, port_mask, mac, aging);
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_LOAD, -1);
+-	mutex_unlock(&priv->reg_mutex);
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_fdb_del(struct qca8k_priv *priv, const u8 *mac, u16 port_mask, u16 vid)
+-{
+-	int ret;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	qca8k_fdb_write(priv, vid, port_mask, mac, 0);
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_PURGE, -1);
+-	mutex_unlock(&priv->reg_mutex);
+-
+-	return ret;
+-}
+-
+-static void
+-qca8k_fdb_flush(struct qca8k_priv *priv)
+-{
+-	mutex_lock(&priv->reg_mutex);
+-	qca8k_fdb_access(priv, QCA8K_FDB_FLUSH, -1);
+-	mutex_unlock(&priv->reg_mutex);
+-}
+-
+-static int
+-qca8k_fdb_search_and_insert(struct qca8k_priv *priv, u8 port_mask,
+-			    const u8 *mac, u16 vid)
+-{
+-	struct qca8k_fdb fdb = { 0 };
+-	int ret;
+-
+-	mutex_lock(&priv->reg_mutex);
+-
+-	qca8k_fdb_write(priv, vid, 0, mac, 0);
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_SEARCH, -1);
+-	if (ret < 0)
+-		goto exit;
+-
+-	ret = qca8k_fdb_read(priv, &fdb);
+-	if (ret < 0)
+-		goto exit;
+-
+-	/* Rule exist. Delete first */
+-	if (!fdb.aging) {
+-		ret = qca8k_fdb_access(priv, QCA8K_FDB_PURGE, -1);
+-		if (ret)
+-			goto exit;
+-	}
+-
+-	/* Add port to fdb portmask */
+-	fdb.port_mask |= port_mask;
+-
+-	qca8k_fdb_write(priv, vid, fdb.port_mask, mac, fdb.aging);
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_LOAD, -1);
+-
+-exit:
+-	mutex_unlock(&priv->reg_mutex);
+-	return ret;
+-}
+-
+-static int
+-qca8k_fdb_search_and_del(struct qca8k_priv *priv, u8 port_mask,
+-			 const u8 *mac, u16 vid)
+-{
+-	struct qca8k_fdb fdb = { 0 };
+-	int ret;
+-
+-	mutex_lock(&priv->reg_mutex);
+-
+-	qca8k_fdb_write(priv, vid, 0, mac, 0);
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_SEARCH, -1);
+-	if (ret < 0)
+-		goto exit;
+-
+-	/* Rule doesn't exist. Why delete? */
+-	if (!fdb.aging) {
+-		ret = -EINVAL;
+-		goto exit;
+-	}
+-
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_PURGE, -1);
+-	if (ret)
+-		goto exit;
+-
+-	/* Only port in the rule is this port. Don't re insert */
+-	if (fdb.port_mask == port_mask)
+-		goto exit;
+-
+-	/* Remove port from port mask */
+-	fdb.port_mask &= ~port_mask;
+-
+-	qca8k_fdb_write(priv, vid, fdb.port_mask, mac, fdb.aging);
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_LOAD, -1);
+-
+-exit:
+-	mutex_unlock(&priv->reg_mutex);
+-	return ret;
+-}
+-
+-static int
+-qca8k_vlan_access(struct qca8k_priv *priv, enum qca8k_vlan_cmd cmd, u16 vid)
+-{
+-	u32 reg;
+-	int ret;
+-
+-	/* Set the command and VLAN index */
+-	reg = QCA8K_VTU_FUNC1_BUSY;
+-	reg |= cmd;
+-	reg |= FIELD_PREP(QCA8K_VTU_FUNC1_VID_MASK, vid);
+-
+-	/* Write the function register triggering the table access */
+-	ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC1, reg);
+-	if (ret)
+-		return ret;
+-
+-	/* wait for completion */
+-	ret = qca8k_busy_wait(priv, QCA8K_REG_VTU_FUNC1, QCA8K_VTU_FUNC1_BUSY);
+-	if (ret)
+-		return ret;
+-
+-	/* Check for table full violation when adding an entry */
+-	if (cmd == QCA8K_VLAN_LOAD) {
+-		ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC1, &reg);
+-		if (ret < 0)
+-			return ret;
+-		if (reg & QCA8K_VTU_FUNC1_FULL)
+-			return -ENOMEM;
+-	}
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_vlan_add(struct qca8k_priv *priv, u8 port, u16 vid, bool untagged)
+-{
+-	u32 reg;
+-	int ret;
+-
+-	/*
+-	   We do the right thing with VLAN 0 and treat it as untagged while
+-	   preserving the tag on egress.
+-	 */
+-	if (vid == 0)
+-		return 0;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	ret = qca8k_vlan_access(priv, QCA8K_VLAN_READ, vid);
+-	if (ret < 0)
+-		goto out;
+-
+-	ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC0, &reg);
+-	if (ret < 0)
+-		goto out;
+-	reg |= QCA8K_VTU_FUNC0_VALID | QCA8K_VTU_FUNC0_IVL_EN;
+-	reg &= ~QCA8K_VTU_FUNC0_EG_MODE_PORT_MASK(port);
+-	if (untagged)
+-		reg |= QCA8K_VTU_FUNC0_EG_MODE_PORT_UNTAG(port);
+-	else
+-		reg |= QCA8K_VTU_FUNC0_EG_MODE_PORT_TAG(port);
+-
+-	ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC0, reg);
+-	if (ret)
+-		goto out;
+-	ret = qca8k_vlan_access(priv, QCA8K_VLAN_LOAD, vid);
+-
+-out:
+-	mutex_unlock(&priv->reg_mutex);
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_vlan_del(struct qca8k_priv *priv, u8 port, u16 vid)
+-{
+-	u32 reg, mask;
+-	int ret, i;
+-	bool del;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	ret = qca8k_vlan_access(priv, QCA8K_VLAN_READ, vid);
+-	if (ret < 0)
+-		goto out;
+-
+-	ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC0, &reg);
+-	if (ret < 0)
+-		goto out;
+-	reg &= ~QCA8K_VTU_FUNC0_EG_MODE_PORT_MASK(port);
+-	reg |= QCA8K_VTU_FUNC0_EG_MODE_PORT_NOT(port);
+-
+-	/* Check if we're the last member to be removed */
+-	del = true;
+-	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+-		mask = QCA8K_VTU_FUNC0_EG_MODE_PORT_NOT(i);
+-
+-		if ((reg & mask) != mask) {
+-			del = false;
+-			break;
+-		}
+-	}
+-
+-	if (del) {
+-		ret = qca8k_vlan_access(priv, QCA8K_VLAN_PURGE, vid);
+-	} else {
+-		ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC0, reg);
+-		if (ret)
+-			goto out;
+-		ret = qca8k_vlan_access(priv, QCA8K_VLAN_LOAD, vid);
+-	}
+-
+-out:
+-	mutex_unlock(&priv->reg_mutex);
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_mib_init(struct qca8k_priv *priv)
+-{
+-	int ret;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	ret = regmap_update_bits(priv->regmap, QCA8K_REG_MIB,
+-				 QCA8K_MIB_FUNC | QCA8K_MIB_BUSY,
+-				 FIELD_PREP(QCA8K_MIB_FUNC, QCA8K_MIB_FLUSH) |
+-				 QCA8K_MIB_BUSY);
+-	if (ret)
+-		goto exit;
+-
+-	ret = qca8k_busy_wait(priv, QCA8K_REG_MIB, QCA8K_MIB_BUSY);
+-	if (ret)
+-		goto exit;
+-
+-	ret = regmap_set_bits(priv->regmap, QCA8K_REG_MIB, QCA8K_MIB_CPU_KEEP);
+-	if (ret)
+-		goto exit;
+-
+-	ret = qca8k_write(priv, QCA8K_REG_MODULE_EN, QCA8K_MODULE_EN_MIB);
+-
+-exit:
+-	mutex_unlock(&priv->reg_mutex);
+-	return ret;
+-}
+-
+-static void
+-qca8k_port_set_status(struct qca8k_priv *priv, int port, int enable)
+-{
+-	u32 mask = QCA8K_PORT_STATUS_TXMAC | QCA8K_PORT_STATUS_RXMAC;
+-
+-	/* Port 0 and 6 have no internal PHY */
+-	if (port > 0 && port < 6)
+-		mask |= QCA8K_PORT_STATUS_LINK_AUTO;
+-
+-	if (enable)
+-		regmap_set_bits(priv->regmap, QCA8K_REG_PORT_STATUS(port), mask);
+-	else
+-		regmap_clear_bits(priv->regmap, QCA8K_REG_PORT_STATUS(port), mask);
+-}
+-
+-static int
+-qca8k_phy_eth_busy_wait(struct qca8k_mgmt_eth_data *mgmt_eth_data,
+-			struct sk_buff *read_skb, u32 *val)
+-{
+-	struct sk_buff *skb = skb_copy(read_skb, GFP_KERNEL);
+-	bool ack;
+-	int ret;
+-
+-	reinit_completion(&mgmt_eth_data->rw_done);
+-
+-	/* Increment seq_num and set it in the copy pkt */
+-	mgmt_eth_data->seq++;
+-	qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
+-	mgmt_eth_data->ack = false;
+-
+-	dev_queue_xmit(skb);
+-
+-	ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
+-					  QCA8K_ETHERNET_TIMEOUT);
+-
+-	ack = mgmt_eth_data->ack;
+-
+-	if (ret <= 0)
+-		return -ETIMEDOUT;
+-
+-	if (!ack)
+-		return -EINVAL;
+-
+-	*val = mgmt_eth_data->data[0];
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
+-		      int regnum, u16 data)
+-{
+-	struct sk_buff *write_skb, *clear_skb, *read_skb;
+-	struct qca8k_mgmt_eth_data *mgmt_eth_data;
+-	u32 write_val, clear_val = 0, val;
+-	struct net_device *mgmt_master;
+-	int ret, ret1;
+-	bool ack;
+-
+-	if (regnum >= QCA8K_MDIO_MASTER_MAX_REG)
+-		return -EINVAL;
+-
+-	mgmt_eth_data = &priv->mgmt_eth_data;
+-
+-	write_val = QCA8K_MDIO_MASTER_BUSY | QCA8K_MDIO_MASTER_EN |
+-		    QCA8K_MDIO_MASTER_PHY_ADDR(phy) |
+-		    QCA8K_MDIO_MASTER_REG_ADDR(regnum);
+-
+-	if (read) {
+-		write_val |= QCA8K_MDIO_MASTER_READ;
+-	} else {
+-		write_val |= QCA8K_MDIO_MASTER_WRITE;
+-		write_val |= QCA8K_MDIO_MASTER_DATA(data);
+-	}
+-
+-	/* Prealloc all the needed skb before the lock */
+-	write_skb = qca8k_alloc_mdio_header(MDIO_WRITE, QCA8K_MDIO_MASTER_CTRL, &write_val,
+-					    QCA8K_ETHERNET_PHY_PRIORITY, sizeof(write_val));
+-	if (!write_skb)
+-		return -ENOMEM;
+-
+-	clear_skb = qca8k_alloc_mdio_header(MDIO_WRITE, QCA8K_MDIO_MASTER_CTRL, &clear_val,
+-					    QCA8K_ETHERNET_PHY_PRIORITY, sizeof(clear_val));
+-	if (!clear_skb) {
+-		ret = -ENOMEM;
+-		goto err_clear_skb;
+-	}
+-
+-	read_skb = qca8k_alloc_mdio_header(MDIO_READ, QCA8K_MDIO_MASTER_CTRL, &clear_val,
+-					   QCA8K_ETHERNET_PHY_PRIORITY, sizeof(clear_val));
+-	if (!read_skb) {
+-		ret = -ENOMEM;
+-		goto err_read_skb;
+-	}
+-
+-	/* Actually start the request:
+-	 * 1. Send mdio master packet
+-	 * 2. Busy Wait for mdio master command
+-	 * 3. Get the data if we are reading
+-	 * 4. Reset the mdio master (even with error)
+-	 */
+-	mutex_lock(&mgmt_eth_data->mutex);
+-
+-	/* Check if mgmt_master is operational */
+-	mgmt_master = priv->mgmt_master;
+-	if (!mgmt_master) {
+-		mutex_unlock(&mgmt_eth_data->mutex);
+-		ret = -EINVAL;
+-		goto err_mgmt_master;
+-	}
+-
+-	read_skb->dev = mgmt_master;
+-	clear_skb->dev = mgmt_master;
+-	write_skb->dev = mgmt_master;
+-
+-	reinit_completion(&mgmt_eth_data->rw_done);
+-
+-	/* Increment seq_num and set it in the write pkt */
+-	mgmt_eth_data->seq++;
+-	qca8k_mdio_header_fill_seq_num(write_skb, mgmt_eth_data->seq);
+-	mgmt_eth_data->ack = false;
+-
+-	dev_queue_xmit(write_skb);
+-
+-	ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
+-					  QCA8K_ETHERNET_TIMEOUT);
+-
+-	ack = mgmt_eth_data->ack;
+-
+-	if (ret <= 0) {
+-		ret = -ETIMEDOUT;
+-		kfree_skb(read_skb);
+-		goto exit;
+-	}
+-
+-	if (!ack) {
+-		ret = -EINVAL;
+-		kfree_skb(read_skb);
+-		goto exit;
+-	}
+-
+-	ret = read_poll_timeout(qca8k_phy_eth_busy_wait, ret1,
+-				!(val & QCA8K_MDIO_MASTER_BUSY), 0,
+-				QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC, false,
+-				mgmt_eth_data, read_skb, &val);
+-
+-	if (ret < 0 && ret1 < 0) {
+-		ret = ret1;
+-		goto exit;
+-	}
+-
+-	if (read) {
+-		reinit_completion(&mgmt_eth_data->rw_done);
+-
+-		/* Increment seq_num and set it in the read pkt */
+-		mgmt_eth_data->seq++;
+-		qca8k_mdio_header_fill_seq_num(read_skb, mgmt_eth_data->seq);
+-		mgmt_eth_data->ack = false;
+-
+-		dev_queue_xmit(read_skb);
+-
+-		ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
+-						  QCA8K_ETHERNET_TIMEOUT);
+-
+-		ack = mgmt_eth_data->ack;
+-
+-		if (ret <= 0) {
+-			ret = -ETIMEDOUT;
+-			goto exit;
+-		}
+-
+-		if (!ack) {
+-			ret = -EINVAL;
+-			goto exit;
+-		}
+-
+-		ret = mgmt_eth_data->data[0] & QCA8K_MDIO_MASTER_DATA_MASK;
+-	} else {
+-		kfree_skb(read_skb);
+-	}
+-exit:
+-	reinit_completion(&mgmt_eth_data->rw_done);
+-
+-	/* Increment seq_num and set it in the clear pkt */
+-	mgmt_eth_data->seq++;
+-	qca8k_mdio_header_fill_seq_num(clear_skb, mgmt_eth_data->seq);
+-	mgmt_eth_data->ack = false;
+-
+-	dev_queue_xmit(clear_skb);
+-
+-	wait_for_completion_timeout(&mgmt_eth_data->rw_done,
+-				    QCA8K_ETHERNET_TIMEOUT);
+-
+-	mutex_unlock(&mgmt_eth_data->mutex);
+-
+-	return ret;
+-
+-	/* Error handling before lock */
+-err_mgmt_master:
+-	kfree_skb(read_skb);
+-err_read_skb:
+-	kfree_skb(clear_skb);
+-err_clear_skb:
+-	kfree_skb(write_skb);
+-
+-	return ret;
+-}
+-
+-static u32
+-qca8k_port_to_phy(int port)
+-{
+-	/* From Andrew Lunn:
+-	 * Port 0 has no internal phy.
+-	 * Port 1 has an internal PHY at MDIO address 0.
+-	 * Port 2 has an internal PHY at MDIO address 1.
+-	 * ...
+-	 * Port 5 has an internal PHY at MDIO address 4.
+-	 * Port 6 has no internal PHY.
+-	 */
+-
+-	return port - 1;
+-}
+-
+-static int
+-qca8k_mdio_busy_wait(struct mii_bus *bus, u32 reg, u32 mask)
+-{
+-	u16 r1, r2, page;
+-	u32 val;
+-	int ret, ret1;
+-
+-	qca8k_split_addr(reg, &r1, &r2, &page);
+-
+-	ret = read_poll_timeout(qca8k_mii_read32, ret1, !(val & mask), 0,
+-				QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC, false,
+-				bus, 0x10 | r2, r1, &val);
+-
+-	/* Check if qca8k_read has failed for a different reason
+-	 * before returnting -ETIMEDOUT
+-	 */
+-	if (ret < 0 && ret1 < 0)
+-		return ret1;
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_mdio_write(struct qca8k_priv *priv, int phy, int regnum, u16 data)
+-{
+-	struct mii_bus *bus = priv->bus;
+-	u16 r1, r2, page;
+-	u32 val;
+-	int ret;
+-
+-	if (regnum >= QCA8K_MDIO_MASTER_MAX_REG)
+-		return -EINVAL;
+-
+-	val = QCA8K_MDIO_MASTER_BUSY | QCA8K_MDIO_MASTER_EN |
+-	      QCA8K_MDIO_MASTER_WRITE | QCA8K_MDIO_MASTER_PHY_ADDR(phy) |
+-	      QCA8K_MDIO_MASTER_REG_ADDR(regnum) |
+-	      QCA8K_MDIO_MASTER_DATA(data);
+-
+-	qca8k_split_addr(QCA8K_MDIO_MASTER_CTRL, &r1, &r2, &page);
+-
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+-
+-	ret = qca8k_set_page(priv, page);
+-	if (ret)
+-		goto exit;
+-
+-	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
+-
+-	ret = qca8k_mdio_busy_wait(bus, QCA8K_MDIO_MASTER_CTRL,
+-				   QCA8K_MDIO_MASTER_BUSY);
+-
+-exit:
+-	/* even if the busy_wait timeouts try to clear the MASTER_EN */
+-	qca8k_mii_write32(priv, 0x10 | r2, r1, 0);
+-
+-	mutex_unlock(&bus->mdio_lock);
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_mdio_read(struct qca8k_priv *priv, int phy, int regnum)
+-{
+-	struct mii_bus *bus = priv->bus;
+-	u16 r1, r2, page;
+-	u32 val;
+-	int ret;
+-
+-	if (regnum >= QCA8K_MDIO_MASTER_MAX_REG)
+-		return -EINVAL;
+-
+-	val = QCA8K_MDIO_MASTER_BUSY | QCA8K_MDIO_MASTER_EN |
+-	      QCA8K_MDIO_MASTER_READ | QCA8K_MDIO_MASTER_PHY_ADDR(phy) |
+-	      QCA8K_MDIO_MASTER_REG_ADDR(regnum);
+-
+-	qca8k_split_addr(QCA8K_MDIO_MASTER_CTRL, &r1, &r2, &page);
+-
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+-
+-	ret = qca8k_set_page(priv, page);
+-	if (ret)
+-		goto exit;
+-
+-	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
+-
+-	ret = qca8k_mdio_busy_wait(bus, QCA8K_MDIO_MASTER_CTRL,
+-				   QCA8K_MDIO_MASTER_BUSY);
+-	if (ret)
+-		goto exit;
+-
+-	ret = qca8k_mii_read32(bus, 0x10 | r2, r1, &val);
+-
+-exit:
+-	/* even if the busy_wait timeouts try to clear the MASTER_EN */
+-	qca8k_mii_write32(priv, 0x10 | r2, r1, 0);
+-
+-	mutex_unlock(&bus->mdio_lock);
+-
+-	if (ret >= 0)
+-		ret = val & QCA8K_MDIO_MASTER_DATA_MASK;
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_internal_mdio_write(struct mii_bus *slave_bus, int phy, int regnum, u16 data)
+-{
+-	struct qca8k_priv *priv = slave_bus->priv;
+-	int ret;
+-
+-	/* Use mdio Ethernet when available, fallback to legacy one on error */
+-	ret = qca8k_phy_eth_command(priv, false, phy, regnum, data);
+-	if (!ret)
+-		return 0;
+-
+-	return qca8k_mdio_write(priv, phy, regnum, data);
+-}
+-
+-static int
+-qca8k_internal_mdio_read(struct mii_bus *slave_bus, int phy, int regnum)
+-{
+-	struct qca8k_priv *priv = slave_bus->priv;
+-	int ret;
+-
+-	/* Use mdio Ethernet when available, fallback to legacy one on error */
+-	ret = qca8k_phy_eth_command(priv, true, phy, regnum, 0);
+-	if (ret >= 0)
+-		return ret;
+-
+-	ret = qca8k_mdio_read(priv, phy, regnum);
+-
+-	if (ret < 0)
+-		return 0xffff;
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_legacy_mdio_write(struct mii_bus *slave_bus, int port, int regnum, u16 data)
+-{
+-	port = qca8k_port_to_phy(port) % PHY_MAX_ADDR;
+-
+-	return qca8k_internal_mdio_write(slave_bus, port, regnum, data);
+-}
+-
+-static int
+-qca8k_legacy_mdio_read(struct mii_bus *slave_bus, int port, int regnum)
+-{
+-	port = qca8k_port_to_phy(port) % PHY_MAX_ADDR;
+-
+-	return qca8k_internal_mdio_read(slave_bus, port, regnum);
+-}
+-
+-static int
+-qca8k_mdio_register(struct qca8k_priv *priv)
+-{
+-	struct dsa_switch *ds = priv->ds;
+-	struct device_node *mdio;
+-	struct mii_bus *bus;
+-
+-	bus = devm_mdiobus_alloc(ds->dev);
+-	if (!bus)
+-		return -ENOMEM;
+-
+-	bus->priv = (void *)priv;
+-	snprintf(bus->id, MII_BUS_ID_SIZE, "qca8k-%d.%d",
+-		 ds->dst->index, ds->index);
+-	bus->parent = ds->dev;
+-	bus->phy_mask = ~ds->phys_mii_mask;
+-	ds->slave_mii_bus = bus;
+-
+-	/* Check if the devicetree declare the port:phy mapping */
+-	mdio = of_get_child_by_name(priv->dev->of_node, "mdio");
+-	if (of_device_is_available(mdio)) {
+-		bus->name = "qca8k slave mii";
+-		bus->read = qca8k_internal_mdio_read;
+-		bus->write = qca8k_internal_mdio_write;
+-		return devm_of_mdiobus_register(priv->dev, bus, mdio);
+-	}
+-
+-	/* If a mapping can't be found the legacy mapping is used,
+-	 * using the qca8k_port_to_phy function
+-	 */
+-	bus->name = "qca8k-legacy slave mii";
+-	bus->read = qca8k_legacy_mdio_read;
+-	bus->write = qca8k_legacy_mdio_write;
+-	return devm_mdiobus_register(priv->dev, bus);
+-}
+-
+-static int
+-qca8k_setup_mdio_bus(struct qca8k_priv *priv)
+-{
+-	u32 internal_mdio_mask = 0, external_mdio_mask = 0, reg;
+-	struct device_node *ports, *port;
+-	phy_interface_t mode;
+-	int err;
+-
+-	ports = of_get_child_by_name(priv->dev->of_node, "ports");
+-	if (!ports)
+-		ports = of_get_child_by_name(priv->dev->of_node, "ethernet-ports");
+-
+-	if (!ports)
+-		return -EINVAL;
+-
+-	for_each_available_child_of_node(ports, port) {
+-		err = of_property_read_u32(port, "reg", &reg);
+-		if (err) {
+-			of_node_put(port);
+-			of_node_put(ports);
+-			return err;
+-		}
+-
+-		if (!dsa_is_user_port(priv->ds, reg))
+-			continue;
+-
+-		of_get_phy_mode(port, &mode);
+-
+-		if (of_property_read_bool(port, "phy-handle") &&
+-		    mode != PHY_INTERFACE_MODE_INTERNAL)
+-			external_mdio_mask |= BIT(reg);
+-		else
+-			internal_mdio_mask |= BIT(reg);
+-	}
+-
+-	of_node_put(ports);
+-	if (!external_mdio_mask && !internal_mdio_mask) {
+-		dev_err(priv->dev, "no PHYs are defined.\n");
+-		return -EINVAL;
+-	}
+-
+-	/* The QCA8K_MDIO_MASTER_EN Bit, which grants access to PHYs through
+-	 * the MDIO_MASTER register also _disconnects_ the external MDC
+-	 * passthrough to the internal PHYs. It's not possible to use both
+-	 * configurations at the same time!
+-	 *
+-	 * Because this came up during the review process:
+-	 * If the external mdio-bus driver is capable magically disabling
+-	 * the QCA8K_MDIO_MASTER_EN and mutex/spin-locking out the qca8k's
+-	 * accessors for the time being, it would be possible to pull this
+-	 * off.
+-	 */
+-	if (!!external_mdio_mask && !!internal_mdio_mask) {
+-		dev_err(priv->dev, "either internal or external mdio bus configuration is supported.\n");
+-		return -EINVAL;
+-	}
+-
+-	if (external_mdio_mask) {
+-		/* Make sure to disable the internal mdio bus in cases
+-		 * a dt-overlay and driver reload changed the configuration
+-		 */
+-
+-		return regmap_clear_bits(priv->regmap, QCA8K_MDIO_MASTER_CTRL,
+-					 QCA8K_MDIO_MASTER_EN);
+-	}
+-
+-	return qca8k_mdio_register(priv);
+-}
+-
+-static int
+-qca8k_setup_mac_pwr_sel(struct qca8k_priv *priv)
+-{
+-	u32 mask = 0;
+-	int ret = 0;
+-
+-	/* SoC specific settings for ipq8064.
+-	 * If more device require this consider adding
+-	 * a dedicated binding.
+-	 */
+-	if (of_machine_is_compatible("qcom,ipq8064"))
+-		mask |= QCA8K_MAC_PWR_RGMII0_1_8V;
+-
+-	/* SoC specific settings for ipq8065 */
+-	if (of_machine_is_compatible("qcom,ipq8065"))
+-		mask |= QCA8K_MAC_PWR_RGMII1_1_8V;
+-
+-	if (mask) {
+-		ret = qca8k_rmw(priv, QCA8K_REG_MAC_PWR_SEL,
+-				QCA8K_MAC_PWR_RGMII0_1_8V |
+-				QCA8K_MAC_PWR_RGMII1_1_8V,
+-				mask);
+-	}
+-
+-	return ret;
+-}
+-
+-static int qca8k_find_cpu_port(struct dsa_switch *ds)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-
+-	/* Find the connected cpu port. Valid port are 0 or 6 */
+-	if (dsa_is_cpu_port(ds, 0))
+-		return 0;
+-
+-	dev_dbg(priv->dev, "port 0 is not the CPU port. Checking port 6");
+-
+-	if (dsa_is_cpu_port(ds, 6))
+-		return 6;
+-
+-	return -EINVAL;
+-}
+-
+-static int
+-qca8k_setup_of_pws_reg(struct qca8k_priv *priv)
+-{
+-	struct device_node *node = priv->dev->of_node;
+-	const struct qca8k_match_data *data;
+-	u32 val = 0;
+-	int ret;
+-
+-	/* QCA8327 require to set to the correct mode.
+-	 * His bigger brother QCA8328 have the 172 pin layout.
+-	 * Should be applied by default but we set this just to make sure.
+-	 */
+-	if (priv->switch_id == QCA8K_ID_QCA8327) {
+-		data = of_device_get_match_data(priv->dev);
+-
+-		/* Set the correct package of 148 pin for QCA8327 */
+-		if (data->reduced_package)
+-			val |= QCA8327_PWS_PACKAGE148_EN;
+-
+-		ret = qca8k_rmw(priv, QCA8K_REG_PWS, QCA8327_PWS_PACKAGE148_EN,
+-				val);
+-		if (ret)
+-			return ret;
+-	}
+-
+-	if (of_property_read_bool(node, "qca,ignore-power-on-sel"))
+-		val |= QCA8K_PWS_POWER_ON_SEL;
+-
+-	if (of_property_read_bool(node, "qca,led-open-drain")) {
+-		if (!(val & QCA8K_PWS_POWER_ON_SEL)) {
+-			dev_err(priv->dev, "qca,led-open-drain require qca,ignore-power-on-sel to be set.");
+-			return -EINVAL;
+-		}
+-
+-		val |= QCA8K_PWS_LED_OPEN_EN_CSR;
+-	}
+-
+-	return qca8k_rmw(priv, QCA8K_REG_PWS,
+-			QCA8K_PWS_LED_OPEN_EN_CSR | QCA8K_PWS_POWER_ON_SEL,
+-			val);
+-}
+-
+-static int
+-qca8k_parse_port_config(struct qca8k_priv *priv)
+-{
+-	int port, cpu_port_index = -1, ret;
+-	struct device_node *port_dn;
+-	phy_interface_t mode;
+-	struct dsa_port *dp;
+-	u32 delay;
+-
+-	/* We have 2 CPU port. Check them */
+-	for (port = 0; port < QCA8K_NUM_PORTS; port++) {
+-		/* Skip every other port */
+-		if (port != 0 && port != 6)
+-			continue;
+-
+-		dp = dsa_to_port(priv->ds, port);
+-		port_dn = dp->dn;
+-		cpu_port_index++;
+-
+-		if (!of_device_is_available(port_dn))
+-			continue;
+-
+-		ret = of_get_phy_mode(port_dn, &mode);
+-		if (ret)
+-			continue;
+-
+-		switch (mode) {
+-		case PHY_INTERFACE_MODE_RGMII:
+-		case PHY_INTERFACE_MODE_RGMII_ID:
+-		case PHY_INTERFACE_MODE_RGMII_TXID:
+-		case PHY_INTERFACE_MODE_RGMII_RXID:
+-		case PHY_INTERFACE_MODE_SGMII:
+-			delay = 0;
+-
+-			if (!of_property_read_u32(port_dn, "tx-internal-delay-ps", &delay))
+-				/* Switch regs accept value in ns, convert ps to ns */
+-				delay = delay / 1000;
+-			else if (mode == PHY_INTERFACE_MODE_RGMII_ID ||
+-				 mode == PHY_INTERFACE_MODE_RGMII_TXID)
+-				delay = 1;
+-
+-			if (!FIELD_FIT(QCA8K_PORT_PAD_RGMII_TX_DELAY_MASK, delay)) {
+-				dev_err(priv->dev, "rgmii tx delay is limited to a max value of 3ns, setting to the max value");
+-				delay = 3;
+-			}
+-
+-			priv->ports_config.rgmii_tx_delay[cpu_port_index] = delay;
+-
+-			delay = 0;
+-
+-			if (!of_property_read_u32(port_dn, "rx-internal-delay-ps", &delay))
+-				/* Switch regs accept value in ns, convert ps to ns */
+-				delay = delay / 1000;
+-			else if (mode == PHY_INTERFACE_MODE_RGMII_ID ||
+-				 mode == PHY_INTERFACE_MODE_RGMII_RXID)
+-				delay = 2;
+-
+-			if (!FIELD_FIT(QCA8K_PORT_PAD_RGMII_RX_DELAY_MASK, delay)) {
+-				dev_err(priv->dev, "rgmii rx delay is limited to a max value of 3ns, setting to the max value");
+-				delay = 3;
+-			}
+-
+-			priv->ports_config.rgmii_rx_delay[cpu_port_index] = delay;
+-
+-			/* Skip sgmii parsing for rgmii* mode */
+-			if (mode == PHY_INTERFACE_MODE_RGMII ||
+-			    mode == PHY_INTERFACE_MODE_RGMII_ID ||
+-			    mode == PHY_INTERFACE_MODE_RGMII_TXID ||
+-			    mode == PHY_INTERFACE_MODE_RGMII_RXID)
+-				break;
+-
+-			if (of_property_read_bool(port_dn, "qca,sgmii-txclk-falling-edge"))
+-				priv->ports_config.sgmii_tx_clk_falling_edge = true;
+-
+-			if (of_property_read_bool(port_dn, "qca,sgmii-rxclk-falling-edge"))
+-				priv->ports_config.sgmii_rx_clk_falling_edge = true;
+-
+-			if (of_property_read_bool(port_dn, "qca,sgmii-enable-pll")) {
+-				priv->ports_config.sgmii_enable_pll = true;
+-
+-				if (priv->switch_id == QCA8K_ID_QCA8327) {
+-					dev_err(priv->dev, "SGMII PLL should NOT be enabled for qca8327. Aborting enabling");
+-					priv->ports_config.sgmii_enable_pll = false;
+-				}
+-
+-				if (priv->switch_revision < 2)
+-					dev_warn(priv->dev, "SGMII PLL should NOT be enabled for qca8337 with revision 2 or more.");
+-			}
+-
+-			break;
+-		default:
+-			continue;
+-		}
+-	}
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_setup(struct dsa_switch *ds)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	int cpu_port, ret, i;
+-	u32 mask;
+-
+-	cpu_port = qca8k_find_cpu_port(ds);
+-	if (cpu_port < 0) {
+-		dev_err(priv->dev, "No cpu port configured in both cpu port0 and port6");
+-		return cpu_port;
+-	}
+-
+-	/* Parse CPU port config to be later used in phy_link mac_config */
+-	ret = qca8k_parse_port_config(priv);
+-	if (ret)
+-		return ret;
+-
+-	ret = qca8k_setup_mdio_bus(priv);
+-	if (ret)
+-		return ret;
+-
+-	ret = qca8k_setup_of_pws_reg(priv);
+-	if (ret)
+-		return ret;
+-
+-	ret = qca8k_setup_mac_pwr_sel(priv);
+-	if (ret)
+-		return ret;
+-
+-	/* Make sure MAC06 is disabled */
+-	ret = regmap_clear_bits(priv->regmap, QCA8K_REG_PORT0_PAD_CTRL,
+-				QCA8K_PORT0_PAD_MAC06_EXCHANGE_EN);
+-	if (ret) {
+-		dev_err(priv->dev, "failed disabling MAC06 exchange");
+-		return ret;
+-	}
+-
+-	/* Enable CPU Port */
+-	ret = regmap_set_bits(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0,
+-			      QCA8K_GLOBAL_FW_CTRL0_CPU_PORT_EN);
+-	if (ret) {
+-		dev_err(priv->dev, "failed enabling CPU port");
+-		return ret;
+-	}
+-
+-	/* Enable MIB counters */
+-	ret = qca8k_mib_init(priv);
+-	if (ret)
+-		dev_warn(priv->dev, "mib init failed");
+-
+-	/* Initial setup of all ports */
+-	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+-		/* Disable forwarding by default on all ports */
+-		ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(i),
+-				QCA8K_PORT_LOOKUP_MEMBER, 0);
+-		if (ret)
+-			return ret;
+-
+-		/* Enable QCA header mode on all cpu ports */
+-		if (dsa_is_cpu_port(ds, i)) {
+-			ret = qca8k_write(priv, QCA8K_REG_PORT_HDR_CTRL(i),
+-					  FIELD_PREP(QCA8K_PORT_HDR_CTRL_TX_MASK, QCA8K_PORT_HDR_CTRL_ALL) |
+-					  FIELD_PREP(QCA8K_PORT_HDR_CTRL_RX_MASK, QCA8K_PORT_HDR_CTRL_ALL));
+-			if (ret) {
+-				dev_err(priv->dev, "failed enabling QCA header mode");
+-				return ret;
+-			}
+-		}
+-
+-		/* Disable MAC by default on all user ports */
+-		if (dsa_is_user_port(ds, i))
+-			qca8k_port_set_status(priv, i, 0);
+-	}
+-
+-	/* Forward all unknown frames to CPU port for Linux processing
+-	 * Notice that in multi-cpu config only one port should be set
+-	 * for igmp, unknown, multicast and broadcast packet
+-	 */
+-	ret = qca8k_write(priv, QCA8K_REG_GLOBAL_FW_CTRL1,
+-			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_IGMP_DP_MASK, BIT(cpu_port)) |
+-			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_BC_DP_MASK, BIT(cpu_port)) |
+-			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_MC_DP_MASK, BIT(cpu_port)) |
+-			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_UC_DP_MASK, BIT(cpu_port)));
+-	if (ret)
+-		return ret;
+-
+-	/* Setup connection between CPU port & user ports
+-	 * Configure specific switch configuration for ports
+-	 */
+-	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+-		/* CPU port gets connected to all user ports of the switch */
+-		if (dsa_is_cpu_port(ds, i)) {
+-			ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(i),
+-					QCA8K_PORT_LOOKUP_MEMBER, dsa_user_ports(ds));
+-			if (ret)
+-				return ret;
+-		}
+-
+-		/* Individual user ports get connected to CPU port only */
+-		if (dsa_is_user_port(ds, i)) {
+-			ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(i),
+-					QCA8K_PORT_LOOKUP_MEMBER,
+-					BIT(cpu_port));
+-			if (ret)
+-				return ret;
+-
+-			/* Enable ARP Auto-learning by default */
+-			ret = regmap_set_bits(priv->regmap, QCA8K_PORT_LOOKUP_CTRL(i),
+-					      QCA8K_PORT_LOOKUP_LEARN);
+-			if (ret)
+-				return ret;
+-
+-			/* For port based vlans to work we need to set the
+-			 * default egress vid
+-			 */
+-			ret = qca8k_rmw(priv, QCA8K_EGRESS_VLAN(i),
+-					QCA8K_EGREES_VLAN_PORT_MASK(i),
+-					QCA8K_EGREES_VLAN_PORT(i, QCA8K_PORT_VID_DEF));
+-			if (ret)
+-				return ret;
+-
+-			ret = qca8k_write(priv, QCA8K_REG_PORT_VLAN_CTRL0(i),
+-					  QCA8K_PORT_VLAN_CVID(QCA8K_PORT_VID_DEF) |
+-					  QCA8K_PORT_VLAN_SVID(QCA8K_PORT_VID_DEF));
+-			if (ret)
+-				return ret;
+-		}
+-
+-		/* The port 5 of the qca8337 have some problem in flood condition. The
+-		 * original legacy driver had some specific buffer and priority settings
+-		 * for the different port suggested by the QCA switch team. Add this
+-		 * missing settings to improve switch stability under load condition.
+-		 * This problem is limited to qca8337 and other qca8k switch are not affected.
+-		 */
+-		if (priv->switch_id == QCA8K_ID_QCA8337) {
+-			switch (i) {
+-			/* The 2 CPU port and port 5 requires some different
+-			 * priority than any other ports.
+-			 */
+-			case 0:
+-			case 5:
+-			case 6:
+-				mask = QCA8K_PORT_HOL_CTRL0_EG_PRI0(0x3) |
+-					QCA8K_PORT_HOL_CTRL0_EG_PRI1(0x4) |
+-					QCA8K_PORT_HOL_CTRL0_EG_PRI2(0x4) |
+-					QCA8K_PORT_HOL_CTRL0_EG_PRI3(0x4) |
+-					QCA8K_PORT_HOL_CTRL0_EG_PRI4(0x6) |
+-					QCA8K_PORT_HOL_CTRL0_EG_PRI5(0x8) |
+-					QCA8K_PORT_HOL_CTRL0_EG_PORT(0x1e);
+-				break;
+-			default:
+-				mask = QCA8K_PORT_HOL_CTRL0_EG_PRI0(0x3) |
+-					QCA8K_PORT_HOL_CTRL0_EG_PRI1(0x4) |
+-					QCA8K_PORT_HOL_CTRL0_EG_PRI2(0x6) |
+-					QCA8K_PORT_HOL_CTRL0_EG_PRI3(0x8) |
+-					QCA8K_PORT_HOL_CTRL0_EG_PORT(0x19);
+-			}
+-			qca8k_write(priv, QCA8K_REG_PORT_HOL_CTRL0(i), mask);
+-
+-			mask = QCA8K_PORT_HOL_CTRL1_ING(0x6) |
+-			QCA8K_PORT_HOL_CTRL1_EG_PRI_BUF_EN |
+-			QCA8K_PORT_HOL_CTRL1_EG_PORT_BUF_EN |
+-			QCA8K_PORT_HOL_CTRL1_WRED_EN;
+-			qca8k_rmw(priv, QCA8K_REG_PORT_HOL_CTRL1(i),
+-				  QCA8K_PORT_HOL_CTRL1_ING_BUF_MASK |
+-				  QCA8K_PORT_HOL_CTRL1_EG_PRI_BUF_EN |
+-				  QCA8K_PORT_HOL_CTRL1_EG_PORT_BUF_EN |
+-				  QCA8K_PORT_HOL_CTRL1_WRED_EN,
+-				  mask);
+-		}
+-	}
+-
+-	/* Special GLOBAL_FC_THRESH value are needed for ar8327 switch */
+-	if (priv->switch_id == QCA8K_ID_QCA8327) {
+-		mask = QCA8K_GLOBAL_FC_GOL_XON_THRES(288) |
+-		       QCA8K_GLOBAL_FC_GOL_XOFF_THRES(496);
+-		qca8k_rmw(priv, QCA8K_REG_GLOBAL_FC_THRESH,
+-			  QCA8K_GLOBAL_FC_GOL_XON_THRES_MASK |
+-			  QCA8K_GLOBAL_FC_GOL_XOFF_THRES_MASK,
+-			  mask);
+-	}
+-
+-	/* Setup our port MTUs to match power on defaults */
+-	ret = qca8k_write(priv, QCA8K_MAX_FRAME_SIZE, ETH_FRAME_LEN + ETH_FCS_LEN);
+-	if (ret)
+-		dev_warn(priv->dev, "failed setting MTU settings");
+-
+-	/* Flush the FDB table */
+-	qca8k_fdb_flush(priv);
+-
+-	/* We don't have interrupts for link changes, so we need to poll */
+-	ds->pcs_poll = true;
+-
+-	/* Set min a max ageing value supported */
+-	ds->ageing_time_min = 7000;
+-	ds->ageing_time_max = 458745000;
+-
+-	/* Set max number of LAGs supported */
+-	ds->num_lag_ids = QCA8K_NUM_LAGS;
+-
+-	return 0;
+-}
+-
+-static void
+-qca8k_mac_config_setup_internal_delay(struct qca8k_priv *priv, int cpu_port_index,
+-				      u32 reg)
+-{
+-	u32 delay, val = 0;
+-	int ret;
+-
+-	/* Delay can be declared in 3 different way.
+-	 * Mode to rgmii and internal-delay standard binding defined
+-	 * rgmii-id or rgmii-tx/rx phy mode set.
+-	 * The parse logic set a delay different than 0 only when one
+-	 * of the 3 different way is used. In all other case delay is
+-	 * not enabled. With ID or TX/RXID delay is enabled and set
+-	 * to the default and recommended value.
+-	 */
+-	if (priv->ports_config.rgmii_tx_delay[cpu_port_index]) {
+-		delay = priv->ports_config.rgmii_tx_delay[cpu_port_index];
+-
+-		val |= QCA8K_PORT_PAD_RGMII_TX_DELAY(delay) |
+-			QCA8K_PORT_PAD_RGMII_TX_DELAY_EN;
+-	}
+-
+-	if (priv->ports_config.rgmii_rx_delay[cpu_port_index]) {
+-		delay = priv->ports_config.rgmii_rx_delay[cpu_port_index];
+-
+-		val |= QCA8K_PORT_PAD_RGMII_RX_DELAY(delay) |
+-			QCA8K_PORT_PAD_RGMII_RX_DELAY_EN;
+-	}
+-
+-	/* Set RGMII delay based on the selected values */
+-	ret = qca8k_rmw(priv, reg,
+-			QCA8K_PORT_PAD_RGMII_TX_DELAY_MASK |
+-			QCA8K_PORT_PAD_RGMII_RX_DELAY_MASK |
+-			QCA8K_PORT_PAD_RGMII_TX_DELAY_EN |
+-			QCA8K_PORT_PAD_RGMII_RX_DELAY_EN,
+-			val);
+-	if (ret)
+-		dev_err(priv->dev, "Failed to set internal delay for CPU port%d",
+-			cpu_port_index == QCA8K_CPU_PORT0 ? 0 : 6);
+-}
+-
+-static void
+-qca8k_phylink_mac_config(struct dsa_switch *ds, int port, unsigned int mode,
+-			 const struct phylink_link_state *state)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	int cpu_port_index, ret;
+-	u32 reg, val;
+-
+-	switch (port) {
+-	case 0: /* 1st CPU port */
+-		if (state->interface != PHY_INTERFACE_MODE_RGMII &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_ID &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_TXID &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_RXID &&
+-		    state->interface != PHY_INTERFACE_MODE_SGMII)
+-			return;
+-
+-		reg = QCA8K_REG_PORT0_PAD_CTRL;
+-		cpu_port_index = QCA8K_CPU_PORT0;
+-		break;
+-	case 1:
+-	case 2:
+-	case 3:
+-	case 4:
+-	case 5:
+-		/* Internal PHY, nothing to do */
+-		return;
+-	case 6: /* 2nd CPU port / external PHY */
+-		if (state->interface != PHY_INTERFACE_MODE_RGMII &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_ID &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_TXID &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_RXID &&
+-		    state->interface != PHY_INTERFACE_MODE_SGMII &&
+-		    state->interface != PHY_INTERFACE_MODE_1000BASEX)
+-			return;
+-
+-		reg = QCA8K_REG_PORT6_PAD_CTRL;
+-		cpu_port_index = QCA8K_CPU_PORT6;
+-		break;
+-	default:
+-		dev_err(ds->dev, "%s: unsupported port: %i\n", __func__, port);
+-		return;
+-	}
+-
+-	if (port != 6 && phylink_autoneg_inband(mode)) {
+-		dev_err(ds->dev, "%s: in-band negotiation unsupported\n",
+-			__func__);
+-		return;
+-	}
+-
+-	switch (state->interface) {
+-	case PHY_INTERFACE_MODE_RGMII:
+-	case PHY_INTERFACE_MODE_RGMII_ID:
+-	case PHY_INTERFACE_MODE_RGMII_TXID:
+-	case PHY_INTERFACE_MODE_RGMII_RXID:
+-		qca8k_write(priv, reg, QCA8K_PORT_PAD_RGMII_EN);
+-
+-		/* Configure rgmii delay */
+-		qca8k_mac_config_setup_internal_delay(priv, cpu_port_index, reg);
+-
+-		/* QCA8337 requires to set rgmii rx delay for all ports.
+-		 * This is enabled through PORT5_PAD_CTRL for all ports,
+-		 * rather than individual port registers.
+-		 */
+-		if (priv->switch_id == QCA8K_ID_QCA8337)
+-			qca8k_write(priv, QCA8K_REG_PORT5_PAD_CTRL,
+-				    QCA8K_PORT_PAD_RGMII_RX_DELAY_EN);
+-		break;
+-	case PHY_INTERFACE_MODE_SGMII:
+-	case PHY_INTERFACE_MODE_1000BASEX:
+-		/* Enable SGMII on the port */
+-		qca8k_write(priv, reg, QCA8K_PORT_PAD_SGMII_EN);
+-
+-		/* Enable/disable SerDes auto-negotiation as necessary */
+-		ret = qca8k_read(priv, QCA8K_REG_PWS, &val);
+-		if (ret)
+-			return;
+-		if (phylink_autoneg_inband(mode))
+-			val &= ~QCA8K_PWS_SERDES_AEN_DIS;
+-		else
+-			val |= QCA8K_PWS_SERDES_AEN_DIS;
+-		qca8k_write(priv, QCA8K_REG_PWS, val);
+-
+-		/* Configure the SGMII parameters */
+-		ret = qca8k_read(priv, QCA8K_REG_SGMII_CTRL, &val);
+-		if (ret)
+-			return;
+-
+-		val |= QCA8K_SGMII_EN_SD;
+-
+-		if (priv->ports_config.sgmii_enable_pll)
+-			val |= QCA8K_SGMII_EN_PLL | QCA8K_SGMII_EN_RX |
+-			       QCA8K_SGMII_EN_TX;
+-
+-		if (dsa_is_cpu_port(ds, port)) {
+-			/* CPU port, we're talking to the CPU MAC, be a PHY */
+-			val &= ~QCA8K_SGMII_MODE_CTRL_MASK;
+-			val |= QCA8K_SGMII_MODE_CTRL_PHY;
+-		} else if (state->interface == PHY_INTERFACE_MODE_SGMII) {
+-			val &= ~QCA8K_SGMII_MODE_CTRL_MASK;
+-			val |= QCA8K_SGMII_MODE_CTRL_MAC;
+-		} else if (state->interface == PHY_INTERFACE_MODE_1000BASEX) {
+-			val &= ~QCA8K_SGMII_MODE_CTRL_MASK;
+-			val |= QCA8K_SGMII_MODE_CTRL_BASEX;
+-		}
+-
+-		qca8k_write(priv, QCA8K_REG_SGMII_CTRL, val);
+-
+-		/* From original code is reported port instability as SGMII also
+-		 * require delay set. Apply advised values here or take them from DT.
+-		 */
+-		if (state->interface == PHY_INTERFACE_MODE_SGMII)
+-			qca8k_mac_config_setup_internal_delay(priv, cpu_port_index, reg);
+-
+-		/* For qca8327/qca8328/qca8334/qca8338 sgmii is unique and
+-		 * falling edge is set writing in the PORT0 PAD reg
+-		 */
+-		if (priv->switch_id == QCA8K_ID_QCA8327 ||
+-		    priv->switch_id == QCA8K_ID_QCA8337)
+-			reg = QCA8K_REG_PORT0_PAD_CTRL;
+-
+-		val = 0;
+-
+-		/* SGMII Clock phase configuration */
+-		if (priv->ports_config.sgmii_rx_clk_falling_edge)
+-			val |= QCA8K_PORT0_PAD_SGMII_RXCLK_FALLING_EDGE;
+-
+-		if (priv->ports_config.sgmii_tx_clk_falling_edge)
+-			val |= QCA8K_PORT0_PAD_SGMII_TXCLK_FALLING_EDGE;
+-
+-		if (val)
+-			ret = qca8k_rmw(priv, reg,
+-					QCA8K_PORT0_PAD_SGMII_RXCLK_FALLING_EDGE |
+-					QCA8K_PORT0_PAD_SGMII_TXCLK_FALLING_EDGE,
+-					val);
+-
+-		break;
+-	default:
+-		dev_err(ds->dev, "xMII mode %s not supported for port %d\n",
+-			phy_modes(state->interface), port);
+-		return;
+-	}
+-}
+-
+-static void
+-qca8k_phylink_validate(struct dsa_switch *ds, int port,
+-		       unsigned long *supported,
+-		       struct phylink_link_state *state)
+-{
+-	__ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
+-
+-	switch (port) {
+-	case 0: /* 1st CPU port */
+-		if (state->interface != PHY_INTERFACE_MODE_NA &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_ID &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_TXID &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_RXID &&
+-		    state->interface != PHY_INTERFACE_MODE_SGMII)
+-			goto unsupported;
+-		break;
+-	case 1:
+-	case 2:
+-	case 3:
+-	case 4:
+-	case 5:
+-		/* Internal PHY */
+-		if (state->interface != PHY_INTERFACE_MODE_NA &&
+-		    state->interface != PHY_INTERFACE_MODE_GMII &&
+-		    state->interface != PHY_INTERFACE_MODE_INTERNAL)
+-			goto unsupported;
+-		break;
+-	case 6: /* 2nd CPU port / external PHY */
+-		if (state->interface != PHY_INTERFACE_MODE_NA &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_ID &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_TXID &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_RXID &&
+-		    state->interface != PHY_INTERFACE_MODE_SGMII &&
+-		    state->interface != PHY_INTERFACE_MODE_1000BASEX)
+-			goto unsupported;
+-		break;
+-	default:
+-unsupported:
+-		linkmode_zero(supported);
+-		return;
+-	}
+-
+-	phylink_set_port_modes(mask);
+-	phylink_set(mask, Autoneg);
+-
+-	phylink_set(mask, 1000baseT_Full);
+-	phylink_set(mask, 10baseT_Half);
+-	phylink_set(mask, 10baseT_Full);
+-	phylink_set(mask, 100baseT_Half);
+-	phylink_set(mask, 100baseT_Full);
+-
+-	if (state->interface == PHY_INTERFACE_MODE_1000BASEX)
+-		phylink_set(mask, 1000baseX_Full);
+-
+-	phylink_set(mask, Pause);
+-	phylink_set(mask, Asym_Pause);
+-
+-	linkmode_and(supported, supported, mask);
+-	linkmode_and(state->advertising, state->advertising, mask);
+-}
+-
+-static int
+-qca8k_phylink_mac_link_state(struct dsa_switch *ds, int port,
+-			     struct phylink_link_state *state)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	u32 reg;
+-	int ret;
+-
+-	ret = qca8k_read(priv, QCA8K_REG_PORT_STATUS(port), &reg);
+-	if (ret < 0)
+-		return ret;
+-
+-	state->link = !!(reg & QCA8K_PORT_STATUS_LINK_UP);
+-	state->an_complete = state->link;
+-	state->an_enabled = !!(reg & QCA8K_PORT_STATUS_LINK_AUTO);
+-	state->duplex = (reg & QCA8K_PORT_STATUS_DUPLEX) ? DUPLEX_FULL :
+-							   DUPLEX_HALF;
+-
+-	switch (reg & QCA8K_PORT_STATUS_SPEED) {
+-	case QCA8K_PORT_STATUS_SPEED_10:
+-		state->speed = SPEED_10;
+-		break;
+-	case QCA8K_PORT_STATUS_SPEED_100:
+-		state->speed = SPEED_100;
+-		break;
+-	case QCA8K_PORT_STATUS_SPEED_1000:
+-		state->speed = SPEED_1000;
+-		break;
+-	default:
+-		state->speed = SPEED_UNKNOWN;
+-		break;
+-	}
+-
+-	state->pause = MLO_PAUSE_NONE;
+-	if (reg & QCA8K_PORT_STATUS_RXFLOW)
+-		state->pause |= MLO_PAUSE_RX;
+-	if (reg & QCA8K_PORT_STATUS_TXFLOW)
+-		state->pause |= MLO_PAUSE_TX;
+-
+-	return 1;
+-}
+-
+-static void
+-qca8k_phylink_mac_link_down(struct dsa_switch *ds, int port, unsigned int mode,
+-			    phy_interface_t interface)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-
+-	qca8k_port_set_status(priv, port, 0);
+-}
+-
+-static void
+-qca8k_phylink_mac_link_up(struct dsa_switch *ds, int port, unsigned int mode,
+-			  phy_interface_t interface, struct phy_device *phydev,
+-			  int speed, int duplex, bool tx_pause, bool rx_pause)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	u32 reg;
+-
+-	if (phylink_autoneg_inband(mode)) {
+-		reg = QCA8K_PORT_STATUS_LINK_AUTO;
+-	} else {
+-		switch (speed) {
+-		case SPEED_10:
+-			reg = QCA8K_PORT_STATUS_SPEED_10;
+-			break;
+-		case SPEED_100:
+-			reg = QCA8K_PORT_STATUS_SPEED_100;
+-			break;
+-		case SPEED_1000:
+-			reg = QCA8K_PORT_STATUS_SPEED_1000;
+-			break;
+-		default:
+-			reg = QCA8K_PORT_STATUS_LINK_AUTO;
+-			break;
+-		}
+-
+-		if (duplex == DUPLEX_FULL)
+-			reg |= QCA8K_PORT_STATUS_DUPLEX;
+-
+-		if (rx_pause || dsa_is_cpu_port(ds, port))
+-			reg |= QCA8K_PORT_STATUS_RXFLOW;
+-
+-		if (tx_pause || dsa_is_cpu_port(ds, port))
+-			reg |= QCA8K_PORT_STATUS_TXFLOW;
+-	}
+-
+-	reg |= QCA8K_PORT_STATUS_TXMAC | QCA8K_PORT_STATUS_RXMAC;
+-
+-	qca8k_write(priv, QCA8K_REG_PORT_STATUS(port), reg);
+-}
+-
+-static void
+-qca8k_get_strings(struct dsa_switch *ds, int port, u32 stringset, uint8_t *data)
+-{
+-	const struct qca8k_match_data *match_data;
+-	struct qca8k_priv *priv = ds->priv;
+-	int i;
+-
+-	if (stringset != ETH_SS_STATS)
+-		return;
+-
+-	match_data = of_device_get_match_data(priv->dev);
+-
+-	for (i = 0; i < match_data->mib_count; i++)
+-		strncpy(data + i * ETH_GSTRING_LEN, ar8327_mib[i].name,
+-			ETH_GSTRING_LEN);
+-}
+-
+-static void qca8k_mib_autocast_handler(struct dsa_switch *ds, struct sk_buff *skb)
+-{
+-	const struct qca8k_match_data *match_data;
+-	struct qca8k_mib_eth_data *mib_eth_data;
+-	struct qca8k_priv *priv = ds->priv;
+-	const struct qca8k_mib_desc *mib;
+-	struct mib_ethhdr *mib_ethhdr;
+-	int i, mib_len, offset = 0;
+-	u64 *data;
+-	u8 port;
+-
+-	mib_ethhdr = (struct mib_ethhdr *)skb_mac_header(skb);
+-	mib_eth_data = &priv->mib_eth_data;
+-
+-	/* The switch autocast every port. Ignore other packet and
+-	 * parse only the requested one.
+-	 */
+-	port = FIELD_GET(QCA_HDR_RECV_SOURCE_PORT, ntohs(mib_ethhdr->hdr));
+-	if (port != mib_eth_data->req_port)
+-		goto exit;
+-
+-	match_data = device_get_match_data(priv->dev);
+-	data = mib_eth_data->data;
+-
+-	for (i = 0; i < match_data->mib_count; i++) {
+-		mib = &ar8327_mib[i];
+-
+-		/* First 3 mib are present in the skb head */
+-		if (i < 3) {
+-			data[i] = mib_ethhdr->data[i];
+-			continue;
+-		}
+-
+-		mib_len = sizeof(uint32_t);
+-
+-		/* Some mib are 64 bit wide */
+-		if (mib->size == 2)
+-			mib_len = sizeof(uint64_t);
+-
+-		/* Copy the mib value from packet to the */
+-		memcpy(data + i, skb->data + offset, mib_len);
+-
+-		/* Set the offset for the next mib */
+-		offset += mib_len;
+-	}
+-
+-exit:
+-	/* Complete on receiving all the mib packet */
+-	if (refcount_dec_and_test(&mib_eth_data->port_parsed))
+-		complete(&mib_eth_data->rw_done);
+-}
+-
+-static int
+-qca8k_get_ethtool_stats_eth(struct dsa_switch *ds, int port, u64 *data)
+-{
+-	struct dsa_port *dp = dsa_to_port(ds, port);
+-	struct qca8k_mib_eth_data *mib_eth_data;
+-	struct qca8k_priv *priv = ds->priv;
+-	int ret;
+-
+-	mib_eth_data = &priv->mib_eth_data;
+-
+-	mutex_lock(&mib_eth_data->mutex);
+-
+-	reinit_completion(&mib_eth_data->rw_done);
+-
+-	mib_eth_data->req_port = dp->index;
+-	mib_eth_data->data = data;
+-	refcount_set(&mib_eth_data->port_parsed, QCA8K_NUM_PORTS);
+-
+-	mutex_lock(&priv->reg_mutex);
+-
+-	/* Send mib autocast request */
+-	ret = regmap_update_bits(priv->regmap, QCA8K_REG_MIB,
+-				 QCA8K_MIB_FUNC | QCA8K_MIB_BUSY,
+-				 FIELD_PREP(QCA8K_MIB_FUNC, QCA8K_MIB_CAST) |
+-				 QCA8K_MIB_BUSY);
+-
+-	mutex_unlock(&priv->reg_mutex);
+-
+-	if (ret)
+-		goto exit;
+-
+-	ret = wait_for_completion_timeout(&mib_eth_data->rw_done, QCA8K_ETHERNET_TIMEOUT);
+-
+-exit:
+-	mutex_unlock(&mib_eth_data->mutex);
+-
+-	return ret;
+-}
+-
+-static void
+-qca8k_get_ethtool_stats(struct dsa_switch *ds, int port,
+-			uint64_t *data)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	const struct qca8k_match_data *match_data;
+-	const struct qca8k_mib_desc *mib;
+-	u32 reg, i, val;
+-	u32 hi = 0;
+-	int ret;
+-
+-	if (priv->mgmt_master &&
+-	    qca8k_get_ethtool_stats_eth(ds, port, data) > 0)
+-		return;
+-
+-	match_data = of_device_get_match_data(priv->dev);
+-
+-	for (i = 0; i < match_data->mib_count; i++) {
+-		mib = &ar8327_mib[i];
+-		reg = QCA8K_PORT_MIB_COUNTER(port) + mib->offset;
+-
+-		ret = qca8k_read(priv, reg, &val);
+-		if (ret < 0)
+-			continue;
+-
+-		if (mib->size == 2) {
+-			ret = qca8k_read(priv, reg + 4, &hi);
+-			if (ret < 0)
+-				continue;
+-		}
+-
+-		data[i] = val;
+-		if (mib->size == 2)
+-			data[i] |= (u64)hi << 32;
+-	}
+-}
+-
+-static int
+-qca8k_get_sset_count(struct dsa_switch *ds, int port, int sset)
+-{
+-	const struct qca8k_match_data *match_data;
+-	struct qca8k_priv *priv = ds->priv;
+-
+-	if (sset != ETH_SS_STATS)
+-		return 0;
+-
+-	match_data = of_device_get_match_data(priv->dev);
+-
+-	return match_data->mib_count;
+-}
+-
+-static int
+-qca8k_set_mac_eee(struct dsa_switch *ds, int port, struct ethtool_eee *eee)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	u32 lpi_en = QCA8K_REG_EEE_CTRL_LPI_EN(port);
+-	u32 reg;
+-	int ret;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	ret = qca8k_read(priv, QCA8K_REG_EEE_CTRL, &reg);
+-	if (ret < 0)
+-		goto exit;
+-
+-	if (eee->eee_enabled)
+-		reg |= lpi_en;
+-	else
+-		reg &= ~lpi_en;
+-	ret = qca8k_write(priv, QCA8K_REG_EEE_CTRL, reg);
+-
+-exit:
+-	mutex_unlock(&priv->reg_mutex);
+-	return ret;
+-}
+-
+-static int
+-qca8k_get_mac_eee(struct dsa_switch *ds, int port, struct ethtool_eee *e)
+-{
+-	/* Nothing to do on the port's MAC */
+-	return 0;
+-}
+-
+-static void
+-qca8k_port_stp_state_set(struct dsa_switch *ds, int port, u8 state)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	u32 stp_state;
+-
+-	switch (state) {
+-	case BR_STATE_DISABLED:
+-		stp_state = QCA8K_PORT_LOOKUP_STATE_DISABLED;
+-		break;
+-	case BR_STATE_BLOCKING:
+-		stp_state = QCA8K_PORT_LOOKUP_STATE_BLOCKING;
+-		break;
+-	case BR_STATE_LISTENING:
+-		stp_state = QCA8K_PORT_LOOKUP_STATE_LISTENING;
+-		break;
+-	case BR_STATE_LEARNING:
+-		stp_state = QCA8K_PORT_LOOKUP_STATE_LEARNING;
+-		break;
+-	case BR_STATE_FORWARDING:
+-	default:
+-		stp_state = QCA8K_PORT_LOOKUP_STATE_FORWARD;
+-		break;
+-	}
+-
+-	qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+-		  QCA8K_PORT_LOOKUP_STATE_MASK, stp_state);
+-}
+-
+-static int
+-qca8k_port_bridge_join(struct dsa_switch *ds, int port, struct net_device *br)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	int port_mask, cpu_port;
+-	int i, ret;
+-
+-	cpu_port = dsa_to_port(ds, port)->cpu_dp->index;
+-	port_mask = BIT(cpu_port);
+-
+-	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+-		if (dsa_is_cpu_port(ds, i))
+-			continue;
+-		if (dsa_to_port(ds, i)->bridge_dev != br)
+-			continue;
+-		/* Add this port to the portvlan mask of the other ports
+-		 * in the bridge
+-		 */
+-		ret = regmap_set_bits(priv->regmap,
+-				      QCA8K_PORT_LOOKUP_CTRL(i),
+-				      BIT(port));
+-		if (ret)
+-			return ret;
+-		if (i != port)
+-			port_mask |= BIT(i);
+-	}
+-
+-	/* Add all other ports to this ports portvlan mask */
+-	ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+-			QCA8K_PORT_LOOKUP_MEMBER, port_mask);
+-
+-	return ret;
+-}
+-
+-static void
+-qca8k_port_bridge_leave(struct dsa_switch *ds, int port, struct net_device *br)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	int cpu_port, i;
+-
+-	cpu_port = dsa_to_port(ds, port)->cpu_dp->index;
+-
+-	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+-		if (dsa_is_cpu_port(ds, i))
+-			continue;
+-		if (dsa_to_port(ds, i)->bridge_dev != br)
+-			continue;
+-		/* Remove this port to the portvlan mask of the other ports
+-		 * in the bridge
+-		 */
+-		regmap_clear_bits(priv->regmap,
+-				  QCA8K_PORT_LOOKUP_CTRL(i),
+-				  BIT(port));
+-	}
+-
+-	/* Set the cpu port to be the only one in the portvlan mask of
+-	 * this port
+-	 */
+-	qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+-		  QCA8K_PORT_LOOKUP_MEMBER, BIT(cpu_port));
+-}
+-
+-static void
+-qca8k_port_fast_age(struct dsa_switch *ds, int port)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	qca8k_fdb_access(priv, QCA8K_FDB_FLUSH_PORT, port);
+-	mutex_unlock(&priv->reg_mutex);
+-}
+-
+-static int
+-qca8k_set_ageing_time(struct dsa_switch *ds, unsigned int msecs)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	unsigned int secs = msecs / 1000;
+-	u32 val;
+-
+-	/* AGE_TIME reg is set in 7s step */
+-	val = secs / 7;
+-
+-	/* Handle case with 0 as val to NOT disable
+-	 * learning
+-	 */
+-	if (!val)
+-		val = 1;
+-
+-	return regmap_update_bits(priv->regmap, QCA8K_REG_ATU_CTRL, QCA8K_ATU_AGE_TIME_MASK,
+-				  QCA8K_ATU_AGE_TIME(val));
+-}
+-
+-static int
+-qca8k_port_enable(struct dsa_switch *ds, int port,
+-		  struct phy_device *phy)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-
+-	qca8k_port_set_status(priv, port, 1);
+-	priv->port_enabled_map |= BIT(port);
+-
+-	if (dsa_is_user_port(ds, port))
+-		phy_support_asym_pause(phy);
+-
+-	return 0;
+-}
+-
+-static void
+-qca8k_port_disable(struct dsa_switch *ds, int port)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-
+-	qca8k_port_set_status(priv, port, 0);
+-	priv->port_enabled_map &= ~BIT(port);
+-}
+-
+-static int
+-qca8k_port_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	int ret;
+-
+-	/* We have only have a general MTU setting.
+-	 * DSA always set the CPU port's MTU to the largest MTU of the slave
+-	 * ports.
+-	 * Setting MTU just for the CPU port is sufficient to correctly set a
+-	 * value for every port.
+-	 */
+-	if (!dsa_is_cpu_port(ds, port))
+-		return 0;
+-
+-	/* To change the MAX_FRAME_SIZE the cpu ports must be off or
+-	 * the switch panics.
+-	 * Turn off both cpu ports before applying the new value to prevent
+-	 * this.
+-	 */
+-	if (priv->port_enabled_map & BIT(0))
+-		qca8k_port_set_status(priv, 0, 0);
+-
+-	if (priv->port_enabled_map & BIT(6))
+-		qca8k_port_set_status(priv, 6, 0);
+-
+-	/* Include L2 header / FCS length */
+-	ret = qca8k_write(priv, QCA8K_MAX_FRAME_SIZE, new_mtu + ETH_HLEN + ETH_FCS_LEN);
+-
+-	if (priv->port_enabled_map & BIT(0))
+-		qca8k_port_set_status(priv, 0, 1);
+-
+-	if (priv->port_enabled_map & BIT(6))
+-		qca8k_port_set_status(priv, 6, 1);
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_port_max_mtu(struct dsa_switch *ds, int port)
+-{
+-	return QCA8K_MAX_MTU;
+-}
+-
+-static int
+-qca8k_port_fdb_insert(struct qca8k_priv *priv, const u8 *addr,
+-		      u16 port_mask, u16 vid)
+-{
+-	/* Set the vid to the port vlan id if no vid is set */
+-	if (!vid)
+-		vid = QCA8K_PORT_VID_DEF;
+-
+-	return qca8k_fdb_add(priv, addr, port_mask, vid,
+-			     QCA8K_ATU_STATUS_STATIC);
+-}
+-
+-static int
+-qca8k_port_fdb_add(struct dsa_switch *ds, int port,
+-		   const unsigned char *addr, u16 vid)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	u16 port_mask = BIT(port);
+-
+-	return qca8k_port_fdb_insert(priv, addr, port_mask, vid);
+-}
+-
+-static int
+-qca8k_port_fdb_del(struct dsa_switch *ds, int port,
+-		   const unsigned char *addr, u16 vid)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	u16 port_mask = BIT(port);
+-
+-	if (!vid)
+-		vid = QCA8K_PORT_VID_DEF;
+-
+-	return qca8k_fdb_del(priv, addr, port_mask, vid);
+-}
+-
+-static int
+-qca8k_port_fdb_dump(struct dsa_switch *ds, int port,
+-		    dsa_fdb_dump_cb_t *cb, void *data)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	struct qca8k_fdb _fdb = { 0 };
+-	int cnt = QCA8K_NUM_FDB_RECORDS;
+-	bool is_static;
+-	int ret = 0;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	while (cnt-- && !qca8k_fdb_next(priv, &_fdb, port)) {
+-		if (!_fdb.aging)
+-			break;
+-		is_static = (_fdb.aging == QCA8K_ATU_STATUS_STATIC);
+-		ret = cb(_fdb.mac, _fdb.vid, is_static, data);
+-		if (ret)
+-			break;
+-	}
+-	mutex_unlock(&priv->reg_mutex);
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_port_mdb_add(struct dsa_switch *ds, int port,
+-		   const struct switchdev_obj_port_mdb *mdb)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	const u8 *addr = mdb->addr;
+-	u16 vid = mdb->vid;
+-
+-	return qca8k_fdb_search_and_insert(priv, BIT(port), addr, vid);
+-}
+-
+-static int
+-qca8k_port_mdb_del(struct dsa_switch *ds, int port,
+-		   const struct switchdev_obj_port_mdb *mdb)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	const u8 *addr = mdb->addr;
+-	u16 vid = mdb->vid;
+-
+-	return qca8k_fdb_search_and_del(priv, BIT(port), addr, vid);
+-}
+-
+-static int
+-qca8k_port_mirror_add(struct dsa_switch *ds, int port,
+-		      struct dsa_mall_mirror_tc_entry *mirror,
+-		      bool ingress)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	int monitor_port, ret;
+-	u32 reg, val;
+-
+-	/* Check for existent entry */
+-	if ((ingress ? priv->mirror_rx : priv->mirror_tx) & BIT(port))
+-		return -EEXIST;
+-
+-	ret = regmap_read(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0, &val);
+-	if (ret)
+-		return ret;
+-
+-	/* QCA83xx can have only one port set to mirror mode.
+-	 * Check that the correct port is requested and return error otherwise.
+-	 * When no mirror port is set, the values is set to 0xF
+-	 */
+-	monitor_port = FIELD_GET(QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, val);
+-	if (monitor_port != 0xF && monitor_port != mirror->to_local_port)
+-		return -EEXIST;
+-
+-	/* Set the monitor port */
+-	val = FIELD_PREP(QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM,
+-			 mirror->to_local_port);
+-	ret = regmap_update_bits(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0,
+-				 QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, val);
+-	if (ret)
+-		return ret;
+-
+-	if (ingress) {
+-		reg = QCA8K_PORT_LOOKUP_CTRL(port);
+-		val = QCA8K_PORT_LOOKUP_ING_MIRROR_EN;
+-	} else {
+-		reg = QCA8K_REG_PORT_HOL_CTRL1(port);
+-		val = QCA8K_PORT_HOL_CTRL1_EG_MIRROR_EN;
+-	}
+-
+-	ret = regmap_update_bits(priv->regmap, reg, val, val);
+-	if (ret)
+-		return ret;
+-
+-	/* Track mirror port for tx and rx to decide when the
+-	 * mirror port has to be disabled.
+-	 */
+-	if (ingress)
+-		priv->mirror_rx |= BIT(port);
+-	else
+-		priv->mirror_tx |= BIT(port);
+-
+-	return 0;
+-}
+-
+-static void
+-qca8k_port_mirror_del(struct dsa_switch *ds, int port,
+-		      struct dsa_mall_mirror_tc_entry *mirror)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	u32 reg, val;
+-	int ret;
+-
+-	if (mirror->ingress) {
+-		reg = QCA8K_PORT_LOOKUP_CTRL(port);
+-		val = QCA8K_PORT_LOOKUP_ING_MIRROR_EN;
+-	} else {
+-		reg = QCA8K_REG_PORT_HOL_CTRL1(port);
+-		val = QCA8K_PORT_HOL_CTRL1_EG_MIRROR_EN;
+-	}
+-
+-	ret = regmap_clear_bits(priv->regmap, reg, val);
+-	if (ret)
+-		goto err;
+-
+-	if (mirror->ingress)
+-		priv->mirror_rx &= ~BIT(port);
+-	else
+-		priv->mirror_tx &= ~BIT(port);
+-
+-	/* No port set to send packet to mirror port. Disable mirror port */
+-	if (!priv->mirror_rx && !priv->mirror_tx) {
+-		val = FIELD_PREP(QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, 0xF);
+-		ret = regmap_update_bits(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0,
+-					 QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, val);
+-		if (ret)
+-			goto err;
+-	}
+-err:
+-	dev_err(priv->dev, "Failed to del mirror port from %d", port);
+-}
+-
+-static int
+-qca8k_port_vlan_filtering(struct dsa_switch *ds, int port, bool vlan_filtering,
+-			  struct netlink_ext_ack *extack)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	int ret;
+-
+-	if (vlan_filtering) {
+-		ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+-				QCA8K_PORT_LOOKUP_VLAN_MODE_MASK,
+-				QCA8K_PORT_LOOKUP_VLAN_MODE_SECURE);
+-	} else {
+-		ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+-				QCA8K_PORT_LOOKUP_VLAN_MODE_MASK,
+-				QCA8K_PORT_LOOKUP_VLAN_MODE_NONE);
+-	}
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_port_vlan_add(struct dsa_switch *ds, int port,
+-		    const struct switchdev_obj_port_vlan *vlan,
+-		    struct netlink_ext_ack *extack)
+-{
+-	bool untagged = vlan->flags & BRIDGE_VLAN_INFO_UNTAGGED;
+-	bool pvid = vlan->flags & BRIDGE_VLAN_INFO_PVID;
+-	struct qca8k_priv *priv = ds->priv;
+-	int ret;
+-
+-	ret = qca8k_vlan_add(priv, port, vlan->vid, untagged);
+-	if (ret) {
+-		dev_err(priv->dev, "Failed to add VLAN to port %d (%d)", port, ret);
+-		return ret;
+-	}
+-
+-	if (pvid) {
+-		ret = qca8k_rmw(priv, QCA8K_EGRESS_VLAN(port),
+-				QCA8K_EGREES_VLAN_PORT_MASK(port),
+-				QCA8K_EGREES_VLAN_PORT(port, vlan->vid));
+-		if (ret)
+-			return ret;
+-
+-		ret = qca8k_write(priv, QCA8K_REG_PORT_VLAN_CTRL0(port),
+-				  QCA8K_PORT_VLAN_CVID(vlan->vid) |
+-				  QCA8K_PORT_VLAN_SVID(vlan->vid));
+-	}
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_port_vlan_del(struct dsa_switch *ds, int port,
+-		    const struct switchdev_obj_port_vlan *vlan)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	int ret;
+-
+-	ret = qca8k_vlan_del(priv, port, vlan->vid);
+-	if (ret)
+-		dev_err(priv->dev, "Failed to delete VLAN from port %d (%d)", port, ret);
+-
+-	return ret;
+-}
+-
+-static u32 qca8k_get_phy_flags(struct dsa_switch *ds, int port)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-
+-	/* Communicate to the phy internal driver the switch revision.
+-	 * Based on the switch revision different values needs to be
+-	 * set to the dbg and mmd reg on the phy.
+-	 * The first 2 bit are used to communicate the switch revision
+-	 * to the phy driver.
+-	 */
+-	if (port > 0 && port < 6)
+-		return priv->switch_revision;
+-
+-	return 0;
+-}
+-
+-static enum dsa_tag_protocol
+-qca8k_get_tag_protocol(struct dsa_switch *ds, int port,
+-		       enum dsa_tag_protocol mp)
+-{
+-	return DSA_TAG_PROTO_QCA;
+-}
+-
+-static bool
+-qca8k_lag_can_offload(struct dsa_switch *ds,
+-		      struct net_device *lag,
+-		      struct netdev_lag_upper_info *info)
+-{
+-	struct dsa_port *dp;
+-	int id, members = 0;
+-
+-	id = dsa_lag_id(ds->dst, lag);
+-	if (id < 0 || id >= ds->num_lag_ids)
+-		return false;
+-
+-	dsa_lag_foreach_port(dp, ds->dst, lag)
+-		/* Includes the port joining the LAG */
+-		members++;
+-
+-	if (members > QCA8K_NUM_PORTS_FOR_LAG)
+-		return false;
+-
+-	if (info->tx_type != NETDEV_LAG_TX_TYPE_HASH)
+-		return false;
+-
+-	if (info->hash_type != NETDEV_LAG_HASH_L2 &&
+-	    info->hash_type != NETDEV_LAG_HASH_L23)
+-		return false;
+-
+-	return true;
+-}
+-
+-static int
+-qca8k_lag_setup_hash(struct dsa_switch *ds,
+-		     struct net_device *lag,
+-		     struct netdev_lag_upper_info *info)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	bool unique_lag = true;
+-	u32 hash = 0;
+-	int i, id;
+-
+-	id = dsa_lag_id(ds->dst, lag);
+-
+-	switch (info->hash_type) {
+-	case NETDEV_LAG_HASH_L23:
+-		hash |= QCA8K_TRUNK_HASH_SIP_EN;
+-		hash |= QCA8K_TRUNK_HASH_DIP_EN;
+-		fallthrough;
+-	case NETDEV_LAG_HASH_L2:
+-		hash |= QCA8K_TRUNK_HASH_SA_EN;
+-		hash |= QCA8K_TRUNK_HASH_DA_EN;
+-		break;
+-	default: /* We should NEVER reach this */
+-		return -EOPNOTSUPP;
+-	}
+-
+-	/* Check if we are the unique configured LAG */
+-	dsa_lags_foreach_id(i, ds->dst)
+-		if (i != id && dsa_lag_dev(ds->dst, i)) {
+-			unique_lag = false;
+-			break;
+-		}
+-
+-	/* Hash Mode is global. Make sure the same Hash Mode
+-	 * is set to all the 4 possible lag.
+-	 * If we are the unique LAG we can set whatever hash
+-	 * mode we want.
+-	 * To change hash mode it's needed to remove all LAG
+-	 * and change the mode with the latest.
+-	 */
+-	if (unique_lag) {
+-		priv->lag_hash_mode = hash;
+-	} else if (priv->lag_hash_mode != hash) {
+-		netdev_err(lag, "Error: Mismateched Hash Mode across different lag is not supported\n");
+-		return -EOPNOTSUPP;
+-	}
+-
+-	return regmap_update_bits(priv->regmap, QCA8K_TRUNK_HASH_EN_CTRL,
+-				  QCA8K_TRUNK_HASH_MASK, hash);
+-}
+-
+-static int
+-qca8k_lag_refresh_portmap(struct dsa_switch *ds, int port,
+-			  struct net_device *lag, bool delete)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	int ret, id, i;
+-	u32 val;
+-
+-	id = dsa_lag_id(ds->dst, lag);
+-
+-	/* Read current port member */
+-	ret = regmap_read(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL0, &val);
+-	if (ret)
+-		return ret;
+-
+-	/* Shift val to the correct trunk */
+-	val >>= QCA8K_REG_GOL_TRUNK_SHIFT(id);
+-	val &= QCA8K_REG_GOL_TRUNK_MEMBER_MASK;
+-	if (delete)
+-		val &= ~BIT(port);
+-	else
+-		val |= BIT(port);
+-
+-	/* Update port member. With empty portmap disable trunk */
+-	ret = regmap_update_bits(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL0,
+-				 QCA8K_REG_GOL_TRUNK_MEMBER(id) |
+-				 QCA8K_REG_GOL_TRUNK_EN(id),
+-				 !val << QCA8K_REG_GOL_TRUNK_SHIFT(id) |
+-				 val << QCA8K_REG_GOL_TRUNK_SHIFT(id));
+-
+-	/* Search empty member if adding or port on deleting */
+-	for (i = 0; i < QCA8K_NUM_PORTS_FOR_LAG; i++) {
+-		ret = regmap_read(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL(id), &val);
+-		if (ret)
+-			return ret;
+-
+-		val >>= QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(id, i);
+-		val &= QCA8K_REG_GOL_TRUNK_ID_MEM_ID_MASK;
+-
+-		if (delete) {
+-			/* If port flagged to be disabled assume this member is
+-			 * empty
+-			 */
+-			if (val != QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN_MASK)
+-				continue;
+-
+-			val &= QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT_MASK;
+-			if (val != port)
+-				continue;
+-		} else {
+-			/* If port flagged to be enabled assume this member is
+-			 * already set
+-			 */
+-			if (val == QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN_MASK)
+-				continue;
+-		}
+-
+-		/* We have found the member to add/remove */
+-		break;
+-	}
+-
+-	/* Set port in the correct port mask or disable port if in delete mode */
+-	return regmap_update_bits(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL(id),
+-				  QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN(id, i) |
+-				  QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT(id, i),
+-				  !delete << QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(id, i) |
+-				  port << QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(id, i));
+-}
+-
+-static int
+-qca8k_port_lag_join(struct dsa_switch *ds, int port,
+-		    struct net_device *lag,
+-		    struct netdev_lag_upper_info *info)
+-{
+-	int ret;
+-
+-	if (!qca8k_lag_can_offload(ds, lag, info))
+-		return -EOPNOTSUPP;
+-
+-	ret = qca8k_lag_setup_hash(ds, lag, info);
+-	if (ret)
+-		return ret;
+-
+-	return qca8k_lag_refresh_portmap(ds, port, lag, false);
+-}
+-
+-static int
+-qca8k_port_lag_leave(struct dsa_switch *ds, int port,
+-		     struct net_device *lag)
+-{
+-	return qca8k_lag_refresh_portmap(ds, port, lag, true);
+-}
+-
+-static void
+-qca8k_master_change(struct dsa_switch *ds, const struct net_device *master,
+-		    bool operational)
+-{
+-	struct dsa_port *dp = master->dsa_ptr;
+-	struct qca8k_priv *priv = ds->priv;
+-
+-	/* Ethernet MIB/MDIO is only supported for CPU port 0 */
+-	if (dp->index != 0)
+-		return;
+-
+-	mutex_lock(&priv->mgmt_eth_data.mutex);
+-	mutex_lock(&priv->mib_eth_data.mutex);
+-
+-	priv->mgmt_master = operational ? (struct net_device *)master : NULL;
+-
+-	mutex_unlock(&priv->mib_eth_data.mutex);
+-	mutex_unlock(&priv->mgmt_eth_data.mutex);
+-}
+-
+-static int qca8k_connect_tag_protocol(struct dsa_switch *ds,
+-				      enum dsa_tag_protocol proto)
+-{
+-	struct qca_tagger_data *tagger_data;
+-
+-	switch (proto) {
+-	case DSA_TAG_PROTO_QCA:
+-		tagger_data = ds->tagger_data;
+-
+-		tagger_data->rw_reg_ack_handler = qca8k_rw_reg_ack_handler;
+-		tagger_data->mib_autocast_handler = qca8k_mib_autocast_handler;
+-
+-		break;
+-	default:
+-		return -EOPNOTSUPP;
+-	}
+-
+-	return 0;
+-}
+-
+-static const struct dsa_switch_ops qca8k_switch_ops = {
+-	.get_tag_protocol	= qca8k_get_tag_protocol,
+-	.setup			= qca8k_setup,
+-	.get_strings		= qca8k_get_strings,
+-	.get_ethtool_stats	= qca8k_get_ethtool_stats,
+-	.get_sset_count		= qca8k_get_sset_count,
+-	.set_ageing_time	= qca8k_set_ageing_time,
+-	.get_mac_eee		= qca8k_get_mac_eee,
+-	.set_mac_eee		= qca8k_set_mac_eee,
+-	.port_enable		= qca8k_port_enable,
+-	.port_disable		= qca8k_port_disable,
+-	.port_change_mtu	= qca8k_port_change_mtu,
+-	.port_max_mtu		= qca8k_port_max_mtu,
+-	.port_stp_state_set	= qca8k_port_stp_state_set,
+-	.port_bridge_join	= qca8k_port_bridge_join,
+-	.port_bridge_leave	= qca8k_port_bridge_leave,
+-	.port_fast_age		= qca8k_port_fast_age,
+-	.port_fdb_add		= qca8k_port_fdb_add,
+-	.port_fdb_del		= qca8k_port_fdb_del,
+-	.port_fdb_dump		= qca8k_port_fdb_dump,
+-	.port_mdb_add		= qca8k_port_mdb_add,
+-	.port_mdb_del		= qca8k_port_mdb_del,
+-	.port_mirror_add	= qca8k_port_mirror_add,
+-	.port_mirror_del	= qca8k_port_mirror_del,
+-	.port_vlan_filtering	= qca8k_port_vlan_filtering,
+-	.port_vlan_add		= qca8k_port_vlan_add,
+-	.port_vlan_del		= qca8k_port_vlan_del,
+-	.phylink_validate	= qca8k_phylink_validate,
+-	.phylink_mac_link_state	= qca8k_phylink_mac_link_state,
+-	.phylink_mac_config	= qca8k_phylink_mac_config,
+-	.phylink_mac_link_down	= qca8k_phylink_mac_link_down,
+-	.phylink_mac_link_up	= qca8k_phylink_mac_link_up,
+-	.get_phy_flags		= qca8k_get_phy_flags,
+-	.port_lag_join		= qca8k_port_lag_join,
+-	.port_lag_leave		= qca8k_port_lag_leave,
+-	.master_state_change	= qca8k_master_change,
+-	.connect_tag_protocol	= qca8k_connect_tag_protocol,
+-};
+-
+-static int qca8k_read_switch_id(struct qca8k_priv *priv)
+-{
+-	const struct qca8k_match_data *data;
+-	u32 val;
+-	u8 id;
+-	int ret;
+-
+-	/* get the switches ID from the compatible */
+-	data = of_device_get_match_data(priv->dev);
+-	if (!data)
+-		return -ENODEV;
+-
+-	ret = qca8k_read(priv, QCA8K_REG_MASK_CTRL, &val);
+-	if (ret < 0)
+-		return -ENODEV;
+-
+-	id = QCA8K_MASK_CTRL_DEVICE_ID(val);
+-	if (id != data->id) {
+-		dev_err(priv->dev, "Switch id detected %x but expected %x", id, data->id);
+-		return -ENODEV;
+-	}
+-
+-	priv->switch_id = id;
+-
+-	/* Save revision to communicate to the internal PHY driver */
+-	priv->switch_revision = QCA8K_MASK_CTRL_REV_ID(val);
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_sw_probe(struct mdio_device *mdiodev)
+-{
+-	struct qca8k_priv *priv;
+-	int ret;
+-
+-	/* allocate the private data struct so that we can probe the switches
+-	 * ID register
+-	 */
+-	priv = devm_kzalloc(&mdiodev->dev, sizeof(*priv), GFP_KERNEL);
+-	if (!priv)
+-		return -ENOMEM;
+-
+-	priv->bus = mdiodev->bus;
+-	priv->dev = &mdiodev->dev;
+-
+-	priv->reset_gpio = devm_gpiod_get_optional(priv->dev, "reset",
+-						   GPIOD_ASIS);
+-	if (IS_ERR(priv->reset_gpio))
+-		return PTR_ERR(priv->reset_gpio);
+-
+-	if (priv->reset_gpio) {
+-		gpiod_set_value_cansleep(priv->reset_gpio, 1);
+-		/* The active low duration must be greater than 10 ms
+-		 * and checkpatch.pl wants 20 ms.
+-		 */
+-		msleep(20);
+-		gpiod_set_value_cansleep(priv->reset_gpio, 0);
+-	}
+-
+-	/* Start by setting up the register mapping */
+-	priv->regmap = devm_regmap_init(&mdiodev->dev, NULL, priv,
+-					&qca8k_regmap_config);
+-	if (IS_ERR(priv->regmap)) {
+-		dev_err(priv->dev, "regmap initialization failed");
+-		return PTR_ERR(priv->regmap);
+-	}
+-
+-	priv->mdio_cache.page = 0xffff;
+-	priv->mdio_cache.lo = 0xffff;
+-	priv->mdio_cache.hi = 0xffff;
+-
+-	/* Check the detected switch id */
+-	ret = qca8k_read_switch_id(priv);
+-	if (ret)
+-		return ret;
+-
+-	priv->ds = devm_kzalloc(&mdiodev->dev, sizeof(*priv->ds), GFP_KERNEL);
+-	if (!priv->ds)
+-		return -ENOMEM;
+-
+-	mutex_init(&priv->mgmt_eth_data.mutex);
+-	init_completion(&priv->mgmt_eth_data.rw_done);
+-
+-	mutex_init(&priv->mib_eth_data.mutex);
+-	init_completion(&priv->mib_eth_data.rw_done);
+-
+-	priv->ds->dev = &mdiodev->dev;
+-	priv->ds->num_ports = QCA8K_NUM_PORTS;
+-	priv->ds->priv = priv;
+-	priv->ds->ops = &qca8k_switch_ops;
+-	mutex_init(&priv->reg_mutex);
+-	dev_set_drvdata(&mdiodev->dev, priv);
+-
+-	return dsa_register_switch(priv->ds);
+-}
+-
+-static void
+-qca8k_sw_remove(struct mdio_device *mdiodev)
+-{
+-	struct qca8k_priv *priv = dev_get_drvdata(&mdiodev->dev);
+-	int i;
+-
+-	if (!priv)
+-		return;
+-
+-	for (i = 0; i < QCA8K_NUM_PORTS; i++)
+-		qca8k_port_set_status(priv, i, 0);
+-
+-	dsa_unregister_switch(priv->ds);
+-
+-	dev_set_drvdata(&mdiodev->dev, NULL);
+-}
+-
+-static void qca8k_sw_shutdown(struct mdio_device *mdiodev)
+-{
+-	struct qca8k_priv *priv = dev_get_drvdata(&mdiodev->dev);
+-
+-	if (!priv)
+-		return;
+-
+-	dsa_switch_shutdown(priv->ds);
+-
+-	dev_set_drvdata(&mdiodev->dev, NULL);
+-}
+-
+-#ifdef CONFIG_PM_SLEEP
+-static void
+-qca8k_set_pm(struct qca8k_priv *priv, int enable)
+-{
+-	int port;
+-
+-	for (port = 0; port < QCA8K_NUM_PORTS; port++) {
+-		/* Do not enable on resume if the port was
+-		 * disabled before.
+-		 */
+-		if (!(priv->port_enabled_map & BIT(port)))
+-			continue;
+-
+-		qca8k_port_set_status(priv, port, enable);
+-	}
+-}
+-
+-static int qca8k_suspend(struct device *dev)
+-{
+-	struct qca8k_priv *priv = dev_get_drvdata(dev);
+-
+-	qca8k_set_pm(priv, 0);
+-
+-	return dsa_switch_suspend(priv->ds);
+-}
+-
+-static int qca8k_resume(struct device *dev)
+-{
+-	struct qca8k_priv *priv = dev_get_drvdata(dev);
+-
+-	qca8k_set_pm(priv, 1);
+-
+-	return dsa_switch_resume(priv->ds);
+-}
+-#endif /* CONFIG_PM_SLEEP */
+-
+-static SIMPLE_DEV_PM_OPS(qca8k_pm_ops,
+-			 qca8k_suspend, qca8k_resume);
+-
+-static const struct qca8k_match_data qca8327 = {
+-	.id = QCA8K_ID_QCA8327,
+-	.reduced_package = true,
+-	.mib_count = QCA8K_QCA832X_MIB_COUNT,
+-};
+-
+-static const struct qca8k_match_data qca8328 = {
+-	.id = QCA8K_ID_QCA8327,
+-	.mib_count = QCA8K_QCA832X_MIB_COUNT,
+-};
+-
+-static const struct qca8k_match_data qca833x = {
+-	.id = QCA8K_ID_QCA8337,
+-	.mib_count = QCA8K_QCA833X_MIB_COUNT,
+-};
+-
+-static const struct of_device_id qca8k_of_match[] = {
+-	{ .compatible = "qca,qca8327", .data = &qca8327 },
+-	{ .compatible = "qca,qca8328", .data = &qca8328 },
+-	{ .compatible = "qca,qca8334", .data = &qca833x },
+-	{ .compatible = "qca,qca8337", .data = &qca833x },
+-	{ /* sentinel */ },
+-};
+-
+-static struct mdio_driver qca8kmdio_driver = {
+-	.probe  = qca8k_sw_probe,
+-	.remove = qca8k_sw_remove,
+-	.shutdown = qca8k_sw_shutdown,
+-	.mdiodrv.driver = {
+-		.name = "qca8k",
+-		.of_match_table = qca8k_of_match,
+-		.pm = &qca8k_pm_ops,
+-	},
+-};
+-
+-mdio_module_driver(qca8kmdio_driver);
+-
+-MODULE_AUTHOR("Mathieu Olivari, John Crispin <john@phrozen.org>");
+-MODULE_DESCRIPTION("Driver for QCA8K ethernet switch family");
+-MODULE_LICENSE("GPL v2");
+-MODULE_ALIAS("platform:qca8k");
+--- a/drivers/net/dsa/qca8k.h
++++ /dev/null
+@@ -1,411 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0-only */
+-/*
+- * Copyright (C) 2009 Felix Fietkau <nbd@nbd.name>
+- * Copyright (C) 2011-2012 Gabor Juhos <juhosg@openwrt.org>
+- * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+- */
+-
+-#ifndef __QCA8K_H
+-#define __QCA8K_H
+-
+-#include <linux/delay.h>
+-#include <linux/regmap.h>
+-#include <linux/gpio.h>
+-#include <linux/dsa/tag_qca.h>
+-
+-#define QCA8K_ETHERNET_MDIO_PRIORITY			7
+-#define QCA8K_ETHERNET_PHY_PRIORITY			6
+-#define QCA8K_ETHERNET_TIMEOUT				100
+-
+-#define QCA8K_NUM_PORTS					7
+-#define QCA8K_NUM_CPU_PORTS				2
+-#define QCA8K_MAX_MTU					9000
+-#define QCA8K_NUM_LAGS					4
+-#define QCA8K_NUM_PORTS_FOR_LAG				4
+-
+-#define PHY_ID_QCA8327					0x004dd034
+-#define QCA8K_ID_QCA8327				0x12
+-#define PHY_ID_QCA8337					0x004dd036
+-#define QCA8K_ID_QCA8337				0x13
+-
+-#define QCA8K_QCA832X_MIB_COUNT				39
+-#define QCA8K_QCA833X_MIB_COUNT				41
+-
+-#define QCA8K_BUSY_WAIT_TIMEOUT				2000
+-
+-#define QCA8K_NUM_FDB_RECORDS				2048
+-
+-#define QCA8K_PORT_VID_DEF				1
+-
+-/* Global control registers */
+-#define QCA8K_REG_MASK_CTRL				0x000
+-#define   QCA8K_MASK_CTRL_REV_ID_MASK			GENMASK(7, 0)
+-#define   QCA8K_MASK_CTRL_REV_ID(x)			FIELD_GET(QCA8K_MASK_CTRL_REV_ID_MASK, x)
+-#define   QCA8K_MASK_CTRL_DEVICE_ID_MASK		GENMASK(15, 8)
+-#define   QCA8K_MASK_CTRL_DEVICE_ID(x)			FIELD_GET(QCA8K_MASK_CTRL_DEVICE_ID_MASK, x)
+-#define QCA8K_REG_PORT0_PAD_CTRL			0x004
+-#define   QCA8K_PORT0_PAD_MAC06_EXCHANGE_EN		BIT(31)
+-#define   QCA8K_PORT0_PAD_SGMII_RXCLK_FALLING_EDGE	BIT(19)
+-#define   QCA8K_PORT0_PAD_SGMII_TXCLK_FALLING_EDGE	BIT(18)
+-#define QCA8K_REG_PORT5_PAD_CTRL			0x008
+-#define QCA8K_REG_PORT6_PAD_CTRL			0x00c
+-#define   QCA8K_PORT_PAD_RGMII_EN			BIT(26)
+-#define   QCA8K_PORT_PAD_RGMII_TX_DELAY_MASK		GENMASK(23, 22)
+-#define   QCA8K_PORT_PAD_RGMII_TX_DELAY(x)		FIELD_PREP(QCA8K_PORT_PAD_RGMII_TX_DELAY_MASK, x)
+-#define   QCA8K_PORT_PAD_RGMII_RX_DELAY_MASK		GENMASK(21, 20)
+-#define   QCA8K_PORT_PAD_RGMII_RX_DELAY(x)		FIELD_PREP(QCA8K_PORT_PAD_RGMII_RX_DELAY_MASK, x)
+-#define	  QCA8K_PORT_PAD_RGMII_TX_DELAY_EN		BIT(25)
+-#define   QCA8K_PORT_PAD_RGMII_RX_DELAY_EN		BIT(24)
+-#define   QCA8K_PORT_PAD_SGMII_EN			BIT(7)
+-#define QCA8K_REG_PWS					0x010
+-#define   QCA8K_PWS_POWER_ON_SEL			BIT(31)
+-/* This reg is only valid for QCA832x and toggle the package
+- * type from 176 pin (by default) to 148 pin used on QCA8327
+- */
+-#define   QCA8327_PWS_PACKAGE148_EN			BIT(30)
+-#define   QCA8K_PWS_LED_OPEN_EN_CSR			BIT(24)
+-#define   QCA8K_PWS_SERDES_AEN_DIS			BIT(7)
+-#define QCA8K_REG_MODULE_EN				0x030
+-#define   QCA8K_MODULE_EN_MIB				BIT(0)
+-#define QCA8K_REG_MIB					0x034
+-#define   QCA8K_MIB_FUNC				GENMASK(26, 24)
+-#define   QCA8K_MIB_CPU_KEEP				BIT(20)
+-#define   QCA8K_MIB_BUSY				BIT(17)
+-#define QCA8K_MDIO_MASTER_CTRL				0x3c
+-#define   QCA8K_MDIO_MASTER_BUSY			BIT(31)
+-#define   QCA8K_MDIO_MASTER_EN				BIT(30)
+-#define   QCA8K_MDIO_MASTER_READ			BIT(27)
+-#define   QCA8K_MDIO_MASTER_WRITE			0
+-#define   QCA8K_MDIO_MASTER_SUP_PRE			BIT(26)
+-#define   QCA8K_MDIO_MASTER_PHY_ADDR_MASK		GENMASK(25, 21)
+-#define   QCA8K_MDIO_MASTER_PHY_ADDR(x)			FIELD_PREP(QCA8K_MDIO_MASTER_PHY_ADDR_MASK, x)
+-#define   QCA8K_MDIO_MASTER_REG_ADDR_MASK		GENMASK(20, 16)
+-#define   QCA8K_MDIO_MASTER_REG_ADDR(x)			FIELD_PREP(QCA8K_MDIO_MASTER_REG_ADDR_MASK, x)
+-#define   QCA8K_MDIO_MASTER_DATA_MASK			GENMASK(15, 0)
+-#define   QCA8K_MDIO_MASTER_DATA(x)			FIELD_PREP(QCA8K_MDIO_MASTER_DATA_MASK, x)
+-#define   QCA8K_MDIO_MASTER_MAX_PORTS			5
+-#define   QCA8K_MDIO_MASTER_MAX_REG			32
+-#define QCA8K_GOL_MAC_ADDR0				0x60
+-#define QCA8K_GOL_MAC_ADDR1				0x64
+-#define QCA8K_MAX_FRAME_SIZE				0x78
+-#define QCA8K_REG_PORT_STATUS(_i)			(0x07c + (_i) * 4)
+-#define   QCA8K_PORT_STATUS_SPEED			GENMASK(1, 0)
+-#define   QCA8K_PORT_STATUS_SPEED_10			0
+-#define   QCA8K_PORT_STATUS_SPEED_100			0x1
+-#define   QCA8K_PORT_STATUS_SPEED_1000			0x2
+-#define   QCA8K_PORT_STATUS_TXMAC			BIT(2)
+-#define   QCA8K_PORT_STATUS_RXMAC			BIT(3)
+-#define   QCA8K_PORT_STATUS_TXFLOW			BIT(4)
+-#define   QCA8K_PORT_STATUS_RXFLOW			BIT(5)
+-#define   QCA8K_PORT_STATUS_DUPLEX			BIT(6)
+-#define   QCA8K_PORT_STATUS_LINK_UP			BIT(8)
+-#define   QCA8K_PORT_STATUS_LINK_AUTO			BIT(9)
+-#define   QCA8K_PORT_STATUS_LINK_PAUSE			BIT(10)
+-#define   QCA8K_PORT_STATUS_FLOW_AUTO			BIT(12)
+-#define QCA8K_REG_PORT_HDR_CTRL(_i)			(0x9c + (_i * 4))
+-#define   QCA8K_PORT_HDR_CTRL_RX_MASK			GENMASK(3, 2)
+-#define   QCA8K_PORT_HDR_CTRL_TX_MASK			GENMASK(1, 0)
+-#define   QCA8K_PORT_HDR_CTRL_ALL			2
+-#define   QCA8K_PORT_HDR_CTRL_MGMT			1
+-#define   QCA8K_PORT_HDR_CTRL_NONE			0
+-#define QCA8K_REG_SGMII_CTRL				0x0e0
+-#define   QCA8K_SGMII_EN_PLL				BIT(1)
+-#define   QCA8K_SGMII_EN_RX				BIT(2)
+-#define   QCA8K_SGMII_EN_TX				BIT(3)
+-#define   QCA8K_SGMII_EN_SD				BIT(4)
+-#define   QCA8K_SGMII_CLK125M_DELAY			BIT(7)
+-#define   QCA8K_SGMII_MODE_CTRL_MASK			GENMASK(23, 22)
+-#define   QCA8K_SGMII_MODE_CTRL(x)			FIELD_PREP(QCA8K_SGMII_MODE_CTRL_MASK, x)
+-#define   QCA8K_SGMII_MODE_CTRL_BASEX			QCA8K_SGMII_MODE_CTRL(0x0)
+-#define   QCA8K_SGMII_MODE_CTRL_PHY			QCA8K_SGMII_MODE_CTRL(0x1)
+-#define   QCA8K_SGMII_MODE_CTRL_MAC			QCA8K_SGMII_MODE_CTRL(0x2)
+-
+-/* MAC_PWR_SEL registers */
+-#define QCA8K_REG_MAC_PWR_SEL				0x0e4
+-#define   QCA8K_MAC_PWR_RGMII1_1_8V			BIT(18)
+-#define   QCA8K_MAC_PWR_RGMII0_1_8V			BIT(19)
+-
+-/* EEE control registers */
+-#define QCA8K_REG_EEE_CTRL				0x100
+-#define  QCA8K_REG_EEE_CTRL_LPI_EN(_i)			((_i + 1) * 2)
+-
+-/* TRUNK_HASH_EN registers */
+-#define QCA8K_TRUNK_HASH_EN_CTRL			0x270
+-#define   QCA8K_TRUNK_HASH_SIP_EN			BIT(3)
+-#define   QCA8K_TRUNK_HASH_DIP_EN			BIT(2)
+-#define   QCA8K_TRUNK_HASH_SA_EN			BIT(1)
+-#define   QCA8K_TRUNK_HASH_DA_EN			BIT(0)
+-#define   QCA8K_TRUNK_HASH_MASK				GENMASK(3, 0)
+-
+-/* ACL registers */
+-#define QCA8K_REG_PORT_VLAN_CTRL0(_i)			(0x420 + (_i * 8))
+-#define   QCA8K_PORT_VLAN_CVID_MASK			GENMASK(27, 16)
+-#define   QCA8K_PORT_VLAN_CVID(x)			FIELD_PREP(QCA8K_PORT_VLAN_CVID_MASK, x)
+-#define   QCA8K_PORT_VLAN_SVID_MASK			GENMASK(11, 0)
+-#define   QCA8K_PORT_VLAN_SVID(x)			FIELD_PREP(QCA8K_PORT_VLAN_SVID_MASK, x)
+-#define QCA8K_REG_PORT_VLAN_CTRL1(_i)			(0x424 + (_i * 8))
+-#define QCA8K_REG_IPV4_PRI_BASE_ADDR			0x470
+-#define QCA8K_REG_IPV4_PRI_ADDR_MASK			0x474
+-
+-/* Lookup registers */
+-#define QCA8K_REG_ATU_DATA0				0x600
+-#define   QCA8K_ATU_ADDR2_MASK				GENMASK(31, 24)
+-#define   QCA8K_ATU_ADDR3_MASK				GENMASK(23, 16)
+-#define   QCA8K_ATU_ADDR4_MASK				GENMASK(15, 8)
+-#define   QCA8K_ATU_ADDR5_MASK				GENMASK(7, 0)
+-#define QCA8K_REG_ATU_DATA1				0x604
+-#define   QCA8K_ATU_PORT_MASK				GENMASK(22, 16)
+-#define   QCA8K_ATU_ADDR0_MASK				GENMASK(15, 8)
+-#define   QCA8K_ATU_ADDR1_MASK				GENMASK(7, 0)
+-#define QCA8K_REG_ATU_DATA2				0x608
+-#define   QCA8K_ATU_VID_MASK				GENMASK(19, 8)
+-#define   QCA8K_ATU_STATUS_MASK				GENMASK(3, 0)
+-#define   QCA8K_ATU_STATUS_STATIC			0xf
+-#define QCA8K_REG_ATU_FUNC				0x60c
+-#define   QCA8K_ATU_FUNC_BUSY				BIT(31)
+-#define   QCA8K_ATU_FUNC_PORT_EN			BIT(14)
+-#define   QCA8K_ATU_FUNC_MULTI_EN			BIT(13)
+-#define   QCA8K_ATU_FUNC_FULL				BIT(12)
+-#define   QCA8K_ATU_FUNC_PORT_MASK			GENMASK(11, 8)
+-#define QCA8K_REG_VTU_FUNC0				0x610
+-#define   QCA8K_VTU_FUNC0_VALID				BIT(20)
+-#define   QCA8K_VTU_FUNC0_IVL_EN			BIT(19)
+-/*        QCA8K_VTU_FUNC0_EG_MODE_MASK			GENMASK(17, 4)
+- *          It does contain VLAN_MODE for each port [5:4] for port0,
+- *          [7:6] for port1 ... [17:16] for port6. Use virtual port
+- *          define to handle this.
+- */
+-#define   QCA8K_VTU_FUNC0_EG_MODE_PORT_SHIFT(_i)	(4 + (_i) * 2)
+-#define   QCA8K_VTU_FUNC0_EG_MODE_MASK			GENMASK(1, 0)
+-#define   QCA8K_VTU_FUNC0_EG_MODE_PORT_MASK(_i)		(GENMASK(1, 0) << QCA8K_VTU_FUNC0_EG_MODE_PORT_SHIFT(_i))
+-#define   QCA8K_VTU_FUNC0_EG_MODE_UNMOD			FIELD_PREP(QCA8K_VTU_FUNC0_EG_MODE_MASK, 0x0)
+-#define   QCA8K_VTU_FUNC0_EG_MODE_PORT_UNMOD(_i)	(QCA8K_VTU_FUNC0_EG_MODE_UNMOD << QCA8K_VTU_FUNC0_EG_MODE_PORT_SHIFT(_i))
+-#define   QCA8K_VTU_FUNC0_EG_MODE_UNTAG			FIELD_PREP(QCA8K_VTU_FUNC0_EG_MODE_MASK, 0x1)
+-#define   QCA8K_VTU_FUNC0_EG_MODE_PORT_UNTAG(_i)	(QCA8K_VTU_FUNC0_EG_MODE_UNTAG << QCA8K_VTU_FUNC0_EG_MODE_PORT_SHIFT(_i))
+-#define   QCA8K_VTU_FUNC0_EG_MODE_TAG			FIELD_PREP(QCA8K_VTU_FUNC0_EG_MODE_MASK, 0x2)
+-#define   QCA8K_VTU_FUNC0_EG_MODE_PORT_TAG(_i)		(QCA8K_VTU_FUNC0_EG_MODE_TAG << QCA8K_VTU_FUNC0_EG_MODE_PORT_SHIFT(_i))
+-#define   QCA8K_VTU_FUNC0_EG_MODE_NOT			FIELD_PREP(QCA8K_VTU_FUNC0_EG_MODE_MASK, 0x3)
+-#define   QCA8K_VTU_FUNC0_EG_MODE_PORT_NOT(_i)		(QCA8K_VTU_FUNC0_EG_MODE_NOT << QCA8K_VTU_FUNC0_EG_MODE_PORT_SHIFT(_i))
+-#define QCA8K_REG_VTU_FUNC1				0x614
+-#define   QCA8K_VTU_FUNC1_BUSY				BIT(31)
+-#define   QCA8K_VTU_FUNC1_VID_MASK			GENMASK(27, 16)
+-#define   QCA8K_VTU_FUNC1_FULL				BIT(4)
+-#define QCA8K_REG_ATU_CTRL				0x618
+-#define   QCA8K_ATU_AGE_TIME_MASK			GENMASK(15, 0)
+-#define   QCA8K_ATU_AGE_TIME(x)				FIELD_PREP(QCA8K_ATU_AGE_TIME_MASK, (x))
+-#define QCA8K_REG_GLOBAL_FW_CTRL0			0x620
+-#define   QCA8K_GLOBAL_FW_CTRL0_CPU_PORT_EN		BIT(10)
+-#define   QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM		GENMASK(7, 4)
+-#define QCA8K_REG_GLOBAL_FW_CTRL1			0x624
+-#define   QCA8K_GLOBAL_FW_CTRL1_IGMP_DP_MASK		GENMASK(30, 24)
+-#define   QCA8K_GLOBAL_FW_CTRL1_BC_DP_MASK		GENMASK(22, 16)
+-#define   QCA8K_GLOBAL_FW_CTRL1_MC_DP_MASK		GENMASK(14, 8)
+-#define   QCA8K_GLOBAL_FW_CTRL1_UC_DP_MASK		GENMASK(6, 0)
+-#define QCA8K_PORT_LOOKUP_CTRL(_i)			(0x660 + (_i) * 0xc)
+-#define   QCA8K_PORT_LOOKUP_MEMBER			GENMASK(6, 0)
+-#define   QCA8K_PORT_LOOKUP_VLAN_MODE_MASK		GENMASK(9, 8)
+-#define   QCA8K_PORT_LOOKUP_VLAN_MODE(x)		FIELD_PREP(QCA8K_PORT_LOOKUP_VLAN_MODE_MASK, x)
+-#define   QCA8K_PORT_LOOKUP_VLAN_MODE_NONE		QCA8K_PORT_LOOKUP_VLAN_MODE(0x0)
+-#define   QCA8K_PORT_LOOKUP_VLAN_MODE_FALLBACK		QCA8K_PORT_LOOKUP_VLAN_MODE(0x1)
+-#define   QCA8K_PORT_LOOKUP_VLAN_MODE_CHECK		QCA8K_PORT_LOOKUP_VLAN_MODE(0x2)
+-#define   QCA8K_PORT_LOOKUP_VLAN_MODE_SECURE		QCA8K_PORT_LOOKUP_VLAN_MODE(0x3)
+-#define   QCA8K_PORT_LOOKUP_STATE_MASK			GENMASK(18, 16)
+-#define   QCA8K_PORT_LOOKUP_STATE(x)			FIELD_PREP(QCA8K_PORT_LOOKUP_STATE_MASK, x)
+-#define   QCA8K_PORT_LOOKUP_STATE_DISABLED		QCA8K_PORT_LOOKUP_STATE(0x0)
+-#define   QCA8K_PORT_LOOKUP_STATE_BLOCKING		QCA8K_PORT_LOOKUP_STATE(0x1)
+-#define   QCA8K_PORT_LOOKUP_STATE_LISTENING		QCA8K_PORT_LOOKUP_STATE(0x2)
+-#define   QCA8K_PORT_LOOKUP_STATE_LEARNING		QCA8K_PORT_LOOKUP_STATE(0x3)
+-#define   QCA8K_PORT_LOOKUP_STATE_FORWARD		QCA8K_PORT_LOOKUP_STATE(0x4)
+-#define   QCA8K_PORT_LOOKUP_LEARN			BIT(20)
+-#define   QCA8K_PORT_LOOKUP_ING_MIRROR_EN		BIT(25)
+-
+-#define QCA8K_REG_GOL_TRUNK_CTRL0			0x700
+-/* 4 max trunk first
+- * first 6 bit for member bitmap
+- * 7th bit is to enable trunk port
+- */
+-#define QCA8K_REG_GOL_TRUNK_SHIFT(_i)			((_i) * 8)
+-#define QCA8K_REG_GOL_TRUNK_EN_MASK			BIT(7)
+-#define QCA8K_REG_GOL_TRUNK_EN(_i)			(QCA8K_REG_GOL_TRUNK_EN_MASK << QCA8K_REG_GOL_TRUNK_SHIFT(_i))
+-#define QCA8K_REG_GOL_TRUNK_MEMBER_MASK			GENMASK(6, 0)
+-#define QCA8K_REG_GOL_TRUNK_MEMBER(_i)			(QCA8K_REG_GOL_TRUNK_MEMBER_MASK << QCA8K_REG_GOL_TRUNK_SHIFT(_i))
+-/* 0x704 for TRUNK 0-1 --- 0x708 for TRUNK 2-3 */
+-#define QCA8K_REG_GOL_TRUNK_CTRL(_i)			(0x704 + (((_i) / 2) * 4))
+-#define QCA8K_REG_GOL_TRUNK_ID_MEM_ID_MASK		GENMASK(3, 0)
+-#define QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN_MASK		BIT(3)
+-#define QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT_MASK		GENMASK(2, 0)
+-#define QCA8K_REG_GOL_TRUNK_ID_SHIFT(_i)		(((_i) / 2) * 16)
+-#define QCA8K_REG_GOL_MEM_ID_SHIFT(_i)			((_i) * 4)
+-/* Complex shift: FIRST shift for port THEN shift for trunk */
+-#define QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(_i, _j)	(QCA8K_REG_GOL_MEM_ID_SHIFT(_j) + QCA8K_REG_GOL_TRUNK_ID_SHIFT(_i))
+-#define QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN(_i, _j)	(QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN_MASK << QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(_i, _j))
+-#define QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT(_i, _j)	(QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT_MASK << QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(_i, _j))
+-
+-#define QCA8K_REG_GLOBAL_FC_THRESH			0x800
+-#define   QCA8K_GLOBAL_FC_GOL_XON_THRES_MASK		GENMASK(24, 16)
+-#define   QCA8K_GLOBAL_FC_GOL_XON_THRES(x)		FIELD_PREP(QCA8K_GLOBAL_FC_GOL_XON_THRES_MASK, x)
+-#define   QCA8K_GLOBAL_FC_GOL_XOFF_THRES_MASK		GENMASK(8, 0)
+-#define   QCA8K_GLOBAL_FC_GOL_XOFF_THRES(x)		FIELD_PREP(QCA8K_GLOBAL_FC_GOL_XOFF_THRES_MASK, x)
+-
+-#define QCA8K_REG_PORT_HOL_CTRL0(_i)			(0x970 + (_i) * 0x8)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI0_BUF_MASK		GENMASK(3, 0)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI0(x)		FIELD_PREP(QCA8K_PORT_HOL_CTRL0_EG_PRI0_BUF_MASK, x)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI1_BUF_MASK		GENMASK(7, 4)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI1(x)		FIELD_PREP(QCA8K_PORT_HOL_CTRL0_EG_PRI1_BUF_MASK, x)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI2_BUF_MASK		GENMASK(11, 8)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI2(x)		FIELD_PREP(QCA8K_PORT_HOL_CTRL0_EG_PRI2_BUF_MASK, x)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI3_BUF_MASK		GENMASK(15, 12)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI3(x)		FIELD_PREP(QCA8K_PORT_HOL_CTRL0_EG_PRI3_BUF_MASK, x)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI4_BUF_MASK		GENMASK(19, 16)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI4(x)		FIELD_PREP(QCA8K_PORT_HOL_CTRL0_EG_PRI4_BUF_MASK, x)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI5_BUF_MASK		GENMASK(23, 20)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PRI5(x)		FIELD_PREP(QCA8K_PORT_HOL_CTRL0_EG_PRI5_BUF_MASK, x)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PORT_BUF_MASK		GENMASK(29, 24)
+-#define   QCA8K_PORT_HOL_CTRL0_EG_PORT(x)		FIELD_PREP(QCA8K_PORT_HOL_CTRL0_EG_PORT_BUF_MASK, x)
+-
+-#define QCA8K_REG_PORT_HOL_CTRL1(_i)			(0x974 + (_i) * 0x8)
+-#define   QCA8K_PORT_HOL_CTRL1_ING_BUF_MASK		GENMASK(3, 0)
+-#define   QCA8K_PORT_HOL_CTRL1_ING(x)			FIELD_PREP(QCA8K_PORT_HOL_CTRL1_ING_BUF_MASK, x)
+-#define   QCA8K_PORT_HOL_CTRL1_EG_PRI_BUF_EN		BIT(6)
+-#define   QCA8K_PORT_HOL_CTRL1_EG_PORT_BUF_EN		BIT(7)
+-#define   QCA8K_PORT_HOL_CTRL1_WRED_EN			BIT(8)
+-#define   QCA8K_PORT_HOL_CTRL1_EG_MIRROR_EN		BIT(16)
+-
+-/* Pkt edit registers */
+-#define QCA8K_EGREES_VLAN_PORT_SHIFT(_i)		(16 * ((_i) % 2))
+-#define QCA8K_EGREES_VLAN_PORT_MASK(_i)			(GENMASK(11, 0) << QCA8K_EGREES_VLAN_PORT_SHIFT(_i))
+-#define QCA8K_EGREES_VLAN_PORT(_i, x)			((x) << QCA8K_EGREES_VLAN_PORT_SHIFT(_i))
+-#define QCA8K_EGRESS_VLAN(x)				(0x0c70 + (4 * (x / 2)))
+-
+-/* L3 registers */
+-#define QCA8K_HROUTER_CONTROL				0xe00
+-#define   QCA8K_HROUTER_CONTROL_GLB_LOCKTIME_M		GENMASK(17, 16)
+-#define   QCA8K_HROUTER_CONTROL_GLB_LOCKTIME_S		16
+-#define   QCA8K_HROUTER_CONTROL_ARP_AGE_MODE		1
+-#define QCA8K_HROUTER_PBASED_CONTROL1			0xe08
+-#define QCA8K_HROUTER_PBASED_CONTROL2			0xe0c
+-#define QCA8K_HNAT_CONTROL				0xe38
+-
+-/* MIB registers */
+-#define QCA8K_PORT_MIB_COUNTER(_i)			(0x1000 + (_i) * 0x100)
+-
+-/* QCA specific MII registers */
+-#define MII_ATH_MMD_ADDR				0x0d
+-#define MII_ATH_MMD_DATA				0x0e
+-
+-enum {
+-	QCA8K_PORT_SPEED_10M = 0,
+-	QCA8K_PORT_SPEED_100M = 1,
+-	QCA8K_PORT_SPEED_1000M = 2,
+-	QCA8K_PORT_SPEED_ERR = 3,
+-};
+-
+-enum qca8k_fdb_cmd {
+-	QCA8K_FDB_FLUSH	= 1,
+-	QCA8K_FDB_LOAD = 2,
+-	QCA8K_FDB_PURGE = 3,
+-	QCA8K_FDB_FLUSH_PORT = 5,
+-	QCA8K_FDB_NEXT = 6,
+-	QCA8K_FDB_SEARCH = 7,
+-};
+-
+-enum qca8k_vlan_cmd {
+-	QCA8K_VLAN_FLUSH = 1,
+-	QCA8K_VLAN_LOAD = 2,
+-	QCA8K_VLAN_PURGE = 3,
+-	QCA8K_VLAN_REMOVE_PORT = 4,
+-	QCA8K_VLAN_NEXT = 5,
+-	QCA8K_VLAN_READ = 6,
+-};
+-
+-enum qca8k_mid_cmd {
+-	QCA8K_MIB_FLUSH = 1,
+-	QCA8K_MIB_FLUSH_PORT = 2,
+-	QCA8K_MIB_CAST = 3,
+-};
+-
+-struct qca8k_match_data {
+-	u8 id;
+-	bool reduced_package;
+-	u8 mib_count;
+-};
+-
+-enum {
+-	QCA8K_CPU_PORT0,
+-	QCA8K_CPU_PORT6,
+-};
+-
+-struct qca8k_mgmt_eth_data {
+-	struct completion rw_done;
+-	struct mutex mutex; /* Enforce one mdio read/write at time */
+-	bool ack;
+-	u32 seq;
+-	u32 data[4];
+-};
+-
+-struct qca8k_mib_eth_data {
+-	struct completion rw_done;
+-	struct mutex mutex; /* Process one command at time */
+-	refcount_t port_parsed; /* Counter to track parsed port */
+-	u8 req_port;
+-	u64 *data; /* pointer to ethtool data */
+-};
+-
+-struct qca8k_ports_config {
+-	bool sgmii_rx_clk_falling_edge;
+-	bool sgmii_tx_clk_falling_edge;
+-	bool sgmii_enable_pll;
+-	u8 rgmii_rx_delay[QCA8K_NUM_CPU_PORTS]; /* 0: CPU port0, 1: CPU port6 */
+-	u8 rgmii_tx_delay[QCA8K_NUM_CPU_PORTS]; /* 0: CPU port0, 1: CPU port6 */
+-};
+-
+-struct qca8k_mdio_cache {
+-/* The 32bit switch registers are accessed indirectly. To achieve this we need
+- * to set the page of the register. Track the last page that was set to reduce
+- * mdio writes
+- */
+-	u16 page;
+-/* lo and hi can also be cached and from Documentation we can skip one
+- * extra mdio write if lo or hi is didn't change.
+- */
+-	u16 lo;
+-	u16 hi;
+-};
+-
+-struct qca8k_priv {
+-	u8 switch_id;
+-	u8 switch_revision;
+-	u8 mirror_rx;
+-	u8 mirror_tx;
+-	u8 lag_hash_mode;
+-	/* Each bit correspond to a port. This switch can support a max of 7 port.
+-	 * Bit 1: port enabled. Bit 0: port disabled.
+-	 */
+-	u8 port_enabled_map;
+-	struct qca8k_ports_config ports_config;
+-	struct regmap *regmap;
+-	struct mii_bus *bus;
+-	struct dsa_switch *ds;
+-	struct mutex reg_mutex;
+-	struct device *dev;
+-	struct gpio_desc *reset_gpio;
+-	struct net_device *mgmt_master; /* Track if mdio/mib Ethernet is available */
+-	struct qca8k_mgmt_eth_data mgmt_eth_data;
+-	struct qca8k_mib_eth_data mib_eth_data;
+-	struct qca8k_mdio_cache mdio_cache;
+-};
+-
+-struct qca8k_mib_desc {
+-	unsigned int size;
+-	unsigned int offset;
+-	const char *name;
+-};
+-
+-struct qca8k_fdb {
+-	u16 vid;
+-	u8 port_mask;
+-	u8 aging;
+-	u8 mac[6];
+-};
+-
+-#endif /* __QCA8K_H */
diff --git a/target/linux/generic/backport-5.15/771-v6.0-01-net-dsa-qca8k-cache-match-data-to-speed-up-access.patch b/target/linux/generic/backport-5.15/771-v6.0-01-net-dsa-qca8k-cache-match-data-to-speed-up-access.patch
new file mode 100644
index 00000000000000..77fe64632f4019
--- /dev/null
+++ b/target/linux/generic/backport-5.15/771-v6.0-01-net-dsa-qca8k-cache-match-data-to-speed-up-access.patch
@@ -0,0 +1,157 @@
+From 3bb0844e7bcd0fb0bcfab6202b5edd349ef5250a Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 27 Jul 2022 13:35:10 +0200
+Subject: [PATCH 01/14] net: dsa: qca8k: cache match data to speed up access
+
+Using of_device_get_match_data is expensive. Cache match data to speed
+up access and rework user of match data to use the new cached value.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/qca/qca8k.c | 35 +++++++++++------------------------
+ drivers/net/dsa/qca/qca8k.h |  1 +
+ 2 files changed, 12 insertions(+), 24 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k.c
++++ b/drivers/net/dsa/qca/qca8k.c
+@@ -1462,8 +1462,8 @@ static int qca8k_find_cpu_port(struct ds
+ static int
+ qca8k_setup_of_pws_reg(struct qca8k_priv *priv)
+ {
++	const struct qca8k_match_data *data = priv->info;
+ 	struct device_node *node = priv->dev->of_node;
+-	const struct qca8k_match_data *data;
+ 	u32 val = 0;
+ 	int ret;
+ 
+@@ -1472,8 +1472,6 @@ qca8k_setup_of_pws_reg(struct qca8k_priv
+ 	 * Should be applied by default but we set this just to make sure.
+ 	 */
+ 	if (priv->switch_id == QCA8K_ID_QCA8327) {
+-		data = of_device_get_match_data(priv->dev);
+-
+ 		/* Set the correct package of 148 pin for QCA8327 */
+ 		if (data->reduced_package)
+ 			val |= QCA8327_PWS_PACKAGE148_EN;
+@@ -2146,23 +2144,19 @@ qca8k_phylink_mac_link_up(struct dsa_swi
+ static void
+ qca8k_get_strings(struct dsa_switch *ds, int port, u32 stringset, uint8_t *data)
+ {
+-	const struct qca8k_match_data *match_data;
+ 	struct qca8k_priv *priv = ds->priv;
+ 	int i;
+ 
+ 	if (stringset != ETH_SS_STATS)
+ 		return;
+ 
+-	match_data = of_device_get_match_data(priv->dev);
+-
+-	for (i = 0; i < match_data->mib_count; i++)
++	for (i = 0; i < priv->info->mib_count; i++)
+ 		strncpy(data + i * ETH_GSTRING_LEN, ar8327_mib[i].name,
+ 			ETH_GSTRING_LEN);
+ }
+ 
+ static void qca8k_mib_autocast_handler(struct dsa_switch *ds, struct sk_buff *skb)
+ {
+-	const struct qca8k_match_data *match_data;
+ 	struct qca8k_mib_eth_data *mib_eth_data;
+ 	struct qca8k_priv *priv = ds->priv;
+ 	const struct qca8k_mib_desc *mib;
+@@ -2181,10 +2175,9 @@ static void qca8k_mib_autocast_handler(s
+ 	if (port != mib_eth_data->req_port)
+ 		goto exit;
+ 
+-	match_data = device_get_match_data(priv->dev);
+ 	data = mib_eth_data->data;
+ 
+-	for (i = 0; i < match_data->mib_count; i++) {
++	for (i = 0; i < priv->info->mib_count; i++) {
+ 		mib = &ar8327_mib[i];
+ 
+ 		/* First 3 mib are present in the skb head */
+@@ -2256,7 +2249,6 @@ qca8k_get_ethtool_stats(struct dsa_switc
+ 			uint64_t *data)
+ {
+ 	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	const struct qca8k_match_data *match_data;
+ 	const struct qca8k_mib_desc *mib;
+ 	u32 reg, i, val;
+ 	u32 hi = 0;
+@@ -2266,9 +2258,7 @@ qca8k_get_ethtool_stats(struct dsa_switc
+ 	    qca8k_get_ethtool_stats_eth(ds, port, data) > 0)
+ 		return;
+ 
+-	match_data = of_device_get_match_data(priv->dev);
+-
+-	for (i = 0; i < match_data->mib_count; i++) {
++	for (i = 0; i < priv->info->mib_count; i++) {
+ 		mib = &ar8327_mib[i];
+ 		reg = QCA8K_PORT_MIB_COUNTER(port) + mib->offset;
+ 
+@@ -2291,15 +2281,12 @@ qca8k_get_ethtool_stats(struct dsa_switc
+ static int
+ qca8k_get_sset_count(struct dsa_switch *ds, int port, int sset)
+ {
+-	const struct qca8k_match_data *match_data;
+ 	struct qca8k_priv *priv = ds->priv;
+ 
+ 	if (sset != ETH_SS_STATS)
+ 		return 0;
+ 
+-	match_data = of_device_get_match_data(priv->dev);
+-
+-	return match_data->mib_count;
++	return priv->info->mib_count;
+ }
+ 
+ static int
+@@ -3037,14 +3024,11 @@ static const struct dsa_switch_ops qca8k
+ 
+ static int qca8k_read_switch_id(struct qca8k_priv *priv)
+ {
+-	const struct qca8k_match_data *data;
+ 	u32 val;
+ 	u8 id;
+ 	int ret;
+ 
+-	/* get the switches ID from the compatible */
+-	data = of_device_get_match_data(priv->dev);
+-	if (!data)
++	if (!priv->info)
+ 		return -ENODEV;
+ 
+ 	ret = qca8k_read(priv, QCA8K_REG_MASK_CTRL, &val);
+@@ -3052,8 +3036,10 @@ static int qca8k_read_switch_id(struct q
+ 		return -ENODEV;
+ 
+ 	id = QCA8K_MASK_CTRL_DEVICE_ID(val);
+-	if (id != data->id) {
+-		dev_err(priv->dev, "Switch id detected %x but expected %x", id, data->id);
++	if (id != priv->info->id) {
++		dev_err(priv->dev,
++			"Switch id detected %x but expected %x",
++			id, priv->info->id);
+ 		return -ENODEV;
+ 	}
+ 
+@@ -3078,6 +3064,7 @@ qca8k_sw_probe(struct mdio_device *mdiod
+ 	if (!priv)
+ 		return -ENOMEM;
+ 
++	priv->info = of_device_get_match_data(priv->dev);
+ 	priv->bus = mdiodev->bus;
+ 	priv->dev = &mdiodev->dev;
+ 
+--- a/drivers/net/dsa/qca/qca8k.h
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -393,6 +393,7 @@ struct qca8k_priv {
+ 	struct qca8k_mgmt_eth_data mgmt_eth_data;
+ 	struct qca8k_mib_eth_data mib_eth_data;
+ 	struct qca8k_mdio_cache mdio_cache;
++	const struct qca8k_match_data *info;
+ };
+ 
+ struct qca8k_mib_desc {
diff --git a/target/linux/generic/backport-5.15/771-v6.0-02-net-dsa-qca8k-make-mib-autocast-feature-optional.patch b/target/linux/generic/backport-5.15/771-v6.0-02-net-dsa-qca8k-make-mib-autocast-feature-optional.patch
new file mode 100644
index 00000000000000..5b2dce4c556ce5
--- /dev/null
+++ b/target/linux/generic/backport-5.15/771-v6.0-02-net-dsa-qca8k-make-mib-autocast-feature-optional.patch
@@ -0,0 +1,77 @@
+From 533c64bca62a8654f00698bc893f639013e38c7b Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 27 Jul 2022 13:35:11 +0200
+Subject: [PATCH 02/14] net: dsa: qca8k: make mib autocast feature optional
+
+Some switch may not support mib autocast feature and require the legacy
+way of reading the regs directly.
+Make the mib autocast feature optional and permit to declare support for
+it using match_data struct in a dedicated qca8k_info_ops struct.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/qca/qca8k.c | 11 +++++++++--
+ drivers/net/dsa/qca/qca8k.h |  5 +++++
+ 2 files changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k.c
++++ b/drivers/net/dsa/qca/qca8k.c
+@@ -2254,8 +2254,8 @@ qca8k_get_ethtool_stats(struct dsa_switc
+ 	u32 hi = 0;
+ 	int ret;
+ 
+-	if (priv->mgmt_master &&
+-	    qca8k_get_ethtool_stats_eth(ds, port, data) > 0)
++	if (priv->mgmt_master && priv->info->ops->autocast_mib &&
++	    priv->info->ops->autocast_mib(ds, port, data) > 0)
+ 		return;
+ 
+ 	for (i = 0; i < priv->info->mib_count; i++) {
+@@ -3187,20 +3187,27 @@ static int qca8k_resume(struct device *d
+ static SIMPLE_DEV_PM_OPS(qca8k_pm_ops,
+ 			 qca8k_suspend, qca8k_resume);
+ 
++static const struct qca8k_info_ops qca8xxx_ops = {
++	.autocast_mib = qca8k_get_ethtool_stats_eth,
++};
++
+ static const struct qca8k_match_data qca8327 = {
+ 	.id = QCA8K_ID_QCA8327,
+ 	.reduced_package = true,
+ 	.mib_count = QCA8K_QCA832X_MIB_COUNT,
++	.ops = &qca8xxx_ops,
+ };
+ 
+ static const struct qca8k_match_data qca8328 = {
+ 	.id = QCA8K_ID_QCA8327,
+ 	.mib_count = QCA8K_QCA832X_MIB_COUNT,
++	.ops = &qca8xxx_ops,
+ };
+ 
+ static const struct qca8k_match_data qca833x = {
+ 	.id = QCA8K_ID_QCA8337,
+ 	.mib_count = QCA8K_QCA833X_MIB_COUNT,
++	.ops = &qca8xxx_ops,
+ };
+ 
+ static const struct of_device_id qca8k_of_match[] = {
+--- a/drivers/net/dsa/qca/qca8k.h
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -324,10 +324,15 @@ enum qca8k_mid_cmd {
+ 	QCA8K_MIB_CAST = 3,
+ };
+ 
++struct qca8k_info_ops {
++	int (*autocast_mib)(struct dsa_switch *ds, int port, u64 *data);
++};
++
+ struct qca8k_match_data {
+ 	u8 id;
+ 	bool reduced_package;
+ 	u8 mib_count;
++	const struct qca8k_info_ops *ops;
+ };
+ 
+ enum {
diff --git a/target/linux/generic/backport-5.15/771-v6.0-03-net-dsa-qca8k-move-mib-struct-to-common-code.patch b/target/linux/generic/backport-5.15/771-v6.0-03-net-dsa-qca8k-move-mib-struct-to-common-code.patch
new file mode 100644
index 00000000000000..afa466693a98c1
--- /dev/null
+++ b/target/linux/generic/backport-5.15/771-v6.0-03-net-dsa-qca8k-move-mib-struct-to-common-code.patch
@@ -0,0 +1,6532 @@
+From 027152b830434e3632ad5dd678cc5d4740358dbb Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 27 Jul 2022 13:35:12 +0200
+Subject: [PATCH 03/14] net: dsa: qca8k: move mib struct to common code
+
+The same MIB struct is used by drivers based on qca8k family switch. Move
+it to common code to make it accessible also by other drivers.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/qca/Makefile                  |  1 +
+ drivers/net/dsa/qca/{qca8k.c => qca8k-8xxx.c} | 51 ---------------
+ drivers/net/dsa/qca/qca8k-common.c            | 63 +++++++++++++++++++
+ drivers/net/dsa/qca/qca8k.h                   |  3 +
+ 4 files changed, 67 insertions(+), 51 deletions(-)
+ rename drivers/net/dsa/qca/{qca8k.c => qca8k-8xxx.c} (98%)
+ create mode 100644 drivers/net/dsa/qca/qca8k-common.c
+
+--- a/drivers/net/dsa/qca/Makefile
++++ b/drivers/net/dsa/qca/Makefile
+@@ -1,3 +1,4 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ obj-$(CONFIG_NET_DSA_AR9331)	+= ar9331.o
+ obj-$(CONFIG_NET_DSA_QCA8K)	+= qca8k.o
++qca8k-y 			+= qca8k-common.o qca8k-8xxx.o
+--- a/drivers/net/dsa/qca/qca8k.c
++++ /dev/null
+@@ -1,3237 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * Copyright (C) 2009 Felix Fietkau <nbd@nbd.name>
+- * Copyright (C) 2011-2012 Gabor Juhos <juhosg@openwrt.org>
+- * Copyright (c) 2015, 2019, The Linux Foundation. All rights reserved.
+- * Copyright (c) 2016 John Crispin <john@phrozen.org>
+- */
+-
+-#include <linux/module.h>
+-#include <linux/phy.h>
+-#include <linux/netdevice.h>
+-#include <linux/bitfield.h>
+-#include <linux/regmap.h>
+-#include <net/dsa.h>
+-#include <linux/of_net.h>
+-#include <linux/of_mdio.h>
+-#include <linux/of_platform.h>
+-#include <linux/if_bridge.h>
+-#include <linux/mdio.h>
+-#include <linux/phylink.h>
+-#include <linux/gpio/consumer.h>
+-#include <linux/etherdevice.h>
+-#include <linux/dsa/tag_qca.h>
+-
+-#include "qca8k.h"
+-
+-#define MIB_DESC(_s, _o, _n)	\
+-	{			\
+-		.size = (_s),	\
+-		.offset = (_o),	\
+-		.name = (_n),	\
+-	}
+-
+-static const struct qca8k_mib_desc ar8327_mib[] = {
+-	MIB_DESC(1, 0x00, "RxBroad"),
+-	MIB_DESC(1, 0x04, "RxPause"),
+-	MIB_DESC(1, 0x08, "RxMulti"),
+-	MIB_DESC(1, 0x0c, "RxFcsErr"),
+-	MIB_DESC(1, 0x10, "RxAlignErr"),
+-	MIB_DESC(1, 0x14, "RxRunt"),
+-	MIB_DESC(1, 0x18, "RxFragment"),
+-	MIB_DESC(1, 0x1c, "Rx64Byte"),
+-	MIB_DESC(1, 0x20, "Rx128Byte"),
+-	MIB_DESC(1, 0x24, "Rx256Byte"),
+-	MIB_DESC(1, 0x28, "Rx512Byte"),
+-	MIB_DESC(1, 0x2c, "Rx1024Byte"),
+-	MIB_DESC(1, 0x30, "Rx1518Byte"),
+-	MIB_DESC(1, 0x34, "RxMaxByte"),
+-	MIB_DESC(1, 0x38, "RxTooLong"),
+-	MIB_DESC(2, 0x3c, "RxGoodByte"),
+-	MIB_DESC(2, 0x44, "RxBadByte"),
+-	MIB_DESC(1, 0x4c, "RxOverFlow"),
+-	MIB_DESC(1, 0x50, "Filtered"),
+-	MIB_DESC(1, 0x54, "TxBroad"),
+-	MIB_DESC(1, 0x58, "TxPause"),
+-	MIB_DESC(1, 0x5c, "TxMulti"),
+-	MIB_DESC(1, 0x60, "TxUnderRun"),
+-	MIB_DESC(1, 0x64, "Tx64Byte"),
+-	MIB_DESC(1, 0x68, "Tx128Byte"),
+-	MIB_DESC(1, 0x6c, "Tx256Byte"),
+-	MIB_DESC(1, 0x70, "Tx512Byte"),
+-	MIB_DESC(1, 0x74, "Tx1024Byte"),
+-	MIB_DESC(1, 0x78, "Tx1518Byte"),
+-	MIB_DESC(1, 0x7c, "TxMaxByte"),
+-	MIB_DESC(1, 0x80, "TxOverSize"),
+-	MIB_DESC(2, 0x84, "TxByte"),
+-	MIB_DESC(1, 0x8c, "TxCollision"),
+-	MIB_DESC(1, 0x90, "TxAbortCol"),
+-	MIB_DESC(1, 0x94, "TxMultiCol"),
+-	MIB_DESC(1, 0x98, "TxSingleCol"),
+-	MIB_DESC(1, 0x9c, "TxExcDefer"),
+-	MIB_DESC(1, 0xa0, "TxDefer"),
+-	MIB_DESC(1, 0xa4, "TxLateCol"),
+-	MIB_DESC(1, 0xa8, "RXUnicast"),
+-	MIB_DESC(1, 0xac, "TXUnicast"),
+-};
+-
+-static void
+-qca8k_split_addr(u32 regaddr, u16 *r1, u16 *r2, u16 *page)
+-{
+-	regaddr >>= 1;
+-	*r1 = regaddr & 0x1e;
+-
+-	regaddr >>= 5;
+-	*r2 = regaddr & 0x7;
+-
+-	regaddr >>= 3;
+-	*page = regaddr & 0x3ff;
+-}
+-
+-static int
+-qca8k_set_lo(struct qca8k_priv *priv, int phy_id, u32 regnum, u16 lo)
+-{
+-	u16 *cached_lo = &priv->mdio_cache.lo;
+-	struct mii_bus *bus = priv->bus;
+-	int ret;
+-
+-	if (lo == *cached_lo)
+-		return 0;
+-
+-	ret = bus->write(bus, phy_id, regnum, lo);
+-	if (ret < 0)
+-		dev_err_ratelimited(&bus->dev,
+-				    "failed to write qca8k 32bit lo register\n");
+-
+-	*cached_lo = lo;
+-	return 0;
+-}
+-
+-static int
+-qca8k_set_hi(struct qca8k_priv *priv, int phy_id, u32 regnum, u16 hi)
+-{
+-	u16 *cached_hi = &priv->mdio_cache.hi;
+-	struct mii_bus *bus = priv->bus;
+-	int ret;
+-
+-	if (hi == *cached_hi)
+-		return 0;
+-
+-	ret = bus->write(bus, phy_id, regnum, hi);
+-	if (ret < 0)
+-		dev_err_ratelimited(&bus->dev,
+-				    "failed to write qca8k 32bit hi register\n");
+-
+-	*cached_hi = hi;
+-	return 0;
+-}
+-
+-static int
+-qca8k_mii_read32(struct mii_bus *bus, int phy_id, u32 regnum, u32 *val)
+-{
+-	int ret;
+-
+-	ret = bus->read(bus, phy_id, regnum);
+-	if (ret >= 0) {
+-		*val = ret;
+-		ret = bus->read(bus, phy_id, regnum + 1);
+-		*val |= ret << 16;
+-	}
+-
+-	if (ret < 0) {
+-		dev_err_ratelimited(&bus->dev,
+-				    "failed to read qca8k 32bit register\n");
+-		*val = 0;
+-		return ret;
+-	}
+-
+-	return 0;
+-}
+-
+-static void
+-qca8k_mii_write32(struct qca8k_priv *priv, int phy_id, u32 regnum, u32 val)
+-{
+-	u16 lo, hi;
+-	int ret;
+-
+-	lo = val & 0xffff;
+-	hi = (u16)(val >> 16);
+-
+-	ret = qca8k_set_lo(priv, phy_id, regnum, lo);
+-	if (ret >= 0)
+-		ret = qca8k_set_hi(priv, phy_id, regnum + 1, hi);
+-}
+-
+-static int
+-qca8k_set_page(struct qca8k_priv *priv, u16 page)
+-{
+-	u16 *cached_page = &priv->mdio_cache.page;
+-	struct mii_bus *bus = priv->bus;
+-	int ret;
+-
+-	if (page == *cached_page)
+-		return 0;
+-
+-	ret = bus->write(bus, 0x18, 0, page);
+-	if (ret < 0) {
+-		dev_err_ratelimited(&bus->dev,
+-				    "failed to set qca8k page\n");
+-		return ret;
+-	}
+-
+-	*cached_page = page;
+-	usleep_range(1000, 2000);
+-	return 0;
+-}
+-
+-static int
+-qca8k_read(struct qca8k_priv *priv, u32 reg, u32 *val)
+-{
+-	return regmap_read(priv->regmap, reg, val);
+-}
+-
+-static int
+-qca8k_write(struct qca8k_priv *priv, u32 reg, u32 val)
+-{
+-	return regmap_write(priv->regmap, reg, val);
+-}
+-
+-static int
+-qca8k_rmw(struct qca8k_priv *priv, u32 reg, u32 mask, u32 write_val)
+-{
+-	return regmap_update_bits(priv->regmap, reg, mask, write_val);
+-}
+-
+-static void qca8k_rw_reg_ack_handler(struct dsa_switch *ds, struct sk_buff *skb)
+-{
+-	struct qca8k_mgmt_eth_data *mgmt_eth_data;
+-	struct qca8k_priv *priv = ds->priv;
+-	struct qca_mgmt_ethhdr *mgmt_ethhdr;
+-	u8 len, cmd;
+-
+-	mgmt_ethhdr = (struct qca_mgmt_ethhdr *)skb_mac_header(skb);
+-	mgmt_eth_data = &priv->mgmt_eth_data;
+-
+-	cmd = FIELD_GET(QCA_HDR_MGMT_CMD, mgmt_ethhdr->command);
+-	len = FIELD_GET(QCA_HDR_MGMT_LENGTH, mgmt_ethhdr->command);
+-
+-	/* Make sure the seq match the requested packet */
+-	if (mgmt_ethhdr->seq == mgmt_eth_data->seq)
+-		mgmt_eth_data->ack = true;
+-
+-	if (cmd == MDIO_READ) {
+-		mgmt_eth_data->data[0] = mgmt_ethhdr->mdio_data;
+-
+-		/* Get the rest of the 12 byte of data.
+-		 * The read/write function will extract the requested data.
+-		 */
+-		if (len > QCA_HDR_MGMT_DATA1_LEN)
+-			memcpy(mgmt_eth_data->data + 1, skb->data,
+-			       QCA_HDR_MGMT_DATA2_LEN);
+-	}
+-
+-	complete(&mgmt_eth_data->rw_done);
+-}
+-
+-static struct sk_buff *qca8k_alloc_mdio_header(enum mdio_cmd cmd, u32 reg, u32 *val,
+-					       int priority, unsigned int len)
+-{
+-	struct qca_mgmt_ethhdr *mgmt_ethhdr;
+-	unsigned int real_len;
+-	struct sk_buff *skb;
+-	u32 *data2;
+-	u16 hdr;
+-
+-	skb = dev_alloc_skb(QCA_HDR_MGMT_PKT_LEN);
+-	if (!skb)
+-		return NULL;
+-
+-	/* Max value for len reg is 15 (0xf) but the switch actually return 16 byte
+-	 * Actually for some reason the steps are:
+-	 * 0: nothing
+-	 * 1-4: first 4 byte
+-	 * 5-6: first 12 byte
+-	 * 7-15: all 16 byte
+-	 */
+-	if (len == 16)
+-		real_len = 15;
+-	else
+-		real_len = len;
+-
+-	skb_reset_mac_header(skb);
+-	skb_set_network_header(skb, skb->len);
+-
+-	mgmt_ethhdr = skb_push(skb, QCA_HDR_MGMT_HEADER_LEN + QCA_HDR_LEN);
+-
+-	hdr = FIELD_PREP(QCA_HDR_XMIT_VERSION, QCA_HDR_VERSION);
+-	hdr |= FIELD_PREP(QCA_HDR_XMIT_PRIORITY, priority);
+-	hdr |= QCA_HDR_XMIT_FROM_CPU;
+-	hdr |= FIELD_PREP(QCA_HDR_XMIT_DP_BIT, BIT(0));
+-	hdr |= FIELD_PREP(QCA_HDR_XMIT_CONTROL, QCA_HDR_XMIT_TYPE_RW_REG);
+-
+-	mgmt_ethhdr->command = FIELD_PREP(QCA_HDR_MGMT_ADDR, reg);
+-	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_LENGTH, real_len);
+-	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_CMD, cmd);
+-	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_CHECK_CODE,
+-					   QCA_HDR_MGMT_CHECK_CODE_VAL);
+-
+-	if (cmd == MDIO_WRITE)
+-		mgmt_ethhdr->mdio_data = *val;
+-
+-	mgmt_ethhdr->hdr = htons(hdr);
+-
+-	data2 = skb_put_zero(skb, QCA_HDR_MGMT_DATA2_LEN + QCA_HDR_MGMT_PADDING_LEN);
+-	if (cmd == MDIO_WRITE && len > QCA_HDR_MGMT_DATA1_LEN)
+-		memcpy(data2, val + 1, len - QCA_HDR_MGMT_DATA1_LEN);
+-
+-	return skb;
+-}
+-
+-static void qca8k_mdio_header_fill_seq_num(struct sk_buff *skb, u32 seq_num)
+-{
+-	struct qca_mgmt_ethhdr *mgmt_ethhdr;
+-
+-	mgmt_ethhdr = (struct qca_mgmt_ethhdr *)skb->data;
+-	mgmt_ethhdr->seq = FIELD_PREP(QCA_HDR_MGMT_SEQ_NUM, seq_num);
+-}
+-
+-static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
+-{
+-	struct qca8k_mgmt_eth_data *mgmt_eth_data = &priv->mgmt_eth_data;
+-	struct sk_buff *skb;
+-	bool ack;
+-	int ret;
+-
+-	skb = qca8k_alloc_mdio_header(MDIO_READ, reg, NULL,
+-				      QCA8K_ETHERNET_MDIO_PRIORITY, len);
+-	if (!skb)
+-		return -ENOMEM;
+-
+-	mutex_lock(&mgmt_eth_data->mutex);
+-
+-	/* Check mgmt_master if is operational */
+-	if (!priv->mgmt_master) {
+-		kfree_skb(skb);
+-		mutex_unlock(&mgmt_eth_data->mutex);
+-		return -EINVAL;
+-	}
+-
+-	skb->dev = priv->mgmt_master;
+-
+-	reinit_completion(&mgmt_eth_data->rw_done);
+-
+-	/* Increment seq_num and set it in the mdio pkt */
+-	mgmt_eth_data->seq++;
+-	qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
+-	mgmt_eth_data->ack = false;
+-
+-	dev_queue_xmit(skb);
+-
+-	ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
+-					  msecs_to_jiffies(QCA8K_ETHERNET_TIMEOUT));
+-
+-	*val = mgmt_eth_data->data[0];
+-	if (len > QCA_HDR_MGMT_DATA1_LEN)
+-		memcpy(val + 1, mgmt_eth_data->data + 1, len - QCA_HDR_MGMT_DATA1_LEN);
+-
+-	ack = mgmt_eth_data->ack;
+-
+-	mutex_unlock(&mgmt_eth_data->mutex);
+-
+-	if (ret <= 0)
+-		return -ETIMEDOUT;
+-
+-	if (!ack)
+-		return -EINVAL;
+-
+-	return 0;
+-}
+-
+-static int qca8k_write_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
+-{
+-	struct qca8k_mgmt_eth_data *mgmt_eth_data = &priv->mgmt_eth_data;
+-	struct sk_buff *skb;
+-	bool ack;
+-	int ret;
+-
+-	skb = qca8k_alloc_mdio_header(MDIO_WRITE, reg, val,
+-				      QCA8K_ETHERNET_MDIO_PRIORITY, len);
+-	if (!skb)
+-		return -ENOMEM;
+-
+-	mutex_lock(&mgmt_eth_data->mutex);
+-
+-	/* Check mgmt_master if is operational */
+-	if (!priv->mgmt_master) {
+-		kfree_skb(skb);
+-		mutex_unlock(&mgmt_eth_data->mutex);
+-		return -EINVAL;
+-	}
+-
+-	skb->dev = priv->mgmt_master;
+-
+-	reinit_completion(&mgmt_eth_data->rw_done);
+-
+-	/* Increment seq_num and set it in the mdio pkt */
+-	mgmt_eth_data->seq++;
+-	qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
+-	mgmt_eth_data->ack = false;
+-
+-	dev_queue_xmit(skb);
+-
+-	ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
+-					  msecs_to_jiffies(QCA8K_ETHERNET_TIMEOUT));
+-
+-	ack = mgmt_eth_data->ack;
+-
+-	mutex_unlock(&mgmt_eth_data->mutex);
+-
+-	if (ret <= 0)
+-		return -ETIMEDOUT;
+-
+-	if (!ack)
+-		return -EINVAL;
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_regmap_update_bits_eth(struct qca8k_priv *priv, u32 reg, u32 mask, u32 write_val)
+-{
+-	u32 val = 0;
+-	int ret;
+-
+-	ret = qca8k_read_eth(priv, reg, &val, sizeof(val));
+-	if (ret)
+-		return ret;
+-
+-	val &= ~mask;
+-	val |= write_val;
+-
+-	return qca8k_write_eth(priv, reg, &val, sizeof(val));
+-}
+-
+-static int
+-qca8k_bulk_read(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
+-{
+-	int i, count = len / sizeof(u32), ret;
+-
+-	if (priv->mgmt_master && !qca8k_read_eth(priv, reg, val, len))
+-		return 0;
+-
+-	for (i = 0; i < count; i++) {
+-		ret = regmap_read(priv->regmap, reg + (i * 4), val + i);
+-		if (ret < 0)
+-			return ret;
+-	}
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_bulk_write(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
+-{
+-	int i, count = len / sizeof(u32), ret;
+-	u32 tmp;
+-
+-	if (priv->mgmt_master && !qca8k_write_eth(priv, reg, val, len))
+-		return 0;
+-
+-	for (i = 0; i < count; i++) {
+-		tmp = val[i];
+-
+-		ret = regmap_write(priv->regmap, reg + (i * 4), tmp);
+-		if (ret < 0)
+-			return ret;
+-	}
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_regmap_read(void *ctx, uint32_t reg, uint32_t *val)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ctx;
+-	struct mii_bus *bus = priv->bus;
+-	u16 r1, r2, page;
+-	int ret;
+-
+-	if (!qca8k_read_eth(priv, reg, val, sizeof(*val)))
+-		return 0;
+-
+-	qca8k_split_addr(reg, &r1, &r2, &page);
+-
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+-
+-	ret = qca8k_set_page(priv, page);
+-	if (ret < 0)
+-		goto exit;
+-
+-	ret = qca8k_mii_read32(bus, 0x10 | r2, r1, val);
+-
+-exit:
+-	mutex_unlock(&bus->mdio_lock);
+-	return ret;
+-}
+-
+-static int
+-qca8k_regmap_write(void *ctx, uint32_t reg, uint32_t val)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ctx;
+-	struct mii_bus *bus = priv->bus;
+-	u16 r1, r2, page;
+-	int ret;
+-
+-	if (!qca8k_write_eth(priv, reg, &val, sizeof(val)))
+-		return 0;
+-
+-	qca8k_split_addr(reg, &r1, &r2, &page);
+-
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+-
+-	ret = qca8k_set_page(priv, page);
+-	if (ret < 0)
+-		goto exit;
+-
+-	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
+-
+-exit:
+-	mutex_unlock(&bus->mdio_lock);
+-	return ret;
+-}
+-
+-static int
+-qca8k_regmap_update_bits(void *ctx, uint32_t reg, uint32_t mask, uint32_t write_val)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ctx;
+-	struct mii_bus *bus = priv->bus;
+-	u16 r1, r2, page;
+-	u32 val;
+-	int ret;
+-
+-	if (!qca8k_regmap_update_bits_eth(priv, reg, mask, write_val))
+-		return 0;
+-
+-	qca8k_split_addr(reg, &r1, &r2, &page);
+-
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+-
+-	ret = qca8k_set_page(priv, page);
+-	if (ret < 0)
+-		goto exit;
+-
+-	ret = qca8k_mii_read32(bus, 0x10 | r2, r1, &val);
+-	if (ret < 0)
+-		goto exit;
+-
+-	val &= ~mask;
+-	val |= write_val;
+-	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
+-
+-exit:
+-	mutex_unlock(&bus->mdio_lock);
+-
+-	return ret;
+-}
+-
+-static const struct regmap_range qca8k_readable_ranges[] = {
+-	regmap_reg_range(0x0000, 0x00e4), /* Global control */
+-	regmap_reg_range(0x0100, 0x0168), /* EEE control */
+-	regmap_reg_range(0x0200, 0x0270), /* Parser control */
+-	regmap_reg_range(0x0400, 0x0454), /* ACL */
+-	regmap_reg_range(0x0600, 0x0718), /* Lookup */
+-	regmap_reg_range(0x0800, 0x0b70), /* QM */
+-	regmap_reg_range(0x0c00, 0x0c80), /* PKT */
+-	regmap_reg_range(0x0e00, 0x0e98), /* L3 */
+-	regmap_reg_range(0x1000, 0x10ac), /* MIB - Port0 */
+-	regmap_reg_range(0x1100, 0x11ac), /* MIB - Port1 */
+-	regmap_reg_range(0x1200, 0x12ac), /* MIB - Port2 */
+-	regmap_reg_range(0x1300, 0x13ac), /* MIB - Port3 */
+-	regmap_reg_range(0x1400, 0x14ac), /* MIB - Port4 */
+-	regmap_reg_range(0x1500, 0x15ac), /* MIB - Port5 */
+-	regmap_reg_range(0x1600, 0x16ac), /* MIB - Port6 */
+-
+-};
+-
+-static const struct regmap_access_table qca8k_readable_table = {
+-	.yes_ranges = qca8k_readable_ranges,
+-	.n_yes_ranges = ARRAY_SIZE(qca8k_readable_ranges),
+-};
+-
+-static struct regmap_config qca8k_regmap_config = {
+-	.reg_bits = 16,
+-	.val_bits = 32,
+-	.reg_stride = 4,
+-	.max_register = 0x16ac, /* end MIB - Port6 range */
+-	.reg_read = qca8k_regmap_read,
+-	.reg_write = qca8k_regmap_write,
+-	.reg_update_bits = qca8k_regmap_update_bits,
+-	.rd_table = &qca8k_readable_table,
+-	.disable_locking = true, /* Locking is handled by qca8k read/write */
+-	.cache_type = REGCACHE_NONE, /* Explicitly disable CACHE */
+-};
+-
+-static int
+-qca8k_busy_wait(struct qca8k_priv *priv, u32 reg, u32 mask)
+-{
+-	u32 val;
+-
+-	return regmap_read_poll_timeout(priv->regmap, reg, val, !(val & mask), 0,
+-				       QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC);
+-}
+-
+-static int
+-qca8k_fdb_read(struct qca8k_priv *priv, struct qca8k_fdb *fdb)
+-{
+-	u32 reg[3];
+-	int ret;
+-
+-	/* load the ARL table into an array */
+-	ret = qca8k_bulk_read(priv, QCA8K_REG_ATU_DATA0, reg, sizeof(reg));
+-	if (ret)
+-		return ret;
+-
+-	/* vid - 83:72 */
+-	fdb->vid = FIELD_GET(QCA8K_ATU_VID_MASK, reg[2]);
+-	/* aging - 67:64 */
+-	fdb->aging = FIELD_GET(QCA8K_ATU_STATUS_MASK, reg[2]);
+-	/* portmask - 54:48 */
+-	fdb->port_mask = FIELD_GET(QCA8K_ATU_PORT_MASK, reg[1]);
+-	/* mac - 47:0 */
+-	fdb->mac[0] = FIELD_GET(QCA8K_ATU_ADDR0_MASK, reg[1]);
+-	fdb->mac[1] = FIELD_GET(QCA8K_ATU_ADDR1_MASK, reg[1]);
+-	fdb->mac[2] = FIELD_GET(QCA8K_ATU_ADDR2_MASK, reg[0]);
+-	fdb->mac[3] = FIELD_GET(QCA8K_ATU_ADDR3_MASK, reg[0]);
+-	fdb->mac[4] = FIELD_GET(QCA8K_ATU_ADDR4_MASK, reg[0]);
+-	fdb->mac[5] = FIELD_GET(QCA8K_ATU_ADDR5_MASK, reg[0]);
+-
+-	return 0;
+-}
+-
+-static void
+-qca8k_fdb_write(struct qca8k_priv *priv, u16 vid, u8 port_mask, const u8 *mac,
+-		u8 aging)
+-{
+-	u32 reg[3] = { 0 };
+-
+-	/* vid - 83:72 */
+-	reg[2] = FIELD_PREP(QCA8K_ATU_VID_MASK, vid);
+-	/* aging - 67:64 */
+-	reg[2] |= FIELD_PREP(QCA8K_ATU_STATUS_MASK, aging);
+-	/* portmask - 54:48 */
+-	reg[1] = FIELD_PREP(QCA8K_ATU_PORT_MASK, port_mask);
+-	/* mac - 47:0 */
+-	reg[1] |= FIELD_PREP(QCA8K_ATU_ADDR0_MASK, mac[0]);
+-	reg[1] |= FIELD_PREP(QCA8K_ATU_ADDR1_MASK, mac[1]);
+-	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR2_MASK, mac[2]);
+-	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR3_MASK, mac[3]);
+-	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR4_MASK, mac[4]);
+-	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR5_MASK, mac[5]);
+-
+-	/* load the array into the ARL table */
+-	qca8k_bulk_write(priv, QCA8K_REG_ATU_DATA0, reg, sizeof(reg));
+-}
+-
+-static int
+-qca8k_fdb_access(struct qca8k_priv *priv, enum qca8k_fdb_cmd cmd, int port)
+-{
+-	u32 reg;
+-	int ret;
+-
+-	/* Set the command and FDB index */
+-	reg = QCA8K_ATU_FUNC_BUSY;
+-	reg |= cmd;
+-	if (port >= 0) {
+-		reg |= QCA8K_ATU_FUNC_PORT_EN;
+-		reg |= FIELD_PREP(QCA8K_ATU_FUNC_PORT_MASK, port);
+-	}
+-
+-	/* Write the function register triggering the table access */
+-	ret = qca8k_write(priv, QCA8K_REG_ATU_FUNC, reg);
+-	if (ret)
+-		return ret;
+-
+-	/* wait for completion */
+-	ret = qca8k_busy_wait(priv, QCA8K_REG_ATU_FUNC, QCA8K_ATU_FUNC_BUSY);
+-	if (ret)
+-		return ret;
+-
+-	/* Check for table full violation when adding an entry */
+-	if (cmd == QCA8K_FDB_LOAD) {
+-		ret = qca8k_read(priv, QCA8K_REG_ATU_FUNC, &reg);
+-		if (ret < 0)
+-			return ret;
+-		if (reg & QCA8K_ATU_FUNC_FULL)
+-			return -1;
+-	}
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_fdb_next(struct qca8k_priv *priv, struct qca8k_fdb *fdb, int port)
+-{
+-	int ret;
+-
+-	qca8k_fdb_write(priv, fdb->vid, fdb->port_mask, fdb->mac, fdb->aging);
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_NEXT, port);
+-	if (ret < 0)
+-		return ret;
+-
+-	return qca8k_fdb_read(priv, fdb);
+-}
+-
+-static int
+-qca8k_fdb_add(struct qca8k_priv *priv, const u8 *mac, u16 port_mask,
+-	      u16 vid, u8 aging)
+-{
+-	int ret;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	qca8k_fdb_write(priv, vid, port_mask, mac, aging);
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_LOAD, -1);
+-	mutex_unlock(&priv->reg_mutex);
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_fdb_del(struct qca8k_priv *priv, const u8 *mac, u16 port_mask, u16 vid)
+-{
+-	int ret;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	qca8k_fdb_write(priv, vid, port_mask, mac, 0);
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_PURGE, -1);
+-	mutex_unlock(&priv->reg_mutex);
+-
+-	return ret;
+-}
+-
+-static void
+-qca8k_fdb_flush(struct qca8k_priv *priv)
+-{
+-	mutex_lock(&priv->reg_mutex);
+-	qca8k_fdb_access(priv, QCA8K_FDB_FLUSH, -1);
+-	mutex_unlock(&priv->reg_mutex);
+-}
+-
+-static int
+-qca8k_fdb_search_and_insert(struct qca8k_priv *priv, u8 port_mask,
+-			    const u8 *mac, u16 vid)
+-{
+-	struct qca8k_fdb fdb = { 0 };
+-	int ret;
+-
+-	mutex_lock(&priv->reg_mutex);
+-
+-	qca8k_fdb_write(priv, vid, 0, mac, 0);
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_SEARCH, -1);
+-	if (ret < 0)
+-		goto exit;
+-
+-	ret = qca8k_fdb_read(priv, &fdb);
+-	if (ret < 0)
+-		goto exit;
+-
+-	/* Rule exist. Delete first */
+-	if (!fdb.aging) {
+-		ret = qca8k_fdb_access(priv, QCA8K_FDB_PURGE, -1);
+-		if (ret)
+-			goto exit;
+-	}
+-
+-	/* Add port to fdb portmask */
+-	fdb.port_mask |= port_mask;
+-
+-	qca8k_fdb_write(priv, vid, fdb.port_mask, mac, fdb.aging);
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_LOAD, -1);
+-
+-exit:
+-	mutex_unlock(&priv->reg_mutex);
+-	return ret;
+-}
+-
+-static int
+-qca8k_fdb_search_and_del(struct qca8k_priv *priv, u8 port_mask,
+-			 const u8 *mac, u16 vid)
+-{
+-	struct qca8k_fdb fdb = { 0 };
+-	int ret;
+-
+-	mutex_lock(&priv->reg_mutex);
+-
+-	qca8k_fdb_write(priv, vid, 0, mac, 0);
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_SEARCH, -1);
+-	if (ret < 0)
+-		goto exit;
+-
+-	/* Rule doesn't exist. Why delete? */
+-	if (!fdb.aging) {
+-		ret = -EINVAL;
+-		goto exit;
+-	}
+-
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_PURGE, -1);
+-	if (ret)
+-		goto exit;
+-
+-	/* Only port in the rule is this port. Don't re insert */
+-	if (fdb.port_mask == port_mask)
+-		goto exit;
+-
+-	/* Remove port from port mask */
+-	fdb.port_mask &= ~port_mask;
+-
+-	qca8k_fdb_write(priv, vid, fdb.port_mask, mac, fdb.aging);
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_LOAD, -1);
+-
+-exit:
+-	mutex_unlock(&priv->reg_mutex);
+-	return ret;
+-}
+-
+-static int
+-qca8k_vlan_access(struct qca8k_priv *priv, enum qca8k_vlan_cmd cmd, u16 vid)
+-{
+-	u32 reg;
+-	int ret;
+-
+-	/* Set the command and VLAN index */
+-	reg = QCA8K_VTU_FUNC1_BUSY;
+-	reg |= cmd;
+-	reg |= FIELD_PREP(QCA8K_VTU_FUNC1_VID_MASK, vid);
+-
+-	/* Write the function register triggering the table access */
+-	ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC1, reg);
+-	if (ret)
+-		return ret;
+-
+-	/* wait for completion */
+-	ret = qca8k_busy_wait(priv, QCA8K_REG_VTU_FUNC1, QCA8K_VTU_FUNC1_BUSY);
+-	if (ret)
+-		return ret;
+-
+-	/* Check for table full violation when adding an entry */
+-	if (cmd == QCA8K_VLAN_LOAD) {
+-		ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC1, &reg);
+-		if (ret < 0)
+-			return ret;
+-		if (reg & QCA8K_VTU_FUNC1_FULL)
+-			return -ENOMEM;
+-	}
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_vlan_add(struct qca8k_priv *priv, u8 port, u16 vid, bool untagged)
+-{
+-	u32 reg;
+-	int ret;
+-
+-	/*
+-	   We do the right thing with VLAN 0 and treat it as untagged while
+-	   preserving the tag on egress.
+-	 */
+-	if (vid == 0)
+-		return 0;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	ret = qca8k_vlan_access(priv, QCA8K_VLAN_READ, vid);
+-	if (ret < 0)
+-		goto out;
+-
+-	ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC0, &reg);
+-	if (ret < 0)
+-		goto out;
+-	reg |= QCA8K_VTU_FUNC0_VALID | QCA8K_VTU_FUNC0_IVL_EN;
+-	reg &= ~QCA8K_VTU_FUNC0_EG_MODE_PORT_MASK(port);
+-	if (untagged)
+-		reg |= QCA8K_VTU_FUNC0_EG_MODE_PORT_UNTAG(port);
+-	else
+-		reg |= QCA8K_VTU_FUNC0_EG_MODE_PORT_TAG(port);
+-
+-	ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC0, reg);
+-	if (ret)
+-		goto out;
+-	ret = qca8k_vlan_access(priv, QCA8K_VLAN_LOAD, vid);
+-
+-out:
+-	mutex_unlock(&priv->reg_mutex);
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_vlan_del(struct qca8k_priv *priv, u8 port, u16 vid)
+-{
+-	u32 reg, mask;
+-	int ret, i;
+-	bool del;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	ret = qca8k_vlan_access(priv, QCA8K_VLAN_READ, vid);
+-	if (ret < 0)
+-		goto out;
+-
+-	ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC0, &reg);
+-	if (ret < 0)
+-		goto out;
+-	reg &= ~QCA8K_VTU_FUNC0_EG_MODE_PORT_MASK(port);
+-	reg |= QCA8K_VTU_FUNC0_EG_MODE_PORT_NOT(port);
+-
+-	/* Check if we're the last member to be removed */
+-	del = true;
+-	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+-		mask = QCA8K_VTU_FUNC0_EG_MODE_PORT_NOT(i);
+-
+-		if ((reg & mask) != mask) {
+-			del = false;
+-			break;
+-		}
+-	}
+-
+-	if (del) {
+-		ret = qca8k_vlan_access(priv, QCA8K_VLAN_PURGE, vid);
+-	} else {
+-		ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC0, reg);
+-		if (ret)
+-			goto out;
+-		ret = qca8k_vlan_access(priv, QCA8K_VLAN_LOAD, vid);
+-	}
+-
+-out:
+-	mutex_unlock(&priv->reg_mutex);
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_mib_init(struct qca8k_priv *priv)
+-{
+-	int ret;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	ret = regmap_update_bits(priv->regmap, QCA8K_REG_MIB,
+-				 QCA8K_MIB_FUNC | QCA8K_MIB_BUSY,
+-				 FIELD_PREP(QCA8K_MIB_FUNC, QCA8K_MIB_FLUSH) |
+-				 QCA8K_MIB_BUSY);
+-	if (ret)
+-		goto exit;
+-
+-	ret = qca8k_busy_wait(priv, QCA8K_REG_MIB, QCA8K_MIB_BUSY);
+-	if (ret)
+-		goto exit;
+-
+-	ret = regmap_set_bits(priv->regmap, QCA8K_REG_MIB, QCA8K_MIB_CPU_KEEP);
+-	if (ret)
+-		goto exit;
+-
+-	ret = qca8k_write(priv, QCA8K_REG_MODULE_EN, QCA8K_MODULE_EN_MIB);
+-
+-exit:
+-	mutex_unlock(&priv->reg_mutex);
+-	return ret;
+-}
+-
+-static void
+-qca8k_port_set_status(struct qca8k_priv *priv, int port, int enable)
+-{
+-	u32 mask = QCA8K_PORT_STATUS_TXMAC | QCA8K_PORT_STATUS_RXMAC;
+-
+-	/* Port 0 and 6 have no internal PHY */
+-	if (port > 0 && port < 6)
+-		mask |= QCA8K_PORT_STATUS_LINK_AUTO;
+-
+-	if (enable)
+-		regmap_set_bits(priv->regmap, QCA8K_REG_PORT_STATUS(port), mask);
+-	else
+-		regmap_clear_bits(priv->regmap, QCA8K_REG_PORT_STATUS(port), mask);
+-}
+-
+-static int
+-qca8k_phy_eth_busy_wait(struct qca8k_mgmt_eth_data *mgmt_eth_data,
+-			struct sk_buff *read_skb, u32 *val)
+-{
+-	struct sk_buff *skb = skb_copy(read_skb, GFP_KERNEL);
+-	bool ack;
+-	int ret;
+-
+-	reinit_completion(&mgmt_eth_data->rw_done);
+-
+-	/* Increment seq_num and set it in the copy pkt */
+-	mgmt_eth_data->seq++;
+-	qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
+-	mgmt_eth_data->ack = false;
+-
+-	dev_queue_xmit(skb);
+-
+-	ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
+-					  QCA8K_ETHERNET_TIMEOUT);
+-
+-	ack = mgmt_eth_data->ack;
+-
+-	if (ret <= 0)
+-		return -ETIMEDOUT;
+-
+-	if (!ack)
+-		return -EINVAL;
+-
+-	*val = mgmt_eth_data->data[0];
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
+-		      int regnum, u16 data)
+-{
+-	struct sk_buff *write_skb, *clear_skb, *read_skb;
+-	struct qca8k_mgmt_eth_data *mgmt_eth_data;
+-	u32 write_val, clear_val = 0, val;
+-	struct net_device *mgmt_master;
+-	int ret, ret1;
+-	bool ack;
+-
+-	if (regnum >= QCA8K_MDIO_MASTER_MAX_REG)
+-		return -EINVAL;
+-
+-	mgmt_eth_data = &priv->mgmt_eth_data;
+-
+-	write_val = QCA8K_MDIO_MASTER_BUSY | QCA8K_MDIO_MASTER_EN |
+-		    QCA8K_MDIO_MASTER_PHY_ADDR(phy) |
+-		    QCA8K_MDIO_MASTER_REG_ADDR(regnum);
+-
+-	if (read) {
+-		write_val |= QCA8K_MDIO_MASTER_READ;
+-	} else {
+-		write_val |= QCA8K_MDIO_MASTER_WRITE;
+-		write_val |= QCA8K_MDIO_MASTER_DATA(data);
+-	}
+-
+-	/* Prealloc all the needed skb before the lock */
+-	write_skb = qca8k_alloc_mdio_header(MDIO_WRITE, QCA8K_MDIO_MASTER_CTRL, &write_val,
+-					    QCA8K_ETHERNET_PHY_PRIORITY, sizeof(write_val));
+-	if (!write_skb)
+-		return -ENOMEM;
+-
+-	clear_skb = qca8k_alloc_mdio_header(MDIO_WRITE, QCA8K_MDIO_MASTER_CTRL, &clear_val,
+-					    QCA8K_ETHERNET_PHY_PRIORITY, sizeof(clear_val));
+-	if (!clear_skb) {
+-		ret = -ENOMEM;
+-		goto err_clear_skb;
+-	}
+-
+-	read_skb = qca8k_alloc_mdio_header(MDIO_READ, QCA8K_MDIO_MASTER_CTRL, &clear_val,
+-					   QCA8K_ETHERNET_PHY_PRIORITY, sizeof(clear_val));
+-	if (!read_skb) {
+-		ret = -ENOMEM;
+-		goto err_read_skb;
+-	}
+-
+-	/* Actually start the request:
+-	 * 1. Send mdio master packet
+-	 * 2. Busy Wait for mdio master command
+-	 * 3. Get the data if we are reading
+-	 * 4. Reset the mdio master (even with error)
+-	 */
+-	mutex_lock(&mgmt_eth_data->mutex);
+-
+-	/* Check if mgmt_master is operational */
+-	mgmt_master = priv->mgmt_master;
+-	if (!mgmt_master) {
+-		mutex_unlock(&mgmt_eth_data->mutex);
+-		ret = -EINVAL;
+-		goto err_mgmt_master;
+-	}
+-
+-	read_skb->dev = mgmt_master;
+-	clear_skb->dev = mgmt_master;
+-	write_skb->dev = mgmt_master;
+-
+-	reinit_completion(&mgmt_eth_data->rw_done);
+-
+-	/* Increment seq_num and set it in the write pkt */
+-	mgmt_eth_data->seq++;
+-	qca8k_mdio_header_fill_seq_num(write_skb, mgmt_eth_data->seq);
+-	mgmt_eth_data->ack = false;
+-
+-	dev_queue_xmit(write_skb);
+-
+-	ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
+-					  QCA8K_ETHERNET_TIMEOUT);
+-
+-	ack = mgmt_eth_data->ack;
+-
+-	if (ret <= 0) {
+-		ret = -ETIMEDOUT;
+-		kfree_skb(read_skb);
+-		goto exit;
+-	}
+-
+-	if (!ack) {
+-		ret = -EINVAL;
+-		kfree_skb(read_skb);
+-		goto exit;
+-	}
+-
+-	ret = read_poll_timeout(qca8k_phy_eth_busy_wait, ret1,
+-				!(val & QCA8K_MDIO_MASTER_BUSY), 0,
+-				QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC, false,
+-				mgmt_eth_data, read_skb, &val);
+-
+-	if (ret < 0 && ret1 < 0) {
+-		ret = ret1;
+-		goto exit;
+-	}
+-
+-	if (read) {
+-		reinit_completion(&mgmt_eth_data->rw_done);
+-
+-		/* Increment seq_num and set it in the read pkt */
+-		mgmt_eth_data->seq++;
+-		qca8k_mdio_header_fill_seq_num(read_skb, mgmt_eth_data->seq);
+-		mgmt_eth_data->ack = false;
+-
+-		dev_queue_xmit(read_skb);
+-
+-		ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
+-						  QCA8K_ETHERNET_TIMEOUT);
+-
+-		ack = mgmt_eth_data->ack;
+-
+-		if (ret <= 0) {
+-			ret = -ETIMEDOUT;
+-			goto exit;
+-		}
+-
+-		if (!ack) {
+-			ret = -EINVAL;
+-			goto exit;
+-		}
+-
+-		ret = mgmt_eth_data->data[0] & QCA8K_MDIO_MASTER_DATA_MASK;
+-	} else {
+-		kfree_skb(read_skb);
+-	}
+-exit:
+-	reinit_completion(&mgmt_eth_data->rw_done);
+-
+-	/* Increment seq_num and set it in the clear pkt */
+-	mgmt_eth_data->seq++;
+-	qca8k_mdio_header_fill_seq_num(clear_skb, mgmt_eth_data->seq);
+-	mgmt_eth_data->ack = false;
+-
+-	dev_queue_xmit(clear_skb);
+-
+-	wait_for_completion_timeout(&mgmt_eth_data->rw_done,
+-				    QCA8K_ETHERNET_TIMEOUT);
+-
+-	mutex_unlock(&mgmt_eth_data->mutex);
+-
+-	return ret;
+-
+-	/* Error handling before lock */
+-err_mgmt_master:
+-	kfree_skb(read_skb);
+-err_read_skb:
+-	kfree_skb(clear_skb);
+-err_clear_skb:
+-	kfree_skb(write_skb);
+-
+-	return ret;
+-}
+-
+-static u32
+-qca8k_port_to_phy(int port)
+-{
+-	/* From Andrew Lunn:
+-	 * Port 0 has no internal phy.
+-	 * Port 1 has an internal PHY at MDIO address 0.
+-	 * Port 2 has an internal PHY at MDIO address 1.
+-	 * ...
+-	 * Port 5 has an internal PHY at MDIO address 4.
+-	 * Port 6 has no internal PHY.
+-	 */
+-
+-	return port - 1;
+-}
+-
+-static int
+-qca8k_mdio_busy_wait(struct mii_bus *bus, u32 reg, u32 mask)
+-{
+-	u16 r1, r2, page;
+-	u32 val;
+-	int ret, ret1;
+-
+-	qca8k_split_addr(reg, &r1, &r2, &page);
+-
+-	ret = read_poll_timeout(qca8k_mii_read32, ret1, !(val & mask), 0,
+-				QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC, false,
+-				bus, 0x10 | r2, r1, &val);
+-
+-	/* Check if qca8k_read has failed for a different reason
+-	 * before returnting -ETIMEDOUT
+-	 */
+-	if (ret < 0 && ret1 < 0)
+-		return ret1;
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_mdio_write(struct qca8k_priv *priv, int phy, int regnum, u16 data)
+-{
+-	struct mii_bus *bus = priv->bus;
+-	u16 r1, r2, page;
+-	u32 val;
+-	int ret;
+-
+-	if (regnum >= QCA8K_MDIO_MASTER_MAX_REG)
+-		return -EINVAL;
+-
+-	val = QCA8K_MDIO_MASTER_BUSY | QCA8K_MDIO_MASTER_EN |
+-	      QCA8K_MDIO_MASTER_WRITE | QCA8K_MDIO_MASTER_PHY_ADDR(phy) |
+-	      QCA8K_MDIO_MASTER_REG_ADDR(regnum) |
+-	      QCA8K_MDIO_MASTER_DATA(data);
+-
+-	qca8k_split_addr(QCA8K_MDIO_MASTER_CTRL, &r1, &r2, &page);
+-
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+-
+-	ret = qca8k_set_page(priv, page);
+-	if (ret)
+-		goto exit;
+-
+-	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
+-
+-	ret = qca8k_mdio_busy_wait(bus, QCA8K_MDIO_MASTER_CTRL,
+-				   QCA8K_MDIO_MASTER_BUSY);
+-
+-exit:
+-	/* even if the busy_wait timeouts try to clear the MASTER_EN */
+-	qca8k_mii_write32(priv, 0x10 | r2, r1, 0);
+-
+-	mutex_unlock(&bus->mdio_lock);
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_mdio_read(struct qca8k_priv *priv, int phy, int regnum)
+-{
+-	struct mii_bus *bus = priv->bus;
+-	u16 r1, r2, page;
+-	u32 val;
+-	int ret;
+-
+-	if (regnum >= QCA8K_MDIO_MASTER_MAX_REG)
+-		return -EINVAL;
+-
+-	val = QCA8K_MDIO_MASTER_BUSY | QCA8K_MDIO_MASTER_EN |
+-	      QCA8K_MDIO_MASTER_READ | QCA8K_MDIO_MASTER_PHY_ADDR(phy) |
+-	      QCA8K_MDIO_MASTER_REG_ADDR(regnum);
+-
+-	qca8k_split_addr(QCA8K_MDIO_MASTER_CTRL, &r1, &r2, &page);
+-
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+-
+-	ret = qca8k_set_page(priv, page);
+-	if (ret)
+-		goto exit;
+-
+-	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
+-
+-	ret = qca8k_mdio_busy_wait(bus, QCA8K_MDIO_MASTER_CTRL,
+-				   QCA8K_MDIO_MASTER_BUSY);
+-	if (ret)
+-		goto exit;
+-
+-	ret = qca8k_mii_read32(bus, 0x10 | r2, r1, &val);
+-
+-exit:
+-	/* even if the busy_wait timeouts try to clear the MASTER_EN */
+-	qca8k_mii_write32(priv, 0x10 | r2, r1, 0);
+-
+-	mutex_unlock(&bus->mdio_lock);
+-
+-	if (ret >= 0)
+-		ret = val & QCA8K_MDIO_MASTER_DATA_MASK;
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_internal_mdio_write(struct mii_bus *slave_bus, int phy, int regnum, u16 data)
+-{
+-	struct qca8k_priv *priv = slave_bus->priv;
+-	int ret;
+-
+-	/* Use mdio Ethernet when available, fallback to legacy one on error */
+-	ret = qca8k_phy_eth_command(priv, false, phy, regnum, data);
+-	if (!ret)
+-		return 0;
+-
+-	return qca8k_mdio_write(priv, phy, regnum, data);
+-}
+-
+-static int
+-qca8k_internal_mdio_read(struct mii_bus *slave_bus, int phy, int regnum)
+-{
+-	struct qca8k_priv *priv = slave_bus->priv;
+-	int ret;
+-
+-	/* Use mdio Ethernet when available, fallback to legacy one on error */
+-	ret = qca8k_phy_eth_command(priv, true, phy, regnum, 0);
+-	if (ret >= 0)
+-		return ret;
+-
+-	ret = qca8k_mdio_read(priv, phy, regnum);
+-
+-	if (ret < 0)
+-		return 0xffff;
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_legacy_mdio_write(struct mii_bus *slave_bus, int port, int regnum, u16 data)
+-{
+-	port = qca8k_port_to_phy(port) % PHY_MAX_ADDR;
+-
+-	return qca8k_internal_mdio_write(slave_bus, port, regnum, data);
+-}
+-
+-static int
+-qca8k_legacy_mdio_read(struct mii_bus *slave_bus, int port, int regnum)
+-{
+-	port = qca8k_port_to_phy(port) % PHY_MAX_ADDR;
+-
+-	return qca8k_internal_mdio_read(slave_bus, port, regnum);
+-}
+-
+-static int
+-qca8k_mdio_register(struct qca8k_priv *priv)
+-{
+-	struct dsa_switch *ds = priv->ds;
+-	struct device_node *mdio;
+-	struct mii_bus *bus;
+-
+-	bus = devm_mdiobus_alloc(ds->dev);
+-	if (!bus)
+-		return -ENOMEM;
+-
+-	bus->priv = (void *)priv;
+-	snprintf(bus->id, MII_BUS_ID_SIZE, "qca8k-%d.%d",
+-		 ds->dst->index, ds->index);
+-	bus->parent = ds->dev;
+-	bus->phy_mask = ~ds->phys_mii_mask;
+-	ds->slave_mii_bus = bus;
+-
+-	/* Check if the devicetree declare the port:phy mapping */
+-	mdio = of_get_child_by_name(priv->dev->of_node, "mdio");
+-	if (of_device_is_available(mdio)) {
+-		bus->name = "qca8k slave mii";
+-		bus->read = qca8k_internal_mdio_read;
+-		bus->write = qca8k_internal_mdio_write;
+-		return devm_of_mdiobus_register(priv->dev, bus, mdio);
+-	}
+-
+-	/* If a mapping can't be found the legacy mapping is used,
+-	 * using the qca8k_port_to_phy function
+-	 */
+-	bus->name = "qca8k-legacy slave mii";
+-	bus->read = qca8k_legacy_mdio_read;
+-	bus->write = qca8k_legacy_mdio_write;
+-	return devm_mdiobus_register(priv->dev, bus);
+-}
+-
+-static int
+-qca8k_setup_mdio_bus(struct qca8k_priv *priv)
+-{
+-	u32 internal_mdio_mask = 0, external_mdio_mask = 0, reg;
+-	struct device_node *ports, *port;
+-	phy_interface_t mode;
+-	int err;
+-
+-	ports = of_get_child_by_name(priv->dev->of_node, "ports");
+-	if (!ports)
+-		ports = of_get_child_by_name(priv->dev->of_node, "ethernet-ports");
+-
+-	if (!ports)
+-		return -EINVAL;
+-
+-	for_each_available_child_of_node(ports, port) {
+-		err = of_property_read_u32(port, "reg", &reg);
+-		if (err) {
+-			of_node_put(port);
+-			of_node_put(ports);
+-			return err;
+-		}
+-
+-		if (!dsa_is_user_port(priv->ds, reg))
+-			continue;
+-
+-		of_get_phy_mode(port, &mode);
+-
+-		if (of_property_read_bool(port, "phy-handle") &&
+-		    mode != PHY_INTERFACE_MODE_INTERNAL)
+-			external_mdio_mask |= BIT(reg);
+-		else
+-			internal_mdio_mask |= BIT(reg);
+-	}
+-
+-	of_node_put(ports);
+-	if (!external_mdio_mask && !internal_mdio_mask) {
+-		dev_err(priv->dev, "no PHYs are defined.\n");
+-		return -EINVAL;
+-	}
+-
+-	/* The QCA8K_MDIO_MASTER_EN Bit, which grants access to PHYs through
+-	 * the MDIO_MASTER register also _disconnects_ the external MDC
+-	 * passthrough to the internal PHYs. It's not possible to use both
+-	 * configurations at the same time!
+-	 *
+-	 * Because this came up during the review process:
+-	 * If the external mdio-bus driver is capable magically disabling
+-	 * the QCA8K_MDIO_MASTER_EN and mutex/spin-locking out the qca8k's
+-	 * accessors for the time being, it would be possible to pull this
+-	 * off.
+-	 */
+-	if (!!external_mdio_mask && !!internal_mdio_mask) {
+-		dev_err(priv->dev, "either internal or external mdio bus configuration is supported.\n");
+-		return -EINVAL;
+-	}
+-
+-	if (external_mdio_mask) {
+-		/* Make sure to disable the internal mdio bus in cases
+-		 * a dt-overlay and driver reload changed the configuration
+-		 */
+-
+-		return regmap_clear_bits(priv->regmap, QCA8K_MDIO_MASTER_CTRL,
+-					 QCA8K_MDIO_MASTER_EN);
+-	}
+-
+-	return qca8k_mdio_register(priv);
+-}
+-
+-static int
+-qca8k_setup_mac_pwr_sel(struct qca8k_priv *priv)
+-{
+-	u32 mask = 0;
+-	int ret = 0;
+-
+-	/* SoC specific settings for ipq8064.
+-	 * If more device require this consider adding
+-	 * a dedicated binding.
+-	 */
+-	if (of_machine_is_compatible("qcom,ipq8064"))
+-		mask |= QCA8K_MAC_PWR_RGMII0_1_8V;
+-
+-	/* SoC specific settings for ipq8065 */
+-	if (of_machine_is_compatible("qcom,ipq8065"))
+-		mask |= QCA8K_MAC_PWR_RGMII1_1_8V;
+-
+-	if (mask) {
+-		ret = qca8k_rmw(priv, QCA8K_REG_MAC_PWR_SEL,
+-				QCA8K_MAC_PWR_RGMII0_1_8V |
+-				QCA8K_MAC_PWR_RGMII1_1_8V,
+-				mask);
+-	}
+-
+-	return ret;
+-}
+-
+-static int qca8k_find_cpu_port(struct dsa_switch *ds)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-
+-	/* Find the connected cpu port. Valid port are 0 or 6 */
+-	if (dsa_is_cpu_port(ds, 0))
+-		return 0;
+-
+-	dev_dbg(priv->dev, "port 0 is not the CPU port. Checking port 6");
+-
+-	if (dsa_is_cpu_port(ds, 6))
+-		return 6;
+-
+-	return -EINVAL;
+-}
+-
+-static int
+-qca8k_setup_of_pws_reg(struct qca8k_priv *priv)
+-{
+-	const struct qca8k_match_data *data = priv->info;
+-	struct device_node *node = priv->dev->of_node;
+-	u32 val = 0;
+-	int ret;
+-
+-	/* QCA8327 require to set to the correct mode.
+-	 * His bigger brother QCA8328 have the 172 pin layout.
+-	 * Should be applied by default but we set this just to make sure.
+-	 */
+-	if (priv->switch_id == QCA8K_ID_QCA8327) {
+-		/* Set the correct package of 148 pin for QCA8327 */
+-		if (data->reduced_package)
+-			val |= QCA8327_PWS_PACKAGE148_EN;
+-
+-		ret = qca8k_rmw(priv, QCA8K_REG_PWS, QCA8327_PWS_PACKAGE148_EN,
+-				val);
+-		if (ret)
+-			return ret;
+-	}
+-
+-	if (of_property_read_bool(node, "qca,ignore-power-on-sel"))
+-		val |= QCA8K_PWS_POWER_ON_SEL;
+-
+-	if (of_property_read_bool(node, "qca,led-open-drain")) {
+-		if (!(val & QCA8K_PWS_POWER_ON_SEL)) {
+-			dev_err(priv->dev, "qca,led-open-drain require qca,ignore-power-on-sel to be set.");
+-			return -EINVAL;
+-		}
+-
+-		val |= QCA8K_PWS_LED_OPEN_EN_CSR;
+-	}
+-
+-	return qca8k_rmw(priv, QCA8K_REG_PWS,
+-			QCA8K_PWS_LED_OPEN_EN_CSR | QCA8K_PWS_POWER_ON_SEL,
+-			val);
+-}
+-
+-static int
+-qca8k_parse_port_config(struct qca8k_priv *priv)
+-{
+-	int port, cpu_port_index = -1, ret;
+-	struct device_node *port_dn;
+-	phy_interface_t mode;
+-	struct dsa_port *dp;
+-	u32 delay;
+-
+-	/* We have 2 CPU port. Check them */
+-	for (port = 0; port < QCA8K_NUM_PORTS; port++) {
+-		/* Skip every other port */
+-		if (port != 0 && port != 6)
+-			continue;
+-
+-		dp = dsa_to_port(priv->ds, port);
+-		port_dn = dp->dn;
+-		cpu_port_index++;
+-
+-		if (!of_device_is_available(port_dn))
+-			continue;
+-
+-		ret = of_get_phy_mode(port_dn, &mode);
+-		if (ret)
+-			continue;
+-
+-		switch (mode) {
+-		case PHY_INTERFACE_MODE_RGMII:
+-		case PHY_INTERFACE_MODE_RGMII_ID:
+-		case PHY_INTERFACE_MODE_RGMII_TXID:
+-		case PHY_INTERFACE_MODE_RGMII_RXID:
+-		case PHY_INTERFACE_MODE_SGMII:
+-			delay = 0;
+-
+-			if (!of_property_read_u32(port_dn, "tx-internal-delay-ps", &delay))
+-				/* Switch regs accept value in ns, convert ps to ns */
+-				delay = delay / 1000;
+-			else if (mode == PHY_INTERFACE_MODE_RGMII_ID ||
+-				 mode == PHY_INTERFACE_MODE_RGMII_TXID)
+-				delay = 1;
+-
+-			if (!FIELD_FIT(QCA8K_PORT_PAD_RGMII_TX_DELAY_MASK, delay)) {
+-				dev_err(priv->dev, "rgmii tx delay is limited to a max value of 3ns, setting to the max value");
+-				delay = 3;
+-			}
+-
+-			priv->ports_config.rgmii_tx_delay[cpu_port_index] = delay;
+-
+-			delay = 0;
+-
+-			if (!of_property_read_u32(port_dn, "rx-internal-delay-ps", &delay))
+-				/* Switch regs accept value in ns, convert ps to ns */
+-				delay = delay / 1000;
+-			else if (mode == PHY_INTERFACE_MODE_RGMII_ID ||
+-				 mode == PHY_INTERFACE_MODE_RGMII_RXID)
+-				delay = 2;
+-
+-			if (!FIELD_FIT(QCA8K_PORT_PAD_RGMII_RX_DELAY_MASK, delay)) {
+-				dev_err(priv->dev, "rgmii rx delay is limited to a max value of 3ns, setting to the max value");
+-				delay = 3;
+-			}
+-
+-			priv->ports_config.rgmii_rx_delay[cpu_port_index] = delay;
+-
+-			/* Skip sgmii parsing for rgmii* mode */
+-			if (mode == PHY_INTERFACE_MODE_RGMII ||
+-			    mode == PHY_INTERFACE_MODE_RGMII_ID ||
+-			    mode == PHY_INTERFACE_MODE_RGMII_TXID ||
+-			    mode == PHY_INTERFACE_MODE_RGMII_RXID)
+-				break;
+-
+-			if (of_property_read_bool(port_dn, "qca,sgmii-txclk-falling-edge"))
+-				priv->ports_config.sgmii_tx_clk_falling_edge = true;
+-
+-			if (of_property_read_bool(port_dn, "qca,sgmii-rxclk-falling-edge"))
+-				priv->ports_config.sgmii_rx_clk_falling_edge = true;
+-
+-			if (of_property_read_bool(port_dn, "qca,sgmii-enable-pll")) {
+-				priv->ports_config.sgmii_enable_pll = true;
+-
+-				if (priv->switch_id == QCA8K_ID_QCA8327) {
+-					dev_err(priv->dev, "SGMII PLL should NOT be enabled for qca8327. Aborting enabling");
+-					priv->ports_config.sgmii_enable_pll = false;
+-				}
+-
+-				if (priv->switch_revision < 2)
+-					dev_warn(priv->dev, "SGMII PLL should NOT be enabled for qca8337 with revision 2 or more.");
+-			}
+-
+-			break;
+-		default:
+-			continue;
+-		}
+-	}
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_setup(struct dsa_switch *ds)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	int cpu_port, ret, i;
+-	u32 mask;
+-
+-	cpu_port = qca8k_find_cpu_port(ds);
+-	if (cpu_port < 0) {
+-		dev_err(priv->dev, "No cpu port configured in both cpu port0 and port6");
+-		return cpu_port;
+-	}
+-
+-	/* Parse CPU port config to be later used in phy_link mac_config */
+-	ret = qca8k_parse_port_config(priv);
+-	if (ret)
+-		return ret;
+-
+-	ret = qca8k_setup_mdio_bus(priv);
+-	if (ret)
+-		return ret;
+-
+-	ret = qca8k_setup_of_pws_reg(priv);
+-	if (ret)
+-		return ret;
+-
+-	ret = qca8k_setup_mac_pwr_sel(priv);
+-	if (ret)
+-		return ret;
+-
+-	/* Make sure MAC06 is disabled */
+-	ret = regmap_clear_bits(priv->regmap, QCA8K_REG_PORT0_PAD_CTRL,
+-				QCA8K_PORT0_PAD_MAC06_EXCHANGE_EN);
+-	if (ret) {
+-		dev_err(priv->dev, "failed disabling MAC06 exchange");
+-		return ret;
+-	}
+-
+-	/* Enable CPU Port */
+-	ret = regmap_set_bits(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0,
+-			      QCA8K_GLOBAL_FW_CTRL0_CPU_PORT_EN);
+-	if (ret) {
+-		dev_err(priv->dev, "failed enabling CPU port");
+-		return ret;
+-	}
+-
+-	/* Enable MIB counters */
+-	ret = qca8k_mib_init(priv);
+-	if (ret)
+-		dev_warn(priv->dev, "mib init failed");
+-
+-	/* Initial setup of all ports */
+-	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+-		/* Disable forwarding by default on all ports */
+-		ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(i),
+-				QCA8K_PORT_LOOKUP_MEMBER, 0);
+-		if (ret)
+-			return ret;
+-
+-		/* Enable QCA header mode on all cpu ports */
+-		if (dsa_is_cpu_port(ds, i)) {
+-			ret = qca8k_write(priv, QCA8K_REG_PORT_HDR_CTRL(i),
+-					  FIELD_PREP(QCA8K_PORT_HDR_CTRL_TX_MASK, QCA8K_PORT_HDR_CTRL_ALL) |
+-					  FIELD_PREP(QCA8K_PORT_HDR_CTRL_RX_MASK, QCA8K_PORT_HDR_CTRL_ALL));
+-			if (ret) {
+-				dev_err(priv->dev, "failed enabling QCA header mode");
+-				return ret;
+-			}
+-		}
+-
+-		/* Disable MAC by default on all user ports */
+-		if (dsa_is_user_port(ds, i))
+-			qca8k_port_set_status(priv, i, 0);
+-	}
+-
+-	/* Forward all unknown frames to CPU port for Linux processing
+-	 * Notice that in multi-cpu config only one port should be set
+-	 * for igmp, unknown, multicast and broadcast packet
+-	 */
+-	ret = qca8k_write(priv, QCA8K_REG_GLOBAL_FW_CTRL1,
+-			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_IGMP_DP_MASK, BIT(cpu_port)) |
+-			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_BC_DP_MASK, BIT(cpu_port)) |
+-			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_MC_DP_MASK, BIT(cpu_port)) |
+-			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_UC_DP_MASK, BIT(cpu_port)));
+-	if (ret)
+-		return ret;
+-
+-	/* Setup connection between CPU port & user ports
+-	 * Configure specific switch configuration for ports
+-	 */
+-	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+-		/* CPU port gets connected to all user ports of the switch */
+-		if (dsa_is_cpu_port(ds, i)) {
+-			ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(i),
+-					QCA8K_PORT_LOOKUP_MEMBER, dsa_user_ports(ds));
+-			if (ret)
+-				return ret;
+-		}
+-
+-		/* Individual user ports get connected to CPU port only */
+-		if (dsa_is_user_port(ds, i)) {
+-			ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(i),
+-					QCA8K_PORT_LOOKUP_MEMBER,
+-					BIT(cpu_port));
+-			if (ret)
+-				return ret;
+-
+-			/* Enable ARP Auto-learning by default */
+-			ret = regmap_set_bits(priv->regmap, QCA8K_PORT_LOOKUP_CTRL(i),
+-					      QCA8K_PORT_LOOKUP_LEARN);
+-			if (ret)
+-				return ret;
+-
+-			/* For port based vlans to work we need to set the
+-			 * default egress vid
+-			 */
+-			ret = qca8k_rmw(priv, QCA8K_EGRESS_VLAN(i),
+-					QCA8K_EGREES_VLAN_PORT_MASK(i),
+-					QCA8K_EGREES_VLAN_PORT(i, QCA8K_PORT_VID_DEF));
+-			if (ret)
+-				return ret;
+-
+-			ret = qca8k_write(priv, QCA8K_REG_PORT_VLAN_CTRL0(i),
+-					  QCA8K_PORT_VLAN_CVID(QCA8K_PORT_VID_DEF) |
+-					  QCA8K_PORT_VLAN_SVID(QCA8K_PORT_VID_DEF));
+-			if (ret)
+-				return ret;
+-		}
+-
+-		/* The port 5 of the qca8337 have some problem in flood condition. The
+-		 * original legacy driver had some specific buffer and priority settings
+-		 * for the different port suggested by the QCA switch team. Add this
+-		 * missing settings to improve switch stability under load condition.
+-		 * This problem is limited to qca8337 and other qca8k switch are not affected.
+-		 */
+-		if (priv->switch_id == QCA8K_ID_QCA8337) {
+-			switch (i) {
+-			/* The 2 CPU port and port 5 requires some different
+-			 * priority than any other ports.
+-			 */
+-			case 0:
+-			case 5:
+-			case 6:
+-				mask = QCA8K_PORT_HOL_CTRL0_EG_PRI0(0x3) |
+-					QCA8K_PORT_HOL_CTRL0_EG_PRI1(0x4) |
+-					QCA8K_PORT_HOL_CTRL0_EG_PRI2(0x4) |
+-					QCA8K_PORT_HOL_CTRL0_EG_PRI3(0x4) |
+-					QCA8K_PORT_HOL_CTRL0_EG_PRI4(0x6) |
+-					QCA8K_PORT_HOL_CTRL0_EG_PRI5(0x8) |
+-					QCA8K_PORT_HOL_CTRL0_EG_PORT(0x1e);
+-				break;
+-			default:
+-				mask = QCA8K_PORT_HOL_CTRL0_EG_PRI0(0x3) |
+-					QCA8K_PORT_HOL_CTRL0_EG_PRI1(0x4) |
+-					QCA8K_PORT_HOL_CTRL0_EG_PRI2(0x6) |
+-					QCA8K_PORT_HOL_CTRL0_EG_PRI3(0x8) |
+-					QCA8K_PORT_HOL_CTRL0_EG_PORT(0x19);
+-			}
+-			qca8k_write(priv, QCA8K_REG_PORT_HOL_CTRL0(i), mask);
+-
+-			mask = QCA8K_PORT_HOL_CTRL1_ING(0x6) |
+-			QCA8K_PORT_HOL_CTRL1_EG_PRI_BUF_EN |
+-			QCA8K_PORT_HOL_CTRL1_EG_PORT_BUF_EN |
+-			QCA8K_PORT_HOL_CTRL1_WRED_EN;
+-			qca8k_rmw(priv, QCA8K_REG_PORT_HOL_CTRL1(i),
+-				  QCA8K_PORT_HOL_CTRL1_ING_BUF_MASK |
+-				  QCA8K_PORT_HOL_CTRL1_EG_PRI_BUF_EN |
+-				  QCA8K_PORT_HOL_CTRL1_EG_PORT_BUF_EN |
+-				  QCA8K_PORT_HOL_CTRL1_WRED_EN,
+-				  mask);
+-		}
+-	}
+-
+-	/* Special GLOBAL_FC_THRESH value are needed for ar8327 switch */
+-	if (priv->switch_id == QCA8K_ID_QCA8327) {
+-		mask = QCA8K_GLOBAL_FC_GOL_XON_THRES(288) |
+-		       QCA8K_GLOBAL_FC_GOL_XOFF_THRES(496);
+-		qca8k_rmw(priv, QCA8K_REG_GLOBAL_FC_THRESH,
+-			  QCA8K_GLOBAL_FC_GOL_XON_THRES_MASK |
+-			  QCA8K_GLOBAL_FC_GOL_XOFF_THRES_MASK,
+-			  mask);
+-	}
+-
+-	/* Setup our port MTUs to match power on defaults */
+-	ret = qca8k_write(priv, QCA8K_MAX_FRAME_SIZE, ETH_FRAME_LEN + ETH_FCS_LEN);
+-	if (ret)
+-		dev_warn(priv->dev, "failed setting MTU settings");
+-
+-	/* Flush the FDB table */
+-	qca8k_fdb_flush(priv);
+-
+-	/* We don't have interrupts for link changes, so we need to poll */
+-	ds->pcs_poll = true;
+-
+-	/* Set min a max ageing value supported */
+-	ds->ageing_time_min = 7000;
+-	ds->ageing_time_max = 458745000;
+-
+-	/* Set max number of LAGs supported */
+-	ds->num_lag_ids = QCA8K_NUM_LAGS;
+-
+-	return 0;
+-}
+-
+-static void
+-qca8k_mac_config_setup_internal_delay(struct qca8k_priv *priv, int cpu_port_index,
+-				      u32 reg)
+-{
+-	u32 delay, val = 0;
+-	int ret;
+-
+-	/* Delay can be declared in 3 different way.
+-	 * Mode to rgmii and internal-delay standard binding defined
+-	 * rgmii-id or rgmii-tx/rx phy mode set.
+-	 * The parse logic set a delay different than 0 only when one
+-	 * of the 3 different way is used. In all other case delay is
+-	 * not enabled. With ID or TX/RXID delay is enabled and set
+-	 * to the default and recommended value.
+-	 */
+-	if (priv->ports_config.rgmii_tx_delay[cpu_port_index]) {
+-		delay = priv->ports_config.rgmii_tx_delay[cpu_port_index];
+-
+-		val |= QCA8K_PORT_PAD_RGMII_TX_DELAY(delay) |
+-			QCA8K_PORT_PAD_RGMII_TX_DELAY_EN;
+-	}
+-
+-	if (priv->ports_config.rgmii_rx_delay[cpu_port_index]) {
+-		delay = priv->ports_config.rgmii_rx_delay[cpu_port_index];
+-
+-		val |= QCA8K_PORT_PAD_RGMII_RX_DELAY(delay) |
+-			QCA8K_PORT_PAD_RGMII_RX_DELAY_EN;
+-	}
+-
+-	/* Set RGMII delay based on the selected values */
+-	ret = qca8k_rmw(priv, reg,
+-			QCA8K_PORT_PAD_RGMII_TX_DELAY_MASK |
+-			QCA8K_PORT_PAD_RGMII_RX_DELAY_MASK |
+-			QCA8K_PORT_PAD_RGMII_TX_DELAY_EN |
+-			QCA8K_PORT_PAD_RGMII_RX_DELAY_EN,
+-			val);
+-	if (ret)
+-		dev_err(priv->dev, "Failed to set internal delay for CPU port%d",
+-			cpu_port_index == QCA8K_CPU_PORT0 ? 0 : 6);
+-}
+-
+-static void
+-qca8k_phylink_mac_config(struct dsa_switch *ds, int port, unsigned int mode,
+-			 const struct phylink_link_state *state)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	int cpu_port_index, ret;
+-	u32 reg, val;
+-
+-	switch (port) {
+-	case 0: /* 1st CPU port */
+-		if (state->interface != PHY_INTERFACE_MODE_RGMII &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_ID &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_TXID &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_RXID &&
+-		    state->interface != PHY_INTERFACE_MODE_SGMII)
+-			return;
+-
+-		reg = QCA8K_REG_PORT0_PAD_CTRL;
+-		cpu_port_index = QCA8K_CPU_PORT0;
+-		break;
+-	case 1:
+-	case 2:
+-	case 3:
+-	case 4:
+-	case 5:
+-		/* Internal PHY, nothing to do */
+-		return;
+-	case 6: /* 2nd CPU port / external PHY */
+-		if (state->interface != PHY_INTERFACE_MODE_RGMII &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_ID &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_TXID &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_RXID &&
+-		    state->interface != PHY_INTERFACE_MODE_SGMII &&
+-		    state->interface != PHY_INTERFACE_MODE_1000BASEX)
+-			return;
+-
+-		reg = QCA8K_REG_PORT6_PAD_CTRL;
+-		cpu_port_index = QCA8K_CPU_PORT6;
+-		break;
+-	default:
+-		dev_err(ds->dev, "%s: unsupported port: %i\n", __func__, port);
+-		return;
+-	}
+-
+-	if (port != 6 && phylink_autoneg_inband(mode)) {
+-		dev_err(ds->dev, "%s: in-band negotiation unsupported\n",
+-			__func__);
+-		return;
+-	}
+-
+-	switch (state->interface) {
+-	case PHY_INTERFACE_MODE_RGMII:
+-	case PHY_INTERFACE_MODE_RGMII_ID:
+-	case PHY_INTERFACE_MODE_RGMII_TXID:
+-	case PHY_INTERFACE_MODE_RGMII_RXID:
+-		qca8k_write(priv, reg, QCA8K_PORT_PAD_RGMII_EN);
+-
+-		/* Configure rgmii delay */
+-		qca8k_mac_config_setup_internal_delay(priv, cpu_port_index, reg);
+-
+-		/* QCA8337 requires to set rgmii rx delay for all ports.
+-		 * This is enabled through PORT5_PAD_CTRL for all ports,
+-		 * rather than individual port registers.
+-		 */
+-		if (priv->switch_id == QCA8K_ID_QCA8337)
+-			qca8k_write(priv, QCA8K_REG_PORT5_PAD_CTRL,
+-				    QCA8K_PORT_PAD_RGMII_RX_DELAY_EN);
+-		break;
+-	case PHY_INTERFACE_MODE_SGMII:
+-	case PHY_INTERFACE_MODE_1000BASEX:
+-		/* Enable SGMII on the port */
+-		qca8k_write(priv, reg, QCA8K_PORT_PAD_SGMII_EN);
+-
+-		/* Enable/disable SerDes auto-negotiation as necessary */
+-		ret = qca8k_read(priv, QCA8K_REG_PWS, &val);
+-		if (ret)
+-			return;
+-		if (phylink_autoneg_inband(mode))
+-			val &= ~QCA8K_PWS_SERDES_AEN_DIS;
+-		else
+-			val |= QCA8K_PWS_SERDES_AEN_DIS;
+-		qca8k_write(priv, QCA8K_REG_PWS, val);
+-
+-		/* Configure the SGMII parameters */
+-		ret = qca8k_read(priv, QCA8K_REG_SGMII_CTRL, &val);
+-		if (ret)
+-			return;
+-
+-		val |= QCA8K_SGMII_EN_SD;
+-
+-		if (priv->ports_config.sgmii_enable_pll)
+-			val |= QCA8K_SGMII_EN_PLL | QCA8K_SGMII_EN_RX |
+-			       QCA8K_SGMII_EN_TX;
+-
+-		if (dsa_is_cpu_port(ds, port)) {
+-			/* CPU port, we're talking to the CPU MAC, be a PHY */
+-			val &= ~QCA8K_SGMII_MODE_CTRL_MASK;
+-			val |= QCA8K_SGMII_MODE_CTRL_PHY;
+-		} else if (state->interface == PHY_INTERFACE_MODE_SGMII) {
+-			val &= ~QCA8K_SGMII_MODE_CTRL_MASK;
+-			val |= QCA8K_SGMII_MODE_CTRL_MAC;
+-		} else if (state->interface == PHY_INTERFACE_MODE_1000BASEX) {
+-			val &= ~QCA8K_SGMII_MODE_CTRL_MASK;
+-			val |= QCA8K_SGMII_MODE_CTRL_BASEX;
+-		}
+-
+-		qca8k_write(priv, QCA8K_REG_SGMII_CTRL, val);
+-
+-		/* From original code is reported port instability as SGMII also
+-		 * require delay set. Apply advised values here or take them from DT.
+-		 */
+-		if (state->interface == PHY_INTERFACE_MODE_SGMII)
+-			qca8k_mac_config_setup_internal_delay(priv, cpu_port_index, reg);
+-
+-		/* For qca8327/qca8328/qca8334/qca8338 sgmii is unique and
+-		 * falling edge is set writing in the PORT0 PAD reg
+-		 */
+-		if (priv->switch_id == QCA8K_ID_QCA8327 ||
+-		    priv->switch_id == QCA8K_ID_QCA8337)
+-			reg = QCA8K_REG_PORT0_PAD_CTRL;
+-
+-		val = 0;
+-
+-		/* SGMII Clock phase configuration */
+-		if (priv->ports_config.sgmii_rx_clk_falling_edge)
+-			val |= QCA8K_PORT0_PAD_SGMII_RXCLK_FALLING_EDGE;
+-
+-		if (priv->ports_config.sgmii_tx_clk_falling_edge)
+-			val |= QCA8K_PORT0_PAD_SGMII_TXCLK_FALLING_EDGE;
+-
+-		if (val)
+-			ret = qca8k_rmw(priv, reg,
+-					QCA8K_PORT0_PAD_SGMII_RXCLK_FALLING_EDGE |
+-					QCA8K_PORT0_PAD_SGMII_TXCLK_FALLING_EDGE,
+-					val);
+-
+-		break;
+-	default:
+-		dev_err(ds->dev, "xMII mode %s not supported for port %d\n",
+-			phy_modes(state->interface), port);
+-		return;
+-	}
+-}
+-
+-static void
+-qca8k_phylink_validate(struct dsa_switch *ds, int port,
+-		       unsigned long *supported,
+-		       struct phylink_link_state *state)
+-{
+-	__ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
+-
+-	switch (port) {
+-	case 0: /* 1st CPU port */
+-		if (state->interface != PHY_INTERFACE_MODE_NA &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_ID &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_TXID &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_RXID &&
+-		    state->interface != PHY_INTERFACE_MODE_SGMII)
+-			goto unsupported;
+-		break;
+-	case 1:
+-	case 2:
+-	case 3:
+-	case 4:
+-	case 5:
+-		/* Internal PHY */
+-		if (state->interface != PHY_INTERFACE_MODE_NA &&
+-		    state->interface != PHY_INTERFACE_MODE_GMII &&
+-		    state->interface != PHY_INTERFACE_MODE_INTERNAL)
+-			goto unsupported;
+-		break;
+-	case 6: /* 2nd CPU port / external PHY */
+-		if (state->interface != PHY_INTERFACE_MODE_NA &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_ID &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_TXID &&
+-		    state->interface != PHY_INTERFACE_MODE_RGMII_RXID &&
+-		    state->interface != PHY_INTERFACE_MODE_SGMII &&
+-		    state->interface != PHY_INTERFACE_MODE_1000BASEX)
+-			goto unsupported;
+-		break;
+-	default:
+-unsupported:
+-		linkmode_zero(supported);
+-		return;
+-	}
+-
+-	phylink_set_port_modes(mask);
+-	phylink_set(mask, Autoneg);
+-
+-	phylink_set(mask, 1000baseT_Full);
+-	phylink_set(mask, 10baseT_Half);
+-	phylink_set(mask, 10baseT_Full);
+-	phylink_set(mask, 100baseT_Half);
+-	phylink_set(mask, 100baseT_Full);
+-
+-	if (state->interface == PHY_INTERFACE_MODE_1000BASEX)
+-		phylink_set(mask, 1000baseX_Full);
+-
+-	phylink_set(mask, Pause);
+-	phylink_set(mask, Asym_Pause);
+-
+-	linkmode_and(supported, supported, mask);
+-	linkmode_and(state->advertising, state->advertising, mask);
+-}
+-
+-static int
+-qca8k_phylink_mac_link_state(struct dsa_switch *ds, int port,
+-			     struct phylink_link_state *state)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	u32 reg;
+-	int ret;
+-
+-	ret = qca8k_read(priv, QCA8K_REG_PORT_STATUS(port), &reg);
+-	if (ret < 0)
+-		return ret;
+-
+-	state->link = !!(reg & QCA8K_PORT_STATUS_LINK_UP);
+-	state->an_complete = state->link;
+-	state->an_enabled = !!(reg & QCA8K_PORT_STATUS_LINK_AUTO);
+-	state->duplex = (reg & QCA8K_PORT_STATUS_DUPLEX) ? DUPLEX_FULL :
+-							   DUPLEX_HALF;
+-
+-	switch (reg & QCA8K_PORT_STATUS_SPEED) {
+-	case QCA8K_PORT_STATUS_SPEED_10:
+-		state->speed = SPEED_10;
+-		break;
+-	case QCA8K_PORT_STATUS_SPEED_100:
+-		state->speed = SPEED_100;
+-		break;
+-	case QCA8K_PORT_STATUS_SPEED_1000:
+-		state->speed = SPEED_1000;
+-		break;
+-	default:
+-		state->speed = SPEED_UNKNOWN;
+-		break;
+-	}
+-
+-	state->pause = MLO_PAUSE_NONE;
+-	if (reg & QCA8K_PORT_STATUS_RXFLOW)
+-		state->pause |= MLO_PAUSE_RX;
+-	if (reg & QCA8K_PORT_STATUS_TXFLOW)
+-		state->pause |= MLO_PAUSE_TX;
+-
+-	return 1;
+-}
+-
+-static void
+-qca8k_phylink_mac_link_down(struct dsa_switch *ds, int port, unsigned int mode,
+-			    phy_interface_t interface)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-
+-	qca8k_port_set_status(priv, port, 0);
+-}
+-
+-static void
+-qca8k_phylink_mac_link_up(struct dsa_switch *ds, int port, unsigned int mode,
+-			  phy_interface_t interface, struct phy_device *phydev,
+-			  int speed, int duplex, bool tx_pause, bool rx_pause)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	u32 reg;
+-
+-	if (phylink_autoneg_inband(mode)) {
+-		reg = QCA8K_PORT_STATUS_LINK_AUTO;
+-	} else {
+-		switch (speed) {
+-		case SPEED_10:
+-			reg = QCA8K_PORT_STATUS_SPEED_10;
+-			break;
+-		case SPEED_100:
+-			reg = QCA8K_PORT_STATUS_SPEED_100;
+-			break;
+-		case SPEED_1000:
+-			reg = QCA8K_PORT_STATUS_SPEED_1000;
+-			break;
+-		default:
+-			reg = QCA8K_PORT_STATUS_LINK_AUTO;
+-			break;
+-		}
+-
+-		if (duplex == DUPLEX_FULL)
+-			reg |= QCA8K_PORT_STATUS_DUPLEX;
+-
+-		if (rx_pause || dsa_is_cpu_port(ds, port))
+-			reg |= QCA8K_PORT_STATUS_RXFLOW;
+-
+-		if (tx_pause || dsa_is_cpu_port(ds, port))
+-			reg |= QCA8K_PORT_STATUS_TXFLOW;
+-	}
+-
+-	reg |= QCA8K_PORT_STATUS_TXMAC | QCA8K_PORT_STATUS_RXMAC;
+-
+-	qca8k_write(priv, QCA8K_REG_PORT_STATUS(port), reg);
+-}
+-
+-static void
+-qca8k_get_strings(struct dsa_switch *ds, int port, u32 stringset, uint8_t *data)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	int i;
+-
+-	if (stringset != ETH_SS_STATS)
+-		return;
+-
+-	for (i = 0; i < priv->info->mib_count; i++)
+-		strncpy(data + i * ETH_GSTRING_LEN, ar8327_mib[i].name,
+-			ETH_GSTRING_LEN);
+-}
+-
+-static void qca8k_mib_autocast_handler(struct dsa_switch *ds, struct sk_buff *skb)
+-{
+-	struct qca8k_mib_eth_data *mib_eth_data;
+-	struct qca8k_priv *priv = ds->priv;
+-	const struct qca8k_mib_desc *mib;
+-	struct mib_ethhdr *mib_ethhdr;
+-	int i, mib_len, offset = 0;
+-	u64 *data;
+-	u8 port;
+-
+-	mib_ethhdr = (struct mib_ethhdr *)skb_mac_header(skb);
+-	mib_eth_data = &priv->mib_eth_data;
+-
+-	/* The switch autocast every port. Ignore other packet and
+-	 * parse only the requested one.
+-	 */
+-	port = FIELD_GET(QCA_HDR_RECV_SOURCE_PORT, ntohs(mib_ethhdr->hdr));
+-	if (port != mib_eth_data->req_port)
+-		goto exit;
+-
+-	data = mib_eth_data->data;
+-
+-	for (i = 0; i < priv->info->mib_count; i++) {
+-		mib = &ar8327_mib[i];
+-
+-		/* First 3 mib are present in the skb head */
+-		if (i < 3) {
+-			data[i] = mib_ethhdr->data[i];
+-			continue;
+-		}
+-
+-		mib_len = sizeof(uint32_t);
+-
+-		/* Some mib are 64 bit wide */
+-		if (mib->size == 2)
+-			mib_len = sizeof(uint64_t);
+-
+-		/* Copy the mib value from packet to the */
+-		memcpy(data + i, skb->data + offset, mib_len);
+-
+-		/* Set the offset for the next mib */
+-		offset += mib_len;
+-	}
+-
+-exit:
+-	/* Complete on receiving all the mib packet */
+-	if (refcount_dec_and_test(&mib_eth_data->port_parsed))
+-		complete(&mib_eth_data->rw_done);
+-}
+-
+-static int
+-qca8k_get_ethtool_stats_eth(struct dsa_switch *ds, int port, u64 *data)
+-{
+-	struct dsa_port *dp = dsa_to_port(ds, port);
+-	struct qca8k_mib_eth_data *mib_eth_data;
+-	struct qca8k_priv *priv = ds->priv;
+-	int ret;
+-
+-	mib_eth_data = &priv->mib_eth_data;
+-
+-	mutex_lock(&mib_eth_data->mutex);
+-
+-	reinit_completion(&mib_eth_data->rw_done);
+-
+-	mib_eth_data->req_port = dp->index;
+-	mib_eth_data->data = data;
+-	refcount_set(&mib_eth_data->port_parsed, QCA8K_NUM_PORTS);
+-
+-	mutex_lock(&priv->reg_mutex);
+-
+-	/* Send mib autocast request */
+-	ret = regmap_update_bits(priv->regmap, QCA8K_REG_MIB,
+-				 QCA8K_MIB_FUNC | QCA8K_MIB_BUSY,
+-				 FIELD_PREP(QCA8K_MIB_FUNC, QCA8K_MIB_CAST) |
+-				 QCA8K_MIB_BUSY);
+-
+-	mutex_unlock(&priv->reg_mutex);
+-
+-	if (ret)
+-		goto exit;
+-
+-	ret = wait_for_completion_timeout(&mib_eth_data->rw_done, QCA8K_ETHERNET_TIMEOUT);
+-
+-exit:
+-	mutex_unlock(&mib_eth_data->mutex);
+-
+-	return ret;
+-}
+-
+-static void
+-qca8k_get_ethtool_stats(struct dsa_switch *ds, int port,
+-			uint64_t *data)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	const struct qca8k_mib_desc *mib;
+-	u32 reg, i, val;
+-	u32 hi = 0;
+-	int ret;
+-
+-	if (priv->mgmt_master && priv->info->ops->autocast_mib &&
+-	    priv->info->ops->autocast_mib(ds, port, data) > 0)
+-		return;
+-
+-	for (i = 0; i < priv->info->mib_count; i++) {
+-		mib = &ar8327_mib[i];
+-		reg = QCA8K_PORT_MIB_COUNTER(port) + mib->offset;
+-
+-		ret = qca8k_read(priv, reg, &val);
+-		if (ret < 0)
+-			continue;
+-
+-		if (mib->size == 2) {
+-			ret = qca8k_read(priv, reg + 4, &hi);
+-			if (ret < 0)
+-				continue;
+-		}
+-
+-		data[i] = val;
+-		if (mib->size == 2)
+-			data[i] |= (u64)hi << 32;
+-	}
+-}
+-
+-static int
+-qca8k_get_sset_count(struct dsa_switch *ds, int port, int sset)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-
+-	if (sset != ETH_SS_STATS)
+-		return 0;
+-
+-	return priv->info->mib_count;
+-}
+-
+-static int
+-qca8k_set_mac_eee(struct dsa_switch *ds, int port, struct ethtool_eee *eee)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	u32 lpi_en = QCA8K_REG_EEE_CTRL_LPI_EN(port);
+-	u32 reg;
+-	int ret;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	ret = qca8k_read(priv, QCA8K_REG_EEE_CTRL, &reg);
+-	if (ret < 0)
+-		goto exit;
+-
+-	if (eee->eee_enabled)
+-		reg |= lpi_en;
+-	else
+-		reg &= ~lpi_en;
+-	ret = qca8k_write(priv, QCA8K_REG_EEE_CTRL, reg);
+-
+-exit:
+-	mutex_unlock(&priv->reg_mutex);
+-	return ret;
+-}
+-
+-static int
+-qca8k_get_mac_eee(struct dsa_switch *ds, int port, struct ethtool_eee *e)
+-{
+-	/* Nothing to do on the port's MAC */
+-	return 0;
+-}
+-
+-static void
+-qca8k_port_stp_state_set(struct dsa_switch *ds, int port, u8 state)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	u32 stp_state;
+-
+-	switch (state) {
+-	case BR_STATE_DISABLED:
+-		stp_state = QCA8K_PORT_LOOKUP_STATE_DISABLED;
+-		break;
+-	case BR_STATE_BLOCKING:
+-		stp_state = QCA8K_PORT_LOOKUP_STATE_BLOCKING;
+-		break;
+-	case BR_STATE_LISTENING:
+-		stp_state = QCA8K_PORT_LOOKUP_STATE_LISTENING;
+-		break;
+-	case BR_STATE_LEARNING:
+-		stp_state = QCA8K_PORT_LOOKUP_STATE_LEARNING;
+-		break;
+-	case BR_STATE_FORWARDING:
+-	default:
+-		stp_state = QCA8K_PORT_LOOKUP_STATE_FORWARD;
+-		break;
+-	}
+-
+-	qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+-		  QCA8K_PORT_LOOKUP_STATE_MASK, stp_state);
+-}
+-
+-static int
+-qca8k_port_bridge_join(struct dsa_switch *ds, int port, struct net_device *br)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	int port_mask, cpu_port;
+-	int i, ret;
+-
+-	cpu_port = dsa_to_port(ds, port)->cpu_dp->index;
+-	port_mask = BIT(cpu_port);
+-
+-	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+-		if (dsa_is_cpu_port(ds, i))
+-			continue;
+-		if (dsa_to_port(ds, i)->bridge_dev != br)
+-			continue;
+-		/* Add this port to the portvlan mask of the other ports
+-		 * in the bridge
+-		 */
+-		ret = regmap_set_bits(priv->regmap,
+-				      QCA8K_PORT_LOOKUP_CTRL(i),
+-				      BIT(port));
+-		if (ret)
+-			return ret;
+-		if (i != port)
+-			port_mask |= BIT(i);
+-	}
+-
+-	/* Add all other ports to this ports portvlan mask */
+-	ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+-			QCA8K_PORT_LOOKUP_MEMBER, port_mask);
+-
+-	return ret;
+-}
+-
+-static void
+-qca8k_port_bridge_leave(struct dsa_switch *ds, int port, struct net_device *br)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	int cpu_port, i;
+-
+-	cpu_port = dsa_to_port(ds, port)->cpu_dp->index;
+-
+-	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+-		if (dsa_is_cpu_port(ds, i))
+-			continue;
+-		if (dsa_to_port(ds, i)->bridge_dev != br)
+-			continue;
+-		/* Remove this port to the portvlan mask of the other ports
+-		 * in the bridge
+-		 */
+-		regmap_clear_bits(priv->regmap,
+-				  QCA8K_PORT_LOOKUP_CTRL(i),
+-				  BIT(port));
+-	}
+-
+-	/* Set the cpu port to be the only one in the portvlan mask of
+-	 * this port
+-	 */
+-	qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+-		  QCA8K_PORT_LOOKUP_MEMBER, BIT(cpu_port));
+-}
+-
+-static void
+-qca8k_port_fast_age(struct dsa_switch *ds, int port)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	qca8k_fdb_access(priv, QCA8K_FDB_FLUSH_PORT, port);
+-	mutex_unlock(&priv->reg_mutex);
+-}
+-
+-static int
+-qca8k_set_ageing_time(struct dsa_switch *ds, unsigned int msecs)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	unsigned int secs = msecs / 1000;
+-	u32 val;
+-
+-	/* AGE_TIME reg is set in 7s step */
+-	val = secs / 7;
+-
+-	/* Handle case with 0 as val to NOT disable
+-	 * learning
+-	 */
+-	if (!val)
+-		val = 1;
+-
+-	return regmap_update_bits(priv->regmap, QCA8K_REG_ATU_CTRL, QCA8K_ATU_AGE_TIME_MASK,
+-				  QCA8K_ATU_AGE_TIME(val));
+-}
+-
+-static int
+-qca8k_port_enable(struct dsa_switch *ds, int port,
+-		  struct phy_device *phy)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-
+-	qca8k_port_set_status(priv, port, 1);
+-	priv->port_enabled_map |= BIT(port);
+-
+-	if (dsa_is_user_port(ds, port))
+-		phy_support_asym_pause(phy);
+-
+-	return 0;
+-}
+-
+-static void
+-qca8k_port_disable(struct dsa_switch *ds, int port)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-
+-	qca8k_port_set_status(priv, port, 0);
+-	priv->port_enabled_map &= ~BIT(port);
+-}
+-
+-static int
+-qca8k_port_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	int ret;
+-
+-	/* We have only have a general MTU setting.
+-	 * DSA always set the CPU port's MTU to the largest MTU of the slave
+-	 * ports.
+-	 * Setting MTU just for the CPU port is sufficient to correctly set a
+-	 * value for every port.
+-	 */
+-	if (!dsa_is_cpu_port(ds, port))
+-		return 0;
+-
+-	/* To change the MAX_FRAME_SIZE the cpu ports must be off or
+-	 * the switch panics.
+-	 * Turn off both cpu ports before applying the new value to prevent
+-	 * this.
+-	 */
+-	if (priv->port_enabled_map & BIT(0))
+-		qca8k_port_set_status(priv, 0, 0);
+-
+-	if (priv->port_enabled_map & BIT(6))
+-		qca8k_port_set_status(priv, 6, 0);
+-
+-	/* Include L2 header / FCS length */
+-	ret = qca8k_write(priv, QCA8K_MAX_FRAME_SIZE, new_mtu + ETH_HLEN + ETH_FCS_LEN);
+-
+-	if (priv->port_enabled_map & BIT(0))
+-		qca8k_port_set_status(priv, 0, 1);
+-
+-	if (priv->port_enabled_map & BIT(6))
+-		qca8k_port_set_status(priv, 6, 1);
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_port_max_mtu(struct dsa_switch *ds, int port)
+-{
+-	return QCA8K_MAX_MTU;
+-}
+-
+-static int
+-qca8k_port_fdb_insert(struct qca8k_priv *priv, const u8 *addr,
+-		      u16 port_mask, u16 vid)
+-{
+-	/* Set the vid to the port vlan id if no vid is set */
+-	if (!vid)
+-		vid = QCA8K_PORT_VID_DEF;
+-
+-	return qca8k_fdb_add(priv, addr, port_mask, vid,
+-			     QCA8K_ATU_STATUS_STATIC);
+-}
+-
+-static int
+-qca8k_port_fdb_add(struct dsa_switch *ds, int port,
+-		   const unsigned char *addr, u16 vid)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	u16 port_mask = BIT(port);
+-
+-	return qca8k_port_fdb_insert(priv, addr, port_mask, vid);
+-}
+-
+-static int
+-qca8k_port_fdb_del(struct dsa_switch *ds, int port,
+-		   const unsigned char *addr, u16 vid)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	u16 port_mask = BIT(port);
+-
+-	if (!vid)
+-		vid = QCA8K_PORT_VID_DEF;
+-
+-	return qca8k_fdb_del(priv, addr, port_mask, vid);
+-}
+-
+-static int
+-qca8k_port_fdb_dump(struct dsa_switch *ds, int port,
+-		    dsa_fdb_dump_cb_t *cb, void *data)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	struct qca8k_fdb _fdb = { 0 };
+-	int cnt = QCA8K_NUM_FDB_RECORDS;
+-	bool is_static;
+-	int ret = 0;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	while (cnt-- && !qca8k_fdb_next(priv, &_fdb, port)) {
+-		if (!_fdb.aging)
+-			break;
+-		is_static = (_fdb.aging == QCA8K_ATU_STATUS_STATIC);
+-		ret = cb(_fdb.mac, _fdb.vid, is_static, data);
+-		if (ret)
+-			break;
+-	}
+-	mutex_unlock(&priv->reg_mutex);
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_port_mdb_add(struct dsa_switch *ds, int port,
+-		   const struct switchdev_obj_port_mdb *mdb)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	const u8 *addr = mdb->addr;
+-	u16 vid = mdb->vid;
+-
+-	return qca8k_fdb_search_and_insert(priv, BIT(port), addr, vid);
+-}
+-
+-static int
+-qca8k_port_mdb_del(struct dsa_switch *ds, int port,
+-		   const struct switchdev_obj_port_mdb *mdb)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	const u8 *addr = mdb->addr;
+-	u16 vid = mdb->vid;
+-
+-	return qca8k_fdb_search_and_del(priv, BIT(port), addr, vid);
+-}
+-
+-static int
+-qca8k_port_mirror_add(struct dsa_switch *ds, int port,
+-		      struct dsa_mall_mirror_tc_entry *mirror,
+-		      bool ingress)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	int monitor_port, ret;
+-	u32 reg, val;
+-
+-	/* Check for existent entry */
+-	if ((ingress ? priv->mirror_rx : priv->mirror_tx) & BIT(port))
+-		return -EEXIST;
+-
+-	ret = regmap_read(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0, &val);
+-	if (ret)
+-		return ret;
+-
+-	/* QCA83xx can have only one port set to mirror mode.
+-	 * Check that the correct port is requested and return error otherwise.
+-	 * When no mirror port is set, the values is set to 0xF
+-	 */
+-	monitor_port = FIELD_GET(QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, val);
+-	if (monitor_port != 0xF && monitor_port != mirror->to_local_port)
+-		return -EEXIST;
+-
+-	/* Set the monitor port */
+-	val = FIELD_PREP(QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM,
+-			 mirror->to_local_port);
+-	ret = regmap_update_bits(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0,
+-				 QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, val);
+-	if (ret)
+-		return ret;
+-
+-	if (ingress) {
+-		reg = QCA8K_PORT_LOOKUP_CTRL(port);
+-		val = QCA8K_PORT_LOOKUP_ING_MIRROR_EN;
+-	} else {
+-		reg = QCA8K_REG_PORT_HOL_CTRL1(port);
+-		val = QCA8K_PORT_HOL_CTRL1_EG_MIRROR_EN;
+-	}
+-
+-	ret = regmap_update_bits(priv->regmap, reg, val, val);
+-	if (ret)
+-		return ret;
+-
+-	/* Track mirror port for tx and rx to decide when the
+-	 * mirror port has to be disabled.
+-	 */
+-	if (ingress)
+-		priv->mirror_rx |= BIT(port);
+-	else
+-		priv->mirror_tx |= BIT(port);
+-
+-	return 0;
+-}
+-
+-static void
+-qca8k_port_mirror_del(struct dsa_switch *ds, int port,
+-		      struct dsa_mall_mirror_tc_entry *mirror)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	u32 reg, val;
+-	int ret;
+-
+-	if (mirror->ingress) {
+-		reg = QCA8K_PORT_LOOKUP_CTRL(port);
+-		val = QCA8K_PORT_LOOKUP_ING_MIRROR_EN;
+-	} else {
+-		reg = QCA8K_REG_PORT_HOL_CTRL1(port);
+-		val = QCA8K_PORT_HOL_CTRL1_EG_MIRROR_EN;
+-	}
+-
+-	ret = regmap_clear_bits(priv->regmap, reg, val);
+-	if (ret)
+-		goto err;
+-
+-	if (mirror->ingress)
+-		priv->mirror_rx &= ~BIT(port);
+-	else
+-		priv->mirror_tx &= ~BIT(port);
+-
+-	/* No port set to send packet to mirror port. Disable mirror port */
+-	if (!priv->mirror_rx && !priv->mirror_tx) {
+-		val = FIELD_PREP(QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, 0xF);
+-		ret = regmap_update_bits(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0,
+-					 QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, val);
+-		if (ret)
+-			goto err;
+-	}
+-err:
+-	dev_err(priv->dev, "Failed to del mirror port from %d", port);
+-}
+-
+-static int
+-qca8k_port_vlan_filtering(struct dsa_switch *ds, int port, bool vlan_filtering,
+-			  struct netlink_ext_ack *extack)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	int ret;
+-
+-	if (vlan_filtering) {
+-		ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+-				QCA8K_PORT_LOOKUP_VLAN_MODE_MASK,
+-				QCA8K_PORT_LOOKUP_VLAN_MODE_SECURE);
+-	} else {
+-		ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+-				QCA8K_PORT_LOOKUP_VLAN_MODE_MASK,
+-				QCA8K_PORT_LOOKUP_VLAN_MODE_NONE);
+-	}
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_port_vlan_add(struct dsa_switch *ds, int port,
+-		    const struct switchdev_obj_port_vlan *vlan,
+-		    struct netlink_ext_ack *extack)
+-{
+-	bool untagged = vlan->flags & BRIDGE_VLAN_INFO_UNTAGGED;
+-	bool pvid = vlan->flags & BRIDGE_VLAN_INFO_PVID;
+-	struct qca8k_priv *priv = ds->priv;
+-	int ret;
+-
+-	ret = qca8k_vlan_add(priv, port, vlan->vid, untagged);
+-	if (ret) {
+-		dev_err(priv->dev, "Failed to add VLAN to port %d (%d)", port, ret);
+-		return ret;
+-	}
+-
+-	if (pvid) {
+-		ret = qca8k_rmw(priv, QCA8K_EGRESS_VLAN(port),
+-				QCA8K_EGREES_VLAN_PORT_MASK(port),
+-				QCA8K_EGREES_VLAN_PORT(port, vlan->vid));
+-		if (ret)
+-			return ret;
+-
+-		ret = qca8k_write(priv, QCA8K_REG_PORT_VLAN_CTRL0(port),
+-				  QCA8K_PORT_VLAN_CVID(vlan->vid) |
+-				  QCA8K_PORT_VLAN_SVID(vlan->vid));
+-	}
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_port_vlan_del(struct dsa_switch *ds, int port,
+-		    const struct switchdev_obj_port_vlan *vlan)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	int ret;
+-
+-	ret = qca8k_vlan_del(priv, port, vlan->vid);
+-	if (ret)
+-		dev_err(priv->dev, "Failed to delete VLAN from port %d (%d)", port, ret);
+-
+-	return ret;
+-}
+-
+-static u32 qca8k_get_phy_flags(struct dsa_switch *ds, int port)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-
+-	/* Communicate to the phy internal driver the switch revision.
+-	 * Based on the switch revision different values needs to be
+-	 * set to the dbg and mmd reg on the phy.
+-	 * The first 2 bit are used to communicate the switch revision
+-	 * to the phy driver.
+-	 */
+-	if (port > 0 && port < 6)
+-		return priv->switch_revision;
+-
+-	return 0;
+-}
+-
+-static enum dsa_tag_protocol
+-qca8k_get_tag_protocol(struct dsa_switch *ds, int port,
+-		       enum dsa_tag_protocol mp)
+-{
+-	return DSA_TAG_PROTO_QCA;
+-}
+-
+-static bool
+-qca8k_lag_can_offload(struct dsa_switch *ds,
+-		      struct net_device *lag,
+-		      struct netdev_lag_upper_info *info)
+-{
+-	struct dsa_port *dp;
+-	int id, members = 0;
+-
+-	id = dsa_lag_id(ds->dst, lag);
+-	if (id < 0 || id >= ds->num_lag_ids)
+-		return false;
+-
+-	dsa_lag_foreach_port(dp, ds->dst, lag)
+-		/* Includes the port joining the LAG */
+-		members++;
+-
+-	if (members > QCA8K_NUM_PORTS_FOR_LAG)
+-		return false;
+-
+-	if (info->tx_type != NETDEV_LAG_TX_TYPE_HASH)
+-		return false;
+-
+-	if (info->hash_type != NETDEV_LAG_HASH_L2 &&
+-	    info->hash_type != NETDEV_LAG_HASH_L23)
+-		return false;
+-
+-	return true;
+-}
+-
+-static int
+-qca8k_lag_setup_hash(struct dsa_switch *ds,
+-		     struct net_device *lag,
+-		     struct netdev_lag_upper_info *info)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	bool unique_lag = true;
+-	u32 hash = 0;
+-	int i, id;
+-
+-	id = dsa_lag_id(ds->dst, lag);
+-
+-	switch (info->hash_type) {
+-	case NETDEV_LAG_HASH_L23:
+-		hash |= QCA8K_TRUNK_HASH_SIP_EN;
+-		hash |= QCA8K_TRUNK_HASH_DIP_EN;
+-		fallthrough;
+-	case NETDEV_LAG_HASH_L2:
+-		hash |= QCA8K_TRUNK_HASH_SA_EN;
+-		hash |= QCA8K_TRUNK_HASH_DA_EN;
+-		break;
+-	default: /* We should NEVER reach this */
+-		return -EOPNOTSUPP;
+-	}
+-
+-	/* Check if we are the unique configured LAG */
+-	dsa_lags_foreach_id(i, ds->dst)
+-		if (i != id && dsa_lag_dev(ds->dst, i)) {
+-			unique_lag = false;
+-			break;
+-		}
+-
+-	/* Hash Mode is global. Make sure the same Hash Mode
+-	 * is set to all the 4 possible lag.
+-	 * If we are the unique LAG we can set whatever hash
+-	 * mode we want.
+-	 * To change hash mode it's needed to remove all LAG
+-	 * and change the mode with the latest.
+-	 */
+-	if (unique_lag) {
+-		priv->lag_hash_mode = hash;
+-	} else if (priv->lag_hash_mode != hash) {
+-		netdev_err(lag, "Error: Mismateched Hash Mode across different lag is not supported\n");
+-		return -EOPNOTSUPP;
+-	}
+-
+-	return regmap_update_bits(priv->regmap, QCA8K_TRUNK_HASH_EN_CTRL,
+-				  QCA8K_TRUNK_HASH_MASK, hash);
+-}
+-
+-static int
+-qca8k_lag_refresh_portmap(struct dsa_switch *ds, int port,
+-			  struct net_device *lag, bool delete)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	int ret, id, i;
+-	u32 val;
+-
+-	id = dsa_lag_id(ds->dst, lag);
+-
+-	/* Read current port member */
+-	ret = regmap_read(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL0, &val);
+-	if (ret)
+-		return ret;
+-
+-	/* Shift val to the correct trunk */
+-	val >>= QCA8K_REG_GOL_TRUNK_SHIFT(id);
+-	val &= QCA8K_REG_GOL_TRUNK_MEMBER_MASK;
+-	if (delete)
+-		val &= ~BIT(port);
+-	else
+-		val |= BIT(port);
+-
+-	/* Update port member. With empty portmap disable trunk */
+-	ret = regmap_update_bits(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL0,
+-				 QCA8K_REG_GOL_TRUNK_MEMBER(id) |
+-				 QCA8K_REG_GOL_TRUNK_EN(id),
+-				 !val << QCA8K_REG_GOL_TRUNK_SHIFT(id) |
+-				 val << QCA8K_REG_GOL_TRUNK_SHIFT(id));
+-
+-	/* Search empty member if adding or port on deleting */
+-	for (i = 0; i < QCA8K_NUM_PORTS_FOR_LAG; i++) {
+-		ret = regmap_read(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL(id), &val);
+-		if (ret)
+-			return ret;
+-
+-		val >>= QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(id, i);
+-		val &= QCA8K_REG_GOL_TRUNK_ID_MEM_ID_MASK;
+-
+-		if (delete) {
+-			/* If port flagged to be disabled assume this member is
+-			 * empty
+-			 */
+-			if (val != QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN_MASK)
+-				continue;
+-
+-			val &= QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT_MASK;
+-			if (val != port)
+-				continue;
+-		} else {
+-			/* If port flagged to be enabled assume this member is
+-			 * already set
+-			 */
+-			if (val == QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN_MASK)
+-				continue;
+-		}
+-
+-		/* We have found the member to add/remove */
+-		break;
+-	}
+-
+-	/* Set port in the correct port mask or disable port if in delete mode */
+-	return regmap_update_bits(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL(id),
+-				  QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN(id, i) |
+-				  QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT(id, i),
+-				  !delete << QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(id, i) |
+-				  port << QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(id, i));
+-}
+-
+-static int
+-qca8k_port_lag_join(struct dsa_switch *ds, int port,
+-		    struct net_device *lag,
+-		    struct netdev_lag_upper_info *info)
+-{
+-	int ret;
+-
+-	if (!qca8k_lag_can_offload(ds, lag, info))
+-		return -EOPNOTSUPP;
+-
+-	ret = qca8k_lag_setup_hash(ds, lag, info);
+-	if (ret)
+-		return ret;
+-
+-	return qca8k_lag_refresh_portmap(ds, port, lag, false);
+-}
+-
+-static int
+-qca8k_port_lag_leave(struct dsa_switch *ds, int port,
+-		     struct net_device *lag)
+-{
+-	return qca8k_lag_refresh_portmap(ds, port, lag, true);
+-}
+-
+-static void
+-qca8k_master_change(struct dsa_switch *ds, const struct net_device *master,
+-		    bool operational)
+-{
+-	struct dsa_port *dp = master->dsa_ptr;
+-	struct qca8k_priv *priv = ds->priv;
+-
+-	/* Ethernet MIB/MDIO is only supported for CPU port 0 */
+-	if (dp->index != 0)
+-		return;
+-
+-	mutex_lock(&priv->mgmt_eth_data.mutex);
+-	mutex_lock(&priv->mib_eth_data.mutex);
+-
+-	priv->mgmt_master = operational ? (struct net_device *)master : NULL;
+-
+-	mutex_unlock(&priv->mib_eth_data.mutex);
+-	mutex_unlock(&priv->mgmt_eth_data.mutex);
+-}
+-
+-static int qca8k_connect_tag_protocol(struct dsa_switch *ds,
+-				      enum dsa_tag_protocol proto)
+-{
+-	struct qca_tagger_data *tagger_data;
+-
+-	switch (proto) {
+-	case DSA_TAG_PROTO_QCA:
+-		tagger_data = ds->tagger_data;
+-
+-		tagger_data->rw_reg_ack_handler = qca8k_rw_reg_ack_handler;
+-		tagger_data->mib_autocast_handler = qca8k_mib_autocast_handler;
+-
+-		break;
+-	default:
+-		return -EOPNOTSUPP;
+-	}
+-
+-	return 0;
+-}
+-
+-static const struct dsa_switch_ops qca8k_switch_ops = {
+-	.get_tag_protocol	= qca8k_get_tag_protocol,
+-	.setup			= qca8k_setup,
+-	.get_strings		= qca8k_get_strings,
+-	.get_ethtool_stats	= qca8k_get_ethtool_stats,
+-	.get_sset_count		= qca8k_get_sset_count,
+-	.set_ageing_time	= qca8k_set_ageing_time,
+-	.get_mac_eee		= qca8k_get_mac_eee,
+-	.set_mac_eee		= qca8k_set_mac_eee,
+-	.port_enable		= qca8k_port_enable,
+-	.port_disable		= qca8k_port_disable,
+-	.port_change_mtu	= qca8k_port_change_mtu,
+-	.port_max_mtu		= qca8k_port_max_mtu,
+-	.port_stp_state_set	= qca8k_port_stp_state_set,
+-	.port_bridge_join	= qca8k_port_bridge_join,
+-	.port_bridge_leave	= qca8k_port_bridge_leave,
+-	.port_fast_age		= qca8k_port_fast_age,
+-	.port_fdb_add		= qca8k_port_fdb_add,
+-	.port_fdb_del		= qca8k_port_fdb_del,
+-	.port_fdb_dump		= qca8k_port_fdb_dump,
+-	.port_mdb_add		= qca8k_port_mdb_add,
+-	.port_mdb_del		= qca8k_port_mdb_del,
+-	.port_mirror_add	= qca8k_port_mirror_add,
+-	.port_mirror_del	= qca8k_port_mirror_del,
+-	.port_vlan_filtering	= qca8k_port_vlan_filtering,
+-	.port_vlan_add		= qca8k_port_vlan_add,
+-	.port_vlan_del		= qca8k_port_vlan_del,
+-	.phylink_validate	= qca8k_phylink_validate,
+-	.phylink_mac_link_state	= qca8k_phylink_mac_link_state,
+-	.phylink_mac_config	= qca8k_phylink_mac_config,
+-	.phylink_mac_link_down	= qca8k_phylink_mac_link_down,
+-	.phylink_mac_link_up	= qca8k_phylink_mac_link_up,
+-	.get_phy_flags		= qca8k_get_phy_flags,
+-	.port_lag_join		= qca8k_port_lag_join,
+-	.port_lag_leave		= qca8k_port_lag_leave,
+-	.master_state_change	= qca8k_master_change,
+-	.connect_tag_protocol	= qca8k_connect_tag_protocol,
+-};
+-
+-static int qca8k_read_switch_id(struct qca8k_priv *priv)
+-{
+-	u32 val;
+-	u8 id;
+-	int ret;
+-
+-	if (!priv->info)
+-		return -ENODEV;
+-
+-	ret = qca8k_read(priv, QCA8K_REG_MASK_CTRL, &val);
+-	if (ret < 0)
+-		return -ENODEV;
+-
+-	id = QCA8K_MASK_CTRL_DEVICE_ID(val);
+-	if (id != priv->info->id) {
+-		dev_err(priv->dev,
+-			"Switch id detected %x but expected %x",
+-			id, priv->info->id);
+-		return -ENODEV;
+-	}
+-
+-	priv->switch_id = id;
+-
+-	/* Save revision to communicate to the internal PHY driver */
+-	priv->switch_revision = QCA8K_MASK_CTRL_REV_ID(val);
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_sw_probe(struct mdio_device *mdiodev)
+-{
+-	struct qca8k_priv *priv;
+-	int ret;
+-
+-	/* allocate the private data struct so that we can probe the switches
+-	 * ID register
+-	 */
+-	priv = devm_kzalloc(&mdiodev->dev, sizeof(*priv), GFP_KERNEL);
+-	if (!priv)
+-		return -ENOMEM;
+-
+-	priv->info = of_device_get_match_data(priv->dev);
+-	priv->bus = mdiodev->bus;
+-	priv->dev = &mdiodev->dev;
+-
+-	priv->reset_gpio = devm_gpiod_get_optional(priv->dev, "reset",
+-						   GPIOD_ASIS);
+-	if (IS_ERR(priv->reset_gpio))
+-		return PTR_ERR(priv->reset_gpio);
+-
+-	if (priv->reset_gpio) {
+-		gpiod_set_value_cansleep(priv->reset_gpio, 1);
+-		/* The active low duration must be greater than 10 ms
+-		 * and checkpatch.pl wants 20 ms.
+-		 */
+-		msleep(20);
+-		gpiod_set_value_cansleep(priv->reset_gpio, 0);
+-	}
+-
+-	/* Start by setting up the register mapping */
+-	priv->regmap = devm_regmap_init(&mdiodev->dev, NULL, priv,
+-					&qca8k_regmap_config);
+-	if (IS_ERR(priv->regmap)) {
+-		dev_err(priv->dev, "regmap initialization failed");
+-		return PTR_ERR(priv->regmap);
+-	}
+-
+-	priv->mdio_cache.page = 0xffff;
+-	priv->mdio_cache.lo = 0xffff;
+-	priv->mdio_cache.hi = 0xffff;
+-
+-	/* Check the detected switch id */
+-	ret = qca8k_read_switch_id(priv);
+-	if (ret)
+-		return ret;
+-
+-	priv->ds = devm_kzalloc(&mdiodev->dev, sizeof(*priv->ds), GFP_KERNEL);
+-	if (!priv->ds)
+-		return -ENOMEM;
+-
+-	mutex_init(&priv->mgmt_eth_data.mutex);
+-	init_completion(&priv->mgmt_eth_data.rw_done);
+-
+-	mutex_init(&priv->mib_eth_data.mutex);
+-	init_completion(&priv->mib_eth_data.rw_done);
+-
+-	priv->ds->dev = &mdiodev->dev;
+-	priv->ds->num_ports = QCA8K_NUM_PORTS;
+-	priv->ds->priv = priv;
+-	priv->ds->ops = &qca8k_switch_ops;
+-	mutex_init(&priv->reg_mutex);
+-	dev_set_drvdata(&mdiodev->dev, priv);
+-
+-	return dsa_register_switch(priv->ds);
+-}
+-
+-static void
+-qca8k_sw_remove(struct mdio_device *mdiodev)
+-{
+-	struct qca8k_priv *priv = dev_get_drvdata(&mdiodev->dev);
+-	int i;
+-
+-	if (!priv)
+-		return;
+-
+-	for (i = 0; i < QCA8K_NUM_PORTS; i++)
+-		qca8k_port_set_status(priv, i, 0);
+-
+-	dsa_unregister_switch(priv->ds);
+-
+-	dev_set_drvdata(&mdiodev->dev, NULL);
+-}
+-
+-static void qca8k_sw_shutdown(struct mdio_device *mdiodev)
+-{
+-	struct qca8k_priv *priv = dev_get_drvdata(&mdiodev->dev);
+-
+-	if (!priv)
+-		return;
+-
+-	dsa_switch_shutdown(priv->ds);
+-
+-	dev_set_drvdata(&mdiodev->dev, NULL);
+-}
+-
+-#ifdef CONFIG_PM_SLEEP
+-static void
+-qca8k_set_pm(struct qca8k_priv *priv, int enable)
+-{
+-	int port;
+-
+-	for (port = 0; port < QCA8K_NUM_PORTS; port++) {
+-		/* Do not enable on resume if the port was
+-		 * disabled before.
+-		 */
+-		if (!(priv->port_enabled_map & BIT(port)))
+-			continue;
+-
+-		qca8k_port_set_status(priv, port, enable);
+-	}
+-}
+-
+-static int qca8k_suspend(struct device *dev)
+-{
+-	struct qca8k_priv *priv = dev_get_drvdata(dev);
+-
+-	qca8k_set_pm(priv, 0);
+-
+-	return dsa_switch_suspend(priv->ds);
+-}
+-
+-static int qca8k_resume(struct device *dev)
+-{
+-	struct qca8k_priv *priv = dev_get_drvdata(dev);
+-
+-	qca8k_set_pm(priv, 1);
+-
+-	return dsa_switch_resume(priv->ds);
+-}
+-#endif /* CONFIG_PM_SLEEP */
+-
+-static SIMPLE_DEV_PM_OPS(qca8k_pm_ops,
+-			 qca8k_suspend, qca8k_resume);
+-
+-static const struct qca8k_info_ops qca8xxx_ops = {
+-	.autocast_mib = qca8k_get_ethtool_stats_eth,
+-};
+-
+-static const struct qca8k_match_data qca8327 = {
+-	.id = QCA8K_ID_QCA8327,
+-	.reduced_package = true,
+-	.mib_count = QCA8K_QCA832X_MIB_COUNT,
+-	.ops = &qca8xxx_ops,
+-};
+-
+-static const struct qca8k_match_data qca8328 = {
+-	.id = QCA8K_ID_QCA8327,
+-	.mib_count = QCA8K_QCA832X_MIB_COUNT,
+-	.ops = &qca8xxx_ops,
+-};
+-
+-static const struct qca8k_match_data qca833x = {
+-	.id = QCA8K_ID_QCA8337,
+-	.mib_count = QCA8K_QCA833X_MIB_COUNT,
+-	.ops = &qca8xxx_ops,
+-};
+-
+-static const struct of_device_id qca8k_of_match[] = {
+-	{ .compatible = "qca,qca8327", .data = &qca8327 },
+-	{ .compatible = "qca,qca8328", .data = &qca8328 },
+-	{ .compatible = "qca,qca8334", .data = &qca833x },
+-	{ .compatible = "qca,qca8337", .data = &qca833x },
+-	{ /* sentinel */ },
+-};
+-
+-static struct mdio_driver qca8kmdio_driver = {
+-	.probe  = qca8k_sw_probe,
+-	.remove = qca8k_sw_remove,
+-	.shutdown = qca8k_sw_shutdown,
+-	.mdiodrv.driver = {
+-		.name = "qca8k",
+-		.of_match_table = qca8k_of_match,
+-		.pm = &qca8k_pm_ops,
+-	},
+-};
+-
+-mdio_module_driver(qca8kmdio_driver);
+-
+-MODULE_AUTHOR("Mathieu Olivari, John Crispin <john@phrozen.org>");
+-MODULE_DESCRIPTION("Driver for QCA8K ethernet switch family");
+-MODULE_LICENSE("GPL v2");
+-MODULE_ALIAS("platform:qca8k");
+--- /dev/null
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -0,0 +1,3186 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (C) 2009 Felix Fietkau <nbd@nbd.name>
++ * Copyright (C) 2011-2012 Gabor Juhos <juhosg@openwrt.org>
++ * Copyright (c) 2015, 2019, The Linux Foundation. All rights reserved.
++ * Copyright (c) 2016 John Crispin <john@phrozen.org>
++ */
++
++#include <linux/module.h>
++#include <linux/phy.h>
++#include <linux/netdevice.h>
++#include <linux/bitfield.h>
++#include <linux/regmap.h>
++#include <net/dsa.h>
++#include <linux/of_net.h>
++#include <linux/of_mdio.h>
++#include <linux/of_platform.h>
++#include <linux/if_bridge.h>
++#include <linux/mdio.h>
++#include <linux/phylink.h>
++#include <linux/gpio/consumer.h>
++#include <linux/etherdevice.h>
++#include <linux/dsa/tag_qca.h>
++
++#include "qca8k.h"
++
++static void
++qca8k_split_addr(u32 regaddr, u16 *r1, u16 *r2, u16 *page)
++{
++	regaddr >>= 1;
++	*r1 = regaddr & 0x1e;
++
++	regaddr >>= 5;
++	*r2 = regaddr & 0x7;
++
++	regaddr >>= 3;
++	*page = regaddr & 0x3ff;
++}
++
++static int
++qca8k_set_lo(struct qca8k_priv *priv, int phy_id, u32 regnum, u16 lo)
++{
++	u16 *cached_lo = &priv->mdio_cache.lo;
++	struct mii_bus *bus = priv->bus;
++	int ret;
++
++	if (lo == *cached_lo)
++		return 0;
++
++	ret = bus->write(bus, phy_id, regnum, lo);
++	if (ret < 0)
++		dev_err_ratelimited(&bus->dev,
++				    "failed to write qca8k 32bit lo register\n");
++
++	*cached_lo = lo;
++	return 0;
++}
++
++static int
++qca8k_set_hi(struct qca8k_priv *priv, int phy_id, u32 regnum, u16 hi)
++{
++	u16 *cached_hi = &priv->mdio_cache.hi;
++	struct mii_bus *bus = priv->bus;
++	int ret;
++
++	if (hi == *cached_hi)
++		return 0;
++
++	ret = bus->write(bus, phy_id, regnum, hi);
++	if (ret < 0)
++		dev_err_ratelimited(&bus->dev,
++				    "failed to write qca8k 32bit hi register\n");
++
++	*cached_hi = hi;
++	return 0;
++}
++
++static int
++qca8k_mii_read32(struct mii_bus *bus, int phy_id, u32 regnum, u32 *val)
++{
++	int ret;
++
++	ret = bus->read(bus, phy_id, regnum);
++	if (ret >= 0) {
++		*val = ret;
++		ret = bus->read(bus, phy_id, regnum + 1);
++		*val |= ret << 16;
++	}
++
++	if (ret < 0) {
++		dev_err_ratelimited(&bus->dev,
++				    "failed to read qca8k 32bit register\n");
++		*val = 0;
++		return ret;
++	}
++
++	return 0;
++}
++
++static void
++qca8k_mii_write32(struct qca8k_priv *priv, int phy_id, u32 regnum, u32 val)
++{
++	u16 lo, hi;
++	int ret;
++
++	lo = val & 0xffff;
++	hi = (u16)(val >> 16);
++
++	ret = qca8k_set_lo(priv, phy_id, regnum, lo);
++	if (ret >= 0)
++		ret = qca8k_set_hi(priv, phy_id, regnum + 1, hi);
++}
++
++static int
++qca8k_set_page(struct qca8k_priv *priv, u16 page)
++{
++	u16 *cached_page = &priv->mdio_cache.page;
++	struct mii_bus *bus = priv->bus;
++	int ret;
++
++	if (page == *cached_page)
++		return 0;
++
++	ret = bus->write(bus, 0x18, 0, page);
++	if (ret < 0) {
++		dev_err_ratelimited(&bus->dev,
++				    "failed to set qca8k page\n");
++		return ret;
++	}
++
++	*cached_page = page;
++	usleep_range(1000, 2000);
++	return 0;
++}
++
++static int
++qca8k_read(struct qca8k_priv *priv, u32 reg, u32 *val)
++{
++	return regmap_read(priv->regmap, reg, val);
++}
++
++static int
++qca8k_write(struct qca8k_priv *priv, u32 reg, u32 val)
++{
++	return regmap_write(priv->regmap, reg, val);
++}
++
++static int
++qca8k_rmw(struct qca8k_priv *priv, u32 reg, u32 mask, u32 write_val)
++{
++	return regmap_update_bits(priv->regmap, reg, mask, write_val);
++}
++
++static void qca8k_rw_reg_ack_handler(struct dsa_switch *ds, struct sk_buff *skb)
++{
++	struct qca8k_mgmt_eth_data *mgmt_eth_data;
++	struct qca8k_priv *priv = ds->priv;
++	struct qca_mgmt_ethhdr *mgmt_ethhdr;
++	u8 len, cmd;
++
++	mgmt_ethhdr = (struct qca_mgmt_ethhdr *)skb_mac_header(skb);
++	mgmt_eth_data = &priv->mgmt_eth_data;
++
++	cmd = FIELD_GET(QCA_HDR_MGMT_CMD, mgmt_ethhdr->command);
++	len = FIELD_GET(QCA_HDR_MGMT_LENGTH, mgmt_ethhdr->command);
++
++	/* Make sure the seq match the requested packet */
++	if (mgmt_ethhdr->seq == mgmt_eth_data->seq)
++		mgmt_eth_data->ack = true;
++
++	if (cmd == MDIO_READ) {
++		mgmt_eth_data->data[0] = mgmt_ethhdr->mdio_data;
++
++		/* Get the rest of the 12 byte of data.
++		 * The read/write function will extract the requested data.
++		 */
++		if (len > QCA_HDR_MGMT_DATA1_LEN)
++			memcpy(mgmt_eth_data->data + 1, skb->data,
++			       QCA_HDR_MGMT_DATA2_LEN);
++	}
++
++	complete(&mgmt_eth_data->rw_done);
++}
++
++static struct sk_buff *qca8k_alloc_mdio_header(enum mdio_cmd cmd, u32 reg, u32 *val,
++					       int priority, unsigned int len)
++{
++	struct qca_mgmt_ethhdr *mgmt_ethhdr;
++	unsigned int real_len;
++	struct sk_buff *skb;
++	u32 *data2;
++	u16 hdr;
++
++	skb = dev_alloc_skb(QCA_HDR_MGMT_PKT_LEN);
++	if (!skb)
++		return NULL;
++
++	/* Max value for len reg is 15 (0xf) but the switch actually return 16 byte
++	 * Actually for some reason the steps are:
++	 * 0: nothing
++	 * 1-4: first 4 byte
++	 * 5-6: first 12 byte
++	 * 7-15: all 16 byte
++	 */
++	if (len == 16)
++		real_len = 15;
++	else
++		real_len = len;
++
++	skb_reset_mac_header(skb);
++	skb_set_network_header(skb, skb->len);
++
++	mgmt_ethhdr = skb_push(skb, QCA_HDR_MGMT_HEADER_LEN + QCA_HDR_LEN);
++
++	hdr = FIELD_PREP(QCA_HDR_XMIT_VERSION, QCA_HDR_VERSION);
++	hdr |= FIELD_PREP(QCA_HDR_XMIT_PRIORITY, priority);
++	hdr |= QCA_HDR_XMIT_FROM_CPU;
++	hdr |= FIELD_PREP(QCA_HDR_XMIT_DP_BIT, BIT(0));
++	hdr |= FIELD_PREP(QCA_HDR_XMIT_CONTROL, QCA_HDR_XMIT_TYPE_RW_REG);
++
++	mgmt_ethhdr->command = FIELD_PREP(QCA_HDR_MGMT_ADDR, reg);
++	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_LENGTH, real_len);
++	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_CMD, cmd);
++	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_CHECK_CODE,
++					   QCA_HDR_MGMT_CHECK_CODE_VAL);
++
++	if (cmd == MDIO_WRITE)
++		mgmt_ethhdr->mdio_data = *val;
++
++	mgmt_ethhdr->hdr = htons(hdr);
++
++	data2 = skb_put_zero(skb, QCA_HDR_MGMT_DATA2_LEN + QCA_HDR_MGMT_PADDING_LEN);
++	if (cmd == MDIO_WRITE && len > QCA_HDR_MGMT_DATA1_LEN)
++		memcpy(data2, val + 1, len - QCA_HDR_MGMT_DATA1_LEN);
++
++	return skb;
++}
++
++static void qca8k_mdio_header_fill_seq_num(struct sk_buff *skb, u32 seq_num)
++{
++	struct qca_mgmt_ethhdr *mgmt_ethhdr;
++
++	mgmt_ethhdr = (struct qca_mgmt_ethhdr *)skb->data;
++	mgmt_ethhdr->seq = FIELD_PREP(QCA_HDR_MGMT_SEQ_NUM, seq_num);
++}
++
++static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
++{
++	struct qca8k_mgmt_eth_data *mgmt_eth_data = &priv->mgmt_eth_data;
++	struct sk_buff *skb;
++	bool ack;
++	int ret;
++
++	skb = qca8k_alloc_mdio_header(MDIO_READ, reg, NULL,
++				      QCA8K_ETHERNET_MDIO_PRIORITY, len);
++	if (!skb)
++		return -ENOMEM;
++
++	mutex_lock(&mgmt_eth_data->mutex);
++
++	/* Check mgmt_master if is operational */
++	if (!priv->mgmt_master) {
++		kfree_skb(skb);
++		mutex_unlock(&mgmt_eth_data->mutex);
++		return -EINVAL;
++	}
++
++	skb->dev = priv->mgmt_master;
++
++	reinit_completion(&mgmt_eth_data->rw_done);
++
++	/* Increment seq_num and set it in the mdio pkt */
++	mgmt_eth_data->seq++;
++	qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
++	mgmt_eth_data->ack = false;
++
++	dev_queue_xmit(skb);
++
++	ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
++					  msecs_to_jiffies(QCA8K_ETHERNET_TIMEOUT));
++
++	*val = mgmt_eth_data->data[0];
++	if (len > QCA_HDR_MGMT_DATA1_LEN)
++		memcpy(val + 1, mgmt_eth_data->data + 1, len - QCA_HDR_MGMT_DATA1_LEN);
++
++	ack = mgmt_eth_data->ack;
++
++	mutex_unlock(&mgmt_eth_data->mutex);
++
++	if (ret <= 0)
++		return -ETIMEDOUT;
++
++	if (!ack)
++		return -EINVAL;
++
++	return 0;
++}
++
++static int qca8k_write_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
++{
++	struct qca8k_mgmt_eth_data *mgmt_eth_data = &priv->mgmt_eth_data;
++	struct sk_buff *skb;
++	bool ack;
++	int ret;
++
++	skb = qca8k_alloc_mdio_header(MDIO_WRITE, reg, val,
++				      QCA8K_ETHERNET_MDIO_PRIORITY, len);
++	if (!skb)
++		return -ENOMEM;
++
++	mutex_lock(&mgmt_eth_data->mutex);
++
++	/* Check mgmt_master if is operational */
++	if (!priv->mgmt_master) {
++		kfree_skb(skb);
++		mutex_unlock(&mgmt_eth_data->mutex);
++		return -EINVAL;
++	}
++
++	skb->dev = priv->mgmt_master;
++
++	reinit_completion(&mgmt_eth_data->rw_done);
++
++	/* Increment seq_num and set it in the mdio pkt */
++	mgmt_eth_data->seq++;
++	qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
++	mgmt_eth_data->ack = false;
++
++	dev_queue_xmit(skb);
++
++	ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
++					  msecs_to_jiffies(QCA8K_ETHERNET_TIMEOUT));
++
++	ack = mgmt_eth_data->ack;
++
++	mutex_unlock(&mgmt_eth_data->mutex);
++
++	if (ret <= 0)
++		return -ETIMEDOUT;
++
++	if (!ack)
++		return -EINVAL;
++
++	return 0;
++}
++
++static int
++qca8k_regmap_update_bits_eth(struct qca8k_priv *priv, u32 reg, u32 mask, u32 write_val)
++{
++	u32 val = 0;
++	int ret;
++
++	ret = qca8k_read_eth(priv, reg, &val, sizeof(val));
++	if (ret)
++		return ret;
++
++	val &= ~mask;
++	val |= write_val;
++
++	return qca8k_write_eth(priv, reg, &val, sizeof(val));
++}
++
++static int
++qca8k_bulk_read(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
++{
++	int i, count = len / sizeof(u32), ret;
++
++	if (priv->mgmt_master && !qca8k_read_eth(priv, reg, val, len))
++		return 0;
++
++	for (i = 0; i < count; i++) {
++		ret = regmap_read(priv->regmap, reg + (i * 4), val + i);
++		if (ret < 0)
++			return ret;
++	}
++
++	return 0;
++}
++
++static int
++qca8k_bulk_write(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
++{
++	int i, count = len / sizeof(u32), ret;
++	u32 tmp;
++
++	if (priv->mgmt_master && !qca8k_write_eth(priv, reg, val, len))
++		return 0;
++
++	for (i = 0; i < count; i++) {
++		tmp = val[i];
++
++		ret = regmap_write(priv->regmap, reg + (i * 4), tmp);
++		if (ret < 0)
++			return ret;
++	}
++
++	return 0;
++}
++
++static int
++qca8k_regmap_read(void *ctx, uint32_t reg, uint32_t *val)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ctx;
++	struct mii_bus *bus = priv->bus;
++	u16 r1, r2, page;
++	int ret;
++
++	if (!qca8k_read_eth(priv, reg, val, sizeof(*val)))
++		return 0;
++
++	qca8k_split_addr(reg, &r1, &r2, &page);
++
++	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++
++	ret = qca8k_set_page(priv, page);
++	if (ret < 0)
++		goto exit;
++
++	ret = qca8k_mii_read32(bus, 0x10 | r2, r1, val);
++
++exit:
++	mutex_unlock(&bus->mdio_lock);
++	return ret;
++}
++
++static int
++qca8k_regmap_write(void *ctx, uint32_t reg, uint32_t val)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ctx;
++	struct mii_bus *bus = priv->bus;
++	u16 r1, r2, page;
++	int ret;
++
++	if (!qca8k_write_eth(priv, reg, &val, sizeof(val)))
++		return 0;
++
++	qca8k_split_addr(reg, &r1, &r2, &page);
++
++	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++
++	ret = qca8k_set_page(priv, page);
++	if (ret < 0)
++		goto exit;
++
++	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
++
++exit:
++	mutex_unlock(&bus->mdio_lock);
++	return ret;
++}
++
++static int
++qca8k_regmap_update_bits(void *ctx, uint32_t reg, uint32_t mask, uint32_t write_val)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ctx;
++	struct mii_bus *bus = priv->bus;
++	u16 r1, r2, page;
++	u32 val;
++	int ret;
++
++	if (!qca8k_regmap_update_bits_eth(priv, reg, mask, write_val))
++		return 0;
++
++	qca8k_split_addr(reg, &r1, &r2, &page);
++
++	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++
++	ret = qca8k_set_page(priv, page);
++	if (ret < 0)
++		goto exit;
++
++	ret = qca8k_mii_read32(bus, 0x10 | r2, r1, &val);
++	if (ret < 0)
++		goto exit;
++
++	val &= ~mask;
++	val |= write_val;
++	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
++
++exit:
++	mutex_unlock(&bus->mdio_lock);
++
++	return ret;
++}
++
++static const struct regmap_range qca8k_readable_ranges[] = {
++	regmap_reg_range(0x0000, 0x00e4), /* Global control */
++	regmap_reg_range(0x0100, 0x0168), /* EEE control */
++	regmap_reg_range(0x0200, 0x0270), /* Parser control */
++	regmap_reg_range(0x0400, 0x0454), /* ACL */
++	regmap_reg_range(0x0600, 0x0718), /* Lookup */
++	regmap_reg_range(0x0800, 0x0b70), /* QM */
++	regmap_reg_range(0x0c00, 0x0c80), /* PKT */
++	regmap_reg_range(0x0e00, 0x0e98), /* L3 */
++	regmap_reg_range(0x1000, 0x10ac), /* MIB - Port0 */
++	regmap_reg_range(0x1100, 0x11ac), /* MIB - Port1 */
++	regmap_reg_range(0x1200, 0x12ac), /* MIB - Port2 */
++	regmap_reg_range(0x1300, 0x13ac), /* MIB - Port3 */
++	regmap_reg_range(0x1400, 0x14ac), /* MIB - Port4 */
++	regmap_reg_range(0x1500, 0x15ac), /* MIB - Port5 */
++	regmap_reg_range(0x1600, 0x16ac), /* MIB - Port6 */
++
++};
++
++static const struct regmap_access_table qca8k_readable_table = {
++	.yes_ranges = qca8k_readable_ranges,
++	.n_yes_ranges = ARRAY_SIZE(qca8k_readable_ranges),
++};
++
++static struct regmap_config qca8k_regmap_config = {
++	.reg_bits = 16,
++	.val_bits = 32,
++	.reg_stride = 4,
++	.max_register = 0x16ac, /* end MIB - Port6 range */
++	.reg_read = qca8k_regmap_read,
++	.reg_write = qca8k_regmap_write,
++	.reg_update_bits = qca8k_regmap_update_bits,
++	.rd_table = &qca8k_readable_table,
++	.disable_locking = true, /* Locking is handled by qca8k read/write */
++	.cache_type = REGCACHE_NONE, /* Explicitly disable CACHE */
++};
++
++static int
++qca8k_busy_wait(struct qca8k_priv *priv, u32 reg, u32 mask)
++{
++	u32 val;
++
++	return regmap_read_poll_timeout(priv->regmap, reg, val, !(val & mask), 0,
++				       QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC);
++}
++
++static int
++qca8k_fdb_read(struct qca8k_priv *priv, struct qca8k_fdb *fdb)
++{
++	u32 reg[3];
++	int ret;
++
++	/* load the ARL table into an array */
++	ret = qca8k_bulk_read(priv, QCA8K_REG_ATU_DATA0, reg, sizeof(reg));
++	if (ret)
++		return ret;
++
++	/* vid - 83:72 */
++	fdb->vid = FIELD_GET(QCA8K_ATU_VID_MASK, reg[2]);
++	/* aging - 67:64 */
++	fdb->aging = FIELD_GET(QCA8K_ATU_STATUS_MASK, reg[2]);
++	/* portmask - 54:48 */
++	fdb->port_mask = FIELD_GET(QCA8K_ATU_PORT_MASK, reg[1]);
++	/* mac - 47:0 */
++	fdb->mac[0] = FIELD_GET(QCA8K_ATU_ADDR0_MASK, reg[1]);
++	fdb->mac[1] = FIELD_GET(QCA8K_ATU_ADDR1_MASK, reg[1]);
++	fdb->mac[2] = FIELD_GET(QCA8K_ATU_ADDR2_MASK, reg[0]);
++	fdb->mac[3] = FIELD_GET(QCA8K_ATU_ADDR3_MASK, reg[0]);
++	fdb->mac[4] = FIELD_GET(QCA8K_ATU_ADDR4_MASK, reg[0]);
++	fdb->mac[5] = FIELD_GET(QCA8K_ATU_ADDR5_MASK, reg[0]);
++
++	return 0;
++}
++
++static void
++qca8k_fdb_write(struct qca8k_priv *priv, u16 vid, u8 port_mask, const u8 *mac,
++		u8 aging)
++{
++	u32 reg[3] = { 0 };
++
++	/* vid - 83:72 */
++	reg[2] = FIELD_PREP(QCA8K_ATU_VID_MASK, vid);
++	/* aging - 67:64 */
++	reg[2] |= FIELD_PREP(QCA8K_ATU_STATUS_MASK, aging);
++	/* portmask - 54:48 */
++	reg[1] = FIELD_PREP(QCA8K_ATU_PORT_MASK, port_mask);
++	/* mac - 47:0 */
++	reg[1] |= FIELD_PREP(QCA8K_ATU_ADDR0_MASK, mac[0]);
++	reg[1] |= FIELD_PREP(QCA8K_ATU_ADDR1_MASK, mac[1]);
++	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR2_MASK, mac[2]);
++	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR3_MASK, mac[3]);
++	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR4_MASK, mac[4]);
++	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR5_MASK, mac[5]);
++
++	/* load the array into the ARL table */
++	qca8k_bulk_write(priv, QCA8K_REG_ATU_DATA0, reg, sizeof(reg));
++}
++
++static int
++qca8k_fdb_access(struct qca8k_priv *priv, enum qca8k_fdb_cmd cmd, int port)
++{
++	u32 reg;
++	int ret;
++
++	/* Set the command and FDB index */
++	reg = QCA8K_ATU_FUNC_BUSY;
++	reg |= cmd;
++	if (port >= 0) {
++		reg |= QCA8K_ATU_FUNC_PORT_EN;
++		reg |= FIELD_PREP(QCA8K_ATU_FUNC_PORT_MASK, port);
++	}
++
++	/* Write the function register triggering the table access */
++	ret = qca8k_write(priv, QCA8K_REG_ATU_FUNC, reg);
++	if (ret)
++		return ret;
++
++	/* wait for completion */
++	ret = qca8k_busy_wait(priv, QCA8K_REG_ATU_FUNC, QCA8K_ATU_FUNC_BUSY);
++	if (ret)
++		return ret;
++
++	/* Check for table full violation when adding an entry */
++	if (cmd == QCA8K_FDB_LOAD) {
++		ret = qca8k_read(priv, QCA8K_REG_ATU_FUNC, &reg);
++		if (ret < 0)
++			return ret;
++		if (reg & QCA8K_ATU_FUNC_FULL)
++			return -1;
++	}
++
++	return 0;
++}
++
++static int
++qca8k_fdb_next(struct qca8k_priv *priv, struct qca8k_fdb *fdb, int port)
++{
++	int ret;
++
++	qca8k_fdb_write(priv, fdb->vid, fdb->port_mask, fdb->mac, fdb->aging);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_NEXT, port);
++	if (ret < 0)
++		return ret;
++
++	return qca8k_fdb_read(priv, fdb);
++}
++
++static int
++qca8k_fdb_add(struct qca8k_priv *priv, const u8 *mac, u16 port_mask,
++	      u16 vid, u8 aging)
++{
++	int ret;
++
++	mutex_lock(&priv->reg_mutex);
++	qca8k_fdb_write(priv, vid, port_mask, mac, aging);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_LOAD, -1);
++	mutex_unlock(&priv->reg_mutex);
++
++	return ret;
++}
++
++static int
++qca8k_fdb_del(struct qca8k_priv *priv, const u8 *mac, u16 port_mask, u16 vid)
++{
++	int ret;
++
++	mutex_lock(&priv->reg_mutex);
++	qca8k_fdb_write(priv, vid, port_mask, mac, 0);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_PURGE, -1);
++	mutex_unlock(&priv->reg_mutex);
++
++	return ret;
++}
++
++static void
++qca8k_fdb_flush(struct qca8k_priv *priv)
++{
++	mutex_lock(&priv->reg_mutex);
++	qca8k_fdb_access(priv, QCA8K_FDB_FLUSH, -1);
++	mutex_unlock(&priv->reg_mutex);
++}
++
++static int
++qca8k_fdb_search_and_insert(struct qca8k_priv *priv, u8 port_mask,
++			    const u8 *mac, u16 vid)
++{
++	struct qca8k_fdb fdb = { 0 };
++	int ret;
++
++	mutex_lock(&priv->reg_mutex);
++
++	qca8k_fdb_write(priv, vid, 0, mac, 0);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_SEARCH, -1);
++	if (ret < 0)
++		goto exit;
++
++	ret = qca8k_fdb_read(priv, &fdb);
++	if (ret < 0)
++		goto exit;
++
++	/* Rule exist. Delete first */
++	if (!fdb.aging) {
++		ret = qca8k_fdb_access(priv, QCA8K_FDB_PURGE, -1);
++		if (ret)
++			goto exit;
++	}
++
++	/* Add port to fdb portmask */
++	fdb.port_mask |= port_mask;
++
++	qca8k_fdb_write(priv, vid, fdb.port_mask, mac, fdb.aging);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_LOAD, -1);
++
++exit:
++	mutex_unlock(&priv->reg_mutex);
++	return ret;
++}
++
++static int
++qca8k_fdb_search_and_del(struct qca8k_priv *priv, u8 port_mask,
++			 const u8 *mac, u16 vid)
++{
++	struct qca8k_fdb fdb = { 0 };
++	int ret;
++
++	mutex_lock(&priv->reg_mutex);
++
++	qca8k_fdb_write(priv, vid, 0, mac, 0);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_SEARCH, -1);
++	if (ret < 0)
++		goto exit;
++
++	/* Rule doesn't exist. Why delete? */
++	if (!fdb.aging) {
++		ret = -EINVAL;
++		goto exit;
++	}
++
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_PURGE, -1);
++	if (ret)
++		goto exit;
++
++	/* Only port in the rule is this port. Don't re insert */
++	if (fdb.port_mask == port_mask)
++		goto exit;
++
++	/* Remove port from port mask */
++	fdb.port_mask &= ~port_mask;
++
++	qca8k_fdb_write(priv, vid, fdb.port_mask, mac, fdb.aging);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_LOAD, -1);
++
++exit:
++	mutex_unlock(&priv->reg_mutex);
++	return ret;
++}
++
++static int
++qca8k_vlan_access(struct qca8k_priv *priv, enum qca8k_vlan_cmd cmd, u16 vid)
++{
++	u32 reg;
++	int ret;
++
++	/* Set the command and VLAN index */
++	reg = QCA8K_VTU_FUNC1_BUSY;
++	reg |= cmd;
++	reg |= FIELD_PREP(QCA8K_VTU_FUNC1_VID_MASK, vid);
++
++	/* Write the function register triggering the table access */
++	ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC1, reg);
++	if (ret)
++		return ret;
++
++	/* wait for completion */
++	ret = qca8k_busy_wait(priv, QCA8K_REG_VTU_FUNC1, QCA8K_VTU_FUNC1_BUSY);
++	if (ret)
++		return ret;
++
++	/* Check for table full violation when adding an entry */
++	if (cmd == QCA8K_VLAN_LOAD) {
++		ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC1, &reg);
++		if (ret < 0)
++			return ret;
++		if (reg & QCA8K_VTU_FUNC1_FULL)
++			return -ENOMEM;
++	}
++
++	return 0;
++}
++
++static int
++qca8k_vlan_add(struct qca8k_priv *priv, u8 port, u16 vid, bool untagged)
++{
++	u32 reg;
++	int ret;
++
++	/*
++	   We do the right thing with VLAN 0 and treat it as untagged while
++	   preserving the tag on egress.
++	 */
++	if (vid == 0)
++		return 0;
++
++	mutex_lock(&priv->reg_mutex);
++	ret = qca8k_vlan_access(priv, QCA8K_VLAN_READ, vid);
++	if (ret < 0)
++		goto out;
++
++	ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC0, &reg);
++	if (ret < 0)
++		goto out;
++	reg |= QCA8K_VTU_FUNC0_VALID | QCA8K_VTU_FUNC0_IVL_EN;
++	reg &= ~QCA8K_VTU_FUNC0_EG_MODE_PORT_MASK(port);
++	if (untagged)
++		reg |= QCA8K_VTU_FUNC0_EG_MODE_PORT_UNTAG(port);
++	else
++		reg |= QCA8K_VTU_FUNC0_EG_MODE_PORT_TAG(port);
++
++	ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC0, reg);
++	if (ret)
++		goto out;
++	ret = qca8k_vlan_access(priv, QCA8K_VLAN_LOAD, vid);
++
++out:
++	mutex_unlock(&priv->reg_mutex);
++
++	return ret;
++}
++
++static int
++qca8k_vlan_del(struct qca8k_priv *priv, u8 port, u16 vid)
++{
++	u32 reg, mask;
++	int ret, i;
++	bool del;
++
++	mutex_lock(&priv->reg_mutex);
++	ret = qca8k_vlan_access(priv, QCA8K_VLAN_READ, vid);
++	if (ret < 0)
++		goto out;
++
++	ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC0, &reg);
++	if (ret < 0)
++		goto out;
++	reg &= ~QCA8K_VTU_FUNC0_EG_MODE_PORT_MASK(port);
++	reg |= QCA8K_VTU_FUNC0_EG_MODE_PORT_NOT(port);
++
++	/* Check if we're the last member to be removed */
++	del = true;
++	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
++		mask = QCA8K_VTU_FUNC0_EG_MODE_PORT_NOT(i);
++
++		if ((reg & mask) != mask) {
++			del = false;
++			break;
++		}
++	}
++
++	if (del) {
++		ret = qca8k_vlan_access(priv, QCA8K_VLAN_PURGE, vid);
++	} else {
++		ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC0, reg);
++		if (ret)
++			goto out;
++		ret = qca8k_vlan_access(priv, QCA8K_VLAN_LOAD, vid);
++	}
++
++out:
++	mutex_unlock(&priv->reg_mutex);
++
++	return ret;
++}
++
++static int
++qca8k_mib_init(struct qca8k_priv *priv)
++{
++	int ret;
++
++	mutex_lock(&priv->reg_mutex);
++	ret = regmap_update_bits(priv->regmap, QCA8K_REG_MIB,
++				 QCA8K_MIB_FUNC | QCA8K_MIB_BUSY,
++				 FIELD_PREP(QCA8K_MIB_FUNC, QCA8K_MIB_FLUSH) |
++				 QCA8K_MIB_BUSY);
++	if (ret)
++		goto exit;
++
++	ret = qca8k_busy_wait(priv, QCA8K_REG_MIB, QCA8K_MIB_BUSY);
++	if (ret)
++		goto exit;
++
++	ret = regmap_set_bits(priv->regmap, QCA8K_REG_MIB, QCA8K_MIB_CPU_KEEP);
++	if (ret)
++		goto exit;
++
++	ret = qca8k_write(priv, QCA8K_REG_MODULE_EN, QCA8K_MODULE_EN_MIB);
++
++exit:
++	mutex_unlock(&priv->reg_mutex);
++	return ret;
++}
++
++static void
++qca8k_port_set_status(struct qca8k_priv *priv, int port, int enable)
++{
++	u32 mask = QCA8K_PORT_STATUS_TXMAC | QCA8K_PORT_STATUS_RXMAC;
++
++	/* Port 0 and 6 have no internal PHY */
++	if (port > 0 && port < 6)
++		mask |= QCA8K_PORT_STATUS_LINK_AUTO;
++
++	if (enable)
++		regmap_set_bits(priv->regmap, QCA8K_REG_PORT_STATUS(port), mask);
++	else
++		regmap_clear_bits(priv->regmap, QCA8K_REG_PORT_STATUS(port), mask);
++}
++
++static int
++qca8k_phy_eth_busy_wait(struct qca8k_mgmt_eth_data *mgmt_eth_data,
++			struct sk_buff *read_skb, u32 *val)
++{
++	struct sk_buff *skb = skb_copy(read_skb, GFP_KERNEL);
++	bool ack;
++	int ret;
++
++	reinit_completion(&mgmt_eth_data->rw_done);
++
++	/* Increment seq_num and set it in the copy pkt */
++	mgmt_eth_data->seq++;
++	qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
++	mgmt_eth_data->ack = false;
++
++	dev_queue_xmit(skb);
++
++	ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
++					  QCA8K_ETHERNET_TIMEOUT);
++
++	ack = mgmt_eth_data->ack;
++
++	if (ret <= 0)
++		return -ETIMEDOUT;
++
++	if (!ack)
++		return -EINVAL;
++
++	*val = mgmt_eth_data->data[0];
++
++	return 0;
++}
++
++static int
++qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
++		      int regnum, u16 data)
++{
++	struct sk_buff *write_skb, *clear_skb, *read_skb;
++	struct qca8k_mgmt_eth_data *mgmt_eth_data;
++	u32 write_val, clear_val = 0, val;
++	struct net_device *mgmt_master;
++	int ret, ret1;
++	bool ack;
++
++	if (regnum >= QCA8K_MDIO_MASTER_MAX_REG)
++		return -EINVAL;
++
++	mgmt_eth_data = &priv->mgmt_eth_data;
++
++	write_val = QCA8K_MDIO_MASTER_BUSY | QCA8K_MDIO_MASTER_EN |
++		    QCA8K_MDIO_MASTER_PHY_ADDR(phy) |
++		    QCA8K_MDIO_MASTER_REG_ADDR(regnum);
++
++	if (read) {
++		write_val |= QCA8K_MDIO_MASTER_READ;
++	} else {
++		write_val |= QCA8K_MDIO_MASTER_WRITE;
++		write_val |= QCA8K_MDIO_MASTER_DATA(data);
++	}
++
++	/* Prealloc all the needed skb before the lock */
++	write_skb = qca8k_alloc_mdio_header(MDIO_WRITE, QCA8K_MDIO_MASTER_CTRL, &write_val,
++					    QCA8K_ETHERNET_PHY_PRIORITY, sizeof(write_val));
++	if (!write_skb)
++		return -ENOMEM;
++
++	clear_skb = qca8k_alloc_mdio_header(MDIO_WRITE, QCA8K_MDIO_MASTER_CTRL, &clear_val,
++					    QCA8K_ETHERNET_PHY_PRIORITY, sizeof(clear_val));
++	if (!clear_skb) {
++		ret = -ENOMEM;
++		goto err_clear_skb;
++	}
++
++	read_skb = qca8k_alloc_mdio_header(MDIO_READ, QCA8K_MDIO_MASTER_CTRL, &clear_val,
++					   QCA8K_ETHERNET_PHY_PRIORITY, sizeof(clear_val));
++	if (!read_skb) {
++		ret = -ENOMEM;
++		goto err_read_skb;
++	}
++
++	/* Actually start the request:
++	 * 1. Send mdio master packet
++	 * 2. Busy Wait for mdio master command
++	 * 3. Get the data if we are reading
++	 * 4. Reset the mdio master (even with error)
++	 */
++	mutex_lock(&mgmt_eth_data->mutex);
++
++	/* Check if mgmt_master is operational */
++	mgmt_master = priv->mgmt_master;
++	if (!mgmt_master) {
++		mutex_unlock(&mgmt_eth_data->mutex);
++		ret = -EINVAL;
++		goto err_mgmt_master;
++	}
++
++	read_skb->dev = mgmt_master;
++	clear_skb->dev = mgmt_master;
++	write_skb->dev = mgmt_master;
++
++	reinit_completion(&mgmt_eth_data->rw_done);
++
++	/* Increment seq_num and set it in the write pkt */
++	mgmt_eth_data->seq++;
++	qca8k_mdio_header_fill_seq_num(write_skb, mgmt_eth_data->seq);
++	mgmt_eth_data->ack = false;
++
++	dev_queue_xmit(write_skb);
++
++	ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
++					  QCA8K_ETHERNET_TIMEOUT);
++
++	ack = mgmt_eth_data->ack;
++
++	if (ret <= 0) {
++		ret = -ETIMEDOUT;
++		kfree_skb(read_skb);
++		goto exit;
++	}
++
++	if (!ack) {
++		ret = -EINVAL;
++		kfree_skb(read_skb);
++		goto exit;
++	}
++
++	ret = read_poll_timeout(qca8k_phy_eth_busy_wait, ret1,
++				!(val & QCA8K_MDIO_MASTER_BUSY), 0,
++				QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC, false,
++				mgmt_eth_data, read_skb, &val);
++
++	if (ret < 0 && ret1 < 0) {
++		ret = ret1;
++		goto exit;
++	}
++
++	if (read) {
++		reinit_completion(&mgmt_eth_data->rw_done);
++
++		/* Increment seq_num and set it in the read pkt */
++		mgmt_eth_data->seq++;
++		qca8k_mdio_header_fill_seq_num(read_skb, mgmt_eth_data->seq);
++		mgmt_eth_data->ack = false;
++
++		dev_queue_xmit(read_skb);
++
++		ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
++						  QCA8K_ETHERNET_TIMEOUT);
++
++		ack = mgmt_eth_data->ack;
++
++		if (ret <= 0) {
++			ret = -ETIMEDOUT;
++			goto exit;
++		}
++
++		if (!ack) {
++			ret = -EINVAL;
++			goto exit;
++		}
++
++		ret = mgmt_eth_data->data[0] & QCA8K_MDIO_MASTER_DATA_MASK;
++	} else {
++		kfree_skb(read_skb);
++	}
++exit:
++	reinit_completion(&mgmt_eth_data->rw_done);
++
++	/* Increment seq_num and set it in the clear pkt */
++	mgmt_eth_data->seq++;
++	qca8k_mdio_header_fill_seq_num(clear_skb, mgmt_eth_data->seq);
++	mgmt_eth_data->ack = false;
++
++	dev_queue_xmit(clear_skb);
++
++	wait_for_completion_timeout(&mgmt_eth_data->rw_done,
++				    QCA8K_ETHERNET_TIMEOUT);
++
++	mutex_unlock(&mgmt_eth_data->mutex);
++
++	return ret;
++
++	/* Error handling before lock */
++err_mgmt_master:
++	kfree_skb(read_skb);
++err_read_skb:
++	kfree_skb(clear_skb);
++err_clear_skb:
++	kfree_skb(write_skb);
++
++	return ret;
++}
++
++static u32
++qca8k_port_to_phy(int port)
++{
++	/* From Andrew Lunn:
++	 * Port 0 has no internal phy.
++	 * Port 1 has an internal PHY at MDIO address 0.
++	 * Port 2 has an internal PHY at MDIO address 1.
++	 * ...
++	 * Port 5 has an internal PHY at MDIO address 4.
++	 * Port 6 has no internal PHY.
++	 */
++
++	return port - 1;
++}
++
++static int
++qca8k_mdio_busy_wait(struct mii_bus *bus, u32 reg, u32 mask)
++{
++	u16 r1, r2, page;
++	u32 val;
++	int ret, ret1;
++
++	qca8k_split_addr(reg, &r1, &r2, &page);
++
++	ret = read_poll_timeout(qca8k_mii_read32, ret1, !(val & mask), 0,
++				QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC, false,
++				bus, 0x10 | r2, r1, &val);
++
++	/* Check if qca8k_read has failed for a different reason
++	 * before returnting -ETIMEDOUT
++	 */
++	if (ret < 0 && ret1 < 0)
++		return ret1;
++
++	return ret;
++}
++
++static int
++qca8k_mdio_write(struct qca8k_priv *priv, int phy, int regnum, u16 data)
++{
++	struct mii_bus *bus = priv->bus;
++	u16 r1, r2, page;
++	u32 val;
++	int ret;
++
++	if (regnum >= QCA8K_MDIO_MASTER_MAX_REG)
++		return -EINVAL;
++
++	val = QCA8K_MDIO_MASTER_BUSY | QCA8K_MDIO_MASTER_EN |
++	      QCA8K_MDIO_MASTER_WRITE | QCA8K_MDIO_MASTER_PHY_ADDR(phy) |
++	      QCA8K_MDIO_MASTER_REG_ADDR(regnum) |
++	      QCA8K_MDIO_MASTER_DATA(data);
++
++	qca8k_split_addr(QCA8K_MDIO_MASTER_CTRL, &r1, &r2, &page);
++
++	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++
++	ret = qca8k_set_page(priv, page);
++	if (ret)
++		goto exit;
++
++	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
++
++	ret = qca8k_mdio_busy_wait(bus, QCA8K_MDIO_MASTER_CTRL,
++				   QCA8K_MDIO_MASTER_BUSY);
++
++exit:
++	/* even if the busy_wait timeouts try to clear the MASTER_EN */
++	qca8k_mii_write32(priv, 0x10 | r2, r1, 0);
++
++	mutex_unlock(&bus->mdio_lock);
++
++	return ret;
++}
++
++static int
++qca8k_mdio_read(struct qca8k_priv *priv, int phy, int regnum)
++{
++	struct mii_bus *bus = priv->bus;
++	u16 r1, r2, page;
++	u32 val;
++	int ret;
++
++	if (regnum >= QCA8K_MDIO_MASTER_MAX_REG)
++		return -EINVAL;
++
++	val = QCA8K_MDIO_MASTER_BUSY | QCA8K_MDIO_MASTER_EN |
++	      QCA8K_MDIO_MASTER_READ | QCA8K_MDIO_MASTER_PHY_ADDR(phy) |
++	      QCA8K_MDIO_MASTER_REG_ADDR(regnum);
++
++	qca8k_split_addr(QCA8K_MDIO_MASTER_CTRL, &r1, &r2, &page);
++
++	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++
++	ret = qca8k_set_page(priv, page);
++	if (ret)
++		goto exit;
++
++	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
++
++	ret = qca8k_mdio_busy_wait(bus, QCA8K_MDIO_MASTER_CTRL,
++				   QCA8K_MDIO_MASTER_BUSY);
++	if (ret)
++		goto exit;
++
++	ret = qca8k_mii_read32(bus, 0x10 | r2, r1, &val);
++
++exit:
++	/* even if the busy_wait timeouts try to clear the MASTER_EN */
++	qca8k_mii_write32(priv, 0x10 | r2, r1, 0);
++
++	mutex_unlock(&bus->mdio_lock);
++
++	if (ret >= 0)
++		ret = val & QCA8K_MDIO_MASTER_DATA_MASK;
++
++	return ret;
++}
++
++static int
++qca8k_internal_mdio_write(struct mii_bus *slave_bus, int phy, int regnum, u16 data)
++{
++	struct qca8k_priv *priv = slave_bus->priv;
++	int ret;
++
++	/* Use mdio Ethernet when available, fallback to legacy one on error */
++	ret = qca8k_phy_eth_command(priv, false, phy, regnum, data);
++	if (!ret)
++		return 0;
++
++	return qca8k_mdio_write(priv, phy, regnum, data);
++}
++
++static int
++qca8k_internal_mdio_read(struct mii_bus *slave_bus, int phy, int regnum)
++{
++	struct qca8k_priv *priv = slave_bus->priv;
++	int ret;
++
++	/* Use mdio Ethernet when available, fallback to legacy one on error */
++	ret = qca8k_phy_eth_command(priv, true, phy, regnum, 0);
++	if (ret >= 0)
++		return ret;
++
++	ret = qca8k_mdio_read(priv, phy, regnum);
++
++	if (ret < 0)
++		return 0xffff;
++
++	return ret;
++}
++
++static int
++qca8k_legacy_mdio_write(struct mii_bus *slave_bus, int port, int regnum, u16 data)
++{
++	port = qca8k_port_to_phy(port) % PHY_MAX_ADDR;
++
++	return qca8k_internal_mdio_write(slave_bus, port, regnum, data);
++}
++
++static int
++qca8k_legacy_mdio_read(struct mii_bus *slave_bus, int port, int regnum)
++{
++	port = qca8k_port_to_phy(port) % PHY_MAX_ADDR;
++
++	return qca8k_internal_mdio_read(slave_bus, port, regnum);
++}
++
++static int
++qca8k_mdio_register(struct qca8k_priv *priv)
++{
++	struct dsa_switch *ds = priv->ds;
++	struct device_node *mdio;
++	struct mii_bus *bus;
++
++	bus = devm_mdiobus_alloc(ds->dev);
++	if (!bus)
++		return -ENOMEM;
++
++	bus->priv = (void *)priv;
++	snprintf(bus->id, MII_BUS_ID_SIZE, "qca8k-%d.%d",
++		 ds->dst->index, ds->index);
++	bus->parent = ds->dev;
++	bus->phy_mask = ~ds->phys_mii_mask;
++	ds->slave_mii_bus = bus;
++
++	/* Check if the devicetree declare the port:phy mapping */
++	mdio = of_get_child_by_name(priv->dev->of_node, "mdio");
++	if (of_device_is_available(mdio)) {
++		bus->name = "qca8k slave mii";
++		bus->read = qca8k_internal_mdio_read;
++		bus->write = qca8k_internal_mdio_write;
++		return devm_of_mdiobus_register(priv->dev, bus, mdio);
++	}
++
++	/* If a mapping can't be found the legacy mapping is used,
++	 * using the qca8k_port_to_phy function
++	 */
++	bus->name = "qca8k-legacy slave mii";
++	bus->read = qca8k_legacy_mdio_read;
++	bus->write = qca8k_legacy_mdio_write;
++	return devm_mdiobus_register(priv->dev, bus);
++}
++
++static int
++qca8k_setup_mdio_bus(struct qca8k_priv *priv)
++{
++	u32 internal_mdio_mask = 0, external_mdio_mask = 0, reg;
++	struct device_node *ports, *port;
++	phy_interface_t mode;
++	int err;
++
++	ports = of_get_child_by_name(priv->dev->of_node, "ports");
++	if (!ports)
++		ports = of_get_child_by_name(priv->dev->of_node, "ethernet-ports");
++
++	if (!ports)
++		return -EINVAL;
++
++	for_each_available_child_of_node(ports, port) {
++		err = of_property_read_u32(port, "reg", &reg);
++		if (err) {
++			of_node_put(port);
++			of_node_put(ports);
++			return err;
++		}
++
++		if (!dsa_is_user_port(priv->ds, reg))
++			continue;
++
++		of_get_phy_mode(port, &mode);
++
++		if (of_property_read_bool(port, "phy-handle") &&
++		    mode != PHY_INTERFACE_MODE_INTERNAL)
++			external_mdio_mask |= BIT(reg);
++		else
++			internal_mdio_mask |= BIT(reg);
++	}
++
++	of_node_put(ports);
++	if (!external_mdio_mask && !internal_mdio_mask) {
++		dev_err(priv->dev, "no PHYs are defined.\n");
++		return -EINVAL;
++	}
++
++	/* The QCA8K_MDIO_MASTER_EN Bit, which grants access to PHYs through
++	 * the MDIO_MASTER register also _disconnects_ the external MDC
++	 * passthrough to the internal PHYs. It's not possible to use both
++	 * configurations at the same time!
++	 *
++	 * Because this came up during the review process:
++	 * If the external mdio-bus driver is capable magically disabling
++	 * the QCA8K_MDIO_MASTER_EN and mutex/spin-locking out the qca8k's
++	 * accessors for the time being, it would be possible to pull this
++	 * off.
++	 */
++	if (!!external_mdio_mask && !!internal_mdio_mask) {
++		dev_err(priv->dev, "either internal or external mdio bus configuration is supported.\n");
++		return -EINVAL;
++	}
++
++	if (external_mdio_mask) {
++		/* Make sure to disable the internal mdio bus in cases
++		 * a dt-overlay and driver reload changed the configuration
++		 */
++
++		return regmap_clear_bits(priv->regmap, QCA8K_MDIO_MASTER_CTRL,
++					 QCA8K_MDIO_MASTER_EN);
++	}
++
++	return qca8k_mdio_register(priv);
++}
++
++static int
++qca8k_setup_mac_pwr_sel(struct qca8k_priv *priv)
++{
++	u32 mask = 0;
++	int ret = 0;
++
++	/* SoC specific settings for ipq8064.
++	 * If more device require this consider adding
++	 * a dedicated binding.
++	 */
++	if (of_machine_is_compatible("qcom,ipq8064"))
++		mask |= QCA8K_MAC_PWR_RGMII0_1_8V;
++
++	/* SoC specific settings for ipq8065 */
++	if (of_machine_is_compatible("qcom,ipq8065"))
++		mask |= QCA8K_MAC_PWR_RGMII1_1_8V;
++
++	if (mask) {
++		ret = qca8k_rmw(priv, QCA8K_REG_MAC_PWR_SEL,
++				QCA8K_MAC_PWR_RGMII0_1_8V |
++				QCA8K_MAC_PWR_RGMII1_1_8V,
++				mask);
++	}
++
++	return ret;
++}
++
++static int qca8k_find_cpu_port(struct dsa_switch *ds)
++{
++	struct qca8k_priv *priv = ds->priv;
++
++	/* Find the connected cpu port. Valid port are 0 or 6 */
++	if (dsa_is_cpu_port(ds, 0))
++		return 0;
++
++	dev_dbg(priv->dev, "port 0 is not the CPU port. Checking port 6");
++
++	if (dsa_is_cpu_port(ds, 6))
++		return 6;
++
++	return -EINVAL;
++}
++
++static int
++qca8k_setup_of_pws_reg(struct qca8k_priv *priv)
++{
++	const struct qca8k_match_data *data = priv->info;
++	struct device_node *node = priv->dev->of_node;
++	u32 val = 0;
++	int ret;
++
++	/* QCA8327 require to set to the correct mode.
++	 * His bigger brother QCA8328 have the 172 pin layout.
++	 * Should be applied by default but we set this just to make sure.
++	 */
++	if (priv->switch_id == QCA8K_ID_QCA8327) {
++		/* Set the correct package of 148 pin for QCA8327 */
++		if (data->reduced_package)
++			val |= QCA8327_PWS_PACKAGE148_EN;
++
++		ret = qca8k_rmw(priv, QCA8K_REG_PWS, QCA8327_PWS_PACKAGE148_EN,
++				val);
++		if (ret)
++			return ret;
++	}
++
++	if (of_property_read_bool(node, "qca,ignore-power-on-sel"))
++		val |= QCA8K_PWS_POWER_ON_SEL;
++
++	if (of_property_read_bool(node, "qca,led-open-drain")) {
++		if (!(val & QCA8K_PWS_POWER_ON_SEL)) {
++			dev_err(priv->dev, "qca,led-open-drain require qca,ignore-power-on-sel to be set.");
++			return -EINVAL;
++		}
++
++		val |= QCA8K_PWS_LED_OPEN_EN_CSR;
++	}
++
++	return qca8k_rmw(priv, QCA8K_REG_PWS,
++			QCA8K_PWS_LED_OPEN_EN_CSR | QCA8K_PWS_POWER_ON_SEL,
++			val);
++}
++
++static int
++qca8k_parse_port_config(struct qca8k_priv *priv)
++{
++	int port, cpu_port_index = -1, ret;
++	struct device_node *port_dn;
++	phy_interface_t mode;
++	struct dsa_port *dp;
++	u32 delay;
++
++	/* We have 2 CPU port. Check them */
++	for (port = 0; port < QCA8K_NUM_PORTS; port++) {
++		/* Skip every other port */
++		if (port != 0 && port != 6)
++			continue;
++
++		dp = dsa_to_port(priv->ds, port);
++		port_dn = dp->dn;
++		cpu_port_index++;
++
++		if (!of_device_is_available(port_dn))
++			continue;
++
++		ret = of_get_phy_mode(port_dn, &mode);
++		if (ret)
++			continue;
++
++		switch (mode) {
++		case PHY_INTERFACE_MODE_RGMII:
++		case PHY_INTERFACE_MODE_RGMII_ID:
++		case PHY_INTERFACE_MODE_RGMII_TXID:
++		case PHY_INTERFACE_MODE_RGMII_RXID:
++		case PHY_INTERFACE_MODE_SGMII:
++			delay = 0;
++
++			if (!of_property_read_u32(port_dn, "tx-internal-delay-ps", &delay))
++				/* Switch regs accept value in ns, convert ps to ns */
++				delay = delay / 1000;
++			else if (mode == PHY_INTERFACE_MODE_RGMII_ID ||
++				 mode == PHY_INTERFACE_MODE_RGMII_TXID)
++				delay = 1;
++
++			if (!FIELD_FIT(QCA8K_PORT_PAD_RGMII_TX_DELAY_MASK, delay)) {
++				dev_err(priv->dev, "rgmii tx delay is limited to a max value of 3ns, setting to the max value");
++				delay = 3;
++			}
++
++			priv->ports_config.rgmii_tx_delay[cpu_port_index] = delay;
++
++			delay = 0;
++
++			if (!of_property_read_u32(port_dn, "rx-internal-delay-ps", &delay))
++				/* Switch regs accept value in ns, convert ps to ns */
++				delay = delay / 1000;
++			else if (mode == PHY_INTERFACE_MODE_RGMII_ID ||
++				 mode == PHY_INTERFACE_MODE_RGMII_RXID)
++				delay = 2;
++
++			if (!FIELD_FIT(QCA8K_PORT_PAD_RGMII_RX_DELAY_MASK, delay)) {
++				dev_err(priv->dev, "rgmii rx delay is limited to a max value of 3ns, setting to the max value");
++				delay = 3;
++			}
++
++			priv->ports_config.rgmii_rx_delay[cpu_port_index] = delay;
++
++			/* Skip sgmii parsing for rgmii* mode */
++			if (mode == PHY_INTERFACE_MODE_RGMII ||
++			    mode == PHY_INTERFACE_MODE_RGMII_ID ||
++			    mode == PHY_INTERFACE_MODE_RGMII_TXID ||
++			    mode == PHY_INTERFACE_MODE_RGMII_RXID)
++				break;
++
++			if (of_property_read_bool(port_dn, "qca,sgmii-txclk-falling-edge"))
++				priv->ports_config.sgmii_tx_clk_falling_edge = true;
++
++			if (of_property_read_bool(port_dn, "qca,sgmii-rxclk-falling-edge"))
++				priv->ports_config.sgmii_rx_clk_falling_edge = true;
++
++			if (of_property_read_bool(port_dn, "qca,sgmii-enable-pll")) {
++				priv->ports_config.sgmii_enable_pll = true;
++
++				if (priv->switch_id == QCA8K_ID_QCA8327) {
++					dev_err(priv->dev, "SGMII PLL should NOT be enabled for qca8327. Aborting enabling");
++					priv->ports_config.sgmii_enable_pll = false;
++				}
++
++				if (priv->switch_revision < 2)
++					dev_warn(priv->dev, "SGMII PLL should NOT be enabled for qca8337 with revision 2 or more.");
++			}
++
++			break;
++		default:
++			continue;
++		}
++	}
++
++	return 0;
++}
++
++static int
++qca8k_setup(struct dsa_switch *ds)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	int cpu_port, ret, i;
++	u32 mask;
++
++	cpu_port = qca8k_find_cpu_port(ds);
++	if (cpu_port < 0) {
++		dev_err(priv->dev, "No cpu port configured in both cpu port0 and port6");
++		return cpu_port;
++	}
++
++	/* Parse CPU port config to be later used in phy_link mac_config */
++	ret = qca8k_parse_port_config(priv);
++	if (ret)
++		return ret;
++
++	ret = qca8k_setup_mdio_bus(priv);
++	if (ret)
++		return ret;
++
++	ret = qca8k_setup_of_pws_reg(priv);
++	if (ret)
++		return ret;
++
++	ret = qca8k_setup_mac_pwr_sel(priv);
++	if (ret)
++		return ret;
++
++	/* Make sure MAC06 is disabled */
++	ret = regmap_clear_bits(priv->regmap, QCA8K_REG_PORT0_PAD_CTRL,
++				QCA8K_PORT0_PAD_MAC06_EXCHANGE_EN);
++	if (ret) {
++		dev_err(priv->dev, "failed disabling MAC06 exchange");
++		return ret;
++	}
++
++	/* Enable CPU Port */
++	ret = regmap_set_bits(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0,
++			      QCA8K_GLOBAL_FW_CTRL0_CPU_PORT_EN);
++	if (ret) {
++		dev_err(priv->dev, "failed enabling CPU port");
++		return ret;
++	}
++
++	/* Enable MIB counters */
++	ret = qca8k_mib_init(priv);
++	if (ret)
++		dev_warn(priv->dev, "mib init failed");
++
++	/* Initial setup of all ports */
++	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
++		/* Disable forwarding by default on all ports */
++		ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(i),
++				QCA8K_PORT_LOOKUP_MEMBER, 0);
++		if (ret)
++			return ret;
++
++		/* Enable QCA header mode on all cpu ports */
++		if (dsa_is_cpu_port(ds, i)) {
++			ret = qca8k_write(priv, QCA8K_REG_PORT_HDR_CTRL(i),
++					  FIELD_PREP(QCA8K_PORT_HDR_CTRL_TX_MASK, QCA8K_PORT_HDR_CTRL_ALL) |
++					  FIELD_PREP(QCA8K_PORT_HDR_CTRL_RX_MASK, QCA8K_PORT_HDR_CTRL_ALL));
++			if (ret) {
++				dev_err(priv->dev, "failed enabling QCA header mode");
++				return ret;
++			}
++		}
++
++		/* Disable MAC by default on all user ports */
++		if (dsa_is_user_port(ds, i))
++			qca8k_port_set_status(priv, i, 0);
++	}
++
++	/* Forward all unknown frames to CPU port for Linux processing
++	 * Notice that in multi-cpu config only one port should be set
++	 * for igmp, unknown, multicast and broadcast packet
++	 */
++	ret = qca8k_write(priv, QCA8K_REG_GLOBAL_FW_CTRL1,
++			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_IGMP_DP_MASK, BIT(cpu_port)) |
++			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_BC_DP_MASK, BIT(cpu_port)) |
++			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_MC_DP_MASK, BIT(cpu_port)) |
++			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_UC_DP_MASK, BIT(cpu_port)));
++	if (ret)
++		return ret;
++
++	/* Setup connection between CPU port & user ports
++	 * Configure specific switch configuration for ports
++	 */
++	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
++		/* CPU port gets connected to all user ports of the switch */
++		if (dsa_is_cpu_port(ds, i)) {
++			ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(i),
++					QCA8K_PORT_LOOKUP_MEMBER, dsa_user_ports(ds));
++			if (ret)
++				return ret;
++		}
++
++		/* Individual user ports get connected to CPU port only */
++		if (dsa_is_user_port(ds, i)) {
++			ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(i),
++					QCA8K_PORT_LOOKUP_MEMBER,
++					BIT(cpu_port));
++			if (ret)
++				return ret;
++
++			/* Enable ARP Auto-learning by default */
++			ret = regmap_set_bits(priv->regmap, QCA8K_PORT_LOOKUP_CTRL(i),
++					      QCA8K_PORT_LOOKUP_LEARN);
++			if (ret)
++				return ret;
++
++			/* For port based vlans to work we need to set the
++			 * default egress vid
++			 */
++			ret = qca8k_rmw(priv, QCA8K_EGRESS_VLAN(i),
++					QCA8K_EGREES_VLAN_PORT_MASK(i),
++					QCA8K_EGREES_VLAN_PORT(i, QCA8K_PORT_VID_DEF));
++			if (ret)
++				return ret;
++
++			ret = qca8k_write(priv, QCA8K_REG_PORT_VLAN_CTRL0(i),
++					  QCA8K_PORT_VLAN_CVID(QCA8K_PORT_VID_DEF) |
++					  QCA8K_PORT_VLAN_SVID(QCA8K_PORT_VID_DEF));
++			if (ret)
++				return ret;
++		}
++
++		/* The port 5 of the qca8337 have some problem in flood condition. The
++		 * original legacy driver had some specific buffer and priority settings
++		 * for the different port suggested by the QCA switch team. Add this
++		 * missing settings to improve switch stability under load condition.
++		 * This problem is limited to qca8337 and other qca8k switch are not affected.
++		 */
++		if (priv->switch_id == QCA8K_ID_QCA8337) {
++			switch (i) {
++			/* The 2 CPU port and port 5 requires some different
++			 * priority than any other ports.
++			 */
++			case 0:
++			case 5:
++			case 6:
++				mask = QCA8K_PORT_HOL_CTRL0_EG_PRI0(0x3) |
++					QCA8K_PORT_HOL_CTRL0_EG_PRI1(0x4) |
++					QCA8K_PORT_HOL_CTRL0_EG_PRI2(0x4) |
++					QCA8K_PORT_HOL_CTRL0_EG_PRI3(0x4) |
++					QCA8K_PORT_HOL_CTRL0_EG_PRI4(0x6) |
++					QCA8K_PORT_HOL_CTRL0_EG_PRI5(0x8) |
++					QCA8K_PORT_HOL_CTRL0_EG_PORT(0x1e);
++				break;
++			default:
++				mask = QCA8K_PORT_HOL_CTRL0_EG_PRI0(0x3) |
++					QCA8K_PORT_HOL_CTRL0_EG_PRI1(0x4) |
++					QCA8K_PORT_HOL_CTRL0_EG_PRI2(0x6) |
++					QCA8K_PORT_HOL_CTRL0_EG_PRI3(0x8) |
++					QCA8K_PORT_HOL_CTRL0_EG_PORT(0x19);
++			}
++			qca8k_write(priv, QCA8K_REG_PORT_HOL_CTRL0(i), mask);
++
++			mask = QCA8K_PORT_HOL_CTRL1_ING(0x6) |
++			QCA8K_PORT_HOL_CTRL1_EG_PRI_BUF_EN |
++			QCA8K_PORT_HOL_CTRL1_EG_PORT_BUF_EN |
++			QCA8K_PORT_HOL_CTRL1_WRED_EN;
++			qca8k_rmw(priv, QCA8K_REG_PORT_HOL_CTRL1(i),
++				  QCA8K_PORT_HOL_CTRL1_ING_BUF_MASK |
++				  QCA8K_PORT_HOL_CTRL1_EG_PRI_BUF_EN |
++				  QCA8K_PORT_HOL_CTRL1_EG_PORT_BUF_EN |
++				  QCA8K_PORT_HOL_CTRL1_WRED_EN,
++				  mask);
++		}
++	}
++
++	/* Special GLOBAL_FC_THRESH value are needed for ar8327 switch */
++	if (priv->switch_id == QCA8K_ID_QCA8327) {
++		mask = QCA8K_GLOBAL_FC_GOL_XON_THRES(288) |
++		       QCA8K_GLOBAL_FC_GOL_XOFF_THRES(496);
++		qca8k_rmw(priv, QCA8K_REG_GLOBAL_FC_THRESH,
++			  QCA8K_GLOBAL_FC_GOL_XON_THRES_MASK |
++			  QCA8K_GLOBAL_FC_GOL_XOFF_THRES_MASK,
++			  mask);
++	}
++
++	/* Setup our port MTUs to match power on defaults */
++	ret = qca8k_write(priv, QCA8K_MAX_FRAME_SIZE, ETH_FRAME_LEN + ETH_FCS_LEN);
++	if (ret)
++		dev_warn(priv->dev, "failed setting MTU settings");
++
++	/* Flush the FDB table */
++	qca8k_fdb_flush(priv);
++
++	/* We don't have interrupts for link changes, so we need to poll */
++	ds->pcs_poll = true;
++
++	/* Set min a max ageing value supported */
++	ds->ageing_time_min = 7000;
++	ds->ageing_time_max = 458745000;
++
++	/* Set max number of LAGs supported */
++	ds->num_lag_ids = QCA8K_NUM_LAGS;
++
++	return 0;
++}
++
++static void
++qca8k_mac_config_setup_internal_delay(struct qca8k_priv *priv, int cpu_port_index,
++				      u32 reg)
++{
++	u32 delay, val = 0;
++	int ret;
++
++	/* Delay can be declared in 3 different way.
++	 * Mode to rgmii and internal-delay standard binding defined
++	 * rgmii-id or rgmii-tx/rx phy mode set.
++	 * The parse logic set a delay different than 0 only when one
++	 * of the 3 different way is used. In all other case delay is
++	 * not enabled. With ID or TX/RXID delay is enabled and set
++	 * to the default and recommended value.
++	 */
++	if (priv->ports_config.rgmii_tx_delay[cpu_port_index]) {
++		delay = priv->ports_config.rgmii_tx_delay[cpu_port_index];
++
++		val |= QCA8K_PORT_PAD_RGMII_TX_DELAY(delay) |
++			QCA8K_PORT_PAD_RGMII_TX_DELAY_EN;
++	}
++
++	if (priv->ports_config.rgmii_rx_delay[cpu_port_index]) {
++		delay = priv->ports_config.rgmii_rx_delay[cpu_port_index];
++
++		val |= QCA8K_PORT_PAD_RGMII_RX_DELAY(delay) |
++			QCA8K_PORT_PAD_RGMII_RX_DELAY_EN;
++	}
++
++	/* Set RGMII delay based on the selected values */
++	ret = qca8k_rmw(priv, reg,
++			QCA8K_PORT_PAD_RGMII_TX_DELAY_MASK |
++			QCA8K_PORT_PAD_RGMII_RX_DELAY_MASK |
++			QCA8K_PORT_PAD_RGMII_TX_DELAY_EN |
++			QCA8K_PORT_PAD_RGMII_RX_DELAY_EN,
++			val);
++	if (ret)
++		dev_err(priv->dev, "Failed to set internal delay for CPU port%d",
++			cpu_port_index == QCA8K_CPU_PORT0 ? 0 : 6);
++}
++
++static void
++qca8k_phylink_mac_config(struct dsa_switch *ds, int port, unsigned int mode,
++			 const struct phylink_link_state *state)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int cpu_port_index, ret;
++	u32 reg, val;
++
++	switch (port) {
++	case 0: /* 1st CPU port */
++		if (state->interface != PHY_INTERFACE_MODE_RGMII &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_ID &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_TXID &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_RXID &&
++		    state->interface != PHY_INTERFACE_MODE_SGMII)
++			return;
++
++		reg = QCA8K_REG_PORT0_PAD_CTRL;
++		cpu_port_index = QCA8K_CPU_PORT0;
++		break;
++	case 1:
++	case 2:
++	case 3:
++	case 4:
++	case 5:
++		/* Internal PHY, nothing to do */
++		return;
++	case 6: /* 2nd CPU port / external PHY */
++		if (state->interface != PHY_INTERFACE_MODE_RGMII &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_ID &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_TXID &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_RXID &&
++		    state->interface != PHY_INTERFACE_MODE_SGMII &&
++		    state->interface != PHY_INTERFACE_MODE_1000BASEX)
++			return;
++
++		reg = QCA8K_REG_PORT6_PAD_CTRL;
++		cpu_port_index = QCA8K_CPU_PORT6;
++		break;
++	default:
++		dev_err(ds->dev, "%s: unsupported port: %i\n", __func__, port);
++		return;
++	}
++
++	if (port != 6 && phylink_autoneg_inband(mode)) {
++		dev_err(ds->dev, "%s: in-band negotiation unsupported\n",
++			__func__);
++		return;
++	}
++
++	switch (state->interface) {
++	case PHY_INTERFACE_MODE_RGMII:
++	case PHY_INTERFACE_MODE_RGMII_ID:
++	case PHY_INTERFACE_MODE_RGMII_TXID:
++	case PHY_INTERFACE_MODE_RGMII_RXID:
++		qca8k_write(priv, reg, QCA8K_PORT_PAD_RGMII_EN);
++
++		/* Configure rgmii delay */
++		qca8k_mac_config_setup_internal_delay(priv, cpu_port_index, reg);
++
++		/* QCA8337 requires to set rgmii rx delay for all ports.
++		 * This is enabled through PORT5_PAD_CTRL for all ports,
++		 * rather than individual port registers.
++		 */
++		if (priv->switch_id == QCA8K_ID_QCA8337)
++			qca8k_write(priv, QCA8K_REG_PORT5_PAD_CTRL,
++				    QCA8K_PORT_PAD_RGMII_RX_DELAY_EN);
++		break;
++	case PHY_INTERFACE_MODE_SGMII:
++	case PHY_INTERFACE_MODE_1000BASEX:
++		/* Enable SGMII on the port */
++		qca8k_write(priv, reg, QCA8K_PORT_PAD_SGMII_EN);
++
++		/* Enable/disable SerDes auto-negotiation as necessary */
++		ret = qca8k_read(priv, QCA8K_REG_PWS, &val);
++		if (ret)
++			return;
++		if (phylink_autoneg_inband(mode))
++			val &= ~QCA8K_PWS_SERDES_AEN_DIS;
++		else
++			val |= QCA8K_PWS_SERDES_AEN_DIS;
++		qca8k_write(priv, QCA8K_REG_PWS, val);
++
++		/* Configure the SGMII parameters */
++		ret = qca8k_read(priv, QCA8K_REG_SGMII_CTRL, &val);
++		if (ret)
++			return;
++
++		val |= QCA8K_SGMII_EN_SD;
++
++		if (priv->ports_config.sgmii_enable_pll)
++			val |= QCA8K_SGMII_EN_PLL | QCA8K_SGMII_EN_RX |
++			       QCA8K_SGMII_EN_TX;
++
++		if (dsa_is_cpu_port(ds, port)) {
++			/* CPU port, we're talking to the CPU MAC, be a PHY */
++			val &= ~QCA8K_SGMII_MODE_CTRL_MASK;
++			val |= QCA8K_SGMII_MODE_CTRL_PHY;
++		} else if (state->interface == PHY_INTERFACE_MODE_SGMII) {
++			val &= ~QCA8K_SGMII_MODE_CTRL_MASK;
++			val |= QCA8K_SGMII_MODE_CTRL_MAC;
++		} else if (state->interface == PHY_INTERFACE_MODE_1000BASEX) {
++			val &= ~QCA8K_SGMII_MODE_CTRL_MASK;
++			val |= QCA8K_SGMII_MODE_CTRL_BASEX;
++		}
++
++		qca8k_write(priv, QCA8K_REG_SGMII_CTRL, val);
++
++		/* From original code is reported port instability as SGMII also
++		 * require delay set. Apply advised values here or take them from DT.
++		 */
++		if (state->interface == PHY_INTERFACE_MODE_SGMII)
++			qca8k_mac_config_setup_internal_delay(priv, cpu_port_index, reg);
++
++		/* For qca8327/qca8328/qca8334/qca8338 sgmii is unique and
++		 * falling edge is set writing in the PORT0 PAD reg
++		 */
++		if (priv->switch_id == QCA8K_ID_QCA8327 ||
++		    priv->switch_id == QCA8K_ID_QCA8337)
++			reg = QCA8K_REG_PORT0_PAD_CTRL;
++
++		val = 0;
++
++		/* SGMII Clock phase configuration */
++		if (priv->ports_config.sgmii_rx_clk_falling_edge)
++			val |= QCA8K_PORT0_PAD_SGMII_RXCLK_FALLING_EDGE;
++
++		if (priv->ports_config.sgmii_tx_clk_falling_edge)
++			val |= QCA8K_PORT0_PAD_SGMII_TXCLK_FALLING_EDGE;
++
++		if (val)
++			ret = qca8k_rmw(priv, reg,
++					QCA8K_PORT0_PAD_SGMII_RXCLK_FALLING_EDGE |
++					QCA8K_PORT0_PAD_SGMII_TXCLK_FALLING_EDGE,
++					val);
++
++		break;
++	default:
++		dev_err(ds->dev, "xMII mode %s not supported for port %d\n",
++			phy_modes(state->interface), port);
++		return;
++	}
++}
++
++static void
++qca8k_phylink_validate(struct dsa_switch *ds, int port,
++		       unsigned long *supported,
++		       struct phylink_link_state *state)
++{
++	__ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
++
++	switch (port) {
++	case 0: /* 1st CPU port */
++		if (state->interface != PHY_INTERFACE_MODE_NA &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_ID &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_TXID &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_RXID &&
++		    state->interface != PHY_INTERFACE_MODE_SGMII)
++			goto unsupported;
++		break;
++	case 1:
++	case 2:
++	case 3:
++	case 4:
++	case 5:
++		/* Internal PHY */
++		if (state->interface != PHY_INTERFACE_MODE_NA &&
++		    state->interface != PHY_INTERFACE_MODE_GMII &&
++		    state->interface != PHY_INTERFACE_MODE_INTERNAL)
++			goto unsupported;
++		break;
++	case 6: /* 2nd CPU port / external PHY */
++		if (state->interface != PHY_INTERFACE_MODE_NA &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_ID &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_TXID &&
++		    state->interface != PHY_INTERFACE_MODE_RGMII_RXID &&
++		    state->interface != PHY_INTERFACE_MODE_SGMII &&
++		    state->interface != PHY_INTERFACE_MODE_1000BASEX)
++			goto unsupported;
++		break;
++	default:
++unsupported:
++		linkmode_zero(supported);
++		return;
++	}
++
++	phylink_set_port_modes(mask);
++	phylink_set(mask, Autoneg);
++
++	phylink_set(mask, 1000baseT_Full);
++	phylink_set(mask, 10baseT_Half);
++	phylink_set(mask, 10baseT_Full);
++	phylink_set(mask, 100baseT_Half);
++	phylink_set(mask, 100baseT_Full);
++
++	if (state->interface == PHY_INTERFACE_MODE_1000BASEX)
++		phylink_set(mask, 1000baseX_Full);
++
++	phylink_set(mask, Pause);
++	phylink_set(mask, Asym_Pause);
++
++	linkmode_and(supported, supported, mask);
++	linkmode_and(state->advertising, state->advertising, mask);
++}
++
++static int
++qca8k_phylink_mac_link_state(struct dsa_switch *ds, int port,
++			     struct phylink_link_state *state)
++{
++	struct qca8k_priv *priv = ds->priv;
++	u32 reg;
++	int ret;
++
++	ret = qca8k_read(priv, QCA8K_REG_PORT_STATUS(port), &reg);
++	if (ret < 0)
++		return ret;
++
++	state->link = !!(reg & QCA8K_PORT_STATUS_LINK_UP);
++	state->an_complete = state->link;
++	state->an_enabled = !!(reg & QCA8K_PORT_STATUS_LINK_AUTO);
++	state->duplex = (reg & QCA8K_PORT_STATUS_DUPLEX) ? DUPLEX_FULL :
++							   DUPLEX_HALF;
++
++	switch (reg & QCA8K_PORT_STATUS_SPEED) {
++	case QCA8K_PORT_STATUS_SPEED_10:
++		state->speed = SPEED_10;
++		break;
++	case QCA8K_PORT_STATUS_SPEED_100:
++		state->speed = SPEED_100;
++		break;
++	case QCA8K_PORT_STATUS_SPEED_1000:
++		state->speed = SPEED_1000;
++		break;
++	default:
++		state->speed = SPEED_UNKNOWN;
++		break;
++	}
++
++	state->pause = MLO_PAUSE_NONE;
++	if (reg & QCA8K_PORT_STATUS_RXFLOW)
++		state->pause |= MLO_PAUSE_RX;
++	if (reg & QCA8K_PORT_STATUS_TXFLOW)
++		state->pause |= MLO_PAUSE_TX;
++
++	return 1;
++}
++
++static void
++qca8k_phylink_mac_link_down(struct dsa_switch *ds, int port, unsigned int mode,
++			    phy_interface_t interface)
++{
++	struct qca8k_priv *priv = ds->priv;
++
++	qca8k_port_set_status(priv, port, 0);
++}
++
++static void
++qca8k_phylink_mac_link_up(struct dsa_switch *ds, int port, unsigned int mode,
++			  phy_interface_t interface, struct phy_device *phydev,
++			  int speed, int duplex, bool tx_pause, bool rx_pause)
++{
++	struct qca8k_priv *priv = ds->priv;
++	u32 reg;
++
++	if (phylink_autoneg_inband(mode)) {
++		reg = QCA8K_PORT_STATUS_LINK_AUTO;
++	} else {
++		switch (speed) {
++		case SPEED_10:
++			reg = QCA8K_PORT_STATUS_SPEED_10;
++			break;
++		case SPEED_100:
++			reg = QCA8K_PORT_STATUS_SPEED_100;
++			break;
++		case SPEED_1000:
++			reg = QCA8K_PORT_STATUS_SPEED_1000;
++			break;
++		default:
++			reg = QCA8K_PORT_STATUS_LINK_AUTO;
++			break;
++		}
++
++		if (duplex == DUPLEX_FULL)
++			reg |= QCA8K_PORT_STATUS_DUPLEX;
++
++		if (rx_pause || dsa_is_cpu_port(ds, port))
++			reg |= QCA8K_PORT_STATUS_RXFLOW;
++
++		if (tx_pause || dsa_is_cpu_port(ds, port))
++			reg |= QCA8K_PORT_STATUS_TXFLOW;
++	}
++
++	reg |= QCA8K_PORT_STATUS_TXMAC | QCA8K_PORT_STATUS_RXMAC;
++
++	qca8k_write(priv, QCA8K_REG_PORT_STATUS(port), reg);
++}
++
++static void
++qca8k_get_strings(struct dsa_switch *ds, int port, u32 stringset, uint8_t *data)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int i;
++
++	if (stringset != ETH_SS_STATS)
++		return;
++
++	for (i = 0; i < priv->info->mib_count; i++)
++		strncpy(data + i * ETH_GSTRING_LEN, ar8327_mib[i].name,
++			ETH_GSTRING_LEN);
++}
++
++static void qca8k_mib_autocast_handler(struct dsa_switch *ds, struct sk_buff *skb)
++{
++	struct qca8k_mib_eth_data *mib_eth_data;
++	struct qca8k_priv *priv = ds->priv;
++	const struct qca8k_mib_desc *mib;
++	struct mib_ethhdr *mib_ethhdr;
++	int i, mib_len, offset = 0;
++	u64 *data;
++	u8 port;
++
++	mib_ethhdr = (struct mib_ethhdr *)skb_mac_header(skb);
++	mib_eth_data = &priv->mib_eth_data;
++
++	/* The switch autocast every port. Ignore other packet and
++	 * parse only the requested one.
++	 */
++	port = FIELD_GET(QCA_HDR_RECV_SOURCE_PORT, ntohs(mib_ethhdr->hdr));
++	if (port != mib_eth_data->req_port)
++		goto exit;
++
++	data = mib_eth_data->data;
++
++	for (i = 0; i < priv->info->mib_count; i++) {
++		mib = &ar8327_mib[i];
++
++		/* First 3 mib are present in the skb head */
++		if (i < 3) {
++			data[i] = mib_ethhdr->data[i];
++			continue;
++		}
++
++		mib_len = sizeof(uint32_t);
++
++		/* Some mib are 64 bit wide */
++		if (mib->size == 2)
++			mib_len = sizeof(uint64_t);
++
++		/* Copy the mib value from packet to the */
++		memcpy(data + i, skb->data + offset, mib_len);
++
++		/* Set the offset for the next mib */
++		offset += mib_len;
++	}
++
++exit:
++	/* Complete on receiving all the mib packet */
++	if (refcount_dec_and_test(&mib_eth_data->port_parsed))
++		complete(&mib_eth_data->rw_done);
++}
++
++static int
++qca8k_get_ethtool_stats_eth(struct dsa_switch *ds, int port, u64 *data)
++{
++	struct dsa_port *dp = dsa_to_port(ds, port);
++	struct qca8k_mib_eth_data *mib_eth_data;
++	struct qca8k_priv *priv = ds->priv;
++	int ret;
++
++	mib_eth_data = &priv->mib_eth_data;
++
++	mutex_lock(&mib_eth_data->mutex);
++
++	reinit_completion(&mib_eth_data->rw_done);
++
++	mib_eth_data->req_port = dp->index;
++	mib_eth_data->data = data;
++	refcount_set(&mib_eth_data->port_parsed, QCA8K_NUM_PORTS);
++
++	mutex_lock(&priv->reg_mutex);
++
++	/* Send mib autocast request */
++	ret = regmap_update_bits(priv->regmap, QCA8K_REG_MIB,
++				 QCA8K_MIB_FUNC | QCA8K_MIB_BUSY,
++				 FIELD_PREP(QCA8K_MIB_FUNC, QCA8K_MIB_CAST) |
++				 QCA8K_MIB_BUSY);
++
++	mutex_unlock(&priv->reg_mutex);
++
++	if (ret)
++		goto exit;
++
++	ret = wait_for_completion_timeout(&mib_eth_data->rw_done, QCA8K_ETHERNET_TIMEOUT);
++
++exit:
++	mutex_unlock(&mib_eth_data->mutex);
++
++	return ret;
++}
++
++static void
++qca8k_get_ethtool_stats(struct dsa_switch *ds, int port,
++			uint64_t *data)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	const struct qca8k_mib_desc *mib;
++	u32 reg, i, val;
++	u32 hi = 0;
++	int ret;
++
++	if (priv->mgmt_master && priv->info->ops->autocast_mib &&
++	    priv->info->ops->autocast_mib(ds, port, data) > 0)
++		return;
++
++	for (i = 0; i < priv->info->mib_count; i++) {
++		mib = &ar8327_mib[i];
++		reg = QCA8K_PORT_MIB_COUNTER(port) + mib->offset;
++
++		ret = qca8k_read(priv, reg, &val);
++		if (ret < 0)
++			continue;
++
++		if (mib->size == 2) {
++			ret = qca8k_read(priv, reg + 4, &hi);
++			if (ret < 0)
++				continue;
++		}
++
++		data[i] = val;
++		if (mib->size == 2)
++			data[i] |= (u64)hi << 32;
++	}
++}
++
++static int
++qca8k_get_sset_count(struct dsa_switch *ds, int port, int sset)
++{
++	struct qca8k_priv *priv = ds->priv;
++
++	if (sset != ETH_SS_STATS)
++		return 0;
++
++	return priv->info->mib_count;
++}
++
++static int
++qca8k_set_mac_eee(struct dsa_switch *ds, int port, struct ethtool_eee *eee)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	u32 lpi_en = QCA8K_REG_EEE_CTRL_LPI_EN(port);
++	u32 reg;
++	int ret;
++
++	mutex_lock(&priv->reg_mutex);
++	ret = qca8k_read(priv, QCA8K_REG_EEE_CTRL, &reg);
++	if (ret < 0)
++		goto exit;
++
++	if (eee->eee_enabled)
++		reg |= lpi_en;
++	else
++		reg &= ~lpi_en;
++	ret = qca8k_write(priv, QCA8K_REG_EEE_CTRL, reg);
++
++exit:
++	mutex_unlock(&priv->reg_mutex);
++	return ret;
++}
++
++static int
++qca8k_get_mac_eee(struct dsa_switch *ds, int port, struct ethtool_eee *e)
++{
++	/* Nothing to do on the port's MAC */
++	return 0;
++}
++
++static void
++qca8k_port_stp_state_set(struct dsa_switch *ds, int port, u8 state)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	u32 stp_state;
++
++	switch (state) {
++	case BR_STATE_DISABLED:
++		stp_state = QCA8K_PORT_LOOKUP_STATE_DISABLED;
++		break;
++	case BR_STATE_BLOCKING:
++		stp_state = QCA8K_PORT_LOOKUP_STATE_BLOCKING;
++		break;
++	case BR_STATE_LISTENING:
++		stp_state = QCA8K_PORT_LOOKUP_STATE_LISTENING;
++		break;
++	case BR_STATE_LEARNING:
++		stp_state = QCA8K_PORT_LOOKUP_STATE_LEARNING;
++		break;
++	case BR_STATE_FORWARDING:
++	default:
++		stp_state = QCA8K_PORT_LOOKUP_STATE_FORWARD;
++		break;
++	}
++
++	qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
++		  QCA8K_PORT_LOOKUP_STATE_MASK, stp_state);
++}
++
++static int
++qca8k_port_bridge_join(struct dsa_switch *ds, int port, struct net_device *br)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	int port_mask, cpu_port;
++	int i, ret;
++
++	cpu_port = dsa_to_port(ds, port)->cpu_dp->index;
++	port_mask = BIT(cpu_port);
++
++	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
++		if (dsa_is_cpu_port(ds, i))
++			continue;
++		if (dsa_to_port(ds, i)->bridge_dev != br)
++			continue;
++		/* Add this port to the portvlan mask of the other ports
++		 * in the bridge
++		 */
++		ret = regmap_set_bits(priv->regmap,
++				      QCA8K_PORT_LOOKUP_CTRL(i),
++				      BIT(port));
++		if (ret)
++			return ret;
++		if (i != port)
++			port_mask |= BIT(i);
++	}
++
++	/* Add all other ports to this ports portvlan mask */
++	ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
++			QCA8K_PORT_LOOKUP_MEMBER, port_mask);
++
++	return ret;
++}
++
++static void
++qca8k_port_bridge_leave(struct dsa_switch *ds, int port, struct net_device *br)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	int cpu_port, i;
++
++	cpu_port = dsa_to_port(ds, port)->cpu_dp->index;
++
++	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
++		if (dsa_is_cpu_port(ds, i))
++			continue;
++		if (dsa_to_port(ds, i)->bridge_dev != br)
++			continue;
++		/* Remove this port to the portvlan mask of the other ports
++		 * in the bridge
++		 */
++		regmap_clear_bits(priv->regmap,
++				  QCA8K_PORT_LOOKUP_CTRL(i),
++				  BIT(port));
++	}
++
++	/* Set the cpu port to be the only one in the portvlan mask of
++	 * this port
++	 */
++	qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
++		  QCA8K_PORT_LOOKUP_MEMBER, BIT(cpu_port));
++}
++
++static void
++qca8k_port_fast_age(struct dsa_switch *ds, int port)
++{
++	struct qca8k_priv *priv = ds->priv;
++
++	mutex_lock(&priv->reg_mutex);
++	qca8k_fdb_access(priv, QCA8K_FDB_FLUSH_PORT, port);
++	mutex_unlock(&priv->reg_mutex);
++}
++
++static int
++qca8k_set_ageing_time(struct dsa_switch *ds, unsigned int msecs)
++{
++	struct qca8k_priv *priv = ds->priv;
++	unsigned int secs = msecs / 1000;
++	u32 val;
++
++	/* AGE_TIME reg is set in 7s step */
++	val = secs / 7;
++
++	/* Handle case with 0 as val to NOT disable
++	 * learning
++	 */
++	if (!val)
++		val = 1;
++
++	return regmap_update_bits(priv->regmap, QCA8K_REG_ATU_CTRL, QCA8K_ATU_AGE_TIME_MASK,
++				  QCA8K_ATU_AGE_TIME(val));
++}
++
++static int
++qca8k_port_enable(struct dsa_switch *ds, int port,
++		  struct phy_device *phy)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++
++	qca8k_port_set_status(priv, port, 1);
++	priv->port_enabled_map |= BIT(port);
++
++	if (dsa_is_user_port(ds, port))
++		phy_support_asym_pause(phy);
++
++	return 0;
++}
++
++static void
++qca8k_port_disable(struct dsa_switch *ds, int port)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++
++	qca8k_port_set_status(priv, port, 0);
++	priv->port_enabled_map &= ~BIT(port);
++}
++
++static int
++qca8k_port_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int ret;
++
++	/* We have only have a general MTU setting.
++	 * DSA always set the CPU port's MTU to the largest MTU of the slave
++	 * ports.
++	 * Setting MTU just for the CPU port is sufficient to correctly set a
++	 * value for every port.
++	 */
++	if (!dsa_is_cpu_port(ds, port))
++		return 0;
++
++	/* To change the MAX_FRAME_SIZE the cpu ports must be off or
++	 * the switch panics.
++	 * Turn off both cpu ports before applying the new value to prevent
++	 * this.
++	 */
++	if (priv->port_enabled_map & BIT(0))
++		qca8k_port_set_status(priv, 0, 0);
++
++	if (priv->port_enabled_map & BIT(6))
++		qca8k_port_set_status(priv, 6, 0);
++
++	/* Include L2 header / FCS length */
++	ret = qca8k_write(priv, QCA8K_MAX_FRAME_SIZE, new_mtu + ETH_HLEN + ETH_FCS_LEN);
++
++	if (priv->port_enabled_map & BIT(0))
++		qca8k_port_set_status(priv, 0, 1);
++
++	if (priv->port_enabled_map & BIT(6))
++		qca8k_port_set_status(priv, 6, 1);
++
++	return ret;
++}
++
++static int
++qca8k_port_max_mtu(struct dsa_switch *ds, int port)
++{
++	return QCA8K_MAX_MTU;
++}
++
++static int
++qca8k_port_fdb_insert(struct qca8k_priv *priv, const u8 *addr,
++		      u16 port_mask, u16 vid)
++{
++	/* Set the vid to the port vlan id if no vid is set */
++	if (!vid)
++		vid = QCA8K_PORT_VID_DEF;
++
++	return qca8k_fdb_add(priv, addr, port_mask, vid,
++			     QCA8K_ATU_STATUS_STATIC);
++}
++
++static int
++qca8k_port_fdb_add(struct dsa_switch *ds, int port,
++		   const unsigned char *addr, u16 vid)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	u16 port_mask = BIT(port);
++
++	return qca8k_port_fdb_insert(priv, addr, port_mask, vid);
++}
++
++static int
++qca8k_port_fdb_del(struct dsa_switch *ds, int port,
++		   const unsigned char *addr, u16 vid)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	u16 port_mask = BIT(port);
++
++	if (!vid)
++		vid = QCA8K_PORT_VID_DEF;
++
++	return qca8k_fdb_del(priv, addr, port_mask, vid);
++}
++
++static int
++qca8k_port_fdb_dump(struct dsa_switch *ds, int port,
++		    dsa_fdb_dump_cb_t *cb, void *data)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	struct qca8k_fdb _fdb = { 0 };
++	int cnt = QCA8K_NUM_FDB_RECORDS;
++	bool is_static;
++	int ret = 0;
++
++	mutex_lock(&priv->reg_mutex);
++	while (cnt-- && !qca8k_fdb_next(priv, &_fdb, port)) {
++		if (!_fdb.aging)
++			break;
++		is_static = (_fdb.aging == QCA8K_ATU_STATUS_STATIC);
++		ret = cb(_fdb.mac, _fdb.vid, is_static, data);
++		if (ret)
++			break;
++	}
++	mutex_unlock(&priv->reg_mutex);
++
++	return 0;
++}
++
++static int
++qca8k_port_mdb_add(struct dsa_switch *ds, int port,
++		   const struct switchdev_obj_port_mdb *mdb)
++{
++	struct qca8k_priv *priv = ds->priv;
++	const u8 *addr = mdb->addr;
++	u16 vid = mdb->vid;
++
++	return qca8k_fdb_search_and_insert(priv, BIT(port), addr, vid);
++}
++
++static int
++qca8k_port_mdb_del(struct dsa_switch *ds, int port,
++		   const struct switchdev_obj_port_mdb *mdb)
++{
++	struct qca8k_priv *priv = ds->priv;
++	const u8 *addr = mdb->addr;
++	u16 vid = mdb->vid;
++
++	return qca8k_fdb_search_and_del(priv, BIT(port), addr, vid);
++}
++
++static int
++qca8k_port_mirror_add(struct dsa_switch *ds, int port,
++		      struct dsa_mall_mirror_tc_entry *mirror,
++		      bool ingress)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int monitor_port, ret;
++	u32 reg, val;
++
++	/* Check for existent entry */
++	if ((ingress ? priv->mirror_rx : priv->mirror_tx) & BIT(port))
++		return -EEXIST;
++
++	ret = regmap_read(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0, &val);
++	if (ret)
++		return ret;
++
++	/* QCA83xx can have only one port set to mirror mode.
++	 * Check that the correct port is requested and return error otherwise.
++	 * When no mirror port is set, the values is set to 0xF
++	 */
++	monitor_port = FIELD_GET(QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, val);
++	if (monitor_port != 0xF && monitor_port != mirror->to_local_port)
++		return -EEXIST;
++
++	/* Set the monitor port */
++	val = FIELD_PREP(QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM,
++			 mirror->to_local_port);
++	ret = regmap_update_bits(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0,
++				 QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, val);
++	if (ret)
++		return ret;
++
++	if (ingress) {
++		reg = QCA8K_PORT_LOOKUP_CTRL(port);
++		val = QCA8K_PORT_LOOKUP_ING_MIRROR_EN;
++	} else {
++		reg = QCA8K_REG_PORT_HOL_CTRL1(port);
++		val = QCA8K_PORT_HOL_CTRL1_EG_MIRROR_EN;
++	}
++
++	ret = regmap_update_bits(priv->regmap, reg, val, val);
++	if (ret)
++		return ret;
++
++	/* Track mirror port for tx and rx to decide when the
++	 * mirror port has to be disabled.
++	 */
++	if (ingress)
++		priv->mirror_rx |= BIT(port);
++	else
++		priv->mirror_tx |= BIT(port);
++
++	return 0;
++}
++
++static void
++qca8k_port_mirror_del(struct dsa_switch *ds, int port,
++		      struct dsa_mall_mirror_tc_entry *mirror)
++{
++	struct qca8k_priv *priv = ds->priv;
++	u32 reg, val;
++	int ret;
++
++	if (mirror->ingress) {
++		reg = QCA8K_PORT_LOOKUP_CTRL(port);
++		val = QCA8K_PORT_LOOKUP_ING_MIRROR_EN;
++	} else {
++		reg = QCA8K_REG_PORT_HOL_CTRL1(port);
++		val = QCA8K_PORT_HOL_CTRL1_EG_MIRROR_EN;
++	}
++
++	ret = regmap_clear_bits(priv->regmap, reg, val);
++	if (ret)
++		goto err;
++
++	if (mirror->ingress)
++		priv->mirror_rx &= ~BIT(port);
++	else
++		priv->mirror_tx &= ~BIT(port);
++
++	/* No port set to send packet to mirror port. Disable mirror port */
++	if (!priv->mirror_rx && !priv->mirror_tx) {
++		val = FIELD_PREP(QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, 0xF);
++		ret = regmap_update_bits(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0,
++					 QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, val);
++		if (ret)
++			goto err;
++	}
++err:
++	dev_err(priv->dev, "Failed to del mirror port from %d", port);
++}
++
++static int
++qca8k_port_vlan_filtering(struct dsa_switch *ds, int port, bool vlan_filtering,
++			  struct netlink_ext_ack *extack)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int ret;
++
++	if (vlan_filtering) {
++		ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
++				QCA8K_PORT_LOOKUP_VLAN_MODE_MASK,
++				QCA8K_PORT_LOOKUP_VLAN_MODE_SECURE);
++	} else {
++		ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
++				QCA8K_PORT_LOOKUP_VLAN_MODE_MASK,
++				QCA8K_PORT_LOOKUP_VLAN_MODE_NONE);
++	}
++
++	return ret;
++}
++
++static int
++qca8k_port_vlan_add(struct dsa_switch *ds, int port,
++		    const struct switchdev_obj_port_vlan *vlan,
++		    struct netlink_ext_ack *extack)
++{
++	bool untagged = vlan->flags & BRIDGE_VLAN_INFO_UNTAGGED;
++	bool pvid = vlan->flags & BRIDGE_VLAN_INFO_PVID;
++	struct qca8k_priv *priv = ds->priv;
++	int ret;
++
++	ret = qca8k_vlan_add(priv, port, vlan->vid, untagged);
++	if (ret) {
++		dev_err(priv->dev, "Failed to add VLAN to port %d (%d)", port, ret);
++		return ret;
++	}
++
++	if (pvid) {
++		ret = qca8k_rmw(priv, QCA8K_EGRESS_VLAN(port),
++				QCA8K_EGREES_VLAN_PORT_MASK(port),
++				QCA8K_EGREES_VLAN_PORT(port, vlan->vid));
++		if (ret)
++			return ret;
++
++		ret = qca8k_write(priv, QCA8K_REG_PORT_VLAN_CTRL0(port),
++				  QCA8K_PORT_VLAN_CVID(vlan->vid) |
++				  QCA8K_PORT_VLAN_SVID(vlan->vid));
++	}
++
++	return ret;
++}
++
++static int
++qca8k_port_vlan_del(struct dsa_switch *ds, int port,
++		    const struct switchdev_obj_port_vlan *vlan)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int ret;
++
++	ret = qca8k_vlan_del(priv, port, vlan->vid);
++	if (ret)
++		dev_err(priv->dev, "Failed to delete VLAN from port %d (%d)", port, ret);
++
++	return ret;
++}
++
++static u32 qca8k_get_phy_flags(struct dsa_switch *ds, int port)
++{
++	struct qca8k_priv *priv = ds->priv;
++
++	/* Communicate to the phy internal driver the switch revision.
++	 * Based on the switch revision different values needs to be
++	 * set to the dbg and mmd reg on the phy.
++	 * The first 2 bit are used to communicate the switch revision
++	 * to the phy driver.
++	 */
++	if (port > 0 && port < 6)
++		return priv->switch_revision;
++
++	return 0;
++}
++
++static enum dsa_tag_protocol
++qca8k_get_tag_protocol(struct dsa_switch *ds, int port,
++		       enum dsa_tag_protocol mp)
++{
++	return DSA_TAG_PROTO_QCA;
++}
++
++static bool
++qca8k_lag_can_offload(struct dsa_switch *ds,
++		      struct net_device *lag,
++		      struct netdev_lag_upper_info *info)
++{
++	struct dsa_port *dp;
++	int id, members = 0;
++
++	id = dsa_lag_id(ds->dst, lag);
++	if (id < 0 || id >= ds->num_lag_ids)
++		return false;
++
++	dsa_lag_foreach_port(dp, ds->dst, lag)
++		/* Includes the port joining the LAG */
++		members++;
++
++	if (members > QCA8K_NUM_PORTS_FOR_LAG)
++		return false;
++
++	if (info->tx_type != NETDEV_LAG_TX_TYPE_HASH)
++		return false;
++
++	if (info->hash_type != NETDEV_LAG_HASH_L2 &&
++	    info->hash_type != NETDEV_LAG_HASH_L23)
++		return false;
++
++	return true;
++}
++
++static int
++qca8k_lag_setup_hash(struct dsa_switch *ds,
++		     struct net_device *lag,
++		     struct netdev_lag_upper_info *info)
++{
++	struct qca8k_priv *priv = ds->priv;
++	bool unique_lag = true;
++	u32 hash = 0;
++	int i, id;
++
++	id = dsa_lag_id(ds->dst, lag);
++
++	switch (info->hash_type) {
++	case NETDEV_LAG_HASH_L23:
++		hash |= QCA8K_TRUNK_HASH_SIP_EN;
++		hash |= QCA8K_TRUNK_HASH_DIP_EN;
++		fallthrough;
++	case NETDEV_LAG_HASH_L2:
++		hash |= QCA8K_TRUNK_HASH_SA_EN;
++		hash |= QCA8K_TRUNK_HASH_DA_EN;
++		break;
++	default: /* We should NEVER reach this */
++		return -EOPNOTSUPP;
++	}
++
++	/* Check if we are the unique configured LAG */
++	dsa_lags_foreach_id(i, ds->dst)
++		if (i != id && dsa_lag_dev(ds->dst, i)) {
++			unique_lag = false;
++			break;
++		}
++
++	/* Hash Mode is global. Make sure the same Hash Mode
++	 * is set to all the 4 possible lag.
++	 * If we are the unique LAG we can set whatever hash
++	 * mode we want.
++	 * To change hash mode it's needed to remove all LAG
++	 * and change the mode with the latest.
++	 */
++	if (unique_lag) {
++		priv->lag_hash_mode = hash;
++	} else if (priv->lag_hash_mode != hash) {
++		netdev_err(lag, "Error: Mismateched Hash Mode across different lag is not supported\n");
++		return -EOPNOTSUPP;
++	}
++
++	return regmap_update_bits(priv->regmap, QCA8K_TRUNK_HASH_EN_CTRL,
++				  QCA8K_TRUNK_HASH_MASK, hash);
++}
++
++static int
++qca8k_lag_refresh_portmap(struct dsa_switch *ds, int port,
++			  struct net_device *lag, bool delete)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int ret, id, i;
++	u32 val;
++
++	id = dsa_lag_id(ds->dst, lag);
++
++	/* Read current port member */
++	ret = regmap_read(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL0, &val);
++	if (ret)
++		return ret;
++
++	/* Shift val to the correct trunk */
++	val >>= QCA8K_REG_GOL_TRUNK_SHIFT(id);
++	val &= QCA8K_REG_GOL_TRUNK_MEMBER_MASK;
++	if (delete)
++		val &= ~BIT(port);
++	else
++		val |= BIT(port);
++
++	/* Update port member. With empty portmap disable trunk */
++	ret = regmap_update_bits(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL0,
++				 QCA8K_REG_GOL_TRUNK_MEMBER(id) |
++				 QCA8K_REG_GOL_TRUNK_EN(id),
++				 !val << QCA8K_REG_GOL_TRUNK_SHIFT(id) |
++				 val << QCA8K_REG_GOL_TRUNK_SHIFT(id));
++
++	/* Search empty member if adding or port on deleting */
++	for (i = 0; i < QCA8K_NUM_PORTS_FOR_LAG; i++) {
++		ret = regmap_read(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL(id), &val);
++		if (ret)
++			return ret;
++
++		val >>= QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(id, i);
++		val &= QCA8K_REG_GOL_TRUNK_ID_MEM_ID_MASK;
++
++		if (delete) {
++			/* If port flagged to be disabled assume this member is
++			 * empty
++			 */
++			if (val != QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN_MASK)
++				continue;
++
++			val &= QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT_MASK;
++			if (val != port)
++				continue;
++		} else {
++			/* If port flagged to be enabled assume this member is
++			 * already set
++			 */
++			if (val == QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN_MASK)
++				continue;
++		}
++
++		/* We have found the member to add/remove */
++		break;
++	}
++
++	/* Set port in the correct port mask or disable port if in delete mode */
++	return regmap_update_bits(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL(id),
++				  QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN(id, i) |
++				  QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT(id, i),
++				  !delete << QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(id, i) |
++				  port << QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(id, i));
++}
++
++static int
++qca8k_port_lag_join(struct dsa_switch *ds, int port,
++		    struct net_device *lag,
++		    struct netdev_lag_upper_info *info)
++{
++	int ret;
++
++	if (!qca8k_lag_can_offload(ds, lag, info))
++		return -EOPNOTSUPP;
++
++	ret = qca8k_lag_setup_hash(ds, lag, info);
++	if (ret)
++		return ret;
++
++	return qca8k_lag_refresh_portmap(ds, port, lag, false);
++}
++
++static int
++qca8k_port_lag_leave(struct dsa_switch *ds, int port,
++		     struct net_device *lag)
++{
++	return qca8k_lag_refresh_portmap(ds, port, lag, true);
++}
++
++static void
++qca8k_master_change(struct dsa_switch *ds, const struct net_device *master,
++		    bool operational)
++{
++	struct dsa_port *dp = master->dsa_ptr;
++	struct qca8k_priv *priv = ds->priv;
++
++	/* Ethernet MIB/MDIO is only supported for CPU port 0 */
++	if (dp->index != 0)
++		return;
++
++	mutex_lock(&priv->mgmt_eth_data.mutex);
++	mutex_lock(&priv->mib_eth_data.mutex);
++
++	priv->mgmt_master = operational ? (struct net_device *)master : NULL;
++
++	mutex_unlock(&priv->mib_eth_data.mutex);
++	mutex_unlock(&priv->mgmt_eth_data.mutex);
++}
++
++static int qca8k_connect_tag_protocol(struct dsa_switch *ds,
++				      enum dsa_tag_protocol proto)
++{
++	struct qca_tagger_data *tagger_data;
++
++	switch (proto) {
++	case DSA_TAG_PROTO_QCA:
++		tagger_data = ds->tagger_data;
++
++		tagger_data->rw_reg_ack_handler = qca8k_rw_reg_ack_handler;
++		tagger_data->mib_autocast_handler = qca8k_mib_autocast_handler;
++
++		break;
++	default:
++		return -EOPNOTSUPP;
++	}
++
++	return 0;
++}
++
++static const struct dsa_switch_ops qca8k_switch_ops = {
++	.get_tag_protocol	= qca8k_get_tag_protocol,
++	.setup			= qca8k_setup,
++	.get_strings		= qca8k_get_strings,
++	.get_ethtool_stats	= qca8k_get_ethtool_stats,
++	.get_sset_count		= qca8k_get_sset_count,
++	.set_ageing_time	= qca8k_set_ageing_time,
++	.get_mac_eee		= qca8k_get_mac_eee,
++	.set_mac_eee		= qca8k_set_mac_eee,
++	.port_enable		= qca8k_port_enable,
++	.port_disable		= qca8k_port_disable,
++	.port_change_mtu	= qca8k_port_change_mtu,
++	.port_max_mtu		= qca8k_port_max_mtu,
++	.port_stp_state_set	= qca8k_port_stp_state_set,
++	.port_bridge_join	= qca8k_port_bridge_join,
++	.port_bridge_leave	= qca8k_port_bridge_leave,
++	.port_fast_age		= qca8k_port_fast_age,
++	.port_fdb_add		= qca8k_port_fdb_add,
++	.port_fdb_del		= qca8k_port_fdb_del,
++	.port_fdb_dump		= qca8k_port_fdb_dump,
++	.port_mdb_add		= qca8k_port_mdb_add,
++	.port_mdb_del		= qca8k_port_mdb_del,
++	.port_mirror_add	= qca8k_port_mirror_add,
++	.port_mirror_del	= qca8k_port_mirror_del,
++	.port_vlan_filtering	= qca8k_port_vlan_filtering,
++	.port_vlan_add		= qca8k_port_vlan_add,
++	.port_vlan_del		= qca8k_port_vlan_del,
++	.phylink_validate	= qca8k_phylink_validate,
++	.phylink_mac_link_state	= qca8k_phylink_mac_link_state,
++	.phylink_mac_config	= qca8k_phylink_mac_config,
++	.phylink_mac_link_down	= qca8k_phylink_mac_link_down,
++	.phylink_mac_link_up	= qca8k_phylink_mac_link_up,
++	.get_phy_flags		= qca8k_get_phy_flags,
++	.port_lag_join		= qca8k_port_lag_join,
++	.port_lag_leave		= qca8k_port_lag_leave,
++	.master_state_change	= qca8k_master_change,
++	.connect_tag_protocol	= qca8k_connect_tag_protocol,
++};
++
++static int qca8k_read_switch_id(struct qca8k_priv *priv)
++{
++	u32 val;
++	u8 id;
++	int ret;
++
++	if (!priv->info)
++		return -ENODEV;
++
++	ret = qca8k_read(priv, QCA8K_REG_MASK_CTRL, &val);
++	if (ret < 0)
++		return -ENODEV;
++
++	id = QCA8K_MASK_CTRL_DEVICE_ID(val);
++	if (id != priv->info->id) {
++		dev_err(priv->dev,
++			"Switch id detected %x but expected %x",
++			id, priv->info->id);
++		return -ENODEV;
++	}
++
++	priv->switch_id = id;
++
++	/* Save revision to communicate to the internal PHY driver */
++	priv->switch_revision = QCA8K_MASK_CTRL_REV_ID(val);
++
++	return 0;
++}
++
++static int
++qca8k_sw_probe(struct mdio_device *mdiodev)
++{
++	struct qca8k_priv *priv;
++	int ret;
++
++	/* allocate the private data struct so that we can probe the switches
++	 * ID register
++	 */
++	priv = devm_kzalloc(&mdiodev->dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	priv->info = of_device_get_match_data(priv->dev);
++	priv->bus = mdiodev->bus;
++	priv->dev = &mdiodev->dev;
++
++	priv->reset_gpio = devm_gpiod_get_optional(priv->dev, "reset",
++						   GPIOD_ASIS);
++	if (IS_ERR(priv->reset_gpio))
++		return PTR_ERR(priv->reset_gpio);
++
++	if (priv->reset_gpio) {
++		gpiod_set_value_cansleep(priv->reset_gpio, 1);
++		/* The active low duration must be greater than 10 ms
++		 * and checkpatch.pl wants 20 ms.
++		 */
++		msleep(20);
++		gpiod_set_value_cansleep(priv->reset_gpio, 0);
++	}
++
++	/* Start by setting up the register mapping */
++	priv->regmap = devm_regmap_init(&mdiodev->dev, NULL, priv,
++					&qca8k_regmap_config);
++	if (IS_ERR(priv->regmap)) {
++		dev_err(priv->dev, "regmap initialization failed");
++		return PTR_ERR(priv->regmap);
++	}
++
++	priv->mdio_cache.page = 0xffff;
++	priv->mdio_cache.lo = 0xffff;
++	priv->mdio_cache.hi = 0xffff;
++
++	/* Check the detected switch id */
++	ret = qca8k_read_switch_id(priv);
++	if (ret)
++		return ret;
++
++	priv->ds = devm_kzalloc(&mdiodev->dev, sizeof(*priv->ds), GFP_KERNEL);
++	if (!priv->ds)
++		return -ENOMEM;
++
++	mutex_init(&priv->mgmt_eth_data.mutex);
++	init_completion(&priv->mgmt_eth_data.rw_done);
++
++	mutex_init(&priv->mib_eth_data.mutex);
++	init_completion(&priv->mib_eth_data.rw_done);
++
++	priv->ds->dev = &mdiodev->dev;
++	priv->ds->num_ports = QCA8K_NUM_PORTS;
++	priv->ds->priv = priv;
++	priv->ds->ops = &qca8k_switch_ops;
++	mutex_init(&priv->reg_mutex);
++	dev_set_drvdata(&mdiodev->dev, priv);
++
++	return dsa_register_switch(priv->ds);
++}
++
++static void
++qca8k_sw_remove(struct mdio_device *mdiodev)
++{
++	struct qca8k_priv *priv = dev_get_drvdata(&mdiodev->dev);
++	int i;
++
++	if (!priv)
++		return;
++
++	for (i = 0; i < QCA8K_NUM_PORTS; i++)
++		qca8k_port_set_status(priv, i, 0);
++
++	dsa_unregister_switch(priv->ds);
++
++	dev_set_drvdata(&mdiodev->dev, NULL);
++}
++
++static void qca8k_sw_shutdown(struct mdio_device *mdiodev)
++{
++	struct qca8k_priv *priv = dev_get_drvdata(&mdiodev->dev);
++
++	if (!priv)
++		return;
++
++	dsa_switch_shutdown(priv->ds);
++
++	dev_set_drvdata(&mdiodev->dev, NULL);
++}
++
++#ifdef CONFIG_PM_SLEEP
++static void
++qca8k_set_pm(struct qca8k_priv *priv, int enable)
++{
++	int port;
++
++	for (port = 0; port < QCA8K_NUM_PORTS; port++) {
++		/* Do not enable on resume if the port was
++		 * disabled before.
++		 */
++		if (!(priv->port_enabled_map & BIT(port)))
++			continue;
++
++		qca8k_port_set_status(priv, port, enable);
++	}
++}
++
++static int qca8k_suspend(struct device *dev)
++{
++	struct qca8k_priv *priv = dev_get_drvdata(dev);
++
++	qca8k_set_pm(priv, 0);
++
++	return dsa_switch_suspend(priv->ds);
++}
++
++static int qca8k_resume(struct device *dev)
++{
++	struct qca8k_priv *priv = dev_get_drvdata(dev);
++
++	qca8k_set_pm(priv, 1);
++
++	return dsa_switch_resume(priv->ds);
++}
++#endif /* CONFIG_PM_SLEEP */
++
++static SIMPLE_DEV_PM_OPS(qca8k_pm_ops,
++			 qca8k_suspend, qca8k_resume);
++
++static const struct qca8k_info_ops qca8xxx_ops = {
++	.autocast_mib = qca8k_get_ethtool_stats_eth,
++};
++
++static const struct qca8k_match_data qca8327 = {
++	.id = QCA8K_ID_QCA8327,
++	.reduced_package = true,
++	.mib_count = QCA8K_QCA832X_MIB_COUNT,
++	.ops = &qca8xxx_ops,
++};
++
++static const struct qca8k_match_data qca8328 = {
++	.id = QCA8K_ID_QCA8327,
++	.mib_count = QCA8K_QCA832X_MIB_COUNT,
++	.ops = &qca8xxx_ops,
++};
++
++static const struct qca8k_match_data qca833x = {
++	.id = QCA8K_ID_QCA8337,
++	.mib_count = QCA8K_QCA833X_MIB_COUNT,
++	.ops = &qca8xxx_ops,
++};
++
++static const struct of_device_id qca8k_of_match[] = {
++	{ .compatible = "qca,qca8327", .data = &qca8327 },
++	{ .compatible = "qca,qca8328", .data = &qca8328 },
++	{ .compatible = "qca,qca8334", .data = &qca833x },
++	{ .compatible = "qca,qca8337", .data = &qca833x },
++	{ /* sentinel */ },
++};
++
++static struct mdio_driver qca8kmdio_driver = {
++	.probe  = qca8k_sw_probe,
++	.remove = qca8k_sw_remove,
++	.shutdown = qca8k_sw_shutdown,
++	.mdiodrv.driver = {
++		.name = "qca8k",
++		.of_match_table = qca8k_of_match,
++		.pm = &qca8k_pm_ops,
++	},
++};
++
++mdio_module_driver(qca8kmdio_driver);
++
++MODULE_AUTHOR("Mathieu Olivari, John Crispin <john@phrozen.org>");
++MODULE_DESCRIPTION("Driver for QCA8K ethernet switch family");
++MODULE_LICENSE("GPL v2");
++MODULE_ALIAS("platform:qca8k");
+--- /dev/null
++++ b/drivers/net/dsa/qca/qca8k-common.c
+@@ -0,0 +1,63 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (C) 2009 Felix Fietkau <nbd@nbd.name>
++ * Copyright (C) 2011-2012 Gabor Juhos <juhosg@openwrt.org>
++ * Copyright (c) 2015, 2019, The Linux Foundation. All rights reserved.
++ * Copyright (c) 2016 John Crispin <john@phrozen.org>
++ */
++
++#include <linux/netdevice.h>
++#include <net/dsa.h>
++
++#include "qca8k.h"
++
++#define MIB_DESC(_s, _o, _n)	\
++	{			\
++		.size = (_s),	\
++		.offset = (_o),	\
++		.name = (_n),	\
++	}
++
++const struct qca8k_mib_desc ar8327_mib[] = {
++	MIB_DESC(1, 0x00, "RxBroad"),
++	MIB_DESC(1, 0x04, "RxPause"),
++	MIB_DESC(1, 0x08, "RxMulti"),
++	MIB_DESC(1, 0x0c, "RxFcsErr"),
++	MIB_DESC(1, 0x10, "RxAlignErr"),
++	MIB_DESC(1, 0x14, "RxRunt"),
++	MIB_DESC(1, 0x18, "RxFragment"),
++	MIB_DESC(1, 0x1c, "Rx64Byte"),
++	MIB_DESC(1, 0x20, "Rx128Byte"),
++	MIB_DESC(1, 0x24, "Rx256Byte"),
++	MIB_DESC(1, 0x28, "Rx512Byte"),
++	MIB_DESC(1, 0x2c, "Rx1024Byte"),
++	MIB_DESC(1, 0x30, "Rx1518Byte"),
++	MIB_DESC(1, 0x34, "RxMaxByte"),
++	MIB_DESC(1, 0x38, "RxTooLong"),
++	MIB_DESC(2, 0x3c, "RxGoodByte"),
++	MIB_DESC(2, 0x44, "RxBadByte"),
++	MIB_DESC(1, 0x4c, "RxOverFlow"),
++	MIB_DESC(1, 0x50, "Filtered"),
++	MIB_DESC(1, 0x54, "TxBroad"),
++	MIB_DESC(1, 0x58, "TxPause"),
++	MIB_DESC(1, 0x5c, "TxMulti"),
++	MIB_DESC(1, 0x60, "TxUnderRun"),
++	MIB_DESC(1, 0x64, "Tx64Byte"),
++	MIB_DESC(1, 0x68, "Tx128Byte"),
++	MIB_DESC(1, 0x6c, "Tx256Byte"),
++	MIB_DESC(1, 0x70, "Tx512Byte"),
++	MIB_DESC(1, 0x74, "Tx1024Byte"),
++	MIB_DESC(1, 0x78, "Tx1518Byte"),
++	MIB_DESC(1, 0x7c, "TxMaxByte"),
++	MIB_DESC(1, 0x80, "TxOverSize"),
++	MIB_DESC(2, 0x84, "TxByte"),
++	MIB_DESC(1, 0x8c, "TxCollision"),
++	MIB_DESC(1, 0x90, "TxAbortCol"),
++	MIB_DESC(1, 0x94, "TxMultiCol"),
++	MIB_DESC(1, 0x98, "TxSingleCol"),
++	MIB_DESC(1, 0x9c, "TxExcDefer"),
++	MIB_DESC(1, 0xa0, "TxDefer"),
++	MIB_DESC(1, 0xa4, "TxLateCol"),
++	MIB_DESC(1, 0xa8, "RXUnicast"),
++	MIB_DESC(1, 0xac, "TXUnicast"),
++};
+--- a/drivers/net/dsa/qca/qca8k.h
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -414,4 +414,7 @@ struct qca8k_fdb {
+ 	u8 mac[6];
+ };
+ 
++/* Common setup function */
++extern const struct qca8k_mib_desc ar8327_mib[];
++
+ #endif /* __QCA8K_H */
diff --git a/target/linux/generic/backport-5.15/771-v6.0-04-net-dsa-qca8k-move-qca8k-read-write-rmw-and-reg-tabl.patch b/target/linux/generic/backport-5.15/771-v6.0-04-net-dsa-qca8k-move-qca8k-read-write-rmw-and-reg-tabl.patch
new file mode 100644
index 00000000000000..012ab854742a41
--- /dev/null
+++ b/target/linux/generic/backport-5.15/771-v6.0-04-net-dsa-qca8k-move-qca8k-read-write-rmw-and-reg-tabl.patch
@@ -0,0 +1,135 @@
+From d5f901eab2e9dfed1095995dfc98f231f4fd2971 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 27 Jul 2022 13:35:13 +0200
+Subject: [PATCH 04/14] net: dsa: qca8k: move qca8k read/write/rmw and reg
+ table to common code
+
+The same reg table and read/write/rmw function are used by drivers
+based on qca8k family switch.
+Move them to common code to make it accessible also by other drivers.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c   | 42 ------------------------------
+ drivers/net/dsa/qca/qca8k-common.c | 38 +++++++++++++++++++++++++++
+ drivers/net/dsa/qca/qca8k.h        |  6 +++++
+ 3 files changed, 44 insertions(+), 42 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -133,24 +133,6 @@ qca8k_set_page(struct qca8k_priv *priv,
+ 	return 0;
+ }
+ 
+-static int
+-qca8k_read(struct qca8k_priv *priv, u32 reg, u32 *val)
+-{
+-	return regmap_read(priv->regmap, reg, val);
+-}
+-
+-static int
+-qca8k_write(struct qca8k_priv *priv, u32 reg, u32 val)
+-{
+-	return regmap_write(priv->regmap, reg, val);
+-}
+-
+-static int
+-qca8k_rmw(struct qca8k_priv *priv, u32 reg, u32 mask, u32 write_val)
+-{
+-	return regmap_update_bits(priv->regmap, reg, mask, write_val);
+-}
+-
+ static void qca8k_rw_reg_ack_handler(struct dsa_switch *ds, struct sk_buff *skb)
+ {
+ 	struct qca8k_mgmt_eth_data *mgmt_eth_data;
+@@ -483,30 +465,6 @@ exit:
+ 	return ret;
+ }
+ 
+-static const struct regmap_range qca8k_readable_ranges[] = {
+-	regmap_reg_range(0x0000, 0x00e4), /* Global control */
+-	regmap_reg_range(0x0100, 0x0168), /* EEE control */
+-	regmap_reg_range(0x0200, 0x0270), /* Parser control */
+-	regmap_reg_range(0x0400, 0x0454), /* ACL */
+-	regmap_reg_range(0x0600, 0x0718), /* Lookup */
+-	regmap_reg_range(0x0800, 0x0b70), /* QM */
+-	regmap_reg_range(0x0c00, 0x0c80), /* PKT */
+-	regmap_reg_range(0x0e00, 0x0e98), /* L3 */
+-	regmap_reg_range(0x1000, 0x10ac), /* MIB - Port0 */
+-	regmap_reg_range(0x1100, 0x11ac), /* MIB - Port1 */
+-	regmap_reg_range(0x1200, 0x12ac), /* MIB - Port2 */
+-	regmap_reg_range(0x1300, 0x13ac), /* MIB - Port3 */
+-	regmap_reg_range(0x1400, 0x14ac), /* MIB - Port4 */
+-	regmap_reg_range(0x1500, 0x15ac), /* MIB - Port5 */
+-	regmap_reg_range(0x1600, 0x16ac), /* MIB - Port6 */
+-
+-};
+-
+-static const struct regmap_access_table qca8k_readable_table = {
+-	.yes_ranges = qca8k_readable_ranges,
+-	.n_yes_ranges = ARRAY_SIZE(qca8k_readable_ranges),
+-};
+-
+ static struct regmap_config qca8k_regmap_config = {
+ 	.reg_bits = 16,
+ 	.val_bits = 32,
+--- a/drivers/net/dsa/qca/qca8k-common.c
++++ b/drivers/net/dsa/qca/qca8k-common.c
+@@ -61,3 +61,41 @@ const struct qca8k_mib_desc ar8327_mib[]
+ 	MIB_DESC(1, 0xa8, "RXUnicast"),
+ 	MIB_DESC(1, 0xac, "TXUnicast"),
+ };
++
++int qca8k_read(struct qca8k_priv *priv, u32 reg, u32 *val)
++{
++	return regmap_read(priv->regmap, reg, val);
++}
++
++int qca8k_write(struct qca8k_priv *priv, u32 reg, u32 val)
++{
++	return regmap_write(priv->regmap, reg, val);
++}
++
++int qca8k_rmw(struct qca8k_priv *priv, u32 reg, u32 mask, u32 write_val)
++{
++	return regmap_update_bits(priv->regmap, reg, mask, write_val);
++}
++
++static const struct regmap_range qca8k_readable_ranges[] = {
++	regmap_reg_range(0x0000, 0x00e4), /* Global control */
++	regmap_reg_range(0x0100, 0x0168), /* EEE control */
++	regmap_reg_range(0x0200, 0x0270), /* Parser control */
++	regmap_reg_range(0x0400, 0x0454), /* ACL */
++	regmap_reg_range(0x0600, 0x0718), /* Lookup */
++	regmap_reg_range(0x0800, 0x0b70), /* QM */
++	regmap_reg_range(0x0c00, 0x0c80), /* PKT */
++	regmap_reg_range(0x0e00, 0x0e98), /* L3 */
++	regmap_reg_range(0x1000, 0x10ac), /* MIB - Port0 */
++	regmap_reg_range(0x1100, 0x11ac), /* MIB - Port1 */
++	regmap_reg_range(0x1200, 0x12ac), /* MIB - Port2 */
++	regmap_reg_range(0x1300, 0x13ac), /* MIB - Port3 */
++	regmap_reg_range(0x1400, 0x14ac), /* MIB - Port4 */
++	regmap_reg_range(0x1500, 0x15ac), /* MIB - Port5 */
++	regmap_reg_range(0x1600, 0x16ac), /* MIB - Port6 */
++};
++
++const struct regmap_access_table qca8k_readable_table = {
++	.yes_ranges = qca8k_readable_ranges,
++	.n_yes_ranges = ARRAY_SIZE(qca8k_readable_ranges),
++};
+--- a/drivers/net/dsa/qca/qca8k.h
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -416,5 +416,11 @@ struct qca8k_fdb {
+ 
+ /* Common setup function */
+ extern const struct qca8k_mib_desc ar8327_mib[];
++extern const struct regmap_access_table qca8k_readable_table;
++
++/* Common read/write/rmw function */
++int qca8k_read(struct qca8k_priv *priv, u32 reg, u32 *val);
++int qca8k_write(struct qca8k_priv *priv, u32 reg, u32 val);
++int qca8k_rmw(struct qca8k_priv *priv, u32 reg, u32 mask, u32 write_val);
+ 
+ #endif /* __QCA8K_H */
diff --git a/target/linux/generic/backport-5.15/771-v6.0-05-net-dsa-qca8k-move-qca8k-bulk-read-write-helper-to-c.patch b/target/linux/generic/backport-5.15/771-v6.0-05-net-dsa-qca8k-move-qca8k-bulk-read-write-helper-to-c.patch
new file mode 100644
index 00000000000000..0ed7ed41fbe6c4
--- /dev/null
+++ b/target/linux/generic/backport-5.15/771-v6.0-05-net-dsa-qca8k-move-qca8k-bulk-read-write-helper-to-c.patch
@@ -0,0 +1,145 @@
+From 910746444313dc463396cd63024cdf54ef04ef39 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 27 Jul 2022 13:35:14 +0200
+Subject: [PATCH 05/14] net: dsa: qca8k: move qca8k bulk read/write helper to
+ common code
+
+The same ATU function are used by drivers based on qca8k family switch.
+Move the bulk read/write helper to common code to declare these shared
+ATU functions in common code.
+These helper will be dropped when regmap correctly support bulk
+read/write.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c   | 39 ++----------------------------
+ drivers/net/dsa/qca/qca8k-common.c | 39 ++++++++++++++++++++++++++++++
+ drivers/net/dsa/qca/qca8k.h        |  8 ++++++
+ 3 files changed, 49 insertions(+), 37 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -343,43 +343,6 @@ qca8k_regmap_update_bits_eth(struct qca8
+ }
+ 
+ static int
+-qca8k_bulk_read(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
+-{
+-	int i, count = len / sizeof(u32), ret;
+-
+-	if (priv->mgmt_master && !qca8k_read_eth(priv, reg, val, len))
+-		return 0;
+-
+-	for (i = 0; i < count; i++) {
+-		ret = regmap_read(priv->regmap, reg + (i * 4), val + i);
+-		if (ret < 0)
+-			return ret;
+-	}
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_bulk_write(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
+-{
+-	int i, count = len / sizeof(u32), ret;
+-	u32 tmp;
+-
+-	if (priv->mgmt_master && !qca8k_write_eth(priv, reg, val, len))
+-		return 0;
+-
+-	for (i = 0; i < count; i++) {
+-		tmp = val[i];
+-
+-		ret = regmap_write(priv->regmap, reg + (i * 4), tmp);
+-		if (ret < 0)
+-			return ret;
+-	}
+-
+-	return 0;
+-}
+-
+-static int
+ qca8k_regmap_read(void *ctx, uint32_t reg, uint32_t *val)
+ {
+ 	struct qca8k_priv *priv = (struct qca8k_priv *)ctx;
+@@ -3096,6 +3059,8 @@ static SIMPLE_DEV_PM_OPS(qca8k_pm_ops,
+ 
+ static const struct qca8k_info_ops qca8xxx_ops = {
+ 	.autocast_mib = qca8k_get_ethtool_stats_eth,
++	.read_eth = qca8k_read_eth,
++	.write_eth = qca8k_write_eth,
+ };
+ 
+ static const struct qca8k_match_data qca8327 = {
+--- a/drivers/net/dsa/qca/qca8k-common.c
++++ b/drivers/net/dsa/qca/qca8k-common.c
+@@ -99,3 +99,42 @@ const struct regmap_access_table qca8k_r
+ 	.yes_ranges = qca8k_readable_ranges,
+ 	.n_yes_ranges = ARRAY_SIZE(qca8k_readable_ranges),
+ };
++
++/* TODO: remove these extra ops when we can support regmap bulk read/write */
++int qca8k_bulk_read(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
++{
++	int i, count = len / sizeof(u32), ret;
++
++	if (priv->mgmt_master && priv->info->ops->read_eth &&
++	    !priv->info->ops->read_eth(priv, reg, val, len))
++		return 0;
++
++	for (i = 0; i < count; i++) {
++		ret = regmap_read(priv->regmap, reg + (i * 4), val + i);
++		if (ret < 0)
++			return ret;
++	}
++
++	return 0;
++}
++
++/* TODO: remove these extra ops when we can support regmap bulk read/write */
++int qca8k_bulk_write(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
++{
++	int i, count = len / sizeof(u32), ret;
++	u32 tmp;
++
++	if (priv->mgmt_master && priv->info->ops->write_eth &&
++	    !priv->info->ops->write_eth(priv, reg, val, len))
++		return 0;
++
++	for (i = 0; i < count; i++) {
++		tmp = val[i];
++
++		ret = regmap_write(priv->regmap, reg + (i * 4), tmp);
++		if (ret < 0)
++			return ret;
++	}
++
++	return 0;
++}
+--- a/drivers/net/dsa/qca/qca8k.h
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -324,8 +324,13 @@ enum qca8k_mid_cmd {
+ 	QCA8K_MIB_CAST = 3,
+ };
+ 
++struct qca8k_priv;
++
+ struct qca8k_info_ops {
+ 	int (*autocast_mib)(struct dsa_switch *ds, int port, u64 *data);
++	/* TODO: remove these extra ops when we can support regmap bulk read/write */
++	int (*read_eth)(struct qca8k_priv *priv, u32 reg, u32 *val, int len);
++	int (*write_eth)(struct qca8k_priv *priv, u32 reg, u32 *val, int len);
+ };
+ 
+ struct qca8k_match_data {
+@@ -423,4 +428,7 @@ int qca8k_read(struct qca8k_priv *priv,
+ int qca8k_write(struct qca8k_priv *priv, u32 reg, u32 val);
+ int qca8k_rmw(struct qca8k_priv *priv, u32 reg, u32 mask, u32 write_val);
+ 
++int qca8k_bulk_read(struct qca8k_priv *priv, u32 reg, u32 *val, int len);
++int qca8k_bulk_write(struct qca8k_priv *priv, u32 reg, u32 *val, int len);
++
+ #endif /* __QCA8K_H */
diff --git a/target/linux/generic/backport-5.15/771-v6.0-06-net-dsa-qca8k-move-mib-init-function-to-common-code.patch b/target/linux/generic/backport-5.15/771-v6.0-06-net-dsa-qca8k-move-mib-init-function-to-common-code.patch
new file mode 100644
index 00000000000000..a39a55b89b4b6b
--- /dev/null
+++ b/target/linux/generic/backport-5.15/771-v6.0-06-net-dsa-qca8k-move-mib-init-function-to-common-code.patch
@@ -0,0 +1,137 @@
+From fce1ec0c4e2d03d9c62ffc615a42bdba78eb4c14 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 27 Jul 2022 13:35:15 +0200
+Subject: [PATCH 06/14] net: dsa: qca8k: move mib init function to common code
+
+The same mib function is used by drivers based on qca8k family switch.
+Move it to common code to make it accessible also by other drivers.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c   | 37 ------------------------------
+ drivers/net/dsa/qca/qca8k-common.c | 35 ++++++++++++++++++++++++++++
+ drivers/net/dsa/qca/qca8k.h        |  4 ++++
+ 3 files changed, 39 insertions(+), 37 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -442,15 +442,6 @@ static struct regmap_config qca8k_regmap
+ };
+ 
+ static int
+-qca8k_busy_wait(struct qca8k_priv *priv, u32 reg, u32 mask)
+-{
+-	u32 val;
+-
+-	return regmap_read_poll_timeout(priv->regmap, reg, val, !(val & mask), 0,
+-				       QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC);
+-}
+-
+-static int
+ qca8k_fdb_read(struct qca8k_priv *priv, struct qca8k_fdb *fdb)
+ {
+ 	u32 reg[3];
+@@ -777,34 +768,6 @@ out:
+ 	return ret;
+ }
+ 
+-static int
+-qca8k_mib_init(struct qca8k_priv *priv)
+-{
+-	int ret;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	ret = regmap_update_bits(priv->regmap, QCA8K_REG_MIB,
+-				 QCA8K_MIB_FUNC | QCA8K_MIB_BUSY,
+-				 FIELD_PREP(QCA8K_MIB_FUNC, QCA8K_MIB_FLUSH) |
+-				 QCA8K_MIB_BUSY);
+-	if (ret)
+-		goto exit;
+-
+-	ret = qca8k_busy_wait(priv, QCA8K_REG_MIB, QCA8K_MIB_BUSY);
+-	if (ret)
+-		goto exit;
+-
+-	ret = regmap_set_bits(priv->regmap, QCA8K_REG_MIB, QCA8K_MIB_CPU_KEEP);
+-	if (ret)
+-		goto exit;
+-
+-	ret = qca8k_write(priv, QCA8K_REG_MODULE_EN, QCA8K_MODULE_EN_MIB);
+-
+-exit:
+-	mutex_unlock(&priv->reg_mutex);
+-	return ret;
+-}
+-
+ static void
+ qca8k_port_set_status(struct qca8k_priv *priv, int port, int enable)
+ {
+--- a/drivers/net/dsa/qca/qca8k-common.c
++++ b/drivers/net/dsa/qca/qca8k-common.c
+@@ -7,6 +7,7 @@
+  */
+ 
+ #include <linux/netdevice.h>
++#include <linux/bitfield.h>
+ #include <net/dsa.h>
+ 
+ #include "qca8k.h"
+@@ -138,3 +139,38 @@ int qca8k_bulk_write(struct qca8k_priv *
+ 
+ 	return 0;
+ }
++
++int qca8k_busy_wait(struct qca8k_priv *priv, u32 reg, u32 mask)
++{
++	u32 val;
++
++	return regmap_read_poll_timeout(priv->regmap, reg, val, !(val & mask), 0,
++				       QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC);
++}
++
++int qca8k_mib_init(struct qca8k_priv *priv)
++{
++	int ret;
++
++	mutex_lock(&priv->reg_mutex);
++	ret = regmap_update_bits(priv->regmap, QCA8K_REG_MIB,
++				 QCA8K_MIB_FUNC | QCA8K_MIB_BUSY,
++				 FIELD_PREP(QCA8K_MIB_FUNC, QCA8K_MIB_FLUSH) |
++				 QCA8K_MIB_BUSY);
++	if (ret)
++		goto exit;
++
++	ret = qca8k_busy_wait(priv, QCA8K_REG_MIB, QCA8K_MIB_BUSY);
++	if (ret)
++		goto exit;
++
++	ret = regmap_set_bits(priv->regmap, QCA8K_REG_MIB, QCA8K_MIB_CPU_KEEP);
++	if (ret)
++		goto exit;
++
++	ret = qca8k_write(priv, QCA8K_REG_MODULE_EN, QCA8K_MODULE_EN_MIB);
++
++exit:
++	mutex_unlock(&priv->reg_mutex);
++	return ret;
++}
+--- a/drivers/net/dsa/qca/qca8k.h
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -422,6 +422,7 @@ struct qca8k_fdb {
+ /* Common setup function */
+ extern const struct qca8k_mib_desc ar8327_mib[];
+ extern const struct regmap_access_table qca8k_readable_table;
++int qca8k_mib_init(struct qca8k_priv *priv);
+ 
+ /* Common read/write/rmw function */
+ int qca8k_read(struct qca8k_priv *priv, u32 reg, u32 *val);
+@@ -431,4 +432,7 @@ int qca8k_rmw(struct qca8k_priv *priv, u
+ int qca8k_bulk_read(struct qca8k_priv *priv, u32 reg, u32 *val, int len);
+ int qca8k_bulk_write(struct qca8k_priv *priv, u32 reg, u32 *val, int len);
+ 
++/* Common ops function */
++int qca8k_busy_wait(struct qca8k_priv *priv, u32 reg, u32 mask);
++
+ #endif /* __QCA8K_H */
diff --git a/target/linux/generic/backport-5.15/771-v6.0-07-net-dsa-qca8k-move-port-set-status-eee-ethtool-stats.patch b/target/linux/generic/backport-5.15/771-v6.0-07-net-dsa-qca8k-move-port-set-status-eee-ethtool-stats.patch
new file mode 100644
index 00000000000000..6fd1c66b0ae169
--- /dev/null
+++ b/target/linux/generic/backport-5.15/771-v6.0-07-net-dsa-qca8k-move-port-set-status-eee-ethtool-stats.patch
@@ -0,0 +1,281 @@
+From 472fcea160f27a5d9b7526093d9d8d89ba0b6137 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 27 Jul 2022 13:35:16 +0200
+Subject: [PATCH 07/14] net: dsa: qca8k: move port set status/eee/ethtool stats
+ function to common code
+
+The same logic to disable/enable port, set eee and get ethtool stats is
+used by drivers based on qca8k family switch.
+Move it to common code to make it accessible also by other drivers.
+While at it also drop unnecessary qca8k_priv cast for void pointers.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c   | 105 -----------------------------
+ drivers/net/dsa/qca/qca8k-common.c | 102 ++++++++++++++++++++++++++++
+ drivers/net/dsa/qca/qca8k.h        |  11 +++
+ 3 files changed, 113 insertions(+), 105 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -768,21 +768,6 @@ out:
+ 	return ret;
+ }
+ 
+-static void
+-qca8k_port_set_status(struct qca8k_priv *priv, int port, int enable)
+-{
+-	u32 mask = QCA8K_PORT_STATUS_TXMAC | QCA8K_PORT_STATUS_RXMAC;
+-
+-	/* Port 0 and 6 have no internal PHY */
+-	if (port > 0 && port < 6)
+-		mask |= QCA8K_PORT_STATUS_LINK_AUTO;
+-
+-	if (enable)
+-		regmap_set_bits(priv->regmap, QCA8K_REG_PORT_STATUS(port), mask);
+-	else
+-		regmap_clear_bits(priv->regmap, QCA8K_REG_PORT_STATUS(port), mask);
+-}
+-
+ static int
+ qca8k_phy_eth_busy_wait(struct qca8k_mgmt_eth_data *mgmt_eth_data,
+ 			struct sk_buff *read_skb, u32 *val)
+@@ -1974,20 +1959,6 @@ qca8k_phylink_mac_link_up(struct dsa_swi
+ 	qca8k_write(priv, QCA8K_REG_PORT_STATUS(port), reg);
+ }
+ 
+-static void
+-qca8k_get_strings(struct dsa_switch *ds, int port, u32 stringset, uint8_t *data)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	int i;
+-
+-	if (stringset != ETH_SS_STATS)
+-		return;
+-
+-	for (i = 0; i < priv->info->mib_count; i++)
+-		strncpy(data + i * ETH_GSTRING_LEN, ar8327_mib[i].name,
+-			ETH_GSTRING_LEN);
+-}
+-
+ static void qca8k_mib_autocast_handler(struct dsa_switch *ds, struct sk_buff *skb)
+ {
+ 	struct qca8k_mib_eth_data *mib_eth_data;
+@@ -2078,82 +2049,6 @@ exit:
+ }
+ 
+ static void
+-qca8k_get_ethtool_stats(struct dsa_switch *ds, int port,
+-			uint64_t *data)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	const struct qca8k_mib_desc *mib;
+-	u32 reg, i, val;
+-	u32 hi = 0;
+-	int ret;
+-
+-	if (priv->mgmt_master && priv->info->ops->autocast_mib &&
+-	    priv->info->ops->autocast_mib(ds, port, data) > 0)
+-		return;
+-
+-	for (i = 0; i < priv->info->mib_count; i++) {
+-		mib = &ar8327_mib[i];
+-		reg = QCA8K_PORT_MIB_COUNTER(port) + mib->offset;
+-
+-		ret = qca8k_read(priv, reg, &val);
+-		if (ret < 0)
+-			continue;
+-
+-		if (mib->size == 2) {
+-			ret = qca8k_read(priv, reg + 4, &hi);
+-			if (ret < 0)
+-				continue;
+-		}
+-
+-		data[i] = val;
+-		if (mib->size == 2)
+-			data[i] |= (u64)hi << 32;
+-	}
+-}
+-
+-static int
+-qca8k_get_sset_count(struct dsa_switch *ds, int port, int sset)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-
+-	if (sset != ETH_SS_STATS)
+-		return 0;
+-
+-	return priv->info->mib_count;
+-}
+-
+-static int
+-qca8k_set_mac_eee(struct dsa_switch *ds, int port, struct ethtool_eee *eee)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	u32 lpi_en = QCA8K_REG_EEE_CTRL_LPI_EN(port);
+-	u32 reg;
+-	int ret;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	ret = qca8k_read(priv, QCA8K_REG_EEE_CTRL, &reg);
+-	if (ret < 0)
+-		goto exit;
+-
+-	if (eee->eee_enabled)
+-		reg |= lpi_en;
+-	else
+-		reg &= ~lpi_en;
+-	ret = qca8k_write(priv, QCA8K_REG_EEE_CTRL, reg);
+-
+-exit:
+-	mutex_unlock(&priv->reg_mutex);
+-	return ret;
+-}
+-
+-static int
+-qca8k_get_mac_eee(struct dsa_switch *ds, int port, struct ethtool_eee *e)
+-{
+-	/* Nothing to do on the port's MAC */
+-	return 0;
+-}
+-
+-static void
+ qca8k_port_stp_state_set(struct dsa_switch *ds, int port, u8 state)
+ {
+ 	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+--- a/drivers/net/dsa/qca/qca8k-common.c
++++ b/drivers/net/dsa/qca/qca8k-common.c
+@@ -174,3 +174,105 @@ exit:
+ 	mutex_unlock(&priv->reg_mutex);
+ 	return ret;
+ }
++
++void qca8k_port_set_status(struct qca8k_priv *priv, int port, int enable)
++{
++	u32 mask = QCA8K_PORT_STATUS_TXMAC | QCA8K_PORT_STATUS_RXMAC;
++
++	/* Port 0 and 6 have no internal PHY */
++	if (port > 0 && port < 6)
++		mask |= QCA8K_PORT_STATUS_LINK_AUTO;
++
++	if (enable)
++		regmap_set_bits(priv->regmap, QCA8K_REG_PORT_STATUS(port), mask);
++	else
++		regmap_clear_bits(priv->regmap, QCA8K_REG_PORT_STATUS(port), mask);
++}
++
++void qca8k_get_strings(struct dsa_switch *ds, int port, u32 stringset,
++		       uint8_t *data)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int i;
++
++	if (stringset != ETH_SS_STATS)
++		return;
++
++	for (i = 0; i < priv->info->mib_count; i++)
++		strncpy(data + i * ETH_GSTRING_LEN, ar8327_mib[i].name,
++			ETH_GSTRING_LEN);
++}
++
++void qca8k_get_ethtool_stats(struct dsa_switch *ds, int port,
++			     uint64_t *data)
++{
++	struct qca8k_priv *priv = ds->priv;
++	const struct qca8k_mib_desc *mib;
++	u32 reg, i, val;
++	u32 hi = 0;
++	int ret;
++
++	if (priv->mgmt_master && priv->info->ops->autocast_mib &&
++	    priv->info->ops->autocast_mib(ds, port, data) > 0)
++		return;
++
++	for (i = 0; i < priv->info->mib_count; i++) {
++		mib = &ar8327_mib[i];
++		reg = QCA8K_PORT_MIB_COUNTER(port) + mib->offset;
++
++		ret = qca8k_read(priv, reg, &val);
++		if (ret < 0)
++			continue;
++
++		if (mib->size == 2) {
++			ret = qca8k_read(priv, reg + 4, &hi);
++			if (ret < 0)
++				continue;
++		}
++
++		data[i] = val;
++		if (mib->size == 2)
++			data[i] |= (u64)hi << 32;
++	}
++}
++
++int qca8k_get_sset_count(struct dsa_switch *ds, int port, int sset)
++{
++	struct qca8k_priv *priv = ds->priv;
++
++	if (sset != ETH_SS_STATS)
++		return 0;
++
++	return priv->info->mib_count;
++}
++
++int qca8k_set_mac_eee(struct dsa_switch *ds, int port,
++		      struct ethtool_eee *eee)
++{
++	u32 lpi_en = QCA8K_REG_EEE_CTRL_LPI_EN(port);
++	struct qca8k_priv *priv = ds->priv;
++	u32 reg;
++	int ret;
++
++	mutex_lock(&priv->reg_mutex);
++	ret = qca8k_read(priv, QCA8K_REG_EEE_CTRL, &reg);
++	if (ret < 0)
++		goto exit;
++
++	if (eee->eee_enabled)
++		reg |= lpi_en;
++	else
++		reg &= ~lpi_en;
++	ret = qca8k_write(priv, QCA8K_REG_EEE_CTRL, reg);
++
++exit:
++	mutex_unlock(&priv->reg_mutex);
++	return ret;
++}
++
++int qca8k_get_mac_eee(struct dsa_switch *ds, int port,
++		      struct ethtool_eee *e)
++{
++	/* Nothing to do on the port's MAC */
++	return 0;
++}
+--- a/drivers/net/dsa/qca/qca8k.h
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -423,6 +423,7 @@ struct qca8k_fdb {
+ extern const struct qca8k_mib_desc ar8327_mib[];
+ extern const struct regmap_access_table qca8k_readable_table;
+ int qca8k_mib_init(struct qca8k_priv *priv);
++void qca8k_port_set_status(struct qca8k_priv *priv, int port, int enable);
+ 
+ /* Common read/write/rmw function */
+ int qca8k_read(struct qca8k_priv *priv, u32 reg, u32 *val);
+@@ -435,4 +436,14 @@ int qca8k_bulk_write(struct qca8k_priv *
+ /* Common ops function */
+ int qca8k_busy_wait(struct qca8k_priv *priv, u32 reg, u32 mask);
+ 
++/* Common ethtool stats function */
++void qca8k_get_strings(struct dsa_switch *ds, int port, u32 stringset, uint8_t *data);
++void qca8k_get_ethtool_stats(struct dsa_switch *ds, int port,
++			     uint64_t *data);
++int qca8k_get_sset_count(struct dsa_switch *ds, int port, int sset);
++
++/* Common eee function */
++int qca8k_set_mac_eee(struct dsa_switch *ds, int port, struct ethtool_eee *eee);
++int qca8k_get_mac_eee(struct dsa_switch *ds, int port, struct ethtool_eee *e);
++
+ #endif /* __QCA8K_H */
diff --git a/target/linux/generic/backport-5.15/771-v6.0-08-net-dsa-qca8k-move-bridge-functions-to-common-code.patch b/target/linux/generic/backport-5.15/771-v6.0-08-net-dsa-qca8k-move-bridge-functions-to-common-code.patch
new file mode 100644
index 00000000000000..3ca682d72ccc99
--- /dev/null
+++ b/target/linux/generic/backport-5.15/771-v6.0-08-net-dsa-qca8k-move-bridge-functions-to-common-code.patch
@@ -0,0 +1,237 @@
+From fd3cae2f3ac190d06e48f43739237e02f9dc51ff Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 27 Jul 2022 13:35:17 +0200
+Subject: [PATCH 08/14] net: dsa: qca8k: move bridge functions to common code
+
+The same bridge functions are used by drivers based on qca8k family
+switch. Move them to common code to make them accessible also by other
+drivers.
+While at it also drop unnecessary qca8k_priv cast for void pointers.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c   | 93 ------------------------------
+ drivers/net/dsa/qca/qca8k-common.c | 93 ++++++++++++++++++++++++++++++
+ drivers/net/dsa/qca/qca8k.h        |  9 +++
+ 3 files changed, 102 insertions(+), 93 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -2049,97 +2049,6 @@ exit:
+ }
+ 
+ static void
+-qca8k_port_stp_state_set(struct dsa_switch *ds, int port, u8 state)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	u32 stp_state;
+-
+-	switch (state) {
+-	case BR_STATE_DISABLED:
+-		stp_state = QCA8K_PORT_LOOKUP_STATE_DISABLED;
+-		break;
+-	case BR_STATE_BLOCKING:
+-		stp_state = QCA8K_PORT_LOOKUP_STATE_BLOCKING;
+-		break;
+-	case BR_STATE_LISTENING:
+-		stp_state = QCA8K_PORT_LOOKUP_STATE_LISTENING;
+-		break;
+-	case BR_STATE_LEARNING:
+-		stp_state = QCA8K_PORT_LOOKUP_STATE_LEARNING;
+-		break;
+-	case BR_STATE_FORWARDING:
+-	default:
+-		stp_state = QCA8K_PORT_LOOKUP_STATE_FORWARD;
+-		break;
+-	}
+-
+-	qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+-		  QCA8K_PORT_LOOKUP_STATE_MASK, stp_state);
+-}
+-
+-static int
+-qca8k_port_bridge_join(struct dsa_switch *ds, int port, struct net_device *br)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	int port_mask, cpu_port;
+-	int i, ret;
+-
+-	cpu_port = dsa_to_port(ds, port)->cpu_dp->index;
+-	port_mask = BIT(cpu_port);
+-
+-	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+-		if (dsa_is_cpu_port(ds, i))
+-			continue;
+-		if (dsa_to_port(ds, i)->bridge_dev != br)
+-			continue;
+-		/* Add this port to the portvlan mask of the other ports
+-		 * in the bridge
+-		 */
+-		ret = regmap_set_bits(priv->regmap,
+-				      QCA8K_PORT_LOOKUP_CTRL(i),
+-				      BIT(port));
+-		if (ret)
+-			return ret;
+-		if (i != port)
+-			port_mask |= BIT(i);
+-	}
+-
+-	/* Add all other ports to this ports portvlan mask */
+-	ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+-			QCA8K_PORT_LOOKUP_MEMBER, port_mask);
+-
+-	return ret;
+-}
+-
+-static void
+-qca8k_port_bridge_leave(struct dsa_switch *ds, int port, struct net_device *br)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	int cpu_port, i;
+-
+-	cpu_port = dsa_to_port(ds, port)->cpu_dp->index;
+-
+-	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+-		if (dsa_is_cpu_port(ds, i))
+-			continue;
+-		if (dsa_to_port(ds, i)->bridge_dev != br)
+-			continue;
+-		/* Remove this port to the portvlan mask of the other ports
+-		 * in the bridge
+-		 */
+-		regmap_clear_bits(priv->regmap,
+-				  QCA8K_PORT_LOOKUP_CTRL(i),
+-				  BIT(port));
+-	}
+-
+-	/* Set the cpu port to be the only one in the portvlan mask of
+-	 * this port
+-	 */
+-	qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+-		  QCA8K_PORT_LOOKUP_MEMBER, BIT(cpu_port));
+-}
+-
+-static void
+ qca8k_port_fast_age(struct dsa_switch *ds, int port)
+ {
+ 	struct qca8k_priv *priv = ds->priv;
+--- a/drivers/net/dsa/qca/qca8k-common.c
++++ b/drivers/net/dsa/qca/qca8k-common.c
+@@ -9,6 +9,7 @@
+ #include <linux/netdevice.h>
+ #include <linux/bitfield.h>
+ #include <net/dsa.h>
++#include <linux/if_bridge.h>
+ 
+ #include "qca8k.h"
+ 
+@@ -276,3 +277,93 @@ int qca8k_get_mac_eee(struct dsa_switch
+ 	/* Nothing to do on the port's MAC */
+ 	return 0;
+ }
++
++void qca8k_port_stp_state_set(struct dsa_switch *ds, int port, u8 state)
++{
++	struct qca8k_priv *priv = ds->priv;
++	u32 stp_state;
++
++	switch (state) {
++	case BR_STATE_DISABLED:
++		stp_state = QCA8K_PORT_LOOKUP_STATE_DISABLED;
++		break;
++	case BR_STATE_BLOCKING:
++		stp_state = QCA8K_PORT_LOOKUP_STATE_BLOCKING;
++		break;
++	case BR_STATE_LISTENING:
++		stp_state = QCA8K_PORT_LOOKUP_STATE_LISTENING;
++		break;
++	case BR_STATE_LEARNING:
++		stp_state = QCA8K_PORT_LOOKUP_STATE_LEARNING;
++		break;
++	case BR_STATE_FORWARDING:
++	default:
++		stp_state = QCA8K_PORT_LOOKUP_STATE_FORWARD;
++		break;
++	}
++
++	qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
++		  QCA8K_PORT_LOOKUP_STATE_MASK, stp_state);
++}
++
++int qca8k_port_bridge_join(struct dsa_switch *ds, int port,
++			   struct net_device *br)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int port_mask, cpu_port;
++	int i, ret;
++
++	cpu_port = dsa_to_port(ds, port)->cpu_dp->index;
++	port_mask = BIT(cpu_port);
++
++	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
++		if (dsa_is_cpu_port(ds, i))
++			continue;
++		if (dsa_to_port(ds, i)->bridge_dev != br)
++			continue;
++		/* Add this port to the portvlan mask of the other ports
++		 * in the bridge
++		 */
++		ret = regmap_set_bits(priv->regmap,
++				      QCA8K_PORT_LOOKUP_CTRL(i),
++				      BIT(port));
++		if (ret)
++			return ret;
++		if (i != port)
++			port_mask |= BIT(i);
++	}
++
++	/* Add all other ports to this ports portvlan mask */
++	ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
++			QCA8K_PORT_LOOKUP_MEMBER, port_mask);
++
++	return ret;
++}
++
++void qca8k_port_bridge_leave(struct dsa_switch *ds, int port,
++			     struct net_device *br)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int cpu_port, i;
++
++	cpu_port = dsa_to_port(ds, port)->cpu_dp->index;
++
++	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
++		if (dsa_is_cpu_port(ds, i))
++			continue;
++		if (dsa_to_port(ds, i)->bridge_dev != br)
++			continue;
++		/* Remove this port to the portvlan mask of the other ports
++		 * in the bridge
++		 */
++		regmap_clear_bits(priv->regmap,
++				  QCA8K_PORT_LOOKUP_CTRL(i),
++				  BIT(port));
++	}
++
++	/* Set the cpu port to be the only one in the portvlan mask of
++	 * this port
++	 */
++	qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
++		  QCA8K_PORT_LOOKUP_MEMBER, BIT(cpu_port));
++}
+--- a/drivers/net/dsa/qca/qca8k.h
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -446,4 +446,11 @@ int qca8k_get_sset_count(struct dsa_swit
+ int qca8k_set_mac_eee(struct dsa_switch *ds, int port, struct ethtool_eee *eee);
+ int qca8k_get_mac_eee(struct dsa_switch *ds, int port, struct ethtool_eee *e);
+ 
++/* Common bridge function */
++void qca8k_port_stp_state_set(struct dsa_switch *ds, int port, u8 state);
++int qca8k_port_bridge_join(struct dsa_switch *ds, int port,
++			   struct net_device *br);
++void qca8k_port_bridge_leave(struct dsa_switch *ds, int port,
++			     struct net_device *br);
++
+ #endif /* __QCA8K_H */
diff --git a/target/linux/generic/backport-5.15/771-v6.0-09-net-dsa-qca8k-move-set-age-MTU-port-enable-disable-f.patch b/target/linux/generic/backport-5.15/771-v6.0-09-net-dsa-qca8k-move-set-age-MTU-port-enable-disable-f.patch
new file mode 100644
index 00000000000000..e3414408d64872
--- /dev/null
+++ b/target/linux/generic/backport-5.15/771-v6.0-09-net-dsa-qca8k-move-set-age-MTU-port-enable-disable-f.patch
@@ -0,0 +1,227 @@
+From b3a302b171f73425b41de8d3357fae3fa7057322 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 27 Jul 2022 13:35:18 +0200
+Subject: [PATCH 09/14] net: dsa: qca8k: move set age/MTU/port enable/disable
+ functions to common code
+
+The same set age, MTU and port enable/disable function are used by
+driver based on qca8k family switch.
+Move them to common code to make them accessible also by other drivers.
+While at it also drop unnecessary qca8k_priv cast for void pointers.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c   | 88 ------------------------------
+ drivers/net/dsa/qca/qca8k-common.c | 85 +++++++++++++++++++++++++++++
+ drivers/net/dsa/qca/qca8k.h        | 12 ++++
+ 3 files changed, 97 insertions(+), 88 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -2059,94 +2059,6 @@ qca8k_port_fast_age(struct dsa_switch *d
+ }
+ 
+ static int
+-qca8k_set_ageing_time(struct dsa_switch *ds, unsigned int msecs)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	unsigned int secs = msecs / 1000;
+-	u32 val;
+-
+-	/* AGE_TIME reg is set in 7s step */
+-	val = secs / 7;
+-
+-	/* Handle case with 0 as val to NOT disable
+-	 * learning
+-	 */
+-	if (!val)
+-		val = 1;
+-
+-	return regmap_update_bits(priv->regmap, QCA8K_REG_ATU_CTRL, QCA8K_ATU_AGE_TIME_MASK,
+-				  QCA8K_ATU_AGE_TIME(val));
+-}
+-
+-static int
+-qca8k_port_enable(struct dsa_switch *ds, int port,
+-		  struct phy_device *phy)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-
+-	qca8k_port_set_status(priv, port, 1);
+-	priv->port_enabled_map |= BIT(port);
+-
+-	if (dsa_is_user_port(ds, port))
+-		phy_support_asym_pause(phy);
+-
+-	return 0;
+-}
+-
+-static void
+-qca8k_port_disable(struct dsa_switch *ds, int port)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-
+-	qca8k_port_set_status(priv, port, 0);
+-	priv->port_enabled_map &= ~BIT(port);
+-}
+-
+-static int
+-qca8k_port_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	int ret;
+-
+-	/* We have only have a general MTU setting.
+-	 * DSA always set the CPU port's MTU to the largest MTU of the slave
+-	 * ports.
+-	 * Setting MTU just for the CPU port is sufficient to correctly set a
+-	 * value for every port.
+-	 */
+-	if (!dsa_is_cpu_port(ds, port))
+-		return 0;
+-
+-	/* To change the MAX_FRAME_SIZE the cpu ports must be off or
+-	 * the switch panics.
+-	 * Turn off both cpu ports before applying the new value to prevent
+-	 * this.
+-	 */
+-	if (priv->port_enabled_map & BIT(0))
+-		qca8k_port_set_status(priv, 0, 0);
+-
+-	if (priv->port_enabled_map & BIT(6))
+-		qca8k_port_set_status(priv, 6, 0);
+-
+-	/* Include L2 header / FCS length */
+-	ret = qca8k_write(priv, QCA8K_MAX_FRAME_SIZE, new_mtu + ETH_HLEN + ETH_FCS_LEN);
+-
+-	if (priv->port_enabled_map & BIT(0))
+-		qca8k_port_set_status(priv, 0, 1);
+-
+-	if (priv->port_enabled_map & BIT(6))
+-		qca8k_port_set_status(priv, 6, 1);
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_port_max_mtu(struct dsa_switch *ds, int port)
+-{
+-	return QCA8K_MAX_MTU;
+-}
+-
+-static int
+ qca8k_port_fdb_insert(struct qca8k_priv *priv, const u8 *addr,
+ 		      u16 port_mask, u16 vid)
+ {
+--- a/drivers/net/dsa/qca/qca8k-common.c
++++ b/drivers/net/dsa/qca/qca8k-common.c
+@@ -367,3 +367,88 @@ void qca8k_port_bridge_leave(struct dsa_
+ 	qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+ 		  QCA8K_PORT_LOOKUP_MEMBER, BIT(cpu_port));
+ }
++
++int qca8k_set_ageing_time(struct dsa_switch *ds, unsigned int msecs)
++{
++	struct qca8k_priv *priv = ds->priv;
++	unsigned int secs = msecs / 1000;
++	u32 val;
++
++	/* AGE_TIME reg is set in 7s step */
++	val = secs / 7;
++
++	/* Handle case with 0 as val to NOT disable
++	 * learning
++	 */
++	if (!val)
++		val = 1;
++
++	return regmap_update_bits(priv->regmap, QCA8K_REG_ATU_CTRL,
++				  QCA8K_ATU_AGE_TIME_MASK,
++				  QCA8K_ATU_AGE_TIME(val));
++}
++
++int qca8k_port_enable(struct dsa_switch *ds, int port,
++		      struct phy_device *phy)
++{
++	struct qca8k_priv *priv = ds->priv;
++
++	qca8k_port_set_status(priv, port, 1);
++	priv->port_enabled_map |= BIT(port);
++
++	if (dsa_is_user_port(ds, port))
++		phy_support_asym_pause(phy);
++
++	return 0;
++}
++
++void qca8k_port_disable(struct dsa_switch *ds, int port)
++{
++	struct qca8k_priv *priv = ds->priv;
++
++	qca8k_port_set_status(priv, port, 0);
++	priv->port_enabled_map &= ~BIT(port);
++}
++
++int qca8k_port_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int ret;
++
++	/* We have only have a general MTU setting.
++	 * DSA always set the CPU port's MTU to the largest MTU of the slave
++	 * ports.
++	 * Setting MTU just for the CPU port is sufficient to correctly set a
++	 * value for every port.
++	 */
++	if (!dsa_is_cpu_port(ds, port))
++		return 0;
++
++	/* To change the MAX_FRAME_SIZE the cpu ports must be off or
++	 * the switch panics.
++	 * Turn off both cpu ports before applying the new value to prevent
++	 * this.
++	 */
++	if (priv->port_enabled_map & BIT(0))
++		qca8k_port_set_status(priv, 0, 0);
++
++	if (priv->port_enabled_map & BIT(6))
++		qca8k_port_set_status(priv, 6, 0);
++
++	/* Include L2 header / FCS length */
++	ret = qca8k_write(priv, QCA8K_MAX_FRAME_SIZE, new_mtu +
++			  ETH_HLEN + ETH_FCS_LEN);
++
++	if (priv->port_enabled_map & BIT(0))
++		qca8k_port_set_status(priv, 0, 1);
++
++	if (priv->port_enabled_map & BIT(6))
++		qca8k_port_set_status(priv, 6, 1);
++
++	return ret;
++}
++
++int qca8k_port_max_mtu(struct dsa_switch *ds, int port)
++{
++	return QCA8K_MAX_MTU;
++}
+--- a/drivers/net/dsa/qca/qca8k.h
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -453,4 +453,16 @@ int qca8k_port_bridge_join(struct dsa_sw
+ void qca8k_port_bridge_leave(struct dsa_switch *ds, int port,
+ 			     struct net_device *br);
+ 
++/* Common port enable/disable function */
++int qca8k_port_enable(struct dsa_switch *ds, int port,
++		      struct phy_device *phy);
++void qca8k_port_disable(struct dsa_switch *ds, int port);
++
++/* Common MTU function */
++int qca8k_port_change_mtu(struct dsa_switch *ds, int port, int new_mtu);
++int qca8k_port_max_mtu(struct dsa_switch *ds, int port);
++
++/* Common fast age function */
++int qca8k_set_ageing_time(struct dsa_switch *ds, unsigned int msecs);
++
+ #endif /* __QCA8K_H */
diff --git a/target/linux/generic/backport-5.15/771-v6.0-10-net-dsa-qca8k-move-port-FDB-MDB-function-to-common-c.patch b/target/linux/generic/backport-5.15/771-v6.0-10-net-dsa-qca8k-move-port-FDB-MDB-function-to-common-c.patch
new file mode 100644
index 00000000000000..96468ae74e9a9d
--- /dev/null
+++ b/target/linux/generic/backport-5.15/771-v6.0-10-net-dsa-qca8k-move-port-FDB-MDB-function-to-common-c.patch
@@ -0,0 +1,704 @@
+From 2e5bd96eea86a246b4de3bf756f7a11b43e6187d Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 27 Jul 2022 13:35:19 +0200
+Subject: [PATCH 10/14] net: dsa: qca8k: move port FDB/MDB function to common
+ code
+
+The same port FDB/MDB function are used by drivers based on qca8k family
+switch. Move them to common code to make them accessible also by other
+drivers.
+Also drop bulk read/write functions and make them static
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c   | 306 -----------------------------
+ drivers/net/dsa/qca/qca8k-common.c | 297 +++++++++++++++++++++++++++-
+ drivers/net/dsa/qca/qca8k.h        |  25 ++-
+ 3 files changed, 317 insertions(+), 311 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -442,217 +442,6 @@ static struct regmap_config qca8k_regmap
+ };
+ 
+ static int
+-qca8k_fdb_read(struct qca8k_priv *priv, struct qca8k_fdb *fdb)
+-{
+-	u32 reg[3];
+-	int ret;
+-
+-	/* load the ARL table into an array */
+-	ret = qca8k_bulk_read(priv, QCA8K_REG_ATU_DATA0, reg, sizeof(reg));
+-	if (ret)
+-		return ret;
+-
+-	/* vid - 83:72 */
+-	fdb->vid = FIELD_GET(QCA8K_ATU_VID_MASK, reg[2]);
+-	/* aging - 67:64 */
+-	fdb->aging = FIELD_GET(QCA8K_ATU_STATUS_MASK, reg[2]);
+-	/* portmask - 54:48 */
+-	fdb->port_mask = FIELD_GET(QCA8K_ATU_PORT_MASK, reg[1]);
+-	/* mac - 47:0 */
+-	fdb->mac[0] = FIELD_GET(QCA8K_ATU_ADDR0_MASK, reg[1]);
+-	fdb->mac[1] = FIELD_GET(QCA8K_ATU_ADDR1_MASK, reg[1]);
+-	fdb->mac[2] = FIELD_GET(QCA8K_ATU_ADDR2_MASK, reg[0]);
+-	fdb->mac[3] = FIELD_GET(QCA8K_ATU_ADDR3_MASK, reg[0]);
+-	fdb->mac[4] = FIELD_GET(QCA8K_ATU_ADDR4_MASK, reg[0]);
+-	fdb->mac[5] = FIELD_GET(QCA8K_ATU_ADDR5_MASK, reg[0]);
+-
+-	return 0;
+-}
+-
+-static void
+-qca8k_fdb_write(struct qca8k_priv *priv, u16 vid, u8 port_mask, const u8 *mac,
+-		u8 aging)
+-{
+-	u32 reg[3] = { 0 };
+-
+-	/* vid - 83:72 */
+-	reg[2] = FIELD_PREP(QCA8K_ATU_VID_MASK, vid);
+-	/* aging - 67:64 */
+-	reg[2] |= FIELD_PREP(QCA8K_ATU_STATUS_MASK, aging);
+-	/* portmask - 54:48 */
+-	reg[1] = FIELD_PREP(QCA8K_ATU_PORT_MASK, port_mask);
+-	/* mac - 47:0 */
+-	reg[1] |= FIELD_PREP(QCA8K_ATU_ADDR0_MASK, mac[0]);
+-	reg[1] |= FIELD_PREP(QCA8K_ATU_ADDR1_MASK, mac[1]);
+-	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR2_MASK, mac[2]);
+-	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR3_MASK, mac[3]);
+-	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR4_MASK, mac[4]);
+-	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR5_MASK, mac[5]);
+-
+-	/* load the array into the ARL table */
+-	qca8k_bulk_write(priv, QCA8K_REG_ATU_DATA0, reg, sizeof(reg));
+-}
+-
+-static int
+-qca8k_fdb_access(struct qca8k_priv *priv, enum qca8k_fdb_cmd cmd, int port)
+-{
+-	u32 reg;
+-	int ret;
+-
+-	/* Set the command and FDB index */
+-	reg = QCA8K_ATU_FUNC_BUSY;
+-	reg |= cmd;
+-	if (port >= 0) {
+-		reg |= QCA8K_ATU_FUNC_PORT_EN;
+-		reg |= FIELD_PREP(QCA8K_ATU_FUNC_PORT_MASK, port);
+-	}
+-
+-	/* Write the function register triggering the table access */
+-	ret = qca8k_write(priv, QCA8K_REG_ATU_FUNC, reg);
+-	if (ret)
+-		return ret;
+-
+-	/* wait for completion */
+-	ret = qca8k_busy_wait(priv, QCA8K_REG_ATU_FUNC, QCA8K_ATU_FUNC_BUSY);
+-	if (ret)
+-		return ret;
+-
+-	/* Check for table full violation when adding an entry */
+-	if (cmd == QCA8K_FDB_LOAD) {
+-		ret = qca8k_read(priv, QCA8K_REG_ATU_FUNC, &reg);
+-		if (ret < 0)
+-			return ret;
+-		if (reg & QCA8K_ATU_FUNC_FULL)
+-			return -1;
+-	}
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_fdb_next(struct qca8k_priv *priv, struct qca8k_fdb *fdb, int port)
+-{
+-	int ret;
+-
+-	qca8k_fdb_write(priv, fdb->vid, fdb->port_mask, fdb->mac, fdb->aging);
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_NEXT, port);
+-	if (ret < 0)
+-		return ret;
+-
+-	return qca8k_fdb_read(priv, fdb);
+-}
+-
+-static int
+-qca8k_fdb_add(struct qca8k_priv *priv, const u8 *mac, u16 port_mask,
+-	      u16 vid, u8 aging)
+-{
+-	int ret;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	qca8k_fdb_write(priv, vid, port_mask, mac, aging);
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_LOAD, -1);
+-	mutex_unlock(&priv->reg_mutex);
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_fdb_del(struct qca8k_priv *priv, const u8 *mac, u16 port_mask, u16 vid)
+-{
+-	int ret;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	qca8k_fdb_write(priv, vid, port_mask, mac, 0);
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_PURGE, -1);
+-	mutex_unlock(&priv->reg_mutex);
+-
+-	return ret;
+-}
+-
+-static void
+-qca8k_fdb_flush(struct qca8k_priv *priv)
+-{
+-	mutex_lock(&priv->reg_mutex);
+-	qca8k_fdb_access(priv, QCA8K_FDB_FLUSH, -1);
+-	mutex_unlock(&priv->reg_mutex);
+-}
+-
+-static int
+-qca8k_fdb_search_and_insert(struct qca8k_priv *priv, u8 port_mask,
+-			    const u8 *mac, u16 vid)
+-{
+-	struct qca8k_fdb fdb = { 0 };
+-	int ret;
+-
+-	mutex_lock(&priv->reg_mutex);
+-
+-	qca8k_fdb_write(priv, vid, 0, mac, 0);
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_SEARCH, -1);
+-	if (ret < 0)
+-		goto exit;
+-
+-	ret = qca8k_fdb_read(priv, &fdb);
+-	if (ret < 0)
+-		goto exit;
+-
+-	/* Rule exist. Delete first */
+-	if (!fdb.aging) {
+-		ret = qca8k_fdb_access(priv, QCA8K_FDB_PURGE, -1);
+-		if (ret)
+-			goto exit;
+-	}
+-
+-	/* Add port to fdb portmask */
+-	fdb.port_mask |= port_mask;
+-
+-	qca8k_fdb_write(priv, vid, fdb.port_mask, mac, fdb.aging);
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_LOAD, -1);
+-
+-exit:
+-	mutex_unlock(&priv->reg_mutex);
+-	return ret;
+-}
+-
+-static int
+-qca8k_fdb_search_and_del(struct qca8k_priv *priv, u8 port_mask,
+-			 const u8 *mac, u16 vid)
+-{
+-	struct qca8k_fdb fdb = { 0 };
+-	int ret;
+-
+-	mutex_lock(&priv->reg_mutex);
+-
+-	qca8k_fdb_write(priv, vid, 0, mac, 0);
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_SEARCH, -1);
+-	if (ret < 0)
+-		goto exit;
+-
+-	/* Rule doesn't exist. Why delete? */
+-	if (!fdb.aging) {
+-		ret = -EINVAL;
+-		goto exit;
+-	}
+-
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_PURGE, -1);
+-	if (ret)
+-		goto exit;
+-
+-	/* Only port in the rule is this port. Don't re insert */
+-	if (fdb.port_mask == port_mask)
+-		goto exit;
+-
+-	/* Remove port from port mask */
+-	fdb.port_mask &= ~port_mask;
+-
+-	qca8k_fdb_write(priv, vid, fdb.port_mask, mac, fdb.aging);
+-	ret = qca8k_fdb_access(priv, QCA8K_FDB_LOAD, -1);
+-
+-exit:
+-	mutex_unlock(&priv->reg_mutex);
+-	return ret;
+-}
+-
+-static int
+ qca8k_vlan_access(struct qca8k_priv *priv, enum qca8k_vlan_cmd cmd, u16 vid)
+ {
+ 	u32 reg;
+@@ -2048,97 +1837,6 @@ exit:
+ 	return ret;
+ }
+ 
+-static void
+-qca8k_port_fast_age(struct dsa_switch *ds, int port)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	qca8k_fdb_access(priv, QCA8K_FDB_FLUSH_PORT, port);
+-	mutex_unlock(&priv->reg_mutex);
+-}
+-
+-static int
+-qca8k_port_fdb_insert(struct qca8k_priv *priv, const u8 *addr,
+-		      u16 port_mask, u16 vid)
+-{
+-	/* Set the vid to the port vlan id if no vid is set */
+-	if (!vid)
+-		vid = QCA8K_PORT_VID_DEF;
+-
+-	return qca8k_fdb_add(priv, addr, port_mask, vid,
+-			     QCA8K_ATU_STATUS_STATIC);
+-}
+-
+-static int
+-qca8k_port_fdb_add(struct dsa_switch *ds, int port,
+-		   const unsigned char *addr, u16 vid)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	u16 port_mask = BIT(port);
+-
+-	return qca8k_port_fdb_insert(priv, addr, port_mask, vid);
+-}
+-
+-static int
+-qca8k_port_fdb_del(struct dsa_switch *ds, int port,
+-		   const unsigned char *addr, u16 vid)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	u16 port_mask = BIT(port);
+-
+-	if (!vid)
+-		vid = QCA8K_PORT_VID_DEF;
+-
+-	return qca8k_fdb_del(priv, addr, port_mask, vid);
+-}
+-
+-static int
+-qca8k_port_fdb_dump(struct dsa_switch *ds, int port,
+-		    dsa_fdb_dump_cb_t *cb, void *data)
+-{
+-	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-	struct qca8k_fdb _fdb = { 0 };
+-	int cnt = QCA8K_NUM_FDB_RECORDS;
+-	bool is_static;
+-	int ret = 0;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	while (cnt-- && !qca8k_fdb_next(priv, &_fdb, port)) {
+-		if (!_fdb.aging)
+-			break;
+-		is_static = (_fdb.aging == QCA8K_ATU_STATUS_STATIC);
+-		ret = cb(_fdb.mac, _fdb.vid, is_static, data);
+-		if (ret)
+-			break;
+-	}
+-	mutex_unlock(&priv->reg_mutex);
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_port_mdb_add(struct dsa_switch *ds, int port,
+-		   const struct switchdev_obj_port_mdb *mdb)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	const u8 *addr = mdb->addr;
+-	u16 vid = mdb->vid;
+-
+-	return qca8k_fdb_search_and_insert(priv, BIT(port), addr, vid);
+-}
+-
+-static int
+-qca8k_port_mdb_del(struct dsa_switch *ds, int port,
+-		   const struct switchdev_obj_port_mdb *mdb)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	const u8 *addr = mdb->addr;
+-	u16 vid = mdb->vid;
+-
+-	return qca8k_fdb_search_and_del(priv, BIT(port), addr, vid);
+-}
+-
+ static int
+ qca8k_port_mirror_add(struct dsa_switch *ds, int port,
+ 		      struct dsa_mall_mirror_tc_entry *mirror,
+--- a/drivers/net/dsa/qca/qca8k-common.c
++++ b/drivers/net/dsa/qca/qca8k-common.c
+@@ -103,7 +103,7 @@ const struct regmap_access_table qca8k_r
+ };
+ 
+ /* TODO: remove these extra ops when we can support regmap bulk read/write */
+-int qca8k_bulk_read(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
++static int qca8k_bulk_read(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
+ {
+ 	int i, count = len / sizeof(u32), ret;
+ 
+@@ -121,7 +121,7 @@ int qca8k_bulk_read(struct qca8k_priv *p
+ }
+ 
+ /* TODO: remove these extra ops when we can support regmap bulk read/write */
+-int qca8k_bulk_write(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
++static int qca8k_bulk_write(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
+ {
+ 	int i, count = len / sizeof(u32), ret;
+ 	u32 tmp;
+@@ -149,6 +149,211 @@ int qca8k_busy_wait(struct qca8k_priv *p
+ 				       QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC);
+ }
+ 
++static int qca8k_fdb_read(struct qca8k_priv *priv, struct qca8k_fdb *fdb)
++{
++	u32 reg[3];
++	int ret;
++
++	/* load the ARL table into an array */
++	ret = qca8k_bulk_read(priv, QCA8K_REG_ATU_DATA0, reg, sizeof(reg));
++	if (ret)
++		return ret;
++
++	/* vid - 83:72 */
++	fdb->vid = FIELD_GET(QCA8K_ATU_VID_MASK, reg[2]);
++	/* aging - 67:64 */
++	fdb->aging = FIELD_GET(QCA8K_ATU_STATUS_MASK, reg[2]);
++	/* portmask - 54:48 */
++	fdb->port_mask = FIELD_GET(QCA8K_ATU_PORT_MASK, reg[1]);
++	/* mac - 47:0 */
++	fdb->mac[0] = FIELD_GET(QCA8K_ATU_ADDR0_MASK, reg[1]);
++	fdb->mac[1] = FIELD_GET(QCA8K_ATU_ADDR1_MASK, reg[1]);
++	fdb->mac[2] = FIELD_GET(QCA8K_ATU_ADDR2_MASK, reg[0]);
++	fdb->mac[3] = FIELD_GET(QCA8K_ATU_ADDR3_MASK, reg[0]);
++	fdb->mac[4] = FIELD_GET(QCA8K_ATU_ADDR4_MASK, reg[0]);
++	fdb->mac[5] = FIELD_GET(QCA8K_ATU_ADDR5_MASK, reg[0]);
++
++	return 0;
++}
++
++static void qca8k_fdb_write(struct qca8k_priv *priv, u16 vid, u8 port_mask,
++			    const u8 *mac, u8 aging)
++{
++	u32 reg[3] = { 0 };
++
++	/* vid - 83:72 */
++	reg[2] = FIELD_PREP(QCA8K_ATU_VID_MASK, vid);
++	/* aging - 67:64 */
++	reg[2] |= FIELD_PREP(QCA8K_ATU_STATUS_MASK, aging);
++	/* portmask - 54:48 */
++	reg[1] = FIELD_PREP(QCA8K_ATU_PORT_MASK, port_mask);
++	/* mac - 47:0 */
++	reg[1] |= FIELD_PREP(QCA8K_ATU_ADDR0_MASK, mac[0]);
++	reg[1] |= FIELD_PREP(QCA8K_ATU_ADDR1_MASK, mac[1]);
++	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR2_MASK, mac[2]);
++	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR3_MASK, mac[3]);
++	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR4_MASK, mac[4]);
++	reg[0] |= FIELD_PREP(QCA8K_ATU_ADDR5_MASK, mac[5]);
++
++	/* load the array into the ARL table */
++	qca8k_bulk_write(priv, QCA8K_REG_ATU_DATA0, reg, sizeof(reg));
++}
++
++static int qca8k_fdb_access(struct qca8k_priv *priv, enum qca8k_fdb_cmd cmd,
++			    int port)
++{
++	u32 reg;
++	int ret;
++
++	/* Set the command and FDB index */
++	reg = QCA8K_ATU_FUNC_BUSY;
++	reg |= cmd;
++	if (port >= 0) {
++		reg |= QCA8K_ATU_FUNC_PORT_EN;
++		reg |= FIELD_PREP(QCA8K_ATU_FUNC_PORT_MASK, port);
++	}
++
++	/* Write the function register triggering the table access */
++	ret = qca8k_write(priv, QCA8K_REG_ATU_FUNC, reg);
++	if (ret)
++		return ret;
++
++	/* wait for completion */
++	ret = qca8k_busy_wait(priv, QCA8K_REG_ATU_FUNC, QCA8K_ATU_FUNC_BUSY);
++	if (ret)
++		return ret;
++
++	/* Check for table full violation when adding an entry */
++	if (cmd == QCA8K_FDB_LOAD) {
++		ret = qca8k_read(priv, QCA8K_REG_ATU_FUNC, &reg);
++		if (ret < 0)
++			return ret;
++		if (reg & QCA8K_ATU_FUNC_FULL)
++			return -1;
++	}
++
++	return 0;
++}
++
++static int qca8k_fdb_next(struct qca8k_priv *priv, struct qca8k_fdb *fdb,
++			  int port)
++{
++	int ret;
++
++	qca8k_fdb_write(priv, fdb->vid, fdb->port_mask, fdb->mac, fdb->aging);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_NEXT, port);
++	if (ret < 0)
++		return ret;
++
++	return qca8k_fdb_read(priv, fdb);
++}
++
++static int qca8k_fdb_add(struct qca8k_priv *priv, const u8 *mac,
++			 u16 port_mask, u16 vid, u8 aging)
++{
++	int ret;
++
++	mutex_lock(&priv->reg_mutex);
++	qca8k_fdb_write(priv, vid, port_mask, mac, aging);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_LOAD, -1);
++	mutex_unlock(&priv->reg_mutex);
++
++	return ret;
++}
++
++static int qca8k_fdb_del(struct qca8k_priv *priv, const u8 *mac,
++			 u16 port_mask, u16 vid)
++{
++	int ret;
++
++	mutex_lock(&priv->reg_mutex);
++	qca8k_fdb_write(priv, vid, port_mask, mac, 0);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_PURGE, -1);
++	mutex_unlock(&priv->reg_mutex);
++
++	return ret;
++}
++
++void qca8k_fdb_flush(struct qca8k_priv *priv)
++{
++	mutex_lock(&priv->reg_mutex);
++	qca8k_fdb_access(priv, QCA8K_FDB_FLUSH, -1);
++	mutex_unlock(&priv->reg_mutex);
++}
++
++static int qca8k_fdb_search_and_insert(struct qca8k_priv *priv, u8 port_mask,
++				       const u8 *mac, u16 vid)
++{
++	struct qca8k_fdb fdb = { 0 };
++	int ret;
++
++	mutex_lock(&priv->reg_mutex);
++
++	qca8k_fdb_write(priv, vid, 0, mac, 0);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_SEARCH, -1);
++	if (ret < 0)
++		goto exit;
++
++	ret = qca8k_fdb_read(priv, &fdb);
++	if (ret < 0)
++		goto exit;
++
++	/* Rule exist. Delete first */
++	if (!fdb.aging) {
++		ret = qca8k_fdb_access(priv, QCA8K_FDB_PURGE, -1);
++		if (ret)
++			goto exit;
++	}
++
++	/* Add port to fdb portmask */
++	fdb.port_mask |= port_mask;
++
++	qca8k_fdb_write(priv, vid, fdb.port_mask, mac, fdb.aging);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_LOAD, -1);
++
++exit:
++	mutex_unlock(&priv->reg_mutex);
++	return ret;
++}
++
++static int qca8k_fdb_search_and_del(struct qca8k_priv *priv, u8 port_mask,
++				    const u8 *mac, u16 vid)
++{
++	struct qca8k_fdb fdb = { 0 };
++	int ret;
++
++	mutex_lock(&priv->reg_mutex);
++
++	qca8k_fdb_write(priv, vid, 0, mac, 0);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_SEARCH, -1);
++	if (ret < 0)
++		goto exit;
++
++	/* Rule doesn't exist. Why delete? */
++	if (!fdb.aging) {
++		ret = -EINVAL;
++		goto exit;
++	}
++
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_PURGE, -1);
++	if (ret)
++		goto exit;
++
++	/* Only port in the rule is this port. Don't re insert */
++	if (fdb.port_mask == port_mask)
++		goto exit;
++
++	/* Remove port from port mask */
++	fdb.port_mask &= ~port_mask;
++
++	qca8k_fdb_write(priv, vid, fdb.port_mask, mac, fdb.aging);
++	ret = qca8k_fdb_access(priv, QCA8K_FDB_LOAD, -1);
++
++exit:
++	mutex_unlock(&priv->reg_mutex);
++	return ret;
++}
++
+ int qca8k_mib_init(struct qca8k_priv *priv)
+ {
+ 	int ret;
+@@ -368,6 +573,15 @@ void qca8k_port_bridge_leave(struct dsa_
+ 		  QCA8K_PORT_LOOKUP_MEMBER, BIT(cpu_port));
+ }
+ 
++void qca8k_port_fast_age(struct dsa_switch *ds, int port)
++{
++	struct qca8k_priv *priv = ds->priv;
++
++	mutex_lock(&priv->reg_mutex);
++	qca8k_fdb_access(priv, QCA8K_FDB_FLUSH_PORT, port);
++	mutex_unlock(&priv->reg_mutex);
++}
++
+ int qca8k_set_ageing_time(struct dsa_switch *ds, unsigned int msecs)
+ {
+ 	struct qca8k_priv *priv = ds->priv;
+@@ -452,3 +666,78 @@ int qca8k_port_max_mtu(struct dsa_switch
+ {
+ 	return QCA8K_MAX_MTU;
+ }
++
++int qca8k_port_fdb_insert(struct qca8k_priv *priv, const u8 *addr,
++			  u16 port_mask, u16 vid)
++{
++	/* Set the vid to the port vlan id if no vid is set */
++	if (!vid)
++		vid = QCA8K_PORT_VID_DEF;
++
++	return qca8k_fdb_add(priv, addr, port_mask, vid,
++			     QCA8K_ATU_STATUS_STATIC);
++}
++
++int qca8k_port_fdb_add(struct dsa_switch *ds, int port,
++		       const unsigned char *addr, u16 vid)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	u16 port_mask = BIT(port);
++
++	return qca8k_port_fdb_insert(priv, addr, port_mask, vid);
++}
++
++int qca8k_port_fdb_del(struct dsa_switch *ds, int port,
++		       const unsigned char *addr, u16 vid)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	u16 port_mask = BIT(port);
++
++	if (!vid)
++		vid = QCA8K_PORT_VID_DEF;
++
++	return qca8k_fdb_del(priv, addr, port_mask, vid);
++}
++
++int qca8k_port_fdb_dump(struct dsa_switch *ds, int port,
++			dsa_fdb_dump_cb_t *cb, void *data)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	struct qca8k_fdb _fdb = { 0 };
++	int cnt = QCA8K_NUM_FDB_RECORDS;
++	bool is_static;
++	int ret = 0;
++
++	mutex_lock(&priv->reg_mutex);
++	while (cnt-- && !qca8k_fdb_next(priv, &_fdb, port)) {
++		if (!_fdb.aging)
++			break;
++		is_static = (_fdb.aging == QCA8K_ATU_STATUS_STATIC);
++		ret = cb(_fdb.mac, _fdb.vid, is_static, data);
++		if (ret)
++			break;
++	}
++	mutex_unlock(&priv->reg_mutex);
++
++	return 0;
++}
++
++int qca8k_port_mdb_add(struct dsa_switch *ds, int port,
++		       const struct switchdev_obj_port_mdb *mdb)
++{
++	struct qca8k_priv *priv = ds->priv;
++	const u8 *addr = mdb->addr;
++	u16 vid = mdb->vid;
++
++	return qca8k_fdb_search_and_insert(priv, BIT(port), addr, vid);
++}
++
++int qca8k_port_mdb_del(struct dsa_switch *ds, int port,
++		       const struct switchdev_obj_port_mdb *mdb)
++{
++	struct qca8k_priv *priv = ds->priv;
++	const u8 *addr = mdb->addr;
++	u16 vid = mdb->vid;
++
++	return qca8k_fdb_search_and_del(priv, BIT(port), addr, vid);
++}
+--- a/drivers/net/dsa/qca/qca8k.h
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -430,11 +430,9 @@ int qca8k_read(struct qca8k_priv *priv,
+ int qca8k_write(struct qca8k_priv *priv, u32 reg, u32 val);
+ int qca8k_rmw(struct qca8k_priv *priv, u32 reg, u32 mask, u32 write_val);
+ 
+-int qca8k_bulk_read(struct qca8k_priv *priv, u32 reg, u32 *val, int len);
+-int qca8k_bulk_write(struct qca8k_priv *priv, u32 reg, u32 *val, int len);
+-
+ /* Common ops function */
+ int qca8k_busy_wait(struct qca8k_priv *priv, u32 reg, u32 mask);
++void qca8k_fdb_flush(struct qca8k_priv *priv);
+ 
+ /* Common ethtool stats function */
+ void qca8k_get_strings(struct dsa_switch *ds, int port, u32 stringset, uint8_t *data);
+@@ -463,6 +461,23 @@ int qca8k_port_change_mtu(struct dsa_swi
+ int qca8k_port_max_mtu(struct dsa_switch *ds, int port);
+ 
+ /* Common fast age function */
++void qca8k_port_fast_age(struct dsa_switch *ds, int port);
+ int qca8k_set_ageing_time(struct dsa_switch *ds, unsigned int msecs);
+ 
++/* Common FDB function */
++int qca8k_port_fdb_insert(struct qca8k_priv *priv, const u8 *addr,
++			  u16 port_mask, u16 vid);
++int qca8k_port_fdb_add(struct dsa_switch *ds, int port,
++		       const unsigned char *addr, u16 vid);
++int qca8k_port_fdb_del(struct dsa_switch *ds, int port,
++		       const unsigned char *addr, u16 vid);
++int qca8k_port_fdb_dump(struct dsa_switch *ds, int port,
++			dsa_fdb_dump_cb_t *cb, void *data);
++
++/* Common MDB function */
++int qca8k_port_mdb_add(struct dsa_switch *ds, int port,
++		       const struct switchdev_obj_port_mdb *mdb);
++int qca8k_port_mdb_del(struct dsa_switch *ds, int port,
++		       const struct switchdev_obj_port_mdb *mdb);
++
+ #endif /* __QCA8K_H */
diff --git a/target/linux/generic/backport-5.15/771-v6.0-11-net-dsa-qca8k-move-port-mirror-functions-to-common-c.patch b/target/linux/generic/backport-5.15/771-v6.0-11-net-dsa-qca8k-move-port-mirror-functions-to-common-c.patch
new file mode 100644
index 00000000000000..c1336d4a92164d
--- /dev/null
+++ b/target/linux/generic/backport-5.15/771-v6.0-11-net-dsa-qca8k-move-port-mirror-functions-to-common-c.patch
@@ -0,0 +1,232 @@
+From 742d37a84d3f7bb60d9b2d9ada9ad4e599f65ebf Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 27 Jul 2022 13:35:20 +0200
+Subject: [PATCH 11/14] net: dsa: qca8k: move port mirror functions to common
+ code
+
+The same port mirror functions are used by drivers based on qca8k family
+switch. Move them to common code to make them accessible also by other
+drivers.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c   | 93 ------------------------------
+ drivers/net/dsa/qca/qca8k-common.c | 91 +++++++++++++++++++++++++++++
+ drivers/net/dsa/qca/qca8k.h        |  7 +++
+ 3 files changed, 98 insertions(+), 93 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -1838,99 +1838,6 @@ exit:
+ }
+ 
+ static int
+-qca8k_port_mirror_add(struct dsa_switch *ds, int port,
+-		      struct dsa_mall_mirror_tc_entry *mirror,
+-		      bool ingress)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	int monitor_port, ret;
+-	u32 reg, val;
+-
+-	/* Check for existent entry */
+-	if ((ingress ? priv->mirror_rx : priv->mirror_tx) & BIT(port))
+-		return -EEXIST;
+-
+-	ret = regmap_read(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0, &val);
+-	if (ret)
+-		return ret;
+-
+-	/* QCA83xx can have only one port set to mirror mode.
+-	 * Check that the correct port is requested and return error otherwise.
+-	 * When no mirror port is set, the values is set to 0xF
+-	 */
+-	monitor_port = FIELD_GET(QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, val);
+-	if (monitor_port != 0xF && monitor_port != mirror->to_local_port)
+-		return -EEXIST;
+-
+-	/* Set the monitor port */
+-	val = FIELD_PREP(QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM,
+-			 mirror->to_local_port);
+-	ret = regmap_update_bits(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0,
+-				 QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, val);
+-	if (ret)
+-		return ret;
+-
+-	if (ingress) {
+-		reg = QCA8K_PORT_LOOKUP_CTRL(port);
+-		val = QCA8K_PORT_LOOKUP_ING_MIRROR_EN;
+-	} else {
+-		reg = QCA8K_REG_PORT_HOL_CTRL1(port);
+-		val = QCA8K_PORT_HOL_CTRL1_EG_MIRROR_EN;
+-	}
+-
+-	ret = regmap_update_bits(priv->regmap, reg, val, val);
+-	if (ret)
+-		return ret;
+-
+-	/* Track mirror port for tx and rx to decide when the
+-	 * mirror port has to be disabled.
+-	 */
+-	if (ingress)
+-		priv->mirror_rx |= BIT(port);
+-	else
+-		priv->mirror_tx |= BIT(port);
+-
+-	return 0;
+-}
+-
+-static void
+-qca8k_port_mirror_del(struct dsa_switch *ds, int port,
+-		      struct dsa_mall_mirror_tc_entry *mirror)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	u32 reg, val;
+-	int ret;
+-
+-	if (mirror->ingress) {
+-		reg = QCA8K_PORT_LOOKUP_CTRL(port);
+-		val = QCA8K_PORT_LOOKUP_ING_MIRROR_EN;
+-	} else {
+-		reg = QCA8K_REG_PORT_HOL_CTRL1(port);
+-		val = QCA8K_PORT_HOL_CTRL1_EG_MIRROR_EN;
+-	}
+-
+-	ret = regmap_clear_bits(priv->regmap, reg, val);
+-	if (ret)
+-		goto err;
+-
+-	if (mirror->ingress)
+-		priv->mirror_rx &= ~BIT(port);
+-	else
+-		priv->mirror_tx &= ~BIT(port);
+-
+-	/* No port set to send packet to mirror port. Disable mirror port */
+-	if (!priv->mirror_rx && !priv->mirror_tx) {
+-		val = FIELD_PREP(QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, 0xF);
+-		ret = regmap_update_bits(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0,
+-					 QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, val);
+-		if (ret)
+-			goto err;
+-	}
+-err:
+-	dev_err(priv->dev, "Failed to del mirror port from %d", port);
+-}
+-
+-static int
+ qca8k_port_vlan_filtering(struct dsa_switch *ds, int port, bool vlan_filtering,
+ 			  struct netlink_ext_ack *extack)
+ {
+--- a/drivers/net/dsa/qca/qca8k-common.c
++++ b/drivers/net/dsa/qca/qca8k-common.c
+@@ -741,3 +741,94 @@ int qca8k_port_mdb_del(struct dsa_switch
+ 
+ 	return qca8k_fdb_search_and_del(priv, BIT(port), addr, vid);
+ }
++
++int qca8k_port_mirror_add(struct dsa_switch *ds, int port,
++			  struct dsa_mall_mirror_tc_entry *mirror,
++			  bool ingress)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int monitor_port, ret;
++	u32 reg, val;
++
++	/* Check for existent entry */
++	if ((ingress ? priv->mirror_rx : priv->mirror_tx) & BIT(port))
++		return -EEXIST;
++
++	ret = regmap_read(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0, &val);
++	if (ret)
++		return ret;
++
++	/* QCA83xx can have only one port set to mirror mode.
++	 * Check that the correct port is requested and return error otherwise.
++	 * When no mirror port is set, the values is set to 0xF
++	 */
++	monitor_port = FIELD_GET(QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, val);
++	if (monitor_port != 0xF && monitor_port != mirror->to_local_port)
++		return -EEXIST;
++
++	/* Set the monitor port */
++	val = FIELD_PREP(QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM,
++			 mirror->to_local_port);
++	ret = regmap_update_bits(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0,
++				 QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, val);
++	if (ret)
++		return ret;
++
++	if (ingress) {
++		reg = QCA8K_PORT_LOOKUP_CTRL(port);
++		val = QCA8K_PORT_LOOKUP_ING_MIRROR_EN;
++	} else {
++		reg = QCA8K_REG_PORT_HOL_CTRL1(port);
++		val = QCA8K_PORT_HOL_CTRL1_EG_MIRROR_EN;
++	}
++
++	ret = regmap_update_bits(priv->regmap, reg, val, val);
++	if (ret)
++		return ret;
++
++	/* Track mirror port for tx and rx to decide when the
++	 * mirror port has to be disabled.
++	 */
++	if (ingress)
++		priv->mirror_rx |= BIT(port);
++	else
++		priv->mirror_tx |= BIT(port);
++
++	return 0;
++}
++
++void qca8k_port_mirror_del(struct dsa_switch *ds, int port,
++			   struct dsa_mall_mirror_tc_entry *mirror)
++{
++	struct qca8k_priv *priv = ds->priv;
++	u32 reg, val;
++	int ret;
++
++	if (mirror->ingress) {
++		reg = QCA8K_PORT_LOOKUP_CTRL(port);
++		val = QCA8K_PORT_LOOKUP_ING_MIRROR_EN;
++	} else {
++		reg = QCA8K_REG_PORT_HOL_CTRL1(port);
++		val = QCA8K_PORT_HOL_CTRL1_EG_MIRROR_EN;
++	}
++
++	ret = regmap_clear_bits(priv->regmap, reg, val);
++	if (ret)
++		goto err;
++
++	if (mirror->ingress)
++		priv->mirror_rx &= ~BIT(port);
++	else
++		priv->mirror_tx &= ~BIT(port);
++
++	/* No port set to send packet to mirror port. Disable mirror port */
++	if (!priv->mirror_rx && !priv->mirror_tx) {
++		val = FIELD_PREP(QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, 0xF);
++		ret = regmap_update_bits(priv->regmap, QCA8K_REG_GLOBAL_FW_CTRL0,
++					 QCA8K_GLOBAL_FW_CTRL0_MIRROR_PORT_NUM, val);
++		if (ret)
++			goto err;
++	}
++err:
++	dev_err(priv->dev, "Failed to del mirror port from %d", port);
++}
+--- a/drivers/net/dsa/qca/qca8k.h
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -480,4 +480,11 @@ int qca8k_port_mdb_add(struct dsa_switch
+ int qca8k_port_mdb_del(struct dsa_switch *ds, int port,
+ 		       const struct switchdev_obj_port_mdb *mdb);
+ 
++/* Common port mirror function */
++int qca8k_port_mirror_add(struct dsa_switch *ds, int port,
++			  struct dsa_mall_mirror_tc_entry *mirror,
++			  bool ingress);
++void qca8k_port_mirror_del(struct dsa_switch *ds, int port,
++			   struct dsa_mall_mirror_tc_entry *mirror);
++
+ #endif /* __QCA8K_H */
diff --git a/target/linux/generic/backport-5.15/771-v6.0-12-net-dsa-qca8k-move-port-VLAN-functions-to-common-cod.patch b/target/linux/generic/backport-5.15/771-v6.0-12-net-dsa-qca8k-move-port-VLAN-functions-to-common-cod.patch
new file mode 100644
index 00000000000000..898010f9509606
--- /dev/null
+++ b/target/linux/generic/backport-5.15/771-v6.0-12-net-dsa-qca8k-move-port-VLAN-functions-to-common-cod.patch
@@ -0,0 +1,448 @@
+From c5290f636624b98e76a82bd63ffec0a8a9daa620 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 27 Jul 2022 13:35:21 +0200
+Subject: [PATCH 12/14] net: dsa: qca8k: move port VLAN functions to common
+ code
+
+The same port VLAN functions are used by drivers based on qca8k family
+switch. Move them to common code to make them accessible also by other
+drivers.
+Also drop exposing busy_wait and make it static.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c   | 182 -----------------------------
+ drivers/net/dsa/qca/qca8k-common.c | 179 +++++++++++++++++++++++++++-
+ drivers/net/dsa/qca/qca8k.h        |  10 +-
+ 3 files changed, 187 insertions(+), 184 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -15,7 +15,6 @@
+ #include <linux/of_net.h>
+ #include <linux/of_mdio.h>
+ #include <linux/of_platform.h>
+-#include <linux/if_bridge.h>
+ #include <linux/mdio.h>
+ #include <linux/phylink.h>
+ #include <linux/gpio/consumer.h>
+@@ -442,122 +441,6 @@ static struct regmap_config qca8k_regmap
+ };
+ 
+ static int
+-qca8k_vlan_access(struct qca8k_priv *priv, enum qca8k_vlan_cmd cmd, u16 vid)
+-{
+-	u32 reg;
+-	int ret;
+-
+-	/* Set the command and VLAN index */
+-	reg = QCA8K_VTU_FUNC1_BUSY;
+-	reg |= cmd;
+-	reg |= FIELD_PREP(QCA8K_VTU_FUNC1_VID_MASK, vid);
+-
+-	/* Write the function register triggering the table access */
+-	ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC1, reg);
+-	if (ret)
+-		return ret;
+-
+-	/* wait for completion */
+-	ret = qca8k_busy_wait(priv, QCA8K_REG_VTU_FUNC1, QCA8K_VTU_FUNC1_BUSY);
+-	if (ret)
+-		return ret;
+-
+-	/* Check for table full violation when adding an entry */
+-	if (cmd == QCA8K_VLAN_LOAD) {
+-		ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC1, &reg);
+-		if (ret < 0)
+-			return ret;
+-		if (reg & QCA8K_VTU_FUNC1_FULL)
+-			return -ENOMEM;
+-	}
+-
+-	return 0;
+-}
+-
+-static int
+-qca8k_vlan_add(struct qca8k_priv *priv, u8 port, u16 vid, bool untagged)
+-{
+-	u32 reg;
+-	int ret;
+-
+-	/*
+-	   We do the right thing with VLAN 0 and treat it as untagged while
+-	   preserving the tag on egress.
+-	 */
+-	if (vid == 0)
+-		return 0;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	ret = qca8k_vlan_access(priv, QCA8K_VLAN_READ, vid);
+-	if (ret < 0)
+-		goto out;
+-
+-	ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC0, &reg);
+-	if (ret < 0)
+-		goto out;
+-	reg |= QCA8K_VTU_FUNC0_VALID | QCA8K_VTU_FUNC0_IVL_EN;
+-	reg &= ~QCA8K_VTU_FUNC0_EG_MODE_PORT_MASK(port);
+-	if (untagged)
+-		reg |= QCA8K_VTU_FUNC0_EG_MODE_PORT_UNTAG(port);
+-	else
+-		reg |= QCA8K_VTU_FUNC0_EG_MODE_PORT_TAG(port);
+-
+-	ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC0, reg);
+-	if (ret)
+-		goto out;
+-	ret = qca8k_vlan_access(priv, QCA8K_VLAN_LOAD, vid);
+-
+-out:
+-	mutex_unlock(&priv->reg_mutex);
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_vlan_del(struct qca8k_priv *priv, u8 port, u16 vid)
+-{
+-	u32 reg, mask;
+-	int ret, i;
+-	bool del;
+-
+-	mutex_lock(&priv->reg_mutex);
+-	ret = qca8k_vlan_access(priv, QCA8K_VLAN_READ, vid);
+-	if (ret < 0)
+-		goto out;
+-
+-	ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC0, &reg);
+-	if (ret < 0)
+-		goto out;
+-	reg &= ~QCA8K_VTU_FUNC0_EG_MODE_PORT_MASK(port);
+-	reg |= QCA8K_VTU_FUNC0_EG_MODE_PORT_NOT(port);
+-
+-	/* Check if we're the last member to be removed */
+-	del = true;
+-	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+-		mask = QCA8K_VTU_FUNC0_EG_MODE_PORT_NOT(i);
+-
+-		if ((reg & mask) != mask) {
+-			del = false;
+-			break;
+-		}
+-	}
+-
+-	if (del) {
+-		ret = qca8k_vlan_access(priv, QCA8K_VLAN_PURGE, vid);
+-	} else {
+-		ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC0, reg);
+-		if (ret)
+-			goto out;
+-		ret = qca8k_vlan_access(priv, QCA8K_VLAN_LOAD, vid);
+-	}
+-
+-out:
+-	mutex_unlock(&priv->reg_mutex);
+-
+-	return ret;
+-}
+-
+-static int
+ qca8k_phy_eth_busy_wait(struct qca8k_mgmt_eth_data *mgmt_eth_data,
+ 			struct sk_buff *read_skb, u32 *val)
+ {
+@@ -1836,71 +1719,6 @@ exit:
+ 
+ 	return ret;
+ }
+-
+-static int
+-qca8k_port_vlan_filtering(struct dsa_switch *ds, int port, bool vlan_filtering,
+-			  struct netlink_ext_ack *extack)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	int ret;
+-
+-	if (vlan_filtering) {
+-		ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+-				QCA8K_PORT_LOOKUP_VLAN_MODE_MASK,
+-				QCA8K_PORT_LOOKUP_VLAN_MODE_SECURE);
+-	} else {
+-		ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+-				QCA8K_PORT_LOOKUP_VLAN_MODE_MASK,
+-				QCA8K_PORT_LOOKUP_VLAN_MODE_NONE);
+-	}
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_port_vlan_add(struct dsa_switch *ds, int port,
+-		    const struct switchdev_obj_port_vlan *vlan,
+-		    struct netlink_ext_ack *extack)
+-{
+-	bool untagged = vlan->flags & BRIDGE_VLAN_INFO_UNTAGGED;
+-	bool pvid = vlan->flags & BRIDGE_VLAN_INFO_PVID;
+-	struct qca8k_priv *priv = ds->priv;
+-	int ret;
+-
+-	ret = qca8k_vlan_add(priv, port, vlan->vid, untagged);
+-	if (ret) {
+-		dev_err(priv->dev, "Failed to add VLAN to port %d (%d)", port, ret);
+-		return ret;
+-	}
+-
+-	if (pvid) {
+-		ret = qca8k_rmw(priv, QCA8K_EGRESS_VLAN(port),
+-				QCA8K_EGREES_VLAN_PORT_MASK(port),
+-				QCA8K_EGREES_VLAN_PORT(port, vlan->vid));
+-		if (ret)
+-			return ret;
+-
+-		ret = qca8k_write(priv, QCA8K_REG_PORT_VLAN_CTRL0(port),
+-				  QCA8K_PORT_VLAN_CVID(vlan->vid) |
+-				  QCA8K_PORT_VLAN_SVID(vlan->vid));
+-	}
+-
+-	return ret;
+-}
+-
+-static int
+-qca8k_port_vlan_del(struct dsa_switch *ds, int port,
+-		    const struct switchdev_obj_port_vlan *vlan)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	int ret;
+-
+-	ret = qca8k_vlan_del(priv, port, vlan->vid);
+-	if (ret)
+-		dev_err(priv->dev, "Failed to delete VLAN from port %d (%d)", port, ret);
+-
+-	return ret;
+-}
+ 
+ static u32 qca8k_get_phy_flags(struct dsa_switch *ds, int port)
+ {
+--- a/drivers/net/dsa/qca/qca8k-common.c
++++ b/drivers/net/dsa/qca/qca8k-common.c
+@@ -141,7 +141,7 @@ static int qca8k_bulk_write(struct qca8k
+ 	return 0;
+ }
+ 
+-int qca8k_busy_wait(struct qca8k_priv *priv, u32 reg, u32 mask)
++static int qca8k_busy_wait(struct qca8k_priv *priv, u32 reg, u32 mask)
+ {
+ 	u32 val;
+ 
+@@ -354,6 +354,120 @@ exit:
+ 	return ret;
+ }
+ 
++static int qca8k_vlan_access(struct qca8k_priv *priv,
++			     enum qca8k_vlan_cmd cmd, u16 vid)
++{
++	u32 reg;
++	int ret;
++
++	/* Set the command and VLAN index */
++	reg = QCA8K_VTU_FUNC1_BUSY;
++	reg |= cmd;
++	reg |= FIELD_PREP(QCA8K_VTU_FUNC1_VID_MASK, vid);
++
++	/* Write the function register triggering the table access */
++	ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC1, reg);
++	if (ret)
++		return ret;
++
++	/* wait for completion */
++	ret = qca8k_busy_wait(priv, QCA8K_REG_VTU_FUNC1, QCA8K_VTU_FUNC1_BUSY);
++	if (ret)
++		return ret;
++
++	/* Check for table full violation when adding an entry */
++	if (cmd == QCA8K_VLAN_LOAD) {
++		ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC1, &reg);
++		if (ret < 0)
++			return ret;
++		if (reg & QCA8K_VTU_FUNC1_FULL)
++			return -ENOMEM;
++	}
++
++	return 0;
++}
++
++static int qca8k_vlan_add(struct qca8k_priv *priv, u8 port, u16 vid,
++			  bool untagged)
++{
++	u32 reg;
++	int ret;
++
++	/* We do the right thing with VLAN 0 and treat it as untagged while
++	 * preserving the tag on egress.
++	 */
++	if (vid == 0)
++		return 0;
++
++	mutex_lock(&priv->reg_mutex);
++	ret = qca8k_vlan_access(priv, QCA8K_VLAN_READ, vid);
++	if (ret < 0)
++		goto out;
++
++	ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC0, &reg);
++	if (ret < 0)
++		goto out;
++	reg |= QCA8K_VTU_FUNC0_VALID | QCA8K_VTU_FUNC0_IVL_EN;
++	reg &= ~QCA8K_VTU_FUNC0_EG_MODE_PORT_MASK(port);
++	if (untagged)
++		reg |= QCA8K_VTU_FUNC0_EG_MODE_PORT_UNTAG(port);
++	else
++		reg |= QCA8K_VTU_FUNC0_EG_MODE_PORT_TAG(port);
++
++	ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC0, reg);
++	if (ret)
++		goto out;
++	ret = qca8k_vlan_access(priv, QCA8K_VLAN_LOAD, vid);
++
++out:
++	mutex_unlock(&priv->reg_mutex);
++
++	return ret;
++}
++
++static int qca8k_vlan_del(struct qca8k_priv *priv, u8 port, u16 vid)
++{
++	u32 reg, mask;
++	int ret, i;
++	bool del;
++
++	mutex_lock(&priv->reg_mutex);
++	ret = qca8k_vlan_access(priv, QCA8K_VLAN_READ, vid);
++	if (ret < 0)
++		goto out;
++
++	ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC0, &reg);
++	if (ret < 0)
++		goto out;
++	reg &= ~QCA8K_VTU_FUNC0_EG_MODE_PORT_MASK(port);
++	reg |= QCA8K_VTU_FUNC0_EG_MODE_PORT_NOT(port);
++
++	/* Check if we're the last member to be removed */
++	del = true;
++	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
++		mask = QCA8K_VTU_FUNC0_EG_MODE_PORT_NOT(i);
++
++		if ((reg & mask) != mask) {
++			del = false;
++			break;
++		}
++	}
++
++	if (del) {
++		ret = qca8k_vlan_access(priv, QCA8K_VLAN_PURGE, vid);
++	} else {
++		ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC0, reg);
++		if (ret)
++			goto out;
++		ret = qca8k_vlan_access(priv, QCA8K_VLAN_LOAD, vid);
++	}
++
++out:
++	mutex_unlock(&priv->reg_mutex);
++
++	return ret;
++}
++
+ int qca8k_mib_init(struct qca8k_priv *priv)
+ {
+ 	int ret;
+@@ -832,3 +946,66 @@ void qca8k_port_mirror_del(struct dsa_sw
+ err:
+ 	dev_err(priv->dev, "Failed to del mirror port from %d", port);
+ }
++
++int qca8k_port_vlan_filtering(struct dsa_switch *ds, int port,
++			      bool vlan_filtering,
++			      struct netlink_ext_ack *extack)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int ret;
++
++	if (vlan_filtering) {
++		ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
++				QCA8K_PORT_LOOKUP_VLAN_MODE_MASK,
++				QCA8K_PORT_LOOKUP_VLAN_MODE_SECURE);
++	} else {
++		ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
++				QCA8K_PORT_LOOKUP_VLAN_MODE_MASK,
++				QCA8K_PORT_LOOKUP_VLAN_MODE_NONE);
++	}
++
++	return ret;
++}
++
++int qca8k_port_vlan_add(struct dsa_switch *ds, int port,
++			const struct switchdev_obj_port_vlan *vlan,
++			struct netlink_ext_ack *extack)
++{
++	bool untagged = vlan->flags & BRIDGE_VLAN_INFO_UNTAGGED;
++	bool pvid = vlan->flags & BRIDGE_VLAN_INFO_PVID;
++	struct qca8k_priv *priv = ds->priv;
++	int ret;
++
++	ret = qca8k_vlan_add(priv, port, vlan->vid, untagged);
++	if (ret) {
++		dev_err(priv->dev, "Failed to add VLAN to port %d (%d)", port, ret);
++		return ret;
++	}
++
++	if (pvid) {
++		ret = qca8k_rmw(priv, QCA8K_EGRESS_VLAN(port),
++				QCA8K_EGREES_VLAN_PORT_MASK(port),
++				QCA8K_EGREES_VLAN_PORT(port, vlan->vid));
++		if (ret)
++			return ret;
++
++		ret = qca8k_write(priv, QCA8K_REG_PORT_VLAN_CTRL0(port),
++				  QCA8K_PORT_VLAN_CVID(vlan->vid) |
++				  QCA8K_PORT_VLAN_SVID(vlan->vid));
++	}
++
++	return ret;
++}
++
++int qca8k_port_vlan_del(struct dsa_switch *ds, int port,
++			const struct switchdev_obj_port_vlan *vlan)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int ret;
++
++	ret = qca8k_vlan_del(priv, port, vlan->vid);
++	if (ret)
++		dev_err(priv->dev, "Failed to delete VLAN from port %d (%d)", port, ret);
++
++	return ret;
++}
+--- a/drivers/net/dsa/qca/qca8k.h
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -431,7 +431,6 @@ int qca8k_write(struct qca8k_priv *priv,
+ int qca8k_rmw(struct qca8k_priv *priv, u32 reg, u32 mask, u32 write_val);
+ 
+ /* Common ops function */
+-int qca8k_busy_wait(struct qca8k_priv *priv, u32 reg, u32 mask);
+ void qca8k_fdb_flush(struct qca8k_priv *priv);
+ 
+ /* Common ethtool stats function */
+@@ -487,4 +486,13 @@ int qca8k_port_mirror_add(struct dsa_swi
+ void qca8k_port_mirror_del(struct dsa_switch *ds, int port,
+ 			   struct dsa_mall_mirror_tc_entry *mirror);
+ 
++/* Common port VLAN function */
++int qca8k_port_vlan_filtering(struct dsa_switch *ds, int port, bool vlan_filtering,
++			      struct netlink_ext_ack *extack);
++int qca8k_port_vlan_add(struct dsa_switch *ds, int port,
++			const struct switchdev_obj_port_vlan *vlan,
++			struct netlink_ext_ack *extack);
++int qca8k_port_vlan_del(struct dsa_switch *ds, int port,
++			const struct switchdev_obj_port_vlan *vlan);
++
+ #endif /* __QCA8K_H */
diff --git a/target/linux/generic/backport-5.15/771-v6.0-13-net-dsa-qca8k-move-port-LAG-functions-to-common-code.patch b/target/linux/generic/backport-5.15/771-v6.0-13-net-dsa-qca8k-move-port-LAG-functions-to-common-code.patch
new file mode 100644
index 00000000000000..1802b17eaad731
--- /dev/null
+++ b/target/linux/generic/backport-5.15/771-v6.0-13-net-dsa-qca8k-move-port-LAG-functions-to-common-code.patch
@@ -0,0 +1,384 @@
+From e9bbf019af44b204b71ef8edf224002550aab641 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 27 Jul 2022 13:35:22 +0200
+Subject: [PATCH 13/14] net: dsa: qca8k: move port LAG functions to common code
+
+The same port LAG functions are used by drivers based on qca8k family
+switch. Move them to common code to make them accessible also by other
+drivers.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c   | 168 -----------------------------
+ drivers/net/dsa/qca/qca8k-common.c | 165 ++++++++++++++++++++++++++++
+ drivers/net/dsa/qca/qca8k.h        |   6 ++
+ 3 files changed, 171 insertions(+), 168 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -1743,178 +1743,6 @@ qca8k_get_tag_protocol(struct dsa_switch
+ 	return DSA_TAG_PROTO_QCA;
+ }
+ 
+-static bool
+-qca8k_lag_can_offload(struct dsa_switch *ds,
+-		      struct net_device *lag,
+-		      struct netdev_lag_upper_info *info)
+-{
+-	struct dsa_port *dp;
+-	int id, members = 0;
+-
+-	id = dsa_lag_id(ds->dst, lag);
+-	if (id < 0 || id >= ds->num_lag_ids)
+-		return false;
+-
+-	dsa_lag_foreach_port(dp, ds->dst, lag)
+-		/* Includes the port joining the LAG */
+-		members++;
+-
+-	if (members > QCA8K_NUM_PORTS_FOR_LAG)
+-		return false;
+-
+-	if (info->tx_type != NETDEV_LAG_TX_TYPE_HASH)
+-		return false;
+-
+-	if (info->hash_type != NETDEV_LAG_HASH_L2 &&
+-	    info->hash_type != NETDEV_LAG_HASH_L23)
+-		return false;
+-
+-	return true;
+-}
+-
+-static int
+-qca8k_lag_setup_hash(struct dsa_switch *ds,
+-		     struct net_device *lag,
+-		     struct netdev_lag_upper_info *info)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	bool unique_lag = true;
+-	u32 hash = 0;
+-	int i, id;
+-
+-	id = dsa_lag_id(ds->dst, lag);
+-
+-	switch (info->hash_type) {
+-	case NETDEV_LAG_HASH_L23:
+-		hash |= QCA8K_TRUNK_HASH_SIP_EN;
+-		hash |= QCA8K_TRUNK_HASH_DIP_EN;
+-		fallthrough;
+-	case NETDEV_LAG_HASH_L2:
+-		hash |= QCA8K_TRUNK_HASH_SA_EN;
+-		hash |= QCA8K_TRUNK_HASH_DA_EN;
+-		break;
+-	default: /* We should NEVER reach this */
+-		return -EOPNOTSUPP;
+-	}
+-
+-	/* Check if we are the unique configured LAG */
+-	dsa_lags_foreach_id(i, ds->dst)
+-		if (i != id && dsa_lag_dev(ds->dst, i)) {
+-			unique_lag = false;
+-			break;
+-		}
+-
+-	/* Hash Mode is global. Make sure the same Hash Mode
+-	 * is set to all the 4 possible lag.
+-	 * If we are the unique LAG we can set whatever hash
+-	 * mode we want.
+-	 * To change hash mode it's needed to remove all LAG
+-	 * and change the mode with the latest.
+-	 */
+-	if (unique_lag) {
+-		priv->lag_hash_mode = hash;
+-	} else if (priv->lag_hash_mode != hash) {
+-		netdev_err(lag, "Error: Mismateched Hash Mode across different lag is not supported\n");
+-		return -EOPNOTSUPP;
+-	}
+-
+-	return regmap_update_bits(priv->regmap, QCA8K_TRUNK_HASH_EN_CTRL,
+-				  QCA8K_TRUNK_HASH_MASK, hash);
+-}
+-
+-static int
+-qca8k_lag_refresh_portmap(struct dsa_switch *ds, int port,
+-			  struct net_device *lag, bool delete)
+-{
+-	struct qca8k_priv *priv = ds->priv;
+-	int ret, id, i;
+-	u32 val;
+-
+-	id = dsa_lag_id(ds->dst, lag);
+-
+-	/* Read current port member */
+-	ret = regmap_read(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL0, &val);
+-	if (ret)
+-		return ret;
+-
+-	/* Shift val to the correct trunk */
+-	val >>= QCA8K_REG_GOL_TRUNK_SHIFT(id);
+-	val &= QCA8K_REG_GOL_TRUNK_MEMBER_MASK;
+-	if (delete)
+-		val &= ~BIT(port);
+-	else
+-		val |= BIT(port);
+-
+-	/* Update port member. With empty portmap disable trunk */
+-	ret = regmap_update_bits(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL0,
+-				 QCA8K_REG_GOL_TRUNK_MEMBER(id) |
+-				 QCA8K_REG_GOL_TRUNK_EN(id),
+-				 !val << QCA8K_REG_GOL_TRUNK_SHIFT(id) |
+-				 val << QCA8K_REG_GOL_TRUNK_SHIFT(id));
+-
+-	/* Search empty member if adding or port on deleting */
+-	for (i = 0; i < QCA8K_NUM_PORTS_FOR_LAG; i++) {
+-		ret = regmap_read(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL(id), &val);
+-		if (ret)
+-			return ret;
+-
+-		val >>= QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(id, i);
+-		val &= QCA8K_REG_GOL_TRUNK_ID_MEM_ID_MASK;
+-
+-		if (delete) {
+-			/* If port flagged to be disabled assume this member is
+-			 * empty
+-			 */
+-			if (val != QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN_MASK)
+-				continue;
+-
+-			val &= QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT_MASK;
+-			if (val != port)
+-				continue;
+-		} else {
+-			/* If port flagged to be enabled assume this member is
+-			 * already set
+-			 */
+-			if (val == QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN_MASK)
+-				continue;
+-		}
+-
+-		/* We have found the member to add/remove */
+-		break;
+-	}
+-
+-	/* Set port in the correct port mask or disable port if in delete mode */
+-	return regmap_update_bits(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL(id),
+-				  QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN(id, i) |
+-				  QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT(id, i),
+-				  !delete << QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(id, i) |
+-				  port << QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(id, i));
+-}
+-
+-static int
+-qca8k_port_lag_join(struct dsa_switch *ds, int port,
+-		    struct net_device *lag,
+-		    struct netdev_lag_upper_info *info)
+-{
+-	int ret;
+-
+-	if (!qca8k_lag_can_offload(ds, lag, info))
+-		return -EOPNOTSUPP;
+-
+-	ret = qca8k_lag_setup_hash(ds, lag, info);
+-	if (ret)
+-		return ret;
+-
+-	return qca8k_lag_refresh_portmap(ds, port, lag, false);
+-}
+-
+-static int
+-qca8k_port_lag_leave(struct dsa_switch *ds, int port,
+-		     struct net_device *lag)
+-{
+-	return qca8k_lag_refresh_portmap(ds, port, lag, true);
+-}
+-
+ static void
+ qca8k_master_change(struct dsa_switch *ds, const struct net_device *master,
+ 		    bool operational)
+--- a/drivers/net/dsa/qca/qca8k-common.c
++++ b/drivers/net/dsa/qca/qca8k-common.c
+@@ -1009,3 +1009,169 @@ int qca8k_port_vlan_del(struct dsa_switc
+ 
+ 	return ret;
+ }
++
++static bool qca8k_lag_can_offload(struct dsa_switch *ds,
++				  struct net_device *lag,
++				  struct netdev_lag_upper_info *info)
++{
++	struct dsa_port *dp;
++	int id, members = 0;
++
++	id = dsa_lag_id(ds->dst, lag);
++	if (id < 0 || id >= ds->num_lag_ids)
++		return false;
++
++	dsa_lag_foreach_port(dp, ds->dst, lag)
++		/* Includes the port joining the LAG */
++		members++;
++
++	if (members > QCA8K_NUM_PORTS_FOR_LAG)
++		return false;
++
++	if (info->tx_type != NETDEV_LAG_TX_TYPE_HASH)
++		return false;
++
++	if (info->hash_type != NETDEV_LAG_HASH_L2 &&
++	    info->hash_type != NETDEV_LAG_HASH_L23)
++		return false;
++
++	return true;
++}
++
++static int qca8k_lag_setup_hash(struct dsa_switch *ds,
++				struct net_device *lag,
++				struct netdev_lag_upper_info *info)
++{
++	struct qca8k_priv *priv = ds->priv;
++	bool unique_lag = true;
++	u32 hash = 0;
++	int i, id;
++
++	id = dsa_lag_id(ds->dst, lag);
++
++	switch (info->hash_type) {
++	case NETDEV_LAG_HASH_L23:
++		hash |= QCA8K_TRUNK_HASH_SIP_EN;
++		hash |= QCA8K_TRUNK_HASH_DIP_EN;
++		fallthrough;
++	case NETDEV_LAG_HASH_L2:
++		hash |= QCA8K_TRUNK_HASH_SA_EN;
++		hash |= QCA8K_TRUNK_HASH_DA_EN;
++		break;
++	default: /* We should NEVER reach this */
++		return -EOPNOTSUPP;
++	}
++
++	/* Check if we are the unique configured LAG */
++	dsa_lags_foreach_id(i, ds->dst)
++		if (i != id && dsa_lag_dev(ds->dst, i)) {
++			unique_lag = false;
++			break;
++		}
++
++	/* Hash Mode is global. Make sure the same Hash Mode
++	 * is set to all the 4 possible lag.
++	 * If we are the unique LAG we can set whatever hash
++	 * mode we want.
++	 * To change hash mode it's needed to remove all LAG
++	 * and change the mode with the latest.
++	 */
++	if (unique_lag) {
++		priv->lag_hash_mode = hash;
++	} else if (priv->lag_hash_mode != hash) {
++		netdev_err(lag, "Error: Mismatched Hash Mode across different lag is not supported\n");
++		return -EOPNOTSUPP;
++	}
++
++	return regmap_update_bits(priv->regmap, QCA8K_TRUNK_HASH_EN_CTRL,
++				  QCA8K_TRUNK_HASH_MASK, hash);
++}
++
++static int qca8k_lag_refresh_portmap(struct dsa_switch *ds, int port,
++				     struct net_device *lag, bool delete)
++{
++	struct qca8k_priv *priv = ds->priv;
++	int ret, id, i;
++	u32 val;
++
++	id = dsa_lag_id(ds->dst, lag);
++
++	/* Read current port member */
++	ret = regmap_read(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL0, &val);
++	if (ret)
++		return ret;
++
++	/* Shift val to the correct trunk */
++	val >>= QCA8K_REG_GOL_TRUNK_SHIFT(id);
++	val &= QCA8K_REG_GOL_TRUNK_MEMBER_MASK;
++	if (delete)
++		val &= ~BIT(port);
++	else
++		val |= BIT(port);
++
++	/* Update port member. With empty portmap disable trunk */
++	ret = regmap_update_bits(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL0,
++				 QCA8K_REG_GOL_TRUNK_MEMBER(id) |
++				 QCA8K_REG_GOL_TRUNK_EN(id),
++				 !val << QCA8K_REG_GOL_TRUNK_SHIFT(id) |
++				 val << QCA8K_REG_GOL_TRUNK_SHIFT(id));
++
++	/* Search empty member if adding or port on deleting */
++	for (i = 0; i < QCA8K_NUM_PORTS_FOR_LAG; i++) {
++		ret = regmap_read(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL(id), &val);
++		if (ret)
++			return ret;
++
++		val >>= QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(id, i);
++		val &= QCA8K_REG_GOL_TRUNK_ID_MEM_ID_MASK;
++
++		if (delete) {
++			/* If port flagged to be disabled assume this member is
++			 * empty
++			 */
++			if (val != QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN_MASK)
++				continue;
++
++			val &= QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT_MASK;
++			if (val != port)
++				continue;
++		} else {
++			/* If port flagged to be enabled assume this member is
++			 * already set
++			 */
++			if (val == QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN_MASK)
++				continue;
++		}
++
++		/* We have found the member to add/remove */
++		break;
++	}
++
++	/* Set port in the correct port mask or disable port if in delete mode */
++	return regmap_update_bits(priv->regmap, QCA8K_REG_GOL_TRUNK_CTRL(id),
++				  QCA8K_REG_GOL_TRUNK_ID_MEM_ID_EN(id, i) |
++				  QCA8K_REG_GOL_TRUNK_ID_MEM_ID_PORT(id, i),
++				  !delete << QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(id, i) |
++				  port << QCA8K_REG_GOL_TRUNK_ID_MEM_ID_SHIFT(id, i));
++}
++
++int qca8k_port_lag_join(struct dsa_switch *ds, int port, struct net_device *lag,
++			struct netdev_lag_upper_info *info)
++{
++	int ret;
++
++	if (!qca8k_lag_can_offload(ds, lag, info))
++		return -EOPNOTSUPP;
++
++	ret = qca8k_lag_setup_hash(ds, lag, info);
++	if (ret)
++		return ret;
++
++	return qca8k_lag_refresh_portmap(ds, port, lag, false);
++}
++
++int qca8k_port_lag_leave(struct dsa_switch *ds, int port,
++			 struct net_device *lag)
++{
++	return qca8k_lag_refresh_portmap(ds, port, lag, true);
++}
+--- a/drivers/net/dsa/qca/qca8k.h
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -495,4 +495,10 @@ int qca8k_port_vlan_add(struct dsa_switc
+ int qca8k_port_vlan_del(struct dsa_switch *ds, int port,
+ 			const struct switchdev_obj_port_vlan *vlan);
+ 
++/* Common port LAG function */
++int qca8k_port_lag_join(struct dsa_switch *ds, int port, struct net_device *lag,
++			struct netdev_lag_upper_info *info);
++int qca8k_port_lag_leave(struct dsa_switch *ds, int port,
++			 struct net_device *lag);
++
+ #endif /* __QCA8K_H */
diff --git a/target/linux/generic/backport-5.15/771-v6.0-14-net-dsa-qca8k-move-read_switch_id-function-to-common.patch b/target/linux/generic/backport-5.15/771-v6.0-14-net-dsa-qca8k-move-read_switch_id-function-to-common.patch
new file mode 100644
index 00000000000000..d6ec8b77e0ceed
--- /dev/null
+++ b/target/linux/generic/backport-5.15/771-v6.0-14-net-dsa-qca8k-move-read_switch_id-function-to-common.patch
@@ -0,0 +1,102 @@
+From 9d1bcb1f293f1391302a109c9819c3705c804700 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 27 Jul 2022 13:35:23 +0200
+Subject: [PATCH 14/14] net: dsa: qca8k: move read_switch_id function to common
+ code
+
+The same function to read the switch id is used by drivers based on
+qca8k family switch. Move them to common code to make them accessible
+also by other drivers.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c   | 29 -----------------------------
+ drivers/net/dsa/qca/qca8k-common.c | 29 +++++++++++++++++++++++++++++
+ drivers/net/dsa/qca/qca8k.h        |  1 +
+ 3 files changed, 30 insertions(+), 29 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -1822,35 +1822,6 @@ static const struct dsa_switch_ops qca8k
+ 	.connect_tag_protocol	= qca8k_connect_tag_protocol,
+ };
+ 
+-static int qca8k_read_switch_id(struct qca8k_priv *priv)
+-{
+-	u32 val;
+-	u8 id;
+-	int ret;
+-
+-	if (!priv->info)
+-		return -ENODEV;
+-
+-	ret = qca8k_read(priv, QCA8K_REG_MASK_CTRL, &val);
+-	if (ret < 0)
+-		return -ENODEV;
+-
+-	id = QCA8K_MASK_CTRL_DEVICE_ID(val);
+-	if (id != priv->info->id) {
+-		dev_err(priv->dev,
+-			"Switch id detected %x but expected %x",
+-			id, priv->info->id);
+-		return -ENODEV;
+-	}
+-
+-	priv->switch_id = id;
+-
+-	/* Save revision to communicate to the internal PHY driver */
+-	priv->switch_revision = QCA8K_MASK_CTRL_REV_ID(val);
+-
+-	return 0;
+-}
+-
+ static int
+ qca8k_sw_probe(struct mdio_device *mdiodev)
+ {
+--- a/drivers/net/dsa/qca/qca8k-common.c
++++ b/drivers/net/dsa/qca/qca8k-common.c
+@@ -1175,3 +1175,32 @@ int qca8k_port_lag_leave(struct dsa_swit
+ {
+ 	return qca8k_lag_refresh_portmap(ds, port, lag, true);
+ }
++
++int qca8k_read_switch_id(struct qca8k_priv *priv)
++{
++	u32 val;
++	u8 id;
++	int ret;
++
++	if (!priv->info)
++		return -ENODEV;
++
++	ret = qca8k_read(priv, QCA8K_REG_MASK_CTRL, &val);
++	if (ret < 0)
++		return -ENODEV;
++
++	id = QCA8K_MASK_CTRL_DEVICE_ID(val);
++	if (id != priv->info->id) {
++		dev_err(priv->dev,
++			"Switch id detected %x but expected %x",
++			id, priv->info->id);
++		return -ENODEV;
++	}
++
++	priv->switch_id = id;
++
++	/* Save revision to communicate to the internal PHY driver */
++	priv->switch_revision = QCA8K_MASK_CTRL_REV_ID(val);
++
++	return 0;
++}
+--- a/drivers/net/dsa/qca/qca8k.h
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -424,6 +424,7 @@ extern const struct qca8k_mib_desc ar832
+ extern const struct regmap_access_table qca8k_readable_table;
+ int qca8k_mib_init(struct qca8k_priv *priv);
+ void qca8k_port_set_status(struct qca8k_priv *priv, int port, int enable);
++int qca8k_read_switch_id(struct qca8k_priv *priv);
+ 
+ /* Common read/write/rmw function */
+ int qca8k_read(struct qca8k_priv *priv, u32 reg, u32 *val);
diff --git a/target/linux/generic/backport-5.15/772-v6.0-net-dsa-qca8k-fix-NULL-pointer-dereference-for-of_de.patch b/target/linux/generic/backport-5.15/772-v6.0-net-dsa-qca8k-fix-NULL-pointer-dereference-for-of_de.patch
new file mode 100644
index 00000000000000..0cca2788f6d3f5
--- /dev/null
+++ b/target/linux/generic/backport-5.15/772-v6.0-net-dsa-qca8k-fix-NULL-pointer-dereference-for-of_de.patch
@@ -0,0 +1,29 @@
+From 057bcf15db8e625276ddf02b2b7c668a3cb43f81 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Sun, 4 Sep 2022 23:46:24 +0200
+Subject: [net PATCH] net: dsa: qca8k: fix NULL pointer dereference for
+ of_device_get_match_data
+
+of_device_get_match_data is called on priv->dev before priv->dev is
+actually set. Move of_device_get_match_data after priv->dev is correctly
+set to fix this kernel panic.
+
+Fixes: 3bb0844e7bcd ("net: dsa: qca8k: cache match data to speed up access")
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -1835,9 +1835,9 @@ qca8k_sw_probe(struct mdio_device *mdiod
+ 	if (!priv)
+ 		return -ENOMEM;
+ 
+-	priv->info = of_device_get_match_data(priv->dev);
+ 	priv->bus = mdiodev->bus;
+ 	priv->dev = &mdiodev->dev;
++	priv->info = of_device_get_match_data(priv->dev);
+ 
+ 	priv->reset_gpio = devm_gpiod_get_optional(priv->dev, "reset",
+ 						   GPIOD_ASIS);
diff --git a/target/linux/generic/backport-5.15/775-v6.0-01-net-ethernet-stmicro-stmmac-move-queue-reset-to-dedi.patch b/target/linux/generic/backport-5.15/775-v6.0-01-net-ethernet-stmicro-stmmac-move-queue-reset-to-dedi.patch
new file mode 100644
index 00000000000000..9b9ab04af6cb43
--- /dev/null
+++ b/target/linux/generic/backport-5.15/775-v6.0-01-net-ethernet-stmicro-stmmac-move-queue-reset-to-dedi.patch
@@ -0,0 +1,142 @@
+From f9ec5723c3dbfcede9c7b0dcdf85e401ce16316c Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Sat, 23 Jul 2022 16:29:29 +0200
+Subject: [PATCH 1/5] net: ethernet: stmicro: stmmac: move queue reset to
+ dedicated functions
+
+Move queue reset to dedicated functions. This aside from a simple
+cleanup is also required to allocate a dma conf without resetting the tx
+queue while the device is temporarily detached as now the reset is not
+part of the dma init function and can be done later in the code flow.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ .../net/ethernet/stmicro/stmmac/stmmac_main.c | 59 ++++++++++---------
+ 1 file changed, 31 insertions(+), 28 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -130,6 +130,9 @@ static irqreturn_t stmmac_mac_interrupt(
+ static irqreturn_t stmmac_safety_interrupt(int irq, void *dev_id);
+ static irqreturn_t stmmac_msi_intr_tx(int irq, void *data);
+ static irqreturn_t stmmac_msi_intr_rx(int irq, void *data);
++static void stmmac_reset_rx_queue(struct stmmac_priv *priv, u32 queue);
++static void stmmac_reset_tx_queue(struct stmmac_priv *priv, u32 queue);
++static void stmmac_reset_queues_param(struct stmmac_priv *priv);
+ static void stmmac_tx_timer_arm(struct stmmac_priv *priv, u32 queue);
+ static void stmmac_flush_tx_descriptors(struct stmmac_priv *priv, int queue);
+ 
+@@ -1712,9 +1715,6 @@ static int __init_dma_rx_desc_rings(stru
+ 			return -ENOMEM;
+ 	}
+ 
+-	rx_q->cur_rx = 0;
+-	rx_q->dirty_rx = 0;
+-
+ 	/* Setup the chained descriptor addresses */
+ 	if (priv->mode == STMMAC_CHAIN_MODE) {
+ 		if (priv->extend_desc)
+@@ -1820,12 +1820,6 @@ static int __init_dma_tx_desc_rings(stru
+ 		tx_q->tx_skbuff[i] = NULL;
+ 	}
+ 
+-	tx_q->dirty_tx = 0;
+-	tx_q->cur_tx = 0;
+-	tx_q->mss = 0;
+-
+-	netdev_tx_reset_queue(netdev_get_tx_queue(priv->dev, queue));
+-
+ 	return 0;
+ }
+ 
+@@ -2694,10 +2688,7 @@ static void stmmac_tx_err(struct stmmac_
+ 	stmmac_stop_tx_dma(priv, chan);
+ 	dma_free_tx_skbufs(priv, chan);
+ 	stmmac_clear_tx_descriptors(priv, chan);
+-	tx_q->dirty_tx = 0;
+-	tx_q->cur_tx = 0;
+-	tx_q->mss = 0;
+-	netdev_tx_reset_queue(netdev_get_tx_queue(priv->dev, chan));
++	stmmac_reset_tx_queue(priv, chan);
+ 	stmmac_init_tx_chan(priv, priv->ioaddr, priv->plat->dma_cfg,
+ 			    tx_q->dma_tx_phy, chan);
+ 	stmmac_start_tx_dma(priv, chan);
+@@ -3781,6 +3772,8 @@ static int stmmac_open(struct net_device
+ 		}
+ 	}
+ 
++	stmmac_reset_queues_param(priv);
++
+ 	ret = stmmac_hw_setup(dev, true);
+ 	if (ret < 0) {
+ 		netdev_err(priv->dev, "%s: Hw setup failed\n", __func__);
+@@ -6430,6 +6423,7 @@ void stmmac_enable_rx_queue(struct stmma
+ 		return;
+ 	}
+ 
++	stmmac_reset_rx_queue(priv, queue);
+ 	stmmac_clear_rx_descriptors(priv, queue);
+ 
+ 	stmmac_init_rx_chan(priv, priv->ioaddr, priv->plat->dma_cfg,
+@@ -6491,6 +6485,7 @@ void stmmac_enable_tx_queue(struct stmma
+ 		return;
+ 	}
+ 
++	stmmac_reset_tx_queue(priv, queue);
+ 	stmmac_clear_tx_descriptors(priv, queue);
+ 
+ 	stmmac_init_tx_chan(priv, priv->ioaddr, priv->plat->dma_cfg,
+@@ -7417,6 +7412,25 @@ int stmmac_suspend(struct device *dev)
+ }
+ EXPORT_SYMBOL_GPL(stmmac_suspend);
+ 
++static void stmmac_reset_rx_queue(struct stmmac_priv *priv, u32 queue)
++{
++	struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
++
++	rx_q->cur_rx = 0;
++	rx_q->dirty_rx = 0;
++}
++
++static void stmmac_reset_tx_queue(struct stmmac_priv *priv, u32 queue)
++{
++	struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
++
++	tx_q->cur_tx = 0;
++	tx_q->dirty_tx = 0;
++	tx_q->mss = 0;
++
++	netdev_tx_reset_queue(netdev_get_tx_queue(priv->dev, queue));
++}
++
+ /**
+  * stmmac_reset_queues_param - reset queue parameters
+  * @priv: device pointer
+@@ -7427,22 +7441,11 @@ static void stmmac_reset_queues_param(st
+ 	u32 tx_cnt = priv->plat->tx_queues_to_use;
+ 	u32 queue;
+ 
+-	for (queue = 0; queue < rx_cnt; queue++) {
+-		struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
++	for (queue = 0; queue < rx_cnt; queue++)
++		stmmac_reset_rx_queue(priv, queue);
+ 
+-		rx_q->cur_rx = 0;
+-		rx_q->dirty_rx = 0;
+-	}
+-
+-	for (queue = 0; queue < tx_cnt; queue++) {
+-		struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
+-
+-		tx_q->cur_tx = 0;
+-		tx_q->dirty_tx = 0;
+-		tx_q->mss = 0;
+-
+-		netdev_tx_reset_queue(netdev_get_tx_queue(priv->dev, queue));
+-	}
++	for (queue = 0; queue < tx_cnt; queue++)
++		stmmac_reset_tx_queue(priv, queue);
+ }
+ 
+ /**
diff --git a/target/linux/generic/backport-5.15/775-v6.0-02-net-ethernet-stmicro-stmmac-first-disable-all-queues.patch b/target/linux/generic/backport-5.15/775-v6.0-02-net-ethernet-stmicro-stmmac-first-disable-all-queues.patch
new file mode 100644
index 00000000000000..8eca92a5c54dc2
--- /dev/null
+++ b/target/linux/generic/backport-5.15/775-v6.0-02-net-ethernet-stmicro-stmmac-first-disable-all-queues.patch
@@ -0,0 +1,37 @@
+From 7028471edb646bfc532fec0973e50e784cdcb7c6 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Sat, 23 Jul 2022 16:29:30 +0200
+Subject: [PATCH 2/5] net: ethernet: stmicro: stmmac: first disable all queues
+ and disconnect in release
+
+Disable all queues and disconnect before tx_disable in stmmac_release to
+prevent a corner case where packet may be still queued at the same time
+tx_disable is called resulting in kernel panic if some packet still has
+to be processed.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -3833,8 +3833,6 @@ static int stmmac_release(struct net_dev
+ 	struct stmmac_priv *priv = netdev_priv(dev);
+ 	u32 chan;
+ 
+-	netif_tx_disable(dev);
+-
+ 	if (device_may_wakeup(priv->device))
+ 		phylink_speed_down(priv->phylink, false);
+ 	/* Stop and disconnect the PHY */
+@@ -3846,6 +3844,8 @@ static int stmmac_release(struct net_dev
+ 	for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
+ 		hrtimer_cancel(&priv->tx_queue[chan].txtimer);
+ 
++	netif_tx_disable(dev);
++
+ 	/* Free the IRQ lines */
+ 	stmmac_free_irq(dev, REQ_IRQ_ERR_ALL, 0);
+ 
diff --git a/target/linux/generic/backport-5.15/775-v6.0-03-net-ethernet-stmicro-stmmac-move-dma-conf-to-dedicat.patch b/target/linux/generic/backport-5.15/775-v6.0-03-net-ethernet-stmicro-stmmac-move-dma-conf-to-dedicat.patch
new file mode 100644
index 00000000000000..d4c2567a1fdfc4
--- /dev/null
+++ b/target/linux/generic/backport-5.15/775-v6.0-03-net-ethernet-stmicro-stmmac-move-dma-conf-to-dedicat.patch
@@ -0,0 +1,1289 @@
+From 8531c80800c10e8ef7952022326c2f983e1314bf Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Sat, 23 Jul 2022 16:29:31 +0200
+Subject: [PATCH 3/5] net: ethernet: stmicro: stmmac: move dma conf to
+ dedicated struct
+
+Move dma buf conf to dedicated struct. This in preparation for code
+rework that will permit to allocate separate dma_conf without affecting
+the priv struct.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ .../net/ethernet/stmicro/stmmac/chain_mode.c  |   6 +-
+ .../net/ethernet/stmicro/stmmac/ring_mode.c   |   4 +-
+ drivers/net/ethernet/stmicro/stmmac/stmmac.h  |  21 +-
+ .../ethernet/stmicro/stmmac/stmmac_ethtool.c  |   4 +-
+ .../net/ethernet/stmicro/stmmac/stmmac_main.c | 286 +++++++++---------
+ .../stmicro/stmmac/stmmac_selftests.c         |   8 +-
+ .../net/ethernet/stmicro/stmmac/stmmac_tc.c   |   6 +-
+ 7 files changed, 172 insertions(+), 163 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
++++ b/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
+@@ -46,7 +46,7 @@ static int jumbo_frm(void *p, struct sk_
+ 
+ 	while (len != 0) {
+ 		tx_q->tx_skbuff[entry] = NULL;
+-		entry = STMMAC_GET_ENTRY(entry, priv->dma_tx_size);
++		entry = STMMAC_GET_ENTRY(entry, priv->dma_conf.dma_tx_size);
+ 		desc = tx_q->dma_tx + entry;
+ 
+ 		if (len > bmax) {
+@@ -137,7 +137,7 @@ static void refill_desc3(void *priv_ptr,
+ 		 */
+ 		p->des3 = cpu_to_le32((unsigned int)(rx_q->dma_rx_phy +
+ 				      (((rx_q->dirty_rx) + 1) %
+-				       priv->dma_rx_size) *
++				       priv->dma_conf.dma_rx_size) *
+ 				      sizeof(struct dma_desc)));
+ }
+ 
+@@ -155,7 +155,7 @@ static void clean_desc3(void *priv_ptr,
+ 		 */
+ 		p->des3 = cpu_to_le32((unsigned int)((tx_q->dma_tx_phy +
+ 				      ((tx_q->dirty_tx + 1) %
+-				       priv->dma_tx_size))
++				       priv->dma_conf.dma_tx_size))
+ 				      * sizeof(struct dma_desc)));
+ }
+ 
+--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
++++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+@@ -51,7 +51,7 @@ static int jumbo_frm(void *p, struct sk_
+ 		stmmac_prepare_tx_desc(priv, desc, 1, bmax, csum,
+ 				STMMAC_RING_MODE, 0, false, skb->len);
+ 		tx_q->tx_skbuff[entry] = NULL;
+-		entry = STMMAC_GET_ENTRY(entry, priv->dma_tx_size);
++		entry = STMMAC_GET_ENTRY(entry, priv->dma_conf.dma_tx_size);
+ 
+ 		if (priv->extend_desc)
+ 			desc = (struct dma_desc *)(tx_q->dma_etx + entry);
+@@ -107,7 +107,7 @@ static void refill_desc3(void *priv_ptr,
+ 	struct stmmac_priv *priv = rx_q->priv_data;
+ 
+ 	/* Fill DES3 in case of RING mode */
+-	if (priv->dma_buf_sz == BUF_SIZE_16KiB)
++	if (priv->dma_conf.dma_buf_sz == BUF_SIZE_16KiB)
+ 		p->des3 = cpu_to_le32(le32_to_cpu(p->des2) + BUF_SIZE_8KiB);
+ }
+ 
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+@@ -185,6 +185,18 @@ struct stmmac_rfs_entry {
+ 	int tc;
+ };
+ 
++struct stmmac_dma_conf {
++	unsigned int dma_buf_sz;
++
++	/* RX Queue */
++	struct stmmac_rx_queue rx_queue[MTL_MAX_RX_QUEUES];
++	unsigned int dma_rx_size;
++
++	/* TX Queue */
++	struct stmmac_tx_queue tx_queue[MTL_MAX_TX_QUEUES];
++	unsigned int dma_tx_size;
++};
++
+ struct stmmac_priv {
+ 	/* Frequently used values are kept adjacent for cache effect */
+ 	u32 tx_coal_frames[MTL_MAX_TX_QUEUES];
+@@ -199,7 +211,6 @@ struct stmmac_priv {
+ 	int sph_cap;
+ 	u32 sarc_type;
+ 
+-	unsigned int dma_buf_sz;
+ 	unsigned int rx_copybreak;
+ 	u32 rx_riwt[MTL_MAX_TX_QUEUES];
+ 	int hwts_rx_en;
+@@ -211,13 +222,7 @@ struct stmmac_priv {
+ 	int (*hwif_quirks)(struct stmmac_priv *priv);
+ 	struct mutex lock;
+ 
+-	/* RX Queue */
+-	struct stmmac_rx_queue rx_queue[MTL_MAX_RX_QUEUES];
+-	unsigned int dma_rx_size;
+-
+-	/* TX Queue */
+-	struct stmmac_tx_queue tx_queue[MTL_MAX_TX_QUEUES];
+-	unsigned int dma_tx_size;
++	struct stmmac_dma_conf dma_conf;
+ 
+ 	/* Generic channel for NAPI */
+ 	struct stmmac_channel channel[STMMAC_CH_MAX];
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+@@ -484,8 +484,8 @@ static void stmmac_get_ringparam(struct
+ 
+ 	ring->rx_max_pending = DMA_MAX_RX_SIZE;
+ 	ring->tx_max_pending = DMA_MAX_TX_SIZE;
+-	ring->rx_pending = priv->dma_rx_size;
+-	ring->tx_pending = priv->dma_tx_size;
++	ring->rx_pending = priv->dma_conf.dma_rx_size;
++	ring->tx_pending = priv->dma_conf.dma_tx_size;
+ }
+ 
+ static int stmmac_set_ringparam(struct net_device *netdev,
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -74,8 +74,8 @@ static int phyaddr = -1;
+ module_param(phyaddr, int, 0444);
+ MODULE_PARM_DESC(phyaddr, "Physical device address");
+ 
+-#define STMMAC_TX_THRESH(x)	((x)->dma_tx_size / 4)
+-#define STMMAC_RX_THRESH(x)	((x)->dma_rx_size / 4)
++#define STMMAC_TX_THRESH(x)	((x)->dma_conf.dma_tx_size / 4)
++#define STMMAC_RX_THRESH(x)	((x)->dma_conf.dma_rx_size / 4)
+ 
+ /* Limit to make sure XDP TX and slow path can coexist */
+ #define STMMAC_XSK_TX_BUDGET_MAX	256
+@@ -232,7 +232,7 @@ static void stmmac_disable_all_queues(st
+ 
+ 	/* synchronize_rcu() needed for pending XDP buffers to drain */
+ 	for (queue = 0; queue < rx_queues_cnt; queue++) {
+-		rx_q = &priv->rx_queue[queue];
++		rx_q = &priv->dma_conf.rx_queue[queue];
+ 		if (rx_q->xsk_pool) {
+ 			synchronize_rcu();
+ 			break;
+@@ -358,13 +358,13 @@ static void print_pkt(unsigned char *buf
+ 
+ static inline u32 stmmac_tx_avail(struct stmmac_priv *priv, u32 queue)
+ {
+-	struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
++	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
+ 	u32 avail;
+ 
+ 	if (tx_q->dirty_tx > tx_q->cur_tx)
+ 		avail = tx_q->dirty_tx - tx_q->cur_tx - 1;
+ 	else
+-		avail = priv->dma_tx_size - tx_q->cur_tx + tx_q->dirty_tx - 1;
++		avail = priv->dma_conf.dma_tx_size - tx_q->cur_tx + tx_q->dirty_tx - 1;
+ 
+ 	return avail;
+ }
+@@ -376,13 +376,13 @@ static inline u32 stmmac_tx_avail(struct
+  */
+ static inline u32 stmmac_rx_dirty(struct stmmac_priv *priv, u32 queue)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ 	u32 dirty;
+ 
+ 	if (rx_q->dirty_rx <= rx_q->cur_rx)
+ 		dirty = rx_q->cur_rx - rx_q->dirty_rx;
+ 	else
+-		dirty = priv->dma_rx_size - rx_q->dirty_rx + rx_q->cur_rx;
++		dirty = priv->dma_conf.dma_rx_size - rx_q->dirty_rx + rx_q->cur_rx;
+ 
+ 	return dirty;
+ }
+@@ -410,7 +410,7 @@ static int stmmac_enable_eee_mode(struct
+ 
+ 	/* check if all TX queues have the work finished */
+ 	for (queue = 0; queue < tx_cnt; queue++) {
+-		struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
++		struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
+ 
+ 		if (tx_q->dirty_tx != tx_q->cur_tx)
+ 			return -EBUSY; /* still unfinished work */
+@@ -1309,7 +1309,7 @@ static void stmmac_display_rx_rings(stru
+ 
+ 	/* Display RX rings */
+ 	for (queue = 0; queue < rx_cnt; queue++) {
+-		struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
++		struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ 
+ 		pr_info("\tRX Queue %u rings\n", queue);
+ 
+@@ -1322,7 +1322,7 @@ static void stmmac_display_rx_rings(stru
+ 		}
+ 
+ 		/* Display RX ring */
+-		stmmac_display_ring(priv, head_rx, priv->dma_rx_size, true,
++		stmmac_display_ring(priv, head_rx, priv->dma_conf.dma_rx_size, true,
+ 				    rx_q->dma_rx_phy, desc_size);
+ 	}
+ }
+@@ -1336,7 +1336,7 @@ static void stmmac_display_tx_rings(stru
+ 
+ 	/* Display TX rings */
+ 	for (queue = 0; queue < tx_cnt; queue++) {
+-		struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
++		struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
+ 
+ 		pr_info("\tTX Queue %d rings\n", queue);
+ 
+@@ -1351,7 +1351,7 @@ static void stmmac_display_tx_rings(stru
+ 			desc_size = sizeof(struct dma_desc);
+ 		}
+ 
+-		stmmac_display_ring(priv, head_tx, priv->dma_tx_size, false,
++		stmmac_display_ring(priv, head_tx, priv->dma_conf.dma_tx_size, false,
+ 				    tx_q->dma_tx_phy, desc_size);
+ 	}
+ }
+@@ -1392,21 +1392,21 @@ static int stmmac_set_bfsize(int mtu, in
+  */
+ static void stmmac_clear_rx_descriptors(struct stmmac_priv *priv, u32 queue)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ 	int i;
+ 
+ 	/* Clear the RX descriptors */
+-	for (i = 0; i < priv->dma_rx_size; i++)
++	for (i = 0; i < priv->dma_conf.dma_rx_size; i++)
+ 		if (priv->extend_desc)
+ 			stmmac_init_rx_desc(priv, &rx_q->dma_erx[i].basic,
+ 					priv->use_riwt, priv->mode,
+-					(i == priv->dma_rx_size - 1),
+-					priv->dma_buf_sz);
++					(i == priv->dma_conf.dma_rx_size - 1),
++					priv->dma_conf.dma_buf_sz);
+ 		else
+ 			stmmac_init_rx_desc(priv, &rx_q->dma_rx[i],
+ 					priv->use_riwt, priv->mode,
+-					(i == priv->dma_rx_size - 1),
+-					priv->dma_buf_sz);
++					(i == priv->dma_conf.dma_rx_size - 1),
++					priv->dma_conf.dma_buf_sz);
+ }
+ 
+ /**
+@@ -1418,12 +1418,12 @@ static void stmmac_clear_rx_descriptors(
+  */
+ static void stmmac_clear_tx_descriptors(struct stmmac_priv *priv, u32 queue)
+ {
+-	struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
++	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
+ 	int i;
+ 
+ 	/* Clear the TX descriptors */
+-	for (i = 0; i < priv->dma_tx_size; i++) {
+-		int last = (i == (priv->dma_tx_size - 1));
++	for (i = 0; i < priv->dma_conf.dma_tx_size; i++) {
++		int last = (i == (priv->dma_conf.dma_tx_size - 1));
+ 		struct dma_desc *p;
+ 
+ 		if (priv->extend_desc)
+@@ -1471,7 +1471,7 @@ static void stmmac_clear_descriptors(str
+ static int stmmac_init_rx_buffers(struct stmmac_priv *priv, struct dma_desc *p,
+ 				  int i, gfp_t flags, u32 queue)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ 	struct stmmac_rx_buffer *buf = &rx_q->buf_pool[i];
+ 
+ 	if (!buf->page) {
+@@ -1496,7 +1496,7 @@ static int stmmac_init_rx_buffers(struct
+ 	buf->addr = page_pool_get_dma_addr(buf->page) + buf->page_offset;
+ 
+ 	stmmac_set_desc_addr(priv, p, buf->addr);
+-	if (priv->dma_buf_sz == BUF_SIZE_16KiB)
++	if (priv->dma_conf.dma_buf_sz == BUF_SIZE_16KiB)
+ 		stmmac_init_desc3(priv, p);
+ 
+ 	return 0;
+@@ -1510,7 +1510,7 @@ static int stmmac_init_rx_buffers(struct
+  */
+ static void stmmac_free_rx_buffer(struct stmmac_priv *priv, u32 queue, int i)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ 	struct stmmac_rx_buffer *buf = &rx_q->buf_pool[i];
+ 
+ 	if (buf->page)
+@@ -1530,7 +1530,7 @@ static void stmmac_free_rx_buffer(struct
+  */
+ static void stmmac_free_tx_buffer(struct stmmac_priv *priv, u32 queue, int i)
+ {
+-	struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
++	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
+ 
+ 	if (tx_q->tx_skbuff_dma[i].buf &&
+ 	    tx_q->tx_skbuff_dma[i].buf_type != STMMAC_TXBUF_T_XDP_TX) {
+@@ -1575,17 +1575,17 @@ static void dma_free_rx_skbufs(struct st
+ {
+ 	int i;
+ 
+-	for (i = 0; i < priv->dma_rx_size; i++)
++	for (i = 0; i < priv->dma_conf.dma_rx_size; i++)
+ 		stmmac_free_rx_buffer(priv, queue, i);
+ }
+ 
+ static int stmmac_alloc_rx_buffers(struct stmmac_priv *priv, u32 queue,
+ 				   gfp_t flags)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ 	int i;
+ 
+-	for (i = 0; i < priv->dma_rx_size; i++) {
++	for (i = 0; i < priv->dma_conf.dma_rx_size; i++) {
+ 		struct dma_desc *p;
+ 		int ret;
+ 
+@@ -1612,10 +1612,10 @@ static int stmmac_alloc_rx_buffers(struc
+  */
+ static void dma_free_rx_xskbufs(struct stmmac_priv *priv, u32 queue)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ 	int i;
+ 
+-	for (i = 0; i < priv->dma_rx_size; i++) {
++	for (i = 0; i < priv->dma_conf.dma_rx_size; i++) {
+ 		struct stmmac_rx_buffer *buf = &rx_q->buf_pool[i];
+ 
+ 		if (!buf->xdp)
+@@ -1628,10 +1628,10 @@ static void dma_free_rx_xskbufs(struct s
+ 
+ static int stmmac_alloc_rx_buffers_zc(struct stmmac_priv *priv, u32 queue)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ 	int i;
+ 
+-	for (i = 0; i < priv->dma_rx_size; i++) {
++	for (i = 0; i < priv->dma_conf.dma_rx_size; i++) {
+ 		struct stmmac_rx_buffer *buf;
+ 		dma_addr_t dma_addr;
+ 		struct dma_desc *p;
+@@ -1674,7 +1674,7 @@ static struct xsk_buff_pool *stmmac_get_
+  */
+ static int __init_dma_rx_desc_rings(struct stmmac_priv *priv, u32 queue, gfp_t flags)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ 	int ret;
+ 
+ 	netif_dbg(priv, probe, priv->dev,
+@@ -1720,11 +1720,11 @@ static int __init_dma_rx_desc_rings(stru
+ 		if (priv->extend_desc)
+ 			stmmac_mode_init(priv, rx_q->dma_erx,
+ 					 rx_q->dma_rx_phy,
+-					 priv->dma_rx_size, 1);
++					 priv->dma_conf.dma_rx_size, 1);
+ 		else
+ 			stmmac_mode_init(priv, rx_q->dma_rx,
+ 					 rx_q->dma_rx_phy,
+-					 priv->dma_rx_size, 0);
++					 priv->dma_conf.dma_rx_size, 0);
+ 	}
+ 
+ 	return 0;
+@@ -1751,7 +1751,7 @@ static int init_dma_rx_desc_rings(struct
+ 
+ err_init_rx_buffers:
+ 	while (queue >= 0) {
+-		struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
++		struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ 
+ 		if (rx_q->xsk_pool)
+ 			dma_free_rx_xskbufs(priv, queue);
+@@ -1780,7 +1780,7 @@ err_init_rx_buffers:
+  */
+ static int __init_dma_tx_desc_rings(struct stmmac_priv *priv, u32 queue)
+ {
+-	struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
++	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
+ 	int i;
+ 
+ 	netif_dbg(priv, probe, priv->dev,
+@@ -1792,16 +1792,16 @@ static int __init_dma_tx_desc_rings(stru
+ 		if (priv->extend_desc)
+ 			stmmac_mode_init(priv, tx_q->dma_etx,
+ 					 tx_q->dma_tx_phy,
+-					 priv->dma_tx_size, 1);
++					 priv->dma_conf.dma_tx_size, 1);
+ 		else if (!(tx_q->tbs & STMMAC_TBS_AVAIL))
+ 			stmmac_mode_init(priv, tx_q->dma_tx,
+ 					 tx_q->dma_tx_phy,
+-					 priv->dma_tx_size, 0);
++					 priv->dma_conf.dma_tx_size, 0);
+ 	}
+ 
+ 	tx_q->xsk_pool = stmmac_get_xsk_pool(priv, queue);
+ 
+-	for (i = 0; i < priv->dma_tx_size; i++) {
++	for (i = 0; i < priv->dma_conf.dma_tx_size; i++) {
+ 		struct dma_desc *p;
+ 
+ 		if (priv->extend_desc)
+@@ -1871,12 +1871,12 @@ static int init_dma_desc_rings(struct ne
+  */
+ static void dma_free_tx_skbufs(struct stmmac_priv *priv, u32 queue)
+ {
+-	struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
++	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
+ 	int i;
+ 
+ 	tx_q->xsk_frames_done = 0;
+ 
+-	for (i = 0; i < priv->dma_tx_size; i++)
++	for (i = 0; i < priv->dma_conf.dma_tx_size; i++)
+ 		stmmac_free_tx_buffer(priv, queue, i);
+ 
+ 	if (tx_q->xsk_pool && tx_q->xsk_frames_done) {
+@@ -1906,7 +1906,7 @@ static void stmmac_free_tx_skbufs(struct
+  */
+ static void __free_dma_rx_desc_resources(struct stmmac_priv *priv, u32 queue)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ 
+ 	/* Release the DMA RX socket buffers */
+ 	if (rx_q->xsk_pool)
+@@ -1919,11 +1919,11 @@ static void __free_dma_rx_desc_resources
+ 
+ 	/* Free DMA regions of consistent memory previously allocated */
+ 	if (!priv->extend_desc)
+-		dma_free_coherent(priv->device, priv->dma_rx_size *
++		dma_free_coherent(priv->device, priv->dma_conf.dma_rx_size *
+ 				  sizeof(struct dma_desc),
+ 				  rx_q->dma_rx, rx_q->dma_rx_phy);
+ 	else
+-		dma_free_coherent(priv->device, priv->dma_rx_size *
++		dma_free_coherent(priv->device, priv->dma_conf.dma_rx_size *
+ 				  sizeof(struct dma_extended_desc),
+ 				  rx_q->dma_erx, rx_q->dma_rx_phy);
+ 
+@@ -1952,7 +1952,7 @@ static void free_dma_rx_desc_resources(s
+  */
+ static void __free_dma_tx_desc_resources(struct stmmac_priv *priv, u32 queue)
+ {
+-	struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
++	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
+ 	size_t size;
+ 	void *addr;
+ 
+@@ -1970,7 +1970,7 @@ static void __free_dma_tx_desc_resources
+ 		addr = tx_q->dma_tx;
+ 	}
+ 
+-	size *= priv->dma_tx_size;
++	size *= priv->dma_conf.dma_tx_size;
+ 
+ 	dma_free_coherent(priv->device, size, addr, tx_q->dma_tx_phy);
+ 
+@@ -1999,7 +1999,7 @@ static void free_dma_tx_desc_resources(s
+  */
+ static int __alloc_dma_rx_desc_resources(struct stmmac_priv *priv, u32 queue)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ 	struct stmmac_channel *ch = &priv->channel[queue];
+ 	bool xdp_prog = stmmac_xdp_is_enabled(priv);
+ 	struct page_pool_params pp_params = { 0 };
+@@ -2011,8 +2011,8 @@ static int __alloc_dma_rx_desc_resources
+ 	rx_q->priv_data = priv;
+ 
+ 	pp_params.flags = PP_FLAG_DMA_MAP | PP_FLAG_DMA_SYNC_DEV;
+-	pp_params.pool_size = priv->dma_rx_size;
+-	num_pages = DIV_ROUND_UP(priv->dma_buf_sz, PAGE_SIZE);
++	pp_params.pool_size = priv->dma_conf.dma_rx_size;
++	num_pages = DIV_ROUND_UP(priv->dma_conf.dma_buf_sz, PAGE_SIZE);
+ 	pp_params.order = ilog2(num_pages);
+ 	pp_params.nid = dev_to_node(priv->device);
+ 	pp_params.dev = priv->device;
+@@ -2027,7 +2027,7 @@ static int __alloc_dma_rx_desc_resources
+ 		return ret;
+ 	}
+ 
+-	rx_q->buf_pool = kcalloc(priv->dma_rx_size,
++	rx_q->buf_pool = kcalloc(priv->dma_conf.dma_rx_size,
+ 				 sizeof(*rx_q->buf_pool),
+ 				 GFP_KERNEL);
+ 	if (!rx_q->buf_pool)
+@@ -2035,7 +2035,7 @@ static int __alloc_dma_rx_desc_resources
+ 
+ 	if (priv->extend_desc) {
+ 		rx_q->dma_erx = dma_alloc_coherent(priv->device,
+-						   priv->dma_rx_size *
++						   priv->dma_conf.dma_rx_size *
+ 						   sizeof(struct dma_extended_desc),
+ 						   &rx_q->dma_rx_phy,
+ 						   GFP_KERNEL);
+@@ -2044,7 +2044,7 @@ static int __alloc_dma_rx_desc_resources
+ 
+ 	} else {
+ 		rx_q->dma_rx = dma_alloc_coherent(priv->device,
+-						  priv->dma_rx_size *
++						  priv->dma_conf.dma_rx_size *
+ 						  sizeof(struct dma_desc),
+ 						  &rx_q->dma_rx_phy,
+ 						  GFP_KERNEL);
+@@ -2101,20 +2101,20 @@ err_dma:
+  */
+ static int __alloc_dma_tx_desc_resources(struct stmmac_priv *priv, u32 queue)
+ {
+-	struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
++	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
+ 	size_t size;
+ 	void *addr;
+ 
+ 	tx_q->queue_index = queue;
+ 	tx_q->priv_data = priv;
+ 
+-	tx_q->tx_skbuff_dma = kcalloc(priv->dma_tx_size,
++	tx_q->tx_skbuff_dma = kcalloc(priv->dma_conf.dma_tx_size,
+ 				      sizeof(*tx_q->tx_skbuff_dma),
+ 				      GFP_KERNEL);
+ 	if (!tx_q->tx_skbuff_dma)
+ 		return -ENOMEM;
+ 
+-	tx_q->tx_skbuff = kcalloc(priv->dma_tx_size,
++	tx_q->tx_skbuff = kcalloc(priv->dma_conf.dma_tx_size,
+ 				  sizeof(struct sk_buff *),
+ 				  GFP_KERNEL);
+ 	if (!tx_q->tx_skbuff)
+@@ -2127,7 +2127,7 @@ static int __alloc_dma_tx_desc_resources
+ 	else
+ 		size = sizeof(struct dma_desc);
+ 
+-	size *= priv->dma_tx_size;
++	size *= priv->dma_conf.dma_tx_size;
+ 
+ 	addr = dma_alloc_coherent(priv->device, size,
+ 				  &tx_q->dma_tx_phy, GFP_KERNEL);
+@@ -2371,7 +2371,7 @@ static void stmmac_dma_operation_mode(st
+ 
+ 	/* configure all channels */
+ 	for (chan = 0; chan < rx_channels_count; chan++) {
+-		struct stmmac_rx_queue *rx_q = &priv->rx_queue[chan];
++		struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[chan];
+ 		u32 buf_size;
+ 
+ 		qmode = priv->plat->rx_queues_cfg[chan].mode_to_use;
+@@ -2386,7 +2386,7 @@ static void stmmac_dma_operation_mode(st
+ 					      chan);
+ 		} else {
+ 			stmmac_set_dma_bfsize(priv, priv->ioaddr,
+-					      priv->dma_buf_sz,
++					      priv->dma_conf.dma_buf_sz,
+ 					      chan);
+ 		}
+ 	}
+@@ -2402,7 +2402,7 @@ static void stmmac_dma_operation_mode(st
+ static bool stmmac_xdp_xmit_zc(struct stmmac_priv *priv, u32 queue, u32 budget)
+ {
+ 	struct netdev_queue *nq = netdev_get_tx_queue(priv->dev, queue);
+-	struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
++	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
+ 	struct xsk_buff_pool *pool = tx_q->xsk_pool;
+ 	unsigned int entry = tx_q->cur_tx;
+ 	struct dma_desc *tx_desc = NULL;
+@@ -2477,7 +2477,7 @@ static bool stmmac_xdp_xmit_zc(struct st
+ 
+ 		stmmac_enable_dma_transmission(priv, priv->ioaddr);
+ 
+-		tx_q->cur_tx = STMMAC_GET_ENTRY(tx_q->cur_tx, priv->dma_tx_size);
++		tx_q->cur_tx = STMMAC_GET_ENTRY(tx_q->cur_tx, priv->dma_conf.dma_tx_size);
+ 		entry = tx_q->cur_tx;
+ 	}
+ 
+@@ -2503,7 +2503,7 @@ static bool stmmac_xdp_xmit_zc(struct st
+  */
+ static int stmmac_tx_clean(struct stmmac_priv *priv, int budget, u32 queue)
+ {
+-	struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
++	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
+ 	unsigned int bytes_compl = 0, pkts_compl = 0;
+ 	unsigned int entry, xmits = 0, count = 0;
+ 
+@@ -2516,7 +2516,7 @@ static int stmmac_tx_clean(struct stmmac
+ 	entry = tx_q->dirty_tx;
+ 
+ 	/* Try to clean all TX complete frame in 1 shot */
+-	while ((entry != tx_q->cur_tx) && count < priv->dma_tx_size) {
++	while ((entry != tx_q->cur_tx) && count < priv->dma_conf.dma_tx_size) {
+ 		struct xdp_frame *xdpf;
+ 		struct sk_buff *skb;
+ 		struct dma_desc *p;
+@@ -2616,7 +2616,7 @@ static int stmmac_tx_clean(struct stmmac
+ 
+ 		stmmac_release_tx_desc(priv, p, priv->mode);
+ 
+-		entry = STMMAC_GET_ENTRY(entry, priv->dma_tx_size);
++		entry = STMMAC_GET_ENTRY(entry, priv->dma_conf.dma_tx_size);
+ 	}
+ 	tx_q->dirty_tx = entry;
+ 
+@@ -2681,7 +2681,7 @@ static int stmmac_tx_clean(struct stmmac
+  */
+ static void stmmac_tx_err(struct stmmac_priv *priv, u32 chan)
+ {
+-	struct stmmac_tx_queue *tx_q = &priv->tx_queue[chan];
++	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[chan];
+ 
+ 	netif_tx_stop_queue(netdev_get_tx_queue(priv->dev, chan));
+ 
+@@ -2748,8 +2748,8 @@ static int stmmac_napi_check(struct stmm
+ {
+ 	int status = stmmac_dma_interrupt_status(priv, priv->ioaddr,
+ 						 &priv->xstats, chan, dir);
+-	struct stmmac_rx_queue *rx_q = &priv->rx_queue[chan];
+-	struct stmmac_tx_queue *tx_q = &priv->tx_queue[chan];
++	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[chan];
++	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[chan];
+ 	struct stmmac_channel *ch = &priv->channel[chan];
+ 	struct napi_struct *rx_napi;
+ 	struct napi_struct *tx_napi;
+@@ -2925,7 +2925,7 @@ static int stmmac_init_dma_engine(struct
+ 
+ 	/* DMA RX Channel Configuration */
+ 	for (chan = 0; chan < rx_channels_count; chan++) {
+-		rx_q = &priv->rx_queue[chan];
++		rx_q = &priv->dma_conf.rx_queue[chan];
+ 
+ 		stmmac_init_rx_chan(priv, priv->ioaddr, priv->plat->dma_cfg,
+ 				    rx_q->dma_rx_phy, chan);
+@@ -2939,7 +2939,7 @@ static int stmmac_init_dma_engine(struct
+ 
+ 	/* DMA TX Channel Configuration */
+ 	for (chan = 0; chan < tx_channels_count; chan++) {
+-		tx_q = &priv->tx_queue[chan];
++		tx_q = &priv->dma_conf.tx_queue[chan];
+ 
+ 		stmmac_init_tx_chan(priv, priv->ioaddr, priv->plat->dma_cfg,
+ 				    tx_q->dma_tx_phy, chan);
+@@ -2954,7 +2954,7 @@ static int stmmac_init_dma_engine(struct
+ 
+ static void stmmac_tx_timer_arm(struct stmmac_priv *priv, u32 queue)
+ {
+-	struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
++	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
+ 
+ 	hrtimer_start(&tx_q->txtimer,
+ 		      STMMAC_COAL_TIMER(priv->tx_coal_timer[queue]),
+@@ -3004,7 +3004,7 @@ static void stmmac_init_coalesce(struct
+ 	u32 chan;
+ 
+ 	for (chan = 0; chan < tx_channel_count; chan++) {
+-		struct stmmac_tx_queue *tx_q = &priv->tx_queue[chan];
++		struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[chan];
+ 
+ 		priv->tx_coal_frames[chan] = STMMAC_TX_FRAMES;
+ 		priv->tx_coal_timer[chan] = STMMAC_COAL_TX_TIMER;
+@@ -3026,12 +3026,12 @@ static void stmmac_set_rings_length(stru
+ 	/* set TX ring length */
+ 	for (chan = 0; chan < tx_channels_count; chan++)
+ 		stmmac_set_tx_ring_len(priv, priv->ioaddr,
+-				       (priv->dma_tx_size - 1), chan);
++				       (priv->dma_conf.dma_tx_size - 1), chan);
+ 
+ 	/* set RX ring length */
+ 	for (chan = 0; chan < rx_channels_count; chan++)
+ 		stmmac_set_rx_ring_len(priv, priv->ioaddr,
+-				       (priv->dma_rx_size - 1), chan);
++				       (priv->dma_conf.dma_rx_size - 1), chan);
+ }
+ 
+ /**
+@@ -3366,7 +3366,7 @@ static int stmmac_hw_setup(struct net_de
+ 	/* Enable TSO */
+ 	if (priv->tso) {
+ 		for (chan = 0; chan < tx_cnt; chan++) {
+-			struct stmmac_tx_queue *tx_q = &priv->tx_queue[chan];
++			struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[chan];
+ 
+ 			/* TSO and TBS cannot co-exist */
+ 			if (tx_q->tbs & STMMAC_TBS_AVAIL)
+@@ -3388,7 +3388,7 @@ static int stmmac_hw_setup(struct net_de
+ 
+ 	/* TBS */
+ 	for (chan = 0; chan < tx_cnt; chan++) {
+-		struct stmmac_tx_queue *tx_q = &priv->tx_queue[chan];
++		struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[chan];
+ 		int enable = tx_q->tbs & STMMAC_TBS_AVAIL;
+ 
+ 		stmmac_enable_tbs(priv, priv->ioaddr, enable, chan);
+@@ -3432,7 +3432,7 @@ static void stmmac_free_irq(struct net_d
+ 		for (j = irq_idx - 1; j >= 0; j--) {
+ 			if (priv->tx_irq[j] > 0) {
+ 				irq_set_affinity_hint(priv->tx_irq[j], NULL);
+-				free_irq(priv->tx_irq[j], &priv->tx_queue[j]);
++				free_irq(priv->tx_irq[j], &priv->dma_conf.tx_queue[j]);
+ 			}
+ 		}
+ 		irq_idx = priv->plat->rx_queues_to_use;
+@@ -3441,7 +3441,7 @@ static void stmmac_free_irq(struct net_d
+ 		for (j = irq_idx - 1; j >= 0; j--) {
+ 			if (priv->rx_irq[j] > 0) {
+ 				irq_set_affinity_hint(priv->rx_irq[j], NULL);
+-				free_irq(priv->rx_irq[j], &priv->rx_queue[j]);
++				free_irq(priv->rx_irq[j], &priv->dma_conf.rx_queue[j]);
+ 			}
+ 		}
+ 
+@@ -3574,7 +3574,7 @@ static int stmmac_request_irq_multi_msi(
+ 		sprintf(int_name, "%s:%s-%d", dev->name, "rx", i);
+ 		ret = request_irq(priv->rx_irq[i],
+ 				  stmmac_msi_intr_rx,
+-				  0, int_name, &priv->rx_queue[i]);
++				  0, int_name, &priv->dma_conf.rx_queue[i]);
+ 		if (unlikely(ret < 0)) {
+ 			netdev_err(priv->dev,
+ 				   "%s: alloc rx-%d  MSI %d (error: %d)\n",
+@@ -3597,7 +3597,7 @@ static int stmmac_request_irq_multi_msi(
+ 		sprintf(int_name, "%s:%s-%d", dev->name, "tx", i);
+ 		ret = request_irq(priv->tx_irq[i],
+ 				  stmmac_msi_intr_tx,
+-				  0, int_name, &priv->tx_queue[i]);
++				  0, int_name, &priv->dma_conf.tx_queue[i]);
+ 		if (unlikely(ret < 0)) {
+ 			netdev_err(priv->dev,
+ 				   "%s: alloc tx-%d  MSI %d (error: %d)\n",
+@@ -3728,21 +3728,21 @@ static int stmmac_open(struct net_device
+ 		bfsize = 0;
+ 
+ 	if (bfsize < BUF_SIZE_16KiB)
+-		bfsize = stmmac_set_bfsize(dev->mtu, priv->dma_buf_sz);
++		bfsize = stmmac_set_bfsize(dev->mtu, priv->dma_conf.dma_buf_sz);
+ 
+-	priv->dma_buf_sz = bfsize;
++	priv->dma_conf.dma_buf_sz = bfsize;
+ 	buf_sz = bfsize;
+ 
+ 	priv->rx_copybreak = STMMAC_RX_COPYBREAK;
+ 
+-	if (!priv->dma_tx_size)
+-		priv->dma_tx_size = DMA_DEFAULT_TX_SIZE;
+-	if (!priv->dma_rx_size)
+-		priv->dma_rx_size = DMA_DEFAULT_RX_SIZE;
++	if (!priv->dma_conf.dma_tx_size)
++		priv->dma_conf.dma_tx_size = DMA_DEFAULT_TX_SIZE;
++	if (!priv->dma_conf.dma_rx_size)
++		priv->dma_conf.dma_rx_size = DMA_DEFAULT_RX_SIZE;
+ 
+ 	/* Earlier check for TBS */
+ 	for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++) {
+-		struct stmmac_tx_queue *tx_q = &priv->tx_queue[chan];
++		struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[chan];
+ 		int tbs_en = priv->plat->tx_queues_cfg[chan].tbs_en;
+ 
+ 		/* Setup per-TXQ tbs flag before TX descriptor alloc */
+@@ -3800,7 +3800,7 @@ irq_error:
+ 	phylink_stop(priv->phylink);
+ 
+ 	for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
+-		hrtimer_cancel(&priv->tx_queue[chan].txtimer);
++		hrtimer_cancel(&priv->dma_conf.tx_queue[chan].txtimer);
+ 
+ 	stmmac_hw_teardown(dev);
+ init_error:
+@@ -3842,7 +3842,7 @@ static int stmmac_release(struct net_dev
+ 	stmmac_disable_all_queues(priv);
+ 
+ 	for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
+-		hrtimer_cancel(&priv->tx_queue[chan].txtimer);
++		hrtimer_cancel(&priv->dma_conf.tx_queue[chan].txtimer);
+ 
+ 	netif_tx_disable(dev);
+ 
+@@ -3906,7 +3906,7 @@ static bool stmmac_vlan_insert(struct st
+ 		return false;
+ 
+ 	stmmac_set_tx_owner(priv, p);
+-	tx_q->cur_tx = STMMAC_GET_ENTRY(tx_q->cur_tx, priv->dma_tx_size);
++	tx_q->cur_tx = STMMAC_GET_ENTRY(tx_q->cur_tx, priv->dma_conf.dma_tx_size);
+ 	return true;
+ }
+ 
+@@ -3924,7 +3924,7 @@ static bool stmmac_vlan_insert(struct st
+ static void stmmac_tso_allocator(struct stmmac_priv *priv, dma_addr_t des,
+ 				 int total_len, bool last_segment, u32 queue)
+ {
+-	struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
++	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
+ 	struct dma_desc *desc;
+ 	u32 buff_size;
+ 	int tmp_len;
+@@ -3935,7 +3935,7 @@ static void stmmac_tso_allocator(struct
+ 		dma_addr_t curr_addr;
+ 
+ 		tx_q->cur_tx = STMMAC_GET_ENTRY(tx_q->cur_tx,
+-						priv->dma_tx_size);
++						priv->dma_conf.dma_tx_size);
+ 		WARN_ON(tx_q->tx_skbuff[tx_q->cur_tx]);
+ 
+ 		if (tx_q->tbs & STMMAC_TBS_AVAIL)
+@@ -3963,7 +3963,7 @@ static void stmmac_tso_allocator(struct
+ 
+ static void stmmac_flush_tx_descriptors(struct stmmac_priv *priv, int queue)
+ {
+-	struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
++	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
+ 	int desc_size;
+ 
+ 	if (likely(priv->extend_desc))
+@@ -4025,7 +4025,7 @@ static netdev_tx_t stmmac_tso_xmit(struc
+ 	dma_addr_t des;
+ 	int i;
+ 
+-	tx_q = &priv->tx_queue[queue];
++	tx_q = &priv->dma_conf.tx_queue[queue];
+ 	first_tx = tx_q->cur_tx;
+ 
+ 	/* Compute header lengths */
+@@ -4065,7 +4065,7 @@ static netdev_tx_t stmmac_tso_xmit(struc
+ 		stmmac_set_mss(priv, mss_desc, mss);
+ 		tx_q->mss = mss;
+ 		tx_q->cur_tx = STMMAC_GET_ENTRY(tx_q->cur_tx,
+-						priv->dma_tx_size);
++						priv->dma_conf.dma_tx_size);
+ 		WARN_ON(tx_q->tx_skbuff[tx_q->cur_tx]);
+ 	}
+ 
+@@ -4177,7 +4177,7 @@ static netdev_tx_t stmmac_tso_xmit(struc
+ 	 * ndo_start_xmit will fill this descriptor the next time it's
+ 	 * called and stmmac_tx_clean may clean up to this descriptor.
+ 	 */
+-	tx_q->cur_tx = STMMAC_GET_ENTRY(tx_q->cur_tx, priv->dma_tx_size);
++	tx_q->cur_tx = STMMAC_GET_ENTRY(tx_q->cur_tx, priv->dma_conf.dma_tx_size);
+ 
+ 	if (unlikely(stmmac_tx_avail(priv, queue) <= (MAX_SKB_FRAGS + 1))) {
+ 		netif_dbg(priv, hw, priv->dev, "%s: stop transmitted packets\n",
+@@ -4265,7 +4265,7 @@ static netdev_tx_t stmmac_xmit(struct sk
+ 	int entry, first_tx;
+ 	dma_addr_t des;
+ 
+-	tx_q = &priv->tx_queue[queue];
++	tx_q = &priv->dma_conf.tx_queue[queue];
+ 	first_tx = tx_q->cur_tx;
+ 
+ 	if (priv->tx_path_in_lpi_mode && priv->eee_sw_timer_en)
+@@ -4328,7 +4328,7 @@ static netdev_tx_t stmmac_xmit(struct sk
+ 		int len = skb_frag_size(frag);
+ 		bool last_segment = (i == (nfrags - 1));
+ 
+-		entry = STMMAC_GET_ENTRY(entry, priv->dma_tx_size);
++		entry = STMMAC_GET_ENTRY(entry, priv->dma_conf.dma_tx_size);
+ 		WARN_ON(tx_q->tx_skbuff[entry]);
+ 
+ 		if (likely(priv->extend_desc))
+@@ -4399,7 +4399,7 @@ static netdev_tx_t stmmac_xmit(struct sk
+ 	 * ndo_start_xmit will fill this descriptor the next time it's
+ 	 * called and stmmac_tx_clean may clean up to this descriptor.
+ 	 */
+-	entry = STMMAC_GET_ENTRY(entry, priv->dma_tx_size);
++	entry = STMMAC_GET_ENTRY(entry, priv->dma_conf.dma_tx_size);
+ 	tx_q->cur_tx = entry;
+ 
+ 	if (netif_msg_pktdata(priv)) {
+@@ -4514,7 +4514,7 @@ static void stmmac_rx_vlan(struct net_de
+  */
+ static inline void stmmac_rx_refill(struct stmmac_priv *priv, u32 queue)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ 	int dirty = stmmac_rx_dirty(priv, queue);
+ 	unsigned int entry = rx_q->dirty_rx;
+ 
+@@ -4564,7 +4564,7 @@ static inline void stmmac_rx_refill(stru
+ 		dma_wmb();
+ 		stmmac_set_rx_owner(priv, p, use_rx_wd);
+ 
+-		entry = STMMAC_GET_ENTRY(entry, priv->dma_rx_size);
++		entry = STMMAC_GET_ENTRY(entry, priv->dma_conf.dma_rx_size);
+ 	}
+ 	rx_q->dirty_rx = entry;
+ 	rx_q->rx_tail_addr = rx_q->dma_rx_phy +
+@@ -4592,12 +4592,12 @@ static unsigned int stmmac_rx_buf1_len(s
+ 
+ 	/* First descriptor, not last descriptor and not split header */
+ 	if (status & rx_not_ls)
+-		return priv->dma_buf_sz;
++		return priv->dma_conf.dma_buf_sz;
+ 
+ 	plen = stmmac_get_rx_frame_len(priv, p, coe);
+ 
+ 	/* First descriptor and last descriptor and not split header */
+-	return min_t(unsigned int, priv->dma_buf_sz, plen);
++	return min_t(unsigned int, priv->dma_conf.dma_buf_sz, plen);
+ }
+ 
+ static unsigned int stmmac_rx_buf2_len(struct stmmac_priv *priv,
+@@ -4613,7 +4613,7 @@ static unsigned int stmmac_rx_buf2_len(s
+ 
+ 	/* Not last descriptor */
+ 	if (status & rx_not_ls)
+-		return priv->dma_buf_sz;
++		return priv->dma_conf.dma_buf_sz;
+ 
+ 	plen = stmmac_get_rx_frame_len(priv, p, coe);
+ 
+@@ -4624,7 +4624,7 @@ static unsigned int stmmac_rx_buf2_len(s
+ static int stmmac_xdp_xmit_xdpf(struct stmmac_priv *priv, int queue,
+ 				struct xdp_frame *xdpf, bool dma_map)
+ {
+-	struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
++	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
+ 	unsigned int entry = tx_q->cur_tx;
+ 	struct dma_desc *tx_desc;
+ 	dma_addr_t dma_addr;
+@@ -4687,7 +4687,7 @@ static int stmmac_xdp_xmit_xdpf(struct s
+ 
+ 	stmmac_enable_dma_transmission(priv, priv->ioaddr);
+ 
+-	entry = STMMAC_GET_ENTRY(entry, priv->dma_tx_size);
++	entry = STMMAC_GET_ENTRY(entry, priv->dma_conf.dma_tx_size);
+ 	tx_q->cur_tx = entry;
+ 
+ 	return STMMAC_XDP_TX;
+@@ -4861,7 +4861,7 @@ static void stmmac_dispatch_skb_zc(struc
+ 
+ static bool stmmac_rx_refill_zc(struct stmmac_priv *priv, u32 queue, u32 budget)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ 	unsigned int entry = rx_q->dirty_rx;
+ 	struct dma_desc *rx_desc = NULL;
+ 	bool ret = true;
+@@ -4904,7 +4904,7 @@ static bool stmmac_rx_refill_zc(struct s
+ 		dma_wmb();
+ 		stmmac_set_rx_owner(priv, rx_desc, use_rx_wd);
+ 
+-		entry = STMMAC_GET_ENTRY(entry, priv->dma_rx_size);
++		entry = STMMAC_GET_ENTRY(entry, priv->dma_conf.dma_rx_size);
+ 	}
+ 
+ 	if (rx_desc) {
+@@ -4919,7 +4919,7 @@ static bool stmmac_rx_refill_zc(struct s
+ 
+ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ 	unsigned int count = 0, error = 0, len = 0;
+ 	int dirty = stmmac_rx_dirty(priv, queue);
+ 	unsigned int next_entry = rx_q->cur_rx;
+@@ -4941,7 +4941,7 @@ static int stmmac_rx_zc(struct stmmac_pr
+ 			desc_size = sizeof(struct dma_desc);
+ 		}
+ 
+-		stmmac_display_ring(priv, rx_head, priv->dma_rx_size, true,
++		stmmac_display_ring(priv, rx_head, priv->dma_conf.dma_rx_size, true,
+ 				    rx_q->dma_rx_phy, desc_size);
+ 	}
+ 	while (count < limit) {
+@@ -4988,7 +4988,7 @@ read_again:
+ 
+ 		/* Prefetch the next RX descriptor */
+ 		rx_q->cur_rx = STMMAC_GET_ENTRY(rx_q->cur_rx,
+-						priv->dma_rx_size);
++						priv->dma_conf.dma_rx_size);
+ 		next_entry = rx_q->cur_rx;
+ 
+ 		if (priv->extend_desc)
+@@ -5109,7 +5109,7 @@ read_again:
+  */
+ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ 	struct stmmac_channel *ch = &priv->channel[queue];
+ 	unsigned int count = 0, error = 0, len = 0;
+ 	int status = 0, coe = priv->hw->rx_csum;
+@@ -5122,7 +5122,7 @@ static int stmmac_rx(struct stmmac_priv
+ 	int buf_sz;
+ 
+ 	dma_dir = page_pool_get_dma_dir(rx_q->page_pool);
+-	buf_sz = DIV_ROUND_UP(priv->dma_buf_sz, PAGE_SIZE) * PAGE_SIZE;
++	buf_sz = DIV_ROUND_UP(priv->dma_conf.dma_buf_sz, PAGE_SIZE) * PAGE_SIZE;
+ 
+ 	if (netif_msg_rx_status(priv)) {
+ 		void *rx_head;
+@@ -5136,7 +5136,7 @@ static int stmmac_rx(struct stmmac_priv
+ 			desc_size = sizeof(struct dma_desc);
+ 		}
+ 
+-		stmmac_display_ring(priv, rx_head, priv->dma_rx_size, true,
++		stmmac_display_ring(priv, rx_head, priv->dma_conf.dma_rx_size, true,
+ 				    rx_q->dma_rx_phy, desc_size);
+ 	}
+ 	while (count < limit) {
+@@ -5180,7 +5180,7 @@ read_again:
+ 			break;
+ 
+ 		rx_q->cur_rx = STMMAC_GET_ENTRY(rx_q->cur_rx,
+-						priv->dma_rx_size);
++						priv->dma_conf.dma_rx_size);
+ 		next_entry = rx_q->cur_rx;
+ 
+ 		if (priv->extend_desc)
+@@ -5314,7 +5314,7 @@ read_again:
+ 						buf1_len, dma_dir);
+ 			skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+ 					buf->page, buf->page_offset, buf1_len,
+-					priv->dma_buf_sz);
++					priv->dma_conf.dma_buf_sz);
+ 
+ 			/* Data payload appended into SKB */
+ 			page_pool_release_page(rx_q->page_pool, buf->page);
+@@ -5326,7 +5326,7 @@ read_again:
+ 						buf2_len, dma_dir);
+ 			skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+ 					buf->sec_page, 0, buf2_len,
+-					priv->dma_buf_sz);
++					priv->dma_conf.dma_buf_sz);
+ 
+ 			/* Data payload appended into SKB */
+ 			page_pool_release_page(rx_q->page_pool, buf->sec_page);
+@@ -5768,11 +5768,13 @@ static irqreturn_t stmmac_safety_interru
+ static irqreturn_t stmmac_msi_intr_tx(int irq, void *data)
+ {
+ 	struct stmmac_tx_queue *tx_q = (struct stmmac_tx_queue *)data;
++	struct stmmac_dma_conf *dma_conf;
+ 	int chan = tx_q->queue_index;
+ 	struct stmmac_priv *priv;
+ 	int status;
+ 
+-	priv = container_of(tx_q, struct stmmac_priv, tx_queue[chan]);
++	dma_conf = container_of(tx_q, struct stmmac_dma_conf, tx_queue[chan]);
++	priv = container_of(dma_conf, struct stmmac_priv, dma_conf);
+ 
+ 	if (unlikely(!data)) {
+ 		netdev_err(priv->dev, "%s: invalid dev pointer\n", __func__);
+@@ -5812,10 +5814,12 @@ static irqreturn_t stmmac_msi_intr_tx(in
+ static irqreturn_t stmmac_msi_intr_rx(int irq, void *data)
+ {
+ 	struct stmmac_rx_queue *rx_q = (struct stmmac_rx_queue *)data;
++	struct stmmac_dma_conf *dma_conf;
+ 	int chan = rx_q->queue_index;
+ 	struct stmmac_priv *priv;
+ 
+-	priv = container_of(rx_q, struct stmmac_priv, rx_queue[chan]);
++	dma_conf = container_of(rx_q, struct stmmac_dma_conf, rx_queue[chan]);
++	priv = container_of(dma_conf, struct stmmac_priv, dma_conf);
+ 
+ 	if (unlikely(!data)) {
+ 		netdev_err(priv->dev, "%s: invalid dev pointer\n", __func__);
+@@ -5846,10 +5850,10 @@ static void stmmac_poll_controller(struc
+ 
+ 	if (priv->plat->multi_msi_en) {
+ 		for (i = 0; i < priv->plat->rx_queues_to_use; i++)
+-			stmmac_msi_intr_rx(0, &priv->rx_queue[i]);
++			stmmac_msi_intr_rx(0, &priv->dma_conf.rx_queue[i]);
+ 
+ 		for (i = 0; i < priv->plat->tx_queues_to_use; i++)
+-			stmmac_msi_intr_tx(0, &priv->tx_queue[i]);
++			stmmac_msi_intr_tx(0, &priv->dma_conf.tx_queue[i]);
+ 	} else {
+ 		disable_irq(dev->irq);
+ 		stmmac_interrupt(dev->irq, dev);
+@@ -6030,34 +6034,34 @@ static int stmmac_rings_status_show(stru
+ 		return 0;
+ 
+ 	for (queue = 0; queue < rx_count; queue++) {
+-		struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
++		struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ 
+ 		seq_printf(seq, "RX Queue %d:\n", queue);
+ 
+ 		if (priv->extend_desc) {
+ 			seq_printf(seq, "Extended descriptor ring:\n");
+ 			sysfs_display_ring((void *)rx_q->dma_erx,
+-					   priv->dma_rx_size, 1, seq, rx_q->dma_rx_phy);
++					   priv->dma_conf.dma_rx_size, 1, seq, rx_q->dma_rx_phy);
+ 		} else {
+ 			seq_printf(seq, "Descriptor ring:\n");
+ 			sysfs_display_ring((void *)rx_q->dma_rx,
+-					   priv->dma_rx_size, 0, seq, rx_q->dma_rx_phy);
++					   priv->dma_conf.dma_rx_size, 0, seq, rx_q->dma_rx_phy);
+ 		}
+ 	}
+ 
+ 	for (queue = 0; queue < tx_count; queue++) {
+-		struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
++		struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
+ 
+ 		seq_printf(seq, "TX Queue %d:\n", queue);
+ 
+ 		if (priv->extend_desc) {
+ 			seq_printf(seq, "Extended descriptor ring:\n");
+ 			sysfs_display_ring((void *)tx_q->dma_etx,
+-					   priv->dma_tx_size, 1, seq, tx_q->dma_tx_phy);
++					   priv->dma_conf.dma_tx_size, 1, seq, tx_q->dma_tx_phy);
+ 		} else if (!(tx_q->tbs & STMMAC_TBS_AVAIL)) {
+ 			seq_printf(seq, "Descriptor ring:\n");
+ 			sysfs_display_ring((void *)tx_q->dma_tx,
+-					   priv->dma_tx_size, 0, seq, tx_q->dma_tx_phy);
++					   priv->dma_conf.dma_tx_size, 0, seq, tx_q->dma_tx_phy);
+ 		}
+ 	}
+ 
+@@ -6404,7 +6408,7 @@ void stmmac_disable_rx_queue(struct stmm
+ 
+ void stmmac_enable_rx_queue(struct stmmac_priv *priv, u32 queue)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ 	struct stmmac_channel *ch = &priv->channel[queue];
+ 	unsigned long flags;
+ 	u32 buf_size;
+@@ -6441,7 +6445,7 @@ void stmmac_enable_rx_queue(struct stmma
+ 				      rx_q->queue_index);
+ 	} else {
+ 		stmmac_set_dma_bfsize(priv, priv->ioaddr,
+-				      priv->dma_buf_sz,
++				      priv->dma_conf.dma_buf_sz,
+ 				      rx_q->queue_index);
+ 	}
+ 
+@@ -6467,7 +6471,7 @@ void stmmac_disable_tx_queue(struct stmm
+ 
+ void stmmac_enable_tx_queue(struct stmmac_priv *priv, u32 queue)
+ {
+-	struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
++	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
+ 	struct stmmac_channel *ch = &priv->channel[queue];
+ 	unsigned long flags;
+ 	int ret;
+@@ -6517,7 +6521,7 @@ void stmmac_xdp_release(struct net_devic
+ 	stmmac_disable_all_queues(priv);
+ 
+ 	for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
+-		hrtimer_cancel(&priv->tx_queue[chan].txtimer);
++		hrtimer_cancel(&priv->dma_conf.tx_queue[chan].txtimer);
+ 
+ 	/* Free the IRQ lines */
+ 	stmmac_free_irq(dev, REQ_IRQ_ERR_ALL, 0);
+@@ -6576,7 +6580,7 @@ int stmmac_xdp_open(struct net_device *d
+ 
+ 	/* DMA RX Channel Configuration */
+ 	for (chan = 0; chan < rx_cnt; chan++) {
+-		rx_q = &priv->rx_queue[chan];
++		rx_q = &priv->dma_conf.rx_queue[chan];
+ 
+ 		stmmac_init_rx_chan(priv, priv->ioaddr, priv->plat->dma_cfg,
+ 				    rx_q->dma_rx_phy, chan);
+@@ -6594,7 +6598,7 @@ int stmmac_xdp_open(struct net_device *d
+ 					      rx_q->queue_index);
+ 		} else {
+ 			stmmac_set_dma_bfsize(priv, priv->ioaddr,
+-					      priv->dma_buf_sz,
++					      priv->dma_conf.dma_buf_sz,
+ 					      rx_q->queue_index);
+ 		}
+ 
+@@ -6603,7 +6607,7 @@ int stmmac_xdp_open(struct net_device *d
+ 
+ 	/* DMA TX Channel Configuration */
+ 	for (chan = 0; chan < tx_cnt; chan++) {
+-		tx_q = &priv->tx_queue[chan];
++		tx_q = &priv->dma_conf.tx_queue[chan];
+ 
+ 		stmmac_init_tx_chan(priv, priv->ioaddr, priv->plat->dma_cfg,
+ 				    tx_q->dma_tx_phy, chan);
+@@ -6636,7 +6640,7 @@ int stmmac_xdp_open(struct net_device *d
+ 
+ irq_error:
+ 	for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
+-		hrtimer_cancel(&priv->tx_queue[chan].txtimer);
++		hrtimer_cancel(&priv->dma_conf.tx_queue[chan].txtimer);
+ 
+ 	stmmac_hw_teardown(dev);
+ init_error:
+@@ -6663,8 +6667,8 @@ int stmmac_xsk_wakeup(struct net_device
+ 	    queue >= priv->plat->tx_queues_to_use)
+ 		return -EINVAL;
+ 
+-	rx_q = &priv->rx_queue[queue];
+-	tx_q = &priv->tx_queue[queue];
++	rx_q = &priv->dma_conf.rx_queue[queue];
++	tx_q = &priv->dma_conf.tx_queue[queue];
+ 	ch = &priv->channel[queue];
+ 
+ 	if (!rx_q->xsk_pool && !tx_q->xsk_pool)
+@@ -6924,8 +6928,8 @@ int stmmac_reinit_ringparam(struct net_d
+ 	if (netif_running(dev))
+ 		stmmac_release(dev);
+ 
+-	priv->dma_rx_size = rx_size;
+-	priv->dma_tx_size = tx_size;
++	priv->dma_conf.dma_rx_size = rx_size;
++	priv->dma_conf.dma_tx_size = tx_size;
+ 
+ 	if (netif_running(dev))
+ 		ret = stmmac_open(dev);
+@@ -7363,7 +7367,7 @@ int stmmac_suspend(struct device *dev)
+ 	stmmac_disable_all_queues(priv);
+ 
+ 	for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
+-		hrtimer_cancel(&priv->tx_queue[chan].txtimer);
++		hrtimer_cancel(&priv->dma_conf.tx_queue[chan].txtimer);
+ 
+ 	if (priv->eee_enabled) {
+ 		priv->tx_path_in_lpi_mode = false;
+@@ -7414,7 +7418,7 @@ EXPORT_SYMBOL_GPL(stmmac_suspend);
+ 
+ static void stmmac_reset_rx_queue(struct stmmac_priv *priv, u32 queue)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ 
+ 	rx_q->cur_rx = 0;
+ 	rx_q->dirty_rx = 0;
+@@ -7422,7 +7426,7 @@ static void stmmac_reset_rx_queue(struct
+ 
+ static void stmmac_reset_tx_queue(struct stmmac_priv *priv, u32 queue)
+ {
+-	struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
++	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
+ 
+ 	tx_q->cur_tx = 0;
+ 	tx_q->dirty_tx = 0;
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c
+@@ -795,8 +795,8 @@ static int stmmac_test_flowctrl(struct s
+ 		struct stmmac_channel *ch = &priv->channel[i];
+ 		u32 tail;
+ 
+-		tail = priv->rx_queue[i].dma_rx_phy +
+-			(priv->dma_rx_size * sizeof(struct dma_desc));
++		tail = priv->dma_conf.rx_queue[i].dma_rx_phy +
++			(priv->dma_conf.dma_rx_size * sizeof(struct dma_desc));
+ 
+ 		stmmac_set_rx_tail_ptr(priv, priv->ioaddr, tail, i);
+ 		stmmac_start_rx(priv, priv->ioaddr, i);
+@@ -1684,7 +1684,7 @@ cleanup:
+ static int __stmmac_test_jumbo(struct stmmac_priv *priv, u16 queue)
+ {
+ 	struct stmmac_packet_attrs attr = { };
+-	int size = priv->dma_buf_sz;
++	int size = priv->dma_conf.dma_buf_sz;
+ 
+ 	attr.dst = priv->dev->dev_addr;
+ 	attr.max_size = size - ETH_FCS_LEN;
+@@ -1767,7 +1767,7 @@ static int stmmac_test_tbs(struct stmmac
+ 
+ 	/* Find first TBS enabled Queue, if any */
+ 	for (i = 0; i < priv->plat->tx_queues_to_use; i++)
+-		if (priv->tx_queue[i].tbs & STMMAC_TBS_AVAIL)
++		if (priv->dma_conf.tx_queue[i].tbs & STMMAC_TBS_AVAIL)
+ 			break;
+ 
+ 	if (i >= priv->plat->tx_queues_to_use)
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+@@ -970,13 +970,13 @@ static int tc_setup_etf(struct stmmac_pr
+ 		return -EOPNOTSUPP;
+ 	if (qopt->queue >= priv->plat->tx_queues_to_use)
+ 		return -EINVAL;
+-	if (!(priv->tx_queue[qopt->queue].tbs & STMMAC_TBS_AVAIL))
++	if (!(priv->dma_conf.tx_queue[qopt->queue].tbs & STMMAC_TBS_AVAIL))
+ 		return -EINVAL;
+ 
+ 	if (qopt->enable)
+-		priv->tx_queue[qopt->queue].tbs |= STMMAC_TBS_EN;
++		priv->dma_conf.tx_queue[qopt->queue].tbs |= STMMAC_TBS_EN;
+ 	else
+-		priv->tx_queue[qopt->queue].tbs &= ~STMMAC_TBS_EN;
++		priv->dma_conf.tx_queue[qopt->queue].tbs &= ~STMMAC_TBS_EN;
+ 
+ 	netdev_info(priv->dev, "%s ETF for Queue %d\n",
+ 		    qopt->enable ? "enabled" : "disabled", qopt->queue);
diff --git a/target/linux/generic/backport-5.15/775-v6.0-04-net-ethernet-stmicro-stmmac-generate-stmmac-dma-conf.patch b/target/linux/generic/backport-5.15/775-v6.0-04-net-ethernet-stmicro-stmmac-generate-stmmac-dma-conf.patch
new file mode 100644
index 00000000000000..e84373b47180b9
--- /dev/null
+++ b/target/linux/generic/backport-5.15/775-v6.0-04-net-ethernet-stmicro-stmmac-generate-stmmac-dma-conf.patch
@@ -0,0 +1,1161 @@
+From ba39b344e9240a4a5fd4ab8178200b85cd1809da Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Sat, 23 Jul 2022 16:29:32 +0200
+Subject: [PATCH 4/5] net: ethernet: stmicro: stmmac: generate stmmac dma conf
+ before open
+
+Rework the driver to generate the stmmac dma_conf before stmmac_open.
+This permits a function to first check if it's possible to allocate a
+new dma_config and then pass it directly to __stmmac_open and "open" the
+interface with the new configuration.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ .../net/ethernet/stmicro/stmmac/stmmac_main.c | 462 +++++++++++-------
+ 1 file changed, 289 insertions(+), 173 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -1300,7 +1300,8 @@ static int stmmac_phy_setup(struct stmma
+ 	return 0;
+ }
+ 
+-static void stmmac_display_rx_rings(struct stmmac_priv *priv)
++static void stmmac_display_rx_rings(struct stmmac_priv *priv,
++				    struct stmmac_dma_conf *dma_conf)
+ {
+ 	u32 rx_cnt = priv->plat->rx_queues_to_use;
+ 	unsigned int desc_size;
+@@ -1309,7 +1310,7 @@ static void stmmac_display_rx_rings(stru
+ 
+ 	/* Display RX rings */
+ 	for (queue = 0; queue < rx_cnt; queue++) {
+-		struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
++		struct stmmac_rx_queue *rx_q = &dma_conf->rx_queue[queue];
+ 
+ 		pr_info("\tRX Queue %u rings\n", queue);
+ 
+@@ -1322,12 +1323,13 @@ static void stmmac_display_rx_rings(stru
+ 		}
+ 
+ 		/* Display RX ring */
+-		stmmac_display_ring(priv, head_rx, priv->dma_conf.dma_rx_size, true,
++		stmmac_display_ring(priv, head_rx, dma_conf->dma_rx_size, true,
+ 				    rx_q->dma_rx_phy, desc_size);
+ 	}
+ }
+ 
+-static void stmmac_display_tx_rings(struct stmmac_priv *priv)
++static void stmmac_display_tx_rings(struct stmmac_priv *priv,
++				    struct stmmac_dma_conf *dma_conf)
+ {
+ 	u32 tx_cnt = priv->plat->tx_queues_to_use;
+ 	unsigned int desc_size;
+@@ -1336,7 +1338,7 @@ static void stmmac_display_tx_rings(stru
+ 
+ 	/* Display TX rings */
+ 	for (queue = 0; queue < tx_cnt; queue++) {
+-		struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
++		struct stmmac_tx_queue *tx_q = &dma_conf->tx_queue[queue];
+ 
+ 		pr_info("\tTX Queue %d rings\n", queue);
+ 
+@@ -1351,18 +1353,19 @@ static void stmmac_display_tx_rings(stru
+ 			desc_size = sizeof(struct dma_desc);
+ 		}
+ 
+-		stmmac_display_ring(priv, head_tx, priv->dma_conf.dma_tx_size, false,
++		stmmac_display_ring(priv, head_tx, dma_conf->dma_tx_size, false,
+ 				    tx_q->dma_tx_phy, desc_size);
+ 	}
+ }
+ 
+-static void stmmac_display_rings(struct stmmac_priv *priv)
++static void stmmac_display_rings(struct stmmac_priv *priv,
++				 struct stmmac_dma_conf *dma_conf)
+ {
+ 	/* Display RX ring */
+-	stmmac_display_rx_rings(priv);
++	stmmac_display_rx_rings(priv, dma_conf);
+ 
+ 	/* Display TX ring */
+-	stmmac_display_tx_rings(priv);
++	stmmac_display_tx_rings(priv, dma_conf);
+ }
+ 
+ static int stmmac_set_bfsize(int mtu, int bufsize)
+@@ -1386,44 +1389,50 @@ static int stmmac_set_bfsize(int mtu, in
+ /**
+  * stmmac_clear_rx_descriptors - clear RX descriptors
+  * @priv: driver private structure
++ * @dma_conf: structure to take the dma data
+  * @queue: RX queue index
+  * Description: this function is called to clear the RX descriptors
+  * in case of both basic and extended descriptors are used.
+  */
+-static void stmmac_clear_rx_descriptors(struct stmmac_priv *priv, u32 queue)
++static void stmmac_clear_rx_descriptors(struct stmmac_priv *priv,
++					struct stmmac_dma_conf *dma_conf,
++					u32 queue)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &dma_conf->rx_queue[queue];
+ 	int i;
+ 
+ 	/* Clear the RX descriptors */
+-	for (i = 0; i < priv->dma_conf.dma_rx_size; i++)
++	for (i = 0; i < dma_conf->dma_rx_size; i++)
+ 		if (priv->extend_desc)
+ 			stmmac_init_rx_desc(priv, &rx_q->dma_erx[i].basic,
+ 					priv->use_riwt, priv->mode,
+-					(i == priv->dma_conf.dma_rx_size - 1),
+-					priv->dma_conf.dma_buf_sz);
++					(i == dma_conf->dma_rx_size - 1),
++					dma_conf->dma_buf_sz);
+ 		else
+ 			stmmac_init_rx_desc(priv, &rx_q->dma_rx[i],
+ 					priv->use_riwt, priv->mode,
+-					(i == priv->dma_conf.dma_rx_size - 1),
+-					priv->dma_conf.dma_buf_sz);
++					(i == dma_conf->dma_rx_size - 1),
++					dma_conf->dma_buf_sz);
+ }
+ 
+ /**
+  * stmmac_clear_tx_descriptors - clear tx descriptors
+  * @priv: driver private structure
++ * @dma_conf: structure to take the dma data
+  * @queue: TX queue index.
+  * Description: this function is called to clear the TX descriptors
+  * in case of both basic and extended descriptors are used.
+  */
+-static void stmmac_clear_tx_descriptors(struct stmmac_priv *priv, u32 queue)
++static void stmmac_clear_tx_descriptors(struct stmmac_priv *priv,
++					struct stmmac_dma_conf *dma_conf,
++					u32 queue)
+ {
+-	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
++	struct stmmac_tx_queue *tx_q = &dma_conf->tx_queue[queue];
+ 	int i;
+ 
+ 	/* Clear the TX descriptors */
+-	for (i = 0; i < priv->dma_conf.dma_tx_size; i++) {
+-		int last = (i == (priv->dma_conf.dma_tx_size - 1));
++	for (i = 0; i < dma_conf->dma_tx_size; i++) {
++		int last = (i == (dma_conf->dma_tx_size - 1));
+ 		struct dma_desc *p;
+ 
+ 		if (priv->extend_desc)
+@@ -1440,10 +1449,12 @@ static void stmmac_clear_tx_descriptors(
+ /**
+  * stmmac_clear_descriptors - clear descriptors
+  * @priv: driver private structure
++ * @dma_conf: structure to take the dma data
+  * Description: this function is called to clear the TX and RX descriptors
+  * in case of both basic and extended descriptors are used.
+  */
+-static void stmmac_clear_descriptors(struct stmmac_priv *priv)
++static void stmmac_clear_descriptors(struct stmmac_priv *priv,
++				     struct stmmac_dma_conf *dma_conf)
+ {
+ 	u32 rx_queue_cnt = priv->plat->rx_queues_to_use;
+ 	u32 tx_queue_cnt = priv->plat->tx_queues_to_use;
+@@ -1451,16 +1462,17 @@ static void stmmac_clear_descriptors(str
+ 
+ 	/* Clear the RX descriptors */
+ 	for (queue = 0; queue < rx_queue_cnt; queue++)
+-		stmmac_clear_rx_descriptors(priv, queue);
++		stmmac_clear_rx_descriptors(priv, dma_conf, queue);
+ 
+ 	/* Clear the TX descriptors */
+ 	for (queue = 0; queue < tx_queue_cnt; queue++)
+-		stmmac_clear_tx_descriptors(priv, queue);
++		stmmac_clear_tx_descriptors(priv, dma_conf, queue);
+ }
+ 
+ /**
+  * stmmac_init_rx_buffers - init the RX descriptor buffer.
+  * @priv: driver private structure
++ * @dma_conf: structure to take the dma data
+  * @p: descriptor pointer
+  * @i: descriptor index
+  * @flags: gfp flag
+@@ -1468,10 +1480,12 @@ static void stmmac_clear_descriptors(str
+  * Description: this function is called to allocate a receive buffer, perform
+  * the DMA mapping and init the descriptor.
+  */
+-static int stmmac_init_rx_buffers(struct stmmac_priv *priv, struct dma_desc *p,
++static int stmmac_init_rx_buffers(struct stmmac_priv *priv,
++				  struct stmmac_dma_conf *dma_conf,
++				  struct dma_desc *p,
+ 				  int i, gfp_t flags, u32 queue)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &dma_conf->rx_queue[queue];
+ 	struct stmmac_rx_buffer *buf = &rx_q->buf_pool[i];
+ 
+ 	if (!buf->page) {
+@@ -1496,7 +1510,7 @@ static int stmmac_init_rx_buffers(struct
+ 	buf->addr = page_pool_get_dma_addr(buf->page) + buf->page_offset;
+ 
+ 	stmmac_set_desc_addr(priv, p, buf->addr);
+-	if (priv->dma_conf.dma_buf_sz == BUF_SIZE_16KiB)
++	if (dma_conf->dma_buf_sz == BUF_SIZE_16KiB)
+ 		stmmac_init_desc3(priv, p);
+ 
+ 	return 0;
+@@ -1505,12 +1519,13 @@ static int stmmac_init_rx_buffers(struct
+ /**
+  * stmmac_free_rx_buffer - free RX dma buffers
+  * @priv: private structure
+- * @queue: RX queue index
++ * @rx_q: RX queue
+  * @i: buffer index.
+  */
+-static void stmmac_free_rx_buffer(struct stmmac_priv *priv, u32 queue, int i)
++static void stmmac_free_rx_buffer(struct stmmac_priv *priv,
++				  struct stmmac_rx_queue *rx_q,
++				  int i)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ 	struct stmmac_rx_buffer *buf = &rx_q->buf_pool[i];
+ 
+ 	if (buf->page)
+@@ -1525,12 +1540,15 @@ static void stmmac_free_rx_buffer(struct
+ /**
+  * stmmac_free_tx_buffer - free RX dma buffers
+  * @priv: private structure
++ * @dma_conf: structure to take the dma data
+  * @queue: RX queue index
+  * @i: buffer index.
+  */
+-static void stmmac_free_tx_buffer(struct stmmac_priv *priv, u32 queue, int i)
++static void stmmac_free_tx_buffer(struct stmmac_priv *priv,
++				  struct stmmac_dma_conf *dma_conf,
++				  u32 queue, int i)
+ {
+-	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
++	struct stmmac_tx_queue *tx_q = &dma_conf->tx_queue[queue];
+ 
+ 	if (tx_q->tx_skbuff_dma[i].buf &&
+ 	    tx_q->tx_skbuff_dma[i].buf_type != STMMAC_TXBUF_T_XDP_TX) {
+@@ -1569,23 +1587,28 @@ static void stmmac_free_tx_buffer(struct
+ /**
+  * dma_free_rx_skbufs - free RX dma buffers
+  * @priv: private structure
++ * @dma_conf: structure to take the dma data
+  * @queue: RX queue index
+  */
+-static void dma_free_rx_skbufs(struct stmmac_priv *priv, u32 queue)
++static void dma_free_rx_skbufs(struct stmmac_priv *priv,
++			       struct stmmac_dma_conf *dma_conf,
++			       u32 queue)
+ {
++	struct stmmac_rx_queue *rx_q = &dma_conf->rx_queue[queue];
+ 	int i;
+ 
+-	for (i = 0; i < priv->dma_conf.dma_rx_size; i++)
+-		stmmac_free_rx_buffer(priv, queue, i);
++	for (i = 0; i < dma_conf->dma_rx_size; i++)
++		stmmac_free_rx_buffer(priv, rx_q, i);
+ }
+ 
+-static int stmmac_alloc_rx_buffers(struct stmmac_priv *priv, u32 queue,
+-				   gfp_t flags)
++static int stmmac_alloc_rx_buffers(struct stmmac_priv *priv,
++				   struct stmmac_dma_conf *dma_conf,
++				   u32 queue, gfp_t flags)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &dma_conf->rx_queue[queue];
+ 	int i;
+ 
+-	for (i = 0; i < priv->dma_conf.dma_rx_size; i++) {
++	for (i = 0; i < dma_conf->dma_rx_size; i++) {
+ 		struct dma_desc *p;
+ 		int ret;
+ 
+@@ -1594,7 +1617,7 @@ static int stmmac_alloc_rx_buffers(struc
+ 		else
+ 			p = rx_q->dma_rx + i;
+ 
+-		ret = stmmac_init_rx_buffers(priv, p, i, flags,
++		ret = stmmac_init_rx_buffers(priv, dma_conf, p, i, flags,
+ 					     queue);
+ 		if (ret)
+ 			return ret;
+@@ -1608,14 +1631,17 @@ static int stmmac_alloc_rx_buffers(struc
+ /**
+  * dma_free_rx_xskbufs - free RX dma buffers from XSK pool
+  * @priv: private structure
++ * @dma_conf: structure to take the dma data
+  * @queue: RX queue index
+  */
+-static void dma_free_rx_xskbufs(struct stmmac_priv *priv, u32 queue)
++static void dma_free_rx_xskbufs(struct stmmac_priv *priv,
++				struct stmmac_dma_conf *dma_conf,
++				u32 queue)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &dma_conf->rx_queue[queue];
+ 	int i;
+ 
+-	for (i = 0; i < priv->dma_conf.dma_rx_size; i++) {
++	for (i = 0; i < dma_conf->dma_rx_size; i++) {
+ 		struct stmmac_rx_buffer *buf = &rx_q->buf_pool[i];
+ 
+ 		if (!buf->xdp)
+@@ -1626,12 +1652,14 @@ static void dma_free_rx_xskbufs(struct s
+ 	}
+ }
+ 
+-static int stmmac_alloc_rx_buffers_zc(struct stmmac_priv *priv, u32 queue)
++static int stmmac_alloc_rx_buffers_zc(struct stmmac_priv *priv,
++				      struct stmmac_dma_conf *dma_conf,
++				      u32 queue)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &dma_conf->rx_queue[queue];
+ 	int i;
+ 
+-	for (i = 0; i < priv->dma_conf.dma_rx_size; i++) {
++	for (i = 0; i < dma_conf->dma_rx_size; i++) {
+ 		struct stmmac_rx_buffer *buf;
+ 		dma_addr_t dma_addr;
+ 		struct dma_desc *p;
+@@ -1666,22 +1694,25 @@ static struct xsk_buff_pool *stmmac_get_
+ /**
+  * __init_dma_rx_desc_rings - init the RX descriptor ring (per queue)
+  * @priv: driver private structure
++ * @dma_conf: structure to take the dma data
+  * @queue: RX queue index
+  * @flags: gfp flag.
+  * Description: this function initializes the DMA RX descriptors
+  * and allocates the socket buffers. It supports the chained and ring
+  * modes.
+  */
+-static int __init_dma_rx_desc_rings(struct stmmac_priv *priv, u32 queue, gfp_t flags)
++static int __init_dma_rx_desc_rings(struct stmmac_priv *priv,
++				    struct stmmac_dma_conf *dma_conf,
++				    u32 queue, gfp_t flags)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &dma_conf->rx_queue[queue];
+ 	int ret;
+ 
+ 	netif_dbg(priv, probe, priv->dev,
+ 		  "(%s) dma_rx_phy=0x%08x\n", __func__,
+ 		  (u32)rx_q->dma_rx_phy);
+ 
+-	stmmac_clear_rx_descriptors(priv, queue);
++	stmmac_clear_rx_descriptors(priv, dma_conf, queue);
+ 
+ 	xdp_rxq_info_unreg_mem_model(&rx_q->xdp_rxq);
+ 
+@@ -1708,9 +1739,9 @@ static int __init_dma_rx_desc_rings(stru
+ 		/* RX XDP ZC buffer pool may not be populated, e.g.
+ 		 * xdpsock TX-only.
+ 		 */
+-		stmmac_alloc_rx_buffers_zc(priv, queue);
++		stmmac_alloc_rx_buffers_zc(priv, dma_conf, queue);
+ 	} else {
+-		ret = stmmac_alloc_rx_buffers(priv, queue, flags);
++		ret = stmmac_alloc_rx_buffers(priv, dma_conf, queue, flags);
+ 		if (ret < 0)
+ 			return -ENOMEM;
+ 	}
+@@ -1720,17 +1751,19 @@ static int __init_dma_rx_desc_rings(stru
+ 		if (priv->extend_desc)
+ 			stmmac_mode_init(priv, rx_q->dma_erx,
+ 					 rx_q->dma_rx_phy,
+-					 priv->dma_conf.dma_rx_size, 1);
++					 dma_conf->dma_rx_size, 1);
+ 		else
+ 			stmmac_mode_init(priv, rx_q->dma_rx,
+ 					 rx_q->dma_rx_phy,
+-					 priv->dma_conf.dma_rx_size, 0);
++					 dma_conf->dma_rx_size, 0);
+ 	}
+ 
+ 	return 0;
+ }
+ 
+-static int init_dma_rx_desc_rings(struct net_device *dev, gfp_t flags)
++static int init_dma_rx_desc_rings(struct net_device *dev,
++				  struct stmmac_dma_conf *dma_conf,
++				  gfp_t flags)
+ {
+ 	struct stmmac_priv *priv = netdev_priv(dev);
+ 	u32 rx_count = priv->plat->rx_queues_to_use;
+@@ -1742,7 +1775,7 @@ static int init_dma_rx_desc_rings(struct
+ 		  "SKB addresses:\nskb\t\tskb data\tdma data\n");
+ 
+ 	for (queue = 0; queue < rx_count; queue++) {
+-		ret = __init_dma_rx_desc_rings(priv, queue, flags);
++		ret = __init_dma_rx_desc_rings(priv, dma_conf, queue, flags);
+ 		if (ret)
+ 			goto err_init_rx_buffers;
+ 	}
+@@ -1751,12 +1784,12 @@ static int init_dma_rx_desc_rings(struct
+ 
+ err_init_rx_buffers:
+ 	while (queue >= 0) {
+-		struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
++		struct stmmac_rx_queue *rx_q = &dma_conf->rx_queue[queue];
+ 
+ 		if (rx_q->xsk_pool)
+-			dma_free_rx_xskbufs(priv, queue);
++			dma_free_rx_xskbufs(priv, dma_conf, queue);
+ 		else
+-			dma_free_rx_skbufs(priv, queue);
++			dma_free_rx_skbufs(priv, dma_conf, queue);
+ 
+ 		rx_q->buf_alloc_num = 0;
+ 		rx_q->xsk_pool = NULL;
+@@ -1773,14 +1806,17 @@ err_init_rx_buffers:
+ /**
+  * __init_dma_tx_desc_rings - init the TX descriptor ring (per queue)
+  * @priv: driver private structure
+- * @queue : TX queue index
++ * @dma_conf: structure to take the dma data
++ * @queue: TX queue index
+  * Description: this function initializes the DMA TX descriptors
+  * and allocates the socket buffers. It supports the chained and ring
+  * modes.
+  */
+-static int __init_dma_tx_desc_rings(struct stmmac_priv *priv, u32 queue)
++static int __init_dma_tx_desc_rings(struct stmmac_priv *priv,
++				    struct stmmac_dma_conf *dma_conf,
++				    u32 queue)
+ {
+-	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
++	struct stmmac_tx_queue *tx_q = &dma_conf->tx_queue[queue];
+ 	int i;
+ 
+ 	netif_dbg(priv, probe, priv->dev,
+@@ -1792,16 +1828,16 @@ static int __init_dma_tx_desc_rings(stru
+ 		if (priv->extend_desc)
+ 			stmmac_mode_init(priv, tx_q->dma_etx,
+ 					 tx_q->dma_tx_phy,
+-					 priv->dma_conf.dma_tx_size, 1);
++					 dma_conf->dma_tx_size, 1);
+ 		else if (!(tx_q->tbs & STMMAC_TBS_AVAIL))
+ 			stmmac_mode_init(priv, tx_q->dma_tx,
+ 					 tx_q->dma_tx_phy,
+-					 priv->dma_conf.dma_tx_size, 0);
++					 dma_conf->dma_tx_size, 0);
+ 	}
+ 
+ 	tx_q->xsk_pool = stmmac_get_xsk_pool(priv, queue);
+ 
+-	for (i = 0; i < priv->dma_conf.dma_tx_size; i++) {
++	for (i = 0; i < dma_conf->dma_tx_size; i++) {
+ 		struct dma_desc *p;
+ 
+ 		if (priv->extend_desc)
+@@ -1823,7 +1859,8 @@ static int __init_dma_tx_desc_rings(stru
+ 	return 0;
+ }
+ 
+-static int init_dma_tx_desc_rings(struct net_device *dev)
++static int init_dma_tx_desc_rings(struct net_device *dev,
++				  struct stmmac_dma_conf *dma_conf)
+ {
+ 	struct stmmac_priv *priv = netdev_priv(dev);
+ 	u32 tx_queue_cnt;
+@@ -1832,7 +1869,7 @@ static int init_dma_tx_desc_rings(struct
+ 	tx_queue_cnt = priv->plat->tx_queues_to_use;
+ 
+ 	for (queue = 0; queue < tx_queue_cnt; queue++)
+-		__init_dma_tx_desc_rings(priv, queue);
++		__init_dma_tx_desc_rings(priv, dma_conf, queue);
+ 
+ 	return 0;
+ }
+@@ -1840,26 +1877,29 @@ static int init_dma_tx_desc_rings(struct
+ /**
+  * init_dma_desc_rings - init the RX/TX descriptor rings
+  * @dev: net device structure
++ * @dma_conf: structure to take the dma data
+  * @flags: gfp flag.
+  * Description: this function initializes the DMA RX/TX descriptors
+  * and allocates the socket buffers. It supports the chained and ring
+  * modes.
+  */
+-static int init_dma_desc_rings(struct net_device *dev, gfp_t flags)
++static int init_dma_desc_rings(struct net_device *dev,
++			       struct stmmac_dma_conf *dma_conf,
++			       gfp_t flags)
+ {
+ 	struct stmmac_priv *priv = netdev_priv(dev);
+ 	int ret;
+ 
+-	ret = init_dma_rx_desc_rings(dev, flags);
++	ret = init_dma_rx_desc_rings(dev, dma_conf, flags);
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = init_dma_tx_desc_rings(dev);
++	ret = init_dma_tx_desc_rings(dev, dma_conf);
+ 
+-	stmmac_clear_descriptors(priv);
++	stmmac_clear_descriptors(priv, dma_conf);
+ 
+ 	if (netif_msg_hw(priv))
+-		stmmac_display_rings(priv);
++		stmmac_display_rings(priv, dma_conf);
+ 
+ 	return ret;
+ }
+@@ -1867,17 +1907,20 @@ static int init_dma_desc_rings(struct ne
+ /**
+  * dma_free_tx_skbufs - free TX dma buffers
+  * @priv: private structure
++ * @dma_conf: structure to take the dma data
+  * @queue: TX queue index
+  */
+-static void dma_free_tx_skbufs(struct stmmac_priv *priv, u32 queue)
++static void dma_free_tx_skbufs(struct stmmac_priv *priv,
++			       struct stmmac_dma_conf *dma_conf,
++			       u32 queue)
+ {
+-	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
++	struct stmmac_tx_queue *tx_q = &dma_conf->tx_queue[queue];
+ 	int i;
+ 
+ 	tx_q->xsk_frames_done = 0;
+ 
+-	for (i = 0; i < priv->dma_conf.dma_tx_size; i++)
+-		stmmac_free_tx_buffer(priv, queue, i);
++	for (i = 0; i < dma_conf->dma_tx_size; i++)
++		stmmac_free_tx_buffer(priv, dma_conf, queue, i);
+ 
+ 	if (tx_q->xsk_pool && tx_q->xsk_frames_done) {
+ 		xsk_tx_completed(tx_q->xsk_pool, tx_q->xsk_frames_done);
+@@ -1896,34 +1939,37 @@ static void stmmac_free_tx_skbufs(struct
+ 	u32 queue;
+ 
+ 	for (queue = 0; queue < tx_queue_cnt; queue++)
+-		dma_free_tx_skbufs(priv, queue);
++		dma_free_tx_skbufs(priv, &priv->dma_conf, queue);
+ }
+ 
+ /**
+  * __free_dma_rx_desc_resources - free RX dma desc resources (per queue)
+  * @priv: private structure
++ * @dma_conf: structure to take the dma data
+  * @queue: RX queue index
+  */
+-static void __free_dma_rx_desc_resources(struct stmmac_priv *priv, u32 queue)
++static void __free_dma_rx_desc_resources(struct stmmac_priv *priv,
++					 struct stmmac_dma_conf *dma_conf,
++					 u32 queue)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &dma_conf->rx_queue[queue];
+ 
+ 	/* Release the DMA RX socket buffers */
+ 	if (rx_q->xsk_pool)
+-		dma_free_rx_xskbufs(priv, queue);
++		dma_free_rx_xskbufs(priv, dma_conf, queue);
+ 	else
+-		dma_free_rx_skbufs(priv, queue);
++		dma_free_rx_skbufs(priv, dma_conf, queue);
+ 
+ 	rx_q->buf_alloc_num = 0;
+ 	rx_q->xsk_pool = NULL;
+ 
+ 	/* Free DMA regions of consistent memory previously allocated */
+ 	if (!priv->extend_desc)
+-		dma_free_coherent(priv->device, priv->dma_conf.dma_rx_size *
++		dma_free_coherent(priv->device, dma_conf->dma_rx_size *
+ 				  sizeof(struct dma_desc),
+ 				  rx_q->dma_rx, rx_q->dma_rx_phy);
+ 	else
+-		dma_free_coherent(priv->device, priv->dma_conf.dma_rx_size *
++		dma_free_coherent(priv->device, dma_conf->dma_rx_size *
+ 				  sizeof(struct dma_extended_desc),
+ 				  rx_q->dma_erx, rx_q->dma_rx_phy);
+ 
+@@ -1935,29 +1981,33 @@ static void __free_dma_rx_desc_resources
+ 		page_pool_destroy(rx_q->page_pool);
+ }
+ 
+-static void free_dma_rx_desc_resources(struct stmmac_priv *priv)
++static void free_dma_rx_desc_resources(struct stmmac_priv *priv,
++				       struct stmmac_dma_conf *dma_conf)
+ {
+ 	u32 rx_count = priv->plat->rx_queues_to_use;
+ 	u32 queue;
+ 
+ 	/* Free RX queue resources */
+ 	for (queue = 0; queue < rx_count; queue++)
+-		__free_dma_rx_desc_resources(priv, queue);
++		__free_dma_rx_desc_resources(priv, dma_conf, queue);
+ }
+ 
+ /**
+  * __free_dma_tx_desc_resources - free TX dma desc resources (per queue)
+  * @priv: private structure
++ * @dma_conf: structure to take the dma data
+  * @queue: TX queue index
+  */
+-static void __free_dma_tx_desc_resources(struct stmmac_priv *priv, u32 queue)
++static void __free_dma_tx_desc_resources(struct stmmac_priv *priv,
++					 struct stmmac_dma_conf *dma_conf,
++					 u32 queue)
+ {
+-	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
++	struct stmmac_tx_queue *tx_q = &dma_conf->tx_queue[queue];
+ 	size_t size;
+ 	void *addr;
+ 
+ 	/* Release the DMA TX socket buffers */
+-	dma_free_tx_skbufs(priv, queue);
++	dma_free_tx_skbufs(priv, dma_conf, queue);
+ 
+ 	if (priv->extend_desc) {
+ 		size = sizeof(struct dma_extended_desc);
+@@ -1970,7 +2020,7 @@ static void __free_dma_tx_desc_resources
+ 		addr = tx_q->dma_tx;
+ 	}
+ 
+-	size *= priv->dma_conf.dma_tx_size;
++	size *= dma_conf->dma_tx_size;
+ 
+ 	dma_free_coherent(priv->device, size, addr, tx_q->dma_tx_phy);
+ 
+@@ -1978,28 +2028,32 @@ static void __free_dma_tx_desc_resources
+ 	kfree(tx_q->tx_skbuff);
+ }
+ 
+-static void free_dma_tx_desc_resources(struct stmmac_priv *priv)
++static void free_dma_tx_desc_resources(struct stmmac_priv *priv,
++				       struct stmmac_dma_conf *dma_conf)
+ {
+ 	u32 tx_count = priv->plat->tx_queues_to_use;
+ 	u32 queue;
+ 
+ 	/* Free TX queue resources */
+ 	for (queue = 0; queue < tx_count; queue++)
+-		__free_dma_tx_desc_resources(priv, queue);
++		__free_dma_tx_desc_resources(priv, dma_conf, queue);
+ }
+ 
+ /**
+  * __alloc_dma_rx_desc_resources - alloc RX resources (per queue).
+  * @priv: private structure
++ * @dma_conf: structure to take the dma data
+  * @queue: RX queue index
+  * Description: according to which descriptor can be used (extend or basic)
+  * this function allocates the resources for TX and RX paths. In case of
+  * reception, for example, it pre-allocated the RX socket buffer in order to
+  * allow zero-copy mechanism.
+  */
+-static int __alloc_dma_rx_desc_resources(struct stmmac_priv *priv, u32 queue)
++static int __alloc_dma_rx_desc_resources(struct stmmac_priv *priv,
++					 struct stmmac_dma_conf *dma_conf,
++					 u32 queue)
+ {
+-	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
++	struct stmmac_rx_queue *rx_q = &dma_conf->rx_queue[queue];
+ 	struct stmmac_channel *ch = &priv->channel[queue];
+ 	bool xdp_prog = stmmac_xdp_is_enabled(priv);
+ 	struct page_pool_params pp_params = { 0 };
+@@ -2011,8 +2065,8 @@ static int __alloc_dma_rx_desc_resources
+ 	rx_q->priv_data = priv;
+ 
+ 	pp_params.flags = PP_FLAG_DMA_MAP | PP_FLAG_DMA_SYNC_DEV;
+-	pp_params.pool_size = priv->dma_conf.dma_rx_size;
+-	num_pages = DIV_ROUND_UP(priv->dma_conf.dma_buf_sz, PAGE_SIZE);
++	pp_params.pool_size = dma_conf->dma_rx_size;
++	num_pages = DIV_ROUND_UP(dma_conf->dma_buf_sz, PAGE_SIZE);
+ 	pp_params.order = ilog2(num_pages);
+ 	pp_params.nid = dev_to_node(priv->device);
+ 	pp_params.dev = priv->device;
+@@ -2027,7 +2081,7 @@ static int __alloc_dma_rx_desc_resources
+ 		return ret;
+ 	}
+ 
+-	rx_q->buf_pool = kcalloc(priv->dma_conf.dma_rx_size,
++	rx_q->buf_pool = kcalloc(dma_conf->dma_rx_size,
+ 				 sizeof(*rx_q->buf_pool),
+ 				 GFP_KERNEL);
+ 	if (!rx_q->buf_pool)
+@@ -2035,7 +2089,7 @@ static int __alloc_dma_rx_desc_resources
+ 
+ 	if (priv->extend_desc) {
+ 		rx_q->dma_erx = dma_alloc_coherent(priv->device,
+-						   priv->dma_conf.dma_rx_size *
++						   dma_conf->dma_rx_size *
+ 						   sizeof(struct dma_extended_desc),
+ 						   &rx_q->dma_rx_phy,
+ 						   GFP_KERNEL);
+@@ -2044,7 +2098,7 @@ static int __alloc_dma_rx_desc_resources
+ 
+ 	} else {
+ 		rx_q->dma_rx = dma_alloc_coherent(priv->device,
+-						  priv->dma_conf.dma_rx_size *
++						  dma_conf->dma_rx_size *
+ 						  sizeof(struct dma_desc),
+ 						  &rx_q->dma_rx_phy,
+ 						  GFP_KERNEL);
+@@ -2069,7 +2123,8 @@ static int __alloc_dma_rx_desc_resources
+ 	return 0;
+ }
+ 
+-static int alloc_dma_rx_desc_resources(struct stmmac_priv *priv)
++static int alloc_dma_rx_desc_resources(struct stmmac_priv *priv,
++				       struct stmmac_dma_conf *dma_conf)
+ {
+ 	u32 rx_count = priv->plat->rx_queues_to_use;
+ 	u32 queue;
+@@ -2077,7 +2132,7 @@ static int alloc_dma_rx_desc_resources(s
+ 
+ 	/* RX queues buffers and DMA */
+ 	for (queue = 0; queue < rx_count; queue++) {
+-		ret = __alloc_dma_rx_desc_resources(priv, queue);
++		ret = __alloc_dma_rx_desc_resources(priv, dma_conf, queue);
+ 		if (ret)
+ 			goto err_dma;
+ 	}
+@@ -2085,7 +2140,7 @@ static int alloc_dma_rx_desc_resources(s
+ 	return 0;
+ 
+ err_dma:
+-	free_dma_rx_desc_resources(priv);
++	free_dma_rx_desc_resources(priv, dma_conf);
+ 
+ 	return ret;
+ }
+@@ -2093,28 +2148,31 @@ err_dma:
+ /**
+  * __alloc_dma_tx_desc_resources - alloc TX resources (per queue).
+  * @priv: private structure
++ * @dma_conf: structure to take the dma data
+  * @queue: TX queue index
+  * Description: according to which descriptor can be used (extend or basic)
+  * this function allocates the resources for TX and RX paths. In case of
+  * reception, for example, it pre-allocated the RX socket buffer in order to
+  * allow zero-copy mechanism.
+  */
+-static int __alloc_dma_tx_desc_resources(struct stmmac_priv *priv, u32 queue)
++static int __alloc_dma_tx_desc_resources(struct stmmac_priv *priv,
++					 struct stmmac_dma_conf *dma_conf,
++					 u32 queue)
+ {
+-	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
++	struct stmmac_tx_queue *tx_q = &dma_conf->tx_queue[queue];
+ 	size_t size;
+ 	void *addr;
+ 
+ 	tx_q->queue_index = queue;
+ 	tx_q->priv_data = priv;
+ 
+-	tx_q->tx_skbuff_dma = kcalloc(priv->dma_conf.dma_tx_size,
++	tx_q->tx_skbuff_dma = kcalloc(dma_conf->dma_tx_size,
+ 				      sizeof(*tx_q->tx_skbuff_dma),
+ 				      GFP_KERNEL);
+ 	if (!tx_q->tx_skbuff_dma)
+ 		return -ENOMEM;
+ 
+-	tx_q->tx_skbuff = kcalloc(priv->dma_conf.dma_tx_size,
++	tx_q->tx_skbuff = kcalloc(dma_conf->dma_tx_size,
+ 				  sizeof(struct sk_buff *),
+ 				  GFP_KERNEL);
+ 	if (!tx_q->tx_skbuff)
+@@ -2127,7 +2185,7 @@ static int __alloc_dma_tx_desc_resources
+ 	else
+ 		size = sizeof(struct dma_desc);
+ 
+-	size *= priv->dma_conf.dma_tx_size;
++	size *= dma_conf->dma_tx_size;
+ 
+ 	addr = dma_alloc_coherent(priv->device, size,
+ 				  &tx_q->dma_tx_phy, GFP_KERNEL);
+@@ -2144,7 +2202,8 @@ static int __alloc_dma_tx_desc_resources
+ 	return 0;
+ }
+ 
+-static int alloc_dma_tx_desc_resources(struct stmmac_priv *priv)
++static int alloc_dma_tx_desc_resources(struct stmmac_priv *priv,
++				       struct stmmac_dma_conf *dma_conf)
+ {
+ 	u32 tx_count = priv->plat->tx_queues_to_use;
+ 	u32 queue;
+@@ -2152,7 +2211,7 @@ static int alloc_dma_tx_desc_resources(s
+ 
+ 	/* TX queues buffers and DMA */
+ 	for (queue = 0; queue < tx_count; queue++) {
+-		ret = __alloc_dma_tx_desc_resources(priv, queue);
++		ret = __alloc_dma_tx_desc_resources(priv, dma_conf, queue);
+ 		if (ret)
+ 			goto err_dma;
+ 	}
+@@ -2160,27 +2219,29 @@ static int alloc_dma_tx_desc_resources(s
+ 	return 0;
+ 
+ err_dma:
+-	free_dma_tx_desc_resources(priv);
++	free_dma_tx_desc_resources(priv, dma_conf);
+ 	return ret;
+ }
+ 
+ /**
+  * alloc_dma_desc_resources - alloc TX/RX resources.
+  * @priv: private structure
++ * @dma_conf: structure to take the dma data
+  * Description: according to which descriptor can be used (extend or basic)
+  * this function allocates the resources for TX and RX paths. In case of
+  * reception, for example, it pre-allocated the RX socket buffer in order to
+  * allow zero-copy mechanism.
+  */
+-static int alloc_dma_desc_resources(struct stmmac_priv *priv)
++static int alloc_dma_desc_resources(struct stmmac_priv *priv,
++				    struct stmmac_dma_conf *dma_conf)
+ {
+ 	/* RX Allocation */
+-	int ret = alloc_dma_rx_desc_resources(priv);
++	int ret = alloc_dma_rx_desc_resources(priv, dma_conf);
+ 
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = alloc_dma_tx_desc_resources(priv);
++	ret = alloc_dma_tx_desc_resources(priv, dma_conf);
+ 
+ 	return ret;
+ }
+@@ -2188,16 +2249,18 @@ static int alloc_dma_desc_resources(stru
+ /**
+  * free_dma_desc_resources - free dma desc resources
+  * @priv: private structure
++ * @dma_conf: structure to take the dma data
+  */
+-static void free_dma_desc_resources(struct stmmac_priv *priv)
++static void free_dma_desc_resources(struct stmmac_priv *priv,
++				    struct stmmac_dma_conf *dma_conf)
+ {
+ 	/* Release the DMA TX socket buffers */
+-	free_dma_tx_desc_resources(priv);
++	free_dma_tx_desc_resources(priv, dma_conf);
+ 
+ 	/* Release the DMA RX socket buffers later
+ 	 * to ensure all pending XDP_TX buffers are returned.
+ 	 */
+-	free_dma_rx_desc_resources(priv);
++	free_dma_rx_desc_resources(priv, dma_conf);
+ }
+ 
+ /**
+@@ -2686,8 +2749,8 @@ static void stmmac_tx_err(struct stmmac_
+ 	netif_tx_stop_queue(netdev_get_tx_queue(priv->dev, chan));
+ 
+ 	stmmac_stop_tx_dma(priv, chan);
+-	dma_free_tx_skbufs(priv, chan);
+-	stmmac_clear_tx_descriptors(priv, chan);
++	dma_free_tx_skbufs(priv, &priv->dma_conf, chan);
++	stmmac_clear_tx_descriptors(priv, &priv->dma_conf, chan);
+ 	stmmac_reset_tx_queue(priv, chan);
+ 	stmmac_init_tx_chan(priv, priv->ioaddr, priv->plat->dma_cfg,
+ 			    tx_q->dma_tx_phy, chan);
+@@ -3684,19 +3747,93 @@ static int stmmac_request_irq(struct net
+ }
+ 
+ /**
+- *  stmmac_open - open entry point of the driver
++ *  stmmac_setup_dma_desc - Generate a dma_conf and allocate DMA queue
++ *  @priv: driver private structure
++ *  @mtu: MTU to setup the dma queue and buf with
++ *  Description: Allocate and generate a dma_conf based on the provided MTU.
++ *  Allocate the Tx/Rx DMA queue and init them.
++ *  Return value:
++ *  the dma_conf allocated struct on success and an appropriate ERR_PTR on failure.
++ */
++static struct stmmac_dma_conf *
++stmmac_setup_dma_desc(struct stmmac_priv *priv, unsigned int mtu)
++{
++	struct stmmac_dma_conf *dma_conf;
++	int chan, bfsize, ret;
++
++	dma_conf = kzalloc(sizeof(*dma_conf), GFP_KERNEL);
++	if (!dma_conf) {
++		netdev_err(priv->dev, "%s: DMA conf allocation failed\n",
++			   __func__);
++		return ERR_PTR(-ENOMEM);
++	}
++
++	bfsize = stmmac_set_16kib_bfsize(priv, mtu);
++	if (bfsize < 0)
++		bfsize = 0;
++
++	if (bfsize < BUF_SIZE_16KiB)
++		bfsize = stmmac_set_bfsize(mtu, 0);
++
++	dma_conf->dma_buf_sz = bfsize;
++	/* Chose the tx/rx size from the already defined one in the
++	 * priv struct. (if defined)
++	 */
++	dma_conf->dma_tx_size = priv->dma_conf.dma_tx_size;
++	dma_conf->dma_rx_size = priv->dma_conf.dma_rx_size;
++
++	if (!dma_conf->dma_tx_size)
++		dma_conf->dma_tx_size = DMA_DEFAULT_TX_SIZE;
++	if (!dma_conf->dma_rx_size)
++		dma_conf->dma_rx_size = DMA_DEFAULT_RX_SIZE;
++
++	/* Earlier check for TBS */
++	for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++) {
++		struct stmmac_tx_queue *tx_q = &dma_conf->tx_queue[chan];
++		int tbs_en = priv->plat->tx_queues_cfg[chan].tbs_en;
++
++		/* Setup per-TXQ tbs flag before TX descriptor alloc */
++		tx_q->tbs |= tbs_en ? STMMAC_TBS_AVAIL : 0;
++	}
++
++	ret = alloc_dma_desc_resources(priv, dma_conf);
++	if (ret < 0) {
++		netdev_err(priv->dev, "%s: DMA descriptors allocation failed\n",
++			   __func__);
++		goto alloc_error;
++	}
++
++	ret = init_dma_desc_rings(priv->dev, dma_conf, GFP_KERNEL);
++	if (ret < 0) {
++		netdev_err(priv->dev, "%s: DMA descriptors initialization failed\n",
++			   __func__);
++		goto init_error;
++	}
++
++	return dma_conf;
++
++init_error:
++	free_dma_desc_resources(priv, dma_conf);
++alloc_error:
++	kfree(dma_conf);
++	return ERR_PTR(ret);
++}
++
++/**
++ *  __stmmac_open - open entry point of the driver
+  *  @dev : pointer to the device structure.
++ *  @dma_conf :  structure to take the dma data
+  *  Description:
+  *  This function is the open entry point of the driver.
+  *  Return value:
+  *  0 on success and an appropriate (-)ve integer as defined in errno.h
+  *  file on failure.
+  */
+-static int stmmac_open(struct net_device *dev)
++static int __stmmac_open(struct net_device *dev,
++			 struct stmmac_dma_conf *dma_conf)
+ {
+ 	struct stmmac_priv *priv = netdev_priv(dev);
+ 	int mode = priv->plat->phy_interface;
+-	int bfsize = 0;
+ 	u32 chan;
+ 	int ret;
+ 
+@@ -3723,45 +3860,10 @@ static int stmmac_open(struct net_device
+ 	memset(&priv->xstats, 0, sizeof(struct stmmac_extra_stats));
+ 	priv->xstats.threshold = tc;
+ 
+-	bfsize = stmmac_set_16kib_bfsize(priv, dev->mtu);
+-	if (bfsize < 0)
+-		bfsize = 0;
+-
+-	if (bfsize < BUF_SIZE_16KiB)
+-		bfsize = stmmac_set_bfsize(dev->mtu, priv->dma_conf.dma_buf_sz);
+-
+-	priv->dma_conf.dma_buf_sz = bfsize;
+-	buf_sz = bfsize;
+-
+ 	priv->rx_copybreak = STMMAC_RX_COPYBREAK;
+ 
+-	if (!priv->dma_conf.dma_tx_size)
+-		priv->dma_conf.dma_tx_size = DMA_DEFAULT_TX_SIZE;
+-	if (!priv->dma_conf.dma_rx_size)
+-		priv->dma_conf.dma_rx_size = DMA_DEFAULT_RX_SIZE;
+-
+-	/* Earlier check for TBS */
+-	for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++) {
+-		struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[chan];
+-		int tbs_en = priv->plat->tx_queues_cfg[chan].tbs_en;
+-
+-		/* Setup per-TXQ tbs flag before TX descriptor alloc */
+-		tx_q->tbs |= tbs_en ? STMMAC_TBS_AVAIL : 0;
+-	}
+-
+-	ret = alloc_dma_desc_resources(priv);
+-	if (ret < 0) {
+-		netdev_err(priv->dev, "%s: DMA descriptors allocation failed\n",
+-			   __func__);
+-		goto dma_desc_error;
+-	}
+-
+-	ret = init_dma_desc_rings(dev, GFP_KERNEL);
+-	if (ret < 0) {
+-		netdev_err(priv->dev, "%s: DMA descriptors initialization failed\n",
+-			   __func__);
+-		goto init_error;
+-	}
++	buf_sz = dma_conf->dma_buf_sz;
++	memcpy(&priv->dma_conf, dma_conf, sizeof(*dma_conf));
+ 
+ 	if (priv->plat->serdes_powerup) {
+ 		ret = priv->plat->serdes_powerup(dev, priv->plat->bsp_priv);
+@@ -3804,14 +3906,28 @@ irq_error:
+ 
+ 	stmmac_hw_teardown(dev);
+ init_error:
+-	free_dma_desc_resources(priv);
+-dma_desc_error:
++	free_dma_desc_resources(priv, &priv->dma_conf);
+ 	phylink_disconnect_phy(priv->phylink);
+ init_phy_error:
+ 	pm_runtime_put(priv->device);
+ 	return ret;
+ }
+ 
++static int stmmac_open(struct net_device *dev)
++{
++	struct stmmac_priv *priv = netdev_priv(dev);
++	struct stmmac_dma_conf *dma_conf;
++	int ret;
++
++	dma_conf = stmmac_setup_dma_desc(priv, dev->mtu);
++	if (IS_ERR(dma_conf))
++		return PTR_ERR(dma_conf);
++
++	ret = __stmmac_open(dev, dma_conf);
++	kfree(dma_conf);
++	return ret;
++}
++
+ static void stmmac_fpe_stop_wq(struct stmmac_priv *priv)
+ {
+ 	set_bit(__FPE_REMOVING, &priv->fpe_task_state);
+@@ -3858,7 +3974,7 @@ static int stmmac_release(struct net_dev
+ 	stmmac_stop_all_dma(priv);
+ 
+ 	/* Release and free the Rx/Tx resources */
+-	free_dma_desc_resources(priv);
++	free_dma_desc_resources(priv, &priv->dma_conf);
+ 
+ 	/* Disable the MAC Rx/Tx */
+ 	stmmac_mac_set(priv, priv->ioaddr, false);
+@@ -6403,7 +6519,7 @@ void stmmac_disable_rx_queue(struct stmm
+ 	spin_unlock_irqrestore(&ch->lock, flags);
+ 
+ 	stmmac_stop_rx_dma(priv, queue);
+-	__free_dma_rx_desc_resources(priv, queue);
++	__free_dma_rx_desc_resources(priv, &priv->dma_conf, queue);
+ }
+ 
+ void stmmac_enable_rx_queue(struct stmmac_priv *priv, u32 queue)
+@@ -6414,21 +6530,21 @@ void stmmac_enable_rx_queue(struct stmma
+ 	u32 buf_size;
+ 	int ret;
+ 
+-	ret = __alloc_dma_rx_desc_resources(priv, queue);
++	ret = __alloc_dma_rx_desc_resources(priv, &priv->dma_conf, queue);
+ 	if (ret) {
+ 		netdev_err(priv->dev, "Failed to alloc RX desc.\n");
+ 		return;
+ 	}
+ 
+-	ret = __init_dma_rx_desc_rings(priv, queue, GFP_KERNEL);
++	ret = __init_dma_rx_desc_rings(priv, &priv->dma_conf, queue, GFP_KERNEL);
+ 	if (ret) {
+-		__free_dma_rx_desc_resources(priv, queue);
++		__free_dma_rx_desc_resources(priv, &priv->dma_conf, queue);
+ 		netdev_err(priv->dev, "Failed to init RX desc.\n");
+ 		return;
+ 	}
+ 
+ 	stmmac_reset_rx_queue(priv, queue);
+-	stmmac_clear_rx_descriptors(priv, queue);
++	stmmac_clear_rx_descriptors(priv, &priv->dma_conf, queue);
+ 
+ 	stmmac_init_rx_chan(priv, priv->ioaddr, priv->plat->dma_cfg,
+ 			    rx_q->dma_rx_phy, rx_q->queue_index);
+@@ -6466,7 +6582,7 @@ void stmmac_disable_tx_queue(struct stmm
+ 	spin_unlock_irqrestore(&ch->lock, flags);
+ 
+ 	stmmac_stop_tx_dma(priv, queue);
+-	__free_dma_tx_desc_resources(priv, queue);
++	__free_dma_tx_desc_resources(priv, &priv->dma_conf, queue);
+ }
+ 
+ void stmmac_enable_tx_queue(struct stmmac_priv *priv, u32 queue)
+@@ -6476,21 +6592,21 @@ void stmmac_enable_tx_queue(struct stmma
+ 	unsigned long flags;
+ 	int ret;
+ 
+-	ret = __alloc_dma_tx_desc_resources(priv, queue);
++	ret = __alloc_dma_tx_desc_resources(priv, &priv->dma_conf, queue);
+ 	if (ret) {
+ 		netdev_err(priv->dev, "Failed to alloc TX desc.\n");
+ 		return;
+ 	}
+ 
+-	ret = __init_dma_tx_desc_rings(priv, queue);
++	ret = __init_dma_tx_desc_rings(priv,  &priv->dma_conf, queue);
+ 	if (ret) {
+-		__free_dma_tx_desc_resources(priv, queue);
++		__free_dma_tx_desc_resources(priv, &priv->dma_conf, queue);
+ 		netdev_err(priv->dev, "Failed to init TX desc.\n");
+ 		return;
+ 	}
+ 
+ 	stmmac_reset_tx_queue(priv, queue);
+-	stmmac_clear_tx_descriptors(priv, queue);
++	stmmac_clear_tx_descriptors(priv, &priv->dma_conf, queue);
+ 
+ 	stmmac_init_tx_chan(priv, priv->ioaddr, priv->plat->dma_cfg,
+ 			    tx_q->dma_tx_phy, tx_q->queue_index);
+@@ -6530,7 +6646,7 @@ void stmmac_xdp_release(struct net_devic
+ 	stmmac_stop_all_dma(priv);
+ 
+ 	/* Release and free the Rx/Tx resources */
+-	free_dma_desc_resources(priv);
++	free_dma_desc_resources(priv, &priv->dma_conf);
+ 
+ 	/* Disable the MAC Rx/Tx */
+ 	stmmac_mac_set(priv, priv->ioaddr, false);
+@@ -6555,14 +6671,14 @@ int stmmac_xdp_open(struct net_device *d
+ 	u32 chan;
+ 	int ret;
+ 
+-	ret = alloc_dma_desc_resources(priv);
++	ret = alloc_dma_desc_resources(priv, &priv->dma_conf);
+ 	if (ret < 0) {
+ 		netdev_err(dev, "%s: DMA descriptors allocation failed\n",
+ 			   __func__);
+ 		goto dma_desc_error;
+ 	}
+ 
+-	ret = init_dma_desc_rings(dev, GFP_KERNEL);
++	ret = init_dma_desc_rings(dev, &priv->dma_conf, GFP_KERNEL);
+ 	if (ret < 0) {
+ 		netdev_err(dev, "%s: DMA descriptors initialization failed\n",
+ 			   __func__);
+@@ -6644,7 +6760,7 @@ irq_error:
+ 
+ 	stmmac_hw_teardown(dev);
+ init_error:
+-	free_dma_desc_resources(priv);
++	free_dma_desc_resources(priv, &priv->dma_conf);
+ dma_desc_error:
+ 	return ret;
+ }
+@@ -7509,7 +7625,7 @@ int stmmac_resume(struct device *dev)
+ 	stmmac_reset_queues_param(priv);
+ 
+ 	stmmac_free_tx_skbufs(priv);
+-	stmmac_clear_descriptors(priv);
++	stmmac_clear_descriptors(priv, &priv->dma_conf);
+ 
+ 	stmmac_hw_setup(ndev, false);
+ 	stmmac_init_coalesce(priv);
diff --git a/target/linux/generic/backport-5.15/775-v6.0-05-net-ethernet-stmicro-stmmac-permit-MTU-change-with-i.patch b/target/linux/generic/backport-5.15/775-v6.0-05-net-ethernet-stmicro-stmmac-permit-MTU-change-with-i.patch
new file mode 100644
index 00000000000000..8fccc716597cf5
--- /dev/null
+++ b/target/linux/generic/backport-5.15/775-v6.0-05-net-ethernet-stmicro-stmmac-permit-MTU-change-with-i.patch
@@ -0,0 +1,73 @@
+From 3470079687448abac42deb62774253be1d6bdef3 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Sat, 23 Jul 2022 16:29:33 +0200
+Subject: [PATCH 5/5] net: ethernet: stmicro: stmmac: permit MTU change with
+ interface up
+
+Remove the limitation where the interface needs to be down to change
+MTU by releasing and opening the stmmac driver to set the new MTU.
+Also call the set_filter function to correctly init the port.
+This permits to remove the EBUSY error while the ethernet port is
+running permitting a correct MTU change if for example a DSA request
+a MTU change for a switch CPU port.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ .../net/ethernet/stmicro/stmmac/stmmac_main.c | 30 +++++++++++++++----
+ 1 file changed, 24 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -5626,18 +5626,15 @@ static int stmmac_change_mtu(struct net_
+ {
+ 	struct stmmac_priv *priv = netdev_priv(dev);
+ 	int txfifosz = priv->plat->tx_fifo_size;
++	struct stmmac_dma_conf *dma_conf;
+ 	const int mtu = new_mtu;
++	int ret;
+ 
+ 	if (txfifosz == 0)
+ 		txfifosz = priv->dma_cap.tx_fifo_size;
+ 
+ 	txfifosz /= priv->plat->tx_queues_to_use;
+ 
+-	if (netif_running(dev)) {
+-		netdev_err(priv->dev, "must be stopped to change its MTU\n");
+-		return -EBUSY;
+-	}
+-
+ 	if (stmmac_xdp_is_enabled(priv) && new_mtu > ETH_DATA_LEN) {
+ 		netdev_dbg(priv->dev, "Jumbo frames not supported for XDP\n");
+ 		return -EINVAL;
+@@ -5649,8 +5646,29 @@ static int stmmac_change_mtu(struct net_
+ 	if ((txfifosz < new_mtu) || (new_mtu > BUF_SIZE_16KiB))
+ 		return -EINVAL;
+ 
+-	dev->mtu = mtu;
++	if (netif_running(dev)) {
++		netdev_dbg(priv->dev, "restarting interface to change its MTU\n");
++		/* Try to allocate the new DMA conf with the new mtu */
++		dma_conf = stmmac_setup_dma_desc(priv, mtu);
++		if (IS_ERR(dma_conf)) {
++			netdev_err(priv->dev, "failed allocating new dma conf for new MTU %d\n",
++				   mtu);
++			return PTR_ERR(dma_conf);
++		}
++
++		stmmac_release(dev);
++
++		ret = __stmmac_open(dev, dma_conf);
++		kfree(dma_conf);
++		if (ret) {
++			netdev_err(priv->dev, "failed reopening the interface after MTU change\n");
++			return ret;
++		}
++
++		stmmac_set_rx_mode(dev);
++	}
+ 
++	dev->mtu = mtu;
+ 	netdev_update_features(dev);
+ 
+ 	return 0;
diff --git a/target/linux/generic/backport-5.15/776-v6.1-01-net-dsa-qca8k-fix-inband-mgmt-for-big-endian-systems.patch b/target/linux/generic/backport-5.15/776-v6.1-01-net-dsa-qca8k-fix-inband-mgmt-for-big-endian-systems.patch
new file mode 100644
index 00000000000000..4f0d95f456106a
--- /dev/null
+++ b/target/linux/generic/backport-5.15/776-v6.1-01-net-dsa-qca8k-fix-inband-mgmt-for-big-endian-systems.patch
@@ -0,0 +1,156 @@
+From a2550d3ce53c68f54042bc5e468c4d07491ffe0e Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 12 Oct 2022 19:18:36 +0200
+Subject: [PATCH 1/2] net: dsa: qca8k: fix inband mgmt for big-endian systems
+
+The header and the data of the skb for the inband mgmt requires
+to be in little-endian. This is problematic for big-endian system
+as the mgmt header is written in the cpu byte order.
+
+Fix this by converting each value for the mgmt header and data to
+little-endian, and convert to cpu byte order the mgmt header and
+data sent by the switch.
+
+Fixes: 5950c7c0a68c ("net: dsa: qca8k: add support for mgmt read/write in Ethernet packet")
+Tested-by: Pawel Dembicki <paweldembicki@gmail.com>
+Tested-by: Lech Perczak <lech.perczak@gmail.com>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Lech Perczak <lech.perczak@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c | 63 ++++++++++++++++++++++++--------
+ include/linux/dsa/tag_qca.h      |  6 +--
+ 2 files changed, 50 insertions(+), 19 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -137,27 +137,42 @@ static void qca8k_rw_reg_ack_handler(str
+ 	struct qca8k_mgmt_eth_data *mgmt_eth_data;
+ 	struct qca8k_priv *priv = ds->priv;
+ 	struct qca_mgmt_ethhdr *mgmt_ethhdr;
++	u32 command;
+ 	u8 len, cmd;
++	int i;
+ 
+ 	mgmt_ethhdr = (struct qca_mgmt_ethhdr *)skb_mac_header(skb);
+ 	mgmt_eth_data = &priv->mgmt_eth_data;
+ 
+-	cmd = FIELD_GET(QCA_HDR_MGMT_CMD, mgmt_ethhdr->command);
+-	len = FIELD_GET(QCA_HDR_MGMT_LENGTH, mgmt_ethhdr->command);
++	command = get_unaligned_le32(&mgmt_ethhdr->command);
++	cmd = FIELD_GET(QCA_HDR_MGMT_CMD, command);
++	len = FIELD_GET(QCA_HDR_MGMT_LENGTH, command);
+ 
+ 	/* Make sure the seq match the requested packet */
+-	if (mgmt_ethhdr->seq == mgmt_eth_data->seq)
++	if (get_unaligned_le32(&mgmt_ethhdr->seq) == mgmt_eth_data->seq)
+ 		mgmt_eth_data->ack = true;
+ 
+ 	if (cmd == MDIO_READ) {
+-		mgmt_eth_data->data[0] = mgmt_ethhdr->mdio_data;
++		u32 *val = mgmt_eth_data->data;
++
++		*val = get_unaligned_le32(&mgmt_ethhdr->mdio_data);
+ 
+ 		/* Get the rest of the 12 byte of data.
+ 		 * The read/write function will extract the requested data.
+ 		 */
+-		if (len > QCA_HDR_MGMT_DATA1_LEN)
+-			memcpy(mgmt_eth_data->data + 1, skb->data,
+-			       QCA_HDR_MGMT_DATA2_LEN);
++		if (len > QCA_HDR_MGMT_DATA1_LEN) {
++			__le32 *data2 = (__le32 *)skb->data;
++			int data_len = min_t(int, QCA_HDR_MGMT_DATA2_LEN,
++					     len - QCA_HDR_MGMT_DATA1_LEN);
++
++			val++;
++
++			for (i = sizeof(u32); i <= data_len; i += sizeof(u32)) {
++				*val = get_unaligned_le32(data2);
++				val++;
++				data2++;
++			}
++		}
+ 	}
+ 
+ 	complete(&mgmt_eth_data->rw_done);
+@@ -169,8 +184,10 @@ static struct sk_buff *qca8k_alloc_mdio_
+ 	struct qca_mgmt_ethhdr *mgmt_ethhdr;
+ 	unsigned int real_len;
+ 	struct sk_buff *skb;
+-	u32 *data2;
++	__le32 *data2;
++	u32 command;
+ 	u16 hdr;
++	int i;
+ 
+ 	skb = dev_alloc_skb(QCA_HDR_MGMT_PKT_LEN);
+ 	if (!skb)
+@@ -199,20 +216,32 @@ static struct sk_buff *qca8k_alloc_mdio_
+ 	hdr |= FIELD_PREP(QCA_HDR_XMIT_DP_BIT, BIT(0));
+ 	hdr |= FIELD_PREP(QCA_HDR_XMIT_CONTROL, QCA_HDR_XMIT_TYPE_RW_REG);
+ 
+-	mgmt_ethhdr->command = FIELD_PREP(QCA_HDR_MGMT_ADDR, reg);
+-	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_LENGTH, real_len);
+-	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_CMD, cmd);
+-	mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_CHECK_CODE,
++	command = FIELD_PREP(QCA_HDR_MGMT_ADDR, reg);
++	command |= FIELD_PREP(QCA_HDR_MGMT_LENGTH, real_len);
++	command |= FIELD_PREP(QCA_HDR_MGMT_CMD, cmd);
++	command |= FIELD_PREP(QCA_HDR_MGMT_CHECK_CODE,
+ 					   QCA_HDR_MGMT_CHECK_CODE_VAL);
+ 
++	put_unaligned_le32(command, &mgmt_ethhdr->command);
++
+ 	if (cmd == MDIO_WRITE)
+-		mgmt_ethhdr->mdio_data = *val;
++		put_unaligned_le32(*val, &mgmt_ethhdr->mdio_data);
+ 
+ 	mgmt_ethhdr->hdr = htons(hdr);
+ 
+ 	data2 = skb_put_zero(skb, QCA_HDR_MGMT_DATA2_LEN + QCA_HDR_MGMT_PADDING_LEN);
+-	if (cmd == MDIO_WRITE && len > QCA_HDR_MGMT_DATA1_LEN)
+-		memcpy(data2, val + 1, len - QCA_HDR_MGMT_DATA1_LEN);
++	if (cmd == MDIO_WRITE && len > QCA_HDR_MGMT_DATA1_LEN) {
++		int data_len = min_t(int, QCA_HDR_MGMT_DATA2_LEN,
++				     len - QCA_HDR_MGMT_DATA1_LEN);
++
++		val++;
++
++		for (i = sizeof(u32); i <= data_len; i += sizeof(u32)) {
++			put_unaligned_le32(*val, data2);
++			data2++;
++			val++;
++		}
++	}
+ 
+ 	return skb;
+ }
+@@ -220,9 +249,11 @@ static struct sk_buff *qca8k_alloc_mdio_
+ static void qca8k_mdio_header_fill_seq_num(struct sk_buff *skb, u32 seq_num)
+ {
+ 	struct qca_mgmt_ethhdr *mgmt_ethhdr;
++	u32 seq;
+ 
++	seq = FIELD_PREP(QCA_HDR_MGMT_SEQ_NUM, seq_num);
+ 	mgmt_ethhdr = (struct qca_mgmt_ethhdr *)skb->data;
+-	mgmt_ethhdr->seq = FIELD_PREP(QCA_HDR_MGMT_SEQ_NUM, seq_num);
++	put_unaligned_le32(seq, &mgmt_ethhdr->seq);
+ }
+ 
+ static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
+--- a/include/linux/dsa/tag_qca.h
++++ b/include/linux/dsa/tag_qca.h
+@@ -56,9 +56,9 @@
+ 
+ /* Special struct emulating a Ethernet header */
+ struct qca_mgmt_ethhdr {
+-	u32 command;		/* command bit 31:0 */
+-	u32 seq;		/* seq 63:32 */
+-	u32 mdio_data;		/* first 4byte mdio */
++	__le32 command;		/* command bit 31:0 */
++	__le32 seq;		/* seq 63:32 */
++	__le32 mdio_data;		/* first 4byte mdio */
+ 	__be16 hdr;		/* qca hdr */
+ } __packed;
+ 
diff --git a/target/linux/generic/backport-5.15/776-v6.1-02-net-dsa-qca8k-fix-ethtool-autocast-mib-for-big-endia.patch b/target/linux/generic/backport-5.15/776-v6.1-02-net-dsa-qca8k-fix-ethtool-autocast-mib-for-big-endia.patch
new file mode 100644
index 00000000000000..d13014bf93bdf9
--- /dev/null
+++ b/target/linux/generic/backport-5.15/776-v6.1-02-net-dsa-qca8k-fix-ethtool-autocast-mib-for-big-endia.patch
@@ -0,0 +1,81 @@
+From 0d4636f7d72df3179b20a2d32b647881917a5e2a Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 12 Oct 2022 19:18:37 +0200
+Subject: [PATCH 2/2] net: dsa: qca8k: fix ethtool autocast mib for big-endian
+ systems
+
+The switch sends autocast mib in little-endian. This is problematic for
+big-endian system as the values needs to be converted.
+
+Fix this by converting each mib value to cpu byte order.
+
+Fixes: 5c957c7ca78c ("net: dsa: qca8k: add support for mib autocast in Ethernet packet")
+Tested-by: Pawel Dembicki <paweldembicki@gmail.com>
+Tested-by: Lech Perczak <lech.perczak@gmail.com>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c | 20 ++++++++------------
+ include/linux/dsa/tag_qca.h      |  2 +-
+ 2 files changed, 9 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -1668,9 +1668,9 @@ static void qca8k_mib_autocast_handler(s
+ 	struct qca8k_priv *priv = ds->priv;
+ 	const struct qca8k_mib_desc *mib;
+ 	struct mib_ethhdr *mib_ethhdr;
+-	int i, mib_len, offset = 0;
+-	u64 *data;
++	__le32 *data2;
+ 	u8 port;
++	int i;
+ 
+ 	mib_ethhdr = (struct mib_ethhdr *)skb_mac_header(skb);
+ 	mib_eth_data = &priv->mib_eth_data;
+@@ -1682,28 +1682,24 @@ static void qca8k_mib_autocast_handler(s
+ 	if (port != mib_eth_data->req_port)
+ 		goto exit;
+ 
+-	data = mib_eth_data->data;
++	data2 = (__le32 *)skb->data;
+ 
+ 	for (i = 0; i < priv->info->mib_count; i++) {
+ 		mib = &ar8327_mib[i];
+ 
+ 		/* First 3 mib are present in the skb head */
+ 		if (i < 3) {
+-			data[i] = mib_ethhdr->data[i];
++			mib_eth_data->data[i] = get_unaligned_le32(mib_ethhdr->data + i);
+ 			continue;
+ 		}
+ 
+-		mib_len = sizeof(uint32_t);
+-
+ 		/* Some mib are 64 bit wide */
+ 		if (mib->size == 2)
+-			mib_len = sizeof(uint64_t);
+-
+-		/* Copy the mib value from packet to the */
+-		memcpy(data + i, skb->data + offset, mib_len);
++			mib_eth_data->data[i] = get_unaligned_le64((__le64 *)data2);
++		else
++			mib_eth_data->data[i] = get_unaligned_le32(data2);
+ 
+-		/* Set the offset for the next mib */
+-		offset += mib_len;
++		data2 += mib->size;
+ 	}
+ 
+ exit:
+--- a/include/linux/dsa/tag_qca.h
++++ b/include/linux/dsa/tag_qca.h
+@@ -68,7 +68,7 @@ enum mdio_cmd {
+ };
+ 
+ struct mib_ethhdr {
+-	u32 data[3];		/* first 3 mib counter */
++	__le32 data[3];		/* first 3 mib counter */
+ 	__be16 hdr;		/* qca hdr */
+ } __packed;
+ 
diff --git a/target/linux/generic/backport-5.15/777-v6.2-01-net-dsa-qca8k-fix-wrong-length-value-for-mgmt-eth-pa.patch b/target/linux/generic/backport-5.15/777-v6.2-01-net-dsa-qca8k-fix-wrong-length-value-for-mgmt-eth-pa.patch
new file mode 100644
index 00000000000000..b61e7ede494652
--- /dev/null
+++ b/target/linux/generic/backport-5.15/777-v6.2-01-net-dsa-qca8k-fix-wrong-length-value-for-mgmt-eth-pa.patch
@@ -0,0 +1,102 @@
+From 9807ae69746196ee4bbffe7d22d22ab2b61c6ed0 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 29 Dec 2022 17:33:32 +0100
+Subject: [PATCH 1/5] net: dsa: qca8k: fix wrong length value for mgmt eth
+ packet
+
+The assumption that Documentation was right about how this value work was
+wrong. It was discovered that the length value of the mgmt header is in
+step of word size.
+
+As an example to process 4 byte of data the correct length to set is 2.
+To process 8 byte 4, 12 byte 6, 16 byte 8...
+
+Odd values will always return the next size on the ack packet.
+(length of 3 (6 byte) will always return 8 bytes of data)
+
+This means that a value of 15 (0xf) actually means reading/writing 32 bytes
+of data instead of 16 bytes. This behaviour is totally absent and not
+documented in the switch Documentation.
+
+In fact from Documentation the max value that mgmt eth can process is
+16 byte of data while in reality it can process 32 bytes at once.
+
+To handle this we always round up the length after deviding it for word
+size. We check if the result is odd and we round another time to align
+to what the switch will provide in the ack packet.
+The workaround for the length limit of 15 is still needed as the length
+reg max value is 0xf(15)
+
+Reported-by: Ronald Wahl <ronald.wahl@raritan.com>
+Tested-by: Ronald Wahl <ronald.wahl@raritan.com>
+Fixes: 90386223f44e ("net: dsa: qca8k: add support for larger read/write size with mgmt Ethernet")
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Cc: stable@vger.kernel.org # v5.18+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c | 45 +++++++++++++++++++++++++-------
+ 1 file changed, 35 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -146,7 +146,16 @@ static void qca8k_rw_reg_ack_handler(str
+ 
+ 	command = get_unaligned_le32(&mgmt_ethhdr->command);
+ 	cmd = FIELD_GET(QCA_HDR_MGMT_CMD, command);
++
+ 	len = FIELD_GET(QCA_HDR_MGMT_LENGTH, command);
++	/* Special case for len of 15 as this is the max value for len and needs to
++	 * be increased before converting it from word to dword.
++	 */
++	if (len == 15)
++		len++;
++
++	/* We can ignore odd value, we always round up them in the alloc function. */
++	len *= sizeof(u16);
+ 
+ 	/* Make sure the seq match the requested packet */
+ 	if (get_unaligned_le32(&mgmt_ethhdr->seq) == mgmt_eth_data->seq)
+@@ -193,17 +202,33 @@ static struct sk_buff *qca8k_alloc_mdio_
+ 	if (!skb)
+ 		return NULL;
+ 
+-	/* Max value for len reg is 15 (0xf) but the switch actually return 16 byte
+-	 * Actually for some reason the steps are:
+-	 * 0: nothing
+-	 * 1-4: first 4 byte
+-	 * 5-6: first 12 byte
+-	 * 7-15: all 16 byte
++	/* Hdr mgmt length value is in step of word size.
++	 * As an example to process 4 byte of data the correct length to set is 2.
++	 * To process 8 byte 4, 12 byte 6, 16 byte 8...
++	 *
++	 * Odd values will always return the next size on the ack packet.
++	 * (length of 3 (6 byte) will always return 8 bytes of data)
++	 *
++	 * This means that a value of 15 (0xf) actually means reading/writing 32 bytes
++	 * of data.
++	 *
++	 * To correctly calculate the length we devide the requested len by word and
++	 * round up.
++	 * On the ack function we can skip the odd check as we already handle the
++	 * case here.
+ 	 */
+-	if (len == 16)
+-		real_len = 15;
+-	else
+-		real_len = len;
++	real_len = DIV_ROUND_UP(len, sizeof(u16));
++
++	/* We check if the result len is odd and we round up another time to
++	 * the next size. (length of 3 will be increased to 4 as switch will always
++	 * return 8 bytes)
++	 */
++	if (real_len % sizeof(u16) != 0)
++		real_len++;
++
++	/* Max reg value is 0xf(15) but switch will always return the next size (32 byte) */
++	if (real_len == 16)
++		real_len--;
+ 
+ 	skb_reset_mac_header(skb);
+ 	skb_set_network_header(skb, skb->len);
diff --git a/target/linux/generic/backport-5.15/777-v6.2-02-net-dsa-tag_qca-fix-wrong-MGMT_DATA2-size.patch b/target/linux/generic/backport-5.15/777-v6.2-02-net-dsa-tag_qca-fix-wrong-MGMT_DATA2-size.patch
new file mode 100644
index 00000000000000..55ecb1eb42e7cd
--- /dev/null
+++ b/target/linux/generic/backport-5.15/777-v6.2-02-net-dsa-tag_qca-fix-wrong-MGMT_DATA2-size.patch
@@ -0,0 +1,34 @@
+From d9dba91be71f03cc75bcf39fc0d5d99ff33f1ae0 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 29 Dec 2022 17:33:33 +0100
+Subject: [PATCH 2/5] net: dsa: tag_qca: fix wrong MGMT_DATA2 size
+
+It was discovered that MGMT_DATA2 can contain up to 28 bytes of data
+instead of the 12 bytes written in the Documentation by accounting the
+limit of 16 bytes declared in Documentation subtracting the first 4 byte
+in the packet header.
+
+Update the define with the real world value.
+
+Tested-by: Ronald Wahl <ronald.wahl@raritan.com>
+Fixes: c2ee8181fddb ("net: dsa: tag_qca: add define for handling mgmt Ethernet packet")
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Cc: stable@vger.kernel.org # v5.18+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/linux/dsa/tag_qca.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/dsa/tag_qca.h
++++ b/include/linux/dsa/tag_qca.h
+@@ -40,8 +40,8 @@
+ 					QCA_HDR_MGMT_COMMAND_LEN + \
+ 					QCA_HDR_MGMT_DATA1_LEN)
+ 
+-#define QCA_HDR_MGMT_DATA2_LEN		12 /* Other 12 byte for the mdio data */
+-#define QCA_HDR_MGMT_PADDING_LEN	34 /* Padding to reach the min Ethernet packet */
++#define QCA_HDR_MGMT_DATA2_LEN		28 /* Other 28 byte for the mdio data */
++#define QCA_HDR_MGMT_PADDING_LEN	18 /* Padding to reach the min Ethernet packet */
+ 
+ #define QCA_HDR_MGMT_PKT_LEN		(QCA_HDR_MGMT_HEADER_LEN + \
+ 					QCA_HDR_LEN + \
diff --git a/target/linux/generic/backport-5.15/777-v6.2-03-Revert-net-dsa-qca8k-cache-lo-and-hi-for-mdio-write.patch b/target/linux/generic/backport-5.15/777-v6.2-03-Revert-net-dsa-qca8k-cache-lo-and-hi-for-mdio-write.patch
new file mode 100644
index 00000000000000..c8e22fd1b815f7
--- /dev/null
+++ b/target/linux/generic/backport-5.15/777-v6.2-03-Revert-net-dsa-qca8k-cache-lo-and-hi-for-mdio-write.patch
@@ -0,0 +1,172 @@
+From 03cb9e6d0b32b768e3d9d473c5c4ca1100877664 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 29 Dec 2022 17:33:34 +0100
+Subject: [PATCH 3/5] Revert "net: dsa: qca8k: cache lo and hi for mdio write"
+
+This reverts commit 2481d206fae7884cd07014fd1318e63af35e99eb.
+
+The Documentation is very confusing about the topic.
+The cache logic for hi and lo is wrong and actually miss some regs to be
+actually written.
+
+What the Documentation actually intended was that it's possible to skip
+writing hi OR lo if half of the reg is not needed to be written or read.
+
+Revert the change in favor of a better and correct implementation.
+
+Reported-by: Ronald Wahl <ronald.wahl@raritan.com>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Cc: stable@vger.kernel.org # v5.18+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c | 61 +++++++-------------------------
+ drivers/net/dsa/qca/qca8k.h      |  5 ---
+ 2 files changed, 12 insertions(+), 54 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -37,44 +37,6 @@ qca8k_split_addr(u32 regaddr, u16 *r1, u
+ }
+ 
+ static int
+-qca8k_set_lo(struct qca8k_priv *priv, int phy_id, u32 regnum, u16 lo)
+-{
+-	u16 *cached_lo = &priv->mdio_cache.lo;
+-	struct mii_bus *bus = priv->bus;
+-	int ret;
+-
+-	if (lo == *cached_lo)
+-		return 0;
+-
+-	ret = bus->write(bus, phy_id, regnum, lo);
+-	if (ret < 0)
+-		dev_err_ratelimited(&bus->dev,
+-				    "failed to write qca8k 32bit lo register\n");
+-
+-	*cached_lo = lo;
+-	return 0;
+-}
+-
+-static int
+-qca8k_set_hi(struct qca8k_priv *priv, int phy_id, u32 regnum, u16 hi)
+-{
+-	u16 *cached_hi = &priv->mdio_cache.hi;
+-	struct mii_bus *bus = priv->bus;
+-	int ret;
+-
+-	if (hi == *cached_hi)
+-		return 0;
+-
+-	ret = bus->write(bus, phy_id, regnum, hi);
+-	if (ret < 0)
+-		dev_err_ratelimited(&bus->dev,
+-				    "failed to write qca8k 32bit hi register\n");
+-
+-	*cached_hi = hi;
+-	return 0;
+-}
+-
+-static int
+ qca8k_mii_read32(struct mii_bus *bus, int phy_id, u32 regnum, u32 *val)
+ {
+ 	int ret;
+@@ -97,7 +59,7 @@ qca8k_mii_read32(struct mii_bus *bus, in
+ }
+ 
+ static void
+-qca8k_mii_write32(struct qca8k_priv *priv, int phy_id, u32 regnum, u32 val)
++qca8k_mii_write32(struct mii_bus *bus, int phy_id, u32 regnum, u32 val)
+ {
+ 	u16 lo, hi;
+ 	int ret;
+@@ -105,9 +67,12 @@ qca8k_mii_write32(struct qca8k_priv *pri
+ 	lo = val & 0xffff;
+ 	hi = (u16)(val >> 16);
+ 
+-	ret = qca8k_set_lo(priv, phy_id, regnum, lo);
++	ret = bus->write(bus, phy_id, regnum, lo);
+ 	if (ret >= 0)
+-		ret = qca8k_set_hi(priv, phy_id, regnum + 1, hi);
++		ret = bus->write(bus, phy_id, regnum + 1, hi);
++	if (ret < 0)
++		dev_err_ratelimited(&bus->dev,
++				    "failed to write qca8k 32bit register\n");
+ }
+ 
+ static int
+@@ -442,7 +407,7 @@ qca8k_regmap_write(void *ctx, uint32_t r
+ 	if (ret < 0)
+ 		goto exit;
+ 
+-	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
++	qca8k_mii_write32(bus, 0x10 | r2, r1, val);
+ 
+ exit:
+ 	mutex_unlock(&bus->mdio_lock);
+@@ -475,7 +440,7 @@ qca8k_regmap_update_bits(void *ctx, uint
+ 
+ 	val &= ~mask;
+ 	val |= write_val;
+-	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
++	qca8k_mii_write32(bus, 0x10 | r2, r1, val);
+ 
+ exit:
+ 	mutex_unlock(&bus->mdio_lock);
+@@ -750,14 +715,14 @@ qca8k_mdio_write(struct qca8k_priv *priv
+ 	if (ret)
+ 		goto exit;
+ 
+-	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
++	qca8k_mii_write32(bus, 0x10 | r2, r1, val);
+ 
+ 	ret = qca8k_mdio_busy_wait(bus, QCA8K_MDIO_MASTER_CTRL,
+ 				   QCA8K_MDIO_MASTER_BUSY);
+ 
+ exit:
+ 	/* even if the busy_wait timeouts try to clear the MASTER_EN */
+-	qca8k_mii_write32(priv, 0x10 | r2, r1, 0);
++	qca8k_mii_write32(bus, 0x10 | r2, r1, 0);
+ 
+ 	mutex_unlock(&bus->mdio_lock);
+ 
+@@ -787,7 +752,7 @@ qca8k_mdio_read(struct qca8k_priv *priv,
+ 	if (ret)
+ 		goto exit;
+ 
+-	qca8k_mii_write32(priv, 0x10 | r2, r1, val);
++	qca8k_mii_write32(bus, 0x10 | r2, r1, val);
+ 
+ 	ret = qca8k_mdio_busy_wait(bus, QCA8K_MDIO_MASTER_CTRL,
+ 				   QCA8K_MDIO_MASTER_BUSY);
+@@ -798,7 +763,7 @@ qca8k_mdio_read(struct qca8k_priv *priv,
+ 
+ exit:
+ 	/* even if the busy_wait timeouts try to clear the MASTER_EN */
+-	qca8k_mii_write32(priv, 0x10 | r2, r1, 0);
++	qca8k_mii_write32(bus, 0x10 | r2, r1, 0);
+ 
+ 	mutex_unlock(&bus->mdio_lock);
+ 
+@@ -1914,8 +1879,6 @@ qca8k_sw_probe(struct mdio_device *mdiod
+ 	}
+ 
+ 	priv->mdio_cache.page = 0xffff;
+-	priv->mdio_cache.lo = 0xffff;
+-	priv->mdio_cache.hi = 0xffff;
+ 
+ 	/* Check the detected switch id */
+ 	ret = qca8k_read_switch_id(priv);
+--- a/drivers/net/dsa/qca/qca8k.h
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -375,11 +375,6 @@ struct qca8k_mdio_cache {
+  * mdio writes
+  */
+ 	u16 page;
+-/* lo and hi can also be cached and from Documentation we can skip one
+- * extra mdio write if lo or hi is didn't change.
+- */
+-	u16 lo;
+-	u16 hi;
+ };
+ 
+ struct qca8k_priv {
diff --git a/target/linux/generic/backport-5.15/777-v6.2-04-net-dsa-qca8k-introduce-single-mii-read-write-lo-hi.patch b/target/linux/generic/backport-5.15/777-v6.2-04-net-dsa-qca8k-introduce-single-mii-read-write-lo-hi.patch
new file mode 100644
index 00000000000000..c0320ad6f9d8ab
--- /dev/null
+++ b/target/linux/generic/backport-5.15/777-v6.2-04-net-dsa-qca8k-introduce-single-mii-read-write-lo-hi.patch
@@ -0,0 +1,150 @@
+From cfbd6de588ef659c198083205dc954a6d3ed2aec Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 29 Dec 2022 17:33:35 +0100
+Subject: [PATCH 4/5] net: dsa: qca8k: introduce single mii read/write lo/hi
+
+It may be useful to read/write just the lo or hi half of a reg.
+
+This is especially useful for phy poll with the use of mdio master.
+The mdio master reg is composed by the first 16 bit related to setup and
+the other half with the returned data or data to write.
+
+Refactor the mii function to permit single mii read/write of lo or hi
+half of the reg.
+
+Tested-by: Ronald Wahl <ronald.wahl@raritan.com>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c | 106 ++++++++++++++++++++++++-------
+ 1 file changed, 84 insertions(+), 22 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -37,42 +37,104 @@ qca8k_split_addr(u32 regaddr, u16 *r1, u
+ }
+ 
+ static int
+-qca8k_mii_read32(struct mii_bus *bus, int phy_id, u32 regnum, u32 *val)
++qca8k_mii_write_lo(struct mii_bus *bus, int phy_id, u32 regnum, u32 val)
+ {
+ 	int ret;
++	u16 lo;
+ 
+-	ret = bus->read(bus, phy_id, regnum);
+-	if (ret >= 0) {
+-		*val = ret;
+-		ret = bus->read(bus, phy_id, regnum + 1);
+-		*val |= ret << 16;
+-	}
++	lo = val & 0xffff;
++	ret = bus->write(bus, phy_id, regnum, lo);
++	if (ret < 0)
++		dev_err_ratelimited(&bus->dev,
++				    "failed to write qca8k 32bit lo register\n");
++
++	return ret;
++}
+ 
+-	if (ret < 0) {
++static int
++qca8k_mii_write_hi(struct mii_bus *bus, int phy_id, u32 regnum, u32 val)
++{
++	int ret;
++	u16 hi;
++
++	hi = (u16)(val >> 16);
++	ret = bus->write(bus, phy_id, regnum, hi);
++	if (ret < 0)
+ 		dev_err_ratelimited(&bus->dev,
+-				    "failed to read qca8k 32bit register\n");
+-		*val = 0;
+-		return ret;
+-	}
++				    "failed to write qca8k 32bit hi register\n");
+ 
++	return ret;
++}
++
++static int
++qca8k_mii_read_lo(struct mii_bus *bus, int phy_id, u32 regnum, u32 *val)
++{
++	int ret;
++
++	ret = bus->read(bus, phy_id, regnum);
++	if (ret < 0)
++		goto err;
++
++	*val = ret & 0xffff;
+ 	return 0;
++
++err:
++	dev_err_ratelimited(&bus->dev,
++			    "failed to read qca8k 32bit lo register\n");
++	*val = 0;
++
++	return ret;
+ }
+ 
+-static void
+-qca8k_mii_write32(struct mii_bus *bus, int phy_id, u32 regnum, u32 val)
++static int
++qca8k_mii_read_hi(struct mii_bus *bus, int phy_id, u32 regnum, u32 *val)
+ {
+-	u16 lo, hi;
+ 	int ret;
+ 
+-	lo = val & 0xffff;
+-	hi = (u16)(val >> 16);
++	ret = bus->read(bus, phy_id, regnum);
++	if (ret < 0)
++		goto err;
+ 
+-	ret = bus->write(bus, phy_id, regnum, lo);
+-	if (ret >= 0)
+-		ret = bus->write(bus, phy_id, regnum + 1, hi);
++	*val = ret << 16;
++	return 0;
++
++err:
++	dev_err_ratelimited(&bus->dev,
++			    "failed to read qca8k 32bit hi register\n");
++	*val = 0;
++
++	return ret;
++}
++
++static int
++qca8k_mii_read32(struct mii_bus *bus, int phy_id, u32 regnum, u32 *val)
++{
++	u32 hi, lo;
++	int ret;
++
++	*val = 0;
++
++	ret = qca8k_mii_read_lo(bus, phy_id, regnum, &lo);
+ 	if (ret < 0)
+-		dev_err_ratelimited(&bus->dev,
+-				    "failed to write qca8k 32bit register\n");
++		goto err;
++
++	ret = qca8k_mii_read_hi(bus, phy_id, regnum + 1, &hi);
++	if (ret < 0)
++		goto err;
++
++	*val = lo | hi;
++
++err:
++	return ret;
++}
++
++static void
++qca8k_mii_write32(struct mii_bus *bus, int phy_id, u32 regnum, u32 val)
++{
++	if (qca8k_mii_write_lo(bus, phy_id, regnum, val) < 0)
++		return;
++
++	qca8k_mii_write_hi(bus, phy_id, regnum + 1, val);
+ }
+ 
+ static int
diff --git a/target/linux/generic/backport-5.15/777-v6.2-05-net-dsa-qca8k-improve-mdio-master-read-write-by-usin.patch b/target/linux/generic/backport-5.15/777-v6.2-05-net-dsa-qca8k-improve-mdio-master-read-write-by-usin.patch
new file mode 100644
index 00000000000000..4cbb66cf35fac3
--- /dev/null
+++ b/target/linux/generic/backport-5.15/777-v6.2-05-net-dsa-qca8k-improve-mdio-master-read-write-by-usin.patch
@@ -0,0 +1,73 @@
+From a4165830ca237f2b3318faf62562bce8ce12a389 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 29 Dec 2022 17:33:36 +0100
+Subject: [PATCH 5/5] net: dsa: qca8k: improve mdio master read/write by using
+ single lo/hi
+
+Improve mdio master read/write by using singe mii read/write lo/hi.
+
+In a read and write we need to poll the mdio master regs in a busy loop
+to check for a specific bit present in the upper half of the reg. We can
+ignore the other half since it won't contain useful data. This will save
+an additional useless read for each read and write operation.
+
+In a read operation the returned data is present in the mdio master reg
+lower half. We can ignore the other half since it won't contain useful
+data. This will save an additional useless read for each read operation.
+
+In a read operation it's needed to just set the hi half of the mdio
+master reg as the lo half will be replaced by the result. This will save
+an additional useless write for each read operation.
+
+Tested-by: Ronald Wahl <ronald.wahl@raritan.com>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -740,9 +740,9 @@ qca8k_mdio_busy_wait(struct mii_bus *bus
+ 
+ 	qca8k_split_addr(reg, &r1, &r2, &page);
+ 
+-	ret = read_poll_timeout(qca8k_mii_read32, ret1, !(val & mask), 0,
++	ret = read_poll_timeout(qca8k_mii_read_hi, ret1, !(val & mask), 0,
+ 				QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC, false,
+-				bus, 0x10 | r2, r1, &val);
++				bus, 0x10 | r2, r1 + 1, &val);
+ 
+ 	/* Check if qca8k_read has failed for a different reason
+ 	 * before returnting -ETIMEDOUT
+@@ -784,7 +784,7 @@ qca8k_mdio_write(struct qca8k_priv *priv
+ 
+ exit:
+ 	/* even if the busy_wait timeouts try to clear the MASTER_EN */
+-	qca8k_mii_write32(bus, 0x10 | r2, r1, 0);
++	qca8k_mii_write_hi(bus, 0x10 | r2, r1 + 1, 0);
+ 
+ 	mutex_unlock(&bus->mdio_lock);
+ 
+@@ -814,18 +814,18 @@ qca8k_mdio_read(struct qca8k_priv *priv,
+ 	if (ret)
+ 		goto exit;
+ 
+-	qca8k_mii_write32(bus, 0x10 | r2, r1, val);
++	qca8k_mii_write_hi(bus, 0x10 | r2, r1 + 1, val);
+ 
+ 	ret = qca8k_mdio_busy_wait(bus, QCA8K_MDIO_MASTER_CTRL,
+ 				   QCA8K_MDIO_MASTER_BUSY);
+ 	if (ret)
+ 		goto exit;
+ 
+-	ret = qca8k_mii_read32(bus, 0x10 | r2, r1, &val);
++	ret = qca8k_mii_read_lo(bus, 0x10 | r2, r1, &val);
+ 
+ exit:
+ 	/* even if the busy_wait timeouts try to clear the MASTER_EN */
+-	qca8k_mii_write32(bus, 0x10 | r2, r1, 0);
++	qca8k_mii_write_hi(bus, 0x10 | r2, r1 + 1, 0);
+ 
+ 	mutex_unlock(&bus->mdio_lock);
+ 
diff --git a/target/linux/generic/backport-5.15/778-v5.18-01-net-phy-at803x-add-fiber-support.patch b/target/linux/generic/backport-5.15/778-v5.18-01-net-phy-at803x-add-fiber-support.patch
new file mode 100644
index 00000000000000..7cb21ed00d60c4
--- /dev/null
+++ b/target/linux/generic/backport-5.15/778-v5.18-01-net-phy-at803x-add-fiber-support.patch
@@ -0,0 +1,193 @@
+From 3265f421887847db9ae2c01a00645e33608556d8 Mon Sep 17 00:00:00 2001
+From: Robert Hancock <robert.hancock@calian.com>
+Date: Tue, 25 Jan 2022 10:54:09 -0600
+Subject: [PATCH] net: phy: at803x: add fiber support
+
+Previously this driver always forced the copper page to be selected,
+however for AR8031 in 100Base-FX or 1000Base-X modes, the fiber page
+needs to be selected. Set the appropriate mode based on the hardware
+mode_cfg strap selection.
+
+Enable the appropriate interrupt bits to detect fiber-side link up
+or down events.
+
+Update config_aneg and read_status methods to use the appropriate
+Clause 37 calls when fiber mode is in use.
+
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/at803x.c | 76 +++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 67 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/phy/at803x.c
++++ b/drivers/net/phy/at803x.c
+@@ -48,6 +48,8 @@
+ #define AT803X_INTR_ENABLE_PAGE_RECEIVED	BIT(12)
+ #define AT803X_INTR_ENABLE_LINK_FAIL		BIT(11)
+ #define AT803X_INTR_ENABLE_LINK_SUCCESS		BIT(10)
++#define AT803X_INTR_ENABLE_LINK_FAIL_BX		BIT(8)
++#define AT803X_INTR_ENABLE_LINK_SUCCESS_BX	BIT(7)
+ #define AT803X_INTR_ENABLE_WIRESPEED_DOWNGRADE	BIT(5)
+ #define AT803X_INTR_ENABLE_POLARITY_CHANGED	BIT(1)
+ #define AT803X_INTR_ENABLE_WOL			BIT(0)
+@@ -82,6 +84,17 @@
+ 
+ #define AT803X_MODE_CFG_MASK			0x0F
+ #define AT803X_MODE_CFG_SGMII			0x01
++#define AT803X_MODE_CFG_BASET_RGMII		0x00
++#define AT803X_MODE_CFG_BASET_SGMII		0x01
++#define AT803X_MODE_CFG_BX1000_RGMII_50OHM	0x02
++#define AT803X_MODE_CFG_BX1000_RGMII_75OHM	0x03
++#define AT803X_MODE_CFG_BX1000_CONV_50OHM	0x04
++#define AT803X_MODE_CFG_BX1000_CONV_75OHM	0x05
++#define AT803X_MODE_CFG_FX100_RGMII_50OHM	0x06
++#define AT803X_MODE_CFG_FX100_CONV_50OHM	0x07
++#define AT803X_MODE_CFG_RGMII_AUTO_MDET		0x0B
++#define AT803X_MODE_CFG_FX100_RGMII_75OHM	0x0E
++#define AT803X_MODE_CFG_FX100_CONV_75OHM	0x0F
+ 
+ #define AT803X_PSSR				0x11	/*PHY-Specific Status Register*/
+ #define AT803X_PSSR_MR_AN_COMPLETE		0x0200
+@@ -199,6 +212,8 @@ struct at803x_priv {
+ 	u16 clk_25m_mask;
+ 	u8 smarteee_lpi_tw_1g;
+ 	u8 smarteee_lpi_tw_100m;
++	bool is_fiber;
++	bool is_1000basex;
+ 	struct regulator_dev *vddio_rdev;
+ 	struct regulator_dev *vddh_rdev;
+ 	struct regulator *vddio;
+@@ -674,7 +689,33 @@ static int at803x_probe(struct phy_devic
+ 			return ret;
+ 	}
+ 
++	if (phydev->drv->phy_id == ATH8031_PHY_ID) {
++		int ccr = phy_read(phydev, AT803X_REG_CHIP_CONFIG);
++		int mode_cfg;
++
++		if (ccr < 0)
++			goto err;
++		mode_cfg = ccr & AT803X_MODE_CFG_MASK;
++
++		switch (mode_cfg) {
++		case AT803X_MODE_CFG_BX1000_RGMII_50OHM:
++		case AT803X_MODE_CFG_BX1000_RGMII_75OHM:
++			priv->is_1000basex = true;
++			fallthrough;
++		case AT803X_MODE_CFG_FX100_RGMII_50OHM:
++		case AT803X_MODE_CFG_FX100_RGMII_75OHM:
++			priv->is_fiber = true;
++			break;
++		}
++	}
++
+ 	return 0;
++
++err:
++	if (priv->vddio)
++		regulator_disable(priv->vddio);
++
++	return ret;
+ }
+ 
+ static void at803x_remove(struct phy_device *phydev)
+@@ -687,6 +728,7 @@ static void at803x_remove(struct phy_dev
+ 
+ static int at803x_get_features(struct phy_device *phydev)
+ {
++	struct at803x_priv *priv = phydev->priv;
+ 	int err;
+ 
+ 	err = genphy_read_abilities(phydev);
+@@ -704,12 +746,13 @@ static int at803x_get_features(struct ph
+ 	 * As a result of that, ESTATUS_1000_XFULL is set
+ 	 * to 1 even when operating in copper TP mode.
+ 	 *
+-	 * Remove this mode from the supported link modes,
+-	 * as this driver currently only supports copper
+-	 * operation.
++	 * Remove this mode from the supported link modes
++	 * when not operating in 1000BaseX mode.
+ 	 */
+-	linkmode_clear_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT,
+-			   phydev->supported);
++	if (!priv->is_1000basex)
++		linkmode_clear_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT,
++				   phydev->supported);
++
+ 	return 0;
+ }
+ 
+@@ -773,15 +816,18 @@ static int at8031_pll_config(struct phy_
+ 
+ static int at803x_config_init(struct phy_device *phydev)
+ {
++	struct at803x_priv *priv = phydev->priv;
+ 	int ret;
+ 
+ 	if (phydev->drv->phy_id == ATH8031_PHY_ID) {
+ 		/* Some bootloaders leave the fiber page selected.
+-		 * Switch to the copper page, as otherwise we read
+-		 * the PHY capabilities from the fiber side.
++		 * Switch to the appropriate page (fiber or copper), as otherwise we
++		 * read the PHY capabilities from the wrong page.
+ 		 */
+ 		phy_lock_mdio_bus(phydev);
+-		ret = at803x_write_page(phydev, AT803X_PAGE_COPPER);
++		ret = at803x_write_page(phydev,
++					priv->is_fiber ? AT803X_PAGE_FIBER :
++							 AT803X_PAGE_COPPER);
+ 		phy_unlock_mdio_bus(phydev);
+ 		if (ret)
+ 			return ret;
+@@ -840,6 +886,7 @@ static int at803x_ack_interrupt(struct p
+ 
+ static int at803x_config_intr(struct phy_device *phydev)
+ {
++	struct at803x_priv *priv = phydev->priv;
+ 	int err;
+ 	int value;
+ 
+@@ -856,6 +903,10 @@ static int at803x_config_intr(struct phy
+ 		value |= AT803X_INTR_ENABLE_DUPLEX_CHANGED;
+ 		value |= AT803X_INTR_ENABLE_LINK_FAIL;
+ 		value |= AT803X_INTR_ENABLE_LINK_SUCCESS;
++		if (priv->is_fiber) {
++			value |= AT803X_INTR_ENABLE_LINK_FAIL_BX;
++			value |= AT803X_INTR_ENABLE_LINK_SUCCESS_BX;
++		}
+ 
+ 		err = phy_write(phydev, AT803X_INTR_ENABLE, value);
+ 	} else {
+@@ -923,8 +974,12 @@ static void at803x_link_change_notify(st
+ 
+ static int at803x_read_status(struct phy_device *phydev)
+ {
++	struct at803x_priv *priv = phydev->priv;
+ 	int ss, err, old_link = phydev->link;
+ 
++	if (priv->is_1000basex)
++		return genphy_c37_read_status(phydev);
++
+ 	/* Update the link, but return if there was an error */
+ 	err = genphy_update_link(phydev);
+ 	if (err)
+@@ -1023,6 +1078,7 @@ static int at803x_config_mdix(struct phy
+ 
+ static int at803x_config_aneg(struct phy_device *phydev)
+ {
++	struct at803x_priv *priv = phydev->priv;
+ 	int ret;
+ 
+ 	ret = at803x_config_mdix(phydev, phydev->mdix_ctrl);
+@@ -1039,6 +1095,9 @@ static int at803x_config_aneg(struct phy
+ 			return ret;
+ 	}
+ 
++	if (priv->is_1000basex)
++		return genphy_c37_config_aneg(phydev);
++
+ 	return genphy_config_aneg(phydev);
+ }
+ 
diff --git a/target/linux/generic/backport-5.15/778-v5.18-02-net-phy-at803x-support-downstream-SFP-cage.patch b/target/linux/generic/backport-5.15/778-v5.18-02-net-phy-at803x-support-downstream-SFP-cage.patch
new file mode 100644
index 00000000000000..8393cb32e896f0
--- /dev/null
+++ b/target/linux/generic/backport-5.15/778-v5.18-02-net-phy-at803x-support-downstream-SFP-cage.patch
@@ -0,0 +1,95 @@
+From dc4d5fcc5d365c9f70ea3f5c09bdf70e988fad50 Mon Sep 17 00:00:00 2001
+From: Robert Hancock <robert.hancock@calian.com>
+Date: Tue, 25 Jan 2022 10:54:10 -0600
+Subject: [PATCH] net: phy: at803x: Support downstream SFP cage
+
+Add support for downstream SFP cages for AR8031 and AR8033. This is
+primarily intended for fiber modules or direct-attach cables, however
+copper modules which work in 1000Base-X mode may also function. Such
+modules are allowed with a warning.
+
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/at803x.c | 56 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 56 insertions(+)
+
+--- a/drivers/net/phy/at803x.c
++++ b/drivers/net/phy/at803x.c
+@@ -19,6 +19,8 @@
+ #include <linux/regulator/of_regulator.h>
+ #include <linux/regulator/driver.h>
+ #include <linux/regulator/consumer.h>
++#include <linux/phylink.h>
++#include <linux/sfp.h>
+ #include <dt-bindings/net/qca-ar803x.h>
+ 
+ #define AT803X_SPECIFIC_FUNCTION_CONTROL	0x10
+@@ -555,6 +557,55 @@ static int at8031_register_regulators(st
+ 	return 0;
+ }
+ 
++static int at803x_sfp_insert(void *upstream, const struct sfp_eeprom_id *id)
++{
++	struct phy_device *phydev = upstream;
++	__ETHTOOL_DECLARE_LINK_MODE_MASK(phy_support);
++	__ETHTOOL_DECLARE_LINK_MODE_MASK(sfp_support);
++	phy_interface_t iface;
++
++	linkmode_zero(phy_support);
++	phylink_set(phy_support, 1000baseX_Full);
++	phylink_set(phy_support, 1000baseT_Full);
++	phylink_set(phy_support, Autoneg);
++	phylink_set(phy_support, Pause);
++	phylink_set(phy_support, Asym_Pause);
++
++	linkmode_zero(sfp_support);
++	sfp_parse_support(phydev->sfp_bus, id, sfp_support);
++	/* Some modules support 10G modes as well as others we support.
++	 * Mask out non-supported modes so the correct interface is picked.
++	 */
++	linkmode_and(sfp_support, phy_support, sfp_support);
++
++	if (linkmode_empty(sfp_support)) {
++		dev_err(&phydev->mdio.dev, "incompatible SFP module inserted\n");
++		return -EINVAL;
++	}
++
++	iface = sfp_select_interface(phydev->sfp_bus, sfp_support);
++
++	/* Only 1000Base-X is supported by AR8031/8033 as the downstream SerDes
++	 * interface for use with SFP modules.
++	 * However, some copper modules detected as having a preferred SGMII
++	 * interface do default to and function in 1000Base-X mode, so just
++	 * print a warning and allow such modules, as they may have some chance
++	 * of working.
++	 */
++	if (iface == PHY_INTERFACE_MODE_SGMII)
++		dev_warn(&phydev->mdio.dev, "module may not function if 1000Base-X not supported\n");
++	else if (iface != PHY_INTERFACE_MODE_1000BASEX)
++		return -EINVAL;
++
++	return 0;
++}
++
++static const struct sfp_upstream_ops at803x_sfp_ops = {
++	.attach = phy_sfp_attach,
++	.detach = phy_sfp_detach,
++	.module_insert = at803x_sfp_insert,
++};
++
+ static int at803x_parse_dt(struct phy_device *phydev)
+ {
+ 	struct device_node *node = phydev->mdio.dev.of_node;
+@@ -662,6 +713,11 @@ static int at803x_parse_dt(struct phy_de
+ 			phydev_err(phydev, "failed to get VDDIO regulator\n");
+ 			return PTR_ERR(priv->vddio);
+ 		}
++
++		/* Only AR8031/8033 support 1000Base-X for SFP modules */
++		ret = phy_sfp_probe(phydev, &at803x_sfp_ops);
++		if (ret < 0)
++			return ret;
+ 	}
+ 
+ 	return 0;
diff --git a/target/linux/generic/backport-5.15/778-v5.18-03-net-phy-at803x-fix-NULL-pointer-dereference-on-AR9331-PHY.patch b/target/linux/generic/backport-5.15/778-v5.18-03-net-phy-at803x-fix-NULL-pointer-dereference-on-AR9331-PHY.patch
new file mode 100644
index 00000000000000..de8951db10cf10
--- /dev/null
+++ b/target/linux/generic/backport-5.15/778-v5.18-03-net-phy-at803x-fix-NULL-pointer-dereference-on-AR9331-PHY.patch
@@ -0,0 +1,56 @@
+From 9926de7315be3d606cc011a305ad9adb9e8e14c9 Mon Sep 17 00:00:00 2001
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+Date: Sat, 18 Jun 2022 14:23:33 +0200
+Subject: [PATCH] net: phy: at803x: fix NULL pointer dereference on AR9331 PHY
+
+Latest kernel will explode on the PHY interrupt config, since it depends
+now on allocated priv. So, run probe to allocate priv to fix it.
+
+ ar9331_switch ethernet.1:10 lan0 (uninitialized): PHY [!ahb!ethernet@1a000000!mdio!switch@10:00] driver [Qualcomm Atheros AR9331 built-in PHY] (irq=13)
+ CPU 0 Unable to handle kernel paging request at virtual address 0000000a, epc == 8050e8a8, ra == 80504b34
+         ...
+ Call Trace:
+ [<8050e8a8>] at803x_config_intr+0x5c/0xd0
+ [<80504b34>] phy_request_interrupt+0xa8/0xd0
+ [<8050289c>] phylink_bringup_phy+0x2d8/0x3ac
+ [<80502b68>] phylink_fwnode_phy_connect+0x118/0x130
+ [<8074d8ec>] dsa_slave_create+0x270/0x420
+ [<80743b04>] dsa_port_setup+0x12c/0x148
+ [<8074580c>] dsa_register_switch+0xaf0/0xcc0
+ [<80511344>] ar9331_sw_probe+0x370/0x388
+ [<8050cb78>] mdio_probe+0x44/0x70
+ [<804df300>] really_probe+0x200/0x424
+ [<804df7b4>] __driver_probe_device+0x290/0x298
+ [<804df810>] driver_probe_device+0x54/0xe4
+ [<804dfd50>] __device_attach_driver+0xe4/0x130
+ [<804dcb00>] bus_for_each_drv+0xb4/0xd8
+ [<804dfac4>] __device_attach+0x104/0x1a4
+ [<804ddd24>] bus_probe_device+0x48/0xc4
+ [<804deb44>] deferred_probe_work_func+0xf0/0x10c
+ [<800a0ffc>] process_one_work+0x314/0x4d4
+ [<800a17fc>] worker_thread+0x2a4/0x354
+ [<800a9a54>] kthread+0x134/0x13c
+ [<8006306c>] ret_from_kernel_thread+0x14/0x1c
+
+Same Issue would affect some other PHYs (QCA8081, QCA9561), so fix it
+too.
+
+Fixes: 3265f4218878 ("net: phy: at803x: add fiber support")
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/at803x.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/phy/at803x.c
++++ b/drivers/net/phy/at803x.c
+@@ -1594,6 +1594,8 @@ static struct phy_driver at803x_driver[]
+ 	/* ATHEROS AR9331 */
+ 	PHY_ID_MATCH_EXACT(ATH9331_PHY_ID),
+ 	.name			= "Qualcomm Atheros AR9331 built-in PHY",
++	.probe			= at803x_probe,
++	.remove			= at803x_remove,
+ 	.suspend		= at803x_suspend,
+ 	.resume			= at803x_resume,
+ 	.flags			= PHY_POLL_CABLE_TEST,
diff --git a/target/linux/generic/backport-5.15/778-v5.18-04-net-phy-at803x-fix-error-return-code-in-at803x_probe.patch b/target/linux/generic/backport-5.15/778-v5.18-04-net-phy-at803x-fix-error-return-code-in-at803x_probe.patch
new file mode 100644
index 00000000000000..cdae5b4ca423de
--- /dev/null
+++ b/target/linux/generic/backport-5.15/778-v5.18-04-net-phy-at803x-fix-error-return-code-in-at803x_probe.patch
@@ -0,0 +1,31 @@
+From 1f0dd412e34e177621769866bef347f0b22364df Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Fri, 18 Nov 2022 10:36:35 +0000
+Subject: [PATCH] net: phy: at803x: fix error return code in at803x_probe()
+
+Fix to return a negative error code from the ccr read error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 3265f4218878 ("net: phy: at803x: add fiber support")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20221118103635.254256-1-weiyongjun@huaweicloud.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/at803x.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/phy/at803x.c
++++ b/drivers/net/phy/at803x.c
+@@ -749,8 +749,10 @@ static int at803x_probe(struct phy_devic
+ 		int ccr = phy_read(phydev, AT803X_REG_CHIP_CONFIG);
+ 		int mode_cfg;
+ 
+-		if (ccr < 0)
++		if (ccr < 0) {
++			ret = ccr;
+ 			goto err;
++		}
+ 		mode_cfg = ccr & AT803X_MODE_CFG_MASK;
+ 
+ 		switch (mode_cfg) {
diff --git a/target/linux/generic/backport-5.15/780-v5.16-bus-mhi-pci_generic-Introduce-Sierra-EM919X-support.patch b/target/linux/generic/backport-5.15/780-v5.16-bus-mhi-pci_generic-Introduce-Sierra-EM919X-support.patch
index 5fe10e0caa5d59..44f0864e9a8369 100644
--- a/target/linux/generic/backport-5.15/780-v5.16-bus-mhi-pci_generic-Introduce-Sierra-EM919X-support.patch
+++ b/target/linux/generic/backport-5.15/780-v5.16-bus-mhi-pci_generic-Introduce-Sierra-EM919X-support.patch
@@ -16,11 +16,11 @@ Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
 Link: https://lore.kernel.org/r/20211216081227.237749-11-manivannan.sadhasivam@linaro.org
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
- drivers/bus/mhi/pci_generic.c | 43 +++++++++++++++++++++++++++++++++++
+ drivers/bus/mhi/host/pci_generic.c | 43 +++++++++++++++++++++++++++++++++++
  1 file changed, 43 insertions(+)
 
---- a/drivers/bus/mhi/pci_generic.c
-+++ b/drivers/bus/mhi/pci_generic.c
+--- a/drivers/bus/mhi/host/pci_generic.c
++++ b/drivers/bus/mhi/host/pci_generic.c
 @@ -406,6 +406,46 @@ static const struct mhi_pci_dev_info mhi
  	.mru_default = 32768,
  };
diff --git a/target/linux/generic/backport-5.15/781-v6.1-bus-mhi-host-always-print-detected-modem-name.patch b/target/linux/generic/backport-5.15/781-v6.1-bus-mhi-host-always-print-detected-modem-name.patch
new file mode 100644
index 00000000000000..3c71a27b79871b
--- /dev/null
+++ b/target/linux/generic/backport-5.15/781-v6.1-bus-mhi-host-always-print-detected-modem-name.patch
@@ -0,0 +1,37 @@
+From f369e9ad52ec9361827e21a631b7198c9fca438e Mon Sep 17 00:00:00 2001
+From: Koen Vandeputte <koen.vandeputte@citymesh.com>
+Date: Wed, 31 Aug 2022 12:03:49 +0200
+Subject: [PATCH] bus: mhi: host: always print detected modem name
+
+This harmless print provides a very easy way of knowing
+if the modem is detected properly during probing.
+
+Promote it to an informational print so no hassle is required
+enabling kernel debugging info to obtain it.
+
+The rationale here is that:
+On a lot of low-storage embedded devices, extensive kernel
+debugging info is not always present as this would
+increase it's size to much causing partition size issues.
+
+Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Loic Poulain <loic.poulain@linaro.org>
+Link: https://lore.kernel.org/r/20220831100349.1488762-1-koen.vandeputte@citymesh.com
+[mani: added missing review tags]
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+---
+ drivers/bus/mhi/host/pci_generic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/bus/mhi/host/pci_generic.c
++++ b/drivers/bus/mhi/host/pci_generic.c
+@@ -806,7 +806,7 @@ static int mhi_pci_probe(struct pci_dev
+ 	struct mhi_controller *mhi_cntrl;
+ 	int err;
+ 
+-	dev_dbg(&pdev->dev, "MHI PCI device found: %s\n", info->name);
++	dev_info(&pdev->dev, "MHI PCI device found: %s\n", info->name);
+ 
+ 	/* mhi_pdev.mhi_cntrl must be zero-initialized */
+ 	mhi_pdev = devm_kzalloc(&pdev->dev, sizeof(*mhi_pdev), GFP_KERNEL);
diff --git a/target/linux/generic/backport-5.15/782-v6.1-net-dsa-mt7530-add-support-for-in-band-link-status.patch b/target/linux/generic/backport-5.15/782-v6.1-net-dsa-mt7530-add-support-for-in-band-link-status.patch
new file mode 100644
index 00000000000000..377ee76171c055
--- /dev/null
+++ b/target/linux/generic/backport-5.15/782-v6.1-net-dsa-mt7530-add-support-for-in-band-link-status.patch
@@ -0,0 +1,130 @@
+From e19de30d20809af3221ef8a2648b8a8a52e02d90 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Wed, 21 Sep 2022 01:23:14 +0100
+Subject: [PATCH 1/1] net: dsa: mt7530: add support for in-band link status
+
+Read link status from SGMII PCS for in-band managed 2500Base-X and
+1000Base-X connection on a MAC port of the MT7531. This is needed to
+get the SFP cage working which is connected to SGMII interface of
+port 5 of the MT7531 switch IC on the Bananapi BPi-R3 board.
+While at it also handle an_complete for both the autoneg and the
+non-autoneg codepath.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/mt7530.c | 50 +++++++++++++++++++++++++++++-----------
+ drivers/net/dsa/mt7530.h |  1 +
+ 2 files changed, 38 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -2736,9 +2736,6 @@ mt7531_mac_config(struct dsa_switch *ds,
+ 	case PHY_INTERFACE_MODE_NA:
+ 	case PHY_INTERFACE_MODE_1000BASEX:
+ 	case PHY_INTERFACE_MODE_2500BASEX:
+-		if (phylink_autoneg_inband(mode))
+-			return -EINVAL;
+-
+ 		return mt7531_sgmii_setup_mode_force(priv, port, interface);
+ 	default:
+ 		return -EINVAL;
+@@ -2814,13 +2811,6 @@ unsupported:
+ 		return;
+ 	}
+ 
+-	if (phylink_autoneg_inband(mode) &&
+-	    state->interface != PHY_INTERFACE_MODE_SGMII) {
+-		dev_err(ds->dev, "%s: in-band negotiation unsupported\n",
+-			__func__);
+-		return;
+-	}
+-
+ 	mcr_cur = mt7530_read(priv, MT7530_PMCR_P(port));
+ 	mcr_new = mcr_cur;
+ 	mcr_new &= ~PMCR_LINK_SETTINGS_MASK;
+@@ -2957,6 +2947,9 @@ static void mt753x_phylink_get_caps(stru
+ 	config->mac_capabilities = MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
+ 				   MAC_10 | MAC_100 | MAC_1000FD;
+ 
++	if ((priv->id == ID_MT7531) && mt753x_is_mac_port(port))
++		config->mac_capabilities |= MAC_2500FD;
++
+ 	/* This driver does not make use of the speed, duplex, pause or the
+ 	 * advertisement in its mac_config, so it is safe to mark this driver
+ 	 * as non-legacy.
+@@ -3022,6 +3015,7 @@ mt7531_sgmii_pcs_get_state_an(struct mt7
+ 
+ 	status = mt7530_read(priv, MT7531_PCS_CONTROL_1(port));
+ 	state->link = !!(status & MT7531_SGMII_LINK_STATUS);
++	state->an_complete = !!(status & MT7531_SGMII_AN_COMPLETE);
+ 	if (state->interface == PHY_INTERFACE_MODE_SGMII &&
+ 	    (status & MT7531_SGMII_AN_ENABLE)) {
+ 		val = mt7530_read(priv, MT7531_PCS_SPEED_ABILITY(port));
+@@ -3052,16 +3046,44 @@ mt7531_sgmii_pcs_get_state_an(struct mt7
+ 	return 0;
+ }
+ 
++static void
++mt7531_sgmii_pcs_get_state_inband(struct mt7530_priv *priv, int port,
++				  struct phylink_link_state *state)
++{
++	unsigned int val;
++
++	val = mt7530_read(priv, MT7531_PCS_CONTROL_1(port));
++	state->link = !!(val & MT7531_SGMII_LINK_STATUS);
++	if (!state->link)
++		return;
++
++	state->an_complete = state->link;
++
++	if (state->interface == PHY_INTERFACE_MODE_2500BASEX)
++		state->speed = SPEED_2500;
++	else
++		state->speed = SPEED_1000;
++
++	state->duplex = DUPLEX_FULL;
++	state->pause = MLO_PAUSE_NONE;
++}
++
+ static void mt7531_pcs_get_state(struct phylink_pcs *pcs,
+ 				 struct phylink_link_state *state)
+ {
+ 	struct mt7530_priv *priv = pcs_to_mt753x_pcs(pcs)->priv;
+ 	int port = pcs_to_mt753x_pcs(pcs)->port;
+ 
+-	if (state->interface == PHY_INTERFACE_MODE_SGMII)
++	if (state->interface == PHY_INTERFACE_MODE_SGMII) {
+ 		mt7531_sgmii_pcs_get_state_an(priv, port, state);
+-	else
+-		state->link = false;
++		return;
++	} else if ((state->interface == PHY_INTERFACE_MODE_1000BASEX) ||
++		   (state->interface == PHY_INTERFACE_MODE_2500BASEX)) {
++		mt7531_sgmii_pcs_get_state_inband(priv, port, state);
++		return;
++	}
++
++	state->link = false;
+ }
+ 
+ static int mt753x_pcs_config(struct phylink_pcs *pcs, unsigned int mode,
+@@ -3102,6 +3124,8 @@ mt753x_setup(struct dsa_switch *ds)
+ 		priv->pcs[i].pcs.ops = priv->info->pcs_ops;
+ 		priv->pcs[i].priv = priv;
+ 		priv->pcs[i].port = i;
++		if (mt753x_is_mac_port(i))
++			priv->pcs[i].pcs.poll = 1;
+ 	}
+ 
+ 	ret = priv->info->sw_setup(ds);
+--- a/drivers/net/dsa/mt7530.h
++++ b/drivers/net/dsa/mt7530.h
+@@ -373,6 +373,7 @@ enum mt7530_vlan_port_acc_frm {
+ #define  MT7531_SGMII_LINK_STATUS	BIT(18)
+ #define  MT7531_SGMII_AN_ENABLE		BIT(12)
+ #define  MT7531_SGMII_AN_RESTART	BIT(9)
++#define  MT7531_SGMII_AN_COMPLETE	BIT(21)
+ 
+ /* Register for SGMII PCS_SPPED_ABILITY */
+ #define MT7531_PCS_SPEED_ABILITY(p)	MT7531_SGMII_REG(p, 0x08)
diff --git a/target/linux/generic/backport-5.15/783-v6.1-net-sfp-re-implement-soft-state-polling-setup.patch b/target/linux/generic/backport-5.15/783-v6.1-net-sfp-re-implement-soft-state-polling-setup.patch
new file mode 100644
index 00000000000000..77cd336d364c83
--- /dev/null
+++ b/target/linux/generic/backport-5.15/783-v6.1-net-sfp-re-implement-soft-state-polling-setup.patch
@@ -0,0 +1,98 @@
+From 8475c4b70b040f9d8cbc308100f2c4d865f810b3 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Tue, 13 Sep 2022 20:06:27 +0100
+Subject: [PATCH 1/1] net: sfp: re-implement soft state polling setup
+
+Re-implement the decision making for soft state polling. Instead of
+generating the soft state mask in sfp_soft_start_poll() by looking at
+which GPIOs are available, record their availability in
+sfp_sm_mod_probe() in sfp->state_hw_mask.
+
+This will then allow us to clear bits in sfp->state_hw_mask in module
+specific quirks when the hardware signals should not be used, thereby
+allowing us to switch to using the software state polling.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/sfp.c | 38 ++++++++++++++++++++++++++------------
+ 1 file changed, 26 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -240,6 +240,7 @@ struct sfp {
+ 	bool need_poll;
+ 
+ 	struct mutex st_mutex;			/* Protects state */
++	unsigned int state_hw_mask;
+ 	unsigned int state_soft_mask;
+ 	unsigned int state;
+ 	struct delayed_work poll;
+@@ -505,17 +506,18 @@ static void sfp_soft_set_state(struct sf
+ static void sfp_soft_start_poll(struct sfp *sfp)
+ {
+ 	const struct sfp_eeprom_id *id = &sfp->id;
++	unsigned int mask = 0;
+ 
+ 	sfp->state_soft_mask = 0;
+-	if (id->ext.enhopts & SFP_ENHOPTS_SOFT_TX_DISABLE &&
+-	    !sfp->gpio[GPIO_TX_DISABLE])
+-		sfp->state_soft_mask |= SFP_F_TX_DISABLE;
+-	if (id->ext.enhopts & SFP_ENHOPTS_SOFT_TX_FAULT &&
+-	    !sfp->gpio[GPIO_TX_FAULT])
+-		sfp->state_soft_mask |= SFP_F_TX_FAULT;
+-	if (id->ext.enhopts & SFP_ENHOPTS_SOFT_RX_LOS &&
+-	    !sfp->gpio[GPIO_LOS])
+-		sfp->state_soft_mask |= SFP_F_LOS;
++	if (id->ext.enhopts & SFP_ENHOPTS_SOFT_TX_DISABLE)
++		mask |= SFP_F_TX_DISABLE;
++	if (id->ext.enhopts & SFP_ENHOPTS_SOFT_TX_FAULT)
++		mask |= SFP_F_TX_FAULT;
++	if (id->ext.enhopts & SFP_ENHOPTS_SOFT_RX_LOS)
++		mask |= SFP_F_LOS;
++
++	// Poll the soft state for hardware pins we want to ignore
++	sfp->state_soft_mask = ~sfp->state_hw_mask & mask;
+ 
+ 	if (sfp->state_soft_mask & (SFP_F_LOS | SFP_F_TX_FAULT) &&
+ 	    !sfp->need_poll)
+@@ -529,10 +531,11 @@ static void sfp_soft_stop_poll(struct sf
+ 
+ static unsigned int sfp_get_state(struct sfp *sfp)
+ {
+-	unsigned int state = sfp->get_state(sfp);
++	unsigned int soft = sfp->state_soft_mask & (SFP_F_LOS | SFP_F_TX_FAULT);
++	unsigned int state;
+ 
+-	if (state & SFP_F_PRESENT &&
+-	    sfp->state_soft_mask & (SFP_F_LOS | SFP_F_TX_FAULT))
++	state = sfp->get_state(sfp) & sfp->state_hw_mask;
++	if (state & SFP_F_PRESENT && soft)
+ 		state |= sfp_soft_get_state(sfp);
+ 
+ 	return state;
+@@ -1942,6 +1945,15 @@ static int sfp_sm_mod_probe(struct sfp *
+ 	if (ret < 0)
+ 		return ret;
+ 
++	/* Initialise state bits to use from hardware */
++	sfp->state_hw_mask = SFP_F_PRESENT;
++	if (sfp->gpio[GPIO_TX_DISABLE])
++		sfp->state_hw_mask |= SFP_F_TX_DISABLE;
++	if (sfp->gpio[GPIO_TX_FAULT])
++		sfp->state_hw_mask |= SFP_F_TX_FAULT;
++	if (sfp->gpio[GPIO_LOS])
++		sfp->state_hw_mask |= SFP_F_LOS;
++
+ 	if (!memcmp(id.base.vendor_name, "ALCATELLUCENT   ", 16) &&
+ 	    !memcmp(id.base.vendor_pn, "3FE46541AA      ", 16))
+ 		sfp->module_t_start_up = T_START_UP_BAD_GPON;
+@@ -2568,6 +2580,8 @@ static int sfp_probe(struct platform_dev
+ 				return PTR_ERR(sfp->gpio[i]);
+ 		}
+ 
++	sfp->state_hw_mask = SFP_F_PRESENT;
++
+ 	sfp->get_state = sfp_gpio_get_state;
+ 	sfp->set_state = sfp_gpio_set_state;
+ 
diff --git a/target/linux/generic/backport-5.15/784-v6.1-net-sfp-move-quirk-handling-into-sfp.c.patch b/target/linux/generic/backport-5.15/784-v6.1-net-sfp-move-quirk-handling-into-sfp.c.patch
new file mode 100644
index 00000000000000..02fa28c5af296d
--- /dev/null
+++ b/target/linux/generic/backport-5.15/784-v6.1-net-sfp-move-quirk-handling-into-sfp.c.patch
@@ -0,0 +1,291 @@
+From 23571c7b96437483d28a990c906cc81f5f66374e Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Tue, 13 Sep 2022 20:06:32 +0100
+Subject: [PATCH 1/1] net: sfp: move quirk handling into sfp.c
+
+We need to handle more quirks than just those which affect the link
+modes of the module. Move the quirk lookup into sfp.c, and pass the
+quirk to sfp-bus.c
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/sfp-bus.c | 98 ++-------------------------------------
+ drivers/net/phy/sfp.c     | 94 ++++++++++++++++++++++++++++++++++++-
+ drivers/net/phy/sfp.h     |  9 +++-
+ 3 files changed, 104 insertions(+), 97 deletions(-)
+
+--- a/drivers/net/phy/sfp-bus.c
++++ b/drivers/net/phy/sfp-bus.c
+@@ -10,12 +10,6 @@
+ 
+ #include "sfp.h"
+ 
+-struct sfp_quirk {
+-	const char *vendor;
+-	const char *part;
+-	void (*modes)(const struct sfp_eeprom_id *id, unsigned long *modes);
+-};
+-
+ /**
+  * struct sfp_bus - internal representation of a sfp bus
+  */
+@@ -38,93 +32,6 @@ struct sfp_bus {
+ 	bool started;
+ };
+ 
+-static void sfp_quirk_2500basex(const struct sfp_eeprom_id *id,
+-				unsigned long *modes)
+-{
+-	phylink_set(modes, 2500baseX_Full);
+-}
+-
+-static void sfp_quirk_ubnt_uf_instant(const struct sfp_eeprom_id *id,
+-				      unsigned long *modes)
+-{
+-	/* Ubiquiti U-Fiber Instant module claims that support all transceiver
+-	 * types including 10G Ethernet which is not truth. So clear all claimed
+-	 * modes and set only one mode which module supports: 1000baseX_Full.
+-	 */
+-	phylink_zero(modes);
+-	phylink_set(modes, 1000baseX_Full);
+-}
+-
+-static const struct sfp_quirk sfp_quirks[] = {
+-	{
+-		// Alcatel Lucent G-010S-P can operate at 2500base-X, but
+-		// incorrectly report 2500MBd NRZ in their EEPROM
+-		.vendor = "ALCATELLUCENT",
+-		.part = "G010SP",
+-		.modes = sfp_quirk_2500basex,
+-	}, {
+-		// Alcatel Lucent G-010S-A can operate at 2500base-X, but
+-		// report 3.2GBd NRZ in their EEPROM
+-		.vendor = "ALCATELLUCENT",
+-		.part = "3FE46541AA",
+-		.modes = sfp_quirk_2500basex,
+-	}, {
+-		// Huawei MA5671A can operate at 2500base-X, but report 1.2GBd
+-		// NRZ in their EEPROM
+-		.vendor = "HUAWEI",
+-		.part = "MA5671A",
+-		.modes = sfp_quirk_2500basex,
+-	}, {
+-		// Lantech 8330-262D-E can operate at 2500base-X, but
+-		// incorrectly report 2500MBd NRZ in their EEPROM
+-		.vendor = "Lantech",
+-		.part = "8330-262D-E",
+-		.modes = sfp_quirk_2500basex,
+-	}, {
+-		.vendor = "UBNT",
+-		.part = "UF-INSTANT",
+-		.modes = sfp_quirk_ubnt_uf_instant,
+-	},
+-};
+-
+-static size_t sfp_strlen(const char *str, size_t maxlen)
+-{
+-	size_t size, i;
+-
+-	/* Trailing characters should be filled with space chars */
+-	for (i = 0, size = 0; i < maxlen; i++)
+-		if (str[i] != ' ')
+-			size = i + 1;
+-
+-	return size;
+-}
+-
+-static bool sfp_match(const char *qs, const char *str, size_t len)
+-{
+-	if (!qs)
+-		return true;
+-	if (strlen(qs) != len)
+-		return false;
+-	return !strncmp(qs, str, len);
+-}
+-
+-static const struct sfp_quirk *sfp_lookup_quirk(const struct sfp_eeprom_id *id)
+-{
+-	const struct sfp_quirk *q;
+-	unsigned int i;
+-	size_t vs, ps;
+-
+-	vs = sfp_strlen(id->base.vendor_name, ARRAY_SIZE(id->base.vendor_name));
+-	ps = sfp_strlen(id->base.vendor_pn, ARRAY_SIZE(id->base.vendor_pn));
+-
+-	for (i = 0, q = sfp_quirks; i < ARRAY_SIZE(sfp_quirks); i++, q++)
+-		if (sfp_match(q->vendor, id->base.vendor_name, vs) &&
+-		    sfp_match(q->part, id->base.vendor_pn, ps))
+-			return q;
+-
+-	return NULL;
+-}
+-
+ /**
+  * sfp_parse_port() - Parse the EEPROM base ID, setting the port type
+  * @bus: a pointer to the &struct sfp_bus structure for the sfp module
+@@ -786,12 +693,13 @@ void sfp_link_down(struct sfp_bus *bus)
+ }
+ EXPORT_SYMBOL_GPL(sfp_link_down);
+ 
+-int sfp_module_insert(struct sfp_bus *bus, const struct sfp_eeprom_id *id)
++int sfp_module_insert(struct sfp_bus *bus, const struct sfp_eeprom_id *id,
++		      const struct sfp_quirk *quirk)
+ {
+ 	const struct sfp_upstream_ops *ops = sfp_get_upstream_ops(bus);
+ 	int ret = 0;
+ 
+-	bus->sfp_quirk = sfp_lookup_quirk(id);
++	bus->sfp_quirk = quirk;
+ 
+ 	if (ops && ops->module_insert)
+ 		ret = ops->module_insert(bus->upstream, id);
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -259,6 +259,8 @@ struct sfp {
+ 	unsigned int module_t_start_up;
+ 	bool tx_fault_ignore;
+ 
++	const struct sfp_quirk *quirk;
++
+ #if IS_ENABLED(CONFIG_HWMON)
+ 	struct sfp_diag diag;
+ 	struct delayed_work hwmon_probe;
+@@ -315,6 +317,93 @@ static const struct of_device_id sfp_of_
+ };
+ MODULE_DEVICE_TABLE(of, sfp_of_match);
+ 
++static void sfp_quirk_2500basex(const struct sfp_eeprom_id *id,
++				unsigned long *modes)
++{
++	linkmode_set_bit(ETHTOOL_LINK_MODE_2500baseX_Full_BIT, modes);
++}
++
++static void sfp_quirk_ubnt_uf_instant(const struct sfp_eeprom_id *id,
++				      unsigned long *modes)
++{
++	/* Ubiquiti U-Fiber Instant module claims that support all transceiver
++	 * types including 10G Ethernet which is not truth. So clear all claimed
++	 * modes and set only one mode which module supports: 1000baseX_Full.
++	 */
++	linkmode_zero(modes);
++	linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT, modes);
++}
++
++static const struct sfp_quirk sfp_quirks[] = {
++	{
++		// Alcatel Lucent G-010S-P can operate at 2500base-X, but
++		// incorrectly report 2500MBd NRZ in their EEPROM
++		.vendor = "ALCATELLUCENT",
++		.part = "G010SP",
++		.modes = sfp_quirk_2500basex,
++	}, {
++		// Alcatel Lucent G-010S-A can operate at 2500base-X, but
++		// report 3.2GBd NRZ in their EEPROM
++		.vendor = "ALCATELLUCENT",
++		.part = "3FE46541AA",
++		.modes = sfp_quirk_2500basex,
++	}, {
++		// Huawei MA5671A can operate at 2500base-X, but report 1.2GBd
++		// NRZ in their EEPROM
++		.vendor = "HUAWEI",
++		.part = "MA5671A",
++		.modes = sfp_quirk_2500basex,
++	}, {
++		// Lantech 8330-262D-E can operate at 2500base-X, but
++		// incorrectly report 2500MBd NRZ in their EEPROM
++		.vendor = "Lantech",
++		.part = "8330-262D-E",
++		.modes = sfp_quirk_2500basex,
++	}, {
++		.vendor = "UBNT",
++		.part = "UF-INSTANT",
++		.modes = sfp_quirk_ubnt_uf_instant,
++	},
++};
++
++static size_t sfp_strlen(const char *str, size_t maxlen)
++{
++	size_t size, i;
++
++	/* Trailing characters should be filled with space chars */
++	for (i = 0, size = 0; i < maxlen; i++)
++		if (str[i] != ' ')
++			size = i + 1;
++
++	return size;
++}
++
++static bool sfp_match(const char *qs, const char *str, size_t len)
++{
++	if (!qs)
++		return true;
++	if (strlen(qs) != len)
++		return false;
++	return !strncmp(qs, str, len);
++}
++
++static const struct sfp_quirk *sfp_lookup_quirk(const struct sfp_eeprom_id *id)
++{
++	const struct sfp_quirk *q;
++	unsigned int i;
++	size_t vs, ps;
++
++	vs = sfp_strlen(id->base.vendor_name, ARRAY_SIZE(id->base.vendor_name));
++	ps = sfp_strlen(id->base.vendor_pn, ARRAY_SIZE(id->base.vendor_pn));
++
++	for (i = 0, q = sfp_quirks; i < ARRAY_SIZE(sfp_quirks); i++, q++)
++		if (sfp_match(q->vendor, id->base.vendor_name, vs) &&
++		    sfp_match(q->part, id->base.vendor_pn, ps))
++			return q;
++
++	return NULL;
++}
++
+ static unsigned long poll_jiffies;
+ 
+ static unsigned int sfp_gpio_get_state(struct sfp *sfp)
+@@ -1966,6 +2055,8 @@ static int sfp_sm_mod_probe(struct sfp *
+ 	else
+ 		sfp->tx_fault_ignore = false;
+ 
++	sfp->quirk = sfp_lookup_quirk(&id);
++
+ 	return 0;
+ }
+ 
+@@ -2077,7 +2168,8 @@ static void sfp_sm_module(struct sfp *sf
+ 			break;
+ 
+ 		/* Report the module insertion to the upstream device */
+-		err = sfp_module_insert(sfp->sfp_bus, &sfp->id);
++		err = sfp_module_insert(sfp->sfp_bus, &sfp->id,
++					sfp->quirk);
+ 		if (err < 0) {
+ 			sfp_sm_mod_next(sfp, SFP_MOD_ERROR, 0);
+ 			break;
+--- a/drivers/net/phy/sfp.h
++++ b/drivers/net/phy/sfp.h
+@@ -6,6 +6,12 @@
+ 
+ struct sfp;
+ 
++struct sfp_quirk {
++	const char *vendor;
++	const char *part;
++	void (*modes)(const struct sfp_eeprom_id *id, unsigned long *modes);
++};
++
+ struct sfp_socket_ops {
+ 	void (*attach)(struct sfp *sfp);
+ 	void (*detach)(struct sfp *sfp);
+@@ -23,7 +29,8 @@ int sfp_add_phy(struct sfp_bus *bus, str
+ void sfp_remove_phy(struct sfp_bus *bus);
+ void sfp_link_up(struct sfp_bus *bus);
+ void sfp_link_down(struct sfp_bus *bus);
+-int sfp_module_insert(struct sfp_bus *bus, const struct sfp_eeprom_id *id);
++int sfp_module_insert(struct sfp_bus *bus, const struct sfp_eeprom_id *id,
++		      const struct sfp_quirk *quirk);
+ void sfp_module_remove(struct sfp_bus *bus);
+ int sfp_module_start(struct sfp_bus *bus);
+ void sfp_module_stop(struct sfp_bus *bus);
diff --git a/target/linux/generic/backport-5.15/785-v6.1-net-sfp-move-Alcatel-Lucent-3FE46541AA-fixup.patch b/target/linux/generic/backport-5.15/785-v6.1-net-sfp-move-Alcatel-Lucent-3FE46541AA-fixup.patch
new file mode 100644
index 00000000000000..b076676cff6de7
--- /dev/null
+++ b/target/linux/generic/backport-5.15/785-v6.1-net-sfp-move-Alcatel-Lucent-3FE46541AA-fixup.patch
@@ -0,0 +1,69 @@
+From 275416754e9a262c97a1ad6f806a4bc6e0464aa2 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Tue, 13 Sep 2022 20:06:37 +0100
+Subject: [PATCH 1/1] net: sfp: move Alcatel Lucent 3FE46541AA fixup
+
+Add a new fixup mechanism to the SFP quirks, and use it for this
+module.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/sfp.c | 14 +++++++++-----
+ drivers/net/phy/sfp.h |  1 +
+ 2 files changed, 10 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -317,6 +317,11 @@ static const struct of_device_id sfp_of_
+ };
+ MODULE_DEVICE_TABLE(of, sfp_of_match);
+ 
++static void sfp_fixup_long_startup(struct sfp *sfp)
++{
++	sfp->module_t_start_up = T_START_UP_BAD_GPON;
++}
++
+ static void sfp_quirk_2500basex(const struct sfp_eeprom_id *id,
+ 				unsigned long *modes)
+ {
+@@ -347,6 +352,7 @@ static const struct sfp_quirk sfp_quirks
+ 		.vendor = "ALCATELLUCENT",
+ 		.part = "3FE46541AA",
+ 		.modes = sfp_quirk_2500basex,
++		.fixup = sfp_fixup_long_startup,
+ 	}, {
+ 		// Huawei MA5671A can operate at 2500base-X, but report 1.2GBd
+ 		// NRZ in their EEPROM
+@@ -2043,11 +2049,7 @@ static int sfp_sm_mod_probe(struct sfp *
+ 	if (sfp->gpio[GPIO_LOS])
+ 		sfp->state_hw_mask |= SFP_F_LOS;
+ 
+-	if (!memcmp(id.base.vendor_name, "ALCATELLUCENT   ", 16) &&
+-	    !memcmp(id.base.vendor_pn, "3FE46541AA      ", 16))
+-		sfp->module_t_start_up = T_START_UP_BAD_GPON;
+-	else
+-		sfp->module_t_start_up = T_START_UP;
++	sfp->module_t_start_up = T_START_UP;
+ 
+ 	if (!memcmp(id.base.vendor_name, "HUAWEI          ", 16) &&
+ 	    !memcmp(id.base.vendor_pn, "MA5671A         ", 16))
+@@ -2056,6 +2058,8 @@ static int sfp_sm_mod_probe(struct sfp *
+ 		sfp->tx_fault_ignore = false;
+ 
+ 	sfp->quirk = sfp_lookup_quirk(&id);
++	if (sfp->quirk && sfp->quirk->fixup)
++		sfp->quirk->fixup(sfp);
+ 
+ 	return 0;
+ }
+--- a/drivers/net/phy/sfp.h
++++ b/drivers/net/phy/sfp.h
+@@ -10,6 +10,7 @@ struct sfp_quirk {
+ 	const char *vendor;
+ 	const char *part;
+ 	void (*modes)(const struct sfp_eeprom_id *id, unsigned long *modes);
++	void (*fixup)(struct sfp *sfp);
+ };
+ 
+ struct sfp_socket_ops {
diff --git a/target/linux/generic/backport-5.15/786-v6.1-net-sfp-move-Huawei-MA5671A-fixup.patch b/target/linux/generic/backport-5.15/786-v6.1-net-sfp-move-Huawei-MA5671A-fixup.patch
new file mode 100644
index 00000000000000..7f856e5b5bee19
--- /dev/null
+++ b/target/linux/generic/backport-5.15/786-v6.1-net-sfp-move-Huawei-MA5671A-fixup.patch
@@ -0,0 +1,48 @@
+From 5029be761161374a3624aa7b4670174c35449bf5 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Tue, 13 Sep 2022 20:06:42 +0100
+Subject: [PATCH 1/1] net: sfp: move Huawei MA5671A fixup
+
+Move this module over to the new fixup mechanism.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/sfp.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -322,6 +322,11 @@ static void sfp_fixup_long_startup(struc
+ 	sfp->module_t_start_up = T_START_UP_BAD_GPON;
+ }
+ 
++static void sfp_fixup_ignore_tx_fault(struct sfp *sfp)
++{
++	sfp->tx_fault_ignore = true;
++}
++
+ static void sfp_quirk_2500basex(const struct sfp_eeprom_id *id,
+ 				unsigned long *modes)
+ {
+@@ -359,6 +364,7 @@ static const struct sfp_quirk sfp_quirks
+ 		.vendor = "HUAWEI",
+ 		.part = "MA5671A",
+ 		.modes = sfp_quirk_2500basex,
++		.fixup = sfp_fixup_ignore_tx_fault,
+ 	}, {
+ 		// Lantech 8330-262D-E can operate at 2500base-X, but
+ 		// incorrectly report 2500MBd NRZ in their EEPROM
+@@ -2051,11 +2057,7 @@ static int sfp_sm_mod_probe(struct sfp *
+ 
+ 	sfp->module_t_start_up = T_START_UP;
+ 
+-	if (!memcmp(id.base.vendor_name, "HUAWEI          ", 16) &&
+-	    !memcmp(id.base.vendor_pn, "MA5671A         ", 16))
+-		sfp->tx_fault_ignore = true;
+-	else
+-		sfp->tx_fault_ignore = false;
++	sfp->tx_fault_ignore = false;
+ 
+ 	sfp->quirk = sfp_lookup_quirk(&id);
+ 	if (sfp->quirk && sfp->quirk->fixup)
diff --git a/target/linux/generic/backport-5.15/787-v6.1-net-sfp-add-support-for-HALNy-GPON-SFP.patch b/target/linux/generic/backport-5.15/787-v6.1-net-sfp-add-support-for-HALNy-GPON-SFP.patch
new file mode 100644
index 00000000000000..81108e19c167d2
--- /dev/null
+++ b/target/linux/generic/backport-5.15/787-v6.1-net-sfp-add-support-for-HALNy-GPON-SFP.patch
@@ -0,0 +1,79 @@
+From 73472c830eae5fce2107f7f086f1e6827d215caf Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Tue, 13 Sep 2022 20:06:48 +0100
+Subject: [PATCH 1/1] net: sfp: add support for HALNy GPON SFP
+
+Add a quirk for the HALNy HL-GSFP module, which appears to have an
+inverted RX_LOS signal, and maybe uses TX_FAULT as a serial port
+transmit pin. Rather than use these hardware signals, switch to
+using software polling for these status signals.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/sfp-bus.c |  2 +-
+ drivers/net/phy/sfp.c     | 21 ++++++++++++++++++---
+ 2 files changed, 19 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/phy/sfp-bus.c
++++ b/drivers/net/phy/sfp-bus.c
+@@ -283,7 +283,7 @@ void sfp_parse_support(struct sfp_bus *b
+ 			phylink_set(modes, 2500baseX_Full);
+ 	}
+ 
+-	if (bus->sfp_quirk)
++	if (bus->sfp_quirk && bus->sfp_quirk->modes)
+ 		bus->sfp_quirk->modes(id, modes);
+ 
+ 	linkmode_or(support, support, modes);
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -327,6 +327,15 @@ static void sfp_fixup_ignore_tx_fault(st
+ 	sfp->tx_fault_ignore = true;
+ }
+ 
++static void sfp_fixup_halny_gsfp(struct sfp *sfp)
++{
++	/* Ignore the TX_FAULT and LOS signals on this module.
++	 * these are possibly used for other purposes on this
++	 * module, e.g. a serial port.
++	 */
++	sfp->state_hw_mask &= ~(SFP_F_TX_FAULT | SFP_F_LOS);
++}
++
+ static void sfp_quirk_2500basex(const struct sfp_eeprom_id *id,
+ 				unsigned long *modes)
+ {
+@@ -359,6 +368,10 @@ static const struct sfp_quirk sfp_quirks
+ 		.modes = sfp_quirk_2500basex,
+ 		.fixup = sfp_fixup_long_startup,
+ 	}, {
++		.vendor = "HALNy",
++		.part = "HL-GSFP",
++		.fixup = sfp_fixup_halny_gsfp,
++	}, {
+ 		// Huawei MA5671A can operate at 2500base-X, but report 1.2GBd
+ 		// NRZ in their EEPROM
+ 		.vendor = "HUAWEI",
+@@ -375,16 +388,18 @@ static const struct sfp_quirk sfp_quirks
+ 		.vendor = "UBNT",
+ 		.part = "UF-INSTANT",
+ 		.modes = sfp_quirk_ubnt_uf_instant,
+-	},
++	}
+ };
+ 
+ static size_t sfp_strlen(const char *str, size_t maxlen)
+ {
+ 	size_t size, i;
+ 
+-	/* Trailing characters should be filled with space chars */
++	/* Trailing characters should be filled with space chars, but
++	 * some manufacturers can't read SFF-8472 and use NUL.
++	 */
+ 	for (i = 0, size = 0; i < maxlen; i++)
+-		if (str[i] != ' ')
++		if (str[i] != ' ' && str[i] != '\0')
+ 			size = i + 1;
+ 
+ 	return size;
diff --git a/target/linux/generic/backport-5.15/788-v6.3-net-dsa-mt7530-use-external-PCS-driver.patch b/target/linux/generic/backport-5.15/788-v6.3-net-dsa-mt7530-use-external-PCS-driver.patch
new file mode 100644
index 00000000000000..9e445f1300cd8f
--- /dev/null
+++ b/target/linux/generic/backport-5.15/788-v6.3-net-dsa-mt7530-use-external-PCS-driver.patch
@@ -0,0 +1,514 @@
+From patchwork Thu Mar  9 10:57:44 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 13167235
+X-Patchwork-Delegate: kuba@kernel.org
+Return-Path: <netdev-owner@vger.kernel.org>
+Date: Thu, 9 Mar 2023 10:57:44 +0000
+From: Daniel Golle <daniel@makrotopia.org>
+To: netdev@vger.kernel.org, linux-mediatek@lists.infradead.org,
+        linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org,
+        Russell King <linux@armlinux.org.uk>,
+        Heiner Kallweit <hkallweit1@gmail.com>,
+        Lorenzo Bianconi <lorenzo@kernel.org>,
+        Mark Lee <Mark-MC.Lee@mediatek.com>,
+        John Crispin <john@phrozen.org>, Felix Fietkau <nbd@nbd.name>,
+        AngeloGioacchino Del Regno
+        <angelogioacchino.delregno@collabora.com>,
+        Matthias Brugger <matthias.bgg@gmail.com>,
+        DENG Qingfang <dqfext@gmail.com>,
+        Landen Chao <Landen.Chao@mediatek.com>,
+        Sean Wang <sean.wang@mediatek.com>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Eric Dumazet <edumazet@google.com>,
+        "David S. Miller" <davem@davemloft.net>,
+        Vladimir Oltean <olteanv@gmail.com>,
+        Florian Fainelli <f.fainelli@gmail.com>,
+        Andrew Lunn <andrew@lunn.ch>,
+        Vladimir Oltean <vladimir.oltean@nxp.com>
+Cc: =?iso-8859-1?q?Bj=F8rn?= Mork <bjorn@mork.no>,
+ Frank Wunderlich <frank-w@public-files.de>,
+ Alexander Couzens <lynxis@fe80.eu>
+Subject: [PATCH net-next v13 11/16] net: dsa: mt7530: use external PCS driver
+Message-ID: 
+ <2ac2ee40d3b0e705461b50613fda6a7edfdbc4b3.1678357225.git.daniel@makrotopia.org>
+References: <cover.1678357225.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1678357225.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <netdev.vger.kernel.org>
+X-Mailing-List: netdev@vger.kernel.org
+X-Patchwork-Delegate: kuba@kernel.org
+
+Implement regmap access wrappers, for now only to be used by the
+pcs-mtk driver.
+Make use of external PCS driver and drop the reduntant implementation
+in mt7530.c.
+As a nice side effect the SGMII registers can now also more easily be
+inspected for debugging via /sys/kernel/debug/regmap.
+
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Tested-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Tested-by: Frank Wunderlich <frank-w@public-files.de>
+---
+ drivers/net/dsa/Kconfig  |   1 +
+ drivers/net/dsa/mt7530.c | 277 ++++++++++-----------------------------
+ drivers/net/dsa/mt7530.h |  47 +------
+ 3 files changed, 71 insertions(+), 254 deletions(-)
+
+--- a/drivers/net/dsa/Kconfig
++++ b/drivers/net/dsa/Kconfig
+@@ -37,6 +37,7 @@ config NET_DSA_MT7530
+ 	tristate "MediaTek MT753x and MT7621 Ethernet switch support"
+ 	select NET_DSA_TAG_MTK
+ 	select MEDIATEK_GE_PHY
++	select PCS_MTK_LYNXI
+ 	help
+ 	  This enables support for the MediaTek MT7530, MT7531, and MT7621
+ 	  Ethernet switch chips.
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -14,6 +14,7 @@
+ #include <linux/of_mdio.h>
+ #include <linux/of_net.h>
+ #include <linux/of_platform.h>
++#include <linux/pcs/pcs-mtk-lynxi.h>
+ #include <linux/phylink.h>
+ #include <linux/regmap.h>
+ #include <linux/regulator/consumer.h>
+@@ -2588,128 +2589,11 @@ static int mt7531_rgmii_setup(struct mt7
+ 	return 0;
+ }
+ 
+-static void mt7531_pcs_link_up(struct phylink_pcs *pcs, unsigned int mode,
+-			       phy_interface_t interface, int speed, int duplex)
+-{
+-	struct mt7530_priv *priv = pcs_to_mt753x_pcs(pcs)->priv;
+-	int port = pcs_to_mt753x_pcs(pcs)->port;
+-	unsigned int val;
+-
+-	/* For adjusting speed and duplex of SGMII force mode. */
+-	if (interface != PHY_INTERFACE_MODE_SGMII ||
+-	    phylink_autoneg_inband(mode))
+-		return;
+-
+-	/* SGMII force mode setting */
+-	val = mt7530_read(priv, MT7531_SGMII_MODE(port));
+-	val &= ~MT7531_SGMII_IF_MODE_MASK;
+-
+-	switch (speed) {
+-	case SPEED_10:
+-		val |= MT7531_SGMII_FORCE_SPEED_10;
+-		break;
+-	case SPEED_100:
+-		val |= MT7531_SGMII_FORCE_SPEED_100;
+-		break;
+-	case SPEED_1000:
+-		val |= MT7531_SGMII_FORCE_SPEED_1000;
+-		break;
+-	}
+-
+-	/* MT7531 SGMII 1G force mode can only work in full duplex mode,
+-	 * no matter MT7531_SGMII_FORCE_HALF_DUPLEX is set or not.
+-	 *
+-	 * The speed check is unnecessary as the MAC capabilities apply
+-	 * this restriction. --rmk
+-	 */
+-	if ((speed == SPEED_10 || speed == SPEED_100) &&
+-	    duplex != DUPLEX_FULL)
+-		val |= MT7531_SGMII_FORCE_HALF_DUPLEX;
+-
+-	mt7530_write(priv, MT7531_SGMII_MODE(port), val);
+-}
+-
+ static bool mt753x_is_mac_port(u32 port)
+ {
+ 	return (port == 5 || port == 6);
+ }
+ 
+-static int mt7531_sgmii_setup_mode_force(struct mt7530_priv *priv, u32 port,
+-					 phy_interface_t interface)
+-{
+-	u32 val;
+-
+-	if (!mt753x_is_mac_port(port))
+-		return -EINVAL;
+-
+-	mt7530_set(priv, MT7531_QPHY_PWR_STATE_CTRL(port),
+-		   MT7531_SGMII_PHYA_PWD);
+-
+-	val = mt7530_read(priv, MT7531_PHYA_CTRL_SIGNAL3(port));
+-	val &= ~MT7531_RG_TPHY_SPEED_MASK;
+-	/* Setup 2.5 times faster clock for 2.5Gbps data speeds with 10B/8B
+-	 * encoding.
+-	 */
+-	val |= (interface == PHY_INTERFACE_MODE_2500BASEX) ?
+-		MT7531_RG_TPHY_SPEED_3_125G : MT7531_RG_TPHY_SPEED_1_25G;
+-	mt7530_write(priv, MT7531_PHYA_CTRL_SIGNAL3(port), val);
+-
+-	mt7530_clear(priv, MT7531_PCS_CONTROL_1(port), MT7531_SGMII_AN_ENABLE);
+-
+-	/* MT7531 SGMII 1G and 2.5G force mode can only work in full duplex
+-	 * mode, no matter MT7531_SGMII_FORCE_HALF_DUPLEX is set or not.
+-	 */
+-	mt7530_rmw(priv, MT7531_SGMII_MODE(port),
+-		   MT7531_SGMII_IF_MODE_MASK | MT7531_SGMII_REMOTE_FAULT_DIS,
+-		   MT7531_SGMII_FORCE_SPEED_1000);
+-
+-	mt7530_write(priv, MT7531_QPHY_PWR_STATE_CTRL(port), 0);
+-
+-	return 0;
+-}
+-
+-static int mt7531_sgmii_setup_mode_an(struct mt7530_priv *priv, int port,
+-				      phy_interface_t interface)
+-{
+-	if (!mt753x_is_mac_port(port))
+-		return -EINVAL;
+-
+-	mt7530_set(priv, MT7531_QPHY_PWR_STATE_CTRL(port),
+-		   MT7531_SGMII_PHYA_PWD);
+-
+-	mt7530_rmw(priv, MT7531_PHYA_CTRL_SIGNAL3(port),
+-		   MT7531_RG_TPHY_SPEED_MASK, MT7531_RG_TPHY_SPEED_1_25G);
+-
+-	mt7530_set(priv, MT7531_SGMII_MODE(port),
+-		   MT7531_SGMII_REMOTE_FAULT_DIS |
+-		   MT7531_SGMII_SPEED_DUPLEX_AN);
+-
+-	mt7530_rmw(priv, MT7531_PCS_SPEED_ABILITY(port),
+-		   MT7531_SGMII_TX_CONFIG_MASK, 1);
+-
+-	mt7530_set(priv, MT7531_PCS_CONTROL_1(port), MT7531_SGMII_AN_ENABLE);
+-
+-	mt7530_set(priv, MT7531_PCS_CONTROL_1(port), MT7531_SGMII_AN_RESTART);
+-
+-	mt7530_write(priv, MT7531_QPHY_PWR_STATE_CTRL(port), 0);
+-
+-	return 0;
+-}
+-
+-static void mt7531_pcs_an_restart(struct phylink_pcs *pcs)
+-{
+-	struct mt7530_priv *priv = pcs_to_mt753x_pcs(pcs)->priv;
+-	int port = pcs_to_mt753x_pcs(pcs)->port;
+-	u32 val;
+-
+-	/* Only restart AN when AN is enabled */
+-	val = mt7530_read(priv, MT7531_PCS_CONTROL_1(port));
+-	if (val & MT7531_SGMII_AN_ENABLE) {
+-		val |= MT7531_SGMII_AN_RESTART;
+-		mt7530_write(priv, MT7531_PCS_CONTROL_1(port), val);
+-	}
+-}
+-
+ static int
+ mt7531_mac_config(struct dsa_switch *ds, int port, unsigned int mode,
+ 		  phy_interface_t interface)
+@@ -2732,11 +2616,11 @@ mt7531_mac_config(struct dsa_switch *ds,
+ 		phydev = dp->slave->phydev;
+ 		return mt7531_rgmii_setup(priv, port, interface, phydev);
+ 	case PHY_INTERFACE_MODE_SGMII:
+-		return mt7531_sgmii_setup_mode_an(priv, port, interface);
+ 	case PHY_INTERFACE_MODE_NA:
+ 	case PHY_INTERFACE_MODE_1000BASEX:
+ 	case PHY_INTERFACE_MODE_2500BASEX:
+-		return mt7531_sgmii_setup_mode_force(priv, port, interface);
++		/* handled in SGMII PCS driver */
++		return 0;
+ 	default:
+ 		return -EINVAL;
+ 	}
+@@ -2761,11 +2645,11 @@ mt753x_phylink_mac_select_pcs(struct dsa
+ 
+ 	switch (interface) {
+ 	case PHY_INTERFACE_MODE_TRGMII:
++		return &priv->pcs[port].pcs;
+ 	case PHY_INTERFACE_MODE_SGMII:
+ 	case PHY_INTERFACE_MODE_1000BASEX:
+ 	case PHY_INTERFACE_MODE_2500BASEX:
+-		return &priv->pcs[port].pcs;
+-
++		return priv->ports[port].sgmii_pcs;
+ 	default:
+ 		return NULL;
+ 	}
+@@ -3006,86 +2890,6 @@ static void mt7530_pcs_get_state(struct
+ 		state->pause |= MLO_PAUSE_TX;
+ }
+ 
+-static int
+-mt7531_sgmii_pcs_get_state_an(struct mt7530_priv *priv, int port,
+-			      struct phylink_link_state *state)
+-{
+-	u32 status, val;
+-	u16 config_reg;
+-
+-	status = mt7530_read(priv, MT7531_PCS_CONTROL_1(port));
+-	state->link = !!(status & MT7531_SGMII_LINK_STATUS);
+-	state->an_complete = !!(status & MT7531_SGMII_AN_COMPLETE);
+-	if (state->interface == PHY_INTERFACE_MODE_SGMII &&
+-	    (status & MT7531_SGMII_AN_ENABLE)) {
+-		val = mt7530_read(priv, MT7531_PCS_SPEED_ABILITY(port));
+-		config_reg = val >> 16;
+-
+-		switch (config_reg & LPA_SGMII_SPD_MASK) {
+-		case LPA_SGMII_1000:
+-			state->speed = SPEED_1000;
+-			break;
+-		case LPA_SGMII_100:
+-			state->speed = SPEED_100;
+-			break;
+-		case LPA_SGMII_10:
+-			state->speed = SPEED_10;
+-			break;
+-		default:
+-			dev_err(priv->dev, "invalid sgmii PHY speed\n");
+-			state->link = false;
+-			return -EINVAL;
+-		}
+-
+-		if (config_reg & LPA_SGMII_FULL_DUPLEX)
+-			state->duplex = DUPLEX_FULL;
+-		else
+-			state->duplex = DUPLEX_HALF;
+-	}
+-
+-	return 0;
+-}
+-
+-static void
+-mt7531_sgmii_pcs_get_state_inband(struct mt7530_priv *priv, int port,
+-				  struct phylink_link_state *state)
+-{
+-	unsigned int val;
+-
+-	val = mt7530_read(priv, MT7531_PCS_CONTROL_1(port));
+-	state->link = !!(val & MT7531_SGMII_LINK_STATUS);
+-	if (!state->link)
+-		return;
+-
+-	state->an_complete = state->link;
+-
+-	if (state->interface == PHY_INTERFACE_MODE_2500BASEX)
+-		state->speed = SPEED_2500;
+-	else
+-		state->speed = SPEED_1000;
+-
+-	state->duplex = DUPLEX_FULL;
+-	state->pause = MLO_PAUSE_NONE;
+-}
+-
+-static void mt7531_pcs_get_state(struct phylink_pcs *pcs,
+-				 struct phylink_link_state *state)
+-{
+-	struct mt7530_priv *priv = pcs_to_mt753x_pcs(pcs)->priv;
+-	int port = pcs_to_mt753x_pcs(pcs)->port;
+-
+-	if (state->interface == PHY_INTERFACE_MODE_SGMII) {
+-		mt7531_sgmii_pcs_get_state_an(priv, port, state);
+-		return;
+-	} else if ((state->interface == PHY_INTERFACE_MODE_1000BASEX) ||
+-		   (state->interface == PHY_INTERFACE_MODE_2500BASEX)) {
+-		mt7531_sgmii_pcs_get_state_inband(priv, port, state);
+-		return;
+-	}
+-
+-	state->link = false;
+-}
+-
+ static int mt753x_pcs_config(struct phylink_pcs *pcs, unsigned int mode,
+ 			     phy_interface_t interface,
+ 			     const unsigned long *advertising,
+@@ -3105,18 +2909,57 @@ static const struct phylink_pcs_ops mt75
+ 	.pcs_an_restart = mt7530_pcs_an_restart,
+ };
+ 
+-static const struct phylink_pcs_ops mt7531_pcs_ops = {
+-	.pcs_validate = mt753x_pcs_validate,
+-	.pcs_get_state = mt7531_pcs_get_state,
+-	.pcs_config = mt753x_pcs_config,
+-	.pcs_an_restart = mt7531_pcs_an_restart,
+-	.pcs_link_up = mt7531_pcs_link_up,
++static int mt7530_regmap_read(void *context, unsigned int reg, unsigned int *val)
++{
++	struct mt7530_priv *priv = context;
++
++	*val = mt7530_read(priv, reg);
++	return 0;
++};
++
++static int mt7530_regmap_write(void *context, unsigned int reg, unsigned int val)
++{
++	struct mt7530_priv *priv = context;
++
++	mt7530_write(priv, reg, val);
++	return 0;
++};
++
++static int mt7530_regmap_update_bits(void *context, unsigned int reg,
++				     unsigned int mask, unsigned int val)
++{
++	struct mt7530_priv *priv = context;
++
++	mt7530_rmw(priv, reg, mask, val);
++	return 0;
++};
++
++static const struct regmap_bus mt7531_regmap_bus = {
++	.reg_write = mt7530_regmap_write,
++	.reg_read = mt7530_regmap_read,
++	.reg_update_bits = mt7530_regmap_update_bits,
++};
++
++#define MT7531_PCS_REGMAP_CONFIG(_name, _reg_base) \
++	{				\
++		.name = _name,		\
++		.reg_bits = 16,		\
++		.val_bits = 32,		\
++		.reg_stride = 4,	\
++		.reg_base = _reg_base,	\
++		.max_register = 0x17c,	\
++	}
++
++static const struct regmap_config mt7531_pcs_config[] = {
++	MT7531_PCS_REGMAP_CONFIG("port5", MT7531_SGMII_REG_BASE(5)),
++	MT7531_PCS_REGMAP_CONFIG("port6", MT7531_SGMII_REG_BASE(6)),
+ };
+ 
+ static int
+ mt753x_setup(struct dsa_switch *ds)
+ {
+ 	struct mt7530_priv *priv = ds->priv;
++	struct regmap *regmap;
+ 	int i, ret;
+ 
+ 	/* Initialise the PCS devices */
+@@ -3124,8 +2967,6 @@ mt753x_setup(struct dsa_switch *ds)
+ 		priv->pcs[i].pcs.ops = priv->info->pcs_ops;
+ 		priv->pcs[i].priv = priv;
+ 		priv->pcs[i].port = i;
+-		if (mt753x_is_mac_port(i))
+-			priv->pcs[i].pcs.poll = 1;
+ 	}
+ 
+ 	ret = priv->info->sw_setup(ds);
+@@ -3140,6 +2981,16 @@ mt753x_setup(struct dsa_switch *ds)
+ 	if (ret && priv->irq)
+ 		mt7530_free_irq_common(priv);
+ 
++	if (priv->id == ID_MT7531)
++		for (i = 0; i < 2; i++) {
++			regmap = devm_regmap_init(ds->dev,
++						  &mt7531_regmap_bus, priv,
++						  &mt7531_pcs_config[i]);
++			priv->ports[5 + i].sgmii_pcs =
++				mtk_pcs_lynxi_create(ds->dev, regmap,
++						     MT7531_PHYA_CTRL_SIGNAL3, 0);
++		}
++
+ 	return ret;
+ }
+ 
+@@ -3231,7 +3082,7 @@ static const struct mt753x_info mt753x_t
+ 	},
+ 	[ID_MT7531] = {
+ 		.id = ID_MT7531,
+-		.pcs_ops = &mt7531_pcs_ops,
++		.pcs_ops = &mt7530_pcs_ops,
+ 		.sw_setup = mt7531_setup,
+ 		.phy_read = mt7531_ind_phy_read,
+ 		.phy_write = mt7531_ind_phy_write,
+@@ -3339,7 +3190,7 @@ static void
+ mt7530_remove(struct mdio_device *mdiodev)
+ {
+ 	struct mt7530_priv *priv = dev_get_drvdata(&mdiodev->dev);
+-	int ret = 0;
++	int ret = 0, i;
+ 
+ 	if (!priv)
+ 		return;
+@@ -3358,6 +3209,10 @@ mt7530_remove(struct mdio_device *mdiode
+ 		mt7530_free_irq(priv);
+ 
+ 	dsa_unregister_switch(priv->ds);
++
++	for (i = 0; i < 2; ++i)
++		mtk_pcs_lynxi_destroy(priv->ports[5 + i].sgmii_pcs);
++
+ 	mutex_destroy(&priv->reg_mutex);
+ 
+ 	dev_set_drvdata(&mdiodev->dev, NULL);
+--- a/drivers/net/dsa/mt7530.h
++++ b/drivers/net/dsa/mt7530.h
+@@ -364,47 +364,8 @@ enum mt7530_vlan_port_acc_frm {
+ 					 CCR_TX_OCT_CNT_BAD)
+ 
+ /* MT7531 SGMII register group */
+-#define MT7531_SGMII_REG_BASE		0x5000
+-#define MT7531_SGMII_REG(p, r)		(MT7531_SGMII_REG_BASE + \
+-					((p) - 5) * 0x1000 + (r))
+-
+-/* Register forSGMII PCS_CONTROL_1 */
+-#define MT7531_PCS_CONTROL_1(p)		MT7531_SGMII_REG(p, 0x00)
+-#define  MT7531_SGMII_LINK_STATUS	BIT(18)
+-#define  MT7531_SGMII_AN_ENABLE		BIT(12)
+-#define  MT7531_SGMII_AN_RESTART	BIT(9)
+-#define  MT7531_SGMII_AN_COMPLETE	BIT(21)
+-
+-/* Register for SGMII PCS_SPPED_ABILITY */
+-#define MT7531_PCS_SPEED_ABILITY(p)	MT7531_SGMII_REG(p, 0x08)
+-#define  MT7531_SGMII_TX_CONFIG_MASK	GENMASK(15, 0)
+-#define  MT7531_SGMII_TX_CONFIG		BIT(0)
+-
+-/* Register for SGMII_MODE */
+-#define MT7531_SGMII_MODE(p)		MT7531_SGMII_REG(p, 0x20)
+-#define  MT7531_SGMII_REMOTE_FAULT_DIS	BIT(8)
+-#define  MT7531_SGMII_IF_MODE_MASK	GENMASK(5, 1)
+-#define  MT7531_SGMII_FORCE_DUPLEX	BIT(4)
+-#define  MT7531_SGMII_FORCE_SPEED_MASK	GENMASK(3, 2)
+-#define  MT7531_SGMII_FORCE_SPEED_1000	BIT(3)
+-#define  MT7531_SGMII_FORCE_SPEED_100	BIT(2)
+-#define  MT7531_SGMII_FORCE_SPEED_10	0
+-#define  MT7531_SGMII_SPEED_DUPLEX_AN	BIT(1)
+-
+-enum mt7531_sgmii_force_duplex {
+-	MT7531_SGMII_FORCE_FULL_DUPLEX = 0,
+-	MT7531_SGMII_FORCE_HALF_DUPLEX = 0x10,
+-};
+-
+-/* Fields of QPHY_PWR_STATE_CTRL */
+-#define MT7531_QPHY_PWR_STATE_CTRL(p)	MT7531_SGMII_REG(p, 0xe8)
+-#define  MT7531_SGMII_PHYA_PWD		BIT(4)
+-
+-/* Values of SGMII SPEED */
+-#define MT7531_PHYA_CTRL_SIGNAL3(p)	MT7531_SGMII_REG(p, 0x128)
+-#define  MT7531_RG_TPHY_SPEED_MASK	(BIT(2) | BIT(3))
+-#define  MT7531_RG_TPHY_SPEED_1_25G	0x0
+-#define  MT7531_RG_TPHY_SPEED_3_125G	BIT(2)
++#define MT7531_SGMII_REG_BASE(p)	(0x5000 + ((p) - 5) * 0x1000)
++#define MT7531_PHYA_CTRL_SIGNAL3	0x128
+ 
+ /* Register for system reset */
+ #define MT7530_SYS_CTRL			0x7000
+@@ -703,13 +664,13 @@ struct mt7530_fdb {
+  * @pm:		The matrix used to show all connections with the port.
+  * @pvid:	The VLAN specified is to be considered a PVID at ingress.  Any
+  *		untagged frames will be assigned to the related VLAN.
+- * @vlan_filtering: The flags indicating whether the port that can recognize
+- *		    VLAN-tagged frames.
++ * @sgmii_pcs:	Pointer to PCS instance for SerDes ports
+  */
+ struct mt7530_port {
+ 	bool enable;
+ 	u32 pm;
+ 	u16 pvid;
++	struct phylink_pcs *sgmii_pcs;
+ };
+ 
+ /* Port 5 interface select definitions */
diff --git a/target/linux/generic/backport-5.15/789-v6.3-net-sfp-add-quirk-enabling-2500Base-x-for-HG-MXPD-48.patch b/target/linux/generic/backport-5.15/789-v6.3-net-sfp-add-quirk-enabling-2500Base-x-for-HG-MXPD-48.patch
new file mode 100644
index 00000000000000..413c73f547863e
--- /dev/null
+++ b/target/linux/generic/backport-5.15/789-v6.3-net-sfp-add-quirk-enabling-2500Base-x-for-HG-MXPD-48.patch
@@ -0,0 +1,37 @@
+From ad651d68cee75e9ac20002254c4e5d09ee67a84b Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sun, 2 Apr 2023 12:44:37 +0100
+Subject: [PATCH] net: sfp: add quirk enabling 2500Base-x for HG MXPD-483II
+
+The HG MXPD-483II 1310nm SFP module is meant to operate with 2500Base-X,
+however, in their EEPROM they incorrectly specify:
+    Transceiver type                          : Ethernet: 1000BASE-LX
+    ...
+    BR, Nominal                               : 2600MBd
+
+Use sfp_quirk_2500basex for this module to allow 2500Base-X mode anyway.
+
+https://forum.banana-pi.org/t/bpi-r3-sfp-module-compatibility/14573/60
+
+Reported-by: chowtom <chowtom@gmail.com>
+Tested-by: chowtom <chowtom@gmail.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/sfp.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -372,6 +372,10 @@ static const struct sfp_quirk sfp_quirks
+ 		.part = "HL-GSFP",
+ 		.fixup = sfp_fixup_halny_gsfp,
+ 	}, {
++		.vendor = "HG GENUINE",
++		.part = "MXPD-483II",
++		.modes = sfp_quirk_2500basex,
++	}, {
+ 		// Huawei MA5671A can operate at 2500base-X, but report 1.2GBd
+ 		// NRZ in their EEPROM
+ 		.vendor = "HUAWEI",
diff --git a/target/linux/generic/backport-5.15/790-v6.0-net-mii-add-mii_bmcr_encode_fixed.patch b/target/linux/generic/backport-5.15/790-v6.0-net-mii-add-mii_bmcr_encode_fixed.patch
new file mode 100644
index 00000000000000..87d7ff6154d128
--- /dev/null
+++ b/target/linux/generic/backport-5.15/790-v6.0-net-mii-add-mii_bmcr_encode_fixed.patch
@@ -0,0 +1,55 @@
+From bdb6cfe7512f7a214815a3092f0be50963dcacbc Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Sat, 18 Jun 2022 11:28:32 +0100
+Subject: [PATCH] net: mii: add mii_bmcr_encode_fixed()
+
+Add a function to encode a fixed speed/duplex to a BMCR value.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/linux/mii.h | 35 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 35 insertions(+)
+
+--- a/include/linux/mii.h
++++ b/include/linux/mii.h
+@@ -595,4 +595,39 @@ static inline u8 mii_resolve_flowctrl_fd
+ 	return cap;
+ }
+ 
++/**
++ * mii_bmcr_encode_fixed - encode fixed speed/duplex settings to a BMCR value
++ * @speed: a SPEED_* value
++ * @duplex: a DUPLEX_* value
++ *
++ * Encode the speed and duplex to a BMCR value. 2500, 1000, 100 and 10 Mbps are
++ * supported. 2500Mbps is encoded to 1000Mbps. Other speeds are encoded as 10
++ * Mbps. Unknown duplex values are encoded to half-duplex.
++ */
++static inline u16 mii_bmcr_encode_fixed(int speed, int duplex)
++{
++	u16 bmcr;
++
++	switch (speed) {
++	case SPEED_2500:
++	case SPEED_1000:
++		bmcr = BMCR_SPEED1000;
++		break;
++
++	case SPEED_100:
++		bmcr = BMCR_SPEED100;
++		break;
++
++	case SPEED_10:
++	default:
++		bmcr = BMCR_SPEED10;
++		break;
++	}
++
++	if (duplex == DUPLEX_FULL)
++		bmcr |= BMCR_FULLDPLX;
++
++	return bmcr;
++}
++
+ #endif /* __LINUX_MII_H__ */
diff --git a/target/linux/generic/backport-5.15/790-v6.4-0001-net-dsa-mt7530-make-some-noise-if-register-read-fail.patch b/target/linux/generic/backport-5.15/790-v6.4-0001-net-dsa-mt7530-make-some-noise-if-register-read-fail.patch
new file mode 100644
index 00000000000000..ffbdde5a5772ea
--- /dev/null
+++ b/target/linux/generic/backport-5.15/790-v6.4-0001-net-dsa-mt7530-make-some-noise-if-register-read-fail.patch
@@ -0,0 +1,32 @@
+From b6f56cddb5f57a0b8da0ce582232a2f1933558c6 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:17:19 +0100
+Subject: [PATCH 04/16] net: dsa: mt7530: make some noise if register read
+ fails
+
+Simply returning the negative error value instead of the read value
+doesn't seem like a good idea. Return 0 instead and add WARN_ON_ONCE(1)
+so this kind of error will not go unnoticed.
+
+Suggested-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/mt7530.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -224,9 +224,10 @@ mt7530_mii_read(struct mt7530_priv *priv
+ 	/* MT7530 uses 31 as the pseudo port */
+ 	ret = bus->write(bus, 0x1f, 0x1f, page);
+ 	if (ret < 0) {
++		WARN_ON_ONCE(1);
+ 		dev_err(&bus->dev,
+ 			"failed to read mt7530 register\n");
+-		return ret;
++		return 0;
+ 	}
+ 
+ 	lo = bus->read(bus, 0x1f, r);
diff --git a/target/linux/generic/backport-5.15/790-v6.4-0002-net-dsa-mt7530-refactor-SGMII-PCS-creation.patch b/target/linux/generic/backport-5.15/790-v6.4-0002-net-dsa-mt7530-refactor-SGMII-PCS-creation.patch
new file mode 100644
index 00000000000000..a933d376c8871e
--- /dev/null
+++ b/target/linux/generic/backport-5.15/790-v6.4-0002-net-dsa-mt7530-refactor-SGMII-PCS-creation.patch
@@ -0,0 +1,111 @@
+From 9ecc00164dc2300dfcd40afe549a8ee951dfea9f Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:17:30 +0100
+Subject: [PATCH 05/16] net: dsa: mt7530: refactor SGMII PCS creation
+
+Instead of macro templates use a dedidated function and allocated
+regmap_config when creating the regmaps for the pcs-mtk-lynxi
+instances.
+This is in preparation to switching to use unlocked regmap accessors
+and have regmap's locking API handle locking for us.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/mt7530.c | 74 +++++++++++++++++++++++++++-------------
+ 1 file changed, 50 insertions(+), 24 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -2941,26 +2941,56 @@ static const struct regmap_bus mt7531_re
+ 	.reg_update_bits = mt7530_regmap_update_bits,
+ };
+ 
+-#define MT7531_PCS_REGMAP_CONFIG(_name, _reg_base) \
+-	{				\
+-		.name = _name,		\
+-		.reg_bits = 16,		\
+-		.val_bits = 32,		\
+-		.reg_stride = 4,	\
+-		.reg_base = _reg_base,	\
+-		.max_register = 0x17c,	\
++static int
++mt7531_create_sgmii(struct mt7530_priv *priv)
++{
++	struct regmap_config *mt7531_pcs_config[2];
++	struct phylink_pcs *pcs;
++	struct regmap *regmap;
++	int i, ret = 0;
++
++	for (i = 0; i < 2; i++) {
++		mt7531_pcs_config[i] = devm_kzalloc(priv->dev,
++						    sizeof(struct regmap_config),
++						    GFP_KERNEL);
++		if (!mt7531_pcs_config[i]) {
++			ret = -ENOMEM;
++			break;
++		}
++
++		mt7531_pcs_config[i]->name = i ? "port6" : "port5";
++		mt7531_pcs_config[i]->reg_bits = 16;
++		mt7531_pcs_config[i]->val_bits = 32;
++		mt7531_pcs_config[i]->reg_stride = 4;
++		mt7531_pcs_config[i]->reg_base = MT7531_SGMII_REG_BASE(5 + i);
++		mt7531_pcs_config[i]->max_register = 0x17c;
++
++		regmap = devm_regmap_init(priv->dev,
++					  &mt7531_regmap_bus, priv,
++					  mt7531_pcs_config[i]);
++		if (IS_ERR(regmap)) {
++			ret = PTR_ERR(regmap);
++			break;
++		}
++		pcs = mtk_pcs_lynxi_create(priv->dev, regmap,
++					   MT7531_PHYA_CTRL_SIGNAL3, 0);
++		if (!pcs) {
++			ret = -ENXIO;
++			break;
++		}
++		priv->ports[5 + i].sgmii_pcs = pcs;
+ 	}
+ 
+-static const struct regmap_config mt7531_pcs_config[] = {
+-	MT7531_PCS_REGMAP_CONFIG("port5", MT7531_SGMII_REG_BASE(5)),
+-	MT7531_PCS_REGMAP_CONFIG("port6", MT7531_SGMII_REG_BASE(6)),
+-};
++	if (ret && i)
++		mtk_pcs_lynxi_destroy(priv->ports[5].sgmii_pcs);
++
++	return ret;
++}
+ 
+ static int
+ mt753x_setup(struct dsa_switch *ds)
+ {
+ 	struct mt7530_priv *priv = ds->priv;
+-	struct regmap *regmap;
+ 	int i, ret;
+ 
+ 	/* Initialise the PCS devices */
+@@ -2982,15 +3012,11 @@ mt753x_setup(struct dsa_switch *ds)
+ 	if (ret && priv->irq)
+ 		mt7530_free_irq_common(priv);
+ 
+-	if (priv->id == ID_MT7531)
+-		for (i = 0; i < 2; i++) {
+-			regmap = devm_regmap_init(ds->dev,
+-						  &mt7531_regmap_bus, priv,
+-						  &mt7531_pcs_config[i]);
+-			priv->ports[5 + i].sgmii_pcs =
+-				mtk_pcs_lynxi_create(ds->dev, regmap,
+-						     MT7531_PHYA_CTRL_SIGNAL3, 0);
+-		}
++	if (priv->id == ID_MT7531) {
++		ret = mt7531_create_sgmii(priv);
++		if (ret && priv->irq)
++			mt7530_free_irq_common(priv);
++	}
+ 
+ 	return ret;
+ }
diff --git a/target/linux/generic/backport-5.15/790-v6.4-0003-net-dsa-mt7530-use-unlocked-regmap-accessors.patch b/target/linux/generic/backport-5.15/790-v6.4-0003-net-dsa-mt7530-use-unlocked-regmap-accessors.patch
new file mode 100644
index 00000000000000..5f6990f117832e
--- /dev/null
+++ b/target/linux/generic/backport-5.15/790-v6.4-0003-net-dsa-mt7530-use-unlocked-regmap-accessors.patch
@@ -0,0 +1,74 @@
+From 1bd099c49f65ed923b9f19b8c4b3cd1ff0024091 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:17:40 +0100
+Subject: [PATCH 06/16] net: dsa: mt7530: use unlocked regmap accessors
+
+Instead of wrapping the locked register accessor functions, use the
+unlocked variants and add locking wrapper functions to let regmap
+handle the locking.
+
+This is a preparation towards being able to always use regmap to
+access switch registers instead of open-coded accessor functions.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/mt7530.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -2914,7 +2914,7 @@ static int mt7530_regmap_read(void *cont
+ {
+ 	struct mt7530_priv *priv = context;
+ 
+-	*val = mt7530_read(priv, reg);
++	*val = mt7530_mii_read(priv, reg);
+ 	return 0;
+ };
+ 
+@@ -2922,23 +2922,25 @@ static int mt7530_regmap_write(void *con
+ {
+ 	struct mt7530_priv *priv = context;
+ 
+-	mt7530_write(priv, reg, val);
++	mt7530_mii_write(priv, reg, val);
+ 	return 0;
+ };
+ 
+-static int mt7530_regmap_update_bits(void *context, unsigned int reg,
+-				     unsigned int mask, unsigned int val)
++static void
++mt7530_mdio_regmap_lock(void *mdio_lock)
+ {
+-	struct mt7530_priv *priv = context;
++	mutex_lock_nested(mdio_lock, MDIO_MUTEX_NESTED);
++}
+ 
+-	mt7530_rmw(priv, reg, mask, val);
+-	return 0;
+-};
++static void
++mt7530_mdio_regmap_unlock(void *mdio_lock)
++{
++	mutex_unlock(mdio_lock);
++}
+ 
+ static const struct regmap_bus mt7531_regmap_bus = {
+ 	.reg_write = mt7530_regmap_write,
+ 	.reg_read = mt7530_regmap_read,
+-	.reg_update_bits = mt7530_regmap_update_bits,
+ };
+ 
+ static int
+@@ -2964,6 +2966,9 @@ mt7531_create_sgmii(struct mt7530_priv *
+ 		mt7531_pcs_config[i]->reg_stride = 4;
+ 		mt7531_pcs_config[i]->reg_base = MT7531_SGMII_REG_BASE(5 + i);
+ 		mt7531_pcs_config[i]->max_register = 0x17c;
++		mt7531_pcs_config[i]->lock = mt7530_mdio_regmap_lock;
++		mt7531_pcs_config[i]->unlock = mt7530_mdio_regmap_unlock;
++		mt7531_pcs_config[i]->lock_arg = &priv->bus->mdio_lock;
+ 
+ 		regmap = devm_regmap_init(priv->dev,
+ 					  &mt7531_regmap_bus, priv,
diff --git a/target/linux/generic/backport-5.15/790-v6.4-0004-net-dsa-mt7530-use-regmap-to-access-switch-register-.patch b/target/linux/generic/backport-5.15/790-v6.4-0004-net-dsa-mt7530-use-regmap-to-access-switch-register-.patch
new file mode 100644
index 00000000000000..9499ca598fbf8e
--- /dev/null
+++ b/target/linux/generic/backport-5.15/790-v6.4-0004-net-dsa-mt7530-use-regmap-to-access-switch-register-.patch
@@ -0,0 +1,224 @@
+From a08c045580e060a6886bbb656c50ae20b0c780b5 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:17:52 +0100
+Subject: [PATCH 07/16] net: dsa: mt7530: use regmap to access switch register
+ space
+
+Use regmap API to access the switch register space.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/mt7530.c | 99 ++++++++++++++++++++++++----------------
+ drivers/net/dsa/mt7530.h |  2 +
+ 2 files changed, 62 insertions(+), 39 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -183,9 +183,9 @@ core_clear(struct mt7530_priv *priv, u32
+ }
+ 
+ static int
+-mt7530_mii_write(struct mt7530_priv *priv, u32 reg, u32 val)
++mt7530_regmap_write(void *context, unsigned int reg, unsigned int val)
+ {
+-	struct mii_bus *bus = priv->bus;
++	struct mii_bus *bus = context;
+ 	u16 page, r, lo, hi;
+ 	int ret;
+ 
+@@ -197,24 +197,34 @@ mt7530_mii_write(struct mt7530_priv *pri
+ 	/* MT7530 uses 31 as the pseudo port */
+ 	ret = bus->write(bus, 0x1f, 0x1f, page);
+ 	if (ret < 0)
+-		goto err;
++		return ret;
+ 
+ 	ret = bus->write(bus, 0x1f, r,  lo);
+ 	if (ret < 0)
+-		goto err;
++		return ret;
+ 
+ 	ret = bus->write(bus, 0x1f, 0x10, hi);
+-err:
++	return ret;
++}
++
++static int
++mt7530_mii_write(struct mt7530_priv *priv, u32 reg, u32 val)
++{
++	int ret;
++
++	ret = regmap_write(priv->regmap, reg, val);
++
+ 	if (ret < 0)
+-		dev_err(&bus->dev,
++		dev_err(priv->dev,
+ 			"failed to write mt7530 register\n");
++
+ 	return ret;
+ }
+ 
+-static u32
+-mt7530_mii_read(struct mt7530_priv *priv, u32 reg)
++static int
++mt7530_regmap_read(void *context, unsigned int reg, unsigned int *val)
+ {
+-	struct mii_bus *bus = priv->bus;
++	struct mii_bus *bus = context;
+ 	u16 page, r, lo, hi;
+ 	int ret;
+ 
+@@ -223,17 +233,32 @@ mt7530_mii_read(struct mt7530_priv *priv
+ 
+ 	/* MT7530 uses 31 as the pseudo port */
+ 	ret = bus->write(bus, 0x1f, 0x1f, page);
+-	if (ret < 0) {
++	if (ret < 0)
++		return ret;
++
++	lo = bus->read(bus, 0x1f, r);
++	hi = bus->read(bus, 0x1f, 0x10);
++
++	*val = (hi << 16) | (lo & 0xffff);
++
++	return 0;
++}
++
++static u32
++mt7530_mii_read(struct mt7530_priv *priv, u32 reg)
++{
++	int ret;
++	u32 val;
++
++	ret = regmap_read(priv->regmap, reg, &val);
++	if (ret) {
+ 		WARN_ON_ONCE(1);
+-		dev_err(&bus->dev,
++		dev_err(priv->dev,
+ 			"failed to read mt7530 register\n");
+ 		return 0;
+ 	}
+ 
+-	lo = bus->read(bus, 0x1f, r);
+-	hi = bus->read(bus, 0x1f, 0x10);
+-
+-	return (hi << 16) | (lo & 0xffff);
++	return val;
+ }
+ 
+ static void
+@@ -283,14 +308,10 @@ mt7530_rmw(struct mt7530_priv *priv, u32
+ 	   u32 mask, u32 set)
+ {
+ 	struct mii_bus *bus = priv->bus;
+-	u32 val;
+ 
+ 	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+ 
+-	val = mt7530_mii_read(priv, reg);
+-	val &= ~mask;
+-	val |= set;
+-	mt7530_mii_write(priv, reg, val);
++	regmap_update_bits(priv->regmap, reg, mask, set);
+ 
+ 	mutex_unlock(&bus->mdio_lock);
+ }
+@@ -298,7 +319,7 @@ mt7530_rmw(struct mt7530_priv *priv, u32
+ static void
+ mt7530_set(struct mt7530_priv *priv, u32 reg, u32 val)
+ {
+-	mt7530_rmw(priv, reg, 0, val);
++	mt7530_rmw(priv, reg, val, val);
+ }
+ 
+ static void
+@@ -2910,22 +2931,6 @@ static const struct phylink_pcs_ops mt75
+ 	.pcs_an_restart = mt7530_pcs_an_restart,
+ };
+ 
+-static int mt7530_regmap_read(void *context, unsigned int reg, unsigned int *val)
+-{
+-	struct mt7530_priv *priv = context;
+-
+-	*val = mt7530_mii_read(priv, reg);
+-	return 0;
+-};
+-
+-static int mt7530_regmap_write(void *context, unsigned int reg, unsigned int val)
+-{
+-	struct mt7530_priv *priv = context;
+-
+-	mt7530_mii_write(priv, reg, val);
+-	return 0;
+-};
+-
+ static void
+ mt7530_mdio_regmap_lock(void *mdio_lock)
+ {
+@@ -2938,7 +2943,7 @@ mt7530_mdio_regmap_unlock(void *mdio_loc
+ 	mutex_unlock(mdio_lock);
+ }
+ 
+-static const struct regmap_bus mt7531_regmap_bus = {
++static const struct regmap_bus mt7530_regmap_bus = {
+ 	.reg_write = mt7530_regmap_write,
+ 	.reg_read = mt7530_regmap_read,
+ };
+@@ -2971,7 +2976,7 @@ mt7531_create_sgmii(struct mt7530_priv *
+ 		mt7531_pcs_config[i]->lock_arg = &priv->bus->mdio_lock;
+ 
+ 		regmap = devm_regmap_init(priv->dev,
+-					  &mt7531_regmap_bus, priv,
++					  &mt7530_regmap_bus, priv->bus,
+ 					  mt7531_pcs_config[i]);
+ 		if (IS_ERR(regmap)) {
+ 			ret = PTR_ERR(regmap);
+@@ -3136,6 +3141,7 @@ MODULE_DEVICE_TABLE(of, mt7530_of_match)
+ static int
+ mt7530_probe(struct mdio_device *mdiodev)
+ {
++	static struct regmap_config *regmap_config;
+ 	struct mt7530_priv *priv;
+ 	struct device_node *dn;
+ 
+@@ -3215,6 +3221,21 @@ mt7530_probe(struct mdio_device *mdiodev
+ 	mutex_init(&priv->reg_mutex);
+ 	dev_set_drvdata(&mdiodev->dev, priv);
+ 
++	regmap_config = devm_kzalloc(&mdiodev->dev, sizeof(*regmap_config),
++				     GFP_KERNEL);
++	if (!regmap_config)
++		return -ENOMEM;
++
++	regmap_config->reg_bits = 16;
++	regmap_config->val_bits = 32;
++	regmap_config->reg_stride = 4;
++	regmap_config->max_register = MT7530_CREV;
++	regmap_config->disable_locking = true;
++	priv->regmap = devm_regmap_init(priv->dev, &mt7530_regmap_bus,
++					priv->bus, regmap_config);
++	if (IS_ERR(priv->regmap))
++		return PTR_ERR(priv->regmap);
++
+ 	return dsa_register_switch(priv->ds);
+ }
+ 
+--- a/drivers/net/dsa/mt7530.h
++++ b/drivers/net/dsa/mt7530.h
+@@ -747,6 +747,7 @@ struct mt753x_info {
+  * @dev:		The device pointer
+  * @ds:			The pointer to the dsa core structure
+  * @bus:		The bus used for the device and built-in PHY
++ * @regmap:		The regmap instance representing all switch registers
+  * @rstc:		The pointer to reset control used by MCM
+  * @core_pwr:		The power supplied into the core
+  * @io_pwr:		The power supplied into the I/O
+@@ -767,6 +768,7 @@ struct mt7530_priv {
+ 	struct device		*dev;
+ 	struct dsa_switch	*ds;
+ 	struct mii_bus		*bus;
++	struct regmap		*regmap;
+ 	struct reset_control	*rstc;
+ 	struct regulator	*core_pwr;
+ 	struct regulator	*io_pwr;
diff --git a/target/linux/generic/backport-5.15/790-v6.4-0005-net-dsa-mt7530-move-SGMII-PCS-creation-to-mt7530_pro.patch b/target/linux/generic/backport-5.15/790-v6.4-0005-net-dsa-mt7530-move-SGMII-PCS-creation-to-mt7530_pro.patch
new file mode 100644
index 00000000000000..44c31a4f6f2a29
--- /dev/null
+++ b/target/linux/generic/backport-5.15/790-v6.4-0005-net-dsa-mt7530-move-SGMII-PCS-creation-to-mt7530_pro.patch
@@ -0,0 +1,54 @@
+From 6de2852297737171ba96b91e89bf302ca1fda869 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:18:04 +0100
+Subject: [PATCH 08/16] net: dsa: mt7530: move SGMII PCS creation to
+ mt7530_probe function
+
+Move creating the SGMII PCS from mt753x_setup() to the more appropriate
+mt7530_probe() function.
+This is done also in preparation of moving all functions related to
+MDIO-connected MT753x switches to a separate module.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/mt7530.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -3022,12 +3022,6 @@ mt753x_setup(struct dsa_switch *ds)
+ 	if (ret && priv->irq)
+ 		mt7530_free_irq_common(priv);
+ 
+-	if (priv->id == ID_MT7531) {
+-		ret = mt7531_create_sgmii(priv);
+-		if (ret && priv->irq)
+-			mt7530_free_irq_common(priv);
+-	}
+-
+ 	return ret;
+ }
+ 
+@@ -3144,6 +3138,7 @@ mt7530_probe(struct mdio_device *mdiodev
+ 	static struct regmap_config *regmap_config;
+ 	struct mt7530_priv *priv;
+ 	struct device_node *dn;
++	int ret;
+ 
+ 	dn = mdiodev->dev.of_node;
+ 
+@@ -3236,6 +3231,12 @@ mt7530_probe(struct mdio_device *mdiodev
+ 	if (IS_ERR(priv->regmap))
+ 		return PTR_ERR(priv->regmap);
+ 
++	if (priv->id == ID_MT7531) {
++		ret = mt7531_create_sgmii(priv);
++		if (ret)
++			return ret;
++	}
++
+ 	return dsa_register_switch(priv->ds);
+ }
+ 
diff --git a/target/linux/generic/backport-5.15/790-v6.4-0006-net-dsa-mt7530-introduce-mutex-helpers.patch b/target/linux/generic/backport-5.15/790-v6.4-0006-net-dsa-mt7530-introduce-mutex-helpers.patch
new file mode 100644
index 00000000000000..c23f96e7a6605a
--- /dev/null
+++ b/target/linux/generic/backport-5.15/790-v6.4-0006-net-dsa-mt7530-introduce-mutex-helpers.patch
@@ -0,0 +1,273 @@
+From 1557c679f71c82a994eae0baadbaeb62b71e15bf Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:18:16 +0100
+Subject: [PATCH 09/16] net: dsa: mt7530: introduce mutex helpers
+
+As the MDIO bus lock only needs to be involved if actually operating
+on an MDIO-connected switch we will need to skip locking for built-in
+switches which are accessed via MMIO.
+Create helper functions which simplify that upcoming change.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/mt7530.c | 73 ++++++++++++++++++++--------------------
+ 1 file changed, 36 insertions(+), 37 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -143,31 +143,40 @@ err:
+ }
+ 
+ static void
+-core_write(struct mt7530_priv *priv, u32 reg, u32 val)
++mt7530_mutex_lock(struct mt7530_priv *priv)
+ {
+-	struct mii_bus *bus = priv->bus;
++	mutex_lock_nested(&priv->bus->mdio_lock, MDIO_MUTEX_NESTED);
++}
+ 
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++static void
++mt7530_mutex_unlock(struct mt7530_priv *priv)
++{
++	mutex_unlock(&priv->bus->mdio_lock);
++}
++
++static void
++core_write(struct mt7530_priv *priv, u32 reg, u32 val)
++{
++	mt7530_mutex_lock(priv);
+ 
+ 	core_write_mmd_indirect(priv, reg, MDIO_MMD_VEND2, val);
+ 
+-	mutex_unlock(&bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ }
+ 
+ static void
+ core_rmw(struct mt7530_priv *priv, u32 reg, u32 mask, u32 set)
+ {
+-	struct mii_bus *bus = priv->bus;
+ 	u32 val;
+ 
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(priv);
+ 
+ 	val = core_read_mmd_indirect(priv, reg, MDIO_MMD_VEND2);
+ 	val &= ~mask;
+ 	val |= set;
+ 	core_write_mmd_indirect(priv, reg, MDIO_MMD_VEND2, val);
+ 
+-	mutex_unlock(&bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ }
+ 
+ static void
+@@ -264,13 +273,11 @@ mt7530_mii_read(struct mt7530_priv *priv
+ static void
+ mt7530_write(struct mt7530_priv *priv, u32 reg, u32 val)
+ {
+-	struct mii_bus *bus = priv->bus;
+-
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(priv);
+ 
+ 	mt7530_mii_write(priv, reg, val);
+ 
+-	mutex_unlock(&bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ }
+ 
+ static u32
+@@ -282,14 +289,13 @@ _mt7530_unlocked_read(struct mt7530_dumm
+ static u32
+ _mt7530_read(struct mt7530_dummy_poll *p)
+ {
+-	struct mii_bus		*bus = p->priv->bus;
+ 	u32 val;
+ 
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(p->priv);
+ 
+ 	val = mt7530_mii_read(p->priv, p->reg);
+ 
+-	mutex_unlock(&bus->mdio_lock);
++	mt7530_mutex_unlock(p->priv);
+ 
+ 	return val;
+ }
+@@ -307,13 +313,11 @@ static void
+ mt7530_rmw(struct mt7530_priv *priv, u32 reg,
+ 	   u32 mask, u32 set)
+ {
+-	struct mii_bus *bus = priv->bus;
+-
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(priv);
+ 
+ 	regmap_update_bits(priv->regmap, reg, mask, set);
+ 
+-	mutex_unlock(&bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ }
+ 
+ static void
+@@ -645,14 +649,13 @@ static int
+ mt7531_ind_c45_phy_read(struct mt7530_priv *priv, int port, int devad,
+ 			int regnum)
+ {
+-	struct mii_bus *bus = priv->bus;
+ 	struct mt7530_dummy_poll p;
+ 	u32 reg, val;
+ 	int ret;
+ 
+ 	INIT_MT7530_DUMMY_POLL(&p, priv, MT7531_PHY_IAC);
+ 
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(priv);
+ 
+ 	ret = readx_poll_timeout(_mt7530_unlocked_read, &p, val,
+ 				 !(val & MT7531_PHY_ACS_ST), 20, 100000);
+@@ -685,7 +688,7 @@ mt7531_ind_c45_phy_read(struct mt7530_pr
+ 
+ 	ret = val & MT7531_MDIO_RW_DATA_MASK;
+ out:
+-	mutex_unlock(&bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ 
+ 	return ret;
+ }
+@@ -694,14 +697,13 @@ static int
+ mt7531_ind_c45_phy_write(struct mt7530_priv *priv, int port, int devad,
+ 			 int regnum, u32 data)
+ {
+-	struct mii_bus *bus = priv->bus;
+ 	struct mt7530_dummy_poll p;
+ 	u32 val, reg;
+ 	int ret;
+ 
+ 	INIT_MT7530_DUMMY_POLL(&p, priv, MT7531_PHY_IAC);
+ 
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(priv);
+ 
+ 	ret = readx_poll_timeout(_mt7530_unlocked_read, &p, val,
+ 				 !(val & MT7531_PHY_ACS_ST), 20, 100000);
+@@ -733,7 +735,7 @@ mt7531_ind_c45_phy_write(struct mt7530_p
+ 	}
+ 
+ out:
+-	mutex_unlock(&bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ 
+ 	return ret;
+ }
+@@ -741,14 +743,13 @@ out:
+ static int
+ mt7531_ind_c22_phy_read(struct mt7530_priv *priv, int port, int regnum)
+ {
+-	struct mii_bus *bus = priv->bus;
+ 	struct mt7530_dummy_poll p;
+ 	int ret;
+ 	u32 val;
+ 
+ 	INIT_MT7530_DUMMY_POLL(&p, priv, MT7531_PHY_IAC);
+ 
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(priv);
+ 
+ 	ret = readx_poll_timeout(_mt7530_unlocked_read, &p, val,
+ 				 !(val & MT7531_PHY_ACS_ST), 20, 100000);
+@@ -771,7 +772,7 @@ mt7531_ind_c22_phy_read(struct mt7530_pr
+ 
+ 	ret = val & MT7531_MDIO_RW_DATA_MASK;
+ out:
+-	mutex_unlock(&bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ 
+ 	return ret;
+ }
+@@ -780,14 +781,13 @@ static int
+ mt7531_ind_c22_phy_write(struct mt7530_priv *priv, int port, int regnum,
+ 			 u16 data)
+ {
+-	struct mii_bus *bus = priv->bus;
+ 	struct mt7530_dummy_poll p;
+ 	int ret;
+ 	u32 reg;
+ 
+ 	INIT_MT7530_DUMMY_POLL(&p, priv, MT7531_PHY_IAC);
+ 
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(priv);
+ 
+ 	ret = readx_poll_timeout(_mt7530_unlocked_read, &p, reg,
+ 				 !(reg & MT7531_PHY_ACS_ST), 20, 100000);
+@@ -809,7 +809,7 @@ mt7531_ind_c22_phy_write(struct mt7530_p
+ 	}
+ 
+ out:
+-	mutex_unlock(&bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ 
+ 	return ret;
+ }
+@@ -1109,7 +1109,6 @@ static int
+ mt7530_port_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
+ {
+ 	struct mt7530_priv *priv = ds->priv;
+-	struct mii_bus *bus = priv->bus;
+ 	int length;
+ 	u32 val;
+ 
+@@ -1120,7 +1119,7 @@ mt7530_port_change_mtu(struct dsa_switch
+ 	if (!dsa_is_cpu_port(ds, port))
+ 		return 0;
+ 
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(priv);
+ 
+ 	val = mt7530_mii_read(priv, MT7530_GMACCR);
+ 	val &= ~MAX_RX_PKT_LEN_MASK;
+@@ -1141,7 +1140,7 @@ mt7530_port_change_mtu(struct dsa_switch
+ 
+ 	mt7530_mii_write(priv, MT7530_GMACCR, val);
+ 
+-	mutex_unlock(&bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ 
+ 	return 0;
+ }
+@@ -1937,10 +1936,10 @@ mt7530_irq_thread_fn(int irq, void *dev_
+ 	u32 val;
+ 	int p;
+ 
+-	mutex_lock_nested(&priv->bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(priv);
+ 	val = mt7530_mii_read(priv, MT7530_SYS_INT_STS);
+ 	mt7530_mii_write(priv, MT7530_SYS_INT_STS, val);
+-	mutex_unlock(&priv->bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ 
+ 	for (p = 0; p < MT7530_NUM_PHYS; p++) {
+ 		if (BIT(p) & val) {
+@@ -1976,7 +1975,7 @@ mt7530_irq_bus_lock(struct irq_data *d)
+ {
+ 	struct mt7530_priv *priv = irq_data_get_irq_chip_data(d);
+ 
+-	mutex_lock_nested(&priv->bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(priv);
+ }
+ 
+ static void
+@@ -1985,7 +1984,7 @@ mt7530_irq_bus_sync_unlock(struct irq_da
+ 	struct mt7530_priv *priv = irq_data_get_irq_chip_data(d);
+ 
+ 	mt7530_mii_write(priv, MT7530_SYS_INT_EN, priv->irq_enable);
+-	mutex_unlock(&priv->bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ }
+ 
+ static struct irq_chip mt7530_irq_chip = {
diff --git a/target/linux/generic/backport-5.15/790-v6.4-0007-net-dsa-mt7530-move-p5_intf_modes-function-to-mt7530.patch b/target/linux/generic/backport-5.15/790-v6.4-0007-net-dsa-mt7530-move-p5_intf_modes-function-to-mt7530.patch
new file mode 100644
index 00000000000000..bd7ca33f6eddb2
--- /dev/null
+++ b/target/linux/generic/backport-5.15/790-v6.4-0007-net-dsa-mt7530-move-p5_intf_modes-function-to-mt7530.patch
@@ -0,0 +1,75 @@
+From 25d15dee34a1a40d5fd71636a205e3211f09fd1d Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:18:28 +0100
+Subject: [PATCH 10/16] net: dsa: mt7530: move p5_intf_modes() function to
+ mt7530.c
+
+In preparation of splitting mt7530.c into a driver for MDIO-connected
+as well as MDIO-accessed built-in switches on one hand and MMIO-accessed
+built-in switches move the p5_inft_modes() function from mt7530.h to
+mt7530.c. The function is only needed there and will trigger a compiler
+warning about a defined but unused function otherwise when including
+mt7530.h in the to-be-introduced bus-specific drivers.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/mt7530.c | 18 ++++++++++++++++++
+ drivers/net/dsa/mt7530.h | 18 ------------------
+ 2 files changed, 18 insertions(+), 18 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -950,6 +950,24 @@ mt7530_set_ageing_time(struct dsa_switch
+ 	return 0;
+ }
+ 
++static const char *p5_intf_modes(unsigned int p5_interface)
++{
++	switch (p5_interface) {
++	case P5_DISABLED:
++		return "DISABLED";
++	case P5_INTF_SEL_PHY_P0:
++		return "PHY P0";
++	case P5_INTF_SEL_PHY_P4:
++		return "PHY P4";
++	case P5_INTF_SEL_GMAC5:
++		return "GMAC5";
++	case P5_INTF_SEL_GMAC5_SGMII:
++		return "GMAC5_SGMII";
++	default:
++		return "unknown";
++	}
++}
++
+ static void mt7530_setup_port5(struct dsa_switch *ds, phy_interface_t interface)
+ {
+ 	struct mt7530_priv *priv = ds->priv;
+--- a/drivers/net/dsa/mt7530.h
++++ b/drivers/net/dsa/mt7530.h
+@@ -682,24 +682,6 @@ enum p5_interface_select {
+ 	P5_INTF_SEL_GMAC5_SGMII,
+ };
+ 
+-static const char *p5_intf_modes(unsigned int p5_interface)
+-{
+-	switch (p5_interface) {
+-	case P5_DISABLED:
+-		return "DISABLED";
+-	case P5_INTF_SEL_PHY_P0:
+-		return "PHY P0";
+-	case P5_INTF_SEL_PHY_P4:
+-		return "PHY P4";
+-	case P5_INTF_SEL_GMAC5:
+-		return "GMAC5";
+-	case P5_INTF_SEL_GMAC5_SGMII:
+-		return "GMAC5_SGMII";
+-	default:
+-		return "unknown";
+-	}
+-}
+-
+ struct mt7530_priv;
+ 
+ struct mt753x_pcs {
diff --git a/target/linux/generic/backport-5.15/790-v6.4-0008-net-dsa-mt7530-introduce-mt7530_probe_common-helper-.patch b/target/linux/generic/backport-5.15/790-v6.4-0008-net-dsa-mt7530-introduce-mt7530_probe_common-helper-.patch
new file mode 100644
index 00000000000000..aeb1e37a1a11ee
--- /dev/null
+++ b/target/linux/generic/backport-5.15/790-v6.4-0008-net-dsa-mt7530-introduce-mt7530_probe_common-helper-.patch
@@ -0,0 +1,155 @@
+From 37c9c0d8d0b2e24f8c9af72ecd4edd31537284d3 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:18:39 +0100
+Subject: [PATCH 11/16] net: dsa: mt7530: introduce mt7530_probe_common helper
+ function
+
+Move commonly used parts from mt7530_probe into new mt7530_probe_common
+helper function which will be used by both, mt7530_probe and the
+to-be-introduced mt7988_probe.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/mt7530.c | 98 ++++++++++++++++++++++------------------
+ 1 file changed, 54 insertions(+), 44 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -3150,44 +3150,21 @@ static const struct of_device_id mt7530_
+ MODULE_DEVICE_TABLE(of, mt7530_of_match);
+ 
+ static int
+-mt7530_probe(struct mdio_device *mdiodev)
++mt7530_probe_common(struct mt7530_priv *priv)
+ {
+-	static struct regmap_config *regmap_config;
+-	struct mt7530_priv *priv;
+-	struct device_node *dn;
+-	int ret;
++	struct device *dev = priv->dev;
+ 
+-	dn = mdiodev->dev.of_node;
+-
+-	priv = devm_kzalloc(&mdiodev->dev, sizeof(*priv), GFP_KERNEL);
+-	if (!priv)
+-		return -ENOMEM;
+-
+-	priv->ds = devm_kzalloc(&mdiodev->dev, sizeof(*priv->ds), GFP_KERNEL);
++	priv->ds = devm_kzalloc(dev, sizeof(*priv->ds), GFP_KERNEL);
+ 	if (!priv->ds)
+ 		return -ENOMEM;
+ 
+-	priv->ds->dev = &mdiodev->dev;
++	priv->ds->dev = dev;
+ 	priv->ds->num_ports = MT7530_NUM_PORTS;
+ 
+-	/* Use medatek,mcm property to distinguish hardware type that would
+-	 * casues a little bit differences on power-on sequence.
+-	 */
+-	priv->mcm = of_property_read_bool(dn, "mediatek,mcm");
+-	if (priv->mcm) {
+-		dev_info(&mdiodev->dev, "MT7530 adapts as multi-chip module\n");
+-
+-		priv->rstc = devm_reset_control_get(&mdiodev->dev, "mcm");
+-		if (IS_ERR(priv->rstc)) {
+-			dev_err(&mdiodev->dev, "Couldn't get our reset line\n");
+-			return PTR_ERR(priv->rstc);
+-		}
+-	}
+-
+ 	/* Get the hardware identifier from the devicetree node.
+ 	 * We will need it for some of the clock and regulator setup.
+ 	 */
+-	priv->info = of_device_get_match_data(&mdiodev->dev);
++	priv->info = of_device_get_match_data(dev);
+ 	if (!priv->info)
+ 		return -EINVAL;
+ 
+@@ -3201,23 +3178,53 @@ mt7530_probe(struct mdio_device *mdiodev
+ 		return -EINVAL;
+ 
+ 	priv->id = priv->info->id;
++	priv->dev = dev;
++	priv->ds->priv = priv;
++	priv->ds->ops = &mt7530_switch_ops;
++	mutex_init(&priv->reg_mutex);
++	dev_set_drvdata(dev, priv);
+ 
+-	if (priv->id == ID_MT7530) {
+-		priv->core_pwr = devm_regulator_get(&mdiodev->dev, "core");
+-		if (IS_ERR(priv->core_pwr))
+-			return PTR_ERR(priv->core_pwr);
++	return 0;
++}
+ 
+-		priv->io_pwr = devm_regulator_get(&mdiodev->dev, "io");
+-		if (IS_ERR(priv->io_pwr))
+-			return PTR_ERR(priv->io_pwr);
+-	}
++static int
++mt7530_probe(struct mdio_device *mdiodev)
++{
++	static struct regmap_config *regmap_config;
++	struct mt7530_priv *priv;
++	struct device_node *dn;
++	int ret;
++
++	dn = mdiodev->dev.of_node;
++
++	priv = devm_kzalloc(&mdiodev->dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
+ 
+-	/* Not MCM that indicates switch works as the remote standalone
++	priv->bus = mdiodev->bus;
++	priv->dev = &mdiodev->dev;
++
++	ret = mt7530_probe_common(priv);
++	if (ret)
++		return ret;
++
++	/* Use medatek,mcm property to distinguish hardware type that would
++	 * cause a little bit differences on power-on sequence.
++	 * Not MCM that indicates switch works as the remote standalone
+ 	 * integrated circuit so the GPIO pin would be used to complete
+ 	 * the reset, otherwise memory-mapped register accessing used
+ 	 * through syscon provides in the case of MCM.
+ 	 */
+-	if (!priv->mcm) {
++	priv->mcm = of_property_read_bool(dn, "mediatek,mcm");
++	if (priv->mcm) {
++		dev_info(&mdiodev->dev, "MT7530 adapts as multi-chip module\n");
++
++		priv->rstc = devm_reset_control_get(&mdiodev->dev, "mcm");
++		if (IS_ERR(priv->rstc)) {
++			dev_err(&mdiodev->dev, "Couldn't get our reset line\n");
++			return PTR_ERR(priv->rstc);
++		}
++	} else {
+ 		priv->reset = devm_gpiod_get_optional(&mdiodev->dev, "reset",
+ 						      GPIOD_OUT_LOW);
+ 		if (IS_ERR(priv->reset)) {
+@@ -3226,12 +3233,15 @@ mt7530_probe(struct mdio_device *mdiodev
+ 		}
+ 	}
+ 
+-	priv->bus = mdiodev->bus;
+-	priv->dev = &mdiodev->dev;
+-	priv->ds->priv = priv;
+-	priv->ds->ops = &mt7530_switch_ops;
+-	mutex_init(&priv->reg_mutex);
+-	dev_set_drvdata(&mdiodev->dev, priv);
++	if (priv->id == ID_MT7530) {
++		priv->core_pwr = devm_regulator_get(&mdiodev->dev, "core");
++		if (IS_ERR(priv->core_pwr))
++			return PTR_ERR(priv->core_pwr);
++
++		priv->io_pwr = devm_regulator_get(&mdiodev->dev, "io");
++		if (IS_ERR(priv->io_pwr))
++			return PTR_ERR(priv->io_pwr);
++	}
+ 
+ 	regmap_config = devm_kzalloc(&mdiodev->dev, sizeof(*regmap_config),
+ 				     GFP_KERNEL);
diff --git a/target/linux/generic/backport-5.15/790-v6.4-0009-net-dsa-mt7530-introduce-mt7530_remove_common-helper.patch b/target/linux/generic/backport-5.15/790-v6.4-0009-net-dsa-mt7530-introduce-mt7530_remove_common-helper.patch
new file mode 100644
index 00000000000000..2651f4591835f1
--- /dev/null
+++ b/target/linux/generic/backport-5.15/790-v6.4-0009-net-dsa-mt7530-introduce-mt7530_remove_common-helper.patch
@@ -0,0 +1,55 @@
+From 720d736351761574af02ed093658ab60de60576c Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:18:50 +0100
+Subject: [PATCH 12/16] net: dsa: mt7530: introduce mt7530_remove_common helper
+ function
+
+Move commonly used parts from mt7530_remove into new
+mt7530_remove_common helper function which will be used by both,
+mt7530_remove and the to-be-introduced mt7988_remove.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/mt7530.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -3268,6 +3268,17 @@ mt7530_probe(struct mdio_device *mdiodev
+ }
+ 
+ static void
++mt7530_remove_common(struct mt7530_priv *priv)
++{
++	if (priv->irq)
++		mt7530_free_irq(priv);
++
++	dsa_unregister_switch(priv->ds);
++
++	mutex_destroy(&priv->reg_mutex);
++}
++
++static void
+ mt7530_remove(struct mdio_device *mdiodev)
+ {
+ 	struct mt7530_priv *priv = dev_get_drvdata(&mdiodev->dev);
+@@ -3286,16 +3297,11 @@ mt7530_remove(struct mdio_device *mdiode
+ 		dev_err(priv->dev, "Failed to disable io pwr: %d\n",
+ 			ret);
+ 
+-	if (priv->irq)
+-		mt7530_free_irq(priv);
+-
+-	dsa_unregister_switch(priv->ds);
++	mt7530_remove_common(priv);
+ 
+ 	for (i = 0; i < 2; ++i)
+ 		mtk_pcs_lynxi_destroy(priv->ports[5 + i].sgmii_pcs);
+ 
+-	mutex_destroy(&priv->reg_mutex);
+-
+ 	dev_set_drvdata(&mdiodev->dev, NULL);
+ }
+ 
diff --git a/target/linux/generic/backport-5.15/790-v6.4-0011-net-dsa-mt7530-introduce-separate-MDIO-driver.patch b/target/linux/generic/backport-5.15/790-v6.4-0011-net-dsa-mt7530-introduce-separate-MDIO-driver.patch
new file mode 100644
index 00000000000000..51346d0620d3a9
--- /dev/null
+++ b/target/linux/generic/backport-5.15/790-v6.4-0011-net-dsa-mt7530-introduce-separate-MDIO-driver.patch
@@ -0,0 +1,692 @@
+From cb675afcddbbeb2bfa6596e3bc236bc026cd425f Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:19:13 +0100
+Subject: [PATCH 14/16] net: dsa: mt7530: introduce separate MDIO driver
+
+Split MT7530 switch driver into a common part and a part specific
+for MDIO connected switches and multi-chip modules.
+Move MDIO-specific functions to newly introduced mt7530-mdio.c while
+keeping the common parts in mt7530.c.
+Introduce new Kconfig symbol CONFIG_NET_DSA_MT7530_MDIO which is
+implied by CONFIG_NET_DSA_MT7530.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ MAINTAINERS                   |   1 +
+ drivers/net/dsa/Kconfig       |  15 +-
+ drivers/net/dsa/Makefile      |   1 +
+ drivers/net/dsa/mt7530-mdio.c | 271 ++++++++++++++++++++++++++++++++++
+ drivers/net/dsa/mt7530.c      | 264 +--------------------------------
+ drivers/net/dsa/mt7530.h      |   6 +
+ 6 files changed, 300 insertions(+), 258 deletions(-)
+ create mode 100644 drivers/net/dsa/mt7530-mdio.c
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -11901,6 +11901,7 @@ M:	Landen Chao <Landen.Chao@mediatek.com
+ M:	DENG Qingfang <dqfext@gmail.com>
+ L:	netdev@vger.kernel.org
+ S:	Maintained
++F:	drivers/net/dsa/mt7530-mdio.c
+ F:	drivers/net/dsa/mt7530.*
+ F:	net/dsa/tag_mtk.c
+ 
+--- a/drivers/net/dsa/Kconfig
++++ b/drivers/net/dsa/Kconfig
+@@ -37,10 +37,22 @@ config NET_DSA_MT7530
+ 	tristate "MediaTek MT753x and MT7621 Ethernet switch support"
+ 	select NET_DSA_TAG_MTK
+ 	select MEDIATEK_GE_PHY
++	imply NET_DSA_MT7530_MDIO
++	help
++	  This enables support for the MediaTek MT7530 and MT7531 Ethernet
++	  switch chips. Multi-chip module MT7530 in MT7621AT, MT7621DAT,
++	  MT7621ST and MT7623AI SoCs, and built-in switch in MT7988 SoC are
++	  supported as well.
++
++config NET_DSA_MT7530_MDIO
++	tristate "MediaTek MT7530 MDIO interface driver"
++	depends on NET_DSA_MT7530
+ 	select PCS_MTK_LYNXI
+ 	help
+-	  This enables support for the MediaTek MT7530, MT7531, and MT7621
+-	  Ethernet switch chips.
++	  This enables support for the MediaTek MT7530 and MT7531 switch
++	  chips which are connected via MDIO, as well as multi-chip
++	  module MT7530 which can be found in the MT7621AT, MT7621DAT,
++	  MT7621ST and MT7623AI SoCs.
+ 
+ config NET_DSA_MV88E6060
+ 	tristate "Marvell 88E6060 ethernet switch chip support"
+--- a/drivers/net/dsa/Makefile
++++ b/drivers/net/dsa/Makefile
+@@ -7,6 +7,7 @@ obj-$(CONFIG_FIXED_PHY)		+= dsa_loop_bdi
+ endif
+ obj-$(CONFIG_NET_DSA_LANTIQ_GSWIP) += lantiq_gswip.o
+ obj-$(CONFIG_NET_DSA_MT7530)	+= mt7530.o
++obj-$(CONFIG_NET_DSA_MT7530_MDIO) += mt7530-mdio.o
+ obj-$(CONFIG_NET_DSA_MV88E6060) += mv88e6060.o
+ obj-$(CONFIG_NET_DSA_REALTEK_SMI) += realtek-smi.o
+ realtek-smi-objs		:= realtek-smi-core.o rtl8366.o rtl8366rb.o
+--- /dev/null
++++ b/drivers/net/dsa/mt7530-mdio.c
+@@ -0,0 +1,271 @@
++// SPDX-License-Identifier: GPL-2.0-only
++
++#include <linux/gpio/consumer.h>
++#include <linux/mdio.h>
++#include <linux/module.h>
++#include <linux/pcs/pcs-mtk-lynxi.h>
++#include <linux/of_irq.h>
++#include <linux/of_mdio.h>
++#include <linux/of_net.h>
++#include <linux/of_platform.h>
++#include <linux/regmap.h>
++#include <linux/reset.h>
++#include <linux/regulator/consumer.h>
++#include <net/dsa.h>
++
++#include "mt7530.h"
++
++static int
++mt7530_regmap_write(void *context, unsigned int reg, unsigned int val)
++{
++	struct mii_bus *bus = context;
++	u16 page, r, lo, hi;
++	int ret;
++
++	page = (reg >> 6) & 0x3ff;
++	r  = (reg >> 2) & 0xf;
++	lo = val & 0xffff;
++	hi = val >> 16;
++
++	/* MT7530 uses 31 as the pseudo port */
++	ret = bus->write(bus, 0x1f, 0x1f, page);
++	if (ret < 0)
++		return ret;
++
++	ret = bus->write(bus, 0x1f, r,  lo);
++	if (ret < 0)
++		return ret;
++
++	ret = bus->write(bus, 0x1f, 0x10, hi);
++	return ret;
++}
++
++static int
++mt7530_regmap_read(void *context, unsigned int reg, unsigned int *val)
++{
++	struct mii_bus *bus = context;
++	u16 page, r, lo, hi;
++	int ret;
++
++	page = (reg >> 6) & 0x3ff;
++	r = (reg >> 2) & 0xf;
++
++	/* MT7530 uses 31 as the pseudo port */
++	ret = bus->write(bus, 0x1f, 0x1f, page);
++	if (ret < 0)
++		return ret;
++
++	lo = bus->read(bus, 0x1f, r);
++	hi = bus->read(bus, 0x1f, 0x10);
++
++	*val = (hi << 16) | (lo & 0xffff);
++
++	return 0;
++}
++
++static void
++mt7530_mdio_regmap_lock(void *mdio_lock)
++{
++	mutex_lock_nested(mdio_lock, MDIO_MUTEX_NESTED);
++}
++
++static void
++mt7530_mdio_regmap_unlock(void *mdio_lock)
++{
++	mutex_unlock(mdio_lock);
++}
++
++static const struct regmap_bus mt7530_regmap_bus = {
++	.reg_write = mt7530_regmap_write,
++	.reg_read = mt7530_regmap_read,
++};
++
++static int
++mt7531_create_sgmii(struct mt7530_priv *priv)
++{
++	struct regmap_config *mt7531_pcs_config[2];
++	struct phylink_pcs *pcs;
++	struct regmap *regmap;
++	int i, ret = 0;
++
++	for (i = 0; i < 2; i++) {
++		mt7531_pcs_config[i] = devm_kzalloc(priv->dev,
++						    sizeof(struct regmap_config),
++						    GFP_KERNEL);
++		if (!mt7531_pcs_config[i]) {
++			ret = -ENOMEM;
++			break;
++		}
++
++		mt7531_pcs_config[i]->name = i ? "port6" : "port5";
++		mt7531_pcs_config[i]->reg_bits = 16;
++		mt7531_pcs_config[i]->val_bits = 32;
++		mt7531_pcs_config[i]->reg_stride = 4;
++		mt7531_pcs_config[i]->reg_base = MT7531_SGMII_REG_BASE(5 + i);
++		mt7531_pcs_config[i]->max_register = 0x17c;
++		mt7531_pcs_config[i]->lock = mt7530_mdio_regmap_lock;
++		mt7531_pcs_config[i]->unlock = mt7530_mdio_regmap_unlock;
++		mt7531_pcs_config[i]->lock_arg = &priv->bus->mdio_lock;
++
++		regmap = devm_regmap_init(priv->dev,
++					  &mt7530_regmap_bus, priv->bus,
++					  mt7531_pcs_config[i]);
++		if (IS_ERR(regmap)) {
++			ret = PTR_ERR(regmap);
++			break;
++		}
++		pcs = mtk_pcs_lynxi_create(priv->dev, regmap,
++					   MT7531_PHYA_CTRL_SIGNAL3, 0);
++		if (!pcs) {
++			ret = -ENXIO;
++			break;
++		}
++		priv->ports[5 + i].sgmii_pcs = pcs;
++	}
++
++	if (ret && i)
++		mtk_pcs_lynxi_destroy(priv->ports[5].sgmii_pcs);
++
++	return ret;
++}
++
++static const struct of_device_id mt7530_of_match[] = {
++	{ .compatible = "mediatek,mt7621", .data = &mt753x_table[ID_MT7621], },
++	{ .compatible = "mediatek,mt7530", .data = &mt753x_table[ID_MT7530], },
++	{ .compatible = "mediatek,mt7531", .data = &mt753x_table[ID_MT7531], },
++	{ /* sentinel */ },
++};
++MODULE_DEVICE_TABLE(of, mt7530_of_match);
++
++static int
++mt7530_probe(struct mdio_device *mdiodev)
++{
++	static struct regmap_config *regmap_config;
++	struct mt7530_priv *priv;
++	struct device_node *dn;
++	int ret;
++
++	dn = mdiodev->dev.of_node;
++
++	priv = devm_kzalloc(&mdiodev->dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	priv->bus = mdiodev->bus;
++	priv->dev = &mdiodev->dev;
++
++	ret = mt7530_probe_common(priv);
++	if (ret)
++		return ret;
++
++	/* Use medatek,mcm property to distinguish hardware type that would
++	 * cause a little bit differences on power-on sequence.
++	 * Not MCM that indicates switch works as the remote standalone
++	 * integrated circuit so the GPIO pin would be used to complete
++	 * the reset, otherwise memory-mapped register accessing used
++	 * through syscon provides in the case of MCM.
++	 */
++	priv->mcm = of_property_read_bool(dn, "mediatek,mcm");
++	if (priv->mcm) {
++		dev_info(&mdiodev->dev, "MT7530 adapts as multi-chip module\n");
++
++		priv->rstc = devm_reset_control_get(&mdiodev->dev, "mcm");
++		if (IS_ERR(priv->rstc)) {
++			dev_err(&mdiodev->dev, "Couldn't get our reset line\n");
++			return PTR_ERR(priv->rstc);
++		}
++	} else {
++		priv->reset = devm_gpiod_get_optional(&mdiodev->dev, "reset",
++						      GPIOD_OUT_LOW);
++		if (IS_ERR(priv->reset)) {
++			dev_err(&mdiodev->dev, "Couldn't get our reset line\n");
++			return PTR_ERR(priv->reset);
++		}
++	}
++
++	if (priv->id == ID_MT7530) {
++		priv->core_pwr = devm_regulator_get(&mdiodev->dev, "core");
++		if (IS_ERR(priv->core_pwr))
++			return PTR_ERR(priv->core_pwr);
++
++		priv->io_pwr = devm_regulator_get(&mdiodev->dev, "io");
++		if (IS_ERR(priv->io_pwr))
++			return PTR_ERR(priv->io_pwr);
++	}
++
++	regmap_config = devm_kzalloc(&mdiodev->dev, sizeof(*regmap_config),
++				     GFP_KERNEL);
++	if (!regmap_config)
++		return -ENOMEM;
++
++	regmap_config->reg_bits = 16;
++	regmap_config->val_bits = 32;
++	regmap_config->reg_stride = 4;
++	regmap_config->max_register = MT7530_CREV;
++	regmap_config->disable_locking = true;
++	priv->regmap = devm_regmap_init(priv->dev, &mt7530_regmap_bus,
++					priv->bus, regmap_config);
++	if (IS_ERR(priv->regmap))
++		return PTR_ERR(priv->regmap);
++
++	if (priv->id == ID_MT7531) {
++		ret = mt7531_create_sgmii(priv);
++		if (ret)
++			return ret;
++	}
++
++	return dsa_register_switch(priv->ds);
++}
++
++static void
++mt7530_remove(struct mdio_device *mdiodev)
++{
++	struct mt7530_priv *priv = dev_get_drvdata(&mdiodev->dev);
++	int ret = 0, i;
++
++	if (!priv)
++		return;
++
++	ret = regulator_disable(priv->core_pwr);
++	if (ret < 0)
++		dev_err(priv->dev,
++			"Failed to disable core power: %d\n", ret);
++
++	ret = regulator_disable(priv->io_pwr);
++	if (ret < 0)
++		dev_err(priv->dev, "Failed to disable io pwr: %d\n",
++			ret);
++
++	mt7530_remove_common(priv);
++
++	for (i = 0; i < 2; ++i)
++		mtk_pcs_lynxi_destroy(priv->ports[5 + i].sgmii_pcs);
++}
++
++static void mt7530_shutdown(struct mdio_device *mdiodev)
++{
++	struct mt7530_priv *priv = dev_get_drvdata(&mdiodev->dev);
++
++	if (!priv)
++		return;
++
++	dsa_switch_shutdown(priv->ds);
++
++	dev_set_drvdata(&mdiodev->dev, NULL);
++}
++
++static struct mdio_driver mt7530_mdio_driver = {
++	.probe  = mt7530_probe,
++	.remove = mt7530_remove,
++	.shutdown = mt7530_shutdown,
++	.mdiodrv.driver = {
++		.name = "mt7530-mdio",
++		.of_match_table = mt7530_of_match,
++	},
++};
++
++mdio_module_driver(mt7530_mdio_driver);
++
++MODULE_AUTHOR("Sean Wang <sean.wang@mediatek.com>");
++MODULE_DESCRIPTION("Driver for Mediatek MT7530 Switch (MDIO)");
++MODULE_LICENSE("GPL");
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -14,7 +14,6 @@
+ #include <linux/of_mdio.h>
+ #include <linux/of_net.h>
+ #include <linux/of_platform.h>
+-#include <linux/pcs/pcs-mtk-lynxi.h>
+ #include <linux/phylink.h>
+ #include <linux/regmap.h>
+ #include <linux/regulator/consumer.h>
+@@ -192,31 +191,6 @@ core_clear(struct mt7530_priv *priv, u32
+ }
+ 
+ static int
+-mt7530_regmap_write(void *context, unsigned int reg, unsigned int val)
+-{
+-	struct mii_bus *bus = context;
+-	u16 page, r, lo, hi;
+-	int ret;
+-
+-	page = (reg >> 6) & 0x3ff;
+-	r  = (reg >> 2) & 0xf;
+-	lo = val & 0xffff;
+-	hi = val >> 16;
+-
+-	/* MT7530 uses 31 as the pseudo port */
+-	ret = bus->write(bus, 0x1f, 0x1f, page);
+-	if (ret < 0)
+-		return ret;
+-
+-	ret = bus->write(bus, 0x1f, r,  lo);
+-	if (ret < 0)
+-		return ret;
+-
+-	ret = bus->write(bus, 0x1f, 0x10, hi);
+-	return ret;
+-}
+-
+-static int
+ mt7530_mii_write(struct mt7530_priv *priv, u32 reg, u32 val)
+ {
+ 	int ret;
+@@ -230,29 +204,6 @@ mt7530_mii_write(struct mt7530_priv *pri
+ 	return ret;
+ }
+ 
+-static int
+-mt7530_regmap_read(void *context, unsigned int reg, unsigned int *val)
+-{
+-	struct mii_bus *bus = context;
+-	u16 page, r, lo, hi;
+-	int ret;
+-
+-	page = (reg >> 6) & 0x3ff;
+-	r = (reg >> 2) & 0xf;
+-
+-	/* MT7530 uses 31 as the pseudo port */
+-	ret = bus->write(bus, 0x1f, 0x1f, page);
+-	if (ret < 0)
+-		return ret;
+-
+-	lo = bus->read(bus, 0x1f, r);
+-	hi = bus->read(bus, 0x1f, 0x10);
+-
+-	*val = (hi << 16) | (lo & 0xffff);
+-
+-	return 0;
+-}
+-
+ static u32
+ mt7530_mii_read(struct mt7530_priv *priv, u32 reg)
+ {
+@@ -2948,72 +2899,6 @@ static const struct phylink_pcs_ops mt75
+ 	.pcs_an_restart = mt7530_pcs_an_restart,
+ };
+ 
+-static void
+-mt7530_mdio_regmap_lock(void *mdio_lock)
+-{
+-	mutex_lock_nested(mdio_lock, MDIO_MUTEX_NESTED);
+-}
+-
+-static void
+-mt7530_mdio_regmap_unlock(void *mdio_lock)
+-{
+-	mutex_unlock(mdio_lock);
+-}
+-
+-static const struct regmap_bus mt7530_regmap_bus = {
+-	.reg_write = mt7530_regmap_write,
+-	.reg_read = mt7530_regmap_read,
+-};
+-
+-static int
+-mt7531_create_sgmii(struct mt7530_priv *priv)
+-{
+-	struct regmap_config *mt7531_pcs_config[2];
+-	struct phylink_pcs *pcs;
+-	struct regmap *regmap;
+-	int i, ret = 0;
+-
+-	for (i = 0; i < 2; i++) {
+-		mt7531_pcs_config[i] = devm_kzalloc(priv->dev,
+-						    sizeof(struct regmap_config),
+-						    GFP_KERNEL);
+-		if (!mt7531_pcs_config[i]) {
+-			ret = -ENOMEM;
+-			break;
+-		}
+-
+-		mt7531_pcs_config[i]->name = i ? "port6" : "port5";
+-		mt7531_pcs_config[i]->reg_bits = 16;
+-		mt7531_pcs_config[i]->val_bits = 32;
+-		mt7531_pcs_config[i]->reg_stride = 4;
+-		mt7531_pcs_config[i]->reg_base = MT7531_SGMII_REG_BASE(5 + i);
+-		mt7531_pcs_config[i]->max_register = 0x17c;
+-		mt7531_pcs_config[i]->lock = mt7530_mdio_regmap_lock;
+-		mt7531_pcs_config[i]->unlock = mt7530_mdio_regmap_unlock;
+-		mt7531_pcs_config[i]->lock_arg = &priv->bus->mdio_lock;
+-
+-		regmap = devm_regmap_init(priv->dev,
+-					  &mt7530_regmap_bus, priv->bus,
+-					  mt7531_pcs_config[i]);
+-		if (IS_ERR(regmap)) {
+-			ret = PTR_ERR(regmap);
+-			break;
+-		}
+-		pcs = mtk_pcs_lynxi_create(priv->dev, regmap,
+-					   MT7531_PHYA_CTRL_SIGNAL3, 0);
+-		if (!pcs) {
+-			ret = -ENXIO;
+-			break;
+-		}
+-		priv->ports[5 + i].sgmii_pcs = pcs;
+-	}
+-
+-	if (ret && i)
+-		mtk_pcs_lynxi_destroy(priv->ports[5].sgmii_pcs);
+-
+-	return ret;
+-}
+-
+ static int
+ mt753x_setup(struct dsa_switch *ds)
+ {
+@@ -3072,7 +2957,7 @@ static int mt753x_set_mac_eee(struct dsa
+ 	return 0;
+ }
+ 
+-static const struct dsa_switch_ops mt7530_switch_ops = {
++const struct dsa_switch_ops mt7530_switch_ops = {
+ 	.get_tag_protocol	= mtk_get_tag_protocol,
+ 	.setup			= mt753x_setup,
+ 	.get_strings		= mt7530_get_strings,
+@@ -3106,8 +2991,9 @@ static const struct dsa_switch_ops mt753
+ 	.get_mac_eee		= mt753x_get_mac_eee,
+ 	.set_mac_eee		= mt753x_set_mac_eee,
+ };
++EXPORT_SYMBOL_GPL(mt7530_switch_ops);
+ 
+-static const struct mt753x_info mt753x_table[] = {
++const struct mt753x_info mt753x_table[] = {
+ 	[ID_MT7621] = {
+ 		.id = ID_MT7621,
+ 		.pcs_ops = &mt7530_pcs_ops,
+@@ -3140,16 +3026,9 @@ static const struct mt753x_info mt753x_t
+ 		.mac_port_config = mt7531_mac_config,
+ 	},
+ };
++EXPORT_SYMBOL_GPL(mt753x_table);
+ 
+-static const struct of_device_id mt7530_of_match[] = {
+-	{ .compatible = "mediatek,mt7621", .data = &mt753x_table[ID_MT7621], },
+-	{ .compatible = "mediatek,mt7530", .data = &mt753x_table[ID_MT7530], },
+-	{ .compatible = "mediatek,mt7531", .data = &mt753x_table[ID_MT7531], },
+-	{ /* sentinel */ },
+-};
+-MODULE_DEVICE_TABLE(of, mt7530_of_match);
+-
+-static int
++int
+ mt7530_probe_common(struct mt7530_priv *priv)
+ {
+ 	struct device *dev = priv->dev;
+@@ -3186,88 +3065,9 @@ mt7530_probe_common(struct mt7530_priv *
+ 
+ 	return 0;
+ }
++EXPORT_SYMBOL_GPL(mt7530_probe_common);
+ 
+-static int
+-mt7530_probe(struct mdio_device *mdiodev)
+-{
+-	static struct regmap_config *regmap_config;
+-	struct mt7530_priv *priv;
+-	struct device_node *dn;
+-	int ret;
+-
+-	dn = mdiodev->dev.of_node;
+-
+-	priv = devm_kzalloc(&mdiodev->dev, sizeof(*priv), GFP_KERNEL);
+-	if (!priv)
+-		return -ENOMEM;
+-
+-	priv->bus = mdiodev->bus;
+-	priv->dev = &mdiodev->dev;
+-
+-	ret = mt7530_probe_common(priv);
+-	if (ret)
+-		return ret;
+-
+-	/* Use medatek,mcm property to distinguish hardware type that would
+-	 * cause a little bit differences on power-on sequence.
+-	 * Not MCM that indicates switch works as the remote standalone
+-	 * integrated circuit so the GPIO pin would be used to complete
+-	 * the reset, otherwise memory-mapped register accessing used
+-	 * through syscon provides in the case of MCM.
+-	 */
+-	priv->mcm = of_property_read_bool(dn, "mediatek,mcm");
+-	if (priv->mcm) {
+-		dev_info(&mdiodev->dev, "MT7530 adapts as multi-chip module\n");
+-
+-		priv->rstc = devm_reset_control_get(&mdiodev->dev, "mcm");
+-		if (IS_ERR(priv->rstc)) {
+-			dev_err(&mdiodev->dev, "Couldn't get our reset line\n");
+-			return PTR_ERR(priv->rstc);
+-		}
+-	} else {
+-		priv->reset = devm_gpiod_get_optional(&mdiodev->dev, "reset",
+-						      GPIOD_OUT_LOW);
+-		if (IS_ERR(priv->reset)) {
+-			dev_err(&mdiodev->dev, "Couldn't get our reset line\n");
+-			return PTR_ERR(priv->reset);
+-		}
+-	}
+-
+-	if (priv->id == ID_MT7530) {
+-		priv->core_pwr = devm_regulator_get(&mdiodev->dev, "core");
+-		if (IS_ERR(priv->core_pwr))
+-			return PTR_ERR(priv->core_pwr);
+-
+-		priv->io_pwr = devm_regulator_get(&mdiodev->dev, "io");
+-		if (IS_ERR(priv->io_pwr))
+-			return PTR_ERR(priv->io_pwr);
+-	}
+-
+-	regmap_config = devm_kzalloc(&mdiodev->dev, sizeof(*regmap_config),
+-				     GFP_KERNEL);
+-	if (!regmap_config)
+-		return -ENOMEM;
+-
+-	regmap_config->reg_bits = 16;
+-	regmap_config->val_bits = 32;
+-	regmap_config->reg_stride = 4;
+-	regmap_config->max_register = MT7530_CREV;
+-	regmap_config->disable_locking = true;
+-	priv->regmap = devm_regmap_init(priv->dev, &mt7530_regmap_bus,
+-					priv->bus, regmap_config);
+-	if (IS_ERR(priv->regmap))
+-		return PTR_ERR(priv->regmap);
+-
+-	if (priv->id == ID_MT7531) {
+-		ret = mt7531_create_sgmii(priv);
+-		if (ret)
+-			return ret;
+-	}
+-
+-	return dsa_register_switch(priv->ds);
+-}
+-
+-static void
++void
+ mt7530_remove_common(struct mt7530_priv *priv)
+ {
+ 	if (priv->irq)
+@@ -3278,57 +3078,6 @@ mt7530_remove_common(struct mt7530_priv
+ 	mutex_destroy(&priv->reg_mutex);
+ }
+ 
+-static void
+-mt7530_remove(struct mdio_device *mdiodev)
+-{
+-	struct mt7530_priv *priv = dev_get_drvdata(&mdiodev->dev);
+-	int ret = 0, i;
+-
+-	if (!priv)
+-		return;
+-
+-	ret = regulator_disable(priv->core_pwr);
+-	if (ret < 0)
+-		dev_err(priv->dev,
+-			"Failed to disable core power: %d\n", ret);
+-
+-	ret = regulator_disable(priv->io_pwr);
+-	if (ret < 0)
+-		dev_err(priv->dev, "Failed to disable io pwr: %d\n",
+-			ret);
+-
+-	mt7530_remove_common(priv);
+-
+-	for (i = 0; i < 2; ++i)
+-		mtk_pcs_lynxi_destroy(priv->ports[5 + i].sgmii_pcs);
+-
+-	dev_set_drvdata(&mdiodev->dev, NULL);
+-}
+-
+-static void mt7530_shutdown(struct mdio_device *mdiodev)
+-{
+-	struct mt7530_priv *priv = dev_get_drvdata(&mdiodev->dev);
+-
+-	if (!priv)
+-		return;
+-
+-	dsa_switch_shutdown(priv->ds);
+-
+-	dev_set_drvdata(&mdiodev->dev, NULL);
+-}
+-
+-static struct mdio_driver mt7530_mdio_driver = {
+-	.probe  = mt7530_probe,
+-	.remove = mt7530_remove,
+-	.shutdown = mt7530_shutdown,
+-	.mdiodrv.driver = {
+-		.name = "mt7530",
+-		.of_match_table = mt7530_of_match,
+-	},
+-};
+-
+-mdio_module_driver(mt7530_mdio_driver);
+-
+ MODULE_AUTHOR("Sean Wang <sean.wang@mediatek.com>");
+ MODULE_DESCRIPTION("Driver for Mediatek MT7530 Switch");
+ MODULE_LICENSE("GPL");
+--- a/drivers/net/dsa/mt7530.h
++++ b/drivers/net/dsa/mt7530.h
+@@ -807,4 +807,10 @@ static inline void INIT_MT7530_DUMMY_POL
+ 	p->reg = reg;
+ }
+ 
++int mt7530_probe_common(struct mt7530_priv *priv);
++void mt7530_remove_common(struct mt7530_priv *priv);
++
++extern const struct dsa_switch_ops mt7530_switch_ops;
++extern const struct mt753x_info mt753x_table[];
++
+ #endif /* __MT7530_H */
diff --git a/target/linux/generic/backport-5.15/790-v6.4-0012-net-dsa-mt7530-skip-locking-if-MDIO-bus-isn-t-presen.patch b/target/linux/generic/backport-5.15/790-v6.4-0012-net-dsa-mt7530-skip-locking-if-MDIO-bus-isn-t-presen.patch
new file mode 100644
index 00000000000000..95b7cc6afe5112
--- /dev/null
+++ b/target/linux/generic/backport-5.15/790-v6.4-0012-net-dsa-mt7530-skip-locking-if-MDIO-bus-isn-t-presen.patch
@@ -0,0 +1,47 @@
+From 54d4147a121cec5004a673a58572da346e4458f8 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:19:28 +0100
+Subject: [PATCH 15/16] net: dsa: mt7530: skip locking if MDIO bus isn't
+ present
+
+As MT7530 and MT7531 internally use 32-bit wide registers, each access
+to any register of the switch requires several operations on the MDIO
+bus. Hence if there is congruent access, e.g. due to PCS or PHY
+polling, this can mess up and interfere with another ongoing register
+access sequence.
+
+However, the MDIO bus mutex is only relevant for MDIO-connected
+switches. Prepare switches which have there registers directly mapped
+into the SoCs register space via MMIO which do not require such
+locking. There we can simply use regmap's default locking mechanism.
+
+Hence guard mutex operations to only be performed in case of MDIO
+connected switches.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/mt7530.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -144,13 +144,15 @@ err:
+ static void
+ mt7530_mutex_lock(struct mt7530_priv *priv)
+ {
+-	mutex_lock_nested(&priv->bus->mdio_lock, MDIO_MUTEX_NESTED);
++	if (priv->bus)
++		mutex_lock_nested(&priv->bus->mdio_lock, MDIO_MUTEX_NESTED);
+ }
+ 
+ static void
+ mt7530_mutex_unlock(struct mt7530_priv *priv)
+ {
+-	mutex_unlock(&priv->bus->mdio_lock);
++	if (priv->bus)
++		mutex_unlock(&priv->bus->mdio_lock);
+ }
+ 
+ static void
diff --git a/target/linux/generic/backport-5.15/790-v6.4-0013-net-dsa-mt7530-introduce-driver-for-MT7988-built-in-.patch b/target/linux/generic/backport-5.15/790-v6.4-0013-net-dsa-mt7530-introduce-driver-for-MT7988-built-in-.patch
new file mode 100644
index 00000000000000..00f4b25c44e1de
--- /dev/null
+++ b/target/linux/generic/backport-5.15/790-v6.4-0013-net-dsa-mt7530-introduce-driver-for-MT7988-built-in-.patch
@@ -0,0 +1,421 @@
+From 110c18bfed41421edd677935dd33be5e6507ba92 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:19:40 +0100
+Subject: [PATCH 16/16] net: dsa: mt7530: introduce driver for MT7988 built-in
+ switch
+
+Add driver for the built-in Gigabit Ethernet switch which can be found
+in the MediaTek MT7988 SoC.
+
+The switch shares most of its design with MT7530 and MT7531, but has
+it's registers mapped into the SoCs register space rather than being
+connected externally or internally via MDIO.
+
+Introduce a new platform driver to support that.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ MAINTAINERS                   |   2 +
+ drivers/net/dsa/Kconfig       |  12 +++
+ drivers/net/dsa/Makefile      |   1 +
+ drivers/net/dsa/mt7530-mmio.c | 101 +++++++++++++++++++++++++
+ drivers/net/dsa/mt7530.c      | 137 +++++++++++++++++++++++++++++++++-
+ drivers/net/dsa/mt7530.h      |  12 +--
+ 6 files changed, 255 insertions(+), 10 deletions(-)
+ create mode 100644 drivers/net/dsa/mt7530-mmio.c
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -11899,9 +11899,11 @@ MEDIATEK SWITCH DRIVER
+ M:	Sean Wang <sean.wang@mediatek.com>
+ M:	Landen Chao <Landen.Chao@mediatek.com>
+ M:	DENG Qingfang <dqfext@gmail.com>
++M:	Daniel Golle <daniel@makrotopia.org>
+ L:	netdev@vger.kernel.org
+ S:	Maintained
+ F:	drivers/net/dsa/mt7530-mdio.c
++F:	drivers/net/dsa/mt7530-mmio.c
+ F:	drivers/net/dsa/mt7530.*
+ F:	net/dsa/tag_mtk.c
+ 
+--- a/drivers/net/dsa/Kconfig
++++ b/drivers/net/dsa/Kconfig
+@@ -38,6 +38,7 @@ config NET_DSA_MT7530
+ 	select NET_DSA_TAG_MTK
+ 	select MEDIATEK_GE_PHY
+ 	imply NET_DSA_MT7530_MDIO
++	imply NET_DSA_MT7530_MMIO
+ 	help
+ 	  This enables support for the MediaTek MT7530 and MT7531 Ethernet
+ 	  switch chips. Multi-chip module MT7530 in MT7621AT, MT7621DAT,
+@@ -54,6 +55,17 @@ config NET_DSA_MT7530_MDIO
+ 	  module MT7530 which can be found in the MT7621AT, MT7621DAT,
+ 	  MT7621ST and MT7623AI SoCs.
+ 
++config NET_DSA_MT7530_MMIO
++	tristate "MediaTek MT7530 MMIO interface driver"
++	depends on NET_DSA_MT7530
++	depends on HAS_IOMEM
++	help
++	  This enables support for the built-in Ethernet switch found
++	  in the MediaTek MT7988 SoC.
++	  The switch is a similar design as MT7531, but the switch registers
++	  are directly mapped into the SoCs register space rather than being
++	  accessible via MDIO.
++
+ config NET_DSA_MV88E6060
+ 	tristate "Marvell 88E6060 ethernet switch chip support"
+ 	select NET_DSA_TAG_TRAILER
+--- a/drivers/net/dsa/Makefile
++++ b/drivers/net/dsa/Makefile
+@@ -8,6 +8,7 @@ endif
+ obj-$(CONFIG_NET_DSA_LANTIQ_GSWIP) += lantiq_gswip.o
+ obj-$(CONFIG_NET_DSA_MT7530)	+= mt7530.o
+ obj-$(CONFIG_NET_DSA_MT7530_MDIO) += mt7530-mdio.o
++obj-$(CONFIG_NET_DSA_MT7530_MMIO) += mt7530-mmio.o
+ obj-$(CONFIG_NET_DSA_MV88E6060) += mv88e6060.o
+ obj-$(CONFIG_NET_DSA_REALTEK_SMI) += realtek-smi.o
+ realtek-smi-objs		:= realtek-smi-core.o rtl8366.o rtl8366rb.o
+--- /dev/null
++++ b/drivers/net/dsa/mt7530-mmio.c
+@@ -0,0 +1,101 @@
++// SPDX-License-Identifier: GPL-2.0-only
++
++#include <linux/module.h>
++#include <linux/of_platform.h>
++#include <linux/regmap.h>
++#include <linux/regulator/consumer.h>
++#include <linux/reset.h>
++#include <net/dsa.h>
++
++#include "mt7530.h"
++
++static const struct of_device_id mt7988_of_match[] = {
++	{ .compatible = "mediatek,mt7988-switch", .data = &mt753x_table[ID_MT7988], },
++	{ /* sentinel */ },
++};
++MODULE_DEVICE_TABLE(of, mt7988_of_match);
++
++static int
++mt7988_probe(struct platform_device *pdev)
++{
++	static struct regmap_config *sw_regmap_config;
++	struct mt7530_priv *priv;
++	void __iomem *base_addr;
++	int ret;
++
++	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	priv->bus = NULL;
++	priv->dev = &pdev->dev;
++
++	ret = mt7530_probe_common(priv);
++	if (ret)
++		return ret;
++
++	priv->rstc = devm_reset_control_get(&pdev->dev, NULL);
++	if (IS_ERR(priv->rstc)) {
++		dev_err(&pdev->dev, "Couldn't get our reset line\n");
++		return PTR_ERR(priv->rstc);
++	}
++
++	base_addr = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(base_addr)) {
++		dev_err(&pdev->dev, "cannot request I/O memory space\n");
++		return -ENXIO;
++	}
++
++	sw_regmap_config = devm_kzalloc(&pdev->dev, sizeof(*sw_regmap_config), GFP_KERNEL);
++	if (!sw_regmap_config)
++		return -ENOMEM;
++
++	sw_regmap_config->name = "switch";
++	sw_regmap_config->reg_bits = 16;
++	sw_regmap_config->val_bits = 32;
++	sw_regmap_config->reg_stride = 4;
++	sw_regmap_config->max_register = MT7530_CREV;
++	priv->regmap = devm_regmap_init_mmio(&pdev->dev, base_addr, sw_regmap_config);
++	if (IS_ERR(priv->regmap))
++		return PTR_ERR(priv->regmap);
++
++	return dsa_register_switch(priv->ds);
++}
++
++static int
++mt7988_remove(struct platform_device *pdev)
++{
++	struct mt7530_priv *priv = platform_get_drvdata(pdev);
++
++	if (priv)
++		mt7530_remove_common(priv);
++
++	return 0;
++}
++
++static void mt7988_shutdown(struct platform_device *pdev)
++{
++	struct mt7530_priv *priv = platform_get_drvdata(pdev);
++
++	if (!priv)
++		return;
++
++	dsa_switch_shutdown(priv->ds);
++
++	dev_set_drvdata(&pdev->dev, NULL);
++}
++
++static struct platform_driver mt7988_platform_driver = {
++	.probe  = mt7988_probe,
++	.remove = mt7988_remove,
++	.shutdown = mt7988_shutdown,
++	.driver = {
++		.name = "mt7530-mmio",
++		.of_match_table = mt7988_of_match,
++	},
++};
++module_platform_driver(mt7988_platform_driver);
++
++MODULE_AUTHOR("Daniel Golle <daniel@makrotopia.org>");
++MODULE_DESCRIPTION("Driver for Mediatek MT7530 Switch (MMIO)");
++MODULE_LICENSE("GPL");
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -1984,6 +1984,47 @@ static const struct irq_domain_ops mt753
+ };
+ 
+ static void
++mt7988_irq_mask(struct irq_data *d)
++{
++	struct mt7530_priv *priv = irq_data_get_irq_chip_data(d);
++
++	priv->irq_enable &= ~BIT(d->hwirq);
++	mt7530_mii_write(priv, MT7530_SYS_INT_EN, priv->irq_enable);
++}
++
++static void
++mt7988_irq_unmask(struct irq_data *d)
++{
++	struct mt7530_priv *priv = irq_data_get_irq_chip_data(d);
++
++	priv->irq_enable |= BIT(d->hwirq);
++	mt7530_mii_write(priv, MT7530_SYS_INT_EN, priv->irq_enable);
++}
++
++static struct irq_chip mt7988_irq_chip = {
++	.name = KBUILD_MODNAME,
++	.irq_mask = mt7988_irq_mask,
++	.irq_unmask = mt7988_irq_unmask,
++};
++
++static int
++mt7988_irq_map(struct irq_domain *domain, unsigned int irq,
++	       irq_hw_number_t hwirq)
++{
++	irq_set_chip_data(irq, domain->host_data);
++	irq_set_chip_and_handler(irq, &mt7988_irq_chip, handle_simple_irq);
++	irq_set_nested_thread(irq, true);
++	irq_set_noprobe(irq);
++
++	return 0;
++}
++
++static const struct irq_domain_ops mt7988_irq_domain_ops = {
++	.map = mt7988_irq_map,
++	.xlate = irq_domain_xlate_onecell,
++};
++
++static void
+ mt7530_setup_mdio_irq(struct mt7530_priv *priv)
+ {
+ 	struct dsa_switch *ds = priv->ds;
+@@ -2017,8 +2058,15 @@ mt7530_setup_irq(struct mt7530_priv *pri
+ 		return priv->irq ? : -EINVAL;
+ 	}
+ 
+-	priv->irq_domain = irq_domain_add_linear(np, MT7530_NUM_PHYS,
+-						 &mt7530_irq_domain_ops, priv);
++	if (priv->id == ID_MT7988)
++		priv->irq_domain = irq_domain_add_linear(np, MT7530_NUM_PHYS,
++							 &mt7988_irq_domain_ops,
++							 priv);
++	else
++		priv->irq_domain = irq_domain_add_linear(np, MT7530_NUM_PHYS,
++							 &mt7530_irq_domain_ops,
++							 priv);
++
+ 	if (!priv->irq_domain) {
+ 		dev_err(dev, "failed to create IRQ domain\n");
+ 		return -ENOMEM;
+@@ -2511,6 +2559,25 @@ static void mt7531_mac_port_get_caps(str
+ 	}
+ }
+ 
++static void mt7988_mac_port_get_caps(struct dsa_switch *ds, int port,
++				     struct phylink_config *config)
++{
++	phy_interface_zero(config->supported_interfaces);
++
++	switch (port) {
++	case 0 ... 4: /* Internal phy */
++		__set_bit(PHY_INTERFACE_MODE_INTERNAL,
++			  config->supported_interfaces);
++		break;
++
++	case 6:
++		__set_bit(PHY_INTERFACE_MODE_INTERNAL,
++			  config->supported_interfaces);
++		config->mac_capabilities = MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
++					   MAC_10000FD;
++	}
++}
++
+ static int
+ mt753x_pad_setup(struct dsa_switch *ds, const struct phylink_link_state *state)
+ {
+@@ -2587,6 +2654,17 @@ static bool mt753x_is_mac_port(u32 port)
+ }
+ 
+ static int
++mt7988_mac_config(struct dsa_switch *ds, int port, unsigned int mode,
++		  phy_interface_t interface)
++{
++	if (dsa_is_cpu_port(ds, port) &&
++	    interface == PHY_INTERFACE_MODE_INTERNAL)
++		return 0;
++
++	return -EINVAL;
++}
++
++static int
+ mt7531_mac_config(struct dsa_switch *ds, int port, unsigned int mode,
+ 		  phy_interface_t interface)
+ {
+@@ -2656,7 +2734,8 @@ mt753x_phylink_mac_config(struct dsa_swi
+ 
+ 	switch (port) {
+ 	case 0 ... 4: /* Internal phy */
+-		if (state->interface != PHY_INTERFACE_MODE_GMII)
++		if (state->interface != PHY_INTERFACE_MODE_GMII &&
++		    state->interface != PHY_INTERFACE_MODE_INTERNAL)
+ 			goto unsupported;
+ 		break;
+ 	case 5: /* 2nd cpu port with phy of port 0 or 4 / external phy */
+@@ -2734,7 +2813,8 @@ static void mt753x_phylink_mac_link_up(s
+ 	/* MT753x MAC works in 1G full duplex mode for all up-clocked
+ 	 * variants.
+ 	 */
+-	if (interface == PHY_INTERFACE_MODE_TRGMII ||
++	if (interface == PHY_INTERFACE_MODE_INTERNAL ||
++	    interface == PHY_INTERFACE_MODE_TRGMII ||
+ 	    (phy_interface_mode_is_8023z(interface))) {
+ 		speed = SPEED_1000;
+ 		duplex = DUPLEX_FULL;
+@@ -2814,6 +2894,21 @@ mt7531_cpu_port_config(struct dsa_switch
+ 	return 0;
+ }
+ 
++static int
++mt7988_cpu_port_config(struct dsa_switch *ds, int port)
++{
++	struct mt7530_priv *priv = ds->priv;
++
++	mt7530_write(priv, MT7530_PMCR_P(port),
++		     PMCR_CPU_PORT_SETTING(priv->id));
++
++	mt753x_phylink_mac_link_up(ds, port, MLO_AN_FIXED,
++				   PHY_INTERFACE_MODE_INTERNAL, NULL,
++				   SPEED_10000, DUPLEX_FULL, true, true);
++
++	return 0;
++}
++
+ static void mt753x_phylink_get_caps(struct dsa_switch *ds, int port,
+ 				    struct phylink_config *config)
+ {
+@@ -2959,6 +3054,27 @@ static int mt753x_set_mac_eee(struct dsa
+ 	return 0;
+ }
+ 
++static int mt7988_pad_setup(struct dsa_switch *ds, phy_interface_t interface)
++{
++	return 0;
++}
++
++static int mt7988_setup(struct dsa_switch *ds)
++{
++	struct mt7530_priv *priv = ds->priv;
++
++	/* Reset the switch */
++	reset_control_assert(priv->rstc);
++	usleep_range(20, 50);
++	reset_control_deassert(priv->rstc);
++	usleep_range(20, 50);
++
++	/* Reset the switch PHYs */
++	mt7530_write(priv, MT7530_SYS_CTRL, SYS_CTRL_PHY_RST);
++
++	return mt7531_setup_common(ds);
++}
++
+ const struct dsa_switch_ops mt7530_switch_ops = {
+ 	.get_tag_protocol	= mtk_get_tag_protocol,
+ 	.setup			= mt753x_setup,
+@@ -3027,6 +3143,17 @@ const struct mt753x_info mt753x_table[]
+ 		.mac_port_get_caps = mt7531_mac_port_get_caps,
+ 		.mac_port_config = mt7531_mac_config,
+ 	},
++	[ID_MT7988] = {
++		.id = ID_MT7988,
++		.pcs_ops = &mt7530_pcs_ops,
++		.sw_setup = mt7988_setup,
++		.phy_read = mt7531_ind_phy_read,
++		.phy_write = mt7531_ind_phy_write,
++		.pad_setup = mt7988_pad_setup,
++		.cpu_port_config = mt7988_cpu_port_config,
++		.mac_port_get_caps = mt7988_mac_port_get_caps,
++		.mac_port_config = mt7988_mac_config,
++	},
+ };
+ EXPORT_SYMBOL_GPL(mt753x_table);
+ 
+--- a/drivers/net/dsa/mt7530.h
++++ b/drivers/net/dsa/mt7530.h
+@@ -18,6 +18,7 @@ enum mt753x_id {
+ 	ID_MT7530 = 0,
+ 	ID_MT7621 = 1,
+ 	ID_MT7531 = 2,
++	ID_MT7988 = 3,
+ };
+ 
+ #define	NUM_TRGMII_CTRL			5
+@@ -54,11 +55,11 @@ enum mt753x_id {
+ #define  MT7531_MIRROR_PORT_SET(x)	(((x) & MIRROR_MASK) << 16)
+ #define  MT7531_CPU_PMAP_MASK		GENMASK(7, 0)
+ 
+-#define MT753X_MIRROR_REG(id)		(((id) == ID_MT7531) ? \
++#define MT753X_MIRROR_REG(id)		((((id) == ID_MT7531) || ((id) == ID_MT7988)) ?	\
+ 					 MT7531_CFC : MT7530_MFC)
+-#define MT753X_MIRROR_EN(id)		(((id) == ID_MT7531) ? \
++#define MT753X_MIRROR_EN(id)		((((id) == ID_MT7531) || ((id) == ID_MT7988)) ?	\
+ 					 MT7531_MIRROR_EN : MIRROR_EN)
+-#define MT753X_MIRROR_MASK(id)		(((id) == ID_MT7531) ? \
++#define MT753X_MIRROR_MASK(id)		((((id) == ID_MT7531) || ((id) == ID_MT7988)) ?	\
+ 					 MT7531_MIRROR_MASK : MIRROR_MASK)
+ 
+ /* Registers for BPDU and PAE frame control*/
+@@ -295,9 +296,8 @@ enum mt7530_vlan_port_acc_frm {
+ 					 MT7531_FORCE_DPX | \
+ 					 MT7531_FORCE_RX_FC | \
+ 					 MT7531_FORCE_TX_FC)
+-#define  PMCR_FORCE_MODE_ID(id)		(((id) == ID_MT7531) ? \
+-					 MT7531_FORCE_MODE : \
+-					 PMCR_FORCE_MODE)
++#define  PMCR_FORCE_MODE_ID(id)		((((id) == ID_MT7531) || ((id) == ID_MT7988)) ?	\
++					 MT7531_FORCE_MODE : PMCR_FORCE_MODE)
+ #define  PMCR_LINK_SETTINGS_MASK	(PMCR_TX_EN | PMCR_FORCE_SPEED_1000 | \
+ 					 PMCR_RX_EN | PMCR_FORCE_SPEED_100 | \
+ 					 PMCR_TX_FC_EN | PMCR_RX_FC_EN | \
diff --git a/target/linux/generic/backport-5.15/790-v6.4-0014-net-dsa-mt7530-fix-support-for-MT7531BE.patch b/target/linux/generic/backport-5.15/790-v6.4-0014-net-dsa-mt7530-fix-support-for-MT7531BE.patch
new file mode 100644
index 00000000000000..ed8bca7d1c1276
--- /dev/null
+++ b/target/linux/generic/backport-5.15/790-v6.4-0014-net-dsa-mt7530-fix-support-for-MT7531BE.patch
@@ -0,0 +1,118 @@
+From 91daa4f62ce878b6e1ac5908aceb83550332447f Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sun, 16 Apr 2023 13:08:14 +0100
+Subject: [PATCH] net: dsa: mt7530: fix support for MT7531BE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+There are two variants of the MT7531 switch IC which got different
+features (and pins) regarding port 5:
+ * MT7531AE: SGMII/1000Base-X/2500Base-X SerDes PCS
+ * MT7531BE: RGMII
+
+Moving the creation of the SerDes PCS from mt753x_setup to mt7530_probe
+with commit 6de285229773 ("net: dsa: mt7530: move SGMII PCS creation
+to mt7530_probe function") works fine for MT7531AE which got two
+instances of mtk-pcs-lynxi, however, MT7531BE requires mt7531_pll_setup
+to setup clocks before the single PCS on port 6 (usually used as CPU
+port) starts to work and hence the PCS creation failed on MT7531BE.
+
+Fix this by introducing a pointer to mt7531_create_sgmii function in
+struct mt7530_priv and call it again at the end of mt753x_setup like it
+was before commit 6de285229773 ("net: dsa: mt7530: move SGMII PCS
+creation to mt7530_probe function").
+
+Fixes: 6de285229773 ("net: dsa: mt7530: move SGMII PCS creation to mt7530_probe function")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Link: https://lore.kernel.org/r/ZDvlLhhqheobUvOK@makrotopia.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/mt7530-mdio.c | 16 ++++++++--------
+ drivers/net/dsa/mt7530.c      |  6 ++++++
+ drivers/net/dsa/mt7530.h      |  4 ++--
+ 3 files changed, 16 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/dsa/mt7530-mdio.c
++++ b/drivers/net/dsa/mt7530-mdio.c
+@@ -81,14 +81,17 @@ static const struct regmap_bus mt7530_re
+ };
+ 
+ static int
+-mt7531_create_sgmii(struct mt7530_priv *priv)
++mt7531_create_sgmii(struct mt7530_priv *priv, bool dual_sgmii)
+ {
+-	struct regmap_config *mt7531_pcs_config[2];
++	struct regmap_config *mt7531_pcs_config[2] = {};
+ 	struct phylink_pcs *pcs;
+ 	struct regmap *regmap;
+ 	int i, ret = 0;
+ 
+-	for (i = 0; i < 2; i++) {
++	/* MT7531AE has two SGMII units for port 5 and port 6
++	 * MT7531BE has only one SGMII unit for port 6
++	 */
++	for (i = dual_sgmii ? 0 : 1; i < 2; i++) {
+ 		mt7531_pcs_config[i] = devm_kzalloc(priv->dev,
+ 						    sizeof(struct regmap_config),
+ 						    GFP_KERNEL);
+@@ -208,11 +211,8 @@ mt7530_probe(struct mdio_device *mdiodev
+ 	if (IS_ERR(priv->regmap))
+ 		return PTR_ERR(priv->regmap);
+ 
+-	if (priv->id == ID_MT7531) {
+-		ret = mt7531_create_sgmii(priv);
+-		if (ret)
+-			return ret;
+-	}
++	if (priv->id == ID_MT7531)
++		priv->create_sgmii = mt7531_create_sgmii;
+ 
+ 	return dsa_register_switch(priv->ds);
+ }
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -3021,6 +3021,12 @@ mt753x_setup(struct dsa_switch *ds)
+ 	if (ret && priv->irq)
+ 		mt7530_free_irq_common(priv);
+ 
++	if (priv->create_sgmii) {
++		ret = priv->create_sgmii(priv, mt7531_dual_sgmii_supported(priv));
++		if (ret && priv->irq)
++			mt7530_free_irq(priv);
++	}
++
+ 	return ret;
+ }
+ 
+--- a/drivers/net/dsa/mt7530.h
++++ b/drivers/net/dsa/mt7530.h
+@@ -741,10 +741,10 @@ struct mt753x_info {
+  *			registers
+  * @p6_interface	Holding the current port 6 interface
+  * @p5_intf_sel:	Holding the current port 5 interface select
+- *
+  * @irq:		IRQ number of the switch
+  * @irq_domain:		IRQ domain of the switch irq_chip
+  * @irq_enable:		IRQ enable bits, synced to SYS_INT_EN
++ * @create_sgmii:	Pointer to function creating SGMII PCS instance(s)
+  */
+ struct mt7530_priv {
+ 	struct device		*dev;
+@@ -763,7 +763,6 @@ struct mt7530_priv {
+ 	unsigned int		p5_intf_sel;
+ 	u8			mirror_rx;
+ 	u8			mirror_tx;
+-
+ 	struct mt7530_port	ports[MT7530_NUM_PORTS];
+ 	struct mt753x_pcs	pcs[MT7530_NUM_PORTS];
+ 	/* protect among processes for registers access*/
+@@ -771,6 +770,7 @@ struct mt7530_priv {
+ 	int irq;
+ 	struct irq_domain *irq_domain;
+ 	u32 irq_enable;
++	int (*create_sgmii)(struct mt7530_priv *priv, bool dual_sgmii);
+ };
+ 
+ struct mt7530_hw_vlan_entry {
diff --git a/target/linux/generic/backport-5.15/791-v6.2-01-net-phy-Add-driver-for-Motorcomm-yt8521-gigabit-ethernet.patch b/target/linux/generic/backport-5.15/791-v6.2-01-net-phy-Add-driver-for-Motorcomm-yt8521-gigabit-ethernet.patch
new file mode 100644
index 00000000000000..e2a0e25a7941f7
--- /dev/null
+++ b/target/linux/generic/backport-5.15/791-v6.2-01-net-phy-Add-driver-for-Motorcomm-yt8521-gigabit-ethernet.patch
@@ -0,0 +1,1724 @@
+From 70479a40954cf353e87a486997a3477108c75aa9 Mon Sep 17 00:00:00 2001
+From: Frank <Frank.Sae@motor-comm.com>
+Date: Fri, 28 Oct 2022 17:26:21 +0800
+Subject: [PATCH] net: phy: Add driver for Motorcomm yt8521 gigabit ethernet
+ phy
+
+Add a driver for the motorcomm yt8521 gigabit ethernet phy. We have verified
+ the driver on StarFive VisionFive development board, which is developed by
+ Shanghai StarFive Technology Co., Ltd.. On the board, yt8521 gigabit ethernet
+ phy works in utp mode, RGMII interface, supports 1000M/100M/10M speeds, and
+ wol(magic package).
+
+Signed-off-by: Frank <Frank.Sae@motor-comm.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ MAINTAINERS                 |    1 +
+ drivers/net/phy/Kconfig     |    2 +-
+ drivers/net/phy/motorcomm.c | 1635 ++++++++++++++++++++++++++++++++++-
+ 3 files changed, 1635 insertions(+), 3 deletions(-)
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -12700,6 +12700,7 @@ F:	include/uapi/linux/meye.h
+ 
+ MOTORCOMM PHY DRIVER
+ M:	Peter Geis <pgwipeout@gmail.com>
++M:	Frank <Frank.Sae@motor-comm.com>
+ L:	netdev@vger.kernel.org
+ S:	Maintained
+ F:	drivers/net/phy/motorcomm.c
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -245,7 +245,7 @@ config MOTORCOMM_PHY
+ 	tristate "Motorcomm PHYs"
+ 	help
+ 	  Enables support for Motorcomm network PHYs.
+-	  Currently supports the YT8511 gigabit PHY.
++	  Currently supports the YT8511, YT8521 Gigabit Ethernet PHYs.
+ 
+ config NATIONAL_PHY
+ 	tristate "National Semiconductor PHYs"
+--- a/drivers/net/phy/motorcomm.c
++++ b/drivers/net/phy/motorcomm.c
+@@ -1,15 +1,106 @@
+ // SPDX-License-Identifier: GPL-2.0+
+ /*
+- * Driver for Motorcomm PHYs
++ * Motorcomm 8511/8521 PHY driver.
+  *
+  * Author: Peter Geis <pgwipeout@gmail.com>
++ * Author: Frank <Frank.Sae@motor-comm.com>
+  */
+ 
++#include <linux/etherdevice.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/phy.h>
+ 
+ #define PHY_ID_YT8511		0x0000010a
++#define PHY_ID_YT8521				0x0000011A
++
++/* YT8521 Register Overview
++ *	UTP Register space	|	FIBER Register space
++ *  ------------------------------------------------------------
++ * |	UTP MII			|	FIBER MII		|
++ * |	UTP MMD			|				|
++ * |	UTP Extended		|	FIBER Extended		|
++ *  ------------------------------------------------------------
++ * |			Common Extended				|
++ *  ------------------------------------------------------------
++ */
++
++/* 0x10 ~ 0x15 , 0x1E and 0x1F are common MII registers of yt phy */
++
++/* Specific Function Control Register */
++#define YTPHY_SPECIFIC_FUNCTION_CONTROL_REG	0x10
++
++/* 2b00 Manual MDI configuration
++ * 2b01 Manual MDIX configuration
++ * 2b10 Reserved
++ * 2b11 Enable automatic crossover for all modes  *default*
++ */
++#define YTPHY_SFCR_MDI_CROSSOVER_MODE_MASK	(BIT(6) | BIT(5))
++#define YTPHY_SFCR_CROSSOVER_EN			BIT(3)
++#define YTPHY_SFCR_SQE_TEST_EN			BIT(2)
++#define YTPHY_SFCR_POLARITY_REVERSAL_EN		BIT(1)
++#define YTPHY_SFCR_JABBER_DIS			BIT(0)
++
++/* Specific Status Register */
++#define YTPHY_SPECIFIC_STATUS_REG		0x11
++#define YTPHY_SSR_SPEED_MODE_OFFSET		14
++
++#define YTPHY_SSR_SPEED_MODE_MASK		(BIT(15) | BIT(14))
++#define YTPHY_SSR_SPEED_10M			0x0
++#define YTPHY_SSR_SPEED_100M			0x1
++#define YTPHY_SSR_SPEED_1000M			0x2
++#define YTPHY_SSR_DUPLEX_OFFSET			13
++#define YTPHY_SSR_DUPLEX			BIT(13)
++#define YTPHY_SSR_PAGE_RECEIVED			BIT(12)
++#define YTPHY_SSR_SPEED_DUPLEX_RESOLVED		BIT(11)
++#define YTPHY_SSR_LINK				BIT(10)
++#define YTPHY_SSR_MDIX_CROSSOVER		BIT(6)
++#define YTPHY_SSR_DOWNGRADE			BIT(5)
++#define YTPHY_SSR_TRANSMIT_PAUSE		BIT(3)
++#define YTPHY_SSR_RECEIVE_PAUSE			BIT(2)
++#define YTPHY_SSR_POLARITY			BIT(1)
++#define YTPHY_SSR_JABBER			BIT(0)
++
++/* Interrupt enable Register */
++#define YTPHY_INTERRUPT_ENABLE_REG		0x12
++#define YTPHY_IER_WOL				BIT(6)
++
++/* Interrupt Status Register */
++#define YTPHY_INTERRUPT_STATUS_REG		0x13
++#define YTPHY_ISR_AUTONEG_ERR			BIT(15)
++#define YTPHY_ISR_SPEED_CHANGED			BIT(14)
++#define YTPHY_ISR_DUPLEX_CHANGED		BIT(13)
++#define YTPHY_ISR_PAGE_RECEIVED			BIT(12)
++#define YTPHY_ISR_LINK_FAILED			BIT(11)
++#define YTPHY_ISR_LINK_SUCCESSED		BIT(10)
++#define YTPHY_ISR_WOL				BIT(6)
++#define YTPHY_ISR_WIRESPEED_DOWNGRADE		BIT(5)
++#define YTPHY_ISR_SERDES_LINK_FAILED		BIT(3)
++#define YTPHY_ISR_SERDES_LINK_SUCCESSED		BIT(2)
++#define YTPHY_ISR_POLARITY_CHANGED		BIT(1)
++#define YTPHY_ISR_JABBER_HAPPENED		BIT(0)
++
++/* Speed Auto Downgrade Control Register */
++#define YTPHY_SPEED_AUTO_DOWNGRADE_CONTROL_REG	0x14
++#define YTPHY_SADCR_SPEED_DOWNGRADE_EN		BIT(5)
++
++/* If these bits are set to 3, the PHY attempts five times ( 3(set value) +
++ * additional 2) before downgrading, default 0x3
++ */
++#define YTPHY_SADCR_SPEED_RETRY_LIMIT		(0x3 << 2)
++
++/* Rx Error Counter Register */
++#define YTPHY_RX_ERROR_COUNTER_REG		0x15
++
++/* Extended Register's Address Offset Register */
++#define YTPHY_PAGE_SELECT			0x1E
++
++/* Extended Register's Data Register */
++#define YTPHY_PAGE_DATA				0x1F
++
++/* FIBER Auto-Negotiation link partner ability */
++#define YTPHY_FLPA_PAUSE			(0x3 << 7)
++#define YTPHY_FLPA_ASYM_PAUSE			(0x2 << 7)
+ 
+ #define YT8511_PAGE_SELECT	0x1e
+ #define YT8511_PAGE		0x1f
+@@ -38,6 +129,352 @@
+ #define YT8511_DELAY_FE_TX_EN	(0xf << 12)
+ #define YT8511_DELAY_FE_TX_DIS	(0x2 << 12)
+ 
++/* Extended register is different from MMD Register and MII Register.
++ * We can use ytphy_read_ext/ytphy_write_ext/ytphy_modify_ext function to
++ * operate extended register.
++ * Extended Register  start
++ */
++
++/* Phy gmii clock gating Register */
++#define YT8521_CLOCK_GATING_REG			0xC
++#define YT8521_CGR_RX_CLK_EN			BIT(12)
++
++#define YT8521_EXTREG_SLEEP_CONTROL1_REG	0x27
++#define YT8521_ESC1R_SLEEP_SW			BIT(15)
++#define YT8521_ESC1R_PLLON_SLP			BIT(14)
++
++/* Phy fiber Link timer cfg2 Register */
++#define YT8521_LINK_TIMER_CFG2_REG		0xA5
++#define YT8521_LTCR_EN_AUTOSEN			BIT(15)
++
++/* 0xA000, 0xA001, 0xA003 ,and 0xA006 ~ 0xA00A  are common ext registers
++ * of yt8521 phy. There is no need to switch reg space when operating these
++ * registers.
++ */
++
++#define YT8521_REG_SPACE_SELECT_REG		0xA000
++#define YT8521_RSSR_SPACE_MASK			BIT(1)
++#define YT8521_RSSR_FIBER_SPACE			(0x1 << 1)
++#define YT8521_RSSR_UTP_SPACE			(0x0 << 1)
++#define YT8521_RSSR_TO_BE_ARBITRATED		(0xFF)
++
++#define YT8521_CHIP_CONFIG_REG			0xA001
++#define YT8521_CCR_SW_RST			BIT(15)
++
++#define YT8521_CCR_MODE_SEL_MASK		(BIT(2) | BIT(1) | BIT(0))
++#define YT8521_CCR_MODE_UTP_TO_RGMII		0
++#define YT8521_CCR_MODE_FIBER_TO_RGMII		1
++#define YT8521_CCR_MODE_UTP_FIBER_TO_RGMII	2
++#define YT8521_CCR_MODE_UTP_TO_SGMII		3
++#define YT8521_CCR_MODE_SGPHY_TO_RGMAC		4
++#define YT8521_CCR_MODE_SGMAC_TO_RGPHY		5
++#define YT8521_CCR_MODE_UTP_TO_FIBER_AUTO	6
++#define YT8521_CCR_MODE_UTP_TO_FIBER_FORCE	7
++
++/* 3 phy polling modes,poll mode combines utp and fiber mode*/
++#define YT8521_MODE_FIBER			0x1
++#define YT8521_MODE_UTP				0x2
++#define YT8521_MODE_POLL			0x3
++
++#define YT8521_RGMII_CONFIG1_REG		0xA003
++
++/* TX Gig-E Delay is bits 3:0, default 0x1
++ * TX Fast-E Delay is bits 7:4, default 0xf
++ * RX Delay is bits 13:10, default 0x0
++ * Delay = 150ps * N
++ * On = 2250ps, off = 0ps
++ */
++#define YT8521_RC1R_RX_DELAY_MASK		(0xF << 10)
++#define YT8521_RC1R_RX_DELAY_EN			(0xF << 10)
++#define YT8521_RC1R_RX_DELAY_DIS		(0x0 << 10)
++#define YT8521_RC1R_FE_TX_DELAY_MASK		(0xF << 4)
++#define YT8521_RC1R_FE_TX_DELAY_EN		(0xF << 4)
++#define YT8521_RC1R_FE_TX_DELAY_DIS		(0x0 << 4)
++#define YT8521_RC1R_GE_TX_DELAY_MASK		(0xF << 0)
++#define YT8521_RC1R_GE_TX_DELAY_EN		(0xF << 0)
++#define YT8521_RC1R_GE_TX_DELAY_DIS		(0x0 << 0)
++
++#define YTPHY_MISC_CONFIG_REG			0xA006
++#define YTPHY_MCR_FIBER_SPEED_MASK		BIT(0)
++#define YTPHY_MCR_FIBER_1000BX			(0x1 << 0)
++#define YTPHY_MCR_FIBER_100FX			(0x0 << 0)
++
++/* WOL MAC ADDR: MACADDR2(highest), MACADDR1(middle), MACADDR0(lowest) */
++#define YTPHY_WOL_MACADDR2_REG			0xA007
++#define YTPHY_WOL_MACADDR1_REG			0xA008
++#define YTPHY_WOL_MACADDR0_REG			0xA009
++
++#define YTPHY_WOL_CONFIG_REG			0xA00A
++#define YTPHY_WCR_INTR_SEL			BIT(6)
++#define YTPHY_WCR_ENABLE			BIT(3)
++
++/* 2b00 84ms
++ * 2b01 168ms  *default*
++ * 2b10 336ms
++ * 2b11 672ms
++ */
++#define YTPHY_WCR_PULSE_WIDTH_MASK		(BIT(2) | BIT(1))
++#define YTPHY_WCR_PULSE_WIDTH_672MS		(BIT(2) | BIT(1))
++
++/* 1b0 Interrupt and WOL events is level triggered and active LOW  *default*
++ * 1b1 Interrupt and WOL events is pulse triggered and active LOW
++ */
++#define YTPHY_WCR_TYPE_PULSE			BIT(0)
++
++/* Extended Register  end */
++
++struct yt8521_priv {
++	/* combo_advertising is used for case of YT8521 in combo mode,
++	 * this means that yt8521 may work in utp or fiber mode which depends
++	 * on which media is connected (YT8521_RSSR_TO_BE_ARBITRATED).
++	 */
++	__ETHTOOL_DECLARE_LINK_MODE_MASK(combo_advertising);
++
++	/* YT8521_MODE_FIBER / YT8521_MODE_UTP / YT8521_MODE_POLL*/
++	u8 polling_mode;
++	u8 strap_mode; /* 8 working modes  */
++	/* current reg page of yt8521 phy:
++	 * YT8521_RSSR_UTP_SPACE
++	 * YT8521_RSSR_FIBER_SPACE
++	 * YT8521_RSSR_TO_BE_ARBITRATED
++	 */
++	u8 reg_page;
++};
++
++/**
++ * ytphy_read_ext() - read a PHY's extended register
++ * @phydev: a pointer to a &struct phy_device
++ * @regnum: register number to read
++ *
++ * NOTE:The caller must have taken the MDIO bus lock.
++ *
++ * returns the value of regnum reg or negative error code
++ */
++static int ytphy_read_ext(struct phy_device *phydev, u16 regnum)
++{
++	int ret;
++
++	ret = __phy_write(phydev, YTPHY_PAGE_SELECT, regnum);
++	if (ret < 0)
++		return ret;
++
++	return __phy_read(phydev, YTPHY_PAGE_DATA);
++}
++
++/**
++ * ytphy_read_ext_with_lock() - read a PHY's extended register
++ * @phydev: a pointer to a &struct phy_device
++ * @regnum: register number to read
++ *
++ * returns the value of regnum reg or negative error code
++ */
++static int ytphy_read_ext_with_lock(struct phy_device *phydev, u16 regnum)
++{
++	int ret;
++
++	phy_lock_mdio_bus(phydev);
++	ret = ytphy_read_ext(phydev, regnum);
++	phy_unlock_mdio_bus(phydev);
++
++	return ret;
++}
++
++/**
++ * ytphy_write_ext() - write a PHY's extended register
++ * @phydev: a pointer to a &struct phy_device
++ * @regnum: register number to write
++ * @val: value to write to @regnum
++ *
++ * NOTE:The caller must have taken the MDIO bus lock.
++ *
++ * returns 0 or negative error code
++ */
++static int ytphy_write_ext(struct phy_device *phydev, u16 regnum, u16 val)
++{
++	int ret;
++
++	ret = __phy_write(phydev, YTPHY_PAGE_SELECT, regnum);
++	if (ret < 0)
++		return ret;
++
++	return __phy_write(phydev, YTPHY_PAGE_DATA, val);
++}
++
++/**
++ * ytphy_write_ext_with_lock() - write a PHY's extended register
++ * @phydev: a pointer to a &struct phy_device
++ * @regnum: register number to write
++ * @val: value to write to @regnum
++ *
++ * returns 0 or negative error code
++ */
++static int ytphy_write_ext_with_lock(struct phy_device *phydev, u16 regnum,
++				     u16 val)
++{
++	int ret;
++
++	phy_lock_mdio_bus(phydev);
++	ret = ytphy_write_ext(phydev, regnum, val);
++	phy_unlock_mdio_bus(phydev);
++
++	return ret;
++}
++
++/**
++ * ytphy_modify_ext() - bits modify a PHY's extended register
++ * @phydev: a pointer to a &struct phy_device
++ * @regnum: register number to write
++ * @mask: bit mask of bits to clear
++ * @set: bit mask of bits to set
++ *
++ * NOTE: Convenience function which allows a PHY's extended register to be
++ * modified as new register value = (old register value & ~mask) | set.
++ * The caller must have taken the MDIO bus lock.
++ *
++ * returns 0 or negative error code
++ */
++static int ytphy_modify_ext(struct phy_device *phydev, u16 regnum, u16 mask,
++			    u16 set)
++{
++	int ret;
++
++	ret = __phy_write(phydev, YTPHY_PAGE_SELECT, regnum);
++	if (ret < 0)
++		return ret;
++
++	return __phy_modify(phydev, YTPHY_PAGE_DATA, mask, set);
++}
++
++/**
++ * ytphy_modify_ext_with_lock() - bits modify a PHY's extended register
++ * @phydev: a pointer to a &struct phy_device
++ * @regnum: register number to write
++ * @mask: bit mask of bits to clear
++ * @set: bit mask of bits to set
++ *
++ * NOTE: Convenience function which allows a PHY's extended register to be
++ * modified as new register value = (old register value & ~mask) | set.
++ *
++ * returns 0 or negative error code
++ */
++static int ytphy_modify_ext_with_lock(struct phy_device *phydev, u16 regnum,
++				      u16 mask, u16 set)
++{
++	int ret;
++
++	phy_lock_mdio_bus(phydev);
++	ret = ytphy_modify_ext(phydev, regnum, mask, set);
++	phy_unlock_mdio_bus(phydev);
++
++	return ret;
++}
++
++/**
++ * ytphy_get_wol() - report whether wake-on-lan is enabled
++ * @phydev: a pointer to a &struct phy_device
++ * @wol: a pointer to a &struct ethtool_wolinfo
++ *
++ * NOTE: YTPHY_WOL_CONFIG_REG is common ext reg.
++ */
++static void ytphy_get_wol(struct phy_device *phydev,
++			  struct ethtool_wolinfo *wol)
++{
++	int wol_config;
++
++	wol->supported = WAKE_MAGIC;
++	wol->wolopts = 0;
++
++	wol_config = ytphy_read_ext_with_lock(phydev, YTPHY_WOL_CONFIG_REG);
++	if (wol_config < 0)
++		return;
++
++	if (wol_config & YTPHY_WCR_ENABLE)
++		wol->wolopts |= WAKE_MAGIC;
++}
++
++/**
++ * ytphy_set_wol() - turn wake-on-lan on or off
++ * @phydev: a pointer to a &struct phy_device
++ * @wol: a pointer to a &struct ethtool_wolinfo
++ *
++ * NOTE: YTPHY_WOL_CONFIG_REG, YTPHY_WOL_MACADDR2_REG, YTPHY_WOL_MACADDR1_REG
++ * and YTPHY_WOL_MACADDR0_REG are common ext reg. The
++ * YTPHY_INTERRUPT_ENABLE_REG of UTP is special, fiber also use this register.
++ *
++ * returns 0 or negative errno code
++ */
++static int ytphy_set_wol(struct phy_device *phydev, struct ethtool_wolinfo *wol)
++{
++	struct net_device *p_attached_dev;
++	const u16 mac_addr_reg[] = {
++		YTPHY_WOL_MACADDR2_REG,
++		YTPHY_WOL_MACADDR1_REG,
++		YTPHY_WOL_MACADDR0_REG,
++	};
++	const u8 *mac_addr;
++	int old_page;
++	int ret = 0;
++	u16 mask;
++	u16 val;
++	u8 i;
++
++	if (wol->wolopts & WAKE_MAGIC) {
++		p_attached_dev = phydev->attached_dev;
++		if (!p_attached_dev)
++			return -ENODEV;
++
++		mac_addr = (const u8 *)p_attached_dev->dev_addr;
++		if (!is_valid_ether_addr(mac_addr))
++			return -EINVAL;
++
++		/* lock mdio bus then switch to utp reg space */
++		old_page = phy_select_page(phydev, YT8521_RSSR_UTP_SPACE);
++		if (old_page < 0)
++			goto err_restore_page;
++
++		/* Store the device address for the magic packet */
++		for (i = 0; i < 3; i++) {
++			ret = ytphy_write_ext(phydev, mac_addr_reg[i],
++					      ((mac_addr[i * 2] << 8)) |
++						      (mac_addr[i * 2 + 1]));
++			if (ret < 0)
++				goto err_restore_page;
++		}
++
++		/* Enable WOL feature */
++		mask = YTPHY_WCR_PULSE_WIDTH_MASK | YTPHY_WCR_INTR_SEL;
++		val = YTPHY_WCR_ENABLE | YTPHY_WCR_INTR_SEL;
++		val |= YTPHY_WCR_TYPE_PULSE | YTPHY_WCR_PULSE_WIDTH_672MS;
++		ret = ytphy_modify_ext(phydev, YTPHY_WOL_CONFIG_REG, mask, val);
++		if (ret < 0)
++			goto err_restore_page;
++
++		/* Enable WOL interrupt */
++		ret = __phy_modify(phydev, YTPHY_INTERRUPT_ENABLE_REG, 0,
++				   YTPHY_IER_WOL);
++		if (ret < 0)
++			goto err_restore_page;
++
++	} else {
++		old_page = phy_select_page(phydev, YT8521_RSSR_UTP_SPACE);
++		if (old_page < 0)
++			goto err_restore_page;
++
++		/* Disable WOL feature */
++		mask = YTPHY_WCR_ENABLE | YTPHY_WCR_INTR_SEL;
++		ret = ytphy_modify_ext(phydev, YTPHY_WOL_CONFIG_REG, mask, 0);
++
++		/* Disable WOL interrupt */
++		ret = __phy_modify(phydev, YTPHY_INTERRUPT_ENABLE_REG,
++				   YTPHY_IER_WOL, 0);
++		if (ret < 0)
++			goto err_restore_page;
++	}
++
++err_restore_page:
++	return phy_restore_page(phydev, old_page, ret);
++}
++
+ static int yt8511_read_page(struct phy_device *phydev)
+ {
+ 	return __phy_read(phydev, YT8511_PAGE_SELECT);
+@@ -111,6 +548,1181 @@ err_restore_page:
+ 	return phy_restore_page(phydev, oldpage, ret);
+ }
+ 
++/**
++ * yt8521_read_page() - read reg page
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * returns current reg space of yt8521 (YT8521_RSSR_FIBER_SPACE/
++ * YT8521_RSSR_UTP_SPACE) or negative errno code
++ */
++static int yt8521_read_page(struct phy_device *phydev)
++{
++	int old_page;
++
++	old_page = ytphy_read_ext(phydev, YT8521_REG_SPACE_SELECT_REG);
++	if (old_page < 0)
++		return old_page;
++
++	if ((old_page & YT8521_RSSR_SPACE_MASK) == YT8521_RSSR_FIBER_SPACE)
++		return YT8521_RSSR_FIBER_SPACE;
++
++	return YT8521_RSSR_UTP_SPACE;
++};
++
++/**
++ * yt8521_write_page() - write reg page
++ * @phydev: a pointer to a &struct phy_device
++ * @page: The reg page(YT8521_RSSR_FIBER_SPACE/YT8521_RSSR_UTP_SPACE) to write.
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_write_page(struct phy_device *phydev, int page)
++{
++	int mask = YT8521_RSSR_SPACE_MASK;
++	int set;
++
++	if ((page & YT8521_RSSR_SPACE_MASK) == YT8521_RSSR_FIBER_SPACE)
++		set = YT8521_RSSR_FIBER_SPACE;
++	else
++		set = YT8521_RSSR_UTP_SPACE;
++
++	return ytphy_modify_ext(phydev, YT8521_REG_SPACE_SELECT_REG, mask, set);
++};
++
++/**
++ * yt8521_probe() - read chip config then set suitable polling_mode
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_probe(struct phy_device *phydev)
++{
++	struct device *dev = &phydev->mdio.dev;
++	struct yt8521_priv *priv;
++	int chip_config;
++	int ret;
++
++	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	phydev->priv = priv;
++
++	chip_config = ytphy_read_ext_with_lock(phydev, YT8521_CHIP_CONFIG_REG);
++	if (chip_config < 0)
++		return chip_config;
++
++	priv->strap_mode = chip_config & YT8521_CCR_MODE_SEL_MASK;
++	switch (priv->strap_mode) {
++	case YT8521_CCR_MODE_FIBER_TO_RGMII:
++	case YT8521_CCR_MODE_SGPHY_TO_RGMAC:
++	case YT8521_CCR_MODE_SGMAC_TO_RGPHY:
++		priv->polling_mode = YT8521_MODE_FIBER;
++		priv->reg_page = YT8521_RSSR_FIBER_SPACE;
++		phydev->port = PORT_FIBRE;
++		break;
++	case YT8521_CCR_MODE_UTP_FIBER_TO_RGMII:
++	case YT8521_CCR_MODE_UTP_TO_FIBER_AUTO:
++	case YT8521_CCR_MODE_UTP_TO_FIBER_FORCE:
++		priv->polling_mode = YT8521_MODE_POLL;
++		priv->reg_page = YT8521_RSSR_TO_BE_ARBITRATED;
++		phydev->port = PORT_NONE;
++		break;
++	case YT8521_CCR_MODE_UTP_TO_SGMII:
++	case YT8521_CCR_MODE_UTP_TO_RGMII:
++		priv->polling_mode = YT8521_MODE_UTP;
++		priv->reg_page = YT8521_RSSR_UTP_SPACE;
++		phydev->port = PORT_TP;
++		break;
++	}
++	/* set default reg space */
++	if (priv->reg_page != YT8521_RSSR_TO_BE_ARBITRATED) {
++		ret = ytphy_write_ext_with_lock(phydev,
++						YT8521_REG_SPACE_SELECT_REG,
++						priv->reg_page);
++		if (ret < 0)
++			return ret;
++	}
++
++	return 0;
++}
++
++/**
++ * ytphy_utp_read_lpa() - read LPA then setup lp_advertising for utp
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * NOTE:The caller must have taken the MDIO bus lock.
++ *
++ * returns 0 or negative errno code
++ */
++static int ytphy_utp_read_lpa(struct phy_device *phydev)
++{
++	int lpa, lpagb;
++
++	if (phydev->autoneg == AUTONEG_ENABLE) {
++		if (!phydev->autoneg_complete) {
++			mii_stat1000_mod_linkmode_lpa_t(phydev->lp_advertising,
++							0);
++			mii_lpa_mod_linkmode_lpa_t(phydev->lp_advertising, 0);
++			return 0;
++		}
++
++		if (phydev->is_gigabit_capable) {
++			lpagb = __phy_read(phydev, MII_STAT1000);
++			if (lpagb < 0)
++				return lpagb;
++
++			if (lpagb & LPA_1000MSFAIL) {
++				int adv = __phy_read(phydev, MII_CTRL1000);
++
++				if (adv < 0)
++					return adv;
++
++				if (adv & CTL1000_ENABLE_MASTER)
++					phydev_err(phydev, "Master/Slave resolution failed, maybe conflicting manual settings?\n");
++				else
++					phydev_err(phydev, "Master/Slave resolution failed\n");
++				return -ENOLINK;
++			}
++
++			mii_stat1000_mod_linkmode_lpa_t(phydev->lp_advertising,
++							lpagb);
++		}
++
++		lpa = __phy_read(phydev, MII_LPA);
++		if (lpa < 0)
++			return lpa;
++
++		mii_lpa_mod_linkmode_lpa_t(phydev->lp_advertising, lpa);
++	} else {
++		linkmode_zero(phydev->lp_advertising);
++	}
++
++	return 0;
++}
++
++/**
++ * yt8521_adjust_status() - update speed and duplex to phydev. when in fiber
++ * mode, adjust speed and duplex.
++ * @phydev: a pointer to a &struct phy_device
++ * @status: yt8521 status read from YTPHY_SPECIFIC_STATUS_REG
++ * @is_utp: false(yt8521 work in fiber mode) or true(yt8521 work in utp mode)
++ *
++ * NOTE:The caller must have taken the MDIO bus lock.
++ *
++ * returns 0
++ */
++static int yt8521_adjust_status(struct phy_device *phydev, int status,
++				bool is_utp)
++{
++	int speed_mode, duplex;
++	int speed;
++	int err;
++	int lpa;
++
++	if (is_utp)
++		duplex = (status & YTPHY_SSR_DUPLEX) >> YTPHY_SSR_DUPLEX_OFFSET;
++	else
++		duplex = DUPLEX_FULL;	/* for fiber, it always DUPLEX_FULL */
++
++	speed_mode = (status & YTPHY_SSR_SPEED_MODE_MASK) >>
++		     YTPHY_SSR_SPEED_MODE_OFFSET;
++
++	switch (speed_mode) {
++	case YTPHY_SSR_SPEED_10M:
++		if (is_utp)
++			speed = SPEED_10;
++		else
++			/* for fiber, it will never run here, default to
++			 * SPEED_UNKNOWN
++			 */
++			speed = SPEED_UNKNOWN;
++		break;
++	case YTPHY_SSR_SPEED_100M:
++		speed = SPEED_100;
++		break;
++	case YTPHY_SSR_SPEED_1000M:
++		speed = SPEED_1000;
++		break;
++	default:
++		speed = SPEED_UNKNOWN;
++		break;
++	}
++
++	phydev->speed = speed;
++	phydev->duplex = duplex;
++
++	if (is_utp) {
++		err = ytphy_utp_read_lpa(phydev);
++		if (err < 0)
++			return err;
++
++		phy_resolve_aneg_pause(phydev);
++	} else {
++		lpa = __phy_read(phydev, MII_LPA);
++		if (lpa < 0)
++			return lpa;
++
++		/* only support 1000baseX Full */
++		linkmode_mod_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT,
++				 phydev->lp_advertising, lpa & LPA_1000XFULL);
++
++		if (!(lpa & YTPHY_FLPA_PAUSE)) {
++			phydev->pause = 0;
++			phydev->asym_pause = 0;
++		} else if ((lpa & YTPHY_FLPA_ASYM_PAUSE)) {
++			phydev->pause = 1;
++			phydev->asym_pause = 1;
++		} else {
++			phydev->pause = 1;
++			phydev->asym_pause = 0;
++		}
++	}
++
++	return 0;
++}
++
++/**
++ * yt8521_read_status_paged() -  determines the speed and duplex of one page
++ * @phydev: a pointer to a &struct phy_device
++ * @page: The reg page(YT8521_RSSR_FIBER_SPACE/YT8521_RSSR_UTP_SPACE) to
++ * operate.
++ *
++ * returns 1 (utp or fiber link),0 (no link) or negative errno code
++ */
++static int yt8521_read_status_paged(struct phy_device *phydev, int page)
++{
++	int fiber_latch_val;
++	int fiber_curr_val;
++	int old_page;
++	int ret = 0;
++	int status;
++	int link;
++
++	linkmode_zero(phydev->lp_advertising);
++	phydev->duplex = DUPLEX_UNKNOWN;
++	phydev->speed = SPEED_UNKNOWN;
++	phydev->asym_pause = 0;
++	phydev->pause = 0;
++
++	/* YT8521 has two reg space (utp/fiber) for linkup with utp/fiber
++	 * respectively. but for utp/fiber combo mode, reg space should be
++	 * arbitrated based on media priority. by default, utp takes
++	 * priority. reg space should be properly set before read
++	 * YTPHY_SPECIFIC_STATUS_REG.
++	 */
++
++	page &= YT8521_RSSR_SPACE_MASK;
++	old_page = phy_select_page(phydev, page);
++	if (old_page < 0)
++		goto err_restore_page;
++
++	/* Read YTPHY_SPECIFIC_STATUS_REG, which indicates the speed and duplex
++	 * of the PHY is actually using.
++	 */
++	ret = __phy_read(phydev, YTPHY_SPECIFIC_STATUS_REG);
++	if (ret < 0)
++		goto err_restore_page;
++
++	status = ret;
++	link = !!(status & YTPHY_SSR_LINK);
++
++	/* When PHY is in fiber mode, speed transferred from 1000Mbps to
++	 * 100Mbps,there is not link down from YTPHY_SPECIFIC_STATUS_REG, so
++	 * we need check MII_BMSR to identify such case.
++	 */
++	if (page == YT8521_RSSR_FIBER_SPACE) {
++		ret = __phy_read(phydev, MII_BMSR);
++		if (ret < 0)
++			goto err_restore_page;
++
++		fiber_latch_val = ret;
++		ret = __phy_read(phydev, MII_BMSR);
++		if (ret < 0)
++			goto err_restore_page;
++
++		fiber_curr_val = ret;
++		if (link && fiber_latch_val != fiber_curr_val) {
++			link = 0;
++			phydev_info(phydev,
++				    "%s, fiber link down detect, latch = %04x, curr = %04x\n",
++				    __func__, fiber_latch_val, fiber_curr_val);
++		}
++	} else {
++		/* Read autonegotiation status */
++		ret = __phy_read(phydev, MII_BMSR);
++		if (ret < 0)
++			goto err_restore_page;
++
++		phydev->autoneg_complete = ret & BMSR_ANEGCOMPLETE ? 1 : 0;
++	}
++
++	if (link) {
++		if (page == YT8521_RSSR_UTP_SPACE)
++			yt8521_adjust_status(phydev, status, true);
++		else
++			yt8521_adjust_status(phydev, status, false);
++	}
++	return phy_restore_page(phydev, old_page, link);
++
++err_restore_page:
++	return phy_restore_page(phydev, old_page, ret);
++}
++
++/**
++ * yt8521_read_status() -  determines the negotiated speed and duplex
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_read_status(struct phy_device *phydev)
++{
++	struct yt8521_priv *priv = phydev->priv;
++	int link_fiber = 0;
++	int link_utp;
++	int link;
++	int ret;
++
++	if (priv->reg_page != YT8521_RSSR_TO_BE_ARBITRATED) {
++		link = yt8521_read_status_paged(phydev, priv->reg_page);
++		if (link < 0)
++			return link;
++	} else {
++		/* when page is YT8521_RSSR_TO_BE_ARBITRATED, arbitration is
++		 * needed. by default, utp is higher priority.
++		 */
++
++		link_utp = yt8521_read_status_paged(phydev,
++						    YT8521_RSSR_UTP_SPACE);
++		if (link_utp < 0)
++			return link_utp;
++
++		if (!link_utp) {
++			link_fiber = yt8521_read_status_paged(phydev,
++							      YT8521_RSSR_FIBER_SPACE);
++			if (link_fiber < 0)
++				return link_fiber;
++		}
++
++		link = link_utp || link_fiber;
++	}
++
++	if (link) {
++		if (phydev->link == 0) {
++			/* arbitrate reg space based on linkup media type. */
++			if (priv->polling_mode == YT8521_MODE_POLL &&
++			    priv->reg_page == YT8521_RSSR_TO_BE_ARBITRATED) {
++				if (link_fiber)
++					priv->reg_page =
++						YT8521_RSSR_FIBER_SPACE;
++				else
++					priv->reg_page = YT8521_RSSR_UTP_SPACE;
++
++				ret = ytphy_write_ext_with_lock(phydev,
++								YT8521_REG_SPACE_SELECT_REG,
++								priv->reg_page);
++				if (ret < 0)
++					return ret;
++
++				phydev->port = link_fiber ? PORT_FIBRE : PORT_TP;
++
++				phydev_info(phydev, "%s, link up, media: %s\n",
++					    __func__,
++					    (phydev->port == PORT_TP) ?
++					    "UTP" : "Fiber");
++			}
++		}
++		phydev->link = 1;
++	} else {
++		if (phydev->link == 1) {
++			phydev_info(phydev, "%s, link down, media: %s\n",
++				    __func__, (phydev->port == PORT_TP) ?
++				    "UTP" : "Fiber");
++
++			/* When in YT8521_MODE_POLL mode, need prepare for next
++			 * arbitration.
++			 */
++			if (priv->polling_mode == YT8521_MODE_POLL) {
++				priv->reg_page = YT8521_RSSR_TO_BE_ARBITRATED;
++				phydev->port = PORT_NONE;
++			}
++		}
++
++		phydev->link = 0;
++	}
++
++	return 0;
++}
++
++/**
++ * yt8521_modify_bmcr_paged - bits modify a PHY's BMCR register of one page
++ * @phydev: the phy_device struct
++ * @page: The reg page(YT8521_RSSR_FIBER_SPACE/YT8521_RSSR_UTP_SPACE) to operate
++ * @mask: bit mask of bits to clear
++ * @set: bit mask of bits to set
++ *
++ * NOTE: Convenience function which allows a PHY's BMCR register to be
++ * modified as new register value = (old register value & ~mask) | set.
++ * YT8521 has two space (utp/fiber) and three mode (utp/fiber/poll), each space
++ * has MII_BMCR. poll mode combines utp and faber,so need do both.
++ * If it is reset, it will wait for completion.
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_modify_bmcr_paged(struct phy_device *phydev, int page,
++				    u16 mask, u16 set)
++{
++	int max_cnt = 500; /* the max wait time of reset ~ 500 ms */
++	int old_page;
++	int ret = 0;
++
++	old_page = phy_select_page(phydev, page & YT8521_RSSR_SPACE_MASK);
++	if (old_page < 0)
++		goto err_restore_page;
++
++	ret = __phy_modify(phydev, MII_BMCR, mask, set);
++	if (ret < 0)
++		goto err_restore_page;
++
++	/* If it is reset, need to wait for the reset to complete */
++	if (set == BMCR_RESET) {
++		while (max_cnt--) {
++			usleep_range(1000, 1100);
++			ret = __phy_read(phydev, MII_BMCR);
++			if (ret < 0)
++				goto err_restore_page;
++
++			if (!(ret & BMCR_RESET))
++				return phy_restore_page(phydev, old_page, 0);
++		}
++	}
++
++err_restore_page:
++	return phy_restore_page(phydev, old_page, ret);
++}
++
++/**
++ * yt8521_modify_utp_fiber_bmcr - bits modify a PHY's BMCR register
++ * @phydev: the phy_device struct
++ * @mask: bit mask of bits to clear
++ * @set: bit mask of bits to set
++ *
++ * NOTE: Convenience function which allows a PHY's BMCR register to be
++ * modified as new register value = (old register value & ~mask) | set.
++ * YT8521 has two space (utp/fiber) and three mode (utp/fiber/poll), each space
++ * has MII_BMCR. poll mode combines utp and faber,so need do both.
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_modify_utp_fiber_bmcr(struct phy_device *phydev, u16 mask,
++					u16 set)
++{
++	struct yt8521_priv *priv = phydev->priv;
++	int ret;
++
++	if (priv->reg_page != YT8521_RSSR_TO_BE_ARBITRATED) {
++		ret = yt8521_modify_bmcr_paged(phydev, priv->reg_page, mask,
++					       set);
++		if (ret < 0)
++			return ret;
++	} else {
++		ret = yt8521_modify_bmcr_paged(phydev, YT8521_RSSR_UTP_SPACE,
++					       mask, set);
++		if (ret < 0)
++			return ret;
++
++		ret = yt8521_modify_bmcr_paged(phydev, YT8521_RSSR_FIBER_SPACE,
++					       mask, set);
++		if (ret < 0)
++			return ret;
++	}
++	return 0;
++}
++
++/**
++ * yt8521_soft_reset() - called to issue a PHY software reset
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_soft_reset(struct phy_device *phydev)
++{
++	return yt8521_modify_utp_fiber_bmcr(phydev, 0, BMCR_RESET);
++}
++
++/**
++ * yt8521_suspend() - suspend the hardware
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_suspend(struct phy_device *phydev)
++{
++	int wol_config;
++
++	/* YTPHY_WOL_CONFIG_REG is common ext reg */
++	wol_config = ytphy_read_ext_with_lock(phydev, YTPHY_WOL_CONFIG_REG);
++	if (wol_config < 0)
++		return wol_config;
++
++	/* if wol enable, do nothing */
++	if (wol_config & YTPHY_WCR_ENABLE)
++		return 0;
++
++	return yt8521_modify_utp_fiber_bmcr(phydev, 0, BMCR_PDOWN);
++}
++
++/**
++ * yt8521_resume() - resume the hardware
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_resume(struct phy_device *phydev)
++{
++	int ret;
++	int wol_config;
++
++	/* disable auto sleep */
++	ret = ytphy_modify_ext_with_lock(phydev,
++					 YT8521_EXTREG_SLEEP_CONTROL1_REG,
++					 YT8521_ESC1R_SLEEP_SW, 0);
++	if (ret < 0)
++		return ret;
++
++	wol_config = ytphy_read_ext_with_lock(phydev, YTPHY_WOL_CONFIG_REG);
++	if (wol_config < 0)
++		return wol_config;
++
++	/* if wol enable, do nothing */
++	if (wol_config & YTPHY_WCR_ENABLE)
++		return 0;
++
++	return yt8521_modify_utp_fiber_bmcr(phydev, BMCR_PDOWN, 0);
++}
++
++/**
++ * yt8521_config_init() - called to initialize the PHY
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_config_init(struct phy_device *phydev)
++{
++	int old_page;
++	int ret = 0;
++	u16 val;
++
++	old_page = phy_select_page(phydev, YT8521_RSSR_UTP_SPACE);
++	if (old_page < 0)
++		goto err_restore_page;
++
++	switch (phydev->interface) {
++	case PHY_INTERFACE_MODE_RGMII:
++		val = YT8521_RC1R_GE_TX_DELAY_DIS | YT8521_RC1R_GE_TX_DELAY_DIS;
++		val |= YT8521_RC1R_RX_DELAY_DIS;
++		break;
++	case PHY_INTERFACE_MODE_RGMII_RXID:
++		val = YT8521_RC1R_GE_TX_DELAY_DIS | YT8521_RC1R_GE_TX_DELAY_DIS;
++		val |= YT8521_RC1R_RX_DELAY_EN;
++		break;
++	case PHY_INTERFACE_MODE_RGMII_TXID:
++		val = YT8521_RC1R_GE_TX_DELAY_EN | YT8521_RC1R_GE_TX_DELAY_EN;
++		val |= YT8521_RC1R_RX_DELAY_DIS;
++		break;
++	case PHY_INTERFACE_MODE_RGMII_ID:
++		val = YT8521_RC1R_GE_TX_DELAY_EN | YT8521_RC1R_GE_TX_DELAY_EN;
++		val |= YT8521_RC1R_RX_DELAY_EN;
++		break;
++	case PHY_INTERFACE_MODE_SGMII:
++		break;
++	default: /* do not support other modes */
++		ret = -EOPNOTSUPP;
++		goto err_restore_page;
++	}
++
++	/* set rgmii delay mode */
++	if (phydev->interface != PHY_INTERFACE_MODE_SGMII) {
++		ret = ytphy_modify_ext(phydev, YT8521_RGMII_CONFIG1_REG,
++				       (YT8521_RC1R_RX_DELAY_MASK |
++				       YT8521_RC1R_FE_TX_DELAY_MASK |
++				       YT8521_RC1R_GE_TX_DELAY_MASK),
++				       val);
++		if (ret < 0)
++			goto err_restore_page;
++	}
++
++	/* disable auto sleep */
++	ret = ytphy_modify_ext(phydev, YT8521_EXTREG_SLEEP_CONTROL1_REG,
++			       YT8521_ESC1R_SLEEP_SW, 0);
++	if (ret < 0)
++		goto err_restore_page;
++
++	/* enable RXC clock when no wire plug */
++	ret = ytphy_modify_ext(phydev, YT8521_CLOCK_GATING_REG,
++			       YT8521_CGR_RX_CLK_EN, 0);
++	if (ret < 0)
++		goto err_restore_page;
++
++err_restore_page:
++	return phy_restore_page(phydev, old_page, ret);
++}
++
++/**
++ * yt8521_prepare_fiber_features() -  A small helper function that setup
++ * fiber's features.
++ * @phydev: a pointer to a &struct phy_device
++ * @dst: a pointer to store fiber's features
++ */
++static void yt8521_prepare_fiber_features(struct phy_device *phydev,
++					  unsigned long *dst)
++{
++	linkmode_set_bit(ETHTOOL_LINK_MODE_100baseFX_Full_BIT, dst);
++	linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT, dst);
++	linkmode_set_bit(ETHTOOL_LINK_MODE_Autoneg_BIT, dst);
++	linkmode_set_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, dst);
++}
++
++/**
++ * yt8521_fiber_setup_forced - configures/forces speed from @phydev
++ * @phydev: target phy_device struct
++ *
++ * NOTE:The caller must have taken the MDIO bus lock.
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_fiber_setup_forced(struct phy_device *phydev)
++{
++	u16 val;
++	int ret;
++
++	if (phydev->speed == SPEED_1000)
++		val = YTPHY_MCR_FIBER_1000BX;
++	else if (phydev->speed == SPEED_100)
++		val = YTPHY_MCR_FIBER_100FX;
++	else
++		return -EINVAL;
++
++	ret =  __phy_modify(phydev, MII_BMCR, BMCR_ANENABLE, 0);
++	if (ret < 0)
++		return ret;
++
++	/* disable Fiber auto sensing */
++	ret =  ytphy_modify_ext(phydev, YT8521_LINK_TIMER_CFG2_REG,
++				YT8521_LTCR_EN_AUTOSEN, 0);
++	if (ret < 0)
++		return ret;
++
++	ret =  ytphy_modify_ext(phydev, YTPHY_MISC_CONFIG_REG,
++				YTPHY_MCR_FIBER_SPEED_MASK, val);
++	if (ret < 0)
++		return ret;
++
++	return ytphy_modify_ext(phydev, YT8521_CHIP_CONFIG_REG,
++				YT8521_CCR_SW_RST, 0);
++}
++
++/**
++ * ytphy_check_and_restart_aneg - Enable and restart auto-negotiation
++ * @phydev: target phy_device struct
++ * @restart: whether aneg restart is requested
++ *
++ * NOTE:The caller must have taken the MDIO bus lock.
++ *
++ * returns 0 or negative errno code
++ */
++static int ytphy_check_and_restart_aneg(struct phy_device *phydev, bool restart)
++{
++	int ret;
++
++	if (!restart) {
++		/* Advertisement hasn't changed, but maybe aneg was never on to
++		 * begin with?  Or maybe phy was isolated?
++		 */
++		ret = __phy_read(phydev, MII_BMCR);
++		if (ret < 0)
++			return ret;
++
++		if (!(ret & BMCR_ANENABLE) || (ret & BMCR_ISOLATE))
++			restart = true;
++	}
++	/* Enable and Restart Autonegotiation
++	 * Don't isolate the PHY if we're negotiating
++	 */
++	if (restart)
++		return __phy_modify(phydev, MII_BMCR, BMCR_ISOLATE,
++				    BMCR_ANENABLE | BMCR_ANRESTART);
++
++	return 0;
++}
++
++/**
++ * yt8521_fiber_config_aneg - restart auto-negotiation or write
++ * YTPHY_MISC_CONFIG_REG.
++ * @phydev: target phy_device struct
++ *
++ * NOTE:The caller must have taken the MDIO bus lock.
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_fiber_config_aneg(struct phy_device *phydev)
++{
++	int err, changed = 0;
++	int bmcr;
++	u16 adv;
++
++	if (phydev->autoneg != AUTONEG_ENABLE)
++		return yt8521_fiber_setup_forced(phydev);
++
++	/* enable Fiber auto sensing */
++	err =  ytphy_modify_ext(phydev, YT8521_LINK_TIMER_CFG2_REG,
++				0, YT8521_LTCR_EN_AUTOSEN);
++	if (err < 0)
++		return err;
++
++	err =  ytphy_modify_ext(phydev, YT8521_CHIP_CONFIG_REG,
++				YT8521_CCR_SW_RST, 0);
++	if (err < 0)
++		return err;
++
++	bmcr = __phy_read(phydev, MII_BMCR);
++	if (bmcr < 0)
++		return bmcr;
++
++	/* When it is coming from fiber forced mode, add bmcr power down
++	 * and power up to let aneg work fine.
++	 */
++	if (!(bmcr & BMCR_ANENABLE)) {
++		__phy_modify(phydev, MII_BMCR, 0, BMCR_PDOWN);
++		usleep_range(1000, 1100);
++		__phy_modify(phydev, MII_BMCR, BMCR_PDOWN, 0);
++	}
++
++	adv = linkmode_adv_to_mii_adv_x(phydev->advertising,
++					ETHTOOL_LINK_MODE_1000baseX_Full_BIT);
++
++	/* Setup fiber advertisement */
++	err = __phy_modify_changed(phydev, MII_ADVERTISE,
++				   ADVERTISE_1000XHALF | ADVERTISE_1000XFULL |
++				   ADVERTISE_1000XPAUSE |
++				   ADVERTISE_1000XPSE_ASYM,
++				   adv);
++	if (err < 0)
++		return err;
++
++	if (err > 0)
++		changed = 1;
++
++	return ytphy_check_and_restart_aneg(phydev, changed);
++}
++
++/**
++ * ytphy_setup_master_slave
++ * @phydev: target phy_device struct
++ *
++ * NOTE: The caller must have taken the MDIO bus lock.
++ *
++ * returns 0 or negative errno code
++ */
++static int ytphy_setup_master_slave(struct phy_device *phydev)
++{
++	u16 ctl = 0;
++
++	if (!phydev->is_gigabit_capable)
++		return 0;
++
++	switch (phydev->master_slave_set) {
++	case MASTER_SLAVE_CFG_MASTER_PREFERRED:
++		ctl |= CTL1000_PREFER_MASTER;
++		break;
++	case MASTER_SLAVE_CFG_SLAVE_PREFERRED:
++		break;
++	case MASTER_SLAVE_CFG_MASTER_FORCE:
++		ctl |= CTL1000_AS_MASTER;
++		fallthrough;
++	case MASTER_SLAVE_CFG_SLAVE_FORCE:
++		ctl |= CTL1000_ENABLE_MASTER;
++		break;
++	case MASTER_SLAVE_CFG_UNKNOWN:
++	case MASTER_SLAVE_CFG_UNSUPPORTED:
++		return 0;
++	default:
++		phydev_warn(phydev, "Unsupported Master/Slave mode\n");
++		return -EOPNOTSUPP;
++	}
++
++	return __phy_modify_changed(phydev, MII_CTRL1000,
++				    (CTL1000_ENABLE_MASTER | CTL1000_AS_MASTER |
++				    CTL1000_PREFER_MASTER), ctl);
++}
++
++/**
++ * ytphy_utp_config_advert - sanitize and advertise auto-negotiation parameters
++ * @phydev: target phy_device struct
++ *
++ * NOTE: Writes MII_ADVERTISE with the appropriate values,
++ * after sanitizing the values to make sure we only advertise
++ * what is supported.  Returns < 0 on error, 0 if the PHY's advertisement
++ * hasn't changed, and > 0 if it has changed.
++ * The caller must have taken the MDIO bus lock.
++ *
++ * returns 0 or negative errno code
++ */
++static int ytphy_utp_config_advert(struct phy_device *phydev)
++{
++	int err, bmsr, changed = 0;
++	u32 adv;
++
++	/* Only allow advertising what this PHY supports */
++	linkmode_and(phydev->advertising, phydev->advertising,
++		     phydev->supported);
++
++	adv = linkmode_adv_to_mii_adv_t(phydev->advertising);
++
++	/* Setup standard advertisement */
++	err = __phy_modify_changed(phydev, MII_ADVERTISE,
++				   ADVERTISE_ALL | ADVERTISE_100BASE4 |
++				   ADVERTISE_PAUSE_CAP | ADVERTISE_PAUSE_ASYM,
++				   adv);
++	if (err < 0)
++		return err;
++	if (err > 0)
++		changed = 1;
++
++	bmsr = __phy_read(phydev, MII_BMSR);
++	if (bmsr < 0)
++		return bmsr;
++
++	/* Per 802.3-2008, Section 22.2.4.2.16 Extended status all
++	 * 1000Mbits/sec capable PHYs shall have the BMSR_ESTATEN bit set to a
++	 * logical 1.
++	 */
++	if (!(bmsr & BMSR_ESTATEN))
++		return changed;
++
++	adv = linkmode_adv_to_mii_ctrl1000_t(phydev->advertising);
++
++	err = __phy_modify_changed(phydev, MII_CTRL1000,
++				   ADVERTISE_1000FULL | ADVERTISE_1000HALF,
++				   adv);
++	if (err < 0)
++		return err;
++	if (err > 0)
++		changed = 1;
++
++	return changed;
++}
++
++/**
++ * ytphy_utp_config_aneg - restart auto-negotiation or write BMCR
++ * @phydev: target phy_device struct
++ * @changed: whether autoneg is requested
++ *
++ * NOTE: If auto-negotiation is enabled, we configure the
++ * advertising, and then restart auto-negotiation.  If it is not
++ * enabled, then we write the BMCR.
++ * The caller must have taken the MDIO bus lock.
++ *
++ * returns 0 or negative errno code
++ */
++static int ytphy_utp_config_aneg(struct phy_device *phydev, bool changed)
++{
++	int err;
++	u16 ctl;
++
++	err = ytphy_setup_master_slave(phydev);
++	if (err < 0)
++		return err;
++	else if (err)
++		changed = true;
++
++	if (phydev->autoneg != AUTONEG_ENABLE) {
++		/* configures/forces speed/duplex from @phydev */
++
++		ctl = mii_bmcr_encode_fixed(phydev->speed, phydev->duplex);
++
++		return __phy_modify(phydev, MII_BMCR, ~(BMCR_LOOPBACK |
++				    BMCR_ISOLATE | BMCR_PDOWN), ctl);
++	}
++
++	err = ytphy_utp_config_advert(phydev);
++	if (err < 0) /* error */
++		return err;
++	else if (err)
++		changed = true;
++
++	return ytphy_check_and_restart_aneg(phydev, changed);
++}
++
++/**
++ * yt8521_config_aneg_paged() - switch reg space then call genphy_config_aneg
++ * of one page
++ * @phydev: a pointer to a &struct phy_device
++ * @page: The reg page(YT8521_RSSR_FIBER_SPACE/YT8521_RSSR_UTP_SPACE) to
++ * operate.
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_config_aneg_paged(struct phy_device *phydev, int page)
++{
++	__ETHTOOL_DECLARE_LINK_MODE_MASK(fiber_supported);
++	struct yt8521_priv *priv = phydev->priv;
++	int old_page;
++	int ret = 0;
++
++	page &= YT8521_RSSR_SPACE_MASK;
++
++	old_page = phy_select_page(phydev, page);
++	if (old_page < 0)
++		goto err_restore_page;
++
++	/* If reg_page is YT8521_RSSR_TO_BE_ARBITRATED,
++	 * phydev->advertising should be updated.
++	 */
++	if (priv->reg_page == YT8521_RSSR_TO_BE_ARBITRATED) {
++		linkmode_zero(fiber_supported);
++		yt8521_prepare_fiber_features(phydev, fiber_supported);
++
++		/* prepare fiber_supported, then setup advertising. */
++		if (page == YT8521_RSSR_FIBER_SPACE) {
++			linkmode_set_bit(ETHTOOL_LINK_MODE_Pause_BIT,
++					 fiber_supported);
++			linkmode_set_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT,
++					 fiber_supported);
++			linkmode_and(phydev->advertising,
++				     priv->combo_advertising, fiber_supported);
++		} else {
++			/* ETHTOOL_LINK_MODE_Autoneg_BIT is also used in utp */
++			linkmode_clear_bit(ETHTOOL_LINK_MODE_Autoneg_BIT,
++					   fiber_supported);
++			linkmode_andnot(phydev->advertising,
++					priv->combo_advertising,
++					fiber_supported);
++		}
++	}
++
++	if (page == YT8521_RSSR_FIBER_SPACE)
++		ret = yt8521_fiber_config_aneg(phydev);
++	else
++		ret = ytphy_utp_config_aneg(phydev, false);
++
++err_restore_page:
++	return phy_restore_page(phydev, old_page, ret);
++}
++
++/**
++ * yt8521_config_aneg() - change reg space then call yt8521_config_aneg_paged
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_config_aneg(struct phy_device *phydev)
++{
++	struct yt8521_priv *priv = phydev->priv;
++	int ret;
++
++	if (priv->reg_page != YT8521_RSSR_TO_BE_ARBITRATED) {
++		ret = yt8521_config_aneg_paged(phydev, priv->reg_page);
++		if (ret < 0)
++			return ret;
++	} else {
++		/* If reg_page is YT8521_RSSR_TO_BE_ARBITRATED,
++		 * phydev->advertising need to be saved at first run.
++		 * Because it contains the advertising which supported by both
++		 * mac and yt8521(utp and fiber).
++		 */
++		if (linkmode_empty(priv->combo_advertising)) {
++			linkmode_copy(priv->combo_advertising,
++				      phydev->advertising);
++		}
++
++		ret = yt8521_config_aneg_paged(phydev, YT8521_RSSR_UTP_SPACE);
++		if (ret < 0)
++			return ret;
++
++		ret = yt8521_config_aneg_paged(phydev, YT8521_RSSR_FIBER_SPACE);
++		if (ret < 0)
++			return ret;
++
++		/* we don't known which will be link, so restore
++		 * phydev->advertising as default value.
++		 */
++		linkmode_copy(phydev->advertising, priv->combo_advertising);
++	}
++	return 0;
++}
++
++/**
++ * yt8521_aneg_done_paged() - determines the auto negotiation result of one
++ * page.
++ * @phydev: a pointer to a &struct phy_device
++ * @page: The reg page(YT8521_RSSR_FIBER_SPACE/YT8521_RSSR_UTP_SPACE) to
++ * operate.
++ *
++ * returns 0(no link)or 1(fiber or utp link) or negative errno code
++ */
++static int yt8521_aneg_done_paged(struct phy_device *phydev, int page)
++{
++	int old_page;
++	int ret = 0;
++	int link;
++
++	old_page = phy_select_page(phydev, page & YT8521_RSSR_SPACE_MASK);
++	if (old_page < 0)
++		goto err_restore_page;
++
++	ret = __phy_read(phydev, YTPHY_SPECIFIC_STATUS_REG);
++	if (ret < 0)
++		goto err_restore_page;
++
++	link = !!(ret & YTPHY_SSR_LINK);
++	ret = link;
++
++err_restore_page:
++	return phy_restore_page(phydev, old_page, ret);
++}
++
++/**
++ * yt8521_aneg_done() - determines the auto negotiation result
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * returns 0(no link)or 1(fiber or utp link) or negative errno code
++ */
++static int yt8521_aneg_done(struct phy_device *phydev)
++{
++	struct yt8521_priv *priv = phydev->priv;
++	int link_fiber = 0;
++	int link_utp;
++	int link;
++
++	if (priv->reg_page != YT8521_RSSR_TO_BE_ARBITRATED) {
++		link = yt8521_aneg_done_paged(phydev, priv->reg_page);
++	} else {
++		link_utp = yt8521_aneg_done_paged(phydev,
++						  YT8521_RSSR_UTP_SPACE);
++		if (link_utp < 0)
++			return link_utp;
++
++		if (!link_utp) {
++			link_fiber = yt8521_aneg_done_paged(phydev,
++							    YT8521_RSSR_FIBER_SPACE);
++			if (link_fiber < 0)
++				return link_fiber;
++		}
++		link = link_fiber || link_utp;
++		phydev_info(phydev, "%s, link_fiber: %d, link_utp: %d\n",
++			    __func__, link_fiber, link_utp);
++	}
++
++	return link;
++}
++
++/**
++ * ytphy_utp_read_abilities - read PHY abilities from Clause 22 registers
++ * @phydev: target phy_device struct
++ *
++ * NOTE: Reads the PHY's abilities and populates
++ * phydev->supported accordingly.
++ * The caller must have taken the MDIO bus lock.
++ *
++ * returns 0 or negative errno code
++ */
++static int ytphy_utp_read_abilities(struct phy_device *phydev)
++{
++	int val;
++
++	linkmode_set_bit_array(phy_basic_ports_array,
++			       ARRAY_SIZE(phy_basic_ports_array),
++			       phydev->supported);
++
++	val = __phy_read(phydev, MII_BMSR);
++	if (val < 0)
++		return val;
++
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_Autoneg_BIT, phydev->supported,
++			 val & BMSR_ANEGCAPABLE);
++
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_100baseT_Full_BIT, phydev->supported,
++			 val & BMSR_100FULL);
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_100baseT_Half_BIT, phydev->supported,
++			 val & BMSR_100HALF);
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_10baseT_Full_BIT, phydev->supported,
++			 val & BMSR_10FULL);
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_10baseT_Half_BIT, phydev->supported,
++			 val & BMSR_10HALF);
++
++	if (val & BMSR_ESTATEN) {
++		val = __phy_read(phydev, MII_ESTATUS);
++		if (val < 0)
++			return val;
++
++		linkmode_mod_bit(ETHTOOL_LINK_MODE_1000baseT_Full_BIT,
++				 phydev->supported, val & ESTATUS_1000_TFULL);
++		linkmode_mod_bit(ETHTOOL_LINK_MODE_1000baseT_Half_BIT,
++				 phydev->supported, val & ESTATUS_1000_THALF);
++		linkmode_mod_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT,
++				 phydev->supported, val & ESTATUS_1000_XFULL);
++	}
++
++	return 0;
++}
++
++/**
++ * yt8521_get_features_paged() -  read supported link modes for one page
++ * @phydev: a pointer to a &struct phy_device
++ * @page: The reg page(YT8521_RSSR_FIBER_SPACE/YT8521_RSSR_UTP_SPACE) to
++ * operate.
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_get_features_paged(struct phy_device *phydev, int page)
++{
++	int old_page;
++	int ret = 0;
++
++	page &= YT8521_RSSR_SPACE_MASK;
++	old_page = phy_select_page(phydev, page);
++	if (old_page < 0)
++		goto err_restore_page;
++
++	if (page == YT8521_RSSR_FIBER_SPACE) {
++		linkmode_zero(phydev->supported);
++		yt8521_prepare_fiber_features(phydev, phydev->supported);
++	} else {
++		ret = ytphy_utp_read_abilities(phydev);
++		if (ret < 0)
++			goto err_restore_page;
++	}
++
++err_restore_page:
++	return phy_restore_page(phydev, old_page, ret);
++}
++
++/**
++ * yt8521_get_features - switch reg space then call yt8521_get_features_paged
++ * @phydev: target phy_device struct
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_get_features(struct phy_device *phydev)
++{
++	struct yt8521_priv *priv = phydev->priv;
++	int ret;
++
++	if (priv->reg_page != YT8521_RSSR_TO_BE_ARBITRATED) {
++		ret = yt8521_get_features_paged(phydev, priv->reg_page);
++	} else {
++		ret = yt8521_get_features_paged(phydev,
++						YT8521_RSSR_UTP_SPACE);
++		if (ret < 0)
++			return ret;
++
++		/* add fiber's features to phydev->supported */
++		yt8521_prepare_fiber_features(phydev, phydev->supported);
++	}
++	return ret;
++}
++
+ static struct phy_driver motorcomm_phy_drvs[] = {
+ 	{
+ 		PHY_ID_MATCH_EXACT(PHY_ID_YT8511),
+@@ -121,16 +1733,35 @@ static struct phy_driver motorcomm_phy_d
+ 		.read_page	= yt8511_read_page,
+ 		.write_page	= yt8511_write_page,
+ 	},
++	{
++		PHY_ID_MATCH_EXACT(PHY_ID_YT8521),
++		.name		= "YT8521 Gigabit Ethernet",
++		.get_features	= yt8521_get_features,
++		.probe		= yt8521_probe,
++		.read_page	= yt8521_read_page,
++		.write_page	= yt8521_write_page,
++		.get_wol	= ytphy_get_wol,
++		.set_wol	= ytphy_set_wol,
++		.config_aneg	= yt8521_config_aneg,
++		.aneg_done	= yt8521_aneg_done,
++		.config_init	= yt8521_config_init,
++		.read_status	= yt8521_read_status,
++		.soft_reset	= yt8521_soft_reset,
++		.suspend	= yt8521_suspend,
++		.resume		= yt8521_resume,
++	},
+ };
+ 
+ module_phy_driver(motorcomm_phy_drvs);
+ 
+-MODULE_DESCRIPTION("Motorcomm PHY driver");
++MODULE_DESCRIPTION("Motorcomm 8511/8521 PHY driver");
+ MODULE_AUTHOR("Peter Geis");
++MODULE_AUTHOR("Frank");
+ MODULE_LICENSE("GPL");
+ 
+ static const struct mdio_device_id __maybe_unused motorcomm_tbl[] = {
+ 	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8511) },
++	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8521) },
+ 	{ /* sentinal */ }
+ };
+ 
diff --git a/target/linux/generic/backport-5.15/791-v6.2-02-net-phy-fix-yt8521-duplicated-argument-to-or.patch b/target/linux/generic/backport-5.15/791-v6.2-02-net-phy-fix-yt8521-duplicated-argument-to-or.patch
new file mode 100644
index 00000000000000..cce71c8d84bfd7
--- /dev/null
+++ b/target/linux/generic/backport-5.15/791-v6.2-02-net-phy-fix-yt8521-duplicated-argument-to-or.patch
@@ -0,0 +1,49 @@
+From 4e0243e7128c9b25ea2739136076a95d6adaba5e Mon Sep 17 00:00:00 2001
+From: Frank <Frank.Sae@motor-comm.com>
+Date: Fri, 4 Nov 2022 16:44:41 +0800
+Subject: [PATCH] net: phy: fix yt8521 duplicated argument to & or |
+
+cocci warnings: (new ones prefixed by >>)
+>> drivers/net/phy/motorcomm.c:1122:8-35: duplicated argument to & or |
+  drivers/net/phy/motorcomm.c:1126:8-35: duplicated argument to & or |
+  drivers/net/phy/motorcomm.c:1130:8-34: duplicated argument to & or |
+  drivers/net/phy/motorcomm.c:1134:8-34: duplicated argument to & or |
+
+ The second YT8521_RC1R_GE_TX_DELAY_xx should be YT8521_RC1R_FE_TX_DELAY_xx.
+
+Fixes: 70479a40954c ("net: phy: Add driver for Motorcomm yt8521 gigabit ethernet phy")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Julia Lawall <julia.lawall@lip6.fr>
+Signed-off-by: Frank <Frank.Sae@motor-comm.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/motorcomm.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/phy/motorcomm.c
++++ b/drivers/net/phy/motorcomm.c
+@@ -1119,19 +1119,19 @@ static int yt8521_config_init(struct phy
+ 
+ 	switch (phydev->interface) {
+ 	case PHY_INTERFACE_MODE_RGMII:
+-		val = YT8521_RC1R_GE_TX_DELAY_DIS | YT8521_RC1R_GE_TX_DELAY_DIS;
++		val = YT8521_RC1R_GE_TX_DELAY_DIS | YT8521_RC1R_FE_TX_DELAY_DIS;
+ 		val |= YT8521_RC1R_RX_DELAY_DIS;
+ 		break;
+ 	case PHY_INTERFACE_MODE_RGMII_RXID:
+-		val = YT8521_RC1R_GE_TX_DELAY_DIS | YT8521_RC1R_GE_TX_DELAY_DIS;
++		val = YT8521_RC1R_GE_TX_DELAY_DIS | YT8521_RC1R_FE_TX_DELAY_DIS;
+ 		val |= YT8521_RC1R_RX_DELAY_EN;
+ 		break;
+ 	case PHY_INTERFACE_MODE_RGMII_TXID:
+-		val = YT8521_RC1R_GE_TX_DELAY_EN | YT8521_RC1R_GE_TX_DELAY_EN;
++		val = YT8521_RC1R_GE_TX_DELAY_EN | YT8521_RC1R_FE_TX_DELAY_EN;
+ 		val |= YT8521_RC1R_RX_DELAY_DIS;
+ 		break;
+ 	case PHY_INTERFACE_MODE_RGMII_ID:
+-		val = YT8521_RC1R_GE_TX_DELAY_EN | YT8521_RC1R_GE_TX_DELAY_EN;
++		val = YT8521_RC1R_GE_TX_DELAY_EN | YT8521_RC1R_FE_TX_DELAY_EN;
+ 		val |= YT8521_RC1R_RX_DELAY_EN;
+ 		break;
+ 	case PHY_INTERFACE_MODE_SGMII:
diff --git a/target/linux/generic/backport-5.15/791-v6.2-03-net-phy-add-Motorcomm-YT8531S-phy-id.patch b/target/linux/generic/backport-5.15/791-v6.2-03-net-phy-add-Motorcomm-YT8531S-phy-id.patch
new file mode 100644
index 00000000000000..da60c63905d7f6
--- /dev/null
+++ b/target/linux/generic/backport-5.15/791-v6.2-03-net-phy-add-Motorcomm-YT8531S-phy-id.patch
@@ -0,0 +1,140 @@
+From 813abcd98fb1b2cccf850cdfa092a4bfc50b2363 Mon Sep 17 00:00:00 2001
+From: Frank <Frank.Sae@motor-comm.com>
+Date: Tue, 22 Nov 2022 16:42:32 +0800
+Subject: [PATCH] net: phy: add Motorcomm YT8531S phy id.
+
+We added patch for motorcomm.c to support YT8531S. This patch has
+been tested on AM335x platform which has one YT8531S interface
+card and passed all test cases.
+The tested cases indluding: YT8531S UTP function with support of
+10M/100M/1000M; YT8531S Fiber function with support of 100M/1000M;
+and YT8531S Combo function that supports auto detection of media type.
+
+Since most functions of YT8531S are similar to YT8521 and we reuse some
+codes for YT8521 in the patch file.
+
+Signed-off-by: Frank <Frank.Sae@motor-comm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/Kconfig     |  2 +-
+ drivers/net/phy/motorcomm.c | 52 +++++++++++++++++++++++++++++++++----
+ 2 files changed, 48 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -245,7 +245,7 @@ config MOTORCOMM_PHY
+ 	tristate "Motorcomm PHYs"
+ 	help
+ 	  Enables support for Motorcomm network PHYs.
+-	  Currently supports the YT8511, YT8521 Gigabit Ethernet PHYs.
++	  Currently supports the YT8511, YT8521, YT8531S Gigabit Ethernet PHYs.
+ 
+ config NATIONAL_PHY
+ 	tristate "National Semiconductor PHYs"
+--- a/drivers/net/phy/motorcomm.c
++++ b/drivers/net/phy/motorcomm.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0+
+ /*
+- * Motorcomm 8511/8521 PHY driver.
++ * Motorcomm 8511/8521/8531S PHY driver.
+  *
+  * Author: Peter Geis <pgwipeout@gmail.com>
+  * Author: Frank <Frank.Sae@motor-comm.com>
+@@ -12,9 +12,10 @@
+ #include <linux/phy.h>
+ 
+ #define PHY_ID_YT8511		0x0000010a
+-#define PHY_ID_YT8521				0x0000011A
++#define PHY_ID_YT8521		0x0000011A
++#define PHY_ID_YT8531S		0x4F51E91A
+ 
+-/* YT8521 Register Overview
++/* YT8521/YT8531S Register Overview
+  *	UTP Register space	|	FIBER Register space
+  *  ------------------------------------------------------------
+  * |	UTP MII			|	FIBER MII		|
+@@ -147,7 +148,7 @@
+ #define YT8521_LINK_TIMER_CFG2_REG		0xA5
+ #define YT8521_LTCR_EN_AUTOSEN			BIT(15)
+ 
+-/* 0xA000, 0xA001, 0xA003 ,and 0xA006 ~ 0xA00A  are common ext registers
++/* 0xA000, 0xA001, 0xA003, 0xA006 ~ 0xA00A and 0xA012 are common ext registers
+  * of yt8521 phy. There is no need to switch reg space when operating these
+  * registers.
+  */
+@@ -221,6 +222,9 @@
+  */
+ #define YTPHY_WCR_TYPE_PULSE			BIT(0)
+ 
++#define YT8531S_SYNCE_CFG_REG			0xA012
++#define YT8531S_SCR_SYNCE_ENABLE		BIT(6)
++
+ /* Extended Register  end */
+ 
+ struct yt8521_priv {
+@@ -648,6 +652,26 @@ static int yt8521_probe(struct phy_devic
+ }
+ 
+ /**
++ * yt8531s_probe() - read chip config then set suitable polling_mode
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8531s_probe(struct phy_device *phydev)
++{
++	int ret;
++
++	/* Disable SyncE clock output by default */
++	ret = ytphy_modify_ext_with_lock(phydev, YT8531S_SYNCE_CFG_REG,
++					 YT8531S_SCR_SYNCE_ENABLE, 0);
++	if (ret < 0)
++		return ret;
++
++	/* same as yt8521_probe */
++	return yt8521_probe(phydev);
++}
++
++/**
+  * ytphy_utp_read_lpa() - read LPA then setup lp_advertising for utp
+  * @phydev: a pointer to a &struct phy_device
+  *
+@@ -1750,11 +1774,28 @@ static struct phy_driver motorcomm_phy_d
+ 		.suspend	= yt8521_suspend,
+ 		.resume		= yt8521_resume,
+ 	},
++	{
++		PHY_ID_MATCH_EXACT(PHY_ID_YT8531S),
++		.name		= "YT8531S Gigabit Ethernet",
++		.get_features	= yt8521_get_features,
++		.probe		= yt8531s_probe,
++		.read_page	= yt8521_read_page,
++		.write_page	= yt8521_write_page,
++		.get_wol	= ytphy_get_wol,
++		.set_wol	= ytphy_set_wol,
++		.config_aneg	= yt8521_config_aneg,
++		.aneg_done	= yt8521_aneg_done,
++		.config_init	= yt8521_config_init,
++		.read_status	= yt8521_read_status,
++		.soft_reset	= yt8521_soft_reset,
++		.suspend	= yt8521_suspend,
++		.resume		= yt8521_resume,
++	},
+ };
+ 
+ module_phy_driver(motorcomm_phy_drvs);
+ 
+-MODULE_DESCRIPTION("Motorcomm 8511/8521 PHY driver");
++MODULE_DESCRIPTION("Motorcomm 8511/8521/8531S PHY driver");
+ MODULE_AUTHOR("Peter Geis");
+ MODULE_AUTHOR("Frank");
+ MODULE_LICENSE("GPL");
+@@ -1762,6 +1803,7 @@ MODULE_LICENSE("GPL");
+ static const struct mdio_device_id __maybe_unused motorcomm_tbl[] = {
+ 	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8511) },
+ 	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8521) },
++	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8531S) },
+ 	{ /* sentinal */ }
+ };
+ 
diff --git a/target/linux/generic/backport-5.15/791-v6.3-04-net-phy-fix-the-spelling-problem-of-Sentinel.patch b/target/linux/generic/backport-5.15/791-v6.3-04-net-phy-fix-the-spelling-problem-of-Sentinel.patch
new file mode 100644
index 00000000000000..94fc32aadb320d
--- /dev/null
+++ b/target/linux/generic/backport-5.15/791-v6.3-04-net-phy-fix-the-spelling-problem-of-Sentinel.patch
@@ -0,0 +1,26 @@
+From 4104a713204d62aca482eebb0c6226d82a0721eb Mon Sep 17 00:00:00 2001
+From: Frank Sae <Frank.Sae@motor-comm.com>
+Date: Sat, 28 Jan 2023 14:35:57 +0800
+Subject: [PATCH] net: phy: fix the spelling problem of Sentinel
+
+CHECK: 'sentinal' may be misspelled - perhaps 'sentinel'?
+
+Signed-off-by: Frank Sae <Frank.Sae@motor-comm.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20230128063558.5850-1-Frank.Sae@motor-comm.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/motorcomm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/phy/motorcomm.c
++++ b/drivers/net/phy/motorcomm.c
+@@ -1804,7 +1804,7 @@ static const struct mdio_device_id __may
+ 	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8511) },
+ 	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8521) },
+ 	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8531S) },
+-	{ /* sentinal */ }
++	{ /* sentinel */ }
+ };
+ 
+ MODULE_DEVICE_TABLE(mdio, motorcomm_tbl);
diff --git a/target/linux/generic/backport-5.15/791-v6.3-05-net-phy-motorcomm-change-the-phy-id-of-yt8521-and-yt8531s.patch b/target/linux/generic/backport-5.15/791-v6.3-05-net-phy-motorcomm-change-the-phy-id-of-yt8521-and-yt8531s.patch
new file mode 100644
index 00000000000000..076fa82d267fce
--- /dev/null
+++ b/target/linux/generic/backport-5.15/791-v6.3-05-net-phy-motorcomm-change-the-phy-id-of-yt8521-and-yt8531s.patch
@@ -0,0 +1,29 @@
+From 3c1dc22162d673d595855d24f95200ed2643f88f Mon Sep 17 00:00:00 2001
+From: Frank Sae <Frank.Sae@motor-comm.com>
+Date: Sat, 28 Jan 2023 14:35:58 +0800
+Subject: [PATCH] net: phy: motorcomm: change the phy id of yt8521 and yt8531s
+ to lowercase
+
+The phy id is usually defined in lower case.
+
+Signed-off-by: Frank Sae <Frank.Sae@motor-comm.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20230128063558.5850-2-Frank.Sae@motor-comm.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/motorcomm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/phy/motorcomm.c
++++ b/drivers/net/phy/motorcomm.c
+@@ -12,8 +12,8 @@
+ #include <linux/phy.h>
+ 
+ #define PHY_ID_YT8511		0x0000010a
+-#define PHY_ID_YT8521		0x0000011A
+-#define PHY_ID_YT8531S		0x4F51E91A
++#define PHY_ID_YT8521		0x0000011a
++#define PHY_ID_YT8531S		0x4f51e91a
+ 
+ /* YT8521/YT8531S Register Overview
+  *	UTP Register space	|	FIBER Register space
diff --git a/target/linux/generic/backport-5.15/791-v6.3-06-net-phy-Add-BIT-macro-for-Motorcomm-yt8521-yt8531-gigabit.patch b/target/linux/generic/backport-5.15/791-v6.3-06-net-phy-Add-BIT-macro-for-Motorcomm-yt8521-yt8531-gigabit.patch
new file mode 100644
index 00000000000000..ba9a6ab4ccba3b
--- /dev/null
+++ b/target/linux/generic/backport-5.15/791-v6.3-06-net-phy-Add-BIT-macro-for-Motorcomm-yt8521-yt8531-gigabit.patch
@@ -0,0 +1,107 @@
+From 4869a146cd60fc8115230f0a45e15e534c531922 Mon Sep 17 00:00:00 2001
+From: Frank Sae <Frank.Sae@motor-comm.com>
+Date: Thu, 2 Feb 2023 11:00:34 +0800
+Subject: [PATCH] net: phy: Add BIT macro for Motorcomm yt8521/yt8531 gigabit
+ ethernet phy
+
+Add BIT macro for Motorcomm yt8521/yt8531 gigabit ethernet phy.
+ This is a preparatory patch. Add BIT macro for 0xA012 reg, and
+ supplement for 0xA001 and 0xA003 reg. These will be used to support dts.
+
+Signed-off-by: Frank Sae <Frank.Sae@motor-comm.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/motorcomm.c | 55 ++++++++++++++++++++++++++++++++++---
+ 1 file changed, 51 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/phy/motorcomm.c
++++ b/drivers/net/phy/motorcomm.c
+@@ -161,6 +161,11 @@
+ 
+ #define YT8521_CHIP_CONFIG_REG			0xA001
+ #define YT8521_CCR_SW_RST			BIT(15)
++/* 1b0 disable 1.9ns rxc clock delay  *default*
++ * 1b1 enable 1.9ns rxc clock delay
++ */
++#define YT8521_CCR_RXC_DLY_EN			BIT(8)
++#define YT8521_CCR_RXC_DLY_1_900_NS		1900
+ 
+ #define YT8521_CCR_MODE_SEL_MASK		(BIT(2) | BIT(1) | BIT(0))
+ #define YT8521_CCR_MODE_UTP_TO_RGMII		0
+@@ -178,22 +183,41 @@
+ #define YT8521_MODE_POLL			0x3
+ 
+ #define YT8521_RGMII_CONFIG1_REG		0xA003
+-
++/* 1b0 use original tx_clk_rgmii  *default*
++ * 1b1 use inverted tx_clk_rgmii.
++ */
++#define YT8521_RC1R_TX_CLK_SEL_INVERTED		BIT(14)
+ /* TX Gig-E Delay is bits 3:0, default 0x1
+  * TX Fast-E Delay is bits 7:4, default 0xf
+  * RX Delay is bits 13:10, default 0x0
+  * Delay = 150ps * N
+  * On = 2250ps, off = 0ps
+  */
+-#define YT8521_RC1R_RX_DELAY_MASK		(0xF << 10)
++#define YT8521_RC1R_RX_DELAY_MASK		GENMASK(13, 10)
+ #define YT8521_RC1R_RX_DELAY_EN			(0xF << 10)
+ #define YT8521_RC1R_RX_DELAY_DIS		(0x0 << 10)
+-#define YT8521_RC1R_FE_TX_DELAY_MASK		(0xF << 4)
++#define YT8521_RC1R_FE_TX_DELAY_MASK		GENMASK(7, 4)
+ #define YT8521_RC1R_FE_TX_DELAY_EN		(0xF << 4)
+ #define YT8521_RC1R_FE_TX_DELAY_DIS		(0x0 << 4)
+-#define YT8521_RC1R_GE_TX_DELAY_MASK		(0xF << 0)
++#define YT8521_RC1R_GE_TX_DELAY_MASK		GENMASK(3, 0)
+ #define YT8521_RC1R_GE_TX_DELAY_EN		(0xF << 0)
+ #define YT8521_RC1R_GE_TX_DELAY_DIS		(0x0 << 0)
++#define YT8521_RC1R_RGMII_0_000_NS		0
++#define YT8521_RC1R_RGMII_0_150_NS		1
++#define YT8521_RC1R_RGMII_0_300_NS		2
++#define YT8521_RC1R_RGMII_0_450_NS		3
++#define YT8521_RC1R_RGMII_0_600_NS		4
++#define YT8521_RC1R_RGMII_0_750_NS		5
++#define YT8521_RC1R_RGMII_0_900_NS		6
++#define YT8521_RC1R_RGMII_1_050_NS		7
++#define YT8521_RC1R_RGMII_1_200_NS		8
++#define YT8521_RC1R_RGMII_1_350_NS		9
++#define YT8521_RC1R_RGMII_1_500_NS		10
++#define YT8521_RC1R_RGMII_1_650_NS		11
++#define YT8521_RC1R_RGMII_1_800_NS		12
++#define YT8521_RC1R_RGMII_1_950_NS		13
++#define YT8521_RC1R_RGMII_2_100_NS		14
++#define YT8521_RC1R_RGMII_2_250_NS		15
+ 
+ #define YTPHY_MISC_CONFIG_REG			0xA006
+ #define YTPHY_MCR_FIBER_SPEED_MASK		BIT(0)
+@@ -222,6 +246,29 @@
+  */
+ #define YTPHY_WCR_TYPE_PULSE			BIT(0)
+ 
++#define YTPHY_SYNCE_CFG_REG			0xA012
++#define YT8521_SCR_SYNCE_ENABLE			BIT(5)
++/* 1b0 output 25m clock
++ * 1b1 output 125m clock  *default*
++ */
++#define YT8521_SCR_CLK_FRE_SEL_125M		BIT(3)
++#define YT8521_SCR_CLK_SRC_MASK			GENMASK(2, 1)
++#define YT8521_SCR_CLK_SRC_PLL_125M		0
++#define YT8521_SCR_CLK_SRC_UTP_RX		1
++#define YT8521_SCR_CLK_SRC_SDS_RX		2
++#define YT8521_SCR_CLK_SRC_REF_25M		3
++#define YT8531_SCR_SYNCE_ENABLE			BIT(6)
++/* 1b0 output 25m clock   *default*
++ * 1b1 output 125m clock
++ */
++#define YT8531_SCR_CLK_FRE_SEL_125M		BIT(4)
++#define YT8531_SCR_CLK_SRC_MASK			GENMASK(3, 1)
++#define YT8531_SCR_CLK_SRC_PLL_125M		0
++#define YT8531_SCR_CLK_SRC_UTP_RX		1
++#define YT8531_SCR_CLK_SRC_SDS_RX		2
++#define YT8531_SCR_CLK_SRC_CLOCK_FROM_DIGITAL	3
++#define YT8531_SCR_CLK_SRC_REF_25M		4
++#define YT8531_SCR_CLK_SRC_SSC_25M		5
+ #define YT8531S_SYNCE_CFG_REG			0xA012
+ #define YT8531S_SCR_SYNCE_ENABLE		BIT(6)
+ 
diff --git a/target/linux/generic/backport-5.15/791-v6.3-07-net-phy-Add-dts-support-for-Motorcomm-yt8521-gigabit.patch b/target/linux/generic/backport-5.15/791-v6.3-07-net-phy-Add-dts-support-for-Motorcomm-yt8521-gigabit.patch
new file mode 100644
index 00000000000000..6d89fae84ccc2f
--- /dev/null
+++ b/target/linux/generic/backport-5.15/791-v6.3-07-net-phy-Add-dts-support-for-Motorcomm-yt8521-gigabit.patch
@@ -0,0 +1,343 @@
+From a6e68f0f8769f79c67cdcfb6302feecd36197dec Mon Sep 17 00:00:00 2001
+From: Frank Sae <Frank.Sae@motor-comm.com>
+Date: Thu, 2 Feb 2023 11:00:35 +0800
+Subject: [PATCH] net: phy: Add dts support for Motorcomm yt8521 gigabit
+ ethernet phy
+
+Add dts support for Motorcomm yt8521 gigabit ethernet phy.
+ Add ytphy_rgmii_clk_delay_config function to support dst config for
+ the delay of rgmii clk. This funciont is common for yt8521, yt8531s
+ and yt8531.
+ This patch has been verified on AM335x platform.
+
+Signed-off-by: Frank Sae <Frank.Sae@motor-comm.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/motorcomm.c | 253 ++++++++++++++++++++++++++++--------
+ 1 file changed, 199 insertions(+), 54 deletions(-)
+
+--- a/drivers/net/phy/motorcomm.c
++++ b/drivers/net/phy/motorcomm.c
+@@ -10,6 +10,7 @@
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/phy.h>
++#include <linux/of.h>
+ 
+ #define PHY_ID_YT8511		0x0000010a
+ #define PHY_ID_YT8521		0x0000011a
+@@ -187,21 +188,9 @@
+  * 1b1 use inverted tx_clk_rgmii.
+  */
+ #define YT8521_RC1R_TX_CLK_SEL_INVERTED		BIT(14)
+-/* TX Gig-E Delay is bits 3:0, default 0x1
+- * TX Fast-E Delay is bits 7:4, default 0xf
+- * RX Delay is bits 13:10, default 0x0
+- * Delay = 150ps * N
+- * On = 2250ps, off = 0ps
+- */
+ #define YT8521_RC1R_RX_DELAY_MASK		GENMASK(13, 10)
+-#define YT8521_RC1R_RX_DELAY_EN			(0xF << 10)
+-#define YT8521_RC1R_RX_DELAY_DIS		(0x0 << 10)
+ #define YT8521_RC1R_FE_TX_DELAY_MASK		GENMASK(7, 4)
+-#define YT8521_RC1R_FE_TX_DELAY_EN		(0xF << 4)
+-#define YT8521_RC1R_FE_TX_DELAY_DIS		(0x0 << 4)
+ #define YT8521_RC1R_GE_TX_DELAY_MASK		GENMASK(3, 0)
+-#define YT8521_RC1R_GE_TX_DELAY_EN		(0xF << 0)
+-#define YT8521_RC1R_GE_TX_DELAY_DIS		(0x0 << 0)
+ #define YT8521_RC1R_RGMII_0_000_NS		0
+ #define YT8521_RC1R_RGMII_0_150_NS		1
+ #define YT8521_RC1R_RGMII_0_300_NS		2
+@@ -274,6 +263,10 @@
+ 
+ /* Extended Register  end */
+ 
++#define YTPHY_DTS_OUTPUT_CLK_DIS		0
++#define YTPHY_DTS_OUTPUT_CLK_25M		25000000
++#define YTPHY_DTS_OUTPUT_CLK_125M		125000000
++
+ struct yt8521_priv {
+ 	/* combo_advertising is used for case of YT8521 in combo mode,
+ 	 * this means that yt8521 may work in utp or fiber mode which depends
+@@ -641,6 +634,142 @@ static int yt8521_write_page(struct phy_
+ };
+ 
+ /**
++ * struct ytphy_cfg_reg_map - map a config value to a register value
++ * @cfg: value in device configuration
++ * @reg: value in the register
++ */
++struct ytphy_cfg_reg_map {
++	u32 cfg;
++	u32 reg;
++};
++
++static const struct ytphy_cfg_reg_map ytphy_rgmii_delays[] = {
++	/* for tx delay / rx delay with YT8521_CCR_RXC_DLY_EN is not set. */
++	{ 0,	YT8521_RC1R_RGMII_0_000_NS },
++	{ 150,	YT8521_RC1R_RGMII_0_150_NS },
++	{ 300,	YT8521_RC1R_RGMII_0_300_NS },
++	{ 450,	YT8521_RC1R_RGMII_0_450_NS },
++	{ 600,	YT8521_RC1R_RGMII_0_600_NS },
++	{ 750,	YT8521_RC1R_RGMII_0_750_NS },
++	{ 900,	YT8521_RC1R_RGMII_0_900_NS },
++	{ 1050,	YT8521_RC1R_RGMII_1_050_NS },
++	{ 1200,	YT8521_RC1R_RGMII_1_200_NS },
++	{ 1350,	YT8521_RC1R_RGMII_1_350_NS },
++	{ 1500,	YT8521_RC1R_RGMII_1_500_NS },
++	{ 1650,	YT8521_RC1R_RGMII_1_650_NS },
++	{ 1800,	YT8521_RC1R_RGMII_1_800_NS },
++	{ 1950,	YT8521_RC1R_RGMII_1_950_NS },	/* default tx/rx delay */
++	{ 2100,	YT8521_RC1R_RGMII_2_100_NS },
++	{ 2250,	YT8521_RC1R_RGMII_2_250_NS },
++
++	/* only for rx delay with YT8521_CCR_RXC_DLY_EN is set. */
++	{ 0    + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_0_000_NS },
++	{ 150  + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_0_150_NS },
++	{ 300  + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_0_300_NS },
++	{ 450  + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_0_450_NS },
++	{ 600  + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_0_600_NS },
++	{ 750  + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_0_750_NS },
++	{ 900  + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_0_900_NS },
++	{ 1050 + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_1_050_NS },
++	{ 1200 + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_1_200_NS },
++	{ 1350 + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_1_350_NS },
++	{ 1500 + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_1_500_NS },
++	{ 1650 + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_1_650_NS },
++	{ 1800 + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_1_800_NS },
++	{ 1950 + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_1_950_NS },
++	{ 2100 + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_2_100_NS },
++	{ 2250 + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_2_250_NS }
++};
++
++static u32 ytphy_get_delay_reg_value(struct phy_device *phydev,
++				     const char *prop_name,
++				     const struct ytphy_cfg_reg_map *tbl,
++				     int tb_size,
++				     u16 *rxc_dly_en,
++				     u32 dflt)
++{
++	struct device_node *node = phydev->mdio.dev.of_node;
++	int tb_size_half = tb_size / 2;
++	u32 val;
++	int i;
++
++	if (of_property_read_u32(node, prop_name, &val))
++		goto err_dts_val;
++
++	/* when rxc_dly_en is NULL, it is get the delay for tx, only half of
++	 * tb_size is valid.
++	 */
++	if (!rxc_dly_en)
++		tb_size = tb_size_half;
++
++	for (i = 0; i < tb_size; i++) {
++		if (tbl[i].cfg == val) {
++			if (rxc_dly_en && i < tb_size_half)
++				*rxc_dly_en = 0;
++			return tbl[i].reg;
++		}
++	}
++
++	phydev_warn(phydev, "Unsupported value %d for %s using default (%u)\n",
++		    val, prop_name, dflt);
++
++err_dts_val:
++	/* when rxc_dly_en is not NULL, it is get the delay for rx.
++	 * The rx default in dts and ytphy_rgmii_clk_delay_config is 1950 ps,
++	 * so YT8521_CCR_RXC_DLY_EN should not be set.
++	 */
++	if (rxc_dly_en)
++		*rxc_dly_en = 0;
++
++	return dflt;
++}
++
++static int ytphy_rgmii_clk_delay_config(struct phy_device *phydev)
++{
++	int tb_size = ARRAY_SIZE(ytphy_rgmii_delays);
++	u16 rxc_dly_en = YT8521_CCR_RXC_DLY_EN;
++	u32 rx_reg, tx_reg;
++	u16 mask, val = 0;
++	int ret;
++
++	rx_reg = ytphy_get_delay_reg_value(phydev, "rx-internal-delay-ps",
++					   ytphy_rgmii_delays, tb_size,
++					   &rxc_dly_en,
++					   YT8521_RC1R_RGMII_1_950_NS);
++	tx_reg = ytphy_get_delay_reg_value(phydev, "tx-internal-delay-ps",
++					   ytphy_rgmii_delays, tb_size, NULL,
++					   YT8521_RC1R_RGMII_1_950_NS);
++
++	switch (phydev->interface) {
++	case PHY_INTERFACE_MODE_RGMII:
++		rxc_dly_en = 0;
++		break;
++	case PHY_INTERFACE_MODE_RGMII_RXID:
++		val |= FIELD_PREP(YT8521_RC1R_RX_DELAY_MASK, rx_reg);
++		break;
++	case PHY_INTERFACE_MODE_RGMII_TXID:
++		rxc_dly_en = 0;
++		val |= FIELD_PREP(YT8521_RC1R_GE_TX_DELAY_MASK, tx_reg);
++		break;
++	case PHY_INTERFACE_MODE_RGMII_ID:
++		val |= FIELD_PREP(YT8521_RC1R_RX_DELAY_MASK, rx_reg) |
++		       FIELD_PREP(YT8521_RC1R_GE_TX_DELAY_MASK, tx_reg);
++		break;
++	default: /* do not support other modes */
++		return -EOPNOTSUPP;
++	}
++
++	ret = ytphy_modify_ext(phydev, YT8521_CHIP_CONFIG_REG,
++			       YT8521_CCR_RXC_DLY_EN, rxc_dly_en);
++	if (ret < 0)
++		return ret;
++
++	/* Generally, it is not necessary to adjust YT8521_RC1R_FE_TX_DELAY */
++	mask = YT8521_RC1R_RX_DELAY_MASK | YT8521_RC1R_GE_TX_DELAY_MASK;
++	return ytphy_modify_ext(phydev, YT8521_RGMII_CONFIG1_REG, mask, val);
++}
++
++/**
+  * yt8521_probe() - read chip config then set suitable polling_mode
+  * @phydev: a pointer to a &struct phy_device
+  *
+@@ -648,9 +777,12 @@ static int yt8521_write_page(struct phy_
+  */
+ static int yt8521_probe(struct phy_device *phydev)
+ {
++	struct device_node *node = phydev->mdio.dev.of_node;
+ 	struct device *dev = &phydev->mdio.dev;
+ 	struct yt8521_priv *priv;
+ 	int chip_config;
++	u16 mask, val;
++	u32 freq;
+ 	int ret;
+ 
+ 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+@@ -695,7 +827,45 @@ static int yt8521_probe(struct phy_devic
+ 			return ret;
+ 	}
+ 
+-	return 0;
++	if (of_property_read_u32(node, "motorcomm,clk-out-frequency-hz", &freq))
++		freq = YTPHY_DTS_OUTPUT_CLK_DIS;
++
++	if (phydev->drv->phy_id == PHY_ID_YT8521) {
++		switch (freq) {
++		case YTPHY_DTS_OUTPUT_CLK_DIS:
++			mask = YT8521_SCR_SYNCE_ENABLE;
++			val = 0;
++			break;
++		case YTPHY_DTS_OUTPUT_CLK_25M:
++			mask = YT8521_SCR_SYNCE_ENABLE |
++			       YT8521_SCR_CLK_SRC_MASK |
++			       YT8521_SCR_CLK_FRE_SEL_125M;
++			val = YT8521_SCR_SYNCE_ENABLE |
++			      FIELD_PREP(YT8521_SCR_CLK_SRC_MASK,
++					 YT8521_SCR_CLK_SRC_REF_25M);
++			break;
++		case YTPHY_DTS_OUTPUT_CLK_125M:
++			mask = YT8521_SCR_SYNCE_ENABLE |
++			       YT8521_SCR_CLK_SRC_MASK |
++			       YT8521_SCR_CLK_FRE_SEL_125M;
++			val = YT8521_SCR_SYNCE_ENABLE |
++			      YT8521_SCR_CLK_FRE_SEL_125M |
++			      FIELD_PREP(YT8521_SCR_CLK_SRC_MASK,
++					 YT8521_SCR_CLK_SRC_PLL_125M);
++			break;
++		default:
++			phydev_warn(phydev, "Freq err:%u\n", freq);
++			return -EINVAL;
++		}
++	} else if (phydev->drv->phy_id == PHY_ID_YT8531S) {
++		return 0;
++	} else {
++		phydev_warn(phydev, "PHY id err\n");
++		return -EINVAL;
++	}
++
++	return ytphy_modify_ext_with_lock(phydev, YTPHY_SYNCE_CFG_REG, mask,
++					  val);
+ }
+ 
+ /**
+@@ -1180,61 +1350,36 @@ static int yt8521_resume(struct phy_devi
+  */
+ static int yt8521_config_init(struct phy_device *phydev)
+ {
++	struct device_node *node = phydev->mdio.dev.of_node;
+ 	int old_page;
+ 	int ret = 0;
+-	u16 val;
+ 
+ 	old_page = phy_select_page(phydev, YT8521_RSSR_UTP_SPACE);
+ 	if (old_page < 0)
+ 		goto err_restore_page;
+ 
+-	switch (phydev->interface) {
+-	case PHY_INTERFACE_MODE_RGMII:
+-		val = YT8521_RC1R_GE_TX_DELAY_DIS | YT8521_RC1R_FE_TX_DELAY_DIS;
+-		val |= YT8521_RC1R_RX_DELAY_DIS;
+-		break;
+-	case PHY_INTERFACE_MODE_RGMII_RXID:
+-		val = YT8521_RC1R_GE_TX_DELAY_DIS | YT8521_RC1R_FE_TX_DELAY_DIS;
+-		val |= YT8521_RC1R_RX_DELAY_EN;
+-		break;
+-	case PHY_INTERFACE_MODE_RGMII_TXID:
+-		val = YT8521_RC1R_GE_TX_DELAY_EN | YT8521_RC1R_FE_TX_DELAY_EN;
+-		val |= YT8521_RC1R_RX_DELAY_DIS;
+-		break;
+-	case PHY_INTERFACE_MODE_RGMII_ID:
+-		val = YT8521_RC1R_GE_TX_DELAY_EN | YT8521_RC1R_FE_TX_DELAY_EN;
+-		val |= YT8521_RC1R_RX_DELAY_EN;
+-		break;
+-	case PHY_INTERFACE_MODE_SGMII:
+-		break;
+-	default: /* do not support other modes */
+-		ret = -EOPNOTSUPP;
+-		goto err_restore_page;
+-	}
+-
+ 	/* set rgmii delay mode */
+ 	if (phydev->interface != PHY_INTERFACE_MODE_SGMII) {
+-		ret = ytphy_modify_ext(phydev, YT8521_RGMII_CONFIG1_REG,
+-				       (YT8521_RC1R_RX_DELAY_MASK |
+-				       YT8521_RC1R_FE_TX_DELAY_MASK |
+-				       YT8521_RC1R_GE_TX_DELAY_MASK),
+-				       val);
++		ret = ytphy_rgmii_clk_delay_config(phydev);
+ 		if (ret < 0)
+ 			goto err_restore_page;
+ 	}
+ 
+-	/* disable auto sleep */
+-	ret = ytphy_modify_ext(phydev, YT8521_EXTREG_SLEEP_CONTROL1_REG,
+-			       YT8521_ESC1R_SLEEP_SW, 0);
+-	if (ret < 0)
+-		goto err_restore_page;
+-
+-	/* enable RXC clock when no wire plug */
+-	ret = ytphy_modify_ext(phydev, YT8521_CLOCK_GATING_REG,
+-			       YT8521_CGR_RX_CLK_EN, 0);
+-	if (ret < 0)
+-		goto err_restore_page;
++	if (of_property_read_bool(node, "motorcomm,auto-sleep-disabled")) {
++		/* disable auto sleep */
++		ret = ytphy_modify_ext(phydev, YT8521_EXTREG_SLEEP_CONTROL1_REG,
++				       YT8521_ESC1R_SLEEP_SW, 0);
++		if (ret < 0)
++			goto err_restore_page;
++	}
+ 
++	if (of_property_read_bool(node, "motorcomm,keep-pll-enabled")) {
++		/* enable RXC clock when no wire plug */
++		ret = ytphy_modify_ext(phydev, YT8521_CLOCK_GATING_REG,
++				       YT8521_CGR_RX_CLK_EN, 0);
++		if (ret < 0)
++			goto err_restore_page;
++	}
+ err_restore_page:
+ 	return phy_restore_page(phydev, old_page, ret);
+ }
diff --git a/target/linux/generic/backport-5.15/791-v6.3-08-net-phy-Add-dts-support-for-Motorcomm-yt8531s-gigabit.patch b/target/linux/generic/backport-5.15/791-v6.3-08-net-phy-Add-dts-support-for-Motorcomm-yt8531s-gigabit.patch
new file mode 100644
index 00000000000000..86fc04695c8ec2
--- /dev/null
+++ b/target/linux/generic/backport-5.15/791-v6.3-08-net-phy-Add-dts-support-for-Motorcomm-yt8531s-gigabit.patch
@@ -0,0 +1,100 @@
+From 36152f87dda4af221b16258751451d9cd3d0fb0b Mon Sep 17 00:00:00 2001
+From: Frank Sae <Frank.Sae@motor-comm.com>
+Date: Thu, 2 Feb 2023 11:00:36 +0800
+Subject: [PATCH] net: phy: Add dts support for Motorcomm yt8531s gigabit
+ ethernet phy
+
+Add dts support for Motorcomm yt8531s gigabit ethernet phy.
+ Change yt8521_probe to support clk config of yt8531s. Becase
+ yt8521_probe does the things which yt8531s is needed, so
+ removed yt8531s function.
+ This patch has been verified on AM335x platform with yt8531s board.
+
+Signed-off-by: Frank Sae <Frank.Sae@motor-comm.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/motorcomm.c | 51 ++++++++++++++++++++-----------------
+ 1 file changed, 27 insertions(+), 24 deletions(-)
+
+--- a/drivers/net/phy/motorcomm.c
++++ b/drivers/net/phy/motorcomm.c
+@@ -258,8 +258,6 @@
+ #define YT8531_SCR_CLK_SRC_CLOCK_FROM_DIGITAL	3
+ #define YT8531_SCR_CLK_SRC_REF_25M		4
+ #define YT8531_SCR_CLK_SRC_SSC_25M		5
+-#define YT8531S_SYNCE_CFG_REG			0xA012
+-#define YT8531S_SCR_SYNCE_ENABLE		BIT(6)
+ 
+ /* Extended Register  end */
+ 
+@@ -858,7 +856,32 @@ static int yt8521_probe(struct phy_devic
+ 			return -EINVAL;
+ 		}
+ 	} else if (phydev->drv->phy_id == PHY_ID_YT8531S) {
+-		return 0;
++		switch (freq) {
++		case YTPHY_DTS_OUTPUT_CLK_DIS:
++			mask = YT8531_SCR_SYNCE_ENABLE;
++			val = 0;
++			break;
++		case YTPHY_DTS_OUTPUT_CLK_25M:
++			mask = YT8531_SCR_SYNCE_ENABLE |
++			       YT8531_SCR_CLK_SRC_MASK |
++			       YT8531_SCR_CLK_FRE_SEL_125M;
++			val = YT8531_SCR_SYNCE_ENABLE |
++			      FIELD_PREP(YT8531_SCR_CLK_SRC_MASK,
++					 YT8531_SCR_CLK_SRC_REF_25M);
++			break;
++		case YTPHY_DTS_OUTPUT_CLK_125M:
++			mask = YT8531_SCR_SYNCE_ENABLE |
++			       YT8531_SCR_CLK_SRC_MASK |
++			       YT8531_SCR_CLK_FRE_SEL_125M;
++			val = YT8531_SCR_SYNCE_ENABLE |
++			      YT8531_SCR_CLK_FRE_SEL_125M |
++			      FIELD_PREP(YT8531_SCR_CLK_SRC_MASK,
++					 YT8531_SCR_CLK_SRC_PLL_125M);
++			break;
++		default:
++			phydev_warn(phydev, "Freq err:%u\n", freq);
++			return -EINVAL;
++		}
+ 	} else {
+ 		phydev_warn(phydev, "PHY id err\n");
+ 		return -EINVAL;
+@@ -869,26 +892,6 @@ static int yt8521_probe(struct phy_devic
+ }
+ 
+ /**
+- * yt8531s_probe() - read chip config then set suitable polling_mode
+- * @phydev: a pointer to a &struct phy_device
+- *
+- * returns 0 or negative errno code
+- */
+-static int yt8531s_probe(struct phy_device *phydev)
+-{
+-	int ret;
+-
+-	/* Disable SyncE clock output by default */
+-	ret = ytphy_modify_ext_with_lock(phydev, YT8531S_SYNCE_CFG_REG,
+-					 YT8531S_SCR_SYNCE_ENABLE, 0);
+-	if (ret < 0)
+-		return ret;
+-
+-	/* same as yt8521_probe */
+-	return yt8521_probe(phydev);
+-}
+-
+-/**
+  * ytphy_utp_read_lpa() - read LPA then setup lp_advertising for utp
+  * @phydev: a pointer to a &struct phy_device
+  *
+@@ -1970,7 +1973,7 @@ static struct phy_driver motorcomm_phy_d
+ 		PHY_ID_MATCH_EXACT(PHY_ID_YT8531S),
+ 		.name		= "YT8531S Gigabit Ethernet",
+ 		.get_features	= yt8521_get_features,
+-		.probe		= yt8531s_probe,
++		.probe		= yt8521_probe,
+ 		.read_page	= yt8521_read_page,
+ 		.write_page	= yt8521_write_page,
+ 		.get_wol	= ytphy_get_wol,
diff --git a/target/linux/generic/backport-5.15/791-v6.3-09-net-phy-Add-driver-for-Motorcomm-yt8531-gigabit-ethernet.patch b/target/linux/generic/backport-5.15/791-v6.3-09-net-phy-Add-driver-for-Motorcomm-yt8531-gigabit-ethernet.patch
new file mode 100644
index 00000000000000..9dce5a8add95f4
--- /dev/null
+++ b/target/linux/generic/backport-5.15/791-v6.3-09-net-phy-Add-driver-for-Motorcomm-yt8531-gigabit-ethernet.patch
@@ -0,0 +1,302 @@
+From 4ac94f728a588e7096dd5010cd7141a309ea7805 Mon Sep 17 00:00:00 2001
+From: Frank Sae <Frank.Sae@motor-comm.com>
+Date: Thu, 2 Feb 2023 11:00:37 +0800
+Subject: [PATCH] net: phy: Add driver for Motorcomm yt8531 gigabit ethernet
+ phy
+
+Add a driver for the motorcomm yt8531 gigabit ethernet phy. We have
+ verified the driver on AM335x platform with yt8531 board. On the
+ board, yt8531 gigabit ethernet phy works in utp mode, RGMII
+ interface, supports 1000M/100M/10M speeds, and wol(magic package).
+
+Signed-off-by: Frank Sae <Frank.Sae@motor-comm.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/Kconfig     |   2 +-
+ drivers/net/phy/motorcomm.c | 208 +++++++++++++++++++++++++++++++++++-
+ 2 files changed, 207 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -245,7 +245,7 @@ config MOTORCOMM_PHY
+ 	tristate "Motorcomm PHYs"
+ 	help
+ 	  Enables support for Motorcomm network PHYs.
+-	  Currently supports the YT8511, YT8521, YT8531S Gigabit Ethernet PHYs.
++	  Currently supports YT85xx Gigabit Ethernet PHYs.
+ 
+ config NATIONAL_PHY
+ 	tristate "National Semiconductor PHYs"
+--- a/drivers/net/phy/motorcomm.c
++++ b/drivers/net/phy/motorcomm.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0+
+ /*
+- * Motorcomm 8511/8521/8531S PHY driver.
++ * Motorcomm 8511/8521/8531/8531S PHY driver.
+  *
+  * Author: Peter Geis <pgwipeout@gmail.com>
+  * Author: Frank <Frank.Sae@motor-comm.com>
+@@ -14,6 +14,7 @@
+ 
+ #define PHY_ID_YT8511		0x0000010a
+ #define PHY_ID_YT8521		0x0000011a
++#define PHY_ID_YT8531		0x4f51e91b
+ #define PHY_ID_YT8531S		0x4f51e91a
+ 
+ /* YT8521/YT8531S Register Overview
+@@ -517,6 +518,61 @@ err_restore_page:
+ 	return phy_restore_page(phydev, old_page, ret);
+ }
+ 
++static int yt8531_set_wol(struct phy_device *phydev,
++			  struct ethtool_wolinfo *wol)
++{
++	const u16 mac_addr_reg[] = {
++		YTPHY_WOL_MACADDR2_REG,
++		YTPHY_WOL_MACADDR1_REG,
++		YTPHY_WOL_MACADDR0_REG,
++	};
++	const u8 *mac_addr;
++	u16 mask, val;
++	int ret;
++	u8 i;
++
++	if (wol->wolopts & WAKE_MAGIC) {
++		mac_addr = phydev->attached_dev->dev_addr;
++
++		/* Store the device address for the magic packet */
++		for (i = 0; i < 3; i++) {
++			ret = ytphy_write_ext_with_lock(phydev, mac_addr_reg[i],
++							((mac_addr[i * 2] << 8)) |
++							(mac_addr[i * 2 + 1]));
++			if (ret < 0)
++				return ret;
++		}
++
++		/* Enable WOL feature */
++		mask = YTPHY_WCR_PULSE_WIDTH_MASK | YTPHY_WCR_INTR_SEL;
++		val = YTPHY_WCR_ENABLE | YTPHY_WCR_INTR_SEL;
++		val |= YTPHY_WCR_TYPE_PULSE | YTPHY_WCR_PULSE_WIDTH_672MS;
++		ret = ytphy_modify_ext_with_lock(phydev, YTPHY_WOL_CONFIG_REG,
++						 mask, val);
++		if (ret < 0)
++			return ret;
++
++		/* Enable WOL interrupt */
++		ret = phy_modify(phydev, YTPHY_INTERRUPT_ENABLE_REG, 0,
++				 YTPHY_IER_WOL);
++		if (ret < 0)
++			return ret;
++	} else {
++		/* Disable WOL feature */
++		mask = YTPHY_WCR_ENABLE | YTPHY_WCR_INTR_SEL;
++		ret = ytphy_modify_ext_with_lock(phydev, YTPHY_WOL_CONFIG_REG,
++						 mask, 0);
++
++		/* Disable WOL interrupt */
++		ret = phy_modify(phydev, YTPHY_INTERRUPT_ENABLE_REG,
++				 YTPHY_IER_WOL, 0);
++		if (ret < 0)
++			return ret;
++	}
++
++	return 0;
++}
++
+ static int yt8511_read_page(struct phy_device *phydev)
+ {
+ 	return __phy_read(phydev, YT8511_PAGE_SELECT);
+@@ -767,6 +823,17 @@ static int ytphy_rgmii_clk_delay_config(
+ 	return ytphy_modify_ext(phydev, YT8521_RGMII_CONFIG1_REG, mask, val);
+ }
+ 
++static int ytphy_rgmii_clk_delay_config_with_lock(struct phy_device *phydev)
++{
++	int ret;
++
++	phy_lock_mdio_bus(phydev);
++	ret = ytphy_rgmii_clk_delay_config(phydev);
++	phy_unlock_mdio_bus(phydev);
++
++	return ret;
++}
++
+ /**
+  * yt8521_probe() - read chip config then set suitable polling_mode
+  * @phydev: a pointer to a &struct phy_device
+@@ -891,6 +958,43 @@ static int yt8521_probe(struct phy_devic
+ 					  val);
+ }
+ 
++static int yt8531_probe(struct phy_device *phydev)
++{
++	struct device_node *node = phydev->mdio.dev.of_node;
++	u16 mask, val;
++	u32 freq;
++
++	if (of_property_read_u32(node, "motorcomm,clk-out-frequency-hz", &freq))
++		freq = YTPHY_DTS_OUTPUT_CLK_DIS;
++
++	switch (freq) {
++	case YTPHY_DTS_OUTPUT_CLK_DIS:
++		mask = YT8531_SCR_SYNCE_ENABLE;
++		val = 0;
++		break;
++	case YTPHY_DTS_OUTPUT_CLK_25M:
++		mask = YT8531_SCR_SYNCE_ENABLE | YT8531_SCR_CLK_SRC_MASK |
++		       YT8531_SCR_CLK_FRE_SEL_125M;
++		val = YT8531_SCR_SYNCE_ENABLE |
++		      FIELD_PREP(YT8531_SCR_CLK_SRC_MASK,
++				 YT8531_SCR_CLK_SRC_REF_25M);
++		break;
++	case YTPHY_DTS_OUTPUT_CLK_125M:
++		mask = YT8531_SCR_SYNCE_ENABLE | YT8531_SCR_CLK_SRC_MASK |
++		       YT8531_SCR_CLK_FRE_SEL_125M;
++		val = YT8531_SCR_SYNCE_ENABLE | YT8531_SCR_CLK_FRE_SEL_125M |
++		      FIELD_PREP(YT8531_SCR_CLK_SRC_MASK,
++				 YT8531_SCR_CLK_SRC_PLL_125M);
++		break;
++	default:
++		phydev_warn(phydev, "Freq err:%u\n", freq);
++		return -EINVAL;
++	}
++
++	return ytphy_modify_ext_with_lock(phydev, YTPHY_SYNCE_CFG_REG, mask,
++					  val);
++}
++
+ /**
+  * ytphy_utp_read_lpa() - read LPA then setup lp_advertising for utp
+  * @phydev: a pointer to a &struct phy_device
+@@ -1387,6 +1491,94 @@ err_restore_page:
+ 	return phy_restore_page(phydev, old_page, ret);
+ }
+ 
++static int yt8531_config_init(struct phy_device *phydev)
++{
++	struct device_node *node = phydev->mdio.dev.of_node;
++	int ret;
++
++	ret = ytphy_rgmii_clk_delay_config_with_lock(phydev);
++	if (ret < 0)
++		return ret;
++
++	if (of_property_read_bool(node, "motorcomm,auto-sleep-disabled")) {
++		/* disable auto sleep */
++		ret = ytphy_modify_ext_with_lock(phydev,
++						 YT8521_EXTREG_SLEEP_CONTROL1_REG,
++						 YT8521_ESC1R_SLEEP_SW, 0);
++		if (ret < 0)
++			return ret;
++	}
++
++	if (of_property_read_bool(node, "motorcomm,keep-pll-enabled")) {
++		/* enable RXC clock when no wire plug */
++		ret = ytphy_modify_ext_with_lock(phydev,
++						 YT8521_CLOCK_GATING_REG,
++						 YT8521_CGR_RX_CLK_EN, 0);
++		if (ret < 0)
++			return ret;
++	}
++
++	return 0;
++}
++
++/**
++ * yt8531_link_change_notify() - Adjust the tx clock direction according to
++ * the current speed and dts config.
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * NOTE: This function is only used to adapt to VF2 with JH7110 SoC. Please
++ * keep "motorcomm,tx-clk-adj-enabled" not exist in dts when the soc is not
++ * JH7110.
++ */
++static void yt8531_link_change_notify(struct phy_device *phydev)
++{
++	struct device_node *node = phydev->mdio.dev.of_node;
++	bool tx_clk_adj_enabled = false;
++	bool tx_clk_1000_inverted;
++	bool tx_clk_100_inverted;
++	bool tx_clk_10_inverted;
++	u16 val = 0;
++	int ret;
++
++	if (of_property_read_bool(node, "motorcomm,tx-clk-adj-enabled"))
++		tx_clk_adj_enabled = true;
++
++	if (!tx_clk_adj_enabled)
++		return;
++
++	if (of_property_read_bool(node, "motorcomm,tx-clk-10-inverted"))
++		tx_clk_10_inverted = true;
++	if (of_property_read_bool(node, "motorcomm,tx-clk-100-inverted"))
++		tx_clk_100_inverted = true;
++	if (of_property_read_bool(node, "motorcomm,tx-clk-1000-inverted"))
++		tx_clk_1000_inverted = true;
++
++	if (phydev->speed < 0)
++		return;
++
++	switch (phydev->speed) {
++	case SPEED_1000:
++		if (tx_clk_1000_inverted)
++			val = YT8521_RC1R_TX_CLK_SEL_INVERTED;
++		break;
++	case SPEED_100:
++		if (tx_clk_100_inverted)
++			val = YT8521_RC1R_TX_CLK_SEL_INVERTED;
++		break;
++	case SPEED_10:
++		if (tx_clk_10_inverted)
++			val = YT8521_RC1R_TX_CLK_SEL_INVERTED;
++		break;
++	default:
++		return;
++	}
++
++	ret = ytphy_modify_ext_with_lock(phydev, YT8521_RGMII_CONFIG1_REG,
++					 YT8521_RC1R_TX_CLK_SEL_INVERTED, val);
++	if (ret < 0)
++		phydev_warn(phydev, "Modify TX_CLK_SEL err:%d\n", ret);
++}
++
+ /**
+  * yt8521_prepare_fiber_features() -  A small helper function that setup
+  * fiber's features.
+@@ -1970,6 +2162,17 @@ static struct phy_driver motorcomm_phy_d
+ 		.resume		= yt8521_resume,
+ 	},
+ 	{
++		PHY_ID_MATCH_EXACT(PHY_ID_YT8531),
++		.name		= "YT8531 Gigabit Ethernet",
++		.probe		= yt8531_probe,
++		.config_init	= yt8531_config_init,
++		.suspend	= genphy_suspend,
++		.resume		= genphy_resume,
++		.get_wol	= ytphy_get_wol,
++		.set_wol	= yt8531_set_wol,
++		.link_change_notify = yt8531_link_change_notify,
++	},
++	{
+ 		PHY_ID_MATCH_EXACT(PHY_ID_YT8531S),
+ 		.name		= "YT8531S Gigabit Ethernet",
+ 		.get_features	= yt8521_get_features,
+@@ -1990,7 +2193,7 @@ static struct phy_driver motorcomm_phy_d
+ 
+ module_phy_driver(motorcomm_phy_drvs);
+ 
+-MODULE_DESCRIPTION("Motorcomm 8511/8521/8531S PHY driver");
++MODULE_DESCRIPTION("Motorcomm 8511/8521/8531/8531S PHY driver");
+ MODULE_AUTHOR("Peter Geis");
+ MODULE_AUTHOR("Frank");
+ MODULE_LICENSE("GPL");
+@@ -1998,6 +2201,7 @@ MODULE_LICENSE("GPL");
+ static const struct mdio_device_id __maybe_unused motorcomm_tbl[] = {
+ 	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8511) },
+ 	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8521) },
++	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8531) },
+ 	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8531S) },
+ 	{ /* sentinel */ }
+ };
diff --git a/target/linux/generic/backport-5.15/791-v6.3-10-net-phy-motorcomm-uninitialized-variables-in.patch b/target/linux/generic/backport-5.15/791-v6.3-10-net-phy-motorcomm-uninitialized-variables-in.patch
new file mode 100644
index 00000000000000..29ae86dbbc2c0c
--- /dev/null
+++ b/target/linux/generic/backport-5.15/791-v6.3-10-net-phy-motorcomm-uninitialized-variables-in.patch
@@ -0,0 +1,34 @@
+From 9753613f7399601f9bae6ee81e9d4274246c98ab Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <error27@gmail.com>
+Date: Wed, 15 Feb 2023 07:21:47 +0300
+Subject: [PATCH] net: phy: motorcomm: uninitialized variables in
+ yt8531_link_change_notify()
+
+These booleans are never set to false, but are just used without being
+initialized.
+
+Fixes: 4ac94f728a58 ("net: phy: Add driver for Motorcomm yt8531 gigabit ethernet phy")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Reviewed-by: Frank Sae <Frank.Sae@motor-comm.com>
+Link: https://lore.kernel.org/r/Y+xd2yJet2ImHLoQ@kili
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/motorcomm.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/phy/motorcomm.c
++++ b/drivers/net/phy/motorcomm.c
+@@ -1533,10 +1533,10 @@ static int yt8531_config_init(struct phy
+ static void yt8531_link_change_notify(struct phy_device *phydev)
+ {
+ 	struct device_node *node = phydev->mdio.dev.of_node;
++	bool tx_clk_1000_inverted = false;
++	bool tx_clk_100_inverted = false;
++	bool tx_clk_10_inverted = false;
+ 	bool tx_clk_adj_enabled = false;
+-	bool tx_clk_1000_inverted;
+-	bool tx_clk_100_inverted;
+-	bool tx_clk_10_inverted;
+ 	u16 val = 0;
+ 	int ret;
+ 
diff --git a/target/linux/generic/backport-5.15/797-v5.17-net-usb-ax88179_178a-add-TSO-feature.patch b/target/linux/generic/backport-5.15/797-v5.17-net-usb-ax88179_178a-add-TSO-feature.patch
new file mode 100644
index 00000000000000..a2168aaba5f645
--- /dev/null
+++ b/target/linux/generic/backport-5.15/797-v5.17-net-usb-ax88179_178a-add-TSO-feature.patch
@@ -0,0 +1,68 @@
+From 16b1c4e01c89ba07367461e0bc4cb84993c2d027 Mon Sep 17 00:00:00 2001
+From: Jacky Chou <jackychou@asix.com.tw>
+Date: Mon, 15 Nov 2021 11:49:41 +0800
+Subject: [PATCH] net: usb: ax88179_178a: add TSO feature
+
+On low-effciency embedded platforms, transmission performance is poor
+due to on Bulk-out with single packet.
+Adding TSO feature improves the transmission performance and reduces
+the number of interrupt caused by Bulk-out complete.
+
+Reference to module, net: usb: aqc111.
+
+Signed-off-by: Jacky Chou <jackychou@asix.com.tw>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/usb/ax88179_178a.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -1377,11 +1377,12 @@ static int ax88179_bind(struct usbnet *d
+ 	dev->mii.phy_id = 0x03;
+ 	dev->mii.supports_gmii = 1;
+ 
+-	dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+-			      NETIF_F_RXCSUM;
++	dev->net->features |= NETIF_F_SG | NETIF_F_IP_CSUM |
++			      NETIF_F_IPV6_CSUM | NETIF_F_RXCSUM | NETIF_F_TSO;
+ 
+-	dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+-				 NETIF_F_RXCSUM;
++	dev->net->hw_features |= dev->net->features;
++
++	netif_set_gso_max_size(dev->net, 16384);
+ 
+ 	/* Enable checksum offload */
+ 	*tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
+@@ -1587,17 +1588,19 @@ ax88179_tx_fixup(struct usbnet *dev, str
+ {
+ 	u32 tx_hdr1, tx_hdr2;
+ 	int frame_size = dev->maxpacket;
+-	int mss = skb_shinfo(skb)->gso_size;
+ 	int headroom;
+ 	void *ptr;
+ 
+ 	tx_hdr1 = skb->len;
+-	tx_hdr2 = mss;
++	tx_hdr2 = skb_shinfo(skb)->gso_size; /* Set TSO mss */
+ 	if (((skb->len + 8) % frame_size) == 0)
+ 		tx_hdr2 |= 0x80008000;	/* Enable padding */
+ 
+ 	headroom = skb_headroom(skb) - 8;
+ 
++	if ((dev->net->features & NETIF_F_SG) && skb_linearize(skb))
++		return NULL;
++
+ 	if ((skb_header_cloned(skb) || headroom < 0) &&
+ 	    pskb_expand_head(skb, headroom < 0 ? 8 : 0, 0, GFP_ATOMIC)) {
+ 		dev_kfree_skb_any(skb);
+@@ -1608,6 +1611,8 @@ ax88179_tx_fixup(struct usbnet *dev, str
+ 	put_unaligned_le32(tx_hdr1, ptr);
+ 	put_unaligned_le32(tx_hdr2, ptr + 4);
+ 
++	usbnet_set_skb_tx_stats(skb, (skb_shinfo(skb)->gso_segs ?: 1), 0);
++
+ 	return skb;
+ }
+ 
diff --git a/target/linux/generic/backport-5.15/802-v5.16-0001-nvmem-core-rework-nvmem-cell-instance-creation.patch b/target/linux/generic/backport-5.15/802-v5.16-0001-nvmem-core-rework-nvmem-cell-instance-creation.patch
new file mode 100644
index 00000000000000..ebab8c7c736dd0
--- /dev/null
+++ b/target/linux/generic/backport-5.15/802-v5.16-0001-nvmem-core-rework-nvmem-cell-instance-creation.patch
@@ -0,0 +1,456 @@
+From 7ae6478b304bc004c3139b422665b0e23b57f05c Mon Sep 17 00:00:00 2001
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Date: Wed, 13 Oct 2021 14:19:55 +0100
+Subject: [PATCH] nvmem: core: rework nvmem cell instance creation
+
+In the existing design, we do not create a instance per nvmem cell consumer
+but we directly refer cell from nvmem cell list that are added to provider.
+
+However this design has some limitations when consumers want to assign name
+or connection id the nvmem cell instance, ex: via "nvmem-cell-names" or
+id in nvmem_cell_get(id).
+
+Having a name associated with nvmem cell consumer instance will help
+provider drivers in performing post processing of nvmem cell data if required
+before data is seen by the consumers. This is pretty normal with some vendors
+storing nvmem cells like mac-address in a vendor specific data layouts that
+are not directly usable by the consumer drivers.
+
+With this patch nvmem cell will be created dynamically during nvmem_cell_get
+and destroyed in nvmem_cell_put, allowing consumers to associate name with
+nvmem cell consumer instance.
+
+With this patch a new struct nvmem_cell_entry replaces struct nvmem_cell
+for storing nvmem cell information within the core.
+This patch does not change nvmem-consumer interface based on nvmem_cell.
+
+Tested-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20211013131957.30271-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c | 165 +++++++++++++++++++++++++++----------------
+ 1 file changed, 105 insertions(+), 60 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -45,8 +45,7 @@ struct nvmem_device {
+ #define to_nvmem_device(d) container_of(d, struct nvmem_device, dev)
+ 
+ #define FLAG_COMPAT		BIT(0)
+-
+-struct nvmem_cell {
++struct nvmem_cell_entry {
+ 	const char		*name;
+ 	int			offset;
+ 	int			bytes;
+@@ -57,6 +56,11 @@ struct nvmem_cell {
+ 	struct list_head	node;
+ };
+ 
++struct nvmem_cell {
++	struct nvmem_cell_entry *entry;
++	const char		*id;
++};
++
+ static DEFINE_MUTEX(nvmem_mutex);
+ static DEFINE_IDA(nvmem_ida);
+ 
+@@ -424,7 +428,7 @@ static struct bus_type nvmem_bus_type =
+ 	.name		= "nvmem",
+ };
+ 
+-static void nvmem_cell_drop(struct nvmem_cell *cell)
++static void nvmem_cell_entry_drop(struct nvmem_cell_entry *cell)
+ {
+ 	blocking_notifier_call_chain(&nvmem_notifier, NVMEM_CELL_REMOVE, cell);
+ 	mutex_lock(&nvmem_mutex);
+@@ -437,13 +441,13 @@ static void nvmem_cell_drop(struct nvmem
+ 
+ static void nvmem_device_remove_all_cells(const struct nvmem_device *nvmem)
+ {
+-	struct nvmem_cell *cell, *p;
++	struct nvmem_cell_entry *cell, *p;
+ 
+ 	list_for_each_entry_safe(cell, p, &nvmem->cells, node)
+-		nvmem_cell_drop(cell);
++		nvmem_cell_entry_drop(cell);
+ }
+ 
+-static void nvmem_cell_add(struct nvmem_cell *cell)
++static void nvmem_cell_entry_add(struct nvmem_cell_entry *cell)
+ {
+ 	mutex_lock(&nvmem_mutex);
+ 	list_add_tail(&cell->node, &cell->nvmem->cells);
+@@ -451,9 +455,9 @@ static void nvmem_cell_add(struct nvmem_
+ 	blocking_notifier_call_chain(&nvmem_notifier, NVMEM_CELL_ADD, cell);
+ }
+ 
+-static int nvmem_cell_info_to_nvmem_cell_nodup(struct nvmem_device *nvmem,
+-					const struct nvmem_cell_info *info,
+-					struct nvmem_cell *cell)
++static int nvmem_cell_info_to_nvmem_cell_entry_nodup(struct nvmem_device *nvmem,
++						     const struct nvmem_cell_info *info,
++						     struct nvmem_cell_entry *cell)
+ {
+ 	cell->nvmem = nvmem;
+ 	cell->offset = info->offset;
+@@ -477,13 +481,13 @@ static int nvmem_cell_info_to_nvmem_cell
+ 	return 0;
+ }
+ 
+-static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
+-				const struct nvmem_cell_info *info,
+-				struct nvmem_cell *cell)
++static int nvmem_cell_info_to_nvmem_cell_entry(struct nvmem_device *nvmem,
++					       const struct nvmem_cell_info *info,
++					       struct nvmem_cell_entry *cell)
+ {
+ 	int err;
+ 
+-	err = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, cell);
++	err = nvmem_cell_info_to_nvmem_cell_entry_nodup(nvmem, info, cell);
+ 	if (err)
+ 		return err;
+ 
+@@ -507,7 +511,7 @@ static int nvmem_add_cells(struct nvmem_
+ 		    const struct nvmem_cell_info *info,
+ 		    int ncells)
+ {
+-	struct nvmem_cell **cells;
++	struct nvmem_cell_entry **cells;
+ 	int i, rval;
+ 
+ 	cells = kcalloc(ncells, sizeof(*cells), GFP_KERNEL);
+@@ -521,13 +525,13 @@ static int nvmem_add_cells(struct nvmem_
+ 			goto err;
+ 		}
+ 
+-		rval = nvmem_cell_info_to_nvmem_cell(nvmem, &info[i], cells[i]);
++		rval = nvmem_cell_info_to_nvmem_cell_entry(nvmem, &info[i], cells[i]);
+ 		if (rval) {
+ 			kfree(cells[i]);
+ 			goto err;
+ 		}
+ 
+-		nvmem_cell_add(cells[i]);
++		nvmem_cell_entry_add(cells[i]);
+ 	}
+ 
+ 	/* remove tmp array */
+@@ -536,7 +540,7 @@ static int nvmem_add_cells(struct nvmem_
+ 	return 0;
+ err:
+ 	while (i--)
+-		nvmem_cell_drop(cells[i]);
++		nvmem_cell_entry_drop(cells[i]);
+ 
+ 	kfree(cells);
+ 
+@@ -573,7 +577,7 @@ static int nvmem_add_cells_from_table(st
+ {
+ 	const struct nvmem_cell_info *info;
+ 	struct nvmem_cell_table *table;
+-	struct nvmem_cell *cell;
++	struct nvmem_cell_entry *cell;
+ 	int rval = 0, i;
+ 
+ 	mutex_lock(&nvmem_cell_mutex);
+@@ -588,15 +592,13 @@ static int nvmem_add_cells_from_table(st
+ 					goto out;
+ 				}
+ 
+-				rval = nvmem_cell_info_to_nvmem_cell(nvmem,
+-								     info,
+-								     cell);
++				rval = nvmem_cell_info_to_nvmem_cell_entry(nvmem, info, cell);
+ 				if (rval) {
+ 					kfree(cell);
+ 					goto out;
+ 				}
+ 
+-				nvmem_cell_add(cell);
++				nvmem_cell_entry_add(cell);
+ 			}
+ 		}
+ 	}
+@@ -606,10 +608,10 @@ out:
+ 	return rval;
+ }
+ 
+-static struct nvmem_cell *
+-nvmem_find_cell_by_name(struct nvmem_device *nvmem, const char *cell_id)
++static struct nvmem_cell_entry *
++nvmem_find_cell_entry_by_name(struct nvmem_device *nvmem, const char *cell_id)
+ {
+-	struct nvmem_cell *iter, *cell = NULL;
++	struct nvmem_cell_entry *iter, *cell = NULL;
+ 
+ 	mutex_lock(&nvmem_mutex);
+ 	list_for_each_entry(iter, &nvmem->cells, node) {
+@@ -680,7 +682,7 @@ static int nvmem_add_cells_from_of(struc
+ {
+ 	struct device_node *parent, *child;
+ 	struct device *dev = &nvmem->dev;
+-	struct nvmem_cell *cell;
++	struct nvmem_cell_entry *cell;
+ 	const __be32 *addr;
+ 	int len;
+ 
+@@ -729,7 +731,7 @@ static int nvmem_add_cells_from_of(struc
+ 		}
+ 
+ 		cell->np = of_node_get(child);
+-		nvmem_cell_add(cell);
++		nvmem_cell_entry_add(cell);
+ 	}
+ 
+ 	return 0;
+@@ -1142,9 +1144,33 @@ struct nvmem_device *devm_nvmem_device_g
+ }
+ EXPORT_SYMBOL_GPL(devm_nvmem_device_get);
+ 
++static struct nvmem_cell *nvmem_create_cell(struct nvmem_cell_entry *entry, const char *id)
++{
++	struct nvmem_cell *cell;
++	const char *name = NULL;
++
++	cell = kzalloc(sizeof(*cell), GFP_KERNEL);
++	if (!cell)
++		return ERR_PTR(-ENOMEM);
++
++	if (id) {
++		name = kstrdup_const(id, GFP_KERNEL);
++		if (!name) {
++			kfree(cell);
++			return ERR_PTR(-ENOMEM);
++		}
++	}
++
++	cell->id = name;
++	cell->entry = entry;
++
++	return cell;
++}
++
+ static struct nvmem_cell *
+ nvmem_cell_get_from_lookup(struct device *dev, const char *con_id)
+ {
++	struct nvmem_cell_entry *cell_entry;
+ 	struct nvmem_cell *cell = ERR_PTR(-ENOENT);
+ 	struct nvmem_cell_lookup *lookup;
+ 	struct nvmem_device *nvmem;
+@@ -1169,11 +1195,15 @@ nvmem_cell_get_from_lookup(struct device
+ 				break;
+ 			}
+ 
+-			cell = nvmem_find_cell_by_name(nvmem,
+-						       lookup->cell_name);
+-			if (!cell) {
++			cell_entry = nvmem_find_cell_entry_by_name(nvmem,
++								   lookup->cell_name);
++			if (!cell_entry) {
+ 				__nvmem_device_put(nvmem);
+ 				cell = ERR_PTR(-ENOENT);
++			} else {
++				cell = nvmem_create_cell(cell_entry, con_id);
++				if (IS_ERR(cell))
++					__nvmem_device_put(nvmem);
+ 			}
+ 			break;
+ 		}
+@@ -1184,10 +1214,10 @@ nvmem_cell_get_from_lookup(struct device
+ }
+ 
+ #if IS_ENABLED(CONFIG_OF)
+-static struct nvmem_cell *
+-nvmem_find_cell_by_node(struct nvmem_device *nvmem, struct device_node *np)
++static struct nvmem_cell_entry *
++nvmem_find_cell_entry_by_node(struct nvmem_device *nvmem, struct device_node *np)
+ {
+-	struct nvmem_cell *iter, *cell = NULL;
++	struct nvmem_cell_entry *iter, *cell = NULL;
+ 
+ 	mutex_lock(&nvmem_mutex);
+ 	list_for_each_entry(iter, &nvmem->cells, node) {
+@@ -1217,6 +1247,7 @@ struct nvmem_cell *of_nvmem_cell_get(str
+ {
+ 	struct device_node *cell_np, *nvmem_np;
+ 	struct nvmem_device *nvmem;
++	struct nvmem_cell_entry *cell_entry;
+ 	struct nvmem_cell *cell;
+ 	int index = 0;
+ 
+@@ -1237,12 +1268,16 @@ struct nvmem_cell *of_nvmem_cell_get(str
+ 	if (IS_ERR(nvmem))
+ 		return ERR_CAST(nvmem);
+ 
+-	cell = nvmem_find_cell_by_node(nvmem, cell_np);
+-	if (!cell) {
++	cell_entry = nvmem_find_cell_entry_by_node(nvmem, cell_np);
++	if (!cell_entry) {
+ 		__nvmem_device_put(nvmem);
+ 		return ERR_PTR(-ENOENT);
+ 	}
+ 
++	cell = nvmem_create_cell(cell_entry, id);
++	if (IS_ERR(cell))
++		__nvmem_device_put(nvmem);
++
+ 	return cell;
+ }
+ EXPORT_SYMBOL_GPL(of_nvmem_cell_get);
+@@ -1348,13 +1383,17 @@ EXPORT_SYMBOL(devm_nvmem_cell_put);
+  */
+ void nvmem_cell_put(struct nvmem_cell *cell)
+ {
+-	struct nvmem_device *nvmem = cell->nvmem;
++	struct nvmem_device *nvmem = cell->entry->nvmem;
++
++	if (cell->id)
++		kfree_const(cell->id);
+ 
++	kfree(cell);
+ 	__nvmem_device_put(nvmem);
+ }
+ EXPORT_SYMBOL_GPL(nvmem_cell_put);
+ 
+-static void nvmem_shift_read_buffer_in_place(struct nvmem_cell *cell, void *buf)
++static void nvmem_shift_read_buffer_in_place(struct nvmem_cell_entry *cell, void *buf)
+ {
+ 	u8 *p, *b;
+ 	int i, extra, bit_offset = cell->bit_offset;
+@@ -1388,8 +1427,8 @@ static void nvmem_shift_read_buffer_in_p
+ }
+ 
+ static int __nvmem_cell_read(struct nvmem_device *nvmem,
+-		      struct nvmem_cell *cell,
+-		      void *buf, size_t *len)
++		      struct nvmem_cell_entry *cell,
++		      void *buf, size_t *len, const char *id)
+ {
+ 	int rc;
+ 
+@@ -1420,18 +1459,18 @@ static int __nvmem_cell_read(struct nvme
+  */
+ void *nvmem_cell_read(struct nvmem_cell *cell, size_t *len)
+ {
+-	struct nvmem_device *nvmem = cell->nvmem;
++	struct nvmem_device *nvmem = cell->entry->nvmem;
+ 	u8 *buf;
+ 	int rc;
+ 
+ 	if (!nvmem)
+ 		return ERR_PTR(-EINVAL);
+ 
+-	buf = kzalloc(cell->bytes, GFP_KERNEL);
++	buf = kzalloc(cell->entry->bytes, GFP_KERNEL);
+ 	if (!buf)
+ 		return ERR_PTR(-ENOMEM);
+ 
+-	rc = __nvmem_cell_read(nvmem, cell, buf, len);
++	rc = __nvmem_cell_read(nvmem, cell->entry, buf, len, cell->id);
+ 	if (rc) {
+ 		kfree(buf);
+ 		return ERR_PTR(rc);
+@@ -1441,7 +1480,7 @@ void *nvmem_cell_read(struct nvmem_cell
+ }
+ EXPORT_SYMBOL_GPL(nvmem_cell_read);
+ 
+-static void *nvmem_cell_prepare_write_buffer(struct nvmem_cell *cell,
++static void *nvmem_cell_prepare_write_buffer(struct nvmem_cell_entry *cell,
+ 					     u8 *_buf, int len)
+ {
+ 	struct nvmem_device *nvmem = cell->nvmem;
+@@ -1494,16 +1533,7 @@ err:
+ 	return ERR_PTR(rc);
+ }
+ 
+-/**
+- * nvmem_cell_write() - Write to a given nvmem cell
+- *
+- * @cell: nvmem cell to be written.
+- * @buf: Buffer to be written.
+- * @len: length of buffer to be written to nvmem cell.
+- *
+- * Return: length of bytes written or negative on failure.
+- */
+-int nvmem_cell_write(struct nvmem_cell *cell, void *buf, size_t len)
++static int __nvmem_cell_entry_write(struct nvmem_cell_entry *cell, void *buf, size_t len)
+ {
+ 	struct nvmem_device *nvmem = cell->nvmem;
+ 	int rc;
+@@ -1529,6 +1559,21 @@ int nvmem_cell_write(struct nvmem_cell *
+ 
+ 	return len;
+ }
++
++/**
++ * nvmem_cell_write() - Write to a given nvmem cell
++ *
++ * @cell: nvmem cell to be written.
++ * @buf: Buffer to be written.
++ * @len: length of buffer to be written to nvmem cell.
++ *
++ * Return: length of bytes written or negative on failure.
++ */
++int nvmem_cell_write(struct nvmem_cell *cell, void *buf, size_t len)
++{
++	return __nvmem_cell_entry_write(cell->entry, buf, len);
++}
++
+ EXPORT_SYMBOL_GPL(nvmem_cell_write);
+ 
+ static int nvmem_cell_read_common(struct device *dev, const char *cell_id,
+@@ -1631,7 +1676,7 @@ static const void *nvmem_cell_read_varia
+ 	if (IS_ERR(cell))
+ 		return cell;
+ 
+-	nbits = cell->nbits;
++	nbits = cell->entry->nbits;
+ 	buf = nvmem_cell_read(cell, len);
+ 	nvmem_cell_put(cell);
+ 	if (IS_ERR(buf))
+@@ -1727,18 +1772,18 @@ EXPORT_SYMBOL_GPL(nvmem_cell_read_variab
+ ssize_t nvmem_device_cell_read(struct nvmem_device *nvmem,
+ 			   struct nvmem_cell_info *info, void *buf)
+ {
+-	struct nvmem_cell cell;
++	struct nvmem_cell_entry cell;
+ 	int rc;
+ 	ssize_t len;
+ 
+ 	if (!nvmem)
+ 		return -EINVAL;
+ 
+-	rc = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, &cell);
++	rc = nvmem_cell_info_to_nvmem_cell_entry_nodup(nvmem, info, &cell);
+ 	if (rc)
+ 		return rc;
+ 
+-	rc = __nvmem_cell_read(nvmem, &cell, buf, &len);
++	rc = __nvmem_cell_read(nvmem, &cell, buf, &len, NULL);
+ 	if (rc)
+ 		return rc;
+ 
+@@ -1758,17 +1803,17 @@ EXPORT_SYMBOL_GPL(nvmem_device_cell_read
+ int nvmem_device_cell_write(struct nvmem_device *nvmem,
+ 			    struct nvmem_cell_info *info, void *buf)
+ {
+-	struct nvmem_cell cell;
++	struct nvmem_cell_entry cell;
+ 	int rc;
+ 
+ 	if (!nvmem)
+ 		return -EINVAL;
+ 
+-	rc = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, &cell);
++	rc = nvmem_cell_info_to_nvmem_cell_entry_nodup(nvmem, info, &cell);
+ 	if (rc)
+ 		return rc;
+ 
+-	return nvmem_cell_write(&cell, buf, cell.bytes);
++	return __nvmem_cell_entry_write(&cell, buf, cell.bytes);
+ }
+ EXPORT_SYMBOL_GPL(nvmem_device_cell_write);
+ 
diff --git a/target/linux/generic/backport-5.15/802-v5.16-0002-nvmem-core-add-nvmem-cell-post-processing-callback.patch b/target/linux/generic/backport-5.15/802-v5.16-0002-nvmem-core-add-nvmem-cell-post-processing-callback.patch
new file mode 100644
index 00000000000000..df264add24524a
--- /dev/null
+++ b/target/linux/generic/backport-5.15/802-v5.16-0002-nvmem-core-add-nvmem-cell-post-processing-callback.patch
@@ -0,0 +1,82 @@
+From 5008062f1c3f5af3acf86164aa6fcc77b0c7bdce Mon Sep 17 00:00:00 2001
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Date: Wed, 13 Oct 2021 14:19:56 +0100
+Subject: [PATCH] nvmem: core: add nvmem cell post processing callback
+
+Some NVMEM providers have certain nvmem cells encoded, which requires
+post processing before actually using it.
+
+For example mac-address is stored in either in ascii or delimited or reverse-order.
+
+Having a post-process callback hook to provider drivers would enable them to
+do this vendor specific post processing before nvmem consumers see it.
+
+Tested-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20211013131957.30271-3-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c           | 9 +++++++++
+ include/linux/nvmem-provider.h | 5 +++++
+ 2 files changed, 14 insertions(+)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -38,6 +38,7 @@ struct nvmem_device {
+ 	unsigned int		nkeepout;
+ 	nvmem_reg_read_t	reg_read;
+ 	nvmem_reg_write_t	reg_write;
++	nvmem_cell_post_process_t cell_post_process;
+ 	struct gpio_desc	*wp_gpio;
+ 	void *priv;
+ };
+@@ -799,6 +800,7 @@ struct nvmem_device *nvmem_register(cons
+ 	nvmem->type = config->type;
+ 	nvmem->reg_read = config->reg_read;
+ 	nvmem->reg_write = config->reg_write;
++	nvmem->cell_post_process = config->cell_post_process;
+ 	nvmem->keepout = config->keepout;
+ 	nvmem->nkeepout = config->nkeepout;
+ 	if (config->of_node)
+@@ -1441,6 +1443,13 @@ static int __nvmem_cell_read(struct nvme
+ 	if (cell->bit_offset || cell->nbits)
+ 		nvmem_shift_read_buffer_in_place(cell, buf);
+ 
++	if (nvmem->cell_post_process) {
++		rc = nvmem->cell_post_process(nvmem->priv, id,
++					      cell->offset, buf, cell->bytes);
++		if (rc)
++			return rc;
++	}
++
+ 	if (len)
+ 		*len = cell->bytes;
+ 
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -19,6 +19,9 @@ typedef int (*nvmem_reg_read_t)(void *pr
+ 				void *val, size_t bytes);
+ typedef int (*nvmem_reg_write_t)(void *priv, unsigned int offset,
+ 				 void *val, size_t bytes);
++/* used for vendor specific post processing of cell data */
++typedef int (*nvmem_cell_post_process_t)(void *priv, const char *id, unsigned int offset,
++					  void *buf, size_t bytes);
+ 
+ enum nvmem_type {
+ 	NVMEM_TYPE_UNKNOWN = 0,
+@@ -62,6 +65,7 @@ struct nvmem_keepout {
+  * @no_of_node:	Device should not use the parent's of_node even if it's !NULL.
+  * @reg_read:	Callback to read data.
+  * @reg_write:	Callback to write data.
++ * @cell_post_process:	Callback for vendor specific post processing of cell data
+  * @size:	Device size.
+  * @word_size:	Minimum read/write access granularity.
+  * @stride:	Minimum read/write access stride.
+@@ -92,6 +96,7 @@ struct nvmem_config {
+ 	bool			no_of_node;
+ 	nvmem_reg_read_t	reg_read;
+ 	nvmem_reg_write_t	reg_write;
++	nvmem_cell_post_process_t cell_post_process;
+ 	int	size;
+ 	int	word_size;
+ 	int	stride;
diff --git a/target/linux/generic/backport-5.15/802-v5.16-0003-nvmem-imx-ocotp-add-support-for-post-processing.patch b/target/linux/generic/backport-5.15/802-v5.16-0003-nvmem-imx-ocotp-add-support-for-post-processing.patch
new file mode 100644
index 00000000000000..ee19228270d101
--- /dev/null
+++ b/target/linux/generic/backport-5.15/802-v5.16-0003-nvmem-imx-ocotp-add-support-for-post-processing.patch
@@ -0,0 +1,92 @@
+From d0221a780cbc99fec6c27a98dba2828dc5735c00 Mon Sep 17 00:00:00 2001
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Date: Wed, 13 Oct 2021 14:19:57 +0100
+Subject: [PATCH] nvmem: imx-ocotp: add support for post processing
+
+Add .cell_post_process callback for imx-ocotp to deal with MAC address,
+since MAC address need to be reversed byte for some i.MX SoCs.
+
+Tested-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20211013131957.30271-4-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/imx-ocotp.c | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+--- a/drivers/nvmem/imx-ocotp.c
++++ b/drivers/nvmem/imx-ocotp.c
+@@ -97,6 +97,7 @@ struct ocotp_params {
+ 	unsigned int bank_address_words;
+ 	void (*set_timing)(struct ocotp_priv *priv);
+ 	struct ocotp_ctrl_reg ctrl;
++	bool reverse_mac_address;
+ };
+ 
+ static int imx_ocotp_wait_for_busy(struct ocotp_priv *priv, u32 flags)
+@@ -221,6 +222,25 @@ read_end:
+ 	return ret;
+ }
+ 
++static int imx_ocotp_cell_pp(void *context, const char *id, unsigned int offset,
++			     void *data, size_t bytes)
++{
++	struct ocotp_priv *priv = context;
++
++	/* Deal with some post processing of nvmem cell data */
++	if (id && !strcmp(id, "mac-address")) {
++		if (priv->params->reverse_mac_address) {
++			u8 *buf = data;
++			int i;
++
++			for (i = 0; i < bytes/2; i++)
++				swap(buf[i], buf[bytes - i - 1]);
++		}
++	}
++
++	return 0;
++}
++
+ static void imx_ocotp_set_imx6_timing(struct ocotp_priv *priv)
+ {
+ 	unsigned long clk_rate;
+@@ -468,6 +488,7 @@ static struct nvmem_config imx_ocotp_nvm
+ 	.stride = 1,
+ 	.reg_read = imx_ocotp_read,
+ 	.reg_write = imx_ocotp_write,
++	.cell_post_process = imx_ocotp_cell_pp,
+ };
+ 
+ static const struct ocotp_params imx6q_params = {
+@@ -530,6 +551,7 @@ static const struct ocotp_params imx8mq_
+ 	.bank_address_words = 0,
+ 	.set_timing = imx_ocotp_set_imx6_timing,
+ 	.ctrl = IMX_OCOTP_BM_CTRL_DEFAULT,
++	.reverse_mac_address = true,
+ };
+ 
+ static const struct ocotp_params imx8mm_params = {
+@@ -537,6 +559,7 @@ static const struct ocotp_params imx8mm_
+ 	.bank_address_words = 0,
+ 	.set_timing = imx_ocotp_set_imx6_timing,
+ 	.ctrl = IMX_OCOTP_BM_CTRL_DEFAULT,
++	.reverse_mac_address = true,
+ };
+ 
+ static const struct ocotp_params imx8mn_params = {
+@@ -544,6 +567,7 @@ static const struct ocotp_params imx8mn_
+ 	.bank_address_words = 0,
+ 	.set_timing = imx_ocotp_set_imx6_timing,
+ 	.ctrl = IMX_OCOTP_BM_CTRL_DEFAULT,
++	.reverse_mac_address = true,
+ };
+ 
+ static const struct ocotp_params imx8mp_params = {
+@@ -551,6 +575,7 @@ static const struct ocotp_params imx8mp_
+ 	.bank_address_words = 0,
+ 	.set_timing = imx_ocotp_set_imx6_timing,
+ 	.ctrl = IMX_OCOTP_BM_CTRL_8MP,
++	.reverse_mac_address = true,
+ };
+ 
+ static const struct of_device_id imx_ocotp_dt_ids[] = {
diff --git a/target/linux/generic/backport-5.15/803-v5.17-0002-nvmem-mtk-efuse-support-minimum-one-byte-access-stri.patch b/target/linux/generic/backport-5.15/803-v5.17-0002-nvmem-mtk-efuse-support-minimum-one-byte-access-stri.patch
new file mode 100644
index 00000000000000..785bfe53f547ab
--- /dev/null
+++ b/target/linux/generic/backport-5.15/803-v5.17-0002-nvmem-mtk-efuse-support-minimum-one-byte-access-stri.patch
@@ -0,0 +1,47 @@
+From 98e2c4efae214fb7086cac9117616eb6ea11475d Mon Sep 17 00:00:00 2001
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Date: Thu, 9 Dec 2021 17:42:34 +0000
+Subject: [PATCH] nvmem: mtk-efuse: support minimum one byte access stride and
+ granularity
+
+In order to support nvmem bits property, should support minimum 1 byte
+read stride and minimum 1 byte read granularity at the same time.
+
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20211209174235.14049-4-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/mtk-efuse.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/nvmem/mtk-efuse.c
++++ b/drivers/nvmem/mtk-efuse.c
+@@ -19,11 +19,12 @@ static int mtk_reg_read(void *context,
+ 			unsigned int reg, void *_val, size_t bytes)
+ {
+ 	struct mtk_efuse_priv *priv = context;
+-	u32 *val = _val;
+-	int i = 0, words = bytes / 4;
++	void __iomem *addr = priv->base + reg;
++	u8 *val = _val;
++	int i;
+ 
+-	while (words--)
+-		*val++ = readl(priv->base + reg + (i++ * 4));
++	for (i = 0; i < bytes; i++, val++)
++		*val = readb(addr + i);
+ 
+ 	return 0;
+ }
+@@ -45,8 +46,8 @@ static int mtk_efuse_probe(struct platfo
+ 	if (IS_ERR(priv->base))
+ 		return PTR_ERR(priv->base);
+ 
+-	econfig.stride = 4;
+-	econfig.word_size = 4;
++	econfig.stride = 1;
++	econfig.word_size = 1;
+ 	econfig.reg_read = mtk_reg_read;
+ 	econfig.size = resource_size(res);
+ 	econfig.priv = priv;
diff --git a/target/linux/generic/backport-5.15/804-v5.18-0001-nvmem-core-Remove-unused-devm_nvmem_unregister.patch b/target/linux/generic/backport-5.15/804-v5.18-0001-nvmem-core-Remove-unused-devm_nvmem_unregister.patch
new file mode 100644
index 00000000000000..ca5357c8d9886e
--- /dev/null
+++ b/target/linux/generic/backport-5.15/804-v5.18-0001-nvmem-core-Remove-unused-devm_nvmem_unregister.patch
@@ -0,0 +1,72 @@
+From 190fae468592bc2f0efc8b928920f8f712b5831e Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Sun, 20 Feb 2022 15:15:15 +0000
+Subject: [PATCH] nvmem: core: Remove unused devm_nvmem_unregister()
+
+There are no users and seems no will come of the devm_nvmem_unregister().
+Remove the function and remove the unused devm_nvmem_match() along with it.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220220151527.17216-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c           | 22 ----------------------
+ include/linux/nvmem-provider.h |  8 --------
+ 2 files changed, 30 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -943,28 +943,6 @@ struct nvmem_device *devm_nvmem_register
+ }
+ EXPORT_SYMBOL_GPL(devm_nvmem_register);
+ 
+-static int devm_nvmem_match(struct device *dev, void *res, void *data)
+-{
+-	struct nvmem_device **r = res;
+-
+-	return *r == data;
+-}
+-
+-/**
+- * devm_nvmem_unregister() - Unregister previously registered managed nvmem
+- * device.
+- *
+- * @dev: Device that uses the nvmem device.
+- * @nvmem: Pointer to previously registered nvmem device.
+- *
+- * Return: Will be negative on error or zero on success.
+- */
+-int devm_nvmem_unregister(struct device *dev, struct nvmem_device *nvmem)
+-{
+-	return devres_release(dev, devm_nvmem_release, devm_nvmem_match, nvmem);
+-}
+-EXPORT_SYMBOL(devm_nvmem_unregister);
+-
+ static struct nvmem_device *__nvmem_device_get(void *data,
+ 			int (*match)(struct device *dev, const void *data))
+ {
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -133,8 +133,6 @@ void nvmem_unregister(struct nvmem_devic
+ struct nvmem_device *devm_nvmem_register(struct device *dev,
+ 					 const struct nvmem_config *cfg);
+ 
+-int devm_nvmem_unregister(struct device *dev, struct nvmem_device *nvmem);
+-
+ void nvmem_add_cell_table(struct nvmem_cell_table *table);
+ void nvmem_del_cell_table(struct nvmem_cell_table *table);
+ 
+@@ -153,12 +151,6 @@ devm_nvmem_register(struct device *dev,
+ 	return nvmem_register(c);
+ }
+ 
+-static inline int
+-devm_nvmem_unregister(struct device *dev, struct nvmem_device *nvmem)
+-{
+-	return -EOPNOTSUPP;
+-}
+-
+ static inline void nvmem_add_cell_table(struct nvmem_cell_table *table) {}
+ static inline void nvmem_del_cell_table(struct nvmem_cell_table *table) {}
+ 
diff --git a/target/linux/generic/backport-5.15/804-v5.18-0002-nvmem-core-Use-devm_add_action_or_reset.patch b/target/linux/generic/backport-5.15/804-v5.18-0002-nvmem-core-Use-devm_add_action_or_reset.patch
new file mode 100644
index 00000000000000..b71a0a365b2166
--- /dev/null
+++ b/target/linux/generic/backport-5.15/804-v5.18-0002-nvmem-core-Use-devm_add_action_or_reset.patch
@@ -0,0 +1,58 @@
+From 5825b2c6762611e67ccaf3ccf64485365a120f0b Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Sun, 20 Feb 2022 15:15:16 +0000
+Subject: [PATCH] nvmem: core: Use devm_add_action_or_reset()
+
+Slightly simplify the devm_nvmem_register() by using the
+devm_add_action_or_reset().
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220220151527.17216-3-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c | 22 +++++++++-------------
+ 1 file changed, 9 insertions(+), 13 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -905,9 +905,9 @@ void nvmem_unregister(struct nvmem_devic
+ }
+ EXPORT_SYMBOL_GPL(nvmem_unregister);
+ 
+-static void devm_nvmem_release(struct device *dev, void *res)
++static void devm_nvmem_unregister(void *nvmem)
+ {
+-	nvmem_unregister(*(struct nvmem_device **)res);
++	nvmem_unregister(nvmem);
+ }
+ 
+ /**
+@@ -924,20 +924,16 @@ static void devm_nvmem_release(struct de
+ struct nvmem_device *devm_nvmem_register(struct device *dev,
+ 					 const struct nvmem_config *config)
+ {
+-	struct nvmem_device **ptr, *nvmem;
+-
+-	ptr = devres_alloc(devm_nvmem_release, sizeof(*ptr), GFP_KERNEL);
+-	if (!ptr)
+-		return ERR_PTR(-ENOMEM);
++	struct nvmem_device *nvmem;
++	int ret;
+ 
+ 	nvmem = nvmem_register(config);
++	if (IS_ERR(nvmem))
++		return nvmem;
+ 
+-	if (!IS_ERR(nvmem)) {
+-		*ptr = nvmem;
+-		devres_add(dev, ptr);
+-	} else {
+-		devres_free(ptr);
+-	}
++	ret = devm_add_action_or_reset(dev, devm_nvmem_unregister, nvmem);
++	if (ret)
++		return ERR_PTR(ret);
+ 
+ 	return nvmem;
+ }
diff --git a/target/linux/generic/backport-5.15/804-v5.18-0003-nvmem-core-Check-input-parameter-for-NULL-in-nvmem_u.patch b/target/linux/generic/backport-5.15/804-v5.18-0003-nvmem-core-Check-input-parameter-for-NULL-in-nvmem_u.patch
new file mode 100644
index 00000000000000..4f471f266738ba
--- /dev/null
+++ b/target/linux/generic/backport-5.15/804-v5.18-0003-nvmem-core-Check-input-parameter-for-NULL-in-nvmem_u.patch
@@ -0,0 +1,30 @@
+From 8c751e0d9a5264376935a84429a2d468c8877d99 Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Sun, 20 Feb 2022 15:15:17 +0000
+Subject: [PATCH] nvmem: core: Check input parameter for NULL in
+ nvmem_unregister()
+
+nvmem_unregister() frees resources and standard pattern is to allow
+caller to not care if it's NULL or not. This will reduce burden on
+the callers to perform this check.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220220151527.17216-4-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -901,7 +901,8 @@ static void nvmem_device_release(struct
+  */
+ void nvmem_unregister(struct nvmem_device *nvmem)
+ {
+-	kref_put(&nvmem->refcnt, nvmem_device_release);
++	if (nvmem)
++		kref_put(&nvmem->refcnt, nvmem_device_release);
+ }
+ EXPORT_SYMBOL_GPL(nvmem_unregister);
+ 
diff --git a/target/linux/generic/backport-5.15/804-v5.18-0004-nvmem-qfprom-fix-kerneldoc-warning.patch b/target/linux/generic/backport-5.15/804-v5.18-0004-nvmem-qfprom-fix-kerneldoc-warning.patch
new file mode 100644
index 00000000000000..c98f8e9d545e90
--- /dev/null
+++ b/target/linux/generic/backport-5.15/804-v5.18-0004-nvmem-qfprom-fix-kerneldoc-warning.patch
@@ -0,0 +1,29 @@
+From 05196facc052385960028ac634447ecf6c764ec3 Mon Sep 17 00:00:00 2001
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Date: Sun, 20 Feb 2022 15:15:18 +0000
+Subject: [PATCH] nvmem: qfprom: fix kerneldoc warning
+
+This patch fixes below kernel doc warning,
+warning: expecting prototype for qfprom_efuse_reg_write().
+Prototype was for qfprom_reg_write() instead
+
+No code changes.
+
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220220151527.17216-5-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/qfprom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/qfprom.c
++++ b/drivers/nvmem/qfprom.c
+@@ -244,7 +244,7 @@ err_clk_prepared:
+ }
+ 
+ /**
+- * qfprom_efuse_reg_write() - Write to fuses.
++ * qfprom_reg_write() - Write to fuses.
+  * @context: Our driver data.
+  * @reg:     The offset to write at.
+  * @_val:    Pointer to data to write.
diff --git a/target/linux/generic/backport-5.15/804-v5.18-0005-nvmem-sunxi_sid-Add-support-for-D1-variant.patch b/target/linux/generic/backport-5.15/804-v5.18-0005-nvmem-sunxi_sid-Add-support-for-D1-variant.patch
new file mode 100644
index 00000000000000..6aad6af0800c55
--- /dev/null
+++ b/target/linux/generic/backport-5.15/804-v5.18-0005-nvmem-sunxi_sid-Add-support-for-D1-variant.patch
@@ -0,0 +1,38 @@
+From 07ae4fde9efada7878e1383d6ccc7da70315ca23 Mon Sep 17 00:00:00 2001
+From: Samuel Holland <samuel@sholland.org>
+Date: Sun, 20 Feb 2022 15:15:20 +0000
+Subject: [PATCH] nvmem: sunxi_sid: Add support for D1 variant
+
+D1 has a smaller eFuse block than some other recent SoCs, and it no
+longer requires a workaround to read the eFuse data.
+
+Signed-off-by: Samuel Holland <samuel@sholland.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220220151527.17216-7-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/sunxi_sid.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/nvmem/sunxi_sid.c
++++ b/drivers/nvmem/sunxi_sid.c
+@@ -184,6 +184,11 @@ static const struct sunxi_sid_cfg sun8i_
+ 	.need_register_readout = true,
+ };
+ 
++static const struct sunxi_sid_cfg sun20i_d1_cfg = {
++	.value_offset = 0x200,
++	.size = 0x100,
++};
++
+ static const struct sunxi_sid_cfg sun50i_a64_cfg = {
+ 	.value_offset = 0x200,
+ 	.size = 0x100,
+@@ -200,6 +205,7 @@ static const struct of_device_id sunxi_s
+ 	{ .compatible = "allwinner,sun7i-a20-sid", .data = &sun7i_a20_cfg },
+ 	{ .compatible = "allwinner,sun8i-a83t-sid", .data = &sun50i_a64_cfg },
+ 	{ .compatible = "allwinner,sun8i-h3-sid", .data = &sun8i_h3_cfg },
++	{ .compatible = "allwinner,sun20i-d1-sid", .data = &sun20i_d1_cfg },
+ 	{ .compatible = "allwinner,sun50i-a64-sid", .data = &sun50i_a64_cfg },
+ 	{ .compatible = "allwinner,sun50i-h5-sid", .data = &sun50i_a64_cfg },
+ 	{ .compatible = "allwinner,sun50i-h6-sid", .data = &sun50i_h6_cfg },
diff --git a/target/linux/generic/backport-5.15/804-v5.18-0006-nvmem-meson-mx-efuse-replace-unnecessary-devm_kstrdu.patch b/target/linux/generic/backport-5.15/804-v5.18-0006-nvmem-meson-mx-efuse-replace-unnecessary-devm_kstrdu.patch
new file mode 100644
index 00000000000000..a73b42c5de3c68
--- /dev/null
+++ b/target/linux/generic/backport-5.15/804-v5.18-0006-nvmem-meson-mx-efuse-replace-unnecessary-devm_kstrdu.patch
@@ -0,0 +1,28 @@
+From 4dc8d89faed9bb05f116fa1794fc955b14910386 Mon Sep 17 00:00:00 2001
+From: Xiaoke Wang <xkernel.wang@foxmail.com>
+Date: Sun, 20 Feb 2022 15:15:21 +0000
+Subject: [PATCH] nvmem: meson-mx-efuse: replace unnecessary devm_kstrdup()
+
+Replace unnecessary devm_kstrdup() so to avoid redundant memory allocation.
+
+Suggested-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Xiaoke Wang <xkernel.wang@foxmail.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220220151527.17216-8-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/meson-mx-efuse.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/nvmem/meson-mx-efuse.c
++++ b/drivers/nvmem/meson-mx-efuse.c
+@@ -209,8 +209,7 @@ static int meson_mx_efuse_probe(struct p
+ 	if (IS_ERR(efuse->base))
+ 		return PTR_ERR(efuse->base);
+ 
+-	efuse->config.name = devm_kstrdup(&pdev->dev, drvdata->name,
+-					  GFP_KERNEL);
++	efuse->config.name = drvdata->name;
+ 	efuse->config.owner = THIS_MODULE;
+ 	efuse->config.dev = &pdev->dev;
+ 	efuse->config.priv = efuse;
diff --git a/target/linux/generic/backport-5.15/804-v5.18-0007-nvmem-add-driver-for-Layerscape-SFP-Security-Fuse-Pr.patch b/target/linux/generic/backport-5.15/804-v5.18-0007-nvmem-add-driver-for-Layerscape-SFP-Security-Fuse-Pr.patch
new file mode 100644
index 00000000000000..6afb68b3f91bb9
--- /dev/null
+++ b/target/linux/generic/backport-5.15/804-v5.18-0007-nvmem-add-driver-for-Layerscape-SFP-Security-Fuse-Pr.patch
@@ -0,0 +1,139 @@
+From f78451012b9e159afdba31c3eb69f223a9f42adc Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Sun, 20 Feb 2022 15:15:23 +0000
+Subject: [PATCH] nvmem: add driver for Layerscape SFP (Security Fuse
+ Processor)
+
+Add support for the Security Fuse Processor found on Layerscape SoCs.
+This driver implements basic read access.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220220151527.17216-10-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/Kconfig          | 12 +++++
+ drivers/nvmem/Makefile         |  2 +
+ drivers/nvmem/layerscape-sfp.c | 89 ++++++++++++++++++++++++++++++++++
+ 3 files changed, 103 insertions(+)
+ create mode 100644 drivers/nvmem/layerscape-sfp.c
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -300,4 +300,16 @@ config NVMEM_BRCM_NVRAM
+ 	  This driver provides support for Broadcom's NVRAM that can be accessed
+ 	  using I/O mapping.
+ 
++config NVMEM_LAYERSCAPE_SFP
++	tristate "Layerscape SFP (Security Fuse Processor) support"
++	depends on ARCH_LAYERSCAPE || COMPILE_TEST
++	depends on HAS_IOMEM
++	help
++	  This driver provides support to read the eFuses on Freescale
++	  Layerscape SoC's. For example, the vendor provides a per part
++	  unique ID there.
++
++	  This driver can also be built as a module. If so, the module
++	  will be called layerscape-sfp.
++
+ endif
+--- a/drivers/nvmem/Makefile
++++ b/drivers/nvmem/Makefile
+@@ -61,3 +61,5 @@ obj-$(CONFIG_NVMEM_RMEM) 	+= nvmem-rmem.
+ nvmem-rmem-y			:= rmem.o
+ obj-$(CONFIG_NVMEM_BRCM_NVRAM)	+= nvmem_brcm_nvram.o
+ nvmem_brcm_nvram-y		:= brcm_nvram.o
++obj-$(CONFIG_NVMEM_LAYERSCAPE_SFP)	+= nvmem-layerscape-sfp.o
++nvmem-layerscape-sfp-y		:= layerscape-sfp.o
+--- /dev/null
++++ b/drivers/nvmem/layerscape-sfp.c
+@@ -0,0 +1,89 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Layerscape SFP driver
++ *
++ * Copyright (c) 2022 Michael Walle <michael@walle.cc>
++ *
++ */
++
++#include <linux/device.h>
++#include <linux/io.h>
++#include <linux/mod_devicetable.h>
++#include <linux/module.h>
++#include <linux/nvmem-provider.h>
++#include <linux/platform_device.h>
++#include <linux/property.h>
++
++#define LAYERSCAPE_SFP_OTP_OFFSET	0x0200
++
++struct layerscape_sfp_priv {
++	void __iomem *base;
++};
++
++struct layerscape_sfp_data {
++	int size;
++};
++
++static int layerscape_sfp_read(void *context, unsigned int offset, void *val,
++			       size_t bytes)
++{
++	struct layerscape_sfp_priv *priv = context;
++
++	memcpy_fromio(val, priv->base + LAYERSCAPE_SFP_OTP_OFFSET + offset,
++		      bytes);
++
++	return 0;
++}
++
++static struct nvmem_config layerscape_sfp_nvmem_config = {
++	.name = "fsl-sfp",
++	.reg_read = layerscape_sfp_read,
++};
++
++static int layerscape_sfp_probe(struct platform_device *pdev)
++{
++	const struct layerscape_sfp_data *data;
++	struct layerscape_sfp_priv *priv;
++	struct nvmem_device *nvmem;
++
++	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	priv->base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(priv->base))
++		return PTR_ERR(priv->base);
++
++	data = device_get_match_data(&pdev->dev);
++
++	layerscape_sfp_nvmem_config.size = data->size;
++	layerscape_sfp_nvmem_config.dev = &pdev->dev;
++	layerscape_sfp_nvmem_config.priv = priv;
++
++	nvmem = devm_nvmem_register(&pdev->dev, &layerscape_sfp_nvmem_config);
++
++	return PTR_ERR_OR_ZERO(nvmem);
++}
++
++static const struct layerscape_sfp_data ls1028a_data = {
++	.size = 0x88,
++};
++
++static const struct of_device_id layerscape_sfp_dt_ids[] = {
++	{ .compatible = "fsl,ls1028a-sfp", .data = &ls1028a_data },
++	{},
++};
++MODULE_DEVICE_TABLE(of, layerscape_sfp_dt_ids);
++
++static struct platform_driver layerscape_sfp_driver = {
++	.probe	= layerscape_sfp_probe,
++	.driver = {
++		.name	= "layerscape_sfp",
++		.of_match_table = layerscape_sfp_dt_ids,
++	},
++};
++module_platform_driver(layerscape_sfp_driver);
++
++MODULE_AUTHOR("Michael Walle <michael@walle.cc>");
++MODULE_DESCRIPTION("Layerscape Security Fuse Processor driver");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/generic/backport-5.15/804-v5.18-0008-nvmem-qfprom-Increase-fuse-blow-timeout-to-prevent-w.patch b/target/linux/generic/backport-5.15/804-v5.18-0008-nvmem-qfprom-Increase-fuse-blow-timeout-to-prevent-w.patch
new file mode 100644
index 00000000000000..74bd4a7eb67636
--- /dev/null
+++ b/target/linux/generic/backport-5.15/804-v5.18-0008-nvmem-qfprom-Increase-fuse-blow-timeout-to-prevent-w.patch
@@ -0,0 +1,32 @@
+From bc5c75e0a5a9400f81a987cc720100ac475fa4d8 Mon Sep 17 00:00:00 2001
+From: Knox Chiou <knoxchiou@chromium.org>
+Date: Wed, 23 Feb 2022 22:35:00 +0000
+Subject: [PATCH] nvmem: qfprom: Increase fuse blow timeout to prevent write
+ fail
+
+sc7180 blow fuses got slightly chances to hit qfprom_reg_write timeout.
+Current timeout is simply too low. Since blowing fuses is a
+very rare operation, so the risk associated with overestimating this
+number is low.
+Increase fuse blow timeout from 1ms to 10ms.
+
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Knox Chiou <knoxchiou@chromium.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220223223502.29454-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/qfprom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/qfprom.c
++++ b/drivers/nvmem/qfprom.c
+@@ -22,7 +22,7 @@
+ 
+ /* Amount of time required to hold charge to blow fuse in micro-seconds */
+ #define QFPROM_FUSE_BLOW_POLL_US	100
+-#define QFPROM_FUSE_BLOW_TIMEOUT_US	1000
++#define QFPROM_FUSE_BLOW_TIMEOUT_US	10000
+ 
+ #define QFPROM_BLOW_STATUS_OFFSET	0x048
+ #define QFPROM_BLOW_STATUS_BUSY		0x1
diff --git a/target/linux/generic/backport-5.15/804-v5.18-0009-nvmem-Add-driver-for-OCOTP-in-Sunplus-SP7021.patch b/target/linux/generic/backport-5.15/804-v5.18-0009-nvmem-Add-driver-for-OCOTP-in-Sunplus-SP7021.patch
new file mode 100644
index 00000000000000..ae177e0cb036e6
--- /dev/null
+++ b/target/linux/generic/backport-5.15/804-v5.18-0009-nvmem-Add-driver-for-OCOTP-in-Sunplus-SP7021.patch
@@ -0,0 +1,291 @@
+From 8747ec2e9762ed9ae53b3a590938f454b6a1abdf Mon Sep 17 00:00:00 2001
+From: Vincent Shih <vincent.sunplus@gmail.com>
+Date: Wed, 23 Feb 2022 22:35:01 +0000
+Subject: [PATCH] nvmem: Add driver for OCOTP in Sunplus SP7021
+
+Add driver for OCOTP in Sunplus SP7021
+
+Signed-off-by: Vincent Shih <vincent.sunplus@gmail.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220223223502.29454-3-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ MAINTAINERS                   |   5 +
+ drivers/nvmem/Kconfig         |  12 ++
+ drivers/nvmem/Makefile        |   2 +
+ drivers/nvmem/sunplus-ocotp.c | 228 ++++++++++++++++++++++++++++++++++
+ 4 files changed, 247 insertions(+)
+ create mode 100644 drivers/nvmem/sunplus-ocotp.c
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -17965,6 +17965,11 @@ L:	netdev@vger.kernel.org
+ S:	Maintained
+ F:	drivers/net/ethernet/dlink/sundance.c
+ 
++SUNPLUS OCOTP DRIVER
++M:	Vincent Shih <vincent.sunplus@gmail.com>
++S:	Maintained
++F:	drivers/nvmem/sunplus-ocotp.c
++
+ SUPERH
+ M:	Yoshinori Sato <ysato@users.sourceforge.jp>
+ M:	Rich Felker <dalias@libc.org>
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -312,4 +312,16 @@ config NVMEM_LAYERSCAPE_SFP
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called layerscape-sfp.
+ 
++config NVMEM_SUNPLUS_OCOTP
++	tristate "Sunplus SoC OTP support"
++	depends on SOC_SP7021 || COMPILE_TEST
++	depends on HAS_IOMEM
++	help
++	  This is a driver for the On-chip OTP controller (OCOTP) available
++	  on Sunplus SoCs. It provides access to 128 bytes of one-time
++	  programmable eFuse.
++
++	  This driver can also be built as a module. If so, the module
++	  will be called nvmem-sunplus-ocotp.
++
+ endif
+--- a/drivers/nvmem/Makefile
++++ b/drivers/nvmem/Makefile
+@@ -63,3 +63,5 @@ obj-$(CONFIG_NVMEM_BRCM_NVRAM)	+= nvmem_
+ nvmem_brcm_nvram-y		:= brcm_nvram.o
+ obj-$(CONFIG_NVMEM_LAYERSCAPE_SFP)	+= nvmem-layerscape-sfp.o
+ nvmem-layerscape-sfp-y		:= layerscape-sfp.o
++obj-$(CONFIG_NVMEM_SUNPLUS_OCOTP)	+= nvmem_sunplus_ocotp.o
++nvmem_sunplus_ocotp-y		:= sunplus-ocotp.o
+--- /dev/null
++++ b/drivers/nvmem/sunplus-ocotp.c
+@@ -0,0 +1,228 @@
++// SPDX-License-Identifier: GPL-2.0
++
++/*
++ * The OCOTP driver for Sunplus	SP7021
++ *
++ * Copyright (C) 2019 Sunplus Technology Inc., All rights reserved.
++ */
++
++#include <linux/bitfield.h>
++#include <linux/clk.h>
++#include <linux/delay.h>
++#include <linux/device.h>
++#include <linux/io.h>
++#include <linux/iopoll.h>
++#include <linux/module.h>
++#include <linux/nvmem-provider.h>
++#include <linux/of_device.h>
++#include <linux/platform_device.h>
++
++/*
++ * OTP memory
++ * Each bank contains 4 words (32 bits).
++ * Bank 0 starts at offset 0 from the base.
++ */
++
++#define OTP_WORDS_PER_BANK		4
++#define OTP_WORD_SIZE			sizeof(u32)
++#define OTP_BIT_ADDR_OF_BANK		(8 * OTP_WORD_SIZE * OTP_WORDS_PER_BANK)
++#define QAC628_OTP_NUM_BANKS		8
++#define QAC628_OTP_SIZE			(QAC628_OTP_NUM_BANKS * OTP_WORDS_PER_BANK * OTP_WORD_SIZE)
++#define OTP_READ_TIMEOUT_US		200000
++
++/* HB_GPIO */
++#define ADDRESS_8_DATA			0x20
++
++/* OTP_RX */
++#define OTP_CONTROL_2			0x48
++#define OTP_RD_PERIOD			GENMASK(15, 8)
++#define OTP_RD_PERIOD_MASK		~GENMASK(15, 8)
++#define CPU_CLOCK			FIELD_PREP(OTP_RD_PERIOD, 30)
++#define SEL_BAK_KEY2			BIT(5)
++#define SEL_BAK_KEY2_MASK		~BIT(5)
++#define SW_TRIM_EN			BIT(4)
++#define SW_TRIM_EN_MASK			~BIT(4)
++#define SEL_BAK_KEY			BIT(3)
++#define SEL_BAK_KEY_MASK		~BIT(3)
++#define OTP_READ			BIT(2)
++#define OTP_LOAD_SECURE_DATA		BIT(1)
++#define OTP_LOAD_SECURE_DATA_MASK	~BIT(1)
++#define OTP_DO_CRC			BIT(0)
++#define OTP_DO_CRC_MASK			~BIT(0)
++#define OTP_STATUS			0x4c
++#define OTP_READ_DONE			BIT(4)
++#define OTP_READ_DONE_MASK		~BIT(4)
++#define OTP_LOAD_SECURE_DONE_MASK	~BIT(2)
++#define OTP_READ_ADDRESS		0x50
++
++enum base_type {
++	HB_GPIO,
++	OTPRX,
++	BASEMAX,
++};
++
++struct sp_ocotp_priv {
++	struct device *dev;
++	void __iomem *base[BASEMAX];
++	struct clk *clk;
++};
++
++struct sp_ocotp_data {
++	int size;
++};
++
++const struct sp_ocotp_data  sp_otp_v0 = {
++	.size = QAC628_OTP_SIZE,
++};
++
++static int sp_otp_read_real(struct sp_ocotp_priv *otp, int addr, char *value)
++{
++	unsigned int addr_data;
++	unsigned int byte_shift;
++	unsigned int status;
++	int ret;
++
++	addr_data = addr % (OTP_WORD_SIZE * OTP_WORDS_PER_BANK);
++	addr_data = addr_data / OTP_WORD_SIZE;
++
++	byte_shift = addr % (OTP_WORD_SIZE * OTP_WORDS_PER_BANK);
++	byte_shift = byte_shift % OTP_WORD_SIZE;
++
++	addr = addr / (OTP_WORD_SIZE * OTP_WORDS_PER_BANK);
++	addr = addr * OTP_BIT_ADDR_OF_BANK;
++
++	writel(readl(otp->base[OTPRX] + OTP_STATUS) & OTP_READ_DONE_MASK &
++	       OTP_LOAD_SECURE_DONE_MASK, otp->base[OTPRX] + OTP_STATUS);
++	writel(addr, otp->base[OTPRX] + OTP_READ_ADDRESS);
++	writel(readl(otp->base[OTPRX] + OTP_CONTROL_2) | OTP_READ,
++	       otp->base[OTPRX] + OTP_CONTROL_2);
++	writel(readl(otp->base[OTPRX] + OTP_CONTROL_2) & SEL_BAK_KEY2_MASK & SW_TRIM_EN_MASK
++	       & SEL_BAK_KEY_MASK & OTP_LOAD_SECURE_DATA_MASK & OTP_DO_CRC_MASK,
++	       otp->base[OTPRX] + OTP_CONTROL_2);
++	writel((readl(otp->base[OTPRX] + OTP_CONTROL_2) & OTP_RD_PERIOD_MASK) | CPU_CLOCK,
++	       otp->base[OTPRX] + OTP_CONTROL_2);
++
++	ret = readl_poll_timeout(otp->base[OTPRX] + OTP_STATUS, status,
++				 status & OTP_READ_DONE, 10, OTP_READ_TIMEOUT_US);
++
++	if (ret < 0)
++		return ret;
++
++	*value = (readl(otp->base[HB_GPIO] + ADDRESS_8_DATA + addr_data * OTP_WORD_SIZE)
++		  >> (8 * byte_shift)) & 0xff;
++
++	return ret;
++}
++
++static int sp_ocotp_read(void *priv, unsigned int offset, void *value, size_t bytes)
++{
++	struct sp_ocotp_priv *otp = priv;
++	unsigned int addr;
++	char *buf = value;
++	char val[4];
++	int ret;
++
++	ret = clk_enable(otp->clk);
++	if (ret)
++		return ret;
++
++	*buf = 0;
++	for (addr = offset; addr < (offset + bytes); addr++) {
++		ret = sp_otp_read_real(otp, addr, val);
++		if (ret < 0) {
++			dev_err(otp->dev, "OTP read fail:%d at %d", ret, addr);
++			goto disable_clk;
++		}
++
++		*buf++ = *val;
++	}
++
++disable_clk:
++	clk_disable(otp->clk);
++
++	return ret;
++}
++
++static struct nvmem_config sp_ocotp_nvmem_config = {
++	.name = "sp-ocotp",
++	.read_only = true,
++	.word_size = 1,
++	.size = QAC628_OTP_SIZE,
++	.stride = 1,
++	.reg_read = sp_ocotp_read,
++	.owner = THIS_MODULE,
++};
++
++static int sp_ocotp_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct nvmem_device *nvmem;
++	struct sp_ocotp_priv *otp;
++	struct resource *res;
++	int ret;
++
++	otp = devm_kzalloc(dev, sizeof(*otp), GFP_KERNEL);
++	if (!otp)
++		return -ENOMEM;
++
++	otp->dev = dev;
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "hb_gpio");
++	otp->base[HB_GPIO] = devm_ioremap_resource(dev, res);
++	if (IS_ERR(otp->base[HB_GPIO]))
++		return PTR_ERR(otp->base[HB_GPIO]);
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "otprx");
++	otp->base[OTPRX] = devm_ioremap_resource(dev, res);
++	if (IS_ERR(otp->base[OTPRX]))
++		return PTR_ERR(otp->base[OTPRX]);
++
++	otp->clk = devm_clk_get(&pdev->dev, NULL);
++	if (IS_ERR(otp->clk))
++		return dev_err_probe(&pdev->dev, PTR_ERR(otp->clk),
++						"devm_clk_get fail\n");
++
++	ret = clk_prepare(otp->clk);
++	if (ret < 0) {
++		dev_err(dev, "failed to prepare clk: %d\n", ret);
++		return ret;
++	}
++
++	sp_ocotp_nvmem_config.priv = otp;
++	sp_ocotp_nvmem_config.dev = dev;
++
++	nvmem = devm_nvmem_register(dev, &sp_ocotp_nvmem_config);
++	if (IS_ERR(nvmem))
++		return dev_err_probe(&pdev->dev, PTR_ERR(nvmem),
++						"register nvmem device fail\n");
++
++	platform_set_drvdata(pdev, nvmem);
++
++	dev_dbg(dev, "banks:%d x wpb:%d x wsize:%d = %d",
++		(int)QAC628_OTP_NUM_BANKS, (int)OTP_WORDS_PER_BANK,
++		(int)OTP_WORD_SIZE, (int)QAC628_OTP_SIZE);
++
++	dev_info(dev, "by Sunplus (C) 2020");
++
++	return 0;
++}
++
++static const struct of_device_id sp_ocotp_dt_ids[] = {
++	{ .compatible = "sunplus,sp7021-ocotp", .data = &sp_otp_v0 },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, sp_ocotp_dt_ids);
++
++static struct platform_driver sp_otp_driver = {
++	.probe     = sp_ocotp_probe,
++	.driver    = {
++		.name           = "sunplus,sp7021-ocotp",
++		.of_match_table = sp_ocotp_dt_ids,
++	}
++};
++module_platform_driver(sp_otp_driver);
++
++MODULE_AUTHOR("Vincent Shih <vincent.sunplus@gmail.com>");
++MODULE_DESCRIPTION("Sunplus On-Chip OTP driver");
++MODULE_LICENSE("GPL");
++
diff --git a/target/linux/generic/backport-5.15/804-v5.18-0010-nvmem-brcm_nvram-parse-NVRAM-content-into-NVMEM-cell.patch b/target/linux/generic/backport-5.15/804-v5.18-0010-nvmem-brcm_nvram-parse-NVRAM-content-into-NVMEM-cell.patch
new file mode 100644
index 00000000000000..99781b3a7b3a79
--- /dev/null
+++ b/target/linux/generic/backport-5.15/804-v5.18-0010-nvmem-brcm_nvram-parse-NVRAM-content-into-NVMEM-cell.patch
@@ -0,0 +1,146 @@
+From 6e977eaa8280e957b87904b536661550f2a6b3e8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 25 Feb 2022 17:58:20 +0000
+Subject: [PATCH] nvmem: brcm_nvram: parse NVRAM content into NVMEM cells
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+NVRAM consist of header and NUL separated key-value pairs. Parse it and
+create NVMEM cell for every key-value entry.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220225175822.8293-3-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/brcm_nvram.c | 90 ++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 90 insertions(+)
+
+--- a/drivers/nvmem/brcm_nvram.c
++++ b/drivers/nvmem/brcm_nvram.c
+@@ -6,12 +6,26 @@
+ #include <linux/io.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/module.h>
++#include <linux/nvmem-consumer.h>
+ #include <linux/nvmem-provider.h>
+ #include <linux/platform_device.h>
++#include <linux/slab.h>
++
++#define NVRAM_MAGIC			"FLSH"
+ 
+ struct brcm_nvram {
+ 	struct device *dev;
+ 	void __iomem *base;
++	struct nvmem_cell_info *cells;
++	int ncells;
++};
++
++struct brcm_nvram_header {
++	char magic[4];
++	__le32 len;
++	__le32 crc_ver_init;	/* 0:7 crc, 8:15 ver, 16:31 sdram_init */
++	__le32 config_refresh;	/* 0:15 sdram_config, 16:31 sdram_refresh */
++	__le32 config_ncdl;	/* ncdl values for memc */
+ };
+ 
+ static int brcm_nvram_read(void *context, unsigned int offset, void *val,
+@@ -26,6 +40,75 @@ static int brcm_nvram_read(void *context
+ 	return 0;
+ }
+ 
++static int brcm_nvram_add_cells(struct brcm_nvram *priv, uint8_t *data,
++				size_t len)
++{
++	struct device *dev = priv->dev;
++	char *var, *value, *eq;
++	int idx;
++
++	priv->ncells = 0;
++	for (var = data + sizeof(struct brcm_nvram_header);
++	     var < (char *)data + len && *var;
++	     var += strlen(var) + 1) {
++		priv->ncells++;
++	}
++
++	priv->cells = devm_kcalloc(dev, priv->ncells, sizeof(*priv->cells), GFP_KERNEL);
++	if (!priv->cells)
++		return -ENOMEM;
++
++	for (var = data + sizeof(struct brcm_nvram_header), idx = 0;
++	     var < (char *)data + len && *var;
++	     var = value + strlen(value) + 1, idx++) {
++		eq = strchr(var, '=');
++		if (!eq)
++			break;
++		*eq = '\0';
++		value = eq + 1;
++
++		priv->cells[idx].name = devm_kstrdup(dev, var, GFP_KERNEL);
++		if (!priv->cells[idx].name)
++			return -ENOMEM;
++		priv->cells[idx].offset = value - (char *)data;
++		priv->cells[idx].bytes = strlen(value);
++	}
++
++	return 0;
++}
++
++static int brcm_nvram_parse(struct brcm_nvram *priv)
++{
++	struct device *dev = priv->dev;
++	struct brcm_nvram_header header;
++	uint8_t *data;
++	size_t len;
++	int err;
++
++	memcpy_fromio(&header, priv->base, sizeof(header));
++
++	if (memcmp(header.magic, NVRAM_MAGIC, 4)) {
++		dev_err(dev, "Invalid NVRAM magic\n");
++		return -EINVAL;
++	}
++
++	len = le32_to_cpu(header.len);
++
++	data = kcalloc(1, len, GFP_KERNEL);
++	memcpy_fromio(data, priv->base, len);
++	data[len - 1] = '\0';
++
++	err = brcm_nvram_add_cells(priv, data, len);
++	if (err) {
++		dev_err(dev, "Failed to add cells: %d\n", err);
++		return err;
++	}
++
++	kfree(data);
++
++	return 0;
++}
++
+ static int brcm_nvram_probe(struct platform_device *pdev)
+ {
+ 	struct nvmem_config config = {
+@@ -35,6 +118,7 @@ static int brcm_nvram_probe(struct platf
+ 	struct device *dev = &pdev->dev;
+ 	struct resource *res;
+ 	struct brcm_nvram *priv;
++	int err;
+ 
+ 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+ 	if (!priv)
+@@ -46,7 +130,13 @@ static int brcm_nvram_probe(struct platf
+ 	if (IS_ERR(priv->base))
+ 		return PTR_ERR(priv->base);
+ 
++	err = brcm_nvram_parse(priv);
++	if (err)
++		return err;
++
+ 	config.dev = dev;
++	config.cells = priv->cells;
++	config.ncells = priv->ncells;
+ 	config.priv = priv;
+ 	config.size = resource_size(res);
+ 
diff --git a/target/linux/generic/backport-5.15/805-v5.19-0001-nvmem-bcm-ocotp-mark-ACPI-device-ID-table-as-maybe-u.patch b/target/linux/generic/backport-5.15/805-v5.19-0001-nvmem-bcm-ocotp-mark-ACPI-device-ID-table-as-maybe-u.patch
new file mode 100644
index 00000000000000..ef3107db946c4f
--- /dev/null
+++ b/target/linux/generic/backport-5.15/805-v5.19-0001-nvmem-bcm-ocotp-mark-ACPI-device-ID-table-as-maybe-u.patch
@@ -0,0 +1,32 @@
+From 6bd0ffeaa389866089e9573b2298ae58d6359b75 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Mon, 21 Mar 2022 12:03:24 +0100
+Subject: [PATCH] nvmem: bcm-ocotp: mark ACPI device ID table as maybe unused
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+"bcm_otpc_acpi_ids" is used with ACPI_PTR, so a build with !CONFIG_ACPI
+has a warning:
+
+  drivers/nvmem/bcm-ocotp.c:247:36: error:
+    ‘bcm_otpc_acpi_ids’ defined but not used [-Werror=unused-const-variable=]
+
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20220321110326.44652-1-krzk@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/bcm-ocotp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/bcm-ocotp.c
++++ b/drivers/nvmem/bcm-ocotp.c
+@@ -244,7 +244,7 @@ static const struct of_device_id bcm_otp
+ };
+ MODULE_DEVICE_TABLE(of, bcm_otpc_dt_ids);
+ 
+-static const struct acpi_device_id bcm_otpc_acpi_ids[] = {
++static const struct acpi_device_id bcm_otpc_acpi_ids[] __maybe_unused = {
+ 	{ .id = "BRCM0700", .driver_data = (kernel_ulong_t)&otp_map },
+ 	{ .id = "BRCM0701", .driver_data = (kernel_ulong_t)&otp_map_v2 },
+ 	{ /* sentinel */ }
diff --git a/target/linux/generic/backport-5.15/805-v5.19-0002-nvmem-sunplus-ocotp-staticize-sp_otp_v0.patch b/target/linux/generic/backport-5.15/805-v5.19-0002-nvmem-sunplus-ocotp-staticize-sp_otp_v0.patch
new file mode 100644
index 00000000000000..a84d2316f0cce9
--- /dev/null
+++ b/target/linux/generic/backport-5.15/805-v5.19-0002-nvmem-sunplus-ocotp-staticize-sp_otp_v0.patch
@@ -0,0 +1,30 @@
+From 1066f8156351fcd997125257cea47cf805ba4f6d Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Mon, 21 Mar 2022 12:03:25 +0100
+Subject: [PATCH] nvmem: sunplus-ocotp: staticize sp_otp_v0
+
+The "sp_otp_v0" file scope variable is not used outside, so make it
+static to fix warning:
+
+  drivers/nvmem/sunplus-ocotp.c:74:29: sparse:
+    sparse: symbol 'sp_otp_v0' was not declared. Should it be static?
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20220321110326.44652-2-krzk@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/sunplus-ocotp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/sunplus-ocotp.c
++++ b/drivers/nvmem/sunplus-ocotp.c
+@@ -71,7 +71,7 @@ struct sp_ocotp_data {
+ 	int size;
+ };
+ 
+-const struct sp_ocotp_data  sp_otp_v0 = {
++static const struct sp_ocotp_data sp_otp_v0 = {
+ 	.size = QAC628_OTP_SIZE,
+ };
+ 
diff --git a/target/linux/generic/backport-5.15/805-v5.19-0003-nvmem-sunplus-ocotp-drop-useless-probe-confirmation.patch b/target/linux/generic/backport-5.15/805-v5.19-0003-nvmem-sunplus-ocotp-drop-useless-probe-confirmation.patch
new file mode 100644
index 00000000000000..886ebc12a9c916
--- /dev/null
+++ b/target/linux/generic/backport-5.15/805-v5.19-0003-nvmem-sunplus-ocotp-drop-useless-probe-confirmation.patch
@@ -0,0 +1,27 @@
+From 874dfbcf219ccc42a2cbd187d087c7db82c3024b Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Mon, 21 Mar 2022 12:03:26 +0100
+Subject: [PATCH] nvmem: sunplus-ocotp: drop useless probe confirmation
+
+Printing probe success is discouraged, because we can use tracing for
+this purpose.  Remove useless print message after Sunplus OCOTP driver
+probe.
+
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20220321110326.44652-3-krzk@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/sunplus-ocotp.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/nvmem/sunplus-ocotp.c
++++ b/drivers/nvmem/sunplus-ocotp.c
+@@ -202,8 +202,6 @@ static int sp_ocotp_probe(struct platfor
+ 		(int)QAC628_OTP_NUM_BANKS, (int)OTP_WORDS_PER_BANK,
+ 		(int)OTP_WORD_SIZE, (int)QAC628_OTP_SIZE);
+ 
+-	dev_info(dev, "by Sunplus (C) 2020");
+-
+ 	return 0;
+ }
+ 
diff --git a/target/linux/generic/backport-5.15/805-v5.19-0004-nvmem-core-support-passing-DT-node-in-cell-info.patch b/target/linux/generic/backport-5.15/805-v5.19-0004-nvmem-core-support-passing-DT-node-in-cell-info.patch
new file mode 100644
index 00000000000000..3b1e76147a8b5d
--- /dev/null
+++ b/target/linux/generic/backport-5.15/805-v5.19-0004-nvmem-core-support-passing-DT-node-in-cell-info.patch
@@ -0,0 +1,41 @@
+From dbc2f62061c6bfba0aee93161ee3194dcee84bd0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 29 Apr 2022 17:26:46 +0100
+Subject: [PATCH] nvmem: core: support passing DT node in cell info
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Some hardware may have NVMEM cells described in Device Tree using
+individual nodes. Let drivers pass such nodes to the NVMEM subsystem so
+they can be later used by NVMEM consumers.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220429162701.2222-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c           | 1 +
+ include/linux/nvmem-consumer.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -467,6 +467,7 @@ static int nvmem_cell_info_to_nvmem_cell
+ 
+ 	cell->bit_offset = info->bit_offset;
+ 	cell->nbits = info->nbits;
++	cell->np = info->np;
+ 
+ 	if (cell->nbits)
+ 		cell->bytes = DIV_ROUND_UP(cell->nbits + cell->bit_offset,
+--- a/include/linux/nvmem-consumer.h
++++ b/include/linux/nvmem-consumer.h
+@@ -25,6 +25,7 @@ struct nvmem_cell_info {
+ 	unsigned int		bytes;
+ 	unsigned int		bit_offset;
+ 	unsigned int		nbits;
++	struct device_node	*np;
+ };
+ 
+ /**
diff --git a/target/linux/generic/backport-5.15/805-v5.19-0005-nvmem-brcm_nvram-find-Device-Tree-nodes-for-NVMEM-ce.patch b/target/linux/generic/backport-5.15/805-v5.19-0005-nvmem-brcm_nvram-find-Device-Tree-nodes-for-NVMEM-ce.patch
new file mode 100644
index 00000000000000..a9eacd9419cb2c
--- /dev/null
+++ b/target/linux/generic/backport-5.15/805-v5.19-0005-nvmem-brcm_nvram-find-Device-Tree-nodes-for-NVMEM-ce.patch
@@ -0,0 +1,38 @@
+From 207775f7e17b8fd0426a2ac4a5b81e4e1d71849e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 29 Apr 2022 17:26:47 +0100
+Subject: [PATCH] nvmem: brcm_nvram: find Device Tree nodes for NVMEM cells
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+DT binding for Broadcom's NVRAM supports specifying NVMEM cells as NVMEM
+device (provider) subnodes. Look for such subnodes when collecing NVMEM
+cells. This allows NVMEM consumers to use NVRAM variables.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220429162701.2222-3-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/brcm_nvram.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/nvmem/brcm_nvram.c
++++ b/drivers/nvmem/brcm_nvram.c
+@@ -8,6 +8,7 @@
+ #include <linux/module.h>
+ #include <linux/nvmem-consumer.h>
+ #include <linux/nvmem-provider.h>
++#include <linux/of.h>
+ #include <linux/platform_device.h>
+ #include <linux/slab.h>
+ 
+@@ -72,6 +73,7 @@ static int brcm_nvram_add_cells(struct b
+ 			return -ENOMEM;
+ 		priv->cells[idx].offset = value - (char *)data;
+ 		priv->cells[idx].bytes = strlen(value);
++		priv->cells[idx].np = of_get_child_by_name(dev->of_node, priv->cells[idx].name);
+ 	}
+ 
+ 	return 0;
diff --git a/target/linux/generic/backport-5.15/805-v5.19-0006-nvmem-Add-Apple-eFuse-driver.patch b/target/linux/generic/backport-5.15/805-v5.19-0006-nvmem-Add-Apple-eFuse-driver.patch
new file mode 100644
index 00000000000000..ebeb6f5ad394c2
--- /dev/null
+++ b/target/linux/generic/backport-5.15/805-v5.19-0006-nvmem-Add-Apple-eFuse-driver.patch
@@ -0,0 +1,130 @@
+From b6b7ef932ae838209254f016ecf8862d716a5ced Mon Sep 17 00:00:00 2001
+From: Sven Peter <sven@svenpeter.dev>
+Date: Fri, 29 Apr 2022 17:26:50 +0100
+Subject: [PATCH] nvmem: Add Apple eFuse driver
+
+Apple SoCs contain eFuses used to store factory-programmed data such
+as calibration values for the PCIe or the Type-C PHY. They are organized
+as 32bit values exposed as MMIO.
+
+Signed-off-by: Sven Peter <sven@svenpeter.dev>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220429162701.2222-6-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/Kconfig        | 12 ++++++
+ drivers/nvmem/Makefile       |  2 +
+ drivers/nvmem/apple-efuses.c | 80 ++++++++++++++++++++++++++++++++++++
+ 3 files changed, 94 insertions(+)
+ create mode 100644 drivers/nvmem/apple-efuses.c
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -324,4 +324,16 @@ config NVMEM_SUNPLUS_OCOTP
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called nvmem-sunplus-ocotp.
+ 
++config NVMEM_APPLE_EFUSES
++	tristate "Apple eFuse support"
++	depends on ARCH_APPLE || COMPILE_TEST
++	default ARCH_APPLE
++	help
++	  Say y here to enable support for reading eFuses on Apple SoCs
++	  such as the M1. These are e.g. used to store factory programmed
++	  calibration data required for the PCIe or the USB-C PHY.
++
++	  This driver can also be built as a module. If so, the module will
++	  be called nvmem-apple-efuses.
++
+ endif
+--- a/drivers/nvmem/Makefile
++++ b/drivers/nvmem/Makefile
+@@ -65,3 +65,5 @@ obj-$(CONFIG_NVMEM_LAYERSCAPE_SFP)	+= nv
+ nvmem-layerscape-sfp-y		:= layerscape-sfp.o
+ obj-$(CONFIG_NVMEM_SUNPLUS_OCOTP)	+= nvmem_sunplus_ocotp.o
+ nvmem_sunplus_ocotp-y		:= sunplus-ocotp.o
++obj-$(CONFIG_NVMEM_APPLE_EFUSES)	+= nvmem-apple-efuses.o
++nvmem-apple-efuses-y 		:= apple-efuses.o
+--- /dev/null
++++ b/drivers/nvmem/apple-efuses.c
+@@ -0,0 +1,80 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Apple SoC eFuse driver
++ *
++ * Copyright (C) The Asahi Linux Contributors
++ */
++
++#include <linux/io.h>
++#include <linux/mod_devicetable.h>
++#include <linux/module.h>
++#include <linux/nvmem-provider.h>
++#include <linux/platform_device.h>
++
++struct apple_efuses_priv {
++	void __iomem *fuses;
++};
++
++static int apple_efuses_read(void *context, unsigned int offset, void *val,
++			     size_t bytes)
++{
++	struct apple_efuses_priv *priv = context;
++	u32 *dst = val;
++
++	while (bytes >= sizeof(u32)) {
++		*dst++ = readl_relaxed(priv->fuses + offset);
++		bytes -= sizeof(u32);
++		offset += sizeof(u32);
++	}
++
++	return 0;
++}
++
++static int apple_efuses_probe(struct platform_device *pdev)
++{
++	struct apple_efuses_priv *priv;
++	struct resource *res;
++	struct nvmem_config config = {
++		.dev = &pdev->dev,
++		.read_only = true,
++		.reg_read = apple_efuses_read,
++		.stride = sizeof(u32),
++		.word_size = sizeof(u32),
++		.name = "apple_efuses_nvmem",
++		.id = NVMEM_DEVID_AUTO,
++		.root_only = true,
++	};
++
++	priv = devm_kzalloc(config.dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	priv->fuses = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
++	if (IS_ERR(priv->fuses))
++		return PTR_ERR(priv->fuses);
++
++	config.priv = priv;
++	config.size = resource_size(res);
++
++	return PTR_ERR_OR_ZERO(devm_nvmem_register(config.dev, &config));
++}
++
++static const struct of_device_id apple_efuses_of_match[] = {
++	{ .compatible = "apple,efuses", },
++	{}
++};
++
++MODULE_DEVICE_TABLE(of, apple_efuses_of_match);
++
++static struct platform_driver apple_efuses_driver = {
++	.driver = {
++		.name = "apple_efuses",
++		.of_match_table = apple_efuses_of_match,
++	},
++	.probe = apple_efuses_probe,
++};
++
++module_platform_driver(apple_efuses_driver);
++
++MODULE_AUTHOR("Sven Peter <sven@svenpeter.dev>");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/generic/backport-5.15/805-v5.19-0007-nvmem-qfprom-using-pm_runtime_resume_and_get-instead.patch b/target/linux/generic/backport-5.15/805-v5.19-0007-nvmem-qfprom-using-pm_runtime_resume_and_get-instead.patch
new file mode 100644
index 00000000000000..cd51d97006918f
--- /dev/null
+++ b/target/linux/generic/backport-5.15/805-v5.19-0007-nvmem-qfprom-using-pm_runtime_resume_and_get-instead.patch
@@ -0,0 +1,31 @@
+From 517f6e2641a2802dce5a5aa0d18c7d37a35678d2 Mon Sep 17 00:00:00 2001
+From: Minghao Chi <chi.minghao@zte.com.cn>
+Date: Fri, 29 Apr 2022 17:26:54 +0100
+Subject: [PATCH] nvmem: qfprom: using pm_runtime_resume_and_get instead of
+ pm_runtime_get_sync
+
+Using pm_runtime_resume_and_get is more appropriate
+for simplifing code
+
+Reported-by: Zeal Robot <zealci@zte.com.cn>
+Signed-off-by: Minghao Chi <chi.minghao@zte.com.cn>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220429162701.2222-10-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/qfprom.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/nvmem/qfprom.c
++++ b/drivers/nvmem/qfprom.c
+@@ -217,9 +217,8 @@ static int qfprom_enable_fuse_blowing(co
+ 		goto err_clk_rate_set;
+ 	}
+ 
+-	ret = pm_runtime_get_sync(priv->dev);
++	ret = pm_runtime_resume_and_get(priv->dev);
+ 	if (ret < 0) {
+-		pm_runtime_put_noidle(priv->dev);
+ 		dev_err(priv->dev, "Failed to enable power-domain\n");
+ 		goto err_reg_enable;
+ 	}
diff --git a/target/linux/generic/backport-5.15/805-v5.19-0008-nvmem-sfp-Use-regmap.patch b/target/linux/generic/backport-5.15/805-v5.19-0008-nvmem-sfp-Use-regmap.patch
new file mode 100644
index 00000000000000..e187238ca38fa1
--- /dev/null
+++ b/target/linux/generic/backport-5.15/805-v5.19-0008-nvmem-sfp-Use-regmap.patch
@@ -0,0 +1,109 @@
+From 943eadbdb11314b41eacbcc484dfb7f93e271ff4 Mon Sep 17 00:00:00 2001
+From: Sean Anderson <sean.anderson@seco.com>
+Date: Fri, 29 Apr 2022 17:27:00 +0100
+Subject: [PATCH] nvmem: sfp: Use regmap
+
+This converts the SFP driver to use regmap. This will allow easily
+supporting devices with different endians. We disallow byte-level
+access, as regmap_bulk_read doesn't support it (and it's unclear what
+the correct result would be when we have an endianness difference).
+
+Signed-off-by: Sean Anderson <sean.anderson@seco.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220429162701.2222-16-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/Kconfig          |  1 +
+ drivers/nvmem/layerscape-sfp.c | 30 ++++++++++++++++++++++--------
+ 2 files changed, 23 insertions(+), 8 deletions(-)
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -304,6 +304,7 @@ config NVMEM_LAYERSCAPE_SFP
+ 	tristate "Layerscape SFP (Security Fuse Processor) support"
+ 	depends on ARCH_LAYERSCAPE || COMPILE_TEST
+ 	depends on HAS_IOMEM
++	select REGMAP_MMIO
+ 	help
+ 	  This driver provides support to read the eFuses on Freescale
+ 	  Layerscape SoC's. For example, the vendor provides a per part
+--- a/drivers/nvmem/layerscape-sfp.c
++++ b/drivers/nvmem/layerscape-sfp.c
+@@ -13,15 +13,17 @@
+ #include <linux/nvmem-provider.h>
+ #include <linux/platform_device.h>
+ #include <linux/property.h>
++#include <linux/regmap.h>
+ 
+ #define LAYERSCAPE_SFP_OTP_OFFSET	0x0200
+ 
+ struct layerscape_sfp_priv {
+-	void __iomem *base;
++	struct regmap *regmap;
+ };
+ 
+ struct layerscape_sfp_data {
+ 	int size;
++	enum regmap_endian endian;
+ };
+ 
+ static int layerscape_sfp_read(void *context, unsigned int offset, void *val,
+@@ -29,15 +31,16 @@ static int layerscape_sfp_read(void *con
+ {
+ 	struct layerscape_sfp_priv *priv = context;
+ 
+-	memcpy_fromio(val, priv->base + LAYERSCAPE_SFP_OTP_OFFSET + offset,
+-		      bytes);
+-
+-	return 0;
++	return regmap_bulk_read(priv->regmap,
++				LAYERSCAPE_SFP_OTP_OFFSET + offset, val,
++				bytes / 4);
+ }
+ 
+ static struct nvmem_config layerscape_sfp_nvmem_config = {
+ 	.name = "fsl-sfp",
+ 	.reg_read = layerscape_sfp_read,
++	.word_size = 4,
++	.stride = 4,
+ };
+ 
+ static int layerscape_sfp_probe(struct platform_device *pdev)
+@@ -45,16 +48,26 @@ static int layerscape_sfp_probe(struct p
+ 	const struct layerscape_sfp_data *data;
+ 	struct layerscape_sfp_priv *priv;
+ 	struct nvmem_device *nvmem;
++	struct regmap_config config = { 0 };
++	void __iomem *base;
+ 
+ 	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+ 	if (!priv)
+ 		return -ENOMEM;
+ 
+-	priv->base = devm_platform_ioremap_resource(pdev, 0);
+-	if (IS_ERR(priv->base))
+-		return PTR_ERR(priv->base);
++	base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(base))
++		return PTR_ERR(base);
+ 
+ 	data = device_get_match_data(&pdev->dev);
++	config.reg_bits = 32;
++	config.reg_stride = 4;
++	config.val_bits = 32;
++	config.val_format_endian = data->endian;
++	config.max_register = LAYERSCAPE_SFP_OTP_OFFSET + data->size - 4;
++	priv->regmap = devm_regmap_init_mmio(&pdev->dev, base, &config);
++	if (IS_ERR(priv->regmap))
++		return PTR_ERR(priv->regmap);
+ 
+ 	layerscape_sfp_nvmem_config.size = data->size;
+ 	layerscape_sfp_nvmem_config.dev = &pdev->dev;
+@@ -67,6 +80,7 @@ static int layerscape_sfp_probe(struct p
+ 
+ static const struct layerscape_sfp_data ls1028a_data = {
+ 	.size = 0x88,
++	.endian = REGMAP_ENDIAN_LITTLE,
+ };
+ 
+ static const struct of_device_id layerscape_sfp_dt_ids[] = {
diff --git a/target/linux/generic/backport-5.15/805-v5.19-0009-nvmem-sfp-Add-support-for-TA-2.1-devices.patch b/target/linux/generic/backport-5.15/805-v5.19-0009-nvmem-sfp-Add-support-for-TA-2.1-devices.patch
new file mode 100644
index 00000000000000..ee000986181a9c
--- /dev/null
+++ b/target/linux/generic/backport-5.15/805-v5.19-0009-nvmem-sfp-Add-support-for-TA-2.1-devices.patch
@@ -0,0 +1,38 @@
+From 33a1c6618677fe33f8e84cb7bedc45abbce89a50 Mon Sep 17 00:00:00 2001
+From: Sean Anderson <sean.anderson@seco.com>
+Date: Fri, 29 Apr 2022 17:27:01 +0100
+Subject: [PATCH] nvmem: sfp: Add support for TA 2.1 devices
+
+This adds support for Trust Architecture (TA) 2.1 devices to the SFP driver.
+There are few differences between TA 2.1 and TA 3.0, especially for
+read-only support, so just re-use the existing data.
+
+Signed-off-by: Sean Anderson <sean.anderson@seco.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220429162701.2222-17-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/layerscape-sfp.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/nvmem/layerscape-sfp.c
++++ b/drivers/nvmem/layerscape-sfp.c
+@@ -78,12 +78,18 @@ static int layerscape_sfp_probe(struct p
+ 	return PTR_ERR_OR_ZERO(nvmem);
+ }
+ 
++static const struct layerscape_sfp_data ls1021a_data = {
++	.size = 0x88,
++	.endian = REGMAP_ENDIAN_BIG,
++};
++
+ static const struct layerscape_sfp_data ls1028a_data = {
+ 	.size = 0x88,
+ 	.endian = REGMAP_ENDIAN_LITTLE,
+ };
+ 
+ static const struct of_device_id layerscape_sfp_dt_ids[] = {
++	{ .compatible = "fsl,ls1021a-sfp", .data = &ls1021a_data },
+ 	{ .compatible = "fsl,ls1028a-sfp", .data = &ls1028a_data },
+ 	{},
+ };
diff --git a/target/linux/generic/backport-5.15/806-v6.0-0001-nvmem-microchip-otpc-add-support.patch b/target/linux/generic/backport-5.15/806-v6.0-0001-nvmem-microchip-otpc-add-support.patch
new file mode 100644
index 00000000000000..ad0460d4f36fdf
--- /dev/null
+++ b/target/linux/generic/backport-5.15/806-v6.0-0001-nvmem-microchip-otpc-add-support.patch
@@ -0,0 +1,389 @@
+From 98830350d3fc824c1ff5c338140fe20f041a5916 Mon Sep 17 00:00:00 2001
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+Date: Wed, 6 Jul 2022 11:06:22 +0100
+Subject: [PATCH] nvmem: microchip-otpc: add support
+
+Add support for Microchip OTP controller available on SAMA7G5. The OTPC
+controls the access to a non-volatile memory. The memory behind OTPC is
+organized into packets, packets are composed by a fixed length header
+(4 bytes long) and a variable length payload (payload length is available
+in the header). When software request the data at an offset in memory
+the OTPC will return (via header + data registers) the whole packet that
+has a word at that offset. For the OTP memory layout like below:
+
+offset  OTP Memory layout
+
+         .           .
+         .    ...    .
+         .           .
+0x0E     +-----------+	<--- packet X
+         | header  X |
+0x12     +-----------+
+         | payload X |
+0x16     |           |
+         |           |
+0x1A     |           |
+         +-----------+
+         .           .
+         .    ...    .
+         .           .
+
+if user requests data at address 0x16 the data started at 0x0E will be
+returned by controller. User will be able to fetch the whole packet
+starting at 0x0E (or parts of the packet) via proper registers. The same
+packet will be returned if software request the data at offset 0x0E or
+0x12 or 0x1A.
+
+The OTP will be populated by Microchip with at least 2 packets first one
+being boot configuration packet and the 2nd one being temperature
+calibration packet. The packet order will be preserved b/w different chip
+revisions but the packet sizes may change.
+
+For the above reasons and to keep the same software able to work on all
+chip variants the read function of the driver is working with a packet
+id instead of an offset in OTP memory.
+
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220706100627.6534-3-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ MAINTAINERS                    |   8 +
+ drivers/nvmem/Kconfig          |   7 +
+ drivers/nvmem/Makefile         |   2 +
+ drivers/nvmem/microchip-otpc.c | 288 +++++++++++++++++++++++++++++++++
+ 4 files changed, 305 insertions(+)
+ create mode 100644 drivers/nvmem/microchip-otpc.c
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -12364,6 +12364,14 @@ S:	Supported
+ F:	Documentation/devicetree/bindings/mtd/atmel-nand.txt
+ F:	drivers/mtd/nand/raw/atmel/*
+ 
++MICROCHIP OTPC DRIVER
++M:	Claudiu Beznea <claudiu.beznea@microchip.com>
++L:	linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
++S:	Supported
++F:	Documentation/devicetree/bindings/nvmem/microchip,sama7g5-otpc.yaml
++F:	drivers/nvmem/microchip-otpc.c
++F:	dt-bindings/nvmem/microchip,sama7g5-otpc.h
++
+ MICROCHIP PWM DRIVER
+ M:	Claudiu Beznea <claudiu.beznea@microchip.com>
+ L:	linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -107,6 +107,13 @@ config MTK_EFUSE
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called efuse-mtk.
+ 
++config MICROCHIP_OTPC
++	tristate "Microchip OTPC support"
++	depends on ARCH_AT91 || COMPILE_TEST
++	help
++	  This driver enable the OTP controller available on Microchip SAMA7G5
++	  SoCs. It controlls the access to the OTP memory connected to it.
++
+ config NVMEM_NINTENDO_OTP
+ 	tristate "Nintendo Wii and Wii U OTP Support"
+ 	depends on WII || COMPILE_TEST
+--- a/drivers/nvmem/Makefile
++++ b/drivers/nvmem/Makefile
+@@ -67,3 +67,5 @@ obj-$(CONFIG_NVMEM_SUNPLUS_OCOTP)	+= nvm
+ nvmem_sunplus_ocotp-y		:= sunplus-ocotp.o
+ obj-$(CONFIG_NVMEM_APPLE_EFUSES)	+= nvmem-apple-efuses.o
+ nvmem-apple-efuses-y 		:= apple-efuses.o
++obj-$(CONFIG_MICROCHIP_OTPC)	+= nvmem-microchip-otpc.o
++nvmem-microchip-otpc-y		:= microchip-otpc.o
+--- /dev/null
++++ b/drivers/nvmem/microchip-otpc.c
+@@ -0,0 +1,288 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * OTP Memory controller
++ *
++ * Copyright (C) 2022 Microchip Technology Inc. and its subsidiaries
++ *
++ * Author: Claudiu Beznea <claudiu.beznea@microchip.com>
++ */
++
++#include <linux/bitfield.h>
++#include <linux/iopoll.h>
++#include <linux/module.h>
++#include <linux/nvmem-provider.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++
++#define MCHP_OTPC_CR			(0x0)
++#define MCHP_OTPC_CR_READ		BIT(6)
++#define MCHP_OTPC_MR			(0x4)
++#define MCHP_OTPC_MR_ADDR		GENMASK(31, 16)
++#define MCHP_OTPC_AR			(0x8)
++#define MCHP_OTPC_SR			(0xc)
++#define MCHP_OTPC_SR_READ		BIT(6)
++#define MCHP_OTPC_HR			(0x20)
++#define MCHP_OTPC_HR_SIZE		GENMASK(15, 8)
++#define MCHP_OTPC_DR			(0x24)
++
++#define MCHP_OTPC_NAME			"mchp-otpc"
++#define MCHP_OTPC_SIZE			(11 * 1024)
++
++/**
++ * struct mchp_otpc - OTPC private data structure
++ * @base: base address
++ * @dev: struct device pointer
++ * @packets: list of packets in OTP memory
++ * @npackets: number of packets in OTP memory
++ */
++struct mchp_otpc {
++	void __iomem *base;
++	struct device *dev;
++	struct list_head packets;
++	u32 npackets;
++};
++
++/**
++ * struct mchp_otpc_packet - OTPC packet data structure
++ * @list: list head
++ * @id: packet ID
++ * @offset: packet offset (in words) in OTP memory
++ */
++struct mchp_otpc_packet {
++	struct list_head list;
++	u32 id;
++	u32 offset;
++};
++
++static struct mchp_otpc_packet *mchp_otpc_id_to_packet(struct mchp_otpc *otpc,
++						       u32 id)
++{
++	struct mchp_otpc_packet *packet;
++
++	if (id >= otpc->npackets)
++		return NULL;
++
++	list_for_each_entry(packet, &otpc->packets, list) {
++		if (packet->id == id)
++			return packet;
++	}
++
++	return NULL;
++}
++
++static int mchp_otpc_prepare_read(struct mchp_otpc *otpc,
++				  unsigned int offset)
++{
++	u32 tmp;
++
++	/* Set address. */
++	tmp = readl_relaxed(otpc->base + MCHP_OTPC_MR);
++	tmp &= ~MCHP_OTPC_MR_ADDR;
++	tmp |= FIELD_PREP(MCHP_OTPC_MR_ADDR, offset);
++	writel_relaxed(tmp, otpc->base + MCHP_OTPC_MR);
++
++	/* Set read. */
++	tmp = readl_relaxed(otpc->base + MCHP_OTPC_CR);
++	tmp |= MCHP_OTPC_CR_READ;
++	writel_relaxed(tmp, otpc->base + MCHP_OTPC_CR);
++
++	/* Wait for packet to be transferred into temporary buffers. */
++	return read_poll_timeout(readl_relaxed, tmp, !(tmp & MCHP_OTPC_SR_READ),
++				 10000, 2000, false, otpc->base + MCHP_OTPC_SR);
++}
++
++/*
++ * OTPC memory is organized into packets. Each packets contains a header and
++ * a payload. Header is 4 bytes long and contains the size of the payload.
++ * Payload size varies. The memory footprint is something as follows:
++ *
++ * Memory offset  Memory footprint     Packet ID
++ * -------------  ----------------     ---------
++ *
++ * 0x0            +------------+   <-- packet 0
++ *                | header  0  |
++ * 0x4            +------------+
++ *                | payload 0  |
++ *                .            .
++ *                .    ...     .
++ *                .            .
++ * offset1        +------------+   <-- packet 1
++ *                | header  1  |
++ * offset1 + 0x4  +------------+
++ *                | payload 1  |
++ *                .            .
++ *                .    ...     .
++ *                .            .
++ * offset2        +------------+   <-- packet 2
++ *                .            .
++ *                .    ...     .
++ *                .            .
++ * offsetN        +------------+   <-- packet N
++ *                | header  N  |
++ * offsetN + 0x4  +------------+
++ *                | payload N  |
++ *                .            .
++ *                .    ...     .
++ *                .            .
++ *                +------------+
++ *
++ * where offset1, offset2, offsetN depends on the size of payload 0, payload 1,
++ * payload N-1.
++ *
++ * The access to memory is done on a per packet basis: the control registers
++ * need to be updated with an offset address (within a packet range) and the
++ * data registers will be update by controller with information contained by
++ * that packet. E.g. if control registers are updated with any address within
++ * the range [offset1, offset2) the data registers are updated by controller
++ * with packet 1. Header data is accessible though MCHP_OTPC_HR register.
++ * Payload data is accessible though MCHP_OTPC_DR and MCHP_OTPC_AR registers.
++ * There is no direct mapping b/w the offset requested by software and the
++ * offset returned by hardware.
++ *
++ * For this, the read function will return the first requested bytes in the
++ * packet. The user will have to be aware of the memory footprint before doing
++ * the read request.
++ */
++static int mchp_otpc_read(void *priv, unsigned int off, void *val,
++			  size_t bytes)
++{
++	struct mchp_otpc *otpc = priv;
++	struct mchp_otpc_packet *packet;
++	u32 *buf = val;
++	u32 offset;
++	size_t len = 0;
++	int ret, payload_size;
++
++	/*
++	 * We reach this point with off being multiple of stride = 4 to
++	 * be able to cross the subsystem. Inside the driver we use continuous
++	 * unsigned integer numbers for packet id, thus devide off by 4
++	 * before passing it to mchp_otpc_id_to_packet().
++	 */
++	packet = mchp_otpc_id_to_packet(otpc, off / 4);
++	if (!packet)
++		return -EINVAL;
++	offset = packet->offset;
++
++	while (len < bytes) {
++		ret = mchp_otpc_prepare_read(otpc, offset);
++		if (ret)
++			return ret;
++
++		/* Read and save header content. */
++		*buf++ = readl_relaxed(otpc->base + MCHP_OTPC_HR);
++		len += sizeof(*buf);
++		offset++;
++		if (len >= bytes)
++			break;
++
++		/* Read and save payload content. */
++		payload_size = FIELD_GET(MCHP_OTPC_HR_SIZE, *(buf - 1));
++		writel_relaxed(0UL, otpc->base + MCHP_OTPC_AR);
++		do {
++			*buf++ = readl_relaxed(otpc->base + MCHP_OTPC_DR);
++			len += sizeof(*buf);
++			offset++;
++			payload_size--;
++		} while (payload_size >= 0 && len < bytes);
++	}
++
++	return 0;
++}
++
++static int mchp_otpc_init_packets_list(struct mchp_otpc *otpc, u32 *size)
++{
++	struct mchp_otpc_packet *packet;
++	u32 word, word_pos = 0, id = 0, npackets = 0, payload_size;
++	int ret;
++
++	INIT_LIST_HEAD(&otpc->packets);
++	*size = 0;
++
++	while (*size < MCHP_OTPC_SIZE) {
++		ret = mchp_otpc_prepare_read(otpc, word_pos);
++		if (ret)
++			return ret;
++
++		word = readl_relaxed(otpc->base + MCHP_OTPC_HR);
++		payload_size = FIELD_GET(MCHP_OTPC_HR_SIZE, word);
++		if (!payload_size)
++			break;
++
++		packet = devm_kzalloc(otpc->dev, sizeof(*packet), GFP_KERNEL);
++		if (!packet)
++			return -ENOMEM;
++
++		packet->id = id++;
++		packet->offset = word_pos;
++		INIT_LIST_HEAD(&packet->list);
++		list_add_tail(&packet->list, &otpc->packets);
++
++		/* Count size by adding header and paload sizes. */
++		*size += 4 * (payload_size + 1);
++		/* Next word: this packet (header, payload) position + 1. */
++		word_pos += payload_size + 2;
++
++		npackets++;
++	}
++
++	otpc->npackets = npackets;
++
++	return 0;
++}
++
++static struct nvmem_config mchp_nvmem_config = {
++	.name = MCHP_OTPC_NAME,
++	.type = NVMEM_TYPE_OTP,
++	.read_only = true,
++	.word_size = 4,
++	.stride = 4,
++	.reg_read = mchp_otpc_read,
++};
++
++static int mchp_otpc_probe(struct platform_device *pdev)
++{
++	struct nvmem_device *nvmem;
++	struct mchp_otpc *otpc;
++	u32 size;
++	int ret;
++
++	otpc = devm_kzalloc(&pdev->dev, sizeof(*otpc), GFP_KERNEL);
++	if (!otpc)
++		return -ENOMEM;
++
++	otpc->base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(otpc->base))
++		return PTR_ERR(otpc->base);
++
++	otpc->dev = &pdev->dev;
++	ret = mchp_otpc_init_packets_list(otpc, &size);
++	if (ret)
++		return ret;
++
++	mchp_nvmem_config.dev = otpc->dev;
++	mchp_nvmem_config.size = size;
++	mchp_nvmem_config.priv = otpc;
++	nvmem = devm_nvmem_register(&pdev->dev, &mchp_nvmem_config);
++
++	return PTR_ERR_OR_ZERO(nvmem);
++}
++
++static const struct of_device_id __maybe_unused mchp_otpc_ids[] = {
++	{ .compatible = "microchip,sama7g5-otpc", },
++	{ },
++};
++MODULE_DEVICE_TABLE(of, mchp_otpc_ids);
++
++static struct platform_driver mchp_otpc_driver = {
++	.probe = mchp_otpc_probe,
++	.driver = {
++		.name = MCHP_OTPC_NAME,
++		.of_match_table = of_match_ptr(mchp_otpc_ids),
++	},
++};
++module_platform_driver(mchp_otpc_driver);
++
++MODULE_AUTHOR("Claudiu Beznea <claudiu.beznea@microchip.com>");
++MODULE_DESCRIPTION("Microchip SAMA7G5 OTPC driver");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/generic/backport-5.15/806-v6.0-0002-nvmem-mtk-efuse-Simplify-with-devm_platform_get_and_.patch b/target/linux/generic/backport-5.15/806-v6.0-0002-nvmem-mtk-efuse-Simplify-with-devm_platform_get_and_.patch
new file mode 100644
index 00000000000000..6a4126b9deda99
--- /dev/null
+++ b/target/linux/generic/backport-5.15/806-v6.0-0002-nvmem-mtk-efuse-Simplify-with-devm_platform_get_and_.patch
@@ -0,0 +1,32 @@
+From f5c97da8037b18d1256a58459fa96ed68e50fb41 Mon Sep 17 00:00:00 2001
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Date: Wed, 6 Jul 2022 11:06:27 +0100
+Subject: [PATCH] nvmem: mtk-efuse: Simplify with
+ devm_platform_get_and_ioremap_resource()
+
+Convert platform_get_resource(), devm_ioremap_resource() to a single
+call to devm_platform_get_and_ioremap_resource(), as this is exactly
+what this function does.
+
+No functional changes.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220706100627.6534-8-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/mtk-efuse.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/nvmem/mtk-efuse.c
++++ b/drivers/nvmem/mtk-efuse.c
+@@ -41,8 +41,7 @@ static int mtk_efuse_probe(struct platfo
+ 	if (!priv)
+ 		return -ENOMEM;
+ 
+-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	priv->base = devm_ioremap_resource(dev, res);
++	priv->base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
+ 	if (IS_ERR(priv->base))
+ 		return PTR_ERR(priv->base);
+ 
diff --git a/target/linux/generic/backport-5.15/807-v6.1-0002-nvmem-add-driver-handling-U-Boot-environment-variabl.patch b/target/linux/generic/backport-5.15/807-v6.1-0002-nvmem-add-driver-handling-U-Boot-environment-variabl.patch
new file mode 100644
index 00000000000000..9138807bc91cd9
--- /dev/null
+++ b/target/linux/generic/backport-5.15/807-v6.1-0002-nvmem-add-driver-handling-U-Boot-environment-variabl.patch
@@ -0,0 +1,286 @@
+From d5542923f200f95bddf524f36fd495f78aa28e3c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 16 Sep 2022 13:20:48 +0100
+Subject: [PATCH] nvmem: add driver handling U-Boot environment variables
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+U-Boot stores its setup as environment variables. It's a list of
+key-value pairs stored on flash device with a custom header.
+
+This commit adds an NVMEM driver that:
+1. Provides NVMEM access to environment vars binary data
+2. Extracts variables as NVMEM cells
+
+Current Linux's NVMEM sysfs API allows reading whole NVMEM data block.
+It can be used by user-space tools for reading U-Boot env vars block
+without the hassle of finding its location. Parsing will still need to
+be re-done there.
+
+Kernel-parsed NVMEM cells can be read however by Linux drivers. This may
+be useful for Ethernet drivers for reading device MAC address which is
+often stored as U-Boot env variable.
+
+Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220916122100.170016-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ MAINTAINERS                |   1 +
+ drivers/nvmem/Kconfig      |  13 +++
+ drivers/nvmem/Makefile     |   2 +
+ drivers/nvmem/u-boot-env.c | 218 +++++++++++++++++++++++++++++++++++++
+ 4 files changed, 234 insertions(+)
+ create mode 100644 drivers/nvmem/u-boot-env.c
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -344,4 +344,17 @@ config NVMEM_APPLE_EFUSES
+ 	  This driver can also be built as a module. If so, the module will
+ 	  be called nvmem-apple-efuses.
+ 
++config NVMEM_U_BOOT_ENV
++	tristate "U-Boot environment variables support"
++	depends on OF && MTD
++	select CRC32
++	help
++	  U-Boot stores its setup as environment variables. This driver adds
++	  support for verifying & exporting such data. It also exposes variables
++	  as NVMEM cells so they can be referenced by other drivers.
++
++	  Currently this drivers works only with env variables on top of MTD.
++
++	  If compiled as module it will be called nvmem_u-boot-env.
++
+ endif
+--- a/drivers/nvmem/Makefile
++++ b/drivers/nvmem/Makefile
+@@ -69,3 +69,5 @@ obj-$(CONFIG_NVMEM_APPLE_EFUSES)	+= nvme
+ nvmem-apple-efuses-y 		:= apple-efuses.o
+ obj-$(CONFIG_MICROCHIP_OTPC)	+= nvmem-microchip-otpc.o
+ nvmem-microchip-otpc-y		:= microchip-otpc.o
++obj-$(CONFIG_NVMEM_U_BOOT_ENV)	+= nvmem_u-boot-env.o
++nvmem_u-boot-env-y		:= u-boot-env.o
+--- /dev/null
++++ b/drivers/nvmem/u-boot-env.c
+@@ -0,0 +1,218 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Copyright (C) 2022 Rafał Miłecki <rafal@milecki.pl>
++ */
++
++#include <linux/crc32.h>
++#include <linux/mod_devicetable.h>
++#include <linux/module.h>
++#include <linux/mtd/mtd.h>
++#include <linux/nvmem-consumer.h>
++#include <linux/nvmem-provider.h>
++#include <linux/of_device.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++
++enum u_boot_env_format {
++	U_BOOT_FORMAT_SINGLE,
++	U_BOOT_FORMAT_REDUNDANT,
++};
++
++struct u_boot_env {
++	struct device *dev;
++	enum u_boot_env_format format;
++
++	struct mtd_info *mtd;
++
++	/* Cells */
++	struct nvmem_cell_info *cells;
++	int ncells;
++};
++
++struct u_boot_env_image_single {
++	__le32 crc32;
++	uint8_t data[];
++} __packed;
++
++struct u_boot_env_image_redundant {
++	__le32 crc32;
++	u8 mark;
++	uint8_t data[];
++} __packed;
++
++static int u_boot_env_read(void *context, unsigned int offset, void *val,
++			   size_t bytes)
++{
++	struct u_boot_env *priv = context;
++	struct device *dev = priv->dev;
++	size_t bytes_read;
++	int err;
++
++	err = mtd_read(priv->mtd, offset, bytes, &bytes_read, val);
++	if (err && !mtd_is_bitflip(err)) {
++		dev_err(dev, "Failed to read from mtd: %d\n", err);
++		return err;
++	}
++
++	if (bytes_read != bytes) {
++		dev_err(dev, "Failed to read %zu bytes\n", bytes);
++		return -EIO;
++	}
++
++	return 0;
++}
++
++static int u_boot_env_add_cells(struct u_boot_env *priv, uint8_t *buf,
++				size_t data_offset, size_t data_len)
++{
++	struct device *dev = priv->dev;
++	char *data = buf + data_offset;
++	char *var, *value, *eq;
++	int idx;
++
++	priv->ncells = 0;
++	for (var = data; var < data + data_len && *var; var += strlen(var) + 1)
++		priv->ncells++;
++
++	priv->cells = devm_kcalloc(dev, priv->ncells, sizeof(*priv->cells), GFP_KERNEL);
++	if (!priv->cells)
++		return -ENOMEM;
++
++	for (var = data, idx = 0;
++	     var < data + data_len && *var;
++	     var = value + strlen(value) + 1, idx++) {
++		eq = strchr(var, '=');
++		if (!eq)
++			break;
++		*eq = '\0';
++		value = eq + 1;
++
++		priv->cells[idx].name = devm_kstrdup(dev, var, GFP_KERNEL);
++		if (!priv->cells[idx].name)
++			return -ENOMEM;
++		priv->cells[idx].offset = data_offset + value - data;
++		priv->cells[idx].bytes = strlen(value);
++	}
++
++	if (WARN_ON(idx != priv->ncells))
++		priv->ncells = idx;
++
++	return 0;
++}
++
++static int u_boot_env_parse(struct u_boot_env *priv)
++{
++	struct device *dev = priv->dev;
++	size_t crc32_data_offset;
++	size_t crc32_data_len;
++	size_t crc32_offset;
++	size_t data_offset;
++	size_t data_len;
++	uint32_t crc32;
++	uint32_t calc;
++	size_t bytes;
++	uint8_t *buf;
++	int err;
++
++	buf = kcalloc(1, priv->mtd->size, GFP_KERNEL);
++	if (!buf) {
++		err = -ENOMEM;
++		goto err_out;
++	}
++
++	err = mtd_read(priv->mtd, 0, priv->mtd->size, &bytes, buf);
++	if ((err && !mtd_is_bitflip(err)) || bytes != priv->mtd->size) {
++		dev_err(dev, "Failed to read from mtd: %d\n", err);
++		goto err_kfree;
++	}
++
++	switch (priv->format) {
++	case U_BOOT_FORMAT_SINGLE:
++		crc32_offset = offsetof(struct u_boot_env_image_single, crc32);
++		crc32_data_offset = offsetof(struct u_boot_env_image_single, data);
++		data_offset = offsetof(struct u_boot_env_image_single, data);
++		break;
++	case U_BOOT_FORMAT_REDUNDANT:
++		crc32_offset = offsetof(struct u_boot_env_image_redundant, crc32);
++		crc32_data_offset = offsetof(struct u_boot_env_image_redundant, mark);
++		data_offset = offsetof(struct u_boot_env_image_redundant, data);
++		break;
++	}
++	crc32 = le32_to_cpu(*(uint32_t *)(buf + crc32_offset));
++	crc32_data_len = priv->mtd->size - crc32_data_offset;
++	data_len = priv->mtd->size - data_offset;
++
++	calc = crc32(~0, buf + crc32_data_offset, crc32_data_len) ^ ~0L;
++	if (calc != crc32) {
++		dev_err(dev, "Invalid calculated CRC32: 0x%08x (expected: 0x%08x)\n", calc, crc32);
++		err = -EINVAL;
++		goto err_kfree;
++	}
++
++	buf[priv->mtd->size - 1] = '\0';
++	err = u_boot_env_add_cells(priv, buf, data_offset, data_len);
++	if (err)
++		dev_err(dev, "Failed to add cells: %d\n", err);
++
++err_kfree:
++	kfree(buf);
++err_out:
++	return err;
++}
++
++static int u_boot_env_probe(struct platform_device *pdev)
++{
++	struct nvmem_config config = {
++		.name = "u-boot-env",
++		.reg_read = u_boot_env_read,
++	};
++	struct device *dev = &pdev->dev;
++	struct device_node *np = dev->of_node;
++	struct u_boot_env *priv;
++	int err;
++
++	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++	priv->dev = dev;
++
++	priv->format = (uintptr_t)of_device_get_match_data(dev);
++
++	priv->mtd = of_get_mtd_device_by_node(np);
++	if (IS_ERR(priv->mtd)) {
++		dev_err_probe(dev, PTR_ERR(priv->mtd), "Failed to get %pOF MTD\n", np);
++		return PTR_ERR(priv->mtd);
++	}
++
++	err = u_boot_env_parse(priv);
++	if (err)
++		return err;
++
++	config.dev = dev;
++	config.cells = priv->cells;
++	config.ncells = priv->ncells;
++	config.priv = priv;
++	config.size = priv->mtd->size;
++
++	return PTR_ERR_OR_ZERO(devm_nvmem_register(dev, &config));
++}
++
++static const struct of_device_id u_boot_env_of_match_table[] = {
++	{ .compatible = "u-boot,env", .data = (void *)U_BOOT_FORMAT_SINGLE, },
++	{ .compatible = "u-boot,env-redundant-bool", .data = (void *)U_BOOT_FORMAT_REDUNDANT, },
++	{ .compatible = "u-boot,env-redundant-count", .data = (void *)U_BOOT_FORMAT_REDUNDANT, },
++	{},
++};
++
++static struct platform_driver u_boot_env_driver = {
++	.probe = u_boot_env_probe,
++	.driver = {
++		.name = "u_boot_env",
++		.of_match_table = u_boot_env_of_match_table,
++	},
++};
++module_platform_driver(u_boot_env_driver);
++
++MODULE_AUTHOR("Rafał Miłecki");
++MODULE_LICENSE("GPL");
++MODULE_DEVICE_TABLE(of, u_boot_env_of_match_table);
diff --git a/target/linux/generic/backport-5.15/807-v6.1-0004-nvmem-brcm_nvram-Use-kzalloc-for-allocating-only-one.patch b/target/linux/generic/backport-5.15/807-v6.1-0004-nvmem-brcm_nvram-Use-kzalloc-for-allocating-only-one.patch
new file mode 100644
index 00000000000000..48ad63fab5f923
--- /dev/null
+++ b/target/linux/generic/backport-5.15/807-v6.1-0004-nvmem-brcm_nvram-Use-kzalloc-for-allocating-only-one.patch
@@ -0,0 +1,29 @@
+From d3524bb5b9a0c567b853a0024526afe87dde01ed Mon Sep 17 00:00:00 2001
+From: Kenneth Lee <klee33@uw.edu>
+Date: Fri, 16 Sep 2022 13:20:52 +0100
+Subject: [PATCH] nvmem: brcm_nvram: Use kzalloc for allocating only one
+ element
+
+Use kzalloc(...) rather than kcalloc(1, ...) because the number of
+elements we are specifying in this case is 1, so kzalloc would
+accomplish the same thing and we can simplify.
+
+Signed-off-by: Kenneth Lee <klee33@uw.edu>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220916122100.170016-6-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/brcm_nvram.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/brcm_nvram.c
++++ b/drivers/nvmem/brcm_nvram.c
+@@ -96,7 +96,7 @@ static int brcm_nvram_parse(struct brcm_
+ 
+ 	len = le32_to_cpu(header.len);
+ 
+-	data = kcalloc(1, len, GFP_KERNEL);
++	data = kzalloc(len, GFP_KERNEL);
+ 	memcpy_fromio(data, priv->base, len);
+ 	data[len - 1] = '\0';
+ 
diff --git a/target/linux/generic/backport-5.15/807-v6.1-0005-nvmem-prefix-all-symbols-with-NVMEM_.patch b/target/linux/generic/backport-5.15/807-v6.1-0005-nvmem-prefix-all-symbols-with-NVMEM_.patch
new file mode 100644
index 00000000000000..4410fc4d615fc9
--- /dev/null
+++ b/target/linux/generic/backport-5.15/807-v6.1-0005-nvmem-prefix-all-symbols-with-NVMEM_.patch
@@ -0,0 +1,281 @@
+From 28fc7c986f01fdcfd28af648be2597624cac0e27 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 16 Sep 2022 13:20:54 +0100
+Subject: [PATCH] nvmem: prefix all symbols with NVMEM_
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This unifies all NVMEM symbols. They follow one style now.
+
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220916122100.170016-8-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/configs/multi_v7_defconfig |  6 +++---
+ arch/arm/configs/qcom_defconfig     |  2 +-
+ arch/arm64/configs/defconfig        | 10 +++++-----
+ arch/mips/configs/ci20_defconfig    |  2 +-
+ drivers/cpufreq/Kconfig.arm         |  2 +-
+ drivers/nvmem/Kconfig               | 24 ++++++++++++------------
+ drivers/nvmem/Makefile              | 24 ++++++++++++------------
+ drivers/soc/mediatek/Kconfig        |  2 +-
+ drivers/thermal/qcom/Kconfig        |  2 +-
+ 9 files changed, 37 insertions(+), 37 deletions(-)
+
+--- a/arch/arm/configs/multi_v7_defconfig
++++ b/arch/arm/configs/multi_v7_defconfig
+@@ -1124,10 +1124,10 @@ CONFIG_TI_PIPE3=y
+ CONFIG_TWL4030_USB=m
+ CONFIG_RAS=y
+ CONFIG_NVMEM_IMX_OCOTP=y
+-CONFIG_ROCKCHIP_EFUSE=m
++CONFIG_NVMEM_ROCKCHIP_EFUSE=m
+ CONFIG_NVMEM_SUNXI_SID=y
+ CONFIG_NVMEM_VF610_OCOTP=y
+-CONFIG_MESON_MX_EFUSE=m
++CONFIG_NVMEM_MESON_MX_EFUSE=m
+ CONFIG_NVMEM_RMEM=m
+ CONFIG_FSI=m
+ CONFIG_FSI_MASTER_GPIO=m
+--- a/arch/arm/configs/qcom_defconfig
++++ b/arch/arm/configs/qcom_defconfig
+@@ -274,7 +274,7 @@ CONFIG_PHY_QCOM_USB_HS=y
+ CONFIG_PHY_QCOM_USB_HSIC=y
+ CONFIG_PHY_QCOM_QMP=y
+ CONFIG_PHY_QCOM_USB_SNPS_FEMTO_V2=y
+-CONFIG_QCOM_QFPROM=y
++CONFIG_NVMEM_QCOM_QFPROM=y
+ CONFIG_INTERCONNECT=y
+ CONFIG_INTERCONNECT_QCOM=y
+ CONFIG_INTERCONNECT_QCOM_MSM8974=m
+--- a/arch/arm64/configs/defconfig
++++ b/arch/arm64/configs/defconfig
+@@ -1135,11 +1135,11 @@ CONFIG_QCOM_L3_PMU=y
+ CONFIG_NVMEM_IMX_OCOTP=y
+ CONFIG_NVMEM_IMX_OCOTP_SCU=y
+ CONFIG_QCOM_QFPROM=y
+-CONFIG_MTK_EFUSE=y
+-CONFIG_ROCKCHIP_EFUSE=y
++CONFIG_NVMEM_MTK_EFUSE=y
++CONFIG_NVMEM_ROCKCHIP_EFUSE=y
+ CONFIG_NVMEM_SUNXI_SID=y
+-CONFIG_UNIPHIER_EFUSE=y
+-CONFIG_MESON_EFUSE=m
++CONFIG_NVMEM_UNIPHIER_EFUSE=y
++CONFIG_NVMEM_MESON_EFUSE=m
+ CONFIG_NVMEM_RMEM=m
+ CONFIG_FPGA=y
+ CONFIG_FPGA_MGR_STRATIX10_SOC=m
+--- a/arch/mips/configs/ci20_defconfig
++++ b/arch/mips/configs/ci20_defconfig
+@@ -137,7 +137,7 @@ CONFIG_MEMORY=y
+ CONFIG_JZ4780_NEMC=y
+ CONFIG_PWM=y
+ CONFIG_PWM_JZ4740=m
+-CONFIG_JZ4780_EFUSE=y
++CONFIG_NVMEM_JZ4780_EFUSE=y
+ CONFIG_JZ4770_PHY=y
+ CONFIG_EXT4_FS=y
+ # CONFIG_DNOTIFY is not set
+--- a/drivers/cpufreq/Kconfig.arm
++++ b/drivers/cpufreq/Kconfig.arm
+@@ -153,7 +153,7 @@ config ARM_OMAP2PLUS_CPUFREQ
+ config ARM_QCOM_CPUFREQ_NVMEM
+ 	tristate "Qualcomm nvmem based CPUFreq"
+ 	depends on ARCH_QCOM
+-	depends on QCOM_QFPROM
++	depends on NVMEM_QCOM_QFPROM
+ 	depends on QCOM_SMEM
+ 	select PM_OPP
+ 	help
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -52,7 +52,7 @@ config NVMEM_IMX_OCOTP_SCU
+ 	  This is a driver for the SCU On-Chip OTP Controller (OCOTP)
+ 	  available on i.MX8 SoCs.
+ 
+-config JZ4780_EFUSE
++config NVMEM_JZ4780_EFUSE
+ 	tristate "JZ4780 EFUSE Memory Support"
+ 	depends on MACH_INGENIC || COMPILE_TEST
+ 	depends on HAS_IOMEM
+@@ -96,7 +96,7 @@ config NVMEM_MXS_OCOTP
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called nvmem-mxs-ocotp.
+ 
+-config MTK_EFUSE
++config NVMEM_MTK_EFUSE
+ 	tristate "Mediatek SoCs EFUSE support"
+ 	depends on ARCH_MEDIATEK || COMPILE_TEST
+ 	depends on HAS_IOMEM
+@@ -107,7 +107,7 @@ config MTK_EFUSE
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called efuse-mtk.
+ 
+-config MICROCHIP_OTPC
++config NVMEM_MICROCHIP_OTPC
+ 	tristate "Microchip OTPC support"
+ 	depends on ARCH_AT91 || COMPILE_TEST
+ 	help
+@@ -126,7 +126,7 @@ config NVMEM_NINTENDO_OTP
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called nvmem-nintendo-otp.
+ 
+-config QCOM_QFPROM
++config NVMEM_QCOM_QFPROM
+ 	tristate "QCOM QFPROM Support"
+ 	depends on ARCH_QCOM || COMPILE_TEST
+ 	depends on HAS_IOMEM
+@@ -145,7 +145,7 @@ config NVMEM_SPMI_SDAM
+ 	  Qualcomm Technologies, Inc. PMICs. It provides the clients
+ 	  an interface to read/write to the SDAM module's shared memory.
+ 
+-config ROCKCHIP_EFUSE
++config NVMEM_ROCKCHIP_EFUSE
+ 	tristate "Rockchip eFuse Support"
+ 	depends on ARCH_ROCKCHIP || COMPILE_TEST
+ 	depends on HAS_IOMEM
+@@ -156,7 +156,7 @@ config ROCKCHIP_EFUSE
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called nvmem_rockchip_efuse.
+ 
+-config ROCKCHIP_OTP
++config NVMEM_ROCKCHIP_OTP
+ 	tristate "Rockchip OTP controller support"
+ 	depends on ARCH_ROCKCHIP || COMPILE_TEST
+ 	depends on HAS_IOMEM
+@@ -199,7 +199,7 @@ config NVMEM_SUNXI_SID
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called nvmem_sunxi_sid.
+ 
+-config UNIPHIER_EFUSE
++config NVMEM_UNIPHIER_EFUSE
+ 	tristate "UniPhier SoCs eFuse support"
+ 	depends on ARCH_UNIPHIER || COMPILE_TEST
+ 	depends on HAS_IOMEM
+@@ -221,7 +221,7 @@ config NVMEM_VF610_OCOTP
+ 	  This driver can also be build as a module. If so, the module will
+ 	  be called nvmem-vf610-ocotp.
+ 
+-config MESON_EFUSE
++config NVMEM_MESON_EFUSE
+ 	tristate "Amlogic Meson GX eFuse Support"
+ 	depends on (ARCH_MESON || COMPILE_TEST) && MESON_SM
+ 	help
+@@ -231,7 +231,7 @@ config MESON_EFUSE
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called nvmem_meson_efuse.
+ 
+-config MESON_MX_EFUSE
++config NVMEM_MESON_MX_EFUSE
+ 	tristate "Amlogic Meson6/Meson8/Meson8b eFuse Support"
+ 	depends on ARCH_MESON || COMPILE_TEST
+ 	help
+@@ -251,13 +251,13 @@ config NVMEM_SNVS_LPGPR
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called nvmem-snvs-lpgpr.
+ 
+-config RAVE_SP_EEPROM
++config NVMEM_RAVE_SP_EEPROM
+ 	tristate "Rave SP EEPROM Support"
+ 	depends on RAVE_SP_CORE
+ 	help
+ 	  Say y here to enable Rave SP EEPROM support.
+ 
+-config SC27XX_EFUSE
++config NVMEM_SC27XX_EFUSE
+ 	tristate "Spreadtrum SC27XX eFuse Support"
+ 	depends on MFD_SC27XX_PMIC || COMPILE_TEST
+ 	depends on HAS_IOMEM
+@@ -278,7 +278,7 @@ config NVMEM_ZYNQMP
+ 
+ 	  If sure, say yes. If unsure, say no.
+ 
+-config SPRD_EFUSE
++config NVMEM_SPRD_EFUSE
+ 	tristate "Spreadtrum SoC eFuse Support"
+ 	depends on ARCH_SPRD || COMPILE_TEST
+ 	depends on HAS_IOMEM
+--- a/drivers/nvmem/Makefile
++++ b/drivers/nvmem/Makefile
+@@ -15,7 +15,7 @@ obj-$(CONFIG_NVMEM_IMX_OCOTP)	+= nvmem-i
+ nvmem-imx-ocotp-y		:= imx-ocotp.o
+ obj-$(CONFIG_NVMEM_IMX_OCOTP_SCU)	+= nvmem-imx-ocotp-scu.o
+ nvmem-imx-ocotp-scu-y		:= imx-ocotp-scu.o
+-obj-$(CONFIG_JZ4780_EFUSE)		+= nvmem_jz4780_efuse.o
++obj-$(CONFIG_NVMEM_JZ4780_EFUSE)		+= nvmem_jz4780_efuse.o
+ nvmem_jz4780_efuse-y		:= jz4780-efuse.o
+ obj-$(CONFIG_NVMEM_LPC18XX_EEPROM)	+= nvmem_lpc18xx_eeprom.o
+ nvmem_lpc18xx_eeprom-y	:= lpc18xx_eeprom.o
+@@ -25,37 +25,37 @@ obj-$(CONFIG_NVMEM_MXS_OCOTP)	+= nvmem-m
+ nvmem-mxs-ocotp-y		:= mxs-ocotp.o
+ obj-$(CONFIG_NVMEM_NINTENDO_OTP)	+= nvmem-nintendo-otp.o
+ nvmem-nintendo-otp-y		:= nintendo-otp.o
+-obj-$(CONFIG_MTK_EFUSE)		+= nvmem_mtk-efuse.o
++obj-$(CONFIG_NVMEM_MTK_EFUSE)		+= nvmem_mtk-efuse.o
+ nvmem_mtk-efuse-y		:= mtk-efuse.o
+-obj-$(CONFIG_QCOM_QFPROM)	+= nvmem_qfprom.o
++obj-$(CONFIG_NVMEM_QCOM_QFPROM)	+= nvmem_qfprom.o
+ nvmem_qfprom-y			:= qfprom.o
+ obj-$(CONFIG_NVMEM_SPMI_SDAM)	+= nvmem_qcom-spmi-sdam.o
+ nvmem_qcom-spmi-sdam-y		+= qcom-spmi-sdam.o
+-obj-$(CONFIG_ROCKCHIP_EFUSE)	+= nvmem_rockchip_efuse.o
++obj-$(CONFIG_NVMEM_ROCKCHIP_EFUSE)	+= nvmem_rockchip_efuse.o
+ nvmem_rockchip_efuse-y		:= rockchip-efuse.o
+-obj-$(CONFIG_ROCKCHIP_OTP)	+= nvmem-rockchip-otp.o
++obj-$(CONFIG_NVMEM_ROCKCHIP_OTP)	+= nvmem-rockchip-otp.o
+ nvmem-rockchip-otp-y		:= rockchip-otp.o
+ obj-$(CONFIG_NVMEM_SUNXI_SID)	+= nvmem_sunxi_sid.o
+ nvmem_stm32_romem-y 		:= stm32-romem.o
+ obj-$(CONFIG_NVMEM_STM32_ROMEM) += nvmem_stm32_romem.o
+ nvmem_sunxi_sid-y		:= sunxi_sid.o
+-obj-$(CONFIG_UNIPHIER_EFUSE)	+= nvmem-uniphier-efuse.o
++obj-$(CONFIG_NVMEM_UNIPHIER_EFUSE)	+= nvmem-uniphier-efuse.o
+ nvmem-uniphier-efuse-y		:= uniphier-efuse.o
+ obj-$(CONFIG_NVMEM_VF610_OCOTP)	+= nvmem-vf610-ocotp.o
+ nvmem-vf610-ocotp-y		:= vf610-ocotp.o
+-obj-$(CONFIG_MESON_EFUSE)	+= nvmem_meson_efuse.o
++obj-$(CONFIG_NVMEM_MESON_EFUSE)	+= nvmem_meson_efuse.o
+ nvmem_meson_efuse-y		:= meson-efuse.o
+-obj-$(CONFIG_MESON_MX_EFUSE)	+= nvmem_meson_mx_efuse.o
++obj-$(CONFIG_NVMEM_MESON_MX_EFUSE)	+= nvmem_meson_mx_efuse.o
+ nvmem_meson_mx_efuse-y		:= meson-mx-efuse.o
+ obj-$(CONFIG_NVMEM_SNVS_LPGPR)	+= nvmem_snvs_lpgpr.o
+ nvmem_snvs_lpgpr-y		:= snvs_lpgpr.o
+-obj-$(CONFIG_RAVE_SP_EEPROM)	+= nvmem-rave-sp-eeprom.o
++obj-$(CONFIG_NVMEM_RAVE_SP_EEPROM)	+= nvmem-rave-sp-eeprom.o
+ nvmem-rave-sp-eeprom-y		:= rave-sp-eeprom.o
+-obj-$(CONFIG_SC27XX_EFUSE)	+= nvmem-sc27xx-efuse.o
++obj-$(CONFIG_NVMEM_SC27XX_EFUSE)	+= nvmem-sc27xx-efuse.o
+ nvmem-sc27xx-efuse-y		:= sc27xx-efuse.o
+ obj-$(CONFIG_NVMEM_ZYNQMP)	+= nvmem_zynqmp_nvmem.o
+ nvmem_zynqmp_nvmem-y		:= zynqmp_nvmem.o
+-obj-$(CONFIG_SPRD_EFUSE)	+= nvmem_sprd_efuse.o
++obj-$(CONFIG_NVMEM_SPRD_EFUSE)	+= nvmem_sprd_efuse.o
+ nvmem_sprd_efuse-y		:= sprd-efuse.o
+ obj-$(CONFIG_NVMEM_RMEM) 	+= nvmem-rmem.o
+ nvmem-rmem-y			:= rmem.o
+@@ -67,7 +67,7 @@ obj-$(CONFIG_NVMEM_SUNPLUS_OCOTP)	+= nvm
+ nvmem_sunplus_ocotp-y		:= sunplus-ocotp.o
+ obj-$(CONFIG_NVMEM_APPLE_EFUSES)	+= nvmem-apple-efuses.o
+ nvmem-apple-efuses-y 		:= apple-efuses.o
+-obj-$(CONFIG_MICROCHIP_OTPC)	+= nvmem-microchip-otpc.o
++obj-$(CONFIG_NVMEM_MICROCHIP_OTPC)	+= nvmem-microchip-otpc.o
+ nvmem-microchip-otpc-y		:= microchip-otpc.o
+ obj-$(CONFIG_NVMEM_U_BOOT_ENV)	+= nvmem_u-boot-env.o
+ nvmem_u-boot-env-y		:= u-boot-env.o
+--- a/drivers/thermal/qcom/Kconfig
++++ b/drivers/thermal/qcom/Kconfig
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ config QCOM_TSENS
+ 	tristate "Qualcomm TSENS Temperature Alarm"
+-	depends on QCOM_QFPROM
++	depends on NVMEM_QCOM_QFPROM
+ 	depends on ARCH_QCOM || COMPILE_TEST
+ 	help
+ 	  This enables the thermal sysfs driver for the TSENS device. It shows
diff --git a/target/linux/generic/backport-5.15/807-v6.1-0006-nvmem-sort-config-symbols-alphabetically.patch b/target/linux/generic/backport-5.15/807-v6.1-0006-nvmem-sort-config-symbols-alphabetically.patch
new file mode 100644
index 00000000000000..4e45524bffcd5c
--- /dev/null
+++ b/target/linux/generic/backport-5.15/807-v6.1-0006-nvmem-sort-config-symbols-alphabetically.patch
@@ -0,0 +1,535 @@
+From a06d9e5a63b7c2f622c908cd9600ce735e70f7c6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 16 Sep 2022 13:20:55 +0100
+Subject: [PATCH] nvmem: sort config symbols alphabetically
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+1. Match what most subsystems do
+2. Simplify maintenance a bit
+3. Reduce amount of conflicts for new drivers patches
+
+While at it unify indent level in Makefile.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220916122100.170016-9-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/Kconfig  | 300 +++++++++++++++++++++--------------------
+ drivers/nvmem/Makefile | 114 ++++++++--------
+ 2 files changed, 208 insertions(+), 206 deletions(-)
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -21,6 +21,40 @@ config NVMEM_SYSFS
+ 	 This interface is mostly used by userspace applications to
+ 	 read/write directly into nvmem.
+ 
++# Devices
++
++config NVMEM_APPLE_EFUSES
++	tristate "Apple eFuse support"
++	depends on ARCH_APPLE || COMPILE_TEST
++	default ARCH_APPLE
++	help
++	  Say y here to enable support for reading eFuses on Apple SoCs
++	  such as the M1. These are e.g. used to store factory programmed
++	  calibration data required for the PCIe or the USB-C PHY.
++
++	  This driver can also be built as a module. If so, the module will
++	  be called nvmem-apple-efuses.
++
++config NVMEM_BCM_OCOTP
++	tristate "Broadcom On-Chip OTP Controller support"
++	depends on ARCH_BCM_IPROC || COMPILE_TEST
++	depends on HAS_IOMEM
++	default ARCH_BCM_IPROC
++	help
++	  Say y here to enable read/write access to the Broadcom OTP
++	  controller.
++
++	  This driver can also be built as a module. If so, the module
++	  will be called nvmem-bcm-ocotp.
++
++config NVMEM_BRCM_NVRAM
++	tristate "Broadcom's NVRAM support"
++	depends on ARCH_BCM_5301X || COMPILE_TEST
++	depends on HAS_IOMEM
++	help
++	  This driver provides support for Broadcom's NVRAM that can be accessed
++	  using I/O mapping.
++
+ config NVMEM_IMX_IIM
+ 	tristate "i.MX IC Identification Module support"
+ 	depends on ARCH_MXC || COMPILE_TEST
+@@ -64,6 +98,19 @@ config NVMEM_JZ4780_EFUSE
+ 	  To compile this driver as a module, choose M here: the module
+ 	  will be called nvmem_jz4780_efuse.
+ 
++config NVMEM_LAYERSCAPE_SFP
++	tristate "Layerscape SFP (Security Fuse Processor) support"
++	depends on ARCH_LAYERSCAPE || COMPILE_TEST
++	depends on HAS_IOMEM
++	select REGMAP_MMIO
++	help
++	  This driver provides support to read the eFuses on Freescale
++	  Layerscape SoC's. For example, the vendor provides a per part
++	  unique ID there.
++
++	  This driver can also be built as a module. If so, the module
++	  will be called layerscape-sfp.
++
+ config NVMEM_LPC18XX_EEPROM
+ 	tristate "NXP LPC18XX EEPROM Memory Support"
+ 	depends on ARCH_LPC18XX || COMPILE_TEST
+@@ -84,17 +131,32 @@ config NVMEM_LPC18XX_OTP
+ 	  To compile this driver as a module, choose M here: the module
+ 	  will be called nvmem_lpc18xx_otp.
+ 
+-config NVMEM_MXS_OCOTP
+-	tristate "Freescale MXS On-Chip OTP Memory Support"
+-	depends on ARCH_MXS || COMPILE_TEST
+-	depends on HAS_IOMEM
++config NVMEM_MESON_EFUSE
++	tristate "Amlogic Meson GX eFuse Support"
++	depends on (ARCH_MESON || COMPILE_TEST) && MESON_SM
+ 	help
+-	  If you say Y here, you will get readonly access to the
+-	  One Time Programmable memory pages that are stored
+-	  on the Freescale i.MX23/i.MX28 processor.
++	  This is a driver to retrieve specific values from the eFuse found on
++	  the Amlogic Meson GX SoCs.
+ 
+ 	  This driver can also be built as a module. If so, the module
+-	  will be called nvmem-mxs-ocotp.
++	  will be called nvmem_meson_efuse.
++
++config NVMEM_MESON_MX_EFUSE
++	tristate "Amlogic Meson6/Meson8/Meson8b eFuse Support"
++	depends on ARCH_MESON || COMPILE_TEST
++	help
++	  This is a driver to retrieve specific values from the eFuse found on
++	  the Amlogic Meson6, Meson8 and Meson8b SoCs.
++
++	  This driver can also be built as a module. If so, the module
++	  will be called nvmem_meson_mx_efuse.
++
++config NVMEM_MICROCHIP_OTPC
++	tristate "Microchip OTPC support"
++	depends on ARCH_AT91 || COMPILE_TEST
++	help
++	  This driver enable the OTP controller available on Microchip SAMA7G5
++	  SoCs. It controlls the access to the OTP memory connected to it.
+ 
+ config NVMEM_MTK_EFUSE
+ 	tristate "Mediatek SoCs EFUSE support"
+@@ -107,12 +169,17 @@ config NVMEM_MTK_EFUSE
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called efuse-mtk.
+ 
+-config NVMEM_MICROCHIP_OTPC
+-	tristate "Microchip OTPC support"
+-	depends on ARCH_AT91 || COMPILE_TEST
++config NVMEM_MXS_OCOTP
++	tristate "Freescale MXS On-Chip OTP Memory Support"
++	depends on ARCH_MXS || COMPILE_TEST
++	depends on HAS_IOMEM
+ 	help
+-	  This driver enable the OTP controller available on Microchip SAMA7G5
+-	  SoCs. It controlls the access to the OTP memory connected to it.
++	  If you say Y here, you will get readonly access to the
++	  One Time Programmable memory pages that are stored
++	  on the Freescale i.MX23/i.MX28 processor.
++
++	  This driver can also be built as a module. If so, the module
++	  will be called nvmem-mxs-ocotp.
+ 
+ config NVMEM_NINTENDO_OTP
+ 	tristate "Nintendo Wii and Wii U OTP Support"
+@@ -137,13 +204,21 @@ config NVMEM_QCOM_QFPROM
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called nvmem_qfprom.
+ 
+-config NVMEM_SPMI_SDAM
+-	tristate "SPMI SDAM Support"
+-	depends on SPMI
++config NVMEM_RAVE_SP_EEPROM
++	tristate "Rave SP EEPROM Support"
++	depends on RAVE_SP_CORE
+ 	help
+-	  This driver supports the Shared Direct Access Memory Module on
+-	  Qualcomm Technologies, Inc. PMICs. It provides the clients
+-	  an interface to read/write to the SDAM module's shared memory.
++	  Say y here to enable Rave SP EEPROM support.
++
++config NVMEM_RMEM
++	tristate "Reserved Memory Based Driver Support"
++	depends on HAS_IOMEM
++	help
++	  This driver maps reserved memory into an nvmem device. It might be
++	  useful to expose information left by firmware in memory.
++
++	  This driver can also be built as a module. If so, the module
++	  will be called nvmem-rmem.
+ 
+ config NVMEM_ROCKCHIP_EFUSE
+ 	tristate "Rockchip eFuse Support"
+@@ -167,79 +242,16 @@ config NVMEM_ROCKCHIP_OTP
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called nvmem_rockchip_otp.
+ 
+-config NVMEM_BCM_OCOTP
+-	tristate "Broadcom On-Chip OTP Controller support"
+-	depends on ARCH_BCM_IPROC || COMPILE_TEST
+-	depends on HAS_IOMEM
+-	default ARCH_BCM_IPROC
+-	help
+-	  Say y here to enable read/write access to the Broadcom OTP
+-	  controller.
+-
+-	  This driver can also be built as a module. If so, the module
+-	  will be called nvmem-bcm-ocotp.
+-
+-config NVMEM_STM32_ROMEM
+-	tristate "STMicroelectronics STM32 factory-programmed memory support"
+-	depends on ARCH_STM32 || COMPILE_TEST
+-	help
+-	  Say y here to enable read-only access for STMicroelectronics STM32
+-	  factory-programmed memory area.
+-
+-	  This driver can also be built as a module. If so, the module
+-	  will be called nvmem-stm32-romem.
+-
+-config NVMEM_SUNXI_SID
+-	tristate "Allwinner SoCs SID support"
+-	depends on ARCH_SUNXI
+-	help
+-	  This is a driver for the 'security ID' available on various Allwinner
+-	  devices.
+-
+-	  This driver can also be built as a module. If so, the module
+-	  will be called nvmem_sunxi_sid.
+-
+-config NVMEM_UNIPHIER_EFUSE
+-	tristate "UniPhier SoCs eFuse support"
+-	depends on ARCH_UNIPHIER || COMPILE_TEST
+-	depends on HAS_IOMEM
+-	help
+-	  This is a simple driver to dump specified values of UniPhier SoC
+-	  from eFuse.
+-
+-	  This driver can also be built as a module. If so, the module
+-	  will be called nvmem-uniphier-efuse.
+-
+-config NVMEM_VF610_OCOTP
+-	tristate "VF610 SoC OCOTP support"
+-	depends on SOC_VF610 || COMPILE_TEST
++config NVMEM_SC27XX_EFUSE
++	tristate "Spreadtrum SC27XX eFuse Support"
++	depends on MFD_SC27XX_PMIC || COMPILE_TEST
+ 	depends on HAS_IOMEM
+ 	help
+-	  This is a driver for the 'OCOTP' peripheral available on Vybrid
+-	  devices like VF5xx and VF6xx.
+-
+-	  This driver can also be build as a module. If so, the module will
+-	  be called nvmem-vf610-ocotp.
+-
+-config NVMEM_MESON_EFUSE
+-	tristate "Amlogic Meson GX eFuse Support"
+-	depends on (ARCH_MESON || COMPILE_TEST) && MESON_SM
+-	help
+-	  This is a driver to retrieve specific values from the eFuse found on
+-	  the Amlogic Meson GX SoCs.
+-
+-	  This driver can also be built as a module. If so, the module
+-	  will be called nvmem_meson_efuse.
+-
+-config NVMEM_MESON_MX_EFUSE
+-	tristate "Amlogic Meson6/Meson8/Meson8b eFuse Support"
+-	depends on ARCH_MESON || COMPILE_TEST
+-	help
+-	  This is a driver to retrieve specific values from the eFuse found on
+-	  the Amlogic Meson6, Meson8 and Meson8b SoCs.
++	  This is a simple driver to dump specified values of Spreadtrum
++	  SC27XX PMICs from eFuse.
+ 
+ 	  This driver can also be built as a module. If so, the module
+-	  will be called nvmem_meson_mx_efuse.
++	  will be called nvmem-sc27xx-efuse.
+ 
+ config NVMEM_SNVS_LPGPR
+ 	tristate "Support for Low Power General Purpose Register"
+@@ -251,32 +263,13 @@ config NVMEM_SNVS_LPGPR
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called nvmem-snvs-lpgpr.
+ 
+-config NVMEM_RAVE_SP_EEPROM
+-	tristate "Rave SP EEPROM Support"
+-	depends on RAVE_SP_CORE
+-	help
+-	  Say y here to enable Rave SP EEPROM support.
+-
+-config NVMEM_SC27XX_EFUSE
+-	tristate "Spreadtrum SC27XX eFuse Support"
+-	depends on MFD_SC27XX_PMIC || COMPILE_TEST
+-	depends on HAS_IOMEM
+-	help
+-	  This is a simple driver to dump specified values of Spreadtrum
+-	  SC27XX PMICs from eFuse.
+-
+-	  This driver can also be built as a module. If so, the module
+-	  will be called nvmem-sc27xx-efuse.
+-
+-config NVMEM_ZYNQMP
+-	bool "Xilinx ZYNQMP SoC nvmem firmware support"
+-	depends on ARCH_ZYNQMP
++config NVMEM_SPMI_SDAM
++	tristate "SPMI SDAM Support"
++	depends on SPMI
+ 	help
+-	  This is a driver to access hardware related data like
+-	  soc revision, IDCODE... etc by using the firmware
+-	  interface.
+-
+-	  If sure, say yes. If unsure, say no.
++	  This driver supports the Shared Direct Access Memory Module on
++	  Qualcomm Technologies, Inc. PMICs. It provides the clients
++	  an interface to read/write to the SDAM module's shared memory.
+ 
+ config NVMEM_SPRD_EFUSE
+ 	tristate "Spreadtrum SoC eFuse Support"
+@@ -289,36 +282,15 @@ config NVMEM_SPRD_EFUSE
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called nvmem-sprd-efuse.
+ 
+-config NVMEM_RMEM
+-	tristate "Reserved Memory Based Driver Support"
+-	depends on HAS_IOMEM
+-	help
+-	  This driver maps reserved memory into an nvmem device. It might be
+-	  useful to expose information left by firmware in memory.
+-
+-	  This driver can also be built as a module. If so, the module
+-	  will be called nvmem-rmem.
+-
+-config NVMEM_BRCM_NVRAM
+-	tristate "Broadcom's NVRAM support"
+-	depends on ARCH_BCM_5301X || COMPILE_TEST
+-	depends on HAS_IOMEM
+-	help
+-	  This driver provides support for Broadcom's NVRAM that can be accessed
+-	  using I/O mapping.
+-
+-config NVMEM_LAYERSCAPE_SFP
+-	tristate "Layerscape SFP (Security Fuse Processor) support"
+-	depends on ARCH_LAYERSCAPE || COMPILE_TEST
+-	depends on HAS_IOMEM
+-	select REGMAP_MMIO
++config NVMEM_STM32_ROMEM
++	tristate "STMicroelectronics STM32 factory-programmed memory support"
++	depends on ARCH_STM32 || COMPILE_TEST
+ 	help
+-	  This driver provides support to read the eFuses on Freescale
+-	  Layerscape SoC's. For example, the vendor provides a per part
+-	  unique ID there.
++	  Say y here to enable read-only access for STMicroelectronics STM32
++	  factory-programmed memory area.
+ 
+ 	  This driver can also be built as a module. If so, the module
+-	  will be called layerscape-sfp.
++	  will be called nvmem-stm32-romem.
+ 
+ config NVMEM_SUNPLUS_OCOTP
+ 	tristate "Sunplus SoC OTP support"
+@@ -332,17 +304,15 @@ config NVMEM_SUNPLUS_OCOTP
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called nvmem-sunplus-ocotp.
+ 
+-config NVMEM_APPLE_EFUSES
+-	tristate "Apple eFuse support"
+-	depends on ARCH_APPLE || COMPILE_TEST
+-	default ARCH_APPLE
++config NVMEM_SUNXI_SID
++	tristate "Allwinner SoCs SID support"
++	depends on ARCH_SUNXI
+ 	help
+-	  Say y here to enable support for reading eFuses on Apple SoCs
+-	  such as the M1. These are e.g. used to store factory programmed
+-	  calibration data required for the PCIe or the USB-C PHY.
++	  This is a driver for the 'security ID' available on various Allwinner
++	  devices.
+ 
+-	  This driver can also be built as a module. If so, the module will
+-	  be called nvmem-apple-efuses.
++	  This driver can also be built as a module. If so, the module
++	  will be called nvmem_sunxi_sid.
+ 
+ config NVMEM_U_BOOT_ENV
+ 	tristate "U-Boot environment variables support"
+@@ -357,4 +327,36 @@ config NVMEM_U_BOOT_ENV
+ 
+ 	  If compiled as module it will be called nvmem_u-boot-env.
+ 
++config NVMEM_UNIPHIER_EFUSE
++	tristate "UniPhier SoCs eFuse support"
++	depends on ARCH_UNIPHIER || COMPILE_TEST
++	depends on HAS_IOMEM
++	help
++	  This is a simple driver to dump specified values of UniPhier SoC
++	  from eFuse.
++
++	  This driver can also be built as a module. If so, the module
++	  will be called nvmem-uniphier-efuse.
++
++config NVMEM_VF610_OCOTP
++	tristate "VF610 SoC OCOTP support"
++	depends on SOC_VF610 || COMPILE_TEST
++	depends on HAS_IOMEM
++	help
++	  This is a driver for the 'OCOTP' peripheral available on Vybrid
++	  devices like VF5xx and VF6xx.
++
++	  This driver can also be build as a module. If so, the module will
++	  be called nvmem-vf610-ocotp.
++
++config NVMEM_ZYNQMP
++	bool "Xilinx ZYNQMP SoC nvmem firmware support"
++	depends on ARCH_ZYNQMP
++	help
++	  This is a driver to access hardware related data like
++	  soc revision, IDCODE... etc by using the firmware
++	  interface.
++
++	  If sure, say yes. If unsure, say no.
++
+ endif
+--- a/drivers/nvmem/Makefile
++++ b/drivers/nvmem/Makefile
+@@ -7,67 +7,67 @@ obj-$(CONFIG_NVMEM)		+= nvmem_core.o
+ nvmem_core-y			:= core.o
+ 
+ # Devices
+-obj-$(CONFIG_NVMEM_BCM_OCOTP)	+= nvmem-bcm-ocotp.o
+-nvmem-bcm-ocotp-y		:= bcm-ocotp.o
+-obj-$(CONFIG_NVMEM_IMX_IIM)	+= nvmem-imx-iim.o
+-nvmem-imx-iim-y			:= imx-iim.o
+-obj-$(CONFIG_NVMEM_IMX_OCOTP)	+= nvmem-imx-ocotp.o
+-nvmem-imx-ocotp-y		:= imx-ocotp.o
++obj-$(CONFIG_NVMEM_APPLE_EFUSES)	+= nvmem-apple-efuses.o
++nvmem-apple-efuses-y 			:= apple-efuses.o
++obj-$(CONFIG_NVMEM_BCM_OCOTP)		+= nvmem-bcm-ocotp.o
++nvmem-bcm-ocotp-y			:= bcm-ocotp.o
++obj-$(CONFIG_NVMEM_BRCM_NVRAM)		+= nvmem_brcm_nvram.o
++nvmem_brcm_nvram-y			:= brcm_nvram.o
++obj-$(CONFIG_NVMEM_IMX_IIM)		+= nvmem-imx-iim.o
++nvmem-imx-iim-y				:= imx-iim.o
++obj-$(CONFIG_NVMEM_IMX_OCOTP)		+= nvmem-imx-ocotp.o
++nvmem-imx-ocotp-y			:= imx-ocotp.o
+ obj-$(CONFIG_NVMEM_IMX_OCOTP_SCU)	+= nvmem-imx-ocotp-scu.o
+-nvmem-imx-ocotp-scu-y		:= imx-ocotp-scu.o
+-obj-$(CONFIG_NVMEM_JZ4780_EFUSE)		+= nvmem_jz4780_efuse.o
+-nvmem_jz4780_efuse-y		:= jz4780-efuse.o
++nvmem-imx-ocotp-scu-y			:= imx-ocotp-scu.o
++obj-$(CONFIG_NVMEM_JZ4780_EFUSE)	+= nvmem_jz4780_efuse.o
++nvmem_jz4780_efuse-y			:= jz4780-efuse.o
++obj-$(CONFIG_NVMEM_LAYERSCAPE_SFP)	+= nvmem-layerscape-sfp.o
++nvmem-layerscape-sfp-y			:= layerscape-sfp.o
+ obj-$(CONFIG_NVMEM_LPC18XX_EEPROM)	+= nvmem_lpc18xx_eeprom.o
+-nvmem_lpc18xx_eeprom-y	:= lpc18xx_eeprom.o
+-obj-$(CONFIG_NVMEM_LPC18XX_OTP)	+= nvmem_lpc18xx_otp.o
+-nvmem_lpc18xx_otp-y		:= lpc18xx_otp.o
+-obj-$(CONFIG_NVMEM_MXS_OCOTP)	+= nvmem-mxs-ocotp.o
+-nvmem-mxs-ocotp-y		:= mxs-ocotp.o
+-obj-$(CONFIG_NVMEM_NINTENDO_OTP)	+= nvmem-nintendo-otp.o
+-nvmem-nintendo-otp-y		:= nintendo-otp.o
++nvmem_lpc18xx_eeprom-y			:= lpc18xx_eeprom.o
++obj-$(CONFIG_NVMEM_LPC18XX_OTP)		+= nvmem_lpc18xx_otp.o
++nvmem_lpc18xx_otp-y			:= lpc18xx_otp.o
++obj-$(CONFIG_NVMEM_MESON_EFUSE)		+= nvmem_meson_efuse.o
++nvmem_meson_efuse-y			:= meson-efuse.o
++obj-$(CONFIG_NVMEM_MESON_MX_EFUSE)	+= nvmem_meson_mx_efuse.o
++nvmem_meson_mx_efuse-y			:= meson-mx-efuse.o
++obj-$(CONFIG_NVMEM_MICROCHIP_OTPC)	+= nvmem-microchip-otpc.o
++nvmem-microchip-otpc-y			:= microchip-otpc.o
+ obj-$(CONFIG_NVMEM_MTK_EFUSE)		+= nvmem_mtk-efuse.o
+-nvmem_mtk-efuse-y		:= mtk-efuse.o
+-obj-$(CONFIG_NVMEM_QCOM_QFPROM)	+= nvmem_qfprom.o
+-nvmem_qfprom-y			:= qfprom.o
+-obj-$(CONFIG_NVMEM_SPMI_SDAM)	+= nvmem_qcom-spmi-sdam.o
+-nvmem_qcom-spmi-sdam-y		+= qcom-spmi-sdam.o
++nvmem_mtk-efuse-y			:= mtk-efuse.o
++obj-$(CONFIG_NVMEM_MXS_OCOTP)		+= nvmem-mxs-ocotp.o
++nvmem-mxs-ocotp-y			:= mxs-ocotp.o
++obj-$(CONFIG_NVMEM_NINTENDO_OTP)	+= nvmem-nintendo-otp.o
++nvmem-nintendo-otp-y			:= nintendo-otp.o
++obj-$(CONFIG_NVMEM_QCOM_QFPROM)		+= nvmem_qfprom.o
++nvmem_qfprom-y				:= qfprom.o
++obj-$(CONFIG_NVMEM_RAVE_SP_EEPROM)	+= nvmem-rave-sp-eeprom.o
++nvmem-rave-sp-eeprom-y			:= rave-sp-eeprom.o
++obj-$(CONFIG_NVMEM_RMEM) 		+= nvmem-rmem.o
++nvmem-rmem-y				:= rmem.o
+ obj-$(CONFIG_NVMEM_ROCKCHIP_EFUSE)	+= nvmem_rockchip_efuse.o
+-nvmem_rockchip_efuse-y		:= rockchip-efuse.o
++nvmem_rockchip_efuse-y			:= rockchip-efuse.o
+ obj-$(CONFIG_NVMEM_ROCKCHIP_OTP)	+= nvmem-rockchip-otp.o
+-nvmem-rockchip-otp-y		:= rockchip-otp.o
+-obj-$(CONFIG_NVMEM_SUNXI_SID)	+= nvmem_sunxi_sid.o
+-nvmem_stm32_romem-y 		:= stm32-romem.o
+-obj-$(CONFIG_NVMEM_STM32_ROMEM) += nvmem_stm32_romem.o
+-nvmem_sunxi_sid-y		:= sunxi_sid.o
+-obj-$(CONFIG_NVMEM_UNIPHIER_EFUSE)	+= nvmem-uniphier-efuse.o
+-nvmem-uniphier-efuse-y		:= uniphier-efuse.o
+-obj-$(CONFIG_NVMEM_VF610_OCOTP)	+= nvmem-vf610-ocotp.o
+-nvmem-vf610-ocotp-y		:= vf610-ocotp.o
+-obj-$(CONFIG_NVMEM_MESON_EFUSE)	+= nvmem_meson_efuse.o
+-nvmem_meson_efuse-y		:= meson-efuse.o
+-obj-$(CONFIG_NVMEM_MESON_MX_EFUSE)	+= nvmem_meson_mx_efuse.o
+-nvmem_meson_mx_efuse-y		:= meson-mx-efuse.o
+-obj-$(CONFIG_NVMEM_SNVS_LPGPR)	+= nvmem_snvs_lpgpr.o
+-nvmem_snvs_lpgpr-y		:= snvs_lpgpr.o
+-obj-$(CONFIG_NVMEM_RAVE_SP_EEPROM)	+= nvmem-rave-sp-eeprom.o
+-nvmem-rave-sp-eeprom-y		:= rave-sp-eeprom.o
++nvmem-rockchip-otp-y			:= rockchip-otp.o
+ obj-$(CONFIG_NVMEM_SC27XX_EFUSE)	+= nvmem-sc27xx-efuse.o
+-nvmem-sc27xx-efuse-y		:= sc27xx-efuse.o
+-obj-$(CONFIG_NVMEM_ZYNQMP)	+= nvmem_zynqmp_nvmem.o
+-nvmem_zynqmp_nvmem-y		:= zynqmp_nvmem.o
+-obj-$(CONFIG_NVMEM_SPRD_EFUSE)	+= nvmem_sprd_efuse.o
+-nvmem_sprd_efuse-y		:= sprd-efuse.o
+-obj-$(CONFIG_NVMEM_RMEM) 	+= nvmem-rmem.o
+-nvmem-rmem-y			:= rmem.o
+-obj-$(CONFIG_NVMEM_BRCM_NVRAM)	+= nvmem_brcm_nvram.o
+-nvmem_brcm_nvram-y		:= brcm_nvram.o
+-obj-$(CONFIG_NVMEM_LAYERSCAPE_SFP)	+= nvmem-layerscape-sfp.o
+-nvmem-layerscape-sfp-y		:= layerscape-sfp.o
++nvmem-sc27xx-efuse-y			:= sc27xx-efuse.o
++obj-$(CONFIG_NVMEM_SNVS_LPGPR)		+= nvmem_snvs_lpgpr.o
++nvmem_snvs_lpgpr-y			:= snvs_lpgpr.o
++obj-$(CONFIG_NVMEM_SPMI_SDAM)		+= nvmem_qcom-spmi-sdam.o
++nvmem_qcom-spmi-sdam-y			+= qcom-spmi-sdam.o
++obj-$(CONFIG_NVMEM_SPRD_EFUSE)		+= nvmem_sprd_efuse.o
++nvmem_sprd_efuse-y			:= sprd-efuse.o
++obj-$(CONFIG_NVMEM_STM32_ROMEM)		+= nvmem_stm32_romem.o
++nvmem_stm32_romem-y 			:= stm32-romem.o
+ obj-$(CONFIG_NVMEM_SUNPLUS_OCOTP)	+= nvmem_sunplus_ocotp.o
+-nvmem_sunplus_ocotp-y		:= sunplus-ocotp.o
+-obj-$(CONFIG_NVMEM_APPLE_EFUSES)	+= nvmem-apple-efuses.o
+-nvmem-apple-efuses-y 		:= apple-efuses.o
+-obj-$(CONFIG_NVMEM_MICROCHIP_OTPC)	+= nvmem-microchip-otpc.o
+-nvmem-microchip-otpc-y		:= microchip-otpc.o
+-obj-$(CONFIG_NVMEM_U_BOOT_ENV)	+= nvmem_u-boot-env.o
+-nvmem_u-boot-env-y		:= u-boot-env.o
++nvmem_sunplus_ocotp-y			:= sunplus-ocotp.o
++obj-$(CONFIG_NVMEM_SUNXI_SID)		+= nvmem_sunxi_sid.o
++nvmem_sunxi_sid-y			:= sunxi_sid.o
++obj-$(CONFIG_NVMEM_U_BOOT_ENV)		+= nvmem_u-boot-env.o
++nvmem_u-boot-env-y			:= u-boot-env.o
++obj-$(CONFIG_NVMEM_UNIPHIER_EFUSE)	+= nvmem-uniphier-efuse.o
++nvmem-uniphier-efuse-y			:= uniphier-efuse.o
++obj-$(CONFIG_NVMEM_VF610_OCOTP)		+= nvmem-vf610-ocotp.o
++nvmem-vf610-ocotp-y			:= vf610-ocotp.o
++obj-$(CONFIG_NVMEM_ZYNQMP)		+= nvmem_zynqmp_nvmem.o
++nvmem_zynqmp_nvmem-y			:= zynqmp_nvmem.o
diff --git a/target/linux/generic/backport-5.15/807-v6.1-0007-nvmem-u-boot-env-find-Device-Tree-nodes-for-NVMEM-ce.patch b/target/linux/generic/backport-5.15/807-v6.1-0007-nvmem-u-boot-env-find-Device-Tree-nodes-for-NVMEM-ce.patch
new file mode 100644
index 00000000000000..e0a082adc45e23
--- /dev/null
+++ b/target/linux/generic/backport-5.15/807-v6.1-0007-nvmem-u-boot-env-find-Device-Tree-nodes-for-NVMEM-ce.patch
@@ -0,0 +1,31 @@
+From d4d432670f7dee0a5432fcffcfc8699b25181ace Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 16 Sep 2022 13:20:57 +0100
+Subject: [PATCH] nvmem: u-boot-env: find Device Tree nodes for NVMEM cells
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+DT binding allows specifying NVMEM cells as NVMEM device (provider)
+subnodes. Looks for such subnodes when building NVMEM cells.
+
+This allows NVMEM consumers to use U-Boot environment variables.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220916122100.170016-11-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/u-boot-env.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/nvmem/u-boot-env.c
++++ b/drivers/nvmem/u-boot-env.c
+@@ -92,6 +92,7 @@ static int u_boot_env_add_cells(struct u
+ 			return -ENOMEM;
+ 		priv->cells[idx].offset = data_offset + value - data;
+ 		priv->cells[idx].bytes = strlen(value);
++		priv->cells[idx].np = of_get_child_by_name(dev->of_node, priv->cells[idx].name);
+ 	}
+ 
+ 	if (WARN_ON(idx != priv->ncells))
diff --git a/target/linux/generic/backport-5.15/807-v6.1-0008-nvmem-lan9662-otp-add-support.patch b/target/linux/generic/backport-5.15/807-v6.1-0008-nvmem-lan9662-otp-add-support.patch
new file mode 100644
index 00000000000000..945c6128ff49c2
--- /dev/null
+++ b/target/linux/generic/backport-5.15/807-v6.1-0008-nvmem-lan9662-otp-add-support.patch
@@ -0,0 +1,274 @@
+From 9e8f208ad5229ddda97cd4a83ecf89c735d99592 Mon Sep 17 00:00:00 2001
+From: Horatiu Vultur <horatiu.vultur@microchip.com>
+Date: Fri, 16 Sep 2022 13:20:59 +0100
+Subject: [PATCH] nvmem: lan9662-otp: add support
+
+Add support for OTP controller available on LAN9662. The OTPC controls
+the access to a non-volatile memory. The size of the memory is 8KB.
+The OTPC can access the memory based on an offset.
+Implement both the read and the write functionality.
+
+Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220916122100.170016-13-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/Kconfig        |   8 ++
+ drivers/nvmem/Makefile       |   2 +
+ drivers/nvmem/lan9662-otpc.c | 222 +++++++++++++++++++++++++++++++++++
+ 3 files changed, 232 insertions(+)
+ create mode 100644 drivers/nvmem/lan9662-otpc.c
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -98,6 +98,14 @@ config NVMEM_JZ4780_EFUSE
+ 	  To compile this driver as a module, choose M here: the module
+ 	  will be called nvmem_jz4780_efuse.
+ 
++config NVMEM_LAN9662_OTPC
++	tristate "Microchip LAN9662 OTP controller support"
++	depends on SOC_LAN966 || COMPILE_TEST
++	depends on HAS_IOMEM
++	help
++	  This driver enables the OTP controller available on Microchip LAN9662
++	  SoCs. It controls the access to the OTP memory connected to it.
++
+ config NVMEM_LAYERSCAPE_SFP
+ 	tristate "Layerscape SFP (Security Fuse Processor) support"
+ 	depends on ARCH_LAYERSCAPE || COMPILE_TEST
+--- a/drivers/nvmem/Makefile
++++ b/drivers/nvmem/Makefile
+@@ -21,6 +21,8 @@ obj-$(CONFIG_NVMEM_IMX_OCOTP_SCU)	+= nvm
+ nvmem-imx-ocotp-scu-y			:= imx-ocotp-scu.o
+ obj-$(CONFIG_NVMEM_JZ4780_EFUSE)	+= nvmem_jz4780_efuse.o
+ nvmem_jz4780_efuse-y			:= jz4780-efuse.o
++obj-$(CONFIG_NVMEM_LAN9662_OTPC)	+= nvmem-lan9662-otpc.o
++nvmem-lan9662-otpc-y		:= lan9662-otpc.o
+ obj-$(CONFIG_NVMEM_LAYERSCAPE_SFP)	+= nvmem-layerscape-sfp.o
+ nvmem-layerscape-sfp-y			:= layerscape-sfp.o
+ obj-$(CONFIG_NVMEM_LPC18XX_EEPROM)	+= nvmem_lpc18xx_eeprom.o
+--- /dev/null
++++ b/drivers/nvmem/lan9662-otpc.c
+@@ -0,0 +1,222 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <linux/iopoll.h>
++#include <linux/module.h>
++#include <linux/nvmem-provider.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++
++#define OTP_OTP_PWR_DN(t)			(t + 0x00)
++#define OTP_OTP_PWR_DN_OTP_PWRDN_N		BIT(0)
++#define OTP_OTP_ADDR_HI(t)			(t + 0x04)
++#define OTP_OTP_ADDR_LO(t)			(t + 0x08)
++#define OTP_OTP_PRGM_DATA(t)			(t + 0x10)
++#define OTP_OTP_PRGM_MODE(t)			(t + 0x14)
++#define OTP_OTP_PRGM_MODE_OTP_PGM_MODE_BYTE	BIT(0)
++#define OTP_OTP_RD_DATA(t)			(t + 0x18)
++#define OTP_OTP_FUNC_CMD(t)			(t + 0x20)
++#define OTP_OTP_FUNC_CMD_OTP_PROGRAM		BIT(1)
++#define OTP_OTP_FUNC_CMD_OTP_READ		BIT(0)
++#define OTP_OTP_CMD_GO(t)			(t + 0x28)
++#define OTP_OTP_CMD_GO_OTP_GO			BIT(0)
++#define OTP_OTP_PASS_FAIL(t)			(t + 0x2c)
++#define OTP_OTP_PASS_FAIL_OTP_READ_PROHIBITED	BIT(3)
++#define OTP_OTP_PASS_FAIL_OTP_WRITE_PROHIBITED	BIT(2)
++#define OTP_OTP_PASS_FAIL_OTP_FAIL		BIT(0)
++#define OTP_OTP_STATUS(t)			(t + 0x30)
++#define OTP_OTP_STATUS_OTP_CPUMPEN		BIT(1)
++#define OTP_OTP_STATUS_OTP_BUSY			BIT(0)
++
++#define OTP_MEM_SIZE 8192
++#define OTP_SLEEP_US 10
++#define OTP_TIMEOUT_US 500000
++
++struct lan9662_otp {
++	struct device *dev;
++	void __iomem *base;
++};
++
++static bool lan9662_otp_wait_flag_clear(void __iomem *reg, u32 flag)
++{
++	u32 val;
++
++	return readl_poll_timeout(reg, val, !(val & flag),
++				  OTP_SLEEP_US, OTP_TIMEOUT_US);
++}
++
++static int lan9662_otp_power(struct lan9662_otp *otp, bool up)
++{
++	void __iomem *pwrdn = OTP_OTP_PWR_DN(otp->base);
++
++	if (up) {
++		writel(readl(pwrdn) & ~OTP_OTP_PWR_DN_OTP_PWRDN_N, pwrdn);
++		if (lan9662_otp_wait_flag_clear(OTP_OTP_STATUS(otp->base),
++						OTP_OTP_STATUS_OTP_CPUMPEN))
++			return -ETIMEDOUT;
++	} else {
++		writel(readl(pwrdn) | OTP_OTP_PWR_DN_OTP_PWRDN_N, pwrdn);
++	}
++
++	return 0;
++}
++
++static int lan9662_otp_execute(struct lan9662_otp *otp)
++{
++	if (lan9662_otp_wait_flag_clear(OTP_OTP_CMD_GO(otp->base),
++					OTP_OTP_CMD_GO_OTP_GO))
++		return -ETIMEDOUT;
++
++	if (lan9662_otp_wait_flag_clear(OTP_OTP_STATUS(otp->base),
++					OTP_OTP_STATUS_OTP_BUSY))
++		return -ETIMEDOUT;
++
++	return 0;
++}
++
++static void lan9662_otp_set_address(struct lan9662_otp *otp, u32 offset)
++{
++	writel(0xff & (offset >> 8), OTP_OTP_ADDR_HI(otp->base));
++	writel(0xff & offset, OTP_OTP_ADDR_LO(otp->base));
++}
++
++static int lan9662_otp_read_byte(struct lan9662_otp *otp, u32 offset, u8 *dst)
++{
++	u32 pass;
++	int rc;
++
++	lan9662_otp_set_address(otp, offset);
++	writel(OTP_OTP_FUNC_CMD_OTP_READ, OTP_OTP_FUNC_CMD(otp->base));
++	writel(OTP_OTP_CMD_GO_OTP_GO, OTP_OTP_CMD_GO(otp->base));
++	rc = lan9662_otp_execute(otp);
++	if (!rc) {
++		pass = readl(OTP_OTP_PASS_FAIL(otp->base));
++		if (pass & OTP_OTP_PASS_FAIL_OTP_READ_PROHIBITED)
++			return -EACCES;
++		*dst = (u8) readl(OTP_OTP_RD_DATA(otp->base));
++	}
++	return rc;
++}
++
++static int lan9662_otp_write_byte(struct lan9662_otp *otp, u32 offset, u8 data)
++{
++	u32 pass;
++	int rc;
++
++	lan9662_otp_set_address(otp, offset);
++	writel(OTP_OTP_PRGM_MODE_OTP_PGM_MODE_BYTE, OTP_OTP_PRGM_MODE(otp->base));
++	writel(data, OTP_OTP_PRGM_DATA(otp->base));
++	writel(OTP_OTP_FUNC_CMD_OTP_PROGRAM, OTP_OTP_FUNC_CMD(otp->base));
++	writel(OTP_OTP_CMD_GO_OTP_GO, OTP_OTP_CMD_GO(otp->base));
++
++	rc = lan9662_otp_execute(otp);
++	if (!rc) {
++		pass = readl(OTP_OTP_PASS_FAIL(otp->base));
++		if (pass & OTP_OTP_PASS_FAIL_OTP_WRITE_PROHIBITED)
++			return -EACCES;
++		if (pass & OTP_OTP_PASS_FAIL_OTP_FAIL)
++			return -EIO;
++	}
++	return rc;
++}
++
++static int lan9662_otp_read(void *context, unsigned int offset,
++			    void *_val, size_t bytes)
++{
++	struct lan9662_otp *otp = context;
++	u8 *val = _val;
++	uint8_t data;
++	int i, rc = 0;
++
++	lan9662_otp_power(otp, true);
++	for (i = 0; i < bytes; i++) {
++		rc = lan9662_otp_read_byte(otp, offset + i, &data);
++		if (rc < 0)
++			break;
++		*val++ = data;
++	}
++	lan9662_otp_power(otp, false);
++
++	return rc;
++}
++
++static int lan9662_otp_write(void *context, unsigned int offset,
++			     void *_val, size_t bytes)
++{
++	struct lan9662_otp *otp = context;
++	u8 *val = _val;
++	u8 data, newdata;
++	int i, rc = 0;
++
++	lan9662_otp_power(otp, true);
++	for (i = 0; i < bytes; i++) {
++		/* Skip zero bytes */
++		if (val[i]) {
++			rc = lan9662_otp_read_byte(otp, offset + i, &data);
++			if (rc < 0)
++				break;
++
++			newdata = data | val[i];
++			if (newdata == data)
++				continue;
++
++			rc = lan9662_otp_write_byte(otp, offset + i,
++						      newdata);
++			if (rc < 0)
++				break;
++		}
++	}
++	lan9662_otp_power(otp, false);
++
++	return rc;
++}
++
++static struct nvmem_config otp_config = {
++	.name = "lan9662-otp",
++	.stride = 1,
++	.word_size = 1,
++	.reg_read = lan9662_otp_read,
++	.reg_write = lan9662_otp_write,
++	.size = OTP_MEM_SIZE,
++};
++
++static int lan9662_otp_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct nvmem_device *nvmem;
++	struct lan9662_otp *otp;
++
++	otp = devm_kzalloc(&pdev->dev, sizeof(*otp), GFP_KERNEL);
++	if (!otp)
++		return -ENOMEM;
++
++	otp->dev = dev;
++	otp->base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(otp->base))
++		return PTR_ERR(otp->base);
++
++	otp_config.priv = otp;
++	otp_config.dev = dev;
++
++	nvmem = devm_nvmem_register(dev, &otp_config);
++
++	return PTR_ERR_OR_ZERO(nvmem);
++}
++
++static const struct of_device_id lan9662_otp_match[] = {
++	{ .compatible = "microchip,lan9662-otp", },
++	{ },
++};
++MODULE_DEVICE_TABLE(of, lan9662_otp_match);
++
++static struct platform_driver lan9662_otp_driver = {
++	.probe = lan9662_otp_probe,
++	.driver = {
++		.name = "lan9662-otp",
++		.of_match_table = lan9662_otp_match,
++	},
++};
++module_platform_driver(lan9662_otp_driver);
++
++MODULE_AUTHOR("Horatiu Vultur <horatiu.vultur@microchip.com>");
++MODULE_DESCRIPTION("lan9662 OTP driver");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/generic/backport-5.15/807-v6.1-0009-nvmem-u-boot-env-fix-crc32-casting-type.patch b/target/linux/generic/backport-5.15/807-v6.1-0009-nvmem-u-boot-env-fix-crc32-casting-type.patch
new file mode 100644
index 00000000000000..633a668a962f65
--- /dev/null
+++ b/target/linux/generic/backport-5.15/807-v6.1-0009-nvmem-u-boot-env-fix-crc32-casting-type.patch
@@ -0,0 +1,32 @@
+From 3717ca3e0cc8683f93b41d3f06ca79631eb58715 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 16 Sep 2022 13:21:00 +0100
+Subject: [PATCH] nvmem: u-boot-env: fix crc32 casting type
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This fixes:
+drivers/nvmem/u-boot-env.c:141:17: sparse: sparse: cast to restricted __le32
+
+Fixes: d5542923f200 ("nvmem: add driver handling U-Boot environment variables")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220916122100.170016-14-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/u-boot-env.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/u-boot-env.c
++++ b/drivers/nvmem/u-boot-env.c
+@@ -139,7 +139,7 @@ static int u_boot_env_parse(struct u_boo
+ 		data_offset = offsetof(struct u_boot_env_image_redundant, data);
+ 		break;
+ 	}
+-	crc32 = le32_to_cpu(*(uint32_t *)(buf + crc32_offset));
++	crc32 = le32_to_cpu(*(__le32 *)(buf + crc32_offset));
+ 	crc32_data_len = priv->mtd->size - crc32_data_offset;
+ 	data_len = priv->mtd->size - data_offset;
+ 
diff --git a/target/linux/generic/backport-5.15/807-v6.1-0010-nvmem-lan9662-otp-Fix-compatible-string.patch b/target/linux/generic/backport-5.15/807-v6.1-0010-nvmem-lan9662-otp-Fix-compatible-string.patch
new file mode 100644
index 00000000000000..b663a1328df3df
--- /dev/null
+++ b/target/linux/generic/backport-5.15/807-v6.1-0010-nvmem-lan9662-otp-Fix-compatible-string.patch
@@ -0,0 +1,34 @@
+From 1aeb122d214b92474c86fde00a03d6e2d69381b5 Mon Sep 17 00:00:00 2001
+From: Horatiu Vultur <horatiu.vultur@microchip.com>
+Date: Wed, 28 Sep 2022 21:51:12 +0200
+Subject: [PATCH] nvmem: lan9662-otp: Fix compatible string
+
+The device tree bindings for lan9662-otp expects the compatible string
+to be one of following compatible strings:
+microchip,lan9662-otpc
+microchip,lan9668-otpc
+
+The problem is that the lan9662-otp driver contains the
+microchip,lan9662-otp compatible string instead of
+microchip,lan9662-otpc.
+Fix this by updating the compatible string in the driver.
+
+Fixes: 9e8f208ad5229d ("nvmem: lan9662-otp: add support")
+Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>
+Link: https://lore.kernel.org/r/20220928195112.630351-1-horatiu.vultur@microchip.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/lan9662-otpc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/lan9662-otpc.c
++++ b/drivers/nvmem/lan9662-otpc.c
+@@ -203,7 +203,7 @@ static int lan9662_otp_probe(struct plat
+ }
+ 
+ static const struct of_device_id lan9662_otp_match[] = {
+-	{ .compatible = "microchip,lan9662-otp", },
++	{ .compatible = "microchip,lan9662-otpc", },
+ 	{ },
+ };
+ MODULE_DEVICE_TABLE(of, lan9662_otp_match);
diff --git a/target/linux/generic/backport-5.15/807-v6.1-0011-nvmem-u-boot-env-fix-crc32_data_offset-on-redundant-.patch b/target/linux/generic/backport-5.15/807-v6.1-0011-nvmem-u-boot-env-fix-crc32_data_offset-on-redundant-.patch
new file mode 100644
index 00000000000000..967e891dbd9c5f
--- /dev/null
+++ b/target/linux/generic/backport-5.15/807-v6.1-0011-nvmem-u-boot-env-fix-crc32_data_offset-on-redundant-.patch
@@ -0,0 +1,59 @@
+From ee424f7d3960152f5f862bbb6943e59828dc7917 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@gmail.com>
+Date: Fri, 4 Nov 2022 17:52:03 +0100
+Subject: [PATCH] nvmem: u-boot-env: fix crc32_data_offset on redundant
+ u-boot-env
+
+The Western Digital MyBook Live (PowerPC 464/APM82181)
+has a set of redundant u-boot-env. Loading up the driver
+the following error:
+
+| u_boot_env: Invalid calculated CRC32: 0x4f8f2c86 (expected: 0x98b14514)
+| u_boot_env: probe of partition@1e000 failed with error -22
+
+Looking up the userspace libubootenv utilities source [0],
+it looks like the "mark" or "flag" is not part of the
+crc32 sum... which is unfortunate :(
+
+|static int libuboot_load(struct uboot_ctx *ctx)
+|{
+|[...]
+|       if (ctx->redundant) {
+|		[...]
+|               offsetdata = offsetof(struct uboot_env_redund, data);
+|		[...]					//-----^^
+|       }
+|       usable_envsize = ctx->size - offsetdata;
+|       buf[0] = malloc(bufsize);
+|[...]
+|	for (i = 0; i < copies; i++) {
+|		data = (uint8_t *)(buf[i] + offsetdata);
+|               uint32_t crc;
+|
+|		ret = devread(ctx, i, buf[i]);
+|		[...]
+|		crc = *(uint32_t *)(buf[i] + offsetcrc);
+|               dev->crc = crc32(0, (uint8_t *)data, usable_envsize);
+|
+
+[0] https://github.com/sbabic/libubootenv/blob/master/src/uboot_env.c#L951
+
+Fixes: d5542923f200 ("nvmem: add driver handling U-Boot environment variables")
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+Link: https://lore.kernel.org/r/70a16eae113e08db2390b76e174f4837caa135c3.1667580636.git.chunkeey@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/u-boot-env.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/u-boot-env.c
++++ b/drivers/nvmem/u-boot-env.c
+@@ -135,7 +135,7 @@ static int u_boot_env_parse(struct u_boo
+ 		break;
+ 	case U_BOOT_FORMAT_REDUNDANT:
+ 		crc32_offset = offsetof(struct u_boot_env_image_redundant, crc32);
+-		crc32_data_offset = offsetof(struct u_boot_env_image_redundant, mark);
++		crc32_data_offset = offsetof(struct u_boot_env_image_redundant, data);
+ 		data_offset = offsetof(struct u_boot_env_image_redundant, data);
+ 		break;
+ 	}
diff --git a/target/linux/generic/backport-5.15/807-v6.1-0013-nvmem-lan9662-otp-Change-return-type-of-lan9662_otp_.patch b/target/linux/generic/backport-5.15/807-v6.1-0013-nvmem-lan9662-otp-Change-return-type-of-lan9662_otp_.patch
new file mode 100644
index 00000000000000..0c842f0793219b
--- /dev/null
+++ b/target/linux/generic/backport-5.15/807-v6.1-0013-nvmem-lan9662-otp-Change-return-type-of-lan9662_otp_.patch
@@ -0,0 +1,35 @@
+From 022b68f271de0e53024e6d5e96fee8e76d25eb95 Mon Sep 17 00:00:00 2001
+From: Horatiu Vultur <horatiu.vultur@microchip.com>
+Date: Fri, 18 Nov 2022 06:38:40 +0000
+Subject: [PATCH] nvmem: lan9662-otp: Change return type of
+ lan9662_otp_wait_flag_clear()
+
+The blamed commit introduced the following smatch warning in the
+function lan9662_otp_wait_flag_clear:
+drivers/nvmem/lan9662-otpc.c:43 lan9662_otp_wait_flag_clear() warn: signedness bug returning '(-110)'
+
+Fix this by changing the return type of the function
+lan9662_otp_wait_flag_clear() to be int instead of bool.
+
+Fixes: 9e8f208ad5229d ("nvmem: lan9662-otp: add support")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20221118063840.6357-5-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/lan9662-otpc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/lan9662-otpc.c
++++ b/drivers/nvmem/lan9662-otpc.c
+@@ -36,7 +36,7 @@ struct lan9662_otp {
+ 	void __iomem *base;
+ };
+ 
+-static bool lan9662_otp_wait_flag_clear(void __iomem *reg, u32 flag)
++static int lan9662_otp_wait_flag_clear(void __iomem *reg, u32 flag)
+ {
+ 	u32 val;
+ 
diff --git a/target/linux/generic/backport-5.15/808-v6.2-0001-nvmem-stm32-move-STM32MP15_BSEC_NUM_LOWER-in-config.patch b/target/linux/generic/backport-5.15/808-v6.2-0001-nvmem-stm32-move-STM32MP15_BSEC_NUM_LOWER-in-config.patch
new file mode 100644
index 00000000000000..33759632ebe4f4
--- /dev/null
+++ b/target/linux/generic/backport-5.15/808-v6.2-0001-nvmem-stm32-move-STM32MP15_BSEC_NUM_LOWER-in-config.patch
@@ -0,0 +1,82 @@
+From fbfc4ca465a1f8d81bf2d67d95bf7fc67c3cf0c2 Mon Sep 17 00:00:00 2001
+From: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Date: Fri, 18 Nov 2022 06:39:20 +0000
+Subject: [PATCH] nvmem: stm32: move STM32MP15_BSEC_NUM_LOWER in config
+
+Support STM32MP15_BSEC_NUM_LOWER in stm32 romem config to prepare
+the next SoC in STM32MP family.
+
+Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20221118063932.6418-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/stm32-romem.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+--- a/drivers/nvmem/stm32-romem.c
++++ b/drivers/nvmem/stm32-romem.c
+@@ -22,16 +22,15 @@
+ /* shadow registers offest */
+ #define STM32MP15_BSEC_DATA0		0x200
+ 
+-/* 32 (x 32-bits) lower shadow registers */
+-#define STM32MP15_BSEC_NUM_LOWER	32
+-
+ struct stm32_romem_cfg {
+ 	int size;
++	u8 lower;
+ };
+ 
+ struct stm32_romem_priv {
+ 	void __iomem *base;
+ 	struct nvmem_config cfg;
++	u8 lower;
+ };
+ 
+ static int stm32_romem_read(void *context, unsigned int offset, void *buf,
+@@ -85,7 +84,7 @@ static int stm32_bsec_read(void *context
+ 	for (i = roffset; (i < roffset + rbytes); i += 4) {
+ 		u32 otp = i >> 2;
+ 
+-		if (otp < STM32MP15_BSEC_NUM_LOWER) {
++		if (otp < priv->lower) {
+ 			/* read lower data from shadow registers */
+ 			val = readl_relaxed(
+ 				priv->base + STM32MP15_BSEC_DATA0 + i);
+@@ -159,6 +158,8 @@ static int stm32_romem_probe(struct plat
+ 	priv->cfg.priv = priv;
+ 	priv->cfg.owner = THIS_MODULE;
+ 
++	priv->lower = 0;
++
+ 	cfg = (const struct stm32_romem_cfg *)
+ 		of_match_device(dev->driver->of_match_table, dev)->data;
+ 	if (!cfg) {
+@@ -167,6 +168,7 @@ static int stm32_romem_probe(struct plat
+ 		priv->cfg.reg_read = stm32_romem_read;
+ 	} else {
+ 		priv->cfg.size = cfg->size;
++		priv->lower = cfg->lower;
+ 		priv->cfg.reg_read = stm32_bsec_read;
+ 		priv->cfg.reg_write = stm32_bsec_write;
+ 	}
+@@ -174,8 +176,17 @@ static int stm32_romem_probe(struct plat
+ 	return PTR_ERR_OR_ZERO(devm_nvmem_register(dev, &priv->cfg));
+ }
+ 
++/*
++ * STM32MP15 BSEC OTP regions: 4096 OTP bits (with 3072 effective bits)
++ * => 96 x 32-bits data words
++ * - Lower: 1K bits, 2:1 redundancy, incremental bit programming
++ *   => 32 (x 32-bits) lower shadow registers = words 0 to 31
++ * - Upper: 2K bits, ECC protection, word programming only
++ *   => 64 (x 32-bits) = words 32 to 95
++ */
+ static const struct stm32_romem_cfg stm32mp15_bsec_cfg = {
+-	.size = 384, /* 96 x 32-bits data words */
++	.size = 384,
++	.lower = 32,
+ };
+ 
+ static const struct of_device_id stm32_romem_of_match[] = {
diff --git a/target/linux/generic/backport-5.15/808-v6.2-0002-nvmem-stm32-add-warning-when-upper-OTPs-are-updated.patch b/target/linux/generic/backport-5.15/808-v6.2-0002-nvmem-stm32-add-warning-when-upper-OTPs-are-updated.patch
new file mode 100644
index 00000000000000..5791df2606ffe3
--- /dev/null
+++ b/target/linux/generic/backport-5.15/808-v6.2-0002-nvmem-stm32-add-warning-when-upper-OTPs-are-updated.patch
@@ -0,0 +1,34 @@
+From d61784e6410f3df2028e6eb91b06ffed37a660e0 Mon Sep 17 00:00:00 2001
+From: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Date: Fri, 18 Nov 2022 06:39:21 +0000
+Subject: [PATCH] nvmem: stm32: add warning when upper OTPs are updated
+
+As the upper OTPs are ECC protected, they support only one 32 bits word
+programming.
+For a second modification of this word, these ECC become invalid and
+this OTP will be no more accessible, the shadowed value is invalid.
+
+This patch adds a warning to indicate an upper OTP update, because this
+operation is dangerous as OTP is not locked by the driver after the first
+update to avoid a second update.
+
+Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20221118063932.6418-3-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/stm32-romem.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/nvmem/stm32-romem.c
++++ b/drivers/nvmem/stm32-romem.c
+@@ -132,6 +132,9 @@ static int stm32_bsec_write(void *contex
+ 		}
+ 	}
+ 
++	if (offset + bytes >= priv->lower * 4)
++		dev_warn(dev, "Update of upper OTPs with ECC protection (word programming, only once)\n");
++
+ 	return 0;
+ }
+ 
diff --git a/target/linux/generic/backport-5.15/808-v6.2-0003-nvmem-stm32-add-nvmem-type-attribute.patch b/target/linux/generic/backport-5.15/808-v6.2-0003-nvmem-stm32-add-nvmem-type-attribute.patch
new file mode 100644
index 00000000000000..b83ad69c6b4ebb
--- /dev/null
+++ b/target/linux/generic/backport-5.15/808-v6.2-0003-nvmem-stm32-add-nvmem-type-attribute.patch
@@ -0,0 +1,26 @@
+From a3816a7d7c097c1da46aad5f5d1e229b607dce04 Mon Sep 17 00:00:00 2001
+From: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Date: Fri, 18 Nov 2022 06:39:22 +0000
+Subject: [PATCH] nvmem: stm32: add nvmem type attribute
+
+Inform NVMEM framework of type attribute for stm32-romem as NVMEM_TYPE_OTP
+so userspace is able to know how the data is stored in BSEC.
+
+Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20221118063932.6418-4-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/stm32-romem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/nvmem/stm32-romem.c
++++ b/drivers/nvmem/stm32-romem.c
+@@ -160,6 +160,7 @@ static int stm32_romem_probe(struct plat
+ 	priv->cfg.dev = dev;
+ 	priv->cfg.priv = priv;
+ 	priv->cfg.owner = THIS_MODULE;
++	priv->cfg.type = NVMEM_TYPE_OTP;
+ 
+ 	priv->lower = 0;
+ 
diff --git a/target/linux/generic/backport-5.15/808-v6.2-0004-nvmem-stm32-fix-spelling-typo-in-comment.patch b/target/linux/generic/backport-5.15/808-v6.2-0004-nvmem-stm32-fix-spelling-typo-in-comment.patch
new file mode 100644
index 00000000000000..52ba1e65b567fa
--- /dev/null
+++ b/target/linux/generic/backport-5.15/808-v6.2-0004-nvmem-stm32-fix-spelling-typo-in-comment.patch
@@ -0,0 +1,27 @@
+From 06aac0e11960a7ddccc1888326b5906d017e0f24 Mon Sep 17 00:00:00 2001
+From: Jiangshan Yi <yijiangshan@kylinos.cn>
+Date: Fri, 18 Nov 2022 06:39:24 +0000
+Subject: [PATCH] nvmem: stm32: fix spelling typo in comment
+
+Fix spelling typo in comment.
+
+Reported-by: k2ci <kernel-bot@kylinos.cn>
+Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20221118063932.6418-6-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/stm32-romem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/stm32-romem.c
++++ b/drivers/nvmem/stm32-romem.c
+@@ -19,7 +19,7 @@
+ #define STM32_SMC_WRITE_SHADOW		0x03
+ #define STM32_SMC_READ_OTP		0x04
+ 
+-/* shadow registers offest */
++/* shadow registers offset */
+ #define STM32MP15_BSEC_DATA0		0x200
+ 
+ struct stm32_romem_cfg {
diff --git a/target/linux/generic/backport-5.15/808-v6.2-0005-nvmem-Kconfig-Fix-spelling-mistake-controlls-control.patch b/target/linux/generic/backport-5.15/808-v6.2-0005-nvmem-Kconfig-Fix-spelling-mistake-controlls-control.patch
new file mode 100644
index 00000000000000..8f024f4c1acb8b
--- /dev/null
+++ b/target/linux/generic/backport-5.15/808-v6.2-0005-nvmem-Kconfig-Fix-spelling-mistake-controlls-control.patch
@@ -0,0 +1,27 @@
+From fb817c4ef63e8cfb6e77ae4a2875ae854c80708f Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.i.king@gmail.com>
+Date: Fri, 18 Nov 2022 06:39:26 +0000
+Subject: [PATCH] nvmem: Kconfig: Fix spelling mistake "controlls" ->
+ "controls"
+
+There is a spelling mistake in a Kconfig description. Fix it.
+
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20221118063932.6418-8-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -164,7 +164,7 @@ config NVMEM_MICROCHIP_OTPC
+ 	depends on ARCH_AT91 || COMPILE_TEST
+ 	help
+ 	  This driver enable the OTP controller available on Microchip SAMA7G5
+-	  SoCs. It controlls the access to the OTP memory connected to it.
++	  SoCs. It controls the access to the OTP memory connected to it.
+ 
+ config NVMEM_MTK_EFUSE
+ 	tristate "Mediatek SoCs EFUSE support"
diff --git a/target/linux/generic/backport-5.15/808-v6.2-0006-nvmem-u-boot-env-add-Broadcom-format-support.patch b/target/linux/generic/backport-5.15/808-v6.2-0006-nvmem-u-boot-env-add-Broadcom-format-support.patch
new file mode 100644
index 00000000000000..861386ad310b59
--- /dev/null
+++ b/target/linux/generic/backport-5.15/808-v6.2-0006-nvmem-u-boot-env-add-Broadcom-format-support.patch
@@ -0,0 +1,67 @@
+From ada84d07af6097b2addd18262668ce6cb9e15206 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 18 Nov 2022 06:39:27 +0000
+Subject: [PATCH] nvmem: u-boot-env: add Broadcom format support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Broadcom uses U-Boot for a lot of their bcmbca familiy chipsets. They
+decided to store U-Boot environment data inside U-Boot partition and to
+use a custom header (with "uEnv" magic and env data length).
+
+Add support for Broadcom's specific binding and their custom format.
+
+Ref: 6b0584c19d87 ("dt-bindings: nvmem: u-boot,env: add Broadcom's variant binding")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20221118063932.6418-9-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/u-boot-env.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/nvmem/u-boot-env.c
++++ b/drivers/nvmem/u-boot-env.c
+@@ -16,6 +16,7 @@
+ enum u_boot_env_format {
+ 	U_BOOT_FORMAT_SINGLE,
+ 	U_BOOT_FORMAT_REDUNDANT,
++	U_BOOT_FORMAT_BROADCOM,
+ };
+ 
+ struct u_boot_env {
+@@ -40,6 +41,13 @@ struct u_boot_env_image_redundant {
+ 	uint8_t data[];
+ } __packed;
+ 
++struct u_boot_env_image_broadcom {
++	__le32 magic;
++	__le32 len;
++	__le32 crc32;
++	uint8_t data[0];
++} __packed;
++
+ static int u_boot_env_read(void *context, unsigned int offset, void *val,
+ 			   size_t bytes)
+ {
+@@ -138,6 +146,11 @@ static int u_boot_env_parse(struct u_boo
+ 		crc32_data_offset = offsetof(struct u_boot_env_image_redundant, data);
+ 		data_offset = offsetof(struct u_boot_env_image_redundant, data);
+ 		break;
++	case U_BOOT_FORMAT_BROADCOM:
++		crc32_offset = offsetof(struct u_boot_env_image_broadcom, crc32);
++		crc32_data_offset = offsetof(struct u_boot_env_image_broadcom, data);
++		data_offset = offsetof(struct u_boot_env_image_broadcom, data);
++		break;
+ 	}
+ 	crc32 = le32_to_cpu(*(__le32 *)(buf + crc32_offset));
+ 	crc32_data_len = priv->mtd->size - crc32_data_offset;
+@@ -202,6 +215,7 @@ static const struct of_device_id u_boot_
+ 	{ .compatible = "u-boot,env", .data = (void *)U_BOOT_FORMAT_SINGLE, },
+ 	{ .compatible = "u-boot,env-redundant-bool", .data = (void *)U_BOOT_FORMAT_REDUNDANT, },
+ 	{ .compatible = "u-boot,env-redundant-count", .data = (void *)U_BOOT_FORMAT_REDUNDANT, },
++	{ .compatible = "brcm,env", .data = (void *)U_BOOT_FORMAT_BROADCOM, },
+ 	{},
+ };
+ 
diff --git a/target/linux/generic/backport-5.15/808-v6.2-0007-nvmem-brcm_nvram-Add-check-for-kzalloc.patch b/target/linux/generic/backport-5.15/808-v6.2-0007-nvmem-brcm_nvram-Add-check-for-kzalloc.patch
new file mode 100644
index 00000000000000..14108b59276857
--- /dev/null
+++ b/target/linux/generic/backport-5.15/808-v6.2-0007-nvmem-brcm_nvram-Add-check-for-kzalloc.patch
@@ -0,0 +1,30 @@
+From b0576ade3aaf24b376ea1a4406ae138e2a22b0c0 Mon Sep 17 00:00:00 2001
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Date: Fri, 27 Jan 2023 10:40:06 +0000
+Subject: [PATCH] nvmem: brcm_nvram: Add check for kzalloc
+
+Add the check for the return value of kzalloc in order to avoid
+NULL pointer dereference.
+
+Fixes: 6e977eaa8280 ("nvmem: brcm_nvram: parse NVRAM content into NVMEM cells")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230127104015.23839-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/brcm_nvram.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/nvmem/brcm_nvram.c
++++ b/drivers/nvmem/brcm_nvram.c
+@@ -97,6 +97,9 @@ static int brcm_nvram_parse(struct brcm_
+ 	len = le32_to_cpu(header.len);
+ 
+ 	data = kzalloc(len, GFP_KERNEL);
++	if (!data)
++		return -ENOMEM;
++
+ 	memcpy_fromio(data, priv->base, len);
+ 	data[len - 1] = '\0';
+ 
diff --git a/target/linux/generic/backport-5.15/808-v6.2-0008-nvmem-sunxi_sid-Always-use-32-bit-MMIO-reads.patch b/target/linux/generic/backport-5.15/808-v6.2-0008-nvmem-sunxi_sid-Always-use-32-bit-MMIO-reads.patch
new file mode 100644
index 00000000000000..632b01cb2ac8f3
--- /dev/null
+++ b/target/linux/generic/backport-5.15/808-v6.2-0008-nvmem-sunxi_sid-Always-use-32-bit-MMIO-reads.patch
@@ -0,0 +1,55 @@
+From c151d5ed8e8fe0474bd61dce7f2076ca5916c683 Mon Sep 17 00:00:00 2001
+From: Samuel Holland <samuel@sholland.org>
+Date: Fri, 27 Jan 2023 10:40:07 +0000
+Subject: [PATCH] nvmem: sunxi_sid: Always use 32-bit MMIO reads
+
+The SID SRAM on at least some SoCs (A64 and D1) returns different values
+when read with bus cycles narrower than 32 bits. This is not immediately
+obvious, because memcpy_fromio() uses word-size accesses as long as
+enough data is being copied.
+
+The vendor driver always uses 32-bit MMIO reads, so do the same here.
+This is faster than the register-based method, which is currently used
+as a workaround on A64. And it fixes the values returned on D1, where
+the SRAM method was being used.
+
+The special case for the last word is needed to maintain .word_size == 1
+for sysfs ABI compatibility, as noted previously in commit de2a3eaea552
+("nvmem: sunxi_sid: Optimize register read-out method").
+
+Fixes: 07ae4fde9efa ("nvmem: sunxi_sid: Add support for D1 variant")
+Cc: stable@vger.kernel.org
+Tested-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Samuel Holland <samuel@sholland.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230127104015.23839-3-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/sunxi_sid.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/drivers/nvmem/sunxi_sid.c
++++ b/drivers/nvmem/sunxi_sid.c
+@@ -41,8 +41,21 @@ static int sunxi_sid_read(void *context,
+ 			  void *val, size_t bytes)
+ {
+ 	struct sunxi_sid *sid = context;
++	u32 word;
+ 
+-	memcpy_fromio(val, sid->base + sid->value_offset + offset, bytes);
++	/* .stride = 4 so offset is guaranteed to be aligned */
++	__ioread32_copy(val, sid->base + sid->value_offset + offset, bytes / 4);
++
++	val += round_down(bytes, 4);
++	offset += round_down(bytes, 4);
++	bytes = bytes % 4;
++
++	if (!bytes)
++		return 0;
++
++	/* Handle any trailing bytes */
++	word = readl_relaxed(sid->base + sid->value_offset + offset);
++	memcpy(val, &word, bytes);
+ 
+ 	return 0;
+ }
diff --git a/target/linux/generic/backport-5.15/808-v6.2-0013-nvmem-core-fix-device-node-refcounting.patch b/target/linux/generic/backport-5.15/808-v6.2-0013-nvmem-core-fix-device-node-refcounting.patch
new file mode 100644
index 00000000000000..a229c303ad0f8c
--- /dev/null
+++ b/target/linux/generic/backport-5.15/808-v6.2-0013-nvmem-core-fix-device-node-refcounting.patch
@@ -0,0 +1,48 @@
+From edcf2fb660526b5ed29f93bd17328a2b4835c8b2 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Fri, 27 Jan 2023 10:40:12 +0000
+Subject: [PATCH] nvmem: core: fix device node refcounting
+
+In of_nvmem_cell_get(), of_get_next_parent() is used on cell_np. This
+will decrement the refcount on cell_np, but cell_np is still used later
+in the code. Use of_get_parent() instead and of_node_put() in the
+appropriate places.
+
+Fixes: 69aba7948cbe ("nvmem: Add a simple NVMEM framework for consumers")
+Fixes: 7ae6478b304b ("nvmem: core: rework nvmem cell instance creation")
+Cc: stable@vger.kernel.org
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230127104015.23839-8-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -1237,16 +1237,21 @@ struct nvmem_cell *of_nvmem_cell_get(str
+ 	if (!cell_np)
+ 		return ERR_PTR(-ENOENT);
+ 
+-	nvmem_np = of_get_next_parent(cell_np);
+-	if (!nvmem_np)
++	nvmem_np = of_get_parent(cell_np);
++	if (!nvmem_np) {
++		of_node_put(cell_np);
+ 		return ERR_PTR(-EINVAL);
++	}
+ 
+ 	nvmem = __nvmem_device_get(nvmem_np, device_match_of_node);
+ 	of_node_put(nvmem_np);
+-	if (IS_ERR(nvmem))
++	if (IS_ERR(nvmem)) {
++		of_node_put(cell_np);
+ 		return ERR_CAST(nvmem);
++	}
+ 
+ 	cell_entry = nvmem_find_cell_entry_by_node(nvmem, cell_np);
++	of_node_put(cell_np);
+ 	if (!cell_entry) {
+ 		__nvmem_device_put(nvmem);
+ 		return ERR_PTR(-ENOENT);
diff --git a/target/linux/generic/backport-5.15/809-v6.3-0001-nvmem-core-remove-spurious-white-space.patch b/target/linux/generic/backport-5.15/809-v6.3-0001-nvmem-core-remove-spurious-white-space.patch
new file mode 100644
index 00000000000000..01400fd490d027
--- /dev/null
+++ b/target/linux/generic/backport-5.15/809-v6.3-0001-nvmem-core-remove-spurious-white-space.patch
@@ -0,0 +1,26 @@
+From 2e8dc541ae207349b51c65391be625ffe1f86e0c Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Mon, 6 Feb 2023 13:43:41 +0000
+Subject: [PATCH] nvmem: core: remove spurious white space
+
+Remove a spurious white space in for the ida_alloc() call.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-8-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -764,7 +764,7 @@ struct nvmem_device *nvmem_register(cons
+ 	if (!nvmem)
+ 		return ERR_PTR(-ENOMEM);
+ 
+-	rval  = ida_alloc(&nvmem_ida, GFP_KERNEL);
++	rval = ida_alloc(&nvmem_ida, GFP_KERNEL);
+ 	if (rval < 0) {
+ 		kfree(nvmem);
+ 		return ERR_PTR(rval);
diff --git a/target/linux/generic/backport-5.15/809-v6.3-0002-nvmem-core-add-an-index-parameter-to-the-cell.patch b/target/linux/generic/backport-5.15/809-v6.3-0002-nvmem-core-add-an-index-parameter-to-the-cell.patch
new file mode 100644
index 00000000000000..454d3bf0ed1a4b
--- /dev/null
+++ b/target/linux/generic/backport-5.15/809-v6.3-0002-nvmem-core-add-an-index-parameter-to-the-cell.patch
@@ -0,0 +1,180 @@
+From 5d8e6e6c10a3d37486d263b16ddc15991a7e4a88 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Mon, 6 Feb 2023 13:43:46 +0000
+Subject: [PATCH] nvmem: core: add an index parameter to the cell
+
+Sometimes a cell can represend multiple values. For example, a base
+ethernet address stored in the NVMEM can be expanded into multiple
+discreet ones by adding an offset.
+
+For this use case, introduce an index parameter which is then used to
+distiguish between values. This parameter will then be passed to the
+post process hook which can then use it to create different values
+during reading.
+
+At the moment, there is only support for the device tree path. You can
+add the index to the phandle, e.g.
+
+  &net {
+          nvmem-cells = <&base_mac_address 2>;
+          nvmem-cell-names = "mac-address";
+  };
+
+  &nvmem_provider {
+          base_mac_address: base-mac-address@0 {
+                  #nvmem-cell-cells = <1>;
+                  reg = <0 6>;
+          };
+  };
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-13-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c           | 37 ++++++++++++++++++++++++----------
+ drivers/nvmem/imx-ocotp.c      |  4 ++--
+ include/linux/nvmem-provider.h |  4 ++--
+ 3 files changed, 30 insertions(+), 15 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -60,6 +60,7 @@ struct nvmem_cell_entry {
+ struct nvmem_cell {
+ 	struct nvmem_cell_entry *entry;
+ 	const char		*id;
++	int			index;
+ };
+ 
+ static DEFINE_MUTEX(nvmem_mutex);
+@@ -1122,7 +1123,8 @@ struct nvmem_device *devm_nvmem_device_g
+ }
+ EXPORT_SYMBOL_GPL(devm_nvmem_device_get);
+ 
+-static struct nvmem_cell *nvmem_create_cell(struct nvmem_cell_entry *entry, const char *id)
++static struct nvmem_cell *nvmem_create_cell(struct nvmem_cell_entry *entry,
++					    const char *id, int index)
+ {
+ 	struct nvmem_cell *cell;
+ 	const char *name = NULL;
+@@ -1141,6 +1143,7 @@ static struct nvmem_cell *nvmem_create_c
+ 
+ 	cell->id = name;
+ 	cell->entry = entry;
++	cell->index = index;
+ 
+ 	return cell;
+ }
+@@ -1179,7 +1182,7 @@ nvmem_cell_get_from_lookup(struct device
+ 				__nvmem_device_put(nvmem);
+ 				cell = ERR_PTR(-ENOENT);
+ 			} else {
+-				cell = nvmem_create_cell(cell_entry, con_id);
++				cell = nvmem_create_cell(cell_entry, con_id, 0);
+ 				if (IS_ERR(cell))
+ 					__nvmem_device_put(nvmem);
+ 			}
+@@ -1227,15 +1230,27 @@ struct nvmem_cell *of_nvmem_cell_get(str
+ 	struct nvmem_device *nvmem;
+ 	struct nvmem_cell_entry *cell_entry;
+ 	struct nvmem_cell *cell;
++	struct of_phandle_args cell_spec;
+ 	int index = 0;
++	int cell_index = 0;
++	int ret;
+ 
+ 	/* if cell name exists, find index to the name */
+ 	if (id)
+ 		index = of_property_match_string(np, "nvmem-cell-names", id);
+ 
+-	cell_np = of_parse_phandle(np, "nvmem-cells", index);
+-	if (!cell_np)
+-		return ERR_PTR(-ENOENT);
++	ret = of_parse_phandle_with_optional_args(np, "nvmem-cells",
++						  "#nvmem-cell-cells",
++						  index, &cell_spec);
++	if (ret)
++		return ERR_PTR(ret);
++
++	if (cell_spec.args_count > 1)
++		return ERR_PTR(-EINVAL);
++
++	cell_np = cell_spec.np;
++	if (cell_spec.args_count)
++		cell_index = cell_spec.args[0];
+ 
+ 	nvmem_np = of_get_parent(cell_np);
+ 	if (!nvmem_np) {
+@@ -1257,7 +1272,7 @@ struct nvmem_cell *of_nvmem_cell_get(str
+ 		return ERR_PTR(-ENOENT);
+ 	}
+ 
+-	cell = nvmem_create_cell(cell_entry, id);
++	cell = nvmem_create_cell(cell_entry, id, cell_index);
+ 	if (IS_ERR(cell))
+ 		__nvmem_device_put(nvmem);
+ 
+@@ -1410,8 +1425,8 @@ static void nvmem_shift_read_buffer_in_p
+ }
+ 
+ static int __nvmem_cell_read(struct nvmem_device *nvmem,
+-		      struct nvmem_cell_entry *cell,
+-		      void *buf, size_t *len, const char *id)
++			     struct nvmem_cell_entry *cell,
++			     void *buf, size_t *len, const char *id, int index)
+ {
+ 	int rc;
+ 
+@@ -1425,7 +1440,7 @@ static int __nvmem_cell_read(struct nvme
+ 		nvmem_shift_read_buffer_in_place(cell, buf);
+ 
+ 	if (nvmem->cell_post_process) {
+-		rc = nvmem->cell_post_process(nvmem->priv, id,
++		rc = nvmem->cell_post_process(nvmem->priv, id, index,
+ 					      cell->offset, buf, cell->bytes);
+ 		if (rc)
+ 			return rc;
+@@ -1460,7 +1475,7 @@ void *nvmem_cell_read(struct nvmem_cell
+ 	if (!buf)
+ 		return ERR_PTR(-ENOMEM);
+ 
+-	rc = __nvmem_cell_read(nvmem, cell->entry, buf, len, cell->id);
++	rc = __nvmem_cell_read(nvmem, cell->entry, buf, len, cell->id, cell->index);
+ 	if (rc) {
+ 		kfree(buf);
+ 		return ERR_PTR(rc);
+@@ -1773,7 +1788,7 @@ ssize_t nvmem_device_cell_read(struct nv
+ 	if (rc)
+ 		return rc;
+ 
+-	rc = __nvmem_cell_read(nvmem, &cell, buf, &len, NULL);
++	rc = __nvmem_cell_read(nvmem, &cell, buf, &len, NULL, 0);
+ 	if (rc)
+ 		return rc;
+ 
+--- a/drivers/nvmem/imx-ocotp.c
++++ b/drivers/nvmem/imx-ocotp.c
+@@ -222,8 +222,8 @@ read_end:
+ 	return ret;
+ }
+ 
+-static int imx_ocotp_cell_pp(void *context, const char *id, unsigned int offset,
+-			     void *data, size_t bytes)
++static int imx_ocotp_cell_pp(void *context, const char *id, int index,
++			     unsigned int offset, void *data, size_t bytes)
+ {
+ 	struct ocotp_priv *priv = context;
+ 
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -20,8 +20,8 @@ typedef int (*nvmem_reg_read_t)(void *pr
+ typedef int (*nvmem_reg_write_t)(void *priv, unsigned int offset,
+ 				 void *val, size_t bytes);
+ /* used for vendor specific post processing of cell data */
+-typedef int (*nvmem_cell_post_process_t)(void *priv, const char *id, unsigned int offset,
+-					  void *buf, size_t bytes);
++typedef int (*nvmem_cell_post_process_t)(void *priv, const char *id, int index,
++					 unsigned int offset, void *buf, size_t bytes);
+ 
+ enum nvmem_type {
+ 	NVMEM_TYPE_UNKNOWN = 0,
diff --git a/target/linux/generic/backport-5.15/809-v6.3-0003-nvmem-core-move-struct-nvmem_cell_info-to-nvmem-prov.patch b/target/linux/generic/backport-5.15/809-v6.3-0003-nvmem-core-move-struct-nvmem_cell_info-to-nvmem-prov.patch
new file mode 100644
index 00000000000000..f3829b3e17f4f6
--- /dev/null
+++ b/target/linux/generic/backport-5.15/809-v6.3-0003-nvmem-core-move-struct-nvmem_cell_info-to-nvmem-prov.patch
@@ -0,0 +1,78 @@
+From fbd03d27776c6121a483921601418e3c8f0ff37e Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Mon, 6 Feb 2023 13:43:47 +0000
+Subject: [PATCH] nvmem: core: move struct nvmem_cell_info to nvmem-provider.h
+
+struct nvmem_cell_info is used to describe a cell. Thus this should
+really be in the nvmem-provider's header. There are two (unused) nvmem
+access methods which use the nvmem_cell_info to describe the cell to be
+accesses. One can argue, that they will create a cell before accessing,
+thus they are both a provider and a consumer.
+
+struct nvmem_cell_info will get used more and more by nvmem-providers,
+don't force them to also include the consumer header, although they are
+not.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-14-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/nvmem-consumer.h | 10 +---------
+ include/linux/nvmem-provider.h | 19 ++++++++++++++++++-
+ 2 files changed, 19 insertions(+), 10 deletions(-)
+
+--- a/include/linux/nvmem-consumer.h
++++ b/include/linux/nvmem-consumer.h
+@@ -18,15 +18,7 @@ struct device_node;
+ /* consumer cookie */
+ struct nvmem_cell;
+ struct nvmem_device;
+-
+-struct nvmem_cell_info {
+-	const char		*name;
+-	unsigned int		offset;
+-	unsigned int		bytes;
+-	unsigned int		bit_offset;
+-	unsigned int		nbits;
+-	struct device_node	*np;
+-};
++struct nvmem_cell_info;
+ 
+ /**
+  * struct nvmem_cell_lookup - cell lookup entry
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -14,7 +14,6 @@
+ #include <linux/gpio/consumer.h>
+ 
+ struct nvmem_device;
+-struct nvmem_cell_info;
+ typedef int (*nvmem_reg_read_t)(void *priv, unsigned int offset,
+ 				void *val, size_t bytes);
+ typedef int (*nvmem_reg_write_t)(void *priv, unsigned int offset,
+@@ -48,6 +47,24 @@ struct nvmem_keepout {
+ };
+ 
+ /**
++ * struct nvmem_cell_info - NVMEM cell description
++ * @name:	Name.
++ * @offset:	Offset within the NVMEM device.
++ * @bytes:	Length of the cell.
++ * @bit_offset:	Bit offset if cell is smaller than a byte.
++ * @nbits:	Number of bits.
++ * @np:		Optional device_node pointer.
++ */
++struct nvmem_cell_info {
++	const char		*name;
++	unsigned int		offset;
++	unsigned int		bytes;
++	unsigned int		bit_offset;
++	unsigned int		nbits;
++	struct device_node	*np;
++};
++
++/**
+  * struct nvmem_config - NVMEM device configuration
+  *
+  * @dev:	Parent device.
diff --git a/target/linux/generic/backport-5.15/809-v6.3-0004-nvmem-core-drop-the-removal-of-the-cells-in-nvmem_ad.patch b/target/linux/generic/backport-5.15/809-v6.3-0004-nvmem-core-drop-the-removal-of-the-cells-in-nvmem_ad.patch
new file mode 100644
index 00000000000000..8f996eab348ff4
--- /dev/null
+++ b/target/linux/generic/backport-5.15/809-v6.3-0004-nvmem-core-drop-the-removal-of-the-cells-in-nvmem_ad.patch
@@ -0,0 +1,65 @@
+From cc5bdd323dde6494623f3ffe3a5b887fa21cd375 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Mon, 6 Feb 2023 13:43:48 +0000
+Subject: [PATCH] nvmem: core: drop the removal of the cells in
+ nvmem_add_cells()
+
+If nvmem_add_cells() fails, the whole nvmem_register() will fail
+and the cells will then be removed anyway. This is a preparation
+to introduce a nvmem_add_one_cell() which can then be used by
+nvmem_add_cells().
+
+This is then the same to what nvmem_add_cells_from_table() and
+nvmem_add_cells_from_of() do.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-15-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -515,7 +515,7 @@ static int nvmem_add_cells(struct nvmem_
+ 		    int ncells)
+ {
+ 	struct nvmem_cell_entry **cells;
+-	int i, rval;
++	int i, rval = 0;
+ 
+ 	cells = kcalloc(ncells, sizeof(*cells), GFP_KERNEL);
+ 	if (!cells)
+@@ -525,28 +525,22 @@ static int nvmem_add_cells(struct nvmem_
+ 		cells[i] = kzalloc(sizeof(**cells), GFP_KERNEL);
+ 		if (!cells[i]) {
+ 			rval = -ENOMEM;
+-			goto err;
++			goto out;
+ 		}
+ 
+ 		rval = nvmem_cell_info_to_nvmem_cell_entry(nvmem, &info[i], cells[i]);
+ 		if (rval) {
+ 			kfree(cells[i]);
+-			goto err;
++			goto out;
+ 		}
+ 
+ 		nvmem_cell_entry_add(cells[i]);
+ 	}
+ 
++out:
+ 	/* remove tmp array */
+ 	kfree(cells);
+ 
+-	return 0;
+-err:
+-	while (i--)
+-		nvmem_cell_entry_drop(cells[i]);
+-
+-	kfree(cells);
+-
+ 	return rval;
+ }
+ 
diff --git a/target/linux/generic/backport-5.15/809-v6.3-0005-nvmem-core-add-nvmem_add_one_cell.patch b/target/linux/generic/backport-5.15/809-v6.3-0005-nvmem-core-add-nvmem_add_one_cell.patch
new file mode 100644
index 00000000000000..711ce229b2c748
--- /dev/null
+++ b/target/linux/generic/backport-5.15/809-v6.3-0005-nvmem-core-add-nvmem_add_one_cell.patch
@@ -0,0 +1,122 @@
+From 2ded6830d376d5e7bf43d59f7f7fdf1a59abc676 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Mon, 6 Feb 2023 13:43:49 +0000
+Subject: [PATCH] nvmem: core: add nvmem_add_one_cell()
+
+Add a new function to add exactly one cell. This will be used by the
+nvmem layout drivers to add custom cells. In contrast to the
+nvmem_add_cells(), this has the advantage that we don't have to assemble
+a list of cells on runtime.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-16-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c           | 59 ++++++++++++++++++++--------------
+ include/linux/nvmem-provider.h |  8 +++++
+ 2 files changed, 43 insertions(+), 24 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -502,6 +502,36 @@ static int nvmem_cell_info_to_nvmem_cell
+ }
+ 
+ /**
++ * nvmem_add_one_cell() - Add one cell information to an nvmem device
++ *
++ * @nvmem: nvmem device to add cells to.
++ * @info: nvmem cell info to add to the device
++ *
++ * Return: 0 or negative error code on failure.
++ */
++int nvmem_add_one_cell(struct nvmem_device *nvmem,
++		       const struct nvmem_cell_info *info)
++{
++	struct nvmem_cell_entry *cell;
++	int rval;
++
++	cell = kzalloc(sizeof(*cell), GFP_KERNEL);
++	if (!cell)
++		return -ENOMEM;
++
++	rval = nvmem_cell_info_to_nvmem_cell_entry(nvmem, info, cell);
++	if (rval) {
++		kfree(cell);
++		return rval;
++	}
++
++	nvmem_cell_entry_add(cell);
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(nvmem_add_one_cell);
++
++/**
+  * nvmem_add_cells() - Add cell information to an nvmem device
+  *
+  * @nvmem: nvmem device to add cells to.
+@@ -514,34 +544,15 @@ static int nvmem_add_cells(struct nvmem_
+ 		    const struct nvmem_cell_info *info,
+ 		    int ncells)
+ {
+-	struct nvmem_cell_entry **cells;
+-	int i, rval = 0;
+-
+-	cells = kcalloc(ncells, sizeof(*cells), GFP_KERNEL);
+-	if (!cells)
+-		return -ENOMEM;
++	int i, rval;
+ 
+ 	for (i = 0; i < ncells; i++) {
+-		cells[i] = kzalloc(sizeof(**cells), GFP_KERNEL);
+-		if (!cells[i]) {
+-			rval = -ENOMEM;
+-			goto out;
+-		}
+-
+-		rval = nvmem_cell_info_to_nvmem_cell_entry(nvmem, &info[i], cells[i]);
+-		if (rval) {
+-			kfree(cells[i]);
+-			goto out;
+-		}
+-
+-		nvmem_cell_entry_add(cells[i]);
++		rval = nvmem_add_one_cell(nvmem, &info[i]);
++		if (rval)
++			return rval;
+ 	}
+ 
+-out:
+-	/* remove tmp array */
+-	kfree(cells);
+-
+-	return rval;
++	return 0;
+ }
+ 
+ /**
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -153,6 +153,9 @@ struct nvmem_device *devm_nvmem_register
+ void nvmem_add_cell_table(struct nvmem_cell_table *table);
+ void nvmem_del_cell_table(struct nvmem_cell_table *table);
+ 
++int nvmem_add_one_cell(struct nvmem_device *nvmem,
++		       const struct nvmem_cell_info *info);
++
+ #else
+ 
+ static inline struct nvmem_device *nvmem_register(const struct nvmem_config *c)
+@@ -170,6 +173,11 @@ devm_nvmem_register(struct device *dev,
+ 
+ static inline void nvmem_add_cell_table(struct nvmem_cell_table *table) {}
+ static inline void nvmem_del_cell_table(struct nvmem_cell_table *table) {}
++static inline int nvmem_add_one_cell(struct nvmem_device *nvmem,
++				     const struct nvmem_cell_info *info)
++{
++	return -EOPNOTSUPP;
++}
+ 
+ #endif /* CONFIG_NVMEM */
+ #endif  /* ifndef _LINUX_NVMEM_PROVIDER_H */
diff --git a/target/linux/generic/backport-5.15/809-v6.3-0006-nvmem-core-use-nvmem_add_one_cell-in-nvmem_add_cells.patch b/target/linux/generic/backport-5.15/809-v6.3-0006-nvmem-core-use-nvmem_add_one_cell-in-nvmem_add_cells.patch
new file mode 100644
index 00000000000000..e1791e5c83cff0
--- /dev/null
+++ b/target/linux/generic/backport-5.15/809-v6.3-0006-nvmem-core-use-nvmem_add_one_cell-in-nvmem_add_cells.patch
@@ -0,0 +1,93 @@
+From 50014d659617dc58780a5d31ceb76c82779a9d8b Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Mon, 6 Feb 2023 13:43:50 +0000
+Subject: [PATCH] nvmem: core: use nvmem_add_one_cell() in
+ nvmem_add_cells_from_of()
+
+Convert nvmem_add_cells_from_of() to use the new nvmem_add_one_cell().
+This will remove duplicate code and it will make it possible to add a
+hook to a nvmem layout in between, which can change fields before the
+cell is finally added.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-17-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c | 45 ++++++++++++++------------------------------
+ 1 file changed, 14 insertions(+), 31 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -688,15 +688,14 @@ static int nvmem_validate_keepouts(struc
+ 
+ static int nvmem_add_cells_from_of(struct nvmem_device *nvmem)
+ {
+-	struct device_node *parent, *child;
+ 	struct device *dev = &nvmem->dev;
+-	struct nvmem_cell_entry *cell;
++	struct device_node *child;
+ 	const __be32 *addr;
+-	int len;
++	int len, ret;
+ 
+-	parent = dev->of_node;
++	for_each_child_of_node(dev->of_node, child) {
++		struct nvmem_cell_info info = {0};
+ 
+-	for_each_child_of_node(parent, child) {
+ 		addr = of_get_property(child, "reg", &len);
+ 		if (!addr)
+ 			continue;
+@@ -706,40 +705,24 @@ static int nvmem_add_cells_from_of(struc
+ 			return -EINVAL;
+ 		}
+ 
+-		cell = kzalloc(sizeof(*cell), GFP_KERNEL);
+-		if (!cell) {
+-			of_node_put(child);
+-			return -ENOMEM;
+-		}
+-
+-		cell->nvmem = nvmem;
+-		cell->offset = be32_to_cpup(addr++);
+-		cell->bytes = be32_to_cpup(addr);
+-		cell->name = kasprintf(GFP_KERNEL, "%pOFn", child);
++		info.offset = be32_to_cpup(addr++);
++		info.bytes = be32_to_cpup(addr);
++		info.name = kasprintf(GFP_KERNEL, "%pOFn", child);
+ 
+ 		addr = of_get_property(child, "bits", &len);
+ 		if (addr && len == (2 * sizeof(u32))) {
+-			cell->bit_offset = be32_to_cpup(addr++);
+-			cell->nbits = be32_to_cpup(addr);
++			info.bit_offset = be32_to_cpup(addr++);
++			info.nbits = be32_to_cpup(addr);
+ 		}
+ 
+-		if (cell->nbits)
+-			cell->bytes = DIV_ROUND_UP(
+-					cell->nbits + cell->bit_offset,
+-					BITS_PER_BYTE);
+-
+-		if (!IS_ALIGNED(cell->offset, nvmem->stride)) {
+-			dev_err(dev, "cell %s unaligned to nvmem stride %d\n",
+-				cell->name, nvmem->stride);
+-			/* Cells already added will be freed later. */
+-			kfree_const(cell->name);
+-			kfree(cell);
++		info.np = of_node_get(child);
++
++		ret = nvmem_add_one_cell(nvmem, &info);
++		kfree(info.name);
++		if (ret) {
+ 			of_node_put(child);
+-			return -EINVAL;
++			return ret;
+ 		}
+-
+-		cell->np = of_node_get(child);
+-		nvmem_cell_entry_add(cell);
+ 	}
+ 
+ 	return 0;
diff --git a/target/linux/generic/backport-5.15/809-v6.3-0007-nvmem-stm32-add-OP-TEE-support-for-STM32MP13x.patch b/target/linux/generic/backport-5.15/809-v6.3-0007-nvmem-stm32-add-OP-TEE-support-for-STM32MP13x.patch
new file mode 100644
index 00000000000000..172a78b76af1a6
--- /dev/null
+++ b/target/linux/generic/backport-5.15/809-v6.3-0007-nvmem-stm32-add-OP-TEE-support-for-STM32MP13x.patch
@@ -0,0 +1,562 @@
+From 6a0bc3522e746025e2d9a63ab2cb5d7062c2d39c Mon Sep 17 00:00:00 2001
+From: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Date: Mon, 6 Feb 2023 13:43:51 +0000
+Subject: [PATCH] nvmem: stm32: add OP-TEE support for STM32MP13x
+
+For boot with OP-TEE on STM32MP13, the communication with the secure
+world no more use STMicroelectronics SMC but communication with the
+STM32MP BSEC TA, for data access (read/write) or lock operation:
+- all the request are sent to OP-TEE trusted application,
+- for upper OTP with ECC protection and with word programming only
+  each OTP are permanently locked when programmed to avoid ECC error
+  on the second write operation
+
+Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-18-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/Kconfig               |  11 +
+ drivers/nvmem/Makefile              |   1 +
+ drivers/nvmem/stm32-bsec-optee-ta.c | 298 ++++++++++++++++++++++++++++
+ drivers/nvmem/stm32-bsec-optee-ta.h |  80 ++++++++
+ drivers/nvmem/stm32-romem.c         |  54 ++++-
+ 5 files changed, 441 insertions(+), 3 deletions(-)
+ create mode 100644 drivers/nvmem/stm32-bsec-optee-ta.c
+ create mode 100644 drivers/nvmem/stm32-bsec-optee-ta.h
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -290,9 +290,20 @@ config NVMEM_SPRD_EFUSE
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called nvmem-sprd-efuse.
+ 
++config NVMEM_STM32_BSEC_OPTEE_TA
++	bool "STM32MP BSEC OP-TEE TA support for nvmem-stm32-romem driver"
++	depends on OPTEE
++	help
++	  Say y here to enable the accesses to STM32MP SoC OTPs by the OP-TEE
++	  trusted application STM32MP BSEC.
++
++	  This library is a used by stm32-romem driver or included in the module
++	  called nvmem-stm32-romem.
++
+ config NVMEM_STM32_ROMEM
+ 	tristate "STMicroelectronics STM32 factory-programmed memory support"
+ 	depends on ARCH_STM32 || COMPILE_TEST
++	imply NVMEM_STM32_BSEC_OPTEE_TA
+ 	help
+ 	  Say y here to enable read-only access for STMicroelectronics STM32
+ 	  factory-programmed memory area.
+--- a/drivers/nvmem/Makefile
++++ b/drivers/nvmem/Makefile
+@@ -61,6 +61,7 @@ obj-$(CONFIG_NVMEM_SPRD_EFUSE)		+= nvmem
+ nvmem_sprd_efuse-y			:= sprd-efuse.o
+ obj-$(CONFIG_NVMEM_STM32_ROMEM)		+= nvmem_stm32_romem.o
+ nvmem_stm32_romem-y 			:= stm32-romem.o
++nvmem_stm32_romem-$(CONFIG_NVMEM_STM32_BSEC_OPTEE_TA) += stm32-bsec-optee-ta.o
+ obj-$(CONFIG_NVMEM_SUNPLUS_OCOTP)	+= nvmem_sunplus_ocotp.o
+ nvmem_sunplus_ocotp-y			:= sunplus-ocotp.o
+ obj-$(CONFIG_NVMEM_SUNXI_SID)		+= nvmem_sunxi_sid.o
+--- /dev/null
++++ b/drivers/nvmem/stm32-bsec-optee-ta.c
+@@ -0,0 +1,298 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * OP-TEE STM32MP BSEC PTA interface, used by STM32 ROMEM driver
++ *
++ * Copyright (C) 2022, STMicroelectronics - All Rights Reserved
++ */
++
++#include <linux/tee_drv.h>
++
++#include "stm32-bsec-optee-ta.h"
++
++/*
++ * Read OTP memory
++ *
++ * [in]		value[0].a		OTP start offset in byte
++ * [in]		value[0].b		Access type (0:shadow, 1:fuse, 2:lock)
++ * [out]	memref[1].buffer	Output buffer to store read values
++ * [out]	memref[1].size		Size of OTP to be read
++ *
++ * Return codes:
++ * TEE_SUCCESS - Invoke command success
++ * TEE_ERROR_BAD_PARAMETERS - Incorrect input param
++ * TEE_ERROR_ACCESS_DENIED - OTP not accessible by caller
++ */
++#define PTA_BSEC_READ_MEM		0x0
++
++/*
++ * Write OTP memory
++ *
++ * [in]		value[0].a		OTP start offset in byte
++ * [in]		value[0].b		Access type (0:shadow, 1:fuse, 2:lock)
++ * [in]		memref[1].buffer	Input buffer to read values
++ * [in]		memref[1].size		Size of OTP to be written
++ *
++ * Return codes:
++ * TEE_SUCCESS - Invoke command success
++ * TEE_ERROR_BAD_PARAMETERS - Incorrect input param
++ * TEE_ERROR_ACCESS_DENIED - OTP not accessible by caller
++ */
++#define PTA_BSEC_WRITE_MEM		0x1
++
++/* value of PTA_BSEC access type = value[in] b */
++#define SHADOW_ACCESS	0
++#define FUSE_ACCESS	1
++#define LOCK_ACCESS	2
++
++/* Bitfield definition for LOCK status */
++#define LOCK_PERM			BIT(30)
++
++/* OP-TEE STM32MP BSEC TA UUID */
++static const uuid_t stm32mp_bsec_ta_uuid =
++	UUID_INIT(0x94cf71ad, 0x80e6, 0x40b5,
++		  0xa7, 0xc6, 0x3d, 0xc5, 0x01, 0xeb, 0x28, 0x03);
++
++/*
++ * Check whether this driver supports the BSEC TA in the TEE instance
++ * represented by the params (ver/data) to this function.
++ */
++static int stm32_bsec_optee_ta_match(struct tee_ioctl_version_data *ver,
++				     const void *data)
++{
++	/* Currently this driver only supports GP compliant, OP-TEE based TA */
++	if ((ver->impl_id == TEE_IMPL_ID_OPTEE) &&
++		(ver->gen_caps & TEE_GEN_CAP_GP))
++		return 1;
++	else
++		return 0;
++}
++
++/* Open a session to OP-TEE for STM32MP BSEC TA */
++static int stm32_bsec_ta_open_session(struct tee_context *ctx, u32 *id)
++{
++	struct tee_ioctl_open_session_arg sess_arg;
++	int rc;
++
++	memset(&sess_arg, 0, sizeof(sess_arg));
++	export_uuid(sess_arg.uuid, &stm32mp_bsec_ta_uuid);
++	sess_arg.clnt_login = TEE_IOCTL_LOGIN_REE_KERNEL;
++	sess_arg.num_params = 0;
++
++	rc = tee_client_open_session(ctx, &sess_arg, NULL);
++	if ((rc < 0) || (sess_arg.ret != 0)) {
++		pr_err("%s: tee_client_open_session failed err:%#x, ret:%#x\n",
++		       __func__, sess_arg.ret, rc);
++		if (!rc)
++			rc = -EINVAL;
++	} else {
++		*id = sess_arg.session;
++	}
++
++	return rc;
++}
++
++/* close a session to OP-TEE for STM32MP BSEC TA */
++static void stm32_bsec_ta_close_session(void *ctx, u32 id)
++{
++	tee_client_close_session(ctx, id);
++}
++
++/* stm32_bsec_optee_ta_open() - initialize the STM32MP BSEC TA */
++int stm32_bsec_optee_ta_open(struct tee_context **ctx)
++{
++	struct tee_context *tee_ctx;
++	u32 session_id;
++	int rc;
++
++	/* Open context with TEE driver */
++	tee_ctx = tee_client_open_context(NULL, stm32_bsec_optee_ta_match, NULL, NULL);
++	if (IS_ERR(tee_ctx)) {
++		rc = PTR_ERR(tee_ctx);
++		if (rc == -ENOENT)
++			return -EPROBE_DEFER;
++		pr_err("%s: tee_client_open_context failed (%d)\n", __func__, rc);
++
++		return rc;
++	}
++
++	/* Check STM32MP BSEC TA presence */
++	rc = stm32_bsec_ta_open_session(tee_ctx, &session_id);
++	if (rc) {
++		tee_client_close_context(tee_ctx);
++		return rc;
++	}
++
++	stm32_bsec_ta_close_session(tee_ctx, session_id);
++
++	*ctx = tee_ctx;
++
++	return 0;
++}
++
++/* stm32_bsec_optee_ta_open() - release the PTA STM32MP BSEC TA */
++void stm32_bsec_optee_ta_close(void *ctx)
++{
++	tee_client_close_context(ctx);
++}
++
++/* stm32_bsec_optee_ta_read() - nvmem read access using PTA client driver */
++int stm32_bsec_optee_ta_read(struct tee_context *ctx, unsigned int offset,
++			     void *buf, size_t bytes)
++{
++	struct tee_shm *shm;
++	struct tee_ioctl_invoke_arg arg;
++	struct tee_param param[2];
++	u8 *shm_buf;
++	u32 start, num_bytes;
++	int ret;
++	u32 session_id;
++
++	ret = stm32_bsec_ta_open_session(ctx, &session_id);
++	if (ret)
++		return ret;
++
++	memset(&arg, 0, sizeof(arg));
++	memset(&param, 0, sizeof(param));
++
++	arg.func = PTA_BSEC_READ_MEM;
++	arg.session = session_id;
++	arg.num_params = 2;
++
++	/* align access on 32bits */
++	start = ALIGN_DOWN(offset, 4);
++	num_bytes = round_up(offset + bytes - start, 4);
++	param[0].attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT;
++	param[0].u.value.a = start;
++	param[0].u.value.b = SHADOW_ACCESS;
++
++	shm = tee_shm_alloc_kernel_buf(ctx, num_bytes);
++	if (IS_ERR(shm)) {
++		ret = PTR_ERR(shm);
++		goto out_tee_session;
++	}
++
++	param[1].attr = TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT;
++	param[1].u.memref.shm = shm;
++	param[1].u.memref.size = num_bytes;
++
++	ret = tee_client_invoke_func(ctx, &arg, param);
++	if (ret < 0 || arg.ret != 0) {
++		pr_err("TA_BSEC invoke failed TEE err:%#x, ret:%#x\n",
++			arg.ret, ret);
++		if (!ret)
++			ret = -EIO;
++	}
++	if (!ret) {
++		shm_buf = tee_shm_get_va(shm, 0);
++		if (IS_ERR(shm_buf)) {
++			ret = PTR_ERR(shm_buf);
++			pr_err("tee_shm_get_va failed for transmit (%d)\n", ret);
++		} else {
++			/* read data from 32 bits aligned buffer */
++			memcpy(buf, &shm_buf[offset % 4], bytes);
++		}
++	}
++
++	tee_shm_free(shm);
++
++out_tee_session:
++	stm32_bsec_ta_close_session(ctx, session_id);
++
++	return ret;
++}
++
++/* stm32_bsec_optee_ta_write() - nvmem write access using PTA client driver */
++int stm32_bsec_optee_ta_write(struct tee_context *ctx, unsigned int lower,
++			      unsigned int offset, void *buf, size_t bytes)
++{	struct tee_shm *shm;
++	struct tee_ioctl_invoke_arg arg;
++	struct tee_param param[2];
++	u8 *shm_buf;
++	int ret;
++	u32 session_id;
++
++	ret = stm32_bsec_ta_open_session(ctx, &session_id);
++	if (ret)
++		return ret;
++
++	/* Allow only writing complete 32-bits aligned words */
++	if ((bytes % 4) || (offset % 4))
++		return -EINVAL;
++
++	memset(&arg, 0, sizeof(arg));
++	memset(&param, 0, sizeof(param));
++
++	arg.func = PTA_BSEC_WRITE_MEM;
++	arg.session = session_id;
++	arg.num_params = 2;
++
++	param[0].attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT;
++	param[0].u.value.a = offset;
++	param[0].u.value.b = FUSE_ACCESS;
++
++	shm = tee_shm_alloc_kernel_buf(ctx, bytes);
++	if (IS_ERR(shm)) {
++		ret = PTR_ERR(shm);
++		goto out_tee_session;
++	}
++
++	param[1].attr = TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT;
++	param[1].u.memref.shm = shm;
++	param[1].u.memref.size = bytes;
++
++	shm_buf = tee_shm_get_va(shm, 0);
++	if (IS_ERR(shm_buf)) {
++		ret = PTR_ERR(shm_buf);
++		pr_err("tee_shm_get_va failed for transmit (%d)\n", ret);
++		tee_shm_free(shm);
++
++		goto out_tee_session;
++	}
++
++	memcpy(shm_buf, buf, bytes);
++
++	ret = tee_client_invoke_func(ctx, &arg, param);
++	if (ret < 0 || arg.ret != 0) {
++		pr_err("TA_BSEC invoke failed TEE err:%#x, ret:%#x\n", arg.ret, ret);
++		if (!ret)
++			ret = -EIO;
++	}
++	pr_debug("Write OTPs %d to %zu, ret=%d\n", offset / 4, (offset + bytes) / 4, ret);
++
++	/* Lock the upper OTPs with ECC protection, word programming only */
++	if (!ret && ((offset + bytes) >= (lower * 4))) {
++		u32 start, nb_lock;
++		u32 *lock = (u32 *)shm_buf;
++		int i;
++
++		/*
++		 * don't lock the lower OTPs, no ECC protection and incremental
++		 * bit programming, a second write is allowed
++		 */
++		start = max_t(u32, offset, lower * 4);
++		nb_lock = (offset + bytes - start) / 4;
++
++		param[0].u.value.a = start;
++		param[0].u.value.b = LOCK_ACCESS;
++		param[1].u.memref.size = nb_lock * 4;
++
++		for (i = 0; i < nb_lock; i++)
++			lock[i] = LOCK_PERM;
++
++		ret = tee_client_invoke_func(ctx, &arg, param);
++		if (ret < 0 || arg.ret != 0) {
++			pr_err("TA_BSEC invoke failed TEE err:%#x, ret:%#x\n", arg.ret, ret);
++			if (!ret)
++				ret = -EIO;
++		}
++		pr_debug("Lock upper OTPs %d to %d, ret=%d\n",
++			 start / 4, start / 4 + nb_lock, ret);
++	}
++
++	tee_shm_free(shm);
++
++out_tee_session:
++	stm32_bsec_ta_close_session(ctx, session_id);
++
++	return ret;
++}
+--- /dev/null
++++ b/drivers/nvmem/stm32-bsec-optee-ta.h
+@@ -0,0 +1,80 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++/*
++ * OP-TEE STM32MP BSEC PTA interface, used by STM32 ROMEM driver
++ *
++ * Copyright (C) 2022, STMicroelectronics - All Rights Reserved
++ */
++
++#if IS_ENABLED(CONFIG_NVMEM_STM32_BSEC_OPTEE_TA)
++/**
++ * stm32_bsec_optee_ta_open() - initialize the STM32 BSEC TA
++ * @ctx: the OP-TEE context on success
++ *
++ * Return:
++ *	On success, 0. On failure, -errno.
++ */
++int stm32_bsec_optee_ta_open(struct tee_context **ctx);
++
++/**
++ * stm32_bsec_optee_ta_close() - release the STM32 BSEC TA
++ * @ctx: the OP-TEE context
++ *
++ * This function used to clean the OP-TEE resources initialized in
++ * stm32_bsec_optee_ta_open(); it can be used as callback to
++ * devm_add_action_or_reset()
++ */
++void stm32_bsec_optee_ta_close(void *ctx);
++
++/**
++ * stm32_bsec_optee_ta_read() - nvmem read access using TA client driver
++ * @ctx: the OP-TEE context provided by stm32_bsec_optee_ta_open
++ * @offset: nvmem offset
++ * @buf: buffer to fill with nvem values
++ * @bytes: number of bytes to read
++ *
++ * Return:
++ *	On success, 0. On failure, -errno.
++ */
++int stm32_bsec_optee_ta_read(struct tee_context *ctx, unsigned int offset,
++			     void *buf, size_t bytes);
++
++/**
++ * stm32_bsec_optee_ta_write() - nvmem write access using TA client driver
++ * @ctx: the OP-TEE context provided by stm32_bsec_optee_ta_open
++ * @lower: number of lower OTP, not protected by ECC
++ * @offset: nvmem offset
++ * @buf: buffer with nvem values
++ * @bytes: number of bytes to write
++ *
++ * Return:
++ *	On success, 0. On failure, -errno.
++ */
++int stm32_bsec_optee_ta_write(struct tee_context *ctx, unsigned int lower,
++			      unsigned int offset, void *buf, size_t bytes);
++
++#else
++
++static inline int stm32_bsec_optee_ta_open(struct tee_context **ctx)
++{
++	return -EOPNOTSUPP;
++}
++
++static inline void stm32_bsec_optee_ta_close(void *ctx)
++{
++}
++
++static inline int stm32_bsec_optee_ta_read(struct tee_context *ctx,
++					   unsigned int offset, void *buf,
++					   size_t bytes)
++{
++	return -EOPNOTSUPP;
++}
++
++static inline int stm32_bsec_optee_ta_write(struct tee_context *ctx,
++					    unsigned int lower,
++					    unsigned int offset, void *buf,
++					    size_t bytes)
++{
++	return -EOPNOTSUPP;
++}
++#endif /* CONFIG_NVMEM_STM32_BSEC_OPTEE_TA */
+--- a/drivers/nvmem/stm32-romem.c
++++ b/drivers/nvmem/stm32-romem.c
+@@ -11,6 +11,9 @@
+ #include <linux/module.h>
+ #include <linux/nvmem-provider.h>
+ #include <linux/of_device.h>
++#include <linux/tee_drv.h>
++
++#include "stm32-bsec-optee-ta.h"
+ 
+ /* BSEC secure service access from non-secure */
+ #define STM32_SMC_BSEC			0x82001003
+@@ -25,12 +28,14 @@
+ struct stm32_romem_cfg {
+ 	int size;
+ 	u8 lower;
++	bool ta;
+ };
+ 
+ struct stm32_romem_priv {
+ 	void __iomem *base;
+ 	struct nvmem_config cfg;
+ 	u8 lower;
++	struct tee_context *ctx;
+ };
+ 
+ static int stm32_romem_read(void *context, unsigned int offset, void *buf,
+@@ -138,12 +143,29 @@ static int stm32_bsec_write(void *contex
+ 	return 0;
+ }
+ 
++static int stm32_bsec_pta_read(void *context, unsigned int offset, void *buf,
++			       size_t bytes)
++{
++	struct stm32_romem_priv *priv = context;
++
++	return stm32_bsec_optee_ta_read(priv->ctx, offset, buf, bytes);
++}
++
++static int stm32_bsec_pta_write(void *context, unsigned int offset, void *buf,
++				size_t bytes)
++{
++	struct stm32_romem_priv *priv = context;
++
++	return stm32_bsec_optee_ta_write(priv->ctx, priv->lower, offset, buf, bytes);
++}
++
+ static int stm32_romem_probe(struct platform_device *pdev)
+ {
+ 	const struct stm32_romem_cfg *cfg;
+ 	struct device *dev = &pdev->dev;
+ 	struct stm32_romem_priv *priv;
+ 	struct resource *res;
++	int rc;
+ 
+ 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+ 	if (!priv)
+@@ -173,15 +195,31 @@ static int stm32_romem_probe(struct plat
+ 	} else {
+ 		priv->cfg.size = cfg->size;
+ 		priv->lower = cfg->lower;
+-		priv->cfg.reg_read = stm32_bsec_read;
+-		priv->cfg.reg_write = stm32_bsec_write;
++		if (cfg->ta) {
++			rc = stm32_bsec_optee_ta_open(&priv->ctx);
++			/* wait for OP-TEE client driver to be up and ready */
++			if (rc)
++				return rc;
++		}
++		if (priv->ctx) {
++			rc = devm_add_action_or_reset(dev, stm32_bsec_optee_ta_close, priv->ctx);
++			if (rc) {
++				dev_err(dev, "devm_add_action_or_reset() failed (%d)\n", rc);
++				return rc;
++			}
++			priv->cfg.reg_read = stm32_bsec_pta_read;
++			priv->cfg.reg_write = stm32_bsec_pta_write;
++		} else {
++			priv->cfg.reg_read = stm32_bsec_read;
++			priv->cfg.reg_write = stm32_bsec_write;
++		}
+ 	}
+ 
+ 	return PTR_ERR_OR_ZERO(devm_nvmem_register(dev, &priv->cfg));
+ }
+ 
+ /*
+- * STM32MP15 BSEC OTP regions: 4096 OTP bits (with 3072 effective bits)
++ * STM32MP15/13 BSEC OTP regions: 4096 OTP bits (with 3072 effective bits)
+  * => 96 x 32-bits data words
+  * - Lower: 1K bits, 2:1 redundancy, incremental bit programming
+  *   => 32 (x 32-bits) lower shadow registers = words 0 to 31
+@@ -191,6 +229,13 @@ static int stm32_romem_probe(struct plat
+ static const struct stm32_romem_cfg stm32mp15_bsec_cfg = {
+ 	.size = 384,
+ 	.lower = 32,
++	.ta = false,
++};
++
++static const struct stm32_romem_cfg stm32mp13_bsec_cfg = {
++	.size = 384,
++	.lower = 32,
++	.ta = true,
+ };
+ 
+ static const struct of_device_id stm32_romem_of_match[] = {
+@@ -198,7 +243,10 @@ static const struct of_device_id stm32_r
+ 		.compatible = "st,stm32mp15-bsec",
+ 		.data = (void *)&stm32mp15_bsec_cfg,
+ 	}, {
++		.compatible = "st,stm32mp13-bsec",
++		.data = (void *)&stm32mp13_bsec_cfg,
+ 	},
++	{ /* sentinel */ },
+ };
+ MODULE_DEVICE_TABLE(of, stm32_romem_of_match);
+ 
diff --git a/target/linux/generic/backport-5.15/809-v6.3-0008-nvmem-stm32-detect-bsec-pta-presence-for-STM32MP15x.patch b/target/linux/generic/backport-5.15/809-v6.3-0008-nvmem-stm32-detect-bsec-pta-presence-for-STM32MP15x.patch
new file mode 100644
index 00000000000000..cea8e93858fc7d
--- /dev/null
+++ b/target/linux/generic/backport-5.15/809-v6.3-0008-nvmem-stm32-detect-bsec-pta-presence-for-STM32MP15x.patch
@@ -0,0 +1,85 @@
+From df2f34ef1d924125ffaf29dfdaf7cdbd3183c321 Mon Sep 17 00:00:00 2001
+From: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Date: Mon, 6 Feb 2023 13:43:52 +0000
+Subject: [PATCH] nvmem: stm32: detect bsec pta presence for STM32MP15x
+
+On STM32MP15x SoC, the SMC backend is optional when OP-TEE is used;
+the PTA BSEC should be used as it is done on STM32MP13x platform,
+but the BSEC SMC can be also used: it is a legacy mode in OP-TEE,
+not recommended but used in previous OP-TEE firmware.
+
+The presence of OP-TEE is dynamically detected in STM32MP15x device tree
+and the supported NVMEM backend is dynamically detected:
+- PTA with stm32_bsec_pta_find
+- SMC with stm32_bsec_check
+
+With OP-TEE but without PTA and SMC detection, the probe is deferred for
+STM32MP15x devices.
+
+On STM32MP13x platform, only the PTA is supported with cfg->ta = true
+and this detection is skipped.
+
+Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-19-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/stm32-romem.c | 38 +++++++++++++++++++++++++++++++++----
+ 1 file changed, 34 insertions(+), 4 deletions(-)
+
+--- a/drivers/nvmem/stm32-romem.c
++++ b/drivers/nvmem/stm32-romem.c
+@@ -159,6 +159,31 @@ static int stm32_bsec_pta_write(void *co
+ 	return stm32_bsec_optee_ta_write(priv->ctx, priv->lower, offset, buf, bytes);
+ }
+ 
++static bool stm32_bsec_smc_check(void)
++{
++	u32 val;
++	int ret;
++
++	/* check that the OP-TEE support the BSEC SMC (legacy mode) */
++	ret = stm32_bsec_smc(STM32_SMC_READ_SHADOW, 0, 0, &val);
++
++	return !ret;
++}
++
++static bool optee_presence_check(void)
++{
++	struct device_node *np;
++	bool tee_detected = false;
++
++	/* check that the OP-TEE node is present and available. */
++	np = of_find_compatible_node(NULL, NULL, "linaro,optee-tz");
++	if (np && of_device_is_available(np))
++		tee_detected = true;
++	of_node_put(np);
++
++	return tee_detected;
++}
++
+ static int stm32_romem_probe(struct platform_device *pdev)
+ {
+ 	const struct stm32_romem_cfg *cfg;
+@@ -195,11 +220,16 @@ static int stm32_romem_probe(struct plat
+ 	} else {
+ 		priv->cfg.size = cfg->size;
+ 		priv->lower = cfg->lower;
+-		if (cfg->ta) {
++		if (cfg->ta || optee_presence_check()) {
+ 			rc = stm32_bsec_optee_ta_open(&priv->ctx);
+-			/* wait for OP-TEE client driver to be up and ready */
+-			if (rc)
+-				return rc;
++			if (rc) {
++				/* wait for OP-TEE client driver to be up and ready */
++				if (rc == -EPROBE_DEFER)
++					return -EPROBE_DEFER;
++				/* BSEC PTA is required or SMC not supported */
++				if (cfg->ta || !stm32_bsec_smc_check())
++					return rc;
++			}
+ 		}
+ 		if (priv->ctx) {
+ 			rc = devm_add_action_or_reset(dev, stm32_bsec_optee_ta_close, priv->ctx);
diff --git a/target/linux/generic/backport-5.15/809-v6.3-0009-nvmem-rave-sp-eeprm-fix-kernel-doc-bad-line-warning.patch b/target/linux/generic/backport-5.15/809-v6.3-0009-nvmem-rave-sp-eeprm-fix-kernel-doc-bad-line-warning.patch
new file mode 100644
index 00000000000000..9d6275a737bccb
--- /dev/null
+++ b/target/linux/generic/backport-5.15/809-v6.3-0009-nvmem-rave-sp-eeprm-fix-kernel-doc-bad-line-warning.patch
@@ -0,0 +1,32 @@
+From 3e5ac22aa564026e99defc3a8e02082521a5b231 Mon Sep 17 00:00:00 2001
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Mon, 6 Feb 2023 13:43:53 +0000
+Subject: [PATCH] nvmem: rave-sp-eeprm: fix kernel-doc bad line warning
+
+Convert an empty line to " *" to avoid a kernel-doc warning:
+
+drivers/nvmem/rave-sp-eeprom.c:48: warning: bad line:
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Cc: Andrey Vostrikov <andrey.vostrikov@cogentembedded.com>
+Cc: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
+Cc: Andrey Smirnov <andrew.smirnov@gmail.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-20-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/rave-sp-eeprom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/rave-sp-eeprom.c
++++ b/drivers/nvmem/rave-sp-eeprom.c
+@@ -45,7 +45,7 @@ enum rave_sp_eeprom_header_size {
+  * @type:	Access type (see enum rave_sp_eeprom_access_type)
+  * @success:	Success flag (Success = 1, Failure = 0)
+  * @data:	Read data
+-
++ *
+  * Note this structure corresponds to RSP_*_EEPROM payload from RAVE
+  * SP ICD
+  */
diff --git a/target/linux/generic/backport-5.15/809-v6.3-0010-nvmem-qcom-spmi-sdam-register-at-device-init-time.patch b/target/linux/generic/backport-5.15/809-v6.3-0010-nvmem-qcom-spmi-sdam-register-at-device-init-time.patch
new file mode 100644
index 00000000000000..1ab9e609d33c91
--- /dev/null
+++ b/target/linux/generic/backport-5.15/809-v6.3-0010-nvmem-qcom-spmi-sdam-register-at-device-init-time.patch
@@ -0,0 +1,43 @@
+From eb7dda20f42a9137e9ee53d5ed3b743d49338cb5 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Mon, 6 Feb 2023 13:43:54 +0000
+Subject: [PATCH] nvmem: qcom-spmi-sdam: register at device init time
+
+There are currently no in-tree users of the Qualcomm SDAM nvmem driver
+and there is generally no point in registering a driver that can be
+built as a module at subsys init time.
+
+Register the driver at the normal device init time instead and let
+driver core sort out the probe order.
+
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-21-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/qcom-spmi-sdam.c | 13 +------------
+ 1 file changed, 1 insertion(+), 12 deletions(-)
+
+--- a/drivers/nvmem/qcom-spmi-sdam.c
++++ b/drivers/nvmem/qcom-spmi-sdam.c
+@@ -175,18 +175,7 @@ static struct platform_driver sdam_drive
+ 	},
+ 	.probe		= sdam_probe,
+ };
+-
+-static int __init sdam_init(void)
+-{
+-	return platform_driver_register(&sdam_driver);
+-}
+-subsys_initcall(sdam_init);
+-
+-static void __exit sdam_exit(void)
+-{
+-	return platform_driver_unregister(&sdam_driver);
+-}
+-module_exit(sdam_exit);
++module_platform_driver(sdam_driver);
+ 
+ MODULE_DESCRIPTION("QCOM SPMI SDAM driver");
+ MODULE_LICENSE("GPL v2");
diff --git a/target/linux/generic/backport-5.15/809-v6.3-0011-nvmem-stm32-fix-OPTEE-dependency.patch b/target/linux/generic/backport-5.15/809-v6.3-0011-nvmem-stm32-fix-OPTEE-dependency.patch
new file mode 100644
index 00000000000000..dcf704c6ffbbfa
--- /dev/null
+++ b/target/linux/generic/backport-5.15/809-v6.3-0011-nvmem-stm32-fix-OPTEE-dependency.patch
@@ -0,0 +1,46 @@
+From 1dc7e37bb0ec1c997fac82031332a38c7610352f Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 6 Feb 2023 13:43:56 +0000
+Subject: [PATCH] nvmem: stm32: fix OPTEE dependency
+
+The stm32 nvmem driver fails to link as built-in when OPTEE
+is a loadable module:
+
+aarch64-linux-ld: drivers/nvmem/stm32-bsec-optee-ta.o: in function `stm32_bsec:
+stm32-bsec-optee-ta.c:(.text+0xc8): undefined reference to `tee_client_open_session'
+aarch64-linux-ld: drivers/nvmem/stm32-bsec-optee-ta.o: in function `stm32_bsec:
+stm32-bsec-optee-ta.c:(.text+0x1fc): undefined reference to `tee_client_open_context'
+
+Change the CONFIG_NVMEM_STM32_ROMEM definition so it can only
+be built-in if OPTEE is either built-in or disabled, and
+make NVMEM_STM32_BSEC_OPTEE_TA a hidden symbol instead.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-23-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/Kconfig | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -291,8 +291,7 @@ config NVMEM_SPRD_EFUSE
+ 	  will be called nvmem-sprd-efuse.
+ 
+ config NVMEM_STM32_BSEC_OPTEE_TA
+-	bool "STM32MP BSEC OP-TEE TA support for nvmem-stm32-romem driver"
+-	depends on OPTEE
++	def_bool NVMEM_STM32_ROMEM && OPTEE
+ 	help
+ 	  Say y here to enable the accesses to STM32MP SoC OTPs by the OP-TEE
+ 	  trusted application STM32MP BSEC.
+@@ -303,7 +302,7 @@ config NVMEM_STM32_BSEC_OPTEE_TA
+ config NVMEM_STM32_ROMEM
+ 	tristate "STMicroelectronics STM32 factory-programmed memory support"
+ 	depends on ARCH_STM32 || COMPILE_TEST
+-	imply NVMEM_STM32_BSEC_OPTEE_TA
++	depends on OPTEE || !OPTEE
+ 	help
+ 	  Say y here to enable read-only access for STMicroelectronics STM32
+ 	  factory-programmed memory area.
diff --git a/target/linux/generic/backport-5.15/810-v5.17-net-qmi_wwan-add-ZTE-MF286D-modem-19d2-1485.patch b/target/linux/generic/backport-5.15/810-v5.17-net-qmi_wwan-add-ZTE-MF286D-modem-19d2-1485.patch
new file mode 100644
index 00000000000000..25802be7e3d036
--- /dev/null
+++ b/target/linux/generic/backport-5.15/810-v5.17-net-qmi_wwan-add-ZTE-MF286D-modem-19d2-1485.patch
@@ -0,0 +1,59 @@
+From 078c6a1cbd4cd7496048786beec2e312577bebbf Mon Sep 17 00:00:00 2001
+From: Pawel Dembicki <paweldembicki@gmail.com>
+Date: Tue, 11 Jan 2022 23:11:32 +0100
+Subject: [PATCH 1/1] net: qmi_wwan: add ZTE MF286D modem 19d2:1485
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Modem from ZTE MF286D is an Qualcomm MDM9250 based 3G/4G modem.
+
+T:  Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  3 Spd=5000 MxCh= 0
+D:  Ver= 3.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs=  1
+P:  Vendor=19d2 ProdID=1485 Rev=52.87
+S:  Manufacturer=ZTE,Incorporated
+S:  Product=ZTE Technologies MSM
+S:  SerialNumber=MF286DZTED000000
+C:* #Ifs= 7 Cfg#= 1 Atr=80 MxPwr=896mA
+A:  FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=06 Prot=00
+I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=02 Prot=ff Driver=rndis_host
+E:  Ad=82(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
+E:  Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E:  Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+E:  Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E:  Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+E:  Ad=85(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
+E:  Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E:  Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+E:  Ad=87(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
+E:  Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E:  Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+E:  Ad=88(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
+E:  Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E:  Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs
+E:  Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E:  Ad=89(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+Acked-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/usb/qmi_wwan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1314,6 +1314,7 @@ static const struct usb_device_id produc
+ 	{QMI_FIXED_INTF(0x19d2, 0x1426, 2)},	/* ZTE MF91 */
+ 	{QMI_FIXED_INTF(0x19d2, 0x1428, 2)},	/* Telewell TW-LTE 4G v2 */
+ 	{QMI_FIXED_INTF(0x19d2, 0x1432, 3)},	/* ZTE ME3620 */
++	{QMI_FIXED_INTF(0x19d2, 0x1485, 5)},	/* ZTE MF286D */
+ 	{QMI_FIXED_INTF(0x19d2, 0x2002, 4)},	/* ZTE (Vodafone) K3765-Z */
+ 	{QMI_FIXED_INTF(0x2001, 0x7e16, 3)},	/* D-Link DWM-221 */
+ 	{QMI_FIXED_INTF(0x2001, 0x7e19, 4)},	/* D-Link DWM-221 B1 */
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0001-nvmem-xilinx-zynqmp-make-modular.patch b/target/linux/generic/backport-5.15/811-v6.4-0001-nvmem-xilinx-zynqmp-make-modular.patch
new file mode 100644
index 00000000000000..8328e87c0af7a4
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0001-nvmem-xilinx-zynqmp-make-modular.patch
@@ -0,0 +1,35 @@
+From bcd1fe07def0f070eb5f31594620aaee6f81d31a Mon Sep 17 00:00:00 2001
+From: Nick Alcock <nick.alcock@oracle.com>
+Date: Tue, 4 Apr 2023 18:21:11 +0100
+Subject: [PATCH] nvmem: xilinx: zynqmp: make modular
+
+This driver has a MODULE_LICENSE but is not tristate so cannot be
+built as a module, unlike all its peers: make it modular to match.
+
+Signed-off-by: Nick Alcock <nick.alcock@oracle.com>
+Suggested-by: Michal Simek <michal.simek@amd.com>
+Cc: Luis Chamberlain <mcgrof@kernel.org>
+Cc: linux-modules@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: Hitomi Hasegawa <hasegawa-hitomi@fujitsu.com>
+Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Cc: Michal Simek <michal.simek@xilinx.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-4-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -368,7 +368,7 @@ config NVMEM_VF610_OCOTP
+ 	  be called nvmem-vf610-ocotp.
+ 
+ config NVMEM_ZYNQMP
+-	bool "Xilinx ZYNQMP SoC nvmem firmware support"
++	tristate "Xilinx ZYNQMP SoC nvmem firmware support"
+ 	depends on ARCH_ZYNQMP
+ 	help
+ 	  This is a driver to access hardware related data like
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0002-nvmem-core-introduce-NVMEM-layouts.patch b/target/linux/generic/backport-5.15/811-v6.4-0002-nvmem-core-introduce-NVMEM-layouts.patch
new file mode 100644
index 00000000000000..23518d21f70c09
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0002-nvmem-core-introduce-NVMEM-layouts.patch
@@ -0,0 +1,387 @@
+From 266570f496b90dea8fda893c2cf7c28d63ae2bd9 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Tue, 4 Apr 2023 18:21:21 +0100
+Subject: [PATCH] nvmem: core: introduce NVMEM layouts
+
+NVMEM layouts are used to generate NVMEM cells during runtime. Think of
+an EEPROM with a well-defined conent. For now, the content can be
+described by a device tree or a board file. But this only works if the
+offsets and lengths are static and don't change. One could also argue
+that putting the layout of the EEPROM in the device tree is the wrong
+place. Instead, the device tree should just have a specific compatible
+string.
+
+Right now there are two use cases:
+ (1) The NVMEM cell needs special processing. E.g. if it only specifies
+     a base MAC address offset and you need to add an offset, or it
+     needs to parse a MAC from ASCII format or some proprietary format.
+     (Post processing of cells is added in a later commit).
+ (2) u-boot environment parsing. The cells don't have a particular
+     offset but it needs parsing the content to determine the offsets
+     and length.
+
+Co-developed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-14-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/driver-api/nvmem.rst |  15 ++++
+ drivers/nvmem/Kconfig              |   4 +
+ drivers/nvmem/Makefile             |   1 +
+ drivers/nvmem/core.c               | 120 +++++++++++++++++++++++++++++
+ drivers/nvmem/layouts/Kconfig      |   5 ++
+ drivers/nvmem/layouts/Makefile     |   4 +
+ include/linux/nvmem-consumer.h     |   7 ++
+ include/linux/nvmem-provider.h     |  51 ++++++++++++
+ 8 files changed, 207 insertions(+)
+ create mode 100644 drivers/nvmem/layouts/Kconfig
+ create mode 100644 drivers/nvmem/layouts/Makefile
+
+--- a/Documentation/driver-api/nvmem.rst
++++ b/Documentation/driver-api/nvmem.rst
+@@ -189,3 +189,18 @@ ex::
+ =====================
+ 
+ See Documentation/devicetree/bindings/nvmem/nvmem.txt
++
++8. NVMEM layouts
++================
++
++NVMEM layouts are yet another mechanism to create cells. With the device
++tree binding it is possible to specify simple cells by using an offset
++and a length. Sometimes, the cells doesn't have a static offset, but
++the content is still well defined, e.g. tag-length-values. In this case,
++the NVMEM device content has to be first parsed and the cells need to
++be added accordingly. Layouts let you read the content of the NVMEM device
++and let you add cells dynamically.
++
++Another use case for layouts is the post processing of cells. With layouts,
++it is possible to associate a custom post processing hook to a cell. It
++even possible to add this hook to cells not created by the layout itself.
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -21,6 +21,10 @@ config NVMEM_SYSFS
+ 	 This interface is mostly used by userspace applications to
+ 	 read/write directly into nvmem.
+ 
++# Layouts
++
++source "drivers/nvmem/layouts/Kconfig"
++
+ # Devices
+ 
+ config NVMEM_APPLE_EFUSES
+--- a/drivers/nvmem/Makefile
++++ b/drivers/nvmem/Makefile
+@@ -5,6 +5,7 @@
+ 
+ obj-$(CONFIG_NVMEM)		+= nvmem_core.o
+ nvmem_core-y			:= core.o
++obj-y				+= layouts/
+ 
+ # Devices
+ obj-$(CONFIG_NVMEM_APPLE_EFUSES)	+= nvmem-apple-efuses.o
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -40,6 +40,7 @@ struct nvmem_device {
+ 	nvmem_reg_write_t	reg_write;
+ 	nvmem_cell_post_process_t cell_post_process;
+ 	struct gpio_desc	*wp_gpio;
++	struct nvmem_layout	*layout;
+ 	void *priv;
+ };
+ 
+@@ -74,6 +75,9 @@ static LIST_HEAD(nvmem_lookup_list);
+ 
+ static BLOCKING_NOTIFIER_HEAD(nvmem_notifier);
+ 
++static DEFINE_SPINLOCK(nvmem_layout_lock);
++static LIST_HEAD(nvmem_layouts);
++
+ static int __nvmem_reg_read(struct nvmem_device *nvmem, unsigned int offset,
+ 			    void *val, size_t bytes)
+ {
+@@ -728,6 +732,101 @@ static int nvmem_add_cells_from_of(struc
+ 	return 0;
+ }
+ 
++int __nvmem_layout_register(struct nvmem_layout *layout, struct module *owner)
++{
++	layout->owner = owner;
++
++	spin_lock(&nvmem_layout_lock);
++	list_add(&layout->node, &nvmem_layouts);
++	spin_unlock(&nvmem_layout_lock);
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(__nvmem_layout_register);
++
++void nvmem_layout_unregister(struct nvmem_layout *layout)
++{
++	spin_lock(&nvmem_layout_lock);
++	list_del(&layout->node);
++	spin_unlock(&nvmem_layout_lock);
++}
++EXPORT_SYMBOL_GPL(nvmem_layout_unregister);
++
++static struct nvmem_layout *nvmem_layout_get(struct nvmem_device *nvmem)
++{
++	struct device_node *layout_np, *np = nvmem->dev.of_node;
++	struct nvmem_layout *l, *layout = NULL;
++
++	layout_np = of_get_child_by_name(np, "nvmem-layout");
++	if (!layout_np)
++		return NULL;
++
++	spin_lock(&nvmem_layout_lock);
++
++	list_for_each_entry(l, &nvmem_layouts, node) {
++		if (of_match_node(l->of_match_table, layout_np)) {
++			if (try_module_get(l->owner))
++				layout = l;
++
++			break;
++		}
++	}
++
++	spin_unlock(&nvmem_layout_lock);
++	of_node_put(layout_np);
++
++	return layout;
++}
++
++static void nvmem_layout_put(struct nvmem_layout *layout)
++{
++	if (layout)
++		module_put(layout->owner);
++}
++
++static int nvmem_add_cells_from_layout(struct nvmem_device *nvmem)
++{
++	struct nvmem_layout *layout = nvmem->layout;
++	int ret;
++
++	if (layout && layout->add_cells) {
++		ret = layout->add_cells(&nvmem->dev, nvmem, layout);
++		if (ret)
++			return ret;
++	}
++
++	return 0;
++}
++
++#if IS_ENABLED(CONFIG_OF)
++/**
++ * of_nvmem_layout_get_container() - Get OF node to layout container.
++ *
++ * @nvmem: nvmem device.
++ *
++ * Return: a node pointer with refcount incremented or NULL if no
++ * container exists. Use of_node_put() on it when done.
++ */
++struct device_node *of_nvmem_layout_get_container(struct nvmem_device *nvmem)
++{
++	return of_get_child_by_name(nvmem->dev.of_node, "nvmem-layout");
++}
++EXPORT_SYMBOL_GPL(of_nvmem_layout_get_container);
++#endif
++
++const void *nvmem_layout_get_match_data(struct nvmem_device *nvmem,
++					struct nvmem_layout *layout)
++{
++	struct device_node __maybe_unused *layout_np;
++	const struct of_device_id *match;
++
++	layout_np = of_nvmem_layout_get_container(nvmem);
++	match = of_match_node(layout->of_match_table, layout_np);
++
++	return match ? match->data : NULL;
++}
++EXPORT_SYMBOL_GPL(nvmem_layout_get_match_data);
++
+ /**
+  * nvmem_register() - Register a nvmem device for given nvmem_config.
+  * Also creates a binary entry in /sys/bus/nvmem/devices/dev-name/nvmem
+@@ -834,6 +933,12 @@ struct nvmem_device *nvmem_register(cons
+ 			goto err_put_device;
+ 	}
+ 
++	/*
++	 * If the driver supplied a layout by config->layout, the module
++	 * pointer will be NULL and nvmem_layout_put() will be a noop.
++	 */
++	nvmem->layout = config->layout ?: nvmem_layout_get(nvmem);
++
+ 	if (config->cells) {
+ 		rval = nvmem_add_cells(nvmem, config->cells, config->ncells);
+ 		if (rval)
+@@ -854,12 +959,17 @@ struct nvmem_device *nvmem_register(cons
+ 	if (rval)
+ 		goto err_remove_cells;
+ 
++	rval = nvmem_add_cells_from_layout(nvmem);
++	if (rval)
++		goto err_remove_cells;
++
+ 	blocking_notifier_call_chain(&nvmem_notifier, NVMEM_ADD, nvmem);
+ 
+ 	return nvmem;
+ 
+ err_remove_cells:
+ 	nvmem_device_remove_all_cells(nvmem);
++	nvmem_layout_put(nvmem->layout);
+ 	if (config->compat)
+ 		nvmem_sysfs_remove_compat(nvmem, config);
+ err_put_device:
+@@ -881,6 +991,7 @@ static void nvmem_device_release(struct
+ 		device_remove_bin_file(nvmem->base_dev, &nvmem->eeprom);
+ 
+ 	nvmem_device_remove_all_cells(nvmem);
++	nvmem_layout_put(nvmem->layout);
+ 	device_unregister(&nvmem->dev);
+ }
+ 
+@@ -1246,6 +1357,15 @@ struct nvmem_cell *of_nvmem_cell_get(str
+ 		return ERR_PTR(-EINVAL);
+ 	}
+ 
++	/* nvmem layouts produce cells within the nvmem-layout container */
++	if (of_node_name_eq(nvmem_np, "nvmem-layout")) {
++		nvmem_np = of_get_next_parent(nvmem_np);
++		if (!nvmem_np) {
++			of_node_put(cell_np);
++			return ERR_PTR(-EINVAL);
++		}
++	}
++
+ 	nvmem = __nvmem_device_get(nvmem_np, device_match_of_node);
+ 	of_node_put(nvmem_np);
+ 	if (IS_ERR(nvmem)) {
+--- /dev/null
++++ b/drivers/nvmem/layouts/Kconfig
+@@ -0,0 +1,5 @@
++# SPDX-License-Identifier: GPL-2.0
++
++menu "Layout Types"
++
++endmenu
+--- /dev/null
++++ b/drivers/nvmem/layouts/Makefile
+@@ -0,0 +1,4 @@
++# SPDX-License-Identifier: GPL-2.0
++#
++# Makefile for nvmem layouts.
++#
+--- a/include/linux/nvmem-consumer.h
++++ b/include/linux/nvmem-consumer.h
+@@ -239,6 +239,7 @@ struct nvmem_cell *of_nvmem_cell_get(str
+ 				     const char *id);
+ struct nvmem_device *of_nvmem_device_get(struct device_node *np,
+ 					 const char *name);
++struct device_node *of_nvmem_layout_get_container(struct nvmem_device *nvmem);
+ #else
+ static inline struct nvmem_cell *of_nvmem_cell_get(struct device_node *np,
+ 						   const char *id)
+@@ -251,6 +252,12 @@ static inline struct nvmem_device *of_nv
+ {
+ 	return ERR_PTR(-EOPNOTSUPP);
+ }
++
++static inline struct device_node *
++of_nvmem_layout_get_container(struct nvmem_device *nvmem)
++{
++	return ERR_PTR(-EOPNOTSUPP);
++}
+ #endif /* CONFIG_NVMEM && CONFIG_OF */
+ 
+ #endif  /* ifndef _LINUX_NVMEM_CONSUMER_H */
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -88,6 +88,7 @@ struct nvmem_cell_info {
+  * @stride:	Minimum read/write access stride.
+  * @priv:	User context passed to read/write callbacks.
+  * @ignore_wp:  Write Protect pin is managed by the provider.
++ * @layout:	Fixed layout associated with this nvmem device.
+  *
+  * Note: A default "nvmem<id>" name will be assigned to the device if
+  * no name is specified in its configuration. In such case "<id>" is
+@@ -109,6 +110,7 @@ struct nvmem_config {
+ 	bool			read_only;
+ 	bool			root_only;
+ 	bool			ignore_wp;
++	struct nvmem_layout	*layout;
+ 	struct device_node	*of_node;
+ 	bool			no_of_node;
+ 	nvmem_reg_read_t	reg_read;
+@@ -142,6 +144,33 @@ struct nvmem_cell_table {
+ 	struct list_head	node;
+ };
+ 
++/**
++ * struct nvmem_layout - NVMEM layout definitions
++ *
++ * @name:		Layout name.
++ * @of_match_table:	Open firmware match table.
++ * @add_cells:		Will be called if a nvmem device is found which
++ *			has this layout. The function will add layout
++ *			specific cells with nvmem_add_one_cell().
++ * @owner:		Pointer to struct module.
++ * @node:		List node.
++ *
++ * A nvmem device can hold a well defined structure which can just be
++ * evaluated during runtime. For example a TLV list, or a list of "name=val"
++ * pairs. A nvmem layout can parse the nvmem device and add appropriate
++ * cells.
++ */
++struct nvmem_layout {
++	const char *name;
++	const struct of_device_id *of_match_table;
++	int (*add_cells)(struct device *dev, struct nvmem_device *nvmem,
++			 struct nvmem_layout *layout);
++
++	/* private */
++	struct module *owner;
++	struct list_head node;
++};
++
+ #if IS_ENABLED(CONFIG_NVMEM)
+ 
+ struct nvmem_device *nvmem_register(const struct nvmem_config *cfg);
+@@ -156,6 +185,14 @@ void nvmem_del_cell_table(struct nvmem_c
+ int nvmem_add_one_cell(struct nvmem_device *nvmem,
+ 		       const struct nvmem_cell_info *info);
+ 
++int __nvmem_layout_register(struct nvmem_layout *layout, struct module *owner);
++#define nvmem_layout_register(layout) \
++	__nvmem_layout_register(layout, THIS_MODULE)
++void nvmem_layout_unregister(struct nvmem_layout *layout);
++
++const void *nvmem_layout_get_match_data(struct nvmem_device *nvmem,
++					struct nvmem_layout *layout);
++
+ #else
+ 
+ static inline struct nvmem_device *nvmem_register(const struct nvmem_config *c)
+@@ -179,5 +216,19 @@ static inline int nvmem_add_one_cell(str
+ 	return -EOPNOTSUPP;
+ }
+ 
++static inline int nvmem_layout_register(struct nvmem_layout *layout)
++{
++	return -EOPNOTSUPP;
++}
++
++static inline void nvmem_layout_unregister(struct nvmem_layout *layout) {}
++
++static inline const void *
++nvmem_layout_get_match_data(struct nvmem_device *nvmem,
++			    struct nvmem_layout *layout)
++{
++	return NULL;
++}
++
+ #endif /* CONFIG_NVMEM */
+ #endif  /* ifndef _LINUX_NVMEM_PROVIDER_H */
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0003-nvmem-core-handle-the-absence-of-expected-layouts.patch b/target/linux/generic/backport-5.15/811-v6.4-0003-nvmem-core-handle-the-absence-of-expected-layouts.patch
new file mode 100644
index 00000000000000..6fa7b6382d8941
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0003-nvmem-core-handle-the-absence-of-expected-layouts.patch
@@ -0,0 +1,61 @@
+From 6468a6f45148fb5e95c86b4efebf63f9abcd2137 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:22 +0100
+Subject: [PATCH] nvmem: core: handle the absence of expected layouts
+
+Make nvmem_layout_get() return -EPROBE_DEFER while the expected layout
+is not available. This condition cannot be triggered today as nvmem
+layout drivers are initialed as part of an early init call, but soon
+these drivers will be converted into modules and be initialized with a
+standard priority, so the unavailability of the drivers might become a
+reality that must be taken care of.
+
+Let's anticipate this by telling the caller the layout might not yet be
+available. A probe deferral is requested in this case.
+
+Please note this does not affect any nvmem device not using layouts,
+because an early check against the "nvmem-layout" container presence
+will return NULL in this case.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Tested-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-15-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -755,7 +755,7 @@ EXPORT_SYMBOL_GPL(nvmem_layout_unregiste
+ static struct nvmem_layout *nvmem_layout_get(struct nvmem_device *nvmem)
+ {
+ 	struct device_node *layout_np, *np = nvmem->dev.of_node;
+-	struct nvmem_layout *l, *layout = NULL;
++	struct nvmem_layout *l, *layout = ERR_PTR(-EPROBE_DEFER);
+ 
+ 	layout_np = of_get_child_by_name(np, "nvmem-layout");
+ 	if (!layout_np)
+@@ -938,6 +938,13 @@ struct nvmem_device *nvmem_register(cons
+ 	 * pointer will be NULL and nvmem_layout_put() will be a noop.
+ 	 */
+ 	nvmem->layout = config->layout ?: nvmem_layout_get(nvmem);
++	if (IS_ERR(nvmem->layout)) {
++		rval = PTR_ERR(nvmem->layout);
++		nvmem->layout = NULL;
++
++		if (rval == -EPROBE_DEFER)
++			goto err_teardown_compat;
++	}
+ 
+ 	if (config->cells) {
+ 		rval = nvmem_add_cells(nvmem, config->cells, config->ncells);
+@@ -970,6 +977,7 @@ struct nvmem_device *nvmem_register(cons
+ err_remove_cells:
+ 	nvmem_device_remove_all_cells(nvmem);
+ 	nvmem_layout_put(nvmem->layout);
++err_teardown_compat:
+ 	if (config->compat)
+ 		nvmem_sysfs_remove_compat(nvmem, config);
+ err_put_device:
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0004-nvmem-core-request-layout-modules-loading.patch b/target/linux/generic/backport-5.15/811-v6.4-0004-nvmem-core-request-layout-modules-loading.patch
new file mode 100644
index 00000000000000..b9341666f91f9d
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0004-nvmem-core-request-layout-modules-loading.patch
@@ -0,0 +1,52 @@
+From b1c37bec1ccfe5ccab72bc0ddc0dfa45c43e2de2 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:23 +0100
+Subject: [PATCH] nvmem: core: request layout modules loading
+
+When a storage device like an eeprom or an mtd device probes, it
+registers an nvmem device if the nvmem subsystem has been enabled (bool
+symbol). During nvmem registration, if the device is using layouts to
+expose dynamic nvmem cells, the core will first try to get a reference
+over the layout driver callbacks. In practice there is not relationship
+that can be described between the storage driver and the nvmem
+layout. So there is no way we can enforce both drivers will be built-in
+or both will be modules. If the storage device driver is built-in but
+the layout is built as a module, instead of badly failing with an
+endless probe deferral loop, lets just make a modprobe call in case the
+driver was made available in an initramfs with
+of_device_node_request_module(), and offer a fully functional system to
+the user.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Tested-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-16-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -17,6 +17,7 @@
+ #include <linux/nvmem-provider.h>
+ #include <linux/gpio/consumer.h>
+ #include <linux/of.h>
++#include <linux/of_device.h>
+ #include <linux/slab.h>
+ 
+ struct nvmem_device {
+@@ -761,6 +762,13 @@ static struct nvmem_layout *nvmem_layout
+ 	if (!layout_np)
+ 		return NULL;
+ 
++	/*
++	 * In case the nvmem device was built-in while the layout was built as a
++	 * module, we shall manually request the layout driver loading otherwise
++	 * we'll never have any match.
++	 */
++	of_request_module(layout_np);
++
+ 	spin_lock(&nvmem_layout_lock);
+ 
+ 	list_for_each_entry(l, &nvmem_layouts, node) {
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0005-nvmem-core-add-per-cell-post-processing.patch b/target/linux/generic/backport-5.15/811-v6.4-0005-nvmem-core-add-per-cell-post-processing.patch
new file mode 100644
index 00000000000000..53628cd4e4ffb4
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0005-nvmem-core-add-per-cell-post-processing.patch
@@ -0,0 +1,86 @@
+From 345ec382cd4b736c36e01f155d08c913b225b736 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Tue, 4 Apr 2023 18:21:24 +0100
+Subject: [PATCH] nvmem: core: add per-cell post processing
+
+Instead of relying on the name the consumer is using for the cell, like
+it is done for the nvmem .cell_post_process configuration parameter,
+provide a per-cell post processing hook. This can then be populated by
+the NVMEM provider (or the NVMEM layout) when adding the cell.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-17-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c           | 17 +++++++++++++++++
+ include/linux/nvmem-provider.h |  3 +++
+ 2 files changed, 20 insertions(+)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -54,6 +54,7 @@ struct nvmem_cell_entry {
+ 	int			bytes;
+ 	int			bit_offset;
+ 	int			nbits;
++	nvmem_cell_post_process_t read_post_process;
+ 	struct device_node	*np;
+ 	struct nvmem_device	*nvmem;
+ 	struct list_head	node;
+@@ -470,6 +471,7 @@ static int nvmem_cell_info_to_nvmem_cell
+ 	cell->offset = info->offset;
+ 	cell->bytes = info->bytes;
+ 	cell->name = info->name;
++	cell->read_post_process = info->read_post_process;
+ 
+ 	cell->bit_offset = info->bit_offset;
+ 	cell->nbits = info->nbits;
+@@ -1563,6 +1565,13 @@ static int __nvmem_cell_read(struct nvme
+ 	if (cell->bit_offset || cell->nbits)
+ 		nvmem_shift_read_buffer_in_place(cell, buf);
+ 
++	if (cell->read_post_process) {
++		rc = cell->read_post_process(nvmem->priv, id, index,
++					     cell->offset, buf, cell->bytes);
++		if (rc)
++			return rc;
++	}
++
+ 	if (nvmem->cell_post_process) {
+ 		rc = nvmem->cell_post_process(nvmem->priv, id, index,
+ 					      cell->offset, buf, cell->bytes);
+@@ -1671,6 +1680,14 @@ static int __nvmem_cell_entry_write(stru
+ 	    (cell->bit_offset == 0 && len != cell->bytes))
+ 		return -EINVAL;
+ 
++	/*
++	 * Any cells which have a read_post_process hook are read-only because
++	 * we cannot reverse the operation and it might affect other cells,
++	 * too.
++	 */
++	if (cell->read_post_process)
++		return -EINVAL;
++
+ 	if (cell->bit_offset || cell->nbits) {
+ 		buf = nvmem_cell_prepare_write_buffer(cell, buf, len);
+ 		if (IS_ERR(buf))
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -54,6 +54,8 @@ struct nvmem_keepout {
+  * @bit_offset:	Bit offset if cell is smaller than a byte.
+  * @nbits:	Number of bits.
+  * @np:		Optional device_node pointer.
++ * @read_post_process:	Callback for optional post processing of cell data
++ *			on reads.
+  */
+ struct nvmem_cell_info {
+ 	const char		*name;
+@@ -62,6 +64,7 @@ struct nvmem_cell_info {
+ 	unsigned int		bit_offset;
+ 	unsigned int		nbits;
+ 	struct device_node	*np;
++	nvmem_cell_post_process_t read_post_process;
+ };
+ 
+ /**
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0006-nvmem-core-allow-to-modify-a-cell-before-adding-it.patch b/target/linux/generic/backport-5.15/811-v6.4-0006-nvmem-core-allow-to-modify-a-cell-before-adding-it.patch
new file mode 100644
index 00000000000000..32990148c806f9
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0006-nvmem-core-allow-to-modify-a-cell-before-adding-it.patch
@@ -0,0 +1,59 @@
+From de12c9691501ccba41a154c223869f82be4c12fd Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Tue, 4 Apr 2023 18:21:25 +0100
+Subject: [PATCH] nvmem: core: allow to modify a cell before adding it
+
+Provide a way to modify a cell before it will get added. This is useful
+to attach a custom post processing hook via a layout.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-18-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c           | 4 ++++
+ include/linux/nvmem-provider.h | 5 +++++
+ 2 files changed, 9 insertions(+)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -695,6 +695,7 @@ static int nvmem_validate_keepouts(struc
+ 
+ static int nvmem_add_cells_from_of(struct nvmem_device *nvmem)
+ {
++	struct nvmem_layout *layout = nvmem->layout;
+ 	struct device *dev = &nvmem->dev;
+ 	struct device_node *child;
+ 	const __be32 *addr;
+@@ -724,6 +725,9 @@ static int nvmem_add_cells_from_of(struc
+ 
+ 		info.np = of_node_get(child);
+ 
++		if (layout && layout->fixup_cell_info)
++			layout->fixup_cell_info(nvmem, layout, &info);
++
+ 		ret = nvmem_add_one_cell(nvmem, &info);
+ 		kfree(info.name);
+ 		if (ret) {
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -155,6 +155,8 @@ struct nvmem_cell_table {
+  * @add_cells:		Will be called if a nvmem device is found which
+  *			has this layout. The function will add layout
+  *			specific cells with nvmem_add_one_cell().
++ * @fixup_cell_info:	Will be called before a cell is added. Can be
++ *			used to modify the nvmem_cell_info.
+  * @owner:		Pointer to struct module.
+  * @node:		List node.
+  *
+@@ -168,6 +170,9 @@ struct nvmem_layout {
+ 	const struct of_device_id *of_match_table;
+ 	int (*add_cells)(struct device *dev, struct nvmem_device *nvmem,
+ 			 struct nvmem_layout *layout);
++	void (*fixup_cell_info)(struct nvmem_device *nvmem,
++				struct nvmem_layout *layout,
++				struct nvmem_cell_info *cell);
+ 
+ 	/* private */
+ 	struct module *owner;
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0007-nvmem-imx-ocotp-replace-global-post-processing-with-.patch b/target/linux/generic/backport-5.15/811-v6.4-0007-nvmem-imx-ocotp-replace-global-post-processing-with-.patch
new file mode 100644
index 00000000000000..2a5fa618ea6529
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0007-nvmem-imx-ocotp-replace-global-post-processing-with-.patch
@@ -0,0 +1,81 @@
+From 6c56a82d7895a213a43182a5d01a21a906a79847 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Tue, 4 Apr 2023 18:21:26 +0100
+Subject: [PATCH] nvmem: imx-ocotp: replace global post processing with layouts
+
+In preparation of retiring the global post processing hook change this
+driver to use layouts. The layout will be supplied during registration
+and will be used to add the post processing hook to all added cells.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Tested-by: Michael Walle <michael@walle.cc> # on kontron-pitx-imx8m
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-19-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/imx-ocotp.c | 30 +++++++++++++++++++-----------
+ 1 file changed, 19 insertions(+), 11 deletions(-)
+
+--- a/drivers/nvmem/imx-ocotp.c
++++ b/drivers/nvmem/imx-ocotp.c
+@@ -225,18 +225,13 @@ read_end:
+ static int imx_ocotp_cell_pp(void *context, const char *id, int index,
+ 			     unsigned int offset, void *data, size_t bytes)
+ {
+-	struct ocotp_priv *priv = context;
++	u8 *buf = data;
++	int i;
+ 
+ 	/* Deal with some post processing of nvmem cell data */
+-	if (id && !strcmp(id, "mac-address")) {
+-		if (priv->params->reverse_mac_address) {
+-			u8 *buf = data;
+-			int i;
+-
+-			for (i = 0; i < bytes/2; i++)
+-				swap(buf[i], buf[bytes - i - 1]);
+-		}
+-	}
++	if (id && !strcmp(id, "mac-address"))
++		for (i = 0; i < bytes / 2; i++)
++			swap(buf[i], buf[bytes - i - 1]);
+ 
+ 	return 0;
+ }
+@@ -488,7 +483,6 @@ static struct nvmem_config imx_ocotp_nvm
+ 	.stride = 1,
+ 	.reg_read = imx_ocotp_read,
+ 	.reg_write = imx_ocotp_write,
+-	.cell_post_process = imx_ocotp_cell_pp,
+ };
+ 
+ static const struct ocotp_params imx6q_params = {
+@@ -595,6 +589,17 @@ static const struct of_device_id imx_oco
+ };
+ MODULE_DEVICE_TABLE(of, imx_ocotp_dt_ids);
+ 
++static void imx_ocotp_fixup_cell_info(struct nvmem_device *nvmem,
++				      struct nvmem_layout *layout,
++				      struct nvmem_cell_info *cell)
++{
++	cell->read_post_process = imx_ocotp_cell_pp;
++}
++
++struct nvmem_layout imx_ocotp_layout = {
++	.fixup_cell_info = imx_ocotp_fixup_cell_info,
++};
++
+ static int imx_ocotp_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
+@@ -619,6 +624,9 @@ static int imx_ocotp_probe(struct platfo
+ 	imx_ocotp_nvmem_config.size = 4 * priv->params->nregs;
+ 	imx_ocotp_nvmem_config.dev = dev;
+ 	imx_ocotp_nvmem_config.priv = priv;
++	if (priv->params->reverse_mac_address)
++		imx_ocotp_nvmem_config.layout = &imx_ocotp_layout;
++
+ 	priv->config = &imx_ocotp_nvmem_config;
+ 
+ 	clk_prepare_enable(priv->clk);
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0008-nvmem-cell-drop-global-cell_post_process.patch b/target/linux/generic/backport-5.15/811-v6.4-0008-nvmem-cell-drop-global-cell_post_process.patch
new file mode 100644
index 00000000000000..eac202b8829841
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0008-nvmem-cell-drop-global-cell_post_process.patch
@@ -0,0 +1,68 @@
+From 011e40a166fdaa65fb9946b7cd91efec85b70dbb Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Tue, 4 Apr 2023 18:21:27 +0100
+Subject: [PATCH] nvmem: cell: drop global cell_post_process
+
+There are no users anymore for the global cell_post_process callback
+anymore. New users should use proper nvmem layouts.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-20-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c           | 9 ---------
+ include/linux/nvmem-provider.h | 2 --
+ 2 files changed, 11 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -39,7 +39,6 @@ struct nvmem_device {
+ 	unsigned int		nkeepout;
+ 	nvmem_reg_read_t	reg_read;
+ 	nvmem_reg_write_t	reg_write;
+-	nvmem_cell_post_process_t cell_post_process;
+ 	struct gpio_desc	*wp_gpio;
+ 	struct nvmem_layout	*layout;
+ 	void *priv;
+@@ -903,7 +902,6 @@ struct nvmem_device *nvmem_register(cons
+ 	nvmem->type = config->type;
+ 	nvmem->reg_read = config->reg_read;
+ 	nvmem->reg_write = config->reg_write;
+-	nvmem->cell_post_process = config->cell_post_process;
+ 	nvmem->keepout = config->keepout;
+ 	nvmem->nkeepout = config->nkeepout;
+ 	if (config->of_node)
+@@ -1575,13 +1573,6 @@ static int __nvmem_cell_read(struct nvme
+ 		if (rc)
+ 			return rc;
+ 	}
+-
+-	if (nvmem->cell_post_process) {
+-		rc = nvmem->cell_post_process(nvmem->priv, id, index,
+-					      cell->offset, buf, cell->bytes);
+-		if (rc)
+-			return rc;
+-	}
+ 
+ 	if (len)
+ 		*len = cell->bytes;
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -85,7 +85,6 @@ struct nvmem_cell_info {
+  * @no_of_node:	Device should not use the parent's of_node even if it's !NULL.
+  * @reg_read:	Callback to read data.
+  * @reg_write:	Callback to write data.
+- * @cell_post_process:	Callback for vendor specific post processing of cell data
+  * @size:	Device size.
+  * @word_size:	Minimum read/write access granularity.
+  * @stride:	Minimum read/write access stride.
+@@ -118,7 +117,6 @@ struct nvmem_config {
+ 	bool			no_of_node;
+ 	nvmem_reg_read_t	reg_read;
+ 	nvmem_reg_write_t	reg_write;
+-	nvmem_cell_post_process_t cell_post_process;
+ 	int	size;
+ 	int	word_size;
+ 	int	stride;
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0009-nvmem-core-provide-own-priv-pointer-in-post-process-.patch b/target/linux/generic/backport-5.15/811-v6.4-0009-nvmem-core-provide-own-priv-pointer-in-post-process-.patch
new file mode 100644
index 00000000000000..46b30a2ed90417
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0009-nvmem-core-provide-own-priv-pointer-in-post-process-.patch
@@ -0,0 +1,76 @@
+From 8a134fd9f9323f4c39ec27055b3d3723cfb5c1e9 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Tue, 4 Apr 2023 18:21:28 +0100
+Subject: [PATCH] nvmem: core: provide own priv pointer in post process
+ callback
+
+It doesn't make any more sense to have a opaque pointer set up by the
+nvmem device. Usually, the layout isn't associated with a particular
+nvmem device. Instead, let the caller who set the post process callback
+provide the priv pointer.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-21-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c           | 4 +++-
+ include/linux/nvmem-provider.h | 5 ++++-
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -54,6 +54,7 @@ struct nvmem_cell_entry {
+ 	int			bit_offset;
+ 	int			nbits;
+ 	nvmem_cell_post_process_t read_post_process;
++	void			*priv;
+ 	struct device_node	*np;
+ 	struct nvmem_device	*nvmem;
+ 	struct list_head	node;
+@@ -471,6 +472,7 @@ static int nvmem_cell_info_to_nvmem_cell
+ 	cell->bytes = info->bytes;
+ 	cell->name = info->name;
+ 	cell->read_post_process = info->read_post_process;
++	cell->priv = info->priv;
+ 
+ 	cell->bit_offset = info->bit_offset;
+ 	cell->nbits = info->nbits;
+@@ -1568,7 +1570,7 @@ static int __nvmem_cell_read(struct nvme
+ 		nvmem_shift_read_buffer_in_place(cell, buf);
+ 
+ 	if (cell->read_post_process) {
+-		rc = cell->read_post_process(nvmem->priv, id, index,
++		rc = cell->read_post_process(cell->priv, id, index,
+ 					     cell->offset, buf, cell->bytes);
+ 		if (rc)
+ 			return rc;
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -20,7 +20,8 @@ typedef int (*nvmem_reg_write_t)(void *p
+ 				 void *val, size_t bytes);
+ /* used for vendor specific post processing of cell data */
+ typedef int (*nvmem_cell_post_process_t)(void *priv, const char *id, int index,
+-					 unsigned int offset, void *buf, size_t bytes);
++					 unsigned int offset, void *buf,
++					 size_t bytes);
+ 
+ enum nvmem_type {
+ 	NVMEM_TYPE_UNKNOWN = 0,
+@@ -56,6 +57,7 @@ struct nvmem_keepout {
+  * @np:		Optional device_node pointer.
+  * @read_post_process:	Callback for optional post processing of cell data
+  *			on reads.
++ * @priv:	Opaque data passed to the read_post_process hook.
+  */
+ struct nvmem_cell_info {
+ 	const char		*name;
+@@ -65,6 +67,7 @@ struct nvmem_cell_info {
+ 	unsigned int		nbits;
+ 	struct device_node	*np;
+ 	nvmem_cell_post_process_t read_post_process;
++	void			*priv;
+ };
+ 
+ /**
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0010-nvmem-layouts-sl28vpd-Add-new-layout-driver.patch b/target/linux/generic/backport-5.15/811-v6.4-0010-nvmem-layouts-sl28vpd-Add-new-layout-driver.patch
new file mode 100644
index 00000000000000..7d97658b60e289
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0010-nvmem-layouts-sl28vpd-Add-new-layout-driver.patch
@@ -0,0 +1,215 @@
+From d9fae023fe86069750092fc1c2f3a73e2fb18512 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Tue, 4 Apr 2023 18:21:29 +0100
+Subject: [PATCH] nvmem: layouts: sl28vpd: Add new layout driver
+
+This layout applies to the VPD of the Kontron sl28 boards. The VPD only
+contains a base MAC address. Therefore, we have to add an individual
+offset to it. This is done by taking the second argument of the nvmem
+phandle into account. Also this let us checking the VPD version and the
+checksum.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-22-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/layouts/Kconfig   |   9 ++
+ drivers/nvmem/layouts/Makefile  |   2 +
+ drivers/nvmem/layouts/sl28vpd.c | 165 ++++++++++++++++++++++++++++++++
+ 3 files changed, 176 insertions(+)
+ create mode 100644 drivers/nvmem/layouts/sl28vpd.c
+
+--- a/drivers/nvmem/layouts/Kconfig
++++ b/drivers/nvmem/layouts/Kconfig
+@@ -2,4 +2,13 @@
+ 
+ menu "Layout Types"
+ 
++config NVMEM_LAYOUT_SL28_VPD
++	tristate "Kontron sl28 VPD layout support"
++	select CRC8
++	help
++	  Say Y here if you want to support the VPD layout of the Kontron
++	  SMARC-sAL28 boards.
++
++	  If unsure, say N.
++
+ endmenu
+--- a/drivers/nvmem/layouts/Makefile
++++ b/drivers/nvmem/layouts/Makefile
+@@ -2,3 +2,5 @@
+ #
+ # Makefile for nvmem layouts.
+ #
++
++obj-$(CONFIG_NVMEM_LAYOUT_SL28_VPD) += sl28vpd.o
+--- /dev/null
++++ b/drivers/nvmem/layouts/sl28vpd.c
+@@ -0,0 +1,165 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <linux/crc8.h>
++#include <linux/etherdevice.h>
++#include <linux/nvmem-consumer.h>
++#include <linux/nvmem-provider.h>
++#include <linux/of.h>
++#include <uapi/linux/if_ether.h>
++
++#define SL28VPD_MAGIC 'V'
++
++struct sl28vpd_header {
++	u8 magic;
++	u8 version;
++} __packed;
++
++struct sl28vpd_v1 {
++	struct sl28vpd_header header;
++	char serial_number[15];
++	u8 base_mac_address[ETH_ALEN];
++	u8 crc8;
++} __packed;
++
++static int sl28vpd_mac_address_pp(void *priv, const char *id, int index,
++				  unsigned int offset, void *buf,
++				  size_t bytes)
++{
++	if (bytes != ETH_ALEN)
++		return -EINVAL;
++
++	if (index < 0)
++		return -EINVAL;
++
++	if (!is_valid_ether_addr(buf))
++		return -EINVAL;
++
++	eth_addr_add(buf, index);
++
++	return 0;
++}
++
++static const struct nvmem_cell_info sl28vpd_v1_entries[] = {
++	{
++		.name = "serial-number",
++		.offset = offsetof(struct sl28vpd_v1, serial_number),
++		.bytes = sizeof_field(struct sl28vpd_v1, serial_number),
++	},
++	{
++		.name = "base-mac-address",
++		.offset = offsetof(struct sl28vpd_v1, base_mac_address),
++		.bytes = sizeof_field(struct sl28vpd_v1, base_mac_address),
++		.read_post_process = sl28vpd_mac_address_pp,
++	},
++};
++
++static int sl28vpd_v1_check_crc(struct device *dev, struct nvmem_device *nvmem)
++{
++	struct sl28vpd_v1 data_v1;
++	u8 table[CRC8_TABLE_SIZE];
++	int ret;
++	u8 crc;
++
++	crc8_populate_msb(table, 0x07);
++
++	ret = nvmem_device_read(nvmem, 0, sizeof(data_v1), &data_v1);
++	if (ret < 0)
++		return ret;
++	else if (ret != sizeof(data_v1))
++		return -EIO;
++
++	crc = crc8(table, (void *)&data_v1, sizeof(data_v1) - 1, 0);
++
++	if (crc != data_v1.crc8) {
++		dev_err(dev,
++			"Checksum is invalid (got %02x, expected %02x).\n",
++			crc, data_v1.crc8);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static int sl28vpd_add_cells(struct device *dev, struct nvmem_device *nvmem,
++			     struct nvmem_layout *layout)
++{
++	const struct nvmem_cell_info *pinfo;
++	struct nvmem_cell_info info = {0};
++	struct device_node *layout_np;
++	struct sl28vpd_header hdr;
++	int ret, i;
++
++	/* check header */
++	ret = nvmem_device_read(nvmem, 0, sizeof(hdr), &hdr);
++	if (ret < 0)
++		return ret;
++	else if (ret != sizeof(hdr))
++		return -EIO;
++
++	if (hdr.magic != SL28VPD_MAGIC) {
++		dev_err(dev, "Invalid magic value (%02x)\n", hdr.magic);
++		return -EINVAL;
++	}
++
++	if (hdr.version != 1) {
++		dev_err(dev, "Version %d is unsupported.\n", hdr.version);
++		return -EINVAL;
++	}
++
++	ret = sl28vpd_v1_check_crc(dev, nvmem);
++	if (ret)
++		return ret;
++
++	layout_np = of_nvmem_layout_get_container(nvmem);
++	if (!layout_np)
++		return -ENOENT;
++
++	for (i = 0; i < ARRAY_SIZE(sl28vpd_v1_entries); i++) {
++		pinfo = &sl28vpd_v1_entries[i];
++
++		info.name = pinfo->name;
++		info.offset = pinfo->offset;
++		info.bytes = pinfo->bytes;
++		info.read_post_process = pinfo->read_post_process;
++		info.np = of_get_child_by_name(layout_np, pinfo->name);
++
++		ret = nvmem_add_one_cell(nvmem, &info);
++		if (ret) {
++			of_node_put(layout_np);
++			return ret;
++		}
++	}
++
++	of_node_put(layout_np);
++
++	return 0;
++}
++
++static const struct of_device_id sl28vpd_of_match_table[] = {
++	{ .compatible = "kontron,sl28-vpd" },
++	{},
++};
++MODULE_DEVICE_TABLE(of, sl28vpd_of_match_table);
++
++struct nvmem_layout sl28vpd_layout = {
++	.name = "sl28-vpd",
++	.of_match_table = sl28vpd_of_match_table,
++	.add_cells = sl28vpd_add_cells,
++};
++
++static int __init sl28vpd_init(void)
++{
++	return nvmem_layout_register(&sl28vpd_layout);
++}
++
++static void __exit sl28vpd_exit(void)
++{
++	nvmem_layout_unregister(&sl28vpd_layout);
++}
++
++module_init(sl28vpd_init);
++module_exit(sl28vpd_exit);
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Michael Walle <michael@walle.cc>");
++MODULE_DESCRIPTION("NVMEM layout driver for the VPD of Kontron sl28 boards");
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0011-nvmem-layouts-onie-tlv-Add-new-layout-driver.patch b/target/linux/generic/backport-5.15/811-v6.4-0011-nvmem-layouts-onie-tlv-Add-new-layout-driver.patch
new file mode 100644
index 00000000000000..ca8b4bc069146b
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0011-nvmem-layouts-onie-tlv-Add-new-layout-driver.patch
@@ -0,0 +1,306 @@
+From d3c0d12f6474216bf386101e2449cc73e5c5b61d Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:31 +0100
+Subject: [PATCH] nvmem: layouts: onie-tlv: Add new layout driver
+
+This layout applies on top of any non volatile storage device containing
+an ONIE table factory flashed. This table follows the tlv
+(type-length-value) organization described in the link below. We cannot
+afford using regular parsers because the content of these tables is
+manufacturer specific and must be dynamically discovered.
+
+Link: https://opencomputeproject.github.io/onie/design-spec/hw_requirements.html
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-24-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/layouts/Kconfig    |   9 ++
+ drivers/nvmem/layouts/Makefile   |   1 +
+ drivers/nvmem/layouts/onie-tlv.c | 257 +++++++++++++++++++++++++++++++
+ 3 files changed, 267 insertions(+)
+ create mode 100644 drivers/nvmem/layouts/onie-tlv.c
+
+--- a/drivers/nvmem/layouts/Kconfig
++++ b/drivers/nvmem/layouts/Kconfig
+@@ -11,4 +11,13 @@ config NVMEM_LAYOUT_SL28_VPD
+ 
+ 	  If unsure, say N.
+ 
++config NVMEM_LAYOUT_ONIE_TLV
++	tristate "ONIE tlv support"
++	select CRC32
++	help
++	  Say Y here if you want to support the Open Compute Project ONIE
++	  Type-Length-Value standard table.
++
++	  If unsure, say N.
++
+ endmenu
+--- a/drivers/nvmem/layouts/Makefile
++++ b/drivers/nvmem/layouts/Makefile
+@@ -4,3 +4,4 @@
+ #
+ 
+ obj-$(CONFIG_NVMEM_LAYOUT_SL28_VPD) += sl28vpd.o
++obj-$(CONFIG_NVMEM_LAYOUT_ONIE_TLV) += onie-tlv.o
+--- /dev/null
++++ b/drivers/nvmem/layouts/onie-tlv.c
+@@ -0,0 +1,257 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * ONIE tlv NVMEM cells provider
++ *
++ * Copyright (C) 2022 Open Compute Group ONIE
++ * Author: Miquel Raynal <miquel.raynal@bootlin.com>
++ * Based on the nvmem driver written by: Vadym Kochan <vadym.kochan@plvision.eu>
++ * Inspired by the first layout written by: Rafał Miłecki <rafal@milecki.pl>
++ */
++
++#include <linux/crc32.h>
++#include <linux/etherdevice.h>
++#include <linux/nvmem-consumer.h>
++#include <linux/nvmem-provider.h>
++#include <linux/of.h>
++
++#define ONIE_TLV_MAX_LEN 2048
++#define ONIE_TLV_CRC_FIELD_SZ 6
++#define ONIE_TLV_CRC_SZ 4
++#define ONIE_TLV_HDR_ID	"TlvInfo"
++
++struct onie_tlv_hdr {
++	u8 id[8];
++	u8 version;
++	__be16 data_len;
++} __packed;
++
++struct onie_tlv {
++	u8 type;
++	u8 len;
++} __packed;
++
++static const char *onie_tlv_cell_name(u8 type)
++{
++	switch (type) {
++	case 0x21:
++		return "product-name";
++	case 0x22:
++		return "part-number";
++	case 0x23:
++		return "serial-number";
++	case 0x24:
++		return "mac-address";
++	case 0x25:
++		return "manufacture-date";
++	case 0x26:
++		return "device-version";
++	case 0x27:
++		return "label-revision";
++	case 0x28:
++		return "platform-name";
++	case 0x29:
++		return "onie-version";
++	case 0x2A:
++		return "num-macs";
++	case 0x2B:
++		return "manufacturer";
++	case 0x2C:
++		return "country-code";
++	case 0x2D:
++		return "vendor";
++	case 0x2E:
++		return "diag-version";
++	case 0x2F:
++		return "service-tag";
++	case 0xFD:
++		return "vendor-extension";
++	case 0xFE:
++		return "crc32";
++	default:
++		break;
++	}
++
++	return NULL;
++}
++
++static int onie_tlv_mac_read_cb(void *priv, const char *id, int index,
++				unsigned int offset, void *buf,
++				size_t bytes)
++{
++	eth_addr_add(buf, index);
++
++	return 0;
++}
++
++static nvmem_cell_post_process_t onie_tlv_read_cb(u8 type, u8 *buf)
++{
++	switch (type) {
++	case 0x24:
++		return &onie_tlv_mac_read_cb;
++	default:
++		break;
++	}
++
++	return NULL;
++}
++
++static int onie_tlv_add_cells(struct device *dev, struct nvmem_device *nvmem,
++			      size_t data_len, u8 *data)
++{
++	struct nvmem_cell_info cell = {};
++	struct device_node *layout;
++	struct onie_tlv tlv;
++	unsigned int hdr_len = sizeof(struct onie_tlv_hdr);
++	unsigned int offset = 0;
++	int ret;
++
++	layout = of_nvmem_layout_get_container(nvmem);
++	if (!layout)
++		return -ENOENT;
++
++	while (offset < data_len) {
++		memcpy(&tlv, data + offset, sizeof(tlv));
++		if (offset + tlv.len >= data_len) {
++			dev_err(dev, "Out of bounds field (0x%x bytes at 0x%x)\n",
++				tlv.len, hdr_len + offset);
++			break;
++		}
++
++		cell.name = onie_tlv_cell_name(tlv.type);
++		if (!cell.name)
++			continue;
++
++		cell.offset = hdr_len + offset + sizeof(tlv.type) + sizeof(tlv.len);
++		cell.bytes = tlv.len;
++		cell.np = of_get_child_by_name(layout, cell.name);
++		cell.read_post_process = onie_tlv_read_cb(tlv.type, data + offset + sizeof(tlv));
++
++		ret = nvmem_add_one_cell(nvmem, &cell);
++		if (ret) {
++			of_node_put(layout);
++			return ret;
++		}
++
++		offset += sizeof(tlv) + tlv.len;
++	}
++
++	of_node_put(layout);
++
++	return 0;
++}
++
++static bool onie_tlv_hdr_is_valid(struct device *dev, struct onie_tlv_hdr *hdr)
++{
++	if (memcmp(hdr->id, ONIE_TLV_HDR_ID, sizeof(hdr->id))) {
++		dev_err(dev, "Invalid header\n");
++		return false;
++	}
++
++	if (hdr->version != 0x1) {
++		dev_err(dev, "Invalid version number\n");
++		return false;
++	}
++
++	return true;
++}
++
++static bool onie_tlv_crc_is_valid(struct device *dev, size_t table_len, u8 *table)
++{
++	struct onie_tlv crc_hdr;
++	u32 read_crc, calc_crc;
++	__be32 crc_be;
++
++	memcpy(&crc_hdr, table + table_len - ONIE_TLV_CRC_FIELD_SZ, sizeof(crc_hdr));
++	if (crc_hdr.type != 0xfe || crc_hdr.len != ONIE_TLV_CRC_SZ) {
++		dev_err(dev, "Invalid CRC field\n");
++		return false;
++	}
++
++	/* The table contains a JAMCRC, which is XOR'ed compared to the original
++	 * CRC32 implementation as known in the Ethernet world.
++	 */
++	memcpy(&crc_be, table + table_len - ONIE_TLV_CRC_SZ, ONIE_TLV_CRC_SZ);
++	read_crc = be32_to_cpu(crc_be);
++	calc_crc = crc32(~0, table, table_len - ONIE_TLV_CRC_SZ) ^ 0xFFFFFFFF;
++	if (read_crc != calc_crc) {
++		dev_err(dev, "Invalid CRC read: 0x%08x, expected: 0x%08x\n",
++			read_crc, calc_crc);
++		return false;
++	}
++
++	return true;
++}
++
++static int onie_tlv_parse_table(struct device *dev, struct nvmem_device *nvmem,
++				struct nvmem_layout *layout)
++{
++	struct onie_tlv_hdr hdr;
++	size_t table_len, data_len, hdr_len;
++	u8 *table, *data;
++	int ret;
++
++	ret = nvmem_device_read(nvmem, 0, sizeof(hdr), &hdr);
++	if (ret < 0)
++		return ret;
++
++	if (!onie_tlv_hdr_is_valid(dev, &hdr)) {
++		dev_err(dev, "Invalid ONIE TLV header\n");
++		return -EINVAL;
++	}
++
++	hdr_len = sizeof(hdr.id) + sizeof(hdr.version) + sizeof(hdr.data_len);
++	data_len = be16_to_cpu(hdr.data_len);
++	table_len = hdr_len + data_len;
++	if (table_len > ONIE_TLV_MAX_LEN) {
++		dev_err(dev, "Invalid ONIE TLV data length\n");
++		return -EINVAL;
++	}
++
++	table = devm_kmalloc(dev, table_len, GFP_KERNEL);
++	if (!table)
++		return -ENOMEM;
++
++	ret = nvmem_device_read(nvmem, 0, table_len, table);
++	if (ret != table_len)
++		return ret;
++
++	if (!onie_tlv_crc_is_valid(dev, table_len, table))
++		return -EINVAL;
++
++	data = table + hdr_len;
++	ret = onie_tlv_add_cells(dev, nvmem, data_len, data);
++	if (ret)
++		return ret;
++
++	return 0;
++}
++
++static const struct of_device_id onie_tlv_of_match_table[] = {
++	{ .compatible = "onie,tlv-layout", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, onie_tlv_of_match_table);
++
++static struct nvmem_layout onie_tlv_layout = {
++	.name = "ONIE tlv layout",
++	.of_match_table = onie_tlv_of_match_table,
++	.add_cells = onie_tlv_parse_table,
++};
++
++static int __init onie_tlv_init(void)
++{
++	return nvmem_layout_register(&onie_tlv_layout);
++}
++
++static void __exit onie_tlv_exit(void)
++{
++	nvmem_layout_unregister(&onie_tlv_layout);
++}
++
++module_init(onie_tlv_init);
++module_exit(onie_tlv_exit);
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Miquel Raynal <miquel.raynal@bootlin.com>");
++MODULE_DESCRIPTION("NVMEM layout driver for Onie TLV table parsing");
++MODULE_ALIAS("NVMEM layout driver for Onie TLV table parsing");
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0012-nvmem-stm32-romem-mark-OF-related-data-as-maybe-unus.patch b/target/linux/generic/backport-5.15/811-v6.4-0012-nvmem-stm32-romem-mark-OF-related-data-as-maybe-unus.patch
new file mode 100644
index 00000000000000..94a0911d73cc76
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0012-nvmem-stm32-romem-mark-OF-related-data-as-maybe-unus.patch
@@ -0,0 +1,32 @@
+From a4fb434ef96ace5af758ca2c52c3a3f8f3abc87c Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Tue, 4 Apr 2023 18:21:34 +0100
+Subject: [PATCH] nvmem: stm32-romem: mark OF related data as maybe unused
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The driver can be compile tested with !CONFIG_OF making certain data
+unused:
+
+  drivers/nvmem/stm32-romem.c:271:34: error: ‘stm32_romem_of_match’ defined but not used [-Werror=unused-const-variable=]
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-27-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/stm32-romem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/stm32-romem.c
++++ b/drivers/nvmem/stm32-romem.c
+@@ -268,7 +268,7 @@ static const struct stm32_romem_cfg stm3
+ 	.ta = true,
+ };
+ 
+-static const struct of_device_id stm32_romem_of_match[] = {
++static const struct of_device_id stm32_romem_of_match[] __maybe_unused = {
+ 	{ .compatible = "st,stm32f4-otp", }, {
+ 		.compatible = "st,stm32mp15-bsec",
+ 		.data = (void *)&stm32mp15_bsec_cfg,
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0013-nvmem-mtk-efuse-Support-postprocessing-for-GPU-speed.patch b/target/linux/generic/backport-5.15/811-v6.4-0013-nvmem-mtk-efuse-Support-postprocessing-for-GPU-speed.patch
new file mode 100644
index 00000000000000..abda402bddb07a
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0013-nvmem-mtk-efuse-Support-postprocessing-for-GPU-speed.patch
@@ -0,0 +1,120 @@
+From de6e05097f7db066afb0ad4c88b730949f7b7749 Mon Sep 17 00:00:00 2001
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Date: Tue, 4 Apr 2023 18:21:35 +0100
+Subject: [PATCH] nvmem: mtk-efuse: Support postprocessing for GPU speed
+ binning data
+
+On some MediaTek SoCs GPU speed binning data is available for read
+in the SoC's eFuse array but it has a format that is incompatible
+with what the OPP API expects, as we read a number from 0 to 7 but
+opp-supported-hw is expecting a bitmask to enable an OPP entry:
+being what we read limited to 0-7, it's straightforward to simply
+convert the value to BIT(value) as a post-processing action.
+
+So, introduce post-processing support and enable it by evaluating
+the newly introduced platform data's `uses_post_processing` member,
+currently enabled only for MT8186.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-28-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/mtk-efuse.c | 53 +++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 51 insertions(+), 2 deletions(-)
+
+--- a/drivers/nvmem/mtk-efuse.c
++++ b/drivers/nvmem/mtk-efuse.c
+@@ -10,6 +10,11 @@
+ #include <linux/io.h>
+ #include <linux/nvmem-provider.h>
+ #include <linux/platform_device.h>
++#include <linux/property.h>
++
++struct mtk_efuse_pdata {
++	bool uses_post_processing;
++};
+ 
+ struct mtk_efuse_priv {
+ 	void __iomem *base;
+@@ -29,6 +34,37 @@ static int mtk_reg_read(void *context,
+ 	return 0;
+ }
+ 
++static int mtk_efuse_gpu_speedbin_pp(void *context, const char *id, int index,
++				     unsigned int offset, void *data, size_t bytes)
++{
++	u8 *val = data;
++
++	if (val[0] < 8)
++		val[0] = BIT(val[0]);
++
++	return 0;
++}
++
++static void mtk_efuse_fixup_cell_info(struct nvmem_device *nvmem,
++				      struct nvmem_layout *layout,
++				      struct nvmem_cell_info *cell)
++{
++	size_t sz = strlen(cell->name);
++
++	/*
++	 * On some SoCs, the GPU speedbin is not read as bitmask but as
++	 * a number with range [0-7] (max 3 bits): post process to use
++	 * it in OPP tables to describe supported-hw.
++	 */
++	if (cell->nbits <= 3 &&
++	    strncmp(cell->name, "gpu-speedbin", min(sz, strlen("gpu-speedbin"))) == 0)
++		cell->read_post_process = mtk_efuse_gpu_speedbin_pp;
++}
++
++static struct nvmem_layout mtk_efuse_layout = {
++	.fixup_cell_info = mtk_efuse_fixup_cell_info,
++};
++
+ static int mtk_efuse_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
+@@ -36,6 +72,7 @@ static int mtk_efuse_probe(struct platfo
+ 	struct nvmem_device *nvmem;
+ 	struct nvmem_config econfig = {};
+ 	struct mtk_efuse_priv *priv;
++	const struct mtk_efuse_pdata *pdata;
+ 
+ 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+ 	if (!priv)
+@@ -45,20 +82,32 @@ static int mtk_efuse_probe(struct platfo
+ 	if (IS_ERR(priv->base))
+ 		return PTR_ERR(priv->base);
+ 
++	pdata = device_get_match_data(dev);
+ 	econfig.stride = 1;
+ 	econfig.word_size = 1;
+ 	econfig.reg_read = mtk_reg_read;
+ 	econfig.size = resource_size(res);
+ 	econfig.priv = priv;
+ 	econfig.dev = dev;
++	if (pdata->uses_post_processing)
++		econfig.layout = &mtk_efuse_layout;
+ 	nvmem = devm_nvmem_register(dev, &econfig);
+ 
+ 	return PTR_ERR_OR_ZERO(nvmem);
+ }
+ 
++static const struct mtk_efuse_pdata mtk_mt8186_efuse_pdata = {
++	.uses_post_processing = true,
++};
++
++static const struct mtk_efuse_pdata mtk_efuse_pdata = {
++	.uses_post_processing = false,
++};
++
+ static const struct of_device_id mtk_efuse_of_match[] = {
+-	{ .compatible = "mediatek,mt8173-efuse",},
+-	{ .compatible = "mediatek,efuse",},
++	{ .compatible = "mediatek,mt8173-efuse", .data = &mtk_efuse_pdata },
++	{ .compatible = "mediatek,mt8186-efuse", .data = &mtk_mt8186_efuse_pdata },
++	{ .compatible = "mediatek,efuse", .data = &mtk_efuse_pdata },
+ 	{/* sentinel */},
+ };
+ MODULE_DEVICE_TABLE(of, mtk_efuse_of_match);
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0014-nvmem-bcm-ocotp-Use-devm_platform_ioremap_resource.patch b/target/linux/generic/backport-5.15/811-v6.4-0014-nvmem-bcm-ocotp-Use-devm_platform_ioremap_resource.patch
new file mode 100644
index 00000000000000..a0874f73d15c1f
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0014-nvmem-bcm-ocotp-Use-devm_platform_ioremap_resource.patch
@@ -0,0 +1,39 @@
+From 1dc552fa33cf98af3e784dbc0500da93cae3b24a Mon Sep 17 00:00:00 2001
+From: Yang Li <yang.lee@linux.alibaba.com>
+Date: Tue, 4 Apr 2023 18:21:38 +0100
+Subject: [PATCH] nvmem: bcm-ocotp: Use devm_platform_ioremap_resource()
+
+According to commit 7945f929f1a7 ("drivers: provide
+devm_platform_ioremap_resource()"), convert platform_get_resource(),
+devm_ioremap_resource() to a single call to use
+devm_platform_ioremap_resource(), as this is exactly what this function
+does.
+
+Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-31-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/bcm-ocotp.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/nvmem/bcm-ocotp.c
++++ b/drivers/nvmem/bcm-ocotp.c
+@@ -254,7 +254,6 @@ MODULE_DEVICE_TABLE(acpi, bcm_otpc_acpi_
+ static int bcm_otpc_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
+-	struct resource *res;
+ 	struct otpc_priv *priv;
+ 	struct nvmem_device *nvmem;
+ 	int err;
+@@ -269,8 +268,7 @@ static int bcm_otpc_probe(struct platfor
+ 		return -ENODEV;
+ 
+ 	/* Get OTP base address register. */
+-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	priv->base = devm_ioremap_resource(dev, res);
++	priv->base = devm_platform_ioremap_resource(pdev, 0);
+ 	if (IS_ERR(priv->base)) {
+ 		dev_err(dev, "unable to map I/O memory\n");
+ 		return PTR_ERR(priv->base);
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0015-nvmem-nintendo-otp-Use-devm_platform_ioremap_resourc.patch b/target/linux/generic/backport-5.15/811-v6.4-0015-nvmem-nintendo-otp-Use-devm_platform_ioremap_resourc.patch
new file mode 100644
index 00000000000000..890dacd08dbef8
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0015-nvmem-nintendo-otp-Use-devm_platform_ioremap_resourc.patch
@@ -0,0 +1,39 @@
+From 649409990d2e93fac657be7c6960c28a2c601d65 Mon Sep 17 00:00:00 2001
+From: Yang Li <yang.lee@linux.alibaba.com>
+Date: Tue, 4 Apr 2023 18:21:39 +0100
+Subject: [PATCH] nvmem: nintendo-otp: Use devm_platform_ioremap_resource()
+
+According to commit 7945f929f1a7 ("drivers: provide
+devm_platform_ioremap_resource()"), convert platform_get_resource(),
+devm_ioremap_resource() to a single call to use
+devm_platform_ioremap_resource(), as this is exactly what this function
+does.
+
+Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-32-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/nintendo-otp.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/nvmem/nintendo-otp.c
++++ b/drivers/nvmem/nintendo-otp.c
+@@ -76,7 +76,6 @@ static int nintendo_otp_probe(struct pla
+ 	struct device *dev = &pdev->dev;
+ 	const struct of_device_id *of_id =
+ 		of_match_device(nintendo_otp_of_table, dev);
+-	struct resource *res;
+ 	struct nvmem_device *nvmem;
+ 	struct nintendo_otp_priv *priv;
+ 
+@@ -92,8 +91,7 @@ static int nintendo_otp_probe(struct pla
+ 	if (!priv)
+ 		return -ENOMEM;
+ 
+-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	priv->regs = devm_ioremap_resource(dev, res);
++	priv->regs = devm_platform_ioremap_resource(pdev, 0);
+ 	if (IS_ERR(priv->regs))
+ 		return PTR_ERR(priv->regs);
+ 
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0016-nvmem-vf610-ocotp-Use-devm_platform_get_and_ioremap_.patch b/target/linux/generic/backport-5.15/811-v6.4-0016-nvmem-vf610-ocotp-Use-devm_platform_get_and_ioremap_.patch
new file mode 100644
index 00000000000000..3f5d3c1ad4c121
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0016-nvmem-vf610-ocotp-Use-devm_platform_get_and_ioremap_.patch
@@ -0,0 +1,32 @@
+From c2367aa60d5e34d48582362c6de34b4131d92be7 Mon Sep 17 00:00:00 2001
+From: Yang Li <yang.lee@linux.alibaba.com>
+Date: Tue, 4 Apr 2023 18:21:40 +0100
+Subject: [PATCH] nvmem: vf610-ocotp: Use
+ devm_platform_get_and_ioremap_resource()
+
+According to commit 890cc39a8799 ("drivers: provide
+devm_platform_get_and_ioremap_resource()"), convert
+platform_get_resource(), devm_ioremap_resource() to a single
+call to devm_platform_get_and_ioremap_resource(), as this is exactly
+what this function does.
+
+Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-33-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/vf610-ocotp.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/nvmem/vf610-ocotp.c
++++ b/drivers/nvmem/vf610-ocotp.c
+@@ -219,8 +219,7 @@ static int vf610_ocotp_probe(struct plat
+ 	if (!ocotp_dev)
+ 		return -ENOMEM;
+ 
+-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	ocotp_dev->base = devm_ioremap_resource(dev, res);
++	ocotp_dev->base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
+ 	if (IS_ERR(ocotp_dev->base))
+ 		return PTR_ERR(ocotp_dev->base);
+ 
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0017-nvmem-core-support-specifying-both-cell-raw-data-pos.patch b/target/linux/generic/backport-5.15/811-v6.4-0017-nvmem-core-support-specifying-both-cell-raw-data-pos.patch
new file mode 100644
index 00000000000000..eeb407e9bb664c
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0017-nvmem-core-support-specifying-both-cell-raw-data-pos.patch
@@ -0,0 +1,115 @@
+From 55d4980ce55b6bb4be66877de4dbec513911b988 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 4 Apr 2023 18:21:42 +0100
+Subject: [PATCH] nvmem: core: support specifying both: cell raw data & post
+ read lengths
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Callback .read_post_process() is designed to modify raw cell content
+before providing it to the consumer. So far we were dealing with
+modifications that didn't affect cell size (length). In some cases
+however cell content needs to be reformatted and resized.
+
+It's required e.g. to provide properly formatted MAC address in case
+it's stored in a non-binary format (e.g. using ASCII).
+
+There were few discussions how to optimally handle that. Following
+possible solutions were considered:
+1. Allow .read_post_process() to realloc (resize) content buffer
+2. Allow .read_post_process() to adjust (decrease) just buffer length
+3. Register NVMEM cells using post-read sizes
+
+The preferred solution was the last one. The problem is that simply
+adjusting "bytes" in NVMEM providers would result in core code NOT
+passing whole raw data to .read_post_process() callbacks. It means
+callback functions couldn't do their job without somehow manually
+reading original cell content on their own.
+
+This patch deals with that by registering NVMEM cells with both lengths:
+raw content one and post read one. It allows:
+1. Core code to read whole raw cell content
+2. Callbacks to return content they want
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-35-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c           | 11 +++++++----
+ include/linux/nvmem-provider.h |  2 ++
+ 2 files changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -50,6 +50,7 @@ struct nvmem_device {
+ struct nvmem_cell_entry {
+ 	const char		*name;
+ 	int			offset;
++	size_t			raw_len;
+ 	int			bytes;
+ 	int			bit_offset;
+ 	int			nbits;
+@@ -469,6 +470,7 @@ static int nvmem_cell_info_to_nvmem_cell
+ {
+ 	cell->nvmem = nvmem;
+ 	cell->offset = info->offset;
++	cell->raw_len = info->raw_len ?: info->bytes;
+ 	cell->bytes = info->bytes;
+ 	cell->name = info->name;
+ 	cell->read_post_process = info->read_post_process;
+@@ -1560,7 +1562,7 @@ static int __nvmem_cell_read(struct nvme
+ {
+ 	int rc;
+ 
+-	rc = nvmem_reg_read(nvmem, cell->offset, buf, cell->bytes);
++	rc = nvmem_reg_read(nvmem, cell->offset, buf, cell->raw_len);
+ 
+ 	if (rc)
+ 		return rc;
+@@ -1571,7 +1573,7 @@ static int __nvmem_cell_read(struct nvme
+ 
+ 	if (cell->read_post_process) {
+ 		rc = cell->read_post_process(cell->priv, id, index,
+-					     cell->offset, buf, cell->bytes);
++					     cell->offset, buf, cell->raw_len);
+ 		if (rc)
+ 			return rc;
+ 	}
+@@ -1594,14 +1596,15 @@ static int __nvmem_cell_read(struct nvme
+  */
+ void *nvmem_cell_read(struct nvmem_cell *cell, size_t *len)
+ {
+-	struct nvmem_device *nvmem = cell->entry->nvmem;
++	struct nvmem_cell_entry *entry = cell->entry;
++	struct nvmem_device *nvmem = entry->nvmem;
+ 	u8 *buf;
+ 	int rc;
+ 
+ 	if (!nvmem)
+ 		return ERR_PTR(-EINVAL);
+ 
+-	buf = kzalloc(cell->entry->bytes, GFP_KERNEL);
++	buf = kzalloc(max_t(size_t, entry->raw_len, entry->bytes), GFP_KERNEL);
+ 	if (!buf)
+ 		return ERR_PTR(-ENOMEM);
+ 
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -51,6 +51,7 @@ struct nvmem_keepout {
+  * struct nvmem_cell_info - NVMEM cell description
+  * @name:	Name.
+  * @offset:	Offset within the NVMEM device.
++ * @raw_len:	Length of raw data (without post processing).
+  * @bytes:	Length of the cell.
+  * @bit_offset:	Bit offset if cell is smaller than a byte.
+  * @nbits:	Number of bits.
+@@ -62,6 +63,7 @@ struct nvmem_keepout {
+ struct nvmem_cell_info {
+ 	const char		*name;
+ 	unsigned int		offset;
++	size_t			raw_len;
+ 	unsigned int		bytes;
+ 	unsigned int		bit_offset;
+ 	unsigned int		nbits;
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0018-nvmem-u-boot-env-post-process-ethaddr-env-variable.patch b/target/linux/generic/backport-5.15/811-v6.4-0018-nvmem-u-boot-env-post-process-ethaddr-env-variable.patch
new file mode 100644
index 00000000000000..adde0ffc4b1786
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0018-nvmem-u-boot-env-post-process-ethaddr-env-variable.patch
@@ -0,0 +1,81 @@
+From c49f1a8af6bcf6d18576bca898f8083ca4b129e1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 4 Apr 2023 18:21:43 +0100
+Subject: [PATCH] nvmem: u-boot-env: post-process "ethaddr" env variable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+U-Boot environment variables are stored in ASCII format so "ethaddr"
+requires parsing into binary to make it work with Ethernet interfaces.
+
+This includes support for indexes to support #nvmem-cell-cells = <1>.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-36-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/Kconfig      |  1 +
+ drivers/nvmem/u-boot-env.c | 26 ++++++++++++++++++++++++++
+ 2 files changed, 27 insertions(+)
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -340,6 +340,7 @@ config NVMEM_U_BOOT_ENV
+ 	tristate "U-Boot environment variables support"
+ 	depends on OF && MTD
+ 	select CRC32
++	select GENERIC_NET_UTILS
+ 	help
+ 	  U-Boot stores its setup as environment variables. This driver adds
+ 	  support for verifying & exporting such data. It also exposes variables
+--- a/drivers/nvmem/u-boot-env.c
++++ b/drivers/nvmem/u-boot-env.c
+@@ -4,6 +4,8 @@
+  */
+ 
+ #include <linux/crc32.h>
++#include <linux/etherdevice.h>
++#include <linux/if_ether.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/module.h>
+ #include <linux/mtd/mtd.h>
+@@ -70,6 +72,25 @@ static int u_boot_env_read(void *context
+ 	return 0;
+ }
+ 
++static int u_boot_env_read_post_process_ethaddr(void *context, const char *id, int index,
++						unsigned int offset, void *buf, size_t bytes)
++{
++	u8 mac[ETH_ALEN];
++
++	if (bytes != 3 * ETH_ALEN - 1)
++		return -EINVAL;
++
++	if (!mac_pton(buf, mac))
++		return -EINVAL;
++
++	if (index)
++		eth_addr_add(mac, index);
++
++	ether_addr_copy(buf, mac);
++
++	return 0;
++}
++
+ static int u_boot_env_add_cells(struct u_boot_env *priv, uint8_t *buf,
+ 				size_t data_offset, size_t data_len)
+ {
+@@ -101,6 +122,11 @@ static int u_boot_env_add_cells(struct u
+ 		priv->cells[idx].offset = data_offset + value - data;
+ 		priv->cells[idx].bytes = strlen(value);
+ 		priv->cells[idx].np = of_get_child_by_name(dev->of_node, priv->cells[idx].name);
++		if (!strcmp(var, "ethaddr")) {
++			priv->cells[idx].raw_len = strlen(value);
++			priv->cells[idx].bytes = ETH_ALEN;
++			priv->cells[idx].read_post_process = u_boot_env_read_post_process_ethaddr;
++		}
+ 	}
+ 
+ 	if (WARN_ON(idx != priv->ncells))
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0019-nvmem-Add-macro-to-register-nvmem-layout-drivers.patch b/target/linux/generic/backport-5.15/811-v6.4-0019-nvmem-Add-macro-to-register-nvmem-layout-drivers.patch
new file mode 100644
index 00000000000000..7c6fe22b5f3a69
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0019-nvmem-Add-macro-to-register-nvmem-layout-drivers.patch
@@ -0,0 +1,42 @@
+From 814c978f02db17f16e6aa2efa2a929372f06da09 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:44 +0100
+Subject: [PATCH] nvmem: Add macro to register nvmem layout drivers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Provide a module_nvmem_layout_driver() macro at the end of the
+nvmem-provider.h header to reduce the boilerplate when registering nvmem
+layout drivers.
+
+Suggested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Acked-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-37-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/nvmem-provider.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -9,6 +9,7 @@
+ #ifndef _LINUX_NVMEM_PROVIDER_H
+ #define _LINUX_NVMEM_PROVIDER_H
+ 
++#include <linux/device/driver.h>
+ #include <linux/err.h>
+ #include <linux/errno.h>
+ #include <linux/gpio/consumer.h>
+@@ -242,4 +243,9 @@ nvmem_layout_get_match_data(struct nvmem
+ }
+ 
+ #endif /* CONFIG_NVMEM */
++
++#define module_nvmem_layout_driver(__layout_driver)		\
++	module_driver(__layout_driver, nvmem_layout_register,	\
++		      nvmem_layout_unregister)
++
+ #endif  /* ifndef _LINUX_NVMEM_PROVIDER_H */
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0020-nvmem-layouts-sl28vpd-Use-module_nvmem_layout_driver.patch b/target/linux/generic/backport-5.15/811-v6.4-0020-nvmem-layouts-sl28vpd-Use-module_nvmem_layout_driver.patch
new file mode 100644
index 00000000000000..06646dd68bf67b
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0020-nvmem-layouts-sl28vpd-Use-module_nvmem_layout_driver.patch
@@ -0,0 +1,39 @@
+From 0abdf99fe0c86252ba274703425f8d543d7e7f0d Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:45 +0100
+Subject: [PATCH] nvmem: layouts: sl28vpd: Use module_nvmem_layout_driver()
+
+Stop open-coding the module init/exit functions. Use the
+module_nvmem_layout_driver() instead.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-38-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/layouts/sl28vpd.c | 14 +-------------
+ 1 file changed, 1 insertion(+), 13 deletions(-)
+
+--- a/drivers/nvmem/layouts/sl28vpd.c
++++ b/drivers/nvmem/layouts/sl28vpd.c
+@@ -146,19 +146,7 @@ struct nvmem_layout sl28vpd_layout = {
+ 	.of_match_table = sl28vpd_of_match_table,
+ 	.add_cells = sl28vpd_add_cells,
+ };
+-
+-static int __init sl28vpd_init(void)
+-{
+-	return nvmem_layout_register(&sl28vpd_layout);
+-}
+-
+-static void __exit sl28vpd_exit(void)
+-{
+-	nvmem_layout_unregister(&sl28vpd_layout);
+-}
+-
+-module_init(sl28vpd_init);
+-module_exit(sl28vpd_exit);
++module_nvmem_layout_driver(sl28vpd_layout);
+ 
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Michael Walle <michael@walle.cc>");
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0021-nvmem-layouts-onie-tlv-Use-module_nvmem_layout_drive.patch b/target/linux/generic/backport-5.15/811-v6.4-0021-nvmem-layouts-onie-tlv-Use-module_nvmem_layout_drive.patch
new file mode 100644
index 00000000000000..826f4378c2fabf
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0021-nvmem-layouts-onie-tlv-Use-module_nvmem_layout_drive.patch
@@ -0,0 +1,39 @@
+From d119eb38faab61125aaa4f63c74eef61585cf34c Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:46 +0100
+Subject: [PATCH] nvmem: layouts: onie-tlv: Use module_nvmem_layout_driver()
+
+Stop open-coding the module init/exit functions. Use the
+module_nvmem_layout_driver() instead.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-39-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/layouts/onie-tlv.c | 14 +-------------
+ 1 file changed, 1 insertion(+), 13 deletions(-)
+
+--- a/drivers/nvmem/layouts/onie-tlv.c
++++ b/drivers/nvmem/layouts/onie-tlv.c
+@@ -237,19 +237,7 @@ static struct nvmem_layout onie_tlv_layo
+ 	.of_match_table = onie_tlv_of_match_table,
+ 	.add_cells = onie_tlv_parse_table,
+ };
+-
+-static int __init onie_tlv_init(void)
+-{
+-	return nvmem_layout_register(&onie_tlv_layout);
+-}
+-
+-static void __exit onie_tlv_exit(void)
+-{
+-	nvmem_layout_unregister(&onie_tlv_layout);
+-}
+-
+-module_init(onie_tlv_init);
+-module_exit(onie_tlv_exit);
++module_nvmem_layout_driver(onie_tlv_layout);
+ 
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Miquel Raynal <miquel.raynal@bootlin.com>");
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0022-nvmem-layouts-onie-tlv-Drop-wrong-module-alias.patch b/target/linux/generic/backport-5.15/811-v6.4-0022-nvmem-layouts-onie-tlv-Drop-wrong-module-alias.patch
new file mode 100644
index 00000000000000..f20db85ceb6ff6
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0022-nvmem-layouts-onie-tlv-Drop-wrong-module-alias.patch
@@ -0,0 +1,24 @@
+From 6b13e4b6a9a45028ac730e550380077df1845912 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:47 +0100
+Subject: [PATCH] nvmem: layouts: onie-tlv: Drop wrong module alias
+
+The MODULE_ALIAS macro is misused here as it carries the
+description. There is currently no relevant alias to provide so let's
+just drop it.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-40-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/layouts/onie-tlv.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/nvmem/layouts/onie-tlv.c
++++ b/drivers/nvmem/layouts/onie-tlv.c
+@@ -242,4 +242,3 @@ module_nvmem_layout_driver(onie_tlv_layo
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Miquel Raynal <miquel.raynal@bootlin.com>");
+ MODULE_DESCRIPTION("NVMEM layout driver for Onie TLV table parsing");
+-MODULE_ALIAS("NVMEM layout driver for Onie TLV table parsing");
diff --git a/target/linux/generic/backport-5.15/811-v6.4-0023-nvmem-layouts-sl28vpd-set-varaiable-sl28vpd_layout-s.patch b/target/linux/generic/backport-5.15/811-v6.4-0023-nvmem-layouts-sl28vpd-set-varaiable-sl28vpd_layout-s.patch
new file mode 100644
index 00000000000000..5cf847b57ae130
--- /dev/null
+++ b/target/linux/generic/backport-5.15/811-v6.4-0023-nvmem-layouts-sl28vpd-set-varaiable-sl28vpd_layout-s.patch
@@ -0,0 +1,31 @@
+From a8642cd11635a35a5f1dc31857887900d6610778 Mon Sep 17 00:00:00 2001
+From: Tom Rix <trix@redhat.com>
+Date: Tue, 4 Apr 2023 18:21:48 +0100
+Subject: [PATCH] nvmem: layouts: sl28vpd: set varaiable sl28vpd_layout
+ storage-class-specifier to static
+
+smatch reports
+drivers/nvmem/layouts/sl28vpd.c:144:21: warning: symbol
+  'sl28vpd_layout' was not declared. Should it be static?
+
+This variable is only used in one file so it should be static.
+
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-41-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/layouts/sl28vpd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/layouts/sl28vpd.c
++++ b/drivers/nvmem/layouts/sl28vpd.c
+@@ -141,7 +141,7 @@ static const struct of_device_id sl28vpd
+ };
+ MODULE_DEVICE_TABLE(of, sl28vpd_of_match_table);
+ 
+-struct nvmem_layout sl28vpd_layout = {
++static struct nvmem_layout sl28vpd_layout = {
+ 	.name = "sl28-vpd",
+ 	.of_match_table = sl28vpd_of_match_table,
+ 	.add_cells = sl28vpd_add_cells,
diff --git a/target/linux/generic/backport-5.15/812-v6.2-firmware-nvram-bcm47xx-support-init-from-IO-memory.patch b/target/linux/generic/backport-5.15/812-v6.2-firmware-nvram-bcm47xx-support-init-from-IO-memory.patch
new file mode 100644
index 00000000000000..13ee2d42293f91
--- /dev/null
+++ b/target/linux/generic/backport-5.15/812-v6.2-firmware-nvram-bcm47xx-support-init-from-IO-memory.patch
@@ -0,0 +1,100 @@
+From a5be5ce0e25439fae3cd42e3d775979547926812 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 3 Nov 2022 09:25:29 +0100
+Subject: [PATCH] firmware/nvram: bcm47xx: support init from IO memory
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Provide NVMEM content to the NVRAM driver from a simple
+memory resource. This is necessary to use NVRAM in a memory-
+mapped flash device. Patch taken from OpenWrts development
+tree.
+
+This patch makes it possible to use memory-mapped NVRAM
+on the D-Link DWL-8610AP and the D-Link DIR-890L.
+
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: linux-mips@vger.kernel.org
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Cc: bcm-kernel-feedback-list@broadcom.com
+Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+[Added an export for modules potentially using the init symbol]
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20221103082529.359084-1-linus.walleij@linaro.org
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ drivers/firmware/broadcom/bcm47xx_nvram.c | 18 ++++++++++++++++++
+ drivers/nvmem/brcm_nvram.c                |  3 +++
+ include/linux/bcm47xx_nvram.h             |  6 ++++++
+ 3 files changed, 27 insertions(+)
+
+--- a/drivers/firmware/broadcom/bcm47xx_nvram.c
++++ b/drivers/firmware/broadcom/bcm47xx_nvram.c
+@@ -110,6 +110,24 @@ found:
+ 	return 0;
+ }
+ 
++int bcm47xx_nvram_init_from_iomem(void __iomem *nvram_start, size_t res_size)
++{
++	if (nvram_len) {
++		pr_warn("nvram already initialized\n");
++		return -EEXIST;
++	}
++
++	if (!bcm47xx_nvram_is_valid(nvram_start)) {
++		pr_err("No valid NVRAM found\n");
++		return -ENOENT;
++	}
++
++	bcm47xx_nvram_copy(nvram_start, res_size);
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(bcm47xx_nvram_init_from_iomem);
++
+ /*
+  * On bcm47xx we need access to the NVRAM very early, so we can't use mtd
+  * subsystem to access flash. We can't even use platform device / driver to
+--- a/drivers/nvmem/brcm_nvram.c
++++ b/drivers/nvmem/brcm_nvram.c
+@@ -3,6 +3,7 @@
+  * Copyright (C) 2021 Rafał Miłecki <rafal@milecki.pl>
+  */
+ 
++#include <linux/bcm47xx_nvram.h>
+ #include <linux/io.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/module.h>
+@@ -139,6 +140,8 @@ static int brcm_nvram_probe(struct platf
+ 	if (err)
+ 		return err;
+ 
++	bcm47xx_nvram_init_from_iomem(priv->base, resource_size(res));
++
+ 	config.dev = dev;
+ 	config.cells = priv->cells;
+ 	config.ncells = priv->ncells;
+--- a/include/linux/bcm47xx_nvram.h
++++ b/include/linux/bcm47xx_nvram.h
+@@ -11,6 +11,7 @@
+ #include <linux/vmalloc.h>
+ 
+ #ifdef CONFIG_BCM47XX_NVRAM
++int bcm47xx_nvram_init_from_iomem(void __iomem *nvram_start, size_t res_size);
+ int bcm47xx_nvram_init_from_mem(u32 base, u32 lim);
+ int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len);
+ int bcm47xx_nvram_gpio_pin(const char *name);
+@@ -20,6 +21,11 @@ static inline void bcm47xx_nvram_release
+ 	vfree(nvram);
+ };
+ #else
++static inline int bcm47xx_nvram_init_from_iomem(void __iomem *nvram_start,
++						size_t res_size)
++{
++	return -ENOTSUPP;
++}
+ static inline int bcm47xx_nvram_init_from_mem(u32 base, u32 lim)
+ {
+ 	return -ENOTSUPP;
diff --git a/target/linux/generic/backport-5.15/813-v6.5-0001-nvmem-imx-ocotp-set-varaiable-imx_ocotp_layout-stora.patch b/target/linux/generic/backport-5.15/813-v6.5-0001-nvmem-imx-ocotp-set-varaiable-imx_ocotp_layout-stora.patch
new file mode 100644
index 00000000000000..38cfccd5ef9b29
--- /dev/null
+++ b/target/linux/generic/backport-5.15/813-v6.5-0001-nvmem-imx-ocotp-set-varaiable-imx_ocotp_layout-stora.patch
@@ -0,0 +1,31 @@
+From eebc6573ad940b62a87776db3917e912b4f52d78 Mon Sep 17 00:00:00 2001
+From: Tom Rix <trix@redhat.com>
+Date: Sun, 11 Jun 2023 15:03:05 +0100
+Subject: [PATCH] nvmem: imx-ocotp: set varaiable imx_ocotp_layout
+ storage-class-specifier to static
+
+smatch reports
+drivers/nvmem/imx-ocotp.c:599:21: warning: symbol
+  'imx_ocotp_layout' was not declared. Should it be static?
+
+This variable is only used in one file so should be static.
+
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-2-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/imx-ocotp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/imx-ocotp.c
++++ b/drivers/nvmem/imx-ocotp.c
+@@ -596,7 +596,7 @@ static void imx_ocotp_fixup_cell_info(st
+ 	cell->read_post_process = imx_ocotp_cell_pp;
+ }
+ 
+-struct nvmem_layout imx_ocotp_layout = {
++static struct nvmem_layout imx_ocotp_layout = {
+ 	.fixup_cell_info = imx_ocotp_fixup_cell_info,
+ };
+ 
diff --git a/target/linux/generic/backport-5.15/813-v6.5-0002-nvmem-imx-ocotp-Reverse-MAC-addresses-on-all-i.MX-de.patch b/target/linux/generic/backport-5.15/813-v6.5-0002-nvmem-imx-ocotp-Reverse-MAC-addresses-on-all-i.MX-de.patch
new file mode 100644
index 00000000000000..7523e5ebf645a7
--- /dev/null
+++ b/target/linux/generic/backport-5.15/813-v6.5-0002-nvmem-imx-ocotp-Reverse-MAC-addresses-on-all-i.MX-de.patch
@@ -0,0 +1,71 @@
+From 8a00fc606312c68b98add8fe8e6f7a013ce29e78 Mon Sep 17 00:00:00 2001
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+Date: Sun, 11 Jun 2023 15:03:06 +0100
+Subject: [PATCH] nvmem: imx-ocotp: Reverse MAC addresses on all i.MX derivates
+
+Not just i.MX8M, but all i.MX6/7 (and subtypes) need to reverse the
+MAC address read from fuses. Exceptions are i.MX6SLL and i.MX7ULP which
+do not support ethernet at all.
+
+Fixes: d0221a780cbc ("nvmem: imx-ocotp: add support for post processing")
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Tested-by: Richard Leitner <richard.leitner@skidata.com> # imx6q
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-3-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/imx-ocotp.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/drivers/nvmem/imx-ocotp.c
++++ b/drivers/nvmem/imx-ocotp.c
+@@ -97,7 +97,6 @@ struct ocotp_params {
+ 	unsigned int bank_address_words;
+ 	void (*set_timing)(struct ocotp_priv *priv);
+ 	struct ocotp_ctrl_reg ctrl;
+-	bool reverse_mac_address;
+ };
+ 
+ static int imx_ocotp_wait_for_busy(struct ocotp_priv *priv, u32 flags)
+@@ -545,7 +544,6 @@ static const struct ocotp_params imx8mq_
+ 	.bank_address_words = 0,
+ 	.set_timing = imx_ocotp_set_imx6_timing,
+ 	.ctrl = IMX_OCOTP_BM_CTRL_DEFAULT,
+-	.reverse_mac_address = true,
+ };
+ 
+ static const struct ocotp_params imx8mm_params = {
+@@ -553,7 +551,6 @@ static const struct ocotp_params imx8mm_
+ 	.bank_address_words = 0,
+ 	.set_timing = imx_ocotp_set_imx6_timing,
+ 	.ctrl = IMX_OCOTP_BM_CTRL_DEFAULT,
+-	.reverse_mac_address = true,
+ };
+ 
+ static const struct ocotp_params imx8mn_params = {
+@@ -561,7 +558,6 @@ static const struct ocotp_params imx8mn_
+ 	.bank_address_words = 0,
+ 	.set_timing = imx_ocotp_set_imx6_timing,
+ 	.ctrl = IMX_OCOTP_BM_CTRL_DEFAULT,
+-	.reverse_mac_address = true,
+ };
+ 
+ static const struct ocotp_params imx8mp_params = {
+@@ -569,7 +565,6 @@ static const struct ocotp_params imx8mp_
+ 	.bank_address_words = 0,
+ 	.set_timing = imx_ocotp_set_imx6_timing,
+ 	.ctrl = IMX_OCOTP_BM_CTRL_8MP,
+-	.reverse_mac_address = true,
+ };
+ 
+ static const struct of_device_id imx_ocotp_dt_ids[] = {
+@@ -624,8 +619,7 @@ static int imx_ocotp_probe(struct platfo
+ 	imx_ocotp_nvmem_config.size = 4 * priv->params->nregs;
+ 	imx_ocotp_nvmem_config.dev = dev;
+ 	imx_ocotp_nvmem_config.priv = priv;
+-	if (priv->params->reverse_mac_address)
+-		imx_ocotp_nvmem_config.layout = &imx_ocotp_layout;
++	imx_ocotp_nvmem_config.layout = &imx_ocotp_layout;
+ 
+ 	priv->config = &imx_ocotp_nvmem_config;
+ 
diff --git a/target/linux/generic/backport-5.15/813-v6.5-0003-nvmem-brcm_nvram-add-.read_post_process-for-MACs.patch b/target/linux/generic/backport-5.15/813-v6.5-0003-nvmem-brcm_nvram-add-.read_post_process-for-MACs.patch
new file mode 100644
index 00000000000000..fb4d346a95add1
--- /dev/null
+++ b/target/linux/generic/backport-5.15/813-v6.5-0003-nvmem-brcm_nvram-add-.read_post_process-for-MACs.patch
@@ -0,0 +1,81 @@
+From 73bcd133c910bff3b6d3b3834d0d14be9444e90a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Sun, 11 Jun 2023 15:03:08 +0100
+Subject: [PATCH] nvmem: brcm_nvram: add .read_post_process() for MACs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+1. Parse ASCII MAC format into byte based
+2. Calculate relative addresses based on index argument
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-5-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/Kconfig      |  1 +
+ drivers/nvmem/brcm_nvram.c | 28 ++++++++++++++++++++++++++++
+ 2 files changed, 29 insertions(+)
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -55,6 +55,7 @@ config NVMEM_BRCM_NVRAM
+ 	tristate "Broadcom's NVRAM support"
+ 	depends on ARCH_BCM_5301X || COMPILE_TEST
+ 	depends on HAS_IOMEM
++	select GENERIC_NET_UTILS
+ 	help
+ 	  This driver provides support for Broadcom's NVRAM that can be accessed
+ 	  using I/O mapping.
+--- a/drivers/nvmem/brcm_nvram.c
++++ b/drivers/nvmem/brcm_nvram.c
+@@ -4,6 +4,8 @@
+  */
+ 
+ #include <linux/bcm47xx_nvram.h>
++#include <linux/etherdevice.h>
++#include <linux/if_ether.h>
+ #include <linux/io.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/module.h>
+@@ -42,6 +44,25 @@ static int brcm_nvram_read(void *context
+ 	return 0;
+ }
+ 
++static int brcm_nvram_read_post_process_macaddr(void *context, const char *id, int index,
++						unsigned int offset, void *buf, size_t bytes)
++{
++	u8 mac[ETH_ALEN];
++
++	if (bytes != 3 * ETH_ALEN - 1)
++		return -EINVAL;
++
++	if (!mac_pton(buf, mac))
++		return -EINVAL;
++
++	if (index)
++		eth_addr_add(mac, index);
++
++	ether_addr_copy(buf, mac);
++
++	return 0;
++}
++
+ static int brcm_nvram_add_cells(struct brcm_nvram *priv, uint8_t *data,
+ 				size_t len)
+ {
+@@ -75,6 +96,13 @@ static int brcm_nvram_add_cells(struct b
+ 		priv->cells[idx].offset = value - (char *)data;
+ 		priv->cells[idx].bytes = strlen(value);
+ 		priv->cells[idx].np = of_get_child_by_name(dev->of_node, priv->cells[idx].name);
++		if (!strcmp(var, "et0macaddr") ||
++		    !strcmp(var, "et1macaddr") ||
++		    !strcmp(var, "et2macaddr")) {
++			priv->cells[idx].raw_len = strlen(value);
++			priv->cells[idx].bytes = ETH_ALEN;
++			priv->cells[idx].read_post_process = brcm_nvram_read_post_process_macaddr;
++		}
+ 	}
+ 
+ 	return 0;
diff --git a/target/linux/generic/backport-5.15/813-v6.5-0004-nvmem-rockchip-otp-Add-clks-and-reg_read-to-rockchip.patch b/target/linux/generic/backport-5.15/813-v6.5-0004-nvmem-rockchip-otp-Add-clks-and-reg_read-to-rockchip.patch
new file mode 100644
index 00000000000000..3b6e6e57f52b44
--- /dev/null
+++ b/target/linux/generic/backport-5.15/813-v6.5-0004-nvmem-rockchip-otp-Add-clks-and-reg_read-to-rockchip.patch
@@ -0,0 +1,166 @@
+From 8dc61364164e79e44c07fa2ac0a7b6939f00d5db Mon Sep 17 00:00:00 2001
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Date: Sun, 11 Jun 2023 15:03:13 +0100
+Subject: [PATCH] nvmem: rockchip-otp: Add clks and reg_read to rockchip_data
+
+In preparation to support new Rockchip OTP memory devices with different
+clock configurations and register layout, extend rockchip_data struct
+with the related members: clks, num_clks, reg_read.
+
+Additionally, to avoid managing redundant driver data, drop num_clks
+member from rockchip_otp struct and update all references to point to
+the equivalent member in rockchip_data.
+
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Tested-by: Vincent Legoll <vincent.legoll@gmail.com>
+Reviewed-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-10-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/rockchip-otp.c | 79 ++++++++++++++++++++++--------------
+ 1 file changed, 49 insertions(+), 30 deletions(-)
+
+--- a/drivers/nvmem/rockchip-otp.c
++++ b/drivers/nvmem/rockchip-otp.c
+@@ -54,21 +54,19 @@
+ 
+ #define OTPC_TIMEOUT			10000
+ 
++struct rockchip_data {
++	int size;
++	const char * const *clks;
++	int num_clks;
++	nvmem_reg_read_t reg_read;
++};
++
+ struct rockchip_otp {
+ 	struct device *dev;
+ 	void __iomem *base;
+-	struct clk_bulk_data	*clks;
+-	int num_clks;
++	struct clk_bulk_data *clks;
+ 	struct reset_control *rst;
+-};
+-
+-/* list of required clocks */
+-static const char * const rockchip_otp_clocks[] = {
+-	"otp", "apb_pclk", "phy",
+-};
+-
+-struct rockchip_data {
+-	int size;
++	const struct rockchip_data *data;
+ };
+ 
+ static int rockchip_otp_reset(struct rockchip_otp *otp)
+@@ -132,29 +130,23 @@ static int rockchip_otp_ecc_enable(struc
+ 	return ret;
+ }
+ 
+-static int rockchip_otp_read(void *context, unsigned int offset,
+-			     void *val, size_t bytes)
++static int px30_otp_read(void *context, unsigned int offset,
++			 void *val, size_t bytes)
+ {
+ 	struct rockchip_otp *otp = context;
+ 	u8 *buf = val;
+-	int ret = 0;
+-
+-	ret = clk_bulk_prepare_enable(otp->num_clks, otp->clks);
+-	if (ret < 0) {
+-		dev_err(otp->dev, "failed to prepare/enable clks\n");
+-		return ret;
+-	}
++	int ret;
+ 
+ 	ret = rockchip_otp_reset(otp);
+ 	if (ret) {
+ 		dev_err(otp->dev, "failed to reset otp phy\n");
+-		goto disable_clks;
++		return ret;
+ 	}
+ 
+ 	ret = rockchip_otp_ecc_enable(otp, false);
+ 	if (ret < 0) {
+ 		dev_err(otp->dev, "rockchip_otp_ecc_enable err\n");
+-		goto disable_clks;
++		return ret;
+ 	}
+ 
+ 	writel(OTPC_USE_USER | OTPC_USE_USER_MASK, otp->base + OTPC_USER_CTRL);
+@@ -174,8 +166,28 @@ static int rockchip_otp_read(void *conte
+ 
+ read_end:
+ 	writel(0x0 | OTPC_USE_USER_MASK, otp->base + OTPC_USER_CTRL);
+-disable_clks:
+-	clk_bulk_disable_unprepare(otp->num_clks, otp->clks);
++
++	return ret;
++}
++
++static int rockchip_otp_read(void *context, unsigned int offset,
++			     void *val, size_t bytes)
++{
++	struct rockchip_otp *otp = context;
++	int ret;
++
++	if (!otp->data || !otp->data->reg_read)
++		return -EINVAL;
++
++	ret = clk_bulk_prepare_enable(otp->data->num_clks, otp->clks);
++	if (ret < 0) {
++		dev_err(otp->dev, "failed to prepare/enable clks\n");
++		return ret;
++	}
++
++	ret = otp->data->reg_read(context, offset, val, bytes);
++
++	clk_bulk_disable_unprepare(otp->data->num_clks, otp->clks);
+ 
+ 	return ret;
+ }
+@@ -189,8 +201,15 @@ static struct nvmem_config otp_config =
+ 	.reg_read = rockchip_otp_read,
+ };
+ 
++static const char * const px30_otp_clocks[] = {
++	"otp", "apb_pclk", "phy",
++};
++
+ static const struct rockchip_data px30_data = {
+ 	.size = 0x40,
++	.clks = px30_otp_clocks,
++	.num_clks = ARRAY_SIZE(px30_otp_clocks),
++	.reg_read = px30_otp_read,
+ };
+ 
+ static const struct of_device_id rockchip_otp_match[] = {
+@@ -225,21 +244,21 @@ static int rockchip_otp_probe(struct pla
+ 	if (!otp)
+ 		return -ENOMEM;
+ 
++	otp->data = data;
+ 	otp->dev = dev;
+ 	otp->base = devm_platform_ioremap_resource(pdev, 0);
+ 	if (IS_ERR(otp->base))
+ 		return PTR_ERR(otp->base);
+ 
+-	otp->num_clks = ARRAY_SIZE(rockchip_otp_clocks);
+-	otp->clks = devm_kcalloc(dev, otp->num_clks,
+-				     sizeof(*otp->clks), GFP_KERNEL);
++	otp->clks = devm_kcalloc(dev, data->num_clks, sizeof(*otp->clks),
++				 GFP_KERNEL);
+ 	if (!otp->clks)
+ 		return -ENOMEM;
+ 
+-	for (i = 0; i < otp->num_clks; ++i)
+-		otp->clks[i].id = rockchip_otp_clocks[i];
++	for (i = 0; i < data->num_clks; ++i)
++		otp->clks[i].id = data->clks[i];
+ 
+-	ret = devm_clk_bulk_get(dev, otp->num_clks, otp->clks);
++	ret = devm_clk_bulk_get(dev, data->num_clks, otp->clks);
+ 	if (ret)
+ 		return ret;
+ 
diff --git a/target/linux/generic/backport-5.15/813-v6.5-0005-nvmem-rockchip-otp-Generalize-rockchip_otp_wait_stat.patch b/target/linux/generic/backport-5.15/813-v6.5-0005-nvmem-rockchip-otp-Generalize-rockchip_otp_wait_stat.patch
new file mode 100644
index 00000000000000..b5b66cfc5ac0d1
--- /dev/null
+++ b/target/linux/generic/backport-5.15/813-v6.5-0005-nvmem-rockchip-otp-Generalize-rockchip_otp_wait_stat.patch
@@ -0,0 +1,62 @@
+From 30fd21cfb1e64ef20035559a8246f5fbf682c40e Mon Sep 17 00:00:00 2001
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Date: Sun, 11 Jun 2023 15:03:14 +0100
+Subject: [PATCH] nvmem: rockchip-otp: Generalize rockchip_otp_wait_status()
+
+In preparation to support additional Rockchip OTP memory devices with
+different register layout, generalize rockchip_otp_wait_status() to
+accept a new parameter for specifying the offset of the status register.
+
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Tested-by: Vincent Legoll <vincent.legoll@gmail.com>
+Reviewed-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-11-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/rockchip-otp.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/nvmem/rockchip-otp.c
++++ b/drivers/nvmem/rockchip-otp.c
+@@ -90,18 +90,19 @@ static int rockchip_otp_reset(struct roc
+ 	return 0;
+ }
+ 
+-static int rockchip_otp_wait_status(struct rockchip_otp *otp, u32 flag)
++static int rockchip_otp_wait_status(struct rockchip_otp *otp,
++				    unsigned int reg, u32 flag)
+ {
+ 	u32 status = 0;
+ 	int ret;
+ 
+-	ret = readl_poll_timeout_atomic(otp->base + OTPC_INT_STATUS, status,
++	ret = readl_poll_timeout_atomic(otp->base + reg, status,
+ 					(status & flag), 1, OTPC_TIMEOUT);
+ 	if (ret)
+ 		return ret;
+ 
+ 	/* clean int status */
+-	writel(flag, otp->base + OTPC_INT_STATUS);
++	writel(flag, otp->base + reg);
+ 
+ 	return 0;
+ }
+@@ -123,7 +124,7 @@ static int rockchip_otp_ecc_enable(struc
+ 
+ 	writel(SBPI_ENABLE_MASK | SBPI_ENABLE, otp->base + OTPC_SBPI_CTRL);
+ 
+-	ret = rockchip_otp_wait_status(otp, OTPC_SBPI_DONE);
++	ret = rockchip_otp_wait_status(otp, OTPC_INT_STATUS, OTPC_SBPI_DONE);
+ 	if (ret < 0)
+ 		dev_err(otp->dev, "timeout during ecc_enable\n");
+ 
+@@ -156,7 +157,7 @@ static int px30_otp_read(void *context,
+ 		       otp->base + OTPC_USER_ADDR);
+ 		writel(OTPC_USER_FSM_ENABLE | OTPC_USER_FSM_ENABLE_MASK,
+ 		       otp->base + OTPC_USER_ENABLE);
+-		ret = rockchip_otp_wait_status(otp, OTPC_USER_DONE);
++		ret = rockchip_otp_wait_status(otp, OTPC_INT_STATUS, OTPC_USER_DONE);
+ 		if (ret < 0) {
+ 			dev_err(otp->dev, "timeout during read setup\n");
+ 			goto read_end;
diff --git a/target/linux/generic/backport-5.15/813-v6.5-0006-nvmem-rockchip-otp-Use-devm_reset_control_array_get_.patch b/target/linux/generic/backport-5.15/813-v6.5-0006-nvmem-rockchip-otp-Use-devm_reset_control_array_get_.patch
new file mode 100644
index 00000000000000..3a17479d959ba2
--- /dev/null
+++ b/target/linux/generic/backport-5.15/813-v6.5-0006-nvmem-rockchip-otp-Use-devm_reset_control_array_get_.patch
@@ -0,0 +1,31 @@
+From d325c9dd2b6e94040ca722ddcadcd6af358dd2be Mon Sep 17 00:00:00 2001
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Date: Sun, 11 Jun 2023 15:03:15 +0100
+Subject: [PATCH] nvmem: rockchip-otp: Use
+ devm_reset_control_array_get_exclusive()
+
+In preparation to support new Rockchip OTP memory devices having
+specific reset configurations, switch devm_reset_control_get() to
+devm_reset_control_array_get_exclusive().
+
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Tested-by: Vincent Legoll <vincent.legoll@gmail.com>
+Reviewed-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-12-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/rockchip-otp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/rockchip-otp.c
++++ b/drivers/nvmem/rockchip-otp.c
+@@ -263,7 +263,7 @@ static int rockchip_otp_probe(struct pla
+ 	if (ret)
+ 		return ret;
+ 
+-	otp->rst = devm_reset_control_get(dev, "phy");
++	otp->rst = devm_reset_control_array_get_exclusive(dev);
+ 	if (IS_ERR(otp->rst))
+ 		return PTR_ERR(otp->rst);
+ 
diff --git a/target/linux/generic/backport-5.15/813-v6.5-0007-nvmem-rockchip-otp-Improve-probe-error-handling.patch b/target/linux/generic/backport-5.15/813-v6.5-0007-nvmem-rockchip-otp-Improve-probe-error-handling.patch
new file mode 100644
index 00000000000000..37cb927b100220
--- /dev/null
+++ b/target/linux/generic/backport-5.15/813-v6.5-0007-nvmem-rockchip-otp-Improve-probe-error-handling.patch
@@ -0,0 +1,71 @@
+From 912517345b867a69542dc9f5c2cc3e9d8beaccf5 Mon Sep 17 00:00:00 2001
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Date: Sun, 11 Jun 2023 15:03:16 +0100
+Subject: [PATCH] nvmem: rockchip-otp: Improve probe error handling
+
+Enhance error handling in the probe function by making use of
+dev_err_probe(), which ensures the error code is always printed, in
+addition to the specified error message.
+
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Tested-by: Vincent Legoll <vincent.legoll@gmail.com>
+Reviewed-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-13-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/rockchip-otp.c | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+--- a/drivers/nvmem/rockchip-otp.c
++++ b/drivers/nvmem/rockchip-otp.c
+@@ -235,10 +235,8 @@ static int rockchip_otp_probe(struct pla
+ 	int ret, i;
+ 
+ 	data = of_device_get_match_data(dev);
+-	if (!data) {
+-		dev_err(dev, "failed to get match data\n");
+-		return -EINVAL;
+-	}
++	if (!data)
++		return dev_err_probe(dev, -EINVAL, "failed to get match data\n");
+ 
+ 	otp = devm_kzalloc(&pdev->dev, sizeof(struct rockchip_otp),
+ 			   GFP_KERNEL);
+@@ -249,7 +247,8 @@ static int rockchip_otp_probe(struct pla
+ 	otp->dev = dev;
+ 	otp->base = devm_platform_ioremap_resource(pdev, 0);
+ 	if (IS_ERR(otp->base))
+-		return PTR_ERR(otp->base);
++		return dev_err_probe(dev, PTR_ERR(otp->base),
++				     "failed to ioremap resource\n");
+ 
+ 	otp->clks = devm_kcalloc(dev, data->num_clks, sizeof(*otp->clks),
+ 				 GFP_KERNEL);
+@@ -261,18 +260,22 @@ static int rockchip_otp_probe(struct pla
+ 
+ 	ret = devm_clk_bulk_get(dev, data->num_clks, otp->clks);
+ 	if (ret)
+-		return ret;
++		return dev_err_probe(dev, ret, "failed to get clocks\n");
+ 
+ 	otp->rst = devm_reset_control_array_get_exclusive(dev);
+ 	if (IS_ERR(otp->rst))
+-		return PTR_ERR(otp->rst);
++		return dev_err_probe(dev, PTR_ERR(otp->rst),
++				     "failed to get resets\n");
+ 
+ 	otp_config.size = data->size;
+ 	otp_config.priv = otp;
+ 	otp_config.dev = dev;
+-	nvmem = devm_nvmem_register(dev, &otp_config);
+ 
+-	return PTR_ERR_OR_ZERO(nvmem);
++	nvmem = devm_nvmem_register(dev, &otp_config);
++	if (IS_ERR(nvmem))
++		return dev_err_probe(dev, PTR_ERR(nvmem),
++				     "failed to register nvmem device\n");
++	return 0;
+ }
+ 
+ static struct platform_driver rockchip_otp_driver = {
diff --git a/target/linux/generic/backport-5.15/813-v6.5-0008-nvmem-rockchip-otp-Add-support-for-RK3588.patch b/target/linux/generic/backport-5.15/813-v6.5-0008-nvmem-rockchip-otp-Add-support-for-RK3588.patch
new file mode 100644
index 00000000000000..c1e2231c9ec940
--- /dev/null
+++ b/target/linux/generic/backport-5.15/813-v6.5-0008-nvmem-rockchip-otp-Add-support-for-RK3588.patch
@@ -0,0 +1,129 @@
+From 8ab099fafbbc8c9607c399d21a774784a6cb8b45 Mon Sep 17 00:00:00 2001
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Date: Sun, 11 Jun 2023 15:03:17 +0100
+Subject: [PATCH] nvmem: rockchip-otp: Add support for RK3588
+
+Add support for the OTP memory device found on the Rockchip RK3588 SoC.
+
+While here, remove the unnecessary 'void *' casts in the OF device ID
+table.
+
+Co-developed-by: Finley Xiao <finley.xiao@rock-chips.com>
+Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Tested-by: Vincent Legoll <vincent.legoll@gmail.com>
+Reviewed-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-14-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/rockchip-otp.c | 78 +++++++++++++++++++++++++++++++++++-
+ 1 file changed, 76 insertions(+), 2 deletions(-)
+
+--- a/drivers/nvmem/rockchip-otp.c
++++ b/drivers/nvmem/rockchip-otp.c
+@@ -54,6 +54,19 @@
+ 
+ #define OTPC_TIMEOUT			10000
+ 
++/* RK3588 Register */
++#define RK3588_OTPC_AUTO_CTRL		0x04
++#define RK3588_OTPC_AUTO_EN		0x08
++#define RK3588_OTPC_INT_ST		0x84
++#define RK3588_OTPC_DOUT0		0x20
++#define RK3588_NO_SECURE_OFFSET		0x300
++#define RK3588_NBYTES			4
++#define RK3588_BURST_NUM		1
++#define RK3588_BURST_SHIFT		8
++#define RK3588_ADDR_SHIFT		16
++#define RK3588_AUTO_EN			BIT(0)
++#define RK3588_RD_DONE			BIT(1)
++
+ struct rockchip_data {
+ 	int size;
+ 	const char * const *clks;
+@@ -171,6 +184,52 @@ read_end:
+ 	return ret;
+ }
+ 
++static int rk3588_otp_read(void *context, unsigned int offset,
++			   void *val, size_t bytes)
++{
++	struct rockchip_otp *otp = context;
++	unsigned int addr_start, addr_end, addr_len;
++	int ret, i = 0;
++	u32 data;
++	u8 *buf;
++
++	addr_start = round_down(offset, RK3588_NBYTES) / RK3588_NBYTES;
++	addr_end = round_up(offset + bytes, RK3588_NBYTES) / RK3588_NBYTES;
++	addr_len = addr_end - addr_start;
++	addr_start += RK3588_NO_SECURE_OFFSET;
++
++	buf = kzalloc(array_size(addr_len, RK3588_NBYTES), GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	while (addr_len--) {
++		writel((addr_start << RK3588_ADDR_SHIFT) |
++		       (RK3588_BURST_NUM << RK3588_BURST_SHIFT),
++		       otp->base + RK3588_OTPC_AUTO_CTRL);
++		writel(RK3588_AUTO_EN, otp->base + RK3588_OTPC_AUTO_EN);
++
++		ret = rockchip_otp_wait_status(otp, RK3588_OTPC_INT_ST,
++					       RK3588_RD_DONE);
++		if (ret < 0) {
++			dev_err(otp->dev, "timeout during read setup\n");
++			goto read_end;
++		}
++
++		data = readl(otp->base + RK3588_OTPC_DOUT0);
++		memcpy(&buf[i], &data, RK3588_NBYTES);
++
++		i += RK3588_NBYTES;
++		addr_start++;
++	}
++
++	memcpy(val, buf + offset % RK3588_NBYTES, bytes);
++
++read_end:
++	kfree(buf);
++
++	return ret;
++}
++
+ static int rockchip_otp_read(void *context, unsigned int offset,
+ 			     void *val, size_t bytes)
+ {
+@@ -213,14 +272,29 @@ static const struct rockchip_data px30_d
+ 	.reg_read = px30_otp_read,
+ };
+ 
++static const char * const rk3588_otp_clocks[] = {
++	"otp", "apb_pclk", "phy", "arb",
++};
++
++static const struct rockchip_data rk3588_data = {
++	.size = 0x400,
++	.clks = rk3588_otp_clocks,
++	.num_clks = ARRAY_SIZE(rk3588_otp_clocks),
++	.reg_read = rk3588_otp_read,
++};
++
+ static const struct of_device_id rockchip_otp_match[] = {
+ 	{
+ 		.compatible = "rockchip,px30-otp",
+-		.data = (void *)&px30_data,
++		.data = &px30_data,
+ 	},
+ 	{
+ 		.compatible = "rockchip,rk3308-otp",
+-		.data = (void *)&px30_data,
++		.data = &px30_data,
++	},
++	{
++		.compatible = "rockchip,rk3588-otp",
++		.data = &rk3588_data,
+ 	},
+ 	{ /* sentinel */ },
+ };
diff --git a/target/linux/generic/backport-5.15/813-v6.5-0009-nvmem-zynqmp-Switch-xilinx.com-emails-to-amd.com.patch b/target/linux/generic/backport-5.15/813-v6.5-0009-nvmem-zynqmp-Switch-xilinx.com-emails-to-amd.com.patch
new file mode 100644
index 00000000000000..220e3e9a05f303
--- /dev/null
+++ b/target/linux/generic/backport-5.15/813-v6.5-0009-nvmem-zynqmp-Switch-xilinx.com-emails-to-amd.com.patch
@@ -0,0 +1,26 @@
+From 9734408969e978a1c0d5d752be63dd638288e374 Mon Sep 17 00:00:00 2001
+From: Michal Simek <michal.simek@amd.com>
+Date: Sun, 11 Jun 2023 15:03:23 +0100
+Subject: [PATCH] nvmem: zynqmp: Switch @xilinx.com emails to @amd.com
+
+@xilinx.com is still working but better to switch to new amd.com after
+AMD/Xilinx acquisition.
+
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-20-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/zynqmp_nvmem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/zynqmp_nvmem.c
++++ b/drivers/nvmem/zynqmp_nvmem.c
+@@ -76,6 +76,6 @@ static struct platform_driver zynqmp_nvm
+ 
+ module_platform_driver(zynqmp_nvmem_driver);
+ 
+-MODULE_AUTHOR("Michal Simek <michal.simek@xilinx.com>, Nava kishore Manne <navam@xilinx.com>");
++MODULE_AUTHOR("Michal Simek <michal.simek@amd.com>, Nava kishore Manne <nava.kishore.manne@amd.com>");
+ MODULE_DESCRIPTION("ZynqMP NVMEM driver");
+ MODULE_LICENSE("GPL");
diff --git a/target/linux/generic/backport-5.15/813-v6.5-0010-nvmem-imx-support-i.MX93-OCOTP.patch b/target/linux/generic/backport-5.15/813-v6.5-0010-nvmem-imx-support-i.MX93-OCOTP.patch
new file mode 100644
index 00000000000000..f8e6be4241604a
--- /dev/null
+++ b/target/linux/generic/backport-5.15/813-v6.5-0010-nvmem-imx-support-i.MX93-OCOTP.patch
@@ -0,0 +1,230 @@
+From 22e9e6fcfb5042cb6d6c7874c459b034800092f1 Mon Sep 17 00:00:00 2001
+From: Peng Fan <peng.fan@nxp.com>
+Date: Sun, 11 Jun 2023 15:03:25 +0100
+Subject: [PATCH] nvmem: imx: support i.MX93 OCOTP
+
+Add i.MX93 OCOTP support. i.MX93 OCOTP has two parts: Fuse shadow
+block(fsb) and fuse managed by ELE. The FSB part could be directly
+accessed with MMIO, the ELE could only be accessed with ELE API.
+
+Currently the ELE API is not ready, so NULL function callback is used,
+but it was tested with downstream ELE API.
+
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-22-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/Kconfig         |   9 ++
+ drivers/nvmem/Makefile        |   2 +
+ drivers/nvmem/imx-ocotp-ele.c | 175 ++++++++++++++++++++++++++++++++++
+ 3 files changed, 186 insertions(+)
+ create mode 100644 drivers/nvmem/imx-ocotp-ele.c
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -83,6 +83,15 @@ config NVMEM_IMX_OCOTP
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called nvmem-imx-ocotp.
+ 
++config NVMEM_IMX_OCOTP_ELE
++	tristate "i.MX On-Chip OTP Controller support"
++	depends on ARCH_MXC || COMPILE_TEST
++	depends on HAS_IOMEM
++	depends on OF
++	help
++	  This is a driver for the On-Chip OTP Controller (OCOTP)
++	  available on i.MX SoCs which has ELE.
++
+ config NVMEM_IMX_OCOTP_SCU
+ 	tristate "i.MX8 SCU On-Chip OTP Controller support"
+ 	depends on IMX_SCU
+--- a/drivers/nvmem/Makefile
++++ b/drivers/nvmem/Makefile
+@@ -18,6 +18,8 @@ obj-$(CONFIG_NVMEM_IMX_IIM)		+= nvmem-im
+ nvmem-imx-iim-y				:= imx-iim.o
+ obj-$(CONFIG_NVMEM_IMX_OCOTP)		+= nvmem-imx-ocotp.o
+ nvmem-imx-ocotp-y			:= imx-ocotp.o
++obj-$(CONFIG_NVMEM_IMX_OCOTP_ELE)	+= nvmem-imx-ocotp-ele.o
++nvmem-imx-ocotp-ele-y			:= imx-ocotp-ele.o
+ obj-$(CONFIG_NVMEM_IMX_OCOTP_SCU)	+= nvmem-imx-ocotp-scu.o
+ nvmem-imx-ocotp-scu-y			:= imx-ocotp-scu.o
+ obj-$(CONFIG_NVMEM_JZ4780_EFUSE)	+= nvmem_jz4780_efuse.o
+--- /dev/null
++++ b/drivers/nvmem/imx-ocotp-ele.c
+@@ -0,0 +1,175 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * i.MX9 OCOTP fusebox driver
++ *
++ * Copyright 2023 NXP
++ */
++
++#include <linux/device.h>
++#include <linux/io.h>
++#include <linux/module.h>
++#include <linux/nvmem-provider.h>
++#include <linux/of_device.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++
++enum fuse_type {
++	FUSE_FSB = 1,
++	FUSE_ELE = 2,
++	FUSE_INVALID = -1
++};
++
++struct ocotp_map_entry {
++	u32 start; /* start word */
++	u32 num; /* num words */
++	enum fuse_type type;
++};
++
++struct ocotp_devtype_data {
++	u32 reg_off;
++	char *name;
++	u32 size;
++	u32 num_entry;
++	u32 flag;
++	nvmem_reg_read_t reg_read;
++	struct ocotp_map_entry entry[];
++};
++
++struct imx_ocotp_priv {
++	struct device *dev;
++	void __iomem *base;
++	struct nvmem_config config;
++	struct mutex lock;
++	const struct ocotp_devtype_data *data;
++};
++
++static enum fuse_type imx_ocotp_fuse_type(void *context, u32 index)
++{
++	struct imx_ocotp_priv *priv = context;
++	const struct ocotp_devtype_data *data = priv->data;
++	u32 start, end;
++	int i;
++
++	for (i = 0; i < data->num_entry; i++) {
++		start = data->entry[i].start;
++		end = data->entry[i].start + data->entry[i].num;
++
++		if (index >= start && index < end)
++			return data->entry[i].type;
++	}
++
++	return FUSE_INVALID;
++}
++
++static int imx_ocotp_reg_read(void *context, unsigned int offset, void *val, size_t bytes)
++{
++	struct imx_ocotp_priv *priv = context;
++	void __iomem *reg = priv->base + priv->data->reg_off;
++	u32 count, index, num_bytes;
++	enum fuse_type type;
++	u32 *buf;
++	void *p;
++	int i;
++
++	index = offset;
++	num_bytes = round_up(bytes, 4);
++	count = num_bytes >> 2;
++
++	if (count > ((priv->data->size >> 2) - index))
++		count = (priv->data->size >> 2) - index;
++
++	p = kzalloc(num_bytes, GFP_KERNEL);
++	if (!p)
++		return -ENOMEM;
++
++	mutex_lock(&priv->lock);
++
++	buf = p;
++
++	for (i = index; i < (index + count); i++) {
++		type = imx_ocotp_fuse_type(context, i);
++		if (type == FUSE_INVALID || type == FUSE_ELE) {
++			*buf++ = 0;
++			continue;
++		}
++
++		*buf++ = readl_relaxed(reg + (i << 2));
++	}
++
++	memcpy(val, (u8 *)p, bytes);
++
++	mutex_unlock(&priv->lock);
++
++	kfree(p);
++
++	return 0;
++};
++
++static int imx_ele_ocotp_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct imx_ocotp_priv *priv;
++	struct nvmem_device *nvmem;
++
++	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	priv->data = of_device_get_match_data(dev);
++
++	priv->base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(priv->base))
++		return PTR_ERR(priv->base);
++
++	priv->config.dev = dev;
++	priv->config.name = "ELE-OCOTP";
++	priv->config.id = NVMEM_DEVID_AUTO;
++	priv->config.owner = THIS_MODULE;
++	priv->config.size = priv->data->size;
++	priv->config.reg_read = priv->data->reg_read;
++	priv->config.word_size = 4;
++	priv->config.stride = 1;
++	priv->config.priv = priv;
++	priv->config.read_only = true;
++	mutex_init(&priv->lock);
++
++	nvmem = devm_nvmem_register(dev, &priv->config);
++	if (IS_ERR(nvmem))
++		return PTR_ERR(nvmem);
++
++	return 0;
++}
++
++static const struct ocotp_devtype_data imx93_ocotp_data = {
++	.reg_off = 0x8000,
++	.reg_read = imx_ocotp_reg_read,
++	.size = 2048,
++	.num_entry = 6,
++	.entry = {
++		{ 0, 52, FUSE_FSB },
++		{ 63, 1, FUSE_ELE},
++		{ 128, 16, FUSE_ELE },
++		{ 182, 1, FUSE_ELE },
++		{ 188, 1, FUSE_ELE },
++		{ 312, 200, FUSE_FSB }
++	},
++};
++
++static const struct of_device_id imx_ele_ocotp_dt_ids[] = {
++	{ .compatible = "fsl,imx93-ocotp", .data = &imx93_ocotp_data, },
++	{},
++};
++MODULE_DEVICE_TABLE(of, imx_ele_ocotp_dt_ids);
++
++static struct platform_driver imx_ele_ocotp_driver = {
++	.driver = {
++		.name = "imx_ele_ocotp",
++		.of_match_table = imx_ele_ocotp_dt_ids,
++	},
++	.probe = imx_ele_ocotp_probe,
++};
++module_platform_driver(imx_ele_ocotp_driver);
++
++MODULE_DESCRIPTION("i.MX OCOTP/ELE driver");
++MODULE_AUTHOR("Peng Fan <peng.fan@nxp.com>");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/generic/backport-5.15/813-v6.5-0011-nvmem-core-add-support-for-fixed-cells-layout.patch b/target/linux/generic/backport-5.15/813-v6.5-0011-nvmem-core-add-support-for-fixed-cells-layout.patch
new file mode 100644
index 00000000000000..59b2f9fa2c6707
--- /dev/null
+++ b/target/linux/generic/backport-5.15/813-v6.5-0011-nvmem-core-add-support-for-fixed-cells-layout.patch
@@ -0,0 +1,96 @@
+From 27f699e578b1a72df89dfa3bc42e093a01dc8d10 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Sun, 11 Jun 2023 15:03:29 +0100
+Subject: [PATCH] nvmem: core: add support for fixed cells *layout*
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This adds support for the "fixed-layout" NVMEM layout binding. It allows
+defining NVMEM cells in a layout DT node named "nvmem-layout".
+
+While NVMEM subsystem supports layout drivers it has been discussed that
+"fixed-layout" may actually be supperted internally. It's because:
+1. It's a very basic layout
+2. It allows sharing code with legacy syntax parsing
+3. It's safer for soc_device_match() due to -EPROBE_DEFER
+4. This will make the syntax transition easier
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-26-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c | 32 +++++++++++++++++++++++++++++---
+ 1 file changed, 29 insertions(+), 3 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -696,7 +696,7 @@ static int nvmem_validate_keepouts(struc
+ 	return 0;
+ }
+ 
+-static int nvmem_add_cells_from_of(struct nvmem_device *nvmem)
++static int nvmem_add_cells_from_dt(struct nvmem_device *nvmem, struct device_node *np)
+ {
+ 	struct nvmem_layout *layout = nvmem->layout;
+ 	struct device *dev = &nvmem->dev;
+@@ -704,7 +704,7 @@ static int nvmem_add_cells_from_of(struc
+ 	const __be32 *addr;
+ 	int len, ret;
+ 
+-	for_each_child_of_node(dev->of_node, child) {
++	for_each_child_of_node(np, child) {
+ 		struct nvmem_cell_info info = {0};
+ 
+ 		addr = of_get_property(child, "reg", &len);
+@@ -742,6 +742,28 @@ static int nvmem_add_cells_from_of(struc
+ 	return 0;
+ }
+ 
++static int nvmem_add_cells_from_legacy_of(struct nvmem_device *nvmem)
++{
++	return nvmem_add_cells_from_dt(nvmem, nvmem->dev.of_node);
++}
++
++static int nvmem_add_cells_from_fixed_layout(struct nvmem_device *nvmem)
++{
++	struct device_node *layout_np;
++	int err = 0;
++
++	layout_np = of_nvmem_layout_get_container(nvmem);
++	if (!layout_np)
++		return 0;
++
++	if (of_device_is_compatible(layout_np, "fixed-layout"))
++		err = nvmem_add_cells_from_dt(nvmem, layout_np);
++
++	of_node_put(layout_np);
++
++	return err;
++}
++
+ int __nvmem_layout_register(struct nvmem_layout *layout, struct module *owner)
+ {
+ 	layout->owner = owner;
+@@ -972,7 +994,7 @@ struct nvmem_device *nvmem_register(cons
+ 	if (rval)
+ 		goto err_remove_cells;
+ 
+-	rval = nvmem_add_cells_from_of(nvmem);
++	rval = nvmem_add_cells_from_legacy_of(nvmem);
+ 	if (rval)
+ 		goto err_remove_cells;
+ 
+@@ -982,6 +1004,10 @@ struct nvmem_device *nvmem_register(cons
+ 	if (rval)
+ 		goto err_remove_cells;
+ 
++	rval = nvmem_add_cells_from_fixed_layout(nvmem);
++	if (rval)
++		goto err_remove_cells;
++
+ 	rval = nvmem_add_cells_from_layout(nvmem);
+ 	if (rval)
+ 		goto err_remove_cells;
diff --git a/target/linux/generic/backport-5.15/814-v6.3-leds-Move-led_init_default_state_get-to-the-global-h.patch b/target/linux/generic/backport-5.15/814-v6.3-leds-Move-led_init_default_state_get-to-the-global-h.patch
new file mode 100644
index 00000000000000..592111fb9545be
--- /dev/null
+++ b/target/linux/generic/backport-5.15/814-v6.3-leds-Move-led_init_default_state_get-to-the-global-h.patch
@@ -0,0 +1,39 @@
+From 156a5bb89ca6f3edd2be0bfd0de15e575442927e Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Tue, 3 Jan 2023 15:12:47 +0200
+Subject: [PATCH] leds: Move led_init_default_state_get() to the global header
+
+There are users inside and outside LED framework that have implemented
+a local copy of led_init_default_state_get(). In order to deduplicate
+that, as the first step move the declaration from LED header to the
+global one.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230103131256.33894-3-andriy.shevchenko@linux.intel.com
+---
+ drivers/leds/leds.h  | 1 -
+ include/linux/leds.h | 2 ++
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/leds/leds.h
++++ b/drivers/leds/leds.h
+@@ -27,7 +27,6 @@ ssize_t led_trigger_read(struct file *fi
+ ssize_t led_trigger_write(struct file *filp, struct kobject *kobj,
+ 			struct bin_attribute *bin_attr, char *buf,
+ 			loff_t pos, size_t count);
+-enum led_default_state led_init_default_state_get(struct fwnode_handle *fwnode);
+ 
+ extern struct rw_semaphore leds_list_lock;
+ extern struct list_head leds_list;
+--- a/include/linux/leds.h
++++ b/include/linux/leds.h
+@@ -63,6 +63,8 @@ struct led_init_data {
+ 	bool devname_mandatory;
+ };
+ 
++enum led_default_state led_init_default_state_get(struct fwnode_handle *fwnode);
++
+ struct led_hw_trigger_type {
+ 	int dummy;
+ };
diff --git a/target/linux/generic/backport-5.15/815-v6.4-01-net-dsa-qca8k-move-qca8k_port_to_phy-to-header.patch b/target/linux/generic/backport-5.15/815-v6.4-01-net-dsa-qca8k-move-qca8k_port_to_phy-to-header.patch
new file mode 100644
index 00000000000000..dcdca9044233aa
--- /dev/null
+++ b/target/linux/generic/backport-5.15/815-v6.4-01-net-dsa-qca8k-move-qca8k_port_to_phy-to-header.patch
@@ -0,0 +1,67 @@
+From 3e8b4d6277fd19d98c817576954dd6a4ff3caa2b Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 17 Apr 2023 17:17:23 +0200
+Subject: [PATCH 1/9] net: dsa: qca8k: move qca8k_port_to_phy() to header
+
+Move qca8k_port_to_phy() to qca8k header as it's useful for future
+reference in Switch LEDs module since the same logic is applied to get
+the right index of the switch port.
+Make it inline as it's simple function that just decrease the port.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c | 15 ---------------
+ drivers/net/dsa/qca/qca8k.h      | 14 ++++++++++++++
+ 2 files changed, 14 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -716,21 +716,6 @@ err_clear_skb:
+ 	return ret;
+ }
+ 
+-static u32
+-qca8k_port_to_phy(int port)
+-{
+-	/* From Andrew Lunn:
+-	 * Port 0 has no internal phy.
+-	 * Port 1 has an internal PHY at MDIO address 0.
+-	 * Port 2 has an internal PHY at MDIO address 1.
+-	 * ...
+-	 * Port 5 has an internal PHY at MDIO address 4.
+-	 * Port 6 has no internal PHY.
+-	 */
+-
+-	return port - 1;
+-}
+-
+ static int
+ qca8k_mdio_busy_wait(struct mii_bus *bus, u32 reg, u32 mask)
+ {
+--- a/drivers/net/dsa/qca/qca8k.h
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -414,6 +414,20 @@ struct qca8k_fdb {
+ 	u8 mac[6];
+ };
+ 
++static inline u32 qca8k_port_to_phy(int port)
++{
++	/* From Andrew Lunn:
++	 * Port 0 has no internal phy.
++	 * Port 1 has an internal PHY at MDIO address 0.
++	 * Port 2 has an internal PHY at MDIO address 1.
++	 * ...
++	 * Port 5 has an internal PHY at MDIO address 4.
++	 * Port 6 has no internal PHY.
++	 */
++
++	return port - 1;
++}
++
+ /* Common setup function */
+ extern const struct qca8k_mib_desc ar8327_mib[];
+ extern const struct regmap_access_table qca8k_readable_table;
diff --git a/target/linux/generic/backport-5.15/815-v6.4-02-net-dsa-qca8k-add-LEDs-basic-support.patch b/target/linux/generic/backport-5.15/815-v6.4-02-net-dsa-qca8k-add-LEDs-basic-support.patch
new file mode 100644
index 00000000000000..baf4c2e4ba713a
--- /dev/null
+++ b/target/linux/generic/backport-5.15/815-v6.4-02-net-dsa-qca8k-add-LEDs-basic-support.patch
@@ -0,0 +1,435 @@
+From 1e264f9d2918b5737023c44a23ae04def1095210 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 17 Apr 2023 17:17:24 +0200
+Subject: [PATCH 2/9] net: dsa: qca8k: add LEDs basic support
+
+Add LEDs basic support for qca8k Switch Family by adding basic
+brightness_set() support.
+
+Since these LEDs refelect port status, the default label is set to
+":port". DT binding should describe the color and function of the
+LEDs using standard LEDs api.
+Each LED always have the device name as prefix. The device name is
+composed from the mii bus id and the PHY addr resulting in example
+names like:
+- qca8k-0.0:00:amber:lan
+- qca8k-0.0:00:white:lan
+- qca8k-0.0:01:amber:lan
+- qca8k-0.0:01:white:lan
+
+These LEDs supports only blocking variant of the brightness_set()
+function since they can sleep during access of the switch leds to set
+the brightness.
+
+While at it add to the qca8k header file each mode defined by the Switch
+Documentation for future use.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca/Kconfig      |   8 ++
+ drivers/net/dsa/qca/Makefile     |   3 +
+ drivers/net/dsa/qca/qca8k-8xxx.c |   5 +
+ drivers/net/dsa/qca/qca8k-leds.c | 239 +++++++++++++++++++++++++++++++
+ drivers/net/dsa/qca/qca8k.h      |  60 ++++++++
+ drivers/net/dsa/qca/qca8k_leds.h |  16 +++
+ 6 files changed, 331 insertions(+)
+ create mode 100644 drivers/net/dsa/qca/qca8k-leds.c
+ create mode 100644 drivers/net/dsa/qca/qca8k_leds.h
+
+--- a/drivers/net/dsa/qca/Kconfig
++++ b/drivers/net/dsa/qca/Kconfig
+@@ -15,3 +15,11 @@ config NET_DSA_QCA8K
+ 	help
+ 	  This enables support for the Qualcomm Atheros QCA8K Ethernet
+ 	  switch chips.
++
++config NET_DSA_QCA8K_LEDS_SUPPORT
++	bool "Qualcomm Atheros QCA8K Ethernet switch family LEDs support"
++	depends on NET_DSA_QCA8K
++	depends on LEDS_CLASS
++	help
++	  This enabled support for LEDs present on the Qualcomm Atheros
++	  QCA8K Ethernet switch chips.
+--- a/drivers/net/dsa/qca/Makefile
++++ b/drivers/net/dsa/qca/Makefile
+@@ -2,3 +2,6 @@
+ obj-$(CONFIG_NET_DSA_AR9331)	+= ar9331.o
+ obj-$(CONFIG_NET_DSA_QCA8K)	+= qca8k.o
+ qca8k-y 			+= qca8k-common.o qca8k-8xxx.o
++ifdef CONFIG_NET_DSA_QCA8K_LEDS_SUPPORT
++qca8k-y				+= qca8k-leds.o
++endif
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -22,6 +22,7 @@
+ #include <linux/dsa/tag_qca.h>
+ 
+ #include "qca8k.h"
++#include "qca8k_leds.h"
+ 
+ static void
+ qca8k_split_addr(u32 regaddr, u16 *r1, u16 *r2, u16 *page)
+@@ -1185,6 +1186,10 @@ qca8k_setup(struct dsa_switch *ds)
+ 	if (ret)
+ 		return ret;
+ 
++	ret = qca8k_setup_led_ctrl(priv);
++	if (ret)
++		return ret;
++
+ 	/* Make sure MAC06 is disabled */
+ 	ret = regmap_clear_bits(priv->regmap, QCA8K_REG_PORT0_PAD_CTRL,
+ 				QCA8K_PORT0_PAD_MAC06_EXCHANGE_EN);
+--- /dev/null
++++ b/drivers/net/dsa/qca/qca8k-leds.c
+@@ -0,0 +1,239 @@
++// SPDX-License-Identifier: GPL-2.0
++#include <linux/regmap.h>
++#include <net/dsa.h>
++
++#include "qca8k.h"
++#include "qca8k_leds.h"
++
++static int
++qca8k_get_enable_led_reg(int port_num, int led_num, struct qca8k_led_pattern_en *reg_info)
++{
++	switch (port_num) {
++	case 0:
++		reg_info->reg = QCA8K_LED_CTRL_REG(led_num);
++		reg_info->shift = QCA8K_LED_PHY0123_CONTROL_RULE_SHIFT;
++		break;
++	case 1:
++	case 2:
++	case 3:
++		/* Port 123 are controlled on a different reg */
++		reg_info->reg = QCA8K_LED_CTRL3_REG;
++		reg_info->shift = QCA8K_LED_PHY123_PATTERN_EN_SHIFT(port_num, led_num);
++		break;
++	case 4:
++		reg_info->reg = QCA8K_LED_CTRL_REG(led_num);
++		reg_info->shift = QCA8K_LED_PHY4_CONTROL_RULE_SHIFT;
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static int
++qca8k_led_brightness_set(struct qca8k_led *led,
++			 enum led_brightness brightness)
++{
++	struct qca8k_led_pattern_en reg_info;
++	struct qca8k_priv *priv = led->priv;
++	u32 mask, val;
++
++	qca8k_get_enable_led_reg(led->port_num, led->led_num, &reg_info);
++
++	val = QCA8K_LED_ALWAYS_OFF;
++	if (brightness)
++		val = QCA8K_LED_ALWAYS_ON;
++
++	/* HW regs to control brightness is special and port 1-2-3
++	 * are placed in a different reg.
++	 *
++	 * To control port 0 brightness:
++	 * - the 2 bit (15, 14) of:
++	 *   - QCA8K_LED_CTRL0_REG for led1
++	 *   - QCA8K_LED_CTRL1_REG for led2
++	 *   - QCA8K_LED_CTRL2_REG for led3
++	 *
++	 * To control port 4:
++	 * - the 2 bit (31, 30) of:
++	 *   - QCA8K_LED_CTRL0_REG for led1
++	 *   - QCA8K_LED_CTRL1_REG for led2
++	 *   - QCA8K_LED_CTRL2_REG for led3
++	 *
++	 * To control port 1:
++	 *   - the 2 bit at (9, 8) of QCA8K_LED_CTRL3_REG are used for led1
++	 *   - the 2 bit at (11, 10) of QCA8K_LED_CTRL3_REG are used for led2
++	 *   - the 2 bit at (13, 12) of QCA8K_LED_CTRL3_REG are used for led3
++	 *
++	 * To control port 2:
++	 *   - the 2 bit at (15, 14) of QCA8K_LED_CTRL3_REG are used for led1
++	 *   - the 2 bit at (17, 16) of QCA8K_LED_CTRL3_REG are used for led2
++	 *   - the 2 bit at (19, 18) of QCA8K_LED_CTRL3_REG are used for led3
++	 *
++	 * To control port 3:
++	 *   - the 2 bit at (21, 20) of QCA8K_LED_CTRL3_REG are used for led1
++	 *   - the 2 bit at (23, 22) of QCA8K_LED_CTRL3_REG are used for led2
++	 *   - the 2 bit at (25, 24) of QCA8K_LED_CTRL3_REG are used for led3
++	 *
++	 * To abstract this and have less code, we use the port and led numm
++	 * to calculate the shift and the correct reg due to this problem of
++	 * not having a 1:1 map of LED with the regs.
++	 */
++	if (led->port_num == 0 || led->port_num == 4) {
++		mask = QCA8K_LED_PATTERN_EN_MASK;
++		val <<= QCA8K_LED_PATTERN_EN_SHIFT;
++	} else {
++		mask = QCA8K_LED_PHY123_PATTERN_EN_MASK;
++	}
++
++	return regmap_update_bits(priv->regmap, reg_info.reg,
++				  mask << reg_info.shift,
++				  val << reg_info.shift);
++}
++
++static int
++qca8k_cled_brightness_set_blocking(struct led_classdev *ldev,
++				   enum led_brightness brightness)
++{
++	struct qca8k_led *led = container_of(ldev, struct qca8k_led, cdev);
++
++	return qca8k_led_brightness_set(led, brightness);
++}
++
++static enum led_brightness
++qca8k_led_brightness_get(struct qca8k_led *led)
++{
++	struct qca8k_led_pattern_en reg_info;
++	struct qca8k_priv *priv = led->priv;
++	u32 val;
++	int ret;
++
++	qca8k_get_enable_led_reg(led->port_num, led->led_num, &reg_info);
++
++	ret = regmap_read(priv->regmap, reg_info.reg, &val);
++	if (ret)
++		return 0;
++
++	val >>= reg_info.shift;
++
++	if (led->port_num == 0 || led->port_num == 4) {
++		val &= QCA8K_LED_PATTERN_EN_MASK;
++		val >>= QCA8K_LED_PATTERN_EN_SHIFT;
++	} else {
++		val &= QCA8K_LED_PHY123_PATTERN_EN_MASK;
++	}
++
++	/* Assume brightness ON only when the LED is set to always ON */
++	return val == QCA8K_LED_ALWAYS_ON;
++}
++
++static int
++qca8k_parse_port_leds(struct qca8k_priv *priv, struct fwnode_handle *port, int port_num)
++{
++	struct fwnode_handle *led = NULL, *leds = NULL;
++	struct led_init_data init_data = { };
++	struct dsa_switch *ds = priv->ds;
++	enum led_default_state state;
++	struct qca8k_led *port_led;
++	int led_num, led_index;
++	int ret;
++
++	leds = fwnode_get_named_child_node(port, "leds");
++	if (!leds) {
++		dev_dbg(priv->dev, "No Leds node specified in device tree for port %d!\n",
++			port_num);
++		return 0;
++	}
++
++	fwnode_for_each_child_node(leds, led) {
++		/* Reg represent the led number of the port.
++		 * Each port can have at most 3 leds attached
++		 * Commonly:
++		 * 1. is gigabit led
++		 * 2. is mbit led
++		 * 3. additional status led
++		 */
++		if (fwnode_property_read_u32(led, "reg", &led_num))
++			continue;
++
++		if (led_num >= QCA8K_LED_PORT_COUNT) {
++			dev_warn(priv->dev, "Invalid LED reg %d defined for port %d",
++				 led_num, port_num);
++			continue;
++		}
++
++		led_index = QCA8K_LED_PORT_INDEX(port_num, led_num);
++
++		port_led = &priv->ports_led[led_index];
++		port_led->port_num = port_num;
++		port_led->led_num = led_num;
++		port_led->priv = priv;
++
++		state = led_init_default_state_get(led);
++		switch (state) {
++		case LEDS_DEFSTATE_ON:
++			port_led->cdev.brightness = 1;
++			qca8k_led_brightness_set(port_led, 1);
++			break;
++		case LEDS_DEFSTATE_KEEP:
++			port_led->cdev.brightness =
++					qca8k_led_brightness_get(port_led);
++			break;
++		default:
++			port_led->cdev.brightness = 0;
++			qca8k_led_brightness_set(port_led, 0);
++		}
++
++		port_led->cdev.max_brightness = 1;
++		port_led->cdev.brightness_set_blocking = qca8k_cled_brightness_set_blocking;
++		init_data.default_label = ":port";
++		init_data.fwnode = led;
++		init_data.devname_mandatory = true;
++		init_data.devicename = kasprintf(GFP_KERNEL, "%s:0%d", ds->slave_mii_bus->id,
++						 port_num);
++		if (!init_data.devicename)
++			return -ENOMEM;
++
++		ret = devm_led_classdev_register_ext(priv->dev, &port_led->cdev, &init_data);
++		if (ret)
++			dev_warn(priv->dev, "Failed to init LED %d for port %d", led_num, port_num);
++
++		kfree(init_data.devicename);
++	}
++
++	return 0;
++}
++
++int
++qca8k_setup_led_ctrl(struct qca8k_priv *priv)
++{
++	struct fwnode_handle *ports, *port;
++	int port_num;
++	int ret;
++
++	ports = device_get_named_child_node(priv->dev, "ports");
++	if (!ports) {
++		dev_info(priv->dev, "No ports node specified in device tree!");
++		return 0;
++	}
++
++	fwnode_for_each_child_node(ports, port) {
++		if (fwnode_property_read_u32(port, "reg", &port_num))
++			continue;
++
++		/* Skip checking for CPU port 0 and CPU port 6 as not supported */
++		if (port_num == 0 || port_num == 6)
++			continue;
++
++		/* Each port can have at most 3 different leds attached.
++		 * Switch port starts from 0 to 6, but port 0 and 6 are CPU
++		 * port. The port index needs to be decreased by one to identify
++		 * the correct port for LED setup.
++		 */
++		ret = qca8k_parse_port_leds(priv, port, qca8k_port_to_phy(port_num));
++		if (ret)
++			return ret;
++	}
++
++	return 0;
++}
+--- a/drivers/net/dsa/qca/qca8k.h
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -11,6 +11,7 @@
+ #include <linux/delay.h>
+ #include <linux/regmap.h>
+ #include <linux/gpio.h>
++#include <linux/leds.h>
+ #include <linux/dsa/tag_qca.h>
+ 
+ #define QCA8K_ETHERNET_MDIO_PRIORITY			7
+@@ -85,6 +86,51 @@
+ #define   QCA8K_MDIO_MASTER_DATA(x)			FIELD_PREP(QCA8K_MDIO_MASTER_DATA_MASK, x)
+ #define   QCA8K_MDIO_MASTER_MAX_PORTS			5
+ #define   QCA8K_MDIO_MASTER_MAX_REG			32
++
++/* LED control register */
++#define QCA8K_LED_PORT_COUNT				3
++#define QCA8K_LED_COUNT					((QCA8K_NUM_PORTS - QCA8K_NUM_CPU_PORTS) * QCA8K_LED_PORT_COUNT)
++#define QCA8K_LED_RULE_COUNT				6
++#define QCA8K_LED_RULE_MAX				11
++#define QCA8K_LED_PORT_INDEX(_phy, _led)		(((_phy) * QCA8K_LED_PORT_COUNT) + (_led))
++
++#define QCA8K_LED_PHY123_PATTERN_EN_SHIFT(_phy, _led)	((((_phy) - 1) * 6) + 8 + (2 * (_led)))
++#define QCA8K_LED_PHY123_PATTERN_EN_MASK		GENMASK(1, 0)
++
++#define QCA8K_LED_PHY0123_CONTROL_RULE_SHIFT		0
++#define QCA8K_LED_PHY4_CONTROL_RULE_SHIFT		16
++
++#define QCA8K_LED_CTRL_REG(_i)				(0x050 + (_i) * 4)
++#define QCA8K_LED_CTRL0_REG				0x50
++#define QCA8K_LED_CTRL1_REG				0x54
++#define QCA8K_LED_CTRL2_REG				0x58
++#define QCA8K_LED_CTRL3_REG				0x5C
++#define   QCA8K_LED_CTRL_SHIFT(_i)			(((_i) % 2) * 16)
++#define   QCA8K_LED_CTRL_MASK				GENMASK(15, 0)
++#define QCA8K_LED_RULE_MASK				GENMASK(13, 0)
++#define QCA8K_LED_BLINK_FREQ_MASK			GENMASK(1, 0)
++#define QCA8K_LED_BLINK_FREQ_SHITF			0
++#define   QCA8K_LED_BLINK_2HZ				0
++#define   QCA8K_LED_BLINK_4HZ				1
++#define   QCA8K_LED_BLINK_8HZ				2
++#define   QCA8K_LED_BLINK_AUTO				3
++#define QCA8K_LED_LINKUP_OVER_MASK			BIT(2)
++#define QCA8K_LED_TX_BLINK_MASK				BIT(4)
++#define QCA8K_LED_RX_BLINK_MASK				BIT(5)
++#define QCA8K_LED_COL_BLINK_MASK			BIT(7)
++#define QCA8K_LED_LINK_10M_EN_MASK			BIT(8)
++#define QCA8K_LED_LINK_100M_EN_MASK			BIT(9)
++#define QCA8K_LED_LINK_1000M_EN_MASK			BIT(10)
++#define QCA8K_LED_POWER_ON_LIGHT_MASK			BIT(11)
++#define QCA8K_LED_HALF_DUPLEX_MASK			BIT(12)
++#define QCA8K_LED_FULL_DUPLEX_MASK			BIT(13)
++#define QCA8K_LED_PATTERN_EN_MASK			GENMASK(15, 14)
++#define QCA8K_LED_PATTERN_EN_SHIFT			14
++#define   QCA8K_LED_ALWAYS_OFF				0
++#define   QCA8K_LED_ALWAYS_BLINK_4HZ			1
++#define   QCA8K_LED_ALWAYS_ON				2
++#define   QCA8K_LED_RULE_CONTROLLED			3
++
+ #define QCA8K_GOL_MAC_ADDR0				0x60
+ #define QCA8K_GOL_MAC_ADDR1				0x64
+ #define QCA8K_MAX_FRAME_SIZE				0x78
+@@ -377,6 +423,19 @@ struct qca8k_mdio_cache {
+ 	u16 page;
+ };
+ 
++struct qca8k_led_pattern_en {
++	u32 reg;
++	u8 shift;
++};
++
++struct qca8k_led {
++	u8 port_num;
++	u8 led_num;
++	u16 old_rule;
++	struct qca8k_priv *priv;
++	struct led_classdev cdev;
++};
++
+ struct qca8k_priv {
+ 	u8 switch_id;
+ 	u8 switch_revision;
+@@ -399,6 +458,7 @@ struct qca8k_priv {
+ 	struct qca8k_mib_eth_data mib_eth_data;
+ 	struct qca8k_mdio_cache mdio_cache;
+ 	const struct qca8k_match_data *info;
++	struct qca8k_led ports_led[QCA8K_LED_COUNT];
+ };
+ 
+ struct qca8k_mib_desc {
+--- /dev/null
++++ b/drivers/net/dsa/qca/qca8k_leds.h
+@@ -0,0 +1,16 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++#ifndef __QCA8K_LEDS_H
++#define __QCA8K_LEDS_H
++
++/* Leds Support function */
++#ifdef CONFIG_NET_DSA_QCA8K_LEDS_SUPPORT
++int qca8k_setup_led_ctrl(struct qca8k_priv *priv);
++#else
++static inline int qca8k_setup_led_ctrl(struct qca8k_priv *priv)
++{
++	return 0;
++}
++#endif
++
++#endif /* __QCA8K_LEDS_H */
diff --git a/target/linux/generic/backport-5.15/815-v6.4-03-net-dsa-qca8k-add-LEDs-blink_set-support.patch b/target/linux/generic/backport-5.15/815-v6.4-03-net-dsa-qca8k-add-LEDs-blink_set-support.patch
new file mode 100644
index 00000000000000..231c4156df8e06
--- /dev/null
+++ b/target/linux/generic/backport-5.15/815-v6.4-03-net-dsa-qca8k-add-LEDs-blink_set-support.patch
@@ -0,0 +1,74 @@
+From 91acadcc6e599dfc62717abcdad58a459cfb1684 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 17 Apr 2023 17:17:25 +0200
+Subject: [PATCH 3/9] net: dsa: qca8k: add LEDs blink_set() support
+
+Add LEDs blink_set() support to qca8k Switch Family.
+These LEDs support hw accellerated blinking at a fixed rate
+of 4Hz.
+
+Reject any other value since not supported by the LEDs switch.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca/qca8k-leds.c | 38 ++++++++++++++++++++++++++++++++
+ 1 file changed, 38 insertions(+)
+
+--- a/drivers/net/dsa/qca/qca8k-leds.c
++++ b/drivers/net/dsa/qca/qca8k-leds.c
+@@ -128,6 +128,43 @@ qca8k_led_brightness_get(struct qca8k_le
+ }
+ 
+ static int
++qca8k_cled_blink_set(struct led_classdev *ldev,
++		     unsigned long *delay_on,
++		     unsigned long *delay_off)
++{
++	struct qca8k_led *led = container_of(ldev, struct qca8k_led, cdev);
++	u32 mask, val = QCA8K_LED_ALWAYS_BLINK_4HZ;
++	struct qca8k_led_pattern_en reg_info;
++	struct qca8k_priv *priv = led->priv;
++
++	if (*delay_on == 0 && *delay_off == 0) {
++		*delay_on = 125;
++		*delay_off = 125;
++	}
++
++	if (*delay_on != 125 || *delay_off != 125) {
++		/* The hardware only supports blinking at 4Hz. Fall back
++		 * to software implementation in other cases.
++		 */
++		return -EINVAL;
++	}
++
++	qca8k_get_enable_led_reg(led->port_num, led->led_num, &reg_info);
++
++	if (led->port_num == 0 || led->port_num == 4) {
++		mask = QCA8K_LED_PATTERN_EN_MASK;
++		val <<= QCA8K_LED_PATTERN_EN_SHIFT;
++	} else {
++		mask = QCA8K_LED_PHY123_PATTERN_EN_MASK;
++	}
++
++	regmap_update_bits(priv->regmap, reg_info.reg, mask << reg_info.shift,
++			   val << reg_info.shift);
++
++	return 0;
++}
++
++static int
+ qca8k_parse_port_leds(struct qca8k_priv *priv, struct fwnode_handle *port, int port_num)
+ {
+ 	struct fwnode_handle *led = NULL, *leds = NULL;
+@@ -186,6 +223,7 @@ qca8k_parse_port_leds(struct qca8k_priv
+ 
+ 		port_led->cdev.max_brightness = 1;
+ 		port_led->cdev.brightness_set_blocking = qca8k_cled_brightness_set_blocking;
++		port_led->cdev.blink_set = qca8k_cled_blink_set;
+ 		init_data.default_label = ":port";
+ 		init_data.fwnode = led;
+ 		init_data.devname_mandatory = true;
diff --git a/target/linux/generic/backport-5.15/815-v6.4-04-leds-Provide-stubs-for-when-CLASS_LED-NEW_LEDS-are-d.patch b/target/linux/generic/backport-5.15/815-v6.4-04-leds-Provide-stubs-for-when-CLASS_LED-NEW_LEDS-are-d.patch
new file mode 100644
index 00000000000000..bc905b4468c1b2
--- /dev/null
+++ b/target/linux/generic/backport-5.15/815-v6.4-04-leds-Provide-stubs-for-when-CLASS_LED-NEW_LEDS-are-d.patch
@@ -0,0 +1,59 @@
+From e5029edd53937a29801ef507cee12e657ff31ea9 Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Mon, 17 Apr 2023 17:17:26 +0200
+Subject: [PATCH 4/9] leds: Provide stubs for when CLASS_LED & NEW_LEDS are
+ disabled
+
+Provide stubs for devm_led_classdev_register_ext() and
+led_init_default_state_get() so that LED drivers embedded within other
+drivers such as PHYs and Ethernet switches still build when LEDS_CLASS
+or NEW_LEDS are disabled. This also helps with Kconfig dependencies,
+which are somewhat hairy for phylib and mdio and only get worse when
+adding a dependency on LED_CLASS.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/linux/leds.h | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/include/linux/leds.h
++++ b/include/linux/leds.h
+@@ -63,7 +63,15 @@ struct led_init_data {
+ 	bool devname_mandatory;
+ };
+ 
++#if IS_ENABLED(CONFIG_NEW_LEDS)
+ enum led_default_state led_init_default_state_get(struct fwnode_handle *fwnode);
++#else
++static inline enum led_default_state
++led_init_default_state_get(struct fwnode_handle *fwnode)
++{
++	return LEDS_DEFSTATE_OFF;
++}
++#endif
+ 
+ struct led_hw_trigger_type {
+ 	int dummy;
+@@ -198,9 +206,19 @@ static inline int led_classdev_register(
+ 	return led_classdev_register_ext(parent, led_cdev, NULL);
+ }
+ 
++#if IS_ENABLED(CONFIG_LEDS_CLASS)
+ int devm_led_classdev_register_ext(struct device *parent,
+ 					  struct led_classdev *led_cdev,
+ 					  struct led_init_data *init_data);
++#else
++static inline int
++devm_led_classdev_register_ext(struct device *parent,
++			       struct led_classdev *led_cdev,
++			       struct led_init_data *init_data)
++{
++	return 0;
++}
++#endif
+ 
+ static inline int devm_led_classdev_register(struct device *parent,
+ 					     struct led_classdev *led_cdev)
diff --git a/target/linux/generic/backport-5.15/815-v6.4-05-net-phy-Add-a-binding-for-PHY-LEDs.patch b/target/linux/generic/backport-5.15/815-v6.4-05-net-phy-Add-a-binding-for-PHY-LEDs.patch
new file mode 100644
index 00000000000000..7ca128b17d653e
--- /dev/null
+++ b/target/linux/generic/backport-5.15/815-v6.4-05-net-phy-Add-a-binding-for-PHY-LEDs.patch
@@ -0,0 +1,191 @@
+From 01e5b728e9e43ae444e0369695a5f72209906464 Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Mon, 17 Apr 2023 17:17:27 +0200
+Subject: [PATCH 5/9] net: phy: Add a binding for PHY LEDs
+
+Define common binding parsing for all PHY drivers with LEDs using
+phylib. Parse the DT as part of the phy_probe and add LEDs to the
+linux LED class infrastructure. For the moment, provide a dummy
+brightness function, which will later be replaced with a call into the
+PHY driver. This allows testing since the LED core might otherwise
+reject an LED whose brightness cannot be set.
+
+Add a dependency on LED_CLASS. It either needs to be built in, or not
+enabled, since a modular build can result in linker errors.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/Kconfig      |  1 +
+ drivers/net/phy/phy_device.c | 76 ++++++++++++++++++++++++++++++++++++
+ include/linux/phy.h          | 16 ++++++++
+ 3 files changed, 93 insertions(+)
+
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -18,6 +18,7 @@ menuconfig PHYLIB
+ 	depends on NETDEVICES
+ 	select MDIO_DEVICE
+ 	select MDIO_DEVRES
++	depends on LEDS_CLASS || LEDS_CLASS=n
+ 	help
+ 	  Ethernet controllers are usually attached to PHY
+ 	  devices.  This option provides infrastructure for
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -19,10 +19,12 @@
+ #include <linux/interrupt.h>
+ #include <linux/io.h>
+ #include <linux/kernel.h>
++#include <linux/list.h>
+ #include <linux/mdio.h>
+ #include <linux/mii.h>
+ #include <linux/mm.h>
+ #include <linux/module.h>
++#include <linux/of.h>
+ #include <linux/netdevice.h>
+ #include <linux/phy.h>
+ #include <linux/phy_led_triggers.h>
+@@ -641,6 +643,7 @@ struct phy_device *phy_device_create(str
+ 	device_initialize(&mdiodev->dev);
+ 
+ 	dev->state = PHY_DOWN;
++	INIT_LIST_HEAD(&dev->leds);
+ 
+ 	mutex_init(&dev->lock);
+ 	INIT_DELAYED_WORK(&dev->state_queue, phy_state_machine);
+@@ -2942,6 +2945,74 @@ static bool phy_drv_supports_irq(struct
+ 	return phydrv->config_intr && phydrv->handle_interrupt;
+ }
+ 
++/* Dummy implementation until calls into PHY driver are added */
++static int phy_led_set_brightness(struct led_classdev *led_cdev,
++				  enum led_brightness value)
++{
++	return 0;
++}
++
++static int of_phy_led(struct phy_device *phydev,
++		      struct device_node *led)
++{
++	struct device *dev = &phydev->mdio.dev;
++	struct led_init_data init_data = {};
++	struct led_classdev *cdev;
++	struct phy_led *phyled;
++	int err;
++
++	phyled = devm_kzalloc(dev, sizeof(*phyled), GFP_KERNEL);
++	if (!phyled)
++		return -ENOMEM;
++
++	cdev = &phyled->led_cdev;
++
++	err = of_property_read_u8(led, "reg", &phyled->index);
++	if (err)
++		return err;
++
++	cdev->brightness_set_blocking = phy_led_set_brightness;
++	cdev->max_brightness = 1;
++	init_data.devicename = dev_name(&phydev->mdio.dev);
++	init_data.fwnode = of_fwnode_handle(led);
++	init_data.devname_mandatory = true;
++
++	err = devm_led_classdev_register_ext(dev, cdev, &init_data);
++	if (err)
++		return err;
++
++	list_add(&phyled->list, &phydev->leds);
++
++	return 0;
++}
++
++static int of_phy_leds(struct phy_device *phydev)
++{
++	struct device_node *node = phydev->mdio.dev.of_node;
++	struct device_node *leds, *led;
++	int err;
++
++	if (!IS_ENABLED(CONFIG_OF_MDIO))
++		return 0;
++
++	if (!node)
++		return 0;
++
++	leds = of_get_child_by_name(node, "leds");
++	if (!leds)
++		return 0;
++
++	for_each_available_child_of_node(leds, led) {
++		err = of_phy_led(phydev, led);
++		if (err) {
++			of_node_put(led);
++			return err;
++		}
++	}
++
++	return 0;
++}
++
+ /**
+  * fwnode_mdio_find_device - Given a fwnode, find the mdio_device
+  * @fwnode: pointer to the mdio_device's fwnode
+@@ -3118,6 +3189,11 @@ static int phy_probe(struct device *dev)
+ 	/* Set the state to READY by default */
+ 	phydev->state = PHY_READY;
+ 
++	/* Get the LEDs from the device tree, and instantiate standard
++	 * LEDs for them.
++	 */
++	err = of_phy_leds(phydev);
++
+ out:
+ 	/* Re-assert the reset signal on error */
+ 	if (err)
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -14,6 +14,7 @@
+ #include <linux/compiler.h>
+ #include <linux/spinlock.h>
+ #include <linux/ethtool.h>
++#include <linux/leds.h>
+ #include <linux/linkmode.h>
+ #include <linux/netlink.h>
+ #include <linux/mdio.h>
+@@ -582,6 +583,7 @@ struct macsec_ops;
+  * @phy_num_led_triggers: Number of triggers in @phy_led_triggers
+  * @led_link_trigger: LED trigger for link up/down
+  * @last_triggered: last LED trigger for link speed
++ * @leds: list of PHY LED structures
+  * @master_slave_set: User requested master/slave configuration
+  * @master_slave_get: Current master/slave advertisement
+  * @master_slave_state: Current master/slave configuration
+@@ -668,6 +670,7 @@ struct phy_device {
+ 
+ 	struct phy_led_trigger *led_link_trigger;
+ #endif
++	struct list_head leds;
+ 
+ 	/*
+ 	 * Interrupt number for this PHY
+@@ -739,6 +742,19 @@ struct phy_tdr_config {
+ #define PHY_PAIR_ALL -1
+ 
+ /**
++ * struct phy_led: An LED driven by the PHY
++ *
++ * @list: List of LEDs
++ * @led_cdev: Standard LED class structure
++ * @index: Number of the LED
++ */
++struct phy_led {
++	struct list_head list;
++	struct led_classdev led_cdev;
++	u8 index;
++};
++
++/**
+  * struct phy_driver - Driver structure for a particular PHY type
+  *
+  * @mdiodrv: Data common to all MDIO devices
diff --git a/target/linux/generic/backport-5.15/815-v6.4-06-net-phy-phy_device-Call-into-the-PHY-driver-to-set-L.patch b/target/linux/generic/backport-5.15/815-v6.4-06-net-phy-phy_device-Call-into-the-PHY-driver-to-set-L.patch
new file mode 100644
index 00000000000000..f990557cc73ddf
--- /dev/null
+++ b/target/linux/generic/backport-5.15/815-v6.4-06-net-phy-phy_device-Call-into-the-PHY-driver-to-set-L.patch
@@ -0,0 +1,97 @@
+From 684818189b04b095b34964ed4a3ea5249a840eab Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Mon, 17 Apr 2023 17:17:28 +0200
+Subject: [PATCH 6/9] net: phy: phy_device: Call into the PHY driver to set LED
+ brightness
+
+Linux LEDs can be software controlled via the brightness file in /sys.
+LED drivers need to implement a brightness_set function which the core
+will call. Implement an intermediary in phy_device, which will call
+into the phy driver if it implements the necessary function.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/phy_device.c | 15 ++++++++++++---
+ include/linux/phy.h          | 13 +++++++++++++
+ 2 files changed, 25 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -2945,11 +2945,18 @@ static bool phy_drv_supports_irq(struct
+ 	return phydrv->config_intr && phydrv->handle_interrupt;
+ }
+ 
+-/* Dummy implementation until calls into PHY driver are added */
+ static int phy_led_set_brightness(struct led_classdev *led_cdev,
+ 				  enum led_brightness value)
+ {
+-	return 0;
++	struct phy_led *phyled = to_phy_led(led_cdev);
++	struct phy_device *phydev = phyled->phydev;
++	int err;
++
++	mutex_lock(&phydev->lock);
++	err = phydev->drv->led_brightness_set(phydev, phyled->index, value);
++	mutex_unlock(&phydev->lock);
++
++	return err;
+ }
+ 
+ static int of_phy_led(struct phy_device *phydev,
+@@ -2966,12 +2973,14 @@ static int of_phy_led(struct phy_device
+ 		return -ENOMEM;
+ 
+ 	cdev = &phyled->led_cdev;
++	phyled->phydev = phydev;
+ 
+ 	err = of_property_read_u8(led, "reg", &phyled->index);
+ 	if (err)
+ 		return err;
+ 
+-	cdev->brightness_set_blocking = phy_led_set_brightness;
++	if (phydev->drv->led_brightness_set)
++		cdev->brightness_set_blocking = phy_led_set_brightness;
+ 	cdev->max_brightness = 1;
+ 	init_data.devicename = dev_name(&phydev->mdio.dev);
+ 	init_data.fwnode = of_fwnode_handle(led);
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -745,15 +745,19 @@ struct phy_tdr_config {
+  * struct phy_led: An LED driven by the PHY
+  *
+  * @list: List of LEDs
++ * @phydev: PHY this LED is attached to
+  * @led_cdev: Standard LED class structure
+  * @index: Number of the LED
+  */
+ struct phy_led {
+ 	struct list_head list;
++	struct phy_device *phydev;
+ 	struct led_classdev led_cdev;
+ 	u8 index;
+ };
+ 
++#define to_phy_led(d) container_of(d, struct phy_led, led_cdev)
++
+ /**
+  * struct phy_driver - Driver structure for a particular PHY type
+  *
+@@ -953,6 +957,15 @@ struct phy_driver {
+ 	int (*get_sqi)(struct phy_device *dev);
+ 	/** @get_sqi_max: Get the maximum signal quality indication */
+ 	int (*get_sqi_max)(struct phy_device *dev);
++
++	/**
++	 * @led_brightness_set: Set a PHY LED brightness. Index
++	 * indicates which of the PHYs led should be set. Value
++	 * follows the standard LED class meaning, e.g. LED_OFF,
++	 * LED_HALF, LED_FULL.
++	 */
++	int (*led_brightness_set)(struct phy_device *dev,
++				  u8 index, enum led_brightness value);
+ };
+ #define to_phy_driver(d) container_of(to_mdio_common_driver(d),		\
+ 				      struct phy_driver, mdiodrv)
diff --git a/target/linux/generic/backport-5.15/815-v6.4-07-net-phy-marvell-Add-software-control-of-the-LEDs.patch b/target/linux/generic/backport-5.15/815-v6.4-07-net-phy-marvell-Add-software-control-of-the-LEDs.patch
new file mode 100644
index 00000000000000..053288ceca765a
--- /dev/null
+++ b/target/linux/generic/backport-5.15/815-v6.4-07-net-phy-marvell-Add-software-control-of-the-LEDs.patch
@@ -0,0 +1,112 @@
+From 2d3960e58ef7c83fe1dbf952f056b9e906cb6df8 Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Mon, 17 Apr 2023 17:17:29 +0200
+Subject: [PATCH 7/9] net: phy: marvell: Add software control of the LEDs
+
+Add a brightness function, so the LEDs can be controlled from
+software using the standard Linux LED infrastructure.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/marvell.c | 45 ++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 40 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -144,11 +144,13 @@
+ /* WOL Event Interrupt Enable */
+ #define MII_88E1318S_PHY_CSIER_WOL_EIE			BIT(7)
+ 
+-/* LED Timer Control Register */
+-#define MII_88E1318S_PHY_LED_TCR			0x12
+-#define MII_88E1318S_PHY_LED_TCR_FORCE_INT		BIT(15)
+-#define MII_88E1318S_PHY_LED_TCR_INTn_ENABLE		BIT(7)
+-#define MII_88E1318S_PHY_LED_TCR_INT_ACTIVE_LOW		BIT(11)
++#define MII_88E1318S_PHY_LED_FUNC		0x10
++#define MII_88E1318S_PHY_LED_FUNC_OFF		(0x8)
++#define MII_88E1318S_PHY_LED_FUNC_ON		(0x9)
++#define MII_88E1318S_PHY_LED_TCR		0x12
++#define MII_88E1318S_PHY_LED_TCR_FORCE_INT	BIT(15)
++#define MII_88E1318S_PHY_LED_TCR_INTn_ENABLE	BIT(7)
++#define MII_88E1318S_PHY_LED_TCR_INT_ACTIVE_LOW	BIT(11)
+ 
+ /* Magic Packet MAC address registers */
+ #define MII_88E1318S_PHY_MAGIC_PACKET_WORD2		0x17
+@@ -2793,6 +2795,34 @@ static int marvell_hwmon_probe(struct ph
+ }
+ #endif
+ 
++static int m88e1318_led_brightness_set(struct phy_device *phydev,
++				       u8 index, enum led_brightness value)
++{
++	int reg;
++
++	reg = phy_read_paged(phydev, MII_MARVELL_LED_PAGE,
++			     MII_88E1318S_PHY_LED_FUNC);
++	if (reg < 0)
++		return reg;
++
++	switch (index) {
++	case 0:
++	case 1:
++	case 2:
++		reg &= ~(0xf << (4 * index));
++		if (value == LED_OFF)
++			reg |= MII_88E1318S_PHY_LED_FUNC_OFF << (4 * index);
++		else
++			reg |= MII_88E1318S_PHY_LED_FUNC_ON << (4 * index);
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	return phy_write_paged(phydev, MII_MARVELL_LED_PAGE,
++			       MII_88E1318S_PHY_LED_FUNC, reg);
++}
++
+ static int marvell_probe(struct phy_device *phydev)
+ {
+ 	struct marvell_priv *priv;
+@@ -3041,6 +3071,7 @@ static struct phy_driver marvell_drivers
+ 		.get_sset_count = marvell_get_sset_count,
+ 		.get_strings = marvell_get_strings,
+ 		.get_stats = marvell_get_stats,
++		.led_brightness_set = m88e1318_led_brightness_set,
+ 	},
+ 	{
+ 		.phy_id = MARVELL_PHY_ID_88E1145,
+@@ -3147,6 +3178,7 @@ static struct phy_driver marvell_drivers
+ 		.cable_test_start = marvell_vct7_cable_test_start,
+ 		.cable_test_tdr_start = marvell_vct5_cable_test_tdr_start,
+ 		.cable_test_get_status = marvell_vct7_cable_test_get_status,
++		.led_brightness_set = m88e1318_led_brightness_set,
+ 	},
+ 	{
+ 		.phy_id = MARVELL_PHY_ID_88E1540,
+@@ -3173,6 +3205,7 @@ static struct phy_driver marvell_drivers
+ 		.cable_test_start = marvell_vct7_cable_test_start,
+ 		.cable_test_tdr_start = marvell_vct5_cable_test_tdr_start,
+ 		.cable_test_get_status = marvell_vct7_cable_test_get_status,
++		.led_brightness_set = m88e1318_led_brightness_set,
+ 	},
+ 	{
+ 		.phy_id = MARVELL_PHY_ID_88E1545,
+@@ -3199,6 +3232,7 @@ static struct phy_driver marvell_drivers
+ 		.cable_test_start = marvell_vct7_cable_test_start,
+ 		.cable_test_tdr_start = marvell_vct5_cable_test_tdr_start,
+ 		.cable_test_get_status = marvell_vct7_cable_test_get_status,
++		.led_brightness_set = m88e1318_led_brightness_set,
+ 	},
+ 	{
+ 		.phy_id = MARVELL_PHY_ID_88E3016,
+@@ -3340,6 +3374,7 @@ static struct phy_driver marvell_drivers
+ 		.get_stats = marvell_get_stats,
+ 		.get_tunable = m88e1540_get_tunable,
+ 		.set_tunable = m88e1540_set_tunable,
++		.led_brightness_set = m88e1318_led_brightness_set,
+ 	},
+ };
+ 
diff --git a/target/linux/generic/backport-5.15/815-v6.4-08-net-phy-phy_device-Call-into-the-PHY-driver-to-set-L.patch b/target/linux/generic/backport-5.15/815-v6.4-08-net-phy-phy_device-Call-into-the-PHY-driver-to-set-L.patch
new file mode 100644
index 00000000000000..4814688de454f4
--- /dev/null
+++ b/target/linux/generic/backport-5.15/815-v6.4-08-net-phy-phy_device-Call-into-the-PHY-driver-to-set-L.patch
@@ -0,0 +1,73 @@
+From 4e901018432e38eab35d2a352661ce4727795be1 Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Mon, 17 Apr 2023 17:17:30 +0200
+Subject: [PATCH 8/9] net: phy: phy_device: Call into the PHY driver to set LED
+ blinking
+
+Linux LEDs can be requested to perform hardware accelerated
+blinking. Pass this to the PHY driver, if it implements the op.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/phy_device.c | 18 ++++++++++++++++++
+ include/linux/phy.h          | 12 ++++++++++++
+ 2 files changed, 30 insertions(+)
+
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -2959,6 +2959,22 @@ static int phy_led_set_brightness(struct
+ 	return err;
+ }
+ 
++static int phy_led_blink_set(struct led_classdev *led_cdev,
++			     unsigned long *delay_on,
++			     unsigned long *delay_off)
++{
++	struct phy_led *phyled = to_phy_led(led_cdev);
++	struct phy_device *phydev = phyled->phydev;
++	int err;
++
++	mutex_lock(&phydev->lock);
++	err = phydev->drv->led_blink_set(phydev, phyled->index,
++					 delay_on, delay_off);
++	mutex_unlock(&phydev->lock);
++
++	return err;
++}
++
+ static int of_phy_led(struct phy_device *phydev,
+ 		      struct device_node *led)
+ {
+@@ -2981,6 +2997,8 @@ static int of_phy_led(struct phy_device
+ 
+ 	if (phydev->drv->led_brightness_set)
+ 		cdev->brightness_set_blocking = phy_led_set_brightness;
++	if (phydev->drv->led_blink_set)
++		cdev->blink_set = phy_led_blink_set;
+ 	cdev->max_brightness = 1;
+ 	init_data.devicename = dev_name(&phydev->mdio.dev);
+ 	init_data.fwnode = of_fwnode_handle(led);
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -966,6 +966,18 @@ struct phy_driver {
+ 	 */
+ 	int (*led_brightness_set)(struct phy_device *dev,
+ 				  u8 index, enum led_brightness value);
++
++	/**
++	 * @led_blink_set: Set a PHY LED brightness.  Index indicates
++	 * which of the PHYs led should be configured to blink. Delays
++	 * are in milliseconds and if both are zero then a sensible
++	 * default should be chosen.  The call should adjust the
++	 * timings in that case and if it can't match the values
++	 * specified exactly.
++	 */
++	int (*led_blink_set)(struct phy_device *dev, u8 index,
++			     unsigned long *delay_on,
++			     unsigned long *delay_off);
+ };
+ #define to_phy_driver(d) container_of(to_mdio_common_driver(d),		\
+ 				      struct phy_driver, mdiodrv)
diff --git a/target/linux/generic/backport-5.15/815-v6.4-09-net-phy-marvell-Implement-led_blink_set.patch b/target/linux/generic/backport-5.15/815-v6.4-09-net-phy-marvell-Implement-led_blink_set.patch
new file mode 100644
index 00000000000000..0f258c6b92f95f
--- /dev/null
+++ b/target/linux/generic/backport-5.15/815-v6.4-09-net-phy-marvell-Implement-led_blink_set.patch
@@ -0,0 +1,104 @@
+From ea9e86485decb2ac1750005bd96c166c9b780406 Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Mon, 17 Apr 2023 17:17:31 +0200
+Subject: [PATCH 9/9] net: phy: marvell: Implement led_blink_set()
+
+The Marvell PHY can blink the LEDs, simple on/off. All LEDs blink at
+the same rate, and the reset default is 84ms per blink, which is
+around 12Hz.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/marvell.c | 36 ++++++++++++++++++++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -147,6 +147,8 @@
+ #define MII_88E1318S_PHY_LED_FUNC		0x10
+ #define MII_88E1318S_PHY_LED_FUNC_OFF		(0x8)
+ #define MII_88E1318S_PHY_LED_FUNC_ON		(0x9)
++#define MII_88E1318S_PHY_LED_FUNC_HI_Z		(0xa)
++#define MII_88E1318S_PHY_LED_FUNC_BLINK		(0xb)
+ #define MII_88E1318S_PHY_LED_TCR		0x12
+ #define MII_88E1318S_PHY_LED_TCR_FORCE_INT	BIT(15)
+ #define MII_88E1318S_PHY_LED_TCR_INTn_ENABLE	BIT(7)
+@@ -2823,6 +2825,35 @@ static int m88e1318_led_brightness_set(s
+ 			       MII_88E1318S_PHY_LED_FUNC, reg);
+ }
+ 
++static int m88e1318_led_blink_set(struct phy_device *phydev, u8 index,
++				  unsigned long *delay_on,
++				  unsigned long *delay_off)
++{
++	int reg;
++
++	reg = phy_read_paged(phydev, MII_MARVELL_LED_PAGE,
++			     MII_88E1318S_PHY_LED_FUNC);
++	if (reg < 0)
++		return reg;
++
++	switch (index) {
++	case 0:
++	case 1:
++	case 2:
++		reg &= ~(0xf << (4 * index));
++			reg |= MII_88E1318S_PHY_LED_FUNC_BLINK << (4 * index);
++			/* Reset default is 84ms */
++			*delay_on = 84 / 2;
++			*delay_off = 84 / 2;
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	return phy_write_paged(phydev, MII_MARVELL_LED_PAGE,
++			       MII_88E1318S_PHY_LED_FUNC, reg);
++}
++
+ static int marvell_probe(struct phy_device *phydev)
+ {
+ 	struct marvell_priv *priv;
+@@ -3072,6 +3103,7 @@ static struct phy_driver marvell_drivers
+ 		.get_strings = marvell_get_strings,
+ 		.get_stats = marvell_get_stats,
+ 		.led_brightness_set = m88e1318_led_brightness_set,
++		.led_blink_set = m88e1318_led_blink_set,
+ 	},
+ 	{
+ 		.phy_id = MARVELL_PHY_ID_88E1145,
+@@ -3179,6 +3211,7 @@ static struct phy_driver marvell_drivers
+ 		.cable_test_tdr_start = marvell_vct5_cable_test_tdr_start,
+ 		.cable_test_get_status = marvell_vct7_cable_test_get_status,
+ 		.led_brightness_set = m88e1318_led_brightness_set,
++		.led_blink_set = m88e1318_led_blink_set,
+ 	},
+ 	{
+ 		.phy_id = MARVELL_PHY_ID_88E1540,
+@@ -3206,6 +3239,7 @@ static struct phy_driver marvell_drivers
+ 		.cable_test_tdr_start = marvell_vct5_cable_test_tdr_start,
+ 		.cable_test_get_status = marvell_vct7_cable_test_get_status,
+ 		.led_brightness_set = m88e1318_led_brightness_set,
++		.led_blink_set = m88e1318_led_blink_set,
+ 	},
+ 	{
+ 		.phy_id = MARVELL_PHY_ID_88E1545,
+@@ -3233,6 +3267,7 @@ static struct phy_driver marvell_drivers
+ 		.cable_test_tdr_start = marvell_vct5_cable_test_tdr_start,
+ 		.cable_test_get_status = marvell_vct7_cable_test_get_status,
+ 		.led_brightness_set = m88e1318_led_brightness_set,
++		.led_blink_set = m88e1318_led_blink_set,
+ 	},
+ 	{
+ 		.phy_id = MARVELL_PHY_ID_88E3016,
+@@ -3375,6 +3410,7 @@ static struct phy_driver marvell_drivers
+ 		.get_tunable = m88e1540_get_tunable,
+ 		.set_tunable = m88e1540_set_tunable,
+ 		.led_brightness_set = m88e1318_led_brightness_set,
++		.led_blink_set = m88e1318_led_blink_set,
+ 	},
+ };
+ 
diff --git a/target/linux/generic/backport-5.15/816-v6.4-net-phy-marvell-Fix-inconsistent-indenting-in-led_bl.patch b/target/linux/generic/backport-5.15/816-v6.4-net-phy-marvell-Fix-inconsistent-indenting-in-led_bl.patch
new file mode 100644
index 00000000000000..c5b611a125b1ae
--- /dev/null
+++ b/target/linux/generic/backport-5.15/816-v6.4-net-phy-marvell-Fix-inconsistent-indenting-in-led_bl.patch
@@ -0,0 +1,38 @@
+From 4774ad841bef97cc51df90195338c5b2573dd4cb Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Sun, 23 Apr 2023 19:28:00 +0200
+Subject: [PATCH] net: phy: marvell: Fix inconsistent indenting in
+ led_blink_set
+
+Fix inconsistent indeinting in m88e1318_led_blink_set reported by kernel
+test robot, probably done by the presence of an if condition dropped in
+later revision of the same code.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Link: https://lore.kernel.org/oe-kbuild-all/202304240007.0VEX8QYG-lkp@intel.com/
+Fixes: ea9e86485dec ("net: phy: marvell: Implement led_blink_set()")
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20230423172800.3470-1-ansuelsmth@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/marvell.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -2841,10 +2841,10 @@ static int m88e1318_led_blink_set(struct
+ 	case 1:
+ 	case 2:
+ 		reg &= ~(0xf << (4 * index));
+-			reg |= MII_88E1318S_PHY_LED_FUNC_BLINK << (4 * index);
+-			/* Reset default is 84ms */
+-			*delay_on = 84 / 2;
+-			*delay_off = 84 / 2;
++		reg |= MII_88E1318S_PHY_LED_FUNC_BLINK << (4 * index);
++		/* Reset default is 84ms */
++		*delay_on = 84 / 2;
++		*delay_off = 84 / 2;
+ 		break;
+ 	default:
+ 		return -EINVAL;
diff --git a/target/linux/generic/backport-5.15/817-v6.5-01-leds-trigger-netdev-Recheck-NETDEV_LED_MODE_LINKUP-o.patch b/target/linux/generic/backport-5.15/817-v6.5-01-leds-trigger-netdev-Recheck-NETDEV_LED_MODE_LINKUP-o.patch
new file mode 100644
index 00000000000000..3385023168de17
--- /dev/null
+++ b/target/linux/generic/backport-5.15/817-v6.5-01-leds-trigger-netdev-Recheck-NETDEV_LED_MODE_LINKUP-o.patch
@@ -0,0 +1,35 @@
+From cee4bd16c3195a701be683f7da9e88c6e11acb73 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 19 Apr 2023 23:07:39 +0200
+Subject: [PATCH 1/5] leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on
+ dev rename
+
+Dev can be renamed also while up for supported device. We currently
+wrongly clear the NETDEV_LED_MODE_LINKUP flag on NETDEV_CHANGENAME
+event.
+
+Fix this by rechecking if the carrier is ok on NETDEV_CHANGENAME and
+correctly set the NETDEV_LED_MODE_LINKUP bit.
+
+Fixes: 5f820ed52371 ("leds: trigger: netdev: fix handling on interface rename")
+Cc: stable@vger.kernel.org # v5.5+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230419210743.3594-2-ansuelsmth@gmail.com
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -318,6 +318,9 @@ static int netdev_trig_notify(struct not
+ 	clear_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode);
+ 	switch (evt) {
+ 	case NETDEV_CHANGENAME:
++		if (netif_carrier_ok(dev))
++			set_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode);
++		fallthrough;
+ 	case NETDEV_REGISTER:
+ 		if (trigger_data->net_dev)
+ 			dev_put(trigger_data->net_dev);
diff --git a/target/linux/generic/backport-5.15/817-v6.5-02-leds-trigger-netdev-Drop-NETDEV_LED_MODE_LINKUP-from.patch b/target/linux/generic/backport-5.15/817-v6.5-02-leds-trigger-netdev-Drop-NETDEV_LED_MODE_LINKUP-from.patch
new file mode 100644
index 00000000000000..3170c260580a4e
--- /dev/null
+++ b/target/linux/generic/backport-5.15/817-v6.5-02-leds-trigger-netdev-Drop-NETDEV_LED_MODE_LINKUP-from.patch
@@ -0,0 +1,87 @@
+From e2f24cb1b5daf9a4f6f3ba574c1fa74aab9807a4 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 19 Apr 2023 23:07:40 +0200
+Subject: [PATCH 2/5] leds: trigger: netdev: Drop NETDEV_LED_MODE_LINKUP from
+ mode
+
+Putting NETDEV_LED_MODE_LINKUP in the same list of the netdev trigger
+modes is wrong as it's used to set the link state of the device and not
+to set a blink mode as it's done by NETDEV_LED_LINK, NETDEV_LED_TX and
+NETDEV_LED_RX. It's also wrong to put this state in the same bitmap of the
+netdev trigger mode and should be external to it.
+
+Drop NETDEV_LED_MODE_LINKUP from mode list and convert to a simple bool
+that will be true or false based on the carrier link. No functional
+change intended.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230419210743.3594-3-ansuelsmth@gmail.com
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 19 ++++++++-----------
+ 1 file changed, 8 insertions(+), 11 deletions(-)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -50,10 +50,10 @@ struct led_netdev_data {
+ 	unsigned int last_activity;
+ 
+ 	unsigned long mode;
++	bool carrier_link_up;
+ #define NETDEV_LED_LINK	0
+ #define NETDEV_LED_TX	1
+ #define NETDEV_LED_RX	2
+-#define NETDEV_LED_MODE_LINKUP	3
+ };
+ 
+ enum netdev_led_attr {
+@@ -73,9 +73,9 @@ static void set_baseline_state(struct le
+ 	if (!led_cdev->blink_brightness)
+ 		led_cdev->blink_brightness = led_cdev->max_brightness;
+ 
+-	if (!test_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode))
++	if (!trigger_data->carrier_link_up) {
+ 		led_set_brightness(led_cdev, LED_OFF);
+-	else {
++	} else {
+ 		if (test_bit(NETDEV_LED_LINK, &trigger_data->mode))
+ 			led_set_brightness(led_cdev,
+ 					   led_cdev->blink_brightness);
+@@ -131,10 +131,9 @@ static ssize_t device_name_store(struct
+ 		trigger_data->net_dev =
+ 		    dev_get_by_name(&init_net, trigger_data->device_name);
+ 
+-	clear_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode);
++	trigger_data->carrier_link_up = false;
+ 	if (trigger_data->net_dev != NULL)
+-		if (netif_carrier_ok(trigger_data->net_dev))
+-			set_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode);
++		trigger_data->carrier_link_up = netif_carrier_ok(trigger_data->net_dev);
+ 
+ 	trigger_data->last_activity = 0;
+ 
+@@ -315,11 +314,10 @@ static int netdev_trig_notify(struct not
+ 
+ 	spin_lock_bh(&trigger_data->lock);
+ 
+-	clear_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode);
++	trigger_data->carrier_link_up = false;
+ 	switch (evt) {
+ 	case NETDEV_CHANGENAME:
+-		if (netif_carrier_ok(dev))
+-			set_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode);
++		trigger_data->carrier_link_up = netif_carrier_ok(dev);
+ 		fallthrough;
+ 	case NETDEV_REGISTER:
+ 		if (trigger_data->net_dev)
+@@ -333,8 +331,7 @@ static int netdev_trig_notify(struct not
+ 		break;
+ 	case NETDEV_UP:
+ 	case NETDEV_CHANGE:
+-		if (netif_carrier_ok(dev))
+-			set_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode);
++		trigger_data->carrier_link_up = netif_carrier_ok(dev);
+ 		break;
+ 	}
+ 
diff --git a/target/linux/generic/backport-5.15/817-v6.5-03-leds-trigger-netdev-Rename-add-namespace-to-netdev-t.patch b/target/linux/generic/backport-5.15/817-v6.5-03-leds-trigger-netdev-Rename-add-namespace-to-netdev-t.patch
new file mode 100644
index 00000000000000..19cc1d7c9edc16
--- /dev/null
+++ b/target/linux/generic/backport-5.15/817-v6.5-03-leds-trigger-netdev-Rename-add-namespace-to-netdev-t.patch
@@ -0,0 +1,149 @@
+From bdec9cb83936e0ac4cb87fed5b49fad0175f7dec Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 19 Apr 2023 23:07:41 +0200
+Subject: [PATCH 3/5] leds: trigger: netdev: Rename add namespace to netdev
+ trigger enum modes
+
+Rename NETDEV trigger enum modes to a more symbolic name and add a
+namespace to them.
+
+Also add __TRIGGER_NETDEV_MAX to identify the max modes of the netdev
+trigger.
+
+This is a cleanup to drop the define and no behaviour change are
+intended.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230419210743.3594-4-ansuelsmth@gmail.com
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 58 ++++++++++++---------------
+ 1 file changed, 25 insertions(+), 33 deletions(-)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -51,15 +51,15 @@ struct led_netdev_data {
+ 
+ 	unsigned long mode;
+ 	bool carrier_link_up;
+-#define NETDEV_LED_LINK	0
+-#define NETDEV_LED_TX	1
+-#define NETDEV_LED_RX	2
+ };
+ 
+-enum netdev_led_attr {
+-	NETDEV_ATTR_LINK,
+-	NETDEV_ATTR_TX,
+-	NETDEV_ATTR_RX
++enum led_trigger_netdev_modes {
++	TRIGGER_NETDEV_LINK = 0,
++	TRIGGER_NETDEV_TX,
++	TRIGGER_NETDEV_RX,
++
++	/* Keep last */
++	__TRIGGER_NETDEV_MAX,
+ };
+ 
+ static void set_baseline_state(struct led_netdev_data *trigger_data)
+@@ -76,7 +76,7 @@ static void set_baseline_state(struct le
+ 	if (!trigger_data->carrier_link_up) {
+ 		led_set_brightness(led_cdev, LED_OFF);
+ 	} else {
+-		if (test_bit(NETDEV_LED_LINK, &trigger_data->mode))
++		if (test_bit(TRIGGER_NETDEV_LINK, &trigger_data->mode))
+ 			led_set_brightness(led_cdev,
+ 					   led_cdev->blink_brightness);
+ 		else
+@@ -85,8 +85,8 @@ static void set_baseline_state(struct le
+ 		/* If we are looking for RX/TX start periodically
+ 		 * checking stats
+ 		 */
+-		if (test_bit(NETDEV_LED_TX, &trigger_data->mode) ||
+-		    test_bit(NETDEV_LED_RX, &trigger_data->mode))
++		if (test_bit(TRIGGER_NETDEV_TX, &trigger_data->mode) ||
++		    test_bit(TRIGGER_NETDEV_RX, &trigger_data->mode))
+ 			schedule_delayed_work(&trigger_data->work, 0);
+ 	}
+ }
+@@ -146,20 +146,16 @@ static ssize_t device_name_store(struct
+ static DEVICE_ATTR_RW(device_name);
+ 
+ static ssize_t netdev_led_attr_show(struct device *dev, char *buf,
+-	enum netdev_led_attr attr)
++				    enum led_trigger_netdev_modes attr)
+ {
+ 	struct led_netdev_data *trigger_data = led_trigger_get_drvdata(dev);
+ 	int bit;
+ 
+ 	switch (attr) {
+-	case NETDEV_ATTR_LINK:
+-		bit = NETDEV_LED_LINK;
+-		break;
+-	case NETDEV_ATTR_TX:
+-		bit = NETDEV_LED_TX;
+-		break;
+-	case NETDEV_ATTR_RX:
+-		bit = NETDEV_LED_RX;
++	case TRIGGER_NETDEV_LINK:
++	case TRIGGER_NETDEV_TX:
++	case TRIGGER_NETDEV_RX:
++		bit = attr;
+ 		break;
+ 	default:
+ 		return -EINVAL;
+@@ -169,7 +165,7 @@ static ssize_t netdev_led_attr_show(stru
+ }
+ 
+ static ssize_t netdev_led_attr_store(struct device *dev, const char *buf,
+-	size_t size, enum netdev_led_attr attr)
++				     size_t size, enum led_trigger_netdev_modes attr)
+ {
+ 	struct led_netdev_data *trigger_data = led_trigger_get_drvdata(dev);
+ 	unsigned long state;
+@@ -181,14 +177,10 @@ static ssize_t netdev_led_attr_store(str
+ 		return ret;
+ 
+ 	switch (attr) {
+-	case NETDEV_ATTR_LINK:
+-		bit = NETDEV_LED_LINK;
+-		break;
+-	case NETDEV_ATTR_TX:
+-		bit = NETDEV_LED_TX;
+-		break;
+-	case NETDEV_ATTR_RX:
+-		bit = NETDEV_LED_RX;
++	case TRIGGER_NETDEV_LINK:
++	case TRIGGER_NETDEV_TX:
++	case TRIGGER_NETDEV_RX:
++		bit = attr;
+ 		break;
+ 	default:
+ 		return -EINVAL;
+@@ -360,21 +352,21 @@ static void netdev_trig_work(struct work
+ 	}
+ 
+ 	/* If we are not looking for RX/TX then return  */
+-	if (!test_bit(NETDEV_LED_TX, &trigger_data->mode) &&
+-	    !test_bit(NETDEV_LED_RX, &trigger_data->mode))
++	if (!test_bit(TRIGGER_NETDEV_TX, &trigger_data->mode) &&
++	    !test_bit(TRIGGER_NETDEV_RX, &trigger_data->mode))
+ 		return;
+ 
+ 	dev_stats = dev_get_stats(trigger_data->net_dev, &temp);
+ 	new_activity =
+-	    (test_bit(NETDEV_LED_TX, &trigger_data->mode) ?
++	    (test_bit(TRIGGER_NETDEV_TX, &trigger_data->mode) ?
+ 		dev_stats->tx_packets : 0) +
+-	    (test_bit(NETDEV_LED_RX, &trigger_data->mode) ?
++	    (test_bit(TRIGGER_NETDEV_RX, &trigger_data->mode) ?
+ 		dev_stats->rx_packets : 0);
+ 
+ 	if (trigger_data->last_activity != new_activity) {
+ 		led_stop_software_blink(trigger_data->led_cdev);
+ 
+-		invert = test_bit(NETDEV_LED_LINK, &trigger_data->mode);
++		invert = test_bit(TRIGGER_NETDEV_LINK, &trigger_data->mode);
+ 		interval = jiffies_to_msecs(
+ 				atomic_read(&trigger_data->interval));
+ 		/* base state is ON (link present) */
diff --git a/target/linux/generic/backport-5.15/817-v6.5-04-leds-trigger-netdev-Convert-device-attr-to-macro.patch b/target/linux/generic/backport-5.15/817-v6.5-04-leds-trigger-netdev-Convert-device-attr-to-macro.patch
new file mode 100644
index 00000000000000..3b45951f5706ad
--- /dev/null
+++ b/target/linux/generic/backport-5.15/817-v6.5-04-leds-trigger-netdev-Convert-device-attr-to-macro.patch
@@ -0,0 +1,82 @@
+From 164b67d53476a9d114be85c885bd31f783835be4 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 19 Apr 2023 23:07:42 +0200
+Subject: [PATCH 4/5] leds: trigger: netdev: Convert device attr to macro
+
+Convert link tx and rx device attr to a common macro to reduce common
+code and in preparation for additional attr.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230419210743.3594-5-ansuelsmth@gmail.com
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 57 ++++++++-------------------
+ 1 file changed, 16 insertions(+), 41 deletions(-)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -198,47 +198,22 @@ static ssize_t netdev_led_attr_store(str
+ 	return size;
+ }
+ 
+-static ssize_t link_show(struct device *dev,
+-	struct device_attribute *attr, char *buf)
+-{
+-	return netdev_led_attr_show(dev, buf, NETDEV_ATTR_LINK);
+-}
+-
+-static ssize_t link_store(struct device *dev,
+-	struct device_attribute *attr, const char *buf, size_t size)
+-{
+-	return netdev_led_attr_store(dev, buf, size, NETDEV_ATTR_LINK);
+-}
+-
+-static DEVICE_ATTR_RW(link);
+-
+-static ssize_t tx_show(struct device *dev,
+-	struct device_attribute *attr, char *buf)
+-{
+-	return netdev_led_attr_show(dev, buf, NETDEV_ATTR_TX);
+-}
+-
+-static ssize_t tx_store(struct device *dev,
+-	struct device_attribute *attr, const char *buf, size_t size)
+-{
+-	return netdev_led_attr_store(dev, buf, size, NETDEV_ATTR_TX);
+-}
+-
+-static DEVICE_ATTR_RW(tx);
+-
+-static ssize_t rx_show(struct device *dev,
+-	struct device_attribute *attr, char *buf)
+-{
+-	return netdev_led_attr_show(dev, buf, NETDEV_ATTR_RX);
+-}
+-
+-static ssize_t rx_store(struct device *dev,
+-	struct device_attribute *attr, const char *buf, size_t size)
+-{
+-	return netdev_led_attr_store(dev, buf, size, NETDEV_ATTR_RX);
+-}
+-
+-static DEVICE_ATTR_RW(rx);
++#define DEFINE_NETDEV_TRIGGER(trigger_name, trigger) \
++	static ssize_t trigger_name##_show(struct device *dev, \
++		struct device_attribute *attr, char *buf) \
++	{ \
++		return netdev_led_attr_show(dev, buf, trigger); \
++	} \
++	static ssize_t trigger_name##_store(struct device *dev, \
++		struct device_attribute *attr, const char *buf, size_t size) \
++	{ \
++		return netdev_led_attr_store(dev, buf, size, trigger); \
++	} \
++	static DEVICE_ATTR_RW(trigger_name)
++
++DEFINE_NETDEV_TRIGGER(link, TRIGGER_NETDEV_LINK);
++DEFINE_NETDEV_TRIGGER(tx, TRIGGER_NETDEV_TX);
++DEFINE_NETDEV_TRIGGER(rx, TRIGGER_NETDEV_RX);
+ 
+ static ssize_t interval_show(struct device *dev,
+ 			     struct device_attribute *attr, char *buf)
diff --git a/target/linux/generic/backport-5.15/817-v6.5-05-leds-trigger-netdev-Use-mutex-instead-of-spinlocks.patch b/target/linux/generic/backport-5.15/817-v6.5-05-leds-trigger-netdev-Use-mutex-instead-of-spinlocks.patch
new file mode 100644
index 00000000000000..180bee96128a5d
--- /dev/null
+++ b/target/linux/generic/backport-5.15/817-v6.5-05-leds-trigger-netdev-Use-mutex-instead-of-spinlocks.patch
@@ -0,0 +1,106 @@
+From d1b9e1391ab2dc80e9db87fe8b2de015c651e4c9 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 19 Apr 2023 23:07:43 +0200
+Subject: [PATCH 5/5] leds: trigger: netdev: Use mutex instead of spinlocks
+
+Some LEDs may require to sleep while doing some operation like setting
+brightness and other cleanup.
+
+For this reason, using a spinlock will cause a sleep under spinlock
+warning.
+
+It should be safe to convert this to a sleepable lock since:
+- sysfs read/write can sleep
+- netdev_trig_work is a work queue and can sleep
+- netdev _trig_notify can sleep
+
+The spinlock was used when brightness didn't support sleeping, but this
+changed and now it supported with brightness_set_blocking().
+
+Convert to mutex lock to permit sleeping using brightness_set_blocking().
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230419210743.3594-6-ansuelsmth@gmail.com
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -20,7 +20,7 @@
+ #include <linux/list.h>
+ #include <linux/module.h>
+ #include <linux/netdevice.h>
+-#include <linux/spinlock.h>
++#include <linux/mutex.h>
+ #include <linux/timer.h>
+ #include "../leds.h"
+ 
+@@ -37,7 +37,7 @@
+  */
+ 
+ struct led_netdev_data {
+-	spinlock_t lock;
++	struct mutex lock;
+ 
+ 	struct delayed_work work;
+ 	struct notifier_block notifier;
+@@ -97,9 +97,9 @@ static ssize_t device_name_show(struct d
+ 	struct led_netdev_data *trigger_data = led_trigger_get_drvdata(dev);
+ 	ssize_t len;
+ 
+-	spin_lock_bh(&trigger_data->lock);
++	mutex_lock(&trigger_data->lock);
+ 	len = sprintf(buf, "%s\n", trigger_data->device_name);
+-	spin_unlock_bh(&trigger_data->lock);
++	mutex_unlock(&trigger_data->lock);
+ 
+ 	return len;
+ }
+@@ -115,7 +115,7 @@ static ssize_t device_name_store(struct
+ 
+ 	cancel_delayed_work_sync(&trigger_data->work);
+ 
+-	spin_lock_bh(&trigger_data->lock);
++	mutex_lock(&trigger_data->lock);
+ 
+ 	if (trigger_data->net_dev) {
+ 		dev_put(trigger_data->net_dev);
+@@ -138,7 +138,7 @@ static ssize_t device_name_store(struct
+ 	trigger_data->last_activity = 0;
+ 
+ 	set_baseline_state(trigger_data);
+-	spin_unlock_bh(&trigger_data->lock);
++	mutex_unlock(&trigger_data->lock);
+ 
+ 	return size;
+ }
+@@ -279,7 +279,7 @@ static int netdev_trig_notify(struct not
+ 
+ 	cancel_delayed_work_sync(&trigger_data->work);
+ 
+-	spin_lock_bh(&trigger_data->lock);
++	mutex_lock(&trigger_data->lock);
+ 
+ 	trigger_data->carrier_link_up = false;
+ 	switch (evt) {
+@@ -304,7 +304,7 @@ static int netdev_trig_notify(struct not
+ 
+ 	set_baseline_state(trigger_data);
+ 
+-	spin_unlock_bh(&trigger_data->lock);
++	mutex_unlock(&trigger_data->lock);
+ 
+ 	return NOTIFY_DONE;
+ }
+@@ -365,7 +365,7 @@ static int netdev_trig_activate(struct l
+ 	if (!trigger_data)
+ 		return -ENOMEM;
+ 
+-	spin_lock_init(&trigger_data->lock);
++	mutex_init(&trigger_data->lock);
+ 
+ 	trigger_data->notifier.notifier_call = netdev_trig_notify;
+ 	trigger_data->notifier.priority = 10;
diff --git a/target/linux/generic/backport-5.15/818-v6.5-01-leds-add-APIs-for-LEDs-hw-control.patch b/target/linux/generic/backport-5.15/818-v6.5-01-leds-add-APIs-for-LEDs-hw-control.patch
new file mode 100644
index 00000000000000..ac186117338ff5
--- /dev/null
+++ b/target/linux/generic/backport-5.15/818-v6.5-01-leds-add-APIs-for-LEDs-hw-control.patch
@@ -0,0 +1,74 @@
+From ed554d3f945179c5b159bddfad7be34b403fe11a Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 29 May 2023 18:32:31 +0200
+Subject: [PATCH 01/13] leds: add APIs for LEDs hw control
+
+Add an option to permit LED driver to declare support for a specific
+trigger to use hw control and setup the LED to blink based on specific
+provided modes.
+
+Add APIs for LEDs hw control. These functions will be used to activate
+hardware control where a LED will use the provided flags, from an
+unique defined supported trigger, to setup the LED to be driven by
+hardware.
+
+Add hw_control_is_supported() to ask the LED driver if the requested
+mode by the trigger are supported and the LED can be setup to follow
+the requested modes.
+
+Deactivate hardware blink control by setting brightness to LED_OFF via
+the brightness_set() callback.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/linux/leds.h | 37 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+--- a/include/linux/leds.h
++++ b/include/linux/leds.h
+@@ -164,6 +164,43 @@ struct led_classdev {
+ 
+ 	/* LEDs that have private triggers have this set */
+ 	struct led_hw_trigger_type	*trigger_type;
++
++	/* Unique trigger name supported by LED set in hw control mode */
++	const char		*hw_control_trigger;
++	/*
++	 * Check if the LED driver supports the requested mode provided by the
++	 * defined supported trigger to setup the LED to hw control mode.
++	 *
++	 * Return 0 on success. Return -EOPNOTSUPP when the passed flags are not
++	 * supported and software fallback needs to be used.
++	 * Return a negative error number on any other case  for check fail due
++	 * to various reason like device not ready or timeouts.
++	 */
++	int			(*hw_control_is_supported)(struct led_classdev *led_cdev,
++							   unsigned long flags);
++	/*
++	 * Activate hardware control, LED driver will use the provided flags
++	 * from the supported trigger and setup the LED to be driven by hardware
++	 * following the requested mode from the trigger flags.
++	 * Deactivate hardware blink control by setting brightness to LED_OFF via
++	 * the brightness_set() callback.
++	 *
++	 * Return 0 on success, a negative error number on flags apply fail.
++	 */
++	int			(*hw_control_set)(struct led_classdev *led_cdev,
++						  unsigned long flags);
++	/*
++	 * Get from the LED driver the current mode that the LED is set in hw
++	 * control mode and put them in flags.
++	 * Trigger can use this to get the initial state of a LED already set in
++	 * hardware blink control.
++	 *
++	 * Return 0 on success, a negative error number on failing parsing the
++	 * initial mode. Error from this function is NOT FATAL as the device
++	 * may be in a not supported initial state by the attached LED trigger.
++	 */
++	int			(*hw_control_get)(struct led_classdev *led_cdev,
++						  unsigned long *flags);
+ #endif
+ 
+ #ifdef CONFIG_LEDS_BRIGHTNESS_HW_CHANGED
diff --git a/target/linux/generic/backport-5.15/818-v6.5-02-leds-add-API-to-get-attached-device-for-LED-hw-contr.patch b/target/linux/generic/backport-5.15/818-v6.5-02-leds-add-API-to-get-attached-device-for-LED-hw-contr.patch
new file mode 100644
index 00000000000000..1a221727a01d7d
--- /dev/null
+++ b/target/linux/generic/backport-5.15/818-v6.5-02-leds-add-API-to-get-attached-device-for-LED-hw-contr.patch
@@ -0,0 +1,37 @@
+From 052c38eb17e866c5b4cd43924e7a5e20167b55c0 Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Mon, 29 May 2023 18:32:32 +0200
+Subject: [PATCH 02/13] leds: add API to get attached device for LED hw control
+
+Some specific LED triggers blink the LED based on events from a device
+or subsystem.
+For example, an LED could be blinked to indicate a network device is
+receiving packets, or a disk is reading blocks. To correctly enable and
+request the hw control of the LED, the trigger has to check if the
+network interface or block device configured via a /sys/class/led file
+match the one the LED driver provide for hw control for.
+
+Provide an API call to get the device which the LED blinks for.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/linux/leds.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/include/linux/leds.h
++++ b/include/linux/leds.h
+@@ -201,6 +201,12 @@ struct led_classdev {
+ 	 */
+ 	int			(*hw_control_get)(struct led_classdev *led_cdev,
+ 						  unsigned long *flags);
++	/*
++	 * Get the device this LED blinks in response to.
++	 * e.g. for a PHY LED, it is the network device. If the LED is
++	 * not yet associated to a device, return NULL.
++	 */
++	struct device		*(*hw_control_get_device)(struct led_classdev *led_cdev);
+ #endif
+ 
+ #ifdef CONFIG_LEDS_BRIGHTNESS_HW_CHANGED
diff --git a/target/linux/generic/backport-5.15/818-v6.5-03-Documentation-leds-leds-class-Document-new-Hardware-.patch b/target/linux/generic/backport-5.15/818-v6.5-03-Documentation-leds-leds-class-Document-new-Hardware-.patch
new file mode 100644
index 00000000000000..af9fb7fdc36526
--- /dev/null
+++ b/target/linux/generic/backport-5.15/818-v6.5-03-Documentation-leds-leds-class-Document-new-Hardware-.patch
@@ -0,0 +1,113 @@
+From 8aa2fd7b66980ecd2e45e95af61cf7eafede1211 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 29 May 2023 18:32:33 +0200
+Subject: [PATCH 03/13] Documentation: leds: leds-class: Document new Hardware
+ driven LEDs APIs
+
+Document new Hardware driven LEDs APIs.
+
+Some LEDs can be programmed to be driven by hardware. This is not
+limited to blink but also to turn off or on autonomously.
+To support this feature, a LED needs to implement various additional
+ops and needs to declare specific support for the supported triggers.
+
+Add documentation for each required value and API to make hw control
+possible and implementable by both LEDs and triggers.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ Documentation/leds/leds-class.rst | 81 +++++++++++++++++++++++++++++++
+ 1 file changed, 81 insertions(+)
+
+--- a/Documentation/leds/leds-class.rst
++++ b/Documentation/leds/leds-class.rst
+@@ -169,6 +169,87 @@ Setting the brightness to zero with brig
+ should completely turn off the LED and cancel the previously programmed
+ hardware blinking function, if any.
+ 
++Hardware driven LEDs
++====================
++
++Some LEDs can be programmed to be driven by hardware. This is not
++limited to blink but also to turn off or on autonomously.
++To support this feature, a LED needs to implement various additional
++ops and needs to declare specific support for the supported triggers.
++
++With hw control we refer to the LED driven by hardware.
++
++LED driver must define the following value to support hw control:
++
++    - hw_control_trigger:
++               unique trigger name supported by the LED in hw control
++               mode.
++
++LED driver must implement the following API to support hw control:
++    - hw_control_is_supported:
++                check if the flags passed by the supported trigger can
++                be parsed and activate hw control on the LED.
++
++                Return 0 if the passed flags mask is supported and
++                can be set with hw_control_set().
++
++                If the passed flags mask is not supported -EOPNOTSUPP
++                must be returned, the LED trigger will use software
++                fallback in this case.
++
++                Return a negative error in case of any other error like
++                device not ready or timeouts.
++
++     - hw_control_set:
++                activate hw control. LED driver will use the provided
++                flags passed from the supported trigger, parse them to
++                a set of mode and setup the LED to be driven by hardware
++                following the requested modes.
++
++                Set LED_OFF via the brightness_set to deactivate hw control.
++
++                Return 0 on success, a negative error number on failing to
++                apply flags.
++
++    - hw_control_get:
++                get active modes from a LED already in hw control, parse
++                them and set in flags the current active flags for the
++                supported trigger.
++
++                Return 0 on success, a negative error number on failing
++                parsing the initial mode.
++                Error from this function is NOT FATAL as the device may
++                be in a not supported initial state by the attached LED
++                trigger.
++
++    - hw_control_get_device:
++                return the device associated with the LED driver in
++                hw control. A trigger might use this to match the
++                returned device from this function with a configured
++                device for the trigger as the source for blinking
++                events and correctly enable hw control.
++                (example a netdev trigger configured to blink for a
++                particular dev match the returned dev from get_device
++                to set hw control)
++
++                Returns a pointer to a struct device or NULL if nothing
++                is currently attached.
++
++LED driver can activate additional modes by default to workaround the
++impossibility of supporting each different mode on the supported trigger.
++Examples are hardcoding the blink speed to a set interval, enable special
++feature like bypassing blink if some requirements are not met.
++
++A trigger should first check if the hw control API are supported by the LED
++driver and check if the trigger is supported to verify if hw control is possible,
++use hw_control_is_supported to check if the flags are supported and only at
++the end use hw_control_set to activate hw control.
++
++A trigger can use hw_control_get to check if a LED is already in hw control
++and init their flags.
++
++When the LED is in hw control, no software blink is possible and doing so
++will effectively disable hw control.
+ 
+ Known Issues
+ ============
diff --git a/target/linux/generic/backport-5.15/818-v6.5-04-leds-trigger-netdev-refactor-code-setting-device-nam.patch b/target/linux/generic/backport-5.15/818-v6.5-04-leds-trigger-netdev-refactor-code-setting-device-nam.patch
new file mode 100644
index 00000000000000..3c804c0b412e3c
--- /dev/null
+++ b/target/linux/generic/backport-5.15/818-v6.5-04-leds-trigger-netdev-refactor-code-setting-device-nam.patch
@@ -0,0 +1,69 @@
+From 28a6a2ef18ad840a390d519840c303b03040961c Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Mon, 29 May 2023 18:32:34 +0200
+Subject: [PATCH 04/13] leds: trigger: netdev: refactor code setting device
+ name
+
+Move the code into a helper, ready for it to be called at
+other times. No intended behaviour change.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 29 ++++++++++++++++++---------
+ 1 file changed, 20 insertions(+), 9 deletions(-)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -104,15 +104,9 @@ static ssize_t device_name_show(struct d
+ 	return len;
+ }
+ 
+-static ssize_t device_name_store(struct device *dev,
+-				 struct device_attribute *attr, const char *buf,
+-				 size_t size)
++static int set_device_name(struct led_netdev_data *trigger_data,
++			   const char *name, size_t size)
+ {
+-	struct led_netdev_data *trigger_data = led_trigger_get_drvdata(dev);
+-
+-	if (size >= IFNAMSIZ)
+-		return -EINVAL;
+-
+ 	cancel_delayed_work_sync(&trigger_data->work);
+ 
+ 	mutex_lock(&trigger_data->lock);
+@@ -122,7 +116,7 @@ static ssize_t device_name_store(struct
+ 		trigger_data->net_dev = NULL;
+ 	}
+ 
+-	memcpy(trigger_data->device_name, buf, size);
++	memcpy(trigger_data->device_name, name, size);
+ 	trigger_data->device_name[size] = 0;
+ 	if (size > 0 && trigger_data->device_name[size - 1] == '\n')
+ 		trigger_data->device_name[size - 1] = 0;
+@@ -140,6 +134,23 @@ static ssize_t device_name_store(struct
+ 	set_baseline_state(trigger_data);
+ 	mutex_unlock(&trigger_data->lock);
+ 
++	return 0;
++}
++
++static ssize_t device_name_store(struct device *dev,
++				 struct device_attribute *attr, const char *buf,
++				 size_t size)
++{
++	struct led_netdev_data *trigger_data = led_trigger_get_drvdata(dev);
++	int ret;
++
++	if (size >= IFNAMSIZ)
++		return -EINVAL;
++
++	ret = set_device_name(trigger_data, buf, size);
++
++	if (ret < 0)
++		return ret;
+ 	return size;
+ }
+ 
diff --git a/target/linux/generic/backport-5.15/818-v6.5-05-leds-trigger-netdev-introduce-check-for-possible-hw-.patch b/target/linux/generic/backport-5.15/818-v6.5-05-leds-trigger-netdev-introduce-check-for-possible-hw-.patch
new file mode 100644
index 00000000000000..284b519482cfed
--- /dev/null
+++ b/target/linux/generic/backport-5.15/818-v6.5-05-leds-trigger-netdev-introduce-check-for-possible-hw-.patch
@@ -0,0 +1,54 @@
+From 4fd1b6d47a7a38e81fdc6f8be2ccd4216b3f93db Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 29 May 2023 18:32:35 +0200
+Subject: [PATCH 05/13] leds: trigger: netdev: introduce check for possible hw
+ control
+
+Introduce function to check if the requested mode can use hw control in
+preparation for hw control support. Currently everything is handled in
+software so can_hw_control will always return false.
+
+Add knob with the new value hw_control in trigger_data struct to
+set hw control possible. Useful for future implementation to implement
+in set_baseline_state() the required function to set the requested mode
+using LEDs hw control ops and in other function to reject set if hw
+control is currently active.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -51,6 +51,7 @@ struct led_netdev_data {
+ 
+ 	unsigned long mode;
+ 	bool carrier_link_up;
++	bool hw_control;
+ };
+ 
+ enum led_trigger_netdev_modes {
+@@ -91,6 +92,11 @@ static void set_baseline_state(struct le
+ 	}
+ }
+ 
++static bool can_hw_control(struct led_netdev_data *trigger_data)
++{
++	return false;
++}
++
+ static ssize_t device_name_show(struct device *dev,
+ 				struct device_attribute *attr, char *buf)
+ {
+@@ -204,6 +210,8 @@ static ssize_t netdev_led_attr_store(str
+ 	else
+ 		clear_bit(bit, &trigger_data->mode);
+ 
++	trigger_data->hw_control = can_hw_control(trigger_data);
++
+ 	set_baseline_state(trigger_data);
+ 
+ 	return size;
diff --git a/target/linux/generic/backport-5.15/818-v6.5-06-leds-trigger-netdev-add-basic-check-for-hw-control-s.patch b/target/linux/generic/backport-5.15/818-v6.5-06-leds-trigger-netdev-add-basic-check-for-hw-control-s.patch
new file mode 100644
index 00000000000000..09759bc623e9c0
--- /dev/null
+++ b/target/linux/generic/backport-5.15/818-v6.5-06-leds-trigger-netdev-add-basic-check-for-hw-control-s.patch
@@ -0,0 +1,42 @@
+From 6352f25f9fadba59d5df2ba7139495759ccc81d5 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 29 May 2023 18:32:36 +0200
+Subject: [PATCH 06/13] leds: trigger: netdev: add basic check for hw control
+ support
+
+Add basic check for hw control support. Check if the required API are
+defined and check if the defined trigger supported in hw control for the
+LED driver match netdev.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -92,8 +92,22 @@ static void set_baseline_state(struct le
+ 	}
+ }
+ 
++static bool supports_hw_control(struct led_classdev *led_cdev)
++{
++	if (!led_cdev->hw_control_get || !led_cdev->hw_control_set ||
++	    !led_cdev->hw_control_is_supported)
++		return false;
++
++	return !strcmp(led_cdev->hw_control_trigger, led_cdev->trigger->name);
++}
++
+ static bool can_hw_control(struct led_netdev_data *trigger_data)
+ {
++	struct led_classdev *led_cdev = trigger_data->led_cdev;
++
++	if (!supports_hw_control(led_cdev))
++		return false;
++
+ 	return false;
+ }
+ 
diff --git a/target/linux/generic/backport-5.15/818-v6.5-07-leds-trigger-netdev-reject-interval-store-for-hw_con.patch b/target/linux/generic/backport-5.15/818-v6.5-07-leds-trigger-netdev-reject-interval-store-for-hw_con.patch
new file mode 100644
index 00000000000000..66349068003149
--- /dev/null
+++ b/target/linux/generic/backport-5.15/818-v6.5-07-leds-trigger-netdev-reject-interval-store-for-hw_con.patch
@@ -0,0 +1,28 @@
+From c84c80c7388f887b10dafd70fc55bc6c5fe9fa5a Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 29 May 2023 18:32:37 +0200
+Subject: [PATCH 07/13] leds: trigger: netdev: reject interval store for
+ hw_control
+
+Reject interval store with hw_control enabled. It's are currently not
+supported and MUST be set to the default value with hw control enabled.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -265,6 +265,9 @@ static ssize_t interval_store(struct dev
+ 	unsigned long value;
+ 	int ret;
+ 
++	if (trigger_data->hw_control)
++		return -EINVAL;
++
+ 	ret = kstrtoul(buf, 0, &value);
+ 	if (ret)
+ 		return ret;
diff --git a/target/linux/generic/backport-5.15/818-v6.5-08-leds-trigger-netdev-add-support-for-LED-hw-control.patch b/target/linux/generic/backport-5.15/818-v6.5-08-leds-trigger-netdev-add-support-for-LED-hw-control.patch
new file mode 100644
index 00000000000000..52faa4809b2ae0
--- /dev/null
+++ b/target/linux/generic/backport-5.15/818-v6.5-08-leds-trigger-netdev-add-support-for-LED-hw-control.patch
@@ -0,0 +1,107 @@
+From 7c145a34ba6e380616af93262fcab9fc7261d851 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 29 May 2023 18:32:38 +0200
+Subject: [PATCH 08/13] leds: trigger: netdev: add support for LED hw control
+
+Add support for LED hw control for the netdev trigger.
+
+The trigger on calling set_baseline_state to configure a new mode, will
+do various check to verify if hw control can be used for the requested
+mode in can_hw_control() function.
+
+It will first check if the LED driver supports hw control for the netdev
+trigger, then will use hw_control_is_supported() and finally will call
+hw_control_set() to apply the requested mode.
+
+To use such mode, interval MUST be set to the default value and net_dev
+MUST be set. If one of these 2 value are not valid, hw control will
+never be used and normal software fallback is used.
+
+The default interval value is moved to a define to make sure they are
+always synced.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 43 +++++++++++++++++++++++++--
+ 1 file changed, 41 insertions(+), 2 deletions(-)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -24,6 +24,8 @@
+ #include <linux/timer.h>
+ #include "../leds.h"
+ 
++#define NETDEV_LED_DEFAULT_INTERVAL	50
++
+ /*
+  * Configurable sysfs attributes:
+  *
+@@ -68,6 +70,13 @@ static void set_baseline_state(struct le
+ 	int current_brightness;
+ 	struct led_classdev *led_cdev = trigger_data->led_cdev;
+ 
++	/* Already validated, hw control is possible with the requested mode */
++	if (trigger_data->hw_control) {
++		led_cdev->hw_control_set(led_cdev, trigger_data->mode);
++
++		return;
++	}
++
+ 	current_brightness = led_cdev->brightness;
+ 	if (current_brightness)
+ 		led_cdev->blink_brightness = current_brightness;
+@@ -103,12 +112,42 @@ static bool supports_hw_control(struct l
+ 
+ static bool can_hw_control(struct led_netdev_data *trigger_data)
+ {
++	unsigned long default_interval = msecs_to_jiffies(NETDEV_LED_DEFAULT_INTERVAL);
++	unsigned int interval = atomic_read(&trigger_data->interval);
+ 	struct led_classdev *led_cdev = trigger_data->led_cdev;
++	int ret;
+ 
+ 	if (!supports_hw_control(led_cdev))
+ 		return false;
+ 
+-	return false;
++	/*
++	 * Interval must be set to the default
++	 * value. Any different value is rejected if in hw
++	 * control.
++	 */
++	if (interval != default_interval)
++		return false;
++
++	/*
++	 * net_dev must be set with hw control, otherwise no
++	 * blinking can be happening and there is nothing to
++	 * offloaded.
++	 */
++	if (!trigger_data->net_dev)
++		return false;
++
++	/* Check if the requested mode is supported */
++	ret = led_cdev->hw_control_is_supported(led_cdev, trigger_data->mode);
++	/* Fall back to software blinking if not supported */
++	if (ret == -EOPNOTSUPP)
++		return false;
++	if (ret) {
++		dev_warn(led_cdev->dev,
++			 "Current mode check failed with error %d\n", ret);
++		return false;
++	}
++
++	return true;
+ }
+ 
+ static ssize_t device_name_show(struct device *dev,
+@@ -413,7 +452,7 @@ static int netdev_trig_activate(struct l
+ 	trigger_data->device_name[0] = 0;
+ 
+ 	trigger_data->mode = 0;
+-	atomic_set(&trigger_data->interval, msecs_to_jiffies(50));
++	atomic_set(&trigger_data->interval, msecs_to_jiffies(NETDEV_LED_DEFAULT_INTERVAL));
+ 	trigger_data->last_activity = 0;
+ 
+ 	led_set_trigger_data(led_cdev, trigger_data);
diff --git a/target/linux/generic/backport-5.15/818-v6.5-09-leds-trigger-netdev-validate-configured-netdev.patch b/target/linux/generic/backport-5.15/818-v6.5-09-leds-trigger-netdev-validate-configured-netdev.patch
new file mode 100644
index 00000000000000..c129ffa4f5944c
--- /dev/null
+++ b/target/linux/generic/backport-5.15/818-v6.5-09-leds-trigger-netdev-validate-configured-netdev.patch
@@ -0,0 +1,58 @@
+From 33ec0b53befff2c0a7f3aa19ff08556d60585d6b Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Mon, 29 May 2023 18:32:39 +0200
+Subject: [PATCH 09/13] leds: trigger: netdev: validate configured netdev
+
+The netdev which the LED should blink for is configurable in
+/sys/class/led/foo/device_name. Ensure when offloading that the
+configured netdev is the same as the netdev the LED is associated
+with. If it is not, only perform software blinking.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 24 ++++++++++++++++++++++--
+ 1 file changed, 22 insertions(+), 2 deletions(-)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -110,6 +110,24 @@ static bool supports_hw_control(struct l
+ 	return !strcmp(led_cdev->hw_control_trigger, led_cdev->trigger->name);
+ }
+ 
++/*
++ * Validate the configured netdev is the same as the one associated with
++ * the LED driver in hw control.
++ */
++static bool validate_net_dev(struct led_classdev *led_cdev,
++			     struct net_device *net_dev)
++{
++	struct device *dev = led_cdev->hw_control_get_device(led_cdev);
++	struct net_device *ndev;
++
++	if (!dev)
++		return false;
++
++	ndev = to_net_dev(dev);
++
++	return ndev == net_dev;
++}
++
+ static bool can_hw_control(struct led_netdev_data *trigger_data)
+ {
+ 	unsigned long default_interval = msecs_to_jiffies(NETDEV_LED_DEFAULT_INTERVAL);
+@@ -131,9 +149,11 @@ static bool can_hw_control(struct led_ne
+ 	/*
+ 	 * net_dev must be set with hw control, otherwise no
+ 	 * blinking can be happening and there is nothing to
+-	 * offloaded.
++	 * offloaded. Additionally, for hw control to be
++	 * valid, the configured netdev must be the same as
++	 * netdev associated to the LED.
+ 	 */
+-	if (!trigger_data->net_dev)
++	if (!validate_net_dev(led_cdev, trigger_data->net_dev))
+ 		return false;
+ 
+ 	/* Check if the requested mode is supported */
diff --git a/target/linux/generic/backport-5.15/818-v6.5-10-leds-trigger-netdev-init-mode-if-hw-control-already-.patch b/target/linux/generic/backport-5.15/818-v6.5-10-leds-trigger-netdev-init-mode-if-hw-control-already-.patch
new file mode 100644
index 00000000000000..e20594c99a3eaa
--- /dev/null
+++ b/target/linux/generic/backport-5.15/818-v6.5-10-leds-trigger-netdev-init-mode-if-hw-control-already-.patch
@@ -0,0 +1,53 @@
+From 0316cc5629d15880dd3f097d221c55ca648bcd61 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 29 May 2023 18:32:40 +0200
+Subject: [PATCH 10/13] leds: trigger: netdev: init mode if hw control already
+ active
+
+On netdev trigger activation, hw control may be already active by
+default. If this is the case and a device is actually provided by
+hw_control_get_device(), init the already active mode and set the
+bool to hw_control bool to true to reflect the already set mode in the
+trigger_data.
+
+Co-developed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -454,6 +454,8 @@ static void netdev_trig_work(struct work
+ static int netdev_trig_activate(struct led_classdev *led_cdev)
+ {
+ 	struct led_netdev_data *trigger_data;
++	unsigned long mode;
++	struct device *dev;
+ 	int rc;
+ 
+ 	trigger_data = kzalloc(sizeof(struct led_netdev_data), GFP_KERNEL);
+@@ -475,6 +477,21 @@ static int netdev_trig_activate(struct l
+ 	atomic_set(&trigger_data->interval, msecs_to_jiffies(NETDEV_LED_DEFAULT_INTERVAL));
+ 	trigger_data->last_activity = 0;
+ 
++	/* Check if hw control is active by default on the LED.
++	 * Init already enabled mode in hw control.
++	 */
++	if (supports_hw_control(led_cdev) &&
++	    !led_cdev->hw_control_get(led_cdev, &mode)) {
++		dev = led_cdev->hw_control_get_device(led_cdev);
++		if (dev) {
++			const char *name = dev_name(dev);
++
++			set_device_name(trigger_data, name, strlen(name));
++			trigger_data->hw_control = true;
++			trigger_data->mode = mode;
++		}
++	}
++
+ 	led_set_trigger_data(led_cdev, trigger_data);
+ 
+ 	rc = register_netdevice_notifier(&trigger_data->notifier);
diff --git a/target/linux/generic/backport-5.15/818-v6.5-11-leds-trigger-netdev-expose-netdev-trigger-modes-in-l.patch b/target/linux/generic/backport-5.15/818-v6.5-11-leds-trigger-netdev-expose-netdev-trigger-modes-in-l.patch
new file mode 100644
index 00000000000000..70aed850d13b4c
--- /dev/null
+++ b/target/linux/generic/backport-5.15/818-v6.5-11-leds-trigger-netdev-expose-netdev-trigger-modes-in-l.patch
@@ -0,0 +1,54 @@
+From 947acacab5ea151291b861cdfbde16ff5cf1b08c Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 29 May 2023 18:32:41 +0200
+Subject: [PATCH 11/13] leds: trigger: netdev: expose netdev trigger modes in
+ linux include
+
+Expose netdev trigger modes to make them accessible by LED driver that
+will support netdev trigger for hw control.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/leds/trigger/ledtrig-netdev.c |  9 ---------
+ include/linux/leds.h                  | 10 ++++++++++
+ 2 files changed, 10 insertions(+), 9 deletions(-)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -56,15 +56,6 @@ struct led_netdev_data {
+ 	bool hw_control;
+ };
+ 
+-enum led_trigger_netdev_modes {
+-	TRIGGER_NETDEV_LINK = 0,
+-	TRIGGER_NETDEV_TX,
+-	TRIGGER_NETDEV_RX,
+-
+-	/* Keep last */
+-	__TRIGGER_NETDEV_MAX,
+-};
+-
+ static void set_baseline_state(struct led_netdev_data *trigger_data)
+ {
+ 	int current_brightness;
+--- a/include/linux/leds.h
++++ b/include/linux/leds.h
+@@ -527,6 +527,16 @@ static inline void *led_get_trigger_data
+ 
+ #endif /* CONFIG_LEDS_TRIGGERS */
+ 
++/* Trigger specific enum */
++enum led_trigger_netdev_modes {
++	TRIGGER_NETDEV_LINK = 0,
++	TRIGGER_NETDEV_TX,
++	TRIGGER_NETDEV_RX,
++
++	/* Keep last */
++	__TRIGGER_NETDEV_MAX,
++};
++
+ /* Trigger specific functions */
+ #ifdef CONFIG_LEDS_TRIGGER_DISK
+ void ledtrig_disk_activity(bool write);
diff --git a/target/linux/generic/backport-5.15/818-v6.5-12-net-dsa-qca8k-implement-hw_control-ops.patch b/target/linux/generic/backport-5.15/818-v6.5-12-net-dsa-qca8k-implement-hw_control-ops.patch
new file mode 100644
index 00000000000000..ad76d89b7bf842
--- /dev/null
+++ b/target/linux/generic/backport-5.15/818-v6.5-12-net-dsa-qca8k-implement-hw_control-ops.patch
@@ -0,0 +1,200 @@
+From e0256648c831af13cbfe4a1787327fcec01c2807 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 29 May 2023 18:32:42 +0200
+Subject: [PATCH 12/13] net: dsa: qca8k: implement hw_control ops
+
+Implement hw_control ops to drive Switch LEDs based on hardware events.
+
+Netdev trigger is the declared supported trigger for hw control
+operation and supports the following mode:
+- tx
+- rx
+
+When hw_control_set is called, LEDs are set to follow the requested
+mode.
+Each LEDs will blink at 4Hz by default.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca/qca8k-leds.c | 154 +++++++++++++++++++++++++++++++
+ 1 file changed, 154 insertions(+)
+
+--- a/drivers/net/dsa/qca/qca8k-leds.c
++++ b/drivers/net/dsa/qca/qca8k-leds.c
+@@ -32,6 +32,43 @@ qca8k_get_enable_led_reg(int port_num, i
+ }
+ 
+ static int
++qca8k_get_control_led_reg(int port_num, int led_num, struct qca8k_led_pattern_en *reg_info)
++{
++	reg_info->reg = QCA8K_LED_CTRL_REG(led_num);
++
++	/* 6 total control rule:
++	 * 3 control rules for phy0-3 that applies to all their leds
++	 * 3 control rules for phy4
++	 */
++	if (port_num == 4)
++		reg_info->shift = QCA8K_LED_PHY4_CONTROL_RULE_SHIFT;
++	else
++		reg_info->shift = QCA8K_LED_PHY0123_CONTROL_RULE_SHIFT;
++
++	return 0;
++}
++
++static int
++qca8k_parse_netdev(unsigned long rules, u32 *offload_trigger)
++{
++	/* Parsing specific to netdev trigger */
++	if (test_bit(TRIGGER_NETDEV_TX, &rules))
++		*offload_trigger |= QCA8K_LED_TX_BLINK_MASK;
++	if (test_bit(TRIGGER_NETDEV_RX, &rules))
++		*offload_trigger |= QCA8K_LED_RX_BLINK_MASK;
++
++	if (rules && !*offload_trigger)
++		return -EOPNOTSUPP;
++
++	/* Enable some default rule by default to the requested mode:
++	 * - Blink at 4Hz by default
++	 */
++	*offload_trigger |= QCA8K_LED_BLINK_4HZ;
++
++	return 0;
++}
++
++static int
+ qca8k_led_brightness_set(struct qca8k_led *led,
+ 			 enum led_brightness brightness)
+ {
+@@ -165,6 +202,119 @@ qca8k_cled_blink_set(struct led_classdev
+ }
+ 
+ static int
++qca8k_cled_trigger_offload(struct led_classdev *ldev, bool enable)
++{
++	struct qca8k_led *led = container_of(ldev, struct qca8k_led, cdev);
++
++	struct qca8k_led_pattern_en reg_info;
++	struct qca8k_priv *priv = led->priv;
++	u32 mask, val = QCA8K_LED_ALWAYS_OFF;
++
++	qca8k_get_enable_led_reg(led->port_num, led->led_num, &reg_info);
++
++	if (enable)
++		val = QCA8K_LED_RULE_CONTROLLED;
++
++	if (led->port_num == 0 || led->port_num == 4) {
++		mask = QCA8K_LED_PATTERN_EN_MASK;
++		val <<= QCA8K_LED_PATTERN_EN_SHIFT;
++	} else {
++		mask = QCA8K_LED_PHY123_PATTERN_EN_MASK;
++	}
++
++	return regmap_update_bits(priv->regmap, reg_info.reg, mask << reg_info.shift,
++				  val << reg_info.shift);
++}
++
++static bool
++qca8k_cled_hw_control_status(struct led_classdev *ldev)
++{
++	struct qca8k_led *led = container_of(ldev, struct qca8k_led, cdev);
++
++	struct qca8k_led_pattern_en reg_info;
++	struct qca8k_priv *priv = led->priv;
++	u32 val;
++
++	qca8k_get_enable_led_reg(led->port_num, led->led_num, &reg_info);
++
++	regmap_read(priv->regmap, reg_info.reg, &val);
++
++	val >>= reg_info.shift;
++
++	if (led->port_num == 0 || led->port_num == 4) {
++		val &= QCA8K_LED_PATTERN_EN_MASK;
++		val >>= QCA8K_LED_PATTERN_EN_SHIFT;
++	} else {
++		val &= QCA8K_LED_PHY123_PATTERN_EN_MASK;
++	}
++
++	return val == QCA8K_LED_RULE_CONTROLLED;
++}
++
++static int
++qca8k_cled_hw_control_is_supported(struct led_classdev *ldev, unsigned long rules)
++{
++	u32 offload_trigger = 0;
++
++	return qca8k_parse_netdev(rules, &offload_trigger);
++}
++
++static int
++qca8k_cled_hw_control_set(struct led_classdev *ldev, unsigned long rules)
++{
++	struct qca8k_led *led = container_of(ldev, struct qca8k_led, cdev);
++	struct qca8k_led_pattern_en reg_info;
++	struct qca8k_priv *priv = led->priv;
++	u32 offload_trigger = 0;
++	int ret;
++
++	ret = qca8k_parse_netdev(rules, &offload_trigger);
++	if (ret)
++		return ret;
++
++	ret = qca8k_cled_trigger_offload(ldev, true);
++	if (ret)
++		return ret;
++
++	qca8k_get_control_led_reg(led->port_num, led->led_num, &reg_info);
++
++	return regmap_update_bits(priv->regmap, reg_info.reg,
++				  QCA8K_LED_RULE_MASK << reg_info.shift,
++				  offload_trigger << reg_info.shift);
++}
++
++static int
++qca8k_cled_hw_control_get(struct led_classdev *ldev, unsigned long *rules)
++{
++	struct qca8k_led *led = container_of(ldev, struct qca8k_led, cdev);
++	struct qca8k_led_pattern_en reg_info;
++	struct qca8k_priv *priv = led->priv;
++	u32 val;
++	int ret;
++
++	/* With hw control not active return err */
++	if (!qca8k_cled_hw_control_status(ldev))
++		return -EINVAL;
++
++	qca8k_get_control_led_reg(led->port_num, led->led_num, &reg_info);
++
++	ret = regmap_read(priv->regmap, reg_info.reg, &val);
++	if (ret)
++		return ret;
++
++	val >>= reg_info.shift;
++	val &= QCA8K_LED_RULE_MASK;
++
++	/* Parsing specific to netdev trigger */
++	if (val & QCA8K_LED_TX_BLINK_MASK)
++		set_bit(TRIGGER_NETDEV_TX, rules);
++	if (val & QCA8K_LED_RX_BLINK_MASK)
++		set_bit(TRIGGER_NETDEV_RX, rules);
++
++	return 0;
++}
++
++static int
+ qca8k_parse_port_leds(struct qca8k_priv *priv, struct fwnode_handle *port, int port_num)
+ {
+ 	struct fwnode_handle *led = NULL, *leds = NULL;
+@@ -224,6 +374,10 @@ qca8k_parse_port_leds(struct qca8k_priv
+ 		port_led->cdev.max_brightness = 1;
+ 		port_led->cdev.brightness_set_blocking = qca8k_cled_brightness_set_blocking;
+ 		port_led->cdev.blink_set = qca8k_cled_blink_set;
++		port_led->cdev.hw_control_is_supported = qca8k_cled_hw_control_is_supported;
++		port_led->cdev.hw_control_set = qca8k_cled_hw_control_set;
++		port_led->cdev.hw_control_get = qca8k_cled_hw_control_get;
++		port_led->cdev.hw_control_trigger = "netdev";
+ 		init_data.default_label = ":port";
+ 		init_data.fwnode = led;
+ 		init_data.devname_mandatory = true;
diff --git a/target/linux/generic/backport-5.15/818-v6.5-13-net-dsa-qca8k-add-op-to-get-ports-netdev.patch b/target/linux/generic/backport-5.15/818-v6.5-13-net-dsa-qca8k-add-op-to-get-ports-netdev.patch
new file mode 100644
index 00000000000000..feb6b9e1e4e8e4
--- /dev/null
+++ b/target/linux/generic/backport-5.15/818-v6.5-13-net-dsa-qca8k-add-op-to-get-ports-netdev.patch
@@ -0,0 +1,70 @@
+From 4f53c27f772e27e4cf4e5507d6f4d5980002cb6a Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Mon, 29 May 2023 18:32:43 +0200
+Subject: [PATCH 13/13] net: dsa: qca8k: add op to get ports netdev
+
+In order that the LED trigger can blink the switch MAC ports LED, it
+needs to know the netdev associated to the port. Add the callback to
+return the struct device of the netdev.
+
+Add an helper function qca8k_phy_to_port() to convert the phy back to
+dsa_port index, as we reference LED port based on the internal PHY
+index and needs to be converted back.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca/qca8k-leds.c | 27 +++++++++++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+--- a/drivers/net/dsa/qca/qca8k-leds.c
++++ b/drivers/net/dsa/qca/qca8k-leds.c
+@@ -5,6 +5,18 @@
+ #include "qca8k.h"
+ #include "qca8k_leds.h"
+ 
++static u32 qca8k_phy_to_port(int phy)
++{
++	/* Internal PHY 0 has port at index 1.
++	 * Internal PHY 1 has port at index 2.
++	 * Internal PHY 2 has port at index 3.
++	 * Internal PHY 3 has port at index 4.
++	 * Internal PHY 4 has port at index 5.
++	 */
++
++	return phy + 1;
++}
++
+ static int
+ qca8k_get_enable_led_reg(int port_num, int led_num, struct qca8k_led_pattern_en *reg_info)
+ {
+@@ -314,6 +326,20 @@ qca8k_cled_hw_control_get(struct led_cla
+ 	return 0;
+ }
+ 
++static struct device *qca8k_cled_hw_control_get_device(struct led_classdev *ldev)
++{
++	struct qca8k_led *led = container_of(ldev, struct qca8k_led, cdev);
++	struct qca8k_priv *priv = led->priv;
++	struct dsa_port *dp;
++
++	dp = dsa_to_port(priv->ds, qca8k_phy_to_port(led->port_num));
++	if (!dp)
++		return NULL;
++	if (dp->slave)
++		return &dp->slave->dev;
++	return NULL;
++}
++
+ static int
+ qca8k_parse_port_leds(struct qca8k_priv *priv, struct fwnode_handle *port, int port_num)
+ {
+@@ -377,6 +403,7 @@ qca8k_parse_port_leds(struct qca8k_priv
+ 		port_led->cdev.hw_control_is_supported = qca8k_cled_hw_control_is_supported;
+ 		port_led->cdev.hw_control_set = qca8k_cled_hw_control_set;
+ 		port_led->cdev.hw_control_get = qca8k_cled_hw_control_get;
++		port_led->cdev.hw_control_get_device = qca8k_cled_hw_control_get_device;
+ 		port_led->cdev.hw_control_trigger = "netdev";
+ 		init_data.default_label = ":port";
+ 		init_data.fwnode = led;
diff --git a/target/linux/generic/backport-5.15/821-v5.16-Bluetooth-btusb-Support-public-address-configuration.patch b/target/linux/generic/backport-5.15/821-v5.16-Bluetooth-btusb-Support-public-address-configuration.patch
index feaabc9d11fed2..98687126487188 100644
--- a/target/linux/generic/backport-5.15/821-v5.16-Bluetooth-btusb-Support-public-address-configuration.patch
+++ b/target/linux/generic/backport-5.15/821-v5.16-Bluetooth-btusb-Support-public-address-configuration.patch
@@ -17,7 +17,7 @@ Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
 
 --- a/drivers/bluetooth/btusb.c
 +++ b/drivers/bluetooth/btusb.c
-@@ -2263,6 +2263,23 @@ struct btmtk_section_map {
+@@ -2272,6 +2272,23 @@ struct btmtk_section_map {
  	};
  } __packed;
  
@@ -41,7 +41,7 @@ Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
  static void btusb_mtk_wmt_recv(struct urb *urb)
  {
  	struct hci_dev *hdev = urb->context;
-@@ -3900,6 +3917,7 @@ static int btusb_probe(struct usb_interf
+@@ -3923,6 +3940,7 @@ static int btusb_probe(struct usb_interf
  		hdev->shutdown = btusb_mtk_shutdown;
  		hdev->manufacturer = 70;
  		hdev->cmd_timeout = btusb_mtk_cmd_timeout;
diff --git a/target/linux/generic/backport-5.15/822-v5.17-Bluetooth-btusb-Fix-application-of-sizeof-to-pointer.patch b/target/linux/generic/backport-5.15/822-v5.17-Bluetooth-btusb-Fix-application-of-sizeof-to-pointer.patch
index b324cb1aa80b20..cff537a86699ed 100644
--- a/target/linux/generic/backport-5.15/822-v5.17-Bluetooth-btusb-Fix-application-of-sizeof-to-pointer.patch
+++ b/target/linux/generic/backport-5.15/822-v5.17-Bluetooth-btusb-Fix-application-of-sizeof-to-pointer.patch
@@ -18,7 +18,7 @@ Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
 
 --- a/drivers/bluetooth/btusb.c
 +++ b/drivers/bluetooth/btusb.c
-@@ -2268,7 +2268,7 @@ static int btusb_set_bdaddr_mtk(struct h
+@@ -2277,7 +2277,7 @@ static int btusb_set_bdaddr_mtk(struct h
  	struct sk_buff *skb;
  	long ret;
  
diff --git a/target/linux/generic/backport-5.15/823-v5.18-Bluetooth-btusb-Add-a-new-PID-VID-13d3-3567-for-MT79.patch b/target/linux/generic/backport-5.15/823-v5.18-Bluetooth-btusb-Add-a-new-PID-VID-13d3-3567-for-MT79.patch
index 549005c5a76c98..d670195da1f2fa 100644
--- a/target/linux/generic/backport-5.15/823-v5.18-Bluetooth-btusb-Add-a-new-PID-VID-13d3-3567-for-MT79.patch
+++ b/target/linux/generic/backport-5.15/823-v5.18-Bluetooth-btusb-Add-a-new-PID-VID-13d3-3567-for-MT79.patch
@@ -58,7 +58,7 @@ Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
 
 --- a/drivers/bluetooth/btusb.c
 +++ b/drivers/bluetooth/btusb.c
-@@ -460,6 +460,9 @@ static const struct usb_device_id blackl
+@@ -464,6 +464,9 @@ static const struct usb_device_id blackl
  	{ USB_DEVICE(0x13d3, 0x3564), .driver_info = BTUSB_MEDIATEK |
  						     BTUSB_WIDEBAND_SPEECH |
  						     BTUSB_VALID_LE_STATES },
diff --git a/target/linux/generic/backport-5.15/824-v5.19-Bluetooth-btusb-Add-a-new-PID-VID-0489-e0c8-for-MT79.patch b/target/linux/generic/backport-5.15/824-v5.19-Bluetooth-btusb-Add-a-new-PID-VID-0489-e0c8-for-MT79.patch
index 54e3388860c1e1..be9dc734215194 100644
--- a/target/linux/generic/backport-5.15/824-v5.19-Bluetooth-btusb-Add-a-new-PID-VID-0489-e0c8-for-MT79.patch
+++ b/target/linux/generic/backport-5.15/824-v5.19-Bluetooth-btusb-Add-a-new-PID-VID-0489-e0c8-for-MT79.patch
@@ -56,7 +56,7 @@ Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
 
 --- a/drivers/bluetooth/btusb.c
 +++ b/drivers/bluetooth/btusb.c
-@@ -451,6 +451,9 @@ static const struct usb_device_id blackl
+@@ -455,6 +455,9 @@ static const struct usb_device_id blackl
  						     BTUSB_VALID_LE_STATES },
  
  	/* Additional MediaTek MT7921 Bluetooth devices */
diff --git a/target/linux/generic/backport-5.15/825-v6.1-Bluetooth-btusb-Add-a-new-VID-PID-0e8d-0608-for-MT79.patch b/target/linux/generic/backport-5.15/825-v6.1-Bluetooth-btusb-Add-a-new-VID-PID-0e8d-0608-for-MT79.patch
new file mode 100644
index 00000000000000..24ec68a2ca50b8
--- /dev/null
+++ b/target/linux/generic/backport-5.15/825-v6.1-Bluetooth-btusb-Add-a-new-VID-PID-0e8d-0608-for-MT79.patch
@@ -0,0 +1,66 @@
+From be55622ce673f9692cc15d26d77a050cda42a3d3 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Fri, 9 Sep 2022 21:00:30 +0100
+Subject: [PATCH 1/1] Bluetooth: btusb: Add a new VID/PID 0e8d/0608 for MT7921
+
+Add a new PID/VID 0e8d/0608 for MT7921K chip found on AMD RZ608 module.
+
+From /sys/kernel/debug/usb/devices:
+T:  Bus=01 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#=  3 Spd=480  MxCh= 0
+D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=0e8d ProdID=0608 Rev= 1.00
+S:  Manufacturer=MediaTek Inc.
+S:  Product=Wireless_Device
+S:  SerialNumber=000000000
+C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA
+A:  FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=125us
+E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+I:  If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  63 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  63 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E:  Ad=8a(I) Atr=03(Int.) MxPS=  64 Ivl=125us
+E:  Ad=0a(O) Atr=03(Int.) MxPS=  64 Ivl=125us
+I:  If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E:  Ad=8a(I) Atr=03(Int.) MxPS=  64 Ivl=125us
+E:  Ad=0a(O) Atr=03(Int.) MxPS=  64 Ivl=125us
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+---
+ drivers/bluetooth/btusb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -473,6 +473,9 @@ static const struct usb_device_id blackl
+ 	{ USB_DEVICE(0x0489, 0xe0cd), .driver_info = BTUSB_MEDIATEK |
+ 						     BTUSB_WIDEBAND_SPEECH |
+ 						     BTUSB_VALID_LE_STATES },
++	{ USB_DEVICE(0x0e8d, 0x0608), .driver_info = BTUSB_MEDIATEK |
++						     BTUSB_WIDEBAND_SPEECH |
++						     BTUSB_VALID_LE_STATES },
+ 
+ 	/* MediaTek MT7922A Bluetooth devices */
+ 	{ USB_DEVICE(0x0489, 0xe0d8), .driver_info = BTUSB_MEDIATEK |
diff --git a/target/linux/generic/backport-5.15/826-v5.17-of-base-make-small-of_parse_phandle-variants-static-.patch b/target/linux/generic/backport-5.15/826-v5.17-of-base-make-small-of_parse_phandle-variants-static-.patch
new file mode 100644
index 00000000000000..b00cf5741991d0
--- /dev/null
+++ b/target/linux/generic/backport-5.15/826-v5.17-of-base-make-small-of_parse_phandle-variants-static-.patch
@@ -0,0 +1,359 @@
+From 66a8f7f04979f4ad739085f01d99c8caf620b4f5 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Tue, 18 Jan 2022 18:35:02 +0100
+Subject: [PATCH] of: base: make small of_parse_phandle() variants static
+ inline
+
+Make all the smaller variants of the of_parse_phandle() static inline.
+This also let us remove the empty function stubs if CONFIG_OF is not
+defined.
+
+Suggested-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Michael Walle <michael@walle.cc>
+[robh: move index < 0 check into __of_parse_phandle_with_args]
+Signed-off-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20220118173504.2867523-2-michael@walle.cc
+---
+ drivers/of/base.c  | 131 +++------------------------------------
+ include/linux/of.h | 148 ++++++++++++++++++++++++++++++++++++---------
+ 2 files changed, 129 insertions(+), 150 deletions(-)
+
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -1371,15 +1371,18 @@ int of_phandle_iterator_args(struct of_p
+ 	return count;
+ }
+ 
+-static int __of_parse_phandle_with_args(const struct device_node *np,
+-					const char *list_name,
+-					const char *cells_name,
+-					int cell_count, int index,
+-					struct of_phandle_args *out_args)
++int __of_parse_phandle_with_args(const struct device_node *np,
++				 const char *list_name,
++				 const char *cells_name,
++				 int cell_count, int index,
++				 struct of_phandle_args *out_args)
+ {
+ 	struct of_phandle_iterator it;
+ 	int rc, cur_index = 0;
+ 
++	if (index < 0)
++		return -EINVAL;
++
+ 	/* Loop over the phandles until all the requested entry is found */
+ 	of_for_each_phandle(&it, rc, np, list_name, cells_name, cell_count) {
+ 		/*
+@@ -1422,82 +1425,7 @@ static int __of_parse_phandle_with_args(
+ 	of_node_put(it.node);
+ 	return rc;
+ }
+-
+-/**
+- * of_parse_phandle - Resolve a phandle property to a device_node pointer
+- * @np: Pointer to device node holding phandle property
+- * @phandle_name: Name of property holding a phandle value
+- * @index: For properties holding a table of phandles, this is the index into
+- *         the table
+- *
+- * Return: The device_node pointer with refcount incremented.  Use
+- * of_node_put() on it when done.
+- */
+-struct device_node *of_parse_phandle(const struct device_node *np,
+-				     const char *phandle_name, int index)
+-{
+-	struct of_phandle_args args;
+-
+-	if (index < 0)
+-		return NULL;
+-
+-	if (__of_parse_phandle_with_args(np, phandle_name, NULL, 0,
+-					 index, &args))
+-		return NULL;
+-
+-	return args.np;
+-}
+-EXPORT_SYMBOL(of_parse_phandle);
+-
+-/**
+- * of_parse_phandle_with_args() - Find a node pointed by phandle in a list
+- * @np:		pointer to a device tree node containing a list
+- * @list_name:	property name that contains a list
+- * @cells_name:	property name that specifies phandles' arguments count
+- * @index:	index of a phandle to parse out
+- * @out_args:	optional pointer to output arguments structure (will be filled)
+- *
+- * This function is useful to parse lists of phandles and their arguments.
+- * Returns 0 on success and fills out_args, on error returns appropriate
+- * errno value.
+- *
+- * Caller is responsible to call of_node_put() on the returned out_args->np
+- * pointer.
+- *
+- * Example::
+- *
+- *  phandle1: node1 {
+- *	#list-cells = <2>;
+- *  };
+- *
+- *  phandle2: node2 {
+- *	#list-cells = <1>;
+- *  };
+- *
+- *  node3 {
+- *	list = <&phandle1 1 2 &phandle2 3>;
+- *  };
+- *
+- * To get a device_node of the ``node2`` node you may call this:
+- * of_parse_phandle_with_args(node3, "list", "#list-cells", 1, &args);
+- */
+-int of_parse_phandle_with_args(const struct device_node *np, const char *list_name,
+-				const char *cells_name, int index,
+-				struct of_phandle_args *out_args)
+-{
+-	int cell_count = -1;
+-
+-	if (index < 0)
+-		return -EINVAL;
+-
+-	/* If cells_name is NULL we assume a cell count of 0 */
+-	if (!cells_name)
+-		cell_count = 0;
+-
+-	return __of_parse_phandle_with_args(np, list_name, cells_name,
+-					    cell_count, index, out_args);
+-}
+-EXPORT_SYMBOL(of_parse_phandle_with_args);
++EXPORT_SYMBOL(__of_parse_phandle_with_args);
+ 
+ /**
+  * of_parse_phandle_with_args_map() - Find a node pointed by phandle in a list and remap it
+@@ -1684,47 +1612,6 @@ free:
+ EXPORT_SYMBOL(of_parse_phandle_with_args_map);
+ 
+ /**
+- * of_parse_phandle_with_fixed_args() - Find a node pointed by phandle in a list
+- * @np:		pointer to a device tree node containing a list
+- * @list_name:	property name that contains a list
+- * @cell_count: number of argument cells following the phandle
+- * @index:	index of a phandle to parse out
+- * @out_args:	optional pointer to output arguments structure (will be filled)
+- *
+- * This function is useful to parse lists of phandles and their arguments.
+- * Returns 0 on success and fills out_args, on error returns appropriate
+- * errno value.
+- *
+- * Caller is responsible to call of_node_put() on the returned out_args->np
+- * pointer.
+- *
+- * Example::
+- *
+- *  phandle1: node1 {
+- *  };
+- *
+- *  phandle2: node2 {
+- *  };
+- *
+- *  node3 {
+- *  	list = <&phandle1 0 2 &phandle2 2 3>;
+- *  };
+- *
+- * To get a device_node of the ``node2`` node you may call this:
+- * of_parse_phandle_with_fixed_args(node3, "list", 2, 1, &args);
+- */
+-int of_parse_phandle_with_fixed_args(const struct device_node *np,
+-				const char *list_name, int cell_count,
+-				int index, struct of_phandle_args *out_args)
+-{
+-	if (index < 0)
+-		return -EINVAL;
+-	return __of_parse_phandle_with_args(np, list_name, NULL, cell_count,
+-					   index, out_args);
+-}
+-EXPORT_SYMBOL(of_parse_phandle_with_fixed_args);
+-
+-/**
+  * of_count_phandle_with_args() - Find the number of phandles references in a property
+  * @np:		pointer to a device tree node containing a list
+  * @list_name:	property name that contains a list
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -363,18 +363,12 @@ extern const struct of_device_id *of_mat
+ 	const struct of_device_id *matches, const struct device_node *node);
+ extern int of_modalias_node(struct device_node *node, char *modalias, int len);
+ extern void of_print_phandle_args(const char *msg, const struct of_phandle_args *args);
+-extern struct device_node *of_parse_phandle(const struct device_node *np,
+-					    const char *phandle_name,
+-					    int index);
+-extern int of_parse_phandle_with_args(const struct device_node *np,
+-	const char *list_name, const char *cells_name, int index,
+-	struct of_phandle_args *out_args);
++extern int __of_parse_phandle_with_args(const struct device_node *np,
++	const char *list_name, const char *cells_name, int cell_count,
++	int index, struct of_phandle_args *out_args);
+ extern int of_parse_phandle_with_args_map(const struct device_node *np,
+ 	const char *list_name, const char *stem_name, int index,
+ 	struct of_phandle_args *out_args);
+-extern int of_parse_phandle_with_fixed_args(const struct device_node *np,
+-	const char *list_name, int cells_count, int index,
+-	struct of_phandle_args *out_args);
+ extern int of_count_phandle_with_args(const struct device_node *np,
+ 	const char *list_name, const char *cells_name);
+ 
+@@ -864,18 +858,12 @@ static inline int of_property_read_strin
+ 	return -ENOSYS;
+ }
+ 
+-static inline struct device_node *of_parse_phandle(const struct device_node *np,
+-						   const char *phandle_name,
+-						   int index)
+-{
+-	return NULL;
+-}
+-
+-static inline int of_parse_phandle_with_args(const struct device_node *np,
+-					     const char *list_name,
+-					     const char *cells_name,
+-					     int index,
+-					     struct of_phandle_args *out_args)
++static inline int __of_parse_phandle_with_args(const struct device_node *np,
++					       const char *list_name,
++					       const char *cells_name,
++					       int cell_count,
++					       int index,
++					       struct of_phandle_args *out_args)
+ {
+ 	return -ENOSYS;
+ }
+@@ -889,13 +877,6 @@ static inline int of_parse_phandle_with_
+ 	return -ENOSYS;
+ }
+ 
+-static inline int of_parse_phandle_with_fixed_args(const struct device_node *np,
+-	const char *list_name, int cells_count, int index,
+-	struct of_phandle_args *out_args)
+-{
+-	return -ENOSYS;
+-}
+-
+ static inline int of_count_phandle_with_args(const struct device_node *np,
+ 					     const char *list_name,
+ 					     const char *cells_name)
+@@ -1077,6 +1058,117 @@ static inline bool of_node_is_type(const
+ }
+ 
+ /**
++ * of_parse_phandle - Resolve a phandle property to a device_node pointer
++ * @np: Pointer to device node holding phandle property
++ * @phandle_name: Name of property holding a phandle value
++ * @index: For properties holding a table of phandles, this is the index into
++ *         the table
++ *
++ * Return: The device_node pointer with refcount incremented.  Use
++ * of_node_put() on it when done.
++ */
++static inline struct device_node *of_parse_phandle(const struct device_node *np,
++						   const char *phandle_name,
++						   int index)
++{
++	struct of_phandle_args args;
++
++	if (__of_parse_phandle_with_args(np, phandle_name, NULL, 0,
++					 index, &args))
++		return NULL;
++
++	return args.np;
++}
++
++/**
++ * of_parse_phandle_with_args() - Find a node pointed by phandle in a list
++ * @np:		pointer to a device tree node containing a list
++ * @list_name:	property name that contains a list
++ * @cells_name:	property name that specifies phandles' arguments count
++ * @index:	index of a phandle to parse out
++ * @out_args:	optional pointer to output arguments structure (will be filled)
++ *
++ * This function is useful to parse lists of phandles and their arguments.
++ * Returns 0 on success and fills out_args, on error returns appropriate
++ * errno value.
++ *
++ * Caller is responsible to call of_node_put() on the returned out_args->np
++ * pointer.
++ *
++ * Example::
++ *
++ *  phandle1: node1 {
++ *	#list-cells = <2>;
++ *  };
++ *
++ *  phandle2: node2 {
++ *	#list-cells = <1>;
++ *  };
++ *
++ *  node3 {
++ *	list = <&phandle1 1 2 &phandle2 3>;
++ *  };
++ *
++ * To get a device_node of the ``node2`` node you may call this:
++ * of_parse_phandle_with_args(node3, "list", "#list-cells", 1, &args);
++ */
++static inline int of_parse_phandle_with_args(const struct device_node *np,
++					     const char *list_name,
++					     const char *cells_name,
++					     int index,
++					     struct of_phandle_args *out_args)
++{
++	int cell_count = -1;
++
++	/* If cells_name is NULL we assume a cell count of 0 */
++	if (!cells_name)
++		cell_count = 0;
++
++	return __of_parse_phandle_with_args(np, list_name, cells_name,
++					    cell_count, index, out_args);
++}
++
++/**
++ * of_parse_phandle_with_fixed_args() - Find a node pointed by phandle in a list
++ * @np:		pointer to a device tree node containing a list
++ * @list_name:	property name that contains a list
++ * @cell_count: number of argument cells following the phandle
++ * @index:	index of a phandle to parse out
++ * @out_args:	optional pointer to output arguments structure (will be filled)
++ *
++ * This function is useful to parse lists of phandles and their arguments.
++ * Returns 0 on success and fills out_args, on error returns appropriate
++ * errno value.
++ *
++ * Caller is responsible to call of_node_put() on the returned out_args->np
++ * pointer.
++ *
++ * Example::
++ *
++ *  phandle1: node1 {
++ *  };
++ *
++ *  phandle2: node2 {
++ *  };
++ *
++ *  node3 {
++ *	list = <&phandle1 0 2 &phandle2 2 3>;
++ *  };
++ *
++ * To get a device_node of the ``node2`` node you may call this:
++ * of_parse_phandle_with_fixed_args(node3, "list", 2, 1, &args);
++ */
++static inline int of_parse_phandle_with_fixed_args(const struct device_node *np,
++						   const char *list_name,
++						   int cell_count,
++						   int index,
++						   struct of_phandle_args *out_args)
++{
++	return __of_parse_phandle_with_args(np, list_name, NULL, cell_count,
++					    index, out_args);
++}
++
++/**
+  * of_property_count_u8_elems - Count the number of u8 elements in a property
+  *
+  * @np:		device node from which the property value is to be read.
diff --git a/target/linux/generic/backport-5.15/827-v6.3-0001-of-base-add-of_parse_phandle_with_optional_args.patch b/target/linux/generic/backport-5.15/827-v6.3-0001-of-base-add-of_parse_phandle_with_optional_args.patch
new file mode 100644
index 00000000000000..2b2a60e096bef2
--- /dev/null
+++ b/target/linux/generic/backport-5.15/827-v6.3-0001-of-base-add-of_parse_phandle_with_optional_args.patch
@@ -0,0 +1,58 @@
+From c5d264d4b527c96ae8903376a4b195df47b05203 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Mon, 6 Feb 2023 13:43:43 +0000
+Subject: [PATCH] of: base: add of_parse_phandle_with_optional_args()
+
+Add a new variant of the of_parse_phandle_with_args() which treats the
+cells name as optional. If it's missing, it is assumed that the phandle
+has no arguments.
+
+Up until now, a nvmem node didn't have any arguments, so all the device
+trees haven't any '#*-cells' property. But there is a need for an
+additional argument for the phandle, for which we need a '#*-cells'
+property. Therefore, we need to support nvmem nodes with and without
+this property.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-10-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/of.h | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -1169,6 +1169,31 @@ static inline int of_parse_phandle_with_
+ }
+ 
+ /**
++ * of_parse_phandle_with_optional_args() - Find a node pointed by phandle in a list
++ * @np:		pointer to a device tree node containing a list
++ * @list_name:	property name that contains a list
++ * @cells_name:	property name that specifies phandles' arguments count
++ * @index:	index of a phandle to parse out
++ * @out_args:	optional pointer to output arguments structure (will be filled)
++ *
++ * Same as of_parse_phandle_with_args() except that if the cells_name property
++ * is not found, cell_count of 0 is assumed.
++ *
++ * This is used to useful, if you have a phandle which didn't have arguments
++ * before and thus doesn't have a '#*-cells' property but is now migrated to
++ * having arguments while retaining backwards compatibility.
++ */
++static inline int of_parse_phandle_with_optional_args(const struct device_node *np,
++						      const char *list_name,
++						      const char *cells_name,
++						      int index,
++						      struct of_phandle_args *out_args)
++{
++	return __of_parse_phandle_with_args(np, list_name, cells_name,
++					    0, index, out_args);
++}
++
++/**
+  * of_property_count_u8_elems - Count the number of u8 elements in a property
+  *
+  * @np:		device node from which the property value is to be read.
diff --git a/target/linux/generic/backport-5.15/827-v6.3-0002-of-property-make-.-cells-optional-for-simple-props.patch b/target/linux/generic/backport-5.15/827-v6.3-0002-of-property-make-.-cells-optional-for-simple-props.patch
new file mode 100644
index 00000000000000..39d9fae7239af5
--- /dev/null
+++ b/target/linux/generic/backport-5.15/827-v6.3-0002-of-property-make-.-cells-optional-for-simple-props.patch
@@ -0,0 +1,34 @@
+From ff24fed10ba414d19579e26e60b126fad2f2bb07 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Mon, 6 Feb 2023 13:43:44 +0000
+Subject: [PATCH] of: property: make #.*-cells optional for simple props
+
+Sometimes, future bindings for phandles will get additional arguments.
+Thus the target node of the phandle will need a new #.*-cells property.
+To be backwards compatible, this needs to be optional.
+
+Prepare the DEFINE_SIMPLE_PROPS() to handle the cells name as optional.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Tested-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-11-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/of/property.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/of/property.c
++++ b/drivers/of/property.c
+@@ -1173,8 +1173,8 @@ static struct device_node *parse_prop_ce
+ 	if (strcmp(prop_name, list_name))
+ 		return NULL;
+ 
+-	if (of_parse_phandle_with_args(np, list_name, cells_name, index,
+-				       &sup_args))
++	if (__of_parse_phandle_with_args(np, list_name, cells_name, 0, index,
++					 &sup_args))
+ 		return NULL;
+ 
+ 	return sup_args.np;
diff --git a/target/linux/generic/backport-5.15/827-v6.3-0003-of-property-add-nvmem-cell-cells-property.patch b/target/linux/generic/backport-5.15/827-v6.3-0003-of-property-add-nvmem-cell-cells-property.patch
new file mode 100644
index 00000000000000..774e793ca5a62c
--- /dev/null
+++ b/target/linux/generic/backport-5.15/827-v6.3-0003-of-property-add-nvmem-cell-cells-property.patch
@@ -0,0 +1,30 @@
+From e2d8172043d2e50df19fcd59c11e5593de8188d7 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Mon, 6 Feb 2023 13:43:45 +0000
+Subject: [PATCH] of: property: add #nvmem-cell-cells property
+
+Bindings describe the new '#nvmem-cell-cells' property. Now that the
+arguments count property is optional, we just add this property to the
+nvmem-cells.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Tested-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-12-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/of/property.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/of/property.c
++++ b/drivers/of/property.c
+@@ -1276,7 +1276,7 @@ DEFINE_SIMPLE_PROP(dmas, "dmas", "#dma-c
+ DEFINE_SIMPLE_PROP(power_domains, "power-domains", "#power-domain-cells")
+ DEFINE_SIMPLE_PROP(hwlocks, "hwlocks", "#hwlock-cells")
+ DEFINE_SIMPLE_PROP(extcon, "extcon", NULL)
+-DEFINE_SIMPLE_PROP(nvmem_cells, "nvmem-cells", NULL)
++DEFINE_SIMPLE_PROP(nvmem_cells, "nvmem-cells", "#nvmem-cell-cells")
+ DEFINE_SIMPLE_PROP(phys, "phys", "#phy-cells")
+ DEFINE_SIMPLE_PROP(wakeup_parent, "wakeup-parent", NULL)
+ DEFINE_SIMPLE_PROP(pinctrl0, "pinctrl-0", NULL)
diff --git a/target/linux/generic/backport-5.15/827-v6.3-0004-of-device-Ignore-modalias-of-reused-nodes.patch b/target/linux/generic/backport-5.15/827-v6.3-0004-of-device-Ignore-modalias-of-reused-nodes.patch
new file mode 100644
index 00000000000000..37eefc4570f9cc
--- /dev/null
+++ b/target/linux/generic/backport-5.15/827-v6.3-0004-of-device-Ignore-modalias-of-reused-nodes.patch
@@ -0,0 +1,37 @@
+From 553bd29700145e1849698985e9800f14e967da49 Mon Sep 17 00:00:00 2001
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+Date: Tue, 7 Feb 2023 12:05:29 +0100
+Subject: [PATCH] of: device: Ignore modalias of reused nodes
+
+If of_node is reused, do not use that node's modalias. This will hide
+the name of the actual device. This is rather prominent in USB glue
+drivers creating a platform device for the host controller.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20230207110531.1060252-2-alexander.stein@ew.tq-group.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/of/device.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -249,7 +249,7 @@ static ssize_t of_device_get_modalias(st
+ 	ssize_t csize;
+ 	ssize_t tsize;
+ 
+-	if ((!dev) || (!dev->of_node))
++	if ((!dev) || (!dev->of_node) || dev->of_node_reused)
+ 		return -ENODEV;
+ 
+ 	/* Name & Type */
+@@ -372,7 +372,7 @@ int of_device_uevent_modalias(struct dev
+ {
+ 	int sl;
+ 
+-	if ((!dev) || (!dev->of_node))
++	if ((!dev) || (!dev->of_node) || dev->of_node_reused)
+ 		return -ENODEV;
+ 
+ 	/* Devicetree modalias is tricky, we add it in 2 steps */
diff --git a/target/linux/generic/backport-5.15/827-v6.3-0005-of-device-Do-not-ignore-error-code-in-of_device_ueve.patch b/target/linux/generic/backport-5.15/827-v6.3-0005-of-device-Do-not-ignore-error-code-in-of_device_ueve.patch
new file mode 100644
index 00000000000000..dd5820e94a5067
--- /dev/null
+++ b/target/linux/generic/backport-5.15/827-v6.3-0005-of-device-Do-not-ignore-error-code-in-of_device_ueve.patch
@@ -0,0 +1,29 @@
+From 2295bed9bebe8d1eef276194fed5b5fbe89c5363 Mon Sep 17 00:00:00 2001
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+Date: Tue, 7 Feb 2023 12:05:30 +0100
+Subject: [PATCH] of: device: Do not ignore error code in
+ of_device_uevent_modalias
+
+of_device_get_modalias might return an error code, propagate that one.
+Otherwise the negative, signed integer is propagated to unsigned integer
+for the comparison resulting in a huge 'sl' size.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20230207110531.1060252-3-alexander.stein@ew.tq-group.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/of/device.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -381,6 +381,8 @@ int of_device_uevent_modalias(struct dev
+ 
+ 	sl = of_device_get_modalias(dev, &env->buf[env->buflen-1],
+ 				    sizeof(env->buf) - env->buflen);
++	if (sl < 0)
++		return sl;
+ 	if (sl >= (sizeof(env->buf) - env->buflen))
+ 		return -ENOMEM;
+ 	env->buflen += sl;
diff --git a/target/linux/generic/backport-5.15/828-v6.4-0002-of-Update-of_device_get_modalias.patch b/target/linux/generic/backport-5.15/828-v6.4-0002-of-Update-of_device_get_modalias.patch
new file mode 100644
index 00000000000000..4713cc71b1291c
--- /dev/null
+++ b/target/linux/generic/backport-5.15/828-v6.4-0002-of-Update-of_device_get_modalias.patch
@@ -0,0 +1,103 @@
+From 5c3d15e127ebfc0754cd18def7124633b6d46672 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:15 +0100
+Subject: [PATCH] of: Update of_device_get_modalias()
+
+This function only needs a "struct device_node" to work, but for
+convenience the author (and only user) of this helper did use a "struct
+device" and put it in device.c.
+
+Let's convert this helper to take a "struct device node" instead. This
+change asks for two additional changes: renaming it "of_modalias()"
+to fit the current naming, and moving it outside of device.c which will
+be done in a follow-up commit.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-8-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/of/device.c | 29 +++++++++++++++++------------
+ 1 file changed, 17 insertions(+), 12 deletions(-)
+
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -241,7 +241,7 @@ const void *of_device_get_match_data(con
+ }
+ EXPORT_SYMBOL(of_device_get_match_data);
+ 
+-static ssize_t of_device_get_modalias(struct device *dev, char *str, ssize_t len)
++static ssize_t of_modalias(const struct device_node *np, char *str, ssize_t len)
+ {
+ 	const char *compat;
+ 	char *c;
+@@ -249,19 +249,16 @@ static ssize_t of_device_get_modalias(st
+ 	ssize_t csize;
+ 	ssize_t tsize;
+ 
+-	if ((!dev) || (!dev->of_node) || dev->of_node_reused)
+-		return -ENODEV;
+-
+ 	/* Name & Type */
+ 	/* %p eats all alphanum characters, so %c must be used here */
+-	csize = snprintf(str, len, "of:N%pOFn%c%s", dev->of_node, 'T',
+-			 of_node_get_device_type(dev->of_node));
++	csize = snprintf(str, len, "of:N%pOFn%c%s", np, 'T',
++			 of_node_get_device_type(np));
+ 	tsize = csize;
+ 	len -= csize;
+ 	if (str)
+ 		str += csize;
+ 
+-	of_property_for_each_string(dev->of_node, "compatible", p, compat) {
++	of_property_for_each_string(np, "compatible", p, compat) {
+ 		csize = strlen(compat) + 1;
+ 		tsize += csize;
+ 		if (csize > len)
+@@ -286,7 +283,10 @@ int of_device_request_module(struct devi
+ 	ssize_t size;
+ 	int ret;
+ 
+-	size = of_device_get_modalias(dev, NULL, 0);
++	if (!dev || !dev->of_node)
++		return -ENODEV;
++
++	size = of_modalias(dev->of_node, NULL, 0);
+ 	if (size < 0)
+ 		return size;
+ 
+@@ -297,7 +297,7 @@ int of_device_request_module(struct devi
+ 	if (!str)
+ 		return -ENOMEM;
+ 
+-	of_device_get_modalias(dev, str, size);
++	of_modalias(dev->of_node, str, size);
+ 	str[size - 1] = '\0';
+ 	ret = request_module(str);
+ 	kfree(str);
+@@ -314,7 +314,12 @@ EXPORT_SYMBOL_GPL(of_device_request_modu
+  */
+ ssize_t of_device_modalias(struct device *dev, char *str, ssize_t len)
+ {
+-	ssize_t sl = of_device_get_modalias(dev, str, len - 2);
++	ssize_t sl;
++
++	if (!dev || !dev->of_node || dev->of_node_reused)
++		return -ENODEV;
++
++	sl = of_modalias(dev->of_node, str, len - 2);
+ 	if (sl < 0)
+ 		return sl;
+ 	if (sl > len - 2)
+@@ -379,8 +384,8 @@ int of_device_uevent_modalias(struct dev
+ 	if (add_uevent_var(env, "MODALIAS="))
+ 		return -ENOMEM;
+ 
+-	sl = of_device_get_modalias(dev, &env->buf[env->buflen-1],
+-				    sizeof(env->buf) - env->buflen);
++	sl = of_modalias(dev->of_node, &env->buf[env->buflen-1],
++			 sizeof(env->buf) - env->buflen);
+ 	if (sl < 0)
+ 		return sl;
+ 	if (sl >= (sizeof(env->buf) - env->buflen))
diff --git a/target/linux/generic/backport-5.15/828-v6.4-0003-of-Rename-of_modalias_node.patch b/target/linux/generic/backport-5.15/828-v6.4-0003-of-Rename-of_modalias_node.patch
new file mode 100644
index 00000000000000..6c205217018b52
--- /dev/null
+++ b/target/linux/generic/backport-5.15/828-v6.4-0003-of-Rename-of_modalias_node.patch
@@ -0,0 +1,173 @@
+From 673aa1ed1c9b6710bf24e3f0957d85e2f46c77db Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:16 +0100
+Subject: [PATCH] of: Rename of_modalias_node()
+
+This helper does not produce a real modalias, but tries to get the
+"product" compatible part of the "vendor,product" compatibles only. It
+is far from creating a purely useful modalias string and does not seem
+to be used like that directly anyway, so let's try to give this helper a
+more meaningful name before moving there a real modalias helper (already
+existing under of/device.c).
+
+Also update the various documentations to refer to the strings as
+"aliases" rather than "modaliases" which has a real meaning in the Linux
+kernel.
+
+There is no functional change.
+
+Cc: Rafael J. Wysocki <rafael@kernel.org>
+Cc: Len Brown <lenb@kernel.org>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Maxime Ripard <mripard@kernel.org>
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Cc: Sebastian Reichel <sre@kernel.org>
+Cc: Wolfram Sang <wsa@kernel.org>
+Cc: Mark Brown <broonie@kernel.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Acked-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Acked-by: Sebastian Reichel <sre@kernel.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-9-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/bus.c                |  7 ++++---
+ drivers/gpu/drm/drm_mipi_dsi.c    |  2 +-
+ drivers/hsi/hsi_core.c            |  2 +-
+ drivers/i2c/busses/i2c-powermac.c |  2 +-
+ drivers/i2c/i2c-core-of.c         |  2 +-
+ drivers/of/base.c                 | 18 +++++++++++-------
+ drivers/spi/spi.c                 |  4 ++--
+ include/linux/of.h                |  3 ++-
+ 8 files changed, 23 insertions(+), 17 deletions(-)
+
+--- a/drivers/acpi/bus.c
++++ b/drivers/acpi/bus.c
+@@ -785,9 +785,10 @@ static bool acpi_of_modalias(struct acpi
+  * @modalias:   Pointer to buffer that modalias value will be copied into
+  * @len:	Length of modalias buffer
+  *
+- * This is a counterpart of of_modalias_node() for struct acpi_device objects.
+- * If there is a compatible string for @adev, it will be copied to @modalias
+- * with the vendor prefix stripped; otherwise, @default_id will be used.
++ * This is a counterpart of of_alias_from_compatible() for struct acpi_device
++ * objects. If there is a compatible string for @adev, it will be copied to
++ * @modalias with the vendor prefix stripped; otherwise, @default_id will be
++ * used.
+  */
+ void acpi_set_modalias(struct acpi_device *adev, const char *default_id,
+ 		       char *modalias, size_t len)
+--- a/drivers/gpu/drm/drm_mipi_dsi.c
++++ b/drivers/gpu/drm/drm_mipi_dsi.c
+@@ -160,7 +160,7 @@ of_mipi_dsi_device_add(struct mipi_dsi_h
+ 	int ret;
+ 	u32 reg;
+ 
+-	if (of_modalias_node(node, info.type, sizeof(info.type)) < 0) {
++	if (of_alias_from_compatible(node, info.type, sizeof(info.type)) < 0) {
+ 		drm_err(host, "modalias failure on %pOF\n", node);
+ 		return ERR_PTR(-EINVAL);
+ 	}
+--- a/drivers/hsi/hsi_core.c
++++ b/drivers/hsi/hsi_core.c
+@@ -207,7 +207,7 @@ static void hsi_add_client_from_dt(struc
+ 	if (!cl)
+ 		return;
+ 
+-	err = of_modalias_node(client, name, sizeof(name));
++	err = of_alias_from_compatible(client, name, sizeof(name));
+ 	if (err)
+ 		goto err;
+ 
+--- a/drivers/i2c/busses/i2c-powermac.c
++++ b/drivers/i2c/busses/i2c-powermac.c
+@@ -284,7 +284,7 @@ static bool i2c_powermac_get_type(struct
+ 	 */
+ 
+ 	/* First try proper modalias */
+-	if (of_modalias_node(node, tmp, sizeof(tmp)) >= 0) {
++	if (of_alias_from_compatible(node, tmp, sizeof(tmp)) >= 0) {
+ 		snprintf(type, type_size, "MAC,%s", tmp);
+ 		return true;
+ 	}
+--- a/drivers/i2c/i2c-core-of.c
++++ b/drivers/i2c/i2c-core-of.c
+@@ -27,7 +27,7 @@ int of_i2c_get_board_info(struct device
+ 
+ 	memset(info, 0, sizeof(*info));
+ 
+-	if (of_modalias_node(node, info->type, sizeof(info->type)) < 0) {
++	if (of_alias_from_compatible(node, info->type, sizeof(info->type)) < 0) {
+ 		dev_err(dev, "of_i2c: modalias failure on %pOF\n", node);
+ 		return -EINVAL;
+ 	}
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -1159,19 +1159,23 @@ struct device_node *of_find_matching_nod
+ EXPORT_SYMBOL(of_find_matching_node_and_match);
+ 
+ /**
+- * of_modalias_node - Lookup appropriate modalias for a device node
++ * of_alias_from_compatible - Lookup appropriate alias for a device node
++ *			      depending on compatible
+  * @node:	pointer to a device tree node
+- * @modalias:	Pointer to buffer that modalias value will be copied into
+- * @len:	Length of modalias value
++ * @alias:	Pointer to buffer that alias value will be copied into
++ * @len:	Length of alias value
+  *
+  * Based on the value of the compatible property, this routine will attempt
+- * to choose an appropriate modalias value for a particular device tree node.
++ * to choose an appropriate alias value for a particular device tree node.
+  * It does this by stripping the manufacturer prefix (as delimited by a ',')
+  * from the first entry in the compatible list property.
+  *
++ * Note: The matching on just the "product" side of the compatible is a relic
++ * from I2C and SPI. Please do not add any new user.
++ *
+  * Return: This routine returns 0 on success, <0 on failure.
+  */
+-int of_modalias_node(struct device_node *node, char *modalias, int len)
++int of_alias_from_compatible(const struct device_node *node, char *alias, int len)
+ {
+ 	const char *compatible, *p;
+ 	int cplen;
+@@ -1180,10 +1184,10 @@ int of_modalias_node(struct device_node
+ 	if (!compatible || strlen(compatible) > cplen)
+ 		return -ENODEV;
+ 	p = strchr(compatible, ',');
+-	strlcpy(modalias, p ? p + 1 : compatible, len);
++	strlcpy(alias, p ? p + 1 : compatible, len);
+ 	return 0;
+ }
+-EXPORT_SYMBOL_GPL(of_modalias_node);
++EXPORT_SYMBOL_GPL(of_alias_from_compatible);
+ 
+ /**
+  * of_find_node_by_phandle - Find a node given a phandle
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -2128,8 +2128,8 @@ of_register_spi_device(struct spi_contro
+ 	}
+ 
+ 	/* Select device driver */
+-	rc = of_modalias_node(nc, spi->modalias,
+-				sizeof(spi->modalias));
++	rc = of_alias_from_compatible(nc, spi->modalias,
++				      sizeof(spi->modalias));
+ 	if (rc < 0) {
+ 		dev_err(&ctlr->dev, "cannot find modalias for %pOF\n", nc);
+ 		goto err_out;
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -361,7 +361,8 @@ extern int of_n_addr_cells(struct device
+ extern int of_n_size_cells(struct device_node *np);
+ extern const struct of_device_id *of_match_node(
+ 	const struct of_device_id *matches, const struct device_node *node);
+-extern int of_modalias_node(struct device_node *node, char *modalias, int len);
++extern int of_alias_from_compatible(const struct device_node *node, char *alias,
++				    int len);
+ extern void of_print_phandle_args(const char *msg, const struct of_phandle_args *args);
+ extern int __of_parse_phandle_with_args(const struct device_node *np,
+ 	const char *list_name, const char *cells_name, int cell_count,
diff --git a/target/linux/generic/backport-5.15/828-v6.4-0004-of-Move-of_modalias-to-module.c.patch b/target/linux/generic/backport-5.15/828-v6.4-0004-of-Move-of_modalias-to-module.c.patch
new file mode 100644
index 00000000000000..a70c6f2eec8cd7
--- /dev/null
+++ b/target/linux/generic/backport-5.15/828-v6.4-0004-of-Move-of_modalias-to-module.c.patch
@@ -0,0 +1,160 @@
+From bd7a7ed774afd1a4174df34227626c95573be517 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:17 +0100
+Subject: [PATCH] of: Move of_modalias() to module.c
+
+Create a specific .c file for OF related module handling.
+Move of_modalias() inside as a first step.
+
+The helper is exposed through of.h even though it is only used by core
+files because the users from device.c will soon be split into an OF-only
+helper in module.c as well as a device-oriented inline helper in
+of_device.h. Putting this helper in of_private.h would require to
+include of_private.h from of_device.h, which is not acceptable.
+
+Suggested-by: Rob Herring <robh+dt@kernel.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-10-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/of/Makefile |  2 +-
+ drivers/of/device.c | 37 -------------------------------------
+ drivers/of/module.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
+ include/linux/of.h  |  9 +++++++++
+ 4 files changed, 54 insertions(+), 38 deletions(-)
+ create mode 100644 drivers/of/module.c
+
+--- a/drivers/of/Makefile
++++ b/drivers/of/Makefile
+@@ -1,5 +1,5 @@
+ # SPDX-License-Identifier: GPL-2.0
+-obj-y = base.o device.o platform.o property.o
++obj-y = base.o device.o module.o platform.o property.o
+ obj-$(CONFIG_OF_KOBJ) += kobj.o
+ obj-$(CONFIG_OF_DYNAMIC) += dynamic.o
+ obj-$(CONFIG_OF_FLATTREE) += fdt.o
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -1,5 +1,4 @@
+ // SPDX-License-Identifier: GPL-2.0
+-#include <linux/string.h>
+ #include <linux/kernel.h>
+ #include <linux/of.h>
+ #include <linux/of_device.h>
+@@ -241,42 +240,6 @@ const void *of_device_get_match_data(con
+ }
+ EXPORT_SYMBOL(of_device_get_match_data);
+ 
+-static ssize_t of_modalias(const struct device_node *np, char *str, ssize_t len)
+-{
+-	const char *compat;
+-	char *c;
+-	struct property *p;
+-	ssize_t csize;
+-	ssize_t tsize;
+-
+-	/* Name & Type */
+-	/* %p eats all alphanum characters, so %c must be used here */
+-	csize = snprintf(str, len, "of:N%pOFn%c%s", np, 'T',
+-			 of_node_get_device_type(np));
+-	tsize = csize;
+-	len -= csize;
+-	if (str)
+-		str += csize;
+-
+-	of_property_for_each_string(np, "compatible", p, compat) {
+-		csize = strlen(compat) + 1;
+-		tsize += csize;
+-		if (csize > len)
+-			continue;
+-
+-		csize = snprintf(str, len, "C%s", compat);
+-		for (c = str; c; ) {
+-			c = strchr(c, ' ');
+-			if (c)
+-				*c++ = '_';
+-		}
+-		len -= csize;
+-		str += csize;
+-	}
+-
+-	return tsize;
+-}
+-
+ int of_device_request_module(struct device *dev)
+ {
+ 	char *str;
+--- /dev/null
++++ b/drivers/of/module.c
+@@ -0,0 +1,44 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Linux kernel module helpers.
++ */
++
++#include <linux/of.h>
++#include <linux/slab.h>
++#include <linux/string.h>
++
++ssize_t of_modalias(const struct device_node *np, char *str, ssize_t len)
++{
++	const char *compat;
++	char *c;
++	struct property *p;
++	ssize_t csize;
++	ssize_t tsize;
++
++	/* Name & Type */
++	/* %p eats all alphanum characters, so %c must be used here */
++	csize = snprintf(str, len, "of:N%pOFn%c%s", np, 'T',
++			 of_node_get_device_type(np));
++	tsize = csize;
++	len -= csize;
++	if (str)
++		str += csize;
++
++	of_property_for_each_string(np, "compatible", p, compat) {
++		csize = strlen(compat) + 1;
++		tsize += csize;
++		if (csize > len)
++			continue;
++
++		csize = snprintf(str, len, "C%s", compat);
++		for (c = str; c; ) {
++			c = strchr(c, ' ');
++			if (c)
++				*c++ = '_';
++		}
++		len -= csize;
++		str += csize;
++	}
++
++	return tsize;
++}
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -373,6 +373,9 @@ extern int of_parse_phandle_with_args_ma
+ extern int of_count_phandle_with_args(const struct device_node *np,
+ 	const char *list_name, const char *cells_name);
+ 
++/* module functions */
++extern ssize_t of_modalias(const struct device_node *np, char *str, ssize_t len);
++
+ /* phandle iterator functions */
+ extern int of_phandle_iterator_init(struct of_phandle_iterator *it,
+ 				    const struct device_node *np,
+@@ -885,6 +888,12 @@ static inline int of_count_phandle_with_
+ 	return -ENOSYS;
+ }
+ 
++static inline ssize_t of_modalias(const struct device_node *np, char *str,
++				  ssize_t len)
++{
++	return -ENODEV;
++}
++
+ static inline int of_phandle_iterator_init(struct of_phandle_iterator *it,
+ 					   const struct device_node *np,
+ 					   const char *list_name,
diff --git a/target/linux/generic/backport-5.15/828-v6.4-0005-of-Move-the-request-module-helper-logic-to-module.c.patch b/target/linux/generic/backport-5.15/828-v6.4-0005-of-Move-the-request-module-helper-logic-to-module.c.patch
new file mode 100644
index 00000000000000..06bc24ca6e3753
--- /dev/null
+++ b/target/linux/generic/backport-5.15/828-v6.4-0005-of-Move-the-request-module-helper-logic-to-module.c.patch
@@ -0,0 +1,131 @@
+From e6506f06d5e82765666902ccf9e9162f3e31d518 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:18 +0100
+Subject: [PATCH] of: Move the request module helper logic to module.c
+
+Depending on device.c for pure OF handling is considered
+backwards. Let's extract the content of of_device_request_module() to
+have the real logic under module.c.
+
+The next step will be to convert users of of_device_request_module() to
+use the new helper.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-11-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/of/device.c | 25 ++-----------------------
+ drivers/of/module.c | 30 ++++++++++++++++++++++++++++++
+ include/linux/of.h  |  6 ++++++
+ 3 files changed, 38 insertions(+), 23 deletions(-)
+
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -8,7 +8,6 @@
+ #include <linux/dma-direct.h> /* for bus_dma_region */
+ #include <linux/dma-map-ops.h>
+ #include <linux/init.h>
+-#include <linux/module.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/slab.h>
+ #include <linux/platform_device.h>
+@@ -242,30 +241,10 @@ EXPORT_SYMBOL(of_device_get_match_data);
+ 
+ int of_device_request_module(struct device *dev)
+ {
+-	char *str;
+-	ssize_t size;
+-	int ret;
+-
+-	if (!dev || !dev->of_node)
++	if (!dev)
+ 		return -ENODEV;
+ 
+-	size = of_modalias(dev->of_node, NULL, 0);
+-	if (size < 0)
+-		return size;
+-
+-	/* Reserve an additional byte for the trailing '\0' */
+-	size++;
+-
+-	str = kmalloc(size, GFP_KERNEL);
+-	if (!str)
+-		return -ENOMEM;
+-
+-	of_modalias(dev->of_node, str, size);
+-	str[size - 1] = '\0';
+-	ret = request_module(str);
+-	kfree(str);
+-
+-	return ret;
++	return of_request_module(dev->of_node);
+ }
+ EXPORT_SYMBOL_GPL(of_device_request_module);
+ 
+--- a/drivers/of/module.c
++++ b/drivers/of/module.c
+@@ -4,6 +4,7 @@
+  */
+ 
+ #include <linux/of.h>
++#include <linux/module.h>
+ #include <linux/slab.h>
+ #include <linux/string.h>
+ 
+@@ -42,3 +43,32 @@ ssize_t of_modalias(const struct device_
+ 
+ 	return tsize;
+ }
++
++int of_request_module(const struct device_node *np)
++{
++	char *str;
++	ssize_t size;
++	int ret;
++
++	if (!np)
++		return -ENODEV;
++
++	size = of_modalias(np, NULL, 0);
++	if (size < 0)
++		return size;
++
++	/* Reserve an additional byte for the trailing '\0' */
++	size++;
++
++	str = kmalloc(size, GFP_KERNEL);
++	if (!str)
++		return -ENOMEM;
++
++	of_modalias(np, str, size);
++	str[size - 1] = '\0';
++	ret = request_module(str);
++	kfree(str);
++
++	return ret;
++}
++EXPORT_SYMBOL_GPL(of_request_module);
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -375,6 +375,7 @@ extern int of_count_phandle_with_args(co
+ 
+ /* module functions */
+ extern ssize_t of_modalias(const struct device_node *np, char *str, ssize_t len);
++extern int of_request_module(const struct device_node *np);
+ 
+ /* phandle iterator functions */
+ extern int of_phandle_iterator_init(struct of_phandle_iterator *it,
+@@ -893,6 +894,11 @@ static inline ssize_t of_modalias(const
+ {
+ 	return -ENODEV;
+ }
++
++static inline int of_request_module(const struct device_node *np)
++{
++	return -ENODEV;
++}
+ 
+ static inline int of_phandle_iterator_init(struct of_phandle_iterator *it,
+ 					   const struct device_node *np,
diff --git a/target/linux/generic/backport-5.15/870-v5.18-hwmon-lm70-Add-ti-tmp125-support.patch b/target/linux/generic/backport-5.15/870-v5.18-hwmon-lm70-Add-ti-tmp125-support.patch
new file mode 100644
index 00000000000000..fabf177628f058
--- /dev/null
+++ b/target/linux/generic/backport-5.15/870-v5.18-hwmon-lm70-Add-ti-tmp125-support.patch
@@ -0,0 +1,71 @@
+From 31d8f414e1596ba54a4315418e4c0086fda9e428 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@gmail.com>
+Date: Fri, 18 Feb 2022 10:06:43 +0100
+Subject: hwmon: (lm70) Add ti,tmp125 support
+
+The TMP125 is a 2 degree Celsius accurate Digital
+Temperature Sensor with a SPI interface.
+
+The temperature register is a 16-bit, read-only register.
+The MSB (Bit 15) is a leading zero and never set. Bits 14
+to 5 are the 1+9 temperature data bits in a two's
+complement format. Bits 4 to 0 are useless copies of
+Bit 5 value and therefore ignored.
+
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+Link: https://lore.kernel.org/r/43b19cbd4e7f51e9509e561b02b5d8d0e7079fac.1645175187.git.chunkeey@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+---
+--- a/drivers/hwmon/lm70.c
++++ b/drivers/hwmon/lm70.c
+@@ -34,6 +34,7 @@
+ #define LM70_CHIP_LM71		2	/* NS LM71 */
+ #define LM70_CHIP_LM74		3	/* NS LM74 */
+ #define LM70_CHIP_TMP122	4	/* TI TMP122/TMP124 */
++#define LM70_CHIP_TMP125	5	/* TI TMP125 */
+ 
+ struct lm70 {
+ 	struct spi_device *spi;
+@@ -87,6 +88,12 @@ static ssize_t temp1_input_show(struct d
+ 	 * LM71:
+ 	 * 14 bits of 2's complement data, discard LSB 2 bits,
+ 	 * resolution 0.0312 degrees celsius.
++	 *
++	 * TMP125:
++	 * MSB/D15 is a leading zero. D14 is the sign-bit. This is
++	 * followed by 9 temperature bits (D13..D5) in 2's complement
++	 * data format with a resolution of 0.25 degrees celsius per unit.
++	 * LSB 5 bits (D4..D0) share the same value as D5 and get discarded.
+ 	 */
+ 	switch (p_lm70->chip) {
+ 	case LM70_CHIP_LM70:
+@@ -102,6 +109,10 @@ static ssize_t temp1_input_show(struct d
+ 	case LM70_CHIP_LM71:
+ 		val = ((int)raw / 4) * 3125 / 100;
+ 		break;
++
++	case LM70_CHIP_TMP125:
++		val = (sign_extend32(raw, 14) / 32) * 250;
++		break;
+ 	}
+ 
+ 	status = sprintf(buf, "%d\n", val); /* millidegrees Celsius */
+@@ -136,6 +147,10 @@ static const struct of_device_id lm70_of
+ 		.data = (void *) LM70_CHIP_TMP122,
+ 	},
+ 	{
++		.compatible = "ti,tmp125",
++		.data = (void *) LM70_CHIP_TMP125,
++	},
++	{
+ 		.compatible = "ti,lm71",
+ 		.data = (void *) LM70_CHIP_LM71,
+ 	},
+@@ -184,6 +199,7 @@ static const struct spi_device_id lm70_i
+ 	{ "lm70",   LM70_CHIP_LM70 },
+ 	{ "tmp121", LM70_CHIP_TMP121 },
+ 	{ "tmp122", LM70_CHIP_TMP122 },
++	{ "tmp125", LM70_CHIP_TMP125 },
+ 	{ "lm71",   LM70_CHIP_LM71 },
+ 	{ "lm74",   LM70_CHIP_LM74 },
+ 	{ },
diff --git a/target/linux/generic/backport-5.15/881-v5.19-rndis_host-enable-the-bogus-MAC-fixup-for-ZTE-device.patch b/target/linux/generic/backport-5.15/881-v5.19-rndis_host-enable-the-bogus-MAC-fixup-for-ZTE-device.patch
index 7da2280cd9bdaa..71a6df81020ad5 100644
--- a/target/linux/generic/backport-5.15/881-v5.19-rndis_host-enable-the-bogus-MAC-fixup-for-ZTE-device.patch
+++ b/target/linux/generic/backport-5.15/881-v5.19-rndis_host-enable-the-bogus-MAC-fixup-for-ZTE-device.patch
@@ -38,7 +38,7 @@ Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
 
 --- a/drivers/net/usb/rndis_host.c
 +++ b/drivers/net/usb/rndis_host.c
-@@ -485,10 +485,14 @@ EXPORT_SYMBOL_GPL(rndis_unbind);
+@@ -486,10 +486,14 @@ EXPORT_SYMBOL_GPL(rndis_unbind);
   */
  int rndis_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
  {
@@ -53,7 +53,7 @@ Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
  	/* peripheral may have batched packets to us... */
  	while (likely(skb->len)) {
  		struct rndis_data_hdr	*hdr = (void *)skb->data;
-@@ -523,10 +527,17 @@ int rndis_rx_fixup(struct usbnet *dev, s
+@@ -524,10 +528,17 @@ int rndis_rx_fixup(struct usbnet *dev, s
  			break;
  		skb_pull(skb, msg_len - sizeof *hdr);
  		skb_trim(skb2, data_len);
@@ -71,7 +71,7 @@ Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
  	return 1;
  }
  EXPORT_SYMBOL_GPL(rndis_rx_fixup);
-@@ -600,6 +611,17 @@ static const struct driver_info	rndis_po
+@@ -601,6 +612,17 @@ static const struct driver_info	rndis_po
  	.tx_fixup =	rndis_tx_fixup,
  };
  
@@ -89,7 +89,7 @@ Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
  /*-------------------------------------------------------------------------*/
  
  static const struct usb_device_id	products [] = {
-@@ -614,6 +636,16 @@ static const struct usb_device_id	produc
+@@ -615,6 +637,16 @@ static const struct usb_device_id	produc
  				      USB_CLASS_COMM, 2 /* ACM */, 0x0ff),
  	.driver_info = (unsigned long)&rndis_info,
  }, {
diff --git a/target/linux/generic/backport-5.15/882-v5.19-rndis_host-limit-scope-of-bogus-MAC-address-detectio.patch b/target/linux/generic/backport-5.15/882-v5.19-rndis_host-limit-scope-of-bogus-MAC-address-detectio.patch
index ebe7a43fd3b33f..bdd812cc906c13 100644
--- a/target/linux/generic/backport-5.15/882-v5.19-rndis_host-limit-scope-of-bogus-MAC-address-detectio.patch
+++ b/target/linux/generic/backport-5.15/882-v5.19-rndis_host-limit-scope-of-bogus-MAC-address-detectio.patch
@@ -23,7 +23,7 @@ Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
 
 --- a/drivers/net/usb/rndis_host.c
 +++ b/drivers/net/usb/rndis_host.c
-@@ -418,10 +418,7 @@ generic_rndis_bind(struct usbnet *dev, s
+@@ -419,10 +419,7 @@ generic_rndis_bind(struct usbnet *dev, s
  		goto halt_fail_and_release;
  	}
  
@@ -35,7 +35,7 @@ Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
  
  	/* set a nonzero filter to enable data transfers */
  	memset(u.set, 0, sizeof *u.set);
-@@ -463,6 +460,16 @@ static int rndis_bind(struct usbnet *dev
+@@ -464,6 +461,16 @@ static int rndis_bind(struct usbnet *dev
  	return generic_rndis_bind(dev, intf, FLAG_RNDIS_PHYM_NOT_WIRELESS);
  }
  
@@ -52,7 +52,7 @@ Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
  void rndis_unbind(struct usbnet *dev, struct usb_interface *intf)
  {
  	struct rndis_halt	*halt;
-@@ -615,7 +622,7 @@ static const struct driver_info	zte_rndi
+@@ -616,7 +623,7 @@ static const struct driver_info	zte_rndi
  	.description =	"ZTE RNDIS device",
  	.flags =	FLAG_ETHER | FLAG_POINTTOPOINT | FLAG_FRAMING_RN | FLAG_NO_SETINT,
  	.data =		RNDIS_DRIVER_DATA_DST_MAC_FIXUP,
diff --git a/target/linux/generic/backport-5.15/890-v6.1-mtd-spinand-winbond-fix-flash-detection.patch b/target/linux/generic/backport-5.15/890-v6.1-mtd-spinand-winbond-fix-flash-detection.patch
new file mode 100644
index 00000000000000..38fbc3a3d73f33
--- /dev/null
+++ b/target/linux/generic/backport-5.15/890-v6.1-mtd-spinand-winbond-fix-flash-detection.patch
@@ -0,0 +1,40 @@
+From dbf70fc204d2fbb0d8ad8f42038a60846502efda Mon Sep 17 00:00:00 2001
+From: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Date: Mon, 10 Oct 2022 13:51:09 +0300
+Subject: [PATCH] mtd: spinand: winbond: fix flash identification
+
+Winbond uses 3 bytes to identify flash: vendor_id, dev_id_0, dev_id_1,
+but current driver uses only first 2 bytes of it for devices
+identification. As result Winbond W25N02KV flash (id_bytes: EF, AA, 22)
+is identified as W25N01GV (id_bytes: EF, AA, 21).
+
+Fix this by adding missed identification bytes.
+
+Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Reviewed-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20221010105110.446674-1-mikhail.kshevetskiy@iopsys.eu
+---
+ drivers/mtd/nand/spi/winbond.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/mtd/nand/spi/winbond.c
++++ b/drivers/mtd/nand/spi/winbond.c
+@@ -76,7 +76,7 @@ static int w25m02gv_select_target(struct
+ 
+ static const struct spinand_info winbond_spinand_table[] = {
+ 	SPINAND_INFO("W25M02GV",
+-		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xab),
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xab, 0x21),
+ 		     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 2),
+ 		     NAND_ECCREQ(1, 512),
+ 		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
+@@ -86,7 +86,7 @@ static const struct spinand_info winbond
+ 		     SPINAND_ECCINFO(&w25m02gv_ooblayout, NULL),
+ 		     SPINAND_SELECT_TARGET(w25m02gv_select_target)),
+ 	SPINAND_INFO("W25N01GV",
+-		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xaa),
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xaa, 0x21),
+ 		     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
+ 		     NAND_ECCREQ(1, 512),
+ 		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
diff --git a/target/linux/generic/backport-5.15/891-v6.1-mtd-spinand-winbond-add-W25N02KV.patch b/target/linux/generic/backport-5.15/891-v6.1-mtd-spinand-winbond-add-W25N02KV.patch
new file mode 100644
index 00000000000000..d75a1acc57c765
--- /dev/null
+++ b/target/linux/generic/backport-5.15/891-v6.1-mtd-spinand-winbond-add-W25N02KV.patch
@@ -0,0 +1,106 @@
+From 6154c7a583483d7b69f53bea868efdc369edd563 Mon Sep 17 00:00:00 2001
+From: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Date: Mon, 10 Oct 2022 13:51:10 +0300
+Subject: [PATCH] mtd: spinand: winbond: add Winbond W25N02KV flash support
+
+Add support of Winbond W25N02KV flash
+
+Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Reviewed-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20221010105110.446674-2-mikhail.kshevetskiy@iopsys.eu
+---
+ drivers/mtd/nand/spi/winbond.c | 75 ++++++++++++++++++++++++++++++++++
+ 1 file changed, 75 insertions(+)
+
+--- a/drivers/mtd/nand/spi/winbond.c
++++ b/drivers/mtd/nand/spi/winbond.c
+@@ -74,6 +74,72 @@ static int w25m02gv_select_target(struct
+ 	return spi_mem_exec_op(spinand->spimem, &op);
+ }
+ 
++static int w25n02kv_ooblayout_ecc(struct mtd_info *mtd, int section,
++				  struct mtd_oob_region *region)
++{
++	if (section > 3)
++		return -ERANGE;
++
++	region->offset = 64 + (16 * section);
++	region->length = 13;
++
++	return 0;
++}
++
++static int w25n02kv_ooblayout_free(struct mtd_info *mtd, int section,
++				   struct mtd_oob_region *region)
++{
++	if (section > 3)
++		return -ERANGE;
++
++	region->offset = (16 * section) + 2;
++	region->length = 14;
++
++	return 0;
++}
++
++static const struct mtd_ooblayout_ops w25n02kv_ooblayout = {
++	.ecc = w25n02kv_ooblayout_ecc,
++	.free = w25n02kv_ooblayout_free,
++};
++
++static int w25n02kv_ecc_get_status(struct spinand_device *spinand,
++				   u8 status)
++{
++	struct nand_device *nand = spinand_to_nand(spinand);
++	u8 mbf = 0;
++	struct spi_mem_op op = SPINAND_GET_FEATURE_OP(0x30, &mbf);
++
++	switch (status & STATUS_ECC_MASK) {
++	case STATUS_ECC_NO_BITFLIPS:
++		return 0;
++
++	case STATUS_ECC_UNCOR_ERROR:
++		return -EBADMSG;
++
++	case STATUS_ECC_HAS_BITFLIPS:
++		/*
++		 * Let's try to retrieve the real maximum number of bitflips
++		 * in order to avoid forcing the wear-leveling layer to move
++		 * data around if it's not necessary.
++		 */
++		if (spi_mem_exec_op(spinand->spimem, &op))
++			return nanddev_get_ecc_conf(nand)->strength;
++
++		mbf >>= 4;
++
++		if (WARN_ON(mbf > nanddev_get_ecc_conf(nand)->strength || !mbf))
++			return nanddev_get_ecc_conf(nand)->strength;
++
++		return mbf;
++
++	default:
++		break;
++	}
++
++	return -EINVAL;
++}
++
+ static const struct spinand_info winbond_spinand_table[] = {
+ 	SPINAND_INFO("W25M02GV",
+ 		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xab, 0x21),
+@@ -94,6 +160,15 @@ static const struct spinand_info winbond
+ 					      &update_cache_variants),
+ 		     0,
+ 		     SPINAND_ECCINFO(&w25m02gv_ooblayout, NULL)),
++	SPINAND_INFO("W25N02KV",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xaa, 0x22),
++		     NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     0,
++		     SPINAND_ECCINFO(&w25n02kv_ooblayout, w25n02kv_ecc_get_status)),
+ };
+ 
+ static int winbond_spinand_init(struct spinand_device *spinand)
diff --git a/target/linux/generic/backport-6.1/020-v6.3-01-UPSTREAM-mm-multi-gen-LRU-rename-lru_gen_struct-to-l.patch b/target/linux/generic/backport-6.1/020-v6.3-01-UPSTREAM-mm-multi-gen-LRU-rename-lru_gen_struct-to-l.patch
new file mode 100644
index 00000000000000..9d21f8de22fd68
--- /dev/null
+++ b/target/linux/generic/backport-6.1/020-v6.3-01-UPSTREAM-mm-multi-gen-LRU-rename-lru_gen_struct-to-l.patch
@@ -0,0 +1,352 @@
+From 8c20e2eb5f2a0175b774134685e4d7bd93e85ff8 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Wed, 21 Dec 2022 21:18:59 -0700
+Subject: [PATCH 01/19] UPSTREAM: mm: multi-gen LRU: rename lru_gen_struct to
+ lru_gen_folio
+
+Patch series "mm: multi-gen LRU: memcg LRU", v3.
+
+Overview
+========
+
+An memcg LRU is a per-node LRU of memcgs.  It is also an LRU of LRUs,
+since each node and memcg combination has an LRU of folios (see
+mem_cgroup_lruvec()).
+
+Its goal is to improve the scalability of global reclaim, which is
+critical to system-wide memory overcommit in data centers.  Note that
+memcg reclaim is currently out of scope.
+
+Its memory bloat is a pointer to each lruvec and negligible to each
+pglist_data.  In terms of traversing memcgs during global reclaim, it
+improves the best-case complexity from O(n) to O(1) and does not affect
+the worst-case complexity O(n).  Therefore, on average, it has a sublinear
+complexity in contrast to the current linear complexity.
+
+The basic structure of an memcg LRU can be understood by an analogy to
+the active/inactive LRU (of folios):
+1. It has the young and the old (generations), i.e., the counterparts
+   to the active and the inactive;
+2. The increment of max_seq triggers promotion, i.e., the counterpart
+   to activation;
+3. Other events trigger similar operations, e.g., offlining an memcg
+   triggers demotion, i.e., the counterpart to deactivation.
+
+In terms of global reclaim, it has two distinct features:
+1. Sharding, which allows each thread to start at a random memcg (in
+   the old generation) and improves parallelism;
+2. Eventual fairness, which allows direct reclaim to bail out at will
+   and reduces latency without affecting fairness over some time.
+
+The commit message in patch 6 details the workflow:
+https://lore.kernel.org/r/20221222041905.2431096-7-yuzhao@google.com/
+
+The following is a simple test to quickly verify its effectiveness.
+
+  Test design:
+  1. Create multiple memcgs.
+  2. Each memcg contains a job (fio).
+  3. All jobs access the same amount of memory randomly.
+  4. The system does not experience global memory pressure.
+  5. Periodically write to the root memory.reclaim.
+
+  Desired outcome:
+  1. All memcgs have similar pgsteal counts, i.e., stddev(pgsteal)
+     over mean(pgsteal) is close to 0%.
+  2. The total pgsteal is close to the total requested through
+     memory.reclaim, i.e., sum(pgsteal) over sum(requested) is close
+     to 100%.
+
+  Actual outcome [1]:
+                                     MGLRU off    MGLRU on
+  stddev(pgsteal) / mean(pgsteal)    75%          20%
+  sum(pgsteal) / sum(requested)      425%         95%
+
+  ####################################################################
+  MEMCGS=128
+
+  for ((memcg = 0; memcg < $MEMCGS; memcg++)); do
+      mkdir /sys/fs/cgroup/memcg$memcg
+  done
+
+  start() {
+      echo $BASHPID > /sys/fs/cgroup/memcg$memcg/cgroup.procs
+
+      fio -name=memcg$memcg --numjobs=1 --ioengine=mmap \
+          --filename=/dev/zero --size=1920M --rw=randrw \
+          --rate=64m,64m --random_distribution=random \
+          --fadvise_hint=0 --time_based --runtime=10h \
+          --group_reporting --minimal
+  }
+
+  for ((memcg = 0; memcg < $MEMCGS; memcg++)); do
+      start &
+  done
+
+  sleep 600
+
+  for ((i = 0; i < 600; i++)); do
+      echo 256m >/sys/fs/cgroup/memory.reclaim
+      sleep 6
+  done
+
+  for ((memcg = 0; memcg < $MEMCGS; memcg++)); do
+      grep "pgsteal " /sys/fs/cgroup/memcg$memcg/memory.stat
+  done
+  ####################################################################
+
+[1]: This was obtained from running the above script (touches less
+     than 256GB memory) on an EPYC 7B13 with 512GB DRAM for over an
+     hour.
+
+This patch (of 8):
+
+The new name lru_gen_folio will be more distinct from the coming
+lru_gen_memcg.
+
+Link: https://lkml.kernel.org/r/20221222041905.2431096-1-yuzhao@google.com
+Link: https://lkml.kernel.org/r/20221222041905.2431096-2-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Roman Gushchin <roman.gushchin@linux.dev>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Bug: 274865848
+(cherry picked from commit 391655fe08d1f942359a11148aa9aaf3f99d6d6f)
+Change-Id: I7df67e0e2435ba28f10eaa57d28d98b61a9210a6
+Signed-off-by: T.J. Mercier <tjmercier@google.com>
+---
+ include/linux/mm_inline.h |  4 ++--
+ include/linux/mmzone.h    |  6 +++---
+ mm/vmscan.c               | 34 +++++++++++++++++-----------------
+ mm/workingset.c           |  4 ++--
+ 4 files changed, 24 insertions(+), 24 deletions(-)
+
+--- a/include/linux/mm_inline.h
++++ b/include/linux/mm_inline.h
+@@ -178,7 +178,7 @@ static inline void lru_gen_update_size(s
+ 	int zone = folio_zonenum(folio);
+ 	int delta = folio_nr_pages(folio);
+ 	enum lru_list lru = type * LRU_INACTIVE_FILE;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_folio *lrugen = &lruvec->lrugen;
+ 
+ 	VM_WARN_ON_ONCE(old_gen != -1 && old_gen >= MAX_NR_GENS);
+ 	VM_WARN_ON_ONCE(new_gen != -1 && new_gen >= MAX_NR_GENS);
+@@ -224,7 +224,7 @@ static inline bool lru_gen_add_folio(str
+ 	int gen = folio_lru_gen(folio);
+ 	int type = folio_is_file_lru(folio);
+ 	int zone = folio_zonenum(folio);
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_folio *lrugen = &lruvec->lrugen;
+ 
+ 	VM_WARN_ON_ONCE_FOLIO(gen != -1, folio);
+ 
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -404,7 +404,7 @@ enum {
+  * The number of pages in each generation is eventually consistent and therefore
+  * can be transiently negative when reset_batch_size() is pending.
+  */
+-struct lru_gen_struct {
++struct lru_gen_folio {
+ 	/* the aging increments the youngest generation number */
+ 	unsigned long max_seq;
+ 	/* the eviction increments the oldest generation numbers */
+@@ -461,7 +461,7 @@ struct lru_gen_mm_state {
+ struct lru_gen_mm_walk {
+ 	/* the lruvec under reclaim */
+ 	struct lruvec *lruvec;
+-	/* unstable max_seq from lru_gen_struct */
++	/* unstable max_seq from lru_gen_folio */
+ 	unsigned long max_seq;
+ 	/* the next address within an mm to scan */
+ 	unsigned long next_addr;
+@@ -524,7 +524,7 @@ struct lruvec {
+ 	unsigned long			flags;
+ #ifdef CONFIG_LRU_GEN
+ 	/* evictable pages divided into generations */
+-	struct lru_gen_struct		lrugen;
++	struct lru_gen_folio		lrugen;
+ 	/* to concurrently iterate lru_gen_mm_list */
+ 	struct lru_gen_mm_state		mm_state;
+ #endif
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -3190,7 +3190,7 @@ static int get_nr_gens(struct lruvec *lr
+ 
+ static bool __maybe_unused seq_is_valid(struct lruvec *lruvec)
+ {
+-	/* see the comment on lru_gen_struct */
++	/* see the comment on lru_gen_folio */
+ 	return get_nr_gens(lruvec, LRU_GEN_FILE) >= MIN_NR_GENS &&
+ 	       get_nr_gens(lruvec, LRU_GEN_FILE) <= get_nr_gens(lruvec, LRU_GEN_ANON) &&
+ 	       get_nr_gens(lruvec, LRU_GEN_ANON) <= MAX_NR_GENS;
+@@ -3596,7 +3596,7 @@ struct ctrl_pos {
+ static void read_ctrl_pos(struct lruvec *lruvec, int type, int tier, int gain,
+ 			  struct ctrl_pos *pos)
+ {
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_folio *lrugen = &lruvec->lrugen;
+ 	int hist = lru_hist_from_seq(lrugen->min_seq[type]);
+ 
+ 	pos->refaulted = lrugen->avg_refaulted[type][tier] +
+@@ -3611,7 +3611,7 @@ static void read_ctrl_pos(struct lruvec
+ static void reset_ctrl_pos(struct lruvec *lruvec, int type, bool carryover)
+ {
+ 	int hist, tier;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_folio *lrugen = &lruvec->lrugen;
+ 	bool clear = carryover ? NR_HIST_GENS == 1 : NR_HIST_GENS > 1;
+ 	unsigned long seq = carryover ? lrugen->min_seq[type] : lrugen->max_seq + 1;
+ 
+@@ -3688,7 +3688,7 @@ static int folio_update_gen(struct folio
+ static int folio_inc_gen(struct lruvec *lruvec, struct folio *folio, bool reclaiming)
+ {
+ 	int type = folio_is_file_lru(folio);
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_folio *lrugen = &lruvec->lrugen;
+ 	int new_gen, old_gen = lru_gen_from_seq(lrugen->min_seq[type]);
+ 	unsigned long new_flags, old_flags = READ_ONCE(folio->flags);
+ 
+@@ -3733,7 +3733,7 @@ static void update_batch_size(struct lru
+ static void reset_batch_size(struct lruvec *lruvec, struct lru_gen_mm_walk *walk)
+ {
+ 	int gen, type, zone;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_folio *lrugen = &lruvec->lrugen;
+ 
+ 	walk->batched = 0;
+ 
+@@ -4250,7 +4250,7 @@ static bool inc_min_seq(struct lruvec *l
+ {
+ 	int zone;
+ 	int remaining = MAX_LRU_BATCH;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_folio *lrugen = &lruvec->lrugen;
+ 	int new_gen, old_gen = lru_gen_from_seq(lrugen->min_seq[type]);
+ 
+ 	if (type == LRU_GEN_ANON && !can_swap)
+@@ -4286,7 +4286,7 @@ static bool try_to_inc_min_seq(struct lr
+ {
+ 	int gen, type, zone;
+ 	bool success = false;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_folio *lrugen = &lruvec->lrugen;
+ 	DEFINE_MIN_SEQ(lruvec);
+ 
+ 	VM_WARN_ON_ONCE(!seq_is_valid(lruvec));
+@@ -4307,7 +4307,7 @@ next:
+ 		;
+ 	}
+ 
+-	/* see the comment on lru_gen_struct */
++	/* see the comment on lru_gen_folio */
+ 	if (can_swap) {
+ 		min_seq[LRU_GEN_ANON] = min(min_seq[LRU_GEN_ANON], min_seq[LRU_GEN_FILE]);
+ 		min_seq[LRU_GEN_FILE] = max(min_seq[LRU_GEN_ANON], lrugen->min_seq[LRU_GEN_FILE]);
+@@ -4329,7 +4329,7 @@ static void inc_max_seq(struct lruvec *l
+ {
+ 	int prev, next;
+ 	int type, zone;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_folio *lrugen = &lruvec->lrugen;
+ 
+ 	spin_lock_irq(&lruvec->lru_lock);
+ 
+@@ -4387,7 +4387,7 @@ static bool try_to_inc_max_seq(struct lr
+ 	bool success;
+ 	struct lru_gen_mm_walk *walk;
+ 	struct mm_struct *mm = NULL;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_folio *lrugen = &lruvec->lrugen;
+ 
+ 	VM_WARN_ON_ONCE(max_seq > READ_ONCE(lrugen->max_seq));
+ 
+@@ -4452,7 +4452,7 @@ static bool should_run_aging(struct lruv
+ 	unsigned long old = 0;
+ 	unsigned long young = 0;
+ 	unsigned long total = 0;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_folio *lrugen = &lruvec->lrugen;
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+ 
+ 	for (type = !can_swap; type < ANON_AND_FILE; type++) {
+@@ -4737,7 +4737,7 @@ static bool sort_folio(struct lruvec *lr
+ 	int delta = folio_nr_pages(folio);
+ 	int refs = folio_lru_refs(folio);
+ 	int tier = lru_tier_from_refs(refs);
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_folio *lrugen = &lruvec->lrugen;
+ 
+ 	VM_WARN_ON_ONCE_FOLIO(gen >= MAX_NR_GENS, folio);
+ 
+@@ -4837,7 +4837,7 @@ static int scan_folios(struct lruvec *lr
+ 	int scanned = 0;
+ 	int isolated = 0;
+ 	int remaining = MAX_LRU_BATCH;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_folio *lrugen = &lruvec->lrugen;
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+ 
+ 	VM_WARN_ON_ONCE(!list_empty(list));
+@@ -5237,7 +5237,7 @@ done:
+ 
+ static bool __maybe_unused state_is_valid(struct lruvec *lruvec)
+ {
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_folio *lrugen = &lruvec->lrugen;
+ 
+ 	if (lrugen->enabled) {
+ 		enum lru_list lru;
+@@ -5519,7 +5519,7 @@ static void lru_gen_seq_show_full(struct
+ 	int i;
+ 	int type, tier;
+ 	int hist = lru_hist_from_seq(seq);
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_folio *lrugen = &lruvec->lrugen;
+ 
+ 	for (tier = 0; tier < MAX_NR_TIERS; tier++) {
+ 		seq_printf(m, "            %10d", tier);
+@@ -5569,7 +5569,7 @@ static int lru_gen_seq_show(struct seq_f
+ 	unsigned long seq;
+ 	bool full = !debugfs_real_fops(m->file)->write;
+ 	struct lruvec *lruvec = v;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_folio *lrugen = &lruvec->lrugen;
+ 	int nid = lruvec_pgdat(lruvec)->node_id;
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+ 	DEFINE_MAX_SEQ(lruvec);
+@@ -5823,7 +5823,7 @@ void lru_gen_init_lruvec(struct lruvec *
+ {
+ 	int i;
+ 	int gen, type, zone;
+-	struct lru_gen_struct *lrugen = &lruvec->lrugen;
++	struct lru_gen_folio *lrugen = &lruvec->lrugen;
+ 
+ 	lrugen->max_seq = MIN_NR_GENS + 1;
+ 	lrugen->enabled = lru_gen_enabled();
+--- a/mm/workingset.c
++++ b/mm/workingset.c
+@@ -223,7 +223,7 @@ static void *lru_gen_eviction(struct fol
+ 	unsigned long token;
+ 	unsigned long min_seq;
+ 	struct lruvec *lruvec;
+-	struct lru_gen_struct *lrugen;
++	struct lru_gen_folio *lrugen;
+ 	int type = folio_is_file_lru(folio);
+ 	int delta = folio_nr_pages(folio);
+ 	int refs = folio_lru_refs(folio);
+@@ -252,7 +252,7 @@ static void lru_gen_refault(struct folio
+ 	unsigned long token;
+ 	unsigned long min_seq;
+ 	struct lruvec *lruvec;
+-	struct lru_gen_struct *lrugen;
++	struct lru_gen_folio *lrugen;
+ 	struct mem_cgroup *memcg;
+ 	struct pglist_data *pgdat;
+ 	int type = folio_is_file_lru(folio);
diff --git a/target/linux/generic/backport-6.1/020-v6.3-02-UPSTREAM-mm-multi-gen-LRU-rename-lrugen-lists-to-lru.patch b/target/linux/generic/backport-6.1/020-v6.3-02-UPSTREAM-mm-multi-gen-LRU-rename-lrugen-lists-to-lru.patch
new file mode 100644
index 00000000000000..97ea33c528b879
--- /dev/null
+++ b/target/linux/generic/backport-6.1/020-v6.3-02-UPSTREAM-mm-multi-gen-LRU-rename-lrugen-lists-to-lru.patch
@@ -0,0 +1,197 @@
+From 656287d55d9cfc72a4bcd4d9bd098570f12ce409 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Wed, 21 Dec 2022 21:19:00 -0700
+Subject: [PATCH 02/19] UPSTREAM: mm: multi-gen LRU: rename lrugen->lists[] to
+ lrugen->folios[]
+
+lru_gen_folio will be chained into per-node lists by the coming
+lrugen->list.
+
+Link: https://lkml.kernel.org/r/20221222041905.2431096-3-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Roman Gushchin <roman.gushchin@linux.dev>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Bug: 274865848
+(cherry picked from commit 6df1b2212950aae2b2188c6645ea18e2a9e3fdd5)
+Change-Id: I09f53e0fb2cd6b8b3adbb8a80b15dc5efbeae857
+Signed-off-by: T.J. Mercier <tjmercier@google.com>
+---
+ Documentation/mm/multigen_lru.rst |  8 ++++----
+ include/linux/mm_inline.h         |  4 ++--
+ include/linux/mmzone.h            |  8 ++++----
+ mm/vmscan.c                       | 20 ++++++++++----------
+ 4 files changed, 20 insertions(+), 20 deletions(-)
+
+--- a/Documentation/mm/multigen_lru.rst
++++ b/Documentation/mm/multigen_lru.rst
+@@ -89,15 +89,15 @@ variables are monotonically increasing.
+ 
+ Generation numbers are truncated into ``order_base_2(MAX_NR_GENS+1)``
+ bits in order to fit into the gen counter in ``folio->flags``. Each
+-truncated generation number is an index to ``lrugen->lists[]``. The
++truncated generation number is an index to ``lrugen->folios[]``. The
+ sliding window technique is used to track at least ``MIN_NR_GENS`` and
+ at most ``MAX_NR_GENS`` generations. The gen counter stores a value
+ within ``[1, MAX_NR_GENS]`` while a page is on one of
+-``lrugen->lists[]``; otherwise it stores zero.
++``lrugen->folios[]``; otherwise it stores zero.
+ 
+ Each generation is divided into multiple tiers. A page accessed ``N``
+ times through file descriptors is in tier ``order_base_2(N)``. Unlike
+-generations, tiers do not have dedicated ``lrugen->lists[]``. In
++generations, tiers do not have dedicated ``lrugen->folios[]``. In
+ contrast to moving across generations, which requires the LRU lock,
+ moving across tiers only involves atomic operations on
+ ``folio->flags`` and therefore has a negligible cost. A feedback loop
+@@ -127,7 +127,7 @@ page mapped by this PTE to ``(max_seq%MA
+ Eviction
+ --------
+ The eviction consumes old generations. Given an ``lruvec``, it
+-increments ``min_seq`` when ``lrugen->lists[]`` indexed by
++increments ``min_seq`` when ``lrugen->folios[]`` indexed by
+ ``min_seq%MAX_NR_GENS`` becomes empty. To select a type and a tier to
+ evict from, it first compares ``min_seq[]`` to select the older type.
+ If both types are equally old, it selects the one whose first tier has
+--- a/include/linux/mm_inline.h
++++ b/include/linux/mm_inline.h
+@@ -256,9 +256,9 @@ static inline bool lru_gen_add_folio(str
+ 	lru_gen_update_size(lruvec, folio, -1, gen);
+ 	/* for folio_rotate_reclaimable() */
+ 	if (reclaiming)
+-		list_add_tail(&folio->lru, &lrugen->lists[gen][type][zone]);
++		list_add_tail(&folio->lru, &lrugen->folios[gen][type][zone]);
+ 	else
+-		list_add(&folio->lru, &lrugen->lists[gen][type][zone]);
++		list_add(&folio->lru, &lrugen->folios[gen][type][zone]);
+ 
+ 	return true;
+ }
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -312,7 +312,7 @@ enum lruvec_flags {
+  * They form a sliding window of a variable size [MIN_NR_GENS, MAX_NR_GENS]. An
+  * offset within MAX_NR_GENS, i.e., gen, indexes the LRU list of the
+  * corresponding generation. The gen counter in folio->flags stores gen+1 while
+- * a page is on one of lrugen->lists[]. Otherwise it stores 0.
++ * a page is on one of lrugen->folios[]. Otherwise it stores 0.
+  *
+  * A page is added to the youngest generation on faulting. The aging needs to
+  * check the accessed bit at least twice before handing this page over to the
+@@ -324,8 +324,8 @@ enum lruvec_flags {
+  * rest of generations, if they exist, are considered inactive. See
+  * lru_gen_is_active().
+  *
+- * PG_active is always cleared while a page is on one of lrugen->lists[] so that
+- * the aging needs not to worry about it. And it's set again when a page
++ * PG_active is always cleared while a page is on one of lrugen->folios[] so
++ * that the aging needs not to worry about it. And it's set again when a page
+  * considered active is isolated for non-reclaiming purposes, e.g., migration.
+  * See lru_gen_add_folio() and lru_gen_del_folio().
+  *
+@@ -412,7 +412,7 @@ struct lru_gen_folio {
+ 	/* the birth time of each generation in jiffies */
+ 	unsigned long timestamps[MAX_NR_GENS];
+ 	/* the multi-gen LRU lists, lazily sorted on eviction */
+-	struct list_head lists[MAX_NR_GENS][ANON_AND_FILE][MAX_NR_ZONES];
++	struct list_head folios[MAX_NR_GENS][ANON_AND_FILE][MAX_NR_ZONES];
+ 	/* the multi-gen LRU sizes, eventually consistent */
+ 	long nr_pages[MAX_NR_GENS][ANON_AND_FILE][MAX_NR_ZONES];
+ 	/* the exponential moving average of refaulted */
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -4258,7 +4258,7 @@ static bool inc_min_seq(struct lruvec *l
+ 
+ 	/* prevent cold/hot inversion if force_scan is true */
+ 	for (zone = 0; zone < MAX_NR_ZONES; zone++) {
+-		struct list_head *head = &lrugen->lists[old_gen][type][zone];
++		struct list_head *head = &lrugen->folios[old_gen][type][zone];
+ 
+ 		while (!list_empty(head)) {
+ 			struct folio *folio = lru_to_folio(head);
+@@ -4269,7 +4269,7 @@ static bool inc_min_seq(struct lruvec *l
+ 			VM_WARN_ON_ONCE_FOLIO(folio_zonenum(folio) != zone, folio);
+ 
+ 			new_gen = folio_inc_gen(lruvec, folio, false);
+-			list_move_tail(&folio->lru, &lrugen->lists[new_gen][type][zone]);
++			list_move_tail(&folio->lru, &lrugen->folios[new_gen][type][zone]);
+ 
+ 			if (!--remaining)
+ 				return false;
+@@ -4297,7 +4297,7 @@ static bool try_to_inc_min_seq(struct lr
+ 			gen = lru_gen_from_seq(min_seq[type]);
+ 
+ 			for (zone = 0; zone < MAX_NR_ZONES; zone++) {
+-				if (!list_empty(&lrugen->lists[gen][type][zone]))
++				if (!list_empty(&lrugen->folios[gen][type][zone]))
+ 					goto next;
+ 			}
+ 
+@@ -4762,7 +4762,7 @@ static bool sort_folio(struct lruvec *lr
+ 
+ 	/* promoted */
+ 	if (gen != lru_gen_from_seq(lrugen->min_seq[type])) {
+-		list_move(&folio->lru, &lrugen->lists[gen][type][zone]);
++		list_move(&folio->lru, &lrugen->folios[gen][type][zone]);
+ 		return true;
+ 	}
+ 
+@@ -4771,7 +4771,7 @@ static bool sort_folio(struct lruvec *lr
+ 		int hist = lru_hist_from_seq(lrugen->min_seq[type]);
+ 
+ 		gen = folio_inc_gen(lruvec, folio, false);
+-		list_move_tail(&folio->lru, &lrugen->lists[gen][type][zone]);
++		list_move_tail(&folio->lru, &lrugen->folios[gen][type][zone]);
+ 
+ 		WRITE_ONCE(lrugen->protected[hist][type][tier - 1],
+ 			   lrugen->protected[hist][type][tier - 1] + delta);
+@@ -4783,7 +4783,7 @@ static bool sort_folio(struct lruvec *lr
+ 	if (folio_test_locked(folio) || folio_test_writeback(folio) ||
+ 	    (type == LRU_GEN_FILE && folio_test_dirty(folio))) {
+ 		gen = folio_inc_gen(lruvec, folio, true);
+-		list_move(&folio->lru, &lrugen->lists[gen][type][zone]);
++		list_move(&folio->lru, &lrugen->folios[gen][type][zone]);
+ 		return true;
+ 	}
+ 
+@@ -4850,7 +4850,7 @@ static int scan_folios(struct lruvec *lr
+ 	for (zone = sc->reclaim_idx; zone >= 0; zone--) {
+ 		LIST_HEAD(moved);
+ 		int skipped = 0;
+-		struct list_head *head = &lrugen->lists[gen][type][zone];
++		struct list_head *head = &lrugen->folios[gen][type][zone];
+ 
+ 		while (!list_empty(head)) {
+ 			struct folio *folio = lru_to_folio(head);
+@@ -5250,7 +5250,7 @@ static bool __maybe_unused state_is_vali
+ 		int gen, type, zone;
+ 
+ 		for_each_gen_type_zone(gen, type, zone) {
+-			if (!list_empty(&lrugen->lists[gen][type][zone]))
++			if (!list_empty(&lrugen->folios[gen][type][zone]))
+ 				return false;
+ 		}
+ 	}
+@@ -5295,7 +5295,7 @@ static bool drain_evictable(struct lruve
+ 	int remaining = MAX_LRU_BATCH;
+ 
+ 	for_each_gen_type_zone(gen, type, zone) {
+-		struct list_head *head = &lruvec->lrugen.lists[gen][type][zone];
++		struct list_head *head = &lruvec->lrugen.folios[gen][type][zone];
+ 
+ 		while (!list_empty(head)) {
+ 			bool success;
+@@ -5832,7 +5832,7 @@ void lru_gen_init_lruvec(struct lruvec *
+ 		lrugen->timestamps[i] = jiffies;
+ 
+ 	for_each_gen_type_zone(gen, type, zone)
+-		INIT_LIST_HEAD(&lrugen->lists[gen][type][zone]);
++		INIT_LIST_HEAD(&lrugen->folios[gen][type][zone]);
+ 
+ 	lruvec->mm_state.seq = MIN_NR_GENS;
+ 	init_waitqueue_head(&lruvec->mm_state.wait);
diff --git a/target/linux/generic/backport-6.1/020-v6.3-03-UPSTREAM-mm-multi-gen-LRU-remove-eviction-fairness-s.patch b/target/linux/generic/backport-6.1/020-v6.3-03-UPSTREAM-mm-multi-gen-LRU-remove-eviction-fairness-s.patch
new file mode 100644
index 00000000000000..a5e4ad557f862c
--- /dev/null
+++ b/target/linux/generic/backport-6.1/020-v6.3-03-UPSTREAM-mm-multi-gen-LRU-remove-eviction-fairness-s.patch
@@ -0,0 +1,192 @@
+From 14f9a7a15f3d1af351f30e0438fd747b7ac253b0 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Wed, 21 Dec 2022 21:19:01 -0700
+Subject: [PATCH 03/19] UPSTREAM: mm: multi-gen LRU: remove eviction fairness
+ safeguard
+
+Recall that the eviction consumes the oldest generation: first it
+bucket-sorts folios whose gen counters were updated by the aging and
+reclaims the rest; then it increments lrugen->min_seq.
+
+The current eviction fairness safeguard for global reclaim has a
+dilemma: when there are multiple eligible memcgs, should it continue
+or stop upon meeting the reclaim goal? If it continues, it overshoots
+and increases direct reclaim latency; if it stops, it loses fairness
+between memcgs it has taken memory away from and those it has yet to.
+
+With memcg LRU, the eviction, while ensuring eventual fairness, will
+stop upon meeting its goal. Therefore the current eviction fairness
+safeguard for global reclaim will not be needed.
+
+Note that memcg LRU only applies to global reclaim. For memcg reclaim,
+the eviction will continue, even if it is overshooting. This becomes
+unconditional due to code simplification.
+
+Link: https://lkml.kernel.org/r/20221222041905.2431096-4-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Roman Gushchin <roman.gushchin@linux.dev>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Bug: 274865848
+(cherry picked from commit a579086c99ed70cc4bfc104348dbe3dd8f2787e6)
+Change-Id: I08ac1b3c90e29cafd0566785aaa4bcdb5db7d22c
+Signed-off-by: T.J. Mercier <tjmercier@google.com>
+---
+ mm/vmscan.c | 81 +++++++++++++++--------------------------------------
+ 1 file changed, 23 insertions(+), 58 deletions(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -448,6 +448,11 @@ static bool cgroup_reclaim(struct scan_c
+ 	return sc->target_mem_cgroup;
+ }
+ 
++static bool global_reclaim(struct scan_control *sc)
++{
++	return !sc->target_mem_cgroup || mem_cgroup_is_root(sc->target_mem_cgroup);
++}
++
+ /**
+  * writeback_throttling_sane - is the usual dirty throttling mechanism available?
+  * @sc: scan_control in question
+@@ -498,6 +503,11 @@ static bool cgroup_reclaim(struct scan_c
+ 	return false;
+ }
+ 
++static bool global_reclaim(struct scan_control *sc)
++{
++	return true;
++}
++
+ static bool writeback_throttling_sane(struct scan_control *sc)
+ {
+ 	return true;
+@@ -4993,8 +5003,7 @@ static int isolate_folios(struct lruvec
+ 	return scanned;
+ }
+ 
+-static int evict_folios(struct lruvec *lruvec, struct scan_control *sc, int swappiness,
+-			bool *need_swapping)
++static int evict_folios(struct lruvec *lruvec, struct scan_control *sc, int swappiness)
+ {
+ 	int type;
+ 	int scanned;
+@@ -5083,9 +5092,6 @@ retry:
+ 		goto retry;
+ 	}
+ 
+-	if (need_swapping && type == LRU_GEN_ANON)
+-		*need_swapping = true;
+-
+ 	return scanned;
+ }
+ 
+@@ -5124,67 +5130,26 @@ done:
+ 	return min_seq[!can_swap] + MIN_NR_GENS <= max_seq ? nr_to_scan : 0;
+ }
+ 
+-static bool should_abort_scan(struct lruvec *lruvec, unsigned long seq,
+-			      struct scan_control *sc, bool need_swapping)
++static unsigned long get_nr_to_reclaim(struct scan_control *sc)
+ {
+-	int i;
+-	DEFINE_MAX_SEQ(lruvec);
+-
+-	if (!current_is_kswapd()) {
+-		/* age each memcg at most once to ensure fairness */
+-		if (max_seq - seq > 1)
+-			return true;
+-
+-		/* over-swapping can increase allocation latency */
+-		if (sc->nr_reclaimed >= sc->nr_to_reclaim && need_swapping)
+-			return true;
+-
+-		/* give this thread a chance to exit and free its memory */
+-		if (fatal_signal_pending(current)) {
+-			sc->nr_reclaimed += MIN_LRU_BATCH;
+-			return true;
+-		}
+-
+-		if (cgroup_reclaim(sc))
+-			return false;
+-	} else if (sc->nr_reclaimed - sc->last_reclaimed < sc->nr_to_reclaim)
+-		return false;
+-
+-	/* keep scanning at low priorities to ensure fairness */
+-	if (sc->priority > DEF_PRIORITY - 2)
+-		return false;
+-
+-	/*
+-	 * A minimum amount of work was done under global memory pressure. For
+-	 * kswapd, it may be overshooting. For direct reclaim, the allocation
+-	 * may succeed if all suitable zones are somewhat safe. In either case,
+-	 * it's better to stop now, and restart later if necessary.
+-	 */
+-	for (i = 0; i <= sc->reclaim_idx; i++) {
+-		unsigned long wmark;
+-		struct zone *zone = lruvec_pgdat(lruvec)->node_zones + i;
+-
+-		if (!managed_zone(zone))
+-			continue;
+-
+-		wmark = current_is_kswapd() ? high_wmark_pages(zone) : low_wmark_pages(zone);
+-		if (wmark > zone_page_state(zone, NR_FREE_PAGES))
+-			return false;
+-	}
++	/* don't abort memcg reclaim to ensure fairness */
++	if (!global_reclaim(sc))
++		return -1;
+ 
+-	sc->nr_reclaimed += MIN_LRU_BATCH;
++	/* discount the previous progress for kswapd */
++	if (current_is_kswapd())
++		return sc->nr_to_reclaim + sc->last_reclaimed;
+ 
+-	return true;
++	return max(sc->nr_to_reclaim, compact_gap(sc->order));
+ }
+ 
+ static void lru_gen_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
+ {
+ 	struct blk_plug plug;
+ 	bool need_aging = false;
+-	bool need_swapping = false;
+ 	unsigned long scanned = 0;
+ 	unsigned long reclaimed = sc->nr_reclaimed;
+-	DEFINE_MAX_SEQ(lruvec);
++	unsigned long nr_to_reclaim = get_nr_to_reclaim(sc);
+ 
+ 	lru_add_drain();
+ 
+@@ -5208,7 +5173,7 @@ static void lru_gen_shrink_lruvec(struct
+ 		if (!nr_to_scan)
+ 			goto done;
+ 
+-		delta = evict_folios(lruvec, sc, swappiness, &need_swapping);
++		delta = evict_folios(lruvec, sc, swappiness);
+ 		if (!delta)
+ 			goto done;
+ 
+@@ -5216,7 +5181,7 @@ static void lru_gen_shrink_lruvec(struct
+ 		if (scanned >= nr_to_scan)
+ 			break;
+ 
+-		if (should_abort_scan(lruvec, max_seq, sc, need_swapping))
++		if (sc->nr_reclaimed >= nr_to_reclaim)
+ 			break;
+ 
+ 		cond_resched();
+@@ -5666,7 +5631,7 @@ static int run_eviction(struct lruvec *l
+ 		if (sc->nr_reclaimed >= nr_to_reclaim)
+ 			return 0;
+ 
+-		if (!evict_folios(lruvec, sc, swappiness, NULL))
++		if (!evict_folios(lruvec, sc, swappiness))
+ 			return 0;
+ 
+ 		cond_resched();
diff --git a/target/linux/generic/backport-6.1/020-v6.3-04-BACKPORT-mm-multi-gen-LRU-remove-aging-fairness-safe.patch b/target/linux/generic/backport-6.1/020-v6.3-04-BACKPORT-mm-multi-gen-LRU-remove-aging-fairness-safe.patch
new file mode 100644
index 00000000000000..87ed87a52d08be
--- /dev/null
+++ b/target/linux/generic/backport-6.1/020-v6.3-04-BACKPORT-mm-multi-gen-LRU-remove-aging-fairness-safe.patch
@@ -0,0 +1,294 @@
+From f3c93d2e37a3c56593d7ccf4f4bcf1b58426fdd8 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Wed, 21 Dec 2022 21:19:02 -0700
+Subject: [PATCH 04/19] BACKPORT: mm: multi-gen LRU: remove aging fairness
+ safeguard
+
+Recall that the aging produces the youngest generation: first it scans
+for accessed folios and updates their gen counters; then it increments
+lrugen->max_seq.
+
+The current aging fairness safeguard for kswapd uses two passes to
+ensure the fairness to multiple eligible memcgs. On the first pass,
+which is shared with the eviction, it checks whether all eligible
+memcgs are low on cold folios. If so, it requires a second pass, on
+which it ages all those memcgs at the same time.
+
+With memcg LRU, the aging, while ensuring eventual fairness, will run
+when necessary. Therefore the current aging fairness safeguard for
+kswapd will not be needed.
+
+Note that memcg LRU only applies to global reclaim. For memcg reclaim,
+the aging can be unfair to different memcgs, i.e., their
+lrugen->max_seq can be incremented at different paces.
+
+Link: https://lkml.kernel.org/r/20221222041905.2431096-5-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Roman Gushchin <roman.gushchin@linux.dev>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Bug: 274865848
+(cherry picked from commit 7348cc91821b0cb24dfb00e578047f68299a50ab)
+[TJ: Resolved conflicts with older function signatures for
+min_cgroup_below_min / min_cgroup_below_low]
+Change-Id: I6e36ecfbaaefbc0a56d9a9d5d7cbe404ed7f57a5
+Signed-off-by: T.J. Mercier <tjmercier@google.com>
+---
+ mm/vmscan.c | 126 ++++++++++++++++++++++++----------------------------
+ 1 file changed, 59 insertions(+), 67 deletions(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -136,7 +136,6 @@ struct scan_control {
+ 
+ #ifdef CONFIG_LRU_GEN
+ 	/* help kswapd make better choices among multiple memcgs */
+-	unsigned int memcgs_need_aging:1;
+ 	unsigned long last_reclaimed;
+ #endif
+ 
+@@ -4455,7 +4454,7 @@ done:
+ 	return true;
+ }
+ 
+-static bool should_run_aging(struct lruvec *lruvec, unsigned long max_seq, unsigned long *min_seq,
++static bool should_run_aging(struct lruvec *lruvec, unsigned long max_seq,
+ 			     struct scan_control *sc, bool can_swap, unsigned long *nr_to_scan)
+ {
+ 	int gen, type, zone;
+@@ -4464,6 +4463,13 @@ static bool should_run_aging(struct lruv
+ 	unsigned long total = 0;
+ 	struct lru_gen_folio *lrugen = &lruvec->lrugen;
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
++	DEFINE_MIN_SEQ(lruvec);
++
++	/* whether this lruvec is completely out of cold folios */
++	if (min_seq[!can_swap] + MIN_NR_GENS > max_seq) {
++		*nr_to_scan = 0;
++		return true;
++	}
+ 
+ 	for (type = !can_swap; type < ANON_AND_FILE; type++) {
+ 		unsigned long seq;
+@@ -4492,8 +4498,6 @@ static bool should_run_aging(struct lruv
+ 	 * stalls when the number of generations reaches MIN_NR_GENS. Hence, the
+ 	 * ideal number of generations is MIN_NR_GENS+1.
+ 	 */
+-	if (min_seq[!can_swap] + MIN_NR_GENS > max_seq)
+-		return true;
+ 	if (min_seq[!can_swap] + MIN_NR_GENS < max_seq)
+ 		return false;
+ 
+@@ -4512,40 +4516,54 @@ static bool should_run_aging(struct lruv
+ 	return false;
+ }
+ 
+-static bool age_lruvec(struct lruvec *lruvec, struct scan_control *sc, unsigned long min_ttl)
++static bool lruvec_is_sizable(struct lruvec *lruvec, struct scan_control *sc)
+ {
+-	bool need_aging;
+-	unsigned long nr_to_scan;
+-	int swappiness = get_swappiness(lruvec, sc);
++	int gen, type, zone;
++	unsigned long total = 0;
++	bool can_swap = get_swappiness(lruvec, sc);
++	struct lru_gen_folio *lrugen = &lruvec->lrugen;
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+ 	DEFINE_MAX_SEQ(lruvec);
+ 	DEFINE_MIN_SEQ(lruvec);
+ 
+-	VM_WARN_ON_ONCE(sc->memcg_low_reclaim);
++	for (type = !can_swap; type < ANON_AND_FILE; type++) {
++		unsigned long seq;
+ 
+-	mem_cgroup_calculate_protection(NULL, memcg);
++		for (seq = min_seq[type]; seq <= max_seq; seq++) {
++			gen = lru_gen_from_seq(seq);
+ 
+-	if (mem_cgroup_below_min(memcg))
+-		return false;
++			for (zone = 0; zone < MAX_NR_ZONES; zone++)
++				total += max(READ_ONCE(lrugen->nr_pages[gen][type][zone]), 0L);
++		}
++	}
+ 
+-	need_aging = should_run_aging(lruvec, max_seq, min_seq, sc, swappiness, &nr_to_scan);
++	/* whether the size is big enough to be helpful */
++	return mem_cgroup_online(memcg) ? (total >> sc->priority) : total;
++}
+ 
+-	if (min_ttl) {
+-		int gen = lru_gen_from_seq(min_seq[LRU_GEN_FILE]);
+-		unsigned long birth = READ_ONCE(lruvec->lrugen.timestamps[gen]);
++static bool lruvec_is_reclaimable(struct lruvec *lruvec, struct scan_control *sc,
++				  unsigned long min_ttl)
++{
++	int gen;
++	unsigned long birth;
++	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
++	DEFINE_MIN_SEQ(lruvec);
+ 
+-		if (time_is_after_jiffies(birth + min_ttl))
+-			return false;
++	VM_WARN_ON_ONCE(sc->memcg_low_reclaim);
+ 
+-		/* the size is likely too small to be helpful */
+-		if (!nr_to_scan && sc->priority != DEF_PRIORITY)
+-			return false;
+-	}
++	/* see the comment on lru_gen_folio */
++	gen = lru_gen_from_seq(min_seq[LRU_GEN_FILE]);
++	birth = READ_ONCE(lruvec->lrugen.timestamps[gen]);
+ 
+-	if (need_aging)
+-		try_to_inc_max_seq(lruvec, max_seq, sc, swappiness, false);
++	if (time_is_after_jiffies(birth + min_ttl))
++		return false;
+ 
+-	return true;
++	if (!lruvec_is_sizable(lruvec, sc))
++		return false;
++
++	mem_cgroup_calculate_protection(NULL, memcg);
++
++	return !mem_cgroup_below_min(memcg);
+ }
+ 
+ /* to protect the working set of the last N jiffies */
+@@ -4554,46 +4572,32 @@ static unsigned long lru_gen_min_ttl __r
+ static void lru_gen_age_node(struct pglist_data *pgdat, struct scan_control *sc)
+ {
+ 	struct mem_cgroup *memcg;
+-	bool success = false;
+ 	unsigned long min_ttl = READ_ONCE(lru_gen_min_ttl);
+ 
+ 	VM_WARN_ON_ONCE(!current_is_kswapd());
+ 
+ 	sc->last_reclaimed = sc->nr_reclaimed;
+ 
+-	/*
+-	 * To reduce the chance of going into the aging path, which can be
+-	 * costly, optimistically skip it if the flag below was cleared in the
+-	 * eviction path. This improves the overall performance when multiple
+-	 * memcgs are available.
+-	 */
+-	if (!sc->memcgs_need_aging) {
+-		sc->memcgs_need_aging = true;
++	/* check the order to exclude compaction-induced reclaim */
++	if (!min_ttl || sc->order || sc->priority == DEF_PRIORITY)
+ 		return;
+-	}
+-
+-	set_mm_walk(pgdat);
+ 
+ 	memcg = mem_cgroup_iter(NULL, NULL, NULL);
+ 	do {
+ 		struct lruvec *lruvec = mem_cgroup_lruvec(memcg, pgdat);
+ 
+-		if (age_lruvec(lruvec, sc, min_ttl))
+-			success = true;
++		if (lruvec_is_reclaimable(lruvec, sc, min_ttl)) {
++			mem_cgroup_iter_break(NULL, memcg);
++			return;
++		}
+ 
+ 		cond_resched();
+ 	} while ((memcg = mem_cgroup_iter(NULL, memcg, NULL)));
+ 
+-	clear_mm_walk();
+-
+-	/* check the order to exclude compaction-induced reclaim */
+-	if (success || !min_ttl || sc->order)
+-		return;
+-
+ 	/*
+ 	 * The main goal is to OOM kill if every generation from all memcgs is
+ 	 * younger than min_ttl. However, another possibility is all memcgs are
+-	 * either below min or empty.
++	 * either too small or below min.
+ 	 */
+ 	if (mutex_trylock(&oom_lock)) {
+ 		struct oom_control oc = {
+@@ -5101,33 +5105,27 @@ retry:
+  *    reclaim.
+  */
+ static unsigned long get_nr_to_scan(struct lruvec *lruvec, struct scan_control *sc,
+-				    bool can_swap, bool *need_aging)
++				    bool can_swap)
+ {
+ 	unsigned long nr_to_scan;
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+ 	DEFINE_MAX_SEQ(lruvec);
+-	DEFINE_MIN_SEQ(lruvec);
+ 
+ 	if (mem_cgroup_below_min(memcg) ||
+ 	    (mem_cgroup_below_low(memcg) && !sc->memcg_low_reclaim))
+ 		return 0;
+ 
+-	*need_aging = should_run_aging(lruvec, max_seq, min_seq, sc, can_swap, &nr_to_scan);
+-	if (!*need_aging)
++	if (!should_run_aging(lruvec, max_seq, sc, can_swap, &nr_to_scan))
+ 		return nr_to_scan;
+ 
+ 	/* skip the aging path at the default priority */
+ 	if (sc->priority == DEF_PRIORITY)
+-		goto done;
++		return nr_to_scan;
+ 
+-	/* leave the work to lru_gen_age_node() */
+-	if (current_is_kswapd())
+-		return 0;
++	try_to_inc_max_seq(lruvec, max_seq, sc, can_swap, false);
+ 
+-	if (try_to_inc_max_seq(lruvec, max_seq, sc, can_swap, false))
+-		return nr_to_scan;
+-done:
+-	return min_seq[!can_swap] + MIN_NR_GENS <= max_seq ? nr_to_scan : 0;
++	/* skip this lruvec as it's low on cold folios */
++	return 0;
+ }
+ 
+ static unsigned long get_nr_to_reclaim(struct scan_control *sc)
+@@ -5146,9 +5144,7 @@ static unsigned long get_nr_to_reclaim(s
+ static void lru_gen_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
+ {
+ 	struct blk_plug plug;
+-	bool need_aging = false;
+ 	unsigned long scanned = 0;
+-	unsigned long reclaimed = sc->nr_reclaimed;
+ 	unsigned long nr_to_reclaim = get_nr_to_reclaim(sc);
+ 
+ 	lru_add_drain();
+@@ -5169,13 +5165,13 @@ static void lru_gen_shrink_lruvec(struct
+ 		else
+ 			swappiness = 0;
+ 
+-		nr_to_scan = get_nr_to_scan(lruvec, sc, swappiness, &need_aging);
++		nr_to_scan = get_nr_to_scan(lruvec, sc, swappiness);
+ 		if (!nr_to_scan)
+-			goto done;
++			break;
+ 
+ 		delta = evict_folios(lruvec, sc, swappiness);
+ 		if (!delta)
+-			goto done;
++			break;
+ 
+ 		scanned += delta;
+ 		if (scanned >= nr_to_scan)
+@@ -5187,10 +5183,6 @@ static void lru_gen_shrink_lruvec(struct
+ 		cond_resched();
+ 	}
+ 
+-	/* see the comment in lru_gen_age_node() */
+-	if (sc->nr_reclaimed - reclaimed >= MIN_LRU_BATCH && !need_aging)
+-		sc->memcgs_need_aging = false;
+-done:
+ 	clear_mm_walk();
+ 
+ 	blk_finish_plug(&plug);
diff --git a/target/linux/generic/backport-6.1/020-v6.3-05-UPSTREAM-mm-multi-gen-LRU-shuffle-should_run_aging.patch b/target/linux/generic/backport-6.1/020-v6.3-05-UPSTREAM-mm-multi-gen-LRU-shuffle-should_run_aging.patch
new file mode 100644
index 00000000000000..857072296bfb83
--- /dev/null
+++ b/target/linux/generic/backport-6.1/020-v6.3-05-UPSTREAM-mm-multi-gen-LRU-shuffle-should_run_aging.patch
@@ -0,0 +1,166 @@
+From eca3858631e0cbad2ca6e40f788892749428e4cb Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Wed, 21 Dec 2022 21:19:03 -0700
+Subject: [PATCH 05/19] UPSTREAM: mm: multi-gen LRU: shuffle should_run_aging()
+
+Move should_run_aging() next to its only caller left.
+
+Link: https://lkml.kernel.org/r/20221222041905.2431096-6-yuzhao@google.com
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Roman Gushchin <roman.gushchin@linux.dev>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Bug: 274865848
+(cherry picked from commit 77d4459a4a1a472b7309e475f962dda87d950abd)
+Signed-off-by: T.J. Mercier <tjmercier@google.com>
+Change-Id: I3b0383fe16b93a783b4d8c0b3a0b325160392576
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Signed-off-by: T.J. Mercier <tjmercier@google.com>
+---
+ mm/vmscan.c | 124 ++++++++++++++++++++++++++--------------------------
+ 1 file changed, 62 insertions(+), 62 deletions(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -4454,68 +4454,6 @@ done:
+ 	return true;
+ }
+ 
+-static bool should_run_aging(struct lruvec *lruvec, unsigned long max_seq,
+-			     struct scan_control *sc, bool can_swap, unsigned long *nr_to_scan)
+-{
+-	int gen, type, zone;
+-	unsigned long old = 0;
+-	unsigned long young = 0;
+-	unsigned long total = 0;
+-	struct lru_gen_folio *lrugen = &lruvec->lrugen;
+-	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+-	DEFINE_MIN_SEQ(lruvec);
+-
+-	/* whether this lruvec is completely out of cold folios */
+-	if (min_seq[!can_swap] + MIN_NR_GENS > max_seq) {
+-		*nr_to_scan = 0;
+-		return true;
+-	}
+-
+-	for (type = !can_swap; type < ANON_AND_FILE; type++) {
+-		unsigned long seq;
+-
+-		for (seq = min_seq[type]; seq <= max_seq; seq++) {
+-			unsigned long size = 0;
+-
+-			gen = lru_gen_from_seq(seq);
+-
+-			for (zone = 0; zone < MAX_NR_ZONES; zone++)
+-				size += max(READ_ONCE(lrugen->nr_pages[gen][type][zone]), 0L);
+-
+-			total += size;
+-			if (seq == max_seq)
+-				young += size;
+-			else if (seq + MIN_NR_GENS == max_seq)
+-				old += size;
+-		}
+-	}
+-
+-	/* try to scrape all its memory if this memcg was deleted */
+-	*nr_to_scan = mem_cgroup_online(memcg) ? (total >> sc->priority) : total;
+-
+-	/*
+-	 * The aging tries to be lazy to reduce the overhead, while the eviction
+-	 * stalls when the number of generations reaches MIN_NR_GENS. Hence, the
+-	 * ideal number of generations is MIN_NR_GENS+1.
+-	 */
+-	if (min_seq[!can_swap] + MIN_NR_GENS < max_seq)
+-		return false;
+-
+-	/*
+-	 * It's also ideal to spread pages out evenly, i.e., 1/(MIN_NR_GENS+1)
+-	 * of the total number of pages for each generation. A reasonable range
+-	 * for this average portion is [1/MIN_NR_GENS, 1/(MIN_NR_GENS+2)]. The
+-	 * aging cares about the upper bound of hot pages, while the eviction
+-	 * cares about the lower bound of cold pages.
+-	 */
+-	if (young * MIN_NR_GENS > total)
+-		return true;
+-	if (old * (MIN_NR_GENS + 2) < total)
+-		return true;
+-
+-	return false;
+-}
+-
+ static bool lruvec_is_sizable(struct lruvec *lruvec, struct scan_control *sc)
+ {
+ 	int gen, type, zone;
+@@ -5099,6 +5037,68 @@ retry:
+ 	return scanned;
+ }
+ 
++static bool should_run_aging(struct lruvec *lruvec, unsigned long max_seq,
++			     struct scan_control *sc, bool can_swap, unsigned long *nr_to_scan)
++{
++	int gen, type, zone;
++	unsigned long old = 0;
++	unsigned long young = 0;
++	unsigned long total = 0;
++	struct lru_gen_folio *lrugen = &lruvec->lrugen;
++	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
++	DEFINE_MIN_SEQ(lruvec);
++
++	/* whether this lruvec is completely out of cold folios */
++	if (min_seq[!can_swap] + MIN_NR_GENS > max_seq) {
++		*nr_to_scan = 0;
++		return true;
++	}
++
++	for (type = !can_swap; type < ANON_AND_FILE; type++) {
++		unsigned long seq;
++
++		for (seq = min_seq[type]; seq <= max_seq; seq++) {
++			unsigned long size = 0;
++
++			gen = lru_gen_from_seq(seq);
++
++			for (zone = 0; zone < MAX_NR_ZONES; zone++)
++				size += max(READ_ONCE(lrugen->nr_pages[gen][type][zone]), 0L);
++
++			total += size;
++			if (seq == max_seq)
++				young += size;
++			else if (seq + MIN_NR_GENS == max_seq)
++				old += size;
++		}
++	}
++
++	/* try to scrape all its memory if this memcg was deleted */
++	*nr_to_scan = mem_cgroup_online(memcg) ? (total >> sc->priority) : total;
++
++	/*
++	 * The aging tries to be lazy to reduce the overhead, while the eviction
++	 * stalls when the number of generations reaches MIN_NR_GENS. Hence, the
++	 * ideal number of generations is MIN_NR_GENS+1.
++	 */
++	if (min_seq[!can_swap] + MIN_NR_GENS < max_seq)
++		return false;
++
++	/*
++	 * It's also ideal to spread pages out evenly, i.e., 1/(MIN_NR_GENS+1)
++	 * of the total number of pages for each generation. A reasonable range
++	 * for this average portion is [1/MIN_NR_GENS, 1/(MIN_NR_GENS+2)]. The
++	 * aging cares about the upper bound of hot pages, while the eviction
++	 * cares about the lower bound of cold pages.
++	 */
++	if (young * MIN_NR_GENS > total)
++		return true;
++	if (old * (MIN_NR_GENS + 2) < total)
++		return true;
++
++	return false;
++}
++
+ /*
+  * For future optimizations:
+  * 1. Defer try_to_inc_max_seq() to workqueues to reduce latency for memcg
diff --git a/target/linux/generic/backport-6.1/020-v6.3-06-BACKPORT-mm-multi-gen-LRU-per-node-lru_gen_folio-lis.patch b/target/linux/generic/backport-6.1/020-v6.3-06-BACKPORT-mm-multi-gen-LRU-per-node-lru_gen_folio-lis.patch
new file mode 100644
index 00000000000000..7a4d175128d9d3
--- /dev/null
+++ b/target/linux/generic/backport-6.1/020-v6.3-06-BACKPORT-mm-multi-gen-LRU-per-node-lru_gen_folio-lis.patch
@@ -0,0 +1,876 @@
+From 8ee8571e47aa75221e5fbd4c9c7802fc4244c346 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Wed, 21 Dec 2022 21:19:04 -0700
+Subject: [PATCH 06/19] BACKPORT: mm: multi-gen LRU: per-node lru_gen_folio
+ lists
+
+For each node, memcgs are divided into two generations: the old and
+the young. For each generation, memcgs are randomly sharded into
+multiple bins to improve scalability. For each bin, an RCU hlist_nulls
+is virtually divided into three segments: the head, the tail and the
+default.
+
+An onlining memcg is added to the tail of a random bin in the old
+generation. The eviction starts at the head of a random bin in the old
+generation. The per-node memcg generation counter, whose reminder (mod
+2) indexes the old generation, is incremented when all its bins become
+empty.
+
+There are four operations:
+1. MEMCG_LRU_HEAD, which moves an memcg to the head of a random bin in
+   its current generation (old or young) and updates its "seg" to
+   "head";
+2. MEMCG_LRU_TAIL, which moves an memcg to the tail of a random bin in
+   its current generation (old or young) and updates its "seg" to
+   "tail";
+3. MEMCG_LRU_OLD, which moves an memcg to the head of a random bin in
+   the old generation, updates its "gen" to "old" and resets its "seg"
+   to "default";
+4. MEMCG_LRU_YOUNG, which moves an memcg to the tail of a random bin
+   in the young generation, updates its "gen" to "young" and resets
+   its "seg" to "default".
+
+The events that trigger the above operations are:
+1. Exceeding the soft limit, which triggers MEMCG_LRU_HEAD;
+2. The first attempt to reclaim an memcg below low, which triggers
+   MEMCG_LRU_TAIL;
+3. The first attempt to reclaim an memcg below reclaimable size
+   threshold, which triggers MEMCG_LRU_TAIL;
+4. The second attempt to reclaim an memcg below reclaimable size
+   threshold, which triggers MEMCG_LRU_YOUNG;
+5. Attempting to reclaim an memcg below min, which triggers
+   MEMCG_LRU_YOUNG;
+6. Finishing the aging on the eviction path, which triggers
+   MEMCG_LRU_YOUNG;
+7. Offlining an memcg, which triggers MEMCG_LRU_OLD.
+
+Note that memcg LRU only applies to global reclaim, and the
+round-robin incrementing of their max_seq counters ensures the
+eventual fairness to all eligible memcgs. For memcg reclaim, it still
+relies on mem_cgroup_iter().
+
+Link: https://lkml.kernel.org/r/20221222041905.2431096-7-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Roman Gushchin <roman.gushchin@linux.dev>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Bug: 274865848
+(cherry picked from commit e4dde56cd208674ce899b47589f263499e5b8cdc)
+[TJ: Resolved conflicts with older function signatures for
+min_cgroup_below_min / min_cgroup_below_low and includes]
+Change-Id: Idc8a0f635e035d72dd911f807d1224cb47cbd655
+Signed-off-by: T.J. Mercier <tjmercier@google.com>
+---
+ include/linux/memcontrol.h |  10 +
+ include/linux/mm_inline.h  |  17 ++
+ include/linux/mmzone.h     | 117 +++++++++++-
+ mm/memcontrol.c            |  16 ++
+ mm/page_alloc.c            |   1 +
+ mm/vmscan.c                | 374 +++++++++++++++++++++++++++++++++----
+ 6 files changed, 500 insertions(+), 35 deletions(-)
+
+--- a/include/linux/memcontrol.h
++++ b/include/linux/memcontrol.h
+@@ -790,6 +790,11 @@ static inline void obj_cgroup_put(struct
+ 	percpu_ref_put(&objcg->refcnt);
+ }
+ 
++static inline bool mem_cgroup_tryget(struct mem_cgroup *memcg)
++{
++	return !memcg || css_tryget(&memcg->css);
++}
++
+ static inline void mem_cgroup_put(struct mem_cgroup *memcg)
+ {
+ 	if (memcg)
+@@ -1290,6 +1295,11 @@ static inline void obj_cgroup_put(struct
+ {
+ }
+ 
++static inline bool mem_cgroup_tryget(struct mem_cgroup *memcg)
++{
++	return true;
++}
++
+ static inline void mem_cgroup_put(struct mem_cgroup *memcg)
+ {
+ }
+--- a/include/linux/mm_inline.h
++++ b/include/linux/mm_inline.h
+@@ -122,6 +122,18 @@ static inline bool lru_gen_in_fault(void
+ 	return current->in_lru_fault;
+ }
+ 
++#ifdef CONFIG_MEMCG
++static inline int lru_gen_memcg_seg(struct lruvec *lruvec)
++{
++	return READ_ONCE(lruvec->lrugen.seg);
++}
++#else
++static inline int lru_gen_memcg_seg(struct lruvec *lruvec)
++{
++	return 0;
++}
++#endif
++
+ static inline int lru_gen_from_seq(unsigned long seq)
+ {
+ 	return seq % MAX_NR_GENS;
+@@ -297,6 +309,11 @@ static inline bool lru_gen_in_fault(void
+ 	return false;
+ }
+ 
++static inline int lru_gen_memcg_seg(struct lruvec *lruvec)
++{
++	return 0;
++}
++
+ static inline bool lru_gen_add_folio(struct lruvec *lruvec, struct folio *folio, bool reclaiming)
+ {
+ 	return false;
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -7,6 +7,7 @@
+ 
+ #include <linux/spinlock.h>
+ #include <linux/list.h>
++#include <linux/list_nulls.h>
+ #include <linux/wait.h>
+ #include <linux/bitops.h>
+ #include <linux/cache.h>
+@@ -367,6 +368,15 @@ struct page_vma_mapped_walk;
+ #define LRU_GEN_MASK		((BIT(LRU_GEN_WIDTH) - 1) << LRU_GEN_PGOFF)
+ #define LRU_REFS_MASK		((BIT(LRU_REFS_WIDTH) - 1) << LRU_REFS_PGOFF)
+ 
++/* see the comment on MEMCG_NR_GENS */
++enum {
++	MEMCG_LRU_NOP,
++	MEMCG_LRU_HEAD,
++	MEMCG_LRU_TAIL,
++	MEMCG_LRU_OLD,
++	MEMCG_LRU_YOUNG,
++};
++
+ #ifdef CONFIG_LRU_GEN
+ 
+ enum {
+@@ -426,6 +436,14 @@ struct lru_gen_folio {
+ 	atomic_long_t refaulted[NR_HIST_GENS][ANON_AND_FILE][MAX_NR_TIERS];
+ 	/* whether the multi-gen LRU is enabled */
+ 	bool enabled;
++#ifdef CONFIG_MEMCG
++	/* the memcg generation this lru_gen_folio belongs to */
++	u8 gen;
++	/* the list segment this lru_gen_folio belongs to */
++	u8 seg;
++	/* per-node lru_gen_folio list for global reclaim */
++	struct hlist_nulls_node list;
++#endif
+ };
+ 
+ enum {
+@@ -479,12 +497,87 @@ void lru_gen_init_lruvec(struct lruvec *
+ void lru_gen_look_around(struct page_vma_mapped_walk *pvmw);
+ 
+ #ifdef CONFIG_MEMCG
++
++/*
++ * For each node, memcgs are divided into two generations: the old and the
++ * young. For each generation, memcgs are randomly sharded into multiple bins
++ * to improve scalability. For each bin, the hlist_nulls is virtually divided
++ * into three segments: the head, the tail and the default.
++ *
++ * An onlining memcg is added to the tail of a random bin in the old generation.
++ * The eviction starts at the head of a random bin in the old generation. The
++ * per-node memcg generation counter, whose reminder (mod MEMCG_NR_GENS) indexes
++ * the old generation, is incremented when all its bins become empty.
++ *
++ * There are four operations:
++ * 1. MEMCG_LRU_HEAD, which moves an memcg to the head of a random bin in its
++ *    current generation (old or young) and updates its "seg" to "head";
++ * 2. MEMCG_LRU_TAIL, which moves an memcg to the tail of a random bin in its
++ *    current generation (old or young) and updates its "seg" to "tail";
++ * 3. MEMCG_LRU_OLD, which moves an memcg to the head of a random bin in the old
++ *    generation, updates its "gen" to "old" and resets its "seg" to "default";
++ * 4. MEMCG_LRU_YOUNG, which moves an memcg to the tail of a random bin in the
++ *    young generation, updates its "gen" to "young" and resets its "seg" to
++ *    "default".
++ *
++ * The events that trigger the above operations are:
++ * 1. Exceeding the soft limit, which triggers MEMCG_LRU_HEAD;
++ * 2. The first attempt to reclaim an memcg below low, which triggers
++ *    MEMCG_LRU_TAIL;
++ * 3. The first attempt to reclaim an memcg below reclaimable size threshold,
++ *    which triggers MEMCG_LRU_TAIL;
++ * 4. The second attempt to reclaim an memcg below reclaimable size threshold,
++ *    which triggers MEMCG_LRU_YOUNG;
++ * 5. Attempting to reclaim an memcg below min, which triggers MEMCG_LRU_YOUNG;
++ * 6. Finishing the aging on the eviction path, which triggers MEMCG_LRU_YOUNG;
++ * 7. Offlining an memcg, which triggers MEMCG_LRU_OLD.
++ *
++ * Note that memcg LRU only applies to global reclaim, and the round-robin
++ * incrementing of their max_seq counters ensures the eventual fairness to all
++ * eligible memcgs. For memcg reclaim, it still relies on mem_cgroup_iter().
++ */
++#define MEMCG_NR_GENS	2
++#define MEMCG_NR_BINS	8
++
++struct lru_gen_memcg {
++	/* the per-node memcg generation counter */
++	unsigned long seq;
++	/* each memcg has one lru_gen_folio per node */
++	unsigned long nr_memcgs[MEMCG_NR_GENS];
++	/* per-node lru_gen_folio list for global reclaim */
++	struct hlist_nulls_head	fifo[MEMCG_NR_GENS][MEMCG_NR_BINS];
++	/* protects the above */
++	spinlock_t lock;
++};
++
++void lru_gen_init_pgdat(struct pglist_data *pgdat);
++
+ void lru_gen_init_memcg(struct mem_cgroup *memcg);
+ void lru_gen_exit_memcg(struct mem_cgroup *memcg);
+-#endif
++void lru_gen_online_memcg(struct mem_cgroup *memcg);
++void lru_gen_offline_memcg(struct mem_cgroup *memcg);
++void lru_gen_release_memcg(struct mem_cgroup *memcg);
++void lru_gen_rotate_memcg(struct lruvec *lruvec, int op);
++
++#else /* !CONFIG_MEMCG */
++
++#define MEMCG_NR_GENS	1
++
++struct lru_gen_memcg {
++};
++
++static inline void lru_gen_init_pgdat(struct pglist_data *pgdat)
++{
++}
++
++#endif /* CONFIG_MEMCG */
+ 
+ #else /* !CONFIG_LRU_GEN */
+ 
++static inline void lru_gen_init_pgdat(struct pglist_data *pgdat)
++{
++}
++
+ static inline void lru_gen_init_lruvec(struct lruvec *lruvec)
+ {
+ }
+@@ -494,6 +587,7 @@ static inline void lru_gen_look_around(s
+ }
+ 
+ #ifdef CONFIG_MEMCG
++
+ static inline void lru_gen_init_memcg(struct mem_cgroup *memcg)
+ {
+ }
+@@ -501,7 +595,24 @@ static inline void lru_gen_init_memcg(st
+ static inline void lru_gen_exit_memcg(struct mem_cgroup *memcg)
+ {
+ }
+-#endif
++
++static inline void lru_gen_online_memcg(struct mem_cgroup *memcg)
++{
++}
++
++static inline void lru_gen_offline_memcg(struct mem_cgroup *memcg)
++{
++}
++
++static inline void lru_gen_release_memcg(struct mem_cgroup *memcg)
++{
++}
++
++static inline void lru_gen_rotate_memcg(struct lruvec *lruvec, int op)
++{
++}
++
++#endif /* CONFIG_MEMCG */
+ 
+ #endif /* CONFIG_LRU_GEN */
+ 
+@@ -1219,6 +1330,8 @@ typedef struct pglist_data {
+ #ifdef CONFIG_LRU_GEN
+ 	/* kswap mm walk data */
+ 	struct lru_gen_mm_walk	mm_walk;
++	/* lru_gen_folio list */
++	struct lru_gen_memcg memcg_lru;
+ #endif
+ 
+ 	CACHELINE_PADDING(_pad2_);
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -477,6 +477,16 @@ static void mem_cgroup_update_tree(struc
+ 	struct mem_cgroup_per_node *mz;
+ 	struct mem_cgroup_tree_per_node *mctz;
+ 
++	if (lru_gen_enabled()) {
++		struct lruvec *lruvec = &memcg->nodeinfo[nid]->lruvec;
++
++		/* see the comment on MEMCG_NR_GENS */
++		if (soft_limit_excess(memcg) && lru_gen_memcg_seg(lruvec) != MEMCG_LRU_HEAD)
++			lru_gen_rotate_memcg(lruvec, MEMCG_LRU_HEAD);
++
++		return;
++	}
++
+ 	mctz = soft_limit_tree.rb_tree_per_node[nid];
+ 	if (!mctz)
+ 		return;
+@@ -3522,6 +3532,9 @@ unsigned long mem_cgroup_soft_limit_recl
+ 	struct mem_cgroup_tree_per_node *mctz;
+ 	unsigned long excess;
+ 
++	if (lru_gen_enabled())
++		return 0;
++
+ 	if (order > 0)
+ 		return 0;
+ 
+@@ -5382,6 +5395,7 @@ static int mem_cgroup_css_online(struct
+ 	if (unlikely(mem_cgroup_is_root(memcg)))
+ 		queue_delayed_work(system_unbound_wq, &stats_flush_dwork,
+ 				   2UL*HZ);
++	lru_gen_online_memcg(memcg);
+ 	return 0;
+ offline_kmem:
+ 	memcg_offline_kmem(memcg);
+@@ -5413,6 +5427,7 @@ static void mem_cgroup_css_offline(struc
+ 	memcg_offline_kmem(memcg);
+ 	reparent_shrinker_deferred(memcg);
+ 	wb_memcg_offline(memcg);
++	lru_gen_offline_memcg(memcg);
+ 
+ 	drain_all_stock(memcg);
+ 
+@@ -5424,6 +5439,7 @@ static void mem_cgroup_css_released(stru
+ 	struct mem_cgroup *memcg = mem_cgroup_from_css(css);
+ 
+ 	invalidate_reclaim_iterators(memcg);
++	lru_gen_release_memcg(memcg);
+ }
+ 
+ static void mem_cgroup_css_free(struct cgroup_subsys_state *css)
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -7957,6 +7957,7 @@ static void __init free_area_init_node(i
+ 	pgdat_set_deferred_range(pgdat);
+ 
+ 	free_area_init_core(pgdat);
++	lru_gen_init_pgdat(pgdat);
+ }
+ 
+ static void __init free_area_init_memoryless_node(int nid)
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -54,6 +54,8 @@
+ #include <linux/shmem_fs.h>
+ #include <linux/ctype.h>
+ #include <linux/debugfs.h>
++#include <linux/rculist_nulls.h>
++#include <linux/random.h>
+ 
+ #include <asm/tlbflush.h>
+ #include <asm/div64.h>
+@@ -134,11 +136,6 @@ struct scan_control {
+ 	/* Always discard instead of demoting to lower tier memory */
+ 	unsigned int no_demotion:1;
+ 
+-#ifdef CONFIG_LRU_GEN
+-	/* help kswapd make better choices among multiple memcgs */
+-	unsigned long last_reclaimed;
+-#endif
+-
+ 	/* Allocation order */
+ 	s8 order;
+ 
+@@ -3160,6 +3157,9 @@ DEFINE_STATIC_KEY_ARRAY_FALSE(lru_gen_ca
+ 		for ((type) = 0; (type) < ANON_AND_FILE; (type)++)	\
+ 			for ((zone) = 0; (zone) < MAX_NR_ZONES; (zone)++)
+ 
++#define get_memcg_gen(seq)	((seq) % MEMCG_NR_GENS)
++#define get_memcg_bin(bin)	((bin) % MEMCG_NR_BINS)
++
+ static struct lruvec *get_lruvec(struct mem_cgroup *memcg, int nid)
+ {
+ 	struct pglist_data *pgdat = NODE_DATA(nid);
+@@ -4440,8 +4440,7 @@ done:
+ 		if (sc->priority <= DEF_PRIORITY - 2)
+ 			wait_event_killable(lruvec->mm_state.wait,
+ 					    max_seq < READ_ONCE(lrugen->max_seq));
+-
+-		return max_seq < READ_ONCE(lrugen->max_seq);
++		return false;
+ 	}
+ 
+ 	VM_WARN_ON_ONCE(max_seq != READ_ONCE(lrugen->max_seq));
+@@ -4514,8 +4513,6 @@ static void lru_gen_age_node(struct pgli
+ 
+ 	VM_WARN_ON_ONCE(!current_is_kswapd());
+ 
+-	sc->last_reclaimed = sc->nr_reclaimed;
+-
+ 	/* check the order to exclude compaction-induced reclaim */
+ 	if (!min_ttl || sc->order || sc->priority == DEF_PRIORITY)
+ 		return;
+@@ -5104,8 +5101,7 @@ static bool should_run_aging(struct lruv
+  * 1. Defer try_to_inc_max_seq() to workqueues to reduce latency for memcg
+  *    reclaim.
+  */
+-static unsigned long get_nr_to_scan(struct lruvec *lruvec, struct scan_control *sc,
+-				    bool can_swap)
++static long get_nr_to_scan(struct lruvec *lruvec, struct scan_control *sc, bool can_swap)
+ {
+ 	unsigned long nr_to_scan;
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+@@ -5122,10 +5118,8 @@ static unsigned long get_nr_to_scan(stru
+ 	if (sc->priority == DEF_PRIORITY)
+ 		return nr_to_scan;
+ 
+-	try_to_inc_max_seq(lruvec, max_seq, sc, can_swap, false);
+-
+ 	/* skip this lruvec as it's low on cold folios */
+-	return 0;
++	return try_to_inc_max_seq(lruvec, max_seq, sc, can_swap, false) ? -1 : 0;
+ }
+ 
+ static unsigned long get_nr_to_reclaim(struct scan_control *sc)
+@@ -5134,29 +5128,18 @@ static unsigned long get_nr_to_reclaim(s
+ 	if (!global_reclaim(sc))
+ 		return -1;
+ 
+-	/* discount the previous progress for kswapd */
+-	if (current_is_kswapd())
+-		return sc->nr_to_reclaim + sc->last_reclaimed;
+-
+ 	return max(sc->nr_to_reclaim, compact_gap(sc->order));
+ }
+ 
+-static void lru_gen_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
++static bool try_to_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
+ {
+-	struct blk_plug plug;
++	long nr_to_scan;
+ 	unsigned long scanned = 0;
+ 	unsigned long nr_to_reclaim = get_nr_to_reclaim(sc);
+ 
+-	lru_add_drain();
+-
+-	blk_start_plug(&plug);
+-
+-	set_mm_walk(lruvec_pgdat(lruvec));
+-
+ 	while (true) {
+ 		int delta;
+ 		int swappiness;
+-		unsigned long nr_to_scan;
+ 
+ 		if (sc->may_swap)
+ 			swappiness = get_swappiness(lruvec, sc);
+@@ -5166,7 +5149,7 @@ static void lru_gen_shrink_lruvec(struct
+ 			swappiness = 0;
+ 
+ 		nr_to_scan = get_nr_to_scan(lruvec, sc, swappiness);
+-		if (!nr_to_scan)
++		if (nr_to_scan <= 0)
+ 			break;
+ 
+ 		delta = evict_folios(lruvec, sc, swappiness);
+@@ -5183,10 +5166,251 @@ static void lru_gen_shrink_lruvec(struct
+ 		cond_resched();
+ 	}
+ 
++	/* whether try_to_inc_max_seq() was successful */
++	return nr_to_scan < 0;
++}
++
++static int shrink_one(struct lruvec *lruvec, struct scan_control *sc)
++{
++	bool success;
++	unsigned long scanned = sc->nr_scanned;
++	unsigned long reclaimed = sc->nr_reclaimed;
++	int seg = lru_gen_memcg_seg(lruvec);
++	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
++	struct pglist_data *pgdat = lruvec_pgdat(lruvec);
++
++	/* see the comment on MEMCG_NR_GENS */
++	if (!lruvec_is_sizable(lruvec, sc))
++		return seg != MEMCG_LRU_TAIL ? MEMCG_LRU_TAIL : MEMCG_LRU_YOUNG;
++
++	mem_cgroup_calculate_protection(NULL, memcg);
++
++	if (mem_cgroup_below_min(memcg))
++		return MEMCG_LRU_YOUNG;
++
++	if (mem_cgroup_below_low(memcg)) {
++		/* see the comment on MEMCG_NR_GENS */
++		if (seg != MEMCG_LRU_TAIL)
++			return MEMCG_LRU_TAIL;
++
++		memcg_memory_event(memcg, MEMCG_LOW);
++	}
++
++	success = try_to_shrink_lruvec(lruvec, sc);
++
++	shrink_slab(sc->gfp_mask, pgdat->node_id, memcg, sc->priority);
++
++	if (!sc->proactive)
++		vmpressure(sc->gfp_mask, memcg, false, sc->nr_scanned - scanned,
++			   sc->nr_reclaimed - reclaimed);
++
++	sc->nr_reclaimed += current->reclaim_state->reclaimed_slab;
++	current->reclaim_state->reclaimed_slab = 0;
++
++	return success ? MEMCG_LRU_YOUNG : 0;
++}
++
++#ifdef CONFIG_MEMCG
++
++static void shrink_many(struct pglist_data *pgdat, struct scan_control *sc)
++{
++	int gen;
++	int bin;
++	int first_bin;
++	struct lruvec *lruvec;
++	struct lru_gen_folio *lrugen;
++	const struct hlist_nulls_node *pos;
++	int op = 0;
++	struct mem_cgroup *memcg = NULL;
++	unsigned long nr_to_reclaim = get_nr_to_reclaim(sc);
++
++	bin = first_bin = get_random_u32_below(MEMCG_NR_BINS);
++restart:
++	gen = get_memcg_gen(READ_ONCE(pgdat->memcg_lru.seq));
++
++	rcu_read_lock();
++
++	hlist_nulls_for_each_entry_rcu(lrugen, pos, &pgdat->memcg_lru.fifo[gen][bin], list) {
++		if (op)
++			lru_gen_rotate_memcg(lruvec, op);
++
++		mem_cgroup_put(memcg);
++
++		lruvec = container_of(lrugen, struct lruvec, lrugen);
++		memcg = lruvec_memcg(lruvec);
++
++		if (!mem_cgroup_tryget(memcg)) {
++			op = 0;
++			memcg = NULL;
++			continue;
++		}
++
++		rcu_read_unlock();
++
++		op = shrink_one(lruvec, sc);
++
++		if (sc->nr_reclaimed >= nr_to_reclaim)
++			goto success;
++
++		rcu_read_lock();
++	}
++
++	rcu_read_unlock();
++
++	/* restart if raced with lru_gen_rotate_memcg() */
++	if (gen != get_nulls_value(pos))
++		goto restart;
++
++	/* try the rest of the bins of the current generation */
++	bin = get_memcg_bin(bin + 1);
++	if (bin != first_bin)
++		goto restart;
++success:
++	if (op)
++		lru_gen_rotate_memcg(lruvec, op);
++
++	mem_cgroup_put(memcg);
++}
++
++static void lru_gen_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
++{
++	struct blk_plug plug;
++
++	VM_WARN_ON_ONCE(global_reclaim(sc));
++
++	lru_add_drain();
++
++	blk_start_plug(&plug);
++
++	set_mm_walk(lruvec_pgdat(lruvec));
++
++	if (try_to_shrink_lruvec(lruvec, sc))
++		lru_gen_rotate_memcg(lruvec, MEMCG_LRU_YOUNG);
++
++	clear_mm_walk();
++
++	blk_finish_plug(&plug);
++}
++
++#else /* !CONFIG_MEMCG */
++
++static void shrink_many(struct pglist_data *pgdat, struct scan_control *sc)
++{
++	BUILD_BUG();
++}
++
++static void lru_gen_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
++{
++	BUILD_BUG();
++}
++
++#endif
++
++static void set_initial_priority(struct pglist_data *pgdat, struct scan_control *sc)
++{
++	int priority;
++	unsigned long reclaimable;
++	struct lruvec *lruvec = mem_cgroup_lruvec(NULL, pgdat);
++
++	if (sc->priority != DEF_PRIORITY || sc->nr_to_reclaim < MIN_LRU_BATCH)
++		return;
++	/*
++	 * Determine the initial priority based on ((total / MEMCG_NR_GENS) >>
++	 * priority) * reclaimed_to_scanned_ratio = nr_to_reclaim, where the
++	 * estimated reclaimed_to_scanned_ratio = inactive / total.
++	 */
++	reclaimable = node_page_state(pgdat, NR_INACTIVE_FILE);
++	if (get_swappiness(lruvec, sc))
++		reclaimable += node_page_state(pgdat, NR_INACTIVE_ANON);
++
++	reclaimable /= MEMCG_NR_GENS;
++
++	/* round down reclaimable and round up sc->nr_to_reclaim */
++	priority = fls_long(reclaimable) - 1 - fls_long(sc->nr_to_reclaim - 1);
++
++	sc->priority = clamp(priority, 0, DEF_PRIORITY);
++}
++
++static void lru_gen_shrink_node(struct pglist_data *pgdat, struct scan_control *sc)
++{
++	struct blk_plug plug;
++	unsigned long reclaimed = sc->nr_reclaimed;
++
++	VM_WARN_ON_ONCE(!global_reclaim(sc));
++
++	lru_add_drain();
++
++	blk_start_plug(&plug);
++
++	set_mm_walk(pgdat);
++
++	set_initial_priority(pgdat, sc);
++
++	if (current_is_kswapd())
++		sc->nr_reclaimed = 0;
++
++	if (mem_cgroup_disabled())
++		shrink_one(&pgdat->__lruvec, sc);
++	else
++		shrink_many(pgdat, sc);
++
++	if (current_is_kswapd())
++		sc->nr_reclaimed += reclaimed;
++
+ 	clear_mm_walk();
+ 
+ 	blk_finish_plug(&plug);
++
++	/* kswapd should never fail */
++	pgdat->kswapd_failures = 0;
++}
++
++#ifdef CONFIG_MEMCG
++void lru_gen_rotate_memcg(struct lruvec *lruvec, int op)
++{
++	int seg;
++	int old, new;
++	int bin = get_random_u32_below(MEMCG_NR_BINS);
++	struct pglist_data *pgdat = lruvec_pgdat(lruvec);
++
++	spin_lock(&pgdat->memcg_lru.lock);
++
++	VM_WARN_ON_ONCE(hlist_nulls_unhashed(&lruvec->lrugen.list));
++
++	seg = 0;
++	new = old = lruvec->lrugen.gen;
++
++	/* see the comment on MEMCG_NR_GENS */
++	if (op == MEMCG_LRU_HEAD)
++		seg = MEMCG_LRU_HEAD;
++	else if (op == MEMCG_LRU_TAIL)
++		seg = MEMCG_LRU_TAIL;
++	else if (op == MEMCG_LRU_OLD)
++		new = get_memcg_gen(pgdat->memcg_lru.seq);
++	else if (op == MEMCG_LRU_YOUNG)
++		new = get_memcg_gen(pgdat->memcg_lru.seq + 1);
++	else
++		VM_WARN_ON_ONCE(true);
++
++	hlist_nulls_del_rcu(&lruvec->lrugen.list);
++
++	if (op == MEMCG_LRU_HEAD || op == MEMCG_LRU_OLD)
++		hlist_nulls_add_head_rcu(&lruvec->lrugen.list, &pgdat->memcg_lru.fifo[new][bin]);
++	else
++		hlist_nulls_add_tail_rcu(&lruvec->lrugen.list, &pgdat->memcg_lru.fifo[new][bin]);
++
++	pgdat->memcg_lru.nr_memcgs[old]--;
++	pgdat->memcg_lru.nr_memcgs[new]++;
++
++	lruvec->lrugen.gen = new;
++	WRITE_ONCE(lruvec->lrugen.seg, seg);
++
++	if (!pgdat->memcg_lru.nr_memcgs[old] && old == get_memcg_gen(pgdat->memcg_lru.seq))
++		WRITE_ONCE(pgdat->memcg_lru.seq, pgdat->memcg_lru.seq + 1);
++
++	spin_unlock(&pgdat->memcg_lru.lock);
+ }
++#endif
+ 
+ /******************************************************************************
+  *                          state change
+@@ -5644,11 +5868,11 @@ static int run_cmd(char cmd, int memcg_i
+ 
+ 	if (!mem_cgroup_disabled()) {
+ 		rcu_read_lock();
++
+ 		memcg = mem_cgroup_from_id(memcg_id);
+-#ifdef CONFIG_MEMCG
+-		if (memcg && !css_tryget(&memcg->css))
++		if (!mem_cgroup_tryget(memcg))
+ 			memcg = NULL;
+-#endif
++
+ 		rcu_read_unlock();
+ 
+ 		if (!memcg)
+@@ -5796,6 +6020,19 @@ void lru_gen_init_lruvec(struct lruvec *
+ }
+ 
+ #ifdef CONFIG_MEMCG
++
++void lru_gen_init_pgdat(struct pglist_data *pgdat)
++{
++	int i, j;
++
++	spin_lock_init(&pgdat->memcg_lru.lock);
++
++	for (i = 0; i < MEMCG_NR_GENS; i++) {
++		for (j = 0; j < MEMCG_NR_BINS; j++)
++			INIT_HLIST_NULLS_HEAD(&pgdat->memcg_lru.fifo[i][j], i);
++	}
++}
++
+ void lru_gen_init_memcg(struct mem_cgroup *memcg)
+ {
+ 	INIT_LIST_HEAD(&memcg->mm_list.fifo);
+@@ -5819,7 +6056,69 @@ void lru_gen_exit_memcg(struct mem_cgrou
+ 		}
+ 	}
+ }
+-#endif
++
++void lru_gen_online_memcg(struct mem_cgroup *memcg)
++{
++	int gen;
++	int nid;
++	int bin = get_random_u32_below(MEMCG_NR_BINS);
++
++	for_each_node(nid) {
++		struct pglist_data *pgdat = NODE_DATA(nid);
++		struct lruvec *lruvec = get_lruvec(memcg, nid);
++
++		spin_lock(&pgdat->memcg_lru.lock);
++
++		VM_WARN_ON_ONCE(!hlist_nulls_unhashed(&lruvec->lrugen.list));
++
++		gen = get_memcg_gen(pgdat->memcg_lru.seq);
++
++		hlist_nulls_add_tail_rcu(&lruvec->lrugen.list, &pgdat->memcg_lru.fifo[gen][bin]);
++		pgdat->memcg_lru.nr_memcgs[gen]++;
++
++		lruvec->lrugen.gen = gen;
++
++		spin_unlock(&pgdat->memcg_lru.lock);
++	}
++}
++
++void lru_gen_offline_memcg(struct mem_cgroup *memcg)
++{
++	int nid;
++
++	for_each_node(nid) {
++		struct lruvec *lruvec = get_lruvec(memcg, nid);
++
++		lru_gen_rotate_memcg(lruvec, MEMCG_LRU_OLD);
++	}
++}
++
++void lru_gen_release_memcg(struct mem_cgroup *memcg)
++{
++	int gen;
++	int nid;
++
++	for_each_node(nid) {
++		struct pglist_data *pgdat = NODE_DATA(nid);
++		struct lruvec *lruvec = get_lruvec(memcg, nid);
++
++		spin_lock(&pgdat->memcg_lru.lock);
++
++		VM_WARN_ON_ONCE(hlist_nulls_unhashed(&lruvec->lrugen.list));
++
++		gen = lruvec->lrugen.gen;
++
++		hlist_nulls_del_rcu(&lruvec->lrugen.list);
++		pgdat->memcg_lru.nr_memcgs[gen]--;
++
++		if (!pgdat->memcg_lru.nr_memcgs[gen] && gen == get_memcg_gen(pgdat->memcg_lru.seq))
++			WRITE_ONCE(pgdat->memcg_lru.seq, pgdat->memcg_lru.seq + 1);
++
++		spin_unlock(&pgdat->memcg_lru.lock);
++	}
++}
++
++#endif /* CONFIG_MEMCG */
+ 
+ static int __init init_lru_gen(void)
+ {
+@@ -5846,6 +6145,10 @@ static void lru_gen_shrink_lruvec(struct
+ {
+ }
+ 
++static void lru_gen_shrink_node(struct pglist_data *pgdat, struct scan_control *sc)
++{
++}
++
+ #endif /* CONFIG_LRU_GEN */
+ 
+ static void shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
+@@ -5859,7 +6162,7 @@ static void shrink_lruvec(struct lruvec
+ 	bool proportional_reclaim;
+ 	struct blk_plug plug;
+ 
+-	if (lru_gen_enabled()) {
++	if (lru_gen_enabled() && !global_reclaim(sc)) {
+ 		lru_gen_shrink_lruvec(lruvec, sc);
+ 		return;
+ 	}
+@@ -6102,6 +6405,11 @@ static void shrink_node(pg_data_t *pgdat
+ 	struct lruvec *target_lruvec;
+ 	bool reclaimable = false;
+ 
++	if (lru_gen_enabled() && global_reclaim(sc)) {
++		lru_gen_shrink_node(pgdat, sc);
++		return;
++	}
++
+ 	target_lruvec = mem_cgroup_lruvec(sc->target_mem_cgroup, pgdat);
+ 
+ again:
diff --git a/target/linux/generic/backport-6.1/020-v6.3-07-BACKPORT-mm-multi-gen-LRU-clarify-scan_control-flags.patch b/target/linux/generic/backport-6.1/020-v6.3-07-BACKPORT-mm-multi-gen-LRU-clarify-scan_control-flags.patch
new file mode 100644
index 00000000000000..29430636ff41f4
--- /dev/null
+++ b/target/linux/generic/backport-6.1/020-v6.3-07-BACKPORT-mm-multi-gen-LRU-clarify-scan_control-flags.patch
@@ -0,0 +1,202 @@
+From 11b14ee8cbbbebd8204609076a9327a1171cd253 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Wed, 21 Dec 2022 21:19:05 -0700
+Subject: [PATCH 07/19] BACKPORT: mm: multi-gen LRU: clarify scan_control flags
+
+Among the flags in scan_control:
+1. sc->may_swap, which indicates swap constraint due to memsw.max, is
+   supported as usual.
+2. sc->proactive, which indicates reclaim by memory.reclaim, may not
+   opportunistically skip the aging path, since it is considered less
+   latency sensitive.
+3. !(sc->gfp_mask & __GFP_IO), which indicates IO constraint, lowers
+   swappiness to prioritize file LRU, since clean file folios are more
+   likely to exist.
+4. sc->may_writepage and sc->may_unmap, which indicates opportunistic
+   reclaim, are rejected, since unmapped clean folios are already
+   prioritized. Scanning for more of them is likely futile and can
+   cause high reclaim latency when there is a large number of memcgs.
+
+The rest are handled by the existing code.
+
+Link: https://lkml.kernel.org/r/20221222041905.2431096-8-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Roman Gushchin <roman.gushchin@linux.dev>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Bug: 274865848
+(cherry picked from commit e9d4e1ee788097484606c32122f146d802a9c5fb)
+[TJ: Resolved conflict with older function signature for min_cgroup_below_min, and over
+cdded861182142ac4488a4d64c571107aeb77f53 ("ANDROID: MGLRU: Don't skip anon reclaim if swap low")]
+Change-Id: Ic2e779eaf4e91a3921831b4e2fa10c740dc59d50
+Signed-off-by: T.J. Mercier <tjmercier@google.com>
+---
+ mm/vmscan.c | 55 +++++++++++++++++++++++++++--------------------------
+ 1 file changed, 28 insertions(+), 27 deletions(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -3185,6 +3185,9 @@ static int get_swappiness(struct lruvec
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+ 	struct pglist_data *pgdat = lruvec_pgdat(lruvec);
+ 
++	if (!sc->may_swap)
++		return 0;
++
+ 	if (!can_demote(pgdat->node_id, sc) &&
+ 	    mem_cgroup_get_nr_swap_pages(memcg) < MIN_LRU_BATCH)
+ 		return 0;
+@@ -4223,7 +4226,7 @@ static void walk_mm(struct lruvec *lruve
+ 	} while (err == -EAGAIN);
+ }
+ 
+-static struct lru_gen_mm_walk *set_mm_walk(struct pglist_data *pgdat)
++static struct lru_gen_mm_walk *set_mm_walk(struct pglist_data *pgdat, bool force_alloc)
+ {
+ 	struct lru_gen_mm_walk *walk = current->reclaim_state->mm_walk;
+ 
+@@ -4231,7 +4234,7 @@ static struct lru_gen_mm_walk *set_mm_wa
+ 		VM_WARN_ON_ONCE(walk);
+ 
+ 		walk = &pgdat->mm_walk;
+-	} else if (!pgdat && !walk) {
++	} else if (!walk && force_alloc) {
+ 		VM_WARN_ON_ONCE(current_is_kswapd());
+ 
+ 		walk = kzalloc(sizeof(*walk), __GFP_HIGH | __GFP_NOMEMALLOC | __GFP_NOWARN);
+@@ -4417,7 +4420,7 @@ static bool try_to_inc_max_seq(struct lr
+ 		goto done;
+ 	}
+ 
+-	walk = set_mm_walk(NULL);
++	walk = set_mm_walk(NULL, true);
+ 	if (!walk) {
+ 		success = iterate_mm_list_nowalk(lruvec, max_seq);
+ 		goto done;
+@@ -4486,8 +4489,6 @@ static bool lruvec_is_reclaimable(struct
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+ 	DEFINE_MIN_SEQ(lruvec);
+ 
+-	VM_WARN_ON_ONCE(sc->memcg_low_reclaim);
+-
+ 	/* see the comment on lru_gen_folio */
+ 	gen = lru_gen_from_seq(min_seq[LRU_GEN_FILE]);
+ 	birth = READ_ONCE(lruvec->lrugen.timestamps[gen]);
+@@ -4743,12 +4744,8 @@ static bool isolate_folio(struct lruvec
+ {
+ 	bool success;
+ 
+-	/* unmapping inhibited */
+-	if (!sc->may_unmap && folio_mapped(folio))
+-		return false;
+-
+ 	/* swapping inhibited */
+-	if (!(sc->may_writepage && (sc->gfp_mask & __GFP_IO)) &&
++	if (!(sc->gfp_mask & __GFP_IO) &&
+ 	    (folio_test_dirty(folio) ||
+ 	     (folio_test_anon(folio) && !folio_test_swapcache(folio))))
+ 		return false;
+@@ -4845,9 +4842,8 @@ static int scan_folios(struct lruvec *lr
+ 	__count_vm_events(PGSCAN_ANON + type, isolated);
+ 
+ 	/*
+-	 * There might not be eligible pages due to reclaim_idx, may_unmap and
+-	 * may_writepage. Check the remaining to prevent livelock if it's not
+-	 * making progress.
++	 * There might not be eligible folios due to reclaim_idx. Check the
++	 * remaining to prevent livelock if it's not making progress.
+ 	 */
+ 	return isolated || !remaining ? scanned : 0;
+ }
+@@ -5107,8 +5103,7 @@ static long get_nr_to_scan(struct lruvec
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+ 	DEFINE_MAX_SEQ(lruvec);
+ 
+-	if (mem_cgroup_below_min(memcg) ||
+-	    (mem_cgroup_below_low(memcg) && !sc->memcg_low_reclaim))
++	if (mem_cgroup_below_min(memcg))
+ 		return 0;
+ 
+ 	if (!should_run_aging(lruvec, max_seq, sc, can_swap, &nr_to_scan))
+@@ -5136,17 +5131,14 @@ static bool try_to_shrink_lruvec(struct
+ 	long nr_to_scan;
+ 	unsigned long scanned = 0;
+ 	unsigned long nr_to_reclaim = get_nr_to_reclaim(sc);
++	int swappiness = get_swappiness(lruvec, sc);
++
++	/* clean file folios are more likely to exist */
++	if (swappiness && !(sc->gfp_mask & __GFP_IO))
++		swappiness = 1;
+ 
+ 	while (true) {
+ 		int delta;
+-		int swappiness;
+-
+-		if (sc->may_swap)
+-			swappiness = get_swappiness(lruvec, sc);
+-		else if (!cgroup_reclaim(sc) && get_swappiness(lruvec, sc))
+-			swappiness = 1;
+-		else
+-			swappiness = 0;
+ 
+ 		nr_to_scan = get_nr_to_scan(lruvec, sc, swappiness);
+ 		if (nr_to_scan <= 0)
+@@ -5277,12 +5269,13 @@ static void lru_gen_shrink_lruvec(struct
+ 	struct blk_plug plug;
+ 
+ 	VM_WARN_ON_ONCE(global_reclaim(sc));
++	VM_WARN_ON_ONCE(!sc->may_writepage || !sc->may_unmap);
+ 
+ 	lru_add_drain();
+ 
+ 	blk_start_plug(&plug);
+ 
+-	set_mm_walk(lruvec_pgdat(lruvec));
++	set_mm_walk(NULL, sc->proactive);
+ 
+ 	if (try_to_shrink_lruvec(lruvec, sc))
+ 		lru_gen_rotate_memcg(lruvec, MEMCG_LRU_YOUNG);
+@@ -5338,11 +5331,19 @@ static void lru_gen_shrink_node(struct p
+ 
+ 	VM_WARN_ON_ONCE(!global_reclaim(sc));
+ 
++	/*
++	 * Unmapped clean folios are already prioritized. Scanning for more of
++	 * them is likely futile and can cause high reclaim latency when there
++	 * is a large number of memcgs.
++	 */
++	if (!sc->may_writepage || !sc->may_unmap)
++		goto done;
++
+ 	lru_add_drain();
+ 
+ 	blk_start_plug(&plug);
+ 
+-	set_mm_walk(pgdat);
++	set_mm_walk(pgdat, sc->proactive);
+ 
+ 	set_initial_priority(pgdat, sc);
+ 
+@@ -5360,7 +5361,7 @@ static void lru_gen_shrink_node(struct p
+ 	clear_mm_walk();
+ 
+ 	blk_finish_plug(&plug);
+-
++done:
+ 	/* kswapd should never fail */
+ 	pgdat->kswapd_failures = 0;
+ }
+@@ -5932,7 +5933,7 @@ static ssize_t lru_gen_seq_write(struct
+ 	set_task_reclaim_state(current, &sc.reclaim_state);
+ 	flags = memalloc_noreclaim_save();
+ 	blk_start_plug(&plug);
+-	if (!set_mm_walk(NULL)) {
++	if (!set_mm_walk(NULL, true)) {
+ 		err = -ENOMEM;
+ 		goto done;
+ 	}
diff --git a/target/linux/generic/backport-6.1/020-v6.3-08-UPSTREAM-mm-multi-gen-LRU-simplify-arch_has_hw_pte_y.patch b/target/linux/generic/backport-6.1/020-v6.3-08-UPSTREAM-mm-multi-gen-LRU-simplify-arch_has_hw_pte_y.patch
new file mode 100644
index 00000000000000..d7d98ca6c59291
--- /dev/null
+++ b/target/linux/generic/backport-6.1/020-v6.3-08-UPSTREAM-mm-multi-gen-LRU-simplify-arch_has_hw_pte_y.patch
@@ -0,0 +1,38 @@
+From 25887d48dff860751a06caa4188bfaf6bfb6e4b2 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Wed, 21 Dec 2022 21:19:06 -0700
+Subject: [PATCH 08/19] UPSTREAM: mm: multi-gen LRU: simplify
+ arch_has_hw_pte_young() check
+
+Scanning page tables when hardware does not set the accessed bit has
+no real use cases.
+
+Link: https://lkml.kernel.org/r/20221222041905.2431096-9-yuzhao@google.com
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Roman Gushchin <roman.gushchin@linux.dev>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Bug: 274865848
+(cherry picked from commit f386e9314025ea99dae639ed2032560a92081430)
+Change-Id: I84d97ab665b4e3bb862a9bc7d72f50dea7191a6b
+Signed-off-by: T.J. Mercier <tjmercier@google.com>
+---
+ mm/vmscan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -4415,7 +4415,7 @@ static bool try_to_inc_max_seq(struct lr
+ 	 * handful of PTEs. Spreading the work out over a period of time usually
+ 	 * is less efficient, but it avoids bursty page faults.
+ 	 */
+-	if (!force_scan && !(arch_has_hw_pte_young() && get_cap(LRU_GEN_MM_WALK))) {
++	if (!arch_has_hw_pte_young() || !get_cap(LRU_GEN_MM_WALK)) {
+ 		success = iterate_mm_list_nowalk(lruvec, max_seq);
+ 		goto done;
+ 	}
diff --git a/target/linux/generic/backport-6.1/020-v6.3-09-UPSTREAM-mm-multi-gen-LRU-avoid-futile-retries.patch b/target/linux/generic/backport-6.1/020-v6.3-09-UPSTREAM-mm-multi-gen-LRU-avoid-futile-retries.patch
new file mode 100644
index 00000000000000..1f91cb9f54f6ab
--- /dev/null
+++ b/target/linux/generic/backport-6.1/020-v6.3-09-UPSTREAM-mm-multi-gen-LRU-avoid-futile-retries.patch
@@ -0,0 +1,92 @@
+From 620b0ee94455e48d124414cd06d8a53f69fb6453 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Mon, 13 Feb 2023 00:53:22 -0700
+Subject: [PATCH 09/19] UPSTREAM: mm: multi-gen LRU: avoid futile retries
+
+Recall that the per-node memcg LRU has two generations and they alternate
+when the last memcg (of a given node) is moved from one to the other.
+Each generation is also sharded into multiple bins to improve scalability.
+A reclaimer starts with a random bin (in the old generation) and, if it
+fails, it will retry, i.e., to try the rest of the bins.
+
+If a reclaimer fails with the last memcg, it should move this memcg to the
+young generation first, which causes the generations to alternate, and
+then retry.  Otherwise, the retries will be futile because all other bins
+are empty.
+
+Link: https://lkml.kernel.org/r/20230213075322.1416966-1-yuzhao@google.com
+Fixes: e4dde56cd208 ("mm: multi-gen LRU: per-node lru_gen_folio lists")
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Reported-by: T.J. Mercier <tjmercier@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Bug: 274865848
+(cherry picked from commit 9f550d78b40da21b4da515db4c37d8d7b12aa1a6)
+Change-Id: Ie92535676b005ec9e7987632b742fdde8d54436f
+Signed-off-by: T.J. Mercier <tjmercier@google.com>
+---
+ mm/vmscan.c | 25 +++++++++++++++----------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -5206,18 +5206,20 @@ static int shrink_one(struct lruvec *lru
+ 
+ static void shrink_many(struct pglist_data *pgdat, struct scan_control *sc)
+ {
++	int op;
+ 	int gen;
+ 	int bin;
+ 	int first_bin;
+ 	struct lruvec *lruvec;
+ 	struct lru_gen_folio *lrugen;
++	struct mem_cgroup *memcg;
+ 	const struct hlist_nulls_node *pos;
+-	int op = 0;
+-	struct mem_cgroup *memcg = NULL;
+ 	unsigned long nr_to_reclaim = get_nr_to_reclaim(sc);
+ 
+ 	bin = first_bin = get_random_u32_below(MEMCG_NR_BINS);
+ restart:
++	op = 0;
++	memcg = NULL;
+ 	gen = get_memcg_gen(READ_ONCE(pgdat->memcg_lru.seq));
+ 
+ 	rcu_read_lock();
+@@ -5241,14 +5243,22 @@ restart:
+ 
+ 		op = shrink_one(lruvec, sc);
+ 
+-		if (sc->nr_reclaimed >= nr_to_reclaim)
+-			goto success;
+-
+ 		rcu_read_lock();
++
++		if (sc->nr_reclaimed >= nr_to_reclaim)
++			break;
+ 	}
+ 
+ 	rcu_read_unlock();
+ 
++	if (op)
++		lru_gen_rotate_memcg(lruvec, op);
++
++	mem_cgroup_put(memcg);
++
++	if (sc->nr_reclaimed >= nr_to_reclaim)
++		return;
++
+ 	/* restart if raced with lru_gen_rotate_memcg() */
+ 	if (gen != get_nulls_value(pos))
+ 		goto restart;
+@@ -5257,11 +5267,6 @@ restart:
+ 	bin = get_memcg_bin(bin + 1);
+ 	if (bin != first_bin)
+ 		goto restart;
+-success:
+-	if (op)
+-		lru_gen_rotate_memcg(lruvec, op);
+-
+-	mem_cgroup_put(memcg);
+ }
+ 
+ static void lru_gen_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
diff --git a/target/linux/generic/backport-6.1/020-v6.3-10-UPSTREAM-mm-add-vma_has_recency.patch b/target/linux/generic/backport-6.1/020-v6.3-10-UPSTREAM-mm-add-vma_has_recency.patch
new file mode 100644
index 00000000000000..b5051d71a476b9
--- /dev/null
+++ b/target/linux/generic/backport-6.1/020-v6.3-10-UPSTREAM-mm-add-vma_has_recency.patch
@@ -0,0 +1,191 @@
+From 70d216c71ff5c5b17dd1da6294f97b91fb6aba7a Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Fri, 30 Dec 2022 14:52:51 -0700
+Subject: [PATCH 10/19] UPSTREAM: mm: add vma_has_recency()
+
+Add vma_has_recency() to indicate whether a VMA may exhibit temporal
+locality that the LRU algorithm relies on.
+
+This function returns false for VMAs marked by VM_SEQ_READ or
+VM_RAND_READ.  While the former flag indicates linear access, i.e., a
+special case of spatial locality, both flags indicate a lack of temporal
+locality, i.e., the reuse of an area within a relatively small duration.
+
+"Recency" is chosen over "locality" to avoid confusion between temporal
+and spatial localities.
+
+Before this patch, the active/inactive LRU only ignored the accessed bit
+from VMAs marked by VM_SEQ_READ.  After this patch, the active/inactive
+LRU and MGLRU share the same logic: they both ignore the accessed bit if
+vma_has_recency() returns false.
+
+For the active/inactive LRU, the following fio test showed a [6, 8]%
+increase in IOPS when randomly accessing mapped files under memory
+pressure.
+
+  kb=$(awk '/MemTotal/ { print $2 }' /proc/meminfo)
+  kb=$((kb - 8*1024*1024))
+
+  modprobe brd rd_nr=1 rd_size=$kb
+  dd if=/dev/zero of=/dev/ram0 bs=1M
+
+  mkfs.ext4 /dev/ram0
+  mount /dev/ram0 /mnt/
+  swapoff -a
+
+  fio --name=test --directory=/mnt/ --ioengine=mmap --numjobs=8 \
+      --size=8G --rw=randrw --time_based --runtime=10m \
+      --group_reporting
+
+The discussion that led to this patch is here [1].  Additional test
+results are available in that thread.
+
+[1] https://lore.kernel.org/r/Y31s%2FK8T85jh05wH@google.com/
+
+Link: https://lkml.kernel.org/r/20221230215252.2628425-1-yuzhao@google.com
+Change-Id: I291dcb795197659e40e46539cd32b857677c34ad
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: Andrea Righi <andrea.righi@canonical.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+(cherry picked from commit 8788f6781486769d9598dcaedc3fe0eb12fc3e59)
+Bug: 274865848
+Signed-off-by: T.J. Mercier <tjmercier@google.com>
+---
+ include/linux/mm_inline.h |  8 ++++++++
+ mm/memory.c               |  7 +++----
+ mm/rmap.c                 | 42 +++++++++++++++++----------------------
+ mm/vmscan.c               |  5 ++++-
+ 4 files changed, 33 insertions(+), 29 deletions(-)
+
+--- a/include/linux/mm_inline.h
++++ b/include/linux/mm_inline.h
+@@ -595,4 +595,12 @@ pte_install_uffd_wp_if_needed(struct vm_
+ #endif
+ }
+ 
++static inline bool vma_has_recency(struct vm_area_struct *vma)
++{
++	if (vma->vm_flags & (VM_SEQ_READ | VM_RAND_READ))
++		return false;
++
++	return true;
++}
++
+ #endif
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1435,8 +1435,7 @@ again:
+ 					force_flush = 1;
+ 					set_page_dirty(page);
+ 				}
+-				if (pte_young(ptent) &&
+-				    likely(!(vma->vm_flags & VM_SEQ_READ)))
++				if (pte_young(ptent) && likely(vma_has_recency(vma)))
+ 					mark_page_accessed(page);
+ 			}
+ 			rss[mm_counter(page)]--;
+@@ -5170,8 +5169,8 @@ static inline void mm_account_fault(stru
+ #ifdef CONFIG_LRU_GEN
+ static void lru_gen_enter_fault(struct vm_area_struct *vma)
+ {
+-	/* the LRU algorithm doesn't apply to sequential or random reads */
+-	current->in_lru_fault = !(vma->vm_flags & (VM_SEQ_READ | VM_RAND_READ));
++	/* the LRU algorithm only applies to accesses with recency */
++	current->in_lru_fault = vma_has_recency(vma);
+ }
+ 
+ static void lru_gen_exit_fault(void)
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -823,25 +823,14 @@ static bool folio_referenced_one(struct
+ 		}
+ 
+ 		if (pvmw.pte) {
+-			if (lru_gen_enabled() && pte_young(*pvmw.pte) &&
+-			    !(vma->vm_flags & (VM_SEQ_READ | VM_RAND_READ))) {
++			if (lru_gen_enabled() && pte_young(*pvmw.pte)) {
+ 				lru_gen_look_around(&pvmw);
+ 				referenced++;
+ 			}
+ 
+ 			if (ptep_clear_flush_young_notify(vma, address,
+-						pvmw.pte)) {
+-				/*
+-				 * Don't treat a reference through
+-				 * a sequentially read mapping as such.
+-				 * If the folio has been used in another mapping,
+-				 * we will catch it; if this other mapping is
+-				 * already gone, the unmap path will have set
+-				 * the referenced flag or activated the folio.
+-				 */
+-				if (likely(!(vma->vm_flags & VM_SEQ_READ)))
+-					referenced++;
+-			}
++						pvmw.pte))
++				referenced++;
+ 		} else if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE)) {
+ 			if (pmdp_clear_flush_young_notify(vma, address,
+ 						pvmw.pmd))
+@@ -875,7 +864,20 @@ static bool invalid_folio_referenced_vma
+ 	struct folio_referenced_arg *pra = arg;
+ 	struct mem_cgroup *memcg = pra->memcg;
+ 
+-	if (!mm_match_cgroup(vma->vm_mm, memcg))
++	/*
++	 * Ignore references from this mapping if it has no recency. If the
++	 * folio has been used in another mapping, we will catch it; if this
++	 * other mapping is already gone, the unmap path will have set the
++	 * referenced flag or activated the folio in zap_pte_range().
++	 */
++	if (!vma_has_recency(vma))
++		return true;
++
++	/*
++	 * If we are reclaiming on behalf of a cgroup, skip counting on behalf
++	 * of references from different cgroups.
++	 */
++	if (memcg && !mm_match_cgroup(vma->vm_mm, memcg))
+ 		return true;
+ 
+ 	return false;
+@@ -906,6 +908,7 @@ int folio_referenced(struct folio *folio
+ 		.arg = (void *)&pra,
+ 		.anon_lock = folio_lock_anon_vma_read,
+ 		.try_lock = true,
++		.invalid_vma = invalid_folio_referenced_vma,
+ 	};
+ 
+ 	*vm_flags = 0;
+@@ -921,15 +924,6 @@ int folio_referenced(struct folio *folio
+ 			return 1;
+ 	}
+ 
+-	/*
+-	 * If we are reclaiming on behalf of a cgroup, skip
+-	 * counting on behalf of references from different
+-	 * cgroups
+-	 */
+-	if (memcg) {
+-		rwc.invalid_vma = invalid_folio_referenced_vma;
+-	}
+-
+ 	rmap_walk(folio, &rwc);
+ 	*vm_flags = pra.vm_flags;
+ 
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -3778,7 +3778,10 @@ static int should_skip_vma(unsigned long
+ 	if (is_vm_hugetlb_page(vma))
+ 		return true;
+ 
+-	if (vma->vm_flags & (VM_LOCKED | VM_SPECIAL | VM_SEQ_READ | VM_RAND_READ))
++	if (!vma_has_recency(vma))
++		return true;
++
++	if (vma->vm_flags & (VM_LOCKED | VM_SPECIAL))
+ 		return true;
+ 
+ 	if (vma == get_gate_vma(vma->vm_mm))
diff --git a/target/linux/generic/backport-6.1/020-v6.3-11-UPSTREAM-mm-support-POSIX_FADV_NOREUSE.patch b/target/linux/generic/backport-6.1/020-v6.3-11-UPSTREAM-mm-support-POSIX_FADV_NOREUSE.patch
new file mode 100644
index 00000000000000..00e5b6e8d513c8
--- /dev/null
+++ b/target/linux/generic/backport-6.1/020-v6.3-11-UPSTREAM-mm-support-POSIX_FADV_NOREUSE.patch
@@ -0,0 +1,129 @@
+From 9ca4e437a24dfc4ec6c362f319eb9850b9eca497 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Fri, 30 Dec 2022 14:52:52 -0700
+Subject: [PATCH 11/19] UPSTREAM: mm: support POSIX_FADV_NOREUSE
+
+This patch adds POSIX_FADV_NOREUSE to vma_has_recency() so that the LRU
+algorithm can ignore access to mapped files marked by this flag.
+
+The advantages of POSIX_FADV_NOREUSE are:
+1. Unlike MADV_SEQUENTIAL and MADV_RANDOM, it does not alter the
+   default readahead behavior.
+2. Unlike MADV_SEQUENTIAL and MADV_RANDOM, it does not split VMAs and
+   therefore does not take mmap_lock.
+3. Unlike MADV_COLD, setting it has a negligible cost, regardless of
+   how many pages it affects.
+
+Its limitations are:
+1. Like POSIX_FADV_RANDOM and POSIX_FADV_SEQUENTIAL, it currently does
+   not support range. IOW, its scope is the entire file.
+2. It currently does not ignore access through file descriptors.
+   Specifically, for the active/inactive LRU, given a file page shared
+   by two users and one of them having set POSIX_FADV_NOREUSE on the
+   file, this page will be activated upon the second user accessing
+   it. This corner case can be covered by checking POSIX_FADV_NOREUSE
+   before calling folio_mark_accessed() on the read path. But it is
+   considered not worth the effort.
+
+There have been a few attempts to support POSIX_FADV_NOREUSE, e.g., [1].
+This time the goal is to fill a niche: a few desktop applications, e.g.,
+large file transferring and video encoding/decoding, want fast file
+streaming with mmap() rather than direct IO.  Among those applications, an
+SVT-AV1 regression was reported when running with MGLRU [2].  The
+following test can reproduce that regression.
+
+  kb=$(awk '/MemTotal/ { print $2 }' /proc/meminfo)
+  kb=$((kb - 8*1024*1024))
+
+  modprobe brd rd_nr=1 rd_size=$kb
+  dd if=/dev/zero of=/dev/ram0 bs=1M
+
+  mkfs.ext4 /dev/ram0
+  mount /dev/ram0 /mnt/
+  swapoff -a
+
+  fallocate -l 8G /mnt/swapfile
+  mkswap /mnt/swapfile
+  swapon /mnt/swapfile
+
+  wget http://ultravideo.cs.tut.fi/video/Bosphorus_3840x2160_120fps_420_8bit_YUV_Y4M.7z
+  7z e -o/mnt/ Bosphorus_3840x2160_120fps_420_8bit_YUV_Y4M.7z
+  SvtAv1EncApp --preset 12 -w 3840 -h 2160 \
+               -i /mnt/Bosphorus_3840x2160.y4m
+
+For MGLRU, the following change showed a [9-11]% increase in FPS,
+which makes it on par with the active/inactive LRU.
+
+  patch Source/App/EncApp/EbAppMain.c <<EOF
+  31a32
+  > #include <fcntl.h>
+  35d35
+  < #include <fcntl.h> /* _O_BINARY */
+  117a118
+  >             posix_fadvise(config->mmap.fd, 0, 0, POSIX_FADV_NOREUSE);
+  EOF
+
+[1] https://lore.kernel.org/r/1308923350-7932-1-git-send-email-andrea@betterlinux.com/
+[2] https://openbenchmarking.org/result/2209259-PTS-MGLRU8GB57
+
+Link: https://lkml.kernel.org/r/20221230215252.2628425-2-yuzhao@google.com
+Change-Id: I0b7f5f971d78014ea1ba44cee6a8ec902a4330d0
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: Andrea Righi <andrea.righi@canonical.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Michael Larabel <Michael@MichaelLarabel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+(cherry picked from commit 17e810229cb3068b692fa078bd9b3a6527e0866a)
+Bug: 274865848
+Signed-off-by: T.J. Mercier <tjmercier@google.com>
+---
+ include/linux/fs.h        | 2 ++
+ include/linux/mm_inline.h | 3 +++
+ mm/fadvise.c              | 5 ++++-
+ 3 files changed, 9 insertions(+), 1 deletion(-)
+
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -166,6 +166,8 @@ typedef int (dio_iodone_t)(struct kiocb
+ /* File supports DIRECT IO */
+ #define	FMODE_CAN_ODIRECT	((__force fmode_t)0x400000)
+ 
++#define	FMODE_NOREUSE		((__force fmode_t)0x800000)
++
+ /* File was opened by fanotify and shouldn't generate fanotify events */
+ #define FMODE_NONOTIFY		((__force fmode_t)0x4000000)
+ 
+--- a/include/linux/mm_inline.h
++++ b/include/linux/mm_inline.h
+@@ -600,6 +600,9 @@ static inline bool vma_has_recency(struc
+ 	if (vma->vm_flags & (VM_SEQ_READ | VM_RAND_READ))
+ 		return false;
+ 
++	if (vma->vm_file && (vma->vm_file->f_mode & FMODE_NOREUSE))
++		return false;
++
+ 	return true;
+ }
+ 
+--- a/mm/fadvise.c
++++ b/mm/fadvise.c
+@@ -80,7 +80,7 @@ int generic_fadvise(struct file *file, l
+ 	case POSIX_FADV_NORMAL:
+ 		file->f_ra.ra_pages = bdi->ra_pages;
+ 		spin_lock(&file->f_lock);
+-		file->f_mode &= ~FMODE_RANDOM;
++		file->f_mode &= ~(FMODE_RANDOM | FMODE_NOREUSE);
+ 		spin_unlock(&file->f_lock);
+ 		break;
+ 	case POSIX_FADV_RANDOM:
+@@ -107,6 +107,9 @@ int generic_fadvise(struct file *file, l
+ 		force_page_cache_readahead(mapping, file, start_index, nrpages);
+ 		break;
+ 	case POSIX_FADV_NOREUSE:
++		spin_lock(&file->f_lock);
++		file->f_mode |= FMODE_NOREUSE;
++		spin_unlock(&file->f_lock);
+ 		break;
+ 	case POSIX_FADV_DONTNEED:
+ 		__filemap_fdatawrite_range(mapping, offset, endbyte,
diff --git a/target/linux/generic/backport-6.1/020-v6.3-12-UPSTREAM-mm-multi-gen-LRU-section-for-working-set-pr.patch b/target/linux/generic/backport-6.1/020-v6.3-12-UPSTREAM-mm-multi-gen-LRU-section-for-working-set-pr.patch
new file mode 100644
index 00000000000000..ca68b3a86aa8be
--- /dev/null
+++ b/target/linux/generic/backport-6.1/020-v6.3-12-UPSTREAM-mm-multi-gen-LRU-section-for-working-set-pr.patch
@@ -0,0 +1,67 @@
+From 1b5e4c317d80f4826eceb3781702d18d06b14394 Mon Sep 17 00:00:00 2001
+From: "T.J. Alumbaugh" <talumbau@google.com>
+Date: Wed, 18 Jan 2023 00:18:21 +0000
+Subject: [PATCH 12/19] UPSTREAM: mm: multi-gen LRU: section for working set
+ protection
+
+Patch series "mm: multi-gen LRU: improve".
+
+This patch series improves a few MGLRU functions, collects related
+functions, and adds additional documentation.
+
+This patch (of 7):
+
+Add a section for working set protection in the code and the design doc.
+The admin doc already contains its usage.
+
+Link: https://lkml.kernel.org/r/20230118001827.1040870-1-talumbau@google.com
+Link: https://lkml.kernel.org/r/20230118001827.1040870-2-talumbau@google.com
+Change-Id: I65599075fd42951db7739a2ab7cee78516e157b3
+Signed-off-by: T.J. Alumbaugh <talumbau@google.com>
+Cc: Yu Zhao <yuzhao@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+(cherry picked from commit 7b8144e63d84716f16a1b929e0c7e03ae5c4d5c1)
+Bug: 274865848
+Signed-off-by: T.J. Mercier <tjmercier@google.com>
+---
+ Documentation/mm/multigen_lru.rst | 15 +++++++++++++++
+ mm/vmscan.c                       |  4 ++++
+ 2 files changed, 19 insertions(+)
+
+--- a/Documentation/mm/multigen_lru.rst
++++ b/Documentation/mm/multigen_lru.rst
+@@ -141,6 +141,21 @@ loop has detected outlying refaults from
+ this end, the feedback loop uses the first tier as the baseline, for
+ the reason stated earlier.
+ 
++Working set protection
++----------------------
++Each generation is timestamped at birth. If ``lru_gen_min_ttl`` is
++set, an ``lruvec`` is protected from the eviction when its oldest
++generation was born within ``lru_gen_min_ttl`` milliseconds. In other
++words, it prevents the working set of ``lru_gen_min_ttl`` milliseconds
++from getting evicted. The OOM killer is triggered if this working set
++cannot be kept in memory.
++
++This time-based approach has the following advantages:
++
++1. It is easier to configure because it is agnostic to applications
++   and memory sizes.
++2. It is more reliable because it is directly wired to the OOM killer.
++
+ Summary
+ -------
+ The multi-gen LRU can be disassembled into the following parts:
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -4459,6 +4459,10 @@ done:
+ 	return true;
+ }
+ 
++/******************************************************************************
++ *                          working set protection
++ ******************************************************************************/
++
+ static bool lruvec_is_sizable(struct lruvec *lruvec, struct scan_control *sc)
+ {
+ 	int gen, type, zone;
diff --git a/target/linux/generic/backport-6.1/020-v6.3-13-UPSTREAM-mm-multi-gen-LRU-section-for-rmap-PT-walk-f.patch b/target/linux/generic/backport-6.1/020-v6.3-13-UPSTREAM-mm-multi-gen-LRU-section-for-rmap-PT-walk-f.patch
new file mode 100644
index 00000000000000..ca28cee2cb35fd
--- /dev/null
+++ b/target/linux/generic/backport-6.1/020-v6.3-13-UPSTREAM-mm-multi-gen-LRU-section-for-rmap-PT-walk-f.patch
@@ -0,0 +1,57 @@
+From 5ddf9d53d375e42af49b744bd7c2f8247c6bce15 Mon Sep 17 00:00:00 2001
+From: "T.J. Alumbaugh" <talumbau@google.com>
+Date: Wed, 18 Jan 2023 00:18:22 +0000
+Subject: [PATCH 13/19] UPSTREAM: mm: multi-gen LRU: section for rmap/PT walk
+ feedback
+
+Add a section for lru_gen_look_around() in the code and the design doc.
+
+Link: https://lkml.kernel.org/r/20230118001827.1040870-3-talumbau@google.com
+Change-Id: I5097af63f61b3b69ec2abee6cdbdc33c296df213
+Signed-off-by: T.J. Alumbaugh <talumbau@google.com>
+Cc: Yu Zhao <yuzhao@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+(cherry picked from commit db19a43d9b3a8876552f00f656008206ef9a5efa)
+Bug: 274865848
+Signed-off-by: T.J. Mercier <tjmercier@google.com>
+---
+ Documentation/mm/multigen_lru.rst | 14 ++++++++++++++
+ mm/vmscan.c                       |  4 ++++
+ 2 files changed, 18 insertions(+)
+
+--- a/Documentation/mm/multigen_lru.rst
++++ b/Documentation/mm/multigen_lru.rst
+@@ -156,6 +156,20 @@ This time-based approach has the followi
+    and memory sizes.
+ 2. It is more reliable because it is directly wired to the OOM killer.
+ 
++Rmap/PT walk feedback
++---------------------
++Searching the rmap for PTEs mapping each page on an LRU list (to test
++and clear the accessed bit) can be expensive because pages from
++different VMAs (PA space) are not cache friendly to the rmap (VA
++space). For workloads mostly using mapped pages, searching the rmap
++can incur the highest CPU cost in the reclaim path.
++
++``lru_gen_look_around()`` exploits spatial locality to reduce the
++trips into the rmap. It scans the adjacent PTEs of a young PTE and
++promotes hot pages. If the scan was done cacheline efficiently, it
++adds the PMD entry pointing to the PTE table to the Bloom filter. This
++forms a feedback loop between the eviction and the aging.
++
+ Summary
+ -------
+ The multi-gen LRU can be disassembled into the following parts:
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -4553,6 +4553,10 @@ static void lru_gen_age_node(struct pgli
+ 	}
+ }
+ 
++/******************************************************************************
++ *                          rmap/PT walk feedback
++ ******************************************************************************/
++
+ /*
+  * This function exploits spatial locality when shrink_folio_list() walks the
+  * rmap. It scans the adjacent PTEs of a young PTE and promotes hot pages. If
diff --git a/target/linux/generic/backport-6.1/020-v6.3-14-UPSTREAM-mm-multi-gen-LRU-section-for-Bloom-filters.patch b/target/linux/generic/backport-6.1/020-v6.3-14-UPSTREAM-mm-multi-gen-LRU-section-for-Bloom-filters.patch
new file mode 100644
index 00000000000000..a7dfb5ffe7960e
--- /dev/null
+++ b/target/linux/generic/backport-6.1/020-v6.3-14-UPSTREAM-mm-multi-gen-LRU-section-for-Bloom-filters.patch
@@ -0,0 +1,243 @@
+From 397624e12244ec038f51cb1f178ccb7a2ec562e5 Mon Sep 17 00:00:00 2001
+From: "T.J. Alumbaugh" <talumbau@google.com>
+Date: Wed, 18 Jan 2023 00:18:23 +0000
+Subject: [PATCH 14/19] UPSTREAM: mm: multi-gen LRU: section for Bloom filters
+
+Move Bloom filters code into a dedicated section.  Improve the design doc
+to explain Bloom filter usage and connection between aging and eviction in
+their use.
+
+Link: https://lkml.kernel.org/r/20230118001827.1040870-4-talumbau@google.com
+Change-Id: I73e866f687c1ed9f5c8538086aa39408b79897db
+Signed-off-by: T.J. Alumbaugh <talumbau@google.com>
+Cc: Yu Zhao <yuzhao@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+(cherry picked from commit ccbbbb85945d8f0255aa9dbc1b617017e2294f2c)
+Bug: 274865848
+Signed-off-by: T.J. Mercier <tjmercier@google.com>
+---
+ Documentation/mm/multigen_lru.rst |  16 +++
+ mm/vmscan.c                       | 180 +++++++++++++++---------------
+ 2 files changed, 108 insertions(+), 88 deletions(-)
+
+--- a/Documentation/mm/multigen_lru.rst
++++ b/Documentation/mm/multigen_lru.rst
+@@ -170,6 +170,22 @@ promotes hot pages. If the scan was done
+ adds the PMD entry pointing to the PTE table to the Bloom filter. This
+ forms a feedback loop between the eviction and the aging.
+ 
++Bloom Filters
++-------------
++Bloom filters are a space and memory efficient data structure for set
++membership test, i.e., test if an element is not in the set or may be
++in the set.
++
++In the eviction path, specifically, in ``lru_gen_look_around()``, if a
++PMD has a sufficient number of hot pages, its address is placed in the
++filter. In the aging path, set membership means that the PTE range
++will be scanned for young pages.
++
++Note that Bloom filters are probabilistic on set membership. If a test
++is false positive, the cost is an additional scan of a range of PTEs,
++which may yield hot pages anyway. Parameters of the filter itself can
++control the false positive rate in the limit.
++
+ Summary
+ -------
+ The multi-gen LRU can be disassembled into the following parts:
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -3209,6 +3209,98 @@ static bool __maybe_unused seq_is_valid(
+ }
+ 
+ /******************************************************************************
++ *                          Bloom filters
++ ******************************************************************************/
++
++/*
++ * Bloom filters with m=1<<15, k=2 and the false positive rates of ~1/5 when
++ * n=10,000 and ~1/2 when n=20,000, where, conventionally, m is the number of
++ * bits in a bitmap, k is the number of hash functions and n is the number of
++ * inserted items.
++ *
++ * Page table walkers use one of the two filters to reduce their search space.
++ * To get rid of non-leaf entries that no longer have enough leaf entries, the
++ * aging uses the double-buffering technique to flip to the other filter each
++ * time it produces a new generation. For non-leaf entries that have enough
++ * leaf entries, the aging carries them over to the next generation in
++ * walk_pmd_range(); the eviction also report them when walking the rmap
++ * in lru_gen_look_around().
++ *
++ * For future optimizations:
++ * 1. It's not necessary to keep both filters all the time. The spare one can be
++ *    freed after the RCU grace period and reallocated if needed again.
++ * 2. And when reallocating, it's worth scaling its size according to the number
++ *    of inserted entries in the other filter, to reduce the memory overhead on
++ *    small systems and false positives on large systems.
++ * 3. Jenkins' hash function is an alternative to Knuth's.
++ */
++#define BLOOM_FILTER_SHIFT	15
++
++static inline int filter_gen_from_seq(unsigned long seq)
++{
++	return seq % NR_BLOOM_FILTERS;
++}
++
++static void get_item_key(void *item, int *key)
++{
++	u32 hash = hash_ptr(item, BLOOM_FILTER_SHIFT * 2);
++
++	BUILD_BUG_ON(BLOOM_FILTER_SHIFT * 2 > BITS_PER_TYPE(u32));
++
++	key[0] = hash & (BIT(BLOOM_FILTER_SHIFT) - 1);
++	key[1] = hash >> BLOOM_FILTER_SHIFT;
++}
++
++static bool test_bloom_filter(struct lruvec *lruvec, unsigned long seq, void *item)
++{
++	int key[2];
++	unsigned long *filter;
++	int gen = filter_gen_from_seq(seq);
++
++	filter = READ_ONCE(lruvec->mm_state.filters[gen]);
++	if (!filter)
++		return true;
++
++	get_item_key(item, key);
++
++	return test_bit(key[0], filter) && test_bit(key[1], filter);
++}
++
++static void update_bloom_filter(struct lruvec *lruvec, unsigned long seq, void *item)
++{
++	int key[2];
++	unsigned long *filter;
++	int gen = filter_gen_from_seq(seq);
++
++	filter = READ_ONCE(lruvec->mm_state.filters[gen]);
++	if (!filter)
++		return;
++
++	get_item_key(item, key);
++
++	if (!test_bit(key[0], filter))
++		set_bit(key[0], filter);
++	if (!test_bit(key[1], filter))
++		set_bit(key[1], filter);
++}
++
++static void reset_bloom_filter(struct lruvec *lruvec, unsigned long seq)
++{
++	unsigned long *filter;
++	int gen = filter_gen_from_seq(seq);
++
++	filter = lruvec->mm_state.filters[gen];
++	if (filter) {
++		bitmap_clear(filter, 0, BIT(BLOOM_FILTER_SHIFT));
++		return;
++	}
++
++	filter = bitmap_zalloc(BIT(BLOOM_FILTER_SHIFT),
++			       __GFP_HIGH | __GFP_NOMEMALLOC | __GFP_NOWARN);
++	WRITE_ONCE(lruvec->mm_state.filters[gen], filter);
++}
++
++/******************************************************************************
+  *                          mm_struct list
+  ******************************************************************************/
+ 
+@@ -3333,94 +3425,6 @@ void lru_gen_migrate_mm(struct mm_struct
+ }
+ #endif
+ 
+-/*
+- * Bloom filters with m=1<<15, k=2 and the false positive rates of ~1/5 when
+- * n=10,000 and ~1/2 when n=20,000, where, conventionally, m is the number of
+- * bits in a bitmap, k is the number of hash functions and n is the number of
+- * inserted items.
+- *
+- * Page table walkers use one of the two filters to reduce their search space.
+- * To get rid of non-leaf entries that no longer have enough leaf entries, the
+- * aging uses the double-buffering technique to flip to the other filter each
+- * time it produces a new generation. For non-leaf entries that have enough
+- * leaf entries, the aging carries them over to the next generation in
+- * walk_pmd_range(); the eviction also report them when walking the rmap
+- * in lru_gen_look_around().
+- *
+- * For future optimizations:
+- * 1. It's not necessary to keep both filters all the time. The spare one can be
+- *    freed after the RCU grace period and reallocated if needed again.
+- * 2. And when reallocating, it's worth scaling its size according to the number
+- *    of inserted entries in the other filter, to reduce the memory overhead on
+- *    small systems and false positives on large systems.
+- * 3. Jenkins' hash function is an alternative to Knuth's.
+- */
+-#define BLOOM_FILTER_SHIFT	15
+-
+-static inline int filter_gen_from_seq(unsigned long seq)
+-{
+-	return seq % NR_BLOOM_FILTERS;
+-}
+-
+-static void get_item_key(void *item, int *key)
+-{
+-	u32 hash = hash_ptr(item, BLOOM_FILTER_SHIFT * 2);
+-
+-	BUILD_BUG_ON(BLOOM_FILTER_SHIFT * 2 > BITS_PER_TYPE(u32));
+-
+-	key[0] = hash & (BIT(BLOOM_FILTER_SHIFT) - 1);
+-	key[1] = hash >> BLOOM_FILTER_SHIFT;
+-}
+-
+-static void reset_bloom_filter(struct lruvec *lruvec, unsigned long seq)
+-{
+-	unsigned long *filter;
+-	int gen = filter_gen_from_seq(seq);
+-
+-	filter = lruvec->mm_state.filters[gen];
+-	if (filter) {
+-		bitmap_clear(filter, 0, BIT(BLOOM_FILTER_SHIFT));
+-		return;
+-	}
+-
+-	filter = bitmap_zalloc(BIT(BLOOM_FILTER_SHIFT),
+-			       __GFP_HIGH | __GFP_NOMEMALLOC | __GFP_NOWARN);
+-	WRITE_ONCE(lruvec->mm_state.filters[gen], filter);
+-}
+-
+-static void update_bloom_filter(struct lruvec *lruvec, unsigned long seq, void *item)
+-{
+-	int key[2];
+-	unsigned long *filter;
+-	int gen = filter_gen_from_seq(seq);
+-
+-	filter = READ_ONCE(lruvec->mm_state.filters[gen]);
+-	if (!filter)
+-		return;
+-
+-	get_item_key(item, key);
+-
+-	if (!test_bit(key[0], filter))
+-		set_bit(key[0], filter);
+-	if (!test_bit(key[1], filter))
+-		set_bit(key[1], filter);
+-}
+-
+-static bool test_bloom_filter(struct lruvec *lruvec, unsigned long seq, void *item)
+-{
+-	int key[2];
+-	unsigned long *filter;
+-	int gen = filter_gen_from_seq(seq);
+-
+-	filter = READ_ONCE(lruvec->mm_state.filters[gen]);
+-	if (!filter)
+-		return true;
+-
+-	get_item_key(item, key);
+-
+-	return test_bit(key[0], filter) && test_bit(key[1], filter);
+-}
+-
+ static void reset_mm_stats(struct lruvec *lruvec, struct lru_gen_mm_walk *walk, bool last)
+ {
+ 	int i;
diff --git a/target/linux/generic/backport-6.1/020-v6.3-15-UPSTREAM-mm-multi-gen-LRU-section-for-memcg-LRU.patch b/target/linux/generic/backport-6.1/020-v6.3-15-UPSTREAM-mm-multi-gen-LRU-section-for-memcg-LRU.patch
new file mode 100644
index 00000000000000..735c91f79983be
--- /dev/null
+++ b/target/linux/generic/backport-6.1/020-v6.3-15-UPSTREAM-mm-multi-gen-LRU-section-for-memcg-LRU.patch
@@ -0,0 +1,427 @@
+From 48c916b812652f9453be5bd45a703728926d41ca Mon Sep 17 00:00:00 2001
+From: "T.J. Alumbaugh" <talumbau@google.com>
+Date: Wed, 18 Jan 2023 00:18:24 +0000
+Subject: [PATCH 15/19] UPSTREAM: mm: multi-gen LRU: section for memcg LRU
+
+Move memcg LRU code into a dedicated section.  Improve the design doc to
+outline its architecture.
+
+Link: https://lkml.kernel.org/r/20230118001827.1040870-5-talumbau@google.com
+Change-Id: Id252e420cff7a858acb098cf2b3642da5c40f602
+Signed-off-by: T.J. Alumbaugh <talumbau@google.com>
+Cc: Yu Zhao <yuzhao@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+(cherry picked from commit 36c7b4db7c942ae9e1b111f0c6b468c8b2e33842)
+Bug: 274865848
+Signed-off-by: T.J. Mercier <tjmercier@google.com>
+---
+ Documentation/mm/multigen_lru.rst |  33 +++-
+ include/linux/mm_inline.h         |  17 --
+ include/linux/mmzone.h            |  13 +-
+ mm/memcontrol.c                   |   8 +-
+ mm/vmscan.c                       | 250 +++++++++++++++++-------------
+ 5 files changed, 178 insertions(+), 143 deletions(-)
+
+--- a/Documentation/mm/multigen_lru.rst
++++ b/Documentation/mm/multigen_lru.rst
+@@ -186,9 +186,40 @@ is false positive, the cost is an additi
+ which may yield hot pages anyway. Parameters of the filter itself can
+ control the false positive rate in the limit.
+ 
++Memcg LRU
++---------
++An memcg LRU is a per-node LRU of memcgs. It is also an LRU of LRUs,
++since each node and memcg combination has an LRU of folios (see
++``mem_cgroup_lruvec()``). Its goal is to improve the scalability of
++global reclaim, which is critical to system-wide memory overcommit in
++data centers. Note that memcg LRU only applies to global reclaim.
++
++The basic structure of an memcg LRU can be understood by an analogy to
++the active/inactive LRU (of folios):
++
++1. It has the young and the old (generations), i.e., the counterparts
++   to the active and the inactive;
++2. The increment of ``max_seq`` triggers promotion, i.e., the
++   counterpart to activation;
++3. Other events trigger similar operations, e.g., offlining an memcg
++   triggers demotion, i.e., the counterpart to deactivation.
++
++In terms of global reclaim, it has two distinct features:
++
++1. Sharding, which allows each thread to start at a random memcg (in
++   the old generation) and improves parallelism;
++2. Eventual fairness, which allows direct reclaim to bail out at will
++   and reduces latency without affecting fairness over some time.
++
++In terms of traversing memcgs during global reclaim, it improves the
++best-case complexity from O(n) to O(1) and does not affect the
++worst-case complexity O(n). Therefore, on average, it has a sublinear
++complexity.
++
+ Summary
+ -------
+-The multi-gen LRU can be disassembled into the following parts:
++The multi-gen LRU (of folios) can be disassembled into the following
++parts:
+ 
+ * Generations
+ * Rmap walks
+--- a/include/linux/mm_inline.h
++++ b/include/linux/mm_inline.h
+@@ -122,18 +122,6 @@ static inline bool lru_gen_in_fault(void
+ 	return current->in_lru_fault;
+ }
+ 
+-#ifdef CONFIG_MEMCG
+-static inline int lru_gen_memcg_seg(struct lruvec *lruvec)
+-{
+-	return READ_ONCE(lruvec->lrugen.seg);
+-}
+-#else
+-static inline int lru_gen_memcg_seg(struct lruvec *lruvec)
+-{
+-	return 0;
+-}
+-#endif
+-
+ static inline int lru_gen_from_seq(unsigned long seq)
+ {
+ 	return seq % MAX_NR_GENS;
+@@ -309,11 +297,6 @@ static inline bool lru_gen_in_fault(void
+ 	return false;
+ }
+ 
+-static inline int lru_gen_memcg_seg(struct lruvec *lruvec)
+-{
+-	return 0;
+-}
+-
+ static inline bool lru_gen_add_folio(struct lruvec *lruvec, struct folio *folio, bool reclaiming)
+ {
+ 	return false;
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -368,15 +368,6 @@ struct page_vma_mapped_walk;
+ #define LRU_GEN_MASK		((BIT(LRU_GEN_WIDTH) - 1) << LRU_GEN_PGOFF)
+ #define LRU_REFS_MASK		((BIT(LRU_REFS_WIDTH) - 1) << LRU_REFS_PGOFF)
+ 
+-/* see the comment on MEMCG_NR_GENS */
+-enum {
+-	MEMCG_LRU_NOP,
+-	MEMCG_LRU_HEAD,
+-	MEMCG_LRU_TAIL,
+-	MEMCG_LRU_OLD,
+-	MEMCG_LRU_YOUNG,
+-};
+-
+ #ifdef CONFIG_LRU_GEN
+ 
+ enum {
+@@ -557,7 +548,7 @@ void lru_gen_exit_memcg(struct mem_cgrou
+ void lru_gen_online_memcg(struct mem_cgroup *memcg);
+ void lru_gen_offline_memcg(struct mem_cgroup *memcg);
+ void lru_gen_release_memcg(struct mem_cgroup *memcg);
+-void lru_gen_rotate_memcg(struct lruvec *lruvec, int op);
++void lru_gen_soft_reclaim(struct lruvec *lruvec);
+ 
+ #else /* !CONFIG_MEMCG */
+ 
+@@ -608,7 +599,7 @@ static inline void lru_gen_release_memcg
+ {
+ }
+ 
+-static inline void lru_gen_rotate_memcg(struct lruvec *lruvec, int op)
++static inline void lru_gen_soft_reclaim(struct lruvec *lruvec)
+ {
+ }
+ 
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -478,12 +478,8 @@ static void mem_cgroup_update_tree(struc
+ 	struct mem_cgroup_tree_per_node *mctz;
+ 
+ 	if (lru_gen_enabled()) {
+-		struct lruvec *lruvec = &memcg->nodeinfo[nid]->lruvec;
+-
+-		/* see the comment on MEMCG_NR_GENS */
+-		if (soft_limit_excess(memcg) && lru_gen_memcg_seg(lruvec) != MEMCG_LRU_HEAD)
+-			lru_gen_rotate_memcg(lruvec, MEMCG_LRU_HEAD);
+-
++		if (soft_limit_excess(memcg))
++			lru_gen_soft_reclaim(&memcg->nodeinfo[nid]->lruvec);
+ 		return;
+ 	}
+ 
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -4690,6 +4690,148 @@ void lru_gen_look_around(struct page_vma
+ }
+ 
+ /******************************************************************************
++ *                          memcg LRU
++ ******************************************************************************/
++
++/* see the comment on MEMCG_NR_GENS */
++enum {
++	MEMCG_LRU_NOP,
++	MEMCG_LRU_HEAD,
++	MEMCG_LRU_TAIL,
++	MEMCG_LRU_OLD,
++	MEMCG_LRU_YOUNG,
++};
++
++#ifdef CONFIG_MEMCG
++
++static int lru_gen_memcg_seg(struct lruvec *lruvec)
++{
++	return READ_ONCE(lruvec->lrugen.seg);
++}
++
++static void lru_gen_rotate_memcg(struct lruvec *lruvec, int op)
++{
++	int seg;
++	int old, new;
++	int bin = get_random_u32_below(MEMCG_NR_BINS);
++	struct pglist_data *pgdat = lruvec_pgdat(lruvec);
++
++	spin_lock(&pgdat->memcg_lru.lock);
++
++	VM_WARN_ON_ONCE(hlist_nulls_unhashed(&lruvec->lrugen.list));
++
++	seg = 0;
++	new = old = lruvec->lrugen.gen;
++
++	/* see the comment on MEMCG_NR_GENS */
++	if (op == MEMCG_LRU_HEAD)
++		seg = MEMCG_LRU_HEAD;
++	else if (op == MEMCG_LRU_TAIL)
++		seg = MEMCG_LRU_TAIL;
++	else if (op == MEMCG_LRU_OLD)
++		new = get_memcg_gen(pgdat->memcg_lru.seq);
++	else if (op == MEMCG_LRU_YOUNG)
++		new = get_memcg_gen(pgdat->memcg_lru.seq + 1);
++	else
++		VM_WARN_ON_ONCE(true);
++
++	hlist_nulls_del_rcu(&lruvec->lrugen.list);
++
++	if (op == MEMCG_LRU_HEAD || op == MEMCG_LRU_OLD)
++		hlist_nulls_add_head_rcu(&lruvec->lrugen.list, &pgdat->memcg_lru.fifo[new][bin]);
++	else
++		hlist_nulls_add_tail_rcu(&lruvec->lrugen.list, &pgdat->memcg_lru.fifo[new][bin]);
++
++	pgdat->memcg_lru.nr_memcgs[old]--;
++	pgdat->memcg_lru.nr_memcgs[new]++;
++
++	lruvec->lrugen.gen = new;
++	WRITE_ONCE(lruvec->lrugen.seg, seg);
++
++	if (!pgdat->memcg_lru.nr_memcgs[old] && old == get_memcg_gen(pgdat->memcg_lru.seq))
++		WRITE_ONCE(pgdat->memcg_lru.seq, pgdat->memcg_lru.seq + 1);
++
++	spin_unlock(&pgdat->memcg_lru.lock);
++}
++
++void lru_gen_online_memcg(struct mem_cgroup *memcg)
++{
++	int gen;
++	int nid;
++	int bin = get_random_u32_below(MEMCG_NR_BINS);
++
++	for_each_node(nid) {
++		struct pglist_data *pgdat = NODE_DATA(nid);
++		struct lruvec *lruvec = get_lruvec(memcg, nid);
++
++		spin_lock(&pgdat->memcg_lru.lock);
++
++		VM_WARN_ON_ONCE(!hlist_nulls_unhashed(&lruvec->lrugen.list));
++
++		gen = get_memcg_gen(pgdat->memcg_lru.seq);
++
++		hlist_nulls_add_tail_rcu(&lruvec->lrugen.list, &pgdat->memcg_lru.fifo[gen][bin]);
++		pgdat->memcg_lru.nr_memcgs[gen]++;
++
++		lruvec->lrugen.gen = gen;
++
++		spin_unlock(&pgdat->memcg_lru.lock);
++	}
++}
++
++void lru_gen_offline_memcg(struct mem_cgroup *memcg)
++{
++	int nid;
++
++	for_each_node(nid) {
++		struct lruvec *lruvec = get_lruvec(memcg, nid);
++
++		lru_gen_rotate_memcg(lruvec, MEMCG_LRU_OLD);
++	}
++}
++
++void lru_gen_release_memcg(struct mem_cgroup *memcg)
++{
++	int gen;
++	int nid;
++
++	for_each_node(nid) {
++		struct pglist_data *pgdat = NODE_DATA(nid);
++		struct lruvec *lruvec = get_lruvec(memcg, nid);
++
++		spin_lock(&pgdat->memcg_lru.lock);
++
++		VM_WARN_ON_ONCE(hlist_nulls_unhashed(&lruvec->lrugen.list));
++
++		gen = lruvec->lrugen.gen;
++
++		hlist_nulls_del_rcu(&lruvec->lrugen.list);
++		pgdat->memcg_lru.nr_memcgs[gen]--;
++
++		if (!pgdat->memcg_lru.nr_memcgs[gen] && gen == get_memcg_gen(pgdat->memcg_lru.seq))
++			WRITE_ONCE(pgdat->memcg_lru.seq, pgdat->memcg_lru.seq + 1);
++
++		spin_unlock(&pgdat->memcg_lru.lock);
++	}
++}
++
++void lru_gen_soft_reclaim(struct lruvec *lruvec)
++{
++	/* see the comment on MEMCG_NR_GENS */
++	if (lru_gen_memcg_seg(lruvec) != MEMCG_LRU_HEAD)
++		lru_gen_rotate_memcg(lruvec, MEMCG_LRU_HEAD);
++}
++
++#else /* !CONFIG_MEMCG */
++
++static int lru_gen_memcg_seg(struct lruvec *lruvec)
++{
++	return 0;
++}
++
++#endif
++
++/******************************************************************************
+  *                          the eviction
+  ******************************************************************************/
+ 
+@@ -5386,53 +5528,6 @@ done:
+ 	pgdat->kswapd_failures = 0;
+ }
+ 
+-#ifdef CONFIG_MEMCG
+-void lru_gen_rotate_memcg(struct lruvec *lruvec, int op)
+-{
+-	int seg;
+-	int old, new;
+-	int bin = get_random_u32_below(MEMCG_NR_BINS);
+-	struct pglist_data *pgdat = lruvec_pgdat(lruvec);
+-
+-	spin_lock(&pgdat->memcg_lru.lock);
+-
+-	VM_WARN_ON_ONCE(hlist_nulls_unhashed(&lruvec->lrugen.list));
+-
+-	seg = 0;
+-	new = old = lruvec->lrugen.gen;
+-
+-	/* see the comment on MEMCG_NR_GENS */
+-	if (op == MEMCG_LRU_HEAD)
+-		seg = MEMCG_LRU_HEAD;
+-	else if (op == MEMCG_LRU_TAIL)
+-		seg = MEMCG_LRU_TAIL;
+-	else if (op == MEMCG_LRU_OLD)
+-		new = get_memcg_gen(pgdat->memcg_lru.seq);
+-	else if (op == MEMCG_LRU_YOUNG)
+-		new = get_memcg_gen(pgdat->memcg_lru.seq + 1);
+-	else
+-		VM_WARN_ON_ONCE(true);
+-
+-	hlist_nulls_del_rcu(&lruvec->lrugen.list);
+-
+-	if (op == MEMCG_LRU_HEAD || op == MEMCG_LRU_OLD)
+-		hlist_nulls_add_head_rcu(&lruvec->lrugen.list, &pgdat->memcg_lru.fifo[new][bin]);
+-	else
+-		hlist_nulls_add_tail_rcu(&lruvec->lrugen.list, &pgdat->memcg_lru.fifo[new][bin]);
+-
+-	pgdat->memcg_lru.nr_memcgs[old]--;
+-	pgdat->memcg_lru.nr_memcgs[new]++;
+-
+-	lruvec->lrugen.gen = new;
+-	WRITE_ONCE(lruvec->lrugen.seg, seg);
+-
+-	if (!pgdat->memcg_lru.nr_memcgs[old] && old == get_memcg_gen(pgdat->memcg_lru.seq))
+-		WRITE_ONCE(pgdat->memcg_lru.seq, pgdat->memcg_lru.seq + 1);
+-
+-	spin_unlock(&pgdat->memcg_lru.lock);
+-}
+-#endif
+-
+ /******************************************************************************
+  *                          state change
+  ******************************************************************************/
+@@ -6078,67 +6173,6 @@ void lru_gen_exit_memcg(struct mem_cgrou
+ 	}
+ }
+ 
+-void lru_gen_online_memcg(struct mem_cgroup *memcg)
+-{
+-	int gen;
+-	int nid;
+-	int bin = get_random_u32_below(MEMCG_NR_BINS);
+-
+-	for_each_node(nid) {
+-		struct pglist_data *pgdat = NODE_DATA(nid);
+-		struct lruvec *lruvec = get_lruvec(memcg, nid);
+-
+-		spin_lock(&pgdat->memcg_lru.lock);
+-
+-		VM_WARN_ON_ONCE(!hlist_nulls_unhashed(&lruvec->lrugen.list));
+-
+-		gen = get_memcg_gen(pgdat->memcg_lru.seq);
+-
+-		hlist_nulls_add_tail_rcu(&lruvec->lrugen.list, &pgdat->memcg_lru.fifo[gen][bin]);
+-		pgdat->memcg_lru.nr_memcgs[gen]++;
+-
+-		lruvec->lrugen.gen = gen;
+-
+-		spin_unlock(&pgdat->memcg_lru.lock);
+-	}
+-}
+-
+-void lru_gen_offline_memcg(struct mem_cgroup *memcg)
+-{
+-	int nid;
+-
+-	for_each_node(nid) {
+-		struct lruvec *lruvec = get_lruvec(memcg, nid);
+-
+-		lru_gen_rotate_memcg(lruvec, MEMCG_LRU_OLD);
+-	}
+-}
+-
+-void lru_gen_release_memcg(struct mem_cgroup *memcg)
+-{
+-	int gen;
+-	int nid;
+-
+-	for_each_node(nid) {
+-		struct pglist_data *pgdat = NODE_DATA(nid);
+-		struct lruvec *lruvec = get_lruvec(memcg, nid);
+-
+-		spin_lock(&pgdat->memcg_lru.lock);
+-
+-		VM_WARN_ON_ONCE(hlist_nulls_unhashed(&lruvec->lrugen.list));
+-
+-		gen = lruvec->lrugen.gen;
+-
+-		hlist_nulls_del_rcu(&lruvec->lrugen.list);
+-		pgdat->memcg_lru.nr_memcgs[gen]--;
+-
+-		if (!pgdat->memcg_lru.nr_memcgs[gen] && gen == get_memcg_gen(pgdat->memcg_lru.seq))
+-			WRITE_ONCE(pgdat->memcg_lru.seq, pgdat->memcg_lru.seq + 1);
+-
+-		spin_unlock(&pgdat->memcg_lru.lock);
+-	}
+-}
+-
+ #endif /* CONFIG_MEMCG */
+ 
+ static int __init init_lru_gen(void)
diff --git a/target/linux/generic/backport-6.1/020-v6.3-16-UPSTREAM-mm-multi-gen-LRU-improve-lru_gen_exit_memcg.patch b/target/linux/generic/backport-6.1/020-v6.3-16-UPSTREAM-mm-multi-gen-LRU-improve-lru_gen_exit_memcg.patch
new file mode 100644
index 00000000000000..94473755058d24
--- /dev/null
+++ b/target/linux/generic/backport-6.1/020-v6.3-16-UPSTREAM-mm-multi-gen-LRU-improve-lru_gen_exit_memcg.patch
@@ -0,0 +1,40 @@
+From bec433f29537652ed054148edfd7e2183ddcf7c3 Mon Sep 17 00:00:00 2001
+From: "T.J. Alumbaugh" <talumbau@google.com>
+Date: Wed, 18 Jan 2023 00:18:25 +0000
+Subject: [PATCH 16/19] UPSTREAM: mm: multi-gen LRU: improve
+ lru_gen_exit_memcg()
+
+Add warnings and poison ->next.
+
+Link: https://lkml.kernel.org/r/20230118001827.1040870-6-talumbau@google.com
+Change-Id: I53de9e04c1ae941e122b33cd45d2bbb5f34aae0c
+Signed-off-by: T.J. Alumbaugh <talumbau@google.com>
+Cc: Yu Zhao <yuzhao@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+(cherry picked from commit 37cc99979d04cca677c0ad5c0acd1149ec165d1b)
+Bug: 274865848
+Signed-off-by: T.J. Mercier <tjmercier@google.com>
+---
+ mm/vmscan.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -6160,12 +6160,17 @@ void lru_gen_exit_memcg(struct mem_cgrou
+ 	int i;
+ 	int nid;
+ 
++	VM_WARN_ON_ONCE(!list_empty(&memcg->mm_list.fifo));
++
+ 	for_each_node(nid) {
+ 		struct lruvec *lruvec = get_lruvec(memcg, nid);
+ 
++		VM_WARN_ON_ONCE(lruvec->mm_state.nr_walkers);
+ 		VM_WARN_ON_ONCE(memchr_inv(lruvec->lrugen.nr_pages, 0,
+ 					   sizeof(lruvec->lrugen.nr_pages)));
+ 
++		lruvec->lrugen.list.next = LIST_POISON1;
++
+ 		for (i = 0; i < NR_BLOOM_FILTERS; i++) {
+ 			bitmap_free(lruvec->mm_state.filters[i]);
+ 			lruvec->mm_state.filters[i] = NULL;
diff --git a/target/linux/generic/backport-6.1/020-v6.3-17-UPSTREAM-mm-multi-gen-LRU-improve-walk_pmd_range.patch b/target/linux/generic/backport-6.1/020-v6.3-17-UPSTREAM-mm-multi-gen-LRU-improve-walk_pmd_range.patch
new file mode 100644
index 00000000000000..2273977dc9c143
--- /dev/null
+++ b/target/linux/generic/backport-6.1/020-v6.3-17-UPSTREAM-mm-multi-gen-LRU-improve-walk_pmd_range.patch
@@ -0,0 +1,135 @@
+From fc0e3b06e0f19917b7ecad7967a72f61d4743644 Mon Sep 17 00:00:00 2001
+From: "T.J. Alumbaugh" <talumbau@google.com>
+Date: Wed, 18 Jan 2023 00:18:26 +0000
+Subject: [PATCH 17/19] UPSTREAM: mm: multi-gen LRU: improve walk_pmd_range()
+
+Improve readability of walk_pmd_range() and walk_pmd_range_locked().
+
+Link: https://lkml.kernel.org/r/20230118001827.1040870-7-talumbau@google.com
+Change-Id: Ia084fbf53fe989673b7804ca8ca520af12d7d52a
+Signed-off-by: T.J. Alumbaugh <talumbau@google.com>
+Cc: Yu Zhao <yuzhao@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+(cherry picked from commit b5ff4133617d0eced35b685da0bd0929dd9fabb7)
+Bug: 274865848
+Signed-off-by: T.J. Mercier <tjmercier@google.com>
+---
+ mm/vmscan.c | 40 ++++++++++++++++++++--------------------
+ 1 file changed, 20 insertions(+), 20 deletions(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -3980,8 +3980,8 @@ restart:
+ }
+ 
+ #if defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined(CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG)
+-static void walk_pmd_range_locked(pud_t *pud, unsigned long next, struct vm_area_struct *vma,
+-				  struct mm_walk *args, unsigned long *bitmap, unsigned long *start)
++static void walk_pmd_range_locked(pud_t *pud, unsigned long addr, struct vm_area_struct *vma,
++				  struct mm_walk *args, unsigned long *bitmap, unsigned long *first)
+ {
+ 	int i;
+ 	pmd_t *pmd;
+@@ -3994,18 +3994,19 @@ static void walk_pmd_range_locked(pud_t
+ 	VM_WARN_ON_ONCE(pud_leaf(*pud));
+ 
+ 	/* try to batch at most 1+MIN_LRU_BATCH+1 entries */
+-	if (*start == -1) {
+-		*start = next;
++	if (*first == -1) {
++		*first = addr;
++		bitmap_zero(bitmap, MIN_LRU_BATCH);
+ 		return;
+ 	}
+ 
+-	i = next == -1 ? 0 : pmd_index(next) - pmd_index(*start);
++	i = addr == -1 ? 0 : pmd_index(addr) - pmd_index(*first);
+ 	if (i && i <= MIN_LRU_BATCH) {
+ 		__set_bit(i - 1, bitmap);
+ 		return;
+ 	}
+ 
+-	pmd = pmd_offset(pud, *start);
++	pmd = pmd_offset(pud, *first);
+ 
+ 	ptl = pmd_lockptr(args->mm, pmd);
+ 	if (!spin_trylock(ptl))
+@@ -4016,15 +4017,16 @@ static void walk_pmd_range_locked(pud_t
+ 	do {
+ 		unsigned long pfn;
+ 		struct folio *folio;
+-		unsigned long addr = i ? (*start & PMD_MASK) + i * PMD_SIZE : *start;
++
++		/* don't round down the first address */
++		addr = i ? (*first & PMD_MASK) + i * PMD_SIZE : *first;
+ 
+ 		pfn = get_pmd_pfn(pmd[i], vma, addr);
+ 		if (pfn == -1)
+ 			goto next;
+ 
+ 		if (!pmd_trans_huge(pmd[i])) {
+-			if (arch_has_hw_nonleaf_pmd_young() &&
+-			    get_cap(LRU_GEN_NONLEAF_YOUNG))
++			if (arch_has_hw_nonleaf_pmd_young() && get_cap(LRU_GEN_NONLEAF_YOUNG))
+ 				pmdp_test_and_clear_young(vma, addr, pmd + i);
+ 			goto next;
+ 		}
+@@ -4053,12 +4055,11 @@ next:
+ 	arch_leave_lazy_mmu_mode();
+ 	spin_unlock(ptl);
+ done:
+-	*start = -1;
+-	bitmap_zero(bitmap, MIN_LRU_BATCH);
++	*first = -1;
+ }
+ #else
+-static void walk_pmd_range_locked(pud_t *pud, unsigned long next, struct vm_area_struct *vma,
+-				  struct mm_walk *args, unsigned long *bitmap, unsigned long *start)
++static void walk_pmd_range_locked(pud_t *pud, unsigned long addr, struct vm_area_struct *vma,
++				  struct mm_walk *args, unsigned long *bitmap, unsigned long *first)
+ {
+ }
+ #endif
+@@ -4071,9 +4072,9 @@ static void walk_pmd_range(pud_t *pud, u
+ 	unsigned long next;
+ 	unsigned long addr;
+ 	struct vm_area_struct *vma;
+-	unsigned long pos = -1;
++	unsigned long bitmap[BITS_TO_LONGS(MIN_LRU_BATCH)];
++	unsigned long first = -1;
+ 	struct lru_gen_mm_walk *walk = args->private;
+-	unsigned long bitmap[BITS_TO_LONGS(MIN_LRU_BATCH)] = {};
+ 
+ 	VM_WARN_ON_ONCE(pud_leaf(*pud));
+ 
+@@ -4115,18 +4116,17 @@ restart:
+ 			if (pfn < pgdat->node_start_pfn || pfn >= pgdat_end_pfn(pgdat))
+ 				continue;
+ 
+-			walk_pmd_range_locked(pud, addr, vma, args, bitmap, &pos);
++			walk_pmd_range_locked(pud, addr, vma, args, bitmap, &first);
+ 			continue;
+ 		}
+ #endif
+ 		walk->mm_stats[MM_NONLEAF_TOTAL]++;
+ 
+-		if (arch_has_hw_nonleaf_pmd_young() &&
+-		    get_cap(LRU_GEN_NONLEAF_YOUNG)) {
++		if (arch_has_hw_nonleaf_pmd_young() && get_cap(LRU_GEN_NONLEAF_YOUNG)) {
+ 			if (!pmd_young(val))
+ 				continue;
+ 
+-			walk_pmd_range_locked(pud, addr, vma, args, bitmap, &pos);
++			walk_pmd_range_locked(pud, addr, vma, args, bitmap, &first);
+ 		}
+ 
+ 		if (!walk->force_scan && !test_bloom_filter(walk->lruvec, walk->max_seq, pmd + i))
+@@ -4143,7 +4143,7 @@ restart:
+ 		update_bloom_filter(walk->lruvec, walk->max_seq + 1, pmd + i);
+ 	}
+ 
+-	walk_pmd_range_locked(pud, -1, vma, args, bitmap, &pos);
++	walk_pmd_range_locked(pud, -1, vma, args, bitmap, &first);
+ 
+ 	if (i < PTRS_PER_PMD && get_next_vma(PUD_MASK, PMD_SIZE, args, &start, &end))
+ 		goto restart;
diff --git a/target/linux/generic/backport-6.1/020-v6.3-18-UPSTREAM-mm-multi-gen-LRU-simplify-lru_gen_look_arou.patch b/target/linux/generic/backport-6.1/020-v6.3-18-UPSTREAM-mm-multi-gen-LRU-simplify-lru_gen_look_arou.patch
new file mode 100644
index 00000000000000..1f071f0839c5f2
--- /dev/null
+++ b/target/linux/generic/backport-6.1/020-v6.3-18-UPSTREAM-mm-multi-gen-LRU-simplify-lru_gen_look_arou.patch
@@ -0,0 +1,148 @@
+From e604c3ccb4dfbdde2467fccef9bb36170a392695 Mon Sep 17 00:00:00 2001
+From: "T.J. Alumbaugh" <talumbau@google.com>
+Date: Wed, 18 Jan 2023 00:18:27 +0000
+Subject: [PATCH 18/19] UPSTREAM: mm: multi-gen LRU: simplify
+ lru_gen_look_around()
+
+Update the folio generation in place with or without
+current->reclaim_state->mm_walk.  The LRU lock is held for longer, if
+mm_walk is NULL and the number of folios to update is more than
+PAGEVEC_SIZE.
+
+This causes a measurable regression from the LRU lock contention during a
+microbencmark.  But a tiny regression is not worth the complexity.
+
+Link: https://lkml.kernel.org/r/20230118001827.1040870-8-talumbau@google.com
+Change-Id: I9ce18b4f4062e6c1c13c98ece9422478eb8e1846
+Signed-off-by: T.J. Alumbaugh <talumbau@google.com>
+Cc: Yu Zhao <yuzhao@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+(cherry picked from commit abf086721a2f1e6897c57796f7268df1b194c750)
+Bug: 274865848
+Signed-off-by: T.J. Mercier <tjmercier@google.com>
+---
+ mm/vmscan.c | 73 +++++++++++++++++------------------------------------
+ 1 file changed, 23 insertions(+), 50 deletions(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -4571,13 +4571,12 @@ static void lru_gen_age_node(struct pgli
+ void lru_gen_look_around(struct page_vma_mapped_walk *pvmw)
+ {
+ 	int i;
+-	pte_t *pte;
+ 	unsigned long start;
+ 	unsigned long end;
+-	unsigned long addr;
+ 	struct lru_gen_mm_walk *walk;
+ 	int young = 0;
+-	unsigned long bitmap[BITS_TO_LONGS(MIN_LRU_BATCH)] = {};
++	pte_t *pte = pvmw->pte;
++	unsigned long addr = pvmw->address;
+ 	struct folio *folio = pfn_folio(pvmw->pfn);
+ 	struct mem_cgroup *memcg = folio_memcg(folio);
+ 	struct pglist_data *pgdat = folio_pgdat(folio);
+@@ -4594,25 +4593,28 @@ void lru_gen_look_around(struct page_vma
+ 	/* avoid taking the LRU lock under the PTL when possible */
+ 	walk = current->reclaim_state ? current->reclaim_state->mm_walk : NULL;
+ 
+-	start = max(pvmw->address & PMD_MASK, pvmw->vma->vm_start);
+-	end = min(pvmw->address | ~PMD_MASK, pvmw->vma->vm_end - 1) + 1;
++	start = max(addr & PMD_MASK, pvmw->vma->vm_start);
++	end = min(addr | ~PMD_MASK, pvmw->vma->vm_end - 1) + 1;
+ 
+ 	if (end - start > MIN_LRU_BATCH * PAGE_SIZE) {
+-		if (pvmw->address - start < MIN_LRU_BATCH * PAGE_SIZE / 2)
++		if (addr - start < MIN_LRU_BATCH * PAGE_SIZE / 2)
+ 			end = start + MIN_LRU_BATCH * PAGE_SIZE;
+-		else if (end - pvmw->address < MIN_LRU_BATCH * PAGE_SIZE / 2)
++		else if (end - addr < MIN_LRU_BATCH * PAGE_SIZE / 2)
+ 			start = end - MIN_LRU_BATCH * PAGE_SIZE;
+ 		else {
+-			start = pvmw->address - MIN_LRU_BATCH * PAGE_SIZE / 2;
+-			end = pvmw->address + MIN_LRU_BATCH * PAGE_SIZE / 2;
++			start = addr - MIN_LRU_BATCH * PAGE_SIZE / 2;
++			end = addr + MIN_LRU_BATCH * PAGE_SIZE / 2;
+ 		}
+ 	}
+ 
+-	pte = pvmw->pte - (pvmw->address - start) / PAGE_SIZE;
++	/* folio_update_gen() requires stable folio_memcg() */
++	if (!mem_cgroup_trylock_pages(memcg))
++		return;
+ 
+-	rcu_read_lock();
+ 	arch_enter_lazy_mmu_mode();
+ 
++	pte -= (addr - start) / PAGE_SIZE;
++
+ 	for (i = 0, addr = start; addr != end; i++, addr += PAGE_SIZE) {
+ 		unsigned long pfn;
+ 
+@@ -4637,56 +4639,27 @@ void lru_gen_look_around(struct page_vma
+ 		      !folio_test_swapcache(folio)))
+ 			folio_mark_dirty(folio);
+ 
++		if (walk) {
++			old_gen = folio_update_gen(folio, new_gen);
++			if (old_gen >= 0 && old_gen != new_gen)
++				update_batch_size(walk, folio, old_gen, new_gen);
++
++			continue;
++		}
++
+ 		old_gen = folio_lru_gen(folio);
+ 		if (old_gen < 0)
+ 			folio_set_referenced(folio);
+ 		else if (old_gen != new_gen)
+-			__set_bit(i, bitmap);
++			folio_activate(folio);
+ 	}
+ 
+ 	arch_leave_lazy_mmu_mode();
+-	rcu_read_unlock();
++	mem_cgroup_unlock_pages();
+ 
+ 	/* feedback from rmap walkers to page table walkers */
+ 	if (suitable_to_scan(i, young))
+ 		update_bloom_filter(lruvec, max_seq, pvmw->pmd);
+-
+-	if (!walk && bitmap_weight(bitmap, MIN_LRU_BATCH) < PAGEVEC_SIZE) {
+-		for_each_set_bit(i, bitmap, MIN_LRU_BATCH) {
+-			folio = pfn_folio(pte_pfn(pte[i]));
+-			folio_activate(folio);
+-		}
+-		return;
+-	}
+-
+-	/* folio_update_gen() requires stable folio_memcg() */
+-	if (!mem_cgroup_trylock_pages(memcg))
+-		return;
+-
+-	if (!walk) {
+-		spin_lock_irq(&lruvec->lru_lock);
+-		new_gen = lru_gen_from_seq(lruvec->lrugen.max_seq);
+-	}
+-
+-	for_each_set_bit(i, bitmap, MIN_LRU_BATCH) {
+-		folio = pfn_folio(pte_pfn(pte[i]));
+-		if (folio_memcg_rcu(folio) != memcg)
+-			continue;
+-
+-		old_gen = folio_update_gen(folio, new_gen);
+-		if (old_gen < 0 || old_gen == new_gen)
+-			continue;
+-
+-		if (walk)
+-			update_batch_size(walk, folio, old_gen, new_gen);
+-		else
+-			lru_gen_update_size(lruvec, folio, old_gen, new_gen);
+-	}
+-
+-	if (!walk)
+-		spin_unlock_irq(&lruvec->lru_lock);
+-
+-	mem_cgroup_unlock_pages();
+ }
+ 
+ /******************************************************************************
diff --git a/target/linux/generic/backport-6.1/020-v6.4-19-mm-Multi-gen-LRU-remove-wait_event_killable.patch b/target/linux/generic/backport-6.1/020-v6.4-19-mm-Multi-gen-LRU-remove-wait_event_killable.patch
new file mode 100644
index 00000000000000..fc42a245f39fcb
--- /dev/null
+++ b/target/linux/generic/backport-6.1/020-v6.4-19-mm-Multi-gen-LRU-remove-wait_event_killable.patch
@@ -0,0 +1,273 @@
+From 418038c22452df38cde519cc8c662bb15139764a Mon Sep 17 00:00:00 2001
+From: Kalesh Singh <kaleshsingh@google.com>
+Date: Thu, 13 Apr 2023 14:43:26 -0700
+Subject: [PATCH 19/19] mm: Multi-gen LRU: remove wait_event_killable()
+
+Android 14 and later default to MGLRU [1] and field telemetry showed
+occasional long tail latency (>100ms) in the reclaim path.
+
+Tracing revealed priority inversion in the reclaim path.  In
+try_to_inc_max_seq(), when high priority tasks were blocked on
+wait_event_killable(), the preemption of the low priority task to call
+wake_up_all() caused those high priority tasks to wait longer than
+necessary.  In general, this problem is not different from others of its
+kind, e.g., one caused by mutex_lock().  However, it is specific to MGLRU
+because it introduced the new wait queue lruvec->mm_state.wait.
+
+The purpose of this new wait queue is to avoid the thundering herd
+problem.  If many direct reclaimers rush into try_to_inc_max_seq(), only
+one can succeed, i.e., the one to wake up the rest, and the rest who
+failed might cause premature OOM kills if they do not wait.  So far there
+is no evidence supporting this scenario, based on how often the wait has
+been hit.  And this begs the question how useful the wait queue is in
+practice.
+
+Based on Minchan's recommendation, which is in line with his commit
+6d4675e60135 ("mm: don't be stuck to rmap lock on reclaim path") and the
+rest of the MGLRU code which also uses trylock when possible, remove the
+wait queue.
+
+[1] https://android-review.googlesource.com/q/I7ed7fbfd6ef9ce10053347528125dd98c39e50bf
+
+Link: https://lkml.kernel.org/r/20230413214326.2147568-1-kaleshsingh@google.com
+Fixes: bd74fdaea146 ("mm: multi-gen LRU: support page table walks")
+Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
+Suggested-by: Minchan Kim <minchan@kernel.org>
+Reported-by: Wei Wang <wvw@google.com>
+Acked-by: Yu Zhao <yuzhao@google.com>
+Cc: Minchan Kim <minchan@kernel.org>
+Cc: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
+Cc: Oleksandr Natalenko <oleksandr@natalenko.name>
+Cc: Suleiman Souhlal <suleiman@google.com>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ include/linux/mmzone.h |   8 +--
+ mm/vmscan.c            | 112 +++++++++++++++--------------------------
+ 2 files changed, 42 insertions(+), 78 deletions(-)
+
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -453,18 +453,14 @@ enum {
+ struct lru_gen_mm_state {
+ 	/* set to max_seq after each iteration */
+ 	unsigned long seq;
+-	/* where the current iteration continues (inclusive) */
++	/* where the current iteration continues after */
+ 	struct list_head *head;
+-	/* where the last iteration ended (exclusive) */
++	/* where the last iteration ended before */
+ 	struct list_head *tail;
+-	/* to wait for the last page table walker to finish */
+-	struct wait_queue_head wait;
+ 	/* Bloom filters flip after each iteration */
+ 	unsigned long *filters[NR_BLOOM_FILTERS];
+ 	/* the mm stats for debugging */
+ 	unsigned long stats[NR_HIST_GENS][NR_MM_STATS];
+-	/* the number of concurrent page table walkers */
+-	int nr_walkers;
+ };
+ 
+ struct lru_gen_mm_walk {
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -3371,18 +3371,13 @@ void lru_gen_del_mm(struct mm_struct *mm
+ 		if (!lruvec)
+ 			continue;
+ 
+-		/* where the last iteration ended (exclusive) */
++		/* where the current iteration continues after */
++		if (lruvec->mm_state.head == &mm->lru_gen.list)
++			lruvec->mm_state.head = lruvec->mm_state.head->prev;
++
++		/* where the last iteration ended before */
+ 		if (lruvec->mm_state.tail == &mm->lru_gen.list)
+ 			lruvec->mm_state.tail = lruvec->mm_state.tail->next;
+-
+-		/* where the current iteration continues (inclusive) */
+-		if (lruvec->mm_state.head != &mm->lru_gen.list)
+-			continue;
+-
+-		lruvec->mm_state.head = lruvec->mm_state.head->next;
+-		/* the deletion ends the current iteration */
+-		if (lruvec->mm_state.head == &mm_list->fifo)
+-			WRITE_ONCE(lruvec->mm_state.seq, lruvec->mm_state.seq + 1);
+ 	}
+ 
+ 	list_del_init(&mm->lru_gen.list);
+@@ -3478,68 +3473,54 @@ static bool iterate_mm_list(struct lruve
+ 			    struct mm_struct **iter)
+ {
+ 	bool first = false;
+-	bool last = true;
++	bool last = false;
+ 	struct mm_struct *mm = NULL;
+ 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
+ 	struct lru_gen_mm_list *mm_list = get_mm_list(memcg);
+ 	struct lru_gen_mm_state *mm_state = &lruvec->mm_state;
+ 
+ 	/*
+-	 * There are four interesting cases for this page table walker:
+-	 * 1. It tries to start a new iteration of mm_list with a stale max_seq;
+-	 *    there is nothing left to do.
+-	 * 2. It's the first of the current generation, and it needs to reset
+-	 *    the Bloom filter for the next generation.
+-	 * 3. It reaches the end of mm_list, and it needs to increment
+-	 *    mm_state->seq; the iteration is done.
+-	 * 4. It's the last of the current generation, and it needs to reset the
+-	 *    mm stats counters for the next generation.
++	 * mm_state->seq is incremented after each iteration of mm_list. There
++	 * are three interesting cases for this page table walker:
++	 * 1. It tries to start a new iteration with a stale max_seq: there is
++	 *    nothing left to do.
++	 * 2. It started the next iteration: it needs to reset the Bloom filter
++	 *    so that a fresh set of PTE tables can be recorded.
++	 * 3. It ended the current iteration: it needs to reset the mm stats
++	 *    counters and tell its caller to increment max_seq.
+ 	 */
+ 	spin_lock(&mm_list->lock);
+ 
+ 	VM_WARN_ON_ONCE(mm_state->seq + 1 < walk->max_seq);
+-	VM_WARN_ON_ONCE(*iter && mm_state->seq > walk->max_seq);
+-	VM_WARN_ON_ONCE(*iter && !mm_state->nr_walkers);
+ 
+-	if (walk->max_seq <= mm_state->seq) {
+-		if (!*iter)
+-			last = false;
++	if (walk->max_seq <= mm_state->seq)
+ 		goto done;
+-	}
+ 
+-	if (!mm_state->nr_walkers) {
+-		VM_WARN_ON_ONCE(mm_state->head && mm_state->head != &mm_list->fifo);
++	if (!mm_state->head)
++		mm_state->head = &mm_list->fifo;
+ 
+-		mm_state->head = mm_list->fifo.next;
++	if (mm_state->head == &mm_list->fifo)
+ 		first = true;
+-	}
+-
+-	while (!mm && mm_state->head != &mm_list->fifo) {
+-		mm = list_entry(mm_state->head, struct mm_struct, lru_gen.list);
+ 
++	do {
+ 		mm_state->head = mm_state->head->next;
++		if (mm_state->head == &mm_list->fifo) {
++			WRITE_ONCE(mm_state->seq, mm_state->seq + 1);
++			last = true;
++			break;
++		}
+ 
+ 		/* force scan for those added after the last iteration */
+-		if (!mm_state->tail || mm_state->tail == &mm->lru_gen.list) {
+-			mm_state->tail = mm_state->head;
++		if (!mm_state->tail || mm_state->tail == mm_state->head) {
++			mm_state->tail = mm_state->head->next;
+ 			walk->force_scan = true;
+ 		}
+ 
++		mm = list_entry(mm_state->head, struct mm_struct, lru_gen.list);
+ 		if (should_skip_mm(mm, walk))
+ 			mm = NULL;
+-	}
+-
+-	if (mm_state->head == &mm_list->fifo)
+-		WRITE_ONCE(mm_state->seq, mm_state->seq + 1);
++	} while (!mm);
+ done:
+-	if (*iter && !mm)
+-		mm_state->nr_walkers--;
+-	if (!*iter && mm)
+-		mm_state->nr_walkers++;
+-
+-	if (mm_state->nr_walkers)
+-		last = false;
+-
+ 	if (*iter || last)
+ 		reset_mm_stats(lruvec, walk, last);
+ 
+@@ -3567,9 +3548,9 @@ static bool iterate_mm_list_nowalk(struc
+ 
+ 	VM_WARN_ON_ONCE(mm_state->seq + 1 < max_seq);
+ 
+-	if (max_seq > mm_state->seq && !mm_state->nr_walkers) {
+-		VM_WARN_ON_ONCE(mm_state->head && mm_state->head != &mm_list->fifo);
+-
++	if (max_seq > mm_state->seq) {
++		mm_state->head = NULL;
++		mm_state->tail = NULL;
+ 		WRITE_ONCE(mm_state->seq, mm_state->seq + 1);
+ 		reset_mm_stats(lruvec, NULL, true);
+ 		success = true;
+@@ -4172,10 +4153,6 @@ restart:
+ 
+ 		walk_pmd_range(&val, addr, next, args);
+ 
+-		/* a racy check to curtail the waiting time */
+-		if (wq_has_sleeper(&walk->lruvec->mm_state.wait))
+-			return 1;
+-
+ 		if (need_resched() || walk->batched >= MAX_LRU_BATCH) {
+ 			end = (addr | ~PUD_MASK) + 1;
+ 			goto done;
+@@ -4208,8 +4185,14 @@ static void walk_mm(struct lruvec *lruve
+ 	walk->next_addr = FIRST_USER_ADDRESS;
+ 
+ 	do {
++		DEFINE_MAX_SEQ(lruvec);
++
+ 		err = -EBUSY;
+ 
++		/* another thread might have called inc_max_seq() */
++		if (walk->max_seq != max_seq)
++			break;
++
+ 		/* folio_update_gen() requires stable folio_memcg() */
+ 		if (!mem_cgroup_trylock_pages(memcg))
+ 			break;
+@@ -4442,25 +4425,12 @@ static bool try_to_inc_max_seq(struct lr
+ 		success = iterate_mm_list(lruvec, walk, &mm);
+ 		if (mm)
+ 			walk_mm(lruvec, mm, walk);
+-
+-		cond_resched();
+ 	} while (mm);
+ done:
+-	if (!success) {
+-		if (sc->priority <= DEF_PRIORITY - 2)
+-			wait_event_killable(lruvec->mm_state.wait,
+-					    max_seq < READ_ONCE(lrugen->max_seq));
+-		return false;
+-	}
++	if (success)
++		inc_max_seq(lruvec, can_swap, force_scan);
+ 
+-	VM_WARN_ON_ONCE(max_seq != READ_ONCE(lrugen->max_seq));
+-
+-	inc_max_seq(lruvec, can_swap, force_scan);
+-	/* either this sees any waiters or they will see updated max_seq */
+-	if (wq_has_sleeper(&lruvec->mm_state.wait))
+-		wake_up_all(&lruvec->mm_state.wait);
+-
+-	return true;
++	return success;
+ }
+ 
+ /******************************************************************************
+@@ -6105,7 +6075,6 @@ void lru_gen_init_lruvec(struct lruvec *
+ 		INIT_LIST_HEAD(&lrugen->folios[gen][type][zone]);
+ 
+ 	lruvec->mm_state.seq = MIN_NR_GENS;
+-	init_waitqueue_head(&lruvec->mm_state.wait);
+ }
+ 
+ #ifdef CONFIG_MEMCG
+@@ -6138,7 +6107,6 @@ void lru_gen_exit_memcg(struct mem_cgrou
+ 	for_each_node(nid) {
+ 		struct lruvec *lruvec = get_lruvec(memcg, nid);
+ 
+-		VM_WARN_ON_ONCE(lruvec->mm_state.nr_walkers);
+ 		VM_WARN_ON_ONCE(memchr_inv(lruvec->lrugen.nr_pages, 0,
+ 					   sizeof(lruvec->lrugen.nr_pages)));
+ 
diff --git a/target/linux/generic/backport-6.1/300-v6.2-powerpc-suppress-some-linker-warnings-in-recent-link.patch b/target/linux/generic/backport-6.1/300-v6.2-powerpc-suppress-some-linker-warnings-in-recent-link.patch
new file mode 100644
index 00000000000000..d8d0cf95557875
--- /dev/null
+++ b/target/linux/generic/backport-6.1/300-v6.2-powerpc-suppress-some-linker-warnings-in-recent-link.patch
@@ -0,0 +1,63 @@
+From 579aee9fc594af94c242068c011b0233563d4bbf Mon Sep 17 00:00:00 2001
+From: Stephen Rothwell <sfr@canb.auug.org.au>
+Date: Mon, 10 Oct 2022 16:57:21 +1100
+Subject: [PATCH] powerpc: suppress some linker warnings in recent linker
+ versions
+
+This is a follow on from commit
+
+  0d362be5b142 ("Makefile: link with -z noexecstack --no-warn-rwx-segments")
+
+for arch/powerpc/boot to address wanrings like:
+
+  ld: warning: opal-calls.o: missing .note.GNU-stack section implies executable stack
+  ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
+  ld: warning: arch/powerpc/boot/zImage.epapr has a LOAD segment with RWX permissions
+
+This fixes issue https://github.com/linuxppc/issues/issues/417
+
+Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20221010165721.106267e6@canb.auug.org.au
+---
+ arch/powerpc/boot/wrapper | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/arch/powerpc/boot/wrapper
++++ b/arch/powerpc/boot/wrapper
+@@ -215,6 +215,11 @@ ld_version()
+     }'
+ }
+ 
++ld_is_lld()
++{
++	${CROSS}ld -V 2>&1 | grep -q LLD
++}
++
+ # Do not include PT_INTERP segment when linking pie. Non-pie linking
+ # just ignores this option.
+ LD_VERSION=$(${CROSS}ld --version | ld_version)
+@@ -223,6 +228,14 @@ if [ "$LD_VERSION" -ge "$LD_NO_DL_MIN_VE
+ 	nodl="--no-dynamic-linker"
+ fi
+ 
++# suppress some warnings in recent ld versions
++nowarn="-z noexecstack"
++if ! ld_is_lld; then
++	if [ "$LD_VERSION" -ge "$(echo 2.39 | ld_version)" ]; then
++		nowarn="$nowarn --no-warn-rwx-segments"
++	fi
++fi
++
+ platformo=$object/"$platform".o
+ lds=$object/zImage.lds
+ ext=strip
+@@ -504,7 +517,7 @@ if [ "$platform" != "miboot" ]; then
+         text_start="-Ttext $link_address"
+     fi
+ #link everything
+-    ${CROSS}ld -m $format -T $lds $text_start $pie $nodl $rodynamic $notext -o "$ofile" $map \
++    ${CROSS}ld -m $format -T $lds $text_start $pie $nodl $nowarn $rodynamic $notext -o "$ofile" $map \
+ 	$platformo $tmp $object/wrapper.a
+     rm $tmp
+ fi
diff --git a/target/linux/generic/backport-6.1/406-v6.2-0001-mtd-core-simplify-a-bit-code-find-partition-matching.patch b/target/linux/generic/backport-6.1/406-v6.2-0001-mtd-core-simplify-a-bit-code-find-partition-matching.patch
new file mode 100644
index 00000000000000..eb6be5ed00e2f0
--- /dev/null
+++ b/target/linux/generic/backport-6.1/406-v6.2-0001-mtd-core-simplify-a-bit-code-find-partition-matching.patch
@@ -0,0 +1,65 @@
+From 63db0cb35e1cb3b3c134906d1062f65513fdda2d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 4 Oct 2022 10:37:09 +0200
+Subject: [PATCH] mtd: core: simplify (a bit) code find partition-matching
+ dynamic OF node
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+1. Don't hardcode "partition-" string twice
+2. Use simpler logic & use ->name to avoid of_property_read_string()
+3. Use mtd_get_of_node() helper
+
+Cc: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20221004083710.27704-1-zajec5@gmail.com
+---
+ drivers/mtd/mtdcore.c | 16 +++++++---------
+ 1 file changed, 7 insertions(+), 9 deletions(-)
+
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -551,18 +551,16 @@ static void mtd_check_of_node(struct mtd
+ 	struct device_node *partitions, *parent_dn, *mtd_dn = NULL;
+ 	const char *pname, *prefix = "partition-";
+ 	int plen, mtd_name_len, offset, prefix_len;
+-	struct mtd_info *parent;
+ 	bool found = false;
+ 
+ 	/* Check if MTD already has a device node */
+-	if (dev_of_node(&mtd->dev))
++	if (mtd_get_of_node(mtd))
+ 		return;
+ 
+ 	/* Check if a partitions node exist */
+ 	if (!mtd_is_partition(mtd))
+ 		return;
+-	parent = mtd->parent;
+-	parent_dn = of_node_get(dev_of_node(&parent->dev));
++	parent_dn = of_node_get(mtd_get_of_node(mtd->parent));
+ 	if (!parent_dn)
+ 		return;
+ 
+@@ -575,15 +573,15 @@ static void mtd_check_of_node(struct mtd
+ 
+ 	/* Search if a partition is defined with the same name */
+ 	for_each_child_of_node(partitions, mtd_dn) {
+-		offset = 0;
+-
+ 		/* Skip partition with no/wrong prefix */
+-		if (!of_node_name_prefix(mtd_dn, "partition-"))
++		if (!of_node_name_prefix(mtd_dn, prefix))
+ 			continue;
+ 
+ 		/* Label have priority. Check that first */
+-		if (of_property_read_string(mtd_dn, "label", &pname)) {
+-			of_property_read_string(mtd_dn, "name", &pname);
++		if (!of_property_read_string(mtd_dn, "label", &pname)) {
++			offset = 0;
++		} else {
++			pname = mtd_dn->name;
+ 			offset = prefix_len;
+ 		}
+ 
diff --git a/target/linux/generic/backport-6.1/406-v6.2-0002-mtd-core-try-to-find-OF-node-for-every-MTD-partition.patch b/target/linux/generic/backport-6.1/406-v6.2-0002-mtd-core-try-to-find-OF-node-for-every-MTD-partition.patch
new file mode 100644
index 00000000000000..f8d3a370d448f3
--- /dev/null
+++ b/target/linux/generic/backport-6.1/406-v6.2-0002-mtd-core-try-to-find-OF-node-for-every-MTD-partition.patch
@@ -0,0 +1,84 @@
+From ddb8cefb7af288950447ca6eeeafb09977dab56f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 4 Oct 2022 10:37:10 +0200
+Subject: [PATCH] mtd: core: try to find OF node for every MTD partition
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+So far this feature was limited to the top-level "nvmem-cells" node.
+There are multiple parsers creating partitions and subpartitions
+dynamically. Extend that code to handle them too.
+
+This allows finding partition-* node for every MTD (sub)partition.
+
+Random example:
+
+partitions {
+	compatible = "brcm,bcm947xx-cfe-partitions";
+
+	partition-firmware {
+		compatible = "brcm,trx";
+
+		partition-loader {
+		};
+	};
+};
+
+Cc: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20221004083710.27704-2-zajec5@gmail.com
+---
+ drivers/mtd/mtdcore.c | 18 ++++++------------
+ 1 file changed, 6 insertions(+), 12 deletions(-)
+
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -551,20 +551,22 @@ static void mtd_check_of_node(struct mtd
+ 	struct device_node *partitions, *parent_dn, *mtd_dn = NULL;
+ 	const char *pname, *prefix = "partition-";
+ 	int plen, mtd_name_len, offset, prefix_len;
+-	bool found = false;
+ 
+ 	/* Check if MTD already has a device node */
+ 	if (mtd_get_of_node(mtd))
+ 		return;
+ 
+-	/* Check if a partitions node exist */
+ 	if (!mtd_is_partition(mtd))
+ 		return;
++
+ 	parent_dn = of_node_get(mtd_get_of_node(mtd->parent));
+ 	if (!parent_dn)
+ 		return;
+ 
+-	partitions = of_get_child_by_name(parent_dn, "partitions");
++	if (mtd_is_partition(mtd->parent))
++		partitions = of_node_get(parent_dn);
++	else
++		partitions = of_get_child_by_name(parent_dn, "partitions");
+ 	if (!partitions)
+ 		goto exit_parent;
+ 
+@@ -588,19 +590,11 @@ static void mtd_check_of_node(struct mtd
+ 		plen = strlen(pname) - offset;
+ 		if (plen == mtd_name_len &&
+ 		    !strncmp(mtd->name, pname + offset, plen)) {
+-			found = true;
++			mtd_set_of_node(mtd, mtd_dn);
+ 			break;
+ 		}
+ 	}
+ 
+-	if (!found)
+-		goto exit_partitions;
+-
+-	/* Set of_node only for nvmem */
+-	if (of_device_is_compatible(mtd_dn, "nvmem-cells"))
+-		mtd_set_of_node(mtd, mtd_dn);
+-
+-exit_partitions:
+ 	of_node_put(partitions);
+ exit_parent:
+ 	of_node_put(parent_dn);
diff --git a/target/linux/generic/backport-6.1/408-v6.2-mtd-core-set-ROOT_DEV-for-partitions-marked-as-rootf.patch b/target/linux/generic/backport-6.1/408-v6.2-mtd-core-set-ROOT_DEV-for-partitions-marked-as-rootf.patch
new file mode 100644
index 00000000000000..5a5e11c8f7adb9
--- /dev/null
+++ b/target/linux/generic/backport-6.1/408-v6.2-mtd-core-set-ROOT_DEV-for-partitions-marked-as-rootf.patch
@@ -0,0 +1,47 @@
+From 26422ac78e9d8767bd4aabfbae616b15edbf6a1b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Sat, 22 Oct 2022 23:13:18 +0200
+Subject: [PATCH] mtd: core: set ROOT_DEV for partitions marked as rootfs in DT
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This adds support for "linux,rootfs" binding that is used to mark flash
+partition containing rootfs. It's useful for devices using device tree
+that don't have bootloader passing root info in cmdline.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20221022211318.32009-2-zajec5@gmail.com
+---
+ drivers/mtd/mtdcore.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -28,6 +28,7 @@
+ #include <linux/leds.h>
+ #include <linux/debugfs.h>
+ #include <linux/nvmem-provider.h>
++#include <linux/root_dev.h>
+ 
+ #include <linux/mtd/mtd.h>
+ #include <linux/mtd/partitions.h>
+@@ -737,6 +738,17 @@ int add_mtd_device(struct mtd_info *mtd)
+ 		not->add(mtd);
+ 
+ 	mutex_unlock(&mtd_table_mutex);
++
++	if (of_find_property(mtd_get_of_node(mtd), "linux,rootfs", NULL)) {
++		if (IS_BUILTIN(CONFIG_MTD)) {
++			pr_info("mtd: setting mtd%d (%s) as root device\n", mtd->index, mtd->name);
++			ROOT_DEV = MKDEV(MTD_BLOCK_MAJOR, mtd->index);
++		} else {
++			pr_warn("mtd: can't set mtd%d (%s) as root device - mtd must be builtin\n",
++				mtd->index, mtd->name);
++		}
++	}
++
+ 	/* We _know_ we aren't being removed, because
+ 	   our caller is still holding us here. So none
+ 	   of this try_ nonsense, and no bitching about it
diff --git a/target/linux/generic/backport-6.1/421-v6.2-mtd-parsers-add-TP-Link-SafeLoader-partitions-table-.patch b/target/linux/generic/backport-6.1/421-v6.2-mtd-parsers-add-TP-Link-SafeLoader-partitions-table-.patch
new file mode 100644
index 00000000000000..e570564a0bc5bb
--- /dev/null
+++ b/target/linux/generic/backport-6.1/421-v6.2-mtd-parsers-add-TP-Link-SafeLoader-partitions-table-.patch
@@ -0,0 +1,229 @@
+From aec4d5f5ffd0f0092bd9dc21ea90e0bc237d4b74 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Sat, 15 Oct 2022 11:29:50 +0200
+Subject: [PATCH] mtd: parsers: add TP-Link SafeLoader partitions table parser
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This parser deals with most TP-Link home routers. It reads info about
+partitions and registers them in the MTD subsystem.
+
+Example from TP-Link Archer C5 V2:
+
+spi-nor spi0.0: s25fl128s1 (16384 Kbytes)
+15 tplink-safeloader partitions found on MTD device spi0.0
+Creating 15 MTD partitions on "spi0.0":
+0x000000000000-0x000000040000 : "fs-uboot"
+0x000000040000-0x000000440000 : "os-image"
+0x000000440000-0x000000e40000 : "rootfs"
+0x000000e40000-0x000000e40200 : "default-mac"
+0x000000e40200-0x000000e40400 : "pin"
+0x000000e40400-0x000000e40600 : "product-info"
+0x000000e50000-0x000000e60000 : "partition-table"
+0x000000e60000-0x000000e60200 : "soft-version"
+0x000000e61000-0x000000e70000 : "support-list"
+0x000000e70000-0x000000e80000 : "profile"
+0x000000e80000-0x000000e90000 : "default-config"
+0x000000e90000-0x000000ee0000 : "user-config"
+0x000000ee0000-0x000000fe0000 : "log"
+0x000000fe0000-0x000000ff0000 : "radio_bk"
+0x000000ff0000-0x000001000000 : "radio"
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20221015092950.27467-2-zajec5@gmail.com
+---
+ drivers/mtd/parsers/Kconfig             |  15 +++
+ drivers/mtd/parsers/Makefile            |   1 +
+ drivers/mtd/parsers/tplink_safeloader.c | 150 ++++++++++++++++++++++++
+ 3 files changed, 166 insertions(+)
+ create mode 100644 drivers/mtd/parsers/tplink_safeloader.c
+
+--- a/drivers/mtd/parsers/Kconfig
++++ b/drivers/mtd/parsers/Kconfig
+@@ -123,6 +123,21 @@ config MTD_AFS_PARTS
+ 	  for your particular device. It won't happen automatically. The
+ 	  'physmap' map driver (CONFIG_MTD_PHYSMAP) does this, for example.
+ 
++config MTD_PARSER_TPLINK_SAFELOADER
++	tristate "TP-Link Safeloader partitions parser"
++	depends on MTD && (ARCH_BCM_5301X || ATH79 || SOC_MT7620 || SOC_MT7621 || COMPILE_TEST)
++	help
++	  TP-Link home routers use flash partitions to store various data. Info
++	  about flash space layout is stored in a partitions table using a
++	  custom ASCII-based format.
++
++	  That format was first found in devices with SafeLoader bootloader and
++	  was named after it. Later it was adapted to CFE and U-Boot
++	  bootloaders.
++
++	  This driver reads partitions table, parses it and creates MTD
++	  partitions.
++
+ config MTD_PARSER_TRX
+ 	tristate "Parser for TRX format partitions"
+ 	depends on MTD && (BCM47XX || ARCH_BCM_5301X || ARCH_MEDIATEK || RALINK || COMPILE_TEST)
+--- a/drivers/mtd/parsers/Makefile
++++ b/drivers/mtd/parsers/Makefile
+@@ -10,6 +10,7 @@ ofpart-$(CONFIG_MTD_OF_PARTS_BCM4908)	+=
+ ofpart-$(CONFIG_MTD_OF_PARTS_LINKSYS_NS)+= ofpart_linksys_ns.o
+ obj-$(CONFIG_MTD_PARSER_IMAGETAG)	+= parser_imagetag.o
+ obj-$(CONFIG_MTD_AFS_PARTS)		+= afs.o
++obj-$(CONFIG_MTD_PARSER_TPLINK_SAFELOADER)	+= tplink_safeloader.o
+ obj-$(CONFIG_MTD_PARSER_TRX)		+= parser_trx.o
+ obj-$(CONFIG_MTD_SERCOMM_PARTS)		+= scpart.o
+ obj-$(CONFIG_MTD_SHARPSL_PARTS)		+= sharpslpart.o
+--- /dev/null
++++ b/drivers/mtd/parsers/tplink_safeloader.c
+@@ -0,0 +1,150 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Copyright © 2022 Rafał Miłecki <rafal@milecki.pl>
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/mtd/mtd.h>
++#include <linux/mtd/partitions.h>
++#include <linux/of.h>
++#include <linux/slab.h>
++
++#define TPLINK_SAFELOADER_DATA_OFFSET		4
++#define TPLINK_SAFELOADER_MAX_PARTS		32
++
++struct safeloader_cmn_header {
++	__be32 size;
++	uint32_t unused;
++} __packed;
++
++static void *mtd_parser_tplink_safeloader_read_table(struct mtd_info *mtd)
++{
++	struct safeloader_cmn_header hdr;
++	struct device_node *np;
++	size_t bytes_read;
++	size_t offset;
++	size_t size;
++	char *buf;
++	int err;
++
++	np = mtd_get_of_node(mtd);
++	if (mtd_is_partition(mtd))
++		of_node_get(np);
++	else
++		np = of_get_child_by_name(np, "partitions");
++
++	if (of_property_read_u32(np, "partitions-table-offset", (u32 *)&offset)) {
++		pr_err("Failed to get partitions table offset\n");
++		goto err_put;
++	}
++
++	err = mtd_read(mtd, offset, sizeof(hdr), &bytes_read, (uint8_t *)&hdr);
++	if (err && !mtd_is_bitflip(err)) {
++		pr_err("Failed to read from %s at 0x%zx\n", mtd->name, offset);
++		goto err_put;
++	}
++
++	size = be32_to_cpu(hdr.size);
++
++	buf = kmalloc(size + 1, GFP_KERNEL);
++	if (!buf)
++		goto err_put;
++
++	err = mtd_read(mtd, offset + sizeof(hdr), size, &bytes_read, buf);
++	if (err && !mtd_is_bitflip(err)) {
++		pr_err("Failed to read from %s at 0x%zx\n", mtd->name, offset + sizeof(hdr));
++		goto err_kfree;
++	}
++
++	buf[size] = '\0';
++
++	of_node_put(np);
++
++	return buf;
++
++err_kfree:
++	kfree(buf);
++err_put:
++	of_node_put(np);
++	return NULL;
++}
++
++static int mtd_parser_tplink_safeloader_parse(struct mtd_info *mtd,
++					      const struct mtd_partition **pparts,
++					      struct mtd_part_parser_data *data)
++{
++	struct mtd_partition *parts;
++	char name[65];
++	size_t offset;
++	size_t bytes;
++	char *buf;
++	int idx;
++	int err;
++
++	parts = kcalloc(TPLINK_SAFELOADER_MAX_PARTS, sizeof(*parts), GFP_KERNEL);
++	if (!parts) {
++		err = -ENOMEM;
++		goto err_out;
++	}
++
++	buf = mtd_parser_tplink_safeloader_read_table(mtd);
++	if (!buf) {
++		err = -ENOENT;
++		goto err_out;
++	}
++
++	for (idx = 0, offset = TPLINK_SAFELOADER_DATA_OFFSET;
++	     idx < TPLINK_SAFELOADER_MAX_PARTS &&
++	     sscanf(buf + offset, "partition %64s base 0x%llx size 0x%llx%zn\n",
++		    name, &parts[idx].offset, &parts[idx].size, &bytes) == 3;
++	     idx++, offset += bytes + 1) {
++		parts[idx].name = kstrdup(name, GFP_KERNEL);
++		if (!parts[idx].name) {
++			err = -ENOMEM;
++			goto err_free;
++		}
++	}
++
++	if (idx == TPLINK_SAFELOADER_MAX_PARTS)
++		pr_warn("Reached maximum number of partitions!\n");
++
++	kfree(buf);
++
++	*pparts = parts;
++
++	return idx;
++
++err_free:
++	for (idx -= 1; idx >= 0; idx--)
++		kfree(parts[idx].name);
++err_out:
++	return err;
++};
++
++static void mtd_parser_tplink_safeloader_cleanup(const struct mtd_partition *pparts,
++						 int nr_parts)
++{
++	int i;
++
++	for (i = 0; i < nr_parts; i++)
++		kfree(pparts[i].name);
++
++	kfree(pparts);
++}
++
++static const struct of_device_id mtd_parser_tplink_safeloader_of_match_table[] = {
++	{ .compatible = "tplink,safeloader-partitions" },
++	{},
++};
++MODULE_DEVICE_TABLE(of, mtd_parser_tplink_safeloader_of_match_table);
++
++static struct mtd_part_parser mtd_parser_tplink_safeloader = {
++	.parse_fn = mtd_parser_tplink_safeloader_parse,
++	.cleanup = mtd_parser_tplink_safeloader_cleanup,
++	.name = "tplink-safeloader",
++	.of_match_table = mtd_parser_tplink_safeloader_of_match_table,
++};
++module_mtd_part_parser(mtd_parser_tplink_safeloader);
++
++MODULE_LICENSE("GPL");
diff --git a/target/linux/generic/backport-6.1/423-v6.3-mtd-spinand-macronix-use-scratch-buffer-for-DMA-oper.patch b/target/linux/generic/backport-6.1/423-v6.3-mtd-spinand-macronix-use-scratch-buffer-for-DMA-oper.patch
new file mode 100644
index 00000000000000..7dbc2717250bfc
--- /dev/null
+++ b/target/linux/generic/backport-6.1/423-v6.3-mtd-spinand-macronix-use-scratch-buffer-for-DMA-oper.patch
@@ -0,0 +1,35 @@
+From ebed787a0becb9354f0a23620a5130cccd6c730c Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 19 Jan 2023 03:45:43 +0000
+Subject: [PATCH] mtd: spinand: macronix: use scratch buffer for DMA operation
+
+The mx35lf1ge4ab_get_eccsr() function uses an SPI DMA operation to
+read the eccsr, hence the buffer should not be on stack. Since commit
+380583227c0c7f ("spi: spi-mem: Add extra sanity checks on the op param")
+the kernel emmits a warning and blocks such operations.
+
+Use the scratch buffer to get eccsr instead of trying to directly read
+into a stack-allocated variable.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Dhruva Gole <d-gole@ti.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/Y8i85zM0u4XdM46z@makrotopia.org
+---
+ drivers/mtd/nand/spi/macronix.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/spi/macronix.c
++++ b/drivers/mtd/nand/spi/macronix.c
+@@ -83,9 +83,10 @@ static int mx35lf1ge4ab_ecc_get_status(s
+ 		 * in order to avoid forcing the wear-leveling layer to move
+ 		 * data around if it's not necessary.
+ 		 */
+-		if (mx35lf1ge4ab_get_eccsr(spinand, &eccsr))
++		if (mx35lf1ge4ab_get_eccsr(spinand, spinand->scratchbuf))
+ 			return nanddev_get_ecc_conf(nand)->strength;
+ 
++		eccsr = *spinand->scratchbuf;
+ 		if (WARN_ON(eccsr > nanddev_get_ecc_conf(nand)->strength ||
+ 			    !eccsr))
+ 			return nanddev_get_ecc_conf(nand)->strength;
diff --git a/target/linux/generic/backport-6.1/424-v6.4-0004-mtd-core-prepare-mtd_otp_nvmem_add-to-handle-EPROBE_.patch b/target/linux/generic/backport-6.1/424-v6.4-0004-mtd-core-prepare-mtd_otp_nvmem_add-to-handle-EPROBE_.patch
new file mode 100644
index 00000000000000..9ddda420ac3bbf
--- /dev/null
+++ b/target/linux/generic/backport-6.1/424-v6.4-0004-mtd-core-prepare-mtd_otp_nvmem_add-to-handle-EPROBE_.patch
@@ -0,0 +1,47 @@
+From 281f7a6c1a33fffcde32001bacbb4f672140fbf9 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Wed, 8 Mar 2023 09:20:21 +0100
+Subject: [PATCH] mtd: core: prepare mtd_otp_nvmem_add() to handle
+ -EPROBE_DEFER
+
+NVMEM soon will get the ability for nvmem layouts and these might
+not be ready when nvmem_register() is called and thus it might
+return -EPROBE_DEFER. Don't print the error message in this case.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20230308082021.870459-4-michael@walle.cc
+---
+ drivers/mtd/mtdcore.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -953,8 +953,8 @@ static int mtd_otp_nvmem_add(struct mtd_
+ 			nvmem = mtd_otp_nvmem_register(mtd, "user-otp", size,
+ 						       mtd_nvmem_user_otp_reg_read);
+ 			if (IS_ERR(nvmem)) {
+-				dev_err(dev, "Failed to register OTP NVMEM device\n");
+-				return PTR_ERR(nvmem);
++				err = PTR_ERR(nvmem);
++				goto err;
+ 			}
+ 			mtd->otp_user_nvmem = nvmem;
+ 		}
+@@ -971,7 +971,6 @@ static int mtd_otp_nvmem_add(struct mtd_
+ 			nvmem = mtd_otp_nvmem_register(mtd, "factory-otp", size,
+ 						       mtd_nvmem_fact_otp_reg_read);
+ 			if (IS_ERR(nvmem)) {
+-				dev_err(dev, "Failed to register OTP NVMEM device\n");
+ 				err = PTR_ERR(nvmem);
+ 				goto err;
+ 			}
+@@ -983,7 +982,7 @@ static int mtd_otp_nvmem_add(struct mtd_
+ 
+ err:
+ 	nvmem_unregister(mtd->otp_user_nvmem);
+-	return err;
++	return dev_err_probe(dev, err, "Failed to register OTP NVMEM device\n");
+ }
+ 
+ /**
diff --git a/target/linux/generic/backport-6.1/611-v6.3-net-add-helper-eth_addr_add.patch b/target/linux/generic/backport-6.1/611-v6.3-net-add-helper-eth_addr_add.patch
new file mode 100644
index 00000000000000..28b7b4383e64c3
--- /dev/null
+++ b/target/linux/generic/backport-6.1/611-v6.3-net-add-helper-eth_addr_add.patch
@@ -0,0 +1,41 @@
+From 7390609b0121a1b982c5ecdfcd72dc328e5784ee Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Mon, 6 Feb 2023 13:43:42 +0000
+Subject: [PATCH] net: add helper eth_addr_add()
+
+Add a helper to add an offset to a ethernet address. This comes in handy
+if you have a base ethernet address for multiple interfaces.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Acked-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-9-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/etherdevice.h | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/include/linux/etherdevice.h
++++ b/include/linux/etherdevice.h
+@@ -508,6 +508,20 @@ static inline void eth_addr_inc(u8 *addr
+ }
+ 
+ /**
++ * eth_addr_add() - Add (or subtract) an offset to/from the given MAC address.
++ *
++ * @offset: Offset to add.
++ * @addr: Pointer to a six-byte array containing Ethernet address to increment.
++ */
++static inline void eth_addr_add(u8 *addr, long offset)
++{
++	u64 u = ether_addr_to_u64(addr);
++
++	u += offset;
++	u64_to_ether_addr(u, addr);
++}
++
++/**
+  * is_etherdev_addr - Tell if given Ethernet address belongs to the device.
+  * @dev: Pointer to a device structure
+  * @addr: Pointer to a six-byte array containing the Ethernet address
diff --git a/target/linux/generic/backport-6.1/700-v6.2-net-phylink-add-phylink_get_link_timer_ns-helper.patch b/target/linux/generic/backport-6.1/700-v6.2-net-phylink-add-phylink_get_link_timer_ns-helper.patch
new file mode 100644
index 00000000000000..81c14a0557b2aa
--- /dev/null
+++ b/target/linux/generic/backport-6.1/700-v6.2-net-phylink-add-phylink_get_link_timer_ns-helper.patch
@@ -0,0 +1,48 @@
+From 9c5a170677c3c8facc83e931a57f4c99c0511ae0 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 27 Oct 2022 14:10:37 +0100
+Subject: [PATCH] net: phylink: add phylink_get_link_timer_ns() helper
+
+Add a helper to convert the PHY interface mode to the required link
+timer setting as stated by the appropriate standard. Inappropriate
+interface modes return an error.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ include/linux/phylink.h | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/include/linux/phylink.h
++++ b/include/linux/phylink.h
+@@ -614,6 +614,30 @@ int phylink_speed_up(struct phylink *pl)
+ 
+ void phylink_set_port_modes(unsigned long *bits);
+ 
++/**
++ * phylink_get_link_timer_ns - return the PCS link timer value
++ * @interface: link &typedef phy_interface_t mode
++ *
++ * Return the PCS link timer setting in nanoseconds for the PHY @interface
++ * mode, or -EINVAL if not appropriate.
++ */
++static inline int phylink_get_link_timer_ns(phy_interface_t interface)
++{
++	switch (interface) {
++	case PHY_INTERFACE_MODE_SGMII:
++	case PHY_INTERFACE_MODE_QSGMII:
++	case PHY_INTERFACE_MODE_USXGMII:
++		return 1600000;
++
++	case PHY_INTERFACE_MODE_1000BASEX:
++	case PHY_INTERFACE_MODE_2500BASEX:
++		return 10000000;
++
++	default:
++		return -EINVAL;
++	}
++}
++
+ void phylink_mii_c22_pcs_decode_state(struct phylink_link_state *state,
+ 				      u16 bmsr, u16 lpa);
+ void phylink_mii_c22_pcs_get_state(struct mdio_device *pcs,
diff --git a/target/linux/generic/backport-6.1/707-v6.3-net-pcs-add-driver-for-MediaTek-SGMII-PCS.patch b/target/linux/generic/backport-6.1/707-v6.3-net-pcs-add-driver-for-MediaTek-SGMII-PCS.patch
new file mode 100644
index 00000000000000..980cb0f9147a6f
--- /dev/null
+++ b/target/linux/generic/backport-6.1/707-v6.3-net-pcs-add-driver-for-MediaTek-SGMII-PCS.patch
@@ -0,0 +1,394 @@
+From 4765a9722e09765866e131ec31f7b9cf4c1f4854 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sun, 19 Mar 2023 12:57:50 +0000
+Subject: [PATCH] net: pcs: add driver for MediaTek SGMII PCS
+
+The SGMII core found in several MediaTek SoCs is identical to what can
+also be found in MediaTek's MT7531 Ethernet switch IC.
+As this has not always been clear, both drivers developed different
+implementations to deal with the PCS.
+Recently Alexander Couzens pointed out this fact which lead to the
+development of this shared driver.
+
+Add a dedicated driver, mostly by copying the code now found in the
+Ethernet driver. The now redundant code will be removed by a follow-up
+commit.
+
+Suggested-by: Alexander Couzens <lynxis@fe80.eu>
+Suggested-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Tested-by: Frank Wunderlich <frank-w@public-files.de>
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ MAINTAINERS                       |   8 +
+ drivers/net/pcs/Kconfig           |   7 +
+ drivers/net/pcs/Makefile          |   1 +
+ drivers/net/pcs/pcs-mtk-lynxi.c   | 305 ++++++++++++++++++++++++++++++
+ include/linux/pcs/pcs-mtk-lynxi.h |  13 ++
+ 5 files changed, 334 insertions(+)
+ create mode 100644 drivers/net/pcs/pcs-mtk-lynxi.c
+ create mode 100644 include/linux/pcs/pcs-mtk-lynxi.h
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -12926,6 +12926,14 @@ L:	netdev@vger.kernel.org
+ S:	Maintained
+ F:	drivers/net/ethernet/mediatek/
+ 
++MEDIATEK ETHERNET PCS DRIVER
++M:	Alexander Couzens <lynxis@fe80.eu>
++M:	Daniel Golle <daniel@makrotopia.org>
++L:	netdev@vger.kernel.org
++S:	Maintained
++F:	drivers/net/pcs/pcs-mtk-lynxi.c
++F:	include/linux/pcs/pcs-mtk-lynxi.h
++
+ MEDIATEK I2C CONTROLLER DRIVER
+ M:	Qii Wang <qii.wang@mediatek.com>
+ L:	linux-i2c@vger.kernel.org
+--- a/drivers/net/pcs/Kconfig
++++ b/drivers/net/pcs/Kconfig
+@@ -32,4 +32,11 @@ config PCS_ALTERA_TSE
+ 	  This module provides helper functions for the Altera Triple Speed
+ 	  Ethernet SGMII PCS, that can be found on the Intel Socfpga family.
+ 
++config PCS_MTK_LYNXI
++	tristate
++	select REGMAP
++	help
++	  This module provides helpers to phylink for managing the LynxI PCS
++	  which is part of MediaTek's SoC and Ethernet switch ICs.
++
+ endmenu
+--- a/drivers/net/pcs/Makefile
++++ b/drivers/net/pcs/Makefile
+@@ -7,3 +7,4 @@ obj-$(CONFIG_PCS_XPCS)		+= pcs_xpcs.o
+ obj-$(CONFIG_PCS_LYNX)		+= pcs-lynx.o
+ obj-$(CONFIG_PCS_RZN1_MIIC)	+= pcs-rzn1-miic.o
+ obj-$(CONFIG_PCS_ALTERA_TSE)	+= pcs-altera-tse.o
++obj-$(CONFIG_PCS_MTK_LYNXI)	+= pcs-mtk-lynxi.o
+--- /dev/null
++++ b/drivers/net/pcs/pcs-mtk-lynxi.c
+@@ -0,0 +1,305 @@
++// SPDX-License-Identifier: GPL-2.0
++// Copyright (c) 2018-2019 MediaTek Inc.
++/* A library for MediaTek SGMII circuit
++ *
++ * Author: Sean Wang <sean.wang@mediatek.com>
++ * Author: Alexander Couzens <lynxis@fe80.eu>
++ * Author: Daniel Golle <daniel@makrotopia.org>
++ *
++ */
++
++#include <linux/mdio.h>
++#include <linux/of.h>
++#include <linux/pcs/pcs-mtk-lynxi.h>
++#include <linux/phylink.h>
++#include <linux/regmap.h>
++
++/* SGMII subsystem config registers */
++/* BMCR (low 16) BMSR (high 16) */
++#define SGMSYS_PCS_CONTROL_1		0x0
++#define SGMII_BMCR			GENMASK(15, 0)
++#define SGMII_BMSR			GENMASK(31, 16)
++
++#define SGMSYS_PCS_DEVICE_ID		0x4
++#define SGMII_LYNXI_DEV_ID		0x4d544950
++
++#define SGMSYS_PCS_ADVERTISE		0x8
++#define SGMII_ADVERTISE			GENMASK(15, 0)
++#define SGMII_LPA			GENMASK(31, 16)
++
++#define SGMSYS_PCS_SCRATCH		0x14
++#define SGMII_DEV_VERSION		GENMASK(31, 16)
++
++/* Register to programmable link timer, the unit in 2 * 8ns */
++#define SGMSYS_PCS_LINK_TIMER		0x18
++#define SGMII_LINK_TIMER_MASK		GENMASK(19, 0)
++#define SGMII_LINK_TIMER_VAL(ns)	FIELD_PREP(SGMII_LINK_TIMER_MASK, \
++						   ((ns) / 2 / 8))
++
++/* Register to control remote fault */
++#define SGMSYS_SGMII_MODE		0x20
++#define SGMII_IF_MODE_SGMII		BIT(0)
++#define SGMII_SPEED_DUPLEX_AN		BIT(1)
++#define SGMII_SPEED_MASK		GENMASK(3, 2)
++#define SGMII_SPEED_10			FIELD_PREP(SGMII_SPEED_MASK, 0)
++#define SGMII_SPEED_100			FIELD_PREP(SGMII_SPEED_MASK, 1)
++#define SGMII_SPEED_1000		FIELD_PREP(SGMII_SPEED_MASK, 2)
++#define SGMII_DUPLEX_HALF		BIT(4)
++#define SGMII_REMOTE_FAULT_DIS		BIT(8)
++
++/* Register to reset SGMII design */
++#define SGMSYS_RESERVED_0		0x34
++#define SGMII_SW_RESET			BIT(0)
++
++/* Register to set SGMII speed, ANA RG_ Control Signals III */
++#define SGMII_PHY_SPEED_MASK		GENMASK(3, 2)
++#define SGMII_PHY_SPEED_1_25G		FIELD_PREP(SGMII_PHY_SPEED_MASK, 0)
++#define SGMII_PHY_SPEED_3_125G		FIELD_PREP(SGMII_PHY_SPEED_MASK, 1)
++
++/* Register to power up QPHY */
++#define SGMSYS_QPHY_PWR_STATE_CTRL	0xe8
++#define	SGMII_PHYA_PWD			BIT(4)
++
++/* Register to QPHY wrapper control */
++#define SGMSYS_QPHY_WRAP_CTRL		0xec
++#define SGMII_PN_SWAP_MASK		GENMASK(1, 0)
++#define SGMII_PN_SWAP_TX_RX		(BIT(0) | BIT(1))
++
++/* struct mtk_pcs_lynxi -  This structure holds each sgmii regmap andassociated
++ *                         data
++ * @regmap:                The register map pointing at the range used to setup
++ *                         SGMII modes
++ * @dev:                   Pointer to device owning the PCS
++ * @ana_rgc3:              The offset of register ANA_RGC3 relative to regmap
++ * @interface:             Currently configured interface mode
++ * @pcs:                   Phylink PCS structure
++ * @flags:                 Flags indicating hardware properties
++ */
++struct mtk_pcs_lynxi {
++	struct regmap		*regmap;
++	u32			ana_rgc3;
++	phy_interface_t		interface;
++	struct			phylink_pcs pcs;
++	u32			flags;
++};
++
++static struct mtk_pcs_lynxi *pcs_to_mtk_pcs_lynxi(struct phylink_pcs *pcs)
++{
++	return container_of(pcs, struct mtk_pcs_lynxi, pcs);
++}
++
++static void mtk_pcs_lynxi_get_state(struct phylink_pcs *pcs,
++				    struct phylink_link_state *state)
++{
++	struct mtk_pcs_lynxi *mpcs = pcs_to_mtk_pcs_lynxi(pcs);
++	unsigned int bm, adv;
++
++	/* Read the BMSR and LPA */
++	regmap_read(mpcs->regmap, SGMSYS_PCS_CONTROL_1, &bm);
++	regmap_read(mpcs->regmap, SGMSYS_PCS_ADVERTISE, &adv);
++
++	phylink_mii_c22_pcs_decode_state(state, FIELD_GET(SGMII_BMSR, bm),
++					 FIELD_GET(SGMII_LPA, adv));
++}
++
++static int mtk_pcs_lynxi_config(struct phylink_pcs *pcs, unsigned int mode,
++				phy_interface_t interface,
++				const unsigned long *advertising,
++				bool permit_pause_to_mac)
++{
++	struct mtk_pcs_lynxi *mpcs = pcs_to_mtk_pcs_lynxi(pcs);
++	bool mode_changed = false, changed, use_an;
++	unsigned int rgc3, sgm_mode, bmcr;
++	int advertise, link_timer;
++
++	advertise = phylink_mii_c22_pcs_encode_advertisement(interface,
++							     advertising);
++	if (advertise < 0)
++		return advertise;
++
++	/* Clearing IF_MODE_BIT0 switches the PCS to BASE-X mode, and
++	 * we assume that fixes it's speed at bitrate = line rate (in
++	 * other words, 1000Mbps or 2500Mbps).
++	 */
++	if (interface == PHY_INTERFACE_MODE_SGMII) {
++		sgm_mode = SGMII_IF_MODE_SGMII;
++		if (phylink_autoneg_inband(mode)) {
++			sgm_mode |= SGMII_REMOTE_FAULT_DIS |
++				    SGMII_SPEED_DUPLEX_AN;
++			use_an = true;
++		} else {
++			use_an = false;
++		}
++	} else if (phylink_autoneg_inband(mode)) {
++		/* 1000base-X or 2500base-X autoneg */
++		sgm_mode = SGMII_REMOTE_FAULT_DIS;
++		use_an = linkmode_test_bit(ETHTOOL_LINK_MODE_Autoneg_BIT,
++					   advertising);
++	} else {
++		/* 1000base-X or 2500base-X without autoneg */
++		sgm_mode = 0;
++		use_an = false;
++	}
++
++	if (use_an)
++		bmcr = BMCR_ANENABLE;
++	else
++		bmcr = 0;
++
++	if (mpcs->interface != interface) {
++		link_timer = phylink_get_link_timer_ns(interface);
++		if (link_timer < 0)
++			return link_timer;
++
++		/* PHYA power down */
++		regmap_set_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
++				SGMII_PHYA_PWD);
++
++		/* Reset SGMII PCS state */
++		regmap_set_bits(mpcs->regmap, SGMSYS_RESERVED_0,
++				SGMII_SW_RESET);
++
++		if (mpcs->flags & MTK_SGMII_FLAG_PN_SWAP)
++			regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_WRAP_CTRL,
++					   SGMII_PN_SWAP_MASK,
++					   SGMII_PN_SWAP_TX_RX);
++
++		if (interface == PHY_INTERFACE_MODE_2500BASEX)
++			rgc3 = SGMII_PHY_SPEED_3_125G;
++		else
++			rgc3 = SGMII_PHY_SPEED_1_25G;
++
++		/* Configure the underlying interface speed */
++		regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
++				   SGMII_PHY_SPEED_MASK, rgc3);
++
++		/* Setup the link timer */
++		regmap_write(mpcs->regmap, SGMSYS_PCS_LINK_TIMER,
++			     SGMII_LINK_TIMER_VAL(link_timer));
++
++		mpcs->interface = interface;
++		mode_changed = true;
++	}
++
++	/* Update the advertisement, noting whether it has changed */
++	regmap_update_bits_check(mpcs->regmap, SGMSYS_PCS_ADVERTISE,
++				 SGMII_ADVERTISE, advertise, &changed);
++
++	/* Update the sgmsys mode register */
++	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
++			   SGMII_REMOTE_FAULT_DIS | SGMII_SPEED_DUPLEX_AN |
++			   SGMII_IF_MODE_SGMII, sgm_mode);
++
++	/* Update the BMCR */
++	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
++			   BMCR_ANENABLE, bmcr);
++
++	/* Release PHYA power down state
++	 * Only removing bit SGMII_PHYA_PWD isn't enough.
++	 * There are cases when the SGMII_PHYA_PWD register contains 0x9 which
++	 * prevents SGMII from working. The SGMII still shows link but no traffic
++	 * can flow. Writing 0x0 to the PHYA_PWD register fix the issue. 0x0 was
++	 * taken from a good working state of the SGMII interface.
++	 * Unknown how much the QPHY needs but it is racy without a sleep.
++	 * Tested on mt7622 & mt7986.
++	 */
++	usleep_range(50, 100);
++	regmap_write(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, 0);
++
++	return changed || mode_changed;
++}
++
++static void mtk_pcs_lynxi_restart_an(struct phylink_pcs *pcs)
++{
++	struct mtk_pcs_lynxi *mpcs = pcs_to_mtk_pcs_lynxi(pcs);
++
++	regmap_set_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1, BMCR_ANRESTART);
++}
++
++static void mtk_pcs_lynxi_link_up(struct phylink_pcs *pcs, unsigned int mode,
++				  phy_interface_t interface, int speed,
++				  int duplex)
++{
++	struct mtk_pcs_lynxi *mpcs = pcs_to_mtk_pcs_lynxi(pcs);
++	unsigned int sgm_mode;
++
++	if (!phylink_autoneg_inband(mode)) {
++		/* Force the speed and duplex setting */
++		if (speed == SPEED_10)
++			sgm_mode = SGMII_SPEED_10;
++		else if (speed == SPEED_100)
++			sgm_mode = SGMII_SPEED_100;
++		else
++			sgm_mode = SGMII_SPEED_1000;
++
++		if (duplex != DUPLEX_FULL)
++			sgm_mode |= SGMII_DUPLEX_HALF;
++
++		regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
++				   SGMII_DUPLEX_HALF | SGMII_SPEED_MASK,
++				   sgm_mode);
++	}
++}
++
++static const struct phylink_pcs_ops mtk_pcs_lynxi_ops = {
++	.pcs_get_state = mtk_pcs_lynxi_get_state,
++	.pcs_config = mtk_pcs_lynxi_config,
++	.pcs_an_restart = mtk_pcs_lynxi_restart_an,
++	.pcs_link_up = mtk_pcs_lynxi_link_up,
++};
++
++struct phylink_pcs *mtk_pcs_lynxi_create(struct device *dev,
++					 struct regmap *regmap, u32 ana_rgc3,
++					 u32 flags)
++{
++	struct mtk_pcs_lynxi *mpcs;
++	u32 id, ver;
++	int ret;
++
++	ret = regmap_read(regmap, SGMSYS_PCS_DEVICE_ID, &id);
++	if (ret < 0)
++		return NULL;
++
++	if (id != SGMII_LYNXI_DEV_ID) {
++		dev_err(dev, "unknown PCS device id %08x\n", id);
++		return NULL;
++	}
++
++	ret = regmap_read(regmap, SGMSYS_PCS_SCRATCH, &ver);
++	if (ret < 0)
++		return NULL;
++
++	ver = FIELD_GET(SGMII_DEV_VERSION, ver);
++	if (ver != 0x1) {
++		dev_err(dev, "unknown PCS device version %04x\n", ver);
++		return NULL;
++	}
++
++	dev_dbg(dev, "MediaTek LynxI SGMII PCS (id 0x%08x, ver 0x%04x)\n", id,
++		ver);
++
++	mpcs = kzalloc(sizeof(*mpcs), GFP_KERNEL);
++	if (!mpcs)
++		return NULL;
++
++	mpcs->ana_rgc3 = ana_rgc3;
++	mpcs->regmap = regmap;
++	mpcs->flags = flags;
++	mpcs->pcs.ops = &mtk_pcs_lynxi_ops;
++	mpcs->pcs.poll = true;
++	mpcs->interface = PHY_INTERFACE_MODE_NA;
++
++	return &mpcs->pcs;
++}
++EXPORT_SYMBOL(mtk_pcs_lynxi_create);
++
++void mtk_pcs_lynxi_destroy(struct phylink_pcs *pcs)
++{
++	if (!pcs)
++		return;
++
++	kfree(pcs_to_mtk_pcs_lynxi(pcs));
++}
++EXPORT_SYMBOL(mtk_pcs_lynxi_destroy);
++
++MODULE_LICENSE("GPL");
+--- /dev/null
++++ b/include/linux/pcs/pcs-mtk-lynxi.h
+@@ -0,0 +1,13 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef __LINUX_PCS_MTK_LYNXI_H
++#define __LINUX_PCS_MTK_LYNXI_H
++
++#include <linux/phylink.h>
++#include <linux/regmap.h>
++
++#define MTK_SGMII_FLAG_PN_SWAP BIT(0)
++struct phylink_pcs *mtk_pcs_lynxi_create(struct device *dev,
++					 struct regmap *regmap,
++					 u32 ana_rgc3, u32 flags);
++void mtk_pcs_lynxi_destroy(struct phylink_pcs *pcs);
++#endif
diff --git a/target/linux/generic/backport-6.1/729-01-v6.1-net-ethernet-mtk_wed-introduce-wed-mcu-support.patch b/target/linux/generic/backport-6.1/729-01-v6.1-net-ethernet-mtk_wed-introduce-wed-mcu-support.patch
new file mode 100644
index 00000000000000..c48613929d1272
--- /dev/null
+++ b/target/linux/generic/backport-6.1/729-01-v6.1-net-ethernet-mtk_wed-introduce-wed-mcu-support.patch
@@ -0,0 +1,591 @@
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Sat, 5 Nov 2022 23:36:18 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: introduce wed mcu support
+
+Introduce WED mcu support used to configure WED WO chip.
+This is a preliminary patch in order to add RX Wireless
+Ethernet Dispatch available on MT7986 SoC.
+
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ create mode 100644 drivers/net/ethernet/mediatek/mtk_wed_mcu.c
+ create mode 100644 drivers/net/ethernet/mediatek/mtk_wed_wo.h
+
+--- a/drivers/net/ethernet/mediatek/Makefile
++++ b/drivers/net/ethernet/mediatek/Makefile
+@@ -5,7 +5,7 @@
+ 
+ obj-$(CONFIG_NET_MEDIATEK_SOC) += mtk_eth.o
+ mtk_eth-y := mtk_eth_soc.o mtk_sgmii.o mtk_eth_path.o mtk_ppe.o mtk_ppe_debugfs.o mtk_ppe_offload.o
+-mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed.o
++mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed.o mtk_wed_mcu.o
+ ifdef CONFIG_DEBUG_FS
+ mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed_debugfs.o
+ endif
+--- /dev/null
++++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
+@@ -0,0 +1,359 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/* Copyright (C) 2022 MediaTek Inc.
++ *
++ * Author: Lorenzo Bianconi <lorenzo@kernel.org>
++ *	   Sujuan Chen <sujuan.chen@mediatek.com>
++ */
++
++#include <linux/firmware.h>
++#include <linux/of_address.h>
++#include <linux/of_reserved_mem.h>
++#include <linux/mfd/syscon.h>
++#include <linux/soc/mediatek/mtk_wed.h>
++
++#include "mtk_wed_regs.h"
++#include "mtk_wed_wo.h"
++#include "mtk_wed.h"
++
++static u32 wo_r32(struct mtk_wed_wo *wo, u32 reg)
++{
++	return readl(wo->boot.addr + reg);
++}
++
++static void wo_w32(struct mtk_wed_wo *wo, u32 reg, u32 val)
++{
++	writel(val, wo->boot.addr + reg);
++}
++
++static struct sk_buff *
++mtk_wed_mcu_msg_alloc(const void *data, int data_len)
++{
++	int length = sizeof(struct mtk_wed_mcu_hdr) + data_len;
++	struct sk_buff *skb;
++
++	skb = alloc_skb(length, GFP_KERNEL);
++	if (!skb)
++		return NULL;
++
++	memset(skb->head, 0, length);
++	skb_reserve(skb, sizeof(struct mtk_wed_mcu_hdr));
++	if (data && data_len)
++		skb_put_data(skb, data, data_len);
++
++	return skb;
++}
++
++static struct sk_buff *
++mtk_wed_mcu_get_response(struct mtk_wed_wo *wo, unsigned long expires)
++{
++	if (!time_is_after_jiffies(expires))
++		return NULL;
++
++	wait_event_timeout(wo->mcu.wait, !skb_queue_empty(&wo->mcu.res_q),
++			   expires - jiffies);
++	return skb_dequeue(&wo->mcu.res_q);
++}
++
++void mtk_wed_mcu_rx_event(struct mtk_wed_wo *wo, struct sk_buff *skb)
++{
++	skb_queue_tail(&wo->mcu.res_q, skb);
++	wake_up(&wo->mcu.wait);
++}
++
++void mtk_wed_mcu_rx_unsolicited_event(struct mtk_wed_wo *wo,
++				      struct sk_buff *skb)
++{
++	struct mtk_wed_mcu_hdr *hdr = (struct mtk_wed_mcu_hdr *)skb->data;
++
++	switch (hdr->cmd) {
++	case MTK_WED_WO_EVT_LOG_DUMP: {
++		const char *msg = (const char *)(skb->data + sizeof(*hdr));
++
++		dev_notice(wo->hw->dev, "%s\n", msg);
++		break;
++	}
++	case MTK_WED_WO_EVT_PROFILING: {
++		struct mtk_wed_wo_log_info *info;
++		u32 count = (skb->len - sizeof(*hdr)) / sizeof(*info);
++		int i;
++
++		info = (struct mtk_wed_wo_log_info *)(skb->data + sizeof(*hdr));
++		for (i = 0 ; i < count ; i++)
++			dev_notice(wo->hw->dev,
++				   "SN:%u latency: total=%u, rro:%u, mod:%u\n",
++				   le32_to_cpu(info[i].sn),
++				   le32_to_cpu(info[i].total),
++				   le32_to_cpu(info[i].rro),
++				   le32_to_cpu(info[i].mod));
++		break;
++	}
++	case MTK_WED_WO_EVT_RXCNT_INFO:
++		break;
++	default:
++		break;
++	}
++
++	dev_kfree_skb(skb);
++}
++
++static int
++mtk_wed_mcu_skb_send_msg(struct mtk_wed_wo *wo, struct sk_buff *skb,
++			 int id, int cmd, u16 *wait_seq, bool wait_resp)
++{
++	struct mtk_wed_mcu_hdr *hdr;
++
++	/* TODO: make it dynamic based on cmd */
++	wo->mcu.timeout = 20 * HZ;
++
++	hdr = (struct mtk_wed_mcu_hdr *)skb_push(skb, sizeof(*hdr));
++	hdr->cmd = cmd;
++	hdr->length = cpu_to_le16(skb->len);
++
++	if (wait_resp && wait_seq) {
++		u16 seq = ++wo->mcu.seq;
++
++		if (!seq)
++			seq = ++wo->mcu.seq;
++		*wait_seq = seq;
++
++		hdr->flag |= cpu_to_le16(MTK_WED_WARP_CMD_FLAG_NEED_RSP);
++		hdr->seq = cpu_to_le16(seq);
++	}
++	if (id == MTK_WED_MODULE_ID_WO)
++		hdr->flag |= cpu_to_le16(MTK_WED_WARP_CMD_FLAG_FROM_TO_WO);
++
++	dev_kfree_skb(skb);
++	return 0;
++}
++
++static int
++mtk_wed_mcu_parse_response(struct mtk_wed_wo *wo, struct sk_buff *skb,
++			   int cmd, int seq)
++{
++	struct mtk_wed_mcu_hdr *hdr;
++
++	if (!skb) {
++		dev_err(wo->hw->dev, "Message %08x (seq %d) timeout\n",
++			cmd, seq);
++		return -ETIMEDOUT;
++	}
++
++	hdr = (struct mtk_wed_mcu_hdr *)skb->data;
++	if (le16_to_cpu(hdr->seq) != seq)
++		return -EAGAIN;
++
++	skb_pull(skb, sizeof(*hdr));
++	switch (cmd) {
++	case MTK_WED_WO_CMD_RXCNT_INFO:
++	default:
++		break;
++	}
++
++	return 0;
++}
++
++int mtk_wed_mcu_send_msg(struct mtk_wed_wo *wo, int id, int cmd,
++			 const void *data, int len, bool wait_resp)
++{
++	unsigned long expires;
++	struct sk_buff *skb;
++	u16 seq;
++	int ret;
++
++	skb = mtk_wed_mcu_msg_alloc(data, len);
++	if (!skb)
++		return -ENOMEM;
++
++	mutex_lock(&wo->mcu.mutex);
++
++	ret = mtk_wed_mcu_skb_send_msg(wo, skb, id, cmd, &seq, wait_resp);
++	if (ret || !wait_resp)
++		goto unlock;
++
++	expires = jiffies + wo->mcu.timeout;
++	do {
++		skb = mtk_wed_mcu_get_response(wo, expires);
++		ret = mtk_wed_mcu_parse_response(wo, skb, cmd, seq);
++		dev_kfree_skb(skb);
++	} while (ret == -EAGAIN);
++
++unlock:
++	mutex_unlock(&wo->mcu.mutex);
++
++	return ret;
++}
++
++static int
++mtk_wed_get_memory_region(struct mtk_wed_wo *wo,
++			  struct mtk_wed_wo_memory_region *region)
++{
++	struct reserved_mem *rmem;
++	struct device_node *np;
++	int index;
++
++	index = of_property_match_string(wo->hw->node, "memory-region-names",
++					 region->name);
++	if (index < 0)
++		return index;
++
++	np = of_parse_phandle(wo->hw->node, "memory-region", index);
++	if (!np)
++		return -ENODEV;
++
++	rmem = of_reserved_mem_lookup(np);
++	of_node_put(np);
++
++	if (!rmem)
++		return -ENODEV;
++
++	region->phy_addr = rmem->base;
++	region->size = rmem->size;
++	region->addr = devm_ioremap(wo->hw->dev, region->phy_addr, region->size);
++
++	return !region->addr ? -EINVAL : 0;
++}
++
++static int
++mtk_wed_mcu_run_firmware(struct mtk_wed_wo *wo, const struct firmware *fw,
++			 struct mtk_wed_wo_memory_region *region)
++{
++	const u8 *first_region_ptr, *region_ptr, *trailer_ptr, *ptr = fw->data;
++	const struct mtk_wed_fw_trailer *trailer;
++	const struct mtk_wed_fw_region *fw_region;
++
++	trailer_ptr = fw->data + fw->size - sizeof(*trailer);
++	trailer = (const struct mtk_wed_fw_trailer *)trailer_ptr;
++	region_ptr = trailer_ptr - trailer->num_region * sizeof(*fw_region);
++	first_region_ptr = region_ptr;
++
++	while (region_ptr < trailer_ptr) {
++		u32 length;
++
++		fw_region = (const struct mtk_wed_fw_region *)region_ptr;
++		length = le32_to_cpu(fw_region->len);
++
++		if (region->phy_addr != le32_to_cpu(fw_region->addr))
++			goto next;
++
++		if (region->size < length)
++			goto next;
++
++		if (first_region_ptr < ptr + length)
++			goto next;
++
++		if (region->shared && region->consumed)
++			return 0;
++
++		if (!region->shared || !region->consumed) {
++			memcpy_toio(region->addr, ptr, length);
++			region->consumed = true;
++			return 0;
++		}
++next:
++		region_ptr += sizeof(*fw_region);
++		ptr += length;
++	}
++
++	return -EINVAL;
++}
++
++static int
++mtk_wed_mcu_load_firmware(struct mtk_wed_wo *wo)
++{
++	static struct mtk_wed_wo_memory_region mem_region[] = {
++		[MTK_WED_WO_REGION_EMI] = {
++			.name = "wo-emi",
++		},
++		[MTK_WED_WO_REGION_ILM] = {
++			.name = "wo-ilm",
++		},
++		[MTK_WED_WO_REGION_DATA] = {
++			.name = "wo-data",
++			.shared = true,
++		},
++	};
++	const struct mtk_wed_fw_trailer *trailer;
++	const struct firmware *fw;
++	const char *fw_name;
++	u32 val, boot_cr;
++	int ret, i;
++
++	/* load firmware region metadata */
++	for (i = 0; i < ARRAY_SIZE(mem_region); i++) {
++		ret = mtk_wed_get_memory_region(wo, &mem_region[i]);
++		if (ret)
++			return ret;
++	}
++
++	wo->boot.name = "wo-boot";
++	ret = mtk_wed_get_memory_region(wo, &wo->boot);
++	if (ret)
++		return ret;
++
++	/* set dummy cr */
++	wed_w32(wo->hw->wed_dev, MTK_WED_SCR0 + 4 * MTK_WED_DUMMY_CR_FWDL,
++		wo->hw->index + 1);
++
++	/* load firmware */
++	fw_name = wo->hw->index ? MT7986_FIRMWARE_WO1 : MT7986_FIRMWARE_WO0;
++	ret = request_firmware(&fw, fw_name, wo->hw->dev);
++	if (ret)
++		return ret;
++
++	trailer = (void *)(fw->data + fw->size -
++			   sizeof(struct mtk_wed_fw_trailer));
++	dev_info(wo->hw->dev,
++		 "MTK WED WO Firmware Version: %.10s, Build Time: %.15s\n",
++		 trailer->fw_ver, trailer->build_date);
++	dev_info(wo->hw->dev, "MTK WED WO Chip ID %02x Region %d\n",
++		 trailer->chip_id, trailer->num_region);
++
++	for (i = 0; i < ARRAY_SIZE(mem_region); i++) {
++		ret = mtk_wed_mcu_run_firmware(wo, fw, &mem_region[i]);
++		if (ret)
++			goto out;
++	}
++
++	/* set the start address */
++	boot_cr = wo->hw->index ? MTK_WO_MCU_CFG_LS_WA_BOOT_ADDR_ADDR
++				: MTK_WO_MCU_CFG_LS_WM_BOOT_ADDR_ADDR;
++	wo_w32(wo, boot_cr, mem_region[MTK_WED_WO_REGION_EMI].phy_addr >> 16);
++	/* wo firmware reset */
++	wo_w32(wo, MTK_WO_MCU_CFG_LS_WF_MCCR_CLR_ADDR, 0xc00);
++
++	val = wo_r32(wo, MTK_WO_MCU_CFG_LS_WF_MCU_CFG_WM_WA_ADDR);
++	val |= wo->hw->index ? MTK_WO_MCU_CFG_LS_WF_WM_WA_WA_CPU_RSTB_MASK
++			     : MTK_WO_MCU_CFG_LS_WF_WM_WA_WM_CPU_RSTB_MASK;
++	wo_w32(wo, MTK_WO_MCU_CFG_LS_WF_MCU_CFG_WM_WA_ADDR, val);
++out:
++	release_firmware(fw);
++
++	return ret;
++}
++
++static u32
++mtk_wed_mcu_read_fw_dl(struct mtk_wed_wo *wo)
++{
++	return wed_r32(wo->hw->wed_dev,
++		       MTK_WED_SCR0 + 4 * MTK_WED_DUMMY_CR_FWDL);
++}
++
++int mtk_wed_mcu_init(struct mtk_wed_wo *wo)
++{
++	u32 val;
++	int ret;
++
++	skb_queue_head_init(&wo->mcu.res_q);
++	init_waitqueue_head(&wo->mcu.wait);
++	mutex_init(&wo->mcu.mutex);
++
++	ret = mtk_wed_mcu_load_firmware(wo);
++	if (ret)
++		return ret;
++
++	return readx_poll_timeout(mtk_wed_mcu_read_fw_dl, wo, val, !val,
++				  100, MTK_FW_DL_TIMEOUT);
++}
++
++MODULE_FIRMWARE(MT7986_FIRMWARE_WO0);
++MODULE_FIRMWARE(MT7986_FIRMWARE_WO1);
+--- a/drivers/net/ethernet/mediatek/mtk_wed_regs.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_regs.h
+@@ -152,6 +152,7 @@ struct mtk_wdma_desc {
+ 
+ #define MTK_WED_RING_RX(_n)				(0x400 + (_n) * 0x10)
+ 
++#define MTK_WED_SCR0					0x3c0
+ #define MTK_WED_WPDMA_INT_TRIGGER			0x504
+ #define MTK_WED_WPDMA_INT_TRIGGER_RX_DONE		BIT(1)
+ #define MTK_WED_WPDMA_INT_TRIGGER_TX_DONE		GENMASK(5, 4)
+--- /dev/null
++++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.h
+@@ -0,0 +1,150 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++/* Copyright (C) 2022 Lorenzo Bianconi <lorenzo@kernel.org>  */
++
++#ifndef __MTK_WED_WO_H
++#define __MTK_WED_WO_H
++
++#include <linux/skbuff.h>
++#include <linux/netdevice.h>
++
++struct mtk_wed_hw;
++
++struct mtk_wed_mcu_hdr {
++	/* DW0 */
++	u8 version;
++	u8 cmd;
++	__le16 length;
++
++	/* DW1 */
++	__le16 seq;
++	__le16 flag;
++
++	/* DW2 */
++	__le32 status;
++
++	/* DW3 */
++	u8 rsv[20];
++};
++
++struct mtk_wed_wo_log_info {
++	__le32 sn;
++	__le32 total;
++	__le32 rro;
++	__le32 mod;
++};
++
++enum mtk_wed_wo_event {
++	MTK_WED_WO_EVT_LOG_DUMP		= 0x1,
++	MTK_WED_WO_EVT_PROFILING	= 0x2,
++	MTK_WED_WO_EVT_RXCNT_INFO	= 0x3,
++};
++
++#define MTK_WED_MODULE_ID_WO		1
++#define MTK_FW_DL_TIMEOUT		4000000 /* us */
++#define MTK_WOCPU_TIMEOUT		2000000 /* us */
++
++enum {
++	MTK_WED_WARP_CMD_FLAG_RSP		= BIT(0),
++	MTK_WED_WARP_CMD_FLAG_NEED_RSP		= BIT(1),
++	MTK_WED_WARP_CMD_FLAG_FROM_TO_WO	= BIT(2),
++};
++
++enum {
++	MTK_WED_WO_REGION_EMI,
++	MTK_WED_WO_REGION_ILM,
++	MTK_WED_WO_REGION_DATA,
++	MTK_WED_WO_REGION_BOOT,
++	__MTK_WED_WO_REGION_MAX,
++};
++
++enum mtk_wed_dummy_cr_idx {
++	MTK_WED_DUMMY_CR_FWDL,
++	MTK_WED_DUMMY_CR_WO_STATUS,
++};
++
++#define MT7986_FIRMWARE_WO0	"mediatek/mt7986_wo_0.bin"
++#define MT7986_FIRMWARE_WO1	"mediatek/mt7986_wo_1.bin"
++
++#define MTK_WO_MCU_CFG_LS_BASE				0
++#define MTK_WO_MCU_CFG_LS_HW_VER_ADDR			(MTK_WO_MCU_CFG_LS_BASE + 0x000)
++#define MTK_WO_MCU_CFG_LS_FW_VER_ADDR			(MTK_WO_MCU_CFG_LS_BASE + 0x004)
++#define MTK_WO_MCU_CFG_LS_CFG_DBG1_ADDR			(MTK_WO_MCU_CFG_LS_BASE + 0x00c)
++#define MTK_WO_MCU_CFG_LS_CFG_DBG2_ADDR			(MTK_WO_MCU_CFG_LS_BASE + 0x010)
++#define MTK_WO_MCU_CFG_LS_WF_MCCR_ADDR			(MTK_WO_MCU_CFG_LS_BASE + 0x014)
++#define MTK_WO_MCU_CFG_LS_WF_MCCR_SET_ADDR		(MTK_WO_MCU_CFG_LS_BASE + 0x018)
++#define MTK_WO_MCU_CFG_LS_WF_MCCR_CLR_ADDR		(MTK_WO_MCU_CFG_LS_BASE + 0x01c)
++#define MTK_WO_MCU_CFG_LS_WF_MCU_CFG_WM_WA_ADDR		(MTK_WO_MCU_CFG_LS_BASE + 0x050)
++#define MTK_WO_MCU_CFG_LS_WM_BOOT_ADDR_ADDR		(MTK_WO_MCU_CFG_LS_BASE + 0x060)
++#define MTK_WO_MCU_CFG_LS_WA_BOOT_ADDR_ADDR		(MTK_WO_MCU_CFG_LS_BASE + 0x064)
++
++#define MTK_WO_MCU_CFG_LS_WF_WM_WA_WM_CPU_RSTB_MASK	BIT(5)
++#define MTK_WO_MCU_CFG_LS_WF_WM_WA_WA_CPU_RSTB_MASK	BIT(0)
++
++struct mtk_wed_wo_memory_region {
++	const char *name;
++	void __iomem *addr;
++	phys_addr_t phy_addr;
++	u32 size;
++	bool shared:1;
++	bool consumed:1;
++};
++
++struct mtk_wed_fw_region {
++	__le32 decomp_crc;
++	__le32 decomp_len;
++	__le32 decomp_blk_sz;
++	u8 rsv0[4];
++	__le32 addr;
++	__le32 len;
++	u8 feature_set;
++	u8 rsv1[15];
++} __packed;
++
++struct mtk_wed_fw_trailer {
++	u8 chip_id;
++	u8 eco_code;
++	u8 num_region;
++	u8 format_ver;
++	u8 format_flag;
++	u8 rsv[2];
++	char fw_ver[10];
++	char build_date[15];
++	u32 crc;
++};
++
++struct mtk_wed_wo {
++	struct mtk_wed_hw *hw;
++	struct mtk_wed_wo_memory_region boot;
++
++	struct {
++		struct mutex mutex;
++		int timeout;
++		u16 seq;
++
++		struct sk_buff_head res_q;
++		wait_queue_head_t wait;
++	} mcu;
++};
++
++static inline int
++mtk_wed_mcu_check_msg(struct mtk_wed_wo *wo, struct sk_buff *skb)
++{
++	struct mtk_wed_mcu_hdr *hdr = (struct mtk_wed_mcu_hdr *)skb->data;
++
++	if (hdr->version)
++		return -EINVAL;
++
++	if (skb->len < sizeof(*hdr) || skb->len != le16_to_cpu(hdr->length))
++		return -EINVAL;
++
++	return 0;
++}
++
++void mtk_wed_mcu_rx_event(struct mtk_wed_wo *wo, struct sk_buff *skb);
++void mtk_wed_mcu_rx_unsolicited_event(struct mtk_wed_wo *wo,
++				      struct sk_buff *skb);
++int mtk_wed_mcu_send_msg(struct mtk_wed_wo *wo, int id, int cmd,
++			 const void *data, int len, bool wait_resp);
++int mtk_wed_mcu_init(struct mtk_wed_wo *wo);
++
++#endif /* __MTK_WED_WO_H */
+--- a/include/linux/soc/mediatek/mtk_wed.h
++++ b/include/linux/soc/mediatek/mtk_wed.h
+@@ -11,6 +11,35 @@
+ struct mtk_wed_hw;
+ struct mtk_wdma_desc;
+ 
++enum mtk_wed_wo_cmd {
++	MTK_WED_WO_CMD_WED_CFG,
++	MTK_WED_WO_CMD_WED_RX_STAT,
++	MTK_WED_WO_CMD_RRO_SER,
++	MTK_WED_WO_CMD_DBG_INFO,
++	MTK_WED_WO_CMD_DEV_INFO,
++	MTK_WED_WO_CMD_BSS_INFO,
++	MTK_WED_WO_CMD_STA_REC,
++	MTK_WED_WO_CMD_DEV_INFO_DUMP,
++	MTK_WED_WO_CMD_BSS_INFO_DUMP,
++	MTK_WED_WO_CMD_STA_REC_DUMP,
++	MTK_WED_WO_CMD_BA_INFO_DUMP,
++	MTK_WED_WO_CMD_FBCMD_Q_DUMP,
++	MTK_WED_WO_CMD_FW_LOG_CTRL,
++	MTK_WED_WO_CMD_LOG_FLUSH,
++	MTK_WED_WO_CMD_CHANGE_STATE,
++	MTK_WED_WO_CMD_CPU_STATS_ENABLE,
++	MTK_WED_WO_CMD_CPU_STATS_DUMP,
++	MTK_WED_WO_CMD_EXCEPTION_INIT,
++	MTK_WED_WO_CMD_PROF_CTRL,
++	MTK_WED_WO_CMD_STA_BA_DUMP,
++	MTK_WED_WO_CMD_BA_CTRL_DUMP,
++	MTK_WED_WO_CMD_RXCNT_CTRL,
++	MTK_WED_WO_CMD_RXCNT_INFO,
++	MTK_WED_WO_CMD_SET_CAP,
++	MTK_WED_WO_CMD_CCIF_RING_DUMP,
++	MTK_WED_WO_CMD_WED_END
++};
++
+ enum mtk_wed_bus_tye {
+ 	MTK_WED_BUS_PCIE,
+ 	MTK_WED_BUS_AXI,
diff --git a/target/linux/generic/backport-6.1/729-02-v6.1-net-ethernet-mtk_wed-introduce-wed-wo-support.patch b/target/linux/generic/backport-6.1/729-02-v6.1-net-ethernet-mtk_wed-introduce-wed-wo-support.patch
new file mode 100644
index 00000000000000..fd5f45df2aaa27
--- /dev/null
+++ b/target/linux/generic/backport-6.1/729-02-v6.1-net-ethernet-mtk_wed-introduce-wed-wo-support.patch
@@ -0,0 +1,737 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 5 Nov 2022 23:36:19 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: introduce wed wo support
+
+Introduce WO chip support to mtk wed driver. MTK WED WO is used to
+implement RX Wireless Ethernet Dispatch and offload traffic received by
+wlan nic to the wired interface.
+
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ create mode 100644 drivers/net/ethernet/mediatek/mtk_wed_wo.c
+
+--- a/drivers/net/ethernet/mediatek/Makefile
++++ b/drivers/net/ethernet/mediatek/Makefile
+@@ -5,7 +5,7 @@
+ 
+ obj-$(CONFIG_NET_MEDIATEK_SOC) += mtk_eth.o
+ mtk_eth-y := mtk_eth_soc.o mtk_sgmii.o mtk_eth_path.o mtk_ppe.o mtk_ppe_debugfs.o mtk_ppe_offload.o
+-mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed.o mtk_wed_mcu.o
++mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed.o mtk_wed_mcu.o mtk_wed_wo.o
+ ifdef CONFIG_DEBUG_FS
+ mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed_debugfs.o
+ endif
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -16,6 +16,7 @@
+ #include "mtk_wed_regs.h"
+ #include "mtk_wed.h"
+ #include "mtk_ppe.h"
++#include "mtk_wed_wo.h"
+ 
+ #define MTK_PCIE_BASE(n)		(0x1a143000 + (n) * 0x2000)
+ 
+@@ -355,6 +356,8 @@ mtk_wed_detach(struct mtk_wed_device *de
+ 
+ 	mtk_wed_free_buffer(dev);
+ 	mtk_wed_free_tx_rings(dev);
++	if (hw->version != 1)
++		mtk_wed_wo_deinit(hw);
+ 
+ 	if (dev->wlan.bus_type == MTK_WED_BUS_PCIE) {
+ 		struct device_node *wlan_node;
+@@ -878,9 +881,11 @@ mtk_wed_attach(struct mtk_wed_device *de
+ 	}
+ 
+ 	mtk_wed_hw_init_early(dev);
+-	if (hw->hifsys)
++	if (hw->version == 1)
+ 		regmap_update_bits(hw->hifsys, HIFSYS_DMA_AG_MAP,
+ 				   BIT(hw->index), 0);
++	else
++		ret = mtk_wed_wo_init(hw);
+ 
+ out:
+ 	mutex_unlock(&hw_lock);
+--- a/drivers/net/ethernet/mediatek/mtk_wed.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed.h
+@@ -10,6 +10,7 @@
+ #include <linux/netdevice.h>
+ 
+ struct mtk_eth;
++struct mtk_wed_wo;
+ 
+ struct mtk_wed_hw {
+ 	struct device_node *node;
+@@ -22,6 +23,7 @@ struct mtk_wed_hw {
+ 	struct regmap *mirror;
+ 	struct dentry *debugfs_dir;
+ 	struct mtk_wed_device *wed_dev;
++	struct mtk_wed_wo *wed_wo;
+ 	u32 debugfs_reg;
+ 	u32 num_flows;
+ 	u8 version;
+--- a/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
+@@ -122,8 +122,7 @@ mtk_wed_mcu_skb_send_msg(struct mtk_wed_
+ 	if (id == MTK_WED_MODULE_ID_WO)
+ 		hdr->flag |= cpu_to_le16(MTK_WED_WARP_CMD_FLAG_FROM_TO_WO);
+ 
+-	dev_kfree_skb(skb);
+-	return 0;
++	return mtk_wed_wo_queue_tx_skb(wo, &wo->q_tx, skb);
+ }
+ 
+ static int
+--- /dev/null
++++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.c
+@@ -0,0 +1,508 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/* Copyright (C) 2022 MediaTek Inc.
++ *
++ * Author: Lorenzo Bianconi <lorenzo@kernel.org>
++ *	   Sujuan Chen <sujuan.chen@mediatek.com>
++ */
++
++#include <linux/kernel.h>
++#include <linux/dma-mapping.h>
++#include <linux/of_platform.h>
++#include <linux/interrupt.h>
++#include <linux/of_address.h>
++#include <linux/mfd/syscon.h>
++#include <linux/of_irq.h>
++#include <linux/bitfield.h>
++
++#include "mtk_wed.h"
++#include "mtk_wed_regs.h"
++#include "mtk_wed_wo.h"
++
++static u32
++mtk_wed_mmio_r32(struct mtk_wed_wo *wo, u32 reg)
++{
++	u32 val;
++
++	if (regmap_read(wo->mmio.regs, reg, &val))
++		val = ~0;
++
++	return val;
++}
++
++static void
++mtk_wed_mmio_w32(struct mtk_wed_wo *wo, u32 reg, u32 val)
++{
++	regmap_write(wo->mmio.regs, reg, val);
++}
++
++static u32
++mtk_wed_wo_get_isr(struct mtk_wed_wo *wo)
++{
++	u32 val = mtk_wed_mmio_r32(wo, MTK_WED_WO_CCIF_RCHNUM);
++
++	return val & MTK_WED_WO_CCIF_RCHNUM_MASK;
++}
++
++static void
++mtk_wed_wo_set_isr(struct mtk_wed_wo *wo, u32 mask)
++{
++	mtk_wed_mmio_w32(wo, MTK_WED_WO_CCIF_IRQ0_MASK, mask);
++}
++
++static void
++mtk_wed_wo_set_ack(struct mtk_wed_wo *wo, u32 mask)
++{
++	mtk_wed_mmio_w32(wo, MTK_WED_WO_CCIF_ACK, mask);
++}
++
++static void
++mtk_wed_wo_set_isr_mask(struct mtk_wed_wo *wo, u32 mask, u32 val, bool set)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&wo->mmio.lock, flags);
++	wo->mmio.irq_mask &= ~mask;
++	wo->mmio.irq_mask |= val;
++	if (set)
++		mtk_wed_wo_set_isr(wo, wo->mmio.irq_mask);
++	spin_unlock_irqrestore(&wo->mmio.lock, flags);
++}
++
++static void
++mtk_wed_wo_irq_enable(struct mtk_wed_wo *wo, u32 mask)
++{
++	mtk_wed_wo_set_isr_mask(wo, 0, mask, false);
++	tasklet_schedule(&wo->mmio.irq_tasklet);
++}
++
++static void
++mtk_wed_wo_irq_disable(struct mtk_wed_wo *wo, u32 mask)
++{
++	mtk_wed_wo_set_isr_mask(wo, mask, 0, true);
++}
++
++static void
++mtk_wed_wo_kickout(struct mtk_wed_wo *wo)
++{
++	mtk_wed_mmio_w32(wo, MTK_WED_WO_CCIF_BUSY, 1 << MTK_WED_WO_TXCH_NUM);
++	mtk_wed_mmio_w32(wo, MTK_WED_WO_CCIF_TCHNUM, MTK_WED_WO_TXCH_NUM);
++}
++
++static void
++mtk_wed_wo_queue_kick(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q,
++		      u32 val)
++{
++	wmb();
++	mtk_wed_mmio_w32(wo, q->regs.cpu_idx, val);
++}
++
++static void *
++mtk_wed_wo_dequeue(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q, u32 *len,
++		   bool flush)
++{
++	int buf_len = SKB_WITH_OVERHEAD(q->buf_size);
++	int index = (q->tail + 1) % q->n_desc;
++	struct mtk_wed_wo_queue_entry *entry;
++	struct mtk_wed_wo_queue_desc *desc;
++	void *buf;
++
++	if (!q->queued)
++		return NULL;
++
++	if (flush)
++		q->desc[index].ctrl |= cpu_to_le32(MTK_WED_WO_CTL_DMA_DONE);
++	else if (!(q->desc[index].ctrl & cpu_to_le32(MTK_WED_WO_CTL_DMA_DONE)))
++		return NULL;
++
++	q->tail = index;
++	q->queued--;
++
++	desc = &q->desc[index];
++	entry = &q->entry[index];
++	buf = entry->buf;
++	if (len)
++		*len = FIELD_GET(MTK_WED_WO_CTL_SD_LEN0,
++				 le32_to_cpu(READ_ONCE(desc->ctrl)));
++	if (buf)
++		dma_unmap_single(wo->hw->dev, entry->addr, buf_len,
++				 DMA_FROM_DEVICE);
++	entry->buf = NULL;
++
++	return buf;
++}
++
++static int
++mtk_wed_wo_queue_refill(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q,
++			gfp_t gfp, bool rx)
++{
++	enum dma_data_direction dir = rx ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
++	int n_buf = 0;
++
++	spin_lock_bh(&q->lock);
++	while (q->queued < q->n_desc) {
++		void *buf = page_frag_alloc(&q->cache, q->buf_size, gfp);
++		struct mtk_wed_wo_queue_entry *entry;
++		dma_addr_t addr;
++
++		if (!buf)
++			break;
++
++		addr = dma_map_single(wo->hw->dev, buf, q->buf_size, dir);
++		if (unlikely(dma_mapping_error(wo->hw->dev, addr))) {
++			skb_free_frag(buf);
++			break;
++		}
++
++		q->head = (q->head + 1) % q->n_desc;
++		entry = &q->entry[q->head];
++		entry->addr = addr;
++		entry->len = q->buf_size;
++		q->entry[q->head].buf = buf;
++
++		if (rx) {
++			struct mtk_wed_wo_queue_desc *desc = &q->desc[q->head];
++			u32 ctrl = MTK_WED_WO_CTL_LAST_SEC0 |
++				   FIELD_PREP(MTK_WED_WO_CTL_SD_LEN0,
++					      entry->len);
++
++			WRITE_ONCE(desc->buf0, cpu_to_le32(addr));
++			WRITE_ONCE(desc->ctrl, cpu_to_le32(ctrl));
++		}
++		q->queued++;
++		n_buf++;
++	}
++	spin_unlock_bh(&q->lock);
++
++	return n_buf;
++}
++
++static void
++mtk_wed_wo_rx_complete(struct mtk_wed_wo *wo)
++{
++	mtk_wed_wo_set_ack(wo, MTK_WED_WO_RXCH_INT_MASK);
++	mtk_wed_wo_irq_enable(wo, MTK_WED_WO_RXCH_INT_MASK);
++}
++
++static void
++mtk_wed_wo_rx_run_queue(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q)
++{
++	for (;;) {
++		struct mtk_wed_mcu_hdr *hdr;
++		struct sk_buff *skb;
++		void *data;
++		u32 len;
++
++		data = mtk_wed_wo_dequeue(wo, q, &len, false);
++		if (!data)
++			break;
++
++		skb = build_skb(data, q->buf_size);
++		if (!skb) {
++			skb_free_frag(data);
++			continue;
++		}
++
++		__skb_put(skb, len);
++		if (mtk_wed_mcu_check_msg(wo, skb)) {
++			dev_kfree_skb(skb);
++			continue;
++		}
++
++		hdr = (struct mtk_wed_mcu_hdr *)skb->data;
++		if (hdr->flag & cpu_to_le16(MTK_WED_WARP_CMD_FLAG_RSP))
++			mtk_wed_mcu_rx_event(wo, skb);
++		else
++			mtk_wed_mcu_rx_unsolicited_event(wo, skb);
++	}
++
++	if (mtk_wed_wo_queue_refill(wo, q, GFP_ATOMIC, true)) {
++		u32 index = (q->head - 1) % q->n_desc;
++
++		mtk_wed_wo_queue_kick(wo, q, index);
++	}
++}
++
++static irqreturn_t
++mtk_wed_wo_irq_handler(int irq, void *data)
++{
++	struct mtk_wed_wo *wo = data;
++
++	mtk_wed_wo_set_isr(wo, 0);
++	tasklet_schedule(&wo->mmio.irq_tasklet);
++
++	return IRQ_HANDLED;
++}
++
++static void mtk_wed_wo_irq_tasklet(struct tasklet_struct *t)
++{
++	struct mtk_wed_wo *wo = from_tasklet(wo, t, mmio.irq_tasklet);
++	u32 intr, mask;
++
++	/* disable interrupts */
++	mtk_wed_wo_set_isr(wo, 0);
++
++	intr = mtk_wed_wo_get_isr(wo);
++	intr &= wo->mmio.irq_mask;
++	mask = intr & (MTK_WED_WO_RXCH_INT_MASK | MTK_WED_WO_EXCEPTION_INT_MASK);
++	mtk_wed_wo_irq_disable(wo, mask);
++
++	if (intr & MTK_WED_WO_RXCH_INT_MASK) {
++		mtk_wed_wo_rx_run_queue(wo, &wo->q_rx);
++		mtk_wed_wo_rx_complete(wo);
++	}
++}
++
++/* mtk wed wo hw queues */
++
++static int
++mtk_wed_wo_queue_alloc(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q,
++		       int n_desc, int buf_size, int index,
++		       struct mtk_wed_wo_queue_regs *regs)
++{
++	spin_lock_init(&q->lock);
++	q->regs = *regs;
++	q->n_desc = n_desc;
++	q->buf_size = buf_size;
++
++	q->desc = dmam_alloc_coherent(wo->hw->dev, n_desc * sizeof(*q->desc),
++				      &q->desc_dma, GFP_KERNEL);
++	if (!q->desc)
++		return -ENOMEM;
++
++	q->entry = devm_kzalloc(wo->hw->dev, n_desc * sizeof(*q->entry),
++				GFP_KERNEL);
++	if (!q->entry)
++		return -ENOMEM;
++
++	return 0;
++}
++
++static void
++mtk_wed_wo_queue_free(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q)
++{
++	mtk_wed_mmio_w32(wo, q->regs.cpu_idx, 0);
++	dma_free_coherent(wo->hw->dev, q->n_desc * sizeof(*q->desc), q->desc,
++			  q->desc_dma);
++}
++
++static void
++mtk_wed_wo_queue_tx_clean(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q)
++{
++	struct page *page;
++	int i;
++
++	spin_lock_bh(&q->lock);
++	for (i = 0; i < q->n_desc; i++) {
++		struct mtk_wed_wo_queue_entry *entry = &q->entry[i];
++
++		dma_unmap_single(wo->hw->dev, entry->addr, entry->len,
++				 DMA_TO_DEVICE);
++		skb_free_frag(entry->buf);
++		entry->buf = NULL;
++	}
++	spin_unlock_bh(&q->lock);
++
++	if (!q->cache.va)
++		return;
++
++	page = virt_to_page(q->cache.va);
++	__page_frag_cache_drain(page, q->cache.pagecnt_bias);
++	memset(&q->cache, 0, sizeof(q->cache));
++}
++
++static void
++mtk_wed_wo_queue_rx_clean(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q)
++{
++	struct page *page;
++
++	spin_lock_bh(&q->lock);
++	for (;;) {
++		void *buf = mtk_wed_wo_dequeue(wo, q, NULL, true);
++
++		if (!buf)
++			break;
++
++		skb_free_frag(buf);
++	}
++	spin_unlock_bh(&q->lock);
++
++	if (!q->cache.va)
++		return;
++
++	page = virt_to_page(q->cache.va);
++	__page_frag_cache_drain(page, q->cache.pagecnt_bias);
++	memset(&q->cache, 0, sizeof(q->cache));
++}
++
++static void
++mtk_wed_wo_queue_reset(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q)
++{
++	mtk_wed_mmio_w32(wo, q->regs.cpu_idx, 0);
++	mtk_wed_mmio_w32(wo, q->regs.desc_base, q->desc_dma);
++	mtk_wed_mmio_w32(wo, q->regs.ring_size, q->n_desc);
++}
++
++int mtk_wed_wo_queue_tx_skb(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q,
++			    struct sk_buff *skb)
++{
++	struct mtk_wed_wo_queue_entry *entry;
++	struct mtk_wed_wo_queue_desc *desc;
++	int ret = 0, index;
++	u32 ctrl;
++
++	spin_lock_bh(&q->lock);
++
++	q->tail = mtk_wed_mmio_r32(wo, q->regs.dma_idx);
++	index = (q->head + 1) % q->n_desc;
++	if (q->tail == index) {
++		ret = -ENOMEM;
++		goto out;
++	}
++
++	entry = &q->entry[index];
++	if (skb->len > entry->len) {
++		ret = -ENOMEM;
++		goto out;
++	}
++
++	desc = &q->desc[index];
++	q->head = index;
++
++	dma_sync_single_for_cpu(wo->hw->dev, entry->addr, skb->len,
++				DMA_TO_DEVICE);
++	memcpy(entry->buf, skb->data, skb->len);
++	dma_sync_single_for_device(wo->hw->dev, entry->addr, skb->len,
++				   DMA_TO_DEVICE);
++
++	ctrl = FIELD_PREP(MTK_WED_WO_CTL_SD_LEN0, skb->len) |
++	       MTK_WED_WO_CTL_LAST_SEC0 | MTK_WED_WO_CTL_DMA_DONE;
++	WRITE_ONCE(desc->buf0, cpu_to_le32(entry->addr));
++	WRITE_ONCE(desc->ctrl, cpu_to_le32(ctrl));
++
++	mtk_wed_wo_queue_kick(wo, q, q->head);
++	mtk_wed_wo_kickout(wo);
++out:
++	spin_unlock_bh(&q->lock);
++
++	dev_kfree_skb(skb);
++
++	return ret;
++}
++
++static int
++mtk_wed_wo_exception_init(struct mtk_wed_wo *wo)
++{
++	return 0;
++}
++
++static int
++mtk_wed_wo_hardware_init(struct mtk_wed_wo *wo)
++{
++	struct mtk_wed_wo_queue_regs regs;
++	struct device_node *np;
++	int ret;
++
++	np = of_parse_phandle(wo->hw->node, "mediatek,wo-ccif", 0);
++	if (!np)
++		return -ENODEV;
++
++	wo->mmio.regs = syscon_regmap_lookup_by_phandle(np, NULL);
++	if (IS_ERR_OR_NULL(wo->mmio.regs))
++		return PTR_ERR(wo->mmio.regs);
++
++	wo->mmio.irq = irq_of_parse_and_map(np, 0);
++	wo->mmio.irq_mask = MTK_WED_WO_ALL_INT_MASK;
++	spin_lock_init(&wo->mmio.lock);
++	tasklet_setup(&wo->mmio.irq_tasklet, mtk_wed_wo_irq_tasklet);
++
++	ret = devm_request_irq(wo->hw->dev, wo->mmio.irq,
++			       mtk_wed_wo_irq_handler, IRQF_TRIGGER_HIGH,
++			       KBUILD_MODNAME, wo);
++	if (ret)
++		goto error;
++
++	regs.desc_base = MTK_WED_WO_CCIF_DUMMY1;
++	regs.ring_size = MTK_WED_WO_CCIF_DUMMY2;
++	regs.dma_idx = MTK_WED_WO_CCIF_SHADOW4;
++	regs.cpu_idx = MTK_WED_WO_CCIF_DUMMY3;
++
++	ret = mtk_wed_wo_queue_alloc(wo, &wo->q_tx, MTK_WED_WO_RING_SIZE,
++				     MTK_WED_WO_CMD_LEN, MTK_WED_WO_TXCH_NUM,
++				     &regs);
++	if (ret)
++		goto error;
++
++	mtk_wed_wo_queue_refill(wo, &wo->q_tx, GFP_KERNEL, false);
++	mtk_wed_wo_queue_reset(wo, &wo->q_tx);
++
++	regs.desc_base = MTK_WED_WO_CCIF_DUMMY5;
++	regs.ring_size = MTK_WED_WO_CCIF_DUMMY6;
++	regs.dma_idx = MTK_WED_WO_CCIF_SHADOW8;
++	regs.cpu_idx = MTK_WED_WO_CCIF_DUMMY7;
++
++	ret = mtk_wed_wo_queue_alloc(wo, &wo->q_rx, MTK_WED_WO_RING_SIZE,
++				     MTK_WED_WO_CMD_LEN, MTK_WED_WO_RXCH_NUM,
++				     &regs);
++	if (ret)
++		goto error;
++
++	mtk_wed_wo_queue_refill(wo, &wo->q_rx, GFP_KERNEL, true);
++	mtk_wed_wo_queue_reset(wo, &wo->q_rx);
++
++	/* rx queue irqmask */
++	mtk_wed_wo_set_isr(wo, wo->mmio.irq_mask);
++
++	return 0;
++
++error:
++	devm_free_irq(wo->hw->dev, wo->mmio.irq, wo);
++
++	return ret;
++}
++
++static void
++mtk_wed_wo_hw_deinit(struct mtk_wed_wo *wo)
++{
++	/* disable interrupts */
++	mtk_wed_wo_set_isr(wo, 0);
++
++	tasklet_disable(&wo->mmio.irq_tasklet);
++
++	disable_irq(wo->mmio.irq);
++	devm_free_irq(wo->hw->dev, wo->mmio.irq, wo);
++
++	mtk_wed_wo_queue_tx_clean(wo, &wo->q_tx);
++	mtk_wed_wo_queue_rx_clean(wo, &wo->q_rx);
++	mtk_wed_wo_queue_free(wo, &wo->q_tx);
++	mtk_wed_wo_queue_free(wo, &wo->q_rx);
++}
++
++int mtk_wed_wo_init(struct mtk_wed_hw *hw)
++{
++	struct mtk_wed_wo *wo;
++	int ret;
++
++	wo = devm_kzalloc(hw->dev, sizeof(*wo), GFP_KERNEL);
++	if (!wo)
++		return -ENOMEM;
++
++	hw->wed_wo = wo;
++	wo->hw = hw;
++
++	ret = mtk_wed_wo_hardware_init(wo);
++	if (ret)
++		return ret;
++
++	ret = mtk_wed_mcu_init(wo);
++	if (ret)
++		return ret;
++
++	return mtk_wed_wo_exception_init(wo);
++}
++
++void mtk_wed_wo_deinit(struct mtk_wed_hw *hw)
++{
++	struct mtk_wed_wo *wo = hw->wed_wo;
++
++	mtk_wed_wo_hw_deinit(wo);
++}
+--- a/drivers/net/ethernet/mediatek/mtk_wed_wo.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.h
+@@ -80,6 +80,54 @@ enum mtk_wed_dummy_cr_idx {
+ #define MTK_WO_MCU_CFG_LS_WF_WM_WA_WM_CPU_RSTB_MASK	BIT(5)
+ #define MTK_WO_MCU_CFG_LS_WF_WM_WA_WA_CPU_RSTB_MASK	BIT(0)
+ 
++#define MTK_WED_WO_RING_SIZE	256
++#define MTK_WED_WO_CMD_LEN	1504
++
++#define MTK_WED_WO_TXCH_NUM		0
++#define MTK_WED_WO_RXCH_NUM		1
++#define MTK_WED_WO_RXCH_WO_EXCEPTION	7
++
++#define MTK_WED_WO_TXCH_INT_MASK	BIT(0)
++#define MTK_WED_WO_RXCH_INT_MASK	BIT(1)
++#define MTK_WED_WO_EXCEPTION_INT_MASK	BIT(7)
++#define MTK_WED_WO_ALL_INT_MASK		(MTK_WED_WO_RXCH_INT_MASK | \
++					 MTK_WED_WO_EXCEPTION_INT_MASK)
++
++#define MTK_WED_WO_CCIF_BUSY		0x004
++#define MTK_WED_WO_CCIF_START		0x008
++#define MTK_WED_WO_CCIF_TCHNUM		0x00c
++#define MTK_WED_WO_CCIF_RCHNUM		0x010
++#define MTK_WED_WO_CCIF_RCHNUM_MASK	GENMASK(7, 0)
++
++#define MTK_WED_WO_CCIF_ACK		0x014
++#define MTK_WED_WO_CCIF_IRQ0_MASK	0x018
++#define MTK_WED_WO_CCIF_IRQ1_MASK	0x01c
++#define MTK_WED_WO_CCIF_DUMMY1		0x020
++#define MTK_WED_WO_CCIF_DUMMY2		0x024
++#define MTK_WED_WO_CCIF_DUMMY3		0x028
++#define MTK_WED_WO_CCIF_DUMMY4		0x02c
++#define MTK_WED_WO_CCIF_SHADOW1		0x030
++#define MTK_WED_WO_CCIF_SHADOW2		0x034
++#define MTK_WED_WO_CCIF_SHADOW3		0x038
++#define MTK_WED_WO_CCIF_SHADOW4		0x03c
++#define MTK_WED_WO_CCIF_DUMMY5		0x050
++#define MTK_WED_WO_CCIF_DUMMY6		0x054
++#define MTK_WED_WO_CCIF_DUMMY7		0x058
++#define MTK_WED_WO_CCIF_DUMMY8		0x05c
++#define MTK_WED_WO_CCIF_SHADOW5		0x060
++#define MTK_WED_WO_CCIF_SHADOW6		0x064
++#define MTK_WED_WO_CCIF_SHADOW7		0x068
++#define MTK_WED_WO_CCIF_SHADOW8		0x06c
++
++#define MTK_WED_WO_CTL_SD_LEN1		GENMASK(13, 0)
++#define MTK_WED_WO_CTL_LAST_SEC1	BIT(14)
++#define MTK_WED_WO_CTL_BURST		BIT(15)
++#define MTK_WED_WO_CTL_SD_LEN0_SHIFT	16
++#define MTK_WED_WO_CTL_SD_LEN0		GENMASK(29, 16)
++#define MTK_WED_WO_CTL_LAST_SEC0	BIT(30)
++#define MTK_WED_WO_CTL_DMA_DONE		BIT(31)
++#define MTK_WED_WO_INFO_WINFO		GENMASK(15, 0)
++
+ struct mtk_wed_wo_memory_region {
+ 	const char *name;
+ 	void __iomem *addr;
+@@ -112,10 +160,53 @@ struct mtk_wed_fw_trailer {
+ 	u32 crc;
+ };
+ 
++struct mtk_wed_wo_queue_regs {
++	u32 desc_base;
++	u32 ring_size;
++	u32 cpu_idx;
++	u32 dma_idx;
++};
++
++struct mtk_wed_wo_queue_desc {
++	__le32 buf0;
++	__le32 ctrl;
++	__le32 buf1;
++	__le32 info;
++	__le32 reserved[4];
++} __packed __aligned(32);
++
++struct mtk_wed_wo_queue_entry {
++	dma_addr_t addr;
++	void *buf;
++	u32 len;
++};
++
++struct mtk_wed_wo_queue {
++	struct mtk_wed_wo_queue_regs regs;
++
++	struct page_frag_cache cache;
++	spinlock_t lock;
++
++	struct mtk_wed_wo_queue_desc *desc;
++	dma_addr_t desc_dma;
++
++	struct mtk_wed_wo_queue_entry *entry;
++
++	u16 head;
++	u16 tail;
++	int n_desc;
++	int queued;
++	int buf_size;
++
++};
++
+ struct mtk_wed_wo {
+ 	struct mtk_wed_hw *hw;
+ 	struct mtk_wed_wo_memory_region boot;
+ 
++	struct mtk_wed_wo_queue q_tx;
++	struct mtk_wed_wo_queue q_rx;
++
+ 	struct {
+ 		struct mutex mutex;
+ 		int timeout;
+@@ -124,6 +215,15 @@ struct mtk_wed_wo {
+ 		struct sk_buff_head res_q;
+ 		wait_queue_head_t wait;
+ 	} mcu;
++
++	struct {
++		struct regmap *regs;
++
++		spinlock_t lock;
++		struct tasklet_struct irq_tasklet;
++		int irq;
++		u32 irq_mask;
++	} mmio;
+ };
+ 
+ static inline int
+@@ -146,5 +246,9 @@ void mtk_wed_mcu_rx_unsolicited_event(st
+ int mtk_wed_mcu_send_msg(struct mtk_wed_wo *wo, int id, int cmd,
+ 			 const void *data, int len, bool wait_resp);
+ int mtk_wed_mcu_init(struct mtk_wed_wo *wo);
++int mtk_wed_wo_init(struct mtk_wed_hw *hw);
++void mtk_wed_wo_deinit(struct mtk_wed_hw *hw);
++int mtk_wed_wo_queue_tx_skb(struct mtk_wed_wo *dev, struct mtk_wed_wo_queue *q,
++			    struct sk_buff *skb);
+ 
+ #endif /* __MTK_WED_WO_H */
diff --git a/target/linux/generic/backport-6.1/729-03-v6.1-net-ethernet-mtk_wed-rename-tx_wdma-array-in-rx_wdma.patch b/target/linux/generic/backport-6.1/729-03-v6.1-net-ethernet-mtk_wed-rename-tx_wdma-array-in-rx_wdma.patch
new file mode 100644
index 00000000000000..a002a5f85163d4
--- /dev/null
+++ b/target/linux/generic/backport-6.1/729-03-v6.1-net-ethernet-mtk_wed-rename-tx_wdma-array-in-rx_wdma.patch
@@ -0,0 +1,79 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 5 Nov 2022 23:36:20 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: rename tx_wdma array in rx_wdma
+
+Rename tx_wdma queue array in rx_wdma since this is rx side of wdma soc.
+Moreover rename mtk_wed_wdma_ring_setup routine in
+mtk_wed_wdma_rx_ring_setup()
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -253,8 +253,8 @@ mtk_wed_free_tx_rings(struct mtk_wed_dev
+ 
+ 	for (i = 0; i < ARRAY_SIZE(dev->tx_ring); i++)
+ 		mtk_wed_free_ring(dev, &dev->tx_ring[i]);
+-	for (i = 0; i < ARRAY_SIZE(dev->tx_wdma); i++)
+-		mtk_wed_free_ring(dev, &dev->tx_wdma[i]);
++	for (i = 0; i < ARRAY_SIZE(dev->rx_wdma); i++)
++		mtk_wed_free_ring(dev, &dev->rx_wdma[i]);
+ }
+ 
+ static void
+@@ -688,10 +688,10 @@ mtk_wed_ring_alloc(struct mtk_wed_device
+ }
+ 
+ static int
+-mtk_wed_wdma_ring_setup(struct mtk_wed_device *dev, int idx, int size)
++mtk_wed_wdma_rx_ring_setup(struct mtk_wed_device *dev, int idx, int size)
+ {
+ 	u32 desc_size = sizeof(struct mtk_wdma_desc) * dev->hw->version;
+-	struct mtk_wed_ring *wdma = &dev->tx_wdma[idx];
++	struct mtk_wed_ring *wdma = &dev->rx_wdma[idx];
+ 
+ 	if (mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE, desc_size))
+ 		return -ENOMEM;
+@@ -805,9 +805,9 @@ mtk_wed_start(struct mtk_wed_device *dev
+ {
+ 	int i;
+ 
+-	for (i = 0; i < ARRAY_SIZE(dev->tx_wdma); i++)
+-		if (!dev->tx_wdma[i].desc)
+-			mtk_wed_wdma_ring_setup(dev, i, 16);
++	for (i = 0; i < ARRAY_SIZE(dev->rx_wdma); i++)
++		if (!dev->rx_wdma[i].desc)
++			mtk_wed_wdma_rx_ring_setup(dev, i, 16);
+ 
+ 	mtk_wed_hw_init(dev);
+ 	mtk_wed_configure_irq(dev, irq_mask);
+@@ -916,7 +916,7 @@ mtk_wed_tx_ring_setup(struct mtk_wed_dev
+ 			       sizeof(*ring->desc)))
+ 		return -ENOMEM;
+ 
+-	if (mtk_wed_wdma_ring_setup(dev, idx, MTK_WED_WDMA_RING_SIZE))
++	if (mtk_wed_wdma_rx_ring_setup(dev, idx, MTK_WED_WDMA_RING_SIZE))
+ 		return -ENOMEM;
+ 
+ 	ring->reg_base = MTK_WED_RING_TX(idx);
+--- a/include/linux/soc/mediatek/mtk_wed.h
++++ b/include/linux/soc/mediatek/mtk_wed.h
+@@ -7,6 +7,7 @@
+ #include <linux/pci.h>
+ 
+ #define MTK_WED_TX_QUEUES		2
++#define MTK_WED_RX_QUEUES		2
+ 
+ struct mtk_wed_hw;
+ struct mtk_wdma_desc;
+@@ -66,7 +67,7 @@ struct mtk_wed_device {
+ 
+ 	struct mtk_wed_ring tx_ring[MTK_WED_TX_QUEUES];
+ 	struct mtk_wed_ring txfree_ring;
+-	struct mtk_wed_ring tx_wdma[MTK_WED_TX_QUEUES];
++	struct mtk_wed_ring rx_wdma[MTK_WED_RX_QUEUES];
+ 
+ 	struct {
+ 		int size;
diff --git a/target/linux/generic/backport-6.1/729-04-v6.1-net-ethernet-mtk_wed-add-configure-wed-wo-support.patch b/target/linux/generic/backport-6.1/729-04-v6.1-net-ethernet-mtk_wed-add-configure-wed-wo-support.patch
new file mode 100644
index 00000000000000..eca29739b4ae38
--- /dev/null
+++ b/target/linux/generic/backport-6.1/729-04-v6.1-net-ethernet-mtk_wed-add-configure-wed-wo-support.patch
@@ -0,0 +1,1521 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 5 Nov 2022 23:36:21 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: add configure wed wo support
+
+Enable RX Wireless Ethernet Dispatch available on MT7986 Soc.
+
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -9,6 +9,7 @@
+ #include <linux/skbuff.h>
+ #include <linux/of_platform.h>
+ #include <linux/of_address.h>
++#include <linux/of_reserved_mem.h>
+ #include <linux/mfd/syscon.h>
+ #include <linux/debugfs.h>
+ #include <linux/soc/mediatek/mtk_wed.h>
+@@ -23,6 +24,7 @@
+ #define MTK_WED_PKT_SIZE		1900
+ #define MTK_WED_BUF_SIZE		2048
+ #define MTK_WED_BUF_PER_PAGE		(PAGE_SIZE / 2048)
++#define MTK_WED_RX_RING_SIZE		1536
+ 
+ #define MTK_WED_TX_RING_SIZE		2048
+ #define MTK_WED_WDMA_RING_SIZE		1024
+@@ -31,6 +33,10 @@
+ #define MTK_WED_PER_GROUP_PKT		128
+ 
+ #define MTK_WED_FBUF_SIZE		128
++#define MTK_WED_MIOD_CNT		16
++#define MTK_WED_FB_CMD_CNT		1024
++#define MTK_WED_RRO_QUE_CNT		8192
++#define MTK_WED_MIOD_ENTRY_CNT		128
+ 
+ static struct mtk_wed_hw *hw_list[2];
+ static DEFINE_MUTEX(hw_lock);
+@@ -65,12 +71,76 @@ wdma_set(struct mtk_wed_device *dev, u32
+ 	wdma_m32(dev, reg, 0, mask);
+ }
+ 
++static void
++wdma_clr(struct mtk_wed_device *dev, u32 reg, u32 mask)
++{
++	wdma_m32(dev, reg, mask, 0);
++}
++
++static u32
++wifi_r32(struct mtk_wed_device *dev, u32 reg)
++{
++	return readl(dev->wlan.base + reg);
++}
++
++static void
++wifi_w32(struct mtk_wed_device *dev, u32 reg, u32 val)
++{
++	writel(val, dev->wlan.base + reg);
++}
++
+ static u32
+ mtk_wed_read_reset(struct mtk_wed_device *dev)
+ {
+ 	return wed_r32(dev, MTK_WED_RESET);
+ }
+ 
++static u32
++mtk_wdma_read_reset(struct mtk_wed_device *dev)
++{
++	return wdma_r32(dev, MTK_WDMA_GLO_CFG);
++}
++
++static void
++mtk_wdma_rx_reset(struct mtk_wed_device *dev)
++{
++	u32 status, mask = MTK_WDMA_GLO_CFG_RX_DMA_BUSY;
++	int i;
++
++	wdma_clr(dev, MTK_WDMA_GLO_CFG, MTK_WDMA_GLO_CFG_RX_DMA_EN);
++	if (readx_poll_timeout(mtk_wdma_read_reset, dev, status,
++			       !(status & mask), 0, 1000))
++		dev_err(dev->hw->dev, "rx reset failed\n");
++
++	for (i = 0; i < ARRAY_SIZE(dev->rx_wdma); i++) {
++		if (dev->rx_wdma[i].desc)
++			continue;
++
++		wdma_w32(dev,
++			 MTK_WDMA_RING_RX(i) + MTK_WED_RING_OFS_CPU_IDX, 0);
++	}
++}
++
++static void
++mtk_wdma_tx_reset(struct mtk_wed_device *dev)
++{
++	u32 status, mask = MTK_WDMA_GLO_CFG_TX_DMA_BUSY;
++	int i;
++
++	wdma_clr(dev, MTK_WDMA_GLO_CFG, MTK_WDMA_GLO_CFG_TX_DMA_EN);
++	if (readx_poll_timeout(mtk_wdma_read_reset, dev, status,
++			       !(status & mask), 0, 1000))
++		dev_err(dev->hw->dev, "tx reset failed\n");
++
++	for (i = 0; i < ARRAY_SIZE(dev->tx_wdma); i++) {
++		if (dev->tx_wdma[i].desc)
++			continue;
++
++		wdma_w32(dev,
++			 MTK_WDMA_RING_TX(i) + MTK_WED_RING_OFS_CPU_IDX, 0);
++	}
++}
++
+ static void
+ mtk_wed_reset(struct mtk_wed_device *dev, u32 mask)
+ {
+@@ -82,6 +152,54 @@ mtk_wed_reset(struct mtk_wed_device *dev
+ 		WARN_ON_ONCE(1);
+ }
+ 
++static u32
++mtk_wed_wo_read_status(struct mtk_wed_device *dev)
++{
++	return wed_r32(dev, MTK_WED_SCR0 + 4 * MTK_WED_DUMMY_CR_WO_STATUS);
++}
++
++static void
++mtk_wed_wo_reset(struct mtk_wed_device *dev)
++{
++	struct mtk_wed_wo *wo = dev->hw->wed_wo;
++	u8 state = MTK_WED_WO_STATE_DISABLE;
++	void __iomem *reg;
++	u32 val;
++
++	mtk_wdma_tx_reset(dev);
++	mtk_wed_reset(dev, MTK_WED_RESET_WED);
++
++	mtk_wed_mcu_send_msg(wo, MTK_WED_MODULE_ID_WO,
++			     MTK_WED_WO_CMD_CHANGE_STATE, &state,
++			     sizeof(state), false);
++
++	if (readx_poll_timeout(mtk_wed_wo_read_status, dev, val,
++			       val == MTK_WED_WOIF_DISABLE_DONE,
++			       100, MTK_WOCPU_TIMEOUT))
++		dev_err(dev->hw->dev, "failed to disable wed-wo\n");
++
++	reg = ioremap(MTK_WED_WO_CPU_MCUSYS_RESET_ADDR, 4);
++
++	val = readl(reg);
++	switch (dev->hw->index) {
++	case 0:
++		val |= MTK_WED_WO_CPU_WO0_MCUSYS_RESET_MASK;
++		writel(val, reg);
++		val &= ~MTK_WED_WO_CPU_WO0_MCUSYS_RESET_MASK;
++		writel(val, reg);
++		break;
++	case 1:
++		val |= MTK_WED_WO_CPU_WO1_MCUSYS_RESET_MASK;
++		writel(val, reg);
++		val &= ~MTK_WED_WO_CPU_WO1_MCUSYS_RESET_MASK;
++		writel(val, reg);
++		break;
++	default:
++		break;
++	}
++	iounmap(reg);
++}
++
+ static struct mtk_wed_hw *
+ mtk_wed_assign(struct mtk_wed_device *dev)
+ {
+@@ -116,7 +234,7 @@ out:
+ }
+ 
+ static int
+-mtk_wed_buffer_alloc(struct mtk_wed_device *dev)
++mtk_wed_tx_buffer_alloc(struct mtk_wed_device *dev)
+ {
+ 	struct mtk_wdma_desc *desc;
+ 	dma_addr_t desc_phys;
+@@ -133,16 +251,16 @@ mtk_wed_buffer_alloc(struct mtk_wed_devi
+ 	if (!page_list)
+ 		return -ENOMEM;
+ 
+-	dev->buf_ring.size = ring_size;
+-	dev->buf_ring.pages = page_list;
++	dev->tx_buf_ring.size = ring_size;
++	dev->tx_buf_ring.pages = page_list;
+ 
+ 	desc = dma_alloc_coherent(dev->hw->dev, ring_size * sizeof(*desc),
+ 				  &desc_phys, GFP_KERNEL);
+ 	if (!desc)
+ 		return -ENOMEM;
+ 
+-	dev->buf_ring.desc = desc;
+-	dev->buf_ring.desc_phys = desc_phys;
++	dev->tx_buf_ring.desc = desc;
++	dev->tx_buf_ring.desc_phys = desc_phys;
+ 
+ 	for (i = 0, page_idx = 0; i < ring_size; i += MTK_WED_BUF_PER_PAGE) {
+ 		dma_addr_t page_phys, buf_phys;
+@@ -203,10 +321,10 @@ mtk_wed_buffer_alloc(struct mtk_wed_devi
+ }
+ 
+ static void
+-mtk_wed_free_buffer(struct mtk_wed_device *dev)
++mtk_wed_free_tx_buffer(struct mtk_wed_device *dev)
+ {
+-	struct mtk_wdma_desc *desc = dev->buf_ring.desc;
+-	void **page_list = dev->buf_ring.pages;
++	struct mtk_wdma_desc *desc = dev->tx_buf_ring.desc;
++	void **page_list = dev->tx_buf_ring.pages;
+ 	int page_idx;
+ 	int i;
+ 
+@@ -216,7 +334,8 @@ mtk_wed_free_buffer(struct mtk_wed_devic
+ 	if (!desc)
+ 		goto free_pagelist;
+ 
+-	for (i = 0, page_idx = 0; i < dev->buf_ring.size; i += MTK_WED_BUF_PER_PAGE) {
++	for (i = 0, page_idx = 0; i < dev->tx_buf_ring.size;
++	     i += MTK_WED_BUF_PER_PAGE) {
+ 		void *page = page_list[page_idx++];
+ 		dma_addr_t buf_addr;
+ 
+@@ -229,13 +348,59 @@ mtk_wed_free_buffer(struct mtk_wed_devic
+ 		__free_page(page);
+ 	}
+ 
+-	dma_free_coherent(dev->hw->dev, dev->buf_ring.size * sizeof(*desc),
+-			  desc, dev->buf_ring.desc_phys);
++	dma_free_coherent(dev->hw->dev, dev->tx_buf_ring.size * sizeof(*desc),
++			  desc, dev->tx_buf_ring.desc_phys);
+ 
+ free_pagelist:
+ 	kfree(page_list);
+ }
+ 
++static int
++mtk_wed_rx_buffer_alloc(struct mtk_wed_device *dev)
++{
++	struct mtk_rxbm_desc *desc;
++	dma_addr_t desc_phys;
++
++	dev->rx_buf_ring.size = dev->wlan.rx_nbuf;
++	desc = dma_alloc_coherent(dev->hw->dev,
++				  dev->wlan.rx_nbuf * sizeof(*desc),
++				  &desc_phys, GFP_KERNEL);
++	if (!desc)
++		return -ENOMEM;
++
++	dev->rx_buf_ring.desc = desc;
++	dev->rx_buf_ring.desc_phys = desc_phys;
++	dev->wlan.init_rx_buf(dev, dev->wlan.rx_npkt);
++
++	return 0;
++}
++
++static void
++mtk_wed_free_rx_buffer(struct mtk_wed_device *dev)
++{
++	struct mtk_rxbm_desc *desc = dev->rx_buf_ring.desc;
++
++	if (!desc)
++		return;
++
++	dev->wlan.release_rx_buf(dev);
++	dma_free_coherent(dev->hw->dev, dev->rx_buf_ring.size * sizeof(*desc),
++			  desc, dev->rx_buf_ring.desc_phys);
++}
++
++static void
++mtk_wed_rx_buffer_hw_init(struct mtk_wed_device *dev)
++{
++	wed_w32(dev, MTK_WED_RX_BM_RX_DMAD,
++		FIELD_PREP(MTK_WED_RX_BM_RX_DMAD_SDL0, dev->wlan.rx_size));
++	wed_w32(dev, MTK_WED_RX_BM_BASE, dev->rx_buf_ring.desc_phys);
++	wed_w32(dev, MTK_WED_RX_BM_INIT_PTR, MTK_WED_RX_BM_INIT_SW_TAIL |
++		FIELD_PREP(MTK_WED_RX_BM_SW_TAIL, dev->wlan.rx_npkt));
++	wed_w32(dev, MTK_WED_RX_BM_DYN_ALLOC_TH,
++		FIELD_PREP(MTK_WED_RX_BM_DYN_ALLOC_TH_H, 0xffff));
++	wed_set(dev, MTK_WED_CTRL, MTK_WED_CTRL_WED_RX_BM_EN);
++}
++
+ static void
+ mtk_wed_free_ring(struct mtk_wed_device *dev, struct mtk_wed_ring *ring)
+ {
+@@ -247,6 +412,13 @@ mtk_wed_free_ring(struct mtk_wed_device
+ }
+ 
+ static void
++mtk_wed_free_rx_rings(struct mtk_wed_device *dev)
++{
++	mtk_wed_free_rx_buffer(dev);
++	mtk_wed_free_ring(dev, &dev->rro.ring);
++}
++
++static void
+ mtk_wed_free_tx_rings(struct mtk_wed_device *dev)
+ {
+ 	int i;
+@@ -291,6 +463,38 @@ mtk_wed_set_512_support(struct mtk_wed_d
+ 	}
+ }
+ 
++#define MTK_WFMDA_RX_DMA_EN	BIT(2)
++static void
++mtk_wed_check_wfdma_rx_fill(struct mtk_wed_device *dev, int idx)
++{
++	u32 val;
++	int i;
++
++	if (!(dev->rx_ring[idx].flags & MTK_WED_RING_CONFIGURED))
++		return; /* queue is not configured by mt76 */
++
++	for (i = 0; i < 3; i++) {
++		u32 cur_idx;
++
++		cur_idx = wed_r32(dev,
++				  MTK_WED_WPDMA_RING_RX_DATA(idx) +
++				  MTK_WED_RING_OFS_CPU_IDX);
++		if (cur_idx == MTK_WED_RX_RING_SIZE - 1)
++			break;
++
++		usleep_range(100000, 200000);
++	}
++
++	if (i == 3) {
++		dev_err(dev->hw->dev, "rx dma enable failed\n");
++		return;
++	}
++
++	val = wifi_r32(dev, dev->wlan.wpdma_rx_glo - dev->wlan.phy_base) |
++	      MTK_WFMDA_RX_DMA_EN;
++	wifi_w32(dev, dev->wlan.wpdma_rx_glo - dev->wlan.phy_base, val);
++}
++
+ static void
+ mtk_wed_dma_disable(struct mtk_wed_device *dev)
+ {
+@@ -304,20 +508,25 @@ mtk_wed_dma_disable(struct mtk_wed_devic
+ 		MTK_WED_GLO_CFG_TX_DMA_EN |
+ 		MTK_WED_GLO_CFG_RX_DMA_EN);
+ 
+-	wdma_m32(dev, MTK_WDMA_GLO_CFG,
++	wdma_clr(dev, MTK_WDMA_GLO_CFG,
+ 		 MTK_WDMA_GLO_CFG_TX_DMA_EN |
+ 		 MTK_WDMA_GLO_CFG_RX_INFO1_PRERES |
+-		 MTK_WDMA_GLO_CFG_RX_INFO2_PRERES, 0);
++		 MTK_WDMA_GLO_CFG_RX_INFO2_PRERES);
+ 
+ 	if (dev->hw->version == 1) {
+ 		regmap_write(dev->hw->mirror, dev->hw->index * 4, 0);
+-		wdma_m32(dev, MTK_WDMA_GLO_CFG,
+-			 MTK_WDMA_GLO_CFG_RX_INFO3_PRERES, 0);
++		wdma_clr(dev, MTK_WDMA_GLO_CFG,
++			 MTK_WDMA_GLO_CFG_RX_INFO3_PRERES);
+ 	} else {
+ 		wed_clr(dev, MTK_WED_WPDMA_GLO_CFG,
+ 			MTK_WED_WPDMA_GLO_CFG_RX_DRV_R0_PKT_PROC |
+ 			MTK_WED_WPDMA_GLO_CFG_RX_DRV_R0_CRX_SYNC);
+ 
++		wed_clr(dev, MTK_WED_WPDMA_RX_D_GLO_CFG,
++			MTK_WED_WPDMA_RX_D_RX_DRV_EN);
++		wed_clr(dev, MTK_WED_WDMA_GLO_CFG,
++			MTK_WED_WDMA_GLO_CFG_TX_DDONE_CHK);
++
+ 		mtk_wed_set_512_support(dev, false);
+ 	}
+ }
+@@ -338,6 +547,13 @@ mtk_wed_stop(struct mtk_wed_device *dev)
+ 	wdma_w32(dev, MTK_WDMA_INT_MASK, 0);
+ 	wdma_w32(dev, MTK_WDMA_INT_GRP2, 0);
+ 	wed_w32(dev, MTK_WED_WPDMA_INT_MASK, 0);
++
++	if (dev->hw->version == 1)
++		return;
++
++	wed_w32(dev, MTK_WED_EXT_INT_MASK1, 0);
++	wed_w32(dev, MTK_WED_EXT_INT_MASK2, 0);
++	wed_clr(dev, MTK_WED_CTRL, MTK_WED_CTRL_WED_RX_BM_EN);
+ }
+ 
+ static void
+@@ -353,11 +569,21 @@ mtk_wed_detach(struct mtk_wed_device *de
+ 	wdma_w32(dev, MTK_WDMA_RESET_IDX, 0);
+ 
+ 	mtk_wed_reset(dev, MTK_WED_RESET_WED);
++	if (mtk_wed_get_rx_capa(dev)) {
++		wdma_clr(dev, MTK_WDMA_GLO_CFG, MTK_WDMA_GLO_CFG_TX_DMA_EN);
++		wdma_w32(dev, MTK_WDMA_RESET_IDX, MTK_WDMA_RESET_IDX_TX);
++		wdma_w32(dev, MTK_WDMA_RESET_IDX, 0);
++	}
+ 
+-	mtk_wed_free_buffer(dev);
++	mtk_wed_free_tx_buffer(dev);
+ 	mtk_wed_free_tx_rings(dev);
+-	if (hw->version != 1)
++
++	if (mtk_wed_get_rx_capa(dev)) {
++		mtk_wed_wo_reset(dev);
++		mtk_wed_free_rx_rings(dev);
+ 		mtk_wed_wo_deinit(hw);
++		mtk_wdma_rx_reset(dev);
++	}
+ 
+ 	if (dev->wlan.bus_type == MTK_WED_BUS_PCIE) {
+ 		struct device_node *wlan_node;
+@@ -434,10 +660,12 @@ mtk_wed_set_wpdma(struct mtk_wed_device
+ 	} else {
+ 		mtk_wed_bus_init(dev);
+ 
+-		wed_w32(dev, MTK_WED_WPDMA_CFG_BASE,  dev->wlan.wpdma_int);
+-		wed_w32(dev, MTK_WED_WPDMA_CFG_INT_MASK,  dev->wlan.wpdma_mask);
+-		wed_w32(dev, MTK_WED_WPDMA_CFG_TX,  dev->wlan.wpdma_tx);
+-		wed_w32(dev, MTK_WED_WPDMA_CFG_TX_FREE,  dev->wlan.wpdma_txfree);
++		wed_w32(dev, MTK_WED_WPDMA_CFG_BASE, dev->wlan.wpdma_int);
++		wed_w32(dev, MTK_WED_WPDMA_CFG_INT_MASK, dev->wlan.wpdma_mask);
++		wed_w32(dev, MTK_WED_WPDMA_CFG_TX, dev->wlan.wpdma_tx);
++		wed_w32(dev, MTK_WED_WPDMA_CFG_TX_FREE, dev->wlan.wpdma_txfree);
++		wed_w32(dev, MTK_WED_WPDMA_RX_GLO_CFG, dev->wlan.wpdma_rx_glo);
++		wed_w32(dev, MTK_WED_WPDMA_RX_RING, dev->wlan.wpdma_rx);
+ 	}
+ }
+ 
+@@ -487,6 +715,132 @@ mtk_wed_hw_init_early(struct mtk_wed_dev
+ 	}
+ }
+ 
++static int
++mtk_wed_rro_ring_alloc(struct mtk_wed_device *dev, struct mtk_wed_ring *ring,
++		       int size)
++{
++	ring->desc = dma_alloc_coherent(dev->hw->dev,
++					size * sizeof(*ring->desc),
++					&ring->desc_phys, GFP_KERNEL);
++	if (!ring->desc)
++		return -ENOMEM;
++
++	ring->desc_size = sizeof(*ring->desc);
++	ring->size = size;
++	memset(ring->desc, 0, size);
++
++	return 0;
++}
++
++#define MTK_WED_MIOD_COUNT	(MTK_WED_MIOD_ENTRY_CNT * MTK_WED_MIOD_CNT)
++static int
++mtk_wed_rro_alloc(struct mtk_wed_device *dev)
++{
++	struct reserved_mem *rmem;
++	struct device_node *np;
++	int index;
++
++	index = of_property_match_string(dev->hw->node, "memory-region-names",
++					 "wo-dlm");
++	if (index < 0)
++		return index;
++
++	np = of_parse_phandle(dev->hw->node, "memory-region", index);
++	if (!np)
++		return -ENODEV;
++
++	rmem = of_reserved_mem_lookup(np);
++	of_node_put(np);
++
++	if (!rmem)
++		return -ENODEV;
++
++	dev->rro.miod_phys = rmem->base;
++	dev->rro.fdbk_phys = MTK_WED_MIOD_COUNT + dev->rro.miod_phys;
++
++	return mtk_wed_rro_ring_alloc(dev, &dev->rro.ring,
++				      MTK_WED_RRO_QUE_CNT);
++}
++
++static int
++mtk_wed_rro_cfg(struct mtk_wed_device *dev)
++{
++	struct mtk_wed_wo *wo = dev->hw->wed_wo;
++	struct {
++		struct {
++			__le32 base;
++			__le32 cnt;
++			__le32 unit;
++		} ring[2];
++		__le32 wed;
++		u8 version;
++	} req = {
++		.ring[0] = {
++			.base = cpu_to_le32(MTK_WED_WOCPU_VIEW_MIOD_BASE),
++			.cnt = cpu_to_le32(MTK_WED_MIOD_CNT),
++			.unit = cpu_to_le32(MTK_WED_MIOD_ENTRY_CNT),
++		},
++		.ring[1] = {
++			.base = cpu_to_le32(MTK_WED_WOCPU_VIEW_MIOD_BASE +
++					    MTK_WED_MIOD_COUNT),
++			.cnt = cpu_to_le32(MTK_WED_FB_CMD_CNT),
++			.unit = cpu_to_le32(4),
++		},
++	};
++
++	return mtk_wed_mcu_send_msg(wo, MTK_WED_MODULE_ID_WO,
++				    MTK_WED_WO_CMD_WED_CFG,
++				    &req, sizeof(req), true);
++}
++
++static void
++mtk_wed_rro_hw_init(struct mtk_wed_device *dev)
++{
++	wed_w32(dev, MTK_WED_RROQM_MIOD_CFG,
++		FIELD_PREP(MTK_WED_RROQM_MIOD_MID_DW, 0x70 >> 2) |
++		FIELD_PREP(MTK_WED_RROQM_MIOD_MOD_DW, 0x10 >> 2) |
++		FIELD_PREP(MTK_WED_RROQM_MIOD_ENTRY_DW,
++			   MTK_WED_MIOD_ENTRY_CNT >> 2));
++
++	wed_w32(dev, MTK_WED_RROQM_MIOD_CTRL0, dev->rro.miod_phys);
++	wed_w32(dev, MTK_WED_RROQM_MIOD_CTRL1,
++		FIELD_PREP(MTK_WED_RROQM_MIOD_CNT, MTK_WED_MIOD_CNT));
++	wed_w32(dev, MTK_WED_RROQM_FDBK_CTRL0, dev->rro.fdbk_phys);
++	wed_w32(dev, MTK_WED_RROQM_FDBK_CTRL1,
++		FIELD_PREP(MTK_WED_RROQM_FDBK_CNT, MTK_WED_FB_CMD_CNT));
++	wed_w32(dev, MTK_WED_RROQM_FDBK_CTRL2, 0);
++	wed_w32(dev, MTK_WED_RROQ_BASE_L, dev->rro.ring.desc_phys);
++
++	wed_set(dev, MTK_WED_RROQM_RST_IDX,
++		MTK_WED_RROQM_RST_IDX_MIOD |
++		MTK_WED_RROQM_RST_IDX_FDBK);
++
++	wed_w32(dev, MTK_WED_RROQM_RST_IDX, 0);
++	wed_w32(dev, MTK_WED_RROQM_MIOD_CTRL2, MTK_WED_MIOD_CNT - 1);
++	wed_set(dev, MTK_WED_CTRL, MTK_WED_CTRL_RX_RRO_QM_EN);
++}
++
++static void
++mtk_wed_route_qm_hw_init(struct mtk_wed_device *dev)
++{
++	wed_w32(dev, MTK_WED_RESET, MTK_WED_RESET_RX_ROUTE_QM);
++
++	for (;;) {
++		usleep_range(100, 200);
++		if (!(wed_r32(dev, MTK_WED_RESET) & MTK_WED_RESET_RX_ROUTE_QM))
++			break;
++	}
++
++	/* configure RX_ROUTE_QM */
++	wed_clr(dev, MTK_WED_RTQM_GLO_CFG, MTK_WED_RTQM_Q_RST);
++	wed_clr(dev, MTK_WED_RTQM_GLO_CFG, MTK_WED_RTQM_TXDMAD_FPORT);
++	wed_set(dev, MTK_WED_RTQM_GLO_CFG,
++		FIELD_PREP(MTK_WED_RTQM_TXDMAD_FPORT, 0x3 + dev->hw->index));
++	wed_clr(dev, MTK_WED_RTQM_GLO_CFG, MTK_WED_RTQM_Q_RST);
++	/* enable RX_ROUTE_QM */
++	wed_set(dev, MTK_WED_CTRL, MTK_WED_CTRL_RX_ROUTE_QM_EN);
++}
++
+ static void
+ mtk_wed_hw_init(struct mtk_wed_device *dev)
+ {
+@@ -498,11 +852,11 @@ mtk_wed_hw_init(struct mtk_wed_device *d
+ 	wed_w32(dev, MTK_WED_TX_BM_CTRL,
+ 		MTK_WED_TX_BM_CTRL_PAUSE |
+ 		FIELD_PREP(MTK_WED_TX_BM_CTRL_VLD_GRP_NUM,
+-			   dev->buf_ring.size / 128) |
++			   dev->tx_buf_ring.size / 128) |
+ 		FIELD_PREP(MTK_WED_TX_BM_CTRL_RSV_GRP_NUM,
+ 			   MTK_WED_TX_RING_SIZE / 256));
+ 
+-	wed_w32(dev, MTK_WED_TX_BM_BASE, dev->buf_ring.desc_phys);
++	wed_w32(dev, MTK_WED_TX_BM_BASE, dev->tx_buf_ring.desc_phys);
+ 
+ 	wed_w32(dev, MTK_WED_TX_BM_BUF_LEN, MTK_WED_PKT_SIZE);
+ 
+@@ -529,9 +883,9 @@ mtk_wed_hw_init(struct mtk_wed_device *d
+ 		wed_w32(dev, MTK_WED_TX_TKID_CTRL,
+ 			MTK_WED_TX_TKID_CTRL_PAUSE |
+ 			FIELD_PREP(MTK_WED_TX_TKID_CTRL_VLD_GRP_NUM,
+-				   dev->buf_ring.size / 128) |
++				   dev->tx_buf_ring.size / 128) |
+ 			FIELD_PREP(MTK_WED_TX_TKID_CTRL_RSV_GRP_NUM,
+-				   dev->buf_ring.size / 128));
++				   dev->tx_buf_ring.size / 128));
+ 		wed_w32(dev, MTK_WED_TX_TKID_DYN_THR,
+ 			FIELD_PREP(MTK_WED_TX_TKID_DYN_THR_LO, 0) |
+ 			MTK_WED_TX_TKID_DYN_THR_HI);
+@@ -539,18 +893,28 @@ mtk_wed_hw_init(struct mtk_wed_device *d
+ 
+ 	mtk_wed_reset(dev, MTK_WED_RESET_TX_BM);
+ 
+-	if (dev->hw->version == 1)
++	if (dev->hw->version == 1) {
+ 		wed_set(dev, MTK_WED_CTRL,
+ 			MTK_WED_CTRL_WED_TX_BM_EN |
+ 			MTK_WED_CTRL_WED_TX_FREE_AGENT_EN);
+-	else
++	} else {
+ 		wed_clr(dev, MTK_WED_TX_TKID_CTRL, MTK_WED_TX_TKID_CTRL_PAUSE);
++		/* rx hw init */
++		wed_w32(dev, MTK_WED_WPDMA_RX_D_RST_IDX,
++			MTK_WED_WPDMA_RX_D_RST_CRX_IDX |
++			MTK_WED_WPDMA_RX_D_RST_DRV_IDX);
++		wed_w32(dev, MTK_WED_WPDMA_RX_D_RST_IDX, 0);
++
++		mtk_wed_rx_buffer_hw_init(dev);
++		mtk_wed_rro_hw_init(dev);
++		mtk_wed_route_qm_hw_init(dev);
++	}
+ 
+ 	wed_clr(dev, MTK_WED_TX_BM_CTRL, MTK_WED_TX_BM_CTRL_PAUSE);
+ }
+ 
+ static void
+-mtk_wed_ring_reset(struct mtk_wed_ring *ring, int size)
++mtk_wed_ring_reset(struct mtk_wed_ring *ring, int size, bool tx)
+ {
+ 	void *head = (void *)ring->desc;
+ 	int i;
+@@ -560,7 +924,10 @@ mtk_wed_ring_reset(struct mtk_wed_ring *
+ 
+ 		desc = (struct mtk_wdma_desc *)(head + i * ring->desc_size);
+ 		desc->buf0 = 0;
+-		desc->ctrl = cpu_to_le32(MTK_WDMA_DESC_CTRL_DMA_DONE);
++		if (tx)
++			desc->ctrl = cpu_to_le32(MTK_WDMA_DESC_CTRL_DMA_DONE);
++		else
++			desc->ctrl = cpu_to_le32(MTK_WFDMA_DESC_CTRL_TO_HOST);
+ 		desc->buf1 = 0;
+ 		desc->info = 0;
+ 	}
+@@ -616,7 +983,8 @@ mtk_wed_reset_dma(struct mtk_wed_device
+ 		if (!dev->tx_ring[i].desc)
+ 			continue;
+ 
+-		mtk_wed_ring_reset(&dev->tx_ring[i], MTK_WED_TX_RING_SIZE);
++		mtk_wed_ring_reset(&dev->tx_ring[i], MTK_WED_TX_RING_SIZE,
++				   true);
+ 	}
+ 
+ 	if (mtk_wed_poll_busy(dev))
+@@ -634,6 +1002,9 @@ mtk_wed_reset_dma(struct mtk_wed_device
+ 	wdma_w32(dev, MTK_WDMA_RESET_IDX, MTK_WDMA_RESET_IDX_RX);
+ 	wdma_w32(dev, MTK_WDMA_RESET_IDX, 0);
+ 
++	if (mtk_wed_get_rx_capa(dev))
++		mtk_wdma_rx_reset(dev);
++
+ 	if (busy) {
+ 		mtk_wed_reset(dev, MTK_WED_RESET_WDMA_INT_AGENT);
+ 		mtk_wed_reset(dev, MTK_WED_RESET_WDMA_RX_DRV);
+@@ -668,12 +1039,11 @@ mtk_wed_reset_dma(struct mtk_wed_device
+ 			MTK_WED_WPDMA_RESET_IDX_RX);
+ 		wed_w32(dev, MTK_WED_WPDMA_RESET_IDX, 0);
+ 	}
+-
+ }
+ 
+ static int
+ mtk_wed_ring_alloc(struct mtk_wed_device *dev, struct mtk_wed_ring *ring,
+-		   int size, u32 desc_size)
++		   int size, u32 desc_size, bool tx)
+ {
+ 	ring->desc = dma_alloc_coherent(dev->hw->dev, size * desc_size,
+ 					&ring->desc_phys, GFP_KERNEL);
+@@ -682,7 +1052,7 @@ mtk_wed_ring_alloc(struct mtk_wed_device
+ 
+ 	ring->desc_size = desc_size;
+ 	ring->size = size;
+-	mtk_wed_ring_reset(ring, size);
++	mtk_wed_ring_reset(ring, size, tx);
+ 
+ 	return 0;
+ }
+@@ -691,9 +1061,14 @@ static int
+ mtk_wed_wdma_rx_ring_setup(struct mtk_wed_device *dev, int idx, int size)
+ {
+ 	u32 desc_size = sizeof(struct mtk_wdma_desc) * dev->hw->version;
+-	struct mtk_wed_ring *wdma = &dev->rx_wdma[idx];
++	struct mtk_wed_ring *wdma;
+ 
+-	if (mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE, desc_size))
++	if (idx >= ARRAY_SIZE(dev->rx_wdma))
++		return -EINVAL;
++
++	wdma = &dev->rx_wdma[idx];
++	if (mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE, desc_size,
++			       true))
+ 		return -ENOMEM;
+ 
+ 	wdma_w32(dev, MTK_WDMA_RING_RX(idx) + MTK_WED_RING_OFS_BASE,
+@@ -710,6 +1085,60 @@ mtk_wed_wdma_rx_ring_setup(struct mtk_we
+ 	return 0;
+ }
+ 
++static int
++mtk_wed_wdma_tx_ring_setup(struct mtk_wed_device *dev, int idx, int size)
++{
++	u32 desc_size = sizeof(struct mtk_wdma_desc) * dev->hw->version;
++	struct mtk_wed_ring *wdma;
++
++	if (idx >= ARRAY_SIZE(dev->tx_wdma))
++		return -EINVAL;
++
++	wdma = &dev->tx_wdma[idx];
++	if (mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE, desc_size,
++			       true))
++		return -ENOMEM;
++
++	wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_BASE,
++		 wdma->desc_phys);
++	wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_COUNT,
++		 size);
++	wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_CPU_IDX, 0);
++	wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_DMA_IDX, 0);
++
++	if (!idx)  {
++		wed_w32(dev, MTK_WED_WDMA_RING_TX + MTK_WED_RING_OFS_BASE,
++			wdma->desc_phys);
++		wed_w32(dev, MTK_WED_WDMA_RING_TX + MTK_WED_RING_OFS_COUNT,
++			size);
++		wed_w32(dev, MTK_WED_WDMA_RING_TX + MTK_WED_RING_OFS_CPU_IDX,
++			0);
++		wed_w32(dev, MTK_WED_WDMA_RING_TX + MTK_WED_RING_OFS_DMA_IDX,
++			0);
++	}
++
++	return 0;
++}
++
++static void
++mtk_wed_ppe_check(struct mtk_wed_device *dev, struct sk_buff *skb,
++		  u32 reason, u32 hash)
++{
++	struct mtk_eth *eth = dev->hw->eth;
++	struct ethhdr *eh;
++
++	if (!skb)
++		return;
++
++	if (reason != MTK_PPE_CPU_REASON_HIT_UNBIND_RATE_REACHED)
++		return;
++
++	skb_set_mac_header(skb, 0);
++	eh = eth_hdr(skb);
++	skb->protocol = eh->h_proto;
++	mtk_ppe_check_skb(eth->ppe[dev->hw->index], skb, hash);
++}
++
+ static void
+ mtk_wed_configure_irq(struct mtk_wed_device *dev, u32 irq_mask)
+ {
+@@ -732,6 +1161,8 @@ mtk_wed_configure_irq(struct mtk_wed_dev
+ 
+ 		wed_clr(dev, MTK_WED_WDMA_INT_CTRL, wdma_mask);
+ 	} else {
++		wdma_mask |= FIELD_PREP(MTK_WDMA_INT_MASK_TX_DONE,
++					GENMASK(1, 0));
+ 		/* initail tx interrupt trigger */
+ 		wed_w32(dev, MTK_WED_WPDMA_INT_CTRL_TX,
+ 			MTK_WED_WPDMA_INT_CTRL_TX0_DONE_EN |
+@@ -750,6 +1181,16 @@ mtk_wed_configure_irq(struct mtk_wed_dev
+ 			FIELD_PREP(MTK_WED_WPDMA_INT_CTRL_TX_FREE_DONE_TRIG,
+ 				   dev->wlan.txfree_tbit));
+ 
++		wed_w32(dev, MTK_WED_WPDMA_INT_CTRL_RX,
++			MTK_WED_WPDMA_INT_CTRL_RX0_EN |
++			MTK_WED_WPDMA_INT_CTRL_RX0_CLR |
++			MTK_WED_WPDMA_INT_CTRL_RX1_EN |
++			MTK_WED_WPDMA_INT_CTRL_RX1_CLR |
++			FIELD_PREP(MTK_WED_WPDMA_INT_CTRL_RX0_DONE_TRIG,
++				   dev->wlan.rx_tbit[0]) |
++			FIELD_PREP(MTK_WED_WPDMA_INT_CTRL_RX1_DONE_TRIG,
++				   dev->wlan.rx_tbit[1]));
++
+ 		wed_w32(dev, MTK_WED_WDMA_INT_CLR, wdma_mask);
+ 		wed_set(dev, MTK_WED_WDMA_INT_CTRL,
+ 			FIELD_PREP(MTK_WED_WDMA_INT_CTRL_POLL_SRC_SEL,
+@@ -787,9 +1228,15 @@ mtk_wed_dma_enable(struct mtk_wed_device
+ 		wdma_set(dev, MTK_WDMA_GLO_CFG,
+ 			 MTK_WDMA_GLO_CFG_RX_INFO3_PRERES);
+ 	} else {
++		int i;
++
+ 		wed_set(dev, MTK_WED_WPDMA_CTRL,
+ 			MTK_WED_WPDMA_CTRL_SDL1_FIXED);
+ 
++		wed_set(dev, MTK_WED_WDMA_GLO_CFG,
++			MTK_WED_WDMA_GLO_CFG_TX_DRV_EN |
++			MTK_WED_WDMA_GLO_CFG_TX_DDONE_CHK);
++
+ 		wed_set(dev, MTK_WED_WPDMA_GLO_CFG,
+ 			MTK_WED_WPDMA_GLO_CFG_RX_DRV_R0_PKT_PROC |
+ 			MTK_WED_WPDMA_GLO_CFG_RX_DRV_R0_CRX_SYNC);
+@@ -797,6 +1244,15 @@ mtk_wed_dma_enable(struct mtk_wed_device
+ 		wed_clr(dev, MTK_WED_WPDMA_GLO_CFG,
+ 			MTK_WED_WPDMA_GLO_CFG_TX_TKID_KEEP |
+ 			MTK_WED_WPDMA_GLO_CFG_TX_DMAD_DW3_PREV);
++
++		wed_set(dev, MTK_WED_WPDMA_RX_D_GLO_CFG,
++			MTK_WED_WPDMA_RX_D_RX_DRV_EN |
++			FIELD_PREP(MTK_WED_WPDMA_RX_D_RXD_READ_LEN, 0x18) |
++			FIELD_PREP(MTK_WED_WPDMA_RX_D_INIT_PHASE_RXEN_SEL,
++				   0x2));
++
++		for (i = 0; i < MTK_WED_RX_QUEUES; i++)
++			mtk_wed_check_wfdma_rx_fill(dev, i);
+ 	}
+ }
+ 
+@@ -822,7 +1278,19 @@ mtk_wed_start(struct mtk_wed_device *dev
+ 		val |= BIT(0) | (BIT(1) * !!dev->hw->index);
+ 		regmap_write(dev->hw->mirror, dev->hw->index * 4, val);
+ 	} else {
+-		mtk_wed_set_512_support(dev, true);
++		/* driver set mid ready and only once */
++		wed_w32(dev, MTK_WED_EXT_INT_MASK1,
++			MTK_WED_EXT_INT_STATUS_WPDMA_MID_RDY);
++		wed_w32(dev, MTK_WED_EXT_INT_MASK2,
++			MTK_WED_EXT_INT_STATUS_WPDMA_MID_RDY);
++
++		wed_r32(dev, MTK_WED_EXT_INT_MASK1);
++		wed_r32(dev, MTK_WED_EXT_INT_MASK2);
++
++		if (mtk_wed_rro_cfg(dev))
++			return;
++
++		mtk_wed_set_512_support(dev, dev->wlan.wcid_512);
+ 	}
+ 
+ 	mtk_wed_dma_enable(dev);
+@@ -856,7 +1324,7 @@ mtk_wed_attach(struct mtk_wed_device *de
+ 	if (!hw) {
+ 		module_put(THIS_MODULE);
+ 		ret = -ENODEV;
+-		goto out;
++		goto unlock;
+ 	}
+ 
+ 	device = dev->wlan.bus_type == MTK_WED_BUS_PCIE
+@@ -869,15 +1337,24 @@ mtk_wed_attach(struct mtk_wed_device *de
+ 	dev->dev = hw->dev;
+ 	dev->irq = hw->irq;
+ 	dev->wdma_idx = hw->index;
++	dev->version = hw->version;
+ 
+ 	if (hw->eth->dma_dev == hw->eth->dev &&
+ 	    of_dma_is_coherent(hw->eth->dev->of_node))
+ 		mtk_eth_set_dma_device(hw->eth, hw->dev);
+ 
+-	ret = mtk_wed_buffer_alloc(dev);
+-	if (ret) {
+-		mtk_wed_detach(dev);
++	ret = mtk_wed_tx_buffer_alloc(dev);
++	if (ret)
+ 		goto out;
++
++	if (mtk_wed_get_rx_capa(dev)) {
++		ret = mtk_wed_rx_buffer_alloc(dev);
++		if (ret)
++			goto out;
++
++		ret = mtk_wed_rro_alloc(dev);
++		if (ret)
++			goto out;
+ 	}
+ 
+ 	mtk_wed_hw_init_early(dev);
+@@ -886,8 +1363,10 @@ mtk_wed_attach(struct mtk_wed_device *de
+ 				   BIT(hw->index), 0);
+ 	else
+ 		ret = mtk_wed_wo_init(hw);
+-
+ out:
++	if (ret)
++		mtk_wed_detach(dev);
++unlock:
+ 	mutex_unlock(&hw_lock);
+ 
+ 	return ret;
+@@ -910,10 +1389,11 @@ mtk_wed_tx_ring_setup(struct mtk_wed_dev
+ 	 * WDMA RX.
+ 	 */
+ 
+-	BUG_ON(idx >= ARRAY_SIZE(dev->tx_ring));
++	if (WARN_ON(idx >= ARRAY_SIZE(dev->tx_ring)))
++		return -EINVAL;
+ 
+ 	if (mtk_wed_ring_alloc(dev, ring, MTK_WED_TX_RING_SIZE,
+-			       sizeof(*ring->desc)))
++			       sizeof(*ring->desc), true))
+ 		return -ENOMEM;
+ 
+ 	if (mtk_wed_wdma_rx_ring_setup(dev, idx, MTK_WED_WDMA_RING_SIZE))
+@@ -960,6 +1440,37 @@ mtk_wed_txfree_ring_setup(struct mtk_wed
+ 	return 0;
+ }
+ 
++static int
++mtk_wed_rx_ring_setup(struct mtk_wed_device *dev, int idx, void __iomem *regs)
++{
++	struct mtk_wed_ring *ring = &dev->rx_ring[idx];
++
++	if (WARN_ON(idx >= ARRAY_SIZE(dev->rx_ring)))
++		return -EINVAL;
++
++	if (mtk_wed_ring_alloc(dev, ring, MTK_WED_RX_RING_SIZE,
++			       sizeof(*ring->desc), false))
++		return -ENOMEM;
++
++	if (mtk_wed_wdma_tx_ring_setup(dev, idx, MTK_WED_WDMA_RING_SIZE))
++		return -ENOMEM;
++
++	ring->reg_base = MTK_WED_RING_RX_DATA(idx);
++	ring->wpdma = regs;
++	ring->flags |= MTK_WED_RING_CONFIGURED;
++
++	/* WPDMA ->  WED */
++	wpdma_rx_w32(dev, idx, MTK_WED_RING_OFS_BASE, ring->desc_phys);
++	wpdma_rx_w32(dev, idx, MTK_WED_RING_OFS_COUNT, MTK_WED_RX_RING_SIZE);
++
++	wed_w32(dev, MTK_WED_WPDMA_RING_RX_DATA(idx) + MTK_WED_RING_OFS_BASE,
++		ring->desc_phys);
++	wed_w32(dev, MTK_WED_WPDMA_RING_RX_DATA(idx) + MTK_WED_RING_OFS_COUNT,
++		MTK_WED_RX_RING_SIZE);
++
++	return 0;
++}
++
+ static u32
+ mtk_wed_irq_get(struct mtk_wed_device *dev, u32 mask)
+ {
+@@ -1056,7 +1567,9 @@ void mtk_wed_add_hw(struct device_node *
+ 	static const struct mtk_wed_ops wed_ops = {
+ 		.attach = mtk_wed_attach,
+ 		.tx_ring_setup = mtk_wed_tx_ring_setup,
++		.rx_ring_setup = mtk_wed_rx_ring_setup,
+ 		.txfree_ring_setup = mtk_wed_txfree_ring_setup,
++		.msg_update = mtk_wed_mcu_msg_update,
+ 		.start = mtk_wed_start,
+ 		.stop = mtk_wed_stop,
+ 		.reset_dma = mtk_wed_reset_dma,
+@@ -1065,6 +1578,7 @@ void mtk_wed_add_hw(struct device_node *
+ 		.irq_get = mtk_wed_irq_get,
+ 		.irq_set_mask = mtk_wed_irq_set_mask,
+ 		.detach = mtk_wed_detach,
++		.ppe_check = mtk_wed_ppe_check,
+ 	};
+ 	struct device_node *eth_np = eth->dev->of_node;
+ 	struct platform_device *pdev;
+--- a/drivers/net/ethernet/mediatek/mtk_wed.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed.h
+@@ -87,6 +87,24 @@ wpdma_tx_w32(struct mtk_wed_device *dev,
+ }
+ 
+ static inline u32
++wpdma_rx_r32(struct mtk_wed_device *dev, int ring, u32 reg)
++{
++	if (!dev->rx_ring[ring].wpdma)
++		return 0;
++
++	return readl(dev->rx_ring[ring].wpdma + reg);
++}
++
++static inline void
++wpdma_rx_w32(struct mtk_wed_device *dev, int ring, u32 reg, u32 val)
++{
++	if (!dev->rx_ring[ring].wpdma)
++		return;
++
++	writel(val, dev->rx_ring[ring].wpdma + reg);
++}
++
++static inline u32
+ wpdma_txfree_r32(struct mtk_wed_device *dev, u32 reg)
+ {
+ 	if (!dev->txfree_ring.wpdma)
+@@ -128,6 +146,7 @@ static inline int mtk_wed_flow_add(int i
+ static inline void mtk_wed_flow_remove(int index)
+ {
+ }
++
+ #endif
+ 
+ #ifdef CONFIG_DEBUG_FS
+--- a/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
+@@ -10,6 +10,7 @@
+ #include <linux/of_reserved_mem.h>
+ #include <linux/mfd/syscon.h>
+ #include <linux/soc/mediatek/mtk_wed.h>
++#include <asm/unaligned.h>
+ 
+ #include "mtk_wed_regs.h"
+ #include "mtk_wed_wo.h"
+@@ -60,24 +61,37 @@ void mtk_wed_mcu_rx_event(struct mtk_wed
+ 	wake_up(&wo->mcu.wait);
+ }
+ 
++static void
++mtk_wed_update_rx_stats(struct mtk_wed_device *wed, struct sk_buff *skb)
++{
++	u32 count = get_unaligned_le32(skb->data);
++	struct mtk_wed_wo_rx_stats *stats;
++	int i;
++
++	if (count * sizeof(*stats) > skb->len - sizeof(u32))
++		return;
++
++	stats = (struct mtk_wed_wo_rx_stats *)(skb->data + sizeof(u32));
++	for (i = 0 ; i < count ; i++)
++		wed->wlan.update_wo_rx_stats(wed, &stats[i]);
++}
++
+ void mtk_wed_mcu_rx_unsolicited_event(struct mtk_wed_wo *wo,
+ 				      struct sk_buff *skb)
+ {
+ 	struct mtk_wed_mcu_hdr *hdr = (struct mtk_wed_mcu_hdr *)skb->data;
+ 
+-	switch (hdr->cmd) {
+-	case MTK_WED_WO_EVT_LOG_DUMP: {
+-		const char *msg = (const char *)(skb->data + sizeof(*hdr));
++	skb_pull(skb, sizeof(*hdr));
+ 
+-		dev_notice(wo->hw->dev, "%s\n", msg);
++	switch (hdr->cmd) {
++	case MTK_WED_WO_EVT_LOG_DUMP:
++		dev_notice(wo->hw->dev, "%s\n", skb->data);
+ 		break;
+-	}
+ 	case MTK_WED_WO_EVT_PROFILING: {
+-		struct mtk_wed_wo_log_info *info;
+-		u32 count = (skb->len - sizeof(*hdr)) / sizeof(*info);
++		struct mtk_wed_wo_log_info *info = (void *)skb->data;
++		u32 count = skb->len / sizeof(*info);
+ 		int i;
+ 
+-		info = (struct mtk_wed_wo_log_info *)(skb->data + sizeof(*hdr));
+ 		for (i = 0 ; i < count ; i++)
+ 			dev_notice(wo->hw->dev,
+ 				   "SN:%u latency: total=%u, rro:%u, mod:%u\n",
+@@ -88,6 +102,7 @@ void mtk_wed_mcu_rx_unsolicited_event(st
+ 		break;
+ 	}
+ 	case MTK_WED_WO_EVT_RXCNT_INFO:
++		mtk_wed_update_rx_stats(wo->hw->wed_dev, skb);
+ 		break;
+ 	default:
+ 		break;
+@@ -144,6 +159,8 @@ mtk_wed_mcu_parse_response(struct mtk_we
+ 	skb_pull(skb, sizeof(*hdr));
+ 	switch (cmd) {
+ 	case MTK_WED_WO_CMD_RXCNT_INFO:
++		mtk_wed_update_rx_stats(wo->hw->wed_dev, skb);
++		break;
+ 	default:
+ 		break;
+ 	}
+@@ -182,6 +199,18 @@ unlock:
+ 	return ret;
+ }
+ 
++int mtk_wed_mcu_msg_update(struct mtk_wed_device *dev, int id, void *data,
++			   int len)
++{
++	struct mtk_wed_wo *wo = dev->hw->wed_wo;
++
++	if (dev->hw->version == 1)
++		return 0;
++
++	return mtk_wed_mcu_send_msg(wo, MTK_WED_MODULE_ID_WO, id, data, len,
++				    true);
++}
++
+ static int
+ mtk_wed_get_memory_region(struct mtk_wed_wo *wo,
+ 			  struct mtk_wed_wo_memory_region *region)
+--- a/drivers/net/ethernet/mediatek/mtk_wed_regs.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_regs.h
+@@ -4,6 +4,7 @@
+ #ifndef __MTK_WED_REGS_H
+ #define __MTK_WED_REGS_H
+ 
++#define MTK_WFDMA_DESC_CTRL_TO_HOST		BIT(8)
+ #define MTK_WDMA_DESC_CTRL_LEN1			GENMASK(14, 0)
+ #define MTK_WDMA_DESC_CTRL_LEN1_V2		GENMASK(13, 0)
+ #define MTK_WDMA_DESC_CTRL_LAST_SEG1		BIT(15)
+@@ -28,6 +29,8 @@ struct mtk_wdma_desc {
+ #define MTK_WED_RESET_WED_TX_DMA			BIT(12)
+ #define MTK_WED_RESET_WDMA_RX_DRV			BIT(17)
+ #define MTK_WED_RESET_WDMA_INT_AGENT			BIT(19)
++#define MTK_WED_RESET_RX_RRO_QM				BIT(20)
++#define MTK_WED_RESET_RX_ROUTE_QM			BIT(21)
+ #define MTK_WED_RESET_WED				BIT(31)
+ 
+ #define MTK_WED_CTRL					0x00c
+@@ -39,8 +42,12 @@ struct mtk_wdma_desc {
+ #define MTK_WED_CTRL_WED_TX_BM_BUSY			BIT(9)
+ #define MTK_WED_CTRL_WED_TX_FREE_AGENT_EN		BIT(10)
+ #define MTK_WED_CTRL_WED_TX_FREE_AGENT_BUSY		BIT(11)
+-#define MTK_WED_CTRL_RESERVE_EN				BIT(12)
+-#define MTK_WED_CTRL_RESERVE_BUSY			BIT(13)
++#define MTK_WED_CTRL_WED_RX_BM_EN			BIT(12)
++#define MTK_WED_CTRL_WED_RX_BM_BUSY			BIT(13)
++#define MTK_WED_CTRL_RX_RRO_QM_EN			BIT(14)
++#define MTK_WED_CTRL_RX_RRO_QM_BUSY			BIT(15)
++#define MTK_WED_CTRL_RX_ROUTE_QM_EN			BIT(16)
++#define MTK_WED_CTRL_RX_ROUTE_QM_BUSY			BIT(17)
+ #define MTK_WED_CTRL_FINAL_DIDX_READ			BIT(24)
+ #define MTK_WED_CTRL_ETH_DMAD_FMT			BIT(25)
+ #define MTK_WED_CTRL_MIB_READ_CLEAR			BIT(28)
+@@ -62,6 +69,9 @@ struct mtk_wdma_desc {
+ #define MTK_WED_EXT_INT_STATUS_TX_DMA_R_RESP_ERR	BIT(22)
+ #define MTK_WED_EXT_INT_STATUS_TX_DMA_W_RESP_ERR	BIT(23)
+ #define MTK_WED_EXT_INT_STATUS_RX_DRV_DMA_RECYCLE	BIT(24)
++#define MTK_WED_EXT_INT_STATUS_RX_DRV_GET_BM_DMAD_SKIP	BIT(25)
++#define MTK_WED_EXT_INT_STATUS_WPDMA_RX_D_DRV_ERR	BIT(26)
++#define MTK_WED_EXT_INT_STATUS_WPDMA_MID_RDY		BIT(27)
+ #define MTK_WED_EXT_INT_STATUS_ERROR_MASK		(MTK_WED_EXT_INT_STATUS_TF_LEN_ERR | \
+ 							 MTK_WED_EXT_INT_STATUS_TKID_WO_PYLD | \
+ 							 MTK_WED_EXT_INT_STATUS_TKID_TITO_INVALID | \
+@@ -71,6 +81,8 @@ struct mtk_wdma_desc {
+ 							 MTK_WED_EXT_INT_STATUS_TX_DMA_R_RESP_ERR)
+ 
+ #define MTK_WED_EXT_INT_MASK				0x028
++#define MTK_WED_EXT_INT_MASK1				0x02c
++#define MTK_WED_EXT_INT_MASK2				0x030
+ 
+ #define MTK_WED_STATUS					0x060
+ #define MTK_WED_STATUS_TX				GENMASK(15, 8)
+@@ -151,6 +163,7 @@ struct mtk_wdma_desc {
+ #define MTK_WED_RING_TX(_n)				(0x300 + (_n) * 0x10)
+ 
+ #define MTK_WED_RING_RX(_n)				(0x400 + (_n) * 0x10)
++#define MTK_WED_RING_RX_DATA(_n)			(0x420 + (_n) * 0x10)
+ 
+ #define MTK_WED_SCR0					0x3c0
+ #define MTK_WED_WPDMA_INT_TRIGGER			0x504
+@@ -213,6 +226,12 @@ struct mtk_wdma_desc {
+ #define MTK_WED_WPDMA_INT_CTRL_TX1_DONE_TRIG		GENMASK(14, 10)
+ 
+ #define MTK_WED_WPDMA_INT_CTRL_RX			0x534
++#define MTK_WED_WPDMA_INT_CTRL_RX0_EN			BIT(0)
++#define MTK_WED_WPDMA_INT_CTRL_RX0_CLR			BIT(1)
++#define MTK_WED_WPDMA_INT_CTRL_RX0_DONE_TRIG		GENMASK(6, 2)
++#define MTK_WED_WPDMA_INT_CTRL_RX1_EN			BIT(8)
++#define MTK_WED_WPDMA_INT_CTRL_RX1_CLR			BIT(9)
++#define MTK_WED_WPDMA_INT_CTRL_RX1_DONE_TRIG		GENMASK(14, 10)
+ 
+ #define MTK_WED_WPDMA_INT_CTRL_TX_FREE			0x538
+ #define MTK_WED_WPDMA_INT_CTRL_TX_FREE_DONE_EN		BIT(0)
+@@ -242,11 +261,34 @@ struct mtk_wdma_desc {
+ 
+ #define MTK_WED_WPDMA_RING_TX(_n)			(0x600 + (_n) * 0x10)
+ #define MTK_WED_WPDMA_RING_RX(_n)			(0x700 + (_n) * 0x10)
++#define MTK_WED_WPDMA_RING_RX_DATA(_n)			(0x730 + (_n) * 0x10)
++
++#define MTK_WED_WPDMA_RX_D_GLO_CFG			0x75c
++#define MTK_WED_WPDMA_RX_D_RX_DRV_EN			BIT(0)
++#define MTK_WED_WPDMA_RX_D_INIT_PHASE_RXEN_SEL		GENMASK(11, 7)
++#define MTK_WED_WPDMA_RX_D_RXD_READ_LEN			GENMASK(31, 24)
++
++#define MTK_WED_WPDMA_RX_D_RST_IDX			0x760
++#define MTK_WED_WPDMA_RX_D_RST_CRX_IDX			GENMASK(17, 16)
++#define MTK_WED_WPDMA_RX_D_RST_DRV_IDX			GENMASK(25, 24)
++
++#define MTK_WED_WPDMA_RX_GLO_CFG			0x76c
++#define MTK_WED_WPDMA_RX_RING				0x770
++
++#define MTK_WED_WPDMA_RX_D_MIB(_n)			(0x774 + (_n) * 4)
++#define MTK_WED_WPDMA_RX_D_PROCESSED_MIB(_n)		(0x784 + (_n) * 4)
++#define MTK_WED_WPDMA_RX_D_COHERENT_MIB			0x78c
++
++#define MTK_WED_WDMA_RING_TX				0x800
++
++#define MTK_WED_WDMA_TX_MIB				0x810
++
+ #define MTK_WED_WDMA_RING_RX(_n)			(0x900 + (_n) * 0x10)
+ #define MTK_WED_WDMA_RX_THRES(_n)			(0x940 + (_n) * 0x4)
+ 
+ #define MTK_WED_WDMA_GLO_CFG				0xa04
+ #define MTK_WED_WDMA_GLO_CFG_TX_DRV_EN			BIT(0)
++#define MTK_WED_WDMA_GLO_CFG_TX_DDONE_CHK		BIT(1)
+ #define MTK_WED_WDMA_GLO_CFG_RX_DRV_EN			BIT(2)
+ #define MTK_WED_WDMA_GLO_CFG_RX_DRV_BUSY		BIT(3)
+ #define MTK_WED_WDMA_GLO_CFG_BT_SIZE			GENMASK(5, 4)
+@@ -291,6 +333,20 @@ struct mtk_wdma_desc {
+ #define MTK_WED_WDMA_RX_RECYCLE_MIB(_n)			(0xae8 + (_n) * 4)
+ #define MTK_WED_WDMA_RX_PROCESSED_MIB(_n)		(0xaf0 + (_n) * 4)
+ 
++#define MTK_WED_RX_BM_RX_DMAD				0xd80
++#define MTK_WED_RX_BM_RX_DMAD_SDL0			GENMASK(13, 0)
++
++#define MTK_WED_RX_BM_BASE				0xd84
++#define MTK_WED_RX_BM_INIT_PTR				0xd88
++#define MTK_WED_RX_BM_SW_TAIL				GENMASK(15, 0)
++#define MTK_WED_RX_BM_INIT_SW_TAIL			BIT(16)
++
++#define MTK_WED_RX_PTR					0xd8c
++
++#define MTK_WED_RX_BM_DYN_ALLOC_TH			0xdb4
++#define MTK_WED_RX_BM_DYN_ALLOC_TH_H			GENMASK(31, 16)
++#define MTK_WED_RX_BM_DYN_ALLOC_TH_L			GENMASK(15, 0)
++
+ #define MTK_WED_RING_OFS_BASE				0x00
+ #define MTK_WED_RING_OFS_COUNT				0x04
+ #define MTK_WED_RING_OFS_CPU_IDX			0x08
+@@ -301,7 +357,9 @@ struct mtk_wdma_desc {
+ 
+ #define MTK_WDMA_GLO_CFG				0x204
+ #define MTK_WDMA_GLO_CFG_TX_DMA_EN			BIT(0)
++#define MTK_WDMA_GLO_CFG_TX_DMA_BUSY			BIT(1)
+ #define MTK_WDMA_GLO_CFG_RX_DMA_EN			BIT(2)
++#define MTK_WDMA_GLO_CFG_RX_DMA_BUSY			BIT(3)
+ #define MTK_WDMA_GLO_CFG_RX_INFO3_PRERES		BIT(26)
+ #define MTK_WDMA_GLO_CFG_RX_INFO2_PRERES		BIT(27)
+ #define MTK_WDMA_GLO_CFG_RX_INFO1_PRERES		BIT(28)
+@@ -330,4 +388,70 @@ struct mtk_wdma_desc {
+ /* DMA channel mapping */
+ #define HIFSYS_DMA_AG_MAP				0x008
+ 
++#define MTK_WED_RTQM_GLO_CFG				0xb00
++#define MTK_WED_RTQM_BUSY				BIT(1)
++#define MTK_WED_RTQM_Q_RST				BIT(2)
++#define MTK_WED_RTQM_Q_DBG_BYPASS			BIT(5)
++#define MTK_WED_RTQM_TXDMAD_FPORT			GENMASK(23, 20)
++
++#define MTK_WED_RTQM_R2H_MIB(_n)			(0xb70 + (_n) * 0x4)
++#define MTK_WED_RTQM_R2Q_MIB(_n)			(0xb78 + (_n) * 0x4)
++#define MTK_WED_RTQM_Q2N_MIB				0xb80
++#define MTK_WED_RTQM_Q2H_MIB(_n)			(0xb84 + (_n) * 0x4)
++
++#define MTK_WED_RTQM_Q2B_MIB				0xb8c
++#define MTK_WED_RTQM_PFDBK_MIB				0xb90
++
++#define MTK_WED_RROQM_GLO_CFG				0xc04
++#define MTK_WED_RROQM_RST_IDX				0xc08
++#define MTK_WED_RROQM_RST_IDX_MIOD			BIT(0)
++#define MTK_WED_RROQM_RST_IDX_FDBK			BIT(4)
++
++#define MTK_WED_RROQM_MIOD_CTRL0			0xc40
++#define MTK_WED_RROQM_MIOD_CTRL1			0xc44
++#define MTK_WED_RROQM_MIOD_CNT				GENMASK(11, 0)
++
++#define MTK_WED_RROQM_MIOD_CTRL2			0xc48
++#define MTK_WED_RROQM_MIOD_CTRL3			0xc4c
++
++#define MTK_WED_RROQM_FDBK_CTRL0			0xc50
++#define MTK_WED_RROQM_FDBK_CTRL1			0xc54
++#define MTK_WED_RROQM_FDBK_CNT				GENMASK(11, 0)
++
++#define MTK_WED_RROQM_FDBK_CTRL2			0xc58
++
++#define MTK_WED_RROQ_BASE_L				0xc80
++#define MTK_WED_RROQ_BASE_H				0xc84
++
++#define MTK_WED_RROQM_MIOD_CFG				0xc8c
++#define MTK_WED_RROQM_MIOD_MID_DW			GENMASK(5, 0)
++#define MTK_WED_RROQM_MIOD_MOD_DW			GENMASK(13, 8)
++#define MTK_WED_RROQM_MIOD_ENTRY_DW			GENMASK(22, 16)
++
++#define MTK_WED_RROQM_MID_MIB				0xcc0
++#define MTK_WED_RROQM_MOD_MIB				0xcc4
++#define MTK_WED_RROQM_MOD_COHERENT_MIB			0xcc8
++#define MTK_WED_RROQM_FDBK_MIB				0xcd0
++#define MTK_WED_RROQM_FDBK_COHERENT_MIB			0xcd4
++#define MTK_WED_RROQM_FDBK_IND_MIB			0xce0
++#define MTK_WED_RROQM_FDBK_ENQ_MIB			0xce4
++#define MTK_WED_RROQM_FDBK_ANC_MIB			0xce8
++#define MTK_WED_RROQM_FDBK_ANC2H_MIB			0xcec
++
++#define MTK_WED_RX_BM_RX_DMAD				0xd80
++#define MTK_WED_RX_BM_BASE				0xd84
++#define MTK_WED_RX_BM_INIT_PTR				0xd88
++#define MTK_WED_RX_BM_PTR				0xd8c
++#define MTK_WED_RX_BM_PTR_HEAD				GENMASK(32, 16)
++#define MTK_WED_RX_BM_PTR_TAIL				GENMASK(15, 0)
++
++#define MTK_WED_RX_BM_BLEN				0xd90
++#define MTK_WED_RX_BM_STS				0xd94
++#define MTK_WED_RX_BM_INTF2				0xd98
++#define MTK_WED_RX_BM_INTF				0xd9c
++#define MTK_WED_RX_BM_ERR_STS				0xda8
++
++#define MTK_WED_WOCPU_VIEW_MIOD_BASE			0x8000
++#define MTK_WED_PCIE_INT_MASK				0x0
++
+ #endif
+--- a/drivers/net/ethernet/mediatek/mtk_wed_wo.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.h
+@@ -49,6 +49,10 @@ enum {
+ 	MTK_WED_WARP_CMD_FLAG_FROM_TO_WO	= BIT(2),
+ };
+ 
++#define MTK_WED_WO_CPU_MCUSYS_RESET_ADDR	0x15194050
++#define MTK_WED_WO_CPU_WO0_MCUSYS_RESET_MASK	0x20
++#define MTK_WED_WO_CPU_WO1_MCUSYS_RESET_MASK	0x1
++
+ enum {
+ 	MTK_WED_WO_REGION_EMI,
+ 	MTK_WED_WO_REGION_ILM,
+@@ -57,6 +61,28 @@ enum {
+ 	__MTK_WED_WO_REGION_MAX,
+ };
+ 
++enum mtk_wed_wo_state {
++	MTK_WED_WO_STATE_UNDEFINED,
++	MTK_WED_WO_STATE_INIT,
++	MTK_WED_WO_STATE_ENABLE,
++	MTK_WED_WO_STATE_DISABLE,
++	MTK_WED_WO_STATE_HALT,
++	MTK_WED_WO_STATE_GATING,
++	MTK_WED_WO_STATE_SER_RESET,
++	MTK_WED_WO_STATE_WF_RESET,
++};
++
++enum mtk_wed_wo_done_state {
++	MTK_WED_WOIF_UNDEFINED,
++	MTK_WED_WOIF_DISABLE_DONE,
++	MTK_WED_WOIF_TRIGGER_ENABLE,
++	MTK_WED_WOIF_ENABLE_DONE,
++	MTK_WED_WOIF_TRIGGER_GATING,
++	MTK_WED_WOIF_GATING_DONE,
++	MTK_WED_WOIF_TRIGGER_HALT,
++	MTK_WED_WOIF_HALT_DONE,
++};
++
+ enum mtk_wed_dummy_cr_idx {
+ 	MTK_WED_DUMMY_CR_FWDL,
+ 	MTK_WED_DUMMY_CR_WO_STATUS,
+@@ -245,6 +271,8 @@ void mtk_wed_mcu_rx_unsolicited_event(st
+ 				      struct sk_buff *skb);
+ int mtk_wed_mcu_send_msg(struct mtk_wed_wo *wo, int id, int cmd,
+ 			 const void *data, int len, bool wait_resp);
++int mtk_wed_mcu_msg_update(struct mtk_wed_device *dev, int id, void *data,
++			   int len);
+ int mtk_wed_mcu_init(struct mtk_wed_wo *wo);
+ int mtk_wed_wo_init(struct mtk_wed_hw *hw);
+ void mtk_wed_wo_deinit(struct mtk_wed_hw *hw);
+--- a/include/linux/soc/mediatek/mtk_wed.h
++++ b/include/linux/soc/mediatek/mtk_wed.h
+@@ -5,10 +5,13 @@
+ #include <linux/rcupdate.h>
+ #include <linux/regmap.h>
+ #include <linux/pci.h>
++#include <linux/skbuff.h>
+ 
+ #define MTK_WED_TX_QUEUES		2
+ #define MTK_WED_RX_QUEUES		2
+ 
++#define WED_WO_STA_REC			0x6
++
+ struct mtk_wed_hw;
+ struct mtk_wdma_desc;
+ 
+@@ -41,21 +44,37 @@ enum mtk_wed_wo_cmd {
+ 	MTK_WED_WO_CMD_WED_END
+ };
+ 
++struct mtk_rxbm_desc {
++	__le32 buf0;
++	__le32 token;
++} __packed __aligned(4);
++
+ enum mtk_wed_bus_tye {
+ 	MTK_WED_BUS_PCIE,
+ 	MTK_WED_BUS_AXI,
+ };
+ 
++#define MTK_WED_RING_CONFIGURED		BIT(0)
+ struct mtk_wed_ring {
+ 	struct mtk_wdma_desc *desc;
+ 	dma_addr_t desc_phys;
+ 	u32 desc_size;
+ 	int size;
++	u32 flags;
+ 
+ 	u32 reg_base;
+ 	void __iomem *wpdma;
+ };
+ 
++struct mtk_wed_wo_rx_stats {
++	__le16 wlan_idx;
++	__le16 tid;
++	__le32 rx_pkt_cnt;
++	__le32 rx_byte_cnt;
++	__le32 rx_err_cnt;
++	__le32 rx_drop_cnt;
++};
++
+ struct mtk_wed_device {
+ #ifdef CONFIG_NET_MEDIATEK_SOC_WED
+ 	const struct mtk_wed_ops *ops;
+@@ -64,9 +83,12 @@ struct mtk_wed_device {
+ 	bool init_done, running;
+ 	int wdma_idx;
+ 	int irq;
++	u8 version;
+ 
+ 	struct mtk_wed_ring tx_ring[MTK_WED_TX_QUEUES];
++	struct mtk_wed_ring rx_ring[MTK_WED_RX_QUEUES];
+ 	struct mtk_wed_ring txfree_ring;
++	struct mtk_wed_ring tx_wdma[MTK_WED_TX_QUEUES];
+ 	struct mtk_wed_ring rx_wdma[MTK_WED_RX_QUEUES];
+ 
+ 	struct {
+@@ -74,7 +96,20 @@ struct mtk_wed_device {
+ 		void **pages;
+ 		struct mtk_wdma_desc *desc;
+ 		dma_addr_t desc_phys;
+-	} buf_ring;
++	} tx_buf_ring;
++
++	struct {
++		int size;
++		struct page_frag_cache rx_page;
++		struct mtk_rxbm_desc *desc;
++		dma_addr_t desc_phys;
++	} rx_buf_ring;
++
++	struct {
++		struct mtk_wed_ring ring;
++		dma_addr_t miod_phys;
++		dma_addr_t fdbk_phys;
++	} rro;
+ 
+ 	/* filled by driver: */
+ 	struct {
+@@ -83,22 +118,36 @@ struct mtk_wed_device {
+ 			struct pci_dev *pci_dev;
+ 		};
+ 		enum mtk_wed_bus_tye bus_type;
++		void __iomem *base;
++		u32 phy_base;
+ 
+ 		u32 wpdma_phys;
+ 		u32 wpdma_int;
+ 		u32 wpdma_mask;
+ 		u32 wpdma_tx;
+ 		u32 wpdma_txfree;
++		u32 wpdma_rx_glo;
++		u32 wpdma_rx;
++
++		bool wcid_512;
+ 
+ 		u16 token_start;
+ 		unsigned int nbuf;
++		unsigned int rx_nbuf;
++		unsigned int rx_npkt;
++		unsigned int rx_size;
+ 
+ 		u8 tx_tbit[MTK_WED_TX_QUEUES];
++		u8 rx_tbit[MTK_WED_RX_QUEUES];
+ 		u8 txfree_tbit;
+ 
+ 		u32 (*init_buf)(void *ptr, dma_addr_t phys, int token_id);
+ 		int (*offload_enable)(struct mtk_wed_device *wed);
+ 		void (*offload_disable)(struct mtk_wed_device *wed);
++		u32 (*init_rx_buf)(struct mtk_wed_device *wed, int size);
++		void (*release_rx_buf)(struct mtk_wed_device *wed);
++		void (*update_wo_rx_stats)(struct mtk_wed_device *wed,
++					   struct mtk_wed_wo_rx_stats *stats);
+ 	} wlan;
+ #endif
+ };
+@@ -107,9 +156,15 @@ struct mtk_wed_ops {
+ 	int (*attach)(struct mtk_wed_device *dev);
+ 	int (*tx_ring_setup)(struct mtk_wed_device *dev, int ring,
+ 			     void __iomem *regs);
++	int (*rx_ring_setup)(struct mtk_wed_device *dev, int ring,
++			     void __iomem *regs);
+ 	int (*txfree_ring_setup)(struct mtk_wed_device *dev,
+ 				 void __iomem *regs);
++	int (*msg_update)(struct mtk_wed_device *dev, int cmd_id,
++			  void *data, int len);
+ 	void (*detach)(struct mtk_wed_device *dev);
++	void (*ppe_check)(struct mtk_wed_device *dev, struct sk_buff *skb,
++			  u32 reason, u32 hash);
+ 
+ 	void (*stop)(struct mtk_wed_device *dev);
+ 	void (*start)(struct mtk_wed_device *dev, u32 irq_mask);
+@@ -144,6 +199,16 @@ mtk_wed_device_attach(struct mtk_wed_dev
+ 	return ret;
+ }
+ 
++static inline bool
++mtk_wed_get_rx_capa(struct mtk_wed_device *dev)
++{
++#ifdef CONFIG_NET_MEDIATEK_SOC_WED
++	return dev->version != 1;
++#else
++	return false;
++#endif
++}
++
+ #ifdef CONFIG_NET_MEDIATEK_SOC_WED
+ #define mtk_wed_device_active(_dev) !!(_dev)->ops
+ #define mtk_wed_device_detach(_dev) (_dev)->ops->detach(_dev)
+@@ -160,6 +225,12 @@ mtk_wed_device_attach(struct mtk_wed_dev
+ 	(_dev)->ops->irq_get(_dev, _mask)
+ #define mtk_wed_device_irq_set_mask(_dev, _mask) \
+ 	(_dev)->ops->irq_set_mask(_dev, _mask)
++#define mtk_wed_device_rx_ring_setup(_dev, _ring, _regs) \
++	(_dev)->ops->rx_ring_setup(_dev, _ring, _regs)
++#define mtk_wed_device_ppe_check(_dev, _skb, _reason, _hash) \
++	(_dev)->ops->ppe_check(_dev, _skb, _reason, _hash)
++#define mtk_wed_device_update_msg(_dev, _id, _msg, _len) \
++	(_dev)->ops->msg_update(_dev, _id, _msg, _len)
+ #else
+ static inline bool mtk_wed_device_active(struct mtk_wed_device *dev)
+ {
+@@ -173,6 +244,9 @@ static inline bool mtk_wed_device_active
+ #define mtk_wed_device_reg_write(_dev, _reg, _val) do {} while (0)
+ #define mtk_wed_device_irq_get(_dev, _mask) 0
+ #define mtk_wed_device_irq_set_mask(_dev, _mask) do {} while (0)
++#define mtk_wed_device_rx_ring_setup(_dev, _ring, _regs) -ENODEV
++#define mtk_wed_device_ppe_check(_dev, _skb, _reason, _hash)  do {} while (0)
++#define mtk_wed_device_update_msg(_dev, _id, _msg, _len) -ENODEV
+ #endif
+ 
+ #endif
diff --git a/target/linux/generic/backport-6.1/729-05-v6.1-net-ethernet-mtk_wed-add-rx-mib-counters.patch b/target/linux/generic/backport-6.1/729-05-v6.1-net-ethernet-mtk_wed-add-rx-mib-counters.patch
new file mode 100644
index 00000000000000..bb1066deceaa46
--- /dev/null
+++ b/target/linux/generic/backport-6.1/729-05-v6.1-net-ethernet-mtk_wed-add-rx-mib-counters.patch
@@ -0,0 +1,149 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 5 Nov 2022 23:36:22 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: add rx mib counters
+
+Introduce WED RX MIB counters support available on MT7986a SoC.
+
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed_debugfs.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_debugfs.c
+@@ -2,6 +2,7 @@
+ /* Copyright (C) 2021 Felix Fietkau <nbd@nbd.name> */
+ 
+ #include <linux/seq_file.h>
++#include <linux/soc/mediatek/mtk_wed.h>
+ #include "mtk_wed.h"
+ #include "mtk_wed_regs.h"
+ 
+@@ -18,6 +19,8 @@ enum {
+ 	DUMP_TYPE_WDMA,
+ 	DUMP_TYPE_WPDMA_TX,
+ 	DUMP_TYPE_WPDMA_TXFREE,
++	DUMP_TYPE_WPDMA_RX,
++	DUMP_TYPE_WED_RRO,
+ };
+ 
+ #define DUMP_STR(_str) { _str, 0, DUMP_TYPE_STRING }
+@@ -36,6 +39,9 @@ enum {
+ 
+ #define DUMP_WPDMA_TX_RING(_n) DUMP_RING("WPDMA_TX" #_n, 0, DUMP_TYPE_WPDMA_TX, _n)
+ #define DUMP_WPDMA_TXFREE_RING DUMP_RING("WPDMA_RX1", 0, DUMP_TYPE_WPDMA_TXFREE)
++#define DUMP_WPDMA_RX_RING(_n)	DUMP_RING("WPDMA_RX" #_n, 0, DUMP_TYPE_WPDMA_RX, _n)
++#define DUMP_WED_RRO_RING(_base)DUMP_RING("WED_RRO_MIOD", MTK_##_base, DUMP_TYPE_WED_RRO)
++#define DUMP_WED_RRO_FDBK(_base)DUMP_RING("WED_RRO_FDBK", MTK_##_base, DUMP_TYPE_WED_RRO)
+ 
+ static void
+ print_reg_val(struct seq_file *s, const char *name, u32 val)
+@@ -57,6 +63,7 @@ dump_wed_regs(struct seq_file *s, struct
+ 				   cur > regs ? "\n" : "",
+ 				   cur->name);
+ 			continue;
++		case DUMP_TYPE_WED_RRO:
+ 		case DUMP_TYPE_WED:
+ 			val = wed_r32(dev, cur->offset);
+ 			break;
+@@ -69,6 +76,9 @@ dump_wed_regs(struct seq_file *s, struct
+ 		case DUMP_TYPE_WPDMA_TXFREE:
+ 			val = wpdma_txfree_r32(dev, cur->offset);
+ 			break;
++		case DUMP_TYPE_WPDMA_RX:
++			val = wpdma_rx_r32(dev, cur->base, cur->offset);
++			break;
+ 		}
+ 		print_reg_val(s, cur->name, val);
+ 	}
+@@ -132,6 +142,80 @@ wed_txinfo_show(struct seq_file *s, void
+ }
+ DEFINE_SHOW_ATTRIBUTE(wed_txinfo);
+ 
++static int
++wed_rxinfo_show(struct seq_file *s, void *data)
++{
++	static const struct reg_dump regs[] = {
++		DUMP_STR("WPDMA RX"),
++		DUMP_WPDMA_RX_RING(0),
++		DUMP_WPDMA_RX_RING(1),
++
++		DUMP_STR("WPDMA RX"),
++		DUMP_WED(WED_WPDMA_RX_D_MIB(0)),
++		DUMP_WED_RING(WED_WPDMA_RING_RX_DATA(0)),
++		DUMP_WED(WED_WPDMA_RX_D_PROCESSED_MIB(0)),
++		DUMP_WED(WED_WPDMA_RX_D_MIB(1)),
++		DUMP_WED_RING(WED_WPDMA_RING_RX_DATA(1)),
++		DUMP_WED(WED_WPDMA_RX_D_PROCESSED_MIB(1)),
++		DUMP_WED(WED_WPDMA_RX_D_COHERENT_MIB),
++
++		DUMP_STR("WED RX"),
++		DUMP_WED_RING(WED_RING_RX_DATA(0)),
++		DUMP_WED_RING(WED_RING_RX_DATA(1)),
++
++		DUMP_STR("WED RRO"),
++		DUMP_WED_RRO_RING(WED_RROQM_MIOD_CTRL0),
++		DUMP_WED(WED_RROQM_MID_MIB),
++		DUMP_WED(WED_RROQM_MOD_MIB),
++		DUMP_WED(WED_RROQM_MOD_COHERENT_MIB),
++		DUMP_WED_RRO_FDBK(WED_RROQM_FDBK_CTRL0),
++		DUMP_WED(WED_RROQM_FDBK_IND_MIB),
++		DUMP_WED(WED_RROQM_FDBK_ENQ_MIB),
++		DUMP_WED(WED_RROQM_FDBK_ANC_MIB),
++		DUMP_WED(WED_RROQM_FDBK_ANC2H_MIB),
++
++		DUMP_STR("WED Route QM"),
++		DUMP_WED(WED_RTQM_R2H_MIB(0)),
++		DUMP_WED(WED_RTQM_R2Q_MIB(0)),
++		DUMP_WED(WED_RTQM_Q2H_MIB(0)),
++		DUMP_WED(WED_RTQM_R2H_MIB(1)),
++		DUMP_WED(WED_RTQM_R2Q_MIB(1)),
++		DUMP_WED(WED_RTQM_Q2H_MIB(1)),
++		DUMP_WED(WED_RTQM_Q2N_MIB),
++		DUMP_WED(WED_RTQM_Q2B_MIB),
++		DUMP_WED(WED_RTQM_PFDBK_MIB),
++
++		DUMP_STR("WED WDMA TX"),
++		DUMP_WED(WED_WDMA_TX_MIB),
++		DUMP_WED_RING(WED_WDMA_RING_TX),
++
++		DUMP_STR("WDMA TX"),
++		DUMP_WDMA(WDMA_GLO_CFG),
++		DUMP_WDMA_RING(WDMA_RING_TX(0)),
++		DUMP_WDMA_RING(WDMA_RING_TX(1)),
++
++		DUMP_STR("WED RX BM"),
++		DUMP_WED(WED_RX_BM_BASE),
++		DUMP_WED(WED_RX_BM_RX_DMAD),
++		DUMP_WED(WED_RX_BM_PTR),
++		DUMP_WED(WED_RX_BM_TKID_MIB),
++		DUMP_WED(WED_RX_BM_BLEN),
++		DUMP_WED(WED_RX_BM_STS),
++		DUMP_WED(WED_RX_BM_INTF2),
++		DUMP_WED(WED_RX_BM_INTF),
++		DUMP_WED(WED_RX_BM_ERR_STS),
++	};
++	struct mtk_wed_hw *hw = s->private;
++	struct mtk_wed_device *dev = hw->wed_dev;
++
++	if (!dev)
++		return 0;
++
++	dump_wed_regs(s, dev, regs, ARRAY_SIZE(regs));
++
++	return 0;
++}
++DEFINE_SHOW_ATTRIBUTE(wed_rxinfo);
+ 
+ static int
+ mtk_wed_reg_set(void *data, u64 val)
+@@ -175,4 +259,7 @@ void mtk_wed_hw_add_debugfs(struct mtk_w
+ 	debugfs_create_u32("regidx", 0600, dir, &hw->debugfs_reg);
+ 	debugfs_create_file_unsafe("regval", 0600, dir, hw, &fops_regval);
+ 	debugfs_create_file_unsafe("txinfo", 0400, dir, hw, &wed_txinfo_fops);
++	if (hw->version != 1)
++		debugfs_create_file_unsafe("rxinfo", 0400, dir, hw,
++					   &wed_rxinfo_fops);
+ }
diff --git a/target/linux/generic/backport-6.1/729-07-v6.1-net-ethernet-mtk_eth_soc-remove-cpu_relax-in-mtk_pen.patch b/target/linux/generic/backport-6.1/729-07-v6.1-net-ethernet-mtk_eth_soc-remove-cpu_relax-in-mtk_pen.patch
new file mode 100644
index 00000000000000..83e015cc6bf2cd
--- /dev/null
+++ b/target/linux/generic/backport-6.1/729-07-v6.1-net-ethernet-mtk_eth_soc-remove-cpu_relax-in-mtk_pen.patch
@@ -0,0 +1,36 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 17 Nov 2022 00:58:46 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: remove cpu_relax in
+ mtk_pending_work
+
+Get rid of cpu_relax in mtk_pending_work routine since MTK_RESETTING is
+set only in mtk_pending_work() and it runs holding rtnl lock
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3495,11 +3495,8 @@ static void mtk_pending_work(struct work
+ 	rtnl_lock();
+ 
+ 	dev_dbg(eth->dev, "[%s][%d] reset\n", __func__, __LINE__);
++	set_bit(MTK_RESETTING, &eth->state);
+ 
+-	while (test_and_set_bit_lock(MTK_RESETTING, &eth->state))
+-		cpu_relax();
+-
+-	dev_dbg(eth->dev, "[%s][%d] mtk_stop starts\n", __func__, __LINE__);
+ 	/* stop all devices to make sure that dma is properly shut down */
+ 	for (i = 0; i < MTK_MAC_COUNT; i++) {
+ 		if (!eth->netdev[i])
+@@ -3533,7 +3530,7 @@ static void mtk_pending_work(struct work
+ 
+ 	dev_dbg(eth->dev, "[%s][%d] reset done\n", __func__, __LINE__);
+ 
+-	clear_bit_unlock(MTK_RESETTING, &eth->state);
++	clear_bit(MTK_RESETTING, &eth->state);
+ 
+ 	rtnl_unlock();
+ }
diff --git a/target/linux/generic/backport-6.1/729-09-v6.2-net-ethernet-mtk_wed-add-wcid-overwritten-support-fo.patch b/target/linux/generic/backport-6.1/729-09-v6.2-net-ethernet-mtk_wed-add-wcid-overwritten-support-fo.patch
new file mode 100644
index 00000000000000..117ccc090258ea
--- /dev/null
+++ b/target/linux/generic/backport-6.1/729-09-v6.2-net-ethernet-mtk_wed-add-wcid-overwritten-support-fo.patch
@@ -0,0 +1,80 @@
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Thu, 24 Nov 2022 11:18:14 +0800
+Subject: [PATCH] net: ethernet: mtk_wed: add wcid overwritten support for wed
+ v1
+
+All wed versions should enable the wcid overwritten feature,
+since the wcid size is controlled by the wlan driver.
+
+Tested-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Co-developed-by: Bo Jiao <bo.jiao@mediatek.com>
+Signed-off-by: Bo Jiao <bo.jiao@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -526,9 +526,9 @@ mtk_wed_dma_disable(struct mtk_wed_devic
+ 			MTK_WED_WPDMA_RX_D_RX_DRV_EN);
+ 		wed_clr(dev, MTK_WED_WDMA_GLO_CFG,
+ 			MTK_WED_WDMA_GLO_CFG_TX_DDONE_CHK);
+-
+-		mtk_wed_set_512_support(dev, false);
+ 	}
++
++	mtk_wed_set_512_support(dev, false);
+ }
+ 
+ static void
+@@ -1290,9 +1290,10 @@ mtk_wed_start(struct mtk_wed_device *dev
+ 		if (mtk_wed_rro_cfg(dev))
+ 			return;
+ 
+-		mtk_wed_set_512_support(dev, dev->wlan.wcid_512);
+ 	}
+ 
++	mtk_wed_set_512_support(dev, dev->wlan.wcid_512);
++
+ 	mtk_wed_dma_enable(dev);
+ 	dev->running = true;
+ }
+@@ -1358,11 +1359,13 @@ mtk_wed_attach(struct mtk_wed_device *de
+ 	}
+ 
+ 	mtk_wed_hw_init_early(dev);
+-	if (hw->version == 1)
++	if (hw->version == 1) {
+ 		regmap_update_bits(hw->hifsys, HIFSYS_DMA_AG_MAP,
+ 				   BIT(hw->index), 0);
+-	else
++	} else {
++		dev->rev_id = wed_r32(dev, MTK_WED_REV_ID);
+ 		ret = mtk_wed_wo_init(hw);
++	}
+ out:
+ 	if (ret)
+ 		mtk_wed_detach(dev);
+--- a/drivers/net/ethernet/mediatek/mtk_wed_regs.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_regs.h
+@@ -20,6 +20,8 @@ struct mtk_wdma_desc {
+ 	__le32 info;
+ } __packed __aligned(4);
+ 
++#define MTK_WED_REV_ID					0x004
++
+ #define MTK_WED_RESET					0x008
+ #define MTK_WED_RESET_TX_BM				BIT(0)
+ #define MTK_WED_RESET_TX_FREE_AGENT			BIT(4)
+--- a/include/linux/soc/mediatek/mtk_wed.h
++++ b/include/linux/soc/mediatek/mtk_wed.h
+@@ -85,6 +85,9 @@ struct mtk_wed_device {
+ 	int irq;
+ 	u8 version;
+ 
++	/* used by wlan driver */
++	u32 rev_id;
++
+ 	struct mtk_wed_ring tx_ring[MTK_WED_TX_QUEUES];
+ 	struct mtk_wed_ring rx_ring[MTK_WED_RX_QUEUES];
+ 	struct mtk_wed_ring txfree_ring;
diff --git a/target/linux/generic/backport-6.1/729-10-v6.2-net-ethernet-mtk_wed-return-status-value-in-mtk_wdma.patch b/target/linux/generic/backport-6.1/729-10-v6.2-net-ethernet-mtk_wed-return-status-value-in-mtk_wdma.patch
new file mode 100644
index 00000000000000..ec58c3fc572400
--- /dev/null
+++ b/target/linux/generic/backport-6.1/729-10-v6.2-net-ethernet-mtk_wed-return-status-value-in-mtk_wdma.patch
@@ -0,0 +1,85 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 24 Nov 2022 16:22:51 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: return status value in
+ mtk_wdma_rx_reset
+
+Move MTK_WDMA_RESET_IDX configuration in mtk_wdma_rx_reset routine.
+Increase poll timeout to 10ms in order to be aligned with vendor sdk.
+This is a preliminary patch to add Wireless Ethernet Dispatcher reset
+support.
+
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -101,17 +101,21 @@ mtk_wdma_read_reset(struct mtk_wed_devic
+ 	return wdma_r32(dev, MTK_WDMA_GLO_CFG);
+ }
+ 
+-static void
++static int
+ mtk_wdma_rx_reset(struct mtk_wed_device *dev)
+ {
+ 	u32 status, mask = MTK_WDMA_GLO_CFG_RX_DMA_BUSY;
+-	int i;
++	int i, ret;
+ 
+ 	wdma_clr(dev, MTK_WDMA_GLO_CFG, MTK_WDMA_GLO_CFG_RX_DMA_EN);
+-	if (readx_poll_timeout(mtk_wdma_read_reset, dev, status,
+-			       !(status & mask), 0, 1000))
++	ret = readx_poll_timeout(mtk_wdma_read_reset, dev, status,
++				 !(status & mask), 0, 10000);
++	if (ret)
+ 		dev_err(dev->hw->dev, "rx reset failed\n");
+ 
++	wdma_w32(dev, MTK_WDMA_RESET_IDX, MTK_WDMA_RESET_IDX_RX);
++	wdma_w32(dev, MTK_WDMA_RESET_IDX, 0);
++
+ 	for (i = 0; i < ARRAY_SIZE(dev->rx_wdma); i++) {
+ 		if (dev->rx_wdma[i].desc)
+ 			continue;
+@@ -119,6 +123,8 @@ mtk_wdma_rx_reset(struct mtk_wed_device
+ 		wdma_w32(dev,
+ 			 MTK_WDMA_RING_RX(i) + MTK_WED_RING_OFS_CPU_IDX, 0);
+ 	}
++
++	return ret;
+ }
+ 
+ static void
+@@ -565,9 +571,7 @@ mtk_wed_detach(struct mtk_wed_device *de
+ 
+ 	mtk_wed_stop(dev);
+ 
+-	wdma_w32(dev, MTK_WDMA_RESET_IDX, MTK_WDMA_RESET_IDX_RX);
+-	wdma_w32(dev, MTK_WDMA_RESET_IDX, 0);
+-
++	mtk_wdma_rx_reset(dev);
+ 	mtk_wed_reset(dev, MTK_WED_RESET_WED);
+ 	if (mtk_wed_get_rx_capa(dev)) {
+ 		wdma_clr(dev, MTK_WDMA_GLO_CFG, MTK_WDMA_GLO_CFG_TX_DMA_EN);
+@@ -582,7 +586,6 @@ mtk_wed_detach(struct mtk_wed_device *de
+ 		mtk_wed_wo_reset(dev);
+ 		mtk_wed_free_rx_rings(dev);
+ 		mtk_wed_wo_deinit(hw);
+-		mtk_wdma_rx_reset(dev);
+ 	}
+ 
+ 	if (dev->wlan.bus_type == MTK_WED_BUS_PCIE) {
+@@ -999,11 +1002,7 @@ mtk_wed_reset_dma(struct mtk_wed_device
+ 		wed_w32(dev, MTK_WED_RESET_IDX, 0);
+ 	}
+ 
+-	wdma_w32(dev, MTK_WDMA_RESET_IDX, MTK_WDMA_RESET_IDX_RX);
+-	wdma_w32(dev, MTK_WDMA_RESET_IDX, 0);
+-
+-	if (mtk_wed_get_rx_capa(dev))
+-		mtk_wdma_rx_reset(dev);
++	mtk_wdma_rx_reset(dev);
+ 
+ 	if (busy) {
+ 		mtk_wed_reset(dev, MTK_WED_RESET_WDMA_INT_AGENT);
diff --git a/target/linux/generic/backport-6.1/729-11-v6.2-net-ethernet-mtk_wed-move-MTK_WDMA_RESET_IDX_TX-conf.patch b/target/linux/generic/backport-6.1/729-11-v6.2-net-ethernet-mtk_wed-move-MTK_WDMA_RESET_IDX_TX-conf.patch
new file mode 100644
index 00000000000000..10c1732c969a9b
--- /dev/null
+++ b/target/linux/generic/backport-6.1/729-11-v6.2-net-ethernet-mtk_wed-move-MTK_WDMA_RESET_IDX_TX-conf.patch
@@ -0,0 +1,52 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 24 Nov 2022 16:22:52 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: move MTK_WDMA_RESET_IDX_TX
+ configuration in mtk_wdma_tx_reset
+
+Remove duplicated code. Increase poll timeout to 10ms in order to be
+aligned with vendor sdk.
+This is a preliminary patch to add Wireless Ethernet Dispatcher reset
+support.
+
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -135,16 +135,15 @@ mtk_wdma_tx_reset(struct mtk_wed_device
+ 
+ 	wdma_clr(dev, MTK_WDMA_GLO_CFG, MTK_WDMA_GLO_CFG_TX_DMA_EN);
+ 	if (readx_poll_timeout(mtk_wdma_read_reset, dev, status,
+-			       !(status & mask), 0, 1000))
++			       !(status & mask), 0, 10000))
+ 		dev_err(dev->hw->dev, "tx reset failed\n");
+ 
+-	for (i = 0; i < ARRAY_SIZE(dev->tx_wdma); i++) {
+-		if (dev->tx_wdma[i].desc)
+-			continue;
++	wdma_w32(dev, MTK_WDMA_RESET_IDX, MTK_WDMA_RESET_IDX_TX);
++	wdma_w32(dev, MTK_WDMA_RESET_IDX, 0);
+ 
++	for (i = 0; i < ARRAY_SIZE(dev->tx_wdma); i++)
+ 		wdma_w32(dev,
+ 			 MTK_WDMA_RING_TX(i) + MTK_WED_RING_OFS_CPU_IDX, 0);
+-	}
+ }
+ 
+ static void
+@@ -573,12 +572,6 @@ mtk_wed_detach(struct mtk_wed_device *de
+ 
+ 	mtk_wdma_rx_reset(dev);
+ 	mtk_wed_reset(dev, MTK_WED_RESET_WED);
+-	if (mtk_wed_get_rx_capa(dev)) {
+-		wdma_clr(dev, MTK_WDMA_GLO_CFG, MTK_WDMA_GLO_CFG_TX_DMA_EN);
+-		wdma_w32(dev, MTK_WDMA_RESET_IDX, MTK_WDMA_RESET_IDX_TX);
+-		wdma_w32(dev, MTK_WDMA_RESET_IDX, 0);
+-	}
+-
+ 	mtk_wed_free_tx_buffer(dev);
+ 	mtk_wed_free_tx_rings(dev);
+ 
diff --git a/target/linux/generic/backport-6.1/729-12-v6.2-net-ethernet-mtk_wed-update-mtk_wed_stop.patch b/target/linux/generic/backport-6.1/729-12-v6.2-net-ethernet-mtk_wed-update-mtk_wed_stop.patch
new file mode 100644
index 00000000000000..f4e842d515a8e1
--- /dev/null
+++ b/target/linux/generic/backport-6.1/729-12-v6.2-net-ethernet-mtk_wed-update-mtk_wed_stop.patch
@@ -0,0 +1,98 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 24 Nov 2022 16:22:53 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: update mtk_wed_stop
+
+Update mtk_wed_stop routine and rename old mtk_wed_stop() to
+mtk_wed_deinit(). This is a preliminary patch to add Wireless Ethernet
+Dispatcher reset support.
+
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -539,14 +539,8 @@ mtk_wed_dma_disable(struct mtk_wed_devic
+ static void
+ mtk_wed_stop(struct mtk_wed_device *dev)
+ {
+-	mtk_wed_dma_disable(dev);
+ 	mtk_wed_set_ext_int(dev, false);
+ 
+-	wed_clr(dev, MTK_WED_CTRL,
+-		MTK_WED_CTRL_WDMA_INT_AGENT_EN |
+-		MTK_WED_CTRL_WPDMA_INT_AGENT_EN |
+-		MTK_WED_CTRL_WED_TX_BM_EN |
+-		MTK_WED_CTRL_WED_TX_FREE_AGENT_EN);
+ 	wed_w32(dev, MTK_WED_WPDMA_INT_TRIGGER, 0);
+ 	wed_w32(dev, MTK_WED_WDMA_INT_TRIGGER, 0);
+ 	wdma_w32(dev, MTK_WDMA_INT_MASK, 0);
+@@ -558,7 +552,27 @@ mtk_wed_stop(struct mtk_wed_device *dev)
+ 
+ 	wed_w32(dev, MTK_WED_EXT_INT_MASK1, 0);
+ 	wed_w32(dev, MTK_WED_EXT_INT_MASK2, 0);
+-	wed_clr(dev, MTK_WED_CTRL, MTK_WED_CTRL_WED_RX_BM_EN);
++}
++
++static void
++mtk_wed_deinit(struct mtk_wed_device *dev)
++{
++	mtk_wed_stop(dev);
++	mtk_wed_dma_disable(dev);
++
++	wed_clr(dev, MTK_WED_CTRL,
++		MTK_WED_CTRL_WDMA_INT_AGENT_EN |
++		MTK_WED_CTRL_WPDMA_INT_AGENT_EN |
++		MTK_WED_CTRL_WED_TX_BM_EN |
++		MTK_WED_CTRL_WED_TX_FREE_AGENT_EN);
++
++	if (dev->hw->version == 1)
++		return;
++
++	wed_clr(dev, MTK_WED_CTRL,
++		MTK_WED_CTRL_RX_ROUTE_QM_EN |
++		MTK_WED_CTRL_WED_RX_BM_EN |
++		MTK_WED_CTRL_RX_RRO_QM_EN);
+ }
+ 
+ static void
+@@ -568,7 +582,7 @@ mtk_wed_detach(struct mtk_wed_device *de
+ 
+ 	mutex_lock(&hw_lock);
+ 
+-	mtk_wed_stop(dev);
++	mtk_wed_deinit(dev);
+ 
+ 	mtk_wdma_rx_reset(dev);
+ 	mtk_wed_reset(dev, MTK_WED_RESET_WED);
+@@ -670,7 +684,7 @@ mtk_wed_hw_init_early(struct mtk_wed_dev
+ {
+ 	u32 mask, set;
+ 
+-	mtk_wed_stop(dev);
++	mtk_wed_deinit(dev);
+ 	mtk_wed_reset(dev, MTK_WED_RESET_WED);
+ 	mtk_wed_set_wpdma(dev);
+ 
+--- a/include/linux/soc/mediatek/mtk_wed.h
++++ b/include/linux/soc/mediatek/mtk_wed.h
+@@ -234,6 +234,8 @@ mtk_wed_get_rx_capa(struct mtk_wed_devic
+ 	(_dev)->ops->ppe_check(_dev, _skb, _reason, _hash)
+ #define mtk_wed_device_update_msg(_dev, _id, _msg, _len) \
+ 	(_dev)->ops->msg_update(_dev, _id, _msg, _len)
++#define mtk_wed_device_stop(_dev) (_dev)->ops->stop(_dev)
++#define mtk_wed_device_dma_reset(_dev) (_dev)->ops->reset_dma(_dev)
+ #else
+ static inline bool mtk_wed_device_active(struct mtk_wed_device *dev)
+ {
+@@ -250,6 +252,8 @@ static inline bool mtk_wed_device_active
+ #define mtk_wed_device_rx_ring_setup(_dev, _ring, _regs) -ENODEV
+ #define mtk_wed_device_ppe_check(_dev, _skb, _reason, _hash)  do {} while (0)
+ #define mtk_wed_device_update_msg(_dev, _id, _msg, _len) -ENODEV
++#define mtk_wed_device_stop(_dev) do {} while (0)
++#define mtk_wed_device_dma_reset(_dev) do {} while (0)
+ #endif
+ 
+ #endif
diff --git a/target/linux/generic/backport-6.1/729-13-v6.2-net-ethernet-mtk_wed-add-mtk_wed_rx_reset-routine.patch b/target/linux/generic/backport-6.1/729-13-v6.2-net-ethernet-mtk_wed-add-mtk_wed_rx_reset-routine.patch
new file mode 100644
index 00000000000000..a0fc9da99e7fd5
--- /dev/null
+++ b/target/linux/generic/backport-6.1/729-13-v6.2-net-ethernet-mtk_wed-add-mtk_wed_rx_reset-routine.patch
@@ -0,0 +1,309 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 24 Nov 2022 16:22:54 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: add mtk_wed_rx_reset routine
+
+Introduce mtk_wed_rx_reset routine in order to reset rx DMA for Wireless
+Ethernet Dispatcher available on MT7986 SoC.
+
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -944,42 +944,130 @@ mtk_wed_ring_reset(struct mtk_wed_ring *
+ }
+ 
+ static u32
+-mtk_wed_check_busy(struct mtk_wed_device *dev)
++mtk_wed_check_busy(struct mtk_wed_device *dev, u32 reg, u32 mask)
+ {
+-	if (wed_r32(dev, MTK_WED_GLO_CFG) & MTK_WED_GLO_CFG_TX_DMA_BUSY)
+-		return true;
+-
+-	if (wed_r32(dev, MTK_WED_WPDMA_GLO_CFG) &
+-	    MTK_WED_WPDMA_GLO_CFG_TX_DRV_BUSY)
+-		return true;
+-
+-	if (wed_r32(dev, MTK_WED_CTRL) & MTK_WED_CTRL_WDMA_INT_AGENT_BUSY)
+-		return true;
+-
+-	if (wed_r32(dev, MTK_WED_WDMA_GLO_CFG) &
+-	    MTK_WED_WDMA_GLO_CFG_RX_DRV_BUSY)
+-		return true;
+-
+-	if (wdma_r32(dev, MTK_WDMA_GLO_CFG) &
+-	    MTK_WED_WDMA_GLO_CFG_RX_DRV_BUSY)
+-		return true;
+-
+-	if (wed_r32(dev, MTK_WED_CTRL) &
+-	    (MTK_WED_CTRL_WED_TX_BM_BUSY | MTK_WED_CTRL_WED_TX_FREE_AGENT_BUSY))
+-		return true;
+-
+-	return false;
++	return !!(wed_r32(dev, reg) & mask);
+ }
+ 
+ static int
+-mtk_wed_poll_busy(struct mtk_wed_device *dev)
++mtk_wed_poll_busy(struct mtk_wed_device *dev, u32 reg, u32 mask)
+ {
+ 	int sleep = 15000;
+ 	int timeout = 100 * sleep;
+ 	u32 val;
+ 
+ 	return read_poll_timeout(mtk_wed_check_busy, val, !val, sleep,
+-				 timeout, false, dev);
++				 timeout, false, dev, reg, mask);
++}
++
++static int
++mtk_wed_rx_reset(struct mtk_wed_device *dev)
++{
++	struct mtk_wed_wo *wo = dev->hw->wed_wo;
++	u8 val = MTK_WED_WO_STATE_SER_RESET;
++	int i, ret;
++
++	ret = mtk_wed_mcu_send_msg(wo, MTK_WED_MODULE_ID_WO,
++				   MTK_WED_WO_CMD_CHANGE_STATE, &val,
++				   sizeof(val), true);
++	if (ret)
++		return ret;
++
++	wed_clr(dev, MTK_WED_WPDMA_RX_D_GLO_CFG, MTK_WED_WPDMA_RX_D_RX_DRV_EN);
++	ret = mtk_wed_poll_busy(dev, MTK_WED_WPDMA_RX_D_GLO_CFG,
++				MTK_WED_WPDMA_RX_D_RX_DRV_BUSY);
++	if (ret) {
++		mtk_wed_reset(dev, MTK_WED_RESET_WPDMA_INT_AGENT);
++		mtk_wed_reset(dev, MTK_WED_RESET_WPDMA_RX_D_DRV);
++	} else {
++		wed_w32(dev, MTK_WED_WPDMA_RX_D_RST_IDX,
++			MTK_WED_WPDMA_RX_D_RST_CRX_IDX |
++			MTK_WED_WPDMA_RX_D_RST_DRV_IDX);
++
++		wed_set(dev, MTK_WED_WPDMA_RX_D_GLO_CFG,
++			MTK_WED_WPDMA_RX_D_RST_INIT_COMPLETE |
++			MTK_WED_WPDMA_RX_D_FSM_RETURN_IDLE);
++		wed_clr(dev, MTK_WED_WPDMA_RX_D_GLO_CFG,
++			MTK_WED_WPDMA_RX_D_RST_INIT_COMPLETE |
++			MTK_WED_WPDMA_RX_D_FSM_RETURN_IDLE);
++
++		wed_w32(dev, MTK_WED_WPDMA_RX_D_RST_IDX, 0);
++	}
++
++	/* reset rro qm */
++	wed_clr(dev, MTK_WED_CTRL, MTK_WED_CTRL_RX_RRO_QM_EN);
++	ret = mtk_wed_poll_busy(dev, MTK_WED_CTRL,
++				MTK_WED_CTRL_RX_RRO_QM_BUSY);
++	if (ret) {
++		mtk_wed_reset(dev, MTK_WED_RESET_RX_RRO_QM);
++	} else {
++		wed_set(dev, MTK_WED_RROQM_RST_IDX,
++			MTK_WED_RROQM_RST_IDX_MIOD |
++			MTK_WED_RROQM_RST_IDX_FDBK);
++		wed_w32(dev, MTK_WED_RROQM_RST_IDX, 0);
++	}
++
++	/* reset route qm */
++	wed_clr(dev, MTK_WED_CTRL, MTK_WED_CTRL_RX_ROUTE_QM_EN);
++	ret = mtk_wed_poll_busy(dev, MTK_WED_CTRL,
++				MTK_WED_CTRL_RX_ROUTE_QM_BUSY);
++	if (ret)
++		mtk_wed_reset(dev, MTK_WED_RESET_RX_ROUTE_QM);
++	else
++		wed_set(dev, MTK_WED_RTQM_GLO_CFG,
++			MTK_WED_RTQM_Q_RST);
++
++	/* reset tx wdma */
++	mtk_wdma_tx_reset(dev);
++
++	/* reset tx wdma drv */
++	wed_clr(dev, MTK_WED_WDMA_GLO_CFG, MTK_WED_WDMA_GLO_CFG_TX_DRV_EN);
++	mtk_wed_poll_busy(dev, MTK_WED_CTRL,
++			  MTK_WED_CTRL_WDMA_INT_AGENT_BUSY);
++	mtk_wed_reset(dev, MTK_WED_RESET_WDMA_TX_DRV);
++
++	/* reset wed rx dma */
++	ret = mtk_wed_poll_busy(dev, MTK_WED_GLO_CFG,
++				MTK_WED_GLO_CFG_RX_DMA_BUSY);
++	wed_clr(dev, MTK_WED_GLO_CFG, MTK_WED_GLO_CFG_RX_DMA_EN);
++	if (ret) {
++		mtk_wed_reset(dev, MTK_WED_RESET_WED_RX_DMA);
++	} else {
++		struct mtk_eth *eth = dev->hw->eth;
++
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++			wed_set(dev, MTK_WED_RESET_IDX,
++				MTK_WED_RESET_IDX_RX_V2);
++		else
++			wed_set(dev, MTK_WED_RESET_IDX, MTK_WED_RESET_IDX_RX);
++		wed_w32(dev, MTK_WED_RESET_IDX, 0);
++	}
++
++	/* reset rx bm */
++	wed_clr(dev, MTK_WED_CTRL, MTK_WED_CTRL_WED_RX_BM_EN);
++	mtk_wed_poll_busy(dev, MTK_WED_CTRL,
++			  MTK_WED_CTRL_WED_RX_BM_BUSY);
++	mtk_wed_reset(dev, MTK_WED_RESET_RX_BM);
++
++	/* wo change to enable state */
++	val = MTK_WED_WO_STATE_ENABLE;
++	ret = mtk_wed_mcu_send_msg(wo, MTK_WED_MODULE_ID_WO,
++				   MTK_WED_WO_CMD_CHANGE_STATE, &val,
++				   sizeof(val), true);
++	if (ret)
++		return ret;
++
++	/* wed_rx_ring_reset */
++	for (i = 0; i < ARRAY_SIZE(dev->rx_ring); i++) {
++		if (!dev->rx_ring[i].desc)
++			continue;
++
++		mtk_wed_ring_reset(&dev->rx_ring[i], MTK_WED_RX_RING_SIZE,
++				   false);
++	}
++	mtk_wed_free_rx_buffer(dev);
++
++	return 0;
+ }
+ 
+ static void
+@@ -997,19 +1085,23 @@ mtk_wed_reset_dma(struct mtk_wed_device
+ 				   true);
+ 	}
+ 
+-	if (mtk_wed_poll_busy(dev))
+-		busy = mtk_wed_check_busy(dev);
+-
++	/* 1. reset WED tx DMA */
++	wed_clr(dev, MTK_WED_GLO_CFG, MTK_WED_GLO_CFG_TX_DMA_EN);
++	busy = mtk_wed_poll_busy(dev, MTK_WED_GLO_CFG,
++				 MTK_WED_GLO_CFG_TX_DMA_BUSY);
+ 	if (busy) {
+ 		mtk_wed_reset(dev, MTK_WED_RESET_WED_TX_DMA);
+ 	} else {
+-		wed_w32(dev, MTK_WED_RESET_IDX,
+-			MTK_WED_RESET_IDX_TX |
+-			MTK_WED_RESET_IDX_RX);
++		wed_w32(dev, MTK_WED_RESET_IDX, MTK_WED_RESET_IDX_TX);
+ 		wed_w32(dev, MTK_WED_RESET_IDX, 0);
+ 	}
+ 
+-	mtk_wdma_rx_reset(dev);
++	/* 2. reset WDMA rx DMA */
++	busy = !!mtk_wdma_rx_reset(dev);
++	wed_clr(dev, MTK_WED_WDMA_GLO_CFG, MTK_WED_WDMA_GLO_CFG_RX_DRV_EN);
++	if (!busy)
++		busy = mtk_wed_poll_busy(dev, MTK_WED_WDMA_GLO_CFG,
++					 MTK_WED_WDMA_GLO_CFG_RX_DRV_BUSY);
+ 
+ 	if (busy) {
+ 		mtk_wed_reset(dev, MTK_WED_RESET_WDMA_INT_AGENT);
+@@ -1026,6 +1118,9 @@ mtk_wed_reset_dma(struct mtk_wed_device
+ 			MTK_WED_WDMA_GLO_CFG_RST_INIT_COMPLETE);
+ 	}
+ 
++	/* 3. reset WED WPDMA tx */
++	wed_clr(dev, MTK_WED_CTRL, MTK_WED_CTRL_WED_TX_FREE_AGENT_EN);
++
+ 	for (i = 0; i < 100; i++) {
+ 		val = wed_r32(dev, MTK_WED_TX_BM_INTF);
+ 		if (FIELD_GET(MTK_WED_TX_BM_INTF_TKFIFO_FDEP, val) == 0x40)
+@@ -1033,8 +1128,19 @@ mtk_wed_reset_dma(struct mtk_wed_device
+ 	}
+ 
+ 	mtk_wed_reset(dev, MTK_WED_RESET_TX_FREE_AGENT);
++	wed_clr(dev, MTK_WED_CTRL, MTK_WED_CTRL_WED_TX_BM_EN);
+ 	mtk_wed_reset(dev, MTK_WED_RESET_TX_BM);
+ 
++	/* 4. reset WED WPDMA tx */
++	busy = mtk_wed_poll_busy(dev, MTK_WED_WPDMA_GLO_CFG,
++				 MTK_WED_WPDMA_GLO_CFG_TX_DRV_BUSY);
++	wed_clr(dev, MTK_WED_WPDMA_GLO_CFG,
++		MTK_WED_WPDMA_GLO_CFG_TX_DRV_EN |
++		MTK_WED_WPDMA_GLO_CFG_RX_DRV_EN);
++	if (!busy)
++		busy = mtk_wed_poll_busy(dev, MTK_WED_WPDMA_GLO_CFG,
++					 MTK_WED_WPDMA_GLO_CFG_RX_DRV_BUSY);
++
+ 	if (busy) {
+ 		mtk_wed_reset(dev, MTK_WED_RESET_WPDMA_INT_AGENT);
+ 		mtk_wed_reset(dev, MTK_WED_RESET_WPDMA_TX_DRV);
+@@ -1045,6 +1151,17 @@ mtk_wed_reset_dma(struct mtk_wed_device
+ 			MTK_WED_WPDMA_RESET_IDX_RX);
+ 		wed_w32(dev, MTK_WED_WPDMA_RESET_IDX, 0);
+ 	}
++
++	dev->init_done = false;
++	if (dev->hw->version == 1)
++		return;
++
++	if (!busy) {
++		wed_w32(dev, MTK_WED_RESET_IDX, MTK_WED_RESET_WPDMA_IDX_RX);
++		wed_w32(dev, MTK_WED_RESET_IDX, 0);
++	}
++
++	mtk_wed_rx_reset(dev);
+ }
+ 
+ static int
+@@ -1267,6 +1384,9 @@ mtk_wed_start(struct mtk_wed_device *dev
+ {
+ 	int i;
+ 
++	if (mtk_wed_get_rx_capa(dev) && mtk_wed_rx_buffer_alloc(dev))
++		return;
++
+ 	for (i = 0; i < ARRAY_SIZE(dev->rx_wdma); i++)
+ 		if (!dev->rx_wdma[i].desc)
+ 			mtk_wed_wdma_rx_ring_setup(dev, i, 16);
+@@ -1355,10 +1475,6 @@ mtk_wed_attach(struct mtk_wed_device *de
+ 		goto out;
+ 
+ 	if (mtk_wed_get_rx_capa(dev)) {
+-		ret = mtk_wed_rx_buffer_alloc(dev);
+-		if (ret)
+-			goto out;
+-
+ 		ret = mtk_wed_rro_alloc(dev);
+ 		if (ret)
+ 			goto out;
+--- a/drivers/net/ethernet/mediatek/mtk_wed_regs.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_regs.h
+@@ -24,11 +24,15 @@ struct mtk_wdma_desc {
+ 
+ #define MTK_WED_RESET					0x008
+ #define MTK_WED_RESET_TX_BM				BIT(0)
++#define MTK_WED_RESET_RX_BM				BIT(1)
+ #define MTK_WED_RESET_TX_FREE_AGENT			BIT(4)
+ #define MTK_WED_RESET_WPDMA_TX_DRV			BIT(8)
+ #define MTK_WED_RESET_WPDMA_RX_DRV			BIT(9)
++#define MTK_WED_RESET_WPDMA_RX_D_DRV			BIT(10)
+ #define MTK_WED_RESET_WPDMA_INT_AGENT			BIT(11)
+ #define MTK_WED_RESET_WED_TX_DMA			BIT(12)
++#define MTK_WED_RESET_WED_RX_DMA			BIT(13)
++#define MTK_WED_RESET_WDMA_TX_DRV			BIT(16)
+ #define MTK_WED_RESET_WDMA_RX_DRV			BIT(17)
+ #define MTK_WED_RESET_WDMA_INT_AGENT			BIT(19)
+ #define MTK_WED_RESET_RX_RRO_QM				BIT(20)
+@@ -158,6 +162,8 @@ struct mtk_wdma_desc {
+ #define MTK_WED_RESET_IDX				0x20c
+ #define MTK_WED_RESET_IDX_TX				GENMASK(3, 0)
+ #define MTK_WED_RESET_IDX_RX				GENMASK(17, 16)
++#define MTK_WED_RESET_IDX_RX_V2				GENMASK(7, 6)
++#define MTK_WED_RESET_WPDMA_IDX_RX			GENMASK(31, 30)
+ 
+ #define MTK_WED_TX_MIB(_n)				(0x2a0 + (_n) * 4)
+ #define MTK_WED_RX_MIB(_n)				(0x2e0 + (_n) * 4)
+@@ -267,6 +273,9 @@ struct mtk_wdma_desc {
+ 
+ #define MTK_WED_WPDMA_RX_D_GLO_CFG			0x75c
+ #define MTK_WED_WPDMA_RX_D_RX_DRV_EN			BIT(0)
++#define MTK_WED_WPDMA_RX_D_RX_DRV_BUSY			BIT(1)
++#define MTK_WED_WPDMA_RX_D_FSM_RETURN_IDLE		BIT(3)
++#define MTK_WED_WPDMA_RX_D_RST_INIT_COMPLETE		BIT(4)
+ #define MTK_WED_WPDMA_RX_D_INIT_PHASE_RXEN_SEL		GENMASK(11, 7)
+ #define MTK_WED_WPDMA_RX_D_RXD_READ_LEN			GENMASK(31, 24)
+ 
diff --git a/target/linux/generic/backport-6.1/729-14-v6.2-net-ethernet-mtk_wed-add-reset-to-tx_ring_setup-call.patch b/target/linux/generic/backport-6.1/729-14-v6.2-net-ethernet-mtk_wed-add-reset-to-tx_ring_setup-call.patch
new file mode 100644
index 00000000000000..4404971cc74dde
--- /dev/null
+++ b/target/linux/generic/backport-6.1/729-14-v6.2-net-ethernet-mtk_wed-add-reset-to-tx_ring_setup-call.patch
@@ -0,0 +1,103 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 24 Nov 2022 16:22:55 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: add reset to tx_ring_setup callback
+
+Introduce reset parameter to mtk_wed_tx_ring_setup signature.
+This is a preliminary patch to add Wireless Ethernet Dispatcher reset
+support.
+
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -1181,7 +1181,8 @@ mtk_wed_ring_alloc(struct mtk_wed_device
+ }
+ 
+ static int
+-mtk_wed_wdma_rx_ring_setup(struct mtk_wed_device *dev, int idx, int size)
++mtk_wed_wdma_rx_ring_setup(struct mtk_wed_device *dev, int idx, int size,
++			   bool reset)
+ {
+ 	u32 desc_size = sizeof(struct mtk_wdma_desc) * dev->hw->version;
+ 	struct mtk_wed_ring *wdma;
+@@ -1190,8 +1191,8 @@ mtk_wed_wdma_rx_ring_setup(struct mtk_we
+ 		return -EINVAL;
+ 
+ 	wdma = &dev->rx_wdma[idx];
+-	if (mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE, desc_size,
+-			       true))
++	if (!reset && mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE,
++					 desc_size, true))
+ 		return -ENOMEM;
+ 
+ 	wdma_w32(dev, MTK_WDMA_RING_RX(idx) + MTK_WED_RING_OFS_BASE,
+@@ -1389,7 +1390,7 @@ mtk_wed_start(struct mtk_wed_device *dev
+ 
+ 	for (i = 0; i < ARRAY_SIZE(dev->rx_wdma); i++)
+ 		if (!dev->rx_wdma[i].desc)
+-			mtk_wed_wdma_rx_ring_setup(dev, i, 16);
++			mtk_wed_wdma_rx_ring_setup(dev, i, 16, false);
+ 
+ 	mtk_wed_hw_init(dev);
+ 	mtk_wed_configure_irq(dev, irq_mask);
+@@ -1498,7 +1499,8 @@ unlock:
+ }
+ 
+ static int
+-mtk_wed_tx_ring_setup(struct mtk_wed_device *dev, int idx, void __iomem *regs)
++mtk_wed_tx_ring_setup(struct mtk_wed_device *dev, int idx, void __iomem *regs,
++		      bool reset)
+ {
+ 	struct mtk_wed_ring *ring = &dev->tx_ring[idx];
+ 
+@@ -1517,11 +1519,12 @@ mtk_wed_tx_ring_setup(struct mtk_wed_dev
+ 	if (WARN_ON(idx >= ARRAY_SIZE(dev->tx_ring)))
+ 		return -EINVAL;
+ 
+-	if (mtk_wed_ring_alloc(dev, ring, MTK_WED_TX_RING_SIZE,
+-			       sizeof(*ring->desc), true))
++	if (!reset && mtk_wed_ring_alloc(dev, ring, MTK_WED_TX_RING_SIZE,
++					 sizeof(*ring->desc), true))
+ 		return -ENOMEM;
+ 
+-	if (mtk_wed_wdma_rx_ring_setup(dev, idx, MTK_WED_WDMA_RING_SIZE))
++	if (mtk_wed_wdma_rx_ring_setup(dev, idx, MTK_WED_WDMA_RING_SIZE,
++				       reset))
+ 		return -ENOMEM;
+ 
+ 	ring->reg_base = MTK_WED_RING_TX(idx);
+--- a/include/linux/soc/mediatek/mtk_wed.h
++++ b/include/linux/soc/mediatek/mtk_wed.h
+@@ -158,7 +158,7 @@ struct mtk_wed_device {
+ struct mtk_wed_ops {
+ 	int (*attach)(struct mtk_wed_device *dev);
+ 	int (*tx_ring_setup)(struct mtk_wed_device *dev, int ring,
+-			     void __iomem *regs);
++			     void __iomem *regs, bool reset);
+ 	int (*rx_ring_setup)(struct mtk_wed_device *dev, int ring,
+ 			     void __iomem *regs);
+ 	int (*txfree_ring_setup)(struct mtk_wed_device *dev,
+@@ -216,8 +216,8 @@ mtk_wed_get_rx_capa(struct mtk_wed_devic
+ #define mtk_wed_device_active(_dev) !!(_dev)->ops
+ #define mtk_wed_device_detach(_dev) (_dev)->ops->detach(_dev)
+ #define mtk_wed_device_start(_dev, _mask) (_dev)->ops->start(_dev, _mask)
+-#define mtk_wed_device_tx_ring_setup(_dev, _ring, _regs) \
+-	(_dev)->ops->tx_ring_setup(_dev, _ring, _regs)
++#define mtk_wed_device_tx_ring_setup(_dev, _ring, _regs, _reset) \
++	(_dev)->ops->tx_ring_setup(_dev, _ring, _regs, _reset)
+ #define mtk_wed_device_txfree_ring_setup(_dev, _regs) \
+ 	(_dev)->ops->txfree_ring_setup(_dev, _regs)
+ #define mtk_wed_device_reg_read(_dev, _reg) \
+@@ -243,7 +243,7 @@ static inline bool mtk_wed_device_active
+ }
+ #define mtk_wed_device_detach(_dev) do {} while (0)
+ #define mtk_wed_device_start(_dev, _mask) do {} while (0)
+-#define mtk_wed_device_tx_ring_setup(_dev, _ring, _regs) -ENODEV
++#define mtk_wed_device_tx_ring_setup(_dev, _ring, _regs, _reset) -ENODEV
+ #define mtk_wed_device_txfree_ring_setup(_dev, _ring, _regs) -ENODEV
+ #define mtk_wed_device_reg_read(_dev, _reg) 0
+ #define mtk_wed_device_reg_write(_dev, _reg, _val) do {} while (0)
diff --git a/target/linux/generic/backport-6.1/729-15-v6.2-net-ethernet-mtk_wed-fix-sleep-while-atomic-in-mtk_w.patch b/target/linux/generic/backport-6.1/729-15-v6.2-net-ethernet-mtk_wed-fix-sleep-while-atomic-in-mtk_w.patch
new file mode 100644
index 00000000000000..f9b11326b1c88e
--- /dev/null
+++ b/target/linux/generic/backport-6.1/729-15-v6.2-net-ethernet-mtk_wed-fix-sleep-while-atomic-in-mtk_w.patch
@@ -0,0 +1,103 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 1 Dec 2022 16:26:53 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: fix sleep while atomic in
+ mtk_wed_wo_queue_refill
+
+In order to fix the following sleep while atomic bug always alloc pages
+with GFP_ATOMIC in mtk_wed_wo_queue_refill since page_frag_alloc runs in
+spin_lock critical section.
+
+[    9.049719] Hardware name: MediaTek MT7986a RFB (DT)
+[    9.054665] Call trace:
+[    9.057096]  dump_backtrace+0x0/0x154
+[    9.060751]  show_stack+0x14/0x1c
+[    9.064052]  dump_stack_lvl+0x64/0x7c
+[    9.067702]  dump_stack+0x14/0x2c
+[    9.071001]  ___might_sleep+0xec/0x120
+[    9.074736]  __might_sleep+0x4c/0x9c
+[    9.078296]  __alloc_pages+0x184/0x2e4
+[    9.082030]  page_frag_alloc_align+0x98/0x1ac
+[    9.086369]  mtk_wed_wo_queue_refill+0x134/0x234
+[    9.090974]  mtk_wed_wo_init+0x174/0x2c0
+[    9.094881]  mtk_wed_attach+0x7c8/0x7e0
+[    9.098701]  mt7915_mmio_wed_init+0x1f0/0x3a0 [mt7915e]
+[    9.103940]  mt7915_pci_probe+0xec/0x3bc [mt7915e]
+[    9.108727]  pci_device_probe+0xac/0x13c
+[    9.112638]  really_probe.part.0+0x98/0x2f4
+[    9.116807]  __driver_probe_device+0x94/0x13c
+[    9.121147]  driver_probe_device+0x40/0x114
+[    9.125314]  __driver_attach+0x7c/0x180
+[    9.129133]  bus_for_each_dev+0x5c/0x90
+[    9.132953]  driver_attach+0x20/0x2c
+[    9.136513]  bus_add_driver+0x104/0x1fc
+[    9.140333]  driver_register+0x74/0x120
+[    9.144153]  __pci_register_driver+0x40/0x50
+[    9.148407]  mt7915_init+0x5c/0x1000 [mt7915e]
+[    9.152848]  do_one_initcall+0x40/0x25c
+[    9.156669]  do_init_module+0x44/0x230
+[    9.160403]  load_module+0x1f30/0x2750
+[    9.164135]  __do_sys_init_module+0x150/0x200
+[    9.168475]  __arm64_sys_init_module+0x18/0x20
+[    9.172901]  invoke_syscall.constprop.0+0x4c/0xe0
+[    9.177589]  do_el0_svc+0x48/0xe0
+[    9.180889]  el0_svc+0x14/0x50
+[    9.183929]  el0t_64_sync_handler+0x9c/0x120
+[    9.188183]  el0t_64_sync+0x158/0x15c
+
+Fixes: 799684448e3e ("net: ethernet: mtk_wed: introduce wed wo support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Link: https://lore.kernel.org/r/67ca94bdd3d9eaeb86e52b3050fbca0bcf7bb02f.1669908312.git.lorenzo@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed_wo.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.c
+@@ -133,17 +133,18 @@ mtk_wed_wo_dequeue(struct mtk_wed_wo *wo
+ 
+ static int
+ mtk_wed_wo_queue_refill(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q,
+-			gfp_t gfp, bool rx)
++			bool rx)
+ {
+ 	enum dma_data_direction dir = rx ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
+ 	int n_buf = 0;
+ 
+ 	spin_lock_bh(&q->lock);
+ 	while (q->queued < q->n_desc) {
+-		void *buf = page_frag_alloc(&q->cache, q->buf_size, gfp);
+ 		struct mtk_wed_wo_queue_entry *entry;
+ 		dma_addr_t addr;
++		void *buf;
+ 
++		buf = page_frag_alloc(&q->cache, q->buf_size, GFP_ATOMIC);
+ 		if (!buf)
+ 			break;
+ 
+@@ -215,7 +216,7 @@ mtk_wed_wo_rx_run_queue(struct mtk_wed_w
+ 			mtk_wed_mcu_rx_unsolicited_event(wo, skb);
+ 	}
+ 
+-	if (mtk_wed_wo_queue_refill(wo, q, GFP_ATOMIC, true)) {
++	if (mtk_wed_wo_queue_refill(wo, q, true)) {
+ 		u32 index = (q->head - 1) % q->n_desc;
+ 
+ 		mtk_wed_wo_queue_kick(wo, q, index);
+@@ -432,7 +433,7 @@ mtk_wed_wo_hardware_init(struct mtk_wed_
+ 	if (ret)
+ 		goto error;
+ 
+-	mtk_wed_wo_queue_refill(wo, &wo->q_tx, GFP_KERNEL, false);
++	mtk_wed_wo_queue_refill(wo, &wo->q_tx, false);
+ 	mtk_wed_wo_queue_reset(wo, &wo->q_tx);
+ 
+ 	regs.desc_base = MTK_WED_WO_CCIF_DUMMY5;
+@@ -446,7 +447,7 @@ mtk_wed_wo_hardware_init(struct mtk_wed_
+ 	if (ret)
+ 		goto error;
+ 
+-	mtk_wed_wo_queue_refill(wo, &wo->q_rx, GFP_KERNEL, true);
++	mtk_wed_wo_queue_refill(wo, &wo->q_rx, true);
+ 	mtk_wed_wo_queue_reset(wo, &wo->q_rx);
+ 
+ 	/* rx queue irqmask */
diff --git a/target/linux/generic/backport-6.1/729-16-v6.3-net-ethernet-mtk_wed-get-rid-of-queue-lock-for-rx-qu.patch b/target/linux/generic/backport-6.1/729-16-v6.3-net-ethernet-mtk_wed-get-rid-of-queue-lock-for-rx-qu.patch
new file mode 100644
index 00000000000000..fa6f56dbe7249d
--- /dev/null
+++ b/target/linux/generic/backport-6.1/729-16-v6.3-net-ethernet-mtk_wed-get-rid-of-queue-lock-for-rx-qu.patch
@@ -0,0 +1,52 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 10 Jan 2023 10:31:26 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: get rid of queue lock for rx queue
+
+Queue spinlock is currently held in mtk_wed_wo_queue_rx_clean and
+mtk_wed_wo_queue_refill routines for MTK Wireless Ethernet Dispatcher
+MCU rx queue. mtk_wed_wo_queue_refill() is running during initialization
+and in rx tasklet while mtk_wed_wo_queue_rx_clean() is running in
+mtk_wed_wo_hw_deinit() during hw de-init phase after rx tasklet has been
+disabled. Since mtk_wed_wo_queue_rx_clean and mtk_wed_wo_queue_refill
+routines can't run concurrently get rid of spinlock for mcu rx queue.
+
+Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/36ec3b729542ea60898471d890796f745479ba32.1673342990.git.lorenzo@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed_wo.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.c
+@@ -138,7 +138,6 @@ mtk_wed_wo_queue_refill(struct mtk_wed_w
+ 	enum dma_data_direction dir = rx ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
+ 	int n_buf = 0;
+ 
+-	spin_lock_bh(&q->lock);
+ 	while (q->queued < q->n_desc) {
+ 		struct mtk_wed_wo_queue_entry *entry;
+ 		dma_addr_t addr;
+@@ -172,7 +171,6 @@ mtk_wed_wo_queue_refill(struct mtk_wed_w
+ 		q->queued++;
+ 		n_buf++;
+ 	}
+-	spin_unlock_bh(&q->lock);
+ 
+ 	return n_buf;
+ }
+@@ -316,7 +314,6 @@ mtk_wed_wo_queue_rx_clean(struct mtk_wed
+ {
+ 	struct page *page;
+ 
+-	spin_lock_bh(&q->lock);
+ 	for (;;) {
+ 		void *buf = mtk_wed_wo_dequeue(wo, q, NULL, true);
+ 
+@@ -325,7 +322,6 @@ mtk_wed_wo_queue_rx_clean(struct mtk_wed
+ 
+ 		skb_free_frag(buf);
+ 	}
+-	spin_unlock_bh(&q->lock);
+ 
+ 	if (!q->cache.va)
+ 		return;
diff --git a/target/linux/generic/backport-6.1/729-17-v6.3-net-ethernet-mtk_wed-get-rid-of-queue-lock-for-tx-qu.patch b/target/linux/generic/backport-6.1/729-17-v6.3-net-ethernet-mtk_wed-get-rid-of-queue-lock-for-tx-qu.patch
new file mode 100644
index 00000000000000..9b1e4c3250705f
--- /dev/null
+++ b/target/linux/generic/backport-6.1/729-17-v6.3-net-ethernet-mtk_wed-get-rid-of-queue-lock-for-tx-qu.patch
@@ -0,0 +1,75 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 12 Jan 2023 10:21:29 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: get rid of queue lock for tx queue
+
+Similar to MTK Wireless Ethernet Dispatcher (WED) MCU rx queue,
+we do not need to protect WED MCU tx queue with a spin lock since
+the tx queue is accessed in the two following routines:
+- mtk_wed_wo_queue_tx_skb():
+  it is run at initialization and during mt7915 normal operation.
+  Moreover MCU messages are serialized through MCU mutex.
+- mtk_wed_wo_queue_tx_clean():
+  it runs just at mt7915 driver module unload when no more messages
+  are sent to the MCU.
+
+Remove tx queue spinlock.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/7bd0337b2a13ab1a63673b7c03fd35206b3b284e.1673515140.git.lorenzo@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed_wo.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.c
+@@ -258,7 +258,6 @@ mtk_wed_wo_queue_alloc(struct mtk_wed_wo
+ 		       int n_desc, int buf_size, int index,
+ 		       struct mtk_wed_wo_queue_regs *regs)
+ {
+-	spin_lock_init(&q->lock);
+ 	q->regs = *regs;
+ 	q->n_desc = n_desc;
+ 	q->buf_size = buf_size;
+@@ -290,7 +289,6 @@ mtk_wed_wo_queue_tx_clean(struct mtk_wed
+ 	struct page *page;
+ 	int i;
+ 
+-	spin_lock_bh(&q->lock);
+ 	for (i = 0; i < q->n_desc; i++) {
+ 		struct mtk_wed_wo_queue_entry *entry = &q->entry[i];
+ 
+@@ -299,7 +297,6 @@ mtk_wed_wo_queue_tx_clean(struct mtk_wed
+ 		skb_free_frag(entry->buf);
+ 		entry->buf = NULL;
+ 	}
+-	spin_unlock_bh(&q->lock);
+ 
+ 	if (!q->cache.va)
+ 		return;
+@@ -347,8 +344,6 @@ int mtk_wed_wo_queue_tx_skb(struct mtk_w
+ 	int ret = 0, index;
+ 	u32 ctrl;
+ 
+-	spin_lock_bh(&q->lock);
+-
+ 	q->tail = mtk_wed_mmio_r32(wo, q->regs.dma_idx);
+ 	index = (q->head + 1) % q->n_desc;
+ 	if (q->tail == index) {
+@@ -379,8 +374,6 @@ int mtk_wed_wo_queue_tx_skb(struct mtk_w
+ 	mtk_wed_wo_queue_kick(wo, q, q->head);
+ 	mtk_wed_wo_kickout(wo);
+ out:
+-	spin_unlock_bh(&q->lock);
+-
+ 	dev_kfree_skb(skb);
+ 
+ 	return ret;
+--- a/drivers/net/ethernet/mediatek/mtk_wed_wo.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.h
+@@ -211,7 +211,6 @@ struct mtk_wed_wo_queue {
+ 	struct mtk_wed_wo_queue_regs regs;
+ 
+ 	struct page_frag_cache cache;
+-	spinlock_t lock;
+ 
+ 	struct mtk_wed_wo_queue_desc *desc;
+ 	dma_addr_t desc_dma;
diff --git a/target/linux/generic/backport-6.1/729-18-v6.3-net-ethernet-mtk_eth_soc-introduce-mtk_hw_reset-util.patch b/target/linux/generic/backport-6.1/729-18-v6.3-net-ethernet-mtk_eth_soc-introduce-mtk_hw_reset-util.patch
new file mode 100644
index 00000000000000..ce64f84ffbdcf2
--- /dev/null
+++ b/target/linux/generic/backport-6.1/729-18-v6.3-net-ethernet-mtk_eth_soc-introduce-mtk_hw_reset-util.patch
@@ -0,0 +1,70 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 14 Jan 2023 18:01:28 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: introduce mtk_hw_reset utility
+ routine
+
+This is a preliminary patch to add Wireless Ethernet Dispatcher reset
+support.
+
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3254,6 +3254,27 @@ static void mtk_set_mcr_max_rx(struct mt
+ 		mtk_w32(mac->hw, mcr_new, MTK_MAC_MCR(mac->id));
+ }
+ 
++static void mtk_hw_reset(struct mtk_eth *eth)
++{
++	u32 val;
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++		regmap_write(eth->ethsys, ETHSYS_FE_RST_CHK_IDLE_EN, 0);
++		val = RSTCTRL_PPE0_V2;
++	} else {
++		val = RSTCTRL_PPE0;
++	}
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_RSTCTRL_PPE1))
++		val |= RSTCTRL_PPE1;
++
++	ethsys_reset(eth, RSTCTRL_ETH | RSTCTRL_FE | val);
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++		regmap_write(eth->ethsys, ETHSYS_FE_RST_CHK_IDLE_EN,
++			     0x3ffffff);
++}
++
+ static int mtk_hw_init(struct mtk_eth *eth)
+ {
+ 	u32 dma_mask = ETHSYS_DMA_AG_MAP_PDMA | ETHSYS_DMA_AG_MAP_QDMA |
+@@ -3293,22 +3314,9 @@ static int mtk_hw_init(struct mtk_eth *e
+ 		return 0;
+ 	}
+ 
+-	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+-		regmap_write(eth->ethsys, ETHSYS_FE_RST_CHK_IDLE_EN, 0);
+-		val = RSTCTRL_PPE0_V2;
+-	} else {
+-		val = RSTCTRL_PPE0;
+-	}
+-
+-	if (MTK_HAS_CAPS(eth->soc->caps, MTK_RSTCTRL_PPE1))
+-		val |= RSTCTRL_PPE1;
+-
+-	ethsys_reset(eth, RSTCTRL_ETH | RSTCTRL_FE | val);
++	mtk_hw_reset(eth);
+ 
+ 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+-		regmap_write(eth->ethsys, ETHSYS_FE_RST_CHK_IDLE_EN,
+-			     0x3ffffff);
+-
+ 		/* Set FE to PDMAv2 if necessary */
+ 		val = mtk_r32(eth, MTK_FE_GLO_MISC);
+ 		mtk_w32(eth,  val | BIT(4), MTK_FE_GLO_MISC);
diff --git a/target/linux/generic/backport-6.1/729-19-v6.3-net-ethernet-mtk_eth_soc-introduce-mtk_hw_warm_reset.patch b/target/linux/generic/backport-6.1/729-19-v6.3-net-ethernet-mtk_eth_soc-introduce-mtk_hw_warm_reset.patch
new file mode 100644
index 00000000000000..09ee03706b7d5e
--- /dev/null
+++ b/target/linux/generic/backport-6.1/729-19-v6.3-net-ethernet-mtk_eth_soc-introduce-mtk_hw_warm_reset.patch
@@ -0,0 +1,107 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 14 Jan 2023 18:01:29 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: introduce mtk_hw_warm_reset
+ support
+
+Introduce mtk_hw_warm_reset utility routine. This is a preliminary patch
+to align reset procedure to vendor sdk and avoid to power down the chip
+during hw reset.
+
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3275,7 +3275,54 @@ static void mtk_hw_reset(struct mtk_eth
+ 			     0x3ffffff);
+ }
+ 
+-static int mtk_hw_init(struct mtk_eth *eth)
++static u32 mtk_hw_reset_read(struct mtk_eth *eth)
++{
++	u32 val;
++
++	regmap_read(eth->ethsys, ETHSYS_RSTCTRL, &val);
++	return val;
++}
++
++static void mtk_hw_warm_reset(struct mtk_eth *eth)
++{
++	u32 rst_mask, val;
++
++	regmap_update_bits(eth->ethsys, ETHSYS_RSTCTRL, RSTCTRL_FE,
++			   RSTCTRL_FE);
++	if (readx_poll_timeout_atomic(mtk_hw_reset_read, eth, val,
++				      val & RSTCTRL_FE, 1, 1000)) {
++		dev_err(eth->dev, "warm reset failed\n");
++		mtk_hw_reset(eth);
++		return;
++	}
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++		rst_mask = RSTCTRL_ETH | RSTCTRL_PPE0_V2;
++	else
++		rst_mask = RSTCTRL_ETH | RSTCTRL_PPE0;
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_RSTCTRL_PPE1))
++		rst_mask |= RSTCTRL_PPE1;
++
++	regmap_update_bits(eth->ethsys, ETHSYS_RSTCTRL, rst_mask, rst_mask);
++
++	udelay(1);
++	val = mtk_hw_reset_read(eth);
++	if (!(val & rst_mask))
++		dev_err(eth->dev, "warm reset stage0 failed %08x (%08x)\n",
++			val, rst_mask);
++
++	rst_mask |= RSTCTRL_FE;
++	regmap_update_bits(eth->ethsys, ETHSYS_RSTCTRL, rst_mask, ~rst_mask);
++
++	udelay(1);
++	val = mtk_hw_reset_read(eth);
++	if (val & rst_mask)
++		dev_err(eth->dev, "warm reset stage1 failed %08x (%08x)\n",
++			val, rst_mask);
++}
++
++static int mtk_hw_init(struct mtk_eth *eth, bool reset)
+ {
+ 	u32 dma_mask = ETHSYS_DMA_AG_MAP_PDMA | ETHSYS_DMA_AG_MAP_QDMA |
+ 		       ETHSYS_DMA_AG_MAP_PPE;
+@@ -3314,7 +3361,12 @@ static int mtk_hw_init(struct mtk_eth *e
+ 		return 0;
+ 	}
+ 
+-	mtk_hw_reset(eth);
++	msleep(100);
++
++	if (reset)
++		mtk_hw_warm_reset(eth);
++	else
++		mtk_hw_reset(eth);
+ 
+ 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+ 		/* Set FE to PDMAv2 if necessary */
+@@ -3522,7 +3574,7 @@ static void mtk_pending_work(struct work
+ 	if (eth->dev->pins)
+ 		pinctrl_select_state(eth->dev->pins->p,
+ 				     eth->dev->pins->default_state);
+-	mtk_hw_init(eth);
++	mtk_hw_init(eth, true);
+ 
+ 	/* restart DMA and enable IRQs */
+ 	for (i = 0; i < MTK_MAC_COUNT; i++) {
+@@ -4114,7 +4166,7 @@ static int mtk_probe(struct platform_dev
+ 	eth->msg_enable = netif_msg_init(mtk_msg_level, MTK_DEFAULT_MSG_ENABLE);
+ 	INIT_WORK(&eth->pending_work, mtk_pending_work);
+ 
+-	err = mtk_hw_init(eth);
++	err = mtk_hw_init(eth, false);
+ 	if (err)
+ 		goto err_wed_exit;
+ 
diff --git a/target/linux/generic/backport-6.1/729-20-v6.3-net-ethernet-mtk_eth_soc-align-reset-procedure-to-ve.patch b/target/linux/generic/backport-6.1/729-20-v6.3-net-ethernet-mtk_eth_soc-align-reset-procedure-to-ve.patch
new file mode 100644
index 00000000000000..963235cd92b82f
--- /dev/null
+++ b/target/linux/generic/backport-6.1/729-20-v6.3-net-ethernet-mtk_eth_soc-align-reset-procedure-to-ve.patch
@@ -0,0 +1,262 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 14 Jan 2023 18:01:30 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: align reset procedure to vendor
+ sdk
+
+Avoid to power-down the ethernet chip during hw reset and align reset
+procedure to vendor sdk.
+
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -2842,14 +2842,29 @@ static void mtk_dma_free(struct mtk_eth
+ 	kfree(eth->scratch_head);
+ }
+ 
++static bool mtk_hw_reset_check(struct mtk_eth *eth)
++{
++	u32 val = mtk_r32(eth, MTK_INT_STATUS2);
++
++	return (val & MTK_FE_INT_FQ_EMPTY) || (val & MTK_FE_INT_RFIFO_UF) ||
++	       (val & MTK_FE_INT_RFIFO_OV) || (val & MTK_FE_INT_TSO_FAIL) ||
++	       (val & MTK_FE_INT_TSO_ALIGN) || (val & MTK_FE_INT_TSO_ILLEGAL);
++}
++
+ static void mtk_tx_timeout(struct net_device *dev, unsigned int txqueue)
+ {
+ 	struct mtk_mac *mac = netdev_priv(dev);
+ 	struct mtk_eth *eth = mac->hw;
+ 
++	if (test_bit(MTK_RESETTING, &eth->state))
++		return;
++
++	if (!mtk_hw_reset_check(eth))
++		return;
++
+ 	eth->netdev[mac->id]->stats.tx_errors++;
+-	netif_err(eth, tx_err, dev,
+-		  "transmit timed out\n");
++	netif_err(eth, tx_err, dev, "transmit timed out\n");
++
+ 	schedule_work(&eth->pending_work);
+ }
+ 
+@@ -3329,15 +3344,17 @@ static int mtk_hw_init(struct mtk_eth *e
+ 	const struct mtk_reg_map *reg_map = eth->soc->reg_map;
+ 	int i, val, ret;
+ 
+-	if (test_and_set_bit(MTK_HW_INIT, &eth->state))
++	if (!reset && test_and_set_bit(MTK_HW_INIT, &eth->state))
+ 		return 0;
+ 
+-	pm_runtime_enable(eth->dev);
+-	pm_runtime_get_sync(eth->dev);
++	if (!reset) {
++		pm_runtime_enable(eth->dev);
++		pm_runtime_get_sync(eth->dev);
+ 
+-	ret = mtk_clk_enable(eth);
+-	if (ret)
+-		goto err_disable_pm;
++		ret = mtk_clk_enable(eth);
++		if (ret)
++			goto err_disable_pm;
++	}
+ 
+ 	if (eth->ethsys)
+ 		regmap_update_bits(eth->ethsys, ETHSYS_DMA_AG_MAP, dma_mask,
+@@ -3466,8 +3483,10 @@ static int mtk_hw_init(struct mtk_eth *e
+ 	return 0;
+ 
+ err_disable_pm:
+-	pm_runtime_put_sync(eth->dev);
+-	pm_runtime_disable(eth->dev);
++	if (!reset) {
++		pm_runtime_put_sync(eth->dev);
++		pm_runtime_disable(eth->dev);
++	}
+ 
+ 	return ret;
+ }
+@@ -3546,30 +3565,53 @@ static int mtk_do_ioctl(struct net_devic
+ 	return -EOPNOTSUPP;
+ }
+ 
++static void mtk_prepare_for_reset(struct mtk_eth *eth)
++{
++	u32 val;
++	int i;
++
++	/* disabe FE P3 and P4 */
++	val = mtk_r32(eth, MTK_FE_GLO_CFG) | MTK_FE_LINK_DOWN_P3;
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_RSTCTRL_PPE1))
++		val |= MTK_FE_LINK_DOWN_P4;
++	mtk_w32(eth, val, MTK_FE_GLO_CFG);
++
++	/* adjust PPE configurations to prepare for reset */
++	for (i = 0; i < ARRAY_SIZE(eth->ppe); i++)
++		mtk_ppe_prepare_reset(eth->ppe[i]);
++
++	/* disable NETSYS interrupts */
++	mtk_w32(eth, 0, MTK_FE_INT_ENABLE);
++
++	/* force link down GMAC */
++	for (i = 0; i < 2; i++) {
++		val = mtk_r32(eth, MTK_MAC_MCR(i)) & ~MAC_MCR_FORCE_LINK;
++		mtk_w32(eth, val, MTK_MAC_MCR(i));
++	}
++}
++
+ static void mtk_pending_work(struct work_struct *work)
+ {
+ 	struct mtk_eth *eth = container_of(work, struct mtk_eth, pending_work);
+-	int err, i;
+ 	unsigned long restart = 0;
++	u32 val;
++	int i;
+ 
+ 	rtnl_lock();
+-
+-	dev_dbg(eth->dev, "[%s][%d] reset\n", __func__, __LINE__);
+ 	set_bit(MTK_RESETTING, &eth->state);
+ 
++	mtk_prepare_for_reset(eth);
++
+ 	/* stop all devices to make sure that dma is properly shut down */
+ 	for (i = 0; i < MTK_MAC_COUNT; i++) {
+-		if (!eth->netdev[i])
++		if (!eth->netdev[i] || !netif_running(eth->netdev[i]))
+ 			continue;
++
+ 		mtk_stop(eth->netdev[i]);
+ 		__set_bit(i, &restart);
+ 	}
+-	dev_dbg(eth->dev, "[%s][%d] mtk_stop ends\n", __func__, __LINE__);
+ 
+-	/* restart underlying hardware such as power, clock, pin mux
+-	 * and the connected phy
+-	 */
+-	mtk_hw_deinit(eth);
++	usleep_range(15000, 16000);
+ 
+ 	if (eth->dev->pins)
+ 		pinctrl_select_state(eth->dev->pins->p,
+@@ -3580,15 +3622,19 @@ static void mtk_pending_work(struct work
+ 	for (i = 0; i < MTK_MAC_COUNT; i++) {
+ 		if (!test_bit(i, &restart))
+ 			continue;
+-		err = mtk_open(eth->netdev[i]);
+-		if (err) {
++
++		if (mtk_open(eth->netdev[i])) {
+ 			netif_alert(eth, ifup, eth->netdev[i],
+-			      "Driver up/down cycle failed, closing device.\n");
++				    "Driver up/down cycle failed\n");
+ 			dev_close(eth->netdev[i]);
+ 		}
+ 	}
+ 
+-	dev_dbg(eth->dev, "[%s][%d] reset done\n", __func__, __LINE__);
++	/* enabe FE P3 and P4 */
++	val = mtk_r32(eth, MTK_FE_GLO_CFG) & ~MTK_FE_LINK_DOWN_P3;
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_RSTCTRL_PPE1))
++		val &= ~MTK_FE_LINK_DOWN_P4;
++	mtk_w32(eth, val, MTK_FE_GLO_CFG);
+ 
+ 	clear_bit(MTK_RESETTING, &eth->state);
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -72,12 +72,24 @@
+ #define	MTK_HW_LRO_REPLACE_DELTA	1000
+ #define	MTK_HW_LRO_SDL_REMAIN_ROOM	1522
+ 
++/* Frame Engine Global Configuration */
++#define MTK_FE_GLO_CFG		0x00
++#define MTK_FE_LINK_DOWN_P3	BIT(11)
++#define MTK_FE_LINK_DOWN_P4	BIT(12)
++
+ /* Frame Engine Global Reset Register */
+ #define MTK_RST_GL		0x04
+ #define RST_GL_PSE		BIT(0)
+ 
+ /* Frame Engine Interrupt Status Register */
+ #define MTK_INT_STATUS2		0x08
++#define MTK_FE_INT_ENABLE	0x0c
++#define MTK_FE_INT_FQ_EMPTY	BIT(8)
++#define MTK_FE_INT_TSO_FAIL	BIT(12)
++#define MTK_FE_INT_TSO_ILLEGAL	BIT(13)
++#define MTK_FE_INT_TSO_ALIGN	BIT(14)
++#define MTK_FE_INT_RFIFO_OV	BIT(18)
++#define MTK_FE_INT_RFIFO_UF	BIT(19)
+ #define MTK_GDM1_AF		BIT(28)
+ #define MTK_GDM2_AF		BIT(29)
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -710,6 +710,33 @@ int mtk_foe_entry_idle_time(struct mtk_p
+ 	return __mtk_foe_entry_idle_time(ppe, entry->data.ib1);
+ }
+ 
++int mtk_ppe_prepare_reset(struct mtk_ppe *ppe)
++{
++	if (!ppe)
++		return -EINVAL;
++
++	/* disable KA */
++	ppe_clear(ppe, MTK_PPE_TB_CFG, MTK_PPE_TB_CFG_KEEPALIVE);
++	ppe_clear(ppe, MTK_PPE_BIND_LMT1, MTK_PPE_NTU_KEEPALIVE);
++	ppe_w32(ppe, MTK_PPE_KEEPALIVE, 0);
++	usleep_range(10000, 11000);
++
++	/* set KA timer to maximum */
++	ppe_set(ppe, MTK_PPE_BIND_LMT1, MTK_PPE_NTU_KEEPALIVE);
++	ppe_w32(ppe, MTK_PPE_KEEPALIVE, 0xffffffff);
++
++	/* set KA tick select */
++	ppe_set(ppe, MTK_PPE_TB_CFG, MTK_PPE_TB_TICK_SEL);
++	ppe_set(ppe, MTK_PPE_TB_CFG, MTK_PPE_TB_CFG_KEEPALIVE);
++	usleep_range(10000, 11000);
++
++	/* disable scan mode */
++	ppe_clear(ppe, MTK_PPE_TB_CFG, MTK_PPE_TB_CFG_SCAN_MODE);
++	usleep_range(10000, 11000);
++
++	return mtk_ppe_wait_busy(ppe);
++}
++
+ struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base,
+ 			     int version, int index)
+ {
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h
+@@ -306,6 +306,7 @@ struct mtk_ppe *mtk_ppe_init(struct mtk_
+ void mtk_ppe_deinit(struct mtk_eth *eth);
+ void mtk_ppe_start(struct mtk_ppe *ppe);
+ int mtk_ppe_stop(struct mtk_ppe *ppe);
++int mtk_ppe_prepare_reset(struct mtk_ppe *ppe);
+ 
+ void __mtk_ppe_check_skb(struct mtk_ppe *ppe, struct sk_buff *skb, u16 hash);
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_regs.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_regs.h
+@@ -58,6 +58,12 @@
+ #define MTK_PPE_TB_CFG_SCAN_MODE		GENMASK(17, 16)
+ #define MTK_PPE_TB_CFG_HASH_DEBUG		GENMASK(19, 18)
+ #define MTK_PPE_TB_CFG_INFO_SEL			BIT(20)
++#define MTK_PPE_TB_TICK_SEL			BIT(24)
++
++#define MTK_PPE_BIND_LMT1			0x230
++#define MTK_PPE_NTU_KEEPALIVE			GENMASK(23, 16)
++
++#define MTK_PPE_KEEPALIVE			0x234
+ 
+ enum {
+ 	MTK_PPE_SCAN_MODE_DISABLED,
diff --git a/target/linux/generic/backport-6.1/729-21-v6.3-net-ethernet-mtk_eth_soc-add-dma-checks-to-mtk_hw_re.patch b/target/linux/generic/backport-6.1/729-21-v6.3-net-ethernet-mtk_eth_soc-add-dma-checks-to-mtk_hw_re.patch
new file mode 100644
index 00000000000000..5fa2500a41edbb
--- /dev/null
+++ b/target/linux/generic/backport-6.1/729-21-v6.3-net-ethernet-mtk_eth_soc-add-dma-checks-to-mtk_hw_re.patch
@@ -0,0 +1,249 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 14 Jan 2023 18:01:31 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: add dma checks to
+ mtk_hw_reset_check
+
+Introduce mtk_hw_check_dma_hang routine to monitor possible dma hangs.
+
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -50,6 +50,7 @@ static const struct mtk_reg_map mtk_reg_
+ 		.delay_irq	= 0x0a0c,
+ 		.irq_status	= 0x0a20,
+ 		.irq_mask	= 0x0a28,
++		.adma_rx_dbg0	= 0x0a38,
+ 		.int_grp	= 0x0a50,
+ 	},
+ 	.qdma = {
+@@ -79,6 +80,8 @@ static const struct mtk_reg_map mtk_reg_
+ 		[0]		= 0x2800,
+ 		[1]		= 0x2c00,
+ 	},
++	.pse_iq_sta		= 0x0110,
++	.pse_oq_sta		= 0x0118,
+ };
+ 
+ static const struct mtk_reg_map mt7628_reg_map = {
+@@ -109,6 +112,7 @@ static const struct mtk_reg_map mt7986_r
+ 		.delay_irq	= 0x620c,
+ 		.irq_status	= 0x6220,
+ 		.irq_mask	= 0x6228,
++		.adma_rx_dbg0	= 0x6238,
+ 		.int_grp	= 0x6250,
+ 	},
+ 	.qdma = {
+@@ -138,6 +142,8 @@ static const struct mtk_reg_map mt7986_r
+ 		[0]		= 0x4800,
+ 		[1]		= 0x4c00,
+ 	},
++	.pse_iq_sta		= 0x0180,
++	.pse_oq_sta		= 0x01a0,
+ };
+ 
+ /* strings used by ethtool */
+@@ -3337,6 +3343,102 @@ static void mtk_hw_warm_reset(struct mtk
+ 			val, rst_mask);
+ }
+ 
++static bool mtk_hw_check_dma_hang(struct mtk_eth *eth)
++{
++	const struct mtk_reg_map *reg_map = eth->soc->reg_map;
++	bool gmac1_tx, gmac2_tx, gdm1_tx, gdm2_tx;
++	bool oq_hang, cdm1_busy, adma_busy;
++	bool wtx_busy, cdm_full, oq_free;
++	u32 wdidx, val, gdm1_fc, gdm2_fc;
++	bool qfsm_hang, qfwd_hang;
++	bool ret = false;
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628))
++		return false;
++
++	/* WDMA sanity checks */
++	wdidx = mtk_r32(eth, reg_map->wdma_base[0] + 0xc);
++
++	val = mtk_r32(eth, reg_map->wdma_base[0] + 0x204);
++	wtx_busy = FIELD_GET(MTK_TX_DMA_BUSY, val);
++
++	val = mtk_r32(eth, reg_map->wdma_base[0] + 0x230);
++	cdm_full = !FIELD_GET(MTK_CDM_TXFIFO_RDY, val);
++
++	oq_free  = (!(mtk_r32(eth, reg_map->pse_oq_sta) & GENMASK(24, 16)) &&
++		    !(mtk_r32(eth, reg_map->pse_oq_sta + 0x4) & GENMASK(8, 0)) &&
++		    !(mtk_r32(eth, reg_map->pse_oq_sta + 0x10) & GENMASK(24, 16)));
++
++	if (wdidx == eth->reset.wdidx && wtx_busy && cdm_full && oq_free) {
++		if (++eth->reset.wdma_hang_count > 2) {
++			eth->reset.wdma_hang_count = 0;
++			ret = true;
++		}
++		goto out;
++	}
++
++	/* QDMA sanity checks */
++	qfsm_hang = !!mtk_r32(eth, reg_map->qdma.qtx_cfg + 0x234);
++	qfwd_hang = !mtk_r32(eth, reg_map->qdma.qtx_cfg + 0x308);
++
++	gdm1_tx = FIELD_GET(GENMASK(31, 16), mtk_r32(eth, MTK_FE_GDM1_FSM)) > 0;
++	gdm2_tx = FIELD_GET(GENMASK(31, 16), mtk_r32(eth, MTK_FE_GDM2_FSM)) > 0;
++	gmac1_tx = FIELD_GET(GENMASK(31, 24), mtk_r32(eth, MTK_MAC_FSM(0))) != 1;
++	gmac2_tx = FIELD_GET(GENMASK(31, 24), mtk_r32(eth, MTK_MAC_FSM(1))) != 1;
++	gdm1_fc = mtk_r32(eth, reg_map->gdm1_cnt + 0x24);
++	gdm2_fc = mtk_r32(eth, reg_map->gdm1_cnt + 0x64);
++
++	if (qfsm_hang && qfwd_hang &&
++	    ((gdm1_tx && gmac1_tx && gdm1_fc < 1) ||
++	     (gdm2_tx && gmac2_tx && gdm2_fc < 1))) {
++		if (++eth->reset.qdma_hang_count > 2) {
++			eth->reset.qdma_hang_count = 0;
++			ret = true;
++		}
++		goto out;
++	}
++
++	/* ADMA sanity checks */
++	oq_hang = !!(mtk_r32(eth, reg_map->pse_oq_sta) & GENMASK(8, 0));
++	cdm1_busy = !!(mtk_r32(eth, MTK_FE_CDM1_FSM) & GENMASK(31, 16));
++	adma_busy = !(mtk_r32(eth, reg_map->pdma.adma_rx_dbg0) & GENMASK(4, 0)) &&
++		    !(mtk_r32(eth, reg_map->pdma.adma_rx_dbg0) & BIT(6));
++
++	if (oq_hang && cdm1_busy && adma_busy) {
++		if (++eth->reset.adma_hang_count > 2) {
++			eth->reset.adma_hang_count = 0;
++			ret = true;
++		}
++		goto out;
++	}
++
++	eth->reset.wdma_hang_count = 0;
++	eth->reset.qdma_hang_count = 0;
++	eth->reset.adma_hang_count = 0;
++out:
++	eth->reset.wdidx = wdidx;
++
++	return ret;
++}
++
++static void mtk_hw_reset_monitor_work(struct work_struct *work)
++{
++	struct delayed_work *del_work = to_delayed_work(work);
++	struct mtk_eth *eth = container_of(del_work, struct mtk_eth,
++					   reset.monitor_work);
++
++	if (test_bit(MTK_RESETTING, &eth->state))
++		goto out;
++
++	/* DMA stuck checks */
++	if (mtk_hw_check_dma_hang(eth))
++		schedule_work(&eth->pending_work);
++
++out:
++	schedule_delayed_work(&eth->reset.monitor_work,
++			      MTK_DMA_MONITOR_TIMEOUT);
++}
++
+ static int mtk_hw_init(struct mtk_eth *eth, bool reset)
+ {
+ 	u32 dma_mask = ETHSYS_DMA_AG_MAP_PDMA | ETHSYS_DMA_AG_MAP_QDMA |
+@@ -3672,6 +3774,7 @@ static int mtk_cleanup(struct mtk_eth *e
+ 	mtk_unreg_dev(eth);
+ 	mtk_free_dev(eth);
+ 	cancel_work_sync(&eth->pending_work);
++	cancel_delayed_work_sync(&eth->reset.monitor_work);
+ 
+ 	return 0;
+ }
+@@ -4099,6 +4202,7 @@ static int mtk_probe(struct platform_dev
+ 
+ 	eth->rx_dim.mode = DIM_CQ_PERIOD_MODE_START_FROM_EQE;
+ 	INIT_WORK(&eth->rx_dim.work, mtk_dim_rx);
++	INIT_DELAYED_WORK(&eth->reset.monitor_work, mtk_hw_reset_monitor_work);
+ 
+ 	eth->tx_dim.mode = DIM_CQ_PERIOD_MODE_START_FROM_EQE;
+ 	INIT_WORK(&eth->tx_dim.work, mtk_dim_tx);
+@@ -4301,6 +4405,8 @@ static int mtk_probe(struct platform_dev
+ 	netif_napi_add(&eth->dummy_dev, &eth->rx_napi, mtk_napi_rx);
+ 
+ 	platform_set_drvdata(pdev, eth);
++	schedule_delayed_work(&eth->reset.monitor_work,
++			      MTK_DMA_MONITOR_TIMEOUT);
+ 
+ 	return 0;
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -257,6 +257,8 @@
+ 
+ #define MTK_RX_DONE_INT_V2	BIT(14)
+ 
++#define MTK_CDM_TXFIFO_RDY	BIT(7)
++
+ /* QDMA Interrupt grouping registers */
+ #define MTK_RLS_DONE_INT	BIT(0)
+ 
+@@ -542,6 +544,17 @@
+ #define MT7628_SDM_RBCNT	(MT7628_SDM_OFFSET + 0x10c)
+ #define MT7628_SDM_CS_ERR	(MT7628_SDM_OFFSET + 0x110)
+ 
++#define MTK_FE_CDM1_FSM		0x220
++#define MTK_FE_CDM2_FSM		0x224
++#define MTK_FE_CDM3_FSM		0x238
++#define MTK_FE_CDM4_FSM		0x298
++#define MTK_FE_CDM5_FSM		0x318
++#define MTK_FE_CDM6_FSM		0x328
++#define MTK_FE_GDM1_FSM		0x228
++#define MTK_FE_GDM2_FSM		0x22C
++
++#define MTK_MAC_FSM(x)		(0x1010C + ((x) * 0x100))
++
+ struct mtk_rx_dma {
+ 	unsigned int rxd1;
+ 	unsigned int rxd2;
+@@ -938,6 +951,7 @@ struct mtk_reg_map {
+ 		u32	delay_irq;	/* delay interrupt */
+ 		u32	irq_status;	/* interrupt status */
+ 		u32	irq_mask;	/* interrupt mask */
++		u32	adma_rx_dbg0;
+ 		u32	int_grp;
+ 	} pdma;
+ 	struct {
+@@ -964,6 +978,8 @@ struct mtk_reg_map {
+ 	u32	gdma_to_ppe;
+ 	u32	ppe_base;
+ 	u32	wdma_base[2];
++	u32	pse_iq_sta;
++	u32	pse_oq_sta;
+ };
+ 
+ /* struct mtk_eth_data -	This is the structure holding all differences
+@@ -1006,6 +1022,8 @@ struct mtk_soc_data {
+ 	} txrx;
+ };
+ 
++#define MTK_DMA_MONITOR_TIMEOUT		msecs_to_jiffies(1000)
++
+ /* currently no SoC has more than 2 macs */
+ #define MTK_MAX_DEVS			2
+ 
+@@ -1128,6 +1146,14 @@ struct mtk_eth {
+ 	struct rhashtable		flow_table;
+ 
+ 	struct bpf_prog			__rcu *prog;
++
++	struct {
++		struct delayed_work monitor_work;
++		u32 wdidx;
++		u8 wdma_hang_count;
++		u8 qdma_hang_count;
++		u8 adma_hang_count;
++	} reset;
+ };
+ 
+ /* struct mtk_mac -	the structure that holds the info about the MACs of the
diff --git a/target/linux/generic/backport-6.1/729-22-v6.3-net-ethernet-mtk_wed-add-reset-reset_complete-callba.patch b/target/linux/generic/backport-6.1/729-22-v6.3-net-ethernet-mtk_wed-add-reset-reset_complete-callba.patch
new file mode 100644
index 00000000000000..2f816af7e22152
--- /dev/null
+++ b/target/linux/generic/backport-6.1/729-22-v6.3-net-ethernet-mtk_wed-add-reset-reset_complete-callba.patch
@@ -0,0 +1,124 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 14 Jan 2023 18:01:32 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: add reset/reset_complete callbacks
+
+Introduce reset and reset_complete wlan callback to schedule WLAN driver
+reset when ethernet/wed driver is resetting.
+
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3703,6 +3703,11 @@ static void mtk_pending_work(struct work
+ 	set_bit(MTK_RESETTING, &eth->state);
+ 
+ 	mtk_prepare_for_reset(eth);
++	mtk_wed_fe_reset();
++	/* Run again reset preliminary configuration in order to avoid any
++	 * possible race during FE reset since it can run releasing RTNL lock.
++	 */
++	mtk_prepare_for_reset(eth);
+ 
+ 	/* stop all devices to make sure that dma is properly shut down */
+ 	for (i = 0; i < MTK_MAC_COUNT; i++) {
+@@ -3740,6 +3745,8 @@ static void mtk_pending_work(struct work
+ 
+ 	clear_bit(MTK_RESETTING, &eth->state);
+ 
++	mtk_wed_fe_reset_complete();
++
+ 	rtnl_unlock();
+ }
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -205,6 +205,48 @@ mtk_wed_wo_reset(struct mtk_wed_device *
+ 	iounmap(reg);
+ }
+ 
++void mtk_wed_fe_reset(void)
++{
++	int i;
++
++	mutex_lock(&hw_lock);
++
++	for (i = 0; i < ARRAY_SIZE(hw_list); i++) {
++		struct mtk_wed_hw *hw = hw_list[i];
++		struct mtk_wed_device *dev = hw->wed_dev;
++		int err;
++
++		if (!dev || !dev->wlan.reset)
++			continue;
++
++		/* reset callback blocks until WLAN reset is completed */
++		err = dev->wlan.reset(dev);
++		if (err)
++			dev_err(dev->dev, "wlan reset failed: %d\n", err);
++	}
++
++	mutex_unlock(&hw_lock);
++}
++
++void mtk_wed_fe_reset_complete(void)
++{
++	int i;
++
++	mutex_lock(&hw_lock);
++
++	for (i = 0; i < ARRAY_SIZE(hw_list); i++) {
++		struct mtk_wed_hw *hw = hw_list[i];
++		struct mtk_wed_device *dev = hw->wed_dev;
++
++		if (!dev || !dev->wlan.reset_complete)
++			continue;
++
++		dev->wlan.reset_complete(dev);
++	}
++
++	mutex_unlock(&hw_lock);
++}
++
+ static struct mtk_wed_hw *
+ mtk_wed_assign(struct mtk_wed_device *dev)
+ {
+--- a/drivers/net/ethernet/mediatek/mtk_wed.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed.h
+@@ -128,6 +128,8 @@ void mtk_wed_add_hw(struct device_node *
+ void mtk_wed_exit(void);
+ int mtk_wed_flow_add(int index);
+ void mtk_wed_flow_remove(int index);
++void mtk_wed_fe_reset(void);
++void mtk_wed_fe_reset_complete(void);
+ #else
+ static inline void
+ mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
+@@ -147,6 +149,13 @@ static inline void mtk_wed_flow_remove(i
+ {
+ }
+ 
++static inline void mtk_wed_fe_reset(void)
++{
++}
++
++static inline void mtk_wed_fe_reset_complete(void)
++{
++}
+ #endif
+ 
+ #ifdef CONFIG_DEBUG_FS
+--- a/include/linux/soc/mediatek/mtk_wed.h
++++ b/include/linux/soc/mediatek/mtk_wed.h
+@@ -151,6 +151,8 @@ struct mtk_wed_device {
+ 		void (*release_rx_buf)(struct mtk_wed_device *wed);
+ 		void (*update_wo_rx_stats)(struct mtk_wed_device *wed,
+ 					   struct mtk_wed_wo_rx_stats *stats);
++		int (*reset)(struct mtk_wed_device *wed);
++		void (*reset_complete)(struct mtk_wed_device *wed);
+ 	} wlan;
+ #endif
+ };
diff --git a/target/linux/generic/backport-6.1/729-23-v6.3-net-ethernet-mtk_wed-add-reset-to-rx_ring_setup-call.patch b/target/linux/generic/backport-6.1/729-23-v6.3-net-ethernet-mtk_wed-add-reset-to-rx_ring_setup-call.patch
new file mode 100644
index 00000000000000..c63628da99da81
--- /dev/null
+++ b/target/linux/generic/backport-6.1/729-23-v6.3-net-ethernet-mtk_wed-add-reset-to-rx_ring_setup-call.patch
@@ -0,0 +1,106 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Mon, 5 Dec 2022 12:34:42 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: add reset to rx_ring_setup callback
+
+This patch adds reset parameter to mtk_wed_rx_ring_setup signature
+in order to align rx_ring_setup callback to tx_ring_setup one introduced
+in 'commit 23dca7a90017 ("net: ethernet: mtk_wed: add reset to
+tx_ring_setup callback")'
+
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Link: https://lore.kernel.org/r/29c6e7a5469e784406cf3e2920351d1207713d05.1670239984.git.lorenzo@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -1252,7 +1252,8 @@ mtk_wed_wdma_rx_ring_setup(struct mtk_we
+ }
+ 
+ static int
+-mtk_wed_wdma_tx_ring_setup(struct mtk_wed_device *dev, int idx, int size)
++mtk_wed_wdma_tx_ring_setup(struct mtk_wed_device *dev, int idx, int size,
++			   bool reset)
+ {
+ 	u32 desc_size = sizeof(struct mtk_wdma_desc) * dev->hw->version;
+ 	struct mtk_wed_ring *wdma;
+@@ -1261,8 +1262,8 @@ mtk_wed_wdma_tx_ring_setup(struct mtk_we
+ 		return -EINVAL;
+ 
+ 	wdma = &dev->tx_wdma[idx];
+-	if (mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE, desc_size,
+-			       true))
++	if (!reset && mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE,
++					 desc_size, true))
+ 		return -ENOMEM;
+ 
+ 	wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_BASE,
+@@ -1272,6 +1273,9 @@ mtk_wed_wdma_tx_ring_setup(struct mtk_we
+ 	wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_CPU_IDX, 0);
+ 	wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_DMA_IDX, 0);
+ 
++	if (reset)
++		mtk_wed_ring_reset(wdma, MTK_WED_WDMA_RING_SIZE, true);
++
+ 	if (!idx)  {
+ 		wed_w32(dev, MTK_WED_WDMA_RING_TX + MTK_WED_RING_OFS_BASE,
+ 			wdma->desc_phys);
+@@ -1611,18 +1615,20 @@ mtk_wed_txfree_ring_setup(struct mtk_wed
+ }
+ 
+ static int
+-mtk_wed_rx_ring_setup(struct mtk_wed_device *dev, int idx, void __iomem *regs)
++mtk_wed_rx_ring_setup(struct mtk_wed_device *dev, int idx, void __iomem *regs,
++		      bool reset)
+ {
+ 	struct mtk_wed_ring *ring = &dev->rx_ring[idx];
+ 
+ 	if (WARN_ON(idx >= ARRAY_SIZE(dev->rx_ring)))
+ 		return -EINVAL;
+ 
+-	if (mtk_wed_ring_alloc(dev, ring, MTK_WED_RX_RING_SIZE,
+-			       sizeof(*ring->desc), false))
++	if (!reset && mtk_wed_ring_alloc(dev, ring, MTK_WED_RX_RING_SIZE,
++					 sizeof(*ring->desc), false))
+ 		return -ENOMEM;
+ 
+-	if (mtk_wed_wdma_tx_ring_setup(dev, idx, MTK_WED_WDMA_RING_SIZE))
++	if (mtk_wed_wdma_tx_ring_setup(dev, idx, MTK_WED_WDMA_RING_SIZE,
++				       reset))
+ 		return -ENOMEM;
+ 
+ 	ring->reg_base = MTK_WED_RING_RX_DATA(idx);
+--- a/include/linux/soc/mediatek/mtk_wed.h
++++ b/include/linux/soc/mediatek/mtk_wed.h
+@@ -162,7 +162,7 @@ struct mtk_wed_ops {
+ 	int (*tx_ring_setup)(struct mtk_wed_device *dev, int ring,
+ 			     void __iomem *regs, bool reset);
+ 	int (*rx_ring_setup)(struct mtk_wed_device *dev, int ring,
+-			     void __iomem *regs);
++			     void __iomem *regs, bool reset);
+ 	int (*txfree_ring_setup)(struct mtk_wed_device *dev,
+ 				 void __iomem *regs);
+ 	int (*msg_update)(struct mtk_wed_device *dev, int cmd_id,
+@@ -230,8 +230,8 @@ mtk_wed_get_rx_capa(struct mtk_wed_devic
+ 	(_dev)->ops->irq_get(_dev, _mask)
+ #define mtk_wed_device_irq_set_mask(_dev, _mask) \
+ 	(_dev)->ops->irq_set_mask(_dev, _mask)
+-#define mtk_wed_device_rx_ring_setup(_dev, _ring, _regs) \
+-	(_dev)->ops->rx_ring_setup(_dev, _ring, _regs)
++#define mtk_wed_device_rx_ring_setup(_dev, _ring, _regs, _reset) \
++	(_dev)->ops->rx_ring_setup(_dev, _ring, _regs, _reset)
+ #define mtk_wed_device_ppe_check(_dev, _skb, _reason, _hash) \
+ 	(_dev)->ops->ppe_check(_dev, _skb, _reason, _hash)
+ #define mtk_wed_device_update_msg(_dev, _id, _msg, _len) \
+@@ -251,7 +251,7 @@ static inline bool mtk_wed_device_active
+ #define mtk_wed_device_reg_write(_dev, _reg, _val) do {} while (0)
+ #define mtk_wed_device_irq_get(_dev, _mask) 0
+ #define mtk_wed_device_irq_set_mask(_dev, _mask) do {} while (0)
+-#define mtk_wed_device_rx_ring_setup(_dev, _ring, _regs) -ENODEV
++#define mtk_wed_device_rx_ring_setup(_dev, _ring, _regs, _reset) -ENODEV
+ #define mtk_wed_device_ppe_check(_dev, _skb, _reason, _hash)  do {} while (0)
+ #define mtk_wed_device_update_msg(_dev, _id, _msg, _len) -ENODEV
+ #define mtk_wed_device_stop(_dev) do {} while (0)
diff --git a/target/linux/generic/backport-6.1/730-01-v6.3-net-ethernet-mtk_eth_soc-account-for-vlan-in-rx-head.patch b/target/linux/generic/backport-6.1/730-01-v6.3-net-ethernet-mtk_eth_soc-account-for-vlan-in-rx-head.patch
new file mode 100644
index 00000000000000..45af898cf003b8
--- /dev/null
+++ b/target/linux/generic/backport-6.1/730-01-v6.3-net-ethernet-mtk_eth_soc-account-for-vlan-in-rx-head.patch
@@ -0,0 +1,22 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 27 Oct 2022 19:50:31 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: account for vlan in rx
+ header length
+
+The network stack assumes that devices can handle an extra VLAN tag without
+increasing the MTU
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -29,7 +29,7 @@
+ #define MTK_TX_DMA_BUF_LEN_V2	0xffff
+ #define MTK_DMA_SIZE		512
+ #define MTK_MAC_COUNT		2
+-#define MTK_RX_ETH_HLEN		(ETH_HLEN + ETH_FCS_LEN)
++#define MTK_RX_ETH_HLEN		(VLAN_ETH_HLEN + ETH_FCS_LEN)
+ #define MTK_RX_HLEN		(NET_SKB_PAD + MTK_RX_ETH_HLEN + NET_IP_ALIGN)
+ #define MTK_DMA_DUMMY_DESC	0xffffffff
+ #define MTK_DEFAULT_MSG_ENABLE	(NETIF_MSG_DRV | \
diff --git a/target/linux/generic/backport-6.1/730-02-v6.3-net-ethernet-mtk_eth_soc-increase-tx-ring-side-for-Q.patch b/target/linux/generic/backport-6.1/730-02-v6.3-net-ethernet-mtk_eth_soc-increase-tx-ring-side-for-Q.patch
new file mode 100644
index 00000000000000..34c41b8d4db869
--- /dev/null
+++ b/target/linux/generic/backport-6.1/730-02-v6.3-net-ethernet-mtk_eth_soc-increase-tx-ring-side-for-Q.patch
@@ -0,0 +1,143 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 27 Oct 2022 19:53:57 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: increase tx ring side for
+ QDMA devices
+
+In order to use the hardware traffic shaper feature, a larger tx ring is
+needed, especially for the scratch ring, which the hardware shaper uses to
+reorder packets.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -945,7 +945,7 @@ static int mtk_init_fq_dma(struct mtk_et
+ {
+ 	const struct mtk_soc_data *soc = eth->soc;
+ 	dma_addr_t phy_ring_tail;
+-	int cnt = MTK_DMA_SIZE;
++	int cnt = MTK_QDMA_RING_SIZE;
+ 	dma_addr_t dma_addr;
+ 	int i;
+ 
+@@ -2209,19 +2209,25 @@ static int mtk_tx_alloc(struct mtk_eth *
+ 	struct mtk_tx_ring *ring = &eth->tx_ring;
+ 	int i, sz = soc->txrx.txd_size;
+ 	struct mtk_tx_dma_v2 *txd;
++	int ring_size;
+ 
+-	ring->buf = kcalloc(MTK_DMA_SIZE, sizeof(*ring->buf),
++	if (MTK_HAS_CAPS(soc->caps, MTK_QDMA))
++		ring_size = MTK_QDMA_RING_SIZE;
++	else
++		ring_size = MTK_DMA_SIZE;
++
++	ring->buf = kcalloc(ring_size, sizeof(*ring->buf),
+ 			       GFP_KERNEL);
+ 	if (!ring->buf)
+ 		goto no_tx_mem;
+ 
+-	ring->dma = dma_alloc_coherent(eth->dma_dev, MTK_DMA_SIZE * sz,
++	ring->dma = dma_alloc_coherent(eth->dma_dev, ring_size * sz,
+ 				       &ring->phys, GFP_KERNEL);
+ 	if (!ring->dma)
+ 		goto no_tx_mem;
+ 
+-	for (i = 0; i < MTK_DMA_SIZE; i++) {
+-		int next = (i + 1) % MTK_DMA_SIZE;
++	for (i = 0; i < ring_size; i++) {
++		int next = (i + 1) % ring_size;
+ 		u32 next_ptr = ring->phys + next * sz;
+ 
+ 		txd = ring->dma + i * sz;
+@@ -2241,22 +2247,22 @@ static int mtk_tx_alloc(struct mtk_eth *
+ 	 * descriptors in ring->dma_pdma.
+ 	 */
+ 	if (!MTK_HAS_CAPS(soc->caps, MTK_QDMA)) {
+-		ring->dma_pdma = dma_alloc_coherent(eth->dma_dev, MTK_DMA_SIZE * sz,
++		ring->dma_pdma = dma_alloc_coherent(eth->dma_dev, ring_size * sz,
+ 						    &ring->phys_pdma, GFP_KERNEL);
+ 		if (!ring->dma_pdma)
+ 			goto no_tx_mem;
+ 
+-		for (i = 0; i < MTK_DMA_SIZE; i++) {
++		for (i = 0; i < ring_size; i++) {
+ 			ring->dma_pdma[i].txd2 = TX_DMA_DESP2_DEF;
+ 			ring->dma_pdma[i].txd4 = 0;
+ 		}
+ 	}
+ 
+-	ring->dma_size = MTK_DMA_SIZE;
+-	atomic_set(&ring->free_count, MTK_DMA_SIZE - 2);
++	ring->dma_size = ring_size;
++	atomic_set(&ring->free_count, ring_size - 2);
+ 	ring->next_free = ring->dma;
+ 	ring->last_free = (void *)txd;
+-	ring->last_free_ptr = (u32)(ring->phys + ((MTK_DMA_SIZE - 1) * sz));
++	ring->last_free_ptr = (u32)(ring->phys + ((ring_size - 1) * sz));
+ 	ring->thresh = MAX_SKB_FRAGS;
+ 
+ 	/* make sure that all changes to the dma ring are flushed before we
+@@ -2268,14 +2274,14 @@ static int mtk_tx_alloc(struct mtk_eth *
+ 		mtk_w32(eth, ring->phys, soc->reg_map->qdma.ctx_ptr);
+ 		mtk_w32(eth, ring->phys, soc->reg_map->qdma.dtx_ptr);
+ 		mtk_w32(eth,
+-			ring->phys + ((MTK_DMA_SIZE - 1) * sz),
++			ring->phys + ((ring_size - 1) * sz),
+ 			soc->reg_map->qdma.crx_ptr);
+ 		mtk_w32(eth, ring->last_free_ptr, soc->reg_map->qdma.drx_ptr);
+ 		mtk_w32(eth, (QDMA_RES_THRES << 8) | QDMA_RES_THRES,
+ 			soc->reg_map->qdma.qtx_cfg);
+ 	} else {
+ 		mtk_w32(eth, ring->phys_pdma, MT7628_TX_BASE_PTR0);
+-		mtk_w32(eth, MTK_DMA_SIZE, MT7628_TX_MAX_CNT0);
++		mtk_w32(eth, ring_size, MT7628_TX_MAX_CNT0);
+ 		mtk_w32(eth, 0, MT7628_TX_CTX_IDX0);
+ 		mtk_w32(eth, MT7628_PST_DTX_IDX0, soc->reg_map->pdma.rst_idx);
+ 	}
+@@ -2293,7 +2299,7 @@ static void mtk_tx_clean(struct mtk_eth
+ 	int i;
+ 
+ 	if (ring->buf) {
+-		for (i = 0; i < MTK_DMA_SIZE; i++)
++		for (i = 0; i < ring->dma_size; i++)
+ 			mtk_tx_unmap(eth, &ring->buf[i], NULL, false);
+ 		kfree(ring->buf);
+ 		ring->buf = NULL;
+@@ -2301,14 +2307,14 @@ static void mtk_tx_clean(struct mtk_eth
+ 
+ 	if (ring->dma) {
+ 		dma_free_coherent(eth->dma_dev,
+-				  MTK_DMA_SIZE * soc->txrx.txd_size,
++				  ring->dma_size * soc->txrx.txd_size,
+ 				  ring->dma, ring->phys);
+ 		ring->dma = NULL;
+ 	}
+ 
+ 	if (ring->dma_pdma) {
+ 		dma_free_coherent(eth->dma_dev,
+-				  MTK_DMA_SIZE * soc->txrx.txd_size,
++				  ring->dma_size * soc->txrx.txd_size,
+ 				  ring->dma_pdma, ring->phys_pdma);
+ 		ring->dma_pdma = NULL;
+ 	}
+@@ -2830,7 +2836,7 @@ static void mtk_dma_free(struct mtk_eth
+ 			netdev_reset_queue(eth->netdev[i]);
+ 	if (eth->scratch_ring) {
+ 		dma_free_coherent(eth->dma_dev,
+-				  MTK_DMA_SIZE * soc->txrx.txd_size,
++				  MTK_QDMA_RING_SIZE * soc->txrx.txd_size,
+ 				  eth->scratch_ring, eth->phy_scratch_ring);
+ 		eth->scratch_ring = NULL;
+ 		eth->phy_scratch_ring = 0;
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -27,6 +27,7 @@
+ #define MTK_MAX_RX_LENGTH_2K	2048
+ #define MTK_TX_DMA_BUF_LEN	0x3fff
+ #define MTK_TX_DMA_BUF_LEN_V2	0xffff
++#define MTK_QDMA_RING_SIZE	2048
+ #define MTK_DMA_SIZE		512
+ #define MTK_MAC_COUNT		2
+ #define MTK_RX_ETH_HLEN		(VLAN_ETH_HLEN + ETH_FCS_LEN)
diff --git a/target/linux/generic/backport-6.1/730-03-v6.3-net-ethernet-mtk_eth_soc-avoid-port_mg-assignment-on.patch b/target/linux/generic/backport-6.1/730-03-v6.3-net-ethernet-mtk_eth_soc-avoid-port_mg-assignment-on.patch
new file mode 100644
index 00000000000000..f5124ee6d8f984
--- /dev/null
+++ b/target/linux/generic/backport-6.1/730-03-v6.3-net-ethernet-mtk_eth_soc-avoid-port_mg-assignment-on.patch
@@ -0,0 +1,52 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 4 Nov 2022 19:49:08 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: avoid port_mg assignment on
+ MT7622 and newer
+
+On newer chips, this field is unused and contains some bits related to queue
+assignment. Initialize it to 0 in those cases.
+Fix offload_version on MT7621 and MT7623, which still need the previous value.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -4484,7 +4484,7 @@ static const struct mtk_soc_data mt7621_
+ 	.hw_features = MTK_HW_FEATURES,
+ 	.required_clks = MT7621_CLKS_BITMAP,
+ 	.required_pctl = false,
+-	.offload_version = 2,
++	.offload_version = 1,
+ 	.hash_offset = 2,
+ 	.foe_entry_size = sizeof(struct mtk_foe_entry) - 16,
+ 	.txrx = {
+@@ -4523,7 +4523,7 @@ static const struct mtk_soc_data mt7623_
+ 	.hw_features = MTK_HW_FEATURES,
+ 	.required_clks = MT7623_CLKS_BITMAP,
+ 	.required_pctl = true,
+-	.offload_version = 2,
++	.offload_version = 1,
+ 	.hash_offset = 2,
+ 	.foe_entry_size = sizeof(struct mtk_foe_entry) - 16,
+ 	.txrx = {
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -175,6 +175,8 @@ int mtk_foe_entry_prepare(struct mtk_eth
+ 		val = FIELD_PREP(MTK_FOE_IB2_DEST_PORT_V2, pse_port) |
+ 		      FIELD_PREP(MTK_FOE_IB2_PORT_AG_V2, 0xf);
+ 	} else {
++		int port_mg = eth->soc->offload_version > 1 ? 0 : 0x3f;
++
+ 		val = FIELD_PREP(MTK_FOE_IB1_STATE, MTK_FOE_STATE_BIND) |
+ 		      FIELD_PREP(MTK_FOE_IB1_PACKET_TYPE, type) |
+ 		      FIELD_PREP(MTK_FOE_IB1_UDP, l4proto == IPPROTO_UDP) |
+@@ -182,7 +184,7 @@ int mtk_foe_entry_prepare(struct mtk_eth
+ 		entry->ib1 = val;
+ 
+ 		val = FIELD_PREP(MTK_FOE_IB2_DEST_PORT, pse_port) |
+-		      FIELD_PREP(MTK_FOE_IB2_PORT_MG, 0x3f) |
++		      FIELD_PREP(MTK_FOE_IB2_PORT_MG, port_mg) |
+ 		      FIELD_PREP(MTK_FOE_IB2_PORT_AG, 0x1f);
+ 	}
+ 
diff --git a/target/linux/generic/backport-6.1/730-04-v6.3-net-ethernet-mtk_eth_soc-implement-multi-queue-suppo.patch b/target/linux/generic/backport-6.1/730-04-v6.3-net-ethernet-mtk_eth_soc-implement-multi-queue-suppo.patch
new file mode 100644
index 00000000000000..655faa2452eefe
--- /dev/null
+++ b/target/linux/generic/backport-6.1/730-04-v6.3-net-ethernet-mtk_eth_soc-implement-multi-queue-suppo.patch
@@ -0,0 +1,654 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 27 Oct 2022 20:17:27 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: implement multi-queue
+ support for per-port queues
+
+When sending traffic to multiple ports with different link speeds, queued
+packets to one port can drown out tx to other ports.
+In order to better handle transmission to multiple ports, use the hardware
+shaper feature to implement weighted fair queueing between ports.
+Weight and maximum rate are automatically adjusted based on the link speed
+of the port.
+The first 3 queues are unrestricted and reserved for non-DSA direct tx on
+GMAC ports. The following queues are automatically assigned by the MTK DSA
+tag driver based on the target port number.
+The PPE offload code configures the queues for offloaded traffic in the same
+way.
+This feature is only supported on devices supporting QDMA. All queues still
+share the same DMA ring and descriptor pool.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -55,6 +55,7 @@ static const struct mtk_reg_map mtk_reg_
+ 	},
+ 	.qdma = {
+ 		.qtx_cfg	= 0x1800,
++		.qtx_sch	= 0x1804,
+ 		.rx_ptr		= 0x1900,
+ 		.rx_cnt_cfg	= 0x1904,
+ 		.qcrx_ptr	= 0x1908,
+@@ -62,6 +63,7 @@ static const struct mtk_reg_map mtk_reg_
+ 		.rst_idx	= 0x1a08,
+ 		.delay_irq	= 0x1a0c,
+ 		.fc_th		= 0x1a10,
++		.tx_sch_rate	= 0x1a14,
+ 		.int_grp	= 0x1a20,
+ 		.hred		= 0x1a44,
+ 		.ctx_ptr	= 0x1b00,
+@@ -117,6 +119,7 @@ static const struct mtk_reg_map mt7986_r
+ 	},
+ 	.qdma = {
+ 		.qtx_cfg	= 0x4400,
++		.qtx_sch	= 0x4404,
+ 		.rx_ptr		= 0x4500,
+ 		.rx_cnt_cfg	= 0x4504,
+ 		.qcrx_ptr	= 0x4508,
+@@ -134,6 +137,7 @@ static const struct mtk_reg_map mt7986_r
+ 		.fq_tail	= 0x4724,
+ 		.fq_count	= 0x4728,
+ 		.fq_blen	= 0x472c,
++		.tx_sch_rate	= 0x4798,
+ 	},
+ 	.gdm1_cnt		= 0x1c00,
+ 	.gdma_to_ppe		= 0x3333,
+@@ -620,6 +624,75 @@ static void mtk_mac_link_down(struct phy
+ 	mtk_w32(mac->hw, mcr, MTK_MAC_MCR(mac->id));
+ }
+ 
++static void mtk_set_queue_speed(struct mtk_eth *eth, unsigned int idx,
++				int speed)
++{
++	const struct mtk_soc_data *soc = eth->soc;
++	u32 ofs, val;
++
++	if (!MTK_HAS_CAPS(soc->caps, MTK_QDMA))
++		return;
++
++	val = MTK_QTX_SCH_MIN_RATE_EN |
++	      /* minimum: 10 Mbps */
++	      FIELD_PREP(MTK_QTX_SCH_MIN_RATE_MAN, 1) |
++	      FIELD_PREP(MTK_QTX_SCH_MIN_RATE_EXP, 4) |
++	      MTK_QTX_SCH_LEAKY_BUCKET_SIZE;
++	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++		val |= MTK_QTX_SCH_LEAKY_BUCKET_EN;
++
++	if (IS_ENABLED(CONFIG_SOC_MT7621)) {
++		switch (speed) {
++		case SPEED_10:
++			val |= MTK_QTX_SCH_MAX_RATE_EN |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 103) |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 2) |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_WEIGHT, 1);
++			break;
++		case SPEED_100:
++			val |= MTK_QTX_SCH_MAX_RATE_EN |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 103) |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 3);
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_WEIGHT, 1);
++			break;
++		case SPEED_1000:
++			val |= MTK_QTX_SCH_MAX_RATE_EN |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 105) |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 4) |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_WEIGHT, 10);
++			break;
++		default:
++			break;
++		}
++	} else {
++		switch (speed) {
++		case SPEED_10:
++			val |= MTK_QTX_SCH_MAX_RATE_EN |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 1) |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 4) |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_WEIGHT, 1);
++			break;
++		case SPEED_100:
++			val |= MTK_QTX_SCH_MAX_RATE_EN |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 1) |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 5);
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_WEIGHT, 1);
++			break;
++		case SPEED_1000:
++			val |= MTK_QTX_SCH_MAX_RATE_EN |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 10) |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 5) |
++			       FIELD_PREP(MTK_QTX_SCH_MAX_RATE_WEIGHT, 10);
++			break;
++		default:
++			break;
++		}
++	}
++
++	ofs = MTK_QTX_OFFSET * idx;
++	mtk_w32(eth, val, soc->reg_map->qdma.qtx_sch + ofs);
++}
++
+ static void mtk_mac_link_up(struct phylink_config *config,
+ 			    struct phy_device *phy,
+ 			    unsigned int mode, phy_interface_t interface,
+@@ -645,6 +718,8 @@ static void mtk_mac_link_up(struct phyli
+ 		break;
+ 	}
+ 
++	mtk_set_queue_speed(mac->hw, mac->id, speed);
++
+ 	/* Configure duplex */
+ 	if (duplex == DUPLEX_FULL)
+ 		mcr |= MAC_MCR_FORCE_DPX;
+@@ -1106,7 +1181,8 @@ static void mtk_tx_set_dma_desc_v1(struc
+ 
+ 	WRITE_ONCE(desc->txd1, info->addr);
+ 
+-	data = TX_DMA_SWC | TX_DMA_PLEN0(info->size);
++	data = TX_DMA_SWC | TX_DMA_PLEN0(info->size) |
++	       FIELD_PREP(TX_DMA_PQID, info->qid);
+ 	if (info->last)
+ 		data |= TX_DMA_LS0;
+ 	WRITE_ONCE(desc->txd3, data);
+@@ -1140,9 +1216,6 @@ static void mtk_tx_set_dma_desc_v2(struc
+ 		data |= TX_DMA_LS0;
+ 	WRITE_ONCE(desc->txd3, data);
+ 
+-	if (!info->qid && mac->id)
+-		info->qid = MTK_QDMA_GMAC2_QID;
+-
+ 	data = (mac->id + 1) << TX_DMA_FPORT_SHIFT_V2; /* forward port */
+ 	data |= TX_DMA_SWC_V2 | QID_BITS_V2(info->qid);
+ 	WRITE_ONCE(desc->txd4, data);
+@@ -1186,11 +1259,12 @@ static int mtk_tx_map(struct sk_buff *sk
+ 		.gso = gso,
+ 		.csum = skb->ip_summed == CHECKSUM_PARTIAL,
+ 		.vlan = skb_vlan_tag_present(skb),
+-		.qid = skb->mark & MTK_QDMA_TX_MASK,
++		.qid = skb_get_queue_mapping(skb),
+ 		.vlan_tci = skb_vlan_tag_get(skb),
+ 		.first = true,
+ 		.last = !skb_is_nonlinear(skb),
+ 	};
++	struct netdev_queue *txq;
+ 	struct mtk_mac *mac = netdev_priv(dev);
+ 	struct mtk_eth *eth = mac->hw;
+ 	const struct mtk_soc_data *soc = eth->soc;
+@@ -1198,8 +1272,10 @@ static int mtk_tx_map(struct sk_buff *sk
+ 	struct mtk_tx_dma *itxd_pdma, *txd_pdma;
+ 	struct mtk_tx_buf *itx_buf, *tx_buf;
+ 	int i, n_desc = 1;
++	int queue = skb_get_queue_mapping(skb);
+ 	int k = 0;
+ 
++	txq = netdev_get_tx_queue(dev, queue);
+ 	itxd = ring->next_free;
+ 	itxd_pdma = qdma_to_pdma(ring, itxd);
+ 	if (itxd == ring->last_free)
+@@ -1248,7 +1324,7 @@ static int mtk_tx_map(struct sk_buff *sk
+ 			memset(&txd_info, 0, sizeof(struct mtk_tx_dma_desc_info));
+ 			txd_info.size = min_t(unsigned int, frag_size,
+ 					      soc->txrx.dma_max_len);
+-			txd_info.qid = skb->mark & MTK_QDMA_TX_MASK;
++			txd_info.qid = queue;
+ 			txd_info.last = i == skb_shinfo(skb)->nr_frags - 1 &&
+ 					!(frag_size - txd_info.size);
+ 			txd_info.addr = skb_frag_dma_map(eth->dma_dev, frag,
+@@ -1287,7 +1363,7 @@ static int mtk_tx_map(struct sk_buff *sk
+ 			txd_pdma->txd2 |= TX_DMA_LS1;
+ 	}
+ 
+-	netdev_sent_queue(dev, skb->len);
++	netdev_tx_sent_queue(txq, skb->len);
+ 	skb_tx_timestamp(skb);
+ 
+ 	ring->next_free = mtk_qdma_phys_to_virt(ring, txd->txd2);
+@@ -1299,8 +1375,7 @@ static int mtk_tx_map(struct sk_buff *sk
+ 	wmb();
+ 
+ 	if (MTK_HAS_CAPS(soc->caps, MTK_QDMA)) {
+-		if (netif_xmit_stopped(netdev_get_tx_queue(dev, 0)) ||
+-		    !netdev_xmit_more())
++		if (netif_xmit_stopped(txq) || !netdev_xmit_more())
+ 			mtk_w32(eth, txd->txd2, soc->reg_map->qdma.ctx_ptr);
+ 	} else {
+ 		int next_idx;
+@@ -1369,7 +1444,7 @@ static void mtk_wake_queue(struct mtk_et
+ 	for (i = 0; i < MTK_MAC_COUNT; i++) {
+ 		if (!eth->netdev[i])
+ 			continue;
+-		netif_wake_queue(eth->netdev[i]);
++		netif_tx_wake_all_queues(eth->netdev[i]);
+ 	}
+ }
+ 
+@@ -1393,7 +1468,7 @@ static netdev_tx_t mtk_start_xmit(struct
+ 
+ 	tx_num = mtk_cal_txd_req(eth, skb);
+ 	if (unlikely(atomic_read(&ring->free_count) <= tx_num)) {
+-		netif_stop_queue(dev);
++		netif_tx_stop_all_queues(dev);
+ 		netif_err(eth, tx_queued, dev,
+ 			  "Tx Ring full when queue awake!\n");
+ 		spin_unlock(&eth->page_lock);
+@@ -1419,7 +1494,7 @@ static netdev_tx_t mtk_start_xmit(struct
+ 		goto drop;
+ 
+ 	if (unlikely(atomic_read(&ring->free_count) <= ring->thresh))
+-		netif_stop_queue(dev);
++		netif_tx_stop_all_queues(dev);
+ 
+ 	spin_unlock(&eth->page_lock);
+ 
+@@ -1586,10 +1661,12 @@ static int mtk_xdp_submit_frame(struct m
+ 	struct skb_shared_info *sinfo = xdp_get_shared_info_from_frame(xdpf);
+ 	const struct mtk_soc_data *soc = eth->soc;
+ 	struct mtk_tx_ring *ring = &eth->tx_ring;
++	struct mtk_mac *mac = netdev_priv(dev);
+ 	struct mtk_tx_dma_desc_info txd_info = {
+ 		.size	= xdpf->len,
+ 		.first	= true,
+ 		.last	= !xdp_frame_has_frags(xdpf),
++		.qid	= mac->id,
+ 	};
+ 	int err, index = 0, n_desc = 1, nr_frags;
+ 	struct mtk_tx_buf *htx_buf, *tx_buf;
+@@ -1639,6 +1716,7 @@ static int mtk_xdp_submit_frame(struct m
+ 		memset(&txd_info, 0, sizeof(struct mtk_tx_dma_desc_info));
+ 		txd_info.size = skb_frag_size(&sinfo->frags[index]);
+ 		txd_info.last = index + 1 == nr_frags;
++		txd_info.qid = mac->id;
+ 		data = skb_frag_address(&sinfo->frags[index]);
+ 
+ 		index++;
+@@ -1993,8 +2071,46 @@ rx_done:
+ 	return done;
+ }
+ 
++struct mtk_poll_state {
++    struct netdev_queue *txq;
++    unsigned int total;
++    unsigned int done;
++    unsigned int bytes;
++};
++
++static void
++mtk_poll_tx_done(struct mtk_eth *eth, struct mtk_poll_state *state, u8 mac,
++		 struct sk_buff *skb)
++{
++	struct netdev_queue *txq;
++	struct net_device *dev;
++	unsigned int bytes = skb->len;
++
++	state->total++;
++	eth->tx_packets++;
++	eth->tx_bytes += bytes;
++
++	dev = eth->netdev[mac];
++	if (!dev)
++		return;
++
++	txq = netdev_get_tx_queue(dev, skb_get_queue_mapping(skb));
++	if (state->txq == txq) {
++		state->done++;
++		state->bytes += bytes;
++		return;
++	}
++
++	if (state->txq)
++		netdev_tx_completed_queue(state->txq, state->done, state->bytes);
++
++	state->txq = txq;
++	state->done = 1;
++	state->bytes = bytes;
++}
++
+ static int mtk_poll_tx_qdma(struct mtk_eth *eth, int budget,
+-			    unsigned int *done, unsigned int *bytes)
++			    struct mtk_poll_state *state)
+ {
+ 	const struct mtk_reg_map *reg_map = eth->soc->reg_map;
+ 	struct mtk_tx_ring *ring = &eth->tx_ring;
+@@ -2026,12 +2142,9 @@ static int mtk_poll_tx_qdma(struct mtk_e
+ 			break;
+ 
+ 		if (tx_buf->data != (void *)MTK_DMA_DUMMY_DESC) {
+-			if (tx_buf->type == MTK_TYPE_SKB) {
+-				struct sk_buff *skb = tx_buf->data;
++			if (tx_buf->type == MTK_TYPE_SKB)
++				mtk_poll_tx_done(eth, state, mac, tx_buf->data);
+ 
+-				bytes[mac] += skb->len;
+-				done[mac]++;
+-			}
+ 			budget--;
+ 		}
+ 		mtk_tx_unmap(eth, tx_buf, &bq, true);
+@@ -2050,7 +2163,7 @@ static int mtk_poll_tx_qdma(struct mtk_e
+ }
+ 
+ static int mtk_poll_tx_pdma(struct mtk_eth *eth, int budget,
+-			    unsigned int *done, unsigned int *bytes)
++			    struct mtk_poll_state *state)
+ {
+ 	struct mtk_tx_ring *ring = &eth->tx_ring;
+ 	struct mtk_tx_buf *tx_buf;
+@@ -2068,12 +2181,8 @@ static int mtk_poll_tx_pdma(struct mtk_e
+ 			break;
+ 
+ 		if (tx_buf->data != (void *)MTK_DMA_DUMMY_DESC) {
+-			if (tx_buf->type == MTK_TYPE_SKB) {
+-				struct sk_buff *skb = tx_buf->data;
+-
+-				bytes[0] += skb->len;
+-				done[0]++;
+-			}
++			if (tx_buf->type == MTK_TYPE_SKB)
++				mtk_poll_tx_done(eth, state, 0, tx_buf->data);
+ 			budget--;
+ 		}
+ 		mtk_tx_unmap(eth, tx_buf, &bq, true);
+@@ -2095,26 +2204,15 @@ static int mtk_poll_tx(struct mtk_eth *e
+ {
+ 	struct mtk_tx_ring *ring = &eth->tx_ring;
+ 	struct dim_sample dim_sample = {};
+-	unsigned int done[MTK_MAX_DEVS];
+-	unsigned int bytes[MTK_MAX_DEVS];
+-	int total = 0, i;
+-
+-	memset(done, 0, sizeof(done));
+-	memset(bytes, 0, sizeof(bytes));
++	struct mtk_poll_state state = {};
+ 
+ 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_QDMA))
+-		budget = mtk_poll_tx_qdma(eth, budget, done, bytes);
++		budget = mtk_poll_tx_qdma(eth, budget, &state);
+ 	else
+-		budget = mtk_poll_tx_pdma(eth, budget, done, bytes);
++		budget = mtk_poll_tx_pdma(eth, budget, &state);
+ 
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
+-		if (!eth->netdev[i] || !done[i])
+-			continue;
+-		netdev_completed_queue(eth->netdev[i], done[i], bytes[i]);
+-		total += done[i];
+-		eth->tx_packets += done[i];
+-		eth->tx_bytes += bytes[i];
+-	}
++	if (state.txq)
++		netdev_tx_completed_queue(state.txq, state.done, state.bytes);
+ 
+ 	dim_update_sample(eth->tx_events, eth->tx_packets, eth->tx_bytes,
+ 			  &dim_sample);
+@@ -2124,7 +2222,7 @@ static int mtk_poll_tx(struct mtk_eth *e
+ 	    (atomic_read(&ring->free_count) > ring->thresh))
+ 		mtk_wake_queue(eth);
+ 
+-	return total;
++	return state.total;
+ }
+ 
+ static void mtk_handle_status_irq(struct mtk_eth *eth)
+@@ -2210,6 +2308,7 @@ static int mtk_tx_alloc(struct mtk_eth *
+ 	int i, sz = soc->txrx.txd_size;
+ 	struct mtk_tx_dma_v2 *txd;
+ 	int ring_size;
++	u32 ofs, val;
+ 
+ 	if (MTK_HAS_CAPS(soc->caps, MTK_QDMA))
+ 		ring_size = MTK_QDMA_RING_SIZE;
+@@ -2277,8 +2376,25 @@ static int mtk_tx_alloc(struct mtk_eth *
+ 			ring->phys + ((ring_size - 1) * sz),
+ 			soc->reg_map->qdma.crx_ptr);
+ 		mtk_w32(eth, ring->last_free_ptr, soc->reg_map->qdma.drx_ptr);
+-		mtk_w32(eth, (QDMA_RES_THRES << 8) | QDMA_RES_THRES,
+-			soc->reg_map->qdma.qtx_cfg);
++
++		for (i = 0, ofs = 0; i < MTK_QDMA_NUM_QUEUES; i++) {
++			val = (QDMA_RES_THRES << 8) | QDMA_RES_THRES;
++			mtk_w32(eth, val, soc->reg_map->qdma.qtx_cfg + ofs);
++
++			val = MTK_QTX_SCH_MIN_RATE_EN |
++			      /* minimum: 10 Mbps */
++			      FIELD_PREP(MTK_QTX_SCH_MIN_RATE_MAN, 1) |
++			      FIELD_PREP(MTK_QTX_SCH_MIN_RATE_EXP, 4) |
++			      MTK_QTX_SCH_LEAKY_BUCKET_SIZE;
++			if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++				val |= MTK_QTX_SCH_LEAKY_BUCKET_EN;
++			mtk_w32(eth, val, soc->reg_map->qdma.qtx_sch + ofs);
++			ofs += MTK_QTX_OFFSET;
++		}
++		val = MTK_QDMA_TX_SCH_MAX_WFQ | (MTK_QDMA_TX_SCH_MAX_WFQ << 16);
++		mtk_w32(eth, val, soc->reg_map->qdma.tx_sch_rate);
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++			mtk_w32(eth, val, soc->reg_map->qdma.tx_sch_rate + 4);
+ 	} else {
+ 		mtk_w32(eth, ring->phys_pdma, MT7628_TX_BASE_PTR0);
+ 		mtk_w32(eth, ring_size, MT7628_TX_MAX_CNT0);
+@@ -2960,7 +3076,7 @@ static int mtk_start_dma(struct mtk_eth
+ 		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
+ 			val |= MTK_MUTLI_CNT | MTK_RESV_BUF |
+ 			       MTK_WCOMP_EN | MTK_DMAD_WR_WDONE |
+-			       MTK_CHK_DDONE_EN;
++			       MTK_CHK_DDONE_EN | MTK_LEAKY_BUCKET_EN;
+ 		else
+ 			val |= MTK_RX_BT_32DWORDS;
+ 		mtk_w32(eth, val, reg_map->qdma.glo_cfg);
+@@ -3006,6 +3122,45 @@ static void mtk_gdm_config(struct mtk_et
+ 	mtk_w32(eth, 0, MTK_RST_GL);
+ }
+ 
++static int mtk_device_event(struct notifier_block *n, unsigned long event, void *ptr)
++{
++	struct mtk_mac *mac = container_of(n, struct mtk_mac, device_notifier);
++	struct mtk_eth *eth = mac->hw;
++	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
++	struct ethtool_link_ksettings s;
++	struct net_device *ldev;
++	struct list_head *iter;
++	struct dsa_port *dp;
++
++	if (event != NETDEV_CHANGE)
++		return NOTIFY_DONE;
++
++	netdev_for_each_lower_dev(dev, ldev, iter) {
++		if (netdev_priv(ldev) == mac)
++			goto found;
++	}
++
++	return NOTIFY_DONE;
++
++found:
++	if (!dsa_slave_dev_check(dev))
++		return NOTIFY_DONE;
++
++	if (__ethtool_get_link_ksettings(dev, &s))
++		return NOTIFY_DONE;
++
++	if (s.base.speed == 0 || s.base.speed == ((__u32)-1))
++		return NOTIFY_DONE;
++
++	dp = dsa_port_from_netdev(dev);
++	if (dp->index >= MTK_QDMA_NUM_QUEUES)
++		return NOTIFY_DONE;
++
++	mtk_set_queue_speed(eth, dp->index + 3, s.base.speed);
++
++	return NOTIFY_DONE;
++}
++
+ static int mtk_open(struct net_device *dev)
+ {
+ 	struct mtk_mac *mac = netdev_priv(dev);
+@@ -3048,7 +3203,8 @@ static int mtk_open(struct net_device *d
+ 		refcount_inc(&eth->dma_refcnt);
+ 
+ 	phylink_start(mac->phylink);
+-	netif_start_queue(dev);
++	netif_tx_start_all_queues(dev);
++
+ 	return 0;
+ }
+ 
+@@ -3774,8 +3930,12 @@ static int mtk_unreg_dev(struct mtk_eth
+ 	int i;
+ 
+ 	for (i = 0; i < MTK_MAC_COUNT; i++) {
++		struct mtk_mac *mac;
+ 		if (!eth->netdev[i])
+ 			continue;
++		mac = netdev_priv(eth->netdev[i]);
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_QDMA))
++			unregister_netdevice_notifier(&mac->device_notifier);
+ 		unregister_netdev(eth->netdev[i]);
+ 	}
+ 
+@@ -3992,6 +4152,23 @@ static int mtk_set_rxnfc(struct net_devi
+ 	return ret;
+ }
+ 
++static u16 mtk_select_queue(struct net_device *dev, struct sk_buff *skb,
++			    struct net_device *sb_dev)
++{
++	struct mtk_mac *mac = netdev_priv(dev);
++	unsigned int queue = 0;
++
++	if (netdev_uses_dsa(dev))
++		queue = skb_get_queue_mapping(skb) + 3;
++	else
++		queue = mac->id;
++
++	if (queue >= dev->num_tx_queues)
++		queue = 0;
++
++	return queue;
++}
++
+ static const struct ethtool_ops mtk_ethtool_ops = {
+ 	.get_link_ksettings	= mtk_get_link_ksettings,
+ 	.set_link_ksettings	= mtk_set_link_ksettings,
+@@ -4027,6 +4204,7 @@ static const struct net_device_ops mtk_n
+ 	.ndo_setup_tc		= mtk_eth_setup_tc,
+ 	.ndo_bpf		= mtk_xdp,
+ 	.ndo_xdp_xmit		= mtk_xdp_xmit,
++	.ndo_select_queue	= mtk_select_queue,
+ };
+ 
+ static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np)
+@@ -4036,6 +4214,7 @@ static int mtk_add_mac(struct mtk_eth *e
+ 	struct phylink *phylink;
+ 	struct mtk_mac *mac;
+ 	int id, err;
++	int txqs = 1;
+ 
+ 	if (!_id) {
+ 		dev_err(eth->dev, "missing mac id\n");
+@@ -4053,7 +4232,10 @@ static int mtk_add_mac(struct mtk_eth *e
+ 		return -EINVAL;
+ 	}
+ 
+-	eth->netdev[id] = alloc_etherdev(sizeof(*mac));
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_QDMA))
++		txqs = MTK_QDMA_NUM_QUEUES;
++
++	eth->netdev[id] = alloc_etherdev_mqs(sizeof(*mac), txqs, 1);
+ 	if (!eth->netdev[id]) {
+ 		dev_err(eth->dev, "alloc_etherdev failed\n");
+ 		return -ENOMEM;
+@@ -4150,6 +4332,11 @@ static int mtk_add_mac(struct mtk_eth *e
+ 	else
+ 		eth->netdev[id]->max_mtu = MTK_MAX_RX_LENGTH_2K - MTK_RX_ETH_HLEN;
+ 
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_QDMA)) {
++		mac->device_notifier.notifier_call = mtk_device_event;
++		register_netdevice_notifier(&mac->device_notifier);
++	}
++
+ 	return 0;
+ 
+ free_netdev:
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -22,6 +22,7 @@
+ #include <linux/bpf_trace.h>
+ #include "mtk_ppe.h"
+ 
++#define MTK_QDMA_NUM_QUEUES	16
+ #define MTK_QDMA_PAGE_SIZE	2048
+ #define MTK_MAX_RX_LENGTH	1536
+ #define MTK_MAX_RX_LENGTH_2K	2048
+@@ -216,8 +217,26 @@
+ #define MTK_RING_MAX_AGG_CNT_H		((MTK_HW_LRO_MAX_AGG_CNT >> 6) & 0x3)
+ 
+ /* QDMA TX Queue Configuration Registers */
++#define MTK_QTX_OFFSET		0x10
+ #define QDMA_RES_THRES		4
+ 
++/* QDMA Tx Queue Scheduler Configuration Registers */
++#define MTK_QTX_SCH_TX_SEL		BIT(31)
++#define MTK_QTX_SCH_TX_SEL_V2		GENMASK(31, 30)
++
++#define MTK_QTX_SCH_LEAKY_BUCKET_EN	BIT(30)
++#define MTK_QTX_SCH_LEAKY_BUCKET_SIZE	GENMASK(29, 28)
++#define MTK_QTX_SCH_MIN_RATE_EN		BIT(27)
++#define MTK_QTX_SCH_MIN_RATE_MAN	GENMASK(26, 20)
++#define MTK_QTX_SCH_MIN_RATE_EXP	GENMASK(19, 16)
++#define MTK_QTX_SCH_MAX_RATE_WEIGHT	GENMASK(15, 12)
++#define MTK_QTX_SCH_MAX_RATE_EN		BIT(11)
++#define MTK_QTX_SCH_MAX_RATE_MAN	GENMASK(10, 4)
++#define MTK_QTX_SCH_MAX_RATE_EXP	GENMASK(3, 0)
++
++/* QDMA TX Scheduler Rate Control Register */
++#define MTK_QDMA_TX_SCH_MAX_WFQ		BIT(15)
++
+ /* QDMA Global Configuration Register */
+ #define MTK_RX_2B_OFFSET	BIT(31)
+ #define MTK_RX_BT_32DWORDS	(3 << 11)
+@@ -236,6 +255,7 @@
+ #define MTK_WCOMP_EN		BIT(24)
+ #define MTK_RESV_BUF		(0x40 << 16)
+ #define MTK_MUTLI_CNT		(0x4 << 12)
++#define MTK_LEAKY_BUCKET_EN	BIT(11)
+ 
+ /* QDMA Flow Control Register */
+ #define FC_THRES_DROP_MODE	BIT(20)
+@@ -266,8 +286,6 @@
+ #define MTK_STAT_OFFSET		0x40
+ 
+ /* QDMA TX NUM */
+-#define MTK_QDMA_TX_NUM		16
+-#define MTK_QDMA_TX_MASK	(MTK_QDMA_TX_NUM - 1)
+ #define QID_BITS_V2(x)		(((x) & 0x3f) << 16)
+ #define MTK_QDMA_GMAC2_QID	8
+ 
+@@ -297,6 +315,7 @@
+ #define TX_DMA_PLEN0(x)		(((x) & eth->soc->txrx.dma_max_len) << eth->soc->txrx.dma_len_offset)
+ #define TX_DMA_PLEN1(x)		((x) & eth->soc->txrx.dma_max_len)
+ #define TX_DMA_SWC		BIT(14)
++#define TX_DMA_PQID		GENMASK(3, 0)
+ 
+ /* PDMA on MT7628 */
+ #define TX_DMA_DONE		BIT(31)
+@@ -957,6 +976,7 @@ struct mtk_reg_map {
+ 	} pdma;
+ 	struct {
+ 		u32	qtx_cfg;	/* tx queue configuration */
++		u32	qtx_sch;	/* tx queue scheduler configuration */
+ 		u32	rx_ptr;		/* rx base pointer */
+ 		u32	rx_cnt_cfg;	/* rx max count configuration */
+ 		u32	qcrx_ptr;	/* rx cpu pointer */
+@@ -974,6 +994,7 @@ struct mtk_reg_map {
+ 		u32	fq_tail;	/* fq tail pointer */
+ 		u32	fq_count;	/* fq free page count */
+ 		u32	fq_blen;	/* fq free page buffer length */
++		u32	tx_sch_rate;	/* tx scheduler rate control registers */
+ 	} qdma;
+ 	u32	gdm1_cnt;
+ 	u32	gdma_to_ppe;
+@@ -1177,6 +1198,7 @@ struct mtk_mac {
+ 	__be32				hwlro_ip[MTK_MAX_LRO_IP_CNT];
+ 	int				hwlro_ip_cnt;
+ 	unsigned int			syscfg0;
++	struct notifier_block		device_notifier;
+ };
+ 
+ /* the struct describing the SoC. these are declared in the soc_xyz.c files */
diff --git a/target/linux/generic/backport-6.1/730-05-v6.3-net-dsa-tag_mtk-assign-per-port-queues.patch b/target/linux/generic/backport-6.1/730-05-v6.3-net-dsa-tag_mtk-assign-per-port-queues.patch
new file mode 100644
index 00000000000000..186df4bdc924d4
--- /dev/null
+++ b/target/linux/generic/backport-6.1/730-05-v6.3-net-dsa-tag_mtk-assign-per-port-queues.patch
@@ -0,0 +1,20 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 28 Oct 2022 18:16:03 +0200
+Subject: [PATCH] net: dsa: tag_mtk: assign per-port queues
+
+Keeps traffic sent to the switch within link speed limits
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/dsa/tag_mtk.c
++++ b/net/dsa/tag_mtk.c
+@@ -25,6 +25,8 @@ static struct sk_buff *mtk_tag_xmit(stru
+ 	u8 xmit_tpid;
+ 	u8 *mtk_tag;
+ 
++	skb_set_queue_mapping(skb, dp->index);
++
+ 	/* Build the special tag after the MAC Source Address. If VLAN header
+ 	 * is present, it's required that VLAN header and special tag is
+ 	 * being combined. Only in this way we can allow the switch can parse
diff --git a/target/linux/generic/backport-6.1/730-06-v6.3-net-ethernet-mediatek-ppe-assign-per-port-queues-for.patch b/target/linux/generic/backport-6.1/730-06-v6.3-net-ethernet-mediatek-ppe-assign-per-port-queues-for.patch
new file mode 100644
index 00000000000000..d29177eee722e8
--- /dev/null
+++ b/target/linux/generic/backport-6.1/730-06-v6.3-net-ethernet-mediatek-ppe-assign-per-port-queues-for.patch
@@ -0,0 +1,93 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 3 Nov 2022 17:49:44 +0100
+Subject: [PATCH] net: ethernet: mediatek: ppe: assign per-port queues
+ for offloaded traffic
+
+Keeps traffic sent to the switch within link speed limits
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -399,6 +399,24 @@ int mtk_foe_entry_set_wdma(struct mtk_et
+ 	return 0;
+ }
+ 
++int mtk_foe_entry_set_queue(struct mtk_eth *eth, struct mtk_foe_entry *entry,
++			    unsigned int queue)
++{
++	u32 *ib2 = mtk_foe_entry_ib2(eth, entry);
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++		*ib2 &= ~MTK_FOE_IB2_QID_V2;
++		*ib2 |= FIELD_PREP(MTK_FOE_IB2_QID_V2, queue);
++		*ib2 |= MTK_FOE_IB2_PSE_QOS_V2;
++	} else {
++		*ib2 &= ~MTK_FOE_IB2_QID;
++		*ib2 |= FIELD_PREP(MTK_FOE_IB2_QID, queue);
++		*ib2 |= MTK_FOE_IB2_PSE_QOS;
++	}
++
++	return 0;
++}
++
+ static bool
+ mtk_flow_entry_match(struct mtk_eth *eth, struct mtk_flow_entry *entry,
+ 		     struct mtk_foe_entry *data)
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h
+@@ -68,7 +68,9 @@ enum {
+ #define MTK_FOE_IB2_DSCP		GENMASK(31, 24)
+ 
+ /* CONFIG_MEDIATEK_NETSYS_V2 */
++#define MTK_FOE_IB2_QID_V2			GENMASK(6, 0)
+ #define MTK_FOE_IB2_PORT_MG_V2		BIT(7)
++#define MTK_FOE_IB2_PSE_QOS_V2		BIT(8)
+ #define MTK_FOE_IB2_DEST_PORT_V2	GENMASK(12, 9)
+ #define MTK_FOE_IB2_MULTICAST_V2	BIT(13)
+ #define MTK_FOE_IB2_WDMA_WINFO_V2	BIT(19)
+@@ -351,6 +353,8 @@ int mtk_foe_entry_set_pppoe(struct mtk_e
+ 			    int sid);
+ int mtk_foe_entry_set_wdma(struct mtk_eth *eth, struct mtk_foe_entry *entry,
+ 			   int wdma_idx, int txq, int bss, int wcid);
++int mtk_foe_entry_set_queue(struct mtk_eth *eth, struct mtk_foe_entry *entry,
++			    unsigned int queue);
+ int mtk_foe_entry_commit(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+ void mtk_foe_entry_clear(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+ int mtk_foe_entry_idle_time(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
+@@ -188,7 +188,7 @@ mtk_flow_set_output_device(struct mtk_et
+ 			   int *wed_index)
+ {
+ 	struct mtk_wdma_info info = {};
+-	int pse_port, dsa_port;
++	int pse_port, dsa_port, queue;
+ 
+ 	if (mtk_flow_get_wdma_info(dev, dest_mac, &info) == 0) {
+ 		mtk_foe_entry_set_wdma(eth, foe, info.wdma_idx, info.queue,
+@@ -212,8 +212,6 @@ mtk_flow_set_output_device(struct mtk_et
+ 	}
+ 
+ 	dsa_port = mtk_flow_get_dsa_port(&dev);
+-	if (dsa_port >= 0)
+-		mtk_foe_entry_set_dsa(eth, foe, dsa_port);
+ 
+ 	if (dev == eth->netdev[0])
+ 		pse_port = 1;
+@@ -222,6 +220,14 @@ mtk_flow_set_output_device(struct mtk_et
+ 	else
+ 		return -EOPNOTSUPP;
+ 
++	if (dsa_port >= 0) {
++		mtk_foe_entry_set_dsa(eth, foe, dsa_port);
++		queue = 3 + dsa_port;
++	} else {
++		queue = pse_port - 1;
++	}
++	mtk_foe_entry_set_queue(eth, foe, queue);
++
+ out:
+ 	mtk_foe_entry_set_pse_port(eth, foe, pse_port);
+ 
diff --git a/target/linux/generic/backport-6.1/730-07-v6.3-net-ethernet-mtk_eth_soc-compile-out-netsys-v2-code-.patch b/target/linux/generic/backport-6.1/730-07-v6.3-net-ethernet-mtk_eth_soc-compile-out-netsys-v2-code-.patch
new file mode 100644
index 00000000000000..31a8ca3ea86f08
--- /dev/null
+++ b/target/linux/generic/backport-6.1/730-07-v6.3-net-ethernet-mtk_eth_soc-compile-out-netsys-v2-code-.patch
@@ -0,0 +1,28 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 27 Oct 2022 23:39:52 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: compile out netsys v2 code
+ on mt7621
+
+Avoid some branches in the hot path on low-end devices with limited CPU power,
+and reduce code size
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -921,7 +921,13 @@ enum mkt_eth_capabilities {
+ #define MTK_MUX_GMAC12_TO_GEPHY_SGMII   \
+ 	(MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII | MTK_MUX)
+ 
+-#define MTK_HAS_CAPS(caps, _x)		(((caps) & (_x)) == (_x))
++#ifdef CONFIG_SOC_MT7621
++#define MTK_CAP_MASK MTK_NETSYS_V2
++#else
++#define MTK_CAP_MASK 0
++#endif
++
++#define MTK_HAS_CAPS(caps, _x)		(((caps) & (_x) & ~(MTK_CAP_MASK)) == (_x))
+ 
+ #define MT7621_CAPS  (MTK_GMAC1_RGMII | MTK_GMAC1_TRGMII | \
+ 		      MTK_GMAC2_RGMII | MTK_SHARED_INT | \
diff --git a/target/linux/generic/backport-6.1/730-08-v6.3-net-dsa-add-support-for-DSA-rx-offloading-via-metada.patch b/target/linux/generic/backport-6.1/730-08-v6.3-net-dsa-add-support-for-DSA-rx-offloading-via-metada.patch
new file mode 100644
index 00000000000000..6b7f3d6018c583
--- /dev/null
+++ b/target/linux/generic/backport-6.1/730-08-v6.3-net-dsa-add-support-for-DSA-rx-offloading-via-metada.patch
@@ -0,0 +1,72 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 8 Nov 2022 15:03:15 +0100
+Subject: [PATCH] net: dsa: add support for DSA rx offloading via
+ metadata dst
+
+If a metadata dst is present with the type METADATA_HW_PORT_MUX on a dsa cpu
+port netdev, assume that it carries the port number and that there is no DSA
+tag present in the skb data.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/core/flow_dissector.c
++++ b/net/core/flow_dissector.c
+@@ -971,12 +971,14 @@ bool __skb_flow_dissect(const struct net
+ #if IS_ENABLED(CONFIG_NET_DSA)
+ 		if (unlikely(skb->dev && netdev_uses_dsa(skb->dev) &&
+ 			     proto == htons(ETH_P_XDSA))) {
++			struct metadata_dst *md_dst = skb_metadata_dst(skb);
+ 			const struct dsa_device_ops *ops;
+ 			int offset = 0;
+ 
+ 			ops = skb->dev->dsa_ptr->tag_ops;
+ 			/* Only DSA header taggers break flow dissection */
+-			if (ops->needed_headroom) {
++			if (ops->needed_headroom &&
++			    (!md_dst || md_dst->type != METADATA_HW_PORT_MUX)) {
+ 				if (ops->flow_dissect)
+ 					ops->flow_dissect(skb, &proto, &offset);
+ 				else
+--- a/net/dsa/dsa.c
++++ b/net/dsa/dsa.c
+@@ -11,6 +11,7 @@
+ #include <linux/netdevice.h>
+ #include <linux/sysfs.h>
+ #include <linux/ptp_classify.h>
++#include <net/dst_metadata.h>
+ 
+ #include "dsa_priv.h"
+ 
+@@ -216,6 +217,7 @@ static bool dsa_skb_defer_rx_timestamp(s
+ static int dsa_switch_rcv(struct sk_buff *skb, struct net_device *dev,
+ 			  struct packet_type *pt, struct net_device *unused)
+ {
++	struct metadata_dst *md_dst = skb_metadata_dst(skb);
+ 	struct dsa_port *cpu_dp = dev->dsa_ptr;
+ 	struct sk_buff *nskb = NULL;
+ 	struct dsa_slave_priv *p;
+@@ -229,7 +231,22 @@ static int dsa_switch_rcv(struct sk_buff
+ 	if (!skb)
+ 		return 0;
+ 
+-	nskb = cpu_dp->rcv(skb, dev);
++	if (md_dst && md_dst->type == METADATA_HW_PORT_MUX) {
++		unsigned int port = md_dst->u.port_info.port_id;
++
++		skb_dst_drop(skb);
++		if (!skb_has_extensions(skb))
++			skb->slow_gro = 0;
++
++		skb->dev = dsa_master_find_slave(dev, 0, port);
++		if (likely(skb->dev)) {
++			dsa_default_offload_fwd_mark(skb);
++			nskb = skb;
++		}
++	} else {
++		nskb = cpu_dp->rcv(skb, dev);
++	}
++
+ 	if (!nskb) {
+ 		kfree_skb(skb);
+ 		return 0;
diff --git a/target/linux/generic/backport-6.1/730-09-v6.3-net-ethernet-mtk_eth_soc-fix-VLAN-rx-hardware-accele.patch b/target/linux/generic/backport-6.1/730-09-v6.3-net-ethernet-mtk_eth_soc-fix-VLAN-rx-hardware-accele.patch
new file mode 100644
index 00000000000000..8c368868e48826
--- /dev/null
+++ b/target/linux/generic/backport-6.1/730-09-v6.3-net-ethernet-mtk_eth_soc-fix-VLAN-rx-hardware-accele.patch
@@ -0,0 +1,192 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 28 Oct 2022 11:01:12 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: fix VLAN rx hardware
+ acceleration
+
+- enable VLAN untagging for PDMA rx
+- make it possible to disable the feature via ethtool
+- pass VLAN tag to the DSA driver
+- untag special tag on PDMA only if no non-DSA devices are in use
+- disable special tag untagging on 7986 for now, since it's not working yet
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -23,6 +23,7 @@
+ #include <linux/jhash.h>
+ #include <linux/bitfield.h>
+ #include <net/dsa.h>
++#include <net/dst_metadata.h>
+ 
+ #include "mtk_eth_soc.h"
+ #include "mtk_wed.h"
+@@ -2022,16 +2023,22 @@ static int mtk_poll_rx(struct napi_struc
+ 						htons(RX_DMA_VPID(trxd.rxd4)),
+ 						RX_DMA_VID(trxd.rxd4));
+ 			} else if (trxd.rxd2 & RX_DMA_VTAG) {
+-				__vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q),
++				__vlan_hwaccel_put_tag(skb, htons(RX_DMA_VPID(trxd.rxd3)),
+ 						       RX_DMA_VID(trxd.rxd3));
+ 			}
++		}
++
++		/* When using VLAN untagging in combination with DSA, the
++		 * hardware treats the MTK special tag as a VLAN and untags it.
++		 */
++		if (skb_vlan_tag_present(skb) && netdev_uses_dsa(netdev)) {
++			unsigned int port = ntohs(skb->vlan_proto) & GENMASK(2, 0);
+ 
+-			/* If the device is attached to a dsa switch, the special
+-			 * tag inserted in VLAN field by hw switch can * be offloaded
+-			 * by RX HW VLAN offload. Clear vlan info.
+-			 */
+-			if (netdev_uses_dsa(netdev))
+-				__vlan_hwaccel_clear_tag(skb);
++			if (port < ARRAY_SIZE(eth->dsa_meta) &&
++			    eth->dsa_meta[port])
++				skb_dst_set_noref(skb, &eth->dsa_meta[port]->dst);
++
++			__vlan_hwaccel_clear_tag(skb);
+ 		}
+ 
+ 		skb_record_rx_queue(skb, 0);
+@@ -2856,15 +2863,30 @@ static netdev_features_t mtk_fix_feature
+ 
+ static int mtk_set_features(struct net_device *dev, netdev_features_t features)
+ {
+-	int err = 0;
++	struct mtk_mac *mac = netdev_priv(dev);
++	struct mtk_eth *eth = mac->hw;
++	netdev_features_t diff = dev->features ^ features;
++	int i;
++
++	if ((diff & NETIF_F_LRO) && !(features & NETIF_F_LRO))
++		mtk_hwlro_netdev_disable(dev);
+ 
+-	if (!((dev->features ^ features) & NETIF_F_LRO))
++	/* Set RX VLAN offloading */
++	if (!(diff & NETIF_F_HW_VLAN_CTAG_RX))
+ 		return 0;
+ 
+-	if (!(features & NETIF_F_LRO))
+-		mtk_hwlro_netdev_disable(dev);
++	mtk_w32(eth, !!(features & NETIF_F_HW_VLAN_CTAG_RX),
++		MTK_CDMP_EG_CTRL);
+ 
+-	return err;
++	/* sync features with other MAC */
++	for (i = 0; i < MTK_MAC_COUNT; i++) {
++		if (!eth->netdev[i] || eth->netdev[i] == dev)
++			continue;
++		eth->netdev[i]->features &= ~NETIF_F_HW_VLAN_CTAG_RX;
++		eth->netdev[i]->features |= features & NETIF_F_HW_VLAN_CTAG_RX;
++	}
++
++	return 0;
+ }
+ 
+ /* wait for DMA to finish whatever it is doing before we start using it again */
+@@ -3161,11 +3183,45 @@ found:
+ 	return NOTIFY_DONE;
+ }
+ 
++static bool mtk_uses_dsa(struct net_device *dev)
++{
++#if IS_ENABLED(CONFIG_NET_DSA)
++	return netdev_uses_dsa(dev) &&
++	       dev->dsa_ptr->tag_ops->proto == DSA_TAG_PROTO_MTK;
++#else
++	return false;
++#endif
++}
++
+ static int mtk_open(struct net_device *dev)
+ {
+ 	struct mtk_mac *mac = netdev_priv(dev);
+ 	struct mtk_eth *eth = mac->hw;
+-	int err;
++	int i, err;
++
++	if (mtk_uses_dsa(dev) && !eth->prog) {
++		for (i = 0; i < ARRAY_SIZE(eth->dsa_meta); i++) {
++			struct metadata_dst *md_dst = eth->dsa_meta[i];
++
++			if (md_dst)
++				continue;
++
++			md_dst = metadata_dst_alloc(0, METADATA_HW_PORT_MUX,
++						    GFP_KERNEL);
++			if (!md_dst)
++				return -ENOMEM;
++
++			md_dst->u.port_info.port_id = i;
++			eth->dsa_meta[i] = md_dst;
++		}
++	} else {
++		/* Hardware special tag parsing needs to be disabled if at least
++		 * one MAC does not use DSA.
++		 */
++		u32 val = mtk_r32(eth, MTK_CDMP_IG_CTRL);
++		val &= ~MTK_CDMP_STAG_EN;
++		mtk_w32(eth, val, MTK_CDMP_IG_CTRL);
++	}
+ 
+ 	err = phylink_of_phy_connect(mac->phylink, mac->of_node, 0);
+ 	if (err) {
+@@ -3686,6 +3742,10 @@ static int mtk_hw_init(struct mtk_eth *e
+ 	 */
+ 	val = mtk_r32(eth, MTK_CDMQ_IG_CTRL);
+ 	mtk_w32(eth, val | MTK_CDMQ_STAG_EN, MTK_CDMQ_IG_CTRL);
++	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++		val = mtk_r32(eth, MTK_CDMP_IG_CTRL);
++		mtk_w32(eth, val | MTK_CDMP_STAG_EN, MTK_CDMP_IG_CTRL);
++	}
+ 
+ 	/* Enable RX VLan Offloading */
+ 	mtk_w32(eth, 1, MTK_CDMP_EG_CTRL);
+@@ -3922,6 +3982,12 @@ static int mtk_free_dev(struct mtk_eth *
+ 		free_netdev(eth->netdev[i]);
+ 	}
+ 
++	for (i = 0; i < ARRAY_SIZE(eth->dsa_meta); i++) {
++		if (!eth->dsa_meta[i])
++			break;
++		metadata_dst_free(eth->dsa_meta[i]);
++	}
++
+ 	return 0;
+ }
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -22,6 +22,9 @@
+ #include <linux/bpf_trace.h>
+ #include "mtk_ppe.h"
+ 
++#define MTK_MAX_DSA_PORTS	7
++#define MTK_DSA_PORT_MASK	GENMASK(2, 0)
++
+ #define MTK_QDMA_NUM_QUEUES	16
+ #define MTK_QDMA_PAGE_SIZE	2048
+ #define MTK_MAX_RX_LENGTH	1536
+@@ -105,6 +108,9 @@
+ #define MTK_CDMQ_IG_CTRL	0x1400
+ #define MTK_CDMQ_STAG_EN	BIT(0)
+ 
++/* CDMQ Exgress Control Register */
++#define MTK_CDMQ_EG_CTRL	0x1404
++
+ /* CDMP Ingress Control Register */
+ #define MTK_CDMP_IG_CTRL	0x400
+ #define MTK_CDMP_STAG_EN	BIT(0)
+@@ -1170,6 +1176,8 @@ struct mtk_eth {
+ 
+ 	int				ip_align;
+ 
++	struct metadata_dst		*dsa_meta[MTK_MAX_DSA_PORTS];
++
+ 	struct mtk_ppe			*ppe[2];
+ 	struct rhashtable		flow_table;
+ 
diff --git a/target/linux/generic/backport-6.1/730-12-v6.3-net-ethernet-mtk_eth_soc-disable-hardware-DSA-untagg.patch b/target/linux/generic/backport-6.1/730-12-v6.3-net-ethernet-mtk_eth_soc-disable-hardware-DSA-untagg.patch
new file mode 100644
index 00000000000000..efbceb9a13de1c
--- /dev/null
+++ b/target/linux/generic/backport-6.1/730-12-v6.3-net-ethernet-mtk_eth_soc-disable-hardware-DSA-untagg.patch
@@ -0,0 +1,42 @@
+From: =?UTF-8?q?Ar=C4=B1n=C3=A7=20=C3=9CNAL?= <arinc.unal@arinc9.com>
+Date: Sat, 28 Jan 2023 12:42:32 +0300
+Subject: [PATCH] net: ethernet: mtk_eth_soc: disable hardware DSA untagging
+ for second MAC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+According to my tests on MT7621AT and MT7623NI SoCs, hardware DSA untagging
+won't work on the second MAC. Therefore, disable this feature when the
+second MAC of the MT7621 and MT7623 SoCs is being used.
+
+Fixes: 2d7605a72906 ("net: ethernet: mtk_eth_soc: enable hardware DSA untagging")
+Link: https://lore.kernel.org/netdev/6249fc14-b38a-c770-36b4-5af6d41c21d3@arinc9.com/
+Tested-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Link: https://lore.kernel.org/r/20230128094232.2451947-1-arinc.unal@arinc9.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3199,7 +3199,8 @@ static int mtk_open(struct net_device *d
+ 	struct mtk_eth *eth = mac->hw;
+ 	int i, err;
+ 
+-	if (mtk_uses_dsa(dev) && !eth->prog) {
++	if ((mtk_uses_dsa(dev) && !eth->prog) &&
++	    !(mac->id == 1 && MTK_HAS_CAPS(eth->soc->caps, MTK_GMAC1_TRGMII))) {
+ 		for (i = 0; i < ARRAY_SIZE(eth->dsa_meta); i++) {
+ 			struct metadata_dst *md_dst = eth->dsa_meta[i];
+ 
+@@ -3216,7 +3217,8 @@ static int mtk_open(struct net_device *d
+ 		}
+ 	} else {
+ 		/* Hardware special tag parsing needs to be disabled if at least
+-		 * one MAC does not use DSA.
++		 * one MAC does not use DSA, or the second MAC of the MT7621 and
++		 * MT7623 SoCs is being used.
+ 		 */
+ 		u32 val = mtk_r32(eth, MTK_CDMP_IG_CTRL);
+ 		val &= ~MTK_CDMP_STAG_EN;
diff --git a/target/linux/generic/backport-6.1/730-13-v6.3-net-ethernet-mtk_eth_soc-enable-special-tag-when-any.patch b/target/linux/generic/backport-6.1/730-13-v6.3-net-ethernet-mtk_eth_soc-enable-special-tag-when-any.patch
new file mode 100644
index 00000000000000..c0bfd9bd042e07
--- /dev/null
+++ b/target/linux/generic/backport-6.1/730-13-v6.3-net-ethernet-mtk_eth_soc-enable-special-tag-when-any.patch
@@ -0,0 +1,54 @@
+From: =?UTF-8?q?Ar=C4=B1n=C3=A7=20=C3=9CNAL?= <arinc.unal@arinc9.com>
+Date: Sun, 5 Feb 2023 20:53:31 +0300
+Subject: [PATCH] net: ethernet: mtk_eth_soc: enable special tag when any MAC
+ uses DSA
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The special tag is only enabled when the first MAC uses DSA. However, it
+must be enabled when any MAC uses DSA. Change the check accordingly.
+
+This fixes hardware DSA untagging not working on the second MAC of the
+MT7621 and MT7623 SoCs, and likely other SoCs too. Therefore, remove the
+check that disables hardware DSA untagging for the second MAC of the MT7621
+and MT7623 SoCs.
+
+Fixes: a1f47752fd62 ("net: ethernet: mtk_eth_soc: disable hardware DSA untagging for second MAC")
+Co-developed-by: Richard van Schagen <richard@routerhints.com>
+Signed-off-by: Richard van Schagen <richard@routerhints.com>
+Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3134,7 +3134,7 @@ static void mtk_gdm_config(struct mtk_et
+ 
+ 		val |= config;
+ 
+-		if (!i && eth->netdev[0] && netdev_uses_dsa(eth->netdev[0]))
++		if (eth->netdev[i] && netdev_uses_dsa(eth->netdev[i]))
+ 			val |= MTK_GDMA_SPECIAL_TAG;
+ 
+ 		mtk_w32(eth, val, MTK_GDMA_FWD_CFG(i));
+@@ -3199,8 +3199,7 @@ static int mtk_open(struct net_device *d
+ 	struct mtk_eth *eth = mac->hw;
+ 	int i, err;
+ 
+-	if ((mtk_uses_dsa(dev) && !eth->prog) &&
+-	    !(mac->id == 1 && MTK_HAS_CAPS(eth->soc->caps, MTK_GMAC1_TRGMII))) {
++	if (mtk_uses_dsa(dev) && !eth->prog) {
+ 		for (i = 0; i < ARRAY_SIZE(eth->dsa_meta); i++) {
+ 			struct metadata_dst *md_dst = eth->dsa_meta[i];
+ 
+@@ -3217,8 +3216,7 @@ static int mtk_open(struct net_device *d
+ 		}
+ 	} else {
+ 		/* Hardware special tag parsing needs to be disabled if at least
+-		 * one MAC does not use DSA, or the second MAC of the MT7621 and
+-		 * MT7623 SoCs is being used.
++		 * one MAC does not use DSA.
+ 		 */
+ 		u32 val = mtk_r32(eth, MTK_CDMP_IG_CTRL);
+ 		val &= ~MTK_CDMP_STAG_EN;
diff --git a/target/linux/generic/backport-6.1/730-14-v6.3-net-ethernet-mtk_eth_soc-fix-DSA-TX-tag-hwaccel-for-.patch b/target/linux/generic/backport-6.1/730-14-v6.3-net-ethernet-mtk_eth_soc-fix-DSA-TX-tag-hwaccel-for-.patch
new file mode 100644
index 00000000000000..a9879ebfa9d21b
--- /dev/null
+++ b/target/linux/generic/backport-6.1/730-14-v6.3-net-ethernet-mtk_eth_soc-fix-DSA-TX-tag-hwaccel-for-.patch
@@ -0,0 +1,129 @@
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Tue, 7 Feb 2023 12:30:27 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: fix DSA TX tag hwaccel for switch
+ port 0
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Arınç reports that on his MT7621AT Unielec U7621-06 board and MT7623NI
+Bananapi BPI-R2, packets received by the CPU over mt7530 switch port 0
+(of which this driver acts as the DSA master) are not processed
+correctly by software. More precisely, they arrive without a DSA tag
+(in packet or in the hwaccel area - skb_metadata_dst()), so DSA cannot
+demux them towards the switch's interface for port 0. Traffic from other
+ports receives a skb_metadata_dst() with the correct port and is demuxed
+properly.
+
+Looking at mtk_poll_rx(), it becomes apparent that this driver uses the
+skb vlan hwaccel area:
+
+	union {
+		u32		vlan_all;
+		struct {
+			__be16	vlan_proto;
+			__u16	vlan_tci;
+		};
+	};
+
+as a temporary storage for the VLAN hwaccel tag, or the DSA hwaccel tag.
+If this is a DSA master it's a DSA hwaccel tag, and finally clears up
+the skb VLAN hwaccel header.
+
+I'm guessing that the problem is the (mis)use of API.
+skb_vlan_tag_present() looks like this:
+
+ #define skb_vlan_tag_present(__skb)	(!!(__skb)->vlan_all)
+
+So if both vlan_proto and vlan_tci are zeroes, skb_vlan_tag_present()
+returns precisely false. I don't know for sure what is the format of the
+DSA hwaccel tag, but I surely know that lowermost 3 bits of vlan_proto
+are 0 when receiving from port 0:
+
+	unsigned int port = vlan_proto & GENMASK(2, 0);
+
+If the RX descriptor has no other bits set to non-zero values in
+RX_DMA_VTAG, then the call to __vlan_hwaccel_put_tag() will not, in
+fact, make the subsequent skb_vlan_tag_present() return true, because
+it's implemented like this:
+
+static inline void __vlan_hwaccel_put_tag(struct sk_buff *skb,
+					  __be16 vlan_proto, u16 vlan_tci)
+{
+	skb->vlan_proto = vlan_proto;
+	skb->vlan_tci = vlan_tci;
+}
+
+What we need to do to fix this problem (assuming this is the problem) is
+to stop using skb->vlan_all as temporary storage for driver affairs, and
+just create some local variables that serve the same purpose, but
+hopefully better. Instead of calling skb_vlan_tag_present(), let's look
+at a boolean has_hwaccel_tag which we set to true when the RX DMA
+descriptors have something. Disambiguate based on netdev_uses_dsa()
+whether this is a VLAN or DSA hwaccel tag, and only call
+__vlan_hwaccel_put_tag() if we're certain it's a VLAN tag.
+
+Arınç confirms that the treatment works, so this validates the
+assumption.
+
+Link: https://lore.kernel.org/netdev/704f3a72-fc9e-714a-db54-272e17612637@arinc9.com/
+Fixes: 2d7605a72906 ("net: ethernet: mtk_eth_soc: enable hardware DSA untagging")
+Reported-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Tested-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1878,7 +1878,9 @@ static int mtk_poll_rx(struct napi_struc
+ 
+ 	while (done < budget) {
+ 		unsigned int pktlen, *rxdcsum;
++		bool has_hwaccel_tag = false;
+ 		struct net_device *netdev;
++		u16 vlan_proto, vlan_tci;
+ 		dma_addr_t dma_addr;
+ 		u32 hash, reason;
+ 		int mac = 0;
+@@ -2018,27 +2020,29 @@ static int mtk_poll_rx(struct napi_struc
+ 
+ 		if (netdev->features & NETIF_F_HW_VLAN_CTAG_RX) {
+ 			if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+-				if (trxd.rxd3 & RX_DMA_VTAG_V2)
+-					__vlan_hwaccel_put_tag(skb,
+-						htons(RX_DMA_VPID(trxd.rxd4)),
+-						RX_DMA_VID(trxd.rxd4));
++				if (trxd.rxd3 & RX_DMA_VTAG_V2) {
++					vlan_proto = RX_DMA_VPID(trxd.rxd4);
++					vlan_tci = RX_DMA_VID(trxd.rxd4);
++					has_hwaccel_tag = true;
++				}
+ 			} else if (trxd.rxd2 & RX_DMA_VTAG) {
+-				__vlan_hwaccel_put_tag(skb, htons(RX_DMA_VPID(trxd.rxd3)),
+-						       RX_DMA_VID(trxd.rxd3));
++				vlan_proto = RX_DMA_VPID(trxd.rxd3);
++				vlan_tci = RX_DMA_VID(trxd.rxd3);
++				has_hwaccel_tag = true;
+ 			}
+ 		}
+ 
+ 		/* When using VLAN untagging in combination with DSA, the
+ 		 * hardware treats the MTK special tag as a VLAN and untags it.
+ 		 */
+-		if (skb_vlan_tag_present(skb) && netdev_uses_dsa(netdev)) {
+-			unsigned int port = ntohs(skb->vlan_proto) & GENMASK(2, 0);
++		if (has_hwaccel_tag && netdev_uses_dsa(netdev)) {
++			unsigned int port = vlan_proto & GENMASK(2, 0);
+ 
+ 			if (port < ARRAY_SIZE(eth->dsa_meta) &&
+ 			    eth->dsa_meta[port])
+ 				skb_dst_set_noref(skb, &eth->dsa_meta[port]->dst);
+-
+-			__vlan_hwaccel_clear_tag(skb);
++		} else if (has_hwaccel_tag) {
++			__vlan_hwaccel_put_tag(skb, htons(vlan_proto), vlan_tci);
+ 		}
+ 
+ 		skb_record_rx_queue(skb, 0);
diff --git a/target/linux/generic/backport-6.1/730-15-v6.3-net-ethernet-mtk_wed-No-need-to-clear-memory-after-a.patch b/target/linux/generic/backport-6.1/730-15-v6.3-net-ethernet-mtk_wed-No-need-to-clear-memory-after-a.patch
new file mode 100644
index 00000000000000..a3bb1c5db77ed1
--- /dev/null
+++ b/target/linux/generic/backport-6.1/730-15-v6.3-net-ethernet-mtk_wed-No-need-to-clear-memory-after-a.patch
@@ -0,0 +1,26 @@
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Sun, 12 Feb 2023 07:51:51 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: No need to clear memory after a
+ dma_alloc_coherent() call
+
+dma_alloc_coherent() already clears the allocated memory, there is no need
+to explicitly call memset().
+
+Moreover, it is likely that the size in the memset() is incorrect and
+should be "size * sizeof(*ring->desc)".
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/d5acce7dd108887832c9719f62c7201b4c83b3fb.1676184599.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -779,7 +779,6 @@ mtk_wed_rro_ring_alloc(struct mtk_wed_de
+ 
+ 	ring->desc_size = sizeof(*ring->desc);
+ 	ring->size = size;
+-	memset(ring->desc, 0, size);
+ 
+ 	return 0;
+ }
diff --git a/target/linux/generic/backport-6.1/730-16-v6.3-net-ethernet-mtk_wed-fix-some-possible-NULL-pointer-.patch b/target/linux/generic/backport-6.1/730-16-v6.3-net-ethernet-mtk_wed-fix-some-possible-NULL-pointer-.patch
new file mode 100644
index 00000000000000..e043a681da40f6
--- /dev/null
+++ b/target/linux/generic/backport-6.1/730-16-v6.3-net-ethernet-mtk_wed-fix-some-possible-NULL-pointer-.patch
@@ -0,0 +1,61 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Wed, 7 Dec 2022 15:04:54 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: fix some possible NULL pointer
+ dereferences
+
+Fix possible NULL pointer dereference in mtk_wed_detach routine checking
+wo pointer is properly allocated before running mtk_wed_wo_reset() and
+mtk_wed_wo_deinit().
+Even if it is just a theoretical issue at the moment check wo pointer is
+not NULL in mtk_wed_mcu_msg_update.
+Moreover, honor mtk_wed_mcu_send_msg return value in mtk_wed_wo_reset()
+
+Fixes: 799684448e3e ("net: ethernet: mtk_wed: introduce wed wo support")
+Fixes: 4c5de09eb0d0 ("net: ethernet: mtk_wed: add configure wed wo support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -174,9 +174,10 @@ mtk_wed_wo_reset(struct mtk_wed_device *
+ 	mtk_wdma_tx_reset(dev);
+ 	mtk_wed_reset(dev, MTK_WED_RESET_WED);
+ 
+-	mtk_wed_mcu_send_msg(wo, MTK_WED_MODULE_ID_WO,
+-			     MTK_WED_WO_CMD_CHANGE_STATE, &state,
+-			     sizeof(state), false);
++	if (mtk_wed_mcu_send_msg(wo, MTK_WED_MODULE_ID_WO,
++				 MTK_WED_WO_CMD_CHANGE_STATE, &state,
++				 sizeof(state), false))
++		return;
+ 
+ 	if (readx_poll_timeout(mtk_wed_wo_read_status, dev, val,
+ 			       val == MTK_WED_WOIF_DISABLE_DONE,
+@@ -632,9 +633,11 @@ mtk_wed_detach(struct mtk_wed_device *de
+ 	mtk_wed_free_tx_rings(dev);
+ 
+ 	if (mtk_wed_get_rx_capa(dev)) {
+-		mtk_wed_wo_reset(dev);
++		if (hw->wed_wo)
++			mtk_wed_wo_reset(dev);
+ 		mtk_wed_free_rx_rings(dev);
+-		mtk_wed_wo_deinit(hw);
++		if (hw->wed_wo)
++			mtk_wed_wo_deinit(hw);
+ 	}
+ 
+ 	if (dev->wlan.bus_type == MTK_WED_BUS_PCIE) {
+--- a/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
+@@ -207,6 +207,9 @@ int mtk_wed_mcu_msg_update(struct mtk_we
+ 	if (dev->hw->version == 1)
+ 		return 0;
+ 
++	if (WARN_ON(!wo))
++		return -ENODEV;
++
+ 	return mtk_wed_mcu_send_msg(wo, MTK_WED_MODULE_ID_WO, id, data, len,
+ 				    true);
+ }
diff --git a/target/linux/generic/backport-6.1/730-17-v6.3-net-ethernet-mtk_wed-fix-possible-deadlock-if-mtk_we.patch b/target/linux/generic/backport-6.1/730-17-v6.3-net-ethernet-mtk_wed-fix-possible-deadlock-if-mtk_we.patch
new file mode 100644
index 00000000000000..0afe7106e5478b
--- /dev/null
+++ b/target/linux/generic/backport-6.1/730-17-v6.3-net-ethernet-mtk_wed-fix-possible-deadlock-if-mtk_we.patch
@@ -0,0 +1,58 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Wed, 7 Dec 2022 15:04:55 +0100
+Subject: [PATCH] net: ethernet: mtk_wed: fix possible deadlock if
+ mtk_wed_wo_init fails
+
+Introduce __mtk_wed_detach() in order to avoid a deadlock in
+mtk_wed_attach routine if mtk_wed_wo_init fails since both
+mtk_wed_attach and mtk_wed_detach run holding hw_lock mutex.
+
+Fixes: 4c5de09eb0d0 ("net: ethernet: mtk_wed: add configure wed wo support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -619,12 +619,10 @@ mtk_wed_deinit(struct mtk_wed_device *de
+ }
+ 
+ static void
+-mtk_wed_detach(struct mtk_wed_device *dev)
++__mtk_wed_detach(struct mtk_wed_device *dev)
+ {
+ 	struct mtk_wed_hw *hw = dev->hw;
+ 
+-	mutex_lock(&hw_lock);
+-
+ 	mtk_wed_deinit(dev);
+ 
+ 	mtk_wdma_rx_reset(dev);
+@@ -657,6 +655,13 @@ mtk_wed_detach(struct mtk_wed_device *de
+ 	module_put(THIS_MODULE);
+ 
+ 	hw->wed_dev = NULL;
++}
++
++static void
++mtk_wed_detach(struct mtk_wed_device *dev)
++{
++	mutex_lock(&hw_lock);
++	__mtk_wed_detach(dev);
+ 	mutex_unlock(&hw_lock);
+ }
+ 
+@@ -1538,8 +1543,10 @@ mtk_wed_attach(struct mtk_wed_device *de
+ 		ret = mtk_wed_wo_init(hw);
+ 	}
+ out:
+-	if (ret)
+-		mtk_wed_detach(dev);
++	if (ret) {
++		dev_err(dev->hw->dev, "failed to attach wed device\n");
++		__mtk_wed_detach(dev);
++	}
+ unlock:
+ 	mutex_unlock(&hw_lock);
+ 
diff --git a/target/linux/generic/backport-6.1/730-18-v6.3-net-ethernet-mtk_eth_soc-fix-tx-throughput-regressio.patch b/target/linux/generic/backport-6.1/730-18-v6.3-net-ethernet-mtk_eth_soc-fix-tx-throughput-regressio.patch
new file mode 100644
index 00000000000000..ca5b6b3a3e00cd
--- /dev/null
+++ b/target/linux/generic/backport-6.1/730-18-v6.3-net-ethernet-mtk_eth_soc-fix-tx-throughput-regressio.patch
@@ -0,0 +1,31 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 24 Mar 2023 14:56:58 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: fix tx throughput regression with
+ direct 1G links
+
+Using the QDMA tx scheduler to throttle tx to line speed works fine for
+switch ports, but apparently caused a regression on non-switch ports.
+
+Based on a number of tests, it seems that this throttling can be safely
+dropped without re-introducing the issues on switch ports that the
+tx scheduling changes resolved.
+
+Link: https://lore.kernel.org/netdev/trinity-92c3826f-c2c8-40af-8339-bc6d0d3ffea4-1678213958520@3c-app-gmx-bs16/
+Fixes: f63959c7eec3 ("net: ethernet: mtk_eth_soc: implement multi-queue support for per-port queues")
+Reported-by: Frank Wunderlich <frank-w@public-files.de>
+Reported-by: Daniel Golle <daniel@makrotopia.org>
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -719,8 +719,6 @@ static void mtk_mac_link_up(struct phyli
+ 		break;
+ 	}
+ 
+-	mtk_set_queue_speed(mac->hw, mac->id, speed);
+-
+ 	/* Configure duplex */
+ 	if (duplex == DUPLEX_FULL)
+ 		mcr |= MAC_MCR_FORCE_DPX;
diff --git a/target/linux/generic/backport-6.1/733-v6.2-02-net-mtk_eth_soc-add-definitions-for-PCS.patch b/target/linux/generic/backport-6.1/733-v6.2-02-net-mtk_eth_soc-add-definitions-for-PCS.patch
new file mode 100644
index 00000000000000..850b806410ca4d
--- /dev/null
+++ b/target/linux/generic/backport-6.1/733-v6.2-02-net-mtk_eth_soc-add-definitions-for-PCS.patch
@@ -0,0 +1,55 @@
+From b6a709cb51f7bdc55c01cec886098a9753ce8c28 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 27 Oct 2022 14:10:42 +0100
+Subject: [PATCH 01/10] net: mtk_eth_soc: add definitions for PCS
+
+As a result of help from Frank Wunderlich to investigate and test, we
+know a bit more about the PCS on the Mediatek platforms. Update the
+definitions from this investigation.
+
+This PCS appears similar, but not identical to the Lynx PCS.
+
+Although not included in this patch, but for future reference, the PHY
+ID registers at offset 4 read as 0x4d544950 'MTIP'.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -504,8 +504,10 @@
+ #define ETHSYS_DMA_AG_MAP_PPE	BIT(2)
+ 
+ /* SGMII subsystem config registers */
+-/* Register to auto-negotiation restart */
++/* BMCR (low 16) BMSR (high 16) */
+ #define SGMSYS_PCS_CONTROL_1	0x0
++#define SGMII_BMCR		GENMASK(15, 0)
++#define SGMII_BMSR		GENMASK(31, 16)
+ #define SGMII_AN_RESTART	BIT(9)
+ #define SGMII_ISOLATE		BIT(10)
+ #define SGMII_AN_ENABLE		BIT(12)
+@@ -515,13 +517,18 @@
+ #define SGMII_PCS_FAULT		BIT(23)
+ #define SGMII_AN_EXPANSION_CLR	BIT(30)
+ 
++#define SGMSYS_PCS_ADVERTISE	0x8
++#define SGMII_ADVERTISE		GENMASK(15, 0)
++#define SGMII_LPA		GENMASK(31, 16)
++
+ /* Register to programmable link timer, the unit in 2 * 8ns */
+ #define SGMSYS_PCS_LINK_TIMER	0x18
+-#define SGMII_LINK_TIMER_DEFAULT	(0x186a0 & GENMASK(19, 0))
++#define SGMII_LINK_TIMER_MASK	GENMASK(19, 0)
++#define SGMII_LINK_TIMER_DEFAULT	(0x186a0 & SGMII_LINK_TIMER_MASK)
+ 
+ /* Register to control remote fault */
+ #define SGMSYS_SGMII_MODE		0x20
+-#define SGMII_IF_MODE_BIT0		BIT(0)
++#define SGMII_IF_MODE_SGMII		BIT(0)
+ #define SGMII_SPEED_DUPLEX_AN		BIT(1)
+ #define SGMII_SPEED_MASK		GENMASK(3, 2)
+ #define SGMII_SPEED_10			FIELD_PREP(SGMII_SPEED_MASK, 0)
diff --git a/target/linux/generic/backport-6.1/733-v6.2-03-net-mtk_eth_soc-eliminate-unnecessary-error-handling.patch b/target/linux/generic/backport-6.1/733-v6.2-03-net-mtk_eth_soc-eliminate-unnecessary-error-handling.patch
new file mode 100644
index 00000000000000..4ea428c9d6b1c2
--- /dev/null
+++ b/target/linux/generic/backport-6.1/733-v6.2-03-net-mtk_eth_soc-eliminate-unnecessary-error-handling.patch
@@ -0,0 +1,74 @@
+From 5cf7797526ee81bea0f627bccaa3d887f48f53e0 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 27 Oct 2022 14:10:47 +0100
+Subject: [PATCH 02/10] net: mtk_eth_soc: eliminate unnecessary error handling
+
+The functions called by the pcs_config() method always return zero, so
+there is no point trying to handle an error from these functions. Make
+these functions void, eliminate the "err" variable and simply return
+zero from the pcs_config() function itself.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 18 ++++++------------
+ 1 file changed, 6 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -20,7 +20,7 @@ static struct mtk_pcs *pcs_to_mtk_pcs(st
+ }
+ 
+ /* For SGMII interface mode */
+-static int mtk_pcs_setup_mode_an(struct mtk_pcs *mpcs)
++static void mtk_pcs_setup_mode_an(struct mtk_pcs *mpcs)
+ {
+ 	unsigned int val;
+ 
+@@ -39,16 +39,13 @@ static int mtk_pcs_setup_mode_an(struct
+ 	regmap_read(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, &val);
+ 	val &= ~SGMII_PHYA_PWD;
+ 	regmap_write(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, val);
+-
+-	return 0;
+-
+ }
+ 
+ /* For 1000BASE-X and 2500BASE-X interface modes, which operate at a
+  * fixed speed.
+  */
+-static int mtk_pcs_setup_mode_force(struct mtk_pcs *mpcs,
+-				    phy_interface_t interface)
++static void mtk_pcs_setup_mode_force(struct mtk_pcs *mpcs,
++				     phy_interface_t interface)
+ {
+ 	unsigned int val;
+ 
+@@ -73,8 +70,6 @@ static int mtk_pcs_setup_mode_force(stru
+ 	regmap_read(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, &val);
+ 	val &= ~SGMII_PHYA_PWD;
+ 	regmap_write(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, val);
+-
+-	return 0;
+ }
+ 
+ static int mtk_pcs_config(struct phylink_pcs *pcs, unsigned int mode,
+@@ -83,15 +78,14 @@ static int mtk_pcs_config(struct phylink
+ 			  bool permit_pause_to_mac)
+ {
+ 	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+-	int err = 0;
+ 
+ 	/* Setup SGMIISYS with the determined property */
+ 	if (interface != PHY_INTERFACE_MODE_SGMII)
+-		err = mtk_pcs_setup_mode_force(mpcs, interface);
++		mtk_pcs_setup_mode_force(mpcs, interface);
+ 	else if (phylink_autoneg_inband(mode))
+-		err = mtk_pcs_setup_mode_an(mpcs);
++		mtk_pcs_setup_mode_an(mpcs);
+ 
+-	return err;
++	return 0;
+ }
+ 
+ static void mtk_pcs_restart_an(struct phylink_pcs *pcs)
diff --git a/target/linux/generic/backport-6.1/733-v6.2-04-net-mtk_eth_soc-add-pcs_get_state-implementation.patch b/target/linux/generic/backport-6.1/733-v6.2-04-net-mtk_eth_soc-add-pcs_get_state-implementation.patch
new file mode 100644
index 00000000000000..64a4a72fa6ae96
--- /dev/null
+++ b/target/linux/generic/backport-6.1/733-v6.2-04-net-mtk_eth_soc-add-pcs_get_state-implementation.patch
@@ -0,0 +1,46 @@
+From c000dca098002da193b98099df051c9ead0cacb4 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 27 Oct 2022 14:10:52 +0100
+Subject: [PATCH 03/10] net: mtk_eth_soc: add pcs_get_state() implementation
+
+Add a pcs_get_state() implementation which uses the advertisements
+to compute the resulting link modes, and BMSR contents to determine
+negotiation and link status.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -19,6 +19,20 @@ static struct mtk_pcs *pcs_to_mtk_pcs(st
+ 	return container_of(pcs, struct mtk_pcs, pcs);
+ }
+ 
++static void mtk_pcs_get_state(struct phylink_pcs *pcs,
++			      struct phylink_link_state *state)
++{
++	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
++	unsigned int bm, adv;
++
++	/* Read the BMSR and LPA */
++	regmap_read(mpcs->regmap, SGMSYS_PCS_CONTROL_1, &bm);
++	regmap_read(mpcs->regmap, SGMSYS_PCS_ADVERTISE, &adv);
++
++	phylink_mii_c22_pcs_decode_state(state, FIELD_GET(SGMII_BMSR, bm),
++					 FIELD_GET(SGMII_LPA, adv));
++}
++
+ /* For SGMII interface mode */
+ static void mtk_pcs_setup_mode_an(struct mtk_pcs *mpcs)
+ {
+@@ -117,6 +131,7 @@ static void mtk_pcs_link_up(struct phyli
+ }
+ 
+ static const struct phylink_pcs_ops mtk_pcs_ops = {
++	.pcs_get_state = mtk_pcs_get_state,
+ 	.pcs_config = mtk_pcs_config,
+ 	.pcs_an_restart = mtk_pcs_restart_an,
+ 	.pcs_link_up = mtk_pcs_link_up,
diff --git a/target/linux/generic/backport-6.1/733-v6.2-05-net-mtk_eth_soc-convert-mtk_sgmii-to-use-regmap_upda.patch b/target/linux/generic/backport-6.1/733-v6.2-05-net-mtk_eth_soc-convert-mtk_sgmii-to-use-regmap_upda.patch
new file mode 100644
index 00000000000000..24610fe11e1f4d
--- /dev/null
+++ b/target/linux/generic/backport-6.1/733-v6.2-05-net-mtk_eth_soc-convert-mtk_sgmii-to-use-regmap_upda.patch
@@ -0,0 +1,130 @@
+From 0d2351dc2768061689abd4de1529fa206bbd574e Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 27 Oct 2022 14:10:58 +0100
+Subject: [PATCH 04/10] net: mtk_eth_soc: convert mtk_sgmii to use
+ regmap_update_bits()
+
+mtk_sgmii does a lot of read-modify-write operations, for which there
+is a specific regmap function. Use this function instead of open-coding
+the operations.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 61 ++++++++++-------------
+ 1 file changed, 26 insertions(+), 35 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -36,23 +36,18 @@ static void mtk_pcs_get_state(struct phy
+ /* For SGMII interface mode */
+ static void mtk_pcs_setup_mode_an(struct mtk_pcs *mpcs)
+ {
+-	unsigned int val;
+-
+ 	/* Setup the link timer and QPHY power up inside SGMIISYS */
+ 	regmap_write(mpcs->regmap, SGMSYS_PCS_LINK_TIMER,
+ 		     SGMII_LINK_TIMER_DEFAULT);
+ 
+-	regmap_read(mpcs->regmap, SGMSYS_SGMII_MODE, &val);
+-	val |= SGMII_REMOTE_FAULT_DIS;
+-	regmap_write(mpcs->regmap, SGMSYS_SGMII_MODE, val);
+-
+-	regmap_read(mpcs->regmap, SGMSYS_PCS_CONTROL_1, &val);
+-	val |= SGMII_AN_RESTART;
+-	regmap_write(mpcs->regmap, SGMSYS_PCS_CONTROL_1, val);
+-
+-	regmap_read(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, &val);
+-	val &= ~SGMII_PHYA_PWD;
+-	regmap_write(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, val);
++	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
++			   SGMII_REMOTE_FAULT_DIS, SGMII_REMOTE_FAULT_DIS);
++
++	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
++			   SGMII_AN_RESTART, SGMII_AN_RESTART);
++
++	regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
++			   SGMII_PHYA_PWD, 0);
+ }
+ 
+ /* For 1000BASE-X and 2500BASE-X interface modes, which operate at a
+@@ -61,29 +56,26 @@ static void mtk_pcs_setup_mode_an(struct
+ static void mtk_pcs_setup_mode_force(struct mtk_pcs *mpcs,
+ 				     phy_interface_t interface)
+ {
+-	unsigned int val;
++	unsigned int rgc3;
+ 
+-	regmap_read(mpcs->regmap, mpcs->ana_rgc3, &val);
+-	val &= ~RG_PHY_SPEED_MASK;
+ 	if (interface == PHY_INTERFACE_MODE_2500BASEX)
+-		val |= RG_PHY_SPEED_3_125G;
+-	regmap_write(mpcs->regmap, mpcs->ana_rgc3, val);
++		rgc3 = RG_PHY_SPEED_3_125G;
++
++	regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
++			   RG_PHY_SPEED_3_125G, rgc3);
+ 
+ 	/* Disable SGMII AN */
+-	regmap_read(mpcs->regmap, SGMSYS_PCS_CONTROL_1, &val);
+-	val &= ~SGMII_AN_ENABLE;
+-	regmap_write(mpcs->regmap, SGMSYS_PCS_CONTROL_1, val);
++	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
++			   SGMII_AN_ENABLE, 0);
+ 
+ 	/* Set the speed etc but leave the duplex unchanged */
+-	regmap_read(mpcs->regmap, SGMSYS_SGMII_MODE, &val);
+-	val &= SGMII_DUPLEX_FULL | ~SGMII_IF_MODE_MASK;
+-	val |= SGMII_SPEED_1000;
+-	regmap_write(mpcs->regmap, SGMSYS_SGMII_MODE, val);
++	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
++			   SGMII_IF_MODE_MASK & ~SGMII_DUPLEX_FULL,
++			   SGMII_SPEED_1000);
+ 
+ 	/* Release PHYA power down state */
+-	regmap_read(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, &val);
+-	val &= ~SGMII_PHYA_PWD;
+-	regmap_write(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, val);
++	regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
++			   SGMII_PHYA_PWD, 0);
+ }
+ 
+ static int mtk_pcs_config(struct phylink_pcs *pcs, unsigned int mode,
+@@ -105,29 +97,28 @@ static int mtk_pcs_config(struct phylink
+ static void mtk_pcs_restart_an(struct phylink_pcs *pcs)
+ {
+ 	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+-	unsigned int val;
+ 
+-	regmap_read(mpcs->regmap, SGMSYS_PCS_CONTROL_1, &val);
+-	val |= SGMII_AN_RESTART;
+-	regmap_write(mpcs->regmap, SGMSYS_PCS_CONTROL_1, val);
++	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
++			   SGMII_AN_RESTART, SGMII_AN_RESTART);
+ }
+ 
+ static void mtk_pcs_link_up(struct phylink_pcs *pcs, unsigned int mode,
+ 			    phy_interface_t interface, int speed, int duplex)
+ {
+ 	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+-	unsigned int val;
++	unsigned int sgm_mode;
+ 
+ 	if (!phy_interface_mode_is_8023z(interface))
+ 		return;
+ 
+ 	/* SGMII force duplex setting */
+-	regmap_read(mpcs->regmap, SGMSYS_SGMII_MODE, &val);
+-	val &= ~SGMII_DUPLEX_FULL;
+ 	if (duplex == DUPLEX_FULL)
+-		val |= SGMII_DUPLEX_FULL;
++		sgm_mode = SGMII_DUPLEX_FULL;
++	else
++		sgm_mode = 0;
+ 
+-	regmap_write(mpcs->regmap, SGMSYS_SGMII_MODE, val);
++	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
++			   SGMII_DUPLEX_FULL, sgm_mode);
+ }
+ 
+ static const struct phylink_pcs_ops mtk_pcs_ops = {
diff --git a/target/linux/generic/backport-6.1/733-v6.2-06-net-mtk_eth_soc-add-out-of-band-forcing-of-speed-and.patch b/target/linux/generic/backport-6.1/733-v6.2-06-net-mtk_eth_soc-add-out-of-band-forcing-of-speed-and.patch
new file mode 100644
index 00000000000000..ba76ca40ffaaa8
--- /dev/null
+++ b/target/linux/generic/backport-6.1/733-v6.2-06-net-mtk_eth_soc-add-out-of-band-forcing-of-speed-and.patch
@@ -0,0 +1,52 @@
+From 12198c3a410fe69843e335c1bbf6d4c2a4d48e4e Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 27 Oct 2022 14:11:03 +0100
+Subject: [PATCH 05/10] net: mtk_eth_soc: add out of band forcing of speed and
+ duplex in pcs_link_up
+
+Add support for forcing the link speed and duplex setting in the
+pcs_link_up() method for out of band modes, which will be useful when
+we finish converting the pcs_config() method. Until then, we still have
+to force duplex for 802.3z modes to work correctly.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 28 ++++++++++++++---------
+ 1 file changed, 17 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -108,17 +108,23 @@ static void mtk_pcs_link_up(struct phyli
+ 	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+ 	unsigned int sgm_mode;
+ 
+-	if (!phy_interface_mode_is_8023z(interface))
+-		return;
++	if (!phylink_autoneg_inband(mode) ||
++	    phy_interface_mode_is_8023z(interface)) {
++		/* Force the speed and duplex setting */
++		if (speed == SPEED_10)
++			sgm_mode = SGMII_SPEED_10;
++		else if (speed == SPEED_100)
++			sgm_mode = SGMII_SPEED_100;
++		else
++			sgm_mode = SGMII_SPEED_1000;
+ 
+-	/* SGMII force duplex setting */
+-	if (duplex == DUPLEX_FULL)
+-		sgm_mode = SGMII_DUPLEX_FULL;
+-	else
+-		sgm_mode = 0;
++		if (duplex == DUPLEX_FULL)
++			sgm_mode |= SGMII_DUPLEX_FULL;
+ 
+-	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
+-			   SGMII_DUPLEX_FULL, sgm_mode);
++		regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
++				   SGMII_DUPLEX_FULL | SGMII_SPEED_MASK,
++				   sgm_mode);
++	}
+ }
+ 
+ static const struct phylink_pcs_ops mtk_pcs_ops = {
diff --git a/target/linux/generic/backport-6.1/733-v6.2-07-net-mtk_eth_soc-move-PHY-power-up.patch b/target/linux/generic/backport-6.1/733-v6.2-07-net-mtk_eth_soc-move-PHY-power-up.patch
new file mode 100644
index 00000000000000..b76e15927505cb
--- /dev/null
+++ b/target/linux/generic/backport-6.1/733-v6.2-07-net-mtk_eth_soc-move-PHY-power-up.patch
@@ -0,0 +1,48 @@
+From 6f38fffe2179dd29612aea2c67c46ed6682b4e46 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 27 Oct 2022 14:11:08 +0100
+Subject: [PATCH 06/10] net: mtk_eth_soc: move PHY power up
+
+The PHY power up is common to both configuration paths, so move it into
+the parent function. We need to do this for all serdes modes.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -45,9 +45,6 @@ static void mtk_pcs_setup_mode_an(struct
+ 
+ 	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
+ 			   SGMII_AN_RESTART, SGMII_AN_RESTART);
+-
+-	regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
+-			   SGMII_PHYA_PWD, 0);
+ }
+ 
+ /* For 1000BASE-X and 2500BASE-X interface modes, which operate at a
+@@ -72,10 +69,6 @@ static void mtk_pcs_setup_mode_force(str
+ 	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
+ 			   SGMII_IF_MODE_MASK & ~SGMII_DUPLEX_FULL,
+ 			   SGMII_SPEED_1000);
+-
+-	/* Release PHYA power down state */
+-	regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
+-			   SGMII_PHYA_PWD, 0);
+ }
+ 
+ static int mtk_pcs_config(struct phylink_pcs *pcs, unsigned int mode,
+@@ -91,6 +84,10 @@ static int mtk_pcs_config(struct phylink
+ 	else if (phylink_autoneg_inband(mode))
+ 		mtk_pcs_setup_mode_an(mpcs);
+ 
++	/* Release PHYA power down state */
++	regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
++			   SGMII_PHYA_PWD, 0);
++
+ 	return 0;
+ }
+ 
diff --git a/target/linux/generic/backport-6.1/733-v6.2-08-net-mtk_eth_soc-move-interface-speed-selection.patch b/target/linux/generic/backport-6.1/733-v6.2-08-net-mtk_eth_soc-move-interface-speed-selection.patch
new file mode 100644
index 00000000000000..cd9f0699b3ebc7
--- /dev/null
+++ b/target/linux/generic/backport-6.1/733-v6.2-08-net-mtk_eth_soc-move-interface-speed-selection.patch
@@ -0,0 +1,48 @@
+From f752c0df13dfeb721c11d3debb79f08cf437344f Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 27 Oct 2022 14:11:13 +0100
+Subject: [PATCH 07/10] net: mtk_eth_soc: move interface speed selection
+
+Move the selection of the underlying interface speed to the pcs_config
+function, so we always program the interface speed.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -53,14 +53,6 @@ static void mtk_pcs_setup_mode_an(struct
+ static void mtk_pcs_setup_mode_force(struct mtk_pcs *mpcs,
+ 				     phy_interface_t interface)
+ {
+-	unsigned int rgc3;
+-
+-	if (interface == PHY_INTERFACE_MODE_2500BASEX)
+-		rgc3 = RG_PHY_SPEED_3_125G;
+-
+-	regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
+-			   RG_PHY_SPEED_3_125G, rgc3);
+-
+ 	/* Disable SGMII AN */
+ 	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
+ 			   SGMII_AN_ENABLE, 0);
+@@ -77,6 +69,16 @@ static int mtk_pcs_config(struct phylink
+ 			  bool permit_pause_to_mac)
+ {
+ 	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
++	unsigned int rgc3;
++
++	if (interface == PHY_INTERFACE_MODE_2500BASEX)
++		rgc3 = RG_PHY_SPEED_3_125G;
++	else
++		rgc3 = 0;
++
++	/* Configure the underlying interface speed */
++	regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
++			   RG_PHY_SPEED_3_125G, rgc3);
+ 
+ 	/* Setup SGMIISYS with the determined property */
+ 	if (interface != PHY_INTERFACE_MODE_SGMII)
diff --git a/target/linux/generic/backport-6.1/733-v6.2-09-net-mtk_eth_soc-add-advertisement-programming.patch b/target/linux/generic/backport-6.1/733-v6.2-09-net-mtk_eth_soc-add-advertisement-programming.patch
new file mode 100644
index 00000000000000..f08358e963d53a
--- /dev/null
+++ b/target/linux/generic/backport-6.1/733-v6.2-09-net-mtk_eth_soc-add-advertisement-programming.patch
@@ -0,0 +1,52 @@
+From c125c66ea71b9377ae2478c4f1b87b180cc5c6ef Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 27 Oct 2022 14:11:18 +0100
+Subject: [PATCH 08/10] net: mtk_eth_soc: add advertisement programming
+
+Program the advertisement into the mtk PCS block.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -70,16 +70,27 @@ static int mtk_pcs_config(struct phylink
+ {
+ 	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+ 	unsigned int rgc3;
++	int advertise;
++	bool changed;
+ 
+ 	if (interface == PHY_INTERFACE_MODE_2500BASEX)
+ 		rgc3 = RG_PHY_SPEED_3_125G;
+ 	else
+ 		rgc3 = 0;
+ 
++	advertise = phylink_mii_c22_pcs_encode_advertisement(interface,
++							     advertising);
++	if (advertise < 0)
++		return advertise;
++
+ 	/* Configure the underlying interface speed */
+ 	regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
+ 			   RG_PHY_SPEED_3_125G, rgc3);
+ 
++	/* Update the advertisement, noting whether it has changed */
++	regmap_update_bits_check(mpcs->regmap, SGMSYS_PCS_ADVERTISE,
++				 SGMII_ADVERTISE, advertise, &changed);
++
+ 	/* Setup SGMIISYS with the determined property */
+ 	if (interface != PHY_INTERFACE_MODE_SGMII)
+ 		mtk_pcs_setup_mode_force(mpcs, interface);
+@@ -90,7 +101,7 @@ static int mtk_pcs_config(struct phylink
+ 	regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
+ 			   SGMII_PHYA_PWD, 0);
+ 
+-	return 0;
++	return changed;
+ }
+ 
+ static void mtk_pcs_restart_an(struct phylink_pcs *pcs)
diff --git a/target/linux/generic/backport-6.1/733-v6.2-10-net-mtk_eth_soc-move-and-correct-link-timer-programm.patch b/target/linux/generic/backport-6.1/733-v6.2-10-net-mtk_eth_soc-move-and-correct-link-timer-programm.patch
new file mode 100644
index 00000000000000..602d52c6f46a3a
--- /dev/null
+++ b/target/linux/generic/backport-6.1/733-v6.2-10-net-mtk_eth_soc-move-and-correct-link-timer-programm.patch
@@ -0,0 +1,63 @@
+From 3027d89f87707e7f3e5b683e0d37a32afb5bde96 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 27 Oct 2022 14:11:23 +0100
+Subject: [PATCH 09/10] net: mtk_eth_soc: move and correct link timer
+ programming
+
+Program the link timer appropriately for the interface mode being
+used, using the newly introduced phylink helper that provides the
+nanosecond link timer interval.
+
+The intervals are 1.6ms for SGMII based protocols and 10ms for
+802.3z based protocols.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -36,10 +36,6 @@ static void mtk_pcs_get_state(struct phy
+ /* For SGMII interface mode */
+ static void mtk_pcs_setup_mode_an(struct mtk_pcs *mpcs)
+ {
+-	/* Setup the link timer and QPHY power up inside SGMIISYS */
+-	regmap_write(mpcs->regmap, SGMSYS_PCS_LINK_TIMER,
+-		     SGMII_LINK_TIMER_DEFAULT);
+-
+ 	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
+ 			   SGMII_REMOTE_FAULT_DIS, SGMII_REMOTE_FAULT_DIS);
+ 
+@@ -69,8 +65,8 @@ static int mtk_pcs_config(struct phylink
+ 			  bool permit_pause_to_mac)
+ {
+ 	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
++	int advertise, link_timer;
+ 	unsigned int rgc3;
+-	int advertise;
+ 	bool changed;
+ 
+ 	if (interface == PHY_INTERFACE_MODE_2500BASEX)
+@@ -83,6 +79,10 @@ static int mtk_pcs_config(struct phylink
+ 	if (advertise < 0)
+ 		return advertise;
+ 
++	link_timer = phylink_get_link_timer_ns(interface);
++	if (link_timer < 0)
++		return link_timer;
++
+ 	/* Configure the underlying interface speed */
+ 	regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
+ 			   RG_PHY_SPEED_3_125G, rgc3);
+@@ -91,6 +91,9 @@ static int mtk_pcs_config(struct phylink
+ 	regmap_update_bits_check(mpcs->regmap, SGMSYS_PCS_ADVERTISE,
+ 				 SGMII_ADVERTISE, advertise, &changed);
+ 
++	/* Setup the link timer and QPHY power up inside SGMIISYS */
++	regmap_write(mpcs->regmap, SGMSYS_PCS_LINK_TIMER, link_timer / 2 / 8);
++
+ 	/* Setup SGMIISYS with the determined property */
+ 	if (interface != PHY_INTERFACE_MODE_SGMII)
+ 		mtk_pcs_setup_mode_force(mpcs, interface);
diff --git a/target/linux/generic/backport-6.1/733-v6.2-11-net-mtk_eth_soc-add-support-for-in-band-802.3z-negot.patch b/target/linux/generic/backport-6.1/733-v6.2-11-net-mtk_eth_soc-add-support-for-in-band-802.3z-negot.patch
new file mode 100644
index 00000000000000..0e9a0535a7b260
--- /dev/null
+++ b/target/linux/generic/backport-6.1/733-v6.2-11-net-mtk_eth_soc-add-support-for-in-band-802.3z-negot.patch
@@ -0,0 +1,132 @@
+From 81b0f12a2a8a1699a7d49c3995e5f71e4ec018e6 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 27 Oct 2022 14:11:28 +0100
+Subject: [PATCH 10/10] net: mtk_eth_soc: add support for in-band 802.3z
+ negotiation
+
+As a result of help from Frank Wunderlich to investigate and test, we
+now know how to program this PCS for in-band 802.3z negotiation. Add
+support for this by moving the contents of the two functions into the
+common mtk_pcs_config() function and adding the register settings for
+802.3z negotiation.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 77 ++++++++++++-----------
+ 1 file changed, 42 insertions(+), 35 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -33,41 +33,15 @@ static void mtk_pcs_get_state(struct phy
+ 					 FIELD_GET(SGMII_LPA, adv));
+ }
+ 
+-/* For SGMII interface mode */
+-static void mtk_pcs_setup_mode_an(struct mtk_pcs *mpcs)
+-{
+-	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
+-			   SGMII_REMOTE_FAULT_DIS, SGMII_REMOTE_FAULT_DIS);
+-
+-	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
+-			   SGMII_AN_RESTART, SGMII_AN_RESTART);
+-}
+-
+-/* For 1000BASE-X and 2500BASE-X interface modes, which operate at a
+- * fixed speed.
+- */
+-static void mtk_pcs_setup_mode_force(struct mtk_pcs *mpcs,
+-				     phy_interface_t interface)
+-{
+-	/* Disable SGMII AN */
+-	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
+-			   SGMII_AN_ENABLE, 0);
+-
+-	/* Set the speed etc but leave the duplex unchanged */
+-	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
+-			   SGMII_IF_MODE_MASK & ~SGMII_DUPLEX_FULL,
+-			   SGMII_SPEED_1000);
+-}
+-
+ static int mtk_pcs_config(struct phylink_pcs *pcs, unsigned int mode,
+ 			  phy_interface_t interface,
+ 			  const unsigned long *advertising,
+ 			  bool permit_pause_to_mac)
+ {
+ 	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
++	unsigned int rgc3, sgm_mode, bmcr;
+ 	int advertise, link_timer;
+-	unsigned int rgc3;
+-	bool changed;
++	bool changed, use_an;
+ 
+ 	if (interface == PHY_INTERFACE_MODE_2500BASEX)
+ 		rgc3 = RG_PHY_SPEED_3_125G;
+@@ -83,6 +57,37 @@ static int mtk_pcs_config(struct phylink
+ 	if (link_timer < 0)
+ 		return link_timer;
+ 
++	/* Clearing IF_MODE_BIT0 switches the PCS to BASE-X mode, and
++	 * we assume that fixes it's speed at bitrate = line rate (in
++	 * other words, 1000Mbps or 2500Mbps).
++	 */
++	if (interface == PHY_INTERFACE_MODE_SGMII) {
++		sgm_mode = SGMII_IF_MODE_SGMII;
++		if (phylink_autoneg_inband(mode)) {
++			sgm_mode |= SGMII_REMOTE_FAULT_DIS |
++				    SGMII_SPEED_DUPLEX_AN;
++			use_an = true;
++		} else {
++			use_an = false;
++		}
++	} else if (phylink_autoneg_inband(mode)) {
++		/* 1000base-X or 2500base-X autoneg */
++		sgm_mode = SGMII_REMOTE_FAULT_DIS;
++		use_an = linkmode_test_bit(ETHTOOL_LINK_MODE_Autoneg_BIT,
++					   advertising);
++	} else {
++		/* 1000base-X or 2500base-X without autoneg */
++		sgm_mode = 0;
++		use_an = false;
++	}
++
++	if (use_an) {
++		/* FIXME: Do we need to set AN_RESTART here? */
++		bmcr = SGMII_AN_RESTART | SGMII_AN_ENABLE;
++	} else {
++		bmcr = 0;
++	}
++
+ 	/* Configure the underlying interface speed */
+ 	regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
+ 			   RG_PHY_SPEED_3_125G, rgc3);
+@@ -94,11 +99,14 @@ static int mtk_pcs_config(struct phylink
+ 	/* Setup the link timer and QPHY power up inside SGMIISYS */
+ 	regmap_write(mpcs->regmap, SGMSYS_PCS_LINK_TIMER, link_timer / 2 / 8);
+ 
+-	/* Setup SGMIISYS with the determined property */
+-	if (interface != PHY_INTERFACE_MODE_SGMII)
+-		mtk_pcs_setup_mode_force(mpcs, interface);
+-	else if (phylink_autoneg_inband(mode))
+-		mtk_pcs_setup_mode_an(mpcs);
++	/* Update the sgmsys mode register */
++	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
++			   SGMII_REMOTE_FAULT_DIS | SGMII_SPEED_DUPLEX_AN |
++			   SGMII_IF_MODE_SGMII, sgm_mode);
++
++	/* Update the BMCR */
++	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
++			   SGMII_AN_RESTART | SGMII_AN_ENABLE, bmcr);
+ 
+ 	/* Release PHYA power down state */
+ 	regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
+@@ -121,8 +129,7 @@ static void mtk_pcs_link_up(struct phyli
+ 	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+ 	unsigned int sgm_mode;
+ 
+-	if (!phylink_autoneg_inband(mode) ||
+-	    phy_interface_mode_is_8023z(interface)) {
++	if (!phylink_autoneg_inband(mode)) {
+ 		/* Force the speed and duplex setting */
+ 		if (speed == SPEED_10)
+ 			sgm_mode = SGMII_SPEED_10;
diff --git a/target/linux/generic/backport-6.1/733-v6.2-12-net-mediatek-sgmii-ensure-the-SGMII-PHY-is-powered-d.patch b/target/linux/generic/backport-6.1/733-v6.2-12-net-mediatek-sgmii-ensure-the-SGMII-PHY-is-powered-d.patch
new file mode 100644
index 00000000000000..7db59ad871b70c
--- /dev/null
+++ b/target/linux/generic/backport-6.1/733-v6.2-12-net-mediatek-sgmii-ensure-the-SGMII-PHY-is-powered-d.patch
@@ -0,0 +1,119 @@
+From 7ff82416de8295c61423ef6fd75f052d3837d2f7 Mon Sep 17 00:00:00 2001
+From: Alexander Couzens <lynxis@fe80.eu>
+Date: Wed, 1 Feb 2023 19:23:29 +0100
+Subject: [PATCH 11/13] net: mediatek: sgmii: ensure the SGMII PHY is powered
+ down on configuration
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The code expect the PHY to be in power down which is only true after reset.
+Allow changes of the SGMII parameters more than once.
+
+Only power down when reconfiguring to avoid bouncing the link when there's
+no reason to - based on code from Russell King.
+
+There are cases when the SGMII_PHYA_PWD register contains 0x9 which
+prevents SGMII from working. The SGMII still shows link but no traffic
+can flow. Writing 0x0 to the PHYA_PWD register fix the issue. 0x0 was
+taken from a good working state of the SGMII interface.
+
+Fixes: 42c03844e93d ("net-next: mediatek: add support for MediaTek MT7622 SoC")
+Suggested-by: Russell King (Oracle) <linux@armlinux.org.uk>
+Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
+[ bmork: rebased and squashed into one patch ]
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Acked-by: Daniel Golle <daniel@makrotopia.org>
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h |  2 ++
+ drivers/net/ethernet/mediatek/mtk_sgmii.c   | 39 +++++++++++++++------
+ 2 files changed, 30 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -1073,11 +1073,13 @@ struct mtk_soc_data {
+  * @regmap:            The register map pointing at the range used to setup
+  *                     SGMII modes
+  * @ana_rgc3:          The offset refers to register ANA_RGC3 related to regmap
++ * @interface:         Currently configured interface mode
+  * @pcs:               Phylink PCS structure
+  */
+ struct mtk_pcs {
+ 	struct regmap	*regmap;
+ 	u32             ana_rgc3;
++	phy_interface_t	interface;
+ 	struct phylink_pcs pcs;
+ };
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -43,11 +43,6 @@ static int mtk_pcs_config(struct phylink
+ 	int advertise, link_timer;
+ 	bool changed, use_an;
+ 
+-	if (interface == PHY_INTERFACE_MODE_2500BASEX)
+-		rgc3 = RG_PHY_SPEED_3_125G;
+-	else
+-		rgc3 = 0;
+-
+ 	advertise = phylink_mii_c22_pcs_encode_advertisement(interface,
+ 							     advertising);
+ 	if (advertise < 0)
+@@ -88,9 +83,22 @@ static int mtk_pcs_config(struct phylink
+ 		bmcr = 0;
+ 	}
+ 
+-	/* Configure the underlying interface speed */
+-	regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
+-			   RG_PHY_SPEED_3_125G, rgc3);
++	if (mpcs->interface != interface) {
++		/* PHYA power down */
++		regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
++				   SGMII_PHYA_PWD, SGMII_PHYA_PWD);
++
++		if (interface == PHY_INTERFACE_MODE_2500BASEX)
++			rgc3 = RG_PHY_SPEED_3_125G;
++		else
++			rgc3 = 0;
++
++		/* Configure the underlying interface speed */
++		regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
++				   RG_PHY_SPEED_3_125G, rgc3);
++
++		mpcs->interface = interface;
++	}
+ 
+ 	/* Update the advertisement, noting whether it has changed */
+ 	regmap_update_bits_check(mpcs->regmap, SGMSYS_PCS_ADVERTISE,
+@@ -108,9 +116,17 @@ static int mtk_pcs_config(struct phylink
+ 	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
+ 			   SGMII_AN_RESTART | SGMII_AN_ENABLE, bmcr);
+ 
+-	/* Release PHYA power down state */
+-	regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
+-			   SGMII_PHYA_PWD, 0);
++	/* Release PHYA power down state
++	 * Only removing bit SGMII_PHYA_PWD isn't enough.
++	 * There are cases when the SGMII_PHYA_PWD register contains 0x9 which
++	 * prevents SGMII from working. The SGMII still shows link but no traffic
++	 * can flow. Writing 0x0 to the PHYA_PWD register fix the issue. 0x0 was
++	 * taken from a good working state of the SGMII interface.
++	 * Unknown how much the QPHY needs but it is racy without a sleep.
++	 * Tested on mt7622 & mt7986.
++	 */
++	usleep_range(50, 100);
++	regmap_write(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, 0);
+ 
+ 	return changed;
+ }
+@@ -171,6 +187,7 @@ int mtk_sgmii_init(struct mtk_sgmii *ss,
+ 			return PTR_ERR(ss->pcs[i].regmap);
+ 
+ 		ss->pcs[i].pcs.ops = &mtk_pcs_ops;
++		ss->pcs[i].interface = PHY_INTERFACE_MODE_NA;
+ 	}
+ 
+ 	return 0;
diff --git a/target/linux/generic/backport-6.1/733-v6.2-13-net-mediatek-sgmii-fix-duplex-configuration.patch b/target/linux/generic/backport-6.1/733-v6.2-13-net-mediatek-sgmii-fix-duplex-configuration.patch
new file mode 100644
index 00000000000000..a06298c0a9cc89
--- /dev/null
+++ b/target/linux/generic/backport-6.1/733-v6.2-13-net-mediatek-sgmii-fix-duplex-configuration.patch
@@ -0,0 +1,52 @@
+From 9d32637122de88f1ef614c29703f0e050cad342e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Wed, 1 Feb 2023 19:23:30 +0100
+Subject: [PATCH 12/13] net: mediatek: sgmii: fix duplex configuration
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The logic of the duplex bit is inverted.  Setting it means half
+duplex, not full duplex.
+
+Fix and rename macro to avoid confusion.
+
+Fixes: 7e538372694b ("net: ethernet: mediatek: Re-add support SGMII")
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Acked-by: Daniel Golle <daniel@makrotopia.org>
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h | 2 +-
+ drivers/net/ethernet/mediatek/mtk_sgmii.c   | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -534,7 +534,7 @@
+ #define SGMII_SPEED_10			FIELD_PREP(SGMII_SPEED_MASK, 0)
+ #define SGMII_SPEED_100			FIELD_PREP(SGMII_SPEED_MASK, 1)
+ #define SGMII_SPEED_1000		FIELD_PREP(SGMII_SPEED_MASK, 2)
+-#define SGMII_DUPLEX_FULL		BIT(4)
++#define SGMII_DUPLEX_HALF		BIT(4)
+ #define SGMII_IF_MODE_BIT5		BIT(5)
+ #define SGMII_REMOTE_FAULT_DIS		BIT(8)
+ #define SGMII_CODE_SYNC_SET_VAL		BIT(9)
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -154,11 +154,11 @@ static void mtk_pcs_link_up(struct phyli
+ 		else
+ 			sgm_mode = SGMII_SPEED_1000;
+ 
+-		if (duplex == DUPLEX_FULL)
+-			sgm_mode |= SGMII_DUPLEX_FULL;
++		if (duplex != DUPLEX_FULL)
++			sgm_mode |= SGMII_DUPLEX_HALF;
+ 
+ 		regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
+-				   SGMII_DUPLEX_FULL | SGMII_SPEED_MASK,
++				   SGMII_DUPLEX_HALF | SGMII_SPEED_MASK,
+ 				   sgm_mode);
+ 	}
+ }
diff --git a/target/linux/generic/backport-6.1/733-v6.2-14-mtk_sgmii-enable-PCS-polling-to-allow-SFP-work.patch b/target/linux/generic/backport-6.1/733-v6.2-14-mtk_sgmii-enable-PCS-polling-to-allow-SFP-work.patch
new file mode 100644
index 00000000000000..56d7a1348fb17d
--- /dev/null
+++ b/target/linux/generic/backport-6.1/733-v6.2-14-mtk_sgmii-enable-PCS-polling-to-allow-SFP-work.patch
@@ -0,0 +1,33 @@
+From 3337a6e04ddf2923a1bdcf3d31b3b52412bf82dd Mon Sep 17 00:00:00 2001
+From: Alexander Couzens <lynxis@fe80.eu>
+Date: Wed, 1 Feb 2023 19:23:31 +0100
+Subject: [PATCH 13/13] mtk_sgmii: enable PCS polling to allow SFP work
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Currently there is no IRQ handling (even the SGMII supports it).
+Enable polling to support SFP ports.
+
+Fixes: 14a44ab0330d ("net: mtk_eth_soc: partially convert to phylink_pcs")
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
+[ bmork: changed "1" => "true" ]
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Acked-by: Daniel Golle <daniel@makrotopia.org>
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -187,6 +187,7 @@ int mtk_sgmii_init(struct mtk_sgmii *ss,
+ 			return PTR_ERR(ss->pcs[i].regmap);
+ 
+ 		ss->pcs[i].pcs.ops = &mtk_pcs_ops;
++		ss->pcs[i].pcs.poll = true;
+ 		ss->pcs[i].interface = PHY_INTERFACE_MODE_NA;
+ 	}
+ 
diff --git a/target/linux/generic/backport-6.1/733-v6.3-15-net-ethernet-mtk_eth_soc-reset-PCS-state.patch b/target/linux/generic/backport-6.1/733-v6.3-15-net-ethernet-mtk_eth_soc-reset-PCS-state.patch
new file mode 100644
index 00000000000000..6acc62d4abca43
--- /dev/null
+++ b/target/linux/generic/backport-6.1/733-v6.3-15-net-ethernet-mtk_eth_soc-reset-PCS-state.patch
@@ -0,0 +1,48 @@
+From 611e2dabb4b3243d176739fd6a5a34d007fa3f86 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Tue, 14 Mar 2023 00:34:26 +0000
+Subject: [PATCH 1/2] net: ethernet: mtk_eth_soc: reset PCS state
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reset the internal PCS state machine when changing interface mode.
+This prevents confusing the state machine when changing interface
+modes, e.g. from SGMII to 2500Base-X or vice-versa.
+
+Fixes: 7e538372694b ("net: ethernet: mediatek: Re-add support SGMII")
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Tested-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h | 4 ++++
+ drivers/net/ethernet/mediatek/mtk_sgmii.c   | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -542,6 +542,10 @@
+ #define SGMII_SEND_AN_ERROR_EN		BIT(11)
+ #define SGMII_IF_MODE_MASK		GENMASK(5, 1)
+ 
++/* Register to reset SGMII design */
++#define SGMII_RESERVED_0	0x34
++#define SGMII_SW_RESET		BIT(0)
++
+ /* Register to set SGMII speed, ANA RG_ Control Signals III*/
+ #define SGMSYS_ANA_RG_CS3	0x2028
+ #define RG_PHY_SPEED_MASK	(BIT(2) | BIT(3))
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -88,6 +88,10 @@ static int mtk_pcs_config(struct phylink
+ 		regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
+ 				   SGMII_PHYA_PWD, SGMII_PHYA_PWD);
+ 
++		/* Reset SGMII PCS state */
++		regmap_update_bits(mpcs->regmap, SGMII_RESERVED_0,
++				   SGMII_SW_RESET, SGMII_SW_RESET);
++
+ 		if (interface == PHY_INTERFACE_MODE_2500BASEX)
+ 			rgc3 = RG_PHY_SPEED_3_125G;
+ 		else
diff --git a/target/linux/generic/backport-6.1/733-v6.3-16-net-ethernet-mtk_eth_soc-only-write-values-if-needed.patch b/target/linux/generic/backport-6.1/733-v6.3-16-net-ethernet-mtk_eth_soc-only-write-values-if-needed.patch
new file mode 100644
index 00000000000000..0fabeea20c07ae
--- /dev/null
+++ b/target/linux/generic/backport-6.1/733-v6.3-16-net-ethernet-mtk_eth_soc-only-write-values-if-needed.patch
@@ -0,0 +1,103 @@
+From 6e933a804c7db8be64f367f33e63cd7dcc302ebb Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Tue, 14 Mar 2023 00:34:45 +0000
+Subject: [PATCH 2/2] net: ethernet: mtk_eth_soc: only write values if needed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Only restart auto-negotiation and write link timer if actually
+necessary. This prevents losing the link in case of minor
+changes.
+
+Fixes: 7e538372694b ("net: ethernet: mediatek: Re-add support SGMII")
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Tested-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/mediatek/mtk_sgmii.c | 24 +++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -38,20 +38,16 @@ static int mtk_pcs_config(struct phylink
+ 			  const unsigned long *advertising,
+ 			  bool permit_pause_to_mac)
+ {
++	bool mode_changed = false, changed, use_an;
+ 	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+ 	unsigned int rgc3, sgm_mode, bmcr;
+ 	int advertise, link_timer;
+-	bool changed, use_an;
+ 
+ 	advertise = phylink_mii_c22_pcs_encode_advertisement(interface,
+ 							     advertising);
+ 	if (advertise < 0)
+ 		return advertise;
+ 
+-	link_timer = phylink_get_link_timer_ns(interface);
+-	if (link_timer < 0)
+-		return link_timer;
+-
+ 	/* Clearing IF_MODE_BIT0 switches the PCS to BASE-X mode, and
+ 	 * we assume that fixes it's speed at bitrate = line rate (in
+ 	 * other words, 1000Mbps or 2500Mbps).
+@@ -77,13 +73,16 @@ static int mtk_pcs_config(struct phylink
+ 	}
+ 
+ 	if (use_an) {
+-		/* FIXME: Do we need to set AN_RESTART here? */
+-		bmcr = SGMII_AN_RESTART | SGMII_AN_ENABLE;
++		bmcr = SGMII_AN_ENABLE;
+ 	} else {
+ 		bmcr = 0;
+ 	}
+ 
+ 	if (mpcs->interface != interface) {
++		link_timer = phylink_get_link_timer_ns(interface);
++		if (link_timer < 0)
++			return link_timer;
++
+ 		/* PHYA power down */
+ 		regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
+ 				   SGMII_PHYA_PWD, SGMII_PHYA_PWD);
+@@ -101,16 +100,17 @@ static int mtk_pcs_config(struct phylink
+ 		regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
+ 				   RG_PHY_SPEED_3_125G, rgc3);
+ 
++		/* Setup the link timer */
++		regmap_write(mpcs->regmap, SGMSYS_PCS_LINK_TIMER, link_timer / 2 / 8);
++
+ 		mpcs->interface = interface;
++		mode_changed = true;
+ 	}
+ 
+ 	/* Update the advertisement, noting whether it has changed */
+ 	regmap_update_bits_check(mpcs->regmap, SGMSYS_PCS_ADVERTISE,
+ 				 SGMII_ADVERTISE, advertise, &changed);
+ 
+-	/* Setup the link timer and QPHY power up inside SGMIISYS */
+-	regmap_write(mpcs->regmap, SGMSYS_PCS_LINK_TIMER, link_timer / 2 / 8);
+-
+ 	/* Update the sgmsys mode register */
+ 	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
+ 			   SGMII_REMOTE_FAULT_DIS | SGMII_SPEED_DUPLEX_AN |
+@@ -118,7 +118,7 @@ static int mtk_pcs_config(struct phylink
+ 
+ 	/* Update the BMCR */
+ 	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
+-			   SGMII_AN_RESTART | SGMII_AN_ENABLE, bmcr);
++			   SGMII_AN_ENABLE, bmcr);
+ 
+ 	/* Release PHYA power down state
+ 	 * Only removing bit SGMII_PHYA_PWD isn't enough.
+@@ -132,7 +132,7 @@ static int mtk_pcs_config(struct phylink
+ 	usleep_range(50, 100);
+ 	regmap_write(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, 0);
+ 
+-	return changed;
++	return changed || mode_changed;
+ }
+ 
+ static void mtk_pcs_restart_an(struct phylink_pcs *pcs)
diff --git a/target/linux/generic/backport-6.1/733-v6.3-18-net-ethernet-mtk_eth_soc-add-support-for-MT7981.patch b/target/linux/generic/backport-6.1/733-v6.3-18-net-ethernet-mtk_eth_soc-add-support-for-MT7981.patch
new file mode 100644
index 00000000000000..1e3f2fb2947256
--- /dev/null
+++ b/target/linux/generic/backport-6.1/733-v6.3-18-net-ethernet-mtk_eth_soc-add-support-for-MT7981.patch
@@ -0,0 +1,200 @@
+From f5d43ddd334b7c32fcaed9ba46afbd85cb467f1f Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sun, 19 Mar 2023 12:56:28 +0000
+Subject: [PATCH] net: ethernet: mtk_eth_soc: add support for MT7981 SoC
+
+The MediaTek MT7981 SoC comes with two 1G/2.5G SGMII ports, just like
+MT7986.
+
+In addition MT7981 is equipped with a built-in 1000Base-T PHY which can
+be used with GMAC1.
+
+As many MT7981 boards make use of inverting SGMII signal polarity, add
+new device-tree attribute 'mediatek,pn_swap' to support them.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_path.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_path.c
+@@ -96,12 +96,20 @@ static int set_mux_gmac2_gmac0_to_gephy(
+ 
+ static int set_mux_u3_gmac2_to_qphy(struct mtk_eth *eth, int path)
+ {
+-	unsigned int val = 0;
++	unsigned int val = 0, mask = 0, reg = 0;
+ 	bool updated = true;
+ 
+ 	switch (path) {
+ 	case MTK_ETH_PATH_GMAC2_SGMII:
+-		val = CO_QPHY_SEL;
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_U3_COPHY_V2)) {
++			reg = USB_PHY_SWITCH_REG;
++			val = SGMII_QPHY_SEL;
++			mask = QPHY_SEL_MASK;
++		} else {
++			reg = INFRA_MISC2;
++			val = CO_QPHY_SEL;
++			mask = val;
++		}
+ 		break;
+ 	default:
+ 		updated = false;
+@@ -109,7 +117,7 @@ static int set_mux_u3_gmac2_to_qphy(stru
+ 	}
+ 
+ 	if (updated)
+-		regmap_update_bits(eth->infra, INFRA_MISC2, CO_QPHY_SEL, val);
++		regmap_update_bits(eth->infra, reg, mask, val);
+ 
+ 	dev_dbg(eth->dev, "path %s in %s updated = %d\n",
+ 		mtk_eth_path_name(path), __func__, updated);
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -4808,6 +4808,26 @@ static const struct mtk_soc_data mt7629_
+ 	},
+ };
+ 
++static const struct mtk_soc_data mt7981_data = {
++	.reg_map = &mt7986_reg_map,
++	.ana_rgc3 = 0x128,
++	.caps = MT7981_CAPS,
++	.hw_features = MTK_HW_FEATURES,
++	.required_clks = MT7981_CLKS_BITMAP,
++	.required_pctl = false,
++	.offload_version = 2,
++	.hash_offset = 4,
++	.foe_entry_size = sizeof(struct mtk_foe_entry),
++	.txrx = {
++		.txd_size = sizeof(struct mtk_tx_dma_v2),
++		.rxd_size = sizeof(struct mtk_rx_dma_v2),
++		.rx_irq_done_mask = MTK_RX_DONE_INT_V2,
++		.rx_dma_l4_valid = RX_DMA_L4_VALID_V2,
++		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
++		.dma_len_offset = 8,
++	},
++};
++
+ static const struct mtk_soc_data mt7986_data = {
+ 	.reg_map = &mt7986_reg_map,
+ 	.ana_rgc3 = 0x128,
+@@ -4849,6 +4869,7 @@ const struct of_device_id of_mtk_match[]
+ 	{ .compatible = "mediatek,mt7622-eth", .data = &mt7622_data},
+ 	{ .compatible = "mediatek,mt7623-eth", .data = &mt7623_data},
+ 	{ .compatible = "mediatek,mt7629-eth", .data = &mt7629_data},
++	{ .compatible = "mediatek,mt7981-eth", .data = &mt7981_data},
+ 	{ .compatible = "mediatek,mt7986-eth", .data = &mt7986_data},
+ 	{ .compatible = "ralink,rt5350-eth", .data = &rt5350_data},
+ 	{},
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -556,11 +556,22 @@
+ #define SGMSYS_QPHY_PWR_STATE_CTRL 0xe8
+ #define	SGMII_PHYA_PWD		BIT(4)
+ 
++/* Register to QPHY wrapper control */
++#define SGMSYS_QPHY_WRAP_CTRL	0xec
++#define SGMII_PN_SWAP_MASK	GENMASK(1, 0)
++#define SGMII_PN_SWAP_TX_RX	(BIT(0) | BIT(1))
++#define MTK_SGMII_FLAG_PN_SWAP	BIT(0)
++
+ /* Infrasys subsystem config registers */
+ #define INFRA_MISC2            0x70c
+ #define CO_QPHY_SEL            BIT(0)
+ #define GEPHY_MAC_SEL          BIT(1)
+ 
++/* Top misc registers */
++#define USB_PHY_SWITCH_REG	0x218
++#define QPHY_SEL_MASK		GENMASK(1, 0)
++#define SGMII_QPHY_SEL		0x2
++
+ /* MT7628/88 specific stuff */
+ #define MT7628_PDMA_OFFSET	0x0800
+ #define MT7628_SDM_OFFSET	0x0c00
+@@ -741,6 +752,17 @@ enum mtk_clks_map {
+ 				 BIT(MTK_CLK_SGMII2_CDR_FB) | \
+ 				 BIT(MTK_CLK_SGMII_CK) | \
+ 				 BIT(MTK_CLK_ETH2PLL) | BIT(MTK_CLK_SGMIITOP))
++#define MT7981_CLKS_BITMAP	(BIT(MTK_CLK_FE) | BIT(MTK_CLK_GP2) | BIT(MTK_CLK_GP1) | \
++				 BIT(MTK_CLK_WOCPU0) | \
++				 BIT(MTK_CLK_SGMII_TX_250M) | \
++				 BIT(MTK_CLK_SGMII_RX_250M) | \
++				 BIT(MTK_CLK_SGMII_CDR_REF) | \
++				 BIT(MTK_CLK_SGMII_CDR_FB) | \
++				 BIT(MTK_CLK_SGMII2_TX_250M) | \
++				 BIT(MTK_CLK_SGMII2_RX_250M) | \
++				 BIT(MTK_CLK_SGMII2_CDR_REF) | \
++				 BIT(MTK_CLK_SGMII2_CDR_FB) | \
++				 BIT(MTK_CLK_SGMII_CK))
+ #define MT7986_CLKS_BITMAP	(BIT(MTK_CLK_FE) | BIT(MTK_CLK_GP2) | BIT(MTK_CLK_GP1) | \
+ 				 BIT(MTK_CLK_WOCPU1) | BIT(MTK_CLK_WOCPU0) | \
+ 				 BIT(MTK_CLK_SGMII_TX_250M) | \
+@@ -854,6 +876,7 @@ enum mkt_eth_capabilities {
+ 	MTK_NETSYS_V2_BIT,
+ 	MTK_SOC_MT7628_BIT,
+ 	MTK_RSTCTRL_PPE1_BIT,
++	MTK_U3_COPHY_V2_BIT,
+ 
+ 	/* MUX BITS*/
+ 	MTK_ETH_MUX_GDM1_TO_GMAC1_ESW_BIT,
+@@ -888,6 +911,7 @@ enum mkt_eth_capabilities {
+ #define MTK_NETSYS_V2		BIT(MTK_NETSYS_V2_BIT)
+ #define MTK_SOC_MT7628		BIT(MTK_SOC_MT7628_BIT)
+ #define MTK_RSTCTRL_PPE1	BIT(MTK_RSTCTRL_PPE1_BIT)
++#define MTK_U3_COPHY_V2		BIT(MTK_U3_COPHY_V2_BIT)
+ 
+ #define MTK_ETH_MUX_GDM1_TO_GMAC1_ESW		\
+ 	BIT(MTK_ETH_MUX_GDM1_TO_GMAC1_ESW_BIT)
+@@ -966,6 +990,11 @@ enum mkt_eth_capabilities {
+ 		      MTK_MUX_U3_GMAC2_TO_QPHY | \
+ 		      MTK_MUX_GMAC12_TO_GEPHY_SGMII | MTK_QDMA)
+ 
++#define MT7981_CAPS  (MTK_GMAC1_SGMII | MTK_GMAC2_SGMII | MTK_GMAC2_GEPHY | \
++		      MTK_MUX_GMAC12_TO_GEPHY_SGMII | MTK_QDMA | \
++		      MTK_MUX_U3_GMAC2_TO_QPHY | MTK_U3_COPHY_V2 | \
++		      MTK_NETSYS_V2 | MTK_RSTCTRL_PPE1)
++
+ #define MT7986_CAPS  (MTK_GMAC1_SGMII | MTK_GMAC2_SGMII | \
+ 		      MTK_MUX_GMAC12_TO_GEPHY_SGMII | MTK_QDMA | \
+ 		      MTK_NETSYS_V2 | MTK_RSTCTRL_PPE1)
+@@ -1079,12 +1108,14 @@ struct mtk_soc_data {
+  * @ana_rgc3:          The offset refers to register ANA_RGC3 related to regmap
+  * @interface:         Currently configured interface mode
+  * @pcs:               Phylink PCS structure
++ * @flags:             Flags indicating hardware properties
+  */
+ struct mtk_pcs {
+ 	struct regmap	*regmap;
+ 	u32             ana_rgc3;
+ 	phy_interface_t	interface;
+ 	struct phylink_pcs pcs;
++	u32		flags;
+ };
+ 
+ /* struct mtk_sgmii -  This is the structure holding sgmii regmap and its
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
+@@ -87,6 +87,11 @@ static int mtk_pcs_config(struct phylink
+ 		regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
+ 				   SGMII_PHYA_PWD, SGMII_PHYA_PWD);
+ 
++		if (mpcs->flags & MTK_SGMII_FLAG_PN_SWAP)
++			regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_WRAP_CTRL,
++					   SGMII_PN_SWAP_MASK,
++					   SGMII_PN_SWAP_TX_RX);
++
+ 		/* Reset SGMII PCS state */
+ 		regmap_update_bits(mpcs->regmap, SGMII_RESERVED_0,
+ 				   SGMII_SW_RESET, SGMII_SW_RESET);
+@@ -186,6 +191,11 @@ int mtk_sgmii_init(struct mtk_sgmii *ss,
+ 
+ 		ss->pcs[i].ana_rgc3 = ana_rgc3;
+ 		ss->pcs[i].regmap = syscon_node_to_regmap(np);
++
++		ss->pcs[i].flags = 0;
++		if (of_property_read_bool(np, "mediatek,pnswap"))
++			ss->pcs[i].flags |= MTK_SGMII_FLAG_PN_SWAP;
++
+ 		of_node_put(np);
+ 		if (IS_ERR(ss->pcs[i].regmap))
+ 			return PTR_ERR(ss->pcs[i].regmap);
diff --git a/target/linux/generic/backport-6.1/733-v6.3-19-net-ethernet-mtk_eth_soc-set-MDIO-bus-clock-frequenc.patch b/target/linux/generic/backport-6.1/733-v6.3-19-net-ethernet-mtk_eth_soc-set-MDIO-bus-clock-frequenc.patch
new file mode 100644
index 00000000000000..ea20bd87f73417
--- /dev/null
+++ b/target/linux/generic/backport-6.1/733-v6.3-19-net-ethernet-mtk_eth_soc-set-MDIO-bus-clock-frequenc.patch
@@ -0,0 +1,76 @@
+From c0a440031d4314d1023c1b87f43a4233634eebdb Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sun, 19 Mar 2023 12:57:15 +0000
+Subject: [PATCH] net: ethernet: mtk_eth_soc: set MDIO bus clock frequency
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Set MDIO bus clock frequency and allow setting a custom maximum
+frequency from device tree.
+
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Tested-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 21 +++++++++++++++++++++
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h |  7 +++++++
+ 2 files changed, 28 insertions(+)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -745,8 +745,10 @@ static const struct phylink_mac_ops mtk_
+ 
+ static int mtk_mdio_init(struct mtk_eth *eth)
+ {
++	unsigned int max_clk = 2500000, divider;
+ 	struct device_node *mii_np;
+ 	int ret;
++	u32 val;
+ 
+ 	mii_np = of_get_child_by_name(eth->dev->of_node, "mdio-bus");
+ 	if (!mii_np) {
+@@ -773,6 +775,25 @@ static int mtk_mdio_init(struct mtk_eth
+ 	eth->mii_bus->parent = eth->dev;
+ 
+ 	snprintf(eth->mii_bus->id, MII_BUS_ID_SIZE, "%pOFn", mii_np);
++
++	if (!of_property_read_u32(mii_np, "clock-frequency", &val)) {
++		if (val > MDC_MAX_FREQ || val < MDC_MAX_FREQ / MDC_MAX_DIVIDER) {
++			dev_err(eth->dev, "MDIO clock frequency out of range");
++			ret = -EINVAL;
++			goto err_put_node;
++		}
++		max_clk = val;
++	}
++	divider = min_t(unsigned int, DIV_ROUND_UP(MDC_MAX_FREQ, max_clk), 63);
++
++	/* Configure MDC Divider */
++	val = mtk_r32(eth, MTK_PPSC);
++	val &= ~PPSC_MDC_CFG;
++	val |= FIELD_PREP(PPSC_MDC_CFG, divider) | PPSC_MDC_TURBO;
++	mtk_w32(eth, val, MTK_PPSC);
++
++	dev_dbg(eth->dev, "MDC is running on %d Hz\n", MDC_MAX_FREQ / divider);
++
+ 	ret = of_mdiobus_register(eth->mii_bus, mii_np);
+ 
+ err_put_node:
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -363,6 +363,13 @@
+ #define RX_DMA_VTAG_V2		BIT(0)
+ #define RX_DMA_L4_VALID_V2	BIT(2)
+ 
++/* PHY Polling and SMI Master Control registers */
++#define MTK_PPSC		0x10000
++#define PPSC_MDC_CFG		GENMASK(29, 24)
++#define PPSC_MDC_TURBO		BIT(20)
++#define MDC_MAX_FREQ		25000000
++#define MDC_MAX_DIVIDER		63
++
+ /* PHY Indirect Access Control registers */
+ #define MTK_PHY_IAC		0x10004
+ #define PHY_IAC_ACCESS		BIT(31)
diff --git a/target/linux/generic/backport-6.1/733-v6.3-20-net-ethernet-mtk_eth_soc-switch-to-external-PCS-driv.patch b/target/linux/generic/backport-6.1/733-v6.3-20-net-ethernet-mtk_eth_soc-switch-to-external-PCS-driv.patch
new file mode 100644
index 00000000000000..7a04753ceb3986
--- /dev/null
+++ b/target/linux/generic/backport-6.1/733-v6.3-20-net-ethernet-mtk_eth_soc-switch-to-external-PCS-driv.patch
@@ -0,0 +1,512 @@
+From 2a3ec7ae313310c1092e4256208cc04d1958e469 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sun, 19 Mar 2023 12:58:02 +0000
+Subject: [PATCH] net: ethernet: mtk_eth_soc: switch to external PCS driver
+
+Now that we got a PCS driver, use it and remove the now redundant
+PCS code and it's header macros from the Ethernet driver.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Tested-by: Frank Wunderlich <frank-w@public-files.de>
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/Kconfig       |   2 +
+ drivers/net/ethernet/mediatek/Makefile      |   2 +-
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c |  61 +++++-
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h |  93 +--------
+ drivers/net/ethernet/mediatek/mtk_sgmii.c   | 217 --------------------
+ 5 files changed, 56 insertions(+), 319 deletions(-)
+ delete mode 100644 drivers/net/ethernet/mediatek/mtk_sgmii.c
+
+--- a/drivers/net/ethernet/mediatek/Kconfig
++++ b/drivers/net/ethernet/mediatek/Kconfig
+@@ -19,6 +19,8 @@ config NET_MEDIATEK_SOC
+ 	select DIMLIB
+ 	select PAGE_POOL
+ 	select PAGE_POOL_STATS
++	select PCS_MTK_LYNXI
++	select REGMAP_MMIO
+ 	help
+ 	  This driver supports the gigabit ethernet MACs in the
+ 	  MediaTek SoC family.
+--- a/drivers/net/ethernet/mediatek/Makefile
++++ b/drivers/net/ethernet/mediatek/Makefile
+@@ -4,7 +4,7 @@
+ #
+ 
+ obj-$(CONFIG_NET_MEDIATEK_SOC) += mtk_eth.o
+-mtk_eth-y := mtk_eth_soc.o mtk_sgmii.o mtk_eth_path.o mtk_ppe.o mtk_ppe_debugfs.o mtk_ppe_offload.o
++mtk_eth-y := mtk_eth_soc.o mtk_eth_path.o mtk_ppe.o mtk_ppe_debugfs.o mtk_ppe_offload.o
+ mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed.o mtk_wed_mcu.o mtk_wed_wo.o
+ ifdef CONFIG_DEBUG_FS
+ mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed_debugfs.o
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -20,6 +20,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/pinctrl/devinfo.h>
+ #include <linux/phylink.h>
++#include <linux/pcs/pcs-mtk-lynxi.h>
+ #include <linux/jhash.h>
+ #include <linux/bitfield.h>
+ #include <net/dsa.h>
+@@ -400,7 +401,7 @@ static struct phylink_pcs *mtk_mac_selec
+ 		sid = (MTK_HAS_CAPS(eth->soc->caps, MTK_SHARED_SGMII)) ?
+ 		       0 : mac->id;
+ 
+-		return mtk_sgmii_select_pcs(eth->sgmii, sid);
++		return eth->sgmii_pcs[sid];
+ 	}
+ 
+ 	return NULL;
+@@ -4031,8 +4032,17 @@ static int mtk_unreg_dev(struct mtk_eth
+ 	return 0;
+ }
+ 
++static void mtk_sgmii_destroy(struct mtk_eth *eth)
++{
++	int i;
++
++	for (i = 0; i < MTK_MAX_DEVS; i++)
++		mtk_pcs_lynxi_destroy(eth->sgmii_pcs[i]);
++}
++
+ static int mtk_cleanup(struct mtk_eth *eth)
+ {
++	mtk_sgmii_destroy(eth);
+ 	mtk_unreg_dev(eth);
+ 	mtk_free_dev(eth);
+ 	cancel_work_sync(&eth->pending_work);
+@@ -4462,6 +4472,36 @@ void mtk_eth_set_dma_device(struct mtk_e
+ 	rtnl_unlock();
+ }
+ 
++static int mtk_sgmii_init(struct mtk_eth *eth)
++{
++	struct device_node *np;
++	struct regmap *regmap;
++	u32 flags;
++	int i;
++
++	for (i = 0; i < MTK_MAX_DEVS; i++) {
++		np = of_parse_phandle(eth->dev->of_node, "mediatek,sgmiisys", i);
++		if (!np)
++			break;
++
++		regmap = syscon_node_to_regmap(np);
++		flags = 0;
++		if (of_property_read_bool(np, "mediatek,pnswap"))
++			flags |= MTK_SGMII_FLAG_PN_SWAP;
++
++		of_node_put(np);
++
++		if (IS_ERR(regmap))
++			return PTR_ERR(regmap);
++
++		eth->sgmii_pcs[i] = mtk_pcs_lynxi_create(eth->dev, regmap,
++							 eth->soc->ana_rgc3,
++							 flags);
++	}
++
++	return 0;
++}
++
+ static int mtk_probe(struct platform_device *pdev)
+ {
+ 	struct resource *res = NULL;
+@@ -4525,13 +4565,7 @@ static int mtk_probe(struct platform_dev
+ 	}
+ 
+ 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_SGMII)) {
+-		eth->sgmii = devm_kzalloc(eth->dev, sizeof(*eth->sgmii),
+-					  GFP_KERNEL);
+-		if (!eth->sgmii)
+-			return -ENOMEM;
+-
+-		err = mtk_sgmii_init(eth->sgmii, pdev->dev.of_node,
+-				     eth->soc->ana_rgc3);
++		err = mtk_sgmii_init(eth);
+ 
+ 		if (err)
+ 			return err;
+@@ -4542,14 +4576,17 @@ static int mtk_probe(struct platform_dev
+ 							    "mediatek,pctl");
+ 		if (IS_ERR(eth->pctl)) {
+ 			dev_err(&pdev->dev, "no pctl regmap found\n");
+-			return PTR_ERR(eth->pctl);
++			err = PTR_ERR(eth->pctl);
++			goto err_destroy_sgmii;
+ 		}
+ 	}
+ 
+ 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+ 		res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-		if (!res)
+-			return -EINVAL;
++		if (!res) {
++			err = -EINVAL;
++			goto err_destroy_sgmii;
++		}
+ 	}
+ 
+ 	if (eth->soc->offload_version) {
+@@ -4708,6 +4745,8 @@ err_deinit_hw:
+ 	mtk_hw_deinit(eth);
+ err_wed_exit:
+ 	mtk_wed_exit();
++err_destroy_sgmii:
++	mtk_sgmii_destroy(eth);
+ 
+ 	return err;
+ }
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -510,65 +510,6 @@
+ #define ETHSYS_DMA_AG_MAP_QDMA	BIT(1)
+ #define ETHSYS_DMA_AG_MAP_PPE	BIT(2)
+ 
+-/* SGMII subsystem config registers */
+-/* BMCR (low 16) BMSR (high 16) */
+-#define SGMSYS_PCS_CONTROL_1	0x0
+-#define SGMII_BMCR		GENMASK(15, 0)
+-#define SGMII_BMSR		GENMASK(31, 16)
+-#define SGMII_AN_RESTART	BIT(9)
+-#define SGMII_ISOLATE		BIT(10)
+-#define SGMII_AN_ENABLE		BIT(12)
+-#define SGMII_LINK_STATYS	BIT(18)
+-#define SGMII_AN_ABILITY	BIT(19)
+-#define SGMII_AN_COMPLETE	BIT(21)
+-#define SGMII_PCS_FAULT		BIT(23)
+-#define SGMII_AN_EXPANSION_CLR	BIT(30)
+-
+-#define SGMSYS_PCS_ADVERTISE	0x8
+-#define SGMII_ADVERTISE		GENMASK(15, 0)
+-#define SGMII_LPA		GENMASK(31, 16)
+-
+-/* Register to programmable link timer, the unit in 2 * 8ns */
+-#define SGMSYS_PCS_LINK_TIMER	0x18
+-#define SGMII_LINK_TIMER_MASK	GENMASK(19, 0)
+-#define SGMII_LINK_TIMER_DEFAULT	(0x186a0 & SGMII_LINK_TIMER_MASK)
+-
+-/* Register to control remote fault */
+-#define SGMSYS_SGMII_MODE		0x20
+-#define SGMII_IF_MODE_SGMII		BIT(0)
+-#define SGMII_SPEED_DUPLEX_AN		BIT(1)
+-#define SGMII_SPEED_MASK		GENMASK(3, 2)
+-#define SGMII_SPEED_10			FIELD_PREP(SGMII_SPEED_MASK, 0)
+-#define SGMII_SPEED_100			FIELD_PREP(SGMII_SPEED_MASK, 1)
+-#define SGMII_SPEED_1000		FIELD_PREP(SGMII_SPEED_MASK, 2)
+-#define SGMII_DUPLEX_HALF		BIT(4)
+-#define SGMII_IF_MODE_BIT5		BIT(5)
+-#define SGMII_REMOTE_FAULT_DIS		BIT(8)
+-#define SGMII_CODE_SYNC_SET_VAL		BIT(9)
+-#define SGMII_CODE_SYNC_SET_EN		BIT(10)
+-#define SGMII_SEND_AN_ERROR_EN		BIT(11)
+-#define SGMII_IF_MODE_MASK		GENMASK(5, 1)
+-
+-/* Register to reset SGMII design */
+-#define SGMII_RESERVED_0	0x34
+-#define SGMII_SW_RESET		BIT(0)
+-
+-/* Register to set SGMII speed, ANA RG_ Control Signals III*/
+-#define SGMSYS_ANA_RG_CS3	0x2028
+-#define RG_PHY_SPEED_MASK	(BIT(2) | BIT(3))
+-#define RG_PHY_SPEED_1_25G	0x0
+-#define RG_PHY_SPEED_3_125G	BIT(2)
+-
+-/* Register to power up QPHY */
+-#define SGMSYS_QPHY_PWR_STATE_CTRL 0xe8
+-#define	SGMII_PHYA_PWD		BIT(4)
+-
+-/* Register to QPHY wrapper control */
+-#define SGMSYS_QPHY_WRAP_CTRL	0xec
+-#define SGMII_PN_SWAP_MASK	GENMASK(1, 0)
+-#define SGMII_PN_SWAP_TX_RX	(BIT(0) | BIT(1))
+-#define MTK_SGMII_FLAG_PN_SWAP	BIT(0)
+-
+ /* Infrasys subsystem config registers */
+ #define INFRA_MISC2            0x70c
+ #define CO_QPHY_SEL            BIT(0)
+@@ -1108,31 +1049,6 @@ struct mtk_soc_data {
+ /* currently no SoC has more than 2 macs */
+ #define MTK_MAX_DEVS			2
+ 
+-/* struct mtk_pcs -    This structure holds each sgmii regmap and associated
+- *                     data
+- * @regmap:            The register map pointing at the range used to setup
+- *                     SGMII modes
+- * @ana_rgc3:          The offset refers to register ANA_RGC3 related to regmap
+- * @interface:         Currently configured interface mode
+- * @pcs:               Phylink PCS structure
+- * @flags:             Flags indicating hardware properties
+- */
+-struct mtk_pcs {
+-	struct regmap	*regmap;
+-	u32             ana_rgc3;
+-	phy_interface_t	interface;
+-	struct phylink_pcs pcs;
+-	u32		flags;
+-};
+-
+-/* struct mtk_sgmii -  This is the structure holding sgmii regmap and its
+- *                     characteristics
+- * @pcs                Array of individual PCS structures
+- */
+-struct mtk_sgmii {
+-	struct mtk_pcs	pcs[MTK_MAX_DEVS];
+-};
+-
+ /* struct mtk_eth -	This is the main datasructure for holding the state
+  *			of the driver
+  * @dev:		The device pointer
+@@ -1152,6 +1068,7 @@ struct mtk_sgmii {
+  *			MII modes
+  * @infra:              The register map pointing at the range used to setup
+  *                      SGMII and GePHY path
++ * @sgmii_pcs:		Pointers to mtk-pcs-lynxi phylink_pcs instances
+  * @pctl:		The register map pointing at the range used to setup
+  *			GMAC port drive/slew values
+  * @dma_refcnt:		track how many netdevs are using the DMA engine
+@@ -1192,8 +1109,8 @@ struct mtk_eth {
+ 	u32				msg_enable;
+ 	unsigned long			sysclk;
+ 	struct regmap			*ethsys;
+-	struct regmap                   *infra;
+-	struct mtk_sgmii                *sgmii;
++	struct regmap			*infra;
++	struct phylink_pcs		*sgmii_pcs[MTK_MAX_DEVS];
+ 	struct regmap			*pctl;
+ 	bool				hwlro;
+ 	refcount_t			dma_refcnt;
+@@ -1355,10 +1272,6 @@ void mtk_stats_update_mac(struct mtk_mac
+ void mtk_w32(struct mtk_eth *eth, u32 val, unsigned reg);
+ u32 mtk_r32(struct mtk_eth *eth, unsigned reg);
+ 
+-struct phylink_pcs *mtk_sgmii_select_pcs(struct mtk_sgmii *ss, int id);
+-int mtk_sgmii_init(struct mtk_sgmii *ss, struct device_node *np,
+-		   u32 ana_rgc3);
+-
+ int mtk_gmac_sgmii_path_setup(struct mtk_eth *eth, int mac_id);
+ int mtk_gmac_gephy_path_setup(struct mtk_eth *eth, int mac_id);
+ int mtk_gmac_rgmii_path_setup(struct mtk_eth *eth, int mac_id);
+--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
++++ /dev/null
+@@ -1,217 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-// Copyright (c) 2018-2019 MediaTek Inc.
+-
+-/* A library for MediaTek SGMII circuit
+- *
+- * Author: Sean Wang <sean.wang@mediatek.com>
+- *
+- */
+-
+-#include <linux/mfd/syscon.h>
+-#include <linux/of.h>
+-#include <linux/phylink.h>
+-#include <linux/regmap.h>
+-
+-#include "mtk_eth_soc.h"
+-
+-static struct mtk_pcs *pcs_to_mtk_pcs(struct phylink_pcs *pcs)
+-{
+-	return container_of(pcs, struct mtk_pcs, pcs);
+-}
+-
+-static void mtk_pcs_get_state(struct phylink_pcs *pcs,
+-			      struct phylink_link_state *state)
+-{
+-	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+-	unsigned int bm, adv;
+-
+-	/* Read the BMSR and LPA */
+-	regmap_read(mpcs->regmap, SGMSYS_PCS_CONTROL_1, &bm);
+-	regmap_read(mpcs->regmap, SGMSYS_PCS_ADVERTISE, &adv);
+-
+-	phylink_mii_c22_pcs_decode_state(state, FIELD_GET(SGMII_BMSR, bm),
+-					 FIELD_GET(SGMII_LPA, adv));
+-}
+-
+-static int mtk_pcs_config(struct phylink_pcs *pcs, unsigned int mode,
+-			  phy_interface_t interface,
+-			  const unsigned long *advertising,
+-			  bool permit_pause_to_mac)
+-{
+-	bool mode_changed = false, changed, use_an;
+-	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+-	unsigned int rgc3, sgm_mode, bmcr;
+-	int advertise, link_timer;
+-
+-	advertise = phylink_mii_c22_pcs_encode_advertisement(interface,
+-							     advertising);
+-	if (advertise < 0)
+-		return advertise;
+-
+-	/* Clearing IF_MODE_BIT0 switches the PCS to BASE-X mode, and
+-	 * we assume that fixes it's speed at bitrate = line rate (in
+-	 * other words, 1000Mbps or 2500Mbps).
+-	 */
+-	if (interface == PHY_INTERFACE_MODE_SGMII) {
+-		sgm_mode = SGMII_IF_MODE_SGMII;
+-		if (phylink_autoneg_inband(mode)) {
+-			sgm_mode |= SGMII_REMOTE_FAULT_DIS |
+-				    SGMII_SPEED_DUPLEX_AN;
+-			use_an = true;
+-		} else {
+-			use_an = false;
+-		}
+-	} else if (phylink_autoneg_inband(mode)) {
+-		/* 1000base-X or 2500base-X autoneg */
+-		sgm_mode = SGMII_REMOTE_FAULT_DIS;
+-		use_an = linkmode_test_bit(ETHTOOL_LINK_MODE_Autoneg_BIT,
+-					   advertising);
+-	} else {
+-		/* 1000base-X or 2500base-X without autoneg */
+-		sgm_mode = 0;
+-		use_an = false;
+-	}
+-
+-	if (use_an) {
+-		bmcr = SGMII_AN_ENABLE;
+-	} else {
+-		bmcr = 0;
+-	}
+-
+-	if (mpcs->interface != interface) {
+-		link_timer = phylink_get_link_timer_ns(interface);
+-		if (link_timer < 0)
+-			return link_timer;
+-
+-		/* PHYA power down */
+-		regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL,
+-				   SGMII_PHYA_PWD, SGMII_PHYA_PWD);
+-
+-		if (mpcs->flags & MTK_SGMII_FLAG_PN_SWAP)
+-			regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_WRAP_CTRL,
+-					   SGMII_PN_SWAP_MASK,
+-					   SGMII_PN_SWAP_TX_RX);
+-
+-		/* Reset SGMII PCS state */
+-		regmap_update_bits(mpcs->regmap, SGMII_RESERVED_0,
+-				   SGMII_SW_RESET, SGMII_SW_RESET);
+-
+-		if (interface == PHY_INTERFACE_MODE_2500BASEX)
+-			rgc3 = RG_PHY_SPEED_3_125G;
+-		else
+-			rgc3 = 0;
+-
+-		/* Configure the underlying interface speed */
+-		regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3,
+-				   RG_PHY_SPEED_3_125G, rgc3);
+-
+-		/* Setup the link timer */
+-		regmap_write(mpcs->regmap, SGMSYS_PCS_LINK_TIMER, link_timer / 2 / 8);
+-
+-		mpcs->interface = interface;
+-		mode_changed = true;
+-	}
+-
+-	/* Update the advertisement, noting whether it has changed */
+-	regmap_update_bits_check(mpcs->regmap, SGMSYS_PCS_ADVERTISE,
+-				 SGMII_ADVERTISE, advertise, &changed);
+-
+-	/* Update the sgmsys mode register */
+-	regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
+-			   SGMII_REMOTE_FAULT_DIS | SGMII_SPEED_DUPLEX_AN |
+-			   SGMII_IF_MODE_SGMII, sgm_mode);
+-
+-	/* Update the BMCR */
+-	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
+-			   SGMII_AN_ENABLE, bmcr);
+-
+-	/* Release PHYA power down state
+-	 * Only removing bit SGMII_PHYA_PWD isn't enough.
+-	 * There are cases when the SGMII_PHYA_PWD register contains 0x9 which
+-	 * prevents SGMII from working. The SGMII still shows link but no traffic
+-	 * can flow. Writing 0x0 to the PHYA_PWD register fix the issue. 0x0 was
+-	 * taken from a good working state of the SGMII interface.
+-	 * Unknown how much the QPHY needs but it is racy without a sleep.
+-	 * Tested on mt7622 & mt7986.
+-	 */
+-	usleep_range(50, 100);
+-	regmap_write(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, 0);
+-
+-	return changed || mode_changed;
+-}
+-
+-static void mtk_pcs_restart_an(struct phylink_pcs *pcs)
+-{
+-	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+-
+-	regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1,
+-			   SGMII_AN_RESTART, SGMII_AN_RESTART);
+-}
+-
+-static void mtk_pcs_link_up(struct phylink_pcs *pcs, unsigned int mode,
+-			    phy_interface_t interface, int speed, int duplex)
+-{
+-	struct mtk_pcs *mpcs = pcs_to_mtk_pcs(pcs);
+-	unsigned int sgm_mode;
+-
+-	if (!phylink_autoneg_inband(mode)) {
+-		/* Force the speed and duplex setting */
+-		if (speed == SPEED_10)
+-			sgm_mode = SGMII_SPEED_10;
+-		else if (speed == SPEED_100)
+-			sgm_mode = SGMII_SPEED_100;
+-		else
+-			sgm_mode = SGMII_SPEED_1000;
+-
+-		if (duplex != DUPLEX_FULL)
+-			sgm_mode |= SGMII_DUPLEX_HALF;
+-
+-		regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE,
+-				   SGMII_DUPLEX_HALF | SGMII_SPEED_MASK,
+-				   sgm_mode);
+-	}
+-}
+-
+-static const struct phylink_pcs_ops mtk_pcs_ops = {
+-	.pcs_get_state = mtk_pcs_get_state,
+-	.pcs_config = mtk_pcs_config,
+-	.pcs_an_restart = mtk_pcs_restart_an,
+-	.pcs_link_up = mtk_pcs_link_up,
+-};
+-
+-int mtk_sgmii_init(struct mtk_sgmii *ss, struct device_node *r, u32 ana_rgc3)
+-{
+-	struct device_node *np;
+-	int i;
+-
+-	for (i = 0; i < MTK_MAX_DEVS; i++) {
+-		np = of_parse_phandle(r, "mediatek,sgmiisys", i);
+-		if (!np)
+-			break;
+-
+-		ss->pcs[i].ana_rgc3 = ana_rgc3;
+-		ss->pcs[i].regmap = syscon_node_to_regmap(np);
+-
+-		ss->pcs[i].flags = 0;
+-		if (of_property_read_bool(np, "mediatek,pnswap"))
+-			ss->pcs[i].flags |= MTK_SGMII_FLAG_PN_SWAP;
+-
+-		of_node_put(np);
+-		if (IS_ERR(ss->pcs[i].regmap))
+-			return PTR_ERR(ss->pcs[i].regmap);
+-
+-		ss->pcs[i].pcs.ops = &mtk_pcs_ops;
+-		ss->pcs[i].pcs.poll = true;
+-		ss->pcs[i].interface = PHY_INTERFACE_MODE_NA;
+-	}
+-
+-	return 0;
+-}
+-
+-struct phylink_pcs *mtk_sgmii_select_pcs(struct mtk_sgmii *ss, int id)
+-{
+-	if (!ss->pcs[id].regmap)
+-		return NULL;
+-
+-	return &ss->pcs[id].pcs;
+-}
diff --git a/target/linux/generic/backport-6.1/733-v6.4-21-net-mtk_eth_soc-use-WO-firmware-for-MT7981.patch b/target/linux/generic/backport-6.1/733-v6.4-21-net-mtk_eth_soc-use-WO-firmware-for-MT7981.patch
new file mode 100644
index 00000000000000..9ce2735951c897
--- /dev/null
+++ b/target/linux/generic/backport-6.1/733-v6.4-21-net-mtk_eth_soc-use-WO-firmware-for-MT7981.patch
@@ -0,0 +1,46 @@
+From f5af7931d2a2cae66d0f9dad4ba517b1b00620b3 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Wed, 19 Apr 2023 19:07:23 +0100
+Subject: [PATCH] net: mtk_eth_soc: use WO firmware for MT7981
+
+In order to support wireless offloading on MT7981 we need to load the
+appropriate firmware. Recognize MT7981 and load mt7981_wo.bin.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/ethernet/mediatek/mtk_wed_mcu.c | 7 ++++++-
+ drivers/net/ethernet/mediatek/mtk_wed_wo.h  | 1 +
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
+@@ -326,7 +326,11 @@ mtk_wed_mcu_load_firmware(struct mtk_wed
+ 		wo->hw->index + 1);
+ 
+ 	/* load firmware */
+-	fw_name = wo->hw->index ? MT7986_FIRMWARE_WO1 : MT7986_FIRMWARE_WO0;
++	if (of_device_is_compatible(wo->hw->node, "mediatek,mt7981-wed"))
++		fw_name = MT7981_FIRMWARE_WO;
++	else
++		fw_name = wo->hw->index ? MT7986_FIRMWARE_WO1 : MT7986_FIRMWARE_WO0;
++
+ 	ret = request_firmware(&fw, fw_name, wo->hw->dev);
+ 	if (ret)
+ 		return ret;
+@@ -386,5 +390,6 @@ int mtk_wed_mcu_init(struct mtk_wed_wo *
+ 				  100, MTK_FW_DL_TIMEOUT);
+ }
+ 
++MODULE_FIRMWARE(MT7981_FIRMWARE_WO);
+ MODULE_FIRMWARE(MT7986_FIRMWARE_WO0);
+ MODULE_FIRMWARE(MT7986_FIRMWARE_WO1);
+--- a/drivers/net/ethernet/mediatek/mtk_wed_wo.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.h
+@@ -88,6 +88,7 @@ enum mtk_wed_dummy_cr_idx {
+ 	MTK_WED_DUMMY_CR_WO_STATUS,
+ };
+ 
++#define MT7981_FIRMWARE_WO	"mediatek/mt7981_wo.bin"
+ #define MT7986_FIRMWARE_WO0	"mediatek/mt7986_wo_0.bin"
+ #define MT7986_FIRMWARE_WO1	"mediatek/mt7986_wo_1.bin"
+ 
diff --git a/target/linux/generic/backport-6.1/733-v6.4-22-net-ethernet-mtk_eth_soc-fix-NULL-pointer-dereferenc.patch b/target/linux/generic/backport-6.1/733-v6.4-22-net-ethernet-mtk_eth_soc-fix-NULL-pointer-dereferenc.patch
new file mode 100644
index 00000000000000..d715c4aa6867b9
--- /dev/null
+++ b/target/linux/generic/backport-6.1/733-v6.4-22-net-ethernet-mtk_eth_soc-fix-NULL-pointer-dereferenc.patch
@@ -0,0 +1,28 @@
+From 7c83e28f10830aa5105c25eaabe890e3adac36aa Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Tue, 9 May 2023 03:20:06 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: fix NULL pointer dereference
+
+Check for NULL pointer to avoid kernel crashing in case of missing WO
+firmware in case only a single WEDv2 device has been initialized, e.g. on
+MT7981 which can connect just one wireless frontend.
+
+Fixes: 86ce0d09e424 ("net: ethernet: mtk_eth_soc: use WO firmware for MT7981")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/mediatek/mtk_wed.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -647,7 +647,7 @@ __mtk_wed_detach(struct mtk_wed_device *
+ 					   BIT(hw->index), BIT(hw->index));
+ 	}
+ 
+-	if (!hw_list[!hw->index]->wed_dev &&
++	if ((!hw_list[!hw->index] || !hw_list[!hw->index]->wed_dev) &&
+ 	    hw->eth->dma_dev != hw->eth->dev)
+ 		mtk_eth_set_dma_device(hw->eth, hw->eth->dev);
+ 
diff --git a/target/linux/generic/backport-6.1/777-v6.2-04-net-dsa-qca8k-introduce-single-mii-read-write-lo-hi.patch b/target/linux/generic/backport-6.1/777-v6.2-04-net-dsa-qca8k-introduce-single-mii-read-write-lo-hi.patch
new file mode 100644
index 00000000000000..c0320ad6f9d8ab
--- /dev/null
+++ b/target/linux/generic/backport-6.1/777-v6.2-04-net-dsa-qca8k-introduce-single-mii-read-write-lo-hi.patch
@@ -0,0 +1,150 @@
+From cfbd6de588ef659c198083205dc954a6d3ed2aec Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 29 Dec 2022 17:33:35 +0100
+Subject: [PATCH 4/5] net: dsa: qca8k: introduce single mii read/write lo/hi
+
+It may be useful to read/write just the lo or hi half of a reg.
+
+This is especially useful for phy poll with the use of mdio master.
+The mdio master reg is composed by the first 16 bit related to setup and
+the other half with the returned data or data to write.
+
+Refactor the mii function to permit single mii read/write of lo or hi
+half of the reg.
+
+Tested-by: Ronald Wahl <ronald.wahl@raritan.com>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c | 106 ++++++++++++++++++++++++-------
+ 1 file changed, 84 insertions(+), 22 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -37,42 +37,104 @@ qca8k_split_addr(u32 regaddr, u16 *r1, u
+ }
+ 
+ static int
+-qca8k_mii_read32(struct mii_bus *bus, int phy_id, u32 regnum, u32 *val)
++qca8k_mii_write_lo(struct mii_bus *bus, int phy_id, u32 regnum, u32 val)
+ {
+ 	int ret;
++	u16 lo;
+ 
+-	ret = bus->read(bus, phy_id, regnum);
+-	if (ret >= 0) {
+-		*val = ret;
+-		ret = bus->read(bus, phy_id, regnum + 1);
+-		*val |= ret << 16;
+-	}
++	lo = val & 0xffff;
++	ret = bus->write(bus, phy_id, regnum, lo);
++	if (ret < 0)
++		dev_err_ratelimited(&bus->dev,
++				    "failed to write qca8k 32bit lo register\n");
++
++	return ret;
++}
+ 
+-	if (ret < 0) {
++static int
++qca8k_mii_write_hi(struct mii_bus *bus, int phy_id, u32 regnum, u32 val)
++{
++	int ret;
++	u16 hi;
++
++	hi = (u16)(val >> 16);
++	ret = bus->write(bus, phy_id, regnum, hi);
++	if (ret < 0)
+ 		dev_err_ratelimited(&bus->dev,
+-				    "failed to read qca8k 32bit register\n");
+-		*val = 0;
+-		return ret;
+-	}
++				    "failed to write qca8k 32bit hi register\n");
+ 
++	return ret;
++}
++
++static int
++qca8k_mii_read_lo(struct mii_bus *bus, int phy_id, u32 regnum, u32 *val)
++{
++	int ret;
++
++	ret = bus->read(bus, phy_id, regnum);
++	if (ret < 0)
++		goto err;
++
++	*val = ret & 0xffff;
+ 	return 0;
++
++err:
++	dev_err_ratelimited(&bus->dev,
++			    "failed to read qca8k 32bit lo register\n");
++	*val = 0;
++
++	return ret;
+ }
+ 
+-static void
+-qca8k_mii_write32(struct mii_bus *bus, int phy_id, u32 regnum, u32 val)
++static int
++qca8k_mii_read_hi(struct mii_bus *bus, int phy_id, u32 regnum, u32 *val)
+ {
+-	u16 lo, hi;
+ 	int ret;
+ 
+-	lo = val & 0xffff;
+-	hi = (u16)(val >> 16);
++	ret = bus->read(bus, phy_id, regnum);
++	if (ret < 0)
++		goto err;
+ 
+-	ret = bus->write(bus, phy_id, regnum, lo);
+-	if (ret >= 0)
+-		ret = bus->write(bus, phy_id, regnum + 1, hi);
++	*val = ret << 16;
++	return 0;
++
++err:
++	dev_err_ratelimited(&bus->dev,
++			    "failed to read qca8k 32bit hi register\n");
++	*val = 0;
++
++	return ret;
++}
++
++static int
++qca8k_mii_read32(struct mii_bus *bus, int phy_id, u32 regnum, u32 *val)
++{
++	u32 hi, lo;
++	int ret;
++
++	*val = 0;
++
++	ret = qca8k_mii_read_lo(bus, phy_id, regnum, &lo);
+ 	if (ret < 0)
+-		dev_err_ratelimited(&bus->dev,
+-				    "failed to write qca8k 32bit register\n");
++		goto err;
++
++	ret = qca8k_mii_read_hi(bus, phy_id, regnum + 1, &hi);
++	if (ret < 0)
++		goto err;
++
++	*val = lo | hi;
++
++err:
++	return ret;
++}
++
++static void
++qca8k_mii_write32(struct mii_bus *bus, int phy_id, u32 regnum, u32 val)
++{
++	if (qca8k_mii_write_lo(bus, phy_id, regnum, val) < 0)
++		return;
++
++	qca8k_mii_write_hi(bus, phy_id, regnum + 1, val);
+ }
+ 
+ static int
diff --git a/target/linux/generic/backport-6.1/777-v6.2-05-net-dsa-qca8k-improve-mdio-master-read-write-by-usin.patch b/target/linux/generic/backport-6.1/777-v6.2-05-net-dsa-qca8k-improve-mdio-master-read-write-by-usin.patch
new file mode 100644
index 00000000000000..4cbb66cf35fac3
--- /dev/null
+++ b/target/linux/generic/backport-6.1/777-v6.2-05-net-dsa-qca8k-improve-mdio-master-read-write-by-usin.patch
@@ -0,0 +1,73 @@
+From a4165830ca237f2b3318faf62562bce8ce12a389 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 29 Dec 2022 17:33:36 +0100
+Subject: [PATCH 5/5] net: dsa: qca8k: improve mdio master read/write by using
+ single lo/hi
+
+Improve mdio master read/write by using singe mii read/write lo/hi.
+
+In a read and write we need to poll the mdio master regs in a busy loop
+to check for a specific bit present in the upper half of the reg. We can
+ignore the other half since it won't contain useful data. This will save
+an additional useless read for each read and write operation.
+
+In a read operation the returned data is present in the mdio master reg
+lower half. We can ignore the other half since it won't contain useful
+data. This will save an additional useless read for each read operation.
+
+In a read operation it's needed to just set the hi half of the mdio
+master reg as the lo half will be replaced by the result. This will save
+an additional useless write for each read operation.
+
+Tested-by: Ronald Wahl <ronald.wahl@raritan.com>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -740,9 +740,9 @@ qca8k_mdio_busy_wait(struct mii_bus *bus
+ 
+ 	qca8k_split_addr(reg, &r1, &r2, &page);
+ 
+-	ret = read_poll_timeout(qca8k_mii_read32, ret1, !(val & mask), 0,
++	ret = read_poll_timeout(qca8k_mii_read_hi, ret1, !(val & mask), 0,
+ 				QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC, false,
+-				bus, 0x10 | r2, r1, &val);
++				bus, 0x10 | r2, r1 + 1, &val);
+ 
+ 	/* Check if qca8k_read has failed for a different reason
+ 	 * before returnting -ETIMEDOUT
+@@ -784,7 +784,7 @@ qca8k_mdio_write(struct qca8k_priv *priv
+ 
+ exit:
+ 	/* even if the busy_wait timeouts try to clear the MASTER_EN */
+-	qca8k_mii_write32(bus, 0x10 | r2, r1, 0);
++	qca8k_mii_write_hi(bus, 0x10 | r2, r1 + 1, 0);
+ 
+ 	mutex_unlock(&bus->mdio_lock);
+ 
+@@ -814,18 +814,18 @@ qca8k_mdio_read(struct qca8k_priv *priv,
+ 	if (ret)
+ 		goto exit;
+ 
+-	qca8k_mii_write32(bus, 0x10 | r2, r1, val);
++	qca8k_mii_write_hi(bus, 0x10 | r2, r1 + 1, val);
+ 
+ 	ret = qca8k_mdio_busy_wait(bus, QCA8K_MDIO_MASTER_CTRL,
+ 				   QCA8K_MDIO_MASTER_BUSY);
+ 	if (ret)
+ 		goto exit;
+ 
+-	ret = qca8k_mii_read32(bus, 0x10 | r2, r1, &val);
++	ret = qca8k_mii_read_lo(bus, 0x10 | r2, r1, &val);
+ 
+ exit:
+ 	/* even if the busy_wait timeouts try to clear the MASTER_EN */
+-	qca8k_mii_write32(bus, 0x10 | r2, r1, 0);
++	qca8k_mii_write_hi(bus, 0x10 | r2, r1 + 1, 0);
+ 
+ 	mutex_unlock(&bus->mdio_lock);
+ 
diff --git a/target/linux/generic/backport-6.1/788-v6.3-net-dsa-mt7530-use-external-PCS-driver.patch b/target/linux/generic/backport-6.1/788-v6.3-net-dsa-mt7530-use-external-PCS-driver.patch
new file mode 100644
index 00000000000000..be97c8ac3c2e6d
--- /dev/null
+++ b/target/linux/generic/backport-6.1/788-v6.3-net-dsa-mt7530-use-external-PCS-driver.patch
@@ -0,0 +1,514 @@
+From patchwork Thu Mar  9 10:57:44 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 13167235
+X-Patchwork-Delegate: kuba@kernel.org
+Return-Path: <netdev-owner@vger.kernel.org>
+Date: Thu, 9 Mar 2023 10:57:44 +0000
+From: Daniel Golle <daniel@makrotopia.org>
+To: netdev@vger.kernel.org, linux-mediatek@lists.infradead.org,
+        linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org,
+        Russell King <linux@armlinux.org.uk>,
+        Heiner Kallweit <hkallweit1@gmail.com>,
+        Lorenzo Bianconi <lorenzo@kernel.org>,
+        Mark Lee <Mark-MC.Lee@mediatek.com>,
+        John Crispin <john@phrozen.org>, Felix Fietkau <nbd@nbd.name>,
+        AngeloGioacchino Del Regno
+        <angelogioacchino.delregno@collabora.com>,
+        Matthias Brugger <matthias.bgg@gmail.com>,
+        DENG Qingfang <dqfext@gmail.com>,
+        Landen Chao <Landen.Chao@mediatek.com>,
+        Sean Wang <sean.wang@mediatek.com>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Eric Dumazet <edumazet@google.com>,
+        "David S. Miller" <davem@davemloft.net>,
+        Vladimir Oltean <olteanv@gmail.com>,
+        Florian Fainelli <f.fainelli@gmail.com>,
+        Andrew Lunn <andrew@lunn.ch>,
+        Vladimir Oltean <vladimir.oltean@nxp.com>
+Cc: =?iso-8859-1?q?Bj=F8rn?= Mork <bjorn@mork.no>,
+ Frank Wunderlich <frank-w@public-files.de>,
+ Alexander Couzens <lynxis@fe80.eu>
+Subject: [PATCH net-next v13 11/16] net: dsa: mt7530: use external PCS driver
+Message-ID: 
+ <2ac2ee40d3b0e705461b50613fda6a7edfdbc4b3.1678357225.git.daniel@makrotopia.org>
+References: <cover.1678357225.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1678357225.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <netdev.vger.kernel.org>
+X-Mailing-List: netdev@vger.kernel.org
+X-Patchwork-Delegate: kuba@kernel.org
+
+Implement regmap access wrappers, for now only to be used by the
+pcs-mtk driver.
+Make use of external PCS driver and drop the reduntant implementation
+in mt7530.c.
+As a nice side effect the SGMII registers can now also more easily be
+inspected for debugging via /sys/kernel/debug/regmap.
+
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Tested-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Tested-by: Frank Wunderlich <frank-w@public-files.de>
+---
+ drivers/net/dsa/Kconfig  |   1 +
+ drivers/net/dsa/mt7530.c | 277 ++++++++++-----------------------------
+ drivers/net/dsa/mt7530.h |  47 +------
+ 3 files changed, 71 insertions(+), 254 deletions(-)
+
+--- a/drivers/net/dsa/Kconfig
++++ b/drivers/net/dsa/Kconfig
+@@ -37,6 +37,7 @@ config NET_DSA_MT7530
+ 	tristate "MediaTek MT753x and MT7621 Ethernet switch support"
+ 	select NET_DSA_TAG_MTK
+ 	select MEDIATEK_GE_PHY
++	select PCS_MTK_LYNXI
+ 	help
+ 	  This enables support for the MediaTek MT7530, MT7531, and MT7621
+ 	  Ethernet switch chips.
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -14,6 +14,7 @@
+ #include <linux/of_mdio.h>
+ #include <linux/of_net.h>
+ #include <linux/of_platform.h>
++#include <linux/pcs/pcs-mtk-lynxi.h>
+ #include <linux/phylink.h>
+ #include <linux/regmap.h>
+ #include <linux/regulator/consumer.h>
+@@ -2597,128 +2598,11 @@ static int mt7531_rgmii_setup(struct mt7
+ 	return 0;
+ }
+ 
+-static void mt7531_pcs_link_up(struct phylink_pcs *pcs, unsigned int mode,
+-			       phy_interface_t interface, int speed, int duplex)
+-{
+-	struct mt7530_priv *priv = pcs_to_mt753x_pcs(pcs)->priv;
+-	int port = pcs_to_mt753x_pcs(pcs)->port;
+-	unsigned int val;
+-
+-	/* For adjusting speed and duplex of SGMII force mode. */
+-	if (interface != PHY_INTERFACE_MODE_SGMII ||
+-	    phylink_autoneg_inband(mode))
+-		return;
+-
+-	/* SGMII force mode setting */
+-	val = mt7530_read(priv, MT7531_SGMII_MODE(port));
+-	val &= ~MT7531_SGMII_IF_MODE_MASK;
+-
+-	switch (speed) {
+-	case SPEED_10:
+-		val |= MT7531_SGMII_FORCE_SPEED_10;
+-		break;
+-	case SPEED_100:
+-		val |= MT7531_SGMII_FORCE_SPEED_100;
+-		break;
+-	case SPEED_1000:
+-		val |= MT7531_SGMII_FORCE_SPEED_1000;
+-		break;
+-	}
+-
+-	/* MT7531 SGMII 1G force mode can only work in full duplex mode,
+-	 * no matter MT7531_SGMII_FORCE_HALF_DUPLEX is set or not.
+-	 *
+-	 * The speed check is unnecessary as the MAC capabilities apply
+-	 * this restriction. --rmk
+-	 */
+-	if ((speed == SPEED_10 || speed == SPEED_100) &&
+-	    duplex != DUPLEX_FULL)
+-		val |= MT7531_SGMII_FORCE_HALF_DUPLEX;
+-
+-	mt7530_write(priv, MT7531_SGMII_MODE(port), val);
+-}
+-
+ static bool mt753x_is_mac_port(u32 port)
+ {
+ 	return (port == 5 || port == 6);
+ }
+ 
+-static int mt7531_sgmii_setup_mode_force(struct mt7530_priv *priv, u32 port,
+-					 phy_interface_t interface)
+-{
+-	u32 val;
+-
+-	if (!mt753x_is_mac_port(port))
+-		return -EINVAL;
+-
+-	mt7530_set(priv, MT7531_QPHY_PWR_STATE_CTRL(port),
+-		   MT7531_SGMII_PHYA_PWD);
+-
+-	val = mt7530_read(priv, MT7531_PHYA_CTRL_SIGNAL3(port));
+-	val &= ~MT7531_RG_TPHY_SPEED_MASK;
+-	/* Setup 2.5 times faster clock for 2.5Gbps data speeds with 10B/8B
+-	 * encoding.
+-	 */
+-	val |= (interface == PHY_INTERFACE_MODE_2500BASEX) ?
+-		MT7531_RG_TPHY_SPEED_3_125G : MT7531_RG_TPHY_SPEED_1_25G;
+-	mt7530_write(priv, MT7531_PHYA_CTRL_SIGNAL3(port), val);
+-
+-	mt7530_clear(priv, MT7531_PCS_CONTROL_1(port), MT7531_SGMII_AN_ENABLE);
+-
+-	/* MT7531 SGMII 1G and 2.5G force mode can only work in full duplex
+-	 * mode, no matter MT7531_SGMII_FORCE_HALF_DUPLEX is set or not.
+-	 */
+-	mt7530_rmw(priv, MT7531_SGMII_MODE(port),
+-		   MT7531_SGMII_IF_MODE_MASK | MT7531_SGMII_REMOTE_FAULT_DIS,
+-		   MT7531_SGMII_FORCE_SPEED_1000);
+-
+-	mt7530_write(priv, MT7531_QPHY_PWR_STATE_CTRL(port), 0);
+-
+-	return 0;
+-}
+-
+-static int mt7531_sgmii_setup_mode_an(struct mt7530_priv *priv, int port,
+-				      phy_interface_t interface)
+-{
+-	if (!mt753x_is_mac_port(port))
+-		return -EINVAL;
+-
+-	mt7530_set(priv, MT7531_QPHY_PWR_STATE_CTRL(port),
+-		   MT7531_SGMII_PHYA_PWD);
+-
+-	mt7530_rmw(priv, MT7531_PHYA_CTRL_SIGNAL3(port),
+-		   MT7531_RG_TPHY_SPEED_MASK, MT7531_RG_TPHY_SPEED_1_25G);
+-
+-	mt7530_set(priv, MT7531_SGMII_MODE(port),
+-		   MT7531_SGMII_REMOTE_FAULT_DIS |
+-		   MT7531_SGMII_SPEED_DUPLEX_AN);
+-
+-	mt7530_rmw(priv, MT7531_PCS_SPEED_ABILITY(port),
+-		   MT7531_SGMII_TX_CONFIG_MASK, 1);
+-
+-	mt7530_set(priv, MT7531_PCS_CONTROL_1(port), MT7531_SGMII_AN_ENABLE);
+-
+-	mt7530_set(priv, MT7531_PCS_CONTROL_1(port), MT7531_SGMII_AN_RESTART);
+-
+-	mt7530_write(priv, MT7531_QPHY_PWR_STATE_CTRL(port), 0);
+-
+-	return 0;
+-}
+-
+-static void mt7531_pcs_an_restart(struct phylink_pcs *pcs)
+-{
+-	struct mt7530_priv *priv = pcs_to_mt753x_pcs(pcs)->priv;
+-	int port = pcs_to_mt753x_pcs(pcs)->port;
+-	u32 val;
+-
+-	/* Only restart AN when AN is enabled */
+-	val = mt7530_read(priv, MT7531_PCS_CONTROL_1(port));
+-	if (val & MT7531_SGMII_AN_ENABLE) {
+-		val |= MT7531_SGMII_AN_RESTART;
+-		mt7530_write(priv, MT7531_PCS_CONTROL_1(port), val);
+-	}
+-}
+-
+ static int
+ mt7531_mac_config(struct dsa_switch *ds, int port, unsigned int mode,
+ 		  phy_interface_t interface)
+@@ -2741,11 +2625,11 @@ mt7531_mac_config(struct dsa_switch *ds,
+ 		phydev = dp->slave->phydev;
+ 		return mt7531_rgmii_setup(priv, port, interface, phydev);
+ 	case PHY_INTERFACE_MODE_SGMII:
+-		return mt7531_sgmii_setup_mode_an(priv, port, interface);
+ 	case PHY_INTERFACE_MODE_NA:
+ 	case PHY_INTERFACE_MODE_1000BASEX:
+ 	case PHY_INTERFACE_MODE_2500BASEX:
+-		return mt7531_sgmii_setup_mode_force(priv, port, interface);
++		/* handled in SGMII PCS driver */
++		return 0;
+ 	default:
+ 		return -EINVAL;
+ 	}
+@@ -2770,11 +2654,11 @@ mt753x_phylink_mac_select_pcs(struct dsa
+ 
+ 	switch (interface) {
+ 	case PHY_INTERFACE_MODE_TRGMII:
++		return &priv->pcs[port].pcs;
+ 	case PHY_INTERFACE_MODE_SGMII:
+ 	case PHY_INTERFACE_MODE_1000BASEX:
+ 	case PHY_INTERFACE_MODE_2500BASEX:
+-		return &priv->pcs[port].pcs;
+-
++		return priv->ports[port].sgmii_pcs;
+ 	default:
+ 		return NULL;
+ 	}
+@@ -3015,86 +2899,6 @@ static void mt7530_pcs_get_state(struct
+ 		state->pause |= MLO_PAUSE_TX;
+ }
+ 
+-static int
+-mt7531_sgmii_pcs_get_state_an(struct mt7530_priv *priv, int port,
+-			      struct phylink_link_state *state)
+-{
+-	u32 status, val;
+-	u16 config_reg;
+-
+-	status = mt7530_read(priv, MT7531_PCS_CONTROL_1(port));
+-	state->link = !!(status & MT7531_SGMII_LINK_STATUS);
+-	state->an_complete = !!(status & MT7531_SGMII_AN_COMPLETE);
+-	if (state->interface == PHY_INTERFACE_MODE_SGMII &&
+-	    (status & MT7531_SGMII_AN_ENABLE)) {
+-		val = mt7530_read(priv, MT7531_PCS_SPEED_ABILITY(port));
+-		config_reg = val >> 16;
+-
+-		switch (config_reg & LPA_SGMII_SPD_MASK) {
+-		case LPA_SGMII_1000:
+-			state->speed = SPEED_1000;
+-			break;
+-		case LPA_SGMII_100:
+-			state->speed = SPEED_100;
+-			break;
+-		case LPA_SGMII_10:
+-			state->speed = SPEED_10;
+-			break;
+-		default:
+-			dev_err(priv->dev, "invalid sgmii PHY speed\n");
+-			state->link = false;
+-			return -EINVAL;
+-		}
+-
+-		if (config_reg & LPA_SGMII_FULL_DUPLEX)
+-			state->duplex = DUPLEX_FULL;
+-		else
+-			state->duplex = DUPLEX_HALF;
+-	}
+-
+-	return 0;
+-}
+-
+-static void
+-mt7531_sgmii_pcs_get_state_inband(struct mt7530_priv *priv, int port,
+-				  struct phylink_link_state *state)
+-{
+-	unsigned int val;
+-
+-	val = mt7530_read(priv, MT7531_PCS_CONTROL_1(port));
+-	state->link = !!(val & MT7531_SGMII_LINK_STATUS);
+-	if (!state->link)
+-		return;
+-
+-	state->an_complete = state->link;
+-
+-	if (state->interface == PHY_INTERFACE_MODE_2500BASEX)
+-		state->speed = SPEED_2500;
+-	else
+-		state->speed = SPEED_1000;
+-
+-	state->duplex = DUPLEX_FULL;
+-	state->pause = MLO_PAUSE_NONE;
+-}
+-
+-static void mt7531_pcs_get_state(struct phylink_pcs *pcs,
+-				 struct phylink_link_state *state)
+-{
+-	struct mt7530_priv *priv = pcs_to_mt753x_pcs(pcs)->priv;
+-	int port = pcs_to_mt753x_pcs(pcs)->port;
+-
+-	if (state->interface == PHY_INTERFACE_MODE_SGMII) {
+-		mt7531_sgmii_pcs_get_state_an(priv, port, state);
+-		return;
+-	} else if ((state->interface == PHY_INTERFACE_MODE_1000BASEX) ||
+-		   (state->interface == PHY_INTERFACE_MODE_2500BASEX)) {
+-		mt7531_sgmii_pcs_get_state_inband(priv, port, state);
+-		return;
+-	}
+-
+-	state->link = false;
+-}
+-
+ static int mt753x_pcs_config(struct phylink_pcs *pcs, unsigned int mode,
+ 			     phy_interface_t interface,
+ 			     const unsigned long *advertising,
+@@ -3114,18 +2918,57 @@ static const struct phylink_pcs_ops mt75
+ 	.pcs_an_restart = mt7530_pcs_an_restart,
+ };
+ 
+-static const struct phylink_pcs_ops mt7531_pcs_ops = {
+-	.pcs_validate = mt753x_pcs_validate,
+-	.pcs_get_state = mt7531_pcs_get_state,
+-	.pcs_config = mt753x_pcs_config,
+-	.pcs_an_restart = mt7531_pcs_an_restart,
+-	.pcs_link_up = mt7531_pcs_link_up,
++static int mt7530_regmap_read(void *context, unsigned int reg, unsigned int *val)
++{
++	struct mt7530_priv *priv = context;
++
++	*val = mt7530_read(priv, reg);
++	return 0;
++};
++
++static int mt7530_regmap_write(void *context, unsigned int reg, unsigned int val)
++{
++	struct mt7530_priv *priv = context;
++
++	mt7530_write(priv, reg, val);
++	return 0;
++};
++
++static int mt7530_regmap_update_bits(void *context, unsigned int reg,
++				     unsigned int mask, unsigned int val)
++{
++	struct mt7530_priv *priv = context;
++
++	mt7530_rmw(priv, reg, mask, val);
++	return 0;
++};
++
++static const struct regmap_bus mt7531_regmap_bus = {
++	.reg_write = mt7530_regmap_write,
++	.reg_read = mt7530_regmap_read,
++	.reg_update_bits = mt7530_regmap_update_bits,
++};
++
++#define MT7531_PCS_REGMAP_CONFIG(_name, _reg_base) \
++	{				\
++		.name = _name,		\
++		.reg_bits = 16,		\
++		.val_bits = 32,		\
++		.reg_stride = 4,	\
++		.reg_base = _reg_base,	\
++		.max_register = 0x17c,	\
++	}
++
++static const struct regmap_config mt7531_pcs_config[] = {
++	MT7531_PCS_REGMAP_CONFIG("port5", MT7531_SGMII_REG_BASE(5)),
++	MT7531_PCS_REGMAP_CONFIG("port6", MT7531_SGMII_REG_BASE(6)),
+ };
+ 
+ static int
+ mt753x_setup(struct dsa_switch *ds)
+ {
+ 	struct mt7530_priv *priv = ds->priv;
++	struct regmap *regmap;
+ 	int i, ret;
+ 
+ 	/* Initialise the PCS devices */
+@@ -3133,8 +2976,6 @@ mt753x_setup(struct dsa_switch *ds)
+ 		priv->pcs[i].pcs.ops = priv->info->pcs_ops;
+ 		priv->pcs[i].priv = priv;
+ 		priv->pcs[i].port = i;
+-		if (mt753x_is_mac_port(i))
+-			priv->pcs[i].pcs.poll = 1;
+ 	}
+ 
+ 	ret = priv->info->sw_setup(ds);
+@@ -3149,6 +2990,16 @@ mt753x_setup(struct dsa_switch *ds)
+ 	if (ret && priv->irq)
+ 		mt7530_free_irq_common(priv);
+ 
++	if (priv->id == ID_MT7531)
++		for (i = 0; i < 2; i++) {
++			regmap = devm_regmap_init(ds->dev,
++						  &mt7531_regmap_bus, priv,
++						  &mt7531_pcs_config[i]);
++			priv->ports[5 + i].sgmii_pcs =
++				mtk_pcs_lynxi_create(ds->dev, regmap,
++						     MT7531_PHYA_CTRL_SIGNAL3, 0);
++		}
++
+ 	return ret;
+ }
+ 
+@@ -3240,7 +3091,7 @@ static const struct mt753x_info mt753x_t
+ 	},
+ 	[ID_MT7531] = {
+ 		.id = ID_MT7531,
+-		.pcs_ops = &mt7531_pcs_ops,
++		.pcs_ops = &mt7530_pcs_ops,
+ 		.sw_setup = mt7531_setup,
+ 		.phy_read = mt7531_ind_phy_read,
+ 		.phy_write = mt7531_ind_phy_write,
+@@ -3348,7 +3199,7 @@ static void
+ mt7530_remove(struct mdio_device *mdiodev)
+ {
+ 	struct mt7530_priv *priv = dev_get_drvdata(&mdiodev->dev);
+-	int ret = 0;
++	int ret = 0, i;
+ 
+ 	if (!priv)
+ 		return;
+@@ -3367,6 +3218,10 @@ mt7530_remove(struct mdio_device *mdiode
+ 		mt7530_free_irq(priv);
+ 
+ 	dsa_unregister_switch(priv->ds);
++
++	for (i = 0; i < 2; ++i)
++		mtk_pcs_lynxi_destroy(priv->ports[5 + i].sgmii_pcs);
++
+ 	mutex_destroy(&priv->reg_mutex);
+ }
+ 
+--- a/drivers/net/dsa/mt7530.h
++++ b/drivers/net/dsa/mt7530.h
+@@ -364,47 +364,8 @@ enum mt7530_vlan_port_acc_frm {
+ 					 CCR_TX_OCT_CNT_BAD)
+ 
+ /* MT7531 SGMII register group */
+-#define MT7531_SGMII_REG_BASE		0x5000
+-#define MT7531_SGMII_REG(p, r)		(MT7531_SGMII_REG_BASE + \
+-					((p) - 5) * 0x1000 + (r))
+-
+-/* Register forSGMII PCS_CONTROL_1 */
+-#define MT7531_PCS_CONTROL_1(p)		MT7531_SGMII_REG(p, 0x00)
+-#define  MT7531_SGMII_LINK_STATUS	BIT(18)
+-#define  MT7531_SGMII_AN_ENABLE		BIT(12)
+-#define  MT7531_SGMII_AN_RESTART	BIT(9)
+-#define  MT7531_SGMII_AN_COMPLETE	BIT(21)
+-
+-/* Register for SGMII PCS_SPPED_ABILITY */
+-#define MT7531_PCS_SPEED_ABILITY(p)	MT7531_SGMII_REG(p, 0x08)
+-#define  MT7531_SGMII_TX_CONFIG_MASK	GENMASK(15, 0)
+-#define  MT7531_SGMII_TX_CONFIG		BIT(0)
+-
+-/* Register for SGMII_MODE */
+-#define MT7531_SGMII_MODE(p)		MT7531_SGMII_REG(p, 0x20)
+-#define  MT7531_SGMII_REMOTE_FAULT_DIS	BIT(8)
+-#define  MT7531_SGMII_IF_MODE_MASK	GENMASK(5, 1)
+-#define  MT7531_SGMII_FORCE_DUPLEX	BIT(4)
+-#define  MT7531_SGMII_FORCE_SPEED_MASK	GENMASK(3, 2)
+-#define  MT7531_SGMII_FORCE_SPEED_1000	BIT(3)
+-#define  MT7531_SGMII_FORCE_SPEED_100	BIT(2)
+-#define  MT7531_SGMII_FORCE_SPEED_10	0
+-#define  MT7531_SGMII_SPEED_DUPLEX_AN	BIT(1)
+-
+-enum mt7531_sgmii_force_duplex {
+-	MT7531_SGMII_FORCE_FULL_DUPLEX = 0,
+-	MT7531_SGMII_FORCE_HALF_DUPLEX = 0x10,
+-};
+-
+-/* Fields of QPHY_PWR_STATE_CTRL */
+-#define MT7531_QPHY_PWR_STATE_CTRL(p)	MT7531_SGMII_REG(p, 0xe8)
+-#define  MT7531_SGMII_PHYA_PWD		BIT(4)
+-
+-/* Values of SGMII SPEED */
+-#define MT7531_PHYA_CTRL_SIGNAL3(p)	MT7531_SGMII_REG(p, 0x128)
+-#define  MT7531_RG_TPHY_SPEED_MASK	(BIT(2) | BIT(3))
+-#define  MT7531_RG_TPHY_SPEED_1_25G	0x0
+-#define  MT7531_RG_TPHY_SPEED_3_125G	BIT(2)
++#define MT7531_SGMII_REG_BASE(p)	(0x5000 + ((p) - 5) * 0x1000)
++#define MT7531_PHYA_CTRL_SIGNAL3	0x128
+ 
+ /* Register for system reset */
+ #define MT7530_SYS_CTRL			0x7000
+@@ -703,13 +664,13 @@ struct mt7530_fdb {
+  * @pm:		The matrix used to show all connections with the port.
+  * @pvid:	The VLAN specified is to be considered a PVID at ingress.  Any
+  *		untagged frames will be assigned to the related VLAN.
+- * @vlan_filtering: The flags indicating whether the port that can recognize
+- *		    VLAN-tagged frames.
++ * @sgmii_pcs:	Pointer to PCS instance for SerDes ports
+  */
+ struct mt7530_port {
+ 	bool enable;
+ 	u32 pm;
+ 	u16 pvid;
++	struct phylink_pcs *sgmii_pcs;
+ };
+ 
+ /* Port 5 interface select definitions */
diff --git a/target/linux/generic/backport-6.1/790-v6.4-0001-net-dsa-mt7530-make-some-noise-if-register-read-fail.patch b/target/linux/generic/backport-6.1/790-v6.4-0001-net-dsa-mt7530-make-some-noise-if-register-read-fail.patch
new file mode 100644
index 00000000000000..4d024b063ab544
--- /dev/null
+++ b/target/linux/generic/backport-6.1/790-v6.4-0001-net-dsa-mt7530-make-some-noise-if-register-read-fail.patch
@@ -0,0 +1,32 @@
+From c3552d3f85f06cf4b4818bd84c4fcc09d8d45165 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:17:19 +0100
+Subject: [PATCH 01/13] net: dsa: mt7530: make some noise if register read
+ fails
+
+Simply returning the negative error value instead of the read value
+doesn't seem like a good idea. Return 0 instead and add WARN_ON_ONCE(1)
+so this kind of error will not go unnoticed.
+
+Suggested-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/mt7530.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -224,9 +224,10 @@ mt7530_mii_read(struct mt7530_priv *priv
+ 	/* MT7530 uses 31 as the pseudo port */
+ 	ret = bus->write(bus, 0x1f, 0x1f, page);
+ 	if (ret < 0) {
++		WARN_ON_ONCE(1);
+ 		dev_err(&bus->dev,
+ 			"failed to read mt7530 register\n");
+-		return ret;
++		return 0;
+ 	}
+ 
+ 	lo = bus->read(bus, 0x1f, r);
diff --git a/target/linux/generic/backport-6.1/790-v6.4-0002-net-dsa-mt7530-refactor-SGMII-PCS-creation.patch b/target/linux/generic/backport-6.1/790-v6.4-0002-net-dsa-mt7530-refactor-SGMII-PCS-creation.patch
new file mode 100644
index 00000000000000..4f255abc5bc92f
--- /dev/null
+++ b/target/linux/generic/backport-6.1/790-v6.4-0002-net-dsa-mt7530-refactor-SGMII-PCS-creation.patch
@@ -0,0 +1,111 @@
+From b896355fc4988216d4f38582d07add9252a795ae Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:17:30 +0100
+Subject: [PATCH 02/13] net: dsa: mt7530: refactor SGMII PCS creation
+
+Instead of macro templates use a dedidated function and allocated
+regmap_config when creating the regmaps for the pcs-mtk-lynxi
+instances.
+This is in preparation to switching to use unlocked regmap accessors
+and have regmap's locking API handle locking for us.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/mt7530.c | 74 +++++++++++++++++++++++++++-------------
+ 1 file changed, 50 insertions(+), 24 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -2950,26 +2950,56 @@ static const struct regmap_bus mt7531_re
+ 	.reg_update_bits = mt7530_regmap_update_bits,
+ };
+ 
+-#define MT7531_PCS_REGMAP_CONFIG(_name, _reg_base) \
+-	{				\
+-		.name = _name,		\
+-		.reg_bits = 16,		\
+-		.val_bits = 32,		\
+-		.reg_stride = 4,	\
+-		.reg_base = _reg_base,	\
+-		.max_register = 0x17c,	\
++static int
++mt7531_create_sgmii(struct mt7530_priv *priv)
++{
++	struct regmap_config *mt7531_pcs_config[2];
++	struct phylink_pcs *pcs;
++	struct regmap *regmap;
++	int i, ret = 0;
++
++	for (i = 0; i < 2; i++) {
++		mt7531_pcs_config[i] = devm_kzalloc(priv->dev,
++						    sizeof(struct regmap_config),
++						    GFP_KERNEL);
++		if (!mt7531_pcs_config[i]) {
++			ret = -ENOMEM;
++			break;
++		}
++
++		mt7531_pcs_config[i]->name = i ? "port6" : "port5";
++		mt7531_pcs_config[i]->reg_bits = 16;
++		mt7531_pcs_config[i]->val_bits = 32;
++		mt7531_pcs_config[i]->reg_stride = 4;
++		mt7531_pcs_config[i]->reg_base = MT7531_SGMII_REG_BASE(5 + i);
++		mt7531_pcs_config[i]->max_register = 0x17c;
++
++		regmap = devm_regmap_init(priv->dev,
++					  &mt7531_regmap_bus, priv,
++					  mt7531_pcs_config[i]);
++		if (IS_ERR(regmap)) {
++			ret = PTR_ERR(regmap);
++			break;
++		}
++		pcs = mtk_pcs_lynxi_create(priv->dev, regmap,
++					   MT7531_PHYA_CTRL_SIGNAL3, 0);
++		if (!pcs) {
++			ret = -ENXIO;
++			break;
++		}
++		priv->ports[5 + i].sgmii_pcs = pcs;
+ 	}
+ 
+-static const struct regmap_config mt7531_pcs_config[] = {
+-	MT7531_PCS_REGMAP_CONFIG("port5", MT7531_SGMII_REG_BASE(5)),
+-	MT7531_PCS_REGMAP_CONFIG("port6", MT7531_SGMII_REG_BASE(6)),
+-};
++	if (ret && i)
++		mtk_pcs_lynxi_destroy(priv->ports[5].sgmii_pcs);
++
++	return ret;
++}
+ 
+ static int
+ mt753x_setup(struct dsa_switch *ds)
+ {
+ 	struct mt7530_priv *priv = ds->priv;
+-	struct regmap *regmap;
+ 	int i, ret;
+ 
+ 	/* Initialise the PCS devices */
+@@ -2991,15 +3021,11 @@ mt753x_setup(struct dsa_switch *ds)
+ 	if (ret && priv->irq)
+ 		mt7530_free_irq_common(priv);
+ 
+-	if (priv->id == ID_MT7531)
+-		for (i = 0; i < 2; i++) {
+-			regmap = devm_regmap_init(ds->dev,
+-						  &mt7531_regmap_bus, priv,
+-						  &mt7531_pcs_config[i]);
+-			priv->ports[5 + i].sgmii_pcs =
+-				mtk_pcs_lynxi_create(ds->dev, regmap,
+-						     MT7531_PHYA_CTRL_SIGNAL3, 0);
+-		}
++	if (priv->id == ID_MT7531) {
++		ret = mt7531_create_sgmii(priv);
++		if (ret && priv->irq)
++			mt7530_free_irq_common(priv);
++	}
+ 
+ 	return ret;
+ }
diff --git a/target/linux/generic/backport-6.1/790-v6.4-0003-net-dsa-mt7530-use-unlocked-regmap-accessors.patch b/target/linux/generic/backport-6.1/790-v6.4-0003-net-dsa-mt7530-use-unlocked-regmap-accessors.patch
new file mode 100644
index 00000000000000..77ac3f3f26858f
--- /dev/null
+++ b/target/linux/generic/backport-6.1/790-v6.4-0003-net-dsa-mt7530-use-unlocked-regmap-accessors.patch
@@ -0,0 +1,74 @@
+From 33396408776385f3d2f6069646169a6b5b28e3b3 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:17:40 +0100
+Subject: [PATCH 03/13] net: dsa: mt7530: use unlocked regmap accessors
+
+Instead of wrapping the locked register accessor functions, use the
+unlocked variants and add locking wrapper functions to let regmap
+handle the locking.
+
+This is a preparation towards being able to always use regmap to
+access switch registers instead of open-coded accessor functions.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/mt7530.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -2923,7 +2923,7 @@ static int mt7530_regmap_read(void *cont
+ {
+ 	struct mt7530_priv *priv = context;
+ 
+-	*val = mt7530_read(priv, reg);
++	*val = mt7530_mii_read(priv, reg);
+ 	return 0;
+ };
+ 
+@@ -2931,23 +2931,25 @@ static int mt7530_regmap_write(void *con
+ {
+ 	struct mt7530_priv *priv = context;
+ 
+-	mt7530_write(priv, reg, val);
++	mt7530_mii_write(priv, reg, val);
+ 	return 0;
+ };
+ 
+-static int mt7530_regmap_update_bits(void *context, unsigned int reg,
+-				     unsigned int mask, unsigned int val)
++static void
++mt7530_mdio_regmap_lock(void *mdio_lock)
+ {
+-	struct mt7530_priv *priv = context;
++	mutex_lock_nested(mdio_lock, MDIO_MUTEX_NESTED);
++}
+ 
+-	mt7530_rmw(priv, reg, mask, val);
+-	return 0;
+-};
++static void
++mt7530_mdio_regmap_unlock(void *mdio_lock)
++{
++	mutex_unlock(mdio_lock);
++}
+ 
+ static const struct regmap_bus mt7531_regmap_bus = {
+ 	.reg_write = mt7530_regmap_write,
+ 	.reg_read = mt7530_regmap_read,
+-	.reg_update_bits = mt7530_regmap_update_bits,
+ };
+ 
+ static int
+@@ -2973,6 +2975,9 @@ mt7531_create_sgmii(struct mt7530_priv *
+ 		mt7531_pcs_config[i]->reg_stride = 4;
+ 		mt7531_pcs_config[i]->reg_base = MT7531_SGMII_REG_BASE(5 + i);
+ 		mt7531_pcs_config[i]->max_register = 0x17c;
++		mt7531_pcs_config[i]->lock = mt7530_mdio_regmap_lock;
++		mt7531_pcs_config[i]->unlock = mt7530_mdio_regmap_unlock;
++		mt7531_pcs_config[i]->lock_arg = &priv->bus->mdio_lock;
+ 
+ 		regmap = devm_regmap_init(priv->dev,
+ 					  &mt7531_regmap_bus, priv,
diff --git a/target/linux/generic/backport-6.1/790-v6.4-0004-net-dsa-mt7530-use-regmap-to-access-switch-register-.patch b/target/linux/generic/backport-6.1/790-v6.4-0004-net-dsa-mt7530-use-regmap-to-access-switch-register-.patch
new file mode 100644
index 00000000000000..6e3e8b09b964aa
--- /dev/null
+++ b/target/linux/generic/backport-6.1/790-v6.4-0004-net-dsa-mt7530-use-regmap-to-access-switch-register-.patch
@@ -0,0 +1,224 @@
+From 743cba4345cb366248f9d375c6a9e50243dc0677 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:17:52 +0100
+Subject: [PATCH 04/13] net: dsa: mt7530: use regmap to access switch register
+ space
+
+Use regmap API to access the switch register space.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/mt7530.c | 99 ++++++++++++++++++++++++----------------
+ drivers/net/dsa/mt7530.h |  2 +
+ 2 files changed, 62 insertions(+), 39 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -183,9 +183,9 @@ core_clear(struct mt7530_priv *priv, u32
+ }
+ 
+ static int
+-mt7530_mii_write(struct mt7530_priv *priv, u32 reg, u32 val)
++mt7530_regmap_write(void *context, unsigned int reg, unsigned int val)
+ {
+-	struct mii_bus *bus = priv->bus;
++	struct mii_bus *bus = context;
+ 	u16 page, r, lo, hi;
+ 	int ret;
+ 
+@@ -197,24 +197,34 @@ mt7530_mii_write(struct mt7530_priv *pri
+ 	/* MT7530 uses 31 as the pseudo port */
+ 	ret = bus->write(bus, 0x1f, 0x1f, page);
+ 	if (ret < 0)
+-		goto err;
++		return ret;
+ 
+ 	ret = bus->write(bus, 0x1f, r,  lo);
+ 	if (ret < 0)
+-		goto err;
++		return ret;
+ 
+ 	ret = bus->write(bus, 0x1f, 0x10, hi);
+-err:
++	return ret;
++}
++
++static int
++mt7530_mii_write(struct mt7530_priv *priv, u32 reg, u32 val)
++{
++	int ret;
++
++	ret = regmap_write(priv->regmap, reg, val);
++
+ 	if (ret < 0)
+-		dev_err(&bus->dev,
++		dev_err(priv->dev,
+ 			"failed to write mt7530 register\n");
++
+ 	return ret;
+ }
+ 
+-static u32
+-mt7530_mii_read(struct mt7530_priv *priv, u32 reg)
++static int
++mt7530_regmap_read(void *context, unsigned int reg, unsigned int *val)
+ {
+-	struct mii_bus *bus = priv->bus;
++	struct mii_bus *bus = context;
+ 	u16 page, r, lo, hi;
+ 	int ret;
+ 
+@@ -223,17 +233,32 @@ mt7530_mii_read(struct mt7530_priv *priv
+ 
+ 	/* MT7530 uses 31 as the pseudo port */
+ 	ret = bus->write(bus, 0x1f, 0x1f, page);
+-	if (ret < 0) {
++	if (ret < 0)
++		return ret;
++
++	lo = bus->read(bus, 0x1f, r);
++	hi = bus->read(bus, 0x1f, 0x10);
++
++	*val = (hi << 16) | (lo & 0xffff);
++
++	return 0;
++}
++
++static u32
++mt7530_mii_read(struct mt7530_priv *priv, u32 reg)
++{
++	int ret;
++	u32 val;
++
++	ret = regmap_read(priv->regmap, reg, &val);
++	if (ret) {
+ 		WARN_ON_ONCE(1);
+-		dev_err(&bus->dev,
++		dev_err(priv->dev,
+ 			"failed to read mt7530 register\n");
+ 		return 0;
+ 	}
+ 
+-	lo = bus->read(bus, 0x1f, r);
+-	hi = bus->read(bus, 0x1f, 0x10);
+-
+-	return (hi << 16) | (lo & 0xffff);
++	return val;
+ }
+ 
+ static void
+@@ -283,14 +308,10 @@ mt7530_rmw(struct mt7530_priv *priv, u32
+ 	   u32 mask, u32 set)
+ {
+ 	struct mii_bus *bus = priv->bus;
+-	u32 val;
+ 
+ 	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+ 
+-	val = mt7530_mii_read(priv, reg);
+-	val &= ~mask;
+-	val |= set;
+-	mt7530_mii_write(priv, reg, val);
++	regmap_update_bits(priv->regmap, reg, mask, set);
+ 
+ 	mutex_unlock(&bus->mdio_lock);
+ }
+@@ -298,7 +319,7 @@ mt7530_rmw(struct mt7530_priv *priv, u32
+ static void
+ mt7530_set(struct mt7530_priv *priv, u32 reg, u32 val)
+ {
+-	mt7530_rmw(priv, reg, 0, val);
++	mt7530_rmw(priv, reg, val, val);
+ }
+ 
+ static void
+@@ -2919,22 +2940,6 @@ static const struct phylink_pcs_ops mt75
+ 	.pcs_an_restart = mt7530_pcs_an_restart,
+ };
+ 
+-static int mt7530_regmap_read(void *context, unsigned int reg, unsigned int *val)
+-{
+-	struct mt7530_priv *priv = context;
+-
+-	*val = mt7530_mii_read(priv, reg);
+-	return 0;
+-};
+-
+-static int mt7530_regmap_write(void *context, unsigned int reg, unsigned int val)
+-{
+-	struct mt7530_priv *priv = context;
+-
+-	mt7530_mii_write(priv, reg, val);
+-	return 0;
+-};
+-
+ static void
+ mt7530_mdio_regmap_lock(void *mdio_lock)
+ {
+@@ -2947,7 +2952,7 @@ mt7530_mdio_regmap_unlock(void *mdio_loc
+ 	mutex_unlock(mdio_lock);
+ }
+ 
+-static const struct regmap_bus mt7531_regmap_bus = {
++static const struct regmap_bus mt7530_regmap_bus = {
+ 	.reg_write = mt7530_regmap_write,
+ 	.reg_read = mt7530_regmap_read,
+ };
+@@ -2980,7 +2985,7 @@ mt7531_create_sgmii(struct mt7530_priv *
+ 		mt7531_pcs_config[i]->lock_arg = &priv->bus->mdio_lock;
+ 
+ 		regmap = devm_regmap_init(priv->dev,
+-					  &mt7531_regmap_bus, priv,
++					  &mt7530_regmap_bus, priv->bus,
+ 					  mt7531_pcs_config[i]);
+ 		if (IS_ERR(regmap)) {
+ 			ret = PTR_ERR(regmap);
+@@ -3145,6 +3150,7 @@ MODULE_DEVICE_TABLE(of, mt7530_of_match)
+ static int
+ mt7530_probe(struct mdio_device *mdiodev)
+ {
++	static struct regmap_config *regmap_config;
+ 	struct mt7530_priv *priv;
+ 	struct device_node *dn;
+ 
+@@ -3224,6 +3230,21 @@ mt7530_probe(struct mdio_device *mdiodev
+ 	mutex_init(&priv->reg_mutex);
+ 	dev_set_drvdata(&mdiodev->dev, priv);
+ 
++	regmap_config = devm_kzalloc(&mdiodev->dev, sizeof(*regmap_config),
++				     GFP_KERNEL);
++	if (!regmap_config)
++		return -ENOMEM;
++
++	regmap_config->reg_bits = 16;
++	regmap_config->val_bits = 32;
++	regmap_config->reg_stride = 4;
++	regmap_config->max_register = MT7530_CREV;
++	regmap_config->disable_locking = true;
++	priv->regmap = devm_regmap_init(priv->dev, &mt7530_regmap_bus,
++					priv->bus, regmap_config);
++	if (IS_ERR(priv->regmap))
++		return PTR_ERR(priv->regmap);
++
+ 	return dsa_register_switch(priv->ds);
+ }
+ 
+--- a/drivers/net/dsa/mt7530.h
++++ b/drivers/net/dsa/mt7530.h
+@@ -747,6 +747,7 @@ struct mt753x_info {
+  * @dev:		The device pointer
+  * @ds:			The pointer to the dsa core structure
+  * @bus:		The bus used for the device and built-in PHY
++ * @regmap:		The regmap instance representing all switch registers
+  * @rstc:		The pointer to reset control used by MCM
+  * @core_pwr:		The power supplied into the core
+  * @io_pwr:		The power supplied into the I/O
+@@ -767,6 +768,7 @@ struct mt7530_priv {
+ 	struct device		*dev;
+ 	struct dsa_switch	*ds;
+ 	struct mii_bus		*bus;
++	struct regmap		*regmap;
+ 	struct reset_control	*rstc;
+ 	struct regulator	*core_pwr;
+ 	struct regulator	*io_pwr;
diff --git a/target/linux/generic/backport-6.1/790-v6.4-0005-net-dsa-mt7530-move-SGMII-PCS-creation-to-mt7530_pro.patch b/target/linux/generic/backport-6.1/790-v6.4-0005-net-dsa-mt7530-move-SGMII-PCS-creation-to-mt7530_pro.patch
new file mode 100644
index 00000000000000..a02702fd687b93
--- /dev/null
+++ b/target/linux/generic/backport-6.1/790-v6.4-0005-net-dsa-mt7530-move-SGMII-PCS-creation-to-mt7530_pro.patch
@@ -0,0 +1,54 @@
+From f3cf1d06e2aef644b426c23b4bb570780b1f8d47 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:18:04 +0100
+Subject: [PATCH 05/13] net: dsa: mt7530: move SGMII PCS creation to
+ mt7530_probe function
+
+Move creating the SGMII PCS from mt753x_setup() to the more appropriate
+mt7530_probe() function.
+This is done also in preparation of moving all functions related to
+MDIO-connected MT753x switches to a separate module.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/mt7530.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -3031,12 +3031,6 @@ mt753x_setup(struct dsa_switch *ds)
+ 	if (ret && priv->irq)
+ 		mt7530_free_irq_common(priv);
+ 
+-	if (priv->id == ID_MT7531) {
+-		ret = mt7531_create_sgmii(priv);
+-		if (ret && priv->irq)
+-			mt7530_free_irq_common(priv);
+-	}
+-
+ 	return ret;
+ }
+ 
+@@ -3153,6 +3147,7 @@ mt7530_probe(struct mdio_device *mdiodev
+ 	static struct regmap_config *regmap_config;
+ 	struct mt7530_priv *priv;
+ 	struct device_node *dn;
++	int ret;
+ 
+ 	dn = mdiodev->dev.of_node;
+ 
+@@ -3245,6 +3240,12 @@ mt7530_probe(struct mdio_device *mdiodev
+ 	if (IS_ERR(priv->regmap))
+ 		return PTR_ERR(priv->regmap);
+ 
++	if (priv->id == ID_MT7531) {
++		ret = mt7531_create_sgmii(priv);
++		if (ret)
++			return ret;
++	}
++
+ 	return dsa_register_switch(priv->ds);
+ }
+ 
diff --git a/target/linux/generic/backport-6.1/790-v6.4-0006-net-dsa-mt7530-introduce-mutex-helpers.patch b/target/linux/generic/backport-6.1/790-v6.4-0006-net-dsa-mt7530-introduce-mutex-helpers.patch
new file mode 100644
index 00000000000000..98122caf0904b4
--- /dev/null
+++ b/target/linux/generic/backport-6.1/790-v6.4-0006-net-dsa-mt7530-introduce-mutex-helpers.patch
@@ -0,0 +1,273 @@
+From e4729ae7c095c0c87794bff47ea43e35d69de986 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:18:16 +0100
+Subject: [PATCH 06/13] net: dsa: mt7530: introduce mutex helpers
+
+As the MDIO bus lock only needs to be involved if actually operating
+on an MDIO-connected switch we will need to skip locking for built-in
+switches which are accessed via MMIO.
+Create helper functions which simplify that upcoming change.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/mt7530.c | 73 ++++++++++++++++++++--------------------
+ 1 file changed, 36 insertions(+), 37 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -143,31 +143,40 @@ err:
+ }
+ 
+ static void
+-core_write(struct mt7530_priv *priv, u32 reg, u32 val)
++mt7530_mutex_lock(struct mt7530_priv *priv)
+ {
+-	struct mii_bus *bus = priv->bus;
++	mutex_lock_nested(&priv->bus->mdio_lock, MDIO_MUTEX_NESTED);
++}
+ 
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++static void
++mt7530_mutex_unlock(struct mt7530_priv *priv)
++{
++	mutex_unlock(&priv->bus->mdio_lock);
++}
++
++static void
++core_write(struct mt7530_priv *priv, u32 reg, u32 val)
++{
++	mt7530_mutex_lock(priv);
+ 
+ 	core_write_mmd_indirect(priv, reg, MDIO_MMD_VEND2, val);
+ 
+-	mutex_unlock(&bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ }
+ 
+ static void
+ core_rmw(struct mt7530_priv *priv, u32 reg, u32 mask, u32 set)
+ {
+-	struct mii_bus *bus = priv->bus;
+ 	u32 val;
+ 
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(priv);
+ 
+ 	val = core_read_mmd_indirect(priv, reg, MDIO_MMD_VEND2);
+ 	val &= ~mask;
+ 	val |= set;
+ 	core_write_mmd_indirect(priv, reg, MDIO_MMD_VEND2, val);
+ 
+-	mutex_unlock(&bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ }
+ 
+ static void
+@@ -264,13 +273,11 @@ mt7530_mii_read(struct mt7530_priv *priv
+ static void
+ mt7530_write(struct mt7530_priv *priv, u32 reg, u32 val)
+ {
+-	struct mii_bus *bus = priv->bus;
+-
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(priv);
+ 
+ 	mt7530_mii_write(priv, reg, val);
+ 
+-	mutex_unlock(&bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ }
+ 
+ static u32
+@@ -282,14 +289,13 @@ _mt7530_unlocked_read(struct mt7530_dumm
+ static u32
+ _mt7530_read(struct mt7530_dummy_poll *p)
+ {
+-	struct mii_bus		*bus = p->priv->bus;
+ 	u32 val;
+ 
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(p->priv);
+ 
+ 	val = mt7530_mii_read(p->priv, p->reg);
+ 
+-	mutex_unlock(&bus->mdio_lock);
++	mt7530_mutex_unlock(p->priv);
+ 
+ 	return val;
+ }
+@@ -307,13 +313,11 @@ static void
+ mt7530_rmw(struct mt7530_priv *priv, u32 reg,
+ 	   u32 mask, u32 set)
+ {
+-	struct mii_bus *bus = priv->bus;
+-
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(priv);
+ 
+ 	regmap_update_bits(priv->regmap, reg, mask, set);
+ 
+-	mutex_unlock(&bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ }
+ 
+ static void
+@@ -645,14 +649,13 @@ static int
+ mt7531_ind_c45_phy_read(struct mt7530_priv *priv, int port, int devad,
+ 			int regnum)
+ {
+-	struct mii_bus *bus = priv->bus;
+ 	struct mt7530_dummy_poll p;
+ 	u32 reg, val;
+ 	int ret;
+ 
+ 	INIT_MT7530_DUMMY_POLL(&p, priv, MT7531_PHY_IAC);
+ 
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(priv);
+ 
+ 	ret = readx_poll_timeout(_mt7530_unlocked_read, &p, val,
+ 				 !(val & MT7531_PHY_ACS_ST), 20, 100000);
+@@ -685,7 +688,7 @@ mt7531_ind_c45_phy_read(struct mt7530_pr
+ 
+ 	ret = val & MT7531_MDIO_RW_DATA_MASK;
+ out:
+-	mutex_unlock(&bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ 
+ 	return ret;
+ }
+@@ -694,14 +697,13 @@ static int
+ mt7531_ind_c45_phy_write(struct mt7530_priv *priv, int port, int devad,
+ 			 int regnum, u32 data)
+ {
+-	struct mii_bus *bus = priv->bus;
+ 	struct mt7530_dummy_poll p;
+ 	u32 val, reg;
+ 	int ret;
+ 
+ 	INIT_MT7530_DUMMY_POLL(&p, priv, MT7531_PHY_IAC);
+ 
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(priv);
+ 
+ 	ret = readx_poll_timeout(_mt7530_unlocked_read, &p, val,
+ 				 !(val & MT7531_PHY_ACS_ST), 20, 100000);
+@@ -733,7 +735,7 @@ mt7531_ind_c45_phy_write(struct mt7530_p
+ 	}
+ 
+ out:
+-	mutex_unlock(&bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ 
+ 	return ret;
+ }
+@@ -741,14 +743,13 @@ out:
+ static int
+ mt7531_ind_c22_phy_read(struct mt7530_priv *priv, int port, int regnum)
+ {
+-	struct mii_bus *bus = priv->bus;
+ 	struct mt7530_dummy_poll p;
+ 	int ret;
+ 	u32 val;
+ 
+ 	INIT_MT7530_DUMMY_POLL(&p, priv, MT7531_PHY_IAC);
+ 
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(priv);
+ 
+ 	ret = readx_poll_timeout(_mt7530_unlocked_read, &p, val,
+ 				 !(val & MT7531_PHY_ACS_ST), 20, 100000);
+@@ -771,7 +772,7 @@ mt7531_ind_c22_phy_read(struct mt7530_pr
+ 
+ 	ret = val & MT7531_MDIO_RW_DATA_MASK;
+ out:
+-	mutex_unlock(&bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ 
+ 	return ret;
+ }
+@@ -780,14 +781,13 @@ static int
+ mt7531_ind_c22_phy_write(struct mt7530_priv *priv, int port, int regnum,
+ 			 u16 data)
+ {
+-	struct mii_bus *bus = priv->bus;
+ 	struct mt7530_dummy_poll p;
+ 	int ret;
+ 	u32 reg;
+ 
+ 	INIT_MT7530_DUMMY_POLL(&p, priv, MT7531_PHY_IAC);
+ 
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(priv);
+ 
+ 	ret = readx_poll_timeout(_mt7530_unlocked_read, &p, reg,
+ 				 !(reg & MT7531_PHY_ACS_ST), 20, 100000);
+@@ -809,7 +809,7 @@ mt7531_ind_c22_phy_write(struct mt7530_p
+ 	}
+ 
+ out:
+-	mutex_unlock(&bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ 
+ 	return ret;
+ }
+@@ -1109,7 +1109,6 @@ static int
+ mt7530_port_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
+ {
+ 	struct mt7530_priv *priv = ds->priv;
+-	struct mii_bus *bus = priv->bus;
+ 	int length;
+ 	u32 val;
+ 
+@@ -1120,7 +1119,7 @@ mt7530_port_change_mtu(struct dsa_switch
+ 	if (!dsa_is_cpu_port(ds, port))
+ 		return 0;
+ 
+-	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(priv);
+ 
+ 	val = mt7530_mii_read(priv, MT7530_GMACCR);
+ 	val &= ~MAX_RX_PKT_LEN_MASK;
+@@ -1141,7 +1140,7 @@ mt7530_port_change_mtu(struct dsa_switch
+ 
+ 	mt7530_mii_write(priv, MT7530_GMACCR, val);
+ 
+-	mutex_unlock(&bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ 
+ 	return 0;
+ }
+@@ -1942,10 +1941,10 @@ mt7530_irq_thread_fn(int irq, void *dev_
+ 	u32 val;
+ 	int p;
+ 
+-	mutex_lock_nested(&priv->bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(priv);
+ 	val = mt7530_mii_read(priv, MT7530_SYS_INT_STS);
+ 	mt7530_mii_write(priv, MT7530_SYS_INT_STS, val);
+-	mutex_unlock(&priv->bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ 
+ 	for (p = 0; p < MT7530_NUM_PHYS; p++) {
+ 		if (BIT(p) & val) {
+@@ -1981,7 +1980,7 @@ mt7530_irq_bus_lock(struct irq_data *d)
+ {
+ 	struct mt7530_priv *priv = irq_data_get_irq_chip_data(d);
+ 
+-	mutex_lock_nested(&priv->bus->mdio_lock, MDIO_MUTEX_NESTED);
++	mt7530_mutex_lock(priv);
+ }
+ 
+ static void
+@@ -1990,7 +1989,7 @@ mt7530_irq_bus_sync_unlock(struct irq_da
+ 	struct mt7530_priv *priv = irq_data_get_irq_chip_data(d);
+ 
+ 	mt7530_mii_write(priv, MT7530_SYS_INT_EN, priv->irq_enable);
+-	mutex_unlock(&priv->bus->mdio_lock);
++	mt7530_mutex_unlock(priv);
+ }
+ 
+ static struct irq_chip mt7530_irq_chip = {
diff --git a/target/linux/generic/backport-6.1/790-v6.4-0007-net-dsa-mt7530-move-p5_intf_modes-function-to-mt7530.patch b/target/linux/generic/backport-6.1/790-v6.4-0007-net-dsa-mt7530-move-p5_intf_modes-function-to-mt7530.patch
new file mode 100644
index 00000000000000..5065d7352326e2
--- /dev/null
+++ b/target/linux/generic/backport-6.1/790-v6.4-0007-net-dsa-mt7530-move-p5_intf_modes-function-to-mt7530.patch
@@ -0,0 +1,75 @@
+From 0d7ae94a0c581f86939bebec0b6ccd66e640d1d8 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:18:28 +0100
+Subject: [PATCH 07/13] net: dsa: mt7530: move p5_intf_modes() function to
+ mt7530.c
+
+In preparation of splitting mt7530.c into a driver for MDIO-connected
+as well as MDIO-accessed built-in switches on one hand and MMIO-accessed
+built-in switches move the p5_inft_modes() function from mt7530.h to
+mt7530.c. The function is only needed there and will trigger a compiler
+warning about a defined but unused function otherwise when including
+mt7530.h in the to-be-introduced bus-specific drivers.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/mt7530.c | 18 ++++++++++++++++++
+ drivers/net/dsa/mt7530.h | 18 ------------------
+ 2 files changed, 18 insertions(+), 18 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -950,6 +950,24 @@ mt7530_set_ageing_time(struct dsa_switch
+ 	return 0;
+ }
+ 
++static const char *p5_intf_modes(unsigned int p5_interface)
++{
++	switch (p5_interface) {
++	case P5_DISABLED:
++		return "DISABLED";
++	case P5_INTF_SEL_PHY_P0:
++		return "PHY P0";
++	case P5_INTF_SEL_PHY_P4:
++		return "PHY P4";
++	case P5_INTF_SEL_GMAC5:
++		return "GMAC5";
++	case P5_INTF_SEL_GMAC5_SGMII:
++		return "GMAC5_SGMII";
++	default:
++		return "unknown";
++	}
++}
++
+ static void mt7530_setup_port5(struct dsa_switch *ds, phy_interface_t interface)
+ {
+ 	struct mt7530_priv *priv = ds->priv;
+--- a/drivers/net/dsa/mt7530.h
++++ b/drivers/net/dsa/mt7530.h
+@@ -682,24 +682,6 @@ enum p5_interface_select {
+ 	P5_INTF_SEL_GMAC5_SGMII,
+ };
+ 
+-static const char *p5_intf_modes(unsigned int p5_interface)
+-{
+-	switch (p5_interface) {
+-	case P5_DISABLED:
+-		return "DISABLED";
+-	case P5_INTF_SEL_PHY_P0:
+-		return "PHY P0";
+-	case P5_INTF_SEL_PHY_P4:
+-		return "PHY P4";
+-	case P5_INTF_SEL_GMAC5:
+-		return "GMAC5";
+-	case P5_INTF_SEL_GMAC5_SGMII:
+-		return "GMAC5_SGMII";
+-	default:
+-		return "unknown";
+-	}
+-}
+-
+ struct mt7530_priv;
+ 
+ struct mt753x_pcs {
diff --git a/target/linux/generic/backport-6.1/790-v6.4-0008-net-dsa-mt7530-introduce-mt7530_probe_common-helper-.patch b/target/linux/generic/backport-6.1/790-v6.4-0008-net-dsa-mt7530-introduce-mt7530_probe_common-helper-.patch
new file mode 100644
index 00000000000000..761aa1d9797bbb
--- /dev/null
+++ b/target/linux/generic/backport-6.1/790-v6.4-0008-net-dsa-mt7530-introduce-mt7530_probe_common-helper-.patch
@@ -0,0 +1,155 @@
+From 4d632005c90e253c000d0db73b7cdb9d8dc2e2dd Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:18:39 +0100
+Subject: [PATCH 08/13] net: dsa: mt7530: introduce mt7530_probe_common helper
+ function
+
+Move commonly used parts from mt7530_probe into new mt7530_probe_common
+helper function which will be used by both, mt7530_probe and the
+to-be-introduced mt7988_probe.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/mt7530.c | 98 ++++++++++++++++++++++------------------
+ 1 file changed, 54 insertions(+), 44 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -3159,44 +3159,21 @@ static const struct of_device_id mt7530_
+ MODULE_DEVICE_TABLE(of, mt7530_of_match);
+ 
+ static int
+-mt7530_probe(struct mdio_device *mdiodev)
++mt7530_probe_common(struct mt7530_priv *priv)
+ {
+-	static struct regmap_config *regmap_config;
+-	struct mt7530_priv *priv;
+-	struct device_node *dn;
+-	int ret;
++	struct device *dev = priv->dev;
+ 
+-	dn = mdiodev->dev.of_node;
+-
+-	priv = devm_kzalloc(&mdiodev->dev, sizeof(*priv), GFP_KERNEL);
+-	if (!priv)
+-		return -ENOMEM;
+-
+-	priv->ds = devm_kzalloc(&mdiodev->dev, sizeof(*priv->ds), GFP_KERNEL);
++	priv->ds = devm_kzalloc(dev, sizeof(*priv->ds), GFP_KERNEL);
+ 	if (!priv->ds)
+ 		return -ENOMEM;
+ 
+-	priv->ds->dev = &mdiodev->dev;
++	priv->ds->dev = dev;
+ 	priv->ds->num_ports = MT7530_NUM_PORTS;
+ 
+-	/* Use medatek,mcm property to distinguish hardware type that would
+-	 * casues a little bit differences on power-on sequence.
+-	 */
+-	priv->mcm = of_property_read_bool(dn, "mediatek,mcm");
+-	if (priv->mcm) {
+-		dev_info(&mdiodev->dev, "MT7530 adapts as multi-chip module\n");
+-
+-		priv->rstc = devm_reset_control_get(&mdiodev->dev, "mcm");
+-		if (IS_ERR(priv->rstc)) {
+-			dev_err(&mdiodev->dev, "Couldn't get our reset line\n");
+-			return PTR_ERR(priv->rstc);
+-		}
+-	}
+-
+ 	/* Get the hardware identifier from the devicetree node.
+ 	 * We will need it for some of the clock and regulator setup.
+ 	 */
+-	priv->info = of_device_get_match_data(&mdiodev->dev);
++	priv->info = of_device_get_match_data(dev);
+ 	if (!priv->info)
+ 		return -EINVAL;
+ 
+@@ -3210,23 +3187,53 @@ mt7530_probe(struct mdio_device *mdiodev
+ 		return -EINVAL;
+ 
+ 	priv->id = priv->info->id;
++	priv->dev = dev;
++	priv->ds->priv = priv;
++	priv->ds->ops = &mt7530_switch_ops;
++	mutex_init(&priv->reg_mutex);
++	dev_set_drvdata(dev, priv);
+ 
+-	if (priv->id == ID_MT7530) {
+-		priv->core_pwr = devm_regulator_get(&mdiodev->dev, "core");
+-		if (IS_ERR(priv->core_pwr))
+-			return PTR_ERR(priv->core_pwr);
++	return 0;
++}
+ 
+-		priv->io_pwr = devm_regulator_get(&mdiodev->dev, "io");
+-		if (IS_ERR(priv->io_pwr))
+-			return PTR_ERR(priv->io_pwr);
+-	}
++static int
++mt7530_probe(struct mdio_device *mdiodev)
++{
++	static struct regmap_config *regmap_config;
++	struct mt7530_priv *priv;
++	struct device_node *dn;
++	int ret;
++
++	dn = mdiodev->dev.of_node;
++
++	priv = devm_kzalloc(&mdiodev->dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
+ 
+-	/* Not MCM that indicates switch works as the remote standalone
++	priv->bus = mdiodev->bus;
++	priv->dev = &mdiodev->dev;
++
++	ret = mt7530_probe_common(priv);
++	if (ret)
++		return ret;
++
++	/* Use medatek,mcm property to distinguish hardware type that would
++	 * cause a little bit differences on power-on sequence.
++	 * Not MCM that indicates switch works as the remote standalone
+ 	 * integrated circuit so the GPIO pin would be used to complete
+ 	 * the reset, otherwise memory-mapped register accessing used
+ 	 * through syscon provides in the case of MCM.
+ 	 */
+-	if (!priv->mcm) {
++	priv->mcm = of_property_read_bool(dn, "mediatek,mcm");
++	if (priv->mcm) {
++		dev_info(&mdiodev->dev, "MT7530 adapts as multi-chip module\n");
++
++		priv->rstc = devm_reset_control_get(&mdiodev->dev, "mcm");
++		if (IS_ERR(priv->rstc)) {
++			dev_err(&mdiodev->dev, "Couldn't get our reset line\n");
++			return PTR_ERR(priv->rstc);
++		}
++	} else {
+ 		priv->reset = devm_gpiod_get_optional(&mdiodev->dev, "reset",
+ 						      GPIOD_OUT_LOW);
+ 		if (IS_ERR(priv->reset)) {
+@@ -3235,12 +3242,15 @@ mt7530_probe(struct mdio_device *mdiodev
+ 		}
+ 	}
+ 
+-	priv->bus = mdiodev->bus;
+-	priv->dev = &mdiodev->dev;
+-	priv->ds->priv = priv;
+-	priv->ds->ops = &mt7530_switch_ops;
+-	mutex_init(&priv->reg_mutex);
+-	dev_set_drvdata(&mdiodev->dev, priv);
++	if (priv->id == ID_MT7530) {
++		priv->core_pwr = devm_regulator_get(&mdiodev->dev, "core");
++		if (IS_ERR(priv->core_pwr))
++			return PTR_ERR(priv->core_pwr);
++
++		priv->io_pwr = devm_regulator_get(&mdiodev->dev, "io");
++		if (IS_ERR(priv->io_pwr))
++			return PTR_ERR(priv->io_pwr);
++	}
+ 
+ 	regmap_config = devm_kzalloc(&mdiodev->dev, sizeof(*regmap_config),
+ 				     GFP_KERNEL);
diff --git a/target/linux/generic/backport-6.1/790-v6.4-0009-net-dsa-mt7530-introduce-mt7530_remove_common-helper.patch b/target/linux/generic/backport-6.1/790-v6.4-0009-net-dsa-mt7530-introduce-mt7530_remove_common-helper.patch
new file mode 100644
index 00000000000000..d3c2a7e2c9b8d4
--- /dev/null
+++ b/target/linux/generic/backport-6.1/790-v6.4-0009-net-dsa-mt7530-introduce-mt7530_remove_common-helper.patch
@@ -0,0 +1,54 @@
+From 69b838d2629e6b82bcd9e0ab3c1c03f46e5e01d3 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:18:50 +0100
+Subject: [PATCH 09/13] net: dsa: mt7530: introduce mt7530_remove_common helper
+ function
+
+Move commonly used parts from mt7530_remove into new
+mt7530_remove_common helper function which will be used by both,
+mt7530_remove and the to-be-introduced mt7988_remove.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/mt7530.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -3277,6 +3277,17 @@ mt7530_probe(struct mdio_device *mdiodev
+ }
+ 
+ static void
++mt7530_remove_common(struct mt7530_priv *priv)
++{
++	if (priv->irq)
++		mt7530_free_irq(priv);
++
++	dsa_unregister_switch(priv->ds);
++
++	mutex_destroy(&priv->reg_mutex);
++}
++
++static void
+ mt7530_remove(struct mdio_device *mdiodev)
+ {
+ 	struct mt7530_priv *priv = dev_get_drvdata(&mdiodev->dev);
+@@ -3295,15 +3306,10 @@ mt7530_remove(struct mdio_device *mdiode
+ 		dev_err(priv->dev, "Failed to disable io pwr: %d\n",
+ 			ret);
+ 
+-	if (priv->irq)
+-		mt7530_free_irq(priv);
+-
+-	dsa_unregister_switch(priv->ds);
++	mt7530_remove_common(priv);
+ 
+ 	for (i = 0; i < 2; ++i)
+ 		mtk_pcs_lynxi_destroy(priv->ports[5 + i].sgmii_pcs);
+-
+-	mutex_destroy(&priv->reg_mutex);
+ }
+ 
+ static void mt7530_shutdown(struct mdio_device *mdiodev)
diff --git a/target/linux/generic/backport-6.1/790-v6.4-0010-net-dsa-mt7530-introduce-separate-MDIO-driver.patch b/target/linux/generic/backport-6.1/790-v6.4-0010-net-dsa-mt7530-introduce-separate-MDIO-driver.patch
new file mode 100644
index 00000000000000..55378ca016b5b5
--- /dev/null
+++ b/target/linux/generic/backport-6.1/790-v6.4-0010-net-dsa-mt7530-introduce-separate-MDIO-driver.patch
@@ -0,0 +1,691 @@
+From 8eceed6dbd74067dbf4d8e39f14734f4d2f35176 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:19:13 +0100
+Subject: [PATCH 10/13] net: dsa: mt7530: introduce separate MDIO driver
+
+Split MT7530 switch driver into a common part and a part specific
+for MDIO connected switches and multi-chip modules.
+Move MDIO-specific functions to newly introduced mt7530-mdio.c while
+keeping the common parts in mt7530.c.
+Introduce new Kconfig symbol CONFIG_NET_DSA_MT7530_MDIO which is
+implied by CONFIG_NET_DSA_MT7530.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ MAINTAINERS                   |   1 +
+ drivers/net/dsa/Kconfig       |  16 +-
+ drivers/net/dsa/Makefile      |   1 +
+ drivers/net/dsa/mt7530-mdio.c | 271 ++++++++++++++++++++++++++++++++++
+ drivers/net/dsa/mt7530.c      | 264 +--------------------------------
+ drivers/net/dsa/mt7530.h      |   6 +
+ 6 files changed, 301 insertions(+), 258 deletions(-)
+ create mode 100644 drivers/net/dsa/mt7530-mdio.c
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -13060,6 +13060,7 @@ M:	Landen Chao <Landen.Chao@mediatek.com
+ M:	DENG Qingfang <dqfext@gmail.com>
+ L:	netdev@vger.kernel.org
+ S:	Maintained
++F:	drivers/net/dsa/mt7530-mdio.c
+ F:	drivers/net/dsa/mt7530.*
+ F:	net/dsa/tag_mtk.c
+ 
+--- a/drivers/net/dsa/Kconfig
++++ b/drivers/net/dsa/Kconfig
+@@ -37,10 +37,22 @@ config NET_DSA_MT7530
+ 	tristate "MediaTek MT753x and MT7621 Ethernet switch support"
+ 	select NET_DSA_TAG_MTK
+ 	select MEDIATEK_GE_PHY
++	imply NET_DSA_MT7530_MDIO
++	help
++	  This enables support for the MediaTek MT7530 and MT7531 Ethernet
++	  switch chips. Multi-chip module MT7530 in MT7621AT, MT7621DAT,
++	  MT7621ST and MT7623AI SoCs, and built-in switch in MT7988 SoC are
++	  supported as well.
++
++config NET_DSA_MT7530_MDIO
++	tristate "MediaTek MT7530 MDIO interface driver"
++	depends on NET_DSA_MT7530
+ 	select PCS_MTK_LYNXI
+ 	help
+-	  This enables support for the MediaTek MT7530, MT7531, and MT7621
+-	  Ethernet switch chips.
++	  This enables support for the MediaTek MT7530 and MT7531 switch
++	  chips which are connected via MDIO, as well as multi-chip
++	  module MT7530 which can be found in the MT7621AT, MT7621DAT,
++	  MT7621ST and MT7623AI SoCs.
+ 
+ config NET_DSA_MV88E6060
+ 	tristate "Marvell 88E6060 ethernet switch chip support"
+--- a/drivers/net/dsa/Makefile
++++ b/drivers/net/dsa/Makefile
+@@ -7,6 +7,7 @@ obj-$(CONFIG_FIXED_PHY)		+= dsa_loop_bdi
+ endif
+ obj-$(CONFIG_NET_DSA_LANTIQ_GSWIP) += lantiq_gswip.o
+ obj-$(CONFIG_NET_DSA_MT7530)	+= mt7530.o
++obj-$(CONFIG_NET_DSA_MT7530_MDIO) += mt7530-mdio.o
+ obj-$(CONFIG_NET_DSA_MV88E6060) += mv88e6060.o
+ obj-$(CONFIG_NET_DSA_RZN1_A5PSW) += rzn1_a5psw.o
+ obj-$(CONFIG_NET_DSA_SMSC_LAN9303) += lan9303-core.o
+--- /dev/null
++++ b/drivers/net/dsa/mt7530-mdio.c
+@@ -0,0 +1,271 @@
++// SPDX-License-Identifier: GPL-2.0-only
++
++#include <linux/gpio/consumer.h>
++#include <linux/mdio.h>
++#include <linux/module.h>
++#include <linux/pcs/pcs-mtk-lynxi.h>
++#include <linux/of_irq.h>
++#include <linux/of_mdio.h>
++#include <linux/of_net.h>
++#include <linux/of_platform.h>
++#include <linux/regmap.h>
++#include <linux/reset.h>
++#include <linux/regulator/consumer.h>
++#include <net/dsa.h>
++
++#include "mt7530.h"
++
++static int
++mt7530_regmap_write(void *context, unsigned int reg, unsigned int val)
++{
++	struct mii_bus *bus = context;
++	u16 page, r, lo, hi;
++	int ret;
++
++	page = (reg >> 6) & 0x3ff;
++	r  = (reg >> 2) & 0xf;
++	lo = val & 0xffff;
++	hi = val >> 16;
++
++	/* MT7530 uses 31 as the pseudo port */
++	ret = bus->write(bus, 0x1f, 0x1f, page);
++	if (ret < 0)
++		return ret;
++
++	ret = bus->write(bus, 0x1f, r,  lo);
++	if (ret < 0)
++		return ret;
++
++	ret = bus->write(bus, 0x1f, 0x10, hi);
++	return ret;
++}
++
++static int
++mt7530_regmap_read(void *context, unsigned int reg, unsigned int *val)
++{
++	struct mii_bus *bus = context;
++	u16 page, r, lo, hi;
++	int ret;
++
++	page = (reg >> 6) & 0x3ff;
++	r = (reg >> 2) & 0xf;
++
++	/* MT7530 uses 31 as the pseudo port */
++	ret = bus->write(bus, 0x1f, 0x1f, page);
++	if (ret < 0)
++		return ret;
++
++	lo = bus->read(bus, 0x1f, r);
++	hi = bus->read(bus, 0x1f, 0x10);
++
++	*val = (hi << 16) | (lo & 0xffff);
++
++	return 0;
++}
++
++static void
++mt7530_mdio_regmap_lock(void *mdio_lock)
++{
++	mutex_lock_nested(mdio_lock, MDIO_MUTEX_NESTED);
++}
++
++static void
++mt7530_mdio_regmap_unlock(void *mdio_lock)
++{
++	mutex_unlock(mdio_lock);
++}
++
++static const struct regmap_bus mt7530_regmap_bus = {
++	.reg_write = mt7530_regmap_write,
++	.reg_read = mt7530_regmap_read,
++};
++
++static int
++mt7531_create_sgmii(struct mt7530_priv *priv)
++{
++	struct regmap_config *mt7531_pcs_config[2];
++	struct phylink_pcs *pcs;
++	struct regmap *regmap;
++	int i, ret = 0;
++
++	for (i = 0; i < 2; i++) {
++		mt7531_pcs_config[i] = devm_kzalloc(priv->dev,
++						    sizeof(struct regmap_config),
++						    GFP_KERNEL);
++		if (!mt7531_pcs_config[i]) {
++			ret = -ENOMEM;
++			break;
++		}
++
++		mt7531_pcs_config[i]->name = i ? "port6" : "port5";
++		mt7531_pcs_config[i]->reg_bits = 16;
++		mt7531_pcs_config[i]->val_bits = 32;
++		mt7531_pcs_config[i]->reg_stride = 4;
++		mt7531_pcs_config[i]->reg_base = MT7531_SGMII_REG_BASE(5 + i);
++		mt7531_pcs_config[i]->max_register = 0x17c;
++		mt7531_pcs_config[i]->lock = mt7530_mdio_regmap_lock;
++		mt7531_pcs_config[i]->unlock = mt7530_mdio_regmap_unlock;
++		mt7531_pcs_config[i]->lock_arg = &priv->bus->mdio_lock;
++
++		regmap = devm_regmap_init(priv->dev,
++					  &mt7530_regmap_bus, priv->bus,
++					  mt7531_pcs_config[i]);
++		if (IS_ERR(regmap)) {
++			ret = PTR_ERR(regmap);
++			break;
++		}
++		pcs = mtk_pcs_lynxi_create(priv->dev, regmap,
++					   MT7531_PHYA_CTRL_SIGNAL3, 0);
++		if (!pcs) {
++			ret = -ENXIO;
++			break;
++		}
++		priv->ports[5 + i].sgmii_pcs = pcs;
++	}
++
++	if (ret && i)
++		mtk_pcs_lynxi_destroy(priv->ports[5].sgmii_pcs);
++
++	return ret;
++}
++
++static const struct of_device_id mt7530_of_match[] = {
++	{ .compatible = "mediatek,mt7621", .data = &mt753x_table[ID_MT7621], },
++	{ .compatible = "mediatek,mt7530", .data = &mt753x_table[ID_MT7530], },
++	{ .compatible = "mediatek,mt7531", .data = &mt753x_table[ID_MT7531], },
++	{ /* sentinel */ },
++};
++MODULE_DEVICE_TABLE(of, mt7530_of_match);
++
++static int
++mt7530_probe(struct mdio_device *mdiodev)
++{
++	static struct regmap_config *regmap_config;
++	struct mt7530_priv *priv;
++	struct device_node *dn;
++	int ret;
++
++	dn = mdiodev->dev.of_node;
++
++	priv = devm_kzalloc(&mdiodev->dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	priv->bus = mdiodev->bus;
++	priv->dev = &mdiodev->dev;
++
++	ret = mt7530_probe_common(priv);
++	if (ret)
++		return ret;
++
++	/* Use medatek,mcm property to distinguish hardware type that would
++	 * cause a little bit differences on power-on sequence.
++	 * Not MCM that indicates switch works as the remote standalone
++	 * integrated circuit so the GPIO pin would be used to complete
++	 * the reset, otherwise memory-mapped register accessing used
++	 * through syscon provides in the case of MCM.
++	 */
++	priv->mcm = of_property_read_bool(dn, "mediatek,mcm");
++	if (priv->mcm) {
++		dev_info(&mdiodev->dev, "MT7530 adapts as multi-chip module\n");
++
++		priv->rstc = devm_reset_control_get(&mdiodev->dev, "mcm");
++		if (IS_ERR(priv->rstc)) {
++			dev_err(&mdiodev->dev, "Couldn't get our reset line\n");
++			return PTR_ERR(priv->rstc);
++		}
++	} else {
++		priv->reset = devm_gpiod_get_optional(&mdiodev->dev, "reset",
++						      GPIOD_OUT_LOW);
++		if (IS_ERR(priv->reset)) {
++			dev_err(&mdiodev->dev, "Couldn't get our reset line\n");
++			return PTR_ERR(priv->reset);
++		}
++	}
++
++	if (priv->id == ID_MT7530) {
++		priv->core_pwr = devm_regulator_get(&mdiodev->dev, "core");
++		if (IS_ERR(priv->core_pwr))
++			return PTR_ERR(priv->core_pwr);
++
++		priv->io_pwr = devm_regulator_get(&mdiodev->dev, "io");
++		if (IS_ERR(priv->io_pwr))
++			return PTR_ERR(priv->io_pwr);
++	}
++
++	regmap_config = devm_kzalloc(&mdiodev->dev, sizeof(*regmap_config),
++				     GFP_KERNEL);
++	if (!regmap_config)
++		return -ENOMEM;
++
++	regmap_config->reg_bits = 16;
++	regmap_config->val_bits = 32;
++	regmap_config->reg_stride = 4;
++	regmap_config->max_register = MT7530_CREV;
++	regmap_config->disable_locking = true;
++	priv->regmap = devm_regmap_init(priv->dev, &mt7530_regmap_bus,
++					priv->bus, regmap_config);
++	if (IS_ERR(priv->regmap))
++		return PTR_ERR(priv->regmap);
++
++	if (priv->id == ID_MT7531) {
++		ret = mt7531_create_sgmii(priv);
++		if (ret)
++			return ret;
++	}
++
++	return dsa_register_switch(priv->ds);
++}
++
++static void
++mt7530_remove(struct mdio_device *mdiodev)
++{
++	struct mt7530_priv *priv = dev_get_drvdata(&mdiodev->dev);
++	int ret = 0, i;
++
++	if (!priv)
++		return;
++
++	ret = regulator_disable(priv->core_pwr);
++	if (ret < 0)
++		dev_err(priv->dev,
++			"Failed to disable core power: %d\n", ret);
++
++	ret = regulator_disable(priv->io_pwr);
++	if (ret < 0)
++		dev_err(priv->dev, "Failed to disable io pwr: %d\n",
++			ret);
++
++	mt7530_remove_common(priv);
++
++	for (i = 0; i < 2; ++i)
++		mtk_pcs_lynxi_destroy(priv->ports[5 + i].sgmii_pcs);
++}
++
++static void mt7530_shutdown(struct mdio_device *mdiodev)
++{
++	struct mt7530_priv *priv = dev_get_drvdata(&mdiodev->dev);
++
++	if (!priv)
++		return;
++
++	dsa_switch_shutdown(priv->ds);
++
++	dev_set_drvdata(&mdiodev->dev, NULL);
++}
++
++static struct mdio_driver mt7530_mdio_driver = {
++	.probe  = mt7530_probe,
++	.remove = mt7530_remove,
++	.shutdown = mt7530_shutdown,
++	.mdiodrv.driver = {
++		.name = "mt7530-mdio",
++		.of_match_table = mt7530_of_match,
++	},
++};
++
++mdio_module_driver(mt7530_mdio_driver);
++
++MODULE_AUTHOR("Sean Wang <sean.wang@mediatek.com>");
++MODULE_DESCRIPTION("Driver for Mediatek MT7530 Switch (MDIO)");
++MODULE_LICENSE("GPL");
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -14,7 +14,6 @@
+ #include <linux/of_mdio.h>
+ #include <linux/of_net.h>
+ #include <linux/of_platform.h>
+-#include <linux/pcs/pcs-mtk-lynxi.h>
+ #include <linux/phylink.h>
+ #include <linux/regmap.h>
+ #include <linux/regulator/consumer.h>
+@@ -192,31 +191,6 @@ core_clear(struct mt7530_priv *priv, u32
+ }
+ 
+ static int
+-mt7530_regmap_write(void *context, unsigned int reg, unsigned int val)
+-{
+-	struct mii_bus *bus = context;
+-	u16 page, r, lo, hi;
+-	int ret;
+-
+-	page = (reg >> 6) & 0x3ff;
+-	r  = (reg >> 2) & 0xf;
+-	lo = val & 0xffff;
+-	hi = val >> 16;
+-
+-	/* MT7530 uses 31 as the pseudo port */
+-	ret = bus->write(bus, 0x1f, 0x1f, page);
+-	if (ret < 0)
+-		return ret;
+-
+-	ret = bus->write(bus, 0x1f, r,  lo);
+-	if (ret < 0)
+-		return ret;
+-
+-	ret = bus->write(bus, 0x1f, 0x10, hi);
+-	return ret;
+-}
+-
+-static int
+ mt7530_mii_write(struct mt7530_priv *priv, u32 reg, u32 val)
+ {
+ 	int ret;
+@@ -230,29 +204,6 @@ mt7530_mii_write(struct mt7530_priv *pri
+ 	return ret;
+ }
+ 
+-static int
+-mt7530_regmap_read(void *context, unsigned int reg, unsigned int *val)
+-{
+-	struct mii_bus *bus = context;
+-	u16 page, r, lo, hi;
+-	int ret;
+-
+-	page = (reg >> 6) & 0x3ff;
+-	r = (reg >> 2) & 0xf;
+-
+-	/* MT7530 uses 31 as the pseudo port */
+-	ret = bus->write(bus, 0x1f, 0x1f, page);
+-	if (ret < 0)
+-		return ret;
+-
+-	lo = bus->read(bus, 0x1f, r);
+-	hi = bus->read(bus, 0x1f, 0x10);
+-
+-	*val = (hi << 16) | (lo & 0xffff);
+-
+-	return 0;
+-}
+-
+ static u32
+ mt7530_mii_read(struct mt7530_priv *priv, u32 reg)
+ {
+@@ -2957,72 +2908,6 @@ static const struct phylink_pcs_ops mt75
+ 	.pcs_an_restart = mt7530_pcs_an_restart,
+ };
+ 
+-static void
+-mt7530_mdio_regmap_lock(void *mdio_lock)
+-{
+-	mutex_lock_nested(mdio_lock, MDIO_MUTEX_NESTED);
+-}
+-
+-static void
+-mt7530_mdio_regmap_unlock(void *mdio_lock)
+-{
+-	mutex_unlock(mdio_lock);
+-}
+-
+-static const struct regmap_bus mt7530_regmap_bus = {
+-	.reg_write = mt7530_regmap_write,
+-	.reg_read = mt7530_regmap_read,
+-};
+-
+-static int
+-mt7531_create_sgmii(struct mt7530_priv *priv)
+-{
+-	struct regmap_config *mt7531_pcs_config[2];
+-	struct phylink_pcs *pcs;
+-	struct regmap *regmap;
+-	int i, ret = 0;
+-
+-	for (i = 0; i < 2; i++) {
+-		mt7531_pcs_config[i] = devm_kzalloc(priv->dev,
+-						    sizeof(struct regmap_config),
+-						    GFP_KERNEL);
+-		if (!mt7531_pcs_config[i]) {
+-			ret = -ENOMEM;
+-			break;
+-		}
+-
+-		mt7531_pcs_config[i]->name = i ? "port6" : "port5";
+-		mt7531_pcs_config[i]->reg_bits = 16;
+-		mt7531_pcs_config[i]->val_bits = 32;
+-		mt7531_pcs_config[i]->reg_stride = 4;
+-		mt7531_pcs_config[i]->reg_base = MT7531_SGMII_REG_BASE(5 + i);
+-		mt7531_pcs_config[i]->max_register = 0x17c;
+-		mt7531_pcs_config[i]->lock = mt7530_mdio_regmap_lock;
+-		mt7531_pcs_config[i]->unlock = mt7530_mdio_regmap_unlock;
+-		mt7531_pcs_config[i]->lock_arg = &priv->bus->mdio_lock;
+-
+-		regmap = devm_regmap_init(priv->dev,
+-					  &mt7530_regmap_bus, priv->bus,
+-					  mt7531_pcs_config[i]);
+-		if (IS_ERR(regmap)) {
+-			ret = PTR_ERR(regmap);
+-			break;
+-		}
+-		pcs = mtk_pcs_lynxi_create(priv->dev, regmap,
+-					   MT7531_PHYA_CTRL_SIGNAL3, 0);
+-		if (!pcs) {
+-			ret = -ENXIO;
+-			break;
+-		}
+-		priv->ports[5 + i].sgmii_pcs = pcs;
+-	}
+-
+-	if (ret && i)
+-		mtk_pcs_lynxi_destroy(priv->ports[5].sgmii_pcs);
+-
+-	return ret;
+-}
+-
+ static int
+ mt753x_setup(struct dsa_switch *ds)
+ {
+@@ -3081,7 +2966,7 @@ static int mt753x_set_mac_eee(struct dsa
+ 	return 0;
+ }
+ 
+-static const struct dsa_switch_ops mt7530_switch_ops = {
++const struct dsa_switch_ops mt7530_switch_ops = {
+ 	.get_tag_protocol	= mtk_get_tag_protocol,
+ 	.setup			= mt753x_setup,
+ 	.get_strings		= mt7530_get_strings,
+@@ -3115,8 +3000,9 @@ static const struct dsa_switch_ops mt753
+ 	.get_mac_eee		= mt753x_get_mac_eee,
+ 	.set_mac_eee		= mt753x_set_mac_eee,
+ };
++EXPORT_SYMBOL_GPL(mt7530_switch_ops);
+ 
+-static const struct mt753x_info mt753x_table[] = {
++const struct mt753x_info mt753x_table[] = {
+ 	[ID_MT7621] = {
+ 		.id = ID_MT7621,
+ 		.pcs_ops = &mt7530_pcs_ops,
+@@ -3149,16 +3035,9 @@ static const struct mt753x_info mt753x_t
+ 		.mac_port_config = mt7531_mac_config,
+ 	},
+ };
++EXPORT_SYMBOL_GPL(mt753x_table);
+ 
+-static const struct of_device_id mt7530_of_match[] = {
+-	{ .compatible = "mediatek,mt7621", .data = &mt753x_table[ID_MT7621], },
+-	{ .compatible = "mediatek,mt7530", .data = &mt753x_table[ID_MT7530], },
+-	{ .compatible = "mediatek,mt7531", .data = &mt753x_table[ID_MT7531], },
+-	{ /* sentinel */ },
+-};
+-MODULE_DEVICE_TABLE(of, mt7530_of_match);
+-
+-static int
++int
+ mt7530_probe_common(struct mt7530_priv *priv)
+ {
+ 	struct device *dev = priv->dev;
+@@ -3195,88 +3074,9 @@ mt7530_probe_common(struct mt7530_priv *
+ 
+ 	return 0;
+ }
++EXPORT_SYMBOL_GPL(mt7530_probe_common);
+ 
+-static int
+-mt7530_probe(struct mdio_device *mdiodev)
+-{
+-	static struct regmap_config *regmap_config;
+-	struct mt7530_priv *priv;
+-	struct device_node *dn;
+-	int ret;
+-
+-	dn = mdiodev->dev.of_node;
+-
+-	priv = devm_kzalloc(&mdiodev->dev, sizeof(*priv), GFP_KERNEL);
+-	if (!priv)
+-		return -ENOMEM;
+-
+-	priv->bus = mdiodev->bus;
+-	priv->dev = &mdiodev->dev;
+-
+-	ret = mt7530_probe_common(priv);
+-	if (ret)
+-		return ret;
+-
+-	/* Use medatek,mcm property to distinguish hardware type that would
+-	 * cause a little bit differences on power-on sequence.
+-	 * Not MCM that indicates switch works as the remote standalone
+-	 * integrated circuit so the GPIO pin would be used to complete
+-	 * the reset, otherwise memory-mapped register accessing used
+-	 * through syscon provides in the case of MCM.
+-	 */
+-	priv->mcm = of_property_read_bool(dn, "mediatek,mcm");
+-	if (priv->mcm) {
+-		dev_info(&mdiodev->dev, "MT7530 adapts as multi-chip module\n");
+-
+-		priv->rstc = devm_reset_control_get(&mdiodev->dev, "mcm");
+-		if (IS_ERR(priv->rstc)) {
+-			dev_err(&mdiodev->dev, "Couldn't get our reset line\n");
+-			return PTR_ERR(priv->rstc);
+-		}
+-	} else {
+-		priv->reset = devm_gpiod_get_optional(&mdiodev->dev, "reset",
+-						      GPIOD_OUT_LOW);
+-		if (IS_ERR(priv->reset)) {
+-			dev_err(&mdiodev->dev, "Couldn't get our reset line\n");
+-			return PTR_ERR(priv->reset);
+-		}
+-	}
+-
+-	if (priv->id == ID_MT7530) {
+-		priv->core_pwr = devm_regulator_get(&mdiodev->dev, "core");
+-		if (IS_ERR(priv->core_pwr))
+-			return PTR_ERR(priv->core_pwr);
+-
+-		priv->io_pwr = devm_regulator_get(&mdiodev->dev, "io");
+-		if (IS_ERR(priv->io_pwr))
+-			return PTR_ERR(priv->io_pwr);
+-	}
+-
+-	regmap_config = devm_kzalloc(&mdiodev->dev, sizeof(*regmap_config),
+-				     GFP_KERNEL);
+-	if (!regmap_config)
+-		return -ENOMEM;
+-
+-	regmap_config->reg_bits = 16;
+-	regmap_config->val_bits = 32;
+-	regmap_config->reg_stride = 4;
+-	regmap_config->max_register = MT7530_CREV;
+-	regmap_config->disable_locking = true;
+-	priv->regmap = devm_regmap_init(priv->dev, &mt7530_regmap_bus,
+-					priv->bus, regmap_config);
+-	if (IS_ERR(priv->regmap))
+-		return PTR_ERR(priv->regmap);
+-
+-	if (priv->id == ID_MT7531) {
+-		ret = mt7531_create_sgmii(priv);
+-		if (ret)
+-			return ret;
+-	}
+-
+-	return dsa_register_switch(priv->ds);
+-}
+-
+-static void
++void
+ mt7530_remove_common(struct mt7530_priv *priv)
+ {
+ 	if (priv->irq)
+@@ -3286,55 +3086,7 @@ mt7530_remove_common(struct mt7530_priv
+ 
+ 	mutex_destroy(&priv->reg_mutex);
+ }
+-
+-static void
+-mt7530_remove(struct mdio_device *mdiodev)
+-{
+-	struct mt7530_priv *priv = dev_get_drvdata(&mdiodev->dev);
+-	int ret = 0, i;
+-
+-	if (!priv)
+-		return;
+-
+-	ret = regulator_disable(priv->core_pwr);
+-	if (ret < 0)
+-		dev_err(priv->dev,
+-			"Failed to disable core power: %d\n", ret);
+-
+-	ret = regulator_disable(priv->io_pwr);
+-	if (ret < 0)
+-		dev_err(priv->dev, "Failed to disable io pwr: %d\n",
+-			ret);
+-
+-	mt7530_remove_common(priv);
+-
+-	for (i = 0; i < 2; ++i)
+-		mtk_pcs_lynxi_destroy(priv->ports[5 + i].sgmii_pcs);
+-}
+-
+-static void mt7530_shutdown(struct mdio_device *mdiodev)
+-{
+-	struct mt7530_priv *priv = dev_get_drvdata(&mdiodev->dev);
+-
+-	if (!priv)
+-		return;
+-
+-	dsa_switch_shutdown(priv->ds);
+-
+-	dev_set_drvdata(&mdiodev->dev, NULL);
+-}
+-
+-static struct mdio_driver mt7530_mdio_driver = {
+-	.probe  = mt7530_probe,
+-	.remove = mt7530_remove,
+-	.shutdown = mt7530_shutdown,
+-	.mdiodrv.driver = {
+-		.name = "mt7530",
+-		.of_match_table = mt7530_of_match,
+-	},
+-};
+-
+-mdio_module_driver(mt7530_mdio_driver);
++EXPORT_SYMBOL_GPL(mt7530_remove_common);
+ 
+ MODULE_AUTHOR("Sean Wang <sean.wang@mediatek.com>");
+ MODULE_DESCRIPTION("Driver for Mediatek MT7530 Switch");
+--- a/drivers/net/dsa/mt7530.h
++++ b/drivers/net/dsa/mt7530.h
+@@ -807,4 +807,10 @@ static inline void INIT_MT7530_DUMMY_POL
+ 	p->reg = reg;
+ }
+ 
++int mt7530_probe_common(struct mt7530_priv *priv);
++void mt7530_remove_common(struct mt7530_priv *priv);
++
++extern const struct dsa_switch_ops mt7530_switch_ops;
++extern const struct mt753x_info mt753x_table[];
++
+ #endif /* __MT7530_H */
diff --git a/target/linux/generic/backport-6.1/790-v6.4-0011-net-dsa-mt7530-skip-locking-if-MDIO-bus-isn-t-presen.patch b/target/linux/generic/backport-6.1/790-v6.4-0011-net-dsa-mt7530-skip-locking-if-MDIO-bus-isn-t-presen.patch
new file mode 100644
index 00000000000000..01011ed1a001c4
--- /dev/null
+++ b/target/linux/generic/backport-6.1/790-v6.4-0011-net-dsa-mt7530-skip-locking-if-MDIO-bus-isn-t-presen.patch
@@ -0,0 +1,47 @@
+From a52cadbf76593f8fcb2f4f62cb006e3f2a22ad06 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:19:28 +0100
+Subject: [PATCH 11/13] net: dsa: mt7530: skip locking if MDIO bus isn't
+ present
+
+As MT7530 and MT7531 internally use 32-bit wide registers, each access
+to any register of the switch requires several operations on the MDIO
+bus. Hence if there is congruent access, e.g. due to PCS or PHY
+polling, this can mess up and interfere with another ongoing register
+access sequence.
+
+However, the MDIO bus mutex is only relevant for MDIO-connected
+switches. Prepare switches which have there registers directly mapped
+into the SoCs register space via MMIO which do not require such
+locking. There we can simply use regmap's default locking mechanism.
+
+Hence guard mutex operations to only be performed in case of MDIO
+connected switches.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/mt7530.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -144,13 +144,15 @@ err:
+ static void
+ mt7530_mutex_lock(struct mt7530_priv *priv)
+ {
+-	mutex_lock_nested(&priv->bus->mdio_lock, MDIO_MUTEX_NESTED);
++	if (priv->bus)
++		mutex_lock_nested(&priv->bus->mdio_lock, MDIO_MUTEX_NESTED);
+ }
+ 
+ static void
+ mt7530_mutex_unlock(struct mt7530_priv *priv)
+ {
+-	mutex_unlock(&priv->bus->mdio_lock);
++	if (priv->bus)
++		mutex_unlock(&priv->bus->mdio_lock);
+ }
+ 
+ static void
diff --git a/target/linux/generic/backport-6.1/790-v6.4-0012-net-dsa-mt7530-introduce-driver-for-MT7988-built-in-.patch b/target/linux/generic/backport-6.1/790-v6.4-0012-net-dsa-mt7530-introduce-driver-for-MT7988-built-in-.patch
new file mode 100644
index 00000000000000..aeaf9f84678e57
--- /dev/null
+++ b/target/linux/generic/backport-6.1/790-v6.4-0012-net-dsa-mt7530-introduce-driver-for-MT7988-built-in-.patch
@@ -0,0 +1,421 @@
+From b361015763fedea439f13b336b15ef7bdf1f7d4f Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 02:19:40 +0100
+Subject: [PATCH 12/13] net: dsa: mt7530: introduce driver for MT7988 built-in
+ switch
+
+Add driver for the built-in Gigabit Ethernet switch which can be found
+in the MediaTek MT7988 SoC.
+
+The switch shares most of its design with MT7530 and MT7531, but has
+it's registers mapped into the SoCs register space rather than being
+connected externally or internally via MDIO.
+
+Introduce a new platform driver to support that.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ MAINTAINERS                   |   2 +
+ drivers/net/dsa/Kconfig       |  12 +++
+ drivers/net/dsa/Makefile      |   1 +
+ drivers/net/dsa/mt7530-mmio.c | 101 +++++++++++++++++++++++++
+ drivers/net/dsa/mt7530.c      | 137 +++++++++++++++++++++++++++++++++-
+ drivers/net/dsa/mt7530.h      |  12 +--
+ 6 files changed, 255 insertions(+), 10 deletions(-)
+ create mode 100644 drivers/net/dsa/mt7530-mmio.c
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -13058,9 +13058,11 @@ MEDIATEK SWITCH DRIVER
+ M:	Sean Wang <sean.wang@mediatek.com>
+ M:	Landen Chao <Landen.Chao@mediatek.com>
+ M:	DENG Qingfang <dqfext@gmail.com>
++M:	Daniel Golle <daniel@makrotopia.org>
+ L:	netdev@vger.kernel.org
+ S:	Maintained
+ F:	drivers/net/dsa/mt7530-mdio.c
++F:	drivers/net/dsa/mt7530-mmio.c
+ F:	drivers/net/dsa/mt7530.*
+ F:	net/dsa/tag_mtk.c
+ 
+--- a/drivers/net/dsa/Kconfig
++++ b/drivers/net/dsa/Kconfig
+@@ -38,6 +38,7 @@ config NET_DSA_MT7530
+ 	select NET_DSA_TAG_MTK
+ 	select MEDIATEK_GE_PHY
+ 	imply NET_DSA_MT7530_MDIO
++	imply NET_DSA_MT7530_MMIO
+ 	help
+ 	  This enables support for the MediaTek MT7530 and MT7531 Ethernet
+ 	  switch chips. Multi-chip module MT7530 in MT7621AT, MT7621DAT,
+@@ -54,6 +55,17 @@ config NET_DSA_MT7530_MDIO
+ 	  module MT7530 which can be found in the MT7621AT, MT7621DAT,
+ 	  MT7621ST and MT7623AI SoCs.
+ 
++config NET_DSA_MT7530_MMIO
++	tristate "MediaTek MT7530 MMIO interface driver"
++	depends on NET_DSA_MT7530
++	depends on HAS_IOMEM
++	help
++	  This enables support for the built-in Ethernet switch found
++	  in the MediaTek MT7988 SoC.
++	  The switch is a similar design as MT7531, but the switch registers
++	  are directly mapped into the SoCs register space rather than being
++	  accessible via MDIO.
++
+ config NET_DSA_MV88E6060
+ 	tristate "Marvell 88E6060 ethernet switch chip support"
+ 	select NET_DSA_TAG_TRAILER
+--- a/drivers/net/dsa/Makefile
++++ b/drivers/net/dsa/Makefile
+@@ -8,6 +8,7 @@ endif
+ obj-$(CONFIG_NET_DSA_LANTIQ_GSWIP) += lantiq_gswip.o
+ obj-$(CONFIG_NET_DSA_MT7530)	+= mt7530.o
+ obj-$(CONFIG_NET_DSA_MT7530_MDIO) += mt7530-mdio.o
++obj-$(CONFIG_NET_DSA_MT7530_MMIO) += mt7530-mmio.o
+ obj-$(CONFIG_NET_DSA_MV88E6060) += mv88e6060.o
+ obj-$(CONFIG_NET_DSA_RZN1_A5PSW) += rzn1_a5psw.o
+ obj-$(CONFIG_NET_DSA_SMSC_LAN9303) += lan9303-core.o
+--- /dev/null
++++ b/drivers/net/dsa/mt7530-mmio.c
+@@ -0,0 +1,101 @@
++// SPDX-License-Identifier: GPL-2.0-only
++
++#include <linux/module.h>
++#include <linux/of_platform.h>
++#include <linux/regmap.h>
++#include <linux/regulator/consumer.h>
++#include <linux/reset.h>
++#include <net/dsa.h>
++
++#include "mt7530.h"
++
++static const struct of_device_id mt7988_of_match[] = {
++	{ .compatible = "mediatek,mt7988-switch", .data = &mt753x_table[ID_MT7988], },
++	{ /* sentinel */ },
++};
++MODULE_DEVICE_TABLE(of, mt7988_of_match);
++
++static int
++mt7988_probe(struct platform_device *pdev)
++{
++	static struct regmap_config *sw_regmap_config;
++	struct mt7530_priv *priv;
++	void __iomem *base_addr;
++	int ret;
++
++	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	priv->bus = NULL;
++	priv->dev = &pdev->dev;
++
++	ret = mt7530_probe_common(priv);
++	if (ret)
++		return ret;
++
++	priv->rstc = devm_reset_control_get(&pdev->dev, NULL);
++	if (IS_ERR(priv->rstc)) {
++		dev_err(&pdev->dev, "Couldn't get our reset line\n");
++		return PTR_ERR(priv->rstc);
++	}
++
++	base_addr = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(base_addr)) {
++		dev_err(&pdev->dev, "cannot request I/O memory space\n");
++		return -ENXIO;
++	}
++
++	sw_regmap_config = devm_kzalloc(&pdev->dev, sizeof(*sw_regmap_config), GFP_KERNEL);
++	if (!sw_regmap_config)
++		return -ENOMEM;
++
++	sw_regmap_config->name = "switch";
++	sw_regmap_config->reg_bits = 16;
++	sw_regmap_config->val_bits = 32;
++	sw_regmap_config->reg_stride = 4;
++	sw_regmap_config->max_register = MT7530_CREV;
++	priv->regmap = devm_regmap_init_mmio(&pdev->dev, base_addr, sw_regmap_config);
++	if (IS_ERR(priv->regmap))
++		return PTR_ERR(priv->regmap);
++
++	return dsa_register_switch(priv->ds);
++}
++
++static int
++mt7988_remove(struct platform_device *pdev)
++{
++	struct mt7530_priv *priv = platform_get_drvdata(pdev);
++
++	if (priv)
++		mt7530_remove_common(priv);
++
++	return 0;
++}
++
++static void mt7988_shutdown(struct platform_device *pdev)
++{
++	struct mt7530_priv *priv = platform_get_drvdata(pdev);
++
++	if (!priv)
++		return;
++
++	dsa_switch_shutdown(priv->ds);
++
++	dev_set_drvdata(&pdev->dev, NULL);
++}
++
++static struct platform_driver mt7988_platform_driver = {
++	.probe  = mt7988_probe,
++	.remove = mt7988_remove,
++	.shutdown = mt7988_shutdown,
++	.driver = {
++		.name = "mt7530-mmio",
++		.of_match_table = mt7988_of_match,
++	},
++};
++module_platform_driver(mt7988_platform_driver);
++
++MODULE_AUTHOR("Daniel Golle <daniel@makrotopia.org>");
++MODULE_DESCRIPTION("Driver for Mediatek MT7530 Switch (MMIO)");
++MODULE_LICENSE("GPL");
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -1989,6 +1989,47 @@ static const struct irq_domain_ops mt753
+ };
+ 
+ static void
++mt7988_irq_mask(struct irq_data *d)
++{
++	struct mt7530_priv *priv = irq_data_get_irq_chip_data(d);
++
++	priv->irq_enable &= ~BIT(d->hwirq);
++	mt7530_mii_write(priv, MT7530_SYS_INT_EN, priv->irq_enable);
++}
++
++static void
++mt7988_irq_unmask(struct irq_data *d)
++{
++	struct mt7530_priv *priv = irq_data_get_irq_chip_data(d);
++
++	priv->irq_enable |= BIT(d->hwirq);
++	mt7530_mii_write(priv, MT7530_SYS_INT_EN, priv->irq_enable);
++}
++
++static struct irq_chip mt7988_irq_chip = {
++	.name = KBUILD_MODNAME,
++	.irq_mask = mt7988_irq_mask,
++	.irq_unmask = mt7988_irq_unmask,
++};
++
++static int
++mt7988_irq_map(struct irq_domain *domain, unsigned int irq,
++	       irq_hw_number_t hwirq)
++{
++	irq_set_chip_data(irq, domain->host_data);
++	irq_set_chip_and_handler(irq, &mt7988_irq_chip, handle_simple_irq);
++	irq_set_nested_thread(irq, true);
++	irq_set_noprobe(irq);
++
++	return 0;
++}
++
++static const struct irq_domain_ops mt7988_irq_domain_ops = {
++	.map = mt7988_irq_map,
++	.xlate = irq_domain_xlate_onecell,
++};
++
++static void
+ mt7530_setup_mdio_irq(struct mt7530_priv *priv)
+ {
+ 	struct dsa_switch *ds = priv->ds;
+@@ -2022,8 +2063,15 @@ mt7530_setup_irq(struct mt7530_priv *pri
+ 		return priv->irq ? : -EINVAL;
+ 	}
+ 
+-	priv->irq_domain = irq_domain_add_linear(np, MT7530_NUM_PHYS,
+-						 &mt7530_irq_domain_ops, priv);
++	if (priv->id == ID_MT7988)
++		priv->irq_domain = irq_domain_add_linear(np, MT7530_NUM_PHYS,
++							 &mt7988_irq_domain_ops,
++							 priv);
++	else
++		priv->irq_domain = irq_domain_add_linear(np, MT7530_NUM_PHYS,
++							 &mt7530_irq_domain_ops,
++							 priv);
++
+ 	if (!priv->irq_domain) {
+ 		dev_err(dev, "failed to create IRQ domain\n");
+ 		return -ENOMEM;
+@@ -2520,6 +2568,25 @@ static void mt7531_mac_port_get_caps(str
+ 	}
+ }
+ 
++static void mt7988_mac_port_get_caps(struct dsa_switch *ds, int port,
++				     struct phylink_config *config)
++{
++	phy_interface_zero(config->supported_interfaces);
++
++	switch (port) {
++	case 0 ... 4: /* Internal phy */
++		__set_bit(PHY_INTERFACE_MODE_INTERNAL,
++			  config->supported_interfaces);
++		break;
++
++	case 6:
++		__set_bit(PHY_INTERFACE_MODE_INTERNAL,
++			  config->supported_interfaces);
++		config->mac_capabilities = MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
++					   MAC_10000FD;
++	}
++}
++
+ static int
+ mt753x_pad_setup(struct dsa_switch *ds, const struct phylink_link_state *state)
+ {
+@@ -2596,6 +2663,17 @@ static bool mt753x_is_mac_port(u32 port)
+ }
+ 
+ static int
++mt7988_mac_config(struct dsa_switch *ds, int port, unsigned int mode,
++		  phy_interface_t interface)
++{
++	if (dsa_is_cpu_port(ds, port) &&
++	    interface == PHY_INTERFACE_MODE_INTERNAL)
++		return 0;
++
++	return -EINVAL;
++}
++
++static int
+ mt7531_mac_config(struct dsa_switch *ds, int port, unsigned int mode,
+ 		  phy_interface_t interface)
+ {
+@@ -2665,7 +2743,8 @@ mt753x_phylink_mac_config(struct dsa_swi
+ 
+ 	switch (port) {
+ 	case 0 ... 4: /* Internal phy */
+-		if (state->interface != PHY_INTERFACE_MODE_GMII)
++		if (state->interface != PHY_INTERFACE_MODE_GMII &&
++		    state->interface != PHY_INTERFACE_MODE_INTERNAL)
+ 			goto unsupported;
+ 		break;
+ 	case 5: /* 2nd cpu port with phy of port 0 or 4 / external phy */
+@@ -2743,7 +2822,8 @@ static void mt753x_phylink_mac_link_up(s
+ 	/* MT753x MAC works in 1G full duplex mode for all up-clocked
+ 	 * variants.
+ 	 */
+-	if (interface == PHY_INTERFACE_MODE_TRGMII ||
++	if (interface == PHY_INTERFACE_MODE_INTERNAL ||
++	    interface == PHY_INTERFACE_MODE_TRGMII ||
+ 	    (phy_interface_mode_is_8023z(interface))) {
+ 		speed = SPEED_1000;
+ 		duplex = DUPLEX_FULL;
+@@ -2823,6 +2903,21 @@ mt7531_cpu_port_config(struct dsa_switch
+ 	return 0;
+ }
+ 
++static int
++mt7988_cpu_port_config(struct dsa_switch *ds, int port)
++{
++	struct mt7530_priv *priv = ds->priv;
++
++	mt7530_write(priv, MT7530_PMCR_P(port),
++		     PMCR_CPU_PORT_SETTING(priv->id));
++
++	mt753x_phylink_mac_link_up(ds, port, MLO_AN_FIXED,
++				   PHY_INTERFACE_MODE_INTERNAL, NULL,
++				   SPEED_10000, DUPLEX_FULL, true, true);
++
++	return 0;
++}
++
+ static void mt753x_phylink_get_caps(struct dsa_switch *ds, int port,
+ 				    struct phylink_config *config)
+ {
+@@ -2968,6 +3063,27 @@ static int mt753x_set_mac_eee(struct dsa
+ 	return 0;
+ }
+ 
++static int mt7988_pad_setup(struct dsa_switch *ds, phy_interface_t interface)
++{
++	return 0;
++}
++
++static int mt7988_setup(struct dsa_switch *ds)
++{
++	struct mt7530_priv *priv = ds->priv;
++
++	/* Reset the switch */
++	reset_control_assert(priv->rstc);
++	usleep_range(20, 50);
++	reset_control_deassert(priv->rstc);
++	usleep_range(20, 50);
++
++	/* Reset the switch PHYs */
++	mt7530_write(priv, MT7530_SYS_CTRL, SYS_CTRL_PHY_RST);
++
++	return mt7531_setup_common(ds);
++}
++
+ const struct dsa_switch_ops mt7530_switch_ops = {
+ 	.get_tag_protocol	= mtk_get_tag_protocol,
+ 	.setup			= mt753x_setup,
+@@ -3036,6 +3152,17 @@ const struct mt753x_info mt753x_table[]
+ 		.mac_port_get_caps = mt7531_mac_port_get_caps,
+ 		.mac_port_config = mt7531_mac_config,
+ 	},
++	[ID_MT7988] = {
++		.id = ID_MT7988,
++		.pcs_ops = &mt7530_pcs_ops,
++		.sw_setup = mt7988_setup,
++		.phy_read = mt7531_ind_phy_read,
++		.phy_write = mt7531_ind_phy_write,
++		.pad_setup = mt7988_pad_setup,
++		.cpu_port_config = mt7988_cpu_port_config,
++		.mac_port_get_caps = mt7988_mac_port_get_caps,
++		.mac_port_config = mt7988_mac_config,
++	},
+ };
+ EXPORT_SYMBOL_GPL(mt753x_table);
+ 
+--- a/drivers/net/dsa/mt7530.h
++++ b/drivers/net/dsa/mt7530.h
+@@ -18,6 +18,7 @@ enum mt753x_id {
+ 	ID_MT7530 = 0,
+ 	ID_MT7621 = 1,
+ 	ID_MT7531 = 2,
++	ID_MT7988 = 3,
+ };
+ 
+ #define	NUM_TRGMII_CTRL			5
+@@ -54,11 +55,11 @@ enum mt753x_id {
+ #define  MT7531_MIRROR_PORT_SET(x)	(((x) & MIRROR_MASK) << 16)
+ #define  MT7531_CPU_PMAP_MASK		GENMASK(7, 0)
+ 
+-#define MT753X_MIRROR_REG(id)		(((id) == ID_MT7531) ? \
++#define MT753X_MIRROR_REG(id)		((((id) == ID_MT7531) || ((id) == ID_MT7988)) ?	\
+ 					 MT7531_CFC : MT7530_MFC)
+-#define MT753X_MIRROR_EN(id)		(((id) == ID_MT7531) ? \
++#define MT753X_MIRROR_EN(id)		((((id) == ID_MT7531) || ((id) == ID_MT7988)) ?	\
+ 					 MT7531_MIRROR_EN : MIRROR_EN)
+-#define MT753X_MIRROR_MASK(id)		(((id) == ID_MT7531) ? \
++#define MT753X_MIRROR_MASK(id)		((((id) == ID_MT7531) || ((id) == ID_MT7988)) ?	\
+ 					 MT7531_MIRROR_MASK : MIRROR_MASK)
+ 
+ /* Registers for BPDU and PAE frame control*/
+@@ -295,9 +296,8 @@ enum mt7530_vlan_port_acc_frm {
+ 					 MT7531_FORCE_DPX | \
+ 					 MT7531_FORCE_RX_FC | \
+ 					 MT7531_FORCE_TX_FC)
+-#define  PMCR_FORCE_MODE_ID(id)		(((id) == ID_MT7531) ? \
+-					 MT7531_FORCE_MODE : \
+-					 PMCR_FORCE_MODE)
++#define  PMCR_FORCE_MODE_ID(id)		((((id) == ID_MT7531) || ((id) == ID_MT7988)) ?	\
++					 MT7531_FORCE_MODE : PMCR_FORCE_MODE)
+ #define  PMCR_LINK_SETTINGS_MASK	(PMCR_TX_EN | PMCR_FORCE_SPEED_1000 | \
+ 					 PMCR_RX_EN | PMCR_FORCE_SPEED_100 | \
+ 					 PMCR_TX_FC_EN | PMCR_RX_FC_EN | \
diff --git a/target/linux/generic/backport-6.1/790-v6.4-0013-net-dsa-mt7530-fix-support-for-MT7531BE.patch b/target/linux/generic/backport-6.1/790-v6.4-0013-net-dsa-mt7530-fix-support-for-MT7531BE.patch
new file mode 100644
index 00000000000000..074472f6dcb09a
--- /dev/null
+++ b/target/linux/generic/backport-6.1/790-v6.4-0013-net-dsa-mt7530-fix-support-for-MT7531BE.patch
@@ -0,0 +1,118 @@
+From eb1dd407b4be7ca38166a38c56c8edf52c6a399f Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sun, 16 Apr 2023 13:08:14 +0100
+Subject: [PATCH 13/13] net: dsa: mt7530: fix support for MT7531BE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+There are two variants of the MT7531 switch IC which got different
+features (and pins) regarding port 5:
+ * MT7531AE: SGMII/1000Base-X/2500Base-X SerDes PCS
+ * MT7531BE: RGMII
+
+Moving the creation of the SerDes PCS from mt753x_setup to mt7530_probe
+with commit 6de285229773 ("net: dsa: mt7530: move SGMII PCS creation
+to mt7530_probe function") works fine for MT7531AE which got two
+instances of mtk-pcs-lynxi, however, MT7531BE requires mt7531_pll_setup
+to setup clocks before the single PCS on port 6 (usually used as CPU
+port) starts to work and hence the PCS creation failed on MT7531BE.
+
+Fix this by introducing a pointer to mt7531_create_sgmii function in
+struct mt7530_priv and call it again at the end of mt753x_setup like it
+was before commit 6de285229773 ("net: dsa: mt7530: move SGMII PCS
+creation to mt7530_probe function").
+
+Fixes: 6de285229773 ("net: dsa: mt7530: move SGMII PCS creation to mt7530_probe function")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Link: https://lore.kernel.org/r/ZDvlLhhqheobUvOK@makrotopia.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/mt7530-mdio.c | 16 ++++++++--------
+ drivers/net/dsa/mt7530.c      |  6 ++++++
+ drivers/net/dsa/mt7530.h      |  4 ++--
+ 3 files changed, 16 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/dsa/mt7530-mdio.c
++++ b/drivers/net/dsa/mt7530-mdio.c
+@@ -81,14 +81,17 @@ static const struct regmap_bus mt7530_re
+ };
+ 
+ static int
+-mt7531_create_sgmii(struct mt7530_priv *priv)
++mt7531_create_sgmii(struct mt7530_priv *priv, bool dual_sgmii)
+ {
+-	struct regmap_config *mt7531_pcs_config[2];
++	struct regmap_config *mt7531_pcs_config[2] = {};
+ 	struct phylink_pcs *pcs;
+ 	struct regmap *regmap;
+ 	int i, ret = 0;
+ 
+-	for (i = 0; i < 2; i++) {
++	/* MT7531AE has two SGMII units for port 5 and port 6
++	 * MT7531BE has only one SGMII unit for port 6
++	 */
++	for (i = dual_sgmii ? 0 : 1; i < 2; i++) {
+ 		mt7531_pcs_config[i] = devm_kzalloc(priv->dev,
+ 						    sizeof(struct regmap_config),
+ 						    GFP_KERNEL);
+@@ -208,11 +211,8 @@ mt7530_probe(struct mdio_device *mdiodev
+ 	if (IS_ERR(priv->regmap))
+ 		return PTR_ERR(priv->regmap);
+ 
+-	if (priv->id == ID_MT7531) {
+-		ret = mt7531_create_sgmii(priv);
+-		if (ret)
+-			return ret;
+-	}
++	if (priv->id == ID_MT7531)
++		priv->create_sgmii = mt7531_create_sgmii;
+ 
+ 	return dsa_register_switch(priv->ds);
+ }
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -3030,6 +3030,12 @@ mt753x_setup(struct dsa_switch *ds)
+ 	if (ret && priv->irq)
+ 		mt7530_free_irq_common(priv);
+ 
++	if (priv->create_sgmii) {
++		ret = priv->create_sgmii(priv, mt7531_dual_sgmii_supported(priv));
++		if (ret && priv->irq)
++			mt7530_free_irq(priv);
++	}
++
+ 	return ret;
+ }
+ 
+--- a/drivers/net/dsa/mt7530.h
++++ b/drivers/net/dsa/mt7530.h
+@@ -741,10 +741,10 @@ struct mt753x_info {
+  *			registers
+  * @p6_interface	Holding the current port 6 interface
+  * @p5_intf_sel:	Holding the current port 5 interface select
+- *
+  * @irq:		IRQ number of the switch
+  * @irq_domain:		IRQ domain of the switch irq_chip
+  * @irq_enable:		IRQ enable bits, synced to SYS_INT_EN
++ * @create_sgmii:	Pointer to function creating SGMII PCS instance(s)
+  */
+ struct mt7530_priv {
+ 	struct device		*dev;
+@@ -763,7 +763,6 @@ struct mt7530_priv {
+ 	unsigned int		p5_intf_sel;
+ 	u8			mirror_rx;
+ 	u8			mirror_tx;
+-
+ 	struct mt7530_port	ports[MT7530_NUM_PORTS];
+ 	struct mt753x_pcs	pcs[MT7530_NUM_PORTS];
+ 	/* protect among processes for registers access*/
+@@ -771,6 +770,7 @@ struct mt7530_priv {
+ 	int irq;
+ 	struct irq_domain *irq_domain;
+ 	u32 irq_enable;
++	int (*create_sgmii)(struct mt7530_priv *priv, bool dual_sgmii);
+ };
+ 
+ struct mt7530_hw_vlan_entry {
diff --git a/target/linux/generic/backport-6.1/791-v6.2-01-net-phy-Add-driver-for-Motorcomm-yt8521-gigabit-ethernet.patch b/target/linux/generic/backport-6.1/791-v6.2-01-net-phy-Add-driver-for-Motorcomm-yt8521-gigabit-ethernet.patch
new file mode 100644
index 00000000000000..ddb32385e4e088
--- /dev/null
+++ b/target/linux/generic/backport-6.1/791-v6.2-01-net-phy-Add-driver-for-Motorcomm-yt8521-gigabit-ethernet.patch
@@ -0,0 +1,1724 @@
+From 70479a40954cf353e87a486997a3477108c75aa9 Mon Sep 17 00:00:00 2001
+From: Frank <Frank.Sae@motor-comm.com>
+Date: Fri, 28 Oct 2022 17:26:21 +0800
+Subject: [PATCH] net: phy: Add driver for Motorcomm yt8521 gigabit ethernet
+ phy
+
+Add a driver for the motorcomm yt8521 gigabit ethernet phy. We have verified
+ the driver on StarFive VisionFive development board, which is developed by
+ Shanghai StarFive Technology Co., Ltd.. On the board, yt8521 gigabit ethernet
+ phy works in utp mode, RGMII interface, supports 1000M/100M/10M speeds, and
+ wol(magic package).
+
+Signed-off-by: Frank <Frank.Sae@motor-comm.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ MAINTAINERS                 |    1 +
+ drivers/net/phy/Kconfig     |    2 +-
+ drivers/net/phy/motorcomm.c | 1635 ++++++++++++++++++++++++++++++++++-
+ 3 files changed, 1635 insertions(+), 3 deletions(-)
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -13962,6 +13962,7 @@ F:	include/uapi/linux/meye.h
+ 
+ MOTORCOMM PHY DRIVER
+ M:	Peter Geis <pgwipeout@gmail.com>
++M:	Frank <Frank.Sae@motor-comm.com>
+ L:	netdev@vger.kernel.org
+ S:	Maintained
+ F:	drivers/net/phy/motorcomm.c
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -260,7 +260,7 @@ config MOTORCOMM_PHY
+ 	tristate "Motorcomm PHYs"
+ 	help
+ 	  Enables support for Motorcomm network PHYs.
+-	  Currently supports the YT8511 gigabit PHY.
++	  Currently supports the YT8511, YT8521 Gigabit Ethernet PHYs.
+ 
+ config NATIONAL_PHY
+ 	tristate "National Semiconductor PHYs"
+--- a/drivers/net/phy/motorcomm.c
++++ b/drivers/net/phy/motorcomm.c
+@@ -1,15 +1,106 @@
+ // SPDX-License-Identifier: GPL-2.0+
+ /*
+- * Driver for Motorcomm PHYs
++ * Motorcomm 8511/8521 PHY driver.
+  *
+  * Author: Peter Geis <pgwipeout@gmail.com>
++ * Author: Frank <Frank.Sae@motor-comm.com>
+  */
+ 
++#include <linux/etherdevice.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/phy.h>
+ 
+ #define PHY_ID_YT8511		0x0000010a
++#define PHY_ID_YT8521				0x0000011A
++
++/* YT8521 Register Overview
++ *	UTP Register space	|	FIBER Register space
++ *  ------------------------------------------------------------
++ * |	UTP MII			|	FIBER MII		|
++ * |	UTP MMD			|				|
++ * |	UTP Extended		|	FIBER Extended		|
++ *  ------------------------------------------------------------
++ * |			Common Extended				|
++ *  ------------------------------------------------------------
++ */
++
++/* 0x10 ~ 0x15 , 0x1E and 0x1F are common MII registers of yt phy */
++
++/* Specific Function Control Register */
++#define YTPHY_SPECIFIC_FUNCTION_CONTROL_REG	0x10
++
++/* 2b00 Manual MDI configuration
++ * 2b01 Manual MDIX configuration
++ * 2b10 Reserved
++ * 2b11 Enable automatic crossover for all modes  *default*
++ */
++#define YTPHY_SFCR_MDI_CROSSOVER_MODE_MASK	(BIT(6) | BIT(5))
++#define YTPHY_SFCR_CROSSOVER_EN			BIT(3)
++#define YTPHY_SFCR_SQE_TEST_EN			BIT(2)
++#define YTPHY_SFCR_POLARITY_REVERSAL_EN		BIT(1)
++#define YTPHY_SFCR_JABBER_DIS			BIT(0)
++
++/* Specific Status Register */
++#define YTPHY_SPECIFIC_STATUS_REG		0x11
++#define YTPHY_SSR_SPEED_MODE_OFFSET		14
++
++#define YTPHY_SSR_SPEED_MODE_MASK		(BIT(15) | BIT(14))
++#define YTPHY_SSR_SPEED_10M			0x0
++#define YTPHY_SSR_SPEED_100M			0x1
++#define YTPHY_SSR_SPEED_1000M			0x2
++#define YTPHY_SSR_DUPLEX_OFFSET			13
++#define YTPHY_SSR_DUPLEX			BIT(13)
++#define YTPHY_SSR_PAGE_RECEIVED			BIT(12)
++#define YTPHY_SSR_SPEED_DUPLEX_RESOLVED		BIT(11)
++#define YTPHY_SSR_LINK				BIT(10)
++#define YTPHY_SSR_MDIX_CROSSOVER		BIT(6)
++#define YTPHY_SSR_DOWNGRADE			BIT(5)
++#define YTPHY_SSR_TRANSMIT_PAUSE		BIT(3)
++#define YTPHY_SSR_RECEIVE_PAUSE			BIT(2)
++#define YTPHY_SSR_POLARITY			BIT(1)
++#define YTPHY_SSR_JABBER			BIT(0)
++
++/* Interrupt enable Register */
++#define YTPHY_INTERRUPT_ENABLE_REG		0x12
++#define YTPHY_IER_WOL				BIT(6)
++
++/* Interrupt Status Register */
++#define YTPHY_INTERRUPT_STATUS_REG		0x13
++#define YTPHY_ISR_AUTONEG_ERR			BIT(15)
++#define YTPHY_ISR_SPEED_CHANGED			BIT(14)
++#define YTPHY_ISR_DUPLEX_CHANGED		BIT(13)
++#define YTPHY_ISR_PAGE_RECEIVED			BIT(12)
++#define YTPHY_ISR_LINK_FAILED			BIT(11)
++#define YTPHY_ISR_LINK_SUCCESSED		BIT(10)
++#define YTPHY_ISR_WOL				BIT(6)
++#define YTPHY_ISR_WIRESPEED_DOWNGRADE		BIT(5)
++#define YTPHY_ISR_SERDES_LINK_FAILED		BIT(3)
++#define YTPHY_ISR_SERDES_LINK_SUCCESSED		BIT(2)
++#define YTPHY_ISR_POLARITY_CHANGED		BIT(1)
++#define YTPHY_ISR_JABBER_HAPPENED		BIT(0)
++
++/* Speed Auto Downgrade Control Register */
++#define YTPHY_SPEED_AUTO_DOWNGRADE_CONTROL_REG	0x14
++#define YTPHY_SADCR_SPEED_DOWNGRADE_EN		BIT(5)
++
++/* If these bits are set to 3, the PHY attempts five times ( 3(set value) +
++ * additional 2) before downgrading, default 0x3
++ */
++#define YTPHY_SADCR_SPEED_RETRY_LIMIT		(0x3 << 2)
++
++/* Rx Error Counter Register */
++#define YTPHY_RX_ERROR_COUNTER_REG		0x15
++
++/* Extended Register's Address Offset Register */
++#define YTPHY_PAGE_SELECT			0x1E
++
++/* Extended Register's Data Register */
++#define YTPHY_PAGE_DATA				0x1F
++
++/* FIBER Auto-Negotiation link partner ability */
++#define YTPHY_FLPA_PAUSE			(0x3 << 7)
++#define YTPHY_FLPA_ASYM_PAUSE			(0x2 << 7)
+ 
+ #define YT8511_PAGE_SELECT	0x1e
+ #define YT8511_PAGE		0x1f
+@@ -38,6 +129,352 @@
+ #define YT8511_DELAY_FE_TX_EN	(0xf << 12)
+ #define YT8511_DELAY_FE_TX_DIS	(0x2 << 12)
+ 
++/* Extended register is different from MMD Register and MII Register.
++ * We can use ytphy_read_ext/ytphy_write_ext/ytphy_modify_ext function to
++ * operate extended register.
++ * Extended Register  start
++ */
++
++/* Phy gmii clock gating Register */
++#define YT8521_CLOCK_GATING_REG			0xC
++#define YT8521_CGR_RX_CLK_EN			BIT(12)
++
++#define YT8521_EXTREG_SLEEP_CONTROL1_REG	0x27
++#define YT8521_ESC1R_SLEEP_SW			BIT(15)
++#define YT8521_ESC1R_PLLON_SLP			BIT(14)
++
++/* Phy fiber Link timer cfg2 Register */
++#define YT8521_LINK_TIMER_CFG2_REG		0xA5
++#define YT8521_LTCR_EN_AUTOSEN			BIT(15)
++
++/* 0xA000, 0xA001, 0xA003 ,and 0xA006 ~ 0xA00A  are common ext registers
++ * of yt8521 phy. There is no need to switch reg space when operating these
++ * registers.
++ */
++
++#define YT8521_REG_SPACE_SELECT_REG		0xA000
++#define YT8521_RSSR_SPACE_MASK			BIT(1)
++#define YT8521_RSSR_FIBER_SPACE			(0x1 << 1)
++#define YT8521_RSSR_UTP_SPACE			(0x0 << 1)
++#define YT8521_RSSR_TO_BE_ARBITRATED		(0xFF)
++
++#define YT8521_CHIP_CONFIG_REG			0xA001
++#define YT8521_CCR_SW_RST			BIT(15)
++
++#define YT8521_CCR_MODE_SEL_MASK		(BIT(2) | BIT(1) | BIT(0))
++#define YT8521_CCR_MODE_UTP_TO_RGMII		0
++#define YT8521_CCR_MODE_FIBER_TO_RGMII		1
++#define YT8521_CCR_MODE_UTP_FIBER_TO_RGMII	2
++#define YT8521_CCR_MODE_UTP_TO_SGMII		3
++#define YT8521_CCR_MODE_SGPHY_TO_RGMAC		4
++#define YT8521_CCR_MODE_SGMAC_TO_RGPHY		5
++#define YT8521_CCR_MODE_UTP_TO_FIBER_AUTO	6
++#define YT8521_CCR_MODE_UTP_TO_FIBER_FORCE	7
++
++/* 3 phy polling modes,poll mode combines utp and fiber mode*/
++#define YT8521_MODE_FIBER			0x1
++#define YT8521_MODE_UTP				0x2
++#define YT8521_MODE_POLL			0x3
++
++#define YT8521_RGMII_CONFIG1_REG		0xA003
++
++/* TX Gig-E Delay is bits 3:0, default 0x1
++ * TX Fast-E Delay is bits 7:4, default 0xf
++ * RX Delay is bits 13:10, default 0x0
++ * Delay = 150ps * N
++ * On = 2250ps, off = 0ps
++ */
++#define YT8521_RC1R_RX_DELAY_MASK		(0xF << 10)
++#define YT8521_RC1R_RX_DELAY_EN			(0xF << 10)
++#define YT8521_RC1R_RX_DELAY_DIS		(0x0 << 10)
++#define YT8521_RC1R_FE_TX_DELAY_MASK		(0xF << 4)
++#define YT8521_RC1R_FE_TX_DELAY_EN		(0xF << 4)
++#define YT8521_RC1R_FE_TX_DELAY_DIS		(0x0 << 4)
++#define YT8521_RC1R_GE_TX_DELAY_MASK		(0xF << 0)
++#define YT8521_RC1R_GE_TX_DELAY_EN		(0xF << 0)
++#define YT8521_RC1R_GE_TX_DELAY_DIS		(0x0 << 0)
++
++#define YTPHY_MISC_CONFIG_REG			0xA006
++#define YTPHY_MCR_FIBER_SPEED_MASK		BIT(0)
++#define YTPHY_MCR_FIBER_1000BX			(0x1 << 0)
++#define YTPHY_MCR_FIBER_100FX			(0x0 << 0)
++
++/* WOL MAC ADDR: MACADDR2(highest), MACADDR1(middle), MACADDR0(lowest) */
++#define YTPHY_WOL_MACADDR2_REG			0xA007
++#define YTPHY_WOL_MACADDR1_REG			0xA008
++#define YTPHY_WOL_MACADDR0_REG			0xA009
++
++#define YTPHY_WOL_CONFIG_REG			0xA00A
++#define YTPHY_WCR_INTR_SEL			BIT(6)
++#define YTPHY_WCR_ENABLE			BIT(3)
++
++/* 2b00 84ms
++ * 2b01 168ms  *default*
++ * 2b10 336ms
++ * 2b11 672ms
++ */
++#define YTPHY_WCR_PULSE_WIDTH_MASK		(BIT(2) | BIT(1))
++#define YTPHY_WCR_PULSE_WIDTH_672MS		(BIT(2) | BIT(1))
++
++/* 1b0 Interrupt and WOL events is level triggered and active LOW  *default*
++ * 1b1 Interrupt and WOL events is pulse triggered and active LOW
++ */
++#define YTPHY_WCR_TYPE_PULSE			BIT(0)
++
++/* Extended Register  end */
++
++struct yt8521_priv {
++	/* combo_advertising is used for case of YT8521 in combo mode,
++	 * this means that yt8521 may work in utp or fiber mode which depends
++	 * on which media is connected (YT8521_RSSR_TO_BE_ARBITRATED).
++	 */
++	__ETHTOOL_DECLARE_LINK_MODE_MASK(combo_advertising);
++
++	/* YT8521_MODE_FIBER / YT8521_MODE_UTP / YT8521_MODE_POLL*/
++	u8 polling_mode;
++	u8 strap_mode; /* 8 working modes  */
++	/* current reg page of yt8521 phy:
++	 * YT8521_RSSR_UTP_SPACE
++	 * YT8521_RSSR_FIBER_SPACE
++	 * YT8521_RSSR_TO_BE_ARBITRATED
++	 */
++	u8 reg_page;
++};
++
++/**
++ * ytphy_read_ext() - read a PHY's extended register
++ * @phydev: a pointer to a &struct phy_device
++ * @regnum: register number to read
++ *
++ * NOTE:The caller must have taken the MDIO bus lock.
++ *
++ * returns the value of regnum reg or negative error code
++ */
++static int ytphy_read_ext(struct phy_device *phydev, u16 regnum)
++{
++	int ret;
++
++	ret = __phy_write(phydev, YTPHY_PAGE_SELECT, regnum);
++	if (ret < 0)
++		return ret;
++
++	return __phy_read(phydev, YTPHY_PAGE_DATA);
++}
++
++/**
++ * ytphy_read_ext_with_lock() - read a PHY's extended register
++ * @phydev: a pointer to a &struct phy_device
++ * @regnum: register number to read
++ *
++ * returns the value of regnum reg or negative error code
++ */
++static int ytphy_read_ext_with_lock(struct phy_device *phydev, u16 regnum)
++{
++	int ret;
++
++	phy_lock_mdio_bus(phydev);
++	ret = ytphy_read_ext(phydev, regnum);
++	phy_unlock_mdio_bus(phydev);
++
++	return ret;
++}
++
++/**
++ * ytphy_write_ext() - write a PHY's extended register
++ * @phydev: a pointer to a &struct phy_device
++ * @regnum: register number to write
++ * @val: value to write to @regnum
++ *
++ * NOTE:The caller must have taken the MDIO bus lock.
++ *
++ * returns 0 or negative error code
++ */
++static int ytphy_write_ext(struct phy_device *phydev, u16 regnum, u16 val)
++{
++	int ret;
++
++	ret = __phy_write(phydev, YTPHY_PAGE_SELECT, regnum);
++	if (ret < 0)
++		return ret;
++
++	return __phy_write(phydev, YTPHY_PAGE_DATA, val);
++}
++
++/**
++ * ytphy_write_ext_with_lock() - write a PHY's extended register
++ * @phydev: a pointer to a &struct phy_device
++ * @regnum: register number to write
++ * @val: value to write to @regnum
++ *
++ * returns 0 or negative error code
++ */
++static int ytphy_write_ext_with_lock(struct phy_device *phydev, u16 regnum,
++				     u16 val)
++{
++	int ret;
++
++	phy_lock_mdio_bus(phydev);
++	ret = ytphy_write_ext(phydev, regnum, val);
++	phy_unlock_mdio_bus(phydev);
++
++	return ret;
++}
++
++/**
++ * ytphy_modify_ext() - bits modify a PHY's extended register
++ * @phydev: a pointer to a &struct phy_device
++ * @regnum: register number to write
++ * @mask: bit mask of bits to clear
++ * @set: bit mask of bits to set
++ *
++ * NOTE: Convenience function which allows a PHY's extended register to be
++ * modified as new register value = (old register value & ~mask) | set.
++ * The caller must have taken the MDIO bus lock.
++ *
++ * returns 0 or negative error code
++ */
++static int ytphy_modify_ext(struct phy_device *phydev, u16 regnum, u16 mask,
++			    u16 set)
++{
++	int ret;
++
++	ret = __phy_write(phydev, YTPHY_PAGE_SELECT, regnum);
++	if (ret < 0)
++		return ret;
++
++	return __phy_modify(phydev, YTPHY_PAGE_DATA, mask, set);
++}
++
++/**
++ * ytphy_modify_ext_with_lock() - bits modify a PHY's extended register
++ * @phydev: a pointer to a &struct phy_device
++ * @regnum: register number to write
++ * @mask: bit mask of bits to clear
++ * @set: bit mask of bits to set
++ *
++ * NOTE: Convenience function which allows a PHY's extended register to be
++ * modified as new register value = (old register value & ~mask) | set.
++ *
++ * returns 0 or negative error code
++ */
++static int ytphy_modify_ext_with_lock(struct phy_device *phydev, u16 regnum,
++				      u16 mask, u16 set)
++{
++	int ret;
++
++	phy_lock_mdio_bus(phydev);
++	ret = ytphy_modify_ext(phydev, regnum, mask, set);
++	phy_unlock_mdio_bus(phydev);
++
++	return ret;
++}
++
++/**
++ * ytphy_get_wol() - report whether wake-on-lan is enabled
++ * @phydev: a pointer to a &struct phy_device
++ * @wol: a pointer to a &struct ethtool_wolinfo
++ *
++ * NOTE: YTPHY_WOL_CONFIG_REG is common ext reg.
++ */
++static void ytphy_get_wol(struct phy_device *phydev,
++			  struct ethtool_wolinfo *wol)
++{
++	int wol_config;
++
++	wol->supported = WAKE_MAGIC;
++	wol->wolopts = 0;
++
++	wol_config = ytphy_read_ext_with_lock(phydev, YTPHY_WOL_CONFIG_REG);
++	if (wol_config < 0)
++		return;
++
++	if (wol_config & YTPHY_WCR_ENABLE)
++		wol->wolopts |= WAKE_MAGIC;
++}
++
++/**
++ * ytphy_set_wol() - turn wake-on-lan on or off
++ * @phydev: a pointer to a &struct phy_device
++ * @wol: a pointer to a &struct ethtool_wolinfo
++ *
++ * NOTE: YTPHY_WOL_CONFIG_REG, YTPHY_WOL_MACADDR2_REG, YTPHY_WOL_MACADDR1_REG
++ * and YTPHY_WOL_MACADDR0_REG are common ext reg. The
++ * YTPHY_INTERRUPT_ENABLE_REG of UTP is special, fiber also use this register.
++ *
++ * returns 0 or negative errno code
++ */
++static int ytphy_set_wol(struct phy_device *phydev, struct ethtool_wolinfo *wol)
++{
++	struct net_device *p_attached_dev;
++	const u16 mac_addr_reg[] = {
++		YTPHY_WOL_MACADDR2_REG,
++		YTPHY_WOL_MACADDR1_REG,
++		YTPHY_WOL_MACADDR0_REG,
++	};
++	const u8 *mac_addr;
++	int old_page;
++	int ret = 0;
++	u16 mask;
++	u16 val;
++	u8 i;
++
++	if (wol->wolopts & WAKE_MAGIC) {
++		p_attached_dev = phydev->attached_dev;
++		if (!p_attached_dev)
++			return -ENODEV;
++
++		mac_addr = (const u8 *)p_attached_dev->dev_addr;
++		if (!is_valid_ether_addr(mac_addr))
++			return -EINVAL;
++
++		/* lock mdio bus then switch to utp reg space */
++		old_page = phy_select_page(phydev, YT8521_RSSR_UTP_SPACE);
++		if (old_page < 0)
++			goto err_restore_page;
++
++		/* Store the device address for the magic packet */
++		for (i = 0; i < 3; i++) {
++			ret = ytphy_write_ext(phydev, mac_addr_reg[i],
++					      ((mac_addr[i * 2] << 8)) |
++						      (mac_addr[i * 2 + 1]));
++			if (ret < 0)
++				goto err_restore_page;
++		}
++
++		/* Enable WOL feature */
++		mask = YTPHY_WCR_PULSE_WIDTH_MASK | YTPHY_WCR_INTR_SEL;
++		val = YTPHY_WCR_ENABLE | YTPHY_WCR_INTR_SEL;
++		val |= YTPHY_WCR_TYPE_PULSE | YTPHY_WCR_PULSE_WIDTH_672MS;
++		ret = ytphy_modify_ext(phydev, YTPHY_WOL_CONFIG_REG, mask, val);
++		if (ret < 0)
++			goto err_restore_page;
++
++		/* Enable WOL interrupt */
++		ret = __phy_modify(phydev, YTPHY_INTERRUPT_ENABLE_REG, 0,
++				   YTPHY_IER_WOL);
++		if (ret < 0)
++			goto err_restore_page;
++
++	} else {
++		old_page = phy_select_page(phydev, YT8521_RSSR_UTP_SPACE);
++		if (old_page < 0)
++			goto err_restore_page;
++
++		/* Disable WOL feature */
++		mask = YTPHY_WCR_ENABLE | YTPHY_WCR_INTR_SEL;
++		ret = ytphy_modify_ext(phydev, YTPHY_WOL_CONFIG_REG, mask, 0);
++
++		/* Disable WOL interrupt */
++		ret = __phy_modify(phydev, YTPHY_INTERRUPT_ENABLE_REG,
++				   YTPHY_IER_WOL, 0);
++		if (ret < 0)
++			goto err_restore_page;
++	}
++
++err_restore_page:
++	return phy_restore_page(phydev, old_page, ret);
++}
++
+ static int yt8511_read_page(struct phy_device *phydev)
+ {
+ 	return __phy_read(phydev, YT8511_PAGE_SELECT);
+@@ -111,6 +548,1181 @@ err_restore_page:
+ 	return phy_restore_page(phydev, oldpage, ret);
+ }
+ 
++/**
++ * yt8521_read_page() - read reg page
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * returns current reg space of yt8521 (YT8521_RSSR_FIBER_SPACE/
++ * YT8521_RSSR_UTP_SPACE) or negative errno code
++ */
++static int yt8521_read_page(struct phy_device *phydev)
++{
++	int old_page;
++
++	old_page = ytphy_read_ext(phydev, YT8521_REG_SPACE_SELECT_REG);
++	if (old_page < 0)
++		return old_page;
++
++	if ((old_page & YT8521_RSSR_SPACE_MASK) == YT8521_RSSR_FIBER_SPACE)
++		return YT8521_RSSR_FIBER_SPACE;
++
++	return YT8521_RSSR_UTP_SPACE;
++};
++
++/**
++ * yt8521_write_page() - write reg page
++ * @phydev: a pointer to a &struct phy_device
++ * @page: The reg page(YT8521_RSSR_FIBER_SPACE/YT8521_RSSR_UTP_SPACE) to write.
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_write_page(struct phy_device *phydev, int page)
++{
++	int mask = YT8521_RSSR_SPACE_MASK;
++	int set;
++
++	if ((page & YT8521_RSSR_SPACE_MASK) == YT8521_RSSR_FIBER_SPACE)
++		set = YT8521_RSSR_FIBER_SPACE;
++	else
++		set = YT8521_RSSR_UTP_SPACE;
++
++	return ytphy_modify_ext(phydev, YT8521_REG_SPACE_SELECT_REG, mask, set);
++};
++
++/**
++ * yt8521_probe() - read chip config then set suitable polling_mode
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_probe(struct phy_device *phydev)
++{
++	struct device *dev = &phydev->mdio.dev;
++	struct yt8521_priv *priv;
++	int chip_config;
++	int ret;
++
++	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	phydev->priv = priv;
++
++	chip_config = ytphy_read_ext_with_lock(phydev, YT8521_CHIP_CONFIG_REG);
++	if (chip_config < 0)
++		return chip_config;
++
++	priv->strap_mode = chip_config & YT8521_CCR_MODE_SEL_MASK;
++	switch (priv->strap_mode) {
++	case YT8521_CCR_MODE_FIBER_TO_RGMII:
++	case YT8521_CCR_MODE_SGPHY_TO_RGMAC:
++	case YT8521_CCR_MODE_SGMAC_TO_RGPHY:
++		priv->polling_mode = YT8521_MODE_FIBER;
++		priv->reg_page = YT8521_RSSR_FIBER_SPACE;
++		phydev->port = PORT_FIBRE;
++		break;
++	case YT8521_CCR_MODE_UTP_FIBER_TO_RGMII:
++	case YT8521_CCR_MODE_UTP_TO_FIBER_AUTO:
++	case YT8521_CCR_MODE_UTP_TO_FIBER_FORCE:
++		priv->polling_mode = YT8521_MODE_POLL;
++		priv->reg_page = YT8521_RSSR_TO_BE_ARBITRATED;
++		phydev->port = PORT_NONE;
++		break;
++	case YT8521_CCR_MODE_UTP_TO_SGMII:
++	case YT8521_CCR_MODE_UTP_TO_RGMII:
++		priv->polling_mode = YT8521_MODE_UTP;
++		priv->reg_page = YT8521_RSSR_UTP_SPACE;
++		phydev->port = PORT_TP;
++		break;
++	}
++	/* set default reg space */
++	if (priv->reg_page != YT8521_RSSR_TO_BE_ARBITRATED) {
++		ret = ytphy_write_ext_with_lock(phydev,
++						YT8521_REG_SPACE_SELECT_REG,
++						priv->reg_page);
++		if (ret < 0)
++			return ret;
++	}
++
++	return 0;
++}
++
++/**
++ * ytphy_utp_read_lpa() - read LPA then setup lp_advertising for utp
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * NOTE:The caller must have taken the MDIO bus lock.
++ *
++ * returns 0 or negative errno code
++ */
++static int ytphy_utp_read_lpa(struct phy_device *phydev)
++{
++	int lpa, lpagb;
++
++	if (phydev->autoneg == AUTONEG_ENABLE) {
++		if (!phydev->autoneg_complete) {
++			mii_stat1000_mod_linkmode_lpa_t(phydev->lp_advertising,
++							0);
++			mii_lpa_mod_linkmode_lpa_t(phydev->lp_advertising, 0);
++			return 0;
++		}
++
++		if (phydev->is_gigabit_capable) {
++			lpagb = __phy_read(phydev, MII_STAT1000);
++			if (lpagb < 0)
++				return lpagb;
++
++			if (lpagb & LPA_1000MSFAIL) {
++				int adv = __phy_read(phydev, MII_CTRL1000);
++
++				if (adv < 0)
++					return adv;
++
++				if (adv & CTL1000_ENABLE_MASTER)
++					phydev_err(phydev, "Master/Slave resolution failed, maybe conflicting manual settings?\n");
++				else
++					phydev_err(phydev, "Master/Slave resolution failed\n");
++				return -ENOLINK;
++			}
++
++			mii_stat1000_mod_linkmode_lpa_t(phydev->lp_advertising,
++							lpagb);
++		}
++
++		lpa = __phy_read(phydev, MII_LPA);
++		if (lpa < 0)
++			return lpa;
++
++		mii_lpa_mod_linkmode_lpa_t(phydev->lp_advertising, lpa);
++	} else {
++		linkmode_zero(phydev->lp_advertising);
++	}
++
++	return 0;
++}
++
++/**
++ * yt8521_adjust_status() - update speed and duplex to phydev. when in fiber
++ * mode, adjust speed and duplex.
++ * @phydev: a pointer to a &struct phy_device
++ * @status: yt8521 status read from YTPHY_SPECIFIC_STATUS_REG
++ * @is_utp: false(yt8521 work in fiber mode) or true(yt8521 work in utp mode)
++ *
++ * NOTE:The caller must have taken the MDIO bus lock.
++ *
++ * returns 0
++ */
++static int yt8521_adjust_status(struct phy_device *phydev, int status,
++				bool is_utp)
++{
++	int speed_mode, duplex;
++	int speed;
++	int err;
++	int lpa;
++
++	if (is_utp)
++		duplex = (status & YTPHY_SSR_DUPLEX) >> YTPHY_SSR_DUPLEX_OFFSET;
++	else
++		duplex = DUPLEX_FULL;	/* for fiber, it always DUPLEX_FULL */
++
++	speed_mode = (status & YTPHY_SSR_SPEED_MODE_MASK) >>
++		     YTPHY_SSR_SPEED_MODE_OFFSET;
++
++	switch (speed_mode) {
++	case YTPHY_SSR_SPEED_10M:
++		if (is_utp)
++			speed = SPEED_10;
++		else
++			/* for fiber, it will never run here, default to
++			 * SPEED_UNKNOWN
++			 */
++			speed = SPEED_UNKNOWN;
++		break;
++	case YTPHY_SSR_SPEED_100M:
++		speed = SPEED_100;
++		break;
++	case YTPHY_SSR_SPEED_1000M:
++		speed = SPEED_1000;
++		break;
++	default:
++		speed = SPEED_UNKNOWN;
++		break;
++	}
++
++	phydev->speed = speed;
++	phydev->duplex = duplex;
++
++	if (is_utp) {
++		err = ytphy_utp_read_lpa(phydev);
++		if (err < 0)
++			return err;
++
++		phy_resolve_aneg_pause(phydev);
++	} else {
++		lpa = __phy_read(phydev, MII_LPA);
++		if (lpa < 0)
++			return lpa;
++
++		/* only support 1000baseX Full */
++		linkmode_mod_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT,
++				 phydev->lp_advertising, lpa & LPA_1000XFULL);
++
++		if (!(lpa & YTPHY_FLPA_PAUSE)) {
++			phydev->pause = 0;
++			phydev->asym_pause = 0;
++		} else if ((lpa & YTPHY_FLPA_ASYM_PAUSE)) {
++			phydev->pause = 1;
++			phydev->asym_pause = 1;
++		} else {
++			phydev->pause = 1;
++			phydev->asym_pause = 0;
++		}
++	}
++
++	return 0;
++}
++
++/**
++ * yt8521_read_status_paged() -  determines the speed and duplex of one page
++ * @phydev: a pointer to a &struct phy_device
++ * @page: The reg page(YT8521_RSSR_FIBER_SPACE/YT8521_RSSR_UTP_SPACE) to
++ * operate.
++ *
++ * returns 1 (utp or fiber link),0 (no link) or negative errno code
++ */
++static int yt8521_read_status_paged(struct phy_device *phydev, int page)
++{
++	int fiber_latch_val;
++	int fiber_curr_val;
++	int old_page;
++	int ret = 0;
++	int status;
++	int link;
++
++	linkmode_zero(phydev->lp_advertising);
++	phydev->duplex = DUPLEX_UNKNOWN;
++	phydev->speed = SPEED_UNKNOWN;
++	phydev->asym_pause = 0;
++	phydev->pause = 0;
++
++	/* YT8521 has two reg space (utp/fiber) for linkup with utp/fiber
++	 * respectively. but for utp/fiber combo mode, reg space should be
++	 * arbitrated based on media priority. by default, utp takes
++	 * priority. reg space should be properly set before read
++	 * YTPHY_SPECIFIC_STATUS_REG.
++	 */
++
++	page &= YT8521_RSSR_SPACE_MASK;
++	old_page = phy_select_page(phydev, page);
++	if (old_page < 0)
++		goto err_restore_page;
++
++	/* Read YTPHY_SPECIFIC_STATUS_REG, which indicates the speed and duplex
++	 * of the PHY is actually using.
++	 */
++	ret = __phy_read(phydev, YTPHY_SPECIFIC_STATUS_REG);
++	if (ret < 0)
++		goto err_restore_page;
++
++	status = ret;
++	link = !!(status & YTPHY_SSR_LINK);
++
++	/* When PHY is in fiber mode, speed transferred from 1000Mbps to
++	 * 100Mbps,there is not link down from YTPHY_SPECIFIC_STATUS_REG, so
++	 * we need check MII_BMSR to identify such case.
++	 */
++	if (page == YT8521_RSSR_FIBER_SPACE) {
++		ret = __phy_read(phydev, MII_BMSR);
++		if (ret < 0)
++			goto err_restore_page;
++
++		fiber_latch_val = ret;
++		ret = __phy_read(phydev, MII_BMSR);
++		if (ret < 0)
++			goto err_restore_page;
++
++		fiber_curr_val = ret;
++		if (link && fiber_latch_val != fiber_curr_val) {
++			link = 0;
++			phydev_info(phydev,
++				    "%s, fiber link down detect, latch = %04x, curr = %04x\n",
++				    __func__, fiber_latch_val, fiber_curr_val);
++		}
++	} else {
++		/* Read autonegotiation status */
++		ret = __phy_read(phydev, MII_BMSR);
++		if (ret < 0)
++			goto err_restore_page;
++
++		phydev->autoneg_complete = ret & BMSR_ANEGCOMPLETE ? 1 : 0;
++	}
++
++	if (link) {
++		if (page == YT8521_RSSR_UTP_SPACE)
++			yt8521_adjust_status(phydev, status, true);
++		else
++			yt8521_adjust_status(phydev, status, false);
++	}
++	return phy_restore_page(phydev, old_page, link);
++
++err_restore_page:
++	return phy_restore_page(phydev, old_page, ret);
++}
++
++/**
++ * yt8521_read_status() -  determines the negotiated speed and duplex
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_read_status(struct phy_device *phydev)
++{
++	struct yt8521_priv *priv = phydev->priv;
++	int link_fiber = 0;
++	int link_utp;
++	int link;
++	int ret;
++
++	if (priv->reg_page != YT8521_RSSR_TO_BE_ARBITRATED) {
++		link = yt8521_read_status_paged(phydev, priv->reg_page);
++		if (link < 0)
++			return link;
++	} else {
++		/* when page is YT8521_RSSR_TO_BE_ARBITRATED, arbitration is
++		 * needed. by default, utp is higher priority.
++		 */
++
++		link_utp = yt8521_read_status_paged(phydev,
++						    YT8521_RSSR_UTP_SPACE);
++		if (link_utp < 0)
++			return link_utp;
++
++		if (!link_utp) {
++			link_fiber = yt8521_read_status_paged(phydev,
++							      YT8521_RSSR_FIBER_SPACE);
++			if (link_fiber < 0)
++				return link_fiber;
++		}
++
++		link = link_utp || link_fiber;
++	}
++
++	if (link) {
++		if (phydev->link == 0) {
++			/* arbitrate reg space based on linkup media type. */
++			if (priv->polling_mode == YT8521_MODE_POLL &&
++			    priv->reg_page == YT8521_RSSR_TO_BE_ARBITRATED) {
++				if (link_fiber)
++					priv->reg_page =
++						YT8521_RSSR_FIBER_SPACE;
++				else
++					priv->reg_page = YT8521_RSSR_UTP_SPACE;
++
++				ret = ytphy_write_ext_with_lock(phydev,
++								YT8521_REG_SPACE_SELECT_REG,
++								priv->reg_page);
++				if (ret < 0)
++					return ret;
++
++				phydev->port = link_fiber ? PORT_FIBRE : PORT_TP;
++
++				phydev_info(phydev, "%s, link up, media: %s\n",
++					    __func__,
++					    (phydev->port == PORT_TP) ?
++					    "UTP" : "Fiber");
++			}
++		}
++		phydev->link = 1;
++	} else {
++		if (phydev->link == 1) {
++			phydev_info(phydev, "%s, link down, media: %s\n",
++				    __func__, (phydev->port == PORT_TP) ?
++				    "UTP" : "Fiber");
++
++			/* When in YT8521_MODE_POLL mode, need prepare for next
++			 * arbitration.
++			 */
++			if (priv->polling_mode == YT8521_MODE_POLL) {
++				priv->reg_page = YT8521_RSSR_TO_BE_ARBITRATED;
++				phydev->port = PORT_NONE;
++			}
++		}
++
++		phydev->link = 0;
++	}
++
++	return 0;
++}
++
++/**
++ * yt8521_modify_bmcr_paged - bits modify a PHY's BMCR register of one page
++ * @phydev: the phy_device struct
++ * @page: The reg page(YT8521_RSSR_FIBER_SPACE/YT8521_RSSR_UTP_SPACE) to operate
++ * @mask: bit mask of bits to clear
++ * @set: bit mask of bits to set
++ *
++ * NOTE: Convenience function which allows a PHY's BMCR register to be
++ * modified as new register value = (old register value & ~mask) | set.
++ * YT8521 has two space (utp/fiber) and three mode (utp/fiber/poll), each space
++ * has MII_BMCR. poll mode combines utp and faber,so need do both.
++ * If it is reset, it will wait for completion.
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_modify_bmcr_paged(struct phy_device *phydev, int page,
++				    u16 mask, u16 set)
++{
++	int max_cnt = 500; /* the max wait time of reset ~ 500 ms */
++	int old_page;
++	int ret = 0;
++
++	old_page = phy_select_page(phydev, page & YT8521_RSSR_SPACE_MASK);
++	if (old_page < 0)
++		goto err_restore_page;
++
++	ret = __phy_modify(phydev, MII_BMCR, mask, set);
++	if (ret < 0)
++		goto err_restore_page;
++
++	/* If it is reset, need to wait for the reset to complete */
++	if (set == BMCR_RESET) {
++		while (max_cnt--) {
++			usleep_range(1000, 1100);
++			ret = __phy_read(phydev, MII_BMCR);
++			if (ret < 0)
++				goto err_restore_page;
++
++			if (!(ret & BMCR_RESET))
++				return phy_restore_page(phydev, old_page, 0);
++		}
++	}
++
++err_restore_page:
++	return phy_restore_page(phydev, old_page, ret);
++}
++
++/**
++ * yt8521_modify_utp_fiber_bmcr - bits modify a PHY's BMCR register
++ * @phydev: the phy_device struct
++ * @mask: bit mask of bits to clear
++ * @set: bit mask of bits to set
++ *
++ * NOTE: Convenience function which allows a PHY's BMCR register to be
++ * modified as new register value = (old register value & ~mask) | set.
++ * YT8521 has two space (utp/fiber) and three mode (utp/fiber/poll), each space
++ * has MII_BMCR. poll mode combines utp and faber,so need do both.
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_modify_utp_fiber_bmcr(struct phy_device *phydev, u16 mask,
++					u16 set)
++{
++	struct yt8521_priv *priv = phydev->priv;
++	int ret;
++
++	if (priv->reg_page != YT8521_RSSR_TO_BE_ARBITRATED) {
++		ret = yt8521_modify_bmcr_paged(phydev, priv->reg_page, mask,
++					       set);
++		if (ret < 0)
++			return ret;
++	} else {
++		ret = yt8521_modify_bmcr_paged(phydev, YT8521_RSSR_UTP_SPACE,
++					       mask, set);
++		if (ret < 0)
++			return ret;
++
++		ret = yt8521_modify_bmcr_paged(phydev, YT8521_RSSR_FIBER_SPACE,
++					       mask, set);
++		if (ret < 0)
++			return ret;
++	}
++	return 0;
++}
++
++/**
++ * yt8521_soft_reset() - called to issue a PHY software reset
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_soft_reset(struct phy_device *phydev)
++{
++	return yt8521_modify_utp_fiber_bmcr(phydev, 0, BMCR_RESET);
++}
++
++/**
++ * yt8521_suspend() - suspend the hardware
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_suspend(struct phy_device *phydev)
++{
++	int wol_config;
++
++	/* YTPHY_WOL_CONFIG_REG is common ext reg */
++	wol_config = ytphy_read_ext_with_lock(phydev, YTPHY_WOL_CONFIG_REG);
++	if (wol_config < 0)
++		return wol_config;
++
++	/* if wol enable, do nothing */
++	if (wol_config & YTPHY_WCR_ENABLE)
++		return 0;
++
++	return yt8521_modify_utp_fiber_bmcr(phydev, 0, BMCR_PDOWN);
++}
++
++/**
++ * yt8521_resume() - resume the hardware
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_resume(struct phy_device *phydev)
++{
++	int ret;
++	int wol_config;
++
++	/* disable auto sleep */
++	ret = ytphy_modify_ext_with_lock(phydev,
++					 YT8521_EXTREG_SLEEP_CONTROL1_REG,
++					 YT8521_ESC1R_SLEEP_SW, 0);
++	if (ret < 0)
++		return ret;
++
++	wol_config = ytphy_read_ext_with_lock(phydev, YTPHY_WOL_CONFIG_REG);
++	if (wol_config < 0)
++		return wol_config;
++
++	/* if wol enable, do nothing */
++	if (wol_config & YTPHY_WCR_ENABLE)
++		return 0;
++
++	return yt8521_modify_utp_fiber_bmcr(phydev, BMCR_PDOWN, 0);
++}
++
++/**
++ * yt8521_config_init() - called to initialize the PHY
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_config_init(struct phy_device *phydev)
++{
++	int old_page;
++	int ret = 0;
++	u16 val;
++
++	old_page = phy_select_page(phydev, YT8521_RSSR_UTP_SPACE);
++	if (old_page < 0)
++		goto err_restore_page;
++
++	switch (phydev->interface) {
++	case PHY_INTERFACE_MODE_RGMII:
++		val = YT8521_RC1R_GE_TX_DELAY_DIS | YT8521_RC1R_GE_TX_DELAY_DIS;
++		val |= YT8521_RC1R_RX_DELAY_DIS;
++		break;
++	case PHY_INTERFACE_MODE_RGMII_RXID:
++		val = YT8521_RC1R_GE_TX_DELAY_DIS | YT8521_RC1R_GE_TX_DELAY_DIS;
++		val |= YT8521_RC1R_RX_DELAY_EN;
++		break;
++	case PHY_INTERFACE_MODE_RGMII_TXID:
++		val = YT8521_RC1R_GE_TX_DELAY_EN | YT8521_RC1R_GE_TX_DELAY_EN;
++		val |= YT8521_RC1R_RX_DELAY_DIS;
++		break;
++	case PHY_INTERFACE_MODE_RGMII_ID:
++		val = YT8521_RC1R_GE_TX_DELAY_EN | YT8521_RC1R_GE_TX_DELAY_EN;
++		val |= YT8521_RC1R_RX_DELAY_EN;
++		break;
++	case PHY_INTERFACE_MODE_SGMII:
++		break;
++	default: /* do not support other modes */
++		ret = -EOPNOTSUPP;
++		goto err_restore_page;
++	}
++
++	/* set rgmii delay mode */
++	if (phydev->interface != PHY_INTERFACE_MODE_SGMII) {
++		ret = ytphy_modify_ext(phydev, YT8521_RGMII_CONFIG1_REG,
++				       (YT8521_RC1R_RX_DELAY_MASK |
++				       YT8521_RC1R_FE_TX_DELAY_MASK |
++				       YT8521_RC1R_GE_TX_DELAY_MASK),
++				       val);
++		if (ret < 0)
++			goto err_restore_page;
++	}
++
++	/* disable auto sleep */
++	ret = ytphy_modify_ext(phydev, YT8521_EXTREG_SLEEP_CONTROL1_REG,
++			       YT8521_ESC1R_SLEEP_SW, 0);
++	if (ret < 0)
++		goto err_restore_page;
++
++	/* enable RXC clock when no wire plug */
++	ret = ytphy_modify_ext(phydev, YT8521_CLOCK_GATING_REG,
++			       YT8521_CGR_RX_CLK_EN, 0);
++	if (ret < 0)
++		goto err_restore_page;
++
++err_restore_page:
++	return phy_restore_page(phydev, old_page, ret);
++}
++
++/**
++ * yt8521_prepare_fiber_features() -  A small helper function that setup
++ * fiber's features.
++ * @phydev: a pointer to a &struct phy_device
++ * @dst: a pointer to store fiber's features
++ */
++static void yt8521_prepare_fiber_features(struct phy_device *phydev,
++					  unsigned long *dst)
++{
++	linkmode_set_bit(ETHTOOL_LINK_MODE_100baseFX_Full_BIT, dst);
++	linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT, dst);
++	linkmode_set_bit(ETHTOOL_LINK_MODE_Autoneg_BIT, dst);
++	linkmode_set_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, dst);
++}
++
++/**
++ * yt8521_fiber_setup_forced - configures/forces speed from @phydev
++ * @phydev: target phy_device struct
++ *
++ * NOTE:The caller must have taken the MDIO bus lock.
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_fiber_setup_forced(struct phy_device *phydev)
++{
++	u16 val;
++	int ret;
++
++	if (phydev->speed == SPEED_1000)
++		val = YTPHY_MCR_FIBER_1000BX;
++	else if (phydev->speed == SPEED_100)
++		val = YTPHY_MCR_FIBER_100FX;
++	else
++		return -EINVAL;
++
++	ret =  __phy_modify(phydev, MII_BMCR, BMCR_ANENABLE, 0);
++	if (ret < 0)
++		return ret;
++
++	/* disable Fiber auto sensing */
++	ret =  ytphy_modify_ext(phydev, YT8521_LINK_TIMER_CFG2_REG,
++				YT8521_LTCR_EN_AUTOSEN, 0);
++	if (ret < 0)
++		return ret;
++
++	ret =  ytphy_modify_ext(phydev, YTPHY_MISC_CONFIG_REG,
++				YTPHY_MCR_FIBER_SPEED_MASK, val);
++	if (ret < 0)
++		return ret;
++
++	return ytphy_modify_ext(phydev, YT8521_CHIP_CONFIG_REG,
++				YT8521_CCR_SW_RST, 0);
++}
++
++/**
++ * ytphy_check_and_restart_aneg - Enable and restart auto-negotiation
++ * @phydev: target phy_device struct
++ * @restart: whether aneg restart is requested
++ *
++ * NOTE:The caller must have taken the MDIO bus lock.
++ *
++ * returns 0 or negative errno code
++ */
++static int ytphy_check_and_restart_aneg(struct phy_device *phydev, bool restart)
++{
++	int ret;
++
++	if (!restart) {
++		/* Advertisement hasn't changed, but maybe aneg was never on to
++		 * begin with?  Or maybe phy was isolated?
++		 */
++		ret = __phy_read(phydev, MII_BMCR);
++		if (ret < 0)
++			return ret;
++
++		if (!(ret & BMCR_ANENABLE) || (ret & BMCR_ISOLATE))
++			restart = true;
++	}
++	/* Enable and Restart Autonegotiation
++	 * Don't isolate the PHY if we're negotiating
++	 */
++	if (restart)
++		return __phy_modify(phydev, MII_BMCR, BMCR_ISOLATE,
++				    BMCR_ANENABLE | BMCR_ANRESTART);
++
++	return 0;
++}
++
++/**
++ * yt8521_fiber_config_aneg - restart auto-negotiation or write
++ * YTPHY_MISC_CONFIG_REG.
++ * @phydev: target phy_device struct
++ *
++ * NOTE:The caller must have taken the MDIO bus lock.
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_fiber_config_aneg(struct phy_device *phydev)
++{
++	int err, changed = 0;
++	int bmcr;
++	u16 adv;
++
++	if (phydev->autoneg != AUTONEG_ENABLE)
++		return yt8521_fiber_setup_forced(phydev);
++
++	/* enable Fiber auto sensing */
++	err =  ytphy_modify_ext(phydev, YT8521_LINK_TIMER_CFG2_REG,
++				0, YT8521_LTCR_EN_AUTOSEN);
++	if (err < 0)
++		return err;
++
++	err =  ytphy_modify_ext(phydev, YT8521_CHIP_CONFIG_REG,
++				YT8521_CCR_SW_RST, 0);
++	if (err < 0)
++		return err;
++
++	bmcr = __phy_read(phydev, MII_BMCR);
++	if (bmcr < 0)
++		return bmcr;
++
++	/* When it is coming from fiber forced mode, add bmcr power down
++	 * and power up to let aneg work fine.
++	 */
++	if (!(bmcr & BMCR_ANENABLE)) {
++		__phy_modify(phydev, MII_BMCR, 0, BMCR_PDOWN);
++		usleep_range(1000, 1100);
++		__phy_modify(phydev, MII_BMCR, BMCR_PDOWN, 0);
++	}
++
++	adv = linkmode_adv_to_mii_adv_x(phydev->advertising,
++					ETHTOOL_LINK_MODE_1000baseX_Full_BIT);
++
++	/* Setup fiber advertisement */
++	err = __phy_modify_changed(phydev, MII_ADVERTISE,
++				   ADVERTISE_1000XHALF | ADVERTISE_1000XFULL |
++				   ADVERTISE_1000XPAUSE |
++				   ADVERTISE_1000XPSE_ASYM,
++				   adv);
++	if (err < 0)
++		return err;
++
++	if (err > 0)
++		changed = 1;
++
++	return ytphy_check_and_restart_aneg(phydev, changed);
++}
++
++/**
++ * ytphy_setup_master_slave
++ * @phydev: target phy_device struct
++ *
++ * NOTE: The caller must have taken the MDIO bus lock.
++ *
++ * returns 0 or negative errno code
++ */
++static int ytphy_setup_master_slave(struct phy_device *phydev)
++{
++	u16 ctl = 0;
++
++	if (!phydev->is_gigabit_capable)
++		return 0;
++
++	switch (phydev->master_slave_set) {
++	case MASTER_SLAVE_CFG_MASTER_PREFERRED:
++		ctl |= CTL1000_PREFER_MASTER;
++		break;
++	case MASTER_SLAVE_CFG_SLAVE_PREFERRED:
++		break;
++	case MASTER_SLAVE_CFG_MASTER_FORCE:
++		ctl |= CTL1000_AS_MASTER;
++		fallthrough;
++	case MASTER_SLAVE_CFG_SLAVE_FORCE:
++		ctl |= CTL1000_ENABLE_MASTER;
++		break;
++	case MASTER_SLAVE_CFG_UNKNOWN:
++	case MASTER_SLAVE_CFG_UNSUPPORTED:
++		return 0;
++	default:
++		phydev_warn(phydev, "Unsupported Master/Slave mode\n");
++		return -EOPNOTSUPP;
++	}
++
++	return __phy_modify_changed(phydev, MII_CTRL1000,
++				    (CTL1000_ENABLE_MASTER | CTL1000_AS_MASTER |
++				    CTL1000_PREFER_MASTER), ctl);
++}
++
++/**
++ * ytphy_utp_config_advert - sanitize and advertise auto-negotiation parameters
++ * @phydev: target phy_device struct
++ *
++ * NOTE: Writes MII_ADVERTISE with the appropriate values,
++ * after sanitizing the values to make sure we only advertise
++ * what is supported.  Returns < 0 on error, 0 if the PHY's advertisement
++ * hasn't changed, and > 0 if it has changed.
++ * The caller must have taken the MDIO bus lock.
++ *
++ * returns 0 or negative errno code
++ */
++static int ytphy_utp_config_advert(struct phy_device *phydev)
++{
++	int err, bmsr, changed = 0;
++	u32 adv;
++
++	/* Only allow advertising what this PHY supports */
++	linkmode_and(phydev->advertising, phydev->advertising,
++		     phydev->supported);
++
++	adv = linkmode_adv_to_mii_adv_t(phydev->advertising);
++
++	/* Setup standard advertisement */
++	err = __phy_modify_changed(phydev, MII_ADVERTISE,
++				   ADVERTISE_ALL | ADVERTISE_100BASE4 |
++				   ADVERTISE_PAUSE_CAP | ADVERTISE_PAUSE_ASYM,
++				   adv);
++	if (err < 0)
++		return err;
++	if (err > 0)
++		changed = 1;
++
++	bmsr = __phy_read(phydev, MII_BMSR);
++	if (bmsr < 0)
++		return bmsr;
++
++	/* Per 802.3-2008, Section 22.2.4.2.16 Extended status all
++	 * 1000Mbits/sec capable PHYs shall have the BMSR_ESTATEN bit set to a
++	 * logical 1.
++	 */
++	if (!(bmsr & BMSR_ESTATEN))
++		return changed;
++
++	adv = linkmode_adv_to_mii_ctrl1000_t(phydev->advertising);
++
++	err = __phy_modify_changed(phydev, MII_CTRL1000,
++				   ADVERTISE_1000FULL | ADVERTISE_1000HALF,
++				   adv);
++	if (err < 0)
++		return err;
++	if (err > 0)
++		changed = 1;
++
++	return changed;
++}
++
++/**
++ * ytphy_utp_config_aneg - restart auto-negotiation or write BMCR
++ * @phydev: target phy_device struct
++ * @changed: whether autoneg is requested
++ *
++ * NOTE: If auto-negotiation is enabled, we configure the
++ * advertising, and then restart auto-negotiation.  If it is not
++ * enabled, then we write the BMCR.
++ * The caller must have taken the MDIO bus lock.
++ *
++ * returns 0 or negative errno code
++ */
++static int ytphy_utp_config_aneg(struct phy_device *phydev, bool changed)
++{
++	int err;
++	u16 ctl;
++
++	err = ytphy_setup_master_slave(phydev);
++	if (err < 0)
++		return err;
++	else if (err)
++		changed = true;
++
++	if (phydev->autoneg != AUTONEG_ENABLE) {
++		/* configures/forces speed/duplex from @phydev */
++
++		ctl = mii_bmcr_encode_fixed(phydev->speed, phydev->duplex);
++
++		return __phy_modify(phydev, MII_BMCR, ~(BMCR_LOOPBACK |
++				    BMCR_ISOLATE | BMCR_PDOWN), ctl);
++	}
++
++	err = ytphy_utp_config_advert(phydev);
++	if (err < 0) /* error */
++		return err;
++	else if (err)
++		changed = true;
++
++	return ytphy_check_and_restart_aneg(phydev, changed);
++}
++
++/**
++ * yt8521_config_aneg_paged() - switch reg space then call genphy_config_aneg
++ * of one page
++ * @phydev: a pointer to a &struct phy_device
++ * @page: The reg page(YT8521_RSSR_FIBER_SPACE/YT8521_RSSR_UTP_SPACE) to
++ * operate.
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_config_aneg_paged(struct phy_device *phydev, int page)
++{
++	__ETHTOOL_DECLARE_LINK_MODE_MASK(fiber_supported);
++	struct yt8521_priv *priv = phydev->priv;
++	int old_page;
++	int ret = 0;
++
++	page &= YT8521_RSSR_SPACE_MASK;
++
++	old_page = phy_select_page(phydev, page);
++	if (old_page < 0)
++		goto err_restore_page;
++
++	/* If reg_page is YT8521_RSSR_TO_BE_ARBITRATED,
++	 * phydev->advertising should be updated.
++	 */
++	if (priv->reg_page == YT8521_RSSR_TO_BE_ARBITRATED) {
++		linkmode_zero(fiber_supported);
++		yt8521_prepare_fiber_features(phydev, fiber_supported);
++
++		/* prepare fiber_supported, then setup advertising. */
++		if (page == YT8521_RSSR_FIBER_SPACE) {
++			linkmode_set_bit(ETHTOOL_LINK_MODE_Pause_BIT,
++					 fiber_supported);
++			linkmode_set_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT,
++					 fiber_supported);
++			linkmode_and(phydev->advertising,
++				     priv->combo_advertising, fiber_supported);
++		} else {
++			/* ETHTOOL_LINK_MODE_Autoneg_BIT is also used in utp */
++			linkmode_clear_bit(ETHTOOL_LINK_MODE_Autoneg_BIT,
++					   fiber_supported);
++			linkmode_andnot(phydev->advertising,
++					priv->combo_advertising,
++					fiber_supported);
++		}
++	}
++
++	if (page == YT8521_RSSR_FIBER_SPACE)
++		ret = yt8521_fiber_config_aneg(phydev);
++	else
++		ret = ytphy_utp_config_aneg(phydev, false);
++
++err_restore_page:
++	return phy_restore_page(phydev, old_page, ret);
++}
++
++/**
++ * yt8521_config_aneg() - change reg space then call yt8521_config_aneg_paged
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_config_aneg(struct phy_device *phydev)
++{
++	struct yt8521_priv *priv = phydev->priv;
++	int ret;
++
++	if (priv->reg_page != YT8521_RSSR_TO_BE_ARBITRATED) {
++		ret = yt8521_config_aneg_paged(phydev, priv->reg_page);
++		if (ret < 0)
++			return ret;
++	} else {
++		/* If reg_page is YT8521_RSSR_TO_BE_ARBITRATED,
++		 * phydev->advertising need to be saved at first run.
++		 * Because it contains the advertising which supported by both
++		 * mac and yt8521(utp and fiber).
++		 */
++		if (linkmode_empty(priv->combo_advertising)) {
++			linkmode_copy(priv->combo_advertising,
++				      phydev->advertising);
++		}
++
++		ret = yt8521_config_aneg_paged(phydev, YT8521_RSSR_UTP_SPACE);
++		if (ret < 0)
++			return ret;
++
++		ret = yt8521_config_aneg_paged(phydev, YT8521_RSSR_FIBER_SPACE);
++		if (ret < 0)
++			return ret;
++
++		/* we don't known which will be link, so restore
++		 * phydev->advertising as default value.
++		 */
++		linkmode_copy(phydev->advertising, priv->combo_advertising);
++	}
++	return 0;
++}
++
++/**
++ * yt8521_aneg_done_paged() - determines the auto negotiation result of one
++ * page.
++ * @phydev: a pointer to a &struct phy_device
++ * @page: The reg page(YT8521_RSSR_FIBER_SPACE/YT8521_RSSR_UTP_SPACE) to
++ * operate.
++ *
++ * returns 0(no link)or 1(fiber or utp link) or negative errno code
++ */
++static int yt8521_aneg_done_paged(struct phy_device *phydev, int page)
++{
++	int old_page;
++	int ret = 0;
++	int link;
++
++	old_page = phy_select_page(phydev, page & YT8521_RSSR_SPACE_MASK);
++	if (old_page < 0)
++		goto err_restore_page;
++
++	ret = __phy_read(phydev, YTPHY_SPECIFIC_STATUS_REG);
++	if (ret < 0)
++		goto err_restore_page;
++
++	link = !!(ret & YTPHY_SSR_LINK);
++	ret = link;
++
++err_restore_page:
++	return phy_restore_page(phydev, old_page, ret);
++}
++
++/**
++ * yt8521_aneg_done() - determines the auto negotiation result
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * returns 0(no link)or 1(fiber or utp link) or negative errno code
++ */
++static int yt8521_aneg_done(struct phy_device *phydev)
++{
++	struct yt8521_priv *priv = phydev->priv;
++	int link_fiber = 0;
++	int link_utp;
++	int link;
++
++	if (priv->reg_page != YT8521_RSSR_TO_BE_ARBITRATED) {
++		link = yt8521_aneg_done_paged(phydev, priv->reg_page);
++	} else {
++		link_utp = yt8521_aneg_done_paged(phydev,
++						  YT8521_RSSR_UTP_SPACE);
++		if (link_utp < 0)
++			return link_utp;
++
++		if (!link_utp) {
++			link_fiber = yt8521_aneg_done_paged(phydev,
++							    YT8521_RSSR_FIBER_SPACE);
++			if (link_fiber < 0)
++				return link_fiber;
++		}
++		link = link_fiber || link_utp;
++		phydev_info(phydev, "%s, link_fiber: %d, link_utp: %d\n",
++			    __func__, link_fiber, link_utp);
++	}
++
++	return link;
++}
++
++/**
++ * ytphy_utp_read_abilities - read PHY abilities from Clause 22 registers
++ * @phydev: target phy_device struct
++ *
++ * NOTE: Reads the PHY's abilities and populates
++ * phydev->supported accordingly.
++ * The caller must have taken the MDIO bus lock.
++ *
++ * returns 0 or negative errno code
++ */
++static int ytphy_utp_read_abilities(struct phy_device *phydev)
++{
++	int val;
++
++	linkmode_set_bit_array(phy_basic_ports_array,
++			       ARRAY_SIZE(phy_basic_ports_array),
++			       phydev->supported);
++
++	val = __phy_read(phydev, MII_BMSR);
++	if (val < 0)
++		return val;
++
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_Autoneg_BIT, phydev->supported,
++			 val & BMSR_ANEGCAPABLE);
++
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_100baseT_Full_BIT, phydev->supported,
++			 val & BMSR_100FULL);
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_100baseT_Half_BIT, phydev->supported,
++			 val & BMSR_100HALF);
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_10baseT_Full_BIT, phydev->supported,
++			 val & BMSR_10FULL);
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_10baseT_Half_BIT, phydev->supported,
++			 val & BMSR_10HALF);
++
++	if (val & BMSR_ESTATEN) {
++		val = __phy_read(phydev, MII_ESTATUS);
++		if (val < 0)
++			return val;
++
++		linkmode_mod_bit(ETHTOOL_LINK_MODE_1000baseT_Full_BIT,
++				 phydev->supported, val & ESTATUS_1000_TFULL);
++		linkmode_mod_bit(ETHTOOL_LINK_MODE_1000baseT_Half_BIT,
++				 phydev->supported, val & ESTATUS_1000_THALF);
++		linkmode_mod_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT,
++				 phydev->supported, val & ESTATUS_1000_XFULL);
++	}
++
++	return 0;
++}
++
++/**
++ * yt8521_get_features_paged() -  read supported link modes for one page
++ * @phydev: a pointer to a &struct phy_device
++ * @page: The reg page(YT8521_RSSR_FIBER_SPACE/YT8521_RSSR_UTP_SPACE) to
++ * operate.
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_get_features_paged(struct phy_device *phydev, int page)
++{
++	int old_page;
++	int ret = 0;
++
++	page &= YT8521_RSSR_SPACE_MASK;
++	old_page = phy_select_page(phydev, page);
++	if (old_page < 0)
++		goto err_restore_page;
++
++	if (page == YT8521_RSSR_FIBER_SPACE) {
++		linkmode_zero(phydev->supported);
++		yt8521_prepare_fiber_features(phydev, phydev->supported);
++	} else {
++		ret = ytphy_utp_read_abilities(phydev);
++		if (ret < 0)
++			goto err_restore_page;
++	}
++
++err_restore_page:
++	return phy_restore_page(phydev, old_page, ret);
++}
++
++/**
++ * yt8521_get_features - switch reg space then call yt8521_get_features_paged
++ * @phydev: target phy_device struct
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8521_get_features(struct phy_device *phydev)
++{
++	struct yt8521_priv *priv = phydev->priv;
++	int ret;
++
++	if (priv->reg_page != YT8521_RSSR_TO_BE_ARBITRATED) {
++		ret = yt8521_get_features_paged(phydev, priv->reg_page);
++	} else {
++		ret = yt8521_get_features_paged(phydev,
++						YT8521_RSSR_UTP_SPACE);
++		if (ret < 0)
++			return ret;
++
++		/* add fiber's features to phydev->supported */
++		yt8521_prepare_fiber_features(phydev, phydev->supported);
++	}
++	return ret;
++}
++
+ static struct phy_driver motorcomm_phy_drvs[] = {
+ 	{
+ 		PHY_ID_MATCH_EXACT(PHY_ID_YT8511),
+@@ -121,16 +1733,35 @@ static struct phy_driver motorcomm_phy_d
+ 		.read_page	= yt8511_read_page,
+ 		.write_page	= yt8511_write_page,
+ 	},
++	{
++		PHY_ID_MATCH_EXACT(PHY_ID_YT8521),
++		.name		= "YT8521 Gigabit Ethernet",
++		.get_features	= yt8521_get_features,
++		.probe		= yt8521_probe,
++		.read_page	= yt8521_read_page,
++		.write_page	= yt8521_write_page,
++		.get_wol	= ytphy_get_wol,
++		.set_wol	= ytphy_set_wol,
++		.config_aneg	= yt8521_config_aneg,
++		.aneg_done	= yt8521_aneg_done,
++		.config_init	= yt8521_config_init,
++		.read_status	= yt8521_read_status,
++		.soft_reset	= yt8521_soft_reset,
++		.suspend	= yt8521_suspend,
++		.resume		= yt8521_resume,
++	},
+ };
+ 
+ module_phy_driver(motorcomm_phy_drvs);
+ 
+-MODULE_DESCRIPTION("Motorcomm PHY driver");
++MODULE_DESCRIPTION("Motorcomm 8511/8521 PHY driver");
+ MODULE_AUTHOR("Peter Geis");
++MODULE_AUTHOR("Frank");
+ MODULE_LICENSE("GPL");
+ 
+ static const struct mdio_device_id __maybe_unused motorcomm_tbl[] = {
+ 	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8511) },
++	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8521) },
+ 	{ /* sentinal */ }
+ };
+ 
diff --git a/target/linux/generic/backport-6.1/791-v6.2-02-net-phy-fix-yt8521-duplicated-argument-to-or.patch b/target/linux/generic/backport-6.1/791-v6.2-02-net-phy-fix-yt8521-duplicated-argument-to-or.patch
new file mode 100644
index 00000000000000..cce71c8d84bfd7
--- /dev/null
+++ b/target/linux/generic/backport-6.1/791-v6.2-02-net-phy-fix-yt8521-duplicated-argument-to-or.patch
@@ -0,0 +1,49 @@
+From 4e0243e7128c9b25ea2739136076a95d6adaba5e Mon Sep 17 00:00:00 2001
+From: Frank <Frank.Sae@motor-comm.com>
+Date: Fri, 4 Nov 2022 16:44:41 +0800
+Subject: [PATCH] net: phy: fix yt8521 duplicated argument to & or |
+
+cocci warnings: (new ones prefixed by >>)
+>> drivers/net/phy/motorcomm.c:1122:8-35: duplicated argument to & or |
+  drivers/net/phy/motorcomm.c:1126:8-35: duplicated argument to & or |
+  drivers/net/phy/motorcomm.c:1130:8-34: duplicated argument to & or |
+  drivers/net/phy/motorcomm.c:1134:8-34: duplicated argument to & or |
+
+ The second YT8521_RC1R_GE_TX_DELAY_xx should be YT8521_RC1R_FE_TX_DELAY_xx.
+
+Fixes: 70479a40954c ("net: phy: Add driver for Motorcomm yt8521 gigabit ethernet phy")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Julia Lawall <julia.lawall@lip6.fr>
+Signed-off-by: Frank <Frank.Sae@motor-comm.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/motorcomm.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/phy/motorcomm.c
++++ b/drivers/net/phy/motorcomm.c
+@@ -1119,19 +1119,19 @@ static int yt8521_config_init(struct phy
+ 
+ 	switch (phydev->interface) {
+ 	case PHY_INTERFACE_MODE_RGMII:
+-		val = YT8521_RC1R_GE_TX_DELAY_DIS | YT8521_RC1R_GE_TX_DELAY_DIS;
++		val = YT8521_RC1R_GE_TX_DELAY_DIS | YT8521_RC1R_FE_TX_DELAY_DIS;
+ 		val |= YT8521_RC1R_RX_DELAY_DIS;
+ 		break;
+ 	case PHY_INTERFACE_MODE_RGMII_RXID:
+-		val = YT8521_RC1R_GE_TX_DELAY_DIS | YT8521_RC1R_GE_TX_DELAY_DIS;
++		val = YT8521_RC1R_GE_TX_DELAY_DIS | YT8521_RC1R_FE_TX_DELAY_DIS;
+ 		val |= YT8521_RC1R_RX_DELAY_EN;
+ 		break;
+ 	case PHY_INTERFACE_MODE_RGMII_TXID:
+-		val = YT8521_RC1R_GE_TX_DELAY_EN | YT8521_RC1R_GE_TX_DELAY_EN;
++		val = YT8521_RC1R_GE_TX_DELAY_EN | YT8521_RC1R_FE_TX_DELAY_EN;
+ 		val |= YT8521_RC1R_RX_DELAY_DIS;
+ 		break;
+ 	case PHY_INTERFACE_MODE_RGMII_ID:
+-		val = YT8521_RC1R_GE_TX_DELAY_EN | YT8521_RC1R_GE_TX_DELAY_EN;
++		val = YT8521_RC1R_GE_TX_DELAY_EN | YT8521_RC1R_FE_TX_DELAY_EN;
+ 		val |= YT8521_RC1R_RX_DELAY_EN;
+ 		break;
+ 	case PHY_INTERFACE_MODE_SGMII:
diff --git a/target/linux/generic/backport-6.1/791-v6.2-03-net-phy-add-Motorcomm-YT8531S-phy-id.patch b/target/linux/generic/backport-6.1/791-v6.2-03-net-phy-add-Motorcomm-YT8531S-phy-id.patch
new file mode 100644
index 00000000000000..a2f22ee99b6491
--- /dev/null
+++ b/target/linux/generic/backport-6.1/791-v6.2-03-net-phy-add-Motorcomm-YT8531S-phy-id.patch
@@ -0,0 +1,140 @@
+From 813abcd98fb1b2cccf850cdfa092a4bfc50b2363 Mon Sep 17 00:00:00 2001
+From: Frank <Frank.Sae@motor-comm.com>
+Date: Tue, 22 Nov 2022 16:42:32 +0800
+Subject: [PATCH] net: phy: add Motorcomm YT8531S phy id.
+
+We added patch for motorcomm.c to support YT8531S. This patch has
+been tested on AM335x platform which has one YT8531S interface
+card and passed all test cases.
+The tested cases indluding: YT8531S UTP function with support of
+10M/100M/1000M; YT8531S Fiber function with support of 100M/1000M;
+and YT8531S Combo function that supports auto detection of media type.
+
+Since most functions of YT8531S are similar to YT8521 and we reuse some
+codes for YT8521 in the patch file.
+
+Signed-off-by: Frank <Frank.Sae@motor-comm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/Kconfig     |  2 +-
+ drivers/net/phy/motorcomm.c | 52 +++++++++++++++++++++++++++++++++----
+ 2 files changed, 48 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -260,7 +260,7 @@ config MOTORCOMM_PHY
+ 	tristate "Motorcomm PHYs"
+ 	help
+ 	  Enables support for Motorcomm network PHYs.
+-	  Currently supports the YT8511, YT8521 Gigabit Ethernet PHYs.
++	  Currently supports the YT8511, YT8521, YT8531S Gigabit Ethernet PHYs.
+ 
+ config NATIONAL_PHY
+ 	tristate "National Semiconductor PHYs"
+--- a/drivers/net/phy/motorcomm.c
++++ b/drivers/net/phy/motorcomm.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0+
+ /*
+- * Motorcomm 8511/8521 PHY driver.
++ * Motorcomm 8511/8521/8531S PHY driver.
+  *
+  * Author: Peter Geis <pgwipeout@gmail.com>
+  * Author: Frank <Frank.Sae@motor-comm.com>
+@@ -12,9 +12,10 @@
+ #include <linux/phy.h>
+ 
+ #define PHY_ID_YT8511		0x0000010a
+-#define PHY_ID_YT8521				0x0000011A
++#define PHY_ID_YT8521		0x0000011A
++#define PHY_ID_YT8531S		0x4F51E91A
+ 
+-/* YT8521 Register Overview
++/* YT8521/YT8531S Register Overview
+  *	UTP Register space	|	FIBER Register space
+  *  ------------------------------------------------------------
+  * |	UTP MII			|	FIBER MII		|
+@@ -147,7 +148,7 @@
+ #define YT8521_LINK_TIMER_CFG2_REG		0xA5
+ #define YT8521_LTCR_EN_AUTOSEN			BIT(15)
+ 
+-/* 0xA000, 0xA001, 0xA003 ,and 0xA006 ~ 0xA00A  are common ext registers
++/* 0xA000, 0xA001, 0xA003, 0xA006 ~ 0xA00A and 0xA012 are common ext registers
+  * of yt8521 phy. There is no need to switch reg space when operating these
+  * registers.
+  */
+@@ -221,6 +222,9 @@
+  */
+ #define YTPHY_WCR_TYPE_PULSE			BIT(0)
+ 
++#define YT8531S_SYNCE_CFG_REG			0xA012
++#define YT8531S_SCR_SYNCE_ENABLE		BIT(6)
++
+ /* Extended Register  end */
+ 
+ struct yt8521_priv {
+@@ -648,6 +652,26 @@ static int yt8521_probe(struct phy_devic
+ }
+ 
+ /**
++ * yt8531s_probe() - read chip config then set suitable polling_mode
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * returns 0 or negative errno code
++ */
++static int yt8531s_probe(struct phy_device *phydev)
++{
++	int ret;
++
++	/* Disable SyncE clock output by default */
++	ret = ytphy_modify_ext_with_lock(phydev, YT8531S_SYNCE_CFG_REG,
++					 YT8531S_SCR_SYNCE_ENABLE, 0);
++	if (ret < 0)
++		return ret;
++
++	/* same as yt8521_probe */
++	return yt8521_probe(phydev);
++}
++
++/**
+  * ytphy_utp_read_lpa() - read LPA then setup lp_advertising for utp
+  * @phydev: a pointer to a &struct phy_device
+  *
+@@ -1750,11 +1774,28 @@ static struct phy_driver motorcomm_phy_d
+ 		.suspend	= yt8521_suspend,
+ 		.resume		= yt8521_resume,
+ 	},
++	{
++		PHY_ID_MATCH_EXACT(PHY_ID_YT8531S),
++		.name		= "YT8531S Gigabit Ethernet",
++		.get_features	= yt8521_get_features,
++		.probe		= yt8531s_probe,
++		.read_page	= yt8521_read_page,
++		.write_page	= yt8521_write_page,
++		.get_wol	= ytphy_get_wol,
++		.set_wol	= ytphy_set_wol,
++		.config_aneg	= yt8521_config_aneg,
++		.aneg_done	= yt8521_aneg_done,
++		.config_init	= yt8521_config_init,
++		.read_status	= yt8521_read_status,
++		.soft_reset	= yt8521_soft_reset,
++		.suspend	= yt8521_suspend,
++		.resume		= yt8521_resume,
++	},
+ };
+ 
+ module_phy_driver(motorcomm_phy_drvs);
+ 
+-MODULE_DESCRIPTION("Motorcomm 8511/8521 PHY driver");
++MODULE_DESCRIPTION("Motorcomm 8511/8521/8531S PHY driver");
+ MODULE_AUTHOR("Peter Geis");
+ MODULE_AUTHOR("Frank");
+ MODULE_LICENSE("GPL");
+@@ -1762,6 +1803,7 @@ MODULE_LICENSE("GPL");
+ static const struct mdio_device_id __maybe_unused motorcomm_tbl[] = {
+ 	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8511) },
+ 	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8521) },
++	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8531S) },
+ 	{ /* sentinal */ }
+ };
+ 
diff --git a/target/linux/generic/backport-6.1/791-v6.3-04-net-phy-fix-the-spelling-problem-of-Sentinel.patch b/target/linux/generic/backport-6.1/791-v6.3-04-net-phy-fix-the-spelling-problem-of-Sentinel.patch
new file mode 100644
index 00000000000000..94fc32aadb320d
--- /dev/null
+++ b/target/linux/generic/backport-6.1/791-v6.3-04-net-phy-fix-the-spelling-problem-of-Sentinel.patch
@@ -0,0 +1,26 @@
+From 4104a713204d62aca482eebb0c6226d82a0721eb Mon Sep 17 00:00:00 2001
+From: Frank Sae <Frank.Sae@motor-comm.com>
+Date: Sat, 28 Jan 2023 14:35:57 +0800
+Subject: [PATCH] net: phy: fix the spelling problem of Sentinel
+
+CHECK: 'sentinal' may be misspelled - perhaps 'sentinel'?
+
+Signed-off-by: Frank Sae <Frank.Sae@motor-comm.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20230128063558.5850-1-Frank.Sae@motor-comm.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/motorcomm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/phy/motorcomm.c
++++ b/drivers/net/phy/motorcomm.c
+@@ -1804,7 +1804,7 @@ static const struct mdio_device_id __may
+ 	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8511) },
+ 	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8521) },
+ 	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8531S) },
+-	{ /* sentinal */ }
++	{ /* sentinel */ }
+ };
+ 
+ MODULE_DEVICE_TABLE(mdio, motorcomm_tbl);
diff --git a/target/linux/generic/backport-6.1/791-v6.3-05-net-phy-motorcomm-change-the-phy-id-of-yt8521-and-yt8531s.patch b/target/linux/generic/backport-6.1/791-v6.3-05-net-phy-motorcomm-change-the-phy-id-of-yt8521-and-yt8531s.patch
new file mode 100644
index 00000000000000..076fa82d267fce
--- /dev/null
+++ b/target/linux/generic/backport-6.1/791-v6.3-05-net-phy-motorcomm-change-the-phy-id-of-yt8521-and-yt8531s.patch
@@ -0,0 +1,29 @@
+From 3c1dc22162d673d595855d24f95200ed2643f88f Mon Sep 17 00:00:00 2001
+From: Frank Sae <Frank.Sae@motor-comm.com>
+Date: Sat, 28 Jan 2023 14:35:58 +0800
+Subject: [PATCH] net: phy: motorcomm: change the phy id of yt8521 and yt8531s
+ to lowercase
+
+The phy id is usually defined in lower case.
+
+Signed-off-by: Frank Sae <Frank.Sae@motor-comm.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20230128063558.5850-2-Frank.Sae@motor-comm.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/motorcomm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/phy/motorcomm.c
++++ b/drivers/net/phy/motorcomm.c
+@@ -12,8 +12,8 @@
+ #include <linux/phy.h>
+ 
+ #define PHY_ID_YT8511		0x0000010a
+-#define PHY_ID_YT8521		0x0000011A
+-#define PHY_ID_YT8531S		0x4F51E91A
++#define PHY_ID_YT8521		0x0000011a
++#define PHY_ID_YT8531S		0x4f51e91a
+ 
+ /* YT8521/YT8531S Register Overview
+  *	UTP Register space	|	FIBER Register space
diff --git a/target/linux/generic/backport-6.1/791-v6.3-06-net-phy-Add-BIT-macro-for-Motorcomm-yt8521-yt8531-gigabit.patch b/target/linux/generic/backport-6.1/791-v6.3-06-net-phy-Add-BIT-macro-for-Motorcomm-yt8521-yt8531-gigabit.patch
new file mode 100644
index 00000000000000..ba9a6ab4ccba3b
--- /dev/null
+++ b/target/linux/generic/backport-6.1/791-v6.3-06-net-phy-Add-BIT-macro-for-Motorcomm-yt8521-yt8531-gigabit.patch
@@ -0,0 +1,107 @@
+From 4869a146cd60fc8115230f0a45e15e534c531922 Mon Sep 17 00:00:00 2001
+From: Frank Sae <Frank.Sae@motor-comm.com>
+Date: Thu, 2 Feb 2023 11:00:34 +0800
+Subject: [PATCH] net: phy: Add BIT macro for Motorcomm yt8521/yt8531 gigabit
+ ethernet phy
+
+Add BIT macro for Motorcomm yt8521/yt8531 gigabit ethernet phy.
+ This is a preparatory patch. Add BIT macro for 0xA012 reg, and
+ supplement for 0xA001 and 0xA003 reg. These will be used to support dts.
+
+Signed-off-by: Frank Sae <Frank.Sae@motor-comm.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/motorcomm.c | 55 ++++++++++++++++++++++++++++++++++---
+ 1 file changed, 51 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/phy/motorcomm.c
++++ b/drivers/net/phy/motorcomm.c
+@@ -161,6 +161,11 @@
+ 
+ #define YT8521_CHIP_CONFIG_REG			0xA001
+ #define YT8521_CCR_SW_RST			BIT(15)
++/* 1b0 disable 1.9ns rxc clock delay  *default*
++ * 1b1 enable 1.9ns rxc clock delay
++ */
++#define YT8521_CCR_RXC_DLY_EN			BIT(8)
++#define YT8521_CCR_RXC_DLY_1_900_NS		1900
+ 
+ #define YT8521_CCR_MODE_SEL_MASK		(BIT(2) | BIT(1) | BIT(0))
+ #define YT8521_CCR_MODE_UTP_TO_RGMII		0
+@@ -178,22 +183,41 @@
+ #define YT8521_MODE_POLL			0x3
+ 
+ #define YT8521_RGMII_CONFIG1_REG		0xA003
+-
++/* 1b0 use original tx_clk_rgmii  *default*
++ * 1b1 use inverted tx_clk_rgmii.
++ */
++#define YT8521_RC1R_TX_CLK_SEL_INVERTED		BIT(14)
+ /* TX Gig-E Delay is bits 3:0, default 0x1
+  * TX Fast-E Delay is bits 7:4, default 0xf
+  * RX Delay is bits 13:10, default 0x0
+  * Delay = 150ps * N
+  * On = 2250ps, off = 0ps
+  */
+-#define YT8521_RC1R_RX_DELAY_MASK		(0xF << 10)
++#define YT8521_RC1R_RX_DELAY_MASK		GENMASK(13, 10)
+ #define YT8521_RC1R_RX_DELAY_EN			(0xF << 10)
+ #define YT8521_RC1R_RX_DELAY_DIS		(0x0 << 10)
+-#define YT8521_RC1R_FE_TX_DELAY_MASK		(0xF << 4)
++#define YT8521_RC1R_FE_TX_DELAY_MASK		GENMASK(7, 4)
+ #define YT8521_RC1R_FE_TX_DELAY_EN		(0xF << 4)
+ #define YT8521_RC1R_FE_TX_DELAY_DIS		(0x0 << 4)
+-#define YT8521_RC1R_GE_TX_DELAY_MASK		(0xF << 0)
++#define YT8521_RC1R_GE_TX_DELAY_MASK		GENMASK(3, 0)
+ #define YT8521_RC1R_GE_TX_DELAY_EN		(0xF << 0)
+ #define YT8521_RC1R_GE_TX_DELAY_DIS		(0x0 << 0)
++#define YT8521_RC1R_RGMII_0_000_NS		0
++#define YT8521_RC1R_RGMII_0_150_NS		1
++#define YT8521_RC1R_RGMII_0_300_NS		2
++#define YT8521_RC1R_RGMII_0_450_NS		3
++#define YT8521_RC1R_RGMII_0_600_NS		4
++#define YT8521_RC1R_RGMII_0_750_NS		5
++#define YT8521_RC1R_RGMII_0_900_NS		6
++#define YT8521_RC1R_RGMII_1_050_NS		7
++#define YT8521_RC1R_RGMII_1_200_NS		8
++#define YT8521_RC1R_RGMII_1_350_NS		9
++#define YT8521_RC1R_RGMII_1_500_NS		10
++#define YT8521_RC1R_RGMII_1_650_NS		11
++#define YT8521_RC1R_RGMII_1_800_NS		12
++#define YT8521_RC1R_RGMII_1_950_NS		13
++#define YT8521_RC1R_RGMII_2_100_NS		14
++#define YT8521_RC1R_RGMII_2_250_NS		15
+ 
+ #define YTPHY_MISC_CONFIG_REG			0xA006
+ #define YTPHY_MCR_FIBER_SPEED_MASK		BIT(0)
+@@ -222,6 +246,29 @@
+  */
+ #define YTPHY_WCR_TYPE_PULSE			BIT(0)
+ 
++#define YTPHY_SYNCE_CFG_REG			0xA012
++#define YT8521_SCR_SYNCE_ENABLE			BIT(5)
++/* 1b0 output 25m clock
++ * 1b1 output 125m clock  *default*
++ */
++#define YT8521_SCR_CLK_FRE_SEL_125M		BIT(3)
++#define YT8521_SCR_CLK_SRC_MASK			GENMASK(2, 1)
++#define YT8521_SCR_CLK_SRC_PLL_125M		0
++#define YT8521_SCR_CLK_SRC_UTP_RX		1
++#define YT8521_SCR_CLK_SRC_SDS_RX		2
++#define YT8521_SCR_CLK_SRC_REF_25M		3
++#define YT8531_SCR_SYNCE_ENABLE			BIT(6)
++/* 1b0 output 25m clock   *default*
++ * 1b1 output 125m clock
++ */
++#define YT8531_SCR_CLK_FRE_SEL_125M		BIT(4)
++#define YT8531_SCR_CLK_SRC_MASK			GENMASK(3, 1)
++#define YT8531_SCR_CLK_SRC_PLL_125M		0
++#define YT8531_SCR_CLK_SRC_UTP_RX		1
++#define YT8531_SCR_CLK_SRC_SDS_RX		2
++#define YT8531_SCR_CLK_SRC_CLOCK_FROM_DIGITAL	3
++#define YT8531_SCR_CLK_SRC_REF_25M		4
++#define YT8531_SCR_CLK_SRC_SSC_25M		5
+ #define YT8531S_SYNCE_CFG_REG			0xA012
+ #define YT8531S_SCR_SYNCE_ENABLE		BIT(6)
+ 
diff --git a/target/linux/generic/backport-6.1/791-v6.3-07-net-phy-Add-dts-support-for-Motorcomm-yt8521-gigabit.patch b/target/linux/generic/backport-6.1/791-v6.3-07-net-phy-Add-dts-support-for-Motorcomm-yt8521-gigabit.patch
new file mode 100644
index 00000000000000..6d89fae84ccc2f
--- /dev/null
+++ b/target/linux/generic/backport-6.1/791-v6.3-07-net-phy-Add-dts-support-for-Motorcomm-yt8521-gigabit.patch
@@ -0,0 +1,343 @@
+From a6e68f0f8769f79c67cdcfb6302feecd36197dec Mon Sep 17 00:00:00 2001
+From: Frank Sae <Frank.Sae@motor-comm.com>
+Date: Thu, 2 Feb 2023 11:00:35 +0800
+Subject: [PATCH] net: phy: Add dts support for Motorcomm yt8521 gigabit
+ ethernet phy
+
+Add dts support for Motorcomm yt8521 gigabit ethernet phy.
+ Add ytphy_rgmii_clk_delay_config function to support dst config for
+ the delay of rgmii clk. This funciont is common for yt8521, yt8531s
+ and yt8531.
+ This patch has been verified on AM335x platform.
+
+Signed-off-by: Frank Sae <Frank.Sae@motor-comm.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/motorcomm.c | 253 ++++++++++++++++++++++++++++--------
+ 1 file changed, 199 insertions(+), 54 deletions(-)
+
+--- a/drivers/net/phy/motorcomm.c
++++ b/drivers/net/phy/motorcomm.c
+@@ -10,6 +10,7 @@
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/phy.h>
++#include <linux/of.h>
+ 
+ #define PHY_ID_YT8511		0x0000010a
+ #define PHY_ID_YT8521		0x0000011a
+@@ -187,21 +188,9 @@
+  * 1b1 use inverted tx_clk_rgmii.
+  */
+ #define YT8521_RC1R_TX_CLK_SEL_INVERTED		BIT(14)
+-/* TX Gig-E Delay is bits 3:0, default 0x1
+- * TX Fast-E Delay is bits 7:4, default 0xf
+- * RX Delay is bits 13:10, default 0x0
+- * Delay = 150ps * N
+- * On = 2250ps, off = 0ps
+- */
+ #define YT8521_RC1R_RX_DELAY_MASK		GENMASK(13, 10)
+-#define YT8521_RC1R_RX_DELAY_EN			(0xF << 10)
+-#define YT8521_RC1R_RX_DELAY_DIS		(0x0 << 10)
+ #define YT8521_RC1R_FE_TX_DELAY_MASK		GENMASK(7, 4)
+-#define YT8521_RC1R_FE_TX_DELAY_EN		(0xF << 4)
+-#define YT8521_RC1R_FE_TX_DELAY_DIS		(0x0 << 4)
+ #define YT8521_RC1R_GE_TX_DELAY_MASK		GENMASK(3, 0)
+-#define YT8521_RC1R_GE_TX_DELAY_EN		(0xF << 0)
+-#define YT8521_RC1R_GE_TX_DELAY_DIS		(0x0 << 0)
+ #define YT8521_RC1R_RGMII_0_000_NS		0
+ #define YT8521_RC1R_RGMII_0_150_NS		1
+ #define YT8521_RC1R_RGMII_0_300_NS		2
+@@ -274,6 +263,10 @@
+ 
+ /* Extended Register  end */
+ 
++#define YTPHY_DTS_OUTPUT_CLK_DIS		0
++#define YTPHY_DTS_OUTPUT_CLK_25M		25000000
++#define YTPHY_DTS_OUTPUT_CLK_125M		125000000
++
+ struct yt8521_priv {
+ 	/* combo_advertising is used for case of YT8521 in combo mode,
+ 	 * this means that yt8521 may work in utp or fiber mode which depends
+@@ -641,6 +634,142 @@ static int yt8521_write_page(struct phy_
+ };
+ 
+ /**
++ * struct ytphy_cfg_reg_map - map a config value to a register value
++ * @cfg: value in device configuration
++ * @reg: value in the register
++ */
++struct ytphy_cfg_reg_map {
++	u32 cfg;
++	u32 reg;
++};
++
++static const struct ytphy_cfg_reg_map ytphy_rgmii_delays[] = {
++	/* for tx delay / rx delay with YT8521_CCR_RXC_DLY_EN is not set. */
++	{ 0,	YT8521_RC1R_RGMII_0_000_NS },
++	{ 150,	YT8521_RC1R_RGMII_0_150_NS },
++	{ 300,	YT8521_RC1R_RGMII_0_300_NS },
++	{ 450,	YT8521_RC1R_RGMII_0_450_NS },
++	{ 600,	YT8521_RC1R_RGMII_0_600_NS },
++	{ 750,	YT8521_RC1R_RGMII_0_750_NS },
++	{ 900,	YT8521_RC1R_RGMII_0_900_NS },
++	{ 1050,	YT8521_RC1R_RGMII_1_050_NS },
++	{ 1200,	YT8521_RC1R_RGMII_1_200_NS },
++	{ 1350,	YT8521_RC1R_RGMII_1_350_NS },
++	{ 1500,	YT8521_RC1R_RGMII_1_500_NS },
++	{ 1650,	YT8521_RC1R_RGMII_1_650_NS },
++	{ 1800,	YT8521_RC1R_RGMII_1_800_NS },
++	{ 1950,	YT8521_RC1R_RGMII_1_950_NS },	/* default tx/rx delay */
++	{ 2100,	YT8521_RC1R_RGMII_2_100_NS },
++	{ 2250,	YT8521_RC1R_RGMII_2_250_NS },
++
++	/* only for rx delay with YT8521_CCR_RXC_DLY_EN is set. */
++	{ 0    + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_0_000_NS },
++	{ 150  + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_0_150_NS },
++	{ 300  + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_0_300_NS },
++	{ 450  + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_0_450_NS },
++	{ 600  + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_0_600_NS },
++	{ 750  + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_0_750_NS },
++	{ 900  + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_0_900_NS },
++	{ 1050 + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_1_050_NS },
++	{ 1200 + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_1_200_NS },
++	{ 1350 + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_1_350_NS },
++	{ 1500 + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_1_500_NS },
++	{ 1650 + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_1_650_NS },
++	{ 1800 + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_1_800_NS },
++	{ 1950 + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_1_950_NS },
++	{ 2100 + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_2_100_NS },
++	{ 2250 + YT8521_CCR_RXC_DLY_1_900_NS,	YT8521_RC1R_RGMII_2_250_NS }
++};
++
++static u32 ytphy_get_delay_reg_value(struct phy_device *phydev,
++				     const char *prop_name,
++				     const struct ytphy_cfg_reg_map *tbl,
++				     int tb_size,
++				     u16 *rxc_dly_en,
++				     u32 dflt)
++{
++	struct device_node *node = phydev->mdio.dev.of_node;
++	int tb_size_half = tb_size / 2;
++	u32 val;
++	int i;
++
++	if (of_property_read_u32(node, prop_name, &val))
++		goto err_dts_val;
++
++	/* when rxc_dly_en is NULL, it is get the delay for tx, only half of
++	 * tb_size is valid.
++	 */
++	if (!rxc_dly_en)
++		tb_size = tb_size_half;
++
++	for (i = 0; i < tb_size; i++) {
++		if (tbl[i].cfg == val) {
++			if (rxc_dly_en && i < tb_size_half)
++				*rxc_dly_en = 0;
++			return tbl[i].reg;
++		}
++	}
++
++	phydev_warn(phydev, "Unsupported value %d for %s using default (%u)\n",
++		    val, prop_name, dflt);
++
++err_dts_val:
++	/* when rxc_dly_en is not NULL, it is get the delay for rx.
++	 * The rx default in dts and ytphy_rgmii_clk_delay_config is 1950 ps,
++	 * so YT8521_CCR_RXC_DLY_EN should not be set.
++	 */
++	if (rxc_dly_en)
++		*rxc_dly_en = 0;
++
++	return dflt;
++}
++
++static int ytphy_rgmii_clk_delay_config(struct phy_device *phydev)
++{
++	int tb_size = ARRAY_SIZE(ytphy_rgmii_delays);
++	u16 rxc_dly_en = YT8521_CCR_RXC_DLY_EN;
++	u32 rx_reg, tx_reg;
++	u16 mask, val = 0;
++	int ret;
++
++	rx_reg = ytphy_get_delay_reg_value(phydev, "rx-internal-delay-ps",
++					   ytphy_rgmii_delays, tb_size,
++					   &rxc_dly_en,
++					   YT8521_RC1R_RGMII_1_950_NS);
++	tx_reg = ytphy_get_delay_reg_value(phydev, "tx-internal-delay-ps",
++					   ytphy_rgmii_delays, tb_size, NULL,
++					   YT8521_RC1R_RGMII_1_950_NS);
++
++	switch (phydev->interface) {
++	case PHY_INTERFACE_MODE_RGMII:
++		rxc_dly_en = 0;
++		break;
++	case PHY_INTERFACE_MODE_RGMII_RXID:
++		val |= FIELD_PREP(YT8521_RC1R_RX_DELAY_MASK, rx_reg);
++		break;
++	case PHY_INTERFACE_MODE_RGMII_TXID:
++		rxc_dly_en = 0;
++		val |= FIELD_PREP(YT8521_RC1R_GE_TX_DELAY_MASK, tx_reg);
++		break;
++	case PHY_INTERFACE_MODE_RGMII_ID:
++		val |= FIELD_PREP(YT8521_RC1R_RX_DELAY_MASK, rx_reg) |
++		       FIELD_PREP(YT8521_RC1R_GE_TX_DELAY_MASK, tx_reg);
++		break;
++	default: /* do not support other modes */
++		return -EOPNOTSUPP;
++	}
++
++	ret = ytphy_modify_ext(phydev, YT8521_CHIP_CONFIG_REG,
++			       YT8521_CCR_RXC_DLY_EN, rxc_dly_en);
++	if (ret < 0)
++		return ret;
++
++	/* Generally, it is not necessary to adjust YT8521_RC1R_FE_TX_DELAY */
++	mask = YT8521_RC1R_RX_DELAY_MASK | YT8521_RC1R_GE_TX_DELAY_MASK;
++	return ytphy_modify_ext(phydev, YT8521_RGMII_CONFIG1_REG, mask, val);
++}
++
++/**
+  * yt8521_probe() - read chip config then set suitable polling_mode
+  * @phydev: a pointer to a &struct phy_device
+  *
+@@ -648,9 +777,12 @@ static int yt8521_write_page(struct phy_
+  */
+ static int yt8521_probe(struct phy_device *phydev)
+ {
++	struct device_node *node = phydev->mdio.dev.of_node;
+ 	struct device *dev = &phydev->mdio.dev;
+ 	struct yt8521_priv *priv;
+ 	int chip_config;
++	u16 mask, val;
++	u32 freq;
+ 	int ret;
+ 
+ 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+@@ -695,7 +827,45 @@ static int yt8521_probe(struct phy_devic
+ 			return ret;
+ 	}
+ 
+-	return 0;
++	if (of_property_read_u32(node, "motorcomm,clk-out-frequency-hz", &freq))
++		freq = YTPHY_DTS_OUTPUT_CLK_DIS;
++
++	if (phydev->drv->phy_id == PHY_ID_YT8521) {
++		switch (freq) {
++		case YTPHY_DTS_OUTPUT_CLK_DIS:
++			mask = YT8521_SCR_SYNCE_ENABLE;
++			val = 0;
++			break;
++		case YTPHY_DTS_OUTPUT_CLK_25M:
++			mask = YT8521_SCR_SYNCE_ENABLE |
++			       YT8521_SCR_CLK_SRC_MASK |
++			       YT8521_SCR_CLK_FRE_SEL_125M;
++			val = YT8521_SCR_SYNCE_ENABLE |
++			      FIELD_PREP(YT8521_SCR_CLK_SRC_MASK,
++					 YT8521_SCR_CLK_SRC_REF_25M);
++			break;
++		case YTPHY_DTS_OUTPUT_CLK_125M:
++			mask = YT8521_SCR_SYNCE_ENABLE |
++			       YT8521_SCR_CLK_SRC_MASK |
++			       YT8521_SCR_CLK_FRE_SEL_125M;
++			val = YT8521_SCR_SYNCE_ENABLE |
++			      YT8521_SCR_CLK_FRE_SEL_125M |
++			      FIELD_PREP(YT8521_SCR_CLK_SRC_MASK,
++					 YT8521_SCR_CLK_SRC_PLL_125M);
++			break;
++		default:
++			phydev_warn(phydev, "Freq err:%u\n", freq);
++			return -EINVAL;
++		}
++	} else if (phydev->drv->phy_id == PHY_ID_YT8531S) {
++		return 0;
++	} else {
++		phydev_warn(phydev, "PHY id err\n");
++		return -EINVAL;
++	}
++
++	return ytphy_modify_ext_with_lock(phydev, YTPHY_SYNCE_CFG_REG, mask,
++					  val);
+ }
+ 
+ /**
+@@ -1180,61 +1350,36 @@ static int yt8521_resume(struct phy_devi
+  */
+ static int yt8521_config_init(struct phy_device *phydev)
+ {
++	struct device_node *node = phydev->mdio.dev.of_node;
+ 	int old_page;
+ 	int ret = 0;
+-	u16 val;
+ 
+ 	old_page = phy_select_page(phydev, YT8521_RSSR_UTP_SPACE);
+ 	if (old_page < 0)
+ 		goto err_restore_page;
+ 
+-	switch (phydev->interface) {
+-	case PHY_INTERFACE_MODE_RGMII:
+-		val = YT8521_RC1R_GE_TX_DELAY_DIS | YT8521_RC1R_FE_TX_DELAY_DIS;
+-		val |= YT8521_RC1R_RX_DELAY_DIS;
+-		break;
+-	case PHY_INTERFACE_MODE_RGMII_RXID:
+-		val = YT8521_RC1R_GE_TX_DELAY_DIS | YT8521_RC1R_FE_TX_DELAY_DIS;
+-		val |= YT8521_RC1R_RX_DELAY_EN;
+-		break;
+-	case PHY_INTERFACE_MODE_RGMII_TXID:
+-		val = YT8521_RC1R_GE_TX_DELAY_EN | YT8521_RC1R_FE_TX_DELAY_EN;
+-		val |= YT8521_RC1R_RX_DELAY_DIS;
+-		break;
+-	case PHY_INTERFACE_MODE_RGMII_ID:
+-		val = YT8521_RC1R_GE_TX_DELAY_EN | YT8521_RC1R_FE_TX_DELAY_EN;
+-		val |= YT8521_RC1R_RX_DELAY_EN;
+-		break;
+-	case PHY_INTERFACE_MODE_SGMII:
+-		break;
+-	default: /* do not support other modes */
+-		ret = -EOPNOTSUPP;
+-		goto err_restore_page;
+-	}
+-
+ 	/* set rgmii delay mode */
+ 	if (phydev->interface != PHY_INTERFACE_MODE_SGMII) {
+-		ret = ytphy_modify_ext(phydev, YT8521_RGMII_CONFIG1_REG,
+-				       (YT8521_RC1R_RX_DELAY_MASK |
+-				       YT8521_RC1R_FE_TX_DELAY_MASK |
+-				       YT8521_RC1R_GE_TX_DELAY_MASK),
+-				       val);
++		ret = ytphy_rgmii_clk_delay_config(phydev);
+ 		if (ret < 0)
+ 			goto err_restore_page;
+ 	}
+ 
+-	/* disable auto sleep */
+-	ret = ytphy_modify_ext(phydev, YT8521_EXTREG_SLEEP_CONTROL1_REG,
+-			       YT8521_ESC1R_SLEEP_SW, 0);
+-	if (ret < 0)
+-		goto err_restore_page;
+-
+-	/* enable RXC clock when no wire plug */
+-	ret = ytphy_modify_ext(phydev, YT8521_CLOCK_GATING_REG,
+-			       YT8521_CGR_RX_CLK_EN, 0);
+-	if (ret < 0)
+-		goto err_restore_page;
++	if (of_property_read_bool(node, "motorcomm,auto-sleep-disabled")) {
++		/* disable auto sleep */
++		ret = ytphy_modify_ext(phydev, YT8521_EXTREG_SLEEP_CONTROL1_REG,
++				       YT8521_ESC1R_SLEEP_SW, 0);
++		if (ret < 0)
++			goto err_restore_page;
++	}
+ 
++	if (of_property_read_bool(node, "motorcomm,keep-pll-enabled")) {
++		/* enable RXC clock when no wire plug */
++		ret = ytphy_modify_ext(phydev, YT8521_CLOCK_GATING_REG,
++				       YT8521_CGR_RX_CLK_EN, 0);
++		if (ret < 0)
++			goto err_restore_page;
++	}
+ err_restore_page:
+ 	return phy_restore_page(phydev, old_page, ret);
+ }
diff --git a/target/linux/generic/backport-6.1/791-v6.3-08-net-phy-Add-dts-support-for-Motorcomm-yt8531s-gigabit.patch b/target/linux/generic/backport-6.1/791-v6.3-08-net-phy-Add-dts-support-for-Motorcomm-yt8531s-gigabit.patch
new file mode 100644
index 00000000000000..86fc04695c8ec2
--- /dev/null
+++ b/target/linux/generic/backport-6.1/791-v6.3-08-net-phy-Add-dts-support-for-Motorcomm-yt8531s-gigabit.patch
@@ -0,0 +1,100 @@
+From 36152f87dda4af221b16258751451d9cd3d0fb0b Mon Sep 17 00:00:00 2001
+From: Frank Sae <Frank.Sae@motor-comm.com>
+Date: Thu, 2 Feb 2023 11:00:36 +0800
+Subject: [PATCH] net: phy: Add dts support for Motorcomm yt8531s gigabit
+ ethernet phy
+
+Add dts support for Motorcomm yt8531s gigabit ethernet phy.
+ Change yt8521_probe to support clk config of yt8531s. Becase
+ yt8521_probe does the things which yt8531s is needed, so
+ removed yt8531s function.
+ This patch has been verified on AM335x platform with yt8531s board.
+
+Signed-off-by: Frank Sae <Frank.Sae@motor-comm.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/motorcomm.c | 51 ++++++++++++++++++++-----------------
+ 1 file changed, 27 insertions(+), 24 deletions(-)
+
+--- a/drivers/net/phy/motorcomm.c
++++ b/drivers/net/phy/motorcomm.c
+@@ -258,8 +258,6 @@
+ #define YT8531_SCR_CLK_SRC_CLOCK_FROM_DIGITAL	3
+ #define YT8531_SCR_CLK_SRC_REF_25M		4
+ #define YT8531_SCR_CLK_SRC_SSC_25M		5
+-#define YT8531S_SYNCE_CFG_REG			0xA012
+-#define YT8531S_SCR_SYNCE_ENABLE		BIT(6)
+ 
+ /* Extended Register  end */
+ 
+@@ -858,7 +856,32 @@ static int yt8521_probe(struct phy_devic
+ 			return -EINVAL;
+ 		}
+ 	} else if (phydev->drv->phy_id == PHY_ID_YT8531S) {
+-		return 0;
++		switch (freq) {
++		case YTPHY_DTS_OUTPUT_CLK_DIS:
++			mask = YT8531_SCR_SYNCE_ENABLE;
++			val = 0;
++			break;
++		case YTPHY_DTS_OUTPUT_CLK_25M:
++			mask = YT8531_SCR_SYNCE_ENABLE |
++			       YT8531_SCR_CLK_SRC_MASK |
++			       YT8531_SCR_CLK_FRE_SEL_125M;
++			val = YT8531_SCR_SYNCE_ENABLE |
++			      FIELD_PREP(YT8531_SCR_CLK_SRC_MASK,
++					 YT8531_SCR_CLK_SRC_REF_25M);
++			break;
++		case YTPHY_DTS_OUTPUT_CLK_125M:
++			mask = YT8531_SCR_SYNCE_ENABLE |
++			       YT8531_SCR_CLK_SRC_MASK |
++			       YT8531_SCR_CLK_FRE_SEL_125M;
++			val = YT8531_SCR_SYNCE_ENABLE |
++			      YT8531_SCR_CLK_FRE_SEL_125M |
++			      FIELD_PREP(YT8531_SCR_CLK_SRC_MASK,
++					 YT8531_SCR_CLK_SRC_PLL_125M);
++			break;
++		default:
++			phydev_warn(phydev, "Freq err:%u\n", freq);
++			return -EINVAL;
++		}
+ 	} else {
+ 		phydev_warn(phydev, "PHY id err\n");
+ 		return -EINVAL;
+@@ -869,26 +892,6 @@ static int yt8521_probe(struct phy_devic
+ }
+ 
+ /**
+- * yt8531s_probe() - read chip config then set suitable polling_mode
+- * @phydev: a pointer to a &struct phy_device
+- *
+- * returns 0 or negative errno code
+- */
+-static int yt8531s_probe(struct phy_device *phydev)
+-{
+-	int ret;
+-
+-	/* Disable SyncE clock output by default */
+-	ret = ytphy_modify_ext_with_lock(phydev, YT8531S_SYNCE_CFG_REG,
+-					 YT8531S_SCR_SYNCE_ENABLE, 0);
+-	if (ret < 0)
+-		return ret;
+-
+-	/* same as yt8521_probe */
+-	return yt8521_probe(phydev);
+-}
+-
+-/**
+  * ytphy_utp_read_lpa() - read LPA then setup lp_advertising for utp
+  * @phydev: a pointer to a &struct phy_device
+  *
+@@ -1970,7 +1973,7 @@ static struct phy_driver motorcomm_phy_d
+ 		PHY_ID_MATCH_EXACT(PHY_ID_YT8531S),
+ 		.name		= "YT8531S Gigabit Ethernet",
+ 		.get_features	= yt8521_get_features,
+-		.probe		= yt8531s_probe,
++		.probe		= yt8521_probe,
+ 		.read_page	= yt8521_read_page,
+ 		.write_page	= yt8521_write_page,
+ 		.get_wol	= ytphy_get_wol,
diff --git a/target/linux/generic/backport-6.1/791-v6.3-09-net-phy-Add-driver-for-Motorcomm-yt8531-gigabit-ethernet.patch b/target/linux/generic/backport-6.1/791-v6.3-09-net-phy-Add-driver-for-Motorcomm-yt8531-gigabit-ethernet.patch
new file mode 100644
index 00000000000000..35495978efa18d
--- /dev/null
+++ b/target/linux/generic/backport-6.1/791-v6.3-09-net-phy-Add-driver-for-Motorcomm-yt8531-gigabit-ethernet.patch
@@ -0,0 +1,302 @@
+From 4ac94f728a588e7096dd5010cd7141a309ea7805 Mon Sep 17 00:00:00 2001
+From: Frank Sae <Frank.Sae@motor-comm.com>
+Date: Thu, 2 Feb 2023 11:00:37 +0800
+Subject: [PATCH] net: phy: Add driver for Motorcomm yt8531 gigabit ethernet
+ phy
+
+Add a driver for the motorcomm yt8531 gigabit ethernet phy. We have
+ verified the driver on AM335x platform with yt8531 board. On the
+ board, yt8531 gigabit ethernet phy works in utp mode, RGMII
+ interface, supports 1000M/100M/10M speeds, and wol(magic package).
+
+Signed-off-by: Frank Sae <Frank.Sae@motor-comm.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/Kconfig     |   2 +-
+ drivers/net/phy/motorcomm.c | 208 +++++++++++++++++++++++++++++++++++-
+ 2 files changed, 207 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -260,7 +260,7 @@ config MOTORCOMM_PHY
+ 	tristate "Motorcomm PHYs"
+ 	help
+ 	  Enables support for Motorcomm network PHYs.
+-	  Currently supports the YT8511, YT8521, YT8531S Gigabit Ethernet PHYs.
++	  Currently supports YT85xx Gigabit Ethernet PHYs.
+ 
+ config NATIONAL_PHY
+ 	tristate "National Semiconductor PHYs"
+--- a/drivers/net/phy/motorcomm.c
++++ b/drivers/net/phy/motorcomm.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0+
+ /*
+- * Motorcomm 8511/8521/8531S PHY driver.
++ * Motorcomm 8511/8521/8531/8531S PHY driver.
+  *
+  * Author: Peter Geis <pgwipeout@gmail.com>
+  * Author: Frank <Frank.Sae@motor-comm.com>
+@@ -14,6 +14,7 @@
+ 
+ #define PHY_ID_YT8511		0x0000010a
+ #define PHY_ID_YT8521		0x0000011a
++#define PHY_ID_YT8531		0x4f51e91b
+ #define PHY_ID_YT8531S		0x4f51e91a
+ 
+ /* YT8521/YT8531S Register Overview
+@@ -517,6 +518,61 @@ err_restore_page:
+ 	return phy_restore_page(phydev, old_page, ret);
+ }
+ 
++static int yt8531_set_wol(struct phy_device *phydev,
++			  struct ethtool_wolinfo *wol)
++{
++	const u16 mac_addr_reg[] = {
++		YTPHY_WOL_MACADDR2_REG,
++		YTPHY_WOL_MACADDR1_REG,
++		YTPHY_WOL_MACADDR0_REG,
++	};
++	const u8 *mac_addr;
++	u16 mask, val;
++	int ret;
++	u8 i;
++
++	if (wol->wolopts & WAKE_MAGIC) {
++		mac_addr = phydev->attached_dev->dev_addr;
++
++		/* Store the device address for the magic packet */
++		for (i = 0; i < 3; i++) {
++			ret = ytphy_write_ext_with_lock(phydev, mac_addr_reg[i],
++							((mac_addr[i * 2] << 8)) |
++							(mac_addr[i * 2 + 1]));
++			if (ret < 0)
++				return ret;
++		}
++
++		/* Enable WOL feature */
++		mask = YTPHY_WCR_PULSE_WIDTH_MASK | YTPHY_WCR_INTR_SEL;
++		val = YTPHY_WCR_ENABLE | YTPHY_WCR_INTR_SEL;
++		val |= YTPHY_WCR_TYPE_PULSE | YTPHY_WCR_PULSE_WIDTH_672MS;
++		ret = ytphy_modify_ext_with_lock(phydev, YTPHY_WOL_CONFIG_REG,
++						 mask, val);
++		if (ret < 0)
++			return ret;
++
++		/* Enable WOL interrupt */
++		ret = phy_modify(phydev, YTPHY_INTERRUPT_ENABLE_REG, 0,
++				 YTPHY_IER_WOL);
++		if (ret < 0)
++			return ret;
++	} else {
++		/* Disable WOL feature */
++		mask = YTPHY_WCR_ENABLE | YTPHY_WCR_INTR_SEL;
++		ret = ytphy_modify_ext_with_lock(phydev, YTPHY_WOL_CONFIG_REG,
++						 mask, 0);
++
++		/* Disable WOL interrupt */
++		ret = phy_modify(phydev, YTPHY_INTERRUPT_ENABLE_REG,
++				 YTPHY_IER_WOL, 0);
++		if (ret < 0)
++			return ret;
++	}
++
++	return 0;
++}
++
+ static int yt8511_read_page(struct phy_device *phydev)
+ {
+ 	return __phy_read(phydev, YT8511_PAGE_SELECT);
+@@ -767,6 +823,17 @@ static int ytphy_rgmii_clk_delay_config(
+ 	return ytphy_modify_ext(phydev, YT8521_RGMII_CONFIG1_REG, mask, val);
+ }
+ 
++static int ytphy_rgmii_clk_delay_config_with_lock(struct phy_device *phydev)
++{
++	int ret;
++
++	phy_lock_mdio_bus(phydev);
++	ret = ytphy_rgmii_clk_delay_config(phydev);
++	phy_unlock_mdio_bus(phydev);
++
++	return ret;
++}
++
+ /**
+  * yt8521_probe() - read chip config then set suitable polling_mode
+  * @phydev: a pointer to a &struct phy_device
+@@ -891,6 +958,43 @@ static int yt8521_probe(struct phy_devic
+ 					  val);
+ }
+ 
++static int yt8531_probe(struct phy_device *phydev)
++{
++	struct device_node *node = phydev->mdio.dev.of_node;
++	u16 mask, val;
++	u32 freq;
++
++	if (of_property_read_u32(node, "motorcomm,clk-out-frequency-hz", &freq))
++		freq = YTPHY_DTS_OUTPUT_CLK_DIS;
++
++	switch (freq) {
++	case YTPHY_DTS_OUTPUT_CLK_DIS:
++		mask = YT8531_SCR_SYNCE_ENABLE;
++		val = 0;
++		break;
++	case YTPHY_DTS_OUTPUT_CLK_25M:
++		mask = YT8531_SCR_SYNCE_ENABLE | YT8531_SCR_CLK_SRC_MASK |
++		       YT8531_SCR_CLK_FRE_SEL_125M;
++		val = YT8531_SCR_SYNCE_ENABLE |
++		      FIELD_PREP(YT8531_SCR_CLK_SRC_MASK,
++				 YT8531_SCR_CLK_SRC_REF_25M);
++		break;
++	case YTPHY_DTS_OUTPUT_CLK_125M:
++		mask = YT8531_SCR_SYNCE_ENABLE | YT8531_SCR_CLK_SRC_MASK |
++		       YT8531_SCR_CLK_FRE_SEL_125M;
++		val = YT8531_SCR_SYNCE_ENABLE | YT8531_SCR_CLK_FRE_SEL_125M |
++		      FIELD_PREP(YT8531_SCR_CLK_SRC_MASK,
++				 YT8531_SCR_CLK_SRC_PLL_125M);
++		break;
++	default:
++		phydev_warn(phydev, "Freq err:%u\n", freq);
++		return -EINVAL;
++	}
++
++	return ytphy_modify_ext_with_lock(phydev, YTPHY_SYNCE_CFG_REG, mask,
++					  val);
++}
++
+ /**
+  * ytphy_utp_read_lpa() - read LPA then setup lp_advertising for utp
+  * @phydev: a pointer to a &struct phy_device
+@@ -1387,6 +1491,94 @@ err_restore_page:
+ 	return phy_restore_page(phydev, old_page, ret);
+ }
+ 
++static int yt8531_config_init(struct phy_device *phydev)
++{
++	struct device_node *node = phydev->mdio.dev.of_node;
++	int ret;
++
++	ret = ytphy_rgmii_clk_delay_config_with_lock(phydev);
++	if (ret < 0)
++		return ret;
++
++	if (of_property_read_bool(node, "motorcomm,auto-sleep-disabled")) {
++		/* disable auto sleep */
++		ret = ytphy_modify_ext_with_lock(phydev,
++						 YT8521_EXTREG_SLEEP_CONTROL1_REG,
++						 YT8521_ESC1R_SLEEP_SW, 0);
++		if (ret < 0)
++			return ret;
++	}
++
++	if (of_property_read_bool(node, "motorcomm,keep-pll-enabled")) {
++		/* enable RXC clock when no wire plug */
++		ret = ytphy_modify_ext_with_lock(phydev,
++						 YT8521_CLOCK_GATING_REG,
++						 YT8521_CGR_RX_CLK_EN, 0);
++		if (ret < 0)
++			return ret;
++	}
++
++	return 0;
++}
++
++/**
++ * yt8531_link_change_notify() - Adjust the tx clock direction according to
++ * the current speed and dts config.
++ * @phydev: a pointer to a &struct phy_device
++ *
++ * NOTE: This function is only used to adapt to VF2 with JH7110 SoC. Please
++ * keep "motorcomm,tx-clk-adj-enabled" not exist in dts when the soc is not
++ * JH7110.
++ */
++static void yt8531_link_change_notify(struct phy_device *phydev)
++{
++	struct device_node *node = phydev->mdio.dev.of_node;
++	bool tx_clk_adj_enabled = false;
++	bool tx_clk_1000_inverted;
++	bool tx_clk_100_inverted;
++	bool tx_clk_10_inverted;
++	u16 val = 0;
++	int ret;
++
++	if (of_property_read_bool(node, "motorcomm,tx-clk-adj-enabled"))
++		tx_clk_adj_enabled = true;
++
++	if (!tx_clk_adj_enabled)
++		return;
++
++	if (of_property_read_bool(node, "motorcomm,tx-clk-10-inverted"))
++		tx_clk_10_inverted = true;
++	if (of_property_read_bool(node, "motorcomm,tx-clk-100-inverted"))
++		tx_clk_100_inverted = true;
++	if (of_property_read_bool(node, "motorcomm,tx-clk-1000-inverted"))
++		tx_clk_1000_inverted = true;
++
++	if (phydev->speed < 0)
++		return;
++
++	switch (phydev->speed) {
++	case SPEED_1000:
++		if (tx_clk_1000_inverted)
++			val = YT8521_RC1R_TX_CLK_SEL_INVERTED;
++		break;
++	case SPEED_100:
++		if (tx_clk_100_inverted)
++			val = YT8521_RC1R_TX_CLK_SEL_INVERTED;
++		break;
++	case SPEED_10:
++		if (tx_clk_10_inverted)
++			val = YT8521_RC1R_TX_CLK_SEL_INVERTED;
++		break;
++	default:
++		return;
++	}
++
++	ret = ytphy_modify_ext_with_lock(phydev, YT8521_RGMII_CONFIG1_REG,
++					 YT8521_RC1R_TX_CLK_SEL_INVERTED, val);
++	if (ret < 0)
++		phydev_warn(phydev, "Modify TX_CLK_SEL err:%d\n", ret);
++}
++
+ /**
+  * yt8521_prepare_fiber_features() -  A small helper function that setup
+  * fiber's features.
+@@ -1970,6 +2162,17 @@ static struct phy_driver motorcomm_phy_d
+ 		.resume		= yt8521_resume,
+ 	},
+ 	{
++		PHY_ID_MATCH_EXACT(PHY_ID_YT8531),
++		.name		= "YT8531 Gigabit Ethernet",
++		.probe		= yt8531_probe,
++		.config_init	= yt8531_config_init,
++		.suspend	= genphy_suspend,
++		.resume		= genphy_resume,
++		.get_wol	= ytphy_get_wol,
++		.set_wol	= yt8531_set_wol,
++		.link_change_notify = yt8531_link_change_notify,
++	},
++	{
+ 		PHY_ID_MATCH_EXACT(PHY_ID_YT8531S),
+ 		.name		= "YT8531S Gigabit Ethernet",
+ 		.get_features	= yt8521_get_features,
+@@ -1990,7 +2193,7 @@ static struct phy_driver motorcomm_phy_d
+ 
+ module_phy_driver(motorcomm_phy_drvs);
+ 
+-MODULE_DESCRIPTION("Motorcomm 8511/8521/8531S PHY driver");
++MODULE_DESCRIPTION("Motorcomm 8511/8521/8531/8531S PHY driver");
+ MODULE_AUTHOR("Peter Geis");
+ MODULE_AUTHOR("Frank");
+ MODULE_LICENSE("GPL");
+@@ -1998,6 +2201,7 @@ MODULE_LICENSE("GPL");
+ static const struct mdio_device_id __maybe_unused motorcomm_tbl[] = {
+ 	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8511) },
+ 	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8521) },
++	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8531) },
+ 	{ PHY_ID_MATCH_EXACT(PHY_ID_YT8531S) },
+ 	{ /* sentinel */ }
+ };
diff --git a/target/linux/generic/backport-6.1/791-v6.3-10-net-phy-motorcomm-uninitialized-variables-in.patch b/target/linux/generic/backport-6.1/791-v6.3-10-net-phy-motorcomm-uninitialized-variables-in.patch
new file mode 100644
index 00000000000000..29ae86dbbc2c0c
--- /dev/null
+++ b/target/linux/generic/backport-6.1/791-v6.3-10-net-phy-motorcomm-uninitialized-variables-in.patch
@@ -0,0 +1,34 @@
+From 9753613f7399601f9bae6ee81e9d4274246c98ab Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <error27@gmail.com>
+Date: Wed, 15 Feb 2023 07:21:47 +0300
+Subject: [PATCH] net: phy: motorcomm: uninitialized variables in
+ yt8531_link_change_notify()
+
+These booleans are never set to false, but are just used without being
+initialized.
+
+Fixes: 4ac94f728a58 ("net: phy: Add driver for Motorcomm yt8531 gigabit ethernet phy")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Reviewed-by: Frank Sae <Frank.Sae@motor-comm.com>
+Link: https://lore.kernel.org/r/Y+xd2yJet2ImHLoQ@kili
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/motorcomm.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/phy/motorcomm.c
++++ b/drivers/net/phy/motorcomm.c
+@@ -1533,10 +1533,10 @@ static int yt8531_config_init(struct phy
+ static void yt8531_link_change_notify(struct phy_device *phydev)
+ {
+ 	struct device_node *node = phydev->mdio.dev.of_node;
++	bool tx_clk_1000_inverted = false;
++	bool tx_clk_100_inverted = false;
++	bool tx_clk_10_inverted = false;
+ 	bool tx_clk_adj_enabled = false;
+-	bool tx_clk_1000_inverted;
+-	bool tx_clk_100_inverted;
+-	bool tx_clk_10_inverted;
+ 	u16 val = 0;
+ 	int ret;
+ 
diff --git a/target/linux/generic/backport-6.1/800-v6.3-leds-Move-led_init_default_state_get-to-the-global-h.patch b/target/linux/generic/backport-6.1/800-v6.3-leds-Move-led_init_default_state_get-to-the-global-h.patch
new file mode 100644
index 00000000000000..592111fb9545be
--- /dev/null
+++ b/target/linux/generic/backport-6.1/800-v6.3-leds-Move-led_init_default_state_get-to-the-global-h.patch
@@ -0,0 +1,39 @@
+From 156a5bb89ca6f3edd2be0bfd0de15e575442927e Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Tue, 3 Jan 2023 15:12:47 +0200
+Subject: [PATCH] leds: Move led_init_default_state_get() to the global header
+
+There are users inside and outside LED framework that have implemented
+a local copy of led_init_default_state_get(). In order to deduplicate
+that, as the first step move the declaration from LED header to the
+global one.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230103131256.33894-3-andriy.shevchenko@linux.intel.com
+---
+ drivers/leds/leds.h  | 1 -
+ include/linux/leds.h | 2 ++
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/leds/leds.h
++++ b/drivers/leds/leds.h
+@@ -27,7 +27,6 @@ ssize_t led_trigger_read(struct file *fi
+ ssize_t led_trigger_write(struct file *filp, struct kobject *kobj,
+ 			struct bin_attribute *bin_attr, char *buf,
+ 			loff_t pos, size_t count);
+-enum led_default_state led_init_default_state_get(struct fwnode_handle *fwnode);
+ 
+ extern struct rw_semaphore leds_list_lock;
+ extern struct list_head leds_list;
+--- a/include/linux/leds.h
++++ b/include/linux/leds.h
+@@ -63,6 +63,8 @@ struct led_init_data {
+ 	bool devname_mandatory;
+ };
+ 
++enum led_default_state led_init_default_state_get(struct fwnode_handle *fwnode);
++
+ struct led_hw_trigger_type {
+ 	int dummy;
+ };
diff --git a/target/linux/generic/backport-6.1/801-v6.4-01-net-dsa-qca8k-move-qca8k_port_to_phy-to-header.patch b/target/linux/generic/backport-6.1/801-v6.4-01-net-dsa-qca8k-move-qca8k_port_to_phy-to-header.patch
new file mode 100644
index 00000000000000..e336fb81bab193
--- /dev/null
+++ b/target/linux/generic/backport-6.1/801-v6.4-01-net-dsa-qca8k-move-qca8k_port_to_phy-to-header.patch
@@ -0,0 +1,67 @@
+From 3e8b4d6277fd19d98c817576954dd6a4ff3caa2b Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 17 Apr 2023 17:17:23 +0200
+Subject: [PATCH 1/9] net: dsa: qca8k: move qca8k_port_to_phy() to header
+
+Move qca8k_port_to_phy() to qca8k header as it's useful for future
+reference in Switch LEDs module since the same logic is applied to get
+the right index of the switch port.
+Make it inline as it's simple function that just decrease the port.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c | 15 ---------------
+ drivers/net/dsa/qca/qca8k.h      | 14 ++++++++++++++
+ 2 files changed, 14 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -716,21 +716,6 @@ err_clear_skb:
+ 	return ret;
+ }
+ 
+-static u32
+-qca8k_port_to_phy(int port)
+-{
+-	/* From Andrew Lunn:
+-	 * Port 0 has no internal phy.
+-	 * Port 1 has an internal PHY at MDIO address 0.
+-	 * Port 2 has an internal PHY at MDIO address 1.
+-	 * ...
+-	 * Port 5 has an internal PHY at MDIO address 4.
+-	 * Port 6 has no internal PHY.
+-	 */
+-
+-	return port - 1;
+-}
+-
+ static int
+ qca8k_mdio_busy_wait(struct mii_bus *bus, u32 reg, u32 mask)
+ {
+--- a/drivers/net/dsa/qca/qca8k.h
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -422,6 +422,20 @@ struct qca8k_fdb {
+ 	u8 mac[6];
+ };
+ 
++static inline u32 qca8k_port_to_phy(int port)
++{
++	/* From Andrew Lunn:
++	 * Port 0 has no internal phy.
++	 * Port 1 has an internal PHY at MDIO address 0.
++	 * Port 2 has an internal PHY at MDIO address 1.
++	 * ...
++	 * Port 5 has an internal PHY at MDIO address 4.
++	 * Port 6 has no internal PHY.
++	 */
++
++	return port - 1;
++}
++
+ /* Common setup function */
+ extern const struct qca8k_mib_desc ar8327_mib[];
+ extern const struct regmap_access_table qca8k_readable_table;
diff --git a/target/linux/generic/backport-6.1/801-v6.4-02-net-dsa-qca8k-add-LEDs-basic-support.patch b/target/linux/generic/backport-6.1/801-v6.4-02-net-dsa-qca8k-add-LEDs-basic-support.patch
new file mode 100644
index 00000000000000..37922580daee75
--- /dev/null
+++ b/target/linux/generic/backport-6.1/801-v6.4-02-net-dsa-qca8k-add-LEDs-basic-support.patch
@@ -0,0 +1,435 @@
+From 1e264f9d2918b5737023c44a23ae04def1095210 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 17 Apr 2023 17:17:24 +0200
+Subject: [PATCH 2/9] net: dsa: qca8k: add LEDs basic support
+
+Add LEDs basic support for qca8k Switch Family by adding basic
+brightness_set() support.
+
+Since these LEDs refelect port status, the default label is set to
+":port". DT binding should describe the color and function of the
+LEDs using standard LEDs api.
+Each LED always have the device name as prefix. The device name is
+composed from the mii bus id and the PHY addr resulting in example
+names like:
+- qca8k-0.0:00:amber:lan
+- qca8k-0.0:00:white:lan
+- qca8k-0.0:01:amber:lan
+- qca8k-0.0:01:white:lan
+
+These LEDs supports only blocking variant of the brightness_set()
+function since they can sleep during access of the switch leds to set
+the brightness.
+
+While at it add to the qca8k header file each mode defined by the Switch
+Documentation for future use.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca/Kconfig      |   8 ++
+ drivers/net/dsa/qca/Makefile     |   3 +
+ drivers/net/dsa/qca/qca8k-8xxx.c |   5 +
+ drivers/net/dsa/qca/qca8k-leds.c | 239 +++++++++++++++++++++++++++++++
+ drivers/net/dsa/qca/qca8k.h      |  60 ++++++++
+ drivers/net/dsa/qca/qca8k_leds.h |  16 +++
+ 6 files changed, 331 insertions(+)
+ create mode 100644 drivers/net/dsa/qca/qca8k-leds.c
+ create mode 100644 drivers/net/dsa/qca/qca8k_leds.h
+
+--- a/drivers/net/dsa/qca/Kconfig
++++ b/drivers/net/dsa/qca/Kconfig
+@@ -15,3 +15,11 @@ config NET_DSA_QCA8K
+ 	help
+ 	  This enables support for the Qualcomm Atheros QCA8K Ethernet
+ 	  switch chips.
++
++config NET_DSA_QCA8K_LEDS_SUPPORT
++	bool "Qualcomm Atheros QCA8K Ethernet switch family LEDs support"
++	depends on NET_DSA_QCA8K
++	depends on LEDS_CLASS
++	help
++	  This enabled support for LEDs present on the Qualcomm Atheros
++	  QCA8K Ethernet switch chips.
+--- a/drivers/net/dsa/qca/Makefile
++++ b/drivers/net/dsa/qca/Makefile
+@@ -2,3 +2,6 @@
+ obj-$(CONFIG_NET_DSA_AR9331)	+= ar9331.o
+ obj-$(CONFIG_NET_DSA_QCA8K)	+= qca8k.o
+ qca8k-y 			+= qca8k-common.o qca8k-8xxx.o
++ifdef CONFIG_NET_DSA_QCA8K_LEDS_SUPPORT
++qca8k-y				+= qca8k-leds.o
++endif
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -22,6 +22,7 @@
+ #include <linux/dsa/tag_qca.h>
+ 
+ #include "qca8k.h"
++#include "qca8k_leds.h"
+ 
+ static void
+ qca8k_split_addr(u32 regaddr, u16 *r1, u16 *r2, u16 *page)
+@@ -1726,6 +1727,10 @@ qca8k_setup(struct dsa_switch *ds)
+ 	if (ret)
+ 		return ret;
+ 
++	ret = qca8k_setup_led_ctrl(priv);
++	if (ret)
++		return ret;
++
+ 	qca8k_setup_pcs(priv, &priv->pcs_port_0, 0);
+ 	qca8k_setup_pcs(priv, &priv->pcs_port_6, 6);
+ 
+--- /dev/null
++++ b/drivers/net/dsa/qca/qca8k-leds.c
+@@ -0,0 +1,239 @@
++// SPDX-License-Identifier: GPL-2.0
++#include <linux/regmap.h>
++#include <net/dsa.h>
++
++#include "qca8k.h"
++#include "qca8k_leds.h"
++
++static int
++qca8k_get_enable_led_reg(int port_num, int led_num, struct qca8k_led_pattern_en *reg_info)
++{
++	switch (port_num) {
++	case 0:
++		reg_info->reg = QCA8K_LED_CTRL_REG(led_num);
++		reg_info->shift = QCA8K_LED_PHY0123_CONTROL_RULE_SHIFT;
++		break;
++	case 1:
++	case 2:
++	case 3:
++		/* Port 123 are controlled on a different reg */
++		reg_info->reg = QCA8K_LED_CTRL3_REG;
++		reg_info->shift = QCA8K_LED_PHY123_PATTERN_EN_SHIFT(port_num, led_num);
++		break;
++	case 4:
++		reg_info->reg = QCA8K_LED_CTRL_REG(led_num);
++		reg_info->shift = QCA8K_LED_PHY4_CONTROL_RULE_SHIFT;
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static int
++qca8k_led_brightness_set(struct qca8k_led *led,
++			 enum led_brightness brightness)
++{
++	struct qca8k_led_pattern_en reg_info;
++	struct qca8k_priv *priv = led->priv;
++	u32 mask, val;
++
++	qca8k_get_enable_led_reg(led->port_num, led->led_num, &reg_info);
++
++	val = QCA8K_LED_ALWAYS_OFF;
++	if (brightness)
++		val = QCA8K_LED_ALWAYS_ON;
++
++	/* HW regs to control brightness is special and port 1-2-3
++	 * are placed in a different reg.
++	 *
++	 * To control port 0 brightness:
++	 * - the 2 bit (15, 14) of:
++	 *   - QCA8K_LED_CTRL0_REG for led1
++	 *   - QCA8K_LED_CTRL1_REG for led2
++	 *   - QCA8K_LED_CTRL2_REG for led3
++	 *
++	 * To control port 4:
++	 * - the 2 bit (31, 30) of:
++	 *   - QCA8K_LED_CTRL0_REG for led1
++	 *   - QCA8K_LED_CTRL1_REG for led2
++	 *   - QCA8K_LED_CTRL2_REG for led3
++	 *
++	 * To control port 1:
++	 *   - the 2 bit at (9, 8) of QCA8K_LED_CTRL3_REG are used for led1
++	 *   - the 2 bit at (11, 10) of QCA8K_LED_CTRL3_REG are used for led2
++	 *   - the 2 bit at (13, 12) of QCA8K_LED_CTRL3_REG are used for led3
++	 *
++	 * To control port 2:
++	 *   - the 2 bit at (15, 14) of QCA8K_LED_CTRL3_REG are used for led1
++	 *   - the 2 bit at (17, 16) of QCA8K_LED_CTRL3_REG are used for led2
++	 *   - the 2 bit at (19, 18) of QCA8K_LED_CTRL3_REG are used for led3
++	 *
++	 * To control port 3:
++	 *   - the 2 bit at (21, 20) of QCA8K_LED_CTRL3_REG are used for led1
++	 *   - the 2 bit at (23, 22) of QCA8K_LED_CTRL3_REG are used for led2
++	 *   - the 2 bit at (25, 24) of QCA8K_LED_CTRL3_REG are used for led3
++	 *
++	 * To abstract this and have less code, we use the port and led numm
++	 * to calculate the shift and the correct reg due to this problem of
++	 * not having a 1:1 map of LED with the regs.
++	 */
++	if (led->port_num == 0 || led->port_num == 4) {
++		mask = QCA8K_LED_PATTERN_EN_MASK;
++		val <<= QCA8K_LED_PATTERN_EN_SHIFT;
++	} else {
++		mask = QCA8K_LED_PHY123_PATTERN_EN_MASK;
++	}
++
++	return regmap_update_bits(priv->regmap, reg_info.reg,
++				  mask << reg_info.shift,
++				  val << reg_info.shift);
++}
++
++static int
++qca8k_cled_brightness_set_blocking(struct led_classdev *ldev,
++				   enum led_brightness brightness)
++{
++	struct qca8k_led *led = container_of(ldev, struct qca8k_led, cdev);
++
++	return qca8k_led_brightness_set(led, brightness);
++}
++
++static enum led_brightness
++qca8k_led_brightness_get(struct qca8k_led *led)
++{
++	struct qca8k_led_pattern_en reg_info;
++	struct qca8k_priv *priv = led->priv;
++	u32 val;
++	int ret;
++
++	qca8k_get_enable_led_reg(led->port_num, led->led_num, &reg_info);
++
++	ret = regmap_read(priv->regmap, reg_info.reg, &val);
++	if (ret)
++		return 0;
++
++	val >>= reg_info.shift;
++
++	if (led->port_num == 0 || led->port_num == 4) {
++		val &= QCA8K_LED_PATTERN_EN_MASK;
++		val >>= QCA8K_LED_PATTERN_EN_SHIFT;
++	} else {
++		val &= QCA8K_LED_PHY123_PATTERN_EN_MASK;
++	}
++
++	/* Assume brightness ON only when the LED is set to always ON */
++	return val == QCA8K_LED_ALWAYS_ON;
++}
++
++static int
++qca8k_parse_port_leds(struct qca8k_priv *priv, struct fwnode_handle *port, int port_num)
++{
++	struct fwnode_handle *led = NULL, *leds = NULL;
++	struct led_init_data init_data = { };
++	struct dsa_switch *ds = priv->ds;
++	enum led_default_state state;
++	struct qca8k_led *port_led;
++	int led_num, led_index;
++	int ret;
++
++	leds = fwnode_get_named_child_node(port, "leds");
++	if (!leds) {
++		dev_dbg(priv->dev, "No Leds node specified in device tree for port %d!\n",
++			port_num);
++		return 0;
++	}
++
++	fwnode_for_each_child_node(leds, led) {
++		/* Reg represent the led number of the port.
++		 * Each port can have at most 3 leds attached
++		 * Commonly:
++		 * 1. is gigabit led
++		 * 2. is mbit led
++		 * 3. additional status led
++		 */
++		if (fwnode_property_read_u32(led, "reg", &led_num))
++			continue;
++
++		if (led_num >= QCA8K_LED_PORT_COUNT) {
++			dev_warn(priv->dev, "Invalid LED reg %d defined for port %d",
++				 led_num, port_num);
++			continue;
++		}
++
++		led_index = QCA8K_LED_PORT_INDEX(port_num, led_num);
++
++		port_led = &priv->ports_led[led_index];
++		port_led->port_num = port_num;
++		port_led->led_num = led_num;
++		port_led->priv = priv;
++
++		state = led_init_default_state_get(led);
++		switch (state) {
++		case LEDS_DEFSTATE_ON:
++			port_led->cdev.brightness = 1;
++			qca8k_led_brightness_set(port_led, 1);
++			break;
++		case LEDS_DEFSTATE_KEEP:
++			port_led->cdev.brightness =
++					qca8k_led_brightness_get(port_led);
++			break;
++		default:
++			port_led->cdev.brightness = 0;
++			qca8k_led_brightness_set(port_led, 0);
++		}
++
++		port_led->cdev.max_brightness = 1;
++		port_led->cdev.brightness_set_blocking = qca8k_cled_brightness_set_blocking;
++		init_data.default_label = ":port";
++		init_data.fwnode = led;
++		init_data.devname_mandatory = true;
++		init_data.devicename = kasprintf(GFP_KERNEL, "%s:0%d", ds->slave_mii_bus->id,
++						 port_num);
++		if (!init_data.devicename)
++			return -ENOMEM;
++
++		ret = devm_led_classdev_register_ext(priv->dev, &port_led->cdev, &init_data);
++		if (ret)
++			dev_warn(priv->dev, "Failed to init LED %d for port %d", led_num, port_num);
++
++		kfree(init_data.devicename);
++	}
++
++	return 0;
++}
++
++int
++qca8k_setup_led_ctrl(struct qca8k_priv *priv)
++{
++	struct fwnode_handle *ports, *port;
++	int port_num;
++	int ret;
++
++	ports = device_get_named_child_node(priv->dev, "ports");
++	if (!ports) {
++		dev_info(priv->dev, "No ports node specified in device tree!");
++		return 0;
++	}
++
++	fwnode_for_each_child_node(ports, port) {
++		if (fwnode_property_read_u32(port, "reg", &port_num))
++			continue;
++
++		/* Skip checking for CPU port 0 and CPU port 6 as not supported */
++		if (port_num == 0 || port_num == 6)
++			continue;
++
++		/* Each port can have at most 3 different leds attached.
++		 * Switch port starts from 0 to 6, but port 0 and 6 are CPU
++		 * port. The port index needs to be decreased by one to identify
++		 * the correct port for LED setup.
++		 */
++		ret = qca8k_parse_port_leds(priv, port, qca8k_port_to_phy(port_num));
++		if (ret)
++			return ret;
++	}
++
++	return 0;
++}
+--- a/drivers/net/dsa/qca/qca8k.h
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -11,6 +11,7 @@
+ #include <linux/delay.h>
+ #include <linux/regmap.h>
+ #include <linux/gpio.h>
++#include <linux/leds.h>
+ #include <linux/dsa/tag_qca.h>
+ 
+ #define QCA8K_ETHERNET_MDIO_PRIORITY			7
+@@ -85,6 +86,51 @@
+ #define   QCA8K_MDIO_MASTER_DATA(x)			FIELD_PREP(QCA8K_MDIO_MASTER_DATA_MASK, x)
+ #define   QCA8K_MDIO_MASTER_MAX_PORTS			5
+ #define   QCA8K_MDIO_MASTER_MAX_REG			32
++
++/* LED control register */
++#define QCA8K_LED_PORT_COUNT				3
++#define QCA8K_LED_COUNT					((QCA8K_NUM_PORTS - QCA8K_NUM_CPU_PORTS) * QCA8K_LED_PORT_COUNT)
++#define QCA8K_LED_RULE_COUNT				6
++#define QCA8K_LED_RULE_MAX				11
++#define QCA8K_LED_PORT_INDEX(_phy, _led)		(((_phy) * QCA8K_LED_PORT_COUNT) + (_led))
++
++#define QCA8K_LED_PHY123_PATTERN_EN_SHIFT(_phy, _led)	((((_phy) - 1) * 6) + 8 + (2 * (_led)))
++#define QCA8K_LED_PHY123_PATTERN_EN_MASK		GENMASK(1, 0)
++
++#define QCA8K_LED_PHY0123_CONTROL_RULE_SHIFT		0
++#define QCA8K_LED_PHY4_CONTROL_RULE_SHIFT		16
++
++#define QCA8K_LED_CTRL_REG(_i)				(0x050 + (_i) * 4)
++#define QCA8K_LED_CTRL0_REG				0x50
++#define QCA8K_LED_CTRL1_REG				0x54
++#define QCA8K_LED_CTRL2_REG				0x58
++#define QCA8K_LED_CTRL3_REG				0x5C
++#define   QCA8K_LED_CTRL_SHIFT(_i)			(((_i) % 2) * 16)
++#define   QCA8K_LED_CTRL_MASK				GENMASK(15, 0)
++#define QCA8K_LED_RULE_MASK				GENMASK(13, 0)
++#define QCA8K_LED_BLINK_FREQ_MASK			GENMASK(1, 0)
++#define QCA8K_LED_BLINK_FREQ_SHITF			0
++#define   QCA8K_LED_BLINK_2HZ				0
++#define   QCA8K_LED_BLINK_4HZ				1
++#define   QCA8K_LED_BLINK_8HZ				2
++#define   QCA8K_LED_BLINK_AUTO				3
++#define QCA8K_LED_LINKUP_OVER_MASK			BIT(2)
++#define QCA8K_LED_TX_BLINK_MASK				BIT(4)
++#define QCA8K_LED_RX_BLINK_MASK				BIT(5)
++#define QCA8K_LED_COL_BLINK_MASK			BIT(7)
++#define QCA8K_LED_LINK_10M_EN_MASK			BIT(8)
++#define QCA8K_LED_LINK_100M_EN_MASK			BIT(9)
++#define QCA8K_LED_LINK_1000M_EN_MASK			BIT(10)
++#define QCA8K_LED_POWER_ON_LIGHT_MASK			BIT(11)
++#define QCA8K_LED_HALF_DUPLEX_MASK			BIT(12)
++#define QCA8K_LED_FULL_DUPLEX_MASK			BIT(13)
++#define QCA8K_LED_PATTERN_EN_MASK			GENMASK(15, 14)
++#define QCA8K_LED_PATTERN_EN_SHIFT			14
++#define   QCA8K_LED_ALWAYS_OFF				0
++#define   QCA8K_LED_ALWAYS_BLINK_4HZ			1
++#define   QCA8K_LED_ALWAYS_ON				2
++#define   QCA8K_LED_RULE_CONTROLLED			3
++
+ #define QCA8K_GOL_MAC_ADDR0				0x60
+ #define QCA8K_GOL_MAC_ADDR1				0x64
+ #define QCA8K_MAX_FRAME_SIZE				0x78
+@@ -383,6 +429,19 @@ struct qca8k_pcs {
+ 	int port;
+ };
+ 
++struct qca8k_led_pattern_en {
++	u32 reg;
++	u8 shift;
++};
++
++struct qca8k_led {
++	u8 port_num;
++	u8 led_num;
++	u16 old_rule;
++	struct qca8k_priv *priv;
++	struct led_classdev cdev;
++};
++
+ struct qca8k_priv {
+ 	u8 switch_id;
+ 	u8 switch_revision;
+@@ -407,6 +466,7 @@ struct qca8k_priv {
+ 	struct qca8k_pcs pcs_port_0;
+ 	struct qca8k_pcs pcs_port_6;
+ 	const struct qca8k_match_data *info;
++	struct qca8k_led ports_led[QCA8K_LED_COUNT];
+ };
+ 
+ struct qca8k_mib_desc {
+--- /dev/null
++++ b/drivers/net/dsa/qca/qca8k_leds.h
+@@ -0,0 +1,16 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++#ifndef __QCA8K_LEDS_H
++#define __QCA8K_LEDS_H
++
++/* Leds Support function */
++#ifdef CONFIG_NET_DSA_QCA8K_LEDS_SUPPORT
++int qca8k_setup_led_ctrl(struct qca8k_priv *priv);
++#else
++static inline int qca8k_setup_led_ctrl(struct qca8k_priv *priv)
++{
++	return 0;
++}
++#endif
++
++#endif /* __QCA8K_LEDS_H */
diff --git a/target/linux/generic/backport-6.1/801-v6.4-03-net-dsa-qca8k-add-LEDs-blink_set-support.patch b/target/linux/generic/backport-6.1/801-v6.4-03-net-dsa-qca8k-add-LEDs-blink_set-support.patch
new file mode 100644
index 00000000000000..231c4156df8e06
--- /dev/null
+++ b/target/linux/generic/backport-6.1/801-v6.4-03-net-dsa-qca8k-add-LEDs-blink_set-support.patch
@@ -0,0 +1,74 @@
+From 91acadcc6e599dfc62717abcdad58a459cfb1684 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 17 Apr 2023 17:17:25 +0200
+Subject: [PATCH 3/9] net: dsa: qca8k: add LEDs blink_set() support
+
+Add LEDs blink_set() support to qca8k Switch Family.
+These LEDs support hw accellerated blinking at a fixed rate
+of 4Hz.
+
+Reject any other value since not supported by the LEDs switch.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca/qca8k-leds.c | 38 ++++++++++++++++++++++++++++++++
+ 1 file changed, 38 insertions(+)
+
+--- a/drivers/net/dsa/qca/qca8k-leds.c
++++ b/drivers/net/dsa/qca/qca8k-leds.c
+@@ -128,6 +128,43 @@ qca8k_led_brightness_get(struct qca8k_le
+ }
+ 
+ static int
++qca8k_cled_blink_set(struct led_classdev *ldev,
++		     unsigned long *delay_on,
++		     unsigned long *delay_off)
++{
++	struct qca8k_led *led = container_of(ldev, struct qca8k_led, cdev);
++	u32 mask, val = QCA8K_LED_ALWAYS_BLINK_4HZ;
++	struct qca8k_led_pattern_en reg_info;
++	struct qca8k_priv *priv = led->priv;
++
++	if (*delay_on == 0 && *delay_off == 0) {
++		*delay_on = 125;
++		*delay_off = 125;
++	}
++
++	if (*delay_on != 125 || *delay_off != 125) {
++		/* The hardware only supports blinking at 4Hz. Fall back
++		 * to software implementation in other cases.
++		 */
++		return -EINVAL;
++	}
++
++	qca8k_get_enable_led_reg(led->port_num, led->led_num, &reg_info);
++
++	if (led->port_num == 0 || led->port_num == 4) {
++		mask = QCA8K_LED_PATTERN_EN_MASK;
++		val <<= QCA8K_LED_PATTERN_EN_SHIFT;
++	} else {
++		mask = QCA8K_LED_PHY123_PATTERN_EN_MASK;
++	}
++
++	regmap_update_bits(priv->regmap, reg_info.reg, mask << reg_info.shift,
++			   val << reg_info.shift);
++
++	return 0;
++}
++
++static int
+ qca8k_parse_port_leds(struct qca8k_priv *priv, struct fwnode_handle *port, int port_num)
+ {
+ 	struct fwnode_handle *led = NULL, *leds = NULL;
+@@ -186,6 +223,7 @@ qca8k_parse_port_leds(struct qca8k_priv
+ 
+ 		port_led->cdev.max_brightness = 1;
+ 		port_led->cdev.brightness_set_blocking = qca8k_cled_brightness_set_blocking;
++		port_led->cdev.blink_set = qca8k_cled_blink_set;
+ 		init_data.default_label = ":port";
+ 		init_data.fwnode = led;
+ 		init_data.devname_mandatory = true;
diff --git a/target/linux/generic/backport-6.1/801-v6.4-04-leds-Provide-stubs-for-when-CLASS_LED-NEW_LEDS-are-d.patch b/target/linux/generic/backport-6.1/801-v6.4-04-leds-Provide-stubs-for-when-CLASS_LED-NEW_LEDS-are-d.patch
new file mode 100644
index 00000000000000..bc905b4468c1b2
--- /dev/null
+++ b/target/linux/generic/backport-6.1/801-v6.4-04-leds-Provide-stubs-for-when-CLASS_LED-NEW_LEDS-are-d.patch
@@ -0,0 +1,59 @@
+From e5029edd53937a29801ef507cee12e657ff31ea9 Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Mon, 17 Apr 2023 17:17:26 +0200
+Subject: [PATCH 4/9] leds: Provide stubs for when CLASS_LED & NEW_LEDS are
+ disabled
+
+Provide stubs for devm_led_classdev_register_ext() and
+led_init_default_state_get() so that LED drivers embedded within other
+drivers such as PHYs and Ethernet switches still build when LEDS_CLASS
+or NEW_LEDS are disabled. This also helps with Kconfig dependencies,
+which are somewhat hairy for phylib and mdio and only get worse when
+adding a dependency on LED_CLASS.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/linux/leds.h | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/include/linux/leds.h
++++ b/include/linux/leds.h
+@@ -63,7 +63,15 @@ struct led_init_data {
+ 	bool devname_mandatory;
+ };
+ 
++#if IS_ENABLED(CONFIG_NEW_LEDS)
+ enum led_default_state led_init_default_state_get(struct fwnode_handle *fwnode);
++#else
++static inline enum led_default_state
++led_init_default_state_get(struct fwnode_handle *fwnode)
++{
++	return LEDS_DEFSTATE_OFF;
++}
++#endif
+ 
+ struct led_hw_trigger_type {
+ 	int dummy;
+@@ -198,9 +206,19 @@ static inline int led_classdev_register(
+ 	return led_classdev_register_ext(parent, led_cdev, NULL);
+ }
+ 
++#if IS_ENABLED(CONFIG_LEDS_CLASS)
+ int devm_led_classdev_register_ext(struct device *parent,
+ 					  struct led_classdev *led_cdev,
+ 					  struct led_init_data *init_data);
++#else
++static inline int
++devm_led_classdev_register_ext(struct device *parent,
++			       struct led_classdev *led_cdev,
++			       struct led_init_data *init_data)
++{
++	return 0;
++}
++#endif
+ 
+ static inline int devm_led_classdev_register(struct device *parent,
+ 					     struct led_classdev *led_cdev)
diff --git a/target/linux/generic/backport-6.1/801-v6.4-05-net-phy-Add-a-binding-for-PHY-LEDs.patch b/target/linux/generic/backport-6.1/801-v6.4-05-net-phy-Add-a-binding-for-PHY-LEDs.patch
new file mode 100644
index 00000000000000..8df0ed1f7f5d74
--- /dev/null
+++ b/target/linux/generic/backport-6.1/801-v6.4-05-net-phy-Add-a-binding-for-PHY-LEDs.patch
@@ -0,0 +1,191 @@
+From 01e5b728e9e43ae444e0369695a5f72209906464 Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Mon, 17 Apr 2023 17:17:27 +0200
+Subject: [PATCH 5/9] net: phy: Add a binding for PHY LEDs
+
+Define common binding parsing for all PHY drivers with LEDs using
+phylib. Parse the DT as part of the phy_probe and add LEDs to the
+linux LED class infrastructure. For the moment, provide a dummy
+brightness function, which will later be replaced with a call into the
+PHY driver. This allows testing since the LED core might otherwise
+reject an LED whose brightness cannot be set.
+
+Add a dependency on LED_CLASS. It either needs to be built in, or not
+enabled, since a modular build can result in linker errors.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/Kconfig      |  1 +
+ drivers/net/phy/phy_device.c | 76 ++++++++++++++++++++++++++++++++++++
+ include/linux/phy.h          | 16 ++++++++
+ 3 files changed, 93 insertions(+)
+
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -18,6 +18,7 @@ menuconfig PHYLIB
+ 	depends on NETDEVICES
+ 	select MDIO_DEVICE
+ 	select MDIO_DEVRES
++	depends on LEDS_CLASS || LEDS_CLASS=n
+ 	help
+ 	  Ethernet controllers are usually attached to PHY
+ 	  devices.  This option provides infrastructure for
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -19,10 +19,12 @@
+ #include <linux/interrupt.h>
+ #include <linux/io.h>
+ #include <linux/kernel.h>
++#include <linux/list.h>
+ #include <linux/mdio.h>
+ #include <linux/mii.h>
+ #include <linux/mm.h>
+ #include <linux/module.h>
++#include <linux/of.h>
+ #include <linux/netdevice.h>
+ #include <linux/phy.h>
+ #include <linux/phy_led_triggers.h>
+@@ -644,6 +646,7 @@ struct phy_device *phy_device_create(str
+ 	device_initialize(&mdiodev->dev);
+ 
+ 	dev->state = PHY_DOWN;
++	INIT_LIST_HEAD(&dev->leds);
+ 
+ 	mutex_init(&dev->lock);
+ 	INIT_DELAYED_WORK(&dev->state_queue, phy_state_machine);
+@@ -2931,6 +2934,74 @@ static bool phy_drv_supports_irq(struct
+ 	return phydrv->config_intr && phydrv->handle_interrupt;
+ }
+ 
++/* Dummy implementation until calls into PHY driver are added */
++static int phy_led_set_brightness(struct led_classdev *led_cdev,
++				  enum led_brightness value)
++{
++	return 0;
++}
++
++static int of_phy_led(struct phy_device *phydev,
++		      struct device_node *led)
++{
++	struct device *dev = &phydev->mdio.dev;
++	struct led_init_data init_data = {};
++	struct led_classdev *cdev;
++	struct phy_led *phyled;
++	int err;
++
++	phyled = devm_kzalloc(dev, sizeof(*phyled), GFP_KERNEL);
++	if (!phyled)
++		return -ENOMEM;
++
++	cdev = &phyled->led_cdev;
++
++	err = of_property_read_u8(led, "reg", &phyled->index);
++	if (err)
++		return err;
++
++	cdev->brightness_set_blocking = phy_led_set_brightness;
++	cdev->max_brightness = 1;
++	init_data.devicename = dev_name(&phydev->mdio.dev);
++	init_data.fwnode = of_fwnode_handle(led);
++	init_data.devname_mandatory = true;
++
++	err = devm_led_classdev_register_ext(dev, cdev, &init_data);
++	if (err)
++		return err;
++
++	list_add(&phyled->list, &phydev->leds);
++
++	return 0;
++}
++
++static int of_phy_leds(struct phy_device *phydev)
++{
++	struct device_node *node = phydev->mdio.dev.of_node;
++	struct device_node *leds, *led;
++	int err;
++
++	if (!IS_ENABLED(CONFIG_OF_MDIO))
++		return 0;
++
++	if (!node)
++		return 0;
++
++	leds = of_get_child_by_name(node, "leds");
++	if (!leds)
++		return 0;
++
++	for_each_available_child_of_node(leds, led) {
++		err = of_phy_led(phydev, led);
++		if (err) {
++			of_node_put(led);
++			return err;
++		}
++	}
++
++	return 0;
++}
++
+ /**
+  * fwnode_mdio_find_device - Given a fwnode, find the mdio_device
+  * @fwnode: pointer to the mdio_device's fwnode
+@@ -3107,6 +3178,11 @@ static int phy_probe(struct device *dev)
+ 	/* Set the state to READY by default */
+ 	phydev->state = PHY_READY;
+ 
++	/* Get the LEDs from the device tree, and instantiate standard
++	 * LEDs for them.
++	 */
++	err = of_phy_leds(phydev);
++
+ out:
+ 	/* Re-assert the reset signal on error */
+ 	if (err)
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -14,6 +14,7 @@
+ #include <linux/compiler.h>
+ #include <linux/spinlock.h>
+ #include <linux/ethtool.h>
++#include <linux/leds.h>
+ #include <linux/linkmode.h>
+ #include <linux/netlink.h>
+ #include <linux/mdio.h>
+@@ -593,6 +594,7 @@ struct macsec_ops;
+  * @phy_num_led_triggers: Number of triggers in @phy_led_triggers
+  * @led_link_trigger: LED trigger for link up/down
+  * @last_triggered: last LED trigger for link speed
++ * @leds: list of PHY LED structures
+  * @master_slave_set: User requested master/slave configuration
+  * @master_slave_get: Current master/slave advertisement
+  * @master_slave_state: Current master/slave configuration
+@@ -685,6 +687,7 @@ struct phy_device {
+ 
+ 	struct phy_led_trigger *led_link_trigger;
+ #endif
++	struct list_head leds;
+ 
+ 	/*
+ 	 * Interrupt number for this PHY
+@@ -759,6 +762,19 @@ struct phy_tdr_config {
+ #define PHY_PAIR_ALL -1
+ 
+ /**
++ * struct phy_led: An LED driven by the PHY
++ *
++ * @list: List of LEDs
++ * @led_cdev: Standard LED class structure
++ * @index: Number of the LED
++ */
++struct phy_led {
++	struct list_head list;
++	struct led_classdev led_cdev;
++	u8 index;
++};
++
++/**
+  * struct phy_driver - Driver structure for a particular PHY type
+  *
+  * @mdiodrv: Data common to all MDIO devices
diff --git a/target/linux/generic/backport-6.1/801-v6.4-06-net-phy-phy_device-Call-into-the-PHY-driver-to-set-L.patch b/target/linux/generic/backport-6.1/801-v6.4-06-net-phy-phy_device-Call-into-the-PHY-driver-to-set-L.patch
new file mode 100644
index 00000000000000..57db12ed4a112b
--- /dev/null
+++ b/target/linux/generic/backport-6.1/801-v6.4-06-net-phy-phy_device-Call-into-the-PHY-driver-to-set-L.patch
@@ -0,0 +1,97 @@
+From 684818189b04b095b34964ed4a3ea5249a840eab Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Mon, 17 Apr 2023 17:17:28 +0200
+Subject: [PATCH 6/9] net: phy: phy_device: Call into the PHY driver to set LED
+ brightness
+
+Linux LEDs can be software controlled via the brightness file in /sys.
+LED drivers need to implement a brightness_set function which the core
+will call. Implement an intermediary in phy_device, which will call
+into the phy driver if it implements the necessary function.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/phy_device.c | 15 ++++++++++++---
+ include/linux/phy.h          | 13 +++++++++++++
+ 2 files changed, 25 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -2934,11 +2934,18 @@ static bool phy_drv_supports_irq(struct
+ 	return phydrv->config_intr && phydrv->handle_interrupt;
+ }
+ 
+-/* Dummy implementation until calls into PHY driver are added */
+ static int phy_led_set_brightness(struct led_classdev *led_cdev,
+ 				  enum led_brightness value)
+ {
+-	return 0;
++	struct phy_led *phyled = to_phy_led(led_cdev);
++	struct phy_device *phydev = phyled->phydev;
++	int err;
++
++	mutex_lock(&phydev->lock);
++	err = phydev->drv->led_brightness_set(phydev, phyled->index, value);
++	mutex_unlock(&phydev->lock);
++
++	return err;
+ }
+ 
+ static int of_phy_led(struct phy_device *phydev,
+@@ -2955,12 +2962,14 @@ static int of_phy_led(struct phy_device
+ 		return -ENOMEM;
+ 
+ 	cdev = &phyled->led_cdev;
++	phyled->phydev = phydev;
+ 
+ 	err = of_property_read_u8(led, "reg", &phyled->index);
+ 	if (err)
+ 		return err;
+ 
+-	cdev->brightness_set_blocking = phy_led_set_brightness;
++	if (phydev->drv->led_brightness_set)
++		cdev->brightness_set_blocking = phy_led_set_brightness;
+ 	cdev->max_brightness = 1;
+ 	init_data.devicename = dev_name(&phydev->mdio.dev);
+ 	init_data.fwnode = of_fwnode_handle(led);
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -765,15 +765,19 @@ struct phy_tdr_config {
+  * struct phy_led: An LED driven by the PHY
+  *
+  * @list: List of LEDs
++ * @phydev: PHY this LED is attached to
+  * @led_cdev: Standard LED class structure
+  * @index: Number of the LED
+  */
+ struct phy_led {
+ 	struct list_head list;
++	struct phy_device *phydev;
+ 	struct led_classdev led_cdev;
+ 	u8 index;
+ };
+ 
++#define to_phy_led(d) container_of(d, struct phy_led, led_cdev)
++
+ /**
+  * struct phy_driver - Driver structure for a particular PHY type
+  *
+@@ -988,6 +992,15 @@ struct phy_driver {
+ 	int (*get_sqi)(struct phy_device *dev);
+ 	/** @get_sqi_max: Get the maximum signal quality indication */
+ 	int (*get_sqi_max)(struct phy_device *dev);
++
++	/**
++	 * @led_brightness_set: Set a PHY LED brightness. Index
++	 * indicates which of the PHYs led should be set. Value
++	 * follows the standard LED class meaning, e.g. LED_OFF,
++	 * LED_HALF, LED_FULL.
++	 */
++	int (*led_brightness_set)(struct phy_device *dev,
++				  u8 index, enum led_brightness value);
+ };
+ #define to_phy_driver(d) container_of(to_mdio_common_driver(d),		\
+ 				      struct phy_driver, mdiodrv)
diff --git a/target/linux/generic/backport-6.1/801-v6.4-07-net-phy-marvell-Add-software-control-of-the-LEDs.patch b/target/linux/generic/backport-6.1/801-v6.4-07-net-phy-marvell-Add-software-control-of-the-LEDs.patch
new file mode 100644
index 00000000000000..5114c0e6da21c0
--- /dev/null
+++ b/target/linux/generic/backport-6.1/801-v6.4-07-net-phy-marvell-Add-software-control-of-the-LEDs.patch
@@ -0,0 +1,112 @@
+From 2d3960e58ef7c83fe1dbf952f056b9e906cb6df8 Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Mon, 17 Apr 2023 17:17:29 +0200
+Subject: [PATCH 7/9] net: phy: marvell: Add software control of the LEDs
+
+Add a brightness function, so the LEDs can be controlled from
+software using the standard Linux LED infrastructure.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/marvell.c | 45 ++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 40 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -144,11 +144,13 @@
+ /* WOL Event Interrupt Enable */
+ #define MII_88E1318S_PHY_CSIER_WOL_EIE			BIT(7)
+ 
+-/* LED Timer Control Register */
+-#define MII_88E1318S_PHY_LED_TCR			0x12
+-#define MII_88E1318S_PHY_LED_TCR_FORCE_INT		BIT(15)
+-#define MII_88E1318S_PHY_LED_TCR_INTn_ENABLE		BIT(7)
+-#define MII_88E1318S_PHY_LED_TCR_INT_ACTIVE_LOW		BIT(11)
++#define MII_88E1318S_PHY_LED_FUNC		0x10
++#define MII_88E1318S_PHY_LED_FUNC_OFF		(0x8)
++#define MII_88E1318S_PHY_LED_FUNC_ON		(0x9)
++#define MII_88E1318S_PHY_LED_TCR		0x12
++#define MII_88E1318S_PHY_LED_TCR_FORCE_INT	BIT(15)
++#define MII_88E1318S_PHY_LED_TCR_INTn_ENABLE	BIT(7)
++#define MII_88E1318S_PHY_LED_TCR_INT_ACTIVE_LOW	BIT(11)
+ 
+ /* Magic Packet MAC address registers */
+ #define MII_88E1318S_PHY_MAGIC_PACKET_WORD2		0x17
+@@ -2832,6 +2834,34 @@ static int marvell_hwmon_probe(struct ph
+ }
+ #endif
+ 
++static int m88e1318_led_brightness_set(struct phy_device *phydev,
++				       u8 index, enum led_brightness value)
++{
++	int reg;
++
++	reg = phy_read_paged(phydev, MII_MARVELL_LED_PAGE,
++			     MII_88E1318S_PHY_LED_FUNC);
++	if (reg < 0)
++		return reg;
++
++	switch (index) {
++	case 0:
++	case 1:
++	case 2:
++		reg &= ~(0xf << (4 * index));
++		if (value == LED_OFF)
++			reg |= MII_88E1318S_PHY_LED_FUNC_OFF << (4 * index);
++		else
++			reg |= MII_88E1318S_PHY_LED_FUNC_ON << (4 * index);
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	return phy_write_paged(phydev, MII_MARVELL_LED_PAGE,
++			       MII_88E1318S_PHY_LED_FUNC, reg);
++}
++
+ static int marvell_probe(struct phy_device *phydev)
+ {
+ 	struct marvell_priv *priv;
+@@ -3081,6 +3111,7 @@ static struct phy_driver marvell_drivers
+ 		.get_sset_count = marvell_get_sset_count,
+ 		.get_strings = marvell_get_strings,
+ 		.get_stats = marvell_get_stats,
++		.led_brightness_set = m88e1318_led_brightness_set,
+ 	},
+ 	{
+ 		.phy_id = MARVELL_PHY_ID_88E1145,
+@@ -3187,6 +3218,7 @@ static struct phy_driver marvell_drivers
+ 		.cable_test_start = marvell_vct7_cable_test_start,
+ 		.cable_test_tdr_start = marvell_vct5_cable_test_tdr_start,
+ 		.cable_test_get_status = marvell_vct7_cable_test_get_status,
++		.led_brightness_set = m88e1318_led_brightness_set,
+ 	},
+ 	{
+ 		.phy_id = MARVELL_PHY_ID_88E1540,
+@@ -3213,6 +3245,7 @@ static struct phy_driver marvell_drivers
+ 		.cable_test_start = marvell_vct7_cable_test_start,
+ 		.cable_test_tdr_start = marvell_vct5_cable_test_tdr_start,
+ 		.cable_test_get_status = marvell_vct7_cable_test_get_status,
++		.led_brightness_set = m88e1318_led_brightness_set,
+ 	},
+ 	{
+ 		.phy_id = MARVELL_PHY_ID_88E1545,
+@@ -3239,6 +3272,7 @@ static struct phy_driver marvell_drivers
+ 		.cable_test_start = marvell_vct7_cable_test_start,
+ 		.cable_test_tdr_start = marvell_vct5_cable_test_tdr_start,
+ 		.cable_test_get_status = marvell_vct7_cable_test_get_status,
++		.led_brightness_set = m88e1318_led_brightness_set,
+ 	},
+ 	{
+ 		.phy_id = MARVELL_PHY_ID_88E3016,
+@@ -3380,6 +3414,7 @@ static struct phy_driver marvell_drivers
+ 		.get_stats = marvell_get_stats,
+ 		.get_tunable = m88e1540_get_tunable,
+ 		.set_tunable = m88e1540_set_tunable,
++		.led_brightness_set = m88e1318_led_brightness_set,
+ 	},
+ };
+ 
diff --git a/target/linux/generic/backport-6.1/801-v6.4-08-net-phy-phy_device-Call-into-the-PHY-driver-to-set-L.patch b/target/linux/generic/backport-6.1/801-v6.4-08-net-phy-phy_device-Call-into-the-PHY-driver-to-set-L.patch
new file mode 100644
index 00000000000000..e868722afab640
--- /dev/null
+++ b/target/linux/generic/backport-6.1/801-v6.4-08-net-phy-phy_device-Call-into-the-PHY-driver-to-set-L.patch
@@ -0,0 +1,73 @@
+From 4e901018432e38eab35d2a352661ce4727795be1 Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Mon, 17 Apr 2023 17:17:30 +0200
+Subject: [PATCH 8/9] net: phy: phy_device: Call into the PHY driver to set LED
+ blinking
+
+Linux LEDs can be requested to perform hardware accelerated
+blinking. Pass this to the PHY driver, if it implements the op.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/phy_device.c | 18 ++++++++++++++++++
+ include/linux/phy.h          | 12 ++++++++++++
+ 2 files changed, 30 insertions(+)
+
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -2948,6 +2948,22 @@ static int phy_led_set_brightness(struct
+ 	return err;
+ }
+ 
++static int phy_led_blink_set(struct led_classdev *led_cdev,
++			     unsigned long *delay_on,
++			     unsigned long *delay_off)
++{
++	struct phy_led *phyled = to_phy_led(led_cdev);
++	struct phy_device *phydev = phyled->phydev;
++	int err;
++
++	mutex_lock(&phydev->lock);
++	err = phydev->drv->led_blink_set(phydev, phyled->index,
++					 delay_on, delay_off);
++	mutex_unlock(&phydev->lock);
++
++	return err;
++}
++
+ static int of_phy_led(struct phy_device *phydev,
+ 		      struct device_node *led)
+ {
+@@ -2970,6 +2986,8 @@ static int of_phy_led(struct phy_device
+ 
+ 	if (phydev->drv->led_brightness_set)
+ 		cdev->brightness_set_blocking = phy_led_set_brightness;
++	if (phydev->drv->led_blink_set)
++		cdev->blink_set = phy_led_blink_set;
+ 	cdev->max_brightness = 1;
+ 	init_data.devicename = dev_name(&phydev->mdio.dev);
+ 	init_data.fwnode = of_fwnode_handle(led);
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -1001,6 +1001,18 @@ struct phy_driver {
+ 	 */
+ 	int (*led_brightness_set)(struct phy_device *dev,
+ 				  u8 index, enum led_brightness value);
++
++	/**
++	 * @led_blink_set: Set a PHY LED brightness.  Index indicates
++	 * which of the PHYs led should be configured to blink. Delays
++	 * are in milliseconds and if both are zero then a sensible
++	 * default should be chosen.  The call should adjust the
++	 * timings in that case and if it can't match the values
++	 * specified exactly.
++	 */
++	int (*led_blink_set)(struct phy_device *dev, u8 index,
++			     unsigned long *delay_on,
++			     unsigned long *delay_off);
+ };
+ #define to_phy_driver(d) container_of(to_mdio_common_driver(d),		\
+ 				      struct phy_driver, mdiodrv)
diff --git a/target/linux/generic/backport-6.1/801-v6.4-09-net-phy-marvell-Implement-led_blink_set.patch b/target/linux/generic/backport-6.1/801-v6.4-09-net-phy-marvell-Implement-led_blink_set.patch
new file mode 100644
index 00000000000000..8d5081a43c1039
--- /dev/null
+++ b/target/linux/generic/backport-6.1/801-v6.4-09-net-phy-marvell-Implement-led_blink_set.patch
@@ -0,0 +1,104 @@
+From ea9e86485decb2ac1750005bd96c166c9b780406 Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Mon, 17 Apr 2023 17:17:31 +0200
+Subject: [PATCH 9/9] net: phy: marvell: Implement led_blink_set()
+
+The Marvell PHY can blink the LEDs, simple on/off. All LEDs blink at
+the same rate, and the reset default is 84ms per blink, which is
+around 12Hz.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/marvell.c | 36 ++++++++++++++++++++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -147,6 +147,8 @@
+ #define MII_88E1318S_PHY_LED_FUNC		0x10
+ #define MII_88E1318S_PHY_LED_FUNC_OFF		(0x8)
+ #define MII_88E1318S_PHY_LED_FUNC_ON		(0x9)
++#define MII_88E1318S_PHY_LED_FUNC_HI_Z		(0xa)
++#define MII_88E1318S_PHY_LED_FUNC_BLINK		(0xb)
+ #define MII_88E1318S_PHY_LED_TCR		0x12
+ #define MII_88E1318S_PHY_LED_TCR_FORCE_INT	BIT(15)
+ #define MII_88E1318S_PHY_LED_TCR_INTn_ENABLE	BIT(7)
+@@ -2862,6 +2864,35 @@ static int m88e1318_led_brightness_set(s
+ 			       MII_88E1318S_PHY_LED_FUNC, reg);
+ }
+ 
++static int m88e1318_led_blink_set(struct phy_device *phydev, u8 index,
++				  unsigned long *delay_on,
++				  unsigned long *delay_off)
++{
++	int reg;
++
++	reg = phy_read_paged(phydev, MII_MARVELL_LED_PAGE,
++			     MII_88E1318S_PHY_LED_FUNC);
++	if (reg < 0)
++		return reg;
++
++	switch (index) {
++	case 0:
++	case 1:
++	case 2:
++		reg &= ~(0xf << (4 * index));
++			reg |= MII_88E1318S_PHY_LED_FUNC_BLINK << (4 * index);
++			/* Reset default is 84ms */
++			*delay_on = 84 / 2;
++			*delay_off = 84 / 2;
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	return phy_write_paged(phydev, MII_MARVELL_LED_PAGE,
++			       MII_88E1318S_PHY_LED_FUNC, reg);
++}
++
+ static int marvell_probe(struct phy_device *phydev)
+ {
+ 	struct marvell_priv *priv;
+@@ -3112,6 +3143,7 @@ static struct phy_driver marvell_drivers
+ 		.get_strings = marvell_get_strings,
+ 		.get_stats = marvell_get_stats,
+ 		.led_brightness_set = m88e1318_led_brightness_set,
++		.led_blink_set = m88e1318_led_blink_set,
+ 	},
+ 	{
+ 		.phy_id = MARVELL_PHY_ID_88E1145,
+@@ -3219,6 +3251,7 @@ static struct phy_driver marvell_drivers
+ 		.cable_test_tdr_start = marvell_vct5_cable_test_tdr_start,
+ 		.cable_test_get_status = marvell_vct7_cable_test_get_status,
+ 		.led_brightness_set = m88e1318_led_brightness_set,
++		.led_blink_set = m88e1318_led_blink_set,
+ 	},
+ 	{
+ 		.phy_id = MARVELL_PHY_ID_88E1540,
+@@ -3246,6 +3279,7 @@ static struct phy_driver marvell_drivers
+ 		.cable_test_tdr_start = marvell_vct5_cable_test_tdr_start,
+ 		.cable_test_get_status = marvell_vct7_cable_test_get_status,
+ 		.led_brightness_set = m88e1318_led_brightness_set,
++		.led_blink_set = m88e1318_led_blink_set,
+ 	},
+ 	{
+ 		.phy_id = MARVELL_PHY_ID_88E1545,
+@@ -3273,6 +3307,7 @@ static struct phy_driver marvell_drivers
+ 		.cable_test_tdr_start = marvell_vct5_cable_test_tdr_start,
+ 		.cable_test_get_status = marvell_vct7_cable_test_get_status,
+ 		.led_brightness_set = m88e1318_led_brightness_set,
++		.led_blink_set = m88e1318_led_blink_set,
+ 	},
+ 	{
+ 		.phy_id = MARVELL_PHY_ID_88E3016,
+@@ -3415,6 +3450,7 @@ static struct phy_driver marvell_drivers
+ 		.get_tunable = m88e1540_get_tunable,
+ 		.set_tunable = m88e1540_set_tunable,
+ 		.led_brightness_set = m88e1318_led_brightness_set,
++		.led_blink_set = m88e1318_led_blink_set,
+ 	},
+ };
+ 
diff --git a/target/linux/generic/backport-6.1/802-v6.4-net-phy-marvell-Fix-inconsistent-indenting-in-led_bl.patch b/target/linux/generic/backport-6.1/802-v6.4-net-phy-marvell-Fix-inconsistent-indenting-in-led_bl.patch
new file mode 100644
index 00000000000000..56df3f095e4c5c
--- /dev/null
+++ b/target/linux/generic/backport-6.1/802-v6.4-net-phy-marvell-Fix-inconsistent-indenting-in-led_bl.patch
@@ -0,0 +1,38 @@
+From 4774ad841bef97cc51df90195338c5b2573dd4cb Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Sun, 23 Apr 2023 19:28:00 +0200
+Subject: [PATCH] net: phy: marvell: Fix inconsistent indenting in
+ led_blink_set
+
+Fix inconsistent indeinting in m88e1318_led_blink_set reported by kernel
+test robot, probably done by the presence of an if condition dropped in
+later revision of the same code.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Link: https://lore.kernel.org/oe-kbuild-all/202304240007.0VEX8QYG-lkp@intel.com/
+Fixes: ea9e86485dec ("net: phy: marvell: Implement led_blink_set()")
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20230423172800.3470-1-ansuelsmth@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/marvell.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -2880,10 +2880,10 @@ static int m88e1318_led_blink_set(struct
+ 	case 1:
+ 	case 2:
+ 		reg &= ~(0xf << (4 * index));
+-			reg |= MII_88E1318S_PHY_LED_FUNC_BLINK << (4 * index);
+-			/* Reset default is 84ms */
+-			*delay_on = 84 / 2;
+-			*delay_off = 84 / 2;
++		reg |= MII_88E1318S_PHY_LED_FUNC_BLINK << (4 * index);
++		/* Reset default is 84ms */
++		*delay_on = 84 / 2;
++		*delay_off = 84 / 2;
+ 		break;
+ 	default:
+ 		return -EINVAL;
diff --git a/target/linux/generic/backport-6.1/803-v6.5-01-leds-trigger-netdev-Recheck-NETDEV_LED_MODE_LINKUP-o.patch b/target/linux/generic/backport-6.1/803-v6.5-01-leds-trigger-netdev-Recheck-NETDEV_LED_MODE_LINKUP-o.patch
new file mode 100644
index 00000000000000..3385023168de17
--- /dev/null
+++ b/target/linux/generic/backport-6.1/803-v6.5-01-leds-trigger-netdev-Recheck-NETDEV_LED_MODE_LINKUP-o.patch
@@ -0,0 +1,35 @@
+From cee4bd16c3195a701be683f7da9e88c6e11acb73 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 19 Apr 2023 23:07:39 +0200
+Subject: [PATCH 1/5] leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on
+ dev rename
+
+Dev can be renamed also while up for supported device. We currently
+wrongly clear the NETDEV_LED_MODE_LINKUP flag on NETDEV_CHANGENAME
+event.
+
+Fix this by rechecking if the carrier is ok on NETDEV_CHANGENAME and
+correctly set the NETDEV_LED_MODE_LINKUP bit.
+
+Fixes: 5f820ed52371 ("leds: trigger: netdev: fix handling on interface rename")
+Cc: stable@vger.kernel.org # v5.5+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230419210743.3594-2-ansuelsmth@gmail.com
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -318,6 +318,9 @@ static int netdev_trig_notify(struct not
+ 	clear_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode);
+ 	switch (evt) {
+ 	case NETDEV_CHANGENAME:
++		if (netif_carrier_ok(dev))
++			set_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode);
++		fallthrough;
+ 	case NETDEV_REGISTER:
+ 		if (trigger_data->net_dev)
+ 			dev_put(trigger_data->net_dev);
diff --git a/target/linux/generic/backport-6.1/803-v6.5-02-leds-trigger-netdev-Drop-NETDEV_LED_MODE_LINKUP-from.patch b/target/linux/generic/backport-6.1/803-v6.5-02-leds-trigger-netdev-Drop-NETDEV_LED_MODE_LINKUP-from.patch
new file mode 100644
index 00000000000000..3170c260580a4e
--- /dev/null
+++ b/target/linux/generic/backport-6.1/803-v6.5-02-leds-trigger-netdev-Drop-NETDEV_LED_MODE_LINKUP-from.patch
@@ -0,0 +1,87 @@
+From e2f24cb1b5daf9a4f6f3ba574c1fa74aab9807a4 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 19 Apr 2023 23:07:40 +0200
+Subject: [PATCH 2/5] leds: trigger: netdev: Drop NETDEV_LED_MODE_LINKUP from
+ mode
+
+Putting NETDEV_LED_MODE_LINKUP in the same list of the netdev trigger
+modes is wrong as it's used to set the link state of the device and not
+to set a blink mode as it's done by NETDEV_LED_LINK, NETDEV_LED_TX and
+NETDEV_LED_RX. It's also wrong to put this state in the same bitmap of the
+netdev trigger mode and should be external to it.
+
+Drop NETDEV_LED_MODE_LINKUP from mode list and convert to a simple bool
+that will be true or false based on the carrier link. No functional
+change intended.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230419210743.3594-3-ansuelsmth@gmail.com
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 19 ++++++++-----------
+ 1 file changed, 8 insertions(+), 11 deletions(-)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -50,10 +50,10 @@ struct led_netdev_data {
+ 	unsigned int last_activity;
+ 
+ 	unsigned long mode;
++	bool carrier_link_up;
+ #define NETDEV_LED_LINK	0
+ #define NETDEV_LED_TX	1
+ #define NETDEV_LED_RX	2
+-#define NETDEV_LED_MODE_LINKUP	3
+ };
+ 
+ enum netdev_led_attr {
+@@ -73,9 +73,9 @@ static void set_baseline_state(struct le
+ 	if (!led_cdev->blink_brightness)
+ 		led_cdev->blink_brightness = led_cdev->max_brightness;
+ 
+-	if (!test_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode))
++	if (!trigger_data->carrier_link_up) {
+ 		led_set_brightness(led_cdev, LED_OFF);
+-	else {
++	} else {
+ 		if (test_bit(NETDEV_LED_LINK, &trigger_data->mode))
+ 			led_set_brightness(led_cdev,
+ 					   led_cdev->blink_brightness);
+@@ -131,10 +131,9 @@ static ssize_t device_name_store(struct
+ 		trigger_data->net_dev =
+ 		    dev_get_by_name(&init_net, trigger_data->device_name);
+ 
+-	clear_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode);
++	trigger_data->carrier_link_up = false;
+ 	if (trigger_data->net_dev != NULL)
+-		if (netif_carrier_ok(trigger_data->net_dev))
+-			set_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode);
++		trigger_data->carrier_link_up = netif_carrier_ok(trigger_data->net_dev);
+ 
+ 	trigger_data->last_activity = 0;
+ 
+@@ -315,11 +314,10 @@ static int netdev_trig_notify(struct not
+ 
+ 	spin_lock_bh(&trigger_data->lock);
+ 
+-	clear_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode);
++	trigger_data->carrier_link_up = false;
+ 	switch (evt) {
+ 	case NETDEV_CHANGENAME:
+-		if (netif_carrier_ok(dev))
+-			set_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode);
++		trigger_data->carrier_link_up = netif_carrier_ok(dev);
+ 		fallthrough;
+ 	case NETDEV_REGISTER:
+ 		if (trigger_data->net_dev)
+@@ -333,8 +331,7 @@ static int netdev_trig_notify(struct not
+ 		break;
+ 	case NETDEV_UP:
+ 	case NETDEV_CHANGE:
+-		if (netif_carrier_ok(dev))
+-			set_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode);
++		trigger_data->carrier_link_up = netif_carrier_ok(dev);
+ 		break;
+ 	}
+ 
diff --git a/target/linux/generic/backport-6.1/803-v6.5-03-leds-trigger-netdev-Rename-add-namespace-to-netdev-t.patch b/target/linux/generic/backport-6.1/803-v6.5-03-leds-trigger-netdev-Rename-add-namespace-to-netdev-t.patch
new file mode 100644
index 00000000000000..19cc1d7c9edc16
--- /dev/null
+++ b/target/linux/generic/backport-6.1/803-v6.5-03-leds-trigger-netdev-Rename-add-namespace-to-netdev-t.patch
@@ -0,0 +1,149 @@
+From bdec9cb83936e0ac4cb87fed5b49fad0175f7dec Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 19 Apr 2023 23:07:41 +0200
+Subject: [PATCH 3/5] leds: trigger: netdev: Rename add namespace to netdev
+ trigger enum modes
+
+Rename NETDEV trigger enum modes to a more symbolic name and add a
+namespace to them.
+
+Also add __TRIGGER_NETDEV_MAX to identify the max modes of the netdev
+trigger.
+
+This is a cleanup to drop the define and no behaviour change are
+intended.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230419210743.3594-4-ansuelsmth@gmail.com
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 58 ++++++++++++---------------
+ 1 file changed, 25 insertions(+), 33 deletions(-)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -51,15 +51,15 @@ struct led_netdev_data {
+ 
+ 	unsigned long mode;
+ 	bool carrier_link_up;
+-#define NETDEV_LED_LINK	0
+-#define NETDEV_LED_TX	1
+-#define NETDEV_LED_RX	2
+ };
+ 
+-enum netdev_led_attr {
+-	NETDEV_ATTR_LINK,
+-	NETDEV_ATTR_TX,
+-	NETDEV_ATTR_RX
++enum led_trigger_netdev_modes {
++	TRIGGER_NETDEV_LINK = 0,
++	TRIGGER_NETDEV_TX,
++	TRIGGER_NETDEV_RX,
++
++	/* Keep last */
++	__TRIGGER_NETDEV_MAX,
+ };
+ 
+ static void set_baseline_state(struct led_netdev_data *trigger_data)
+@@ -76,7 +76,7 @@ static void set_baseline_state(struct le
+ 	if (!trigger_data->carrier_link_up) {
+ 		led_set_brightness(led_cdev, LED_OFF);
+ 	} else {
+-		if (test_bit(NETDEV_LED_LINK, &trigger_data->mode))
++		if (test_bit(TRIGGER_NETDEV_LINK, &trigger_data->mode))
+ 			led_set_brightness(led_cdev,
+ 					   led_cdev->blink_brightness);
+ 		else
+@@ -85,8 +85,8 @@ static void set_baseline_state(struct le
+ 		/* If we are looking for RX/TX start periodically
+ 		 * checking stats
+ 		 */
+-		if (test_bit(NETDEV_LED_TX, &trigger_data->mode) ||
+-		    test_bit(NETDEV_LED_RX, &trigger_data->mode))
++		if (test_bit(TRIGGER_NETDEV_TX, &trigger_data->mode) ||
++		    test_bit(TRIGGER_NETDEV_RX, &trigger_data->mode))
+ 			schedule_delayed_work(&trigger_data->work, 0);
+ 	}
+ }
+@@ -146,20 +146,16 @@ static ssize_t device_name_store(struct
+ static DEVICE_ATTR_RW(device_name);
+ 
+ static ssize_t netdev_led_attr_show(struct device *dev, char *buf,
+-	enum netdev_led_attr attr)
++				    enum led_trigger_netdev_modes attr)
+ {
+ 	struct led_netdev_data *trigger_data = led_trigger_get_drvdata(dev);
+ 	int bit;
+ 
+ 	switch (attr) {
+-	case NETDEV_ATTR_LINK:
+-		bit = NETDEV_LED_LINK;
+-		break;
+-	case NETDEV_ATTR_TX:
+-		bit = NETDEV_LED_TX;
+-		break;
+-	case NETDEV_ATTR_RX:
+-		bit = NETDEV_LED_RX;
++	case TRIGGER_NETDEV_LINK:
++	case TRIGGER_NETDEV_TX:
++	case TRIGGER_NETDEV_RX:
++		bit = attr;
+ 		break;
+ 	default:
+ 		return -EINVAL;
+@@ -169,7 +165,7 @@ static ssize_t netdev_led_attr_show(stru
+ }
+ 
+ static ssize_t netdev_led_attr_store(struct device *dev, const char *buf,
+-	size_t size, enum netdev_led_attr attr)
++				     size_t size, enum led_trigger_netdev_modes attr)
+ {
+ 	struct led_netdev_data *trigger_data = led_trigger_get_drvdata(dev);
+ 	unsigned long state;
+@@ -181,14 +177,10 @@ static ssize_t netdev_led_attr_store(str
+ 		return ret;
+ 
+ 	switch (attr) {
+-	case NETDEV_ATTR_LINK:
+-		bit = NETDEV_LED_LINK;
+-		break;
+-	case NETDEV_ATTR_TX:
+-		bit = NETDEV_LED_TX;
+-		break;
+-	case NETDEV_ATTR_RX:
+-		bit = NETDEV_LED_RX;
++	case TRIGGER_NETDEV_LINK:
++	case TRIGGER_NETDEV_TX:
++	case TRIGGER_NETDEV_RX:
++		bit = attr;
+ 		break;
+ 	default:
+ 		return -EINVAL;
+@@ -360,21 +352,21 @@ static void netdev_trig_work(struct work
+ 	}
+ 
+ 	/* If we are not looking for RX/TX then return  */
+-	if (!test_bit(NETDEV_LED_TX, &trigger_data->mode) &&
+-	    !test_bit(NETDEV_LED_RX, &trigger_data->mode))
++	if (!test_bit(TRIGGER_NETDEV_TX, &trigger_data->mode) &&
++	    !test_bit(TRIGGER_NETDEV_RX, &trigger_data->mode))
+ 		return;
+ 
+ 	dev_stats = dev_get_stats(trigger_data->net_dev, &temp);
+ 	new_activity =
+-	    (test_bit(NETDEV_LED_TX, &trigger_data->mode) ?
++	    (test_bit(TRIGGER_NETDEV_TX, &trigger_data->mode) ?
+ 		dev_stats->tx_packets : 0) +
+-	    (test_bit(NETDEV_LED_RX, &trigger_data->mode) ?
++	    (test_bit(TRIGGER_NETDEV_RX, &trigger_data->mode) ?
+ 		dev_stats->rx_packets : 0);
+ 
+ 	if (trigger_data->last_activity != new_activity) {
+ 		led_stop_software_blink(trigger_data->led_cdev);
+ 
+-		invert = test_bit(NETDEV_LED_LINK, &trigger_data->mode);
++		invert = test_bit(TRIGGER_NETDEV_LINK, &trigger_data->mode);
+ 		interval = jiffies_to_msecs(
+ 				atomic_read(&trigger_data->interval));
+ 		/* base state is ON (link present) */
diff --git a/target/linux/generic/backport-6.1/803-v6.5-04-leds-trigger-netdev-Convert-device-attr-to-macro.patch b/target/linux/generic/backport-6.1/803-v6.5-04-leds-trigger-netdev-Convert-device-attr-to-macro.patch
new file mode 100644
index 00000000000000..3b45951f5706ad
--- /dev/null
+++ b/target/linux/generic/backport-6.1/803-v6.5-04-leds-trigger-netdev-Convert-device-attr-to-macro.patch
@@ -0,0 +1,82 @@
+From 164b67d53476a9d114be85c885bd31f783835be4 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 19 Apr 2023 23:07:42 +0200
+Subject: [PATCH 4/5] leds: trigger: netdev: Convert device attr to macro
+
+Convert link tx and rx device attr to a common macro to reduce common
+code and in preparation for additional attr.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230419210743.3594-5-ansuelsmth@gmail.com
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 57 ++++++++-------------------
+ 1 file changed, 16 insertions(+), 41 deletions(-)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -198,47 +198,22 @@ static ssize_t netdev_led_attr_store(str
+ 	return size;
+ }
+ 
+-static ssize_t link_show(struct device *dev,
+-	struct device_attribute *attr, char *buf)
+-{
+-	return netdev_led_attr_show(dev, buf, NETDEV_ATTR_LINK);
+-}
+-
+-static ssize_t link_store(struct device *dev,
+-	struct device_attribute *attr, const char *buf, size_t size)
+-{
+-	return netdev_led_attr_store(dev, buf, size, NETDEV_ATTR_LINK);
+-}
+-
+-static DEVICE_ATTR_RW(link);
+-
+-static ssize_t tx_show(struct device *dev,
+-	struct device_attribute *attr, char *buf)
+-{
+-	return netdev_led_attr_show(dev, buf, NETDEV_ATTR_TX);
+-}
+-
+-static ssize_t tx_store(struct device *dev,
+-	struct device_attribute *attr, const char *buf, size_t size)
+-{
+-	return netdev_led_attr_store(dev, buf, size, NETDEV_ATTR_TX);
+-}
+-
+-static DEVICE_ATTR_RW(tx);
+-
+-static ssize_t rx_show(struct device *dev,
+-	struct device_attribute *attr, char *buf)
+-{
+-	return netdev_led_attr_show(dev, buf, NETDEV_ATTR_RX);
+-}
+-
+-static ssize_t rx_store(struct device *dev,
+-	struct device_attribute *attr, const char *buf, size_t size)
+-{
+-	return netdev_led_attr_store(dev, buf, size, NETDEV_ATTR_RX);
+-}
+-
+-static DEVICE_ATTR_RW(rx);
++#define DEFINE_NETDEV_TRIGGER(trigger_name, trigger) \
++	static ssize_t trigger_name##_show(struct device *dev, \
++		struct device_attribute *attr, char *buf) \
++	{ \
++		return netdev_led_attr_show(dev, buf, trigger); \
++	} \
++	static ssize_t trigger_name##_store(struct device *dev, \
++		struct device_attribute *attr, const char *buf, size_t size) \
++	{ \
++		return netdev_led_attr_store(dev, buf, size, trigger); \
++	} \
++	static DEVICE_ATTR_RW(trigger_name)
++
++DEFINE_NETDEV_TRIGGER(link, TRIGGER_NETDEV_LINK);
++DEFINE_NETDEV_TRIGGER(tx, TRIGGER_NETDEV_TX);
++DEFINE_NETDEV_TRIGGER(rx, TRIGGER_NETDEV_RX);
+ 
+ static ssize_t interval_show(struct device *dev,
+ 			     struct device_attribute *attr, char *buf)
diff --git a/target/linux/generic/backport-6.1/803-v6.5-05-leds-trigger-netdev-Use-mutex-instead-of-spinlocks.patch b/target/linux/generic/backport-6.1/803-v6.5-05-leds-trigger-netdev-Use-mutex-instead-of-spinlocks.patch
new file mode 100644
index 00000000000000..180bee96128a5d
--- /dev/null
+++ b/target/linux/generic/backport-6.1/803-v6.5-05-leds-trigger-netdev-Use-mutex-instead-of-spinlocks.patch
@@ -0,0 +1,106 @@
+From d1b9e1391ab2dc80e9db87fe8b2de015c651e4c9 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 19 Apr 2023 23:07:43 +0200
+Subject: [PATCH 5/5] leds: trigger: netdev: Use mutex instead of spinlocks
+
+Some LEDs may require to sleep while doing some operation like setting
+brightness and other cleanup.
+
+For this reason, using a spinlock will cause a sleep under spinlock
+warning.
+
+It should be safe to convert this to a sleepable lock since:
+- sysfs read/write can sleep
+- netdev_trig_work is a work queue and can sleep
+- netdev _trig_notify can sleep
+
+The spinlock was used when brightness didn't support sleeping, but this
+changed and now it supported with brightness_set_blocking().
+
+Convert to mutex lock to permit sleeping using brightness_set_blocking().
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230419210743.3594-6-ansuelsmth@gmail.com
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -20,7 +20,7 @@
+ #include <linux/list.h>
+ #include <linux/module.h>
+ #include <linux/netdevice.h>
+-#include <linux/spinlock.h>
++#include <linux/mutex.h>
+ #include <linux/timer.h>
+ #include "../leds.h"
+ 
+@@ -37,7 +37,7 @@
+  */
+ 
+ struct led_netdev_data {
+-	spinlock_t lock;
++	struct mutex lock;
+ 
+ 	struct delayed_work work;
+ 	struct notifier_block notifier;
+@@ -97,9 +97,9 @@ static ssize_t device_name_show(struct d
+ 	struct led_netdev_data *trigger_data = led_trigger_get_drvdata(dev);
+ 	ssize_t len;
+ 
+-	spin_lock_bh(&trigger_data->lock);
++	mutex_lock(&trigger_data->lock);
+ 	len = sprintf(buf, "%s\n", trigger_data->device_name);
+-	spin_unlock_bh(&trigger_data->lock);
++	mutex_unlock(&trigger_data->lock);
+ 
+ 	return len;
+ }
+@@ -115,7 +115,7 @@ static ssize_t device_name_store(struct
+ 
+ 	cancel_delayed_work_sync(&trigger_data->work);
+ 
+-	spin_lock_bh(&trigger_data->lock);
++	mutex_lock(&trigger_data->lock);
+ 
+ 	if (trigger_data->net_dev) {
+ 		dev_put(trigger_data->net_dev);
+@@ -138,7 +138,7 @@ static ssize_t device_name_store(struct
+ 	trigger_data->last_activity = 0;
+ 
+ 	set_baseline_state(trigger_data);
+-	spin_unlock_bh(&trigger_data->lock);
++	mutex_unlock(&trigger_data->lock);
+ 
+ 	return size;
+ }
+@@ -279,7 +279,7 @@ static int netdev_trig_notify(struct not
+ 
+ 	cancel_delayed_work_sync(&trigger_data->work);
+ 
+-	spin_lock_bh(&trigger_data->lock);
++	mutex_lock(&trigger_data->lock);
+ 
+ 	trigger_data->carrier_link_up = false;
+ 	switch (evt) {
+@@ -304,7 +304,7 @@ static int netdev_trig_notify(struct not
+ 
+ 	set_baseline_state(trigger_data);
+ 
+-	spin_unlock_bh(&trigger_data->lock);
++	mutex_unlock(&trigger_data->lock);
+ 
+ 	return NOTIFY_DONE;
+ }
+@@ -365,7 +365,7 @@ static int netdev_trig_activate(struct l
+ 	if (!trigger_data)
+ 		return -ENOMEM;
+ 
+-	spin_lock_init(&trigger_data->lock);
++	mutex_init(&trigger_data->lock);
+ 
+ 	trigger_data->notifier.notifier_call = netdev_trig_notify;
+ 	trigger_data->notifier.priority = 10;
diff --git a/target/linux/generic/backport-6.1/804-v6.5-01-leds-add-APIs-for-LEDs-hw-control.patch b/target/linux/generic/backport-6.1/804-v6.5-01-leds-add-APIs-for-LEDs-hw-control.patch
new file mode 100644
index 00000000000000..ac186117338ff5
--- /dev/null
+++ b/target/linux/generic/backport-6.1/804-v6.5-01-leds-add-APIs-for-LEDs-hw-control.patch
@@ -0,0 +1,74 @@
+From ed554d3f945179c5b159bddfad7be34b403fe11a Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 29 May 2023 18:32:31 +0200
+Subject: [PATCH 01/13] leds: add APIs for LEDs hw control
+
+Add an option to permit LED driver to declare support for a specific
+trigger to use hw control and setup the LED to blink based on specific
+provided modes.
+
+Add APIs for LEDs hw control. These functions will be used to activate
+hardware control where a LED will use the provided flags, from an
+unique defined supported trigger, to setup the LED to be driven by
+hardware.
+
+Add hw_control_is_supported() to ask the LED driver if the requested
+mode by the trigger are supported and the LED can be setup to follow
+the requested modes.
+
+Deactivate hardware blink control by setting brightness to LED_OFF via
+the brightness_set() callback.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/linux/leds.h | 37 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+--- a/include/linux/leds.h
++++ b/include/linux/leds.h
+@@ -164,6 +164,43 @@ struct led_classdev {
+ 
+ 	/* LEDs that have private triggers have this set */
+ 	struct led_hw_trigger_type	*trigger_type;
++
++	/* Unique trigger name supported by LED set in hw control mode */
++	const char		*hw_control_trigger;
++	/*
++	 * Check if the LED driver supports the requested mode provided by the
++	 * defined supported trigger to setup the LED to hw control mode.
++	 *
++	 * Return 0 on success. Return -EOPNOTSUPP when the passed flags are not
++	 * supported and software fallback needs to be used.
++	 * Return a negative error number on any other case  for check fail due
++	 * to various reason like device not ready or timeouts.
++	 */
++	int			(*hw_control_is_supported)(struct led_classdev *led_cdev,
++							   unsigned long flags);
++	/*
++	 * Activate hardware control, LED driver will use the provided flags
++	 * from the supported trigger and setup the LED to be driven by hardware
++	 * following the requested mode from the trigger flags.
++	 * Deactivate hardware blink control by setting brightness to LED_OFF via
++	 * the brightness_set() callback.
++	 *
++	 * Return 0 on success, a negative error number on flags apply fail.
++	 */
++	int			(*hw_control_set)(struct led_classdev *led_cdev,
++						  unsigned long flags);
++	/*
++	 * Get from the LED driver the current mode that the LED is set in hw
++	 * control mode and put them in flags.
++	 * Trigger can use this to get the initial state of a LED already set in
++	 * hardware blink control.
++	 *
++	 * Return 0 on success, a negative error number on failing parsing the
++	 * initial mode. Error from this function is NOT FATAL as the device
++	 * may be in a not supported initial state by the attached LED trigger.
++	 */
++	int			(*hw_control_get)(struct led_classdev *led_cdev,
++						  unsigned long *flags);
+ #endif
+ 
+ #ifdef CONFIG_LEDS_BRIGHTNESS_HW_CHANGED
diff --git a/target/linux/generic/backport-6.1/804-v6.5-02-leds-add-API-to-get-attached-device-for-LED-hw-contr.patch b/target/linux/generic/backport-6.1/804-v6.5-02-leds-add-API-to-get-attached-device-for-LED-hw-contr.patch
new file mode 100644
index 00000000000000..1a221727a01d7d
--- /dev/null
+++ b/target/linux/generic/backport-6.1/804-v6.5-02-leds-add-API-to-get-attached-device-for-LED-hw-contr.patch
@@ -0,0 +1,37 @@
+From 052c38eb17e866c5b4cd43924e7a5e20167b55c0 Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Mon, 29 May 2023 18:32:32 +0200
+Subject: [PATCH 02/13] leds: add API to get attached device for LED hw control
+
+Some specific LED triggers blink the LED based on events from a device
+or subsystem.
+For example, an LED could be blinked to indicate a network device is
+receiving packets, or a disk is reading blocks. To correctly enable and
+request the hw control of the LED, the trigger has to check if the
+network interface or block device configured via a /sys/class/led file
+match the one the LED driver provide for hw control for.
+
+Provide an API call to get the device which the LED blinks for.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/linux/leds.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/include/linux/leds.h
++++ b/include/linux/leds.h
+@@ -201,6 +201,12 @@ struct led_classdev {
+ 	 */
+ 	int			(*hw_control_get)(struct led_classdev *led_cdev,
+ 						  unsigned long *flags);
++	/*
++	 * Get the device this LED blinks in response to.
++	 * e.g. for a PHY LED, it is the network device. If the LED is
++	 * not yet associated to a device, return NULL.
++	 */
++	struct device		*(*hw_control_get_device)(struct led_classdev *led_cdev);
+ #endif
+ 
+ #ifdef CONFIG_LEDS_BRIGHTNESS_HW_CHANGED
diff --git a/target/linux/generic/backport-6.1/804-v6.5-03-Documentation-leds-leds-class-Document-new-Hardware-.patch b/target/linux/generic/backport-6.1/804-v6.5-03-Documentation-leds-leds-class-Document-new-Hardware-.patch
new file mode 100644
index 00000000000000..af9fb7fdc36526
--- /dev/null
+++ b/target/linux/generic/backport-6.1/804-v6.5-03-Documentation-leds-leds-class-Document-new-Hardware-.patch
@@ -0,0 +1,113 @@
+From 8aa2fd7b66980ecd2e45e95af61cf7eafede1211 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 29 May 2023 18:32:33 +0200
+Subject: [PATCH 03/13] Documentation: leds: leds-class: Document new Hardware
+ driven LEDs APIs
+
+Document new Hardware driven LEDs APIs.
+
+Some LEDs can be programmed to be driven by hardware. This is not
+limited to blink but also to turn off or on autonomously.
+To support this feature, a LED needs to implement various additional
+ops and needs to declare specific support for the supported triggers.
+
+Add documentation for each required value and API to make hw control
+possible and implementable by both LEDs and triggers.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ Documentation/leds/leds-class.rst | 81 +++++++++++++++++++++++++++++++
+ 1 file changed, 81 insertions(+)
+
+--- a/Documentation/leds/leds-class.rst
++++ b/Documentation/leds/leds-class.rst
+@@ -169,6 +169,87 @@ Setting the brightness to zero with brig
+ should completely turn off the LED and cancel the previously programmed
+ hardware blinking function, if any.
+ 
++Hardware driven LEDs
++====================
++
++Some LEDs can be programmed to be driven by hardware. This is not
++limited to blink but also to turn off or on autonomously.
++To support this feature, a LED needs to implement various additional
++ops and needs to declare specific support for the supported triggers.
++
++With hw control we refer to the LED driven by hardware.
++
++LED driver must define the following value to support hw control:
++
++    - hw_control_trigger:
++               unique trigger name supported by the LED in hw control
++               mode.
++
++LED driver must implement the following API to support hw control:
++    - hw_control_is_supported:
++                check if the flags passed by the supported trigger can
++                be parsed and activate hw control on the LED.
++
++                Return 0 if the passed flags mask is supported and
++                can be set with hw_control_set().
++
++                If the passed flags mask is not supported -EOPNOTSUPP
++                must be returned, the LED trigger will use software
++                fallback in this case.
++
++                Return a negative error in case of any other error like
++                device not ready or timeouts.
++
++     - hw_control_set:
++                activate hw control. LED driver will use the provided
++                flags passed from the supported trigger, parse them to
++                a set of mode and setup the LED to be driven by hardware
++                following the requested modes.
++
++                Set LED_OFF via the brightness_set to deactivate hw control.
++
++                Return 0 on success, a negative error number on failing to
++                apply flags.
++
++    - hw_control_get:
++                get active modes from a LED already in hw control, parse
++                them and set in flags the current active flags for the
++                supported trigger.
++
++                Return 0 on success, a negative error number on failing
++                parsing the initial mode.
++                Error from this function is NOT FATAL as the device may
++                be in a not supported initial state by the attached LED
++                trigger.
++
++    - hw_control_get_device:
++                return the device associated with the LED driver in
++                hw control. A trigger might use this to match the
++                returned device from this function with a configured
++                device for the trigger as the source for blinking
++                events and correctly enable hw control.
++                (example a netdev trigger configured to blink for a
++                particular dev match the returned dev from get_device
++                to set hw control)
++
++                Returns a pointer to a struct device or NULL if nothing
++                is currently attached.
++
++LED driver can activate additional modes by default to workaround the
++impossibility of supporting each different mode on the supported trigger.
++Examples are hardcoding the blink speed to a set interval, enable special
++feature like bypassing blink if some requirements are not met.
++
++A trigger should first check if the hw control API are supported by the LED
++driver and check if the trigger is supported to verify if hw control is possible,
++use hw_control_is_supported to check if the flags are supported and only at
++the end use hw_control_set to activate hw control.
++
++A trigger can use hw_control_get to check if a LED is already in hw control
++and init their flags.
++
++When the LED is in hw control, no software blink is possible and doing so
++will effectively disable hw control.
+ 
+ Known Issues
+ ============
diff --git a/target/linux/generic/backport-6.1/804-v6.5-04-leds-trigger-netdev-refactor-code-setting-device-nam.patch b/target/linux/generic/backport-6.1/804-v6.5-04-leds-trigger-netdev-refactor-code-setting-device-nam.patch
new file mode 100644
index 00000000000000..3c804c0b412e3c
--- /dev/null
+++ b/target/linux/generic/backport-6.1/804-v6.5-04-leds-trigger-netdev-refactor-code-setting-device-nam.patch
@@ -0,0 +1,69 @@
+From 28a6a2ef18ad840a390d519840c303b03040961c Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Mon, 29 May 2023 18:32:34 +0200
+Subject: [PATCH 04/13] leds: trigger: netdev: refactor code setting device
+ name
+
+Move the code into a helper, ready for it to be called at
+other times. No intended behaviour change.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 29 ++++++++++++++++++---------
+ 1 file changed, 20 insertions(+), 9 deletions(-)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -104,15 +104,9 @@ static ssize_t device_name_show(struct d
+ 	return len;
+ }
+ 
+-static ssize_t device_name_store(struct device *dev,
+-				 struct device_attribute *attr, const char *buf,
+-				 size_t size)
++static int set_device_name(struct led_netdev_data *trigger_data,
++			   const char *name, size_t size)
+ {
+-	struct led_netdev_data *trigger_data = led_trigger_get_drvdata(dev);
+-
+-	if (size >= IFNAMSIZ)
+-		return -EINVAL;
+-
+ 	cancel_delayed_work_sync(&trigger_data->work);
+ 
+ 	mutex_lock(&trigger_data->lock);
+@@ -122,7 +116,7 @@ static ssize_t device_name_store(struct
+ 		trigger_data->net_dev = NULL;
+ 	}
+ 
+-	memcpy(trigger_data->device_name, buf, size);
++	memcpy(trigger_data->device_name, name, size);
+ 	trigger_data->device_name[size] = 0;
+ 	if (size > 0 && trigger_data->device_name[size - 1] == '\n')
+ 		trigger_data->device_name[size - 1] = 0;
+@@ -140,6 +134,23 @@ static ssize_t device_name_store(struct
+ 	set_baseline_state(trigger_data);
+ 	mutex_unlock(&trigger_data->lock);
+ 
++	return 0;
++}
++
++static ssize_t device_name_store(struct device *dev,
++				 struct device_attribute *attr, const char *buf,
++				 size_t size)
++{
++	struct led_netdev_data *trigger_data = led_trigger_get_drvdata(dev);
++	int ret;
++
++	if (size >= IFNAMSIZ)
++		return -EINVAL;
++
++	ret = set_device_name(trigger_data, buf, size);
++
++	if (ret < 0)
++		return ret;
+ 	return size;
+ }
+ 
diff --git a/target/linux/generic/backport-6.1/804-v6.5-05-leds-trigger-netdev-introduce-check-for-possible-hw-.patch b/target/linux/generic/backport-6.1/804-v6.5-05-leds-trigger-netdev-introduce-check-for-possible-hw-.patch
new file mode 100644
index 00000000000000..284b519482cfed
--- /dev/null
+++ b/target/linux/generic/backport-6.1/804-v6.5-05-leds-trigger-netdev-introduce-check-for-possible-hw-.patch
@@ -0,0 +1,54 @@
+From 4fd1b6d47a7a38e81fdc6f8be2ccd4216b3f93db Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 29 May 2023 18:32:35 +0200
+Subject: [PATCH 05/13] leds: trigger: netdev: introduce check for possible hw
+ control
+
+Introduce function to check if the requested mode can use hw control in
+preparation for hw control support. Currently everything is handled in
+software so can_hw_control will always return false.
+
+Add knob with the new value hw_control in trigger_data struct to
+set hw control possible. Useful for future implementation to implement
+in set_baseline_state() the required function to set the requested mode
+using LEDs hw control ops and in other function to reject set if hw
+control is currently active.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -51,6 +51,7 @@ struct led_netdev_data {
+ 
+ 	unsigned long mode;
+ 	bool carrier_link_up;
++	bool hw_control;
+ };
+ 
+ enum led_trigger_netdev_modes {
+@@ -91,6 +92,11 @@ static void set_baseline_state(struct le
+ 	}
+ }
+ 
++static bool can_hw_control(struct led_netdev_data *trigger_data)
++{
++	return false;
++}
++
+ static ssize_t device_name_show(struct device *dev,
+ 				struct device_attribute *attr, char *buf)
+ {
+@@ -204,6 +210,8 @@ static ssize_t netdev_led_attr_store(str
+ 	else
+ 		clear_bit(bit, &trigger_data->mode);
+ 
++	trigger_data->hw_control = can_hw_control(trigger_data);
++
+ 	set_baseline_state(trigger_data);
+ 
+ 	return size;
diff --git a/target/linux/generic/backport-6.1/804-v6.5-06-leds-trigger-netdev-add-basic-check-for-hw-control-s.patch b/target/linux/generic/backport-6.1/804-v6.5-06-leds-trigger-netdev-add-basic-check-for-hw-control-s.patch
new file mode 100644
index 00000000000000..09759bc623e9c0
--- /dev/null
+++ b/target/linux/generic/backport-6.1/804-v6.5-06-leds-trigger-netdev-add-basic-check-for-hw-control-s.patch
@@ -0,0 +1,42 @@
+From 6352f25f9fadba59d5df2ba7139495759ccc81d5 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 29 May 2023 18:32:36 +0200
+Subject: [PATCH 06/13] leds: trigger: netdev: add basic check for hw control
+ support
+
+Add basic check for hw control support. Check if the required API are
+defined and check if the defined trigger supported in hw control for the
+LED driver match netdev.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -92,8 +92,22 @@ static void set_baseline_state(struct le
+ 	}
+ }
+ 
++static bool supports_hw_control(struct led_classdev *led_cdev)
++{
++	if (!led_cdev->hw_control_get || !led_cdev->hw_control_set ||
++	    !led_cdev->hw_control_is_supported)
++		return false;
++
++	return !strcmp(led_cdev->hw_control_trigger, led_cdev->trigger->name);
++}
++
+ static bool can_hw_control(struct led_netdev_data *trigger_data)
+ {
++	struct led_classdev *led_cdev = trigger_data->led_cdev;
++
++	if (!supports_hw_control(led_cdev))
++		return false;
++
+ 	return false;
+ }
+ 
diff --git a/target/linux/generic/backport-6.1/804-v6.5-07-leds-trigger-netdev-reject-interval-store-for-hw_con.patch b/target/linux/generic/backport-6.1/804-v6.5-07-leds-trigger-netdev-reject-interval-store-for-hw_con.patch
new file mode 100644
index 00000000000000..66349068003149
--- /dev/null
+++ b/target/linux/generic/backport-6.1/804-v6.5-07-leds-trigger-netdev-reject-interval-store-for-hw_con.patch
@@ -0,0 +1,28 @@
+From c84c80c7388f887b10dafd70fc55bc6c5fe9fa5a Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 29 May 2023 18:32:37 +0200
+Subject: [PATCH 07/13] leds: trigger: netdev: reject interval store for
+ hw_control
+
+Reject interval store with hw_control enabled. It's are currently not
+supported and MUST be set to the default value with hw control enabled.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -265,6 +265,9 @@ static ssize_t interval_store(struct dev
+ 	unsigned long value;
+ 	int ret;
+ 
++	if (trigger_data->hw_control)
++		return -EINVAL;
++
+ 	ret = kstrtoul(buf, 0, &value);
+ 	if (ret)
+ 		return ret;
diff --git a/target/linux/generic/backport-6.1/804-v6.5-08-leds-trigger-netdev-add-support-for-LED-hw-control.patch b/target/linux/generic/backport-6.1/804-v6.5-08-leds-trigger-netdev-add-support-for-LED-hw-control.patch
new file mode 100644
index 00000000000000..52faa4809b2ae0
--- /dev/null
+++ b/target/linux/generic/backport-6.1/804-v6.5-08-leds-trigger-netdev-add-support-for-LED-hw-control.patch
@@ -0,0 +1,107 @@
+From 7c145a34ba6e380616af93262fcab9fc7261d851 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 29 May 2023 18:32:38 +0200
+Subject: [PATCH 08/13] leds: trigger: netdev: add support for LED hw control
+
+Add support for LED hw control for the netdev trigger.
+
+The trigger on calling set_baseline_state to configure a new mode, will
+do various check to verify if hw control can be used for the requested
+mode in can_hw_control() function.
+
+It will first check if the LED driver supports hw control for the netdev
+trigger, then will use hw_control_is_supported() and finally will call
+hw_control_set() to apply the requested mode.
+
+To use such mode, interval MUST be set to the default value and net_dev
+MUST be set. If one of these 2 value are not valid, hw control will
+never be used and normal software fallback is used.
+
+The default interval value is moved to a define to make sure they are
+always synced.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 43 +++++++++++++++++++++++++--
+ 1 file changed, 41 insertions(+), 2 deletions(-)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -24,6 +24,8 @@
+ #include <linux/timer.h>
+ #include "../leds.h"
+ 
++#define NETDEV_LED_DEFAULT_INTERVAL	50
++
+ /*
+  * Configurable sysfs attributes:
+  *
+@@ -68,6 +70,13 @@ static void set_baseline_state(struct le
+ 	int current_brightness;
+ 	struct led_classdev *led_cdev = trigger_data->led_cdev;
+ 
++	/* Already validated, hw control is possible with the requested mode */
++	if (trigger_data->hw_control) {
++		led_cdev->hw_control_set(led_cdev, trigger_data->mode);
++
++		return;
++	}
++
+ 	current_brightness = led_cdev->brightness;
+ 	if (current_brightness)
+ 		led_cdev->blink_brightness = current_brightness;
+@@ -103,12 +112,42 @@ static bool supports_hw_control(struct l
+ 
+ static bool can_hw_control(struct led_netdev_data *trigger_data)
+ {
++	unsigned long default_interval = msecs_to_jiffies(NETDEV_LED_DEFAULT_INTERVAL);
++	unsigned int interval = atomic_read(&trigger_data->interval);
+ 	struct led_classdev *led_cdev = trigger_data->led_cdev;
++	int ret;
+ 
+ 	if (!supports_hw_control(led_cdev))
+ 		return false;
+ 
+-	return false;
++	/*
++	 * Interval must be set to the default
++	 * value. Any different value is rejected if in hw
++	 * control.
++	 */
++	if (interval != default_interval)
++		return false;
++
++	/*
++	 * net_dev must be set with hw control, otherwise no
++	 * blinking can be happening and there is nothing to
++	 * offloaded.
++	 */
++	if (!trigger_data->net_dev)
++		return false;
++
++	/* Check if the requested mode is supported */
++	ret = led_cdev->hw_control_is_supported(led_cdev, trigger_data->mode);
++	/* Fall back to software blinking if not supported */
++	if (ret == -EOPNOTSUPP)
++		return false;
++	if (ret) {
++		dev_warn(led_cdev->dev,
++			 "Current mode check failed with error %d\n", ret);
++		return false;
++	}
++
++	return true;
+ }
+ 
+ static ssize_t device_name_show(struct device *dev,
+@@ -413,7 +452,7 @@ static int netdev_trig_activate(struct l
+ 	trigger_data->device_name[0] = 0;
+ 
+ 	trigger_data->mode = 0;
+-	atomic_set(&trigger_data->interval, msecs_to_jiffies(50));
++	atomic_set(&trigger_data->interval, msecs_to_jiffies(NETDEV_LED_DEFAULT_INTERVAL));
+ 	trigger_data->last_activity = 0;
+ 
+ 	led_set_trigger_data(led_cdev, trigger_data);
diff --git a/target/linux/generic/backport-6.1/804-v6.5-09-leds-trigger-netdev-validate-configured-netdev.patch b/target/linux/generic/backport-6.1/804-v6.5-09-leds-trigger-netdev-validate-configured-netdev.patch
new file mode 100644
index 00000000000000..c129ffa4f5944c
--- /dev/null
+++ b/target/linux/generic/backport-6.1/804-v6.5-09-leds-trigger-netdev-validate-configured-netdev.patch
@@ -0,0 +1,58 @@
+From 33ec0b53befff2c0a7f3aa19ff08556d60585d6b Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Mon, 29 May 2023 18:32:39 +0200
+Subject: [PATCH 09/13] leds: trigger: netdev: validate configured netdev
+
+The netdev which the LED should blink for is configurable in
+/sys/class/led/foo/device_name. Ensure when offloading that the
+configured netdev is the same as the netdev the LED is associated
+with. If it is not, only perform software blinking.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 24 ++++++++++++++++++++++--
+ 1 file changed, 22 insertions(+), 2 deletions(-)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -110,6 +110,24 @@ static bool supports_hw_control(struct l
+ 	return !strcmp(led_cdev->hw_control_trigger, led_cdev->trigger->name);
+ }
+ 
++/*
++ * Validate the configured netdev is the same as the one associated with
++ * the LED driver in hw control.
++ */
++static bool validate_net_dev(struct led_classdev *led_cdev,
++			     struct net_device *net_dev)
++{
++	struct device *dev = led_cdev->hw_control_get_device(led_cdev);
++	struct net_device *ndev;
++
++	if (!dev)
++		return false;
++
++	ndev = to_net_dev(dev);
++
++	return ndev == net_dev;
++}
++
+ static bool can_hw_control(struct led_netdev_data *trigger_data)
+ {
+ 	unsigned long default_interval = msecs_to_jiffies(NETDEV_LED_DEFAULT_INTERVAL);
+@@ -131,9 +149,11 @@ static bool can_hw_control(struct led_ne
+ 	/*
+ 	 * net_dev must be set with hw control, otherwise no
+ 	 * blinking can be happening and there is nothing to
+-	 * offloaded.
++	 * offloaded. Additionally, for hw control to be
++	 * valid, the configured netdev must be the same as
++	 * netdev associated to the LED.
+ 	 */
+-	if (!trigger_data->net_dev)
++	if (!validate_net_dev(led_cdev, trigger_data->net_dev))
+ 		return false;
+ 
+ 	/* Check if the requested mode is supported */
diff --git a/target/linux/generic/backport-6.1/804-v6.5-10-leds-trigger-netdev-init-mode-if-hw-control-already-.patch b/target/linux/generic/backport-6.1/804-v6.5-10-leds-trigger-netdev-init-mode-if-hw-control-already-.patch
new file mode 100644
index 00000000000000..e20594c99a3eaa
--- /dev/null
+++ b/target/linux/generic/backport-6.1/804-v6.5-10-leds-trigger-netdev-init-mode-if-hw-control-already-.patch
@@ -0,0 +1,53 @@
+From 0316cc5629d15880dd3f097d221c55ca648bcd61 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 29 May 2023 18:32:40 +0200
+Subject: [PATCH 10/13] leds: trigger: netdev: init mode if hw control already
+ active
+
+On netdev trigger activation, hw control may be already active by
+default. If this is the case and a device is actually provided by
+hw_control_get_device(), init the already active mode and set the
+bool to hw_control bool to true to reflect the already set mode in the
+trigger_data.
+
+Co-developed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -454,6 +454,8 @@ static void netdev_trig_work(struct work
+ static int netdev_trig_activate(struct led_classdev *led_cdev)
+ {
+ 	struct led_netdev_data *trigger_data;
++	unsigned long mode;
++	struct device *dev;
+ 	int rc;
+ 
+ 	trigger_data = kzalloc(sizeof(struct led_netdev_data), GFP_KERNEL);
+@@ -475,6 +477,21 @@ static int netdev_trig_activate(struct l
+ 	atomic_set(&trigger_data->interval, msecs_to_jiffies(NETDEV_LED_DEFAULT_INTERVAL));
+ 	trigger_data->last_activity = 0;
+ 
++	/* Check if hw control is active by default on the LED.
++	 * Init already enabled mode in hw control.
++	 */
++	if (supports_hw_control(led_cdev) &&
++	    !led_cdev->hw_control_get(led_cdev, &mode)) {
++		dev = led_cdev->hw_control_get_device(led_cdev);
++		if (dev) {
++			const char *name = dev_name(dev);
++
++			set_device_name(trigger_data, name, strlen(name));
++			trigger_data->hw_control = true;
++			trigger_data->mode = mode;
++		}
++	}
++
+ 	led_set_trigger_data(led_cdev, trigger_data);
+ 
+ 	rc = register_netdevice_notifier(&trigger_data->notifier);
diff --git a/target/linux/generic/backport-6.1/804-v6.5-11-leds-trigger-netdev-expose-netdev-trigger-modes-in-l.patch b/target/linux/generic/backport-6.1/804-v6.5-11-leds-trigger-netdev-expose-netdev-trigger-modes-in-l.patch
new file mode 100644
index 00000000000000..70aed850d13b4c
--- /dev/null
+++ b/target/linux/generic/backport-6.1/804-v6.5-11-leds-trigger-netdev-expose-netdev-trigger-modes-in-l.patch
@@ -0,0 +1,54 @@
+From 947acacab5ea151291b861cdfbde16ff5cf1b08c Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 29 May 2023 18:32:41 +0200
+Subject: [PATCH 11/13] leds: trigger: netdev: expose netdev trigger modes in
+ linux include
+
+Expose netdev trigger modes to make them accessible by LED driver that
+will support netdev trigger for hw control.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/leds/trigger/ledtrig-netdev.c |  9 ---------
+ include/linux/leds.h                  | 10 ++++++++++
+ 2 files changed, 10 insertions(+), 9 deletions(-)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -56,15 +56,6 @@ struct led_netdev_data {
+ 	bool hw_control;
+ };
+ 
+-enum led_trigger_netdev_modes {
+-	TRIGGER_NETDEV_LINK = 0,
+-	TRIGGER_NETDEV_TX,
+-	TRIGGER_NETDEV_RX,
+-
+-	/* Keep last */
+-	__TRIGGER_NETDEV_MAX,
+-};
+-
+ static void set_baseline_state(struct led_netdev_data *trigger_data)
+ {
+ 	int current_brightness;
+--- a/include/linux/leds.h
++++ b/include/linux/leds.h
+@@ -527,6 +527,16 @@ static inline void *led_get_trigger_data
+ 
+ #endif /* CONFIG_LEDS_TRIGGERS */
+ 
++/* Trigger specific enum */
++enum led_trigger_netdev_modes {
++	TRIGGER_NETDEV_LINK = 0,
++	TRIGGER_NETDEV_TX,
++	TRIGGER_NETDEV_RX,
++
++	/* Keep last */
++	__TRIGGER_NETDEV_MAX,
++};
++
+ /* Trigger specific functions */
+ #ifdef CONFIG_LEDS_TRIGGER_DISK
+ void ledtrig_disk_activity(bool write);
diff --git a/target/linux/generic/backport-6.1/804-v6.5-12-net-dsa-qca8k-implement-hw_control-ops.patch b/target/linux/generic/backport-6.1/804-v6.5-12-net-dsa-qca8k-implement-hw_control-ops.patch
new file mode 100644
index 00000000000000..ad76d89b7bf842
--- /dev/null
+++ b/target/linux/generic/backport-6.1/804-v6.5-12-net-dsa-qca8k-implement-hw_control-ops.patch
@@ -0,0 +1,200 @@
+From e0256648c831af13cbfe4a1787327fcec01c2807 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 29 May 2023 18:32:42 +0200
+Subject: [PATCH 12/13] net: dsa: qca8k: implement hw_control ops
+
+Implement hw_control ops to drive Switch LEDs based on hardware events.
+
+Netdev trigger is the declared supported trigger for hw control
+operation and supports the following mode:
+- tx
+- rx
+
+When hw_control_set is called, LEDs are set to follow the requested
+mode.
+Each LEDs will blink at 4Hz by default.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca/qca8k-leds.c | 154 +++++++++++++++++++++++++++++++
+ 1 file changed, 154 insertions(+)
+
+--- a/drivers/net/dsa/qca/qca8k-leds.c
++++ b/drivers/net/dsa/qca/qca8k-leds.c
+@@ -32,6 +32,43 @@ qca8k_get_enable_led_reg(int port_num, i
+ }
+ 
+ static int
++qca8k_get_control_led_reg(int port_num, int led_num, struct qca8k_led_pattern_en *reg_info)
++{
++	reg_info->reg = QCA8K_LED_CTRL_REG(led_num);
++
++	/* 6 total control rule:
++	 * 3 control rules for phy0-3 that applies to all their leds
++	 * 3 control rules for phy4
++	 */
++	if (port_num == 4)
++		reg_info->shift = QCA8K_LED_PHY4_CONTROL_RULE_SHIFT;
++	else
++		reg_info->shift = QCA8K_LED_PHY0123_CONTROL_RULE_SHIFT;
++
++	return 0;
++}
++
++static int
++qca8k_parse_netdev(unsigned long rules, u32 *offload_trigger)
++{
++	/* Parsing specific to netdev trigger */
++	if (test_bit(TRIGGER_NETDEV_TX, &rules))
++		*offload_trigger |= QCA8K_LED_TX_BLINK_MASK;
++	if (test_bit(TRIGGER_NETDEV_RX, &rules))
++		*offload_trigger |= QCA8K_LED_RX_BLINK_MASK;
++
++	if (rules && !*offload_trigger)
++		return -EOPNOTSUPP;
++
++	/* Enable some default rule by default to the requested mode:
++	 * - Blink at 4Hz by default
++	 */
++	*offload_trigger |= QCA8K_LED_BLINK_4HZ;
++
++	return 0;
++}
++
++static int
+ qca8k_led_brightness_set(struct qca8k_led *led,
+ 			 enum led_brightness brightness)
+ {
+@@ -165,6 +202,119 @@ qca8k_cled_blink_set(struct led_classdev
+ }
+ 
+ static int
++qca8k_cled_trigger_offload(struct led_classdev *ldev, bool enable)
++{
++	struct qca8k_led *led = container_of(ldev, struct qca8k_led, cdev);
++
++	struct qca8k_led_pattern_en reg_info;
++	struct qca8k_priv *priv = led->priv;
++	u32 mask, val = QCA8K_LED_ALWAYS_OFF;
++
++	qca8k_get_enable_led_reg(led->port_num, led->led_num, &reg_info);
++
++	if (enable)
++		val = QCA8K_LED_RULE_CONTROLLED;
++
++	if (led->port_num == 0 || led->port_num == 4) {
++		mask = QCA8K_LED_PATTERN_EN_MASK;
++		val <<= QCA8K_LED_PATTERN_EN_SHIFT;
++	} else {
++		mask = QCA8K_LED_PHY123_PATTERN_EN_MASK;
++	}
++
++	return regmap_update_bits(priv->regmap, reg_info.reg, mask << reg_info.shift,
++				  val << reg_info.shift);
++}
++
++static bool
++qca8k_cled_hw_control_status(struct led_classdev *ldev)
++{
++	struct qca8k_led *led = container_of(ldev, struct qca8k_led, cdev);
++
++	struct qca8k_led_pattern_en reg_info;
++	struct qca8k_priv *priv = led->priv;
++	u32 val;
++
++	qca8k_get_enable_led_reg(led->port_num, led->led_num, &reg_info);
++
++	regmap_read(priv->regmap, reg_info.reg, &val);
++
++	val >>= reg_info.shift;
++
++	if (led->port_num == 0 || led->port_num == 4) {
++		val &= QCA8K_LED_PATTERN_EN_MASK;
++		val >>= QCA8K_LED_PATTERN_EN_SHIFT;
++	} else {
++		val &= QCA8K_LED_PHY123_PATTERN_EN_MASK;
++	}
++
++	return val == QCA8K_LED_RULE_CONTROLLED;
++}
++
++static int
++qca8k_cled_hw_control_is_supported(struct led_classdev *ldev, unsigned long rules)
++{
++	u32 offload_trigger = 0;
++
++	return qca8k_parse_netdev(rules, &offload_trigger);
++}
++
++static int
++qca8k_cled_hw_control_set(struct led_classdev *ldev, unsigned long rules)
++{
++	struct qca8k_led *led = container_of(ldev, struct qca8k_led, cdev);
++	struct qca8k_led_pattern_en reg_info;
++	struct qca8k_priv *priv = led->priv;
++	u32 offload_trigger = 0;
++	int ret;
++
++	ret = qca8k_parse_netdev(rules, &offload_trigger);
++	if (ret)
++		return ret;
++
++	ret = qca8k_cled_trigger_offload(ldev, true);
++	if (ret)
++		return ret;
++
++	qca8k_get_control_led_reg(led->port_num, led->led_num, &reg_info);
++
++	return regmap_update_bits(priv->regmap, reg_info.reg,
++				  QCA8K_LED_RULE_MASK << reg_info.shift,
++				  offload_trigger << reg_info.shift);
++}
++
++static int
++qca8k_cled_hw_control_get(struct led_classdev *ldev, unsigned long *rules)
++{
++	struct qca8k_led *led = container_of(ldev, struct qca8k_led, cdev);
++	struct qca8k_led_pattern_en reg_info;
++	struct qca8k_priv *priv = led->priv;
++	u32 val;
++	int ret;
++
++	/* With hw control not active return err */
++	if (!qca8k_cled_hw_control_status(ldev))
++		return -EINVAL;
++
++	qca8k_get_control_led_reg(led->port_num, led->led_num, &reg_info);
++
++	ret = regmap_read(priv->regmap, reg_info.reg, &val);
++	if (ret)
++		return ret;
++
++	val >>= reg_info.shift;
++	val &= QCA8K_LED_RULE_MASK;
++
++	/* Parsing specific to netdev trigger */
++	if (val & QCA8K_LED_TX_BLINK_MASK)
++		set_bit(TRIGGER_NETDEV_TX, rules);
++	if (val & QCA8K_LED_RX_BLINK_MASK)
++		set_bit(TRIGGER_NETDEV_RX, rules);
++
++	return 0;
++}
++
++static int
+ qca8k_parse_port_leds(struct qca8k_priv *priv, struct fwnode_handle *port, int port_num)
+ {
+ 	struct fwnode_handle *led = NULL, *leds = NULL;
+@@ -224,6 +374,10 @@ qca8k_parse_port_leds(struct qca8k_priv
+ 		port_led->cdev.max_brightness = 1;
+ 		port_led->cdev.brightness_set_blocking = qca8k_cled_brightness_set_blocking;
+ 		port_led->cdev.blink_set = qca8k_cled_blink_set;
++		port_led->cdev.hw_control_is_supported = qca8k_cled_hw_control_is_supported;
++		port_led->cdev.hw_control_set = qca8k_cled_hw_control_set;
++		port_led->cdev.hw_control_get = qca8k_cled_hw_control_get;
++		port_led->cdev.hw_control_trigger = "netdev";
+ 		init_data.default_label = ":port";
+ 		init_data.fwnode = led;
+ 		init_data.devname_mandatory = true;
diff --git a/target/linux/generic/backport-6.1/804-v6.5-13-net-dsa-qca8k-add-op-to-get-ports-netdev.patch b/target/linux/generic/backport-6.1/804-v6.5-13-net-dsa-qca8k-add-op-to-get-ports-netdev.patch
new file mode 100644
index 00000000000000..feb6b9e1e4e8e4
--- /dev/null
+++ b/target/linux/generic/backport-6.1/804-v6.5-13-net-dsa-qca8k-add-op-to-get-ports-netdev.patch
@@ -0,0 +1,70 @@
+From 4f53c27f772e27e4cf4e5507d6f4d5980002cb6a Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Mon, 29 May 2023 18:32:43 +0200
+Subject: [PATCH 13/13] net: dsa: qca8k: add op to get ports netdev
+
+In order that the LED trigger can blink the switch MAC ports LED, it
+needs to know the netdev associated to the port. Add the callback to
+return the struct device of the netdev.
+
+Add an helper function qca8k_phy_to_port() to convert the phy back to
+dsa_port index, as we reference LED port based on the internal PHY
+index and needs to be converted back.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca/qca8k-leds.c | 27 +++++++++++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+--- a/drivers/net/dsa/qca/qca8k-leds.c
++++ b/drivers/net/dsa/qca/qca8k-leds.c
+@@ -5,6 +5,18 @@
+ #include "qca8k.h"
+ #include "qca8k_leds.h"
+ 
++static u32 qca8k_phy_to_port(int phy)
++{
++	/* Internal PHY 0 has port at index 1.
++	 * Internal PHY 1 has port at index 2.
++	 * Internal PHY 2 has port at index 3.
++	 * Internal PHY 3 has port at index 4.
++	 * Internal PHY 4 has port at index 5.
++	 */
++
++	return phy + 1;
++}
++
+ static int
+ qca8k_get_enable_led_reg(int port_num, int led_num, struct qca8k_led_pattern_en *reg_info)
+ {
+@@ -314,6 +326,20 @@ qca8k_cled_hw_control_get(struct led_cla
+ 	return 0;
+ }
+ 
++static struct device *qca8k_cled_hw_control_get_device(struct led_classdev *ldev)
++{
++	struct qca8k_led *led = container_of(ldev, struct qca8k_led, cdev);
++	struct qca8k_priv *priv = led->priv;
++	struct dsa_port *dp;
++
++	dp = dsa_to_port(priv->ds, qca8k_phy_to_port(led->port_num));
++	if (!dp)
++		return NULL;
++	if (dp->slave)
++		return &dp->slave->dev;
++	return NULL;
++}
++
+ static int
+ qca8k_parse_port_leds(struct qca8k_priv *priv, struct fwnode_handle *port, int port_num)
+ {
+@@ -377,6 +403,7 @@ qca8k_parse_port_leds(struct qca8k_priv
+ 		port_led->cdev.hw_control_is_supported = qca8k_cled_hw_control_is_supported;
+ 		port_led->cdev.hw_control_set = qca8k_cled_hw_control_set;
+ 		port_led->cdev.hw_control_get = qca8k_cled_hw_control_get;
++		port_led->cdev.hw_control_get_device = qca8k_cled_hw_control_get_device;
+ 		port_led->cdev.hw_control_trigger = "netdev";
+ 		init_data.default_label = ":port";
+ 		init_data.fwnode = led;
diff --git a/target/linux/generic/backport-6.1/808-v6.2-0001-nvmem-stm32-move-STM32MP15_BSEC_NUM_LOWER-in-config.patch b/target/linux/generic/backport-6.1/808-v6.2-0001-nvmem-stm32-move-STM32MP15_BSEC_NUM_LOWER-in-config.patch
new file mode 100644
index 00000000000000..33759632ebe4f4
--- /dev/null
+++ b/target/linux/generic/backport-6.1/808-v6.2-0001-nvmem-stm32-move-STM32MP15_BSEC_NUM_LOWER-in-config.patch
@@ -0,0 +1,82 @@
+From fbfc4ca465a1f8d81bf2d67d95bf7fc67c3cf0c2 Mon Sep 17 00:00:00 2001
+From: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Date: Fri, 18 Nov 2022 06:39:20 +0000
+Subject: [PATCH] nvmem: stm32: move STM32MP15_BSEC_NUM_LOWER in config
+
+Support STM32MP15_BSEC_NUM_LOWER in stm32 romem config to prepare
+the next SoC in STM32MP family.
+
+Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20221118063932.6418-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/stm32-romem.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+--- a/drivers/nvmem/stm32-romem.c
++++ b/drivers/nvmem/stm32-romem.c
+@@ -22,16 +22,15 @@
+ /* shadow registers offest */
+ #define STM32MP15_BSEC_DATA0		0x200
+ 
+-/* 32 (x 32-bits) lower shadow registers */
+-#define STM32MP15_BSEC_NUM_LOWER	32
+-
+ struct stm32_romem_cfg {
+ 	int size;
++	u8 lower;
+ };
+ 
+ struct stm32_romem_priv {
+ 	void __iomem *base;
+ 	struct nvmem_config cfg;
++	u8 lower;
+ };
+ 
+ static int stm32_romem_read(void *context, unsigned int offset, void *buf,
+@@ -85,7 +84,7 @@ static int stm32_bsec_read(void *context
+ 	for (i = roffset; (i < roffset + rbytes); i += 4) {
+ 		u32 otp = i >> 2;
+ 
+-		if (otp < STM32MP15_BSEC_NUM_LOWER) {
++		if (otp < priv->lower) {
+ 			/* read lower data from shadow registers */
+ 			val = readl_relaxed(
+ 				priv->base + STM32MP15_BSEC_DATA0 + i);
+@@ -159,6 +158,8 @@ static int stm32_romem_probe(struct plat
+ 	priv->cfg.priv = priv;
+ 	priv->cfg.owner = THIS_MODULE;
+ 
++	priv->lower = 0;
++
+ 	cfg = (const struct stm32_romem_cfg *)
+ 		of_match_device(dev->driver->of_match_table, dev)->data;
+ 	if (!cfg) {
+@@ -167,6 +168,7 @@ static int stm32_romem_probe(struct plat
+ 		priv->cfg.reg_read = stm32_romem_read;
+ 	} else {
+ 		priv->cfg.size = cfg->size;
++		priv->lower = cfg->lower;
+ 		priv->cfg.reg_read = stm32_bsec_read;
+ 		priv->cfg.reg_write = stm32_bsec_write;
+ 	}
+@@ -174,8 +176,17 @@ static int stm32_romem_probe(struct plat
+ 	return PTR_ERR_OR_ZERO(devm_nvmem_register(dev, &priv->cfg));
+ }
+ 
++/*
++ * STM32MP15 BSEC OTP regions: 4096 OTP bits (with 3072 effective bits)
++ * => 96 x 32-bits data words
++ * - Lower: 1K bits, 2:1 redundancy, incremental bit programming
++ *   => 32 (x 32-bits) lower shadow registers = words 0 to 31
++ * - Upper: 2K bits, ECC protection, word programming only
++ *   => 64 (x 32-bits) = words 32 to 95
++ */
+ static const struct stm32_romem_cfg stm32mp15_bsec_cfg = {
+-	.size = 384, /* 96 x 32-bits data words */
++	.size = 384,
++	.lower = 32,
+ };
+ 
+ static const struct of_device_id stm32_romem_of_match[] = {
diff --git a/target/linux/generic/backport-6.1/808-v6.2-0002-nvmem-stm32-add-warning-when-upper-OTPs-are-updated.patch b/target/linux/generic/backport-6.1/808-v6.2-0002-nvmem-stm32-add-warning-when-upper-OTPs-are-updated.patch
new file mode 100644
index 00000000000000..5791df2606ffe3
--- /dev/null
+++ b/target/linux/generic/backport-6.1/808-v6.2-0002-nvmem-stm32-add-warning-when-upper-OTPs-are-updated.patch
@@ -0,0 +1,34 @@
+From d61784e6410f3df2028e6eb91b06ffed37a660e0 Mon Sep 17 00:00:00 2001
+From: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Date: Fri, 18 Nov 2022 06:39:21 +0000
+Subject: [PATCH] nvmem: stm32: add warning when upper OTPs are updated
+
+As the upper OTPs are ECC protected, they support only one 32 bits word
+programming.
+For a second modification of this word, these ECC become invalid and
+this OTP will be no more accessible, the shadowed value is invalid.
+
+This patch adds a warning to indicate an upper OTP update, because this
+operation is dangerous as OTP is not locked by the driver after the first
+update to avoid a second update.
+
+Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20221118063932.6418-3-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/stm32-romem.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/nvmem/stm32-romem.c
++++ b/drivers/nvmem/stm32-romem.c
+@@ -132,6 +132,9 @@ static int stm32_bsec_write(void *contex
+ 		}
+ 	}
+ 
++	if (offset + bytes >= priv->lower * 4)
++		dev_warn(dev, "Update of upper OTPs with ECC protection (word programming, only once)\n");
++
+ 	return 0;
+ }
+ 
diff --git a/target/linux/generic/backport-6.1/808-v6.2-0003-nvmem-stm32-add-nvmem-type-attribute.patch b/target/linux/generic/backport-6.1/808-v6.2-0003-nvmem-stm32-add-nvmem-type-attribute.patch
new file mode 100644
index 00000000000000..b83ad69c6b4ebb
--- /dev/null
+++ b/target/linux/generic/backport-6.1/808-v6.2-0003-nvmem-stm32-add-nvmem-type-attribute.patch
@@ -0,0 +1,26 @@
+From a3816a7d7c097c1da46aad5f5d1e229b607dce04 Mon Sep 17 00:00:00 2001
+From: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Date: Fri, 18 Nov 2022 06:39:22 +0000
+Subject: [PATCH] nvmem: stm32: add nvmem type attribute
+
+Inform NVMEM framework of type attribute for stm32-romem as NVMEM_TYPE_OTP
+so userspace is able to know how the data is stored in BSEC.
+
+Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20221118063932.6418-4-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/stm32-romem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/nvmem/stm32-romem.c
++++ b/drivers/nvmem/stm32-romem.c
+@@ -160,6 +160,7 @@ static int stm32_romem_probe(struct plat
+ 	priv->cfg.dev = dev;
+ 	priv->cfg.priv = priv;
+ 	priv->cfg.owner = THIS_MODULE;
++	priv->cfg.type = NVMEM_TYPE_OTP;
+ 
+ 	priv->lower = 0;
+ 
diff --git a/target/linux/generic/backport-6.1/808-v6.2-0004-nvmem-stm32-fix-spelling-typo-in-comment.patch b/target/linux/generic/backport-6.1/808-v6.2-0004-nvmem-stm32-fix-spelling-typo-in-comment.patch
new file mode 100644
index 00000000000000..52ba1e65b567fa
--- /dev/null
+++ b/target/linux/generic/backport-6.1/808-v6.2-0004-nvmem-stm32-fix-spelling-typo-in-comment.patch
@@ -0,0 +1,27 @@
+From 06aac0e11960a7ddccc1888326b5906d017e0f24 Mon Sep 17 00:00:00 2001
+From: Jiangshan Yi <yijiangshan@kylinos.cn>
+Date: Fri, 18 Nov 2022 06:39:24 +0000
+Subject: [PATCH] nvmem: stm32: fix spelling typo in comment
+
+Fix spelling typo in comment.
+
+Reported-by: k2ci <kernel-bot@kylinos.cn>
+Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20221118063932.6418-6-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/stm32-romem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/stm32-romem.c
++++ b/drivers/nvmem/stm32-romem.c
+@@ -19,7 +19,7 @@
+ #define STM32_SMC_WRITE_SHADOW		0x03
+ #define STM32_SMC_READ_OTP		0x04
+ 
+-/* shadow registers offest */
++/* shadow registers offset */
+ #define STM32MP15_BSEC_DATA0		0x200
+ 
+ struct stm32_romem_cfg {
diff --git a/target/linux/generic/backport-6.1/808-v6.2-0005-nvmem-Kconfig-Fix-spelling-mistake-controlls-control.patch b/target/linux/generic/backport-6.1/808-v6.2-0005-nvmem-Kconfig-Fix-spelling-mistake-controlls-control.patch
new file mode 100644
index 00000000000000..8f024f4c1acb8b
--- /dev/null
+++ b/target/linux/generic/backport-6.1/808-v6.2-0005-nvmem-Kconfig-Fix-spelling-mistake-controlls-control.patch
@@ -0,0 +1,27 @@
+From fb817c4ef63e8cfb6e77ae4a2875ae854c80708f Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.i.king@gmail.com>
+Date: Fri, 18 Nov 2022 06:39:26 +0000
+Subject: [PATCH] nvmem: Kconfig: Fix spelling mistake "controlls" ->
+ "controls"
+
+There is a spelling mistake in a Kconfig description. Fix it.
+
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20221118063932.6418-8-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -164,7 +164,7 @@ config NVMEM_MICROCHIP_OTPC
+ 	depends on ARCH_AT91 || COMPILE_TEST
+ 	help
+ 	  This driver enable the OTP controller available on Microchip SAMA7G5
+-	  SoCs. It controlls the access to the OTP memory connected to it.
++	  SoCs. It controls the access to the OTP memory connected to it.
+ 
+ config NVMEM_MTK_EFUSE
+ 	tristate "Mediatek SoCs EFUSE support"
diff --git a/target/linux/generic/backport-6.1/808-v6.2-0006-nvmem-u-boot-env-add-Broadcom-format-support.patch b/target/linux/generic/backport-6.1/808-v6.2-0006-nvmem-u-boot-env-add-Broadcom-format-support.patch
new file mode 100644
index 00000000000000..861386ad310b59
--- /dev/null
+++ b/target/linux/generic/backport-6.1/808-v6.2-0006-nvmem-u-boot-env-add-Broadcom-format-support.patch
@@ -0,0 +1,67 @@
+From ada84d07af6097b2addd18262668ce6cb9e15206 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 18 Nov 2022 06:39:27 +0000
+Subject: [PATCH] nvmem: u-boot-env: add Broadcom format support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Broadcom uses U-Boot for a lot of their bcmbca familiy chipsets. They
+decided to store U-Boot environment data inside U-Boot partition and to
+use a custom header (with "uEnv" magic and env data length).
+
+Add support for Broadcom's specific binding and their custom format.
+
+Ref: 6b0584c19d87 ("dt-bindings: nvmem: u-boot,env: add Broadcom's variant binding")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20221118063932.6418-9-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/u-boot-env.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/nvmem/u-boot-env.c
++++ b/drivers/nvmem/u-boot-env.c
+@@ -16,6 +16,7 @@
+ enum u_boot_env_format {
+ 	U_BOOT_FORMAT_SINGLE,
+ 	U_BOOT_FORMAT_REDUNDANT,
++	U_BOOT_FORMAT_BROADCOM,
+ };
+ 
+ struct u_boot_env {
+@@ -40,6 +41,13 @@ struct u_boot_env_image_redundant {
+ 	uint8_t data[];
+ } __packed;
+ 
++struct u_boot_env_image_broadcom {
++	__le32 magic;
++	__le32 len;
++	__le32 crc32;
++	uint8_t data[0];
++} __packed;
++
+ static int u_boot_env_read(void *context, unsigned int offset, void *val,
+ 			   size_t bytes)
+ {
+@@ -138,6 +146,11 @@ static int u_boot_env_parse(struct u_boo
+ 		crc32_data_offset = offsetof(struct u_boot_env_image_redundant, data);
+ 		data_offset = offsetof(struct u_boot_env_image_redundant, data);
+ 		break;
++	case U_BOOT_FORMAT_BROADCOM:
++		crc32_offset = offsetof(struct u_boot_env_image_broadcom, crc32);
++		crc32_data_offset = offsetof(struct u_boot_env_image_broadcom, data);
++		data_offset = offsetof(struct u_boot_env_image_broadcom, data);
++		break;
+ 	}
+ 	crc32 = le32_to_cpu(*(__le32 *)(buf + crc32_offset));
+ 	crc32_data_len = priv->mtd->size - crc32_data_offset;
+@@ -202,6 +215,7 @@ static const struct of_device_id u_boot_
+ 	{ .compatible = "u-boot,env", .data = (void *)U_BOOT_FORMAT_SINGLE, },
+ 	{ .compatible = "u-boot,env-redundant-bool", .data = (void *)U_BOOT_FORMAT_REDUNDANT, },
+ 	{ .compatible = "u-boot,env-redundant-count", .data = (void *)U_BOOT_FORMAT_REDUNDANT, },
++	{ .compatible = "brcm,env", .data = (void *)U_BOOT_FORMAT_BROADCOM, },
+ 	{},
+ };
+ 
diff --git a/target/linux/generic/backport-6.1/809-v6.3-0001-nvmem-core-remove-spurious-white-space.patch b/target/linux/generic/backport-6.1/809-v6.3-0001-nvmem-core-remove-spurious-white-space.patch
new file mode 100644
index 00000000000000..01400fd490d027
--- /dev/null
+++ b/target/linux/generic/backport-6.1/809-v6.3-0001-nvmem-core-remove-spurious-white-space.patch
@@ -0,0 +1,26 @@
+From 2e8dc541ae207349b51c65391be625ffe1f86e0c Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Mon, 6 Feb 2023 13:43:41 +0000
+Subject: [PATCH] nvmem: core: remove spurious white space
+
+Remove a spurious white space in for the ida_alloc() call.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-8-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -764,7 +764,7 @@ struct nvmem_device *nvmem_register(cons
+ 	if (!nvmem)
+ 		return ERR_PTR(-ENOMEM);
+ 
+-	rval  = ida_alloc(&nvmem_ida, GFP_KERNEL);
++	rval = ida_alloc(&nvmem_ida, GFP_KERNEL);
+ 	if (rval < 0) {
+ 		kfree(nvmem);
+ 		return ERR_PTR(rval);
diff --git a/target/linux/generic/backport-6.1/809-v6.3-0002-nvmem-core-add-an-index-parameter-to-the-cell.patch b/target/linux/generic/backport-6.1/809-v6.3-0002-nvmem-core-add-an-index-parameter-to-the-cell.patch
new file mode 100644
index 00000000000000..454d3bf0ed1a4b
--- /dev/null
+++ b/target/linux/generic/backport-6.1/809-v6.3-0002-nvmem-core-add-an-index-parameter-to-the-cell.patch
@@ -0,0 +1,180 @@
+From 5d8e6e6c10a3d37486d263b16ddc15991a7e4a88 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Mon, 6 Feb 2023 13:43:46 +0000
+Subject: [PATCH] nvmem: core: add an index parameter to the cell
+
+Sometimes a cell can represend multiple values. For example, a base
+ethernet address stored in the NVMEM can be expanded into multiple
+discreet ones by adding an offset.
+
+For this use case, introduce an index parameter which is then used to
+distiguish between values. This parameter will then be passed to the
+post process hook which can then use it to create different values
+during reading.
+
+At the moment, there is only support for the device tree path. You can
+add the index to the phandle, e.g.
+
+  &net {
+          nvmem-cells = <&base_mac_address 2>;
+          nvmem-cell-names = "mac-address";
+  };
+
+  &nvmem_provider {
+          base_mac_address: base-mac-address@0 {
+                  #nvmem-cell-cells = <1>;
+                  reg = <0 6>;
+          };
+  };
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-13-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c           | 37 ++++++++++++++++++++++++----------
+ drivers/nvmem/imx-ocotp.c      |  4 ++--
+ include/linux/nvmem-provider.h |  4 ++--
+ 3 files changed, 30 insertions(+), 15 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -60,6 +60,7 @@ struct nvmem_cell_entry {
+ struct nvmem_cell {
+ 	struct nvmem_cell_entry *entry;
+ 	const char		*id;
++	int			index;
+ };
+ 
+ static DEFINE_MUTEX(nvmem_mutex);
+@@ -1122,7 +1123,8 @@ struct nvmem_device *devm_nvmem_device_g
+ }
+ EXPORT_SYMBOL_GPL(devm_nvmem_device_get);
+ 
+-static struct nvmem_cell *nvmem_create_cell(struct nvmem_cell_entry *entry, const char *id)
++static struct nvmem_cell *nvmem_create_cell(struct nvmem_cell_entry *entry,
++					    const char *id, int index)
+ {
+ 	struct nvmem_cell *cell;
+ 	const char *name = NULL;
+@@ -1141,6 +1143,7 @@ static struct nvmem_cell *nvmem_create_c
+ 
+ 	cell->id = name;
+ 	cell->entry = entry;
++	cell->index = index;
+ 
+ 	return cell;
+ }
+@@ -1179,7 +1182,7 @@ nvmem_cell_get_from_lookup(struct device
+ 				__nvmem_device_put(nvmem);
+ 				cell = ERR_PTR(-ENOENT);
+ 			} else {
+-				cell = nvmem_create_cell(cell_entry, con_id);
++				cell = nvmem_create_cell(cell_entry, con_id, 0);
+ 				if (IS_ERR(cell))
+ 					__nvmem_device_put(nvmem);
+ 			}
+@@ -1227,15 +1230,27 @@ struct nvmem_cell *of_nvmem_cell_get(str
+ 	struct nvmem_device *nvmem;
+ 	struct nvmem_cell_entry *cell_entry;
+ 	struct nvmem_cell *cell;
++	struct of_phandle_args cell_spec;
+ 	int index = 0;
++	int cell_index = 0;
++	int ret;
+ 
+ 	/* if cell name exists, find index to the name */
+ 	if (id)
+ 		index = of_property_match_string(np, "nvmem-cell-names", id);
+ 
+-	cell_np = of_parse_phandle(np, "nvmem-cells", index);
+-	if (!cell_np)
+-		return ERR_PTR(-ENOENT);
++	ret = of_parse_phandle_with_optional_args(np, "nvmem-cells",
++						  "#nvmem-cell-cells",
++						  index, &cell_spec);
++	if (ret)
++		return ERR_PTR(ret);
++
++	if (cell_spec.args_count > 1)
++		return ERR_PTR(-EINVAL);
++
++	cell_np = cell_spec.np;
++	if (cell_spec.args_count)
++		cell_index = cell_spec.args[0];
+ 
+ 	nvmem_np = of_get_parent(cell_np);
+ 	if (!nvmem_np) {
+@@ -1257,7 +1272,7 @@ struct nvmem_cell *of_nvmem_cell_get(str
+ 		return ERR_PTR(-ENOENT);
+ 	}
+ 
+-	cell = nvmem_create_cell(cell_entry, id);
++	cell = nvmem_create_cell(cell_entry, id, cell_index);
+ 	if (IS_ERR(cell))
+ 		__nvmem_device_put(nvmem);
+ 
+@@ -1410,8 +1425,8 @@ static void nvmem_shift_read_buffer_in_p
+ }
+ 
+ static int __nvmem_cell_read(struct nvmem_device *nvmem,
+-		      struct nvmem_cell_entry *cell,
+-		      void *buf, size_t *len, const char *id)
++			     struct nvmem_cell_entry *cell,
++			     void *buf, size_t *len, const char *id, int index)
+ {
+ 	int rc;
+ 
+@@ -1425,7 +1440,7 @@ static int __nvmem_cell_read(struct nvme
+ 		nvmem_shift_read_buffer_in_place(cell, buf);
+ 
+ 	if (nvmem->cell_post_process) {
+-		rc = nvmem->cell_post_process(nvmem->priv, id,
++		rc = nvmem->cell_post_process(nvmem->priv, id, index,
+ 					      cell->offset, buf, cell->bytes);
+ 		if (rc)
+ 			return rc;
+@@ -1460,7 +1475,7 @@ void *nvmem_cell_read(struct nvmem_cell
+ 	if (!buf)
+ 		return ERR_PTR(-ENOMEM);
+ 
+-	rc = __nvmem_cell_read(nvmem, cell->entry, buf, len, cell->id);
++	rc = __nvmem_cell_read(nvmem, cell->entry, buf, len, cell->id, cell->index);
+ 	if (rc) {
+ 		kfree(buf);
+ 		return ERR_PTR(rc);
+@@ -1773,7 +1788,7 @@ ssize_t nvmem_device_cell_read(struct nv
+ 	if (rc)
+ 		return rc;
+ 
+-	rc = __nvmem_cell_read(nvmem, &cell, buf, &len, NULL);
++	rc = __nvmem_cell_read(nvmem, &cell, buf, &len, NULL, 0);
+ 	if (rc)
+ 		return rc;
+ 
+--- a/drivers/nvmem/imx-ocotp.c
++++ b/drivers/nvmem/imx-ocotp.c
+@@ -222,8 +222,8 @@ read_end:
+ 	return ret;
+ }
+ 
+-static int imx_ocotp_cell_pp(void *context, const char *id, unsigned int offset,
+-			     void *data, size_t bytes)
++static int imx_ocotp_cell_pp(void *context, const char *id, int index,
++			     unsigned int offset, void *data, size_t bytes)
+ {
+ 	struct ocotp_priv *priv = context;
+ 
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -20,8 +20,8 @@ typedef int (*nvmem_reg_read_t)(void *pr
+ typedef int (*nvmem_reg_write_t)(void *priv, unsigned int offset,
+ 				 void *val, size_t bytes);
+ /* used for vendor specific post processing of cell data */
+-typedef int (*nvmem_cell_post_process_t)(void *priv, const char *id, unsigned int offset,
+-					  void *buf, size_t bytes);
++typedef int (*nvmem_cell_post_process_t)(void *priv, const char *id, int index,
++					 unsigned int offset, void *buf, size_t bytes);
+ 
+ enum nvmem_type {
+ 	NVMEM_TYPE_UNKNOWN = 0,
diff --git a/target/linux/generic/backport-6.1/809-v6.3-0003-nvmem-core-move-struct-nvmem_cell_info-to-nvmem-prov.patch b/target/linux/generic/backport-6.1/809-v6.3-0003-nvmem-core-move-struct-nvmem_cell_info-to-nvmem-prov.patch
new file mode 100644
index 00000000000000..f3829b3e17f4f6
--- /dev/null
+++ b/target/linux/generic/backport-6.1/809-v6.3-0003-nvmem-core-move-struct-nvmem_cell_info-to-nvmem-prov.patch
@@ -0,0 +1,78 @@
+From fbd03d27776c6121a483921601418e3c8f0ff37e Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Mon, 6 Feb 2023 13:43:47 +0000
+Subject: [PATCH] nvmem: core: move struct nvmem_cell_info to nvmem-provider.h
+
+struct nvmem_cell_info is used to describe a cell. Thus this should
+really be in the nvmem-provider's header. There are two (unused) nvmem
+access methods which use the nvmem_cell_info to describe the cell to be
+accesses. One can argue, that they will create a cell before accessing,
+thus they are both a provider and a consumer.
+
+struct nvmem_cell_info will get used more and more by nvmem-providers,
+don't force them to also include the consumer header, although they are
+not.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-14-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/nvmem-consumer.h | 10 +---------
+ include/linux/nvmem-provider.h | 19 ++++++++++++++++++-
+ 2 files changed, 19 insertions(+), 10 deletions(-)
+
+--- a/include/linux/nvmem-consumer.h
++++ b/include/linux/nvmem-consumer.h
+@@ -18,15 +18,7 @@ struct device_node;
+ /* consumer cookie */
+ struct nvmem_cell;
+ struct nvmem_device;
+-
+-struct nvmem_cell_info {
+-	const char		*name;
+-	unsigned int		offset;
+-	unsigned int		bytes;
+-	unsigned int		bit_offset;
+-	unsigned int		nbits;
+-	struct device_node	*np;
+-};
++struct nvmem_cell_info;
+ 
+ /**
+  * struct nvmem_cell_lookup - cell lookup entry
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -14,7 +14,6 @@
+ #include <linux/gpio/consumer.h>
+ 
+ struct nvmem_device;
+-struct nvmem_cell_info;
+ typedef int (*nvmem_reg_read_t)(void *priv, unsigned int offset,
+ 				void *val, size_t bytes);
+ typedef int (*nvmem_reg_write_t)(void *priv, unsigned int offset,
+@@ -48,6 +47,24 @@ struct nvmem_keepout {
+ };
+ 
+ /**
++ * struct nvmem_cell_info - NVMEM cell description
++ * @name:	Name.
++ * @offset:	Offset within the NVMEM device.
++ * @bytes:	Length of the cell.
++ * @bit_offset:	Bit offset if cell is smaller than a byte.
++ * @nbits:	Number of bits.
++ * @np:		Optional device_node pointer.
++ */
++struct nvmem_cell_info {
++	const char		*name;
++	unsigned int		offset;
++	unsigned int		bytes;
++	unsigned int		bit_offset;
++	unsigned int		nbits;
++	struct device_node	*np;
++};
++
++/**
+  * struct nvmem_config - NVMEM device configuration
+  *
+  * @dev:	Parent device.
diff --git a/target/linux/generic/backport-6.1/809-v6.3-0004-nvmem-core-drop-the-removal-of-the-cells-in-nvmem_ad.patch b/target/linux/generic/backport-6.1/809-v6.3-0004-nvmem-core-drop-the-removal-of-the-cells-in-nvmem_ad.patch
new file mode 100644
index 00000000000000..8f996eab348ff4
--- /dev/null
+++ b/target/linux/generic/backport-6.1/809-v6.3-0004-nvmem-core-drop-the-removal-of-the-cells-in-nvmem_ad.patch
@@ -0,0 +1,65 @@
+From cc5bdd323dde6494623f3ffe3a5b887fa21cd375 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Mon, 6 Feb 2023 13:43:48 +0000
+Subject: [PATCH] nvmem: core: drop the removal of the cells in
+ nvmem_add_cells()
+
+If nvmem_add_cells() fails, the whole nvmem_register() will fail
+and the cells will then be removed anyway. This is a preparation
+to introduce a nvmem_add_one_cell() which can then be used by
+nvmem_add_cells().
+
+This is then the same to what nvmem_add_cells_from_table() and
+nvmem_add_cells_from_of() do.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-15-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -515,7 +515,7 @@ static int nvmem_add_cells(struct nvmem_
+ 		    int ncells)
+ {
+ 	struct nvmem_cell_entry **cells;
+-	int i, rval;
++	int i, rval = 0;
+ 
+ 	cells = kcalloc(ncells, sizeof(*cells), GFP_KERNEL);
+ 	if (!cells)
+@@ -525,28 +525,22 @@ static int nvmem_add_cells(struct nvmem_
+ 		cells[i] = kzalloc(sizeof(**cells), GFP_KERNEL);
+ 		if (!cells[i]) {
+ 			rval = -ENOMEM;
+-			goto err;
++			goto out;
+ 		}
+ 
+ 		rval = nvmem_cell_info_to_nvmem_cell_entry(nvmem, &info[i], cells[i]);
+ 		if (rval) {
+ 			kfree(cells[i]);
+-			goto err;
++			goto out;
+ 		}
+ 
+ 		nvmem_cell_entry_add(cells[i]);
+ 	}
+ 
++out:
+ 	/* remove tmp array */
+ 	kfree(cells);
+ 
+-	return 0;
+-err:
+-	while (i--)
+-		nvmem_cell_entry_drop(cells[i]);
+-
+-	kfree(cells);
+-
+ 	return rval;
+ }
+ 
diff --git a/target/linux/generic/backport-6.1/809-v6.3-0005-nvmem-core-add-nvmem_add_one_cell.patch b/target/linux/generic/backport-6.1/809-v6.3-0005-nvmem-core-add-nvmem_add_one_cell.patch
new file mode 100644
index 00000000000000..711ce229b2c748
--- /dev/null
+++ b/target/linux/generic/backport-6.1/809-v6.3-0005-nvmem-core-add-nvmem_add_one_cell.patch
@@ -0,0 +1,122 @@
+From 2ded6830d376d5e7bf43d59f7f7fdf1a59abc676 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Mon, 6 Feb 2023 13:43:49 +0000
+Subject: [PATCH] nvmem: core: add nvmem_add_one_cell()
+
+Add a new function to add exactly one cell. This will be used by the
+nvmem layout drivers to add custom cells. In contrast to the
+nvmem_add_cells(), this has the advantage that we don't have to assemble
+a list of cells on runtime.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-16-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c           | 59 ++++++++++++++++++++--------------
+ include/linux/nvmem-provider.h |  8 +++++
+ 2 files changed, 43 insertions(+), 24 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -502,6 +502,36 @@ static int nvmem_cell_info_to_nvmem_cell
+ }
+ 
+ /**
++ * nvmem_add_one_cell() - Add one cell information to an nvmem device
++ *
++ * @nvmem: nvmem device to add cells to.
++ * @info: nvmem cell info to add to the device
++ *
++ * Return: 0 or negative error code on failure.
++ */
++int nvmem_add_one_cell(struct nvmem_device *nvmem,
++		       const struct nvmem_cell_info *info)
++{
++	struct nvmem_cell_entry *cell;
++	int rval;
++
++	cell = kzalloc(sizeof(*cell), GFP_KERNEL);
++	if (!cell)
++		return -ENOMEM;
++
++	rval = nvmem_cell_info_to_nvmem_cell_entry(nvmem, info, cell);
++	if (rval) {
++		kfree(cell);
++		return rval;
++	}
++
++	nvmem_cell_entry_add(cell);
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(nvmem_add_one_cell);
++
++/**
+  * nvmem_add_cells() - Add cell information to an nvmem device
+  *
+  * @nvmem: nvmem device to add cells to.
+@@ -514,34 +544,15 @@ static int nvmem_add_cells(struct nvmem_
+ 		    const struct nvmem_cell_info *info,
+ 		    int ncells)
+ {
+-	struct nvmem_cell_entry **cells;
+-	int i, rval = 0;
+-
+-	cells = kcalloc(ncells, sizeof(*cells), GFP_KERNEL);
+-	if (!cells)
+-		return -ENOMEM;
++	int i, rval;
+ 
+ 	for (i = 0; i < ncells; i++) {
+-		cells[i] = kzalloc(sizeof(**cells), GFP_KERNEL);
+-		if (!cells[i]) {
+-			rval = -ENOMEM;
+-			goto out;
+-		}
+-
+-		rval = nvmem_cell_info_to_nvmem_cell_entry(nvmem, &info[i], cells[i]);
+-		if (rval) {
+-			kfree(cells[i]);
+-			goto out;
+-		}
+-
+-		nvmem_cell_entry_add(cells[i]);
++		rval = nvmem_add_one_cell(nvmem, &info[i]);
++		if (rval)
++			return rval;
+ 	}
+ 
+-out:
+-	/* remove tmp array */
+-	kfree(cells);
+-
+-	return rval;
++	return 0;
+ }
+ 
+ /**
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -153,6 +153,9 @@ struct nvmem_device *devm_nvmem_register
+ void nvmem_add_cell_table(struct nvmem_cell_table *table);
+ void nvmem_del_cell_table(struct nvmem_cell_table *table);
+ 
++int nvmem_add_one_cell(struct nvmem_device *nvmem,
++		       const struct nvmem_cell_info *info);
++
+ #else
+ 
+ static inline struct nvmem_device *nvmem_register(const struct nvmem_config *c)
+@@ -170,6 +173,11 @@ devm_nvmem_register(struct device *dev,
+ 
+ static inline void nvmem_add_cell_table(struct nvmem_cell_table *table) {}
+ static inline void nvmem_del_cell_table(struct nvmem_cell_table *table) {}
++static inline int nvmem_add_one_cell(struct nvmem_device *nvmem,
++				     const struct nvmem_cell_info *info)
++{
++	return -EOPNOTSUPP;
++}
+ 
+ #endif /* CONFIG_NVMEM */
+ #endif  /* ifndef _LINUX_NVMEM_PROVIDER_H */
diff --git a/target/linux/generic/backport-6.1/809-v6.3-0006-nvmem-core-use-nvmem_add_one_cell-in-nvmem_add_cells.patch b/target/linux/generic/backport-6.1/809-v6.3-0006-nvmem-core-use-nvmem_add_one_cell-in-nvmem_add_cells.patch
new file mode 100644
index 00000000000000..e1791e5c83cff0
--- /dev/null
+++ b/target/linux/generic/backport-6.1/809-v6.3-0006-nvmem-core-use-nvmem_add_one_cell-in-nvmem_add_cells.patch
@@ -0,0 +1,93 @@
+From 50014d659617dc58780a5d31ceb76c82779a9d8b Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Mon, 6 Feb 2023 13:43:50 +0000
+Subject: [PATCH] nvmem: core: use nvmem_add_one_cell() in
+ nvmem_add_cells_from_of()
+
+Convert nvmem_add_cells_from_of() to use the new nvmem_add_one_cell().
+This will remove duplicate code and it will make it possible to add a
+hook to a nvmem layout in between, which can change fields before the
+cell is finally added.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-17-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c | 45 ++++++++++++++------------------------------
+ 1 file changed, 14 insertions(+), 31 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -688,15 +688,14 @@ static int nvmem_validate_keepouts(struc
+ 
+ static int nvmem_add_cells_from_of(struct nvmem_device *nvmem)
+ {
+-	struct device_node *parent, *child;
+ 	struct device *dev = &nvmem->dev;
+-	struct nvmem_cell_entry *cell;
++	struct device_node *child;
+ 	const __be32 *addr;
+-	int len;
++	int len, ret;
+ 
+-	parent = dev->of_node;
++	for_each_child_of_node(dev->of_node, child) {
++		struct nvmem_cell_info info = {0};
+ 
+-	for_each_child_of_node(parent, child) {
+ 		addr = of_get_property(child, "reg", &len);
+ 		if (!addr)
+ 			continue;
+@@ -706,40 +705,24 @@ static int nvmem_add_cells_from_of(struc
+ 			return -EINVAL;
+ 		}
+ 
+-		cell = kzalloc(sizeof(*cell), GFP_KERNEL);
+-		if (!cell) {
+-			of_node_put(child);
+-			return -ENOMEM;
+-		}
+-
+-		cell->nvmem = nvmem;
+-		cell->offset = be32_to_cpup(addr++);
+-		cell->bytes = be32_to_cpup(addr);
+-		cell->name = kasprintf(GFP_KERNEL, "%pOFn", child);
++		info.offset = be32_to_cpup(addr++);
++		info.bytes = be32_to_cpup(addr);
++		info.name = kasprintf(GFP_KERNEL, "%pOFn", child);
+ 
+ 		addr = of_get_property(child, "bits", &len);
+ 		if (addr && len == (2 * sizeof(u32))) {
+-			cell->bit_offset = be32_to_cpup(addr++);
+-			cell->nbits = be32_to_cpup(addr);
++			info.bit_offset = be32_to_cpup(addr++);
++			info.nbits = be32_to_cpup(addr);
+ 		}
+ 
+-		if (cell->nbits)
+-			cell->bytes = DIV_ROUND_UP(
+-					cell->nbits + cell->bit_offset,
+-					BITS_PER_BYTE);
+-
+-		if (!IS_ALIGNED(cell->offset, nvmem->stride)) {
+-			dev_err(dev, "cell %s unaligned to nvmem stride %d\n",
+-				cell->name, nvmem->stride);
+-			/* Cells already added will be freed later. */
+-			kfree_const(cell->name);
+-			kfree(cell);
++		info.np = of_node_get(child);
++
++		ret = nvmem_add_one_cell(nvmem, &info);
++		kfree(info.name);
++		if (ret) {
+ 			of_node_put(child);
+-			return -EINVAL;
++			return ret;
+ 		}
+-
+-		cell->np = of_node_get(child);
+-		nvmem_cell_entry_add(cell);
+ 	}
+ 
+ 	return 0;
diff --git a/target/linux/generic/backport-6.1/809-v6.3-0007-nvmem-stm32-add-OP-TEE-support-for-STM32MP13x.patch b/target/linux/generic/backport-6.1/809-v6.3-0007-nvmem-stm32-add-OP-TEE-support-for-STM32MP13x.patch
new file mode 100644
index 00000000000000..172a78b76af1a6
--- /dev/null
+++ b/target/linux/generic/backport-6.1/809-v6.3-0007-nvmem-stm32-add-OP-TEE-support-for-STM32MP13x.patch
@@ -0,0 +1,562 @@
+From 6a0bc3522e746025e2d9a63ab2cb5d7062c2d39c Mon Sep 17 00:00:00 2001
+From: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Date: Mon, 6 Feb 2023 13:43:51 +0000
+Subject: [PATCH] nvmem: stm32: add OP-TEE support for STM32MP13x
+
+For boot with OP-TEE on STM32MP13, the communication with the secure
+world no more use STMicroelectronics SMC but communication with the
+STM32MP BSEC TA, for data access (read/write) or lock operation:
+- all the request are sent to OP-TEE trusted application,
+- for upper OTP with ECC protection and with word programming only
+  each OTP are permanently locked when programmed to avoid ECC error
+  on the second write operation
+
+Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-18-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/Kconfig               |  11 +
+ drivers/nvmem/Makefile              |   1 +
+ drivers/nvmem/stm32-bsec-optee-ta.c | 298 ++++++++++++++++++++++++++++
+ drivers/nvmem/stm32-bsec-optee-ta.h |  80 ++++++++
+ drivers/nvmem/stm32-romem.c         |  54 ++++-
+ 5 files changed, 441 insertions(+), 3 deletions(-)
+ create mode 100644 drivers/nvmem/stm32-bsec-optee-ta.c
+ create mode 100644 drivers/nvmem/stm32-bsec-optee-ta.h
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -290,9 +290,20 @@ config NVMEM_SPRD_EFUSE
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called nvmem-sprd-efuse.
+ 
++config NVMEM_STM32_BSEC_OPTEE_TA
++	bool "STM32MP BSEC OP-TEE TA support for nvmem-stm32-romem driver"
++	depends on OPTEE
++	help
++	  Say y here to enable the accesses to STM32MP SoC OTPs by the OP-TEE
++	  trusted application STM32MP BSEC.
++
++	  This library is a used by stm32-romem driver or included in the module
++	  called nvmem-stm32-romem.
++
+ config NVMEM_STM32_ROMEM
+ 	tristate "STMicroelectronics STM32 factory-programmed memory support"
+ 	depends on ARCH_STM32 || COMPILE_TEST
++	imply NVMEM_STM32_BSEC_OPTEE_TA
+ 	help
+ 	  Say y here to enable read-only access for STMicroelectronics STM32
+ 	  factory-programmed memory area.
+--- a/drivers/nvmem/Makefile
++++ b/drivers/nvmem/Makefile
+@@ -61,6 +61,7 @@ obj-$(CONFIG_NVMEM_SPRD_EFUSE)		+= nvmem
+ nvmem_sprd_efuse-y			:= sprd-efuse.o
+ obj-$(CONFIG_NVMEM_STM32_ROMEM)		+= nvmem_stm32_romem.o
+ nvmem_stm32_romem-y 			:= stm32-romem.o
++nvmem_stm32_romem-$(CONFIG_NVMEM_STM32_BSEC_OPTEE_TA) += stm32-bsec-optee-ta.o
+ obj-$(CONFIG_NVMEM_SUNPLUS_OCOTP)	+= nvmem_sunplus_ocotp.o
+ nvmem_sunplus_ocotp-y			:= sunplus-ocotp.o
+ obj-$(CONFIG_NVMEM_SUNXI_SID)		+= nvmem_sunxi_sid.o
+--- /dev/null
++++ b/drivers/nvmem/stm32-bsec-optee-ta.c
+@@ -0,0 +1,298 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * OP-TEE STM32MP BSEC PTA interface, used by STM32 ROMEM driver
++ *
++ * Copyright (C) 2022, STMicroelectronics - All Rights Reserved
++ */
++
++#include <linux/tee_drv.h>
++
++#include "stm32-bsec-optee-ta.h"
++
++/*
++ * Read OTP memory
++ *
++ * [in]		value[0].a		OTP start offset in byte
++ * [in]		value[0].b		Access type (0:shadow, 1:fuse, 2:lock)
++ * [out]	memref[1].buffer	Output buffer to store read values
++ * [out]	memref[1].size		Size of OTP to be read
++ *
++ * Return codes:
++ * TEE_SUCCESS - Invoke command success
++ * TEE_ERROR_BAD_PARAMETERS - Incorrect input param
++ * TEE_ERROR_ACCESS_DENIED - OTP not accessible by caller
++ */
++#define PTA_BSEC_READ_MEM		0x0
++
++/*
++ * Write OTP memory
++ *
++ * [in]		value[0].a		OTP start offset in byte
++ * [in]		value[0].b		Access type (0:shadow, 1:fuse, 2:lock)
++ * [in]		memref[1].buffer	Input buffer to read values
++ * [in]		memref[1].size		Size of OTP to be written
++ *
++ * Return codes:
++ * TEE_SUCCESS - Invoke command success
++ * TEE_ERROR_BAD_PARAMETERS - Incorrect input param
++ * TEE_ERROR_ACCESS_DENIED - OTP not accessible by caller
++ */
++#define PTA_BSEC_WRITE_MEM		0x1
++
++/* value of PTA_BSEC access type = value[in] b */
++#define SHADOW_ACCESS	0
++#define FUSE_ACCESS	1
++#define LOCK_ACCESS	2
++
++/* Bitfield definition for LOCK status */
++#define LOCK_PERM			BIT(30)
++
++/* OP-TEE STM32MP BSEC TA UUID */
++static const uuid_t stm32mp_bsec_ta_uuid =
++	UUID_INIT(0x94cf71ad, 0x80e6, 0x40b5,
++		  0xa7, 0xc6, 0x3d, 0xc5, 0x01, 0xeb, 0x28, 0x03);
++
++/*
++ * Check whether this driver supports the BSEC TA in the TEE instance
++ * represented by the params (ver/data) to this function.
++ */
++static int stm32_bsec_optee_ta_match(struct tee_ioctl_version_data *ver,
++				     const void *data)
++{
++	/* Currently this driver only supports GP compliant, OP-TEE based TA */
++	if ((ver->impl_id == TEE_IMPL_ID_OPTEE) &&
++		(ver->gen_caps & TEE_GEN_CAP_GP))
++		return 1;
++	else
++		return 0;
++}
++
++/* Open a session to OP-TEE for STM32MP BSEC TA */
++static int stm32_bsec_ta_open_session(struct tee_context *ctx, u32 *id)
++{
++	struct tee_ioctl_open_session_arg sess_arg;
++	int rc;
++
++	memset(&sess_arg, 0, sizeof(sess_arg));
++	export_uuid(sess_arg.uuid, &stm32mp_bsec_ta_uuid);
++	sess_arg.clnt_login = TEE_IOCTL_LOGIN_REE_KERNEL;
++	sess_arg.num_params = 0;
++
++	rc = tee_client_open_session(ctx, &sess_arg, NULL);
++	if ((rc < 0) || (sess_arg.ret != 0)) {
++		pr_err("%s: tee_client_open_session failed err:%#x, ret:%#x\n",
++		       __func__, sess_arg.ret, rc);
++		if (!rc)
++			rc = -EINVAL;
++	} else {
++		*id = sess_arg.session;
++	}
++
++	return rc;
++}
++
++/* close a session to OP-TEE for STM32MP BSEC TA */
++static void stm32_bsec_ta_close_session(void *ctx, u32 id)
++{
++	tee_client_close_session(ctx, id);
++}
++
++/* stm32_bsec_optee_ta_open() - initialize the STM32MP BSEC TA */
++int stm32_bsec_optee_ta_open(struct tee_context **ctx)
++{
++	struct tee_context *tee_ctx;
++	u32 session_id;
++	int rc;
++
++	/* Open context with TEE driver */
++	tee_ctx = tee_client_open_context(NULL, stm32_bsec_optee_ta_match, NULL, NULL);
++	if (IS_ERR(tee_ctx)) {
++		rc = PTR_ERR(tee_ctx);
++		if (rc == -ENOENT)
++			return -EPROBE_DEFER;
++		pr_err("%s: tee_client_open_context failed (%d)\n", __func__, rc);
++
++		return rc;
++	}
++
++	/* Check STM32MP BSEC TA presence */
++	rc = stm32_bsec_ta_open_session(tee_ctx, &session_id);
++	if (rc) {
++		tee_client_close_context(tee_ctx);
++		return rc;
++	}
++
++	stm32_bsec_ta_close_session(tee_ctx, session_id);
++
++	*ctx = tee_ctx;
++
++	return 0;
++}
++
++/* stm32_bsec_optee_ta_open() - release the PTA STM32MP BSEC TA */
++void stm32_bsec_optee_ta_close(void *ctx)
++{
++	tee_client_close_context(ctx);
++}
++
++/* stm32_bsec_optee_ta_read() - nvmem read access using PTA client driver */
++int stm32_bsec_optee_ta_read(struct tee_context *ctx, unsigned int offset,
++			     void *buf, size_t bytes)
++{
++	struct tee_shm *shm;
++	struct tee_ioctl_invoke_arg arg;
++	struct tee_param param[2];
++	u8 *shm_buf;
++	u32 start, num_bytes;
++	int ret;
++	u32 session_id;
++
++	ret = stm32_bsec_ta_open_session(ctx, &session_id);
++	if (ret)
++		return ret;
++
++	memset(&arg, 0, sizeof(arg));
++	memset(&param, 0, sizeof(param));
++
++	arg.func = PTA_BSEC_READ_MEM;
++	arg.session = session_id;
++	arg.num_params = 2;
++
++	/* align access on 32bits */
++	start = ALIGN_DOWN(offset, 4);
++	num_bytes = round_up(offset + bytes - start, 4);
++	param[0].attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT;
++	param[0].u.value.a = start;
++	param[0].u.value.b = SHADOW_ACCESS;
++
++	shm = tee_shm_alloc_kernel_buf(ctx, num_bytes);
++	if (IS_ERR(shm)) {
++		ret = PTR_ERR(shm);
++		goto out_tee_session;
++	}
++
++	param[1].attr = TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT;
++	param[1].u.memref.shm = shm;
++	param[1].u.memref.size = num_bytes;
++
++	ret = tee_client_invoke_func(ctx, &arg, param);
++	if (ret < 0 || arg.ret != 0) {
++		pr_err("TA_BSEC invoke failed TEE err:%#x, ret:%#x\n",
++			arg.ret, ret);
++		if (!ret)
++			ret = -EIO;
++	}
++	if (!ret) {
++		shm_buf = tee_shm_get_va(shm, 0);
++		if (IS_ERR(shm_buf)) {
++			ret = PTR_ERR(shm_buf);
++			pr_err("tee_shm_get_va failed for transmit (%d)\n", ret);
++		} else {
++			/* read data from 32 bits aligned buffer */
++			memcpy(buf, &shm_buf[offset % 4], bytes);
++		}
++	}
++
++	tee_shm_free(shm);
++
++out_tee_session:
++	stm32_bsec_ta_close_session(ctx, session_id);
++
++	return ret;
++}
++
++/* stm32_bsec_optee_ta_write() - nvmem write access using PTA client driver */
++int stm32_bsec_optee_ta_write(struct tee_context *ctx, unsigned int lower,
++			      unsigned int offset, void *buf, size_t bytes)
++{	struct tee_shm *shm;
++	struct tee_ioctl_invoke_arg arg;
++	struct tee_param param[2];
++	u8 *shm_buf;
++	int ret;
++	u32 session_id;
++
++	ret = stm32_bsec_ta_open_session(ctx, &session_id);
++	if (ret)
++		return ret;
++
++	/* Allow only writing complete 32-bits aligned words */
++	if ((bytes % 4) || (offset % 4))
++		return -EINVAL;
++
++	memset(&arg, 0, sizeof(arg));
++	memset(&param, 0, sizeof(param));
++
++	arg.func = PTA_BSEC_WRITE_MEM;
++	arg.session = session_id;
++	arg.num_params = 2;
++
++	param[0].attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT;
++	param[0].u.value.a = offset;
++	param[0].u.value.b = FUSE_ACCESS;
++
++	shm = tee_shm_alloc_kernel_buf(ctx, bytes);
++	if (IS_ERR(shm)) {
++		ret = PTR_ERR(shm);
++		goto out_tee_session;
++	}
++
++	param[1].attr = TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT;
++	param[1].u.memref.shm = shm;
++	param[1].u.memref.size = bytes;
++
++	shm_buf = tee_shm_get_va(shm, 0);
++	if (IS_ERR(shm_buf)) {
++		ret = PTR_ERR(shm_buf);
++		pr_err("tee_shm_get_va failed for transmit (%d)\n", ret);
++		tee_shm_free(shm);
++
++		goto out_tee_session;
++	}
++
++	memcpy(shm_buf, buf, bytes);
++
++	ret = tee_client_invoke_func(ctx, &arg, param);
++	if (ret < 0 || arg.ret != 0) {
++		pr_err("TA_BSEC invoke failed TEE err:%#x, ret:%#x\n", arg.ret, ret);
++		if (!ret)
++			ret = -EIO;
++	}
++	pr_debug("Write OTPs %d to %zu, ret=%d\n", offset / 4, (offset + bytes) / 4, ret);
++
++	/* Lock the upper OTPs with ECC protection, word programming only */
++	if (!ret && ((offset + bytes) >= (lower * 4))) {
++		u32 start, nb_lock;
++		u32 *lock = (u32 *)shm_buf;
++		int i;
++
++		/*
++		 * don't lock the lower OTPs, no ECC protection and incremental
++		 * bit programming, a second write is allowed
++		 */
++		start = max_t(u32, offset, lower * 4);
++		nb_lock = (offset + bytes - start) / 4;
++
++		param[0].u.value.a = start;
++		param[0].u.value.b = LOCK_ACCESS;
++		param[1].u.memref.size = nb_lock * 4;
++
++		for (i = 0; i < nb_lock; i++)
++			lock[i] = LOCK_PERM;
++
++		ret = tee_client_invoke_func(ctx, &arg, param);
++		if (ret < 0 || arg.ret != 0) {
++			pr_err("TA_BSEC invoke failed TEE err:%#x, ret:%#x\n", arg.ret, ret);
++			if (!ret)
++				ret = -EIO;
++		}
++		pr_debug("Lock upper OTPs %d to %d, ret=%d\n",
++			 start / 4, start / 4 + nb_lock, ret);
++	}
++
++	tee_shm_free(shm);
++
++out_tee_session:
++	stm32_bsec_ta_close_session(ctx, session_id);
++
++	return ret;
++}
+--- /dev/null
++++ b/drivers/nvmem/stm32-bsec-optee-ta.h
+@@ -0,0 +1,80 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++/*
++ * OP-TEE STM32MP BSEC PTA interface, used by STM32 ROMEM driver
++ *
++ * Copyright (C) 2022, STMicroelectronics - All Rights Reserved
++ */
++
++#if IS_ENABLED(CONFIG_NVMEM_STM32_BSEC_OPTEE_TA)
++/**
++ * stm32_bsec_optee_ta_open() - initialize the STM32 BSEC TA
++ * @ctx: the OP-TEE context on success
++ *
++ * Return:
++ *	On success, 0. On failure, -errno.
++ */
++int stm32_bsec_optee_ta_open(struct tee_context **ctx);
++
++/**
++ * stm32_bsec_optee_ta_close() - release the STM32 BSEC TA
++ * @ctx: the OP-TEE context
++ *
++ * This function used to clean the OP-TEE resources initialized in
++ * stm32_bsec_optee_ta_open(); it can be used as callback to
++ * devm_add_action_or_reset()
++ */
++void stm32_bsec_optee_ta_close(void *ctx);
++
++/**
++ * stm32_bsec_optee_ta_read() - nvmem read access using TA client driver
++ * @ctx: the OP-TEE context provided by stm32_bsec_optee_ta_open
++ * @offset: nvmem offset
++ * @buf: buffer to fill with nvem values
++ * @bytes: number of bytes to read
++ *
++ * Return:
++ *	On success, 0. On failure, -errno.
++ */
++int stm32_bsec_optee_ta_read(struct tee_context *ctx, unsigned int offset,
++			     void *buf, size_t bytes);
++
++/**
++ * stm32_bsec_optee_ta_write() - nvmem write access using TA client driver
++ * @ctx: the OP-TEE context provided by stm32_bsec_optee_ta_open
++ * @lower: number of lower OTP, not protected by ECC
++ * @offset: nvmem offset
++ * @buf: buffer with nvem values
++ * @bytes: number of bytes to write
++ *
++ * Return:
++ *	On success, 0. On failure, -errno.
++ */
++int stm32_bsec_optee_ta_write(struct tee_context *ctx, unsigned int lower,
++			      unsigned int offset, void *buf, size_t bytes);
++
++#else
++
++static inline int stm32_bsec_optee_ta_open(struct tee_context **ctx)
++{
++	return -EOPNOTSUPP;
++}
++
++static inline void stm32_bsec_optee_ta_close(void *ctx)
++{
++}
++
++static inline int stm32_bsec_optee_ta_read(struct tee_context *ctx,
++					   unsigned int offset, void *buf,
++					   size_t bytes)
++{
++	return -EOPNOTSUPP;
++}
++
++static inline int stm32_bsec_optee_ta_write(struct tee_context *ctx,
++					    unsigned int lower,
++					    unsigned int offset, void *buf,
++					    size_t bytes)
++{
++	return -EOPNOTSUPP;
++}
++#endif /* CONFIG_NVMEM_STM32_BSEC_OPTEE_TA */
+--- a/drivers/nvmem/stm32-romem.c
++++ b/drivers/nvmem/stm32-romem.c
+@@ -11,6 +11,9 @@
+ #include <linux/module.h>
+ #include <linux/nvmem-provider.h>
+ #include <linux/of_device.h>
++#include <linux/tee_drv.h>
++
++#include "stm32-bsec-optee-ta.h"
+ 
+ /* BSEC secure service access from non-secure */
+ #define STM32_SMC_BSEC			0x82001003
+@@ -25,12 +28,14 @@
+ struct stm32_romem_cfg {
+ 	int size;
+ 	u8 lower;
++	bool ta;
+ };
+ 
+ struct stm32_romem_priv {
+ 	void __iomem *base;
+ 	struct nvmem_config cfg;
+ 	u8 lower;
++	struct tee_context *ctx;
+ };
+ 
+ static int stm32_romem_read(void *context, unsigned int offset, void *buf,
+@@ -138,12 +143,29 @@ static int stm32_bsec_write(void *contex
+ 	return 0;
+ }
+ 
++static int stm32_bsec_pta_read(void *context, unsigned int offset, void *buf,
++			       size_t bytes)
++{
++	struct stm32_romem_priv *priv = context;
++
++	return stm32_bsec_optee_ta_read(priv->ctx, offset, buf, bytes);
++}
++
++static int stm32_bsec_pta_write(void *context, unsigned int offset, void *buf,
++				size_t bytes)
++{
++	struct stm32_romem_priv *priv = context;
++
++	return stm32_bsec_optee_ta_write(priv->ctx, priv->lower, offset, buf, bytes);
++}
++
+ static int stm32_romem_probe(struct platform_device *pdev)
+ {
+ 	const struct stm32_romem_cfg *cfg;
+ 	struct device *dev = &pdev->dev;
+ 	struct stm32_romem_priv *priv;
+ 	struct resource *res;
++	int rc;
+ 
+ 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+ 	if (!priv)
+@@ -173,15 +195,31 @@ static int stm32_romem_probe(struct plat
+ 	} else {
+ 		priv->cfg.size = cfg->size;
+ 		priv->lower = cfg->lower;
+-		priv->cfg.reg_read = stm32_bsec_read;
+-		priv->cfg.reg_write = stm32_bsec_write;
++		if (cfg->ta) {
++			rc = stm32_bsec_optee_ta_open(&priv->ctx);
++			/* wait for OP-TEE client driver to be up and ready */
++			if (rc)
++				return rc;
++		}
++		if (priv->ctx) {
++			rc = devm_add_action_or_reset(dev, stm32_bsec_optee_ta_close, priv->ctx);
++			if (rc) {
++				dev_err(dev, "devm_add_action_or_reset() failed (%d)\n", rc);
++				return rc;
++			}
++			priv->cfg.reg_read = stm32_bsec_pta_read;
++			priv->cfg.reg_write = stm32_bsec_pta_write;
++		} else {
++			priv->cfg.reg_read = stm32_bsec_read;
++			priv->cfg.reg_write = stm32_bsec_write;
++		}
+ 	}
+ 
+ 	return PTR_ERR_OR_ZERO(devm_nvmem_register(dev, &priv->cfg));
+ }
+ 
+ /*
+- * STM32MP15 BSEC OTP regions: 4096 OTP bits (with 3072 effective bits)
++ * STM32MP15/13 BSEC OTP regions: 4096 OTP bits (with 3072 effective bits)
+  * => 96 x 32-bits data words
+  * - Lower: 1K bits, 2:1 redundancy, incremental bit programming
+  *   => 32 (x 32-bits) lower shadow registers = words 0 to 31
+@@ -191,6 +229,13 @@ static int stm32_romem_probe(struct plat
+ static const struct stm32_romem_cfg stm32mp15_bsec_cfg = {
+ 	.size = 384,
+ 	.lower = 32,
++	.ta = false,
++};
++
++static const struct stm32_romem_cfg stm32mp13_bsec_cfg = {
++	.size = 384,
++	.lower = 32,
++	.ta = true,
+ };
+ 
+ static const struct of_device_id stm32_romem_of_match[] = {
+@@ -198,7 +243,10 @@ static const struct of_device_id stm32_r
+ 		.compatible = "st,stm32mp15-bsec",
+ 		.data = (void *)&stm32mp15_bsec_cfg,
+ 	}, {
++		.compatible = "st,stm32mp13-bsec",
++		.data = (void *)&stm32mp13_bsec_cfg,
+ 	},
++	{ /* sentinel */ },
+ };
+ MODULE_DEVICE_TABLE(of, stm32_romem_of_match);
+ 
diff --git a/target/linux/generic/backport-6.1/809-v6.3-0008-nvmem-stm32-detect-bsec-pta-presence-for-STM32MP15x.patch b/target/linux/generic/backport-6.1/809-v6.3-0008-nvmem-stm32-detect-bsec-pta-presence-for-STM32MP15x.patch
new file mode 100644
index 00000000000000..cea8e93858fc7d
--- /dev/null
+++ b/target/linux/generic/backport-6.1/809-v6.3-0008-nvmem-stm32-detect-bsec-pta-presence-for-STM32MP15x.patch
@@ -0,0 +1,85 @@
+From df2f34ef1d924125ffaf29dfdaf7cdbd3183c321 Mon Sep 17 00:00:00 2001
+From: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Date: Mon, 6 Feb 2023 13:43:52 +0000
+Subject: [PATCH] nvmem: stm32: detect bsec pta presence for STM32MP15x
+
+On STM32MP15x SoC, the SMC backend is optional when OP-TEE is used;
+the PTA BSEC should be used as it is done on STM32MP13x platform,
+but the BSEC SMC can be also used: it is a legacy mode in OP-TEE,
+not recommended but used in previous OP-TEE firmware.
+
+The presence of OP-TEE is dynamically detected in STM32MP15x device tree
+and the supported NVMEM backend is dynamically detected:
+- PTA with stm32_bsec_pta_find
+- SMC with stm32_bsec_check
+
+With OP-TEE but without PTA and SMC detection, the probe is deferred for
+STM32MP15x devices.
+
+On STM32MP13x platform, only the PTA is supported with cfg->ta = true
+and this detection is skipped.
+
+Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-19-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/stm32-romem.c | 38 +++++++++++++++++++++++++++++++++----
+ 1 file changed, 34 insertions(+), 4 deletions(-)
+
+--- a/drivers/nvmem/stm32-romem.c
++++ b/drivers/nvmem/stm32-romem.c
+@@ -159,6 +159,31 @@ static int stm32_bsec_pta_write(void *co
+ 	return stm32_bsec_optee_ta_write(priv->ctx, priv->lower, offset, buf, bytes);
+ }
+ 
++static bool stm32_bsec_smc_check(void)
++{
++	u32 val;
++	int ret;
++
++	/* check that the OP-TEE support the BSEC SMC (legacy mode) */
++	ret = stm32_bsec_smc(STM32_SMC_READ_SHADOW, 0, 0, &val);
++
++	return !ret;
++}
++
++static bool optee_presence_check(void)
++{
++	struct device_node *np;
++	bool tee_detected = false;
++
++	/* check that the OP-TEE node is present and available. */
++	np = of_find_compatible_node(NULL, NULL, "linaro,optee-tz");
++	if (np && of_device_is_available(np))
++		tee_detected = true;
++	of_node_put(np);
++
++	return tee_detected;
++}
++
+ static int stm32_romem_probe(struct platform_device *pdev)
+ {
+ 	const struct stm32_romem_cfg *cfg;
+@@ -195,11 +220,16 @@ static int stm32_romem_probe(struct plat
+ 	} else {
+ 		priv->cfg.size = cfg->size;
+ 		priv->lower = cfg->lower;
+-		if (cfg->ta) {
++		if (cfg->ta || optee_presence_check()) {
+ 			rc = stm32_bsec_optee_ta_open(&priv->ctx);
+-			/* wait for OP-TEE client driver to be up and ready */
+-			if (rc)
+-				return rc;
++			if (rc) {
++				/* wait for OP-TEE client driver to be up and ready */
++				if (rc == -EPROBE_DEFER)
++					return -EPROBE_DEFER;
++				/* BSEC PTA is required or SMC not supported */
++				if (cfg->ta || !stm32_bsec_smc_check())
++					return rc;
++			}
+ 		}
+ 		if (priv->ctx) {
+ 			rc = devm_add_action_or_reset(dev, stm32_bsec_optee_ta_close, priv->ctx);
diff --git a/target/linux/generic/backport-6.1/809-v6.3-0009-nvmem-rave-sp-eeprm-fix-kernel-doc-bad-line-warning.patch b/target/linux/generic/backport-6.1/809-v6.3-0009-nvmem-rave-sp-eeprm-fix-kernel-doc-bad-line-warning.patch
new file mode 100644
index 00000000000000..9d6275a737bccb
--- /dev/null
+++ b/target/linux/generic/backport-6.1/809-v6.3-0009-nvmem-rave-sp-eeprm-fix-kernel-doc-bad-line-warning.patch
@@ -0,0 +1,32 @@
+From 3e5ac22aa564026e99defc3a8e02082521a5b231 Mon Sep 17 00:00:00 2001
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Mon, 6 Feb 2023 13:43:53 +0000
+Subject: [PATCH] nvmem: rave-sp-eeprm: fix kernel-doc bad line warning
+
+Convert an empty line to " *" to avoid a kernel-doc warning:
+
+drivers/nvmem/rave-sp-eeprom.c:48: warning: bad line:
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Cc: Andrey Vostrikov <andrey.vostrikov@cogentembedded.com>
+Cc: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
+Cc: Andrey Smirnov <andrew.smirnov@gmail.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-20-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/rave-sp-eeprom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/rave-sp-eeprom.c
++++ b/drivers/nvmem/rave-sp-eeprom.c
+@@ -45,7 +45,7 @@ enum rave_sp_eeprom_header_size {
+  * @type:	Access type (see enum rave_sp_eeprom_access_type)
+  * @success:	Success flag (Success = 1, Failure = 0)
+  * @data:	Read data
+-
++ *
+  * Note this structure corresponds to RSP_*_EEPROM payload from RAVE
+  * SP ICD
+  */
diff --git a/target/linux/generic/backport-6.1/809-v6.3-0010-nvmem-qcom-spmi-sdam-register-at-device-init-time.patch b/target/linux/generic/backport-6.1/809-v6.3-0010-nvmem-qcom-spmi-sdam-register-at-device-init-time.patch
new file mode 100644
index 00000000000000..1ab9e609d33c91
--- /dev/null
+++ b/target/linux/generic/backport-6.1/809-v6.3-0010-nvmem-qcom-spmi-sdam-register-at-device-init-time.patch
@@ -0,0 +1,43 @@
+From eb7dda20f42a9137e9ee53d5ed3b743d49338cb5 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Mon, 6 Feb 2023 13:43:54 +0000
+Subject: [PATCH] nvmem: qcom-spmi-sdam: register at device init time
+
+There are currently no in-tree users of the Qualcomm SDAM nvmem driver
+and there is generally no point in registering a driver that can be
+built as a module at subsys init time.
+
+Register the driver at the normal device init time instead and let
+driver core sort out the probe order.
+
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-21-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/qcom-spmi-sdam.c | 13 +------------
+ 1 file changed, 1 insertion(+), 12 deletions(-)
+
+--- a/drivers/nvmem/qcom-spmi-sdam.c
++++ b/drivers/nvmem/qcom-spmi-sdam.c
+@@ -175,18 +175,7 @@ static struct platform_driver sdam_drive
+ 	},
+ 	.probe		= sdam_probe,
+ };
+-
+-static int __init sdam_init(void)
+-{
+-	return platform_driver_register(&sdam_driver);
+-}
+-subsys_initcall(sdam_init);
+-
+-static void __exit sdam_exit(void)
+-{
+-	return platform_driver_unregister(&sdam_driver);
+-}
+-module_exit(sdam_exit);
++module_platform_driver(sdam_driver);
+ 
+ MODULE_DESCRIPTION("QCOM SPMI SDAM driver");
+ MODULE_LICENSE("GPL v2");
diff --git a/target/linux/generic/backport-6.1/809-v6.3-0011-nvmem-stm32-fix-OPTEE-dependency.patch b/target/linux/generic/backport-6.1/809-v6.3-0011-nvmem-stm32-fix-OPTEE-dependency.patch
new file mode 100644
index 00000000000000..dcf704c6ffbbfa
--- /dev/null
+++ b/target/linux/generic/backport-6.1/809-v6.3-0011-nvmem-stm32-fix-OPTEE-dependency.patch
@@ -0,0 +1,46 @@
+From 1dc7e37bb0ec1c997fac82031332a38c7610352f Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 6 Feb 2023 13:43:56 +0000
+Subject: [PATCH] nvmem: stm32: fix OPTEE dependency
+
+The stm32 nvmem driver fails to link as built-in when OPTEE
+is a loadable module:
+
+aarch64-linux-ld: drivers/nvmem/stm32-bsec-optee-ta.o: in function `stm32_bsec:
+stm32-bsec-optee-ta.c:(.text+0xc8): undefined reference to `tee_client_open_session'
+aarch64-linux-ld: drivers/nvmem/stm32-bsec-optee-ta.o: in function `stm32_bsec:
+stm32-bsec-optee-ta.c:(.text+0x1fc): undefined reference to `tee_client_open_context'
+
+Change the CONFIG_NVMEM_STM32_ROMEM definition so it can only
+be built-in if OPTEE is either built-in or disabled, and
+make NVMEM_STM32_BSEC_OPTEE_TA a hidden symbol instead.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-23-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/Kconfig | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -291,8 +291,7 @@ config NVMEM_SPRD_EFUSE
+ 	  will be called nvmem-sprd-efuse.
+ 
+ config NVMEM_STM32_BSEC_OPTEE_TA
+-	bool "STM32MP BSEC OP-TEE TA support for nvmem-stm32-romem driver"
+-	depends on OPTEE
++	def_bool NVMEM_STM32_ROMEM && OPTEE
+ 	help
+ 	  Say y here to enable the accesses to STM32MP SoC OTPs by the OP-TEE
+ 	  trusted application STM32MP BSEC.
+@@ -303,7 +302,7 @@ config NVMEM_STM32_BSEC_OPTEE_TA
+ config NVMEM_STM32_ROMEM
+ 	tristate "STMicroelectronics STM32 factory-programmed memory support"
+ 	depends on ARCH_STM32 || COMPILE_TEST
+-	imply NVMEM_STM32_BSEC_OPTEE_TA
++	depends on OPTEE || !OPTEE
+ 	help
+ 	  Say y here to enable read-only access for STMicroelectronics STM32
+ 	  factory-programmed memory area.
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0001-nvmem-xilinx-zynqmp-make-modular.patch b/target/linux/generic/backport-6.1/811-v6.4-0001-nvmem-xilinx-zynqmp-make-modular.patch
new file mode 100644
index 00000000000000..8328e87c0af7a4
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0001-nvmem-xilinx-zynqmp-make-modular.patch
@@ -0,0 +1,35 @@
+From bcd1fe07def0f070eb5f31594620aaee6f81d31a Mon Sep 17 00:00:00 2001
+From: Nick Alcock <nick.alcock@oracle.com>
+Date: Tue, 4 Apr 2023 18:21:11 +0100
+Subject: [PATCH] nvmem: xilinx: zynqmp: make modular
+
+This driver has a MODULE_LICENSE but is not tristate so cannot be
+built as a module, unlike all its peers: make it modular to match.
+
+Signed-off-by: Nick Alcock <nick.alcock@oracle.com>
+Suggested-by: Michal Simek <michal.simek@amd.com>
+Cc: Luis Chamberlain <mcgrof@kernel.org>
+Cc: linux-modules@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: Hitomi Hasegawa <hasegawa-hitomi@fujitsu.com>
+Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Cc: Michal Simek <michal.simek@xilinx.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-4-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -368,7 +368,7 @@ config NVMEM_VF610_OCOTP
+ 	  be called nvmem-vf610-ocotp.
+ 
+ config NVMEM_ZYNQMP
+-	bool "Xilinx ZYNQMP SoC nvmem firmware support"
++	tristate "Xilinx ZYNQMP SoC nvmem firmware support"
+ 	depends on ARCH_ZYNQMP
+ 	help
+ 	  This is a driver to access hardware related data like
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0002-nvmem-core-introduce-NVMEM-layouts.patch b/target/linux/generic/backport-6.1/811-v6.4-0002-nvmem-core-introduce-NVMEM-layouts.patch
new file mode 100644
index 00000000000000..94cd23c18ac347
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0002-nvmem-core-introduce-NVMEM-layouts.patch
@@ -0,0 +1,387 @@
+From 266570f496b90dea8fda893c2cf7c28d63ae2bd9 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Tue, 4 Apr 2023 18:21:21 +0100
+Subject: [PATCH] nvmem: core: introduce NVMEM layouts
+
+NVMEM layouts are used to generate NVMEM cells during runtime. Think of
+an EEPROM with a well-defined conent. For now, the content can be
+described by a device tree or a board file. But this only works if the
+offsets and lengths are static and don't change. One could also argue
+that putting the layout of the EEPROM in the device tree is the wrong
+place. Instead, the device tree should just have a specific compatible
+string.
+
+Right now there are two use cases:
+ (1) The NVMEM cell needs special processing. E.g. if it only specifies
+     a base MAC address offset and you need to add an offset, or it
+     needs to parse a MAC from ASCII format or some proprietary format.
+     (Post processing of cells is added in a later commit).
+ (2) u-boot environment parsing. The cells don't have a particular
+     offset but it needs parsing the content to determine the offsets
+     and length.
+
+Co-developed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-14-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/driver-api/nvmem.rst |  15 ++++
+ drivers/nvmem/Kconfig              |   4 +
+ drivers/nvmem/Makefile             |   1 +
+ drivers/nvmem/core.c               | 120 +++++++++++++++++++++++++++++
+ drivers/nvmem/layouts/Kconfig      |   5 ++
+ drivers/nvmem/layouts/Makefile     |   4 +
+ include/linux/nvmem-consumer.h     |   7 ++
+ include/linux/nvmem-provider.h     |  51 ++++++++++++
+ 8 files changed, 207 insertions(+)
+ create mode 100644 drivers/nvmem/layouts/Kconfig
+ create mode 100644 drivers/nvmem/layouts/Makefile
+
+--- a/Documentation/driver-api/nvmem.rst
++++ b/Documentation/driver-api/nvmem.rst
+@@ -185,3 +185,18 @@ ex::
+ =====================
+ 
+ See Documentation/devicetree/bindings/nvmem/nvmem.txt
++
++8. NVMEM layouts
++================
++
++NVMEM layouts are yet another mechanism to create cells. With the device
++tree binding it is possible to specify simple cells by using an offset
++and a length. Sometimes, the cells doesn't have a static offset, but
++the content is still well defined, e.g. tag-length-values. In this case,
++the NVMEM device content has to be first parsed and the cells need to
++be added accordingly. Layouts let you read the content of the NVMEM device
++and let you add cells dynamically.
++
++Another use case for layouts is the post processing of cells. With layouts,
++it is possible to associate a custom post processing hook to a cell. It
++even possible to add this hook to cells not created by the layout itself.
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -21,6 +21,10 @@ config NVMEM_SYSFS
+ 	 This interface is mostly used by userspace applications to
+ 	 read/write directly into nvmem.
+ 
++# Layouts
++
++source "drivers/nvmem/layouts/Kconfig"
++
+ # Devices
+ 
+ config NVMEM_APPLE_EFUSES
+--- a/drivers/nvmem/Makefile
++++ b/drivers/nvmem/Makefile
+@@ -5,6 +5,7 @@
+ 
+ obj-$(CONFIG_NVMEM)		+= nvmem_core.o
+ nvmem_core-y			:= core.o
++obj-y				+= layouts/
+ 
+ # Devices
+ obj-$(CONFIG_NVMEM_APPLE_EFUSES)	+= nvmem-apple-efuses.o
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -40,6 +40,7 @@ struct nvmem_device {
+ 	nvmem_reg_write_t	reg_write;
+ 	nvmem_cell_post_process_t cell_post_process;
+ 	struct gpio_desc	*wp_gpio;
++	struct nvmem_layout	*layout;
+ 	void *priv;
+ };
+ 
+@@ -74,6 +75,9 @@ static LIST_HEAD(nvmem_lookup_list);
+ 
+ static BLOCKING_NOTIFIER_HEAD(nvmem_notifier);
+ 
++static DEFINE_SPINLOCK(nvmem_layout_lock);
++static LIST_HEAD(nvmem_layouts);
++
+ static int __nvmem_reg_read(struct nvmem_device *nvmem, unsigned int offset,
+ 			    void *val, size_t bytes)
+ {
+@@ -728,6 +732,101 @@ static int nvmem_add_cells_from_of(struc
+ 	return 0;
+ }
+ 
++int __nvmem_layout_register(struct nvmem_layout *layout, struct module *owner)
++{
++	layout->owner = owner;
++
++	spin_lock(&nvmem_layout_lock);
++	list_add(&layout->node, &nvmem_layouts);
++	spin_unlock(&nvmem_layout_lock);
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(__nvmem_layout_register);
++
++void nvmem_layout_unregister(struct nvmem_layout *layout)
++{
++	spin_lock(&nvmem_layout_lock);
++	list_del(&layout->node);
++	spin_unlock(&nvmem_layout_lock);
++}
++EXPORT_SYMBOL_GPL(nvmem_layout_unregister);
++
++static struct nvmem_layout *nvmem_layout_get(struct nvmem_device *nvmem)
++{
++	struct device_node *layout_np, *np = nvmem->dev.of_node;
++	struct nvmem_layout *l, *layout = NULL;
++
++	layout_np = of_get_child_by_name(np, "nvmem-layout");
++	if (!layout_np)
++		return NULL;
++
++	spin_lock(&nvmem_layout_lock);
++
++	list_for_each_entry(l, &nvmem_layouts, node) {
++		if (of_match_node(l->of_match_table, layout_np)) {
++			if (try_module_get(l->owner))
++				layout = l;
++
++			break;
++		}
++	}
++
++	spin_unlock(&nvmem_layout_lock);
++	of_node_put(layout_np);
++
++	return layout;
++}
++
++static void nvmem_layout_put(struct nvmem_layout *layout)
++{
++	if (layout)
++		module_put(layout->owner);
++}
++
++static int nvmem_add_cells_from_layout(struct nvmem_device *nvmem)
++{
++	struct nvmem_layout *layout = nvmem->layout;
++	int ret;
++
++	if (layout && layout->add_cells) {
++		ret = layout->add_cells(&nvmem->dev, nvmem, layout);
++		if (ret)
++			return ret;
++	}
++
++	return 0;
++}
++
++#if IS_ENABLED(CONFIG_OF)
++/**
++ * of_nvmem_layout_get_container() - Get OF node to layout container.
++ *
++ * @nvmem: nvmem device.
++ *
++ * Return: a node pointer with refcount incremented or NULL if no
++ * container exists. Use of_node_put() on it when done.
++ */
++struct device_node *of_nvmem_layout_get_container(struct nvmem_device *nvmem)
++{
++	return of_get_child_by_name(nvmem->dev.of_node, "nvmem-layout");
++}
++EXPORT_SYMBOL_GPL(of_nvmem_layout_get_container);
++#endif
++
++const void *nvmem_layout_get_match_data(struct nvmem_device *nvmem,
++					struct nvmem_layout *layout)
++{
++	struct device_node __maybe_unused *layout_np;
++	const struct of_device_id *match;
++
++	layout_np = of_nvmem_layout_get_container(nvmem);
++	match = of_match_node(layout->of_match_table, layout_np);
++
++	return match ? match->data : NULL;
++}
++EXPORT_SYMBOL_GPL(nvmem_layout_get_match_data);
++
+ /**
+  * nvmem_register() - Register a nvmem device for given nvmem_config.
+  * Also creates a binary entry in /sys/bus/nvmem/devices/dev-name/nvmem
+@@ -834,6 +933,12 @@ struct nvmem_device *nvmem_register(cons
+ 			goto err_put_device;
+ 	}
+ 
++	/*
++	 * If the driver supplied a layout by config->layout, the module
++	 * pointer will be NULL and nvmem_layout_put() will be a noop.
++	 */
++	nvmem->layout = config->layout ?: nvmem_layout_get(nvmem);
++
+ 	if (config->cells) {
+ 		rval = nvmem_add_cells(nvmem, config->cells, config->ncells);
+ 		if (rval)
+@@ -854,12 +959,17 @@ struct nvmem_device *nvmem_register(cons
+ 	if (rval)
+ 		goto err_remove_cells;
+ 
++	rval = nvmem_add_cells_from_layout(nvmem);
++	if (rval)
++		goto err_remove_cells;
++
+ 	blocking_notifier_call_chain(&nvmem_notifier, NVMEM_ADD, nvmem);
+ 
+ 	return nvmem;
+ 
+ err_remove_cells:
+ 	nvmem_device_remove_all_cells(nvmem);
++	nvmem_layout_put(nvmem->layout);
+ 	if (config->compat)
+ 		nvmem_sysfs_remove_compat(nvmem, config);
+ err_put_device:
+@@ -881,6 +991,7 @@ static void nvmem_device_release(struct
+ 		device_remove_bin_file(nvmem->base_dev, &nvmem->eeprom);
+ 
+ 	nvmem_device_remove_all_cells(nvmem);
++	nvmem_layout_put(nvmem->layout);
+ 	device_unregister(&nvmem->dev);
+ }
+ 
+@@ -1246,6 +1357,15 @@ struct nvmem_cell *of_nvmem_cell_get(str
+ 		return ERR_PTR(-EINVAL);
+ 	}
+ 
++	/* nvmem layouts produce cells within the nvmem-layout container */
++	if (of_node_name_eq(nvmem_np, "nvmem-layout")) {
++		nvmem_np = of_get_next_parent(nvmem_np);
++		if (!nvmem_np) {
++			of_node_put(cell_np);
++			return ERR_PTR(-EINVAL);
++		}
++	}
++
+ 	nvmem = __nvmem_device_get(nvmem_np, device_match_of_node);
+ 	of_node_put(nvmem_np);
+ 	if (IS_ERR(nvmem)) {
+--- /dev/null
++++ b/drivers/nvmem/layouts/Kconfig
+@@ -0,0 +1,5 @@
++# SPDX-License-Identifier: GPL-2.0
++
++menu "Layout Types"
++
++endmenu
+--- /dev/null
++++ b/drivers/nvmem/layouts/Makefile
+@@ -0,0 +1,4 @@
++# SPDX-License-Identifier: GPL-2.0
++#
++# Makefile for nvmem layouts.
++#
+--- a/include/linux/nvmem-consumer.h
++++ b/include/linux/nvmem-consumer.h
+@@ -239,6 +239,7 @@ struct nvmem_cell *of_nvmem_cell_get(str
+ 				     const char *id);
+ struct nvmem_device *of_nvmem_device_get(struct device_node *np,
+ 					 const char *name);
++struct device_node *of_nvmem_layout_get_container(struct nvmem_device *nvmem);
+ #else
+ static inline struct nvmem_cell *of_nvmem_cell_get(struct device_node *np,
+ 						   const char *id)
+@@ -251,6 +252,12 @@ static inline struct nvmem_device *of_nv
+ {
+ 	return ERR_PTR(-EOPNOTSUPP);
+ }
++
++static inline struct device_node *
++of_nvmem_layout_get_container(struct nvmem_device *nvmem)
++{
++	return ERR_PTR(-EOPNOTSUPP);
++}
+ #endif /* CONFIG_NVMEM && CONFIG_OF */
+ 
+ #endif  /* ifndef _LINUX_NVMEM_CONSUMER_H */
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -88,6 +88,7 @@ struct nvmem_cell_info {
+  * @stride:	Minimum read/write access stride.
+  * @priv:	User context passed to read/write callbacks.
+  * @ignore_wp:  Write Protect pin is managed by the provider.
++ * @layout:	Fixed layout associated with this nvmem device.
+  *
+  * Note: A default "nvmem<id>" name will be assigned to the device if
+  * no name is specified in its configuration. In such case "<id>" is
+@@ -109,6 +110,7 @@ struct nvmem_config {
+ 	bool			read_only;
+ 	bool			root_only;
+ 	bool			ignore_wp;
++	struct nvmem_layout	*layout;
+ 	struct device_node	*of_node;
+ 	bool			no_of_node;
+ 	nvmem_reg_read_t	reg_read;
+@@ -142,6 +144,33 @@ struct nvmem_cell_table {
+ 	struct list_head	node;
+ };
+ 
++/**
++ * struct nvmem_layout - NVMEM layout definitions
++ *
++ * @name:		Layout name.
++ * @of_match_table:	Open firmware match table.
++ * @add_cells:		Will be called if a nvmem device is found which
++ *			has this layout. The function will add layout
++ *			specific cells with nvmem_add_one_cell().
++ * @owner:		Pointer to struct module.
++ * @node:		List node.
++ *
++ * A nvmem device can hold a well defined structure which can just be
++ * evaluated during runtime. For example a TLV list, or a list of "name=val"
++ * pairs. A nvmem layout can parse the nvmem device and add appropriate
++ * cells.
++ */
++struct nvmem_layout {
++	const char *name;
++	const struct of_device_id *of_match_table;
++	int (*add_cells)(struct device *dev, struct nvmem_device *nvmem,
++			 struct nvmem_layout *layout);
++
++	/* private */
++	struct module *owner;
++	struct list_head node;
++};
++
+ #if IS_ENABLED(CONFIG_NVMEM)
+ 
+ struct nvmem_device *nvmem_register(const struct nvmem_config *cfg);
+@@ -156,6 +185,14 @@ void nvmem_del_cell_table(struct nvmem_c
+ int nvmem_add_one_cell(struct nvmem_device *nvmem,
+ 		       const struct nvmem_cell_info *info);
+ 
++int __nvmem_layout_register(struct nvmem_layout *layout, struct module *owner);
++#define nvmem_layout_register(layout) \
++	__nvmem_layout_register(layout, THIS_MODULE)
++void nvmem_layout_unregister(struct nvmem_layout *layout);
++
++const void *nvmem_layout_get_match_data(struct nvmem_device *nvmem,
++					struct nvmem_layout *layout);
++
+ #else
+ 
+ static inline struct nvmem_device *nvmem_register(const struct nvmem_config *c)
+@@ -179,5 +216,19 @@ static inline int nvmem_add_one_cell(str
+ 	return -EOPNOTSUPP;
+ }
+ 
++static inline int nvmem_layout_register(struct nvmem_layout *layout)
++{
++	return -EOPNOTSUPP;
++}
++
++static inline void nvmem_layout_unregister(struct nvmem_layout *layout) {}
++
++static inline const void *
++nvmem_layout_get_match_data(struct nvmem_device *nvmem,
++			    struct nvmem_layout *layout)
++{
++	return NULL;
++}
++
+ #endif /* CONFIG_NVMEM */
+ #endif  /* ifndef _LINUX_NVMEM_PROVIDER_H */
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0003-nvmem-core-handle-the-absence-of-expected-layouts.patch b/target/linux/generic/backport-6.1/811-v6.4-0003-nvmem-core-handle-the-absence-of-expected-layouts.patch
new file mode 100644
index 00000000000000..6fa7b6382d8941
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0003-nvmem-core-handle-the-absence-of-expected-layouts.patch
@@ -0,0 +1,61 @@
+From 6468a6f45148fb5e95c86b4efebf63f9abcd2137 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:22 +0100
+Subject: [PATCH] nvmem: core: handle the absence of expected layouts
+
+Make nvmem_layout_get() return -EPROBE_DEFER while the expected layout
+is not available. This condition cannot be triggered today as nvmem
+layout drivers are initialed as part of an early init call, but soon
+these drivers will be converted into modules and be initialized with a
+standard priority, so the unavailability of the drivers might become a
+reality that must be taken care of.
+
+Let's anticipate this by telling the caller the layout might not yet be
+available. A probe deferral is requested in this case.
+
+Please note this does not affect any nvmem device not using layouts,
+because an early check against the "nvmem-layout" container presence
+will return NULL in this case.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Tested-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-15-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -755,7 +755,7 @@ EXPORT_SYMBOL_GPL(nvmem_layout_unregiste
+ static struct nvmem_layout *nvmem_layout_get(struct nvmem_device *nvmem)
+ {
+ 	struct device_node *layout_np, *np = nvmem->dev.of_node;
+-	struct nvmem_layout *l, *layout = NULL;
++	struct nvmem_layout *l, *layout = ERR_PTR(-EPROBE_DEFER);
+ 
+ 	layout_np = of_get_child_by_name(np, "nvmem-layout");
+ 	if (!layout_np)
+@@ -938,6 +938,13 @@ struct nvmem_device *nvmem_register(cons
+ 	 * pointer will be NULL and nvmem_layout_put() will be a noop.
+ 	 */
+ 	nvmem->layout = config->layout ?: nvmem_layout_get(nvmem);
++	if (IS_ERR(nvmem->layout)) {
++		rval = PTR_ERR(nvmem->layout);
++		nvmem->layout = NULL;
++
++		if (rval == -EPROBE_DEFER)
++			goto err_teardown_compat;
++	}
+ 
+ 	if (config->cells) {
+ 		rval = nvmem_add_cells(nvmem, config->cells, config->ncells);
+@@ -970,6 +977,7 @@ struct nvmem_device *nvmem_register(cons
+ err_remove_cells:
+ 	nvmem_device_remove_all_cells(nvmem);
+ 	nvmem_layout_put(nvmem->layout);
++err_teardown_compat:
+ 	if (config->compat)
+ 		nvmem_sysfs_remove_compat(nvmem, config);
+ err_put_device:
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0004-nvmem-core-request-layout-modules-loading.patch b/target/linux/generic/backport-6.1/811-v6.4-0004-nvmem-core-request-layout-modules-loading.patch
new file mode 100644
index 00000000000000..b9341666f91f9d
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0004-nvmem-core-request-layout-modules-loading.patch
@@ -0,0 +1,52 @@
+From b1c37bec1ccfe5ccab72bc0ddc0dfa45c43e2de2 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:23 +0100
+Subject: [PATCH] nvmem: core: request layout modules loading
+
+When a storage device like an eeprom or an mtd device probes, it
+registers an nvmem device if the nvmem subsystem has been enabled (bool
+symbol). During nvmem registration, if the device is using layouts to
+expose dynamic nvmem cells, the core will first try to get a reference
+over the layout driver callbacks. In practice there is not relationship
+that can be described between the storage driver and the nvmem
+layout. So there is no way we can enforce both drivers will be built-in
+or both will be modules. If the storage device driver is built-in but
+the layout is built as a module, instead of badly failing with an
+endless probe deferral loop, lets just make a modprobe call in case the
+driver was made available in an initramfs with
+of_device_node_request_module(), and offer a fully functional system to
+the user.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Tested-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-16-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -17,6 +17,7 @@
+ #include <linux/nvmem-provider.h>
+ #include <linux/gpio/consumer.h>
+ #include <linux/of.h>
++#include <linux/of_device.h>
+ #include <linux/slab.h>
+ 
+ struct nvmem_device {
+@@ -761,6 +762,13 @@ static struct nvmem_layout *nvmem_layout
+ 	if (!layout_np)
+ 		return NULL;
+ 
++	/*
++	 * In case the nvmem device was built-in while the layout was built as a
++	 * module, we shall manually request the layout driver loading otherwise
++	 * we'll never have any match.
++	 */
++	of_request_module(layout_np);
++
+ 	spin_lock(&nvmem_layout_lock);
+ 
+ 	list_for_each_entry(l, &nvmem_layouts, node) {
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0005-nvmem-core-add-per-cell-post-processing.patch b/target/linux/generic/backport-6.1/811-v6.4-0005-nvmem-core-add-per-cell-post-processing.patch
new file mode 100644
index 00000000000000..53628cd4e4ffb4
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0005-nvmem-core-add-per-cell-post-processing.patch
@@ -0,0 +1,86 @@
+From 345ec382cd4b736c36e01f155d08c913b225b736 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Tue, 4 Apr 2023 18:21:24 +0100
+Subject: [PATCH] nvmem: core: add per-cell post processing
+
+Instead of relying on the name the consumer is using for the cell, like
+it is done for the nvmem .cell_post_process configuration parameter,
+provide a per-cell post processing hook. This can then be populated by
+the NVMEM provider (or the NVMEM layout) when adding the cell.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-17-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c           | 17 +++++++++++++++++
+ include/linux/nvmem-provider.h |  3 +++
+ 2 files changed, 20 insertions(+)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -54,6 +54,7 @@ struct nvmem_cell_entry {
+ 	int			bytes;
+ 	int			bit_offset;
+ 	int			nbits;
++	nvmem_cell_post_process_t read_post_process;
+ 	struct device_node	*np;
+ 	struct nvmem_device	*nvmem;
+ 	struct list_head	node;
+@@ -470,6 +471,7 @@ static int nvmem_cell_info_to_nvmem_cell
+ 	cell->offset = info->offset;
+ 	cell->bytes = info->bytes;
+ 	cell->name = info->name;
++	cell->read_post_process = info->read_post_process;
+ 
+ 	cell->bit_offset = info->bit_offset;
+ 	cell->nbits = info->nbits;
+@@ -1563,6 +1565,13 @@ static int __nvmem_cell_read(struct nvme
+ 	if (cell->bit_offset || cell->nbits)
+ 		nvmem_shift_read_buffer_in_place(cell, buf);
+ 
++	if (cell->read_post_process) {
++		rc = cell->read_post_process(nvmem->priv, id, index,
++					     cell->offset, buf, cell->bytes);
++		if (rc)
++			return rc;
++	}
++
+ 	if (nvmem->cell_post_process) {
+ 		rc = nvmem->cell_post_process(nvmem->priv, id, index,
+ 					      cell->offset, buf, cell->bytes);
+@@ -1671,6 +1680,14 @@ static int __nvmem_cell_entry_write(stru
+ 	    (cell->bit_offset == 0 && len != cell->bytes))
+ 		return -EINVAL;
+ 
++	/*
++	 * Any cells which have a read_post_process hook are read-only because
++	 * we cannot reverse the operation and it might affect other cells,
++	 * too.
++	 */
++	if (cell->read_post_process)
++		return -EINVAL;
++
+ 	if (cell->bit_offset || cell->nbits) {
+ 		buf = nvmem_cell_prepare_write_buffer(cell, buf, len);
+ 		if (IS_ERR(buf))
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -54,6 +54,8 @@ struct nvmem_keepout {
+  * @bit_offset:	Bit offset if cell is smaller than a byte.
+  * @nbits:	Number of bits.
+  * @np:		Optional device_node pointer.
++ * @read_post_process:	Callback for optional post processing of cell data
++ *			on reads.
+  */
+ struct nvmem_cell_info {
+ 	const char		*name;
+@@ -62,6 +64,7 @@ struct nvmem_cell_info {
+ 	unsigned int		bit_offset;
+ 	unsigned int		nbits;
+ 	struct device_node	*np;
++	nvmem_cell_post_process_t read_post_process;
+ };
+ 
+ /**
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0006-nvmem-core-allow-to-modify-a-cell-before-adding-it.patch b/target/linux/generic/backport-6.1/811-v6.4-0006-nvmem-core-allow-to-modify-a-cell-before-adding-it.patch
new file mode 100644
index 00000000000000..32990148c806f9
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0006-nvmem-core-allow-to-modify-a-cell-before-adding-it.patch
@@ -0,0 +1,59 @@
+From de12c9691501ccba41a154c223869f82be4c12fd Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Tue, 4 Apr 2023 18:21:25 +0100
+Subject: [PATCH] nvmem: core: allow to modify a cell before adding it
+
+Provide a way to modify a cell before it will get added. This is useful
+to attach a custom post processing hook via a layout.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-18-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c           | 4 ++++
+ include/linux/nvmem-provider.h | 5 +++++
+ 2 files changed, 9 insertions(+)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -695,6 +695,7 @@ static int nvmem_validate_keepouts(struc
+ 
+ static int nvmem_add_cells_from_of(struct nvmem_device *nvmem)
+ {
++	struct nvmem_layout *layout = nvmem->layout;
+ 	struct device *dev = &nvmem->dev;
+ 	struct device_node *child;
+ 	const __be32 *addr;
+@@ -724,6 +725,9 @@ static int nvmem_add_cells_from_of(struc
+ 
+ 		info.np = of_node_get(child);
+ 
++		if (layout && layout->fixup_cell_info)
++			layout->fixup_cell_info(nvmem, layout, &info);
++
+ 		ret = nvmem_add_one_cell(nvmem, &info);
+ 		kfree(info.name);
+ 		if (ret) {
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -155,6 +155,8 @@ struct nvmem_cell_table {
+  * @add_cells:		Will be called if a nvmem device is found which
+  *			has this layout. The function will add layout
+  *			specific cells with nvmem_add_one_cell().
++ * @fixup_cell_info:	Will be called before a cell is added. Can be
++ *			used to modify the nvmem_cell_info.
+  * @owner:		Pointer to struct module.
+  * @node:		List node.
+  *
+@@ -168,6 +170,9 @@ struct nvmem_layout {
+ 	const struct of_device_id *of_match_table;
+ 	int (*add_cells)(struct device *dev, struct nvmem_device *nvmem,
+ 			 struct nvmem_layout *layout);
++	void (*fixup_cell_info)(struct nvmem_device *nvmem,
++				struct nvmem_layout *layout,
++				struct nvmem_cell_info *cell);
+ 
+ 	/* private */
+ 	struct module *owner;
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0007-nvmem-imx-ocotp-replace-global-post-processing-with-.patch b/target/linux/generic/backport-6.1/811-v6.4-0007-nvmem-imx-ocotp-replace-global-post-processing-with-.patch
new file mode 100644
index 00000000000000..2a5fa618ea6529
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0007-nvmem-imx-ocotp-replace-global-post-processing-with-.patch
@@ -0,0 +1,81 @@
+From 6c56a82d7895a213a43182a5d01a21a906a79847 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Tue, 4 Apr 2023 18:21:26 +0100
+Subject: [PATCH] nvmem: imx-ocotp: replace global post processing with layouts
+
+In preparation of retiring the global post processing hook change this
+driver to use layouts. The layout will be supplied during registration
+and will be used to add the post processing hook to all added cells.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Tested-by: Michael Walle <michael@walle.cc> # on kontron-pitx-imx8m
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-19-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/imx-ocotp.c | 30 +++++++++++++++++++-----------
+ 1 file changed, 19 insertions(+), 11 deletions(-)
+
+--- a/drivers/nvmem/imx-ocotp.c
++++ b/drivers/nvmem/imx-ocotp.c
+@@ -225,18 +225,13 @@ read_end:
+ static int imx_ocotp_cell_pp(void *context, const char *id, int index,
+ 			     unsigned int offset, void *data, size_t bytes)
+ {
+-	struct ocotp_priv *priv = context;
++	u8 *buf = data;
++	int i;
+ 
+ 	/* Deal with some post processing of nvmem cell data */
+-	if (id && !strcmp(id, "mac-address")) {
+-		if (priv->params->reverse_mac_address) {
+-			u8 *buf = data;
+-			int i;
+-
+-			for (i = 0; i < bytes/2; i++)
+-				swap(buf[i], buf[bytes - i - 1]);
+-		}
+-	}
++	if (id && !strcmp(id, "mac-address"))
++		for (i = 0; i < bytes / 2; i++)
++			swap(buf[i], buf[bytes - i - 1]);
+ 
+ 	return 0;
+ }
+@@ -488,7 +483,6 @@ static struct nvmem_config imx_ocotp_nvm
+ 	.stride = 1,
+ 	.reg_read = imx_ocotp_read,
+ 	.reg_write = imx_ocotp_write,
+-	.cell_post_process = imx_ocotp_cell_pp,
+ };
+ 
+ static const struct ocotp_params imx6q_params = {
+@@ -595,6 +589,17 @@ static const struct of_device_id imx_oco
+ };
+ MODULE_DEVICE_TABLE(of, imx_ocotp_dt_ids);
+ 
++static void imx_ocotp_fixup_cell_info(struct nvmem_device *nvmem,
++				      struct nvmem_layout *layout,
++				      struct nvmem_cell_info *cell)
++{
++	cell->read_post_process = imx_ocotp_cell_pp;
++}
++
++struct nvmem_layout imx_ocotp_layout = {
++	.fixup_cell_info = imx_ocotp_fixup_cell_info,
++};
++
+ static int imx_ocotp_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
+@@ -619,6 +624,9 @@ static int imx_ocotp_probe(struct platfo
+ 	imx_ocotp_nvmem_config.size = 4 * priv->params->nregs;
+ 	imx_ocotp_nvmem_config.dev = dev;
+ 	imx_ocotp_nvmem_config.priv = priv;
++	if (priv->params->reverse_mac_address)
++		imx_ocotp_nvmem_config.layout = &imx_ocotp_layout;
++
+ 	priv->config = &imx_ocotp_nvmem_config;
+ 
+ 	clk_prepare_enable(priv->clk);
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0008-nvmem-cell-drop-global-cell_post_process.patch b/target/linux/generic/backport-6.1/811-v6.4-0008-nvmem-cell-drop-global-cell_post_process.patch
new file mode 100644
index 00000000000000..eac202b8829841
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0008-nvmem-cell-drop-global-cell_post_process.patch
@@ -0,0 +1,68 @@
+From 011e40a166fdaa65fb9946b7cd91efec85b70dbb Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Tue, 4 Apr 2023 18:21:27 +0100
+Subject: [PATCH] nvmem: cell: drop global cell_post_process
+
+There are no users anymore for the global cell_post_process callback
+anymore. New users should use proper nvmem layouts.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-20-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c           | 9 ---------
+ include/linux/nvmem-provider.h | 2 --
+ 2 files changed, 11 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -39,7 +39,6 @@ struct nvmem_device {
+ 	unsigned int		nkeepout;
+ 	nvmem_reg_read_t	reg_read;
+ 	nvmem_reg_write_t	reg_write;
+-	nvmem_cell_post_process_t cell_post_process;
+ 	struct gpio_desc	*wp_gpio;
+ 	struct nvmem_layout	*layout;
+ 	void *priv;
+@@ -903,7 +902,6 @@ struct nvmem_device *nvmem_register(cons
+ 	nvmem->type = config->type;
+ 	nvmem->reg_read = config->reg_read;
+ 	nvmem->reg_write = config->reg_write;
+-	nvmem->cell_post_process = config->cell_post_process;
+ 	nvmem->keepout = config->keepout;
+ 	nvmem->nkeepout = config->nkeepout;
+ 	if (config->of_node)
+@@ -1575,13 +1573,6 @@ static int __nvmem_cell_read(struct nvme
+ 		if (rc)
+ 			return rc;
+ 	}
+-
+-	if (nvmem->cell_post_process) {
+-		rc = nvmem->cell_post_process(nvmem->priv, id, index,
+-					      cell->offset, buf, cell->bytes);
+-		if (rc)
+-			return rc;
+-	}
+ 
+ 	if (len)
+ 		*len = cell->bytes;
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -85,7 +85,6 @@ struct nvmem_cell_info {
+  * @no_of_node:	Device should not use the parent's of_node even if it's !NULL.
+  * @reg_read:	Callback to read data.
+  * @reg_write:	Callback to write data.
+- * @cell_post_process:	Callback for vendor specific post processing of cell data
+  * @size:	Device size.
+  * @word_size:	Minimum read/write access granularity.
+  * @stride:	Minimum read/write access stride.
+@@ -118,7 +117,6 @@ struct nvmem_config {
+ 	bool			no_of_node;
+ 	nvmem_reg_read_t	reg_read;
+ 	nvmem_reg_write_t	reg_write;
+-	nvmem_cell_post_process_t cell_post_process;
+ 	int	size;
+ 	int	word_size;
+ 	int	stride;
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0009-nvmem-core-provide-own-priv-pointer-in-post-process-.patch b/target/linux/generic/backport-6.1/811-v6.4-0009-nvmem-core-provide-own-priv-pointer-in-post-process-.patch
new file mode 100644
index 00000000000000..46b30a2ed90417
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0009-nvmem-core-provide-own-priv-pointer-in-post-process-.patch
@@ -0,0 +1,76 @@
+From 8a134fd9f9323f4c39ec27055b3d3723cfb5c1e9 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Tue, 4 Apr 2023 18:21:28 +0100
+Subject: [PATCH] nvmem: core: provide own priv pointer in post process
+ callback
+
+It doesn't make any more sense to have a opaque pointer set up by the
+nvmem device. Usually, the layout isn't associated with a particular
+nvmem device. Instead, let the caller who set the post process callback
+provide the priv pointer.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-21-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c           | 4 +++-
+ include/linux/nvmem-provider.h | 5 ++++-
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -54,6 +54,7 @@ struct nvmem_cell_entry {
+ 	int			bit_offset;
+ 	int			nbits;
+ 	nvmem_cell_post_process_t read_post_process;
++	void			*priv;
+ 	struct device_node	*np;
+ 	struct nvmem_device	*nvmem;
+ 	struct list_head	node;
+@@ -471,6 +472,7 @@ static int nvmem_cell_info_to_nvmem_cell
+ 	cell->bytes = info->bytes;
+ 	cell->name = info->name;
+ 	cell->read_post_process = info->read_post_process;
++	cell->priv = info->priv;
+ 
+ 	cell->bit_offset = info->bit_offset;
+ 	cell->nbits = info->nbits;
+@@ -1568,7 +1570,7 @@ static int __nvmem_cell_read(struct nvme
+ 		nvmem_shift_read_buffer_in_place(cell, buf);
+ 
+ 	if (cell->read_post_process) {
+-		rc = cell->read_post_process(nvmem->priv, id, index,
++		rc = cell->read_post_process(cell->priv, id, index,
+ 					     cell->offset, buf, cell->bytes);
+ 		if (rc)
+ 			return rc;
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -20,7 +20,8 @@ typedef int (*nvmem_reg_write_t)(void *p
+ 				 void *val, size_t bytes);
+ /* used for vendor specific post processing of cell data */
+ typedef int (*nvmem_cell_post_process_t)(void *priv, const char *id, int index,
+-					 unsigned int offset, void *buf, size_t bytes);
++					 unsigned int offset, void *buf,
++					 size_t bytes);
+ 
+ enum nvmem_type {
+ 	NVMEM_TYPE_UNKNOWN = 0,
+@@ -56,6 +57,7 @@ struct nvmem_keepout {
+  * @np:		Optional device_node pointer.
+  * @read_post_process:	Callback for optional post processing of cell data
+  *			on reads.
++ * @priv:	Opaque data passed to the read_post_process hook.
+  */
+ struct nvmem_cell_info {
+ 	const char		*name;
+@@ -65,6 +67,7 @@ struct nvmem_cell_info {
+ 	unsigned int		nbits;
+ 	struct device_node	*np;
+ 	nvmem_cell_post_process_t read_post_process;
++	void			*priv;
+ };
+ 
+ /**
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0010-nvmem-layouts-sl28vpd-Add-new-layout-driver.patch b/target/linux/generic/backport-6.1/811-v6.4-0010-nvmem-layouts-sl28vpd-Add-new-layout-driver.patch
new file mode 100644
index 00000000000000..7d97658b60e289
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0010-nvmem-layouts-sl28vpd-Add-new-layout-driver.patch
@@ -0,0 +1,215 @@
+From d9fae023fe86069750092fc1c2f3a73e2fb18512 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Tue, 4 Apr 2023 18:21:29 +0100
+Subject: [PATCH] nvmem: layouts: sl28vpd: Add new layout driver
+
+This layout applies to the VPD of the Kontron sl28 boards. The VPD only
+contains a base MAC address. Therefore, we have to add an individual
+offset to it. This is done by taking the second argument of the nvmem
+phandle into account. Also this let us checking the VPD version and the
+checksum.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-22-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/layouts/Kconfig   |   9 ++
+ drivers/nvmem/layouts/Makefile  |   2 +
+ drivers/nvmem/layouts/sl28vpd.c | 165 ++++++++++++++++++++++++++++++++
+ 3 files changed, 176 insertions(+)
+ create mode 100644 drivers/nvmem/layouts/sl28vpd.c
+
+--- a/drivers/nvmem/layouts/Kconfig
++++ b/drivers/nvmem/layouts/Kconfig
+@@ -2,4 +2,13 @@
+ 
+ menu "Layout Types"
+ 
++config NVMEM_LAYOUT_SL28_VPD
++	tristate "Kontron sl28 VPD layout support"
++	select CRC8
++	help
++	  Say Y here if you want to support the VPD layout of the Kontron
++	  SMARC-sAL28 boards.
++
++	  If unsure, say N.
++
+ endmenu
+--- a/drivers/nvmem/layouts/Makefile
++++ b/drivers/nvmem/layouts/Makefile
+@@ -2,3 +2,5 @@
+ #
+ # Makefile for nvmem layouts.
+ #
++
++obj-$(CONFIG_NVMEM_LAYOUT_SL28_VPD) += sl28vpd.o
+--- /dev/null
++++ b/drivers/nvmem/layouts/sl28vpd.c
+@@ -0,0 +1,165 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <linux/crc8.h>
++#include <linux/etherdevice.h>
++#include <linux/nvmem-consumer.h>
++#include <linux/nvmem-provider.h>
++#include <linux/of.h>
++#include <uapi/linux/if_ether.h>
++
++#define SL28VPD_MAGIC 'V'
++
++struct sl28vpd_header {
++	u8 magic;
++	u8 version;
++} __packed;
++
++struct sl28vpd_v1 {
++	struct sl28vpd_header header;
++	char serial_number[15];
++	u8 base_mac_address[ETH_ALEN];
++	u8 crc8;
++} __packed;
++
++static int sl28vpd_mac_address_pp(void *priv, const char *id, int index,
++				  unsigned int offset, void *buf,
++				  size_t bytes)
++{
++	if (bytes != ETH_ALEN)
++		return -EINVAL;
++
++	if (index < 0)
++		return -EINVAL;
++
++	if (!is_valid_ether_addr(buf))
++		return -EINVAL;
++
++	eth_addr_add(buf, index);
++
++	return 0;
++}
++
++static const struct nvmem_cell_info sl28vpd_v1_entries[] = {
++	{
++		.name = "serial-number",
++		.offset = offsetof(struct sl28vpd_v1, serial_number),
++		.bytes = sizeof_field(struct sl28vpd_v1, serial_number),
++	},
++	{
++		.name = "base-mac-address",
++		.offset = offsetof(struct sl28vpd_v1, base_mac_address),
++		.bytes = sizeof_field(struct sl28vpd_v1, base_mac_address),
++		.read_post_process = sl28vpd_mac_address_pp,
++	},
++};
++
++static int sl28vpd_v1_check_crc(struct device *dev, struct nvmem_device *nvmem)
++{
++	struct sl28vpd_v1 data_v1;
++	u8 table[CRC8_TABLE_SIZE];
++	int ret;
++	u8 crc;
++
++	crc8_populate_msb(table, 0x07);
++
++	ret = nvmem_device_read(nvmem, 0, sizeof(data_v1), &data_v1);
++	if (ret < 0)
++		return ret;
++	else if (ret != sizeof(data_v1))
++		return -EIO;
++
++	crc = crc8(table, (void *)&data_v1, sizeof(data_v1) - 1, 0);
++
++	if (crc != data_v1.crc8) {
++		dev_err(dev,
++			"Checksum is invalid (got %02x, expected %02x).\n",
++			crc, data_v1.crc8);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static int sl28vpd_add_cells(struct device *dev, struct nvmem_device *nvmem,
++			     struct nvmem_layout *layout)
++{
++	const struct nvmem_cell_info *pinfo;
++	struct nvmem_cell_info info = {0};
++	struct device_node *layout_np;
++	struct sl28vpd_header hdr;
++	int ret, i;
++
++	/* check header */
++	ret = nvmem_device_read(nvmem, 0, sizeof(hdr), &hdr);
++	if (ret < 0)
++		return ret;
++	else if (ret != sizeof(hdr))
++		return -EIO;
++
++	if (hdr.magic != SL28VPD_MAGIC) {
++		dev_err(dev, "Invalid magic value (%02x)\n", hdr.magic);
++		return -EINVAL;
++	}
++
++	if (hdr.version != 1) {
++		dev_err(dev, "Version %d is unsupported.\n", hdr.version);
++		return -EINVAL;
++	}
++
++	ret = sl28vpd_v1_check_crc(dev, nvmem);
++	if (ret)
++		return ret;
++
++	layout_np = of_nvmem_layout_get_container(nvmem);
++	if (!layout_np)
++		return -ENOENT;
++
++	for (i = 0; i < ARRAY_SIZE(sl28vpd_v1_entries); i++) {
++		pinfo = &sl28vpd_v1_entries[i];
++
++		info.name = pinfo->name;
++		info.offset = pinfo->offset;
++		info.bytes = pinfo->bytes;
++		info.read_post_process = pinfo->read_post_process;
++		info.np = of_get_child_by_name(layout_np, pinfo->name);
++
++		ret = nvmem_add_one_cell(nvmem, &info);
++		if (ret) {
++			of_node_put(layout_np);
++			return ret;
++		}
++	}
++
++	of_node_put(layout_np);
++
++	return 0;
++}
++
++static const struct of_device_id sl28vpd_of_match_table[] = {
++	{ .compatible = "kontron,sl28-vpd" },
++	{},
++};
++MODULE_DEVICE_TABLE(of, sl28vpd_of_match_table);
++
++struct nvmem_layout sl28vpd_layout = {
++	.name = "sl28-vpd",
++	.of_match_table = sl28vpd_of_match_table,
++	.add_cells = sl28vpd_add_cells,
++};
++
++static int __init sl28vpd_init(void)
++{
++	return nvmem_layout_register(&sl28vpd_layout);
++}
++
++static void __exit sl28vpd_exit(void)
++{
++	nvmem_layout_unregister(&sl28vpd_layout);
++}
++
++module_init(sl28vpd_init);
++module_exit(sl28vpd_exit);
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Michael Walle <michael@walle.cc>");
++MODULE_DESCRIPTION("NVMEM layout driver for the VPD of Kontron sl28 boards");
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0011-nvmem-layouts-onie-tlv-Add-new-layout-driver.patch b/target/linux/generic/backport-6.1/811-v6.4-0011-nvmem-layouts-onie-tlv-Add-new-layout-driver.patch
new file mode 100644
index 00000000000000..ca8b4bc069146b
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0011-nvmem-layouts-onie-tlv-Add-new-layout-driver.patch
@@ -0,0 +1,306 @@
+From d3c0d12f6474216bf386101e2449cc73e5c5b61d Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:31 +0100
+Subject: [PATCH] nvmem: layouts: onie-tlv: Add new layout driver
+
+This layout applies on top of any non volatile storage device containing
+an ONIE table factory flashed. This table follows the tlv
+(type-length-value) organization described in the link below. We cannot
+afford using regular parsers because the content of these tables is
+manufacturer specific and must be dynamically discovered.
+
+Link: https://opencomputeproject.github.io/onie/design-spec/hw_requirements.html
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-24-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/layouts/Kconfig    |   9 ++
+ drivers/nvmem/layouts/Makefile   |   1 +
+ drivers/nvmem/layouts/onie-tlv.c | 257 +++++++++++++++++++++++++++++++
+ 3 files changed, 267 insertions(+)
+ create mode 100644 drivers/nvmem/layouts/onie-tlv.c
+
+--- a/drivers/nvmem/layouts/Kconfig
++++ b/drivers/nvmem/layouts/Kconfig
+@@ -11,4 +11,13 @@ config NVMEM_LAYOUT_SL28_VPD
+ 
+ 	  If unsure, say N.
+ 
++config NVMEM_LAYOUT_ONIE_TLV
++	tristate "ONIE tlv support"
++	select CRC32
++	help
++	  Say Y here if you want to support the Open Compute Project ONIE
++	  Type-Length-Value standard table.
++
++	  If unsure, say N.
++
+ endmenu
+--- a/drivers/nvmem/layouts/Makefile
++++ b/drivers/nvmem/layouts/Makefile
+@@ -4,3 +4,4 @@
+ #
+ 
+ obj-$(CONFIG_NVMEM_LAYOUT_SL28_VPD) += sl28vpd.o
++obj-$(CONFIG_NVMEM_LAYOUT_ONIE_TLV) += onie-tlv.o
+--- /dev/null
++++ b/drivers/nvmem/layouts/onie-tlv.c
+@@ -0,0 +1,257 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * ONIE tlv NVMEM cells provider
++ *
++ * Copyright (C) 2022 Open Compute Group ONIE
++ * Author: Miquel Raynal <miquel.raynal@bootlin.com>
++ * Based on the nvmem driver written by: Vadym Kochan <vadym.kochan@plvision.eu>
++ * Inspired by the first layout written by: Rafał Miłecki <rafal@milecki.pl>
++ */
++
++#include <linux/crc32.h>
++#include <linux/etherdevice.h>
++#include <linux/nvmem-consumer.h>
++#include <linux/nvmem-provider.h>
++#include <linux/of.h>
++
++#define ONIE_TLV_MAX_LEN 2048
++#define ONIE_TLV_CRC_FIELD_SZ 6
++#define ONIE_TLV_CRC_SZ 4
++#define ONIE_TLV_HDR_ID	"TlvInfo"
++
++struct onie_tlv_hdr {
++	u8 id[8];
++	u8 version;
++	__be16 data_len;
++} __packed;
++
++struct onie_tlv {
++	u8 type;
++	u8 len;
++} __packed;
++
++static const char *onie_tlv_cell_name(u8 type)
++{
++	switch (type) {
++	case 0x21:
++		return "product-name";
++	case 0x22:
++		return "part-number";
++	case 0x23:
++		return "serial-number";
++	case 0x24:
++		return "mac-address";
++	case 0x25:
++		return "manufacture-date";
++	case 0x26:
++		return "device-version";
++	case 0x27:
++		return "label-revision";
++	case 0x28:
++		return "platform-name";
++	case 0x29:
++		return "onie-version";
++	case 0x2A:
++		return "num-macs";
++	case 0x2B:
++		return "manufacturer";
++	case 0x2C:
++		return "country-code";
++	case 0x2D:
++		return "vendor";
++	case 0x2E:
++		return "diag-version";
++	case 0x2F:
++		return "service-tag";
++	case 0xFD:
++		return "vendor-extension";
++	case 0xFE:
++		return "crc32";
++	default:
++		break;
++	}
++
++	return NULL;
++}
++
++static int onie_tlv_mac_read_cb(void *priv, const char *id, int index,
++				unsigned int offset, void *buf,
++				size_t bytes)
++{
++	eth_addr_add(buf, index);
++
++	return 0;
++}
++
++static nvmem_cell_post_process_t onie_tlv_read_cb(u8 type, u8 *buf)
++{
++	switch (type) {
++	case 0x24:
++		return &onie_tlv_mac_read_cb;
++	default:
++		break;
++	}
++
++	return NULL;
++}
++
++static int onie_tlv_add_cells(struct device *dev, struct nvmem_device *nvmem,
++			      size_t data_len, u8 *data)
++{
++	struct nvmem_cell_info cell = {};
++	struct device_node *layout;
++	struct onie_tlv tlv;
++	unsigned int hdr_len = sizeof(struct onie_tlv_hdr);
++	unsigned int offset = 0;
++	int ret;
++
++	layout = of_nvmem_layout_get_container(nvmem);
++	if (!layout)
++		return -ENOENT;
++
++	while (offset < data_len) {
++		memcpy(&tlv, data + offset, sizeof(tlv));
++		if (offset + tlv.len >= data_len) {
++			dev_err(dev, "Out of bounds field (0x%x bytes at 0x%x)\n",
++				tlv.len, hdr_len + offset);
++			break;
++		}
++
++		cell.name = onie_tlv_cell_name(tlv.type);
++		if (!cell.name)
++			continue;
++
++		cell.offset = hdr_len + offset + sizeof(tlv.type) + sizeof(tlv.len);
++		cell.bytes = tlv.len;
++		cell.np = of_get_child_by_name(layout, cell.name);
++		cell.read_post_process = onie_tlv_read_cb(tlv.type, data + offset + sizeof(tlv));
++
++		ret = nvmem_add_one_cell(nvmem, &cell);
++		if (ret) {
++			of_node_put(layout);
++			return ret;
++		}
++
++		offset += sizeof(tlv) + tlv.len;
++	}
++
++	of_node_put(layout);
++
++	return 0;
++}
++
++static bool onie_tlv_hdr_is_valid(struct device *dev, struct onie_tlv_hdr *hdr)
++{
++	if (memcmp(hdr->id, ONIE_TLV_HDR_ID, sizeof(hdr->id))) {
++		dev_err(dev, "Invalid header\n");
++		return false;
++	}
++
++	if (hdr->version != 0x1) {
++		dev_err(dev, "Invalid version number\n");
++		return false;
++	}
++
++	return true;
++}
++
++static bool onie_tlv_crc_is_valid(struct device *dev, size_t table_len, u8 *table)
++{
++	struct onie_tlv crc_hdr;
++	u32 read_crc, calc_crc;
++	__be32 crc_be;
++
++	memcpy(&crc_hdr, table + table_len - ONIE_TLV_CRC_FIELD_SZ, sizeof(crc_hdr));
++	if (crc_hdr.type != 0xfe || crc_hdr.len != ONIE_TLV_CRC_SZ) {
++		dev_err(dev, "Invalid CRC field\n");
++		return false;
++	}
++
++	/* The table contains a JAMCRC, which is XOR'ed compared to the original
++	 * CRC32 implementation as known in the Ethernet world.
++	 */
++	memcpy(&crc_be, table + table_len - ONIE_TLV_CRC_SZ, ONIE_TLV_CRC_SZ);
++	read_crc = be32_to_cpu(crc_be);
++	calc_crc = crc32(~0, table, table_len - ONIE_TLV_CRC_SZ) ^ 0xFFFFFFFF;
++	if (read_crc != calc_crc) {
++		dev_err(dev, "Invalid CRC read: 0x%08x, expected: 0x%08x\n",
++			read_crc, calc_crc);
++		return false;
++	}
++
++	return true;
++}
++
++static int onie_tlv_parse_table(struct device *dev, struct nvmem_device *nvmem,
++				struct nvmem_layout *layout)
++{
++	struct onie_tlv_hdr hdr;
++	size_t table_len, data_len, hdr_len;
++	u8 *table, *data;
++	int ret;
++
++	ret = nvmem_device_read(nvmem, 0, sizeof(hdr), &hdr);
++	if (ret < 0)
++		return ret;
++
++	if (!onie_tlv_hdr_is_valid(dev, &hdr)) {
++		dev_err(dev, "Invalid ONIE TLV header\n");
++		return -EINVAL;
++	}
++
++	hdr_len = sizeof(hdr.id) + sizeof(hdr.version) + sizeof(hdr.data_len);
++	data_len = be16_to_cpu(hdr.data_len);
++	table_len = hdr_len + data_len;
++	if (table_len > ONIE_TLV_MAX_LEN) {
++		dev_err(dev, "Invalid ONIE TLV data length\n");
++		return -EINVAL;
++	}
++
++	table = devm_kmalloc(dev, table_len, GFP_KERNEL);
++	if (!table)
++		return -ENOMEM;
++
++	ret = nvmem_device_read(nvmem, 0, table_len, table);
++	if (ret != table_len)
++		return ret;
++
++	if (!onie_tlv_crc_is_valid(dev, table_len, table))
++		return -EINVAL;
++
++	data = table + hdr_len;
++	ret = onie_tlv_add_cells(dev, nvmem, data_len, data);
++	if (ret)
++		return ret;
++
++	return 0;
++}
++
++static const struct of_device_id onie_tlv_of_match_table[] = {
++	{ .compatible = "onie,tlv-layout", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, onie_tlv_of_match_table);
++
++static struct nvmem_layout onie_tlv_layout = {
++	.name = "ONIE tlv layout",
++	.of_match_table = onie_tlv_of_match_table,
++	.add_cells = onie_tlv_parse_table,
++};
++
++static int __init onie_tlv_init(void)
++{
++	return nvmem_layout_register(&onie_tlv_layout);
++}
++
++static void __exit onie_tlv_exit(void)
++{
++	nvmem_layout_unregister(&onie_tlv_layout);
++}
++
++module_init(onie_tlv_init);
++module_exit(onie_tlv_exit);
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Miquel Raynal <miquel.raynal@bootlin.com>");
++MODULE_DESCRIPTION("NVMEM layout driver for Onie TLV table parsing");
++MODULE_ALIAS("NVMEM layout driver for Onie TLV table parsing");
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0012-nvmem-stm32-romem-mark-OF-related-data-as-maybe-unus.patch b/target/linux/generic/backport-6.1/811-v6.4-0012-nvmem-stm32-romem-mark-OF-related-data-as-maybe-unus.patch
new file mode 100644
index 00000000000000..94a0911d73cc76
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0012-nvmem-stm32-romem-mark-OF-related-data-as-maybe-unus.patch
@@ -0,0 +1,32 @@
+From a4fb434ef96ace5af758ca2c52c3a3f8f3abc87c Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Tue, 4 Apr 2023 18:21:34 +0100
+Subject: [PATCH] nvmem: stm32-romem: mark OF related data as maybe unused
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The driver can be compile tested with !CONFIG_OF making certain data
+unused:
+
+  drivers/nvmem/stm32-romem.c:271:34: error: ‘stm32_romem_of_match’ defined but not used [-Werror=unused-const-variable=]
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-27-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/stm32-romem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/stm32-romem.c
++++ b/drivers/nvmem/stm32-romem.c
+@@ -268,7 +268,7 @@ static const struct stm32_romem_cfg stm3
+ 	.ta = true,
+ };
+ 
+-static const struct of_device_id stm32_romem_of_match[] = {
++static const struct of_device_id stm32_romem_of_match[] __maybe_unused = {
+ 	{ .compatible = "st,stm32f4-otp", }, {
+ 		.compatible = "st,stm32mp15-bsec",
+ 		.data = (void *)&stm32mp15_bsec_cfg,
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0013-nvmem-mtk-efuse-Support-postprocessing-for-GPU-speed.patch b/target/linux/generic/backport-6.1/811-v6.4-0013-nvmem-mtk-efuse-Support-postprocessing-for-GPU-speed.patch
new file mode 100644
index 00000000000000..abda402bddb07a
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0013-nvmem-mtk-efuse-Support-postprocessing-for-GPU-speed.patch
@@ -0,0 +1,120 @@
+From de6e05097f7db066afb0ad4c88b730949f7b7749 Mon Sep 17 00:00:00 2001
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Date: Tue, 4 Apr 2023 18:21:35 +0100
+Subject: [PATCH] nvmem: mtk-efuse: Support postprocessing for GPU speed
+ binning data
+
+On some MediaTek SoCs GPU speed binning data is available for read
+in the SoC's eFuse array but it has a format that is incompatible
+with what the OPP API expects, as we read a number from 0 to 7 but
+opp-supported-hw is expecting a bitmask to enable an OPP entry:
+being what we read limited to 0-7, it's straightforward to simply
+convert the value to BIT(value) as a post-processing action.
+
+So, introduce post-processing support and enable it by evaluating
+the newly introduced platform data's `uses_post_processing` member,
+currently enabled only for MT8186.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-28-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/mtk-efuse.c | 53 +++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 51 insertions(+), 2 deletions(-)
+
+--- a/drivers/nvmem/mtk-efuse.c
++++ b/drivers/nvmem/mtk-efuse.c
+@@ -10,6 +10,11 @@
+ #include <linux/io.h>
+ #include <linux/nvmem-provider.h>
+ #include <linux/platform_device.h>
++#include <linux/property.h>
++
++struct mtk_efuse_pdata {
++	bool uses_post_processing;
++};
+ 
+ struct mtk_efuse_priv {
+ 	void __iomem *base;
+@@ -29,6 +34,37 @@ static int mtk_reg_read(void *context,
+ 	return 0;
+ }
+ 
++static int mtk_efuse_gpu_speedbin_pp(void *context, const char *id, int index,
++				     unsigned int offset, void *data, size_t bytes)
++{
++	u8 *val = data;
++
++	if (val[0] < 8)
++		val[0] = BIT(val[0]);
++
++	return 0;
++}
++
++static void mtk_efuse_fixup_cell_info(struct nvmem_device *nvmem,
++				      struct nvmem_layout *layout,
++				      struct nvmem_cell_info *cell)
++{
++	size_t sz = strlen(cell->name);
++
++	/*
++	 * On some SoCs, the GPU speedbin is not read as bitmask but as
++	 * a number with range [0-7] (max 3 bits): post process to use
++	 * it in OPP tables to describe supported-hw.
++	 */
++	if (cell->nbits <= 3 &&
++	    strncmp(cell->name, "gpu-speedbin", min(sz, strlen("gpu-speedbin"))) == 0)
++		cell->read_post_process = mtk_efuse_gpu_speedbin_pp;
++}
++
++static struct nvmem_layout mtk_efuse_layout = {
++	.fixup_cell_info = mtk_efuse_fixup_cell_info,
++};
++
+ static int mtk_efuse_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
+@@ -36,6 +72,7 @@ static int mtk_efuse_probe(struct platfo
+ 	struct nvmem_device *nvmem;
+ 	struct nvmem_config econfig = {};
+ 	struct mtk_efuse_priv *priv;
++	const struct mtk_efuse_pdata *pdata;
+ 
+ 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+ 	if (!priv)
+@@ -45,20 +82,32 @@ static int mtk_efuse_probe(struct platfo
+ 	if (IS_ERR(priv->base))
+ 		return PTR_ERR(priv->base);
+ 
++	pdata = device_get_match_data(dev);
+ 	econfig.stride = 1;
+ 	econfig.word_size = 1;
+ 	econfig.reg_read = mtk_reg_read;
+ 	econfig.size = resource_size(res);
+ 	econfig.priv = priv;
+ 	econfig.dev = dev;
++	if (pdata->uses_post_processing)
++		econfig.layout = &mtk_efuse_layout;
+ 	nvmem = devm_nvmem_register(dev, &econfig);
+ 
+ 	return PTR_ERR_OR_ZERO(nvmem);
+ }
+ 
++static const struct mtk_efuse_pdata mtk_mt8186_efuse_pdata = {
++	.uses_post_processing = true,
++};
++
++static const struct mtk_efuse_pdata mtk_efuse_pdata = {
++	.uses_post_processing = false,
++};
++
+ static const struct of_device_id mtk_efuse_of_match[] = {
+-	{ .compatible = "mediatek,mt8173-efuse",},
+-	{ .compatible = "mediatek,efuse",},
++	{ .compatible = "mediatek,mt8173-efuse", .data = &mtk_efuse_pdata },
++	{ .compatible = "mediatek,mt8186-efuse", .data = &mtk_mt8186_efuse_pdata },
++	{ .compatible = "mediatek,efuse", .data = &mtk_efuse_pdata },
+ 	{/* sentinel */},
+ };
+ MODULE_DEVICE_TABLE(of, mtk_efuse_of_match);
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0014-nvmem-bcm-ocotp-Use-devm_platform_ioremap_resource.patch b/target/linux/generic/backport-6.1/811-v6.4-0014-nvmem-bcm-ocotp-Use-devm_platform_ioremap_resource.patch
new file mode 100644
index 00000000000000..200eb1928f8c4a
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0014-nvmem-bcm-ocotp-Use-devm_platform_ioremap_resource.patch
@@ -0,0 +1,39 @@
+From 1dc552fa33cf98af3e784dbc0500da93cae3b24a Mon Sep 17 00:00:00 2001
+From: Yang Li <yang.lee@linux.alibaba.com>
+Date: Tue, 4 Apr 2023 18:21:38 +0100
+Subject: [PATCH] nvmem: bcm-ocotp: Use devm_platform_ioremap_resource()
+
+According to commit 7945f929f1a7 ("drivers: provide
+devm_platform_ioremap_resource()"), convert platform_get_resource(),
+devm_ioremap_resource() to a single call to use
+devm_platform_ioremap_resource(), as this is exactly what this function
+does.
+
+Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-31-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/bcm-ocotp.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/nvmem/bcm-ocotp.c
++++ b/drivers/nvmem/bcm-ocotp.c
+@@ -244,7 +244,6 @@ MODULE_DEVICE_TABLE(acpi, bcm_otpc_acpi_
+ static int bcm_otpc_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
+-	struct resource *res;
+ 	struct otpc_priv *priv;
+ 	struct nvmem_device *nvmem;
+ 	int err;
+@@ -259,8 +258,7 @@ static int bcm_otpc_probe(struct platfor
+ 		return -ENODEV;
+ 
+ 	/* Get OTP base address register. */
+-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	priv->base = devm_ioremap_resource(dev, res);
++	priv->base = devm_platform_ioremap_resource(pdev, 0);
+ 	if (IS_ERR(priv->base)) {
+ 		dev_err(dev, "unable to map I/O memory\n");
+ 		return PTR_ERR(priv->base);
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0015-nvmem-nintendo-otp-Use-devm_platform_ioremap_resourc.patch b/target/linux/generic/backport-6.1/811-v6.4-0015-nvmem-nintendo-otp-Use-devm_platform_ioremap_resourc.patch
new file mode 100644
index 00000000000000..890dacd08dbef8
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0015-nvmem-nintendo-otp-Use-devm_platform_ioremap_resourc.patch
@@ -0,0 +1,39 @@
+From 649409990d2e93fac657be7c6960c28a2c601d65 Mon Sep 17 00:00:00 2001
+From: Yang Li <yang.lee@linux.alibaba.com>
+Date: Tue, 4 Apr 2023 18:21:39 +0100
+Subject: [PATCH] nvmem: nintendo-otp: Use devm_platform_ioremap_resource()
+
+According to commit 7945f929f1a7 ("drivers: provide
+devm_platform_ioremap_resource()"), convert platform_get_resource(),
+devm_ioremap_resource() to a single call to use
+devm_platform_ioremap_resource(), as this is exactly what this function
+does.
+
+Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-32-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/nintendo-otp.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/nvmem/nintendo-otp.c
++++ b/drivers/nvmem/nintendo-otp.c
+@@ -76,7 +76,6 @@ static int nintendo_otp_probe(struct pla
+ 	struct device *dev = &pdev->dev;
+ 	const struct of_device_id *of_id =
+ 		of_match_device(nintendo_otp_of_table, dev);
+-	struct resource *res;
+ 	struct nvmem_device *nvmem;
+ 	struct nintendo_otp_priv *priv;
+ 
+@@ -92,8 +91,7 @@ static int nintendo_otp_probe(struct pla
+ 	if (!priv)
+ 		return -ENOMEM;
+ 
+-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	priv->regs = devm_ioremap_resource(dev, res);
++	priv->regs = devm_platform_ioremap_resource(pdev, 0);
+ 	if (IS_ERR(priv->regs))
+ 		return PTR_ERR(priv->regs);
+ 
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0016-nvmem-vf610-ocotp-Use-devm_platform_get_and_ioremap_.patch b/target/linux/generic/backport-6.1/811-v6.4-0016-nvmem-vf610-ocotp-Use-devm_platform_get_and_ioremap_.patch
new file mode 100644
index 00000000000000..3f5d3c1ad4c121
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0016-nvmem-vf610-ocotp-Use-devm_platform_get_and_ioremap_.patch
@@ -0,0 +1,32 @@
+From c2367aa60d5e34d48582362c6de34b4131d92be7 Mon Sep 17 00:00:00 2001
+From: Yang Li <yang.lee@linux.alibaba.com>
+Date: Tue, 4 Apr 2023 18:21:40 +0100
+Subject: [PATCH] nvmem: vf610-ocotp: Use
+ devm_platform_get_and_ioremap_resource()
+
+According to commit 890cc39a8799 ("drivers: provide
+devm_platform_get_and_ioremap_resource()"), convert
+platform_get_resource(), devm_ioremap_resource() to a single
+call to devm_platform_get_and_ioremap_resource(), as this is exactly
+what this function does.
+
+Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-33-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/vf610-ocotp.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/nvmem/vf610-ocotp.c
++++ b/drivers/nvmem/vf610-ocotp.c
+@@ -219,8 +219,7 @@ static int vf610_ocotp_probe(struct plat
+ 	if (!ocotp_dev)
+ 		return -ENOMEM;
+ 
+-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	ocotp_dev->base = devm_ioremap_resource(dev, res);
++	ocotp_dev->base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
+ 	if (IS_ERR(ocotp_dev->base))
+ 		return PTR_ERR(ocotp_dev->base);
+ 
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0017-nvmem-core-support-specifying-both-cell-raw-data-pos.patch b/target/linux/generic/backport-6.1/811-v6.4-0017-nvmem-core-support-specifying-both-cell-raw-data-pos.patch
new file mode 100644
index 00000000000000..eeb407e9bb664c
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0017-nvmem-core-support-specifying-both-cell-raw-data-pos.patch
@@ -0,0 +1,115 @@
+From 55d4980ce55b6bb4be66877de4dbec513911b988 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 4 Apr 2023 18:21:42 +0100
+Subject: [PATCH] nvmem: core: support specifying both: cell raw data & post
+ read lengths
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Callback .read_post_process() is designed to modify raw cell content
+before providing it to the consumer. So far we were dealing with
+modifications that didn't affect cell size (length). In some cases
+however cell content needs to be reformatted and resized.
+
+It's required e.g. to provide properly formatted MAC address in case
+it's stored in a non-binary format (e.g. using ASCII).
+
+There were few discussions how to optimally handle that. Following
+possible solutions were considered:
+1. Allow .read_post_process() to realloc (resize) content buffer
+2. Allow .read_post_process() to adjust (decrease) just buffer length
+3. Register NVMEM cells using post-read sizes
+
+The preferred solution was the last one. The problem is that simply
+adjusting "bytes" in NVMEM providers would result in core code NOT
+passing whole raw data to .read_post_process() callbacks. It means
+callback functions couldn't do their job without somehow manually
+reading original cell content on their own.
+
+This patch deals with that by registering NVMEM cells with both lengths:
+raw content one and post read one. It allows:
+1. Core code to read whole raw cell content
+2. Callbacks to return content they want
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-35-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c           | 11 +++++++----
+ include/linux/nvmem-provider.h |  2 ++
+ 2 files changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -50,6 +50,7 @@ struct nvmem_device {
+ struct nvmem_cell_entry {
+ 	const char		*name;
+ 	int			offset;
++	size_t			raw_len;
+ 	int			bytes;
+ 	int			bit_offset;
+ 	int			nbits;
+@@ -469,6 +470,7 @@ static int nvmem_cell_info_to_nvmem_cell
+ {
+ 	cell->nvmem = nvmem;
+ 	cell->offset = info->offset;
++	cell->raw_len = info->raw_len ?: info->bytes;
+ 	cell->bytes = info->bytes;
+ 	cell->name = info->name;
+ 	cell->read_post_process = info->read_post_process;
+@@ -1560,7 +1562,7 @@ static int __nvmem_cell_read(struct nvme
+ {
+ 	int rc;
+ 
+-	rc = nvmem_reg_read(nvmem, cell->offset, buf, cell->bytes);
++	rc = nvmem_reg_read(nvmem, cell->offset, buf, cell->raw_len);
+ 
+ 	if (rc)
+ 		return rc;
+@@ -1571,7 +1573,7 @@ static int __nvmem_cell_read(struct nvme
+ 
+ 	if (cell->read_post_process) {
+ 		rc = cell->read_post_process(cell->priv, id, index,
+-					     cell->offset, buf, cell->bytes);
++					     cell->offset, buf, cell->raw_len);
+ 		if (rc)
+ 			return rc;
+ 	}
+@@ -1594,14 +1596,15 @@ static int __nvmem_cell_read(struct nvme
+  */
+ void *nvmem_cell_read(struct nvmem_cell *cell, size_t *len)
+ {
+-	struct nvmem_device *nvmem = cell->entry->nvmem;
++	struct nvmem_cell_entry *entry = cell->entry;
++	struct nvmem_device *nvmem = entry->nvmem;
+ 	u8 *buf;
+ 	int rc;
+ 
+ 	if (!nvmem)
+ 		return ERR_PTR(-EINVAL);
+ 
+-	buf = kzalloc(cell->entry->bytes, GFP_KERNEL);
++	buf = kzalloc(max_t(size_t, entry->raw_len, entry->bytes), GFP_KERNEL);
+ 	if (!buf)
+ 		return ERR_PTR(-ENOMEM);
+ 
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -51,6 +51,7 @@ struct nvmem_keepout {
+  * struct nvmem_cell_info - NVMEM cell description
+  * @name:	Name.
+  * @offset:	Offset within the NVMEM device.
++ * @raw_len:	Length of raw data (without post processing).
+  * @bytes:	Length of the cell.
+  * @bit_offset:	Bit offset if cell is smaller than a byte.
+  * @nbits:	Number of bits.
+@@ -62,6 +63,7 @@ struct nvmem_keepout {
+ struct nvmem_cell_info {
+ 	const char		*name;
+ 	unsigned int		offset;
++	size_t			raw_len;
+ 	unsigned int		bytes;
+ 	unsigned int		bit_offset;
+ 	unsigned int		nbits;
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0018-nvmem-u-boot-env-post-process-ethaddr-env-variable.patch b/target/linux/generic/backport-6.1/811-v6.4-0018-nvmem-u-boot-env-post-process-ethaddr-env-variable.patch
new file mode 100644
index 00000000000000..adde0ffc4b1786
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0018-nvmem-u-boot-env-post-process-ethaddr-env-variable.patch
@@ -0,0 +1,81 @@
+From c49f1a8af6bcf6d18576bca898f8083ca4b129e1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 4 Apr 2023 18:21:43 +0100
+Subject: [PATCH] nvmem: u-boot-env: post-process "ethaddr" env variable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+U-Boot environment variables are stored in ASCII format so "ethaddr"
+requires parsing into binary to make it work with Ethernet interfaces.
+
+This includes support for indexes to support #nvmem-cell-cells = <1>.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-36-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/Kconfig      |  1 +
+ drivers/nvmem/u-boot-env.c | 26 ++++++++++++++++++++++++++
+ 2 files changed, 27 insertions(+)
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -340,6 +340,7 @@ config NVMEM_U_BOOT_ENV
+ 	tristate "U-Boot environment variables support"
+ 	depends on OF && MTD
+ 	select CRC32
++	select GENERIC_NET_UTILS
+ 	help
+ 	  U-Boot stores its setup as environment variables. This driver adds
+ 	  support for verifying & exporting such data. It also exposes variables
+--- a/drivers/nvmem/u-boot-env.c
++++ b/drivers/nvmem/u-boot-env.c
+@@ -4,6 +4,8 @@
+  */
+ 
+ #include <linux/crc32.h>
++#include <linux/etherdevice.h>
++#include <linux/if_ether.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/module.h>
+ #include <linux/mtd/mtd.h>
+@@ -70,6 +72,25 @@ static int u_boot_env_read(void *context
+ 	return 0;
+ }
+ 
++static int u_boot_env_read_post_process_ethaddr(void *context, const char *id, int index,
++						unsigned int offset, void *buf, size_t bytes)
++{
++	u8 mac[ETH_ALEN];
++
++	if (bytes != 3 * ETH_ALEN - 1)
++		return -EINVAL;
++
++	if (!mac_pton(buf, mac))
++		return -EINVAL;
++
++	if (index)
++		eth_addr_add(mac, index);
++
++	ether_addr_copy(buf, mac);
++
++	return 0;
++}
++
+ static int u_boot_env_add_cells(struct u_boot_env *priv, uint8_t *buf,
+ 				size_t data_offset, size_t data_len)
+ {
+@@ -101,6 +122,11 @@ static int u_boot_env_add_cells(struct u
+ 		priv->cells[idx].offset = data_offset + value - data;
+ 		priv->cells[idx].bytes = strlen(value);
+ 		priv->cells[idx].np = of_get_child_by_name(dev->of_node, priv->cells[idx].name);
++		if (!strcmp(var, "ethaddr")) {
++			priv->cells[idx].raw_len = strlen(value);
++			priv->cells[idx].bytes = ETH_ALEN;
++			priv->cells[idx].read_post_process = u_boot_env_read_post_process_ethaddr;
++		}
+ 	}
+ 
+ 	if (WARN_ON(idx != priv->ncells))
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0019-nvmem-Add-macro-to-register-nvmem-layout-drivers.patch b/target/linux/generic/backport-6.1/811-v6.4-0019-nvmem-Add-macro-to-register-nvmem-layout-drivers.patch
new file mode 100644
index 00000000000000..7c6fe22b5f3a69
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0019-nvmem-Add-macro-to-register-nvmem-layout-drivers.patch
@@ -0,0 +1,42 @@
+From 814c978f02db17f16e6aa2efa2a929372f06da09 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:44 +0100
+Subject: [PATCH] nvmem: Add macro to register nvmem layout drivers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Provide a module_nvmem_layout_driver() macro at the end of the
+nvmem-provider.h header to reduce the boilerplate when registering nvmem
+layout drivers.
+
+Suggested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Acked-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-37-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/nvmem-provider.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -9,6 +9,7 @@
+ #ifndef _LINUX_NVMEM_PROVIDER_H
+ #define _LINUX_NVMEM_PROVIDER_H
+ 
++#include <linux/device/driver.h>
+ #include <linux/err.h>
+ #include <linux/errno.h>
+ #include <linux/gpio/consumer.h>
+@@ -242,4 +243,9 @@ nvmem_layout_get_match_data(struct nvmem
+ }
+ 
+ #endif /* CONFIG_NVMEM */
++
++#define module_nvmem_layout_driver(__layout_driver)		\
++	module_driver(__layout_driver, nvmem_layout_register,	\
++		      nvmem_layout_unregister)
++
+ #endif  /* ifndef _LINUX_NVMEM_PROVIDER_H */
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0020-nvmem-layouts-sl28vpd-Use-module_nvmem_layout_driver.patch b/target/linux/generic/backport-6.1/811-v6.4-0020-nvmem-layouts-sl28vpd-Use-module_nvmem_layout_driver.patch
new file mode 100644
index 00000000000000..06646dd68bf67b
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0020-nvmem-layouts-sl28vpd-Use-module_nvmem_layout_driver.patch
@@ -0,0 +1,39 @@
+From 0abdf99fe0c86252ba274703425f8d543d7e7f0d Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:45 +0100
+Subject: [PATCH] nvmem: layouts: sl28vpd: Use module_nvmem_layout_driver()
+
+Stop open-coding the module init/exit functions. Use the
+module_nvmem_layout_driver() instead.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-38-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/layouts/sl28vpd.c | 14 +-------------
+ 1 file changed, 1 insertion(+), 13 deletions(-)
+
+--- a/drivers/nvmem/layouts/sl28vpd.c
++++ b/drivers/nvmem/layouts/sl28vpd.c
+@@ -146,19 +146,7 @@ struct nvmem_layout sl28vpd_layout = {
+ 	.of_match_table = sl28vpd_of_match_table,
+ 	.add_cells = sl28vpd_add_cells,
+ };
+-
+-static int __init sl28vpd_init(void)
+-{
+-	return nvmem_layout_register(&sl28vpd_layout);
+-}
+-
+-static void __exit sl28vpd_exit(void)
+-{
+-	nvmem_layout_unregister(&sl28vpd_layout);
+-}
+-
+-module_init(sl28vpd_init);
+-module_exit(sl28vpd_exit);
++module_nvmem_layout_driver(sl28vpd_layout);
+ 
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Michael Walle <michael@walle.cc>");
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0021-nvmem-layouts-onie-tlv-Use-module_nvmem_layout_drive.patch b/target/linux/generic/backport-6.1/811-v6.4-0021-nvmem-layouts-onie-tlv-Use-module_nvmem_layout_drive.patch
new file mode 100644
index 00000000000000..826f4378c2fabf
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0021-nvmem-layouts-onie-tlv-Use-module_nvmem_layout_drive.patch
@@ -0,0 +1,39 @@
+From d119eb38faab61125aaa4f63c74eef61585cf34c Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:46 +0100
+Subject: [PATCH] nvmem: layouts: onie-tlv: Use module_nvmem_layout_driver()
+
+Stop open-coding the module init/exit functions. Use the
+module_nvmem_layout_driver() instead.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-39-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/layouts/onie-tlv.c | 14 +-------------
+ 1 file changed, 1 insertion(+), 13 deletions(-)
+
+--- a/drivers/nvmem/layouts/onie-tlv.c
++++ b/drivers/nvmem/layouts/onie-tlv.c
+@@ -237,19 +237,7 @@ static struct nvmem_layout onie_tlv_layo
+ 	.of_match_table = onie_tlv_of_match_table,
+ 	.add_cells = onie_tlv_parse_table,
+ };
+-
+-static int __init onie_tlv_init(void)
+-{
+-	return nvmem_layout_register(&onie_tlv_layout);
+-}
+-
+-static void __exit onie_tlv_exit(void)
+-{
+-	nvmem_layout_unregister(&onie_tlv_layout);
+-}
+-
+-module_init(onie_tlv_init);
+-module_exit(onie_tlv_exit);
++module_nvmem_layout_driver(onie_tlv_layout);
+ 
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Miquel Raynal <miquel.raynal@bootlin.com>");
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0022-nvmem-layouts-onie-tlv-Drop-wrong-module-alias.patch b/target/linux/generic/backport-6.1/811-v6.4-0022-nvmem-layouts-onie-tlv-Drop-wrong-module-alias.patch
new file mode 100644
index 00000000000000..f20db85ceb6ff6
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0022-nvmem-layouts-onie-tlv-Drop-wrong-module-alias.patch
@@ -0,0 +1,24 @@
+From 6b13e4b6a9a45028ac730e550380077df1845912 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:47 +0100
+Subject: [PATCH] nvmem: layouts: onie-tlv: Drop wrong module alias
+
+The MODULE_ALIAS macro is misused here as it carries the
+description. There is currently no relevant alias to provide so let's
+just drop it.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-40-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/layouts/onie-tlv.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/nvmem/layouts/onie-tlv.c
++++ b/drivers/nvmem/layouts/onie-tlv.c
+@@ -242,4 +242,3 @@ module_nvmem_layout_driver(onie_tlv_layo
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Miquel Raynal <miquel.raynal@bootlin.com>");
+ MODULE_DESCRIPTION("NVMEM layout driver for Onie TLV table parsing");
+-MODULE_ALIAS("NVMEM layout driver for Onie TLV table parsing");
diff --git a/target/linux/generic/backport-6.1/811-v6.4-0023-nvmem-layouts-sl28vpd-set-varaiable-sl28vpd_layout-s.patch b/target/linux/generic/backport-6.1/811-v6.4-0023-nvmem-layouts-sl28vpd-set-varaiable-sl28vpd_layout-s.patch
new file mode 100644
index 00000000000000..5cf847b57ae130
--- /dev/null
+++ b/target/linux/generic/backport-6.1/811-v6.4-0023-nvmem-layouts-sl28vpd-set-varaiable-sl28vpd_layout-s.patch
@@ -0,0 +1,31 @@
+From a8642cd11635a35a5f1dc31857887900d6610778 Mon Sep 17 00:00:00 2001
+From: Tom Rix <trix@redhat.com>
+Date: Tue, 4 Apr 2023 18:21:48 +0100
+Subject: [PATCH] nvmem: layouts: sl28vpd: set varaiable sl28vpd_layout
+ storage-class-specifier to static
+
+smatch reports
+drivers/nvmem/layouts/sl28vpd.c:144:21: warning: symbol
+  'sl28vpd_layout' was not declared. Should it be static?
+
+This variable is only used in one file so it should be static.
+
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-41-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/layouts/sl28vpd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/layouts/sl28vpd.c
++++ b/drivers/nvmem/layouts/sl28vpd.c
+@@ -141,7 +141,7 @@ static const struct of_device_id sl28vpd
+ };
+ MODULE_DEVICE_TABLE(of, sl28vpd_of_match_table);
+ 
+-struct nvmem_layout sl28vpd_layout = {
++static struct nvmem_layout sl28vpd_layout = {
+ 	.name = "sl28-vpd",
+ 	.of_match_table = sl28vpd_of_match_table,
+ 	.add_cells = sl28vpd_add_cells,
diff --git a/target/linux/generic/backport-6.1/812-v6.2-firmware-nvram-bcm47xx-support-init-from-IO-memory.patch b/target/linux/generic/backport-6.1/812-v6.2-firmware-nvram-bcm47xx-support-init-from-IO-memory.patch
new file mode 100644
index 00000000000000..13ee2d42293f91
--- /dev/null
+++ b/target/linux/generic/backport-6.1/812-v6.2-firmware-nvram-bcm47xx-support-init-from-IO-memory.patch
@@ -0,0 +1,100 @@
+From a5be5ce0e25439fae3cd42e3d775979547926812 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 3 Nov 2022 09:25:29 +0100
+Subject: [PATCH] firmware/nvram: bcm47xx: support init from IO memory
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Provide NVMEM content to the NVRAM driver from a simple
+memory resource. This is necessary to use NVRAM in a memory-
+mapped flash device. Patch taken from OpenWrts development
+tree.
+
+This patch makes it possible to use memory-mapped NVRAM
+on the D-Link DWL-8610AP and the D-Link DIR-890L.
+
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: linux-mips@vger.kernel.org
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Cc: bcm-kernel-feedback-list@broadcom.com
+Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+[Added an export for modules potentially using the init symbol]
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20221103082529.359084-1-linus.walleij@linaro.org
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ drivers/firmware/broadcom/bcm47xx_nvram.c | 18 ++++++++++++++++++
+ drivers/nvmem/brcm_nvram.c                |  3 +++
+ include/linux/bcm47xx_nvram.h             |  6 ++++++
+ 3 files changed, 27 insertions(+)
+
+--- a/drivers/firmware/broadcom/bcm47xx_nvram.c
++++ b/drivers/firmware/broadcom/bcm47xx_nvram.c
+@@ -110,6 +110,24 @@ found:
+ 	return 0;
+ }
+ 
++int bcm47xx_nvram_init_from_iomem(void __iomem *nvram_start, size_t res_size)
++{
++	if (nvram_len) {
++		pr_warn("nvram already initialized\n");
++		return -EEXIST;
++	}
++
++	if (!bcm47xx_nvram_is_valid(nvram_start)) {
++		pr_err("No valid NVRAM found\n");
++		return -ENOENT;
++	}
++
++	bcm47xx_nvram_copy(nvram_start, res_size);
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(bcm47xx_nvram_init_from_iomem);
++
+ /*
+  * On bcm47xx we need access to the NVRAM very early, so we can't use mtd
+  * subsystem to access flash. We can't even use platform device / driver to
+--- a/drivers/nvmem/brcm_nvram.c
++++ b/drivers/nvmem/brcm_nvram.c
+@@ -3,6 +3,7 @@
+  * Copyright (C) 2021 Rafał Miłecki <rafal@milecki.pl>
+  */
+ 
++#include <linux/bcm47xx_nvram.h>
+ #include <linux/io.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/module.h>
+@@ -139,6 +140,8 @@ static int brcm_nvram_probe(struct platf
+ 	if (err)
+ 		return err;
+ 
++	bcm47xx_nvram_init_from_iomem(priv->base, resource_size(res));
++
+ 	config.dev = dev;
+ 	config.cells = priv->cells;
+ 	config.ncells = priv->ncells;
+--- a/include/linux/bcm47xx_nvram.h
++++ b/include/linux/bcm47xx_nvram.h
+@@ -11,6 +11,7 @@
+ #include <linux/vmalloc.h>
+ 
+ #ifdef CONFIG_BCM47XX_NVRAM
++int bcm47xx_nvram_init_from_iomem(void __iomem *nvram_start, size_t res_size);
+ int bcm47xx_nvram_init_from_mem(u32 base, u32 lim);
+ int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len);
+ int bcm47xx_nvram_gpio_pin(const char *name);
+@@ -20,6 +21,11 @@ static inline void bcm47xx_nvram_release
+ 	vfree(nvram);
+ };
+ #else
++static inline int bcm47xx_nvram_init_from_iomem(void __iomem *nvram_start,
++						size_t res_size)
++{
++	return -ENOTSUPP;
++}
+ static inline int bcm47xx_nvram_init_from_mem(u32 base, u32 lim)
+ {
+ 	return -ENOTSUPP;
diff --git a/target/linux/generic/backport-6.1/813-v6.5-0001-nvmem-imx-ocotp-set-varaiable-imx_ocotp_layout-stora.patch b/target/linux/generic/backport-6.1/813-v6.5-0001-nvmem-imx-ocotp-set-varaiable-imx_ocotp_layout-stora.patch
new file mode 100644
index 00000000000000..38cfccd5ef9b29
--- /dev/null
+++ b/target/linux/generic/backport-6.1/813-v6.5-0001-nvmem-imx-ocotp-set-varaiable-imx_ocotp_layout-stora.patch
@@ -0,0 +1,31 @@
+From eebc6573ad940b62a87776db3917e912b4f52d78 Mon Sep 17 00:00:00 2001
+From: Tom Rix <trix@redhat.com>
+Date: Sun, 11 Jun 2023 15:03:05 +0100
+Subject: [PATCH] nvmem: imx-ocotp: set varaiable imx_ocotp_layout
+ storage-class-specifier to static
+
+smatch reports
+drivers/nvmem/imx-ocotp.c:599:21: warning: symbol
+  'imx_ocotp_layout' was not declared. Should it be static?
+
+This variable is only used in one file so should be static.
+
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-2-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/imx-ocotp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/imx-ocotp.c
++++ b/drivers/nvmem/imx-ocotp.c
+@@ -596,7 +596,7 @@ static void imx_ocotp_fixup_cell_info(st
+ 	cell->read_post_process = imx_ocotp_cell_pp;
+ }
+ 
+-struct nvmem_layout imx_ocotp_layout = {
++static struct nvmem_layout imx_ocotp_layout = {
+ 	.fixup_cell_info = imx_ocotp_fixup_cell_info,
+ };
+ 
diff --git a/target/linux/generic/backport-6.1/813-v6.5-0002-nvmem-imx-ocotp-Reverse-MAC-addresses-on-all-i.MX-de.patch b/target/linux/generic/backport-6.1/813-v6.5-0002-nvmem-imx-ocotp-Reverse-MAC-addresses-on-all-i.MX-de.patch
new file mode 100644
index 00000000000000..7523e5ebf645a7
--- /dev/null
+++ b/target/linux/generic/backport-6.1/813-v6.5-0002-nvmem-imx-ocotp-Reverse-MAC-addresses-on-all-i.MX-de.patch
@@ -0,0 +1,71 @@
+From 8a00fc606312c68b98add8fe8e6f7a013ce29e78 Mon Sep 17 00:00:00 2001
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+Date: Sun, 11 Jun 2023 15:03:06 +0100
+Subject: [PATCH] nvmem: imx-ocotp: Reverse MAC addresses on all i.MX derivates
+
+Not just i.MX8M, but all i.MX6/7 (and subtypes) need to reverse the
+MAC address read from fuses. Exceptions are i.MX6SLL and i.MX7ULP which
+do not support ethernet at all.
+
+Fixes: d0221a780cbc ("nvmem: imx-ocotp: add support for post processing")
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Tested-by: Richard Leitner <richard.leitner@skidata.com> # imx6q
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-3-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/imx-ocotp.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/drivers/nvmem/imx-ocotp.c
++++ b/drivers/nvmem/imx-ocotp.c
+@@ -97,7 +97,6 @@ struct ocotp_params {
+ 	unsigned int bank_address_words;
+ 	void (*set_timing)(struct ocotp_priv *priv);
+ 	struct ocotp_ctrl_reg ctrl;
+-	bool reverse_mac_address;
+ };
+ 
+ static int imx_ocotp_wait_for_busy(struct ocotp_priv *priv, u32 flags)
+@@ -545,7 +544,6 @@ static const struct ocotp_params imx8mq_
+ 	.bank_address_words = 0,
+ 	.set_timing = imx_ocotp_set_imx6_timing,
+ 	.ctrl = IMX_OCOTP_BM_CTRL_DEFAULT,
+-	.reverse_mac_address = true,
+ };
+ 
+ static const struct ocotp_params imx8mm_params = {
+@@ -553,7 +551,6 @@ static const struct ocotp_params imx8mm_
+ 	.bank_address_words = 0,
+ 	.set_timing = imx_ocotp_set_imx6_timing,
+ 	.ctrl = IMX_OCOTP_BM_CTRL_DEFAULT,
+-	.reverse_mac_address = true,
+ };
+ 
+ static const struct ocotp_params imx8mn_params = {
+@@ -561,7 +558,6 @@ static const struct ocotp_params imx8mn_
+ 	.bank_address_words = 0,
+ 	.set_timing = imx_ocotp_set_imx6_timing,
+ 	.ctrl = IMX_OCOTP_BM_CTRL_DEFAULT,
+-	.reverse_mac_address = true,
+ };
+ 
+ static const struct ocotp_params imx8mp_params = {
+@@ -569,7 +565,6 @@ static const struct ocotp_params imx8mp_
+ 	.bank_address_words = 0,
+ 	.set_timing = imx_ocotp_set_imx6_timing,
+ 	.ctrl = IMX_OCOTP_BM_CTRL_8MP,
+-	.reverse_mac_address = true,
+ };
+ 
+ static const struct of_device_id imx_ocotp_dt_ids[] = {
+@@ -624,8 +619,7 @@ static int imx_ocotp_probe(struct platfo
+ 	imx_ocotp_nvmem_config.size = 4 * priv->params->nregs;
+ 	imx_ocotp_nvmem_config.dev = dev;
+ 	imx_ocotp_nvmem_config.priv = priv;
+-	if (priv->params->reverse_mac_address)
+-		imx_ocotp_nvmem_config.layout = &imx_ocotp_layout;
++	imx_ocotp_nvmem_config.layout = &imx_ocotp_layout;
+ 
+ 	priv->config = &imx_ocotp_nvmem_config;
+ 
diff --git a/target/linux/generic/backport-6.1/813-v6.5-0003-nvmem-brcm_nvram-add-.read_post_process-for-MACs.patch b/target/linux/generic/backport-6.1/813-v6.5-0003-nvmem-brcm_nvram-add-.read_post_process-for-MACs.patch
new file mode 100644
index 00000000000000..fb4d346a95add1
--- /dev/null
+++ b/target/linux/generic/backport-6.1/813-v6.5-0003-nvmem-brcm_nvram-add-.read_post_process-for-MACs.patch
@@ -0,0 +1,81 @@
+From 73bcd133c910bff3b6d3b3834d0d14be9444e90a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Sun, 11 Jun 2023 15:03:08 +0100
+Subject: [PATCH] nvmem: brcm_nvram: add .read_post_process() for MACs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+1. Parse ASCII MAC format into byte based
+2. Calculate relative addresses based on index argument
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-5-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/Kconfig      |  1 +
+ drivers/nvmem/brcm_nvram.c | 28 ++++++++++++++++++++++++++++
+ 2 files changed, 29 insertions(+)
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -55,6 +55,7 @@ config NVMEM_BRCM_NVRAM
+ 	tristate "Broadcom's NVRAM support"
+ 	depends on ARCH_BCM_5301X || COMPILE_TEST
+ 	depends on HAS_IOMEM
++	select GENERIC_NET_UTILS
+ 	help
+ 	  This driver provides support for Broadcom's NVRAM that can be accessed
+ 	  using I/O mapping.
+--- a/drivers/nvmem/brcm_nvram.c
++++ b/drivers/nvmem/brcm_nvram.c
+@@ -4,6 +4,8 @@
+  */
+ 
+ #include <linux/bcm47xx_nvram.h>
++#include <linux/etherdevice.h>
++#include <linux/if_ether.h>
+ #include <linux/io.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/module.h>
+@@ -42,6 +44,25 @@ static int brcm_nvram_read(void *context
+ 	return 0;
+ }
+ 
++static int brcm_nvram_read_post_process_macaddr(void *context, const char *id, int index,
++						unsigned int offset, void *buf, size_t bytes)
++{
++	u8 mac[ETH_ALEN];
++
++	if (bytes != 3 * ETH_ALEN - 1)
++		return -EINVAL;
++
++	if (!mac_pton(buf, mac))
++		return -EINVAL;
++
++	if (index)
++		eth_addr_add(mac, index);
++
++	ether_addr_copy(buf, mac);
++
++	return 0;
++}
++
+ static int brcm_nvram_add_cells(struct brcm_nvram *priv, uint8_t *data,
+ 				size_t len)
+ {
+@@ -75,6 +96,13 @@ static int brcm_nvram_add_cells(struct b
+ 		priv->cells[idx].offset = value - (char *)data;
+ 		priv->cells[idx].bytes = strlen(value);
+ 		priv->cells[idx].np = of_get_child_by_name(dev->of_node, priv->cells[idx].name);
++		if (!strcmp(var, "et0macaddr") ||
++		    !strcmp(var, "et1macaddr") ||
++		    !strcmp(var, "et2macaddr")) {
++			priv->cells[idx].raw_len = strlen(value);
++			priv->cells[idx].bytes = ETH_ALEN;
++			priv->cells[idx].read_post_process = brcm_nvram_read_post_process_macaddr;
++		}
+ 	}
+ 
+ 	return 0;
diff --git a/target/linux/generic/backport-6.1/813-v6.5-0004-nvmem-rockchip-otp-Add-clks-and-reg_read-to-rockchip.patch b/target/linux/generic/backport-6.1/813-v6.5-0004-nvmem-rockchip-otp-Add-clks-and-reg_read-to-rockchip.patch
new file mode 100644
index 00000000000000..3b6e6e57f52b44
--- /dev/null
+++ b/target/linux/generic/backport-6.1/813-v6.5-0004-nvmem-rockchip-otp-Add-clks-and-reg_read-to-rockchip.patch
@@ -0,0 +1,166 @@
+From 8dc61364164e79e44c07fa2ac0a7b6939f00d5db Mon Sep 17 00:00:00 2001
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Date: Sun, 11 Jun 2023 15:03:13 +0100
+Subject: [PATCH] nvmem: rockchip-otp: Add clks and reg_read to rockchip_data
+
+In preparation to support new Rockchip OTP memory devices with different
+clock configurations and register layout, extend rockchip_data struct
+with the related members: clks, num_clks, reg_read.
+
+Additionally, to avoid managing redundant driver data, drop num_clks
+member from rockchip_otp struct and update all references to point to
+the equivalent member in rockchip_data.
+
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Tested-by: Vincent Legoll <vincent.legoll@gmail.com>
+Reviewed-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-10-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/rockchip-otp.c | 79 ++++++++++++++++++++++--------------
+ 1 file changed, 49 insertions(+), 30 deletions(-)
+
+--- a/drivers/nvmem/rockchip-otp.c
++++ b/drivers/nvmem/rockchip-otp.c
+@@ -54,21 +54,19 @@
+ 
+ #define OTPC_TIMEOUT			10000
+ 
++struct rockchip_data {
++	int size;
++	const char * const *clks;
++	int num_clks;
++	nvmem_reg_read_t reg_read;
++};
++
+ struct rockchip_otp {
+ 	struct device *dev;
+ 	void __iomem *base;
+-	struct clk_bulk_data	*clks;
+-	int num_clks;
++	struct clk_bulk_data *clks;
+ 	struct reset_control *rst;
+-};
+-
+-/* list of required clocks */
+-static const char * const rockchip_otp_clocks[] = {
+-	"otp", "apb_pclk", "phy",
+-};
+-
+-struct rockchip_data {
+-	int size;
++	const struct rockchip_data *data;
+ };
+ 
+ static int rockchip_otp_reset(struct rockchip_otp *otp)
+@@ -132,29 +130,23 @@ static int rockchip_otp_ecc_enable(struc
+ 	return ret;
+ }
+ 
+-static int rockchip_otp_read(void *context, unsigned int offset,
+-			     void *val, size_t bytes)
++static int px30_otp_read(void *context, unsigned int offset,
++			 void *val, size_t bytes)
+ {
+ 	struct rockchip_otp *otp = context;
+ 	u8 *buf = val;
+-	int ret = 0;
+-
+-	ret = clk_bulk_prepare_enable(otp->num_clks, otp->clks);
+-	if (ret < 0) {
+-		dev_err(otp->dev, "failed to prepare/enable clks\n");
+-		return ret;
+-	}
++	int ret;
+ 
+ 	ret = rockchip_otp_reset(otp);
+ 	if (ret) {
+ 		dev_err(otp->dev, "failed to reset otp phy\n");
+-		goto disable_clks;
++		return ret;
+ 	}
+ 
+ 	ret = rockchip_otp_ecc_enable(otp, false);
+ 	if (ret < 0) {
+ 		dev_err(otp->dev, "rockchip_otp_ecc_enable err\n");
+-		goto disable_clks;
++		return ret;
+ 	}
+ 
+ 	writel(OTPC_USE_USER | OTPC_USE_USER_MASK, otp->base + OTPC_USER_CTRL);
+@@ -174,8 +166,28 @@ static int rockchip_otp_read(void *conte
+ 
+ read_end:
+ 	writel(0x0 | OTPC_USE_USER_MASK, otp->base + OTPC_USER_CTRL);
+-disable_clks:
+-	clk_bulk_disable_unprepare(otp->num_clks, otp->clks);
++
++	return ret;
++}
++
++static int rockchip_otp_read(void *context, unsigned int offset,
++			     void *val, size_t bytes)
++{
++	struct rockchip_otp *otp = context;
++	int ret;
++
++	if (!otp->data || !otp->data->reg_read)
++		return -EINVAL;
++
++	ret = clk_bulk_prepare_enable(otp->data->num_clks, otp->clks);
++	if (ret < 0) {
++		dev_err(otp->dev, "failed to prepare/enable clks\n");
++		return ret;
++	}
++
++	ret = otp->data->reg_read(context, offset, val, bytes);
++
++	clk_bulk_disable_unprepare(otp->data->num_clks, otp->clks);
+ 
+ 	return ret;
+ }
+@@ -189,8 +201,15 @@ static struct nvmem_config otp_config =
+ 	.reg_read = rockchip_otp_read,
+ };
+ 
++static const char * const px30_otp_clocks[] = {
++	"otp", "apb_pclk", "phy",
++};
++
+ static const struct rockchip_data px30_data = {
+ 	.size = 0x40,
++	.clks = px30_otp_clocks,
++	.num_clks = ARRAY_SIZE(px30_otp_clocks),
++	.reg_read = px30_otp_read,
+ };
+ 
+ static const struct of_device_id rockchip_otp_match[] = {
+@@ -225,21 +244,21 @@ static int rockchip_otp_probe(struct pla
+ 	if (!otp)
+ 		return -ENOMEM;
+ 
++	otp->data = data;
+ 	otp->dev = dev;
+ 	otp->base = devm_platform_ioremap_resource(pdev, 0);
+ 	if (IS_ERR(otp->base))
+ 		return PTR_ERR(otp->base);
+ 
+-	otp->num_clks = ARRAY_SIZE(rockchip_otp_clocks);
+-	otp->clks = devm_kcalloc(dev, otp->num_clks,
+-				     sizeof(*otp->clks), GFP_KERNEL);
++	otp->clks = devm_kcalloc(dev, data->num_clks, sizeof(*otp->clks),
++				 GFP_KERNEL);
+ 	if (!otp->clks)
+ 		return -ENOMEM;
+ 
+-	for (i = 0; i < otp->num_clks; ++i)
+-		otp->clks[i].id = rockchip_otp_clocks[i];
++	for (i = 0; i < data->num_clks; ++i)
++		otp->clks[i].id = data->clks[i];
+ 
+-	ret = devm_clk_bulk_get(dev, otp->num_clks, otp->clks);
++	ret = devm_clk_bulk_get(dev, data->num_clks, otp->clks);
+ 	if (ret)
+ 		return ret;
+ 
diff --git a/target/linux/generic/backport-6.1/813-v6.5-0005-nvmem-rockchip-otp-Generalize-rockchip_otp_wait_stat.patch b/target/linux/generic/backport-6.1/813-v6.5-0005-nvmem-rockchip-otp-Generalize-rockchip_otp_wait_stat.patch
new file mode 100644
index 00000000000000..b5b66cfc5ac0d1
--- /dev/null
+++ b/target/linux/generic/backport-6.1/813-v6.5-0005-nvmem-rockchip-otp-Generalize-rockchip_otp_wait_stat.patch
@@ -0,0 +1,62 @@
+From 30fd21cfb1e64ef20035559a8246f5fbf682c40e Mon Sep 17 00:00:00 2001
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Date: Sun, 11 Jun 2023 15:03:14 +0100
+Subject: [PATCH] nvmem: rockchip-otp: Generalize rockchip_otp_wait_status()
+
+In preparation to support additional Rockchip OTP memory devices with
+different register layout, generalize rockchip_otp_wait_status() to
+accept a new parameter for specifying the offset of the status register.
+
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Tested-by: Vincent Legoll <vincent.legoll@gmail.com>
+Reviewed-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-11-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/rockchip-otp.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/nvmem/rockchip-otp.c
++++ b/drivers/nvmem/rockchip-otp.c
+@@ -90,18 +90,19 @@ static int rockchip_otp_reset(struct roc
+ 	return 0;
+ }
+ 
+-static int rockchip_otp_wait_status(struct rockchip_otp *otp, u32 flag)
++static int rockchip_otp_wait_status(struct rockchip_otp *otp,
++				    unsigned int reg, u32 flag)
+ {
+ 	u32 status = 0;
+ 	int ret;
+ 
+-	ret = readl_poll_timeout_atomic(otp->base + OTPC_INT_STATUS, status,
++	ret = readl_poll_timeout_atomic(otp->base + reg, status,
+ 					(status & flag), 1, OTPC_TIMEOUT);
+ 	if (ret)
+ 		return ret;
+ 
+ 	/* clean int status */
+-	writel(flag, otp->base + OTPC_INT_STATUS);
++	writel(flag, otp->base + reg);
+ 
+ 	return 0;
+ }
+@@ -123,7 +124,7 @@ static int rockchip_otp_ecc_enable(struc
+ 
+ 	writel(SBPI_ENABLE_MASK | SBPI_ENABLE, otp->base + OTPC_SBPI_CTRL);
+ 
+-	ret = rockchip_otp_wait_status(otp, OTPC_SBPI_DONE);
++	ret = rockchip_otp_wait_status(otp, OTPC_INT_STATUS, OTPC_SBPI_DONE);
+ 	if (ret < 0)
+ 		dev_err(otp->dev, "timeout during ecc_enable\n");
+ 
+@@ -156,7 +157,7 @@ static int px30_otp_read(void *context,
+ 		       otp->base + OTPC_USER_ADDR);
+ 		writel(OTPC_USER_FSM_ENABLE | OTPC_USER_FSM_ENABLE_MASK,
+ 		       otp->base + OTPC_USER_ENABLE);
+-		ret = rockchip_otp_wait_status(otp, OTPC_USER_DONE);
++		ret = rockchip_otp_wait_status(otp, OTPC_INT_STATUS, OTPC_USER_DONE);
+ 		if (ret < 0) {
+ 			dev_err(otp->dev, "timeout during read setup\n");
+ 			goto read_end;
diff --git a/target/linux/generic/backport-6.1/813-v6.5-0006-nvmem-rockchip-otp-Use-devm_reset_control_array_get_.patch b/target/linux/generic/backport-6.1/813-v6.5-0006-nvmem-rockchip-otp-Use-devm_reset_control_array_get_.patch
new file mode 100644
index 00000000000000..3a17479d959ba2
--- /dev/null
+++ b/target/linux/generic/backport-6.1/813-v6.5-0006-nvmem-rockchip-otp-Use-devm_reset_control_array_get_.patch
@@ -0,0 +1,31 @@
+From d325c9dd2b6e94040ca722ddcadcd6af358dd2be Mon Sep 17 00:00:00 2001
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Date: Sun, 11 Jun 2023 15:03:15 +0100
+Subject: [PATCH] nvmem: rockchip-otp: Use
+ devm_reset_control_array_get_exclusive()
+
+In preparation to support new Rockchip OTP memory devices having
+specific reset configurations, switch devm_reset_control_get() to
+devm_reset_control_array_get_exclusive().
+
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Tested-by: Vincent Legoll <vincent.legoll@gmail.com>
+Reviewed-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-12-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/rockchip-otp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/rockchip-otp.c
++++ b/drivers/nvmem/rockchip-otp.c
+@@ -263,7 +263,7 @@ static int rockchip_otp_probe(struct pla
+ 	if (ret)
+ 		return ret;
+ 
+-	otp->rst = devm_reset_control_get(dev, "phy");
++	otp->rst = devm_reset_control_array_get_exclusive(dev);
+ 	if (IS_ERR(otp->rst))
+ 		return PTR_ERR(otp->rst);
+ 
diff --git a/target/linux/generic/backport-6.1/813-v6.5-0007-nvmem-rockchip-otp-Improve-probe-error-handling.patch b/target/linux/generic/backport-6.1/813-v6.5-0007-nvmem-rockchip-otp-Improve-probe-error-handling.patch
new file mode 100644
index 00000000000000..37cb927b100220
--- /dev/null
+++ b/target/linux/generic/backport-6.1/813-v6.5-0007-nvmem-rockchip-otp-Improve-probe-error-handling.patch
@@ -0,0 +1,71 @@
+From 912517345b867a69542dc9f5c2cc3e9d8beaccf5 Mon Sep 17 00:00:00 2001
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Date: Sun, 11 Jun 2023 15:03:16 +0100
+Subject: [PATCH] nvmem: rockchip-otp: Improve probe error handling
+
+Enhance error handling in the probe function by making use of
+dev_err_probe(), which ensures the error code is always printed, in
+addition to the specified error message.
+
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Tested-by: Vincent Legoll <vincent.legoll@gmail.com>
+Reviewed-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-13-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/rockchip-otp.c | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+--- a/drivers/nvmem/rockchip-otp.c
++++ b/drivers/nvmem/rockchip-otp.c
+@@ -235,10 +235,8 @@ static int rockchip_otp_probe(struct pla
+ 	int ret, i;
+ 
+ 	data = of_device_get_match_data(dev);
+-	if (!data) {
+-		dev_err(dev, "failed to get match data\n");
+-		return -EINVAL;
+-	}
++	if (!data)
++		return dev_err_probe(dev, -EINVAL, "failed to get match data\n");
+ 
+ 	otp = devm_kzalloc(&pdev->dev, sizeof(struct rockchip_otp),
+ 			   GFP_KERNEL);
+@@ -249,7 +247,8 @@ static int rockchip_otp_probe(struct pla
+ 	otp->dev = dev;
+ 	otp->base = devm_platform_ioremap_resource(pdev, 0);
+ 	if (IS_ERR(otp->base))
+-		return PTR_ERR(otp->base);
++		return dev_err_probe(dev, PTR_ERR(otp->base),
++				     "failed to ioremap resource\n");
+ 
+ 	otp->clks = devm_kcalloc(dev, data->num_clks, sizeof(*otp->clks),
+ 				 GFP_KERNEL);
+@@ -261,18 +260,22 @@ static int rockchip_otp_probe(struct pla
+ 
+ 	ret = devm_clk_bulk_get(dev, data->num_clks, otp->clks);
+ 	if (ret)
+-		return ret;
++		return dev_err_probe(dev, ret, "failed to get clocks\n");
+ 
+ 	otp->rst = devm_reset_control_array_get_exclusive(dev);
+ 	if (IS_ERR(otp->rst))
+-		return PTR_ERR(otp->rst);
++		return dev_err_probe(dev, PTR_ERR(otp->rst),
++				     "failed to get resets\n");
+ 
+ 	otp_config.size = data->size;
+ 	otp_config.priv = otp;
+ 	otp_config.dev = dev;
+-	nvmem = devm_nvmem_register(dev, &otp_config);
+ 
+-	return PTR_ERR_OR_ZERO(nvmem);
++	nvmem = devm_nvmem_register(dev, &otp_config);
++	if (IS_ERR(nvmem))
++		return dev_err_probe(dev, PTR_ERR(nvmem),
++				     "failed to register nvmem device\n");
++	return 0;
+ }
+ 
+ static struct platform_driver rockchip_otp_driver = {
diff --git a/target/linux/generic/backport-6.1/813-v6.5-0008-nvmem-rockchip-otp-Add-support-for-RK3588.patch b/target/linux/generic/backport-6.1/813-v6.5-0008-nvmem-rockchip-otp-Add-support-for-RK3588.patch
new file mode 100644
index 00000000000000..c1e2231c9ec940
--- /dev/null
+++ b/target/linux/generic/backport-6.1/813-v6.5-0008-nvmem-rockchip-otp-Add-support-for-RK3588.patch
@@ -0,0 +1,129 @@
+From 8ab099fafbbc8c9607c399d21a774784a6cb8b45 Mon Sep 17 00:00:00 2001
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Date: Sun, 11 Jun 2023 15:03:17 +0100
+Subject: [PATCH] nvmem: rockchip-otp: Add support for RK3588
+
+Add support for the OTP memory device found on the Rockchip RK3588 SoC.
+
+While here, remove the unnecessary 'void *' casts in the OF device ID
+table.
+
+Co-developed-by: Finley Xiao <finley.xiao@rock-chips.com>
+Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Tested-by: Vincent Legoll <vincent.legoll@gmail.com>
+Reviewed-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-14-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/rockchip-otp.c | 78 +++++++++++++++++++++++++++++++++++-
+ 1 file changed, 76 insertions(+), 2 deletions(-)
+
+--- a/drivers/nvmem/rockchip-otp.c
++++ b/drivers/nvmem/rockchip-otp.c
+@@ -54,6 +54,19 @@
+ 
+ #define OTPC_TIMEOUT			10000
+ 
++/* RK3588 Register */
++#define RK3588_OTPC_AUTO_CTRL		0x04
++#define RK3588_OTPC_AUTO_EN		0x08
++#define RK3588_OTPC_INT_ST		0x84
++#define RK3588_OTPC_DOUT0		0x20
++#define RK3588_NO_SECURE_OFFSET		0x300
++#define RK3588_NBYTES			4
++#define RK3588_BURST_NUM		1
++#define RK3588_BURST_SHIFT		8
++#define RK3588_ADDR_SHIFT		16
++#define RK3588_AUTO_EN			BIT(0)
++#define RK3588_RD_DONE			BIT(1)
++
+ struct rockchip_data {
+ 	int size;
+ 	const char * const *clks;
+@@ -171,6 +184,52 @@ read_end:
+ 	return ret;
+ }
+ 
++static int rk3588_otp_read(void *context, unsigned int offset,
++			   void *val, size_t bytes)
++{
++	struct rockchip_otp *otp = context;
++	unsigned int addr_start, addr_end, addr_len;
++	int ret, i = 0;
++	u32 data;
++	u8 *buf;
++
++	addr_start = round_down(offset, RK3588_NBYTES) / RK3588_NBYTES;
++	addr_end = round_up(offset + bytes, RK3588_NBYTES) / RK3588_NBYTES;
++	addr_len = addr_end - addr_start;
++	addr_start += RK3588_NO_SECURE_OFFSET;
++
++	buf = kzalloc(array_size(addr_len, RK3588_NBYTES), GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	while (addr_len--) {
++		writel((addr_start << RK3588_ADDR_SHIFT) |
++		       (RK3588_BURST_NUM << RK3588_BURST_SHIFT),
++		       otp->base + RK3588_OTPC_AUTO_CTRL);
++		writel(RK3588_AUTO_EN, otp->base + RK3588_OTPC_AUTO_EN);
++
++		ret = rockchip_otp_wait_status(otp, RK3588_OTPC_INT_ST,
++					       RK3588_RD_DONE);
++		if (ret < 0) {
++			dev_err(otp->dev, "timeout during read setup\n");
++			goto read_end;
++		}
++
++		data = readl(otp->base + RK3588_OTPC_DOUT0);
++		memcpy(&buf[i], &data, RK3588_NBYTES);
++
++		i += RK3588_NBYTES;
++		addr_start++;
++	}
++
++	memcpy(val, buf + offset % RK3588_NBYTES, bytes);
++
++read_end:
++	kfree(buf);
++
++	return ret;
++}
++
+ static int rockchip_otp_read(void *context, unsigned int offset,
+ 			     void *val, size_t bytes)
+ {
+@@ -213,14 +272,29 @@ static const struct rockchip_data px30_d
+ 	.reg_read = px30_otp_read,
+ };
+ 
++static const char * const rk3588_otp_clocks[] = {
++	"otp", "apb_pclk", "phy", "arb",
++};
++
++static const struct rockchip_data rk3588_data = {
++	.size = 0x400,
++	.clks = rk3588_otp_clocks,
++	.num_clks = ARRAY_SIZE(rk3588_otp_clocks),
++	.reg_read = rk3588_otp_read,
++};
++
+ static const struct of_device_id rockchip_otp_match[] = {
+ 	{
+ 		.compatible = "rockchip,px30-otp",
+-		.data = (void *)&px30_data,
++		.data = &px30_data,
+ 	},
+ 	{
+ 		.compatible = "rockchip,rk3308-otp",
+-		.data = (void *)&px30_data,
++		.data = &px30_data,
++	},
++	{
++		.compatible = "rockchip,rk3588-otp",
++		.data = &rk3588_data,
+ 	},
+ 	{ /* sentinel */ },
+ };
diff --git a/target/linux/generic/backport-6.1/813-v6.5-0009-nvmem-zynqmp-Switch-xilinx.com-emails-to-amd.com.patch b/target/linux/generic/backport-6.1/813-v6.5-0009-nvmem-zynqmp-Switch-xilinx.com-emails-to-amd.com.patch
new file mode 100644
index 00000000000000..220e3e9a05f303
--- /dev/null
+++ b/target/linux/generic/backport-6.1/813-v6.5-0009-nvmem-zynqmp-Switch-xilinx.com-emails-to-amd.com.patch
@@ -0,0 +1,26 @@
+From 9734408969e978a1c0d5d752be63dd638288e374 Mon Sep 17 00:00:00 2001
+From: Michal Simek <michal.simek@amd.com>
+Date: Sun, 11 Jun 2023 15:03:23 +0100
+Subject: [PATCH] nvmem: zynqmp: Switch @xilinx.com emails to @amd.com
+
+@xilinx.com is still working but better to switch to new amd.com after
+AMD/Xilinx acquisition.
+
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-20-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/zynqmp_nvmem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/zynqmp_nvmem.c
++++ b/drivers/nvmem/zynqmp_nvmem.c
+@@ -76,6 +76,6 @@ static struct platform_driver zynqmp_nvm
+ 
+ module_platform_driver(zynqmp_nvmem_driver);
+ 
+-MODULE_AUTHOR("Michal Simek <michal.simek@xilinx.com>, Nava kishore Manne <navam@xilinx.com>");
++MODULE_AUTHOR("Michal Simek <michal.simek@amd.com>, Nava kishore Manne <nava.kishore.manne@amd.com>");
+ MODULE_DESCRIPTION("ZynqMP NVMEM driver");
+ MODULE_LICENSE("GPL");
diff --git a/target/linux/generic/backport-6.1/813-v6.5-0010-nvmem-imx-support-i.MX93-OCOTP.patch b/target/linux/generic/backport-6.1/813-v6.5-0010-nvmem-imx-support-i.MX93-OCOTP.patch
new file mode 100644
index 00000000000000..f8e6be4241604a
--- /dev/null
+++ b/target/linux/generic/backport-6.1/813-v6.5-0010-nvmem-imx-support-i.MX93-OCOTP.patch
@@ -0,0 +1,230 @@
+From 22e9e6fcfb5042cb6d6c7874c459b034800092f1 Mon Sep 17 00:00:00 2001
+From: Peng Fan <peng.fan@nxp.com>
+Date: Sun, 11 Jun 2023 15:03:25 +0100
+Subject: [PATCH] nvmem: imx: support i.MX93 OCOTP
+
+Add i.MX93 OCOTP support. i.MX93 OCOTP has two parts: Fuse shadow
+block(fsb) and fuse managed by ELE. The FSB part could be directly
+accessed with MMIO, the ELE could only be accessed with ELE API.
+
+Currently the ELE API is not ready, so NULL function callback is used,
+but it was tested with downstream ELE API.
+
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-22-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/Kconfig         |   9 ++
+ drivers/nvmem/Makefile        |   2 +
+ drivers/nvmem/imx-ocotp-ele.c | 175 ++++++++++++++++++++++++++++++++++
+ 3 files changed, 186 insertions(+)
+ create mode 100644 drivers/nvmem/imx-ocotp-ele.c
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -83,6 +83,15 @@ config NVMEM_IMX_OCOTP
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called nvmem-imx-ocotp.
+ 
++config NVMEM_IMX_OCOTP_ELE
++	tristate "i.MX On-Chip OTP Controller support"
++	depends on ARCH_MXC || COMPILE_TEST
++	depends on HAS_IOMEM
++	depends on OF
++	help
++	  This is a driver for the On-Chip OTP Controller (OCOTP)
++	  available on i.MX SoCs which has ELE.
++
+ config NVMEM_IMX_OCOTP_SCU
+ 	tristate "i.MX8 SCU On-Chip OTP Controller support"
+ 	depends on IMX_SCU
+--- a/drivers/nvmem/Makefile
++++ b/drivers/nvmem/Makefile
+@@ -18,6 +18,8 @@ obj-$(CONFIG_NVMEM_IMX_IIM)		+= nvmem-im
+ nvmem-imx-iim-y				:= imx-iim.o
+ obj-$(CONFIG_NVMEM_IMX_OCOTP)		+= nvmem-imx-ocotp.o
+ nvmem-imx-ocotp-y			:= imx-ocotp.o
++obj-$(CONFIG_NVMEM_IMX_OCOTP_ELE)	+= nvmem-imx-ocotp-ele.o
++nvmem-imx-ocotp-ele-y			:= imx-ocotp-ele.o
+ obj-$(CONFIG_NVMEM_IMX_OCOTP_SCU)	+= nvmem-imx-ocotp-scu.o
+ nvmem-imx-ocotp-scu-y			:= imx-ocotp-scu.o
+ obj-$(CONFIG_NVMEM_JZ4780_EFUSE)	+= nvmem_jz4780_efuse.o
+--- /dev/null
++++ b/drivers/nvmem/imx-ocotp-ele.c
+@@ -0,0 +1,175 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * i.MX9 OCOTP fusebox driver
++ *
++ * Copyright 2023 NXP
++ */
++
++#include <linux/device.h>
++#include <linux/io.h>
++#include <linux/module.h>
++#include <linux/nvmem-provider.h>
++#include <linux/of_device.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++
++enum fuse_type {
++	FUSE_FSB = 1,
++	FUSE_ELE = 2,
++	FUSE_INVALID = -1
++};
++
++struct ocotp_map_entry {
++	u32 start; /* start word */
++	u32 num; /* num words */
++	enum fuse_type type;
++};
++
++struct ocotp_devtype_data {
++	u32 reg_off;
++	char *name;
++	u32 size;
++	u32 num_entry;
++	u32 flag;
++	nvmem_reg_read_t reg_read;
++	struct ocotp_map_entry entry[];
++};
++
++struct imx_ocotp_priv {
++	struct device *dev;
++	void __iomem *base;
++	struct nvmem_config config;
++	struct mutex lock;
++	const struct ocotp_devtype_data *data;
++};
++
++static enum fuse_type imx_ocotp_fuse_type(void *context, u32 index)
++{
++	struct imx_ocotp_priv *priv = context;
++	const struct ocotp_devtype_data *data = priv->data;
++	u32 start, end;
++	int i;
++
++	for (i = 0; i < data->num_entry; i++) {
++		start = data->entry[i].start;
++		end = data->entry[i].start + data->entry[i].num;
++
++		if (index >= start && index < end)
++			return data->entry[i].type;
++	}
++
++	return FUSE_INVALID;
++}
++
++static int imx_ocotp_reg_read(void *context, unsigned int offset, void *val, size_t bytes)
++{
++	struct imx_ocotp_priv *priv = context;
++	void __iomem *reg = priv->base + priv->data->reg_off;
++	u32 count, index, num_bytes;
++	enum fuse_type type;
++	u32 *buf;
++	void *p;
++	int i;
++
++	index = offset;
++	num_bytes = round_up(bytes, 4);
++	count = num_bytes >> 2;
++
++	if (count > ((priv->data->size >> 2) - index))
++		count = (priv->data->size >> 2) - index;
++
++	p = kzalloc(num_bytes, GFP_KERNEL);
++	if (!p)
++		return -ENOMEM;
++
++	mutex_lock(&priv->lock);
++
++	buf = p;
++
++	for (i = index; i < (index + count); i++) {
++		type = imx_ocotp_fuse_type(context, i);
++		if (type == FUSE_INVALID || type == FUSE_ELE) {
++			*buf++ = 0;
++			continue;
++		}
++
++		*buf++ = readl_relaxed(reg + (i << 2));
++	}
++
++	memcpy(val, (u8 *)p, bytes);
++
++	mutex_unlock(&priv->lock);
++
++	kfree(p);
++
++	return 0;
++};
++
++static int imx_ele_ocotp_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct imx_ocotp_priv *priv;
++	struct nvmem_device *nvmem;
++
++	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	priv->data = of_device_get_match_data(dev);
++
++	priv->base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(priv->base))
++		return PTR_ERR(priv->base);
++
++	priv->config.dev = dev;
++	priv->config.name = "ELE-OCOTP";
++	priv->config.id = NVMEM_DEVID_AUTO;
++	priv->config.owner = THIS_MODULE;
++	priv->config.size = priv->data->size;
++	priv->config.reg_read = priv->data->reg_read;
++	priv->config.word_size = 4;
++	priv->config.stride = 1;
++	priv->config.priv = priv;
++	priv->config.read_only = true;
++	mutex_init(&priv->lock);
++
++	nvmem = devm_nvmem_register(dev, &priv->config);
++	if (IS_ERR(nvmem))
++		return PTR_ERR(nvmem);
++
++	return 0;
++}
++
++static const struct ocotp_devtype_data imx93_ocotp_data = {
++	.reg_off = 0x8000,
++	.reg_read = imx_ocotp_reg_read,
++	.size = 2048,
++	.num_entry = 6,
++	.entry = {
++		{ 0, 52, FUSE_FSB },
++		{ 63, 1, FUSE_ELE},
++		{ 128, 16, FUSE_ELE },
++		{ 182, 1, FUSE_ELE },
++		{ 188, 1, FUSE_ELE },
++		{ 312, 200, FUSE_FSB }
++	},
++};
++
++static const struct of_device_id imx_ele_ocotp_dt_ids[] = {
++	{ .compatible = "fsl,imx93-ocotp", .data = &imx93_ocotp_data, },
++	{},
++};
++MODULE_DEVICE_TABLE(of, imx_ele_ocotp_dt_ids);
++
++static struct platform_driver imx_ele_ocotp_driver = {
++	.driver = {
++		.name = "imx_ele_ocotp",
++		.of_match_table = imx_ele_ocotp_dt_ids,
++	},
++	.probe = imx_ele_ocotp_probe,
++};
++module_platform_driver(imx_ele_ocotp_driver);
++
++MODULE_DESCRIPTION("i.MX OCOTP/ELE driver");
++MODULE_AUTHOR("Peng Fan <peng.fan@nxp.com>");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/generic/backport-6.1/813-v6.5-0011-nvmem-core-add-support-for-fixed-cells-layout.patch b/target/linux/generic/backport-6.1/813-v6.5-0011-nvmem-core-add-support-for-fixed-cells-layout.patch
new file mode 100644
index 00000000000000..59b2f9fa2c6707
--- /dev/null
+++ b/target/linux/generic/backport-6.1/813-v6.5-0011-nvmem-core-add-support-for-fixed-cells-layout.patch
@@ -0,0 +1,96 @@
+From 27f699e578b1a72df89dfa3bc42e093a01dc8d10 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Sun, 11 Jun 2023 15:03:29 +0100
+Subject: [PATCH] nvmem: core: add support for fixed cells *layout*
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This adds support for the "fixed-layout" NVMEM layout binding. It allows
+defining NVMEM cells in a layout DT node named "nvmem-layout".
+
+While NVMEM subsystem supports layout drivers it has been discussed that
+"fixed-layout" may actually be supperted internally. It's because:
+1. It's a very basic layout
+2. It allows sharing code with legacy syntax parsing
+3. It's safer for soc_device_match() due to -EPROBE_DEFER
+4. This will make the syntax transition easier
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-26-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c | 32 +++++++++++++++++++++++++++++---
+ 1 file changed, 29 insertions(+), 3 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -696,7 +696,7 @@ static int nvmem_validate_keepouts(struc
+ 	return 0;
+ }
+ 
+-static int nvmem_add_cells_from_of(struct nvmem_device *nvmem)
++static int nvmem_add_cells_from_dt(struct nvmem_device *nvmem, struct device_node *np)
+ {
+ 	struct nvmem_layout *layout = nvmem->layout;
+ 	struct device *dev = &nvmem->dev;
+@@ -704,7 +704,7 @@ static int nvmem_add_cells_from_of(struc
+ 	const __be32 *addr;
+ 	int len, ret;
+ 
+-	for_each_child_of_node(dev->of_node, child) {
++	for_each_child_of_node(np, child) {
+ 		struct nvmem_cell_info info = {0};
+ 
+ 		addr = of_get_property(child, "reg", &len);
+@@ -742,6 +742,28 @@ static int nvmem_add_cells_from_of(struc
+ 	return 0;
+ }
+ 
++static int nvmem_add_cells_from_legacy_of(struct nvmem_device *nvmem)
++{
++	return nvmem_add_cells_from_dt(nvmem, nvmem->dev.of_node);
++}
++
++static int nvmem_add_cells_from_fixed_layout(struct nvmem_device *nvmem)
++{
++	struct device_node *layout_np;
++	int err = 0;
++
++	layout_np = of_nvmem_layout_get_container(nvmem);
++	if (!layout_np)
++		return 0;
++
++	if (of_device_is_compatible(layout_np, "fixed-layout"))
++		err = nvmem_add_cells_from_dt(nvmem, layout_np);
++
++	of_node_put(layout_np);
++
++	return err;
++}
++
+ int __nvmem_layout_register(struct nvmem_layout *layout, struct module *owner)
+ {
+ 	layout->owner = owner;
+@@ -972,7 +994,7 @@ struct nvmem_device *nvmem_register(cons
+ 	if (rval)
+ 		goto err_remove_cells;
+ 
+-	rval = nvmem_add_cells_from_of(nvmem);
++	rval = nvmem_add_cells_from_legacy_of(nvmem);
+ 	if (rval)
+ 		goto err_remove_cells;
+ 
+@@ -982,6 +1004,10 @@ struct nvmem_device *nvmem_register(cons
+ 	if (rval)
+ 		goto err_remove_cells;
+ 
++	rval = nvmem_add_cells_from_fixed_layout(nvmem);
++	if (rval)
++		goto err_remove_cells;
++
+ 	rval = nvmem_add_cells_from_layout(nvmem);
+ 	if (rval)
+ 		goto err_remove_cells;
diff --git a/target/linux/generic/backport-6.1/827-v6.3-0001-of-base-add-of_parse_phandle_with_optional_args.patch b/target/linux/generic/backport-6.1/827-v6.3-0001-of-base-add-of_parse_phandle_with_optional_args.patch
new file mode 100644
index 00000000000000..f568c3f6ce5886
--- /dev/null
+++ b/target/linux/generic/backport-6.1/827-v6.3-0001-of-base-add-of_parse_phandle_with_optional_args.patch
@@ -0,0 +1,58 @@
+From c5d264d4b527c96ae8903376a4b195df47b05203 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Mon, 6 Feb 2023 13:43:43 +0000
+Subject: [PATCH] of: base: add of_parse_phandle_with_optional_args()
+
+Add a new variant of the of_parse_phandle_with_args() which treats the
+cells name as optional. If it's missing, it is assumed that the phandle
+has no arguments.
+
+Up until now, a nvmem node didn't have any arguments, so all the device
+trees haven't any '#*-cells' property. But there is a need for an
+additional argument for the phandle, for which we need a '#*-cells'
+property. Therefore, we need to support nvmem nodes with and without
+this property.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-10-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/of.h | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -1009,6 +1009,31 @@ static inline int of_parse_phandle_with_
+ }
+ 
+ /**
++ * of_parse_phandle_with_optional_args() - Find a node pointed by phandle in a list
++ * @np:		pointer to a device tree node containing a list
++ * @list_name:	property name that contains a list
++ * @cells_name:	property name that specifies phandles' arguments count
++ * @index:	index of a phandle to parse out
++ * @out_args:	optional pointer to output arguments structure (will be filled)
++ *
++ * Same as of_parse_phandle_with_args() except that if the cells_name property
++ * is not found, cell_count of 0 is assumed.
++ *
++ * This is used to useful, if you have a phandle which didn't have arguments
++ * before and thus doesn't have a '#*-cells' property but is now migrated to
++ * having arguments while retaining backwards compatibility.
++ */
++static inline int of_parse_phandle_with_optional_args(const struct device_node *np,
++						      const char *list_name,
++						      const char *cells_name,
++						      int index,
++						      struct of_phandle_args *out_args)
++{
++	return __of_parse_phandle_with_args(np, list_name, cells_name,
++					    0, index, out_args);
++}
++
++/**
+  * of_property_count_u8_elems - Count the number of u8 elements in a property
+  *
+  * @np:		device node from which the property value is to be read.
diff --git a/target/linux/generic/backport-6.1/827-v6.3-0002-of-property-make-.-cells-optional-for-simple-props.patch b/target/linux/generic/backport-6.1/827-v6.3-0002-of-property-make-.-cells-optional-for-simple-props.patch
new file mode 100644
index 00000000000000..c4f44b87a4d39d
--- /dev/null
+++ b/target/linux/generic/backport-6.1/827-v6.3-0002-of-property-make-.-cells-optional-for-simple-props.patch
@@ -0,0 +1,34 @@
+From ff24fed10ba414d19579e26e60b126fad2f2bb07 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Mon, 6 Feb 2023 13:43:44 +0000
+Subject: [PATCH] of: property: make #.*-cells optional for simple props
+
+Sometimes, future bindings for phandles will get additional arguments.
+Thus the target node of the phandle will need a new #.*-cells property.
+To be backwards compatible, this needs to be optional.
+
+Prepare the DEFINE_SIMPLE_PROPS() to handle the cells name as optional.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Tested-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-11-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/of/property.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/of/property.c
++++ b/drivers/of/property.c
+@@ -1202,8 +1202,8 @@ static struct device_node *parse_prop_ce
+ 	if (strcmp(prop_name, list_name))
+ 		return NULL;
+ 
+-	if (of_parse_phandle_with_args(np, list_name, cells_name, index,
+-				       &sup_args))
++	if (__of_parse_phandle_with_args(np, list_name, cells_name, 0, index,
++					 &sup_args))
+ 		return NULL;
+ 
+ 	return sup_args.np;
diff --git a/target/linux/generic/backport-6.1/827-v6.3-0003-of-property-add-nvmem-cell-cells-property.patch b/target/linux/generic/backport-6.1/827-v6.3-0003-of-property-add-nvmem-cell-cells-property.patch
new file mode 100644
index 00000000000000..c2b86de9b97dd1
--- /dev/null
+++ b/target/linux/generic/backport-6.1/827-v6.3-0003-of-property-add-nvmem-cell-cells-property.patch
@@ -0,0 +1,30 @@
+From e2d8172043d2e50df19fcd59c11e5593de8188d7 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Mon, 6 Feb 2023 13:43:45 +0000
+Subject: [PATCH] of: property: add #nvmem-cell-cells property
+
+Bindings describe the new '#nvmem-cell-cells' property. Now that the
+arguments count property is optional, we just add this property to the
+nvmem-cells.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Tested-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230206134356.839737-12-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/of/property.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/of/property.c
++++ b/drivers/of/property.c
+@@ -1307,7 +1307,7 @@ DEFINE_SIMPLE_PROP(dmas, "dmas", "#dma-c
+ DEFINE_SIMPLE_PROP(power_domains, "power-domains", "#power-domain-cells")
+ DEFINE_SIMPLE_PROP(hwlocks, "hwlocks", "#hwlock-cells")
+ DEFINE_SIMPLE_PROP(extcon, "extcon", NULL)
+-DEFINE_SIMPLE_PROP(nvmem_cells, "nvmem-cells", NULL)
++DEFINE_SIMPLE_PROP(nvmem_cells, "nvmem-cells", "#nvmem-cell-cells")
+ DEFINE_SIMPLE_PROP(phys, "phys", "#phy-cells")
+ DEFINE_SIMPLE_PROP(wakeup_parent, "wakeup-parent", NULL)
+ DEFINE_SIMPLE_PROP(pinctrl0, "pinctrl-0", NULL)
diff --git a/target/linux/generic/backport-6.1/827-v6.3-0004-of-device-Ignore-modalias-of-reused-nodes.patch b/target/linux/generic/backport-6.1/827-v6.3-0004-of-device-Ignore-modalias-of-reused-nodes.patch
new file mode 100644
index 00000000000000..8dc370618e6bce
--- /dev/null
+++ b/target/linux/generic/backport-6.1/827-v6.3-0004-of-device-Ignore-modalias-of-reused-nodes.patch
@@ -0,0 +1,37 @@
+From 553bd29700145e1849698985e9800f14e967da49 Mon Sep 17 00:00:00 2001
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+Date: Tue, 7 Feb 2023 12:05:29 +0100
+Subject: [PATCH] of: device: Ignore modalias of reused nodes
+
+If of_node is reused, do not use that node's modalias. This will hide
+the name of the actual device. This is rather prominent in USB glue
+drivers creating a platform device for the host controller.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20230207110531.1060252-2-alexander.stein@ew.tq-group.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/of/device.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -256,7 +256,7 @@ static ssize_t of_device_get_modalias(st
+ 	ssize_t csize;
+ 	ssize_t tsize;
+ 
+-	if ((!dev) || (!dev->of_node))
++	if ((!dev) || (!dev->of_node) || dev->of_node_reused)
+ 		return -ENODEV;
+ 
+ 	/* Name & Type */
+@@ -379,7 +379,7 @@ int of_device_uevent_modalias(struct dev
+ {
+ 	int sl;
+ 
+-	if ((!dev) || (!dev->of_node))
++	if ((!dev) || (!dev->of_node) || dev->of_node_reused)
+ 		return -ENODEV;
+ 
+ 	/* Devicetree modalias is tricky, we add it in 2 steps */
diff --git a/target/linux/generic/backport-6.1/827-v6.3-0005-of-device-Do-not-ignore-error-code-in-of_device_ueve.patch b/target/linux/generic/backport-6.1/827-v6.3-0005-of-device-Do-not-ignore-error-code-in-of_device_ueve.patch
new file mode 100644
index 00000000000000..dcdc2313ba6ab3
--- /dev/null
+++ b/target/linux/generic/backport-6.1/827-v6.3-0005-of-device-Do-not-ignore-error-code-in-of_device_ueve.patch
@@ -0,0 +1,29 @@
+From 2295bed9bebe8d1eef276194fed5b5fbe89c5363 Mon Sep 17 00:00:00 2001
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+Date: Tue, 7 Feb 2023 12:05:30 +0100
+Subject: [PATCH] of: device: Do not ignore error code in
+ of_device_uevent_modalias
+
+of_device_get_modalias might return an error code, propagate that one.
+Otherwise the negative, signed integer is propagated to unsigned integer
+for the comparison resulting in a huge 'sl' size.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20230207110531.1060252-3-alexander.stein@ew.tq-group.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/of/device.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -388,6 +388,8 @@ int of_device_uevent_modalias(struct dev
+ 
+ 	sl = of_device_get_modalias(dev, &env->buf[env->buflen-1],
+ 				    sizeof(env->buf) - env->buflen);
++	if (sl < 0)
++		return sl;
+ 	if (sl >= (sizeof(env->buf) - env->buflen))
+ 		return -ENOMEM;
+ 	env->buflen += sl;
diff --git a/target/linux/generic/backport-6.1/828-v6.4-0002-of-Update-of_device_get_modalias.patch b/target/linux/generic/backport-6.1/828-v6.4-0002-of-Update-of_device_get_modalias.patch
new file mode 100644
index 00000000000000..280ed9085c7a80
--- /dev/null
+++ b/target/linux/generic/backport-6.1/828-v6.4-0002-of-Update-of_device_get_modalias.patch
@@ -0,0 +1,103 @@
+From 5c3d15e127ebfc0754cd18def7124633b6d46672 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:15 +0100
+Subject: [PATCH] of: Update of_device_get_modalias()
+
+This function only needs a "struct device_node" to work, but for
+convenience the author (and only user) of this helper did use a "struct
+device" and put it in device.c.
+
+Let's convert this helper to take a "struct device node" instead. This
+change asks for two additional changes: renaming it "of_modalias()"
+to fit the current naming, and moving it outside of device.c which will
+be done in a follow-up commit.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-8-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/of/device.c | 29 +++++++++++++++++------------
+ 1 file changed, 17 insertions(+), 12 deletions(-)
+
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -248,7 +248,7 @@ const void *of_device_get_match_data(con
+ }
+ EXPORT_SYMBOL(of_device_get_match_data);
+ 
+-static ssize_t of_device_get_modalias(struct device *dev, char *str, ssize_t len)
++static ssize_t of_modalias(const struct device_node *np, char *str, ssize_t len)
+ {
+ 	const char *compat;
+ 	char *c;
+@@ -256,19 +256,16 @@ static ssize_t of_device_get_modalias(st
+ 	ssize_t csize;
+ 	ssize_t tsize;
+ 
+-	if ((!dev) || (!dev->of_node) || dev->of_node_reused)
+-		return -ENODEV;
+-
+ 	/* Name & Type */
+ 	/* %p eats all alphanum characters, so %c must be used here */
+-	csize = snprintf(str, len, "of:N%pOFn%c%s", dev->of_node, 'T',
+-			 of_node_get_device_type(dev->of_node));
++	csize = snprintf(str, len, "of:N%pOFn%c%s", np, 'T',
++			 of_node_get_device_type(np));
+ 	tsize = csize;
+ 	len -= csize;
+ 	if (str)
+ 		str += csize;
+ 
+-	of_property_for_each_string(dev->of_node, "compatible", p, compat) {
++	of_property_for_each_string(np, "compatible", p, compat) {
+ 		csize = strlen(compat) + 1;
+ 		tsize += csize;
+ 		if (csize > len)
+@@ -293,7 +290,10 @@ int of_device_request_module(struct devi
+ 	ssize_t size;
+ 	int ret;
+ 
+-	size = of_device_get_modalias(dev, NULL, 0);
++	if (!dev || !dev->of_node)
++		return -ENODEV;
++
++	size = of_modalias(dev->of_node, NULL, 0);
+ 	if (size < 0)
+ 		return size;
+ 
+@@ -304,7 +304,7 @@ int of_device_request_module(struct devi
+ 	if (!str)
+ 		return -ENOMEM;
+ 
+-	of_device_get_modalias(dev, str, size);
++	of_modalias(dev->of_node, str, size);
+ 	str[size - 1] = '\0';
+ 	ret = request_module(str);
+ 	kfree(str);
+@@ -321,7 +321,12 @@ EXPORT_SYMBOL_GPL(of_device_request_modu
+  */
+ ssize_t of_device_modalias(struct device *dev, char *str, ssize_t len)
+ {
+-	ssize_t sl = of_device_get_modalias(dev, str, len - 2);
++	ssize_t sl;
++
++	if (!dev || !dev->of_node || dev->of_node_reused)
++		return -ENODEV;
++
++	sl = of_modalias(dev->of_node, str, len - 2);
+ 	if (sl < 0)
+ 		return sl;
+ 	if (sl > len - 2)
+@@ -386,8 +391,8 @@ int of_device_uevent_modalias(struct dev
+ 	if (add_uevent_var(env, "MODALIAS="))
+ 		return -ENOMEM;
+ 
+-	sl = of_device_get_modalias(dev, &env->buf[env->buflen-1],
+-				    sizeof(env->buf) - env->buflen);
++	sl = of_modalias(dev->of_node, &env->buf[env->buflen-1],
++			 sizeof(env->buf) - env->buflen);
+ 	if (sl < 0)
+ 		return sl;
+ 	if (sl >= (sizeof(env->buf) - env->buflen))
diff --git a/target/linux/generic/backport-6.1/828-v6.4-0003-of-Rename-of_modalias_node.patch b/target/linux/generic/backport-6.1/828-v6.4-0003-of-Rename-of_modalias_node.patch
new file mode 100644
index 00000000000000..f82dc1428aa552
--- /dev/null
+++ b/target/linux/generic/backport-6.1/828-v6.4-0003-of-Rename-of_modalias_node.patch
@@ -0,0 +1,173 @@
+From 673aa1ed1c9b6710bf24e3f0957d85e2f46c77db Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:16 +0100
+Subject: [PATCH] of: Rename of_modalias_node()
+
+This helper does not produce a real modalias, but tries to get the
+"product" compatible part of the "vendor,product" compatibles only. It
+is far from creating a purely useful modalias string and does not seem
+to be used like that directly anyway, so let's try to give this helper a
+more meaningful name before moving there a real modalias helper (already
+existing under of/device.c).
+
+Also update the various documentations to refer to the strings as
+"aliases" rather than "modaliases" which has a real meaning in the Linux
+kernel.
+
+There is no functional change.
+
+Cc: Rafael J. Wysocki <rafael@kernel.org>
+Cc: Len Brown <lenb@kernel.org>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Maxime Ripard <mripard@kernel.org>
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Cc: Sebastian Reichel <sre@kernel.org>
+Cc: Wolfram Sang <wsa@kernel.org>
+Cc: Mark Brown <broonie@kernel.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Acked-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Acked-by: Sebastian Reichel <sre@kernel.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-9-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/bus.c                |  7 ++++---
+ drivers/gpu/drm/drm_mipi_dsi.c    |  2 +-
+ drivers/hsi/hsi_core.c            |  2 +-
+ drivers/i2c/busses/i2c-powermac.c |  2 +-
+ drivers/i2c/i2c-core-of.c         |  2 +-
+ drivers/of/base.c                 | 18 +++++++++++-------
+ drivers/spi/spi.c                 |  4 ++--
+ include/linux/of.h                |  3 ++-
+ 8 files changed, 23 insertions(+), 17 deletions(-)
+
+--- a/drivers/acpi/bus.c
++++ b/drivers/acpi/bus.c
+@@ -806,9 +806,10 @@ static bool acpi_of_modalias(struct acpi
+  * @modalias:   Pointer to buffer that modalias value will be copied into
+  * @len:	Length of modalias buffer
+  *
+- * This is a counterpart of of_modalias_node() for struct acpi_device objects.
+- * If there is a compatible string for @adev, it will be copied to @modalias
+- * with the vendor prefix stripped; otherwise, @default_id will be used.
++ * This is a counterpart of of_alias_from_compatible() for struct acpi_device
++ * objects. If there is a compatible string for @adev, it will be copied to
++ * @modalias with the vendor prefix stripped; otherwise, @default_id will be
++ * used.
+  */
+ void acpi_set_modalias(struct acpi_device *adev, const char *default_id,
+ 		       char *modalias, size_t len)
+--- a/drivers/gpu/drm/drm_mipi_dsi.c
++++ b/drivers/gpu/drm/drm_mipi_dsi.c
+@@ -160,7 +160,7 @@ of_mipi_dsi_device_add(struct mipi_dsi_h
+ 	int ret;
+ 	u32 reg;
+ 
+-	if (of_modalias_node(node, info.type, sizeof(info.type)) < 0) {
++	if (of_alias_from_compatible(node, info.type, sizeof(info.type)) < 0) {
+ 		drm_err(host, "modalias failure on %pOF\n", node);
+ 		return ERR_PTR(-EINVAL);
+ 	}
+--- a/drivers/hsi/hsi_core.c
++++ b/drivers/hsi/hsi_core.c
+@@ -207,7 +207,7 @@ static void hsi_add_client_from_dt(struc
+ 	if (!cl)
+ 		return;
+ 
+-	err = of_modalias_node(client, name, sizeof(name));
++	err = of_alias_from_compatible(client, name, sizeof(name));
+ 	if (err)
+ 		goto err;
+ 
+--- a/drivers/i2c/busses/i2c-powermac.c
++++ b/drivers/i2c/busses/i2c-powermac.c
+@@ -284,7 +284,7 @@ static bool i2c_powermac_get_type(struct
+ 	 */
+ 
+ 	/* First try proper modalias */
+-	if (of_modalias_node(node, tmp, sizeof(tmp)) >= 0) {
++	if (of_alias_from_compatible(node, tmp, sizeof(tmp)) >= 0) {
+ 		snprintf(type, type_size, "MAC,%s", tmp);
+ 		return true;
+ 	}
+--- a/drivers/i2c/i2c-core-of.c
++++ b/drivers/i2c/i2c-core-of.c
+@@ -27,7 +27,7 @@ int of_i2c_get_board_info(struct device
+ 
+ 	memset(info, 0, sizeof(*info));
+ 
+-	if (of_modalias_node(node, info->type, sizeof(info->type)) < 0) {
++	if (of_alias_from_compatible(node, info->type, sizeof(info->type)) < 0) {
+ 		dev_err(dev, "of_i2c: modalias failure on %pOF\n", node);
+ 		return -EINVAL;
+ 	}
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -1208,19 +1208,23 @@ struct device_node *of_find_matching_nod
+ EXPORT_SYMBOL(of_find_matching_node_and_match);
+ 
+ /**
+- * of_modalias_node - Lookup appropriate modalias for a device node
++ * of_alias_from_compatible - Lookup appropriate alias for a device node
++ *			      depending on compatible
+  * @node:	pointer to a device tree node
+- * @modalias:	Pointer to buffer that modalias value will be copied into
+- * @len:	Length of modalias value
++ * @alias:	Pointer to buffer that alias value will be copied into
++ * @len:	Length of alias value
+  *
+  * Based on the value of the compatible property, this routine will attempt
+- * to choose an appropriate modalias value for a particular device tree node.
++ * to choose an appropriate alias value for a particular device tree node.
+  * It does this by stripping the manufacturer prefix (as delimited by a ',')
+  * from the first entry in the compatible list property.
+  *
++ * Note: The matching on just the "product" side of the compatible is a relic
++ * from I2C and SPI. Please do not add any new user.
++ *
+  * Return: This routine returns 0 on success, <0 on failure.
+  */
+-int of_modalias_node(struct device_node *node, char *modalias, int len)
++int of_alias_from_compatible(const struct device_node *node, char *alias, int len)
+ {
+ 	const char *compatible, *p;
+ 	int cplen;
+@@ -1229,10 +1233,10 @@ int of_modalias_node(struct device_node
+ 	if (!compatible || strlen(compatible) > cplen)
+ 		return -ENODEV;
+ 	p = strchr(compatible, ',');
+-	strscpy(modalias, p ? p + 1 : compatible, len);
++	strscpy(alias, p ? p + 1 : compatible, len);
+ 	return 0;
+ }
+-EXPORT_SYMBOL_GPL(of_modalias_node);
++EXPORT_SYMBOL_GPL(of_alias_from_compatible);
+ 
+ /**
+  * of_find_node_by_phandle - Find a node given a phandle
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -2315,8 +2315,8 @@ of_register_spi_device(struct spi_contro
+ 	}
+ 
+ 	/* Select device driver */
+-	rc = of_modalias_node(nc, spi->modalias,
+-				sizeof(spi->modalias));
++	rc = of_alias_from_compatible(nc, spi->modalias,
++				      sizeof(spi->modalias));
+ 	if (rc < 0) {
+ 		dev_err(&ctlr->dev, "cannot find modalias for %pOF\n", nc);
+ 		goto err_out;
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -362,7 +362,8 @@ extern int of_n_addr_cells(struct device
+ extern int of_n_size_cells(struct device_node *np);
+ extern const struct of_device_id *of_match_node(
+ 	const struct of_device_id *matches, const struct device_node *node);
+-extern int of_modalias_node(struct device_node *node, char *modalias, int len);
++extern int of_alias_from_compatible(const struct device_node *node, char *alias,
++				    int len);
+ extern void of_print_phandle_args(const char *msg, const struct of_phandle_args *args);
+ extern int __of_parse_phandle_with_args(const struct device_node *np,
+ 	const char *list_name, const char *cells_name, int cell_count,
diff --git a/target/linux/generic/backport-6.1/828-v6.4-0004-of-Move-of_modalias-to-module.c.patch b/target/linux/generic/backport-6.1/828-v6.4-0004-of-Move-of_modalias-to-module.c.patch
new file mode 100644
index 00000000000000..39a84161a27c75
--- /dev/null
+++ b/target/linux/generic/backport-6.1/828-v6.4-0004-of-Move-of_modalias-to-module.c.patch
@@ -0,0 +1,160 @@
+From bd7a7ed774afd1a4174df34227626c95573be517 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:17 +0100
+Subject: [PATCH] of: Move of_modalias() to module.c
+
+Create a specific .c file for OF related module handling.
+Move of_modalias() inside as a first step.
+
+The helper is exposed through of.h even though it is only used by core
+files because the users from device.c will soon be split into an OF-only
+helper in module.c as well as a device-oriented inline helper in
+of_device.h. Putting this helper in of_private.h would require to
+include of_private.h from of_device.h, which is not acceptable.
+
+Suggested-by: Rob Herring <robh+dt@kernel.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-10-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/of/Makefile |  2 +-
+ drivers/of/device.c | 37 -------------------------------------
+ drivers/of/module.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
+ include/linux/of.h  |  9 +++++++++
+ 4 files changed, 54 insertions(+), 38 deletions(-)
+ create mode 100644 drivers/of/module.c
+
+--- a/drivers/of/Makefile
++++ b/drivers/of/Makefile
+@@ -1,5 +1,5 @@
+ # SPDX-License-Identifier: GPL-2.0
+-obj-y = base.o device.o platform.o property.o
++obj-y = base.o device.o module.o platform.o property.o
+ obj-$(CONFIG_OF_KOBJ) += kobj.o
+ obj-$(CONFIG_OF_DYNAMIC) += dynamic.o
+ obj-$(CONFIG_OF_FLATTREE) += fdt.o
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -1,5 +1,4 @@
+ // SPDX-License-Identifier: GPL-2.0
+-#include <linux/string.h>
+ #include <linux/kernel.h>
+ #include <linux/of.h>
+ #include <linux/of_device.h>
+@@ -248,42 +247,6 @@ const void *of_device_get_match_data(con
+ }
+ EXPORT_SYMBOL(of_device_get_match_data);
+ 
+-static ssize_t of_modalias(const struct device_node *np, char *str, ssize_t len)
+-{
+-	const char *compat;
+-	char *c;
+-	struct property *p;
+-	ssize_t csize;
+-	ssize_t tsize;
+-
+-	/* Name & Type */
+-	/* %p eats all alphanum characters, so %c must be used here */
+-	csize = snprintf(str, len, "of:N%pOFn%c%s", np, 'T',
+-			 of_node_get_device_type(np));
+-	tsize = csize;
+-	len -= csize;
+-	if (str)
+-		str += csize;
+-
+-	of_property_for_each_string(np, "compatible", p, compat) {
+-		csize = strlen(compat) + 1;
+-		tsize += csize;
+-		if (csize > len)
+-			continue;
+-
+-		csize = snprintf(str, len, "C%s", compat);
+-		for (c = str; c; ) {
+-			c = strchr(c, ' ');
+-			if (c)
+-				*c++ = '_';
+-		}
+-		len -= csize;
+-		str += csize;
+-	}
+-
+-	return tsize;
+-}
+-
+ int of_device_request_module(struct device *dev)
+ {
+ 	char *str;
+--- /dev/null
++++ b/drivers/of/module.c
+@@ -0,0 +1,44 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Linux kernel module helpers.
++ */
++
++#include <linux/of.h>
++#include <linux/slab.h>
++#include <linux/string.h>
++
++ssize_t of_modalias(const struct device_node *np, char *str, ssize_t len)
++{
++	const char *compat;
++	char *c;
++	struct property *p;
++	ssize_t csize;
++	ssize_t tsize;
++
++	/* Name & Type */
++	/* %p eats all alphanum characters, so %c must be used here */
++	csize = snprintf(str, len, "of:N%pOFn%c%s", np, 'T',
++			 of_node_get_device_type(np));
++	tsize = csize;
++	len -= csize;
++	if (str)
++		str += csize;
++
++	of_property_for_each_string(np, "compatible", p, compat) {
++		csize = strlen(compat) + 1;
++		tsize += csize;
++		if (csize > len)
++			continue;
++
++		csize = snprintf(str, len, "C%s", compat);
++		for (c = str; c; ) {
++			c = strchr(c, ' ');
++			if (c)
++				*c++ = '_';
++		}
++		len -= csize;
++		str += csize;
++	}
++
++	return tsize;
++}
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -374,6 +374,9 @@ extern int of_parse_phandle_with_args_ma
+ extern int of_count_phandle_with_args(const struct device_node *np,
+ 	const char *list_name, const char *cells_name);
+ 
++/* module functions */
++extern ssize_t of_modalias(const struct device_node *np, char *str, ssize_t len);
++
+ /* phandle iterator functions */
+ extern int of_phandle_iterator_init(struct of_phandle_iterator *it,
+ 				    const struct device_node *np,
+@@ -731,6 +734,12 @@ static inline int of_count_phandle_with_
+ 	return -ENOSYS;
+ }
+ 
++static inline ssize_t of_modalias(const struct device_node *np, char *str,
++				  ssize_t len)
++{
++	return -ENODEV;
++}
++
+ static inline int of_phandle_iterator_init(struct of_phandle_iterator *it,
+ 					   const struct device_node *np,
+ 					   const char *list_name,
diff --git a/target/linux/generic/backport-6.1/828-v6.4-0005-of-Move-the-request-module-helper-logic-to-module.c.patch b/target/linux/generic/backport-6.1/828-v6.4-0005-of-Move-the-request-module-helper-logic-to-module.c.patch
new file mode 100644
index 00000000000000..046c1df5615f62
--- /dev/null
+++ b/target/linux/generic/backport-6.1/828-v6.4-0005-of-Move-the-request-module-helper-logic-to-module.c.patch
@@ -0,0 +1,131 @@
+From e6506f06d5e82765666902ccf9e9162f3e31d518 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 4 Apr 2023 18:21:18 +0100
+Subject: [PATCH] of: Move the request module helper logic to module.c
+
+Depending on device.c for pure OF handling is considered
+backwards. Let's extract the content of of_device_request_module() to
+have the real logic under module.c.
+
+The next step will be to convert users of of_device_request_module() to
+use the new helper.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-11-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/of/device.c | 25 ++-----------------------
+ drivers/of/module.c | 30 ++++++++++++++++++++++++++++++
+ include/linux/of.h  |  6 ++++++
+ 3 files changed, 38 insertions(+), 23 deletions(-)
+
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -8,7 +8,6 @@
+ #include <linux/dma-direct.h> /* for bus_dma_region */
+ #include <linux/dma-map-ops.h>
+ #include <linux/init.h>
+-#include <linux/module.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/slab.h>
+ #include <linux/platform_device.h>
+@@ -249,30 +248,10 @@ EXPORT_SYMBOL(of_device_get_match_data);
+ 
+ int of_device_request_module(struct device *dev)
+ {
+-	char *str;
+-	ssize_t size;
+-	int ret;
+-
+-	if (!dev || !dev->of_node)
++	if (!dev)
+ 		return -ENODEV;
+ 
+-	size = of_modalias(dev->of_node, NULL, 0);
+-	if (size < 0)
+-		return size;
+-
+-	/* Reserve an additional byte for the trailing '\0' */
+-	size++;
+-
+-	str = kmalloc(size, GFP_KERNEL);
+-	if (!str)
+-		return -ENOMEM;
+-
+-	of_modalias(dev->of_node, str, size);
+-	str[size - 1] = '\0';
+-	ret = request_module(str);
+-	kfree(str);
+-
+-	return ret;
++	return of_request_module(dev->of_node);
+ }
+ EXPORT_SYMBOL_GPL(of_device_request_module);
+ 
+--- a/drivers/of/module.c
++++ b/drivers/of/module.c
+@@ -4,6 +4,7 @@
+  */
+ 
+ #include <linux/of.h>
++#include <linux/module.h>
+ #include <linux/slab.h>
+ #include <linux/string.h>
+ 
+@@ -42,3 +43,32 @@ ssize_t of_modalias(const struct device_
+ 
+ 	return tsize;
+ }
++
++int of_request_module(const struct device_node *np)
++{
++	char *str;
++	ssize_t size;
++	int ret;
++
++	if (!np)
++		return -ENODEV;
++
++	size = of_modalias(np, NULL, 0);
++	if (size < 0)
++		return size;
++
++	/* Reserve an additional byte for the trailing '\0' */
++	size++;
++
++	str = kmalloc(size, GFP_KERNEL);
++	if (!str)
++		return -ENOMEM;
++
++	of_modalias(np, str, size);
++	str[size - 1] = '\0';
++	ret = request_module(str);
++	kfree(str);
++
++	return ret;
++}
++EXPORT_SYMBOL_GPL(of_request_module);
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -376,6 +376,7 @@ extern int of_count_phandle_with_args(co
+ 
+ /* module functions */
+ extern ssize_t of_modalias(const struct device_node *np, char *str, ssize_t len);
++extern int of_request_module(const struct device_node *np);
+ 
+ /* phandle iterator functions */
+ extern int of_phandle_iterator_init(struct of_phandle_iterator *it,
+@@ -739,6 +740,11 @@ static inline ssize_t of_modalias(const
+ {
+ 	return -ENODEV;
+ }
++
++static inline int of_request_module(const struct device_node *np)
++{
++	return -ENODEV;
++}
+ 
+ static inline int of_phandle_iterator_init(struct of_phandle_iterator *it,
+ 					   const struct device_node *np,
diff --git a/target/linux/generic/backport-6.1/830-00-v6.2-dt-bindings-arm-qcom-document-qcom-msm-id-and-qcom-b.patch b/target/linux/generic/backport-6.1/830-00-v6.2-dt-bindings-arm-qcom-document-qcom-msm-id-and-qcom-b.patch
new file mode 100644
index 00000000000000..3319f431baccac
--- /dev/null
+++ b/target/linux/generic/backport-6.1/830-00-v6.2-dt-bindings-arm-qcom-document-qcom-msm-id-and-qcom-b.patch
@@ -0,0 +1,207 @@
+From 77faa07c185c969e742cbb3e6aa487a11b0b616c Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Tue, 30 Aug 2022 09:57:42 +0300
+Subject: [PATCH] dt-bindings: arm: qcom: document qcom,msm-id and
+ qcom,board-id
+
+The top level qcom,msm-id and qcom,board-id properties are utilized by
+bootloaders on Qualcomm MSM platforms to determine which device tree
+should be used and passed to the kernel.
+
+The commit b32e592d3c28 ("devicetree: bindings: Document qcom board
+compatible format") from 2015 was a consensus during discussion about
+upstreaming qcom,msm-id and qcom,board-id fields.  There are however still
+problems with that consensus:
+1. It was reached 7 years ago but it turned out its implementation did
+   not reach all possible products.
+
+2. Initially additional tool (dtbTool) was needed for parsing these
+   fields to create a QCDT image consisting of multiple DTBs, later the
+   bootloaders were improved and they use these qcom,msm-id and
+   qcom,board-id properties directly.
+
+3. Extracting relevant information from the board compatible requires
+   this additional tool (dtbTool), which makes the build process more
+   complicated and not easily reproducible (DTBs are modified after the
+   kernel build).
+
+4. Some versions of Qualcomm bootloaders expect these properties even
+   when booting with a single DTB.  The community is stuck with these
+   bootloaders thus they require properties in the DTBs.
+
+Since several upstreamed Qualcomm SoC-based boards require these
+properties to properly boot and the properties are reportedly used by
+bootloaders, document them along with the bindings header with constants
+used by: bootloader, some DTS and socinfo driver.
+
+Link: https://lore.kernel.org/r/a3c932d1-a102-ce18-deea-18cbbd05ecab@linaro.org/
+Co-developed-by: Kumar Gala <galak@codeaurora.org>
+Signed-off-by: Kumar Gala <galak@codeaurora.org>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220830065744.161163-2-krzysztof.kozlowski@linaro.org
+---
+ include/dt-bindings/arm/qcom,ids.h | 155 +++++++++++++++++++++++++++++
+ 1 file changed, 155 insertions(+)
+ create mode 100644 include/dt-bindings/arm/qcom,ids.h
+
+--- /dev/null
++++ b/include/dt-bindings/arm/qcom,ids.h
+@@ -0,0 +1,155 @@
++/* SPDX-License-Identifier: GPL-2.0-only OR BSD-2-Clause */
++/*
++ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
++ * Copyright (c) 2022 Linaro Ltd
++ * Author: Krzysztof Kozlowski <krzk@kernel.org> based on previous work of Kumar Gala.
++ */
++#ifndef _DT_BINDINGS_ARM_QCOM_IDS_H
++#define _DT_BINDINGS_ARM_QCOM_IDS_H
++
++/*
++ * The MSM chipset and hardware revision used by Qualcomm bootloaders, DTS for
++ * older chipsets (qcom,msm-id) and in socinfo driver:
++ */
++#define QCOM_ID_MSM8960			87
++#define QCOM_ID_APQ8064			109
++#define QCOM_ID_MSM8660A		122
++#define QCOM_ID_MSM8260A		123
++#define QCOM_ID_APQ8060A		124
++#define QCOM_ID_MSM8974			126
++#define QCOM_ID_MPQ8064			130
++#define QCOM_ID_MSM8960AB		138
++#define QCOM_ID_APQ8060AB		139
++#define QCOM_ID_MSM8260AB		140
++#define QCOM_ID_MSM8660AB		141
++#define QCOM_ID_MSM8626			145
++#define QCOM_ID_MSM8610			147
++#define QCOM_ID_APQ8064AB		153
++#define QCOM_ID_MSM8226			158
++#define QCOM_ID_MSM8526			159
++#define QCOM_ID_MSM8110			161
++#define QCOM_ID_MSM8210			162
++#define QCOM_ID_MSM8810			163
++#define QCOM_ID_MSM8212			164
++#define QCOM_ID_MSM8612			165
++#define QCOM_ID_MSM8112			166
++#define QCOM_ID_MSM8225Q		168
++#define QCOM_ID_MSM8625Q		169
++#define QCOM_ID_MSM8125Q		170
++#define QCOM_ID_APQ8064AA		172
++#define QCOM_ID_APQ8084			178
++#define QCOM_ID_APQ8074			184
++#define QCOM_ID_MSM8274			185
++#define QCOM_ID_MSM8674			186
++#define QCOM_ID_MSM8974PRO_AC		194
++#define QCOM_ID_MSM8126			198
++#define QCOM_ID_APQ8026			199
++#define QCOM_ID_MSM8926			200
++#define QCOM_ID_MSM8326			205
++#define QCOM_ID_MSM8916			206
++#define QCOM_ID_MSM8994			207
++#define QCOM_ID_APQ8074PRO_AA		208
++#define QCOM_ID_APQ8074PRO_AB		209
++#define QCOM_ID_APQ8074PRO_AC		210
++#define QCOM_ID_MSM8274PRO_AA		211
++#define QCOM_ID_MSM8274PRO_AB		212
++#define QCOM_ID_MSM8274PRO_AC		213
++#define QCOM_ID_MSM8674PRO_AA		214
++#define QCOM_ID_MSM8674PRO_AB		215
++#define QCOM_ID_MSM8674PRO_AC		216
++#define QCOM_ID_MSM8974PRO_AA		217
++#define QCOM_ID_MSM8974PRO_AB		218
++#define QCOM_ID_APQ8028			219
++#define QCOM_ID_MSM8128			220
++#define QCOM_ID_MSM8228			221
++#define QCOM_ID_MSM8528			222
++#define QCOM_ID_MSM8628			223
++#define QCOM_ID_MSM8928			224
++#define QCOM_ID_MSM8510			225
++#define QCOM_ID_MSM8512			226
++#define QCOM_ID_MSM8936			233
++#define QCOM_ID_MSM8939			239
++#define QCOM_ID_APQ8036			240
++#define QCOM_ID_APQ8039			241
++#define QCOM_ID_MSM8996			246
++#define QCOM_ID_APQ8016			247
++#define QCOM_ID_MSM8216			248
++#define QCOM_ID_MSM8116			249
++#define QCOM_ID_MSM8616			250
++#define QCOM_ID_MSM8992			251
++#define QCOM_ID_APQ8094			253
++#define QCOM_ID_MDM9607			290
++#define QCOM_ID_APQ8096			291
++#define QCOM_ID_MSM8998			292
++#define QCOM_ID_MSM8953			293
++#define QCOM_ID_MDM8207			296
++#define QCOM_ID_MDM9207			297
++#define QCOM_ID_MDM9307			298
++#define QCOM_ID_MDM9628			299
++#define QCOM_ID_APQ8053			304
++#define QCOM_ID_MSM8996SG		305
++#define QCOM_ID_MSM8996AU		310
++#define QCOM_ID_APQ8096AU		311
++#define QCOM_ID_APQ8096SG		312
++#define QCOM_ID_SDM660			317
++#define QCOM_ID_SDM630			318
++#define QCOM_ID_APQ8098			319
++#define QCOM_ID_SDM845			321
++#define QCOM_ID_MDM9206			322
++#define QCOM_ID_IPQ8074			323
++#define QCOM_ID_SDA660			324
++#define QCOM_ID_SDM658			325
++#define QCOM_ID_SDA658			326
++#define QCOM_ID_SDA630			327
++#define QCOM_ID_SDM450			338
++#define QCOM_ID_SDA845			341
++#define QCOM_ID_IPQ8072			342
++#define QCOM_ID_IPQ8076			343
++#define QCOM_ID_IPQ8078			344
++#define QCOM_ID_SDM636			345
++#define QCOM_ID_SDA636			346
++#define QCOM_ID_SDM632			349
++#define QCOM_ID_SDA632			350
++#define QCOM_ID_SDA450			351
++#define QCOM_ID_SM8250			356
++#define QCOM_ID_IPQ8070			375
++#define QCOM_ID_IPQ8071			376
++#define QCOM_ID_IPQ8072A		389
++#define QCOM_ID_IPQ8074A		390
++#define QCOM_ID_IPQ8076A		391
++#define QCOM_ID_IPQ8078A		392
++#define QCOM_ID_SM6125			394
++#define QCOM_ID_IPQ8070A		395
++#define QCOM_ID_IPQ8071A		396
++#define QCOM_ID_IPQ6018			402
++#define QCOM_ID_IPQ6028			403
++#define QCOM_ID_IPQ6000			421
++#define QCOM_ID_IPQ6010			422
++#define QCOM_ID_SC7180			425
++#define QCOM_ID_SM6350			434
++#define QCOM_ID_SM8350			439
++#define QCOM_ID_SC8280XP		449
++#define QCOM_ID_IPQ6005			453
++#define QCOM_ID_QRB5165			455
++#define QCOM_ID_SM8450			457
++#define QCOM_ID_SM7225			459
++#define QCOM_ID_SA8295P			460
++#define QCOM_ID_SA8540P			461
++#define QCOM_ID_SM8450_2		480
++#define QCOM_ID_SM8450_3		482
++#define QCOM_ID_SC7280			487
++#define QCOM_ID_SC7180P			495
++#define QCOM_ID_SM6375			507
++
++/*
++ * The board type and revision information, used by Qualcomm bootloaders and
++ * DTS for older chipsets (qcom,board-id):
++ */
++#define QCOM_BOARD_ID(a, major, minor) \
++	(((major & 0xff) << 16) | ((minor & 0xff) << 8) | QCOM_BOARD_ID_##a)
++
++#define QCOM_BOARD_ID_MTP			8
++#define QCOM_BOARD_ID_DRAGONBOARD		10
++#define QCOM_BOARD_ID_SBC			24
++
++#endif /* _DT_BINDINGS_ARM_QCOM_IDS_H */
diff --git a/target/linux/generic/backport-6.1/830-01-v6.5-soc-qcom-socinfo-move-SMEM-item-struct-and-defines-t.patch b/target/linux/generic/backport-6.1/830-01-v6.5-soc-qcom-socinfo-move-SMEM-item-struct-and-defines-t.patch
new file mode 100644
index 00000000000000..394087a27a4d5e
--- /dev/null
+++ b/target/linux/generic/backport-6.1/830-01-v6.5-soc-qcom-socinfo-move-SMEM-item-struct-and-defines-t.patch
@@ -0,0 +1,171 @@
+From 7cbff3c3f867ff3b24de674f44ca03f54e416a37 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Sat, 31 Dec 2022 00:27:42 +0100
+Subject: [PATCH] soc: qcom: socinfo: move SMEM item struct and defines to a
+ header
+
+Move SMEM item struct and related defines to a header in order to be able
+to reuse them in the Qualcomm NVMEM CPUFreq driver instead of duplicating
+them.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230526204802.3081168-1-robimarko@gmail.com
+---
+ drivers/soc/qcom/socinfo.c       | 58 +--------------------------
+ include/linux/soc/qcom/socinfo.h | 67 ++++++++++++++++++++++++++++++++
+ 2 files changed, 68 insertions(+), 57 deletions(-)
+ create mode 100644 include/linux/soc/qcom/socinfo.h
+
+--- a/drivers/soc/qcom/socinfo.c
++++ b/drivers/soc/qcom/socinfo.c
+@@ -11,6 +11,7 @@
+ #include <linux/random.h>
+ #include <linux/slab.h>
+ #include <linux/soc/qcom/smem.h>
++#include <linux/soc/qcom/socinfo.h>
+ #include <linux/string.h>
+ #include <linux/sys_soc.h>
+ #include <linux/types.h>
+@@ -25,15 +26,6 @@
+ #define SOCINFO_MINOR(ver) ((ver) & 0xffff)
+ #define SOCINFO_VERSION(maj, min)  ((((maj) & 0xffff) << 16)|((min) & 0xffff))
+ 
+-#define SMEM_SOCINFO_BUILD_ID_LENGTH           32
+-#define SMEM_SOCINFO_CHIP_ID_LENGTH            32
+-
+-/*
+- * SMEM item id, used to acquire handles to respective
+- * SMEM region.
+- */
+-#define SMEM_HW_SW_BUILD_ID            137
+-
+ #ifdef CONFIG_DEBUG_FS
+ #define SMEM_IMAGE_VERSION_BLOCKS_COUNT        32
+ #define SMEM_IMAGE_VERSION_SIZE                4096
+@@ -116,54 +108,6 @@ static const char *const pmic_models[] =
+ };
+ #endif /* CONFIG_DEBUG_FS */
+ 
+-/* Socinfo SMEM item structure */
+-struct socinfo {
+-	__le32 fmt;
+-	__le32 id;
+-	__le32 ver;
+-	char build_id[SMEM_SOCINFO_BUILD_ID_LENGTH];
+-	/* Version 2 */
+-	__le32 raw_id;
+-	__le32 raw_ver;
+-	/* Version 3 */
+-	__le32 hw_plat;
+-	/* Version 4 */
+-	__le32 plat_ver;
+-	/* Version 5 */
+-	__le32 accessory_chip;
+-	/* Version 6 */
+-	__le32 hw_plat_subtype;
+-	/* Version 7 */
+-	__le32 pmic_model;
+-	__le32 pmic_die_rev;
+-	/* Version 8 */
+-	__le32 pmic_model_1;
+-	__le32 pmic_die_rev_1;
+-	__le32 pmic_model_2;
+-	__le32 pmic_die_rev_2;
+-	/* Version 9 */
+-	__le32 foundry_id;
+-	/* Version 10 */
+-	__le32 serial_num;
+-	/* Version 11 */
+-	__le32 num_pmics;
+-	__le32 pmic_array_offset;
+-	/* Version 12 */
+-	__le32 chip_family;
+-	__le32 raw_device_family;
+-	__le32 raw_device_num;
+-	/* Version 13 */
+-	__le32 nproduct_id;
+-	char chip_id[SMEM_SOCINFO_CHIP_ID_LENGTH];
+-	/* Version 14 */
+-	__le32 num_clusters;
+-	__le32 ncluster_array_offset;
+-	__le32 num_defective_parts;
+-	__le32 ndefective_parts_array_offset;
+-	/* Version 15 */
+-	__le32 nmodem_supported;
+-};
+-
+ #ifdef CONFIG_DEBUG_FS
+ struct socinfo_params {
+ 	u32 raw_device_family;
+--- /dev/null
++++ b/include/linux/soc/qcom/socinfo.h
+@@ -0,0 +1,67 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (c) 2009-2017, The Linux Foundation. All rights reserved.
++ * Copyright (c) 2017-2019, Linaro Ltd.
++ */
++
++#ifndef __QCOM_SOCINFO_H__
++#define __QCOM_SOCINFO_H__
++
++/*
++ * SMEM item id, used to acquire handles to respective
++ * SMEM region.
++ */
++#define SMEM_HW_SW_BUILD_ID		137
++
++#define SMEM_SOCINFO_BUILD_ID_LENGTH	32
++#define SMEM_SOCINFO_CHIP_ID_LENGTH	32
++
++/* Socinfo SMEM item structure */
++struct socinfo {
++	__le32 fmt;
++	__le32 id;
++	__le32 ver;
++	char build_id[SMEM_SOCINFO_BUILD_ID_LENGTH];
++	/* Version 2 */
++	__le32 raw_id;
++	__le32 raw_ver;
++	/* Version 3 */
++	__le32 hw_plat;
++	/* Version 4 */
++	__le32 plat_ver;
++	/* Version 5 */
++	__le32 accessory_chip;
++	/* Version 6 */
++	__le32 hw_plat_subtype;
++	/* Version 7 */
++	__le32 pmic_model;
++	__le32 pmic_die_rev;
++	/* Version 8 */
++	__le32 pmic_model_1;
++	__le32 pmic_die_rev_1;
++	__le32 pmic_model_2;
++	__le32 pmic_die_rev_2;
++	/* Version 9 */
++	__le32 foundry_id;
++	/* Version 10 */
++	__le32 serial_num;
++	/* Version 11 */
++	__le32 num_pmics;
++	__le32 pmic_array_offset;
++	/* Version 12 */
++	__le32 chip_family;
++	__le32 raw_device_family;
++	__le32 raw_device_num;
++	/* Version 13 */
++	__le32 nproduct_id;
++	char chip_id[SMEM_SOCINFO_CHIP_ID_LENGTH];
++	/* Version 14 */
++	__le32 num_clusters;
++	__le32 ncluster_array_offset;
++	__le32 num_defective_parts;
++	__le32 ndefective_parts_array_offset;
++	/* Version 15 */
++	__le32 nmodem_supported;
++};
++
++#endif
diff --git a/target/linux/generic/backport-6.1/830-02-v6.5-soc-qcom-smem-Switch-to-EXPORT_SYMBOL_GPL.patch b/target/linux/generic/backport-6.1/830-02-v6.5-soc-qcom-smem-Switch-to-EXPORT_SYMBOL_GPL.patch
new file mode 100644
index 00000000000000..7c7c3f3635cd89
--- /dev/null
+++ b/target/linux/generic/backport-6.1/830-02-v6.5-soc-qcom-smem-Switch-to-EXPORT_SYMBOL_GPL.patch
@@ -0,0 +1,55 @@
+From 9f1bbff157a69db7684f5da2f73b2325c638a90e Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 26 May 2023 22:47:59 +0200
+Subject: [PATCH] soc: qcom: smem: Switch to EXPORT_SYMBOL_GPL()
+
+SMEM has been GPL licensed from the start, and there is no reason to use
+EXPORT_SYMBOL() so switch to the GPL version.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Trilok Soni <quic_tsoni@quicinc.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230526204802.3081168-2-robimarko@gmail.com
+---
+ drivers/soc/qcom/smem.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -500,7 +500,7 @@ int qcom_smem_alloc(unsigned host, unsig
+ 
+ 	return ret;
+ }
+-EXPORT_SYMBOL(qcom_smem_alloc);
++EXPORT_SYMBOL_GPL(qcom_smem_alloc);
+ 
+ static void *qcom_smem_get_global(struct qcom_smem *smem,
+ 				  unsigned item,
+@@ -674,7 +674,7 @@ void *qcom_smem_get(unsigned host, unsig
+ 	return ptr;
+ 
+ }
+-EXPORT_SYMBOL(qcom_smem_get);
++EXPORT_SYMBOL_GPL(qcom_smem_get);
+ 
+ /**
+  * qcom_smem_get_free_space() - retrieve amount of free space in a partition
+@@ -719,7 +719,7 @@ int qcom_smem_get_free_space(unsigned ho
+ 
+ 	return ret;
+ }
+-EXPORT_SYMBOL(qcom_smem_get_free_space);
++EXPORT_SYMBOL_GPL(qcom_smem_get_free_space);
+ 
+ static bool addr_in_range(void __iomem *base, size_t size, void *addr)
+ {
+@@ -770,7 +770,7 @@ phys_addr_t qcom_smem_virt_to_phys(void
+ 
+ 	return 0;
+ }
+-EXPORT_SYMBOL(qcom_smem_virt_to_phys);
++EXPORT_SYMBOL_GPL(qcom_smem_virt_to_phys);
+ 
+ static int qcom_smem_get_sbl_version(struct qcom_smem *smem)
+ {
diff --git a/target/linux/generic/backport-6.1/830-03-v6.5-soc-qcom-smem-introduce-qcom_smem_get_soc_id.patch b/target/linux/generic/backport-6.1/830-03-v6.5-soc-qcom-smem-introduce-qcom_smem_get_soc_id.patch
new file mode 100644
index 00000000000000..4a816bb0f9763f
--- /dev/null
+++ b/target/linux/generic/backport-6.1/830-03-v6.5-soc-qcom-smem-introduce-qcom_smem_get_soc_id.patch
@@ -0,0 +1,70 @@
+From c3ecf2602a32d9b9e5fc997076c0d2836495c085 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 26 May 2023 22:48:00 +0200
+Subject: [PATCH] soc: qcom: smem: introduce qcom_smem_get_soc_id()
+
+Introduce a helper to return the SoC SMEM ID, which is used to identify the
+exact SoC model as there may be differences in the same SoC family.
+
+Currently, cpufreq-nvmem does this completely in the driver and there has
+been more interest expresed for other drivers to use this information so
+lets expose a common helper to prevent redoing it in individual drivers
+since this field is present on every SMEM table version.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230526204802.3081168-3-robimarko@gmail.com
+---
+ drivers/soc/qcom/smem.c       | 23 +++++++++++++++++++++++
+ include/linux/soc/qcom/smem.h |  2 ++
+ 2 files changed, 25 insertions(+)
+
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -14,6 +14,7 @@
+ #include <linux/sizes.h>
+ #include <linux/slab.h>
+ #include <linux/soc/qcom/smem.h>
++#include <linux/soc/qcom/socinfo.h>
+ 
+ /*
+  * The Qualcomm shared memory system is a allocate only heap structure that
+@@ -772,6 +773,28 @@ phys_addr_t qcom_smem_virt_to_phys(void
+ }
+ EXPORT_SYMBOL_GPL(qcom_smem_virt_to_phys);
+ 
++/**
++ * qcom_smem_get_soc_id() - return the SoC ID
++ * @id:	On success, we return the SoC ID here.
++ *
++ * Look up SoC ID from HW/SW build ID and return it.
++ *
++ * Return: 0 on success, negative errno on failure.
++ */
++int qcom_smem_get_soc_id(u32 *id)
++{
++	struct socinfo *info;
++
++	info = qcom_smem_get(QCOM_SMEM_HOST_ANY, SMEM_HW_SW_BUILD_ID, NULL);
++	if (IS_ERR(info))
++		return PTR_ERR(info);
++
++	*id = __le32_to_cpu(info->id);
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(qcom_smem_get_soc_id);
++
+ static int qcom_smem_get_sbl_version(struct qcom_smem *smem)
+ {
+ 	struct smem_header *header;
+--- a/include/linux/soc/qcom/smem.h
++++ b/include/linux/soc/qcom/smem.h
+@@ -11,4 +11,6 @@ int qcom_smem_get_free_space(unsigned ho
+ 
+ phys_addr_t qcom_smem_virt_to_phys(void *p);
+ 
++int qcom_smem_get_soc_id(u32 *id);
++
+ #endif
diff --git a/target/linux/generic/backport-6.1/830-04-v6.5-cpufreq-qcom-nvmem-use-SoC-ID-s-from-bindings.patch b/target/linux/generic/backport-6.1/830-04-v6.5-cpufreq-qcom-nvmem-use-SoC-ID-s-from-bindings.patch
new file mode 100644
index 00000000000000..9560122ccd5116
--- /dev/null
+++ b/target/linux/generic/backport-6.1/830-04-v6.5-cpufreq-qcom-nvmem-use-SoC-ID-s-from-bindings.patch
@@ -0,0 +1,51 @@
+From 2b8634d1468ff498cc91b6adf993c27ae6fa079d Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 26 May 2023 22:48:01 +0200
+Subject: [PATCH] cpufreq: qcom-nvmem: use SoC ID-s from bindings
+
+SMEM SoC ID-s are now stored in DT bindings so lets use those instead of
+defining them in the driver again.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230526204802.3081168-4-robimarko@gmail.com
+---
+ drivers/cpufreq/qcom-cpufreq-nvmem.c | 15 +++++----------
+ 1 file changed, 5 insertions(+), 10 deletions(-)
+
+--- a/drivers/cpufreq/qcom-cpufreq-nvmem.c
++++ b/drivers/cpufreq/qcom-cpufreq-nvmem.c
+@@ -31,12 +31,7 @@
+ 
+ #define MSM_ID_SMEM	137
+ 
+-enum _msm_id {
+-	MSM8996V3 = 0xF6ul,
+-	APQ8096V3 = 0x123ul,
+-	MSM8996SG = 0x131ul,
+-	APQ8096SG = 0x138ul,
+-};
++#include <dt-bindings/arm/qcom,ids.h>
+ 
+ enum _msm8996_version {
+ 	MSM8996_V3,
+@@ -154,12 +149,12 @@ static enum _msm8996_version qcom_cpufre
+ 	msm_id++;
+ 
+ 	switch ((enum _msm_id)*msm_id) {
+-	case MSM8996V3:
+-	case APQ8096V3:
++	case QCOM_ID_MSM8996:
++	case QCOM_ID_APQ8096:
+ 		version = MSM8996_V3;
+ 		break;
+-	case MSM8996SG:
+-	case APQ8096SG:
++	case QCOM_ID_MSM8996SG:
++	case QCOM_ID_APQ8096SG:
+ 		version = MSM8996_SG;
+ 		break;
+ 	default:
diff --git a/target/linux/generic/backport-6.1/830-05-v6.5-cpufreq-qcom-nvmem-use-helper-to-get-SMEM-SoC-ID.patch b/target/linux/generic/backport-6.1/830-05-v6.5-cpufreq-qcom-nvmem-use-helper-to-get-SMEM-SoC-ID.patch
new file mode 100644
index 00000000000000..4f37d672ba6e00
--- /dev/null
+++ b/target/linux/generic/backport-6.1/830-05-v6.5-cpufreq-qcom-nvmem-use-helper-to-get-SMEM-SoC-ID.patch
@@ -0,0 +1,109 @@
+From e7992615acacc27baeec310197108143afc77337 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 26 May 2023 22:48:02 +0200
+Subject: [PATCH] cpufreq: qcom-nvmem: use helper to get SMEM SoC ID
+
+Now that SMEM exports a helper to get the SMEM SoC ID lets utilize it.
+Currently qcom_cpufreq_get_msm_id() is encoding the returned SMEM SoC ID
+into an enum, however there is no reason to do so and we can just match
+directly on the SMEM SoC ID as returned by qcom_smem_get_soc_id().
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230526204802.3081168-5-robimarko@gmail.com
+---
+ drivers/cpufreq/qcom-cpufreq-nvmem.c | 56 +++++-----------------------
+ 1 file changed, 10 insertions(+), 46 deletions(-)
+
+--- a/drivers/cpufreq/qcom-cpufreq-nvmem.c
++++ b/drivers/cpufreq/qcom-cpufreq-nvmem.c
+@@ -29,16 +29,8 @@
+ #include <linux/slab.h>
+ #include <linux/soc/qcom/smem.h>
+ 
+-#define MSM_ID_SMEM	137
+-
+ #include <dt-bindings/arm/qcom,ids.h>
+ 
+-enum _msm8996_version {
+-	MSM8996_V3,
+-	MSM8996_SG,
+-	NUM_OF_MSM8996_VERSIONS,
+-};
+-
+ struct qcom_cpufreq_drv;
+ 
+ struct qcom_cpufreq_match_data {
+@@ -135,60 +127,32 @@ static void get_krait_bin_format_b(struc
+ 	dev_dbg(cpu_dev, "PVS version: %d\n", *pvs_ver);
+ }
+ 
+-static enum _msm8996_version qcom_cpufreq_get_msm_id(void)
+-{
+-	size_t len;
+-	u32 *msm_id;
+-	enum _msm8996_version version;
+-
+-	msm_id = qcom_smem_get(QCOM_SMEM_HOST_ANY, MSM_ID_SMEM, &len);
+-	if (IS_ERR(msm_id))
+-		return NUM_OF_MSM8996_VERSIONS;
+-
+-	/* The first 4 bytes are format, next to them is the actual msm-id */
+-	msm_id++;
+-
+-	switch ((enum _msm_id)*msm_id) {
+-	case QCOM_ID_MSM8996:
+-	case QCOM_ID_APQ8096:
+-		version = MSM8996_V3;
+-		break;
+-	case QCOM_ID_MSM8996SG:
+-	case QCOM_ID_APQ8096SG:
+-		version = MSM8996_SG;
+-		break;
+-	default:
+-		version = NUM_OF_MSM8996_VERSIONS;
+-	}
+-
+-	return version;
+-}
+-
+ static int qcom_cpufreq_kryo_name_version(struct device *cpu_dev,
+ 					  struct nvmem_cell *speedbin_nvmem,
+ 					  char **pvs_name,
+ 					  struct qcom_cpufreq_drv *drv)
+ {
+ 	size_t len;
++	u32 msm_id;
+ 	u8 *speedbin;
+-	enum _msm8996_version msm8996_version;
++	int ret;
+ 	*pvs_name = NULL;
+ 
+-	msm8996_version = qcom_cpufreq_get_msm_id();
+-	if (NUM_OF_MSM8996_VERSIONS == msm8996_version) {
+-		dev_err(cpu_dev, "Not Snapdragon 820/821!");
+-		return -ENODEV;
+-	}
++	ret = qcom_smem_get_soc_id(&msm_id);
++	if (ret)
++		return ret;
+ 
+ 	speedbin = nvmem_cell_read(speedbin_nvmem, &len);
+ 	if (IS_ERR(speedbin))
+ 		return PTR_ERR(speedbin);
+ 
+-	switch (msm8996_version) {
+-	case MSM8996_V3:
++	switch (msm_id) {
++	case QCOM_ID_MSM8996:
++	case QCOM_ID_APQ8096:
+ 		drv->versions = 1 << (unsigned int)(*speedbin);
+ 		break;
+-	case MSM8996_SG:
++	case QCOM_ID_MSM8996SG:
++	case QCOM_ID_APQ8096SG:
+ 		drv->versions = 1 << ((unsigned int)(*speedbin) + 4);
+ 		break;
+ 	default:
diff --git a/target/linux/generic/backport-6.1/890-v6.2-mtd-spinand-winbond-fix-flash-detection.patch b/target/linux/generic/backport-6.1/890-v6.2-mtd-spinand-winbond-fix-flash-detection.patch
new file mode 100644
index 00000000000000..38fbc3a3d73f33
--- /dev/null
+++ b/target/linux/generic/backport-6.1/890-v6.2-mtd-spinand-winbond-fix-flash-detection.patch
@@ -0,0 +1,40 @@
+From dbf70fc204d2fbb0d8ad8f42038a60846502efda Mon Sep 17 00:00:00 2001
+From: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Date: Mon, 10 Oct 2022 13:51:09 +0300
+Subject: [PATCH] mtd: spinand: winbond: fix flash identification
+
+Winbond uses 3 bytes to identify flash: vendor_id, dev_id_0, dev_id_1,
+but current driver uses only first 2 bytes of it for devices
+identification. As result Winbond W25N02KV flash (id_bytes: EF, AA, 22)
+is identified as W25N01GV (id_bytes: EF, AA, 21).
+
+Fix this by adding missed identification bytes.
+
+Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Reviewed-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20221010105110.446674-1-mikhail.kshevetskiy@iopsys.eu
+---
+ drivers/mtd/nand/spi/winbond.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/mtd/nand/spi/winbond.c
++++ b/drivers/mtd/nand/spi/winbond.c
+@@ -76,7 +76,7 @@ static int w25m02gv_select_target(struct
+ 
+ static const struct spinand_info winbond_spinand_table[] = {
+ 	SPINAND_INFO("W25M02GV",
+-		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xab),
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xab, 0x21),
+ 		     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 2),
+ 		     NAND_ECCREQ(1, 512),
+ 		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
+@@ -86,7 +86,7 @@ static const struct spinand_info winbond
+ 		     SPINAND_ECCINFO(&w25m02gv_ooblayout, NULL),
+ 		     SPINAND_SELECT_TARGET(w25m02gv_select_target)),
+ 	SPINAND_INFO("W25N01GV",
+-		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xaa),
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xaa, 0x21),
+ 		     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
+ 		     NAND_ECCREQ(1, 512),
+ 		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
diff --git a/target/linux/generic/backport-6.1/891-v6.2-mtd-spinand-winbond-add-W25N02KV.patch b/target/linux/generic/backport-6.1/891-v6.2-mtd-spinand-winbond-add-W25N02KV.patch
new file mode 100644
index 00000000000000..d75a1acc57c765
--- /dev/null
+++ b/target/linux/generic/backport-6.1/891-v6.2-mtd-spinand-winbond-add-W25N02KV.patch
@@ -0,0 +1,106 @@
+From 6154c7a583483d7b69f53bea868efdc369edd563 Mon Sep 17 00:00:00 2001
+From: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Date: Mon, 10 Oct 2022 13:51:10 +0300
+Subject: [PATCH] mtd: spinand: winbond: add Winbond W25N02KV flash support
+
+Add support of Winbond W25N02KV flash
+
+Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Reviewed-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20221010105110.446674-2-mikhail.kshevetskiy@iopsys.eu
+---
+ drivers/mtd/nand/spi/winbond.c | 75 ++++++++++++++++++++++++++++++++++
+ 1 file changed, 75 insertions(+)
+
+--- a/drivers/mtd/nand/spi/winbond.c
++++ b/drivers/mtd/nand/spi/winbond.c
+@@ -74,6 +74,72 @@ static int w25m02gv_select_target(struct
+ 	return spi_mem_exec_op(spinand->spimem, &op);
+ }
+ 
++static int w25n02kv_ooblayout_ecc(struct mtd_info *mtd, int section,
++				  struct mtd_oob_region *region)
++{
++	if (section > 3)
++		return -ERANGE;
++
++	region->offset = 64 + (16 * section);
++	region->length = 13;
++
++	return 0;
++}
++
++static int w25n02kv_ooblayout_free(struct mtd_info *mtd, int section,
++				   struct mtd_oob_region *region)
++{
++	if (section > 3)
++		return -ERANGE;
++
++	region->offset = (16 * section) + 2;
++	region->length = 14;
++
++	return 0;
++}
++
++static const struct mtd_ooblayout_ops w25n02kv_ooblayout = {
++	.ecc = w25n02kv_ooblayout_ecc,
++	.free = w25n02kv_ooblayout_free,
++};
++
++static int w25n02kv_ecc_get_status(struct spinand_device *spinand,
++				   u8 status)
++{
++	struct nand_device *nand = spinand_to_nand(spinand);
++	u8 mbf = 0;
++	struct spi_mem_op op = SPINAND_GET_FEATURE_OP(0x30, &mbf);
++
++	switch (status & STATUS_ECC_MASK) {
++	case STATUS_ECC_NO_BITFLIPS:
++		return 0;
++
++	case STATUS_ECC_UNCOR_ERROR:
++		return -EBADMSG;
++
++	case STATUS_ECC_HAS_BITFLIPS:
++		/*
++		 * Let's try to retrieve the real maximum number of bitflips
++		 * in order to avoid forcing the wear-leveling layer to move
++		 * data around if it's not necessary.
++		 */
++		if (spi_mem_exec_op(spinand->spimem, &op))
++			return nanddev_get_ecc_conf(nand)->strength;
++
++		mbf >>= 4;
++
++		if (WARN_ON(mbf > nanddev_get_ecc_conf(nand)->strength || !mbf))
++			return nanddev_get_ecc_conf(nand)->strength;
++
++		return mbf;
++
++	default:
++		break;
++	}
++
++	return -EINVAL;
++}
++
+ static const struct spinand_info winbond_spinand_table[] = {
+ 	SPINAND_INFO("W25M02GV",
+ 		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xab, 0x21),
+@@ -94,6 +160,15 @@ static const struct spinand_info winbond
+ 					      &update_cache_variants),
+ 		     0,
+ 		     SPINAND_ECCINFO(&w25m02gv_ooblayout, NULL)),
++	SPINAND_INFO("W25N02KV",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xaa, 0x22),
++		     NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     0,
++		     SPINAND_ECCINFO(&w25n02kv_ooblayout, w25n02kv_ecc_get_status)),
+ };
+ 
+ static int winbond_spinand_init(struct spinand_device *spinand)
diff --git a/target/linux/generic/config-5.15 b/target/linux/generic/config-5.15
index 596485f2f792cd..251a6fbcc32f28 100644
--- a/target/linux/generic/config-5.15
+++ b/target/linux/generic/config-5.15
@@ -130,6 +130,7 @@ CONFIG_AEABI=y
 # CONFIG_AF_RXRPC_IPV6 is not set
 CONFIG_AF_UNIX_OOB=y
 # CONFIG_AGP is not set
+# CONFIG_AHCI_BRCM is not set
 # CONFIG_AHCI_CEVA is not set
 # CONFIG_AHCI_IMX is not set
 # CONFIG_AHCI_MVEBU is not set
@@ -328,6 +329,9 @@ CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8
 # CONFIG_ARM64_ERRATUM_1508412 is not set
 # CONFIG_ARM64_ERRATUM_1530923 is not set
 # CONFIG_ARM64_ERRATUM_1542419 is not set
+# CONFIG_ARM64_ERRATUM_1742098 is not set
+# CONFIG_ARM64_ERRATUM_2441007 is not set
+# CONFIG_ARM64_ERRATUM_2441009 is not set
 # CONFIG_ARM64_ERRATUM_819472 is not set
 # CONFIG_ARM64_ERRATUM_824069 is not set
 # CONFIG_ARM64_ERRATUM_826319 is not set
@@ -337,10 +341,9 @@ CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8
 # CONFIG_ARM64_ERRATUM_843419 is not set
 # CONFIG_ARM64_ERRATUM_845719 is not set
 # CONFIG_ARM64_ERRATUM_858921 is not set
-# CONFIG_ARM64_ERRATUM_2441009 is not set
 # CONFIG_ARM64_HW_AFDBM is not set
 # CONFIG_ARM64_LSE_ATOMICS is not set
-# CONFIG_ARM64_MODULE_PLTS is not set
+CONFIG_ARM64_MODULE_PLTS=y
 # CONFIG_ARM64_MTE is not set
 # CONFIG_ARM64_PAN is not set
 # CONFIG_ARM64_PMEM is not set
@@ -405,7 +408,7 @@ CONFIG_ARM_GIC_MAX_NR=1
 # CONFIG_ARM_LPAE is not set
 # CONFIG_ARM_MEDIATEK_CPUFREQ_HW is not set
 # CONFIG_ARM_MHU is not set
-# CONFIG_ARM_MODULE_PLTS is not set
+CONFIG_ARM_MODULE_PLTS=y
 # CONFIG_ARM_PATCH_PHYS_VIRT is not set
 # CONFIG_ARM_PSCI is not set
 # CONFIG_ARM_PSCI_CHECKER is not set
@@ -708,6 +711,7 @@ CONFIG_BLOCK=y
 # CONFIG_BONDING is not set
 # CONFIG_BOOKE_WDT is not set
 CONFIG_BOOKE_WDT_DEFAULT_TIMEOUT=3
+# CONFIG_BOOTPARAM_HARDLOCKUP_PANIC is not set
 # CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set
 # CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC is not set
 # CONFIG_BOOTTIME_TRACING is not set
@@ -894,6 +898,7 @@ CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y
 # CONFIG_CHARGER_LTC4162L is not set
 # CONFIG_CHARGER_MANAGER is not set
 # CONFIG_CHARGER_MAX8903 is not set
+# CONFIG_CHARGER_QCOM_SMBB is not set
 # CONFIG_CHARGER_RT9455 is not set
 # CONFIG_CHARGER_SBS is not set
 # CONFIG_CHARGER_SMB347 is not set
@@ -930,7 +935,6 @@ CONFIG_CIFS_XATTR=y
 # CONFIG_CLEANCACHE is not set
 # CONFIG_CLKSRC_PISTACHIO is not set
 # CONFIG_CLKSRC_VERSATILE is not set
-# CONFIG_CLKSRC_PISTACHIO is not set
 # CONFIG_CLK_GFM_LPASS_SM8250 is not set
 # CONFIG_CLK_HSDK is not set
 # CONFIG_CLK_QORIQ is not set
@@ -1024,7 +1028,7 @@ CONFIG_CONSTRUCTORS=y
 # CONFIG_CPU_IDLE_GOV_TEO is not set
 # CONFIG_CPU_IDLE_MULTIPLE_DRIVERS is not set
 # CONFIG_CPU_ISOLATION is not set
-CONFIG_CPU_LITTLE_ENDIAN=y
+# CONFIG_CPU_LITTLE_ENDIAN is not set
 # CONFIG_CPU_NO_EFFICIENT_FFS is not set
 CONFIG_CPU_SW_DOMAIN_PAN=y
 # CONFIG_CPU_THERMAL is not set
@@ -1216,14 +1220,9 @@ CONFIG_CRYPTO_PCRYPT=y
 # CONFIG_CRYPTO_POLY1305_MIPS is not set
 # CONFIG_CRYPTO_POLY1305_NEON is not set
 # CONFIG_CRYPTO_POLY1305_X86_64 is not set
-# CONFIG_CRYPTO_RMD128 is not set
 # CONFIG_CRYPTO_RMD160 is not set
-# CONFIG_CRYPTO_RMD256 is not set
-# CONFIG_CRYPTO_RMD320 is not set
 # CONFIG_CRYPTO_RNG is not set
 # CONFIG_CRYPTO_RSA is not set
-# CONFIG_CRYPTO_SALSA20 is not set
-# CONFIG_CRYPTO_SALSA20_586 is not set
 # CONFIG_CRYPTO_SEED is not set
 # CONFIG_CRYPTO_SEQIV is not set
 # CONFIG_CRYPTO_SERPENT is not set
@@ -1256,7 +1255,6 @@ CONFIG_CRYPTO_SKCIPHER2=y
 # CONFIG_CRYPTO_STREEBOG is not set
 # CONFIG_CRYPTO_TEA is not set
 # CONFIG_CRYPTO_TEST is not set
-# CONFIG_CRYPTO_TGR192 is not set
 # CONFIG_CRYPTO_TWOFISH is not set
 # CONFIG_CRYPTO_TWOFISH_586 is not set
 # CONFIG_CRYPTO_TWOFISH_COMMON is not set
@@ -1370,7 +1368,10 @@ CONFIG_DEBUG_KERNEL=y
 # CONFIG_DEBUG_USER is not set
 # CONFIG_DEBUG_VIRTUAL is not set
 # CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_VM_PGFLAGS is not set
 # CONFIG_DEBUG_VM_PGTABLE is not set
+# CONFIG_DEBUG_VM_RB is not set
+# CONFIG_DEBUG_VM_VMACACHE is not set
 # CONFIG_DEBUG_WQ_FORCE_RR_CPU is not set
 # CONFIG_DEBUG_WW_MUTEX_SLOWPATH is not set
 # CONFIG_DEBUG_WX is not set
@@ -1381,6 +1382,7 @@ CONFIG_DEFAULT_CUBIC=y
 CONFIG_DEFAULT_DEADLINE=y
 # CONFIG_DEFAULT_FQ is not set
 CONFIG_DEFAULT_FQ_CODEL=y
+# CONFIG_DEFAULT_FQ_PIE is not set
 CONFIG_DEFAULT_HOSTNAME="(none)"
 CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120
 CONFIG_DEFAULT_INIT=""
@@ -1504,6 +1506,7 @@ CONFIG_DQL=y
 # CONFIG_DRM_ARCPGU is not set
 # CONFIG_DRM_ARMADA is not set
 # CONFIG_DRM_AST is not set
+# CONFIG_DRM_ATMEL_HLCDC is not set
 # CONFIG_DRM_BOCHS is not set
 # CONFIG_DRM_CDNS_DSI is not set
 # CONFIG_DRM_CDNS_MHDP8546 is not set
@@ -1631,6 +1634,8 @@ CONFIG_DQL=y
 # CONFIG_DRM_RADEON_USERPTR is not set
 # CONFIG_DRM_RCAR_DW_HDMI is not set
 # CONFIG_DRM_RCAR_LVDS is not set
+# CONFIG_DRM_RCAR_USE_LVDS is not set
+# CONFIG_DRM_ROCKCHIP is not set
 # CONFIG_DRM_SII902X is not set
 # CONFIG_DRM_SII9234 is not set
 # CONFIG_DRM_SIL_SII8620 is not set
@@ -1661,6 +1666,7 @@ CONFIG_DQL=y
 # CONFIG_DRM_VKMS is not set
 # CONFIG_DRM_VMWGFX is not set
 # CONFIG_DRM_XEN is not set
+# CONFIG_DRM_XEN_FRONTEND is not set
 # CONFIG_DS1682 is not set
 # CONFIG_DS1803 is not set
 # CONFIG_DS4424 is not set
@@ -1793,6 +1799,7 @@ CONFIG_DVB_MAX_ADAPTERS=16
 # CONFIG_DVB_TUNER_DIB0090 is not set
 # CONFIG_DVB_TUNER_ITD1000 is not set
 # CONFIG_DVB_ULE_DEBUG is not set
+# CONFIG_DVB_USB is not set
 # CONFIG_DVB_USB_V2 is not set
 # CONFIG_DVB_VES1820 is not set
 # CONFIG_DVB_VES1X93 is not set
@@ -1818,7 +1825,7 @@ CONFIG_DVB_MAX_ADAPTERS=16
 # CONFIG_DW_WATCHDOG is not set
 # CONFIG_DW_XDATA_PCIE is not set
 # CONFIG_DYNAMIC_DEBUG is not set
-CONFIG_DYNAMIC_DEBUG_CORE=y
+# CONFIG_DYNAMIC_DEBUG_CORE is not set
 # CONFIG_E100 is not set
 # CONFIG_E1000 is not set
 # CONFIG_E1000E is not set
@@ -1848,7 +1855,6 @@ CONFIG_ELFCORE=y
 # CONFIG_EMAC_ROCKCHIP is not set
 CONFIG_EMBEDDED=y
 # CONFIG_EM_TIMER_STI is not set
-# CONFIG_ENABLE_MUST_CHECK is not set
 CONFIG_ENABLE_WARN_DEPRECATED=y
 # CONFIG_ENA_ETHERNET is not set
 # CONFIG_ENC28J60 is not set
@@ -1928,6 +1934,7 @@ CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
 # CONFIG_FB_ARK is not set
 # CONFIG_FB_ARMCLCD is not set
 # CONFIG_FB_ASILIANT is not set
+# CONFIG_FB_ATMEL is not set
 # CONFIG_FB_ATY is not set
 # CONFIG_FB_ATY128 is not set
 # CONFIG_FB_AUO_K190X is not set
@@ -2071,7 +2078,6 @@ CONFIG_FORTIFY_SOURCE=y
 # CONFIG_FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER is not set
 # CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION is not set
 # CONFIG_FRAME_POINTER is not set
-CONFIG_FRAME_WARN=1024
 # CONFIG_FREEZER is not set
 # CONFIG_FRONTSWAP is not set
 # CONFIG_FSCACHE is not set
@@ -2104,6 +2110,7 @@ CONFIG_FSNOTIFY=y
 # CONFIG_FUJITSU_ES is not set
 # CONFIG_FUJITSU_LAPTOP is not set
 # CONFIG_FUJITSU_TABLET is not set
+# CONFIG_FUNCTION_ERROR_INJECTION is not set
 # CONFIG_FUNCTION_TRACER is not set
 # CONFIG_FUSE_FS is not set
 # CONFIG_FUSION is not set
@@ -2200,7 +2207,6 @@ CONFIG_GPIOLIB_FASTPATH_LIMIT=512
 # CONFIG_GPIO_MAX732X is not set
 # CONFIG_GPIO_MB86S7X is not set
 # CONFIG_GPIO_MC33880 is not set
-# CONFIG_GPIO_MCP23S08 is not set
 # CONFIG_GPIO_ML_IOH is not set
 # CONFIG_GPIO_MOCKUP is not set
 # CONFIG_GPIO_MPC8XXX is not set
@@ -2387,6 +2393,7 @@ CONFIG_HIGH_RES_TIMERS=y
 # CONFIG_HISI_DMA is not set
 # CONFIG_HISI_FEMAC is not set
 # CONFIG_HISI_HIKEY_USB is not set
+# CONFIG_HIST_TRIGGERS_DEBUG is not set
 # CONFIG_HIX5HD2_GMAC is not set
 # CONFIG_HMC425 is not set
 # CONFIG_HMC6352 is not set
@@ -2400,6 +2407,11 @@ CONFIG_HIGH_RES_TIMERS=y
 # CONFIG_HOSTAP_PLX is not set
 # CONFIG_HOTPLUG_CPU is not set
 # CONFIG_HOTPLUG_PCI is not set
+# CONFIG_HOTPLUG_PCI_ACPI_IBM is not set
+# CONFIG_HOTPLUG_PCI_COMPAQ is not set
+# CONFIG_HOTPLUG_PCI_CPCI is not set
+# CONFIG_HOTPLUG_PCI_IBM is not set
+# CONFIG_HOTPLUG_PCI_SHPC is not set
 # CONFIG_HP03 is not set
 # CONFIG_HP100 is not set
 # CONFIG_HP206C is not set
@@ -2431,6 +2443,7 @@ CONFIG_HW_PERF_EVENTS=y
 # CONFIG_HW_RANDOM_ARM_SMCCC_TRNG is not set
 # CONFIG_HW_RANDOM_ATMEL is not set
 # CONFIG_HW_RANDOM_BA431 is not set
+# CONFIG_HW_RANDOM_BCM2835 is not set
 # CONFIG_HW_RANDOM_CAVIUM is not set
 # CONFIG_HW_RANDOM_CCTRNG is not set
 # CONFIG_HW_RANDOM_EXYNOS is not set
@@ -2476,6 +2489,7 @@ CONFIG_HZ_100=y
 # CONFIG_I2C_AU1550 is not set
 # CONFIG_I2C_BCM2835 is not set
 # CONFIG_I2C_BCM_IPROC is not set
+# CONFIG_I2C_BRCMSTB is not set
 # CONFIG_I2C_CADENCE is not set
 # CONFIG_I2C_CBUS_GPIO is not set
 # CONFIG_I2C_CHARDEV is not set
@@ -2619,7 +2633,6 @@ CONFIG_IIO_CONSUMERS_PER_TRIGGER=2
 # CONFIG_IKCONFIG_PROC is not set
 # CONFIG_IKHEADERS is not set
 # CONFIG_IMA is not set
-# CONFIG_IMAGE_CMDLINE_HACK is not set
 # CONFIG_IMGPDC_WDT is not set
 # CONFIG_IMG_MDC_DMA is not set
 # CONFIG_IMX7D_ADC is not set
@@ -2633,10 +2646,6 @@ CONFIG_INET=y
 # CONFIG_INET6_ESPINTCP is not set
 # CONFIG_INET6_IPCOMP is not set
 # CONFIG_INET6_TUNNEL is not set
-# CONFIG_INET6_XFRM_MODE_BEET is not set
-# CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set
-# CONFIG_INET6_XFRM_MODE_TRANSPORT is not set
-# CONFIG_INET6_XFRM_MODE_TUNNEL is not set
 # CONFIG_INET6_XFRM_TUNNEL is not set
 # CONFIG_INET_AH is not set
 # CONFIG_INET_DIAG is not set
@@ -2644,12 +2653,10 @@ CONFIG_INET=y
 # CONFIG_INET_ESPINTCP is not set
 # CONFIG_INET_IPCOMP is not set
 # CONFIG_INET_LRO is not set
+CONFIG_INET_TABLE_PERTURB_ORDER=16
 # CONFIG_INET_TCP_DIAG is not set
 # CONFIG_INET_TUNNEL is not set
 # CONFIG_INET_UDP_DIAG is not set
-# CONFIG_INET_XFRM_MODE_BEET is not set
-# CONFIG_INET_XFRM_MODE_TRANSPORT is not set
-# CONFIG_INET_XFRM_MODE_TUNNEL is not set
 # CONFIG_INET_XFRM_TUNNEL is not set
 # CONFIG_INFINIBAND is not set
 # CONFIG_INFTL is not set
@@ -2719,6 +2726,8 @@ CONFIG_INPUT_MISC=y
 # CONFIG_INPUT_PALMAS_PWRBUTTON is not set
 # CONFIG_INPUT_PCF8574 is not set
 # CONFIG_INPUT_PCSPKR is not set
+# CONFIG_INPUT_PM8941_PWRKEY is not set
+# CONFIG_INPUT_PM8XXX_VIBRATOR is not set
 # CONFIG_INPUT_POLLDEV is not set
 # CONFIG_INPUT_POWERMATE is not set
 # CONFIG_INPUT_PWM_BEEPER is not set
@@ -2745,6 +2754,8 @@ CONFIG_INPUT_MISC=y
 # CONFIG_INTEL_HID_EVENT is not set
 # CONFIG_INTEL_IDLE is not set
 # CONFIG_INTEL_IDMA64 is not set
+# CONFIG_INTEL_IDXD is not set
+# CONFIG_INTEL_IDXD_COMPAT is not set
 # CONFIG_INTEL_INT0002_VGPIO is not set
 # CONFIG_INTEL_IOATDMA is not set
 # CONFIG_INTEL_ISH_HID is not set
@@ -2772,6 +2783,9 @@ CONFIG_INPUT_MISC=y
 # CONFIG_INV_MPU6050_I2C is not set
 # CONFIG_INV_MPU6050_IIO is not set
 # CONFIG_INV_MPU6050_SPI is not set
+# CONFIG_IOMMU_DEFAULT_DMA_LAZY is not set
+# CONFIG_IOMMU_DEFAULT_DMA_STRICT is not set
+# CONFIG_IOMMU_DEFAULT_PASSTHROUGH is not set
 # CONFIG_IOMMU_SUPPORT is not set
 # CONFIG_IONIC is not set
 # CONFIG_IOSCHED_BFQ is not set
@@ -2896,8 +2910,11 @@ CONFIG_IP_VS_MH_TAB_INDEX=10
 # CONFIG_IR_RC5_DECODER is not set
 # CONFIG_IR_RC6_DECODER is not set
 # CONFIG_IR_REDRAT3 is not set
+# CONFIG_IR_SERIAL is not set
+# CONFIG_IR_SIR is not set
 # CONFIG_IR_SONY_DECODER is not set
 # CONFIG_IR_STREAMZAP is not set
+# CONFIG_IR_TOY is not set
 # CONFIG_IR_TTUSBIR is not set
 # CONFIG_ISA_BUS is not set
 # CONFIG_ISA_BUS_API is not set
@@ -2966,9 +2983,11 @@ CONFIG_KALLSYMS_BASE_RELATIVE=y
 # CONFIG_KALLSYMS_UNCOMPRESSED is not set
 # CONFIG_KARMA_PARTITION is not set
 # CONFIG_KASAN is not set
+# CONFIG_KASAN_MODULE_TEST is not set
 CONFIG_KASAN_STACK=y
 # CONFIG_KCMP is not set
 # CONFIG_KCOV is not set
+CONFIG_KCOV_IRQ_AREA_SIZE=0x40000
 # CONFIG_KCSAN is not set
 # CONFIG_KERNEL_BZIP2 is not set
 # CONFIG_KERNEL_CAT is not set
@@ -3076,6 +3095,7 @@ CONFIG_LBDAF=y
 CONFIG_LDISC_AUTOLOAD=y
 # CONFIG_LDM_PARTITION is not set
 CONFIG_LD_DEAD_CODE_DATA_ELIMINATION=y
+# CONFIG_LD_HEAD_STUB_CATCH is not set
 # CONFIG_LEDS_AN30259A is not set
 # CONFIG_LEDS_APU is not set
 # CONFIG_LEDS_AW2013 is not set
@@ -3143,7 +3163,6 @@ CONFIG_LEDS_TRIGGER_TIMER=y
 # CONFIG_LEDS_TRIGGER_TRANSIENT is not set
 # CONFIG_LEDS_TRIGGER_TTY is not set
 # CONFIG_LEDS_TURRIS_OMNIA is not set
-# CONFIG_LEDS_UBNT_LEDBAR is not set
 # CONFIG_LEDS_USER is not set
 # CONFIG_LED_TRIGGER_PHY is not set
 # CONFIG_LEGACY_PTYS is not set
@@ -3166,9 +3185,11 @@ CONFIG_LIB_MEMNEQ=y
 CONFIG_LINEAR_RANGES=y
 # CONFIG_LIQUIDIO is not set
 # CONFIG_LIQUIDIO_VF is not set
+# CONFIG_LIRC is not set
 # CONFIG_LIS3L02DQ is not set
 # CONFIG_LITEX_LITEETH is not set
 # CONFIG_LITEX_SOC_CONTROLLER is not set
+# CONFIG_LIVEPATCH is not set
 # CONFIG_LKDTM is not set
 CONFIG_LLC=y
 # CONFIG_LLC2 is not set
@@ -3178,6 +3199,11 @@ CONFIG_LLC=y
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 # CONFIG_LOCKD is not set
+CONFIG_LOCKDEP_BITS=15
+CONFIG_LOCKDEP_CHAINS_BITS=16
+CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=12
+CONFIG_LOCKDEP_STACK_TRACE_BITS=19
+CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
 CONFIG_LOCKDEP_SUPPORT=y
 CONFIG_LOCKD_V4=y
 # CONFIG_LOCKUP_DETECTOR is not set
@@ -3323,6 +3349,7 @@ CONFIG_MAY_USE_DEVLINK=y
 # CONFIG_MEDIA_CAMERA_SUPPORT is not set
 # CONFIG_MEDIA_CEC_SUPPORT is not set
 # CONFIG_MEDIA_CONTROLLER is not set
+# CONFIG_MEDIA_CONTROLLER_DVB is not set
 # CONFIG_MEDIA_DIGITAL_TV_SUPPORT is not set
 # CONFIG_MEDIA_PCI_SUPPORT is not set
 # CONFIG_MEDIA_PLATFORM_SUPPORT is not set
@@ -3600,6 +3627,7 @@ CONFIG_MMC_BLOCK_MINORS=8
 # CONFIG_MMC_SDHCI_ACPI is not set
 # CONFIG_MMC_SDHCI_AM654 is not set
 # CONFIG_MMC_SDHCI_BCM_KONA is not set
+# CONFIG_MMC_SDHCI_BRCMSTB is not set
 # CONFIG_MMC_SDHCI_CADENCE is not set
 # CONFIG_MMC_SDHCI_F_SDH30 is not set
 # CONFIG_MMC_SDHCI_IPROC is not set
@@ -4013,7 +4041,6 @@ CONFIG_NET_CLS_IND=y
 # CONFIG_NET_CLS_ROUTE4 is not set
 # CONFIG_NET_CLS_RSVP is not set
 # CONFIG_NET_CLS_RSVP6 is not set
-# CONFIG_NET_CLS_TCINDEX is not set
 # CONFIG_NET_CLS_U32 is not set
 CONFIG_NET_CORE=y
 # CONFIG_NET_DEVLINK is not set
@@ -4038,6 +4065,7 @@ CONFIG_NET_CORE=y
 # CONFIG_NET_DSA_MV88E6XXX_NEED_PPU is not set
 # CONFIG_NET_DSA_MV88E6XXX_PTP is not set
 # CONFIG_NET_DSA_QCA8K is not set
+# CONFIG_NET_DSA_QCA8K_LEDS_SUPPORT is not set
 # CONFIG_NET_DSA_REALTEK_SMI is not set
 # CONFIG_NET_DSA_SJA1105 is not set
 # CONFIG_NET_DSA_SMSC_LAN9303_I2C is not set
@@ -4392,7 +4420,6 @@ CONFIG_NMI_LOG_BUF_SHIFT=13
 # CONFIG_NO_HZ is not set
 # CONFIG_NO_HZ_FULL is not set
 # CONFIG_NO_HZ_IDLE is not set
-CONFIG_NR_LRU_GENS=7
 # CONFIG_NS83820 is not set
 # CONFIG_NTB is not set
 # CONFIG_NTFS3_64BIT_CLUSTER is not set
@@ -4410,6 +4437,8 @@ CONFIG_NR_LRU_GENS=7
 # CONFIG_NVMEM is not set
 # CONFIG_NVMEM_BCM_OCOTP is not set
 # CONFIG_NVMEM_IMX_OCOTP is not set
+# CONFIG_NVMEM_LAYOUT_ONIE_TLV is not set
+# CONFIG_NVMEM_LAYOUT_SL28_VPD is not set
 # CONFIG_NVMEM_REBOOT_MODE is not set
 # CONFIG_NVMEM_RMEM is not set
 # CONFIG_NVMEM_SYSFS is not set
@@ -4463,6 +4492,8 @@ CONFIG_PACKET=y
 # CONFIG_PAGE_EXTENSION is not set
 # CONFIG_PAGE_OWNER is not set
 # CONFIG_PAGE_POISONING is not set
+# CONFIG_PAGE_POOL is not set
+# CONFIG_PAGE_POOL_STATS is not set
 # CONFIG_PAGE_REPORTING is not set
 # CONFIG_PAGE_SIZE_16KB is not set
 # CONFIG_PAGE_SIZE_32KB is not set
@@ -4753,6 +4784,7 @@ CONFIG_PPC_4K_PAGES=y
 # CONFIG_PPC_DISABLE_WERROR is not set
 # CONFIG_PPC_EMULATED_STATS is not set
 # CONFIG_PPC_EPAPR_HV_BYTECHAN is not set
+# CONFIG_PPC_QUEUED_SPINLOCKS is not set
 # CONFIG_PPP is not set
 # CONFIG_PPPOATM is not set
 # CONFIG_PPPOE is not set
@@ -4838,7 +4870,9 @@ CONFIG_PSTORE_DEFAULT_KMSG_BYTES=10240
 # CONFIG_PWM_DEBUG is not set
 # CONFIG_PWM_DWC is not set
 # CONFIG_PWM_FSL_FTM is not set
+# CONFIG_PWM_IMG is not set
 # CONFIG_PWM_JZ4740 is not set
+# CONFIG_PWM_MEDIATEK is not set
 # CONFIG_PWM_PCA9685 is not set
 # CONFIG_PWM_RASPBERRYPI_POE is not set
 CONFIG_PWRSEQ_EMMC=y
@@ -4906,11 +4940,10 @@ CONFIG_PWRSEQ_SIMPLE=y
 # CONFIG_RANDOM32_SELFTEST is not set
 # CONFIG_RANDOMIZE_BASE is not set
 # CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT is not set
-# CONFIG_RANDOM_TRUST_BOOTLOADER is not set
-# CONFIG_RANDOM_TRUST_CPU is not set
+CONFIG_RANDOM_TRUST_BOOTLOADER=y
+CONFIG_RANDOM_TRUST_CPU=y
 # CONFIG_RAPIDIO is not set
 # CONFIG_RAS is not set
-# CONFIG_RAW_DRIVER is not set
 # CONFIG_RBTREE_TEST is not set
 # CONFIG_RCU_BOOST is not set
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
@@ -4932,6 +4965,7 @@ CONFIG_RCU_TORTURE_TEST_SLOW_INIT_DELAY=3
 # CONFIG_RC_DECODERS is not set
 # CONFIG_RC_LOOPBACK is not set
 # CONFIG_RC_MAP is not set
+# CONFIG_RC_XBOX_DVD is not set
 # CONFIG_RDS is not set
 # CONFIG_RD_BZIP2 is not set
 # CONFIG_RD_GZIP is not set
@@ -5198,6 +5232,8 @@ CONFIG_RXKAD=y
 # CONFIG_SATA_AHCI is not set
 # CONFIG_SATA_AHCI_PLATFORM is not set
 # CONFIG_SATA_DWC is not set
+# CONFIG_SATA_DWC_DEBUG is not set
+# CONFIG_SATA_DWC_OLD_DMA is not set
 # CONFIG_SATA_FSL is not set
 # CONFIG_SATA_HIGHBANK is not set
 # CONFIG_SATA_HOST is not set
@@ -5233,7 +5269,7 @@ CONFIG_SCHED_HRTICK=y
 # CONFIG_SCHED_MC is not set
 CONFIG_SCHED_OMIT_FRAME_POINTER=y
 # CONFIG_SCHED_SMT is not set
-# CONFIG_SCHED_STACK_END_CHECK is not set
+CONFIG_SCHED_STACK_END_CHECK=y
 # CONFIG_SCHED_TRACER is not set
 # CONFIG_SCR24X is not set
 # CONFIG_SCSI is not set
@@ -5712,8 +5748,8 @@ CONFIG_SIGNALFD=y
 # CONFIG_SKY2_DEBUG is not set
 # CONFIG_SLAB is not set
 CONFIG_SLABINFO=y
-# CONFIG_SLAB_FREELIST_HARDENED is not set
-# CONFIG_SLAB_FREELIST_RANDOM is not set
+CONFIG_SLAB_FREELIST_HARDENED=y
+CONFIG_SLAB_FREELIST_RANDOM=y
 CONFIG_SLAB_MERGE_DEFAULT=y
 # CONFIG_SLHC is not set
 # CONFIG_SLICOSS is not set
@@ -5955,7 +5991,6 @@ CONFIG_SND_PROC_FS=y
 # CONFIG_SND_SOC_FSL_AUD2HTX is not set
 # CONFIG_SND_SOC_FSL_AUDMIX is not set
 # CONFIG_SND_SOC_FSL_ESAI is not set
-# CONFIG_SND_SOC_IMX_RPMSG is not set
 # CONFIG_SND_SOC_FSL_MICFIL is not set
 # CONFIG_SND_SOC_FSL_RPMSG is not set
 # CONFIG_SND_SOC_FSL_SAI is not set
@@ -5970,6 +6005,7 @@ CONFIG_SND_PROC_FS=y
 # CONFIG_SND_SOC_IMX_CARD is not set
 # CONFIG_SND_SOC_IMX_ES8328 is not set
 # CONFIG_SND_SOC_IMX_HDMI is not set
+# CONFIG_SND_SOC_IMX_RPMSG is not set
 # CONFIG_SND_SOC_IMX_SPDIF is not set
 # CONFIG_SND_SOC_IMX_WM8962 is not set
 # CONFIG_SND_SOC_INNO_RK3036 is not set
@@ -6064,6 +6100,8 @@ CONFIG_SND_SOC_INTEL_SST_TOPLEVEL=y
 # CONFIG_SND_SOC_PCM512x_SPI is not set
 # CONFIG_SND_SOC_QCOM is not set
 # CONFIG_SND_SOC_RK3328 is not set
+# CONFIG_SND_SOC_RK817 is not set
+# CONFIG_SND_SOC_ROCKCHIP is not set
 # CONFIG_SND_SOC_RT5616 is not set
 # CONFIG_SND_SOC_RT5631 is not set
 # CONFIG_SND_SOC_RT5640 is not set
@@ -6288,6 +6326,7 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_STACKTRACE is not set
 # CONFIG_STACKTRACE_BUILD_ID is not set
 CONFIG_STACKTRACE_SUPPORT=y
+CONFIG_STACK_HASH_ORDER=20
 # CONFIG_STACK_TRACER is not set
 # CONFIG_STACK_VALIDATION is not set
 CONFIG_STAGING=y
@@ -6350,6 +6389,7 @@ CONFIG_SYMBOLIC_ERRNAME=y
 # CONFIG_SYNC_FILE is not set
 # CONFIG_SYNOPSYS_DWC_ETH_QOS is not set
 # CONFIG_SYNTH_EVENTS is not set
+# CONFIG_SYNTH_EVENT_GEN_TEST is not set
 CONFIG_SYN_COOKIES=y
 # CONFIG_SYSCON_REBOOT_MODE is not set
 CONFIG_SYSCTL=y
@@ -6424,6 +6464,7 @@ CONFIG_TCP_CONG_CUBIC=y
 # CONFIG_TEST_BLACKHOLE_DEV is not set
 # CONFIG_TEST_BPF is not set
 # CONFIG_TEST_CLOCKSOURCE_WATCHDOG is not set
+# CONFIG_TEST_DEBUG_VIRTUAL is not set
 # CONFIG_TEST_DIV64 is not set
 # CONFIG_TEST_FIRMWARE is not set
 # CONFIG_TEST_FREE_PAGES is not set
@@ -6485,7 +6526,6 @@ CONFIG_THIN_ARCHIVES=y
 # CONFIG_THUNDER_NIC_VF is not set
 # CONFIG_TICK_CPU_ACCOUNTING is not set
 CONFIG_TICK_ONESHOT=y
-CONFIG_TIERS_PER_GEN=4
 # CONFIG_TIFM_CORE is not set
 # CONFIG_TIGON3 is not set
 # CONFIG_TIMB_DMA is not set
@@ -6534,6 +6574,8 @@ CONFIG_TINY_RCU=y
 # CONFIG_TI_TSC2046 is not set
 # CONFIG_TLAN is not set
 # CONFIG_TLS is not set
+# CONFIG_TLS_DEVICE is not set
+# CONFIG_TLS_TOE is not set
 # CONFIG_TMD_HERMES is not set
 # CONFIG_TMP006 is not set
 # CONFIG_TMP007 is not set
@@ -6726,7 +6768,12 @@ CONFIG_UBIFS_FS_ZLIB=y
 CONFIG_UBIFS_FS_ZSTD=y
 # CONFIG_UBSAN is not set
 CONFIG_UBSAN_ALIGNMENT=y
+CONFIG_UBSAN_BOOL=y
+# CONFIG_UBSAN_DIV_ZERO is not set
+CONFIG_UBSAN_ENUM=y
 # CONFIG_UBSAN_MISC is not set
+CONFIG_UBSAN_SHIFT=y
+# CONFIG_UBSAN_UNREACHABLE is not set
 # CONFIG_UCB1400_CORE is not set
 # CONFIG_UCSI is not set
 # CONFIG_UDF_FS is not set
@@ -7194,6 +7241,7 @@ CONFIG_VHOST_MENU=y
 # CONFIG_VIDEO_CADENCE is not set
 # CONFIG_VIDEO_CAFE_CCIC is not set
 # CONFIG_VIDEO_CCS is not set
+# CONFIG_VIDEO_CODA is not set
 # CONFIG_VIDEO_CS3308 is not set
 # CONFIG_VIDEO_CS5345 is not set
 # CONFIG_VIDEO_CS53L32A is not set
@@ -7217,6 +7265,7 @@ CONFIG_VHOST_MENU=y
 # CONFIG_VIDEO_HEXIUM_ORION is not set
 # CONFIG_VIDEO_HI556 is not set
 # CONFIG_VIDEO_I2C is not set
+# CONFIG_VIDEO_IMX208 is not set
 # CONFIG_VIDEO_IMX214 is not set
 # CONFIG_VIDEO_IMX219 is not set
 # CONFIG_VIDEO_IMX258 is not set
@@ -7228,6 +7277,8 @@ CONFIG_VHOST_MENU=y
 # CONFIG_VIDEO_IMX355 is not set
 # CONFIG_VIDEO_IMX412 is not set
 # CONFIG_VIDEO_IMX477 is not set
+# CONFIG_VIDEO_IMX8_JPEG is not set
+# CONFIG_VIDEO_IMX_PXP is not set
 # CONFIG_VIDEO_IRS1125 is not set
 # CONFIG_VIDEO_IR_I2C is not set
 # CONFIG_VIDEO_IVTV is not set
@@ -7237,6 +7288,7 @@ CONFIG_VHOST_MENU=y
 # CONFIG_VIDEO_M52790 is not set
 # CONFIG_VIDEO_M5MOLS is not set
 # CONFIG_VIDEO_MAX9286 is not set
+# CONFIG_VIDEO_MEM2MEM_DEINTERLACE is not set
 # CONFIG_VIDEO_ML86V7667 is not set
 # CONFIG_VIDEO_MSP3400 is not set
 # CONFIG_VIDEO_MT9M001 is not set
@@ -7284,6 +7336,7 @@ CONFIG_VHOST_MENU=y
 # CONFIG_VIDEO_RDACM20 is not set
 # CONFIG_VIDEO_RDACM21 is not set
 # CONFIG_VIDEO_RJ54N1 is not set
+# CONFIG_VIDEO_ROCKCHIP_ISP1 is not set
 # CONFIG_VIDEO_S5C73M3 is not set
 # CONFIG_VIDEO_S5K4ECGX is not set
 # CONFIG_VIDEO_S5K5BAF is not set
@@ -7340,6 +7393,7 @@ CONFIG_VHOST_MENU=y
 # CONFIG_VIRTIO_CONSOLE is not set
 # CONFIG_VIRTIO_FS is not set
 # CONFIG_VIRTIO_INPUT is not set
+# CONFIG_VIRTIO_IOMMU is not set
 CONFIG_VIRTIO_MENU=y
 # CONFIG_VIRTIO_MMIO is not set
 # CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES is not set
@@ -7418,16 +7472,16 @@ CONFIG_WATCHDOG_OPEN_TIMEOUT=0
 # CONFIG_WD80x3 is not set
 # CONFIG_WDAT_WDT is not set
 # CONFIG_WDTPCI is not set
-# CONFIG_WERROR is not set
-CONFIG_WEXT_CORE=y
-CONFIG_WEXT_PRIV=y
-CONFIG_WEXT_PROC=y
-CONFIG_WEXT_SPY=y
+CONFIG_WERROR=y
+# CONFIG_WEXT_CORE is not set
+# CONFIG_WEXT_PRIV is not set
+# CONFIG_WEXT_PROC is not set
+# CONFIG_WEXT_SPY is not set
 CONFIG_WILINK_PLATFORM_DATA=y
 # CONFIG_WIMAX is not set
 # CONFIG_WIREGUARD is not set
 CONFIG_WIRELESS=y
-CONFIG_WIRELESS_EXT=y
+# CONFIG_WIRELESS_EXT is not set
 # CONFIG_WIRELESS_WDS is not set
 # CONFIG_WIZNET_W5100 is not set
 # CONFIG_WIZNET_W5300 is not set
@@ -7529,7 +7583,9 @@ CONFIG_ZONE_DMA=y
 # CONFIG_ZPA2326 is not set
 # CONFIG_ZPOOL is not set
 # CONFIG_ZRAM is not set
+# CONFIG_ZRAM_DEF_COMP_842 is not set
 # CONFIG_ZRAM_DEF_COMP_LZ4 is not set
+# CONFIG_ZRAM_DEF_COMP_LZ4HC is not set
 # CONFIG_ZRAM_DEF_COMP_LZO is not set
 # CONFIG_ZRAM_DEF_COMP_LZORLE is not set
 # CONFIG_ZRAM_DEF_COMP_ZSTD is not set
diff --git a/target/linux/generic/config-6.1 b/target/linux/generic/config-6.1
new file mode 100644
index 00000000000000..6252e668965117
--- /dev/null
+++ b/target/linux/generic/config-6.1
@@ -0,0 +1,7858 @@
+# CONFIG_104_QUAD_8 is not set
+CONFIG_32BIT=y
+CONFIG_64BIT_TIME=y
+# CONFIG_6LOWPAN is not set
+# CONFIG_6LOWPAN_DEBUGFS is not set
+# CONFIG_6PACK is not set
+# CONFIG_8139CP is not set
+# CONFIG_8139TOO is not set
+# CONFIG_9P_FS is not set
+# CONFIG_AB3100_CORE is not set
+# CONFIG_AB8500_CORE is not set
+# CONFIG_ABP060MG is not set
+# CONFIG_ABX500_CORE is not set
+# CONFIG_ACCESSIBILITY is not set
+# CONFIG_ACENIC is not set
+# CONFIG_ACERHDF is not set
+# CONFIG_ACER_WIRELESS is not set
+# CONFIG_ACORN_PARTITION is not set
+# CONFIG_ACPI_ALS is not set
+# CONFIG_ACPI_APEI is not set
+# CONFIG_ACPI_APEI_PCIEAER is not set
+# CONFIG_ACPI_BUTTON is not set
+# CONFIG_ACPI_CONFIGFS is not set
+# CONFIG_ACPI_CUSTOM_METHOD is not set
+# CONFIG_ACPI_EXTLOG is not set
+# CONFIG_ACPI_HED is not set
+# CONFIG_ACPI_NFIT is not set
+# CONFIG_ACPI_REDUCED_HARDWARE_ONLY is not set
+# CONFIG_ACPI_TABLE_UPGRADE is not set
+# CONFIG_ACPI_VIDEO is not set
+# CONFIG_AD2S1200 is not set
+# CONFIG_AD2S1210 is not set
+# CONFIG_AD2S90 is not set
+# CONFIG_AD3552R is not set
+# CONFIG_AD5064 is not set
+# CONFIG_AD5110 is not set
+# CONFIG_AD525X_DPOT is not set
+# CONFIG_AD5272 is not set
+# CONFIG_AD5360 is not set
+# CONFIG_AD5380 is not set
+# CONFIG_AD5421 is not set
+# CONFIG_AD5446 is not set
+# CONFIG_AD5449 is not set
+# CONFIG_AD5504 is not set
+# CONFIG_AD5592R is not set
+# CONFIG_AD5593R is not set
+# CONFIG_AD5624R_SPI is not set
+# CONFIG_AD5686 is not set
+# CONFIG_AD5686_SPI is not set
+# CONFIG_AD5696_I2C is not set
+# CONFIG_AD5755 is not set
+# CONFIG_AD5758 is not set
+# CONFIG_AD5761 is not set
+# CONFIG_AD5764 is not set
+# CONFIG_AD5766 is not set
+# CONFIG_AD5770R is not set
+# CONFIG_AD5791 is not set
+# CONFIG_AD5933 is not set
+# CONFIG_AD7091R5 is not set
+# CONFIG_AD7124 is not set
+# CONFIG_AD7150 is not set
+# CONFIG_AD7152 is not set
+# CONFIG_AD7192 is not set
+# CONFIG_AD7266 is not set
+# CONFIG_AD7280 is not set
+# CONFIG_AD7291 is not set
+# CONFIG_AD7292 is not set
+# CONFIG_AD7293 is not set
+# CONFIG_AD7298 is not set
+# CONFIG_AD7303 is not set
+# CONFIG_AD74413R is not set
+# CONFIG_AD7476 is not set
+# CONFIG_AD7606 is not set
+# CONFIG_AD7606_IFACE_PARALLEL is not set
+# CONFIG_AD7606_IFACE_SPI is not set
+# CONFIG_AD7746 is not set
+# CONFIG_AD7766 is not set
+# CONFIG_AD7768_1 is not set
+# CONFIG_AD7780 is not set
+# CONFIG_AD7791 is not set
+# CONFIG_AD7793 is not set
+# CONFIG_AD7816 is not set
+# CONFIG_AD7887 is not set
+# CONFIG_AD7923 is not set
+# CONFIG_AD7949 is not set
+# CONFIG_AD799X is not set
+# CONFIG_AD8366 is not set
+# CONFIG_AD8801 is not set
+# CONFIG_AD9467 is not set
+# CONFIG_AD9523 is not set
+# CONFIG_AD9832 is not set
+# CONFIG_AD9834 is not set
+# CONFIG_ADA4250 is not set
+# CONFIG_ADAPTEC_STARFIRE is not set
+# CONFIG_ADE7854 is not set
+# CONFIG_ADF4350 is not set
+# CONFIG_ADF4371 is not set
+# CONFIG_ADFS_FS is not set
+# CONFIG_ADIN1100_PHY is not set
+# CONFIG_ADIN1110 is not set
+# CONFIG_ADIN_PHY is not set
+# CONFIG_ADIS16080 is not set
+# CONFIG_ADIS16130 is not set
+# CONFIG_ADIS16136 is not set
+# CONFIG_ADIS16201 is not set
+# CONFIG_ADIS16203 is not set
+# CONFIG_ADIS16209 is not set
+# CONFIG_ADIS16240 is not set
+# CONFIG_ADIS16260 is not set
+# CONFIG_ADIS16400 is not set
+# CONFIG_ADIS16460 is not set
+# CONFIG_ADIS16475 is not set
+# CONFIG_ADIS16480 is not set
+# CONFIG_ADI_AXI_ADC is not set
+# CONFIG_ADJD_S311 is not set
+# CONFIG_ADM6996_PHY is not set
+# CONFIG_ADM8211 is not set
+# CONFIG_ADMV1013 is not set
+# CONFIG_ADMV1014 is not set
+# CONFIG_ADMV4420 is not set
+# CONFIG_ADMV8818 is not set
+# CONFIG_ADRF6780 is not set
+# CONFIG_ADT7316 is not set
+# CONFIG_ADUX1020 is not set
+CONFIG_ADVISE_SYSCALLS=y
+# CONFIG_ADXL313_I2C is not set
+# CONFIG_ADXL313_SPI is not set
+# CONFIG_ADXL345_I2C is not set
+# CONFIG_ADXL345_SPI is not set
+# CONFIG_ADXL355_I2C is not set
+# CONFIG_ADXL355_SPI is not set
+# CONFIG_ADXL367_I2C is not set
+# CONFIG_ADXL367_SPI is not set
+# CONFIG_ADXL372_I2C is not set
+# CONFIG_ADXL372_SPI is not set
+# CONFIG_ADXRS290 is not set
+# CONFIG_ADXRS450 is not set
+CONFIG_AEABI=y
+# CONFIG_AFE4403 is not set
+# CONFIG_AFE4404 is not set
+# CONFIG_AFFS_FS is not set
+# CONFIG_AFS_DEBUG_CURSOR is not set
+# CONFIG_AFS_FS is not set
+# CONFIG_AF_KCM is not set
+# CONFIG_AF_RXRPC is not set
+# CONFIG_AF_RXRPC_INJECT_LOSS is not set
+# CONFIG_AF_RXRPC_IPV6 is not set
+CONFIG_AF_UNIX_OOB=y
+# CONFIG_AGP is not set
+# CONFIG_AHCI_BRCM is not set
+# CONFIG_AHCI_CEVA is not set
+# CONFIG_AHCI_DWC is not set
+# CONFIG_AHCI_IMX is not set
+# CONFIG_AHCI_MVEBU is not set
+# CONFIG_AHCI_QORIQ is not set
+# CONFIG_AHCI_XGENE is not set
+CONFIG_AIO=y
+# CONFIG_AIRO is not set
+# CONFIG_AIRO_CS is not set
+# CONFIG_AIX_PARTITION is not set
+# CONFIG_AK09911 is not set
+# CONFIG_AK8974 is not set
+# CONFIG_AK8975 is not set
+# CONFIG_AL3010 is not set
+# CONFIG_AL3320A is not set
+# CONFIG_ALIM7101_WDT is not set
+CONFIG_ALLOW_DEV_COREDUMP=y
+# CONFIG_ALTERA_MBOX is not set
+# CONFIG_ALTERA_MSGDMA is not set
+# CONFIG_ALTERA_STAPL is not set
+# CONFIG_ALTERA_TSE is not set
+# CONFIG_ALX is not set
+# CONFIG_AL_FIC is not set
+# CONFIG_AM2315 is not set
+# CONFIG_AM335X_PHY_USB is not set
+# CONFIG_AMBA_PL08X is not set
+# CONFIG_AMD8111_ETH is not set
+# CONFIG_AMD_MEM_ENCRYPT is not set
+# CONFIG_AMD_PHY is not set
+# CONFIG_AMD_XGBE is not set
+# CONFIG_AMD_XGBE_HAVE_ECC is not set
+# CONFIG_AMIGA_PARTITION is not set
+# CONFIG_AMILO_RFKILL is not set
+# CONFIG_AMT is not set
+# CONFIG_ANDROID is not set
+# CONFIG_ANDROID_BINDER_IPC is not set
+CONFIG_ANON_INODES=y
+# CONFIG_ANON_VMA_NAME is not set
+# CONFIG_APDS9300 is not set
+# CONFIG_APDS9802ALS is not set
+# CONFIG_APDS9960 is not set
+# CONFIG_APM8018X is not set
+# CONFIG_APM_EMULATION is not set
+# CONFIG_APPLE_GMUX is not set
+# CONFIG_APPLE_MFI_FASTCHARGE is not set
+# CONFIG_APPLE_PROPERTIES is not set
+# CONFIG_APPLICOM is not set
+# CONFIG_AQTION is not set
+# CONFIG_AQUANTIA_PHY is not set
+# CONFIG_AR5523 is not set
+# CONFIG_AR7 is not set
+# CONFIG_AR8216_PHY is not set
+# CONFIG_AR8216_PHY_LEDS is not set
+# CONFIG_ARCH_ACTIONS is not set
+# CONFIG_ARCH_AGILEX is not set
+# CONFIG_ARCH_AIROHA is not set
+# CONFIG_ARCH_ALPINE is not set
+# CONFIG_ARCH_APPLE is not set
+# CONFIG_ARCH_ARTPEC is not set
+# CONFIG_ARCH_ASPEED is not set
+# CONFIG_ARCH_AT91 is not set
+# CONFIG_ARCH_AXXIA is not set
+# CONFIG_ARCH_BCM is not set
+# CONFIG_ARCH_BCM2835 is not set
+# CONFIG_ARCH_BCM4908 is not set
+# CONFIG_ARCH_BCMBCA is not set
+# CONFIG_ARCH_BCM_21664 is not set
+# CONFIG_ARCH_BCM_23550 is not set
+# CONFIG_ARCH_BCM_281XX is not set
+# CONFIG_ARCH_BCM_5301X is not set
+# CONFIG_ARCH_BCM_53573 is not set
+# CONFIG_ARCH_BCM_63XX is not set
+# CONFIG_ARCH_BCM_CYGNUS is not set
+# CONFIG_ARCH_BCM_HR2 is not set
+# CONFIG_ARCH_BCM_IPROC is not set
+# CONFIG_ARCH_BCM_NSP is not set
+# CONFIG_ARCH_BERLIN is not set
+CONFIG_ARCH_BINFMT_ELF_STATE=y
+# CONFIG_ARCH_BITMAIN is not set
+# CONFIG_ARCH_BRCMSTB is not set
+# CONFIG_ARCH_CLPS711X is not set
+# CONFIG_ARCH_CNS3XXX is not set
+# CONFIG_ARCH_DAVINCI is not set
+# CONFIG_ARCH_DIGICOLOR is not set
+# CONFIG_ARCH_DMA_ADDR_T_64BIT is not set
+# CONFIG_ARCH_DOVE is not set
+# CONFIG_ARCH_EBSA110 is not set
+# CONFIG_ARCH_EP93XX is not set
+# CONFIG_ARCH_EXYNOS is not set
+CONFIG_ARCH_FLATMEM_ENABLE=y
+# CONFIG_ARCH_FOOTBRIDGE is not set
+# CONFIG_ARCH_GEMINI is not set
+# CONFIG_ARCH_HI3xxx is not set
+# CONFIG_ARCH_HIGHBANK is not set
+# CONFIG_ARCH_HISI is not set
+# CONFIG_ARCH_HPE is not set
+# CONFIG_ARCH_INTEGRATOR is not set
+# CONFIG_ARCH_INTEL_SOCFPGA is not set
+# CONFIG_ARCH_IOP13XX is not set
+# CONFIG_ARCH_IOP32X is not set
+# CONFIG_ARCH_IOP33X is not set
+# CONFIG_ARCH_IXP4XX is not set
+# CONFIG_ARCH_K3 is not set
+# CONFIG_ARCH_KEEMBAY is not set
+# CONFIG_ARCH_KEYSTONE is not set
+# CONFIG_ARCH_KS8695 is not set
+# CONFIG_ARCH_LAYERSCAPE is not set
+# CONFIG_ARCH_LG1K is not set
+# CONFIG_ARCH_LPC32XX is not set
+# CONFIG_ARCH_MEDIATEK is not set
+# CONFIG_ARCH_MESON is not set
+# CONFIG_ARCH_MILBEAUT is not set
+CONFIG_ARCH_MMAP_RND_BITS=8
+CONFIG_ARCH_MMAP_RND_BITS_MAX=16
+CONFIG_ARCH_MMAP_RND_BITS_MIN=8
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=16
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8
+# CONFIG_ARCH_MMP is not set
+# CONFIG_ARCH_MSTARV7 is not set
+# CONFIG_ARCH_MULTIPLATFORM is not set
+# CONFIG_ARCH_MULTI_V6 is not set
+# CONFIG_ARCH_MULTI_V7 is not set
+# CONFIG_ARCH_MV78XX0 is not set
+# CONFIG_ARCH_MVEBU is not set
+# CONFIG_ARCH_MXC is not set
+# CONFIG_ARCH_MXS is not set
+# CONFIG_ARCH_NEEDS_CPU_IDLE_COUPLED is not set
+# CONFIG_ARCH_NETX is not set
+# CONFIG_ARCH_NOMADIK is not set
+# CONFIG_ARCH_NPCM is not set
+# CONFIG_ARCH_NSPIRE is not set
+# CONFIG_ARCH_NXP is not set
+# CONFIG_ARCH_OMAP is not set
+# CONFIG_ARCH_OMAP1 is not set
+# CONFIG_ARCH_OMAP2 is not set
+# CONFIG_ARCH_OMAP2PLUS is not set
+# CONFIG_ARCH_OMAP3 is not set
+# CONFIG_ARCH_OMAP4 is not set
+# CONFIG_ARCH_ORION5X is not set
+# CONFIG_ARCH_OXNAS is not set
+# CONFIG_ARCH_PICOXCELL is not set
+# CONFIG_ARCH_PRIMA2 is not set
+# CONFIG_ARCH_PXA is not set
+# CONFIG_ARCH_QCOM is not set
+# CONFIG_ARCH_RANDOM is not set
+# CONFIG_ARCH_RDA is not set
+# CONFIG_ARCH_REALTEK is not set
+# CONFIG_ARCH_REALVIEW is not set
+# CONFIG_ARCH_RENESAS is not set
+# CONFIG_ARCH_ROCKCHIP is not set
+# CONFIG_ARCH_RPC is not set
+# CONFIG_ARCH_S32 is not set
+# CONFIG_ARCH_S3C24XX is not set
+# CONFIG_ARCH_S3C64XX is not set
+# CONFIG_ARCH_S5PV210 is not set
+# CONFIG_ARCH_SA1100 is not set
+# CONFIG_ARCH_SEATTLE is not set
+# CONFIG_ARCH_SHMOBILE is not set
+# CONFIG_ARCH_SIRF is not set
+# CONFIG_ARCH_SOCFPGA is not set
+# CONFIG_ARCH_SPARX5 is not set
+# CONFIG_ARCH_SPRD is not set
+# CONFIG_ARCH_STI is not set
+# CONFIG_ARCH_STM32 is not set
+# CONFIG_ARCH_STRATIX10 is not set
+# CONFIG_ARCH_SUNPLUS is not set
+# CONFIG_ARCH_SUNXI is not set
+# CONFIG_ARCH_SYNQUACER is not set
+# CONFIG_ARCH_TANGO is not set
+# CONFIG_ARCH_TEGRA is not set
+# CONFIG_ARCH_THUNDER is not set
+# CONFIG_ARCH_THUNDER2 is not set
+# CONFIG_ARCH_U300 is not set
+# CONFIG_ARCH_U8500 is not set
+# CONFIG_ARCH_UNIPHIER is not set
+# CONFIG_ARCH_VERSATILE is not set
+# CONFIG_ARCH_VEXPRESS is not set
+# CONFIG_ARCH_VIRT is not set
+# CONFIG_ARCH_VISCONTI is not set
+# CONFIG_ARCH_VT8500 is not set
+# CONFIG_ARCH_VULCAN is not set
+# CONFIG_ARCH_W90X900 is not set
+# CONFIG_ARCH_WANTS_THP_SWAP is not set
+# CONFIG_ARCH_WM8505 is not set
+# CONFIG_ARCH_WM8750 is not set
+# CONFIG_ARCH_WM8850 is not set
+# CONFIG_ARCH_XGENE is not set
+# CONFIG_ARCH_ZX is not set
+# CONFIG_ARCH_ZYNQ is not set
+# CONFIG_ARCH_ZYNQMP is not set
+# CONFIG_ARCNET is not set
+# CONFIG_ARC_EMAC is not set
+# CONFIG_ARC_IRQ_NO_AUTOSAVE is not set
+# CONFIG_ARM64_16K_PAGES is not set
+# CONFIG_ARM64_64K_PAGES is not set
+# CONFIG_ARM64_AMU_EXTN is not set
+# CONFIG_ARM64_BTI is not set
+# CONFIG_ARM64_CRYPTO is not set
+# CONFIG_ARM64_E0PD is not set
+# CONFIG_ARM64_ERRATUM_1024718 is not set
+# CONFIG_ARM64_ERRATUM_1165522 is not set
+# CONFIG_ARM64_ERRATUM_1286807 is not set
+# CONFIG_ARM64_ERRATUM_1319367 is not set
+# CONFIG_ARM64_ERRATUM_1418040 is not set
+# CONFIG_ARM64_ERRATUM_1463225 is not set
+# CONFIG_ARM64_ERRATUM_1508412 is not set
+# CONFIG_ARM64_ERRATUM_1530923 is not set
+# CONFIG_ARM64_ERRATUM_1542419 is not set
+# CONFIG_ARM64_ERRATUM_1742098 is not set
+# CONFIG_ARM64_ERRATUM_2051678 is not set
+# CONFIG_ARM64_ERRATUM_2054223 is not set
+# CONFIG_ARM64_ERRATUM_2067961 is not set
+# CONFIG_ARM64_ERRATUM_2077057 is not set
+# CONFIG_ARM64_ERRATUM_2441007 is not set
+# CONFIG_ARM64_ERRATUM_2441009 is not set
+# CONFIG_ARM64_ERRATUM_2658417 is not set
+# CONFIG_ARM64_ERRATUM_819472 is not set
+# CONFIG_ARM64_ERRATUM_824069 is not set
+# CONFIG_ARM64_ERRATUM_826319 is not set
+# CONFIG_ARM64_ERRATUM_827319 is not set
+# CONFIG_ARM64_ERRATUM_832075 is not set
+# CONFIG_ARM64_ERRATUM_834220 is not set
+# CONFIG_ARM64_ERRATUM_843419 is not set
+# CONFIG_ARM64_ERRATUM_845719 is not set
+# CONFIG_ARM64_ERRATUM_858921 is not set
+# CONFIG_ARM64_HW_AFDBM is not set
+# CONFIG_ARM64_LSE_ATOMICS is not set
+CONFIG_ARM64_MODULE_PLTS=y
+# CONFIG_ARM64_MTE is not set
+# CONFIG_ARM64_PAN is not set
+# CONFIG_ARM64_PMEM is not set
+# CONFIG_ARM64_PSEUDO_NMI is not set
+# CONFIG_ARM64_PTDUMP_DEBUGFS is not set
+# CONFIG_ARM64_PTR_AUTH is not set
+# CONFIG_ARM64_RANDOMIZE_TEXT_OFFSET is not set
+# CONFIG_ARM64_RAS_EXTN is not set
+# CONFIG_ARM64_RELOC_TEST is not set
+# CONFIG_ARM64_SME is not set
+# CONFIG_ARM64_SVE is not set
+CONFIG_ARM64_SW_TTBR0_PAN=y
+# CONFIG_ARM64_TLB_RANGE is not set
+# CONFIG_ARM64_UAO is not set
+# CONFIG_ARM64_USE_LSE_ATOMICS is not set
+# CONFIG_ARM64_VA_BITS_48 is not set
+# CONFIG_ARM64_VHE is not set
+# CONFIG_ARM_APPENDED_DTB is not set
+# CONFIG_ARM_ARCH_TIMER is not set
+# CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_EXTEND is not set
+# CONFIG_ARM_BIG_LITTLE_CPUFREQ is not set
+# CONFIG_ARM_CCI is not set
+# CONFIG_ARM_CCI400_PMU is not set
+# CONFIG_ARM_CCI5xx_PMU is not set
+# CONFIG_ARM_CCI_PMU is not set
+# CONFIG_ARM_CCN is not set
+# CONFIG_ARM_CMN is not set
+# CONFIG_ARM_CPUIDLE is not set
+CONFIG_ARM_CPU_TOPOLOGY=y
+# CONFIG_ARM_CRYPTO is not set
+CONFIG_ARM_DMA_MEM_BUFFERABLE=y
+# CONFIG_ARM_DSU_PMU is not set
+# CONFIG_ARM_ERRATA_326103 is not set
+# CONFIG_ARM_ERRATA_364296 is not set
+# CONFIG_ARM_ERRATA_411920 is not set
+# CONFIG_ARM_ERRATA_430973 is not set
+# CONFIG_ARM_ERRATA_458693 is not set
+# CONFIG_ARM_ERRATA_460075 is not set
+# CONFIG_ARM_ERRATA_643719 is not set
+# CONFIG_ARM_ERRATA_720789 is not set
+# CONFIG_ARM_ERRATA_742230 is not set
+# CONFIG_ARM_ERRATA_742231 is not set
+# CONFIG_ARM_ERRATA_743622 is not set
+# CONFIG_ARM_ERRATA_751472 is not set
+# CONFIG_ARM_ERRATA_754322 is not set
+# CONFIG_ARM_ERRATA_754327 is not set
+# CONFIG_ARM_ERRATA_764319 is not set
+# CONFIG_ARM_ERRATA_764369 is not set
+# CONFIG_ARM_ERRATA_773022 is not set
+# CONFIG_ARM_ERRATA_775420 is not set
+# CONFIG_ARM_ERRATA_798181 is not set
+# CONFIG_ARM_ERRATA_814220 is not set
+# CONFIG_ARM_ERRATA_818325_852422 is not set
+# CONFIG_ARM_ERRATA_821420 is not set
+# CONFIG_ARM_ERRATA_825619 is not set
+# CONFIG_ARM_ERRATA_852421 is not set
+# CONFIG_ARM_ERRATA_852423 is not set
+# CONFIG_ARM_ERRATA_857271 is not set
+# CONFIG_ARM_ERRATA_857272 is not set
+# CONFIG_ARM_FFA_TRANSPORT is not set
+CONFIG_ARM_GIC_MAX_NR=1
+# CONFIG_ARM_KIRKWOOD_CPUFREQ is not set
+# CONFIG_ARM_KPROBES_TEST is not set
+# CONFIG_ARM_LPAE is not set
+# CONFIG_ARM_MEDIATEK_CPUFREQ_HW is not set
+# CONFIG_ARM_MHU is not set
+CONFIG_ARM_MODULE_PLTS=y
+# CONFIG_ARM_PATCH_PHYS_VIRT is not set
+# CONFIG_ARM_PSCI is not set
+# CONFIG_ARM_PSCI_CHECKER is not set
+# CONFIG_ARM_PSCI_CPUIDLE is not set
+# CONFIG_ARM_PTDUMP_DEBUGFS is not set
+# CONFIG_ARM_SBSA_WATCHDOG is not set
+# CONFIG_ARM_SCMI_PROTOCOL is not set
+# CONFIG_ARM_SCPI_PROTOCOL is not set
+# CONFIG_ARM_SDE_INTERFACE is not set
+# CONFIG_ARM_SMCCC_SOC_ID is not set
+# CONFIG_ARM_SMC_WATCHDOG is not set
+# CONFIG_ARM_SP805_WATCHDOG is not set
+# CONFIG_ARM_SPE_PMU is not set
+# CONFIG_ARM_THUMBEE is not set
+# CONFIG_ARM_TIMER_SP804 is not set
+# CONFIG_ARM_UNWIND is not set
+# CONFIG_ARM_VIRT_EXT is not set
+# CONFIG_AS3935 is not set
+# CONFIG_AS73211 is not set
+# CONFIG_ASM9260_TIMER is not set
+# CONFIG_ASN1 is not set
+# CONFIG_ASUS_LAPTOP is not set
+# CONFIG_ASUS_WIRELESS is not set
+# CONFIG_ASYMMETRIC_KEY_TYPE is not set
+# CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE is not set
+# CONFIG_ASYNC_RAID6_TEST is not set
+# CONFIG_ASYNC_TX_DMA is not set
+# CONFIG_AT76C50X_USB is not set
+# CONFIG_AT803X_PHY is not set
+# CONFIG_AT91_SAMA5D2_ADC is not set
+# CONFIG_ATA is not set
+# CONFIG_ATAGS is not set
+CONFIG_ATAGS_PROC=y
+# CONFIG_ATALK is not set
+# CONFIG_ATARI_PARTITION is not set
+# CONFIG_ATA_ACPI is not set
+CONFIG_ATA_BMDMA=y
+# CONFIG_ATA_FORCE is not set
+# CONFIG_ATA_GENERIC is not set
+# CONFIG_ATA_LEDS is not set
+# CONFIG_ATA_NONSTANDARD is not set
+# CONFIG_ATA_OVER_ETH is not set
+# CONFIG_ATA_PIIX is not set
+CONFIG_ATA_SFF=y
+# CONFIG_ATA_VERBOSE_ERROR is not set
+# CONFIG_ATH10K is not set
+# CONFIG_ATH25 is not set
+# CONFIG_ATH5K is not set
+# CONFIG_ATH6KL is not set
+# CONFIG_ATH79 is not set
+# CONFIG_ATH9K is not set
+# CONFIG_ATH9K_HTC is not set
+# CONFIG_ATH_DEBUG is not set
+# CONFIG_ATL1 is not set
+# CONFIG_ATL1C is not set
+# CONFIG_ATL1E is not set
+# CONFIG_ATL2 is not set
+# CONFIG_ATLAS_EZO_SENSOR is not set
+# CONFIG_ATLAS_PH_SENSOR is not set
+# CONFIG_ATM is not set
+# CONFIG_ATMEL is not set
+# CONFIG_ATMEL_PIT is not set
+# CONFIG_ATMEL_SSC is not set
+# CONFIG_ATM_AMBASSADOR is not set
+# CONFIG_ATM_BR2684 is not set
+CONFIG_ATM_BR2684_IPFILTER=y
+# CONFIG_ATM_CLIP is not set
+CONFIG_ATM_CLIP_NO_ICMP=y
+# CONFIG_ATM_DRIVERS is not set
+# CONFIG_ATM_DUMMY is not set
+# CONFIG_ATM_ENI is not set
+# CONFIG_ATM_FIRESTREAM is not set
+# CONFIG_ATM_FORE200E is not set
+# CONFIG_ATM_HE is not set
+# CONFIG_ATM_HORIZON is not set
+# CONFIG_ATM_IA is not set
+# CONFIG_ATM_IDT77252 is not set
+# CONFIG_ATM_LANAI is not set
+# CONFIG_ATM_LANE is not set
+# CONFIG_ATM_MPOA is not set
+# CONFIG_ATM_NICSTAR is not set
+# CONFIG_ATM_SOLOS is not set
+# CONFIG_ATM_TCP is not set
+# CONFIG_ATM_ZATM is not set
+# CONFIG_ATOMIC64_SELFTEST is not set
+# CONFIG_ATP is not set
+# CONFIG_AUDIT is not set
+# CONFIG_AUDIT_ARCH_COMPAT_GENERIC is not set
+# CONFIG_AURORA_NB8800 is not set
+# CONFIG_AUTOFS4_FS is not set
+# CONFIG_AUTOFS_FS is not set
+# CONFIG_AUTO_ZRELADDR is not set
+# CONFIG_AUXDISPLAY is not set
+# CONFIG_AX25 is not set
+# CONFIG_AX25_DAMA_SLAVE is not set
+# CONFIG_AX88796 is not set
+# CONFIG_AX88796B_PHY is not set
+# CONFIG_AXP20X_ADC is not set
+# CONFIG_AXP20X_POWER is not set
+# CONFIG_AXP288_ADC is not set
+# CONFIG_AXP288_FUEL_GAUGE is not set
+# CONFIG_B43 is not set
+# CONFIG_B43LEGACY is not set
+# CONFIG_B44 is not set
+# CONFIG_B53 is not set
+# CONFIG_B53_MDIO_DRIVER is not set
+# CONFIG_B53_MMAP_DRIVER is not set
+# CONFIG_B53_SERDES is not set
+# CONFIG_B53_SPI_DRIVER is not set
+# CONFIG_B53_SRAB_DRIVER is not set
+# CONFIG_BACKLIGHT_ADP8860 is not set
+# CONFIG_BACKLIGHT_ADP8870 is not set
+# CONFIG_BACKLIGHT_APPLE is not set
+# CONFIG_BACKLIGHT_ARCXCNN is not set
+# CONFIG_BACKLIGHT_BD6107 is not set
+# CONFIG_BACKLIGHT_CLASS_DEVICE is not set
+# CONFIG_BACKLIGHT_GENERIC is not set
+# CONFIG_BACKLIGHT_GPIO is not set
+# CONFIG_BACKLIGHT_KTD253 is not set
+# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
+# CONFIG_BACKLIGHT_LED is not set
+# CONFIG_BACKLIGHT_LM3630A is not set
+# CONFIG_BACKLIGHT_LM3639 is not set
+# CONFIG_BACKLIGHT_LP855X is not set
+# CONFIG_BACKLIGHT_LV5207LP is not set
+# CONFIG_BACKLIGHT_PANDORA is not set
+# CONFIG_BACKLIGHT_PM8941_WLED is not set
+# CONFIG_BACKLIGHT_PWM is not set
+# CONFIG_BACKLIGHT_QCOM_WLED is not set
+# CONFIG_BACKLIGHT_RPI is not set
+# CONFIG_BACKLIGHT_SAHARA is not set
+# CONFIG_BACKTRACE_SELF_TEST is not set
+# CONFIG_BACKTRACE_VERBOSE is not set
+# CONFIG_BAREUDP is not set
+CONFIG_BASE_FULL=y
+CONFIG_BASE_SMALL=0
+# CONFIG_BATMAN_ADV is not set
+# CONFIG_BATTERY_BQ27XXX is not set
+# CONFIG_BATTERY_BQ27XXX_HDQ is not set
+# CONFIG_BATTERY_CW2015 is not set
+# CONFIG_BATTERY_DS2760 is not set
+# CONFIG_BATTERY_DS2780 is not set
+# CONFIG_BATTERY_DS2781 is not set
+# CONFIG_BATTERY_DS2782 is not set
+# CONFIG_BATTERY_GAUGE_LTC2941 is not set
+# CONFIG_BATTERY_GOLDFISH is not set
+# CONFIG_BATTERY_LEGO_EV3 is not set
+# CONFIG_BATTERY_MAX17040 is not set
+# CONFIG_BATTERY_MAX17042 is not set
+# CONFIG_BATTERY_MAX1721X is not set
+# CONFIG_BATTERY_RT5033 is not set
+# CONFIG_BATTERY_SAMSUNG_SDI is not set
+# CONFIG_BATTERY_SBS is not set
+# CONFIG_BATTERY_UG3105 is not set
+# CONFIG_BAYCOM_EPP is not set
+# CONFIG_BAYCOM_PAR is not set
+# CONFIG_BAYCOM_SER_FDX is not set
+# CONFIG_BAYCOM_SER_HDX is not set
+# CONFIG_BCACHE is not set
+# CONFIG_BCM47XX is not set
+# CONFIG_BCM54140_PHY is not set
+# CONFIG_BCM63XX is not set
+# CONFIG_BCM63XX_PHY is not set
+# CONFIG_BCM7038_L1_IRQ is not set
+# CONFIG_BCM7038_WDT is not set
+# CONFIG_BCM7120_L2_IRQ is not set
+# CONFIG_BCM7XXX_PHY is not set
+# CONFIG_BCM84881_PHY is not set
+# CONFIG_BCM87XX_PHY is not set
+# CONFIG_BCMA is not set
+# CONFIG_BCMA_DRIVER_GPIO is not set
+CONFIG_BCMA_POSSIBLE=y
+# CONFIG_BCMGENET is not set
+# CONFIG_BCM_IPROC_ADC is not set
+# CONFIG_BCM_KONA_USB2_PHY is not set
+# CONFIG_BCM_SBA_RAID is not set
+# CONFIG_BCM_VK is not set
+# CONFIG_BDI_SWITCH is not set
+# CONFIG_BE2ISCSI is not set
+# CONFIG_BE2NET is not set
+# CONFIG_BEFS_FS is not set
+# CONFIG_BFS_FS is not set
+# CONFIG_BGMAC is not set
+# CONFIG_BH1750 is not set
+# CONFIG_BH1780 is not set
+# CONFIG_BIG_KEYS is not set
+# CONFIG_BIG_LITTLE is not set
+CONFIG_BINARY_PRINTF=y
+# CONFIG_BINFMT_AOUT is not set
+CONFIG_BINFMT_ELF=y
+# CONFIG_BINFMT_ELF_FDPIC is not set
+# CONFIG_BINFMT_FLAT is not set
+# CONFIG_BINFMT_MISC is not set
+CONFIG_BINFMT_SCRIPT=y
+CONFIG_BITREVERSE=y
+# CONFIG_BLK_CGROUP_IOCOST is not set
+# CONFIG_BLK_CGROUP_IOLATENCY is not set
+# CONFIG_BLK_CGROUP_IOPRIO is not set
+# CONFIG_BLK_CMDLINE_PARSER is not set
+# CONFIG_BLK_DEBUG_FS is not set
+CONFIG_BLK_DEV=y
+# CONFIG_BLK_DEV_3W_XXXX_RAID is not set
+# CONFIG_BLK_DEV_4DRIVES is not set
+# CONFIG_BLK_DEV_AEC62XX is not set
+# CONFIG_BLK_DEV_ALI14XX is not set
+# CONFIG_BLK_DEV_ALI15X3 is not set
+# CONFIG_BLK_DEV_AMD74XX is not set
+# CONFIG_BLK_DEV_ATIIXP is not set
+# CONFIG_BLK_DEV_BSG is not set
+# CONFIG_BLK_DEV_BSGLIB is not set
+# CONFIG_BLK_DEV_CMD640 is not set
+# CONFIG_BLK_DEV_CMD64X is not set
+# CONFIG_BLK_DEV_COW_COMMON is not set
+# CONFIG_BLK_DEV_CRYPTOLOOP is not set
+# CONFIG_BLK_DEV_CS5520 is not set
+# CONFIG_BLK_DEV_CS5530 is not set
+# CONFIG_BLK_DEV_CS5535 is not set
+# CONFIG_BLK_DEV_CS5536 is not set
+# CONFIG_BLK_DEV_CY82C693 is not set
+# CONFIG_BLK_DEV_DAC960 is not set
+# CONFIG_BLK_DEV_DELKIN is not set
+# CONFIG_BLK_DEV_DM is not set
+# CONFIG_BLK_DEV_DRBD is not set
+# CONFIG_BLK_DEV_DTC2278 is not set
+# CONFIG_BLK_DEV_FD is not set
+# CONFIG_BLK_DEV_GENERIC is not set
+# CONFIG_BLK_DEV_HPT366 is not set
+# CONFIG_BLK_DEV_HT6560B is not set
+# CONFIG_BLK_DEV_IDEACPI is not set
+# CONFIG_BLK_DEV_IDECD is not set
+# CONFIG_BLK_DEV_IDECS is not set
+# CONFIG_BLK_DEV_IDEPCI is not set
+# CONFIG_BLK_DEV_IDEPNP is not set
+# CONFIG_BLK_DEV_IDETAPE is not set
+# CONFIG_BLK_DEV_IDE_AU1XXX is not set
+# CONFIG_BLK_DEV_IDE_SATA is not set
+CONFIG_BLK_DEV_INITRD=y
+# CONFIG_BLK_DEV_INTEGRITY is not set
+# CONFIG_BLK_DEV_IO_TRACE is not set
+# CONFIG_BLK_DEV_IT8172 is not set
+# CONFIG_BLK_DEV_IT8213 is not set
+# CONFIG_BLK_DEV_IT821X is not set
+# CONFIG_BLK_DEV_JMICRON is not set
+# CONFIG_BLK_DEV_LOOP is not set
+CONFIG_BLK_DEV_LOOP_MIN_COUNT=8
+# CONFIG_BLK_DEV_MD is not set
+# CONFIG_BLK_DEV_NBD is not set
+# CONFIG_BLK_DEV_NS87415 is not set
+# CONFIG_BLK_DEV_NULL_BLK is not set
+# CONFIG_BLK_DEV_NVME is not set
+# CONFIG_BLK_DEV_OFFBOARD is not set
+# CONFIG_BLK_DEV_OPTI621 is not set
+# CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set
+# CONFIG_BLK_DEV_PDC202XX_NEW is not set
+# CONFIG_BLK_DEV_PDC202XX_OLD is not set
+# CONFIG_BLK_DEV_PIIX is not set
+# CONFIG_BLK_DEV_PLATFORM is not set
+# CONFIG_BLK_DEV_PMEM is not set
+# CONFIG_BLK_DEV_QD65XX is not set
+# CONFIG_BLK_DEV_RAM is not set
+# CONFIG_BLK_DEV_RBD is not set
+# CONFIG_BLK_DEV_RSXX is not set
+# CONFIG_BLK_DEV_RZ1000 is not set
+# CONFIG_BLK_DEV_SC1200 is not set
+# CONFIG_BLK_DEV_SD is not set
+# CONFIG_BLK_DEV_SIIMAGE is not set
+# CONFIG_BLK_DEV_SIS5513 is not set
+# CONFIG_BLK_DEV_SKD is not set
+# CONFIG_BLK_DEV_SL82C105 is not set
+# CONFIG_BLK_DEV_SLC90E66 is not set
+# CONFIG_BLK_DEV_SR is not set
+# CONFIG_BLK_DEV_SVWKS is not set
+# CONFIG_BLK_DEV_SX8 is not set
+# CONFIG_BLK_DEV_TC86C001 is not set
+# CONFIG_BLK_DEV_THROTTLING is not set
+# CONFIG_BLK_DEV_TRIFLEX is not set
+# CONFIG_BLK_DEV_TRM290 is not set
+# CONFIG_BLK_DEV_UBLK is not set
+# CONFIG_BLK_DEV_UMC8672 is not set
+# CONFIG_BLK_DEV_UMEM is not set
+# CONFIG_BLK_DEV_VIA82CXXX is not set
+# CONFIG_BLK_DEV_ZONED is not set
+# CONFIG_BLK_INLINE_ENCRYPTION is not set
+# CONFIG_BLK_SED_OPAL is not set
+# CONFIG_BLK_WBT is not set
+CONFIG_BLOCK=y
+# CONFIG_BLOCK_LEGACY_AUTOLOAD is not set
+# CONFIG_BMA180 is not set
+# CONFIG_BMA220 is not set
+# CONFIG_BMA400 is not set
+# CONFIG_BMC150_ACCEL is not set
+# CONFIG_BMC150_MAGN is not set
+# CONFIG_BMC150_MAGN_I2C is not set
+# CONFIG_BMC150_MAGN_SPI is not set
+# CONFIG_BME680 is not set
+# CONFIG_BMG160 is not set
+# CONFIG_BMI088_ACCEL is not set
+# CONFIG_BMI160_I2C is not set
+# CONFIG_BMI160_SPI is not set
+# CONFIG_BMIPS_GENERIC is not set
+# CONFIG_BMP280 is not set
+# CONFIG_BNA is not set
+# CONFIG_BNX2 is not set
+# CONFIG_BNX2X is not set
+# CONFIG_BNX2X_SRIOV is not set
+# CONFIG_BNXT is not set
+# CONFIG_BONDING is not set
+# CONFIG_BOOKE_WDT is not set
+CONFIG_BOOKE_WDT_DEFAULT_TIMEOUT=3
+# CONFIG_BOOTPARAM_HARDLOCKUP_PANIC is not set
+# CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set
+# CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC is not set
+# CONFIG_BOOTTIME_TRACING is not set
+# CONFIG_BOOT_CONFIG is not set
+# CONFIG_BOOT_PRINTK_DELAY is not set
+CONFIG_BOOT_RAW=y
+# CONFIG_BOSCH_BNO055_I2C is not set
+# CONFIG_BOSCH_BNO055_SERIAL is not set
+# CONFIG_BOUNCE is not set
+CONFIG_BPF=y
+# CONFIG_BPFILTER is not set
+CONFIG_BPF_JIT=y
+# CONFIG_BPF_JIT_ALWAYS_ON is not set
+CONFIG_BPF_JIT_DEFAULT_ON=y
+# CONFIG_BPF_PRELOAD is not set
+# CONFIG_BPF_STREAM_PARSER is not set
+CONFIG_BPF_SYSCALL=y
+CONFIG_BPF_UNPRIV_DEFAULT_OFF=y
+# CONFIG_BPQETHER is not set
+CONFIG_BQL=y
+CONFIG_BRANCH_PROFILE_NONE=y
+# CONFIG_BRCMFMAC is not set
+# CONFIG_BRCMSMAC is not set
+# CONFIG_BRCMSTB_GISB_ARB is not set
+# CONFIG_BRCMSTB_L2_IRQ is not set
+CONFIG_BRIDGE=y
+# CONFIG_BRIDGE_CFM is not set
+# CONFIG_BRIDGE_EBT_802_3 is not set
+# CONFIG_BRIDGE_EBT_AMONG is not set
+# CONFIG_BRIDGE_EBT_ARP is not set
+# CONFIG_BRIDGE_EBT_ARPREPLY is not set
+# CONFIG_BRIDGE_EBT_BROUTE is not set
+# CONFIG_BRIDGE_EBT_DNAT is not set
+# CONFIG_BRIDGE_EBT_IP is not set
+# CONFIG_BRIDGE_EBT_IP6 is not set
+# CONFIG_BRIDGE_EBT_LIMIT is not set
+# CONFIG_BRIDGE_EBT_LOG is not set
+# CONFIG_BRIDGE_EBT_MARK is not set
+# CONFIG_BRIDGE_EBT_MARK_T is not set
+# CONFIG_BRIDGE_EBT_NFLOG is not set
+# CONFIG_BRIDGE_EBT_PKTTYPE is not set
+# CONFIG_BRIDGE_EBT_REDIRECT is not set
+# CONFIG_BRIDGE_EBT_SNAT is not set
+# CONFIG_BRIDGE_EBT_STP is not set
+# CONFIG_BRIDGE_EBT_T_FILTER is not set
+# CONFIG_BRIDGE_EBT_T_NAT is not set
+# CONFIG_BRIDGE_EBT_VLAN is not set
+CONFIG_BRIDGE_IGMP_SNOOPING=y
+# CONFIG_BRIDGE_MRP is not set
+# CONFIG_BRIDGE_NETFILTER is not set
+# CONFIG_BRIDGE_NF_EBTABLES is not set
+CONFIG_BRIDGE_VLAN_FILTERING=y
+# CONFIG_BROADCOM_PHY is not set
+CONFIG_BROKEN_ON_SMP=y
+# CONFIG_BSD_DISKLABEL is not set
+# CONFIG_BSD_PROCESS_ACCT is not set
+# CONFIG_BSD_PROCESS_ACCT_V3 is not set
+# CONFIG_BT is not set
+# CONFIG_BTRFS_ASSERT is not set
+# CONFIG_BTRFS_DEBUG is not set
+# CONFIG_BTRFS_FS is not set
+# CONFIG_BTRFS_FS_POSIX_ACL is not set
+# CONFIG_BTRFS_FS_REF_VERIFY is not set
+# CONFIG_BTRFS_FS_RUN_SANITY_TESTS is not set
+# CONFIG_BT_AOSPEXT is not set
+# CONFIG_BT_ATH3K is not set
+# CONFIG_BT_BNEP is not set
+CONFIG_BT_BNEP_MC_FILTER=y
+CONFIG_BT_BNEP_PROTO_FILTER=y
+# CONFIG_BT_BREDR is not set
+# CONFIG_BT_CMTP is not set
+# CONFIG_BT_FEATURE_DEBUG is not set
+# CONFIG_BT_HCIBCM203X is not set
+# CONFIG_BT_HCIBFUSB is not set
+# CONFIG_BT_HCIBLUECARD is not set
+# CONFIG_BT_HCIBPA10X is not set
+# CONFIG_BT_HCIBT3C is not set
+# CONFIG_BT_HCIBTSDIO is not set
+# CONFIG_BT_HCIBTUSB is not set
+# CONFIG_BT_HCIBTUSB_AUTOSUSPEND is not set
+# CONFIG_BT_HCIBTUSB_MTK is not set
+# CONFIG_BT_HCIBTUSB_RTL is not set
+# CONFIG_BT_HCIDTL1 is not set
+# CONFIG_BT_HCIUART is not set
+# CONFIG_BT_HCIUART_3WIRE is not set
+# CONFIG_BT_HCIUART_AG6XX is not set
+# CONFIG_BT_HCIUART_ATH3K is not set
+CONFIG_BT_HCIUART_BCSP=y
+CONFIG_BT_HCIUART_H4=y
+# CONFIG_BT_HCIUART_LL is not set
+# CONFIG_BT_HCIUART_MRVL is not set
+# CONFIG_BT_HCIUART_QCA is not set
+# CONFIG_BT_HCIUART_RTL is not set
+# CONFIG_BT_HCIVHCI is not set
+# CONFIG_BT_HIDP is not set
+# CONFIG_BT_HS is not set
+# CONFIG_BT_LE is not set
+# CONFIG_BT_LEDS is not set
+# CONFIG_BT_MRVL is not set
+# CONFIG_BT_MSFTEXT is not set
+# CONFIG_BT_MTKSDIO is not set
+# CONFIG_BT_MTKUART is not set
+# CONFIG_BT_RFCOMM is not set
+CONFIG_BT_RFCOMM_TTY=y
+# CONFIG_BT_SELFTEST is not set
+# CONFIG_BT_VIRTIO is not set
+CONFIG_BUG=y
+# CONFIG_BUG_ON_DATA_CORRUPTION is not set
+CONFIG_BUILDTIME_EXTABLE_SORT=y
+CONFIG_BUILDTIME_TABLE_SORT=y
+# CONFIG_BUILD_BIN2C is not set
+CONFIG_BUILD_SALT=""
+# CONFIG_C2PORT is not set
+CONFIG_CACHE_L2X0_PMU=y
+# CONFIG_CADENCE_WATCHDOG is not set
+# CONFIG_CAIF is not set
+# CONFIG_CAN is not set
+# CONFIG_CAN_BCM is not set
+# CONFIG_CAN_CAN327 is not set
+# CONFIG_CAN_CTUCANFD_PCI is not set
+# CONFIG_CAN_CTUCANFD_PLATFORM is not set
+# CONFIG_CAN_DEBUG_DEVICES is not set
+# CONFIG_CAN_DEV is not set
+# CONFIG_CAN_ESD_USB is not set
+# CONFIG_CAN_ETAS_ES58X is not set
+# CONFIG_CAN_GS_USB is not set
+# CONFIG_CAN_GW is not set
+# CONFIG_CAN_HI311X is not set
+# CONFIG_CAN_IFI_CANFD is not set
+# CONFIG_CAN_ISOTP is not set
+# CONFIG_CAN_J1939 is not set
+# CONFIG_CAN_KVASER_PCIEFD is not set
+# CONFIG_CAN_MCBA_USB is not set
+# CONFIG_CAN_MCP251XFD is not set
+# CONFIG_CAN_M_CAN is not set
+# CONFIG_CAN_NETLINK is not set
+# CONFIG_CAN_PEAK_PCIEFD is not set
+# CONFIG_CAN_RAW is not set
+# CONFIG_CAN_RCAR is not set
+# CONFIG_CAN_RCAR_CANFD is not set
+# CONFIG_CAN_SLCAN is not set
+# CONFIG_CAN_SUN4I is not set
+# CONFIG_CAN_UCAN is not set
+# CONFIG_CAN_VCAN is not set
+# CONFIG_CAN_VXCAN is not set
+# CONFIG_CAPI_AVM is not set
+# CONFIG_CAPI_EICON is not set
+# CONFIG_CAPI_TRACE is not set
+CONFIG_CARDBUS=y
+# CONFIG_CARDMAN_4000 is not set
+# CONFIG_CARDMAN_4040 is not set
+# CONFIG_CARL9170 is not set
+# CONFIG_CASSINI is not set
+# CONFIG_CAVIUM_CPT is not set
+# CONFIG_CAVIUM_ERRATUM_22375 is not set
+# CONFIG_CAVIUM_ERRATUM_23144 is not set
+# CONFIG_CAVIUM_ERRATUM_23154 is not set
+# CONFIG_CAVIUM_ERRATUM_27456 is not set
+# CONFIG_CAVIUM_ERRATUM_30115 is not set
+# CONFIG_CAVIUM_OCTEON_SOC is not set
+# CONFIG_CAVIUM_PTP is not set
+# CONFIG_CAVIUM_TX2_ERRATUM_219 is not set
+# CONFIG_CB710_CORE is not set
+# CONFIG_CC10001_ADC is not set
+# CONFIG_CCS811 is not set
+CONFIG_CC_CAN_LINK=y
+CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y
+# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
+# CONFIG_CDROM_PKTCDVD is not set
+# CONFIG_CEPH_FS is not set
+# CONFIG_CEPH_LIB is not set
+# CONFIG_CFG80211 is not set
+# CONFIG_CFG80211_CERTIFICATION_ONUS is not set
+CONFIG_CFG80211_HEADERS=y
+# CONFIG_CGROUPS is not set
+# CONFIG_CGROUP_FAVOR_DYNMODS is not set
+# CONFIG_CGROUP_MISC is not set
+# CONFIG_CHARGER_ADP5061 is not set
+# CONFIG_CHARGER_BD99954 is not set
+# CONFIG_CHARGER_BQ2415X is not set
+# CONFIG_CHARGER_BQ24190 is not set
+# CONFIG_CHARGER_BQ24257 is not set
+# CONFIG_CHARGER_BQ24735 is not set
+# CONFIG_CHARGER_BQ2515X is not set
+# CONFIG_CHARGER_BQ256XX is not set
+# CONFIG_CHARGER_BQ25890 is not set
+# CONFIG_CHARGER_BQ25980 is not set
+# CONFIG_CHARGER_DETECTOR_MAX14656 is not set
+# CONFIG_CHARGER_GPIO is not set
+# CONFIG_CHARGER_ISP1704 is not set
+# CONFIG_CHARGER_LP8727 is not set
+# CONFIG_CHARGER_LT3651 is not set
+# CONFIG_CHARGER_LTC3651 is not set
+# CONFIG_CHARGER_LTC4162L is not set
+# CONFIG_CHARGER_MANAGER is not set
+# CONFIG_CHARGER_MAX77976 is not set
+# CONFIG_CHARGER_MAX8903 is not set
+# CONFIG_CHARGER_QCOM_SMBB is not set
+# CONFIG_CHARGER_RT9455 is not set
+# CONFIG_CHARGER_SBS is not set
+# CONFIG_CHARGER_SMB347 is not set
+# CONFIG_CHARGER_TWL4030 is not set
+# CONFIG_CHARGER_UCS1002 is not set
+# CONFIG_CHASH_SELFTEST is not set
+# CONFIG_CHASH_STATS is not set
+# CONFIG_CHECKPOINT_RESTORE is not set
+# CONFIG_CHELSIO_T1 is not set
+# CONFIG_CHELSIO_T3 is not set
+# CONFIG_CHELSIO_T4 is not set
+# CONFIG_CHELSIO_T4VF is not set
+# CONFIG_CHROME_PLATFORMS is not set
+# CONFIG_CHR_DEV_OSST is not set
+# CONFIG_CHR_DEV_SCH is not set
+# CONFIG_CHR_DEV_SG is not set
+# CONFIG_CHR_DEV_ST is not set
+# CONFIG_CICADA_PHY is not set
+# CONFIG_CIFS is not set
+# CONFIG_CIFS_ACL is not set
+CONFIG_CIFS_ALLOW_INSECURE_LEGACY=y
+# CONFIG_CIFS_DEBUG is not set
+# CONFIG_CIFS_DEBUG2 is not set
+# CONFIG_CIFS_FSCACHE is not set
+# CONFIG_CIFS_NFSD_EXPORT is not set
+CONFIG_CIFS_POSIX=y
+# CONFIG_CIFS_SMB2 is not set
+# CONFIG_CIFS_STATS is not set
+# CONFIG_CIFS_STATS2 is not set
+# CONFIG_CIFS_SWN_UPCALL is not set
+# CONFIG_CIFS_WEAK_PW_HASH is not set
+CONFIG_CIFS_XATTR=y
+# CONFIG_CIO_DAC is not set
+# CONFIG_CLEANCACHE is not set
+# CONFIG_CLKSRC_PISTACHIO is not set
+# CONFIG_CLKSRC_VERSATILE is not set
+# CONFIG_CLK_GFM_LPASS_SM8250 is not set
+# CONFIG_CLK_HSDK is not set
+# CONFIG_CLK_ICST is not set
+# CONFIG_CLK_QORIQ is not set
+# CONFIG_CLK_SP810 is not set
+# CONFIG_CLOCK_THERMAL is not set
+CONFIG_CLS_U32_MARK=y
+# CONFIG_CLS_U32_PERF is not set
+# CONFIG_CM32181 is not set
+# CONFIG_CM3232 is not set
+# CONFIG_CM3323 is not set
+# CONFIG_CM3605 is not set
+# CONFIG_CM36651 is not set
+# CONFIG_CMA is not set
+CONFIG_CMDLINE=""
+# CONFIG_CMDLINE_BOOL is not set
+# CONFIG_CMDLINE_EXTEND is not set
+# CONFIG_CMDLINE_FORCE is not set
+# CONFIG_CMDLINE_FROM_BOOTLOADER is not set
+# CONFIG_CMDLINE_PARTITION is not set
+# CONFIG_CNIC is not set
+# CONFIG_CODA_FS is not set
+# CONFIG_CODE_PATCHING_SELFTEST is not set
+# CONFIG_COMEDI is not set
+# CONFIG_COMMON_CLK_AXI_CLKGEN is not set
+# CONFIG_COMMON_CLK_BOSTON is not set
+# CONFIG_COMMON_CLK_CDCE706 is not set
+# CONFIG_COMMON_CLK_CDCE925 is not set
+# CONFIG_COMMON_CLK_CS2000_CP is not set
+# CONFIG_COMMON_CLK_FIXED_MMIO is not set
+# CONFIG_COMMON_CLK_IPROC is not set
+# CONFIG_COMMON_CLK_MAX9485 is not set
+# CONFIG_COMMON_CLK_MT6765 is not set
+# CONFIG_COMMON_CLK_MT8167 is not set
+# CONFIG_COMMON_CLK_MT8167_AUDSYS is not set
+# CONFIG_COMMON_CLK_MT8167_IMGSYS is not set
+# CONFIG_COMMON_CLK_MT8167_MFGCFG is not set
+# CONFIG_COMMON_CLK_MT8167_MMSYS is not set
+# CONFIG_COMMON_CLK_MT8167_VDECSYS is not set
+# CONFIG_COMMON_CLK_MT8192 is not set
+# CONFIG_COMMON_CLK_NXP is not set
+# CONFIG_COMMON_CLK_PIC32 is not set
+# CONFIG_COMMON_CLK_PISTACHIO is not set
+# CONFIG_COMMON_CLK_PWM is not set
+# CONFIG_COMMON_CLK_PXA is not set
+# CONFIG_COMMON_CLK_QCOM is not set
+# CONFIG_COMMON_CLK_RS9_PCIE is not set
+# CONFIG_COMMON_CLK_SI514 is not set
+# CONFIG_COMMON_CLK_SI5341 is not set
+# CONFIG_COMMON_CLK_SI5351 is not set
+# CONFIG_COMMON_CLK_SI544 is not set
+# CONFIG_COMMON_CLK_SI570 is not set
+# CONFIG_COMMON_CLK_VC5 is not set
+# CONFIG_COMMON_CLK_VC7 is not set
+# CONFIG_COMMON_CLK_XGENE is not set
+# CONFIG_COMMON_CLK_XLNX_CLKWZRD is not set
+CONFIG_COMPACTION=y
+# CONFIG_COMPAL_LAPTOP is not set
+# CONFIG_COMPAT is not set
+# CONFIG_COMPAT_BRK is not set
+# CONFIG_COMPILE_TEST is not set
+# CONFIG_CONFIGFS_FS is not set
+# CONFIG_CONNECTOR is not set
+CONFIG_CONSOLE_LOGLEVEL_DEFAULT=7
+CONFIG_CONSOLE_LOGLEVEL_QUIET=4
+CONFIG_CONSTRUCTORS=y
+# CONFIG_CONTEXT_SWITCH_TRACER is not set
+# CONFIG_COPS is not set
+# CONFIG_CORDIC is not set
+# CONFIG_COREDUMP is not set
+# CONFIG_CORESIGHT is not set
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+# CONFIG_CORTINA_PHY is not set
+# CONFIG_COUNTER is not set
+# CONFIG_CPA_DEBUG is not set
+# CONFIG_CPU_BIG_ENDIAN is not set
+# CONFIG_CPU_BPREDICT_DISABLE is not set
+# CONFIG_CPU_DCACHE_DISABLE is not set
+# CONFIG_CPU_FREQ is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
+# CONFIG_CPU_FREQ_GOV_SCHEDUTIL is not set
+# CONFIG_CPU_FREQ_STAT_DETAILS is not set
+# CONFIG_CPU_FREQ_THERMAL is not set
+# CONFIG_CPU_HOTPLUG_STATE_CONTROL is not set
+# CONFIG_CPU_ICACHE_DISABLE is not set
+# CONFIG_CPU_ICACHE_MISMATCH_WORKAROUND is not set
+# CONFIG_CPU_IDLE is not set
+# CONFIG_CPU_IDLE_GOV_LADDER is not set
+# CONFIG_CPU_IDLE_GOV_MENU is not set
+# CONFIG_CPU_IDLE_GOV_TEO is not set
+# CONFIG_CPU_IDLE_MULTIPLE_DRIVERS is not set
+# CONFIG_CPU_ISOLATION is not set
+# CONFIG_CPU_LITTLE_ENDIAN is not set
+# CONFIG_CPU_NO_EFFICIENT_FFS is not set
+CONFIG_CPU_SW_DOMAIN_PAN=y
+# CONFIG_CPU_THERMAL is not set
+# CONFIG_CRAMFS is not set
+CONFIG_CRAMFS_BLOCKDEV=y
+# CONFIG_CRAMFS_MTD is not set
+# CONFIG_CRASH_DUMP is not set
+# CONFIG_CRC16 is not set
+CONFIG_CRC32=y
+# CONFIG_CRC32_BIT is not set
+CONFIG_CRC32_SARWATE=y
+# CONFIG_CRC32_SELFTEST is not set
+# CONFIG_CRC32_SLICEBY4 is not set
+# CONFIG_CRC32_SLICEBY8 is not set
+# CONFIG_CRC4 is not set
+# CONFIG_CRC64 is not set
+# CONFIG_CRC64_ROCKSOFT is not set
+# CONFIG_CRC7 is not set
+# CONFIG_CRC8 is not set
+# CONFIG_CRC_CCITT is not set
+# CONFIG_CRC_ITU_T is not set
+# CONFIG_CRC_T10DIF is not set
+CONFIG_CROSS_COMPILE=""
+# CONFIG_CROSS_MEMORY_ATTACH is not set
+CONFIG_CRYPTO=y
+# CONFIG_CRYPTO_842 is not set
+CONFIG_CRYPTO_ACOMP2=y
+# CONFIG_CRYPTO_ADIANTUM is not set
+CONFIG_CRYPTO_AEAD=y
+CONFIG_CRYPTO_AEAD2=y
+# CONFIG_CRYPTO_AEGIS128 is not set
+# CONFIG_CRYPTO_AEGIS128L is not set
+# CONFIG_CRYPTO_AEGIS128L_AESNI_SSE2 is not set
+# CONFIG_CRYPTO_AEGIS128_AESNI_SSE2 is not set
+# CONFIG_CRYPTO_AEGIS256 is not set
+# CONFIG_CRYPTO_AEGIS256_AESNI_SSE2 is not set
+CONFIG_CRYPTO_AES=y
+# CONFIG_CRYPTO_AES_586 is not set
+# CONFIG_CRYPTO_AES_ARM is not set
+# CONFIG_CRYPTO_AES_ARM64 is not set
+# CONFIG_CRYPTO_AES_ARM64_BS is not set
+# CONFIG_CRYPTO_AES_ARM64_CE is not set
+# CONFIG_CRYPTO_AES_ARM64_CE_BLK is not set
+# CONFIG_CRYPTO_AES_ARM64_CE_CCM is not set
+# CONFIG_CRYPTO_AES_ARM64_NEON_BLK is not set
+# CONFIG_CRYPTO_AES_ARM_BS is not set
+# CONFIG_CRYPTO_AES_ARM_CE is not set
+# CONFIG_CRYPTO_AES_NI_INTEL is not set
+# CONFIG_CRYPTO_AES_TI is not set
+CONFIG_CRYPTO_AKCIPHER=y
+CONFIG_CRYPTO_AKCIPHER2=y
+CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_ALGAPI2=y
+# CONFIG_CRYPTO_ANSI_CPRNG is not set
+# CONFIG_CRYPTO_ANUBIS is not set
+# CONFIG_CRYPTO_ARC4 is not set
+# CONFIG_CRYPTO_ARIA is not set
+# CONFIG_CRYPTO_AUTHENC is not set
+# CONFIG_CRYPTO_BLAKE2B is not set
+# CONFIG_CRYPTO_BLAKE2B_NEON is not set
+# CONFIG_CRYPTO_BLAKE2S is not set
+# CONFIG_CRYPTO_BLAKE2S_ARM is not set
+# CONFIG_CRYPTO_BLAKE2S_X86 is not set
+# CONFIG_CRYPTO_BLOWFISH is not set
+# CONFIG_CRYPTO_CAMELLIA is not set
+# CONFIG_CRYPTO_CAST5 is not set
+# CONFIG_CRYPTO_CAST6 is not set
+# CONFIG_CRYPTO_CBC is not set
+CONFIG_CRYPTO_CCM=y
+# CONFIG_CRYPTO_CFB is not set
+# CONFIG_CRYPTO_CHACHA20 is not set
+# CONFIG_CRYPTO_CHACHA20POLY1305 is not set
+# CONFIG_CRYPTO_CHACHA20_NEON is not set
+# CONFIG_CRYPTO_CHACHA20_X86_64 is not set
+# CONFIG_CRYPTO_CHACHA_MIPS is not set
+# CONFIG_CRYPTO_CMAC is not set
+# CONFIG_CRYPTO_CRC32 is not set
+# CONFIG_CRYPTO_CRC32C is not set
+# CONFIG_CRYPTO_CRC32C_INTEL is not set
+# CONFIG_CRYPTO_CRC32_ARM_CE is not set
+# CONFIG_CRYPTO_CRCT10DIF is not set
+# CONFIG_CRYPTO_CRCT10DIF_ARM64_CE is not set
+# CONFIG_CRYPTO_CRCT10DIF_ARM_CE is not set
+# CONFIG_CRYPTO_CRYPTD is not set
+CONFIG_CRYPTO_CTR=y
+# CONFIG_CRYPTO_CTS is not set
+# CONFIG_CRYPTO_CURVE25519 is not set
+# CONFIG_CRYPTO_CURVE25519_NEON is not set
+# CONFIG_CRYPTO_CURVE25519_X86 is not set
+# CONFIG_CRYPTO_DEFLATE is not set
+# CONFIG_CRYPTO_DES is not set
+# CONFIG_CRYPTO_DEV_AMLOGIC_GXL is not set
+# CONFIG_CRYPTO_DEV_ATMEL_AES is not set
+# CONFIG_CRYPTO_DEV_ATMEL_AUTHENC is not set
+# CONFIG_CRYPTO_DEV_ATMEL_ECC is not set
+# CONFIG_CRYPTO_DEV_ATMEL_SHA is not set
+# CONFIG_CRYPTO_DEV_ATMEL_SHA204A is not set
+# CONFIG_CRYPTO_DEV_ATMEL_TDES is not set
+# CONFIG_CRYPTO_DEV_CAVIUM_ZIP is not set
+# CONFIG_CRYPTO_DEV_CCP is not set
+# CONFIG_CRYPTO_DEV_CCP_DEBUGFS is not set
+# CONFIG_CRYPTO_DEV_CCREE is not set
+# CONFIG_CRYPTO_DEV_FSL_CAAM is not set
+# CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API_DESC is not set
+# CONFIG_CRYPTO_DEV_HIFN_795X is not set
+# CONFIG_CRYPTO_DEV_HISI_SEC is not set
+# CONFIG_CRYPTO_DEV_HISI_ZIP is not set
+# CONFIG_CRYPTO_DEV_IMGTEC_HASH is not set
+# CONFIG_CRYPTO_DEV_MARVELL_CESA is not set
+# CONFIG_CRYPTO_DEV_MEDIATEK is not set
+# CONFIG_CRYPTO_DEV_MV_CESA is not set
+# CONFIG_CRYPTO_DEV_MXC_SCC is not set
+# CONFIG_CRYPTO_DEV_MXS_DCP is not set
+# CONFIG_CRYPTO_DEV_NITROX_CNN55XX is not set
+# CONFIG_CRYPTO_DEV_OCTEONTX_CPT is not set
+# CONFIG_CRYPTO_DEV_QAT_4XXX is not set
+# CONFIG_CRYPTO_DEV_QAT_C3XXX is not set
+# CONFIG_CRYPTO_DEV_QAT_C3XXXVF is not set
+# CONFIG_CRYPTO_DEV_QAT_C62X is not set
+# CONFIG_CRYPTO_DEV_QAT_C62XVF is not set
+# CONFIG_CRYPTO_DEV_QAT_DH895xCC is not set
+# CONFIG_CRYPTO_DEV_QAT_DH895xCCVF is not set
+# CONFIG_CRYPTO_DEV_QCE is not set
+# CONFIG_CRYPTO_DEV_S5P is not set
+# CONFIG_CRYPTO_DEV_SAFEXCEL is not set
+# CONFIG_CRYPTO_DEV_SAHARA is not set
+# CONFIG_CRYPTO_DEV_SP_PSP is not set
+# CONFIG_CRYPTO_DEV_TALITOS is not set
+# CONFIG_CRYPTO_DEV_VIRTIO is not set
+# CONFIG_CRYPTO_DH is not set
+# CONFIG_CRYPTO_DRBG_CTR is not set
+# CONFIG_CRYPTO_DRBG_HASH is not set
+# CONFIG_CRYPTO_DRBG_MENU is not set
+# CONFIG_CRYPTO_ECB is not set
+# CONFIG_CRYPTO_ECDH is not set
+# CONFIG_CRYPTO_ECDSA is not set
+# CONFIG_CRYPTO_ECHAINIV is not set
+# CONFIG_CRYPTO_ECRDSA is not set
+# CONFIG_CRYPTO_ESSIV is not set
+# CONFIG_CRYPTO_FCRYPT is not set
+# CONFIG_CRYPTO_FIPS is not set
+CONFIG_CRYPTO_GCM=y
+CONFIG_CRYPTO_GF128MUL=y
+CONFIG_CRYPTO_GHASH=y
+# CONFIG_CRYPTO_GHASH_ARM64_CE is not set
+# CONFIG_CRYPTO_GHASH_ARM_CE is not set
+# CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL is not set
+CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_HASH2=y
+# CONFIG_CRYPTO_HCTR2 is not set
+# CONFIG_CRYPTO_HMAC is not set
+# CONFIG_CRYPTO_HW is not set
+# CONFIG_CRYPTO_JITTERENTROPY is not set
+# CONFIG_CRYPTO_KEYWRAP is not set
+# CONFIG_CRYPTO_KHAZAD is not set
+CONFIG_CRYPTO_KPP=y
+CONFIG_CRYPTO_KPP2=y
+CONFIG_CRYPTO_LIB_AES=y
+CONFIG_CRYPTO_LIB_ARC4=y
+# CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC is not set
+# CONFIG_CRYPTO_LIB_CHACHA is not set
+# CONFIG_CRYPTO_LIB_CHACHA20POLY1305 is not set
+# CONFIG_CRYPTO_LIB_CURVE25519 is not set
+# CONFIG_CRYPTO_LIB_POLY1305 is not set
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=9
+# CONFIG_CRYPTO_LRW is not set
+# CONFIG_CRYPTO_LZ4 is not set
+# CONFIG_CRYPTO_LZ4HC is not set
+# CONFIG_CRYPTO_LZO is not set
+CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
+CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y
+# CONFIG_CRYPTO_MCRYPTD is not set
+# CONFIG_CRYPTO_MD4 is not set
+# CONFIG_CRYPTO_MD5 is not set
+# CONFIG_CRYPTO_MICHAEL_MIC is not set
+# CONFIG_CRYPTO_MORUS1280 is not set
+# CONFIG_CRYPTO_MORUS1280_AVX2 is not set
+# CONFIG_CRYPTO_MORUS1280_SSE2 is not set
+# CONFIG_CRYPTO_MORUS640 is not set
+# CONFIG_CRYPTO_MORUS640_SSE2 is not set
+# CONFIG_CRYPTO_NHPOLY1305_NEON is not set
+CONFIG_CRYPTO_NULL=y
+CONFIG_CRYPTO_NULL2=y
+# CONFIG_CRYPTO_OFB is not set
+# CONFIG_CRYPTO_PCBC is not set
+# CONFIG_CRYPTO_PCOMP is not set
+# CONFIG_CRYPTO_PCOMP2 is not set
+CONFIG_CRYPTO_PCRYPT=y
+# CONFIG_CRYPTO_POLY1305 is not set
+# CONFIG_CRYPTO_POLY1305_ARM is not set
+# CONFIG_CRYPTO_POLY1305_MIPS is not set
+# CONFIG_CRYPTO_POLY1305_NEON is not set
+# CONFIG_CRYPTO_POLY1305_X86_64 is not set
+# CONFIG_CRYPTO_POLYVAL_ARM64_CE is not set
+# CONFIG_CRYPTO_RMD160 is not set
+# CONFIG_CRYPTO_RNG is not set
+# CONFIG_CRYPTO_RSA is not set
+# CONFIG_CRYPTO_SEED is not set
+# CONFIG_CRYPTO_SEQIV is not set
+# CONFIG_CRYPTO_SERPENT is not set
+# CONFIG_CRYPTO_SHA1 is not set
+# CONFIG_CRYPTO_SHA1_ARM is not set
+# CONFIG_CRYPTO_SHA1_ARM64_CE is not set
+# CONFIG_CRYPTO_SHA1_ARM_CE is not set
+# CONFIG_CRYPTO_SHA1_ARM_NEON is not set
+# CONFIG_CRYPTO_SHA256 is not set
+# CONFIG_CRYPTO_SHA256_ARM is not set
+# CONFIG_CRYPTO_SHA256_ARM64 is not set
+# CONFIG_CRYPTO_SHA2_ARM64_CE is not set
+# CONFIG_CRYPTO_SHA2_ARM_CE is not set
+# CONFIG_CRYPTO_SHA3 is not set
+# CONFIG_CRYPTO_SHA3_ARM64 is not set
+# CONFIG_CRYPTO_SHA512 is not set
+# CONFIG_CRYPTO_SHA512_ARM is not set
+# CONFIG_CRYPTO_SHA512_ARM64 is not set
+# CONFIG_CRYPTO_SHA512_ARM64_CE is not set
+# CONFIG_CRYPTO_SIMD is not set
+CONFIG_CRYPTO_SKCIPHER=y
+CONFIG_CRYPTO_SKCIPHER2=y
+# CONFIG_CRYPTO_SM2 is not set
+# CONFIG_CRYPTO_SM3 is not set
+# CONFIG_CRYPTO_SM3_ARM64_CE is not set
+# CONFIG_CRYPTO_SM3_GENERIC is not set
+# CONFIG_CRYPTO_SM3_NEON is not set
+# CONFIG_CRYPTO_SM4 is not set
+# CONFIG_CRYPTO_SM4_ARM64_CE is not set
+# CONFIG_CRYPTO_SM4_ARM64_CE_BLK is not set
+# CONFIG_CRYPTO_SM4_ARM64_NEON_BLK is not set
+# CONFIG_CRYPTO_SM4_GENERIC is not set
+# CONFIG_CRYPTO_SPECK is not set
+# CONFIG_CRYPTO_STATS is not set
+# CONFIG_CRYPTO_STREEBOG is not set
+# CONFIG_CRYPTO_TEA is not set
+# CONFIG_CRYPTO_TEST is not set
+# CONFIG_CRYPTO_TWOFISH is not set
+# CONFIG_CRYPTO_TWOFISH_586 is not set
+# CONFIG_CRYPTO_TWOFISH_COMMON is not set
+# CONFIG_CRYPTO_USER is not set
+# CONFIG_CRYPTO_USER_API_AEAD is not set
+# CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE is not set
+# CONFIG_CRYPTO_USER_API_HASH is not set
+# CONFIG_CRYPTO_USER_API_RNG is not set
+# CONFIG_CRYPTO_USER_API_RNG_CAVP is not set
+# CONFIG_CRYPTO_USER_API_SKCIPHER is not set
+# CONFIG_CRYPTO_VMAC is not set
+# CONFIG_CRYPTO_WP512 is not set
+# CONFIG_CRYPTO_XCBC is not set
+# CONFIG_CRYPTO_XTS is not set
+# CONFIG_CRYPTO_XXHASH is not set
+# CONFIG_CRYPTO_ZLIB is not set
+# CONFIG_CRYPTO_ZSTD is not set
+# CONFIG_CS5535_MFGPT is not set
+# CONFIG_CS89x0 is not set
+# CONFIG_CS89x0_PLATFORM is not set
+# CONFIG_CSD_LOCK_WAIT_DEBUG is not set
+# CONFIG_CUSE is not set
+# CONFIG_CW1200 is not set
+# CONFIG_CXD2880_SPI_DRV is not set
+# CONFIG_CXL_AFU_DRIVER_OPS is not set
+# CONFIG_CXL_BASE is not set
+# CONFIG_CXL_BUS is not set
+# CONFIG_CXL_EEH is not set
+# CONFIG_CXL_KERNEL_API is not set
+# CONFIG_CXL_LIB is not set
+# CONFIG_CYPRESS_FIRMWARE is not set
+# CONFIG_DA280 is not set
+# CONFIG_DA311 is not set
+# CONFIG_DAMON is not set
+# CONFIG_DAVICOM_PHY is not set
+# CONFIG_DAX is not set
+# CONFIG_DCB is not set
+# CONFIG_DDR is not set
+# CONFIG_DEBUG_ALIGN_RODATA is not set
+# CONFIG_DEBUG_ATOMIC_SLEEP is not set
+# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
+# CONFIG_DEBUG_BUGVERBOSE is not set
+# CONFIG_DEBUG_CREDENTIALS is not set
+# CONFIG_DEBUG_DEVRES is not set
+# CONFIG_DEBUG_DRIVER is not set
+# CONFIG_DEBUG_EFI is not set
+# CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_32B is not set
+# CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B is not set
+# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
+CONFIG_DEBUG_FS=y
+CONFIG_DEBUG_FS_ALLOW_ALL=y
+# CONFIG_DEBUG_FS_ALLOW_NONE is not set
+# CONFIG_DEBUG_FS_DISALLOW_MOUNT is not set
+# CONFIG_DEBUG_GPIO is not set
+# CONFIG_DEBUG_HIGHMEM is not set
+# CONFIG_DEBUG_ICEDCC is not set
+# CONFIG_DEBUG_INFO is not set
+# CONFIG_DEBUG_INFO_BTF is not set
+# CONFIG_DEBUG_INFO_COMPRESSED is not set
+# CONFIG_DEBUG_INFO_DWARF4 is not set
+# CONFIG_DEBUG_INFO_DWARF5 is not set
+CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
+# CONFIG_DEBUG_INFO_NONE is not set
+# CONFIG_DEBUG_INFO_REDUCED is not set
+# CONFIG_DEBUG_INFO_SPLIT is not set
+# CONFIG_DEBUG_IRQFLAGS is not set
+CONFIG_DEBUG_KERNEL=y
+# CONFIG_DEBUG_KMAP_LOCAL is not set
+# CONFIG_DEBUG_KMEMLEAK is not set
+# CONFIG_DEBUG_KOBJECT is not set
+# CONFIG_DEBUG_KOBJECT_RELEASE is not set
+# CONFIG_DEBUG_LIST is not set
+# CONFIG_DEBUG_LL is not set
+# CONFIG_DEBUG_LL_UART_8250 is not set
+# CONFIG_DEBUG_LL_UART_PL01X is not set
+# CONFIG_DEBUG_LOCKDEP is not set
+# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
+# CONFIG_DEBUG_LOCK_ALLOC is not set
+# CONFIG_DEBUG_MAPLE_TREE is not set
+# CONFIG_DEBUG_MEMORY_INIT is not set
+# CONFIG_DEBUG_MISC is not set
+# CONFIG_DEBUG_MUTEXES is not set
+# CONFIG_DEBUG_NET is not set
+# CONFIG_DEBUG_NOTIFIERS is not set
+# CONFIG_DEBUG_NX_TEST is not set
+# CONFIG_DEBUG_OBJECTS is not set
+# CONFIG_DEBUG_PAGEALLOC is not set
+# CONFIG_DEBUG_PAGE_REF is not set
+# CONFIG_DEBUG_PERF_USE_VMALLOC is not set
+# CONFIG_DEBUG_PER_CPU_MAPS is not set
+# CONFIG_DEBUG_PINCTRL is not set
+# CONFIG_DEBUG_PI_LIST is not set
+# CONFIG_DEBUG_PLIST is not set
+# CONFIG_DEBUG_PREEMPT is not set
+# CONFIG_DEBUG_RODATA_TEST is not set
+# CONFIG_DEBUG_RSEQ is not set
+# CONFIG_DEBUG_RT_MUTEXES is not set
+# CONFIG_DEBUG_RWSEMS is not set
+# CONFIG_DEBUG_SECTION_MISMATCH is not set
+# CONFIG_DEBUG_SEMIHOSTING is not set
+# CONFIG_DEBUG_SG is not set
+# CONFIG_DEBUG_SHIRQ is not set
+# CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_SPINLOCK is not set
+# CONFIG_DEBUG_STACKOVERFLOW is not set
+# CONFIG_DEBUG_STACK_USAGE is not set
+# CONFIG_DEBUG_STRICT_USER_COPY_CHECKS is not set
+# CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set
+# CONFIG_DEBUG_TIMEKEEPING is not set
+# CONFIG_DEBUG_UART_8250_PALMCHIP is not set
+# CONFIG_DEBUG_UART_8250_WORD is not set
+# CONFIG_DEBUG_UART_BCM63XX is not set
+# CONFIG_DEBUG_UART_FLOW_CONTROL is not set
+# CONFIG_DEBUG_USER is not set
+# CONFIG_DEBUG_VIRTUAL is not set
+# CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_VM_PGFLAGS is not set
+# CONFIG_DEBUG_VM_PGTABLE is not set
+# CONFIG_DEBUG_VM_RB is not set
+# CONFIG_DEBUG_VM_VMACACHE is not set
+# CONFIG_DEBUG_WQ_FORCE_RR_CPU is not set
+# CONFIG_DEBUG_WW_MUTEX_SLOWPATH is not set
+# CONFIG_DEBUG_WX is not set
+# CONFIG_DEBUG_ZBOOT is not set
+# CONFIG_DECNET is not set
+# CONFIG_DEFAULT_CODEL is not set
+CONFIG_DEFAULT_CUBIC=y
+CONFIG_DEFAULT_DEADLINE=y
+# CONFIG_DEFAULT_FQ is not set
+CONFIG_DEFAULT_FQ_CODEL=y
+# CONFIG_DEFAULT_FQ_PIE is not set
+CONFIG_DEFAULT_HOSTNAME="(none)"
+CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120
+CONFIG_DEFAULT_INIT=""
+CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
+CONFIG_DEFAULT_NET_SCH="fq_codel"
+# CONFIG_DEFAULT_NOOP is not set
+# CONFIG_DEFAULT_PFIFO_FAST is not set
+# CONFIG_DEFAULT_RENO is not set
+CONFIG_DEFAULT_SECURITY=""
+CONFIG_DEFAULT_SECURITY_DAC=y
+# CONFIG_DEFAULT_SECURITY_SELINUX is not set
+# CONFIG_DEFAULT_SFQ is not set
+CONFIG_DEFAULT_TCP_CONG="cubic"
+CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+# CONFIG_DEFERRED_STRUCT_PAGE_INIT is not set
+# CONFIG_DELL_LAPTOP is not set
+# CONFIG_DELL_RBTN is not set
+# CONFIG_DELL_SMBIOS is not set
+# CONFIG_DELL_SMO8800 is not set
+# CONFIG_DEPRECATED_PARAM_STRUCT is not set
+# CONFIG_DETECT_HUNG_TASK is not set
+# CONFIG_DEVKMEM is not set
+# CONFIG_DEVMEM is not set
+CONFIG_DEVPORT=y
+# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
+# CONFIG_DEVTMPFS is not set
+# CONFIG_DEVTMPFS_MOUNT is not set
+# CONFIG_DEV_DAX is not set
+# CONFIG_DGAP is not set
+# CONFIG_DGNC is not set
+# CONFIG_DHT11 is not set
+# CONFIG_DISCONTIGMEM_MANUAL is not set
+# CONFIG_DISPLAY_CONNECTOR_ANALOG_TV is not set
+# CONFIG_DISPLAY_CONNECTOR_DVI is not set
+# CONFIG_DISPLAY_CONNECTOR_HDMI is not set
+# CONFIG_DISPLAY_ENCODER_TFP410 is not set
+# CONFIG_DISPLAY_ENCODER_TPD12S015 is not set
+# CONFIG_DISPLAY_PANEL_DPI is not set
+# CONFIG_DISPLAY_PANEL_LGPHILIPS_LB035Q02 is not set
+# CONFIG_DISPLAY_PANEL_TPO_TD028TTEC1 is not set
+# CONFIG_DISPLAY_PANEL_TPO_TD043MTEA1 is not set
+# CONFIG_DL2K is not set
+# CONFIG_DLHL60D is not set
+# CONFIG_DLM is not set
+# CONFIG_DM9000 is not set
+# CONFIG_DM9051 is not set
+# CONFIG_DMABUF_DEBUG is not set
+# CONFIG_DMABUF_HEAPS is not set
+# CONFIG_DMABUF_MOVE_NOTIFY is not set
+# CONFIG_DMABUF_SELFTESTS is not set
+# CONFIG_DMABUF_SYSFS_STATS is not set
+# CONFIG_DMADEVICES is not set
+# CONFIG_DMADEVICES_DEBUG is not set
+# CONFIG_DMARD06 is not set
+# CONFIG_DMARD09 is not set
+# CONFIG_DMARD10 is not set
+# CONFIG_DMASCC is not set
+# CONFIG_DMATEST is not set
+# CONFIG_DMA_API_DEBUG is not set
+CONFIG_DMA_COHERENT_POOL=y
+CONFIG_DMA_DECLARE_COHERENT=y
+# CONFIG_DMA_ENGINE is not set
+# CONFIG_DMA_FENCE_TRACE is not set
+# CONFIG_DMA_JZ4780 is not set
+# CONFIG_DMA_MAP_BENCHMARK is not set
+CONFIG_DMA_NONCOHERENT_MMAP=y
+# CONFIG_DMA_NOOP_OPS is not set
+# CONFIG_DMA_PERNUMA_CMA is not set
+# CONFIG_DMA_RESTRICTED_POOL is not set
+# CONFIG_DMA_SHARED_BUFFER is not set
+# CONFIG_DMA_VIRT_OPS is not set
+# CONFIG_DM_CACHE is not set
+# CONFIG_DM_CLONE is not set
+# CONFIG_DM_DEBUG is not set
+# CONFIG_DM_DELAY is not set
+# CONFIG_DM_DUST is not set
+# CONFIG_DM_EBS is not set
+# CONFIG_DM_ERA is not set
+# CONFIG_DM_FLAKEY is not set
+# CONFIG_DM_INTEGRITY is not set
+# CONFIG_DM_LOG_USERSPACE is not set
+# CONFIG_DM_LOG_WRITES is not set
+# CONFIG_DM_MQ_DEFAULT is not set
+# CONFIG_DM_MULTIPATH is not set
+# CONFIG_DM_RAID is not set
+# CONFIG_DM_SWITCH is not set
+# CONFIG_DM_THIN_PROVISIONING is not set
+# CONFIG_DM_UEVENT is not set
+# CONFIG_DM_UNSTRIPED is not set
+# CONFIG_DM_VERITY is not set
+# CONFIG_DM_WRITECACHE is not set
+# CONFIG_DM_ZERO is not set
+# CONFIG_DNET is not set
+# CONFIG_DNOTIFY is not set
+# CONFIG_DNS_RESOLVER is not set
+CONFIG_DOUBLEFAULT=y
+# CONFIG_DP83640_PHY is not set
+# CONFIG_DP83822_PHY is not set
+# CONFIG_DP83848_PHY is not set
+# CONFIG_DP83867_PHY is not set
+# CONFIG_DP83869_PHY is not set
+# CONFIG_DP83TC811_PHY is not set
+# CONFIG_DP83TD510_PHY is not set
+# CONFIG_DPOT_DAC is not set
+# CONFIG_DPS310 is not set
+CONFIG_DQL=y
+# CONFIG_DRAGONRISE_FF is not set
+# CONFIG_DRM is not set
+# CONFIG_DRM_AMDGPU is not set
+# CONFIG_DRM_AMDGPU_CIK is not set
+# CONFIG_DRM_AMDGPU_GART_DEBUGFS is not set
+# CONFIG_DRM_AMDGPU_SI is not set
+# CONFIG_DRM_AMDGPU_USERPTR is not set
+# CONFIG_DRM_AMD_ACP is not set
+# CONFIG_DRM_AMD_DC_DCN2_0 is not set
+# CONFIG_DRM_AMD_DC_DCN3_0 is not set
+# CONFIG_DRM_AMD_DC_HDCP is not set
+# CONFIG_DRM_AMD_DC_SI is not set
+# CONFIG_DRM_AMD_SECURE_DISPLAY is not set
+# CONFIG_DRM_ANALOGIX_ANX6345 is not set
+# CONFIG_DRM_ANALOGIX_ANX7625 is not set
+# CONFIG_DRM_ANALOGIX_ANX78XX is not set
+# CONFIG_DRM_ARCPGU is not set
+# CONFIG_DRM_ARMADA is not set
+# CONFIG_DRM_AST is not set
+# CONFIG_DRM_ATMEL_HLCDC is not set
+# CONFIG_DRM_BOCHS is not set
+# CONFIG_DRM_CDNS_DSI is not set
+# CONFIG_DRM_CDNS_MHDP8546 is not set
+# CONFIG_DRM_CHIPONE_ICN6211 is not set
+# CONFIG_DRM_CHRONTEL_CH7033 is not set
+# CONFIG_DRM_CIRRUS_QEMU is not set
+# CONFIG_DRM_DEBUG_DP_MST_TOPOLOGY_REFS is not set
+# CONFIG_DRM_DEBUG_MM is not set
+# CONFIG_DRM_DEBUG_MODESET_LOCK is not set
+# CONFIG_DRM_DEBUG_SELFTEST is not set
+# CONFIG_DRM_DISPLAY_CONNECTOR is not set
+# CONFIG_DRM_DP_AUX_CHARDEV is not set
+# CONFIG_DRM_DP_CEC is not set
+# CONFIG_DRM_DUMB_VGA_DAC is not set
+# CONFIG_DRM_DW_HDMI_CEC is not set
+# CONFIG_DRM_ETNAVIV is not set
+# CONFIG_DRM_EXYNOS is not set
+# CONFIG_DRM_FBDEV_EMULATION is not set
+# CONFIG_DRM_FBDEV_LEAK_PHYS_SMEM is not set
+# CONFIG_DRM_FSL_DCU is not set
+# CONFIG_DRM_GM12U320 is not set
+# CONFIG_DRM_GMA500 is not set
+# CONFIG_DRM_GUD is not set
+# CONFIG_DRM_HDLCD is not set
+# CONFIG_DRM_HISI_HIBMC is not set
+# CONFIG_DRM_HISI_KIRIN is not set
+# CONFIG_DRM_I2C_ADV7511 is not set
+# CONFIG_DRM_I2C_CH7006 is not set
+# CONFIG_DRM_I2C_NXP_TDA9950 is not set
+# CONFIG_DRM_I2C_NXP_TDA998X is not set
+# CONFIG_DRM_I2C_SIL164 is not set
+# CONFIG_DRM_I915 is not set
+# CONFIG_DRM_IMX_LCDIF is not set
+# CONFIG_DRM_ITE_IT6505 is not set
+# CONFIG_DRM_ITE_IT66121 is not set
+# CONFIG_DRM_KOMEDA is not set
+# CONFIG_DRM_LEGACY is not set
+# CONFIG_DRM_LIB_RANDOM is not set
+# CONFIG_DRM_LIMA is not set
+# CONFIG_DRM_LOAD_EDID_FIRMWARE is not set
+# CONFIG_DRM_LOGICVC is not set
+# CONFIG_DRM_LONTIUM_LT8912B is not set
+# CONFIG_DRM_LONTIUM_LT9211 is not set
+# CONFIG_DRM_LONTIUM_LT9611 is not set
+# CONFIG_DRM_LONTIUM_LT9611UXC is not set
+# CONFIG_DRM_LVDS_CODEC is not set
+# CONFIG_DRM_LVDS_ENCODER is not set
+# CONFIG_DRM_MALI_DISPLAY is not set
+# CONFIG_DRM_MCDE is not set
+# CONFIG_DRM_MEGACHIPS_STDPXXXX_GE_B850V3_FW is not set
+# CONFIG_DRM_MGAG200 is not set
+# CONFIG_DRM_MXSFB is not set
+# CONFIG_DRM_NOUVEAU is not set
+# CONFIG_DRM_NWL_MIPI_DSI is not set
+# CONFIG_DRM_NXP_PTN3460 is not set
+# CONFIG_DRM_OMAP is not set
+# CONFIG_DRM_PANEL_ABT_Y030XX067A is not set
+# CONFIG_DRM_PANEL_ARM_VERSATILE is not set
+# CONFIG_DRM_PANEL_ASUS_Z00T_TM5P5_NT35596 is not set
+# CONFIG_DRM_PANEL_BOE_BF060Y8M_AJ0 is not set
+# CONFIG_DRM_PANEL_BOE_HIMAX8279D is not set
+# CONFIG_DRM_PANEL_BOE_TV101WUM_NL6 is not set
+# CONFIG_DRM_PANEL_DSI_CM is not set
+# CONFIG_DRM_PANEL_EBBG_FT8719 is not set
+# CONFIG_DRM_PANEL_EDP is not set
+# CONFIG_DRM_PANEL_ELIDA_KD35T133 is not set
+# CONFIG_DRM_PANEL_FEIXIN_K101_IM2BA02 is not set
+# CONFIG_DRM_PANEL_FEIYANG_FY07024DI26A30D is not set
+# CONFIG_DRM_PANEL_ILITEK_IL9322 is not set
+# CONFIG_DRM_PANEL_ILITEK_ILI9341 is not set
+# CONFIG_DRM_PANEL_ILITEK_ILI9806E is not set
+# CONFIG_DRM_PANEL_ILITEK_ILI9881C is not set
+# CONFIG_DRM_PANEL_INNOLUX_EJ030NA is not set
+# CONFIG_DRM_PANEL_INNOLUX_P079ZCA is not set
+# CONFIG_DRM_PANEL_JDI_LT070ME05000 is not set
+# CONFIG_DRM_PANEL_JDI_R63452 is not set
+# CONFIG_DRM_PANEL_KHADAS_TS050 is not set
+# CONFIG_DRM_PANEL_KINGDISPLAY_KD097D04 is not set
+# CONFIG_DRM_PANEL_LEADTEK_LTK050H3146W is not set
+# CONFIG_DRM_PANEL_LEADTEK_LTK500HD1829 is not set
+# CONFIG_DRM_PANEL_LG_LB035Q02 is not set
+# CONFIG_DRM_PANEL_LG_LG4573 is not set
+# CONFIG_DRM_PANEL_LVDS is not set
+# CONFIG_DRM_PANEL_MANTIX_MLAF057WE51 is not set
+# CONFIG_DRM_PANEL_MIPI_DBI is not set
+# CONFIG_DRM_PANEL_NEC_NL8048HL11 is not set
+# CONFIG_DRM_PANEL_NEWVISION_NV3052C is not set
+# CONFIG_DRM_PANEL_NOVATEK_NT35510 is not set
+# CONFIG_DRM_PANEL_NOVATEK_NT35560 is not set
+# CONFIG_DRM_PANEL_NOVATEK_NT35950 is not set
+# CONFIG_DRM_PANEL_NOVATEK_NT36672A is not set
+# CONFIG_DRM_PANEL_NOVATEK_NT39016 is not set
+# CONFIG_DRM_PANEL_OLIMEX_LCD_OLINUXINO is not set
+# CONFIG_DRM_PANEL_ORISETECH_OTM8009A is not set
+# CONFIG_DRM_PANEL_OSD_OSD101T2587_53TS is not set
+# CONFIG_DRM_PANEL_PANASONIC_VVX10F034N00 is not set
+# CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN is not set
+# CONFIG_DRM_PANEL_RAYDIUM_RM67191 is not set
+# CONFIG_DRM_PANEL_RAYDIUM_RM68200 is not set
+# CONFIG_DRM_PANEL_ROCKTECH_JH057N00900 is not set
+# CONFIG_DRM_PANEL_RONBO_RB070D30 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_ATNA33XC20 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_DB7430 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_LD9040 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_S6D16D0 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_S6D27A1 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_S6E3HA2 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_S6E63J0X03 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_S6E63M0 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_S6E88A0_AMS452EF01 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_S6E8AA0 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_SOFEF00 is not set
+# CONFIG_DRM_PANEL_SEIKO_43WVF1G is not set
+# CONFIG_DRM_PANEL_SHARP_LQ101R1SX01 is not set
+# CONFIG_DRM_PANEL_SHARP_LS037V7DW01 is not set
+# CONFIG_DRM_PANEL_SHARP_LS043T1LE01 is not set
+# CONFIG_DRM_PANEL_SHARP_LS060T1SX01 is not set
+# CONFIG_DRM_PANEL_SIMPLE is not set
+# CONFIG_DRM_PANEL_SITRONIX_ST7701 is not set
+# CONFIG_DRM_PANEL_SITRONIX_ST7703 is not set
+# CONFIG_DRM_PANEL_SITRONIX_ST7789V is not set
+# CONFIG_DRM_PANEL_SONY_ACX424AKP is not set
+# CONFIG_DRM_PANEL_SONY_ACX565AKM is not set
+# CONFIG_DRM_PANEL_SONY_TULIP_TRULY_NT35521 is not set
+# CONFIG_DRM_PANEL_TDO_TL070WSH30 is not set
+# CONFIG_DRM_PANEL_TPO_TD028TTEC1 is not set
+# CONFIG_DRM_PANEL_TPO_TD043MTEA1 is not set
+# CONFIG_DRM_PANEL_TPO_TPG110 is not set
+# CONFIG_DRM_PANEL_TPO_Y17P is not set
+# CONFIG_DRM_PANEL_TRULY_NT35597_WQXGA is not set
+# CONFIG_DRM_PANEL_VISIONOX_RM69299 is not set
+# CONFIG_DRM_PANEL_WAVESHARE_TOUCHSCREEN is not set
+# CONFIG_DRM_PANEL_WIDECHIPS_WS2401 is not set
+# CONFIG_DRM_PANEL_XINPENG_XPP055C272 is not set
+# CONFIG_DRM_PANFROST is not set
+# CONFIG_DRM_PARADE_PS8622 is not set
+# CONFIG_DRM_PARADE_PS8640 is not set
+# CONFIG_DRM_PL111 is not set
+# CONFIG_DRM_QXL is not set
+# CONFIG_DRM_RADEON is not set
+# CONFIG_DRM_RADEON_USERPTR is not set
+# CONFIG_DRM_RCAR_DW_HDMI is not set
+# CONFIG_DRM_RCAR_LVDS is not set
+# CONFIG_DRM_RCAR_USE_LVDS is not set
+# CONFIG_DRM_RCAR_USE_MIPI_DSI is not set
+# CONFIG_DRM_ROCKCHIP is not set
+# CONFIG_DRM_SII902X is not set
+# CONFIG_DRM_SII9234 is not set
+# CONFIG_DRM_SIL_SII8620 is not set
+# CONFIG_DRM_SIMPLEDRM is not set
+# CONFIG_DRM_SIMPLE_BRIDGE is not set
+# CONFIG_DRM_SSD130X is not set
+# CONFIG_DRM_STI is not set
+# CONFIG_DRM_STM is not set
+# CONFIG_DRM_SUN4I is not set
+# CONFIG_DRM_THINE_THC63LVD1024 is not set
+# CONFIG_DRM_TIDSS is not set
+# CONFIG_DRM_TILCDC is not set
+# CONFIG_DRM_TINYDRM is not set
+# CONFIG_DRM_TI_DLPC3433 is not set
+# CONFIG_DRM_TI_SN65DSI83 is not set
+# CONFIG_DRM_TI_SN65DSI86 is not set
+# CONFIG_DRM_TI_TFP410 is not set
+# CONFIG_DRM_TI_TPD12S015 is not set
+# CONFIG_DRM_TOSHIBA_TC358762 is not set
+# CONFIG_DRM_TOSHIBA_TC358764 is not set
+# CONFIG_DRM_TOSHIBA_TC358767 is not set
+# CONFIG_DRM_TOSHIBA_TC358768 is not set
+# CONFIG_DRM_TOSHIBA_TC358775 is not set
+# CONFIG_DRM_TVE200 is not set
+# CONFIG_DRM_UDL is not set
+# CONFIG_DRM_VBOXVIDEO is not set
+# CONFIG_DRM_VC4_HDMI_CEC is not set
+# CONFIG_DRM_VGEM is not set
+# CONFIG_DRM_VIRTIO_GPU is not set
+# CONFIG_DRM_VKMS is not set
+# CONFIG_DRM_VMWGFX is not set
+# CONFIG_DRM_XEN is not set
+# CONFIG_DRM_XEN_FRONTEND is not set
+# CONFIG_DS1682 is not set
+# CONFIG_DS1803 is not set
+# CONFIG_DS4424 is not set
+# CONFIG_DST_CACHE is not set
+# CONFIG_DTLK is not set
+# CONFIG_DUMMY is not set
+CONFIG_DUMMY_CONSOLE_COLUMNS=80
+CONFIG_DUMMY_CONSOLE_ROWS=25
+# CONFIG_DUMMY_IRQ is not set
+# CONFIG_DVB_A8293 is not set
+# CONFIG_DVB_AF9013 is not set
+# CONFIG_DVB_AF9033 is not set
+# CONFIG_DVB_AS102 is not set
+# CONFIG_DVB_ASCOT2E is not set
+# CONFIG_DVB_ATBM8830 is not set
+# CONFIG_DVB_AU8522_DTV is not set
+# CONFIG_DVB_AU8522_V4L is not set
+# CONFIG_DVB_B2C2_FLEXCOP_USB is not set
+# CONFIG_DVB_BCM3510 is not set
+# CONFIG_DVB_CORE is not set
+# CONFIG_DVB_CX22700 is not set
+# CONFIG_DVB_CX22702 is not set
+# CONFIG_DVB_CX24110 is not set
+# CONFIG_DVB_CX24116 is not set
+# CONFIG_DVB_CX24117 is not set
+# CONFIG_DVB_CX24120 is not set
+# CONFIG_DVB_CX24123 is not set
+# CONFIG_DVB_CXD2099 is not set
+# CONFIG_DVB_CXD2820R is not set
+# CONFIG_DVB_CXD2841ER is not set
+# CONFIG_DVB_CXD2880 is not set
+# CONFIG_DVB_DEMUX_SECTION_LOSS_LOG is not set
+# CONFIG_DVB_DIB3000MB is not set
+# CONFIG_DVB_DIB3000MC is not set
+# CONFIG_DVB_DIB7000M is not set
+# CONFIG_DVB_DIB7000P is not set
+# CONFIG_DVB_DIB8000 is not set
+# CONFIG_DVB_DIB9000 is not set
+# CONFIG_DVB_DRX39XYJ is not set
+# CONFIG_DVB_DRXD is not set
+# CONFIG_DVB_DRXK is not set
+# CONFIG_DVB_DS3000 is not set
+# CONFIG_DVB_DUMMY_FE is not set
+# CONFIG_DVB_DYNAMIC_MINORS is not set
+# CONFIG_DVB_EC100 is not set
+# CONFIG_DVB_FIREDTV is not set
+# CONFIG_DVB_HELENE is not set
+# CONFIG_DVB_HORUS3A is not set
+# CONFIG_DVB_ISL6405 is not set
+# CONFIG_DVB_ISL6421 is not set
+# CONFIG_DVB_ISL6423 is not set
+# CONFIG_DVB_IX2505V is not set
+# CONFIG_DVB_L64781 is not set
+# CONFIG_DVB_LG2160 is not set
+# CONFIG_DVB_LGDT3305 is not set
+# CONFIG_DVB_LGDT3306A is not set
+# CONFIG_DVB_LGDT330X is not set
+# CONFIG_DVB_LGS8GL5 is not set
+# CONFIG_DVB_LGS8GXX is not set
+# CONFIG_DVB_LNBH25 is not set
+# CONFIG_DVB_LNBH29 is not set
+# CONFIG_DVB_LNBP21 is not set
+# CONFIG_DVB_LNBP22 is not set
+# CONFIG_DVB_M88DS3103 is not set
+# CONFIG_DVB_M88RS2000 is not set
+CONFIG_DVB_MAX_ADAPTERS=16
+# CONFIG_DVB_MB86A16 is not set
+# CONFIG_DVB_MB86A20S is not set
+# CONFIG_DVB_MMAP is not set
+# CONFIG_DVB_MN88443X is not set
+# CONFIG_DVB_MN88472 is not set
+# CONFIG_DVB_MN88473 is not set
+# CONFIG_DVB_MT312 is not set
+# CONFIG_DVB_MT352 is not set
+# CONFIG_DVB_MXL5XX is not set
+# CONFIG_DVB_MXL692 is not set
+# CONFIG_DVB_NET is not set
+# CONFIG_DVB_NXT200X is not set
+# CONFIG_DVB_NXT6000 is not set
+# CONFIG_DVB_OR51132 is not set
+# CONFIG_DVB_OR51211 is not set
+# CONFIG_DVB_PLATFORM_DRIVERS is not set
+# CONFIG_DVB_PLL is not set
+# CONFIG_DVB_RTL2830 is not set
+# CONFIG_DVB_RTL2832 is not set
+# CONFIG_DVB_RTL2832_SDR is not set
+# CONFIG_DVB_S5H1409 is not set
+# CONFIG_DVB_S5H1411 is not set
+# CONFIG_DVB_S5H1420 is not set
+# CONFIG_DVB_S5H1432 is not set
+# CONFIG_DVB_S921 is not set
+# CONFIG_DVB_SI2165 is not set
+# CONFIG_DVB_SI2168 is not set
+# CONFIG_DVB_SI21XX is not set
+# CONFIG_DVB_SP2 is not set
+# CONFIG_DVB_SP8870 is not set
+# CONFIG_DVB_SP887X is not set
+# CONFIG_DVB_STB0899 is not set
+# CONFIG_DVB_STB6000 is not set
+# CONFIG_DVB_STB6100 is not set
+# CONFIG_DVB_STV0288 is not set
+# CONFIG_DVB_STV0297 is not set
+# CONFIG_DVB_STV0299 is not set
+# CONFIG_DVB_STV0367 is not set
+# CONFIG_DVB_STV0900 is not set
+# CONFIG_DVB_STV090x is not set
+# CONFIG_DVB_STV0910 is not set
+# CONFIG_DVB_STV6110 is not set
+# CONFIG_DVB_STV6110x is not set
+# CONFIG_DVB_STV6111 is not set
+# CONFIG_DVB_TC90522 is not set
+# CONFIG_DVB_TDA10021 is not set
+# CONFIG_DVB_TDA10023 is not set
+# CONFIG_DVB_TDA10048 is not set
+# CONFIG_DVB_TDA1004X is not set
+# CONFIG_DVB_TDA10071 is not set
+# CONFIG_DVB_TDA10086 is not set
+# CONFIG_DVB_TDA18271C2DD is not set
+# CONFIG_DVB_TDA665x is not set
+# CONFIG_DVB_TDA8083 is not set
+# CONFIG_DVB_TDA8261 is not set
+# CONFIG_DVB_TDA826X is not set
+# CONFIG_DVB_TEST_DRIVERS is not set
+# CONFIG_DVB_TS2020 is not set
+# CONFIG_DVB_TTUSB_BUDGET is not set
+# CONFIG_DVB_TTUSB_DEC is not set
+# CONFIG_DVB_TUA6100 is not set
+# CONFIG_DVB_TUNER_CX24113 is not set
+# CONFIG_DVB_TUNER_DIB0070 is not set
+# CONFIG_DVB_TUNER_DIB0090 is not set
+# CONFIG_DVB_TUNER_ITD1000 is not set
+# CONFIG_DVB_ULE_DEBUG is not set
+# CONFIG_DVB_USB is not set
+# CONFIG_DVB_USB_V2 is not set
+# CONFIG_DVB_VES1820 is not set
+# CONFIG_DVB_VES1X93 is not set
+# CONFIG_DVB_ZD1301_DEMOD is not set
+# CONFIG_DVB_ZL10036 is not set
+# CONFIG_DVB_ZL10039 is not set
+# CONFIG_DVB_ZL10353 is not set
+# CONFIG_DWC_XLGMAC is not set
+# CONFIG_DWMAC_DWC_QOS_ETH is not set
+# CONFIG_DWMAC_INTEL_PLAT is not set
+# CONFIG_DWMAC_IPQ806X is not set
+# CONFIG_DWMAC_LOONGSON is not set
+# CONFIG_DWMAC_LPC18XX is not set
+# CONFIG_DWMAC_MESON is not set
+# CONFIG_DWMAC_ROCKCHIP is not set
+# CONFIG_DWMAC_SOCFPGA is not set
+# CONFIG_DWMAC_STI is not set
+# CONFIG_DW_AXI_DMAC is not set
+# CONFIG_DW_DMAC is not set
+# CONFIG_DW_DMAC_PCI is not set
+# CONFIG_DW_EDMA is not set
+# CONFIG_DW_EDMA_PCIE is not set
+# CONFIG_DW_WATCHDOG is not set
+# CONFIG_DW_XDATA_PCIE is not set
+# CONFIG_DYNAMIC_DEBUG is not set
+# CONFIG_DYNAMIC_DEBUG_CORE is not set
+# CONFIG_E100 is not set
+# CONFIG_E1000 is not set
+# CONFIG_E1000E is not set
+# CONFIG_E1000E_HWTS is not set
+# CONFIG_EARLY_PRINTK_8250 is not set
+# CONFIG_EARLY_PRINTK_USB_XDBC is not set
+# CONFIG_EBC_C384_WDT is not set
+# CONFIG_ECHO is not set
+# CONFIG_ECRYPT_FS is not set
+# CONFIG_EDAC is not set
+# CONFIG_EEEPC_LAPTOP is not set
+# CONFIG_EEPROM_93CX6 is not set
+# CONFIG_EEPROM_93XX46 is not set
+# CONFIG_EEPROM_AT24 is not set
+# CONFIG_EEPROM_AT25 is not set
+# CONFIG_EEPROM_DIGSY_MTC_CFG is not set
+# CONFIG_EEPROM_EE1004 is not set
+# CONFIG_EEPROM_IDT_89HPESX is not set
+# CONFIG_EEPROM_LEGACY is not set
+# CONFIG_EEPROM_MAX6875 is not set
+# CONFIG_EFI is not set
+CONFIG_EFI_PARTITION=y
+# CONFIG_EFI_VARS_PSTORE is not set
+# CONFIG_EFS_FS is not set
+CONFIG_ELFCORE=y
+# CONFIG_ELF_CORE is not set
+# CONFIG_EMAC_ROCKCHIP is not set
+CONFIG_EMBEDDED=y
+# CONFIG_EM_TIMER_STI is not set
+CONFIG_ENABLE_WARN_DEPRECATED=y
+# CONFIG_ENA_ETHERNET is not set
+# CONFIG_ENC28J60 is not set
+# CONFIG_ENCLOSURE_SERVICES is not set
+# CONFIG_ENCRYPTED_KEYS is not set
+# CONFIG_ENCX24J600 is not set
+# CONFIG_ENERGY_MODEL is not set
+# CONFIG_ENIC is not set
+# CONFIG_ENVELOPE_DETECTOR is not set
+# CONFIG_EPAPR_PARAVIRT is not set
+# CONFIG_EPIC100 is not set
+CONFIG_EPOLL=y
+# CONFIG_EQUALIZER is not set
+# CONFIG_EROFS_FS is not set
+# CONFIG_ET131X is not set
+CONFIG_ETHERNET=y
+# CONFIG_ETHOC is not set
+CONFIG_ETHTOOL_NETLINK=y
+CONFIG_EVENTFD=y
+# CONFIG_EVM is not set
+# CONFIG_EXFAT_FS is not set
+CONFIG_EXPERT=y
+CONFIG_EXPORTFS=y
+# CONFIG_EXPORTFS_BLOCK_OPS is not set
+# CONFIG_EXT2_FS is not set
+CONFIG_EXT2_FS_XATTR=y
+# CONFIG_EXT3_FS is not set
+# CONFIG_EXT4_DEBUG is not set
+# CONFIG_EXT4_ENCRYPTION is not set
+# CONFIG_EXT4_FS is not set
+# CONFIG_EXT4_FS_POSIX_ACL is not set
+# CONFIG_EXT4_FS_SECURITY is not set
+CONFIG_EXT4_USE_FOR_EXT2=y
+# CONFIG_EXTCON is not set
+# CONFIG_EXTCON_ADC_JACK is not set
+# CONFIG_EXTCON_ARIZONA is not set
+# CONFIG_EXTCON_AXP288 is not set
+# CONFIG_EXTCON_FSA9480 is not set
+# CONFIG_EXTCON_GPIO is not set
+# CONFIG_EXTCON_INTEL_INT3496 is not set
+# CONFIG_EXTCON_MAX3355 is not set
+# CONFIG_EXTCON_PTN5150 is not set
+# CONFIG_EXTCON_QCOM_SPMI_MISC is not set
+# CONFIG_EXTCON_RT8973A is not set
+# CONFIG_EXTCON_SM5502 is not set
+# CONFIG_EXTCON_USBC_TUSB320 is not set
+# CONFIG_EXTCON_USB_GPIO is not set
+CONFIG_EXTRA_FIRMWARE=""
+CONFIG_EXTRA_TARGETS=""
+# CONFIG_EXYNOS_ADC is not set
+# CONFIG_EXYNOS_VIDEO is not set
+# CONFIG_EZCHIP_NPS_MANAGEMENT_ENET is not set
+# CONFIG_EZX_PCAP is not set
+# CONFIG_F2FS_CHECK_FS is not set
+# CONFIG_F2FS_FAULT_INJECTION is not set
+# CONFIG_F2FS_FS is not set
+# CONFIG_F2FS_FS_COMPRESSION is not set
+# CONFIG_F2FS_FS_ENCRYPTION is not set
+# CONFIG_F2FS_FS_POSIX_ACL is not set
+# CONFIG_F2FS_FS_SECURITY is not set
+CONFIG_F2FS_FS_XATTR=y
+# CONFIG_F2FS_IOSTAT is not set
+# CONFIG_F2FS_IO_TRACE is not set
+CONFIG_F2FS_STAT_FS=y
+# CONFIG_F2FS_UNFAIR_RWSEM is not set
+# CONFIG_FAILOVER is not set
+# CONFIG_FAIR_GROUP_SCHED is not set
+# CONFIG_FANOTIFY is not set
+# CONFIG_FANOTIFY_ACCESS_PERMISSIONS is not set
+CONFIG_FAT_DEFAULT_CODEPAGE=437
+CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
+# CONFIG_FAT_DEFAULT_UTF8 is not set
+# CONFIG_FAT_FS is not set
+# CONFIG_FAULT_INJECTION is not set
+# CONFIG_FB is not set
+# CONFIG_FB_3DFX is not set
+# CONFIG_FB_ARC is not set
+# CONFIG_FB_ARK is not set
+# CONFIG_FB_ARMCLCD is not set
+# CONFIG_FB_ASILIANT is not set
+# CONFIG_FB_ATMEL is not set
+# CONFIG_FB_ATY is not set
+# CONFIG_FB_ATY128 is not set
+# CONFIG_FB_AUO_K190X is not set
+# CONFIG_FB_BACKLIGHT is not set
+# CONFIG_FB_BIG_ENDIAN is not set
+# CONFIG_FB_BOOT_VESA_SUPPORT is not set
+# CONFIG_FB_BOTH_ENDIAN is not set
+# CONFIG_FB_BROADSHEET is not set
+# CONFIG_FB_CARMINE is not set
+# CONFIG_FB_CFB_COPYAREA is not set
+# CONFIG_FB_CFB_FILLRECT is not set
+# CONFIG_FB_CFB_IMAGEBLIT is not set
+# CONFIG_FB_CFB_REV_PIXELS_IN_BYTE is not set
+# CONFIG_FB_CIRRUS is not set
+# CONFIG_FB_CYBER2000 is not set
+# CONFIG_FB_DA8XX is not set
+# CONFIG_FB_DDC is not set
+# CONFIG_FB_FLEX is not set
+# CONFIG_FB_FOREIGN_ENDIAN is not set
+# CONFIG_FB_FSL_DIU is not set
+# CONFIG_FB_GEODE is not set
+# CONFIG_FB_GOLDFISH is not set
+# CONFIG_FB_HGA is not set
+# CONFIG_FB_I740 is not set
+# CONFIG_FB_IBM_GXT4500 is not set
+# CONFIG_FB_IMSTT is not set
+# CONFIG_FB_IMX is not set
+# CONFIG_FB_KYRO is not set
+# CONFIG_FB_LE80578 is not set
+# CONFIG_FB_LITTLE_ENDIAN is not set
+# CONFIG_FB_MACMODES is not set
+# CONFIG_FB_MATROX is not set
+# CONFIG_FB_MB862XX is not set
+# CONFIG_FB_METRONOME is not set
+# CONFIG_FB_MODE_HELPERS is not set
+# CONFIG_FB_MXS is not set
+# CONFIG_FB_N411 is not set
+# CONFIG_FB_NEOMAGIC is not set
+CONFIG_FB_NOTIFY=y
+# CONFIG_FB_NVIDIA is not set
+# CONFIG_FB_OF is not set
+# CONFIG_FB_OMAP2 is not set
+# CONFIG_FB_OPENCORES is not set
+# CONFIG_FB_PM2 is not set
+# CONFIG_FB_PM3 is not set
+# CONFIG_FB_PS3 is not set
+# CONFIG_FB_PXA is not set
+# CONFIG_FB_RADEON is not set
+# CONFIG_FB_RIVA is not set
+# CONFIG_FB_S1D13XXX is not set
+# CONFIG_FB_S3 is not set
+# CONFIG_FB_SAVAGE is not set
+# CONFIG_FB_SIMPLE is not set
+# CONFIG_FB_SIS is not set
+# CONFIG_FB_SM712 is not set
+# CONFIG_FB_SM750 is not set
+# CONFIG_FB_SMSCUFX is not set
+# CONFIG_FB_SSD1307 is not set
+# CONFIG_FB_SVGALIB is not set
+# CONFIG_FB_SYS_COPYAREA is not set
+# CONFIG_FB_SYS_FILLRECT is not set
+# CONFIG_FB_SYS_FOPS is not set
+# CONFIG_FB_SYS_IMAGEBLIT is not set
+# CONFIG_FB_TFT is not set
+# CONFIG_FB_TFT_AGM1264K_FL is not set
+# CONFIG_FB_TFT_BD663474 is not set
+# CONFIG_FB_TFT_FBTFT_DEVICE is not set
+# CONFIG_FB_TFT_HX8340BN is not set
+# CONFIG_FB_TFT_HX8347D is not set
+# CONFIG_FB_TFT_HX8353D is not set
+# CONFIG_FB_TFT_HX8357D is not set
+# CONFIG_FB_TFT_ILI9163 is not set
+# CONFIG_FB_TFT_ILI9320 is not set
+# CONFIG_FB_TFT_ILI9325 is not set
+# CONFIG_FB_TFT_ILI9340 is not set
+# CONFIG_FB_TFT_ILI9341 is not set
+# CONFIG_FB_TFT_ILI9481 is not set
+# CONFIG_FB_TFT_ILI9486 is not set
+# CONFIG_FB_TFT_PCD8544 is not set
+# CONFIG_FB_TFT_RA8875 is not set
+# CONFIG_FB_TFT_S6D02A1 is not set
+# CONFIG_FB_TFT_S6D1121 is not set
+# CONFIG_FB_TFT_SEPS525 is not set
+# CONFIG_FB_TFT_SH1106 is not set
+# CONFIG_FB_TFT_SSD1289 is not set
+# CONFIG_FB_TFT_SSD1305 is not set
+# CONFIG_FB_TFT_SSD1306 is not set
+# CONFIG_FB_TFT_SSD1325 is not set
+# CONFIG_FB_TFT_SSD1331 is not set
+# CONFIG_FB_TFT_SSD1351 is not set
+# CONFIG_FB_TFT_ST7735R is not set
+# CONFIG_FB_TFT_ST7789V is not set
+# CONFIG_FB_TFT_TINYLCD is not set
+# CONFIG_FB_TFT_TLS8204 is not set
+# CONFIG_FB_TFT_UC1611 is not set
+# CONFIG_FB_TFT_UC1701 is not set
+# CONFIG_FB_TFT_UPD161704 is not set
+# CONFIG_FB_TFT_WATTEROTT is not set
+# CONFIG_FB_TILEBLITTING is not set
+# CONFIG_FB_TMIO is not set
+# CONFIG_FB_TRIDENT is not set
+# CONFIG_FB_UDL is not set
+# CONFIG_FB_UVESA is not set
+# CONFIG_FB_VGA16 is not set
+# CONFIG_FB_VIA is not set
+# CONFIG_FB_VIRTUAL is not set
+# CONFIG_FB_VOODOO1 is not set
+# CONFIG_FB_VT8623 is not set
+# CONFIG_FB_XGI is not set
+# CONFIG_FCOE is not set
+# CONFIG_FCOE_FNIC is not set
+# CONFIG_FDDI is not set
+# CONFIG_FEALNX is not set
+# CONFIG_FENCE_TRACE is not set
+# CONFIG_FHANDLE is not set
+CONFIG_FIB_RULES=y
+# CONFIG_FIELDBUS_DEV is not set
+CONFIG_FILE_LOCKING=y
+# CONFIG_FIND_BIT_BENCHMARK is not set
+# CONFIG_FIREWIRE is not set
+# CONFIG_FIREWIRE_NOSY is not set
+# CONFIG_FIREWIRE_SERIAL is not set
+# CONFIG_FIRMWARE_EDID is not set
+# CONFIG_FIRMWARE_IN_KERNEL is not set
+# CONFIG_FIRMWARE_MEMMAP is not set
+# CONFIG_FIT_PARTITION is not set
+# CONFIG_FIXED_PHY is not set
+CONFIG_FLATMEM=y
+CONFIG_FLATMEM_MANUAL=y
+CONFIG_FLAT_NODE_MEM_MAP=y
+# CONFIG_FM10K is not set
+# CONFIG_FMC is not set
+# CONFIG_FONTS is not set
+# CONFIG_FONT_6x8 is not set
+# CONFIG_FONT_TER16x32 is not set
+# CONFIG_FORCEDETH is not set
+CONFIG_FORCE_MAX_ZONEORDER=11
+# CONFIG_FORCE_NR_CPUS is not set
+CONFIG_FORTIFY_SOURCE=y
+# CONFIG_FPGA is not set
+# CONFIG_FRAMEBUFFER_CONSOLE is not set
+# CONFIG_FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER is not set
+# CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION is not set
+# CONFIG_FRAME_POINTER is not set
+# CONFIG_FREEZER is not set
+# CONFIG_FRONTSWAP is not set
+# CONFIG_FSCACHE is not set
+# CONFIG_FSI is not set
+# CONFIG_FSL_EDMA is not set
+# CONFIG_FSL_ENETC is not set
+# CONFIG_FSL_ENETC_IERB is not set
+# CONFIG_FSL_ENETC_MDIO is not set
+# CONFIG_FSL_ENETC_VF is not set
+# CONFIG_FSL_ERRATUM_A008585 is not set
+# CONFIG_FSL_MC_BUS is not set
+# CONFIG_FSL_PQ_MDIO is not set
+# CONFIG_FSL_QDMA is not set
+# CONFIG_FSL_RCPM is not set
+# CONFIG_FSL_XGMAC_MDIO is not set
+CONFIG_FSNOTIFY=y
+# CONFIG_FS_DAX is not set
+# CONFIG_FS_ENCRYPTION is not set
+# CONFIG_FS_POSIX_ACL is not set
+# CONFIG_FS_VERITY is not set
+# CONFIG_FTGMAC100 is not set
+# CONFIG_FTL is not set
+# CONFIG_FTMAC100 is not set
+# CONFIG_FTRACE is not set
+# CONFIG_FTRACE_RECORD_RECURSION is not set
+# CONFIG_FTRACE_SORT_STARTUP_TEST is not set
+# CONFIG_FTRACE_STARTUP_TEST is not set
+# CONFIG_FTR_FIXUP_SELFTEST is not set
+# CONFIG_FTWDT010_WATCHDOG is not set
+# CONFIG_FUJITSU_ERRATUM_010001 is not set
+# CONFIG_FUJITSU_ES is not set
+# CONFIG_FUJITSU_LAPTOP is not set
+# CONFIG_FUJITSU_TABLET is not set
+# CONFIG_FUNCTION_ERROR_INJECTION is not set
+# CONFIG_FUNCTION_TRACER is not set
+# CONFIG_FUN_ETH is not set
+# CONFIG_FUSE_FS is not set
+# CONFIG_FUSION is not set
+# CONFIG_FUSION_FC is not set
+# CONFIG_FUSION_SAS is not set
+# CONFIG_FUSION_SPI is not set
+CONFIG_FUTEX=y
+CONFIG_FUTEX_PI=y
+# CONFIG_FW_CFG_SYSFS is not set
+CONFIG_FW_LOADER=y
+# CONFIG_FW_LOADER_COMPRESS is not set
+CONFIG_FW_LOADER_USER_HELPER=y
+CONFIG_FW_LOADER_USER_HELPER_FALLBACK=y
+# CONFIG_FW_UPLOAD is not set
+# CONFIG_FXAS21002C is not set
+# CONFIG_FXLS8962AF_I2C is not set
+# CONFIG_FXLS8962AF_SPI is not set
+# CONFIG_FXOS8700_I2C is not set
+# CONFIG_FXOS8700_SPI is not set
+CONFIG_GACT_PROB=y
+# CONFIG_GADGET_UAC1 is not set
+# CONFIG_GAMEPORT is not set
+# CONFIG_GATEWORKS_GW16083 is not set
+# CONFIG_GCC_PLUGINS is not set
+# CONFIG_GCOV is not set
+# CONFIG_GCOV_KERNEL is not set
+# CONFIG_GDB_SCRIPTS is not set
+# CONFIG_GEMINI_ETHERNET is not set
+# CONFIG_GENERIC_ADC_BATTERY is not set
+# CONFIG_GENERIC_ADC_THERMAL is not set
+CONFIG_GENERIC_CALIBRATE_DELAY=y
+# CONFIG_GENERIC_CPU_DEVICES is not set
+CONFIG_GENERIC_HWEIGHT=y
+# CONFIG_GENERIC_IRQ_DEBUGFS is not set
+CONFIG_GENERIC_IRQ_IPI=y
+CONFIG_GENERIC_IRQ_PROBE=y
+CONFIG_GENERIC_NET_UTILS=y
+# CONFIG_GENERIC_PHY is not set
+CONFIG_GENERIC_PTDUMP=y
+CONFIG_GENERIC_VDSO_TIME_NS=y
+# CONFIG_GENEVE is not set
+# CONFIG_GENWQE is not set
+# CONFIG_GFS2_FS is not set
+# CONFIG_GIGASET_CAPI is not set
+# CONFIG_GIGASET_DEBUG is not set
+# CONFIG_GIGASET_DUMMYLL is not set
+# CONFIG_GLOB_SELFTEST is not set
+# CONFIG_GNSS is not set
+# CONFIG_GOLDFISH is not set
+# CONFIG_GOOGLE_FIRMWARE is not set
+# CONFIG_GOOGLE_FRAMEBUFFER_COREBOOT is not set
+# CONFIG_GOOGLE_MEMCONSOLE_X86_LEGACY is not set
+# CONFIG_GOOGLE_SMI is not set
+# CONFIG_GP2AP002 is not set
+# CONFIG_GP2AP020A00F is not set
+# CONFIG_GPD_POCKET_FAN is not set
+CONFIG_GPIOLIB=y
+CONFIG_GPIOLIB_FASTPATH_LIMIT=512
+# CONFIG_GPIO_104_DIO_48E is not set
+# CONFIG_GPIO_104_IDIO_16 is not set
+# CONFIG_GPIO_104_IDI_48 is not set
+# CONFIG_GPIO_74X164 is not set
+# CONFIG_GPIO_74XX_MMIO is not set
+# CONFIG_GPIO_ADNP is not set
+# CONFIG_GPIO_ADP5588 is not set
+# CONFIG_GPIO_AGGREGATOR is not set
+# CONFIG_GPIO_ALTERA is not set
+# CONFIG_GPIO_AMD8111 is not set
+# CONFIG_GPIO_AMDPT is not set
+# CONFIG_GPIO_AMD_FCH is not set
+# CONFIG_GPIO_BCM_KONA is not set
+# CONFIG_GPIO_BT8XX is not set
+# CONFIG_GPIO_CADENCE is not set
+# CONFIG_GPIO_CASCADE is not set
+# CONFIG_GPIO_CDEV is not set
+# CONFIG_GPIO_CDEV_V1 is not set
+# CONFIG_GPIO_CS5535 is not set
+# CONFIG_GPIO_DWAPB is not set
+# CONFIG_GPIO_EM is not set
+# CONFIG_GPIO_EXAR is not set
+# CONFIG_GPIO_F7188X is not set
+# CONFIG_GPIO_FTGPIO010 is not set
+# CONFIG_GPIO_GENERIC_PLATFORM is not set
+# CONFIG_GPIO_GPIO_MM is not set
+# CONFIG_GPIO_GRGPIO is not set
+# CONFIG_GPIO_GW_PLD is not set
+# CONFIG_GPIO_HLWD is not set
+# CONFIG_GPIO_ICH is not set
+# CONFIG_GPIO_IT87 is not set
+# CONFIG_GPIO_LOGICVC is not set
+# CONFIG_GPIO_LYNXPOINT is not set
+# CONFIG_GPIO_MAX3191X is not set
+# CONFIG_GPIO_MAX7300 is not set
+# CONFIG_GPIO_MAX7301 is not set
+# CONFIG_GPIO_MAX732X is not set
+# CONFIG_GPIO_MB86S7X is not set
+# CONFIG_GPIO_MC33880 is not set
+# CONFIG_GPIO_ML_IOH is not set
+# CONFIG_GPIO_MOCKUP is not set
+# CONFIG_GPIO_MPC8XXX is not set
+# CONFIG_GPIO_PCA953X is not set
+# CONFIG_GPIO_PCA953X_IRQ is not set
+# CONFIG_GPIO_PCA9570 is not set
+# CONFIG_GPIO_PCF857X is not set
+# CONFIG_GPIO_PCH is not set
+# CONFIG_GPIO_PCIE_IDIO_24 is not set
+# CONFIG_GPIO_PCI_IDIO_16 is not set
+# CONFIG_GPIO_PISOSR is not set
+# CONFIG_GPIO_PL061 is not set
+# CONFIG_GPIO_PWM is not set
+# CONFIG_GPIO_RCAR is not set
+# CONFIG_GPIO_RDC321X is not set
+# CONFIG_GPIO_SAMA5D2_PIOBU is not set
+# CONFIG_GPIO_SCH is not set
+# CONFIG_GPIO_SCH311X is not set
+# CONFIG_GPIO_SIFIVE is not set
+# CONFIG_GPIO_SIM is not set
+# CONFIG_GPIO_SX150X is not set
+# CONFIG_GPIO_SYSCON is not set
+CONFIG_GPIO_SYSFS=y
+# CONFIG_GPIO_TPIC2810 is not set
+# CONFIG_GPIO_TS4900 is not set
+# CONFIG_GPIO_TS5500 is not set
+# CONFIG_GPIO_VIRTIO is not set
+# CONFIG_GPIO_VX855 is not set
+# CONFIG_GPIO_WATCHDOG is not set
+# CONFIG_GPIO_WINBOND is not set
+# CONFIG_GPIO_WS16C48 is not set
+# CONFIG_GPIO_XGENE is not set
+# CONFIG_GPIO_XILINX is not set
+# CONFIG_GPIO_XRA1403 is not set
+# CONFIG_GPIO_ZEVIO is not set
+# CONFIG_GPIO_ZX is not set
+# CONFIG_GP_PCI1XXXX is not set
+# CONFIG_GREENASIA_FF is not set
+# CONFIG_GREYBUS is not set
+# CONFIG_GS_FPGABOOT is not set
+# CONFIG_GTP is not set
+# CONFIG_GUP_BENCHMARK is not set
+# CONFIG_GUP_TEST is not set
+# CONFIG_GVE is not set
+# CONFIG_HABANA_AI is not set
+# CONFIG_HAMACHI is not set
+# CONFIG_HAMRADIO is not set
+# CONFIG_HAPPYMEAL is not set
+CONFIG_HARDENED_USERCOPY=y
+# CONFIG_HARDENED_USERCOPY_FALLBACK is not set
+# CONFIG_HARDENED_USERCOPY_PAGESPAN is not set
+CONFIG_HARDEN_BRANCH_HISTORY=y
+CONFIG_HARDEN_EL2_VECTORS=y
+# CONFIG_HARDLOCKUP_DETECTOR is not set
+# CONFIG_HAVE_ARM_ARCH_TIMER is not set
+# CONFIG_HCALL_STATS is not set
+# CONFIG_HDC100X is not set
+# CONFIG_HDC2010 is not set
+# CONFIG_HDLC is not set
+# CONFIG_HDLC_CISCO is not set
+# CONFIG_HDLC_FR is not set
+# CONFIG_HDLC_PPP is not set
+# CONFIG_HDLC_RAW is not set
+# CONFIG_HDLC_RAW_ETH is not set
+# CONFIG_HDMI_LPE_AUDIO is not set
+# CONFIG_HDQ_MASTER_OMAP is not set
+# CONFIG_HEADERS_CHECK is not set
+# CONFIG_HEADERS_INSTALL is not set
+# CONFIG_HEADER_TEST is not set
+# CONFIG_HERMES is not set
+# CONFIG_HFSPLUS_FS is not set
+# CONFIG_HFSPLUS_FS_POSIX_ACL is not set
+# CONFIG_HFS_FS is not set
+# CONFIG_HFS_FS_POSIX_ACL is not set
+# CONFIG_HI6421V600_IRQ is not set
+# CONFIG_HI8435 is not set
+# CONFIG_HIBERNATION is not set
+# CONFIG_HID is not set
+# CONFIG_HIDRAW is not set
+# CONFIG_HID_A4TECH is not set
+# CONFIG_HID_ACCUTOUCH is not set
+# CONFIG_HID_ACRUX is not set
+# CONFIG_HID_ACRUX_FF is not set
+# CONFIG_HID_ALPS is not set
+# CONFIG_HID_APPLE is not set
+# CONFIG_HID_APPLEIR is not set
+# CONFIG_HID_ASUS is not set
+# CONFIG_HID_AUREAL is not set
+# CONFIG_HID_BATTERY_STRENGTH is not set
+# CONFIG_HID_BELKIN is not set
+# CONFIG_HID_BETOP_FF is not set
+# CONFIG_HID_BIGBEN_FF is not set
+# CONFIG_HID_CHERRY is not set
+# CONFIG_HID_CHICONY is not set
+# CONFIG_HID_CMEDIA is not set
+# CONFIG_HID_CORSAIR is not set
+# CONFIG_HID_COUGAR is not set
+# CONFIG_HID_CP2112 is not set
+# CONFIG_HID_CREATIVE_SB0540 is not set
+# CONFIG_HID_CYPRESS is not set
+# CONFIG_HID_DRAGONRISE is not set
+# CONFIG_HID_ELAN is not set
+# CONFIG_HID_ELECOM is not set
+# CONFIG_HID_ELO is not set
+# CONFIG_HID_EMS_FF is not set
+# CONFIG_HID_EZKEY is not set
+# CONFIG_HID_FT260 is not set
+# CONFIG_HID_GEMBIRD is not set
+# CONFIG_HID_GENERIC is not set
+# CONFIG_HID_GFRM is not set
+# CONFIG_HID_GLORIOUS is not set
+# CONFIG_HID_GOOGLE_HAMMER is not set
+# CONFIG_HID_GREENASIA is not set
+# CONFIG_HID_GT683R is not set
+# CONFIG_HID_GYRATION is not set
+# CONFIG_HID_HOLTEK is not set
+# CONFIG_HID_ICADE is not set
+# CONFIG_HID_ITE is not set
+# CONFIG_HID_JABRA is not set
+# CONFIG_HID_KENSINGTON is not set
+# CONFIG_HID_KEYTOUCH is not set
+# CONFIG_HID_KYE is not set
+# CONFIG_HID_LCPOWER is not set
+# CONFIG_HID_LED is not set
+# CONFIG_HID_LENOVO is not set
+# CONFIG_HID_LETSKETCH is not set
+# CONFIG_HID_LOGITECH is not set
+# CONFIG_HID_LOGITECH_DJ is not set
+# CONFIG_HID_LOGITECH_HIDPP is not set
+# CONFIG_HID_MACALLY is not set
+# CONFIG_HID_MAGICMOUSE is not set
+# CONFIG_HID_MALTRON is not set
+# CONFIG_HID_MAYFLASH is not set
+# CONFIG_HID_MCP2221 is not set
+# CONFIG_HID_MEGAWORLD_FF is not set
+# CONFIG_HID_MICROSOFT is not set
+# CONFIG_HID_MONTEREY is not set
+# CONFIG_HID_MULTITOUCH is not set
+# CONFIG_HID_NINTENDO is not set
+# CONFIG_HID_NTI is not set
+# CONFIG_HID_NTRIG is not set
+# CONFIG_HID_ORTEK is not set
+# CONFIG_HID_PANTHERLORD is not set
+# CONFIG_HID_PENMOUNT is not set
+# CONFIG_HID_PETALYNX is not set
+# CONFIG_HID_PICOLCD is not set
+# CONFIG_HID_PID is not set
+# CONFIG_HID_PLANTRONICS is not set
+# CONFIG_HID_PLAYSTATION is not set
+# CONFIG_HID_PRIMAX is not set
+# CONFIG_HID_PRODIKEYS is not set
+# CONFIG_HID_PXRC is not set
+# CONFIG_HID_RAZER is not set
+# CONFIG_HID_REDRAGON is not set
+# CONFIG_HID_RETRODE is not set
+# CONFIG_HID_RMI is not set
+# CONFIG_HID_ROCCAT is not set
+# CONFIG_HID_SAITEK is not set
+# CONFIG_HID_SAMSUNG is not set
+# CONFIG_HID_SEMITEK is not set
+# CONFIG_HID_SENSOR_HUB is not set
+# CONFIG_HID_SIGMAMICRO is not set
+# CONFIG_HID_SMARTJOYPLUS is not set
+# CONFIG_HID_SONY is not set
+# CONFIG_HID_SPEEDLINK is not set
+# CONFIG_HID_STEAM is not set
+# CONFIG_HID_STEELSERIES is not set
+# CONFIG_HID_SUNPLUS is not set
+# CONFIG_HID_THINGM is not set
+# CONFIG_HID_THRUSTMASTER is not set
+# CONFIG_HID_TIVO is not set
+# CONFIG_HID_TOPRE is not set
+# CONFIG_HID_TOPSEED is not set
+# CONFIG_HID_TWINHAN is not set
+# CONFIG_HID_U2FZERO is not set
+# CONFIG_HID_UCLOGIC is not set
+# CONFIG_HID_UDRAW_PS3 is not set
+# CONFIG_HID_VIEWSONIC is not set
+# CONFIG_HID_VIVALDI is not set
+# CONFIG_HID_VRC2 is not set
+# CONFIG_HID_WACOM is not set
+# CONFIG_HID_WALTOP is not set
+# CONFIG_HID_WIIMOTE is not set
+# CONFIG_HID_XIAOMI is not set
+# CONFIG_HID_XINMO is not set
+# CONFIG_HID_ZEROPLUS is not set
+# CONFIG_HID_ZYDACRON is not set
+# CONFIG_HIGHMEM is not set
+CONFIG_HIGH_RES_TIMERS=y
+# CONFIG_HINIC is not set
+# CONFIG_HIP04_ETH is not set
+# CONFIG_HIPPI is not set
+# CONFIG_HISILICON_ERRATUM_161010101 is not set
+# CONFIG_HISILICON_ERRATUM_161600802 is not set
+# CONFIG_HISI_DMA is not set
+# CONFIG_HISI_FEMAC is not set
+# CONFIG_HISI_HIKEY_USB is not set
+# CONFIG_HISI_PCIE_PMU is not set
+# CONFIG_HISI_PTT is not set
+# CONFIG_HIST_TRIGGERS_DEBUG is not set
+# CONFIG_HIX5HD2_GMAC is not set
+# CONFIG_HMC425 is not set
+# CONFIG_HMC6352 is not set
+# CONFIG_HNS is not set
+# CONFIG_HNS3 is not set
+# CONFIG_HNS3_PMU is not set
+# CONFIG_HNS_DSAF is not set
+# CONFIG_HNS_ENET is not set
+# CONFIG_HOSTAP is not set
+# CONFIG_HOSTAP_CS is not set
+# CONFIG_HOSTAP_PCI is not set
+# CONFIG_HOSTAP_PLX is not set
+# CONFIG_HOTPLUG_CPU is not set
+# CONFIG_HOTPLUG_PCI is not set
+# CONFIG_HP03 is not set
+# CONFIG_HP100 is not set
+# CONFIG_HP206C is not set
+CONFIG_HPET_MMAP_DEFAULT=y
+# CONFIG_HPFS_FS is not set
+# CONFIG_HP_ILO is not set
+# CONFIG_HP_WATCHDOG is not set
+# CONFIG_HP_WIRELESS is not set
+# CONFIG_HSA_AMD is not set
+# CONFIG_HSI is not set
+# CONFIG_HSR is not set
+# CONFIG_HTC_EGPIO is not set
+# CONFIG_HTC_I2CPLD is not set
+# CONFIG_HTC_PASIC3 is not set
+# CONFIG_HTE is not set
+# CONFIG_HTS221 is not set
+# CONFIG_HTU21 is not set
+# CONFIG_HUGETLBFS is not set
+# CONFIG_HUGETLB_PAGE is not set
+# CONFIG_HVC_DCC is not set
+# CONFIG_HVC_UDBG is not set
+# CONFIG_HWLAT_TRACER is not set
+# CONFIG_HWMON is not set
+# CONFIG_HWMON_DEBUG_CHIP is not set
+# CONFIG_HWMON_VID is not set
+# CONFIG_HWSPINLOCK is not set
+# CONFIG_HWSPINLOCK_OMAP is not set
+CONFIG_HW_PERF_EVENTS=y
+# CONFIG_HW_RANDOM is not set
+# CONFIG_HW_RANDOM_AMD is not set
+# CONFIG_HW_RANDOM_ARM_SMCCC_TRNG is not set
+# CONFIG_HW_RANDOM_ATMEL is not set
+# CONFIG_HW_RANDOM_BA431 is not set
+# CONFIG_HW_RANDOM_BCM2835 is not set
+# CONFIG_HW_RANDOM_CAVIUM is not set
+# CONFIG_HW_RANDOM_CCTRNG is not set
+# CONFIG_HW_RANDOM_CN10K is not set
+# CONFIG_HW_RANDOM_EXYNOS is not set
+# CONFIG_HW_RANDOM_GEODE is not set
+# CONFIG_HW_RANDOM_INTEL is not set
+# CONFIG_HW_RANDOM_IPROC_RNG200 is not set
+# CONFIG_HW_RANDOM_MTK is not set
+# CONFIG_HW_RANDOM_OMAP is not set
+# CONFIG_HW_RANDOM_OMAP3_ROM is not set
+# CONFIG_HW_RANDOM_PPC4XX is not set
+# CONFIG_HW_RANDOM_TIMERIOMEM is not set
+CONFIG_HW_RANDOM_TPM=y
+# CONFIG_HW_RANDOM_VIA is not set
+# CONFIG_HW_RANDOM_VIRTIO is not set
+# CONFIG_HW_RANDOM_XIPHERA is not set
+# CONFIG_HX711 is not set
+# CONFIG_HYPERV is not set
+# CONFIG_HYPERV_TSCPAGE is not set
+# CONFIG_HYSDN is not set
+CONFIG_HZ=100
+CONFIG_HZ_100=y
+# CONFIG_HZ_1000 is not set
+# CONFIG_HZ_1024 is not set
+# CONFIG_HZ_128 is not set
+# CONFIG_HZ_200 is not set
+# CONFIG_HZ_24 is not set
+# CONFIG_HZ_250 is not set
+# CONFIG_HZ_256 is not set
+# CONFIG_HZ_300 is not set
+# CONFIG_HZ_48 is not set
+# CONFIG_HZ_500 is not set
+# CONFIG_HZ_PERIODIC is not set
+# CONFIG_I2C is not set
+# CONFIG_I2C_ALGOBIT is not set
+# CONFIG_I2C_ALGOPCA is not set
+# CONFIG_I2C_ALGOPCF is not set
+# CONFIG_I2C_ALI1535 is not set
+# CONFIG_I2C_ALI1563 is not set
+# CONFIG_I2C_ALI15X3 is not set
+# CONFIG_I2C_AMD756 is not set
+# CONFIG_I2C_AMD8111 is not set
+# CONFIG_I2C_ARB_GPIO_CHALLENGE is not set
+# CONFIG_I2C_AU1550 is not set
+# CONFIG_I2C_BCM2835 is not set
+# CONFIG_I2C_BCM_IPROC is not set
+# CONFIG_I2C_BRCMSTB is not set
+# CONFIG_I2C_CADENCE is not set
+# CONFIG_I2C_CBUS_GPIO is not set
+# CONFIG_I2C_CHARDEV is not set
+# CONFIG_I2C_COMPAT is not set
+# CONFIG_I2C_CP2615 is not set
+# CONFIG_I2C_DEBUG_ALGO is not set
+# CONFIG_I2C_DEBUG_BUS is not set
+# CONFIG_I2C_DEBUG_CORE is not set
+# CONFIG_I2C_DEMUX_PINCTRL is not set
+# CONFIG_I2C_DESIGNWARE_PCI is not set
+# CONFIG_I2C_DESIGNWARE_PLATFORM is not set
+# CONFIG_I2C_DESIGNWARE_SLAVE is not set
+# CONFIG_I2C_DIOLAN_U2C is not set
+# CONFIG_I2C_EG20T is not set
+# CONFIG_I2C_ELEKTOR is not set
+# CONFIG_I2C_EMEV2 is not set
+# CONFIG_I2C_GPIO is not set
+# CONFIG_I2C_GPIO_FAULT_INJECTOR is not set
+# CONFIG_I2C_HELPER_AUTO is not set
+# CONFIG_I2C_HID is not set
+# CONFIG_I2C_HID_OF is not set
+# CONFIG_I2C_HID_OF_ELAN is not set
+# CONFIG_I2C_HID_OF_GOODIX is not set
+# CONFIG_I2C_I801 is not set
+# CONFIG_I2C_IBM_IIC is not set
+# CONFIG_I2C_IMG is not set
+# CONFIG_I2C_ISCH is not set
+# CONFIG_I2C_ISMT is not set
+# CONFIG_I2C_JZ4780 is not set
+# CONFIG_I2C_MLXCPLD is not set
+# CONFIG_I2C_MPC is not set
+# CONFIG_I2C_MT65XX is not set
+# CONFIG_I2C_MUX is not set
+# CONFIG_I2C_MUX_GPIO is not set
+# CONFIG_I2C_MUX_GPMUX is not set
+# CONFIG_I2C_MUX_LTC4306 is not set
+# CONFIG_I2C_MUX_MLXCPLD is not set
+# CONFIG_I2C_MUX_PCA9541 is not set
+# CONFIG_I2C_MUX_PCA954x is not set
+# CONFIG_I2C_MUX_PINCTRL is not set
+# CONFIG_I2C_MUX_REG is not set
+# CONFIG_I2C_MV64XXX is not set
+# CONFIG_I2C_NFORCE2 is not set
+# CONFIG_I2C_NOMADIK is not set
+# CONFIG_I2C_NVIDIA_GPU is not set
+# CONFIG_I2C_OCORES is not set
+# CONFIG_I2C_OCTEON is not set
+# CONFIG_I2C_PARPORT is not set
+# CONFIG_I2C_PARPORT_LIGHT is not set
+# CONFIG_I2C_PCA_ISA is not set
+# CONFIG_I2C_PCA_PLATFORM is not set
+# CONFIG_I2C_PCI1XXXX is not set
+# CONFIG_I2C_PIIX4 is not set
+# CONFIG_I2C_PXA_PCI is not set
+# CONFIG_I2C_PXA_SLAVE is not set
+# CONFIG_I2C_RCAR is not set
+# CONFIG_I2C_RK3X is not set
+# CONFIG_I2C_ROBOTFUZZ_OSIF is not set
+# CONFIG_I2C_S3C2410 is not set
+# CONFIG_I2C_SCMI is not set
+# CONFIG_I2C_SH_MOBILE is not set
+# CONFIG_I2C_SIMTEC is not set
+# CONFIG_I2C_SIS5595 is not set
+# CONFIG_I2C_SIS630 is not set
+# CONFIG_I2C_SIS96X is not set
+# CONFIG_I2C_SLAVE is not set
+# CONFIG_I2C_SLAVE_EEPROM is not set
+# CONFIG_I2C_SMBUS is not set
+# CONFIG_I2C_STUB is not set
+# CONFIG_I2C_TAOS_EVM is not set
+# CONFIG_I2C_THUNDERX is not set
+# CONFIG_I2C_TINY_USB is not set
+# CONFIG_I2C_VERSATILE is not set
+# CONFIG_I2C_VIA is not set
+# CONFIG_I2C_VIAPRO is not set
+# CONFIG_I2C_VIRTIO is not set
+# CONFIG_I2C_XILINX is not set
+# CONFIG_I3C is not set
+# CONFIG_I40E is not set
+# CONFIG_I40EVF is not set
+# CONFIG_I6300ESB_WDT is not set
+# CONFIG_I82092 is not set
+# CONFIG_I82365 is not set
+# CONFIG_IAQCORE is not set
+# CONFIG_IBM_ASM is not set
+# CONFIG_IBM_EMAC_DEBUG is not set
+# CONFIG_IBM_EMAC_EMAC4 is not set
+# CONFIG_IBM_EMAC_MAL_CLR_ICINTSTAT is not set
+# CONFIG_IBM_EMAC_MAL_COMMON_ERR is not set
+# CONFIG_IBM_EMAC_NO_FLOW_CTRL is not set
+# CONFIG_IBM_EMAC_RGMII is not set
+# CONFIG_IBM_EMAC_TAH is not set
+# CONFIG_IBM_EMAC_ZMII is not set
+# CONFIG_ICE is not set
+# CONFIG_ICP10100 is not set
+# CONFIG_ICPLUS_PHY is not set
+# CONFIG_ICS932S401 is not set
+# CONFIG_ICST is not set
+# CONFIG_IDE is not set
+# CONFIG_IDEAPAD_LAPTOP is not set
+# CONFIG_IDE_GD is not set
+# CONFIG_IDE_PROC_FS is not set
+# CONFIG_IDE_TASK_IOCTL is not set
+# CONFIG_IDLE_PAGE_TRACKING is not set
+# CONFIG_IEEE802154 is not set
+# CONFIG_IEEE802154_ADF7242 is not set
+# CONFIG_IEEE802154_ATUSB is not set
+# CONFIG_IEEE802154_CA8210 is not set
+# CONFIG_IEEE802154_HWSIM is not set
+# CONFIG_IEEE802154_MCR20A is not set
+# CONFIG_IFB is not set
+# CONFIG_IGB is not set
+# CONFIG_IGBVF is not set
+# CONFIG_IGC is not set
+# CONFIG_IIO is not set
+# CONFIG_IIO_BUFFER is not set
+# CONFIG_IIO_BUFFER_CB is not set
+# CONFIG_IIO_BUFFER_DMA is not set
+# CONFIG_IIO_BUFFER_DMAENGINE is not set
+# CONFIG_IIO_BUFFER_HDC2010 is not set
+# CONFIG_IIO_BUFFER_HW_CONSUMER is not set
+# CONFIG_IIO_CONFIGFS is not set
+CONFIG_IIO_CONSUMERS_PER_TRIGGER=2
+# CONFIG_IIO_CROS_EC_ACCEL_LEGACY is not set
+# CONFIG_IIO_INTERRUPT_TRIGGER is not set
+# CONFIG_IIO_MUX is not set
+# CONFIG_IIO_PERIODIC_RTC_TRIGGER is not set
+# CONFIG_IIO_RESCALE is not set
+# CONFIG_IIO_SIMPLE_DUMMY is not set
+# CONFIG_IIO_SSP_SENSORHUB is not set
+# CONFIG_IIO_ST_ACCEL_3AXIS is not set
+# CONFIG_IIO_ST_GYRO_3AXIS is not set
+# CONFIG_IIO_ST_LSM6DSX is not set
+# CONFIG_IIO_ST_LSM9DS0 is not set
+# CONFIG_IIO_ST_MAGN_3AXIS is not set
+# CONFIG_IIO_ST_PRESS is not set
+# CONFIG_IIO_SW_DEVICE is not set
+# CONFIG_IIO_SW_TRIGGER is not set
+# CONFIG_IIO_SYSFS_TRIGGER is not set
+# CONFIG_IIO_TRIGGER is not set
+# CONFIG_IIO_TRIGGERED_EVENT is not set
+# CONFIG_IKCONFIG is not set
+# CONFIG_IKCONFIG_PROC is not set
+# CONFIG_IKHEADERS is not set
+# CONFIG_IMA is not set
+# CONFIG_IMAGE_CMDLINE_HACK is not set
+# CONFIG_IMGPDC_WDT is not set
+# CONFIG_IMG_MDC_DMA is not set
+# CONFIG_IMX7D_ADC is not set
+# CONFIG_IMX_IPUV3_CORE is not set
+# CONFIG_IMX_THERMAL is not set
+# CONFIG_INA2XX_ADC is not set
+# CONFIG_INDIRECT_PIO is not set
+CONFIG_INET=y
+# CONFIG_INET6_AH is not set
+# CONFIG_INET6_ESP is not set
+# CONFIG_INET6_ESPINTCP is not set
+# CONFIG_INET6_IPCOMP is not set
+# CONFIG_INET6_TUNNEL is not set
+# CONFIG_INET6_XFRM_TUNNEL is not set
+# CONFIG_INET_AH is not set
+# CONFIG_INET_DIAG is not set
+# CONFIG_INET_ESP is not set
+# CONFIG_INET_ESPINTCP is not set
+# CONFIG_INET_IPCOMP is not set
+# CONFIG_INET_LRO is not set
+CONFIG_INET_TABLE_PERTURB_ORDER=16
+# CONFIG_INET_TCP_DIAG is not set
+# CONFIG_INET_TUNNEL is not set
+# CONFIG_INET_UDP_DIAG is not set
+# CONFIG_INET_XFRM_TUNNEL is not set
+# CONFIG_INFINIBAND is not set
+# CONFIG_INFTL is not set
+# CONFIG_INGENIC_ADC is not set
+# CONFIG_INGENIC_CGU_JZ4725B is not set
+# CONFIG_INGENIC_CGU_JZ4740 is not set
+# CONFIG_INGENIC_CGU_JZ4760 is not set
+# CONFIG_INGENIC_CGU_JZ4770 is not set
+# CONFIG_INGENIC_CGU_JZ4780 is not set
+# CONFIG_INGENIC_CGU_X1000 is not set
+# CONFIG_INGENIC_CGU_X1830 is not set
+# CONFIG_INGENIC_OST is not set
+# CONFIG_INGENIC_SYSOST is not set
+# CONFIG_INGENIC_TCU_CLK is not set
+# CONFIG_INGENIC_TCU_IRQ is not set
+# CONFIG_INGENIC_TIMER is not set
+# CONFIG_INITRAMFS_PRESERVE_MTIME is not set
+CONFIG_INIT_ENV_ARG_LIMIT=32
+# CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
+# CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
+# CONFIG_INIT_STACK_ALL_PATTERN is not set
+# CONFIG_INIT_STACK_ALL_ZERO is not set
+CONFIG_INIT_STACK_NONE=y
+CONFIG_INOTIFY_USER=y
+# CONFIG_INPUT is not set
+# CONFIG_INPUT_AD714X is not set
+# CONFIG_INPUT_ADXL34X is not set
+# CONFIG_INPUT_APANEL is not set
+# CONFIG_INPUT_ATI_REMOTE2 is not set
+# CONFIG_INPUT_ATLAS_BTNS is not set
+# CONFIG_INPUT_ATMEL_CAPTOUCH is not set
+# CONFIG_INPUT_AXP20X_PEK is not set
+# CONFIG_INPUT_BMA150 is not set
+# CONFIG_INPUT_CM109 is not set
+# CONFIG_INPUT_CMA3000 is not set
+# CONFIG_INPUT_DA7280_HAPTICS is not set
+# CONFIG_INPUT_DRV260X_HAPTICS is not set
+# CONFIG_INPUT_DRV2665_HAPTICS is not set
+# CONFIG_INPUT_DRV2667_HAPTICS is not set
+# CONFIG_INPUT_E3X0_BUTTON is not set
+# CONFIG_INPUT_EVBUG is not set
+# CONFIG_INPUT_EVDEV is not set
+# CONFIG_INPUT_FF_MEMLESS is not set
+# CONFIG_INPUT_GP2A is not set
+# CONFIG_INPUT_GPIO_BEEPER is not set
+# CONFIG_INPUT_GPIO_DECODER is not set
+# CONFIG_INPUT_GPIO_ROTARY_ENCODER is not set
+# CONFIG_INPUT_GPIO_TILT_POLLED is not set
+# CONFIG_INPUT_GPIO_VIBRA is not set
+# CONFIG_INPUT_IDEAPAD_SLIDEBAR is not set
+# CONFIG_INPUT_IMS_PCU is not set
+# CONFIG_INPUT_IQS269A is not set
+# CONFIG_INPUT_IQS626A is not set
+# CONFIG_INPUT_IQS7222 is not set
+# CONFIG_INPUT_JOYDEV is not set
+# CONFIG_INPUT_JOYSTICK is not set
+# CONFIG_INPUT_KEYBOARD is not set
+# CONFIG_INPUT_KEYSPAN_REMOTE is not set
+# CONFIG_INPUT_KXTJ9 is not set
+# CONFIG_INPUT_LEDS is not set
+# CONFIG_INPUT_MATRIXKMAP is not set
+# CONFIG_INPUT_MAX8997_HAPTIC is not set
+CONFIG_INPUT_MISC=y
+# CONFIG_INPUT_MMA8450 is not set
+# CONFIG_INPUT_MOUSE is not set
+# CONFIG_INPUT_MOUSEDEV is not set
+# CONFIG_INPUT_MPU3050 is not set
+# CONFIG_INPUT_MSM_VIBRATOR is not set
+# CONFIG_INPUT_PALMAS_PWRBUTTON is not set
+# CONFIG_INPUT_PCF8574 is not set
+# CONFIG_INPUT_PCSPKR is not set
+# CONFIG_INPUT_PM8941_PWRKEY is not set
+# CONFIG_INPUT_PM8XXX_VIBRATOR is not set
+# CONFIG_INPUT_POLLDEV is not set
+# CONFIG_INPUT_POWERMATE is not set
+# CONFIG_INPUT_PWM_BEEPER is not set
+# CONFIG_INPUT_PWM_VIBRA is not set
+# CONFIG_INPUT_REGULATOR_HAPTIC is not set
+# CONFIG_INPUT_SOC_BUTTON_ARRAY is not set
+# CONFIG_INPUT_SPARSEKMAP is not set
+# CONFIG_INPUT_TABLET is not set
+# CONFIG_INPUT_TOUCHSCREEN is not set
+# CONFIG_INPUT_TPS65218_PWRBUTTON is not set
+# CONFIG_INPUT_TWL4030_PWRBUTTON is not set
+# CONFIG_INPUT_TWL4030_VIBRA is not set
+# CONFIG_INPUT_TWL6040_VIBRA is not set
+# CONFIG_INPUT_UINPUT is not set
+# CONFIG_INPUT_WISTRON_BTNS is not set
+# CONFIG_INPUT_YEALINK is not set
+# CONFIG_INT340X_THERMAL is not set
+# CONFIG_INTEGRITY is not set
+# CONFIG_INTEGRITY_AUDIT is not set
+# CONFIG_INTEGRITY_SIGNATURE is not set
+# CONFIG_INTEL_ATOMISP2_LED is not set
+# CONFIG_INTEL_ATOMISP2_PM is not set
+# CONFIG_INTEL_CHT_INT33FE is not set
+# CONFIG_INTEL_HID_EVENT is not set
+# CONFIG_INTEL_IDLE is not set
+# CONFIG_INTEL_IDMA64 is not set
+# CONFIG_INTEL_INT0002_VGPIO is not set
+# CONFIG_INTEL_IOATDMA is not set
+# CONFIG_INTEL_ISH_HID is not set
+# CONFIG_INTEL_MEI is not set
+# CONFIG_INTEL_MEI_ME is not set
+# CONFIG_INTEL_MEI_TXE is not set
+# CONFIG_INTEL_MIC_CARD is not set
+# CONFIG_INTEL_MIC_HOST is not set
+# CONFIG_INTEL_MID_PTI is not set
+# CONFIG_INTEL_OAKTRAIL is not set
+# CONFIG_INTEL_PMC_CORE is not set
+# CONFIG_INTEL_PUNIT_IPC is not set
+# CONFIG_INTEL_RST is not set
+# CONFIG_INTEL_SMARTCONNECT is not set
+# CONFIG_INTEL_SOC_PMIC is not set
+# CONFIG_INTEL_SOC_PMIC_CHTDC_TI is not set
+# CONFIG_INTEL_SOC_PMIC_CHTWC is not set
+# CONFIG_INTEL_TH is not set
+# CONFIG_INTEL_VBTN is not set
+# CONFIG_INTEL_XWAY_PHY is not set
+# CONFIG_INTERCONNECT is not set
+# CONFIG_INTERVAL_TREE_TEST is not set
+# CONFIG_INV_ICM42600_I2C is not set
+# CONFIG_INV_ICM42600_SPI is not set
+# CONFIG_INV_MPU6050_I2C is not set
+# CONFIG_INV_MPU6050_IIO is not set
+# CONFIG_INV_MPU6050_SPI is not set
+# CONFIG_IOMMU_SUPPORT is not set
+# CONFIG_IONIC is not set
+# CONFIG_IOSCHED_BFQ is not set
+# CONFIG_IOSM is not set
+CONFIG_IO_STRICT_DEVMEM=y
+# CONFIG_IO_URING is not set
+CONFIG_IO_WQ=y
+# CONFIG_IP17XX_PHY is not set
+# CONFIG_IP5XXX_POWER is not set
+# CONFIG_IP6_NF_FILTER is not set
+# CONFIG_IP6_NF_IPTABLES is not set
+# CONFIG_IP6_NF_MANGLE is not set
+# CONFIG_IP6_NF_MATCH_AH is not set
+# CONFIG_IP6_NF_MATCH_EUI64 is not set
+# CONFIG_IP6_NF_MATCH_FRAG is not set
+# CONFIG_IP6_NF_MATCH_HL is not set
+# CONFIG_IP6_NF_MATCH_IPV6HEADER is not set
+# CONFIG_IP6_NF_MATCH_MH is not set
+# CONFIG_IP6_NF_MATCH_OPTS is not set
+# CONFIG_IP6_NF_MATCH_RPFILTER is not set
+# CONFIG_IP6_NF_MATCH_RT is not set
+# CONFIG_IP6_NF_MATCH_SRH is not set
+# CONFIG_IP6_NF_NAT is not set
+# CONFIG_IP6_NF_RAW is not set
+# CONFIG_IP6_NF_SECURITY is not set
+# CONFIG_IP6_NF_TARGET_HL is not set
+# CONFIG_IP6_NF_TARGET_MASQUERADE is not set
+# CONFIG_IP6_NF_TARGET_REJECT is not set
+# CONFIG_IP6_NF_TARGET_SYNPROXY is not set
+# CONFIG_IPACK_BUS is not set
+# CONFIG_IPC_NS is not set
+# CONFIG_IPMB_DEVICE_INTERFACE is not set
+# CONFIG_IPMI_HANDLER is not set
+# CONFIG_IPV6 is not set
+# CONFIG_IPV6_FOU is not set
+# CONFIG_IPV6_FOU_TUNNEL is not set
+# CONFIG_IPV6_ILA is not set
+# CONFIG_IPV6_IOAM6_LWTUNNEL is not set
+# CONFIG_IPV6_MIP6 is not set
+# CONFIG_IPV6_MROUTE is not set
+# CONFIG_IPV6_MROUTE_MULTIPLE_TABLES is not set
+# CONFIG_IPV6_MULTIPLE_TABLES is not set
+CONFIG_IPV6_NDISC_NODETYPE=y
+# CONFIG_IPV6_OPTIMISTIC_DAD is not set
+# CONFIG_IPV6_ROUTER_PREF is not set
+# CONFIG_IPV6_ROUTE_INFO is not set
+# CONFIG_IPV6_RPL_LWTUNNEL is not set
+# CONFIG_IPV6_SEG6_HMAC is not set
+# CONFIG_IPV6_SEG6_LWTUNNEL is not set
+# CONFIG_IPV6_SIT is not set
+# CONFIG_IPV6_SIT_6RD is not set
+# CONFIG_IPV6_TUNNEL is not set
+# CONFIG_IPV6_VTI is not set
+# CONFIG_IPVLAN is not set
+# CONFIG_IPVTAP is not set
+# CONFIG_IPW2100 is not set
+# CONFIG_IPW2100_DEBUG is not set
+CONFIG_IPW2100_MONITOR=y
+# CONFIG_IPW2200 is not set
+# CONFIG_IPW2200_DEBUG is not set
+CONFIG_IPW2200_MONITOR=y
+# CONFIG_IPW2200_PROMISCUOUS is not set
+# CONFIG_IPW2200_QOS is not set
+# CONFIG_IPW2200_RADIOTAP is not set
+# CONFIG_IPWIRELESS is not set
+# CONFIG_IPX is not set
+CONFIG_IP_ADVANCED_ROUTER=y
+# CONFIG_IP_DCCP is not set
+# CONFIG_IP_FIB_TRIE_STATS is not set
+# CONFIG_IP_MROUTE is not set
+CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_MULTIPLE_TABLES=y
+# CONFIG_IP_NF_ARPFILTER is not set
+# CONFIG_IP_NF_ARPTABLES is not set
+# CONFIG_IP_NF_ARP_MANGLE is not set
+# CONFIG_IP_NF_FILTER is not set
+# CONFIG_IP_NF_IPTABLES is not set
+# CONFIG_IP_NF_MANGLE is not set
+# CONFIG_IP_NF_MATCH_AH is not set
+# CONFIG_IP_NF_MATCH_ECN is not set
+# CONFIG_IP_NF_MATCH_RPFILTER is not set
+# CONFIG_IP_NF_MATCH_TTL is not set
+# CONFIG_IP_NF_RAW is not set
+# CONFIG_IP_NF_SECURITY is not set
+# CONFIG_IP_NF_TARGET_CLUSTERIP is not set
+# CONFIG_IP_NF_TARGET_ECN is not set
+# CONFIG_IP_NF_TARGET_MASQUERADE is not set
+# CONFIG_IP_NF_TARGET_NETMAP is not set
+# CONFIG_IP_NF_TARGET_REDIRECT is not set
+# CONFIG_IP_NF_TARGET_REJECT is not set
+# CONFIG_IP_NF_TARGET_SYNPROXY is not set
+# CONFIG_IP_NF_TARGET_TTL is not set
+# CONFIG_IP_PIMSM_V1 is not set
+# CONFIG_IP_PIMSM_V2 is not set
+# CONFIG_IP_PNP is not set
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_IP_ROUTE_VERBOSE=y
+# CONFIG_IP_SCTP is not set
+# CONFIG_IP_SET is not set
+# CONFIG_IP_SET_HASH_IPMAC is not set
+# CONFIG_IP_VS is not set
+# CONFIG_IP_VS_MH is not set
+CONFIG_IP_VS_MH_TAB_INDEX=10
+# CONFIG_IP_VS_TWOS is not set
+# CONFIG_IRDA is not set
+# CONFIG_IRQSOFF_TRACER is not set
+# CONFIG_IRQ_ALL_CPUS is not set
+# CONFIG_IRQ_DOMAIN_DEBUG is not set
+# CONFIG_IRQ_POLL is not set
+# CONFIG_IRQ_TIME_ACCOUNTING is not set
+# CONFIG_IR_GPIO_CIR is not set
+# CONFIG_IR_HIX5HD2 is not set
+# CONFIG_IR_IGORPLUGUSB is not set
+# CONFIG_IR_IGUANA is not set
+# CONFIG_IR_IMG is not set
+# CONFIG_IR_IMON is not set
+# CONFIG_IR_IMON_RAW is not set
+# CONFIG_IR_JVC_DECODER is not set
+# CONFIG_IR_LIRC_CODEC is not set
+# CONFIG_IR_MCEUSB is not set
+# CONFIG_IR_NEC_DECODER is not set
+# CONFIG_IR_RC5_DECODER is not set
+# CONFIG_IR_RC6_DECODER is not set
+# CONFIG_IR_REDRAT3 is not set
+# CONFIG_IR_SERIAL is not set
+# CONFIG_IR_SIR is not set
+# CONFIG_IR_SONY_DECODER is not set
+# CONFIG_IR_STREAMZAP is not set
+# CONFIG_IR_TOY is not set
+# CONFIG_IR_TTUSBIR is not set
+# CONFIG_ISA_BUS is not set
+# CONFIG_ISA_BUS_API is not set
+# CONFIG_ISCSI_BOOT_SYSFS is not set
+# CONFIG_ISCSI_TCP is not set
+CONFIG_ISDN=y
+# CONFIG_ISDN_AUDIO is not set
+# CONFIG_ISDN_CAPI is not set
+# CONFIG_ISDN_CAPI_CAPIDRV is not set
+# CONFIG_ISDN_DIVERSION is not set
+# CONFIG_ISDN_DRV_ACT2000 is not set
+# CONFIG_ISDN_DRV_GIGASET is not set
+# CONFIG_ISDN_DRV_HISAX is not set
+# CONFIG_ISDN_DRV_ICN is not set
+# CONFIG_ISDN_DRV_LOOP is not set
+# CONFIG_ISDN_DRV_PCBIT is not set
+# CONFIG_ISDN_DRV_SC is not set
+# CONFIG_ISDN_I4L is not set
+# CONFIG_ISL29003 is not set
+# CONFIG_ISL29020 is not set
+# CONFIG_ISL29125 is not set
+# CONFIG_ISL29501 is not set
+# CONFIG_ISO9660_FS is not set
+# CONFIG_ISS4xx is not set
+# CONFIG_ITG3200 is not set
+# CONFIG_IWL3945 is not set
+# CONFIG_IWLWIFI is not set
+# CONFIG_IXGB is not set
+# CONFIG_IXGBE is not set
+# CONFIG_IXGBEVF is not set
+# CONFIG_JAILHOUSE_GUEST is not set
+# CONFIG_JBD2_DEBUG is not set
+# CONFIG_JFFS2_CMODE_FAVOURLZO is not set
+# CONFIG_JFFS2_CMODE_NONE is not set
+CONFIG_JFFS2_CMODE_PRIORITY=y
+# CONFIG_JFFS2_CMODE_SIZE is not set
+CONFIG_JFFS2_COMPRESSION_OPTIONS=y
+CONFIG_JFFS2_FS=y
+CONFIG_JFFS2_FS_DEBUG=0
+# CONFIG_JFFS2_FS_POSIX_ACL is not set
+# CONFIG_JFFS2_FS_SECURITY is not set
+# CONFIG_JFFS2_FS_WBUF_VERIFY is not set
+CONFIG_JFFS2_FS_WRITEBUFFER=y
+CONFIG_JFFS2_FS_XATTR=y
+CONFIG_JFFS2_LZMA=y
+# CONFIG_JFFS2_LZO is not set
+CONFIG_JFFS2_RTIME=y
+# CONFIG_JFFS2_RUBIN is not set
+CONFIG_JFFS2_SUMMARY=y
+# CONFIG_JFFS2_ZLIB is not set
+# CONFIG_JFS_DEBUG is not set
+# CONFIG_JFS_FS is not set
+# CONFIG_JFS_POSIX_ACL is not set
+# CONFIG_JFS_SECURITY is not set
+# CONFIG_JFS_STATISTICS is not set
+# CONFIG_JME is not set
+CONFIG_JOLIET=y
+# CONFIG_JSA1212 is not set
+# CONFIG_JUMP_LABEL is not set
+# CONFIG_JZ4740_WDT is not set
+# CONFIG_JZ4770_PHY is not set
+# CONFIG_KALLSYMS is not set
+# CONFIG_KALLSYMS_ABSOLUTE_PERCPU is not set
+# CONFIG_KALLSYMS_ALL is not set
+CONFIG_KALLSYMS_BASE_RELATIVE=y
+# CONFIG_KALLSYMS_UNCOMPRESSED is not set
+# CONFIG_KARMA_PARTITION is not set
+# CONFIG_KASAN is not set
+# CONFIG_KASAN_MODULE_TEST is not set
+CONFIG_KASAN_STACK=y
+# CONFIG_KCMP is not set
+# CONFIG_KCOV is not set
+CONFIG_KCOV_IRQ_AREA_SIZE=0x40000
+# CONFIG_KCSAN is not set
+# CONFIG_KERNEL_BZIP2 is not set
+# CONFIG_KERNEL_CAT is not set
+# CONFIG_KERNEL_GZIP is not set
+# CONFIG_KERNEL_LZ4 is not set
+# CONFIG_KERNEL_LZMA is not set
+# CONFIG_KERNEL_LZO is not set
+CONFIG_KERNEL_MODE_NEON=y
+CONFIG_KERNEL_XZ=y
+# CONFIG_KERNEL_ZSTD is not set
+CONFIG_KERNFS=y
+# CONFIG_KEXEC is not set
+# CONFIG_KEXEC_FILE is not set
+# CONFIG_KEXEC_SIG is not set
+# CONFIG_KEYBOARD_ADC is not set
+# CONFIG_KEYBOARD_ADP5588 is not set
+# CONFIG_KEYBOARD_ADP5589 is not set
+# CONFIG_KEYBOARD_APPLESPI is not set
+# CONFIG_KEYBOARD_ATKBD is not set
+# CONFIG_KEYBOARD_BCM is not set
+# CONFIG_KEYBOARD_CAP11XX is not set
+# CONFIG_KEYBOARD_CYPRESS_SF is not set
+# CONFIG_KEYBOARD_DLINK_DIR685 is not set
+# CONFIG_KEYBOARD_GPIO is not set
+# CONFIG_KEYBOARD_GPIO_POLLED is not set
+# CONFIG_KEYBOARD_LKKBD is not set
+# CONFIG_KEYBOARD_LM8323 is not set
+# CONFIG_KEYBOARD_LM8333 is not set
+# CONFIG_KEYBOARD_MATRIX is not set
+# CONFIG_KEYBOARD_MAX7359 is not set
+# CONFIG_KEYBOARD_MCS is not set
+# CONFIG_KEYBOARD_MPR121 is not set
+# CONFIG_KEYBOARD_NEWTON is not set
+# CONFIG_KEYBOARD_OMAP4 is not set
+# CONFIG_KEYBOARD_OPENCORES is not set
+# CONFIG_KEYBOARD_PINEPHONE is not set
+# CONFIG_KEYBOARD_PXA27x is not set
+# CONFIG_KEYBOARD_QT1050 is not set
+# CONFIG_KEYBOARD_QT1070 is not set
+# CONFIG_KEYBOARD_QT2160 is not set
+# CONFIG_KEYBOARD_SAMSUNG is not set
+# CONFIG_KEYBOARD_SH_KEYSC is not set
+# CONFIG_KEYBOARD_SNVS_PWRKEY is not set
+# CONFIG_KEYBOARD_STMPE is not set
+# CONFIG_KEYBOARD_STOWAWAY is not set
+# CONFIG_KEYBOARD_SUNKBD is not set
+# CONFIG_KEYBOARD_TCA6416 is not set
+# CONFIG_KEYBOARD_TCA8418 is not set
+# CONFIG_KEYBOARD_TEGRA is not set
+# CONFIG_KEYBOARD_TM2_TOUCHKEY is not set
+# CONFIG_KEYBOARD_TWL4030 is not set
+# CONFIG_KEYBOARD_XTKBD is not set
+# CONFIG_KEYS is not set
+# CONFIG_KEYS_REQUEST_CACHE is not set
+# CONFIG_KEY_DH_OPERATIONS is not set
+# CONFIG_KFENCE is not set
+# CONFIG_KGDB is not set
+# CONFIG_KMEMCHECK is not set
+# CONFIG_KMX61 is not set
+# CONFIG_KPC2000 is not set
+# CONFIG_KPROBES is not set
+# CONFIG_KPROBES_SANITY_TEST is not set
+# CONFIG_KPROBE_EVENTS_ON_NOTRACE is not set
+# CONFIG_KPROBE_EVENT_GEN_TEST is not set
+# CONFIG_KS7010 is not set
+# CONFIG_KS8842 is not set
+# CONFIG_KS8851 is not set
+# CONFIG_KS8851_MLL is not set
+# CONFIG_KSM is not set
+# CONFIG_KSZ884X_PCI is not set
+# CONFIG_KUNIT is not set
+CONFIG_KUSER_HELPERS=y
+# CONFIG_KVM_AMD is not set
+# CONFIG_KVM_AMD_SEV is not set
+# CONFIG_KVM_GUEST is not set
+# CONFIG_KVM_INTEL is not set
+# CONFIG_KVM_WERROR is not set
+# CONFIG_KVM_XEN is not set
+# CONFIG_KXCJK1013 is not set
+# CONFIG_KXSD9 is not set
+# CONFIG_L2TP is not set
+# CONFIG_L2TP_ETH is not set
+# CONFIG_L2TP_IP is not set
+# CONFIG_L2TP_V3 is not set
+# CONFIG_LAN743X is not set
+# CONFIG_LAN966X_SWITCH is not set
+# CONFIG_LANMEDIA is not set
+# CONFIG_LANTIQ is not set
+# CONFIG_LAPB is not set
+# CONFIG_LASAT is not set
+# CONFIG_LATENCYTOP is not set
+# CONFIG_LATTICE_ECP3_CONFIG is not set
+CONFIG_LBDAF=y
+# CONFIG_LCD_AMS369FG06 is not set
+# CONFIG_LCD_CLASS_DEVICE is not set
+# CONFIG_LCD_HX8357 is not set
+# CONFIG_LCD_ILI922X is not set
+# CONFIG_LCD_ILI9320 is not set
+# CONFIG_LCD_L4F00242T03 is not set
+# CONFIG_LCD_LD9040 is not set
+# CONFIG_LCD_LMS283GF05 is not set
+# CONFIG_LCD_LMS501KF03 is not set
+# CONFIG_LCD_LTV350QV is not set
+# CONFIG_LCD_OTM3225A is not set
+# CONFIG_LCD_S6E63M0 is not set
+# CONFIG_LCD_TDO24M is not set
+# CONFIG_LCD_VGG2432A4 is not set
+CONFIG_LDISC_AUTOLOAD=y
+# CONFIG_LDM_PARTITION is not set
+CONFIG_LD_DEAD_CODE_DATA_ELIMINATION=y
+# CONFIG_LD_HEAD_STUB_CATCH is not set
+# CONFIG_LEDS_AN30259A is not set
+# CONFIG_LEDS_APU is not set
+# CONFIG_LEDS_AW2013 is not set
+# CONFIG_LEDS_BCM6328 is not set
+# CONFIG_LEDS_BCM6358 is not set
+# CONFIG_LEDS_BD2802 is not set
+# CONFIG_LEDS_BLINKM is not set
+CONFIG_LEDS_BRIGHTNESS_HW_CHANGED=y
+CONFIG_LEDS_CLASS=y
+# CONFIG_LEDS_CLASS_FLASH is not set
+CONFIG_LEDS_CLASS_MULTICOLOR=y
+# CONFIG_LEDS_CR0014114 is not set
+# CONFIG_LEDS_DAC124S085 is not set
+# CONFIG_LEDS_EL15203000 is not set
+# CONFIG_LEDS_GPIO is not set
+# CONFIG_LEDS_INTEL_SS4200 is not set
+# CONFIG_LEDS_IS31FL319X is not set
+# CONFIG_LEDS_IS31FL32XX is not set
+# CONFIG_LEDS_LM3530 is not set
+# CONFIG_LEDS_LM3532 is not set
+# CONFIG_LEDS_LM355x is not set
+# CONFIG_LEDS_LM3642 is not set
+# CONFIG_LEDS_LM3692X is not set
+# CONFIG_LEDS_LP3944 is not set
+# CONFIG_LEDS_LP3952 is not set
+# CONFIG_LEDS_LP50XX is not set
+# CONFIG_LEDS_LP5521 is not set
+# CONFIG_LEDS_LP5523 is not set
+# CONFIG_LEDS_LP5562 is not set
+# CONFIG_LEDS_LP55XX_COMMON is not set
+# CONFIG_LEDS_LP8501 is not set
+# CONFIG_LEDS_LP8860 is not set
+# CONFIG_LEDS_LT3593 is not set
+# CONFIG_LEDS_MLXCPLD is not set
+# CONFIG_LEDS_MLXREG is not set
+# CONFIG_LEDS_NIC78BX is not set
+# CONFIG_LEDS_NS2 is not set
+# CONFIG_LEDS_OT200 is not set
+# CONFIG_LEDS_PCA9532 is not set
+# CONFIG_LEDS_PCA955X is not set
+# CONFIG_LEDS_PCA963X is not set
+# CONFIG_LEDS_PWM is not set
+# CONFIG_LEDS_PWM_MULTICOLOR is not set
+# CONFIG_LEDS_REGULATOR is not set
+# CONFIG_LEDS_SPI_BYTE is not set
+# CONFIG_LEDS_SYSCON is not set
+# CONFIG_LEDS_TCA6507 is not set
+# CONFIG_LEDS_TI_LMU_COMMON is not set
+# CONFIG_LEDS_TLC591XX is not set
+CONFIG_LEDS_TRIGGERS=y
+# CONFIG_LEDS_TRIGGER_ACTIVITY is not set
+# CONFIG_LEDS_TRIGGER_AUDIO is not set
+# CONFIG_LEDS_TRIGGER_BACKLIGHT is not set
+# CONFIG_LEDS_TRIGGER_CAMERA is not set
+# CONFIG_LEDS_TRIGGER_CPU is not set
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+# CONFIG_LEDS_TRIGGER_DISK is not set
+# CONFIG_LEDS_TRIGGER_GPIO is not set
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+# CONFIG_LEDS_TRIGGER_MTD is not set
+CONFIG_LEDS_TRIGGER_NETDEV=y
+# CONFIG_LEDS_TRIGGER_ONESHOT is not set
+# CONFIG_LEDS_TRIGGER_PANIC is not set
+# CONFIG_LEDS_TRIGGER_PATTERN is not set
+CONFIG_LEDS_TRIGGER_TIMER=y
+# CONFIG_LEDS_TRIGGER_TRANSIENT is not set
+# CONFIG_LEDS_TRIGGER_TTY is not set
+# CONFIG_LEDS_TURRIS_OMNIA is not set
+# CONFIG_LEDS_USER is not set
+# CONFIG_LED_TRIGGER_PHY is not set
+# CONFIG_LEGACY_PTYS is not set
+# CONFIG_LGUEST is not set
+# CONFIG_LIB80211 is not set
+# CONFIG_LIB80211_CRYPT_CCMP is not set
+# CONFIG_LIB80211_CRYPT_TKIP is not set
+# CONFIG_LIB80211_CRYPT_WEP is not set
+# CONFIG_LIB80211_DEBUG is not set
+# CONFIG_LIBCRC32C is not set
+# CONFIG_LIBERTAS is not set
+# CONFIG_LIBERTAS_THINFIRM is not set
+# CONFIG_LIBERTAS_USB is not set
+# CONFIG_LIBFC is not set
+# CONFIG_LIBFCOE is not set
+# CONFIG_LIBIPW_DEBUG is not set
+# CONFIG_LIBNVDIMM is not set
+CONFIG_LIB_MEMNEQ=y
+# CONFIG_LIDAR_LITE_V2 is not set
+CONFIG_LINEAR_RANGES=y
+# CONFIG_LIQUIDIO is not set
+# CONFIG_LIQUIDIO_VF is not set
+# CONFIG_LIRC is not set
+# CONFIG_LIS3L02DQ is not set
+# CONFIG_LITEX_LITEETH is not set
+# CONFIG_LITEX_SOC_CONTROLLER is not set
+# CONFIG_LIVEPATCH is not set
+# CONFIG_LKDTM is not set
+CONFIG_LLC=y
+# CONFIG_LLC2 is not set
+# CONFIG_LMK04832 is not set
+# CONFIG_LMP91000 is not set
+# CONFIG_LNET is not set
+CONFIG_LOCALVERSION=""
+# CONFIG_LOCALVERSION_AUTO is not set
+# CONFIG_LOCKD is not set
+CONFIG_LOCKDEP_BITS=15
+CONFIG_LOCKDEP_CHAINS_BITS=16
+CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=12
+CONFIG_LOCKDEP_STACK_TRACE_BITS=19
+CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
+CONFIG_LOCKDEP_SUPPORT=y
+CONFIG_LOCKD_V4=y
+# CONFIG_LOCKUP_DETECTOR is not set
+# CONFIG_LOCK_EVENT_COUNTS is not set
+# CONFIG_LOCK_STAT is not set
+# CONFIG_LOCK_TORTURE_TEST is not set
+# CONFIG_LOGFS is not set
+# CONFIG_LOGIG940_FF is not set
+# CONFIG_LOGIRUMBLEPAD2_FF is not set
+# CONFIG_LOGITECH_FF is not set
+# CONFIG_LOGIWHEELS_FF is not set
+# CONFIG_LOGO is not set
+CONFIG_LOG_BUF_SHIFT=17
+CONFIG_LOG_CPU_MAX_BUF_SHIFT=12
+# CONFIG_LOONGSON_MC146818 is not set
+# CONFIG_LPC_ICH is not set
+# CONFIG_LPC_SCH is not set
+# CONFIG_LP_CONSOLE is not set
+CONFIG_LRU_GEN=y
+CONFIG_LRU_GEN_ENABLED=y
+# CONFIG_LRU_GEN_STATS is not set
+# CONFIG_LSI_ET1011C_PHY is not set
+CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity"
+CONFIG_LSM_MMAP_MIN_ADDR=65536
+# CONFIG_LTC1660 is not set
+# CONFIG_LTC2471 is not set
+# CONFIG_LTC2485 is not set
+# CONFIG_LTC2496 is not set
+# CONFIG_LTC2497 is not set
+# CONFIG_LTC2632 is not set
+# CONFIG_LTC2688 is not set
+# CONFIG_LTC2983 is not set
+# CONFIG_LTE_GDM724X is not set
+CONFIG_LTO_NONE=y
+# CONFIG_LTPC is not set
+# CONFIG_LTR501 is not set
+# CONFIG_LTRF216A is not set
+# CONFIG_LUSTRE_FS is not set
+# CONFIG_LV0104CS is not set
+# CONFIG_LWTUNNEL is not set
+# CONFIG_LXT_PHY is not set
+# CONFIG_LZ4HC_COMPRESS is not set
+# CONFIG_LZ4_COMPRESS is not set
+# CONFIG_LZ4_DECOMPRESS is not set
+CONFIG_LZMA_COMPRESS=y
+CONFIG_LZMA_DECOMPRESS=y
+# CONFIG_LZO_COMPRESS is not set
+# CONFIG_LZO_DECOMPRESS is not set
+# CONFIG_M62332 is not set
+# CONFIG_MAC80211 is not set
+# CONFIG_MAC80211_MESSAGE_TRACING is not set
+CONFIG_MAC80211_STA_HASH_MAX_SIZE=0
+# CONFIG_MACB is not set
+# CONFIG_MACH_ASM9260 is not set
+# CONFIG_MACH_DECSTATION is not set
+# CONFIG_MACH_INGENIC is not set
+# CONFIG_MACH_INGENIC_SOC is not set
+# CONFIG_MACH_JAZZ is not set
+# CONFIG_MACH_JZ4740 is not set
+# CONFIG_MACH_LOONGSON2EF is not set
+# CONFIG_MACH_LOONGSON32 is not set
+# CONFIG_MACH_LOONGSON64 is not set
+# CONFIG_MACH_NINTENDO64 is not set
+# CONFIG_MACH_PIC32 is not set
+# CONFIG_MACH_PISTACHIO is not set
+# CONFIG_MACH_REALTEK_RTL is not set
+# CONFIG_MACH_TX39XX is not set
+# CONFIG_MACH_TX49XX is not set
+# CONFIG_MACH_VR41XX is not set
+# CONFIG_MACH_XILFPGA is not set
+# CONFIG_MACINTOSH_DRIVERS is not set
+# CONFIG_MACSEC is not set
+# CONFIG_MACVLAN is not set
+# CONFIG_MACVTAP is not set
+# CONFIG_MAC_EMUMOUSEBTN is not set
+# CONFIG_MAC_PARTITION is not set
+# CONFIG_MAG3110 is not set
+# CONFIG_MAGIC_SYSRQ is not set
+CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x1
+# CONFIG_MAGIC_SYSRQ_SERIAL is not set
+CONFIG_MAGIC_SYSRQ_SERIAL_SEQUENCE=""
+# CONFIG_MAILBOX is not set
+# CONFIG_MANAGER_SBS is not set
+# CONFIG_MANDATORY_FILE_LOCKING is not set
+# CONFIG_MANGLE_BOOTARGS is not set
+# CONFIG_MARVELL_10G_PHY is not set
+# CONFIG_MARVELL_88X2222_PHY is not set
+# CONFIG_MARVELL_PHY is not set
+# CONFIG_MAX1027 is not set
+# CONFIG_MAX11100 is not set
+# CONFIG_MAX1118 is not set
+# CONFIG_MAX11205 is not set
+# CONFIG_MAX1241 is not set
+# CONFIG_MAX1363 is not set
+# CONFIG_MAX30100 is not set
+# CONFIG_MAX30102 is not set
+# CONFIG_MAX31856 is not set
+# CONFIG_MAX31865 is not set
+# CONFIG_MAX44000 is not set
+# CONFIG_MAX44009 is not set
+# CONFIG_MAX517 is not set
+# CONFIG_MAX5432 is not set
+# CONFIG_MAX5481 is not set
+# CONFIG_MAX5487 is not set
+# CONFIG_MAX5821 is not set
+# CONFIG_MAX63XX_WATCHDOG is not set
+# CONFIG_MAX9611 is not set
+# CONFIG_MAXIM_THERMOCOUPLE is not set
+# CONFIG_MAXLINEAR_GPHY is not set
+CONFIG_MAY_USE_DEVLINK=y
+# CONFIG_MB1232 is not set
+# CONFIG_MC3230 is not set
+# CONFIG_MCB is not set
+# CONFIG_MCP320X is not set
+# CONFIG_MCP3422 is not set
+# CONFIG_MCP3911 is not set
+# CONFIG_MCP4018 is not set
+# CONFIG_MCP41010 is not set
+# CONFIG_MCP4131 is not set
+# CONFIG_MCP4531 is not set
+# CONFIG_MCP4725 is not set
+# CONFIG_MCP4922 is not set
+# CONFIG_MCPM is not set
+# CONFIG_MCTP is not set
+# CONFIG_MD is not set
+# CONFIG_MDIO_BCM_UNIMAC is not set
+# CONFIG_MDIO_BITBANG is not set
+# CONFIG_MDIO_BUS_MUX_GPIO is not set
+# CONFIG_MDIO_BUS_MUX_MMIOREG is not set
+# CONFIG_MDIO_BUS_MUX_MULTIPLEXER is not set
+# CONFIG_MDIO_DEVICE is not set
+# CONFIG_MDIO_DEVRES is not set
+# CONFIG_MDIO_HISI_FEMAC is not set
+# CONFIG_MDIO_IPQ4019 is not set
+# CONFIG_MDIO_IPQ8064 is not set
+# CONFIG_MDIO_MSCC_MIIM is not set
+# CONFIG_MDIO_MVUSB is not set
+# CONFIG_MDIO_OCTEON is not set
+# CONFIG_MDIO_THUNDER is not set
+# CONFIG_MDIO_XPCS is not set
+# CONFIG_MDM_GCC_9607 is not set
+# CONFIG_MD_FAULTY is not set
+# CONFIG_MEDIATEK_GE_PHY is not set
+# CONFIG_MEDIATEK_MT6577_AUXADC is not set
+# CONFIG_MEDIA_ANALOG_TV_SUPPORT is not set
+# CONFIG_MEDIA_ATTACH is not set
+# CONFIG_MEDIA_CAMERA_SUPPORT is not set
+# CONFIG_MEDIA_CEC_SUPPORT is not set
+# CONFIG_MEDIA_CONTROLLER is not set
+# CONFIG_MEDIA_CONTROLLER_DVB is not set
+# CONFIG_MEDIA_DIGITAL_TV_SUPPORT is not set
+# CONFIG_MEDIA_PCI_SUPPORT is not set
+# CONFIG_MEDIA_PLATFORM_DRIVERS is not set
+# CONFIG_MEDIA_PLATFORM_SUPPORT is not set
+# CONFIG_MEDIA_RADIO_SUPPORT is not set
+# CONFIG_MEDIA_RC_SUPPORT is not set
+# CONFIG_MEDIA_SDR_SUPPORT is not set
+# CONFIG_MEDIA_SUBDRV_AUTOSELECT is not set
+# CONFIG_MEDIA_SUPPORT is not set
+# CONFIG_MEDIA_SUPPORT_FILTER is not set
+# CONFIG_MEDIA_TEST_SUPPORT is not set
+# CONFIG_MEDIA_TUNER_E4000 is not set
+# CONFIG_MEDIA_TUNER_FC0011 is not set
+# CONFIG_MEDIA_TUNER_FC0012 is not set
+# CONFIG_MEDIA_TUNER_FC0013 is not set
+# CONFIG_MEDIA_TUNER_FC2580 is not set
+# CONFIG_MEDIA_TUNER_IT913X is not set
+# CONFIG_MEDIA_TUNER_M88RS6000T is not set
+# CONFIG_MEDIA_TUNER_MAX2165 is not set
+# CONFIG_MEDIA_TUNER_MC44S803 is not set
+# CONFIG_MEDIA_TUNER_MSI001 is not set
+# CONFIG_MEDIA_TUNER_MT2060 is not set
+# CONFIG_MEDIA_TUNER_MT2063 is not set
+# CONFIG_MEDIA_TUNER_MT20XX is not set
+# CONFIG_MEDIA_TUNER_MT2131 is not set
+# CONFIG_MEDIA_TUNER_MT2266 is not set
+# CONFIG_MEDIA_TUNER_MXL301RF is not set
+# CONFIG_MEDIA_TUNER_MXL5005S is not set
+# CONFIG_MEDIA_TUNER_MXL5007T is not set
+# CONFIG_MEDIA_TUNER_QM1D1B0004 is not set
+# CONFIG_MEDIA_TUNER_QM1D1C0042 is not set
+# CONFIG_MEDIA_TUNER_QT1010 is not set
+# CONFIG_MEDIA_TUNER_R820T is not set
+# CONFIG_MEDIA_TUNER_SI2157 is not set
+# CONFIG_MEDIA_TUNER_SIMPLE is not set
+# CONFIG_MEDIA_TUNER_TDA18212 is not set
+# CONFIG_MEDIA_TUNER_TDA18218 is not set
+# CONFIG_MEDIA_TUNER_TDA18250 is not set
+# CONFIG_MEDIA_TUNER_TDA18271 is not set
+# CONFIG_MEDIA_TUNER_TDA827X is not set
+# CONFIG_MEDIA_TUNER_TDA8290 is not set
+# CONFIG_MEDIA_TUNER_TDA9887 is not set
+# CONFIG_MEDIA_TUNER_TEA5761 is not set
+# CONFIG_MEDIA_TUNER_TEA5767 is not set
+# CONFIG_MEDIA_TUNER_TUA9001 is not set
+# CONFIG_MEDIA_TUNER_XC2028 is not set
+# CONFIG_MEDIA_TUNER_XC4000 is not set
+# CONFIG_MEDIA_TUNER_XC5000 is not set
+# CONFIG_MEDIA_USB_SUPPORT is not set
+# CONFIG_MEGARAID_LEGACY is not set
+# CONFIG_MEGARAID_NEWGEN is not set
+# CONFIG_MEGARAID_SAS is not set
+# CONFIG_MELLANOX_PLATFORM is not set
+CONFIG_MEMBARRIER=y
+# CONFIG_MEMORY is not set
+# CONFIG_MEMORY_FAILURE is not set
+# CONFIG_MEMORY_HOTPLUG is not set
+# CONFIG_MEMSTICK is not set
+# CONFIG_MEMTEST is not set
+# CONFIG_MEN_A21_WDT is not set
+# CONFIG_MESON_SM is not set
+CONFIG_MESSAGE_LOGLEVEL_DEFAULT=4
+# CONFIG_MFD_88PM800 is not set
+# CONFIG_MFD_88PM805 is not set
+# CONFIG_MFD_88PM860X is not set
+# CONFIG_MFD_AAT2870_CORE is not set
+# CONFIG_MFD_AC100 is not set
+# CONFIG_MFD_ACT8945A is not set
+# CONFIG_MFD_ARIZONA_I2C is not set
+# CONFIG_MFD_ARIZONA_SPI is not set
+# CONFIG_MFD_AS3711 is not set
+# CONFIG_MFD_AS3722 is not set
+# CONFIG_MFD_ASIC3 is not set
+# CONFIG_MFD_ATC260X_I2C is not set
+# CONFIG_MFD_ATMEL_FLEXCOM is not set
+# CONFIG_MFD_ATMEL_HLCDC is not set
+# CONFIG_MFD_AXP20X is not set
+# CONFIG_MFD_AXP20X_I2C is not set
+# CONFIG_MFD_BCM590XX is not set
+# CONFIG_MFD_BD9571MWV is not set
+# CONFIG_MFD_CORE is not set
+# CONFIG_MFD_CPCAP is not set
+# CONFIG_MFD_CROS_EC is not set
+# CONFIG_MFD_CS5535 is not set
+# CONFIG_MFD_DA9052_I2C is not set
+# CONFIG_MFD_DA9052_SPI is not set
+# CONFIG_MFD_DA9055 is not set
+# CONFIG_MFD_DA9062 is not set
+# CONFIG_MFD_DA9063 is not set
+# CONFIG_MFD_DA9150 is not set
+# CONFIG_MFD_DLN2 is not set
+# CONFIG_MFD_EXYNOS_LPASS is not set
+# CONFIG_MFD_GATEWORKS_GSC is not set
+# CONFIG_MFD_HI6421_PMIC is not set
+# CONFIG_MFD_INTEL_M10_BMC is not set
+# CONFIG_MFD_INTEL_PMT is not set
+# CONFIG_MFD_INTEL_QUARK_I2C_GPIO is not set
+# CONFIG_MFD_IQS62X is not set
+# CONFIG_MFD_JANZ_CMODIO is not set
+# CONFIG_MFD_KEMPLD is not set
+# CONFIG_MFD_LM3533 is not set
+# CONFIG_MFD_LOCHNAGAR is not set
+# CONFIG_MFD_LP3943 is not set
+# CONFIG_MFD_LP8788 is not set
+# CONFIG_MFD_MADERA is not set
+# CONFIG_MFD_MAX14577 is not set
+# CONFIG_MFD_MAX77620 is not set
+# CONFIG_MFD_MAX77650 is not set
+# CONFIG_MFD_MAX77686 is not set
+# CONFIG_MFD_MAX77693 is not set
+# CONFIG_MFD_MAX77714 is not set
+# CONFIG_MFD_MAX77843 is not set
+# CONFIG_MFD_MAX8907 is not set
+# CONFIG_MFD_MAX8925 is not set
+# CONFIG_MFD_MAX8997 is not set
+# CONFIG_MFD_MAX8998 is not set
+# CONFIG_MFD_MC13XXX is not set
+# CONFIG_MFD_MC13XXX_I2C is not set
+# CONFIG_MFD_MC13XXX_SPI is not set
+# CONFIG_MFD_MENF21BMC is not set
+# CONFIG_MFD_MP2629 is not set
+# CONFIG_MFD_MT6360 is not set
+# CONFIG_MFD_MT6370 is not set
+# CONFIG_MFD_MT6397 is not set
+# CONFIG_MFD_NTXEC is not set
+# CONFIG_MFD_OCELOT is not set
+# CONFIG_MFD_OMAP_USB_HOST is not set
+# CONFIG_MFD_PALMAS is not set
+# CONFIG_MFD_PCF50633 is not set
+# CONFIG_MFD_PM8921_CORE is not set
+# CONFIG_MFD_PM8XXX is not set
+# CONFIG_MFD_QCOM_PM8008 is not set
+# CONFIG_MFD_RC5T583 is not set
+# CONFIG_MFD_RDC321X is not set
+# CONFIG_MFD_RETU is not set
+# CONFIG_MFD_RK808 is not set
+# CONFIG_MFD_RN5T618 is not set
+# CONFIG_MFD_ROHM_BD70528 is not set
+# CONFIG_MFD_ROHM_BD71828 is not set
+# CONFIG_MFD_ROHM_BD718XX is not set
+# CONFIG_MFD_ROHM_BD957XMUF is not set
+# CONFIG_MFD_RSMU_I2C is not set
+# CONFIG_MFD_RSMU_SPI is not set
+# CONFIG_MFD_RT4831 is not set
+# CONFIG_MFD_RT5033 is not set
+# CONFIG_MFD_RT5120 is not set
+# CONFIG_MFD_RTSX_PCI is not set
+# CONFIG_MFD_RTSX_USB is not set
+# CONFIG_MFD_SEC_CORE is not set
+# CONFIG_MFD_SI476X_CORE is not set
+# CONFIG_MFD_SKY81452 is not set
+# CONFIG_MFD_SL28CPLD is not set
+# CONFIG_MFD_SM501 is not set
+# CONFIG_MFD_SMSC is not set
+# CONFIG_MFD_STMFX is not set
+# CONFIG_MFD_STMPE is not set
+# CONFIG_MFD_STPMIC1 is not set
+# CONFIG_MFD_SY7636A is not set
+# CONFIG_MFD_SYSCON is not set
+# CONFIG_MFD_T7L66XB is not set
+# CONFIG_MFD_TC3589X is not set
+# CONFIG_MFD_TC6387XB is not set
+# CONFIG_MFD_TC6393XB is not set
+# CONFIG_MFD_TIMBERDALE is not set
+# CONFIG_MFD_TI_AM335X_TSCADC is not set
+# CONFIG_MFD_TI_LMU is not set
+# CONFIG_MFD_TI_LP873X is not set
+# CONFIG_MFD_TI_LP87565 is not set
+# CONFIG_MFD_TMIO is not set
+# CONFIG_MFD_TPS65086 is not set
+# CONFIG_MFD_TPS65090 is not set
+# CONFIG_MFD_TPS65217 is not set
+# CONFIG_MFD_TPS65218 is not set
+# CONFIG_MFD_TPS6586X is not set
+# CONFIG_MFD_TPS65910 is not set
+# CONFIG_MFD_TPS65912 is not set
+# CONFIG_MFD_TPS65912_I2C is not set
+# CONFIG_MFD_TPS65912_SPI is not set
+# CONFIG_MFD_TPS68470 is not set
+# CONFIG_MFD_TPS80031 is not set
+# CONFIG_MFD_TQMX86 is not set
+# CONFIG_MFD_VIPERBOARD is not set
+# CONFIG_MFD_VX855 is not set
+# CONFIG_MFD_WL1273_CORE is not set
+# CONFIG_MFD_WM831X is not set
+# CONFIG_MFD_WM831X_I2C is not set
+# CONFIG_MFD_WM831X_SPI is not set
+# CONFIG_MFD_WM8350_I2C is not set
+# CONFIG_MFD_WM8400 is not set
+# CONFIG_MFD_WM8994 is not set
+# CONFIG_MG_DISK is not set
+# CONFIG_MHI_BUS is not set
+# CONFIG_MHI_BUS_DEBUG is not set
+# CONFIG_MHI_BUS_EP is not set
+# CONFIG_MHI_BUS_PCI_GENERIC is not set
+# CONFIG_MHI_NET is not set
+# CONFIG_MHI_WWAN_CTRL is not set
+# CONFIG_MHI_WWAN_MBIM is not set
+# CONFIG_MICREL_KS8995MA is not set
+# CONFIG_MICREL_PHY is not set
+# CONFIG_MICROCHIP_KSZ is not set
+# CONFIG_MICROCHIP_PHY is not set
+# CONFIG_MICROCHIP_PIT64B is not set
+# CONFIG_MICROCHIP_T1_PHY is not set
+# CONFIG_MICROSEMI_PHY is not set
+# CONFIG_MIGRATION is not set
+CONFIG_MII=y
+# CONFIG_MIKROTIK is not set
+# CONFIG_MIKROTIK_RB532 is not set
+# CONFIG_MINIX_FS is not set
+# CONFIG_MINIX_FS_NATIVE_ENDIAN is not set
+# CONFIG_MINIX_SUBPARTITION is not set
+# CONFIG_MIPS32_N32 is not set
+# CONFIG_MIPS32_O32 is not set
+# CONFIG_MIPS_ALCHEMY is not set
+# CONFIG_MIPS_CDMM is not set
+# CONFIG_MIPS_CMDLINE_DTB_EXTEND is not set
+# CONFIG_MIPS_CMDLINE_FROM_DTB is not set
+# CONFIG_MIPS_CMP is not set
+# CONFIG_MIPS_COBALT is not set
+# CONFIG_MIPS_CPS is not set
+# CONFIG_MIPS_ELF_APPENDED_DTB is not set
+# CONFIG_MIPS_FPU_EMULATOR is not set
+# CONFIG_MIPS_FP_SUPPORT is not set
+# CONFIG_MIPS_GENERIC is not set
+# CONFIG_MIPS_GENERIC_KERNEL is not set
+# CONFIG_MIPS_MALTA is not set
+# CONFIG_MIPS_O32_FP64_SUPPORT is not set
+# CONFIG_MIPS_PARAVIRT is not set
+# CONFIG_MIPS_PLATFORM_DEVICES is not set
+# CONFIG_MIPS_RAW_APPENDED_DTB is not set
+# CONFIG_MIPS_SEAD3 is not set
+# CONFIG_MIPS_VA_BITS_48 is not set
+# CONFIG_MIPS_VPE_LOADER is not set
+# CONFIG_MISC_ALCOR_PCI is not set
+CONFIG_MISC_FILESYSTEMS=y
+# CONFIG_MISC_RTSX_PCI is not set
+# CONFIG_MISC_RTSX_USB is not set
+# CONFIG_MISDN is not set
+# CONFIG_MISDN_AVMFRITZ is not set
+# CONFIG_MISDN_HFCPCI is not set
+# CONFIG_MISDN_HFCUSB is not set
+# CONFIG_MISDN_INFINEON is not set
+# CONFIG_MISDN_NETJET is not set
+# CONFIG_MISDN_SPEEDFAX is not set
+# CONFIG_MISDN_W6692 is not set
+CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY=y
+# CONFIG_MKISS is not set
+# CONFIG_MLX4_CORE is not set
+# CONFIG_MLX4_EN is not set
+# CONFIG_MLX5_CORE is not set
+# CONFIG_MLX5_EN_MACSEC is not set
+# CONFIG_MLX5_SF is not set
+# CONFIG_MLX90614 is not set
+# CONFIG_MLX90632 is not set
+# CONFIG_MLXFW is not set
+# CONFIG_MLXSW_CORE is not set
+# CONFIG_MLX_CPLD_PLATFORM is not set
+# CONFIG_MLX_PLATFORM is not set
+# CONFIG_MMA7455_I2C is not set
+# CONFIG_MMA7455_SPI is not set
+# CONFIG_MMA7660 is not set
+# CONFIG_MMA8452 is not set
+# CONFIG_MMA9551 is not set
+# CONFIG_MMA9553 is not set
+# CONFIG_MMC is not set
+# CONFIG_MMC35240 is not set
+# CONFIG_MMC_ARMMMCI is not set
+# CONFIG_MMC_AU1X is not set
+# CONFIG_MMC_BLOCK is not set
+CONFIG_MMC_BLOCK_BOUNCE=y
+CONFIG_MMC_BLOCK_MINORS=8
+# CONFIG_MMC_CAVIUM_THUNDERX is not set
+# CONFIG_MMC_CB710 is not set
+# CONFIG_MMC_CQHCI is not set
+# CONFIG_MMC_DEBUG is not set
+# CONFIG_MMC_DW is not set
+# CONFIG_MMC_HSQ is not set
+# CONFIG_MMC_JZ4740 is not set
+# CONFIG_MMC_MTK is not set
+# CONFIG_MMC_MVSDIO is not set
+# CONFIG_MMC_S3C is not set
+# CONFIG_MMC_SDHCI is not set
+# CONFIG_MMC_SDHCI_ACPI is not set
+# CONFIG_MMC_SDHCI_AM654 is not set
+# CONFIG_MMC_SDHCI_BCM_KONA is not set
+# CONFIG_MMC_SDHCI_BRCMSTB is not set
+# CONFIG_MMC_SDHCI_CADENCE is not set
+# CONFIG_MMC_SDHCI_F_SDH30 is not set
+# CONFIG_MMC_SDHCI_IPROC is not set
+# CONFIG_MMC_SDHCI_MILBEAUT is not set
+# CONFIG_MMC_SDHCI_MSM is not set
+# CONFIG_MMC_SDHCI_OF_ARASAN is not set
+# CONFIG_MMC_SDHCI_OF_ASPEED is not set
+# CONFIG_MMC_SDHCI_OF_AT91 is not set
+# CONFIG_MMC_SDHCI_OF_DWCMSHC is not set
+# CONFIG_MMC_SDHCI_OF_ESDHC is not set
+# CONFIG_MMC_SDHCI_OF_HLWD is not set
+# CONFIG_MMC_SDHCI_OMAP is not set
+# CONFIG_MMC_SDHCI_PXAV2 is not set
+# CONFIG_MMC_SDHCI_PXAV3 is not set
+# CONFIG_MMC_SDHCI_S3C is not set
+# CONFIG_MMC_SDHCI_XENON is not set
+# CONFIG_MMC_SDRICOH_CS is not set
+# CONFIG_MMC_SPI is not set
+# CONFIG_MMC_STM32_SDMMC is not set
+# CONFIG_MMC_TEST is not set
+# CONFIG_MMC_TIFM_SD is not set
+# CONFIG_MMC_TOSHIBA_PCI is not set
+# CONFIG_MMC_USDHI6ROL0 is not set
+# CONFIG_MMC_USHC is not set
+# CONFIG_MMC_VIA_SDMMC is not set
+# CONFIG_MMC_VUB300 is not set
+# CONFIG_MMIOTRACE is not set
+CONFIG_MMU=y
+CONFIG_MMU_GATHER_RCU_TABLE_FREE=y
+CONFIG_MMU_GATHER_TABLE_FREE=y
+CONFIG_MODPROBE_PATH="/sbin/modprobe"
+CONFIG_MODULES=y
+# CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS is not set
+# CONFIG_MODULE_COMPRESS is not set
+# CONFIG_MODULE_COMPRESS_GZIP is not set
+CONFIG_MODULE_COMPRESS_NONE=y
+# CONFIG_MODULE_COMPRESS_XZ is not set
+# CONFIG_MODULE_COMPRESS_ZSTD is not set
+# CONFIG_MODULE_FORCE_LOAD is not set
+# CONFIG_MODULE_FORCE_UNLOAD is not set
+# CONFIG_MODULE_SIG is not set
+# CONFIG_MODULE_SRCVERSION_ALL is not set
+CONFIG_MODULE_STRIPPED=y
+CONFIG_MODULE_UNLOAD=y
+# CONFIG_MODULE_UNLOAD_TAINT_TRACKING is not set
+# CONFIG_MODVERSIONS is not set
+# CONFIG_MOST is not set
+# CONFIG_MOTORCOMM_PHY is not set
+# CONFIG_MOUSE_APPLETOUCH is not set
+# CONFIG_MOUSE_ELAN_I2C is not set
+# CONFIG_MOUSE_GPIO is not set
+# CONFIG_MOUSE_INPORT is not set
+# CONFIG_MOUSE_LOGIBM is not set
+# CONFIG_MOUSE_PC110PAD is not set
+# CONFIG_MOUSE_PS2_FOCALTECH is not set
+# CONFIG_MOUSE_PS2_SENTELIC is not set
+# CONFIG_MOUSE_SYNAPTICS_I2C is not set
+# CONFIG_MOUSE_SYNAPTICS_USB is not set
+# CONFIG_MOXTET is not set
+# CONFIG_MPL115 is not set
+# CONFIG_MPL115_I2C is not set
+# CONFIG_MPL115_SPI is not set
+# CONFIG_MPL3115 is not set
+# CONFIG_MPLS is not set
+# CONFIG_MPLS_IPTUNNEL is not set
+# CONFIG_MPLS_ROUTING is not set
+# CONFIG_MPTCP is not set
+# CONFIG_MPU3050_I2C is not set
+# CONFIG_MQ_IOSCHED_DEADLINE is not set
+# CONFIG_MQ_IOSCHED_KYBER is not set
+# CONFIG_MS5611 is not set
+# CONFIG_MS5637 is not set
+# CONFIG_MSA311 is not set
+# CONFIG_MSCC_OCELOT_SWITCH is not set
+# CONFIG_MSDOS_FS is not set
+CONFIG_MSDOS_PARTITION=y
+# CONFIG_MSE102X is not set
+# CONFIG_MSI_BITMAP_SELFTEST is not set
+# CONFIG_MSI_LAPTOP is not set
+# CONFIG_MSM_GCC_8953 is not set
+# CONFIG_MSM_MMCC_8994 is not set
+# CONFIG_MST_IRQ is not set
+CONFIG_MTD=y
+# CONFIG_MTD_ABSENT is not set
+# CONFIG_MTD_AFS_PARTS is not set
+# CONFIG_MTD_AR7_PARTS is not set
+CONFIG_MTD_BLKDEVS=y
+CONFIG_MTD_BLOCK=y
+# CONFIG_MTD_BLOCK2MTD is not set
+CONFIG_MTD_CFI=y
+# CONFIG_MTD_CFI_ADV_OPTIONS is not set
+CONFIG_MTD_CFI_AMDSTD=y
+# CONFIG_MTD_CFI_BE_BYTE_SWAP is not set
+CONFIG_MTD_CFI_I1=y
+CONFIG_MTD_CFI_I2=y
+# CONFIG_MTD_CFI_I4 is not set
+# CONFIG_MTD_CFI_I8 is not set
+CONFIG_MTD_CFI_INTELEXT=y
+# CONFIG_MTD_CFI_LE_BYTE_SWAP is not set
+CONFIG_MTD_CFI_NOSWAP=y
+# CONFIG_MTD_CFI_STAA is not set
+CONFIG_MTD_CFI_UTIL=y
+# CONFIG_MTD_CMDLINE_PARTS is not set
+CONFIG_MTD_COMPLEX_MAPPINGS=y
+# CONFIG_MTD_DATAFLASH is not set
+# CONFIG_MTD_DOCG3 is not set
+CONFIG_MTD_GEN_PROBE=y
+# CONFIG_MTD_GPIO_ADDR is not set
+# CONFIG_MTD_HYPERBUS is not set
+# CONFIG_MTD_IMPA7 is not set
+# CONFIG_MTD_INTEL_VR_NOR is not set
+# CONFIG_MTD_JEDECPROBE is not set
+# CONFIG_MTD_LATCH_ADDR is not set
+# CONFIG_MTD_LPDDR is not set
+# CONFIG_MTD_LPDDR2_NVM is not set
+# CONFIG_MTD_M25P80 is not set
+CONFIG_MTD_MAP_BANK_WIDTH_1=y
+# CONFIG_MTD_MAP_BANK_WIDTH_16 is not set
+CONFIG_MTD_MAP_BANK_WIDTH_2=y
+# CONFIG_MTD_MAP_BANK_WIDTH_32 is not set
+CONFIG_MTD_MAP_BANK_WIDTH_4=y
+# CONFIG_MTD_MAP_BANK_WIDTH_8 is not set
+# CONFIG_MTD_MCHP23K256 is not set
+# CONFIG_MTD_MCHP48L640 is not set
+# CONFIG_MTD_MT81xx_NOR is not set
+# CONFIG_MTD_MTDRAM is not set
+# CONFIG_MTD_MYLOADER_PARTS is not set
+# CONFIG_MTD_NAND is not set
+# CONFIG_MTD_NAND_AMS_DELTA is not set
+# CONFIG_MTD_NAND_AR934X is not set
+# CONFIG_MTD_NAND_AR934X_HW_ECC is not set
+# CONFIG_MTD_NAND_ARASAN is not set
+# CONFIG_MTD_NAND_ATMEL is not set
+# CONFIG_MTD_NAND_AU1550 is not set
+# CONFIG_MTD_NAND_BCH is not set
+# CONFIG_MTD_NAND_BF5XX is not set
+# CONFIG_MTD_NAND_BRCMNAND is not set
+# CONFIG_MTD_NAND_BRCMNAND_BCM63XX is not set
+# CONFIG_MTD_NAND_BRCMNAND_BCMBCA is not set
+# CONFIG_MTD_NAND_BRCMNAND_BRCMSTB is not set
+# CONFIG_MTD_NAND_BRCMNAND_IPROC is not set
+# CONFIG_MTD_NAND_CADENCE is not set
+# CONFIG_MTD_NAND_CAFE is not set
+# CONFIG_MTD_NAND_CM_X270 is not set
+# CONFIG_MTD_NAND_CS553X is not set
+# CONFIG_MTD_NAND_DAVINCI is not set
+# CONFIG_MTD_NAND_DENALI is not set
+# CONFIG_MTD_NAND_DENALI_DT is not set
+# CONFIG_MTD_NAND_DENALI_PCI is not set
+CONFIG_MTD_NAND_DENALI_SCRATCH_REG_ADDR=0xff108018
+# CONFIG_MTD_NAND_DISKONCHIP is not set
+# CONFIG_MTD_NAND_DOCG4 is not set
+# CONFIG_MTD_NAND_ECC is not set
+# CONFIG_MTD_NAND_ECC_BCH is not set
+# CONFIG_MTD_NAND_ECC_MXIC is not set
+# CONFIG_MTD_NAND_ECC_SMC is not set
+# CONFIG_MTD_NAND_ECC_SW_BCH is not set
+# CONFIG_MTD_NAND_ECC_SW_HAMMING is not set
+# CONFIG_MTD_NAND_ECC_SW_HAMMING_SMC is not set
+# CONFIG_MTD_NAND_FSL_ELBC is not set
+# CONFIG_MTD_NAND_FSL_IFC is not set
+# CONFIG_MTD_NAND_FSL_UPM is not set
+# CONFIG_MTD_NAND_FSMC is not set
+# CONFIG_MTD_NAND_GPIO is not set
+# CONFIG_MTD_NAND_GPMI_NAND is not set
+# CONFIG_MTD_NAND_HISI504 is not set
+CONFIG_MTD_NAND_IDS=y
+# CONFIG_MTD_NAND_INTEL_LGM is not set
+# CONFIG_MTD_NAND_JZ4740 is not set
+# CONFIG_MTD_NAND_MPC5121_NFC is not set
+# CONFIG_MTD_NAND_MTK is not set
+# CONFIG_MTD_NAND_MTK_BMT is not set
+# CONFIG_MTD_NAND_MXC is not set
+# CONFIG_MTD_NAND_MXIC is not set
+# CONFIG_MTD_NAND_NANDSIM is not set
+# CONFIG_MTD_NAND_NDFC is not set
+# CONFIG_MTD_NAND_NUC900 is not set
+# CONFIG_MTD_NAND_OMAP2 is not set
+# CONFIG_MTD_NAND_OMAP_BCH_BUILD is not set
+# CONFIG_MTD_NAND_ORION is not set
+# CONFIG_MTD_NAND_PASEMI is not set
+# CONFIG_MTD_NAND_PLATFORM is not set
+# CONFIG_MTD_NAND_PXA3xx is not set
+# CONFIG_MTD_NAND_RB4XX is not set
+# CONFIG_MTD_NAND_RB750 is not set
+# CONFIG_MTD_NAND_RB91X is not set
+# CONFIG_MTD_NAND_RICOH is not set
+# CONFIG_MTD_NAND_S3C2410 is not set
+# CONFIG_MTD_NAND_SHARPSL is not set
+# CONFIG_MTD_NAND_SH_FLCTL is not set
+# CONFIG_MTD_NAND_SOCRATES is not set
+# CONFIG_MTD_NAND_TMIO is not set
+# CONFIG_MTD_NAND_TXX9NDFMC is not set
+CONFIG_MTD_OF_PARTS=y
+# CONFIG_MTD_ONENAND is not set
+# CONFIG_MTD_OOPS is not set
+# CONFIG_MTD_OTP is not set
+# CONFIG_MTD_PARSER_TRX is not set
+# CONFIG_MTD_PARTITIONED_MASTER is not set
+# CONFIG_MTD_PCI is not set
+# CONFIG_MTD_PCMCIA is not set
+# CONFIG_MTD_PHRAM is not set
+# CONFIG_MTD_PHYSMAP is not set
+# CONFIG_MTD_PHYSMAP_COMPAT is not set
+# CONFIG_MTD_PHYSMAP_GEMINI is not set
+# CONFIG_MTD_PHYSMAP_GPIO_ADDR is not set
+# CONFIG_MTD_PHYSMAP_IXP4XX is not set
+CONFIG_MTD_PHYSMAP_OF=y
+# CONFIG_MTD_PHYSMAP_OF_GEMINI is not set
+# CONFIG_MTD_PHYSMAP_OF_VERSATILE is not set
+# CONFIG_MTD_PHYSMAP_VERSATILE is not set
+# CONFIG_MTD_PLATRAM is not set
+# CONFIG_MTD_PMC551 is not set
+# CONFIG_MTD_RAM is not set
+# CONFIG_MTD_RAW_NAND is not set
+CONFIG_MTD_REDBOOT_DIRECTORY_BLOCK=-1
+# CONFIG_MTD_REDBOOT_PARTS is not set
+# CONFIG_MTD_REDBOOT_PARTS_READONLY is not set
+# CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED is not set
+# CONFIG_MTD_ROM is not set
+CONFIG_MTD_ROOTFS_ROOT_DEV=y
+# CONFIG_MTD_ROUTERBOOT_PARTS is not set
+# CONFIG_MTD_SERCOMM_PARTS is not set
+# CONFIG_MTD_SLRAM is not set
+# CONFIG_MTD_SM_COMMON is not set
+# CONFIG_MTD_SPINAND_MT29F is not set
+# CONFIG_MTD_SPI_NAND is not set
+# CONFIG_MTD_SPI_NOR is not set
+# CONFIG_MTD_SPI_NOR_SWP_DISABLE is not set
+CONFIG_MTD_SPI_NOR_SWP_DISABLE_ON_VOLATILE=y
+# CONFIG_MTD_SPI_NOR_SWP_KEEP is not set
+# CONFIG_MTD_SPI_NOR_USE_4K_SECTORS is not set
+# CONFIG_MTD_SPI_NOR_USE_VARIABLE_ERASE is not set
+CONFIG_MTD_SPLIT=y
+# CONFIG_MTD_SPLIT_BCM63XX_FW is not set
+# CONFIG_MTD_SPLIT_BCM_WFI_FW is not set
+# CONFIG_MTD_SPLIT_BRNIMAGE_FW is not set
+# CONFIG_MTD_SPLIT_ELF_FW is not set
+# CONFIG_MTD_SPLIT_EVA_FW is not set
+# CONFIG_MTD_SPLIT_FIRMWARE is not set
+CONFIG_MTD_SPLIT_FIRMWARE_NAME="firmware"
+# CONFIG_MTD_SPLIT_FIT_FW is not set
+# CONFIG_MTD_SPLIT_H3C_VFS is not set
+# CONFIG_MTD_SPLIT_JIMAGE_FW is not set
+# CONFIG_MTD_SPLIT_LZMA_FW is not set
+# CONFIG_MTD_SPLIT_MINOR_FW is not set
+# CONFIG_MTD_SPLIT_SEAMA_FW is not set
+CONFIG_MTD_SPLIT_SQUASHFS_ROOT=y
+CONFIG_MTD_SPLIT_SUPPORT=y
+# CONFIG_MTD_SPLIT_TPLINK_FW is not set
+# CONFIG_MTD_SPLIT_TRX_FW is not set
+# CONFIG_MTD_SPLIT_UIMAGE_FW is not set
+# CONFIG_MTD_SPLIT_WRGG_FW is not set
+# CONFIG_MTD_SST25L is not set
+# CONFIG_MTD_SWAP is not set
+# CONFIG_MTD_TESTS is not set
+# CONFIG_MTD_UBI is not set
+# CONFIG_MTD_UBI_FASTMAP is not set
+# CONFIG_MTD_UBI_GLUEBI is not set
+# CONFIG_MTD_UIMAGE_SPLIT is not set
+# CONFIG_MTD_VIRT_CONCAT is not set
+# CONFIG_MTK_DEVAPC is not set
+# CONFIG_MTK_MMC is not set
+# CONFIG_MTK_MMSYS is not set
+# CONFIG_MTK_T7XX is not set
+# CONFIG_MTK_THERMAL is not set
+# CONFIG_MULTIPLEXER is not set
+CONFIG_MULTIUSER=y
+# CONFIG_MUTEX_SPIN_ON_OWNER is not set
+# CONFIG_MUX_ADG792A is not set
+# CONFIG_MUX_ADGS1408 is not set
+# CONFIG_MUX_GPIO is not set
+# CONFIG_MUX_MMIO is not set
+# CONFIG_MV643XX_ETH is not set
+# CONFIG_MVMDIO is not set
+# CONFIG_MVNETA_BM is not set
+# CONFIG_MVSW61XX_PHY is not set
+# CONFIG_MV_XOR_V2 is not set
+# CONFIG_MWAVE is not set
+# CONFIG_MWL8K is not set
+# CONFIG_MXC4005 is not set
+# CONFIG_MXC6255 is not set
+# CONFIG_MYRI10GE is not set
+# CONFIG_NAMESPACES is not set
+# CONFIG_NATIONAL_PHY is not set
+# CONFIG_NATSEMI is not set
+# CONFIG_NAU7802 is not set
+# CONFIG_NBPFAXI_DMA is not set
+# CONFIG_NCP_FS is not set
+# CONFIG_NE2000 is not set
+# CONFIG_NE2K_PCI is not set
+# CONFIG_NEC_MARKEINS is not set
+CONFIG_NET=y
+# CONFIG_NETCONSOLE is not set
+CONFIG_NETDEVICES=y
+# CONFIG_NETDEVSIM is not set
+# CONFIG_NETFILTER is not set
+# CONFIG_NETFILTER_ADVANCED is not set
+# CONFIG_NETFILTER_DEBUG is not set
+# CONFIG_NETFILTER_EGRESS is not set
+# CONFIG_NETFILTER_INGRESS is not set
+# CONFIG_NETFILTER_NETLINK is not set
+# CONFIG_NETFILTER_NETLINK_ACCT is not set
+# CONFIG_NETFILTER_NETLINK_GLUE_CT is not set
+# CONFIG_NETFILTER_NETLINK_HOOK is not set
+# CONFIG_NETFILTER_NETLINK_LOG is not set
+# CONFIG_NETFILTER_NETLINK_OSF is not set
+# CONFIG_NETFILTER_NETLINK_QUEUE is not set
+# CONFIG_NETFILTER_XTABLES is not set
+# CONFIG_NETFILTER_XTABLES_COMPAT is not set
+# CONFIG_NETFILTER_XT_CONNMARK is not set
+# CONFIG_NETFILTER_XT_MARK is not set
+# CONFIG_NETFILTER_XT_MATCH_ADDRTYPE is not set
+# CONFIG_NETFILTER_XT_MATCH_BPF is not set
+# CONFIG_NETFILTER_XT_MATCH_CGROUP is not set
+# CONFIG_NETFILTER_XT_MATCH_CLUSTER is not set
+# CONFIG_NETFILTER_XT_MATCH_COMMENT is not set
+# CONFIG_NETFILTER_XT_MATCH_CONNBYTES is not set
+# CONFIG_NETFILTER_XT_MATCH_CONNLABEL is not set
+# CONFIG_NETFILTER_XT_MATCH_CONNLIMIT is not set
+# CONFIG_NETFILTER_XT_MATCH_CONNMARK is not set
+# CONFIG_NETFILTER_XT_MATCH_CONNTRACK is not set
+# CONFIG_NETFILTER_XT_MATCH_CPU is not set
+# CONFIG_NETFILTER_XT_MATCH_DCCP is not set
+# CONFIG_NETFILTER_XT_MATCH_DEVGROUP is not set
+# CONFIG_NETFILTER_XT_MATCH_DSCP is not set
+# CONFIG_NETFILTER_XT_MATCH_ECN is not set
+# CONFIG_NETFILTER_XT_MATCH_ESP is not set
+# CONFIG_NETFILTER_XT_MATCH_HASHLIMIT is not set
+# CONFIG_NETFILTER_XT_MATCH_HELPER is not set
+# CONFIG_NETFILTER_XT_MATCH_HL is not set
+# CONFIG_NETFILTER_XT_MATCH_IPCOMP is not set
+# CONFIG_NETFILTER_XT_MATCH_IPRANGE is not set
+# CONFIG_NETFILTER_XT_MATCH_L2TP is not set
+# CONFIG_NETFILTER_XT_MATCH_LENGTH is not set
+# CONFIG_NETFILTER_XT_MATCH_LIMIT is not set
+# CONFIG_NETFILTER_XT_MATCH_MAC is not set
+# CONFIG_NETFILTER_XT_MATCH_MARK is not set
+# CONFIG_NETFILTER_XT_MATCH_MULTIPORT is not set
+# CONFIG_NETFILTER_XT_MATCH_NFACCT is not set
+# CONFIG_NETFILTER_XT_MATCH_OSF is not set
+# CONFIG_NETFILTER_XT_MATCH_OWNER is not set
+# CONFIG_NETFILTER_XT_MATCH_PHYSDEV is not set
+# CONFIG_NETFILTER_XT_MATCH_PKTTYPE is not set
+# CONFIG_NETFILTER_XT_MATCH_POLICY is not set
+# CONFIG_NETFILTER_XT_MATCH_QUOTA is not set
+# CONFIG_NETFILTER_XT_MATCH_RATEEST is not set
+# CONFIG_NETFILTER_XT_MATCH_REALM is not set
+# CONFIG_NETFILTER_XT_MATCH_RECENT is not set
+# CONFIG_NETFILTER_XT_MATCH_SCTP is not set
+# CONFIG_NETFILTER_XT_MATCH_SOCKET is not set
+# CONFIG_NETFILTER_XT_MATCH_STATE is not set
+# CONFIG_NETFILTER_XT_MATCH_STATISTIC is not set
+# CONFIG_NETFILTER_XT_MATCH_STRING is not set
+# CONFIG_NETFILTER_XT_MATCH_TCPMSS is not set
+# CONFIG_NETFILTER_XT_MATCH_TIME is not set
+# CONFIG_NETFILTER_XT_MATCH_U32 is not set
+# CONFIG_NETFILTER_XT_TARGET_AUDIT is not set
+# CONFIG_NETFILTER_XT_TARGET_CHECKSUM is not set
+# CONFIG_NETFILTER_XT_TARGET_CLASSIFY is not set
+# CONFIG_NETFILTER_XT_TARGET_CONNMARK is not set
+# CONFIG_NETFILTER_XT_TARGET_CT is not set
+# CONFIG_NETFILTER_XT_TARGET_DSCP is not set
+# CONFIG_NETFILTER_XT_TARGET_HL is not set
+# CONFIG_NETFILTER_XT_TARGET_HMARK is not set
+# CONFIG_NETFILTER_XT_TARGET_IDLETIMER is not set
+# CONFIG_NETFILTER_XT_TARGET_LED is not set
+# CONFIG_NETFILTER_XT_TARGET_LOG is not set
+# CONFIG_NETFILTER_XT_TARGET_MARK is not set
+# CONFIG_NETFILTER_XT_TARGET_NETMAP is not set
+# CONFIG_NETFILTER_XT_TARGET_NFLOG is not set
+# CONFIG_NETFILTER_XT_TARGET_NFQUEUE is not set
+# CONFIG_NETFILTER_XT_TARGET_NOTRACK is not set
+# CONFIG_NETFILTER_XT_TARGET_RATEEST is not set
+# CONFIG_NETFILTER_XT_TARGET_REDIRECT is not set
+# CONFIG_NETFILTER_XT_TARGET_SECMARK is not set
+# CONFIG_NETFILTER_XT_TARGET_TCPMSS is not set
+# CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set
+# CONFIG_NETFILTER_XT_TARGET_TEE is not set
+# CONFIG_NETFILTER_XT_TARGET_TPROXY is not set
+# CONFIG_NETFILTER_XT_TARGET_TRACE is not set
+# CONFIG_NETFS_STATS is not set
+# CONFIG_NETLABEL is not set
+# CONFIG_NETLINK_DIAG is not set
+# CONFIG_NETLINK_MMAP is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NETROM is not set
+CONFIG_NETWORK_FILESYSTEMS=y
+# CONFIG_NETWORK_PHY_TIMESTAMPING is not set
+# CONFIG_NETWORK_SECMARK is not set
+# CONFIG_NETXEN_NIC is not set
+# CONFIG_NET_9P is not set
+# CONFIG_NET_ACT_BPF is not set
+# CONFIG_NET_ACT_CSUM is not set
+# CONFIG_NET_ACT_CT is not set
+# CONFIG_NET_ACT_GACT is not set
+# CONFIG_NET_ACT_GATE is not set
+# CONFIG_NET_ACT_IFE is not set
+# CONFIG_NET_ACT_IPT is not set
+# CONFIG_NET_ACT_MIRRED is not set
+# CONFIG_NET_ACT_MPLS is not set
+# CONFIG_NET_ACT_NAT is not set
+# CONFIG_NET_ACT_PEDIT is not set
+# CONFIG_NET_ACT_POLICE is not set
+# CONFIG_NET_ACT_SAMPLE is not set
+# CONFIG_NET_ACT_SIMP is not set
+# CONFIG_NET_ACT_SKBEDIT is not set
+# CONFIG_NET_ACT_SKBMOD is not set
+# CONFIG_NET_ACT_TUNNEL_KEY is not set
+# CONFIG_NET_ACT_VLAN is not set
+CONFIG_NET_CADENCE=y
+# CONFIG_NET_CALXEDA_XGMAC is not set
+CONFIG_NET_CLS=y
+# CONFIG_NET_CLS_ACT is not set
+# CONFIG_NET_CLS_BASIC is not set
+# CONFIG_NET_CLS_BPF is not set
+# CONFIG_NET_CLS_FLOW is not set
+# CONFIG_NET_CLS_FLOWER is not set
+# CONFIG_NET_CLS_FW is not set
+CONFIG_NET_CLS_IND=y
+# CONFIG_NET_CLS_MATCHALL is not set
+# CONFIG_NET_CLS_ROUTE4 is not set
+# CONFIG_NET_CLS_RSVP is not set
+# CONFIG_NET_CLS_RSVP6 is not set
+# CONFIG_NET_CLS_U32 is not set
+CONFIG_NET_CORE=y
+# CONFIG_NET_DEVLINK is not set
+# CONFIG_NET_DEV_REFCNT_TRACKER is not set
+# CONFIG_NET_DROP_MONITOR is not set
+# CONFIG_NET_DSA is not set
+# CONFIG_NET_DSA_AR9331 is not set
+# CONFIG_NET_DSA_BCM_SF2 is not set
+# CONFIG_NET_DSA_LANTIQ_GSWIP is not set
+# CONFIG_NET_DSA_LEGACY is not set
+# CONFIG_NET_DSA_LOOP is not set
+# CONFIG_NET_DSA_MICROCHIP_KSZ8795 is not set
+# CONFIG_NET_DSA_MICROCHIP_KSZ9477 is not set
+# CONFIG_NET_DSA_MICROCHIP_KSZ_COMMON is not set
+# CONFIG_NET_DSA_MSCC_FELIX is not set
+# CONFIG_NET_DSA_MSCC_SEVILLE is not set
+# CONFIG_NET_DSA_MT7530 is not set
+# CONFIG_NET_DSA_MV88E6060 is not set
+# CONFIG_NET_DSA_MV88E6123_61_65 is not set
+# CONFIG_NET_DSA_MV88E6131 is not set
+# CONFIG_NET_DSA_MV88E6171 is not set
+# CONFIG_NET_DSA_MV88E6352 is not set
+# CONFIG_NET_DSA_MV88E6XXX is not set
+# CONFIG_NET_DSA_MV88E6XXX_NEED_PPU is not set
+# CONFIG_NET_DSA_MV88E6XXX_PTP is not set
+# CONFIG_NET_DSA_QCA8K is not set
+# CONFIG_NET_DSA_QCA8K_LEDS_SUPPORT is not set
+# CONFIG_NET_DSA_REALTEK is not set
+# CONFIG_NET_DSA_REALTEK_SMI is not set
+# CONFIG_NET_DSA_SJA1105 is not set
+# CONFIG_NET_DSA_SMSC_LAN9303_I2C is not set
+# CONFIG_NET_DSA_SMSC_LAN9303_MDIO is not set
+# CONFIG_NET_DSA_TAG_8021Q is not set
+# CONFIG_NET_DSA_TAG_AR9331 is not set
+# CONFIG_NET_DSA_TAG_BRCM is not set
+# CONFIG_NET_DSA_TAG_BRCM_LEGACY is not set
+# CONFIG_NET_DSA_TAG_BRCM_PREPEND is not set
+# CONFIG_NET_DSA_TAG_DSA is not set
+# CONFIG_NET_DSA_TAG_EDSA is not set
+# CONFIG_NET_DSA_TAG_GSWIP is not set
+# CONFIG_NET_DSA_TAG_HELLCREEK is not set
+# CONFIG_NET_DSA_TAG_KSZ is not set
+# CONFIG_NET_DSA_TAG_LAN9303 is not set
+# CONFIG_NET_DSA_TAG_MTK is not set
+# CONFIG_NET_DSA_TAG_OCELOT is not set
+# CONFIG_NET_DSA_TAG_OCELOT_8021Q is not set
+# CONFIG_NET_DSA_TAG_QCA is not set
+# CONFIG_NET_DSA_TAG_RTL4_A is not set
+# CONFIG_NET_DSA_TAG_RTL8_4 is not set
+# CONFIG_NET_DSA_TAG_RZN1_A5PSW is not set
+# CONFIG_NET_DSA_TAG_SJA1105 is not set
+# CONFIG_NET_DSA_TAG_TRAILER is not set
+# CONFIG_NET_DSA_TAG_XRS700X is not set
+# CONFIG_NET_DSA_VITESSE_VSC73XX is not set
+# CONFIG_NET_DSA_VITESSE_VSC73XX_PLATFORM is not set
+# CONFIG_NET_DSA_VITESSE_VSC73XX_SPI is not set
+# CONFIG_NET_DSA_XRS700X_I2C is not set
+# CONFIG_NET_DSA_XRS700X_MDIO is not set
+# CONFIG_NET_EMATCH is not set
+# CONFIG_NET_EMATCH_CANID is not set
+# CONFIG_NET_EMATCH_CMP is not set
+# CONFIG_NET_EMATCH_IPT is not set
+# CONFIG_NET_EMATCH_META is not set
+# CONFIG_NET_EMATCH_NBYTE is not set
+CONFIG_NET_EMATCH_STACK=32
+# CONFIG_NET_EMATCH_TEXT is not set
+# CONFIG_NET_EMATCH_U32 is not set
+# CONFIG_NET_FAILOVER is not set
+# CONFIG_NET_FC is not set
+# CONFIG_NET_FOU is not set
+# CONFIG_NET_FOU_IP_TUNNELS is not set
+# CONFIG_NET_IFE is not set
+# CONFIG_NET_IPGRE is not set
+CONFIG_NET_IPGRE_BROADCAST=y
+# CONFIG_NET_IPGRE_DEMUX is not set
+# CONFIG_NET_IPIP is not set
+# CONFIG_NET_IPVTI is not set
+# CONFIG_NET_IP_TUNNEL is not set
+# CONFIG_NET_KEY is not set
+# CONFIG_NET_KEY_MIGRATE is not set
+# CONFIG_NET_L3_MASTER_DEV is not set
+# CONFIG_NET_MEDIATEK_STAR_EMAC is not set
+# CONFIG_NET_MPLS_GSO is not set
+# CONFIG_NET_NCSI is not set
+# CONFIG_NET_NSH is not set
+# CONFIG_NET_NS_REFCNT_TRACKER is not set
+# CONFIG_NET_PACKET_ENGINE is not set
+# CONFIG_NET_PKTGEN is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
+# CONFIG_NET_PTP_CLASSIFY is not set
+CONFIG_NET_RX_BUSY_POLL=y
+# CONFIG_NET_SB1000 is not set
+CONFIG_NET_SCHED=y
+# CONFIG_NET_SCH_ATM is not set
+# CONFIG_NET_SCH_CAKE is not set
+# CONFIG_NET_SCH_CBQ is not set
+# CONFIG_NET_SCH_CBS is not set
+# CONFIG_NET_SCH_CHOKE is not set
+# CONFIG_NET_SCH_CODEL is not set
+CONFIG_NET_SCH_DEFAULT=y
+# CONFIG_NET_SCH_DRR is not set
+# CONFIG_NET_SCH_DSMARK is not set
+# CONFIG_NET_SCH_ETF is not set
+# CONFIG_NET_SCH_ETS is not set
+CONFIG_NET_SCH_FIFO=y
+# CONFIG_NET_SCH_FQ is not set
+CONFIG_NET_SCH_FQ_CODEL=y
+# CONFIG_NET_SCH_FQ_PIE is not set
+# CONFIG_NET_SCH_GRED is not set
+# CONFIG_NET_SCH_HFSC is not set
+# CONFIG_NET_SCH_HHF is not set
+# CONFIG_NET_SCH_HTB is not set
+# CONFIG_NET_SCH_INGRESS is not set
+# CONFIG_NET_SCH_MQPRIO is not set
+# CONFIG_NET_SCH_MULTIQ is not set
+# CONFIG_NET_SCH_NETEM is not set
+# CONFIG_NET_SCH_PIE is not set
+# CONFIG_NET_SCH_PLUG is not set
+# CONFIG_NET_SCH_PRIO is not set
+# CONFIG_NET_SCH_QFQ is not set
+# CONFIG_NET_SCH_RED is not set
+# CONFIG_NET_SCH_SFB is not set
+# CONFIG_NET_SCH_SFQ is not set
+# CONFIG_NET_SCH_SKBPRIO is not set
+# CONFIG_NET_SCH_TAPRIO is not set
+# CONFIG_NET_SCH_TBF is not set
+# CONFIG_NET_SCH_TEQL is not set
+# CONFIG_NET_SCTPPROBE is not set
+# CONFIG_NET_SELFTESTS is not set
+CONFIG_NET_SOCK_MSG=y
+# CONFIG_NET_SWITCHDEV is not set
+# CONFIG_NET_TCPPROBE is not set
+# CONFIG_NET_TC_SKB_EXT is not set
+# CONFIG_NET_TEAM is not set
+# CONFIG_NET_TULIP is not set
+# CONFIG_NET_UDP_TUNNEL is not set
+CONFIG_NET_VENDOR_3COM=y
+CONFIG_NET_VENDOR_8390=y
+CONFIG_NET_VENDOR_ADAPTEC=y
+CONFIG_NET_VENDOR_ADI=y
+CONFIG_NET_VENDOR_AGERE=y
+CONFIG_NET_VENDOR_ALACRITECH=y
+CONFIG_NET_VENDOR_ALTEON=y
+CONFIG_NET_VENDOR_AMAZON=y
+CONFIG_NET_VENDOR_AMD=y
+CONFIG_NET_VENDOR_AQUANTIA=y
+CONFIG_NET_VENDOR_ARC=y
+# CONFIG_NET_VENDOR_ASIX is not set
+CONFIG_NET_VENDOR_ATHEROS=y
+CONFIG_NET_VENDOR_AURORA=y
+CONFIG_NET_VENDOR_BROADCOM=y
+CONFIG_NET_VENDOR_BROCADE=y
+CONFIG_NET_VENDOR_CADENCE=y
+CONFIG_NET_VENDOR_CAVIUM=y
+CONFIG_NET_VENDOR_CHELSIO=y
+CONFIG_NET_VENDOR_CIRRUS=y
+CONFIG_NET_VENDOR_CISCO=y
+CONFIG_NET_VENDOR_CORTINA=y
+# CONFIG_NET_VENDOR_DAVICOM is not set
+CONFIG_NET_VENDOR_DEC=y
+CONFIG_NET_VENDOR_DLINK=y
+CONFIG_NET_VENDOR_EMULEX=y
+# CONFIG_NET_VENDOR_ENGLEDER is not set
+CONFIG_NET_VENDOR_EXAR=y
+CONFIG_NET_VENDOR_EZCHIP=y
+CONFIG_NET_VENDOR_FARADAY=y
+CONFIG_NET_VENDOR_FREESCALE=y
+CONFIG_NET_VENDOR_FUJITSU=y
+# CONFIG_NET_VENDOR_FUNGIBLE is not set
+CONFIG_NET_VENDOR_GOOGLE=y
+CONFIG_NET_VENDOR_HISILICON=y
+CONFIG_NET_VENDOR_HP=y
+CONFIG_NET_VENDOR_HUAWEI=y
+CONFIG_NET_VENDOR_I825XX=y
+CONFIG_NET_VENDOR_IBM=y
+CONFIG_NET_VENDOR_INTEL=y
+# CONFIG_NET_VENDOR_LITEX is not set
+CONFIG_NET_VENDOR_MARVELL=y
+CONFIG_NET_VENDOR_MELLANOX=y
+CONFIG_NET_VENDOR_MICREL=y
+CONFIG_NET_VENDOR_MICROCHIP=y
+CONFIG_NET_VENDOR_MICROSEMI=y
+# CONFIG_NET_VENDOR_MICROSOFT is not set
+CONFIG_NET_VENDOR_MYRI=y
+CONFIG_NET_VENDOR_NATSEMI=y
+CONFIG_NET_VENDOR_NETERION=y
+CONFIG_NET_VENDOR_NETRONOME=y
+CONFIG_NET_VENDOR_NI=y
+CONFIG_NET_VENDOR_NVIDIA=y
+CONFIG_NET_VENDOR_OKI=y
+CONFIG_NET_VENDOR_PACKET_ENGINES=y
+CONFIG_NET_VENDOR_PENSANDO=y
+CONFIG_NET_VENDOR_QLOGIC=y
+CONFIG_NET_VENDOR_QUALCOMM=y
+CONFIG_NET_VENDOR_RDC=y
+CONFIG_NET_VENDOR_REALTEK=y
+CONFIG_NET_VENDOR_RENESAS=y
+CONFIG_NET_VENDOR_ROCKER=y
+CONFIG_NET_VENDOR_SAMSUNG=y
+CONFIG_NET_VENDOR_SEEQ=y
+CONFIG_NET_VENDOR_SILAN=y
+CONFIG_NET_VENDOR_SIS=y
+CONFIG_NET_VENDOR_SMSC=y
+CONFIG_NET_VENDOR_SOCIONEXT=y
+CONFIG_NET_VENDOR_SOLARFLARE=y
+CONFIG_NET_VENDOR_STMICRO=y
+CONFIG_NET_VENDOR_SUN=y
+CONFIG_NET_VENDOR_SYNOPSYS=y
+CONFIG_NET_VENDOR_TEHUTI=y
+CONFIG_NET_VENDOR_TI=y
+CONFIG_NET_VENDOR_TOSHIBA=y
+# CONFIG_NET_VENDOR_VERTEXCOM is not set
+CONFIG_NET_VENDOR_VIA=y
+# CONFIG_NET_VENDOR_WANGXUN is not set
+CONFIG_NET_VENDOR_WIZNET=y
+CONFIG_NET_VENDOR_XILINX=y
+CONFIG_NET_VENDOR_XIRCOM=y
+# CONFIG_NET_VRF is not set
+# CONFIG_NET_XGENE is not set
+CONFIG_NEW_LEDS=y
+# CONFIG_NFC is not set
+# CONFIG_NFP is not set
+# CONFIG_NFSD is not set
+# CONFIG_NFSD_V2_ACL is not set
+CONFIG_NFSD_V3=y
+# CONFIG_NFSD_V3_ACL is not set
+# CONFIG_NFSD_V4 is not set
+# CONFIG_NFS_ACL_SUPPORT is not set
+CONFIG_NFS_COMMON=y
+# CONFIG_NFS_DISABLE_UDP_SUPPORT is not set
+# CONFIG_NFS_FS is not set
+# CONFIG_NFS_FSCACHE is not set
+# CONFIG_NFS_SWAP is not set
+# CONFIG_NFS_V2 is not set
+CONFIG_NFS_V3=y
+# CONFIG_NFS_V3_ACL is not set
+# CONFIG_NFS_V4 is not set
+# CONFIG_NFS_V4_1 is not set
+# CONFIG_NFTL is not set
+# CONFIG_NFT_BRIDGE_META is not set
+# CONFIG_NFT_BRIDGE_REJECT is not set
+# CONFIG_NFT_CONNLIMIT is not set
+# CONFIG_NFT_DUP_IPV4 is not set
+# CONFIG_NFT_DUP_IPV6 is not set
+# CONFIG_NFT_FIB_IPV4 is not set
+# CONFIG_NFT_FIB_IPV6 is not set
+# CONFIG_NFT_FIB_NETDEV is not set
+# CONFIG_NFT_FLOW_OFFLOAD is not set
+# CONFIG_NFT_OBJREF is not set
+# CONFIG_NFT_OSF is not set
+# CONFIG_NFT_REJECT_NETDEV is not set
+# CONFIG_NFT_RT is not set
+# CONFIG_NFT_SET_BITMAP is not set
+# CONFIG_NFT_SOCKET is not set
+# CONFIG_NFT_SYNPROXY is not set
+# CONFIG_NFT_TPROXY is not set
+# CONFIG_NFT_TUNNEL is not set
+# CONFIG_NFT_XFRM is not set
+# CONFIG_NF_CONNTRACK is not set
+# CONFIG_NF_CONNTRACK_AMANDA is not set
+# CONFIG_NF_CONNTRACK_BRIDGE is not set
+# CONFIG_NF_CONNTRACK_EVENTS is not set
+# CONFIG_NF_CONNTRACK_FTP is not set
+# CONFIG_NF_CONNTRACK_H323 is not set
+# CONFIG_NF_CONNTRACK_IRC is not set
+# CONFIG_NF_CONNTRACK_LABELS is not set
+# CONFIG_NF_CONNTRACK_MARK is not set
+# CONFIG_NF_CONNTRACK_NETBIOS_NS is not set
+# CONFIG_NF_CONNTRACK_PPTP is not set
+CONFIG_NF_CONNTRACK_PROCFS=y
+# CONFIG_NF_CONNTRACK_PROC_COMPAT is not set
+# CONFIG_NF_CONNTRACK_SANE is not set
+# CONFIG_NF_CONNTRACK_SECMARK is not set
+# CONFIG_NF_CONNTRACK_SIP is not set
+# CONFIG_NF_CONNTRACK_SNMP is not set
+# CONFIG_NF_CONNTRACK_TFTP is not set
+# CONFIG_NF_CONNTRACK_TIMEOUT is not set
+# CONFIG_NF_CONNTRACK_TIMESTAMP is not set
+# CONFIG_NF_CONNTRACK_ZONES is not set
+# CONFIG_NF_CT_NETLINK is not set
+# CONFIG_NF_CT_NETLINK_HELPER is not set
+# CONFIG_NF_CT_NETLINK_TIMEOUT is not set
+# CONFIG_NF_CT_PROTO_DCCP is not set
+# CONFIG_NF_CT_PROTO_GRE is not set
+# CONFIG_NF_CT_PROTO_SCTP is not set
+# CONFIG_NF_CT_PROTO_UDPLITE is not set
+# CONFIG_NF_DEFRAG_IPV4 is not set
+# CONFIG_NF_DUP_IPV4 is not set
+# CONFIG_NF_DUP_IPV6 is not set
+# CONFIG_NF_FLOW_TABLE is not set
+# CONFIG_NF_FLOW_TABLE_PROCFS is not set
+# CONFIG_NF_LOG_ARP is not set
+# CONFIG_NF_LOG_BRIDGE is not set
+# CONFIG_NF_LOG_IPV4 is not set
+# CONFIG_NF_LOG_NETDEV is not set
+# CONFIG_NF_LOG_SYSLOG is not set
+# CONFIG_NF_NAT is not set
+# CONFIG_NF_NAT_AMANDA is not set
+# CONFIG_NF_NAT_FTP is not set
+# CONFIG_NF_NAT_H323 is not set
+# CONFIG_NF_NAT_IRC is not set
+# CONFIG_NF_NAT_NEEDED is not set
+# CONFIG_NF_NAT_PPTP is not set
+# CONFIG_NF_NAT_PROTO_GRE is not set
+# CONFIG_NF_NAT_SIP is not set
+# CONFIG_NF_NAT_SNMP_BASIC is not set
+# CONFIG_NF_NAT_TFTP is not set
+# CONFIG_NF_REJECT_IPV4 is not set
+# CONFIG_NF_REJECT_IPV6 is not set
+# CONFIG_NF_SOCKET_IPV4 is not set
+# CONFIG_NF_SOCKET_IPV6 is not set
+# CONFIG_NF_TABLES is not set
+CONFIG_NF_TABLES_ARP=y
+CONFIG_NF_TABLES_BRIDGE=y
+CONFIG_NF_TABLES_INET=y
+CONFIG_NF_TABLES_IPV4=y
+CONFIG_NF_TABLES_IPV6=y
+CONFIG_NF_TABLES_NETDEV=y
+# CONFIG_NF_TABLES_SET is not set
+# CONFIG_NF_TPROXY_IPV4 is not set
+# CONFIG_NF_TPROXY_IPV6 is not set
+# CONFIG_NGBE is not set
+# CONFIG_NI65 is not set
+# CONFIG_NI903X_WDT is not set
+# CONFIG_NIC7018_WDT is not set
+# CONFIG_NILFS2_FS is not set
+# CONFIG_NIU is not set
+# CONFIG_NI_XGE_MANAGEMENT_ENET is not set
+CONFIG_NLATTR=y
+# CONFIG_NLMON is not set
+# CONFIG_NLM_XLP_BOARD is not set
+# CONFIG_NLM_XLR_BOARD is not set
+# CONFIG_NLS is not set
+# CONFIG_NLS_ASCII is not set
+# CONFIG_NLS_CODEPAGE_1250 is not set
+# CONFIG_NLS_CODEPAGE_1251 is not set
+# CONFIG_NLS_CODEPAGE_437 is not set
+# CONFIG_NLS_CODEPAGE_737 is not set
+# CONFIG_NLS_CODEPAGE_775 is not set
+# CONFIG_NLS_CODEPAGE_850 is not set
+# CONFIG_NLS_CODEPAGE_852 is not set
+# CONFIG_NLS_CODEPAGE_855 is not set
+# CONFIG_NLS_CODEPAGE_857 is not set
+# CONFIG_NLS_CODEPAGE_860 is not set
+# CONFIG_NLS_CODEPAGE_861 is not set
+# CONFIG_NLS_CODEPAGE_862 is not set
+# CONFIG_NLS_CODEPAGE_863 is not set
+# CONFIG_NLS_CODEPAGE_864 is not set
+# CONFIG_NLS_CODEPAGE_865 is not set
+# CONFIG_NLS_CODEPAGE_866 is not set
+# CONFIG_NLS_CODEPAGE_869 is not set
+# CONFIG_NLS_CODEPAGE_874 is not set
+# CONFIG_NLS_CODEPAGE_932 is not set
+# CONFIG_NLS_CODEPAGE_936 is not set
+# CONFIG_NLS_CODEPAGE_949 is not set
+# CONFIG_NLS_CODEPAGE_950 is not set
+CONFIG_NLS_DEFAULT="iso8859-1"
+# CONFIG_NLS_ISO8859_1 is not set
+# CONFIG_NLS_ISO8859_13 is not set
+# CONFIG_NLS_ISO8859_14 is not set
+# CONFIG_NLS_ISO8859_15 is not set
+# CONFIG_NLS_ISO8859_2 is not set
+# CONFIG_NLS_ISO8859_3 is not set
+# CONFIG_NLS_ISO8859_4 is not set
+# CONFIG_NLS_ISO8859_5 is not set
+# CONFIG_NLS_ISO8859_6 is not set
+# CONFIG_NLS_ISO8859_7 is not set
+# CONFIG_NLS_ISO8859_8 is not set
+# CONFIG_NLS_ISO8859_9 is not set
+# CONFIG_NLS_KOI8_R is not set
+# CONFIG_NLS_KOI8_U is not set
+# CONFIG_NLS_MAC_CELTIC is not set
+# CONFIG_NLS_MAC_CENTEURO is not set
+# CONFIG_NLS_MAC_CROATIAN is not set
+# CONFIG_NLS_MAC_CYRILLIC is not set
+# CONFIG_NLS_MAC_GAELIC is not set
+# CONFIG_NLS_MAC_GREEK is not set
+# CONFIG_NLS_MAC_ICELAND is not set
+# CONFIG_NLS_MAC_INUIT is not set
+# CONFIG_NLS_MAC_ROMAN is not set
+# CONFIG_NLS_MAC_ROMANIAN is not set
+# CONFIG_NLS_MAC_TURKISH is not set
+# CONFIG_NLS_UTF8 is not set
+CONFIG_NMI_LOG_BUF_SHIFT=13
+# CONFIG_NOA1305 is not set
+# CONFIG_NOP_USB_XCEIV is not set
+# CONFIG_NORTEL_HERMES is not set
+# CONFIG_NOTIFIER_ERROR_INJECTION is not set
+# CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT is not set
+# CONFIG_NOZOMI is not set
+# CONFIG_NO_BOOTMEM is not set
+# CONFIG_NO_HZ is not set
+# CONFIG_NO_HZ_FULL is not set
+# CONFIG_NO_HZ_IDLE is not set
+# CONFIG_NS83820 is not set
+# CONFIG_NTB is not set
+# CONFIG_NTFS3_64BIT_CLUSTER is not set
+# CONFIG_NTFS3_FS is not set
+# CONFIG_NTFS3_FS_POSIX_ACL is not set
+# CONFIG_NTFS3_LZX_XPRESS is not set
+# CONFIG_NTFS_DEBUG is not set
+# CONFIG_NTFS_FS is not set
+# CONFIG_NTFS_RW is not set
+# CONFIG_NTP_PPS is not set
+# CONFIG_NULL_TTY is not set
+# CONFIG_NUMA is not set
+# CONFIG_NVIDIA_CARMEL_CNP_ERRATUM is not set
+# CONFIG_NVM is not set
+# CONFIG_NVMEM is not set
+# CONFIG_NVMEM_BCM_OCOTP is not set
+# CONFIG_NVMEM_IMX_OCOTP is not set
+# CONFIG_NVMEM_LAYOUT_ONIE_TLV is not set
+# CONFIG_NVMEM_LAYOUT_SL28_VPD is not set
+# CONFIG_NVMEM_REBOOT_MODE is not set
+# CONFIG_NVMEM_RMEM is not set
+# CONFIG_NVMEM_SYSFS is not set
+# CONFIG_NVMEM_U_BOOT_ENV is not set
+# CONFIG_NVME_AUTH is not set
+# CONFIG_NVME_FC is not set
+# CONFIG_NVME_TARGET is not set
+# CONFIG_NVME_TCP is not set
+# CONFIG_NVME_VERBOSE_ERRORS is not set
+# CONFIG_NVRAM is not set
+# CONFIG_NV_TCO is not set
+# CONFIG_NXP_C45_TJA11XX_PHY is not set
+# CONFIG_NXP_STB220 is not set
+# CONFIG_NXP_STB225 is not set
+# CONFIG_NXP_TJA11XX_PHY is not set
+# CONFIG_N_GSM is not set
+# CONFIG_OABI_COMPAT is not set
+# CONFIG_OBS600 is not set
+# CONFIG_OCFS2_FS is not set
+# CONFIG_OCTEONTX2_AF is not set
+# CONFIG_OCTEONTX2_PF is not set
+# CONFIG_OCTEON_EP is not set
+# CONFIG_OF_OVERLAY is not set
+CONFIG_OF_RESERVED_MEM=y
+# CONFIG_OF_UNITTEST is not set
+# CONFIG_OID_REGISTRY is not set
+# CONFIG_OMAP2_DSS_DEBUG is not set
+# CONFIG_OMAP2_DSS_DEBUGFS is not set
+# CONFIG_OMAP2_DSS_SDI is not set
+# CONFIG_OMAP_OCP2SCP is not set
+# CONFIG_OMAP_USB2 is not set
+# CONFIG_OMFS_FS is not set
+# CONFIG_OPENVSWITCH is not set
+# CONFIG_OPEN_DICE is not set
+# CONFIG_OPROFILE is not set
+# CONFIG_OPROFILE_EVENT_MULTIPLEX is not set
+# CONFIG_OPT3001 is not set
+CONFIG_OPTIMIZE_INLINING=y
+# CONFIG_ORANGEFS_FS is not set
+# CONFIG_ORION_WATCHDOG is not set
+# CONFIG_OSF_PARTITION is not set
+# CONFIG_OSNOISE_TRACER is not set
+CONFIG_OVERLAY_FS=y
+# CONFIG_OVERLAY_FS_INDEX is not set
+# CONFIG_OVERLAY_FS_METACOPY is not set
+CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW=y
+# CONFIG_OVERLAY_FS_REDIRECT_DIR is not set
+CONFIG_OVERLAY_FS_XINO_AUTO=y
+# CONFIG_OWL_LOADER is not set
+# CONFIG_P54_COMMON is not set
+# CONFIG_PA12203001 is not set
+CONFIG_PACKET=y
+# CONFIG_PACKET_DIAG is not set
+# CONFIG_PACKING is not set
+# CONFIG_PAGE_EXTENSION is not set
+# CONFIG_PAGE_OWNER is not set
+# CONFIG_PAGE_POISONING is not set
+# CONFIG_PAGE_POOL is not set
+# CONFIG_PAGE_POOL_STATS is not set
+# CONFIG_PAGE_REPORTING is not set
+# CONFIG_PAGE_SIZE_16KB is not set
+# CONFIG_PAGE_SIZE_32KB is not set
+CONFIG_PAGE_SIZE_4KB=y
+# CONFIG_PAGE_SIZE_64KB is not set
+# CONFIG_PAGE_SIZE_8KB is not set
+# CONFIG_PAGE_TABLE_CHECK is not set
+# CONFIG_PALMAS_GPADC is not set
+# CONFIG_PANASONIC_LAPTOP is not set
+# CONFIG_PANEL is not set
+CONFIG_PANIC_ON_OOPS=y
+CONFIG_PANIC_ON_OOPS_VALUE=1
+CONFIG_PANIC_TIMEOUT=1
+# CONFIG_PANTHERLORD_FF is not set
+# CONFIG_PARAVIRT is not set
+# CONFIG_PARAVIRT_TIME_ACCOUNTING is not set
+# CONFIG_PARPORT is not set
+# CONFIG_PARPORT_1284 is not set
+# CONFIG_PARPORT_AX88796 is not set
+# CONFIG_PARPORT_GSC is not set
+# CONFIG_PARPORT_PC is not set
+CONFIG_PARTITION_ADVANCED=y
+# CONFIG_PATA_ALI is not set
+# CONFIG_PATA_AMD is not set
+# CONFIG_PATA_ARASAN_CF is not set
+# CONFIG_PATA_ARTOP is not set
+# CONFIG_PATA_ATIIXP is not set
+# CONFIG_PATA_ATP867X is not set
+# CONFIG_PATA_CMD640_PCI is not set
+# CONFIG_PATA_CMD64X is not set
+# CONFIG_PATA_CS5520 is not set
+# CONFIG_PATA_CS5530 is not set
+# CONFIG_PATA_CS5535 is not set
+# CONFIG_PATA_CS5536 is not set
+# CONFIG_PATA_CYPRESS is not set
+# CONFIG_PATA_EFAR is not set
+# CONFIG_PATA_HPT366 is not set
+# CONFIG_PATA_HPT37X is not set
+# CONFIG_PATA_HPT3X2N is not set
+# CONFIG_PATA_HPT3X3 is not set
+# CONFIG_PATA_IMX is not set
+# CONFIG_PATA_ISAPNP is not set
+# CONFIG_PATA_IT8213 is not set
+# CONFIG_PATA_IT821X is not set
+# CONFIG_PATA_JMICRON is not set
+# CONFIG_PATA_LEGACY is not set
+# CONFIG_PATA_MARVELL is not set
+# CONFIG_PATA_MPIIX is not set
+# CONFIG_PATA_NETCELL is not set
+# CONFIG_PATA_NINJA32 is not set
+# CONFIG_PATA_NS87410 is not set
+# CONFIG_PATA_NS87415 is not set
+# CONFIG_PATA_OCTEON_CF is not set
+# CONFIG_PATA_OF_PLATFORM is not set
+# CONFIG_PATA_OLDPIIX is not set
+# CONFIG_PATA_OPTI is not set
+# CONFIG_PATA_OPTIDMA is not set
+# CONFIG_PATA_PCMCIA is not set
+# CONFIG_PATA_PDC2027X is not set
+# CONFIG_PATA_PDC_OLD is not set
+# CONFIG_PATA_PLATFORM is not set
+# CONFIG_PATA_QDI is not set
+# CONFIG_PATA_RADISYS is not set
+# CONFIG_PATA_RDC is not set
+# CONFIG_PATA_RZ1000 is not set
+# CONFIG_PATA_SC1200 is not set
+# CONFIG_PATA_SCH is not set
+# CONFIG_PATA_SERVERWORKS is not set
+# CONFIG_PATA_SIL680 is not set
+# CONFIG_PATA_SIS is not set
+# CONFIG_PATA_TOSHIBA is not set
+# CONFIG_PATA_TRIFLEX is not set
+# CONFIG_PATA_VIA is not set
+# CONFIG_PATA_WINBOND is not set
+# CONFIG_PATA_WINBOND_VLB is not set
+# CONFIG_PC104 is not set
+# CONFIG_PC300TOO is not set
+# CONFIG_PCCARD is not set
+# CONFIG_PCH_DMA is not set
+# CONFIG_PCH_GBE is not set
+# CONFIG_PCH_PHUB is not set
+# CONFIG_PCI is not set
+# CONFIG_PCI200SYN is not set
+# CONFIG_PCIEAER is not set
+# CONFIG_PCIEAER_INJECT is not set
+# CONFIG_PCIEASPM is not set
+# CONFIG_PCIEPORTBUS is not set
+# CONFIG_PCIE_AL is not set
+# CONFIG_PCIE_ALTERA is not set
+# CONFIG_PCIE_ARMADA_8K is not set
+CONFIG_PCIE_BUS_DEFAULT=y
+# CONFIG_PCIE_BUS_PEER2PEER is not set
+# CONFIG_PCIE_BUS_PERFORMANCE is not set
+# CONFIG_PCIE_BUS_SAFE is not set
+# CONFIG_PCIE_BUS_TUNE_OFF is not set
+# CONFIG_PCIE_BW is not set
+# CONFIG_PCIE_CADENCE_HOST is not set
+# CONFIG_PCIE_CADENCE_PLAT_HOST is not set
+# CONFIG_PCIE_DPC is not set
+# CONFIG_PCIE_DW_PLAT is not set
+# CONFIG_PCIE_DW_PLAT_HOST is not set
+# CONFIG_PCIE_ECRC is not set
+# CONFIG_PCIE_IPROC is not set
+# CONFIG_PCIE_KIRIN is not set
+# CONFIG_PCIE_LAYERSCAPE_GEN4 is not set
+# CONFIG_PCIE_MEDIATEK_GEN3 is not set
+# CONFIG_PCIE_MICROCHIP_HOST is not set
+# CONFIG_PCIE_PTM is not set
+# CONFIG_PCIE_XILINX is not set
+# CONFIG_PCIPCWATCHDOG is not set
+# CONFIG_PCI_ATMEL is not set
+# CONFIG_PCI_CNB20LE_QUIRK is not set
+# CONFIG_PCI_DEBUG is not set
+# CONFIG_PCI_DISABLE_COMMON_QUIRKS is not set
+# CONFIG_PCI_ENDPOINT is not set
+# CONFIG_PCI_ENDPOINT_TEST is not set
+# CONFIG_PCI_FTPCI100 is not set
+# CONFIG_PCI_HERMES is not set
+# CONFIG_PCI_HISI is not set
+# CONFIG_PCI_HOST_GENERIC is not set
+# CONFIG_PCI_HOST_THUNDER_ECAM is not set
+# CONFIG_PCI_HOST_THUNDER_PEM is not set
+# CONFIG_PCI_IOV is not set
+# CONFIG_PCI_J721E_HOST is not set
+# CONFIG_PCI_LAYERSCAPE is not set
+# CONFIG_PCI_MESON is not set
+# CONFIG_PCI_MSI is not set
+# CONFIG_PCI_PASID is not set
+# CONFIG_PCI_PF_STUB is not set
+# CONFIG_PCI_PRI is not set
+CONFIG_PCI_QUIRKS=y
+# CONFIG_PCI_REALLOC_ENABLE_AUTO is not set
+# CONFIG_PCI_STUB is not set
+# CONFIG_PCI_SW_SWITCHTEC is not set
+CONFIG_PCI_SYSCALL=y
+# CONFIG_PCI_V3_SEMI is not set
+# CONFIG_PCI_XGENE is not set
+# CONFIG_PCMCIA is not set
+# CONFIG_PCMCIA_3C574 is not set
+# CONFIG_PCMCIA_3C589 is not set
+# CONFIG_PCMCIA_AHA152X is not set
+# CONFIG_PCMCIA_ATMEL is not set
+# CONFIG_PCMCIA_AXNET is not set
+# CONFIG_PCMCIA_DEBUG is not set
+# CONFIG_PCMCIA_FDOMAIN is not set
+# CONFIG_PCMCIA_FMVJ18X is not set
+# CONFIG_PCMCIA_HERMES is not set
+# CONFIG_PCMCIA_LOAD_CIS is not set
+# CONFIG_PCMCIA_NINJA_SCSI is not set
+# CONFIG_PCMCIA_NMCLAN is not set
+# CONFIG_PCMCIA_PCNET is not set
+# CONFIG_PCMCIA_QLOGIC is not set
+# CONFIG_PCMCIA_RAYCS is not set
+# CONFIG_PCMCIA_SMC91C92 is not set
+# CONFIG_PCMCIA_SPECTRUM is not set
+# CONFIG_PCMCIA_SYM53C500 is not set
+# CONFIG_PCMCIA_WL3501 is not set
+# CONFIG_PCMCIA_XIRC2PS is not set
+# CONFIG_PCMCIA_XIRCOM is not set
+# CONFIG_PCNET32 is not set
+# CONFIG_PCPU_DEV_REFCNT is not set
+# CONFIG_PCSPKR_PLATFORM is not set
+# CONFIG_PCS_XPCS is not set
+# CONFIG_PD6729 is not set
+# CONFIG_PDA_POWER is not set
+# CONFIG_PDC_ADMA is not set
+# CONFIG_PECI is not set
+# CONFIG_PERCPU_STATS is not set
+# CONFIG_PERCPU_TEST is not set
+# CONFIG_PERF_EVENTS is not set
+# CONFIG_PERF_EVENTS_AMD_POWER is not set
+# CONFIG_PERSISTENT_KEYRINGS is not set
+# CONFIG_PHANTOM is not set
+# CONFIG_PHONET is not set
+# CONFIG_PHYLIB is not set
+# CONFIG_PHYS_ADDR_T_64BIT is not set
+# CONFIG_PHY_CADENCE_DP is not set
+# CONFIG_PHY_CADENCE_DPHY is not set
+# CONFIG_PHY_CADENCE_DPHY_RX is not set
+# CONFIG_PHY_CADENCE_SALVO is not set
+# CONFIG_PHY_CADENCE_SIERRA is not set
+# CONFIG_PHY_CADENCE_TORRENT is not set
+# CONFIG_PHY_CAN_TRANSCEIVER is not set
+# CONFIG_PHY_CPCAP_USB is not set
+# CONFIG_PHY_EXYNOS_DP_VIDEO is not set
+# CONFIG_PHY_EXYNOS_MIPI_VIDEO is not set
+# CONFIG_PHY_FSL_IMX8MQ_USB is not set
+# CONFIG_PHY_INGENIC_USB is not set
+# CONFIG_PHY_INTEL_KEEMBAY_EMMC is not set
+# CONFIG_PHY_LAN966X_SERDES is not set
+# CONFIG_PHY_MAPPHONE_MDM6600 is not set
+# CONFIG_PHY_MIXEL_MIPI_DPHY is not set
+# CONFIG_PHY_MTK_HDMI is not set
+# CONFIG_PHY_MTK_MIPI_DSI is not set
+# CONFIG_PHY_MVEBU_CP110_UTMI is not set
+# CONFIG_PHY_OCELOT_SERDES is not set
+# CONFIG_PHY_PISTACHIO_USB is not set
+# CONFIG_PHY_PXA_28NM_HSIC is not set
+# CONFIG_PHY_PXA_28NM_USB2 is not set
+# CONFIG_PHY_QCOM_DWC3 is not set
+# CONFIG_PHY_QCOM_USB_HS is not set
+# CONFIG_PHY_QCOM_USB_HSIC is not set
+# CONFIG_PHY_SAMSUNG_USB2 is not set
+# CONFIG_PHY_TUSB1210 is not set
+# CONFIG_PHY_XGENE is not set
+# CONFIG_PI433 is not set
+# CONFIG_PID_IN_CONTEXTIDR is not set
+# CONFIG_PID_NS is not set
+CONFIG_PINCONF=y
+# CONFIG_PINCTRL is not set
+# CONFIG_PINCTRL_AMD is not set
+# CONFIG_PINCTRL_AXP209 is not set
+# CONFIG_PINCTRL_CEDARFORK is not set
+# CONFIG_PINCTRL_CY8C95X0 is not set
+# CONFIG_PINCTRL_EXYNOS is not set
+# CONFIG_PINCTRL_EXYNOS5440 is not set
+# CONFIG_PINCTRL_ICELAKE is not set
+# CONFIG_PINCTRL_INGENIC is not set
+# CONFIG_PINCTRL_LPASS_LPI is not set
+# CONFIG_PINCTRL_MCP23S08 is not set
+# CONFIG_PINCTRL_MDM9607 is not set
+# CONFIG_PINCTRL_MICROCHIP_SGPIO is not set
+# CONFIG_PINCTRL_MSM8953 is not set
+# CONFIG_PINCTRL_MSM8X74 is not set
+# CONFIG_PINCTRL_MT6779 is not set
+# CONFIG_PINCTRL_MT8167 is not set
+# CONFIG_PINCTRL_MT8192 is not set
+# CONFIG_PINCTRL_MT8195 is not set
+# CONFIG_PINCTRL_MT8365 is not set
+# CONFIG_PINCTRL_MTK_V2 is not set
+# CONFIG_PINCTRL_OCELOT is not set
+# CONFIG_PINCTRL_PISTACHIO is not set
+# CONFIG_PINCTRL_SC7280 is not set
+# CONFIG_PINCTRL_SC8180X is not set
+# CONFIG_PINCTRL_SDX55 is not set
+CONFIG_PINCTRL_SINGLE=y
+# CONFIG_PINCTRL_SM6115 is not set
+# CONFIG_PINCTRL_SM6125 is not set
+# CONFIG_PINCTRL_SM8350 is not set
+# CONFIG_PINCTRL_STMFX is not set
+# CONFIG_PINCTRL_SX150X is not set
+# CONFIG_PING is not set
+CONFIG_PINMUX=y
+# CONFIG_PKCS7_MESSAGE_PARSER is not set
+# CONFIG_PL310_ERRATA_588369 is not set
+# CONFIG_PL310_ERRATA_727915 is not set
+# CONFIG_PL310_ERRATA_753970 is not set
+# CONFIG_PL310_ERRATA_769419 is not set
+# CONFIG_PL320_MBOX is not set
+# CONFIG_PL330_DMA is not set
+# CONFIG_PLATFORM_MHU is not set
+# CONFIG_PLAT_SPEAR is not set
+# CONFIG_PLIP is not set
+# CONFIG_PLX_DMA is not set
+# CONFIG_PLX_HERMES is not set
+# CONFIG_PM is not set
+# CONFIG_PMBUS is not set
+# CONFIG_PMC_MSP is not set
+# CONFIG_PMIC_ADP5520 is not set
+# CONFIG_PMIC_DA903X is not set
+# CONFIG_PMS7003 is not set
+# CONFIG_PM_AUTOSLEEP is not set
+# CONFIG_PM_DEBUG is not set
+# CONFIG_PM_DEVFREQ is not set
+# CONFIG_PM_USERSPACE_AUTOSLEEP is not set
+# CONFIG_PM_WAKELOCKS is not set
+# CONFIG_POSIX_MQUEUE is not set
+CONFIG_POSIX_TIMERS=y
+# CONFIG_POWERCAP is not set
+# CONFIG_POWER_AVS is not set
+# CONFIG_POWER_RESET is not set
+# CONFIG_POWER_RESET_BRCMKONA is not set
+# CONFIG_POWER_RESET_BRCMSTB is not set
+# CONFIG_POWER_RESET_GPIO is not set
+# CONFIG_POWER_RESET_GPIO_RESTART is not set
+# CONFIG_POWER_RESET_LINKSTATION is not set
+# CONFIG_POWER_RESET_LTC2952 is not set
+# CONFIG_POWER_RESET_PIIX4_POWEROFF is not set
+# CONFIG_POWER_RESET_QNAP is not set
+# CONFIG_POWER_RESET_REGULATOR is not set
+# CONFIG_POWER_RESET_RESTART is not set
+# CONFIG_POWER_RESET_SYSCON is not set
+# CONFIG_POWER_RESET_SYSCON_POWEROFF is not set
+# CONFIG_POWER_RESET_VERSATILE is not set
+# CONFIG_POWER_RESET_XGENE is not set
+# CONFIG_POWER_SUPPLY is not set
+# CONFIG_POWER_SUPPLY_DEBUG is not set
+# CONFIG_POWER_SUPPLY_HWMON is not set
+# CONFIG_PPC4xx_GPIO is not set
+# CONFIG_PPC_16K_PAGES is not set
+# CONFIG_PPC_256K_PAGES is not set
+CONFIG_PPC_4K_PAGES=y
+# CONFIG_PPC_64K_PAGES is not set
+# CONFIG_PPC_DISABLE_WERROR is not set
+# CONFIG_PPC_EMULATED_STATS is not set
+# CONFIG_PPC_EPAPR_HV_BYTECHAN is not set
+# CONFIG_PPC_QUEUED_SPINLOCKS is not set
+# CONFIG_PPP is not set
+# CONFIG_PPPOATM is not set
+# CONFIG_PPPOE is not set
+# CONFIG_PPPOL2TP is not set
+# CONFIG_PPP_ASYNC is not set
+# CONFIG_PPP_BSDCOMP is not set
+# CONFIG_PPP_DEFLATE is not set
+CONFIG_PPP_FILTER=y
+# CONFIG_PPP_MPPE is not set
+CONFIG_PPP_MULTILINK=y
+# CONFIG_PPP_SYNC_TTY is not set
+# CONFIG_PPS is not set
+# CONFIG_PPS_CLIENT_GPIO is not set
+# CONFIG_PPS_CLIENT_KTIMER is not set
+# CONFIG_PPS_CLIENT_LDISC is not set
+# CONFIG_PPS_CLIENT_PARPORT is not set
+# CONFIG_PPS_DEBUG is not set
+# CONFIG_PPTP is not set
+# CONFIG_PREEMPT is not set
+# CONFIG_PREEMPTIRQ_DELAY_TEST is not set
+# CONFIG_PREEMPTIRQ_EVENTS is not set
+# CONFIG_PREEMPT_DYNAMIC is not set
+CONFIG_PREEMPT_NONE=y
+# CONFIG_PREEMPT_TRACER is not set
+# CONFIG_PREEMPT_VOLUNTARY is not set
+# CONFIG_PRESTERA is not set
+CONFIG_PREVENT_FIRMWARE_BUILD=y
+# CONFIG_PRIME_NUMBERS is not set
+CONFIG_PRINTK=y
+# CONFIG_PRINTK_CALLER is not set
+# CONFIG_PRINTK_INDEX is not set
+CONFIG_PRINTK_NMI=y
+CONFIG_PRINTK_SAFE_LOG_BUF_SHIFT=13
+# CONFIG_PRINTK_TIME is not set
+CONFIG_PRINT_STACK_DEPTH=64
+# CONFIG_PRISM2_USB is not set
+# CONFIG_PRISM54 is not set
+# CONFIG_PROC_CHILDREN is not set
+CONFIG_PROC_FS=y
+# CONFIG_PROC_KCORE is not set
+# CONFIG_PROC_PAGE_MONITOR is not set
+# CONFIG_PROC_STRIPPED is not set
+CONFIG_PROC_SYSCTL=y
+# CONFIG_PROC_VMCORE_DEVICE_DUMP is not set
+# CONFIG_PROFILE_ALL_BRANCHES is not set
+# CONFIG_PROFILE_ANNOTATED_BRANCHES is not set
+# CONFIG_PROFILING is not set
+# CONFIG_PROVE_LOCKING is not set
+# CONFIG_PROVE_RAW_LOCK_NESTING is not set
+# CONFIG_PROVE_RCU is not set
+# CONFIG_PROVE_RCU_LIST is not set
+# CONFIG_PROVE_RCU_REPEATEDLY is not set
+# CONFIG_PSAMPLE is not set
+# CONFIG_PSB6970_PHY is not set
+# CONFIG_PSE_CONTROLLER is not set
+# CONFIG_PSI is not set
+# CONFIG_PSTORE is not set
+# CONFIG_PSTORE_842_COMPRESS is not set
+# CONFIG_PSTORE_BLK is not set
+# CONFIG_PSTORE_COMPRESS is not set
+# CONFIG_PSTORE_CONSOLE is not set
+CONFIG_PSTORE_DEFAULT_KMSG_BYTES=10240
+# CONFIG_PSTORE_DEFLATE_COMPRESS is not set
+# CONFIG_PSTORE_DEFLATE_COMPRESS_DEFAULT is not set
+# CONFIG_PSTORE_FTRACE is not set
+# CONFIG_PSTORE_LZ4HC_COMPRESS is not set
+# CONFIG_PSTORE_LZ4_COMPRESS is not set
+# CONFIG_PSTORE_LZO_COMPRESS is not set
+# CONFIG_PSTORE_PMSG is not set
+# CONFIG_PSTORE_RAM is not set
+# CONFIG_PSTORE_ZSTD_COMPRESS is not set
+# CONFIG_PTDUMP_DEBUGFS is not set
+# CONFIG_PTP_1588_CLOCK is not set
+# CONFIG_PTP_1588_CLOCK_IDT82P33 is not set
+# CONFIG_PTP_1588_CLOCK_IDTCM is not set
+# CONFIG_PTP_1588_CLOCK_IXP46X is not set
+# CONFIG_PTP_1588_CLOCK_KVM is not set
+# CONFIG_PTP_1588_CLOCK_OCP is not set
+# CONFIG_PTP_1588_CLOCK_PCH is not set
+# CONFIG_PTP_1588_CLOCK_VMW is not set
+# CONFIG_PUBLIC_KEY_ALGO_RSA is not set
+# CONFIG_PVPANIC is not set
+# CONFIG_PWM is not set
+# CONFIG_PWM_ATMEL_TCB is not set
+# CONFIG_PWM_CLK is not set
+# CONFIG_PWM_DEBUG is not set
+# CONFIG_PWM_DWC is not set
+# CONFIG_PWM_FSL_FTM is not set
+# CONFIG_PWM_IMG is not set
+# CONFIG_PWM_JZ4740 is not set
+# CONFIG_PWM_MEDIATEK is not set
+# CONFIG_PWM_PCA9685 is not set
+# CONFIG_PWM_RASPBERRYPI_POE is not set
+# CONFIG_PWM_XILINX is not set
+CONFIG_PWRSEQ_EMMC=y
+# CONFIG_PWRSEQ_SD8787 is not set
+CONFIG_PWRSEQ_SIMPLE=y
+# CONFIG_QCA7000 is not set
+# CONFIG_QCA7000_SPI is not set
+# CONFIG_QCA7000_UART is not set
+# CONFIG_QCOM_A7PLL is not set
+# CONFIG_QCOM_BAM_DMUX is not set
+# CONFIG_QCOM_EMAC is not set
+# CONFIG_QCOM_FALKOR_ERRATUM_1003 is not set
+# CONFIG_QCOM_FALKOR_ERRATUM_1009 is not set
+# CONFIG_QCOM_FALKOR_ERRATUM_E1041 is not set
+# CONFIG_QCOM_GPI_DMA is not set
+# CONFIG_QCOM_HIDMA is not set
+# CONFIG_QCOM_HIDMA_MGMT is not set
+# CONFIG_QCOM_LMH is not set
+# CONFIG_QCOM_QDF2400_ERRATUM_0065 is not set
+# CONFIG_QCOM_SPMI_ADC5 is not set
+# CONFIG_QCOM_SPMI_ADC_TM5 is not set
+# CONFIG_QCOM_SPMI_IADC is not set
+# CONFIG_QCOM_SPMI_TEMP_ALARM is not set
+# CONFIG_QCOM_SPMI_VADC is not set
+# CONFIG_QCOM_SSC_BLOCK_BUS is not set
+# CONFIG_QED is not set
+# CONFIG_QFMT_V1 is not set
+# CONFIG_QLA3XXX is not set
+# CONFIG_QLCNIC is not set
+# CONFIG_QLGE is not set
+# CONFIG_QNX4FS_FS is not set
+# CONFIG_QNX6FS_FS is not set
+# CONFIG_QORIQ_CPUFREQ is not set
+# CONFIG_QORIQ_THERMAL is not set
+# CONFIG_QRTR is not set
+# CONFIG_QRTR_MHI is not set
+# CONFIG_QRTR_TUN is not set
+# CONFIG_QSEMI_PHY is not set
+# CONFIG_QUEUED_LOCK_STAT is not set
+# CONFIG_QUICC_ENGINE is not set
+# CONFIG_QUOTA is not set
+# CONFIG_QUOTACTL is not set
+# CONFIG_QUOTA_DEBUG is not set
+# CONFIG_QUOTA_NETLINK_INTERFACE is not set
+# CONFIG_R3964 is not set
+# CONFIG_R6040 is not set
+# CONFIG_R8169 is not set
+# CONFIG_R8188EU is not set
+# CONFIG_R8712U is not set
+# CONFIG_R8723AU is not set
+# CONFIG_RADIO_ADAPTERS is not set
+# CONFIG_RADIO_AZTECH is not set
+# CONFIG_RADIO_CADET is not set
+# CONFIG_RADIO_GEMTEK is not set
+# CONFIG_RADIO_MAXIRADIO is not set
+# CONFIG_RADIO_RTRACK is not set
+# CONFIG_RADIO_RTRACK2 is not set
+# CONFIG_RADIO_SF16FMI is not set
+# CONFIG_RADIO_SF16FMR2 is not set
+# CONFIG_RADIO_TERRATEC is not set
+# CONFIG_RADIO_TRUST is not set
+# CONFIG_RADIO_TYPHOON is not set
+# CONFIG_RADIO_ZOLTRIX is not set
+# CONFIG_RAID6_PQ_BENCHMARK is not set
+# CONFIG_RAID_ATTRS is not set
+# CONFIG_RALINK is not set
+# CONFIG_RANDOM32_SELFTEST is not set
+# CONFIG_RANDOMIZE_BASE is not set
+CONFIG_RANDOMIZE_KSTACK_OFFSET=y
+# CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT is not set
+CONFIG_RANDOM_TRUST_BOOTLOADER=y
+CONFIG_RANDOM_TRUST_CPU=y
+# CONFIG_RANDSTRUCT_NONE is not set
+# CONFIG_RAPIDIO is not set
+# CONFIG_RAS is not set
+# CONFIG_RBTREE_TEST is not set
+# CONFIG_RCU_BOOST is not set
+CONFIG_RCU_CPU_STALL_TIMEOUT=60
+# CONFIG_RCU_EQS_DEBUG is not set
+# CONFIG_RCU_EXPEDITE_BOOT is not set
+# CONFIG_RCU_EXPERT is not set
+CONFIG_RCU_EXP_CPU_STALL_TIMEOUT=0
+CONFIG_RCU_KTHREAD_PRIO=0
+CONFIG_RCU_NEED_SEGCBLIST=y
+# CONFIG_RCU_PERF_TEST is not set
+# CONFIG_RCU_REF_SCALE_TEST is not set
+# CONFIG_RCU_SCALE_TEST is not set
+CONFIG_RCU_STALL_COMMON=y
+# CONFIG_RCU_STRICT_GRACE_PERIOD is not set
+# CONFIG_RCU_TORTURE_TEST is not set
+CONFIG_RCU_TORTURE_TEST_SLOW_INIT_DELAY=3
+# CONFIG_RCU_TRACE is not set
+# CONFIG_RC_ATI_REMOTE is not set
+# CONFIG_RC_CORE is not set
+# CONFIG_RC_DECODERS is not set
+# CONFIG_RC_LOOPBACK is not set
+# CONFIG_RC_MAP is not set
+# CONFIG_RC_XBOX_DVD is not set
+# CONFIG_RDS is not set
+# CONFIG_RD_BZIP2 is not set
+# CONFIG_RD_GZIP is not set
+# CONFIG_RD_LZ4 is not set
+# CONFIG_RD_LZMA is not set
+# CONFIG_RD_LZO is not set
+# CONFIG_RD_XZ is not set
+# CONFIG_RD_ZSTD is not set
+# CONFIG_READABLE_ASM is not set
+# CONFIG_READ_ONLY_THP_FOR_FS is not set
+# CONFIG_REALTEK_PHY is not set
+# CONFIG_REDWOOD is not set
+# CONFIG_REED_SOLOMON is not set
+# CONFIG_REED_SOLOMON_DEC8 is not set
+# CONFIG_REED_SOLOMON_ENC8 is not set
+# CONFIG_REED_SOLOMON_TEST is not set
+# CONFIG_REGMAP is not set
+# CONFIG_REGMAP_I2C is not set
+# CONFIG_REGMAP_MMIO is not set
+# CONFIG_REGMAP_SPI is not set
+# CONFIG_REGULATOR is not set
+# CONFIG_REGULATOR_88PG86X is not set
+# CONFIG_REGULATOR_ACT8865 is not set
+# CONFIG_REGULATOR_AD5398 is not set
+# CONFIG_REGULATOR_ANATOP is not set
+# CONFIG_REGULATOR_DA9121 is not set
+# CONFIG_REGULATOR_DA9210 is not set
+# CONFIG_REGULATOR_DA9211 is not set
+# CONFIG_REGULATOR_DEBUG is not set
+# CONFIG_REGULATOR_FAN53555 is not set
+# CONFIG_REGULATOR_FAN53880 is not set
+# CONFIG_REGULATOR_FIXED_VOLTAGE is not set
+# CONFIG_REGULATOR_GPIO is not set
+# CONFIG_REGULATOR_ISL6271A is not set
+# CONFIG_REGULATOR_ISL9305 is not set
+# CONFIG_REGULATOR_LP3971 is not set
+# CONFIG_REGULATOR_LP3972 is not set
+# CONFIG_REGULATOR_LP872X is not set
+# CONFIG_REGULATOR_LP8755 is not set
+# CONFIG_REGULATOR_LTC3589 is not set
+# CONFIG_REGULATOR_LTC3676 is not set
+# CONFIG_REGULATOR_MAX1586 is not set
+# CONFIG_REGULATOR_MAX20086 is not set
+# CONFIG_REGULATOR_MAX77620 is not set
+# CONFIG_REGULATOR_MAX77826 is not set
+# CONFIG_REGULATOR_MAX8649 is not set
+# CONFIG_REGULATOR_MAX8660 is not set
+# CONFIG_REGULATOR_MAX8893 is not set
+# CONFIG_REGULATOR_MAX8952 is not set
+# CONFIG_REGULATOR_MAX8973 is not set
+# CONFIG_REGULATOR_MCP16502 is not set
+# CONFIG_REGULATOR_MP5416 is not set
+# CONFIG_REGULATOR_MP8859 is not set
+# CONFIG_REGULATOR_MP886X is not set
+# CONFIG_REGULATOR_MPQ7920 is not set
+# CONFIG_REGULATOR_MT6311 is not set
+# CONFIG_REGULATOR_MT6315 is not set
+# CONFIG_REGULATOR_MT6359 is not set
+# CONFIG_REGULATOR_PCA9450 is not set
+# CONFIG_REGULATOR_PF8X00 is not set
+# CONFIG_REGULATOR_PFUZE100 is not set
+# CONFIG_REGULATOR_PV88060 is not set
+# CONFIG_REGULATOR_PV88080 is not set
+# CONFIG_REGULATOR_PV88090 is not set
+# CONFIG_REGULATOR_PWM is not set
+# CONFIG_REGULATOR_RASPBERRYPI_TOUCHSCREEN_ATTINY is not set
+# CONFIG_REGULATOR_RT4801 is not set
+# CONFIG_REGULATOR_RT5190A is not set
+# CONFIG_REGULATOR_RT5759 is not set
+# CONFIG_REGULATOR_RT6160 is not set
+# CONFIG_REGULATOR_RT6245 is not set
+# CONFIG_REGULATOR_RTMV20 is not set
+# CONFIG_REGULATOR_RTQ2134 is not set
+# CONFIG_REGULATOR_RTQ6752 is not set
+# CONFIG_REGULATOR_SLG51000 is not set
+# CONFIG_REGULATOR_SY8106A is not set
+# CONFIG_REGULATOR_SY8824X is not set
+# CONFIG_REGULATOR_SY8827N is not set
+# CONFIG_REGULATOR_TI_ABB is not set
+# CONFIG_REGULATOR_TPS51632 is not set
+# CONFIG_REGULATOR_TPS62360 is not set
+# CONFIG_REGULATOR_TPS6286X is not set
+# CONFIG_REGULATOR_TPS65023 is not set
+# CONFIG_REGULATOR_TPS6507X is not set
+# CONFIG_REGULATOR_TPS65132 is not set
+# CONFIG_REGULATOR_TPS6524X is not set
+# CONFIG_REGULATOR_USERSPACE_CONSUMER is not set
+# CONFIG_REGULATOR_VCTRL is not set
+# CONFIG_REGULATOR_VIRTUAL_CONSUMER is not set
+# CONFIG_REISERFS_CHECK is not set
+# CONFIG_REISERFS_FS is not set
+# CONFIG_REISERFS_FS_POSIX_ACL is not set
+# CONFIG_REISERFS_FS_SECURITY is not set
+CONFIG_REISERFS_FS_XATTR=y
+# CONFIG_REISERFS_PROC_INFO is not set
+# CONFIG_RELAY is not set
+# CONFIG_RELOCATABLE is not set
+# CONFIG_REMOTEPROC is not set
+# CONFIG_RENESAS_PHY is not set
+# CONFIG_RESET_ATH79 is not set
+# CONFIG_RESET_BERLIN is not set
+# CONFIG_RESET_BRCMSTB_RESCAL is not set
+# CONFIG_RESET_CONTROLLER is not set
+# CONFIG_RESET_IMX7 is not set
+# CONFIG_RESET_INTEL_GW is not set
+# CONFIG_RESET_LANTIQ is not set
+# CONFIG_RESET_LPC18XX is not set
+# CONFIG_RESET_MESON is not set
+# CONFIG_RESET_PISTACHIO is not set
+# CONFIG_RESET_SIMPLE is not set
+# CONFIG_RESET_SOCFPGA is not set
+# CONFIG_RESET_STM32 is not set
+# CONFIG_RESET_SUNXI is not set
+# CONFIG_RESET_TEGRA_BPMP is not set
+# CONFIG_RESET_TI_SYSCON is not set
+# CONFIG_RESET_TI_TPS380X is not set
+# CONFIG_RESET_ZYNQ is not set
+# CONFIG_RFD77402 is not set
+# CONFIG_RFD_FTL is not set
+CONFIG_RFKILL=y
+# CONFIG_RFKILL_FULL is not set
+# CONFIG_RFKILL_GPIO is not set
+# CONFIG_RFKILL_INPUT is not set
+# CONFIG_RFKILL_LEDS is not set
+# CONFIG_RFKILL_REGULATOR is not set
+# CONFIG_RICHTEK_RTQ6056 is not set
+# CONFIG_RING_BUFFER_BENCHMARK is not set
+# CONFIG_RING_BUFFER_STARTUP_TEST is not set
+# CONFIG_RING_BUFFER_VALIDATE_TIME_DELTAS is not set
+# CONFIG_RMI4_CORE is not set
+# CONFIG_RMNET is not set
+# CONFIG_ROCKCHIP_PHY is not set
+# CONFIG_ROCKER is not set
+# CONFIG_ROMFS_FS is not set
+# CONFIG_ROSE is not set
+# CONFIG_RPCSEC_GSS_KRB5 is not set
+# CONFIG_RPMSG_QCOM_GLINK_RPM is not set
+# CONFIG_RPMSG_VIRTIO is not set
+# CONFIG_RPMSG_WWAN_CTRL is not set
+# CONFIG_RPR0521 is not set
+# CONFIG_RSEQ is not set
+# CONFIG_RT2X00 is not set
+# CONFIG_RTC_CLASS is not set
+# CONFIG_RTC_DEBUG is not set
+# CONFIG_RTC_DRV_ABB5ZES3 is not set
+# CONFIG_RTC_DRV_ABEOZ9 is not set
+# CONFIG_RTC_DRV_ABX80X is not set
+# CONFIG_RTC_DRV_ARMADA38X is not set
+# CONFIG_RTC_DRV_AU1XXX is not set
+# CONFIG_RTC_DRV_BQ32K is not set
+# CONFIG_RTC_DRV_BQ4802 is not set
+# CONFIG_RTC_DRV_CADENCE is not set
+CONFIG_RTC_DRV_CMOS=y
+# CONFIG_RTC_DRV_DS1286 is not set
+# CONFIG_RTC_DRV_DS1302 is not set
+# CONFIG_RTC_DRV_DS1305 is not set
+# CONFIG_RTC_DRV_DS1307 is not set
+# CONFIG_RTC_DRV_DS1307_CENTURY is not set
+# CONFIG_RTC_DRV_DS1307_HWMON is not set
+# CONFIG_RTC_DRV_DS1343 is not set
+# CONFIG_RTC_DRV_DS1347 is not set
+# CONFIG_RTC_DRV_DS1374 is not set
+# CONFIG_RTC_DRV_DS1390 is not set
+# CONFIG_RTC_DRV_DS1511 is not set
+# CONFIG_RTC_DRV_DS1553 is not set
+# CONFIG_RTC_DRV_DS1672 is not set
+# CONFIG_RTC_DRV_DS1685_FAMILY is not set
+# CONFIG_RTC_DRV_DS1742 is not set
+# CONFIG_RTC_DRV_DS2404 is not set
+# CONFIG_RTC_DRV_DS3232 is not set
+# CONFIG_RTC_DRV_DS3234 is not set
+# CONFIG_RTC_DRV_EM3027 is not set
+# CONFIG_RTC_DRV_EP93XX is not set
+# CONFIG_RTC_DRV_FM3130 is not set
+# CONFIG_RTC_DRV_FTRTC010 is not set
+# CONFIG_RTC_DRV_GENERIC is not set
+# CONFIG_RTC_DRV_GOLDFISH is not set
+# CONFIG_RTC_DRV_HID_SENSOR_TIME is not set
+# CONFIG_RTC_DRV_HYM8563 is not set
+# CONFIG_RTC_DRV_ISL12022 is not set
+# CONFIG_RTC_DRV_ISL12026 is not set
+# CONFIG_RTC_DRV_ISL12057 is not set
+# CONFIG_RTC_DRV_ISL1208 is not set
+# CONFIG_RTC_DRV_JZ4740 is not set
+# CONFIG_RTC_DRV_M41T80 is not set
+# CONFIG_RTC_DRV_M41T93 is not set
+# CONFIG_RTC_DRV_M41T94 is not set
+# CONFIG_RTC_DRV_M48T35 is not set
+# CONFIG_RTC_DRV_M48T59 is not set
+# CONFIG_RTC_DRV_M48T86 is not set
+# CONFIG_RTC_DRV_MAX6900 is not set
+# CONFIG_RTC_DRV_MAX6902 is not set
+# CONFIG_RTC_DRV_MAX6916 is not set
+# CONFIG_RTC_DRV_MAX77686 is not set
+# CONFIG_RTC_DRV_MCP795 is not set
+# CONFIG_RTC_DRV_MOXART is not set
+# CONFIG_RTC_DRV_MPC5121 is not set
+# CONFIG_RTC_DRV_MSM6242 is not set
+# CONFIG_RTC_DRV_MT2712 is not set
+# CONFIG_RTC_DRV_NCT3018Y is not set
+# CONFIG_RTC_DRV_OMAP is not set
+# CONFIG_RTC_DRV_PCF2123 is not set
+# CONFIG_RTC_DRV_PCF2127 is not set
+# CONFIG_RTC_DRV_PCF85063 is not set
+# CONFIG_RTC_DRV_PCF8523 is not set
+# CONFIG_RTC_DRV_PCF85363 is not set
+# CONFIG_RTC_DRV_PCF8563 is not set
+# CONFIG_RTC_DRV_PCF8583 is not set
+# CONFIG_RTC_DRV_PL030 is not set
+# CONFIG_RTC_DRV_PL031 is not set
+# CONFIG_RTC_DRV_PS3 is not set
+# CONFIG_RTC_DRV_PT7C4338 is not set
+# CONFIG_RTC_DRV_R7301 is not set
+# CONFIG_RTC_DRV_R9701 is not set
+# CONFIG_RTC_DRV_RP5C01 is not set
+# CONFIG_RTC_DRV_RS5C348 is not set
+# CONFIG_RTC_DRV_RS5C372 is not set
+# CONFIG_RTC_DRV_RTC7301 is not set
+# CONFIG_RTC_DRV_RV3028 is not set
+# CONFIG_RTC_DRV_RV3029C2 is not set
+# CONFIG_RTC_DRV_RV3032 is not set
+# CONFIG_RTC_DRV_RV8803 is not set
+# CONFIG_RTC_DRV_RX4581 is not set
+# CONFIG_RTC_DRV_RX6110 is not set
+# CONFIG_RTC_DRV_RX8010 is not set
+# CONFIG_RTC_DRV_RX8025 is not set
+# CONFIG_RTC_DRV_RX8581 is not set
+# CONFIG_RTC_DRV_S35390A is not set
+# CONFIG_RTC_DRV_SD3078 is not set
+# CONFIG_RTC_DRV_SNVS is not set
+# CONFIG_RTC_DRV_STK17TA8 is not set
+# CONFIG_RTC_DRV_SUN6I is not set
+# CONFIG_RTC_DRV_TEGRA is not set
+# CONFIG_RTC_DRV_TEST is not set
+# CONFIG_RTC_DRV_V3020 is not set
+# CONFIG_RTC_DRV_X1205 is not set
+# CONFIG_RTC_DRV_XGENE is not set
+# CONFIG_RTC_DRV_ZYNQMP is not set
+CONFIG_RTC_HCTOSYS=y
+CONFIG_RTC_HCTOSYS_DEVICE="rtc0"
+CONFIG_RTC_INTF_DEV=y
+# CONFIG_RTC_INTF_DEV_UIE_EMUL is not set
+CONFIG_RTC_INTF_PROC=y
+CONFIG_RTC_INTF_SYSFS=y
+CONFIG_RTC_LIB=y
+# CONFIG_RTC_NVMEM is not set
+CONFIG_RTC_SYSTOHC=y
+CONFIG_RTC_SYSTOHC_DEVICE="rtc0"
+# CONFIG_RTL8180 is not set
+# CONFIG_RTL8187 is not set
+# CONFIG_RTL8192E is not set
+# CONFIG_RTL8192U is not set
+# CONFIG_RTL8306_PHY is not set
+# CONFIG_RTL8366RB_PHY is not set
+# CONFIG_RTL8366S_PHY is not set
+# CONFIG_RTL8366_SMI is not set
+# CONFIG_RTL8366_SMI_DEBUG_FS is not set
+# CONFIG_RTL8367B_PHY is not set
+# CONFIG_RTL8367_PHY is not set
+# CONFIG_RTLLIB is not set
+# CONFIG_RTL_CARDS is not set
+# CONFIG_RTS5208 is not set
+CONFIG_RT_MUTEXES=y
+# CONFIG_RUNTIME_DEBUG is not set
+CONFIG_RUNTIME_TESTING_MENU=y
+# CONFIG_RV is not set
+CONFIG_RWSEM_GENERIC_SPINLOCK=y
+CONFIG_RXKAD=y
+# CONFIG_S2IO is not set
+# CONFIG_SAMPLES is not set
+# CONFIG_SAMSUNG_LAPTOP is not set
+# CONFIG_SATA_ACARD_AHCI is not set
+# CONFIG_SATA_AHCI is not set
+# CONFIG_SATA_AHCI_PLATFORM is not set
+# CONFIG_SATA_DWC is not set
+# CONFIG_SATA_DWC_OLD_DMA is not set
+# CONFIG_SATA_FSL is not set
+# CONFIG_SATA_HIGHBANK is not set
+# CONFIG_SATA_HOST is not set
+# CONFIG_SATA_INIC162X is not set
+CONFIG_SATA_MOBILE_LPM_POLICY=0
+# CONFIG_SATA_MV is not set
+# CONFIG_SATA_NV is not set
+# CONFIG_SATA_PMP is not set
+# CONFIG_SATA_PROMISE is not set
+# CONFIG_SATA_QSTOR is not set
+# CONFIG_SATA_RCAR is not set
+# CONFIG_SATA_SIL is not set
+# CONFIG_SATA_SIL24 is not set
+# CONFIG_SATA_SIS is not set
+# CONFIG_SATA_SVW is not set
+# CONFIG_SATA_SX4 is not set
+# CONFIG_SATA_ULI is not set
+# CONFIG_SATA_VIA is not set
+# CONFIG_SATA_VITESSE is not set
+# CONFIG_SBC_FITPC2_WATCHDOG is not set
+CONFIG_SBITMAP=y
+# CONFIG_SC92031 is not set
+# CONFIG_SCA3000 is not set
+# CONFIG_SCA3300 is not set
+# CONFIG_SCACHE_DEBUGFS is not set
+# CONFIG_SCC is not set
+# CONFIG_SCD30_CORE is not set
+# CONFIG_SCD4X is not set
+# CONFIG_SCF_TORTURE_TEST is not set
+# CONFIG_SCHEDSTATS is not set
+# CONFIG_SCHED_AUTOGROUP is not set
+# CONFIG_SCHED_CLUSTER is not set
+# CONFIG_SCHED_DEBUG is not set
+CONFIG_SCHED_HRTICK=y
+# CONFIG_SCHED_MC is not set
+CONFIG_SCHED_OMIT_FRAME_POINTER=y
+# CONFIG_SCHED_SMT is not set
+CONFIG_SCHED_STACK_END_CHECK=y
+# CONFIG_SCHED_TRACER is not set
+# CONFIG_SCR24X is not set
+# CONFIG_SCSI is not set
+# CONFIG_SCSI_3W_9XXX is not set
+# CONFIG_SCSI_3W_SAS is not set
+# CONFIG_SCSI_7000FASST is not set
+# CONFIG_SCSI_AACRAID is not set
+# CONFIG_SCSI_ACARD is not set
+# CONFIG_SCSI_ADVANSYS is not set
+# CONFIG_SCSI_AHA152X is not set
+# CONFIG_SCSI_AHA1542 is not set
+# CONFIG_SCSI_AIC79XX is not set
+# CONFIG_SCSI_AIC7XXX is not set
+# CONFIG_SCSI_AIC94XX is not set
+# CONFIG_SCSI_AM53C974 is not set
+# CONFIG_SCSI_ARCMSR is not set
+# CONFIG_SCSI_BFA_FC is not set
+# CONFIG_SCSI_BNX2X_FCOE is not set
+# CONFIG_SCSI_BNX2_ISCSI is not set
+# CONFIG_SCSI_BUSLOGIC is not set
+# CONFIG_SCSI_CHELSIO_FCOE is not set
+# CONFIG_SCSI_CONSTANTS is not set
+# CONFIG_SCSI_CXGB3_ISCSI is not set
+# CONFIG_SCSI_CXGB4_ISCSI is not set
+# CONFIG_SCSI_DC395x is not set
+# CONFIG_SCSI_DEBUG is not set
+# CONFIG_SCSI_DH is not set
+CONFIG_SCSI_DMA=y
+# CONFIG_SCSI_DMX3191D is not set
+# CONFIG_SCSI_DPT_I2O is not set
+# CONFIG_SCSI_DTC3280 is not set
+# CONFIG_SCSI_EATA is not set
+# CONFIG_SCSI_ESAS2R is not set
+# CONFIG_SCSI_FC_ATTRS is not set
+# CONFIG_SCSI_FDOMAIN_PCI is not set
+# CONFIG_SCSI_FUTURE_DOMAIN is not set
+# CONFIG_SCSI_GDTH is not set
+# CONFIG_SCSI_GENERIC_NCR5380 is not set
+# CONFIG_SCSI_GENERIC_NCR5380_MMIO is not set
+# CONFIG_SCSI_HISI_SAS is not set
+# CONFIG_SCSI_HPSA is not set
+# CONFIG_SCSI_HPTIOP is not set
+# CONFIG_SCSI_IN2000 is not set
+# CONFIG_SCSI_INIA100 is not set
+# CONFIG_SCSI_INITIO is not set
+# CONFIG_SCSI_IPR is not set
+# CONFIG_SCSI_IPS is not set
+# CONFIG_SCSI_ISCI is not set
+# CONFIG_SCSI_ISCSI_ATTRS is not set
+# CONFIG_SCSI_LOGGING is not set
+CONFIG_SCSI_LOWLEVEL=y
+# CONFIG_SCSI_LOWLEVEL_PCMCIA is not set
+# CONFIG_SCSI_LPFC is not set
+CONFIG_SCSI_MOD=y
+# CONFIG_SCSI_MPI3MR is not set
+# CONFIG_SCSI_MPT2SAS is not set
+# CONFIG_SCSI_MPT3SAS is not set
+# CONFIG_SCSI_MQ_DEFAULT is not set
+# CONFIG_SCSI_MVSAS is not set
+# CONFIG_SCSI_MVSAS_DEBUG is not set
+# CONFIG_SCSI_MVUMI is not set
+# CONFIG_SCSI_MYRB is not set
+# CONFIG_SCSI_MYRS is not set
+# CONFIG_SCSI_NCR53C406A is not set
+# CONFIG_SCSI_NETLINK is not set
+# CONFIG_SCSI_NSP32 is not set
+# CONFIG_SCSI_OSD_INITIATOR is not set
+# CONFIG_SCSI_PAS16 is not set
+# CONFIG_SCSI_PM8001 is not set
+# CONFIG_SCSI_PMCRAID is not set
+CONFIG_SCSI_PROC_FS=y
+# CONFIG_SCSI_QLA_FC is not set
+# CONFIG_SCSI_QLA_ISCSI is not set
+# CONFIG_SCSI_QLOGIC_1280 is not set
+# CONFIG_SCSI_QLOGIC_FAS is not set
+# CONFIG_SCSI_SAS_ATTRS is not set
+# CONFIG_SCSI_SAS_LIBSAS is not set
+# CONFIG_SCSI_SCAN_ASYNC is not set
+# CONFIG_SCSI_SMARTPQI is not set
+# CONFIG_SCSI_SNIC is not set
+# CONFIG_SCSI_SPI_ATTRS is not set
+# CONFIG_SCSI_SRP_ATTRS is not set
+# CONFIG_SCSI_STEX is not set
+# CONFIG_SCSI_SYM53C416 is not set
+# CONFIG_SCSI_SYM53C8XX_2 is not set
+# CONFIG_SCSI_T128 is not set
+# CONFIG_SCSI_U14_34F is not set
+# CONFIG_SCSI_UFSHCD is not set
+# CONFIG_SCSI_ULTRASTOR is not set
+# CONFIG_SCSI_VIRTIO is not set
+# CONFIG_SCSI_WD719X is not set
+# CONFIG_SC_CAMCC_7180 is not set
+# CONFIG_SC_DISPCC_7280 is not set
+# CONFIG_SC_GCC_7280 is not set
+# CONFIG_SC_GCC_8180X is not set
+# CONFIG_SC_GPUCC_7280 is not set
+# CONFIG_SC_GPUCC_8280XP is not set
+# CONFIG_SC_VIDEOCC_7280 is not set
+# CONFIG_SCx200_ACB is not set
+# CONFIG_SDIO_UART is not set
+# CONFIG_SDM_GPUCC_660 is not set
+# CONFIG_SDM_MMCC_660 is not set
+# CONFIG_SDR_MAX2175 is not set
+# CONFIG_SDR_PLATFORM_DRIVERS is not set
+# CONFIG_SDX_GCC_55 is not set
+# CONFIG_SD_ADC_MODULATOR is not set
+# CONFIG_SECCOMP is not set
+# CONFIG_SECCOMP_CACHE_DEBUG is not set
+CONFIG_SECTION_MISMATCH_WARN_ONLY=y
+# CONFIG_SECURITY is not set
+# CONFIG_SECURITYFS is not set
+# CONFIG_SECURITY_APPARMOR is not set
+CONFIG_SECURITY_DMESG_RESTRICT=y
+# CONFIG_SECURITY_LANDLOCK is not set
+# CONFIG_SECURITY_LOADPIN is not set
+# CONFIG_SECURITY_LOCKDOWN_LSM is not set
+# CONFIG_SECURITY_NETWORK_XFRM is not set
+# CONFIG_SECURITY_PATH is not set
+# CONFIG_SECURITY_SAFESETID is not set
+# CONFIG_SECURITY_SELINUX_AVC_STATS is not set
+# CONFIG_SECURITY_SELINUX_BOOTPARAM is not set
+CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=0
+# CONFIG_SECURITY_SELINUX_DEVELOP is not set
+# CONFIG_SECURITY_SELINUX_DISABLE is not set
+# CONFIG_SECURITY_SMACK is not set
+# CONFIG_SECURITY_TOMOYO is not set
+# CONFIG_SECURITY_YAMA is not set
+CONFIG_SELECT_MEMORY_MODEL=y
+# CONFIG_SENSEAIR_SUNRISE_CO2 is not set
+# CONFIG_SENSIRION_SGP30 is not set
+# CONFIG_SENSIRION_SGP40 is not set
+# CONFIG_SENSORS_ABITUGURU is not set
+# CONFIG_SENSORS_ABITUGURU3 is not set
+# CONFIG_SENSORS_ACPI_POWER is not set
+# CONFIG_SENSORS_AD7314 is not set
+# CONFIG_SENSORS_AD7414 is not set
+# CONFIG_SENSORS_AD7418 is not set
+# CONFIG_SENSORS_ADC128D818 is not set
+# CONFIG_SENSORS_ADCXX is not set
+# CONFIG_SENSORS_ADM1021 is not set
+# CONFIG_SENSORS_ADM1025 is not set
+# CONFIG_SENSORS_ADM1026 is not set
+# CONFIG_SENSORS_ADM1029 is not set
+# CONFIG_SENSORS_ADM1031 is not set
+# CONFIG_SENSORS_ADM1177 is not set
+# CONFIG_SENSORS_ADM1266 is not set
+# CONFIG_SENSORS_ADM1275 is not set
+# CONFIG_SENSORS_ADM9240 is not set
+# CONFIG_SENSORS_ADS1015 is not set
+# CONFIG_SENSORS_ADS7828 is not set
+# CONFIG_SENSORS_ADS7871 is not set
+# CONFIG_SENSORS_ADT7310 is not set
+# CONFIG_SENSORS_ADT7410 is not set
+# CONFIG_SENSORS_ADT7411 is not set
+# CONFIG_SENSORS_ADT7462 is not set
+# CONFIG_SENSORS_ADT7470 is not set
+# CONFIG_SENSORS_ADT7475 is not set
+# CONFIG_SENSORS_AHT10 is not set
+# CONFIG_SENSORS_AMC6821 is not set
+# CONFIG_SENSORS_APDS990X is not set
+# CONFIG_SENSORS_APPLESMC is not set
+# CONFIG_SENSORS_AQUACOMPUTER_D5NEXT is not set
+# CONFIG_SENSORS_AS370 is not set
+# CONFIG_SENSORS_ASB100 is not set
+# CONFIG_SENSORS_ASC7621 is not set
+# CONFIG_SENSORS_ASPEED is not set
+# CONFIG_SENSORS_ATK0110 is not set
+# CONFIG_SENSORS_ATXP1 is not set
+# CONFIG_SENSORS_AXI_FAN_CONTROL is not set
+# CONFIG_SENSORS_BEL_PFE is not set
+# CONFIG_SENSORS_BH1770 is not set
+# CONFIG_SENSORS_BH1780 is not set
+# CONFIG_SENSORS_BPA_RS600 is not set
+# CONFIG_SENSORS_CORETEMP is not set
+# CONFIG_SENSORS_CORSAIR_CPRO is not set
+# CONFIG_SENSORS_CORSAIR_PSU is not set
+# CONFIG_SENSORS_DELL_SMM is not set
+# CONFIG_SENSORS_DELTA_AHE50DC_FAN is not set
+# CONFIG_SENSORS_DME1737 is not set
+# CONFIG_SENSORS_DPS920AB is not set
+# CONFIG_SENSORS_DRIVETEMP is not set
+# CONFIG_SENSORS_DS1621 is not set
+# CONFIG_SENSORS_DS620 is not set
+# CONFIG_SENSORS_EMC1403 is not set
+# CONFIG_SENSORS_EMC2103 is not set
+# CONFIG_SENSORS_EMC2305 is not set
+# CONFIG_SENSORS_EMC6W201 is not set
+# CONFIG_SENSORS_F71805F is not set
+# CONFIG_SENSORS_F71882FG is not set
+# CONFIG_SENSORS_F75375S is not set
+# CONFIG_SENSORS_FAM15H_POWER is not set
+# CONFIG_SENSORS_FSCHMD is not set
+# CONFIG_SENSORS_FSP_3Y is not set
+# CONFIG_SENSORS_FTSTEUTATES is not set
+# CONFIG_SENSORS_G760A is not set
+# CONFIG_SENSORS_G762 is not set
+# CONFIG_SENSORS_GL518SM is not set
+# CONFIG_SENSORS_GL520SM is not set
+# CONFIG_SENSORS_GPIO_FAN is not set
+# CONFIG_SENSORS_GSC is not set
+# CONFIG_SENSORS_HDAPS is not set
+# CONFIG_SENSORS_HIH6130 is not set
+# CONFIG_SENSORS_HMC5843 is not set
+# CONFIG_SENSORS_HMC5843_I2C is not set
+# CONFIG_SENSORS_HMC5843_SPI is not set
+# CONFIG_SENSORS_HTU21 is not set
+# CONFIG_SENSORS_I5500 is not set
+# CONFIG_SENSORS_I5K_AMB is not set
+# CONFIG_SENSORS_IBM_CFFPS is not set
+# CONFIG_SENSORS_IIO_HWMON is not set
+# CONFIG_SENSORS_INA209 is not set
+# CONFIG_SENSORS_INA238 is not set
+# CONFIG_SENSORS_INA2XX is not set
+# CONFIG_SENSORS_INA3221 is not set
+# CONFIG_SENSORS_INSPUR_IPSPS is not set
+# CONFIG_SENSORS_IR35221 is not set
+# CONFIG_SENSORS_IR36021 is not set
+# CONFIG_SENSORS_IR38064 is not set
+# CONFIG_SENSORS_IRPS5401 is not set
+# CONFIG_SENSORS_ISL29018 is not set
+# CONFIG_SENSORS_ISL29028 is not set
+# CONFIG_SENSORS_ISL68137 is not set
+# CONFIG_SENSORS_IT87 is not set
+# CONFIG_SENSORS_JC42 is not set
+# CONFIG_SENSORS_K10TEMP is not set
+# CONFIG_SENSORS_K8TEMP is not set
+# CONFIG_SENSORS_LINEAGE is not set
+# CONFIG_SENSORS_LIS3LV02D is not set
+# CONFIG_SENSORS_LIS3_I2C is not set
+# CONFIG_SENSORS_LIS3_SPI is not set
+# CONFIG_SENSORS_LM25066 is not set
+# CONFIG_SENSORS_LM63 is not set
+# CONFIG_SENSORS_LM70 is not set
+# CONFIG_SENSORS_LM73 is not set
+# CONFIG_SENSORS_LM75 is not set
+# CONFIG_SENSORS_LM77 is not set
+# CONFIG_SENSORS_LM78 is not set
+# CONFIG_SENSORS_LM80 is not set
+# CONFIG_SENSORS_LM83 is not set
+# CONFIG_SENSORS_LM85 is not set
+# CONFIG_SENSORS_LM87 is not set
+# CONFIG_SENSORS_LM90 is not set
+# CONFIG_SENSORS_LM92 is not set
+# CONFIG_SENSORS_LM93 is not set
+# CONFIG_SENSORS_LM95234 is not set
+# CONFIG_SENSORS_LM95241 is not set
+# CONFIG_SENSORS_LM95245 is not set
+# CONFIG_SENSORS_LT7182S is not set
+# CONFIG_SENSORS_LTC2945 is not set
+# CONFIG_SENSORS_LTC2947_I2C is not set
+# CONFIG_SENSORS_LTC2947_SPI is not set
+# CONFIG_SENSORS_LTC2978 is not set
+# CONFIG_SENSORS_LTC2990 is not set
+# CONFIG_SENSORS_LTC2992 is not set
+# CONFIG_SENSORS_LTC3815 is not set
+# CONFIG_SENSORS_LTC4151 is not set
+# CONFIG_SENSORS_LTC4215 is not set
+# CONFIG_SENSORS_LTC4222 is not set
+# CONFIG_SENSORS_LTC4245 is not set
+# CONFIG_SENSORS_LTC4260 is not set
+# CONFIG_SENSORS_LTC4261 is not set
+# CONFIG_SENSORS_LTQ_CPUTEMP is not set
+# CONFIG_SENSORS_MAX1111 is not set
+# CONFIG_SENSORS_MAX127 is not set
+# CONFIG_SENSORS_MAX15301 is not set
+# CONFIG_SENSORS_MAX16064 is not set
+# CONFIG_SENSORS_MAX16065 is not set
+# CONFIG_SENSORS_MAX1619 is not set
+# CONFIG_SENSORS_MAX16601 is not set
+# CONFIG_SENSORS_MAX1668 is not set
+# CONFIG_SENSORS_MAX197 is not set
+# CONFIG_SENSORS_MAX20730 is not set
+# CONFIG_SENSORS_MAX20751 is not set
+# CONFIG_SENSORS_MAX31722 is not set
+# CONFIG_SENSORS_MAX31730 is not set
+# CONFIG_SENSORS_MAX31760 is not set
+# CONFIG_SENSORS_MAX31785 is not set
+# CONFIG_SENSORS_MAX31790 is not set
+# CONFIG_SENSORS_MAX34440 is not set
+# CONFIG_SENSORS_MAX6620 is not set
+# CONFIG_SENSORS_MAX6621 is not set
+# CONFIG_SENSORS_MAX6639 is not set
+# CONFIG_SENSORS_MAX6642 is not set
+# CONFIG_SENSORS_MAX6650 is not set
+# CONFIG_SENSORS_MAX6697 is not set
+# CONFIG_SENSORS_MAX8688 is not set
+# CONFIG_SENSORS_MCP3021 is not set
+# CONFIG_SENSORS_MP2888 is not set
+# CONFIG_SENSORS_MP2975 is not set
+# CONFIG_SENSORS_MP5023 is not set
+# CONFIG_SENSORS_MR75203 is not set
+# CONFIG_SENSORS_NCT6683 is not set
+# CONFIG_SENSORS_NCT6775 is not set
+# CONFIG_SENSORS_NCT6775_I2C is not set
+# CONFIG_SENSORS_NCT7802 is not set
+# CONFIG_SENSORS_NCT7904 is not set
+# CONFIG_SENSORS_NPCM7XX is not set
+# CONFIG_SENSORS_NSA320 is not set
+# CONFIG_SENSORS_NTC_THERMISTOR is not set
+# CONFIG_SENSORS_NZXT_KRAKEN2 is not set
+# CONFIG_SENSORS_NZXT_SMART2 is not set
+# CONFIG_SENSORS_OCC_P8_I2C is not set
+# CONFIG_SENSORS_PC87360 is not set
+# CONFIG_SENSORS_PC87427 is not set
+# CONFIG_SENSORS_PCF8591 is not set
+# CONFIG_SENSORS_PIM4328 is not set
+# CONFIG_SENSORS_PLI1209BC is not set
+# CONFIG_SENSORS_PM6764TR is not set
+# CONFIG_SENSORS_PMBUS is not set
+# CONFIG_SENSORS_POWR1220 is not set
+# CONFIG_SENSORS_PWM_FAN is not set
+# CONFIG_SENSORS_PXE1610 is not set
+# CONFIG_SENSORS_Q54SJ108A2 is not set
+# CONFIG_SENSORS_RM3100_I2C is not set
+# CONFIG_SENSORS_RM3100_SPI is not set
+# CONFIG_SENSORS_SBRMI is not set
+# CONFIG_SENSORS_SBTSI is not set
+# CONFIG_SENSORS_SCH5627 is not set
+# CONFIG_SENSORS_SCH5636 is not set
+# CONFIG_SENSORS_SCH56XX_COMMON is not set
+# CONFIG_SENSORS_SHT15 is not set
+# CONFIG_SENSORS_SHT21 is not set
+# CONFIG_SENSORS_SHT3x is not set
+# CONFIG_SENSORS_SHT4x is not set
+# CONFIG_SENSORS_SHTC1 is not set
+# CONFIG_SENSORS_SIS5595 is not set
+# CONFIG_SENSORS_SMM665 is not set
+# CONFIG_SENSORS_SMSC47B397 is not set
+# CONFIG_SENSORS_SMSC47M1 is not set
+# CONFIG_SENSORS_SMSC47M192 is not set
+# CONFIG_SENSORS_STPDDC60 is not set
+# CONFIG_SENSORS_STTS751 is not set
+# CONFIG_SENSORS_TC654 is not set
+# CONFIG_SENSORS_TC74 is not set
+# CONFIG_SENSORS_THMC50 is not set
+# CONFIG_SENSORS_TMP102 is not set
+# CONFIG_SENSORS_TMP103 is not set
+# CONFIG_SENSORS_TMP108 is not set
+# CONFIG_SENSORS_TMP401 is not set
+# CONFIG_SENSORS_TMP421 is not set
+# CONFIG_SENSORS_TMP464 is not set
+# CONFIG_SENSORS_TMP513 is not set
+# CONFIG_SENSORS_TPS23861 is not set
+# CONFIG_SENSORS_TPS40422 is not set
+# CONFIG_SENSORS_TPS53679 is not set
+# CONFIG_SENSORS_TPS546D24 is not set
+# CONFIG_SENSORS_TSL2550 is not set
+# CONFIG_SENSORS_TSL2563 is not set
+# CONFIG_SENSORS_UCD9000 is not set
+# CONFIG_SENSORS_UCD9200 is not set
+# CONFIG_SENSORS_VEXPRESS is not set
+# CONFIG_SENSORS_VIA686A is not set
+# CONFIG_SENSORS_VIA_CPUTEMP is not set
+# CONFIG_SENSORS_VT1211 is not set
+# CONFIG_SENSORS_VT8231 is not set
+# CONFIG_SENSORS_W83627EHF is not set
+# CONFIG_SENSORS_W83627HF is not set
+# CONFIG_SENSORS_W83773G is not set
+# CONFIG_SENSORS_W83781D is not set
+# CONFIG_SENSORS_W83791D is not set
+# CONFIG_SENSORS_W83792D is not set
+# CONFIG_SENSORS_W83793 is not set
+# CONFIG_SENSORS_W83795 is not set
+# CONFIG_SENSORS_W83L785TS is not set
+# CONFIG_SENSORS_W83L786NG is not set
+# CONFIG_SENSORS_XDPE122 is not set
+# CONFIG_SENSORS_XDPE152 is not set
+# CONFIG_SENSORS_XGENE is not set
+# CONFIG_SENSORS_ZL6100 is not set
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_16550A_VARIANTS=y
+# CONFIG_SERIAL_8250_ACCENT is not set
+# CONFIG_SERIAL_8250_ASPEED_VUART is not set
+# CONFIG_SERIAL_8250_BOCA is not set
+CONFIG_SERIAL_8250_CONSOLE=y
+# CONFIG_SERIAL_8250_CS is not set
+# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
+# CONFIG_SERIAL_8250_DETECT_IRQ is not set
+CONFIG_SERIAL_8250_DMA=y
+# CONFIG_SERIAL_8250_DW is not set
+# CONFIG_SERIAL_8250_EM is not set
+# CONFIG_SERIAL_8250_EXAR is not set
+# CONFIG_SERIAL_8250_EXAR_ST16C554 is not set
+# CONFIG_SERIAL_8250_EXTENDED is not set
+# CONFIG_SERIAL_8250_FINTEK is not set
+# CONFIG_SERIAL_8250_FOURPORT is not set
+# CONFIG_SERIAL_8250_HUB6 is not set
+# CONFIG_SERIAL_8250_INGENIC is not set
+# CONFIG_SERIAL_8250_LPSS is not set
+# CONFIG_SERIAL_8250_MANY_PORTS is not set
+# CONFIG_SERIAL_8250_MID is not set
+# CONFIG_SERIAL_8250_MOXA is not set
+CONFIG_SERIAL_8250_NR_UARTS=2
+# CONFIG_SERIAL_8250_PCI is not set
+# CONFIG_SERIAL_8250_PERICOM is not set
+# CONFIG_SERIAL_8250_RSA is not set
+# CONFIG_SERIAL_8250_RT288X is not set
+CONFIG_SERIAL_8250_RUNTIME_UARTS=2
+# CONFIG_SERIAL_ALTERA_JTAGUART is not set
+# CONFIG_SERIAL_ALTERA_UART is not set
+# CONFIG_SERIAL_AMBA_PL010 is not set
+# CONFIG_SERIAL_AMBA_PL011 is not set
+# CONFIG_SERIAL_ARC is not set
+# CONFIG_SERIAL_BCM63XX is not set
+# CONFIG_SERIAL_CONEXANT_DIGICOLOR is not set
+CONFIG_SERIAL_CORE=y
+CONFIG_SERIAL_CORE_CONSOLE=y
+# CONFIG_SERIAL_DEV_BUS is not set
+CONFIG_SERIAL_EARLYCON=y
+# CONFIG_SERIAL_EARLYCON_ARM_SEMIHOST is not set
+# CONFIG_SERIAL_FSL_LINFLEXUART is not set
+# CONFIG_SERIAL_FSL_LPUART is not set
+# CONFIG_SERIAL_GRLIB_GAISLER_APBUART is not set
+# CONFIG_SERIAL_IFX6X60 is not set
+# CONFIG_SERIAL_JSM is not set
+# CONFIG_SERIAL_MAX3100 is not set
+# CONFIG_SERIAL_MAX310X is not set
+# CONFIG_SERIAL_NONSTANDARD is not set
+# CONFIG_SERIAL_OF_PLATFORM is not set
+# CONFIG_SERIAL_OF_PLATFORM_NWPSERIAL is not set
+# CONFIG_SERIAL_PCH_UART is not set
+# CONFIG_SERIAL_RP2 is not set
+# CONFIG_SERIAL_SC16IS7XX is not set
+# CONFIG_SERIAL_SCCNXP is not set
+# CONFIG_SERIAL_SH_SCI is not set
+# CONFIG_SERIAL_SIFIVE is not set
+# CONFIG_SERIAL_SPRD is not set
+# CONFIG_SERIAL_STM32 is not set
+# CONFIG_SERIAL_ST_ASC is not set
+# CONFIG_SERIAL_TIMBERDALE is not set
+# CONFIG_SERIAL_UARTLITE is not set
+# CONFIG_SERIAL_XILINX_PS_UART is not set
+# CONFIG_SERIO is not set
+# CONFIG_SERIO_ALTERA_PS2 is not set
+# CONFIG_SERIO_AMBAKMI is not set
+# CONFIG_SERIO_APBPS2 is not set
+# CONFIG_SERIO_ARC_PS2 is not set
+# CONFIG_SERIO_CT82C710 is not set
+# CONFIG_SERIO_GPIO_PS2 is not set
+# CONFIG_SERIO_I8042 is not set
+# CONFIG_SERIO_LIBPS2 is not set
+# CONFIG_SERIO_PARKBD is not set
+# CONFIG_SERIO_PCIPS2 is not set
+# CONFIG_SERIO_PS2MULT is not set
+# CONFIG_SERIO_RAW is not set
+# CONFIG_SERIO_SERPORT is not set
+# CONFIG_SERIO_SUN4I_PS2 is not set
+# CONFIG_SFC is not set
+# CONFIG_SFC_FALCON is not set
+# CONFIG_SFC_SIENA is not set
+# CONFIG_SFI is not set
+# CONFIG_SFP is not set
+# CONFIG_SF_PDMA is not set
+# CONFIG_SGETMASK_SYSCALL is not set
+# CONFIG_SGI_IOC4 is not set
+# CONFIG_SGI_IP22 is not set
+# CONFIG_SGI_IP27 is not set
+# CONFIG_SGI_IP28 is not set
+# CONFIG_SGI_IP30 is not set
+# CONFIG_SGI_IP32 is not set
+# CONFIG_SGI_MFD_IOC3 is not set
+# CONFIG_SGI_PARTITION is not set
+# CONFIG_SG_POOL is not set
+# CONFIG_SG_SPLIT is not set
+# CONFIG_SHADOW_CALL_STACK is not set
+CONFIG_SHMEM=y
+# CONFIG_SHRINKER_DEBUG is not set
+# CONFIG_SHUFFLE_PAGE_ALLOCATOR is not set
+# CONFIG_SH_ETH is not set
+# CONFIG_SH_TIMER_CMT is not set
+# CONFIG_SH_TIMER_MTU2 is not set
+# CONFIG_SH_TIMER_TMU is not set
+# CONFIG_SI1133 is not set
+# CONFIG_SI1145 is not set
+# CONFIG_SI7005 is not set
+# CONFIG_SI7020 is not set
+# CONFIG_SIBYTE_BIGSUR is not set
+# CONFIG_SIBYTE_CARMEL is not set
+# CONFIG_SIBYTE_CRHINE is not set
+# CONFIG_SIBYTE_CRHONE is not set
+# CONFIG_SIBYTE_LITTLESUR is not set
+# CONFIG_SIBYTE_RHONE is not set
+# CONFIG_SIBYTE_SENTOSA is not set
+# CONFIG_SIBYTE_SWARM is not set
+CONFIG_SIGNALFD=y
+# CONFIG_SIGNED_PE_FILE_VERIFICATION is not set
+# CONFIG_SIMPLE_GPIO is not set
+# CONFIG_SIMPLE_PM_BUS is not set
+# CONFIG_SIOX is not set
+# CONFIG_SIS190 is not set
+# CONFIG_SIS900 is not set
+# CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
+# CONFIG_SKY2_DEBUG is not set
+# CONFIG_SLAB is not set
+CONFIG_SLABINFO=y
+CONFIG_SLAB_FREELIST_HARDENED=y
+CONFIG_SLAB_FREELIST_RANDOM=y
+CONFIG_SLAB_MERGE_DEFAULT=y
+# CONFIG_SLHC is not set
+# CONFIG_SLICOSS is not set
+# CONFIG_SLIMBUS is not set
+# CONFIG_SLIP is not set
+# CONFIG_SLOB is not set
+CONFIG_SLUB=y
+CONFIG_SLUB_CPU_PARTIAL=y
+# CONFIG_SLUB_DEBUG is not set
+# CONFIG_SLUB_DEBUG_ON is not set
+# CONFIG_SLUB_MEMCG_SYSFS_ON is not set
+# CONFIG_SLUB_STATS is not set
+# CONFIG_SMARTJOYPLUS_FF is not set
+# CONFIG_SMB_SERVER is not set
+# CONFIG_SMC911X is not set
+# CONFIG_SMC9194 is not set
+# CONFIG_SMC91X is not set
+# CONFIG_SMP is not set
+# CONFIG_SMSC911X is not set
+# CONFIG_SMSC9420 is not set
+# CONFIG_SMSC_PHY is not set
+# CONFIG_SMS_SDIO_DRV is not set
+# CONFIG_SMS_USB_DRV is not set
+# CONFIG_SM_CAMCC_8250 is not set
+# CONFIG_SM_FTL is not set
+# CONFIG_SM_GCC_6115 is not set
+# CONFIG_SM_GCC_6125 is not set
+# CONFIG_SM_GCC_6350 is not set
+# CONFIG_SM_GCC_6375 is not set
+# CONFIG_SM_GCC_8350 is not set
+# CONFIG_SND is not set
+# CONFIG_SND_AC97_POWER_SAVE is not set
+# CONFIG_SND_AD1816A is not set
+# CONFIG_SND_AD1848 is not set
+# CONFIG_SND_AD1889 is not set
+# CONFIG_SND_ADLIB is not set
+# CONFIG_SND_ALI5451 is not set
+# CONFIG_SND_ALOOP is not set
+# CONFIG_SND_ALS100 is not set
+# CONFIG_SND_ALS300 is not set
+# CONFIG_SND_ALS4000 is not set
+# CONFIG_SND_AMD_ACP_CONFIG is not set
+# CONFIG_SND_ARM is not set
+# CONFIG_SND_ASIHPI is not set
+# CONFIG_SND_ATIIXP is not set
+# CONFIG_SND_ATIIXP_MODEM is not set
+# CONFIG_SND_ATMEL_AC97C is not set
+# CONFIG_SND_ATMEL_SOC is not set
+# CONFIG_SND_AU8810 is not set
+# CONFIG_SND_AU8820 is not set
+# CONFIG_SND_AU8830 is not set
+# CONFIG_SND_AUDIO_GRAPH_CARD is not set
+# CONFIG_SND_AUDIO_GRAPH_CARD2 is not set
+# CONFIG_SND_AUDIO_GRAPH_SCU_CARD is not set
+# CONFIG_SND_AW2 is not set
+# CONFIG_SND_AZT2320 is not set
+# CONFIG_SND_AZT3328 is not set
+# CONFIG_SND_BCD2000 is not set
+# CONFIG_SND_BCM63XX_I2S_WHISTLER is not set
+# CONFIG_SND_BT87X is not set
+# CONFIG_SND_CA0106 is not set
+# CONFIG_SND_CMI8330 is not set
+# CONFIG_SND_CMIPCI is not set
+# CONFIG_SND_CS4231 is not set
+# CONFIG_SND_CS4236 is not set
+# CONFIG_SND_CS4281 is not set
+# CONFIG_SND_CS46XX is not set
+# CONFIG_SND_CS5530 is not set
+# CONFIG_SND_CS5535AUDIO is not set
+# CONFIG_SND_CTL_FAST_LOOKUP is not set
+# CONFIG_SND_CTL_INPUT_VALIDATION is not set
+# CONFIG_SND_CTXFI is not set
+# CONFIG_SND_DARLA20 is not set
+# CONFIG_SND_DARLA24 is not set
+# CONFIG_SND_DEBUG is not set
+# CONFIG_SND_DESIGNWARE_I2S is not set
+CONFIG_SND_DRIVERS=y
+# CONFIG_SND_DUMMY is not set
+# CONFIG_SND_DYNAMIC_MINORS is not set
+# CONFIG_SND_ECHO3G is not set
+# CONFIG_SND_EDMA_SOC is not set
+# CONFIG_SND_EMU10K1 is not set
+# CONFIG_SND_EMU10K1X is not set
+# CONFIG_SND_EMU10K1_SEQ is not set
+# CONFIG_SND_ENS1370 is not set
+# CONFIG_SND_ENS1371 is not set
+# CONFIG_SND_ES1688 is not set
+# CONFIG_SND_ES18XX is not set
+# CONFIG_SND_ES1938 is not set
+# CONFIG_SND_ES1968 is not set
+# CONFIG_SND_FIREWIRE is not set
+# CONFIG_SND_FM801 is not set
+# CONFIG_SND_GINA20 is not set
+# CONFIG_SND_GINA24 is not set
+# CONFIG_SND_GUSCLASSIC is not set
+# CONFIG_SND_GUSEXTREME is not set
+# CONFIG_SND_GUSMAX is not set
+# CONFIG_SND_HDA_CODEC_CS8409 is not set
+# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_HDA_INTEL_DETECT_DMIC is not set
+# CONFIG_SND_HDA_INTEL_HDMI_SILENT_STREAM is not set
+CONFIG_SND_HDA_POWER_SAVE_DEFAULT=0
+CONFIG_SND_HDA_PREALLOC_SIZE=64
+# CONFIG_SND_HDSP is not set
+# CONFIG_SND_HDSPM is not set
+# CONFIG_SND_HRTIMER is not set
+# CONFIG_SND_HWDEP is not set
+# CONFIG_SND_I2S_HI6210_I2S is not set
+# CONFIG_SND_ICE1712 is not set
+# CONFIG_SND_ICE1724 is not set
+# CONFIG_SND_INDIGO is not set
+# CONFIG_SND_INDIGODJ is not set
+# CONFIG_SND_INDIGODJX is not set
+# CONFIG_SND_INDIGOIO is not set
+# CONFIG_SND_INDIGOIOX is not set
+# CONFIG_SND_INTEL8X0 is not set
+# CONFIG_SND_INTEL8X0M is not set
+# CONFIG_SND_INTERWAVE is not set
+# CONFIG_SND_INTERWAVE_STB is not set
+# CONFIG_SND_ISA is not set
+# CONFIG_SND_JZ4740_SOC_I2S is not set
+# CONFIG_SND_KIRKWOOD_SOC is not set
+# CONFIG_SND_KORG1212 is not set
+# CONFIG_SND_LAYLA20 is not set
+# CONFIG_SND_LAYLA24 is not set
+# CONFIG_SND_LOLA is not set
+# CONFIG_SND_LX6464ES is not set
+# CONFIG_SND_MAESTRO3 is not set
+CONFIG_SND_MAX_CARDS=16
+# CONFIG_SND_MIA is not set
+# CONFIG_SND_MIPS is not set
+# CONFIG_SND_MIRO is not set
+# CONFIG_SND_MIXART is not set
+# CONFIG_SND_MIXER_OSS is not set
+# CONFIG_SND_MONA is not set
+# CONFIG_SND_MPC52xx_SOC_EFIKA is not set
+# CONFIG_SND_MPU401 is not set
+# CONFIG_SND_MTPAV is not set
+# CONFIG_SND_MTS64 is not set
+# CONFIG_SND_MXS_SOC is not set
+# CONFIG_SND_NM256 is not set
+# CONFIG_SND_OPL3SA2 is not set
+# CONFIG_SND_OPL3_LIB_SEQ is not set
+# CONFIG_SND_OPL4_LIB_SEQ is not set
+# CONFIG_SND_OPTI92X_AD1848 is not set
+# CONFIG_SND_OPTI92X_CS4231 is not set
+# CONFIG_SND_OPTI93X is not set
+CONFIG_SND_OSSEMUL=y
+# CONFIG_SND_OXYGEN is not set
+CONFIG_SND_PCI=y
+# CONFIG_SND_PCM is not set
+# CONFIG_SND_PCMCIA is not set
+# CONFIG_SND_PCM_OSS is not set
+CONFIG_SND_PCM_OSS_PLUGINS=y
+# CONFIG_SND_PCM_TIMER is not set
+# CONFIG_SND_PCM_XRUN_DEBUG is not set
+# CONFIG_SND_PCXHR is not set
+# CONFIG_SND_PDAUDIOCF is not set
+# CONFIG_SND_PORTMAN2X4 is not set
+# CONFIG_SND_POWERPC_SOC is not set
+# CONFIG_SND_PPC is not set
+CONFIG_SND_PROC_FS=y
+# CONFIG_SND_RAWMIDI is not set
+# CONFIG_SND_RAWMIDI_SEQ is not set
+# CONFIG_SND_RIPTIDE is not set
+# CONFIG_SND_RME32 is not set
+# CONFIG_SND_RME96 is not set
+# CONFIG_SND_RME9652 is not set
+# CONFIG_SND_RTCTIMER is not set
+# CONFIG_SND_SB16 is not set
+# CONFIG_SND_SB8 is not set
+# CONFIG_SND_SBAWE is not set
+# CONFIG_SND_SBAWE_SEQ is not set
+# CONFIG_SND_SE6X is not set
+# CONFIG_SND_SEQUENCER is not set
+# CONFIG_SND_SERIAL_GENERIC is not set
+# CONFIG_SND_SERIAL_U16550 is not set
+# CONFIG_SND_SIMPLE_CARD is not set
+# CONFIG_SND_SIMPLE_SCU_CARD is not set
+# CONFIG_SND_SIS7019 is not set
+# CONFIG_SND_SOC is not set
+# CONFIG_SND_SOC_AC97_CODEC is not set
+# CONFIG_SND_SOC_AD193X_I2C is not set
+# CONFIG_SND_SOC_AD193X_SPI is not set
+# CONFIG_SND_SOC_ADAU1372_I2C is not set
+# CONFIG_SND_SOC_ADAU1372_SPI is not set
+# CONFIG_SND_SOC_ADAU1701 is not set
+# CONFIG_SND_SOC_ADAU1761_I2C is not set
+# CONFIG_SND_SOC_ADAU1761_SPI is not set
+# CONFIG_SND_SOC_ADAU7002 is not set
+# CONFIG_SND_SOC_ADAU7118_HW is not set
+# CONFIG_SND_SOC_ADAU7118_I2C is not set
+# CONFIG_SND_SOC_ADI is not set
+# CONFIG_SND_SOC_AK4104 is not set
+# CONFIG_SND_SOC_AK4118 is not set
+# CONFIG_SND_SOC_AK4375 is not set
+# CONFIG_SND_SOC_AK4458 is not set
+# CONFIG_SND_SOC_AK4554 is not set
+# CONFIG_SND_SOC_AK4613 is not set
+# CONFIG_SND_SOC_AK4642 is not set
+# CONFIG_SND_SOC_AK5386 is not set
+# CONFIG_SND_SOC_AK5558 is not set
+# CONFIG_SND_SOC_ALC5623 is not set
+# CONFIG_SND_SOC_AMD_ACP is not set
+# CONFIG_SND_SOC_AMD_ACP3x is not set
+# CONFIG_SND_SOC_AMD_ACP5x is not set
+# CONFIG_SND_SOC_AMD_RENOIR is not set
+# CONFIG_SND_SOC_AU1XAUDIO is not set
+# CONFIG_SND_SOC_AU1XPSC is not set
+# CONFIG_SND_SOC_AW8738 is not set
+# CONFIG_SND_SOC_BD28623 is not set
+# CONFIG_SND_SOC_BT_SCO is not set
+# CONFIG_SND_SOC_CS35L32 is not set
+# CONFIG_SND_SOC_CS35L33 is not set
+# CONFIG_SND_SOC_CS35L34 is not set
+# CONFIG_SND_SOC_CS35L35 is not set
+# CONFIG_SND_SOC_CS35L36 is not set
+# CONFIG_SND_SOC_CS35L41_I2C is not set
+# CONFIG_SND_SOC_CS35L41_SPI is not set
+# CONFIG_SND_SOC_CS35L45_I2C is not set
+# CONFIG_SND_SOC_CS35L45_SPI is not set
+# CONFIG_SND_SOC_CS4234 is not set
+# CONFIG_SND_SOC_CS4265 is not set
+# CONFIG_SND_SOC_CS4270 is not set
+# CONFIG_SND_SOC_CS4271 is not set
+# CONFIG_SND_SOC_CS4271_I2C is not set
+# CONFIG_SND_SOC_CS4271_SPI is not set
+# CONFIG_SND_SOC_CS42L42 is not set
+# CONFIG_SND_SOC_CS42L51_I2C is not set
+# CONFIG_SND_SOC_CS42L52 is not set
+# CONFIG_SND_SOC_CS42L56 is not set
+# CONFIG_SND_SOC_CS42L73 is not set
+# CONFIG_SND_SOC_CS42L83 is not set
+# CONFIG_SND_SOC_CS42XX8_I2C is not set
+# CONFIG_SND_SOC_CS43130 is not set
+# CONFIG_SND_SOC_CS4341 is not set
+# CONFIG_SND_SOC_CS4349 is not set
+# CONFIG_SND_SOC_CS53L30 is not set
+# CONFIG_SND_SOC_CX2072X is not set
+# CONFIG_SND_SOC_DA7213 is not set
+# CONFIG_SND_SOC_DIO2125 is not set
+# CONFIG_SND_SOC_DMIC is not set
+# CONFIG_SND_SOC_ES7134 is not set
+# CONFIG_SND_SOC_ES7241 is not set
+# CONFIG_SND_SOC_ES8316 is not set
+# CONFIG_SND_SOC_ES8326 is not set
+# CONFIG_SND_SOC_ES8328 is not set
+# CONFIG_SND_SOC_ES8328_I2C is not set
+# CONFIG_SND_SOC_ES8328_SPI is not set
+# CONFIG_SND_SOC_EUKREA_TLV320 is not set
+# CONFIG_SND_SOC_FSL_ASOC_CARD is not set
+# CONFIG_SND_SOC_FSL_ASRC is not set
+# CONFIG_SND_SOC_FSL_AUD2HTX is not set
+# CONFIG_SND_SOC_FSL_AUDMIX is not set
+# CONFIG_SND_SOC_FSL_ESAI is not set
+# CONFIG_SND_SOC_FSL_MICFIL is not set
+# CONFIG_SND_SOC_FSL_RPMSG is not set
+# CONFIG_SND_SOC_FSL_SAI is not set
+# CONFIG_SND_SOC_FSL_SPDIF is not set
+# CONFIG_SND_SOC_FSL_SSI is not set
+# CONFIG_SND_SOC_FSL_XCVR is not set
+# CONFIG_SND_SOC_GTM601 is not set
+# CONFIG_SND_SOC_HDA is not set
+# CONFIG_SND_SOC_ICS43432 is not set
+# CONFIG_SND_SOC_IMG is not set
+# CONFIG_SND_SOC_IMX_AUDMIX is not set
+# CONFIG_SND_SOC_IMX_AUDMUX is not set
+# CONFIG_SND_SOC_IMX_CARD is not set
+# CONFIG_SND_SOC_IMX_ES8328 is not set
+# CONFIG_SND_SOC_IMX_HDMI is not set
+# CONFIG_SND_SOC_IMX_RPMSG is not set
+# CONFIG_SND_SOC_IMX_SPDIF is not set
+# CONFIG_SND_SOC_IMX_WM8962 is not set
+# CONFIG_SND_SOC_INNO_RK3036 is not set
+# CONFIG_SND_SOC_INTEL_APL is not set
+# CONFIG_SND_SOC_INTEL_BAYTRAIL is not set
+# CONFIG_SND_SOC_INTEL_BDW_RT5677_MACH is not set
+# CONFIG_SND_SOC_INTEL_BXT_DA7219_MAX98357A_MACH is not set
+# CONFIG_SND_SOC_INTEL_BXT_RT298_MACH is not set
+# CONFIG_SND_SOC_INTEL_BYTCR_RT5640_MACH is not set
+# CONFIG_SND_SOC_INTEL_BYTCR_RT5651_MACH is not set
+# CONFIG_SND_SOC_INTEL_BYT_CHT_DA7213_MACH is not set
+# CONFIG_SND_SOC_INTEL_BYT_CHT_ES8316_MACH is not set
+# CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH is not set
+# CONFIG_SND_SOC_INTEL_BYT_MAX98090_MACH is not set
+# CONFIG_SND_SOC_INTEL_BYT_RT5640_MACH is not set
+# CONFIG_SND_SOC_INTEL_CATPT is not set
+# CONFIG_SND_SOC_INTEL_CFL is not set
+# CONFIG_SND_SOC_INTEL_CHT_BSW_MAX98090_TI_MACH is not set
+# CONFIG_SND_SOC_INTEL_CHT_BSW_NAU8824_MACH is not set
+# CONFIG_SND_SOC_INTEL_CHT_BSW_RT5645_MACH is not set
+# CONFIG_SND_SOC_INTEL_CHT_BSW_RT5672_MACH is not set
+# CONFIG_SND_SOC_INTEL_CML_H is not set
+# CONFIG_SND_SOC_INTEL_CML_LP is not set
+# CONFIG_SND_SOC_INTEL_CNL is not set
+# CONFIG_SND_SOC_INTEL_GLK is not set
+# CONFIG_SND_SOC_INTEL_HASWELL is not set
+# CONFIG_SND_SOC_INTEL_KBL is not set
+# CONFIG_SND_SOC_INTEL_KBL_RT5663_MAX98927_MACH is not set
+# CONFIG_SND_SOC_INTEL_KBL_RT5663_RT5514_MAX98927_MACH is not set
+# CONFIG_SND_SOC_INTEL_KEEMBAY is not set
+# CONFIG_SND_SOC_INTEL_SKL is not set
+# CONFIG_SND_SOC_INTEL_SKL_NAU88L25_MAX98357A_MACH is not set
+# CONFIG_SND_SOC_INTEL_SKL_NAU88L25_SSM4567_MACH is not set
+# CONFIG_SND_SOC_INTEL_SKL_RT286_MACH is not set
+# CONFIG_SND_SOC_INTEL_SKYLAKE is not set
+# CONFIG_SND_SOC_INTEL_SST is not set
+CONFIG_SND_SOC_INTEL_SST_TOPLEVEL=y
+# CONFIG_SND_SOC_INTEL_USER_FRIENDLY_LONG_NAMES is not set
+# CONFIG_SND_SOC_JZ4725B_CODEC is not set
+# CONFIG_SND_SOC_JZ4740_CODEC is not set
+# CONFIG_SND_SOC_JZ4770_CODEC is not set
+# CONFIG_SND_SOC_LPASS_RX_MACRO is not set
+# CONFIG_SND_SOC_LPASS_TX_MACRO is not set
+# CONFIG_SND_SOC_LPASS_VA_MACRO is not set
+# CONFIG_SND_SOC_LPASS_WSA_MACRO is not set
+# CONFIG_SND_SOC_MA120X0P is not set
+# CONFIG_SND_SOC_MAX9759 is not set
+# CONFIG_SND_SOC_MAX98088 is not set
+# CONFIG_SND_SOC_MAX98357A is not set
+# CONFIG_SND_SOC_MAX98373 is not set
+# CONFIG_SND_SOC_MAX98373_I2C is not set
+# CONFIG_SND_SOC_MAX98390 is not set
+# CONFIG_SND_SOC_MAX98396 is not set
+# CONFIG_SND_SOC_MAX98504 is not set
+# CONFIG_SND_SOC_MAX98520 is not set
+# CONFIG_SND_SOC_MAX9860 is not set
+# CONFIG_SND_SOC_MAX9867 is not set
+# CONFIG_SND_SOC_MAX98927 is not set
+# CONFIG_SND_SOC_MEDIATEK is not set
+# CONFIG_SND_SOC_MPC5200_AC97 is not set
+# CONFIG_SND_SOC_MPC5200_I2S is not set
+# CONFIG_SND_SOC_MSM8916_WCD_ANALOG is not set
+# CONFIG_SND_SOC_MSM8916_WCD_DIGITAL is not set
+# CONFIG_SND_SOC_MT2701 is not set
+# CONFIG_SND_SOC_MT6351 is not set
+# CONFIG_SND_SOC_MT6358 is not set
+# CONFIG_SND_SOC_MT6359 is not set
+# CONFIG_SND_SOC_MT6359_ACCDET is not set
+# CONFIG_SND_SOC_MT6660 is not set
+# CONFIG_SND_SOC_MT6797 is not set
+# CONFIG_SND_SOC_MT8173 is not set
+# CONFIG_SND_SOC_MT8183 is not set
+# CONFIG_SND_SOC_MT8192 is not set
+# CONFIG_SND_SOC_MT8195 is not set
+# CONFIG_SND_SOC_MTK_BTCVSD is not set
+# CONFIG_SND_SOC_NAU8315 is not set
+# CONFIG_SND_SOC_NAU8540 is not set
+# CONFIG_SND_SOC_NAU8810 is not set
+# CONFIG_SND_SOC_NAU8821 is not set
+# CONFIG_SND_SOC_NAU8822 is not set
+# CONFIG_SND_SOC_NAU8824 is not set
+# CONFIG_SND_SOC_PCM1681 is not set
+# CONFIG_SND_SOC_PCM1789_I2C is not set
+# CONFIG_SND_SOC_PCM1792A is not set
+# CONFIG_SND_SOC_PCM179X_I2C is not set
+# CONFIG_SND_SOC_PCM179X_SPI is not set
+# CONFIG_SND_SOC_PCM186X_I2C is not set
+# CONFIG_SND_SOC_PCM186X_SPI is not set
+# CONFIG_SND_SOC_PCM3060_I2C is not set
+# CONFIG_SND_SOC_PCM3060_SPI is not set
+# CONFIG_SND_SOC_PCM3168A_I2C is not set
+# CONFIG_SND_SOC_PCM3168A_SPI is not set
+# CONFIG_SND_SOC_PCM5102A is not set
+# CONFIG_SND_SOC_PCM512x_I2C is not set
+# CONFIG_SND_SOC_PCM512x_SPI is not set
+# CONFIG_SND_SOC_QCOM is not set
+# CONFIG_SND_SOC_RK3328 is not set
+# CONFIG_SND_SOC_RK817 is not set
+# CONFIG_SND_SOC_ROCKCHIP is not set
+# CONFIG_SND_SOC_RT5616 is not set
+# CONFIG_SND_SOC_RT5631 is not set
+# CONFIG_SND_SOC_RT5640 is not set
+# CONFIG_SND_SOC_RT5659 is not set
+# CONFIG_SND_SOC_RT5677_SPI is not set
+# CONFIG_SND_SOC_RT9120 is not set
+# CONFIG_SND_SOC_SGTL5000 is not set
+# CONFIG_SND_SOC_SIMPLE_AMPLIFIER is not set
+# CONFIG_SND_SOC_SIMPLE_MUX is not set
+# CONFIG_SND_SOC_SIRF_AUDIO_CODEC is not set
+# CONFIG_SND_SOC_SOF_TOPLEVEL is not set
+# CONFIG_SND_SOC_SPDIF is not set
+# CONFIG_SND_SOC_SRC4XXX_I2C is not set
+# CONFIG_SND_SOC_SSM2305 is not set
+# CONFIG_SND_SOC_SSM2518 is not set
+# CONFIG_SND_SOC_SSM2602_I2C is not set
+# CONFIG_SND_SOC_SSM2602_SPI is not set
+# CONFIG_SND_SOC_SSM4567 is not set
+# CONFIG_SND_SOC_STA32X is not set
+# CONFIG_SND_SOC_STA350 is not set
+# CONFIG_SND_SOC_STI_SAS is not set
+# CONFIG_SND_SOC_TAS2552 is not set
+# CONFIG_SND_SOC_TAS2562 is not set
+# CONFIG_SND_SOC_TAS2764 is not set
+# CONFIG_SND_SOC_TAS2770 is not set
+# CONFIG_SND_SOC_TAS2780 is not set
+# CONFIG_SND_SOC_TAS5086 is not set
+# CONFIG_SND_SOC_TAS571X is not set
+# CONFIG_SND_SOC_TAS5720 is not set
+# CONFIG_SND_SOC_TAS5805M is not set
+# CONFIG_SND_SOC_TAS6424 is not set
+# CONFIG_SND_SOC_TDA7419 is not set
+# CONFIG_SND_SOC_TFA9879 is not set
+# CONFIG_SND_SOC_TFA989X is not set
+# CONFIG_SND_SOC_TLV320ADC3XXX is not set
+# CONFIG_SND_SOC_TLV320ADCX140 is not set
+# CONFIG_SND_SOC_TLV320AIC23_I2C is not set
+# CONFIG_SND_SOC_TLV320AIC23_SPI is not set
+# CONFIG_SND_SOC_TLV320AIC31XX is not set
+# CONFIG_SND_SOC_TLV320AIC32X4_I2C is not set
+# CONFIG_SND_SOC_TLV320AIC32X4_SPI is not set
+# CONFIG_SND_SOC_TLV320AIC3X is not set
+# CONFIG_SND_SOC_TLV320AIC3X_I2C is not set
+# CONFIG_SND_SOC_TLV320AIC3X_SPI is not set
+# CONFIG_SND_SOC_TPA6130A2 is not set
+# CONFIG_SND_SOC_TS3A227E is not set
+# CONFIG_SND_SOC_TSCS42XX is not set
+# CONFIG_SND_SOC_TSCS454 is not set
+# CONFIG_SND_SOC_UDA1334 is not set
+# CONFIG_SND_SOC_WM8510 is not set
+# CONFIG_SND_SOC_WM8523 is not set
+# CONFIG_SND_SOC_WM8524 is not set
+# CONFIG_SND_SOC_WM8580 is not set
+# CONFIG_SND_SOC_WM8711 is not set
+# CONFIG_SND_SOC_WM8728 is not set
+# CONFIG_SND_SOC_WM8731 is not set
+# CONFIG_SND_SOC_WM8731_I2C is not set
+# CONFIG_SND_SOC_WM8731_SPI is not set
+# CONFIG_SND_SOC_WM8737 is not set
+# CONFIG_SND_SOC_WM8741 is not set
+# CONFIG_SND_SOC_WM8750 is not set
+# CONFIG_SND_SOC_WM8753 is not set
+# CONFIG_SND_SOC_WM8770 is not set
+# CONFIG_SND_SOC_WM8776 is not set
+# CONFIG_SND_SOC_WM8782 is not set
+# CONFIG_SND_SOC_WM8804_I2C is not set
+# CONFIG_SND_SOC_WM8804_SPI is not set
+# CONFIG_SND_SOC_WM8903 is not set
+# CONFIG_SND_SOC_WM8904 is not set
+# CONFIG_SND_SOC_WM8940 is not set
+# CONFIG_SND_SOC_WM8960 is not set
+# CONFIG_SND_SOC_WM8962 is not set
+# CONFIG_SND_SOC_WM8974 is not set
+# CONFIG_SND_SOC_WM8978 is not set
+# CONFIG_SND_SOC_WM8985 is not set
+# CONFIG_SND_SOC_XILINX_AUDIO_FORMATTER is not set
+# CONFIG_SND_SOC_XILINX_I2S is not set
+# CONFIG_SND_SOC_XILINX_SPDIF is not set
+# CONFIG_SND_SOC_XTFPGA_I2S is not set
+# CONFIG_SND_SOC_ZL38060 is not set
+# CONFIG_SND_SOC_ZX_AUD96P22 is not set
+# CONFIG_SND_SONICVIBES is not set
+# CONFIG_SND_SPI is not set
+# CONFIG_SND_SSCAPE is not set
+# CONFIG_SND_SST_ATOM_HIFI2_PLATFORM_ACPI is not set
+# CONFIG_SND_SST_ATOM_HIFI2_PLATFORM_PCI is not set
+# CONFIG_SND_SUN4I_CODEC is not set
+# CONFIG_SND_SUPPORT_OLD_API is not set
+# CONFIG_SND_TEST_COMPONENT is not set
+# CONFIG_SND_TIMER is not set
+# CONFIG_SND_TRIDENT is not set
+CONFIG_SND_USB=y
+# CONFIG_SND_USB_6FIRE is not set
+# CONFIG_SND_USB_AUDIO is not set
+# CONFIG_SND_USB_CAIAQ is not set
+# CONFIG_SND_USB_HIFACE is not set
+# CONFIG_SND_USB_POD is not set
+# CONFIG_SND_USB_PODHD is not set
+# CONFIG_SND_USB_TONEPORT is not set
+# CONFIG_SND_USB_UA101 is not set
+# CONFIG_SND_USB_US122L is not set
+# CONFIG_SND_USB_USX2Y is not set
+# CONFIG_SND_USB_VARIAX is not set
+# CONFIG_SND_VERBOSE_PRINTK is not set
+CONFIG_SND_VERBOSE_PROCFS=y
+# CONFIG_SND_VIA82XX is not set
+# CONFIG_SND_VIA82XX_MODEM is not set
+# CONFIG_SND_VIRTIO is not set
+# CONFIG_SND_VIRTUOSO is not set
+# CONFIG_SND_VX222 is not set
+# CONFIG_SND_VXPOCKET is not set
+# CONFIG_SND_WAVEFRONT is not set
+CONFIG_SND_X86=y
+# CONFIG_SND_XEN_FRONTEND is not set
+# CONFIG_SND_YMFPCI is not set
+# CONFIG_SNI_RM is not set
+# CONFIG_SOCIONEXT_SYNQUACER_PREITS is not set
+# CONFIG_SOCK_CGROUP_DATA is not set
+# CONFIG_SOC_AM33XX is not set
+# CONFIG_SOC_AM43XX is not set
+# CONFIG_SOC_BRCMSTB is not set
+# CONFIG_SOC_CAMERA is not set
+# CONFIG_SOC_DRA7XX is not set
+# CONFIG_SOC_HAS_OMAP2_SDRC is not set
+# CONFIG_SOC_OMAP5 is not set
+# CONFIG_SOC_TI is not set
+# CONFIG_SOFTLOCKUP_DETECTOR is not set
+# CONFIG_SOFT_WATCHDOG is not set
+# CONFIG_SOLARIS_X86_PARTITION is not set
+# CONFIG_SONYPI is not set
+# CONFIG_SONY_LAPTOP is not set
+# CONFIG_SOUND is not set
+# CONFIG_SOUNDWIRE is not set
+# CONFIG_SOUND_OSS_CORE is not set
+# CONFIG_SOUND_OSS_CORE_PRECLAIM is not set
+# CONFIG_SOUND_PRIME is not set
+# CONFIG_SP5100_TCO is not set
+# CONFIG_SPARSEMEM_MANUAL is not set
+# CONFIG_SPARSEMEM_STATIC is not set
+# CONFIG_SPARSEMEM_VMEMMAP_ENABLE is not set
+# CONFIG_SPARSE_IRQ is not set
+# CONFIG_SPARSE_RCU_POINTER is not set
+# CONFIG_SPEAKUP is not set
+# CONFIG_SPI is not set
+# CONFIG_SPINLOCK_TEST is not set
+# CONFIG_SPI_ALTERA is not set
+# CONFIG_SPI_AMD is not set
+# CONFIG_SPI_AU1550 is not set
+# CONFIG_SPI_AX88796C is not set
+# CONFIG_SPI_AXI_SPI_ENGINE is not set
+# CONFIG_SPI_BCM2835 is not set
+# CONFIG_SPI_BCM_QSPI is not set
+# CONFIG_SPI_BITBANG is not set
+# CONFIG_SPI_BUTTERFLY is not set
+# CONFIG_SPI_CADENCE is not set
+# CONFIG_SPI_CADENCE_QUADSPI is not set
+# CONFIG_SPI_CADENCE_XSPI is not set
+# CONFIG_SPI_DEBUG is not set
+# CONFIG_SPI_DESIGNWARE is not set
+# CONFIG_SPI_FSL_DSPI is not set
+# CONFIG_SPI_FSL_ESPI is not set
+# CONFIG_SPI_FSL_SPI is not set
+# CONFIG_SPI_GPIO is not set
+# CONFIG_SPI_GPIO_OLD is not set
+# CONFIG_SPI_IMG_SPFI is not set
+# CONFIG_SPI_LANTIQ_SSC is not set
+# CONFIG_SPI_LM70_LLP is not set
+# CONFIG_SPI_LOOPBACK_TEST is not set
+# CONFIG_SPI_MASTER is not set
+# CONFIG_SPI_MEM is not set
+# CONFIG_SPI_MICROCHIP_CORE is not set
+# CONFIG_SPI_MICROCHIP_CORE_QSPI is not set
+# CONFIG_SPI_MPC52xx is not set
+# CONFIG_SPI_MPC52xx_PSC is not set
+# CONFIG_SPI_MTK_QUADSPI is not set
+# CONFIG_SPI_MUX is not set
+# CONFIG_SPI_MXIC is not set
+# CONFIG_SPI_NXP_FLEXSPI is not set
+# CONFIG_SPI_OCTEON is not set
+# CONFIG_SPI_OC_TINY is not set
+# CONFIG_SPI_ORION is not set
+# CONFIG_SPI_PL022 is not set
+# CONFIG_SPI_PPC4xx is not set
+# CONFIG_SPI_PXA2XX is not set
+# CONFIG_SPI_PXA2XX_PCI is not set
+# CONFIG_SPI_QCOM_QSPI is not set
+# CONFIG_SPI_ROCKCHIP is not set
+# CONFIG_SPI_S3C64XX is not set
+# CONFIG_SPI_SC18IS602 is not set
+# CONFIG_SPI_SIFIVE is not set
+# CONFIG_SPI_SLAVE is not set
+# CONFIG_SPI_SPIDEV is not set
+# CONFIG_SPI_THUNDERX is not set
+# CONFIG_SPI_TI_QSPI is not set
+# CONFIG_SPI_TLE62X0 is not set
+# CONFIG_SPI_TOPCLIFF_PCH is not set
+# CONFIG_SPI_XCOMM is not set
+# CONFIG_SPI_XILINX is not set
+# CONFIG_SPI_XWAY is not set
+# CONFIG_SPI_ZYNQMP_GQSPI is not set
+CONFIG_SPLIT_PTLOCK_CPUS=4
+# CONFIG_SPMI is not set
+# CONFIG_SPS30 is not set
+# CONFIG_SPS30_I2C is not set
+# CONFIG_SPS30_SERIAL is not set
+CONFIG_SQUASHFS=y
+# CONFIG_SQUASHFS_4K_DEVBLK_SIZE is not set
+# CONFIG_SQUASHFS_DECOMP_MULTI is not set
+CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU=y
+# CONFIG_SQUASHFS_DECOMP_SINGLE is not set
+CONFIG_SQUASHFS_EMBEDDED=y
+# CONFIG_SQUASHFS_FILE_CACHE is not set
+CONFIG_SQUASHFS_FILE_DIRECT=y
+CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE=3
+# CONFIG_SQUASHFS_LZ4 is not set
+# CONFIG_SQUASHFS_LZO is not set
+# CONFIG_SQUASHFS_XATTR is not set
+CONFIG_SQUASHFS_XZ=y
+# CONFIG_SQUASHFS_ZLIB is not set
+# CONFIG_SQUASHFS_ZSTD is not set
+# CONFIG_SRAM is not set
+# CONFIG_SRF04 is not set
+# CONFIG_SRF08 is not set
+# CONFIG_SSB is not set
+# CONFIG_SSB_DEBUG is not set
+# CONFIG_SSB_DRIVER_GPIO is not set
+# CONFIG_SSB_HOST_SOC is not set
+# CONFIG_SSB_PCMCIAHOST is not set
+CONFIG_SSB_POSSIBLE=y
+# CONFIG_SSB_SDIOHOST is not set
+# CONFIG_SSB_SILENT is not set
+# CONFIG_SSFDC is not set
+# CONFIG_STACKPROTECTOR is not set
+# CONFIG_STACKPROTECTOR_PER_TASK is not set
+# CONFIG_STACKPROTECTOR_STRONG is not set
+# CONFIG_STACKTRACE is not set
+# CONFIG_STACKTRACE_BUILD_ID is not set
+CONFIG_STACKTRACE_SUPPORT=y
+CONFIG_STACK_HASH_ORDER=20
+# CONFIG_STACK_TRACER is not set
+# CONFIG_STACK_VALIDATION is not set
+CONFIG_STAGING=y
+# CONFIG_STAGING_BOARD is not set
+# CONFIG_STAGING_GASKET_FRAMEWORK is not set
+# CONFIG_STAGING_MEDIA is not set
+CONFIG_STANDALONE=y
+# CONFIG_STATIC_KEYS_SELFTEST is not set
+# CONFIG_STATIC_USERMODEHELPER is not set
+CONFIG_STDBINUTILS=y
+# CONFIG_STE10XP is not set
+# CONFIG_STE_MODEM_RPROC is not set
+# CONFIG_STK3310 is not set
+# CONFIG_STK8312 is not set
+# CONFIG_STK8BA50 is not set
+# CONFIG_STM is not set
+# CONFIG_STMMAC_ETH is not set
+# CONFIG_STMMAC_PCI is not set
+# CONFIG_STMMAC_PLATFORM is not set
+# CONFIG_STMMAC_SELFTESTS is not set
+# CONFIG_STM_DUMMY is not set
+# CONFIG_STM_SOURCE_CONSOLE is not set
+CONFIG_STP=y
+# CONFIG_STREAM_PARSER is not set
+# CONFIG_STRICT_DEVMEM is not set
+CONFIG_STRICT_KERNEL_RWX=y
+CONFIG_STRICT_MODULE_RWX=y
+# CONFIG_STRING_SELFTEST is not set
+CONFIG_STRIP_ASM_SYMS=y
+# CONFIG_STX104 is not set
+# CONFIG_ST_UVIS25 is not set
+# CONFIG_SUN4I_GPADC is not set
+# CONFIG_SUN50I_DE2_BUS is not set
+# CONFIG_SUN50I_ERRATUM_UNKNOWN1 is not set
+# CONFIG_SUNDANCE is not set
+# CONFIG_SUNGEM is not set
+# CONFIG_SUNRPC is not set
+# CONFIG_SUNRPC_DEBUG is not set
+CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES=y
+# CONFIG_SUNRPC_GSS is not set
+# CONFIG_SUNXI_SRAM is not set
+# CONFIG_SUN_PARTITION is not set
+# CONFIG_SURFACE_3_BUTTON is not set
+# CONFIG_SURFACE_PLATFORMS is not set
+# CONFIG_SUSPEND is not set
+# CONFIG_SUSPEND_SKIP_SYNC is not set
+CONFIG_SWAP=y
+# CONFIG_SWCONFIG is not set
+# CONFIG_SWCONFIG_B53 is not set
+# CONFIG_SWCONFIG_B53_MDIO_DRIVER is not set
+# CONFIG_SWCONFIG_B53_MMAP_DRIVER is not set
+# CONFIG_SWCONFIG_B53_SPI_DRIVER is not set
+# CONFIG_SWCONFIG_B53_SRAB_DRIVER is not set
+# CONFIG_SWCONFIG_LEDS is not set
+# CONFIG_SW_SYNC is not set
+# CONFIG_SX9310 is not set
+# CONFIG_SX9324 is not set
+# CONFIG_SX9360 is not set
+# CONFIG_SX9500 is not set
+# CONFIG_SXGBE_ETH is not set
+CONFIG_SYMBOLIC_ERRNAME=y
+# CONFIG_SYNCLINK_CS is not set
+# CONFIG_SYNC_FILE is not set
+# CONFIG_SYNOPSYS_DWC_ETH_QOS is not set
+# CONFIG_SYNTH_EVENTS is not set
+# CONFIG_SYNTH_EVENT_GEN_TEST is not set
+CONFIG_SYN_COOKIES=y
+# CONFIG_SYSCON_REBOOT_MODE is not set
+CONFIG_SYSCTL=y
+# CONFIG_SYSCTL_SYSCALL is not set
+CONFIG_SYSFS=y
+# CONFIG_SYSFS_DEPRECATED is not set
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
+# CONFIG_SYSFS_SYSCALL is not set
+# CONFIG_SYSTEMPORT is not set
+# CONFIG_SYSTEM_BLACKLIST_KEYRING is not set
+# CONFIG_SYSTEM_DATA_VERIFICATION is not set
+# CONFIG_SYSTEM_TRUSTED_KEYRING is not set
+CONFIG_SYSTEM_TRUSTED_KEYS=""
+# CONFIG_SYSV68_PARTITION is not set
+CONFIG_SYSVIPC=y
+CONFIG_SYSVIPC_SYSCTL=y
+# CONFIG_SYSV_FS is not set
+# CONFIG_SYS_HYPERVISOR is not set
+# CONFIG_T5403 is not set
+# CONFIG_TARGET_CORE is not set
+# CONFIG_TASKSTATS is not set
+# CONFIG_TASKS_RCU is not set
+# CONFIG_TASK_XACCT is not set
+# CONFIG_TC35815 is not set
+# CONFIG_TCG_ATMEL is not set
+# CONFIG_TCG_CRB is not set
+# CONFIG_TCG_FTPM_TEE is not set
+# CONFIG_TCG_INFINEON is not set
+# CONFIG_TCG_NSC is not set
+# CONFIG_TCG_ST33_I2C is not set
+# CONFIG_TCG_TIS is not set
+# CONFIG_TCG_TIS_I2C is not set
+# CONFIG_TCG_TIS_I2C_ATMEL is not set
+# CONFIG_TCG_TIS_I2C_CR50 is not set
+# CONFIG_TCG_TIS_I2C_INFINEON is not set
+# CONFIG_TCG_TIS_I2C_NUVOTON is not set
+# CONFIG_TCG_TIS_SPI is not set
+# CONFIG_TCG_TIS_ST33ZP24_I2C is not set
+# CONFIG_TCG_TIS_ST33ZP24_SPI is not set
+# CONFIG_TCG_TPM is not set
+# CONFIG_TCG_VTPM_PROXY is not set
+# CONFIG_TCG_XEN is not set
+# CONFIG_TCIC is not set
+CONFIG_TCP_CONG_ADVANCED=y
+# CONFIG_TCP_CONG_BBR is not set
+# CONFIG_TCP_CONG_BIC is not set
+# CONFIG_TCP_CONG_CDG is not set
+CONFIG_TCP_CONG_CUBIC=y
+# CONFIG_TCP_CONG_DCTCP is not set
+# CONFIG_TCP_CONG_HSTCP is not set
+# CONFIG_TCP_CONG_HTCP is not set
+# CONFIG_TCP_CONG_HYBLA is not set
+# CONFIG_TCP_CONG_ILLINOIS is not set
+# CONFIG_TCP_CONG_LP is not set
+# CONFIG_TCP_CONG_NV is not set
+# CONFIG_TCP_CONG_SCALABLE is not set
+# CONFIG_TCP_CONG_VEGAS is not set
+# CONFIG_TCP_CONG_VENO is not set
+# CONFIG_TCP_CONG_WESTWOOD is not set
+# CONFIG_TCP_CONG_YEAH is not set
+# CONFIG_TCP_MD5SIG is not set
+# CONFIG_TCS3414 is not set
+# CONFIG_TCS3472 is not set
+# CONFIG_TEE is not set
+# CONFIG_TEGRA_AHB is not set
+# CONFIG_TEGRA_HOST1X is not set
+# CONFIG_TEHUTI is not set
+# CONFIG_TERANETICS_PHY is not set
+# CONFIG_TEST_ASYNC_DRIVER_PROBE is not set
+# CONFIG_TEST_BITFIELD is not set
+# CONFIG_TEST_BITMAP is not set
+# CONFIG_TEST_BITOPS is not set
+# CONFIG_TEST_BLACKHOLE_DEV is not set
+# CONFIG_TEST_BPF is not set
+# CONFIG_TEST_CLOCKSOURCE_WATCHDOG is not set
+# CONFIG_TEST_DEBUG_VIRTUAL is not set
+# CONFIG_TEST_DIV64 is not set
+# CONFIG_TEST_DYNAMIC_DEBUG is not set
+# CONFIG_TEST_FIRMWARE is not set
+# CONFIG_TEST_FREE_PAGES is not set
+# CONFIG_TEST_HASH is not set
+# CONFIG_TEST_HEXDUMP is not set
+# CONFIG_TEST_IDA is not set
+# CONFIG_TEST_KASAN_MODULE is not set
+# CONFIG_TEST_KMOD is not set
+# CONFIG_TEST_KSTRTOX is not set
+# CONFIG_TEST_LIST_SORT is not set
+# CONFIG_TEST_LKM is not set
+# CONFIG_TEST_LOCKUP is not set
+# CONFIG_TEST_MAPLE_TREE is not set
+# CONFIG_TEST_MEMCAT_P is not set
+# CONFIG_TEST_MEMINIT is not set
+# CONFIG_TEST_MIN_HEAP is not set
+# CONFIG_TEST_OVERFLOW is not set
+# CONFIG_TEST_POWER is not set
+# CONFIG_TEST_PRINTF is not set
+# CONFIG_TEST_REF_TRACKER is not set
+# CONFIG_TEST_RHASHTABLE is not set
+# CONFIG_TEST_SCANF is not set
+# CONFIG_TEST_SIPHASH is not set
+# CONFIG_TEST_SORT is not set
+# CONFIG_TEST_STACKINIT is not set
+# CONFIG_TEST_STATIC_KEYS is not set
+# CONFIG_TEST_STRING_HELPERS is not set
+# CONFIG_TEST_STRSCPY is not set
+# CONFIG_TEST_SYSCTL is not set
+# CONFIG_TEST_UBSAN is not set
+# CONFIG_TEST_UDELAY is not set
+# CONFIG_TEST_USER_COPY is not set
+# CONFIG_TEST_UUID is not set
+# CONFIG_TEST_VMALLOC is not set
+# CONFIG_TEST_XARRAY is not set
+CONFIG_TEXTSEARCH=y
+# CONFIG_TEXTSEARCH_BM is not set
+# CONFIG_TEXTSEARCH_FSM is not set
+# CONFIG_TEXTSEARCH_KMP is not set
+# CONFIG_THERMAL is not set
+# CONFIG_THERMAL_DEFAULT_GOV_FAIR_SHARE is not set
+# CONFIG_THERMAL_DEFAULT_GOV_POWER_ALLOCATOR is not set
+# CONFIG_THERMAL_DEFAULT_GOV_USER_SPACE is not set
+# CONFIG_THERMAL_EMULATION is not set
+# CONFIG_THERMAL_GOV_BANG_BANG is not set
+# CONFIG_THERMAL_GOV_FAIR_SHARE is not set
+# CONFIG_THERMAL_GOV_POWER_ALLOCATOR is not set
+# CONFIG_THERMAL_GOV_USER_SPACE is not set
+# CONFIG_THERMAL_HWMON is not set
+# CONFIG_THERMAL_MMIO is not set
+# CONFIG_THERMAL_NETLINK is not set
+# CONFIG_THERMAL_STATISTICS is not set
+# CONFIG_THERMAL_WRITABLE_TRIPS is not set
+# CONFIG_THINKPAD_ACPI is not set
+CONFIG_THIN_ARCHIVES=y
+# CONFIG_THRUSTMASTER_FF is not set
+# CONFIG_THUMB2_KERNEL is not set
+# CONFIG_THUNDERBOLT is not set
+# CONFIG_THUNDER_NIC_BGX is not set
+# CONFIG_THUNDER_NIC_PF is not set
+# CONFIG_THUNDER_NIC_RGX is not set
+# CONFIG_THUNDER_NIC_VF is not set
+# CONFIG_TICK_CPU_ACCOUNTING is not set
+CONFIG_TICK_ONESHOT=y
+# CONFIG_TIFM_CORE is not set
+# CONFIG_TIGON3 is not set
+# CONFIG_TIMB_DMA is not set
+CONFIG_TIMERFD=y
+# CONFIG_TIMERLAT_TRACER is not set
+# CONFIG_TIMER_STATS is not set
+# CONFIG_TIME_NS is not set
+# CONFIG_TINYDRM_HX8357D is not set
+# CONFIG_TINYDRM_ILI9163 is not set
+# CONFIG_TINYDRM_ILI9225 is not set
+# CONFIG_TINYDRM_ILI9341 is not set
+# CONFIG_TINYDRM_ILI9486 is not set
+# CONFIG_TINYDRM_MI0283QT is not set
+# CONFIG_TINYDRM_REPAPER is not set
+# CONFIG_TINYDRM_ST7586 is not set
+# CONFIG_TINYDRM_ST7735R is not set
+CONFIG_TINY_RCU=y
+# CONFIG_TIPC is not set
+# CONFIG_TI_ADC081C is not set
+# CONFIG_TI_ADC0832 is not set
+# CONFIG_TI_ADC084S021 is not set
+# CONFIG_TI_ADC108S102 is not set
+# CONFIG_TI_ADC12138 is not set
+# CONFIG_TI_ADC128S052 is not set
+# CONFIG_TI_ADC161S626 is not set
+# CONFIG_TI_ADS1015 is not set
+# CONFIG_TI_ADS124S08 is not set
+# CONFIG_TI_ADS131E08 is not set
+# CONFIG_TI_ADS7950 is not set
+# CONFIG_TI_ADS8344 is not set
+# CONFIG_TI_ADS8688 is not set
+# CONFIG_TI_AM335X_ADC is not set
+# CONFIG_TI_CPSW is not set
+# CONFIG_TI_CPSW_ALE is not set
+# CONFIG_TI_CPSW_PHY_SEL is not set
+# CONFIG_TI_CPTS is not set
+# CONFIG_TI_DAC082S085 is not set
+# CONFIG_TI_DAC5571 is not set
+# CONFIG_TI_DAC7311 is not set
+# CONFIG_TI_DAC7512 is not set
+# CONFIG_TI_DAC7612 is not set
+# CONFIG_TI_DAVINCI_CPDMA is not set
+# CONFIG_TI_DAVINCI_MDIO is not set
+# CONFIG_TI_ST is not set
+# CONFIG_TI_SYSCON_RESET is not set
+# CONFIG_TI_TLC4541 is not set
+# CONFIG_TI_TSC2046 is not set
+# CONFIG_TLAN is not set
+# CONFIG_TLS is not set
+# CONFIG_TLS_DEVICE is not set
+# CONFIG_TLS_TOE is not set
+# CONFIG_TMD_HERMES is not set
+# CONFIG_TMP006 is not set
+# CONFIG_TMP007 is not set
+# CONFIG_TMP117 is not set
+CONFIG_TMPFS=y
+# CONFIG_TMPFS_INODE64 is not set
+# CONFIG_TMPFS_POSIX_ACL is not set
+CONFIG_TMPFS_XATTR=y
+# CONFIG_TOPSTAR_LAPTOP is not set
+# CONFIG_TORTURE_TEST is not set
+# CONFIG_TOSHIBA_HAPS is not set
+# CONFIG_TOUCHSCREEN_88PM860X is not set
+# CONFIG_TOUCHSCREEN_AD7877 is not set
+# CONFIG_TOUCHSCREEN_AD7879 is not set
+# CONFIG_TOUCHSCREEN_AD7879_I2C is not set
+# CONFIG_TOUCHSCREEN_AD7879_SPI is not set
+# CONFIG_TOUCHSCREEN_ADC is not set
+# CONFIG_TOUCHSCREEN_ADS7846 is not set
+# CONFIG_TOUCHSCREEN_AR1021_I2C is not set
+# CONFIG_TOUCHSCREEN_ATMEL_MXT is not set
+# CONFIG_TOUCHSCREEN_ATMEL_MXT_T37 is not set
+# CONFIG_TOUCHSCREEN_AUO_PIXCIR is not set
+# CONFIG_TOUCHSCREEN_BU21013 is not set
+# CONFIG_TOUCHSCREEN_BU21029 is not set
+# CONFIG_TOUCHSCREEN_CHIPONE_ICN8318 is not set
+# CONFIG_TOUCHSCREEN_CHIPONE_ICN8505 is not set
+# CONFIG_TOUCHSCREEN_COLIBRI_VF50 is not set
+# CONFIG_TOUCHSCREEN_CY8CTMA140 is not set
+# CONFIG_TOUCHSCREEN_CY8CTMG110 is not set
+# CONFIG_TOUCHSCREEN_CYTTSP4_CORE is not set
+# CONFIG_TOUCHSCREEN_CYTTSP4_I2C is not set
+# CONFIG_TOUCHSCREEN_CYTTSP4_SPI is not set
+# CONFIG_TOUCHSCREEN_CYTTSP_CORE is not set
+# CONFIG_TOUCHSCREEN_CYTTSP_I2C is not set
+# CONFIG_TOUCHSCREEN_CYTTSP_SPI is not set
+# CONFIG_TOUCHSCREEN_DA9034 is not set
+# CONFIG_TOUCHSCREEN_DA9052 is not set
+# CONFIG_TOUCHSCREEN_DYNAPRO is not set
+# CONFIG_TOUCHSCREEN_EDT_FT5X06 is not set
+# CONFIG_TOUCHSCREEN_EETI is not set
+# CONFIG_TOUCHSCREEN_EGALAX is not set
+# CONFIG_TOUCHSCREEN_EGALAX_SERIAL is not set
+# CONFIG_TOUCHSCREEN_EKTF2127 is not set
+# CONFIG_TOUCHSCREEN_ELAN is not set
+# CONFIG_TOUCHSCREEN_ELO is not set
+# CONFIG_TOUCHSCREEN_EXC3000 is not set
+# CONFIG_TOUCHSCREEN_FUJITSU is not set
+# CONFIG_TOUCHSCREEN_GOODIX is not set
+# CONFIG_TOUCHSCREEN_GUNZE is not set
+# CONFIG_TOUCHSCREEN_HAMPSHIRE is not set
+# CONFIG_TOUCHSCREEN_HIDEEP is not set
+# CONFIG_TOUCHSCREEN_HP600 is not set
+# CONFIG_TOUCHSCREEN_HP7XX is not set
+# CONFIG_TOUCHSCREEN_HTCPEN is not set
+# CONFIG_TOUCHSCREEN_HYCON_HY46XX is not set
+# CONFIG_TOUCHSCREEN_ILI210X is not set
+# CONFIG_TOUCHSCREEN_ILITEK is not set
+# CONFIG_TOUCHSCREEN_IMAGIS is not set
+# CONFIG_TOUCHSCREEN_IMX6UL_TSC is not set
+# CONFIG_TOUCHSCREEN_INEXIO is not set
+# CONFIG_TOUCHSCREEN_IPAQ_MICRO is not set
+# CONFIG_TOUCHSCREEN_IPROC is not set
+# CONFIG_TOUCHSCREEN_IQS5XX is not set
+# CONFIG_TOUCHSCREEN_LPC32XX is not set
+# CONFIG_TOUCHSCREEN_MAX11801 is not set
+# CONFIG_TOUCHSCREEN_MC13783 is not set
+# CONFIG_TOUCHSCREEN_MCS5000 is not set
+# CONFIG_TOUCHSCREEN_MELFAS_MIP4 is not set
+# CONFIG_TOUCHSCREEN_MIGOR is not set
+# CONFIG_TOUCHSCREEN_MK712 is not set
+# CONFIG_TOUCHSCREEN_MMS114 is not set
+# CONFIG_TOUCHSCREEN_MSG2638 is not set
+# CONFIG_TOUCHSCREEN_MTOUCH is not set
+# CONFIG_TOUCHSCREEN_MX25 is not set
+# CONFIG_TOUCHSCREEN_MXS_LRADC is not set
+# CONFIG_TOUCHSCREEN_PCAP is not set
+# CONFIG_TOUCHSCREEN_PENMOUNT is not set
+# CONFIG_TOUCHSCREEN_PIXCIR is not set
+# CONFIG_TOUCHSCREEN_PROPERTIES is not set
+# CONFIG_TOUCHSCREEN_RASPBERRYPI_FW is not set
+# CONFIG_TOUCHSCREEN_RM_TS is not set
+# CONFIG_TOUCHSCREEN_ROHM_BU21023 is not set
+# CONFIG_TOUCHSCREEN_RPI_FT5406 is not set
+# CONFIG_TOUCHSCREEN_S3C2410 is not set
+# CONFIG_TOUCHSCREEN_S6SY761 is not set
+# CONFIG_TOUCHSCREEN_SILEAD is not set
+# CONFIG_TOUCHSCREEN_SIS_I2C is not set
+# CONFIG_TOUCHSCREEN_ST1232 is not set
+# CONFIG_TOUCHSCREEN_STMFTS is not set
+# CONFIG_TOUCHSCREEN_STMPE is not set
+# CONFIG_TOUCHSCREEN_SUN4I is not set
+# CONFIG_TOUCHSCREEN_SUR40 is not set
+# CONFIG_TOUCHSCREEN_SURFACE3_SPI is not set
+# CONFIG_TOUCHSCREEN_SX8654 is not set
+# CONFIG_TOUCHSCREEN_TI_AM335X_TSC is not set
+# CONFIG_TOUCHSCREEN_TOUCHIT213 is not set
+# CONFIG_TOUCHSCREEN_TOUCHRIGHT is not set
+# CONFIG_TOUCHSCREEN_TOUCHWIN is not set
+# CONFIG_TOUCHSCREEN_TPS6507X is not set
+# CONFIG_TOUCHSCREEN_TS4800 is not set
+# CONFIG_TOUCHSCREEN_TSC2004 is not set
+# CONFIG_TOUCHSCREEN_TSC2005 is not set
+# CONFIG_TOUCHSCREEN_TSC2007 is not set
+# CONFIG_TOUCHSCREEN_TSC2007_IIO is not set
+# CONFIG_TOUCHSCREEN_TSC200X_CORE is not set
+# CONFIG_TOUCHSCREEN_TSC_SERIO is not set
+# CONFIG_TOUCHSCREEN_UCB1400 is not set
+# CONFIG_TOUCHSCREEN_USB_3M is not set
+# CONFIG_TOUCHSCREEN_USB_COMPOSITE is not set
+# CONFIG_TOUCHSCREEN_USB_DMC_TSC10 is not set
+# CONFIG_TOUCHSCREEN_USB_E2I is not set
+# CONFIG_TOUCHSCREEN_USB_EASYTOUCH is not set
+# CONFIG_TOUCHSCREEN_USB_EGALAX is not set
+# CONFIG_TOUCHSCREEN_USB_ELO is not set
+# CONFIG_TOUCHSCREEN_USB_ETT_TC45USB is not set
+# CONFIG_TOUCHSCREEN_USB_ETURBO is not set
+# CONFIG_TOUCHSCREEN_USB_GENERAL_TOUCH is not set
+# CONFIG_TOUCHSCREEN_USB_GOTOP is not set
+# CONFIG_TOUCHSCREEN_USB_GUNZE is not set
+# CONFIG_TOUCHSCREEN_USB_IDEALTEK is not set
+# CONFIG_TOUCHSCREEN_USB_IRTOUCH is not set
+# CONFIG_TOUCHSCREEN_USB_ITM is not set
+# CONFIG_TOUCHSCREEN_USB_JASTEC is not set
+# CONFIG_TOUCHSCREEN_USB_NEXIO is not set
+# CONFIG_TOUCHSCREEN_USB_PANJIT is not set
+# CONFIG_TOUCHSCREEN_USB_ZYTRONIC is not set
+# CONFIG_TOUCHSCREEN_W90X900 is not set
+# CONFIG_TOUCHSCREEN_WACOM_I2C is not set
+# CONFIG_TOUCHSCREEN_WACOM_W8001 is not set
+# CONFIG_TOUCHSCREEN_WDT87XX_I2C is not set
+# CONFIG_TOUCHSCREEN_WM831X is not set
+# CONFIG_TOUCHSCREEN_WM9705 is not set
+# CONFIG_TOUCHSCREEN_WM9712 is not set
+# CONFIG_TOUCHSCREEN_WM9713 is not set
+# CONFIG_TOUCHSCREEN_WM97XX is not set
+# CONFIG_TOUCHSCREEN_WM97XX_MAINSTONE is not set
+# CONFIG_TOUCHSCREEN_WM97XX_ZYLONITE is not set
+# CONFIG_TOUCHSCREEN_ZET6223 is not set
+# CONFIG_TOUCHSCREEN_ZFORCE is not set
+# CONFIG_TOUCHSCREEN_ZINITIX is not set
+# CONFIG_TPL0102 is not set
+# CONFIG_TPS6105X is not set
+# CONFIG_TPS65010 is not set
+# CONFIG_TPS6507X is not set
+# CONFIG_TRACEPOINT_BENCHMARK is not set
+# CONFIG_TRACER_SNAPSHOT is not set
+# CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP is not set
+# CONFIG_TRACE_BRANCH_PROFILING is not set
+# CONFIG_TRACE_EVAL_MAP_FILE is not set
+# CONFIG_TRACE_EVENT_INJECT is not set
+CONFIG_TRACE_IRQFLAGS_SUPPORT=y
+# CONFIG_TRACE_MMIO_ACCESS is not set
+# CONFIG_TRACE_SINK is not set
+# CONFIG_TRACING_EVENTS_GPIO is not set
+CONFIG_TRACING_SUPPORT=y
+CONFIG_TRAD_SIGNALS=y
+# CONFIG_TRANSPARENT_HUGEPAGE is not set
+# CONFIG_TREE_RCU is not set
+# CONFIG_TREE_RCU_TRACE is not set
+# CONFIG_TRIM_UNUSED_KSYMS is not set
+# CONFIG_TRUSTED_FOUNDATIONS is not set
+# CONFIG_TRUSTED_KEYS is not set
+# CONFIG_TRUSTED_KEYS_TPM is not set
+# CONFIG_TSL2583 is not set
+# CONFIG_TSL2591 is not set
+# CONFIG_TSL2772 is not set
+# CONFIG_TSL2x7x is not set
+# CONFIG_TSL4531 is not set
+# CONFIG_TSNEP is not set
+# CONFIG_TSYS01 is not set
+# CONFIG_TSYS02D is not set
+# CONFIG_TTPCI_EEPROM is not set
+CONFIG_TTY=y
+# CONFIG_TTY_PRINTK is not set
+# CONFIG_TUN is not set
+# CONFIG_TUN_VNET_CROSS_LE is not set
+# CONFIG_TWL4030_CORE is not set
+# CONFIG_TWL4030_MADC is not set
+# CONFIG_TWL6030_GPADC is not set
+# CONFIG_TWL6040_CORE is not set
+# CONFIG_TXGBE is not set
+# CONFIG_TYPEC is not set
+# CONFIG_TYPEC_DP_ALTMODE is not set
+# CONFIG_TYPEC_TCPM is not set
+# CONFIG_TYPEC_UCSI is not set
+# CONFIG_TYPHOON is not set
+# CONFIG_UACCESS_WITH_MEMCPY is not set
+# CONFIG_UBIFS_ATIME_SUPPORT is not set
+# CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
+# CONFIG_UBIFS_FS_AUTHENTICATION is not set
+# CONFIG_UBIFS_FS_ENCRYPTION is not set
+CONFIG_UBIFS_FS_LZO=y
+# CONFIG_UBIFS_FS_SECURITY is not set
+CONFIG_UBIFS_FS_XATTR=y
+CONFIG_UBIFS_FS_ZLIB=y
+CONFIG_UBIFS_FS_ZSTD=y
+# CONFIG_UBSAN is not set
+CONFIG_UBSAN_ALIGNMENT=y
+CONFIG_UBSAN_BOOL=y
+# CONFIG_UBSAN_DIV_ZERO is not set
+CONFIG_UBSAN_ENUM=y
+# CONFIG_UBSAN_MISC is not set
+CONFIG_UBSAN_SHIFT=y
+# CONFIG_UBSAN_UNREACHABLE is not set
+# CONFIG_UCB1400_CORE is not set
+# CONFIG_UCSI is not set
+# CONFIG_UDF_FS is not set
+# CONFIG_UDMABUF is not set
+CONFIG_UEVENT_HELPER=y
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+# CONFIG_UFS_FS is not set
+# CONFIG_UHID is not set
+CONFIG_UID16=y
+# CONFIG_UIO is not set
+# CONFIG_ULTRA is not set
+# CONFIG_ULTRIX_PARTITION is not set
+# CONFIG_UNICODE is not set
+# CONFIG_UNISYSSPAR is not set
+# CONFIG_UNISYS_VISORBUS is not set
+CONFIG_UNIX=y
+CONFIG_UNIX98_PTYS=y
+# CONFIG_UNIXWARE_DISKLABEL is not set
+# CONFIG_UNIX_DIAG is not set
+CONFIG_UNIX_SCM=y
+# CONFIG_UNUSED_BOARD_FILES is not set
+# CONFIG_UNUSED_SYMBOLS is not set
+# CONFIG_UNWINDER_FRAME_POINTER is not set
+# CONFIG_UPROBES is not set
+# CONFIG_UPROBE_EVENTS is not set
+# CONFIG_US5182D is not set
+# CONFIG_USB is not set
+# CONFIG_USB4 is not set
+# CONFIG_USBIP_CORE is not set
+CONFIG_USBIP_VHCI_HC_PORTS=8
+CONFIG_USBIP_VHCI_NR_HCS=1
+# CONFIG_USBIP_VUDC is not set
+# CONFIG_USBPCWATCHDOG is not set
+# CONFIG_USB_ACM is not set
+# CONFIG_USB_ADUTUX is not set
+# CONFIG_USB_AIRSPY is not set
+CONFIG_USB_ALI_M5632=y
+# CONFIG_USB_AMD5536UDC is not set
+CONFIG_USB_AN2720=y
+# CONFIG_USB_ANNOUNCE_NEW_DEVICES is not set
+# CONFIG_USB_APPLEDISPLAY is not set
+CONFIG_USB_ARCH_HAS_HCD=y
+CONFIG_USB_ARMLINUX=y
+# CONFIG_USB_ATM is not set
+# CONFIG_USB_AUDIO is not set
+CONFIG_USB_AUTOSUSPEND_DELAY=2
+# CONFIG_USB_BDC_UDC is not set
+CONFIG_USB_BELKIN=y
+# CONFIG_USB_C67X00_HCD is not set
+# CONFIG_USB_CATC is not set
+# CONFIG_USB_CDC_COMPOSITE is not set
+# CONFIG_USB_CDNS3 is not set
+# CONFIG_USB_CDNS_SUPPORT is not set
+# CONFIG_USB_CHAOSKEY is not set
+# CONFIG_USB_CHIPIDEA is not set
+# CONFIG_USB_CHIPIDEA_GENERIC is not set
+# CONFIG_USB_CHIPIDEA_IMX is not set
+# CONFIG_USB_CHIPIDEA_MSM is not set
+# CONFIG_USB_CHIPIDEA_PCI is not set
+# CONFIG_USB_CHIPIDEA_TEGRA is not set
+# CONFIG_USB_CONFIGFS is not set
+# CONFIG_USB_CONN_GPIO is not set
+# CONFIG_USB_CXACRU is not set
+# CONFIG_USB_CYPRESS_CY7C63 is not set
+# CONFIG_USB_CYTHERM is not set
+CONFIG_USB_DEFAULT_PERSIST=y
+# CONFIG_USB_DSBR is not set
+# CONFIG_USB_DUMMY_HCD is not set
+# CONFIG_USB_DWC2 is not set
+# CONFIG_USB_DWC2_DEBUG is not set
+# CONFIG_USB_DWC2_DUAL_ROLE is not set
+# CONFIG_USB_DWC2_HOST is not set
+# CONFIG_USB_DWC2_PERIPHERAL is not set
+# CONFIG_USB_DWC2_TRACK_MISSED_SOFS is not set
+# CONFIG_USB_DWC3 is not set
+# CONFIG_USB_DWC3_EXYNOS is not set
+# CONFIG_USB_DWC3_HAPS is not set
+# CONFIG_USB_DWC3_KEYSTONE is not set
+# CONFIG_USB_DWC3_OF_SIMPLE is not set
+# CONFIG_USB_DWC3_PCI is not set
+# CONFIG_USB_DWC3_QCOM is not set
+# CONFIG_USB_DWC3_ULPI is not set
+# CONFIG_USB_DYNAMIC_MINORS is not set
+# CONFIG_USB_EG20T is not set
+# CONFIG_USB_EHCI_ATH79 is not set
+# CONFIG_USB_EHCI_FSL is not set
+# CONFIG_USB_EHCI_HCD is not set
+# CONFIG_USB_EHCI_HCD_AT91 is not set
+# CONFIG_USB_EHCI_HCD_OMAP is not set
+# CONFIG_USB_EHCI_HCD_PPC_OF is not set
+# CONFIG_USB_EHCI_MSM is not set
+# CONFIG_USB_EHCI_MV is not set
+CONFIG_USB_EHCI_ROOT_HUB_TT=y
+CONFIG_USB_EHCI_TT_NEWSCHED=y
+# CONFIG_USB_EHSET_TEST_FIXTURE is not set
+# CONFIG_USB_EMI26 is not set
+# CONFIG_USB_EMI62 is not set
+# CONFIG_USB_EPSON2888 is not set
+# CONFIG_USB_ETH is not set
+# CONFIG_USB_EZUSB_FX2 is not set
+# CONFIG_USB_FEW_INIT_RETRIES is not set
+# CONFIG_USB_FOTG210_HCD is not set
+# CONFIG_USB_FOTG210_UDC is not set
+# CONFIG_USB_FSL_USB2 is not set
+# CONFIG_USB_FTDI_ELAN is not set
+# CONFIG_USB_FUNCTIONFS is not set
+# CONFIG_USB_FUSB300 is not set
+# CONFIG_USB_GADGET is not set
+# CONFIG_USB_GADGETFS is not set
+# CONFIG_USB_GADGET_DEBUG is not set
+# CONFIG_USB_GADGET_DEBUG_FILES is not set
+# CONFIG_USB_GADGET_DEBUG_FS is not set
+CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS=2
+CONFIG_USB_GADGET_VBUS_DRAW=2
+# CONFIG_USB_GADGET_XILINX is not set
+# CONFIG_USB_GL860 is not set
+# CONFIG_USB_GOKU is not set
+# CONFIG_USB_GPIO_VBUS is not set
+# CONFIG_USB_GR_UDC is not set
+# CONFIG_USB_GSPCA is not set
+# CONFIG_USB_GSPCA_BENQ is not set
+# CONFIG_USB_GSPCA_CONEX is not set
+# CONFIG_USB_GSPCA_CPIA1 is not set
+# CONFIG_USB_GSPCA_DTCS033 is not set
+# CONFIG_USB_GSPCA_ETOMS is not set
+# CONFIG_USB_GSPCA_FINEPIX is not set
+# CONFIG_USB_GSPCA_JEILINJ is not set
+# CONFIG_USB_GSPCA_JL2005BCD is not set
+# CONFIG_USB_GSPCA_KINECT is not set
+# CONFIG_USB_GSPCA_KONICA is not set
+# CONFIG_USB_GSPCA_MARS is not set
+# CONFIG_USB_GSPCA_MR97310A is not set
+# CONFIG_USB_GSPCA_NW80X is not set
+# CONFIG_USB_GSPCA_OV519 is not set
+# CONFIG_USB_GSPCA_OV534 is not set
+# CONFIG_USB_GSPCA_OV534_9 is not set
+# CONFIG_USB_GSPCA_PAC207 is not set
+# CONFIG_USB_GSPCA_PAC7302 is not set
+# CONFIG_USB_GSPCA_PAC7311 is not set
+# CONFIG_USB_GSPCA_SE401 is not set
+# CONFIG_USB_GSPCA_SN9C2028 is not set
+# CONFIG_USB_GSPCA_SN9C20X is not set
+# CONFIG_USB_GSPCA_SONIXB is not set
+# CONFIG_USB_GSPCA_SONIXJ is not set
+# CONFIG_USB_GSPCA_SPCA1528 is not set
+# CONFIG_USB_GSPCA_SPCA500 is not set
+# CONFIG_USB_GSPCA_SPCA501 is not set
+# CONFIG_USB_GSPCA_SPCA505 is not set
+# CONFIG_USB_GSPCA_SPCA506 is not set
+# CONFIG_USB_GSPCA_SPCA508 is not set
+# CONFIG_USB_GSPCA_SPCA561 is not set
+# CONFIG_USB_GSPCA_SQ905 is not set
+# CONFIG_USB_GSPCA_SQ905C is not set
+# CONFIG_USB_GSPCA_SQ930X is not set
+# CONFIG_USB_GSPCA_STK014 is not set
+# CONFIG_USB_GSPCA_STK1135 is not set
+# CONFIG_USB_GSPCA_STV0680 is not set
+# CONFIG_USB_GSPCA_SUNPLUS is not set
+# CONFIG_USB_GSPCA_T613 is not set
+# CONFIG_USB_GSPCA_TOPRO is not set
+# CONFIG_USB_GSPCA_TOUPTEK is not set
+# CONFIG_USB_GSPCA_TV8532 is not set
+# CONFIG_USB_GSPCA_VC032X is not set
+# CONFIG_USB_GSPCA_VICAM is not set
+# CONFIG_USB_GSPCA_XIRLINK_CIT is not set
+# CONFIG_USB_GSPCA_ZC3XX is not set
+# CONFIG_USB_G_ACM_MS is not set
+# CONFIG_USB_G_DBGP is not set
+# CONFIG_USB_G_HID is not set
+# CONFIG_USB_G_MULTI is not set
+# CONFIG_USB_G_NCM is not set
+# CONFIG_USB_G_NOKIA is not set
+# CONFIG_USB_G_PRINTER is not set
+# CONFIG_USB_G_SERIAL is not set
+# CONFIG_USB_G_WEBCAM is not set
+# CONFIG_USB_HACKRF is not set
+# CONFIG_USB_HCD_TEST_MODE is not set
+# CONFIG_USB_HID is not set
+# CONFIG_USB_HIDDEV is not set
+# CONFIG_USB_HSIC_USB3503 is not set
+# CONFIG_USB_HSIC_USB4604 is not set
+# CONFIG_USB_HSO is not set
+# CONFIG_USB_HUB_USB251XB is not set
+# CONFIG_USB_HWA_HCD is not set
+# CONFIG_USB_IDMOUSE is not set
+# CONFIG_USB_IMX21_HCD is not set
+# CONFIG_USB_IOWARRIOR is not set
+# CONFIG_USB_IPHETH is not set
+# CONFIG_USB_ISIGHTFW is not set
+# CONFIG_USB_ISP116X_HCD is not set
+# CONFIG_USB_ISP1301 is not set
+# CONFIG_USB_ISP1362_HCD is not set
+# CONFIG_USB_ISP1760 is not set
+# CONFIG_USB_ISP1760_HCD is not set
+# CONFIG_USB_KAWETH is not set
+# CONFIG_USB_KBD is not set
+# CONFIG_USB_KC2190 is not set
+# CONFIG_USB_LAN78XX is not set
+# CONFIG_USB_LCD is not set
+# CONFIG_USB_LD is not set
+# CONFIG_USB_LED is not set
+# CONFIG_USB_LEDS_TRIGGER_USBPORT is not set
+# CONFIG_USB_LED_TRIG is not set
+# CONFIG_USB_LEGOTOWER is not set
+# CONFIG_USB_LGM_PHY is not set
+# CONFIG_USB_LINK_LAYER_TEST is not set
+# CONFIG_USB_M5602 is not set
+# CONFIG_USB_M66592 is not set
+# CONFIG_USB_MASS_STORAGE is not set
+# CONFIG_USB_MAX3420_UDC is not set
+# CONFIG_USB_MAX3421_HCD is not set
+# CONFIG_USB_MDC800 is not set
+# CONFIG_USB_MICROTEK is not set
+# CONFIG_USB_MIDI_GADGET is not set
+# CONFIG_USB_MON is not set
+# CONFIG_USB_MOUSE is not set
+# CONFIG_USB_MSI2500 is not set
+# CONFIG_USB_MSM_OTG is not set
+# CONFIG_USB_MTU3 is not set
+# CONFIG_USB_MUSB_GADGET is not set
+# CONFIG_USB_MUSB_HDRC is not set
+# CONFIG_USB_MUSB_HOST is not set
+# CONFIG_USB_MV_U3D is not set
+# CONFIG_USB_MV_UDC is not set
+# CONFIG_USB_MXS_PHY is not set
+# CONFIG_USB_NET2272 is not set
+# CONFIG_USB_NET2280 is not set
+# CONFIG_USB_NET_AQC111 is not set
+# CONFIG_USB_NET_AX88179_178A is not set
+# CONFIG_USB_NET_AX8817X is not set
+# CONFIG_USB_NET_CDCETHER is not set
+# CONFIG_USB_NET_CDC_EEM is not set
+# CONFIG_USB_NET_CDC_MBIM is not set
+# CONFIG_USB_NET_CDC_NCM is not set
+# CONFIG_USB_NET_CDC_SUBSET is not set
+# CONFIG_USB_NET_CH9200 is not set
+# CONFIG_USB_NET_CX82310_ETH is not set
+# CONFIG_USB_NET_DM9601 is not set
+# CONFIG_USB_NET_DRIVERS is not set
+# CONFIG_USB_NET_GL620A is not set
+# CONFIG_USB_NET_HUAWEI_CDC_NCM is not set
+# CONFIG_USB_NET_INT51X1 is not set
+# CONFIG_USB_NET_KALMIA is not set
+# CONFIG_USB_NET_MCS7830 is not set
+# CONFIG_USB_NET_NET1080 is not set
+# CONFIG_USB_NET_PLUSB is not set
+# CONFIG_USB_NET_QMI_WWAN is not set
+# CONFIG_USB_NET_RNDIS_HOST is not set
+# CONFIG_USB_NET_RNDIS_WLAN is not set
+# CONFIG_USB_NET_SMSC75XX is not set
+# CONFIG_USB_NET_SMSC95XX is not set
+# CONFIG_USB_NET_SR9700 is not set
+# CONFIG_USB_NET_SR9800 is not set
+# CONFIG_USB_NET_ZAURUS is not set
+# CONFIG_USB_OHCI_HCD is not set
+# CONFIG_USB_OHCI_HCD_PCI is not set
+# CONFIG_USB_OHCI_HCD_PPC_OF is not set
+# CONFIG_USB_OHCI_HCD_PPC_OF_BE is not set
+# CONFIG_USB_OHCI_HCD_PPC_OF_LE is not set
+# CONFIG_USB_OHCI_HCD_SSB is not set
+CONFIG_USB_OHCI_LITTLE_ENDIAN=y
+# CONFIG_USB_ONBOARD_HUB is not set
+# CONFIG_USB_OTG is not set
+# CONFIG_USB_OTG_BLACKLIST_HUB is not set
+# CONFIG_USB_OTG_DISABLE_EXTERNAL_HUB is not set
+# CONFIG_USB_OTG_FSM is not set
+# CONFIG_USB_OTG_PRODUCTLIST is not set
+# CONFIG_USB_OTG_WHITELIST is not set
+# CONFIG_USB_OXU210HP_HCD is not set
+# CONFIG_USB_PCI is not set
+# CONFIG_USB_PEGASUS is not set
+# CONFIG_USB_PHY is not set
+# CONFIG_USB_PRINTER is not set
+# CONFIG_USB_PWC_INPUT_EVDEV is not set
+# CONFIG_USB_PXA27X is not set
+# CONFIG_USB_QCOM_EUD is not set
+# CONFIG_USB_R8A66597 is not set
+# CONFIG_USB_R8A66597_HCD is not set
+# CONFIG_USB_RAW_GADGET is not set
+# CONFIG_USB_RCAR_PHY is not set
+# CONFIG_USB_RENESAS_USBHS is not set
+# CONFIG_USB_RIO500 is not set
+# CONFIG_USB_ROLES_INTEL_XHCI is not set
+# CONFIG_USB_ROLE_SWITCH is not set
+# CONFIG_USB_RTL8150 is not set
+# CONFIG_USB_RTL8152 is not set
+# CONFIG_USB_RTL8153_ECM is not set
+# CONFIG_USB_S2255 is not set
+# CONFIG_USB_SERIAL is not set
+# CONFIG_USB_SERIAL_AIRCABLE is not set
+# CONFIG_USB_SERIAL_ARK3116 is not set
+# CONFIG_USB_SERIAL_BELKIN is not set
+# CONFIG_USB_SERIAL_CH341 is not set
+# CONFIG_USB_SERIAL_CP210X is not set
+# CONFIG_USB_SERIAL_CYBERJACK is not set
+# CONFIG_USB_SERIAL_CYPRESS_M8 is not set
+# CONFIG_USB_SERIAL_DEBUG is not set
+# CONFIG_USB_SERIAL_DIGI_ACCELEPORT is not set
+# CONFIG_USB_SERIAL_EDGEPORT is not set
+# CONFIG_USB_SERIAL_EDGEPORT_TI is not set
+# CONFIG_USB_SERIAL_EMPEG is not set
+# CONFIG_USB_SERIAL_F81232 is not set
+# CONFIG_USB_SERIAL_F8153X is not set
+# CONFIG_USB_SERIAL_FTDI_SIO is not set
+# CONFIG_USB_SERIAL_GARMIN is not set
+CONFIG_USB_SERIAL_GENERIC=y
+# CONFIG_USB_SERIAL_IPAQ is not set
+# CONFIG_USB_SERIAL_IPW is not set
+# CONFIG_USB_SERIAL_IR is not set
+# CONFIG_USB_SERIAL_IUU is not set
+# CONFIG_USB_SERIAL_KEYSPAN is not set
+CONFIG_USB_SERIAL_KEYSPAN_MPR=y
+# CONFIG_USB_SERIAL_KEYSPAN_PDA is not set
+CONFIG_USB_SERIAL_KEYSPAN_USA18X=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19QI=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19QW=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19W=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28X=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28XA=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28XB=y
+CONFIG_USB_SERIAL_KEYSPAN_USA49W=y
+CONFIG_USB_SERIAL_KEYSPAN_USA49WLC=y
+# CONFIG_USB_SERIAL_KLSI is not set
+# CONFIG_USB_SERIAL_KOBIL_SCT is not set
+# CONFIG_USB_SERIAL_MCT_U232 is not set
+# CONFIG_USB_SERIAL_METRO is not set
+# CONFIG_USB_SERIAL_MOS7715_PARPORT is not set
+# CONFIG_USB_SERIAL_MOS7720 is not set
+# CONFIG_USB_SERIAL_MOS7840 is not set
+# CONFIG_USB_SERIAL_MXUPORT is not set
+# CONFIG_USB_SERIAL_NAVMAN is not set
+# CONFIG_USB_SERIAL_OMNINET is not set
+# CONFIG_USB_SERIAL_OPTICON is not set
+# CONFIG_USB_SERIAL_OPTION is not set
+# CONFIG_USB_SERIAL_OTI6858 is not set
+# CONFIG_USB_SERIAL_PL2303 is not set
+# CONFIG_USB_SERIAL_QCAUX is not set
+# CONFIG_USB_SERIAL_QT2 is not set
+# CONFIG_USB_SERIAL_QUALCOMM is not set
+# CONFIG_USB_SERIAL_SAFE is not set
+CONFIG_USB_SERIAL_SAFE_PADDED=y
+# CONFIG_USB_SERIAL_SIERRAWIRELESS is not set
+# CONFIG_USB_SERIAL_SIMPLE is not set
+# CONFIG_USB_SERIAL_SPCP8X5 is not set
+# CONFIG_USB_SERIAL_SSU100 is not set
+# CONFIG_USB_SERIAL_SYMBOL is not set
+# CONFIG_USB_SERIAL_TI is not set
+# CONFIG_USB_SERIAL_UPD78F0730 is not set
+# CONFIG_USB_SERIAL_VISOR is not set
+# CONFIG_USB_SERIAL_WHITEHEAT is not set
+# CONFIG_USB_SERIAL_WISHBONE is not set
+# CONFIG_USB_SERIAL_XIRCOM is not set
+# CONFIG_USB_SERIAL_XR is not set
+# CONFIG_USB_SERIAL_XSENS_MT is not set
+# CONFIG_USB_SEVSEG is not set
+# CONFIG_USB_SIERRA_NET is not set
+# CONFIG_USB_SISUSBVGA is not set
+# CONFIG_USB_SL811_HCD is not set
+# CONFIG_USB_SNP_UDC_PLAT is not set
+# CONFIG_USB_SPEEDTOUCH is not set
+# CONFIG_USB_STKWEBCAM is not set
+# CONFIG_USB_STORAGE is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
+# CONFIG_USB_STORAGE_DATAFAB is not set
+# CONFIG_USB_STORAGE_DEBUG is not set
+# CONFIG_USB_STORAGE_ENE_UB6250 is not set
+# CONFIG_USB_STORAGE_FREECOM is not set
+# CONFIG_USB_STORAGE_ISD200 is not set
+# CONFIG_USB_STORAGE_JUMPSHOT is not set
+# CONFIG_USB_STORAGE_KARMA is not set
+# CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_STORAGE_REALTEK is not set
+# CONFIG_USB_STORAGE_SDDR09 is not set
+# CONFIG_USB_STORAGE_SDDR55 is not set
+# CONFIG_USB_STORAGE_USBAT is not set
+# CONFIG_USB_STV06XX is not set
+# CONFIG_USB_SUPPORT is not set
+# CONFIG_USB_SWITCH_FSA9480 is not set
+# CONFIG_USB_TEST is not set
+# CONFIG_USB_TMC is not set
+# CONFIG_USB_TRANCEVIBRATOR is not set
+# CONFIG_USB_UAS is not set
+# CONFIG_USB_UEAGLEATM is not set
+# CONFIG_USB_ULPI is not set
+# CONFIG_USB_ULPI_BUS is not set
+# CONFIG_USB_USBNET is not set
+# CONFIG_USB_USS720 is not set
+# CONFIG_USB_VIDEO_CLASS is not set
+CONFIG_USB_VIDEO_CLASS_INPUT_EVDEV=y
+# CONFIG_USB_VL600 is not set
+# CONFIG_USB_WDM is not set
+# CONFIG_USB_WHCI_HCD is not set
+# CONFIG_USB_WUSB is not set
+# CONFIG_USB_WUSB_CBAF is not set
+# CONFIG_USB_XEN_HCD is not set
+# CONFIG_USB_XHCI_DBGCAP is not set
+# CONFIG_USB_XHCI_HCD is not set
+# CONFIG_USB_XHCI_MVEBU is not set
+# CONFIG_USB_XHCI_PCI_RENESAS is not set
+# CONFIG_USB_XUSBATM is not set
+# CONFIG_USB_YUREX is not set
+# CONFIG_USB_ZD1201 is not set
+# CONFIG_USB_ZERO is not set
+# CONFIG_USB_ZR364XX is not set
+# CONFIG_USELIB is not set
+# CONFIG_USERFAULTFD is not set
+# CONFIG_USERIO is not set
+# CONFIG_USER_DECRYPTED_DATA is not set
+# CONFIG_USE_OF is not set
+# CONFIG_UTS_NS is not set
+# CONFIG_UWB is not set
+# CONFIG_U_SERIAL_CONSOLE is not set
+# CONFIG_V4L_MEM2MEM_DRIVERS is not set
+# CONFIG_V4L_PLATFORM_DRIVERS is not set
+# CONFIG_V4L_TEST_DRIVERS is not set
+# CONFIG_VALIDATE_FS_PARSER is not set
+# CONFIG_VBOXGUEST is not set
+# CONFIG_VCNL3020 is not set
+# CONFIG_VCNL4000 is not set
+# CONFIG_VCNL4035 is not set
+# CONFIG_VCPU_STALL_DETECTOR is not set
+# CONFIG_VDPA is not set
+CONFIG_VDSO=y
+# CONFIG_VEML6030 is not set
+# CONFIG_VEML6070 is not set
+# CONFIG_VETH is not set
+# CONFIG_VEXPRESS_CONFIG is not set
+# CONFIG_VF610_ADC is not set
+# CONFIG_VF610_DAC is not set
+# CONFIG_VFAT_FS is not set
+# CONFIG_VFIO is not set
+# CONFIG_VGASTATE is not set
+# CONFIG_VGA_ARB is not set
+# CONFIG_VGA_CONSOLE is not set
+# CONFIG_VGA_SWITCHEROO is not set
+# CONFIG_VHOST_CROSS_ENDIAN_LEGACY is not set
+CONFIG_VHOST_MENU=y
+# CONFIG_VHOST_NET is not set
+# CONFIG_VHOST_VSOCK is not set
+# CONFIG_VIA_RHINE is not set
+# CONFIG_VIA_VELOCITY is not set
+# CONFIG_VIDEO_AD5398 is not set
+# CONFIG_VIDEO_AD5820 is not set
+# CONFIG_VIDEO_AD9389B is not set
+# CONFIG_VIDEO_ADP1653 is not set
+# CONFIG_VIDEO_ADV7170 is not set
+# CONFIG_VIDEO_ADV7175 is not set
+# CONFIG_VIDEO_ADV7180 is not set
+# CONFIG_VIDEO_ADV7183 is not set
+# CONFIG_VIDEO_ADV7343 is not set
+# CONFIG_VIDEO_ADV7393 is not set
+# CONFIG_VIDEO_ADV748X is not set
+# CONFIG_VIDEO_ADV7511 is not set
+# CONFIG_VIDEO_ADV7604 is not set
+# CONFIG_VIDEO_ADV7842 is not set
+# CONFIG_VIDEO_ADV_DEBUG is not set
+# CONFIG_VIDEO_AK7375 is not set
+# CONFIG_VIDEO_AK881X is not set
+# CONFIG_VIDEO_AM437X_VPFE is not set
+# CONFIG_VIDEO_AR0521 is not set
+# CONFIG_VIDEO_ASPEED is not set
+# CONFIG_VIDEO_ATMEL_ISC is not set
+# CONFIG_VIDEO_ATMEL_ISI is not set
+# CONFIG_VIDEO_AU0828 is not set
+# CONFIG_VIDEO_BT819 is not set
+# CONFIG_VIDEO_BT848 is not set
+# CONFIG_VIDEO_BT856 is not set
+# CONFIG_VIDEO_BT866 is not set
+# CONFIG_VIDEO_CADENCE is not set
+# CONFIG_VIDEO_CADENCE_CSI2RX is not set
+# CONFIG_VIDEO_CADENCE_CSI2TX is not set
+# CONFIG_VIDEO_CAFE_CCIC is not set
+# CONFIG_VIDEO_CCS is not set
+# CONFIG_VIDEO_CODA is not set
+# CONFIG_VIDEO_CS3308 is not set
+# CONFIG_VIDEO_CS5345 is not set
+# CONFIG_VIDEO_CS53L32A is not set
+# CONFIG_VIDEO_CX231XX is not set
+# CONFIG_VIDEO_CX2341X is not set
+# CONFIG_VIDEO_CX25840 is not set
+# CONFIG_VIDEO_CX88 is not set
+# CONFIG_VIDEO_DEV is not set
+# CONFIG_VIDEO_DM6446_CCDC is not set
+# CONFIG_VIDEO_DT3155 is not set
+# CONFIG_VIDEO_DW9714 is not set
+# CONFIG_VIDEO_DW9768 is not set
+# CONFIG_VIDEO_DW9807_VCM is not set
+# CONFIG_VIDEO_EM28XX is not set
+# CONFIG_VIDEO_ET8EK8 is not set
+# CONFIG_VIDEO_FIXED_MINOR_RANGES is not set
+# CONFIG_VIDEO_GO7007 is not set
+# CONFIG_VIDEO_GS1662 is not set
+# CONFIG_VIDEO_HDPVR is not set
+# CONFIG_VIDEO_HEXIUM_GEMINI is not set
+# CONFIG_VIDEO_HEXIUM_ORION is not set
+# CONFIG_VIDEO_HI556 is not set
+# CONFIG_VIDEO_HI846 is not set
+# CONFIG_VIDEO_HI847 is not set
+# CONFIG_VIDEO_I2C is not set
+# CONFIG_VIDEO_IMX208 is not set
+# CONFIG_VIDEO_IMX214 is not set
+# CONFIG_VIDEO_IMX219 is not set
+# CONFIG_VIDEO_IMX258 is not set
+# CONFIG_VIDEO_IMX274 is not set
+# CONFIG_VIDEO_IMX290 is not set
+# CONFIG_VIDEO_IMX319 is not set
+# CONFIG_VIDEO_IMX334 is not set
+# CONFIG_VIDEO_IMX335 is not set
+# CONFIG_VIDEO_IMX355 is not set
+# CONFIG_VIDEO_IMX412 is not set
+# CONFIG_VIDEO_IMX477 is not set
+# CONFIG_VIDEO_IMX8_JPEG is not set
+# CONFIG_VIDEO_IMX_PXP is not set
+# CONFIG_VIDEO_IRS1125 is not set
+# CONFIG_VIDEO_IR_I2C is not set
+# CONFIG_VIDEO_ISL7998X is not set
+# CONFIG_VIDEO_IVTV is not set
+# CONFIG_VIDEO_KS0127 is not set
+# CONFIG_VIDEO_LM3560 is not set
+# CONFIG_VIDEO_LM3646 is not set
+# CONFIG_VIDEO_M52790 is not set
+# CONFIG_VIDEO_M5MOLS is not set
+# CONFIG_VIDEO_MAX9286 is not set
+# CONFIG_VIDEO_MEM2MEM_DEINTERLACE is not set
+# CONFIG_VIDEO_ML86V7667 is not set
+# CONFIG_VIDEO_MSP3400 is not set
+# CONFIG_VIDEO_MT9M001 is not set
+# CONFIG_VIDEO_MT9M032 is not set
+# CONFIG_VIDEO_MT9M111 is not set
+# CONFIG_VIDEO_MT9P031 is not set
+# CONFIG_VIDEO_MT9T001 is not set
+# CONFIG_VIDEO_MT9T112 is not set
+# CONFIG_VIDEO_MT9V011 is not set
+# CONFIG_VIDEO_MT9V032 is not set
+# CONFIG_VIDEO_MT9V111 is not set
+# CONFIG_VIDEO_MUX is not set
+# CONFIG_VIDEO_MXB is not set
+# CONFIG_VIDEO_NOON010PC30 is not set
+# CONFIG_VIDEO_OG01A1B is not set
+# CONFIG_VIDEO_OMAP2_VOUT is not set
+# CONFIG_VIDEO_OV02A10 is not set
+# CONFIG_VIDEO_OV08D10 is not set
+# CONFIG_VIDEO_OV13858 is not set
+# CONFIG_VIDEO_OV13B10 is not set
+# CONFIG_VIDEO_OV2311 is not set
+# CONFIG_VIDEO_OV2640 is not set
+# CONFIG_VIDEO_OV2659 is not set
+# CONFIG_VIDEO_OV2680 is not set
+# CONFIG_VIDEO_OV2685 is not set
+# CONFIG_VIDEO_OV2740 is not set
+# CONFIG_VIDEO_OV5640 is not set
+# CONFIG_VIDEO_OV5645 is not set
+# CONFIG_VIDEO_OV5647 is not set
+# CONFIG_VIDEO_OV5648 is not set
+# CONFIG_VIDEO_OV5670 is not set
+# CONFIG_VIDEO_OV5675 is not set
+# CONFIG_VIDEO_OV5693 is not set
+# CONFIG_VIDEO_OV5695 is not set
+# CONFIG_VIDEO_OV6650 is not set
+# CONFIG_VIDEO_OV7251 is not set
+# CONFIG_VIDEO_OV7640 is not set
+# CONFIG_VIDEO_OV7670 is not set
+# CONFIG_VIDEO_OV772X is not set
+# CONFIG_VIDEO_OV7740 is not set
+# CONFIG_VIDEO_OV8856 is not set
+# CONFIG_VIDEO_OV8865 is not set
+# CONFIG_VIDEO_OV9281 is not set
+# CONFIG_VIDEO_OV9282 is not set
+# CONFIG_VIDEO_OV9640 is not set
+# CONFIG_VIDEO_OV9650 is not set
+# CONFIG_VIDEO_OV9734 is not set
+# CONFIG_VIDEO_PVRUSB2 is not set
+# CONFIG_VIDEO_RDACM20 is not set
+# CONFIG_VIDEO_RDACM21 is not set
+# CONFIG_VIDEO_RJ54N1 is not set
+# CONFIG_VIDEO_S5C73M3 is not set
+# CONFIG_VIDEO_S5K4ECGX is not set
+# CONFIG_VIDEO_S5K5BAF is not set
+# CONFIG_VIDEO_S5K6A3 is not set
+# CONFIG_VIDEO_S5K6AA is not set
+# CONFIG_VIDEO_SAA6588 is not set
+# CONFIG_VIDEO_SAA6752HS is not set
+# CONFIG_VIDEO_SAA7110 is not set
+# CONFIG_VIDEO_SAA711X is not set
+# CONFIG_VIDEO_SAA7127 is not set
+# CONFIG_VIDEO_SAA7134 is not set
+# CONFIG_VIDEO_SAA717X is not set
+# CONFIG_VIDEO_SAA7185 is not set
+# CONFIG_VIDEO_SH_MOBILE_CEU is not set
+# CONFIG_VIDEO_SMIAPP is not set
+# CONFIG_VIDEO_SONY_BTF_MPX is not set
+# CONFIG_VIDEO_SR030PC30 is not set
+# CONFIG_VIDEO_STK1160_COMMON is not set
+# CONFIG_VIDEO_ST_MIPID02 is not set
+# CONFIG_VIDEO_TC358743 is not set
+# CONFIG_VIDEO_TDA1997X is not set
+# CONFIG_VIDEO_TDA7432 is not set
+# CONFIG_VIDEO_TDA9840 is not set
+# CONFIG_VIDEO_TEA6415C is not set
+# CONFIG_VIDEO_TEA6420 is not set
+# CONFIG_VIDEO_THS7303 is not set
+# CONFIG_VIDEO_THS8200 is not set
+# CONFIG_VIDEO_TIMBERDALE is not set
+# CONFIG_VIDEO_TLV320AIC23B is not set
+# CONFIG_VIDEO_TM6000 is not set
+# CONFIG_VIDEO_TVAUDIO is not set
+# CONFIG_VIDEO_TVP514X is not set
+# CONFIG_VIDEO_TVP5150 is not set
+# CONFIG_VIDEO_TVP7002 is not set
+# CONFIG_VIDEO_TW2804 is not set
+# CONFIG_VIDEO_TW9903 is not set
+# CONFIG_VIDEO_TW9906 is not set
+# CONFIG_VIDEO_TW9910 is not set
+# CONFIG_VIDEO_UDA1342 is not set
+# CONFIG_VIDEO_UPD64031A is not set
+# CONFIG_VIDEO_UPD64083 is not set
+# CONFIG_VIDEO_USBTV is not set
+# CONFIG_VIDEO_USBVISION is not set
+# CONFIG_VIDEO_V4L2 is not set
+# CONFIG_VIDEO_VP27SMPX is not set
+# CONFIG_VIDEO_VPX3220 is not set
+# CONFIG_VIDEO_VS6624 is not set
+# CONFIG_VIDEO_WM8739 is not set
+# CONFIG_VIDEO_WM8775 is not set
+# CONFIG_VIDEO_XILINX is not set
+# CONFIG_VIDEO_ZORAN is not set
+# CONFIG_VIRTIO_BALLOON is not set
+# CONFIG_VIRTIO_BLK_SCSI is not set
+# CONFIG_VIRTIO_CONSOLE is not set
+# CONFIG_VIRTIO_FS is not set
+# CONFIG_VIRTIO_INPUT is not set
+CONFIG_VIRTIO_MENU=y
+# CONFIG_VIRTIO_MMIO is not set
+# CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES is not set
+# CONFIG_VIRTIO_PCI is not set
+# CONFIG_VIRTUALIZATION is not set
+# CONFIG_VIRT_CPU_ACCOUNTING_GEN is not set
+# CONFIG_VIRT_DRIVERS is not set
+CONFIG_VIRT_TO_BUS=y
+# CONFIG_VITESSE_PHY is not set
+# CONFIG_VL53L0X_I2C is not set
+# CONFIG_VL6180 is not set
+CONFIG_VLAN_8021Q=y
+# CONFIG_VLAN_8021Q_GVRP is not set
+# CONFIG_VLAN_8021Q_MVRP is not set
+# CONFIG_VMAP_STACK is not set
+# CONFIG_VME_BUS is not set
+# CONFIG_VMLINUX_MAP is not set
+# CONFIG_VMSPLIT_1G is not set
+# CONFIG_VMSPLIT_2G is not set
+# CONFIG_VMSPLIT_2G_OPT is not set
+CONFIG_VMSPLIT_3G=y
+# CONFIG_VMSPLIT_3G_OPT is not set
+# CONFIG_VMWARE_PVSCSI is not set
+# CONFIG_VMWARE_VMCI is not set
+# CONFIG_VMXNET3 is not set
+# CONFIG_VM_EVENT_COUNTERS is not set
+# CONFIG_VOP_BUS is not set
+# CONFIG_VORTEX is not set
+# CONFIG_VSOCKETS is not set
+# CONFIG_VSOCKETS_DIAG is not set
+# CONFIG_VT is not set
+# CONFIG_VT6655 is not set
+# CONFIG_VT6656 is not set
+# CONFIG_VXFS_FS is not set
+# CONFIG_VXGE is not set
+# CONFIG_VXLAN is not set
+# CONFIG_VZ89X is not set
+# CONFIG_W1 is not set
+# CONFIG_W1_CON is not set
+# CONFIG_W1_MASTER_DS1WM is not set
+# CONFIG_W1_MASTER_DS2482 is not set
+# CONFIG_W1_MASTER_DS2490 is not set
+# CONFIG_W1_MASTER_GPIO is not set
+# CONFIG_W1_MASTER_MATROX is not set
+# CONFIG_W1_MASTER_SGI is not set
+# CONFIG_W1_SLAVE_DS2405 is not set
+# CONFIG_W1_SLAVE_DS2406 is not set
+# CONFIG_W1_SLAVE_DS2408 is not set
+# CONFIG_W1_SLAVE_DS2413 is not set
+# CONFIG_W1_SLAVE_DS2423 is not set
+# CONFIG_W1_SLAVE_DS2430 is not set
+# CONFIG_W1_SLAVE_DS2431 is not set
+# CONFIG_W1_SLAVE_DS2433 is not set
+# CONFIG_W1_SLAVE_DS2438 is not set
+# CONFIG_W1_SLAVE_DS250X is not set
+# CONFIG_W1_SLAVE_DS2780 is not set
+# CONFIG_W1_SLAVE_DS2781 is not set
+# CONFIG_W1_SLAVE_DS2805 is not set
+# CONFIG_W1_SLAVE_DS28E04 is not set
+# CONFIG_W1_SLAVE_DS28E17 is not set
+# CONFIG_W1_SLAVE_SMEM is not set
+# CONFIG_W1_SLAVE_THERM is not set
+# CONFIG_W83627HF_WDT is not set
+# CONFIG_W83877F_WDT is not set
+# CONFIG_W83977F_WDT is not set
+# CONFIG_WAN is not set
+# CONFIG_WANXL is not set
+# CONFIG_WARN_ALL_UNSEEDED_RANDOM is not set
+CONFIG_WATCHDOG=y
+# CONFIG_WATCHDOG_CORE is not set
+CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED=y
+# CONFIG_WATCHDOG_HRTIMER_PRETIMEOUT is not set
+# CONFIG_WATCHDOG_NOWAYOUT is not set
+CONFIG_WATCHDOG_OPEN_TIMEOUT=0
+# CONFIG_WATCHDOG_PRETIMEOUT_GOV is not set
+# CONFIG_WATCHDOG_SYSFS is not set
+# CONFIG_WATCH_QUEUE is not set
+# CONFIG_WD80x3 is not set
+# CONFIG_WDAT_WDT is not set
+# CONFIG_WDTPCI is not set
+CONFIG_WERROR=y
+# CONFIG_WEXT_CORE is not set
+# CONFIG_WEXT_PRIV is not set
+# CONFIG_WEXT_PROC is not set
+# CONFIG_WEXT_SPY is not set
+CONFIG_WILINK_PLATFORM_DATA=y
+# CONFIG_WIMAX is not set
+# CONFIG_WIREGUARD is not set
+CONFIG_WIRELESS=y
+# CONFIG_WIRELESS_EXT is not set
+# CONFIG_WIRELESS_WDS is not set
+# CONFIG_WIZNET_W5100 is not set
+# CONFIG_WIZNET_W5300 is not set
+# CONFIG_WL1251 is not set
+# CONFIG_WL12XX is not set
+# CONFIG_WL18XX is not set
+CONFIG_WLAN=y
+# CONFIG_WLAN_VENDOR_ADMTEK is not set
+# CONFIG_WLAN_VENDOR_ATH is not set
+# CONFIG_WLAN_VENDOR_ATMEL is not set
+# CONFIG_WLAN_VENDOR_BROADCOM is not set
+# CONFIG_WLAN_VENDOR_CISCO is not set
+# CONFIG_WLAN_VENDOR_INTEL is not set
+# CONFIG_WLAN_VENDOR_INTERSIL is not set
+# CONFIG_WLAN_VENDOR_MARVELL is not set
+# CONFIG_WLAN_VENDOR_MEDIATEK is not set
+# CONFIG_WLAN_VENDOR_MICROCHIP is not set
+# CONFIG_WLAN_VENDOR_PURELIFI is not set
+# CONFIG_WLAN_VENDOR_QUANTENNA is not set
+# CONFIG_WLAN_VENDOR_RALINK is not set
+# CONFIG_WLAN_VENDOR_REALTEK is not set
+# CONFIG_WLAN_VENDOR_RSI is not set
+# CONFIG_WLAN_VENDOR_SILABS is not set
+# CONFIG_WLAN_VENDOR_ST is not set
+# CONFIG_WLAN_VENDOR_TI is not set
+# CONFIG_WLAN_VENDOR_ZYDAS is not set
+# CONFIG_WLCORE is not set
+CONFIG_WQ_POWER_EFFICIENT_DEFAULT=y
+# CONFIG_WQ_WATCHDOG is not set
+# CONFIG_WWAN is not set
+# CONFIG_WWAN_HWSIM is not set
+# CONFIG_WW_MUTEX_SELFTEST is not set
+# CONFIG_X25 is not set
+# CONFIG_X509_CERTIFICATE_PARSER is not set
+# CONFIG_X86_PKG_TEMP_THERMAL is not set
+CONFIG_X86_SYSFB=y
+# CONFIG_XDP_SOCKETS is not set
+# CONFIG_XEN is not set
+# CONFIG_XEN_GRANT_DMA_ALLOC is not set
+# CONFIG_XEN_PVCALLS_FRONTEND is not set
+CONFIG_XEN_SCRUB_PAGES_DEFAULT=y
+CONFIG_XFRM=y
+# CONFIG_XFRM_INTERFACE is not set
+# CONFIG_XFRM_IPCOMP is not set
+# CONFIG_XFRM_MIGRATE is not set
+# CONFIG_XFRM_STATISTICS is not set
+# CONFIG_XFRM_SUB_POLICY is not set
+# CONFIG_XFRM_USER is not set
+# CONFIG_XFS_DEBUG is not set
+# CONFIG_XFS_FS is not set
+# CONFIG_XFS_ONLINE_SCRUB is not set
+# CONFIG_XFS_POSIX_ACL is not set
+# CONFIG_XFS_QUOTA is not set
+# CONFIG_XFS_RT is not set
+# CONFIG_XFS_SUPPORT_V4 is not set
+# CONFIG_XFS_WARN is not set
+# CONFIG_XILINX_AXI_EMAC is not set
+# CONFIG_XILINX_DMA is not set
+# CONFIG_XILINX_EMACLITE is not set
+# CONFIG_XILINX_GMII2RGMII is not set
+# CONFIG_XILINX_INTC is not set
+# CONFIG_XILINX_LL_TEMAC is not set
+# CONFIG_XILINX_SDFEC is not set
+# CONFIG_XILINX_VCU is not set
+# CONFIG_XILINX_WATCHDOG is not set
+# CONFIG_XILINX_XADC is not set
+# CONFIG_XILINX_ZYNQMP_DMA is not set
+# CONFIG_XILINX_ZYNQMP_DPDMA is not set
+# CONFIG_XILLYBUS is not set
+# CONFIG_XILLYUSB is not set
+# CONFIG_XIL_AXIS_FIFO is not set
+# CONFIG_XIP_KERNEL is not set
+# CONFIG_XMON is not set
+CONFIG_XZ_DEC=y
+# CONFIG_XZ_DEC_ARM is not set
+# CONFIG_XZ_DEC_ARMTHUMB is not set
+# CONFIG_XZ_DEC_BCJ is not set
+# CONFIG_XZ_DEC_IA64 is not set
+# CONFIG_XZ_DEC_MICROLZMA is not set
+# CONFIG_XZ_DEC_POWERPC is not set
+# CONFIG_XZ_DEC_SPARC is not set
+# CONFIG_XZ_DEC_TEST is not set
+# CONFIG_XZ_DEC_X86 is not set
+# CONFIG_YAM is not set
+# CONFIG_YAMAHA_YAS530 is not set
+# CONFIG_YELLOWFIN is not set
+# CONFIG_YENTA is not set
+# CONFIG_YENTA_O2 is not set
+# CONFIG_YENTA_RICOH is not set
+# CONFIG_YENTA_TI is not set
+# CONFIG_YENTA_TOSHIBA is not set
+# CONFIG_ZBUD is not set
+# CONFIG_ZD1211RW is not set
+# CONFIG_ZD1211RW_DEBUG is not set
+# CONFIG_ZEROPLUS_FF is not set
+# CONFIG_ZERO_CALL_USED_REGS is not set
+# CONFIG_ZIIRAVE_WATCHDOG is not set
+# CONFIG_ZISOFS is not set
+# CONFIG_ZLIB_DEFLATE is not set
+# CONFIG_ZLIB_INFLATE is not set
+CONFIG_ZONE_DMA=y
+# CONFIG_ZOPT2201 is not set
+# CONFIG_ZPA2326 is not set
+# CONFIG_ZPOOL is not set
+# CONFIG_ZRAM is not set
+# CONFIG_ZRAM_DEF_COMP_842 is not set
+# CONFIG_ZRAM_DEF_COMP_LZ4 is not set
+# CONFIG_ZRAM_DEF_COMP_LZ4HC is not set
+# CONFIG_ZRAM_DEF_COMP_LZO is not set
+# CONFIG_ZRAM_DEF_COMP_LZORLE is not set
+# CONFIG_ZRAM_DEF_COMP_ZSTD is not set
+# CONFIG_ZRAM_MEMORY_TRACKING is not set
+# CONFIG_ZSMALLOC is not set
+# CONFIG_ZSWAP is not set
+# CONFIG_ZX_TDM is not set
diff --git a/target/linux/generic/config-filter b/target/linux/generic/config-filter
index 16daecf321235a..e7aa90f8b548f4 100644
--- a/target/linux/generic/config-filter
+++ b/target/linux/generic/config-filter
@@ -9,6 +9,8 @@ CONFIG_CLANG_VERSION=.*
 # CONFIG_INLINE_.* is not set
 # CONFIG_LD_.* is not set
 CONFIG_LLD_VERSION=.*
+CONFIG_PAHOLE_VERSION=.*
+CONFIG_PAHOLE_HAS_SPLIT_BTF=.*
 CONFIG_PLUGIN_HOSTCC=".*"
 # CONFIG_SET_FS is not set
 # CONFIG_TASKS_.* is not set
diff --git a/target/linux/generic/files/block/partitions/fit.c b/target/linux/generic/files/block/partitions/fit.c
index ce6a2b54115c97..91b25e0581e7e0 100644
--- a/target/linux/generic/files/block/partitions/fit.c
+++ b/target/linux/generic/files/block/partitions/fit.c
@@ -73,11 +73,7 @@
 
 int parse_fit_partitions(struct parsed_partitions *state, u64 fit_start_sector, u64 sectors, int *slot, int add_remain)
 {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
 	struct block_device *bdev = state->disk->part0;
-#else
-	struct block_device *bdev = state->bdev;
-#endif
 	struct address_space *mapping = bdev->bd_inode->i_mapping;
 	struct page *page;
 	void *fit, *init_fit;
@@ -88,13 +84,13 @@ int parse_fit_partitions(struct parsed_partitions *state, u64 fit_start_sector,
 	const u32 *image_offset_be, *image_len_be, *image_pos_be;
 	int ret = 1, node, images, config;
 	const char *image_name, *image_type, *image_description, *config_default,
-		*config_description, *config_loadables;
+		*config_description, *config_loadables, *bootconf_c;
 	int image_name_len, image_type_len, image_description_len, config_default_len,
-		config_description_len, config_loadables_len;
+		config_description_len, config_loadables_len, bootconf_len;
 	sector_t start_sect, nr_sects;
 	size_t label_min;
 	struct device_node *np = NULL;
-	const char *bootconf;
+	char *bootconf = NULL, *bootconf_term;
 	const char *loadable;
 	const char *select_rootfs = NULL;
 	bool found;
@@ -147,10 +143,17 @@ int parse_fit_partitions(struct parsed_partitions *state, u64 fit_start_sector,
 		return -ENOMEM;
 
 	np = of_find_node_by_path("/chosen");
-	if (np)
-		bootconf = of_get_property(np, "u-boot,bootconf", NULL);
-	else
-		bootconf = NULL;
+	if (np) {
+		bootconf_c = of_get_property(np, "u-boot,bootconf", &bootconf_len);
+		if (bootconf_c && bootconf_len)
+			bootconf = kmemdup_nul(bootconf_c, bootconf_len, GFP_KERNEL);
+	}
+
+	if (bootconf) {
+		bootconf_term = strchr(bootconf, '#');
+		if (bootconf_term)
+			*bootconf_term = '\0';
+	}
 
 	config = fdt_path_offset(fit, FIT_CONFS_PATH);
 	if (config < 0) {
@@ -289,6 +292,7 @@ int parse_fit_partitions(struct parsed_partitions *state, u64 fit_start_sector,
 		strlcat(state->pp_buf, tmp, PAGE_SIZE);
 	}
 ret_out:
+	kfree(bootconf);
 	kfree(fit);
 	return ret;
 }
diff --git a/target/linux/generic/files/drivers/bcma/fallback-sprom.c b/target/linux/generic/files/drivers/bcma/fallback-sprom.c
new file mode 100644
index 00000000000000..db583fca9cc2a7
--- /dev/null
+++ b/target/linux/generic/files/drivers/bcma/fallback-sprom.c
@@ -0,0 +1,533 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * BCMA Fallback SPROM Driver
+ *
+ * Copyright (C) 2020 Álvaro Fernández Rojas <noltari@gmail.com>
+ * Copyright (C) 2014 Jonas Gorski <jonas.gorski@gmail.com>
+ * Copyright (C) 2008 Maxime Bizon <mbizon@freebox.fr>
+ * Copyright (C) 2008 Florian Fainelli <f.fainelli@gmail.com>
+ */
+
+#include <linux/bcma/bcma.h>
+#include <linux/etherdevice.h>
+#include <linux/firmware.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/mtd/mtd.h>
+#include <linux/of_net.h>
+#include <linux/of_platform.h>
+
+#define BCMA_FBS_MAX_SIZE 468
+
+/* SPROM Extraction */
+#define SPOFF(offset)	((offset) / sizeof(u16))
+
+#define SPEX(_outvar, _offset, _mask, _shift)	\
+	out->_outvar = ((in[SPOFF(_offset)] & (_mask)) >> (_shift))
+
+#define SPEX32(_outvar, _offset, _mask, _shift)	\
+	out->_outvar = ((((u32)in[SPOFF((_offset)+2)] << 16 | \
+			   in[SPOFF(_offset)]) & (_mask)) >> (_shift))
+
+#define SPEX_ARRAY8(_field, _offset, _mask, _shift)	\
+	do {	\
+		SPEX(_field[0], _offset +  0, _mask, _shift);	\
+		SPEX(_field[1], _offset +  2, _mask, _shift);	\
+		SPEX(_field[2], _offset +  4, _mask, _shift);	\
+		SPEX(_field[3], _offset +  6, _mask, _shift);	\
+		SPEX(_field[4], _offset +  8, _mask, _shift);	\
+		SPEX(_field[5], _offset + 10, _mask, _shift);	\
+		SPEX(_field[6], _offset + 12, _mask, _shift);	\
+		SPEX(_field[7], _offset + 14, _mask, _shift);	\
+	} while (0)
+
+struct bcma_fbs {
+	struct device *dev;
+	struct list_head list;
+	struct ssb_sprom sprom;
+	u32 pci_bus;
+	u32 pci_dev;
+	bool devid_override;
+};
+
+static DEFINE_SPINLOCK(bcma_fbs_lock);
+static struct list_head bcma_fbs_list = LIST_HEAD_INIT(bcma_fbs_list);
+
+int bcma_get_fallback_sprom(struct bcma_bus *bus, struct ssb_sprom *out)
+{
+	struct bcma_fbs *pos;
+	u32 pci_bus, pci_dev;
+
+	if (bus->hosttype != BCMA_HOSTTYPE_PCI)
+		return -ENOENT;
+
+	pci_bus = bus->host_pci->bus->number;
+	pci_dev = PCI_SLOT(bus->host_pci->devfn);
+
+	list_for_each_entry(pos, &bcma_fbs_list, list) {
+		if (pos->pci_bus != pci_bus ||
+		    pos->pci_dev != pci_dev)
+		    	continue;
+
+		if (pos->devid_override)
+			bus->host_pci->device = pos->sprom.dev_id;
+
+		memcpy(out, &pos->sprom, sizeof(struct ssb_sprom));
+		dev_info(pos->dev, "requested by [%x:%x]",
+			 pos->pci_bus, pos->pci_dev);
+
+		return 0;
+	}
+
+	pr_err("unable to fill SPROM for [%x:%x]\n", pci_bus, pci_dev);
+
+	return -EINVAL;
+}
+
+static s8 sprom_extract_antgain(const u16 *in, u16 offset, u16 mask, u16 shift)
+{
+	u16 v;
+	u8 gain;
+
+	v = in[SPOFF(offset)];
+	gain = (v & mask) >> shift;
+	if (gain == 0xFF) {
+		gain = 8; /* If unset use 2dBm */
+	} else {
+		/* Q5.2 Fractional part is stored in 0xC0 */
+		gain = ((gain & 0xC0) >> 6) | ((gain & 0x3F) << 2);
+	}
+
+	return (s8)gain;
+}
+
+static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
+{
+	static const u16 pwr_info_offset[] = {
+		SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
+		SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
+	};
+	u16 o;
+	int i;
+
+	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
+		     ARRAY_SIZE(out->core_pwr_info));
+
+	SPEX(board_rev, SSB_SPROM8_BOARDREV, ~0, 0);
+	SPEX(board_type, SSB_SPROM1_SPID, ~0, 0);
+
+	SPEX(txpid2g[0], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G0,
+	     SSB_SPROM4_TXPID2G0_SHIFT);
+	SPEX(txpid2g[1], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G1,
+	     SSB_SPROM4_TXPID2G1_SHIFT);
+	SPEX(txpid2g[2], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G2,
+	     SSB_SPROM4_TXPID2G2_SHIFT);
+	SPEX(txpid2g[3], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G3,
+	     SSB_SPROM4_TXPID2G3_SHIFT);
+
+	SPEX(txpid5gl[0], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL0,
+	     SSB_SPROM4_TXPID5GL0_SHIFT);
+	SPEX(txpid5gl[1], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL1,
+	     SSB_SPROM4_TXPID5GL1_SHIFT);
+	SPEX(txpid5gl[2], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL2,
+	     SSB_SPROM4_TXPID5GL2_SHIFT);
+	SPEX(txpid5gl[3], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL3,
+	     SSB_SPROM4_TXPID5GL3_SHIFT);
+
+	SPEX(txpid5g[0], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G0,
+	     SSB_SPROM4_TXPID5G0_SHIFT);
+	SPEX(txpid5g[1], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G1,
+	     SSB_SPROM4_TXPID5G1_SHIFT);
+	SPEX(txpid5g[2], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G2,
+	     SSB_SPROM4_TXPID5G2_SHIFT);
+	SPEX(txpid5g[3], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G3,
+	     SSB_SPROM4_TXPID5G3_SHIFT);
+
+	SPEX(txpid5gh[0], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH0,
+	     SSB_SPROM4_TXPID5GH0_SHIFT);
+	SPEX(txpid5gh[1], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH1,
+	     SSB_SPROM4_TXPID5GH1_SHIFT);
+	SPEX(txpid5gh[2], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH2,
+	     SSB_SPROM4_TXPID5GH2_SHIFT);
+	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH3,
+	     SSB_SPROM4_TXPID5GH3_SHIFT);
+
+	SPEX(boardflags_lo, SSB_SPROM8_BFLLO, ~0, 0);
+	SPEX(boardflags_hi, SSB_SPROM8_BFLHI, ~0, 0);
+	SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, ~0, 0);
+	SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, ~0, 0);
+
+	SPEX(alpha2[0], SSB_SPROM8_CCODE, 0xff00, 8);
+	SPEX(alpha2[1], SSB_SPROM8_CCODE, 0x00ff, 0);
+
+	/* Extract core's power info */
+	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
+		o = pwr_info_offset[i];
+		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
+			SSB_SPROM8_2G_ITSSI, SSB_SPROM8_2G_ITSSI_SHIFT);
+		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
+			SSB_SPROM8_2G_MAXP, 0);
+
+		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SROM8_2G_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SROM8_2G_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SROM8_2G_PA_2, ~0, 0);
+
+		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
+			SSB_SPROM8_5G_ITSSI, SSB_SPROM8_5G_ITSSI_SHIFT);
+		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
+			SSB_SPROM8_5G_MAXP, 0);
+		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM8_5GHL_MAXP,
+			SSB_SPROM8_5GH_MAXP, 0);
+		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM8_5GHL_MAXP,
+			SSB_SPROM8_5GL_MAXP, SSB_SPROM8_5GL_MAXP_SHIFT);
+
+		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SROM8_5GL_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SROM8_5GL_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SROM8_5GL_PA_2, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SROM8_5G_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SROM8_5G_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SROM8_5G_PA_2, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SROM8_5GH_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SROM8_5GH_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SROM8_5GH_PA_2, ~0, 0);
+	}
+
+	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TSSIPOS,
+	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
+	SPEX(fem.ghz2.extpa_gain, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_EXTPA_GAIN,
+	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
+	SPEX(fem.ghz2.pdet_range, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_PDET_RANGE,
+	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
+	SPEX(fem.ghz2.tr_iso, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TR_ISO,
+	     SSB_SROM8_FEM_TR_ISO_SHIFT);
+	SPEX(fem.ghz2.antswlut, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_ANTSWLUT,
+	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
+
+	SPEX(fem.ghz5.tssipos, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TSSIPOS,
+	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
+	SPEX(fem.ghz5.extpa_gain, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_EXTPA_GAIN,
+	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
+	SPEX(fem.ghz5.pdet_range, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_PDET_RANGE,
+	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
+	SPEX(fem.ghz5.tr_iso, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TR_ISO,
+	     SSB_SROM8_FEM_TR_ISO_SHIFT);
+	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_ANTSWLUT,
+	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
+
+	SPEX(ant_available_a, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_A,
+	     SSB_SPROM8_ANTAVAIL_A_SHIFT);
+	SPEX(ant_available_bg, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_BG,
+	     SSB_SPROM8_ANTAVAIL_BG_SHIFT);
+	SPEX(maxpwr_bg, SSB_SPROM8_MAXP_BG, SSB_SPROM8_MAXP_BG_MASK, 0);
+	SPEX(itssi_bg, SSB_SPROM8_MAXP_BG, SSB_SPROM8_ITSSI_BG,
+	     SSB_SPROM8_ITSSI_BG_SHIFT);
+	SPEX(maxpwr_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_MAXP_A_MASK, 0);
+	SPEX(itssi_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_ITSSI_A,
+	     SSB_SPROM8_ITSSI_A_SHIFT);
+	SPEX(maxpwr_ah, SSB_SPROM8_MAXP_AHL, SSB_SPROM8_MAXP_AH_MASK, 0);
+	SPEX(maxpwr_al, SSB_SPROM8_MAXP_AHL, SSB_SPROM8_MAXP_AL_MASK,
+	     SSB_SPROM8_MAXP_AL_SHIFT);
+	SPEX(gpio0, SSB_SPROM8_GPIOA, SSB_SPROM8_GPIOA_P0, 0);
+	SPEX(gpio1, SSB_SPROM8_GPIOA, SSB_SPROM8_GPIOA_P1,
+	     SSB_SPROM8_GPIOA_P1_SHIFT);
+	SPEX(gpio2, SSB_SPROM8_GPIOB, SSB_SPROM8_GPIOB_P2, 0);
+	SPEX(gpio3, SSB_SPROM8_GPIOB, SSB_SPROM8_GPIOB_P3,
+	     SSB_SPROM8_GPIOB_P3_SHIFT);
+	SPEX(tri2g, SSB_SPROM8_TRI25G, SSB_SPROM8_TRI2G, 0);
+	SPEX(tri5g, SSB_SPROM8_TRI25G, SSB_SPROM8_TRI5G,
+	     SSB_SPROM8_TRI5G_SHIFT);
+	SPEX(tri5gl, SSB_SPROM8_TRI5GHL, SSB_SPROM8_TRI5GL, 0);
+	SPEX(tri5gh, SSB_SPROM8_TRI5GHL, SSB_SPROM8_TRI5GH,
+	     SSB_SPROM8_TRI5GH_SHIFT);
+	SPEX(rxpo2g, SSB_SPROM8_RXPO, SSB_SPROM8_RXPO2G,
+	     SSB_SPROM8_RXPO2G_SHIFT);
+	SPEX(rxpo5g, SSB_SPROM8_RXPO, SSB_SPROM8_RXPO5G,
+	     SSB_SPROM8_RXPO5G_SHIFT);
+	SPEX(rssismf2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISMF2G, 0);
+	SPEX(rssismc2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISMC2G,
+	     SSB_SPROM8_RSSISMC2G_SHIFT);
+	SPEX(rssisav2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISAV2G,
+	     SSB_SPROM8_RSSISAV2G_SHIFT);
+	SPEX(bxa2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_BXA2G,
+	     SSB_SPROM8_BXA2G_SHIFT);
+	SPEX(rssismf5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISMF5G, 0);
+	SPEX(rssismc5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISMC5G,
+	     SSB_SPROM8_RSSISMC5G_SHIFT);
+	SPEX(rssisav5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISAV5G,
+	     SSB_SPROM8_RSSISAV5G_SHIFT);
+	SPEX(bxa5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_BXA5G,
+	     SSB_SPROM8_BXA5G_SHIFT);
+
+	SPEX(pa0b0, SSB_SPROM8_PA0B0, ~0, 0);
+	SPEX(pa0b1, SSB_SPROM8_PA0B1, ~0, 0);
+	SPEX(pa0b2, SSB_SPROM8_PA0B2, ~0, 0);
+	SPEX(pa1b0, SSB_SPROM8_PA1B0, ~0, 0);
+	SPEX(pa1b1, SSB_SPROM8_PA1B1, ~0, 0);
+	SPEX(pa1b2, SSB_SPROM8_PA1B2, ~0, 0);
+	SPEX(pa1lob0, SSB_SPROM8_PA1LOB0, ~0, 0);
+	SPEX(pa1lob1, SSB_SPROM8_PA1LOB1, ~0, 0);
+	SPEX(pa1lob2, SSB_SPROM8_PA1LOB2, ~0, 0);
+	SPEX(pa1hib0, SSB_SPROM8_PA1HIB0, ~0, 0);
+	SPEX(pa1hib1, SSB_SPROM8_PA1HIB1, ~0, 0);
+	SPEX(pa1hib2, SSB_SPROM8_PA1HIB2, ~0, 0);
+	SPEX(cck2gpo, SSB_SPROM8_CCK2GPO, ~0, 0);
+	SPEX32(ofdm2gpo, SSB_SPROM8_OFDM2GPO, ~0, 0);
+	SPEX32(ofdm5glpo, SSB_SPROM8_OFDM5GLPO, ~0, 0);
+	SPEX32(ofdm5gpo, SSB_SPROM8_OFDM5GPO, ~0, 0);
+	SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, ~0, 0);
+
+	/* Extract the antenna gain values. */
+	out->antenna_gain.a0 = sprom_extract_antgain(in,
+						     SSB_SPROM8_AGAIN01,
+						     SSB_SPROM8_AGAIN0,
+						     SSB_SPROM8_AGAIN0_SHIFT);
+	out->antenna_gain.a1 = sprom_extract_antgain(in,
+						     SSB_SPROM8_AGAIN01,
+						     SSB_SPROM8_AGAIN1,
+						     SSB_SPROM8_AGAIN1_SHIFT);
+	out->antenna_gain.a2 = sprom_extract_antgain(in,
+						     SSB_SPROM8_AGAIN23,
+						     SSB_SPROM8_AGAIN2,
+						     SSB_SPROM8_AGAIN2_SHIFT);
+	out->antenna_gain.a3 = sprom_extract_antgain(in,
+						     SSB_SPROM8_AGAIN23,
+						     SSB_SPROM8_AGAIN3,
+						     SSB_SPROM8_AGAIN3_SHIFT);
+
+	SPEX(leddc_on_time, SSB_SPROM8_LEDDC, SSB_SPROM8_LEDDC_ON,
+	     SSB_SPROM8_LEDDC_ON_SHIFT);
+	SPEX(leddc_off_time, SSB_SPROM8_LEDDC, SSB_SPROM8_LEDDC_OFF,
+	     SSB_SPROM8_LEDDC_OFF_SHIFT);
+
+	SPEX(txchain, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_TXCHAIN,
+	     SSB_SPROM8_TXRXC_TXCHAIN_SHIFT);
+	SPEX(rxchain, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_RXCHAIN,
+	     SSB_SPROM8_TXRXC_RXCHAIN_SHIFT);
+	SPEX(antswitch, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_SWITCH,
+	     SSB_SPROM8_TXRXC_SWITCH_SHIFT);
+
+	SPEX(opo, SSB_SPROM8_OFDM2GPO, 0x00ff, 0);
+
+	SPEX_ARRAY8(mcs2gpo, SSB_SPROM8_2G_MCSPO, ~0, 0);
+	SPEX_ARRAY8(mcs5gpo, SSB_SPROM8_5G_MCSPO, ~0, 0);
+	SPEX_ARRAY8(mcs5glpo, SSB_SPROM8_5GL_MCSPO, ~0, 0);
+	SPEX_ARRAY8(mcs5ghpo, SSB_SPROM8_5GH_MCSPO, ~0, 0);
+
+	SPEX(rawtempsense, SSB_SPROM8_RAWTS, SSB_SPROM8_RAWTS_RAWTEMP,
+	     SSB_SPROM8_RAWTS_RAWTEMP_SHIFT);
+	SPEX(measpower, SSB_SPROM8_RAWTS, SSB_SPROM8_RAWTS_MEASPOWER,
+	     SSB_SPROM8_RAWTS_MEASPOWER_SHIFT);
+	SPEX(tempsense_slope, SSB_SPROM8_OPT_CORRX,
+	     SSB_SPROM8_OPT_CORRX_TEMP_SLOPE,
+	     SSB_SPROM8_OPT_CORRX_TEMP_SLOPE_SHIFT);
+	SPEX(tempcorrx, SSB_SPROM8_OPT_CORRX, SSB_SPROM8_OPT_CORRX_TEMPCORRX,
+	     SSB_SPROM8_OPT_CORRX_TEMPCORRX_SHIFT);
+	SPEX(tempsense_option, SSB_SPROM8_OPT_CORRX,
+	     SSB_SPROM8_OPT_CORRX_TEMP_OPTION,
+	     SSB_SPROM8_OPT_CORRX_TEMP_OPTION_SHIFT);
+	SPEX(freqoffset_corr, SSB_SPROM8_HWIQ_IQSWP,
+	     SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR,
+	     SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR_SHIFT);
+	SPEX(iqcal_swp_dis, SSB_SPROM8_HWIQ_IQSWP,
+	     SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP,
+	     SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP_SHIFT);
+	SPEX(hw_iqcal_en, SSB_SPROM8_HWIQ_IQSWP, SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL,
+	     SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL_SHIFT);
+
+	SPEX(bw40po, SSB_SPROM8_BW40PO, ~0, 0);
+	SPEX(cddpo, SSB_SPROM8_CDDPO, ~0, 0);
+	SPEX(stbcpo, SSB_SPROM8_STBCPO, ~0, 0);
+	SPEX(bwduppo, SSB_SPROM8_BWDUPPO, ~0, 0);
+
+	SPEX(tempthresh, SSB_SPROM8_THERMAL, SSB_SPROM8_THERMAL_TRESH,
+	     SSB_SPROM8_THERMAL_TRESH_SHIFT);
+	SPEX(tempoffset, SSB_SPROM8_THERMAL, SSB_SPROM8_THERMAL_OFFSET,
+	     SSB_SPROM8_THERMAL_OFFSET_SHIFT);
+	SPEX(phycal_tempdelta, SSB_SPROM8_TEMPDELTA,
+	     SSB_SPROM8_TEMPDELTA_PHYCAL,
+	     SSB_SPROM8_TEMPDELTA_PHYCAL_SHIFT);
+	SPEX(temps_period, SSB_SPROM8_TEMPDELTA, SSB_SPROM8_TEMPDELTA_PERIOD,
+	     SSB_SPROM8_TEMPDELTA_PERIOD_SHIFT);
+	SPEX(temps_hysteresis, SSB_SPROM8_TEMPDELTA,
+	     SSB_SPROM8_TEMPDELTA_HYSTERESIS,
+	     SSB_SPROM8_TEMPDELTA_HYSTERESIS_SHIFT);
+}
+
+static int sprom_extract(struct bcma_fbs *priv, const u16 *in, u16 size)
+{
+	struct ssb_sprom *out = &priv->sprom;
+
+	memset(out, 0, sizeof(*out));
+
+	out->revision = in[size - 1] & 0x00FF;
+	if (out->revision < 8 || out->revision > 11) {
+		dev_warn(priv->dev,
+			 "Unsupported SPROM revision %d detected."
+			 " Will extract v8\n",
+			 out->revision);
+		out->revision = 8;
+	}
+
+	sprom_extract_r8(out, in);
+
+	return 0;
+}
+
+static void bcma_fbs_fixup(struct bcma_fbs *priv, u16 *sprom)
+{
+	struct device_node *node = priv->dev->of_node;
+	u32 fixups, off, val;
+	int i = 0;
+
+	if (!of_get_property(node, "brcm,sprom-fixups", &fixups))
+		return;
+
+	fixups /= sizeof(u32);
+
+	dev_info(priv->dev, "patching SPROM with %u fixups...\n", fixups >> 1);
+
+	while (i < fixups) {
+		if (of_property_read_u32_index(node, "brcm,sprom-fixups",
+					       i++, &off)) {
+			dev_err(priv->dev, "error reading fixup[%u] offset\n",
+				i - 1);
+			return;
+		}
+
+		if (of_property_read_u32_index(node, "brcm,sprom-fixups",
+					       i++, &val)) {
+			dev_err(priv->dev, "error reading fixup[%u] value\n",
+				i - 1);
+			return;
+		}
+
+		dev_dbg(priv->dev, "fixup[%d]=0x%04x\n", off, val);
+
+		sprom[off] = val;
+	}
+}
+
+static bool sprom_override_devid(struct bcma_fbs *priv, struct ssb_sprom *out,
+				 const u16 *in)
+{
+	SPEX(dev_id, 0x0060, 0xFFFF, 0);
+	return !!out->dev_id;
+}
+
+static void bcma_fbs_set(struct bcma_fbs *priv, struct device_node *node)
+{
+	struct ssb_sprom *sprom = &priv->sprom;
+	const struct firmware *fw;
+	const char *sprom_name;
+	int err;
+
+	if (of_property_read_string(node, "brcm,sprom", &sprom_name))
+		sprom_name = NULL;
+
+	if (sprom_name) {
+		err = request_firmware_direct(&fw, sprom_name, priv->dev);
+		if (err)
+			dev_err(priv->dev, "%s load error\n", sprom_name);
+	} else {
+		err = -ENOENT;
+	}
+
+	if (err) {
+		sprom->revision = 0x02;
+		sprom->board_rev = 0x0017;
+		sprom->country_code = 0x00;
+		sprom->ant_available_bg = 0x03;
+		sprom->pa0b0 = 0x15ae;
+		sprom->pa0b1 = 0xfa85;
+		sprom->pa0b2 = 0xfe8d;
+		sprom->pa1b0 = 0xffff;
+		sprom->pa1b1 = 0xffff;
+		sprom->pa1b2 = 0xffff;
+		sprom->gpio0 = 0xff;
+		sprom->gpio1 = 0xff;
+		sprom->gpio2 = 0xff;
+		sprom->gpio3 = 0xff;
+		sprom->maxpwr_bg = 0x4c;
+		sprom->itssi_bg = 0x00;
+		sprom->boardflags_lo = 0x2848;
+		sprom->boardflags_hi = 0x0000;
+		priv->devid_override = false;
+
+		dev_warn(priv->dev, "using basic SPROM\n");
+	} else {
+		size_t size = min(fw->size, (size_t) BCMA_FBS_MAX_SIZE);
+		u16 tmp_sprom[BCMA_FBS_MAX_SIZE >> 1];
+		u32 i, j;
+
+		for (i = 0, j = 0; i < size; i += 2, j++)
+			tmp_sprom[j] = (fw->data[i] << 8) | fw->data[i + 1];
+
+		release_firmware(fw);
+		bcma_fbs_fixup(priv, tmp_sprom);
+		sprom_extract(priv, tmp_sprom, size >> 1);
+
+		priv->devid_override = sprom_override_devid(priv, sprom,
+							    tmp_sprom);
+	}
+}
+
+static int bcma_fbs_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node;
+	struct bcma_fbs *priv;
+	unsigned long flags;
+	u8 mac[ETH_ALEN];
+
+	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	priv->dev = dev;
+
+	bcma_fbs_set(priv, node);
+
+	of_property_read_u32(node, "pci-bus", &priv->pci_bus);
+	of_property_read_u32(node, "pci-dev", &priv->pci_dev);
+
+	of_get_mac_address(node, mac);
+	if (is_valid_ether_addr(mac)) {
+		dev_info(dev, "mtd mac %pM\n", mac);
+	} else {
+		eth_random_addr(mac);
+		dev_info(dev, "random mac %pM\n", mac);
+	}
+
+	memcpy(priv->sprom.il0mac, mac, ETH_ALEN);
+ 	memcpy(priv->sprom.et0mac, mac, ETH_ALEN);
+ 	memcpy(priv->sprom.et1mac, mac, ETH_ALEN);
+	memcpy(priv->sprom.et2mac, mac, ETH_ALEN);
+
+	spin_lock_irqsave(&bcma_fbs_lock, flags);
+	list_add(&priv->list, &bcma_fbs_list);
+	spin_unlock_irqrestore(&bcma_fbs_lock, flags);
+
+	dev_info(dev, "registered SPROM for [%x:%x]\n",
+		 priv->pci_bus, priv->pci_dev);
+
+	return 0;
+}
+
+static const struct of_device_id bcma_fbs_of_match[] = {
+	{ .compatible = "brcm,bcma-sprom", },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, bcma_fbs_of_match);
+
+static struct platform_driver bcma_fbs_driver = {
+	.probe = bcma_fbs_probe,
+	.driver	= {
+		.name = "bcma-sprom",
+		.of_match_table = bcma_fbs_of_match,
+	},
+};
+
+int __init bcma_fbs_register(void)
+{
+	return platform_driver_register(&bcma_fbs_driver);
+}
diff --git a/target/linux/generic/files/drivers/mtd/mtdsplit/Kconfig b/target/linux/generic/files/drivers/mtd/mtdsplit/Kconfig
index f929c6153e7f60..f1864d8fdb7058 100644
--- a/target/linux/generic/files/drivers/mtd/mtdsplit/Kconfig
+++ b/target/linux/generic/files/drivers/mtd/mtdsplit/Kconfig
@@ -12,7 +12,6 @@ config MTD_SPLIT_SQUASHFS_ROOT
 	bool "Squashfs based root partition parser"
 	depends on MTD_SPLIT_SUPPORT
 	select MTD_SPLIT
-	default n
 	help
 	  This provides a parsing function which allows to detect the
 	  offset and size of the unused portion of a rootfs partition
diff --git a/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_bcm_wfi.c b/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_bcm_wfi.c
index 1ddcf6745facd4..1cafc91fded3dc 100644
--- a/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_bcm_wfi.c
+++ b/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_bcm_wfi.c
@@ -31,6 +31,7 @@
 
 #define CFERAM_NAME		"cferam"
 #define CFERAM_NAME_LEN		(sizeof(CFERAM_NAME) - 1)
+#define CFERAM_NAME_MAX_LEN	32
 #define KERNEL_NAME		"vmlinux.lz"
 #define KERNEL_NAME_LEN		(sizeof(KERNEL_NAME) - 1)
 #define OPENWRT_NAME		"1-openwrt"
@@ -157,17 +158,28 @@ static int parse_bcm_wfi(struct mtd_info *master,
 			 const struct mtd_partition **pparts,
 			 uint8_t *buf, loff_t off, loff_t size, bool cfe_part)
 {
+	struct device_node *mtd_node;
 	struct mtd_partition *parts;
 	loff_t cfe_off, kernel_off, rootfs_off;
 	unsigned int num_parts = BCM_WFI_PARTS, cur_part = 0;
+	const char *cferam_name = CFERAM_NAME;
+	size_t cferam_name_len;
 	int ret;
 
+	mtd_node = mtd_get_of_node(master);
+	if (mtd_node)
+		of_property_read_string(mtd_node, "brcm,cferam", &cferam_name);
+
+	cferam_name_len = strnlen(cferam_name, CFERAM_NAME_MAX_LEN);
+	if (cferam_name_len > 0)
+		cferam_name_len--;
+
 	if (cfe_part) {
 		num_parts++;
 		cfe_off = off;
 
-		ret = jffs2_find_file(master, buf, CFERAM_NAME,
-				      CFERAM_NAME_LEN, &cfe_off,
+		ret = jffs2_find_file(master, buf, cferam_name,
+				      cferam_name_len, &cfe_off,
 				      size - (cfe_off - off), NULL, NULL);
 		if (ret)
 			return ret;
diff --git a/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.h b/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.h
index dff1f28c8171f4..517ff7414f34ab 100644
--- a/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.h
+++ b/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.h
@@ -95,8 +95,14 @@ bbt_nand_read(u32 page, unsigned char *dat, int dat_len,
 		.datbuf = dat,
 		.len = dat_len,
 	};
-
-	return bmtd._read_oob(bmtd.mtd, page << bmtd.pg_shift, &ops);
+	int ret;
+
+	ret = bmtd._read_oob(bmtd.mtd, page << bmtd.pg_shift, &ops);
+	if (ret < 0)
+		return ret;
+	if (ret)
+		pr_info("%s: %d bitflips\n", __func__, ret);
+	return 0;
 }
 
 static inline int bbt_nand_erase(u16 block)
diff --git a/target/linux/generic/files/drivers/mtd/nand/mtk_bmt_v2.c b/target/linux/generic/files/drivers/mtd/nand/mtk_bmt_v2.c
index 2770376e98bb14..6b06948c0f45fa 100644
--- a/target/linux/generic/files/drivers/mtd/nand/mtk_bmt_v2.c
+++ b/target/linux/generic/files/drivers/mtd/nand/mtk_bmt_v2.c
@@ -191,36 +191,6 @@ static u16 get_bmt_index(struct bbmt *bmt)
 	return 0;
 }
 
-static int
-read_bmt(u16 block, unsigned char *dat, unsigned char *fdm, int fdm_len)
-{
-	u32 len = bmtd.bmt_pgs << bmtd.pg_shift;
-
-	return bbt_nand_read(blk_pg(block), dat, len, fdm, fdm_len);
-}
-
-static struct bbbt *scan_bmt(u16 block)
-{
-	u8 fdm[4];
-
-	if (block < bmtd.pool_lba)
-		return NULL;
-
-	if (read_bmt(block, bmtd.bbt_buf, fdm, sizeof(fdm)))
-		return scan_bmt(block - 1);
-
-	if (is_valid_bmt(bmtd.bbt_buf, fdm)) {
-		bmtd.bmt_blk_idx = get_bmt_index(bmt_tbl((struct bbbt *)bmtd.bbt_buf));
-		if (bmtd.bmt_blk_idx == 0) {
-			pr_info("[BBT] FATAL ERR: bmt block index is wrong!\n");
-			return NULL;
-		}
-		pr_info("[BBT] BMT.v2 is found at 0x%x\n", block);
-		return (struct bbbt *)bmtd.bbt_buf;
-	} else
-		return scan_bmt(block - 1);
-}
-
 /* Write the Burner Bad Block Table to Nand Flash
  * n - write BMT to bmt_tbl[n]
  */
@@ -472,7 +442,30 @@ static int mtk_bmt_init_v2(struct device_node *np)
 	/* Scanning start from the first page of the last block
 	 * of whole flash
 	 */
-	bmtd.bbt = scan_bmt(bmtd.total_blks - 1);
+	bmtd.bbt = NULL;
+	for (u16 block = bmtd.total_blks - 1; !bmtd.bbt && block >= bmtd.pool_lba; block--) {
+		u8 fdm[4];
+
+		if (bbt_nand_read(blk_pg(block), bmtd.bbt_buf, bufsz, fdm, sizeof(fdm))) {
+			/* Read failed, try the previous block */
+			continue;
+		}
+
+		if (!is_valid_bmt(bmtd.bbt_buf, fdm)) {
+			/* No valid BMT found, try the previous block */
+			continue;
+		}
+
+		bmtd.bmt_blk_idx = get_bmt_index(bmt_tbl((struct bbbt *)bmtd.bbt_buf));
+		if (bmtd.bmt_blk_idx == 0) {
+			pr_info("[BBT] FATAL ERR: bmt block index is wrong!\n");
+			break;
+		}
+
+		pr_info("[BBT] BMT.v2 is found at 0x%x\n", block);
+		bmtd.bbt = (struct bbbt *)bmtd.bbt_buf;
+	}
+
 	if (!bmtd.bbt) {
 		/* BMT not found */
 		if (bmtd.total_blks > BB_TABLE_MAX + BMT_TABLE_MAX) {
diff --git a/target/linux/generic/files/drivers/net/phy/ar8216.c b/target/linux/generic/files/drivers/net/phy/ar8216.c
index bf98fd599ecb76..850bcefb74e26e 100644
--- a/target/linux/generic/files/drivers/net/phy/ar8216.c
+++ b/target/linux/generic/files/drivers/net/phy/ar8216.c
@@ -891,11 +891,7 @@ ar8216_phy_write(struct ar8xxx_priv *priv, int addr, int regnum, u16 val)
 static int
 ar8229_hw_init(struct ar8xxx_priv *priv)
 {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 5, 0)
 	phy_interface_t phy_if_mode;
-#else
-	int phy_if_mode;
-#endif
 
 	if (priv->initialized)
 		return 0;
@@ -903,11 +899,7 @@ ar8229_hw_init(struct ar8xxx_priv *priv)
 	ar8xxx_write(priv, AR8216_REG_CTRL, AR8216_CTRL_RESET);
 	ar8xxx_reg_wait(priv, AR8216_REG_CTRL, AR8216_CTRL_RESET, 0, 1000);
 
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 5, 0)
 	of_get_phy_mode(priv->pdev->of_node, &phy_if_mode);
-#else
-	phy_if_mode = of_get_phy_mode(priv->pdev->of_node);
-#endif
 
 	if (phy_if_mode == PHY_INTERFACE_MODE_GMII) {
 		ar8xxx_write(priv, AR8229_REG_OPER_MODE0,
@@ -1427,8 +1419,7 @@ ar8xxx_sw_reset_switch(struct switch_dev *dev)
 	int i;
 
 	mutex_lock(&priv->reg_mutex);
-	memset(&priv->vlan, 0, sizeof(struct ar8xxx_priv) -
-		offsetof(struct ar8xxx_priv, vlan));
+	memset(&priv->ar8xxx_priv_volatile, 0, sizeof(priv->ar8xxx_priv_volatile));
 
 	for (i = 0; i < dev->vlans; i++)
 		priv->vlan_id[i] = i;
@@ -2467,10 +2458,10 @@ ar8xxx_phy_config_init(struct phy_device *phydev)
 	/* VID fixup only needed on ar8216 */
 	if (chip_is_ar8216(priv)) {
 		dev->phy_ptr = priv;
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,15,0)
-		dev->extra_priv_flags |= IFF_NO_IP_ALIGN;
-#else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6,1,0)
 		dev->priv_flags |= IFF_NO_IP_ALIGN;
+#else
+		dev->extra_priv_flags |= IFF_NO_IP_ALIGN;
 #endif
 		dev->eth_mangle_rx = ar8216_mangle_rx;
 		dev->eth_mangle_tx = ar8216_mangle_tx;
@@ -2706,10 +2697,10 @@ ar8xxx_phy_detach(struct phy_device *phydev)
 
 #ifdef CONFIG_ETHERNET_PACKET_MANGLE
 	dev->phy_ptr = NULL;
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,15,0)
-	dev->extra_priv_flags &= ~IFF_NO_IP_ALIGN;
-#else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6,1,0)
 	dev->priv_flags &= ~IFF_NO_IP_ALIGN;
+#else
+	dev->extra_priv_flags &= ~IFF_NO_IP_ALIGN;
 #endif
 	dev->eth_mangle_rx = NULL;
 	dev->eth_mangle_tx = NULL;
diff --git a/target/linux/generic/files/drivers/net/phy/ar8216.h b/target/linux/generic/files/drivers/net/phy/ar8216.h
index d62cf60f57e640..f046b35f43fba9 100644
--- a/target/linux/generic/files/drivers/net/phy/ar8216.h
+++ b/target/linux/generic/files/drivers/net/phy/ar8216.h
@@ -506,20 +506,22 @@ struct ar8xxx_priv {
 	unsigned int use_count;
 
 	/* all fields below are cleared on reset */
-	bool vlan;
-
-	u16 vlan_id[AR8XXX_MAX_VLANS];
-	u8 vlan_table[AR8XXX_MAX_VLANS];
-	u8 vlan_tagged;
-	u16 pvid[AR8X16_MAX_PORTS];
-	int arl_age_time;
-
-	/* mirroring */
-	bool mirror_rx;
-	bool mirror_tx;
-	int source_port;
-	int monitor_port;
-	u8 port_vlan_prio[AR8X16_MAX_PORTS];
+	struct_group(ar8xxx_priv_volatile,
+		bool vlan;
+
+		u16 vlan_id[AR8XXX_MAX_VLANS];
+		u8 vlan_table[AR8XXX_MAX_VLANS];
+		u8 vlan_tagged;
+		u16 pvid[AR8X16_MAX_PORTS];
+		int arl_age_time;
+
+		/* mirroring */
+		bool mirror_rx;
+		bool mirror_tx;
+		int source_port;
+		int monitor_port;
+		u8 port_vlan_prio[AR8X16_MAX_PORTS];
+	);
 };
 
 u32
diff --git a/target/linux/generic/files/drivers/net/phy/b53/b53_common.c b/target/linux/generic/files/drivers/net/phy/b53/b53_common.c
index 87d731ec3e2a86..d5f9bfc2f0438b 100644
--- a/target/linux/generic/files/drivers/net/phy/b53/b53_common.c
+++ b/target/linux/generic/files/drivers/net/phy/b53/b53_common.c
@@ -506,15 +506,9 @@ static int b53_configure_ports_of(struct b53_device *dev)
 		if (fixed_link) {
 			u32 spd;
 			u8 po = GMII_PO_LINK;
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 5, 0)
 			phy_interface_t mode;
-#else
-			int mode = of_get_phy_mode(pn);
-#endif
 
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 5, 0)
 			of_get_phy_mode(pn, &mode);
-#endif
 
 			if (!of_property_read_u32(fixed_link, "speed", &spd)) {
 				switch (spd) {
@@ -1617,8 +1611,8 @@ static int b53_switch_init(struct b53_device *dev)
 	return b53_switch_reset(dev);
 }
 
-struct b53_device *b53_switch_alloc(struct device *base, struct b53_io_ops *ops,
-				    void *priv)
+struct b53_device *b53_swconfig_switch_alloc(struct device *base, struct b53_io_ops *ops,
+					     void *priv)
 {
 	struct b53_device *dev;
 
@@ -1633,9 +1627,9 @@ struct b53_device *b53_switch_alloc(struct device *base, struct b53_io_ops *ops,
 
 	return dev;
 }
-EXPORT_SYMBOL(b53_switch_alloc);
+EXPORT_SYMBOL(b53_swconfig_switch_alloc);
 
-int b53_switch_detect(struct b53_device *dev)
+int b53_swconfig_switch_detect(struct b53_device *dev)
 {
 	u32 id32;
 	u16 tmp;
@@ -1700,9 +1694,9 @@ int b53_switch_detect(struct b53_device *dev)
 		return b53_read8(dev, B53_MGMT_PAGE, B53_REV_ID,
 				 &dev->core_rev);
 }
-EXPORT_SYMBOL(b53_switch_detect);
+EXPORT_SYMBOL(b53_swconfig_switch_detect);
 
-int b53_switch_register(struct b53_device *dev)
+int b53_swconfig_switch_register(struct b53_device *dev)
 {
 	int ret;
 
@@ -1712,7 +1706,7 @@ int b53_switch_register(struct b53_device *dev)
 		dev->sw_dev.alias = dev->pdata->alias;
 	}
 
-	if (!dev->chip_id && b53_switch_detect(dev))
+	if (!dev->chip_id && b53_swconfig_switch_detect(dev))
 		return -EINVAL;
 
 	ret = b53_switch_init(dev);
@@ -1723,7 +1717,7 @@ int b53_switch_register(struct b53_device *dev)
 
 	return register_switch(&dev->sw_dev, NULL);
 }
-EXPORT_SYMBOL(b53_switch_register);
+EXPORT_SYMBOL(b53_swconfig_switch_register);
 
 MODULE_AUTHOR("Jonas Gorski <jogo@openwrt.org>");
 MODULE_DESCRIPTION("B53 switch library");
diff --git a/target/linux/generic/files/drivers/net/phy/b53/b53_mdio.c b/target/linux/generic/files/drivers/net/phy/b53/b53_mdio.c
index 6ec23a49a36450..c85df1f3055801 100644
--- a/target/linux/generic/files/drivers/net/phy/b53/b53_mdio.c
+++ b/target/linux/generic/files/drivers/net/phy/b53/b53_mdio.c
@@ -280,7 +280,7 @@ static int b53_phy_probe(struct phy_device *phydev)
 	if (phydev->mdio.addr != B53_PSEUDO_PHY && phydev->mdio.addr != 0)
 		return -ENODEV;
 
-	dev = b53_switch_alloc(&phydev->mdio.dev, &b53_mdio_ops, phydev->mdio.bus);
+	dev = b53_swconfig_switch_alloc(&phydev->mdio.dev, &b53_mdio_ops, phydev->mdio.bus);
 	if (!dev)
 		return -ENOMEM;
 
@@ -290,7 +290,7 @@ static int b53_phy_probe(struct phy_device *phydev)
 	dev->pdata = NULL;
 	mutex_init(&dev->reg_mutex);
 
-	ret = b53_switch_detect(dev);
+	ret = b53_swconfig_switch_detect(dev);
 	if (ret)
 		return ret;
 
@@ -302,7 +302,7 @@ static int b53_phy_probe(struct phy_device *phydev)
 
 	linkmode_copy(phydev->advertising, phydev->supported);
 
-	ret = b53_switch_register(dev);
+	ret = b53_swconfig_switch_register(dev);
 	if (ret) {
 		dev_err(dev->dev, "failed to register switch: %i\n", ret);
 		return ret;
diff --git a/target/linux/generic/files/drivers/net/phy/b53/b53_mmap.c b/target/linux/generic/files/drivers/net/phy/b53/b53_mmap.c
index ab1895e9b5ad47..0a21ff1de55ed4 100644
--- a/target/linux/generic/files/drivers/net/phy/b53/b53_mmap.c
+++ b/target/linux/generic/files/drivers/net/phy/b53/b53_mmap.c
@@ -205,7 +205,7 @@ static int b53_mmap_probe(struct platform_device *pdev)
 	if (!pdata)
 		return -EINVAL;
 
-	dev = b53_switch_alloc(&pdev->dev, &b53_mmap_ops, pdata->regs);
+	dev = b53_swconfig_switch_alloc(&pdev->dev, &b53_mmap_ops, pdata->regs);
 	if (!dev)
 		return -ENOMEM;
 
@@ -214,7 +214,7 @@ static int b53_mmap_probe(struct platform_device *pdev)
 
 	platform_set_drvdata(pdev, dev);
 
-	return b53_switch_register(dev);
+	return b53_swconfig_switch_register(dev);
 }
 
 static int b53_mmap_remove(struct platform_device *pdev)
diff --git a/target/linux/generic/files/drivers/net/phy/b53/b53_priv.h b/target/linux/generic/files/drivers/net/phy/b53/b53_priv.h
index 37c17aeb256dde..e455c755bf22e3 100644
--- a/target/linux/generic/files/drivers/net/phy/b53/b53_priv.h
+++ b/target/linux/generic/files/drivers/net/phy/b53/b53_priv.h
@@ -183,12 +183,12 @@ static inline struct b53_device *sw_to_b53(struct switch_dev *sw)
 	return container_of(sw, struct b53_device, sw_dev);
 }
 
-struct b53_device *b53_switch_alloc(struct device *base, struct b53_io_ops *ops,
-				    void *priv);
+struct b53_device *b53_swconfig_switch_alloc(struct device *base, struct b53_io_ops *ops,
+					     void *priv);
 
-int b53_switch_detect(struct b53_device *dev);
+int b53_swconfig_switch_detect(struct b53_device *dev);
 
-int b53_switch_register(struct b53_device *dev);
+int b53_swconfig_switch_register(struct b53_device *dev);
 
 static inline void b53_switch_remove(struct b53_device *dev)
 {
diff --git a/target/linux/generic/files/drivers/net/phy/b53/b53_spi.c b/target/linux/generic/files/drivers/net/phy/b53/b53_spi.c
index efc8f7ee89f2b3..400454df18c119 100644
--- a/target/linux/generic/files/drivers/net/phy/b53/b53_spi.c
+++ b/target/linux/generic/files/drivers/net/phy/b53/b53_spi.c
@@ -288,14 +288,14 @@ static int b53_spi_probe(struct spi_device *spi)
 	struct b53_device *dev;
 	int ret;
 
-	dev = b53_switch_alloc(&spi->dev, &b53_spi_ops, spi);
+	dev = b53_swconfig_switch_alloc(&spi->dev, &b53_spi_ops, spi);
 	if (!dev)
 		return -ENOMEM;
 
 	if (spi->dev.platform_data)
 		dev->pdata = spi->dev.platform_data;
 
-	ret = b53_switch_register(dev);
+	ret = b53_swconfig_switch_register(dev);
 	if (ret)
 		return ret;
 
diff --git a/target/linux/generic/files/drivers/net/phy/b53/b53_srab.c b/target/linux/generic/files/drivers/net/phy/b53/b53_srab.c
index 012daa3a51fef8..ead5209cf0b84b 100644
--- a/target/linux/generic/files/drivers/net/phy/b53/b53_srab.c
+++ b/target/linux/generic/files/drivers/net/phy/b53/b53_srab.c
@@ -342,7 +342,7 @@ static int b53_srab_probe(struct platform_device *pdev)
 	if (!pdata)
 		return -EINVAL;
 
-	dev = b53_switch_alloc(&pdev->dev, &b53_srab_ops, pdata->regs);
+	dev = b53_swconfig_switch_alloc(&pdev->dev, &b53_srab_ops, pdata->regs);
 	if (!dev)
 		return -ENOMEM;
 
@@ -351,7 +351,7 @@ static int b53_srab_probe(struct platform_device *pdev)
 
 	platform_set_drvdata(pdev, dev);
 
-	return b53_switch_register(dev);
+	return b53_swconfig_switch_register(dev);
 }
 
 static int b53_srab_remove(struct platform_device *pdev)
diff --git a/target/linux/generic/files/drivers/net/phy/psb6970.c b/target/linux/generic/files/drivers/net/phy/psb6970.c
index fb6ed0e2041b80..2587b999138474 100644
--- a/target/linux/generic/files/drivers/net/phy/psb6970.c
+++ b/target/linux/generic/files/drivers/net/phy/psb6970.c
@@ -60,11 +60,13 @@ struct psb6970_priv {
 	struct mutex reg_mutex;
 
 	/* all fields below are cleared on reset */
-	bool vlan;
-	u16 vlan_id[PSB6970_MAX_VLANS];
-	u8 vlan_table[PSB6970_MAX_VLANS];
-	u8 vlan_tagged;
-	u16 pvid[PSB6970_NUM_PORTS];
+	struct_group(psb6970_priv_volatile,
+		bool vlan;
+		u16 vlan_id[PSB6970_MAX_VLANS];
+		u8 vlan_table[PSB6970_MAX_VLANS];
+		u8 vlan_tagged;
+		u16 pvid[PSB6970_NUM_PORTS];
+	);
 };
 
 #define to_psb6970(_dev) container_of(_dev, struct psb6970_priv, dev)
@@ -272,8 +274,8 @@ static int psb6970_reset_switch(struct switch_dev *dev)
 
 	mutex_lock(&priv->reg_mutex);
 
-	memset(&priv->vlan, 0, sizeof(struct psb6970_priv) -
-	       offsetof(struct psb6970_priv, vlan));
+	memset(&priv->psb6970_priv_volatile, 0,
+		sizeof(priv->psb6970_priv_volatile));
 
 	for (i = 0; i < PSB6970_MAX_VLANS; i++)
 		priv->vlan_id[i] = i;
@@ -307,7 +309,6 @@ static const struct switch_dev_ops psb6970_ops = {
 static int psb6970_config_init(struct phy_device *pdev)
 {
 	struct psb6970_priv *priv;
-	struct net_device *dev = pdev->attached_dev;
 	struct switch_dev *swdev;
 	int ret;
 
diff --git a/target/linux/generic/files/drivers/net/phy/swconfig.c b/target/linux/generic/files/drivers/net/phy/swconfig.c
index a734e576080aa6..5fa2b147c6fca4 100644
--- a/target/linux/generic/files/drivers/net/phy/swconfig.c
+++ b/target/linux/generic/files/drivers/net/phy/swconfig.c
@@ -1054,6 +1054,9 @@ static struct genl_family switch_fam = {
 	.module = THIS_MODULE,
 	.ops = swconfig_ops,
 	.n_ops = ARRAY_SIZE(swconfig_ops),
+#if LINUX_VERSION_CODE > KERNEL_VERSION(6,0,0)
+	.resv_start_op = SWITCH_CMD_SET_VLAN + 1,
+#endif
 };
 
 #ifdef CONFIG_OF
diff --git a/target/linux/generic/files/drivers/net/phy/swconfig_leds.c b/target/linux/generic/files/drivers/net/phy/swconfig_leds.c
index df53e5cd4a21a6..1d309c046c8df8 100644
--- a/target/linux/generic/files/drivers/net/phy/swconfig_leds.c
+++ b/target/linux/generic/files/drivers/net/phy/swconfig_leds.c
@@ -85,7 +85,11 @@ swconfig_trig_update_port_mask(struct led_trigger *trigger)
 	sw_trig = (void *) trigger;
 
 	port_mask = 0;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,16,0)
+	spin_lock(&trigger->leddev_list_lock);
+#else
 	read_lock(&trigger->leddev_list_lock);
+#endif
 	list_for_each(entry, &trigger->led_cdevs) {
 		struct led_classdev *led_cdev;
 		struct swconfig_trig_data *trig_data;
@@ -98,7 +102,11 @@ swconfig_trig_update_port_mask(struct led_trigger *trigger)
 			read_unlock(&trig_data->lock);
 		}
 	}
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,16,0)
+	spin_unlock(&trigger->leddev_list_lock);
+#else
 	read_unlock(&trigger->leddev_list_lock);
+#endif
 
 	sw_trig->port_mask = port_mask;
 
@@ -418,14 +426,22 @@ swconfig_trig_update_leds(struct switch_led_trigger *sw_trig)
 	struct led_trigger *trigger;
 
 	trigger = &sw_trig->trig;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,16,0)
+	spin_lock(&trigger->leddev_list_lock);
+#else
 	read_lock(&trigger->leddev_list_lock);
+#endif
 	list_for_each(entry, &trigger->led_cdevs) {
 		struct led_classdev *led_cdev;
 
 		led_cdev = list_entry(entry, struct led_classdev, trig_list);
 		swconfig_trig_led_event(sw_trig, led_cdev);
 	}
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,16,0)
+	spin_unlock(&trigger->leddev_list_lock);
+#else
 	read_unlock(&trigger->leddev_list_lock);
+#endif
 }
 
 static void
diff --git a/target/linux/generic/files/drivers/platform/mikrotik/Kconfig b/target/linux/generic/files/drivers/platform/mikrotik/Kconfig
index 7499ba1e1c6188..1dc027815a5bf7 100644
--- a/target/linux/generic/files/drivers/platform/mikrotik/Kconfig
+++ b/target/linux/generic/files/drivers/platform/mikrotik/Kconfig
@@ -1,6 +1,5 @@
 menuconfig MIKROTIK
 	bool "Platform support for MikroTik RouterBoard virtual devices"
-	default n
 	help
 	  Say Y here to get to see options for the MikroTik RouterBoard platform.
 	  This option alone does not add any kernel code.
diff --git a/target/linux/generic/files/drivers/ssb/fallback-sprom.c b/target/linux/generic/files/drivers/ssb/fallback-sprom.c
new file mode 100644
index 00000000000000..b8a4dcedcf4f1c
--- /dev/null
+++ b/target/linux/generic/files/drivers/ssb/fallback-sprom.c
@@ -0,0 +1,744 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * SSB Fallback SPROM Driver
+ *
+ * Copyright (C) 2020 Álvaro Fernández Rojas <noltari@gmail.com>
+ * Copyright (C) 2014 Jonas Gorski <jonas.gorski@gmail.com>
+ * Copyright (C) 2008 Maxime Bizon <mbizon@freebox.fr>
+ * Copyright (C) 2008 Florian Fainelli <f.fainelli@gmail.com>
+ */
+
+#include <linux/etherdevice.h>
+#include <linux/firmware.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/mtd/mtd.h>
+#include <linux/of_net.h>
+#include <linux/of_platform.h>
+#include <linux/ssb/ssb.h>
+
+#define SSB_FBS_MAX_SIZE 440
+
+/* Get the word-offset for a SSB_SPROM_XXX define. */
+#define SPOFF(offset)	((offset) / sizeof(u16))
+/* Helper to extract some _offset, which is one of the SSB_SPROM_XXX defines. */
+#define SPEX16(_outvar, _offset, _mask, _shift)	\
+	out->_outvar = ((in[SPOFF(_offset)] & (_mask)) >> (_shift))
+#define SPEX32(_outvar, _offset, _mask, _shift)	\
+	out->_outvar = ((((u32)in[SPOFF((_offset)+2)] << 16 | \
+			   in[SPOFF(_offset)]) & (_mask)) >> (_shift))
+#define SPEX(_outvar, _offset, _mask, _shift) \
+	SPEX16(_outvar, _offset, _mask, _shift)
+
+#define SPEX_ARRAY8(_field, _offset, _mask, _shift)	\
+	do {	\
+		SPEX(_field[0], _offset +  0, _mask, _shift);	\
+		SPEX(_field[1], _offset +  2, _mask, _shift);	\
+		SPEX(_field[2], _offset +  4, _mask, _shift);	\
+		SPEX(_field[3], _offset +  6, _mask, _shift);	\
+		SPEX(_field[4], _offset +  8, _mask, _shift);	\
+		SPEX(_field[5], _offset + 10, _mask, _shift);	\
+		SPEX(_field[6], _offset + 12, _mask, _shift);	\
+		SPEX(_field[7], _offset + 14, _mask, _shift);	\
+	} while (0)
+
+struct ssb_fbs {
+	struct device *dev;
+	struct list_head list;
+	struct ssb_sprom sprom;
+	u32 pci_bus;
+	u32 pci_dev;
+	bool devid_override;
+};
+
+static DEFINE_SPINLOCK(ssb_fbs_lock);
+static struct list_head ssb_fbs_list = LIST_HEAD_INIT(ssb_fbs_list);
+
+int ssb_get_fallback_sprom(struct ssb_bus *bus, struct ssb_sprom *out)
+{
+	struct ssb_fbs *pos;
+	u32 pci_bus, pci_dev;
+
+	if (bus->bustype != SSB_BUSTYPE_PCI)
+		return -ENOENT;
+
+	pci_bus = bus->host_pci->bus->number;
+	pci_dev = PCI_SLOT(bus->host_pci->devfn);
+
+	list_for_each_entry(pos, &ssb_fbs_list, list) {
+		if (pos->pci_bus != pci_bus ||
+		    pos->pci_dev != pci_dev)
+		    	continue;
+
+		if (pos->devid_override)
+			bus->host_pci->device = pos->sprom.dev_id;
+
+		memcpy(out, &pos->sprom, sizeof(struct ssb_sprom));
+		dev_info(pos->dev, "requested by [%x:%x]",
+			 pos->pci_bus, pos->pci_dev);
+
+		return 0;
+	}
+
+	pr_err("unable to fill SPROM for [%x:%x]\n", pci_bus, pci_dev);
+
+	return -EINVAL;
+}
+
+static s8 sprom_extract_antgain(u8 sprom_revision, const u16 *in, u16 offset,
+				u16 mask, u16 shift)
+{
+	u16 v;
+	u8 gain;
+
+	v = in[SPOFF(offset)];
+	gain = (v & mask) >> shift;
+	if (gain == 0xFF)
+		gain = 2; /* If unset use 2dBm */
+	if (sprom_revision == 1) {
+		/* Convert to Q5.2 */
+		gain <<= 2;
+	} else {
+		/* Q5.2 Fractional part is stored in 0xC0 */
+		gain = ((gain & 0xC0) >> 6) | ((gain & 0x3F) << 2);
+	}
+
+	return (s8)gain;
+}
+
+static void sprom_extract_r23(struct ssb_sprom *out, const u16 *in)
+{
+	SPEX(boardflags_hi, SSB_SPROM2_BFLHI, 0xFFFF, 0);
+	SPEX(opo, SSB_SPROM2_OPO, SSB_SPROM2_OPO_VALUE, 0);
+	SPEX(pa1lob0, SSB_SPROM2_PA1LOB0, 0xFFFF, 0);
+	SPEX(pa1lob1, SSB_SPROM2_PA1LOB1, 0xFFFF, 0);
+	SPEX(pa1lob2, SSB_SPROM2_PA1LOB2, 0xFFFF, 0);
+	SPEX(pa1hib0, SSB_SPROM2_PA1HIB0, 0xFFFF, 0);
+	SPEX(pa1hib1, SSB_SPROM2_PA1HIB1, 0xFFFF, 0);
+	SPEX(pa1hib2, SSB_SPROM2_PA1HIB2, 0xFFFF, 0);
+	SPEX(maxpwr_ah, SSB_SPROM2_MAXP_A, SSB_SPROM2_MAXP_A_HI, 0);
+	SPEX(maxpwr_al, SSB_SPROM2_MAXP_A, SSB_SPROM2_MAXP_A_LO,
+	     SSB_SPROM2_MAXP_A_LO_SHIFT);
+}
+
+static void sprom_extract_r123(struct ssb_sprom *out, const u16 *in)
+{
+	SPEX(et0phyaddr, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET0A, 0);
+	SPEX(et1phyaddr, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET1A,
+	     SSB_SPROM1_ETHPHY_ET1A_SHIFT);
+	SPEX(et0mdcport, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET0M, 14);
+	SPEX(et1mdcport, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET1M, 15);
+	SPEX(board_rev, SSB_SPROM1_BINF, SSB_SPROM1_BINF_BREV, 0);
+	SPEX(board_type, SSB_SPROM1_SPID, 0xFFFF, 0);
+	if (out->revision == 1)
+		SPEX(country_code, SSB_SPROM1_BINF, SSB_SPROM1_BINF_CCODE,
+		     SSB_SPROM1_BINF_CCODE_SHIFT);
+	SPEX(ant_available_a, SSB_SPROM1_BINF, SSB_SPROM1_BINF_ANTA,
+	     SSB_SPROM1_BINF_ANTA_SHIFT);
+	SPEX(ant_available_bg, SSB_SPROM1_BINF, SSB_SPROM1_BINF_ANTBG,
+	     SSB_SPROM1_BINF_ANTBG_SHIFT);
+	SPEX(pa0b0, SSB_SPROM1_PA0B0, 0xFFFF, 0);
+	SPEX(pa0b1, SSB_SPROM1_PA0B1, 0xFFFF, 0);
+	SPEX(pa0b2, SSB_SPROM1_PA0B2, 0xFFFF, 0);
+	SPEX(pa1b0, SSB_SPROM1_PA1B0, 0xFFFF, 0);
+	SPEX(pa1b1, SSB_SPROM1_PA1B1, 0xFFFF, 0);
+	SPEX(pa1b2, SSB_SPROM1_PA1B2, 0xFFFF, 0);
+	SPEX(gpio0, SSB_SPROM1_GPIOA, SSB_SPROM1_GPIOA_P0, 0);
+	SPEX(gpio1, SSB_SPROM1_GPIOA, SSB_SPROM1_GPIOA_P1,
+	     SSB_SPROM1_GPIOA_P1_SHIFT);
+	SPEX(gpio2, SSB_SPROM1_GPIOB, SSB_SPROM1_GPIOB_P2, 0);
+	SPEX(gpio3, SSB_SPROM1_GPIOB, SSB_SPROM1_GPIOB_P3,
+	     SSB_SPROM1_GPIOB_P3_SHIFT);
+	SPEX(maxpwr_a, SSB_SPROM1_MAXPWR, SSB_SPROM1_MAXPWR_A,
+	     SSB_SPROM1_MAXPWR_A_SHIFT);
+	SPEX(maxpwr_bg, SSB_SPROM1_MAXPWR, SSB_SPROM1_MAXPWR_BG, 0);
+	SPEX(itssi_a, SSB_SPROM1_ITSSI, SSB_SPROM1_ITSSI_A,
+	     SSB_SPROM1_ITSSI_A_SHIFT);
+	SPEX(itssi_bg, SSB_SPROM1_ITSSI, SSB_SPROM1_ITSSI_BG, 0);
+	SPEX(boardflags_lo, SSB_SPROM1_BFLLO, 0xFFFF, 0);
+
+	SPEX(alpha2[0], SSB_SPROM1_CCODE, 0xff00, 8);
+	SPEX(alpha2[1], SSB_SPROM1_CCODE, 0x00ff, 0);
+
+	/* Extract the antenna gain values. */
+	out->antenna_gain.a0 = sprom_extract_antgain(out->revision, in,
+						     SSB_SPROM1_AGAIN,
+						     SSB_SPROM1_AGAIN_BG,
+						     SSB_SPROM1_AGAIN_BG_SHIFT);
+	out->antenna_gain.a1 = sprom_extract_antgain(out->revision, in,
+						     SSB_SPROM1_AGAIN,
+						     SSB_SPROM1_AGAIN_A,
+						     SSB_SPROM1_AGAIN_A_SHIFT);
+	if (out->revision >= 2)
+		sprom_extract_r23(out, in);
+}
+
+/* Revs 4 5 and 8 have partially shared layout */
+static void sprom_extract_r458(struct ssb_sprom *out, const u16 *in)
+{
+	SPEX(txpid2g[0], SSB_SPROM4_TXPID2G01,
+	     SSB_SPROM4_TXPID2G0, SSB_SPROM4_TXPID2G0_SHIFT);
+	SPEX(txpid2g[1], SSB_SPROM4_TXPID2G01,
+	     SSB_SPROM4_TXPID2G1, SSB_SPROM4_TXPID2G1_SHIFT);
+	SPEX(txpid2g[2], SSB_SPROM4_TXPID2G23,
+	     SSB_SPROM4_TXPID2G2, SSB_SPROM4_TXPID2G2_SHIFT);
+	SPEX(txpid2g[3], SSB_SPROM4_TXPID2G23,
+	     SSB_SPROM4_TXPID2G3, SSB_SPROM4_TXPID2G3_SHIFT);
+
+	SPEX(txpid5gl[0], SSB_SPROM4_TXPID5GL01,
+	     SSB_SPROM4_TXPID5GL0, SSB_SPROM4_TXPID5GL0_SHIFT);
+	SPEX(txpid5gl[1], SSB_SPROM4_TXPID5GL01,
+	     SSB_SPROM4_TXPID5GL1, SSB_SPROM4_TXPID5GL1_SHIFT);
+	SPEX(txpid5gl[2], SSB_SPROM4_TXPID5GL23,
+	     SSB_SPROM4_TXPID5GL2, SSB_SPROM4_TXPID5GL2_SHIFT);
+	SPEX(txpid5gl[3], SSB_SPROM4_TXPID5GL23,
+	     SSB_SPROM4_TXPID5GL3, SSB_SPROM4_TXPID5GL3_SHIFT);
+
+	SPEX(txpid5g[0], SSB_SPROM4_TXPID5G01,
+	     SSB_SPROM4_TXPID5G0, SSB_SPROM4_TXPID5G0_SHIFT);
+	SPEX(txpid5g[1], SSB_SPROM4_TXPID5G01,
+	     SSB_SPROM4_TXPID5G1, SSB_SPROM4_TXPID5G1_SHIFT);
+	SPEX(txpid5g[2], SSB_SPROM4_TXPID5G23,
+	     SSB_SPROM4_TXPID5G2, SSB_SPROM4_TXPID5G2_SHIFT);
+	SPEX(txpid5g[3], SSB_SPROM4_TXPID5G23,
+	     SSB_SPROM4_TXPID5G3, SSB_SPROM4_TXPID5G3_SHIFT);
+
+	SPEX(txpid5gh[0], SSB_SPROM4_TXPID5GH01,
+	     SSB_SPROM4_TXPID5GH0, SSB_SPROM4_TXPID5GH0_SHIFT);
+	SPEX(txpid5gh[1], SSB_SPROM4_TXPID5GH01,
+	     SSB_SPROM4_TXPID5GH1, SSB_SPROM4_TXPID5GH1_SHIFT);
+	SPEX(txpid5gh[2], SSB_SPROM4_TXPID5GH23,
+	     SSB_SPROM4_TXPID5GH2, SSB_SPROM4_TXPID5GH2_SHIFT);
+	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23,
+	     SSB_SPROM4_TXPID5GH3, SSB_SPROM4_TXPID5GH3_SHIFT);
+}
+
+static void sprom_extract_r45(struct ssb_sprom *out, const u16 *in)
+{
+	static const u16 pwr_info_offset[] = {
+		SSB_SPROM4_PWR_INFO_CORE0, SSB_SPROM4_PWR_INFO_CORE1,
+		SSB_SPROM4_PWR_INFO_CORE2, SSB_SPROM4_PWR_INFO_CORE3
+	};
+	int i;
+
+	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
+		     ARRAY_SIZE(out->core_pwr_info));
+
+	SPEX(et0phyaddr, SSB_SPROM4_ETHPHY, SSB_SPROM4_ETHPHY_ET0A, 0);
+	SPEX(et1phyaddr, SSB_SPROM4_ETHPHY, SSB_SPROM4_ETHPHY_ET1A,
+	     SSB_SPROM4_ETHPHY_ET1A_SHIFT);
+	SPEX(board_rev, SSB_SPROM4_BOARDREV, 0xFFFF, 0);
+	SPEX(board_type, SSB_SPROM1_SPID, 0xFFFF, 0);
+	if (out->revision == 4) {
+		SPEX(alpha2[0], SSB_SPROM4_CCODE, 0xff00, 8);
+		SPEX(alpha2[1], SSB_SPROM4_CCODE, 0x00ff, 0);
+		SPEX(boardflags_lo, SSB_SPROM4_BFLLO, 0xFFFF, 0);
+		SPEX(boardflags_hi, SSB_SPROM4_BFLHI, 0xFFFF, 0);
+		SPEX(boardflags2_lo, SSB_SPROM4_BFL2LO, 0xFFFF, 0);
+		SPEX(boardflags2_hi, SSB_SPROM4_BFL2HI, 0xFFFF, 0);
+	} else {
+		SPEX(alpha2[0], SSB_SPROM5_CCODE, 0xff00, 8);
+		SPEX(alpha2[1], SSB_SPROM5_CCODE, 0x00ff, 0);
+		SPEX(boardflags_lo, SSB_SPROM5_BFLLO, 0xFFFF, 0);
+		SPEX(boardflags_hi, SSB_SPROM5_BFLHI, 0xFFFF, 0);
+		SPEX(boardflags2_lo, SSB_SPROM5_BFL2LO, 0xFFFF, 0);
+		SPEX(boardflags2_hi, SSB_SPROM5_BFL2HI, 0xFFFF, 0);
+	}
+	SPEX(ant_available_a, SSB_SPROM4_ANTAVAIL, SSB_SPROM4_ANTAVAIL_A,
+	     SSB_SPROM4_ANTAVAIL_A_SHIFT);
+	SPEX(ant_available_bg, SSB_SPROM4_ANTAVAIL, SSB_SPROM4_ANTAVAIL_BG,
+	     SSB_SPROM4_ANTAVAIL_BG_SHIFT);
+	SPEX(maxpwr_bg, SSB_SPROM4_MAXP_BG, SSB_SPROM4_MAXP_BG_MASK, 0);
+	SPEX(itssi_bg, SSB_SPROM4_MAXP_BG, SSB_SPROM4_ITSSI_BG,
+	     SSB_SPROM4_ITSSI_BG_SHIFT);
+	SPEX(maxpwr_a, SSB_SPROM4_MAXP_A, SSB_SPROM4_MAXP_A_MASK, 0);
+	SPEX(itssi_a, SSB_SPROM4_MAXP_A, SSB_SPROM4_ITSSI_A,
+	     SSB_SPROM4_ITSSI_A_SHIFT);
+	if (out->revision == 4) {
+		SPEX(gpio0, SSB_SPROM4_GPIOA, SSB_SPROM4_GPIOA_P0, 0);
+		SPEX(gpio1, SSB_SPROM4_GPIOA, SSB_SPROM4_GPIOA_P1,
+		     SSB_SPROM4_GPIOA_P1_SHIFT);
+		SPEX(gpio2, SSB_SPROM4_GPIOB, SSB_SPROM4_GPIOB_P2, 0);
+		SPEX(gpio3, SSB_SPROM4_GPIOB, SSB_SPROM4_GPIOB_P3,
+		     SSB_SPROM4_GPIOB_P3_SHIFT);
+	} else {
+		SPEX(gpio0, SSB_SPROM5_GPIOA, SSB_SPROM5_GPIOA_P0, 0);
+		SPEX(gpio1, SSB_SPROM5_GPIOA, SSB_SPROM5_GPIOA_P1,
+		     SSB_SPROM5_GPIOA_P1_SHIFT);
+		SPEX(gpio2, SSB_SPROM5_GPIOB, SSB_SPROM5_GPIOB_P2, 0);
+		SPEX(gpio3, SSB_SPROM5_GPIOB, SSB_SPROM5_GPIOB_P3,
+		     SSB_SPROM5_GPIOB_P3_SHIFT);
+	}
+
+	/* Extract the antenna gain values. */
+	out->antenna_gain.a0 = sprom_extract_antgain(out->revision, in,
+						     SSB_SPROM4_AGAIN01,
+						     SSB_SPROM4_AGAIN0,
+						     SSB_SPROM4_AGAIN0_SHIFT);
+	out->antenna_gain.a1 = sprom_extract_antgain(out->revision, in,
+						     SSB_SPROM4_AGAIN01,
+						     SSB_SPROM4_AGAIN1,
+						     SSB_SPROM4_AGAIN1_SHIFT);
+	out->antenna_gain.a2 = sprom_extract_antgain(out->revision, in,
+						     SSB_SPROM4_AGAIN23,
+						     SSB_SPROM4_AGAIN2,
+						     SSB_SPROM4_AGAIN2_SHIFT);
+	out->antenna_gain.a3 = sprom_extract_antgain(out->revision, in,
+						     SSB_SPROM4_AGAIN23,
+						     SSB_SPROM4_AGAIN3,
+						     SSB_SPROM4_AGAIN3_SHIFT);
+
+	/* Extract cores power info info */
+	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
+		u16 o = pwr_info_offset[i];
+
+		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SPROM4_2G_MAXP_ITSSI,
+			SSB_SPROM4_2G_ITSSI, SSB_SPROM4_2G_ITSSI_SHIFT);
+		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SPROM4_2G_MAXP_ITSSI,
+			SSB_SPROM4_2G_MAXP, 0);
+
+		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SPROM4_2G_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SPROM4_2G_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SPROM4_2G_PA_2, ~0, 0);
+		SPEX(core_pwr_info[i].pa_2g[3], o + SSB_SPROM4_2G_PA_3, ~0, 0);
+
+		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SPROM4_5G_MAXP_ITSSI,
+			SSB_SPROM4_5G_ITSSI, SSB_SPROM4_5G_ITSSI_SHIFT);
+		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SPROM4_5G_MAXP_ITSSI,
+			SSB_SPROM4_5G_MAXP, 0);
+		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM4_5GHL_MAXP,
+			SSB_SPROM4_5GH_MAXP, 0);
+		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM4_5GHL_MAXP,
+			SSB_SPROM4_5GL_MAXP, SSB_SPROM4_5GL_MAXP_SHIFT);
+
+		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SPROM4_5GL_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SPROM4_5GL_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SPROM4_5GL_PA_2, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gl[3], o + SSB_SPROM4_5GL_PA_3, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SPROM4_5G_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SPROM4_5G_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SPROM4_5G_PA_2, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5g[3], o + SSB_SPROM4_5G_PA_3, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SPROM4_5GH_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SPROM4_5GH_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SPROM4_5GH_PA_2, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gh[3], o + SSB_SPROM4_5GH_PA_3, ~0, 0);
+	}
+
+	sprom_extract_r458(out, in);
+
+	/* TODO - get remaining rev 4 stuff needed */
+}
+
+static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
+{
+	int i;
+	u16 o;
+	static const u16 pwr_info_offset[] = {
+		SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
+		SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
+	};
+	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
+			ARRAY_SIZE(out->core_pwr_info));
+
+	SPEX(board_rev, SSB_SPROM8_BOARDREV, 0xFFFF, 0);
+	SPEX(board_type, SSB_SPROM1_SPID, 0xFFFF, 0);
+	SPEX(alpha2[0], SSB_SPROM8_CCODE, 0xff00, 8);
+	SPEX(alpha2[1], SSB_SPROM8_CCODE, 0x00ff, 0);
+	SPEX(boardflags_lo, SSB_SPROM8_BFLLO, 0xFFFF, 0);
+	SPEX(boardflags_hi, SSB_SPROM8_BFLHI, 0xFFFF, 0);
+	SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, 0xFFFF, 0);
+	SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, 0xFFFF, 0);
+	SPEX(ant_available_a, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_A,
+	     SSB_SPROM8_ANTAVAIL_A_SHIFT);
+	SPEX(ant_available_bg, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_BG,
+	     SSB_SPROM8_ANTAVAIL_BG_SHIFT);
+	SPEX(maxpwr_bg, SSB_SPROM8_MAXP_BG, SSB_SPROM8_MAXP_BG_MASK, 0);
+	SPEX(itssi_bg, SSB_SPROM8_MAXP_BG, SSB_SPROM8_ITSSI_BG,
+	     SSB_SPROM8_ITSSI_BG_SHIFT);
+	SPEX(maxpwr_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_MAXP_A_MASK, 0);
+	SPEX(itssi_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_ITSSI_A,
+	     SSB_SPROM8_ITSSI_A_SHIFT);
+	SPEX(maxpwr_ah, SSB_SPROM8_MAXP_AHL, SSB_SPROM8_MAXP_AH_MASK, 0);
+	SPEX(maxpwr_al, SSB_SPROM8_MAXP_AHL, SSB_SPROM8_MAXP_AL_MASK,
+	     SSB_SPROM8_MAXP_AL_SHIFT);
+	SPEX(gpio0, SSB_SPROM8_GPIOA, SSB_SPROM8_GPIOA_P0, 0);
+	SPEX(gpio1, SSB_SPROM8_GPIOA, SSB_SPROM8_GPIOA_P1,
+	     SSB_SPROM8_GPIOA_P1_SHIFT);
+	SPEX(gpio2, SSB_SPROM8_GPIOB, SSB_SPROM8_GPIOB_P2, 0);
+	SPEX(gpio3, SSB_SPROM8_GPIOB, SSB_SPROM8_GPIOB_P3,
+	     SSB_SPROM8_GPIOB_P3_SHIFT);
+	SPEX(tri2g, SSB_SPROM8_TRI25G, SSB_SPROM8_TRI2G, 0);
+	SPEX(tri5g, SSB_SPROM8_TRI25G, SSB_SPROM8_TRI5G,
+	     SSB_SPROM8_TRI5G_SHIFT);
+	SPEX(tri5gl, SSB_SPROM8_TRI5GHL, SSB_SPROM8_TRI5GL, 0);
+	SPEX(tri5gh, SSB_SPROM8_TRI5GHL, SSB_SPROM8_TRI5GH,
+	     SSB_SPROM8_TRI5GH_SHIFT);
+	SPEX(rxpo2g, SSB_SPROM8_RXPO, SSB_SPROM8_RXPO2G, 0);
+	SPEX(rxpo5g, SSB_SPROM8_RXPO, SSB_SPROM8_RXPO5G,
+	     SSB_SPROM8_RXPO5G_SHIFT);
+	SPEX(rssismf2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISMF2G, 0);
+	SPEX(rssismc2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISMC2G,
+	     SSB_SPROM8_RSSISMC2G_SHIFT);
+	SPEX(rssisav2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISAV2G,
+	     SSB_SPROM8_RSSISAV2G_SHIFT);
+	SPEX(bxa2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_BXA2G,
+	     SSB_SPROM8_BXA2G_SHIFT);
+	SPEX(rssismf5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISMF5G, 0);
+	SPEX(rssismc5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISMC5G,
+	     SSB_SPROM8_RSSISMC5G_SHIFT);
+	SPEX(rssisav5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISAV5G,
+	     SSB_SPROM8_RSSISAV5G_SHIFT);
+	SPEX(bxa5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_BXA5G,
+	     SSB_SPROM8_BXA5G_SHIFT);
+	SPEX(pa0b0, SSB_SPROM8_PA0B0, 0xFFFF, 0);
+	SPEX(pa0b1, SSB_SPROM8_PA0B1, 0xFFFF, 0);
+	SPEX(pa0b2, SSB_SPROM8_PA0B2, 0xFFFF, 0);
+	SPEX(pa1b0, SSB_SPROM8_PA1B0, 0xFFFF, 0);
+	SPEX(pa1b1, SSB_SPROM8_PA1B1, 0xFFFF, 0);
+	SPEX(pa1b2, SSB_SPROM8_PA1B2, 0xFFFF, 0);
+	SPEX(pa1lob0, SSB_SPROM8_PA1LOB0, 0xFFFF, 0);
+	SPEX(pa1lob1, SSB_SPROM8_PA1LOB1, 0xFFFF, 0);
+	SPEX(pa1lob2, SSB_SPROM8_PA1LOB2, 0xFFFF, 0);
+	SPEX(pa1hib0, SSB_SPROM8_PA1HIB0, 0xFFFF, 0);
+	SPEX(pa1hib1, SSB_SPROM8_PA1HIB1, 0xFFFF, 0);
+	SPEX(pa1hib2, SSB_SPROM8_PA1HIB2, 0xFFFF, 0);
+	SPEX(cck2gpo, SSB_SPROM8_CCK2GPO, 0xFFFF, 0);
+	SPEX32(ofdm2gpo, SSB_SPROM8_OFDM2GPO, 0xFFFFFFFF, 0);
+	SPEX32(ofdm5glpo, SSB_SPROM8_OFDM5GLPO, 0xFFFFFFFF, 0);
+	SPEX32(ofdm5gpo, SSB_SPROM8_OFDM5GPO, 0xFFFFFFFF, 0);
+	SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, 0xFFFFFFFF, 0);
+
+	/* Extract the antenna gain values. */
+	out->antenna_gain.a0 = sprom_extract_antgain(out->revision, in,
+						     SSB_SPROM8_AGAIN01,
+						     SSB_SPROM8_AGAIN0,
+						     SSB_SPROM8_AGAIN0_SHIFT);
+	out->antenna_gain.a1 = sprom_extract_antgain(out->revision, in,
+						     SSB_SPROM8_AGAIN01,
+						     SSB_SPROM8_AGAIN1,
+						     SSB_SPROM8_AGAIN1_SHIFT);
+	out->antenna_gain.a2 = sprom_extract_antgain(out->revision, in,
+						     SSB_SPROM8_AGAIN23,
+						     SSB_SPROM8_AGAIN2,
+						     SSB_SPROM8_AGAIN2_SHIFT);
+	out->antenna_gain.a3 = sprom_extract_antgain(out->revision, in,
+						     SSB_SPROM8_AGAIN23,
+						     SSB_SPROM8_AGAIN3,
+						     SSB_SPROM8_AGAIN3_SHIFT);
+
+	/* Extract cores power info info */
+	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
+		o = pwr_info_offset[i];
+		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
+			SSB_SPROM8_2G_ITSSI, SSB_SPROM8_2G_ITSSI_SHIFT);
+		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
+			SSB_SPROM8_2G_MAXP, 0);
+
+		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SROM8_2G_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SROM8_2G_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SROM8_2G_PA_2, ~0, 0);
+
+		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
+			SSB_SPROM8_5G_ITSSI, SSB_SPROM8_5G_ITSSI_SHIFT);
+		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
+			SSB_SPROM8_5G_MAXP, 0);
+		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM8_5GHL_MAXP,
+			SSB_SPROM8_5GH_MAXP, 0);
+		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM8_5GHL_MAXP,
+			SSB_SPROM8_5GL_MAXP, SSB_SPROM8_5GL_MAXP_SHIFT);
+
+		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SROM8_5GL_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SROM8_5GL_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SROM8_5GL_PA_2, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SROM8_5G_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SROM8_5G_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SROM8_5G_PA_2, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SROM8_5GH_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SROM8_5GH_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SROM8_5GH_PA_2, ~0, 0);
+	}
+
+	/* Extract FEM info */
+	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G,
+		SSB_SROM8_FEM_TSSIPOS, SSB_SROM8_FEM_TSSIPOS_SHIFT);
+	SPEX(fem.ghz2.extpa_gain, SSB_SPROM8_FEM2G,
+		SSB_SROM8_FEM_EXTPA_GAIN, SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
+	SPEX(fem.ghz2.pdet_range, SSB_SPROM8_FEM2G,
+		SSB_SROM8_FEM_PDET_RANGE, SSB_SROM8_FEM_PDET_RANGE_SHIFT);
+	SPEX(fem.ghz2.tr_iso, SSB_SPROM8_FEM2G,
+		SSB_SROM8_FEM_TR_ISO, SSB_SROM8_FEM_TR_ISO_SHIFT);
+	SPEX(fem.ghz2.antswlut, SSB_SPROM8_FEM2G,
+		SSB_SROM8_FEM_ANTSWLUT, SSB_SROM8_FEM_ANTSWLUT_SHIFT);
+
+	SPEX(fem.ghz5.tssipos, SSB_SPROM8_FEM5G,
+		SSB_SROM8_FEM_TSSIPOS, SSB_SROM8_FEM_TSSIPOS_SHIFT);
+	SPEX(fem.ghz5.extpa_gain, SSB_SPROM8_FEM5G,
+		SSB_SROM8_FEM_EXTPA_GAIN, SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
+	SPEX(fem.ghz5.pdet_range, SSB_SPROM8_FEM5G,
+		SSB_SROM8_FEM_PDET_RANGE, SSB_SROM8_FEM_PDET_RANGE_SHIFT);
+	SPEX(fem.ghz5.tr_iso, SSB_SPROM8_FEM5G,
+		SSB_SROM8_FEM_TR_ISO, SSB_SROM8_FEM_TR_ISO_SHIFT);
+	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G,
+		SSB_SROM8_FEM_ANTSWLUT, SSB_SROM8_FEM_ANTSWLUT_SHIFT);
+
+	SPEX(leddc_on_time, SSB_SPROM8_LEDDC, SSB_SPROM8_LEDDC_ON,
+	     SSB_SPROM8_LEDDC_ON_SHIFT);
+	SPEX(leddc_off_time, SSB_SPROM8_LEDDC, SSB_SPROM8_LEDDC_OFF,
+	     SSB_SPROM8_LEDDC_OFF_SHIFT);
+
+	SPEX(txchain, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_TXCHAIN,
+	     SSB_SPROM8_TXRXC_TXCHAIN_SHIFT);
+	SPEX(rxchain, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_RXCHAIN,
+	     SSB_SPROM8_TXRXC_RXCHAIN_SHIFT);
+	SPEX(antswitch, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_SWITCH,
+	     SSB_SPROM8_TXRXC_SWITCH_SHIFT);
+
+	SPEX(opo, SSB_SPROM8_OFDM2GPO, 0x00ff, 0);
+
+	SPEX_ARRAY8(mcs2gpo, SSB_SPROM8_2G_MCSPO, ~0, 0);
+	SPEX_ARRAY8(mcs5gpo, SSB_SPROM8_5G_MCSPO, ~0, 0);
+	SPEX_ARRAY8(mcs5glpo, SSB_SPROM8_5GL_MCSPO, ~0, 0);
+	SPEX_ARRAY8(mcs5ghpo, SSB_SPROM8_5GH_MCSPO, ~0, 0);
+
+	SPEX(rawtempsense, SSB_SPROM8_RAWTS, SSB_SPROM8_RAWTS_RAWTEMP,
+	     SSB_SPROM8_RAWTS_RAWTEMP_SHIFT);
+	SPEX(measpower, SSB_SPROM8_RAWTS, SSB_SPROM8_RAWTS_MEASPOWER,
+	     SSB_SPROM8_RAWTS_MEASPOWER_SHIFT);
+	SPEX(tempsense_slope, SSB_SPROM8_OPT_CORRX,
+	     SSB_SPROM8_OPT_CORRX_TEMP_SLOPE,
+	     SSB_SPROM8_OPT_CORRX_TEMP_SLOPE_SHIFT);
+	SPEX(tempcorrx, SSB_SPROM8_OPT_CORRX, SSB_SPROM8_OPT_CORRX_TEMPCORRX,
+	     SSB_SPROM8_OPT_CORRX_TEMPCORRX_SHIFT);
+	SPEX(tempsense_option, SSB_SPROM8_OPT_CORRX,
+	     SSB_SPROM8_OPT_CORRX_TEMP_OPTION,
+	     SSB_SPROM8_OPT_CORRX_TEMP_OPTION_SHIFT);
+	SPEX(freqoffset_corr, SSB_SPROM8_HWIQ_IQSWP,
+	     SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR,
+	     SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR_SHIFT);
+	SPEX(iqcal_swp_dis, SSB_SPROM8_HWIQ_IQSWP,
+	     SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP,
+	     SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP_SHIFT);
+	SPEX(hw_iqcal_en, SSB_SPROM8_HWIQ_IQSWP, SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL,
+	     SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL_SHIFT);
+
+	SPEX(bw40po, SSB_SPROM8_BW40PO, ~0, 0);
+	SPEX(cddpo, SSB_SPROM8_CDDPO, ~0, 0);
+	SPEX(stbcpo, SSB_SPROM8_STBCPO, ~0, 0);
+	SPEX(bwduppo, SSB_SPROM8_BWDUPPO, ~0, 0);
+
+	SPEX(tempthresh, SSB_SPROM8_THERMAL, SSB_SPROM8_THERMAL_TRESH,
+	     SSB_SPROM8_THERMAL_TRESH_SHIFT);
+	SPEX(tempoffset, SSB_SPROM8_THERMAL, SSB_SPROM8_THERMAL_OFFSET,
+	     SSB_SPROM8_THERMAL_OFFSET_SHIFT);
+	SPEX(phycal_tempdelta, SSB_SPROM8_TEMPDELTA,
+	     SSB_SPROM8_TEMPDELTA_PHYCAL,
+	     SSB_SPROM8_TEMPDELTA_PHYCAL_SHIFT);
+	SPEX(temps_period, SSB_SPROM8_TEMPDELTA, SSB_SPROM8_TEMPDELTA_PERIOD,
+	     SSB_SPROM8_TEMPDELTA_PERIOD_SHIFT);
+	SPEX(temps_hysteresis, SSB_SPROM8_TEMPDELTA,
+	     SSB_SPROM8_TEMPDELTA_HYSTERESIS,
+	     SSB_SPROM8_TEMPDELTA_HYSTERESIS_SHIFT);
+	sprom_extract_r458(out, in);
+
+	/* TODO - get remaining rev 8 stuff needed */
+}
+
+static int sprom_extract(struct ssb_fbs *priv, const u16 *in, u16 size)
+{
+	struct ssb_sprom *out = &priv->sprom;
+
+	memset(out, 0, sizeof(*out));
+
+	out->revision = in[size - 1] & 0x00FF;
+
+	switch (out->revision) {
+	case 1:
+	case 2:
+	case 3:
+		sprom_extract_r123(out, in);
+		break;
+	case 4:
+	case 5:
+		sprom_extract_r45(out, in);
+		break;
+	case 8:
+		sprom_extract_r8(out, in);
+		break;
+	default:
+		dev_warn(priv->dev,
+			 "Unsupported SPROM revision %d detected."
+			 " Will extract v1\n",
+			 out->revision);
+		out->revision = 1;
+		sprom_extract_r123(out, in);
+	}
+
+	if (out->boardflags_lo == 0xFFFF)
+		out->boardflags_lo = 0;  /* per specs */
+	if (out->boardflags_hi == 0xFFFF)
+		out->boardflags_hi = 0;  /* per specs */
+
+	return 0;
+}
+
+static void ssb_fbs_fixup(struct ssb_fbs *priv, u16 *sprom)
+{
+	struct device_node *node = priv->dev->of_node;
+	u32 fixups, off, val;
+	int i = 0;
+
+	if (!of_get_property(node, "brcm,sprom-fixups", &fixups))
+		return;
+
+	fixups /= sizeof(u32);
+
+	dev_info(priv->dev, "patching SPROM with %u fixups...\n", fixups >> 1);
+
+	while (i < fixups) {
+		if (of_property_read_u32_index(node, "brcm,sprom-fixups",
+					       i++, &off)) {
+			dev_err(priv->dev, "error reading fixup[%u] offset\n",
+				i - 1);
+			return;
+		}
+
+		if (of_property_read_u32_index(node, "brcm,sprom-fixups",
+					       i++, &val)) {
+			dev_err(priv->dev, "error reading fixup[%u] value\n",
+				i - 1);
+			return;
+		}
+
+		dev_dbg(priv->dev, "fixup[%d]=0x%04x\n", off, val);
+
+		sprom[off] = val;
+	}
+}
+
+static bool sprom_override_devid(struct ssb_fbs *priv, struct ssb_sprom *out,
+				 const u16 *in)
+{
+	SPEX(dev_id, SSB_SPROM1_PID, 0xFFFF, 0);
+	return !!out->dev_id;
+}
+
+static int ssb_fbs_set(struct ssb_fbs *priv, struct device_node *node)
+{
+	struct ssb_sprom *sprom = &priv->sprom;
+	const struct firmware *fw;
+	const char *sprom_name;
+	int err;
+
+	if (of_property_read_string(node, "brcm,sprom", &sprom_name))
+		sprom_name = NULL;
+
+	if (sprom_name) {
+		err = request_firmware_direct(&fw, sprom_name, priv->dev);
+		if (err)
+			dev_err(priv->dev, "%s load error\n", sprom_name);
+	} else {
+		err = -ENOENT;
+	}
+
+	if (err) {
+		sprom->revision = 0x02;
+		sprom->board_rev = 0x0017;
+		sprom->country_code = 0x00;
+		sprom->ant_available_bg = 0x03;
+		sprom->pa0b0 = 0x15ae;
+		sprom->pa0b1 = 0xfa85;
+		sprom->pa0b2 = 0xfe8d;
+		sprom->pa1b0 = 0xffff;
+		sprom->pa1b1 = 0xffff;
+		sprom->pa1b2 = 0xffff;
+		sprom->gpio0 = 0xff;
+		sprom->gpio1 = 0xff;
+		sprom->gpio2 = 0xff;
+		sprom->gpio3 = 0xff;
+		sprom->maxpwr_bg = 0x4c;
+		sprom->itssi_bg = 0x00;
+		sprom->boardflags_lo = 0x2848;
+		sprom->boardflags_hi = 0x0000;
+		priv->devid_override = false;
+
+		dev_warn(priv->dev, "using basic SPROM\n");
+	} else {
+		size_t size = min(fw->size, (size_t) SSB_FBS_MAX_SIZE);
+		u16 tmp_sprom[SSB_FBS_MAX_SIZE >> 1];
+		u32 i, j;
+
+		for (i = 0, j = 0; i < size; i += 2, j++)
+			tmp_sprom[j] = (fw->data[i] << 8) | fw->data[i + 1];
+
+		release_firmware(fw);
+		ssb_fbs_fixup(priv, tmp_sprom);
+		sprom_extract(priv, tmp_sprom, size >> 1);
+
+		priv->devid_override = sprom_override_devid(priv, sprom,
+							    tmp_sprom);
+	}
+
+	return 0;
+}
+
+static int ssb_fbs_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node;
+	struct ssb_fbs *priv;
+	unsigned long flags;
+	u8 mac[ETH_ALEN];
+
+	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	priv->dev = dev;
+
+	ssb_fbs_set(priv, node);
+
+	of_property_read_u32(node, "pci-bus", &priv->pci_bus);
+	of_property_read_u32(node, "pci-dev", &priv->pci_dev);
+
+	of_get_mac_address(node, mac);
+	if (is_valid_ether_addr(mac)) {
+		dev_info(dev, "mtd mac %pM\n", mac);
+	} else {
+		eth_random_addr(mac);
+		dev_info(dev, "random mac %pM\n", mac);
+	}
+
+	memcpy(priv->sprom.il0mac, mac, ETH_ALEN);
+ 	memcpy(priv->sprom.et0mac, mac, ETH_ALEN);
+ 	memcpy(priv->sprom.et1mac, mac, ETH_ALEN);
+	memcpy(priv->sprom.et2mac, mac, ETH_ALEN);
+
+	spin_lock_irqsave(&ssb_fbs_lock, flags);
+	list_add(&priv->list, &ssb_fbs_list);
+	spin_unlock_irqrestore(&ssb_fbs_lock, flags);
+
+	dev_info(dev, "registered SPROM for [%x:%x]\n",
+		 priv->pci_bus, priv->pci_dev);
+
+	return 0;
+}
+
+static const struct of_device_id ssb_fbs_of_match[] = {
+	{ .compatible = "brcm,ssb-sprom", },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, ssb_fbs_of_match);
+
+static struct platform_driver ssb_fbs_driver = {
+	.probe = ssb_fbs_probe,
+	.driver	= {
+		.name = "ssb-sprom",
+		.of_match_table = ssb_fbs_of_match,
+	},
+};
+
+int __init ssb_fbs_register(void)
+{
+	return platform_driver_register(&ssb_fbs_driver);
+}
diff --git a/target/linux/generic/hack-5.15/204-module_strip.patch b/target/linux/generic/hack-5.15/204-module_strip.patch
index dee240d9f9f6d7..dd5d93e22673e7 100644
--- a/target/linux/generic/hack-5.15/204-module_strip.patch
+++ b/target/linux/generic/hack-5.15/204-module_strip.patch
@@ -88,7 +88,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/init/Kconfig
 +++ b/init/Kconfig
-@@ -2352,6 +2352,13 @@ config UNUSED_KSYMS_WHITELIST
+@@ -2356,6 +2356,13 @@ config UNUSED_KSYMS_WHITELIST
  	  one per line. The path can be absolute, or relative to the kernel
  	  source tree.
  
@@ -143,7 +143,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/scripts/mod/modpost.c
 +++ b/scripts/mod/modpost.c
-@@ -2034,7 +2034,9 @@ static void read_symbols(const char *mod
+@@ -2036,7 +2036,9 @@ static void read_symbols(const char *mod
  		symname = remove_dot(info.strtab + sym->st_name);
  
  		handle_symbol(mod, &info, sym, symname);
@@ -153,7 +153,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	}
  
  	for (sym = info.symtab_start; sym < info.symtab_stop; sym++) {
-@@ -2213,8 +2215,10 @@ static void add_header(struct buffer *b,
+@@ -2215,8 +2217,10 @@ static void add_header(struct buffer *b,
  	buf_printf(b, "BUILD_SALT;\n");
  	buf_printf(b, "BUILD_LTO_INFO;\n");
  	buf_printf(b, "\n");
@@ -164,7 +164,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	buf_printf(b, "\n");
  	buf_printf(b, "__visible struct module __this_module\n");
  	buf_printf(b, "__section(\".gnu.linkonce.this_module\") = {\n");
-@@ -2231,8 +2235,10 @@ static void add_header(struct buffer *b,
+@@ -2233,8 +2237,10 @@ static void add_header(struct buffer *b,
  
  static void add_intree_flag(struct buffer *b, int is_intree)
  {
@@ -175,7 +175,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
  
  /* Cannot check for assembler */
-@@ -2245,8 +2251,10 @@ static void add_retpoline(struct buffer
+@@ -2247,8 +2253,10 @@ static void add_retpoline(struct buffer
  
  static void add_staging_flag(struct buffer *b, const char *name)
  {
@@ -186,7 +186,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
  
  /**
-@@ -2326,11 +2334,13 @@ static void add_depends(struct buffer *b
+@@ -2328,11 +2336,13 @@ static void add_depends(struct buffer *b
  
  static void add_srcversion(struct buffer *b, struct module *mod)
  {
@@ -200,7 +200,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
  
  static void write_buf(struct buffer *b, const char *fname)
-@@ -2579,7 +2589,9 @@ int main(int argc, char **argv)
+@@ -2581,7 +2591,9 @@ int main(int argc, char **argv)
  		add_staging_flag(&buf, mod->name);
  		add_versions(&buf, mod);
  		add_depends(&buf, mod);
diff --git a/target/linux/generic/hack-5.15/205-kconfig-abort-configuration-on-unset-symbol.patch b/target/linux/generic/hack-5.15/205-kconfig-abort-configuration-on-unset-symbol.patch
new file mode 100644
index 00000000000000..a87c7a51169eb3
--- /dev/null
+++ b/target/linux/generic/hack-5.15/205-kconfig-abort-configuration-on-unset-symbol.patch
@@ -0,0 +1,41 @@
+From 310e8e04a05d9eb43fa9dd7f00143300afcaa37a Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Fri, 11 Nov 2022 13:33:44 +0100
+Subject: [PATCH] kconfig: abort configuration on unset symbol
+
+When a target configuration has unset Kconfig symbols, the build will
+fail when OpenWrt is compiled with V=s and stdin is connected to a tty.
+
+In case OpenWrt is compiled without either of these preconditions, the
+build will succeed with the symbols in question being unset.
+
+Modify the kernel configuration in a way it fails on unset symbols
+regardless of the aforementioned preconditions.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ scripts/kconfig/conf.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/scripts/kconfig/conf.c
++++ b/scripts/kconfig/conf.c
+@@ -341,6 +341,9 @@ static int conf_askvalue(struct symbol *
+ 		}
+ 		/* fall through */
+ 	default:
++		if (!tty_stdio && getenv("FAIL_ON_UNCONFIGURED")) {
++			exit(1);
++		}
+ 		fflush(stdout);
+ 		xfgets(line, sizeof(line), stdin);
+ 		break;
+@@ -523,6 +526,9 @@ static int conf_choice(struct menu *menu
+ 			}
+ 			/* fall through */
+ 		case oldaskconfig:
++			if (!tty_stdio && getenv("FAIL_ON_UNCONFIGURED")) {
++				exit(1);
++			}
+ 			fflush(stdout);
+ 			xfgets(line, sizeof(line), stdin);
+ 			strip(line);
diff --git a/target/linux/generic/hack-5.15/221-module_exports.patch b/target/linux/generic/hack-5.15/221-module_exports.patch
index 204027d769d8a2..87f541b46f2c0c 100644
--- a/target/linux/generic/hack-5.15/221-module_exports.patch
+++ b/target/linux/generic/hack-5.15/221-module_exports.patch
@@ -30,7 +30,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  /* Align . to a 8 byte boundary equals to maximum function alignment. */
  #define ALIGN_FUNCTION()  . = ALIGN(8)
  
-@@ -484,14 +494,14 @@
+@@ -485,14 +495,14 @@
  	/* Kernel symbol table: Normal symbols */			\
  	__ksymtab         : AT(ADDR(__ksymtab) - LOAD_OFFSET) {		\
  		__start___ksymtab = .;					\
@@ -47,7 +47,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		__stop___ksymtab_gpl = .;				\
  	}								\
  									\
-@@ -511,7 +521,7 @@
+@@ -512,7 +522,7 @@
  									\
  	/* Kernel symbol table: strings */				\
          __ksymtab_strings : AT(ADDR(__ksymtab_strings) - LOAD_OFFSET) {	\
@@ -56,7 +56,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	}								\
  									\
  	/* __*init sections */						\
-@@ -1018,6 +1028,8 @@
+@@ -1022,6 +1032,8 @@
  
  #define COMMON_DISCARDS							\
  	SANITIZER_DISCARDS						\
diff --git a/target/linux/generic/hack-5.15/251-kconfig.patch b/target/linux/generic/hack-5.15/251-kconfig.patch
index 5a8a820252a63c..0e24c3e8041f34 100644
--- a/target/linux/generic/hack-5.15/251-kconfig.patch
+++ b/target/linux/generic/hack-5.15/251-kconfig.patch
@@ -197,3 +197,14 @@ Signed-off-by: John Crispin <john@phrozen.org>
  
  config SND_JACK
  	bool
+--- a/net/Kconfig
++++ b/net/Kconfig
+@@ -432,7 +432,7 @@ config NET_DEVLINK
+ 	default n
+ 
+ config PAGE_POOL
+-	bool
++	bool "Page pool support"
+ 
+ config PAGE_POOL_STATS
+ 	default n
diff --git a/target/linux/generic/hack-5.15/253-ksmbd-config.patch b/target/linux/generic/hack-5.15/253-ksmbd-config.patch
index a29cf3bf617cac..b8cb94f62bc0a8 100644
--- a/target/linux/generic/hack-5.15/253-ksmbd-config.patch
+++ b/target/linux/generic/hack-5.15/253-ksmbd-config.patch
@@ -10,7 +10,7 @@ Subject: [PATCH] Kconfig: add tristate for OID and ASNI string
 
 --- a/init/Kconfig
 +++ b/init/Kconfig
-@@ -2384,7 +2384,7 @@ config PADATA
+@@ -2388,7 +2388,7 @@ config PADATA
  	bool
  
  config ASN1
diff --git a/target/linux/generic/hack-5.15/259-regmap_dynamic.patch b/target/linux/generic/hack-5.15/259-regmap_dynamic.patch
index 6be5875177cfd3..e0820ccfc0dbf3 100644
--- a/target/linux/generic/hack-5.15/259-regmap_dynamic.patch
+++ b/target/linux/generic/hack-5.15/259-regmap_dynamic.patch
@@ -125,7 +125,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #include <linux/mutex.h>
  #include <linux/err.h>
  #include <linux/property.h>
-@@ -3341,3 +3342,5 @@ static int __init regmap_initcall(void)
+@@ -3360,3 +3361,5 @@ static int __init regmap_initcall(void)
  	return 0;
  }
  postcore_initcall(regmap_initcall);
diff --git a/target/linux/generic/hack-5.15/402-mtd-blktrans-call-add-disks-after-mtd-device.patch b/target/linux/generic/hack-5.15/402-mtd-blktrans-call-add-disks-after-mtd-device.patch
index 011f790fa7e606..32a7fb6266422f 100644
--- a/target/linux/generic/hack-5.15/402-mtd-blktrans-call-add-disks-after-mtd-device.patch
+++ b/target/linux/generic/hack-5.15/402-mtd-blktrans-call-add-disks-after-mtd-device.patch
@@ -69,7 +69,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	unsigned long flags;
 --- a/drivers/mtd/mtdcore.c
 +++ b/drivers/mtd/mtdcore.c
-@@ -31,6 +31,7 @@
+@@ -32,6 +32,7 @@
  
  #include <linux/mtd/mtd.h>
  #include <linux/mtd/partitions.h>
@@ -77,15 +77,15 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  #include "mtdcore.h"
  
-@@ -1073,6 +1074,8 @@ int mtd_device_parse_register(struct mtd
- 
- 	ret = mtd_otp_nvmem_add(mtd);
+@@ -1082,6 +1083,8 @@ int mtd_device_parse_register(struct mtd
+ 		register_reboot_notifier(&mtd->reboot_notifier);
+ 	}
  
 +	register_mtd_blktrans_devs();
 +
  out:
- 	if (ret && device_is_registered(&mtd->dev))
- 		del_mtd_device(mtd);
+ 	if (ret) {
+ 		nvmem_unregister(mtd->otp_user_nvmem);
 --- a/include/linux/mtd/blktrans.h
 +++ b/include/linux/mtd/blktrans.h
 @@ -76,6 +76,7 @@ extern int deregister_mtd_blktrans(struc
diff --git a/target/linux/generic/hack-5.15/420-mtd-support-OpenWrt-s-MTD_ROOTFS_ROOT_DEV.patch b/target/linux/generic/hack-5.15/420-mtd-support-OpenWrt-s-MTD_ROOTFS_ROOT_DEV.patch
new file mode 100644
index 00000000000000..947b2c262f3390
--- /dev/null
+++ b/target/linux/generic/hack-5.15/420-mtd-support-OpenWrt-s-MTD_ROOTFS_ROOT_DEV.patch
@@ -0,0 +1,24 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 7 Nov 2022 23:48:24 +0100
+Subject: [PATCH] mtd: support OpenWrt's MTD_ROOTFS_ROOT_DEV
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This allows setting ROOT_DEV to MTD partition named "rootfs".
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -761,7 +761,8 @@ int add_mtd_device(struct mtd_info *mtd)
+ 
+ 	mutex_unlock(&mtd_table_mutex);
+ 
+-	if (of_find_property(mtd_get_of_node(mtd), "linux,rootfs", NULL)) {
++	if (of_find_property(mtd_get_of_node(mtd), "linux,rootfs", NULL) ||
++	    (IS_ENABLED(CONFIG_MTD_ROOTFS_ROOT_DEV) && !strcmp(mtd->name, "rootfs") && ROOT_DEV == 0)) {
+ 		if (IS_BUILTIN(CONFIG_MTD)) {
+ 			pr_info("mtd: setting mtd%d (%s) as root device\n", mtd->index, mtd->name);
+ 			ROOT_DEV = MKDEV(MTD_BLOCK_MAJOR, mtd->index);
diff --git a/target/linux/generic/hack-5.15/601-of_net-add-mac-address-ascii-support.patch b/target/linux/generic/hack-5.15/601-of_net-add-mac-address-ascii-support.patch
new file mode 100644
index 00000000000000..55866c313506aa
--- /dev/null
+++ b/target/linux/generic/hack-5.15/601-of_net-add-mac-address-ascii-support.patch
@@ -0,0 +1,116 @@
+From: Yousong Zhou <yszhou4tech@gmail.com>
+Subject: [PATCH] of: net: add nvmem cell mac-address-ascii support
+
+This is needed for devices with mac address stored in ascii format,
+e.g. HiWiFi HC6361 to be ported in the following patch.
+
+Submitted-by: Yousong Zhou <yszhou4tech@gmail.com>
+---
+ net/core/of_net.c | 83 ++++++++++++------
+ 1 files changed, 72 insertions(+), 11 deletions(-)
+
+--- a/net/core/of_net.c
++++ b/net/core/of_net.c
+@@ -57,13 +57,70 @@ static int of_get_mac_addr(struct device
+ 	return -ENODEV;
+ }
+ 
++static void *nvmem_cell_get_mac_address(struct nvmem_cell *cell)
++{
++	size_t len;
++	void *mac;
++
++	mac = nvmem_cell_read(cell, &len);
++	if (IS_ERR(mac))
++		return mac;
++	if (len != ETH_ALEN) {
++		kfree(mac);
++		return ERR_PTR(-EINVAL);
++	}
++	return mac;
++}
++
++static void *nvmem_cell_get_mac_address_ascii(struct nvmem_cell *cell)
++{
++	size_t len;
++	int ret;
++	void *mac_ascii;
++	u8 *mac;
++
++	mac_ascii = nvmem_cell_read(cell, &len);
++	if (IS_ERR(mac_ascii))
++		return mac_ascii;
++	if (len != ETH_ALEN*2+5) {
++		kfree(mac_ascii);
++		return ERR_PTR(-EINVAL);
++	}
++	mac = kmalloc(ETH_ALEN, GFP_KERNEL);
++	if (!mac) {
++		kfree(mac_ascii);
++		return ERR_PTR(-ENOMEM);
++	}
++	ret = sscanf(mac_ascii, "%2hhx:%2hhx:%2hhx:%2hhx:%2hhx:%2hhx",
++				&mac[0], &mac[1], &mac[2],
++				&mac[3], &mac[4], &mac[5]);
++	kfree(mac_ascii);
++	if (ret == ETH_ALEN)
++		return mac;
++	kfree(mac);
++	return ERR_PTR(-EINVAL);
++}
++
++static struct nvmem_cell_mac_address_property {
++	char *name;
++	void *(*read)(struct nvmem_cell *);
++} nvmem_cell_mac_address_properties[] = {
++	{
++		.name = "mac-address",
++		.read = nvmem_cell_get_mac_address,
++	}, {
++		.name = "mac-address-ascii",
++		.read = nvmem_cell_get_mac_address_ascii,
++	},
++};
++
+ static int of_get_mac_addr_nvmem(struct device_node *np, u8 *addr)
+ {
+ 	struct platform_device *pdev = of_find_device_by_node(np);
++	struct nvmem_cell_mac_address_property *property;
+ 	struct nvmem_cell *cell;
+ 	const void *mac;
+-	size_t len;
+-	int ret;
++	int ret, i;
+ 
+ 	/* Try lookup by device first, there might be a nvmem_cell_lookup
+ 	 * associated with a given device.
+@@ -74,17 +131,26 @@ static int of_get_mac_addr_nvmem(struct
+ 		return ret;
+ 	}
+ 
+-	cell = of_nvmem_cell_get(np, "mac-address");
++	for (i = 0; i < ARRAY_SIZE(nvmem_cell_mac_address_properties); i++) {
++		property = &nvmem_cell_mac_address_properties[i];
++		cell = of_nvmem_cell_get(np, property->name);
++		/* For -EPROBE_DEFER don't try other properties.
++		 * We'll get back to this one.
++		 */
++		if (!IS_ERR(cell) || PTR_ERR(cell) == -EPROBE_DEFER)
++			break;
++	}
++
+ 	if (IS_ERR(cell))
+ 		return PTR_ERR(cell);
+ 
+-	mac = nvmem_cell_read(cell, &len);
++	mac = property->read(cell);
+ 	nvmem_cell_put(cell);
+ 
+ 	if (IS_ERR(mac))
+ 		return PTR_ERR(mac);
+ 
+-	if (len != ETH_ALEN || !is_valid_ether_addr(mac)) {
++	if (!is_valid_ether_addr(mac)) {
+ 		kfree(mac);
+ 		return -EINVAL;
+ 	}
diff --git a/target/linux/generic/hack-5.15/645-netfilter-connmark-introduce-set-dscpmark.patch b/target/linux/generic/hack-5.15/645-netfilter-connmark-introduce-set-dscpmark.patch
index 2d3fe01a755b9e..c368c4ae3bfd9e 100644
--- a/target/linux/generic/hack-5.15/645-netfilter-connmark-introduce-set-dscpmark.patch
+++ b/target/linux/generic/hack-5.15/645-netfilter-connmark-introduce-set-dscpmark.patch
@@ -109,7 +109,7 @@ Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
  	__u8 invert;
 --- a/net/netfilter/xt_connmark.c
 +++ b/net/netfilter/xt_connmark.c
-@@ -24,12 +24,13 @@ MODULE_ALIAS("ipt_connmark");
+@@ -24,13 +24,13 @@ MODULE_ALIAS("ipt_connmark");
  MODULE_ALIAS("ip6t_connmark");
  
  static unsigned int
@@ -120,20 +120,22 @@ Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
  	u_int32_t new_targetmark;
  	struct nf_conn *ct;
  	u_int32_t newmark;
+-	u_int32_t oldmark;
 +	u_int8_t dscp;
  
  	ct = nf_ct_get(skb, &ctinfo);
  	if (ct == NULL)
-@@ -37,12 +38,24 @@ connmark_tg_shift(struct sk_buff *skb, c
+@@ -38,13 +38,24 @@ connmark_tg_shift(struct sk_buff *skb, c
  
  	switch (info->mode) {
  	case XT_CONNMARK_SET:
--		newmark = (ct->mark & ~info->ctmask) ^ info->ctmark;
+-		oldmark = READ_ONCE(ct->mark);
+-		newmark = (oldmark & ~info->ctmask) ^ info->ctmark;
 -		if (info->shift_dir == D_SHIFT_RIGHT)
 -			newmark >>= info->shift_bits;
 -		else
 -			newmark <<= info->shift_bits;
-+		newmark = ct->mark;
++		newmark = READ_ONCE(ct->mark);
 +		if (info->func & XT_CONNMARK_VALUE) {
 +			newmark = (newmark & ~info->ctmask) ^ info->ctmark;
 +			if (info->shift_dir == D_SHIFT_RIGHT)
@@ -151,10 +153,10 @@ Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
 +			newmark = (newmark & ~info->ctmark) |
 +				  (info->ctmask | (dscp << info->shift_bits));
 +		}
- 		if (ct->mark != newmark) {
- 			ct->mark = newmark;
+ 		if (READ_ONCE(ct->mark) != newmark) {
+ 			WRITE_ONCE(ct->mark, newmark);
  			nf_conntrack_event_cache(IPCT_MARK, ct);
-@@ -81,20 +94,36 @@ static unsigned int
+@@ -83,20 +94,36 @@ static unsigned int
  connmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
  {
  	const struct xt_connmark_tginfo1 *info = par->targinfo;
@@ -193,7 +195,7 @@ Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
  
  	return connmark_tg_shift(skb, info);
  }
-@@ -165,6 +194,16 @@ static struct xt_target connmark_tg_reg[
+@@ -167,6 +194,16 @@ static struct xt_target connmark_tg_reg[
  		.targetsize     = sizeof(struct xt_connmark_tginfo2),
  		.destroy        = connmark_tg_destroy,
  		.me             = THIS_MODULE,
diff --git a/target/linux/generic/hack-5.15/650-netfilter-add-xt_FLOWOFFLOAD-target.patch b/target/linux/generic/hack-5.15/650-netfilter-add-xt_FLOWOFFLOAD-target.patch
index 961a930bb38fb3..aa6c668558ab93 100644
--- a/target/linux/generic/hack-5.15/650-netfilter-add-xt_FLOWOFFLOAD-target.patch
+++ b/target/linux/generic/hack-5.15/650-netfilter-add-xt_FLOWOFFLOAD-target.patch
@@ -98,7 +98,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o
 --- /dev/null
 +++ b/net/netfilter/xt_FLOWOFFLOAD.c
-@@ -0,0 +1,697 @@
+@@ -0,0 +1,698 @@
 +/*
 + * Copyright (C) 2018-2021 Felix Fietkau <nbd@nbd.name>
 + *
@@ -752,6 +752,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +{
 +	INIT_DELAYED_WORK(&tbl->work, xt_flowoffload_hook_work);
 +	tbl->ft.type = &flowtable_inet;
++	tbl->ft.flags = NF_FLOWTABLE_COUNTER;
 +
 +	return nf_flow_table_init(&tbl->ft);
 +}
@@ -770,7 +771,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +	if (ret)
 +		goto cleanup;
 +
-+	flowtable[1].ft.flags = NF_FLOWTABLE_HW_OFFLOAD;
++	flowtable[1].ft.flags |= NF_FLOWTABLE_HW_OFFLOAD;
 +
 +	ret = xt_register_target(&offload_tg_reg);
 +	if (ret)
diff --git a/target/linux/generic/hack-5.15/660-fq_codel_defaults.patch b/target/linux/generic/hack-5.15/660-fq_codel_defaults.patch
index 5541c0bc89ee1b..a57a045f4a8382 100644
--- a/target/linux/generic/hack-5.15/660-fq_codel_defaults.patch
+++ b/target/linux/generic/hack-5.15/660-fq_codel_defaults.patch
@@ -13,7 +13,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/sched/sch_fq_codel.c
 +++ b/net/sched/sch_fq_codel.c
-@@ -469,7 +469,11 @@ static int fq_codel_init(struct Qdisc *s
+@@ -467,7 +467,11 @@ static int fq_codel_init(struct Qdisc *s
  
  	sch->limit = 10*1024;
  	q->flows_cnt = 1024;
diff --git a/target/linux/generic/hack-5.15/661-kernel-ct-size-the-hashtable-more-adequately.patch b/target/linux/generic/hack-5.15/661-kernel-ct-size-the-hashtable-more-adequately.patch
index 134e2100c84d41..2fa91deece4b37 100644
--- a/target/linux/generic/hack-5.15/661-kernel-ct-size-the-hashtable-more-adequately.patch
+++ b/target/linux/generic/hack-5.15/661-kernel-ct-size-the-hashtable-more-adequately.patch
@@ -14,7 +14,7 @@ Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
 
 --- a/net/netfilter/nf_conntrack_core.c
 +++ b/net/netfilter/nf_conntrack_core.c
-@@ -2727,7 +2727,7 @@ int nf_conntrack_init_start(void)
+@@ -2738,7 +2738,7 @@ int nf_conntrack_init_start(void)
  
  	if (!nf_conntrack_htable_size) {
  		nf_conntrack_htable_size
diff --git a/target/linux/generic/hack-5.15/700-swconfig_switch_drivers.patch b/target/linux/generic/hack-5.15/700-swconfig_switch_drivers.patch
index 48be4400256c8d..9d77efaca6ef99 100644
--- a/target/linux/generic/hack-5.15/700-swconfig_switch_drivers.patch
+++ b/target/linux/generic/hack-5.15/700-swconfig_switch_drivers.patch
@@ -12,7 +12,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/phy/Kconfig
 +++ b/drivers/net/phy/Kconfig
-@@ -61,6 +61,80 @@ config SFP
+@@ -62,6 +62,80 @@ config SFP
  	depends on HWMON || HWMON=n
  	select MDIO_I2C
  
diff --git a/target/linux/generic/hack-5.15/711-net-dsa-mv88e6xxx-disable-ATU-violation.patch b/target/linux/generic/hack-5.15/711-net-dsa-mv88e6xxx-disable-ATU-violation.patch
index ffa44f09607ccd..e62f45f3c33c59 100644
--- a/target/linux/generic/hack-5.15/711-net-dsa-mv88e6xxx-disable-ATU-violation.patch
+++ b/target/linux/generic/hack-5.15/711-net-dsa-mv88e6xxx-disable-ATU-violation.patch
@@ -9,7 +9,7 @@ Subject: [PATCH] net/dsa/mv88e6xxx: disable ATU violation
 
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
-@@ -2980,6 +2980,9 @@ static int mv88e6xxx_setup_port(struct m
+@@ -2985,6 +2985,9 @@ static int mv88e6xxx_setup_port(struct m
  	else
  		reg = 1 << port;
  
diff --git a/target/linux/generic/hack-5.15/720-net-phy-add-aqr-phys.patch b/target/linux/generic/hack-5.15/720-net-phy-add-aqr-phys.patch
index 65d8f47521581e..29050d38ea22b0 100644
--- a/target/linux/generic/hack-5.15/720-net-phy-add-aqr-phys.patch
+++ b/target/linux/generic/hack-5.15/720-net-phy-add-aqr-phys.patch
@@ -20,7 +20,7 @@ Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
  
  #define MDIO_PHYXS_VEND_IF_STATUS		0xe812
  #define MDIO_PHYXS_VEND_IF_STATUS_TYPE_MASK	GENMASK(7, 3)
-@@ -372,6 +374,49 @@ static int aqr107_read_rate(struct phy_d
+@@ -381,6 +383,49 @@ static int aqr107_read_rate(struct phy_d
  	return 0;
  }
  
@@ -70,7 +70,7 @@ Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
  static int aqr107_read_status(struct phy_device *phydev)
  {
  	int val, ret;
-@@ -502,7 +547,7 @@ static void aqr107_chip_info(struct phy_
+@@ -511,7 +556,7 @@ static void aqr107_chip_info(struct phy_
  	build_id = FIELD_GET(VEND1_GLOBAL_RSVD_STAT1_FW_BUILD_ID, val);
  	prov_id = FIELD_GET(VEND1_GLOBAL_RSVD_STAT1_PROV_ID, val);
  
@@ -79,7 +79,7 @@ Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
  		   fw_major, fw_minor, build_id, prov_id);
  }
  
-@@ -674,6 +719,24 @@ static struct phy_driver aqr_driver[] =
+@@ -719,6 +764,24 @@ static struct phy_driver aqr_driver[] =
  	.link_change_notify = aqr107_link_change_notify,
  },
  {
@@ -104,7 +104,7 @@ Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
  	PHY_ID_MATCH_MODEL(PHY_ID_AQCS109),
  	.name		= "Aquantia AQCS109",
  	.probe		= aqr107_probe,
-@@ -699,6 +762,24 @@ static struct phy_driver aqr_driver[] =
+@@ -744,6 +807,24 @@ static struct phy_driver aqr_driver[] =
  	.handle_interrupt = aqr_handle_interrupt,
  	.read_status	= aqr_read_status,
  },
@@ -129,7 +129,7 @@ Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
  };
  
  module_phy_driver(aqr_driver);
-@@ -709,8 +790,10 @@ static struct mdio_device_id __maybe_unu
+@@ -754,8 +835,10 @@ static struct mdio_device_id __maybe_unu
  	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR105) },
  	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR106) },
  	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR107) },
diff --git a/target/linux/generic/hack-5.15/721-net-add-packet-mangeling.patch b/target/linux/generic/hack-5.15/721-net-add-packet-mangeling.patch
index 53f6d33bd90959..b4e92b4a185dc5 100644
--- a/target/linux/generic/hack-5.15/721-net-add-packet-mangeling.patch
+++ b/target/linux/generic/hack-5.15/721-net-add-packet-mangeling.patch
@@ -19,7 +19,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/include/linux/netdevice.h
 +++ b/include/linux/netdevice.h
-@@ -1669,6 +1669,10 @@ enum netdev_priv_flags {
+@@ -1682,6 +1682,10 @@ enum netdev_priv_flags {
  	IFF_TX_SKB_NO_LINEAR		= BIT_ULL(31),
  };
  
@@ -30,7 +30,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #define IFF_802_1Q_VLAN			IFF_802_1Q_VLAN
  #define IFF_EBRIDGE			IFF_EBRIDGE
  #define IFF_BONDING			IFF_BONDING
-@@ -1701,6 +1705,7 @@ enum netdev_priv_flags {
+@@ -1714,6 +1718,7 @@ enum netdev_priv_flags {
  #define IFF_L3MDEV_RX_HANDLER		IFF_L3MDEV_RX_HANDLER
  #define IFF_LIVE_RENAME_OK		IFF_LIVE_RENAME_OK
  #define IFF_TX_SKB_NO_LINEAR		IFF_TX_SKB_NO_LINEAR
@@ -38,7 +38,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  /* Specifies the type of the struct net_device::ml_priv pointer */
  enum netdev_ml_priv_type {
-@@ -2002,6 +2007,7 @@ struct net_device {
+@@ -2015,6 +2020,7 @@ struct net_device {
  	/* Read-mostly cache-line for fast-path access */
  	unsigned int		flags;
  	unsigned int		priv_flags;
@@ -46,7 +46,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	const struct net_device_ops *netdev_ops;
  	int			ifindex;
  	unsigned short		gflags;
-@@ -2062,6 +2068,11 @@ struct net_device {
+@@ -2075,6 +2081,11 @@ struct net_device {
  	const struct tlsdev_ops *tlsdev_ops;
  #endif
  
@@ -58,7 +58,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	const struct header_ops *header_ops;
  
  	unsigned char		operstate;
-@@ -2136,6 +2147,10 @@ struct net_device {
+@@ -2149,6 +2160,10 @@ struct net_device {
  	struct mctp_dev __rcu	*mctp_ptr;
  #endif
  
@@ -71,7 +71,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
   */
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -2824,6 +2824,10 @@ static inline int pskb_trim(struct sk_bu
+@@ -2855,6 +2855,10 @@ static inline int pskb_trim(struct sk_bu
  	return (len < skb->len) ? __pskb_trim(skb, len) : 0;
  }
  
@@ -82,7 +82,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  /**
   *	pskb_trim_unique - remove end from a paged unique (not cloned) buffer
   *	@skb: buffer to alter
-@@ -2974,16 +2978,6 @@ static inline struct sk_buff *dev_alloc_
+@@ -3005,16 +3009,6 @@ static inline struct sk_buff *dev_alloc_
  }
  
  
@@ -116,7 +116,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	help
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -3588,6 +3588,11 @@ static int xmit_one(struct sk_buff *skb,
+@@ -3592,6 +3592,11 @@ static int xmit_one(struct sk_buff *skb,
  	if (dev_nit_active(dev))
  		dev_queue_xmit_nit(skb, dev);
  
diff --git a/target/linux/generic/hack-5.15/722-net-phy-aquantia-enable-AQR112-and-AQR412.patch b/target/linux/generic/hack-5.15/722-net-phy-aquantia-enable-AQR112-and-AQR412.patch
index f1901853e1d264..211696c5688ec8 100644
--- a/target/linux/generic/hack-5.15/722-net-phy-aquantia-enable-AQR112-and-AQR412.patch
+++ b/target/linux/generic/hack-5.15/722-net-phy-aquantia-enable-AQR112-and-AQR412.patch
@@ -27,9 +27,9 @@ Signed-off-by: Alex Marginean <alexandru.marginean@nxp.com>
  #define PHY_ID_AQR813	0x31c31cb2
  
  #define MDIO_PHYXS_VEND_IF_STATUS		0xe812
-@@ -126,6 +128,29 @@
- #define VEND1_GLOBAL_INT_VEND_MASK_GLOBAL2	BIT(1)
- #define VEND1_GLOBAL_INT_VEND_MASK_GLOBAL3	BIT(0)
+@@ -135,6 +137,29 @@
+ #define AQR107_OP_IN_PROG_SLEEP		1000
+ #define AQR107_OP_IN_PROG_TIMEOUT	100000
  
 +/* registers in MDIO_MMD_VEND1 region */
 +#define AQUANTIA_VND1_GLOBAL_SC			0x000
@@ -57,7 +57,7 @@ Signed-off-by: Alex Marginean <alexandru.marginean@nxp.com>
  struct aqr107_hw_stat {
  	const char *name;
  	int reg;
-@@ -257,6 +282,51 @@ static int aqr_config_aneg(struct phy_de
+@@ -266,6 +291,51 @@ static int aqr_config_aneg(struct phy_de
  	return genphy_c45_check_and_restart_aneg(phydev, changed);
  }
  
@@ -109,7 +109,7 @@ Signed-off-by: Alex Marginean <alexandru.marginean@nxp.com>
  static int aqr_config_intr(struct phy_device *phydev)
  {
  	bool en = phydev->interrupts == PHY_INTERRUPT_ENABLED;
-@@ -780,6 +850,30 @@ static struct phy_driver aqr_driver[] =
+@@ -825,6 +895,30 @@ static struct phy_driver aqr_driver[] =
  	.get_stats	= aqr107_get_stats,
  	.link_change_notify = aqr107_link_change_notify,
  },
@@ -140,7 +140,7 @@ Signed-off-by: Alex Marginean <alexandru.marginean@nxp.com>
  };
  
  module_phy_driver(aqr_driver);
-@@ -790,9 +884,11 @@ static struct mdio_device_id __maybe_unu
+@@ -835,9 +929,11 @@ static struct mdio_device_id __maybe_unu
  	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR105) },
  	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR106) },
  	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR107) },
diff --git a/target/linux/generic/hack-5.15/723-net-phy-aquantia-fix-system-side-protocol-mi.patch b/target/linux/generic/hack-5.15/723-net-phy-aquantia-fix-system-side-protocol-mi.patch
index d99b4951b8266d..7d16c8aa289a70 100644
--- a/target/linux/generic/hack-5.15/723-net-phy-aquantia-fix-system-side-protocol-mi.patch
+++ b/target/linux/generic/hack-5.15/723-net-phy-aquantia-fix-system-side-protocol-mi.patch
@@ -14,7 +14,7 @@ Signed-off-by: Alex Marginean <alexandru.marginean@nxp.com>
 
 --- a/drivers/net/phy/aquantia_main.c
 +++ b/drivers/net/phy/aquantia_main.c
-@@ -315,10 +315,16 @@ static int aqr_config_aneg_set_prot(stru
+@@ -324,10 +324,16 @@ static int aqr_config_aneg_set_prot(stru
  	phy_write_mmd(phydev, MDIO_MMD_VEND1, AQUANTIA_VND1_GSTART_RATE,
  		      aquantia_syscfg[if_type].start_rate);
  
diff --git a/target/linux/generic/hack-5.15/724-net-phy-aquantia-Add-AQR113-driver-support.patch b/target/linux/generic/hack-5.15/724-net-phy-aquantia-Add-AQR113-driver-support.patch
index 634288c780f954..d03c3430fae296 100644
--- a/target/linux/generic/hack-5.15/724-net-phy-aquantia-Add-AQR113-driver-support.patch
+++ b/target/linux/generic/hack-5.15/724-net-phy-aquantia-Add-AQR113-driver-support.patch
@@ -18,7 +18,7 @@ Add a new entry for AQR113 PHY_ID
  #define PHY_ID_AQR113C	0x31c31c12
  #define PHY_ID_AQCS109	0x03a1b5c2
  #define PHY_ID_AQR405	0x03a1b4b0
-@@ -869,6 +870,14 @@ static struct phy_driver aqr_driver[] =
+@@ -914,6 +915,14 @@ static struct phy_driver aqr_driver[] =
  	.get_stats	= aqr107_get_stats,
  },
  {
@@ -33,7 +33,7 @@ Add a new entry for AQR113 PHY_ID
  	PHY_ID_MATCH_MODEL(PHY_ID_AQR412),
  	.name		= "Aquantia AQR412",
  	.probe		= aqr107_probe,
-@@ -891,6 +900,7 @@ static struct mdio_device_id __maybe_unu
+@@ -936,6 +945,7 @@ static struct mdio_device_id __maybe_unu
  	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR106) },
  	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR107) },
  	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR112) },
diff --git a/target/linux/generic/hack-5.15/725-net-phy-aquantia-add-PHY_IDs-for-AQR112-variants.patch b/target/linux/generic/hack-5.15/725-net-phy-aquantia-add-PHY_IDs-for-AQR112-variants.patch
index f7ccc454e92b4c..9821c0c86ee22c 100644
--- a/target/linux/generic/hack-5.15/725-net-phy-aquantia-add-PHY_IDs-for-AQR112-variants.patch
+++ b/target/linux/generic/hack-5.15/725-net-phy-aquantia-add-PHY_IDs-for-AQR112-variants.patch
@@ -21,7 +21,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  #define PHY_ID_AQR113	0x31c31c40
  #define PHY_ID_AQR113C	0x31c31c12
  #define PHY_ID_AQCS109	0x03a1b5c2
-@@ -870,6 +872,30 @@ static struct phy_driver aqr_driver[] =
+@@ -915,6 +917,30 @@ static struct phy_driver aqr_driver[] =
  	.get_stats	= aqr107_get_stats,
  },
  {
@@ -52,7 +52,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	PHY_ID_MATCH_MODEL(PHY_ID_AQR113),
  	.name		= "Aquantia AQR113",
  	.config_aneg	= aqr_config_aneg,
-@@ -900,6 +926,8 @@ static struct mdio_device_id __maybe_unu
+@@ -945,6 +971,8 @@ static struct mdio_device_id __maybe_unu
  	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR106) },
  	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR107) },
  	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR112) },
diff --git a/target/linux/generic/hack-5.15/750-net-pcs-mtk-lynxi-workaround-2500BaseX-no-an.patch b/target/linux/generic/hack-5.15/750-net-pcs-mtk-lynxi-workaround-2500BaseX-no-an.patch
new file mode 100644
index 00000000000000..8b7f2f095577fd
--- /dev/null
+++ b/target/linux/generic/hack-5.15/750-net-pcs-mtk-lynxi-workaround-2500BaseX-no-an.patch
@@ -0,0 +1,53 @@
+From 880d1311335120f64447ca9d11933872d734e19a Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 27 Mar 2023 18:41:54 +0100
+Subject: [PATCH] generic: pcs-mtk-lynxi: add hack to use 2500Base-X without AN
+
+Using 2500Base-T SFP modules e.g. on the BananaPi R3 requires manually
+disabling auto-negotiation, e.g. using ethtool. While a proper fix
+using SFP quirks is being discussed upstream, bring a work-around to
+restore user experience to what it was before the switch to the
+dedicated SGMII PCS driver.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+
+--- a/drivers/net/pcs/pcs-mtk-lynxi.c
++++ b/drivers/net/pcs/pcs-mtk-lynxi.c
+@@ -92,14 +92,23 @@ static void mtk_pcs_lynxi_get_state(stru
+ 				    struct phylink_link_state *state)
+ {
+ 	struct mtk_pcs_lynxi *mpcs = pcs_to_mtk_pcs_lynxi(pcs);
+-	unsigned int bm, adv;
++	unsigned int bm, bmsr, adv;
+ 
+ 	/* Read the BMSR and LPA */
+ 	regmap_read(mpcs->regmap, SGMSYS_PCS_CONTROL_1, &bm);
+-	regmap_read(mpcs->regmap, SGMSYS_PCS_ADVERTISE, &adv);
++	bmsr = FIELD_GET(SGMII_BMSR, bm);
++
++	if (state->interface == PHY_INTERFACE_MODE_2500BASEX) {
++		state->link = !!(bmsr & BMSR_LSTATUS);
++		state->an_complete = !!(bmsr & BMSR_ANEGCOMPLETE);
++		state->speed = SPEED_2500;
++		state->duplex = DUPLEX_FULL;
+ 
+-	phylink_mii_c22_pcs_decode_state(state, FIELD_GET(SGMII_BMSR, bm),
+-					 FIELD_GET(SGMII_LPA, adv));
++		return;
++	}
++
++	regmap_read(mpcs->regmap, SGMSYS_PCS_ADVERTISE, &adv);
++	phylink_mii_c22_pcs_decode_state(state, bmsr, FIELD_GET(SGMII_LPA, adv));
+ }
+ 
+ static int mtk_pcs_lynxi_config(struct phylink_pcs *pcs, unsigned int mode,
+@@ -134,7 +143,8 @@ static int mtk_pcs_lynxi_config(struct p
+ 		/* 1000base-X or 2500base-X autoneg */
+ 		sgm_mode = SGMII_REMOTE_FAULT_DIS;
+ 		use_an = linkmode_test_bit(ETHTOOL_LINK_MODE_Autoneg_BIT,
+-					   advertising);
++					   advertising) &&
++			 !(interface == PHY_INTERFACE_MODE_2500BASEX);
+ 	} else {
+ 		/* 1000base-X or 2500base-X without autoneg */
+ 		sgm_mode = 0;
diff --git a/target/linux/generic/hack-5.15/760-net-usb-r8152-add-LED-configuration-from-OF.patch b/target/linux/generic/hack-5.15/760-net-usb-r8152-add-LED-configuration-from-OF.patch
index c54332f71c4aa2..f61c078521e2ce 100644
--- a/target/linux/generic/hack-5.15/760-net-usb-r8152-add-LED-configuration-from-OF.patch
+++ b/target/linux/generic/hack-5.15/760-net-usb-r8152-add-LED-configuration-from-OF.patch
@@ -22,7 +22,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  #include <linux/crc32.h>
  #include <linux/if_vlan.h>
  #include <linux/uaccess.h>
-@@ -6861,6 +6862,22 @@ static void rtl_tally_reset(struct r8152
+@@ -6886,6 +6887,22 @@ static void rtl_tally_reset(struct r8152
  	ocp_write_word(tp, MCU_TYPE_PLA, PLA_RSTTALLY, ocp_data);
  }
  
@@ -45,7 +45,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  static void r8152b_init(struct r8152 *tp)
  {
  	u32 ocp_data;
-@@ -6902,6 +6919,8 @@ static void r8152b_init(struct r8152 *tp
+@@ -6927,6 +6944,8 @@ static void r8152b_init(struct r8152 *tp
  	ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_USB_CTRL);
  	ocp_data &= ~(RX_AGG_DISABLE | RX_ZERO_EN);
  	ocp_write_word(tp, MCU_TYPE_USB, USB_USB_CTRL, ocp_data);
@@ -54,7 +54,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  }
  
  static void r8153_init(struct r8152 *tp)
-@@ -7042,6 +7061,8 @@ static void r8153_init(struct r8152 *tp)
+@@ -7067,6 +7086,8 @@ static void r8153_init(struct r8152 *tp)
  		tp->coalesce = COALESCE_SLOW;
  		break;
  	}
@@ -63,7 +63,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  }
  
  static void r8153b_init(struct r8152 *tp)
-@@ -7124,6 +7145,8 @@ static void r8153b_init(struct r8152 *tp
+@@ -7149,6 +7170,8 @@ static void r8153b_init(struct r8152 *tp
  	rtl_tally_reset(tp);
  
  	tp->coalesce = 15000;	/* 15 us */
diff --git a/target/linux/generic/hack-5.15/765-mxl-gpy-control-LED-reg-from-DT.patch b/target/linux/generic/hack-5.15/765-mxl-gpy-control-LED-reg-from-DT.patch
new file mode 100644
index 00000000000000..8de3668def224d
--- /dev/null
+++ b/target/linux/generic/hack-5.15/765-mxl-gpy-control-LED-reg-from-DT.patch
@@ -0,0 +1,101 @@
+From 94b90966095f3fa625897e8f53d215882f6e19b3 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sat, 11 Mar 2023 17:00:01 +0100
+Subject: [PATCH] mxl-gpy: control LED reg from DT
+
+Add dynamic configuration for the LED control registers on MXL PHYs.
+
+This patch has been tested with MaxLinear GPY211C. It is unlikely to be
+accepted upstream, as upstream plans on integrating their own framework
+for handling these LEDs.
+
+For the time being, use this hack to configure PHY driven device-LEDs to
+show the correct state.
+
+A possible alternative might be to expose the LEDs using the kernel LED
+framework and bind it to the netdevice. This might also be upstreamable,
+although it is a considerable extra amount of work.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ drivers/net/phy/mxl-gpy.c | 37 ++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 36 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/phy/mxl-gpy.c
++++ b/drivers/net/phy/mxl-gpy.c
+@@ -8,6 +8,7 @@
+ 
+ #include <linux/module.h>
+ #include <linux/bitfield.h>
++#include <linux/of.h>
+ #include <linux/phy.h>
+ #include <linux/netdevice.h>
+ 
+@@ -30,6 +31,7 @@
+ #define PHY_MIISTAT		0x18	/* MII state */
+ #define PHY_IMASK		0x19	/* interrupt mask */
+ #define PHY_ISTAT		0x1A	/* interrupt status */
++#define PHY_LED			0x1B	/* LED control */
+ #define PHY_FWV			0x1E	/* firmware version */
+ 
+ #define PHY_MIISTAT_SPD_MASK	GENMASK(2, 0)
+@@ -53,10 +55,15 @@
+ 				 PHY_IMASK_ADSC | \
+ 				 PHY_IMASK_ANC)
+ 
++#define PHY_LED_NUM_LEDS	4
++
+ #define PHY_FWV_REL_MASK	BIT(15)
+ #define PHY_FWV_TYPE_MASK	GENMASK(11, 8)
+ #define PHY_FWV_MINOR_MASK	GENMASK(7, 0)
+ 
++/* LED */
++#define VSPEC1_LED(x)		(0x1 + x)
++
+ /* SGMII */
+ #define VSPEC1_SGMII_CTRL	0x08
+ #define VSPEC1_SGMII_CTRL_ANEN	BIT(12)		/* Aneg enable */
+@@ -80,6 +87,31 @@ static const struct {
+ 	{9, 0x73},
+ };
+ 
++static int gpy_led_write(struct phy_device *phydev)
++{
++	struct device_node *node = phydev->mdio.dev.of_node;
++	u32 led_regs[PHY_LED_NUM_LEDS];
++	int i, ret;
++
++	if (!IS_ENABLED(CONFIG_OF_MDIO))
++		return 0;
++
++	if (of_property_read_u32_array(node, "mxl,led-config", led_regs, PHY_LED_NUM_LEDS))
++		return 0;
++
++	/* Enable LED function handling on all ports*/
++	phy_write(phydev, PHY_LED, 0xFF00);
++
++	/* Write LED register values */
++	for (i = 0; i < PHY_LED_NUM_LEDS; i++) {
++		ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, VSPEC1_LED(i), (u16)led_regs[i]);
++		if (ret < 0)
++			return ret;
++	}
++
++	return 0;
++}
++
+ static int gpy_config_init(struct phy_device *phydev)
+ {
+ 	int ret;
+@@ -91,7 +123,10 @@ static int gpy_config_init(struct phy_de
+ 
+ 	/* Clear all pending interrupts */
+ 	ret = phy_read(phydev, PHY_ISTAT);
+-	return ret < 0 ? ret : 0;
++	if (ret < 0)
++		return ret;
++
++	return gpy_led_write(phydev);
+ }
+ 
+ static int gpy_probe(struct phy_device *phydev)
diff --git a/target/linux/generic/hack-5.15/766-net-phy-mediatek-ge-add-LED-configuration-interface.patch b/target/linux/generic/hack-5.15/766-net-phy-mediatek-ge-add-LED-configuration-interface.patch
new file mode 100644
index 00000000000000..3405d5c535b6c9
--- /dev/null
+++ b/target/linux/generic/hack-5.15/766-net-phy-mediatek-ge-add-LED-configuration-interface.patch
@@ -0,0 +1,72 @@
+From cc225d163b5a4f7a0d1968298bf7927306646a47 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Fri, 28 Apr 2023 01:53:01 +0200
+Subject: [PATCH] net: phy: mediatek-ge: add LED configuration interface
+
+This adds a small hack similar to the one used for ar8xxx switches to
+read a reg:value map for configuring the LED configuration registers.
+
+This allows OpenWrt to write device-specific LED action as well as blink
+configurations. It is unlikely to be accepted upstream, as upstream
+plans on integrating their own framework for handling these LEDs.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ drivers/net/phy/mediatek-ge.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+--- a/drivers/net/phy/mediatek-ge.c
++++ b/drivers/net/phy/mediatek-ge.c
+@@ -1,4 +1,5 @@
+ // SPDX-License-Identifier: GPL-2.0+
++#include <linux/of.h>
+ #include <linux/bitfield.h>
+ #include <linux/module.h>
+ #include <linux/phy.h>
+@@ -53,6 +54,36 @@ static int mt7530_phy_config_init(struct
+ 	return 0;
+ }
+ 
++static int mt7530_led_config_of(struct phy_device *phydev)
++{
++	struct device_node *np = phydev->mdio.dev.of_node;
++	const __be32 *paddr;
++	int len;
++	int i;
++
++	paddr = of_get_property(np, "mediatek,led-config", &len);
++	if (!paddr)
++		return 0;
++
++	if (len < (2 * sizeof(*paddr)))
++		return -EINVAL;
++
++	len /= sizeof(*paddr);
++
++	phydev_warn(phydev, "Configure LED registers (num=%d)\n", len);
++	for (i = 0; i < len - 1; i += 2) {
++		u32 reg;
++		u32 val;
++
++		reg = be32_to_cpup(paddr + i);
++		val = be32_to_cpup(paddr + i + 1);
++
++		phy_write_mmd(phydev, MDIO_MMD_VEND2, reg, val);
++	}
++
++	return 0;
++}
++
+ static int mt7531_phy_config_init(struct phy_device *phydev)
+ {
+ 	mtk_gephy_config_init(phydev);
+@@ -65,6 +96,9 @@ static int mt7531_phy_config_init(struct
+ 	phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x13, 0x404);
+ 	phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x14, 0x404);
+ 
++	/* LED Config*/
++	mt7530_led_config_of(phydev);
++
+ 	return 0;
+ }
+ 
diff --git a/target/linux/generic/hack-5.15/773-bgmac-add-srab-switch.patch b/target/linux/generic/hack-5.15/773-bgmac-add-srab-switch.patch
index 1e4fc446ce423b..7127aa136c6a53 100644
--- a/target/linux/generic/hack-5.15/773-bgmac-add-srab-switch.patch
+++ b/target/linux/generic/hack-5.15/773-bgmac-add-srab-switch.patch
@@ -50,9 +50,9 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  /**************************************************
   * MII
   **************************************************/
-@@ -1542,6 +1554,14 @@ int bgmac_enet_probe(struct bgmac *bgmac
- 	/* Omit FCS from max MTU size */
- 	net_dev->max_mtu = BGMAC_RX_MAX_FRAME_SIZE - ETH_FCS_LEN;
+@@ -1546,6 +1558,14 @@ int bgmac_enet_probe(struct bgmac *bgmac
+ 
+ 	bgmac->in_init = false;
  
 +	if ((bgmac->feature_flags & BGMAC_FEAT_SRAB) && !bgmac_b53_pdata.regs) {
 +		bgmac_b53_pdata.regs = ioremap(0x18007000, 0x1000);
@@ -65,7 +65,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  	err = register_netdev(bgmac->net_dev);
  	if (err) {
  		dev_err(bgmac->dev, "Cannot register net device\n");
-@@ -1564,6 +1584,10 @@ EXPORT_SYMBOL_GPL(bgmac_enet_probe);
+@@ -1568,6 +1588,10 @@ EXPORT_SYMBOL_GPL(bgmac_enet_probe);
  
  void bgmac_enet_remove(struct bgmac *bgmac)
  {
@@ -86,7 +86,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  
  struct bgmac_slot_info {
  	union {
-@@ -495,6 +496,9 @@ struct bgmac {
+@@ -497,6 +498,9 @@ struct bgmac {
  	void (*cmn_maskset32)(struct bgmac *bgmac, u16 offset, u32 mask,
  			      u32 set);
  	int (*phy_connect)(struct bgmac *bgmac);
diff --git a/target/linux/generic/hack-5.15/780-usb-net-MeigLink_modem_support.patch b/target/linux/generic/hack-5.15/780-usb-net-MeigLink_modem_support.patch
index 683c29620b2624..367d66fc666dc4 100644
--- a/target/linux/generic/hack-5.15/780-usb-net-MeigLink_modem_support.patch
+++ b/target/linux/generic/hack-5.15/780-usb-net-MeigLink_modem_support.patch
@@ -10,18 +10,18 @@ Subject: [PATCH] net/usb/qmi_wwan: add MeigLink modem support
 
 --- a/drivers/net/usb/qmi_wwan.c
 +++ b/drivers/net/usb/qmi_wwan.c
-@@ -1085,6 +1085,7 @@ static const struct usb_device_id produc
- 	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0512)},	/* Quectel EG12/EM12 */
+@@ -1086,6 +1086,7 @@ static const struct usb_device_id produc
  	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0620)},	/* Quectel EM160R-GL */
  	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0800)},	/* Quectel RM500Q-GL */
+ 	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0801)},	/* Quectel RM520N */
 +	{QMI_MATCH_FF_FF_FF(0x05c6, 0xf601)},   /* MeigLink SLM750 */
  
  	/* 3. Combined interface devices matching on interface number */
  	{QMI_FIXED_INTF(0x0408, 0xea42, 4)},	/* Yota / Megafon M100-1 */
 --- a/drivers/usb/serial/option.c
 +++ b/drivers/usb/serial/option.c
-@@ -243,6 +243,8 @@ static void option_instat_callback(struc
- #define UBLOX_PRODUCT_R6XX			0x90fa
+@@ -244,6 +244,8 @@ static void option_instat_callback(struc
+ #define UBLOX_PRODUCT_R410M			0x90b2
  /* These Yuga products use Qualcomm's vendor ID */
  #define YUGA_PRODUCT_CLM920_NC5			0x9625
 +/* These MeigLink products use Qualcomm's vendor ID */
@@ -29,8 +29,8 @@ Subject: [PATCH] net/usb/qmi_wwan: add MeigLink modem support
  
  #define QUECTEL_VENDOR_ID			0x2c7c
  /* These Quectel products use Quectel's vendor ID */
-@@ -1140,6 +1142,11 @@ static const struct usb_device_id option
- 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95, 0xff, 0, 0) },
+@@ -1169,6 +1171,11 @@ static const struct usb_device_id option
+ 	  .driver_info = ZLP },
  	{ USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96),
  	  .driver_info = RSVD(4) },
 +	/* Meiglink products using Qualcomm vendor ID */
diff --git a/target/linux/generic/hack-5.15/790-SFP-GE-T-ignore-TX_FAULT.patch b/target/linux/generic/hack-5.15/790-SFP-GE-T-ignore-TX_FAULT.patch
index d9835f88961036..10af22e52e050d 100644
--- a/target/linux/generic/hack-5.15/790-SFP-GE-T-ignore-TX_FAULT.patch
+++ b/target/linux/generic/hack-5.15/790-SFP-GE-T-ignore-TX_FAULT.patch
@@ -26,7 +26,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 
 --- a/drivers/net/phy/sfp.c
 +++ b/drivers/net/phy/sfp.c
-@@ -369,6 +369,11 @@ static const struct sfp_quirk sfp_quirks
+@@ -383,6 +383,11 @@ static const struct sfp_quirk sfp_quirks
  		.modes = sfp_quirk_2500basex,
  		.fixup = sfp_fixup_ignore_tx_fault,
  	}, {
@@ -38,7 +38,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		// Lantech 8330-262D-E can operate at 2500base-X, but
  		// incorrectly report 2500MBd NRZ in their EEPROM
  		.vendor = "Lantech",
-@@ -2303,7 +2308,8 @@ static void sfp_sm_main(struct sfp *sfp,
+@@ -2312,7 +2317,8 @@ static void sfp_sm_main(struct sfp *sfp,
  			 * or t_start_up, so assume there is a fault.
  			 */
  			sfp_sm_fault(sfp, SFP_S_INIT_TX_FAULT,
@@ -48,7 +48,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		} else if (event == SFP_E_TIMEOUT || event == SFP_E_TX_CLEAR) {
  	init_done:
  			sfp->sm_phy_retries = R_PHY_RETRY;
-@@ -2526,10 +2532,12 @@ static void sfp_check_state(struct sfp *
+@@ -2535,10 +2541,12 @@ static void sfp_check_state(struct sfp *
  	mutex_lock(&sfp->st_mutex);
  	state = sfp_get_state(sfp);
  	changed = state ^ sfp->state;
diff --git a/target/linux/generic/hack-5.15/795-backport-phylink_pcs-helpers.patch b/target/linux/generic/hack-5.15/795-backport-phylink_pcs-helpers.patch
new file mode 100644
index 00000000000000..b1e7065a8b91f9
--- /dev/null
+++ b/target/linux/generic/hack-5.15/795-backport-phylink_pcs-helpers.patch
@@ -0,0 +1,167 @@
+From 027586ae8ecacff49757ed854c020f35d24a599c Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 11 Mar 2023 03:44:41 +0000
+Subject: [PATCH] generic: backport some phylink helper functions
+
+It isn't feasible to literally backport all upstream phylink_pcs changes
+down to Linux 5.15: It's just too many patches, and many downstream
+drivers and hacks are likely to break. We are too close to branching off
+to risk this, and it's also just too much work.
+Instead just add helper functions used by modern PCS drivers while keeping
+the original functions instact as well. While this may add a kilobyte or
+two of extra kernel size, it has the advantage that we get the best of both
+worlds: None of the existing codepaths are touched, but yet we have the
+option to backport singular improvements to Ethernet drivers where needed.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+
+--- a/include/linux/phylink.h
++++ b/include/linux/phylink.h
+@@ -584,10 +584,37 @@ int phylink_speed_up(struct phylink *pl)
+ #define phylink_test(bm, mode)	__phylink_do_bit(test_bit, bm, mode)
+ 
+ void phylink_set_port_modes(unsigned long *bits);
++
++/**
++ * phylink_get_link_timer_ns - return the PCS link timer value
++ * @interface: link &typedef phy_interface_t mode
++ *
++ * Return the PCS link timer setting in nanoseconds for the PHY @interface
++ * mode, or -EINVAL if not appropriate.
++ */
++static inline int phylink_get_link_timer_ns(phy_interface_t interface)
++{
++	switch (interface) {
++	case PHY_INTERFACE_MODE_SGMII:
++		return 1600000;
++
++	case PHY_INTERFACE_MODE_1000BASEX:
++	case PHY_INTERFACE_MODE_2500BASEX:
++		return 10000000;
++
++	default:
++		return -EINVAL;
++	}
++}
++
+ void phylink_helper_basex_speed(struct phylink_link_state *state);
+ 
++void phylink_mii_c22_pcs_decode_state(struct phylink_link_state *state,
++				      u16 bmsr, u16 lpa);
+ void phylink_mii_c22_pcs_get_state(struct mdio_device *pcs,
+ 				   struct phylink_link_state *state);
++int phylink_mii_c22_pcs_encode_advertisement(phy_interface_t interface,
++					     const unsigned long *advertising);
+ int phylink_mii_c22_pcs_set_advertisement(struct mdio_device *pcs,
+ 					  phy_interface_t interface,
+ 					  const unsigned long *advertising);
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -885,7 +885,6 @@ static int phylink_change_inband_advert(
+ 
+ 	return 0;
+ }
+-
+ static void phylink_mac_pcs_get_state(struct phylink *pl,
+ 				      struct phylink_link_state *state)
+ {
+@@ -2966,6 +2965,52 @@ void phylink_mii_c22_pcs_get_state(struc
+ EXPORT_SYMBOL_GPL(phylink_mii_c22_pcs_get_state);
+ 
+ /**
++ * phylink_mii_c22_pcs_decode_state() - Decode MAC PCS state from MII registers
++ * @state: a pointer to a &struct phylink_link_state.
++ * @bmsr: The value of the %MII_BMSR register
++ * @lpa: The value of the %MII_LPA register
++ *
++ * Helper for MAC PCS supporting the 802.3 clause 22 register set for
++ * clause 37 negotiation and/or SGMII control.
++ *
++ * Parse the Clause 37 or Cisco SGMII link partner negotiation word into
++ * the phylink @state structure. This is suitable to be used for implementing
++ * the mac_pcs_get_state() member of the struct phylink_mac_ops structure if
++ * accessing @bmsr and @lpa cannot be done with MDIO directly.
++ */
++void phylink_mii_c22_pcs_decode_state(struct phylink_link_state *state,
++				      u16 bmsr, u16 lpa)
++{
++	state->link = !!(bmsr & BMSR_LSTATUS);
++	state->an_complete = !!(bmsr & BMSR_ANEGCOMPLETE);
++	/* If there is no link or autonegotiation is disabled, the LP advertisement
++	 * data is not meaningful, so don't go any further.
++	 */
++	if (!state->link || !state->an_enabled)
++		return;
++
++	switch (state->interface) {
++	case PHY_INTERFACE_MODE_1000BASEX:
++		phylink_decode_c37_word(state, lpa, SPEED_1000);
++		break;
++
++	case PHY_INTERFACE_MODE_2500BASEX:
++		phylink_decode_c37_word(state, lpa, SPEED_2500);
++		break;
++
++	case PHY_INTERFACE_MODE_SGMII:
++	case PHY_INTERFACE_MODE_QSGMII:
++		phylink_decode_sgmii_word(state, lpa);
++		break;
++
++	default:
++		state->link = false;
++		break;
++	}
++}
++EXPORT_SYMBOL_GPL(phylink_mii_c22_pcs_decode_state);
++
++/**
+  * phylink_mii_c22_pcs_set_advertisement() - configure the clause 37 PCS
+  *	advertisement
+  * @pcs: a pointer to a &struct mdio_device.
+@@ -3037,6 +3082,46 @@ int phylink_mii_c22_pcs_set_advertisemen
+ EXPORT_SYMBOL_GPL(phylink_mii_c22_pcs_set_advertisement);
+ 
+ /**
++ * phylink_mii_c22_pcs_encode_advertisement() - configure the clause 37 PCS
++ *	advertisement
++ * @interface: the PHY interface mode being configured
++ * @advertising: the ethtool advertisement mask
++ *
++ * Helper for MAC PCS supporting the 802.3 clause 22 register set for
++ * clause 37 negotiation and/or SGMII control.
++ *
++ * Encode the clause 37 PCS advertisement as specified by @interface and
++ * @advertising.
++ *
++ * Return: The new value for @adv, or ``-EINVAL`` if it should not be changed.
++ */
++int phylink_mii_c22_pcs_encode_advertisement(phy_interface_t interface,
++					     const unsigned long *advertising)
++{
++	u16 adv;
++
++	switch (interface) {
++	case PHY_INTERFACE_MODE_1000BASEX:
++	case PHY_INTERFACE_MODE_2500BASEX:
++		adv = ADVERTISE_1000XFULL;
++		if (linkmode_test_bit(ETHTOOL_LINK_MODE_Pause_BIT,
++				      advertising))
++			adv |= ADVERTISE_1000XPAUSE;
++		if (linkmode_test_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT,
++				      advertising))
++			adv |= ADVERTISE_1000XPSE_ASYM;
++		return adv;
++	case PHY_INTERFACE_MODE_SGMII:
++	case PHY_INTERFACE_MODE_QSGMII:
++		return 0x0001;
++	default:
++		/* Nothing to do for other modes */
++		return -EINVAL;
++	}
++}
++EXPORT_SYMBOL_GPL(phylink_mii_c22_pcs_encode_advertisement);
++
++/**
+  * phylink_mii_c22_pcs_config() - configure clause 22 PCS
+  * @pcs: a pointer to a &struct mdio_device.
+  * @mode: link autonegotiation mode
diff --git a/target/linux/generic/hack-5.15/800-GPIO-add-named-gpio-exports.patch b/target/linux/generic/hack-5.15/800-GPIO-add-named-gpio-exports.patch
index 9fde1eaabb0851..0a2c82cacbc11f 100644
--- a/target/linux/generic/hack-5.15/800-GPIO-add-named-gpio-exports.patch
+++ b/target/linux/generic/hack-5.15/800-GPIO-add-named-gpio-exports.patch
@@ -105,7 +105,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  {
 --- a/include/linux/gpio/consumer.h
 +++ b/include/linux/gpio/consumer.h
-@@ -715,6 +715,7 @@ static inline void devm_acpi_dev_remove_
+@@ -712,6 +712,7 @@ static inline void devm_acpi_dev_remove_
  
  #if IS_ENABLED(CONFIG_GPIOLIB) && IS_ENABLED(CONFIG_GPIO_SYSFS)
  
@@ -113,7 +113,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  int gpiod_export(struct gpio_desc *desc, bool direction_may_change);
  int gpiod_export_link(struct device *dev, const char *name,
  		      struct gpio_desc *desc);
-@@ -722,6 +723,13 @@ void gpiod_unexport(struct gpio_desc *de
+@@ -719,6 +720,13 @@ void gpiod_unexport(struct gpio_desc *de
  
  #else  /* CONFIG_GPIOLIB && CONFIG_GPIO_SYSFS */
  
diff --git a/target/linux/generic/hack-5.15/810-bcma-ssb-fallback-sprom.patch b/target/linux/generic/hack-5.15/810-bcma-ssb-fallback-sprom.patch
new file mode 100644
index 00000000000000..c581a512cbd5d0
--- /dev/null
+++ b/target/linux/generic/hack-5.15/810-bcma-ssb-fallback-sprom.patch
@@ -0,0 +1,187 @@
+From e4d708702e6c98f2111e33201a264d6788564cb2 Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Fri, 12 May 2023 11:08:43 +0200
+Subject: [PATCH] ssb_sprom: add generic kernel support for Broadcom  Fallback SPROMs
+
+---
+ drivers/bcma/Kconfig        |  4 ++++
+ drivers/bcma/Makefile       |  1 +
+ drivers/bcma/bcma_private.h |  4 ++++
+ drivers/bcma/main.c         |  8 ++++++++
+ drivers/bcma/sprom.c        | 23 ++++++++++++++---------
+ drivers/ssb/Kconfig         |  5 +++++
+ drivers/ssb/Makefile        |  1 +
+ drivers/ssb/main.c          |  8 ++++++++
+ drivers/ssb/sprom.c         | 12 +++++++++++-
+ drivers/ssb/ssb_private.h   |  4 ++++
+ 10 files changed, 60 insertions(+), 10 deletions(-)
+
+--- a/drivers/bcma/Kconfig
++++ b/drivers/bcma/Kconfig
+@@ -18,6 +18,10 @@ config BCMA_BLOCKIO
+ 	bool
+ 	default y
+ 
++config BCMA_FALLBACK_SPROM
++	bool
++	default y
++
+ config BCMA_HOST_PCI_POSSIBLE
+ 	bool
+ 	depends on PCI = y
+--- a/drivers/bcma/Makefile
++++ b/drivers/bcma/Makefile
+@@ -11,6 +11,7 @@ bcma-$(CONFIG_BCMA_DRIVER_PCI_HOSTMODE)
+ bcma-$(CONFIG_BCMA_DRIVER_MIPS)		+= driver_mips.o
+ bcma-$(CONFIG_BCMA_DRIVER_GMAC_CMN)	+= driver_gmac_cmn.o
+ bcma-$(CONFIG_BCMA_DRIVER_GPIO)		+= driver_gpio.o
++bcma-$(CONFIG_BCMA_FALLBACK_SPROM)	+= fallback-sprom.o
+ bcma-$(CONFIG_BCMA_HOST_PCI)		+= host_pci.o
+ bcma-$(CONFIG_BCMA_HOST_SOC)		+= host_soc.o
+ obj-$(CONFIG_BCMA)			+= bcma.o
+--- a/drivers/bcma/bcma_private.h
++++ b/drivers/bcma/bcma_private.h
+@@ -38,6 +38,10 @@ int bcma_bus_resume(struct bcma_bus *bus
+ void bcma_detect_chip(struct bcma_bus *bus);
+ int bcma_bus_scan(struct bcma_bus *bus);
+ 
++/* fallback-sprom.c */
++int __init bcma_fbs_register(void);
++int bcma_get_fallback_sprom(struct bcma_bus *dev, struct ssb_sprom *out);
++
+ /* sprom.c */
+ int bcma_sprom_get(struct bcma_bus *bus);
+ 
+--- a/drivers/bcma/main.c
++++ b/drivers/bcma/main.c
+@@ -668,6 +668,14 @@ static int __init bcma_modinit(void)
+ {
+ 	int err;
+ 
++#ifdef CONFIG_BCMA_FALLBACK_SPROM
++	err = bcma_fbs_register();
++	if (err) {
++		pr_err("Fallback SPROM initialization failed\n");
++		err = 0;
++	}
++#endif /* CONFIG_BCMA_FALLBACK_SPROM */
++
+ 	err = bcma_init_bus_register();
+ 	if (err)
+ 		return err;
+--- a/drivers/bcma/sprom.c
++++ b/drivers/bcma/sprom.c
+@@ -51,21 +51,26 @@ static int bcma_fill_sprom_with_fallback
+ {
+ 	int err;
+ 
+-	if (!get_fallback_sprom) {
++	if (get_fallback_sprom)
++		err = get_fallback_sprom(bus, out);
++
++#ifdef CONFIG_BCMA_FALLBACK_SPROM
++	if (!get_fallback_sprom || err)
++		err = bcma_get_fallback_sprom(bus, out);
++#else
++	if (!get_fallback_sprom)
+ 		err = -ENOENT;
+-		goto fail;
+-	}
++#endif /* CONFIG_BCMA_FALLBACK_SPROM */
+ 
+-	err = get_fallback_sprom(bus, out);
+-	if (err)
+-		goto fail;
++	if (err) {
++		bcma_warn(bus, "Using fallback SPROM failed (err %d)\n", err);
++		return err;
++	}
+ 
+ 	bcma_debug(bus, "Using SPROM revision %d provided by platform.\n",
+ 		   bus->sprom.revision);
++
+ 	return 0;
+-fail:
+-	bcma_warn(bus, "Using fallback SPROM failed (err %d)\n", err);
+-	return err;
+ }
+ 
+ /**************************************************
+--- a/drivers/ssb/Kconfig
++++ b/drivers/ssb/Kconfig
+@@ -25,6 +25,11 @@ if SSB
+ config SSB_SPROM
+ 	bool
+ 
++config SSB_FALLBACK_SPROM
++	bool
++	depends on SSB_PCIHOST
++	default y
++
+ # Support for Block-I/O. SELECT this from the driver that needs it.
+ config SSB_BLOCKIO
+ 	bool
+--- a/drivers/ssb/Makefile
++++ b/drivers/ssb/Makefile
+@@ -2,6 +2,7 @@
+ # core
+ ssb-y					+= main.o scan.o
+ ssb-$(CONFIG_SSB_EMBEDDED)		+= embedded.o
++ssb-$(CONFIG_SSB_FALLBACK_SPROM)	+= fallback-sprom.o
+ ssb-$(CONFIG_SSB_SPROM)			+= sprom.o
+ 
+ # host support
+--- a/drivers/ssb/main.c
++++ b/drivers/ssb/main.c
+@@ -1287,6 +1287,14 @@ static int __init ssb_modinit(void)
+ {
+ 	int err;
+ 
++#ifdef CONFIG_SSB_FALLBACK_SPROM
++	err = ssb_fbs_register();
++	if (err) {
++		pr_err("Fallback SPROM initialization failed\n");
++		err = 0;
++	}
++#endif /* CONFIG_SSB_FALLBACK_SPROM */
++
+ 	/* See the comment at the ssb_is_early_boot definition */
+ 	ssb_is_early_boot = 0;
+ 	err = bus_register(&ssb_bustype);
+--- a/drivers/ssb/sprom.c
++++ b/drivers/ssb/sprom.c
+@@ -180,10 +180,20 @@ int ssb_arch_register_fallback_sprom(int
+ 
+ int ssb_fill_sprom_with_fallback(struct ssb_bus *bus, struct ssb_sprom *out)
+ {
++	int err;
++
++	if (get_fallback_sprom)
++		err = get_fallback_sprom(bus, out);
++
++#ifdef CONFIG_SSB_FALLBACK_SPROM
++	if (!get_fallback_sprom || err)
++		err = ssb_get_fallback_sprom(bus, out);
++#else
+ 	if (!get_fallback_sprom)
+ 		return -ENOENT;
++#endif /* CONFIG_SSB_FALLBACK_SPROM */
+ 
+-	return get_fallback_sprom(bus, out);
++	return err;
+ }
+ 
+ /* https://bcm-v4.sipsolutions.net/802.11/IsSpromAvailable */
+--- a/drivers/ssb/ssb_private.h
++++ b/drivers/ssb/ssb_private.h
+@@ -143,6 +143,10 @@ extern int ssb_bus_scan(struct ssb_bus *
+ extern void ssb_iounmap(struct ssb_bus *ssb);
+ 
+ 
++/* fallback-sprom.c */
++int __init ssb_fbs_register(void);
++int ssb_get_fallback_sprom(struct ssb_bus *dev, struct ssb_sprom *out);
++
+ /* sprom.c */
+ extern
+ ssize_t ssb_attr_sprom_show(struct ssb_bus *bus, char *buf,
diff --git a/target/linux/generic/hack-5.15/901-debloat_sock_diag.patch b/target/linux/generic/hack-5.15/901-debloat_sock_diag.patch
index ab629d598f9328..ac502bdd16d666 100644
--- a/target/linux/generic/hack-5.15/901-debloat_sock_diag.patch
+++ b/target/linux/generic/hack-5.15/901-debloat_sock_diag.patch
@@ -122,7 +122,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	u64 res;
 --- a/net/ipv4/Kconfig
 +++ b/net/ipv4/Kconfig
-@@ -414,6 +414,7 @@ config INET_TUNNEL
+@@ -424,6 +424,7 @@ config INET_TUNNEL
  
  config INET_DIAG
  	tristate "INET: socket monitoring interface"
diff --git a/target/linux/generic/hack-5.15/902-debloat_proc.patch b/target/linux/generic/hack-5.15/902-debloat_proc.patch
index c58370eff115e3..12e99280289159 100644
--- a/target/linux/generic/hack-5.15/902-debloat_proc.patch
+++ b/target/linux/generic/hack-5.15/902-debloat_proc.patch
@@ -29,7 +29,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/fs/locks.c
 +++ b/fs/locks.c
-@@ -2929,6 +2929,8 @@ static const struct seq_operations locks
+@@ -2953,6 +2953,8 @@ static const struct seq_operations locks
  
  static int __init proc_locks_init(void)
  {
@@ -235,7 +235,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!pe)
 --- a/mm/vmalloc.c
 +++ b/mm/vmalloc.c
-@@ -3962,6 +3962,8 @@ static const struct seq_operations vmall
+@@ -3964,6 +3964,8 @@ static const struct seq_operations vmall
  
  static int __init proc_vmalloc_init(void)
  {
@@ -330,7 +330,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/net/core/sock.c
 +++ b/net/core/sock.c
-@@ -3857,6 +3857,8 @@ static __net_initdata struct pernet_oper
+@@ -3866,6 +3866,8 @@ static __net_initdata struct pernet_oper
  
  static int __init proto_init(void)
  {
@@ -341,7 +341,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/net/ipv4/fib_trie.c
 +++ b/net/ipv4/fib_trie.c
-@@ -3022,11 +3022,13 @@ static const struct seq_operations fib_r
+@@ -3024,11 +3024,13 @@ static const struct seq_operations fib_r
  
  int __net_init fib_proc_init(struct net *net)
  {
@@ -357,7 +357,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			fib_triestat_seq_show, NULL))
  		goto out2;
  
-@@ -3037,17 +3039,21 @@ int __net_init fib_proc_init(struct net
+@@ -3039,17 +3041,21 @@ int __net_init fib_proc_init(struct net
  	return 0;
  
  out3:
diff --git a/target/linux/generic/hack-5.15/904-debloat_dma_buf.patch b/target/linux/generic/hack-5.15/904-debloat_dma_buf.patch
index 302c0007f2f8af..0291a5e9bd8c42 100644
--- a/target/linux/generic/hack-5.15/904-debloat_dma_buf.patch
+++ b/target/linux/generic/hack-5.15/904-debloat_dma_buf.patch
@@ -72,7 +72,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +MODULE_LICENSE("GPL");
 --- a/kernel/sched/core.c
 +++ b/kernel/sched/core.c
-@@ -4184,6 +4184,7 @@ int wake_up_state(struct task_struct *p,
+@@ -4216,6 +4216,7 @@ int wake_up_state(struct task_struct *p,
  {
  	return try_to_wake_up(p, state, 0);
  }
diff --git a/target/linux/generic/hack-6.1/204-module_strip.patch b/target/linux/generic/hack-6.1/204-module_strip.patch
new file mode 100644
index 00000000000000..f0949d32fddd19
--- /dev/null
+++ b/target/linux/generic/hack-6.1/204-module_strip.patch
@@ -0,0 +1,210 @@
+From a779a482fb9b9f8fcdf8b2519c789b4b9bb5dd05 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 7 Jul 2017 16:56:48 +0200
+Subject: build: add a hack for removing non-essential module info
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ include/linux/module.h      | 13 ++++++++-----
+ include/linux/moduleparam.h | 15 ++++++++++++---
+ init/Kconfig                |  7 +++++++
+ kernel/module.c             |  5 ++++-
+ scripts/mod/modpost.c       | 12 ++++++++++++
+ 5 files changed, 43 insertions(+), 9 deletions(-)
+
+--- a/include/linux/module.h
++++ b/include/linux/module.h
+@@ -163,6 +163,7 @@ extern void cleanup_module(void);
+ 
+ /* Generic info of form tag = "info" */
+ #define MODULE_INFO(tag, info) __MODULE_INFO(tag, tag, info)
++#define MODULE_INFO_STRIP(tag, info) __MODULE_INFO_STRIP(tag, tag, info)
+ 
+ /* For userspace: you can also call me... */
+ #define MODULE_ALIAS(_alias) MODULE_INFO(alias, _alias)
+@@ -232,12 +233,12 @@ extern void cleanup_module(void);
+  * Author(s), use "Name <email>" or just "Name", for multiple
+  * authors use multiple MODULE_AUTHOR() statements/lines.
+  */
+-#define MODULE_AUTHOR(_author) MODULE_INFO(author, _author)
++#define MODULE_AUTHOR(_author) MODULE_INFO_STRIP(author, _author)
+ 
+ /* What your module does. */
+-#define MODULE_DESCRIPTION(_description) MODULE_INFO(description, _description)
++#define MODULE_DESCRIPTION(_description) MODULE_INFO_STRIP(description, _description)
+ 
+-#ifdef MODULE
++#if defined(MODULE) && !defined(CONFIG_MODULE_STRIPPED)
+ /* Creates an alias so file2alias.c can find device table. */
+ #define MODULE_DEVICE_TABLE(type, name)					\
+ extern typeof(name) __mod_##type##__##name##_device_table		\
+@@ -264,7 +265,9 @@ extern typeof(name) __mod_##type##__##na
+  */
+ 
+ #if defined(MODULE) || !defined(CONFIG_SYSFS)
+-#define MODULE_VERSION(_version) MODULE_INFO(version, _version)
++#define MODULE_VERSION(_version) MODULE_INFO_STRIP(version, _version)
++#elif defined(CONFIG_MODULE_STRIPPED)
++#define MODULE_VERSION(_version) __MODULE_INFO_DISABLED(version)
+ #else
+ #define MODULE_VERSION(_version)					\
+ 	MODULE_INFO(version, _version);					\
+@@ -287,7 +290,7 @@ extern typeof(name) __mod_##type##__##na
+ /* Optional firmware file (or files) needed by the module
+  * format is simply firmware file name.  Multiple firmware
+  * files require multiple MODULE_FIRMWARE() specifiers */
+-#define MODULE_FIRMWARE(_firmware) MODULE_INFO(firmware, _firmware)
++#define MODULE_FIRMWARE(_firmware) MODULE_INFO_STRIP(firmware, _firmware)
+ 
+ #define MODULE_IMPORT_NS(ns)	MODULE_INFO(import_ns, __stringify(ns))
+ 
+--- a/include/linux/moduleparam.h
++++ b/include/linux/moduleparam.h
+@@ -20,6 +20,16 @@
+ /* Chosen so that structs with an unsigned long line up. */
+ #define MAX_PARAM_PREFIX_LEN (64 - sizeof(unsigned long))
+ 
++/* This struct is here for syntactic coherency, it is not used */
++#define __MODULE_INFO_DISABLED(name)					  \
++  struct __UNIQUE_ID(name) {}
++
++#ifdef CONFIG_MODULE_STRIPPED
++#define __MODULE_INFO_STRIP(tag, name, info) __MODULE_INFO_DISABLED(name)
++#else
++#define __MODULE_INFO_STRIP(tag, name, info) __MODULE_INFO(tag, name, info)
++#endif
++
+ #define __MODULE_INFO(tag, name, info)					  \
+ 	static const char __UNIQUE_ID(name)[]				  \
+ 		__used __section(".modinfo") __aligned(1)		  \
+@@ -31,7 +41,7 @@
+ /* One for each parameter, describing how to use it.  Some files do
+    multiple of these per line, so can't just use MODULE_INFO. */
+ #define MODULE_PARM_DESC(_parm, desc) \
+-	__MODULE_INFO(parm, _parm, #_parm ":" desc)
++	__MODULE_INFO_STRIP(parm, _parm, #_parm ":" desc)
+ 
+ struct kernel_param;
+ 
+--- a/kernel/module/Kconfig
++++ b/kernel/module/Kconfig
+@@ -290,4 +290,11 @@ config MODULES_TREE_LOOKUP
+ 	def_bool y
+ 	depends on PERF_EVENTS || TRACING || CFI_CLANG
+ 
++config MODULE_STRIPPED
++	bool "Reduce module size"
++	depends on MODULES
++	help
++	  Remove module parameter descriptions, author info, version, aliases,
++	  device tables, etc.
++
+ endif # MODULES
+--- a/kernel/module/main.c
++++ b/kernel/module/main.c
+@@ -988,6 +988,7 @@ size_t modinfo_attrs_count = ARRAY_SIZE(
+ 
+ static const char vermagic[] = VERMAGIC_STRING;
+ 
++#if defined(CONFIG_MODVERSIONS) || !defined(CONFIG_MODULE_STRIPPED)
+ int try_to_force_load(struct module *mod, const char *reason)
+ {
+ #ifdef CONFIG_MODULE_FORCE_LOAD
+@@ -999,6 +1000,7 @@ int try_to_force_load(struct module *mod
+ 	return -ENOEXEC;
+ #endif
+ }
++#endif
+ 
+ static char *get_modinfo(const struct load_info *info, const char *tag);
+ static char *get_next_modinfo(const struct load_info *info, const char *tag,
+@@ -1950,9 +1952,11 @@ static int setup_load_info(struct load_i
+ 
+ static int check_modinfo(struct module *mod, struct load_info *info, int flags)
+ {
+-	const char *modmagic = get_modinfo(info, "vermagic");
+ 	int err;
+ 
++#ifndef CONFIG_MODULE_STRIPPED
++	const char *modmagic = get_modinfo(info, "vermagic");
++
+ 	if (flags & MODULE_INIT_IGNORE_VERMAGIC)
+ 		modmagic = NULL;
+ 
+@@ -1973,6 +1977,7 @@ static int check_modinfo(struct module *
+ 				mod->name);
+ 		add_taint_module(mod, TAINT_OOT_MODULE, LOCKDEP_STILL_OK);
+ 	}
++#endif
+ 
+ 	check_modinfo_retpoline(mod, info);
+ 
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -1817,7 +1817,9 @@ static void read_symbols(const char *mod
+ 		symname = remove_dot(info.strtab + sym->st_name);
+ 
+ 		handle_symbol(mod, &info, sym, symname);
++#ifndef CONFIG_MODULE_STRIPPED
+ 		handle_moddevtable(mod, &info, sym, symname);
++#endif
+ 	}
+ 
+ 	for (sym = info.symtab_start; sym < info.symtab_stop; sym++) {
+@@ -1980,8 +1982,10 @@ static void add_header(struct buffer *b,
+ 	buf_printf(b, "BUILD_SALT;\n");
+ 	buf_printf(b, "BUILD_LTO_INFO;\n");
+ 	buf_printf(b, "\n");
++#ifndef CONFIG_MODULE_STRIPPED
+ 	buf_printf(b, "MODULE_INFO(vermagic, VERMAGIC_STRING);\n");
+ 	buf_printf(b, "MODULE_INFO(name, KBUILD_MODNAME);\n");
++#endif
+ 	buf_printf(b, "\n");
+ 	buf_printf(b, "__visible struct module __this_module\n");
+ 	buf_printf(b, "__section(\".gnu.linkonce.this_module\") = {\n");
+@@ -1995,8 +1999,10 @@ static void add_header(struct buffer *b,
+ 	buf_printf(b, "\t.arch = MODULE_ARCH_INIT,\n");
+ 	buf_printf(b, "};\n");
+ 
++#ifndef CONFIG_MODULE_STRIPPED
+ 	if (!external_module)
+ 		buf_printf(b, "\nMODULE_INFO(intree, \"Y\");\n");
++#endif
+ 
+ 	buf_printf(b,
+ 		   "\n"
+@@ -2004,8 +2010,10 @@ static void add_header(struct buffer *b,
+ 		   "MODULE_INFO(retpoline, \"Y\");\n"
+ 		   "#endif\n");
+ 
++#ifndef CONFIG_MODULE_STRIPPED
+ 	if (strstarts(mod->name, "drivers/staging"))
+ 		buf_printf(b, "\nMODULE_INFO(staging, \"Y\");\n");
++#endif
+ 
+ 	if (strstarts(mod->name, "tools/testing"))
+ 		buf_printf(b, "\nMODULE_INFO(test, \"Y\");\n");
+@@ -2101,11 +2109,13 @@ static void add_depends(struct buffer *b
+ 
+ static void add_srcversion(struct buffer *b, struct module *mod)
+ {
++#ifndef CONFIG_MODULE_STRIPPED
+ 	if (mod->srcversion[0]) {
+ 		buf_printf(b, "\n");
+ 		buf_printf(b, "MODULE_INFO(srcversion, \"%s\");\n",
+ 			   mod->srcversion);
+ 	}
++#endif
+ }
+ 
+ static void write_buf(struct buffer *b, const char *fname)
+@@ -2191,7 +2201,9 @@ static void write_mod_c_file(struct modu
+ 	add_exported_symbols(&buf, mod);
+ 	add_versions(&buf, mod);
+ 	add_depends(&buf, mod);
++#ifndef CONFIG_MODULE_STRIPPED
+ 	add_moddevtable(&buf, mod);
++#endif
+ 	add_srcversion(&buf, mod);
+ 
+ 	ret = snprintf(fname, sizeof(fname), "%s.mod.c", mod->name);
diff --git a/target/linux/generic/hack-6.1/205-kconfig-abort-configuration-on-unset-symbol.patch b/target/linux/generic/hack-6.1/205-kconfig-abort-configuration-on-unset-symbol.patch
new file mode 100644
index 00000000000000..df18507041f7be
--- /dev/null
+++ b/target/linux/generic/hack-6.1/205-kconfig-abort-configuration-on-unset-symbol.patch
@@ -0,0 +1,41 @@
+From 310e8e04a05d9eb43fa9dd7f00143300afcaa37a Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Fri, 11 Nov 2022 13:33:44 +0100
+Subject: [PATCH] kconfig: abort configuration on unset symbol
+
+When a target configuration has unset Kconfig symbols, the build will
+fail when OpenWrt is compiled with V=s and stdin is connected to a tty.
+
+In case OpenWrt is compiled without either of these preconditions, the
+build will succeed with the symbols in question being unset.
+
+Modify the kernel configuration in a way it fails on unset symbols
+regardless of the aforementioned preconditions.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ scripts/kconfig/conf.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/scripts/kconfig/conf.c
++++ b/scripts/kconfig/conf.c
+@@ -338,6 +338,9 @@ static int conf_askvalue(struct symbol *
+ 		}
+ 		/* fall through */
+ 	default:
++		if (!tty_stdio && getenv("FAIL_ON_UNCONFIGURED")) {
++			exit(1);
++		}
+ 		fflush(stdout);
+ 		xfgets(line, sizeof(line), stdin);
+ 		break;
+@@ -520,6 +523,9 @@ static int conf_choice(struct menu *menu
+ 			}
+ 			/* fall through */
+ 		case oldaskconfig:
++			if (!tty_stdio && getenv("FAIL_ON_UNCONFIGURED")) {
++				exit(1);
++			}
+ 			fflush(stdout);
+ 			xfgets(line, sizeof(line), stdin);
+ 			strip(line);
diff --git a/target/linux/generic/hack-6.1/210-darwin_scripts_include.patch b/target/linux/generic/hack-6.1/210-darwin_scripts_include.patch
new file mode 100644
index 00000000000000..c9612536dec6e5
--- /dev/null
+++ b/target/linux/generic/hack-6.1/210-darwin_scripts_include.patch
@@ -0,0 +1,3053 @@
+From db7c30dcd9a0391bf13b62c9f91e144d762ef43a Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Fri, 7 Jul 2017 17:00:49 +0200
+Subject: Add an OSX specific patch to make the kernel be compiled
+
+lede-commit: 3fc2a24f0422b2f55f9ed43f116db3111f700526
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ scripts/kconfig/Makefile   |    3 +
+ scripts/mod/elf.h          | 3007 ++++++++++++++++++++++++++++++++++++++++++++
+ scripts/mod/mk_elfconfig.c |    4 +
+ scripts/mod/modpost.h      |    4 +
+ 4 files changed, 3018 insertions(+)
+ create mode 100644 scripts/mod/elf.h
+
+--- /dev/null
++++ b/scripts/mod/elf.h
+@@ -0,0 +1,3007 @@
++/* This file defines standard ELF types, structures, and macros.
++   Copyright (C) 1995-2012 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <http://www.gnu.org/licenses/>.  */
++
++#ifndef _ELF_H
++#define	_ELF_H 1
++
++/* Standard ELF types.  */
++
++#include <stdint.h>
++
++/* Type for a 16-bit quantity.  */
++typedef uint16_t Elf32_Half;
++typedef uint16_t Elf64_Half;
++
++/* Types for signed and unsigned 32-bit quantities.  */
++typedef uint32_t Elf32_Word;
++typedef	int32_t  Elf32_Sword;
++typedef uint32_t Elf64_Word;
++typedef	int32_t  Elf64_Sword;
++
++/* Types for signed and unsigned 64-bit quantities.  */
++typedef uint64_t Elf32_Xword;
++typedef	int64_t  Elf32_Sxword;
++typedef uint64_t Elf64_Xword;
++typedef	int64_t  Elf64_Sxword;
++
++/* Type of addresses.  */
++typedef uint32_t Elf32_Addr;
++typedef uint64_t Elf64_Addr;
++
++/* Type of file offsets.  */
++typedef uint32_t Elf32_Off;
++typedef uint64_t Elf64_Off;
++
++/* Type for section indices, which are 16-bit quantities.  */
++typedef uint16_t Elf32_Section;
++typedef uint16_t Elf64_Section;
++
++/* Type for version symbol information.  */
++typedef Elf32_Half Elf32_Versym;
++typedef Elf64_Half Elf64_Versym;
++
++
++/* The ELF file header.  This appears at the start of every ELF file.  */
++
++#define EI_NIDENT (16)
++
++typedef struct
++{
++  unsigned char	e_ident[EI_NIDENT];	/* Magic number and other info */
++  Elf32_Half	e_type;			/* Object file type */
++  Elf32_Half	e_machine;		/* Architecture */
++  Elf32_Word	e_version;		/* Object file version */
++  Elf32_Addr	e_entry;		/* Entry point virtual address */
++  Elf32_Off	e_phoff;		/* Program header table file offset */
++  Elf32_Off	e_shoff;		/* Section header table file offset */
++  Elf32_Word	e_flags;		/* Processor-specific flags */
++  Elf32_Half	e_ehsize;		/* ELF header size in bytes */
++  Elf32_Half	e_phentsize;		/* Program header table entry size */
++  Elf32_Half	e_phnum;		/* Program header table entry count */
++  Elf32_Half	e_shentsize;		/* Section header table entry size */
++  Elf32_Half	e_shnum;		/* Section header table entry count */
++  Elf32_Half	e_shstrndx;		/* Section header string table index */
++} Elf32_Ehdr;
++
++typedef struct
++{
++  unsigned char	e_ident[EI_NIDENT];	/* Magic number and other info */
++  Elf64_Half	e_type;			/* Object file type */
++  Elf64_Half	e_machine;		/* Architecture */
++  Elf64_Word	e_version;		/* Object file version */
++  Elf64_Addr	e_entry;		/* Entry point virtual address */
++  Elf64_Off	e_phoff;		/* Program header table file offset */
++  Elf64_Off	e_shoff;		/* Section header table file offset */
++  Elf64_Word	e_flags;		/* Processor-specific flags */
++  Elf64_Half	e_ehsize;		/* ELF header size in bytes */
++  Elf64_Half	e_phentsize;		/* Program header table entry size */
++  Elf64_Half	e_phnum;		/* Program header table entry count */
++  Elf64_Half	e_shentsize;		/* Section header table entry size */
++  Elf64_Half	e_shnum;		/* Section header table entry count */
++  Elf64_Half	e_shstrndx;		/* Section header string table index */
++} Elf64_Ehdr;
++
++/* Fields in the e_ident array.  The EI_* macros are indices into the
++   array.  The macros under each EI_* macro are the values the byte
++   may have.  */
++
++#define EI_MAG0		0		/* File identification byte 0 index */
++#define ELFMAG0		0x7f		/* Magic number byte 0 */
++
++#define EI_MAG1		1		/* File identification byte 1 index */
++#define ELFMAG1		'E'		/* Magic number byte 1 */
++
++#define EI_MAG2		2		/* File identification byte 2 index */
++#define ELFMAG2		'L'		/* Magic number byte 2 */
++
++#define EI_MAG3		3		/* File identification byte 3 index */
++#define ELFMAG3		'F'		/* Magic number byte 3 */
++
++/* Conglomeration of the identification bytes, for easy testing as a word.  */
++#define	ELFMAG		"\177ELF"
++#define	SELFMAG		4
++
++#define EI_CLASS	4		/* File class byte index */
++#define ELFCLASSNONE	0		/* Invalid class */
++#define ELFCLASS32	1		/* 32-bit objects */
++#define ELFCLASS64	2		/* 64-bit objects */
++#define ELFCLASSNUM	3
++
++#define EI_DATA		5		/* Data encoding byte index */
++#define ELFDATANONE	0		/* Invalid data encoding */
++#define ELFDATA2LSB	1		/* 2's complement, little endian */
++#define ELFDATA2MSB	2		/* 2's complement, big endian */
++#define ELFDATANUM	3
++
++#define EI_VERSION	6		/* File version byte index */
++					/* Value must be EV_CURRENT */
++
++#define EI_OSABI	7		/* OS ABI identification */
++#define ELFOSABI_NONE		0	/* UNIX System V ABI */
++#define ELFOSABI_SYSV		0	/* Alias.  */
++#define ELFOSABI_HPUX		1	/* HP-UX */
++#define ELFOSABI_NETBSD		2	/* NetBSD.  */
++#define ELFOSABI_GNU		3	/* Object uses GNU ELF extensions.  */
++#define ELFOSABI_LINUX		ELFOSABI_GNU /* Compatibility alias.  */
++#define ELFOSABI_SOLARIS	6	/* Sun Solaris.  */
++#define ELFOSABI_AIX		7	/* IBM AIX.  */
++#define ELFOSABI_IRIX		8	/* SGI Irix.  */
++#define ELFOSABI_FREEBSD	9	/* FreeBSD.  */
++#define ELFOSABI_TRU64		10	/* Compaq TRU64 UNIX.  */
++#define ELFOSABI_MODESTO	11	/* Novell Modesto.  */
++#define ELFOSABI_OPENBSD	12	/* OpenBSD.  */
++#define ELFOSABI_ARM_AEABI	64	/* ARM EABI */
++#define ELFOSABI_ARM		97	/* ARM */
++#define ELFOSABI_STANDALONE	255	/* Standalone (embedded) application */
++
++#define EI_ABIVERSION	8		/* ABI version */
++
++#define EI_PAD		9		/* Byte index of padding bytes */
++
++/* Legal values for e_type (object file type).  */
++
++#define ET_NONE		0		/* No file type */
++#define ET_REL		1		/* Relocatable file */
++#define ET_EXEC		2		/* Executable file */
++#define ET_DYN		3		/* Shared object file */
++#define ET_CORE		4		/* Core file */
++#define	ET_NUM		5		/* Number of defined types */
++#define ET_LOOS		0xfe00		/* OS-specific range start */
++#define ET_HIOS		0xfeff		/* OS-specific range end */
++#define ET_LOPROC	0xff00		/* Processor-specific range start */
++#define ET_HIPROC	0xffff		/* Processor-specific range end */
++
++/* Legal values for e_machine (architecture).  */
++
++#define EM_NONE		 0		/* No machine */
++#define EM_M32		 1		/* AT&T WE 32100 */
++#define EM_SPARC	 2		/* SUN SPARC */
++#define EM_386		 3		/* Intel 80386 */
++#define EM_68K		 4		/* Motorola m68k family */
++#define EM_88K		 5		/* Motorola m88k family */
++#define EM_860		 7		/* Intel 80860 */
++#define EM_MIPS		 8		/* MIPS R3000 big-endian */
++#define EM_S370		 9		/* IBM System/370 */
++#define EM_MIPS_RS3_LE	10		/* MIPS R3000 little-endian */
++
++#define EM_PARISC	15		/* HPPA */
++#define EM_VPP500	17		/* Fujitsu VPP500 */
++#define EM_SPARC32PLUS	18		/* Sun's "v8plus" */
++#define EM_960		19		/* Intel 80960 */
++#define EM_PPC		20		/* PowerPC */
++#define EM_PPC64	21		/* PowerPC 64-bit */
++#define EM_S390		22		/* IBM S390 */
++
++#define EM_V800		36		/* NEC V800 series */
++#define EM_FR20		37		/* Fujitsu FR20 */
++#define EM_RH32		38		/* TRW RH-32 */
++#define EM_RCE		39		/* Motorola RCE */
++#define EM_ARM		40		/* ARM */
++#define EM_FAKE_ALPHA	41		/* Digital Alpha */
++#define EM_SH		42		/* Hitachi SH */
++#define EM_SPARCV9	43		/* SPARC v9 64-bit */
++#define EM_TRICORE	44		/* Siemens Tricore */
++#define EM_ARC		45		/* Argonaut RISC Core */
++#define EM_H8_300	46		/* Hitachi H8/300 */
++#define EM_H8_300H	47		/* Hitachi H8/300H */
++#define EM_H8S		48		/* Hitachi H8S */
++#define EM_H8_500	49		/* Hitachi H8/500 */
++#define EM_IA_64	50		/* Intel Merced */
++#define EM_MIPS_X	51		/* Stanford MIPS-X */
++#define EM_COLDFIRE	52		/* Motorola Coldfire */
++#define EM_68HC12	53		/* Motorola M68HC12 */
++#define EM_MMA		54		/* Fujitsu MMA Multimedia Accelerator*/
++#define EM_PCP		55		/* Siemens PCP */
++#define EM_NCPU		56		/* Sony nCPU embeeded RISC */
++#define EM_NDR1		57		/* Denso NDR1 microprocessor */
++#define EM_STARCORE	58		/* Motorola Start*Core processor */
++#define EM_ME16		59		/* Toyota ME16 processor */
++#define EM_ST100	60		/* STMicroelectronic ST100 processor */
++#define EM_TINYJ	61		/* Advanced Logic Corp. Tinyj emb.fam*/
++#define EM_X86_64	62		/* AMD x86-64 architecture */
++#define EM_PDSP		63		/* Sony DSP Processor */
++
++#define EM_FX66		66		/* Siemens FX66 microcontroller */
++#define EM_ST9PLUS	67		/* STMicroelectronics ST9+ 8/16 mc */
++#define EM_ST7		68		/* STmicroelectronics ST7 8 bit mc */
++#define EM_68HC16	69		/* Motorola MC68HC16 microcontroller */
++#define EM_68HC11	70		/* Motorola MC68HC11 microcontroller */
++#define EM_68HC08	71		/* Motorola MC68HC08 microcontroller */
++#define EM_68HC05	72		/* Motorola MC68HC05 microcontroller */
++#define EM_SVX		73		/* Silicon Graphics SVx */
++#define EM_ST19		74		/* STMicroelectronics ST19 8 bit mc */
++#define EM_VAX		75		/* Digital VAX */
++#define EM_CRIS		76		/* Axis Communications 32-bit embedded processor */
++#define EM_JAVELIN	77		/* Infineon Technologies 32-bit embedded processor */
++#define EM_FIREPATH	78		/* Element 14 64-bit DSP Processor */
++#define EM_ZSP		79		/* LSI Logic 16-bit DSP Processor */
++#define EM_MMIX		80		/* Donald Knuth's educational 64-bit processor */
++#define EM_HUANY	81		/* Harvard University machine-independent object files */
++#define EM_PRISM	82		/* SiTera Prism */
++#define EM_AVR		83		/* Atmel AVR 8-bit microcontroller */
++#define EM_FR30		84		/* Fujitsu FR30 */
++#define EM_D10V		85		/* Mitsubishi D10V */
++#define EM_D30V		86		/* Mitsubishi D30V */
++#define EM_V850		87		/* NEC v850 */
++#define EM_M32R		88		/* Mitsubishi M32R */
++#define EM_MN10300	89		/* Matsushita MN10300 */
++#define EM_MN10200	90		/* Matsushita MN10200 */
++#define EM_PJ		91		/* picoJava */
++#define EM_OPENRISC	92		/* OpenRISC 32-bit embedded processor */
++#define EM_ARC_A5	93		/* ARC Cores Tangent-A5 */
++#define EM_XTENSA	94		/* Tensilica Xtensa Architecture */
++#define EM_TILEPRO	188		/* Tilera TILEPro */
++#define EM_TILEGX	191		/* Tilera TILE-Gx */
++#define EM_NUM		192
++
++/* If it is necessary to assign new unofficial EM_* values, please
++   pick large random numbers (0x8523, 0xa7f2, etc.) to minimize the
++   chances of collision with official or non-GNU unofficial values.  */
++
++#define EM_ALPHA	0x9026
++
++/* Legal values for e_version (version).  */
++
++#define EV_NONE		0		/* Invalid ELF version */
++#define EV_CURRENT	1		/* Current version */
++#define EV_NUM		2
++
++/* Section header.  */
++
++typedef struct
++{
++  Elf32_Word	sh_name;		/* Section name (string tbl index) */
++  Elf32_Word	sh_type;		/* Section type */
++  Elf32_Word	sh_flags;		/* Section flags */
++  Elf32_Addr	sh_addr;		/* Section virtual addr at execution */
++  Elf32_Off	sh_offset;		/* Section file offset */
++  Elf32_Word	sh_size;		/* Section size in bytes */
++  Elf32_Word	sh_link;		/* Link to another section */
++  Elf32_Word	sh_info;		/* Additional section information */
++  Elf32_Word	sh_addralign;		/* Section alignment */
++  Elf32_Word	sh_entsize;		/* Entry size if section holds table */
++} Elf32_Shdr;
++
++typedef struct
++{
++  Elf64_Word	sh_name;		/* Section name (string tbl index) */
++  Elf64_Word	sh_type;		/* Section type */
++  Elf64_Xword	sh_flags;		/* Section flags */
++  Elf64_Addr	sh_addr;		/* Section virtual addr at execution */
++  Elf64_Off	sh_offset;		/* Section file offset */
++  Elf64_Xword	sh_size;		/* Section size in bytes */
++  Elf64_Word	sh_link;		/* Link to another section */
++  Elf64_Word	sh_info;		/* Additional section information */
++  Elf64_Xword	sh_addralign;		/* Section alignment */
++  Elf64_Xword	sh_entsize;		/* Entry size if section holds table */
++} Elf64_Shdr;
++
++/* Special section indices.  */
++
++#define SHN_UNDEF	0		/* Undefined section */
++#define SHN_LORESERVE	0xff00		/* Start of reserved indices */
++#define SHN_LOPROC	0xff00		/* Start of processor-specific */
++#define SHN_BEFORE	0xff00		/* Order section before all others
++					   (Solaris).  */
++#define SHN_AFTER	0xff01		/* Order section after all others
++					   (Solaris).  */
++#define SHN_HIPROC	0xff1f		/* End of processor-specific */
++#define SHN_LOOS	0xff20		/* Start of OS-specific */
++#define SHN_HIOS	0xff3f		/* End of OS-specific */
++#define SHN_ABS		0xfff1		/* Associated symbol is absolute */
++#define SHN_COMMON	0xfff2		/* Associated symbol is common */
++#define SHN_XINDEX	0xffff		/* Index is in extra table.  */
++#define SHN_HIRESERVE	0xffff		/* End of reserved indices */
++
++/* Legal values for sh_type (section type).  */
++
++#define SHT_NULL	  0		/* Section header table entry unused */
++#define SHT_PROGBITS	  1		/* Program data */
++#define SHT_SYMTAB	  2		/* Symbol table */
++#define SHT_STRTAB	  3		/* String table */
++#define SHT_RELA	  4		/* Relocation entries with addends */
++#define SHT_HASH	  5		/* Symbol hash table */
++#define SHT_DYNAMIC	  6		/* Dynamic linking information */
++#define SHT_NOTE	  7		/* Notes */
++#define SHT_NOBITS	  8		/* Program space with no data (bss) */
++#define SHT_REL		  9		/* Relocation entries, no addends */
++#define SHT_SHLIB	  10		/* Reserved */
++#define SHT_DYNSYM	  11		/* Dynamic linker symbol table */
++#define SHT_INIT_ARRAY	  14		/* Array of constructors */
++#define SHT_FINI_ARRAY	  15		/* Array of destructors */
++#define SHT_PREINIT_ARRAY 16		/* Array of pre-constructors */
++#define SHT_GROUP	  17		/* Section group */
++#define SHT_SYMTAB_SHNDX  18		/* Extended section indeces */
++#define	SHT_NUM		  19		/* Number of defined types.  */
++#define SHT_LOOS	  0x60000000	/* Start OS-specific.  */
++#define SHT_GNU_ATTRIBUTES 0x6ffffff5	/* Object attributes.  */
++#define SHT_GNU_HASH	  0x6ffffff6	/* GNU-style hash table.  */
++#define SHT_GNU_LIBLIST	  0x6ffffff7	/* Prelink library list */
++#define SHT_CHECKSUM	  0x6ffffff8	/* Checksum for DSO content.  */
++#define SHT_LOSUNW	  0x6ffffffa	/* Sun-specific low bound.  */
++#define SHT_SUNW_move	  0x6ffffffa
++#define SHT_SUNW_COMDAT   0x6ffffffb
++#define SHT_SUNW_syminfo  0x6ffffffc
++#define SHT_GNU_verdef	  0x6ffffffd	/* Version definition section.  */
++#define SHT_GNU_verneed	  0x6ffffffe	/* Version needs section.  */
++#define SHT_GNU_versym	  0x6fffffff	/* Version symbol table.  */
++#define SHT_HISUNW	  0x6fffffff	/* Sun-specific high bound.  */
++#define SHT_HIOS	  0x6fffffff	/* End OS-specific type */
++#define SHT_LOPROC	  0x70000000	/* Start of processor-specific */
++#define SHT_HIPROC	  0x7fffffff	/* End of processor-specific */
++#define SHT_LOUSER	  0x80000000	/* Start of application-specific */
++#define SHT_HIUSER	  0x8fffffff	/* End of application-specific */
++
++/* Legal values for sh_flags (section flags).  */
++
++#define SHF_WRITE	     (1 << 0)	/* Writable */
++#define SHF_ALLOC	     (1 << 1)	/* Occupies memory during execution */
++#define SHF_EXECINSTR	     (1 << 2)	/* Executable */
++#define SHF_MERGE	     (1 << 4)	/* Might be merged */
++#define SHF_STRINGS	     (1 << 5)	/* Contains nul-terminated strings */
++#define SHF_INFO_LINK	     (1 << 6)	/* `sh_info' contains SHT index */
++#define SHF_LINK_ORDER	     (1 << 7)	/* Preserve order after combining */
++#define SHF_OS_NONCONFORMING (1 << 8)	/* Non-standard OS specific handling
++					   required */
++#define SHF_GROUP	     (1 << 9)	/* Section is member of a group.  */
++#define SHF_TLS		     (1 << 10)	/* Section hold thread-local data.  */
++#define SHF_MASKOS	     0x0ff00000	/* OS-specific.  */
++#define SHF_MASKPROC	     0xf0000000	/* Processor-specific */
++#define SHF_ORDERED	     (1 << 30)	/* Special ordering requirement
++					   (Solaris).  */
++#define SHF_EXCLUDE	     (1 << 31)	/* Section is excluded unless
++					   referenced or allocated (Solaris).*/
++
++/* Section group handling.  */
++#define GRP_COMDAT	0x1		/* Mark group as COMDAT.  */
++
++/* Symbol table entry.  */
++
++typedef struct
++{
++  Elf32_Word	st_name;		/* Symbol name (string tbl index) */
++  Elf32_Addr	st_value;		/* Symbol value */
++  Elf32_Word	st_size;		/* Symbol size */
++  unsigned char	st_info;		/* Symbol type and binding */
++  unsigned char	st_other;		/* Symbol visibility */
++  Elf32_Section	st_shndx;		/* Section index */
++} Elf32_Sym;
++
++typedef struct
++{
++  Elf64_Word	st_name;		/* Symbol name (string tbl index) */
++  unsigned char	st_info;		/* Symbol type and binding */
++  unsigned char st_other;		/* Symbol visibility */
++  Elf64_Section	st_shndx;		/* Section index */
++  Elf64_Addr	st_value;		/* Symbol value */
++  Elf64_Xword	st_size;		/* Symbol size */
++} Elf64_Sym;
++
++/* The syminfo section if available contains additional information about
++   every dynamic symbol.  */
++
++typedef struct
++{
++  Elf32_Half si_boundto;		/* Direct bindings, symbol bound to */
++  Elf32_Half si_flags;			/* Per symbol flags */
++} Elf32_Syminfo;
++
++typedef struct
++{
++  Elf64_Half si_boundto;		/* Direct bindings, symbol bound to */
++  Elf64_Half si_flags;			/* Per symbol flags */
++} Elf64_Syminfo;
++
++/* Possible values for si_boundto.  */
++#define SYMINFO_BT_SELF		0xffff	/* Symbol bound to self */
++#define SYMINFO_BT_PARENT	0xfffe	/* Symbol bound to parent */
++#define SYMINFO_BT_LOWRESERVE	0xff00	/* Beginning of reserved entries */
++
++/* Possible bitmasks for si_flags.  */
++#define SYMINFO_FLG_DIRECT	0x0001	/* Direct bound symbol */
++#define SYMINFO_FLG_PASSTHRU	0x0002	/* Pass-thru symbol for translator */
++#define SYMINFO_FLG_COPY	0x0004	/* Symbol is a copy-reloc */
++#define SYMINFO_FLG_LAZYLOAD	0x0008	/* Symbol bound to object to be lazy
++					   loaded */
++/* Syminfo version values.  */
++#define SYMINFO_NONE		0
++#define SYMINFO_CURRENT		1
++#define SYMINFO_NUM		2
++
++
++/* How to extract and insert information held in the st_info field.  */
++
++#define ELF32_ST_BIND(val)		(((unsigned char) (val)) >> 4)
++#define ELF32_ST_TYPE(val)		((val) & 0xf)
++#define ELF32_ST_INFO(bind, type)	(((bind) << 4) + ((type) & 0xf))
++
++/* Both Elf32_Sym and Elf64_Sym use the same one-byte st_info field.  */
++#define ELF64_ST_BIND(val)		ELF32_ST_BIND (val)
++#define ELF64_ST_TYPE(val)		ELF32_ST_TYPE (val)
++#define ELF64_ST_INFO(bind, type)	ELF32_ST_INFO ((bind), (type))
++
++/* Legal values for ST_BIND subfield of st_info (symbol binding).  */
++
++#define STB_LOCAL	0		/* Local symbol */
++#define STB_GLOBAL	1		/* Global symbol */
++#define STB_WEAK	2		/* Weak symbol */
++#define	STB_NUM		3		/* Number of defined types.  */
++#define STB_LOOS	10		/* Start of OS-specific */
++#define STB_GNU_UNIQUE	10		/* Unique symbol.  */
++#define STB_HIOS	12		/* End of OS-specific */
++#define STB_LOPROC	13		/* Start of processor-specific */
++#define STB_HIPROC	15		/* End of processor-specific */
++
++/* Legal values for ST_TYPE subfield of st_info (symbol type).  */
++
++#define STT_NOTYPE	0		/* Symbol type is unspecified */
++#define STT_OBJECT	1		/* Symbol is a data object */
++#define STT_FUNC	2		/* Symbol is a code object */
++#define STT_SECTION	3		/* Symbol associated with a section */
++#define STT_FILE	4		/* Symbol's name is file name */
++#define STT_COMMON	5		/* Symbol is a common data object */
++#define STT_TLS		6		/* Symbol is thread-local data object*/
++#define	STT_NUM		7		/* Number of defined types.  */
++#define STT_LOOS	10		/* Start of OS-specific */
++#define STT_GNU_IFUNC	10		/* Symbol is indirect code object */
++#define STT_HIOS	12		/* End of OS-specific */
++#define STT_LOPROC	13		/* Start of processor-specific */
++#define STT_HIPROC	15		/* End of processor-specific */
++
++
++/* Symbol table indices are found in the hash buckets and chain table
++   of a symbol hash table section.  This special index value indicates
++   the end of a chain, meaning no further symbols are found in that bucket.  */
++
++#define STN_UNDEF	0		/* End of a chain.  */
++
++
++/* How to extract and insert information held in the st_other field.  */
++
++#define ELF32_ST_VISIBILITY(o)	((o) & 0x03)
++
++/* For ELF64 the definitions are the same.  */
++#define ELF64_ST_VISIBILITY(o)	ELF32_ST_VISIBILITY (o)
++
++/* Symbol visibility specification encoded in the st_other field.  */
++#define STV_DEFAULT	0		/* Default symbol visibility rules */
++#define STV_INTERNAL	1		/* Processor specific hidden class */
++#define STV_HIDDEN	2		/* Sym unavailable in other modules */
++#define STV_PROTECTED	3		/* Not preemptible, not exported */
++
++
++/* Relocation table entry without addend (in section of type SHT_REL).  */
++
++typedef struct
++{
++  Elf32_Addr	r_offset;		/* Address */
++  Elf32_Word	r_info;			/* Relocation type and symbol index */
++} Elf32_Rel;
++
++/* I have seen two different definitions of the Elf64_Rel and
++   Elf64_Rela structures, so we'll leave them out until Novell (or
++   whoever) gets their act together.  */
++/* The following, at least, is used on Sparc v9, MIPS, and Alpha.  */
++
++typedef struct
++{
++  Elf64_Addr	r_offset;		/* Address */
++  Elf64_Xword	r_info;			/* Relocation type and symbol index */
++} Elf64_Rel;
++
++/* Relocation table entry with addend (in section of type SHT_RELA).  */
++
++typedef struct
++{
++  Elf32_Addr	r_offset;		/* Address */
++  Elf32_Word	r_info;			/* Relocation type and symbol index */
++  Elf32_Sword	r_addend;		/* Addend */
++} Elf32_Rela;
++
++typedef struct
++{
++  Elf64_Addr	r_offset;		/* Address */
++  Elf64_Xword	r_info;			/* Relocation type and symbol index */
++  Elf64_Sxword	r_addend;		/* Addend */
++} Elf64_Rela;
++
++/* How to extract and insert information held in the r_info field.  */
++
++#define ELF32_R_SYM(val)		((val) >> 8)
++#define ELF32_R_TYPE(val)		((val) & 0xff)
++#define ELF32_R_INFO(sym, type)		(((sym) << 8) + ((type) & 0xff))
++
++#define ELF64_R_SYM(i)			((i) >> 32)
++#define ELF64_R_TYPE(i)			((i) & 0xffffffff)
++#define ELF64_R_INFO(sym,type)		((((Elf64_Xword) (sym)) << 32) + (type))
++
++/* Program segment header.  */
++
++typedef struct
++{
++  Elf32_Word	p_type;			/* Segment type */
++  Elf32_Off	p_offset;		/* Segment file offset */
++  Elf32_Addr	p_vaddr;		/* Segment virtual address */
++  Elf32_Addr	p_paddr;		/* Segment physical address */
++  Elf32_Word	p_filesz;		/* Segment size in file */
++  Elf32_Word	p_memsz;		/* Segment size in memory */
++  Elf32_Word	p_flags;		/* Segment flags */
++  Elf32_Word	p_align;		/* Segment alignment */
++} Elf32_Phdr;
++
++typedef struct
++{
++  Elf64_Word	p_type;			/* Segment type */
++  Elf64_Word	p_flags;		/* Segment flags */
++  Elf64_Off	p_offset;		/* Segment file offset */
++  Elf64_Addr	p_vaddr;		/* Segment virtual address */
++  Elf64_Addr	p_paddr;		/* Segment physical address */
++  Elf64_Xword	p_filesz;		/* Segment size in file */
++  Elf64_Xword	p_memsz;		/* Segment size in memory */
++  Elf64_Xword	p_align;		/* Segment alignment */
++} Elf64_Phdr;
++
++/* Special value for e_phnum.  This indicates that the real number of
++   program headers is too large to fit into e_phnum.  Instead the real
++   value is in the field sh_info of section 0.  */
++
++#define PN_XNUM		0xffff
++
++/* Legal values for p_type (segment type).  */
++
++#define	PT_NULL		0		/* Program header table entry unused */
++#define PT_LOAD		1		/* Loadable program segment */
++#define PT_DYNAMIC	2		/* Dynamic linking information */
++#define PT_INTERP	3		/* Program interpreter */
++#define PT_NOTE		4		/* Auxiliary information */
++#define PT_SHLIB	5		/* Reserved */
++#define PT_PHDR		6		/* Entry for header table itself */
++#define PT_TLS		7		/* Thread-local storage segment */
++#define	PT_NUM		8		/* Number of defined types */
++#define PT_LOOS		0x60000000	/* Start of OS-specific */
++#define PT_GNU_EH_FRAME	0x6474e550	/* GCC .eh_frame_hdr segment */
++#define PT_GNU_STACK	0x6474e551	/* Indicates stack executability */
++#define PT_GNU_RELRO	0x6474e552	/* Read-only after relocation */
++#define PT_LOSUNW	0x6ffffffa
++#define PT_SUNWBSS	0x6ffffffa	/* Sun Specific segment */
++#define PT_SUNWSTACK	0x6ffffffb	/* Stack segment */
++#define PT_HISUNW	0x6fffffff
++#define PT_HIOS		0x6fffffff	/* End of OS-specific */
++#define PT_LOPROC	0x70000000	/* Start of processor-specific */
++#define PT_HIPROC	0x7fffffff	/* End of processor-specific */
++
++/* Legal values for p_flags (segment flags).  */
++
++#define PF_X		(1 << 0)	/* Segment is executable */
++#define PF_W		(1 << 1)	/* Segment is writable */
++#define PF_R		(1 << 2)	/* Segment is readable */
++#define PF_MASKOS	0x0ff00000	/* OS-specific */
++#define PF_MASKPROC	0xf0000000	/* Processor-specific */
++
++/* Legal values for note segment descriptor types for core files. */
++
++#define NT_PRSTATUS	1		/* Contains copy of prstatus struct */
++#define NT_FPREGSET	2		/* Contains copy of fpregset struct */
++#define NT_PRPSINFO	3		/* Contains copy of prpsinfo struct */
++#define NT_PRXREG	4		/* Contains copy of prxregset struct */
++#define NT_TASKSTRUCT	4		/* Contains copy of task structure */
++#define NT_PLATFORM	5		/* String from sysinfo(SI_PLATFORM) */
++#define NT_AUXV		6		/* Contains copy of auxv array */
++#define NT_GWINDOWS	7		/* Contains copy of gwindows struct */
++#define NT_ASRS		8		/* Contains copy of asrset struct */
++#define NT_PSTATUS	10		/* Contains copy of pstatus struct */
++#define NT_PSINFO	13		/* Contains copy of psinfo struct */
++#define NT_PRCRED	14		/* Contains copy of prcred struct */
++#define NT_UTSNAME	15		/* Contains copy of utsname struct */
++#define NT_LWPSTATUS	16		/* Contains copy of lwpstatus struct */
++#define NT_LWPSINFO	17		/* Contains copy of lwpinfo struct */
++#define NT_PRFPXREG	20		/* Contains copy of fprxregset struct */
++#define NT_PRXFPREG	0x46e62b7f	/* Contains copy of user_fxsr_struct */
++#define NT_PPC_VMX	0x100		/* PowerPC Altivec/VMX registers */
++#define NT_PPC_SPE	0x101		/* PowerPC SPE/EVR registers */
++#define NT_PPC_VSX	0x102		/* PowerPC VSX registers */
++#define NT_386_TLS	0x200		/* i386 TLS slots (struct user_desc) */
++#define NT_386_IOPERM	0x201		/* x86 io permission bitmap (1=deny) */
++#define NT_X86_XSTATE	0x202		/* x86 extended state using xsave */
++
++/* Legal values for the note segment descriptor types for object files.  */
++
++#define NT_VERSION	1		/* Contains a version string.  */
++
++
++/* Dynamic section entry.  */
++
++typedef struct
++{
++  Elf32_Sword	d_tag;			/* Dynamic entry type */
++  union
++    {
++      Elf32_Word d_val;			/* Integer value */
++      Elf32_Addr d_ptr;			/* Address value */
++    } d_un;
++} Elf32_Dyn;
++
++typedef struct
++{
++  Elf64_Sxword	d_tag;			/* Dynamic entry type */
++  union
++    {
++      Elf64_Xword d_val;		/* Integer value */
++      Elf64_Addr d_ptr;			/* Address value */
++    } d_un;
++} Elf64_Dyn;
++
++/* Legal values for d_tag (dynamic entry type).  */
++
++#define DT_NULL		0		/* Marks end of dynamic section */
++#define DT_NEEDED	1		/* Name of needed library */
++#define DT_PLTRELSZ	2		/* Size in bytes of PLT relocs */
++#define DT_PLTGOT	3		/* Processor defined value */
++#define DT_HASH		4		/* Address of symbol hash table */
++#define DT_STRTAB	5		/* Address of string table */
++#define DT_SYMTAB	6		/* Address of symbol table */
++#define DT_RELA		7		/* Address of Rela relocs */
++#define DT_RELASZ	8		/* Total size of Rela relocs */
++#define DT_RELAENT	9		/* Size of one Rela reloc */
++#define DT_STRSZ	10		/* Size of string table */
++#define DT_SYMENT	11		/* Size of one symbol table entry */
++#define DT_INIT		12		/* Address of init function */
++#define DT_FINI		13		/* Address of termination function */
++#define DT_SONAME	14		/* Name of shared object */
++#define DT_RPATH	15		/* Library search path (deprecated) */
++#define DT_SYMBOLIC	16		/* Start symbol search here */
++#define DT_REL		17		/* Address of Rel relocs */
++#define DT_RELSZ	18		/* Total size of Rel relocs */
++#define DT_RELENT	19		/* Size of one Rel reloc */
++#define DT_PLTREL	20		/* Type of reloc in PLT */
++#define DT_DEBUG	21		/* For debugging; unspecified */
++#define DT_TEXTREL	22		/* Reloc might modify .text */
++#define DT_JMPREL	23		/* Address of PLT relocs */
++#define	DT_BIND_NOW	24		/* Process relocations of object */
++#define	DT_INIT_ARRAY	25		/* Array with addresses of init fct */
++#define	DT_FINI_ARRAY	26		/* Array with addresses of fini fct */
++#define	DT_INIT_ARRAYSZ	27		/* Size in bytes of DT_INIT_ARRAY */
++#define	DT_FINI_ARRAYSZ	28		/* Size in bytes of DT_FINI_ARRAY */
++#define DT_RUNPATH	29		/* Library search path */
++#define DT_FLAGS	30		/* Flags for the object being loaded */
++#define DT_ENCODING	32		/* Start of encoded range */
++#define DT_PREINIT_ARRAY 32		/* Array with addresses of preinit fct*/
++#define DT_PREINIT_ARRAYSZ 33		/* size in bytes of DT_PREINIT_ARRAY */
++#define	DT_NUM		34		/* Number used */
++#define DT_LOOS		0x6000000d	/* Start of OS-specific */
++#define DT_HIOS		0x6ffff000	/* End of OS-specific */
++#define DT_LOPROC	0x70000000	/* Start of processor-specific */
++#define DT_HIPROC	0x7fffffff	/* End of processor-specific */
++#define	DT_PROCNUM	DT_MIPS_NUM	/* Most used by any processor */
++
++/* DT_* entries which fall between DT_VALRNGHI & DT_VALRNGLO use the
++   Dyn.d_un.d_val field of the Elf*_Dyn structure.  This follows Sun's
++   approach.  */
++#define DT_VALRNGLO	0x6ffffd00
++#define DT_GNU_PRELINKED 0x6ffffdf5	/* Prelinking timestamp */
++#define DT_GNU_CONFLICTSZ 0x6ffffdf6	/* Size of conflict section */
++#define DT_GNU_LIBLISTSZ 0x6ffffdf7	/* Size of library list */
++#define DT_CHECKSUM	0x6ffffdf8
++#define DT_PLTPADSZ	0x6ffffdf9
++#define DT_MOVEENT	0x6ffffdfa
++#define DT_MOVESZ	0x6ffffdfb
++#define DT_FEATURE_1	0x6ffffdfc	/* Feature selection (DTF_*).  */
++#define DT_POSFLAG_1	0x6ffffdfd	/* Flags for DT_* entries, effecting
++					   the following DT_* entry.  */
++#define DT_SYMINSZ	0x6ffffdfe	/* Size of syminfo table (in bytes) */
++#define DT_SYMINENT	0x6ffffdff	/* Entry size of syminfo */
++#define DT_VALRNGHI	0x6ffffdff
++#define DT_VALTAGIDX(tag)	(DT_VALRNGHI - (tag))	/* Reverse order! */
++#define DT_VALNUM 12
++
++/* DT_* entries which fall between DT_ADDRRNGHI & DT_ADDRRNGLO use the
++   Dyn.d_un.d_ptr field of the Elf*_Dyn structure.
++
++   If any adjustment is made to the ELF object after it has been
++   built these entries will need to be adjusted.  */
++#define DT_ADDRRNGLO	0x6ffffe00
++#define DT_GNU_HASH	0x6ffffef5	/* GNU-style hash table.  */
++#define DT_TLSDESC_PLT	0x6ffffef6
++#define DT_TLSDESC_GOT	0x6ffffef7
++#define DT_GNU_CONFLICT	0x6ffffef8	/* Start of conflict section */
++#define DT_GNU_LIBLIST	0x6ffffef9	/* Library list */
++#define DT_CONFIG	0x6ffffefa	/* Configuration information.  */
++#define DT_DEPAUDIT	0x6ffffefb	/* Dependency auditing.  */
++#define DT_AUDIT	0x6ffffefc	/* Object auditing.  */
++#define	DT_PLTPAD	0x6ffffefd	/* PLT padding.  */
++#define	DT_MOVETAB	0x6ffffefe	/* Move table.  */
++#define DT_SYMINFO	0x6ffffeff	/* Syminfo table.  */
++#define DT_ADDRRNGHI	0x6ffffeff
++#define DT_ADDRTAGIDX(tag)	(DT_ADDRRNGHI - (tag))	/* Reverse order! */
++#define DT_ADDRNUM 11
++
++/* The versioning entry types.  The next are defined as part of the
++   GNU extension.  */
++#define DT_VERSYM	0x6ffffff0
++
++#define DT_RELACOUNT	0x6ffffff9
++#define DT_RELCOUNT	0x6ffffffa
++
++/* These were chosen by Sun.  */
++#define DT_FLAGS_1	0x6ffffffb	/* State flags, see DF_1_* below.  */
++#define	DT_VERDEF	0x6ffffffc	/* Address of version definition
++					   table */
++#define	DT_VERDEFNUM	0x6ffffffd	/* Number of version definitions */
++#define	DT_VERNEED	0x6ffffffe	/* Address of table with needed
++					   versions */
++#define	DT_VERNEEDNUM	0x6fffffff	/* Number of needed versions */
++#define DT_VERSIONTAGIDX(tag)	(DT_VERNEEDNUM - (tag))	/* Reverse order! */
++#define DT_VERSIONTAGNUM 16
++
++/* Sun added these machine-independent extensions in the "processor-specific"
++   range.  Be compatible.  */
++#define DT_AUXILIARY    0x7ffffffd      /* Shared object to load before self */
++#define DT_FILTER       0x7fffffff      /* Shared object to get values from */
++#define DT_EXTRATAGIDX(tag)	((Elf32_Word)-((Elf32_Sword) (tag) <<1>>1)-1)
++#define DT_EXTRANUM	3
++
++/* Values of `d_un.d_val' in the DT_FLAGS entry.  */
++#define DF_ORIGIN	0x00000001	/* Object may use DF_ORIGIN */
++#define DF_SYMBOLIC	0x00000002	/* Symbol resolutions starts here */
++#define DF_TEXTREL	0x00000004	/* Object contains text relocations */
++#define DF_BIND_NOW	0x00000008	/* No lazy binding for this object */
++#define DF_STATIC_TLS	0x00000010	/* Module uses the static TLS model */
++
++/* State flags selectable in the `d_un.d_val' element of the DT_FLAGS_1
++   entry in the dynamic section.  */
++#define DF_1_NOW	0x00000001	/* Set RTLD_NOW for this object.  */
++#define DF_1_GLOBAL	0x00000002	/* Set RTLD_GLOBAL for this object.  */
++#define DF_1_GROUP	0x00000004	/* Set RTLD_GROUP for this object.  */
++#define DF_1_NODELETE	0x00000008	/* Set RTLD_NODELETE for this object.*/
++#define DF_1_LOADFLTR	0x00000010	/* Trigger filtee loading at runtime.*/
++#define DF_1_INITFIRST	0x00000020	/* Set RTLD_INITFIRST for this object*/
++#define DF_1_NOOPEN	0x00000040	/* Set RTLD_NOOPEN for this object.  */
++#define DF_1_ORIGIN	0x00000080	/* $ORIGIN must be handled.  */
++#define DF_1_DIRECT	0x00000100	/* Direct binding enabled.  */
++#define DF_1_TRANS	0x00000200
++#define DF_1_INTERPOSE	0x00000400	/* Object is used to interpose.  */
++#define DF_1_NODEFLIB	0x00000800	/* Ignore default lib search path.  */
++#define DF_1_NODUMP	0x00001000	/* Object can't be dldump'ed.  */
++#define DF_1_CONFALT	0x00002000	/* Configuration alternative created.*/
++#define DF_1_ENDFILTEE	0x00004000	/* Filtee terminates filters search. */
++#define	DF_1_DISPRELDNE	0x00008000	/* Disp reloc applied at build time. */
++#define	DF_1_DISPRELPND	0x00010000	/* Disp reloc applied at run-time.  */
++
++/* Flags for the feature selection in DT_FEATURE_1.  */
++#define DTF_1_PARINIT	0x00000001
++#define DTF_1_CONFEXP	0x00000002
++
++/* Flags in the DT_POSFLAG_1 entry effecting only the next DT_* entry.  */
++#define DF_P1_LAZYLOAD	0x00000001	/* Lazyload following object.  */
++#define DF_P1_GROUPPERM	0x00000002	/* Symbols from next object are not
++					   generally available.  */
++
++/* Version definition sections.  */
++
++typedef struct
++{
++  Elf32_Half	vd_version;		/* Version revision */
++  Elf32_Half	vd_flags;		/* Version information */
++  Elf32_Half	vd_ndx;			/* Version Index */
++  Elf32_Half	vd_cnt;			/* Number of associated aux entries */
++  Elf32_Word	vd_hash;		/* Version name hash value */
++  Elf32_Word	vd_aux;			/* Offset in bytes to verdaux array */
++  Elf32_Word	vd_next;		/* Offset in bytes to next verdef
++					   entry */
++} Elf32_Verdef;
++
++typedef struct
++{
++  Elf64_Half	vd_version;		/* Version revision */
++  Elf64_Half	vd_flags;		/* Version information */
++  Elf64_Half	vd_ndx;			/* Version Index */
++  Elf64_Half	vd_cnt;			/* Number of associated aux entries */
++  Elf64_Word	vd_hash;		/* Version name hash value */
++  Elf64_Word	vd_aux;			/* Offset in bytes to verdaux array */
++  Elf64_Word	vd_next;		/* Offset in bytes to next verdef
++					   entry */
++} Elf64_Verdef;
++
++
++/* Legal values for vd_version (version revision).  */
++#define VER_DEF_NONE	0		/* No version */
++#define VER_DEF_CURRENT	1		/* Current version */
++#define VER_DEF_NUM	2		/* Given version number */
++
++/* Legal values for vd_flags (version information flags).  */
++#define VER_FLG_BASE	0x1		/* Version definition of file itself */
++#define VER_FLG_WEAK	0x2		/* Weak version identifier */
++
++/* Versym symbol index values.  */
++#define	VER_NDX_LOCAL		0	/* Symbol is local.  */
++#define	VER_NDX_GLOBAL		1	/* Symbol is global.  */
++#define	VER_NDX_LORESERVE	0xff00	/* Beginning of reserved entries.  */
++#define	VER_NDX_ELIMINATE	0xff01	/* Symbol is to be eliminated.  */
++
++/* Auxialiary version information.  */
++
++typedef struct
++{
++  Elf32_Word	vda_name;		/* Version or dependency names */
++  Elf32_Word	vda_next;		/* Offset in bytes to next verdaux
++					   entry */
++} Elf32_Verdaux;
++
++typedef struct
++{
++  Elf64_Word	vda_name;		/* Version or dependency names */
++  Elf64_Word	vda_next;		/* Offset in bytes to next verdaux
++					   entry */
++} Elf64_Verdaux;
++
++
++/* Version dependency section.  */
++
++typedef struct
++{
++  Elf32_Half	vn_version;		/* Version of structure */
++  Elf32_Half	vn_cnt;			/* Number of associated aux entries */
++  Elf32_Word	vn_file;		/* Offset of filename for this
++					   dependency */
++  Elf32_Word	vn_aux;			/* Offset in bytes to vernaux array */
++  Elf32_Word	vn_next;		/* Offset in bytes to next verneed
++					   entry */
++} Elf32_Verneed;
++
++typedef struct
++{
++  Elf64_Half	vn_version;		/* Version of structure */
++  Elf64_Half	vn_cnt;			/* Number of associated aux entries */
++  Elf64_Word	vn_file;		/* Offset of filename for this
++					   dependency */
++  Elf64_Word	vn_aux;			/* Offset in bytes to vernaux array */
++  Elf64_Word	vn_next;		/* Offset in bytes to next verneed
++					   entry */
++} Elf64_Verneed;
++
++
++/* Legal values for vn_version (version revision).  */
++#define VER_NEED_NONE	 0		/* No version */
++#define VER_NEED_CURRENT 1		/* Current version */
++#define VER_NEED_NUM	 2		/* Given version number */
++
++/* Auxiliary needed version information.  */
++
++typedef struct
++{
++  Elf32_Word	vna_hash;		/* Hash value of dependency name */
++  Elf32_Half	vna_flags;		/* Dependency specific information */
++  Elf32_Half	vna_other;		/* Unused */
++  Elf32_Word	vna_name;		/* Dependency name string offset */
++  Elf32_Word	vna_next;		/* Offset in bytes to next vernaux
++					   entry */
++} Elf32_Vernaux;
++
++typedef struct
++{
++  Elf64_Word	vna_hash;		/* Hash value of dependency name */
++  Elf64_Half	vna_flags;		/* Dependency specific information */
++  Elf64_Half	vna_other;		/* Unused */
++  Elf64_Word	vna_name;		/* Dependency name string offset */
++  Elf64_Word	vna_next;		/* Offset in bytes to next vernaux
++					   entry */
++} Elf64_Vernaux;
++
++
++/* Legal values for vna_flags.  */
++#define VER_FLG_WEAK	0x2		/* Weak version identifier */
++
++
++/* Auxiliary vector.  */
++
++/* This vector is normally only used by the program interpreter.  The
++   usual definition in an ABI supplement uses the name auxv_t.  The
++   vector is not usually defined in a standard <elf.h> file, but it
++   can't hurt.  We rename it to avoid conflicts.  The sizes of these
++   types are an arrangement between the exec server and the program
++   interpreter, so we don't fully specify them here.  */
++
++typedef struct
++{
++  uint32_t a_type;		/* Entry type */
++  union
++    {
++      uint32_t a_val;		/* Integer value */
++      /* We use to have pointer elements added here.  We cannot do that,
++	 though, since it does not work when using 32-bit definitions
++	 on 64-bit platforms and vice versa.  */
++    } a_un;
++} Elf32_auxv_t;
++
++typedef struct
++{
++  uint64_t a_type;		/* Entry type */
++  union
++    {
++      uint64_t a_val;		/* Integer value */
++      /* We use to have pointer elements added here.  We cannot do that,
++	 though, since it does not work when using 32-bit definitions
++	 on 64-bit platforms and vice versa.  */
++    } a_un;
++} Elf64_auxv_t;
++
++/* Legal values for a_type (entry type).  */
++
++#define AT_NULL		0		/* End of vector */
++#define AT_IGNORE	1		/* Entry should be ignored */
++#define AT_EXECFD	2		/* File descriptor of program */
++#define AT_PHDR		3		/* Program headers for program */
++#define AT_PHENT	4		/* Size of program header entry */
++#define AT_PHNUM	5		/* Number of program headers */
++#define AT_PAGESZ	6		/* System page size */
++#define AT_BASE		7		/* Base address of interpreter */
++#define AT_FLAGS	8		/* Flags */
++#define AT_ENTRY	9		/* Entry point of program */
++#define AT_NOTELF	10		/* Program is not ELF */
++#define AT_UID		11		/* Real uid */
++#define AT_EUID		12		/* Effective uid */
++#define AT_GID		13		/* Real gid */
++#define AT_EGID		14		/* Effective gid */
++#define AT_CLKTCK	17		/* Frequency of times() */
++
++/* Some more special a_type values describing the hardware.  */
++#define AT_PLATFORM	15		/* String identifying platform.  */
++#define AT_HWCAP	16		/* Machine dependent hints about
++					   processor capabilities.  */
++
++/* This entry gives some information about the FPU initialization
++   performed by the kernel.  */
++#define AT_FPUCW	18		/* Used FPU control word.  */
++
++/* Cache block sizes.  */
++#define AT_DCACHEBSIZE	19		/* Data cache block size.  */
++#define AT_ICACHEBSIZE	20		/* Instruction cache block size.  */
++#define AT_UCACHEBSIZE	21		/* Unified cache block size.  */
++
++/* A special ignored value for PPC, used by the kernel to control the
++   interpretation of the AUXV. Must be > 16.  */
++#define AT_IGNOREPPC	22		/* Entry should be ignored.  */
++
++#define	AT_SECURE	23		/* Boolean, was exec setuid-like?  */
++
++#define AT_BASE_PLATFORM 24		/* String identifying real platforms.*/
++
++#define AT_RANDOM	25		/* Address of 16 random bytes.  */
++
++#define AT_EXECFN	31		/* Filename of executable.  */
++
++/* Pointer to the global system page used for system calls and other
++   nice things.  */
++#define AT_SYSINFO	32
++#define AT_SYSINFO_EHDR	33
++
++/* Shapes of the caches.  Bits 0-3 contains associativity; bits 4-7 contains
++   log2 of line size; mask those to get cache size.  */
++#define AT_L1I_CACHESHAPE	34
++#define AT_L1D_CACHESHAPE	35
++#define AT_L2_CACHESHAPE	36
++#define AT_L3_CACHESHAPE	37
++
++/* Note section contents.  Each entry in the note section begins with
++   a header of a fixed form.  */
++
++typedef struct
++{
++  Elf32_Word n_namesz;			/* Length of the note's name.  */
++  Elf32_Word n_descsz;			/* Length of the note's descriptor.  */
++  Elf32_Word n_type;			/* Type of the note.  */
++} Elf32_Nhdr;
++
++typedef struct
++{
++  Elf64_Word n_namesz;			/* Length of the note's name.  */
++  Elf64_Word n_descsz;			/* Length of the note's descriptor.  */
++  Elf64_Word n_type;			/* Type of the note.  */
++} Elf64_Nhdr;
++
++/* Known names of notes.  */
++
++/* Solaris entries in the note section have this name.  */
++#define ELF_NOTE_SOLARIS	"SUNW Solaris"
++
++/* Note entries for GNU systems have this name.  */
++#define ELF_NOTE_GNU		"GNU"
++
++
++/* Defined types of notes for Solaris.  */
++
++/* Value of descriptor (one word) is desired pagesize for the binary.  */
++#define ELF_NOTE_PAGESIZE_HINT	1
++
++
++/* Defined note types for GNU systems.  */
++
++/* ABI information.  The descriptor consists of words:
++   word 0: OS descriptor
++   word 1: major version of the ABI
++   word 2: minor version of the ABI
++   word 3: subminor version of the ABI
++*/
++#define NT_GNU_ABI_TAG	1
++#define ELF_NOTE_ABI	NT_GNU_ABI_TAG /* Old name.  */
++
++/* Known OSes.  These values can appear in word 0 of an
++   NT_GNU_ABI_TAG note section entry.  */
++#define ELF_NOTE_OS_LINUX	0
++#define ELF_NOTE_OS_GNU		1
++#define ELF_NOTE_OS_SOLARIS2	2
++#define ELF_NOTE_OS_FREEBSD	3
++
++/* Synthetic hwcap information.  The descriptor begins with two words:
++   word 0: number of entries
++   word 1: bitmask of enabled entries
++   Then follow variable-length entries, one byte followed by a
++   '\0'-terminated hwcap name string.  The byte gives the bit
++   number to test if enabled, (1U << bit) & bitmask.  */
++#define NT_GNU_HWCAP	2
++
++/* Build ID bits as generated by ld --build-id.
++   The descriptor consists of any nonzero number of bytes.  */
++#define NT_GNU_BUILD_ID	3
++
++/* Version note generated by GNU gold containing a version string.  */
++#define NT_GNU_GOLD_VERSION	4
++
++
++/* Move records.  */
++typedef struct
++{
++  Elf32_Xword m_value;		/* Symbol value.  */
++  Elf32_Word m_info;		/* Size and index.  */
++  Elf32_Word m_poffset;		/* Symbol offset.  */
++  Elf32_Half m_repeat;		/* Repeat count.  */
++  Elf32_Half m_stride;		/* Stride info.  */
++} Elf32_Move;
++
++typedef struct
++{
++  Elf64_Xword m_value;		/* Symbol value.  */
++  Elf64_Xword m_info;		/* Size and index.  */
++  Elf64_Xword m_poffset;	/* Symbol offset.  */
++  Elf64_Half m_repeat;		/* Repeat count.  */
++  Elf64_Half m_stride;		/* Stride info.  */
++} Elf64_Move;
++
++/* Macro to construct move records.  */
++#define ELF32_M_SYM(info)	((info) >> 8)
++#define ELF32_M_SIZE(info)	((unsigned char) (info))
++#define ELF32_M_INFO(sym, size)	(((sym) << 8) + (unsigned char) (size))
++
++#define ELF64_M_SYM(info)	ELF32_M_SYM (info)
++#define ELF64_M_SIZE(info)	ELF32_M_SIZE (info)
++#define ELF64_M_INFO(sym, size)	ELF32_M_INFO (sym, size)
++
++
++/* Motorola 68k specific definitions.  */
++
++/* Values for Elf32_Ehdr.e_flags.  */
++#define EF_CPU32	0x00810000
++
++/* m68k relocs.  */
++
++#define R_68K_NONE	0		/* No reloc */
++#define R_68K_32	1		/* Direct 32 bit  */
++#define R_68K_16	2		/* Direct 16 bit  */
++#define R_68K_8		3		/* Direct 8 bit  */
++#define R_68K_PC32	4		/* PC relative 32 bit */
++#define R_68K_PC16	5		/* PC relative 16 bit */
++#define R_68K_PC8	6		/* PC relative 8 bit */
++#define R_68K_GOT32	7		/* 32 bit PC relative GOT entry */
++#define R_68K_GOT16	8		/* 16 bit PC relative GOT entry */
++#define R_68K_GOT8	9		/* 8 bit PC relative GOT entry */
++#define R_68K_GOT32O	10		/* 32 bit GOT offset */
++#define R_68K_GOT16O	11		/* 16 bit GOT offset */
++#define R_68K_GOT8O	12		/* 8 bit GOT offset */
++#define R_68K_PLT32	13		/* 32 bit PC relative PLT address */
++#define R_68K_PLT16	14		/* 16 bit PC relative PLT address */
++#define R_68K_PLT8	15		/* 8 bit PC relative PLT address */
++#define R_68K_PLT32O	16		/* 32 bit PLT offset */
++#define R_68K_PLT16O	17		/* 16 bit PLT offset */
++#define R_68K_PLT8O	18		/* 8 bit PLT offset */
++#define R_68K_COPY	19		/* Copy symbol at runtime */
++#define R_68K_GLOB_DAT	20		/* Create GOT entry */
++#define R_68K_JMP_SLOT	21		/* Create PLT entry */
++#define R_68K_RELATIVE	22		/* Adjust by program base */
++#define R_68K_TLS_GD32      25          /* 32 bit GOT offset for GD */
++#define R_68K_TLS_GD16      26          /* 16 bit GOT offset for GD */
++#define R_68K_TLS_GD8       27          /* 8 bit GOT offset for GD */
++#define R_68K_TLS_LDM32     28          /* 32 bit GOT offset for LDM */
++#define R_68K_TLS_LDM16     29          /* 16 bit GOT offset for LDM */
++#define R_68K_TLS_LDM8      30          /* 8 bit GOT offset for LDM */
++#define R_68K_TLS_LDO32     31          /* 32 bit module-relative offset */
++#define R_68K_TLS_LDO16     32          /* 16 bit module-relative offset */
++#define R_68K_TLS_LDO8      33          /* 8 bit module-relative offset */
++#define R_68K_TLS_IE32      34          /* 32 bit GOT offset for IE */
++#define R_68K_TLS_IE16      35          /* 16 bit GOT offset for IE */
++#define R_68K_TLS_IE8       36          /* 8 bit GOT offset for IE */
++#define R_68K_TLS_LE32      37          /* 32 bit offset relative to
++					   static TLS block */
++#define R_68K_TLS_LE16      38          /* 16 bit offset relative to
++					   static TLS block */
++#define R_68K_TLS_LE8       39          /* 8 bit offset relative to
++					   static TLS block */
++#define R_68K_TLS_DTPMOD32  40          /* 32 bit module number */
++#define R_68K_TLS_DTPREL32  41          /* 32 bit module-relative offset */
++#define R_68K_TLS_TPREL32   42          /* 32 bit TP-relative offset */
++/* Keep this the last entry.  */
++#define R_68K_NUM	43
++
++/* Intel 80386 specific definitions.  */
++
++/* i386 relocs.  */
++
++#define R_386_NONE	   0		/* No reloc */
++#define R_386_32	   1		/* Direct 32 bit  */
++#define R_386_PC32	   2		/* PC relative 32 bit */
++#define R_386_GOT32	   3		/* 32 bit GOT entry */
++#define R_386_PLT32	   4		/* 32 bit PLT address */
++#define R_386_COPY	   5		/* Copy symbol at runtime */
++#define R_386_GLOB_DAT	   6		/* Create GOT entry */
++#define R_386_JMP_SLOT	   7		/* Create PLT entry */
++#define R_386_RELATIVE	   8		/* Adjust by program base */
++#define R_386_GOTOFF	   9		/* 32 bit offset to GOT */
++#define R_386_GOTPC	   10		/* 32 bit PC relative offset to GOT */
++#define R_386_32PLT	   11
++#define R_386_TLS_TPOFF	   14		/* Offset in static TLS block */
++#define R_386_TLS_IE	   15		/* Address of GOT entry for static TLS
++					   block offset */
++#define R_386_TLS_GOTIE	   16		/* GOT entry for static TLS block
++					   offset */
++#define R_386_TLS_LE	   17		/* Offset relative to static TLS
++					   block */
++#define R_386_TLS_GD	   18		/* Direct 32 bit for GNU version of
++					   general dynamic thread local data */
++#define R_386_TLS_LDM	   19		/* Direct 32 bit for GNU version of
++					   local dynamic thread local data
++					   in LE code */
++#define R_386_16	   20
++#define R_386_PC16	   21
++#define R_386_8		   22
++#define R_386_PC8	   23
++#define R_386_TLS_GD_32	   24		/* Direct 32 bit for general dynamic
++					   thread local data */
++#define R_386_TLS_GD_PUSH  25		/* Tag for pushl in GD TLS code */
++#define R_386_TLS_GD_CALL  26		/* Relocation for call to
++					   __tls_get_addr() */
++#define R_386_TLS_GD_POP   27		/* Tag for popl in GD TLS code */
++#define R_386_TLS_LDM_32   28		/* Direct 32 bit for local dynamic
++					   thread local data in LE code */
++#define R_386_TLS_LDM_PUSH 29		/* Tag for pushl in LDM TLS code */
++#define R_386_TLS_LDM_CALL 30		/* Relocation for call to
++					   __tls_get_addr() in LDM code */
++#define R_386_TLS_LDM_POP  31		/* Tag for popl in LDM TLS code */
++#define R_386_TLS_LDO_32   32		/* Offset relative to TLS block */
++#define R_386_TLS_IE_32	   33		/* GOT entry for negated static TLS
++					   block offset */
++#define R_386_TLS_LE_32	   34		/* Negated offset relative to static
++					   TLS block */
++#define R_386_TLS_DTPMOD32 35		/* ID of module containing symbol */
++#define R_386_TLS_DTPOFF32 36		/* Offset in TLS block */
++#define R_386_TLS_TPOFF32  37		/* Negated offset in static TLS block */
++/* 38? */
++#define R_386_TLS_GOTDESC  39		/* GOT offset for TLS descriptor.  */
++#define R_386_TLS_DESC_CALL 40		/* Marker of call through TLS
++					   descriptor for
++					   relaxation.  */
++#define R_386_TLS_DESC     41		/* TLS descriptor containing
++					   pointer to code and to
++					   argument, returning the TLS
++					   offset for the symbol.  */
++#define R_386_IRELATIVE	   42		/* Adjust indirectly by program base */
++/* Keep this the last entry.  */
++#define R_386_NUM	   43
++
++/* SUN SPARC specific definitions.  */
++
++/* Legal values for ST_TYPE subfield of st_info (symbol type).  */
++
++#define STT_SPARC_REGISTER	13	/* Global register reserved to app. */
++
++/* Values for Elf64_Ehdr.e_flags.  */
++
++#define EF_SPARCV9_MM		3
++#define EF_SPARCV9_TSO		0
++#define EF_SPARCV9_PSO		1
++#define EF_SPARCV9_RMO		2
++#define EF_SPARC_LEDATA		0x800000 /* little endian data */
++#define EF_SPARC_EXT_MASK	0xFFFF00
++#define EF_SPARC_32PLUS		0x000100 /* generic V8+ features */
++#define EF_SPARC_SUN_US1	0x000200 /* Sun UltraSPARC1 extensions */
++#define EF_SPARC_HAL_R1		0x000400 /* HAL R1 extensions */
++#define EF_SPARC_SUN_US3	0x000800 /* Sun UltraSPARCIII extensions */
++
++/* SPARC relocs.  */
++
++#define R_SPARC_NONE		0	/* No reloc */
++#define R_SPARC_8		1	/* Direct 8 bit */
++#define R_SPARC_16		2	/* Direct 16 bit */
++#define R_SPARC_32		3	/* Direct 32 bit */
++#define R_SPARC_DISP8		4	/* PC relative 8 bit */
++#define R_SPARC_DISP16		5	/* PC relative 16 bit */
++#define R_SPARC_DISP32		6	/* PC relative 32 bit */
++#define R_SPARC_WDISP30		7	/* PC relative 30 bit shifted */
++#define R_SPARC_WDISP22		8	/* PC relative 22 bit shifted */
++#define R_SPARC_HI22		9	/* High 22 bit */
++#define R_SPARC_22		10	/* Direct 22 bit */
++#define R_SPARC_13		11	/* Direct 13 bit */
++#define R_SPARC_LO10		12	/* Truncated 10 bit */
++#define R_SPARC_GOT10		13	/* Truncated 10 bit GOT entry */
++#define R_SPARC_GOT13		14	/* 13 bit GOT entry */
++#define R_SPARC_GOT22		15	/* 22 bit GOT entry shifted */
++#define R_SPARC_PC10		16	/* PC relative 10 bit truncated */
++#define R_SPARC_PC22		17	/* PC relative 22 bit shifted */
++#define R_SPARC_WPLT30		18	/* 30 bit PC relative PLT address */
++#define R_SPARC_COPY		19	/* Copy symbol at runtime */
++#define R_SPARC_GLOB_DAT	20	/* Create GOT entry */
++#define R_SPARC_JMP_SLOT	21	/* Create PLT entry */
++#define R_SPARC_RELATIVE	22	/* Adjust by program base */
++#define R_SPARC_UA32		23	/* Direct 32 bit unaligned */
++
++/* Additional Sparc64 relocs.  */
++
++#define R_SPARC_PLT32		24	/* Direct 32 bit ref to PLT entry */
++#define R_SPARC_HIPLT22		25	/* High 22 bit PLT entry */
++#define R_SPARC_LOPLT10		26	/* Truncated 10 bit PLT entry */
++#define R_SPARC_PCPLT32		27	/* PC rel 32 bit ref to PLT entry */
++#define R_SPARC_PCPLT22		28	/* PC rel high 22 bit PLT entry */
++#define R_SPARC_PCPLT10		29	/* PC rel trunc 10 bit PLT entry */
++#define R_SPARC_10		30	/* Direct 10 bit */
++#define R_SPARC_11		31	/* Direct 11 bit */
++#define R_SPARC_64		32	/* Direct 64 bit */
++#define R_SPARC_OLO10		33	/* 10bit with secondary 13bit addend */
++#define R_SPARC_HH22		34	/* Top 22 bits of direct 64 bit */
++#define R_SPARC_HM10		35	/* High middle 10 bits of ... */
++#define R_SPARC_LM22		36	/* Low middle 22 bits of ... */
++#define R_SPARC_PC_HH22		37	/* Top 22 bits of pc rel 64 bit */
++#define R_SPARC_PC_HM10		38	/* High middle 10 bit of ... */
++#define R_SPARC_PC_LM22		39	/* Low miggle 22 bits of ... */
++#define R_SPARC_WDISP16		40	/* PC relative 16 bit shifted */
++#define R_SPARC_WDISP19		41	/* PC relative 19 bit shifted */
++#define R_SPARC_GLOB_JMP	42	/* was part of v9 ABI but was removed */
++#define R_SPARC_7		43	/* Direct 7 bit */
++#define R_SPARC_5		44	/* Direct 5 bit */
++#define R_SPARC_6		45	/* Direct 6 bit */
++#define R_SPARC_DISP64		46	/* PC relative 64 bit */
++#define R_SPARC_PLT64		47	/* Direct 64 bit ref to PLT entry */
++#define R_SPARC_HIX22		48	/* High 22 bit complemented */
++#define R_SPARC_LOX10		49	/* Truncated 11 bit complemented */
++#define R_SPARC_H44		50	/* Direct high 12 of 44 bit */
++#define R_SPARC_M44		51	/* Direct mid 22 of 44 bit */
++#define R_SPARC_L44		52	/* Direct low 10 of 44 bit */
++#define R_SPARC_REGISTER	53	/* Global register usage */
++#define R_SPARC_UA64		54	/* Direct 64 bit unaligned */
++#define R_SPARC_UA16		55	/* Direct 16 bit unaligned */
++#define R_SPARC_TLS_GD_HI22	56
++#define R_SPARC_TLS_GD_LO10	57
++#define R_SPARC_TLS_GD_ADD	58
++#define R_SPARC_TLS_GD_CALL	59
++#define R_SPARC_TLS_LDM_HI22	60
++#define R_SPARC_TLS_LDM_LO10	61
++#define R_SPARC_TLS_LDM_ADD	62
++#define R_SPARC_TLS_LDM_CALL	63
++#define R_SPARC_TLS_LDO_HIX22	64
++#define R_SPARC_TLS_LDO_LOX10	65
++#define R_SPARC_TLS_LDO_ADD	66
++#define R_SPARC_TLS_IE_HI22	67
++#define R_SPARC_TLS_IE_LO10	68
++#define R_SPARC_TLS_IE_LD	69
++#define R_SPARC_TLS_IE_LDX	70
++#define R_SPARC_TLS_IE_ADD	71
++#define R_SPARC_TLS_LE_HIX22	72
++#define R_SPARC_TLS_LE_LOX10	73
++#define R_SPARC_TLS_DTPMOD32	74
++#define R_SPARC_TLS_DTPMOD64	75
++#define R_SPARC_TLS_DTPOFF32	76
++#define R_SPARC_TLS_DTPOFF64	77
++#define R_SPARC_TLS_TPOFF32	78
++#define R_SPARC_TLS_TPOFF64	79
++#define R_SPARC_GOTDATA_HIX22	80
++#define R_SPARC_GOTDATA_LOX10	81
++#define R_SPARC_GOTDATA_OP_HIX22	82
++#define R_SPARC_GOTDATA_OP_LOX10	83
++#define R_SPARC_GOTDATA_OP	84
++#define R_SPARC_H34		85
++#define R_SPARC_SIZE32		86
++#define R_SPARC_SIZE64		87
++#define R_SPARC_WDISP10		88
++#define R_SPARC_JMP_IREL	248
++#define R_SPARC_IRELATIVE	249
++#define R_SPARC_GNU_VTINHERIT	250
++#define R_SPARC_GNU_VTENTRY	251
++#define R_SPARC_REV32		252
++/* Keep this the last entry.  */
++#define R_SPARC_NUM		253
++
++/* For Sparc64, legal values for d_tag of Elf64_Dyn.  */
++
++#define DT_SPARC_REGISTER 0x70000001
++#define DT_SPARC_NUM	2
++
++/* MIPS R3000 specific definitions.  */
++
++/* Legal values for e_flags field of Elf32_Ehdr.  */
++
++#define EF_MIPS_NOREORDER   1		/* A .noreorder directive was used */
++#define EF_MIPS_PIC	    2		/* Contains PIC code */
++#define EF_MIPS_CPIC	    4		/* Uses PIC calling sequence */
++#define EF_MIPS_XGOT	    8
++#define EF_MIPS_64BIT_WHIRL 16
++#define EF_MIPS_ABI2	    32
++#define EF_MIPS_ABI_ON32    64
++#define EF_MIPS_ARCH	    0xf0000000	/* MIPS architecture level */
++
++/* Legal values for MIPS architecture level.  */
++
++#define EF_MIPS_ARCH_1	    0x00000000	/* -mips1 code.  */
++#define EF_MIPS_ARCH_2	    0x10000000	/* -mips2 code.  */
++#define EF_MIPS_ARCH_3	    0x20000000	/* -mips3 code.  */
++#define EF_MIPS_ARCH_4	    0x30000000	/* -mips4 code.  */
++#define EF_MIPS_ARCH_5	    0x40000000	/* -mips5 code.  */
++#define EF_MIPS_ARCH_32	    0x60000000	/* MIPS32 code.  */
++#define EF_MIPS_ARCH_64	    0x70000000	/* MIPS64 code.  */
++
++/* The following are non-official names and should not be used.  */
++
++#define E_MIPS_ARCH_1	  0x00000000	/* -mips1 code.  */
++#define E_MIPS_ARCH_2	  0x10000000	/* -mips2 code.  */
++#define E_MIPS_ARCH_3	  0x20000000	/* -mips3 code.  */
++#define E_MIPS_ARCH_4	  0x30000000	/* -mips4 code.  */
++#define E_MIPS_ARCH_5	  0x40000000	/* -mips5 code.  */
++#define E_MIPS_ARCH_32	  0x60000000	/* MIPS32 code.  */
++#define E_MIPS_ARCH_64	  0x70000000	/* MIPS64 code.  */
++
++/* Special section indices.  */
++
++#define SHN_MIPS_ACOMMON    0xff00	/* Allocated common symbols */
++#define SHN_MIPS_TEXT	    0xff01	/* Allocated test symbols.  */
++#define SHN_MIPS_DATA	    0xff02	/* Allocated data symbols.  */
++#define SHN_MIPS_SCOMMON    0xff03	/* Small common symbols */
++#define SHN_MIPS_SUNDEFINED 0xff04	/* Small undefined symbols */
++
++/* Legal values for sh_type field of Elf32_Shdr.  */
++
++#define SHT_MIPS_LIBLIST       0x70000000 /* Shared objects used in link */
++#define SHT_MIPS_MSYM	       0x70000001
++#define SHT_MIPS_CONFLICT      0x70000002 /* Conflicting symbols */
++#define SHT_MIPS_GPTAB	       0x70000003 /* Global data area sizes */
++#define SHT_MIPS_UCODE	       0x70000004 /* Reserved for SGI/MIPS compilers */
++#define SHT_MIPS_DEBUG	       0x70000005 /* MIPS ECOFF debugging information*/
++#define SHT_MIPS_REGINFO       0x70000006 /* Register usage information */
++#define SHT_MIPS_PACKAGE       0x70000007
++#define SHT_MIPS_PACKSYM       0x70000008
++#define SHT_MIPS_RELD	       0x70000009
++#define SHT_MIPS_IFACE         0x7000000b
++#define SHT_MIPS_CONTENT       0x7000000c
++#define SHT_MIPS_OPTIONS       0x7000000d /* Miscellaneous options.  */
++#define SHT_MIPS_SHDR	       0x70000010
++#define SHT_MIPS_FDESC	       0x70000011
++#define SHT_MIPS_EXTSYM	       0x70000012
++#define SHT_MIPS_DENSE	       0x70000013
++#define SHT_MIPS_PDESC	       0x70000014
++#define SHT_MIPS_LOCSYM	       0x70000015
++#define SHT_MIPS_AUXSYM	       0x70000016
++#define SHT_MIPS_OPTSYM	       0x70000017
++#define SHT_MIPS_LOCSTR	       0x70000018
++#define SHT_MIPS_LINE	       0x70000019
++#define SHT_MIPS_RFDESC	       0x7000001a
++#define SHT_MIPS_DELTASYM      0x7000001b
++#define SHT_MIPS_DELTAINST     0x7000001c
++#define SHT_MIPS_DELTACLASS    0x7000001d
++#define SHT_MIPS_DWARF         0x7000001e /* DWARF debugging information.  */
++#define SHT_MIPS_DELTADECL     0x7000001f
++#define SHT_MIPS_SYMBOL_LIB    0x70000020
++#define SHT_MIPS_EVENTS	       0x70000021 /* Event section.  */
++#define SHT_MIPS_TRANSLATE     0x70000022
++#define SHT_MIPS_PIXIE	       0x70000023
++#define SHT_MIPS_XLATE	       0x70000024
++#define SHT_MIPS_XLATE_DEBUG   0x70000025
++#define SHT_MIPS_WHIRL	       0x70000026
++#define SHT_MIPS_EH_REGION     0x70000027
++#define SHT_MIPS_XLATE_OLD     0x70000028
++#define SHT_MIPS_PDR_EXCEPTION 0x70000029
++
++/* Legal values for sh_flags field of Elf32_Shdr.  */
++
++#define SHF_MIPS_GPREL	 0x10000000	/* Must be part of global data area */
++#define SHF_MIPS_MERGE	 0x20000000
++#define SHF_MIPS_ADDR	 0x40000000
++#define SHF_MIPS_STRINGS 0x80000000
++#define SHF_MIPS_NOSTRIP 0x08000000
++#define SHF_MIPS_LOCAL	 0x04000000
++#define SHF_MIPS_NAMES	 0x02000000
++#define SHF_MIPS_NODUPE	 0x01000000
++
++
++/* Symbol tables.  */
++
++/* MIPS specific values for `st_other'.  */
++#define STO_MIPS_DEFAULT		0x0
++#define STO_MIPS_INTERNAL		0x1
++#define STO_MIPS_HIDDEN			0x2
++#define STO_MIPS_PROTECTED		0x3
++#define STO_MIPS_PLT			0x8
++#define STO_MIPS_SC_ALIGN_UNUSED	0xff
++
++/* MIPS specific values for `st_info'.  */
++#define STB_MIPS_SPLIT_COMMON		13
++
++/* Entries found in sections of type SHT_MIPS_GPTAB.  */
++
++typedef union
++{
++  struct
++    {
++      Elf32_Word gt_current_g_value;	/* -G value used for compilation */
++      Elf32_Word gt_unused;		/* Not used */
++    } gt_header;			/* First entry in section */
++  struct
++    {
++      Elf32_Word gt_g_value;		/* If this value were used for -G */
++      Elf32_Word gt_bytes;		/* This many bytes would be used */
++    } gt_entry;				/* Subsequent entries in section */
++} Elf32_gptab;
++
++/* Entry found in sections of type SHT_MIPS_REGINFO.  */
++
++typedef struct
++{
++  Elf32_Word	ri_gprmask;		/* General registers used */
++  Elf32_Word	ri_cprmask[4];		/* Coprocessor registers used */
++  Elf32_Sword	ri_gp_value;		/* $gp register value */
++} Elf32_RegInfo;
++
++/* Entries found in sections of type SHT_MIPS_OPTIONS.  */
++
++typedef struct
++{
++  unsigned char kind;		/* Determines interpretation of the
++				   variable part of descriptor.  */
++  unsigned char size;		/* Size of descriptor, including header.  */
++  Elf32_Section section;	/* Section header index of section affected,
++				   0 for global options.  */
++  Elf32_Word info;		/* Kind-specific information.  */
++} Elf_Options;
++
++/* Values for `kind' field in Elf_Options.  */
++
++#define ODK_NULL	0	/* Undefined.  */
++#define ODK_REGINFO	1	/* Register usage information.  */
++#define ODK_EXCEPTIONS	2	/* Exception processing options.  */
++#define ODK_PAD		3	/* Section padding options.  */
++#define ODK_HWPATCH	4	/* Hardware workarounds performed */
++#define ODK_FILL	5	/* record the fill value used by the linker. */
++#define ODK_TAGS	6	/* reserve space for desktop tools to write. */
++#define ODK_HWAND	7	/* HW workarounds.  'AND' bits when merging. */
++#define ODK_HWOR	8	/* HW workarounds.  'OR' bits when merging.  */
++
++/* Values for `info' in Elf_Options for ODK_EXCEPTIONS entries.  */
++
++#define OEX_FPU_MIN	0x1f	/* FPE's which MUST be enabled.  */
++#define OEX_FPU_MAX	0x1f00	/* FPE's which MAY be enabled.  */
++#define OEX_PAGE0	0x10000	/* page zero must be mapped.  */
++#define OEX_SMM		0x20000	/* Force sequential memory mode?  */
++#define OEX_FPDBUG	0x40000	/* Force floating point debug mode?  */
++#define OEX_PRECISEFP	OEX_FPDBUG
++#define OEX_DISMISS	0x80000	/* Dismiss invalid address faults?  */
++
++#define OEX_FPU_INVAL	0x10
++#define OEX_FPU_DIV0	0x08
++#define OEX_FPU_OFLO	0x04
++#define OEX_FPU_UFLO	0x02
++#define OEX_FPU_INEX	0x01
++
++/* Masks for `info' in Elf_Options for an ODK_HWPATCH entry.  */
++
++#define OHW_R4KEOP	0x1	/* R4000 end-of-page patch.  */
++#define OHW_R8KPFETCH	0x2	/* may need R8000 prefetch patch.  */
++#define OHW_R5KEOP	0x4	/* R5000 end-of-page patch.  */
++#define OHW_R5KCVTL	0x8	/* R5000 cvt.[ds].l bug.  clean=1.  */
++
++#define OPAD_PREFIX	0x1
++#define OPAD_POSTFIX	0x2
++#define OPAD_SYMBOL	0x4
++
++/* Entry found in `.options' section.  */
++
++typedef struct
++{
++  Elf32_Word hwp_flags1;	/* Extra flags.  */
++  Elf32_Word hwp_flags2;	/* Extra flags.  */
++} Elf_Options_Hw;
++
++/* Masks for `info' in ElfOptions for ODK_HWAND and ODK_HWOR entries.  */
++
++#define OHWA0_R4KEOP_CHECKED	0x00000001
++#define OHWA1_R4KEOP_CLEAN	0x00000002
++
++/* MIPS relocs.  */
++
++#define R_MIPS_NONE		0	/* No reloc */
++#define R_MIPS_16		1	/* Direct 16 bit */
++#define R_MIPS_32		2	/* Direct 32 bit */
++#define R_MIPS_REL32		3	/* PC relative 32 bit */
++#define R_MIPS_26		4	/* Direct 26 bit shifted */
++#define R_MIPS_HI16		5	/* High 16 bit */
++#define R_MIPS_LO16		6	/* Low 16 bit */
++#define R_MIPS_GPREL16		7	/* GP relative 16 bit */
++#define R_MIPS_LITERAL		8	/* 16 bit literal entry */
++#define R_MIPS_GOT16		9	/* 16 bit GOT entry */
++#define R_MIPS_PC16		10	/* PC relative 16 bit */
++#define R_MIPS_CALL16		11	/* 16 bit GOT entry for function */
++#define R_MIPS_GPREL32		12	/* GP relative 32 bit */
++
++#define R_MIPS_SHIFT5		16
++#define R_MIPS_SHIFT6		17
++#define R_MIPS_64		18
++#define R_MIPS_GOT_DISP		19
++#define R_MIPS_GOT_PAGE		20
++#define R_MIPS_GOT_OFST		21
++#define R_MIPS_GOT_HI16		22
++#define R_MIPS_GOT_LO16		23
++#define R_MIPS_SUB		24
++#define R_MIPS_INSERT_A		25
++#define R_MIPS_INSERT_B		26
++#define R_MIPS_DELETE		27
++#define R_MIPS_HIGHER		28
++#define R_MIPS_HIGHEST		29
++#define R_MIPS_CALL_HI16	30
++#define R_MIPS_CALL_LO16	31
++#define R_MIPS_SCN_DISP		32
++#define R_MIPS_REL16		33
++#define R_MIPS_ADD_IMMEDIATE	34
++#define R_MIPS_PJUMP		35
++#define R_MIPS_RELGOT		36
++#define R_MIPS_JALR		37
++#define R_MIPS_TLS_DTPMOD32	38	/* Module number 32 bit */
++#define R_MIPS_TLS_DTPREL32	39	/* Module-relative offset 32 bit */
++#define R_MIPS_TLS_DTPMOD64	40	/* Module number 64 bit */
++#define R_MIPS_TLS_DTPREL64	41	/* Module-relative offset 64 bit */
++#define R_MIPS_TLS_GD		42	/* 16 bit GOT offset for GD */
++#define R_MIPS_TLS_LDM		43	/* 16 bit GOT offset for LDM */
++#define R_MIPS_TLS_DTPREL_HI16	44	/* Module-relative offset, high 16 bits */
++#define R_MIPS_TLS_DTPREL_LO16	45	/* Module-relative offset, low 16 bits */
++#define R_MIPS_TLS_GOTTPREL	46	/* 16 bit GOT offset for IE */
++#define R_MIPS_TLS_TPREL32	47	/* TP-relative offset, 32 bit */
++#define R_MIPS_TLS_TPREL64	48	/* TP-relative offset, 64 bit */
++#define R_MIPS_TLS_TPREL_HI16	49	/* TP-relative offset, high 16 bits */
++#define R_MIPS_TLS_TPREL_LO16	50	/* TP-relative offset, low 16 bits */
++#define R_MIPS_GLOB_DAT		51
++#define R_MIPS_COPY		126
++#define R_MIPS_JUMP_SLOT        127
++/* Keep this the last entry.  */
++#define R_MIPS_NUM		128
++
++/* Legal values for p_type field of Elf32_Phdr.  */
++
++#define PT_MIPS_REGINFO	0x70000000	/* Register usage information */
++#define PT_MIPS_RTPROC  0x70000001	/* Runtime procedure table. */
++#define PT_MIPS_OPTIONS 0x70000002
++
++/* Special program header types.  */
++
++#define PF_MIPS_LOCAL	0x10000000
++
++/* Legal values for d_tag field of Elf32_Dyn.  */
++
++#define DT_MIPS_RLD_VERSION  0x70000001	/* Runtime linker interface version */
++#define DT_MIPS_TIME_STAMP   0x70000002	/* Timestamp */
++#define DT_MIPS_ICHECKSUM    0x70000003	/* Checksum */
++#define DT_MIPS_IVERSION     0x70000004	/* Version string (string tbl index) */
++#define DT_MIPS_FLAGS	     0x70000005	/* Flags */
++#define DT_MIPS_BASE_ADDRESS 0x70000006	/* Base address */
++#define DT_MIPS_MSYM	     0x70000007
++#define DT_MIPS_CONFLICT     0x70000008	/* Address of CONFLICT section */
++#define DT_MIPS_LIBLIST	     0x70000009	/* Address of LIBLIST section */
++#define DT_MIPS_LOCAL_GOTNO  0x7000000a	/* Number of local GOT entries */
++#define DT_MIPS_CONFLICTNO   0x7000000b	/* Number of CONFLICT entries */
++#define DT_MIPS_LIBLISTNO    0x70000010	/* Number of LIBLIST entries */
++#define DT_MIPS_SYMTABNO     0x70000011	/* Number of DYNSYM entries */
++#define DT_MIPS_UNREFEXTNO   0x70000012	/* First external DYNSYM */
++#define DT_MIPS_GOTSYM	     0x70000013	/* First GOT entry in DYNSYM */
++#define DT_MIPS_HIPAGENO     0x70000014	/* Number of GOT page table entries */
++#define DT_MIPS_RLD_MAP	     0x70000016	/* Address of run time loader map.  */
++#define DT_MIPS_DELTA_CLASS  0x70000017	/* Delta C++ class definition.  */
++#define DT_MIPS_DELTA_CLASS_NO    0x70000018 /* Number of entries in
++						DT_MIPS_DELTA_CLASS.  */
++#define DT_MIPS_DELTA_INSTANCE    0x70000019 /* Delta C++ class instances.  */
++#define DT_MIPS_DELTA_INSTANCE_NO 0x7000001a /* Number of entries in
++						DT_MIPS_DELTA_INSTANCE.  */
++#define DT_MIPS_DELTA_RELOC  0x7000001b /* Delta relocations.  */
++#define DT_MIPS_DELTA_RELOC_NO 0x7000001c /* Number of entries in
++					     DT_MIPS_DELTA_RELOC.  */
++#define DT_MIPS_DELTA_SYM    0x7000001d /* Delta symbols that Delta
++					   relocations refer to.  */
++#define DT_MIPS_DELTA_SYM_NO 0x7000001e /* Number of entries in
++					   DT_MIPS_DELTA_SYM.  */
++#define DT_MIPS_DELTA_CLASSSYM 0x70000020 /* Delta symbols that hold the
++					     class declaration.  */
++#define DT_MIPS_DELTA_CLASSSYM_NO 0x70000021 /* Number of entries in
++						DT_MIPS_DELTA_CLASSSYM.  */
++#define DT_MIPS_CXX_FLAGS    0x70000022 /* Flags indicating for C++ flavor.  */
++#define DT_MIPS_PIXIE_INIT   0x70000023
++#define DT_MIPS_SYMBOL_LIB   0x70000024
++#define DT_MIPS_LOCALPAGE_GOTIDX 0x70000025
++#define DT_MIPS_LOCAL_GOTIDX 0x70000026
++#define DT_MIPS_HIDDEN_GOTIDX 0x70000027
++#define DT_MIPS_PROTECTED_GOTIDX 0x70000028
++#define DT_MIPS_OPTIONS	     0x70000029 /* Address of .options.  */
++#define DT_MIPS_INTERFACE    0x7000002a /* Address of .interface.  */
++#define DT_MIPS_DYNSTR_ALIGN 0x7000002b
++#define DT_MIPS_INTERFACE_SIZE 0x7000002c /* Size of the .interface section. */
++#define DT_MIPS_RLD_TEXT_RESOLVE_ADDR 0x7000002d /* Address of rld_text_rsolve
++						    function stored in GOT.  */
++#define DT_MIPS_PERF_SUFFIX  0x7000002e /* Default suffix of dso to be added
++					   by rld on dlopen() calls.  */
++#define DT_MIPS_COMPACT_SIZE 0x7000002f /* (O32)Size of compact rel section. */
++#define DT_MIPS_GP_VALUE     0x70000030 /* GP value for aux GOTs.  */
++#define DT_MIPS_AUX_DYNAMIC  0x70000031 /* Address of aux .dynamic.  */
++/* The address of .got.plt in an executable using the new non-PIC ABI.  */
++#define DT_MIPS_PLTGOT	     0x70000032
++/* The base of the PLT in an executable using the new non-PIC ABI if that
++   PLT is writable.  For a non-writable PLT, this is omitted or has a zero
++   value.  */
++#define DT_MIPS_RWPLT        0x70000034
++#define DT_MIPS_NUM	     0x35
++
++/* Legal values for DT_MIPS_FLAGS Elf32_Dyn entry.  */
++
++#define RHF_NONE		   0		/* No flags */
++#define RHF_QUICKSTART		   (1 << 0)	/* Use quickstart */
++#define RHF_NOTPOT		   (1 << 1)	/* Hash size not power of 2 */
++#define RHF_NO_LIBRARY_REPLACEMENT (1 << 2)	/* Ignore LD_LIBRARY_PATH */
++#define RHF_NO_MOVE		   (1 << 3)
++#define RHF_SGI_ONLY		   (1 << 4)
++#define RHF_GUARANTEE_INIT	   (1 << 5)
++#define RHF_DELTA_C_PLUS_PLUS	   (1 << 6)
++#define RHF_GUARANTEE_START_INIT   (1 << 7)
++#define RHF_PIXIE		   (1 << 8)
++#define RHF_DEFAULT_DELAY_LOAD	   (1 << 9)
++#define RHF_REQUICKSTART	   (1 << 10)
++#define RHF_REQUICKSTARTED	   (1 << 11)
++#define RHF_CORD		   (1 << 12)
++#define RHF_NO_UNRES_UNDEF	   (1 << 13)
++#define RHF_RLD_ORDER_SAFE	   (1 << 14)
++
++/* Entries found in sections of type SHT_MIPS_LIBLIST.  */
++
++typedef struct
++{
++  Elf32_Word l_name;		/* Name (string table index) */
++  Elf32_Word l_time_stamp;	/* Timestamp */
++  Elf32_Word l_checksum;	/* Checksum */
++  Elf32_Word l_version;		/* Interface version */
++  Elf32_Word l_flags;		/* Flags */
++} Elf32_Lib;
++
++typedef struct
++{
++  Elf64_Word l_name;		/* Name (string table index) */
++  Elf64_Word l_time_stamp;	/* Timestamp */
++  Elf64_Word l_checksum;	/* Checksum */
++  Elf64_Word l_version;		/* Interface version */
++  Elf64_Word l_flags;		/* Flags */
++} Elf64_Lib;
++
++
++/* Legal values for l_flags.  */
++
++#define LL_NONE		  0
++#define LL_EXACT_MATCH	  (1 << 0)	/* Require exact match */
++#define LL_IGNORE_INT_VER (1 << 1)	/* Ignore interface version */
++#define LL_REQUIRE_MINOR  (1 << 2)
++#define LL_EXPORTS	  (1 << 3)
++#define LL_DELAY_LOAD	  (1 << 4)
++#define LL_DELTA	  (1 << 5)
++
++/* Entries found in sections of type SHT_MIPS_CONFLICT.  */
++
++typedef Elf32_Addr Elf32_Conflict;
++
++
++/* HPPA specific definitions.  */
++
++/* Legal values for e_flags field of Elf32_Ehdr.  */
++
++#define EF_PARISC_TRAPNIL	0x00010000 /* Trap nil pointer dereference.  */
++#define EF_PARISC_EXT		0x00020000 /* Program uses arch. extensions. */
++#define EF_PARISC_LSB		0x00040000 /* Program expects little endian. */
++#define EF_PARISC_WIDE		0x00080000 /* Program expects wide mode.  */
++#define EF_PARISC_NO_KABP	0x00100000 /* No kernel assisted branch
++					      prediction.  */
++#define EF_PARISC_LAZYSWAP	0x00400000 /* Allow lazy swapping.  */
++#define EF_PARISC_ARCH		0x0000ffff /* Architecture version.  */
++
++/* Defined values for `e_flags & EF_PARISC_ARCH' are:  */
++
++#define EFA_PARISC_1_0		    0x020b /* PA-RISC 1.0 big-endian.  */
++#define EFA_PARISC_1_1		    0x0210 /* PA-RISC 1.1 big-endian.  */
++#define EFA_PARISC_2_0		    0x0214 /* PA-RISC 2.0 big-endian.  */
++
++/* Additional section indeces.  */
++
++#define SHN_PARISC_ANSI_COMMON	0xff00	   /* Section for tenatively declared
++					      symbols in ANSI C.  */
++#define SHN_PARISC_HUGE_COMMON	0xff01	   /* Common blocks in huge model.  */
++
++/* Legal values for sh_type field of Elf32_Shdr.  */
++
++#define SHT_PARISC_EXT		0x70000000 /* Contains product specific ext. */
++#define SHT_PARISC_UNWIND	0x70000001 /* Unwind information.  */
++#define SHT_PARISC_DOC		0x70000002 /* Debug info for optimized code. */
++
++/* Legal values for sh_flags field of Elf32_Shdr.  */
++
++#define SHF_PARISC_SHORT	0x20000000 /* Section with short addressing. */
++#define SHF_PARISC_HUGE		0x40000000 /* Section far from gp.  */
++#define SHF_PARISC_SBP		0x80000000 /* Static branch prediction code. */
++
++/* Legal values for ST_TYPE subfield of st_info (symbol type).  */
++
++#define STT_PARISC_MILLICODE	13	/* Millicode function entry point.  */
++
++#define STT_HP_OPAQUE		(STT_LOOS + 0x1)
++#define STT_HP_STUB		(STT_LOOS + 0x2)
++
++/* HPPA relocs.  */
++
++#define R_PARISC_NONE		0	/* No reloc.  */
++#define R_PARISC_DIR32		1	/* Direct 32-bit reference.  */
++#define R_PARISC_DIR21L		2	/* Left 21 bits of eff. address.  */
++#define R_PARISC_DIR17R		3	/* Right 17 bits of eff. address.  */
++#define R_PARISC_DIR17F		4	/* 17 bits of eff. address.  */
++#define R_PARISC_DIR14R		6	/* Right 14 bits of eff. address.  */
++#define R_PARISC_PCREL32	9	/* 32-bit rel. address.  */
++#define R_PARISC_PCREL21L	10	/* Left 21 bits of rel. address.  */
++#define R_PARISC_PCREL17R	11	/* Right 17 bits of rel. address.  */
++#define R_PARISC_PCREL17F	12	/* 17 bits of rel. address.  */
++#define R_PARISC_PCREL14R	14	/* Right 14 bits of rel. address.  */
++#define R_PARISC_DPREL21L	18	/* Left 21 bits of rel. address.  */
++#define R_PARISC_DPREL14R	22	/* Right 14 bits of rel. address.  */
++#define R_PARISC_GPREL21L	26	/* GP-relative, left 21 bits.  */
++#define R_PARISC_GPREL14R	30	/* GP-relative, right 14 bits.  */
++#define R_PARISC_LTOFF21L	34	/* LT-relative, left 21 bits.  */
++#define R_PARISC_LTOFF14R	38	/* LT-relative, right 14 bits.  */
++#define R_PARISC_SECREL32	41	/* 32 bits section rel. address.  */
++#define R_PARISC_SEGBASE	48	/* No relocation, set segment base.  */
++#define R_PARISC_SEGREL32	49	/* 32 bits segment rel. address.  */
++#define R_PARISC_PLTOFF21L	50	/* PLT rel. address, left 21 bits.  */
++#define R_PARISC_PLTOFF14R	54	/* PLT rel. address, right 14 bits.  */
++#define R_PARISC_LTOFF_FPTR32	57	/* 32 bits LT-rel. function pointer. */
++#define R_PARISC_LTOFF_FPTR21L	58	/* LT-rel. fct ptr, left 21 bits. */
++#define R_PARISC_LTOFF_FPTR14R	62	/* LT-rel. fct ptr, right 14 bits. */
++#define R_PARISC_FPTR64		64	/* 64 bits function address.  */
++#define R_PARISC_PLABEL32	65	/* 32 bits function address.  */
++#define R_PARISC_PLABEL21L	66	/* Left 21 bits of fdesc address.  */
++#define R_PARISC_PLABEL14R	70	/* Right 14 bits of fdesc address.  */
++#define R_PARISC_PCREL64	72	/* 64 bits PC-rel. address.  */
++#define R_PARISC_PCREL22F	74	/* 22 bits PC-rel. address.  */
++#define R_PARISC_PCREL14WR	75	/* PC-rel. address, right 14 bits.  */
++#define R_PARISC_PCREL14DR	76	/* PC rel. address, right 14 bits.  */
++#define R_PARISC_PCREL16F	77	/* 16 bits PC-rel. address.  */
++#define R_PARISC_PCREL16WF	78	/* 16 bits PC-rel. address.  */
++#define R_PARISC_PCREL16DF	79	/* 16 bits PC-rel. address.  */
++#define R_PARISC_DIR64		80	/* 64 bits of eff. address.  */
++#define R_PARISC_DIR14WR	83	/* 14 bits of eff. address.  */
++#define R_PARISC_DIR14DR	84	/* 14 bits of eff. address.  */
++#define R_PARISC_DIR16F		85	/* 16 bits of eff. address.  */
++#define R_PARISC_DIR16WF	86	/* 16 bits of eff. address.  */
++#define R_PARISC_DIR16DF	87	/* 16 bits of eff. address.  */
++#define R_PARISC_GPREL64	88	/* 64 bits of GP-rel. address.  */
++#define R_PARISC_GPREL14WR	91	/* GP-rel. address, right 14 bits.  */
++#define R_PARISC_GPREL14DR	92	/* GP-rel. address, right 14 bits.  */
++#define R_PARISC_GPREL16F	93	/* 16 bits GP-rel. address.  */
++#define R_PARISC_GPREL16WF	94	/* 16 bits GP-rel. address.  */
++#define R_PARISC_GPREL16DF	95	/* 16 bits GP-rel. address.  */
++#define R_PARISC_LTOFF64	96	/* 64 bits LT-rel. address.  */
++#define R_PARISC_LTOFF14WR	99	/* LT-rel. address, right 14 bits.  */
++#define R_PARISC_LTOFF14DR	100	/* LT-rel. address, right 14 bits.  */
++#define R_PARISC_LTOFF16F	101	/* 16 bits LT-rel. address.  */
++#define R_PARISC_LTOFF16WF	102	/* 16 bits LT-rel. address.  */
++#define R_PARISC_LTOFF16DF	103	/* 16 bits LT-rel. address.  */
++#define R_PARISC_SECREL64	104	/* 64 bits section rel. address.  */
++#define R_PARISC_SEGREL64	112	/* 64 bits segment rel. address.  */
++#define R_PARISC_PLTOFF14WR	115	/* PLT-rel. address, right 14 bits.  */
++#define R_PARISC_PLTOFF14DR	116	/* PLT-rel. address, right 14 bits.  */
++#define R_PARISC_PLTOFF16F	117	/* 16 bits LT-rel. address.  */
++#define R_PARISC_PLTOFF16WF	118	/* 16 bits PLT-rel. address.  */
++#define R_PARISC_PLTOFF16DF	119	/* 16 bits PLT-rel. address.  */
++#define R_PARISC_LTOFF_FPTR64	120	/* 64 bits LT-rel. function ptr.  */
++#define R_PARISC_LTOFF_FPTR14WR	123	/* LT-rel. fct. ptr., right 14 bits. */
++#define R_PARISC_LTOFF_FPTR14DR	124	/* LT-rel. fct. ptr., right 14 bits. */
++#define R_PARISC_LTOFF_FPTR16F	125	/* 16 bits LT-rel. function ptr.  */
++#define R_PARISC_LTOFF_FPTR16WF	126	/* 16 bits LT-rel. function ptr.  */
++#define R_PARISC_LTOFF_FPTR16DF	127	/* 16 bits LT-rel. function ptr.  */
++#define R_PARISC_LORESERVE	128
++#define R_PARISC_COPY		128	/* Copy relocation.  */
++#define R_PARISC_IPLT		129	/* Dynamic reloc, imported PLT */
++#define R_PARISC_EPLT		130	/* Dynamic reloc, exported PLT */
++#define R_PARISC_TPREL32	153	/* 32 bits TP-rel. address.  */
++#define R_PARISC_TPREL21L	154	/* TP-rel. address, left 21 bits.  */
++#define R_PARISC_TPREL14R	158	/* TP-rel. address, right 14 bits.  */
++#define R_PARISC_LTOFF_TP21L	162	/* LT-TP-rel. address, left 21 bits. */
++#define R_PARISC_LTOFF_TP14R	166	/* LT-TP-rel. address, right 14 bits.*/
++#define R_PARISC_LTOFF_TP14F	167	/* 14 bits LT-TP-rel. address.  */
++#define R_PARISC_TPREL64	216	/* 64 bits TP-rel. address.  */
++#define R_PARISC_TPREL14WR	219	/* TP-rel. address, right 14 bits.  */
++#define R_PARISC_TPREL14DR	220	/* TP-rel. address, right 14 bits.  */
++#define R_PARISC_TPREL16F	221	/* 16 bits TP-rel. address.  */
++#define R_PARISC_TPREL16WF	222	/* 16 bits TP-rel. address.  */
++#define R_PARISC_TPREL16DF	223	/* 16 bits TP-rel. address.  */
++#define R_PARISC_LTOFF_TP64	224	/* 64 bits LT-TP-rel. address.  */
++#define R_PARISC_LTOFF_TP14WR	227	/* LT-TP-rel. address, right 14 bits.*/
++#define R_PARISC_LTOFF_TP14DR	228	/* LT-TP-rel. address, right 14 bits.*/
++#define R_PARISC_LTOFF_TP16F	229	/* 16 bits LT-TP-rel. address.  */
++#define R_PARISC_LTOFF_TP16WF	230	/* 16 bits LT-TP-rel. address.  */
++#define R_PARISC_LTOFF_TP16DF	231	/* 16 bits LT-TP-rel. address.  */
++#define R_PARISC_GNU_VTENTRY	232
++#define R_PARISC_GNU_VTINHERIT	233
++#define R_PARISC_TLS_GD21L	234	/* GD 21-bit left.  */
++#define R_PARISC_TLS_GD14R	235	/* GD 14-bit right.  */
++#define R_PARISC_TLS_GDCALL	236	/* GD call to __t_g_a.  */
++#define R_PARISC_TLS_LDM21L	237	/* LD module 21-bit left.  */
++#define R_PARISC_TLS_LDM14R	238	/* LD module 14-bit right.  */
++#define R_PARISC_TLS_LDMCALL	239	/* LD module call to __t_g_a.  */
++#define R_PARISC_TLS_LDO21L	240	/* LD offset 21-bit left.  */
++#define R_PARISC_TLS_LDO14R	241	/* LD offset 14-bit right.  */
++#define R_PARISC_TLS_DTPMOD32	242	/* DTP module 32-bit.  */
++#define R_PARISC_TLS_DTPMOD64	243	/* DTP module 64-bit.  */
++#define R_PARISC_TLS_DTPOFF32	244	/* DTP offset 32-bit.  */
++#define R_PARISC_TLS_DTPOFF64	245	/* DTP offset 32-bit.  */
++#define R_PARISC_TLS_LE21L	R_PARISC_TPREL21L
++#define R_PARISC_TLS_LE14R	R_PARISC_TPREL14R
++#define R_PARISC_TLS_IE21L	R_PARISC_LTOFF_TP21L
++#define R_PARISC_TLS_IE14R	R_PARISC_LTOFF_TP14R
++#define R_PARISC_TLS_TPREL32	R_PARISC_TPREL32
++#define R_PARISC_TLS_TPREL64	R_PARISC_TPREL64
++#define R_PARISC_HIRESERVE	255
++
++/* Legal values for p_type field of Elf32_Phdr/Elf64_Phdr.  */
++
++#define PT_HP_TLS		(PT_LOOS + 0x0)
++#define PT_HP_CORE_NONE		(PT_LOOS + 0x1)
++#define PT_HP_CORE_VERSION	(PT_LOOS + 0x2)
++#define PT_HP_CORE_KERNEL	(PT_LOOS + 0x3)
++#define PT_HP_CORE_COMM		(PT_LOOS + 0x4)
++#define PT_HP_CORE_PROC		(PT_LOOS + 0x5)
++#define PT_HP_CORE_LOADABLE	(PT_LOOS + 0x6)
++#define PT_HP_CORE_STACK	(PT_LOOS + 0x7)
++#define PT_HP_CORE_SHM		(PT_LOOS + 0x8)
++#define PT_HP_CORE_MMF		(PT_LOOS + 0x9)
++#define PT_HP_PARALLEL		(PT_LOOS + 0x10)
++#define PT_HP_FASTBIND		(PT_LOOS + 0x11)
++#define PT_HP_OPT_ANNOT		(PT_LOOS + 0x12)
++#define PT_HP_HSL_ANNOT		(PT_LOOS + 0x13)
++#define PT_HP_STACK		(PT_LOOS + 0x14)
++
++#define PT_PARISC_ARCHEXT	0x70000000
++#define PT_PARISC_UNWIND	0x70000001
++
++/* Legal values for p_flags field of Elf32_Phdr/Elf64_Phdr.  */
++
++#define PF_PARISC_SBP		0x08000000
++
++#define PF_HP_PAGE_SIZE		0x00100000
++#define PF_HP_FAR_SHARED	0x00200000
++#define PF_HP_NEAR_SHARED	0x00400000
++#define PF_HP_CODE		0x01000000
++#define PF_HP_MODIFY		0x02000000
++#define PF_HP_LAZYSWAP		0x04000000
++#define PF_HP_SBP		0x08000000
++
++
++/* Alpha specific definitions.  */
++
++/* Legal values for e_flags field of Elf64_Ehdr.  */
++
++#define EF_ALPHA_32BIT		1	/* All addresses must be < 2GB.  */
++#define EF_ALPHA_CANRELAX	2	/* Relocations for relaxing exist.  */
++
++/* Legal values for sh_type field of Elf64_Shdr.  */
++
++/* These two are primerily concerned with ECOFF debugging info.  */
++#define SHT_ALPHA_DEBUG		0x70000001
++#define SHT_ALPHA_REGINFO	0x70000002
++
++/* Legal values for sh_flags field of Elf64_Shdr.  */
++
++#define SHF_ALPHA_GPREL		0x10000000
++
++/* Legal values for st_other field of Elf64_Sym.  */
++#define STO_ALPHA_NOPV		0x80	/* No PV required.  */
++#define STO_ALPHA_STD_GPLOAD	0x88	/* PV only used for initial ldgp.  */
++
++/* Alpha relocs.  */
++
++#define R_ALPHA_NONE		0	/* No reloc */
++#define R_ALPHA_REFLONG		1	/* Direct 32 bit */
++#define R_ALPHA_REFQUAD		2	/* Direct 64 bit */
++#define R_ALPHA_GPREL32		3	/* GP relative 32 bit */
++#define R_ALPHA_LITERAL		4	/* GP relative 16 bit w/optimization */
++#define R_ALPHA_LITUSE		5	/* Optimization hint for LITERAL */
++#define R_ALPHA_GPDISP		6	/* Add displacement to GP */
++#define R_ALPHA_BRADDR		7	/* PC+4 relative 23 bit shifted */
++#define R_ALPHA_HINT		8	/* PC+4 relative 16 bit shifted */
++#define R_ALPHA_SREL16		9	/* PC relative 16 bit */
++#define R_ALPHA_SREL32		10	/* PC relative 32 bit */
++#define R_ALPHA_SREL64		11	/* PC relative 64 bit */
++#define R_ALPHA_GPRELHIGH	17	/* GP relative 32 bit, high 16 bits */
++#define R_ALPHA_GPRELLOW	18	/* GP relative 32 bit, low 16 bits */
++#define R_ALPHA_GPREL16		19	/* GP relative 16 bit */
++#define R_ALPHA_COPY		24	/* Copy symbol at runtime */
++#define R_ALPHA_GLOB_DAT	25	/* Create GOT entry */
++#define R_ALPHA_JMP_SLOT	26	/* Create PLT entry */
++#define R_ALPHA_RELATIVE	27	/* Adjust by program base */
++#define R_ALPHA_TLS_GD_HI	28
++#define R_ALPHA_TLSGD		29
++#define R_ALPHA_TLS_LDM		30
++#define R_ALPHA_DTPMOD64	31
++#define R_ALPHA_GOTDTPREL	32
++#define R_ALPHA_DTPREL64	33
++#define R_ALPHA_DTPRELHI	34
++#define R_ALPHA_DTPRELLO	35
++#define R_ALPHA_DTPREL16	36
++#define R_ALPHA_GOTTPREL	37
++#define R_ALPHA_TPREL64		38
++#define R_ALPHA_TPRELHI		39
++#define R_ALPHA_TPRELLO		40
++#define R_ALPHA_TPREL16		41
++/* Keep this the last entry.  */
++#define R_ALPHA_NUM		46
++
++/* Magic values of the LITUSE relocation addend.  */
++#define LITUSE_ALPHA_ADDR	0
++#define LITUSE_ALPHA_BASE	1
++#define LITUSE_ALPHA_BYTOFF	2
++#define LITUSE_ALPHA_JSR	3
++#define LITUSE_ALPHA_TLS_GD	4
++#define LITUSE_ALPHA_TLS_LDM	5
++
++/* Legal values for d_tag of Elf64_Dyn.  */
++#define DT_ALPHA_PLTRO		(DT_LOPROC + 0)
++#define DT_ALPHA_NUM		1
++
++/* PowerPC specific declarations */
++
++/* Values for Elf32/64_Ehdr.e_flags.  */
++#define EF_PPC_EMB		0x80000000	/* PowerPC embedded flag */
++
++/* Cygnus local bits below */
++#define EF_PPC_RELOCATABLE	0x00010000	/* PowerPC -mrelocatable flag*/
++#define EF_PPC_RELOCATABLE_LIB	0x00008000	/* PowerPC -mrelocatable-lib
++						   flag */
++
++/* PowerPC relocations defined by the ABIs */
++#define R_PPC_NONE		0
++#define R_PPC_ADDR32		1	/* 32bit absolute address */
++#define R_PPC_ADDR24		2	/* 26bit address, 2 bits ignored.  */
++#define R_PPC_ADDR16		3	/* 16bit absolute address */
++#define R_PPC_ADDR16_LO		4	/* lower 16bit of absolute address */
++#define R_PPC_ADDR16_HI		5	/* high 16bit of absolute address */
++#define R_PPC_ADDR16_HA		6	/* adjusted high 16bit */
++#define R_PPC_ADDR14		7	/* 16bit address, 2 bits ignored */
++#define R_PPC_ADDR14_BRTAKEN	8
++#define R_PPC_ADDR14_BRNTAKEN	9
++#define R_PPC_REL24		10	/* PC relative 26 bit */
++#define R_PPC_REL14		11	/* PC relative 16 bit */
++#define R_PPC_REL14_BRTAKEN	12
++#define R_PPC_REL14_BRNTAKEN	13
++#define R_PPC_GOT16		14
++#define R_PPC_GOT16_LO		15
++#define R_PPC_GOT16_HI		16
++#define R_PPC_GOT16_HA		17
++#define R_PPC_PLTREL24		18
++#define R_PPC_COPY		19
++#define R_PPC_GLOB_DAT		20
++#define R_PPC_JMP_SLOT		21
++#define R_PPC_RELATIVE		22
++#define R_PPC_LOCAL24PC		23
++#define R_PPC_UADDR32		24
++#define R_PPC_UADDR16		25
++#define R_PPC_REL32		26
++#define R_PPC_PLT32		27
++#define R_PPC_PLTREL32		28
++#define R_PPC_PLT16_LO		29
++#define R_PPC_PLT16_HI		30
++#define R_PPC_PLT16_HA		31
++#define R_PPC_SDAREL16		32
++#define R_PPC_SECTOFF		33
++#define R_PPC_SECTOFF_LO	34
++#define R_PPC_SECTOFF_HI	35
++#define R_PPC_SECTOFF_HA	36
++
++/* PowerPC relocations defined for the TLS access ABI.  */
++#define R_PPC_TLS		67 /* none	(sym+add)@tls */
++#define R_PPC_DTPMOD32		68 /* word32	(sym+add)@dtpmod */
++#define R_PPC_TPREL16		69 /* half16*	(sym+add)@tprel */
++#define R_PPC_TPREL16_LO	70 /* half16	(sym+add)@tprel@l */
++#define R_PPC_TPREL16_HI	71 /* half16	(sym+add)@tprel@h */
++#define R_PPC_TPREL16_HA	72 /* half16	(sym+add)@tprel@ha */
++#define R_PPC_TPREL32		73 /* word32	(sym+add)@tprel */
++#define R_PPC_DTPREL16		74 /* half16*	(sym+add)@dtprel */
++#define R_PPC_DTPREL16_LO	75 /* half16	(sym+add)@dtprel@l */
++#define R_PPC_DTPREL16_HI	76 /* half16	(sym+add)@dtprel@h */
++#define R_PPC_DTPREL16_HA	77 /* half16	(sym+add)@dtprel@ha */
++#define R_PPC_DTPREL32		78 /* word32	(sym+add)@dtprel */
++#define R_PPC_GOT_TLSGD16	79 /* half16*	(sym+add)@got@tlsgd */
++#define R_PPC_GOT_TLSGD16_LO	80 /* half16	(sym+add)@got@tlsgd@l */
++#define R_PPC_GOT_TLSGD16_HI	81 /* half16	(sym+add)@got@tlsgd@h */
++#define R_PPC_GOT_TLSGD16_HA	82 /* half16	(sym+add)@got@tlsgd@ha */
++#define R_PPC_GOT_TLSLD16	83 /* half16*	(sym+add)@got@tlsld */
++#define R_PPC_GOT_TLSLD16_LO	84 /* half16	(sym+add)@got@tlsld@l */
++#define R_PPC_GOT_TLSLD16_HI	85 /* half16	(sym+add)@got@tlsld@h */
++#define R_PPC_GOT_TLSLD16_HA	86 /* half16	(sym+add)@got@tlsld@ha */
++#define R_PPC_GOT_TPREL16	87 /* half16*	(sym+add)@got@tprel */
++#define R_PPC_GOT_TPREL16_LO	88 /* half16	(sym+add)@got@tprel@l */
++#define R_PPC_GOT_TPREL16_HI	89 /* half16	(sym+add)@got@tprel@h */
++#define R_PPC_GOT_TPREL16_HA	90 /* half16	(sym+add)@got@tprel@ha */
++#define R_PPC_GOT_DTPREL16	91 /* half16*	(sym+add)@got@dtprel */
++#define R_PPC_GOT_DTPREL16_LO	92 /* half16*	(sym+add)@got@dtprel@l */
++#define R_PPC_GOT_DTPREL16_HI	93 /* half16*	(sym+add)@got@dtprel@h */
++#define R_PPC_GOT_DTPREL16_HA	94 /* half16*	(sym+add)@got@dtprel@ha */
++
++/* The remaining relocs are from the Embedded ELF ABI, and are not
++   in the SVR4 ELF ABI.  */
++#define R_PPC_EMB_NADDR32	101
++#define R_PPC_EMB_NADDR16	102
++#define R_PPC_EMB_NADDR16_LO	103
++#define R_PPC_EMB_NADDR16_HI	104
++#define R_PPC_EMB_NADDR16_HA	105
++#define R_PPC_EMB_SDAI16	106
++#define R_PPC_EMB_SDA2I16	107
++#define R_PPC_EMB_SDA2REL	108
++#define R_PPC_EMB_SDA21		109	/* 16 bit offset in SDA */
++#define R_PPC_EMB_MRKREF	110
++#define R_PPC_EMB_RELSEC16	111
++#define R_PPC_EMB_RELST_LO	112
++#define R_PPC_EMB_RELST_HI	113
++#define R_PPC_EMB_RELST_HA	114
++#define R_PPC_EMB_BIT_FLD	115
++#define R_PPC_EMB_RELSDA	116	/* 16 bit relative offset in SDA */
++
++/* Diab tool relocations.  */
++#define R_PPC_DIAB_SDA21_LO	180	/* like EMB_SDA21, but lower 16 bit */
++#define R_PPC_DIAB_SDA21_HI	181	/* like EMB_SDA21, but high 16 bit */
++#define R_PPC_DIAB_SDA21_HA	182	/* like EMB_SDA21, adjusted high 16 */
++#define R_PPC_DIAB_RELSDA_LO	183	/* like EMB_RELSDA, but lower 16 bit */
++#define R_PPC_DIAB_RELSDA_HI	184	/* like EMB_RELSDA, but high 16 bit */
++#define R_PPC_DIAB_RELSDA_HA	185	/* like EMB_RELSDA, adjusted high 16 */
++
++/* GNU extension to support local ifunc.  */
++#define R_PPC_IRELATIVE		248
++
++/* GNU relocs used in PIC code sequences.  */
++#define R_PPC_REL16		249	/* half16   (sym+add-.) */
++#define R_PPC_REL16_LO		250	/* half16   (sym+add-.)@l */
++#define R_PPC_REL16_HI		251	/* half16   (sym+add-.)@h */
++#define R_PPC_REL16_HA		252	/* half16   (sym+add-.)@ha */
++
++/* This is a phony reloc to handle any old fashioned TOC16 references
++   that may still be in object files.  */
++#define R_PPC_TOC16		255
++
++/* PowerPC specific values for the Dyn d_tag field.  */
++#define DT_PPC_GOT		(DT_LOPROC + 0)
++#define DT_PPC_NUM		1
++
++/* PowerPC64 relocations defined by the ABIs */
++#define R_PPC64_NONE		R_PPC_NONE
++#define R_PPC64_ADDR32		R_PPC_ADDR32 /* 32bit absolute address */
++#define R_PPC64_ADDR24		R_PPC_ADDR24 /* 26bit address, word aligned */
++#define R_PPC64_ADDR16		R_PPC_ADDR16 /* 16bit absolute address */
++#define R_PPC64_ADDR16_LO	R_PPC_ADDR16_LO	/* lower 16bits of address */
++#define R_PPC64_ADDR16_HI	R_PPC_ADDR16_HI	/* high 16bits of address. */
++#define R_PPC64_ADDR16_HA	R_PPC_ADDR16_HA /* adjusted high 16bits.  */
++#define R_PPC64_ADDR14		R_PPC_ADDR14 /* 16bit address, word aligned */
++#define R_PPC64_ADDR14_BRTAKEN	R_PPC_ADDR14_BRTAKEN
++#define R_PPC64_ADDR14_BRNTAKEN	R_PPC_ADDR14_BRNTAKEN
++#define R_PPC64_REL24		R_PPC_REL24 /* PC-rel. 26 bit, word aligned */
++#define R_PPC64_REL14		R_PPC_REL14 /* PC relative 16 bit */
++#define R_PPC64_REL14_BRTAKEN	R_PPC_REL14_BRTAKEN
++#define R_PPC64_REL14_BRNTAKEN	R_PPC_REL14_BRNTAKEN
++#define R_PPC64_GOT16		R_PPC_GOT16
++#define R_PPC64_GOT16_LO	R_PPC_GOT16_LO
++#define R_PPC64_GOT16_HI	R_PPC_GOT16_HI
++#define R_PPC64_GOT16_HA	R_PPC_GOT16_HA
++
++#define R_PPC64_COPY		R_PPC_COPY
++#define R_PPC64_GLOB_DAT	R_PPC_GLOB_DAT
++#define R_PPC64_JMP_SLOT	R_PPC_JMP_SLOT
++#define R_PPC64_RELATIVE	R_PPC_RELATIVE
++
++#define R_PPC64_UADDR32		R_PPC_UADDR32
++#define R_PPC64_UADDR16		R_PPC_UADDR16
++#define R_PPC64_REL32		R_PPC_REL32
++#define R_PPC64_PLT32		R_PPC_PLT32
++#define R_PPC64_PLTREL32	R_PPC_PLTREL32
++#define R_PPC64_PLT16_LO	R_PPC_PLT16_LO
++#define R_PPC64_PLT16_HI	R_PPC_PLT16_HI
++#define R_PPC64_PLT16_HA	R_PPC_PLT16_HA
++
++#define R_PPC64_SECTOFF		R_PPC_SECTOFF
++#define R_PPC64_SECTOFF_LO	R_PPC_SECTOFF_LO
++#define R_PPC64_SECTOFF_HI	R_PPC_SECTOFF_HI
++#define R_PPC64_SECTOFF_HA	R_PPC_SECTOFF_HA
++#define R_PPC64_ADDR30		37 /* word30 (S + A - P) >> 2 */
++#define R_PPC64_ADDR64		38 /* doubleword64 S + A */
++#define R_PPC64_ADDR16_HIGHER	39 /* half16 #higher(S + A) */
++#define R_PPC64_ADDR16_HIGHERA	40 /* half16 #highera(S + A) */
++#define R_PPC64_ADDR16_HIGHEST	41 /* half16 #highest(S + A) */
++#define R_PPC64_ADDR16_HIGHESTA	42 /* half16 #highesta(S + A) */
++#define R_PPC64_UADDR64		43 /* doubleword64 S + A */
++#define R_PPC64_REL64		44 /* doubleword64 S + A - P */
++#define R_PPC64_PLT64		45 /* doubleword64 L + A */
++#define R_PPC64_PLTREL64	46 /* doubleword64 L + A - P */
++#define R_PPC64_TOC16		47 /* half16* S + A - .TOC */
++#define R_PPC64_TOC16_LO	48 /* half16 #lo(S + A - .TOC.) */
++#define R_PPC64_TOC16_HI	49 /* half16 #hi(S + A - .TOC.) */
++#define R_PPC64_TOC16_HA	50 /* half16 #ha(S + A - .TOC.) */
++#define R_PPC64_TOC		51 /* doubleword64 .TOC */
++#define R_PPC64_PLTGOT16	52 /* half16* M + A */
++#define R_PPC64_PLTGOT16_LO	53 /* half16 #lo(M + A) */
++#define R_PPC64_PLTGOT16_HI	54 /* half16 #hi(M + A) */
++#define R_PPC64_PLTGOT16_HA	55 /* half16 #ha(M + A) */
++
++#define R_PPC64_ADDR16_DS	56 /* half16ds* (S + A) >> 2 */
++#define R_PPC64_ADDR16_LO_DS	57 /* half16ds  #lo(S + A) >> 2 */
++#define R_PPC64_GOT16_DS	58 /* half16ds* (G + A) >> 2 */
++#define R_PPC64_GOT16_LO_DS	59 /* half16ds  #lo(G + A) >> 2 */
++#define R_PPC64_PLT16_LO_DS	60 /* half16ds  #lo(L + A) >> 2 */
++#define R_PPC64_SECTOFF_DS	61 /* half16ds* (R + A) >> 2 */
++#define R_PPC64_SECTOFF_LO_DS	62 /* half16ds  #lo(R + A) >> 2 */
++#define R_PPC64_TOC16_DS	63 /* half16ds* (S + A - .TOC.) >> 2 */
++#define R_PPC64_TOC16_LO_DS	64 /* half16ds  #lo(S + A - .TOC.) >> 2 */
++#define R_PPC64_PLTGOT16_DS	65 /* half16ds* (M + A) >> 2 */
++#define R_PPC64_PLTGOT16_LO_DS	66 /* half16ds  #lo(M + A) >> 2 */
++
++/* PowerPC64 relocations defined for the TLS access ABI.  */
++#define R_PPC64_TLS		67 /* none	(sym+add)@tls */
++#define R_PPC64_DTPMOD64	68 /* doubleword64 (sym+add)@dtpmod */
++#define R_PPC64_TPREL16		69 /* half16*	(sym+add)@tprel */
++#define R_PPC64_TPREL16_LO	70 /* half16	(sym+add)@tprel@l */
++#define R_PPC64_TPREL16_HI	71 /* half16	(sym+add)@tprel@h */
++#define R_PPC64_TPREL16_HA	72 /* half16	(sym+add)@tprel@ha */
++#define R_PPC64_TPREL64		73 /* doubleword64 (sym+add)@tprel */
++#define R_PPC64_DTPREL16	74 /* half16*	(sym+add)@dtprel */
++#define R_PPC64_DTPREL16_LO	75 /* half16	(sym+add)@dtprel@l */
++#define R_PPC64_DTPREL16_HI	76 /* half16	(sym+add)@dtprel@h */
++#define R_PPC64_DTPREL16_HA	77 /* half16	(sym+add)@dtprel@ha */
++#define R_PPC64_DTPREL64	78 /* doubleword64 (sym+add)@dtprel */
++#define R_PPC64_GOT_TLSGD16	79 /* half16*	(sym+add)@got@tlsgd */
++#define R_PPC64_GOT_TLSGD16_LO	80 /* half16	(sym+add)@got@tlsgd@l */
++#define R_PPC64_GOT_TLSGD16_HI	81 /* half16	(sym+add)@got@tlsgd@h */
++#define R_PPC64_GOT_TLSGD16_HA	82 /* half16	(sym+add)@got@tlsgd@ha */
++#define R_PPC64_GOT_TLSLD16	83 /* half16*	(sym+add)@got@tlsld */
++#define R_PPC64_GOT_TLSLD16_LO	84 /* half16	(sym+add)@got@tlsld@l */
++#define R_PPC64_GOT_TLSLD16_HI	85 /* half16	(sym+add)@got@tlsld@h */
++#define R_PPC64_GOT_TLSLD16_HA	86 /* half16	(sym+add)@got@tlsld@ha */
++#define R_PPC64_GOT_TPREL16_DS	87 /* half16ds*	(sym+add)@got@tprel */
++#define R_PPC64_GOT_TPREL16_LO_DS 88 /* half16ds (sym+add)@got@tprel@l */
++#define R_PPC64_GOT_TPREL16_HI	89 /* half16	(sym+add)@got@tprel@h */
++#define R_PPC64_GOT_TPREL16_HA	90 /* half16	(sym+add)@got@tprel@ha */
++#define R_PPC64_GOT_DTPREL16_DS	91 /* half16ds*	(sym+add)@got@dtprel */
++#define R_PPC64_GOT_DTPREL16_LO_DS 92 /* half16ds (sym+add)@got@dtprel@l */
++#define R_PPC64_GOT_DTPREL16_HI	93 /* half16	(sym+add)@got@dtprel@h */
++#define R_PPC64_GOT_DTPREL16_HA	94 /* half16	(sym+add)@got@dtprel@ha */
++#define R_PPC64_TPREL16_DS	95 /* half16ds*	(sym+add)@tprel */
++#define R_PPC64_TPREL16_LO_DS	96 /* half16ds	(sym+add)@tprel@l */
++#define R_PPC64_TPREL16_HIGHER	97 /* half16	(sym+add)@tprel@higher */
++#define R_PPC64_TPREL16_HIGHERA	98 /* half16	(sym+add)@tprel@highera */
++#define R_PPC64_TPREL16_HIGHEST	99 /* half16	(sym+add)@tprel@highest */
++#define R_PPC64_TPREL16_HIGHESTA 100 /* half16	(sym+add)@tprel@highesta */
++#define R_PPC64_DTPREL16_DS	101 /* half16ds* (sym+add)@dtprel */
++#define R_PPC64_DTPREL16_LO_DS	102 /* half16ds	(sym+add)@dtprel@l */
++#define R_PPC64_DTPREL16_HIGHER	103 /* half16	(sym+add)@dtprel@higher */
++#define R_PPC64_DTPREL16_HIGHERA 104 /* half16	(sym+add)@dtprel@highera */
++#define R_PPC64_DTPREL16_HIGHEST 105 /* half16	(sym+add)@dtprel@highest */
++#define R_PPC64_DTPREL16_HIGHESTA 106 /* half16	(sym+add)@dtprel@highesta */
++
++/* GNU extension to support local ifunc.  */
++#define R_PPC64_JMP_IREL	247
++#define R_PPC64_IRELATIVE	248
++#define R_PPC64_REL16		249	/* half16   (sym+add-.) */
++#define R_PPC64_REL16_LO	250	/* half16   (sym+add-.)@l */
++#define R_PPC64_REL16_HI	251	/* half16   (sym+add-.)@h */
++#define R_PPC64_REL16_HA	252	/* half16   (sym+add-.)@ha */
++
++/* PowerPC64 specific values for the Dyn d_tag field.  */
++#define DT_PPC64_GLINK  (DT_LOPROC + 0)
++#define DT_PPC64_OPD	(DT_LOPROC + 1)
++#define DT_PPC64_OPDSZ	(DT_LOPROC + 2)
++#define DT_PPC64_NUM    3
++
++
++/* ARM specific declarations */
++
++/* Processor specific flags for the ELF header e_flags field.  */
++#define EF_ARM_RELEXEC		0x01
++#define EF_ARM_HASENTRY		0x02
++#define EF_ARM_INTERWORK	0x04
++#define EF_ARM_APCS_26		0x08
++#define EF_ARM_APCS_FLOAT	0x10
++#define EF_ARM_PIC		0x20
++#define EF_ARM_ALIGN8		0x40 /* 8-bit structure alignment is in use */
++#define EF_ARM_NEW_ABI		0x80
++#define EF_ARM_OLD_ABI		0x100
++#define EF_ARM_SOFT_FLOAT	0x200
++#define EF_ARM_VFP_FLOAT	0x400
++#define EF_ARM_MAVERICK_FLOAT	0x800
++
++
++/* Other constants defined in the ARM ELF spec. version B-01.  */
++/* NB. These conflict with values defined above.  */
++#define EF_ARM_SYMSARESORTED	0x04
++#define EF_ARM_DYNSYMSUSESEGIDX	0x08
++#define EF_ARM_MAPSYMSFIRST	0x10
++#define EF_ARM_EABIMASK		0XFF000000
++
++/* Constants defined in AAELF.  */
++#define EF_ARM_BE8	    0x00800000
++#define EF_ARM_LE8	    0x00400000
++
++#define EF_ARM_EABI_VERSION(flags)	((flags) & EF_ARM_EABIMASK)
++#define EF_ARM_EABI_UNKNOWN	0x00000000
++#define EF_ARM_EABI_VER1	0x01000000
++#define EF_ARM_EABI_VER2	0x02000000
++#define EF_ARM_EABI_VER3	0x03000000
++#define EF_ARM_EABI_VER4	0x04000000
++#define EF_ARM_EABI_VER5	0x05000000
++
++/* Additional symbol types for Thumb.  */
++#define STT_ARM_TFUNC		STT_LOPROC /* A Thumb function.  */
++#define STT_ARM_16BIT		STT_HIPROC /* A Thumb label.  */
++
++/* ARM-specific values for sh_flags */
++#define SHF_ARM_ENTRYSECT	0x10000000 /* Section contains an entry point */
++#define SHF_ARM_COMDEF		0x80000000 /* Section may be multiply defined
++					      in the input to a link step.  */
++
++/* ARM-specific program header flags */
++#define PF_ARM_SB		0x10000000 /* Segment contains the location
++					      addressed by the static base. */
++#define PF_ARM_PI		0x20000000 /* Position-independent segment.  */
++#define PF_ARM_ABS		0x40000000 /* Absolute segment.  */
++
++/* Processor specific values for the Phdr p_type field.  */
++#define PT_ARM_EXIDX		(PT_LOPROC + 1)	/* ARM unwind segment.  */
++
++/* Processor specific values for the Shdr sh_type field.  */
++#define SHT_ARM_EXIDX		(SHT_LOPROC + 1) /* ARM unwind section.  */
++#define SHT_ARM_PREEMPTMAP	(SHT_LOPROC + 2) /* Preemption details.  */
++#define SHT_ARM_ATTRIBUTES	(SHT_LOPROC + 3) /* ARM attributes section.  */
++
++
++/* ARM relocs.  */
++
++#define R_ARM_NONE		0	/* No reloc */
++#define R_ARM_PC24		1	/* PC relative 26 bit branch */
++#define R_ARM_ABS32		2	/* Direct 32 bit  */
++#define R_ARM_REL32		3	/* PC relative 32 bit */
++#define R_ARM_PC13		4
++#define R_ARM_ABS16		5	/* Direct 16 bit */
++#define R_ARM_ABS12		6	/* Direct 12 bit */
++#define R_ARM_THM_ABS5		7
++#define R_ARM_ABS8		8	/* Direct 8 bit */
++#define R_ARM_SBREL32		9
++#define R_ARM_THM_PC22		10
++#define R_ARM_THM_PC8		11
++#define R_ARM_AMP_VCALL9	12
++#define R_ARM_SWI24		13	/* Obsolete static relocation.  */
++#define R_ARM_TLS_DESC		13      /* Dynamic relocation.  */
++#define R_ARM_THM_SWI8		14
++#define R_ARM_XPC25		15
++#define R_ARM_THM_XPC22		16
++#define R_ARM_TLS_DTPMOD32	17	/* ID of module containing symbol */
++#define R_ARM_TLS_DTPOFF32	18	/* Offset in TLS block */
++#define R_ARM_TLS_TPOFF32	19	/* Offset in static TLS block */
++#define R_ARM_COPY		20	/* Copy symbol at runtime */
++#define R_ARM_GLOB_DAT		21	/* Create GOT entry */
++#define R_ARM_JUMP_SLOT		22	/* Create PLT entry */
++#define R_ARM_RELATIVE		23	/* Adjust by program base */
++#define R_ARM_GOTOFF		24	/* 32 bit offset to GOT */
++#define R_ARM_GOTPC		25	/* 32 bit PC relative offset to GOT */
++#define R_ARM_GOT32		26	/* 32 bit GOT entry */
++#define R_ARM_PLT32		27	/* 32 bit PLT address */
++#define R_ARM_ALU_PCREL_7_0	32
++#define R_ARM_ALU_PCREL_15_8	33
++#define R_ARM_ALU_PCREL_23_15	34
++#define R_ARM_LDR_SBREL_11_0	35
++#define R_ARM_ALU_SBREL_19_12	36
++#define R_ARM_ALU_SBREL_27_20	37
++#define R_ARM_TLS_GOTDESC	90
++#define R_ARM_TLS_CALL		91
++#define R_ARM_TLS_DESCSEQ	92
++#define R_ARM_THM_TLS_CALL	93
++#define R_ARM_GNU_VTENTRY	100
++#define R_ARM_GNU_VTINHERIT	101
++#define R_ARM_THM_PC11		102	/* thumb unconditional branch */
++#define R_ARM_THM_PC9		103	/* thumb conditional branch */
++#define R_ARM_TLS_GD32		104	/* PC-rel 32 bit for global dynamic
++					   thread local data */
++#define R_ARM_TLS_LDM32		105	/* PC-rel 32 bit for local dynamic
++					   thread local data */
++#define R_ARM_TLS_LDO32		106	/* 32 bit offset relative to TLS
++					   block */
++#define R_ARM_TLS_IE32		107	/* PC-rel 32 bit for GOT entry of
++					   static TLS block offset */
++#define R_ARM_TLS_LE32		108	/* 32 bit offset relative to static
++					   TLS block */
++#define	R_ARM_THM_TLS_DESCSEQ	129
++#define R_ARM_IRELATIVE		160
++#define R_ARM_RXPC25		249
++#define R_ARM_RSBREL32		250
++#define R_ARM_THM_RPC22		251
++#define R_ARM_RREL32		252
++#define R_ARM_RABS22		253
++#define R_ARM_RPC24		254
++#define R_ARM_RBASE		255
++/* Keep this the last entry.  */
++#define R_ARM_NUM		256
++
++/* IA-64 specific declarations.  */
++
++/* Processor specific flags for the Ehdr e_flags field.  */
++#define EF_IA_64_MASKOS		0x0000000f	/* os-specific flags */
++#define EF_IA_64_ABI64		0x00000010	/* 64-bit ABI */
++#define EF_IA_64_ARCH		0xff000000	/* arch. version mask */
++
++/* Processor specific values for the Phdr p_type field.  */
++#define PT_IA_64_ARCHEXT	(PT_LOPROC + 0)	/* arch extension bits */
++#define PT_IA_64_UNWIND		(PT_LOPROC + 1)	/* ia64 unwind bits */
++#define PT_IA_64_HP_OPT_ANOT	(PT_LOOS + 0x12)
++#define PT_IA_64_HP_HSL_ANOT	(PT_LOOS + 0x13)
++#define PT_IA_64_HP_STACK	(PT_LOOS + 0x14)
++
++/* Processor specific flags for the Phdr p_flags field.  */
++#define PF_IA_64_NORECOV	0x80000000	/* spec insns w/o recovery */
++
++/* Processor specific values for the Shdr sh_type field.  */
++#define SHT_IA_64_EXT		(SHT_LOPROC + 0) /* extension bits */
++#define SHT_IA_64_UNWIND	(SHT_LOPROC + 1) /* unwind bits */
++
++/* Processor specific flags for the Shdr sh_flags field.  */
++#define SHF_IA_64_SHORT		0x10000000	/* section near gp */
++#define SHF_IA_64_NORECOV	0x20000000	/* spec insns w/o recovery */
++
++/* Processor specific values for the Dyn d_tag field.  */
++#define DT_IA_64_PLT_RESERVE	(DT_LOPROC + 0)
++#define DT_IA_64_NUM		1
++
++/* IA-64 relocations.  */
++#define R_IA64_NONE		0x00	/* none */
++#define R_IA64_IMM14		0x21	/* symbol + addend, add imm14 */
++#define R_IA64_IMM22		0x22	/* symbol + addend, add imm22 */
++#define R_IA64_IMM64		0x23	/* symbol + addend, mov imm64 */
++#define R_IA64_DIR32MSB		0x24	/* symbol + addend, data4 MSB */
++#define R_IA64_DIR32LSB		0x25	/* symbol + addend, data4 LSB */
++#define R_IA64_DIR64MSB		0x26	/* symbol + addend, data8 MSB */
++#define R_IA64_DIR64LSB		0x27	/* symbol + addend, data8 LSB */
++#define R_IA64_GPREL22		0x2a	/* @gprel(sym + add), add imm22 */
++#define R_IA64_GPREL64I		0x2b	/* @gprel(sym + add), mov imm64 */
++#define R_IA64_GPREL32MSB	0x2c	/* @gprel(sym + add), data4 MSB */
++#define R_IA64_GPREL32LSB	0x2d	/* @gprel(sym + add), data4 LSB */
++#define R_IA64_GPREL64MSB	0x2e	/* @gprel(sym + add), data8 MSB */
++#define R_IA64_GPREL64LSB	0x2f	/* @gprel(sym + add), data8 LSB */
++#define R_IA64_LTOFF22		0x32	/* @ltoff(sym + add), add imm22 */
++#define R_IA64_LTOFF64I		0x33	/* @ltoff(sym + add), mov imm64 */
++#define R_IA64_PLTOFF22		0x3a	/* @pltoff(sym + add), add imm22 */
++#define R_IA64_PLTOFF64I	0x3b	/* @pltoff(sym + add), mov imm64 */
++#define R_IA64_PLTOFF64MSB	0x3e	/* @pltoff(sym + add), data8 MSB */
++#define R_IA64_PLTOFF64LSB	0x3f	/* @pltoff(sym + add), data8 LSB */
++#define R_IA64_FPTR64I		0x43	/* @fptr(sym + add), mov imm64 */
++#define R_IA64_FPTR32MSB	0x44	/* @fptr(sym + add), data4 MSB */
++#define R_IA64_FPTR32LSB	0x45	/* @fptr(sym + add), data4 LSB */
++#define R_IA64_FPTR64MSB	0x46	/* @fptr(sym + add), data8 MSB */
++#define R_IA64_FPTR64LSB	0x47	/* @fptr(sym + add), data8 LSB */
++#define R_IA64_PCREL60B		0x48	/* @pcrel(sym + add), brl */
++#define R_IA64_PCREL21B		0x49	/* @pcrel(sym + add), ptb, call */
++#define R_IA64_PCREL21M		0x4a	/* @pcrel(sym + add), chk.s */
++#define R_IA64_PCREL21F		0x4b	/* @pcrel(sym + add), fchkf */
++#define R_IA64_PCREL32MSB	0x4c	/* @pcrel(sym + add), data4 MSB */
++#define R_IA64_PCREL32LSB	0x4d	/* @pcrel(sym + add), data4 LSB */
++#define R_IA64_PCREL64MSB	0x4e	/* @pcrel(sym + add), data8 MSB */
++#define R_IA64_PCREL64LSB	0x4f	/* @pcrel(sym + add), data8 LSB */
++#define R_IA64_LTOFF_FPTR22	0x52	/* @ltoff(@fptr(s+a)), imm22 */
++#define R_IA64_LTOFF_FPTR64I	0x53	/* @ltoff(@fptr(s+a)), imm64 */
++#define R_IA64_LTOFF_FPTR32MSB	0x54	/* @ltoff(@fptr(s+a)), data4 MSB */
++#define R_IA64_LTOFF_FPTR32LSB	0x55	/* @ltoff(@fptr(s+a)), data4 LSB */
++#define R_IA64_LTOFF_FPTR64MSB	0x56	/* @ltoff(@fptr(s+a)), data8 MSB */
++#define R_IA64_LTOFF_FPTR64LSB	0x57	/* @ltoff(@fptr(s+a)), data8 LSB */
++#define R_IA64_SEGREL32MSB	0x5c	/* @segrel(sym + add), data4 MSB */
++#define R_IA64_SEGREL32LSB	0x5d	/* @segrel(sym + add), data4 LSB */
++#define R_IA64_SEGREL64MSB	0x5e	/* @segrel(sym + add), data8 MSB */
++#define R_IA64_SEGREL64LSB	0x5f	/* @segrel(sym + add), data8 LSB */
++#define R_IA64_SECREL32MSB	0x64	/* @secrel(sym + add), data4 MSB */
++#define R_IA64_SECREL32LSB	0x65	/* @secrel(sym + add), data4 LSB */
++#define R_IA64_SECREL64MSB	0x66	/* @secrel(sym + add), data8 MSB */
++#define R_IA64_SECREL64LSB	0x67	/* @secrel(sym + add), data8 LSB */
++#define R_IA64_REL32MSB		0x6c	/* data 4 + REL */
++#define R_IA64_REL32LSB		0x6d	/* data 4 + REL */
++#define R_IA64_REL64MSB		0x6e	/* data 8 + REL */
++#define R_IA64_REL64LSB		0x6f	/* data 8 + REL */
++#define R_IA64_LTV32MSB		0x74	/* symbol + addend, data4 MSB */
++#define R_IA64_LTV32LSB		0x75	/* symbol + addend, data4 LSB */
++#define R_IA64_LTV64MSB		0x76	/* symbol + addend, data8 MSB */
++#define R_IA64_LTV64LSB		0x77	/* symbol + addend, data8 LSB */
++#define R_IA64_PCREL21BI	0x79	/* @pcrel(sym + add), 21bit inst */
++#define R_IA64_PCREL22		0x7a	/* @pcrel(sym + add), 22bit inst */
++#define R_IA64_PCREL64I		0x7b	/* @pcrel(sym + add), 64bit inst */
++#define R_IA64_IPLTMSB		0x80	/* dynamic reloc, imported PLT, MSB */
++#define R_IA64_IPLTLSB		0x81	/* dynamic reloc, imported PLT, LSB */
++#define R_IA64_COPY		0x84	/* copy relocation */
++#define R_IA64_SUB		0x85	/* Addend and symbol difference */
++#define R_IA64_LTOFF22X		0x86	/* LTOFF22, relaxable.  */
++#define R_IA64_LDXMOV		0x87	/* Use of LTOFF22X.  */
++#define R_IA64_TPREL14		0x91	/* @tprel(sym + add), imm14 */
++#define R_IA64_TPREL22		0x92	/* @tprel(sym + add), imm22 */
++#define R_IA64_TPREL64I		0x93	/* @tprel(sym + add), imm64 */
++#define R_IA64_TPREL64MSB	0x96	/* @tprel(sym + add), data8 MSB */
++#define R_IA64_TPREL64LSB	0x97	/* @tprel(sym + add), data8 LSB */
++#define R_IA64_LTOFF_TPREL22	0x9a	/* @ltoff(@tprel(s+a)), imm2 */
++#define R_IA64_DTPMOD64MSB	0xa6	/* @dtpmod(sym + add), data8 MSB */
++#define R_IA64_DTPMOD64LSB	0xa7	/* @dtpmod(sym + add), data8 LSB */
++#define R_IA64_LTOFF_DTPMOD22	0xaa	/* @ltoff(@dtpmod(sym + add)), imm22 */
++#define R_IA64_DTPREL14		0xb1	/* @dtprel(sym + add), imm14 */
++#define R_IA64_DTPREL22		0xb2	/* @dtprel(sym + add), imm22 */
++#define R_IA64_DTPREL64I	0xb3	/* @dtprel(sym + add), imm64 */
++#define R_IA64_DTPREL32MSB	0xb4	/* @dtprel(sym + add), data4 MSB */
++#define R_IA64_DTPREL32LSB	0xb5	/* @dtprel(sym + add), data4 LSB */
++#define R_IA64_DTPREL64MSB	0xb6	/* @dtprel(sym + add), data8 MSB */
++#define R_IA64_DTPREL64LSB	0xb7	/* @dtprel(sym + add), data8 LSB */
++#define R_IA64_LTOFF_DTPREL22	0xba	/* @ltoff(@dtprel(s+a)), imm22 */
++
++/* SH specific declarations */
++
++/* Processor specific flags for the ELF header e_flags field.  */
++#define EF_SH_MACH_MASK		0x1f
++#define EF_SH_UNKNOWN		0x0
++#define EF_SH1			0x1
++#define EF_SH2			0x2
++#define EF_SH3			0x3
++#define EF_SH_DSP		0x4
++#define EF_SH3_DSP		0x5
++#define EF_SH4AL_DSP		0x6
++#define EF_SH3E			0x8
++#define EF_SH4			0x9
++#define EF_SH2E			0xb
++#define EF_SH4A			0xc
++#define EF_SH2A			0xd
++#define EF_SH4_NOFPU		0x10
++#define EF_SH4A_NOFPU		0x11
++#define EF_SH4_NOMMU_NOFPU	0x12
++#define EF_SH2A_NOFPU		0x13
++#define EF_SH3_NOMMU		0x14
++#define EF_SH2A_SH4_NOFPU	0x15
++#define EF_SH2A_SH3_NOFPU	0x16
++#define EF_SH2A_SH4		0x17
++#define EF_SH2A_SH3E		0x18
++
++/* SH relocs.  */
++#define	R_SH_NONE		0
++#define	R_SH_DIR32		1
++#define	R_SH_REL32		2
++#define	R_SH_DIR8WPN		3
++#define	R_SH_IND12W		4
++#define	R_SH_DIR8WPL		5
++#define	R_SH_DIR8WPZ		6
++#define	R_SH_DIR8BP		7
++#define	R_SH_DIR8W		8
++#define	R_SH_DIR8L		9
++#define	R_SH_SWITCH16		25
++#define	R_SH_SWITCH32		26
++#define	R_SH_USES		27
++#define	R_SH_COUNT		28
++#define	R_SH_ALIGN		29
++#define	R_SH_CODE		30
++#define	R_SH_DATA		31
++#define	R_SH_LABEL		32
++#define	R_SH_SWITCH8		33
++#define	R_SH_GNU_VTINHERIT	34
++#define	R_SH_GNU_VTENTRY	35
++#define	R_SH_TLS_GD_32		144
++#define	R_SH_TLS_LD_32		145
++#define	R_SH_TLS_LDO_32		146
++#define	R_SH_TLS_IE_32		147
++#define	R_SH_TLS_LE_32		148
++#define	R_SH_TLS_DTPMOD32	149
++#define	R_SH_TLS_DTPOFF32	150
++#define	R_SH_TLS_TPOFF32	151
++#define	R_SH_GOT32		160
++#define	R_SH_PLT32		161
++#define	R_SH_COPY		162
++#define	R_SH_GLOB_DAT		163
++#define	R_SH_JMP_SLOT		164
++#define	R_SH_RELATIVE		165
++#define	R_SH_GOTOFF		166
++#define	R_SH_GOTPC		167
++/* Keep this the last entry.  */
++#define	R_SH_NUM		256
++
++/* S/390 specific definitions.  */
++
++/* Valid values for the e_flags field.  */
++
++#define EF_S390_HIGH_GPRS    0x00000001  /* High GPRs kernel facility needed.  */
++
++/* Additional s390 relocs */
++
++#define R_390_NONE		0	/* No reloc.  */
++#define R_390_8			1	/* Direct 8 bit.  */
++#define R_390_12		2	/* Direct 12 bit.  */
++#define R_390_16		3	/* Direct 16 bit.  */
++#define R_390_32		4	/* Direct 32 bit.  */
++#define R_390_PC32		5	/* PC relative 32 bit.	*/
++#define R_390_GOT12		6	/* 12 bit GOT offset.  */
++#define R_390_GOT32		7	/* 32 bit GOT offset.  */
++#define R_390_PLT32		8	/* 32 bit PC relative PLT address.  */
++#define R_390_COPY		9	/* Copy symbol at runtime.  */
++#define R_390_GLOB_DAT		10	/* Create GOT entry.  */
++#define R_390_JMP_SLOT		11	/* Create PLT entry.  */
++#define R_390_RELATIVE		12	/* Adjust by program base.  */
++#define R_390_GOTOFF32		13	/* 32 bit offset to GOT.	 */
++#define R_390_GOTPC		14	/* 32 bit PC relative offset to GOT.  */
++#define R_390_GOT16		15	/* 16 bit GOT offset.  */
++#define R_390_PC16		16	/* PC relative 16 bit.	*/
++#define R_390_PC16DBL		17	/* PC relative 16 bit shifted by 1.  */
++#define R_390_PLT16DBL		18	/* 16 bit PC rel. PLT shifted by 1.  */
++#define R_390_PC32DBL		19	/* PC relative 32 bit shifted by 1.  */
++#define R_390_PLT32DBL		20	/* 32 bit PC rel. PLT shifted by 1.  */
++#define R_390_GOTPCDBL		21	/* 32 bit PC rel. GOT shifted by 1.  */
++#define R_390_64		22	/* Direct 64 bit.  */
++#define R_390_PC64		23	/* PC relative 64 bit.	*/
++#define R_390_GOT64		24	/* 64 bit GOT offset.  */
++#define R_390_PLT64		25	/* 64 bit PC relative PLT address.  */
++#define R_390_GOTENT		26	/* 32 bit PC rel. to GOT entry >> 1. */
++#define R_390_GOTOFF16		27	/* 16 bit offset to GOT. */
++#define R_390_GOTOFF64		28	/* 64 bit offset to GOT. */
++#define R_390_GOTPLT12		29	/* 12 bit offset to jump slot.	*/
++#define R_390_GOTPLT16		30	/* 16 bit offset to jump slot.	*/
++#define R_390_GOTPLT32		31	/* 32 bit offset to jump slot.	*/
++#define R_390_GOTPLT64		32	/* 64 bit offset to jump slot.	*/
++#define R_390_GOTPLTENT		33	/* 32 bit rel. offset to jump slot.  */
++#define R_390_PLTOFF16		34	/* 16 bit offset from GOT to PLT. */
++#define R_390_PLTOFF32		35	/* 32 bit offset from GOT to PLT. */
++#define R_390_PLTOFF64		36	/* 16 bit offset from GOT to PLT. */
++#define R_390_TLS_LOAD		37	/* Tag for load insn in TLS code.  */
++#define R_390_TLS_GDCALL	38	/* Tag for function call in general
++					   dynamic TLS code. */
++#define R_390_TLS_LDCALL	39	/* Tag for function call in local
++					   dynamic TLS code. */
++#define R_390_TLS_GD32		40	/* Direct 32 bit for general dynamic
++					   thread local data.  */
++#define R_390_TLS_GD64		41	/* Direct 64 bit for general dynamic
++					  thread local data.  */
++#define R_390_TLS_GOTIE12	42	/* 12 bit GOT offset for static TLS
++					   block offset.  */
++#define R_390_TLS_GOTIE32	43	/* 32 bit GOT offset for static TLS
++					   block offset.  */
++#define R_390_TLS_GOTIE64	44	/* 64 bit GOT offset for static TLS
++					   block offset. */
++#define R_390_TLS_LDM32		45	/* Direct 32 bit for local dynamic
++					   thread local data in LE code.  */
++#define R_390_TLS_LDM64		46	/* Direct 64 bit for local dynamic
++					   thread local data in LE code.  */
++#define R_390_TLS_IE32		47	/* 32 bit address of GOT entry for
++					   negated static TLS block offset.  */
++#define R_390_TLS_IE64		48	/* 64 bit address of GOT entry for
++					   negated static TLS block offset.  */
++#define R_390_TLS_IEENT		49	/* 32 bit rel. offset to GOT entry for
++					   negated static TLS block offset.  */
++#define R_390_TLS_LE32		50	/* 32 bit negated offset relative to
++					   static TLS block.  */
++#define R_390_TLS_LE64		51	/* 64 bit negated offset relative to
++					   static TLS block.  */
++#define R_390_TLS_LDO32		52	/* 32 bit offset relative to TLS
++					   block.  */
++#define R_390_TLS_LDO64		53	/* 64 bit offset relative to TLS
++					   block.  */
++#define R_390_TLS_DTPMOD	54	/* ID of module containing symbol.  */
++#define R_390_TLS_DTPOFF	55	/* Offset in TLS block.	 */
++#define R_390_TLS_TPOFF		56	/* Negated offset in static TLS
++					   block.  */
++#define R_390_20		57	/* Direct 20 bit.  */
++#define R_390_GOT20		58	/* 20 bit GOT offset.  */
++#define R_390_GOTPLT20		59	/* 20 bit offset to jump slot.  */
++#define R_390_TLS_GOTIE20	60	/* 20 bit GOT offset for static TLS
++					   block offset.  */
++#define R_390_IRELATIVE         61      /* STT_GNU_IFUNC relocation.  */
++/* Keep this the last entry.  */
++#define R_390_NUM		62
++
++
++/* CRIS relocations.  */
++#define R_CRIS_NONE		0
++#define R_CRIS_8		1
++#define R_CRIS_16		2
++#define R_CRIS_32		3
++#define R_CRIS_8_PCREL		4
++#define R_CRIS_16_PCREL		5
++#define R_CRIS_32_PCREL		6
++#define R_CRIS_GNU_VTINHERIT	7
++#define R_CRIS_GNU_VTENTRY	8
++#define R_CRIS_COPY		9
++#define R_CRIS_GLOB_DAT		10
++#define R_CRIS_JUMP_SLOT	11
++#define R_CRIS_RELATIVE		12
++#define R_CRIS_16_GOT		13
++#define R_CRIS_32_GOT		14
++#define R_CRIS_16_GOTPLT	15
++#define R_CRIS_32_GOTPLT	16
++#define R_CRIS_32_GOTREL	17
++#define R_CRIS_32_PLT_GOTREL	18
++#define R_CRIS_32_PLT_PCREL	19
++
++#define R_CRIS_NUM		20
++
++
++/* AMD x86-64 relocations.  */
++#define R_X86_64_NONE		0	/* No reloc */
++#define R_X86_64_64		1	/* Direct 64 bit  */
++#define R_X86_64_PC32		2	/* PC relative 32 bit signed */
++#define R_X86_64_GOT32		3	/* 32 bit GOT entry */
++#define R_X86_64_PLT32		4	/* 32 bit PLT address */
++#define R_X86_64_COPY		5	/* Copy symbol at runtime */
++#define R_X86_64_GLOB_DAT	6	/* Create GOT entry */
++#define R_X86_64_JUMP_SLOT	7	/* Create PLT entry */
++#define R_X86_64_RELATIVE	8	/* Adjust by program base */
++#define R_X86_64_GOTPCREL	9	/* 32 bit signed PC relative
++					   offset to GOT */
++#define R_X86_64_32		10	/* Direct 32 bit zero extended */
++#define R_X86_64_32S		11	/* Direct 32 bit sign extended */
++#define R_X86_64_16		12	/* Direct 16 bit zero extended */
++#define R_X86_64_PC16		13	/* 16 bit sign extended pc relative */
++#define R_X86_64_8		14	/* Direct 8 bit sign extended  */
++#define R_X86_64_PC8		15	/* 8 bit sign extended pc relative */
++#define R_X86_64_DTPMOD64	16	/* ID of module containing symbol */
++#define R_X86_64_DTPOFF64	17	/* Offset in module's TLS block */
++#define R_X86_64_TPOFF64	18	/* Offset in initial TLS block */
++#define R_X86_64_TLSGD		19	/* 32 bit signed PC relative offset
++					   to two GOT entries for GD symbol */
++#define R_X86_64_TLSLD		20	/* 32 bit signed PC relative offset
++					   to two GOT entries for LD symbol */
++#define R_X86_64_DTPOFF32	21	/* Offset in TLS block */
++#define R_X86_64_GOTTPOFF	22	/* 32 bit signed PC relative offset
++					   to GOT entry for IE symbol */
++#define R_X86_64_TPOFF32	23	/* Offset in initial TLS block */
++#define R_X86_64_PC64		24	/* PC relative 64 bit */
++#define R_X86_64_GOTOFF64	25	/* 64 bit offset to GOT */
++#define R_X86_64_GOTPC32	26	/* 32 bit signed pc relative
++					   offset to GOT */
++#define R_X86_64_GOT64		27	/* 64-bit GOT entry offset */
++#define R_X86_64_GOTPCREL64	28	/* 64-bit PC relative offset
++					   to GOT entry */
++#define R_X86_64_GOTPC64	29	/* 64-bit PC relative offset to GOT */
++#define R_X86_64_GOTPLT64	30 	/* like GOT64, says PLT entry needed */
++#define R_X86_64_PLTOFF64	31	/* 64-bit GOT relative offset
++					   to PLT entry */
++#define R_X86_64_SIZE32		32	/* Size of symbol plus 32-bit addend */
++#define R_X86_64_SIZE64		33	/* Size of symbol plus 64-bit addend */
++#define R_X86_64_GOTPC32_TLSDESC 34	/* GOT offset for TLS descriptor.  */
++#define R_X86_64_TLSDESC_CALL   35	/* Marker for call through TLS
++					   descriptor.  */
++#define R_X86_64_TLSDESC        36	/* TLS descriptor.  */
++#define R_X86_64_IRELATIVE	37	/* Adjust indirectly by program base */
++#define R_X86_64_RELATIVE64	38	/* 64-bit adjust by program base */
++
++#define R_X86_64_NUM		39
++
++
++/* AM33 relocations.  */
++#define R_MN10300_NONE		0	/* No reloc.  */
++#define R_MN10300_32		1	/* Direct 32 bit.  */
++#define R_MN10300_16		2	/* Direct 16 bit.  */
++#define R_MN10300_8		3	/* Direct 8 bit.  */
++#define R_MN10300_PCREL32	4	/* PC-relative 32-bit.  */
++#define R_MN10300_PCREL16	5	/* PC-relative 16-bit signed.  */
++#define R_MN10300_PCREL8	6	/* PC-relative 8-bit signed.  */
++#define R_MN10300_GNU_VTINHERIT	7	/* Ancient C++ vtable garbage... */
++#define R_MN10300_GNU_VTENTRY	8	/* ... collection annotation.  */
++#define R_MN10300_24		9	/* Direct 24 bit.  */
++#define R_MN10300_GOTPC32	10	/* 32-bit PCrel offset to GOT.  */
++#define R_MN10300_GOTPC16	11	/* 16-bit PCrel offset to GOT.  */
++#define R_MN10300_GOTOFF32	12	/* 32-bit offset from GOT.  */
++#define R_MN10300_GOTOFF24	13	/* 24-bit offset from GOT.  */
++#define R_MN10300_GOTOFF16	14	/* 16-bit offset from GOT.  */
++#define R_MN10300_PLT32		15	/* 32-bit PCrel to PLT entry.  */
++#define R_MN10300_PLT16		16	/* 16-bit PCrel to PLT entry.  */
++#define R_MN10300_GOT32		17	/* 32-bit offset to GOT entry.  */
++#define R_MN10300_GOT24		18	/* 24-bit offset to GOT entry.  */
++#define R_MN10300_GOT16		19	/* 16-bit offset to GOT entry.  */
++#define R_MN10300_COPY		20	/* Copy symbol at runtime.  */
++#define R_MN10300_GLOB_DAT	21	/* Create GOT entry.  */
++#define R_MN10300_JMP_SLOT	22	/* Create PLT entry.  */
++#define R_MN10300_RELATIVE	23	/* Adjust by program base.  */
++
++#define R_MN10300_NUM		24
++
++
++/* M32R relocs.  */
++#define R_M32R_NONE		0	/* No reloc. */
++#define R_M32R_16		1	/* Direct 16 bit. */
++#define R_M32R_32		2	/* Direct 32 bit. */
++#define R_M32R_24		3	/* Direct 24 bit. */
++#define R_M32R_10_PCREL		4	/* PC relative 10 bit shifted. */
++#define R_M32R_18_PCREL		5	/* PC relative 18 bit shifted. */
++#define R_M32R_26_PCREL		6	/* PC relative 26 bit shifted. */
++#define R_M32R_HI16_ULO		7	/* High 16 bit with unsigned low. */
++#define R_M32R_HI16_SLO		8	/* High 16 bit with signed low. */
++#define R_M32R_LO16		9	/* Low 16 bit. */
++#define R_M32R_SDA16		10	/* 16 bit offset in SDA. */
++#define R_M32R_GNU_VTINHERIT	11
++#define R_M32R_GNU_VTENTRY	12
++/* M32R relocs use SHT_RELA.  */
++#define R_M32R_16_RELA		33	/* Direct 16 bit. */
++#define R_M32R_32_RELA		34	/* Direct 32 bit. */
++#define R_M32R_24_RELA		35	/* Direct 24 bit. */
++#define R_M32R_10_PCREL_RELA	36	/* PC relative 10 bit shifted. */
++#define R_M32R_18_PCREL_RELA	37	/* PC relative 18 bit shifted. */
++#define R_M32R_26_PCREL_RELA	38	/* PC relative 26 bit shifted. */
++#define R_M32R_HI16_ULO_RELA	39	/* High 16 bit with unsigned low */
++#define R_M32R_HI16_SLO_RELA	40	/* High 16 bit with signed low */
++#define R_M32R_LO16_RELA	41	/* Low 16 bit */
++#define R_M32R_SDA16_RELA	42	/* 16 bit offset in SDA */
++#define R_M32R_RELA_GNU_VTINHERIT	43
++#define R_M32R_RELA_GNU_VTENTRY	44
++#define R_M32R_REL32		45	/* PC relative 32 bit.  */
++
++#define R_M32R_GOT24		48	/* 24 bit GOT entry */
++#define R_M32R_26_PLTREL	49	/* 26 bit PC relative to PLT shifted */
++#define R_M32R_COPY		50	/* Copy symbol at runtime */
++#define R_M32R_GLOB_DAT		51	/* Create GOT entry */
++#define R_M32R_JMP_SLOT		52	/* Create PLT entry */
++#define R_M32R_RELATIVE		53	/* Adjust by program base */
++#define R_M32R_GOTOFF		54	/* 24 bit offset to GOT */
++#define R_M32R_GOTPC24		55	/* 24 bit PC relative offset to GOT */
++#define R_M32R_GOT16_HI_ULO	56	/* High 16 bit GOT entry with unsigned
++					   low */
++#define R_M32R_GOT16_HI_SLO	57	/* High 16 bit GOT entry with signed
++					   low */
++#define R_M32R_GOT16_LO		58	/* Low 16 bit GOT entry */
++#define R_M32R_GOTPC_HI_ULO	59	/* High 16 bit PC relative offset to
++					   GOT with unsigned low */
++#define R_M32R_GOTPC_HI_SLO	60	/* High 16 bit PC relative offset to
++					   GOT with signed low */
++#define R_M32R_GOTPC_LO		61	/* Low 16 bit PC relative offset to
++					   GOT */
++#define R_M32R_GOTOFF_HI_ULO	62	/* High 16 bit offset to GOT
++					   with unsigned low */
++#define R_M32R_GOTOFF_HI_SLO	63	/* High 16 bit offset to GOT
++					   with signed low */
++#define R_M32R_GOTOFF_LO	64	/* Low 16 bit offset to GOT */
++#define R_M32R_NUM		256	/* Keep this the last entry. */
++
++
++/* TILEPro relocations.  */
++#define R_TILEPRO_NONE		0	/* No reloc */
++#define R_TILEPRO_32		1	/* Direct 32 bit */
++#define R_TILEPRO_16		2	/* Direct 16 bit */
++#define R_TILEPRO_8		3	/* Direct 8 bit */
++#define R_TILEPRO_32_PCREL	4	/* PC relative 32 bit */
++#define R_TILEPRO_16_PCREL	5	/* PC relative 16 bit */
++#define R_TILEPRO_8_PCREL	6	/* PC relative 8 bit */
++#define R_TILEPRO_LO16		7	/* Low 16 bit */
++#define R_TILEPRO_HI16		8	/* High 16 bit */
++#define R_TILEPRO_HA16		9	/* High 16 bit, adjusted */
++#define R_TILEPRO_COPY		10	/* Copy relocation */
++#define R_TILEPRO_GLOB_DAT	11	/* Create GOT entry */
++#define R_TILEPRO_JMP_SLOT	12	/* Create PLT entry */
++#define R_TILEPRO_RELATIVE	13	/* Adjust by program base */
++#define R_TILEPRO_BROFF_X1	14	/* X1 pipe branch offset */
++#define R_TILEPRO_JOFFLONG_X1	15	/* X1 pipe jump offset */
++#define R_TILEPRO_JOFFLONG_X1_PLT 16	/* X1 pipe jump offset to PLT */
++#define R_TILEPRO_IMM8_X0	17	/* X0 pipe 8-bit */
++#define R_TILEPRO_IMM8_Y0	18	/* Y0 pipe 8-bit */
++#define R_TILEPRO_IMM8_X1	19	/* X1 pipe 8-bit */
++#define R_TILEPRO_IMM8_Y1	20	/* Y1 pipe 8-bit */
++#define R_TILEPRO_MT_IMM15_X1	21	/* X1 pipe mtspr */
++#define R_TILEPRO_MF_IMM15_X1	22	/* X1 pipe mfspr */
++#define R_TILEPRO_IMM16_X0	23	/* X0 pipe 16-bit */
++#define R_TILEPRO_IMM16_X1	24	/* X1 pipe 16-bit */
++#define R_TILEPRO_IMM16_X0_LO	25	/* X0 pipe low 16-bit */
++#define R_TILEPRO_IMM16_X1_LO	26	/* X1 pipe low 16-bit */
++#define R_TILEPRO_IMM16_X0_HI	27	/* X0 pipe high 16-bit */
++#define R_TILEPRO_IMM16_X1_HI	28	/* X1 pipe high 16-bit */
++#define R_TILEPRO_IMM16_X0_HA	29	/* X0 pipe high 16-bit, adjusted */
++#define R_TILEPRO_IMM16_X1_HA	30	/* X1 pipe high 16-bit, adjusted */
++#define R_TILEPRO_IMM16_X0_PCREL 31	/* X0 pipe PC relative 16 bit */
++#define R_TILEPRO_IMM16_X1_PCREL 32	/* X1 pipe PC relative 16 bit */
++#define R_TILEPRO_IMM16_X0_LO_PCREL 33	/* X0 pipe PC relative low 16 bit */
++#define R_TILEPRO_IMM16_X1_LO_PCREL 34	/* X1 pipe PC relative low 16 bit */
++#define R_TILEPRO_IMM16_X0_HI_PCREL 35	/* X0 pipe PC relative high 16 bit */
++#define R_TILEPRO_IMM16_X1_HI_PCREL 36	/* X1 pipe PC relative high 16 bit */
++#define R_TILEPRO_IMM16_X0_HA_PCREL 37	/* X0 pipe PC relative ha() 16 bit */
++#define R_TILEPRO_IMM16_X1_HA_PCREL 38	/* X1 pipe PC relative ha() 16 bit */
++#define R_TILEPRO_IMM16_X0_GOT	39	/* X0 pipe 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X1_GOT	40	/* X1 pipe 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X0_GOT_LO 41	/* X0 pipe low 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X1_GOT_LO 42	/* X1 pipe low 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X0_GOT_HI 43	/* X0 pipe high 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X1_GOT_HI 44	/* X1 pipe high 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X0_GOT_HA 45	/* X0 pipe ha() 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X1_GOT_HA 46	/* X1 pipe ha() 16-bit GOT offset */
++#define R_TILEPRO_MMSTART_X0	47	/* X0 pipe mm "start" */
++#define R_TILEPRO_MMEND_X0	48	/* X0 pipe mm "end" */
++#define R_TILEPRO_MMSTART_X1	49	/* X1 pipe mm "start" */
++#define R_TILEPRO_MMEND_X1	50	/* X1 pipe mm "end" */
++#define R_TILEPRO_SHAMT_X0	51	/* X0 pipe shift amount */
++#define R_TILEPRO_SHAMT_X1	52	/* X1 pipe shift amount */
++#define R_TILEPRO_SHAMT_Y0	53	/* Y0 pipe shift amount */
++#define R_TILEPRO_SHAMT_Y1	54	/* Y1 pipe shift amount */
++#define R_TILEPRO_DEST_IMM8_X1	55	/* X1 pipe destination 8-bit */
++/* Relocs 56-59 are currently not defined.  */
++#define R_TILEPRO_TLS_GD_CALL	60	/* "jal" for TLS GD */
++#define R_TILEPRO_IMM8_X0_TLS_GD_ADD 61	/* X0 pipe "addi" for TLS GD */
++#define R_TILEPRO_IMM8_X1_TLS_GD_ADD 62	/* X1 pipe "addi" for TLS GD */
++#define R_TILEPRO_IMM8_Y0_TLS_GD_ADD 63	/* Y0 pipe "addi" for TLS GD */
++#define R_TILEPRO_IMM8_Y1_TLS_GD_ADD 64	/* Y1 pipe "addi" for TLS GD */
++#define R_TILEPRO_TLS_IE_LOAD	65	/* "lw_tls" for TLS IE */
++#define R_TILEPRO_IMM16_X0_TLS_GD 66	/* X0 pipe 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X1_TLS_GD 67	/* X1 pipe 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X0_TLS_GD_LO 68	/* X0 pipe low 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X1_TLS_GD_LO 69	/* X1 pipe low 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X0_TLS_GD_HI 70	/* X0 pipe high 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X1_TLS_GD_HI 71	/* X1 pipe high 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X0_TLS_GD_HA 72	/* X0 pipe ha() 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X1_TLS_GD_HA 73	/* X1 pipe ha() 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X0_TLS_IE 74	/* X0 pipe 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X1_TLS_IE 75	/* X1 pipe 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X0_TLS_IE_LO 76	/* X0 pipe low 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X1_TLS_IE_LO 77	/* X1 pipe low 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X0_TLS_IE_HI 78	/* X0 pipe high 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X1_TLS_IE_HI 79	/* X1 pipe high 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X0_TLS_IE_HA 80	/* X0 pipe ha() 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X1_TLS_IE_HA 81	/* X1 pipe ha() 16-bit TLS IE offset */
++#define R_TILEPRO_TLS_DTPMOD32	82	/* ID of module containing symbol */
++#define R_TILEPRO_TLS_DTPOFF32	83	/* Offset in TLS block */
++#define R_TILEPRO_TLS_TPOFF32	84	/* Offset in static TLS block */
++#define R_TILEPRO_IMM16_X0_TLS_LE 85	/* X0 pipe 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X1_TLS_LE 86	/* X1 pipe 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X0_TLS_LE_LO 87	/* X0 pipe low 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X1_TLS_LE_LO 88	/* X1 pipe low 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X0_TLS_LE_HI 89	/* X0 pipe high 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X1_TLS_LE_HI 90	/* X1 pipe high 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X0_TLS_LE_HA 91	/* X0 pipe ha() 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X1_TLS_LE_HA 92	/* X1 pipe ha() 16-bit TLS LE offset */
++
++#define R_TILEPRO_GNU_VTINHERIT	128	/* GNU C++ vtable hierarchy */
++#define R_TILEPRO_GNU_VTENTRY	129	/* GNU C++ vtable member usage */
++
++#define R_TILEPRO_NUM		130
++
++
++/* TILE-Gx relocations.  */
++#define R_TILEGX_NONE		0	/* No reloc */
++#define R_TILEGX_64		1	/* Direct 64 bit */
++#define R_TILEGX_32		2	/* Direct 32 bit */
++#define R_TILEGX_16		3	/* Direct 16 bit */
++#define R_TILEGX_8		4	/* Direct 8 bit */
++#define R_TILEGX_64_PCREL	5	/* PC relative 64 bit */
++#define R_TILEGX_32_PCREL	6	/* PC relative 32 bit */
++#define R_TILEGX_16_PCREL	7	/* PC relative 16 bit */
++#define R_TILEGX_8_PCREL	8	/* PC relative 8 bit */
++#define R_TILEGX_HW0		9	/* hword 0 16-bit */
++#define R_TILEGX_HW1		10	/* hword 1 16-bit */
++#define R_TILEGX_HW2		11	/* hword 2 16-bit */
++#define R_TILEGX_HW3		12	/* hword 3 16-bit */
++#define R_TILEGX_HW0_LAST	13	/* last hword 0 16-bit */
++#define R_TILEGX_HW1_LAST	14	/* last hword 1 16-bit */
++#define R_TILEGX_HW2_LAST	15	/* last hword 2 16-bit */
++#define R_TILEGX_COPY		16	/* Copy relocation */
++#define R_TILEGX_GLOB_DAT	17	/* Create GOT entry */
++#define R_TILEGX_JMP_SLOT	18	/* Create PLT entry */
++#define R_TILEGX_RELATIVE	19	/* Adjust by program base */
++#define R_TILEGX_BROFF_X1	20	/* X1 pipe branch offset */
++#define R_TILEGX_JUMPOFF_X1	21	/* X1 pipe jump offset */
++#define R_TILEGX_JUMPOFF_X1_PLT	22	/* X1 pipe jump offset to PLT */
++#define R_TILEGX_IMM8_X0	23	/* X0 pipe 8-bit */
++#define R_TILEGX_IMM8_Y0	24	/* Y0 pipe 8-bit */
++#define R_TILEGX_IMM8_X1	25	/* X1 pipe 8-bit */
++#define R_TILEGX_IMM8_Y1	26	/* Y1 pipe 8-bit */
++#define R_TILEGX_DEST_IMM8_X1	27	/* X1 pipe destination 8-bit */
++#define R_TILEGX_MT_IMM14_X1	28	/* X1 pipe mtspr */
++#define R_TILEGX_MF_IMM14_X1	29	/* X1 pipe mfspr */
++#define R_TILEGX_MMSTART_X0	30	/* X0 pipe mm "start" */
++#define R_TILEGX_MMEND_X0	31	/* X0 pipe mm "end" */
++#define R_TILEGX_SHAMT_X0	32	/* X0 pipe shift amount */
++#define R_TILEGX_SHAMT_X1	33	/* X1 pipe shift amount */
++#define R_TILEGX_SHAMT_Y0	34	/* Y0 pipe shift amount */
++#define R_TILEGX_SHAMT_Y1	35	/* Y1 pipe shift amount */
++#define R_TILEGX_IMM16_X0_HW0	36	/* X0 pipe hword 0 */
++#define R_TILEGX_IMM16_X1_HW0	37	/* X1 pipe hword 0 */
++#define R_TILEGX_IMM16_X0_HW1	38	/* X0 pipe hword 1 */
++#define R_TILEGX_IMM16_X1_HW1	39	/* X1 pipe hword 1 */
++#define R_TILEGX_IMM16_X0_HW2	40	/* X0 pipe hword 2 */
++#define R_TILEGX_IMM16_X1_HW2	41	/* X1 pipe hword 2 */
++#define R_TILEGX_IMM16_X0_HW3	42	/* X0 pipe hword 3 */
++#define R_TILEGX_IMM16_X1_HW3	43	/* X1 pipe hword 3 */
++#define R_TILEGX_IMM16_X0_HW0_LAST 44	/* X0 pipe last hword 0 */
++#define R_TILEGX_IMM16_X1_HW0_LAST 45	/* X1 pipe last hword 0 */
++#define R_TILEGX_IMM16_X0_HW1_LAST 46	/* X0 pipe last hword 1 */
++#define R_TILEGX_IMM16_X1_HW1_LAST 47	/* X1 pipe last hword 1 */
++#define R_TILEGX_IMM16_X0_HW2_LAST 48	/* X0 pipe last hword 2 */
++#define R_TILEGX_IMM16_X1_HW2_LAST 49	/* X1 pipe last hword 2 */
++#define R_TILEGX_IMM16_X0_HW0_PCREL 50	/* X0 pipe PC relative hword 0 */
++#define R_TILEGX_IMM16_X1_HW0_PCREL 51	/* X1 pipe PC relative hword 0 */
++#define R_TILEGX_IMM16_X0_HW1_PCREL 52	/* X0 pipe PC relative hword 1 */
++#define R_TILEGX_IMM16_X1_HW1_PCREL 53	/* X1 pipe PC relative hword 1 */
++#define R_TILEGX_IMM16_X0_HW2_PCREL 54	/* X0 pipe PC relative hword 2 */
++#define R_TILEGX_IMM16_X1_HW2_PCREL 55	/* X1 pipe PC relative hword 2 */
++#define R_TILEGX_IMM16_X0_HW3_PCREL 56	/* X0 pipe PC relative hword 3 */
++#define R_TILEGX_IMM16_X1_HW3_PCREL 57	/* X1 pipe PC relative hword 3 */
++#define R_TILEGX_IMM16_X0_HW0_LAST_PCREL 58 /* X0 pipe PC-rel last hword 0 */
++#define R_TILEGX_IMM16_X1_HW0_LAST_PCREL 59 /* X1 pipe PC-rel last hword 0 */
++#define R_TILEGX_IMM16_X0_HW1_LAST_PCREL 60 /* X0 pipe PC-rel last hword 1 */
++#define R_TILEGX_IMM16_X1_HW1_LAST_PCREL 61 /* X1 pipe PC-rel last hword 1 */
++#define R_TILEGX_IMM16_X0_HW2_LAST_PCREL 62 /* X0 pipe PC-rel last hword 2 */
++#define R_TILEGX_IMM16_X1_HW2_LAST_PCREL 63 /* X1 pipe PC-rel last hword 2 */
++#define R_TILEGX_IMM16_X0_HW0_GOT 64	/* X0 pipe hword 0 GOT offset */
++#define R_TILEGX_IMM16_X1_HW0_GOT 65	/* X1 pipe hword 0 GOT offset */
++/* Relocs 66-71 are currently not defined.  */
++#define R_TILEGX_IMM16_X0_HW0_LAST_GOT 72 /* X0 pipe last hword 0 GOT offset */
++#define R_TILEGX_IMM16_X1_HW0_LAST_GOT 73 /* X1 pipe last hword 0 GOT offset */
++#define R_TILEGX_IMM16_X0_HW1_LAST_GOT 74 /* X0 pipe last hword 1 GOT offset */
++#define R_TILEGX_IMM16_X1_HW1_LAST_GOT 75 /* X1 pipe last hword 1 GOT offset */
++/* Relocs 76-77 are currently not defined.  */
++#define R_TILEGX_IMM16_X0_HW0_TLS_GD 78	/* X0 pipe hword 0 TLS GD offset */
++#define R_TILEGX_IMM16_X1_HW0_TLS_GD 79	/* X1 pipe hword 0 TLS GD offset */
++#define R_TILEGX_IMM16_X0_HW0_TLS_LE 80	/* X0 pipe hword 0 TLS LE offset */
++#define R_TILEGX_IMM16_X1_HW0_TLS_LE 81	/* X1 pipe hword 0 TLS LE offset */
++#define R_TILEGX_IMM16_X0_HW0_LAST_TLS_LE 82 /* X0 pipe last hword 0 LE off */
++#define R_TILEGX_IMM16_X1_HW0_LAST_TLS_LE 83 /* X1 pipe last hword 0 LE off */
++#define R_TILEGX_IMM16_X0_HW1_LAST_TLS_LE 84 /* X0 pipe last hword 1 LE off */
++#define R_TILEGX_IMM16_X1_HW1_LAST_TLS_LE 85 /* X1 pipe last hword 1 LE off */
++#define R_TILEGX_IMM16_X0_HW0_LAST_TLS_GD 86 /* X0 pipe last hword 0 GD off */
++#define R_TILEGX_IMM16_X1_HW0_LAST_TLS_GD 87 /* X1 pipe last hword 0 GD off */
++#define R_TILEGX_IMM16_X0_HW1_LAST_TLS_GD 88 /* X0 pipe last hword 1 GD off */
++#define R_TILEGX_IMM16_X1_HW1_LAST_TLS_GD 89 /* X1 pipe last hword 1 GD off */
++/* Relocs 90-91 are currently not defined.  */
++#define R_TILEGX_IMM16_X0_HW0_TLS_IE 92	/* X0 pipe hword 0 TLS IE offset */
++#define R_TILEGX_IMM16_X1_HW0_TLS_IE 93	/* X1 pipe hword 0 TLS IE offset */
++/* Relocs 94-99 are currently not defined.  */
++#define R_TILEGX_IMM16_X0_HW0_LAST_TLS_IE 100 /* X0 pipe last hword 0 IE off */
++#define R_TILEGX_IMM16_X1_HW0_LAST_TLS_IE 101 /* X1 pipe last hword 0 IE off */
++#define R_TILEGX_IMM16_X0_HW1_LAST_TLS_IE 102 /* X0 pipe last hword 1 IE off */
++#define R_TILEGX_IMM16_X1_HW1_LAST_TLS_IE 103 /* X1 pipe last hword 1 IE off */
++/* Relocs 104-105 are currently not defined.  */
++#define R_TILEGX_TLS_DTPMOD64	106	/* 64-bit ID of symbol's module */
++#define R_TILEGX_TLS_DTPOFF64	107	/* 64-bit offset in TLS block */
++#define R_TILEGX_TLS_TPOFF64	108	/* 64-bit offset in static TLS block */
++#define R_TILEGX_TLS_DTPMOD32	109	/* 32-bit ID of symbol's module */
++#define R_TILEGX_TLS_DTPOFF32	110	/* 32-bit offset in TLS block */
++#define R_TILEGX_TLS_TPOFF32	111	/* 32-bit offset in static TLS block */
++#define R_TILEGX_TLS_GD_CALL	112	/* "jal" for TLS GD */
++#define R_TILEGX_IMM8_X0_TLS_GD_ADD 113	/* X0 pipe "addi" for TLS GD */
++#define R_TILEGX_IMM8_X1_TLS_GD_ADD 114	/* X1 pipe "addi" for TLS GD */
++#define R_TILEGX_IMM8_Y0_TLS_GD_ADD 115	/* Y0 pipe "addi" for TLS GD */
++#define R_TILEGX_IMM8_Y1_TLS_GD_ADD 116	/* Y1 pipe "addi" for TLS GD */
++#define R_TILEGX_TLS_IE_LOAD	117	/* "ld_tls" for TLS IE */
++#define R_TILEGX_IMM8_X0_TLS_ADD 118	/* X0 pipe "addi" for TLS GD/IE */
++#define R_TILEGX_IMM8_X1_TLS_ADD 119	/* X1 pipe "addi" for TLS GD/IE */
++#define R_TILEGX_IMM8_Y0_TLS_ADD 120	/* Y0 pipe "addi" for TLS GD/IE */
++#define R_TILEGX_IMM8_Y1_TLS_ADD 121	/* Y1 pipe "addi" for TLS GD/IE */
++
++#define R_TILEGX_GNU_VTINHERIT	128	/* GNU C++ vtable hierarchy */
++#define R_TILEGX_GNU_VTENTRY	129	/* GNU C++ vtable member usage */
++
++#define R_TILEGX_NUM		130
++
++#endif	/* elf.h */
+--- a/scripts/mod/mk_elfconfig.c
++++ b/scripts/mod/mk_elfconfig.c
+@@ -2,7 +2,11 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
++#ifndef __APPLE__
+ #include <elf.h>
++#else
++#include "elf.h"
++#endif
+ 
+ int
+ main(int argc, char **argv)
+--- a/scripts/mod/modpost.h
++++ b/scripts/mod/modpost.h
+@@ -9,7 +9,11 @@
+ #include <sys/mman.h>
+ #include <fcntl.h>
+ #include <unistd.h>
++#if !(defined(__APPLE__) || defined(__CYGWIN__))
+ #include <elf.h>
++#else
++#include "elf.h"
++#endif
+ 
+ #include "list.h"
+ #include "elfconfig.h"
diff --git a/target/linux/generic/hack-6.1/211-darwin-uuid-typedef-clash.patch b/target/linux/generic/hack-6.1/211-darwin-uuid-typedef-clash.patch
new file mode 100644
index 00000000000000..50a6227148f4ea
--- /dev/null
+++ b/target/linux/generic/hack-6.1/211-darwin-uuid-typedef-clash.patch
@@ -0,0 +1,22 @@
+From e44fc2af1ddc452b6659d08c16973d65c73b7d0a Mon Sep 17 00:00:00 2001
+From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+Date: Wed, 5 Feb 2020 18:36:43 +0000
+Subject: [PATCH] file2alias: build on macos
+
+Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+---
+ scripts/mod/file2alias.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/scripts/mod/file2alias.c
++++ b/scripts/mod/file2alias.c
+@@ -38,6 +38,9 @@ typedef struct {
+ 	__u8 b[16];
+ } guid_t;
+ 
++#ifdef __APPLE__
++#define uuid_t compat_uuid_t
++#endif
+ /* backwards compatibility, don't use in new code */
+ typedef struct {
+ 	__u8 b[16];
diff --git a/target/linux/generic/hack-6.1/212-tools_portability.patch b/target/linux/generic/hack-6.1/212-tools_portability.patch
new file mode 100644
index 00000000000000..4b1c6c49839008
--- /dev/null
+++ b/target/linux/generic/hack-6.1/212-tools_portability.patch
@@ -0,0 +1,93 @@
+From 48232d3d931c95953ce2ddfe7da7bb164aef6a73 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 7 Jul 2017 17:03:16 +0200
+Subject: fix portability of some includes files in tools/ used on the host
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ tools/include/tools/be_byteshift.h |  4 ++++
+ tools/include/tools/le_byteshift.h |  4 ++++
+ tools/include/tools/linux_types.h  | 22 ++++++++++++++++++++++
+ 3 files changed, 30 insertions(+)
+ create mode 100644 tools/include/tools/linux_types.h
+
+--- a/tools/include/tools/be_byteshift.h
++++ b/tools/include/tools/be_byteshift.h
+@@ -2,6 +2,10 @@
+ #ifndef _TOOLS_BE_BYTESHIFT_H
+ #define _TOOLS_BE_BYTESHIFT_H
+ 
++#ifndef __linux__
++#include "linux_types.h"
++#endif
++
+ #include <stdint.h>
+ 
+ static inline uint16_t __get_unaligned_be16(const uint8_t *p)
+--- a/tools/include/tools/le_byteshift.h
++++ b/tools/include/tools/le_byteshift.h
+@@ -2,6 +2,10 @@
+ #ifndef _TOOLS_LE_BYTESHIFT_H
+ #define _TOOLS_LE_BYTESHIFT_H
+ 
++#ifndef __linux__
++#include "linux_types.h"
++#endif
++
+ #include <stdint.h>
+ 
+ static inline uint16_t __get_unaligned_le16(const uint8_t *p)
+--- /dev/null
++++ b/tools/include/tools/linux_types.h
+@@ -0,0 +1,26 @@
++#ifndef __LINUX_TYPES_H
++#define __LINUX_TYPES_H
++
++#include <stdint.h>
++
++typedef int8_t __s8;
++typedef uint8_t __u8;
++typedef uint8_t __be8;
++typedef uint8_t __le8;
++
++typedef int16_t __s16;
++typedef uint16_t __u16;
++typedef uint16_t __be16;
++typedef uint16_t __le16;
++
++typedef int32_t __s32;
++typedef uint32_t __u32;
++typedef uint32_t __be32;
++typedef uint32_t __le32;
++
++typedef int64_t __s64;
++typedef uint64_t __u64;
++typedef uint64_t __be64;
++typedef uint64_t __le64;
++
++#endif
+--- a/tools/include/linux/types.h
++++ b/tools/include/linux/types.h
+@@ -10,8 +10,12 @@
+ #define __SANE_USERSPACE_TYPES__	/* For PPC64, to get LL64 types */
+ #endif
+ 
++#ifndef __linux__
++#include <tools/linux_types.h>
++#else
+ #include <asm/types.h>
+ #include <asm/posix_types.h>
++#endif
+ 
+ struct page;
+ struct kmem_cache;
+--- a/tools/perf/pmu-events/jevents.py
++++ b/tools/perf/pmu-events/jevents.py
+@@ -684,6 +684,7 @@ def main() -> None:
+ #include "util/header.h"
+ #include "util/pmu.h"
+ #include <string.h>
++#include <strings.h>
+ #include <stddef.h>
+ 
+ struct compact_pmu_event {
diff --git a/target/linux/generic/hack-6.1/214-spidev_h_portability.patch b/target/linux/generic/hack-6.1/214-spidev_h_portability.patch
new file mode 100644
index 00000000000000..db754a29033c06
--- /dev/null
+++ b/target/linux/generic/hack-6.1/214-spidev_h_portability.patch
@@ -0,0 +1,24 @@
+From be9be95ff10e16a5b4ad36f903978d0cc5747024 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 7 Jul 2017 17:04:08 +0200
+Subject: kernel: fix linux/spi/spidev.h portability issues with musl
+
+Felix will try to get this define included into musl
+
+lede-commit: 795e7cf60de19e7a076a46874fab7bb88b43bbff
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ include/uapi/linux/spi/spidev.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/uapi/linux/spi/spidev.h
++++ b/include/uapi/linux/spi/spidev.h
+@@ -93,7 +93,7 @@ struct spi_ioc_transfer {
+ 
+ /* not all platforms use <asm-generic/ioctl.h> or _IOC_TYPECHECK() ... */
+ #define SPI_MSGSIZE(N) \
+-	((((N)*(sizeof (struct spi_ioc_transfer))) < (1 << _IOC_SIZEBITS)) \
++	((((N)*(sizeof (struct spi_ioc_transfer))) < (1 << 13)) \
+ 		? ((N)*(sizeof (struct spi_ioc_transfer))) : 0)
+ #define SPI_IOC_MESSAGE(N) _IOW(SPI_IOC_MAGIC, 0, char[SPI_MSGSIZE(N)])
+ 
diff --git a/target/linux/generic/hack-6.1/220-arm-gc_sections.patch b/target/linux/generic/hack-6.1/220-arm-gc_sections.patch
new file mode 100644
index 00000000000000..483118138e213b
--- /dev/null
+++ b/target/linux/generic/hack-6.1/220-arm-gc_sections.patch
@@ -0,0 +1,123 @@
+From e3d8676f5722b7622685581e06e8f53e6138e3ab Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 15 Jul 2017 23:42:36 +0200
+Subject: use -ffunction-sections, -fdata-sections and --gc-sections
+
+In combination with kernel symbol export stripping this significantly reduces
+the kernel image size. Used on both ARM and MIPS architectures.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Jonas Gorski <jogo@openwrt.org>
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -122,6 +122,7 @@ config ARM
+ 	select HAVE_UID16
+ 	select HAVE_VIRT_CPU_ACCOUNTING_GEN
+ 	select IRQ_FORCED_THREADING
++	select HAVE_LD_DEAD_CODE_DATA_ELIMINATION
+ 	select MODULES_USE_ELF_REL
+ 	select NEED_DMA_MAP_STATE
+ 	select OF_EARLY_FLATTREE if OF
+--- a/arch/arm/boot/compressed/Makefile
++++ b/arch/arm/boot/compressed/Makefile
+@@ -91,6 +91,7 @@ endif
+ ifeq ($(CONFIG_USE_OF),y)
+ OBJS	+= $(libfdt_objs) fdt_check_mem_start.o
+ endif
++KBUILD_CFLAGS_KERNEL := $(patsubst -f%-sections,,$(KBUILD_CFLAGS_KERNEL))
+ 
+ OBJS	+= lib1funcs.o ashldi3.o bswapsdi2.o
+ 
+--- a/arch/arm/kernel/vmlinux.lds.S
++++ b/arch/arm/kernel/vmlinux.lds.S
+@@ -75,7 +75,7 @@ SECTIONS
+ 	. = ALIGN(4);
+ 	__ex_table : AT(ADDR(__ex_table) - LOAD_OFFSET) {
+ 		__start___ex_table = .;
+-		ARM_MMU_KEEP(*(__ex_table))
++		KEEP(*(__ex_table))
+ 		__stop___ex_table = .;
+ 	}
+ 
+@@ -100,24 +100,24 @@ SECTIONS
+ 	}
+ 	.init.arch.info : {
+ 		__arch_info_begin = .;
+-		*(.arch.info.init)
++		KEEP(*(.arch.info.init))
+ 		__arch_info_end = .;
+ 	}
+ 	.init.tagtable : {
+ 		__tagtable_begin = .;
+-		*(.taglist.init)
++		KEEP(*(.taglist.init))
+ 		__tagtable_end = .;
+ 	}
+ #ifdef CONFIG_SMP_ON_UP
+ 	.init.smpalt : {
+ 		__smpalt_begin = .;
+-		*(.alt.smp.init)
++		KEEP(*(.alt.smp.init))
+ 		__smpalt_end = .;
+ 	}
+ #endif
+ 	.init.pv_table : {
+ 		__pv_table_begin = .;
+-		*(.pv_table)
++		KEEP(*(.pv_table))
+ 		__pv_table_end = .;
+ 	}
+ 
+--- a/arch/arm/include/asm/vmlinux.lds.h
++++ b/arch/arm/include/asm/vmlinux.lds.h
+@@ -42,13 +42,13 @@
+ #define PROC_INFO							\
+ 		. = ALIGN(4);						\
+ 		__proc_info_begin = .;					\
+-		*(.proc.info.init)					\
++		KEEP(*(.proc.info.init))				\
+ 		__proc_info_end = .;
+ 
+ #define IDMAP_TEXT							\
+ 		ALIGN_FUNCTION();					\
+ 		__idmap_text_start = .;					\
+-		*(.idmap.text)						\
++		KEEP(*(.idmap.text))					\
+ 		__idmap_text_end = .;					\
+ 
+ #define ARM_DISCARD							\
+@@ -109,12 +109,12 @@
+ 	. = ALIGN(8);							\
+ 	.ARM.unwind_idx : {						\
+ 		__start_unwind_idx = .;					\
+-		*(.ARM.exidx*)						\
++		KEEP(*(.ARM.exidx*))					\
+ 		__stop_unwind_idx = .;					\
+ 	}								\
+ 	.ARM.unwind_tab : {						\
+ 		__start_unwind_tab = .;					\
+-		*(.ARM.extab*)						\
++		KEEP(*(.ARM.extab*))					\
+ 		__stop_unwind_tab = .;					\
+ 	}
+ 
+@@ -126,7 +126,7 @@
+ 	__vectors_lma = .;						\
+ 	OVERLAY 0xffff0000 : NOCROSSREFS AT(__vectors_lma) {		\
+ 		.vectors {						\
+-			*(.vectors)					\
++			KEEP(*(.vectors))				\
+ 		}							\
+ 		.vectors.bhb.loop8 {					\
+ 			*(.vectors.bhb.loop8)				\
+@@ -144,7 +144,7 @@
+ 									\
+ 	__stubs_lma = .;						\
+ 	.stubs ADDR(.vectors) + 0x1000 : AT(__stubs_lma) {		\
+-		*(.stubs)						\
++		KEEP(*(.stubs))						\
+ 	}								\
+ 	ARM_LMA(__stubs, .stubs);					\
+ 	. = __stubs_lma + SIZEOF(.stubs);				\
diff --git a/target/linux/generic/hack-6.1/221-module_exports.patch b/target/linux/generic/hack-6.1/221-module_exports.patch
new file mode 100644
index 00000000000000..d1ff81613a87fb
--- /dev/null
+++ b/target/linux/generic/hack-6.1/221-module_exports.patch
@@ -0,0 +1,126 @@
+From b14784e7883390c20ed3ff904892255404a5914b Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 7 Jul 2017 17:05:53 +0200
+Subject: add an optional config option for stripping all unnecessary symbol exports from the kernel image
+
+lede-commit: bb5a40c64b7c4f4848509fa0a6625055fc9e66cc
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ include/asm-generic/vmlinux.lds.h | 18 +++++++++++++++---
+ include/linux/export.h            |  9 ++++++++-
+ scripts/Makefile.build            |  2 +-
+ 3 files changed, 24 insertions(+), 5 deletions(-)
+
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -81,6 +81,16 @@
+ #define RO_EXCEPTION_TABLE
+ #endif
+ 
++#ifndef SYMTAB_KEEP
++#define SYMTAB_KEEP KEEP(*(SORT(___ksymtab+*)))
++#define SYMTAB_KEEP_GPL KEEP(*(SORT(___ksymtab_gpl+*)))
++#endif
++
++#ifndef SYMTAB_DISCARD
++#define SYMTAB_DISCARD
++#define SYMTAB_DISCARD_GPL
++#endif
++
+ /* Align . to a 8 byte boundary equals to maximum function alignment. */
+ #define ALIGN_FUNCTION()  . = ALIGN(8)
+ 
+@@ -512,14 +522,14 @@
+ 	/* Kernel symbol table: Normal symbols */			\
+ 	__ksymtab         : AT(ADDR(__ksymtab) - LOAD_OFFSET) {		\
+ 		__start___ksymtab = .;					\
+-		KEEP(*(SORT(___ksymtab+*)))				\
++		SYMTAB_KEEP						\
+ 		__stop___ksymtab = .;					\
+ 	}								\
+ 									\
+ 	/* Kernel symbol table: GPL-only symbols */			\
+ 	__ksymtab_gpl     : AT(ADDR(__ksymtab_gpl) - LOAD_OFFSET) {	\
+ 		__start___ksymtab_gpl = .;				\
+-		KEEP(*(SORT(___ksymtab_gpl+*)))				\
++		SYMTAB_KEEP_GPL						\
+ 		__stop___ksymtab_gpl = .;				\
+ 	}								\
+ 									\
+@@ -539,7 +549,7 @@
+ 									\
+ 	/* Kernel symbol table: strings */				\
+         __ksymtab_strings : AT(ADDR(__ksymtab_strings) - LOAD_OFFSET) {	\
+-		*(__ksymtab_strings)					\
++		*(__ksymtab_strings+*)					\
+ 	}								\
+ 									\
+ 	/* __*init sections */						\
+@@ -1048,6 +1058,8 @@
+ #define COMMON_DISCARDS							\
+ 	SANITIZER_DISCARDS						\
+ 	PATCHABLE_DISCARDS						\
++	SYMTAB_DISCARD							\
++	SYMTAB_DISCARD_GPL						\
+ 	*(.discard)							\
+ 	*(.discard.*)							\
+ 	*(.modinfo)							\
+--- a/include/linux/export.h
++++ b/include/linux/export.h
+@@ -72,6 +72,12 @@ struct kernel_symbol {
+ 
+ #else
+ 
++#ifdef MODULE
++#define __EXPORT_SUFFIX(sym)
++#else
++#define __EXPORT_SUFFIX(sym) "+" #sym
++#endif
++
+ /*
+  * For every exported symbol, do the following:
+  *
+@@ -87,7 +93,7 @@ struct kernel_symbol {
+ 	extern typeof(sym) sym;							\
+ 	extern const char __kstrtab_##sym[];					\
+ 	extern const char __kstrtabns_##sym[];					\
+-	asm("	.section \"__ksymtab_strings\",\"aMS\",%progbits,1	\n"	\
++	asm("	.section \"__ksymtab_strings" __EXPORT_SUFFIX(sym) "\",\"aMS\",%progbits,1	\n"	\
+ 	    "__kstrtab_" #sym ":					\n"	\
+ 	    "	.asciz 	\"" #sym "\"					\n"	\
+ 	    "__kstrtabns_" #sym ":					\n"	\
+--- a/include/asm-generic/export.h
++++ b/include/asm-generic/export.h
+@@ -31,6 +31,12 @@
+ #endif
+ .endm
+ 
++#ifdef MODULE
++#define __EXPORT_SUFFIX(name)
++#else
++#define __EXPORT_SUFFIX(name) + #name
++#endif
++
+ /*
+  * note on .section use: we specify progbits since usage of the "M" (SHF_MERGE)
+  * section flag requires it. Use '%progbits' instead of '@progbits' since the
+@@ -44,7 +50,7 @@
+ __ksymtab_\name:
+ 	__put \val, __kstrtab_\name
+ 	.previous
+-	.section __ksymtab_strings,"aMS",%progbits,1
++	.section __ksymtab_strings __EXPORT_SUFFIX(name),"aMS",%progbits,1
+ __kstrtab_\name:
+ 	.asciz "\name"
+ 	.previous
+--- a/scripts/Makefile.build
++++ b/scripts/Makefile.build
+@@ -388,7 +388,7 @@ targets += $(real-dtb-y) $(lib-y) $(alwa
+ # Linker scripts preprocessor (.lds.S -> .lds)
+ # ---------------------------------------------------------------------------
+ quiet_cmd_cpp_lds_S = LDS     $@
+-      cmd_cpp_lds_S = $(CPP) $(cpp_flags) -P -U$(ARCH) \
++      cmd_cpp_lds_S = $(CPP) $(EXTRA_LDSFLAGS) $(cpp_flags) -P -U$(ARCH) \
+ 	                     -D__ASSEMBLY__ -DLINKER_SCRIPT -o $@ $<
+ 
+ $(obj)/%.lds: $(src)/%.lds.S FORCE
diff --git a/target/linux/generic/hack-6.1/230-openwrt_lzma_options.patch b/target/linux/generic/hack-6.1/230-openwrt_lzma_options.patch
new file mode 100644
index 00000000000000..55530c5c7e4e05
--- /dev/null
+++ b/target/linux/generic/hack-6.1/230-openwrt_lzma_options.patch
@@ -0,0 +1,38 @@
+From b3d00b452467f621317953d9e4c6f9ae8dcfd271 Mon Sep 17 00:00:00 2001
+From: Imre Kaloz <kaloz@openwrt.org>
+Date: Fri, 7 Jul 2017 17:06:55 +0200
+Subject: use the openwrt lzma options for now
+
+lede-commit: 548de949f392049420a6a1feeef118b30ab8ea8c
+Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
+---
+ lib/decompress.c              |  1 +
+ scripts/Makefile.lib          |  2 +-
+ usr/gen_initramfs_list.sh | 10 +++++-----
+ 3 files changed, 7 insertions(+), 6 deletions(-)
+
+--- a/lib/decompress.c
++++ b/lib/decompress.c
+@@ -53,6 +53,7 @@ static const struct compress_format comp
+ 	{ {0x1f, 0x9e}, "gzip", gunzip },
+ 	{ {0x42, 0x5a}, "bzip2", bunzip2 },
+ 	{ {0x5d, 0x00}, "lzma", unlzma },
++	{ {0x6d, 0x00}, "lzma-openwrt", unlzma },
+ 	{ {0xfd, 0x37}, "xz", unxz },
+ 	{ {0x89, 0x4c}, "lzo", unlzo },
+ 	{ {0x02, 0x21}, "lz4", unlz4 },
+--- a/scripts/Makefile.lib
++++ b/scripts/Makefile.lib
+@@ -443,10 +443,10 @@ quiet_cmd_bzip2_with_size = BZIP2   $@
+ # ---------------------------------------------------------------------------
+ 
+ quiet_cmd_lzma = LZMA    $@
+-      cmd_lzma = cat $(real-prereqs) | $(LZMA) -9 > $@
++      cmd_lzma = cat $(real-prereqs) | $(LZMA) e -d20 -lc1 -lp2 -pb2 -eos -si -so > $@
+ 
+ quiet_cmd_lzma_with_size = LZMA    $@
+-      cmd_lzma_with_size = { cat $(real-prereqs) | $(LZMA) -9; $(size_append); } > $@
++      cmd_lzma_with_size = { cat $(real-prereqs) | $(LZMA) e -d20 -lc1 -lp2 -pb2 -eos -si -so; $(size_append); } > $@
+ 
+ quiet_cmd_lzo = LZO     $@
+       cmd_lzo = cat $(real-prereqs) | $(KLZOP) -9 > $@
diff --git a/target/linux/generic/hack-6.1/250-netfilter_depends.patch b/target/linux/generic/hack-6.1/250-netfilter_depends.patch
new file mode 100644
index 00000000000000..fbb5a61157fd16
--- /dev/null
+++ b/target/linux/generic/hack-6.1/250-netfilter_depends.patch
@@ -0,0 +1,27 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: hack: net: remove bogus netfilter dependencies
+
+lede-commit: 589d2a377dee27d206fc3725325309cf649e4df6
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ net/netfilter/Kconfig | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -253,7 +253,6 @@ config NF_CONNTRACK_FTP
+ 
+ config NF_CONNTRACK_H323
+ 	tristate "H.323 protocol support"
+-	depends on IPV6 || IPV6=n
+ 	depends on NETFILTER_ADVANCED
+ 	help
+ 	  H.323 is a VoIP signalling protocol from ITU-T. As one of the most
+@@ -1118,7 +1117,6 @@ config NETFILTER_XT_TARGET_SECMARK
+ 
+ config NETFILTER_XT_TARGET_TCPMSS
+ 	tristate '"TCPMSS" target support'
+-	depends on IPV6 || IPV6=n
+ 	default m if NETFILTER_ADVANCED=n
+ 	help
+ 	  This option adds a `TCPMSS' target, which allows you to alter the
diff --git a/target/linux/generic/hack-6.1/251-kconfig.patch b/target/linux/generic/hack-6.1/251-kconfig.patch
new file mode 100644
index 00000000000000..e1ecbca6fe36a3
--- /dev/null
+++ b/target/linux/generic/hack-6.1/251-kconfig.patch
@@ -0,0 +1,210 @@
+From da3c50704f14132f4adf80d48e9a4cd5d46e54c9 Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Fri, 7 Jul 2017 17:09:21 +0200
+Subject: kconfig: owrt specifc dependencies
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ crypto/Kconfig        | 10 +++++-----
+ drivers/bcma/Kconfig  |  1 +
+ drivers/ssb/Kconfig   |  3 ++-
+ lib/Kconfig           |  8 ++++----
+ net/netfilter/Kconfig |  2 +-
+ net/wireless/Kconfig  | 17 ++++++++++-------
+ sound/core/Kconfig    |  4 ++--
+ 7 files changed, 25 insertions(+), 20 deletions(-)
+
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -55,7 +55,7 @@ config CRYPTO_FIPS_VERSION
+ 	  By default the KERNELRELEASE value is used.
+ 
+ config CRYPTO_ALGAPI
+-	tristate
++	tristate "ALGAPI"
+ 	select CRYPTO_ALGAPI2
+ 	help
+ 	  This option provides the API for cryptographic algorithms.
+@@ -64,7 +64,7 @@ config CRYPTO_ALGAPI2
+ 	tristate
+ 
+ config CRYPTO_AEAD
+-	tristate
++	tristate "AEAD"
+ 	select CRYPTO_AEAD2
+ 	select CRYPTO_ALGAPI
+ 
+@@ -75,7 +75,7 @@ config CRYPTO_AEAD2
+ 	select CRYPTO_RNG2
+ 
+ config CRYPTO_SKCIPHER
+-	tristate
++	tristate "SKCIPHER"
+ 	select CRYPTO_SKCIPHER2
+ 	select CRYPTO_ALGAPI
+ 
+@@ -85,7 +85,7 @@ config CRYPTO_SKCIPHER2
+ 	select CRYPTO_RNG2
+ 
+ config CRYPTO_HASH
+-	tristate
++	tristate "HASH"
+ 	select CRYPTO_HASH2
+ 	select CRYPTO_ALGAPI
+ 
+@@ -94,7 +94,7 @@ config CRYPTO_HASH2
+ 	select CRYPTO_ALGAPI2
+ 
+ config CRYPTO_RNG
+-	tristate
++	tristate "RNG"
+ 	select CRYPTO_RNG2
+ 	select CRYPTO_ALGAPI
+ 
+--- a/drivers/bcma/Kconfig
++++ b/drivers/bcma/Kconfig
+@@ -16,6 +16,7 @@ if BCMA
+ # Support for Block-I/O. SELECT this from the driver that needs it.
+ config BCMA_BLOCKIO
+ 	bool
++	default y
+ 
+ config BCMA_HOST_PCI_POSSIBLE
+ 	bool
+--- a/drivers/ssb/Kconfig
++++ b/drivers/ssb/Kconfig
+@@ -29,6 +29,7 @@ config SSB_SPROM
+ config SSB_BLOCKIO
+ 	bool
+ 	depends on SSB
++	default y
+ 
+ config SSB_PCIHOST_POSSIBLE
+ 	bool
+@@ -49,7 +50,7 @@ config SSB_PCIHOST
+ config SSB_B43_PCI_BRIDGE
+ 	bool
+ 	depends on SSB_PCIHOST
+-	default n
++	default y
+ 
+ config SSB_PCMCIAHOST_POSSIBLE
+ 	bool
+--- a/lib/Kconfig
++++ b/lib/Kconfig
+@@ -457,16 +457,16 @@ config BCH_CONST_T
+ # Textsearch support is select'ed if needed
+ #
+ config TEXTSEARCH
+-	bool
++	bool "Textsearch support"
+ 
+ config TEXTSEARCH_KMP
+-	tristate
++	tristate "Textsearch KMP"
+ 
+ config TEXTSEARCH_BM
+-	tristate
++	tristate "Textsearch BM"
+ 
+ config TEXTSEARCH_FSM
+-	tristate
++	tristate "Textsearch FSM"
+ 
+ config BTREE
+ 	bool
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -22,7 +22,7 @@ config NETFILTER_SKIP_EGRESS
+ 	def_bool NETFILTER_EGRESS && (NET_CLS_ACT || IFB)
+ 
+ config NETFILTER_NETLINK
+-	tristate
++	tristate "Netfilter NFNETLINK interface"
+ 
+ config NETFILTER_FAMILY_BRIDGE
+ 	bool
+--- a/net/wireless/Kconfig
++++ b/net/wireless/Kconfig
+@@ -1,6 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ config WIRELESS_EXT
+-	bool
++	bool "Wireless extensions"
+ 
+ config WEXT_CORE
+ 	def_bool y
+@@ -12,10 +12,10 @@ config WEXT_PROC
+ 	depends on WEXT_CORE
+ 
+ config WEXT_SPY
+-	bool
++	bool "WEXT_SPY"
+ 
+ config WEXT_PRIV
+-	bool
++	bool "WEXT_PRIV"
+ 
+ config CFG80211
+ 	tristate "cfg80211 - wireless configuration API"
+@@ -208,7 +208,7 @@ config CFG80211_WEXT_EXPORT
+ endif # CFG80211
+ 
+ config LIB80211
+-	tristate
++	tristate "LIB80211"
+ 	default n
+ 	help
+ 	  This options enables a library of common routines used
+@@ -217,17 +217,17 @@ config LIB80211
+ 	  Drivers should select this themselves if needed.
+ 
+ config LIB80211_CRYPT_WEP
+-	tristate
++	tristate "LIB80211_CRYPT_WEP"
+ 	select CRYPTO_LIB_ARC4
+ 
+ config LIB80211_CRYPT_CCMP
+-	tristate
++	tristate "LIB80211_CRYPT_CCMP"
+ 	select CRYPTO
+ 	select CRYPTO_AES
+ 	select CRYPTO_CCM
+ 
+ config LIB80211_CRYPT_TKIP
+-	tristate
++	tristate "LIB80211_CRYPT_TKIP"
+ 	select CRYPTO_LIB_ARC4
+ 
+ config LIB80211_DEBUG
+--- a/sound/core/Kconfig
++++ b/sound/core/Kconfig
+@@ -17,7 +17,7 @@ config SND_DMAENGINE_PCM
+ 	tristate
+ 
+ config SND_HWDEP
+-	tristate
++	tristate "Sound hardware support"
+ 
+ config SND_SEQ_DEVICE
+ 	tristate
+@@ -27,7 +27,7 @@ config SND_RAWMIDI
+ 	select SND_SEQ_DEVICE if SND_SEQUENCER != n
+ 
+ config SND_COMPRESS_OFFLOAD
+-	tristate
++	tristate "Compression offloading support"
+ 
+ config SND_JACK
+ 	bool
+--- a/net/Kconfig
++++ b/net/Kconfig
+@@ -430,7 +430,7 @@ config NET_DEVLINK
+ 	default n
+ 
+ config PAGE_POOL
+-	bool
++	bool "Page pool support"
+ 
+ config PAGE_POOL_STATS
+ 	default n
diff --git a/target/linux/generic/hack-6.1/253-ksmbd-config.patch b/target/linux/generic/hack-6.1/253-ksmbd-config.patch
new file mode 100644
index 00000000000000..b0c379657e3b21
--- /dev/null
+++ b/target/linux/generic/hack-6.1/253-ksmbd-config.patch
@@ -0,0 +1,32 @@
+From dcd966fa7ca63f38cf7147e1184d13d66e2ca340 Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 13:33:30 +0200
+Subject: [PATCH] Kconfig: add tristate for OID and ASNI string
+
+---
+ init/Kconfig | 2 +-
+ lib/Kconfig  | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -2003,7 +2003,7 @@ config PADATA
+ 	bool
+ 
+ config ASN1
+-	tristate
++	tristate "ASN1"
+ 	help
+ 	  Build a simple ASN.1 grammar compiler that produces a bytecode output
+ 	  that can be interpreted by the ASN.1 stream decoder and used to
+--- a/lib/Kconfig
++++ b/lib/Kconfig
+@@ -637,7 +637,7 @@ config LIBFDT
+ 	bool
+ 
+ config OID_REGISTRY
+-	tristate
++	tristate "OID"
+ 	help
+ 	  Enable fast lookup object identifier registry.
+ 
diff --git a/target/linux/generic/hack-6.1/259-regmap_dynamic.patch b/target/linux/generic/hack-6.1/259-regmap_dynamic.patch
new file mode 100644
index 00000000000000..8d25f59ce2823a
--- /dev/null
+++ b/target/linux/generic/hack-6.1/259-regmap_dynamic.patch
@@ -0,0 +1,144 @@
+From 811d9e2268a62b830cfe93cd8bc929afcb8b198b Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 15 Jul 2017 21:12:38 +0200
+Subject: kernel: move regmap bloat out of the kernel image if it is only being used in modules
+
+lede-commit: 96f39119815028073583e4fca3a9c5fe9141e998
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ drivers/base/regmap/Kconfig  | 15 ++++++++++-----
+ drivers/base/regmap/Makefile | 12 ++++++++----
+ drivers/base/regmap/regmap.c |  3 +++
+ include/linux/regmap.h       |  2 +-
+ 4 files changed, 22 insertions(+), 10 deletions(-)
+
+--- a/drivers/base/regmap/Kconfig
++++ b/drivers/base/regmap/Kconfig
+@@ -4,10 +4,9 @@
+ # subsystems should select the appropriate symbols.
+ 
+ config REGMAP
+-	default y if (REGMAP_I2C || REGMAP_SPI || REGMAP_SPMI || REGMAP_W1 || REGMAP_AC97 || REGMAP_MMIO || REGMAP_IRQ || REGMAP_SOUNDWIRE || REGMAP_SOUNDWIRE_MBQ || REGMAP_SCCB || REGMAP_I3C || REGMAP_SPI_AVMM || REGMAP_MDIO)
+ 	select IRQ_DOMAIN if REGMAP_IRQ
+ 	select MDIO_BUS if REGMAP_MDIO
+-	bool
++	tristate
+ 
+ config REGCACHE_COMPRESSED
+ 	select LZO_COMPRESS
+@@ -15,53 +14,67 @@ config REGCACHE_COMPRESSED
+ 	bool
+ 
+ config REGMAP_AC97
++	select REGMAP
+ 	tristate
+ 
+ config REGMAP_I2C
++	select REGMAP
+ 	tristate
+ 	depends on I2C
+ 
+ config REGMAP_SLIMBUS
++	select REGMAP
+ 	tristate
+ 	depends on SLIMBUS
+ 
+ config REGMAP_SPI
++	select REGMAP
+ 	tristate
+ 	depends on SPI
+ 
+ config REGMAP_SPMI
++	select REGMAP
+ 	tristate
+ 	depends on SPMI
+ 
+ config REGMAP_W1
++	select REGMAP
+ 	tristate
+ 	depends on W1
+ 
+ config REGMAP_MDIO
++	select REGMAP
+ 	tristate
+ 
+ config REGMAP_MMIO
++	select REGMAP
+ 	tristate
+ 
+ config REGMAP_IRQ
++	select REGMAP
+ 	bool
+ 
+ config REGMAP_SOUNDWIRE
++	select REGMAP
+ 	tristate
+ 	depends on SOUNDWIRE
+ 
+ config REGMAP_SOUNDWIRE_MBQ
++	select REGMAP
+ 	tristate
+ 	depends on SOUNDWIRE
+ 
+ config REGMAP_SCCB
++	select REGMAP
+ 	tristate
+ 	depends on I2C
+ 
+ config REGMAP_I3C
++	select REGMAP
+ 	tristate
+ 	depends on I3C
+ 
+ config REGMAP_SPI_AVMM
++	select REGMAP
+ 	tristate
+ 	depends on SPI
+--- a/drivers/base/regmap/Makefile
++++ b/drivers/base/regmap/Makefile
+@@ -2,10 +2,14 @@
+ # For include/trace/define_trace.h to include trace.h
+ CFLAGS_regmap.o := -I$(src)
+ 
+-obj-$(CONFIG_REGMAP) += regmap.o regcache.o
+-obj-$(CONFIG_REGMAP) += regcache-rbtree.o regcache-flat.o
+-obj-$(CONFIG_REGCACHE_COMPRESSED) += regcache-lzo.o
+-obj-$(CONFIG_DEBUG_FS) += regmap-debugfs.o
++regmap-core-objs = regmap.o regcache.o regcache-rbtree.o regcache-flat.o
++ifdef CONFIG_DEBUG_FS
++regmap-core-objs += regmap-debugfs.o
++endif
++ifdef CONFIG_REGCACHE_COMPRESSED
++regmap-core-objs += regcache-lzo.o
++endif
++obj-$(CONFIG_REGMAP) += regmap-core.o
+ obj-$(CONFIG_REGMAP_AC97) += regmap-ac97.o
+ obj-$(CONFIG_REGMAP_I2C) += regmap-i2c.o
+ obj-$(CONFIG_REGMAP_SLIMBUS) += regmap-slimbus.o
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -9,6 +9,7 @@
+ #include <linux/device.h>
+ #include <linux/slab.h>
+ #include <linux/export.h>
++#include <linux/module.h>
+ #include <linux/mutex.h>
+ #include <linux/err.h>
+ #include <linux/property.h>
+@@ -3513,3 +3514,5 @@ static int __init regmap_initcall(void)
+ 	return 0;
+ }
+ postcore_initcall(regmap_initcall);
++
++MODULE_LICENSE("GPL");
+--- a/include/linux/regmap.h
++++ b/include/linux/regmap.h
+@@ -180,7 +180,7 @@ struct reg_sequence {
+ 	__ret ?: __tmp; \
+ })
+ 
+-#ifdef CONFIG_REGMAP
++#if IS_REACHABLE(CONFIG_REGMAP)
+ 
+ enum regmap_endian {
+ 	/* Unspecified -> 0 -> Backwards compatible default */
diff --git a/target/linux/generic/hack-6.1/260-crypto_test_dependencies.patch b/target/linux/generic/hack-6.1/260-crypto_test_dependencies.patch
new file mode 100644
index 00000000000000..7ea517496e2a12
--- /dev/null
+++ b/target/linux/generic/hack-6.1/260-crypto_test_dependencies.patch
@@ -0,0 +1,52 @@
+From fd1799b0bf5efa46dd3e6dfbbf3955564807e508 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 7 Jul 2017 17:12:51 +0200
+Subject: kernel: prevent cryptomgr from pulling in useless extra dependencies for tests that are not run
+
+Reduces kernel size after LZMA by about 5k on MIPS
+
+lede-commit: 044c316167e076479a344c59905e5b435b84a77f
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ crypto/Kconfig   | 13 ++++++-------
+ crypto/algboss.c |  4 ++++
+ 2 files changed, 10 insertions(+), 7 deletions(-)
+
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -142,13 +142,13 @@ config CRYPTO_MANAGER
+ 	  cbc(aes).
+ 
+ config CRYPTO_MANAGER2
+-	def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
+-	select CRYPTO_AEAD2
+-	select CRYPTO_HASH2
+-	select CRYPTO_SKCIPHER2
+-	select CRYPTO_AKCIPHER2
+-	select CRYPTO_KPP2
+-	select CRYPTO_ACOMP2
++	def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y && !CRYPTO_MANAGER_DISABLE_TESTS)
++	select CRYPTO_AEAD2 if !CRYPTO_MANAGER_DISABLE_TESTS
++	select CRYPTO_HASH2 if !CRYPTO_MANAGER_DISABLE_TESTS
++	select CRYPTO_SKCIPHER2 if !CRYPTO_MANAGER_DISABLE_TESTS
++	select CRYPTO_AKCIPHER2 if !CRYPTO_MANAGER_DISABLE_TESTS
++	select CRYPTO_KPP2 if !CRYPTO_MANAGER_DISABLE_TESTS
++	select CRYPTO_ACOMP2 if !CRYPTO_MANAGER_DISABLE_TESTS
+ 
+ config CRYPTO_USER
+ 	tristate "Userspace cryptographic algorithm configuration"
+--- a/crypto/algboss.c
++++ b/crypto/algboss.c
+@@ -211,8 +211,12 @@ static int cryptomgr_schedule_test(struc
+ 	type = alg->cra_flags;
+ 
+ 	/* Do not test internal algorithms. */
++#ifdef CONFIG_CRYPTO_MANAGER_DISABLE_TESTS
++	type |= CRYPTO_ALG_TESTED;
++#else
+ 	if (type & CRYPTO_ALG_INTERNAL)
+ 		type |= CRYPTO_ALG_TESTED;
++#endif
+ 
+ 	param->type = type;
+ 
diff --git a/target/linux/generic/hack-6.1/261-lib-arc4-unhide.patch b/target/linux/generic/hack-6.1/261-lib-arc4-unhide.patch
new file mode 100644
index 00000000000000..01829b2d51ef95
--- /dev/null
+++ b/target/linux/generic/hack-6.1/261-lib-arc4-unhide.patch
@@ -0,0 +1,24 @@
+From 241e5d3f7b0dd3c01f8c7fa83cbc9a3882286d53 Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 13:35:18 +0200
+Subject: [PATCH] lib/crypto: add tristate string for ARC4
+
+This makes it possible to select CONFIG_CRYPTO_LIB_ARC4 directly. We 
+need this to be able to compile this into the kernel and make use of it 
+from backports.
+
+---
+ lib/crypto/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/crypto/Kconfig
++++ b/lib/crypto/Kconfig
+@@ -9,7 +9,7 @@ config CRYPTO_LIB_AES
+ 	tristate
+ 
+ config CRYPTO_LIB_ARC4
+-	tristate
++	tristate "ARC4 cipher library"
+ 
+ config CRYPTO_ARCH_HAVE_LIB_BLAKE2S
+ 	bool
diff --git a/target/linux/generic/hack-6.1/280-rfkill-stubs.patch b/target/linux/generic/hack-6.1/280-rfkill-stubs.patch
new file mode 100644
index 00000000000000..ff6638f7a05b4c
--- /dev/null
+++ b/target/linux/generic/hack-6.1/280-rfkill-stubs.patch
@@ -0,0 +1,84 @@
+From 236c1acdfef5958010ac9814a9872e0a46fd78ee Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Fri, 7 Jul 2017 17:13:44 +0200
+Subject: rfkill: add fake rfkill support
+
+allow building of modules depending on RFKILL even if RFKILL is not enabled.
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ include/linux/rfkill.h |  2 +-
+ net/Makefile           |  2 +-
+ net/rfkill/Kconfig     | 14 +++++++++-----
+ net/rfkill/Makefile    |  2 +-
+ 4 files changed, 12 insertions(+), 8 deletions(-)
+
+--- a/include/linux/rfkill.h
++++ b/include/linux/rfkill.h
+@@ -64,7 +64,7 @@ struct rfkill_ops {
+ 	int	(*set_block)(void *data, bool blocked);
+ };
+ 
+-#if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
++#if defined(CONFIG_RFKILL_FULL) || defined(CONFIG_RFKILL_FULL_MODULE)
+ /**
+  * rfkill_alloc - Allocate rfkill structure
+  * @name: name of the struct -- the string is not copied internally
+--- a/net/Makefile
++++ b/net/Makefile
+@@ -51,7 +51,7 @@ obj-$(CONFIG_TIPC)		+= tipc/
+ obj-$(CONFIG_NETLABEL)		+= netlabel/
+ obj-$(CONFIG_IUCV)		+= iucv/
+ obj-$(CONFIG_SMC)		+= smc/
+-obj-$(CONFIG_RFKILL)		+= rfkill/
++obj-$(CONFIG_RFKILL_FULL)	+= rfkill/
+ obj-$(CONFIG_NET_9P)		+= 9p/
+ obj-$(CONFIG_CAIF)		+= caif/
+ obj-$(CONFIG_DCB)		+= dcb/
+--- a/net/rfkill/Kconfig
++++ b/net/rfkill/Kconfig
+@@ -2,7 +2,11 @@
+ #
+ # RF switch subsystem configuration
+ #
+-menuconfig RFKILL
++config RFKILL
++	bool
++	default y
++
++menuconfig RFKILL_FULL
+ 	tristate "RF switch subsystem support"
+ 	help
+ 	  Say Y here if you want to have control over RF switches
+@@ -14,19 +18,19 @@ menuconfig RFKILL
+ # LED trigger support
+ config RFKILL_LEDS
+ 	bool
+-	depends on RFKILL
++	depends on RFKILL_FULL
+ 	depends on LEDS_TRIGGERS = y || RFKILL = LEDS_TRIGGERS
+ 	default y
+ 
+ config RFKILL_INPUT
+ 	bool "RF switch input support" if EXPERT
+-	depends on RFKILL
++	depends on RFKILL_FULL
+ 	depends on INPUT = y || RFKILL = INPUT
+ 	default y if !EXPERT
+ 
+ config RFKILL_GPIO
+ 	tristate "GPIO RFKILL driver"
+-	depends on RFKILL
++	depends on RFKILL_FULL
+ 	depends on GPIOLIB || COMPILE_TEST
+ 	default n
+ 	help
+--- a/net/rfkill/Makefile
++++ b/net/rfkill/Makefile
+@@ -5,5 +5,5 @@
+ 
+ rfkill-y			+= core.o
+ rfkill-$(CONFIG_RFKILL_INPUT)	+= input.o
+-obj-$(CONFIG_RFKILL)		+= rfkill.o
++obj-$(CONFIG_RFKILL_FULL)	+= rfkill.o
+ obj-$(CONFIG_RFKILL_GPIO)	+= rfkill-gpio.o
diff --git a/target/linux/generic/hack-6.1/300-MIPS-r4k_cache-use-more-efficient-cache-blast.patch b/target/linux/generic/hack-6.1/300-MIPS-r4k_cache-use-more-efficient-cache-blast.patch
new file mode 100644
index 00000000000000..f21f200136f00b
--- /dev/null
+++ b/target/linux/generic/hack-6.1/300-MIPS-r4k_cache-use-more-efficient-cache-blast.patch
@@ -0,0 +1,64 @@
+From: Ben Menchaca <ben.menchaca@qca.qualcomm.com>
+Date: Fri, 7 Jun 2013 18:35:22 -0500
+Subject: MIPS: r4k_cache: use more efficient cache blast
+
+Optimize the compiler output for larger cache blast cases that are
+common for DMA-based networking.
+
+Signed-off-by: Ben Menchaca <ben.menchaca@qca.qualcomm.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+--- a/arch/mips/include/asm/r4kcache.h
++++ b/arch/mips/include/asm/r4kcache.h
+@@ -286,14 +286,46 @@ static inline void prot##extra##blast_##
+ 						    unsigned long end)	\
+ {									\
+ 	unsigned long lsize = cpu_##desc##_line_size();			\
++	unsigned long lsize_2 = lsize * 2;				\
++	unsigned long lsize_3 = lsize * 3;				\
++	unsigned long lsize_4 = lsize * 4;				\
++	unsigned long lsize_5 = lsize * 5;				\
++	unsigned long lsize_6 = lsize * 6;				\
++	unsigned long lsize_7 = lsize * 7;				\
++	unsigned long lsize_8 = lsize * 8;				\
+ 	unsigned long addr = start & ~(lsize - 1);			\
+-	unsigned long aend = (end - 1) & ~(lsize - 1);			\
++	unsigned long aend = (end + lsize - 1) & ~(lsize - 1);		\
++	int lines = (aend - addr) / lsize;				\
+ 									\
+-	while (1) {							\
++	while (lines >= 8) {						\
++		prot##cache_op(hitop, addr);				\
++		prot##cache_op(hitop, addr + lsize);			\
++		prot##cache_op(hitop, addr + lsize_2);			\
++		prot##cache_op(hitop, addr + lsize_3);			\
++		prot##cache_op(hitop, addr + lsize_4);			\
++		prot##cache_op(hitop, addr + lsize_5);			\
++		prot##cache_op(hitop, addr + lsize_6);			\
++		prot##cache_op(hitop, addr + lsize_7);			\
++		addr += lsize_8;					\
++		lines -= 8;						\
++	}								\
++									\
++	if (lines & 0x4) {						\
++		prot##cache_op(hitop, addr);				\
++		prot##cache_op(hitop, addr + lsize);			\
++		prot##cache_op(hitop, addr + lsize_2);			\
++		prot##cache_op(hitop, addr + lsize_3);			\
++		addr += lsize_4;					\
++	}								\
++									\
++	if (lines & 0x2) {						\
++		prot##cache_op(hitop, addr);				\
++		prot##cache_op(hitop, addr + lsize);			\
++		addr += lsize_2;					\
++	}								\
++									\
++	if (lines & 0x1) {						\
+ 		prot##cache_op(hitop, addr);				\
+-		if (addr == aend)					\
+-			break;						\
+-		addr += lsize;						\
+ 	}								\
+ }
+ 
diff --git a/target/linux/generic/hack-6.1/321-powerpc_crtsavres_prereq.patch b/target/linux/generic/hack-6.1/321-powerpc_crtsavres_prereq.patch
new file mode 100644
index 00000000000000..17eba0b354eb80
--- /dev/null
+++ b/target/linux/generic/hack-6.1/321-powerpc_crtsavres_prereq.patch
@@ -0,0 +1,38 @@
+From 107c0964cb8db7ca28ac5199426414fdab3c274d Mon Sep 17 00:00:00 2001
+From: "Alexandros C. Couloumbis" <alex@ozo.com>
+Date: Fri, 7 Jul 2017 17:14:51 +0200
+Subject: hack: arch: powerpc: drop register save/restore library from modules
+
+Upstream GCC uses a libgcc function for saving/restoring registers. This
+makes the code bigger, and upstream kernels need to carry that function
+for every single kernel module. Our GCC is patched to avoid those
+references, so we can drop the extra bloat for modules.
+
+lede-commit: e8e1084654f50904e6bf77b70b2de3f137d7b3ec
+Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
+---
+ arch/powerpc/Makefile | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -42,19 +42,6 @@ machine-$(CONFIG_PPC64) += 64
+ machine-$(CONFIG_CPU_LITTLE_ENDIAN) += le
+ UTS_MACHINE := $(subst $(space),,$(machine-y))
+ 
+-# XXX This needs to be before we override LD below
+-ifdef CONFIG_PPC32
+-KBUILD_LDFLAGS_MODULE += arch/powerpc/lib/crtsavres.o
+-else
+-ifeq ($(call ld-ifversion, -ge, 22500, y),y)
+-# Have the linker provide sfpr if possible.
+-# There is a corresponding test in arch/powerpc/lib/Makefile
+-KBUILD_LDFLAGS_MODULE += --save-restore-funcs
+-else
+-KBUILD_LDFLAGS_MODULE += arch/powerpc/lib/crtsavres.o
+-endif
+-endif
+-
+ ifdef CONFIG_CPU_LITTLE_ENDIAN
+ KBUILD_CFLAGS	+= -mlittle-endian
+ KBUILD_LDFLAGS	+= -EL
diff --git a/target/linux/generic/hack-6.1/402-mtd-blktrans-call-add-disks-after-mtd-device.patch b/target/linux/generic/hack-6.1/402-mtd-blktrans-call-add-disks-after-mtd-device.patch
new file mode 100644
index 00000000000000..c0fa2ddabf4029
--- /dev/null
+++ b/target/linux/generic/hack-6.1/402-mtd-blktrans-call-add-disks-after-mtd-device.patch
@@ -0,0 +1,112 @@
+From 0bccc3722bdd88e8ae995e77ef9f7b77ee4cbdee Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Wed, 7 Apr 2021 22:45:54 +0100
+Subject: [PATCH 2/2] mtd: blktrans: call add disks after mtd device
+To: linux-mtd@lists.infradead.org
+Cc: Vignesh Raghavendra <vigneshr@ti.com>,
+    Richard Weinberger <richard@nod.at>,
+    Miquel Raynal <miquel.raynal@bootlin.com>,
+    David Woodhouse <dwmw2@infradead.org>
+
+Calling device_add_disk while holding mtd_table_mutex leads
+to deadlock in case part_bits!=0 as block partition parsers
+will try to open the newly created disks, trying to acquire
+mutex once again.
+Move device_add_disk to additional function called after
+add partitions of an MTD device have been added and locks
+have been released.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/mtd/mtd_blkdevs.c    | 33 ++++++++++++++++++++++++++-------
+ drivers/mtd/mtdcore.c        |  3 +++
+ include/linux/mtd/blktrans.h |  1 +
+ 3 files changed, 30 insertions(+), 7 deletions(-)
+
+--- a/drivers/mtd/mtd_blkdevs.c
++++ b/drivers/mtd/mtd_blkdevs.c
+@@ -386,19 +386,8 @@ int add_mtd_blktrans_dev(struct mtd_blkt
+ 	if (new->readonly)
+ 		set_disk_ro(gd, 1);
+ 
+-	ret = device_add_disk(&new->mtd->dev, gd, NULL);
+-	if (ret)
+-		goto out_cleanup_disk;
+-
+-	if (new->disk_attributes) {
+-		ret = sysfs_create_group(&disk_to_dev(gd)->kobj,
+-					new->disk_attributes);
+-		WARN_ON(ret);
+-	}
+ 	return 0;
+ 
+-out_cleanup_disk:
+-	put_disk(new->disk);
+ out_free_tag_set:
+ 	blk_mq_free_tag_set(new->tag_set);
+ out_kfree_tag_set:
+@@ -408,6 +397,35 @@ out_list_del:
+ 	return ret;
+ }
+ 
++void register_mtd_blktrans_devs(void)
++{
++	struct mtd_blktrans_ops *tr;
++	struct mtd_blktrans_dev *dev, *next;
++	int ret;
++
++	list_for_each_entry(tr, &blktrans_majors, list) {
++		list_for_each_entry_safe(dev, next, &tr->devs, list) {
++			if (disk_live(dev->disk))
++				continue;
++
++			ret = device_add_disk(&dev->mtd->dev, dev->disk, NULL);
++			if (ret)
++				goto out_cleanup_disk;
++
++			if (dev->disk_attributes) {
++				ret = sysfs_create_group(&disk_to_dev(dev->disk)->kobj,
++							dev->disk_attributes);
++				WARN_ON(ret);
++			}
++		}
++	}
++
++	return;
++
++out_cleanup_disk:
++	put_disk(dev->disk);
++}
++
+ int del_mtd_blktrans_dev(struct mtd_blktrans_dev *old)
+ {
+ 	unsigned long flags;
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -32,6 +32,7 @@
+ 
+ #include <linux/mtd/mtd.h>
+ #include <linux/mtd/partitions.h>
++#include <linux/mtd/blktrans.h>
+ 
+ #include "mtdcore.h"
+ 
+@@ -1074,6 +1075,8 @@ int mtd_device_parse_register(struct mtd
+ 		register_reboot_notifier(&mtd->reboot_notifier);
+ 	}
+ 
++	register_mtd_blktrans_devs();
++
+ out:
+ 	if (ret) {
+ 		nvmem_unregister(mtd->otp_user_nvmem);
+--- a/include/linux/mtd/blktrans.h
++++ b/include/linux/mtd/blktrans.h
+@@ -76,6 +76,7 @@ extern int deregister_mtd_blktrans(struc
+ extern int add_mtd_blktrans_dev(struct mtd_blktrans_dev *dev);
+ extern int del_mtd_blktrans_dev(struct mtd_blktrans_dev *dev);
+ extern int mtd_blktrans_cease_background(struct mtd_blktrans_dev *dev);
++extern void register_mtd_blktrans_devs(void);
+ 
+ /**
+  * module_mtd_blktrans() - Helper macro for registering a mtd blktrans driver
diff --git a/target/linux/generic/hack-6.1/410-block-fit-partition-parser.patch b/target/linux/generic/hack-6.1/410-block-fit-partition-parser.patch
new file mode 100644
index 00000000000000..0384dad85e5954
--- /dev/null
+++ b/target/linux/generic/hack-6.1/410-block-fit-partition-parser.patch
@@ -0,0 +1,191 @@
+From 69357074558daf6ff24c9f58714935e9e095a865 Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 13:37:33 +0200
+Subject: [PATCH] kernel: add block fit partition parser
+
+---
+ block/blk.h                     |  2 ++
+ block/partitions/Kconfig        |  7 +++++++
+ block/partitions/Makefile       |  1 +
+ block/partitions/check.h        |  3 +++
+ block/partitions/core.c         | 17 +++++++++++++++++
+ block/partitions/efi.c          |  8 ++++++++
+ block/partitions/efi.h          |  3 +++
+ block/partitions/msdos.c        | 10 ++++++++++
+ drivers/mtd/mtd_blkdevs.c       |  2 ++
+ drivers/mtd/ubi/block.c         |  3 +++
+ include/linux/msdos_partition.h |  1 +
+ 11 files changed, 57 insertions(+)
+
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -414,6 +414,8 @@ void blk_free_ext_minor(unsigned int min
+ #define ADDPART_FLAG_NONE	0
+ #define ADDPART_FLAG_RAID	1
+ #define ADDPART_FLAG_WHOLEDISK	2
++#define ADDPART_FLAG_READONLY	4
++#define ADDPART_FLAG_ROOTDEV	8
+ int bdev_add_partition(struct gendisk *disk, int partno, sector_t start,
+ 		sector_t length);
+ int bdev_del_partition(struct gendisk *disk, int partno);
+--- a/block/partitions/Kconfig
++++ b/block/partitions/Kconfig
+@@ -103,6 +103,13 @@ config ATARI_PARTITION
+ 	  Say Y here if you would like to use hard disks under Linux which
+ 	  were partitioned under the Atari OS.
+ 
++config FIT_PARTITION
++	bool "Flattened-Image-Tree (FIT) partition support" if PARTITION_ADVANCED
++	default n
++	help
++	  Say Y here if your system needs to mount the filesystem part of
++	  a Flattened-Image-Tree (FIT) image commonly used with Das U-Boot.
++
+ config IBM_PARTITION
+ 	bool "IBM disk label and partition support"
+ 	depends on PARTITION_ADVANCED && S390
+--- a/block/partitions/Makefile
++++ b/block/partitions/Makefile
+@@ -8,6 +8,7 @@ obj-$(CONFIG_ACORN_PARTITION) += acorn.o
+ obj-$(CONFIG_AMIGA_PARTITION) += amiga.o
+ obj-$(CONFIG_ATARI_PARTITION) += atari.o
+ obj-$(CONFIG_AIX_PARTITION) += aix.o
++obj-$(CONFIG_FIT_PARTITION) += fit.o
+ obj-$(CONFIG_CMDLINE_PARTITION) += cmdline.o
+ obj-$(CONFIG_MAC_PARTITION) += mac.o
+ obj-$(CONFIG_LDM_PARTITION) += ldm.o
+--- a/block/partitions/check.h
++++ b/block/partitions/check.h
+@@ -57,6 +57,7 @@ int amiga_partition(struct parsed_partit
+ int atari_partition(struct parsed_partitions *state);
+ int cmdline_partition(struct parsed_partitions *state);
+ int efi_partition(struct parsed_partitions *state);
++int fit_partition(struct parsed_partitions *state);
+ int ibm_partition(struct parsed_partitions *);
+ int karma_partition(struct parsed_partitions *state);
+ int ldm_partition(struct parsed_partitions *state);
+@@ -67,3 +68,5 @@ int sgi_partition(struct parsed_partitio
+ int sun_partition(struct parsed_partitions *state);
+ int sysv68_partition(struct parsed_partitions *state);
+ int ultrix_partition(struct parsed_partitions *state);
++
++int parse_fit_partitions(struct parsed_partitions *state, u64 start_sector, u64 nr_sectors, int *slot, int add_remain);
+--- a/block/partitions/core.c
++++ b/block/partitions/core.c
+@@ -10,6 +10,10 @@
+ #include <linux/ctype.h>
+ #include <linux/vmalloc.h>
+ #include <linux/raid/detect.h>
++#ifdef CONFIG_FIT_PARTITION
++#include <linux/root_dev.h>
++#endif
++
+ #include "check.h"
+ 
+ static int (*check_part[])(struct parsed_partitions *) = {
+@@ -46,6 +50,9 @@ static int (*check_part[])(struct parsed
+ #ifdef CONFIG_EFI_PARTITION
+ 	efi_partition,		/* this must come before msdos */
+ #endif
++#ifdef CONFIG_FIT_PARTITION
++	fit_partition,
++#endif
+ #ifdef CONFIG_SGI_PARTITION
+ 	sgi_partition,
+ #endif
+@@ -398,6 +405,11 @@ static struct block_device *add_partitio
+ 			goto out_del;
+ 	}
+ 
++#ifdef CONFIG_FIT_PARTITION
++	if (flags & ADDPART_FLAG_READONLY)
++		bdev->bd_read_only = true;
++#endif
++
+ 	/* everything is up and running, commence */
+ 	err = xa_insert(&disk->part_tbl, partno, bdev, GFP_KERNEL);
+ 	if (err)
+@@ -585,6 +597,11 @@ static bool blk_add_partition(struct gen
+ 	    (state->parts[p].flags & ADDPART_FLAG_RAID))
+ 		md_autodetect_dev(part->bd_dev);
+ 
++#ifdef CONFIG_FIT_PARTITION
++	if ((state->parts[p].flags & ADDPART_FLAG_ROOTDEV) && ROOT_DEV == 0)
++		ROOT_DEV = part->bd_dev;
++#endif
++
+ 	return true;
+ }
+ 
+--- a/block/partitions/efi.c
++++ b/block/partitions/efi.c
+@@ -716,6 +716,9 @@ int efi_partition(struct parsed_partitio
+ 	gpt_entry *ptes = NULL;
+ 	u32 i;
+ 	unsigned ssz = queue_logical_block_size(state->disk->queue) / 512;
++#ifdef CONFIG_FIT_PARTITION
++	u32 extra_slot = 64;
++#endif
+ 
+ 	if (!find_valid_gpt(state, &gpt, &ptes) || !gpt || !ptes) {
+ 		kfree(gpt);
+@@ -749,6 +752,11 @@ int efi_partition(struct parsed_partitio
+ 				ARRAY_SIZE(ptes[i].partition_name));
+ 		utf16_le_to_7bit(ptes[i].partition_name, label_max, info->volname);
+ 		state->parts[i + 1].has_info = true;
++#ifdef CONFIG_FIT_PARTITION
++		/* If this is a U-Boot FIT volume it may have subpartitions */
++		if (!efi_guidcmp(ptes[i].partition_type_guid, PARTITION_LINUX_FIT_GUID))
++			(void) parse_fit_partitions(state, start * ssz, size * ssz, &extra_slot, 1);
++#endif
+ 	}
+ 	kfree(ptes);
+ 	kfree(gpt);
+--- a/block/partitions/efi.h
++++ b/block/partitions/efi.h
+@@ -51,6 +51,9 @@
+ #define PARTITION_LINUX_LVM_GUID \
+     EFI_GUID( 0xe6d6d379, 0xf507, 0x44c2, \
+               0xa2, 0x3c, 0x23, 0x8f, 0x2a, 0x3d, 0xf9, 0x28)
++#define PARTITION_LINUX_FIT_GUID \
++    EFI_GUID( 0xcae9be83, 0xb15f, 0x49cc, \
++              0x86, 0x3f, 0x08, 0x1b, 0x74, 0x4a, 0x2d, 0x93)
+ 
+ typedef struct _gpt_header {
+ 	__le64 signature;
+--- a/block/partitions/msdos.c
++++ b/block/partitions/msdos.c
+@@ -564,6 +564,15 @@ static void parse_minix(struct parsed_pa
+ #endif /* CONFIG_MINIX_SUBPARTITION */
+ }
+ 
++static void parse_fit_mbr(struct parsed_partitions *state,
++			  sector_t offset, sector_t size, int origin)
++{
++#ifdef CONFIG_FIT_PARTITION
++	u32 extra_slot = 64;
++	(void) parse_fit_partitions(state, offset, size, &extra_slot, 1);
++#endif /* CONFIG_FIT_PARTITION */
++}
++
+ static struct {
+ 	unsigned char id;
+ 	void (*parse)(struct parsed_partitions *, sector_t, sector_t, int);
+@@ -575,6 +584,7 @@ static struct {
+ 	{UNIXWARE_PARTITION, parse_unixware},
+ 	{SOLARIS_X86_PARTITION, parse_solaris_x86},
+ 	{NEW_SOLARIS_X86_PARTITION, parse_solaris_x86},
++	{FIT_PARTITION, parse_fit_mbr},
+ 	{0, NULL},
+ };
+ 
+--- a/include/linux/msdos_partition.h
++++ b/include/linux/msdos_partition.h
+@@ -31,6 +31,7 @@ enum msdos_sys_ind {
+ 	LINUX_LVM_PARTITION = 0x8e,
+ 	LINUX_RAID_PARTITION = 0xfd,	/* autodetect RAID partition */
+ 
++	FIT_PARTITION = 0x2e,		/* U-Boot uImage.FIT */
+ 	SOLARIS_X86_PARTITION =	0x82,	/* also Linux swap partitions */
+ 	NEW_SOLARIS_X86_PARTITION = 0xbf,
+ 
diff --git a/target/linux/generic/hack-6.1/420-mtd-support-OpenWrt-s-MTD_ROOTFS_ROOT_DEV.patch b/target/linux/generic/hack-6.1/420-mtd-support-OpenWrt-s-MTD_ROOTFS_ROOT_DEV.patch
new file mode 100644
index 00000000000000..8e8e5cea8d6af2
--- /dev/null
+++ b/target/linux/generic/hack-6.1/420-mtd-support-OpenWrt-s-MTD_ROOTFS_ROOT_DEV.patch
@@ -0,0 +1,24 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 7 Nov 2022 23:48:24 +0100
+Subject: [PATCH] mtd: support OpenWrt's MTD_ROOTFS_ROOT_DEV
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This allows setting ROOT_DEV to MTD partition named "rootfs".
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -750,7 +750,8 @@ int add_mtd_device(struct mtd_info *mtd)
+ 
+ 	mutex_unlock(&mtd_table_mutex);
+ 
+-	if (of_find_property(mtd_get_of_node(mtd), "linux,rootfs", NULL)) {
++	if (of_find_property(mtd_get_of_node(mtd), "linux,rootfs", NULL) ||
++	    (IS_ENABLED(CONFIG_MTD_ROOTFS_ROOT_DEV) && !strcmp(mtd->name, "rootfs") && ROOT_DEV == 0)) {
+ 		if (IS_BUILTIN(CONFIG_MTD)) {
+ 			pr_info("mtd: setting mtd%d (%s) as root device\n", mtd->index, mtd->name);
+ 			ROOT_DEV = MKDEV(MTD_BLOCK_MAJOR, mtd->index);
diff --git a/target/linux/generic/hack-6.1/421-drivers-mtd-parsers-add-nvmem-support-to-cmdlinepart.patch b/target/linux/generic/hack-6.1/421-drivers-mtd-parsers-add-nvmem-support-to-cmdlinepart.patch
new file mode 100644
index 00000000000000..965a331a1905bb
--- /dev/null
+++ b/target/linux/generic/hack-6.1/421-drivers-mtd-parsers-add-nvmem-support-to-cmdlinepart.patch
@@ -0,0 +1,120 @@
+From 6fa9e3678eb002246df1280322b6a024853950a5 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Mon, 11 Oct 2021 00:53:14 +0200
+Subject: [PATCH] drivers: mtd: parsers: add nvmem support to cmdlinepart
+
+Assuming cmdlinepart is only one level deep partition scheme and that
+static partition are also defined in DTS, we can assign an of_node for
+partition declared from bootargs. cmdlinepart have priority than
+fiexed-partition parser so in this specific case the parser doesn't
+assign an of_node. Fix this by searching a defined of_node using a
+similar fixed_partition parser and if a partition is found with the same
+label, check that it has the same offset and size and return the DT
+of_node to correctly use NVMEM cells.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+---
+ drivers/mtd/parsers/cmdlinepart.c | 71 +++++++++++++++++++++++++++++++
+ 1 file changed, 71 insertions(+)
+
+--- a/drivers/mtd/parsers/cmdlinepart.c
++++ b/drivers/mtd/parsers/cmdlinepart.c
+@@ -43,6 +43,7 @@
+ #include <linux/mtd/partitions.h>
+ #include <linux/module.h>
+ #include <linux/err.h>
++#include <linux/of.h>
+ 
+ /* debug macro */
+ #if 0
+@@ -323,6 +324,68 @@ static int mtdpart_setup_real(char *s)
+ 	return 0;
+ }
+ 
++static int search_fixed_partition(struct mtd_info *master,
++				  struct mtd_partition *target_part,
++				  struct mtd_partition *fixed_part)
++{
++	struct device_node *mtd_node;
++	struct device_node *ofpart_node;
++	struct device_node *pp;
++	struct mtd_partition part;
++	const char *partname;
++
++	mtd_node = mtd_get_of_node(master);
++	if (!mtd_node)
++		return -EINVAL;
++
++	ofpart_node = of_get_child_by_name(mtd_node, "partitions");
++
++	for_each_child_of_node(ofpart_node,  pp) {
++		const __be32 *reg;
++		int len;
++		int a_cells, s_cells;
++
++		reg = of_get_property(pp, "reg", &len);
++		if (!reg) {
++			pr_debug("%s: ofpart partition %pOF (%pOF) missing reg property.\n",
++				 master->name, pp,
++				 mtd_node);
++			continue;
++		}
++
++		a_cells = of_n_addr_cells(pp);
++		s_cells = of_n_size_cells(pp);
++		if (len / 4 != a_cells + s_cells) {
++			pr_debug("%s: ofpart partition %pOF (%pOF) error parsing reg property.\n",
++				 master->name, pp,
++				 mtd_node);
++			continue;
++		}
++
++		part.offset = of_read_number(reg, a_cells);
++		part.size = of_read_number(reg + a_cells, s_cells);
++		part.of_node = pp;
++
++		partname = of_get_property(pp, "label", &len);
++		if (!partname)
++			partname = of_get_property(pp, "name", &len);
++		part.name = partname;
++
++		if (!strncmp(target_part->name, part.name, len)) {
++			if (part.offset != target_part->offset)
++				return -EINVAL;
++
++			if (part.size != target_part->size)
++				return -EINVAL;
++
++			memcpy(fixed_part, &part, sizeof(struct mtd_partition));
++			return 0;
++		}
++	}
++
++	return -EINVAL;
++}
++
+ /*
+  * Main function to be called from the MTD mapping driver/device to
+  * obtain the partitioning information. At this point the command line
+@@ -338,6 +401,7 @@ static int parse_cmdline_partitions(stru
+ 	int i, err;
+ 	struct cmdline_mtd_partition *part;
+ 	const char *mtd_id = master->name;
++	struct mtd_partition fixed_part;
+ 
+ 	/* parse command line */
+ 	if (!cmdline_parsed) {
+@@ -382,6 +446,13 @@ static int parse_cmdline_partitions(stru
+ 				sizeof(*part->parts) * (part->num_parts - i));
+ 			i--;
+ 		}
++
++		err = search_fixed_partition(master, &part->parts[i], &fixed_part);
++		if (!err) {
++			part->parts[i].of_node = fixed_part.of_node;
++			pr_info("Found partition defined in DT for %s. Assigning OF node to support nvmem.",
++				part->parts[i].name);
++		}
+ 	}
+ 
+ 	*pparts = kmemdup(part->parts, sizeof(*part->parts) * part->num_parts,
diff --git a/target/linux/generic/hack-6.1/430-mtk-bmt-support.patch b/target/linux/generic/hack-6.1/430-mtk-bmt-support.patch
new file mode 100644
index 00000000000000..1e69ee644600ff
--- /dev/null
+++ b/target/linux/generic/hack-6.1/430-mtk-bmt-support.patch
@@ -0,0 +1,33 @@
+From ac84397efb3b3868c71c10ad7521161773228a17 Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 13:41:44 +0200
+Subject: [PATCH] mtd/nand: add MediaTek NAND bad block managment table
+
+---
+ drivers/mtd/nand/Kconfig  | 4 ++++
+ drivers/mtd/nand/Makefile | 1 +
+ 2 files changed, 5 insertions(+)
+
+--- a/drivers/mtd/nand/Kconfig
++++ b/drivers/mtd/nand/Kconfig
+@@ -46,6 +46,10 @@ config MTD_NAND_ECC_SW_BCH
+ 	  ECC codes. They are used with NAND devices requiring more than 1 bit
+ 	  of error correction.
+ 
++config MTD_NAND_MTK_BMT
++	bool "Support MediaTek NAND Bad-block Management Table"
++	default n
++
+ config MTD_NAND_ECC_MXIC
+ 	bool "Macronix external hardware ECC engine"
+ 	depends on HAS_IOMEM
+--- a/drivers/mtd/nand/Makefile
++++ b/drivers/mtd/nand/Makefile
+@@ -3,6 +3,7 @@
+ nandcore-objs := core.o bbt.o
+ obj-$(CONFIG_MTD_NAND_CORE) += nandcore.o
+ obj-$(CONFIG_MTD_NAND_ECC_MEDIATEK) += ecc-mtk.o
++obj-$(CONFIG_MTD_NAND_MTK_BMT)	+= mtk_bmt.o mtk_bmt_v2.o mtk_bmt_bbt.o mtk_bmt_nmbm.o
+ 
+ obj-y	+= onenand/
+ obj-y	+= raw/
diff --git a/target/linux/generic/hack-6.1/601-of_net-add-mac-address-ascii-support.patch b/target/linux/generic/hack-6.1/601-of_net-add-mac-address-ascii-support.patch
new file mode 100644
index 00000000000000..55866c313506aa
--- /dev/null
+++ b/target/linux/generic/hack-6.1/601-of_net-add-mac-address-ascii-support.patch
@@ -0,0 +1,116 @@
+From: Yousong Zhou <yszhou4tech@gmail.com>
+Subject: [PATCH] of: net: add nvmem cell mac-address-ascii support
+
+This is needed for devices with mac address stored in ascii format,
+e.g. HiWiFi HC6361 to be ported in the following patch.
+
+Submitted-by: Yousong Zhou <yszhou4tech@gmail.com>
+---
+ net/core/of_net.c | 83 ++++++++++++------
+ 1 files changed, 72 insertions(+), 11 deletions(-)
+
+--- a/net/core/of_net.c
++++ b/net/core/of_net.c
+@@ -57,13 +57,70 @@ static int of_get_mac_addr(struct device
+ 	return -ENODEV;
+ }
+ 
++static void *nvmem_cell_get_mac_address(struct nvmem_cell *cell)
++{
++	size_t len;
++	void *mac;
++
++	mac = nvmem_cell_read(cell, &len);
++	if (IS_ERR(mac))
++		return mac;
++	if (len != ETH_ALEN) {
++		kfree(mac);
++		return ERR_PTR(-EINVAL);
++	}
++	return mac;
++}
++
++static void *nvmem_cell_get_mac_address_ascii(struct nvmem_cell *cell)
++{
++	size_t len;
++	int ret;
++	void *mac_ascii;
++	u8 *mac;
++
++	mac_ascii = nvmem_cell_read(cell, &len);
++	if (IS_ERR(mac_ascii))
++		return mac_ascii;
++	if (len != ETH_ALEN*2+5) {
++		kfree(mac_ascii);
++		return ERR_PTR(-EINVAL);
++	}
++	mac = kmalloc(ETH_ALEN, GFP_KERNEL);
++	if (!mac) {
++		kfree(mac_ascii);
++		return ERR_PTR(-ENOMEM);
++	}
++	ret = sscanf(mac_ascii, "%2hhx:%2hhx:%2hhx:%2hhx:%2hhx:%2hhx",
++				&mac[0], &mac[1], &mac[2],
++				&mac[3], &mac[4], &mac[5]);
++	kfree(mac_ascii);
++	if (ret == ETH_ALEN)
++		return mac;
++	kfree(mac);
++	return ERR_PTR(-EINVAL);
++}
++
++static struct nvmem_cell_mac_address_property {
++	char *name;
++	void *(*read)(struct nvmem_cell *);
++} nvmem_cell_mac_address_properties[] = {
++	{
++		.name = "mac-address",
++		.read = nvmem_cell_get_mac_address,
++	}, {
++		.name = "mac-address-ascii",
++		.read = nvmem_cell_get_mac_address_ascii,
++	},
++};
++
+ static int of_get_mac_addr_nvmem(struct device_node *np, u8 *addr)
+ {
+ 	struct platform_device *pdev = of_find_device_by_node(np);
++	struct nvmem_cell_mac_address_property *property;
+ 	struct nvmem_cell *cell;
+ 	const void *mac;
+-	size_t len;
+-	int ret;
++	int ret, i;
+ 
+ 	/* Try lookup by device first, there might be a nvmem_cell_lookup
+ 	 * associated with a given device.
+@@ -74,17 +131,26 @@ static int of_get_mac_addr_nvmem(struct
+ 		return ret;
+ 	}
+ 
+-	cell = of_nvmem_cell_get(np, "mac-address");
++	for (i = 0; i < ARRAY_SIZE(nvmem_cell_mac_address_properties); i++) {
++		property = &nvmem_cell_mac_address_properties[i];
++		cell = of_nvmem_cell_get(np, property->name);
++		/* For -EPROBE_DEFER don't try other properties.
++		 * We'll get back to this one.
++		 */
++		if (!IS_ERR(cell) || PTR_ERR(cell) == -EPROBE_DEFER)
++			break;
++	}
++
+ 	if (IS_ERR(cell))
+ 		return PTR_ERR(cell);
+ 
+-	mac = nvmem_cell_read(cell, &len);
++	mac = property->read(cell);
+ 	nvmem_cell_put(cell);
+ 
+ 	if (IS_ERR(mac))
+ 		return PTR_ERR(mac);
+ 
+-	if (len != ETH_ALEN || !is_valid_ether_addr(mac)) {
++	if (!is_valid_ether_addr(mac)) {
+ 		kfree(mac);
+ 		return -EINVAL;
+ 	}
diff --git a/target/linux/generic/hack-6.1/645-netfilter-connmark-introduce-set-dscpmark.patch b/target/linux/generic/hack-6.1/645-netfilter-connmark-introduce-set-dscpmark.patch
new file mode 100644
index 00000000000000..444f8edfea7ca2
--- /dev/null
+++ b/target/linux/generic/hack-6.1/645-netfilter-connmark-introduce-set-dscpmark.patch
@@ -0,0 +1,214 @@
+From eda40b8c8c82e0f2789d6bc8bf63846dce2e8f32 Mon Sep 17 00:00:00 2001
+From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+Date: Sat, 23 Mar 2019 09:29:49 +0000
+Subject: [PATCH] netfilter: connmark: introduce set-dscpmark
+
+set-dscpmark is a method of storing the DSCP of an ip packet into
+conntrack mark.  In combination with a suitable tc filter action
+(act_ctinfo) DSCP values are able to be stored in the mark on egress and
+restored on ingress across links that otherwise alter or bleach DSCP.
+
+This is useful for qdiscs such as CAKE which are able to shape according
+to policies based on DSCP.
+
+Ingress classification is traditionally a challenging task since
+iptables rules haven't yet run and tc filter/eBPF programs are pre-NAT
+lookups, hence are unable to see internal IPv4 addresses as used on the
+typical home masquerading gateway.
+
+x_tables CONNMARK set-dscpmark target solves the problem of storing the
+DSCP to the conntrack mark in a way suitable for the new act_ctinfo tc
+action to restore.
+
+The set-dscpmark option accepts 2 parameters, a 32bit 'dscpmask' and a
+32bit 'statemask'.  The dscp mask must be 6 contiguous bits and
+represents the area where the DSCP will be stored in the connmark.  The
+state mask is a minimum 1 bit length mask that must not overlap with the
+dscpmask.  It represents a flag which is set when the DSCP has been
+stored in the conntrack mark. This is useful to implement a 'one shot'
+iptables based classification where the 'complicated' iptables rules are
+only run once to classify the connection on initial (egress) packet and
+subsequent packets are all marked/restored with the same DSCP.  A state
+mask of zero disables the setting of a status bit/s.
+
+example syntax with a suitably modified iptables user space application:
+
+iptables -A QOS_MARK_eth0 -t mangle -j CONNMARK --set-dscpmark 0xfc000000/0x01000000
+
+Would store the DSCP in the top 6 bits of the 32bit mark field, and use
+the LSB of the top byte as the 'DSCP has been stored' marker.
+
+|----0xFC----conntrack mark----000000---|
+| Bits 31-26 | bit 25 | bit24 |~~~ Bit 0|
+| DSCP       | unused | flag  |unused   |
+|-----------------------0x01---000000---|
+      ^                   ^
+      |                   |
+      ---|             Conditional flag
+         |             set this when dscp
+|-ip diffserv-|        stored in mark
+| 6 bits      |
+|-------------|
+
+an identically configured tc action to restore looks like:
+
+tc filter show dev eth0 ingress
+filter parent ffff: protocol all pref 10 u32 chain 0
+filter parent ffff: protocol all pref 10 u32 chain 0 fh 800: ht divisor 1
+filter parent ffff: protocol all pref 10 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1: not_in_hw
+  match 00000000/00000000 at 0
+	action order 1: ctinfo zone 0 pipe
+	 index 2 ref 1 bind 1 dscp 0xfc000000/0x1000000
+
+	action order 2: mirred (Egress Redirect to device ifb4eth0) stolen
+	index 1 ref 1 bind 1
+
+|----0xFC----conntrack mark----000000---|
+| Bits 31-26 | bit 25 | bit24 |~~~ Bit 0|
+| DSCP       | unused | flag  |unused   |
+|-----------------------0x01---000000---|
+      |                   |
+      |                   |
+      ---|             Conditional flag
+         v             only restore if set
+|-ip diffserv-|
+| 6 bits      |
+|-------------|
+
+Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+---
+ include/uapi/linux/netfilter/xt_connmark.h | 10 ++++
+ net/netfilter/xt_connmark.c                | 55 ++++++++++++++++++----
+ 2 files changed, 57 insertions(+), 8 deletions(-)
+
+--- a/include/uapi/linux/netfilter/xt_connmark.h
++++ b/include/uapi/linux/netfilter/xt_connmark.h
+@@ -15,6 +15,11 @@ enum {
+ };
+ 
+ enum {
++	XT_CONNMARK_VALUE =	(1 << 0),
++	XT_CONNMARK_DSCP = 	(1 << 1)
++};
++
++enum {
+ 	D_SHIFT_LEFT = 0,
+ 	D_SHIFT_RIGHT,
+ };
+@@ -29,6 +34,11 @@ struct xt_connmark_tginfo2 {
+ 	__u8 shift_dir, shift_bits, mode;
+ };
+ 
++struct xt_connmark_tginfo3 {
++	__u32 ctmark, ctmask, nfmask;
++	__u8 shift_dir, shift_bits, mode, func;
++};
++
+ struct xt_connmark_mtinfo1 {
+ 	__u32 mark, mask;
+ 	__u8 invert;
+--- a/net/netfilter/xt_connmark.c
++++ b/net/netfilter/xt_connmark.c
+@@ -24,13 +24,13 @@ MODULE_ALIAS("ipt_connmark");
+ MODULE_ALIAS("ip6t_connmark");
+ 
+ static unsigned int
+-connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info)
++connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo3 *info)
+ {
+ 	enum ip_conntrack_info ctinfo;
+ 	u_int32_t new_targetmark;
+ 	struct nf_conn *ct;
+ 	u_int32_t newmark;
+-	u_int32_t oldmark;
++	u_int8_t dscp;
+ 
+ 	ct = nf_ct_get(skb, &ctinfo);
+ 	if (ct == NULL)
+@@ -38,13 +38,24 @@ connmark_tg_shift(struct sk_buff *skb, c
+ 
+ 	switch (info->mode) {
+ 	case XT_CONNMARK_SET:
+-		oldmark = READ_ONCE(ct->mark);
+-		newmark = (oldmark & ~info->ctmask) ^ info->ctmark;
+-		if (info->shift_dir == D_SHIFT_RIGHT)
+-			newmark >>= info->shift_bits;
+-		else
+-			newmark <<= info->shift_bits;
++		newmark = READ_ONCE(ct->mark);
++		if (info->func & XT_CONNMARK_VALUE) {
++			newmark = (newmark & ~info->ctmask) ^ info->ctmark;
++			if (info->shift_dir == D_SHIFT_RIGHT)
++				newmark >>= info->shift_bits;
++			else
++				newmark <<= info->shift_bits;
++		} else if (info->func & XT_CONNMARK_DSCP) {
++			if (skb->protocol == htons(ETH_P_IP))
++				dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2;
++			else if (skb->protocol == htons(ETH_P_IPV6))
++				dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2;
++			else	/* protocol doesn't have diffserv */
++				break;
+ 
++			newmark = (newmark & ~info->ctmark) |
++				  (info->ctmask | (dscp << info->shift_bits));
++		}
+ 		if (READ_ONCE(ct->mark) != newmark) {
+ 			WRITE_ONCE(ct->mark, newmark);
+ 			nf_conntrack_event_cache(IPCT_MARK, ct);
+@@ -83,20 +94,36 @@ static unsigned int
+ connmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
+ {
+ 	const struct xt_connmark_tginfo1 *info = par->targinfo;
+-	const struct xt_connmark_tginfo2 info2 = {
++	const struct xt_connmark_tginfo3 info3 = {
+ 		.ctmark	= info->ctmark,
+ 		.ctmask	= info->ctmask,
+ 		.nfmask	= info->nfmask,
+ 		.mode	= info->mode,
++		.func	= XT_CONNMARK_VALUE
+ 	};
+ 
+-	return connmark_tg_shift(skb, &info2);
++	return connmark_tg_shift(skb, &info3);
+ }
+ 
+ static unsigned int
+ connmark_tg_v2(struct sk_buff *skb, const struct xt_action_param *par)
+ {
+ 	const struct xt_connmark_tginfo2 *info = par->targinfo;
++	const struct xt_connmark_tginfo3 info3 = {
++		.ctmark	= info->ctmark,
++		.ctmask	= info->ctmask,
++		.nfmask	= info->nfmask,
++		.mode	= info->mode,
++		.func	= XT_CONNMARK_VALUE
++	};
++
++	return connmark_tg_shift(skb, &info3);
++}
++
++static unsigned int
++connmark_tg_v3(struct sk_buff *skb, const struct xt_action_param *par)
++{
++	const struct xt_connmark_tginfo3 *info = par->targinfo;
+ 
+ 	return connmark_tg_shift(skb, info);
+ }
+@@ -167,6 +194,16 @@ static struct xt_target connmark_tg_reg[
+ 		.targetsize     = sizeof(struct xt_connmark_tginfo2),
+ 		.destroy        = connmark_tg_destroy,
+ 		.me             = THIS_MODULE,
++	},
++	{
++		.name           = "CONNMARK",
++		.revision       = 3,
++		.family         = NFPROTO_UNSPEC,
++		.checkentry     = connmark_tg_check,
++		.target         = connmark_tg_v3,
++		.targetsize     = sizeof(struct xt_connmark_tginfo3),
++		.destroy        = connmark_tg_destroy,
++		.me             = THIS_MODULE,
+ 	}
+ };
+ 
diff --git a/target/linux/generic/hack-6.1/650-netfilter-add-xt_FLOWOFFLOAD-target.patch b/target/linux/generic/hack-6.1/650-netfilter-add-xt_FLOWOFFLOAD-target.patch
new file mode 100644
index 00000000000000..386291bfe816a6
--- /dev/null
+++ b/target/linux/generic/hack-6.1/650-netfilter-add-xt_FLOWOFFLOAD-target.patch
@@ -0,0 +1,799 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 20 Feb 2018 15:56:02 +0100
+Subject: [PATCH] netfilter: add xt_FLOWOFFLOAD target
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ create mode 100644 net/netfilter/xt_OFFLOAD.c
+
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -1023,6 +1023,15 @@ config NETFILTER_XT_TARGET_NOTRACK
+ 	depends on NETFILTER_ADVANCED
+ 	select NETFILTER_XT_TARGET_CT
+ 
++config NETFILTER_XT_TARGET_FLOWOFFLOAD
++	tristate '"FLOWOFFLOAD" target support'
++	depends on NF_FLOW_TABLE
++	depends on NETFILTER_INGRESS
++	help
++	  This option adds a `FLOWOFFLOAD' target, which uses the nf_flow_offload
++	  module to speed up processing of packets by bypassing the usual
++	  netfilter chains
++
+ config NETFILTER_XT_TARGET_RATEEST
+ 	tristate '"RATEEST" target support'
+ 	depends on NETFILTER_ADVANCED
+--- a/net/netfilter/Makefile
++++ b/net/netfilter/Makefile
+@@ -154,6 +154,7 @@ obj-$(CONFIG_NETFILTER_XT_TARGET_CLASSIF
+ obj-$(CONFIG_NETFILTER_XT_TARGET_CONNSECMARK) += xt_CONNSECMARK.o
+ obj-$(CONFIG_NETFILTER_XT_TARGET_CT) += xt_CT.o
+ obj-$(CONFIG_NETFILTER_XT_TARGET_DSCP) += xt_DSCP.o
++obj-$(CONFIG_NETFILTER_XT_TARGET_FLOWOFFLOAD) += xt_FLOWOFFLOAD.o
+ obj-$(CONFIG_NETFILTER_XT_TARGET_HL) += xt_HL.o
+ obj-$(CONFIG_NETFILTER_XT_TARGET_HMARK) += xt_HMARK.o
+ obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o
+--- /dev/null
++++ b/net/netfilter/xt_FLOWOFFLOAD.c
+@@ -0,0 +1,698 @@
++/*
++ * Copyright (C) 2018-2021 Felix Fietkau <nbd@nbd.name>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++#include <linux/module.h>
++#include <linux/init.h>
++#include <linux/netfilter.h>
++#include <linux/netfilter/xt_FLOWOFFLOAD.h>
++#include <linux/if_vlan.h>
++#include <net/ip.h>
++#include <net/netfilter/nf_conntrack.h>
++#include <net/netfilter/nf_conntrack_extend.h>
++#include <net/netfilter/nf_conntrack_helper.h>
++#include <net/netfilter/nf_flow_table.h>
++
++struct xt_flowoffload_hook {
++	struct hlist_node list;
++	struct nf_hook_ops ops;
++	struct net *net;
++	bool registered;
++	bool used;
++};
++
++struct xt_flowoffload_table {
++	struct nf_flowtable ft;
++	struct hlist_head hooks;
++	struct delayed_work work;
++};
++
++struct nf_forward_info {
++	const struct net_device *indev;
++	const struct net_device *outdev;
++	const struct net_device *hw_outdev;
++	struct id {
++		__u16	id;
++		__be16	proto;
++	} encap[NF_FLOW_TABLE_ENCAP_MAX];
++	u8 num_encaps;
++	u8 ingress_vlans;
++	u8 h_source[ETH_ALEN];
++	u8 h_dest[ETH_ALEN];
++	enum flow_offload_xmit_type xmit_type;
++};
++
++static DEFINE_SPINLOCK(hooks_lock);
++
++struct xt_flowoffload_table flowtable[2];
++
++static unsigned int
++xt_flowoffload_net_hook(void *priv, struct sk_buff *skb,
++			const struct nf_hook_state *state)
++{
++	struct vlan_ethhdr *veth;
++	__be16 proto;
++
++	switch (skb->protocol) {
++	case htons(ETH_P_8021Q):
++		veth = (struct vlan_ethhdr *)skb_mac_header(skb);
++		proto = veth->h_vlan_encapsulated_proto;
++		break;
++	case htons(ETH_P_PPP_SES):
++		proto = nf_flow_pppoe_proto(skb);
++		break;
++	default:
++		proto = skb->protocol;
++		break;
++	}
++
++	switch (proto) {
++	case htons(ETH_P_IP):
++		return nf_flow_offload_ip_hook(priv, skb, state);
++	case htons(ETH_P_IPV6):
++		return nf_flow_offload_ipv6_hook(priv, skb, state);
++	}
++
++	return NF_ACCEPT;
++}
++
++static int
++xt_flowoffload_create_hook(struct xt_flowoffload_table *table,
++			   struct net_device *dev)
++{
++	struct xt_flowoffload_hook *hook;
++	struct nf_hook_ops *ops;
++
++	hook = kzalloc(sizeof(*hook), GFP_ATOMIC);
++	if (!hook)
++		return -ENOMEM;
++
++	ops = &hook->ops;
++	ops->pf = NFPROTO_NETDEV;
++	ops->hooknum = NF_NETDEV_INGRESS;
++	ops->priority = 10;
++	ops->priv = &table->ft;
++	ops->hook = xt_flowoffload_net_hook;
++	ops->dev = dev;
++
++	hlist_add_head(&hook->list, &table->hooks);
++	mod_delayed_work(system_power_efficient_wq, &table->work, 0);
++
++	return 0;
++}
++
++static struct xt_flowoffload_hook *
++flow_offload_lookup_hook(struct xt_flowoffload_table *table,
++			 struct net_device *dev)
++{
++	struct xt_flowoffload_hook *hook;
++
++	hlist_for_each_entry(hook, &table->hooks, list) {
++		if (hook->ops.dev == dev)
++			return hook;
++	}
++
++	return NULL;
++}
++
++static void
++xt_flowoffload_check_device(struct xt_flowoffload_table *table,
++			    struct net_device *dev)
++{
++	struct xt_flowoffload_hook *hook;
++
++	if (!dev)
++		return;
++
++	spin_lock_bh(&hooks_lock);
++	hook = flow_offload_lookup_hook(table, dev);
++	if (hook)
++		hook->used = true;
++	else
++		xt_flowoffload_create_hook(table, dev);
++	spin_unlock_bh(&hooks_lock);
++}
++
++static void
++xt_flowoffload_register_hooks(struct xt_flowoffload_table *table)
++{
++	struct xt_flowoffload_hook *hook;
++
++restart:
++	hlist_for_each_entry(hook, &table->hooks, list) {
++		if (hook->registered)
++			continue;
++
++		hook->registered = true;
++		hook->net = dev_net(hook->ops.dev);
++		spin_unlock_bh(&hooks_lock);
++		nf_register_net_hook(hook->net, &hook->ops);
++		if (table->ft.flags & NF_FLOWTABLE_HW_OFFLOAD)
++			table->ft.type->setup(&table->ft, hook->ops.dev,
++					      FLOW_BLOCK_BIND);
++		spin_lock_bh(&hooks_lock);
++		goto restart;
++	}
++
++}
++
++static bool
++xt_flowoffload_cleanup_hooks(struct xt_flowoffload_table *table)
++{
++	struct xt_flowoffload_hook *hook;
++	bool active = false;
++
++restart:
++	spin_lock_bh(&hooks_lock);
++	hlist_for_each_entry(hook, &table->hooks, list) {
++		if (hook->used || !hook->registered) {
++			active = true;
++			continue;
++		}
++
++		hlist_del(&hook->list);
++		spin_unlock_bh(&hooks_lock);
++		if (table->ft.flags & NF_FLOWTABLE_HW_OFFLOAD)
++			table->ft.type->setup(&table->ft, hook->ops.dev,
++					      FLOW_BLOCK_UNBIND);
++		nf_unregister_net_hook(hook->net, &hook->ops);
++		kfree(hook);
++		goto restart;
++	}
++	spin_unlock_bh(&hooks_lock);
++
++	return active;
++}
++
++static void
++xt_flowoffload_check_hook(struct nf_flowtable *flowtable,
++			  struct flow_offload *flow, void *data)
++{
++	struct xt_flowoffload_table *table;
++	struct flow_offload_tuple *tuple0 = &flow->tuplehash[0].tuple;
++	struct flow_offload_tuple *tuple1 = &flow->tuplehash[1].tuple;
++	struct xt_flowoffload_hook *hook;
++
++	table = container_of(flowtable, struct xt_flowoffload_table, ft);
++
++	spin_lock_bh(&hooks_lock);
++	hlist_for_each_entry(hook, &table->hooks, list) {
++		if (hook->ops.dev->ifindex != tuple0->iifidx &&
++		    hook->ops.dev->ifindex != tuple1->iifidx)
++			continue;
++
++		hook->used = true;
++	}
++	spin_unlock_bh(&hooks_lock);
++}
++
++static void
++xt_flowoffload_hook_work(struct work_struct *work)
++{
++	struct xt_flowoffload_table *table;
++	struct xt_flowoffload_hook *hook;
++	int err;
++
++	table = container_of(work, struct xt_flowoffload_table, work.work);
++
++	spin_lock_bh(&hooks_lock);
++	xt_flowoffload_register_hooks(table);
++	hlist_for_each_entry(hook, &table->hooks, list)
++		hook->used = false;
++	spin_unlock_bh(&hooks_lock);
++
++	err = nf_flow_table_iterate(&table->ft, xt_flowoffload_check_hook,
++				    NULL);
++	if (err && err != -EAGAIN)
++		goto out;
++
++	if (!xt_flowoffload_cleanup_hooks(table))
++		return;
++
++out:
++	queue_delayed_work(system_power_efficient_wq, &table->work, HZ);
++}
++
++static bool
++xt_flowoffload_skip(struct sk_buff *skb, int family)
++{
++	if (skb_sec_path(skb))
++		return true;
++
++	if (family == NFPROTO_IPV4) {
++		const struct ip_options *opt = &(IPCB(skb)->opt);
++
++		if (unlikely(opt->optlen))
++			return true;
++	}
++
++	return false;
++}
++
++static enum flow_offload_xmit_type nf_xmit_type(struct dst_entry *dst)
++{
++	if (dst_xfrm(dst))
++		return FLOW_OFFLOAD_XMIT_XFRM;
++
++	return FLOW_OFFLOAD_XMIT_NEIGH;
++}
++
++static void nf_default_forward_path(struct nf_flow_route *route,
++				    struct dst_entry *dst_cache,
++				    enum ip_conntrack_dir dir,
++				    struct net_device **dev)
++{
++	dev[!dir] = dst_cache->dev;
++	route->tuple[!dir].in.ifindex	= dst_cache->dev->ifindex;
++	route->tuple[dir].dst		= dst_cache;
++	route->tuple[dir].xmit_type	= nf_xmit_type(dst_cache);
++}
++
++static bool nf_is_valid_ether_device(const struct net_device *dev)
++{
++	if (!dev || (dev->flags & IFF_LOOPBACK) || dev->type != ARPHRD_ETHER ||
++	    dev->addr_len != ETH_ALEN || !is_valid_ether_addr(dev->dev_addr))
++		return false;
++
++	return true;
++}
++
++static void nf_dev_path_info(const struct net_device_path_stack *stack,
++			     struct nf_forward_info *info,
++			     unsigned char *ha)
++{
++	const struct net_device_path *path;
++	int i;
++
++	memcpy(info->h_dest, ha, ETH_ALEN);
++
++	for (i = 0; i < stack->num_paths; i++) {
++		path = &stack->path[i];
++		switch (path->type) {
++		case DEV_PATH_ETHERNET:
++		case DEV_PATH_DSA:
++		case DEV_PATH_VLAN:
++		case DEV_PATH_PPPOE:
++			info->indev = path->dev;
++			if (is_zero_ether_addr(info->h_source))
++				memcpy(info->h_source, path->dev->dev_addr, ETH_ALEN);
++
++			if (path->type == DEV_PATH_ETHERNET)
++				break;
++			if (path->type == DEV_PATH_DSA) {
++				i = stack->num_paths;
++				break;
++			}
++
++			/* DEV_PATH_VLAN and DEV_PATH_PPPOE */
++			if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX) {
++				info->indev = NULL;
++				break;
++			}
++			if (!info->outdev)
++				info->outdev = path->dev;
++			info->encap[info->num_encaps].id = path->encap.id;
++			info->encap[info->num_encaps].proto = path->encap.proto;
++			info->num_encaps++;
++			if (path->type == DEV_PATH_PPPOE)
++				memcpy(info->h_dest, path->encap.h_dest, ETH_ALEN);
++			break;
++		case DEV_PATH_BRIDGE:
++			if (is_zero_ether_addr(info->h_source))
++				memcpy(info->h_source, path->dev->dev_addr, ETH_ALEN);
++
++			switch (path->bridge.vlan_mode) {
++			case DEV_PATH_BR_VLAN_UNTAG_HW:
++				info->ingress_vlans |= BIT(info->num_encaps - 1);
++				break;
++			case DEV_PATH_BR_VLAN_TAG:
++				info->encap[info->num_encaps].id = path->bridge.vlan_id;
++				info->encap[info->num_encaps].proto = path->bridge.vlan_proto;
++				info->num_encaps++;
++				break;
++			case DEV_PATH_BR_VLAN_UNTAG:
++				info->num_encaps--;
++				break;
++			case DEV_PATH_BR_VLAN_KEEP:
++				break;
++			}
++			break;
++		default:
++			info->indev = NULL;
++			break;
++		}
++	}
++	if (!info->outdev)
++		info->outdev = info->indev;
++
++	info->hw_outdev = info->indev;
++
++	if (nf_is_valid_ether_device(info->indev))
++		info->xmit_type = FLOW_OFFLOAD_XMIT_DIRECT;
++}
++
++static int nf_dev_fill_forward_path(const struct nf_flow_route *route,
++				     const struct dst_entry *dst_cache,
++				     const struct nf_conn *ct,
++				     enum ip_conntrack_dir dir, u8 *ha,
++				     struct net_device_path_stack *stack)
++{
++	const void *daddr = &ct->tuplehash[!dir].tuple.src.u3;
++	struct net_device *dev = dst_cache->dev;
++	struct neighbour *n;
++	u8 nud_state;
++
++	if (!nf_is_valid_ether_device(dev))
++		goto out;
++
++	n = dst_neigh_lookup(dst_cache, daddr);
++	if (!n)
++		return -1;
++
++	read_lock_bh(&n->lock);
++	nud_state = n->nud_state;
++	ether_addr_copy(ha, n->ha);
++	read_unlock_bh(&n->lock);
++	neigh_release(n);
++
++	if (!(nud_state & NUD_VALID))
++		return -1;
++
++out:
++	return dev_fill_forward_path(dev, ha, stack);
++}
++
++static void nf_dev_forward_path(struct nf_flow_route *route,
++				const struct nf_conn *ct,
++				enum ip_conntrack_dir dir,
++				struct net_device **devs)
++{
++	const struct dst_entry *dst = route->tuple[dir].dst;
++	struct net_device_path_stack stack;
++	struct nf_forward_info info = {};
++	unsigned char ha[ETH_ALEN];
++	int i;
++
++	if (nf_dev_fill_forward_path(route, dst, ct, dir, ha, &stack) >= 0)
++		nf_dev_path_info(&stack, &info, ha);
++
++	devs[!dir] = (struct net_device *)info.indev;
++	if (!info.indev)
++		return;
++
++	route->tuple[!dir].in.ifindex = info.indev->ifindex;
++	for (i = 0; i < info.num_encaps; i++) {
++		route->tuple[!dir].in.encap[i].id = info.encap[i].id;
++		route->tuple[!dir].in.encap[i].proto = info.encap[i].proto;
++	}
++	route->tuple[!dir].in.num_encaps = info.num_encaps;
++	route->tuple[!dir].in.ingress_vlans = info.ingress_vlans;
++
++	if (info.xmit_type == FLOW_OFFLOAD_XMIT_DIRECT) {
++		memcpy(route->tuple[dir].out.h_source, info.h_source, ETH_ALEN);
++		memcpy(route->tuple[dir].out.h_dest, info.h_dest, ETH_ALEN);
++		route->tuple[dir].out.ifindex = info.outdev->ifindex;
++		route->tuple[dir].out.hw_ifindex = info.hw_outdev->ifindex;
++		route->tuple[dir].xmit_type = info.xmit_type;
++	}
++}
++
++static int
++xt_flowoffload_route(struct sk_buff *skb, const struct nf_conn *ct,
++		     const struct xt_action_param *par,
++		     struct nf_flow_route *route, enum ip_conntrack_dir dir,
++		     struct net_device **devs)
++{
++	struct dst_entry *this_dst = skb_dst(skb);
++	struct dst_entry *other_dst = NULL;
++	struct flowi fl;
++
++	memset(&fl, 0, sizeof(fl));
++	switch (xt_family(par)) {
++	case NFPROTO_IPV4:
++		fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip;
++		fl.u.ip4.flowi4_oif = xt_in(par)->ifindex;
++		break;
++	case NFPROTO_IPV6:
++		fl.u.ip6.saddr = ct->tuplehash[!dir].tuple.dst.u3.in6;
++		fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6;
++		fl.u.ip6.flowi6_oif = xt_in(par)->ifindex;
++		break;
++	}
++
++	nf_route(xt_net(par), &other_dst, &fl, false, xt_family(par));
++	if (!other_dst)
++		return -ENOENT;
++
++	nf_default_forward_path(route, this_dst, dir, devs);
++	nf_default_forward_path(route, other_dst, !dir, devs);
++
++	if (route->tuple[dir].xmit_type	== FLOW_OFFLOAD_XMIT_NEIGH &&
++	    route->tuple[!dir].xmit_type == FLOW_OFFLOAD_XMIT_NEIGH) {
++		nf_dev_forward_path(route, ct, dir, devs);
++		nf_dev_forward_path(route, ct, !dir, devs);
++	}
++
++	return 0;
++}
++
++static unsigned int
++flowoffload_tg(struct sk_buff *skb, const struct xt_action_param *par)
++{
++	struct xt_flowoffload_table *table;
++	const struct xt_flowoffload_target_info *info = par->targinfo;
++	struct tcphdr _tcph, *tcph = NULL;
++	enum ip_conntrack_info ctinfo;
++	enum ip_conntrack_dir dir;
++	struct nf_flow_route route = {};
++	struct flow_offload *flow = NULL;
++	struct net_device *devs[2] = {};
++	struct nf_conn *ct;
++	struct net *net;
++
++	if (xt_flowoffload_skip(skb, xt_family(par)))
++		return XT_CONTINUE;
++
++	ct = nf_ct_get(skb, &ctinfo);
++	if (ct == NULL)
++		return XT_CONTINUE;
++
++	switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum) {
++	case IPPROTO_TCP:
++		if (ct->proto.tcp.state != TCP_CONNTRACK_ESTABLISHED)
++			return XT_CONTINUE;
++
++		tcph = skb_header_pointer(skb, par->thoff,
++					  sizeof(_tcph), &_tcph);
++		if (unlikely(!tcph || tcph->fin || tcph->rst))
++			return XT_CONTINUE;
++		break;
++	case IPPROTO_UDP:
++		break;
++	default:
++		return XT_CONTINUE;
++	}
++
++	if (nf_ct_ext_exist(ct, NF_CT_EXT_HELPER) ||
++	    ct->status & (IPS_SEQ_ADJUST | IPS_NAT_CLASH))
++		return XT_CONTINUE;
++
++	if (!nf_ct_is_confirmed(ct))
++		return XT_CONTINUE;
++
++	devs[dir] = xt_out(par);
++	devs[!dir] = xt_in(par);
++
++	if (!devs[dir] || !devs[!dir])
++		return XT_CONTINUE;
++
++	if (test_and_set_bit(IPS_OFFLOAD_BIT, &ct->status))
++		return XT_CONTINUE;
++
++	dir = CTINFO2DIR(ctinfo);
++
++	if (xt_flowoffload_route(skb, ct, par, &route, dir, devs) < 0)
++		goto err_flow_route;
++
++	flow = flow_offload_alloc(ct);
++	if (!flow)
++		goto err_flow_alloc;
++
++	if (flow_offload_route_init(flow, &route) < 0)
++		goto err_flow_add;
++
++	if (tcph) {
++		ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
++		ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
++	}
++
++	table = &flowtable[!!(info->flags & XT_FLOWOFFLOAD_HW)];
++
++	net = read_pnet(&table->ft.net);
++	if (!net)
++		write_pnet(&table->ft.net, xt_net(par));
++
++	if (flow_offload_add(&table->ft, flow) < 0)
++		goto err_flow_add;
++
++	xt_flowoffload_check_device(table, devs[0]);
++	xt_flowoffload_check_device(table, devs[1]);
++
++	dst_release(route.tuple[!dir].dst);
++
++	return XT_CONTINUE;
++
++err_flow_add:
++	flow_offload_free(flow);
++err_flow_alloc:
++	dst_release(route.tuple[!dir].dst);
++err_flow_route:
++	clear_bit(IPS_OFFLOAD_BIT, &ct->status);
++
++	return XT_CONTINUE;
++}
++
++static int flowoffload_chk(const struct xt_tgchk_param *par)
++{
++	struct xt_flowoffload_target_info *info = par->targinfo;
++
++	if (info->flags & ~XT_FLOWOFFLOAD_MASK)
++		return -EINVAL;
++
++	return 0;
++}
++
++static struct xt_target offload_tg_reg __read_mostly = {
++	.family		= NFPROTO_UNSPEC,
++	.name		= "FLOWOFFLOAD",
++	.revision	= 0,
++	.targetsize	= sizeof(struct xt_flowoffload_target_info),
++	.usersize	= sizeof(struct xt_flowoffload_target_info),
++	.checkentry	= flowoffload_chk,
++	.target		= flowoffload_tg,
++	.me		= THIS_MODULE,
++};
++
++static int flow_offload_netdev_event(struct notifier_block *this,
++				     unsigned long event, void *ptr)
++{
++	struct xt_flowoffload_hook *hook0, *hook1;
++	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
++
++	if (event != NETDEV_UNREGISTER)
++		return NOTIFY_DONE;
++
++	spin_lock_bh(&hooks_lock);
++	hook0 = flow_offload_lookup_hook(&flowtable[0], dev);
++	if (hook0)
++		hlist_del(&hook0->list);
++
++	hook1 = flow_offload_lookup_hook(&flowtable[1], dev);
++	if (hook1)
++		hlist_del(&hook1->list);
++	spin_unlock_bh(&hooks_lock);
++
++	if (hook0) {
++		nf_unregister_net_hook(hook0->net, &hook0->ops);
++		kfree(hook0);
++	}
++
++	if (hook1) {
++		nf_unregister_net_hook(hook1->net, &hook1->ops);
++		kfree(hook1);
++	}
++
++	nf_flow_table_cleanup(dev);
++
++	return NOTIFY_DONE;
++}
++
++static struct notifier_block flow_offload_netdev_notifier = {
++	.notifier_call	= flow_offload_netdev_event,
++};
++
++static int nf_flow_rule_route_inet(struct net *net,
++				   const struct flow_offload *flow,
++				   enum flow_offload_tuple_dir dir,
++				   struct nf_flow_rule *flow_rule)
++{
++	const struct flow_offload_tuple *flow_tuple = &flow->tuplehash[dir].tuple;
++	int err;
++
++	switch (flow_tuple->l3proto) {
++	case NFPROTO_IPV4:
++		err = nf_flow_rule_route_ipv4(net, flow, dir, flow_rule);
++		break;
++	case NFPROTO_IPV6:
++		err = nf_flow_rule_route_ipv6(net, flow, dir, flow_rule);
++		break;
++	default:
++		err = -1;
++		break;
++	}
++
++	return err;
++}
++
++static struct nf_flowtable_type flowtable_inet = {
++	.family		= NFPROTO_INET,
++	.init		= nf_flow_table_init,
++	.setup		= nf_flow_table_offload_setup,
++	.action		= nf_flow_rule_route_inet,
++	.free		= nf_flow_table_free,
++	.hook		= xt_flowoffload_net_hook,
++	.owner		= THIS_MODULE,
++};
++
++static int init_flowtable(struct xt_flowoffload_table *tbl)
++{
++	INIT_DELAYED_WORK(&tbl->work, xt_flowoffload_hook_work);
++	tbl->ft.type = &flowtable_inet;
++	tbl->ft.flags = NF_FLOWTABLE_COUNTER;
++
++	return nf_flow_table_init(&tbl->ft);
++}
++
++static int __init xt_flowoffload_tg_init(void)
++{
++	int ret;
++
++	register_netdevice_notifier(&flow_offload_netdev_notifier);
++
++	ret = init_flowtable(&flowtable[0]);
++	if (ret)
++		return ret;
++
++	ret = init_flowtable(&flowtable[1]);
++	if (ret)
++		goto cleanup;
++
++	flowtable[1].ft.flags |= NF_FLOWTABLE_HW_OFFLOAD;
++
++	ret = xt_register_target(&offload_tg_reg);
++	if (ret)
++		goto cleanup2;
++
++	return 0;
++
++cleanup2:
++	nf_flow_table_free(&flowtable[1].ft);
++cleanup:
++	nf_flow_table_free(&flowtable[0].ft);
++	return ret;
++}
++
++static void __exit xt_flowoffload_tg_exit(void)
++{
++	xt_unregister_target(&offload_tg_reg);
++	unregister_netdevice_notifier(&flow_offload_netdev_notifier);
++	nf_flow_table_free(&flowtable[0].ft);
++	nf_flow_table_free(&flowtable[1].ft);
++}
++
++MODULE_LICENSE("GPL");
++module_init(xt_flowoffload_tg_init);
++module_exit(xt_flowoffload_tg_exit);
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -7,7 +7,6 @@
+ #include <linux/netdevice.h>
+ #include <net/ip.h>
+ #include <net/ip6_route.h>
+-#include <net/netfilter/nf_tables.h>
+ #include <net/netfilter/nf_flow_table.h>
+ #include <net/netfilter/nf_conntrack.h>
+ #include <net/netfilter/nf_conntrack_core.h>
+@@ -381,8 +380,7 @@ flow_offload_lookup(struct nf_flowtable
+ }
+ EXPORT_SYMBOL_GPL(flow_offload_lookup);
+ 
+-static int
+-nf_flow_table_iterate(struct nf_flowtable *flow_table,
++int nf_flow_table_iterate(struct nf_flowtable *flow_table,
+ 		      void (*iter)(struct nf_flowtable *flowtable,
+ 				   struct flow_offload *flow, void *data),
+ 		      void *data)
+@@ -436,6 +434,7 @@ static void nf_flow_offload_gc_step(stru
+ 		nf_flow_offload_stats(flow_table, flow);
+ 	}
+ }
++EXPORT_SYMBOL_GPL(nf_flow_table_iterate);
+ 
+ void nf_flow_table_gc_run(struct nf_flowtable *flow_table)
+ {
+--- /dev/null
++++ b/include/uapi/linux/netfilter/xt_FLOWOFFLOAD.h
+@@ -0,0 +1,17 @@
++/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
++#ifndef _XT_FLOWOFFLOAD_H
++#define _XT_FLOWOFFLOAD_H
++
++#include <linux/types.h>
++
++enum {
++	XT_FLOWOFFLOAD_HW	= 1 << 0,
++
++	XT_FLOWOFFLOAD_MASK	= XT_FLOWOFFLOAD_HW
++};
++
++struct xt_flowoffload_target_info {
++	__u32 flags;
++};
++
++#endif /* _XT_FLOWOFFLOAD_H */
+--- a/include/net/netfilter/nf_flow_table.h
++++ b/include/net/netfilter/nf_flow_table.h
+@@ -280,6 +280,11 @@ void nf_flow_table_free(struct nf_flowta
+ 
+ void flow_offload_teardown(struct flow_offload *flow);
+ 
++int nf_flow_table_iterate(struct nf_flowtable *flow_table,
++                      void (*iter)(struct nf_flowtable *flowtable,
++                                   struct flow_offload *flow, void *data),
++                      void *data);
++
+ void nf_flow_snat_port(const struct flow_offload *flow,
+ 		       struct sk_buff *skb, unsigned int thoff,
+ 		       u8 protocol, enum flow_offload_tuple_dir dir);
diff --git a/target/linux/generic/hack-6.1/651-wireless_mesh_header.patch b/target/linux/generic/hack-6.1/651-wireless_mesh_header.patch
new file mode 100644
index 00000000000000..fd7d5346ad99e4
--- /dev/null
+++ b/target/linux/generic/hack-6.1/651-wireless_mesh_header.patch
@@ -0,0 +1,24 @@
+From 6d3bc769657b0ee7c7506dad9911111c4226a7ea Mon Sep 17 00:00:00 2001
+From: Imre Kaloz <kaloz@openwrt.org>
+Date: Fri, 7 Jul 2017 17:21:05 +0200
+Subject: mac80211: increase wireless mesh header size
+
+lede-commit 3d4466cfd8f75f717efdb1f96fdde3c70d865fc1
+Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
+---
+ include/linux/netdevice.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -149,8 +149,8 @@ static inline bool dev_xmit_complete(int
+ 
+ #if defined(CONFIG_HYPERV_NET)
+ # define LL_MAX_HEADER 128
+-#elif defined(CONFIG_WLAN) || IS_ENABLED(CONFIG_AX25)
+-# if defined(CONFIG_MAC80211_MESH)
++#elif defined(CONFIG_WLAN) || IS_ENABLED(CONFIG_AX25) || 1
++# if defined(CONFIG_MAC80211_MESH) || 1
+ #  define LL_MAX_HEADER 128
+ # else
+ #  define LL_MAX_HEADER 96
diff --git a/target/linux/generic/hack-6.1/660-fq_codel_defaults.patch b/target/linux/generic/hack-6.1/660-fq_codel_defaults.patch
new file mode 100644
index 00000000000000..b923a2d206da3c
--- /dev/null
+++ b/target/linux/generic/hack-6.1/660-fq_codel_defaults.patch
@@ -0,0 +1,27 @@
+From a6ccb238939b25851474a279b20367fd24a0e816 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 7 Jul 2017 17:21:53 +0200
+Subject:  hack: net: fq_codel: tune defaults for small devices
+
+Assume that x86_64 devices always have a big memory and do not need this 
+optimization compared to devices with only 32 MB or 64 MB RAM.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ net/sched/sch_fq_codel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sched/sch_fq_codel.c
++++ b/net/sched/sch_fq_codel.c
+@@ -471,7 +471,11 @@ static int fq_codel_init(struct Qdisc *s
+ 
+ 	sch->limit = 10*1024;
+ 	q->flows_cnt = 1024;
++#ifdef CONFIG_X86_64
+ 	q->memory_limit = 32 << 20; /* 32 MBytes */
++#else
++	q->memory_limit = 4 << 20; /* 4 MBytes */
++#endif
+ 	q->drop_batch_size = 64;
+ 	q->quantum = psched_mtu(qdisc_dev(sch));
+ 	INIT_LIST_HEAD(&q->new_flows);
diff --git a/target/linux/generic/hack-6.1/661-kernel-ct-size-the-hashtable-more-adequately.patch b/target/linux/generic/hack-6.1/661-kernel-ct-size-the-hashtable-more-adequately.patch
new file mode 100644
index 00000000000000..fe94a9da0c4ecd
--- /dev/null
+++ b/target/linux/generic/hack-6.1/661-kernel-ct-size-the-hashtable-more-adequately.patch
@@ -0,0 +1,25 @@
+From 804fbb3f2ec9283f7b778e057a68bfff440a0be6 Mon Sep 17 00:00:00 2001
+From: Rui Salvaterra <rsalvaterra@gmail.com>
+Date: Wed, 30 Mar 2022 22:51:55 +0100
+Subject: [PATCH] kernel: ct: size the hashtable more adequately
+
+To set the default size of the connection tracking hash table, a divider of
+16384 becomes inadequate for a router handling lots of connections. Divide by
+2048 instead, making the default size scale better with the available RAM.
+
+Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
+---
+ net/netfilter/nf_conntrack_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -2705,7 +2705,7 @@ int nf_conntrack_init_start(void)
+ 
+ 	if (!nf_conntrack_htable_size) {
+ 		nf_conntrack_htable_size
+-			= (((nr_pages << PAGE_SHIFT) / 16384)
++			= (((nr_pages << PAGE_SHIFT) / 2048)
+ 			   / sizeof(struct hlist_head));
+ 		if (BITS_PER_LONG >= 64 &&
+ 		    nr_pages > (4 * (1024 * 1024 * 1024 / PAGE_SIZE)))
diff --git a/target/linux/generic/hack-6.1/700-swconfig_switch_drivers.patch b/target/linux/generic/hack-6.1/700-swconfig_switch_drivers.patch
new file mode 100644
index 00000000000000..9d77efaca6ef99
--- /dev/null
+++ b/target/linux/generic/hack-6.1/700-swconfig_switch_drivers.patch
@@ -0,0 +1,131 @@
+From 36e516290611e613aa92996cb4339561452695b4 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 7 Jul 2017 17:24:23 +0200
+Subject: net: swconfig: adds openwrt switch layer
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ drivers/net/phy/Kconfig   | 83 +++++++++++++++++++++++++++++++++++++++++++++++
+ drivers/net/phy/Makefile  | 15 +++++++++
+ include/uapi/linux/Kbuild |  1 +
+ 3 files changed, 99 insertions(+)
+
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -62,6 +62,80 @@ config SFP
+ 	depends on HWMON || HWMON=n
+ 	select MDIO_I2C
+ 
++comment "Switch configuration API + drivers"
++
++config SWCONFIG
++	tristate "Switch configuration API"
++	help
++	  Switch configuration API using netlink. This allows
++	  you to configure the VLAN features of certain switches.
++
++config SWCONFIG_LEDS
++	bool "Switch LED trigger support"
++	depends on (SWCONFIG && LEDS_TRIGGERS)
++
++config ADM6996_PHY
++	tristate "Driver for ADM6996 switches"
++	select SWCONFIG
++	help
++	  Currently supports the ADM6996FC and ADM6996M switches.
++	  Support for FC is very limited.
++
++config AR8216_PHY
++	tristate "Driver for Atheros AR8216/8327 switches"
++	select SWCONFIG
++	select ETHERNET_PACKET_MANGLE
++
++config AR8216_PHY_LEDS
++	bool "Atheros AR8216 switch LED support"
++	depends on (AR8216_PHY && LEDS_CLASS)
++
++source "drivers/net/phy/b53/Kconfig"
++
++config IP17XX_PHY
++	tristate "Driver for IC+ IP17xx switches"
++	select SWCONFIG
++
++config PSB6970_PHY
++	tristate "Lantiq XWAY Tantos (PSB6970) Ethernet switch"
++	select SWCONFIG
++
++config RTL8306_PHY
++	tristate "Driver for Realtek RTL8306S switches"
++	select SWCONFIG
++
++config RTL8366_SMI
++	tristate "Driver for the RTL8366 SMI interface"
++	depends on GPIOLIB
++	help
++	  This module implements the SMI interface protocol which is used
++	  by some RTL8366 ethernet switch devices via the generic GPIO API.
++
++if RTL8366_SMI
++
++config RTL8366_SMI_DEBUG_FS
++	bool "RTL8366 SMI interface debugfs support"
++        depends on DEBUG_FS
++        default n
++
++config RTL8366S_PHY
++	tristate "Driver for the Realtek RTL8366S switch"
++	select SWCONFIG
++
++config RTL8366RB_PHY
++	tristate "Driver for the Realtek RTL8366RB switch"
++	select SWCONFIG
++
++config RTL8367_PHY
++	tristate "Driver for the Realtek RTL8367R/M switches"
++	select SWCONFIG
++
++config RTL8367B_PHY
++	tristate "Driver fot the Realtek RTL8367R-VB switch"
++	select SWCONFIG
++
++endif # RTL8366_SMI
++
+ comment "MII PHY device drivers"
+ 
+ config AMD_PHY
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -24,6 +24,21 @@ libphy-$(CONFIG_LED_TRIGGER_PHY)	+= phy_
+ obj-$(CONFIG_PHYLINK)		+= phylink.o
+ obj-$(CONFIG_PHYLIB)		+= libphy.o
+ 
++obj-$(CONFIG_SWCONFIG)		+= swconfig.o
++obj-$(CONFIG_ADM6996_PHY)	+= adm6996.o
++obj-$(CONFIG_AR8216_PHY)	+= ar8xxx.o
++ar8xxx-y			+= ar8216.o
++ar8xxx-y			+= ar8327.o
++obj-$(CONFIG_SWCONFIG_B53)	+= b53/
++obj-$(CONFIG_IP17XX_PHY)	+= ip17xx.o
++obj-$(CONFIG_PSB6970_PHY)	+= psb6970.o
++obj-$(CONFIG_RTL8306_PHY)	+= rtl8306.o
++obj-$(CONFIG_RTL8366_SMI)	+= rtl8366_smi.o
++obj-$(CONFIG_RTL8366S_PHY)	+= rtl8366s.o
++obj-$(CONFIG_RTL8366RB_PHY)	+= rtl8366rb.o
++obj-$(CONFIG_RTL8367_PHY)	+= rtl8367.o
++obj-$(CONFIG_RTL8367B_PHY)	+= rtl8367b.o
++
+ obj-$(CONFIG_NETWORK_PHY_TIMESTAMPING) += mii_timestamper.o
+ 
+ obj-$(CONFIG_SFP)		+= sfp.o
+--- a/include/linux/platform_data/b53.h
++++ b/include/linux/platform_data/b53.h
+@@ -29,6 +29,9 @@ struct b53_platform_data {
+ 	u32 chip_id;
+ 	u16 enabled_ports;
+ 
++	/* allow to specify an ethX alias */
++	const char *alias;
++
+ 	/* only used by MMAP'd driver */
+ 	unsigned big_endian:1;
+ 	void __iomem *regs;
diff --git a/target/linux/generic/hack-6.1/711-net-dsa-mv88e6xxx-disable-ATU-violation.patch b/target/linux/generic/hack-6.1/711-net-dsa-mv88e6xxx-disable-ATU-violation.patch
new file mode 100644
index 00000000000000..25a3f83b2422b2
--- /dev/null
+++ b/target/linux/generic/hack-6.1/711-net-dsa-mv88e6xxx-disable-ATU-violation.patch
@@ -0,0 +1,21 @@
+From ebd924d773223593142d417c41d4ee6fa16f1805 Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 13:45:56 +0200
+Subject: [PATCH] net/dsa/mv88e6xxx: disable ATU violation
+
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -3465,6 +3465,9 @@ static int mv88e6xxx_setup_port(struct m
+ 	else
+ 		reg = 1 << port;
+ 
++	/* Disable ATU member violation interrupt */
++	reg |= MV88E6XXX_PORT_ASSOC_VECTOR_IGNORE_WRONG;
++
+ 	err = mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_ASSOC_VECTOR,
+ 				   reg);
+ 	if (err)
diff --git a/target/linux/generic/hack-6.1/720-net-phy-add-aqr-phys.patch b/target/linux/generic/hack-6.1/720-net-phy-add-aqr-phys.patch
new file mode 100644
index 00000000000000..fd2687d8ba9e52
--- /dev/null
+++ b/target/linux/generic/hack-6.1/720-net-phy-add-aqr-phys.patch
@@ -0,0 +1,120 @@
+From: Birger Koblitz <git@birger-koblitz.de>
+Date: Sun, 5 Sep 2021 15:13:10 +0200
+Subject: [PATCH] kernel: Add AQR113C and AQR813 support
+
+This hack adds support for the Aquantia 4th generation, 10GBit
+PHYs AQR113C and AQR813.
+
+Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
+
+--- a/drivers/net/phy/aquantia_main.c
++++ b/drivers/net/phy/aquantia_main.c
+@@ -23,6 +23,7 @@
+ #define PHY_ID_AQCS109	0x03a1b5c2
+ #define PHY_ID_AQR405	0x03a1b4b0
+ #define PHY_ID_AQR113C	0x31c31c12
++#define PHY_ID_AQR813	0x31c31cb2
+ 
+ #define MDIO_PHYXS_VEND_IF_STATUS		0xe812
+ #define MDIO_PHYXS_VEND_IF_STATUS_TYPE_MASK	GENMASK(7, 3)
+@@ -415,6 +416,49 @@ static int aqr107_read_rate(struct phy_d
+ 	return 0;
+ }
+ 
++static int aqr113c_read_status(struct phy_device *phydev)
++{
++	int val, ret;
++
++	ret = aqr_read_status(phydev);
++	if (ret)
++		return ret;
++
++	if (!phydev->link || phydev->autoneg == AUTONEG_DISABLE)
++		return 0;
++
++	// On AQR113C, the speed returned by aqr_read_status is wrong
++	aqr107_read_rate(phydev);
++
++	val = phy_read_mmd(phydev, MDIO_MMD_PHYXS, MDIO_PHYXS_VEND_IF_STATUS);
++	if (val < 0)
++		return val;
++
++	switch (FIELD_GET(MDIO_PHYXS_VEND_IF_STATUS_TYPE_MASK, val)) {
++	case MDIO_PHYXS_VEND_IF_STATUS_TYPE_KR:
++		phydev->interface = PHY_INTERFACE_MODE_10GKR;
++		break;
++	case MDIO_PHYXS_VEND_IF_STATUS_TYPE_XFI:
++		phydev->interface = PHY_INTERFACE_MODE_10GBASER;
++		break;
++	case MDIO_PHYXS_VEND_IF_STATUS_TYPE_USXGMII:
++		phydev->interface = PHY_INTERFACE_MODE_USXGMII;
++		break;
++	case MDIO_PHYXS_VEND_IF_STATUS_TYPE_SGMII:
++		phydev->interface = PHY_INTERFACE_MODE_SGMII;
++		break;
++	case MDIO_PHYXS_VEND_IF_STATUS_TYPE_OCSGMII:
++		phydev->interface = PHY_INTERFACE_MODE_2500BASEX;
++		break;
++	default:
++		phydev->interface = PHY_INTERFACE_MODE_NA;
++		break;
++	}
++
++	/* Read downshifted rate from vendor register */
++	return aqr107_read_rate(phydev);
++}
++
+ static int aqr107_read_status(struct phy_device *phydev)
+ {
+ 	int val, ret;
+@@ -554,7 +598,7 @@ static void aqr107_chip_info(struct phy_
+ 	build_id = FIELD_GET(VEND1_GLOBAL_RSVD_STAT1_FW_BUILD_ID, val);
+ 	prov_id = FIELD_GET(VEND1_GLOBAL_RSVD_STAT1_PROV_ID, val);
+ 
+-	phydev_dbg(phydev, "FW %u.%u, Build %u, Provisioning %u\n",
++	phydev_info(phydev, "FW %u.%u, Build %u, Provisioning %u\n",
+ 		   fw_major, fw_minor, build_id, prov_id);
+ }
+ 
+@@ -809,7 +853,7 @@ static struct phy_driver aqr_driver[] =
+ 	.config_aneg    = aqr_config_aneg,
+ 	.config_intr    = aqr_config_intr,
+ 	.handle_interrupt       = aqr_handle_interrupt,
+-	.read_status    = aqr107_read_status,
++	.read_status    = aqr113c_read_status,
+ 	.get_tunable    = aqr107_get_tunable,
+ 	.set_tunable    = aqr107_set_tunable,
+ 	.suspend        = aqr107_suspend,
+@@ -819,6 +863,24 @@ static struct phy_driver aqr_driver[] =
+ 	.get_stats      = aqr107_get_stats,
+ 	.link_change_notify = aqr107_link_change_notify,
+ },
++{
++	PHY_ID_MATCH_MODEL(PHY_ID_AQR813),
++	.name		= "Aquantia AQR813",
++	.probe		= aqr107_probe,
++	.config_init	= aqr107_config_init,
++	.config_aneg    = aqr_config_aneg,
++	.config_intr	= aqr_config_intr,
++	.handle_interrupt = aqr_handle_interrupt,
++	.read_status	= aqr113c_read_status,
++	.get_tunable    = aqr107_get_tunable,
++	.set_tunable    = aqr107_set_tunable,
++	.suspend	= aqr107_suspend,
++	.resume		= aqr107_resume,
++	.get_sset_count	= aqr107_get_sset_count,
++	.get_strings	= aqr107_get_strings,
++	.get_stats	= aqr107_get_stats,
++	.link_change_notify = aqr107_link_change_notify,
++},
+ };
+ 
+ module_phy_driver(aqr_driver);
+@@ -832,6 +894,7 @@ static struct mdio_device_id __maybe_unu
+ 	{ PHY_ID_MATCH_MODEL(PHY_ID_AQCS109) },
+ 	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR405) },
+ 	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR113C) },
++	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR813) },
+ 	{ }
+ };
+ 
diff --git a/target/linux/generic/hack-6.1/721-net-add-packet-mangeling.patch b/target/linux/generic/hack-6.1/721-net-add-packet-mangeling.patch
new file mode 100644
index 00000000000000..91dc3e011084eb
--- /dev/null
+++ b/target/linux/generic/hack-6.1/721-net-add-packet-mangeling.patch
@@ -0,0 +1,167 @@
+From ffe387740bbe88dd88bbe04d6375902708003d6e Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 7 Jul 2017 17:25:00 +0200
+Subject: net: add packet mangeling
+
+ar8216 switches have a hardware bug, which renders normal 802.1q support
+unusable. Packet mangling is required to fix up the vlan for incoming
+packets.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ include/linux/netdevice.h | 11 +++++++++++
+ include/linux/skbuff.h    | 14 ++++----------
+ net/Kconfig               |  6 ++++++
+ net/core/dev.c            | 20 +++++++++++++++-----
+ net/core/skbuff.c         | 17 +++++++++++++++++
+ net/ethernet/eth.c        |  6 ++++++
+ 6 files changed, 59 insertions(+), 15 deletions(-)
+
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1707,6 +1707,7 @@ enum netdev_priv_flags {
+ 	IFF_LIVE_RENAME_OK		= 1<<30,
+ 	IFF_TX_SKB_NO_LINEAR		= BIT_ULL(31),
+ 	IFF_CHANGE_PROTO_DOWN		= BIT_ULL(32),
++	IFF_NO_IP_ALIGN			= BIT_ULL(33),
+ };
+ 
+ #define IFF_802_1Q_VLAN			IFF_802_1Q_VLAN
+@@ -1741,6 +1742,7 @@ enum netdev_priv_flags {
+ #define IFF_L3MDEV_RX_HANDLER		IFF_L3MDEV_RX_HANDLER
+ #define IFF_LIVE_RENAME_OK		IFF_LIVE_RENAME_OK
+ #define IFF_TX_SKB_NO_LINEAR		IFF_TX_SKB_NO_LINEAR
++#define IFF_NO_IP_ALIGN		IFF_NO_IP_ALIGN
+ 
+ /* Specifies the type of the struct net_device::ml_priv pointer */
+ enum netdev_ml_priv_type {
+@@ -2109,6 +2111,11 @@ struct net_device {
+ 	const struct tlsdev_ops *tlsdev_ops;
+ #endif
+ 
++#ifdef CONFIG_ETHERNET_PACKET_MANGLE
++	void (*eth_mangle_rx)(struct net_device *dev, struct sk_buff *skb);
++	struct sk_buff *(*eth_mangle_tx)(struct net_device *dev, struct sk_buff *skb);
++#endif
++
+ 	const struct header_ops *header_ops;
+ 
+ 	unsigned char		operstate;
+@@ -2184,6 +2191,10 @@ struct net_device {
+ 	struct mctp_dev __rcu	*mctp_ptr;
+ #endif
+ 
++#ifdef CONFIG_ETHERNET_PACKET_MANGLE
++	void			*phy_ptr; /* PHY device specific data */
++#endif
++
+ /*
+  * Cache lines mostly used on receive path (including eth_type_trans())
+  */
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -3032,6 +3032,10 @@ static inline int pskb_trim(struct sk_bu
+ 	return (len < skb->len) ? __pskb_trim(skb, len) : 0;
+ }
+ 
++extern struct sk_buff *__netdev_alloc_skb_ip_align(struct net_device *dev,
++		unsigned int length, gfp_t gfp);
++
++
+ /**
+  *	pskb_trim_unique - remove end from a paged unique (not cloned) buffer
+  *	@skb: buffer to alter
+@@ -3181,16 +3185,6 @@ static inline struct sk_buff *dev_alloc_
+ }
+ 
+ 
+-static inline struct sk_buff *__netdev_alloc_skb_ip_align(struct net_device *dev,
+-		unsigned int length, gfp_t gfp)
+-{
+-	struct sk_buff *skb = __netdev_alloc_skb(dev, length + NET_IP_ALIGN, gfp);
+-
+-	if (NET_IP_ALIGN && skb)
+-		skb_reserve(skb, NET_IP_ALIGN);
+-	return skb;
+-}
+-
+ static inline struct sk_buff *netdev_alloc_skb_ip_align(struct net_device *dev,
+ 		unsigned int length)
+ {
+--- a/net/Kconfig
++++ b/net/Kconfig
+@@ -26,6 +26,12 @@ menuconfig NET
+ 
+ if NET
+ 
++config ETHERNET_PACKET_MANGLE
++	bool
++	help
++	  This option can be selected by phy drivers that need to mangle
++	  packets going in or out of an ethernet device.
++
+ config WANT_COMPAT_NETLINK_MESSAGES
+ 	bool
+ 	help
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -3590,6 +3590,11 @@ static int xmit_one(struct sk_buff *skb,
+ 	if (dev_nit_active(dev))
+ 		dev_queue_xmit_nit(skb, dev);
+ 
++#ifdef CONFIG_ETHERNET_PACKET_MANGLE
++	if (dev->eth_mangle_tx && !(skb = dev->eth_mangle_tx(dev, skb)))
++		return NETDEV_TX_OK;
++#endif
++
+ 	len = skb->len;
+ 	trace_net_dev_start_xmit(skb, dev);
+ 	rc = netdev_start_xmit(skb, dev, txq, more);
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -61,6 +61,7 @@
+ #include <linux/if_vlan.h>
+ #include <linux/mpls.h>
+ #include <linux/kcov.h>
++#include <linux/if.h>
+ 
+ #include <net/protocol.h>
+ #include <net/dst.h>
+@@ -707,6 +708,22 @@ skb_fail:
+ }
+ EXPORT_SYMBOL(__napi_alloc_skb);
+ 
++struct sk_buff *__netdev_alloc_skb_ip_align(struct net_device *dev,
++		unsigned int length, gfp_t gfp)
++{
++	struct sk_buff *skb = __netdev_alloc_skb(dev, length + NET_IP_ALIGN, gfp);
++
++#ifdef CONFIG_ETHERNET_PACKET_MANGLE
++	if (dev && (dev->priv_flags & IFF_NO_IP_ALIGN))
++		return skb;
++#endif
++
++	if (NET_IP_ALIGN && skb)
++		skb_reserve(skb, NET_IP_ALIGN);
++	return skb;
++}
++EXPORT_SYMBOL(__netdev_alloc_skb_ip_align);
++
+ void skb_add_rx_frag(struct sk_buff *skb, int i, struct page *page, int off,
+ 		     int size, unsigned int truesize)
+ {
+--- a/net/ethernet/eth.c
++++ b/net/ethernet/eth.c
+@@ -171,6 +171,12 @@ __be16 eth_type_trans(struct sk_buff *sk
+ 	const struct ethhdr *eth;
+ 
+ 	skb->dev = dev;
++
++#ifdef CONFIG_ETHERNET_PACKET_MANGLE
++	if (dev->eth_mangle_rx)
++		dev->eth_mangle_rx(dev, skb);
++#endif
++
+ 	skb_reset_mac_header(skb);
+ 
+ 	eth = (struct ethhdr *)skb->data;
diff --git a/target/linux/generic/hack-6.1/722-net-phy-aquantia-enable-AQR112-and-AQR412.patch b/target/linux/generic/hack-6.1/722-net-phy-aquantia-enable-AQR112-and-AQR412.patch
new file mode 100644
index 00000000000000..77b190464cfb02
--- /dev/null
+++ b/target/linux/generic/hack-6.1/722-net-phy-aquantia-enable-AQR112-and-AQR412.patch
@@ -0,0 +1,148 @@
+From 5f62951fba63a9f9cfff564209426bdea5fcc371 Mon Sep 17 00:00:00 2001
+From: Alex Marginean <alexandru.marginean@nxp.com>
+Date: Tue, 27 Aug 2019 15:16:56 +0300
+Subject: [PATCH] drivers: net: phy: aquantia: enable AQR112 and AQR412
+
+Adds support for AQR112 and AQR412 which is mostly based on existing code
+with the addition of code configuring the protocol on system side.
+This allows changing the system side protocol without having to deploy a
+different firmware on the PHY.
+
+Signed-off-by: Alex Marginean <alexandru.marginean@nxp.com>
+---
+ drivers/net/phy/aquantia_main.c | 88 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 88 insertions(+)
+
+--- a/drivers/net/phy/aquantia_main.c
++++ b/drivers/net/phy/aquantia_main.c
+@@ -24,6 +24,8 @@
+ #define PHY_ID_AQR405	0x03a1b4b0
+ #define PHY_ID_AQR113C	0x31c31c12
+ #define PHY_ID_AQR813	0x31c31cb2
++#define PHY_ID_AQR112	0x03a1b662
++#define PHY_ID_AQR412	0x03a1b712
+ 
+ #define MDIO_PHYXS_VEND_IF_STATUS		0xe812
+ #define MDIO_PHYXS_VEND_IF_STATUS_TYPE_MASK	GENMASK(7, 3)
+@@ -151,6 +153,29 @@
+ #define AQR107_OP_IN_PROG_SLEEP		1000
+ #define AQR107_OP_IN_PROG_TIMEOUT	100000
+ 
++/* registers in MDIO_MMD_VEND1 region */
++#define AQUANTIA_VND1_GLOBAL_SC			0x000
++#define  AQUANTIA_VND1_GLOBAL_SC_LP		BIT(0xb)
++
++/* global start rate, the protocol associated with this speed is used by default
++ * on SI.
++ */
++#define AQUANTIA_VND1_GSTART_RATE		0x31a
++#define  AQUANTIA_VND1_GSTART_RATE_OFF		0
++#define  AQUANTIA_VND1_GSTART_RATE_100M		1
++#define  AQUANTIA_VND1_GSTART_RATE_1G		2
++#define  AQUANTIA_VND1_GSTART_RATE_10G		3
++#define  AQUANTIA_VND1_GSTART_RATE_2_5G		4
++#define  AQUANTIA_VND1_GSTART_RATE_5G		5
++
++/* SYSCFG registers for 100M, 1G, 2.5G, 5G, 10G */
++#define AQUANTIA_VND1_GSYSCFG_BASE		0x31b
++#define AQUANTIA_VND1_GSYSCFG_100M		0
++#define AQUANTIA_VND1_GSYSCFG_1G		1
++#define AQUANTIA_VND1_GSYSCFG_2_5G		2
++#define AQUANTIA_VND1_GSYSCFG_5G		3
++#define AQUANTIA_VND1_GSYSCFG_10G		4
++
+ struct aqr107_hw_stat {
+ 	const char *name;
+ 	int reg;
+@@ -282,6 +307,51 @@ static int aqr_config_aneg(struct phy_de
+ 	return genphy_c45_check_and_restart_aneg(phydev, changed);
+ }
+ 
++static struct {
++	u16 syscfg;
++	int cnt;
++	u16 start_rate;
++} aquantia_syscfg[PHY_INTERFACE_MODE_MAX] = {
++	[PHY_INTERFACE_MODE_SGMII] =      {0x04b, AQUANTIA_VND1_GSYSCFG_1G,
++					   AQUANTIA_VND1_GSTART_RATE_1G},
++	[PHY_INTERFACE_MODE_2500BASEX] = {0x144, AQUANTIA_VND1_GSYSCFG_2_5G,
++					   AQUANTIA_VND1_GSTART_RATE_2_5G},
++	[PHY_INTERFACE_MODE_XGMII] =      {0x100, AQUANTIA_VND1_GSYSCFG_10G,
++					   AQUANTIA_VND1_GSTART_RATE_10G},
++	[PHY_INTERFACE_MODE_USXGMII] =    {0x080, AQUANTIA_VND1_GSYSCFG_10G,
++					   AQUANTIA_VND1_GSTART_RATE_10G},
++};
++
++/* Sets up protocol on system side before calling aqr_config_aneg */
++static int aqr_config_aneg_set_prot(struct phy_device *phydev)
++{
++	int if_type = phydev->interface;
++	int i;
++
++	if (!aquantia_syscfg[if_type].cnt)
++		return 0;
++
++	/* set PHY in low power mode so we can configure protocols */
++	phy_write_mmd(phydev, MDIO_MMD_VEND1, AQUANTIA_VND1_GLOBAL_SC,
++		      AQUANTIA_VND1_GLOBAL_SC_LP);
++	mdelay(10);
++
++	/* set the default rate to enable the SI link */
++	phy_write_mmd(phydev, MDIO_MMD_VEND1, AQUANTIA_VND1_GSTART_RATE,
++		      aquantia_syscfg[if_type].start_rate);
++
++	for (i = 0; i <= aquantia_syscfg[if_type].cnt; i++)
++		phy_write_mmd(phydev, MDIO_MMD_VEND1,
++			      AQUANTIA_VND1_GSYSCFG_BASE + i,
++			      aquantia_syscfg[if_type].syscfg);
++
++	/* wake PHY back up */
++	phy_write_mmd(phydev, MDIO_MMD_VEND1, AQUANTIA_VND1_GLOBAL_SC, 0);
++	mdelay(10);
++
++	return aqr_config_aneg(phydev);
++}
++
+ static int aqr_config_intr(struct phy_device *phydev)
+ {
+ 	bool en = phydev->interrupts == PHY_INTERRUPT_ENABLED;
+@@ -881,6 +951,30 @@ static struct phy_driver aqr_driver[] =
+ 	.get_stats	= aqr107_get_stats,
+ 	.link_change_notify = aqr107_link_change_notify,
+ },
++{
++	PHY_ID_MATCH_MODEL(PHY_ID_AQR112),
++	.name		= "Aquantia AQR112",
++	.probe		= aqr107_probe,
++	.config_aneg	= aqr_config_aneg_set_prot,
++	.config_intr	= aqr_config_intr,
++	.handle_interrupt = aqr_handle_interrupt,
++	.read_status	= aqr107_read_status,
++	.get_sset_count	= aqr107_get_sset_count,
++	.get_strings	= aqr107_get_strings,
++	.get_stats	= aqr107_get_stats,
++},
++{
++	PHY_ID_MATCH_MODEL(PHY_ID_AQR412),
++	.name		= "Aquantia AQR412",
++	.probe		= aqr107_probe,
++	.config_aneg	= aqr_config_aneg_set_prot,
++	.config_intr	= aqr_config_intr,
++	.handle_interrupt = aqr_handle_interrupt,
++	.read_status	= aqr107_read_status,
++	.get_sset_count	= aqr107_get_sset_count,
++	.get_strings	= aqr107_get_strings,
++	.get_stats	= aqr107_get_stats,
++},
+ };
+ 
+ module_phy_driver(aqr_driver);
+@@ -895,6 +989,8 @@ static struct mdio_device_id __maybe_unu
+ 	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR405) },
+ 	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR113C) },
+ 	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR813) },
++	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR112) },
++	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR412) },
+ 	{ }
+ };
+ 
diff --git a/target/linux/generic/hack-6.1/723-net-phy-aquantia-fix-system-side-protocol-mi.patch b/target/linux/generic/hack-6.1/723-net-phy-aquantia-fix-system-side-protocol-mi.patch
new file mode 100644
index 00000000000000..8e204cb146aa93
--- /dev/null
+++ b/target/linux/generic/hack-6.1/723-net-phy-aquantia-fix-system-side-protocol-mi.patch
@@ -0,0 +1,34 @@
+From 5f008cb22f60da4e10375f22266c1a4e20b1252e Mon Sep 17 00:00:00 2001
+From: Alex Marginean <alexandru.marginean@nxp.com>
+Date: Fri, 20 Sep 2019 18:22:52 +0300
+Subject: [PATCH] drivers: net: phy: aquantia: fix system side protocol
+ misconfiguration
+
+Do not set up protocols for speeds that are not supported by FW.  Enabling
+these protocols leads to link issues on system side.
+
+Signed-off-by: Alex Marginean <alexandru.marginean@nxp.com>
+---
+ drivers/net/phy/aquantia_main.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/phy/aquantia_main.c
++++ b/drivers/net/phy/aquantia_main.c
+@@ -340,10 +340,16 @@ static int aqr_config_aneg_set_prot(stru
+ 	phy_write_mmd(phydev, MDIO_MMD_VEND1, AQUANTIA_VND1_GSTART_RATE,
+ 		      aquantia_syscfg[if_type].start_rate);
+ 
+-	for (i = 0; i <= aquantia_syscfg[if_type].cnt; i++)
++	for (i = 0; i <= aquantia_syscfg[if_type].cnt; i++) {
++		u16 reg = phy_read_mmd(phydev, MDIO_MMD_VEND1,
++				       AQUANTIA_VND1_GSYSCFG_BASE + i);
++		if (!reg)
++			continue;
++
+ 		phy_write_mmd(phydev, MDIO_MMD_VEND1,
+ 			      AQUANTIA_VND1_GSYSCFG_BASE + i,
+ 			      aquantia_syscfg[if_type].syscfg);
++	}
+ 
+ 	/* wake PHY back up */
+ 	phy_write_mmd(phydev, MDIO_MMD_VEND1, AQUANTIA_VND1_GLOBAL_SC, 0);
diff --git a/target/linux/generic/hack-6.1/724-net-phy-aquantia-Add-AQR113-driver-support.patch b/target/linux/generic/hack-6.1/724-net-phy-aquantia-Add-AQR113-driver-support.patch
new file mode 100644
index 00000000000000..0a1e97062390ed
--- /dev/null
+++ b/target/linux/generic/hack-6.1/724-net-phy-aquantia-Add-AQR113-driver-support.patch
@@ -0,0 +1,43 @@
+From 2e677e4ae8f8330f68013163b060d0fda3a43095 Mon Sep 17 00:00:00 2001
+From: "Langer, Thomas" <tlanger@maxlinear.com>
+Date: Fri, 9 Jul 2021 17:36:46 +0200
+Subject: [PATCH] PONRTSYS-8842: aquantia: Add AQR113 driver support
+
+Add a new entry for AQR113 PHY_ID
+---
+ drivers/net/phy/aquantia_main.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/net/phy/aquantia_main.c
++++ b/drivers/net/phy/aquantia_main.c
+@@ -26,6 +26,7 @@
+ #define PHY_ID_AQR813	0x31c31cb2
+ #define PHY_ID_AQR112	0x03a1b662
+ #define PHY_ID_AQR412	0x03a1b712
++#define PHY_ID_AQR113	0x31c31c40
+ 
+ #define MDIO_PHYXS_VEND_IF_STATUS		0xe812
+ #define MDIO_PHYXS_VEND_IF_STATUS_TYPE_MASK	GENMASK(7, 3)
+@@ -981,6 +982,14 @@ static struct phy_driver aqr_driver[] =
+ 	.get_strings	= aqr107_get_strings,
+ 	.get_stats	= aqr107_get_stats,
+ },
++{
++	PHY_ID_MATCH_MODEL(PHY_ID_AQR113),
++	.name		= "Aquantia AQR113",
++	.config_aneg	= aqr_config_aneg,
++	.config_intr	= aqr_config_intr,
++	.handle_interrupt = aqr_handle_interrupt,
++	.read_status	= aqr107_read_status,
++},
+ };
+ 
+ module_phy_driver(aqr_driver);
+@@ -997,6 +1006,7 @@ static struct mdio_device_id __maybe_unu
+ 	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR813) },
+ 	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR112) },
+ 	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR412) },
++	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR113) },
+ 	{ }
+ };
+ 
diff --git a/target/linux/generic/hack-6.1/725-net-phy-aquantia-add-PHY_IDs-for-AQR112-variants.patch b/target/linux/generic/hack-6.1/725-net-phy-aquantia-add-PHY_IDs-for-AQR112-variants.patch
new file mode 100644
index 00000000000000..654fea566112a8
--- /dev/null
+++ b/target/linux/generic/hack-6.1/725-net-phy-aquantia-add-PHY_IDs-for-AQR112-variants.patch
@@ -0,0 +1,63 @@
+From 3b92ee7b7899b6beffb2b484c58326e36612a873 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 23 Dec 2021 14:52:56 +0000
+Subject: [PATCH] net: phy: aquantia: add PHY_ID for AQR112R
+
+As advised by Ian Chang this PHY is used in Puzzle devices.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/aquantia_main.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/net/phy/aquantia_main.c
++++ b/drivers/net/phy/aquantia_main.c
+@@ -27,6 +27,8 @@
+ #define PHY_ID_AQR112	0x03a1b662
+ #define PHY_ID_AQR412	0x03a1b712
+ #define PHY_ID_AQR113	0x31c31c40
++#define PHY_ID_AQR112C	0x03a1b790
++#define PHY_ID_AQR112R	0x31c31d12
+ 
+ #define MDIO_PHYXS_VEND_IF_STATUS		0xe812
+ #define MDIO_PHYXS_VEND_IF_STATUS_TYPE_MASK	GENMASK(7, 3)
+@@ -990,6 +992,30 @@ static struct phy_driver aqr_driver[] =
+ 	.handle_interrupt = aqr_handle_interrupt,
+ 	.read_status	= aqr107_read_status,
+ },
++{
++	PHY_ID_MATCH_MODEL(PHY_ID_AQR112C),
++	.name		= "Aquantia AQR112C",
++	.probe		= aqr107_probe,
++	.config_aneg	= aqr_config_aneg_set_prot,
++	.config_intr	= aqr_config_intr,
++	.handle_interrupt = aqr_handle_interrupt,
++	.read_status	= aqr107_read_status,
++	.get_sset_count	= aqr107_get_sset_count,
++	.get_strings	= aqr107_get_strings,
++	.get_stats	= aqr107_get_stats,
++},
++{
++	PHY_ID_MATCH_MODEL(PHY_ID_AQR112R),
++	.name		= "Aquantia AQR112R",
++	.probe		= aqr107_probe,
++	.config_aneg	= aqr_config_aneg_set_prot,
++	.config_intr	= aqr_config_intr,
++	.handle_interrupt = aqr_handle_interrupt,
++	.read_status	= aqr107_read_status,
++	.get_sset_count	= aqr107_get_sset_count,
++	.get_strings	= aqr107_get_strings,
++	.get_stats	= aqr107_get_stats,
++},
+ };
+ 
+ module_phy_driver(aqr_driver);
+@@ -1007,6 +1033,8 @@ static struct mdio_device_id __maybe_unu
+ 	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR112) },
+ 	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR412) },
+ 	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR113) },
++	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR112C) },
++	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR112R) },
+ 	{ }
+ };
+ 
diff --git a/target/linux/generic/hack-6.1/750-net-pcs-mtk-lynxi-workaround-2500BaseX-no-an.patch b/target/linux/generic/hack-6.1/750-net-pcs-mtk-lynxi-workaround-2500BaseX-no-an.patch
new file mode 100644
index 00000000000000..8b7f2f095577fd
--- /dev/null
+++ b/target/linux/generic/hack-6.1/750-net-pcs-mtk-lynxi-workaround-2500BaseX-no-an.patch
@@ -0,0 +1,53 @@
+From 880d1311335120f64447ca9d11933872d734e19a Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 27 Mar 2023 18:41:54 +0100
+Subject: [PATCH] generic: pcs-mtk-lynxi: add hack to use 2500Base-X without AN
+
+Using 2500Base-T SFP modules e.g. on the BananaPi R3 requires manually
+disabling auto-negotiation, e.g. using ethtool. While a proper fix
+using SFP quirks is being discussed upstream, bring a work-around to
+restore user experience to what it was before the switch to the
+dedicated SGMII PCS driver.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+
+--- a/drivers/net/pcs/pcs-mtk-lynxi.c
++++ b/drivers/net/pcs/pcs-mtk-lynxi.c
+@@ -92,14 +92,23 @@ static void mtk_pcs_lynxi_get_state(stru
+ 				    struct phylink_link_state *state)
+ {
+ 	struct mtk_pcs_lynxi *mpcs = pcs_to_mtk_pcs_lynxi(pcs);
+-	unsigned int bm, adv;
++	unsigned int bm, bmsr, adv;
+ 
+ 	/* Read the BMSR and LPA */
+ 	regmap_read(mpcs->regmap, SGMSYS_PCS_CONTROL_1, &bm);
+-	regmap_read(mpcs->regmap, SGMSYS_PCS_ADVERTISE, &adv);
++	bmsr = FIELD_GET(SGMII_BMSR, bm);
++
++	if (state->interface == PHY_INTERFACE_MODE_2500BASEX) {
++		state->link = !!(bmsr & BMSR_LSTATUS);
++		state->an_complete = !!(bmsr & BMSR_ANEGCOMPLETE);
++		state->speed = SPEED_2500;
++		state->duplex = DUPLEX_FULL;
+ 
+-	phylink_mii_c22_pcs_decode_state(state, FIELD_GET(SGMII_BMSR, bm),
+-					 FIELD_GET(SGMII_LPA, adv));
++		return;
++	}
++
++	regmap_read(mpcs->regmap, SGMSYS_PCS_ADVERTISE, &adv);
++	phylink_mii_c22_pcs_decode_state(state, bmsr, FIELD_GET(SGMII_LPA, adv));
+ }
+ 
+ static int mtk_pcs_lynxi_config(struct phylink_pcs *pcs, unsigned int mode,
+@@ -134,7 +143,8 @@ static int mtk_pcs_lynxi_config(struct p
+ 		/* 1000base-X or 2500base-X autoneg */
+ 		sgm_mode = SGMII_REMOTE_FAULT_DIS;
+ 		use_an = linkmode_test_bit(ETHTOOL_LINK_MODE_Autoneg_BIT,
+-					   advertising);
++					   advertising) &&
++			 !(interface == PHY_INTERFACE_MODE_2500BASEX);
+ 	} else {
+ 		/* 1000base-X or 2500base-X without autoneg */
+ 		sgm_mode = 0;
diff --git a/target/linux/generic/hack-6.1/760-net-usb-r8152-add-LED-configuration-from-OF.patch b/target/linux/generic/hack-6.1/760-net-usb-r8152-add-LED-configuration-from-OF.patch
new file mode 100644
index 00000000000000..ba03a00eb27abf
--- /dev/null
+++ b/target/linux/generic/hack-6.1/760-net-usb-r8152-add-LED-configuration-from-OF.patch
@@ -0,0 +1,74 @@
+From 82985725e071f2a5735052f18e109a32aeac3a0b Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sun, 26 Jul 2020 02:38:31 +0200
+Subject: [PATCH] net: usb: r8152: add LED configuration from OF
+
+This adds the ability to configure the LED configuration register using
+OF. This way, the correct value for board specific LED configuration can
+be determined.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ drivers/net/usb/r8152.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -11,6 +11,7 @@
+ #include <linux/mii.h>
+ #include <linux/ethtool.h>
+ #include <linux/usb.h>
++#include <linux/of.h>
+ #include <linux/crc32.h>
+ #include <linux/if_vlan.h>
+ #include <linux/uaccess.h>
+@@ -6893,6 +6894,22 @@ static void rtl_tally_reset(struct r8152
+ 	ocp_write_word(tp, MCU_TYPE_PLA, PLA_RSTTALLY, ocp_data);
+ }
+ 
++static int r8152_led_configuration(struct r8152 *tp)
++{
++	u32 led_data;
++	int ret;
++
++	ret = of_property_read_u32(tp->udev->dev.of_node, "realtek,led-data",
++								&led_data);
++
++	if (ret)
++		return ret;
++	
++	ocp_write_word(tp, MCU_TYPE_PLA, PLA_LEDSEL, led_data);
++
++	return 0;
++}
++
+ static void r8152b_init(struct r8152 *tp)
+ {
+ 	u32 ocp_data;
+@@ -6934,6 +6951,8 @@ static void r8152b_init(struct r8152 *tp
+ 	ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_USB_CTRL);
+ 	ocp_data &= ~(RX_AGG_DISABLE | RX_ZERO_EN);
+ 	ocp_write_word(tp, MCU_TYPE_USB, USB_USB_CTRL, ocp_data);
++
++	r8152_led_configuration(tp);
+ }
+ 
+ static void r8153_init(struct r8152 *tp)
+@@ -7074,6 +7093,8 @@ static void r8153_init(struct r8152 *tp)
+ 		tp->coalesce = COALESCE_SLOW;
+ 		break;
+ 	}
++
++	r8152_led_configuration(tp);
+ }
+ 
+ static void r8153b_init(struct r8152 *tp)
+@@ -7156,6 +7177,8 @@ static void r8153b_init(struct r8152 *tp
+ 	rtl_tally_reset(tp);
+ 
+ 	tp->coalesce = 15000;	/* 15 us */
++
++	r8152_led_configuration(tp);
+ }
+ 
+ static void r8153c_init(struct r8152 *tp)
diff --git a/target/linux/generic/hack-6.1/761-dt-bindings-net-add-RTL8152-binding-documentation.patch b/target/linux/generic/hack-6.1/761-dt-bindings-net-add-RTL8152-binding-documentation.patch
new file mode 100644
index 00000000000000..be262b993cd5d4
--- /dev/null
+++ b/target/linux/generic/hack-6.1/761-dt-bindings-net-add-RTL8152-binding-documentation.patch
@@ -0,0 +1,54 @@
+From 3ee05f4aa64fc86af3be5bc176ba5808de9260a7 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sun, 26 Jul 2020 15:30:33 +0200
+Subject: [PATCH] dt-bindings: net: add RTL8152 binding documentation
+
+Add binding documentation for the Realtek RTL8152 / RTL8153 USB ethernet
+adapters.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ .../bindings/net/realtek,rtl8152.yaml         | 36 +++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/net/realtek,rtl8152.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/net/realtek,rtl8152.yaml
+@@ -0,0 +1,36 @@
++# SPDX-License-Identifier: GPL-2.0
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/net/realtek,rtl8152.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Realtek RTL8152/RTL8153 series USB ethernet
++
++maintainers:
++  - David Bauer <mail@david-bauer.net>
++
++properties:
++  compatible:
++    oneOf:
++      - items:
++          - enum:
++              - realtek,rtl8152
++              - realtek,rtl8153
++
++  reg:
++    description: The device number on the USB bus
++
++  realtek,led-data:
++    description: Value to be written to the LED configuration register.
++
++required:
++  - compatible
++  - reg
++
++examples:
++  - |
++    usb-eth@2 {
++      compatible = "realtek,rtl8153";
++      reg = <2>;
++      realtek,led-data = <0x87>;
++    };
+\ No newline at end of file
diff --git a/target/linux/generic/hack-6.1/765-mxl-gpy-control-LED-reg-from-DT.patch b/target/linux/generic/hack-6.1/765-mxl-gpy-control-LED-reg-from-DT.patch
new file mode 100644
index 00000000000000..d7165cb30ac7c0
--- /dev/null
+++ b/target/linux/generic/hack-6.1/765-mxl-gpy-control-LED-reg-from-DT.patch
@@ -0,0 +1,101 @@
+From 94b90966095f3fa625897e8f53d215882f6e19b3 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sat, 11 Mar 2023 17:00:01 +0100
+Subject: [PATCH] mxl-gpy: control LED reg from DT
+
+Add dynamic configuration for the LED control registers on MXL PHYs.
+
+This patch has been tested with MaxLinear GPY211C. It is unlikely to be
+accepted upstream, as upstream plans on integrating their own framework
+for handling these LEDs.
+
+For the time being, use this hack to configure PHY driven device-LEDs to
+show the correct state.
+
+A possible alternative might be to expose the LEDs using the kernel LED
+framework and bind it to the netdevice. This might also be upstreamable,
+although it is a considerable extra amount of work.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ drivers/net/phy/mxl-gpy.c | 37 ++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 36 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/phy/mxl-gpy.c
++++ b/drivers/net/phy/mxl-gpy.c
+@@ -10,6 +10,7 @@
+ #include <linux/bitfield.h>
+ #include <linux/hwmon.h>
+ #include <linux/mutex.h>
++#include <linux/of.h>
+ #include <linux/phy.h>
+ #include <linux/polynomial.h>
+ #include <linux/netdevice.h>
+@@ -33,6 +34,7 @@
+ #define PHY_MIISTAT		0x18	/* MII state */
+ #define PHY_IMASK		0x19	/* interrupt mask */
+ #define PHY_ISTAT		0x1A	/* interrupt status */
++#define PHY_LED			0x1B	/* LED control */
+ #define PHY_FWV			0x1E	/* firmware version */
+ 
+ #define PHY_MIISTAT_SPD_MASK	GENMASK(2, 0)
+@@ -56,10 +58,15 @@
+ 				 PHY_IMASK_ADSC | \
+ 				 PHY_IMASK_ANC)
+ 
++#define PHY_LED_NUM_LEDS	4
++
+ #define PHY_FWV_REL_MASK	BIT(15)
+ #define PHY_FWV_MAJOR_MASK	GENMASK(11, 8)
+ #define PHY_FWV_MINOR_MASK	GENMASK(7, 0)
+ 
++/* LED */
++#define VSPEC1_LED(x)		(0x1 + x)
++
+ /* SGMII */
+ #define VSPEC1_SGMII_CTRL	0x08
+ #define VSPEC1_SGMII_CTRL_ANEN	BIT(12)		/* Aneg enable */
+@@ -241,6 +248,31 @@ out:
+ 	return ret;
+ }
+ 
++static int gpy_led_write(struct phy_device *phydev)
++{
++	struct device_node *node = phydev->mdio.dev.of_node;
++	u32 led_regs[PHY_LED_NUM_LEDS];
++	int i, ret;
++
++	if (!IS_ENABLED(CONFIG_OF_MDIO))
++		return 0;
++
++	if (of_property_read_u32_array(node, "mxl,led-config", led_regs, PHY_LED_NUM_LEDS))
++		return 0;
++
++	/* Enable LED function handling on all ports*/
++	phy_write(phydev, PHY_LED, 0xFF00);
++
++	/* Write LED register values */
++	for (i = 0; i < PHY_LED_NUM_LEDS; i++) {
++		ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, VSPEC1_LED(i), (u16)led_regs[i]);
++		if (ret < 0)
++			return ret;
++	}
++
++	return 0;
++}
++
+ static int gpy_config_init(struct phy_device *phydev)
+ {
+ 	int ret;
+@@ -252,7 +284,10 @@ static int gpy_config_init(struct phy_de
+ 
+ 	/* Clear all pending interrupts */
+ 	ret = phy_read(phydev, PHY_ISTAT);
+-	return ret < 0 ? ret : 0;
++	if (ret < 0)
++		return ret;
++
++	return gpy_led_write(phydev);
+ }
+ 
+ static bool gpy_has_broken_mdint(struct phy_device *phydev)
diff --git a/target/linux/generic/hack-6.1/766-net-phy-mediatek-ge-add-LED-configuration-interface.patch b/target/linux/generic/hack-6.1/766-net-phy-mediatek-ge-add-LED-configuration-interface.patch
new file mode 100644
index 00000000000000..3405d5c535b6c9
--- /dev/null
+++ b/target/linux/generic/hack-6.1/766-net-phy-mediatek-ge-add-LED-configuration-interface.patch
@@ -0,0 +1,72 @@
+From cc225d163b5a4f7a0d1968298bf7927306646a47 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Fri, 28 Apr 2023 01:53:01 +0200
+Subject: [PATCH] net: phy: mediatek-ge: add LED configuration interface
+
+This adds a small hack similar to the one used for ar8xxx switches to
+read a reg:value map for configuring the LED configuration registers.
+
+This allows OpenWrt to write device-specific LED action as well as blink
+configurations. It is unlikely to be accepted upstream, as upstream
+plans on integrating their own framework for handling these LEDs.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ drivers/net/phy/mediatek-ge.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+--- a/drivers/net/phy/mediatek-ge.c
++++ b/drivers/net/phy/mediatek-ge.c
+@@ -1,4 +1,5 @@
+ // SPDX-License-Identifier: GPL-2.0+
++#include <linux/of.h>
+ #include <linux/bitfield.h>
+ #include <linux/module.h>
+ #include <linux/phy.h>
+@@ -53,6 +54,36 @@ static int mt7530_phy_config_init(struct
+ 	return 0;
+ }
+ 
++static int mt7530_led_config_of(struct phy_device *phydev)
++{
++	struct device_node *np = phydev->mdio.dev.of_node;
++	const __be32 *paddr;
++	int len;
++	int i;
++
++	paddr = of_get_property(np, "mediatek,led-config", &len);
++	if (!paddr)
++		return 0;
++
++	if (len < (2 * sizeof(*paddr)))
++		return -EINVAL;
++
++	len /= sizeof(*paddr);
++
++	phydev_warn(phydev, "Configure LED registers (num=%d)\n", len);
++	for (i = 0; i < len - 1; i += 2) {
++		u32 reg;
++		u32 val;
++
++		reg = be32_to_cpup(paddr + i);
++		val = be32_to_cpup(paddr + i + 1);
++
++		phy_write_mmd(phydev, MDIO_MMD_VEND2, reg, val);
++	}
++
++	return 0;
++}
++
+ static int mt7531_phy_config_init(struct phy_device *phydev)
+ {
+ 	mtk_gephy_config_init(phydev);
+@@ -65,6 +96,9 @@ static int mt7531_phy_config_init(struct
+ 	phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x13, 0x404);
+ 	phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x14, 0x404);
+ 
++	/* LED Config*/
++	mt7530_led_config_of(phydev);
++
+ 	return 0;
+ }
+ 
diff --git a/target/linux/generic/hack-6.1/773-bgmac-add-srab-switch.patch b/target/linux/generic/hack-6.1/773-bgmac-add-srab-switch.patch
new file mode 100644
index 00000000000000..633cacd1e7c313
--- /dev/null
+++ b/target/linux/generic/hack-6.1/773-bgmac-add-srab-switch.patch
@@ -0,0 +1,98 @@
+From 3cb240533ab787899dc7f17aa7d6c5b4810e2e58 Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Fri, 7 Jul 2017 17:26:01 +0200
+Subject: bcm53xx: bgmac: use srab switch driver
+
+use the srab switch driver on these SoCs.
+
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+---
+ drivers/net/ethernet/broadcom/bgmac-bcma.c |  1 +
+ drivers/net/ethernet/broadcom/bgmac.c      | 24 ++++++++++++++++++++++++
+ drivers/net/ethernet/broadcom/bgmac.h      |  4 ++++
+ 3 files changed, 29 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/bgmac-bcma.c
++++ b/drivers/net/ethernet/broadcom/bgmac-bcma.c
+@@ -280,6 +280,7 @@ static int bgmac_probe(struct bcma_devic
+ 		bgmac->feature_flags |= BGMAC_FEAT_CLKCTLST;
+ 		bgmac->feature_flags |= BGMAC_FEAT_NO_RESET;
+ 		bgmac->feature_flags |= BGMAC_FEAT_FORCE_SPEED_2500;
++		bgmac->feature_flags |= BGMAC_FEAT_SRAB;
+ 		break;
+ 	default:
+ 		bgmac->feature_flags |= BGMAC_FEAT_CLKCTLST;
+--- a/drivers/net/ethernet/broadcom/bgmac.c
++++ b/drivers/net/ethernet/broadcom/bgmac.c
+@@ -12,6 +12,7 @@
+ #include <linux/bcma/bcma.h>
+ #include <linux/etherdevice.h>
+ #include <linux/interrupt.h>
++#include <linux/platform_data/b53.h>
+ #include <linux/bcm47xx_nvram.h>
+ #include <linux/phy.h>
+ #include <linux/phy_fixed.h>
+@@ -1408,6 +1409,17 @@ static const struct ethtool_ops bgmac_et
+ 	.set_link_ksettings     = phy_ethtool_set_link_ksettings,
+ };
+ 
++static struct b53_platform_data bgmac_b53_pdata = {
++};
++
++static struct platform_device bgmac_b53_dev = {
++	.name		= "b53-srab-switch",
++	.id		= -1,
++	.dev		= {
++		.platform_data = &bgmac_b53_pdata,
++	},
++};
++
+ /**************************************************
+  * MII
+  **************************************************/
+@@ -1546,6 +1558,14 @@ int bgmac_enet_probe(struct bgmac *bgmac
+ 
+ 	bgmac->in_init = false;
+ 
++	if ((bgmac->feature_flags & BGMAC_FEAT_SRAB) && !bgmac_b53_pdata.regs) {
++		bgmac_b53_pdata.regs = ioremap(0x18007000, 0x1000);
++
++		err = platform_device_register(&bgmac_b53_dev);
++		if (!err)
++			bgmac->b53_device = &bgmac_b53_dev;
++	}
++
+ 	err = register_netdev(bgmac->net_dev);
+ 	if (err) {
+ 		dev_err(bgmac->dev, "Cannot register net device\n");
+@@ -1568,6 +1588,10 @@ EXPORT_SYMBOL_GPL(bgmac_enet_probe);
+ 
+ void bgmac_enet_remove(struct bgmac *bgmac)
+ {
++	if (bgmac->b53_device)
++		platform_device_unregister(&bgmac_b53_dev);
++	bgmac->b53_device = NULL;
++
+ 	unregister_netdev(bgmac->net_dev);
+ 	phy_disconnect(bgmac->net_dev->phydev);
+ 	netif_napi_del(&bgmac->napi);
+--- a/drivers/net/ethernet/broadcom/bgmac.h
++++ b/drivers/net/ethernet/broadcom/bgmac.h
+@@ -388,6 +388,7 @@
+ #define BGMAC_FEAT_CC4_IF_SW_TYPE_RGMII	BIT(18)
+ #define BGMAC_FEAT_CC7_IF_TYPE_RGMII	BIT(19)
+ #define BGMAC_FEAT_IDM_MASK		BIT(20)
++#define BGMAC_FEAT_SRAB			BIT(21)
+ 
+ struct bgmac_slot_info {
+ 	union {
+@@ -495,6 +496,9 @@ struct bgmac {
+ 	void (*cmn_maskset32)(struct bgmac *bgmac, u16 offset, u32 mask,
+ 			      u32 set);
+ 	int (*phy_connect)(struct bgmac *bgmac);
++
++	/* platform device for associated switch */
++	struct platform_device *b53_device;
+ };
+ 
+ struct bgmac *bgmac_alloc(struct device *dev);
diff --git a/target/linux/generic/hack-6.1/780-usb-net-MeigLink_modem_support.patch b/target/linux/generic/hack-6.1/780-usb-net-MeigLink_modem_support.patch
new file mode 100644
index 00000000000000..23f8be5d264be3
--- /dev/null
+++ b/target/linux/generic/hack-6.1/780-usb-net-MeigLink_modem_support.patch
@@ -0,0 +1,43 @@
+From f81700b6bb2eda3756247bce472d8eaf6f466f61 Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 13:49:26 +0200
+Subject: [PATCH] net/usb/qmi_wwan: add MeigLink modem support
+
+---
+ drivers/net/usb/qmi_wwan.c  | 1 +
+ drivers/usb/serial/option.c | 7 +++++++
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1088,6 +1088,7 @@ static const struct usb_device_id produc
+ 	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0620)},	/* Quectel EM160R-GL */
+ 	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0800)},	/* Quectel RM500Q-GL */
+ 	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0801)},	/* Quectel RM520N */
++	{QMI_MATCH_FF_FF_FF(0x05c6, 0xf601)},   /* MeigLink SLM750 */
+ 
+ 	/* 3. Combined interface devices matching on interface number */
+ 	{QMI_FIXED_INTF(0x0408, 0xea42, 4)},	/* Yota / Megafon M100-1 */
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -244,6 +244,8 @@ static void option_instat_callback(struc
+ #define UBLOX_PRODUCT_R410M			0x90b2
+ /* These Yuga products use Qualcomm's vendor ID */
+ #define YUGA_PRODUCT_CLM920_NC5			0x9625
++/* These MeigLink products use Qualcomm's vendor ID */
++#define MEIGLINK_PRODUCT_SLM750			0xf601
+ 
+ #define QUECTEL_VENDOR_ID			0x2c7c
+ /* These Quectel products use Quectel's vendor ID */
+@@ -1169,6 +1171,11 @@ static const struct usb_device_id option
+ 	  .driver_info = ZLP },
+ 	{ USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96),
+ 	  .driver_info = RSVD(4) },
++	/* Meiglink products using Qualcomm vendor ID */
++	// Works OK. In case of some issues check macros that are used by Quectel Products
++	{ USB_DEVICE_AND_INTERFACE_INFO(QUALCOMM_VENDOR_ID, MEIGLINK_PRODUCT_SLM750, 0xff, 0xff, 0xff),
++	  .driver_info = NUMEP2 },
++	{ USB_DEVICE_AND_INTERFACE_INFO(QUALCOMM_VENDOR_ID, MEIGLINK_PRODUCT_SLM750, 0xff, 0, 0) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff),
+ 	  .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) },
diff --git a/target/linux/generic/hack-6.1/790-SFP-GE-T-ignore-TX_FAULT.patch b/target/linux/generic/hack-6.1/790-SFP-GE-T-ignore-TX_FAULT.patch
new file mode 100644
index 00000000000000..afb9f3d9076f9d
--- /dev/null
+++ b/target/linux/generic/hack-6.1/790-SFP-GE-T-ignore-TX_FAULT.patch
@@ -0,0 +1,63 @@
+From 7cc39a6bedbd85f3ff7e16845f310e4ce8d9833f Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Tue, 6 Sep 2022 00:31:19 +0100
+Subject: [PATCH] net: sfp: add quirk for ATS SFP-GE-T 1000Base-TX module
+To: netdev@vger.kernel.org,
+    linux-kernel@vger.kernel.org,
+    Russell King <linux@armlinux.org.uk>,
+    Andrew Lunn <andrew@lunn.ch>,
+    Heiner Kallweit <hkallweit1@gmail.com>
+Cc: David S. Miller <davem@davemloft.net>,
+    Eric Dumazet <edumazet@google.com>,
+    Jakub Kicinski <kuba@kernel.org>,
+    Paolo Abeni <pabeni@redhat.com>,
+    Josef Schlehofer <pepe.schlehofer@gmail.com>
+
+This copper module comes with broken TX_FAULT indicator which must be
+ignored for it to work. Implement ignoring TX_FAULT state bit also
+during reset/insertion and mute the warning telling the user that the
+module indicates TX_FAULT.
+
+Co-authored-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/sfp.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -404,6 +404,9 @@ static const struct sfp_quirk sfp_quirks
+ 	SFP_QUIRK("HUAWEI", "MA5671A", sfp_quirk_2500basex,
+ 		  sfp_fixup_ignore_tx_fault),
+ 
++	// OEM SFP-GE-T is 1000Base-T module
++	SFP_QUIRK_F("OEM", "SFP-GE-T", sfp_fixup_ignore_tx_fault),
++
+ 	// Lantech 8330-262D-E can operate at 2500base-X, but incorrectly report
+ 	// 2500MBd NRZ in their EEPROM
+ 	SFP_QUIRK_M("Lantech", "8330-262D-E", sfp_quirk_2500basex),
+@@ -2339,7 +2342,8 @@ static void sfp_sm_main(struct sfp *sfp,
+ 			 * or t_start_up, so assume there is a fault.
+ 			 */
+ 			sfp_sm_fault(sfp, SFP_S_INIT_TX_FAULT,
+-				     sfp->sm_fault_retries == N_FAULT_INIT);
++				     !sfp->tx_fault_ignore &&
++				     (sfp->sm_fault_retries == N_FAULT_INIT));
+ 		} else if (event == SFP_E_TIMEOUT || event == SFP_E_TX_CLEAR) {
+ 	init_done:
+ 			/* Create mdiobus and start trying for PHY */
+@@ -2568,10 +2572,12 @@ static void sfp_check_state(struct sfp *
+ 	mutex_lock(&sfp->st_mutex);
+ 	state = sfp_get_state(sfp);
+ 	changed = state ^ sfp->state;
+-	if (sfp->tx_fault_ignore)
++	if (sfp->tx_fault_ignore) {
+ 		changed &= SFP_F_PRESENT | SFP_F_LOS;
+-	else
++		state &= ~SFP_F_TX_FAULT;
++	} else {
+ 		changed &= SFP_F_PRESENT | SFP_F_LOS | SFP_F_TX_FAULT;
++	}
+ 
+ 	for (i = 0; i < GPIO_MAX; i++)
+ 		if (changed & BIT(i))
diff --git a/target/linux/generic/hack-6.1/800-GPIO-add-named-gpio-exports.patch b/target/linux/generic/hack-6.1/800-GPIO-add-named-gpio-exports.patch
new file mode 100644
index 00000000000000..658d9c38069178
--- /dev/null
+++ b/target/linux/generic/hack-6.1/800-GPIO-add-named-gpio-exports.patch
@@ -0,0 +1,162 @@
+From cc809a441d8f2924f785eb863dfa6aef47a25b0b Mon Sep 17 00:00:00 2001
+From: John Crispin <blogic@openwrt.org>
+Date: Tue, 12 Aug 2014 20:49:27 +0200
+Subject: [PATCH 30/36] GPIO: add named gpio exports
+
+Signed-off-by: John Crispin <blogic@openwrt.org>
+--- a/drivers/gpio/gpiolib-of.c
++++ b/drivers/gpio/gpiolib-of.c
+@@ -19,6 +19,8 @@
+ #include <linux/pinctrl/pinctrl.h>
+ #include <linux/slab.h>
+ #include <linux/gpio/machine.h>
++#include <linux/init.h>
++#include <linux/platform_device.h>
+ 
+ #include "gpiolib.h"
+ #include "gpiolib-of.h"
+@@ -1030,3 +1032,72 @@ void of_gpio_dev_init(struct gpio_chip *
+ 	else
+ 		gc->of_node = gdev->dev.of_node;
+ }
++
++#ifdef CONFIG_GPIO_SYSFS
++
++static struct of_device_id gpio_export_ids[] = {
++	{ .compatible = "gpio-export" },
++	{ /* sentinel */ }
++};
++
++static int of_gpio_export_probe(struct platform_device *pdev)
++{
++	struct device_node *np = pdev->dev.of_node;
++	struct device_node *cnp;
++	u32 val;
++	int nb = 0;
++
++	for_each_child_of_node(np, cnp) {
++		const char *name = NULL;
++		int gpio;
++		bool dmc;
++		int max_gpio = 1;
++		int i;
++
++		of_property_read_string(cnp, "gpio-export,name", &name);
++
++		if (!name)
++			max_gpio = of_gpio_count(cnp);
++
++		for (i = 0; i < max_gpio; i++) {
++			unsigned flags = 0;
++			enum of_gpio_flags of_flags;
++
++			gpio = of_get_gpio_flags(cnp, i, &of_flags);
++			if (!gpio_is_valid(gpio))
++				return gpio;
++
++			if (of_flags == OF_GPIO_ACTIVE_LOW)
++				flags |= GPIOF_ACTIVE_LOW;
++
++			if (!of_property_read_u32(cnp, "gpio-export,output", &val))
++				flags |= val ? GPIOF_OUT_INIT_HIGH : GPIOF_OUT_INIT_LOW;
++			else
++				flags |= GPIOF_IN;
++
++			if (devm_gpio_request_one(&pdev->dev, gpio, flags, name ? name : of_node_full_name(np)))
++				continue;
++
++			dmc = of_property_read_bool(cnp, "gpio-export,direction_may_change");
++			gpio_export_with_name(gpio, dmc, name);
++			nb++;
++		}
++	}
++
++	dev_info(&pdev->dev, "%d gpio(s) exported\n", nb);
++
++	return 0;
++}
++
++static struct platform_driver gpio_export_driver = {
++	.driver		= {
++		.name		= "gpio-export",
++		.owner	= THIS_MODULE,
++		.of_match_table	= of_match_ptr(gpio_export_ids),
++	},
++	.probe		= of_gpio_export_probe,
++};
++
++module_platform_driver(gpio_export_driver);
++
++#endif
+--- a/include/asm-generic/gpio.h
++++ b/include/asm-generic/gpio.h
+@@ -125,6 +125,12 @@ static inline int gpio_export(unsigned g
+ 	return gpiod_export(gpio_to_desc(gpio), direction_may_change);
+ }
+ 
++int __gpiod_export(struct gpio_desc *desc, bool direction_may_change, const char *name);
++static inline int gpio_export_with_name(unsigned gpio, bool direction_may_change, const char *name)
++{
++	return __gpiod_export(gpio_to_desc(gpio), direction_may_change, name);
++}
++
+ static inline int gpio_export_link(struct device *dev, const char *name,
+ 				   unsigned gpio)
+ {
+--- a/include/linux/gpio/consumer.h
++++ b/include/linux/gpio/consumer.h
+@@ -715,6 +715,7 @@ static inline struct gpio_desc *acpi_get
+ 
+ #if IS_ENABLED(CONFIG_GPIOLIB) && IS_ENABLED(CONFIG_GPIO_SYSFS)
+ 
++int _gpiod_export(struct gpio_desc *desc, bool direction_may_change, const char *name);
+ int gpiod_export(struct gpio_desc *desc, bool direction_may_change);
+ int gpiod_export_link(struct device *dev, const char *name,
+ 		      struct gpio_desc *desc);
+@@ -722,6 +723,13 @@ void gpiod_unexport(struct gpio_desc *de
+ 
+ #else  /* CONFIG_GPIOLIB && CONFIG_GPIO_SYSFS */
+ 
++static inline int _gpiod_export(struct gpio_desc *desc,
++			       bool direction_may_change,
++			       const char *name)
++{
++	return -ENOSYS;
++}
++
+ static inline int gpiod_export(struct gpio_desc *desc,
+ 			       bool direction_may_change)
+ {
+--- a/drivers/gpio/gpiolib-sysfs.c
++++ b/drivers/gpio/gpiolib-sysfs.c
+@@ -544,7 +544,7 @@ static struct class gpio_class = {
+  *
+  * Returns zero on success, else an error.
+  */
+-int gpiod_export(struct gpio_desc *desc, bool direction_may_change)
++int __gpiod_export(struct gpio_desc *desc, bool direction_may_change, const char *name)
+ {
+ 	struct gpio_chip	*chip;
+ 	struct gpio_device	*gdev;
+@@ -606,6 +606,8 @@ int gpiod_export(struct gpio_desc *desc,
+ 	offset = gpio_chip_hwgpio(desc);
+ 	if (chip->names && chip->names[offset])
+ 		ioname = chip->names[offset];
++	if (name)
++		ioname = name;
+ 
+ 	dev = device_create_with_groups(&gpio_class, &gdev->dev,
+ 					MKDEV(0, 0), data, gpio_groups,
+@@ -627,6 +629,12 @@ err_unlock:
+ 	gpiod_dbg(desc, "%s: status %d\n", __func__, status);
+ 	return status;
+ }
++EXPORT_SYMBOL_GPL(__gpiod_export);
++
++int gpiod_export(struct gpio_desc *desc, bool direction_may_change)
++{
++	return __gpiod_export(desc, direction_may_change, NULL);
++}
+ EXPORT_SYMBOL_GPL(gpiod_export);
+ 
+ static int match_export(struct device *dev, const void *desc)
diff --git a/target/linux/generic/hack-6.1/810-bcma-ssb-fallback-sprom.patch b/target/linux/generic/hack-6.1/810-bcma-ssb-fallback-sprom.patch
new file mode 100644
index 00000000000000..c581a512cbd5d0
--- /dev/null
+++ b/target/linux/generic/hack-6.1/810-bcma-ssb-fallback-sprom.patch
@@ -0,0 +1,187 @@
+From e4d708702e6c98f2111e33201a264d6788564cb2 Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Fri, 12 May 2023 11:08:43 +0200
+Subject: [PATCH] ssb_sprom: add generic kernel support for Broadcom  Fallback SPROMs
+
+---
+ drivers/bcma/Kconfig        |  4 ++++
+ drivers/bcma/Makefile       |  1 +
+ drivers/bcma/bcma_private.h |  4 ++++
+ drivers/bcma/main.c         |  8 ++++++++
+ drivers/bcma/sprom.c        | 23 ++++++++++++++---------
+ drivers/ssb/Kconfig         |  5 +++++
+ drivers/ssb/Makefile        |  1 +
+ drivers/ssb/main.c          |  8 ++++++++
+ drivers/ssb/sprom.c         | 12 +++++++++++-
+ drivers/ssb/ssb_private.h   |  4 ++++
+ 10 files changed, 60 insertions(+), 10 deletions(-)
+
+--- a/drivers/bcma/Kconfig
++++ b/drivers/bcma/Kconfig
+@@ -18,6 +18,10 @@ config BCMA_BLOCKIO
+ 	bool
+ 	default y
+ 
++config BCMA_FALLBACK_SPROM
++	bool
++	default y
++
+ config BCMA_HOST_PCI_POSSIBLE
+ 	bool
+ 	depends on PCI = y
+--- a/drivers/bcma/Makefile
++++ b/drivers/bcma/Makefile
+@@ -11,6 +11,7 @@ bcma-$(CONFIG_BCMA_DRIVER_PCI_HOSTMODE)
+ bcma-$(CONFIG_BCMA_DRIVER_MIPS)		+= driver_mips.o
+ bcma-$(CONFIG_BCMA_DRIVER_GMAC_CMN)	+= driver_gmac_cmn.o
+ bcma-$(CONFIG_BCMA_DRIVER_GPIO)		+= driver_gpio.o
++bcma-$(CONFIG_BCMA_FALLBACK_SPROM)	+= fallback-sprom.o
+ bcma-$(CONFIG_BCMA_HOST_PCI)		+= host_pci.o
+ bcma-$(CONFIG_BCMA_HOST_SOC)		+= host_soc.o
+ obj-$(CONFIG_BCMA)			+= bcma.o
+--- a/drivers/bcma/bcma_private.h
++++ b/drivers/bcma/bcma_private.h
+@@ -38,6 +38,10 @@ int bcma_bus_resume(struct bcma_bus *bus
+ void bcma_detect_chip(struct bcma_bus *bus);
+ int bcma_bus_scan(struct bcma_bus *bus);
+ 
++/* fallback-sprom.c */
++int __init bcma_fbs_register(void);
++int bcma_get_fallback_sprom(struct bcma_bus *dev, struct ssb_sprom *out);
++
+ /* sprom.c */
+ int bcma_sprom_get(struct bcma_bus *bus);
+ 
+--- a/drivers/bcma/main.c
++++ b/drivers/bcma/main.c
+@@ -668,6 +668,14 @@ static int __init bcma_modinit(void)
+ {
+ 	int err;
+ 
++#ifdef CONFIG_BCMA_FALLBACK_SPROM
++	err = bcma_fbs_register();
++	if (err) {
++		pr_err("Fallback SPROM initialization failed\n");
++		err = 0;
++	}
++#endif /* CONFIG_BCMA_FALLBACK_SPROM */
++
+ 	err = bcma_init_bus_register();
+ 	if (err)
+ 		return err;
+--- a/drivers/bcma/sprom.c
++++ b/drivers/bcma/sprom.c
+@@ -51,21 +51,26 @@ static int bcma_fill_sprom_with_fallback
+ {
+ 	int err;
+ 
+-	if (!get_fallback_sprom) {
++	if (get_fallback_sprom)
++		err = get_fallback_sprom(bus, out);
++
++#ifdef CONFIG_BCMA_FALLBACK_SPROM
++	if (!get_fallback_sprom || err)
++		err = bcma_get_fallback_sprom(bus, out);
++#else
++	if (!get_fallback_sprom)
+ 		err = -ENOENT;
+-		goto fail;
+-	}
++#endif /* CONFIG_BCMA_FALLBACK_SPROM */
+ 
+-	err = get_fallback_sprom(bus, out);
+-	if (err)
+-		goto fail;
++	if (err) {
++		bcma_warn(bus, "Using fallback SPROM failed (err %d)\n", err);
++		return err;
++	}
+ 
+ 	bcma_debug(bus, "Using SPROM revision %d provided by platform.\n",
+ 		   bus->sprom.revision);
++
+ 	return 0;
+-fail:
+-	bcma_warn(bus, "Using fallback SPROM failed (err %d)\n", err);
+-	return err;
+ }
+ 
+ /**************************************************
+--- a/drivers/ssb/Kconfig
++++ b/drivers/ssb/Kconfig
+@@ -25,6 +25,11 @@ if SSB
+ config SSB_SPROM
+ 	bool
+ 
++config SSB_FALLBACK_SPROM
++	bool
++	depends on SSB_PCIHOST
++	default y
++
+ # Support for Block-I/O. SELECT this from the driver that needs it.
+ config SSB_BLOCKIO
+ 	bool
+--- a/drivers/ssb/Makefile
++++ b/drivers/ssb/Makefile
+@@ -2,6 +2,7 @@
+ # core
+ ssb-y					+= main.o scan.o
+ ssb-$(CONFIG_SSB_EMBEDDED)		+= embedded.o
++ssb-$(CONFIG_SSB_FALLBACK_SPROM)	+= fallback-sprom.o
+ ssb-$(CONFIG_SSB_SPROM)			+= sprom.o
+ 
+ # host support
+--- a/drivers/ssb/main.c
++++ b/drivers/ssb/main.c
+@@ -1287,6 +1287,14 @@ static int __init ssb_modinit(void)
+ {
+ 	int err;
+ 
++#ifdef CONFIG_SSB_FALLBACK_SPROM
++	err = ssb_fbs_register();
++	if (err) {
++		pr_err("Fallback SPROM initialization failed\n");
++		err = 0;
++	}
++#endif /* CONFIG_SSB_FALLBACK_SPROM */
++
+ 	/* See the comment at the ssb_is_early_boot definition */
+ 	ssb_is_early_boot = 0;
+ 	err = bus_register(&ssb_bustype);
+--- a/drivers/ssb/sprom.c
++++ b/drivers/ssb/sprom.c
+@@ -180,10 +180,20 @@ int ssb_arch_register_fallback_sprom(int
+ 
+ int ssb_fill_sprom_with_fallback(struct ssb_bus *bus, struct ssb_sprom *out)
+ {
++	int err;
++
++	if (get_fallback_sprom)
++		err = get_fallback_sprom(bus, out);
++
++#ifdef CONFIG_SSB_FALLBACK_SPROM
++	if (!get_fallback_sprom || err)
++		err = ssb_get_fallback_sprom(bus, out);
++#else
+ 	if (!get_fallback_sprom)
+ 		return -ENOENT;
++#endif /* CONFIG_SSB_FALLBACK_SPROM */
+ 
+-	return get_fallback_sprom(bus, out);
++	return err;
+ }
+ 
+ /* https://bcm-v4.sipsolutions.net/802.11/IsSpromAvailable */
+--- a/drivers/ssb/ssb_private.h
++++ b/drivers/ssb/ssb_private.h
+@@ -143,6 +143,10 @@ extern int ssb_bus_scan(struct ssb_bus *
+ extern void ssb_iounmap(struct ssb_bus *ssb);
+ 
+ 
++/* fallback-sprom.c */
++int __init ssb_fbs_register(void);
++int ssb_get_fallback_sprom(struct ssb_bus *dev, struct ssb_sprom *out);
++
+ /* sprom.c */
+ extern
+ ssize_t ssb_attr_sprom_show(struct ssb_bus *bus, char *buf,
diff --git a/target/linux/generic/hack-6.1/901-debloat_sock_diag.patch b/target/linux/generic/hack-6.1/901-debloat_sock_diag.patch
new file mode 100644
index 00000000000000..582a48cb182c77
--- /dev/null
+++ b/target/linux/generic/hack-6.1/901-debloat_sock_diag.patch
@@ -0,0 +1,164 @@
+From 3b6115d6b57a263bdc8c9b1df273bd4a7955eead Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 8 Jul 2017 08:16:31 +0200
+Subject: debloat: add some debloat patches, strip down procfs and make O_DIRECT support optional, saves ~15K after lzma on MIPS
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ net/Kconfig         | 3 +++
+ net/core/Makefile   | 3 ++-
+ net/core/sock.c     | 2 ++
+ net/ipv4/Kconfig    | 1 +
+ net/netlink/Kconfig | 1 +
+ net/packet/Kconfig  | 1 +
+ net/unix/Kconfig    | 1 +
+ 7 files changed, 11 insertions(+), 1 deletion(-)
+
+--- a/net/Kconfig
++++ b/net/Kconfig
+@@ -104,6 +104,9 @@ source "net/mptcp/Kconfig"
+ 
+ endif # if INET
+ 
++config SOCK_DIAG
++	bool
++
+ config NETWORK_SECMARK
+ 	bool "Security Marking"
+ 	help
+--- a/net/core/Makefile
++++ b/net/core/Makefile
+@@ -11,11 +11,12 @@ obj-$(CONFIG_SYSCTL) += sysctl_net_core.
+ 
+ obj-y		     += dev.o dev_addr_lists.o dst.o netevent.o \
+ 			neighbour.o rtnetlink.o utils.o link_watch.o filter.o \
+-			sock_diag.o dev_ioctl.o tso.o sock_reuseport.o \
++ 			dev_ioctl.o tso.o sock_reuseport.o \
+ 			fib_notifier.o xdp.o flow_offload.o gro.o
+ 
+ obj-$(CONFIG_NETDEV_ADDR_LIST_TEST) += dev_addr_lists_test.o
+ 
++obj-$(CONFIG_SOCK_DIAG) += sock_diag.o
+ obj-y += net-sysfs.o
+ obj-$(CONFIG_PAGE_POOL) += page_pool.o
+ obj-$(CONFIG_PROC_FS) += net-procfs.o
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -114,6 +114,7 @@
+ #include <linux/memcontrol.h>
+ #include <linux/prefetch.h>
+ #include <linux/compat.h>
++#include <linux/cookie.h>
+ 
+ #include <linux/uaccess.h>
+ 
+@@ -145,6 +146,7 @@
+ 
+ static DEFINE_MUTEX(proto_list_mutex);
+ static LIST_HEAD(proto_list);
++DEFINE_COOKIE(sock_cookie);
+ 
+ static void sock_def_write_space_wfree(struct sock *sk);
+ static void sock_def_write_space(struct sock *sk);
+@@ -582,6 +584,18 @@ discard_and_relse:
+ }
+ EXPORT_SYMBOL(__sk_receive_skb);
+ 
++u64 __sock_gen_cookie(struct sock *sk)
++{
++	while (1) {
++		u64 res = atomic64_read(&sk->sk_cookie);
++
++		if (res)
++			return res;
++		res = gen_cookie_next(&sock_cookie);
++		atomic64_cmpxchg(&sk->sk_cookie, 0, res);
++	}
++}
++
+ INDIRECT_CALLABLE_DECLARE(struct dst_entry *ip6_dst_check(struct dst_entry *,
+ 							  u32));
+ INDIRECT_CALLABLE_DECLARE(struct dst_entry *ipv4_dst_check(struct dst_entry *,
+@@ -2174,9 +2188,11 @@ static void __sk_free(struct sock *sk)
+ 	if (likely(sk->sk_net_refcnt))
+ 		sock_inuse_add(sock_net(sk), -1);
+ 
++#ifdef CONFIG_SOCK_DIAG
+ 	if (unlikely(sk->sk_net_refcnt && sock_diag_has_destroy_listeners(sk)))
+ 		sock_diag_broadcast_destroy(sk);
+ 	else
++#endif
+ 		sk_destruct(sk);
+ }
+ 
+--- a/net/core/sock_diag.c
++++ b/net/core/sock_diag.c
+@@ -12,7 +12,6 @@
+ #include <linux/tcp.h>
+ #include <linux/workqueue.h>
+ #include <linux/nospec.h>
+-#include <linux/cookie.h>
+ #include <linux/inet_diag.h>
+ #include <linux/sock_diag.h>
+ 
+@@ -21,20 +20,6 @@ static int (*inet_rcv_compat)(struct sk_
+ static DEFINE_MUTEX(sock_diag_table_mutex);
+ static struct workqueue_struct *broadcast_wq;
+ 
+-DEFINE_COOKIE(sock_cookie);
+-
+-u64 __sock_gen_cookie(struct sock *sk)
+-{
+-	while (1) {
+-		u64 res = atomic64_read(&sk->sk_cookie);
+-
+-		if (res)
+-			return res;
+-		res = gen_cookie_next(&sock_cookie);
+-		atomic64_cmpxchg(&sk->sk_cookie, 0, res);
+-	}
+-}
+-
+ int sock_diag_check_cookie(struct sock *sk, const __u32 *cookie)
+ {
+ 	u64 res;
+--- a/net/ipv4/Kconfig
++++ b/net/ipv4/Kconfig
+@@ -423,6 +423,7 @@ config INET_TUNNEL
+ 
+ config INET_DIAG
+ 	tristate "INET: socket monitoring interface"
++	select SOCK_DIAG
+ 	default y
+ 	help
+ 	  Support for INET (TCP, DCCP, etc) socket monitoring interface used by
+--- a/net/netlink/Kconfig
++++ b/net/netlink/Kconfig
+@@ -5,6 +5,7 @@
+ 
+ config NETLINK_DIAG
+ 	tristate "NETLINK: socket monitoring interface"
++	select SOCK_DIAG
+ 	default n
+ 	help
+ 	  Support for NETLINK socket monitoring interface used by the ss tool.
+--- a/net/packet/Kconfig
++++ b/net/packet/Kconfig
+@@ -19,6 +19,7 @@ config PACKET
+ config PACKET_DIAG
+ 	tristate "Packet: sockets monitoring interface"
+ 	depends on PACKET
++	select SOCK_DIAG
+ 	default n
+ 	help
+ 	  Support for PF_PACKET sockets monitoring interface used by the ss tool.
+--- a/net/unix/Kconfig
++++ b/net/unix/Kconfig
+@@ -33,6 +33,7 @@ config	AF_UNIX_OOB
+ config UNIX_DIAG
+ 	tristate "UNIX: socket monitoring interface"
+ 	depends on UNIX
++	select SOCK_DIAG
+ 	default n
+ 	help
+ 	  Support for UNIX socket monitoring interface used by the ss tool.
diff --git a/target/linux/generic/hack-6.1/902-debloat_proc.patch b/target/linux/generic/hack-6.1/902-debloat_proc.patch
new file mode 100644
index 00000000000000..bac3d4af827664
--- /dev/null
+++ b/target/linux/generic/hack-6.1/902-debloat_proc.patch
@@ -0,0 +1,408 @@
+From 9e3f1d0805b2d919904dd9a4ff0d956314cc3cba Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 8 Jul 2017 08:20:09 +0200
+Subject: debloat: procfs
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ fs/locks.c               |  2 ++
+ fs/proc/Kconfig          |  5 +++++
+ fs/proc/consoles.c       |  3 +++
+ fs/proc/proc_tty.c       | 11 ++++++++++-
+ include/net/snmp.h       | 18 +++++++++++++++++-
+ ipc/msg.c                |  3 +++
+ ipc/sem.c                |  2 ++
+ ipc/shm.c                |  2 ++
+ ipc/util.c               |  3 +++
+ kernel/exec_domain.c     |  2 ++
+ kernel/irq/proc.c        |  9 +++++++++
+ kernel/time/timer_list.c |  2 ++
+ mm/vmalloc.c             |  2 ++
+ mm/vmstat.c              |  8 +++++---
+ net/8021q/vlanproc.c     |  6 ++++++
+ net/core/net-procfs.c    | 18 ++++++++++++------
+ net/core/sock.c          |  2 ++
+ net/ipv4/fib_trie.c      | 18 ++++++++++++------
+ net/ipv4/proc.c          |  3 +++
+ net/ipv4/route.c         |  3 +++
+ 20 files changed, 105 insertions(+), 17 deletions(-)
+
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -2909,6 +2909,8 @@ static const struct seq_operations locks
+ 
+ static int __init proc_locks_init(void)
+ {
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return 0;
+ 	proc_create_seq_private("locks", 0, NULL, &locks_seq_operations,
+ 			sizeof(struct locks_iterator), NULL);
+ 	return 0;
+--- a/fs/proc/Kconfig
++++ b/fs/proc/Kconfig
+@@ -101,6 +101,11 @@ config PROC_CHILDREN
+ 	  Say Y if you are running any user-space software which takes benefit from
+ 	  this interface. For example, rkt is such a piece of software.
+ 
++config PROC_STRIPPED
++	default n
++	depends on EXPERT
++	bool "Strip non-essential /proc functionality to reduce code size"
++
+ config PROC_PID_ARCH_STATUS
+ 	def_bool n
+ 	depends on PROC_FS
+--- a/fs/proc/consoles.c
++++ b/fs/proc/consoles.c
+@@ -92,6 +92,9 @@ static const struct seq_operations conso
+ 
+ static int __init proc_consoles_init(void)
+ {
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return 0;
++
+ 	proc_create_seq("consoles", 0, NULL, &consoles_op);
+ 	return 0;
+ }
+--- a/fs/proc/proc_tty.c
++++ b/fs/proc/proc_tty.c
+@@ -131,7 +131,10 @@ static const struct seq_operations tty_d
+ void proc_tty_register_driver(struct tty_driver *driver)
+ {
+ 	struct proc_dir_entry *ent;
+-		
++
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return;
++
+ 	if (!driver->driver_name || driver->proc_entry ||
+ 	    !driver->ops->proc_show)
+ 		return;
+@@ -148,6 +151,9 @@ void proc_tty_unregister_driver(struct t
+ {
+ 	struct proc_dir_entry *ent;
+ 
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return;
++
+ 	ent = driver->proc_entry;
+ 	if (!ent)
+ 		return;
+@@ -162,6 +168,9 @@ void proc_tty_unregister_driver(struct t
+  */
+ void __init proc_tty_init(void)
+ {
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return;
++
+ 	if (!proc_mkdir("tty", NULL))
+ 		return;
+ 	proc_mkdir("tty/ldisc", NULL);	/* Preserved: it's userspace visible */
+--- a/include/net/snmp.h
++++ b/include/net/snmp.h
+@@ -124,6 +124,21 @@ struct linux_tls_mib {
+ #define DECLARE_SNMP_STAT(type, name)	\
+ 	extern __typeof__(type) __percpu *name
+ 
++#ifdef CONFIG_PROC_STRIPPED
++#define __SNMP_STATS_DUMMY(mib)	\
++	do { (void) mib->mibs[0]; } while(0)
++
++#define __SNMP_INC_STATS(mib, field) __SNMP_STATS_DUMMY(mib)
++#define SNMP_INC_STATS_ATOMIC_LONG(mib, field) __SNMP_STATS_DUMMY(mib)
++#define SNMP_INC_STATS(mib, field) __SNMP_STATS_DUMMY(mib)
++#define SNMP_DEC_STATS(mib, field) __SNMP_STATS_DUMMY(mib)
++#define __SNMP_ADD_STATS(mib, field, addend) __SNMP_STATS_DUMMY(mib)
++#define SNMP_ADD_STATS(mib, field, addend) __SNMP_STATS_DUMMY(mib)
++#define SNMP_UPD_PO_STATS(mib, basefield, addend) __SNMP_STATS_DUMMY(mib)
++#define __SNMP_UPD_PO_STATS(mib, basefield, addend) __SNMP_STATS_DUMMY(mib)
++
++#else
++
+ #define __SNMP_INC_STATS(mib, field)	\
+ 			__this_cpu_inc(mib->mibs[field])
+ 
+@@ -154,8 +169,9 @@ struct linux_tls_mib {
+ 		__this_cpu_add(ptr[basefield##OCTETS], addend);	\
+ 	} while (0)
+ 
++#endif
+ 
+-#if BITS_PER_LONG==32
++#if (BITS_PER_LONG==32) && !defined(CONFIG_PROC_STRIPPED)
+ 
+ #define __SNMP_ADD_STATS64(mib, field, addend) 				\
+ 	do {								\
+--- a/ipc/msg.c
++++ b/ipc/msg.c
+@@ -1370,6 +1370,9 @@ void __init msg_init(void)
+ {
+ 	msg_init_ns(&init_ipc_ns);
+ 
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return;
++
+ 	ipc_init_proc_interface("sysvipc/msg",
+ 				"       key      msqid perms      cbytes       qnum lspid lrpid   uid   gid  cuid  cgid      stime      rtime      ctime\n",
+ 				IPC_MSG_IDS, sysvipc_msg_proc_show);
+--- a/ipc/sem.c
++++ b/ipc/sem.c
+@@ -268,6 +268,8 @@ void sem_exit_ns(struct ipc_namespace *n
+ void __init sem_init(void)
+ {
+ 	sem_init_ns(&init_ipc_ns);
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return;
+ 	ipc_init_proc_interface("sysvipc/sem",
+ 				"       key      semid perms      nsems   uid   gid  cuid  cgid      otime      ctime\n",
+ 				IPC_SEM_IDS, sysvipc_sem_proc_show);
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -154,6 +154,8 @@ pure_initcall(ipc_ns_init);
+ 
+ void __init shm_init(void)
+ {
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return;
+ 	ipc_init_proc_interface("sysvipc/shm",
+ #if BITS_PER_LONG <= 32
+ 				"       key      shmid perms       size  cpid  lpid nattch   uid   gid  cuid  cgid      atime      dtime      ctime        rss       swap\n",
+--- a/ipc/util.c
++++ b/ipc/util.c
+@@ -141,6 +141,9 @@ void __init ipc_init_proc_interface(cons
+ 	struct proc_dir_entry *pde;
+ 	struct ipc_proc_iface *iface;
+ 
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return;
++
+ 	iface = kmalloc(sizeof(*iface), GFP_KERNEL);
+ 	if (!iface)
+ 		return;
+--- a/kernel/exec_domain.c
++++ b/kernel/exec_domain.c
+@@ -29,6 +29,8 @@ static int execdomains_proc_show(struct
+ 
+ static int __init proc_execdomains_init(void)
+ {
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return 0;
+ 	proc_create_single("execdomains", 0, NULL, execdomains_proc_show);
+ 	return 0;
+ }
+--- a/kernel/irq/proc.c
++++ b/kernel/irq/proc.c
+@@ -341,6 +341,9 @@ void register_irq_proc(unsigned int irq,
+ 	void __maybe_unused *irqp = (void *)(unsigned long) irq;
+ 	char name [MAX_NAMELEN];
+ 
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED) && !IS_ENABLED(CONFIG_SMP))
++		return;
++
+ 	if (!root_irq_dir || (desc->irq_data.chip == &no_irq_chip))
+ 		return;
+ 
+@@ -394,6 +397,9 @@ void unregister_irq_proc(unsigned int ir
+ {
+ 	char name [MAX_NAMELEN];
+ 
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED) && !IS_ENABLED(CONFIG_SMP))
++		return;
++
+ 	if (!root_irq_dir || !desc->dir)
+ 		return;
+ #ifdef CONFIG_SMP
+@@ -432,6 +438,9 @@ void init_irq_proc(void)
+ 	unsigned int irq;
+ 	struct irq_desc *desc;
+ 
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED) && !IS_ENABLED(CONFIG_SMP))
++		return;
++
+ 	/* create /proc/irq */
+ 	root_irq_dir = proc_mkdir("irq", NULL);
+ 	if (!root_irq_dir)
+--- a/kernel/time/timer_list.c
++++ b/kernel/time/timer_list.c
+@@ -350,6 +350,8 @@ static int __init init_timer_list_procfs
+ {
+ 	struct proc_dir_entry *pe;
+ 
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return 0;
+ 	pe = proc_create_seq_private("timer_list", 0400, NULL, &timer_list_sops,
+ 			sizeof(struct timer_list_iter), NULL);
+ 	if (!pe)
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -4183,6 +4183,8 @@ static const struct seq_operations vmall
+ 
+ static int __init proc_vmalloc_init(void)
+ {
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return 0;
+ 	if (IS_ENABLED(CONFIG_NUMA))
+ 		proc_create_seq_private("vmallocinfo", 0400, NULL,
+ 				&vmalloc_op,
+--- a/mm/vmstat.c
++++ b/mm/vmstat.c
+@@ -2109,10 +2109,12 @@ void __init init_mm_internals(void)
+ 	start_shepherd_timer();
+ #endif
+ #ifdef CONFIG_PROC_FS
+-	proc_create_seq("buddyinfo", 0444, NULL, &fragmentation_op);
+-	proc_create_seq("pagetypeinfo", 0400, NULL, &pagetypeinfo_op);
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED)) {
++		proc_create_seq("buddyinfo", 0444, NULL, &fragmentation_op);
++		proc_create_seq("pagetypeinfo", 0400, NULL, &pagetypeinfo_op);
++		proc_create_seq("zoneinfo", 0444, NULL, &zoneinfo_op);
++	}
+ 	proc_create_seq("vmstat", 0444, NULL, &vmstat_op);
+-	proc_create_seq("zoneinfo", 0444, NULL, &zoneinfo_op);
+ #endif
+ }
+ 
+--- a/net/8021q/vlanproc.c
++++ b/net/8021q/vlanproc.c
+@@ -93,6 +93,9 @@ void vlan_proc_cleanup(struct net *net)
+ {
+ 	struct vlan_net *vn = net_generic(net, vlan_net_id);
+ 
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return;
++
+ 	if (vn->proc_vlan_conf)
+ 		remove_proc_entry(name_conf, vn->proc_vlan_dir);
+ 
+@@ -112,6 +115,9 @@ int __net_init vlan_proc_init(struct net
+ {
+ 	struct vlan_net *vn = net_generic(net, vlan_net_id);
+ 
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return 0;
++
+ 	vn->proc_vlan_dir = proc_net_mkdir(net, name_root, net->proc_net);
+ 	if (!vn->proc_vlan_dir)
+ 		goto err;
+--- a/net/core/net-procfs.c
++++ b/net/core/net-procfs.c
+@@ -319,10 +319,12 @@ static int __net_init dev_proc_net_init(
+ 	if (!proc_create_net("dev", 0444, net->proc_net, &dev_seq_ops,
+ 			sizeof(struct seq_net_private)))
+ 		goto out;
+-	if (!proc_create_seq("softnet_stat", 0444, net->proc_net,
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED) &&
++			!proc_create_seq("softnet_stat", 0444, net->proc_net,
+ 			 &softnet_seq_ops))
+ 		goto out_dev;
+-	if (!proc_create_net("ptype", 0444, net->proc_net, &ptype_seq_ops,
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED) &&
++			!proc_create_net("ptype", 0444, net->proc_net, &ptype_seq_ops,
+ 			sizeof(struct seq_net_private)))
+ 		goto out_softnet;
+ 
+@@ -332,9 +334,11 @@ static int __net_init dev_proc_net_init(
+ out:
+ 	return rc;
+ out_ptype:
+-	remove_proc_entry("ptype", net->proc_net);
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED))
++		remove_proc_entry("ptype", net->proc_net);
+ out_softnet:
+-	remove_proc_entry("softnet_stat", net->proc_net);
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED))
++		remove_proc_entry("softnet_stat", net->proc_net);
+ out_dev:
+ 	remove_proc_entry("dev", net->proc_net);
+ 	goto out;
+@@ -344,8 +348,10 @@ static void __net_exit dev_proc_net_exit
+ {
+ 	wext_proc_exit(net);
+ 
+-	remove_proc_entry("ptype", net->proc_net);
+-	remove_proc_entry("softnet_stat", net->proc_net);
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED)) {
++		remove_proc_entry("ptype", net->proc_net);
++		remove_proc_entry("softnet_stat", net->proc_net);
++	}
+ 	remove_proc_entry("dev", net->proc_net);
+ }
+ 
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -4088,6 +4088,8 @@ static __net_initdata struct pernet_oper
+ 
+ static int __init proto_init(void)
+ {
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return 0;
+ 	return register_pernet_subsys(&proto_net_ops);
+ }
+ 
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -3031,11 +3031,13 @@ static const struct seq_operations fib_r
+ 
+ int __net_init fib_proc_init(struct net *net)
+ {
+-	if (!proc_create_net("fib_trie", 0444, net->proc_net, &fib_trie_seq_ops,
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED) &&
++			!proc_create_net("fib_trie", 0444, net->proc_net, &fib_trie_seq_ops,
+ 			sizeof(struct fib_trie_iter)))
+ 		goto out1;
+ 
+-	if (!proc_create_net_single("fib_triestat", 0444, net->proc_net,
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED) &&
++			!proc_create_net_single("fib_triestat", 0444, net->proc_net,
+ 			fib_triestat_seq_show, NULL))
+ 		goto out2;
+ 
+@@ -3046,17 +3048,21 @@ int __net_init fib_proc_init(struct net
+ 	return 0;
+ 
+ out3:
+-	remove_proc_entry("fib_triestat", net->proc_net);
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED))
++		remove_proc_entry("fib_triestat", net->proc_net);
+ out2:
+-	remove_proc_entry("fib_trie", net->proc_net);
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED))
++		remove_proc_entry("fib_trie", net->proc_net);
+ out1:
+ 	return -ENOMEM;
+ }
+ 
+ void __net_exit fib_proc_exit(struct net *net)
+ {
+-	remove_proc_entry("fib_trie", net->proc_net);
+-	remove_proc_entry("fib_triestat", net->proc_net);
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED)) {
++		remove_proc_entry("fib_trie", net->proc_net);
++		remove_proc_entry("fib_triestat", net->proc_net);
++	}
+ 	remove_proc_entry("route", net->proc_net);
+ }
+ 
+--- a/net/ipv4/proc.c
++++ b/net/ipv4/proc.c
+@@ -553,5 +553,8 @@ static __net_initdata struct pernet_oper
+ 
+ int __init ip_misc_proc_init(void)
+ {
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return 0;
++
+ 	return register_pernet_subsys(&ip_proc_ops);
+ }
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -380,6 +380,9 @@ static struct pernet_operations ip_rt_pr
+ 
+ static int __init ip_rt_proc_init(void)
+ {
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return 0;
++
+ 	return register_pernet_subsys(&ip_rt_proc_ops);
+ }
+ 
diff --git a/target/linux/generic/hack-6.1/904-debloat_dma_buf.patch b/target/linux/generic/hack-6.1/904-debloat_dma_buf.patch
new file mode 100644
index 00000000000000..48c001bfab5cab
--- /dev/null
+++ b/target/linux/generic/hack-6.1/904-debloat_dma_buf.patch
@@ -0,0 +1,93 @@
+From e3692cb2fcd5ba1244512a0f43b8118f65f1c375 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 8 Jul 2017 08:20:43 +0200
+Subject: debloat: dmabuf
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ drivers/base/Kconfig      |  2 +-
+ drivers/dma-buf/Makefile  | 10 +++++++---
+ drivers/dma-buf/dma-buf.c |  4 +++-
+ kernel/sched/core.c       |  1 +
+ 4 files changed, 12 insertions(+), 5 deletions(-)
+
+--- a/drivers/base/Kconfig
++++ b/drivers/base/Kconfig
+@@ -198,7 +198,7 @@ config SOC_BUS
+ source "drivers/base/regmap/Kconfig"
+ 
+ config DMA_SHARED_BUFFER
+-	bool
++	tristate
+ 	default n
+ 	select IRQ_WORK
+ 	help
+--- a/drivers/dma-buf/heaps/Makefile
++++ b/drivers/dma-buf/heaps/Makefile
+@@ -1,3 +1,3 @@
+ # SPDX-License-Identifier: GPL-2.0
+-obj-$(CONFIG_DMABUF_HEAPS_SYSTEM)	+= system_heap.o
+-obj-$(CONFIG_DMABUF_HEAPS_CMA)		+= cma_heap.o
++dma-buf-objs-$(CONFIG_DMABUF_HEAPS_SYSTEM)	+= system_heap.o
++dma-buf-objs-$(CONFIG_DMABUF_HEAPS_CMA)		+= cma_heap.o
+--- a/drivers/dma-buf/Makefile
++++ b/drivers/dma-buf/Makefile
+@@ -1,12 +1,14 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+-obj-y := dma-buf.o dma-fence.o dma-fence-array.o dma-fence-chain.o \
++obj-$(CONFIG_DMA_SHARED_BUFFER) := dma-shared-buffer.o
++
++dma-buf-objs-y := dma-buf.o dma-fence.o dma-fence-array.o dma-fence-chain.o \
+ 	 dma-fence-unwrap.o dma-resv.o
+-obj-$(CONFIG_DMABUF_HEAPS)	+= dma-heap.o
+-obj-$(CONFIG_DMABUF_HEAPS)	+= heaps/
+-obj-$(CONFIG_SYNC_FILE)		+= sync_file.o
+-obj-$(CONFIG_SW_SYNC)		+= sw_sync.o sync_debug.o
+-obj-$(CONFIG_UDMABUF)		+= udmabuf.o
+-obj-$(CONFIG_DMABUF_SYSFS_STATS) += dma-buf-sysfs-stats.o
++dma-buf-objs-$(CONFIG_DMABUF_HEAPS)	+= dma-heap.o
++obj-$(CONFIG_DMABUF_HEAPS)		+= heaps/
++dma-buf-objs-$(CONFIG_SYNC_FILE)	+= sync_file.o
++dma-buf-objs-$(CONFIG_SW_SYNC)		+= sw_sync.o sync_debug.o
++dma-buf-objs-$(CONFIG_UDMABUF)		+= udmabuf.o
++dma-buf-objs-$(CONFIG_DMABUF_SYSFS_STATS) += dma-buf-sysfs-stats.o
+ 
+ dmabuf_selftests-y := \
+ 	selftest.o \
+@@ -15,4 +17,6 @@ dmabuf_selftests-y := \
+ 	st-dma-fence-unwrap.o \
+ 	st-dma-resv.o
+ 
+-obj-$(CONFIG_DMABUF_SELFTESTS)	+= dmabuf_selftests.o
++dma-buf-objs-$(CONFIG_DMABUF_SELFTESTS)	+= dmabuf_selftests.o
++
++dma-shared-buffer-objs :=  $(dma-buf-objs-y)
+--- a/drivers/dma-buf/dma-buf.c
++++ b/drivers/dma-buf/dma-buf.c
+@@ -1583,4 +1583,5 @@ static void __exit dma_buf_deinit(void)
+ 	kern_unmount(dma_buf_mnt);
+ 	dma_buf_uninit_sysfs_statistics();
+ }
+-__exitcall(dma_buf_deinit);
++module_exit(dma_buf_deinit);
++MODULE_LICENSE("GPL");
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -4363,6 +4363,7 @@ int wake_up_state(struct task_struct *p,
+ {
+ 	return try_to_wake_up(p, state, 0);
+ }
++EXPORT_SYMBOL_GPL(wake_up_state);
+ 
+ /*
+  * Perform scheduler related setup for a newly forked process p.
+--- a/fs/d_path.c
++++ b/fs/d_path.c
+@@ -313,6 +313,7 @@ char *dynamic_dname(char *buffer, int bu
+ 	buffer += buflen - sz;
+ 	return memcpy(buffer, temp, sz);
+ }
++EXPORT_SYMBOL_GPL(dynamic_dname);
+ 
+ char *simple_dname(struct dentry *dentry, char *buffer, int buflen)
+ {
diff --git a/target/linux/generic/hack-6.1/910-kobject_uevent.patch b/target/linux/generic/hack-6.1/910-kobject_uevent.patch
new file mode 100644
index 00000000000000..c4c41ca400ae32
--- /dev/null
+++ b/target/linux/generic/hack-6.1/910-kobject_uevent.patch
@@ -0,0 +1,32 @@
+From 0d37e6edc09c99e683dd91ca0e83bbc0df8477b3 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 16 Jul 2017 16:56:10 +0200
+Subject: lib: add uevent_next_seqnum()
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ include/linux/kobject.h |  5 +++++
+ lib/kobject_uevent.c    | 37 +++++++++++++++++++++++++++++++++++++
+ 2 files changed, 42 insertions(+)
+
+--- a/lib/kobject_uevent.c
++++ b/lib/kobject_uevent.c
+@@ -179,6 +179,18 @@ out:
+ 	return r;
+ }
+ 
++u64 uevent_next_seqnum(void)
++{
++	u64 seq;
++
++	mutex_lock(&uevent_sock_mutex);
++	seq = ++uevent_seqnum;
++	mutex_unlock(&uevent_sock_mutex);
++
++	return seq;
++}
++EXPORT_SYMBOL_GPL(uevent_next_seqnum);
++
+ /**
+  * kobject_synth_uevent - send synthetic uevent with arguments
+  *
diff --git a/target/linux/generic/hack-6.1/911-kobject_add_broadcast_uevent.patch b/target/linux/generic/hack-6.1/911-kobject_add_broadcast_uevent.patch
new file mode 100644
index 00000000000000..9854585d25913d
--- /dev/null
+++ b/target/linux/generic/hack-6.1/911-kobject_add_broadcast_uevent.patch
@@ -0,0 +1,76 @@
+From 0d37e6edc09c99e683dd91ca0e83bbc0df8477b3 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 16 Jul 2017 16:56:10 +0200
+Subject: lib: add uevent_next_seqnum()
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ include/linux/kobject.h |  5 +++++
+ lib/kobject_uevent.c    | 37 +++++++++++++++++++++++++++++++++++++
+ 2 files changed, 42 insertions(+)
+
+--- a/include/linux/kobject.h
++++ b/include/linux/kobject.h
+@@ -32,6 +32,8 @@
+ #define UEVENT_NUM_ENVP			64	/* number of env pointers */
+ #define UEVENT_BUFFER_SIZE		2048	/* buffer for the variables */
+ 
++struct sk_buff;
++
+ #ifdef CONFIG_UEVENT_HELPER
+ /* path to the userspace helper executed on an event */
+ extern char uevent_helper[];
+@@ -224,4 +226,7 @@ int kobject_synth_uevent(struct kobject
+ __printf(2, 3)
+ int add_uevent_var(struct kobj_uevent_env *env, const char *format, ...);
+ 
++int broadcast_uevent(struct sk_buff *skb, __u32 pid, __u32 group,
++		     gfp_t allocation);
++
+ #endif /* _KOBJECT_H_ */
+--- a/lib/kobject_uevent.c
++++ b/lib/kobject_uevent.c
+@@ -691,6 +691,43 @@ int add_uevent_var(struct kobj_uevent_en
+ EXPORT_SYMBOL_GPL(add_uevent_var);
+ 
+ #if defined(CONFIG_NET)
++int broadcast_uevent(struct sk_buff *skb, __u32 pid, __u32 group,
++		     gfp_t allocation)
++{
++	struct uevent_sock *ue_sk;
++	int err = 0;
++
++	/* send netlink message */
++	mutex_lock(&uevent_sock_mutex);
++	list_for_each_entry(ue_sk, &uevent_sock_list, list) {
++		struct sock *uevent_sock = ue_sk->sk;
++		struct sk_buff *skb2;
++
++		skb2 = skb_clone(skb, allocation);
++		if (!skb2)
++			break;
++
++		err = netlink_broadcast(uevent_sock, skb2, pid, group,
++					allocation);
++		if (err)
++			break;
++	}
++	mutex_unlock(&uevent_sock_mutex);
++
++	kfree_skb(skb);
++	return err;
++}
++#else
++int broadcast_uevent(struct sk_buff *skb, __u32 pid, __u32 group,
++		     gfp_t allocation)
++{
++	kfree_skb(skb);
++	return 0;
++}
++#endif
++EXPORT_SYMBOL_GPL(broadcast_uevent);
++
++#if defined(CONFIG_NET)
+ static int uevent_net_broadcast(struct sock *usk, struct sk_buff *skb,
+ 				struct netlink_ext_ack *extack)
+ {
diff --git a/target/linux/generic/hack-6.1/920-device_tree_cmdline.patch b/target/linux/generic/hack-6.1/920-device_tree_cmdline.patch
new file mode 100644
index 00000000000000..cc384bb553baae
--- /dev/null
+++ b/target/linux/generic/hack-6.1/920-device_tree_cmdline.patch
@@ -0,0 +1,21 @@
+From e08bcbbaa52fcc41f02743fd2e62a33255ce52da Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 13:52:28 +0200
+Subject: [PATCH] of/ftd: add device tree cmdline
+
+---
+ drivers/of/fdt.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -1183,6 +1183,9 @@ int __init early_init_dt_scan_chosen(cha
+ 	p = of_get_flat_dt_prop(node, "bootargs", &l);
+ 	if (p != NULL && l > 0)
+ 		strscpy(cmdline, p, min(l, COMMAND_LINE_SIZE));
++	p = of_get_flat_dt_prop(node, "bootargs-append", &l);
++	if (p != NULL && l > 0)
++		strlcat(cmdline, p, min_t(int, strlen(cmdline) + (int)l, COMMAND_LINE_SIZE));
+ 
+ handle_cmdline:
+ 	/*
diff --git a/target/linux/generic/hack-6.1/930-Revert-Revert-Revert-driver-core-Set-fw_devlink-on-b.patch b/target/linux/generic/hack-6.1/930-Revert-Revert-Revert-driver-core-Set-fw_devlink-on-b.patch
new file mode 100644
index 00000000000000..98081c4b64b14c
--- /dev/null
+++ b/target/linux/generic/hack-6.1/930-Revert-Revert-Revert-driver-core-Set-fw_devlink-on-b.patch
@@ -0,0 +1,30 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 19 Jul 2022 06:17:48 +0200
+Subject: [PATCH] Revert "Revert "Revert "driver core: Set fw_devlink=on by
+ default"""
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This reverts commit ea718c699055c8566eb64432388a04974c43b2ea.
+
+With of_platform_populate() called for MTD partitions that commit breaks
+probing devices which reference MTD in device tree.
+
+Link: https://lore.kernel.org/all/696cb2da-20b9-b3dd-46d9-de4bf91a1506@gmail.com/T/#u
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+ drivers/base/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -1700,7 +1700,7 @@ static void device_links_purge(struct de
+ #define FW_DEVLINK_FLAGS_RPM		(FW_DEVLINK_FLAGS_ON | \
+ 					 DL_FLAG_PM_RUNTIME)
+ 
+-static u32 fw_devlink_flags = FW_DEVLINK_FLAGS_ON;
++static u32 fw_devlink_flags = FW_DEVLINK_FLAGS_PERMISSIVE;
+ static int __init fw_devlink_setup(char *arg)
+ {
+ 	if (!arg)
diff --git a/target/linux/generic/pending-5.15/103-kbuild-export-SUBARCH.patch b/target/linux/generic/pending-5.15/103-kbuild-export-SUBARCH.patch
new file mode 100644
index 00000000000000..120b6e4cf897f8
--- /dev/null
+++ b/target/linux/generic/pending-5.15/103-kbuild-export-SUBARCH.patch
@@ -0,0 +1,21 @@
+From 173019b66dcc9d68ad9333aa744dad1e369b5aa8 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 9 Jul 2017 00:26:53 +0200
+Subject: [PATCH 34/34] kernel: add compile fix for linux 4.9 on x86
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/Makefile
++++ b/Makefile
+@@ -534,7 +534,7 @@ KBUILD_LDFLAGS_MODULE :=
+ KBUILD_LDFLAGS :=
+ CLANG_FLAGS :=
+ 
+-export ARCH SRCARCH CONFIG_SHELL BASH HOSTCC KBUILD_HOSTCFLAGS CROSS_COMPILE LD CC HOSTPKG_CONFIG
++export ARCH SRCARCH SUBARCH CONFIG_SHELL BASH HOSTCC KBUILD_HOSTCFLAGS CROSS_COMPILE LD CC HOSTPKG_CONFIG
+ export CPP AR NM STRIP OBJCOPY OBJDUMP READELF PAHOLE RESOLVE_BTFIDS LEX YACC AWK INSTALLKERNEL
+ export PERL PYTHON3 CHECK CHECKFLAGS MAKE UTS_MACHINE HOSTCXX
+ export KGZIP KBZIP2 KLZOP LZMA LZ4 XZ ZSTD
diff --git a/target/linux/generic/pending-5.15/110-v6.3-0001-spidev-Add-Silicon-Labs-EM3581-device-compatible.patch b/target/linux/generic/pending-5.15/110-v6.3-0001-spidev-Add-Silicon-Labs-EM3581-device-compatible.patch
new file mode 100644
index 00000000000000..5216d6a7068e10
--- /dev/null
+++ b/target/linux/generic/pending-5.15/110-v6.3-0001-spidev-Add-Silicon-Labs-EM3581-device-compatible.patch
@@ -0,0 +1,32 @@
+From f7982c726e02001afc19052fe48f642dfcbc00b2 Mon Sep 17 00:00:00 2001
+From: Vincent Tremblay <vincent@vtremblay.dev>
+Date: Mon, 26 Dec 2022 21:10:37 -0500
+Subject: [PATCH 1/2] spidev: Add Silicon Labs EM3581 device compatible
+
+Add compatible string for Silicon Labs EM3581 device.
+
+Note: This patch is adapted from a patch submitted to the for-next branch (v6.3).
+
+Signed-off-by: Vincent Tremblay <vincent@vtremblay.dev>
+---
+ drivers/spi/spidev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -691,6 +691,7 @@ static const struct spi_device_id spidev
+ 	{ .name = "m53cpld" },
+ 	{ .name = "spi-petra" },
+ 	{ .name = "spi-authenta" },
++	{ .name = "em3581" },
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(spi, spidev_spi_ids);
+@@ -705,6 +706,7 @@ static const struct of_device_id spidev_
+ 	{ .compatible = "menlo,m53cpld" },
+ 	{ .compatible = "cisco,spi-petra" },
+ 	{ .compatible = "micron,spi-authenta" },
++	{ .compatible = "silabs,em3581" },
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(of, spidev_dt_ids);
diff --git a/target/linux/generic/pending-5.15/110-v6.3-0002-spidev-Add-Silicon-Labs-SI3210-device-compatible.patch b/target/linux/generic/pending-5.15/110-v6.3-0002-spidev-Add-Silicon-Labs-SI3210-device-compatible.patch
new file mode 100644
index 00000000000000..ffbed0c622bfcf
--- /dev/null
+++ b/target/linux/generic/pending-5.15/110-v6.3-0002-spidev-Add-Silicon-Labs-SI3210-device-compatible.patch
@@ -0,0 +1,32 @@
+From 536581825219e97fa2ae0c4de35605d2f6311416 Mon Sep 17 00:00:00 2001
+From: Vincent Tremblay <vincent@vtremblay.dev>
+Date: Tue, 27 Dec 2022 09:00:58 -0500
+Subject: [PATCH 2/2] spidev: Add Silicon Labs SI3210 device compatible
+
+Add compatible string for Silicon Labs SI3210 device.
+
+Note: This patch is adapted from a patch submitted to the for-next branch (v6.3).
+
+Signed-off-by: Vincent Tremblay <vincent@vtremblay.dev>
+---
+ drivers/spi/spidev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -692,6 +692,7 @@ static const struct spi_device_id spidev
+ 	{ .name = "spi-petra" },
+ 	{ .name = "spi-authenta" },
+ 	{ .name = "em3581" },
++	{ .name = "si3210" },
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(spi, spidev_spi_ids);
+@@ -707,6 +708,7 @@ static const struct of_device_id spidev_
+ 	{ .compatible = "cisco,spi-petra" },
+ 	{ .compatible = "micron,spi-authenta" },
+ 	{ .compatible = "silabs,em3581" },
++	{ .compatible = "silabs,si3210" },
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(of, spidev_dt_ids);
diff --git a/target/linux/generic/pending-5.15/111-watchdog-max63xx_wdt-Add-support-for-specifying-WDI-.patch b/target/linux/generic/pending-5.15/111-watchdog-max63xx_wdt-Add-support-for-specifying-WDI-.patch
new file mode 100644
index 00000000000000..d6b10491f830e5
--- /dev/null
+++ b/target/linux/generic/pending-5.15/111-watchdog-max63xx_wdt-Add-support-for-specifying-WDI-.patch
@@ -0,0 +1,75 @@
+From bd1b9f66d5134e518419f4c4dacf1884c1616983 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
+Date: Thu, 28 Apr 2022 11:13:23 +0200
+Subject: [PATCH] watchdog: max63xx_wdt: Add support for specifying WDI logic
+ via GPIO
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+On some boards is WDI logic of max6370 chip connected via GPIO.
+So extend max63xx_wdt driver to allow specifying WDI logic via GPIO.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+---
+ drivers/watchdog/max63xx_wdt.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/drivers/watchdog/max63xx_wdt.c
++++ b/drivers/watchdog/max63xx_wdt.c
+@@ -27,6 +27,7 @@
+ #include <linux/io.h>
+ #include <linux/slab.h>
+ #include <linux/property.h>
++#include <linux/gpio/consumer.h>
+ 
+ #define DEFAULT_HEARTBEAT 60
+ #define MAX_HEARTBEAT     60
+@@ -53,6 +54,9 @@ struct max63xx_wdt {
+ 	void __iomem *base;
+ 	spinlock_t lock;
+ 
++	/* GPIOs */
++	struct gpio_desc *gpio_wdi;
++
+ 	/* WDI and WSET bits write access routines */
+ 	void (*ping)(struct max63xx_wdt *wdt);
+ 	void (*set)(struct max63xx_wdt *wdt, u8 set);
+@@ -158,6 +162,17 @@ static const struct watchdog_info max63x
+ 	.identity = "max63xx Watchdog",
+ };
+ 
++static void max63xx_gpio_ping(struct max63xx_wdt *wdt)
++{
++	spin_lock(&wdt->lock);
++
++	gpiod_set_value(wdt->gpio_wdi, 1);
++	udelay(1);
++	gpiod_set_value(wdt->gpio_wdi, 0);
++
++	spin_unlock(&wdt->lock);
++}
++
+ static void max63xx_mmap_ping(struct max63xx_wdt *wdt)
+ {
+ 	u8 val;
+@@ -225,10 +240,19 @@ static int max63xx_wdt_probe(struct plat
+ 		return -EINVAL;
+ 	}
+ 
++	wdt->gpio_wdi = devm_gpiod_get(dev, NULL, GPIOD_FLAGS_BIT_DIR_OUT);
++	if (IS_ERR(wdt->gpio_wdi) && PTR_ERR(wdt->gpio_wdi) != -ENOENT)
++		return dev_err_probe(dev, PTR_ERR(wdt->gpio_wdi),
++				     "unable to request gpio: %ld\n",
++				     PTR_ERR(wdt->gpio_wdi));
++
+ 	err = max63xx_mmap_init(pdev, wdt);
+ 	if (err)
+ 		return err;
+ 
++	if (!IS_ERR(wdt->gpio_wdi))
++		wdt->ping = max63xx_gpio_ping;
++
+ 	platform_set_drvdata(pdev, &wdt->wdd);
+ 	watchdog_set_drvdata(&wdt->wdd, wdt);
+ 
diff --git a/target/linux/generic/pending-5.15/120-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch b/target/linux/generic/pending-5.15/120-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch
index b0b399a2dd6c97..ac5e3a69b80c65 100644
--- a/target/linux/generic/pending-5.15/120-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch
+++ b/target/linux/generic/pending-5.15/120-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch
@@ -71,7 +71,7 @@ Signed-off-by: Tobias Wolf <dev-NTEO@vplace.de>
 
 --- a/mm/page_alloc.c
 +++ b/mm/page_alloc.c
-@@ -7557,7 +7557,7 @@ static void __init alloc_node_mem_map(st
+@@ -7620,7 +7620,7 @@ static void __init alloc_node_mem_map(st
  	if (pgdat == NODE_DATA(0)) {
  		mem_map = NODE_DATA(0)->node_mem_map;
  		if (page_to_pfn(mem_map) != pgdat->node_start_pfn)
diff --git a/target/linux/generic/pending-5.15/143-jffs2-reduce-stack-usage-in-jffs2_build_xattr_subsys.patch b/target/linux/generic/pending-5.15/143-jffs2-reduce-stack-usage-in-jffs2_build_xattr_subsys.patch
new file mode 100644
index 00000000000000..e5a86dd29fe174
--- /dev/null
+++ b/target/linux/generic/pending-5.15/143-jffs2-reduce-stack-usage-in-jffs2_build_xattr_subsys.patch
@@ -0,0 +1,121 @@
+From eee53f6eb7561f516b9c4bac829ce31c48096130 Mon Sep 17 00:00:00 2001
+From: Fabian Frederick <fabf@skynet.be>
+Date: Tue, 9 May 2017 22:30:03 +0200
+Subject: [PATCH] jffs2: reduce stack usage in jffs2_build_xattr_subsystem()
+
+Use kcalloc() for allocation/flush of 128 pointers table to
+reduce stack usage.
+
+Function now returns -ENOMEM or 0 on success.
+
+stackusage
+Before:
+./fs/jffs2/xattr.c:775  jffs2_build_xattr_subsystem     1208
+dynamic,bounded
+
+After:
+./fs/jffs2/xattr.c:775  jffs2_build_xattr_subsystem     192
+dynamic,bounded
+
+Also update definition when CONFIG_JFFS2_FS_XATTR is not enabled
+
+Tested with an MTD mount point and some user set/getfattr.
+
+Many current target on OpenWRT also suffer from a compilation warning
+(that become an error with CONFIG_WERROR) with the following output:
+
+fs/jffs2/xattr.c: In function 'jffs2_build_xattr_subsystem':
+fs/jffs2/xattr.c:887:1: error: the frame size of 1088 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
+  887 | }
+      | ^
+
+Using dynamic allocation fix this compilation warning.
+
+Fixes: c9f700f840bd ("[JFFS2][XATTR] using 'delete marker' for xdatum/xref deletion")
+Reported-by: Tim Gardner <tim.gardner@canonical.com>
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Ron Economos <re@w6rz.net>
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Fabian Frederick <fabf@skynet.be>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Cc: stable@vger.kernel.org
+---
+ fs/jffs2/build.c |  5 ++++-
+ fs/jffs2/xattr.c | 13 +++++++++----
+ fs/jffs2/xattr.h |  4 ++--
+ 3 files changed, 15 insertions(+), 7 deletions(-)
+
+--- a/fs/jffs2/build.c
++++ b/fs/jffs2/build.c
+@@ -211,7 +211,10 @@ static int jffs2_build_filesystem(struct
+ 		ic->scan_dents = NULL;
+ 		cond_resched();
+ 	}
+-	jffs2_build_xattr_subsystem(c);
++	ret = jffs2_build_xattr_subsystem(c);
++	if (ret)
++		goto exit;
++
+ 	c->flags &= ~JFFS2_SB_FLAG_BUILDING;
+ 
+ 	dbg_fsbuild("FS build complete\n");
+--- a/fs/jffs2/xattr.c
++++ b/fs/jffs2/xattr.c
+@@ -772,10 +772,10 @@ void jffs2_clear_xattr_subsystem(struct
+ }
+ 
+ #define XREF_TMPHASH_SIZE	(128)
+-void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
++int jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
+ {
+ 	struct jffs2_xattr_ref *ref, *_ref;
+-	struct jffs2_xattr_ref *xref_tmphash[XREF_TMPHASH_SIZE];
++	struct jffs2_xattr_ref **xref_tmphash;
+ 	struct jffs2_xattr_datum *xd, *_xd;
+ 	struct jffs2_inode_cache *ic;
+ 	struct jffs2_raw_node_ref *raw;
+@@ -784,9 +784,12 @@ void jffs2_build_xattr_subsystem(struct
+ 
+ 	BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
+ 
++	xref_tmphash = kcalloc(XREF_TMPHASH_SIZE,
++			       sizeof(struct jffs2_xattr_ref *), GFP_KERNEL);
++	if (!xref_tmphash)
++		return -ENOMEM;
++
+ 	/* Phase.1 : Merge same xref */
+-	for (i=0; i < XREF_TMPHASH_SIZE; i++)
+-		xref_tmphash[i] = NULL;
+ 	for (ref=c->xref_temp; ref; ref=_ref) {
+ 		struct jffs2_xattr_ref *tmp;
+ 
+@@ -884,6 +887,8 @@ void jffs2_build_xattr_subsystem(struct
+ 		     "%u of xref (%u dead, %u orphan) found.\n",
+ 		     xdatum_count, xdatum_unchecked_count, xdatum_orphan_count,
+ 		     xref_count, xref_dead_count, xref_orphan_count);
++	kfree(xref_tmphash);
++	return 0;
+ }
+ 
+ struct jffs2_xattr_datum *jffs2_setup_xattr_datum(struct jffs2_sb_info *c,
+--- a/fs/jffs2/xattr.h
++++ b/fs/jffs2/xattr.h
+@@ -71,7 +71,7 @@ static inline int is_xattr_ref_dead(stru
+ #ifdef CONFIG_JFFS2_FS_XATTR
+ 
+ extern void jffs2_init_xattr_subsystem(struct jffs2_sb_info *c);
+-extern void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c);
++extern int jffs2_build_xattr_subsystem(struct jffs2_sb_info *c);
+ extern void jffs2_clear_xattr_subsystem(struct jffs2_sb_info *c);
+ 
+ extern struct jffs2_xattr_datum *jffs2_setup_xattr_datum(struct jffs2_sb_info *c,
+@@ -103,7 +103,7 @@ extern ssize_t jffs2_listxattr(struct de
+ #else
+ 
+ #define jffs2_init_xattr_subsystem(c)
+-#define jffs2_build_xattr_subsystem(c)
++#define jffs2_build_xattr_subsystem(c)		(0)
+ #define jffs2_clear_xattr_subsystem(c)
+ 
+ #define jffs2_xattr_do_crccheck_inode(c, ic)
diff --git a/target/linux/generic/pending-5.15/160-workqueue-fix-enum-type-for-gcc-13.patch b/target/linux/generic/pending-5.15/160-workqueue-fix-enum-type-for-gcc-13.patch
new file mode 100644
index 00000000000000..82076121ac3c41
--- /dev/null
+++ b/target/linux/generic/pending-5.15/160-workqueue-fix-enum-type-for-gcc-13.patch
@@ -0,0 +1,44 @@
+From 525ff9c2965770762b81d679820552a208070d59 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Tue, 17 Jan 2023 17:40:35 +0100
+Subject: workqueue: fix enum type for gcc-13
+
+In gcc-13, the WORK_STRUCT_WQ_DATA_MASK constant is a signed 64-bit
+type on 32-bit architectures because the enum definition has both
+negative numbers and numbers above LONG_MAX in it:
+
+kernel/workqueue.c: In function 'get_work_pwq':
+kernel/workqueue.c:709:24: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
+  709 |                 return (void *)(data & WORK_STRUCT_WQ_DATA_MASK);
+      |                        ^
+kernel/workqueue.c: In function 'get_work_pool':
+kernel/workqueue.c:737:25: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
+  737 |                 return ((struct pool_workqueue *)
+      |                         ^
+kernel/workqueue.c: In function 'get_work_pool_id':
+kernel/workqueue.c:759:25: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
+  759 |                 return ((struct pool_workqueue *)
+      |                         ^
+
+Change the enum definition to ensure all values can fit into
+the range of 'unsigned long' on all architectures.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Tested-by: Thierry Reding <treding@nvidia.com>
+Tested-by: Lai Jiangshan<jiangshanlai@gmail.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+---
+ include/linux/workqueue.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/workqueue.h
++++ b/include/linux/workqueue.h
+@@ -83,7 +83,7 @@ enum {
+ 
+ 	/* convenience constants */
+ 	WORK_STRUCT_FLAG_MASK	= (1UL << WORK_STRUCT_FLAG_BITS) - 1,
+-	WORK_STRUCT_WQ_DATA_MASK = ~WORK_STRUCT_FLAG_MASK,
++	WORK_STRUCT_WQ_DATA_MASK = (unsigned long)~WORK_STRUCT_FLAG_MASK,
+ 	WORK_STRUCT_NO_POOL	= (unsigned long)WORK_OFFQ_POOL_NONE << WORK_OFFQ_POOL_SHIFT,
+ 
+ 	/* bit mask for work_busy() return values */
diff --git a/target/linux/generic/pending-5.15/203-kallsyms_uncompressed.patch b/target/linux/generic/pending-5.15/203-kallsyms_uncompressed.patch
index b525976fc9635b..e469b7229ce979 100644
--- a/target/linux/generic/pending-5.15/203-kallsyms_uncompressed.patch
+++ b/target/linux/generic/pending-5.15/203-kallsyms_uncompressed.patch
@@ -13,7 +13,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/init/Kconfig
 +++ b/init/Kconfig
-@@ -1443,6 +1443,17 @@ config SYSCTL_ARCH_UNALIGN_ALLOW
+@@ -1447,6 +1447,17 @@ config SYSCTL_ARCH_UNALIGN_ALLOW
  	  the unaligned access emulation.
  	  see arch/parisc/kernel/unaligned.c for reference
  
@@ -33,7 +33,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/kernel/kallsyms.c
 +++ b/kernel/kallsyms.c
-@@ -80,6 +80,11 @@ static unsigned int kallsyms_expand_symb
+@@ -88,6 +88,11 @@ static unsigned int kallsyms_expand_symb
  	 * For every byte on the compressed symbol data, copy the table
  	 * entry for that byte.
  	 */
@@ -45,7 +45,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	while (len) {
  		tptr = &kallsyms_token_table[kallsyms_token_index[*data]];
  		data++;
-@@ -112,6 +117,9 @@ tail:
+@@ -120,6 +125,9 @@ tail:
   */
  static char kallsyms_get_symbol_type(unsigned int off)
  {
@@ -65,7 +65,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static int absolute_percpu;
  static int base_relative;
  
-@@ -486,6 +487,9 @@ static void write_src(void)
+@@ -509,6 +510,9 @@ static void write_src(void)
  
  	free(markers);
  
@@ -75,7 +75,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	output_label("kallsyms_token_table");
  	off = 0;
  	for (i = 0; i < 256; i++) {
-@@ -537,6 +541,9 @@ static unsigned char *find_token(unsigne
+@@ -560,6 +564,9 @@ static unsigned char *find_token(unsigne
  {
  	int i;
  
@@ -85,7 +85,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	for (i = 0; i < len - 1; i++) {
  		if (str[i] == token[0] && str[i+1] == token[1])
  			return &str[i];
-@@ -609,6 +616,9 @@ static void optimize_result(void)
+@@ -632,6 +639,9 @@ static void optimize_result(void)
  {
  	int i, best;
  
@@ -95,7 +95,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	/* using the '\0' symbol last allows compress_symbols to use standard
  	 * fast string functions */
  	for (i = 255; i >= 0; i--) {
-@@ -773,6 +783,8 @@ int main(int argc, char **argv)
+@@ -796,6 +806,8 @@ int main(int argc, char **argv)
  				absolute_percpu = 1;
  			else if (strcmp(argv[i], "--base-relative") == 0)
  				base_relative = 1;
diff --git a/target/linux/generic/pending-5.15/301-MIPS-Add-barriers-between-dcache-icache-flushes.patch b/target/linux/generic/pending-5.15/301-MIPS-Add-barriers-between-dcache-icache-flushes.patch
new file mode 100644
index 00000000000000..726c884027f1d1
--- /dev/null
+++ b/target/linux/generic/pending-5.15/301-MIPS-Add-barriers-between-dcache-icache-flushes.patch
@@ -0,0 +1,71 @@
+From e6e6ef4275978823ec3a84133fc91f4ffbef5c84 Mon Sep 17 00:00:00 2001
+From: Paul Burton <paul.burton@imgtec.com>
+Date: Mon, 22 Feb 2016 18:09:44 +0000
+Subject: [PATCH] MIPS: Add barriers between dcache & icache flushes
+
+Index-based cache operations may be arbitrarily reordered by out of
+order CPUs. Thus code which writes back the dcache & then invalidates
+the icache using indexed cache ops must include a barrier between
+operating on the 2 caches in order to prevent the scenario in which:
+
+  - icache invalidation occurs.
+
+  - icache fetch occurs, due to speculation.
+
+  - dcache writeback occurs.
+
+If the above were allowed to happen then the icache would contain stale
+data. Forcing the dcache writeback to complete before the icache
+invalidation avoids this.
+
+Signed-off-by: Paul Burton <paul.burton@imgtec.com>
+Cc: James Hogan <james.hogan@imgtec.com>
+---
+ arch/mips/mm/c-r4k.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -515,6 +515,7 @@ static inline void local_r4k___flush_cac
+ 
+ 	default:
+ 		r4k_blast_dcache();
++		mb(); /* cache instructions may be reordered */
+ 		r4k_blast_icache();
+ 		break;
+ 	}
+@@ -595,8 +596,10 @@ static inline void local_r4k_flush_cache
+ 	if (cpu_has_dc_aliases || (exec && !cpu_has_ic_fills_f_dc))
+ 		r4k_blast_dcache();
+ 	/* If executable, blast stale lines from icache */
+-	if (exec)
++	if (exec) {
++		mb(); /* cache instructions may be reordered */
+ 		r4k_blast_icache();
++	}
+ }
+ 
+ static void r4k_flush_cache_range(struct vm_area_struct *vma,
+@@ -697,8 +700,13 @@ static inline void local_r4k_flush_cache
+ 	if (cpu_has_dc_aliases || (exec && !cpu_has_ic_fills_f_dc)) {
+ 		vaddr ? r4k_blast_dcache_page(addr) :
+ 			r4k_blast_dcache_user_page(addr);
+-		if (exec && !cpu_icache_snoops_remote_store)
++		if (exec)
++			mb(); /* cache instructions may be reordered */
++
++		if (exec && !cpu_icache_snoops_remote_store) {
+ 			r4k_blast_scache_page(addr);
++			mb(); /* cache instructions may be reordered */
++		}
+ 	}
+ 	if (exec) {
+ 		if (vaddr && cpu_has_vtag_icache && mm == current->active_mm) {
+@@ -765,6 +773,7 @@ static inline void __local_r4k_flush_ica
+ 			else
+ 				blast_dcache_range(start, end);
+ 		}
++		mb(); /* cache instructions may be reordered */
+ 	}
+ 
+ 	if (type == R4K_INDEX ||
diff --git a/target/linux/generic/pending-5.15/330-MIPS-kexec-Accept-command-line-parameters-from-users.patch b/target/linux/generic/pending-5.15/330-MIPS-kexec-Accept-command-line-parameters-from-users.patch
index 3a5f5a238df6d8..3f553b28b34be7 100644
--- a/target/linux/generic/pending-5.15/330-MIPS-kexec-Accept-command-line-parameters-from-users.patch
+++ b/target/linux/generic/pending-5.15/330-MIPS-kexec-Accept-command-line-parameters-from-users.patch
@@ -260,7 +260,7 @@ Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
  
  #ifdef CONFIG_SMP
  /*
-@@ -181,9 +182,15 @@ kexec_indirection_page:
+@@ -177,8 +178,15 @@ EXPORT(kexec_indirection_page)
  	PTR_WD		0
  	.size		kexec_indirection_page, PTRSIZE
  
@@ -275,8 +275,7 @@ Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
 +	.skip		KEXEC_ARGV_SIZE
 +	.size		kexec_argv, KEXEC_ARGV_SIZE
  
--relocate_new_kernel_size:
--	EXPORT(relocate_new_kernel_size)
+-EXPORT(relocate_new_kernel_size)
 -	PTR_WD		relocate_new_kernel_end - relocate_new_kernel
 -	.size		relocate_new_kernel_size, PTRSIZE
 +kexec_relocate_new_kernel_end:
diff --git a/target/linux/generic/pending-5.15/351-irqchip-bcm-6345-l1-request-memory-region.patch b/target/linux/generic/pending-5.15/351-irqchip-bcm-6345-l1-request-memory-region.patch
new file mode 100644
index 00000000000000..9fad4f62c61696
--- /dev/null
+++ b/target/linux/generic/pending-5.15/351-irqchip-bcm-6345-l1-request-memory-region.patch
@@ -0,0 +1,113 @@
+From patchwork Thu Mar 16 19:28:33 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=
+ <noltari@gmail.com>
+X-Patchwork-Id: 13178238
+Return-Path: <linux-mips-owner@vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id 5EF2AC6FD19
+	for <linux-mips@archiver.kernel.org>; Thu, 16 Mar 2023 19:28:43 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S230076AbjCPT2l (ORCPT <rfc822;linux-mips@archiver.kernel.org>);
+        Thu, 16 Mar 2023 15:28:41 -0400
+Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56412 "EHLO
+        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S230039AbjCPT2k (ORCPT
+        <rfc822;linux-mips@vger.kernel.org>); Thu, 16 Mar 2023 15:28:40 -0400
+Received: from mail-wr1-x42f.google.com (mail-wr1-x42f.google.com
+ [IPv6:2a00:1450:4864:20::42f])
+        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7259B7D9F;
+        Thu, 16 Mar 2023 12:28:38 -0700 (PDT)
+Received: by mail-wr1-x42f.google.com with SMTP id y14so2539231wrq.4;
+        Thu, 16 Mar 2023 12:28:38 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20210112; t=1678994917;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:from:to:cc:subject:date
+         :message-id:reply-to;
+        bh=j8afldfRZftLeVmekmQfoh01jVdumsVP7nkKoPaU3Q0=;
+        b=FzMRr5ekh/fDiJqTlezNj6nLjzvn5z92FtYeB8MquVSMB8PuvarccnyqAzsXiccf+v
+         uwRFIomnTWNLGVjzc1xrB2hGiCKD3jBo5n1u8p/yEV6rpolbxVjfM7eTHXyAHXGXz7ZJ
+         TPeVbWfAlxiSD6+BPtXr/efehcdI64fIoL6G/U1WHNMo01Tzr/Obf3y5tug17N0fGcXg
+         CH6E5a2HguZUtwrm26LcK9IOV/7xEx5eIE1cOvTLMxPbGWaZwEjjP16HylJr06xRLhaf
+         RpiYBT3mXwwuOx0jLOhqavY/2kZ9GVbZRWMMwZrZv9xNO13SBwc1VUVgD4k3FntnSk7Z
+         AaOQ==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20210112; t=1678994917;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
+         :subject:date:message-id:reply-to;
+        bh=j8afldfRZftLeVmekmQfoh01jVdumsVP7nkKoPaU3Q0=;
+        b=OaA5DMgqalrfqO5iOtmmxFPsH90MkN7l4EJpyVnzuiO1Wd6rSCpqPOR7xpxZno8OPP
+         tdfm4vzn9Ie4AUDbFKDTUlPG+tgkmIruo3K9C0VnY9DD2PRZMEYBbWaJKU1otqKt0NKu
+         IAAHNvxvQvCESKzbXFLYwWbRKFScOSMGmGBTDfgThz51A18Ff1hJy/BmnuZk7M2TLgHO
+         wQpy9t7oeB/Hkxl41y46emLc/nESsvwvAG/fx/zPzCe9UiaQLrdZq+BKeOwSBedktzK5
+         U/ZTfgzU2UGSI67aGRqqGnI0uXq+MAJMK18qzM0VByxj6W+AXJ6BJr5P0quljeQ8upSg
+         bEUg==
+X-Gm-Message-State: AO0yUKWnqTlccBDnqwCSRdqOBGc2FyfiLy1Tg7EjPENlISpzXuDYwW/R
+        lJSI06rrfq+Vel/SigfpGJI=
+X-Google-Smtp-Source: 
+ AK7set/jYfYl9ttVzIXJO+ZQVfa6cE/yOsP8fx4teiTmGNNWyVlIJRzMAlF3IUGqRAXAmY3hAabIuQ==
+X-Received: by 2002:a5d:40ce:0:b0:2cd:ceab:df1a with SMTP id
+ b14-20020a5d40ce000000b002cdceabdf1amr381006wrq.32.1678994916642;
+        Thu, 16 Mar 2023 12:28:36 -0700 (PDT)
+Received: from atlantis.lan (255.red-79-146-124.dynamicip.rima-tde.net.
+ [79.146.124.255])
+        by smtp.gmail.com with ESMTPSA id
+ l10-20020a5d4bca000000b002cfea3c49d5sm180041wrt.52.2023.03.16.12.28.35
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Thu, 16 Mar 2023 12:28:35 -0700 (PDT)
+From: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+To: f.fainelli@gmail.com, jonas.gorski@gmail.com,
+        bcm-kernel-feedback-list@broadcom.com, tglx@linutronix.de,
+        maz@kernel.org, linux-mips@vger.kernel.org,
+        linux-kernel@vger.kernel.org
+Cc: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+Subject: [PATCH v2] irqchip/bcm-6345-l1: request memory region
+Date: Thu, 16 Mar 2023 20:28:33 +0100
+Message-Id: <20230316192833.1603149-1-noltari@gmail.com>
+X-Mailer: git-send-email 2.30.2
+In-Reply-To: <20230316180701.783785-1-noltari@gmail.com>
+References: <20230316180701.783785-1-noltari@gmail.com>
+MIME-Version: 1.0
+Precedence: bulk
+List-ID: <linux-mips.vger.kernel.org>
+X-Mailing-List: linux-mips@vger.kernel.org
+
+Request memory region in order to display it in /proc/iomem.
+Also stop printing the MMIO address since it just displays (ptrval).
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ v2: request memory region and stop displaying MMIO address.
+
+ drivers/irqchip/irq-bcm6345-l1.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/irqchip/irq-bcm6345-l1.c
++++ b/drivers/irqchip/irq-bcm6345-l1.c
+@@ -261,6 +261,9 @@ static int __init bcm6345_l1_init_one(st
+ 	if (!cpu->map_base)
+ 		return -ENOMEM;
+ 
++	if (!request_mem_region(res.start, sz, res.name))
++		pr_err("failed to request intc memory");
++
+ 	for (i = 0; i < n_words; i++) {
+ 		cpu->enable_cache[i] = 0;
+ 		__raw_writel(0, cpu->map_base + reg_enable(intc, i));
+@@ -339,8 +342,7 @@ static int __init bcm6345_l1_of_init(str
+ 	for_each_cpu(idx, &intc->cpumask) {
+ 		struct bcm6345_l1_cpu *cpu = intc->cpus[idx];
+ 
+-		pr_info("  CPU%u at MMIO 0x%p (irq = %d)\n", idx,
+-				cpu->map_base, cpu->parent_irq);
++		pr_info("  CPU%u (irq = %d)\n", idx, cpu->parent_irq);
+ 	}
+ 
+ 	return 0;
diff --git a/target/linux/generic/pending-5.15/400-mtd-mtdsplit-support.patch b/target/linux/generic/pending-5.15/400-mtd-mtdsplit-support.patch
index d07afd70ee00b1..46ef15d127dfb6 100644
--- a/target/linux/generic/pending-5.15/400-mtd-mtdsplit-support.patch
+++ b/target/linux/generic/pending-5.15/400-mtd-mtdsplit-support.patch
@@ -66,7 +66,7 @@ Subject: [PATCH] mtd: mtdsplit support
  
  /*
   * MTD methods which simply translate the effective address and pass through
-@@ -236,6 +238,146 @@ static int mtd_add_partition_attrs(struc
+@@ -236,6 +238,147 @@ static int mtd_add_partition_attrs(struc
  	return ret;
  }
  
@@ -198,7 +198,8 @@ Subject: [PATCH] mtd: mtdsplit support
 +	if (rootfs_found)
 +		return;
 +
-+	if (!strcmp(part->name, "rootfs")) {
++	if (of_find_property(mtd_get_of_node(part), "linux,rootfs", NULL) ||
++	    !strcmp(part->name, "rootfs")) {
 +		run_parsers_by_type(part, MTD_PARSER_TYPE_ROOTFS);
 +
 +		rootfs_found = 1;
@@ -213,7 +214,7 @@ Subject: [PATCH] mtd: mtdsplit support
  int mtd_add_partition(struct mtd_info *parent, const char *name,
  		      long long offset, long long length)
  {
-@@ -274,6 +416,7 @@ int mtd_add_partition(struct mtd_info *p
+@@ -274,6 +417,7 @@ int mtd_add_partition(struct mtd_info *p
  	if (ret)
  		goto err_remove_part;
  
@@ -221,7 +222,7 @@ Subject: [PATCH] mtd: mtdsplit support
  	mtd_add_partition_attrs(child);
  
  	return 0;
-@@ -422,6 +565,7 @@ int add_mtd_partitions(struct mtd_info *
+@@ -422,6 +566,7 @@ int add_mtd_partitions(struct mtd_info *
  			goto err_del_partitions;
  		}
  
@@ -229,7 +230,7 @@ Subject: [PATCH] mtd: mtdsplit support
  		mtd_add_partition_attrs(child);
  
  		/* Look for subpartitions */
-@@ -438,31 +582,6 @@ err_del_partitions:
+@@ -438,31 +583,6 @@ err_del_partitions:
  	return ret;
  }
  
@@ -263,7 +264,7 @@ Subject: [PATCH] mtd: mtdsplit support
   * one chunk. Do that by default.
 --- a/include/linux/mtd/mtd.h
 +++ b/include/linux/mtd/mtd.h
-@@ -613,6 +613,24 @@ static inline void mtd_align_erase_req(s
+@@ -620,6 +620,24 @@ static inline void mtd_align_erase_req(s
  		req->len += mtd->erasesize - mod;
  }
  
@@ -288,7 +289,7 @@ Subject: [PATCH] mtd: mtdsplit support
  static inline uint32_t mtd_div_by_ws(uint64_t sz, struct mtd_info *mtd)
  {
  	if (mtd->writesize_shift)
-@@ -686,6 +704,13 @@ extern struct mtd_info *of_get_mtd_devic
+@@ -693,6 +711,13 @@ extern struct mtd_info *of_get_mtd_devic
  extern struct mtd_info *get_mtd_device_nm(const char *name);
  extern void put_mtd_device(struct mtd_info *mtd);
  
diff --git a/target/linux/generic/pending-5.15/402-mtd-spi-nor-write-support-for-minor-aligned-partitions.patch b/target/linux/generic/pending-5.15/402-mtd-spi-nor-write-support-for-minor-aligned-partitions.patch
index ed9d1c9dc13865..d12bc9c3d59b6c 100644
--- a/target/linux/generic/pending-5.15/402-mtd-spi-nor-write-support-for-minor-aligned-partitions.patch
+++ b/target/linux/generic/pending-5.15/402-mtd-spi-nor-write-support-for-minor-aligned-partitions.patch
@@ -80,7 +80,7 @@ Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
 
 --- a/drivers/mtd/mtdcore.c
 +++ b/drivers/mtd/mtdcore.c
-@@ -168,6 +168,15 @@ static ssize_t mtd_erasesize_show(struct
+@@ -169,6 +169,15 @@ static ssize_t mtd_erasesize_show(struct
  }
  MTD_DEVICE_ATTR_RO(erasesize);
  
@@ -96,7 +96,7 @@ Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
  static ssize_t mtd_writesize_show(struct device *dev,
  		struct device_attribute *attr, char *buf)
  {
-@@ -313,6 +322,7 @@ static struct attribute *mtd_attrs[] = {
+@@ -314,6 +323,7 @@ static struct attribute *mtd_attrs[] = {
  	&dev_attr_flags.attr,
  	&dev_attr_size.attr,
  	&dev_attr_erasesize.attr,
@@ -202,7 +202,7 @@ Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
  	return !!nor->params->erase_map.uniform_erase_type;
  }
  
-@@ -2388,6 +2390,7 @@ static int spi_nor_select_erase(struct s
+@@ -2400,6 +2402,7 @@ static int spi_nor_select_erase(struct s
  {
  	struct spi_nor_erase_map *map = &nor->params->erase_map;
  	const struct spi_nor_erase_type *erase = NULL;
@@ -210,7 +210,7 @@ Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
  	struct mtd_info *mtd = &nor->mtd;
  	u32 wanted_size = nor->info->sector_size;
  	int i;
-@@ -2420,8 +2423,9 @@ static int spi_nor_select_erase(struct s
+@@ -2432,8 +2435,9 @@ static int spi_nor_select_erase(struct s
  	 */
  	for (i = SNOR_ERASE_TYPE_MAX - 1; i >= 0; i--) {
  		if (map->erase_type[i].size) {
@@ -222,7 +222,7 @@ Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
  		}
  	}
  
-@@ -2429,6 +2433,9 @@ static int spi_nor_select_erase(struct s
+@@ -2441,6 +2445,9 @@ static int spi_nor_select_erase(struct s
  		return -EINVAL;
  
  	mtd->erasesize = erase->size;
@@ -234,7 +234,7 @@ Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
  
 --- a/include/linux/mtd/mtd.h
 +++ b/include/linux/mtd/mtd.h
-@@ -243,6 +243,8 @@ struct mtd_info {
+@@ -250,6 +250,8 @@ struct mtd_info {
  	 * information below if they desire
  	 */
  	uint32_t erasesize;
diff --git a/target/linux/generic/pending-5.15/435-mtd-add-routerbootpart-parser-config.patch b/target/linux/generic/pending-5.15/435-mtd-add-routerbootpart-parser-config.patch
index 30f5334af40b75..ee949f73c095f9 100644
--- a/target/linux/generic/pending-5.15/435-mtd-add-routerbootpart-parser-config.patch
+++ b/target/linux/generic/pending-5.15/435-mtd-add-routerbootpart-parser-config.patch
@@ -16,7 +16,7 @@ Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
 
 --- a/drivers/mtd/parsers/Kconfig
 +++ b/drivers/mtd/parsers/Kconfig
-@@ -211,3 +211,12 @@ config MTD_SERCOMM_PARTS
+@@ -226,3 +226,12 @@ config MTD_SERCOMM_PARTS
  	  partition map. This partition table contains real partition
  	  offsets, which may differ from device to device depending on the
  	  number and location of bad blocks on NAND.
@@ -31,7 +31,7 @@ Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
 +	 formatted DTS.
 --- a/drivers/mtd/parsers/Makefile
 +++ b/drivers/mtd/parsers/Makefile
-@@ -15,3 +15,4 @@ obj-$(CONFIG_MTD_SERCOMM_PARTS)		+= scpa
+@@ -16,3 +16,4 @@ obj-$(CONFIG_MTD_SERCOMM_PARTS)		+= scpa
  obj-$(CONFIG_MTD_SHARPSL_PARTS)		+= sharpslpart.o
  obj-$(CONFIG_MTD_REDBOOT_PARTS)		+= redboot.o
  obj-$(CONFIG_MTD_QCOMSMEM_PARTS)	+= qcomsmempart.o
diff --git a/target/linux/generic/pending-5.15/476-mtd-spi-nor-add-eon-en25q128.patch b/target/linux/generic/pending-5.15/476-mtd-spi-nor-add-eon-en25q128.patch
index 325fca62f3edc9..9383e48856d91f 100644
--- a/target/linux/generic/pending-5.15/476-mtd-spi-nor-add-eon-en25q128.patch
+++ b/target/linux/generic/pending-5.15/476-mtd-spi-nor-add-eon-en25q128.patch
@@ -8,7 +8,7 @@ Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
 
 --- a/drivers/mtd/spi-nor/eon.c
 +++ b/drivers/mtd/spi-nor/eon.c
-@@ -15,6 +15,7 @@ static const struct flash_info eon_parts
+@@ -25,6 +25,7 @@ static const struct flash_info eon_parts
  	{ "en25q32b",   INFO(0x1c3016, 0, 64 * 1024,   64, 0) },
  	{ "en25p64",    INFO(0x1c2017, 0, 64 * 1024,  128, 0) },
  	{ "en25q64",    INFO(0x1c3017, 0, 64 * 1024,  128, SECT_4K) },
diff --git a/target/linux/generic/pending-5.15/477-mtd-spi-nor-add-eon-en25qx128a.patch b/target/linux/generic/pending-5.15/477-mtd-spi-nor-add-eon-en25qx128a.patch
new file mode 100644
index 00000000000000..3c579e55e34c4d
--- /dev/null
+++ b/target/linux/generic/pending-5.15/477-mtd-spi-nor-add-eon-en25qx128a.patch
@@ -0,0 +1,21 @@
+From: Christian Marangi <ansuelsmth@gmail.com>
+Subject: kernel/mtd: add support for EON EN25QX128A
+
+Add support for EON EN25QX128A with no flags as it does
+support SFDP parsing.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/mtd/spi-nor/spi-nor.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mtd/spi-nor/eon.c
++++ b/drivers/mtd/spi-nor/eon.c
+@@ -26,6 +26,7 @@ static const struct flash_info eon_parts
+ 	{ "en25p64",    INFO(0x1c2017, 0, 64 * 1024,  128, 0) },
+ 	{ "en25q64",    INFO(0x1c3017, 0, 64 * 1024,  128, SECT_4K) },
+ 	{ "en25q128",   INFO(0x1c3018, 0, 64 * 1024,  256, SECT_4K) },
++	{ "en25qx128a", INFO(0x1c7118, 0, 64 * 1024, 256, 0) },
+ 	{ "en25q80a",   INFO(0x1c3014, 0, 64 * 1024,   16,
+ 			     SECT_4K | SPI_NOR_DUAL_READ) },
+ 	{ "en25qh16",   INFO(0x1c7015, 0, 64 * 1024,   32,
diff --git a/target/linux/generic/pending-5.15/479-mtd-spi-nor-add-xtx-xt25f128b.patch b/target/linux/generic/pending-5.15/479-mtd-spi-nor-add-xtx-xt25f128b.patch
index 58a336a4bd1c3a..5a064b714bfdcd 100644
--- a/target/linux/generic/pending-5.15/479-mtd-spi-nor-add-xtx-xt25f128b.patch
+++ b/target/linux/generic/pending-5.15/479-mtd-spi-nor-add-xtx-xt25f128b.patch
@@ -59,7 +59,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +};
 --- a/drivers/mtd/spi-nor/core.c
 +++ b/drivers/mtd/spi-nor/core.c
-@@ -1857,6 +1857,7 @@ static const struct spi_nor_manufacturer
+@@ -1859,6 +1859,7 @@ static const struct spi_nor_manufacturer
  	&spi_nor_winbond,
  	&spi_nor_xilinx,
  	&spi_nor_xmc,
diff --git a/target/linux/generic/pending-5.15/486-01-mtd-spinand-add-support-for-ESMT-F50x1G41LB.patch b/target/linux/generic/pending-5.15/486-01-mtd-spinand-add-support-for-ESMT-F50x1G41LB.patch
index c170fedc67ba72..d117cfe0a3a9cd 100644
--- a/target/linux/generic/pending-5.15/486-01-mtd-spinand-add-support-for-ESMT-F50x1G41LB.patch
+++ b/target/linux/generic/pending-5.15/486-01-mtd-spinand-add-support-for-ESMT-F50x1G41LB.patch
@@ -31,7 +31,7 @@ Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
  obj-$(CONFIG_MTD_SPI_NAND) += spinand.o
 --- a/drivers/mtd/nand/spi/core.c
 +++ b/drivers/mtd/nand/spi/core.c
-@@ -896,6 +896,7 @@ static const struct nand_ops spinand_ops
+@@ -906,6 +906,7 @@ static const struct nand_ops spinand_ops
  };
  
  static const struct spinand_manufacturer *spinand_manufacturers[] = {
diff --git a/target/linux/generic/pending-5.15/487-mtd-spinand-Add-support-for-Etron-EM73D044VCx.patch b/target/linux/generic/pending-5.15/487-mtd-spinand-Add-support-for-Etron-EM73D044VCx.patch
index c32e15d0c642d7..7e20e14bb620ef 100644
--- a/target/linux/generic/pending-5.15/487-mtd-spinand-Add-support-for-Etron-EM73D044VCx.patch
+++ b/target/linux/generic/pending-5.15/487-mtd-spinand-Add-support-for-Etron-EM73D044VCx.patch
@@ -1,3 +1,43 @@
+From f32085fc0b87049491b07e198d924d738a1a2834 Mon Sep 17 00:00:00 2001
+From: Daniel Danzberger <daniel@dd-wrt.com>
+Date: Wed, 3 Aug 2022 17:31:03 +0200
+Subject: [PATCH] mtd: spinand: Add support for Etron EM73D044VCx
+
+Airoha is a new ARM platform based on Cortex-A53 which has recently been
+merged into linux-next.
+
+Due to BootROM limitations on this platform, the Cortex-A53 can't run in
+Aarch64 mode and code must be compiled for 32-Bit ARM.
+
+This support is based mostly on those linux-next commits backported
+for kernel 5.15.
+
+Patches:
+1 - platform support = linux-next
+2 - clock driver = linux-next
+3 - gpio driver = linux-next
+4 - linux,usable-memory-range dts support = linux-next
+5 - mtd spinand driver
+6 - spi driver
+7 - pci driver (kconfig only, uses mediatek PCI) = linux-next
+
+Still missing:
+- Ethernet driver
+- Sysupgrade support
+
+A.t.m there exists one subtarget EN7523 with only one evaluation
+board.
+
+The initramfs can be run with the following commands from u-boot:
+-
+u-boot> setenv bootfile \
+	openwrt-airoha-airoha_en7523-evb-initramfs-kernel.bin
+u-boot> tftpboot
+u-boot> bootm 0x81800000
+-
+
+Submitted-by: Daniel Danzberger <daniel@dd-wrt.com>
+
 --- a/drivers/mtd/nand/spi/Makefile
 +++ b/drivers/mtd/nand/spi/Makefile
 @@ -1,3 +1,3 @@
@@ -7,7 +47,7 @@
  obj-$(CONFIG_MTD_SPI_NAND) += spinand.o
 --- a/drivers/mtd/nand/spi/core.c
 +++ b/drivers/mtd/nand/spi/core.c
-@@ -898,6 +898,7 @@ static const struct nand_ops spinand_ops
+@@ -908,6 +908,7 @@ static const struct nand_ops spinand_ops
  static const struct spinand_manufacturer *spinand_manufacturers[] = {
  	&esmt_c8_spinand_manufacturer,
  	&gigadevice_spinand_manufacturer,
diff --git a/target/linux/generic/pending-5.15/488-mtd-spi-nor-add-xmc-xm25qh64c.patch b/target/linux/generic/pending-5.15/488-mtd-spi-nor-add-xmc-xm25qh64c.patch
new file mode 100644
index 00000000000000..236d1c2755fee2
--- /dev/null
+++ b/target/linux/generic/pending-5.15/488-mtd-spi-nor-add-xmc-xm25qh64c.patch
@@ -0,0 +1,22 @@
+From: Joe Mullally <jwmullally@gmail.com>
+Subject: mtd/spi-nor/xmc: add support for XMC XM25QH64C
+
+The XMC XM25QH64C is a 8MB SPI NOR chip. The patch is verified on TL-WPA8631P v3.
+Datasheet available at https://www.xmcwh.com/uploads/442/XM25QH64C.pdf
+
+Signed-off-by: Joe Mullally <jwmullally@gmail.com>
+---
+ drivers/mtd/spi-nor/xmc.c                             | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/mtd/spi-nor/xmc.c
++++ b/drivers/mtd/spi-nor/xmc.c
+@@ -12,6 +12,8 @@ static const struct flash_info xmc_parts
+ 	/* XMC (Wuhan Xinxin Semiconductor Manufacturing Corp.) */
+ 	{ "XM25QH64A", INFO(0x207017, 0, 64 * 1024, 128,
+ 			    SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) },
++	{ "XM25QH64C", INFO(0x204017, 0, 64 * 1024, 128,
++			    SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) },
+ 	{ "XM25QH128A", INFO(0x207018, 0, 64 * 1024, 256,
+ 			     SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) },
+ 	{ "XM25QH128C", INFO(0x204018, 0, 64 * 1024, 256,
diff --git a/target/linux/generic/pending-5.15/490-ubi-auto-attach-mtd-device-named-ubi-or-data-on-boot.patch b/target/linux/generic/pending-5.15/490-ubi-auto-attach-mtd-device-named-ubi-or-data-on-boot.patch
index b120548d2e77f9..2751da541a0542 100644
--- a/target/linux/generic/pending-5.15/490-ubi-auto-attach-mtd-device-named-ubi-or-data-on-boot.patch
+++ b/target/linux/generic/pending-5.15/490-ubi-auto-attach-mtd-device-named-ubi-or-data-on-boot.patch
@@ -8,7 +8,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 
 --- a/drivers/mtd/ubi/build.c
 +++ b/drivers/mtd/ubi/build.c
-@@ -1184,6 +1184,73 @@ static struct mtd_info * __init open_mtd
+@@ -1200,6 +1200,73 @@ static struct mtd_info * __init open_mtd
  	return mtd;
  }
  
@@ -82,7 +82,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  static int __init ubi_init(void)
  {
  	int err, i, k;
-@@ -1267,6 +1334,12 @@ static int __init ubi_init(void)
+@@ -1283,6 +1350,12 @@ static int __init ubi_init(void)
  		}
  	}
  
diff --git a/target/linux/generic/pending-5.15/530-jffs2_make_lzma_available.patch b/target/linux/generic/pending-5.15/530-jffs2_make_lzma_available.patch
index fd6ca784c0f9e3..ac784d0b0bb73d 100644
--- a/target/linux/generic/pending-5.15/530-jffs2_make_lzma_available.patch
+++ b/target/linux/generic/pending-5.15/530-jffs2_make_lzma_available.patch
@@ -356,7 +356,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +#endif
 --- /dev/null
 +++ b/include/linux/lzma/LzFind.h
-@@ -0,0 +1,115 @@
+@@ -0,0 +1,98 @@
 +/* LzFind.h -- Match finder for LZ algorithms
 +2009-04-22 : Igor Pavlov : Public domain */
 +
@@ -414,11 +414,6 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +
 +#define Inline_MatchFinder_GetNumAvailableBytes(p) ((p)->streamPos - (p)->pos)
 +
-+int MatchFinder_NeedMove(CMatchFinder *p);
-+Byte *MatchFinder_GetPointerToCurrentPos(CMatchFinder *p);
-+void MatchFinder_MoveBlock(CMatchFinder *p);
-+void MatchFinder_ReadIfRequired(CMatchFinder *p);
-+
 +void MatchFinder_Construct(CMatchFinder *p);
 +
 +/* Conditions:
@@ -429,12 +424,6 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +    UInt32 keepAddBufferBefore, UInt32 matchMaxLen, UInt32 keepAddBufferAfter,
 +    ISzAlloc *alloc);
 +void MatchFinder_Free(CMatchFinder *p, ISzAlloc *alloc);
-+void MatchFinder_Normalize3(UInt32 subValue, CLzRef *items, UInt32 numItems);
-+void MatchFinder_ReduceOffsets(CMatchFinder *p, UInt32 subValue);
-+
-+UInt32 * GetMatchesSpec1(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *buffer, CLzRef *son,
-+    UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 _cutValue,
-+    UInt32 *distances, UInt32 maxLen);
 +
 +/*
 +Conditions:
@@ -461,12 +450,6 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +
 +void MatchFinder_CreateVTable(CMatchFinder *p, IMatchFinder *vTable);
 +
-+void MatchFinder_Init(CMatchFinder *p);
-+UInt32 Bt3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances);
-+UInt32 Hc3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances);
-+void Bt3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num);
-+void Hc3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num);
-+
 +#ifdef __cplusplus
 +}
 +#endif
@@ -531,7 +514,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +#endif
 --- /dev/null
 +++ b/include/linux/lzma/LzmaDec.h
-@@ -0,0 +1,231 @@
+@@ -0,0 +1,130 @@
 +/* LzmaDec.h -- LZMA Decoder
 +2009-02-07 : Igor Pavlov : Public domain */
 +
@@ -565,14 +548,6 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  UInt32 dicSize;
 +} CLzmaProps;
 +
-+/* LzmaProps_Decode - decodes properties
-+Returns:
-+  SZ_OK
-+  SZ_ERROR_UNSUPPORTED - Unsupported properties
-+*/
-+
-+SRes LzmaProps_Decode(CLzmaProps *p, const Byte *data, unsigned size);
-+
 +
 +/* ---------- LZMA Decoder state ---------- */
 +
@@ -604,8 +579,6 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +
 +#define LzmaDec_Construct(p) { (p)->dic = 0; (p)->probs = 0; }
 +
-+void LzmaDec_Init(CLzmaDec *p);
-+
 +/* There are two types of LZMA streams:
 +     0) Stream with end mark. That end mark adds about 6 bytes to compressed size.
 +     1) Stream without end mark. You must know exact uncompressed size to decompress such stream. */
@@ -642,97 +615,6 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +
 +/* ELzmaStatus is used only as output value for function call */
 +
-+
-+/* ---------- Interfaces ---------- */
-+
-+/* There are 3 levels of interfaces:
-+     1) Dictionary Interface
-+     2) Buffer Interface
-+     3) One Call Interface
-+   You can select any of these interfaces, but don't mix functions from different
-+   groups for same object. */
-+
-+
-+/* There are two variants to allocate state for Dictionary Interface:
-+     1) LzmaDec_Allocate / LzmaDec_Free
-+     2) LzmaDec_AllocateProbs / LzmaDec_FreeProbs
-+   You can use variant 2, if you set dictionary buffer manually.
-+   For Buffer Interface you must always use variant 1.
-+
-+LzmaDec_Allocate* can return:
-+  SZ_OK
-+  SZ_ERROR_MEM         - Memory allocation error
-+  SZ_ERROR_UNSUPPORTED - Unsupported properties
-+*/
-+
-+SRes LzmaDec_AllocateProbs(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc);
-+void LzmaDec_FreeProbs(CLzmaDec *p, ISzAlloc *alloc);
-+
-+SRes LzmaDec_Allocate(CLzmaDec *state, const Byte *prop, unsigned propsSize, ISzAlloc *alloc);
-+void LzmaDec_Free(CLzmaDec *state, ISzAlloc *alloc);
-+
-+/* ---------- Dictionary Interface ---------- */
-+
-+/* You can use it, if you want to eliminate the overhead for data copying from
-+   dictionary to some other external buffer.
-+   You must work with CLzmaDec variables directly in this interface.
-+
-+   STEPS:
-+     LzmaDec_Constr()
-+     LzmaDec_Allocate()
-+     for (each new stream)
-+     {
-+       LzmaDec_Init()
-+       while (it needs more decompression)
-+       {
-+         LzmaDec_DecodeToDic()
-+         use data from CLzmaDec::dic and update CLzmaDec::dicPos
-+       }
-+     }
-+     LzmaDec_Free()
-+*/
-+
-+/* LzmaDec_DecodeToDic
-+
-+   The decoding to internal dictionary buffer (CLzmaDec::dic).
-+   You must manually update CLzmaDec::dicPos, if it reaches CLzmaDec::dicBufSize !!!
-+
-+finishMode:
-+  It has meaning only if the decoding reaches output limit (dicLimit).
-+  LZMA_FINISH_ANY - Decode just dicLimit bytes.
-+  LZMA_FINISH_END - Stream must be finished after dicLimit.
-+
-+Returns:
-+  SZ_OK
-+    status:
-+      LZMA_STATUS_FINISHED_WITH_MARK
-+      LZMA_STATUS_NOT_FINISHED
-+      LZMA_STATUS_NEEDS_MORE_INPUT
-+      LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK
-+  SZ_ERROR_DATA - Data error
-+*/
-+
-+SRes LzmaDec_DecodeToDic(CLzmaDec *p, SizeT dicLimit,
-+    const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status);
-+
-+
-+/* ---------- Buffer Interface ---------- */
-+
-+/* It's zlib-like interface.
-+   See LzmaDec_DecodeToDic description for information about STEPS and return results,
-+   but you must use LzmaDec_DecodeToBuf instead of LzmaDec_DecodeToDic and you don't need
-+   to work with CLzmaDec variables manually.
-+
-+finishMode:
-+  It has meaning only if the decoding reaches output limit (*destLen).
-+  LZMA_FINISH_ANY - Decode just destLen bytes.
-+  LZMA_FINISH_END - Stream must be finished after (*destLen).
-+*/
-+
-+SRes LzmaDec_DecodeToBuf(CLzmaDec *p, Byte *dest, SizeT *destLen,
-+    const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status);
-+
-+
 +/* ---------- One Call Interface ---------- */
 +
 +/* LzmaDecode
@@ -765,7 +647,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +#endif
 --- /dev/null
 +++ b/include/linux/lzma/LzmaEnc.h
-@@ -0,0 +1,80 @@
+@@ -0,0 +1,60 @@
 +/*  LzmaEnc.h -- LZMA Encoder
 +2009-02-07 : Igor Pavlov : Public domain */
 +
@@ -799,9 +681,6 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +} CLzmaEncProps;
 +
 +void LzmaEncProps_Init(CLzmaEncProps *p);
-+void LzmaEncProps_Normalize(CLzmaEncProps *p);
-+UInt32 LzmaEncProps_GetDictSize(const CLzmaEncProps *props2);
-+
 +
 +/* ---------- CLzmaEncHandle Interface ---------- */
 +
@@ -821,26 +700,9 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +void LzmaEnc_Destroy(CLzmaEncHandle p, ISzAlloc *alloc, ISzAlloc *allocBig);
 +SRes LzmaEnc_SetProps(CLzmaEncHandle p, const CLzmaEncProps *props);
 +SRes LzmaEnc_WriteProperties(CLzmaEncHandle p, Byte *properties, SizeT *size);
-+SRes LzmaEnc_Encode(CLzmaEncHandle p, ISeqOutStream *outStream, ISeqInStream *inStream,
-+    ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig);
 +SRes LzmaEnc_MemEncode(CLzmaEncHandle p, Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
 +    int writeEndMark, ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig);
 +
-+/* ---------- One Call Interface ---------- */
-+
-+/* LzmaEncode
-+Return code:
-+  SZ_OK               - OK
-+  SZ_ERROR_MEM        - Memory allocation error
-+  SZ_ERROR_PARAM      - Incorrect paramater
-+  SZ_ERROR_OUTPUT_EOF - output buffer overflow
-+  SZ_ERROR_THREAD     - errors in multithreading functions (only for Mt version)
-+*/
-+
-+SRes LzmaEncode(Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
-+    const CLzmaEncProps *props, Byte *propsEncoded, SizeT *propsSize, int writeEndMark,
-+    ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig);
-+
 +#ifdef __cplusplus
 +}
 +#endif
@@ -1130,7 +992,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
  lib-$(CONFIG_DECOMPRESS_BZIP2) += decompress_bunzip2.o
 --- /dev/null
 +++ b/lib/lzma/LzFind.c
-@@ -0,0 +1,761 @@
+@@ -0,0 +1,522 @@
 +/* LzFind.c -- Match finder for LZ algorithms
 +2009-04-22 : Igor Pavlov : Public domain */
 +
@@ -1147,9 +1009,15 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +
 +#define kStartMaxLen 3
 +
++#if 0
++#define DIRECT_INPUT	p->directInput
++#else
++#define DIRECT_INPUT	1
++#endif
++
 +static void LzInWindow_Free(CMatchFinder *p, ISzAlloc *alloc)
 +{
-+  if (!p->directInput)
++  if (!DIRECT_INPUT)
 +  {
 +    alloc->Free(alloc, p->bufferBase);
 +    p->bufferBase = 0;
@@ -1161,7 +1029,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +static int LzInWindow_Create(CMatchFinder *p, UInt32 keepSizeReserv, ISzAlloc *alloc)
 +{
 +  UInt32 blockSize = p->keepSizeBefore + p->keepSizeAfter + keepSizeReserv;
-+  if (p->directInput)
++  if (DIRECT_INPUT)
 +  {
 +    p->blockSize = blockSize;
 +    return 1;
@@ -1175,12 +1043,12 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  return (p->bufferBase != 0);
 +}
 +
-+Byte *MatchFinder_GetPointerToCurrentPos(CMatchFinder *p) { return p->buffer; }
-+Byte MatchFinder_GetIndexByte(CMatchFinder *p, Int32 index) { return p->buffer[index]; }
++static Byte *MatchFinder_GetPointerToCurrentPos(CMatchFinder *p) { return p->buffer; }
++static Byte MatchFinder_GetIndexByte(CMatchFinder *p, Int32 index) { return p->buffer[index]; }
 +
-+UInt32 MatchFinder_GetNumAvailableBytes(CMatchFinder *p) { return p->streamPos - p->pos; }
++static UInt32 MatchFinder_GetNumAvailableBytes(CMatchFinder *p) { return p->streamPos - p->pos; }
 +
-+void MatchFinder_ReduceOffsets(CMatchFinder *p, UInt32 subValue)
++static void MatchFinder_ReduceOffsets(CMatchFinder *p, UInt32 subValue)
 +{
 +  p->posLimit -= subValue;
 +  p->pos -= subValue;
@@ -1191,7 +1059,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +{
 +  if (p->streamEndWasReached || p->result != SZ_OK)
 +    return;
-+  if (p->directInput)
++  if (DIRECT_INPUT)
 +  {
 +    UInt32 curSize = 0xFFFFFFFF - p->streamPos;
 +    if (curSize > p->directInputRem)
@@ -1222,7 +1090,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  }
 +}
 +
-+void MatchFinder_MoveBlock(CMatchFinder *p)
++static void MatchFinder_MoveBlock(CMatchFinder *p)
 +{
 +  memmove(p->bufferBase,
 +    p->buffer - p->keepSizeBefore,
@@ -1230,22 +1098,14 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  p->buffer = p->bufferBase + p->keepSizeBefore;
 +}
 +
-+int MatchFinder_NeedMove(CMatchFinder *p)
++static int MatchFinder_NeedMove(CMatchFinder *p)
 +{
-+  if (p->directInput)
++  if (DIRECT_INPUT)
 +    return 0;
 +  /* if (p->streamEndWasReached) return 0; */
 +  return ((size_t)(p->bufferBase + p->blockSize - p->buffer) <= p->keepSizeAfter);
 +}
 +
-+void MatchFinder_ReadIfRequired(CMatchFinder *p)
-+{
-+  if (p->streamEndWasReached)
-+    return;
-+  if (p->keepSizeAfter >= p->streamPos - p->pos)
-+    MatchFinder_ReadBlock(p);
-+}
-+
 +static void MatchFinder_CheckAndMoveAndRead(CMatchFinder *p)
 +{
 +  if (MatchFinder_NeedMove(p))
@@ -1401,7 +1261,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  p->posLimit = p->pos + limit;
 +}
 +
-+void MatchFinder_Init(CMatchFinder *p)
++static void MatchFinder_Init(CMatchFinder *p)
 +{
 +  UInt32 i;
 +  for (i = 0; i < p->hashSizeSum; i++)
@@ -1420,7 +1280,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  return (p->pos - p->historySize - 1) & kNormalizeMask;
 +}
 +
-+void MatchFinder_Normalize3(UInt32 subValue, CLzRef *items, UInt32 numItems)
++static void MatchFinder_Normalize3(UInt32 subValue, CLzRef *items, UInt32 numItems)
 +{
 +  UInt32 i;
 +  for (i = 0; i < numItems; i++)
@@ -1452,38 +1312,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  MatchFinder_SetLimits(p);
 +}
 +
-+static UInt32 * Hc_GetMatchesSpec(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *cur, CLzRef *son,
-+    UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 cutValue,
-+    UInt32 *distances, UInt32 maxLen)
-+{
-+  son[_cyclicBufferPos] = curMatch;
-+  for (;;)
-+  {
-+    UInt32 delta = pos - curMatch;
-+    if (cutValue-- == 0 || delta >= _cyclicBufferSize)
-+      return distances;
-+    {
-+      const Byte *pb = cur - delta;
-+      curMatch = son[_cyclicBufferPos - delta + ((delta > _cyclicBufferPos) ? _cyclicBufferSize : 0)];
-+      if (pb[maxLen] == cur[maxLen] && *pb == *cur)
-+      {
-+        UInt32 len = 0;
-+        while (++len != lenLimit)
-+          if (pb[len] != cur[len])
-+            break;
-+        if (maxLen < len)
-+        {
-+          *distances++ = maxLen = len;
-+          *distances++ = delta - 1;
-+          if (len == lenLimit)
-+            return distances;
-+        }
-+      }
-+    }
-+  }
-+}
-+
-+UInt32 * GetMatchesSpec1(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *cur, CLzRef *son,
++static UInt32 * GetMatchesSpec1(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *cur, CLzRef *son,
 +    UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 cutValue,
 +    UInt32 *distances, UInt32 maxLen)
 +{
@@ -1593,10 +1422,10 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  p->buffer++; \
 +  if (++p->pos == p->posLimit) MatchFinder_CheckLimits(p);
 +
-+#define MOVE_POS_RET MOVE_POS return offset;
-+
 +static void MatchFinder_MovePos(CMatchFinder *p) { MOVE_POS; }
 +
++#define MOVE_POS_RET MatchFinder_MovePos(p); return offset;
++
 +#define GET_MATCHES_HEADER2(minLen, ret_op) \
 +  UInt32 lenLimit; UInt32 hashValue; const Byte *cur; UInt32 curMatch; \
 +  lenLimit = p->lenLimit; { if (lenLimit < minLen) { MatchFinder_MovePos(p); ret_op; }} \
@@ -1612,62 +1441,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  distances + offset, maxLen) - distances); MOVE_POS_RET;
 +
 +#define SKIP_FOOTER \
-+  SkipMatchesSpec(lenLimit, curMatch, MF_PARAMS(p)); MOVE_POS;
-+
-+static UInt32 Bt2_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
-+{
-+  UInt32 offset;
-+  GET_MATCHES_HEADER(2)
-+  HASH2_CALC;
-+  curMatch = p->hash[hashValue];
-+  p->hash[hashValue] = p->pos;
-+  offset = 0;
-+  GET_MATCHES_FOOTER(offset, 1)
-+}
-+
-+UInt32 Bt3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
-+{
-+  UInt32 offset;
-+  GET_MATCHES_HEADER(3)
-+  HASH_ZIP_CALC;
-+  curMatch = p->hash[hashValue];
-+  p->hash[hashValue] = p->pos;
-+  offset = 0;
-+  GET_MATCHES_FOOTER(offset, 2)
-+}
-+
-+static UInt32 Bt3_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
-+{
-+  UInt32 hash2Value, delta2, maxLen, offset;
-+  GET_MATCHES_HEADER(3)
-+
-+  HASH3_CALC;
-+
-+  delta2 = p->pos - p->hash[hash2Value];
-+  curMatch = p->hash[kFix3HashSize + hashValue];
-+
-+  p->hash[hash2Value] =
-+  p->hash[kFix3HashSize + hashValue] = p->pos;
-+
-+
-+  maxLen = 2;
-+  offset = 0;
-+  if (delta2 < p->cyclicBufferSize && *(cur - delta2) == *cur)
-+  {
-+    for (; maxLen != lenLimit; maxLen++)
-+      if (cur[(ptrdiff_t)maxLen - delta2] != cur[maxLen])
-+        break;
-+    distances[0] = maxLen;
-+    distances[1] = delta2 - 1;
-+    offset = 2;
-+    if (maxLen == lenLimit)
-+    {
-+      SkipMatchesSpec(lenLimit, curMatch, MF_PARAMS(p));
-+      MOVE_POS_RET;
-+    }
-+  }
-+  GET_MATCHES_FOOTER(offset, maxLen)
-+}
++  SkipMatchesSpec(lenLimit, curMatch, MF_PARAMS(p)); MatchFinder_MovePos(p);
 +
 +static UInt32 Bt4_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
 +{
@@ -1716,108 +1490,6 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  GET_MATCHES_FOOTER(offset, maxLen)
 +}
 +
-+static UInt32 Hc4_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
-+{
-+  UInt32 hash2Value, hash3Value, delta2, delta3, maxLen, offset;
-+  GET_MATCHES_HEADER(4)
-+
-+  HASH4_CALC;
-+
-+  delta2 = p->pos - p->hash[                hash2Value];
-+  delta3 = p->pos - p->hash[kFix3HashSize + hash3Value];
-+  curMatch = p->hash[kFix4HashSize + hashValue];
-+
-+  p->hash[                hash2Value] =
-+  p->hash[kFix3HashSize + hash3Value] =
-+  p->hash[kFix4HashSize + hashValue] = p->pos;
-+
-+  maxLen = 1;
-+  offset = 0;
-+  if (delta2 < p->cyclicBufferSize && *(cur - delta2) == *cur)
-+  {
-+    distances[0] = maxLen = 2;
-+    distances[1] = delta2 - 1;
-+    offset = 2;
-+  }
-+  if (delta2 != delta3 && delta3 < p->cyclicBufferSize && *(cur - delta3) == *cur)
-+  {
-+    maxLen = 3;
-+    distances[offset + 1] = delta3 - 1;
-+    offset += 2;
-+    delta2 = delta3;
-+  }
-+  if (offset != 0)
-+  {
-+    for (; maxLen != lenLimit; maxLen++)
-+      if (cur[(ptrdiff_t)maxLen - delta2] != cur[maxLen])
-+        break;
-+    distances[offset - 2] = maxLen;
-+    if (maxLen == lenLimit)
-+    {
-+      p->son[p->cyclicBufferPos] = curMatch;
-+      MOVE_POS_RET;
-+    }
-+  }
-+  if (maxLen < 3)
-+    maxLen = 3;
-+  offset = (UInt32)(Hc_GetMatchesSpec(lenLimit, curMatch, MF_PARAMS(p),
-+    distances + offset, maxLen) - (distances));
-+  MOVE_POS_RET
-+}
-+
-+UInt32 Hc3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
-+{
-+  UInt32 offset;
-+  GET_MATCHES_HEADER(3)
-+  HASH_ZIP_CALC;
-+  curMatch = p->hash[hashValue];
-+  p->hash[hashValue] = p->pos;
-+  offset = (UInt32)(Hc_GetMatchesSpec(lenLimit, curMatch, MF_PARAMS(p),
-+    distances, 2) - (distances));
-+  MOVE_POS_RET
-+}
-+
-+static void Bt2_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
-+{
-+  do
-+  {
-+    SKIP_HEADER(2)
-+    HASH2_CALC;
-+    curMatch = p->hash[hashValue];
-+    p->hash[hashValue] = p->pos;
-+    SKIP_FOOTER
-+  }
-+  while (--num != 0);
-+}
-+
-+void Bt3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
-+{
-+  do
-+  {
-+    SKIP_HEADER(3)
-+    HASH_ZIP_CALC;
-+    curMatch = p->hash[hashValue];
-+    p->hash[hashValue] = p->pos;
-+    SKIP_FOOTER
-+  }
-+  while (--num != 0);
-+}
-+
-+static void Bt3_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
-+{
-+  do
-+  {
-+    UInt32 hash2Value;
-+    SKIP_HEADER(3)
-+    HASH3_CALC;
-+    curMatch = p->hash[kFix3HashSize + hashValue];
-+    p->hash[hash2Value] =
-+    p->hash[kFix3HashSize + hashValue] = p->pos;
-+    SKIP_FOOTER
-+  }
-+  while (--num != 0);
-+}
-+
 +static void Bt4_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
 +{
 +  do
@@ -1834,67 +1506,18 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  while (--num != 0);
 +}
 +
-+static void Hc4_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
-+{
-+  do
-+  {
-+    UInt32 hash2Value, hash3Value;
-+    SKIP_HEADER(4)
-+    HASH4_CALC;
-+    curMatch = p->hash[kFix4HashSize + hashValue];
-+    p->hash[                hash2Value] =
-+    p->hash[kFix3HashSize + hash3Value] =
-+    p->hash[kFix4HashSize + hashValue] = p->pos;
-+    p->son[p->cyclicBufferPos] = curMatch;
-+    MOVE_POS
-+  }
-+  while (--num != 0);
-+}
-+
-+void Hc3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
-+{
-+  do
-+  {
-+    SKIP_HEADER(3)
-+    HASH_ZIP_CALC;
-+    curMatch = p->hash[hashValue];
-+    p->hash[hashValue] = p->pos;
-+    p->son[p->cyclicBufferPos] = curMatch;
-+    MOVE_POS
-+  }
-+  while (--num != 0);
-+}
-+
 +void MatchFinder_CreateVTable(CMatchFinder *p, IMatchFinder *vTable)
 +{
 +  vTable->Init = (Mf_Init_Func)MatchFinder_Init;
 +  vTable->GetIndexByte = (Mf_GetIndexByte_Func)MatchFinder_GetIndexByte;
 +  vTable->GetNumAvailableBytes = (Mf_GetNumAvailableBytes_Func)MatchFinder_GetNumAvailableBytes;
 +  vTable->GetPointerToCurrentPos = (Mf_GetPointerToCurrentPos_Func)MatchFinder_GetPointerToCurrentPos;
-+  if (!p->btMode)
-+  {
-+    vTable->GetMatches = (Mf_GetMatches_Func)Hc4_MatchFinder_GetMatches;
-+    vTable->Skip = (Mf_Skip_Func)Hc4_MatchFinder_Skip;
-+  }
-+  else if (p->numHashBytes == 2)
-+  {
-+    vTable->GetMatches = (Mf_GetMatches_Func)Bt2_MatchFinder_GetMatches;
-+    vTable->Skip = (Mf_Skip_Func)Bt2_MatchFinder_Skip;
-+  }
-+  else if (p->numHashBytes == 3)
-+  {
-+    vTable->GetMatches = (Mf_GetMatches_Func)Bt3_MatchFinder_GetMatches;
-+    vTable->Skip = (Mf_Skip_Func)Bt3_MatchFinder_Skip;
-+  }
-+  else
-+  {
-+    vTable->GetMatches = (Mf_GetMatches_Func)Bt4_MatchFinder_GetMatches;
-+    vTable->Skip = (Mf_Skip_Func)Bt4_MatchFinder_Skip;
-+  }
++  vTable->GetMatches = (Mf_GetMatches_Func)Bt4_MatchFinder_GetMatches;
++  vTable->Skip = (Mf_Skip_Func)Bt4_MatchFinder_Skip;
 +}
 --- /dev/null
 +++ b/lib/lzma/LzmaDec.c
-@@ -0,0 +1,999 @@
+@@ -0,0 +1,925 @@
 +/* LzmaDec.c -- LZMA Decoder
 +2009-09-20 : Igor Pavlov : Public domain */
 +
@@ -2579,7 +2202,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  p->needFlush = 0;
 +}
 +
-+void LzmaDec_InitDicAndState(CLzmaDec *p, Bool initDic, Bool initState)
++static void LzmaDec_InitDicAndState(CLzmaDec *p, Bool initDic, Bool initState)
 +{
 +  p->needFlush = 1;
 +  p->remainLen = 0;
@@ -2595,7 +2218,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +    p->needInitState = 1;
 +}
 +
-+void LzmaDec_Init(CLzmaDec *p)
++static void LzmaDec_Init(CLzmaDec *p)
 +{
 +  p->dicPos = 0;
 +  LzmaDec_InitDicAndState(p, True, True);
@@ -2613,7 +2236,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  p->needInitState = 0;
 +}
 +
-+SRes LzmaDec_DecodeToDic(CLzmaDec *p, SizeT dicLimit, const Byte *src, SizeT *srcLen,
++static SRes LzmaDec_DecodeToDic(CLzmaDec *p, SizeT dicLimit, const Byte *src, SizeT *srcLen,
 +    ELzmaFinishMode finishMode, ELzmaStatus *status)
 +{
 +  SizeT inSize = *srcLen;
@@ -2734,65 +2357,13 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  return (p->code == 0) ? SZ_OK : SZ_ERROR_DATA;
 +}
 +
-+SRes LzmaDec_DecodeToBuf(CLzmaDec *p, Byte *dest, SizeT *destLen, const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status)
-+{
-+  SizeT outSize = *destLen;
-+  SizeT inSize = *srcLen;
-+  *srcLen = *destLen = 0;
-+  for (;;)
-+  {
-+    SizeT inSizeCur = inSize, outSizeCur, dicPos;
-+    ELzmaFinishMode curFinishMode;
-+    SRes res;
-+    if (p->dicPos == p->dicBufSize)
-+      p->dicPos = 0;
-+    dicPos = p->dicPos;
-+    if (outSize > p->dicBufSize - dicPos)
-+    {
-+      outSizeCur = p->dicBufSize;
-+      curFinishMode = LZMA_FINISH_ANY;
-+    }
-+    else
-+    {
-+      outSizeCur = dicPos + outSize;
-+      curFinishMode = finishMode;
-+    }
-+
-+    res = LzmaDec_DecodeToDic(p, outSizeCur, src, &inSizeCur, curFinishMode, status);
-+    src += inSizeCur;
-+    inSize -= inSizeCur;
-+    *srcLen += inSizeCur;
-+    outSizeCur = p->dicPos - dicPos;
-+    memcpy(dest, p->dic + dicPos, outSizeCur);
-+    dest += outSizeCur;
-+    outSize -= outSizeCur;
-+    *destLen += outSizeCur;
-+    if (res != 0)
-+      return res;
-+    if (outSizeCur == 0 || outSize == 0)
-+      return SZ_OK;
-+  }
-+}
-+
-+void LzmaDec_FreeProbs(CLzmaDec *p, ISzAlloc *alloc)
++static void LzmaDec_FreeProbs(CLzmaDec *p, ISzAlloc *alloc)
 +{
 +  alloc->Free(alloc, p->probs);
 +  p->probs = 0;
 +}
 +
-+static void LzmaDec_FreeDict(CLzmaDec *p, ISzAlloc *alloc)
-+{
-+  alloc->Free(alloc, p->dic);
-+  p->dic = 0;
-+}
-+
-+void LzmaDec_Free(CLzmaDec *p, ISzAlloc *alloc)
-+{
-+  LzmaDec_FreeProbs(p, alloc);
-+  LzmaDec_FreeDict(p, alloc);
-+}
-+
-+SRes LzmaProps_Decode(CLzmaProps *p, const Byte *data, unsigned size)
++static SRes LzmaProps_Decode(CLzmaProps *p, const Byte *data, unsigned size)
 +{
 +  UInt32 dicSize;
 +  Byte d;
@@ -2832,33 +2403,11 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  return SZ_OK;
 +}
 +
-+SRes LzmaDec_AllocateProbs(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc)
-+{
-+  CLzmaProps propNew;
-+  RINOK(LzmaProps_Decode(&propNew, props, propsSize));
-+  RINOK(LzmaDec_AllocateProbs2(p, &propNew, alloc));
-+  p->prop = propNew;
-+  return SZ_OK;
-+}
-+
-+SRes LzmaDec_Allocate(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc)
++static SRes LzmaDec_AllocateProbs(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc)
 +{
 +  CLzmaProps propNew;
-+  SizeT dicBufSize;
 +  RINOK(LzmaProps_Decode(&propNew, props, propsSize));
 +  RINOK(LzmaDec_AllocateProbs2(p, &propNew, alloc));
-+  dicBufSize = propNew.dicSize;
-+  if (p->dic == 0 || dicBufSize != p->dicBufSize)
-+  {
-+    LzmaDec_FreeDict(p, alloc);
-+    p->dic = (Byte *)alloc->Alloc(alloc, dicBufSize);
-+    if (p->dic == 0)
-+    {
-+      LzmaDec_FreeProbs(p, alloc);
-+      return SZ_ERROR_MEM;
-+    }
-+  }
-+  p->dicBufSize = dicBufSize;
 +  p->prop = propNew;
 +  return SZ_OK;
 +}
@@ -2896,7 +2445,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +}
 --- /dev/null
 +++ b/lib/lzma/LzmaEnc.c
-@@ -0,0 +1,2271 @@
+@@ -0,0 +1,2123 @@
 +/* LzmaEnc.c -- LZMA Encoder
 +2009-11-24 : Igor Pavlov : Public domain */
 +
@@ -2952,7 +2501,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  p->writeEndMark = 0;
 +}
 +
-+void LzmaEncProps_Normalize(CLzmaEncProps *p)
++static void LzmaEncProps_Normalize(CLzmaEncProps *p)
 +{
 +  int level = p->level;
 +  if (level < 0) level = 5;
@@ -2975,7 +2524,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +      #endif
 +}
 +
-+UInt32 LzmaEncProps_GetDictSize(const CLzmaEncProps *props2)
++static UInt32 __maybe_unused LzmaEncProps_GetDictSize(const CLzmaEncProps *props2)
 +{
 +  CLzmaEncProps props = *props2;
 +  LzmaEncProps_Normalize(&props);
@@ -2992,7 +2541,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +
 +#define BSR2_RET(pos, res) { unsigned long i; _BitScanReverse(&i, (pos)); res = (i + i) + ((pos >> (i - 1)) & 1); }
 +
-+UInt32 GetPosSlot1(UInt32 pos)
++static UInt32 GetPosSlot1(UInt32 pos)
 +{
 +  UInt32 res;
 +  BSR2_RET(pos, res);
@@ -3006,7 +2555,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +#define kNumLogBits (9 + (int)sizeof(size_t) / 2)
 +#define kDicLogSizeMaxCompress ((kNumLogBits - 1) * 2 + 7)
 +
-+void LzmaEnc_FastPosInit(Byte *g_FastPos)
++static void LzmaEnc_FastPosInit(Byte *g_FastPos)
 +{
 +  int c = 2, slotFast;
 +  g_FastPos[0] = 0;
@@ -3238,58 +2787,6 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  CSaveState saveState;
 +} CLzmaEnc;
 +
-+void LzmaEnc_SaveState(CLzmaEncHandle pp)
-+{
-+  CLzmaEnc *p = (CLzmaEnc *)pp;
-+  CSaveState *dest = &p->saveState;
-+  int i;
-+  dest->lenEnc = p->lenEnc;
-+  dest->repLenEnc = p->repLenEnc;
-+  dest->state = p->state;
-+
-+  for (i = 0; i < kNumStates; i++)
-+  {
-+    memcpy(dest->isMatch[i], p->isMatch[i], sizeof(p->isMatch[i]));
-+    memcpy(dest->isRep0Long[i], p->isRep0Long[i], sizeof(p->isRep0Long[i]));
-+  }
-+  for (i = 0; i < kNumLenToPosStates; i++)
-+    memcpy(dest->posSlotEncoder[i], p->posSlotEncoder[i], sizeof(p->posSlotEncoder[i]));
-+  memcpy(dest->isRep, p->isRep, sizeof(p->isRep));
-+  memcpy(dest->isRepG0, p->isRepG0, sizeof(p->isRepG0));
-+  memcpy(dest->isRepG1, p->isRepG1, sizeof(p->isRepG1));
-+  memcpy(dest->isRepG2, p->isRepG2, sizeof(p->isRepG2));
-+  memcpy(dest->posEncoders, p->posEncoders, sizeof(p->posEncoders));
-+  memcpy(dest->posAlignEncoder, p->posAlignEncoder, sizeof(p->posAlignEncoder));
-+  memcpy(dest->reps, p->reps, sizeof(p->reps));
-+  memcpy(dest->litProbs, p->litProbs, (0x300 << p->lclp) * sizeof(CLzmaProb));
-+}
-+
-+void LzmaEnc_RestoreState(CLzmaEncHandle pp)
-+{
-+  CLzmaEnc *dest = (CLzmaEnc *)pp;
-+  const CSaveState *p = &dest->saveState;
-+  int i;
-+  dest->lenEnc = p->lenEnc;
-+  dest->repLenEnc = p->repLenEnc;
-+  dest->state = p->state;
-+
-+  for (i = 0; i < kNumStates; i++)
-+  {
-+    memcpy(dest->isMatch[i], p->isMatch[i], sizeof(p->isMatch[i]));
-+    memcpy(dest->isRep0Long[i], p->isRep0Long[i], sizeof(p->isRep0Long[i]));
-+  }
-+  for (i = 0; i < kNumLenToPosStates; i++)
-+    memcpy(dest->posSlotEncoder[i], p->posSlotEncoder[i], sizeof(p->posSlotEncoder[i]));
-+  memcpy(dest->isRep, p->isRep, sizeof(p->isRep));
-+  memcpy(dest->isRepG0, p->isRepG0, sizeof(p->isRepG0));
-+  memcpy(dest->isRepG1, p->isRepG1, sizeof(p->isRepG1));
-+  memcpy(dest->isRepG2, p->isRepG2, sizeof(p->isRepG2));
-+  memcpy(dest->posEncoders, p->posEncoders, sizeof(p->posEncoders));
-+  memcpy(dest->posAlignEncoder, p->posAlignEncoder, sizeof(p->posAlignEncoder));
-+  memcpy(dest->reps, p->reps, sizeof(p->reps));
-+  memcpy(dest->litProbs, p->litProbs, (0x300 << dest->lclp) * sizeof(CLzmaProb));
-+}
-+
 +SRes LzmaEnc_SetProps(CLzmaEncHandle pp, const CLzmaEncProps *props2)
 +{
 +  CLzmaEnc *p = (CLzmaEnc *)pp;
@@ -3499,7 +2996,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  while (symbol < 0x10000);
 +}
 +
-+void LzmaEnc_InitPriceTables(UInt32 *ProbPrices)
++static void LzmaEnc_InitPriceTables(UInt32 *ProbPrices)
 +{
 +  UInt32 i;
 +  for (i = (1 << kNumMoveReducingBits) / 2; i < kBitModelTotal; i += (1 << kNumMoveReducingBits))
@@ -4575,7 +4072,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  p->matchPriceCount = 0;
 +}
 +
-+void LzmaEnc_Construct(CLzmaEnc *p)
++static void LzmaEnc_Construct(CLzmaEnc *p)
 +{
 +  RangeEnc_Construct(&p->rc);
 +  MatchFinder_Construct(&p->matchFinderBase);
@@ -4608,7 +4105,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  return p;
 +}
 +
-+void LzmaEnc_FreeLits(CLzmaEnc *p, ISzAlloc *alloc)
++static void LzmaEnc_FreeLits(CLzmaEnc *p, ISzAlloc *alloc)
 +{
 +  alloc->Free(alloc, p->litProbs);
 +  alloc->Free(alloc, p->saveState.litProbs);
@@ -4616,7 +4113,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  p->saveState.litProbs = 0;
 +}
 +
-+void LzmaEnc_Destruct(CLzmaEnc *p, ISzAlloc *alloc, ISzAlloc *allocBig)
++static void LzmaEnc_Destruct(CLzmaEnc *p, ISzAlloc *alloc, ISzAlloc *allocBig)
 +{
 +  #ifndef _7ZIP_ST
 +  MatchFinderMt_Destruct(&p->matchFinderMt, allocBig);
@@ -4846,7 +4343,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  return SZ_OK;
 +}
 +
-+void LzmaEnc_Init(CLzmaEnc *p)
++static void LzmaEnc_Init(CLzmaEnc *p)
 +{
 +  UInt32 i;
 +  p->state = 0;
@@ -4904,7 +4401,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  p->lpMask = (1 << p->lp) - 1;
 +}
 +
-+void LzmaEnc_InitPrices(CLzmaEnc *p)
++static void LzmaEnc_InitPrices(CLzmaEnc *p)
 +{
 +  if (!p->fastMode)
 +  {
@@ -4936,26 +4433,6 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  return SZ_OK;
 +}
 +
-+static SRes LzmaEnc_Prepare(CLzmaEncHandle pp, ISeqOutStream *outStream, ISeqInStream *inStream,
-+    ISzAlloc *alloc, ISzAlloc *allocBig)
-+{
-+  CLzmaEnc *p = (CLzmaEnc *)pp;
-+  p->matchFinderBase.stream = inStream;
-+  p->needInit = 1;
-+  p->rc.outStream = outStream;
-+  return LzmaEnc_AllocAndInit(p, 0, alloc, allocBig);
-+}
-+
-+SRes LzmaEnc_PrepareForLzma2(CLzmaEncHandle pp,
-+    ISeqInStream *inStream, UInt32 keepWindowSize,
-+    ISzAlloc *alloc, ISzAlloc *allocBig)
-+{
-+  CLzmaEnc *p = (CLzmaEnc *)pp;
-+  p->matchFinderBase.stream = inStream;
-+  p->needInit = 1;
-+  return LzmaEnc_AllocAndInit(p, keepWindowSize, alloc, allocBig);
-+}
-+
 +static void LzmaEnc_SetInputBuf(CLzmaEnc *p, const Byte *src, SizeT srcLen)
 +{
 +  p->matchFinderBase.directInput = 1;
@@ -4963,7 +4440,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  p->matchFinderBase.directInputRem = srcLen;
 +}
 +
-+SRes LzmaEnc_MemPrepare(CLzmaEncHandle pp, const Byte *src, SizeT srcLen,
++static SRes LzmaEnc_MemPrepare(CLzmaEncHandle pp, const Byte *src, SizeT srcLen,
 +    UInt32 keepWindowSize, ISzAlloc *alloc, ISzAlloc *allocBig)
 +{
 +  CLzmaEnc *p = (CLzmaEnc *)pp;
@@ -4973,7 +4450,7 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  return LzmaEnc_AllocAndInit(p, keepWindowSize, alloc, allocBig);
 +}
 +
-+void LzmaEnc_Finish(CLzmaEncHandle pp)
++static void LzmaEnc_Finish(CLzmaEncHandle pp)
 +{
 +  #ifndef _7ZIP_ST
 +  CLzmaEnc *p = (CLzmaEnc *)pp;
@@ -5006,53 +4483,6 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  return size;
 +}
 +
-+
-+UInt32 LzmaEnc_GetNumAvailableBytes(CLzmaEncHandle pp)
-+{
-+  const CLzmaEnc *p = (CLzmaEnc *)pp;
-+  return p->matchFinder.GetNumAvailableBytes(p->matchFinderObj);
-+}
-+
-+const Byte *LzmaEnc_GetCurBuf(CLzmaEncHandle pp)
-+{
-+  const CLzmaEnc *p = (CLzmaEnc *)pp;
-+  return p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - p->additionalOffset;
-+}
-+
-+SRes LzmaEnc_CodeOneMemBlock(CLzmaEncHandle pp, Bool reInit,
-+    Byte *dest, size_t *destLen, UInt32 desiredPackSize, UInt32 *unpackSize)
-+{
-+  CLzmaEnc *p = (CLzmaEnc *)pp;
-+  UInt64 nowPos64;
-+  SRes res;
-+  CSeqOutStreamBuf outStream;
-+
-+  outStream.funcTable.Write = MyWrite;
-+  outStream.data = dest;
-+  outStream.rem = *destLen;
-+  outStream.overflow = False;
-+
-+  p->writeEndMark = False;
-+  p->finished = False;
-+  p->result = SZ_OK;
-+
-+  if (reInit)
-+    LzmaEnc_Init(p);
-+  LzmaEnc_InitPrices(p);
-+  nowPos64 = p->nowPos64;
-+  RangeEnc_Init(&p->rc);
-+  p->rc.outStream = &outStream.funcTable;
-+
-+  res = LzmaEnc_CodeOneBlock(p, True, desiredPackSize, *unpackSize);
-+
-+  *unpackSize = (UInt32)(p->nowPos64 - nowPos64);
-+  *destLen -= outStream.rem;
-+  if (outStream.overflow)
-+    return SZ_ERROR_OUTPUT_EOF;
-+
-+  return res;
-+}
-+
 +static SRes LzmaEnc_Encode2(CLzmaEnc *p, ICompressProgress *progress)
 +{
 +  SRes res = SZ_OK;
@@ -5083,13 +4513,6 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +  return res;
 +}
 +
-+SRes LzmaEnc_Encode(CLzmaEncHandle pp, ISeqOutStream *outStream, ISeqInStream *inStream, ICompressProgress *progress,
-+    ISzAlloc *alloc, ISzAlloc *allocBig)
-+{
-+  RINOK(LzmaEnc_Prepare(pp, outStream, inStream, alloc, allocBig));
-+  return LzmaEnc_Encode2((CLzmaEnc *)pp, progress);
-+}
-+
 +SRes LzmaEnc_WriteProperties(CLzmaEncHandle pp, Byte *props, SizeT *size)
 +{
 +  CLzmaEnc *p = (CLzmaEnc *)pp;
@@ -5146,28 +4569,6 @@ Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
 +    return SZ_ERROR_OUTPUT_EOF;
 +  return res;
 +}
-+
-+SRes LzmaEncode(Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
-+    const CLzmaEncProps *props, Byte *propsEncoded, SizeT *propsSize, int writeEndMark,
-+    ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig)
-+{
-+  CLzmaEnc *p = (CLzmaEnc *)LzmaEnc_Create(alloc);
-+  SRes res;
-+  if (p == 0)
-+    return SZ_ERROR_MEM;
-+
-+  res = LzmaEnc_SetProps(p, props);
-+  if (res == SZ_OK)
-+  {
-+    res = LzmaEnc_WriteProperties(p, propsEncoded, propsSize);
-+    if (res == SZ_OK)
-+      res = LzmaEnc_MemEncode(p, dest, destLen, src, srcLen,
-+          writeEndMark, progress, alloc, allocBig);
-+  }
-+
-+  LzmaEnc_Destroy(p, alloc, allocBig);
-+  return res;
-+}
 --- /dev/null
 +++ b/lib/lzma/Makefile
 @@ -0,0 +1,7 @@
diff --git a/target/linux/generic/pending-5.15/610-netfilter_match_bypass_default_checks.patch b/target/linux/generic/pending-5.15/610-netfilter_match_bypass_default_checks.patch
index 457703121cdb77..c1e050e935e6bf 100644
--- a/target/linux/generic/pending-5.15/610-netfilter_match_bypass_default_checks.patch
+++ b/target/linux/generic/pending-5.15/610-netfilter_match_bypass_default_checks.patch
@@ -91,7 +91,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		for (i = sizeof(struct ipt_entry);
  		     i < e->target_offset;
  		     i += m->u.match_size) {
-@@ -1223,12 +1260,15 @@ compat_copy_entry_to_user(struct ipt_ent
+@@ -1222,12 +1259,15 @@ compat_copy_entry_to_user(struct ipt_ent
  	compat_uint_t origsize;
  	const struct xt_entry_match *ematch;
  	int ret = 0;
diff --git a/target/linux/generic/pending-5.15/630-packet_socket_type.patch b/target/linux/generic/pending-5.15/630-packet_socket_type.patch
index c61935ffb05f3d..ee13ce2a5c8d77 100644
--- a/target/linux/generic/pending-5.15/630-packet_socket_type.patch
+++ b/target/linux/generic/pending-5.15/630-packet_socket_type.patch
@@ -30,7 +30,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #define PACKET_FANOUT_LB		1
 --- a/net/packet/af_packet.c
 +++ b/net/packet/af_packet.c
-@@ -1825,6 +1825,7 @@ static int packet_rcv_spkt(struct sk_buf
+@@ -1826,6 +1826,7 @@ static int packet_rcv_spkt(struct sk_buf
  {
  	struct sock *sk;
  	struct sockaddr_pkt *spkt;
@@ -38,7 +38,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	/*
  	 *	When we registered the protocol we saved the socket in the data
-@@ -1832,6 +1833,7 @@ static int packet_rcv_spkt(struct sk_buf
+@@ -1833,6 +1834,7 @@ static int packet_rcv_spkt(struct sk_buf
  	 */
  
  	sk = pt->af_packet_priv;
@@ -46,7 +46,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	/*
  	 *	Yank back the headers [hope the device set this
-@@ -1844,7 +1846,7 @@ static int packet_rcv_spkt(struct sk_buf
+@@ -1845,7 +1847,7 @@ static int packet_rcv_spkt(struct sk_buf
  	 *	so that this procedure is noop.
  	 */
  
@@ -55,7 +55,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		goto out;
  
  	if (!net_eq(dev_net(dev), sock_net(sk)))
-@@ -2082,12 +2084,12 @@ static int packet_rcv(struct sk_buff *sk
+@@ -2091,12 +2093,12 @@ static int packet_rcv(struct sk_buff *sk
  	unsigned int snaplen, res;
  	bool is_drop_n_account = false;
  
@@ -71,7 +71,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!net_eq(dev_net(dev), sock_net(sk)))
  		goto drop;
  
-@@ -2213,12 +2215,12 @@ static int tpacket_rcv(struct sk_buff *s
+@@ -2222,12 +2224,12 @@ static int tpacket_rcv(struct sk_buff *s
  	BUILD_BUG_ON(TPACKET_ALIGN(sizeof(*h.h2)) != 32);
  	BUILD_BUG_ON(TPACKET_ALIGN(sizeof(*h.h3)) != 48);
  
@@ -87,7 +87,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!net_eq(dev_net(dev), sock_net(sk)))
  		goto drop;
  
-@@ -3330,6 +3332,7 @@ static int packet_create(struct net *net
+@@ -3342,6 +3344,7 @@ static int packet_create(struct net *net
  	mutex_init(&po->pg_vec_lock);
  	po->rollover = NULL;
  	po->prot_hook.func = packet_rcv;
@@ -95,8 +95,8 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	if (sock->type == SOCK_PACKET)
  		po->prot_hook.func = packet_rcv_spkt;
-@@ -3971,6 +3974,16 @@ packet_setsockopt(struct socket *sock, i
- 		po->xmit = val ? packet_direct_xmit : dev_queue_xmit;
+@@ -3979,6 +3982,16 @@ packet_setsockopt(struct socket *sock, i
+ 		WRITE_ONCE(po->xmit, val ? packet_direct_xmit : dev_queue_xmit);
  		return 0;
  	}
 +	case PACKET_RECV_TYPE:
@@ -112,7 +112,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	default:
  		return -ENOPROTOOPT;
  	}
-@@ -4027,6 +4040,13 @@ static int packet_getsockopt(struct sock
+@@ -4035,6 +4048,13 @@ static int packet_getsockopt(struct sock
  	case PACKET_VNET_HDR:
  		val = po->has_vnet_hdr;
  		break;
@@ -128,7 +128,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		break;
 --- a/net/packet/internal.h
 +++ b/net/packet/internal.h
-@@ -137,6 +137,7 @@ struct packet_sock {
+@@ -136,6 +136,7 @@ struct packet_sock {
  	int			(*xmit)(struct sk_buff *skb);
  	struct packet_type	prot_hook ____cacheline_aligned_in_smp;
  	atomic_t		tp_drops ____cacheline_aligned_in_smp;
diff --git a/target/linux/generic/pending-5.15/655-increase_skb_pad.patch b/target/linux/generic/pending-5.15/655-increase_skb_pad.patch
index e3dd249d11843c..5d100270a90786 100644
--- a/target/linux/generic/pending-5.15/655-increase_skb_pad.patch
+++ b/target/linux/generic/pending-5.15/655-increase_skb_pad.patch
@@ -9,7 +9,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -2790,7 +2790,7 @@ static inline int pskb_network_may_pull(
+@@ -2821,7 +2821,7 @@ static inline int pskb_network_may_pull(
   * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
   */
  #ifndef NET_SKB_PAD
diff --git a/target/linux/generic/pending-5.15/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch b/target/linux/generic/pending-5.15/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
index 09efa1e72fe24f..2f6fbd59e4365e 100644
--- a/target/linux/generic/pending-5.15/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
+++ b/target/linux/generic/pending-5.15/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
@@ -338,7 +338,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
  		return -1;
  
-@@ -1525,6 +1686,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
+@@ -1526,6 +1687,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
  	t->parms.link = p->link;
  	t->parms.proto = p->proto;
  	t->parms.fwmark = p->fwmark;
@@ -353,7 +353,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	dst_cache_reset(&t->dst_cache);
  	ip6_tnl_link_config(t);
  	return 0;
-@@ -1563,6 +1732,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
+@@ -1564,6 +1733,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
  	p->flowinfo = u->flowinfo;
  	p->link = u->link;
  	p->proto = u->proto;
@@ -361,7 +361,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	memcpy(p->name, u->name, sizeof(u->name));
  }
  
-@@ -1949,6 +2119,15 @@ static int ip6_tnl_validate(struct nlatt
+@@ -1950,6 +2120,15 @@ static int ip6_tnl_validate(struct nlatt
  	return 0;
  }
  
@@ -377,7 +377,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  static void ip6_tnl_netlink_parms(struct nlattr *data[],
  				  struct __ip6_tnl_parm *parms)
  {
-@@ -1986,6 +2165,46 @@ static void ip6_tnl_netlink_parms(struct
+@@ -1987,6 +2166,46 @@ static void ip6_tnl_netlink_parms(struct
  
  	if (data[IFLA_IPTUN_FWMARK])
  		parms->fwmark = nla_get_u32(data[IFLA_IPTUN_FWMARK]);
@@ -424,7 +424,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  }
  
  static bool ip6_tnl_netlink_encap_parms(struct nlattr *data[],
-@@ -2101,6 +2320,12 @@ static void ip6_tnl_dellink(struct net_d
+@@ -2102,6 +2321,12 @@ static void ip6_tnl_dellink(struct net_d
  
  static size_t ip6_tnl_get_size(const struct net_device *dev)
  {
@@ -437,7 +437,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	return
  		/* IFLA_IPTUN_LINK */
  		nla_total_size(4) +
-@@ -2130,6 +2355,24 @@ static size_t ip6_tnl_get_size(const str
+@@ -2131,6 +2356,24 @@ static size_t ip6_tnl_get_size(const str
  		nla_total_size(0) +
  		/* IFLA_IPTUN_FWMARK */
  		nla_total_size(4) +
@@ -462,7 +462,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  		0;
  }
  
-@@ -2137,6 +2380,9 @@ static int ip6_tnl_fill_info(struct sk_b
+@@ -2138,6 +2381,9 @@ static int ip6_tnl_fill_info(struct sk_b
  {
  	struct ip6_tnl *tunnel = netdev_priv(dev);
  	struct __ip6_tnl_parm *parm = &tunnel->parms;
@@ -472,7 +472,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  
  	if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
  	    nla_put_in6_addr(skb, IFLA_IPTUN_LOCAL, &parm->laddr) ||
-@@ -2146,9 +2392,27 @@ static int ip6_tnl_fill_info(struct sk_b
+@@ -2147,9 +2393,27 @@ static int ip6_tnl_fill_info(struct sk_b
  	    nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) ||
  	    nla_put_u32(skb, IFLA_IPTUN_FLAGS, parm->flags) ||
  	    nla_put_u8(skb, IFLA_IPTUN_PROTO, parm->proto) ||
@@ -501,7 +501,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	if (nla_put_u16(skb, IFLA_IPTUN_ENCAP_TYPE, tunnel->encap.type) ||
  	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_SPORT, tunnel->encap.sport) ||
  	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_DPORT, tunnel->encap.dport) ||
-@@ -2188,6 +2452,7 @@ static const struct nla_policy ip6_tnl_p
+@@ -2189,6 +2453,7 @@ static const struct nla_policy ip6_tnl_p
  	[IFLA_IPTUN_ENCAP_DPORT]	= { .type = NLA_U16 },
  	[IFLA_IPTUN_COLLECT_METADATA]	= { .type = NLA_FLAG },
  	[IFLA_IPTUN_FWMARK]		= { .type = NLA_U32 },
diff --git a/target/linux/generic/pending-5.15/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch b/target/linux/generic/pending-5.15/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
index ac4396209efb4b..86bd9664e55552 100644
--- a/target/linux/generic/pending-5.15/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
+++ b/target/linux/generic/pending-5.15/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
@@ -53,7 +53,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  
 --- a/net/ipv4/fib_semantics.c
 +++ b/net/ipv4/fib_semantics.c
-@@ -142,6 +142,10 @@ const struct fib_prop fib_props[RTN_MAX
+@@ -143,6 +143,10 @@ const struct fib_prop fib_props[RTN_MAX
  		.error	= -EINVAL,
  		.scope	= RT_SCOPE_NOWHERE,
  	},
@@ -66,7 +66,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  static void rt_fibinfo_free(struct rtable __rcu **rtp)
 --- a/net/ipv4/fib_trie.c
 +++ b/net/ipv4/fib_trie.c
-@@ -2770,6 +2770,7 @@ static const char *const rtn_type_names[
+@@ -2772,6 +2772,7 @@ static const char *const rtn_type_names[
  	[RTN_THROW] = "THROW",
  	[RTN_NAT] = "NAT",
  	[RTN_XRESOLVE] = "XRESOLVE",
@@ -185,7 +185,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		cfg->fc_flags |= RTF_REJECT;
  
  	if (rtm->rtm_type == RTN_LOCAL)
-@@ -6300,6 +6331,8 @@ static int ip6_route_dev_notify(struct n
+@@ -6301,6 +6332,8 @@ static int ip6_route_dev_notify(struct n
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  		net->ipv6.ip6_prohibit_entry->dst.dev = dev;
  		net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
@@ -194,7 +194,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
  		net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
  #endif
-@@ -6311,6 +6344,7 @@ static int ip6_route_dev_notify(struct n
+@@ -6312,6 +6345,7 @@ static int ip6_route_dev_notify(struct n
  		in6_dev_put_clear(&net->ipv6.ip6_null_entry->rt6i_idev);
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  		in6_dev_put_clear(&net->ipv6.ip6_prohibit_entry->rt6i_idev);
@@ -202,7 +202,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		in6_dev_put_clear(&net->ipv6.ip6_blk_hole_entry->rt6i_idev);
  #endif
  	}
-@@ -6502,6 +6536,8 @@ static int __net_init ip6_route_net_init
+@@ -6503,6 +6537,8 @@ static int __net_init ip6_route_net_init
  
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  	net->ipv6.fib6_has_custom_rules = false;
@@ -211,7 +211,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	net->ipv6.ip6_prohibit_entry = kmemdup(&ip6_prohibit_entry_template,
  					       sizeof(*net->ipv6.ip6_prohibit_entry),
  					       GFP_KERNEL);
-@@ -6512,11 +6548,21 @@ static int __net_init ip6_route_net_init
+@@ -6513,11 +6549,21 @@ static int __net_init ip6_route_net_init
  			 ip6_template_metrics, true);
  	INIT_LIST_HEAD(&net->ipv6.ip6_prohibit_entry->rt6i_uncached);
  
@@ -234,7 +234,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
  	dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
  			 ip6_template_metrics, true);
-@@ -6543,6 +6589,8 @@ out:
+@@ -6544,6 +6590,8 @@ out:
  	return ret;
  
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
@@ -243,7 +243,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  out_ip6_prohibit_entry:
  	kfree(net->ipv6.ip6_prohibit_entry);
  out_ip6_null_entry:
-@@ -6562,6 +6610,7 @@ static void __net_exit ip6_route_net_exi
+@@ -6563,6 +6611,7 @@ static void __net_exit ip6_route_net_exi
  	kfree(net->ipv6.ip6_null_entry);
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  	kfree(net->ipv6.ip6_prohibit_entry);
@@ -251,7 +251,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	kfree(net->ipv6.ip6_blk_hole_entry);
  #endif
  	dst_entries_destroy(&net->ipv6.ip6_dst_ops);
-@@ -6639,6 +6688,9 @@ void __init ip6_route_init_special_entri
+@@ -6646,6 +6695,9 @@ void __init ip6_route_init_special_entri
  	init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
  	init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
  	init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
diff --git a/target/linux/generic/pending-5.15/680-NET-skip-GRO-for-foreign-MAC-addresses.patch b/target/linux/generic/pending-5.15/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
index 233d7b65637404..4ccf229026a288 100644
--- a/target/linux/generic/pending-5.15/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
+++ b/target/linux/generic/pending-5.15/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
@@ -11,7 +11,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/include/linux/netdevice.h
 +++ b/include/linux/netdevice.h
-@@ -2089,6 +2089,8 @@ struct net_device {
+@@ -2101,6 +2101,8 @@ struct net_device {
  	struct netdev_hw_addr_list	mc;
  	struct netdev_hw_addr_list	dev_addrs;
  
@@ -22,7 +22,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #endif
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -890,6 +890,7 @@ struct sk_buff {
+@@ -893,6 +893,7 @@ struct sk_buff {
  #ifdef CONFIG_IPV6_NDISC_NODETYPE
  	__u8			ndisc_nodetype:2;
  #endif
@@ -32,7 +32,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	__u8			inner_protocol_type:1;
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -6063,6 +6063,9 @@ static enum gro_result dev_gro_receive(s
+@@ -6069,6 +6069,9 @@ static enum gro_result dev_gro_receive(s
  	int same_flow;
  	int grow;
  
@@ -42,7 +42,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (netif_elide_gro(skb->dev))
  		goto normal;
  
-@@ -8077,6 +8080,48 @@ static void __netdev_adjacent_dev_unlink
+@@ -8083,6 +8086,48 @@ static void __netdev_adjacent_dev_unlink
  					   &upper_dev->adj_list.lower);
  }
  
@@ -91,7 +91,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static int __netdev_upper_dev_link(struct net_device *dev,
  				   struct net_device *upper_dev, bool master,
  				   void *upper_priv, void *upper_info,
-@@ -8128,6 +8173,7 @@ static int __netdev_upper_dev_link(struc
+@@ -8134,6 +8179,7 @@ static int __netdev_upper_dev_link(struc
  	if (ret)
  		return ret;
  
@@ -99,7 +99,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	ret = call_netdevice_notifiers_info(NETDEV_CHANGEUPPER,
  					    &changeupper_info.info);
  	ret = notifier_to_errno(ret);
-@@ -8224,6 +8270,7 @@ static void __netdev_upper_dev_unlink(st
+@@ -8230,6 +8276,7 @@ static void __netdev_upper_dev_unlink(st
  
  	__netdev_adjacent_dev_unlink_neighbour(dev, upper_dev);
  
@@ -107,7 +107,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	call_netdevice_notifiers_info(NETDEV_CHANGEUPPER,
  				      &changeupper_info.info);
  
-@@ -9043,6 +9090,7 @@ int dev_set_mac_address(struct net_devic
+@@ -9049,6 +9096,7 @@ int dev_set_mac_address(struct net_devic
  	if (err)
  		return err;
  	dev->addr_assign_type = NET_ADDR_SET;
diff --git a/target/linux/generic/pending-5.15/684-of_net-do-mac-address-increment-only-once.patch b/target/linux/generic/pending-5.15/684-of_net-do-mac-address-increment-only-once.patch
new file mode 100644
index 00000000000000..44d88e31a2e750
--- /dev/null
+++ b/target/linux/generic/pending-5.15/684-of_net-do-mac-address-increment-only-once.patch
@@ -0,0 +1,31 @@
+From dd07dd394d8bfdb5d527fab18ca54f20815ec4e4 Mon Sep 17 00:00:00 2001
+From: Will Moss <willormos@gmail.com>
+Date: Wed, 3 Aug 2022 13:48:55 +0000
+Subject: [PATCH] of_net: do mac-address-increment only once
+
+Remove mac-address-increment and mac-address-increment-byte
+DT property after incrementing process to make sure MAC address
+would not get incremented more if this function is stared again.
+It could happen if device initialization is deferred after
+unsuccessful attempt.
+
+Signed-off-by: Will Moss <willormos@gmail.com>
+---
+ drivers/of/of_net.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/core/of_net.c
++++ b/net/core/of_net.c
+@@ -194,6 +194,12 @@ found:
+ 		addr[3] = (mac_val >> 16) & 0xff;
+ 		addr[4] = (mac_val >> 8) & 0xff;
+ 		addr[5] = (mac_val >> 0) & 0xff;
++
++		/* Remove mac-address-increment and mac-address-increment-byte
++		 * DT property to make sure MAC address would not get incremented
++		 * more if this function is stared again. */
++		of_remove_property(np, of_find_property(np, "mac-address-increment", NULL));
++		of_remove_property(np, of_find_property(np, "mac-address-increment-byte", NULL));
+ 	}
+ 
+ 	of_add_mac_address(np, addr);
diff --git a/target/linux/generic/pending-5.15/700-netfilter-nft_flow_offload-handle-netdevice-events-f.patch b/target/linux/generic/pending-5.15/700-netfilter-nft_flow_offload-handle-netdevice-events-f.patch
new file mode 100644
index 00000000000000..488c6a8d92c7dd
--- /dev/null
+++ b/target/linux/generic/pending-5.15/700-netfilter-nft_flow_offload-handle-netdevice-events-f.patch
@@ -0,0 +1,106 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Thu, 25 Jan 2018 12:58:55 +0100
+Subject: [PATCH] netfilter: nft_flow_offload: handle netdevice events from
+ nf_flow_table
+
+Move the code that deals with device events to the core.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -613,13 +613,41 @@ void nf_flow_table_free(struct nf_flowta
+ }
+ EXPORT_SYMBOL_GPL(nf_flow_table_free);
+ 
++static int nf_flow_table_netdev_event(struct notifier_block *this,
++				      unsigned long event, void *ptr)
++{
++	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
++
++	if (event != NETDEV_DOWN)
++		return NOTIFY_DONE;
++
++	nf_flow_table_cleanup(dev);
++
++	return NOTIFY_DONE;
++}
++
++static struct notifier_block flow_offload_netdev_notifier = {
++	.notifier_call	= nf_flow_table_netdev_event,
++};
++
+ static int __init nf_flow_table_module_init(void)
+ {
+-	return nf_flow_table_offload_init();
++	int ret;
++
++	ret = nf_flow_table_offload_init();
++	if (ret)
++		return ret;
++
++	ret = register_netdevice_notifier(&flow_offload_netdev_notifier);
++	if (ret)
++		nf_flow_table_offload_exit();
++
++	return ret;
+ }
+ 
+ static void __exit nf_flow_table_module_exit(void)
+ {
++	unregister_netdevice_notifier(&flow_offload_netdev_notifier);
+ 	nf_flow_table_offload_exit();
+ }
+ 
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -444,47 +444,14 @@ static struct nft_expr_type nft_flow_off
+ 	.owner		= THIS_MODULE,
+ };
+ 
+-static int flow_offload_netdev_event(struct notifier_block *this,
+-				     unsigned long event, void *ptr)
+-{
+-	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+-
+-	if (event != NETDEV_DOWN)
+-		return NOTIFY_DONE;
+-
+-	nf_flow_table_cleanup(dev);
+-
+-	return NOTIFY_DONE;
+-}
+-
+-static struct notifier_block flow_offload_netdev_notifier = {
+-	.notifier_call	= flow_offload_netdev_event,
+-};
+-
+ static int __init nft_flow_offload_module_init(void)
+ {
+-	int err;
+-
+-	err = register_netdevice_notifier(&flow_offload_netdev_notifier);
+-	if (err)
+-		goto err;
+-
+-	err = nft_register_expr(&nft_flow_offload_type);
+-	if (err < 0)
+-		goto register_expr;
+-
+-	return 0;
+-
+-register_expr:
+-	unregister_netdevice_notifier(&flow_offload_netdev_notifier);
+-err:
+-	return err;
++	return nft_register_expr(&nft_flow_offload_type);
+ }
+ 
+ static void __exit nft_flow_offload_module_exit(void)
+ {
+ 	nft_unregister_expr(&nft_flow_offload_type);
+-	unregister_netdevice_notifier(&flow_offload_netdev_notifier);
+ }
+ 
+ module_init(nft_flow_offload_module_init);
diff --git a/target/linux/generic/pending-5.15/702-net-ethernet-mtk_eth_soc-enable-threaded-NAPI.patch b/target/linux/generic/pending-5.15/702-net-ethernet-mtk_eth_soc-enable-threaded-NAPI.patch
index 298122375fd34d..a4e3d2650333eb 100644
--- a/target/linux/generic/pending-5.15/702-net-ethernet-mtk_eth_soc-enable-threaded-NAPI.patch
+++ b/target/linux/generic/pending-5.15/702-net-ethernet-mtk_eth_soc-enable-threaded-NAPI.patch
@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -2383,8 +2383,8 @@ static irqreturn_t mtk_handle_irq_rx(int
+@@ -2992,8 +2992,8 @@ static irqreturn_t mtk_handle_irq_rx(int
  
  	eth->rx_events++;
  	if (likely(napi_schedule_prep(&eth->rx_napi))) {
@@ -20,7 +20,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	}
  
  	return IRQ_HANDLED;
-@@ -2396,8 +2396,8 @@ static irqreturn_t mtk_handle_irq_tx(int
+@@ -3005,8 +3005,8 @@ static irqreturn_t mtk_handle_irq_tx(int
  
  	eth->tx_events++;
  	if (likely(napi_schedule_prep(&eth->tx_napi))) {
@@ -30,7 +30,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	}
  
  	return IRQ_HANDLED;
-@@ -3587,6 +3587,8 @@ static int mtk_probe(struct platform_dev
+@@ -4673,6 +4673,8 @@ static int mtk_probe(struct platform_dev
  	 * for NAPI to work
  	 */
  	init_dummy_netdev(&eth->dummy_dev);
diff --git a/target/linux/generic/pending-5.15/703-phy-add-detach-callback-to-struct-phy_driver.patch b/target/linux/generic/pending-5.15/703-phy-add-detach-callback-to-struct-phy_driver.patch
index d6e7f40f3b6741..83587b5c931533 100644
--- a/target/linux/generic/pending-5.15/703-phy-add-detach-callback-to-struct-phy_driver.patch
+++ b/target/linux/generic/pending-5.15/703-phy-add-detach-callback-to-struct-phy_driver.patch
@@ -11,7 +11,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
-@@ -1744,6 +1744,9 @@ void phy_detach(struct phy_device *phyde
+@@ -1751,6 +1751,9 @@ void phy_detach(struct phy_device *phyde
  	struct module *ndev_owner = NULL;
  	struct mii_bus *bus;
  
@@ -23,7 +23,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  			sysfs_remove_link(&dev->dev.kobj, "phydev");
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -823,6 +823,12 @@ struct phy_driver {
+@@ -843,6 +843,12 @@ struct phy_driver {
  	/** @handle_interrupt: Override default interrupt handling */
  	irqreturn_t (*handle_interrupt)(struct phy_device *phydev);
  
diff --git a/target/linux/generic/pending-5.15/704-01-v6.4-net-mvneta-fix-transmit-path-dma-unmapping-on-error.patch b/target/linux/generic/pending-5.15/704-01-v6.4-net-mvneta-fix-transmit-path-dma-unmapping-on-error.patch
new file mode 100644
index 00000000000000..287728ba1df5f7
--- /dev/null
+++ b/target/linux/generic/pending-5.15/704-01-v6.4-net-mvneta-fix-transmit-path-dma-unmapping-on-error.patch
@@ -0,0 +1,111 @@
+From d6d80269cf5c79f9dfe7d69f8b41a72015c89748 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Mon, 3 Apr 2023 19:30:20 +0100
+Subject: [PATCH 1/5] net: mvneta: fix transmit path dma-unmapping on error
+
+The transmit code assumes that the transmit descriptors that are used
+begin with the first descriptor in the ring, but this may not be the
+case. Fix this by providing a new function that dma-unmaps a range of
+numbered descriptor entries, and use that to do the unmapping.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 53 +++++++++++++++++----------
+ 1 file changed, 33 insertions(+), 20 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -2647,14 +2647,40 @@ mvneta_tso_put_data(struct net_device *d
+ 	return 0;
+ }
+ 
++static void mvneta_release_descs(struct mvneta_port *pp,
++				 struct mvneta_tx_queue *txq,
++				 int first, int num)
++{
++	int desc_idx, i;
++
++	desc_idx = first + num;
++	if (desc_idx >= txq->size)
++		desc_idx -= txq->size;
++
++	for (i = num; i >= 0; i--) {
++		struct mvneta_tx_desc *tx_desc = txq->descs + desc_idx;
++
++		if (!IS_TSO_HEADER(txq, tx_desc->buf_phys_addr))
++			dma_unmap_single(pp->dev->dev.parent,
++					 tx_desc->buf_phys_addr,
++					 tx_desc->data_size,
++					 DMA_TO_DEVICE);
++
++		mvneta_txq_desc_put(txq);
++
++		if (desc_idx == 0)
++			desc_idx = txq->size;
++		desc_idx -= 1;
++	}
++}
++
+ static int mvneta_tx_tso(struct sk_buff *skb, struct net_device *dev,
+ 			 struct mvneta_tx_queue *txq)
+ {
+ 	int hdr_len, total_len, data_left;
+-	int desc_count = 0;
++	int first_desc, desc_count = 0;
+ 	struct mvneta_port *pp = netdev_priv(dev);
+ 	struct tso_t tso;
+-	int i;
+ 
+ 	/* Count needed descriptors */
+ 	if ((txq->count + tso_count_descs(skb)) >= txq->size)
+@@ -2665,6 +2691,8 @@ static int mvneta_tx_tso(struct sk_buff
+ 		return 0;
+ 	}
+ 
++	first_desc = txq->txq_put_index;
++
+ 	/* Initialize the TSO handler, and prepare the first payload */
+ 	hdr_len = tso_start(skb, &tso);
+ 
+@@ -2705,15 +2733,7 @@ err_release:
+ 	/* Release all used data descriptors; header descriptors must not
+ 	 * be DMA-unmapped.
+ 	 */
+-	for (i = desc_count - 1; i >= 0; i--) {
+-		struct mvneta_tx_desc *tx_desc = txq->descs + i;
+-		if (!IS_TSO_HEADER(txq, tx_desc->buf_phys_addr))
+-			dma_unmap_single(pp->dev->dev.parent,
+-					 tx_desc->buf_phys_addr,
+-					 tx_desc->data_size,
+-					 DMA_TO_DEVICE);
+-		mvneta_txq_desc_put(txq);
+-	}
++	mvneta_release_descs(pp, txq, first_desc, desc_count - 1);
+ 	return 0;
+ }
+ 
+@@ -2723,6 +2743,7 @@ static int mvneta_tx_frag_process(struct
+ {
+ 	struct mvneta_tx_desc *tx_desc;
+ 	int i, nr_frags = skb_shinfo(skb)->nr_frags;
++	int first_desc = txq->txq_put_index;
+ 
+ 	for (i = 0; i < nr_frags; i++) {
+ 		struct mvneta_tx_buf *buf = &txq->buf[txq->txq_put_index];
+@@ -2761,15 +2782,7 @@ error:
+ 	/* Release all descriptors that were used to map fragments of
+ 	 * this packet, as well as the corresponding DMA mappings
+ 	 */
+-	for (i = i - 1; i >= 0; i--) {
+-		tx_desc = txq->descs + i;
+-		dma_unmap_single(pp->dev->dev.parent,
+-				 tx_desc->buf_phys_addr,
+-				 tx_desc->data_size,
+-				 DMA_TO_DEVICE);
+-		mvneta_txq_desc_put(txq);
+-	}
+-
++	mvneta_release_descs(pp, txq, first_desc, i - 1);
+ 	return -ENOMEM;
+ }
+ 
diff --git a/target/linux/generic/pending-5.15/704-02-v6.4-net-mvneta-mark-mapped-and-tso-buffers-separately.patch b/target/linux/generic/pending-5.15/704-02-v6.4-net-mvneta-mark-mapped-and-tso-buffers-separately.patch
new file mode 100644
index 00000000000000..4db3ffe4e149d4
--- /dev/null
+++ b/target/linux/generic/pending-5.15/704-02-v6.4-net-mvneta-mark-mapped-and-tso-buffers-separately.patch
@@ -0,0 +1,42 @@
+From e3c77d0a1b635d114c147fd2078afb57ed558b81 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Mon, 3 Apr 2023 19:30:25 +0100
+Subject: [PATCH 2/5] net: mvneta: mark mapped and tso buffers separately
+
+Mark dma-mapped skbs and TSO buffers separately, so we can use
+buf->type to identify their differences.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -607,6 +607,7 @@ struct mvneta_rx_desc {
+ #endif
+ 
+ enum mvneta_tx_buf_type {
++	MVNETA_TYPE_TSO,
+ 	MVNETA_TYPE_SKB,
+ 	MVNETA_TYPE_XDP_TX,
+ 	MVNETA_TYPE_XDP_NDO,
+@@ -1852,7 +1853,8 @@ static void mvneta_txq_bufs_free(struct
+ 			dma_unmap_single(pp->dev->dev.parent,
+ 					 tx_desc->buf_phys_addr,
+ 					 tx_desc->data_size, DMA_TO_DEVICE);
+-		if (buf->type == MVNETA_TYPE_SKB && buf->skb) {
++		if ((buf->type == MVNETA_TYPE_TSO ||
++		     buf->type == MVNETA_TYPE_SKB) && buf->skb) {
+ 			bytes_compl += buf->skb->len;
+ 			pkts_compl++;
+ 			dev_kfree_skb_any(buf->skb);
+@@ -2607,7 +2609,7 @@ mvneta_tso_put_hdr(struct sk_buff *skb,
+ 	tx_desc->command |= MVNETA_TXD_F_DESC;
+ 	tx_desc->buf_phys_addr = txq->tso_hdrs_phys +
+ 				 txq->txq_put_index * TSO_HEADER_SIZE;
+-	buf->type = MVNETA_TYPE_SKB;
++	buf->type = MVNETA_TYPE_TSO;
+ 	buf->skb = NULL;
+ 
+ 	mvneta_txq_inc_put(txq);
diff --git a/target/linux/generic/pending-5.15/704-03-v6.4-net-mvneta-use-buf-type-to-determine-whether-to-dma-.patch b/target/linux/generic/pending-5.15/704-03-v6.4-net-mvneta-use-buf-type-to-determine-whether-to-dma-.patch
new file mode 100644
index 00000000000000..37511ff1dd75e4
--- /dev/null
+++ b/target/linux/generic/pending-5.15/704-03-v6.4-net-mvneta-use-buf-type-to-determine-whether-to-dma-.patch
@@ -0,0 +1,59 @@
+From fe2abc1abc0dfc6c13fe8f189216f00dbbb33044 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Mon, 3 Apr 2023 19:30:30 +0100
+Subject: [PATCH 3/5] net: mvneta: use buf->type to determine whether to
+ dma-unmap
+
+Now that we use a different buffer type for TSO headers, we can use
+buf->type to determine whether the original buffer was DMA-mapped or
+not. The rules are:
+
+	MVNETA_TYPE_XDP_TX - from a DMA pool, no unmap is required
+	MVNETA_TYPE_XDP_NDO - dma_map_single()'d
+	MVNETA_TYPE_SKB - normal skbuff, dma_map_single()'d
+	MVNETA_TYPE_TSO - from the TSO buffer area
+
+This means we only need to call dma_unmap_single() on the XDP_NDO and
+SKB types of buffer, and we no longer need the private IS_TSO_HEADER()
+which relies on the TSO region being contiguously allocated.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -334,10 +334,6 @@
+ 			 MVNETA_SKB_HEADROOM))
+ #define MVNETA_MAX_RX_BUF_SIZE	(PAGE_SIZE - MVNETA_SKB_PAD)
+ 
+-#define IS_TSO_HEADER(txq, addr) \
+-	((addr >= txq->tso_hdrs_phys) && \
+-	 (addr < txq->tso_hdrs_phys + txq->size * TSO_HEADER_SIZE))
+-
+ #define MVNETA_RX_GET_BM_POOL_ID(rxd) \
+ 	(((rxd)->status & MVNETA_RXD_BM_POOL_MASK) >> MVNETA_RXD_BM_POOL_SHIFT)
+ 
+@@ -1848,8 +1844,8 @@ static void mvneta_txq_bufs_free(struct
+ 
+ 		mvneta_txq_inc_get(txq);
+ 
+-		if (!IS_TSO_HEADER(txq, tx_desc->buf_phys_addr) &&
+-		    buf->type != MVNETA_TYPE_XDP_TX)
++		if (buf->type == MVNETA_TYPE_XDP_NDO ||
++		    buf->type == MVNETA_TYPE_SKB)
+ 			dma_unmap_single(pp->dev->dev.parent,
+ 					 tx_desc->buf_phys_addr,
+ 					 tx_desc->data_size, DMA_TO_DEVICE);
+@@ -2661,8 +2657,9 @@ static void mvneta_release_descs(struct
+ 
+ 	for (i = num; i >= 0; i--) {
+ 		struct mvneta_tx_desc *tx_desc = txq->descs + desc_idx;
++		struct mvneta_tx_buf *buf = &txq->buf[desc_idx];
+ 
+-		if (!IS_TSO_HEADER(txq, tx_desc->buf_phys_addr))
++		if (buf->type == MVNETA_TYPE_SKB)
+ 			dma_unmap_single(pp->dev->dev.parent,
+ 					 tx_desc->buf_phys_addr,
+ 					 tx_desc->data_size,
diff --git a/target/linux/generic/pending-5.15/704-04-v6.4-net-mvneta-move-tso_build_hdr-into-mvneta_tso_put_hd.patch b/target/linux/generic/pending-5.15/704-04-v6.4-net-mvneta-move-tso_build_hdr-into-mvneta_tso_put_hd.patch
new file mode 100644
index 00000000000000..444b60f15166d0
--- /dev/null
+++ b/target/linux/generic/pending-5.15/704-04-v6.4-net-mvneta-move-tso_build_hdr-into-mvneta_tso_put_hd.patch
@@ -0,0 +1,65 @@
+From 210ca75d4949f1ace8ea53a75148806cc28224a0 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Mon, 3 Apr 2023 19:30:35 +0100
+Subject: [PATCH 4/5] net: mvneta: move tso_build_hdr() into
+ mvneta_tso_put_hdr()
+
+Move tso_build_hdr() into mvneta_tso_put_hdr() so that all the TSO
+header building code is in one place.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -2592,19 +2592,24 @@ err_drop_frame:
+ 	return rx_done;
+ }
+ 
+-static inline void
+-mvneta_tso_put_hdr(struct sk_buff *skb, struct mvneta_tx_queue *txq)
++static void mvneta_tso_put_hdr(struct sk_buff *skb, struct mvneta_tx_queue *txq,
++			       struct tso_t *tso, int size, bool is_last)
+ {
+-	int hdr_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
++	int tso_offset, hdr_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
+ 	struct mvneta_tx_buf *buf = &txq->buf[txq->txq_put_index];
+ 	struct mvneta_tx_desc *tx_desc;
++	char *hdr;
++
++	tso_offset = txq->txq_put_index * TSO_HEADER_SIZE;
++
++	hdr = txq->tso_hdrs + tso_offset;
++	tso_build_hdr(skb, hdr, tso, size, is_last);
+ 
+ 	tx_desc = mvneta_txq_next_desc_get(txq);
+ 	tx_desc->data_size = hdr_len;
+ 	tx_desc->command = mvneta_skb_tx_csum(skb);
+ 	tx_desc->command |= MVNETA_TXD_F_DESC;
+-	tx_desc->buf_phys_addr = txq->tso_hdrs_phys +
+-				 txq->txq_put_index * TSO_HEADER_SIZE;
++	tx_desc->buf_phys_addr = txq->tso_hdrs_phys + tso_offset;
+ 	buf->type = MVNETA_TYPE_TSO;
+ 	buf->skb = NULL;
+ 
+@@ -2697,17 +2702,12 @@ static int mvneta_tx_tso(struct sk_buff
+ 
+ 	total_len = skb->len - hdr_len;
+ 	while (total_len > 0) {
+-		char *hdr;
+-
+ 		data_left = min_t(int, skb_shinfo(skb)->gso_size, total_len);
+ 		total_len -= data_left;
+ 		desc_count++;
+ 
+ 		/* prepare packet headers: MAC + IP + TCP */
+-		hdr = txq->tso_hdrs + txq->txq_put_index * TSO_HEADER_SIZE;
+-		tso_build_hdr(skb, hdr, &tso, data_left, total_len == 0);
+-
+-		mvneta_tso_put_hdr(skb, txq);
++		mvneta_tso_put_hdr(skb, txq, &tso, data_left, total_len == 0);
+ 
+ 		while (data_left > 0) {
+ 			int size;
diff --git a/target/linux/generic/pending-5.15/704-05-v6.4-net-mvneta-allocate-TSO-header-DMA-memory-in-chunks.patch b/target/linux/generic/pending-5.15/704-05-v6.4-net-mvneta-allocate-TSO-header-DMA-memory-in-chunks.patch
new file mode 100644
index 00000000000000..395a0bf5d2b8d4
--- /dev/null
+++ b/target/linux/generic/pending-5.15/704-05-v6.4-net-mvneta-allocate-TSO-header-DMA-memory-in-chunks.patch
@@ -0,0 +1,179 @@
+From 58d50fb089da553023df5a05f5ae86feaacc7f24 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Mon, 3 Apr 2023 19:30:40 +0100
+Subject: [PATCH 5/5] net: mvneta: allocate TSO header DMA memory in chunks
+
+Now that we no longer need to check whether the DMA address is within
+the TSO header DMA memory range for the queue, we can allocate the TSO
+header DMA memory in chunks rather than one contiguous order-6 chunk,
+which can stress the kernel's memory subsystems to allocate.
+
+Instead, use order-1 (8k) allocations, which will result in 32 order-1
+pages containing 32 TSO headers.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 88 +++++++++++++++++++++------
+ 1 file changed, 70 insertions(+), 18 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -314,6 +314,15 @@
+ 
+ #define MVNETA_MAX_SKB_DESCS (MVNETA_MAX_TSO_SEGS * 2 + MAX_SKB_FRAGS)
+ 
++/* The size of a TSO header page */
++#define MVNETA_TSO_PAGE_SIZE (2 * PAGE_SIZE)
++
++/* Number of TSO headers per page. This should be a power of 2 */
++#define MVNETA_TSO_PER_PAGE (MVNETA_TSO_PAGE_SIZE / TSO_HEADER_SIZE)
++
++/* Maximum number of TSO header pages */
++#define MVNETA_MAX_TSO_PAGES (MVNETA_MAX_TXD / MVNETA_TSO_PER_PAGE)
++
+ /* descriptor aligned size */
+ #define MVNETA_DESC_ALIGNED_SIZE	32
+ 
+@@ -656,10 +665,10 @@ struct mvneta_tx_queue {
+ 	int next_desc_to_proc;
+ 
+ 	/* DMA buffers for TSO headers */
+-	char *tso_hdrs;
++	char *tso_hdrs[MVNETA_MAX_TSO_PAGES];
+ 
+ 	/* DMA address of TSO headers */
+-	dma_addr_t tso_hdrs_phys;
++	dma_addr_t tso_hdrs_phys[MVNETA_MAX_TSO_PAGES];
+ 
+ 	/* Affinity mask for CPUs*/
+ 	cpumask_t affinity_mask;
+@@ -2592,24 +2601,71 @@ err_drop_frame:
+ 	return rx_done;
+ }
+ 
++static void mvneta_free_tso_hdrs(struct mvneta_port *pp,
++				 struct mvneta_tx_queue *txq)
++{
++	struct device *dev = pp->dev->dev.parent;
++	int i;
++
++	for (i = 0; i < MVNETA_MAX_TSO_PAGES; i++) {
++		if (txq->tso_hdrs[i]) {
++			dma_free_coherent(dev, MVNETA_TSO_PAGE_SIZE,
++					  txq->tso_hdrs[i],
++					  txq->tso_hdrs_phys[i]);
++			txq->tso_hdrs[i] = NULL;
++		}
++	}
++}
++
++static int mvneta_alloc_tso_hdrs(struct mvneta_port *pp,
++				 struct mvneta_tx_queue *txq)
++{
++	struct device *dev = pp->dev->dev.parent;
++	int i, num;
++
++	num = DIV_ROUND_UP(txq->size, MVNETA_TSO_PER_PAGE);
++	for (i = 0; i < num; i++) {
++		txq->tso_hdrs[i] = dma_alloc_coherent(dev, MVNETA_TSO_PAGE_SIZE,
++						      &txq->tso_hdrs_phys[i],
++						      GFP_KERNEL);
++		if (!txq->tso_hdrs[i]) {
++			mvneta_free_tso_hdrs(pp, txq);
++			return -ENOMEM;
++		}
++	}
++
++	return 0;
++}
++
++static char *mvneta_get_tso_hdr(struct mvneta_tx_queue *txq, dma_addr_t *dma)
++{
++	int index, offset;
++
++	index = txq->txq_put_index / MVNETA_TSO_PER_PAGE;
++	offset = (txq->txq_put_index % MVNETA_TSO_PER_PAGE) * TSO_HEADER_SIZE;
++
++	*dma = txq->tso_hdrs_phys[index] + offset;
++
++	return txq->tso_hdrs[index] + offset;
++}
++
+ static void mvneta_tso_put_hdr(struct sk_buff *skb, struct mvneta_tx_queue *txq,
+ 			       struct tso_t *tso, int size, bool is_last)
+ {
+-	int tso_offset, hdr_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
++	int hdr_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
+ 	struct mvneta_tx_buf *buf = &txq->buf[txq->txq_put_index];
+ 	struct mvneta_tx_desc *tx_desc;
++	dma_addr_t hdr_phys;
+ 	char *hdr;
+ 
+-	tso_offset = txq->txq_put_index * TSO_HEADER_SIZE;
+-
+-	hdr = txq->tso_hdrs + tso_offset;
++	hdr = mvneta_get_tso_hdr(txq, &hdr_phys);
+ 	tso_build_hdr(skb, hdr, tso, size, is_last);
+ 
+ 	tx_desc = mvneta_txq_next_desc_get(txq);
+ 	tx_desc->data_size = hdr_len;
+ 	tx_desc->command = mvneta_skb_tx_csum(skb);
+ 	tx_desc->command |= MVNETA_TXD_F_DESC;
+-	tx_desc->buf_phys_addr = txq->tso_hdrs_phys + tso_offset;
++	tx_desc->buf_phys_addr = hdr_phys;
+ 	buf->type = MVNETA_TYPE_TSO;
+ 	buf->skb = NULL;
+ 
+@@ -3401,7 +3457,7 @@ static void mvneta_rxq_deinit(struct mvn
+ static int mvneta_txq_sw_init(struct mvneta_port *pp,
+ 			      struct mvneta_tx_queue *txq)
+ {
+-	int cpu;
++	int cpu, err;
+ 
+ 	txq->size = pp->tx_ring_size;
+ 
+@@ -3426,11 +3482,9 @@ static int mvneta_txq_sw_init(struct mvn
+ 		return -ENOMEM;
+ 
+ 	/* Allocate DMA buffers for TSO MAC/IP/TCP headers */
+-	txq->tso_hdrs = dma_alloc_coherent(pp->dev->dev.parent,
+-					   txq->size * TSO_HEADER_SIZE,
+-					   &txq->tso_hdrs_phys, GFP_KERNEL);
+-	if (!txq->tso_hdrs)
+-		return -ENOMEM;
++	err = mvneta_alloc_tso_hdrs(pp, txq);
++	if (err)
++		return err;
+ 
+ 	/* Setup XPS mapping */
+ 	if (pp->neta_armada3700)
+@@ -3482,10 +3536,7 @@ static void mvneta_txq_sw_deinit(struct
+ 
+ 	kfree(txq->buf);
+ 
+-	if (txq->tso_hdrs)
+-		dma_free_coherent(pp->dev->dev.parent,
+-				  txq->size * TSO_HEADER_SIZE,
+-				  txq->tso_hdrs, txq->tso_hdrs_phys);
++	mvneta_free_tso_hdrs(pp, txq);
+ 	if (txq->descs)
+ 		dma_free_coherent(pp->dev->dev.parent,
+ 				  txq->size * MVNETA_DESC_ALIGNED_SIZE,
+@@ -3494,7 +3545,6 @@ static void mvneta_txq_sw_deinit(struct
+ 	netdev_tx_reset_queue(nq);
+ 
+ 	txq->buf               = NULL;
+-	txq->tso_hdrs          = NULL;
+ 	txq->descs             = NULL;
+ 	txq->last_desc         = 0;
+ 	txq->next_desc_to_proc = 0;
+@@ -5543,6 +5593,8 @@ static int __init mvneta_driver_init(voi
+ {
+ 	int ret;
+ 
++	BUILD_BUG_ON_NOT_POWER_OF_2(MVNETA_TSO_PER_PAGE);
++
+ 	ret = cpuhp_setup_state_multi(CPUHP_AP_ONLINE_DYN, "net/mvneta:online",
+ 				      mvneta_cpu_online,
+ 				      mvneta_cpu_down_prepare);
diff --git a/target/linux/generic/pending-5.15/705-net-dsa-tag_mtk-add-padding-for-tx-packets.patch b/target/linux/generic/pending-5.15/705-net-dsa-tag_mtk-add-padding-for-tx-packets.patch
index e27ac3595f52ad..d444b2027cb462 100644
--- a/target/linux/generic/pending-5.15/705-net-dsa-tag_mtk-add-padding-for-tx-packets.patch
+++ b/target/linux/generic/pending-5.15/705-net-dsa-tag_mtk-add-padding-for-tx-packets.patch
@@ -12,17 +12,16 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/dsa/tag_mtk.c
 +++ b/net/dsa/tag_mtk.c
-@@ -25,6 +25,14 @@ static struct sk_buff *mtk_tag_xmit(stru
- 	u8 xmit_tpid;
- 	u8 *mtk_tag;
+@@ -27,6 +27,13 @@ static struct sk_buff *mtk_tag_xmit(stru
+ 
+ 	skb_set_queue_mapping(skb, dp->index);
  
 +	/* The Ethernet switch we are interfaced with needs packets to be at
 +	 * least 64 bytes (including FCS) otherwise their padding might be
 +	 * corrupted. With tags enabled, we need to make sure that packets are
 +	 * at least 68 bytes (including FCS and tag).
 +	 */
-+	if (__skb_put_padto(skb, ETH_ZLEN + MTK_HDR_LEN, false))
-+		return NULL;
++	eth_skb_pad(skb);
 +
  	/* Build the special tag after the MAC Source Address. If VLAN header
  	 * is present, it's required that VLAN header and special tag is
diff --git a/target/linux/generic/pending-5.15/710-bridge-add-knob-for-filtering-rx-tx-BPDU-pack.patch b/target/linux/generic/pending-5.15/710-bridge-add-knob-for-filtering-rx-tx-BPDU-pack.patch
index 2a2ca7f1faeeba..7e8ed5455d9867 100644
--- a/target/linux/generic/pending-5.15/710-bridge-add-knob-for-filtering-rx-tx-BPDU-pack.patch
+++ b/target/linux/generic/pending-5.15/710-bridge-add-knob-for-filtering-rx-tx-BPDU-pack.patch
@@ -161,7 +161,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  struct rtnl_link {
  	rtnl_doit_func		doit;
-@@ -4700,7 +4700,9 @@ int ndo_dflt_bridge_getlink(struct sk_bu
+@@ -4706,7 +4706,9 @@ int ndo_dflt_bridge_getlink(struct sk_bu
  	    brport_nla_put_flag(skb, flags, mask,
  				IFLA_BRPORT_MCAST_FLOOD, BR_MCAST_FLOOD) ||
  	    brport_nla_put_flag(skb, flags, mask,
diff --git a/target/linux/generic/pending-5.15/721-net-phy-realtek-rtl8221-allow-to-configure-SERDES-mo.patch b/target/linux/generic/pending-5.15/721-net-phy-realtek-rtl8221-allow-to-configure-SERDES-mo.patch
index 703a0b8b72b24b..c93fe42273ea60 100644
--- a/target/linux/generic/pending-5.15/721-net-phy-realtek-rtl8221-allow-to-configure-SERDES-mo.patch
+++ b/target/linux/generic/pending-5.15/721-net-phy-realtek-rtl8221-allow-to-configure-SERDES-mo.patch
@@ -39,7 +39,7 @@ Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
  #define RTL8366RB_POWER_SAVE			0x15
  #define RTL8366RB_POWER_SAVE_ON			BIT(12)
  
-@@ -841,6 +850,43 @@ static irqreturn_t rtl9000a_handle_inter
+@@ -841,6 +850,48 @@ static irqreturn_t rtl9000a_handle_inter
  	return IRQ_HANDLED;
  }
  
@@ -48,8 +48,13 @@ Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
 +	u16 option_mode;
 +
 +	switch (phydev->interface) {
-+	case PHY_INTERFACE_MODE_SGMII:
 +	case PHY_INTERFACE_MODE_2500BASEX:
++		if (!phydev->is_c45) {
++			option_mode = RTL8221B_SERDES_OPTION_MODE_2500BASEX;
++			break;
++		}
++		fallthrough;
++	case PHY_INTERFACE_MODE_SGMII:
 +		option_mode = RTL8221B_SERDES_OPTION_MODE_2500BASEX_SGMII;
 +		break;
 +	default:
@@ -57,24 +62,24 @@ Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
 +	}
 +
 +	phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL,
-+                      0x75f3, 0);
++		      0x75f3, 0);
 +
 +	phy_modify_mmd_changed(phydev, RTL8221B_MMD_SERDES_CTRL,
 +			       RTL8221B_SERDES_OPTION,
 +			       RTL8221B_SERDES_OPTION_MODE_MASK, option_mode);
 +	switch (option_mode) {
-+        case RTL8221B_SERDES_OPTION_MODE_2500BASEX_SGMII:
-+        case RTL8221B_SERDES_OPTION_MODE_2500BASEX:
-+                phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x6a04, 0x0503);
-+                phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x6f10, 0xd455);
-+                phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x6f11, 0x8020);
-+                break;
-+        case RTL8221B_SERDES_OPTION_MODE_HISGMII_SGMII:
-+        case RTL8221B_SERDES_OPTION_MODE_HISGMII:
-+                phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x6a04, 0x0503);
-+                phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x6f10, 0xd433);
-+                phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x6f11, 0x8020);
-+                break;
++	case RTL8221B_SERDES_OPTION_MODE_2500BASEX_SGMII:
++	case RTL8221B_SERDES_OPTION_MODE_2500BASEX:
++		phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x6a04, 0x0503);
++		phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x6f10, 0xd455);
++		phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x6f11, 0x8020);
++		break;
++	case RTL8221B_SERDES_OPTION_MODE_HISGMII_SGMII:
++	case RTL8221B_SERDES_OPTION_MODE_HISGMII:
++		phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x6a04, 0x0503);
++		phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x6f10, 0xd433);
++		phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x6f11, 0x8020);
++		break;
 +	}
 +
 +	return 0;
@@ -83,19 +88,19 @@ Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
  static struct phy_driver realtek_drvs[] = {
  	{
  		PHY_ID_MATCH_EXACT(0x00008201),
-@@ -981,6 +1027,7 @@ static struct phy_driver realtek_drvs[]
+@@ -981,6 +1032,7 @@ static struct phy_driver realtek_drvs[]
  		PHY_ID_MATCH_EXACT(0x001cc849),
  		.name           = "RTL8221B-VB-CG 2.5Gbps PHY",
  		.get_features   = rtl822x_get_features,
-+		.config_init	= rtl8221b_config_init,
++		.config_init    = rtl8221b_config_init,
  		.config_aneg    = rtl822x_config_aneg,
  		.read_status    = rtl822x_read_status,
  		.suspend        = genphy_suspend,
-@@ -992,6 +1039,7 @@ static struct phy_driver realtek_drvs[]
+@@ -992,6 +1044,7 @@ static struct phy_driver realtek_drvs[]
  		.name           = "RTL8221B-VM-CG 2.5Gbps PHY",
  		.get_features   = rtl822x_get_features,
  		.config_aneg    = rtl822x_config_aneg,
-+		.config_init	= rtl8221b_config_init,
++		.config_init    = rtl8221b_config_init,
  		.read_status    = rtl822x_read_status,
  		.suspend        = genphy_suspend,
  		.resume         = rtlgen_resume,
diff --git a/target/linux/generic/pending-5.15/722-net-phy-realtek-support-switching-between-SGMII-and-.patch b/target/linux/generic/pending-5.15/722-net-phy-realtek-support-switching-between-SGMII-and-.patch
new file mode 100644
index 00000000000000..211a8ed297f86f
--- /dev/null
+++ b/target/linux/generic/pending-5.15/722-net-phy-realtek-support-switching-between-SGMII-and-.patch
@@ -0,0 +1,61 @@
+From 312753d0aadba0f58841ae513b80fdbabc887523 Mon Sep 17 00:00:00 2001
+From: Chukun Pan <amadeus@jmu.edu.cn>
+Date: Wed, 8 Feb 2023 16:32:18 +0800
+Subject: [PATCH] net: phy: realtek: support switching between SGMII and
+ 2500BASE-X for RTL822x series
+
+After commit ace6aba ("net: phy: realtek: rtl8221: allow to configure
+SERDES mode"), the rtl8221 phy can work in SGMII and 2500base-x modes
+respectively. So add interface automatic switching for rtl8221 phy to
+match various wire speeds.
+
+Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
+---
+ drivers/net/phy/realtek.c | 26 ++++++++++++++++++++++++--
+ 1 file changed, 24 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -676,6 +676,25 @@ static int rtl822x_config_aneg(struct ph
+ 	return __genphy_config_aneg(phydev, ret);
+ }
+ 
++static void rtl822x_update_interface(struct phy_device *phydev)
++{
++	/* Automatically switch SERDES interface between
++	 * SGMII and 2500-BaseX according to speed.
++	 */
++	switch (phydev->speed) {
++	case SPEED_2500:
++		phydev->interface = PHY_INTERFACE_MODE_2500BASEX;
++		break;
++	case SPEED_1000:
++	case SPEED_100:
++	case SPEED_10:
++		phydev->interface = PHY_INTERFACE_MODE_SGMII;
++		break;
++	default:
++		break;
++	}
++}
++
+ static int rtl822x_read_status(struct phy_device *phydev)
+ {
+ 	int ret;
+@@ -694,11 +713,14 @@ static int rtl822x_read_status(struct ph
+ 			phydev->lp_advertising, lpadv & RTL_LPADV_2500FULL);
+ 	}
+ 
+-	ret = genphy_read_status(phydev);
++	ret = rtlgen_read_status(phydev);
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	return rtlgen_get_speed(phydev);
++	if (phydev->is_c45 && phydev->link)
++		rtl822x_update_interface(phydev);
++
++	return 0;
+ }
+ 
+ static bool rtlgen_supports_2_5gbps(struct phy_device *phydev)
diff --git a/target/linux/generic/pending-5.15/723-net-mt7531-ensure-all-MACs-are-powered-down-before-r.patch b/target/linux/generic/pending-5.15/723-net-mt7531-ensure-all-MACs-are-powered-down-before-r.patch
index cc12d72110a5eb..a3274906a4332e 100644
--- a/target/linux/generic/pending-5.15/723-net-mt7531-ensure-all-MACs-are-powered-down-before-r.patch
+++ b/target/linux/generic/pending-5.15/723-net-mt7531-ensure-all-MACs-are-powered-down-before-r.patch
@@ -10,12 +10,21 @@ The datasheet [1] explicit describes it as requirement for a reset.
 
 Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
 ---
- drivers/net/dsa/mt7530.c | 4 ++++
- 1 file changed, 4 insertions(+)
+ drivers/net/dsa/mt7530.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2324,6 +2324,10 @@ mt7531_setup(struct dsa_switch *ds)
+@@ -2412,7 +2412,7 @@ mt7531_setup(struct dsa_switch *ds)
+ 	struct mt7530_priv *priv = ds->priv;
+ 	struct mt7530_dummy_poll p;
+ 	u32 val, id;
+-	int ret;
++	int ret, i;
+ 
+ 	/* Reset whole chip through gpio pin or memory-mapped registers for
+ 	 * different type of hardware
+@@ -2444,6 +2444,10 @@ mt7531_setup(struct dsa_switch *ds)
  		return -ENODEV;
  	}
  
diff --git a/target/linux/generic/pending-5.15/724-net-phy-realtek-use-genphy_soft_reset-for-2.5G-PHYs.patch b/target/linux/generic/pending-5.15/724-net-phy-realtek-use-genphy_soft_reset-for-2.5G-PHYs.patch
new file mode 100644
index 00000000000000..69418183510209
--- /dev/null
+++ b/target/linux/generic/pending-5.15/724-net-phy-realtek-use-genphy_soft_reset-for-2.5G-PHYs.patch
@@ -0,0 +1,65 @@
+From 85cd45580f5e3b26068cccb7d6173f200e754dc0 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sun, 2 Apr 2023 23:56:16 +0100
+Subject: [PATCH 1/2] net: phy: realtek: use genphy_soft_reset for 2.5G PHYs
+
+Some vendor bootloaders do weird things with those PHYs which result in
+link modes being reported wrongly. Start from a clean sheet by resetting
+the PHY.
+
+Reported-by: Yevhen Kolomeiko <jarvis2709@gmail.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/realtek.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -1018,6 +1018,7 @@ static struct phy_driver realtek_drvs[]
+ 		.write_page	= rtl821x_write_page,
+ 		.read_mmd	= rtl822x_read_mmd,
+ 		.write_mmd	= rtl822x_write_mmd,
++		.soft_reset     = genphy_soft_reset,
+ 	}, {
+ 		PHY_ID_MATCH_EXACT(0x001cc840),
+ 		.name		= "RTL8226B_RTL8221B 2.5Gbps PHY",
+@@ -1030,6 +1031,7 @@ static struct phy_driver realtek_drvs[]
+ 		.write_page	= rtl821x_write_page,
+ 		.read_mmd	= rtl822x_read_mmd,
+ 		.write_mmd	= rtl822x_write_mmd,
++		.soft_reset     = genphy_soft_reset,
+ 	}, {
+ 		PHY_ID_MATCH_EXACT(0x001cc838),
+ 		.name           = "RTL8226-CG 2.5Gbps PHY",
+@@ -1040,6 +1042,7 @@ static struct phy_driver realtek_drvs[]
+ 		.resume         = rtlgen_resume,
+ 		.read_page      = rtl821x_read_page,
+ 		.write_page     = rtl821x_write_page,
++		.soft_reset     = genphy_soft_reset,
+ 	}, {
+ 		PHY_ID_MATCH_EXACT(0x001cc848),
+ 		.name           = "RTL8226B-CG_RTL8221B-CG 2.5Gbps PHY",
+@@ -1050,6 +1053,7 @@ static struct phy_driver realtek_drvs[]
+ 		.resume         = rtlgen_resume,
+ 		.read_page      = rtl821x_read_page,
+ 		.write_page     = rtl821x_write_page,
++		.soft_reset     = genphy_soft_reset,
+ 	}, {
+ 		PHY_ID_MATCH_EXACT(0x001cc849),
+ 		.name           = "RTL8221B-VB-CG 2.5Gbps PHY",
+@@ -1061,6 +1065,7 @@ static struct phy_driver realtek_drvs[]
+ 		.resume         = rtlgen_resume,
+ 		.read_page      = rtl821x_read_page,
+ 		.write_page     = rtl821x_write_page,
++		.soft_reset     = genphy_soft_reset,
+ 	}, {
+ 		PHY_ID_MATCH_EXACT(0x001cc84a),
+ 		.name           = "RTL8221B-VM-CG 2.5Gbps PHY",
+@@ -1072,6 +1077,7 @@ static struct phy_driver realtek_drvs[]
+ 		.resume         = rtlgen_resume,
+ 		.read_page      = rtl821x_read_page,
+ 		.write_page     = rtl821x_write_page,
++		.soft_reset     = genphy_soft_reset,
+ 	}, {
+ 		PHY_ID_MATCH_EXACT(0x001cc961),
+ 		.name		= "RTL8366RB Gigabit Ethernet",
diff --git a/target/linux/generic/pending-5.15/725-net-phy-realtek-disable-SGMII-in-band-AN-for-2-5G-PHYs.patch b/target/linux/generic/pending-5.15/725-net-phy-realtek-disable-SGMII-in-band-AN-for-2-5G-PHYs.patch
new file mode 100644
index 00000000000000..1370c6324bba7c
--- /dev/null
+++ b/target/linux/generic/pending-5.15/725-net-phy-realtek-disable-SGMII-in-band-AN-for-2-5G-PHYs.patch
@@ -0,0 +1,43 @@
+From 2b1b8c4c215af7988136401c902338d091d408a1 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 01:21:57 +0300
+Subject: [PATCH 2/2] net: phy: realtek: disable SGMII in-band AN for 2.5G PHYs
+
+MAC drivers don't use SGMII in-band autonegotiation unless told to do so
+in device tree using 'managed = "in-band-status"'. When using MDIO to
+access a PHY, in-band-status is unneeded as we have link-status via
+MDIO. Switch off SGMII in-band autonegotiation using magic values.
+
+Reported-by: Chen Minqiang <ptpt52@gmail.com>
+Reported-by: Chukun Pan <amadeus@jmu.edu.cn>
+Reported-by: Yevhen Kolomeiko <jarvis2709@gmail.com>
+Tested-by: Yevhen Kolomeiko <jarvis2709@gmail.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/realtek.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -875,6 +875,7 @@ static irqreturn_t rtl9000a_handle_inter
+ static int rtl8221b_config_init(struct phy_device *phydev)
+ {
+ 	u16 option_mode;
++	int val;
+ 
+ 	switch (phydev->interface) {
+ 	case PHY_INTERFACE_MODE_2500BASEX:
+@@ -911,6 +912,13 @@ static int rtl8221b_config_init(struct p
+ 		break;
+ 	}
+ 
++	/* Disable SGMII AN */
++	phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x7588, 0x2);
++	phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x7589, 0x71d0);
++	phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x7587, 0x3);
++	phy_read_mmd_poll_timeout(phydev, RTL8221B_MMD_SERDES_CTRL, 0x7587,
++				  val, !(val & BIT(0)), 500, 100000, false);
++
+ 	return 0;
+ }
+ 
diff --git a/target/linux/generic/pending-5.15/726-net-phy-realtek-make-sure-paged-read-is-protected-by.patch b/target/linux/generic/pending-5.15/726-net-phy-realtek-make-sure-paged-read-is-protected-by.patch
new file mode 100644
index 00000000000000..31f0622327b869
--- /dev/null
+++ b/target/linux/generic/pending-5.15/726-net-phy-realtek-make-sure-paged-read-is-protected-by.patch
@@ -0,0 +1,35 @@
+From 4dd2cc9b91ecb25f278a2c55e07e6455e9000e6b Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 22 Apr 2023 01:21:14 +0100
+Subject: [PATCH] net: phy: realtek: make sure paged read is protected by mutex
+
+As we cannot rely on phy_read_paged function before the PHY is
+identified, the paged read in rtlgen_supports_2_5gbps needs to be open
+coded as it is being called by the match_phy_device function, ie. before
+.read_page and .write_page have been populated.
+
+Make sure it is also protected by the MDIO bus mutex and use
+rtl821x_write_page instead of 3 individually locked MDIO bus operations.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/realtek.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -727,9 +727,11 @@ static bool rtlgen_supports_2_5gbps(stru
+ {
+ 	int val;
+ 
+-	phy_write(phydev, RTL821x_PAGE_SELECT, 0xa61);
+-	val = phy_read(phydev, 0x13);
+-	phy_write(phydev, RTL821x_PAGE_SELECT, 0);
++	mutex_lock(&phydev->mdio.bus->mdio_lock);
++	rtl821x_write_page(phydev, 0xa61);
++	val = __phy_read(phydev, 0x13);
++	rtl821x_write_page(phydev, 0);
++	mutex_unlock(&phydev->mdio.bus->mdio_lock);
+ 
+ 	return val >= 0 && val & RTL_SUPPORTS_2500FULL;
+ }
diff --git a/target/linux/generic/pending-5.15/727-net-phy-realtek-use-inline-functions-for-10GbE-adver.patch b/target/linux/generic/pending-5.15/727-net-phy-realtek-use-inline-functions-for-10GbE-adver.patch
new file mode 100644
index 00000000000000..a24b4dd79a1b5f
--- /dev/null
+++ b/target/linux/generic/pending-5.15/727-net-phy-realtek-use-inline-functions-for-10GbE-adver.patch
@@ -0,0 +1,60 @@
+From 92c8b9d558160d94b981dd8a2b9c47657627ffdc Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 22 Apr 2023 01:23:08 +0100
+Subject: [PATCH 2/3] net: phy: realtek: use inline functions for 10GbE
+ advertisement
+
+Use existing generic inline functions to encode local advertisement
+of 10GbE link modes as well as to decode link-partner advertisement.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/realtek.c | 22 +++++-----------------
+ 1 file changed, 5 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -68,10 +68,6 @@
+ #define RTL_SUPPORTS_5000FULL			BIT(14)
+ #define RTL_SUPPORTS_2500FULL			BIT(13)
+ #define RTL_SUPPORTS_10000FULL			BIT(0)
+-#define RTL_ADV_2500FULL			BIT(7)
+-#define RTL_LPADV_10000FULL			BIT(11)
+-#define RTL_LPADV_5000FULL			BIT(6)
+-#define RTL_LPADV_2500FULL			BIT(5)
+ 
+ #define RTL9000A_GINMR				0x14
+ #define RTL9000A_GINMR_LINK_STATUS		BIT(4)
+@@ -661,14 +657,11 @@ static int rtl822x_config_aneg(struct ph
+ 	int ret = 0;
+ 
+ 	if (phydev->autoneg == AUTONEG_ENABLE) {
+-		u16 adv2500 = 0;
+-
+-		if (linkmode_test_bit(ETHTOOL_LINK_MODE_2500baseT_Full_BIT,
+-				      phydev->advertising))
+-			adv2500 = RTL_ADV_2500FULL;
+-
+ 		ret = phy_modify_paged_changed(phydev, 0xa5d, 0x12,
+-					       RTL_ADV_2500FULL, adv2500);
++					       MDIO_AN_10GBT_CTRL_ADV10G |
++					       MDIO_AN_10GBT_CTRL_ADV5G |
++					       MDIO_AN_10GBT_CTRL_ADV2_5G,
++			linkmode_adv_to_mii_10gbt_adv_t(phydev->advertising));
+ 		if (ret < 0)
+ 			return ret;
+ 	}
+@@ -705,12 +698,7 @@ static int rtl822x_read_status(struct ph
+ 		if (lpadv < 0)
+ 			return lpadv;
+ 
+-		linkmode_mod_bit(ETHTOOL_LINK_MODE_10000baseT_Full_BIT,
+-			phydev->lp_advertising, lpadv & RTL_LPADV_10000FULL);
+-		linkmode_mod_bit(ETHTOOL_LINK_MODE_5000baseT_Full_BIT,
+-			phydev->lp_advertising, lpadv & RTL_LPADV_5000FULL);
+-		linkmode_mod_bit(ETHTOOL_LINK_MODE_2500baseT_Full_BIT,
+-			phydev->lp_advertising, lpadv & RTL_LPADV_2500FULL);
++		mii_10gbt_stat_mod_linkmode_lpa_t(phydev->lp_advertising, lpadv);
+ 	}
+ 
+ 	ret = rtlgen_read_status(phydev);
diff --git a/target/linux/generic/pending-5.15/728-net-phy-realtek-check-validity-of-10GbE-link-partner.patch b/target/linux/generic/pending-5.15/728-net-phy-realtek-check-validity-of-10GbE-link-partner.patch
new file mode 100644
index 00000000000000..084ee4b6450204
--- /dev/null
+++ b/target/linux/generic/pending-5.15/728-net-phy-realtek-check-validity-of-10GbE-link-partner.patch
@@ -0,0 +1,28 @@
+From 929bb4d3cfbc7878326c0771a01a636d49c54b40 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 22 Apr 2023 01:25:39 +0100
+Subject: [PATCH 3/3] net: phy: realtek: check validity of 10GbE link-partner
+ advertisement
+
+Only use link-partner advertisement bits for 10GbE modes if they are
+actually valid. Check LOCALOK and REMOTEOK bits and clear 10GbE modes
+unless both of them are set.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/realtek.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -698,6 +698,10 @@ static int rtl822x_read_status(struct ph
+ 		if (lpadv < 0)
+ 			return lpadv;
+ 
++		if (!(lpadv & MDIO_AN_10GBT_STAT_REMOK) ||
++		    !(lpadv & MDIO_AN_10GBT_STAT_LOCOK))
++			lpadv = 0;
++
+ 		mii_10gbt_stat_mod_linkmode_lpa_t(phydev->lp_advertising, lpadv);
+ 	}
+ 
diff --git a/target/linux/generic/pending-5.15/729-net-phy-realtek-introduce-rtl822x_probe.patch b/target/linux/generic/pending-5.15/729-net-phy-realtek-introduce-rtl822x_probe.patch
new file mode 100644
index 00000000000000..87102d38187501
--- /dev/null
+++ b/target/linux/generic/pending-5.15/729-net-phy-realtek-introduce-rtl822x_probe.patch
@@ -0,0 +1,100 @@
+From 9155098547fb1172d4fa536f3f6bc9d42f59d08c Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 22 Apr 2023 03:26:01 +0100
+Subject: [PATCH] net: phy: realtek: setup ALDPS on RTL822x
+
+Setup Link Down Power Saving Mode according the DTS property
+just like for RTL821x 1GE PHYs.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/realtek.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -62,6 +62,10 @@
+ #define RTL8221B_SERDES_OPTION_MODE_2500BASEX		2
+ #define RTL8221B_SERDES_OPTION_MODE_HISGMII		3
+ 
++#define RTL8221B_PHYCR1				0xa430
++#define RTL8221B_PHYCR1_ALDPS_EN		BIT(2)
++#define RTL8221B_PHYCR1_ALDPS_XTAL_OFF_EN	BIT(12)
++
+ #define RTL8366RB_POWER_SAVE			0x15
+ #define RTL8366RB_POWER_SAVE_ON			BIT(12)
+ 
+@@ -740,6 +744,25 @@ static int rtl8226_match_phy_device(stru
+ 	       rtlgen_supports_2_5gbps(phydev);
+ }
+ 
++static int rtl822x_probe(struct phy_device *phydev)
++{
++	struct device *dev = &phydev->mdio.dev;
++	int val;
++
++	val = phy_read_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, RTL8221B_PHYCR1);
++	if (val < 0)
++		return val;
++
++	if (of_property_read_bool(dev->of_node, "realtek,aldps-enable"))
++		val |= RTL8221B_PHYCR1_ALDPS_EN | RTL8221B_PHYCR1_ALDPS_XTAL_OFF_EN;
++	else
++		val &= ~(RTL8221B_PHYCR1_ALDPS_EN | RTL8221B_PHYCR1_ALDPS_XTAL_OFF_EN);
++
++	phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, RTL8221B_PHYCR1, val);
++
++	return 0;
++}
++
+ static int rtlgen_resume(struct phy_device *phydev)
+ {
+ 	int ret = genphy_resume(phydev);
+@@ -1013,6 +1036,7 @@ static struct phy_driver realtek_drvs[]
+ 		.match_phy_device = rtl8226_match_phy_device,
+ 		.get_features	= rtl822x_get_features,
+ 		.config_aneg	= rtl822x_config_aneg,
++		.probe          = rtl822x_probe,
+ 		.read_status	= rtl822x_read_status,
+ 		.suspend	= genphy_suspend,
+ 		.resume		= rtlgen_resume,
+@@ -1026,6 +1050,7 @@ static struct phy_driver realtek_drvs[]
+ 		.name		= "RTL8226B_RTL8221B 2.5Gbps PHY",
+ 		.get_features	= rtl822x_get_features,
+ 		.config_aneg	= rtl822x_config_aneg,
++		.probe          = rtl822x_probe,
+ 		.read_status	= rtl822x_read_status,
+ 		.suspend	= genphy_suspend,
+ 		.resume		= rtlgen_resume,
+@@ -1039,6 +1064,7 @@ static struct phy_driver realtek_drvs[]
+ 		.name           = "RTL8226-CG 2.5Gbps PHY",
+ 		.get_features   = rtl822x_get_features,
+ 		.config_aneg    = rtl822x_config_aneg,
++		.probe          = rtl822x_probe,
+ 		.read_status    = rtl822x_read_status,
+ 		.suspend        = genphy_suspend,
+ 		.resume         = rtlgen_resume,
+@@ -1050,6 +1076,7 @@ static struct phy_driver realtek_drvs[]
+ 		.name           = "RTL8226B-CG_RTL8221B-CG 2.5Gbps PHY",
+ 		.get_features   = rtl822x_get_features,
+ 		.config_aneg    = rtl822x_config_aneg,
++		.probe          = rtl822x_probe,
+ 		.read_status    = rtl822x_read_status,
+ 		.suspend        = genphy_suspend,
+ 		.resume         = rtlgen_resume,
+@@ -1062,6 +1089,7 @@ static struct phy_driver realtek_drvs[]
+ 		.get_features   = rtl822x_get_features,
+ 		.config_init    = rtl8221b_config_init,
+ 		.config_aneg    = rtl822x_config_aneg,
++		.probe          = rtl822x_probe,
+ 		.read_status    = rtl822x_read_status,
+ 		.suspend        = genphy_suspend,
+ 		.resume         = rtlgen_resume,
+@@ -1074,6 +1102,7 @@ static struct phy_driver realtek_drvs[]
+ 		.get_features   = rtl822x_get_features,
+ 		.config_aneg    = rtl822x_config_aneg,
+ 		.config_init    = rtl8221b_config_init,
++		.probe          = rtl822x_probe,
+ 		.read_status    = rtl822x_read_status,
+ 		.suspend        = genphy_suspend,
+ 		.resume         = rtlgen_resume,
diff --git a/target/linux/generic/pending-5.15/730-net-phy-realtek-detect-early-version-of-RTL8221B.patch b/target/linux/generic/pending-5.15/730-net-phy-realtek-detect-early-version-of-RTL8221B.patch
new file mode 100644
index 00000000000000..6d414bfbade9b2
--- /dev/null
+++ b/target/linux/generic/pending-5.15/730-net-phy-realtek-detect-early-version-of-RTL8221B.patch
@@ -0,0 +1,63 @@
+From 0de82310d2b32e78ff79d42c08b1122a6ede3778 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sun, 30 Apr 2023 00:15:41 +0100
+Subject: [PATCH] net: phy: realtek: detect early version of RTL8221B
+
+Early versions (?) of the RTL8221B PHY cannot be identified in a regular
+Clause-45 bus scan as the PHY doesn't report the implemented MMDs
+correctly but returns 0 instead.
+Implement custom identify function using the PKGID instead of iterating
+over the implemented MMDs.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -744,6 +744,38 @@ static int rtl8226_match_phy_device(stru
+ 	       rtlgen_supports_2_5gbps(phydev);
+ }
+ 
++static int rtl8221b_vb_cg_match_phy_device(struct phy_device *phydev)
++{
++	int val;
++	u32 id;
++
++	if (phydev->mdio.bus->probe_capabilities >= MDIOBUS_C45) {
++		val = phy_read_mmd(phydev, MDIO_MMD_PMAPMD, MDIO_PKGID1);
++		if (val < 0)
++			return 0;
++
++		id = val << 16;
++		val = phy_read_mmd(phydev, MDIO_MMD_PMAPMD, MDIO_PKGID2);
++		if (val < 0)
++			return 0;
++
++		id |= val;
++	} else {
++		val = phy_read(phydev, MII_PHYSID1);
++		if (val < 0)
++			return 0;
++
++		id = val << 16;
++		val = phy_read(phydev, MII_PHYSID2);
++		if (val < 0)
++			return 0;
++
++		id |= val;
++	}
++
++	return (id == 0x001cc849);
++}
++
+ static int rtl822x_probe(struct phy_device *phydev)
+ {
+ 	struct device *dev = &phydev->mdio.dev;
+@@ -1084,7 +1116,7 @@ static struct phy_driver realtek_drvs[]
+ 		.write_page     = rtl821x_write_page,
+ 		.soft_reset     = genphy_soft_reset,
+ 	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc849),
++		.match_phy_device = rtl8221b_vb_cg_match_phy_device,
+ 		.name           = "RTL8221B-VB-CG 2.5Gbps PHY",
+ 		.get_features   = rtl822x_get_features,
+ 		.config_init    = rtl8221b_config_init,
diff --git a/target/linux/generic/pending-5.15/731-net-ethernet-mediatek-ppe-add-support-for-flow-accou.patch b/target/linux/generic/pending-5.15/731-net-ethernet-mediatek-ppe-add-support-for-flow-accou.patch
new file mode 100644
index 00000000000000..60c32b67057a93
--- /dev/null
+++ b/target/linux/generic/pending-5.15/731-net-ethernet-mediatek-ppe-add-support-for-flow-accou.patch
@@ -0,0 +1,428 @@
+From patchwork Wed Nov  2 00:58:01 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 13027653
+X-Patchwork-Delegate: kuba@kernel.org
+Return-Path: <netdev-owner@kernel.org>
+Date: Wed, 2 Nov 2022 00:58:01 +0000
+From: Daniel Golle <daniel@makrotopia.org>
+To: Felix Fietkau <nbd@nbd.name>, John Crispin <john@phrozen.org>,
+        Sean Wang <sean.wang@mediatek.com>,
+        Mark Lee <Mark-MC.Lee@mediatek.com>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Matthias Brugger <matthias.bgg@gmail.com>,
+        netdev@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
+        linux-mediatek@lists.infradead.org, linux-kernel@vger.kernel.org
+Subject: [PATCH v4] net: ethernet: mediatek: ppe: add support for flow
+ accounting
+Message-ID: <Y2HAmYYPd77dz+K5@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+Precedence: bulk
+List-ID: <netdev.vger.kernel.org>
+X-Mailing-List: netdev@vger.kernel.org
+X-Patchwork-Delegate: kuba@kernel.org
+
+The PPE units found in MT7622 and newer support packet and byte
+accounting of hw-offloaded flows. Add support for reading those
+counters as found in MediaTek's SDK[1].
+
+[1]: https://git01.mediatek.com/plugins/gitiles/openwrt/feeds/mtk-openwrt-feeds/+/bc6a6a375c800dc2b80e1a325a2c732d1737df92
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+v4: declare function mtk_mib_entry_read as static
+v3: don't bother to set 'false' values in any zero-initialized struct
+    use mtk_foe_entry_ib2
+    both changes were requested by Felix Fietkau
+
+v2: fix wrong variable name in return value check spotted by Denis Kirjanov
+
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c   |   7 +-
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h   |   1 +
+ drivers/net/ethernet/mediatek/mtk_ppe.c       | 110 +++++++++++++++++-
+ drivers/net/ethernet/mediatek/mtk_ppe.h       |  23 +++-
+ .../net/ethernet/mediatek/mtk_ppe_debugfs.c   |   9 +-
+ .../net/ethernet/mediatek/mtk_ppe_offload.c   |   7 ++
+ drivers/net/ethernet/mediatek/mtk_ppe_regs.h  |  14 +++
+ 7 files changed, 166 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -4642,8 +4642,8 @@ static int mtk_probe(struct platform_dev
+ 		for (i = 0; i < num_ppe; i++) {
+ 			u32 ppe_addr = eth->soc->reg_map->ppe_base + i * 0x400;
+ 
+-			eth->ppe[i] = mtk_ppe_init(eth, eth->base + ppe_addr,
+-						   eth->soc->offload_version, i);
++			eth->ppe[i] = mtk_ppe_init(eth, eth->base + ppe_addr, i);
++
+ 			if (!eth->ppe[i]) {
+ 				err = -ENOMEM;
+ 				goto err_free_dev;
+@@ -4770,6 +4770,7 @@ static const struct mtk_soc_data mt7622_
+ 	.required_pctl = false,
+ 	.offload_version = 2,
+ 	.hash_offset = 2,
++	.has_accounting = true,
+ 	.foe_entry_size = sizeof(struct mtk_foe_entry) - 16,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+@@ -4807,6 +4808,7 @@ static const struct mtk_soc_data mt7629_
+ 	.hw_features = MTK_HW_FEATURES,
+ 	.required_clks = MT7629_CLKS_BITMAP,
+ 	.required_pctl = false,
++	.has_accounting = true,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+ 		.rxd_size = sizeof(struct mtk_rx_dma),
+@@ -4827,6 +4829,7 @@ static const struct mtk_soc_data mt7981_
+ 	.offload_version = 2,
+ 	.hash_offset = 4,
+ 	.foe_entry_size = sizeof(struct mtk_foe_entry),
++	.has_accounting = true,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma_v2),
+ 		.rxd_size = sizeof(struct mtk_rx_dma_v2),
+@@ -4847,6 +4850,7 @@ static const struct mtk_soc_data mt7986_
+ 	.offload_version = 2,
+ 	.hash_offset = 4,
+ 	.foe_entry_size = sizeof(struct mtk_foe_entry),
++	.has_accounting = true,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma_v2),
+ 		.rxd_size = sizeof(struct mtk_rx_dma_v2),
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -1014,6 +1014,8 @@ struct mtk_reg_map {
+  *				the extra setup for those pins used by GMAC.
+  * @hash_offset			Flow table hash offset.
+  * @foe_entry_size		Foe table entry size.
++ * @has_accounting		Bool indicating support for accounting of
++ *				offloaded flows.
+  * @txd_size			Tx DMA descriptor size.
+  * @rxd_size			Rx DMA descriptor size.
+  * @rx_irq_done_mask		Rx irq done register mask.
+@@ -1031,6 +1033,7 @@ struct mtk_soc_data {
+ 	u8		hash_offset;
+ 	u16		foe_entry_size;
+ 	netdev_features_t hw_features;
++	bool		has_accounting;
+ 	struct {
+ 		u32	txd_size;
+ 		u32	rxd_size;
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -74,6 +74,48 @@ static int mtk_ppe_wait_busy(struct mtk_
+ 	return ret;
+ }
+ 
++static int mtk_ppe_mib_wait_busy(struct mtk_ppe *ppe)
++{
++	int ret;
++	u32 val;
++
++	ret = readl_poll_timeout(ppe->base + MTK_PPE_MIB_SER_CR, val,
++				 !(val & MTK_PPE_MIB_SER_CR_ST),
++				 20, MTK_PPE_WAIT_TIMEOUT_US);
++
++	if (ret)
++		dev_err(ppe->dev, "MIB table busy");
++
++	return ret;
++}
++
++static int mtk_mib_entry_read(struct mtk_ppe *ppe, u16 index, u64 *bytes, u64 *packets)
++{
++	u32 byte_cnt_low, byte_cnt_high, pkt_cnt_low, pkt_cnt_high;
++	u32 val, cnt_r0, cnt_r1, cnt_r2;
++	int ret;
++
++	val = FIELD_PREP(MTK_PPE_MIB_SER_CR_ADDR, index) | MTK_PPE_MIB_SER_CR_ST;
++	ppe_w32(ppe, MTK_PPE_MIB_SER_CR, val);
++
++	ret = mtk_ppe_mib_wait_busy(ppe);
++	if (ret)
++		return ret;
++
++	cnt_r0 = readl(ppe->base + MTK_PPE_MIB_SER_R0);
++	cnt_r1 = readl(ppe->base + MTK_PPE_MIB_SER_R1);
++	cnt_r2 = readl(ppe->base + MTK_PPE_MIB_SER_R2);
++
++	byte_cnt_low = FIELD_GET(MTK_PPE_MIB_SER_R0_BYTE_CNT_LOW, cnt_r0);
++	byte_cnt_high = FIELD_GET(MTK_PPE_MIB_SER_R1_BYTE_CNT_HIGH, cnt_r1);
++	pkt_cnt_low = FIELD_GET(MTK_PPE_MIB_SER_R1_PKT_CNT_LOW, cnt_r1);
++	pkt_cnt_high = FIELD_GET(MTK_PPE_MIB_SER_R2_PKT_CNT_HIGH, cnt_r2);
++	*bytes = ((u64)byte_cnt_high << 32) | byte_cnt_low;
++	*packets = (pkt_cnt_high << 16) | pkt_cnt_low;
++
++	return 0;
++}
++
+ static void mtk_ppe_cache_clear(struct mtk_ppe *ppe)
+ {
+ 	ppe_set(ppe, MTK_PPE_CACHE_CTL, MTK_PPE_CACHE_CTL_CLEAR);
+@@ -464,6 +506,13 @@ __mtk_foe_entry_clear(struct mtk_ppe *pp
+ 		hwe->ib1 &= ~MTK_FOE_IB1_STATE;
+ 		hwe->ib1 |= FIELD_PREP(MTK_FOE_IB1_STATE, MTK_FOE_STATE_INVALID);
+ 		dma_wmb();
++		if (ppe->accounting) {
++			struct mtk_foe_accounting *acct;
++
++			acct = ppe->acct_table + entry->hash * sizeof(*acct);
++			acct->packets = 0;
++			acct->bytes = 0;
++		}
+ 	}
+ 	entry->hash = 0xffff;
+ 
+@@ -571,6 +620,9 @@ __mtk_foe_entry_commit(struct mtk_ppe *p
+ 	wmb();
+ 	hwe->ib1 = entry->ib1;
+ 
++	if (ppe->accounting)
++		*mtk_foe_entry_ib2(eth, hwe) |= MTK_FOE_IB2_MIB_CNT;
++
+ 	dma_wmb();
+ 
+ 	mtk_ppe_cache_clear(ppe);
+@@ -762,11 +814,39 @@ int mtk_ppe_prepare_reset(struct mtk_ppe
+ 	return mtk_ppe_wait_busy(ppe);
+ }
+ 
+-struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base,
+-			     int version, int index)
++struct mtk_foe_accounting *mtk_foe_entry_get_mib(struct mtk_ppe *ppe, u32 index,
++						 struct mtk_foe_accounting *diff)
++{
++	struct mtk_foe_accounting *acct;
++	int size = sizeof(struct mtk_foe_accounting);
++	u64 bytes, packets;
++
++	if (!ppe->accounting)
++		return NULL;
++
++	if (mtk_mib_entry_read(ppe, index, &bytes, &packets))
++		return NULL;
++
++	acct = ppe->acct_table + index * size;
++
++	acct->bytes += bytes;
++	acct->packets += packets;
++
++	if (diff) {
++		diff->bytes = bytes;
++		diff->packets = packets;
++	}
++
++	return acct;
++}
++
++struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base, int index)
+ {
++	bool accounting = eth->soc->has_accounting;
+ 	const struct mtk_soc_data *soc = eth->soc;
++	struct mtk_foe_accounting *acct;
+ 	struct device *dev = eth->dev;
++	struct mtk_mib_entry *mib;
+ 	struct mtk_ppe *ppe;
+ 	u32 foe_flow_size;
+ 	void *foe;
+@@ -783,7 +863,8 @@ struct mtk_ppe *mtk_ppe_init(struct mtk_
+ 	ppe->base = base;
+ 	ppe->eth = eth;
+ 	ppe->dev = dev;
+-	ppe->version = version;
++	ppe->version = eth->soc->offload_version;
++	ppe->accounting = accounting;
+ 
+ 	foe = dmam_alloc_coherent(ppe->dev,
+ 				  MTK_PPE_ENTRIES * soc->foe_entry_size,
+@@ -799,6 +880,23 @@ struct mtk_ppe *mtk_ppe_init(struct mtk_
+ 	if (!ppe->foe_flow)
+ 		return NULL;
+ 
++	if (accounting) {
++		mib = dmam_alloc_coherent(ppe->dev, MTK_PPE_ENTRIES * sizeof(*mib),
++					  &ppe->mib_phys, GFP_KERNEL);
++		if (!mib)
++			return NULL;
++
++		ppe->mib_table = mib;
++
++		acct = devm_kzalloc(dev, MTK_PPE_ENTRIES * sizeof(*acct),
++				    GFP_KERNEL);
++
++		if (!acct)
++			return NULL;
++
++		ppe->acct_table = acct;
++	}
++
+ 	mtk_ppe_debugfs_init(ppe, index);
+ 
+ 	return ppe;
+@@ -913,6 +1011,16 @@ void mtk_ppe_start(struct mtk_ppe *ppe)
+ 		ppe_w32(ppe, MTK_PPE_DEFAULT_CPU_PORT1, 0xcb777);
+ 		ppe_w32(ppe, MTK_PPE_SBW_CTRL, 0x7f);
+ 	}
++
++	if (ppe->accounting && ppe->mib_phys) {
++		ppe_w32(ppe, MTK_PPE_MIB_TB_BASE, ppe->mib_phys);
++		ppe_m32(ppe, MTK_PPE_MIB_CFG, MTK_PPE_MIB_CFG_EN,
++			MTK_PPE_MIB_CFG_EN);
++		ppe_m32(ppe, MTK_PPE_MIB_CFG, MTK_PPE_MIB_CFG_RD_CLR,
++			MTK_PPE_MIB_CFG_RD_CLR);
++		ppe_m32(ppe, MTK_PPE_MIB_CACHE_CTL, MTK_PPE_MIB_CACHE_CTL_EN,
++			MTK_PPE_MIB_CFG_RD_CLR);
++	}
+ }
+ 
+ int mtk_ppe_stop(struct mtk_ppe *ppe)
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h
+@@ -57,6 +57,7 @@ enum {
+ #define MTK_FOE_IB2_MULTICAST		BIT(8)
+ 
+ #define MTK_FOE_IB2_WDMA_QID2		GENMASK(13, 12)
++#define MTK_FOE_IB2_MIB_CNT		BIT(15)
+ #define MTK_FOE_IB2_WDMA_DEVIDX		BIT(16)
+ #define MTK_FOE_IB2_WDMA_WINFO		BIT(17)
+ 
+@@ -285,16 +286,34 @@ struct mtk_flow_entry {
+ 	unsigned long cookie;
+ };
+ 
++struct mtk_mib_entry {
++	u32	byt_cnt_l;
++	u16	byt_cnt_h;
++	u32	pkt_cnt_l;
++	u8	pkt_cnt_h;
++	u8	_rsv0;
++	u32	_rsv1;
++} __packed;
++
++struct mtk_foe_accounting {
++	u64	bytes;
++	u64	packets;
++};
++
+ struct mtk_ppe {
+ 	struct mtk_eth *eth;
+ 	struct device *dev;
+ 	void __iomem *base;
+ 	int version;
+ 	char dirname[5];
++	bool accounting;
+ 
+ 	void *foe_table;
+ 	dma_addr_t foe_phys;
+ 
++	struct mtk_mib_entry *mib_table;
++	dma_addr_t mib_phys;
++
+ 	u16 foe_check_time[MTK_PPE_ENTRIES];
+ 	struct hlist_head *foe_flow;
+ 
+@@ -303,8 +322,7 @@ struct mtk_ppe {
+ 	void *acct_table;
+ };
+ 
+-struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base,
+-			     int version, int index);
++struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base, int index);
+ void mtk_ppe_start(struct mtk_ppe *ppe);
+ int mtk_ppe_stop(struct mtk_ppe *ppe);
+ int mtk_ppe_prepare_reset(struct mtk_ppe *ppe);
+@@ -358,5 +376,7 @@ int mtk_foe_entry_commit(struct mtk_ppe
+ void mtk_foe_entry_clear(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+ int mtk_foe_entry_idle_time(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+ int mtk_ppe_debugfs_init(struct mtk_ppe *ppe, int index);
++struct mtk_foe_accounting *mtk_foe_entry_get_mib(struct mtk_ppe *ppe, u32 index,
++						 struct mtk_foe_accounting *diff);
+ 
+ #endif
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_debugfs.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_debugfs.c
+@@ -82,6 +82,7 @@ mtk_ppe_debugfs_foe_show(struct seq_file
+ 		struct mtk_foe_entry *entry = mtk_foe_get_entry(ppe, i);
+ 		struct mtk_foe_mac_info *l2;
+ 		struct mtk_flow_addr_info ai = {};
++		struct mtk_foe_accounting *acct;
+ 		unsigned char h_source[ETH_ALEN];
+ 		unsigned char h_dest[ETH_ALEN];
+ 		int type, state;
+@@ -95,6 +96,8 @@ mtk_ppe_debugfs_foe_show(struct seq_file
+ 		if (bind && state != MTK_FOE_STATE_BIND)
+ 			continue;
+ 
++		acct = mtk_foe_entry_get_mib(ppe, i, NULL);
++
+ 		type = FIELD_GET(MTK_FOE_IB1_PACKET_TYPE, entry->ib1);
+ 		seq_printf(m, "%05x %s %7s", i,
+ 			   mtk_foe_entry_state_str(state),
+@@ -153,9 +156,11 @@ mtk_ppe_debugfs_foe_show(struct seq_file
+ 		*((__be16 *)&h_dest[4]) = htons(l2->dest_mac_lo);
+ 
+ 		seq_printf(m, " eth=%pM->%pM etype=%04x"
+-			      " vlan=%d,%d ib1=%08x ib2=%08x\n",
++			      " vlan=%d,%d ib1=%08x ib2=%08x"
++			      " packets=%llu bytes=%llu\n",
+ 			   h_source, h_dest, ntohs(l2->etype),
+-			   l2->vlan1, l2->vlan2, entry->ib1, ib2);
++			   l2->vlan1, l2->vlan2, entry->ib1, ib2,
++			   acct ? acct->packets : 0, acct ? acct->bytes : 0);
+ 	}
+ 
+ 	return 0;
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
+@@ -497,6 +497,7 @@ static int
+ mtk_flow_offload_stats(struct mtk_eth *eth, struct flow_cls_offload *f)
+ {
+ 	struct mtk_flow_entry *entry;
++	struct mtk_foe_accounting diff;
+ 	u32 idle;
+ 
+ 	entry = rhashtable_lookup(&eth->flow_table, &f->cookie,
+@@ -507,6 +508,13 @@ mtk_flow_offload_stats(struct mtk_eth *e
+ 	idle = mtk_foe_entry_idle_time(eth->ppe[entry->ppe_index], entry);
+ 	f->stats.lastused = jiffies - idle * HZ;
+ 
++	if (entry->hash != 0xFFFF &&
++	    mtk_foe_entry_get_mib(eth->ppe[entry->ppe_index], entry->hash,
++				  &diff)) {
++		f->stats.pkts += diff.packets;
++		f->stats.bytes += diff.bytes;
++	}
++
+ 	return 0;
+ }
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_regs.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_regs.h
+@@ -149,6 +149,20 @@ enum {
+ 
+ #define MTK_PPE_MIB_TB_BASE			0x338
+ 
++#define MTK_PPE_MIB_SER_CR			0x33C
++#define MTK_PPE_MIB_SER_CR_ST			BIT(16)
++#define MTK_PPE_MIB_SER_CR_ADDR			GENMASK(13, 0)
++
++#define MTK_PPE_MIB_SER_R0			0x340
++#define MTK_PPE_MIB_SER_R0_BYTE_CNT_LOW		GENMASK(31, 0)
++
++#define MTK_PPE_MIB_SER_R1			0x344
++#define MTK_PPE_MIB_SER_R1_PKT_CNT_LOW		GENMASK(31, 16)
++#define MTK_PPE_MIB_SER_R1_BYTE_CNT_HIGH	GENMASK(15, 0)
++
++#define MTK_PPE_MIB_SER_R2			0x348
++#define MTK_PPE_MIB_SER_R2_PKT_CNT_HIGH		GENMASK(23, 0)
++
+ #define MTK_PPE_MIB_CACHE_CTL			0x350
+ #define MTK_PPE_MIB_CACHE_CTL_EN		BIT(0)
+ #define MTK_PPE_MIB_CACHE_CTL_FLUSH		BIT(2)
diff --git a/target/linux/generic/pending-5.15/732-00-net-ethernet-mtk_eth_soc-drop-generic-vlan-rx-offloa.patch b/target/linux/generic/pending-5.15/732-00-net-ethernet-mtk_eth_soc-drop-generic-vlan-rx-offloa.patch
new file mode 100644
index 00000000000000..35b296a2553274
--- /dev/null
+++ b/target/linux/generic/pending-5.15/732-00-net-ethernet-mtk_eth_soc-drop-generic-vlan-rx-offloa.patch
@@ -0,0 +1,201 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 20 Nov 2022 23:01:00 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: drop generic vlan rx offload,
+ only use DSA untagging
+
+Through testing I found out that hardware vlan rx offload support seems to
+have some hardware issues. At least when using multiple MACs and when receiving
+tagged packets on the secondary MAC, the hardware can sometimes start to emit
+wrong tags on the first MAC as well.
+
+In order to avoid such issues, drop the feature configuration and use the
+offload feature only for DSA hardware untagging on MT7621/MT7622 devices which
+only use one MAC.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1850,9 +1850,7 @@ static int mtk_poll_rx(struct napi_struc
+ 
+ 	while (done < budget) {
+ 		unsigned int pktlen, *rxdcsum;
+-		bool has_hwaccel_tag = false;
+ 		struct net_device *netdev;
+-		u16 vlan_proto, vlan_tci;
+ 		dma_addr_t dma_addr;
+ 		u32 hash, reason;
+ 		int mac = 0;
+@@ -1987,36 +1985,21 @@ static int mtk_poll_rx(struct napi_struc
+ 			skb_checksum_none_assert(skb);
+ 		skb->protocol = eth_type_trans(skb, netdev);
+ 
+-		if (reason == MTK_PPE_CPU_REASON_HIT_UNBIND_RATE_REACHED)
+-			mtk_ppe_check_skb(eth->ppe[0], skb, hash);
+-
+-		if (netdev->features & NETIF_F_HW_VLAN_CTAG_RX) {
+-			if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+-				if (trxd.rxd3 & RX_DMA_VTAG_V2) {
+-					vlan_proto = RX_DMA_VPID(trxd.rxd4);
+-					vlan_tci = RX_DMA_VID(trxd.rxd4);
+-					has_hwaccel_tag = true;
+-				}
+-			} else if (trxd.rxd2 & RX_DMA_VTAG) {
+-				vlan_proto = RX_DMA_VPID(trxd.rxd3);
+-				vlan_tci = RX_DMA_VID(trxd.rxd3);
+-				has_hwaccel_tag = true;
+-			}
+-		}
+-
+ 		/* When using VLAN untagging in combination with DSA, the
+ 		 * hardware treats the MTK special tag as a VLAN and untags it.
+ 		 */
+-		if (has_hwaccel_tag && netdev_uses_dsa(netdev)) {
+-			unsigned int port = vlan_proto & GENMASK(2, 0);
++		if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2) &&
++		    (trxd.rxd2 & RX_DMA_VTAG) && netdev_uses_dsa(netdev)) {
++			unsigned int port = RX_DMA_VPID(trxd.rxd3) & GENMASK(2, 0);
+ 
+ 			if (port < ARRAY_SIZE(eth->dsa_meta) &&
+ 			    eth->dsa_meta[port])
+ 				skb_dst_set_noref(skb, &eth->dsa_meta[port]->dst);
+-		} else if (has_hwaccel_tag) {
+-			__vlan_hwaccel_put_tag(skb, htons(vlan_proto), vlan_tci);
+ 		}
+ 
++		if (reason == MTK_PPE_CPU_REASON_HIT_UNBIND_RATE_REACHED)
++			mtk_ppe_check_skb(eth->ppe[0], skb, hash);
++
+ 		skb_record_rx_queue(skb, 0);
+ 		napi_gro_receive(napi, skb);
+ 
+@@ -2831,29 +2814,11 @@ static netdev_features_t mtk_fix_feature
+ 
+ static int mtk_set_features(struct net_device *dev, netdev_features_t features)
+ {
+-	struct mtk_mac *mac = netdev_priv(dev);
+-	struct mtk_eth *eth = mac->hw;
+ 	netdev_features_t diff = dev->features ^ features;
+-	int i;
+ 
+ 	if ((diff & NETIF_F_LRO) && !(features & NETIF_F_LRO))
+ 		mtk_hwlro_netdev_disable(dev);
+ 
+-	/* Set RX VLAN offloading */
+-	if (!(diff & NETIF_F_HW_VLAN_CTAG_RX))
+-		return 0;
+-
+-	mtk_w32(eth, !!(features & NETIF_F_HW_VLAN_CTAG_RX),
+-		MTK_CDMP_EG_CTRL);
+-
+-	/* sync features with other MAC */
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
+-		if (!eth->netdev[i] || eth->netdev[i] == dev)
+-			continue;
+-		eth->netdev[i]->features &= ~NETIF_F_HW_VLAN_CTAG_RX;
+-		eth->netdev[i]->features |= features & NETIF_F_HW_VLAN_CTAG_RX;
+-	}
+-
+ 	return 0;
+ }
+ 
+@@ -3167,30 +3132,6 @@ static int mtk_open(struct net_device *d
+ 	struct mtk_eth *eth = mac->hw;
+ 	int i, err;
+ 
+-	if (mtk_uses_dsa(dev) && !eth->prog) {
+-		for (i = 0; i < ARRAY_SIZE(eth->dsa_meta); i++) {
+-			struct metadata_dst *md_dst = eth->dsa_meta[i];
+-
+-			if (md_dst)
+-				continue;
+-
+-			md_dst = metadata_dst_alloc(0, METADATA_HW_PORT_MUX,
+-						    GFP_KERNEL);
+-			if (!md_dst)
+-				return -ENOMEM;
+-
+-			md_dst->u.port_info.port_id = i;
+-			eth->dsa_meta[i] = md_dst;
+-		}
+-	} else {
+-		/* Hardware special tag parsing needs to be disabled if at least
+-		 * one MAC does not use DSA.
+-		 */
+-		u32 val = mtk_r32(eth, MTK_CDMP_IG_CTRL);
+-		val &= ~MTK_CDMP_STAG_EN;
+-		mtk_w32(eth, val, MTK_CDMP_IG_CTRL);
+-	}
+-
+ 	err = phylink_of_phy_connect(mac->phylink, mac->of_node, 0);
+ 	if (err) {
+ 		netdev_err(dev, "%s: could not attach PHY: %d\n", __func__,
+@@ -3231,6 +3172,35 @@ static int mtk_open(struct net_device *d
+ 	phylink_start(mac->phylink);
+ 	netif_tx_start_all_queues(dev);
+ 
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++		return 0;
++
++	if (mtk_uses_dsa(dev) && !eth->prog) {
++		for (i = 0; i < ARRAY_SIZE(eth->dsa_meta); i++) {
++			struct metadata_dst *md_dst = eth->dsa_meta[i];
++
++			if (md_dst)
++				continue;
++
++			md_dst = metadata_dst_alloc(0, METADATA_HW_PORT_MUX,
++						    GFP_KERNEL);
++			if (!md_dst)
++				return -ENOMEM;
++
++			md_dst->u.port_info.port_id = i;
++			eth->dsa_meta[i] = md_dst;
++		}
++	} else {
++		/* Hardware special tag parsing needs to be disabled if at least
++		 * one MAC does not use DSA.
++		 */
++		u32 val = mtk_r32(eth, MTK_CDMP_IG_CTRL);
++		val &= ~MTK_CDMP_STAG_EN;
++		mtk_w32(eth, val, MTK_CDMP_IG_CTRL);
++
++		mtk_w32(eth, 0, MTK_CDMP_EG_CTRL);
++	}
++
+ 	return 0;
+ }
+ 
+@@ -3715,10 +3685,9 @@ static int mtk_hw_init(struct mtk_eth *e
+ 	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+ 		val = mtk_r32(eth, MTK_CDMP_IG_CTRL);
+ 		mtk_w32(eth, val | MTK_CDMP_STAG_EN, MTK_CDMP_IG_CTRL);
+-	}
+ 
+-	/* Enable RX VLan Offloading */
+-	mtk_w32(eth, 1, MTK_CDMP_EG_CTRL);
++		mtk_w32(eth, 1, MTK_CDMP_EG_CTRL);
++	}
+ 
+ 	/* set interrupt delays based on current Net DIM sample */
+ 	mtk_dim_rx(&eth->rx_dim.work);
+@@ -4365,7 +4334,7 @@ static int mtk_add_mac(struct mtk_eth *e
+ 		eth->netdev[id]->hw_features |= NETIF_F_LRO;
+ 
+ 	eth->netdev[id]->vlan_features = eth->soc->hw_features &
+-		~(NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX);
++		~NETIF_F_HW_VLAN_CTAG_TX;
+ 	eth->netdev[id]->features |= eth->soc->hw_features;
+ 	eth->netdev[id]->ethtool_ops = &mtk_ethtool_ops;
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -48,7 +48,6 @@
+ #define MTK_HW_FEATURES		(NETIF_F_IP_CSUM | \
+ 				 NETIF_F_RXCSUM | \
+ 				 NETIF_F_HW_VLAN_CTAG_TX | \
+-				 NETIF_F_HW_VLAN_CTAG_RX | \
+ 				 NETIF_F_SG | NETIF_F_TSO | \
+ 				 NETIF_F_TSO6 | \
+ 				 NETIF_F_IPV6_CSUM |\
diff --git a/target/linux/generic/pending-5.15/732-01-net-ethernet-mtk_eth_soc-work-around-issue-with-send.patch b/target/linux/generic/pending-5.15/732-01-net-ethernet-mtk_eth_soc-work-around-issue-with-send.patch
new file mode 100644
index 00000000000000..fbf0cb5735eb2b
--- /dev/null
+++ b/target/linux/generic/pending-5.15/732-01-net-ethernet-mtk_eth_soc-work-around-issue-with-send.patch
@@ -0,0 +1,94 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 3 Nov 2022 12:38:49 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: work around issue with sending
+ small fragments
+
+When lots of frames are sent with a number of very small fragments, an
+internal FIFO can overflow, causing the DMA engine to lock up lock up and
+transmit attempts time out.
+
+Fix this on MT7986 by increasing the reserved FIFO space.
+Fix this on older chips by detecting the presence of small fragments and use
+skb_gso_segment + skb_linearize to deal with them.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1423,12 +1423,28 @@ static void mtk_wake_queue(struct mtk_et
+ 	}
+ }
+ 
++static bool mtk_skb_has_small_frag(struct sk_buff *skb)
++{
++	int min_size = 16;
++	int i;
++
++	if (skb_headlen(skb) < min_size)
++		return true;
++
++	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
++		if (skb_frag_size(&skb_shinfo(skb)->frags[i]) < min_size)
++			return true;
++
++	return false;
++}
++
+ static netdev_tx_t mtk_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ 	struct mtk_mac *mac = netdev_priv(dev);
+ 	struct mtk_eth *eth = mac->hw;
+ 	struct mtk_tx_ring *ring = &eth->tx_ring;
+ 	struct net_device_stats *stats = &dev->stats;
++	struct sk_buff *segs, *next;
+ 	bool gso = false;
+ 	int tx_num;
+ 
+@@ -1450,6 +1466,18 @@ static netdev_tx_t mtk_start_xmit(struct
+ 		return NETDEV_TX_BUSY;
+ 	}
+ 
++	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2) &&
++	    skb_is_gso(skb) && mtk_skb_has_small_frag(skb)) {
++		segs = skb_gso_segment(skb, dev->features & ~NETIF_F_ALL_TSO);
++		if (IS_ERR(segs))
++			goto drop;
++
++		if (segs) {
++			consume_skb(skb);
++			skb = segs;
++		}
++	}
++
+ 	/* TSO: fill MSS info in tcp checksum field */
+ 	if (skb_is_gso(skb)) {
+ 		if (skb_cow_head(skb, 0)) {
+@@ -1465,8 +1493,14 @@ static netdev_tx_t mtk_start_xmit(struct
+ 		}
+ 	}
+ 
+-	if (mtk_tx_map(skb, dev, tx_num, ring, gso) < 0)
+-		goto drop;
++	skb_list_walk_safe(skb, skb, next) {
++		if ((!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2) &&
++		     mtk_skb_has_small_frag(skb) && skb_linearize(skb)) ||
++		    mtk_tx_map(skb, dev, tx_num, ring, gso) < 0) {
++				stats->tx_dropped++;
++				dev_kfree_skb_any(skb);
++		}
++	}
+ 
+ 	if (unlikely(atomic_read(&ring->free_count) <= ring->thresh))
+ 		netif_tx_stop_all_queues(dev);
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -258,7 +258,7 @@
+ #define MTK_CHK_DDONE_EN	BIT(28)
+ #define MTK_DMAD_WR_WDONE	BIT(26)
+ #define MTK_WCOMP_EN		BIT(24)
+-#define MTK_RESV_BUF		(0x40 << 16)
++#define MTK_RESV_BUF		(0x80 << 16)
+ #define MTK_MUTLI_CNT		(0x4 << 12)
+ #define MTK_LEAKY_BUCKET_EN	BIT(11)
+ 
diff --git a/target/linux/generic/pending-5.15/732-02-net-ethernet-mtk_eth_soc-set-NETIF_F_ALL_TSO.patch b/target/linux/generic/pending-5.15/732-02-net-ethernet-mtk_eth_soc-set-NETIF_F_ALL_TSO.patch
new file mode 100644
index 00000000000000..3c6359ee419a76
--- /dev/null
+++ b/target/linux/generic/pending-5.15/732-02-net-ethernet-mtk_eth_soc-set-NETIF_F_ALL_TSO.patch
@@ -0,0 +1,21 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 28 Oct 2022 12:54:48 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: set NETIF_F_ALL_TSO
+
+Significantly improves performance by avoiding unnecessary segmentation
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -48,8 +48,7 @@
+ #define MTK_HW_FEATURES		(NETIF_F_IP_CSUM | \
+ 				 NETIF_F_RXCSUM | \
+ 				 NETIF_F_HW_VLAN_CTAG_TX | \
+-				 NETIF_F_SG | NETIF_F_TSO | \
+-				 NETIF_F_TSO6 | \
++				 NETIF_F_SG | NETIF_F_ALL_TSO | \
+ 				 NETIF_F_IPV6_CSUM |\
+ 				 NETIF_F_HW_TC)
+ #define MTK_HW_FEATURES_MT7628	(NETIF_F_SG | NETIF_F_RXCSUM)
diff --git a/target/linux/generic/pending-5.15/732-03-net-ethernet-mtk_eth_soc-fix-remaining-throughput-re.patch b/target/linux/generic/pending-5.15/732-03-net-ethernet-mtk_eth_soc-fix-remaining-throughput-re.patch
new file mode 100644
index 00000000000000..0aa9382b6bdd91
--- /dev/null
+++ b/target/linux/generic/pending-5.15/732-03-net-ethernet-mtk_eth_soc-fix-remaining-throughput-re.patch
@@ -0,0 +1,42 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 29 Mar 2023 16:02:54 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: fix remaining throughput
+ regression
+
+Based on further tests, it seems that the QDMA shaper is not able to
+perform shaping close to the MAC link rate without throughput loss.
+This cannot be compensated by increasing the shaping rate, so it seems
+to be an internal limit.
+
+Fix the remaining throughput regression by detecting that condition and
+limiting shaping to ports with lower link speed.
+
+This patch intentionally ignores link speed gain from TRGMII, because
+even on such links, shaping to 1000 Mbit/s incurs some throughput
+degradation.
+
+Fixes: f63959c7eec3 ("net: ethernet: mtk_eth_soc: implement multi-queue support for per-port queues")
+Reported-by: Frank Wunderlich <frank-w@public-files.de>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -667,6 +667,7 @@ static void mtk_mac_link_up(struct phyli
+ 		 MAC_MCR_FORCE_RX_FC);
+ 
+ 	/* Configure speed */
++	mac->speed = speed;
+ 	switch (speed) {
+ 	case SPEED_2500:
+ 	case SPEED_1000:
+@@ -3145,6 +3146,9 @@ found:
+ 	if (dp->index >= MTK_QDMA_NUM_QUEUES)
+ 		return NOTIFY_DONE;
+ 
++	if (mac->speed > 0 && mac->speed <= s.base.speed)
++		s.base.speed = 0;
++
+ 	mtk_set_queue_speed(eth, dp->index + 3, s.base.speed);
+ 
+ 	return NOTIFY_DONE;
diff --git a/target/linux/generic/pending-5.15/734-net-ethernet-mtk_eth_soc-ppe-fix-L2-offloading-with-.patch b/target/linux/generic/pending-5.15/734-net-ethernet-mtk_eth_soc-ppe-fix-L2-offloading-with-.patch
new file mode 100644
index 00000000000000..9ef65ec16f7bb7
--- /dev/null
+++ b/target/linux/generic/pending-5.15/734-net-ethernet-mtk_eth_soc-ppe-fix-L2-offloading-with-.patch
@@ -0,0 +1,33 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 27 Dec 2022 15:02:51 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: ppe: fix L2 offloading with DSA
+ untagging offload enabled
+
+Check for skb metadata in order to detect the case where the DSA header is not
+present.
+
+Fixes: 2d7605a72906 ("net: ethernet: mtk_eth_soc: enable hardware DSA untagging")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -8,6 +8,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/if_ether.h>
+ #include <linux/if_vlan.h>
++#include <net/dst_metadata.h>
+ #include <net/dsa.h>
+ #include "mtk_eth_soc.h"
+ #include "mtk_ppe.h"
+@@ -757,7 +758,9 @@ void __mtk_ppe_check_skb(struct mtk_ppe
+ 		    skb->dev->dsa_ptr->tag_ops->proto != DSA_TAG_PROTO_MTK)
+ 			goto out;
+ 
+-		tag += 4;
++		if (!skb_metadata_dst(skb))
++			tag += 4;
++
+ 		if (get_unaligned_be16(tag) != ETH_P_8021Q)
+ 			break;
+ 
diff --git a/target/linux/generic/pending-5.15/736-01-net-ethernet-mtk_eth_soc-add-code-for-offloading-flo.patch b/target/linux/generic/pending-5.15/736-01-net-ethernet-mtk_eth_soc-add-code-for-offloading-flo.patch
new file mode 100644
index 00000000000000..4f765c5c1451c3
--- /dev/null
+++ b/target/linux/generic/pending-5.15/736-01-net-ethernet-mtk_eth_soc-add-code-for-offloading-flo.patch
@@ -0,0 +1,266 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 20 Mar 2023 11:44:30 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: add code for offloading flows
+ from wlan devices
+
+WED version 2 (on MT7986 and later) can offload flows originating from wireless
+devices. In order to make that work, ndo_setup_tc needs to be implemented on
+the netdevs. This adds the required code to offload flows coming in from WED,
+while keeping track of the incoming wed index used for selecting the correct
+PPE device.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -1277,6 +1277,9 @@ int mtk_gmac_rgmii_path_setup(struct mtk
+ int mtk_eth_offload_init(struct mtk_eth *eth);
+ int mtk_eth_setup_tc(struct net_device *dev, enum tc_setup_type type,
+ 		     void *type_data);
++int mtk_flow_offload_cmd(struct mtk_eth *eth, struct flow_cls_offload *cls,
++			 int ppe_index);
++void mtk_flow_offload_cleanup(struct mtk_eth *eth, struct list_head *list);
+ void mtk_eth_set_dma_device(struct mtk_eth *eth, struct device *dma_dev);
+ 
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
+@@ -235,7 +235,8 @@ out:
+ }
+ 
+ static int
+-mtk_flow_offload_replace(struct mtk_eth *eth, struct flow_cls_offload *f)
++mtk_flow_offload_replace(struct mtk_eth *eth, struct flow_cls_offload *f,
++			 int ppe_index)
+ {
+ 	struct flow_rule *rule = flow_cls_offload_flow_rule(f);
+ 	struct flow_action_entry *act;
+@@ -452,6 +453,7 @@ mtk_flow_offload_replace(struct mtk_eth
+ 	entry->cookie = f->cookie;
+ 	memcpy(&entry->data, &foe, sizeof(entry->data));
+ 	entry->wed_index = wed_index;
++	entry->ppe_index = ppe_index;
+ 
+ 	err = mtk_foe_entry_commit(eth->ppe[entry->ppe_index], entry);
+ 	if (err < 0)
+@@ -520,25 +522,15 @@ mtk_flow_offload_stats(struct mtk_eth *e
+ 
+ static DEFINE_MUTEX(mtk_flow_offload_mutex);
+ 
+-static int
+-mtk_eth_setup_tc_block_cb(enum tc_setup_type type, void *type_data, void *cb_priv)
++int mtk_flow_offload_cmd(struct mtk_eth *eth, struct flow_cls_offload *cls,
++			 int ppe_index)
+ {
+-	struct flow_cls_offload *cls = type_data;
+-	struct net_device *dev = cb_priv;
+-	struct mtk_mac *mac = netdev_priv(dev);
+-	struct mtk_eth *eth = mac->hw;
+ 	int err;
+ 
+-	if (!tc_can_offload(dev))
+-		return -EOPNOTSUPP;
+-
+-	if (type != TC_SETUP_CLSFLOWER)
+-		return -EOPNOTSUPP;
+-
+ 	mutex_lock(&mtk_flow_offload_mutex);
+ 	switch (cls->command) {
+ 	case FLOW_CLS_REPLACE:
+-		err = mtk_flow_offload_replace(eth, cls);
++		err = mtk_flow_offload_replace(eth, cls, ppe_index);
+ 		break;
+ 	case FLOW_CLS_DESTROY:
+ 		err = mtk_flow_offload_destroy(eth, cls);
+@@ -556,6 +548,23 @@ mtk_eth_setup_tc_block_cb(enum tc_setup_
+ }
+ 
+ static int
++mtk_eth_setup_tc_block_cb(enum tc_setup_type type, void *type_data, void *cb_priv)
++{
++	struct flow_cls_offload *cls = type_data;
++	struct net_device *dev = cb_priv;
++	struct mtk_mac *mac = netdev_priv(dev);
++	struct mtk_eth *eth = mac->hw;
++
++	if (!tc_can_offload(dev))
++		return -EOPNOTSUPP;
++
++	if (type != TC_SETUP_CLSFLOWER)
++		return -EOPNOTSUPP;
++
++	return mtk_flow_offload_cmd(eth, cls, 0);
++}
++
++static int
+ mtk_eth_setup_tc_block(struct net_device *dev, struct flow_block_offload *f)
+ {
+ 	struct mtk_mac *mac = netdev_priv(dev);
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -13,6 +13,8 @@
+ #include <linux/mfd/syscon.h>
+ #include <linux/debugfs.h>
+ #include <linux/soc/mediatek/mtk_wed.h>
++#include <net/flow_offload.h>
++#include <net/pkt_cls.h>
+ #include "mtk_eth_soc.h"
+ #include "mtk_wed_regs.h"
+ #include "mtk_wed.h"
+@@ -41,6 +43,11 @@
+ static struct mtk_wed_hw *hw_list[2];
+ static DEFINE_MUTEX(hw_lock);
+ 
++struct mtk_wed_flow_block_priv {
++	struct mtk_wed_hw *hw;
++	struct net_device *dev;
++};
++
+ static void
+ wed_m32(struct mtk_wed_device *dev, u32 reg, u32 mask, u32 val)
+ {
+@@ -1752,6 +1759,99 @@ out:
+ 	mutex_unlock(&hw_lock);
+ }
+ 
++static int
++mtk_wed_setup_tc_block_cb(enum tc_setup_type type, void *type_data, void *cb_priv)
++{
++	struct mtk_wed_flow_block_priv *priv = cb_priv;
++	struct flow_cls_offload *cls = type_data;
++	struct mtk_wed_hw *hw = priv->hw;
++
++	if (!tc_can_offload(priv->dev))
++		return -EOPNOTSUPP;
++
++	if (type != TC_SETUP_CLSFLOWER)
++		return -EOPNOTSUPP;
++
++	return mtk_flow_offload_cmd(hw->eth, cls, hw->index);
++}
++
++static int
++mtk_wed_setup_tc_block(struct mtk_wed_hw *hw, struct net_device *dev,
++		       struct flow_block_offload *f)
++{
++	struct mtk_wed_flow_block_priv *priv;
++	static LIST_HEAD(block_cb_list);
++	struct flow_block_cb *block_cb;
++	struct mtk_eth *eth = hw->eth;
++	flow_setup_cb_t *cb;
++
++	if (!eth->soc->offload_version)
++		return -EOPNOTSUPP;
++
++	if (f->binder_type != FLOW_BLOCK_BINDER_TYPE_CLSACT_INGRESS)
++		return -EOPNOTSUPP;
++
++	cb = mtk_wed_setup_tc_block_cb;
++	f->driver_block_list = &block_cb_list;
++
++	switch (f->command) {
++	case FLOW_BLOCK_BIND:
++		block_cb = flow_block_cb_lookup(f->block, cb, dev);
++		if (block_cb) {
++			flow_block_cb_incref(block_cb);
++			return 0;
++		}
++
++		priv = kzalloc(sizeof(*priv), GFP_KERNEL);
++		if (!priv)
++			return -ENOMEM;
++
++		priv->hw = hw;
++		priv->dev = dev;
++		block_cb = flow_block_cb_alloc(cb, dev, priv, NULL);
++		if (IS_ERR(block_cb)) {
++			kfree(priv);
++			return PTR_ERR(block_cb);
++		}
++
++		flow_block_cb_incref(block_cb);
++		flow_block_cb_add(block_cb, f);
++		list_add_tail(&block_cb->driver_list, &block_cb_list);
++		return 0;
++	case FLOW_BLOCK_UNBIND:
++		block_cb = flow_block_cb_lookup(f->block, cb, dev);
++		if (!block_cb)
++			return -ENOENT;
++
++		if (!flow_block_cb_decref(block_cb)) {
++			flow_block_cb_remove(block_cb, f);
++			list_del(&block_cb->driver_list);
++			kfree(block_cb->cb_priv);
++		}
++		return 0;
++	default:
++		return -EOPNOTSUPP;
++	}
++}
++
++static int
++mtk_wed_setup_tc(struct mtk_wed_device *wed, struct net_device *dev,
++		 enum tc_setup_type type, void *type_data)
++{
++	struct mtk_wed_hw *hw = wed->hw;
++
++	if (hw->version < 2)
++		return -EOPNOTSUPP;
++
++	switch (type) {
++	case TC_SETUP_BLOCK:
++	case TC_SETUP_FT:
++		return mtk_wed_setup_tc_block(hw, dev, type_data);
++	default:
++		return -EOPNOTSUPP;
++	}
++}
++
+ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
+ 		    void __iomem *wdma, phys_addr_t wdma_phy,
+ 		    int index)
+@@ -1771,6 +1871,7 @@ void mtk_wed_add_hw(struct device_node *
+ 		.irq_set_mask = mtk_wed_irq_set_mask,
+ 		.detach = mtk_wed_detach,
+ 		.ppe_check = mtk_wed_ppe_check,
++		.setup_tc = mtk_wed_setup_tc,
+ 	};
+ 	struct device_node *eth_np = eth->dev->of_node;
+ 	struct platform_device *pdev;
+--- a/include/linux/soc/mediatek/mtk_wed.h
++++ b/include/linux/soc/mediatek/mtk_wed.h
+@@ -6,6 +6,7 @@
+ #include <linux/regmap.h>
+ #include <linux/pci.h>
+ #include <linux/skbuff.h>
++#include <linux/netdevice.h>
+ 
+ #define MTK_WED_TX_QUEUES		2
+ #define MTK_WED_RX_QUEUES		2
+@@ -180,6 +181,8 @@ struct mtk_wed_ops {
+ 
+ 	u32 (*irq_get)(struct mtk_wed_device *dev, u32 mask);
+ 	void (*irq_set_mask)(struct mtk_wed_device *dev, u32 mask);
++	int (*setup_tc)(struct mtk_wed_device *wed, struct net_device *dev,
++			enum tc_setup_type type, void *type_data);
+ };
+ 
+ extern const struct mtk_wed_ops __rcu *mtk_soc_wed_ops;
+@@ -238,6 +241,8 @@ mtk_wed_get_rx_capa(struct mtk_wed_devic
+ 	(_dev)->ops->msg_update(_dev, _id, _msg, _len)
+ #define mtk_wed_device_stop(_dev) (_dev)->ops->stop(_dev)
+ #define mtk_wed_device_dma_reset(_dev) (_dev)->ops->reset_dma(_dev)
++#define mtk_wed_device_setup_tc(_dev, _netdev, _type, _type_data) \
++	(_dev)->ops->setup_tc(_dev, _netdev, _type, _type_data)
+ #else
+ static inline bool mtk_wed_device_active(struct mtk_wed_device *dev)
+ {
+@@ -256,6 +261,7 @@ static inline bool mtk_wed_device_active
+ #define mtk_wed_device_update_msg(_dev, _id, _msg, _len) -ENODEV
+ #define mtk_wed_device_stop(_dev) do {} while (0)
+ #define mtk_wed_device_dma_reset(_dev) do {} while (0)
++#define mtk_wed_device_setup_tc(_dev, _netdev, _type, _type_data) -EOPNOTSUPP
+ #endif
+ 
+ #endif
diff --git a/target/linux/generic/pending-5.15/736-02-net-ethernet-mediatek-mtk_ppe-prefer-newly-added-l2-.patch b/target/linux/generic/pending-5.15/736-02-net-ethernet-mediatek-mtk_ppe-prefer-newly-added-l2-.patch
new file mode 100644
index 00000000000000..6e17e4dc529f75
--- /dev/null
+++ b/target/linux/generic/pending-5.15/736-02-net-ethernet-mediatek-mtk_ppe-prefer-newly-added-l2-.patch
@@ -0,0 +1,37 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 20 Mar 2023 15:37:55 +0100
+Subject: [PATCH] net: ethernet: mediatek: mtk_ppe: prefer newly added l2
+ flows over existing ones
+
+When a device is roaming between interfaces and a new flow entry is created,
+we should assume that its output device is more up to date than whatever
+entry existed already.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -639,10 +639,20 @@ void mtk_foe_entry_clear(struct mtk_ppe
+ static int
+ mtk_foe_entry_commit_l2(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
+ {
++	struct mtk_flow_entry *prev;
++
+ 	entry->type = MTK_FLOW_TYPE_L2;
+ 
+-	return rhashtable_insert_fast(&ppe->l2_flows, &entry->l2_node,
+-				      mtk_flow_l2_ht_params);
++	prev = rhashtable_lookup_get_insert_fast(&ppe->l2_flows, &entry->l2_node,
++						 mtk_flow_l2_ht_params);
++	if (likely(!prev))
++		return 0;
++
++	if (IS_ERR(prev))
++		return PTR_ERR(prev);
++
++	return rhashtable_replace_fast(&ppe->l2_flows, &prev->l2_node,
++				       &entry->l2_node, mtk_flow_l2_ht_params);
+ }
+ 
+ int mtk_foe_entry_commit(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
diff --git a/target/linux/generic/pending-5.15/736-03-net-ethernet-mtk_eth_soc-improve-keeping-track-of-of.patch b/target/linux/generic/pending-5.15/736-03-net-ethernet-mtk_eth_soc-improve-keeping-track-of-of.patch
new file mode 100644
index 00000000000000..29d6e0b09918cc
--- /dev/null
+++ b/target/linux/generic/pending-5.15/736-03-net-ethernet-mtk_eth_soc-improve-keeping-track-of-of.patch
@@ -0,0 +1,331 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 23 Mar 2023 10:24:11 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: improve keeping track of
+ offloaded flows
+
+Unify tracking of L2 and L3 flows. Use the generic list field in struct
+mtk_foe_entry for tracking L2 subflows. Preparation for improving
+flow accounting support.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -466,42 +466,43 @@ int mtk_foe_entry_set_queue(struct mtk_e
+ 	return 0;
+ }
+ 
++static int
++mtk_flow_entry_match_len(struct mtk_eth *eth, struct mtk_foe_entry *entry)
++{
++	int type = mtk_get_ib1_pkt_type(eth, entry->ib1);
++
++	if (type > MTK_PPE_PKT_TYPE_IPV4_DSLITE)
++		return offsetof(struct mtk_foe_entry, ipv6._rsv);
++	else
++		return offsetof(struct mtk_foe_entry, ipv4.ib2);
++}
++
+ static bool
+ mtk_flow_entry_match(struct mtk_eth *eth, struct mtk_flow_entry *entry,
+-		     struct mtk_foe_entry *data)
++		     struct mtk_foe_entry *data, int len)
+ {
+-	int type, len;
+-
+ 	if ((data->ib1 ^ entry->data.ib1) & MTK_FOE_IB1_UDP)
+ 		return false;
+ 
+-	type = mtk_get_ib1_pkt_type(eth, entry->data.ib1);
+-	if (type > MTK_PPE_PKT_TYPE_IPV4_DSLITE)
+-		len = offsetof(struct mtk_foe_entry, ipv6._rsv);
+-	else
+-		len = offsetof(struct mtk_foe_entry, ipv4.ib2);
+-
+ 	return !memcmp(&entry->data.data, &data->data, len - 4);
+ }
+ 
+ static void
+-__mtk_foe_entry_clear(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
++__mtk_foe_entry_clear(struct mtk_ppe *ppe, struct mtk_flow_entry *entry,
++		      bool set_state)
+ {
+-	struct hlist_head *head;
+ 	struct hlist_node *tmp;
+ 
+ 	if (entry->type == MTK_FLOW_TYPE_L2) {
+ 		rhashtable_remove_fast(&ppe->l2_flows, &entry->l2_node,
+ 				       mtk_flow_l2_ht_params);
+ 
+-		head = &entry->l2_flows;
+-		hlist_for_each_entry_safe(entry, tmp, head, l2_data.list)
+-			__mtk_foe_entry_clear(ppe, entry);
++		hlist_for_each_entry_safe(entry, tmp, &entry->l2_flows, l2_list)
++			__mtk_foe_entry_clear(ppe, entry, set_state);
+ 		return;
+ 	}
+ 
+-	hlist_del_init(&entry->list);
+-	if (entry->hash != 0xffff) {
++	if (entry->hash != 0xffff && set_state) {
+ 		struct mtk_foe_entry *hwe = mtk_foe_get_entry(ppe, entry->hash);
+ 
+ 		hwe->ib1 &= ~MTK_FOE_IB1_STATE;
+@@ -520,7 +521,8 @@ __mtk_foe_entry_clear(struct mtk_ppe *pp
+ 	if (entry->type != MTK_FLOW_TYPE_L2_SUBFLOW)
+ 		return;
+ 
+-	hlist_del_init(&entry->l2_data.list);
++	hlist_del_init(&entry->l2_list);
++	hlist_del_init(&entry->list);
+ 	kfree(entry);
+ }
+ 
+@@ -536,66 +538,55 @@ static int __mtk_foe_entry_idle_time(str
+ 		return now - timestamp;
+ }
+ 
++static bool
++mtk_flow_entry_update(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
++{
++	struct mtk_foe_entry foe = {};
++	struct mtk_foe_entry *hwe;
++	u16 hash = entry->hash;
++	int len;
++
++	if (hash == 0xffff)
++		return false;
++
++	hwe = mtk_foe_get_entry(ppe, hash);
++	len = mtk_flow_entry_match_len(ppe->eth, &entry->data);
++	memcpy(&foe, hwe, len);
++
++	if (!mtk_flow_entry_match(ppe->eth, entry, &foe, len) ||
++	    FIELD_GET(MTK_FOE_IB1_STATE, foe.ib1) != MTK_FOE_STATE_BIND)
++		return false;
++
++	entry->data.ib1 = foe.ib1;
++
++	return true;
++}
++
+ static void
+ mtk_flow_entry_update_l2(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
+ {
+ 	u32 ib1_ts_mask = mtk_get_ib1_ts_mask(ppe->eth);
+ 	struct mtk_flow_entry *cur;
+-	struct mtk_foe_entry *hwe;
+ 	struct hlist_node *tmp;
+ 	int idle;
+ 
+ 	idle = __mtk_foe_entry_idle_time(ppe, entry->data.ib1);
+-	hlist_for_each_entry_safe(cur, tmp, &entry->l2_flows, l2_data.list) {
++	hlist_for_each_entry_safe(cur, tmp, &entry->l2_flows, l2_list) {
+ 		int cur_idle;
+-		u32 ib1;
+-
+-		hwe = mtk_foe_get_entry(ppe, cur->hash);
+-		ib1 = READ_ONCE(hwe->ib1);
+ 
+-		if (FIELD_GET(MTK_FOE_IB1_STATE, ib1) != MTK_FOE_STATE_BIND) {
+-			cur->hash = 0xffff;
+-			__mtk_foe_entry_clear(ppe, cur);
++		if (!mtk_flow_entry_update(ppe, cur)) {
++			__mtk_foe_entry_clear(ppe, entry, false);
+ 			continue;
+ 		}
+ 
+-		cur_idle = __mtk_foe_entry_idle_time(ppe, ib1);
++		cur_idle = __mtk_foe_entry_idle_time(ppe, cur->data.ib1);
+ 		if (cur_idle >= idle)
+ 			continue;
+ 
+ 		idle = cur_idle;
+ 		entry->data.ib1 &= ~ib1_ts_mask;
+-		entry->data.ib1 |= hwe->ib1 & ib1_ts_mask;
+-	}
+-}
+-
+-static void
+-mtk_flow_entry_update(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
+-{
+-	struct mtk_foe_entry foe = {};
+-	struct mtk_foe_entry *hwe;
+-
+-	spin_lock_bh(&ppe_lock);
+-
+-	if (entry->type == MTK_FLOW_TYPE_L2) {
+-		mtk_flow_entry_update_l2(ppe, entry);
+-		goto out;
++		entry->data.ib1 |= cur->data.ib1 & ib1_ts_mask;
+ 	}
+-
+-	if (entry->hash == 0xffff)
+-		goto out;
+-
+-	hwe = mtk_foe_get_entry(ppe, entry->hash);
+-	memcpy(&foe, hwe, ppe->eth->soc->foe_entry_size);
+-	if (!mtk_flow_entry_match(ppe->eth, entry, &foe)) {
+-		entry->hash = 0xffff;
+-		goto out;
+-	}
+-
+-	entry->data.ib1 = foe.ib1;
+-
+-out:
+-	spin_unlock_bh(&ppe_lock);
+ }
+ 
+ static void
+@@ -632,7 +623,8 @@ __mtk_foe_entry_commit(struct mtk_ppe *p
+ void mtk_foe_entry_clear(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
+ {
+ 	spin_lock_bh(&ppe_lock);
+-	__mtk_foe_entry_clear(ppe, entry);
++	__mtk_foe_entry_clear(ppe, entry, true);
++	hlist_del_init(&entry->list);
+ 	spin_unlock_bh(&ppe_lock);
+ }
+ 
+@@ -679,8 +671,8 @@ mtk_foe_entry_commit_subflow(struct mtk_
+ {
+ 	const struct mtk_soc_data *soc = ppe->eth->soc;
+ 	struct mtk_flow_entry *flow_info;
+-	struct mtk_foe_entry foe = {}, *hwe;
+ 	struct mtk_foe_mac_info *l2;
++	struct mtk_foe_entry *hwe;
+ 	u32 ib1_mask = mtk_get_ib1_pkt_type_mask(ppe->eth) | MTK_FOE_IB1_UDP;
+ 	int type;
+ 
+@@ -688,30 +680,30 @@ mtk_foe_entry_commit_subflow(struct mtk_
+ 	if (!flow_info)
+ 		return;
+ 
+-	flow_info->l2_data.base_flow = entry;
+ 	flow_info->type = MTK_FLOW_TYPE_L2_SUBFLOW;
+ 	flow_info->hash = hash;
+ 	hlist_add_head(&flow_info->list,
+ 		       &ppe->foe_flow[hash / soc->hash_offset]);
+-	hlist_add_head(&flow_info->l2_data.list, &entry->l2_flows);
++	hlist_add_head(&flow_info->l2_list, &entry->l2_flows);
+ 
+ 	hwe = mtk_foe_get_entry(ppe, hash);
+-	memcpy(&foe, hwe, soc->foe_entry_size);
+-	foe.ib1 &= ib1_mask;
+-	foe.ib1 |= entry->data.ib1 & ~ib1_mask;
++	memcpy(&flow_info->data, hwe, soc->foe_entry_size);
++	flow_info->data.ib1 &= ib1_mask;
++	flow_info->data.ib1 |= entry->data.ib1 & ~ib1_mask;
+ 
+-	l2 = mtk_foe_entry_l2(ppe->eth, &foe);
++	l2 = mtk_foe_entry_l2(ppe->eth, &flow_info->data);
+ 	memcpy(l2, &entry->data.bridge.l2, sizeof(*l2));
+ 
+-	type = mtk_get_ib1_pkt_type(ppe->eth, foe.ib1);
++	type = mtk_get_ib1_pkt_type(ppe->eth, flow_info->data.ib1);
+ 	if (type == MTK_PPE_PKT_TYPE_IPV4_HNAPT)
+-		memcpy(&foe.ipv4.new, &foe.ipv4.orig, sizeof(foe.ipv4.new));
++		memcpy(&flow_info->data.ipv4.new, &flow_info->data.ipv4.orig,
++		       sizeof(flow_info->data.ipv4.new));
+ 	else if (type >= MTK_PPE_PKT_TYPE_IPV6_ROUTE_3T && l2->etype == ETH_P_IP)
+ 		l2->etype = ETH_P_IPV6;
+ 
+-	*mtk_foe_entry_ib2(ppe->eth, &foe) = entry->data.bridge.ib2;
++	*mtk_foe_entry_ib2(ppe->eth, &flow_info->data) = entry->data.bridge.ib2;
+ 
+-	__mtk_foe_entry_commit(ppe, &foe, hash);
++	__mtk_foe_entry_commit(ppe, &flow_info->data, hash);
+ }
+ 
+ void __mtk_ppe_check_skb(struct mtk_ppe *ppe, struct sk_buff *skb, u16 hash)
+@@ -721,9 +713,11 @@ void __mtk_ppe_check_skb(struct mtk_ppe
+ 	struct mtk_foe_entry *hwe = mtk_foe_get_entry(ppe, hash);
+ 	struct mtk_flow_entry *entry;
+ 	struct mtk_foe_bridge key = {};
++	struct mtk_foe_entry foe = {};
+ 	struct hlist_node *n;
+ 	struct ethhdr *eh;
+ 	bool found = false;
++	int entry_len;
+ 	u8 *tag;
+ 
+ 	spin_lock_bh(&ppe_lock);
+@@ -731,20 +725,14 @@ void __mtk_ppe_check_skb(struct mtk_ppe
+ 	if (FIELD_GET(MTK_FOE_IB1_STATE, hwe->ib1) == MTK_FOE_STATE_BIND)
+ 		goto out;
+ 
+-	hlist_for_each_entry_safe(entry, n, head, list) {
+-		if (entry->type == MTK_FLOW_TYPE_L2_SUBFLOW) {
+-			if (unlikely(FIELD_GET(MTK_FOE_IB1_STATE, hwe->ib1) ==
+-				     MTK_FOE_STATE_BIND))
+-				continue;
+-
+-			entry->hash = 0xffff;
+-			__mtk_foe_entry_clear(ppe, entry);
+-			continue;
+-		}
++	entry_len = mtk_flow_entry_match_len(ppe->eth, hwe);
++	memcpy(&foe, hwe, entry_len);
+ 
+-		if (found || !mtk_flow_entry_match(ppe->eth, entry, hwe)) {
++	hlist_for_each_entry_safe(entry, n, head, list) {
++		if (found ||
++		    !mtk_flow_entry_match(ppe->eth, entry, &foe, entry_len)) {
+ 			if (entry->hash != 0xffff)
+-				entry->hash = 0xffff;
++				__mtk_foe_entry_clear(ppe, entry, false);
+ 			continue;
+ 		}
+ 
+@@ -795,9 +783,17 @@ out:
+ 
+ int mtk_foe_entry_idle_time(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
+ {
+-	mtk_flow_entry_update(ppe, entry);
++	int idle;
++
++	spin_lock_bh(&ppe_lock);
++	if (entry->type == MTK_FLOW_TYPE_L2)
++		mtk_flow_entry_update_l2(ppe, entry);
++	else
++		mtk_flow_entry_update(ppe, entry);
++	idle = __mtk_foe_entry_idle_time(ppe, entry->data.ib1);
++	spin_unlock_bh(&ppe_lock);
+ 
+-	return __mtk_foe_entry_idle_time(ppe, entry->data.ib1);
++	return idle;
+ }
+ 
+ int mtk_ppe_prepare_reset(struct mtk_ppe *ppe)
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h
+@@ -265,7 +265,12 @@ enum {
+ 
+ struct mtk_flow_entry {
+ 	union {
+-		struct hlist_node list;
++		/* regular flows + L2 subflows */
++		struct {
++			struct hlist_node list;
++			struct hlist_node l2_list;
++		};
++		/* L2 flows */
+ 		struct {
+ 			struct rhash_head l2_node;
+ 			struct hlist_head l2_flows;
+@@ -275,13 +280,7 @@ struct mtk_flow_entry {
+ 	s8 wed_index;
+ 	u8 ppe_index;
+ 	u16 hash;
+-	union {
+-		struct mtk_foe_entry data;
+-		struct {
+-			struct mtk_flow_entry *base_flow;
+-			struct hlist_node list;
+-		} l2_data;
+-	};
++	struct mtk_foe_entry data;
+ 	struct rhash_head node;
+ 	unsigned long cookie;
+ };
diff --git a/target/linux/generic/pending-5.15/736-04-net-ethernet-mediatek-fix-ppe-flow-accounting-for-L2.patch b/target/linux/generic/pending-5.15/736-04-net-ethernet-mediatek-fix-ppe-flow-accounting-for-L2.patch
new file mode 100644
index 00000000000000..fdc3d520c119fc
--- /dev/null
+++ b/target/linux/generic/pending-5.15/736-04-net-ethernet-mediatek-fix-ppe-flow-accounting-for-L2.patch
@@ -0,0 +1,333 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 23 Mar 2023 11:05:22 +0100
+Subject: [PATCH] net: ethernet: mediatek: fix ppe flow accounting for L2
+ flows
+
+For L2 flows, the packet/byte counters should report the sum of the
+counters of their subflows, both current and expired.
+In order to make this work, change the way that accounting data is tracked.
+Reset counters when a flow enters bind. Once it expires (or enters unbind),
+store the last counter value in struct mtk_flow_entry.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -80,9 +80,9 @@ static int mtk_ppe_mib_wait_busy(struct
+ 	int ret;
+ 	u32 val;
+ 
+-	ret = readl_poll_timeout(ppe->base + MTK_PPE_MIB_SER_CR, val,
+-				 !(val & MTK_PPE_MIB_SER_CR_ST),
+-				 20, MTK_PPE_WAIT_TIMEOUT_US);
++	ret = readl_poll_timeout_atomic(ppe->base + MTK_PPE_MIB_SER_CR, val,
++					!(val & MTK_PPE_MIB_SER_CR_ST),
++					20, MTK_PPE_WAIT_TIMEOUT_US);
+ 
+ 	if (ret)
+ 		dev_err(ppe->dev, "MIB table busy");
+@@ -90,18 +90,32 @@ static int mtk_ppe_mib_wait_busy(struct
+ 	return ret;
+ }
+ 
+-static int mtk_mib_entry_read(struct mtk_ppe *ppe, u16 index, u64 *bytes, u64 *packets)
++static inline struct mtk_foe_accounting *
++mtk_ppe_acct_data(struct mtk_ppe *ppe, u16 index)
++{
++	if (!ppe->acct_table)
++		return NULL;
++
++	return ppe->acct_table + index * sizeof(struct mtk_foe_accounting);
++}
++
++struct mtk_foe_accounting *mtk_ppe_mib_entry_read(struct mtk_ppe *ppe, u16 index)
+ {
+ 	u32 byte_cnt_low, byte_cnt_high, pkt_cnt_low, pkt_cnt_high;
+ 	u32 val, cnt_r0, cnt_r1, cnt_r2;
++	struct mtk_foe_accounting *acct;
+ 	int ret;
+ 
+ 	val = FIELD_PREP(MTK_PPE_MIB_SER_CR_ADDR, index) | MTK_PPE_MIB_SER_CR_ST;
+ 	ppe_w32(ppe, MTK_PPE_MIB_SER_CR, val);
+ 
++	acct = mtk_ppe_acct_data(ppe, index);
++	if (!acct)
++		return NULL;
++
+ 	ret = mtk_ppe_mib_wait_busy(ppe);
+ 	if (ret)
+-		return ret;
++		return acct;
+ 
+ 	cnt_r0 = readl(ppe->base + MTK_PPE_MIB_SER_R0);
+ 	cnt_r1 = readl(ppe->base + MTK_PPE_MIB_SER_R1);
+@@ -111,10 +125,11 @@ static int mtk_mib_entry_read(struct mtk
+ 	byte_cnt_high = FIELD_GET(MTK_PPE_MIB_SER_R1_BYTE_CNT_HIGH, cnt_r1);
+ 	pkt_cnt_low = FIELD_GET(MTK_PPE_MIB_SER_R1_PKT_CNT_LOW, cnt_r1);
+ 	pkt_cnt_high = FIELD_GET(MTK_PPE_MIB_SER_R2_PKT_CNT_HIGH, cnt_r2);
+-	*bytes = ((u64)byte_cnt_high << 32) | byte_cnt_low;
+-	*packets = (pkt_cnt_high << 16) | pkt_cnt_low;
+ 
+-	return 0;
++	acct->bytes += ((u64)byte_cnt_high << 32) | byte_cnt_low;
++	acct->packets += (pkt_cnt_high << 16) | pkt_cnt_low;
++
++	return acct;
+ }
+ 
+ static void mtk_ppe_cache_clear(struct mtk_ppe *ppe)
+@@ -508,13 +523,6 @@ __mtk_foe_entry_clear(struct mtk_ppe *pp
+ 		hwe->ib1 &= ~MTK_FOE_IB1_STATE;
+ 		hwe->ib1 |= FIELD_PREP(MTK_FOE_IB1_STATE, MTK_FOE_STATE_INVALID);
+ 		dma_wmb();
+-		if (ppe->accounting) {
+-			struct mtk_foe_accounting *acct;
+-
+-			acct = ppe->acct_table + entry->hash * sizeof(*acct);
+-			acct->packets = 0;
+-			acct->bytes = 0;
+-		}
+ 	}
+ 	entry->hash = 0xffff;
+ 
+@@ -539,11 +547,14 @@ static int __mtk_foe_entry_idle_time(str
+ }
+ 
+ static bool
+-mtk_flow_entry_update(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
++mtk_flow_entry_update(struct mtk_ppe *ppe, struct mtk_flow_entry *entry,
++		      u64 *packets, u64 *bytes)
+ {
++	struct mtk_foe_accounting *acct;
+ 	struct mtk_foe_entry foe = {};
+ 	struct mtk_foe_entry *hwe;
+ 	u16 hash = entry->hash;
++	bool ret = false;
+ 	int len;
+ 
+ 	if (hash == 0xffff)
+@@ -554,18 +565,35 @@ mtk_flow_entry_update(struct mtk_ppe *pp
+ 	memcpy(&foe, hwe, len);
+ 
+ 	if (!mtk_flow_entry_match(ppe->eth, entry, &foe, len) ||
+-	    FIELD_GET(MTK_FOE_IB1_STATE, foe.ib1) != MTK_FOE_STATE_BIND)
+-		return false;
++	    FIELD_GET(MTK_FOE_IB1_STATE, foe.ib1) != MTK_FOE_STATE_BIND) {
++		acct = mtk_ppe_acct_data(ppe, hash);
++		if (acct) {
++			entry->prev_packets += acct->packets;
++			entry->prev_bytes += acct->bytes;
++		}
++
++		goto out;
++	}
+ 
+ 	entry->data.ib1 = foe.ib1;
++	acct = mtk_ppe_mib_entry_read(ppe, hash);
++	ret = true;
++
++out:
++	if (acct) {
++		*packets += acct->packets;
++		*bytes += acct->bytes;
++	}
+ 
+-	return true;
++	return ret;
+ }
+ 
+ static void
+ mtk_flow_entry_update_l2(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
+ {
+ 	u32 ib1_ts_mask = mtk_get_ib1_ts_mask(ppe->eth);
++	u64 *packets = &entry->packets;
++	u64 *bytes = &entry->bytes;
+ 	struct mtk_flow_entry *cur;
+ 	struct hlist_node *tmp;
+ 	int idle;
+@@ -574,7 +602,9 @@ mtk_flow_entry_update_l2(struct mtk_ppe
+ 	hlist_for_each_entry_safe(cur, tmp, &entry->l2_flows, l2_list) {
+ 		int cur_idle;
+ 
+-		if (!mtk_flow_entry_update(ppe, cur)) {
++		if (!mtk_flow_entry_update(ppe, cur, packets, bytes)) {
++			entry->prev_packets += cur->prev_packets;
++			entry->prev_bytes += cur->prev_bytes;
+ 			__mtk_foe_entry_clear(ppe, entry, false);
+ 			continue;
+ 		}
+@@ -589,10 +619,29 @@ mtk_flow_entry_update_l2(struct mtk_ppe
+ 	}
+ }
+ 
++void mtk_foe_entry_get_stats(struct mtk_ppe *ppe, struct mtk_flow_entry *entry,
++			     int *idle)
++{
++	entry->packets = entry->prev_packets;
++	entry->bytes = entry->prev_bytes;
++
++	spin_lock_bh(&ppe_lock);
++
++	if (entry->type == MTK_FLOW_TYPE_L2)
++		mtk_flow_entry_update_l2(ppe, entry);
++	else
++		mtk_flow_entry_update(ppe, entry, &entry->packets, &entry->bytes);
++
++	*idle = __mtk_foe_entry_idle_time(ppe, entry->data.ib1);
++
++	spin_unlock_bh(&ppe_lock);
++}
++
+ static void
+ __mtk_foe_entry_commit(struct mtk_ppe *ppe, struct mtk_foe_entry *entry,
+ 		       u16 hash)
+ {
++	struct mtk_foe_accounting *acct;
+ 	struct mtk_eth *eth = ppe->eth;
+ 	u16 timestamp = mtk_eth_timestamp(eth);
+ 	struct mtk_foe_entry *hwe;
+@@ -617,6 +666,12 @@ __mtk_foe_entry_commit(struct mtk_ppe *p
+ 
+ 	dma_wmb();
+ 
++	acct = mtk_ppe_mib_entry_read(ppe, hash);
++	if (acct) {
++		acct->packets = 0;
++		acct->bytes = 0;
++	}
++
+ 	mtk_ppe_cache_clear(ppe);
+ }
+ 
+@@ -781,21 +836,6 @@ out:
+ 	spin_unlock_bh(&ppe_lock);
+ }
+ 
+-int mtk_foe_entry_idle_time(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
+-{
+-	int idle;
+-
+-	spin_lock_bh(&ppe_lock);
+-	if (entry->type == MTK_FLOW_TYPE_L2)
+-		mtk_flow_entry_update_l2(ppe, entry);
+-	else
+-		mtk_flow_entry_update(ppe, entry);
+-	idle = __mtk_foe_entry_idle_time(ppe, entry->data.ib1);
+-	spin_unlock_bh(&ppe_lock);
+-
+-	return idle;
+-}
+-
+ int mtk_ppe_prepare_reset(struct mtk_ppe *ppe)
+ {
+ 	if (!ppe)
+@@ -823,32 +863,6 @@ int mtk_ppe_prepare_reset(struct mtk_ppe
+ 	return mtk_ppe_wait_busy(ppe);
+ }
+ 
+-struct mtk_foe_accounting *mtk_foe_entry_get_mib(struct mtk_ppe *ppe, u32 index,
+-						 struct mtk_foe_accounting *diff)
+-{
+-	struct mtk_foe_accounting *acct;
+-	int size = sizeof(struct mtk_foe_accounting);
+-	u64 bytes, packets;
+-
+-	if (!ppe->accounting)
+-		return NULL;
+-
+-	if (mtk_mib_entry_read(ppe, index, &bytes, &packets))
+-		return NULL;
+-
+-	acct = ppe->acct_table + index * size;
+-
+-	acct->bytes += bytes;
+-	acct->packets += packets;
+-
+-	if (diff) {
+-		diff->bytes = bytes;
+-		diff->packets = packets;
+-	}
+-
+-	return acct;
+-}
+-
+ struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base, int index)
+ {
+ 	bool accounting = eth->soc->has_accounting;
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h
+@@ -283,6 +283,8 @@ struct mtk_flow_entry {
+ 	struct mtk_foe_entry data;
+ 	struct rhash_head node;
+ 	unsigned long cookie;
++	u64 prev_packets, prev_bytes;
++	u64 packets, bytes;
+ };
+ 
+ struct mtk_mib_entry {
+@@ -325,6 +327,7 @@ struct mtk_ppe *mtk_ppe_init(struct mtk_
+ void mtk_ppe_start(struct mtk_ppe *ppe);
+ int mtk_ppe_stop(struct mtk_ppe *ppe);
+ int mtk_ppe_prepare_reset(struct mtk_ppe *ppe);
++struct mtk_foe_accounting *mtk_ppe_mib_entry_read(struct mtk_ppe *ppe, u16 index);
+ 
+ void __mtk_ppe_check_skb(struct mtk_ppe *ppe, struct sk_buff *skb, u16 hash);
+ 
+@@ -373,9 +376,8 @@ int mtk_foe_entry_set_queue(struct mtk_e
+ 			    unsigned int queue);
+ int mtk_foe_entry_commit(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+ void mtk_foe_entry_clear(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+-int mtk_foe_entry_idle_time(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+ int mtk_ppe_debugfs_init(struct mtk_ppe *ppe, int index);
+-struct mtk_foe_accounting *mtk_foe_entry_get_mib(struct mtk_ppe *ppe, u32 index,
+-						 struct mtk_foe_accounting *diff);
++void mtk_foe_entry_get_stats(struct mtk_ppe *ppe, struct mtk_flow_entry *entry,
++			     int *idle);
+ 
+ #endif
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_debugfs.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_debugfs.c
+@@ -96,7 +96,7 @@ mtk_ppe_debugfs_foe_show(struct seq_file
+ 		if (bind && state != MTK_FOE_STATE_BIND)
+ 			continue;
+ 
+-		acct = mtk_foe_entry_get_mib(ppe, i, NULL);
++		acct = mtk_ppe_mib_entry_read(ppe, i);
+ 
+ 		type = FIELD_GET(MTK_FOE_IB1_PACKET_TYPE, entry->ib1);
+ 		seq_printf(m, "%05x %s %7s", i,
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
+@@ -499,24 +499,21 @@ static int
+ mtk_flow_offload_stats(struct mtk_eth *eth, struct flow_cls_offload *f)
+ {
+ 	struct mtk_flow_entry *entry;
+-	struct mtk_foe_accounting diff;
+-	u32 idle;
++	u64 packets, bytes;
++	int idle;
+ 
+ 	entry = rhashtable_lookup(&eth->flow_table, &f->cookie,
+ 				  mtk_flow_ht_params);
+ 	if (!entry)
+ 		return -ENOENT;
+ 
+-	idle = mtk_foe_entry_idle_time(eth->ppe[entry->ppe_index], entry);
++	packets = entry->packets;
++	bytes = entry->bytes;
++	mtk_foe_entry_get_stats(eth->ppe[entry->ppe_index], entry, &idle);
++	f->stats.pkts += entry->packets - packets;
++	f->stats.bytes += entry->bytes - bytes;
+ 	f->stats.lastused = jiffies - idle * HZ;
+ 
+-	if (entry->hash != 0xFFFF &&
+-	    mtk_foe_entry_get_mib(eth->ppe[entry->ppe_index], entry->hash,
+-				  &diff)) {
+-		f->stats.pkts += diff.packets;
+-		f->stats.bytes += diff.bytes;
+-	}
+-
+ 	return 0;
+ }
+ 
diff --git a/target/linux/generic/pending-5.15/736-05-net-ethernet-mtk_eth_soc-add-missing-ppe-cache-flush.patch b/target/linux/generic/pending-5.15/736-05-net-ethernet-mtk_eth_soc-add-missing-ppe-cache-flush.patch
new file mode 100644
index 00000000000000..30839319c7dcd9
--- /dev/null
+++ b/target/linux/generic/pending-5.15/736-05-net-ethernet-mtk_eth_soc-add-missing-ppe-cache-flush.patch
@@ -0,0 +1,21 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 23 Mar 2023 11:19:14 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: add missing ppe cache flush when
+ deleting a flow
+
+The cache needs to be flushed to ensure that the hardware stops offloading
+the flow immediately.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -523,6 +523,7 @@ __mtk_foe_entry_clear(struct mtk_ppe *pp
+ 		hwe->ib1 &= ~MTK_FOE_IB1_STATE;
+ 		hwe->ib1 |= FIELD_PREP(MTK_FOE_IB1_STATE, MTK_FOE_STATE_INVALID);
+ 		dma_wmb();
++		mtk_ppe_cache_clear(ppe);
+ 	}
+ 	entry->hash = 0xffff;
+ 
diff --git a/target/linux/generic/pending-5.15/736-06-net-ethernet-mediatek-fix-ppe-flow-accounting-for-v1.patch b/target/linux/generic/pending-5.15/736-06-net-ethernet-mediatek-fix-ppe-flow-accounting-for-v1.patch
new file mode 100644
index 00000000000000..3dfa193e7079e2
--- /dev/null
+++ b/target/linux/generic/pending-5.15/736-06-net-ethernet-mediatek-fix-ppe-flow-accounting-for-v1.patch
@@ -0,0 +1,51 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 23 Mar 2023 21:45:43 +0100
+Subject: [PATCH] net: ethernet: mediatek: fix ppe flow accounting for v1
+ hardware
+
+Older chips (like MT7622) use a different bit in ib2 to enable hardware
+counter support.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -646,6 +646,7 @@ __mtk_foe_entry_commit(struct mtk_ppe *p
+ 	struct mtk_eth *eth = ppe->eth;
+ 	u16 timestamp = mtk_eth_timestamp(eth);
+ 	struct mtk_foe_entry *hwe;
++	u32 val;
+ 
+ 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+ 		entry->ib1 &= ~MTK_FOE_IB1_BIND_TIMESTAMP_V2;
+@@ -662,8 +663,13 @@ __mtk_foe_entry_commit(struct mtk_ppe *p
+ 	wmb();
+ 	hwe->ib1 = entry->ib1;
+ 
+-	if (ppe->accounting)
+-		*mtk_foe_entry_ib2(eth, hwe) |= MTK_FOE_IB2_MIB_CNT;
++	if (ppe->accounting) {
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++			val = MTK_FOE_IB2_MIB_CNT_V2;
++		else
++			val = MTK_FOE_IB2_MIB_CNT;
++		*mtk_foe_entry_ib2(eth, hwe) |= val;
++	}
+ 
+ 	dma_wmb();
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h
+@@ -55,9 +55,10 @@ enum {
+ #define MTK_FOE_IB2_PSE_QOS		BIT(4)
+ #define MTK_FOE_IB2_DEST_PORT		GENMASK(7, 5)
+ #define MTK_FOE_IB2_MULTICAST		BIT(8)
++#define MTK_FOE_IB2_MIB_CNT		BIT(10)
+ 
+ #define MTK_FOE_IB2_WDMA_QID2		GENMASK(13, 12)
+-#define MTK_FOE_IB2_MIB_CNT		BIT(15)
++#define MTK_FOE_IB2_MIB_CNT_V2		BIT(15)
+ #define MTK_FOE_IB2_WDMA_DEVIDX		BIT(16)
+ #define MTK_FOE_IB2_WDMA_WINFO		BIT(17)
+ 
diff --git a/target/linux/generic/pending-5.15/737-01-net-ethernet-mtk_eth_soc-add-MTK_NETSYS_V1-capabilit.patch b/target/linux/generic/pending-5.15/737-01-net-ethernet-mtk_eth_soc-add-MTK_NETSYS_V1-capabilit.patch
new file mode 100644
index 00000000000000..621a7b0fcf0839
--- /dev/null
+++ b/target/linux/generic/pending-5.15/737-01-net-ethernet-mtk_eth_soc-add-MTK_NETSYS_V1-capabilit.patch
@@ -0,0 +1,223 @@
+From 663fa1b7e0cb2c929008482014a70c6625caad75 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 7 Mar 2023 15:55:13 +0000
+Subject: [PATCH 1/7] net: ethernet: mtk_eth_soc: add MTK_NETSYS_V1 capability
+ bit
+
+Introduce MTK_NETSYS_V1 bit in the device capabilities for
+MT7621/MT7622/MT7623/MT7628/MT7629 SoCs.
+Use !MTK_NETSYS_V1 instead of MTK_NETSYS_V2 in the driver codebase.
+This is a preliminary patch to introduce support for MT7988 SoC.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 30 +++++++-------
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h | 45 ++++++++++++---------
+ 2 files changed, 41 insertions(+), 34 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -597,7 +597,7 @@ static void mtk_set_queue_speed(struct m
+ 	      FIELD_PREP(MTK_QTX_SCH_MIN_RATE_MAN, 1) |
+ 	      FIELD_PREP(MTK_QTX_SCH_MIN_RATE_EXP, 4) |
+ 	      MTK_QTX_SCH_LEAKY_BUCKET_SIZE;
+-	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1))
+ 		val |= MTK_QTX_SCH_LEAKY_BUCKET_EN;
+ 
+ 	if (IS_ENABLED(CONFIG_SOC_MT7621)) {
+@@ -974,7 +974,7 @@ static bool mtk_rx_get_desc(struct mtk_e
+ 	rxd->rxd1 = READ_ONCE(dma_rxd->rxd1);
+ 	rxd->rxd3 = READ_ONCE(dma_rxd->rxd3);
+ 	rxd->rxd4 = READ_ONCE(dma_rxd->rxd4);
+-	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1)) {
+ 		rxd->rxd5 = READ_ONCE(dma_rxd->rxd5);
+ 		rxd->rxd6 = READ_ONCE(dma_rxd->rxd6);
+ 	}
+@@ -1032,7 +1032,7 @@ static int mtk_init_fq_dma(struct mtk_et
+ 
+ 		txd->txd3 = TX_DMA_PLEN0(MTK_QDMA_PAGE_SIZE);
+ 		txd->txd4 = 0;
+-		if (MTK_HAS_CAPS(soc->caps, MTK_NETSYS_V2)) {
++		if (!MTK_HAS_CAPS(soc->caps, MTK_NETSYS_V1)) {
+ 			txd->txd5 = 0;
+ 			txd->txd6 = 0;
+ 			txd->txd7 = 0;
+@@ -1221,7 +1221,7 @@ static void mtk_tx_set_dma_desc(struct n
+ 	struct mtk_mac *mac = netdev_priv(dev);
+ 	struct mtk_eth *eth = mac->hw;
+ 
+-	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1))
+ 		mtk_tx_set_dma_desc_v2(dev, txd, info);
+ 	else
+ 		mtk_tx_set_dma_desc_v1(dev, txd, info);
+@@ -1902,7 +1902,7 @@ static int mtk_poll_rx(struct napi_struc
+ 			break;
+ 
+ 		/* find out which mac the packet come from. values start at 1 */
+-		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++		if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1))
+ 			mac = RX_DMA_GET_SPORT_V2(trxd.rxd5) - 1;
+ 		else if (!MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628) &&
+ 			 !(trxd.rxd4 & RX_DMA_SPECIAL_TAG))
+@@ -1998,7 +1998,7 @@ static int mtk_poll_rx(struct napi_struc
+ 		skb->dev = netdev;
+ 		bytes += skb->len;
+ 
+-		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++		if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1)) {
+ 			reason = FIELD_GET(MTK_RXD5_PPE_CPU_REASON, trxd.rxd5);
+ 			hash = trxd.rxd5 & MTK_RXD5_FOE_ENTRY;
+ 			if (hash != MTK_RXD5_FOE_ENTRY)
+@@ -2023,7 +2023,7 @@ static int mtk_poll_rx(struct napi_struc
+ 		/* When using VLAN untagging in combination with DSA, the
+ 		 * hardware treats the MTK special tag as a VLAN and untags it.
+ 		 */
+-		if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2) &&
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1) &&
+ 		    (trxd.rxd2 & RX_DMA_VTAG) && netdev_uses_dsa(netdev)) {
+ 			unsigned int port = RX_DMA_VPID(trxd.rxd3) & GENMASK(2, 0);
+ 
+@@ -2328,7 +2328,7 @@ static int mtk_tx_alloc(struct mtk_eth *
+ 		txd->txd2 = next_ptr;
+ 		txd->txd3 = TX_DMA_LS0 | TX_DMA_OWNER_CPU;
+ 		txd->txd4 = 0;
+-		if (MTK_HAS_CAPS(soc->caps, MTK_NETSYS_V2)) {
++		if (!MTK_HAS_CAPS(soc->caps, MTK_NETSYS_V1)) {
+ 			txd->txd5 = 0;
+ 			txd->txd6 = 0;
+ 			txd->txd7 = 0;
+@@ -2381,7 +2381,7 @@ static int mtk_tx_alloc(struct mtk_eth *
+ 			      FIELD_PREP(MTK_QTX_SCH_MIN_RATE_MAN, 1) |
+ 			      FIELD_PREP(MTK_QTX_SCH_MIN_RATE_EXP, 4) |
+ 			      MTK_QTX_SCH_LEAKY_BUCKET_SIZE;
+-			if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++			if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1))
+ 				val |= MTK_QTX_SCH_LEAKY_BUCKET_EN;
+ 			mtk_w32(eth, val, soc->reg_map->qdma.qtx_sch + ofs);
+ 			ofs += MTK_QTX_OFFSET;
+@@ -2515,7 +2515,7 @@ static int mtk_rx_alloc(struct mtk_eth *
+ 
+ 		rxd->rxd3 = 0;
+ 		rxd->rxd4 = 0;
+-		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++		if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1)) {
+ 			rxd->rxd5 = 0;
+ 			rxd->rxd6 = 0;
+ 			rxd->rxd7 = 0;
+@@ -3063,7 +3063,7 @@ static int mtk_start_dma(struct mtk_eth
+ 		       MTK_TX_BT_32DWORDS | MTK_NDP_CO_PRO |
+ 		       MTK_RX_2B_OFFSET | MTK_TX_WB_DDONE;
+ 
+-		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++		if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1))
+ 			val |= MTK_MUTLI_CNT | MTK_RESV_BUF |
+ 			       MTK_WCOMP_EN | MTK_DMAD_WR_WDONE |
+ 			       MTK_CHK_DDONE_EN | MTK_LEAKY_BUCKET_EN;
+@@ -3475,7 +3475,7 @@ static void mtk_hw_reset(struct mtk_eth
+ {
+ 	u32 val;
+ 
+-	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1)) {
+ 		regmap_write(eth->ethsys, ETHSYS_FE_RST_CHK_IDLE_EN, 0);
+ 		val = RSTCTRL_PPE0_V2;
+ 	} else {
+@@ -3487,7 +3487,7 @@ static void mtk_hw_reset(struct mtk_eth
+ 
+ 	ethsys_reset(eth, RSTCTRL_ETH | RSTCTRL_FE | val);
+ 
+-	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1))
+ 		regmap_write(eth->ethsys, ETHSYS_FE_RST_CHK_IDLE_EN,
+ 			     0x3ffffff);
+ }
+@@ -3683,7 +3683,7 @@ static int mtk_hw_init(struct mtk_eth *e
+ 	else
+ 		mtk_hw_reset(eth);
+ 
+-	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1)) {
+ 		/* Set FE to PDMAv2 if necessary */
+ 		val = mtk_r32(eth, MTK_FE_GLO_MISC);
+ 		mtk_w32(eth,  val | BIT(4), MTK_FE_GLO_MISC);
+@@ -3720,7 +3720,7 @@ static int mtk_hw_init(struct mtk_eth *e
+ 	 */
+ 	val = mtk_r32(eth, MTK_CDMQ_IG_CTRL);
+ 	mtk_w32(eth, val | MTK_CDMQ_STAG_EN, MTK_CDMQ_IG_CTRL);
+-	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1)) {
+ 		val = mtk_r32(eth, MTK_CDMP_IG_CTRL);
+ 		mtk_w32(eth, val | MTK_CDMP_STAG_EN, MTK_CDMP_IG_CTRL);
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -816,6 +816,7 @@ enum mkt_eth_capabilities {
+ 	MTK_SHARED_INT_BIT,
+ 	MTK_TRGMII_MT7621_CLK_BIT,
+ 	MTK_QDMA_BIT,
++	MTK_NETSYS_V1_BIT,
+ 	MTK_NETSYS_V2_BIT,
+ 	MTK_SOC_MT7628_BIT,
+ 	MTK_RSTCTRL_PPE1_BIT,
+@@ -851,6 +852,7 @@ enum mkt_eth_capabilities {
+ #define MTK_SHARED_INT		BIT(MTK_SHARED_INT_BIT)
+ #define MTK_TRGMII_MT7621_CLK	BIT(MTK_TRGMII_MT7621_CLK_BIT)
+ #define MTK_QDMA		BIT(MTK_QDMA_BIT)
++#define MTK_NETSYS_V1		BIT(MTK_NETSYS_V1_BIT)
+ #define MTK_NETSYS_V2		BIT(MTK_NETSYS_V2_BIT)
+ #define MTK_SOC_MT7628		BIT(MTK_SOC_MT7628_BIT)
+ #define MTK_RSTCTRL_PPE1	BIT(MTK_RSTCTRL_PPE1_BIT)
+@@ -913,25 +915,30 @@ enum mkt_eth_capabilities {
+ 
+ #define MTK_HAS_CAPS(caps, _x)		(((caps) & (_x) & ~(MTK_CAP_MASK)) == (_x))
+ 
+-#define MT7621_CAPS  (MTK_GMAC1_RGMII | MTK_GMAC1_TRGMII | \
+-		      MTK_GMAC2_RGMII | MTK_SHARED_INT | \
+-		      MTK_TRGMII_MT7621_CLK | MTK_QDMA)
+-
+-#define MT7622_CAPS  (MTK_GMAC1_RGMII | MTK_GMAC1_SGMII | MTK_GMAC2_RGMII | \
+-		      MTK_GMAC2_SGMII | MTK_GDM1_ESW | \
+-		      MTK_MUX_GDM1_TO_GMAC1_ESW | \
+-		      MTK_MUX_GMAC1_GMAC2_TO_SGMII_RGMII | MTK_QDMA)
+-
+-#define MT7623_CAPS  (MTK_GMAC1_RGMII | MTK_GMAC1_TRGMII | MTK_GMAC2_RGMII | \
+-		      MTK_QDMA)
+-
+-#define MT7628_CAPS  (MTK_SHARED_INT | MTK_SOC_MT7628)
+-
+-#define MT7629_CAPS  (MTK_GMAC1_SGMII | MTK_GMAC2_SGMII | MTK_GMAC2_GEPHY | \
+-		      MTK_GDM1_ESW | MTK_MUX_GDM1_TO_GMAC1_ESW | \
+-		      MTK_MUX_GMAC2_GMAC0_TO_GEPHY | \
+-		      MTK_MUX_U3_GMAC2_TO_QPHY | \
+-		      MTK_MUX_GMAC12_TO_GEPHY_SGMII | MTK_QDMA)
++#define MT7621_CAPS  (MTK_GMAC1_RGMII | MTK_GMAC1_TRGMII |	\
++		      MTK_GMAC2_RGMII | MTK_SHARED_INT |	\
++		      MTK_TRGMII_MT7621_CLK | MTK_QDMA |	\
++		      MTK_NETSYS_V1)
++
++#define MT7622_CAPS  (MTK_GMAC1_RGMII | MTK_GMAC1_SGMII |	\
++		      MTK_GMAC2_RGMII | MTK_GMAC2_SGMII |	\
++		      MTK_GDM1_ESW | MTK_MUX_GDM1_TO_GMAC1_ESW |\
++		      MTK_MUX_GMAC1_GMAC2_TO_SGMII_RGMII |	\
++		      MTK_QDMA | MTK_NETSYS_V1)
++
++#define MT7623_CAPS  (MTK_GMAC1_RGMII | MTK_GMAC1_TRGMII |	\
++		      MTK_GMAC2_RGMII | MTK_QDMA |		\
++		      MTK_NETSYS_V1)
++
++#define MT7628_CAPS  (MTK_SHARED_INT | MTK_SOC_MT7628 |		\
++		      MTK_NETSYS_V1)
++
++#define MT7629_CAPS  (MTK_GMAC1_SGMII | MTK_GMAC2_SGMII |	\
++		      MTK_GMAC2_GEPHY | MTK_GDM1_ESW |		\
++		      MTK_MUX_GMAC2_GMAC0_TO_GEPHY | MTK_QDMA |	\
++		      MTK_MUX_U3_GMAC2_TO_QPHY | MTK_NETSYS_V1 |\
++		      MTK_MUX_GDM1_TO_GMAC1_ESW |		\
++		      MTK_MUX_GMAC12_TO_GEPHY_SGMII)
+ 
+ #define MT7981_CAPS  (MTK_GMAC1_SGMII | MTK_GMAC2_SGMII | MTK_GMAC2_GEPHY | \
+ 		      MTK_MUX_GMAC12_TO_GEPHY_SGMII | MTK_QDMA | \
diff --git a/target/linux/generic/pending-5.15/737-02-net-ethernet-mtk_eth_soc-move-MAX_DEVS-in-mtk_soc_da.patch b/target/linux/generic/pending-5.15/737-02-net-ethernet-mtk_eth_soc-move-MAX_DEVS-in-mtk_soc_da.patch
new file mode 100644
index 00000000000000..a8debc41bfb3ce
--- /dev/null
+++ b/target/linux/generic/pending-5.15/737-02-net-ethernet-mtk_eth_soc-move-MAX_DEVS-in-mtk_soc_da.patch
@@ -0,0 +1,181 @@
+From 5af2b2dc4d6ba0ff7696e79f18e5b2bf862194eb Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 7 Mar 2023 15:55:24 +0000
+Subject: [PATCH 2/7] net: ethernet: mtk_eth_soc: move MAX_DEVS in mtk_soc_data
+
+This is a preliminary patch to add MT7988 SoC support since it runs 3
+macs instead of 2.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 34 +++++++++++++++++++--
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h | 11 +++----
+ 2 files changed, 36 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3989,7 +3989,10 @@ static void mtk_sgmii_destroy(struct mtk
+ {
+ 	int i;
+ 
+-	for (i = 0; i < MTK_MAX_DEVS; i++)
++	if (!eth->sgmii_pcs)
++		return;
++
++	for (i = 0; i < eth->soc->num_devs; i++)
+ 		mtk_pcs_lynxi_destroy(eth->sgmii_pcs[i]);
+ }
+ 
+@@ -4432,7 +4435,12 @@ static int mtk_sgmii_init(struct mtk_eth
+ 	u32 flags;
+ 	int i;
+ 
+-	for (i = 0; i < MTK_MAX_DEVS; i++) {
++	eth->sgmii_pcs = devm_kzalloc(eth->dev,
++				      sizeof(*eth->sgmii_pcs) *
++				      eth->soc->num_devs,
++				      GFP_KERNEL);
++
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		np = of_parse_phandle(eth->dev->of_node, "mediatek,sgmiisys", i);
+ 		if (!np)
+ 			break;
+@@ -4477,6 +4485,18 @@ static int mtk_probe(struct platform_dev
+ 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628))
+ 		eth->ip_align = NET_IP_ALIGN;
+ 
++	eth->netdev = devm_kzalloc(eth->dev,
++				   sizeof(*eth->netdev) * eth->soc->num_devs,
++				   GFP_KERNEL);
++	if (!eth->netdev)
++		return -ENOMEM;
++
++	eth->mac = devm_kzalloc(eth->dev,
++				sizeof(*eth->mac) * eth->soc->num_devs,
++				GFP_KERNEL);
++	if (!eth->mac)
++		return -ENOMEM;
++
+ 	spin_lock_init(&eth->page_lock);
+ 	spin_lock_init(&eth->tx_irq_lock);
+ 	spin_lock_init(&eth->rx_irq_lock);
+@@ -4662,7 +4682,7 @@ static int mtk_probe(struct platform_dev
+ 			goto err_free_dev;
+ 	}
+ 
+-	for (i = 0; i < MTK_MAX_DEVS; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		if (!eth->netdev[i])
+ 			continue;
+ 
+@@ -4739,6 +4759,7 @@ static const struct mtk_soc_data mt2701_
+ 	.hw_features = MTK_HW_FEATURES,
+ 	.required_clks = MT7623_CLKS_BITMAP,
+ 	.required_pctl = true,
++	.num_devs = 2,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+ 		.rxd_size = sizeof(struct mtk_rx_dma),
+@@ -4757,6 +4778,7 @@ static const struct mtk_soc_data mt7621_
+ 	.required_pctl = false,
+ 	.offload_version = 1,
+ 	.hash_offset = 2,
++	.num_devs = 2,
+ 	.foe_entry_size = sizeof(struct mtk_foe_entry) - 16,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+@@ -4778,6 +4800,7 @@ static const struct mtk_soc_data mt7622_
+ 	.offload_version = 2,
+ 	.hash_offset = 2,
+ 	.has_accounting = true,
++	.num_devs = 2,
+ 	.foe_entry_size = sizeof(struct mtk_foe_entry) - 16,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+@@ -4797,6 +4820,7 @@ static const struct mtk_soc_data mt7623_
+ 	.required_pctl = true,
+ 	.offload_version = 1,
+ 	.hash_offset = 2,
++	.num_devs = 2,
+ 	.foe_entry_size = sizeof(struct mtk_foe_entry) - 16,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+@@ -4816,6 +4840,7 @@ static const struct mtk_soc_data mt7629_
+ 	.required_clks = MT7629_CLKS_BITMAP,
+ 	.required_pctl = false,
+ 	.has_accounting = true,
++	.num_devs = 2,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+ 		.rxd_size = sizeof(struct mtk_rx_dma),
+@@ -4837,6 +4862,7 @@ static const struct mtk_soc_data mt7981_
+ 	.hash_offset = 4,
+ 	.foe_entry_size = sizeof(struct mtk_foe_entry),
+ 	.has_accounting = true,
++	.num_devs = 2,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma_v2),
+ 		.rxd_size = sizeof(struct mtk_rx_dma_v2),
+@@ -4856,6 +4882,7 @@ static const struct mtk_soc_data mt7986_
+ 	.required_pctl = false,
+ 	.offload_version = 2,
+ 	.hash_offset = 4,
++	.num_devs = 2,
+ 	.foe_entry_size = sizeof(struct mtk_foe_entry),
+ 	.has_accounting = true,
+ 	.txrx = {
+@@ -4874,6 +4901,7 @@ static const struct mtk_soc_data rt5350_
+ 	.hw_features = MTK_HW_FEATURES_MT7628,
+ 	.required_clks = MT7628_CLKS_BITMAP,
+ 	.required_pctl = false,
++	.num_devs = 2,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+ 		.rxd_size = sizeof(struct mtk_rx_dma),
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -1018,6 +1018,7 @@ struct mtk_reg_map {
+  * @required_pctl		A bool value to show whether the SoC requires
+  *				the extra setup for those pins used by GMAC.
+  * @hash_offset			Flow table hash offset.
++ * @num_devs			SoC number of macs.
+  * @foe_entry_size		Foe table entry size.
+  * @has_accounting		Bool indicating support for accounting of
+  *				offloaded flows.
+@@ -1036,6 +1037,7 @@ struct mtk_soc_data {
+ 	bool		required_pctl;
+ 	u8		offload_version;
+ 	u8		hash_offset;
++	u8		num_devs;
+ 	u16		foe_entry_size;
+ 	netdev_features_t hw_features;
+ 	bool		has_accounting;
+@@ -1051,9 +1053,6 @@ struct mtk_soc_data {
+ 
+ #define MTK_DMA_MONITOR_TIMEOUT		msecs_to_jiffies(1000)
+ 
+-/* currently no SoC has more than 2 macs */
+-#define MTK_MAX_DEVS			2
+-
+ /* struct mtk_eth -	This is the main datasructure for holding the state
+  *			of the driver
+  * @dev:		The device pointer
+@@ -1108,14 +1107,14 @@ struct mtk_eth {
+ 	spinlock_t			tx_irq_lock;
+ 	spinlock_t			rx_irq_lock;
+ 	struct net_device		dummy_dev;
+-	struct net_device		*netdev[MTK_MAX_DEVS];
+-	struct mtk_mac			*mac[MTK_MAX_DEVS];
++	struct net_device		**netdev;
++	struct mtk_mac			**mac;
+ 	int				irq[3];
+ 	u32				msg_enable;
+ 	unsigned long			sysclk;
+ 	struct regmap			*ethsys;
+ 	struct regmap			*infra;
+-	struct phylink_pcs		*sgmii_pcs[MTK_MAX_DEVS];
++	struct phylink_pcs		**sgmii_pcs;
+ 	struct regmap			*pctl;
+ 	bool				hwlro;
+ 	refcount_t			dma_refcnt;
diff --git a/target/linux/generic/pending-5.15/737-03-net-ethernet-mtk_eth_soc-rely-on-num_devs-and-remove.patch b/target/linux/generic/pending-5.15/737-03-net-ethernet-mtk_eth_soc-rely-on-num_devs-and-remove.patch
new file mode 100644
index 00000000000000..d6b36bf6368933
--- /dev/null
+++ b/target/linux/generic/pending-5.15/737-03-net-ethernet-mtk_eth_soc-rely-on-num_devs-and-remove.patch
@@ -0,0 +1,153 @@
+From 4e35e80750b33727e606be9e7ce447bde2e0deb7 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 7 Mar 2023 15:55:35 +0000
+Subject: [PATCH 3/7] net: ethernet: mtk_eth_soc: rely on num_devs and remove
+ MTK_MAC_COUNT
+
+Get rid of MTK_MAC_COUNT since it is a duplicated of eth->soc->num_devs.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 30 ++++++++++-----------
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h |  1 -
+ 2 files changed, 15 insertions(+), 16 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -900,7 +900,7 @@ static void mtk_stats_update(struct mtk_
+ {
+ 	int i;
+ 
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		if (!eth->mac[i] || !eth->mac[i]->hw_stats)
+ 			continue;
+ 		if (spin_trylock(&eth->mac[i]->hw_stats->stats_lock)) {
+@@ -1403,7 +1403,7 @@ static int mtk_queue_stopped(struct mtk_
+ {
+ 	int i;
+ 
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		if (!eth->netdev[i])
+ 			continue;
+ 		if (netif_queue_stopped(eth->netdev[i]))
+@@ -1417,7 +1417,7 @@ static void mtk_wake_queue(struct mtk_et
+ {
+ 	int i;
+ 
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		if (!eth->netdev[i])
+ 			continue;
+ 		netif_tx_wake_all_queues(eth->netdev[i]);
+@@ -1908,7 +1908,7 @@ static int mtk_poll_rx(struct napi_struc
+ 			 !(trxd.rxd4 & RX_DMA_SPECIAL_TAG))
+ 			mac = RX_DMA_GET_SPORT(trxd.rxd4) - 1;
+ 
+-		if (unlikely(mac < 0 || mac >= MTK_MAC_COUNT ||
++		if (unlikely(mac < 0 || mac >= eth->soc->num_devs ||
+ 			     !eth->netdev[mac]))
+ 			goto release_desc;
+ 
+@@ -2937,7 +2937,7 @@ static void mtk_dma_free(struct mtk_eth
+ 	const struct mtk_soc_data *soc = eth->soc;
+ 	int i;
+ 
+-	for (i = 0; i < MTK_MAC_COUNT; i++)
++	for (i = 0; i < soc->num_devs; i++)
+ 		if (eth->netdev[i])
+ 			netdev_reset_queue(eth->netdev[i]);
+ 	if (eth->scratch_ring) {
+@@ -3091,7 +3091,7 @@ static void mtk_gdm_config(struct mtk_et
+ 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628))
+ 		return;
+ 
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		u32 val = mtk_r32(eth, MTK_GDMA_FWD_CFG(i));
+ 
+ 		/* default setup the forward port to send frame to PDMA */
+@@ -3704,7 +3704,7 @@ static int mtk_hw_init(struct mtk_eth *e
+ 	 * up with the more appropriate value when mtk_mac_config call is being
+ 	 * invoked.
+ 	 */
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		struct net_device *dev = eth->netdev[i];
+ 
+ 		mtk_w32(eth, MAC_MCR_FORCE_LINK_DOWN, MTK_MAC_MCR(i));
+@@ -3909,7 +3909,7 @@ static void mtk_pending_work(struct work
+ 	mtk_prepare_for_reset(eth);
+ 
+ 	/* stop all devices to make sure that dma is properly shut down */
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		if (!eth->netdev[i] || !netif_running(eth->netdev[i]))
+ 			continue;
+ 
+@@ -3925,7 +3925,7 @@ static void mtk_pending_work(struct work
+ 	mtk_hw_init(eth, true);
+ 
+ 	/* restart DMA and enable IRQs */
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		if (!test_bit(i, &restart))
+ 			continue;
+ 
+@@ -3953,7 +3953,7 @@ static int mtk_free_dev(struct mtk_eth *
+ {
+ 	int i;
+ 
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		if (!eth->netdev[i])
+ 			continue;
+ 		free_netdev(eth->netdev[i]);
+@@ -3972,7 +3972,7 @@ static int mtk_unreg_dev(struct mtk_eth
+ {
+ 	int i;
+ 
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		struct mtk_mac *mac;
+ 		if (!eth->netdev[i])
+ 			continue;
+@@ -4277,7 +4277,7 @@ static int mtk_add_mac(struct mtk_eth *e
+ 	}
+ 
+ 	id = be32_to_cpup(_id);
+-	if (id >= MTK_MAC_COUNT) {
++	if (id >= eth->soc->num_devs) {
+ 		dev_err(eth->dev, "%d is not a valid mac id\n", id);
+ 		return -EINVAL;
+ 	}
+@@ -4407,7 +4407,7 @@ void mtk_eth_set_dma_device(struct mtk_e
+ 
+ 	rtnl_lock();
+ 
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		dev = eth->netdev[i];
+ 
+ 		if (!dev || !(dev->flags & IFF_UP))
+@@ -4734,7 +4734,7 @@ static int mtk_remove(struct platform_de
+ 	int i;
+ 
+ 	/* stop all devices to make sure that dma is properly shut down */
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		if (!eth->netdev[i])
+ 			continue;
+ 		mtk_stop(eth->netdev[i]);
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -33,7 +33,6 @@
+ #define MTK_TX_DMA_BUF_LEN_V2	0xffff
+ #define MTK_QDMA_RING_SIZE	2048
+ #define MTK_DMA_SIZE		512
+-#define MTK_MAC_COUNT		2
+ #define MTK_RX_ETH_HLEN		(VLAN_ETH_HLEN + ETH_FCS_LEN)
+ #define MTK_RX_HLEN		(NET_SKB_PAD + MTK_RX_ETH_HLEN + NET_IP_ALIGN)
+ #define MTK_DMA_DUMMY_DESC	0xffffffff
diff --git a/target/linux/generic/pending-5.15/737-04-net-ethernet-mtk_eth_soc-add-MTK_NETSYS_V3-capabilit.patch b/target/linux/generic/pending-5.15/737-04-net-ethernet-mtk_eth_soc-add-MTK_NETSYS_V3-capabilit.patch
new file mode 100644
index 00000000000000..80d729db17ff16
--- /dev/null
+++ b/target/linux/generic/pending-5.15/737-04-net-ethernet-mtk_eth_soc-add-MTK_NETSYS_V3-capabilit.patch
@@ -0,0 +1,292 @@
+From ab817f559d505329d8a413c7d29250f6d87d77a0 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 7 Mar 2023 15:55:47 +0000
+Subject: [PATCH 4/7] net: ethernet: mtk_eth_soc: add MTK_NETSYS_V3 capability
+ bit
+
+Introduce MTK_NETSYS_V3 bit in the device capabilities.
+This is a preliminary patch to introduce support for MT7988 SoC.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 115 ++++++++++++++++----
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h |  44 +++++++-
+ 2 files changed, 134 insertions(+), 25 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -880,17 +880,32 @@ void mtk_stats_update_mac(struct mtk_mac
+ 			mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x20 + offs);
+ 		hw_stats->rx_flow_control_packets +=
+ 			mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x24 + offs);
+-		hw_stats->tx_skip +=
+-			mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x28 + offs);
+-		hw_stats->tx_collisions +=
+-			mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x2c + offs);
+-		hw_stats->tx_bytes +=
+-			mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x30 + offs);
+-		stats =  mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x34 + offs);
+-		if (stats)
+-			hw_stats->tx_bytes += (stats << 32);
+-		hw_stats->tx_packets +=
+-			mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x38 + offs);
++
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3)) {
++			hw_stats->tx_skip +=
++				mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x50 + offs);
++			hw_stats->tx_collisions +=
++				mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x54 + offs);
++			hw_stats->tx_bytes +=
++				mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x40 + offs);
++			stats =  mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x44 + offs);
++			if (stats)
++				hw_stats->tx_bytes += (stats << 32);
++			hw_stats->tx_packets +=
++				mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x48 + offs);
++		} else {
++			hw_stats->tx_skip +=
++				mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x28 + offs);
++			hw_stats->tx_collisions +=
++				mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x2c + offs);
++			hw_stats->tx_bytes +=
++				mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x30 + offs);
++			stats =  mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x34 + offs);
++			if (stats)
++				hw_stats->tx_bytes += (stats << 32);
++			hw_stats->tx_packets +=
++				mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x38 + offs);
++		}
+ 	}
+ 
+ 	u64_stats_update_end(&hw_stats->syncp);
+@@ -1192,7 +1207,10 @@ static void mtk_tx_set_dma_desc_v2(struc
+ 		data |= TX_DMA_LS0;
+ 	WRITE_ONCE(desc->txd3, data);
+ 
+-	data = (mac->id + 1) << TX_DMA_FPORT_SHIFT_V2; /* forward port */
++	if (mac->id == MTK_GMAC3_ID)
++		data = PSE_GDM3_PORT;
++	else
++		data = (mac->id + 1) << TX_DMA_FPORT_SHIFT_V2; /* forward port */
+ 	data |= TX_DMA_SWC_V2 | QID_BITS_V2(info->qid);
+ 	WRITE_ONCE(desc->txd4, data);
+ 
+@@ -1203,6 +1221,9 @@ static void mtk_tx_set_dma_desc_v2(struc
+ 		/* tx checksum offload */
+ 		if (info->csum)
+ 			data |= TX_DMA_CHKSUM_V2;
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3) &&
++		    netdev_uses_dsa(dev))
++			data |= TX_DMA_SPTAG_V3;
+ 	}
+ 	WRITE_ONCE(desc->txd5, data);
+ 
+@@ -1268,8 +1289,13 @@ static int mtk_tx_map(struct sk_buff *sk
+ 	mtk_tx_set_dma_desc(dev, itxd, &txd_info);
+ 
+ 	itx_buf->flags |= MTK_TX_FLAGS_SINGLE0;
+-	itx_buf->flags |= (!mac->id) ? MTK_TX_FLAGS_FPORT0 :
+-			  MTK_TX_FLAGS_FPORT1;
++	if (mac->id == MTK_GMAC1_ID)
++		itx_buf->flags |= MTK_TX_FLAGS_FPORT0;
++	else if (mac->id == MTK_GMAC2_ID)
++		itx_buf->flags |= MTK_TX_FLAGS_FPORT1;
++	else
++		itx_buf->flags |= MTK_TX_FLAGS_FPORT2;
++
+ 	setup_tx_buf(eth, itx_buf, itxd_pdma, txd_info.addr, txd_info.size,
+ 		     k++);
+ 
+@@ -1317,8 +1343,13 @@ static int mtk_tx_map(struct sk_buff *sk
+ 				memset(tx_buf, 0, sizeof(*tx_buf));
+ 			tx_buf->data = (void *)MTK_DMA_DUMMY_DESC;
+ 			tx_buf->flags |= MTK_TX_FLAGS_PAGE0;
+-			tx_buf->flags |= (!mac->id) ? MTK_TX_FLAGS_FPORT0 :
+-					 MTK_TX_FLAGS_FPORT1;
++
++			if (mac->id == MTK_GMAC1_ID)
++				tx_buf->flags |= MTK_TX_FLAGS_FPORT0;
++			else if (mac->id == MTK_GMAC2_ID)
++				tx_buf->flags |= MTK_TX_FLAGS_FPORT1;
++			else
++				tx_buf->flags |= MTK_TX_FLAGS_FPORT2;
+ 
+ 			setup_tx_buf(eth, tx_buf, txd_pdma, txd_info.addr,
+ 				     txd_info.size, k++);
+@@ -1902,11 +1933,24 @@ static int mtk_poll_rx(struct napi_struc
+ 			break;
+ 
+ 		/* find out which mac the packet come from. values start at 1 */
+-		if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1))
+-			mac = RX_DMA_GET_SPORT_V2(trxd.rxd5) - 1;
+-		else if (!MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628) &&
+-			 !(trxd.rxd4 & RX_DMA_SPECIAL_TAG))
++		if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1)) {
++			u32 val = RX_DMA_GET_SPORT_V2(trxd.rxd5);
++
++			switch (val) {
++			case PSE_GDM1_PORT:
++			case PSE_GDM2_PORT:
++				mac = val - 1;
++				break;
++			case PSE_GDM3_PORT:
++				mac = MTK_GMAC3_ID;
++				break;
++			default:
++				break;
++			}
++		} else if (!MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628) &&
++			 !(trxd.rxd4 & RX_DMA_SPECIAL_TAG)) {
+ 			mac = RX_DMA_GET_SPORT(trxd.rxd4) - 1;
++		}
+ 
+ 		if (unlikely(mac < 0 || mac >= eth->soc->num_devs ||
+ 			     !eth->netdev[mac]))
+@@ -2135,7 +2179,9 @@ static int mtk_poll_tx_qdma(struct mtk_e
+ 		tx_buf = mtk_desc_to_tx_buf(ring, desc,
+ 					    eth->soc->txrx.txd_size);
+ 		if (tx_buf->flags & MTK_TX_FLAGS_FPORT1)
+-			mac = 1;
++			mac = MTK_GMAC2_ID;
++		else if (tx_buf->flags & MTK_TX_FLAGS_FPORT2)
++			mac = MTK_GMAC3_ID;
+ 
+ 		if (!tx_buf->data)
+ 			break;
+@@ -3742,7 +3788,26 @@ static int mtk_hw_init(struct mtk_eth *e
+ 	mtk_w32(eth, eth->soc->txrx.rx_irq_done_mask, reg_map->qdma.int_grp + 4);
+ 	mtk_w32(eth, 0x21021000, MTK_FE_INT_GRP);
+ 
+-	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3)) {
++		/* PSE should not drop port1, port8 and port9 packets */
++		mtk_w32(eth, 0x00000302, PSE_DROP_CFG);
++
++		/* GDM and CDM Threshold */
++		mtk_w32(eth, 0x00000707, MTK_CDMW0_THRES);
++		mtk_w32(eth, 0x00000077, MTK_CDMW1_THRES);
++
++		/* Disable GDM1 RX CRC stripping */
++		val = mtk_r32(eth, MTK_GDMA_FWD_CFG(0));
++		val &= ~MTK_GDMA_STRP_CRC;
++		mtk_w32(eth, val, MTK_GDMA_FWD_CFG(0));
++
++		/* PSE GDM3 MIB counter has incorrect hw default values,
++		 * so the driver ought to read clear the values beforehand
++		 * in case ethtool retrieve wrong mib values.
++		 */
++		for (i = 0; i < 0x80; i += 0x4)
++			mtk_r32(eth, reg_map->gdm1_cnt + 0x100 + i);
++	} else if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+ 		/* PSE should not drop port8 and port9 packets from WDMA Tx */
+ 		mtk_w32(eth, 0x00000300, PSE_DROP_CFG);
+ 
+@@ -4314,7 +4379,11 @@ static int mtk_add_mac(struct mtk_eth *e
+ 	}
+ 	spin_lock_init(&mac->hw_stats->stats_lock);
+ 	u64_stats_init(&mac->hw_stats->syncp);
+-	mac->hw_stats->reg_offset = id * MTK_STAT_OFFSET;
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3))
++		mac->hw_stats->reg_offset = id * 0x80;
++	else
++		mac->hw_stats->reg_offset = id * 0x40;
+ 
+ 	/* phylink create */
+ 	err = of_get_phy_mode(np, &phy_mode);
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -121,6 +121,7 @@
+ #define MTK_GDMA_ICS_EN		BIT(22)
+ #define MTK_GDMA_TCS_EN		BIT(21)
+ #define MTK_GDMA_UCS_EN		BIT(20)
++#define MTK_GDMA_STRP_CRC	BIT(16)
+ #define MTK_GDMA_TO_PDMA	0x0
+ #define MTK_GDMA_DROP_ALL       0x7777
+ 
+@@ -286,8 +287,6 @@
+ /* QDMA Interrupt grouping registers */
+ #define MTK_RLS_DONE_INT	BIT(0)
+ 
+-#define MTK_STAT_OFFSET		0x40
+-
+ /* QDMA TX NUM */
+ #define QID_BITS_V2(x)		(((x) & 0x3f) << 16)
+ #define MTK_QDMA_GMAC2_QID	8
+@@ -300,6 +299,8 @@
+ #define TX_DMA_CHKSUM_V2	(0x7 << 28)
+ #define TX_DMA_TSO_V2		BIT(31)
+ 
++#define TX_DMA_SPTAG_V3         BIT(27)
++
+ /* QDMA V2 descriptor txd4 */
+ #define TX_DMA_FPORT_SHIFT_V2	8
+ #define TX_DMA_FPORT_MASK_V2	0xf
+@@ -636,6 +637,7 @@ enum mtk_tx_flags {
+ 	 */
+ 	MTK_TX_FLAGS_FPORT0	= 0x04,
+ 	MTK_TX_FLAGS_FPORT1	= 0x08,
++	MTK_TX_FLAGS_FPORT2	= 0x10,
+ };
+ 
+ /* This enum allows us to identify how the clock is defined on the array of the
+@@ -721,6 +723,42 @@ enum mtk_dev_state {
+ 	MTK_RESETTING
+ };
+ 
++/* PSE Port Definition */
++enum mtk_pse_port {
++	PSE_ADMA_PORT = 0,
++	PSE_GDM1_PORT,
++	PSE_GDM2_PORT,
++	PSE_PPE0_PORT,
++	PSE_PPE1_PORT,
++	PSE_QDMA_TX_PORT,
++	PSE_QDMA_RX_PORT,
++	PSE_DROP_PORT,
++	PSE_WDMA0_PORT,
++	PSE_WDMA1_PORT,
++	PSE_TDMA_PORT,
++	PSE_NONE_PORT,
++	PSE_PPE2_PORT,
++	PSE_WDMA2_PORT,
++	PSE_EIP197_PORT,
++	PSE_GDM3_PORT,
++	PSE_PORT_MAX
++};
++
++/* GMAC Identifier */
++enum mtk_gmac_id {
++	MTK_GMAC1_ID = 0,
++	MTK_GMAC2_ID,
++	MTK_GMAC3_ID,
++	MTK_GMAC_ID_MAX
++};
++
++/* GDM Type */
++enum mtk_gdm_type {
++	MTK_GDM_TYPE = 0,
++	MTK_XGDM_TYPE,
++	MTK_GDM_TYPE_MAX
++};
++
+ enum mtk_tx_buf_type {
+ 	MTK_TYPE_SKB,
+ 	MTK_TYPE_XDP_TX,
+@@ -817,6 +855,7 @@ enum mkt_eth_capabilities {
+ 	MTK_QDMA_BIT,
+ 	MTK_NETSYS_V1_BIT,
+ 	MTK_NETSYS_V2_BIT,
++	MTK_NETSYS_V3_BIT,
+ 	MTK_SOC_MT7628_BIT,
+ 	MTK_RSTCTRL_PPE1_BIT,
+ 	MTK_U3_COPHY_V2_BIT,
+@@ -853,6 +892,7 @@ enum mkt_eth_capabilities {
+ #define MTK_QDMA		BIT(MTK_QDMA_BIT)
+ #define MTK_NETSYS_V1		BIT(MTK_NETSYS_V1_BIT)
+ #define MTK_NETSYS_V2		BIT(MTK_NETSYS_V2_BIT)
++#define MTK_NETSYS_V3		BIT(MTK_NETSYS_V3_BIT)
+ #define MTK_SOC_MT7628		BIT(MTK_SOC_MT7628_BIT)
+ #define MTK_RSTCTRL_PPE1	BIT(MTK_RSTCTRL_PPE1_BIT)
+ #define MTK_U3_COPHY_V2		BIT(MTK_U3_COPHY_V2_BIT)
diff --git a/target/linux/generic/pending-5.15/737-05-net-ethernet-mtk_eth_soc-convert-caps-in-mtk_soc_dat.patch b/target/linux/generic/pending-5.15/737-05-net-ethernet-mtk_eth_soc-convert-caps-in-mtk_soc_dat.patch
new file mode 100644
index 00000000000000..bd26cca305dbd0
--- /dev/null
+++ b/target/linux/generic/pending-5.15/737-05-net-ethernet-mtk_eth_soc-convert-caps-in-mtk_soc_dat.patch
@@ -0,0 +1,197 @@
+From 45b575fd9e6a455090820248bf1b98b1f2c7b6c8 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 7 Mar 2023 15:56:00 +0000
+Subject: [PATCH 5/7] net: ethernet: mtk_eth_soc: convert caps in mtk_soc_data
+ struct to u64
+
+This is a preliminary patch to introduce support for MT7988 SoC.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_path.c | 22 +++----
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h  | 62 ++++++++++----------
+ 2 files changed, 42 insertions(+), 42 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_path.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_path.c
+@@ -15,10 +15,10 @@
+ struct mtk_eth_muxc {
+ 	const char	*name;
+ 	int		cap_bit;
+-	int		(*set_path)(struct mtk_eth *eth, int path);
++	int		(*set_path)(struct mtk_eth *eth, u64 path);
+ };
+ 
+-static const char *mtk_eth_path_name(int path)
++static const char *mtk_eth_path_name(u64 path)
+ {
+ 	switch (path) {
+ 	case MTK_ETH_PATH_GMAC1_RGMII:
+@@ -40,7 +40,7 @@ static const char *mtk_eth_path_name(int
+ 	}
+ }
+ 
+-static int set_mux_gdm1_to_gmac1_esw(struct mtk_eth *eth, int path)
++static int set_mux_gdm1_to_gmac1_esw(struct mtk_eth *eth, u64 path)
+ {
+ 	bool updated = true;
+ 	u32 val, mask, set;
+@@ -71,7 +71,7 @@ static int set_mux_gdm1_to_gmac1_esw(str
+ 	return 0;
+ }
+ 
+-static int set_mux_gmac2_gmac0_to_gephy(struct mtk_eth *eth, int path)
++static int set_mux_gmac2_gmac0_to_gephy(struct mtk_eth *eth, u64 path)
+ {
+ 	unsigned int val = 0;
+ 	bool updated = true;
+@@ -94,7 +94,7 @@ static int set_mux_gmac2_gmac0_to_gephy(
+ 	return 0;
+ }
+ 
+-static int set_mux_u3_gmac2_to_qphy(struct mtk_eth *eth, int path)
++static int set_mux_u3_gmac2_to_qphy(struct mtk_eth *eth, u64 path)
+ {
+ 	unsigned int val = 0, mask = 0, reg = 0;
+ 	bool updated = true;
+@@ -125,7 +125,7 @@ static int set_mux_u3_gmac2_to_qphy(stru
+ 	return 0;
+ }
+ 
+-static int set_mux_gmac1_gmac2_to_sgmii_rgmii(struct mtk_eth *eth, int path)
++static int set_mux_gmac1_gmac2_to_sgmii_rgmii(struct mtk_eth *eth, u64 path)
+ {
+ 	unsigned int val = 0;
+ 	bool updated = true;
+@@ -163,7 +163,7 @@ static int set_mux_gmac1_gmac2_to_sgmii_
+ 	return 0;
+ }
+ 
+-static int set_mux_gmac12_to_gephy_sgmii(struct mtk_eth *eth, int path)
++static int set_mux_gmac12_to_gephy_sgmii(struct mtk_eth *eth, u64 path)
+ {
+ 	unsigned int val = 0;
+ 	bool updated = true;
+@@ -218,7 +218,7 @@ static const struct mtk_eth_muxc mtk_eth
+ 	},
+ };
+ 
+-static int mtk_eth_mux_setup(struct mtk_eth *eth, int path)
++static int mtk_eth_mux_setup(struct mtk_eth *eth, u64 path)
+ {
+ 	int i, err = 0;
+ 
+@@ -249,7 +249,7 @@ out:
+ 
+ int mtk_gmac_sgmii_path_setup(struct mtk_eth *eth, int mac_id)
+ {
+-	int path;
++	u64 path;
+ 
+ 	path = (mac_id == 0) ?  MTK_ETH_PATH_GMAC1_SGMII :
+ 				MTK_ETH_PATH_GMAC2_SGMII;
+@@ -260,7 +260,7 @@ int mtk_gmac_sgmii_path_setup(struct mtk
+ 
+ int mtk_gmac_gephy_path_setup(struct mtk_eth *eth, int mac_id)
+ {
+-	int path = 0;
++	u64 path = 0;
+ 
+ 	if (mac_id == 1)
+ 		path = MTK_ETH_PATH_GMAC2_GEPHY;
+@@ -274,7 +274,7 @@ int mtk_gmac_gephy_path_setup(struct mtk
+ 
+ int mtk_gmac_rgmii_path_setup(struct mtk_eth *eth, int mac_id)
+ {
+-	int path;
++	u64 path;
+ 
+ 	path = (mac_id == 0) ?  MTK_ETH_PATH_GMAC1_RGMII :
+ 				MTK_ETH_PATH_GMAC2_RGMII;
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -878,44 +878,44 @@ enum mkt_eth_capabilities {
+ };
+ 
+ /* Supported hardware group on SoCs */
+-#define MTK_RGMII		BIT(MTK_RGMII_BIT)
+-#define MTK_TRGMII		BIT(MTK_TRGMII_BIT)
+-#define MTK_SGMII		BIT(MTK_SGMII_BIT)
+-#define MTK_ESW			BIT(MTK_ESW_BIT)
+-#define MTK_GEPHY		BIT(MTK_GEPHY_BIT)
+-#define MTK_MUX			BIT(MTK_MUX_BIT)
+-#define MTK_INFRA		BIT(MTK_INFRA_BIT)
+-#define MTK_SHARED_SGMII	BIT(MTK_SHARED_SGMII_BIT)
+-#define MTK_HWLRO		BIT(MTK_HWLRO_BIT)
+-#define MTK_SHARED_INT		BIT(MTK_SHARED_INT_BIT)
+-#define MTK_TRGMII_MT7621_CLK	BIT(MTK_TRGMII_MT7621_CLK_BIT)
+-#define MTK_QDMA		BIT(MTK_QDMA_BIT)
+-#define MTK_NETSYS_V1		BIT(MTK_NETSYS_V1_BIT)
+-#define MTK_NETSYS_V2		BIT(MTK_NETSYS_V2_BIT)
+-#define MTK_NETSYS_V3		BIT(MTK_NETSYS_V3_BIT)
+-#define MTK_SOC_MT7628		BIT(MTK_SOC_MT7628_BIT)
+-#define MTK_RSTCTRL_PPE1	BIT(MTK_RSTCTRL_PPE1_BIT)
+-#define MTK_U3_COPHY_V2		BIT(MTK_U3_COPHY_V2_BIT)
++#define MTK_RGMII		BIT_ULL(MTK_RGMII_BIT)
++#define MTK_TRGMII		BIT_ULL(MTK_TRGMII_BIT)
++#define MTK_SGMII		BIT_ULL(MTK_SGMII_BIT)
++#define MTK_ESW			BIT_ULL(MTK_ESW_BIT)
++#define MTK_GEPHY		BIT_ULL(MTK_GEPHY_BIT)
++#define MTK_MUX			BIT_ULL(MTK_MUX_BIT)
++#define MTK_INFRA		BIT_ULL(MTK_INFRA_BIT)
++#define MTK_SHARED_SGMII	BIT_ULL(MTK_SHARED_SGMII_BIT)
++#define MTK_HWLRO		BIT_ULL(MTK_HWLRO_BIT)
++#define MTK_SHARED_INT		BIT_ULL(MTK_SHARED_INT_BIT)
++#define MTK_TRGMII_MT7621_CLK	BIT_ULL(MTK_TRGMII_MT7621_CLK_BIT)
++#define MTK_QDMA		BIT_ULL(MTK_QDMA_BIT)
++#define MTK_NETSYS_V1		BIT_ULL(MTK_NETSYS_V1_BIT)
++#define MTK_NETSYS_V2		BIT_ULL(MTK_NETSYS_V2_BIT)
++#define MTK_NETSYS_V3		BIT_ULL(MTK_NETSYS_V3_BIT)
++#define MTK_SOC_MT7628		BIT_ULL(MTK_SOC_MT7628_BIT)
++#define MTK_RSTCTRL_PPE1	BIT_ULL(MTK_RSTCTRL_PPE1_BIT)
++#define MTK_U3_COPHY_V2		BIT_ULL(MTK_U3_COPHY_V2_BIT)
+ 
+ #define MTK_ETH_MUX_GDM1_TO_GMAC1_ESW		\
+-	BIT(MTK_ETH_MUX_GDM1_TO_GMAC1_ESW_BIT)
++	BIT_ULL(MTK_ETH_MUX_GDM1_TO_GMAC1_ESW_BIT)
+ #define MTK_ETH_MUX_GMAC2_GMAC0_TO_GEPHY	\
+-	BIT(MTK_ETH_MUX_GMAC2_GMAC0_TO_GEPHY_BIT)
++	BIT_ULL(MTK_ETH_MUX_GMAC2_GMAC0_TO_GEPHY_BIT)
+ #define MTK_ETH_MUX_U3_GMAC2_TO_QPHY		\
+-	BIT(MTK_ETH_MUX_U3_GMAC2_TO_QPHY_BIT)
++	BIT_ULL(MTK_ETH_MUX_U3_GMAC2_TO_QPHY_BIT)
+ #define MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII	\
+-	BIT(MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII_BIT)
++	BIT_ULL(MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII_BIT)
+ #define MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII	\
+-	BIT(MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII_BIT)
++	BIT_ULL(MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII_BIT)
+ 
+ /* Supported path present on SoCs */
+-#define MTK_ETH_PATH_GMAC1_RGMII	BIT(MTK_ETH_PATH_GMAC1_RGMII_BIT)
+-#define MTK_ETH_PATH_GMAC1_TRGMII	BIT(MTK_ETH_PATH_GMAC1_TRGMII_BIT)
+-#define MTK_ETH_PATH_GMAC1_SGMII	BIT(MTK_ETH_PATH_GMAC1_SGMII_BIT)
+-#define MTK_ETH_PATH_GMAC2_RGMII	BIT(MTK_ETH_PATH_GMAC2_RGMII_BIT)
+-#define MTK_ETH_PATH_GMAC2_SGMII	BIT(MTK_ETH_PATH_GMAC2_SGMII_BIT)
+-#define MTK_ETH_PATH_GMAC2_GEPHY	BIT(MTK_ETH_PATH_GMAC2_GEPHY_BIT)
+-#define MTK_ETH_PATH_GDM1_ESW		BIT(MTK_ETH_PATH_GDM1_ESW_BIT)
++#define MTK_ETH_PATH_GMAC1_RGMII	BIT_ULL(MTK_ETH_PATH_GMAC1_RGMII_BIT)
++#define MTK_ETH_PATH_GMAC1_TRGMII	BIT_ULL(MTK_ETH_PATH_GMAC1_TRGMII_BIT)
++#define MTK_ETH_PATH_GMAC1_SGMII	BIT_ULL(MTK_ETH_PATH_GMAC1_SGMII_BIT)
++#define MTK_ETH_PATH_GMAC2_RGMII	BIT_ULL(MTK_ETH_PATH_GMAC2_RGMII_BIT)
++#define MTK_ETH_PATH_GMAC2_SGMII	BIT_ULL(MTK_ETH_PATH_GMAC2_SGMII_BIT)
++#define MTK_ETH_PATH_GMAC2_GEPHY	BIT_ULL(MTK_ETH_PATH_GMAC2_GEPHY_BIT)
++#define MTK_ETH_PATH_GDM1_ESW		BIT_ULL(MTK_ETH_PATH_GDM1_ESW_BIT)
+ 
+ #define MTK_GMAC1_RGMII		(MTK_ETH_PATH_GMAC1_RGMII | MTK_RGMII)
+ #define MTK_GMAC1_TRGMII	(MTK_ETH_PATH_GMAC1_TRGMII | MTK_TRGMII)
+@@ -1071,7 +1071,7 @@ struct mtk_reg_map {
+ struct mtk_soc_data {
+ 	const struct mtk_reg_map *reg_map;
+ 	u32             ana_rgc3;
+-	u32		caps;
++	u64		caps;
+ 	u32		required_clks;
+ 	bool		required_pctl;
+ 	u8		offload_version;
diff --git a/target/linux/generic/pending-5.15/737-06-net-ethernet-mtk_eth_soc-add-support-for-MT7988-SoC.patch b/target/linux/generic/pending-5.15/737-06-net-ethernet-mtk_eth_soc-add-support-for-MT7988-SoC.patch
new file mode 100644
index 00000000000000..504d2ea22664d6
--- /dev/null
+++ b/target/linux/generic/pending-5.15/737-06-net-ethernet-mtk_eth_soc-add-support-for-MT7988-SoC.patch
@@ -0,0 +1,495 @@
+From 661bacf4363ca68939c15e20056b5f72fbd034e7 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 25 Feb 2023 00:08:24 +0100
+Subject: [PATCH 6/7] net: ethernet: mtk_eth_soc: add support for MT7988 SoC
+
+Introduce support for ethernet chip available in MT7988 SoC to
+mtk_eth_soc driver.
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 153 ++++++++++++++--
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h | 193 ++++++++++++++------
+ 2 files changed, 279 insertions(+), 67 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -152,6 +152,54 @@ static const struct mtk_reg_map mt7986_r
+ 	.pse_oq_sta		= 0x01a0,
+ };
+ 
++static const struct mtk_reg_map mt7988_reg_map = {
++	.tx_irq_mask		= 0x461c,
++	.tx_irq_status		= 0x4618,
++	.pdma = {
++		.rx_ptr		= 0x6900,
++		.rx_cnt_cfg	= 0x6904,
++		.pcrx_ptr	= 0x6908,
++		.glo_cfg	= 0x6a04,
++		.rst_idx	= 0x6a08,
++		.delay_irq	= 0x6a0c,
++		.irq_status	= 0x6a20,
++		.irq_mask	= 0x6a28,
++		.adma_rx_dbg0	= 0x6a38,
++		.int_grp	= 0x6a50,
++	},
++	.qdma = {
++		.qtx_cfg	= 0x4400,
++		.qtx_sch	= 0x4404,
++		.rx_ptr		= 0x4500,
++		.rx_cnt_cfg	= 0x4504,
++		.qcrx_ptr	= 0x4508,
++		.glo_cfg	= 0x4604,
++		.rst_idx	= 0x4608,
++		.delay_irq	= 0x460c,
++		.fc_th		= 0x4610,
++		.int_grp	= 0x4620,
++		.hred		= 0x4644,
++		.ctx_ptr	= 0x4700,
++		.dtx_ptr	= 0x4704,
++		.crx_ptr	= 0x4710,
++		.drx_ptr	= 0x4714,
++		.fq_head	= 0x4720,
++		.fq_tail	= 0x4724,
++		.fq_count	= 0x4728,
++		.fq_blen	= 0x472c,
++		.tx_sch_rate	= 0x4798,
++	},
++	.gdm1_cnt		= 0x1c00,
++	.gdma_to_ppe0		= 0x3333,
++	.ppe_base		= 0x2200,
++	.wdma_base = {
++		[0]		= 0x4800,
++		[1]		= 0x4c00,
++	},
++	.pse_iq_sta		= 0x0180,
++	.pse_oq_sta		= 0x01a0,
++};
++
+ /* strings used by ethtool */
+ static const struct mtk_ethtool_stats {
+ 	char str[ETH_GSTRING_LEN];
+@@ -179,10 +227,54 @@ static const struct mtk_ethtool_stats {
+ };
+ 
+ static const char * const mtk_clks_source_name[] = {
+-	"ethif", "sgmiitop", "esw", "gp0", "gp1", "gp2", "fe", "trgpll",
+-	"sgmii_tx250m", "sgmii_rx250m", "sgmii_cdr_ref", "sgmii_cdr_fb",
+-	"sgmii2_tx250m", "sgmii2_rx250m", "sgmii2_cdr_ref", "sgmii2_cdr_fb",
+-	"sgmii_ck", "eth2pll", "wocpu0", "wocpu1", "netsys0", "netsys1"
++	"ethif",
++	"sgmiitop",
++	"esw",
++	"gp0",
++	"gp1",
++	"gp2",
++	"gp3",
++	"xgp1",
++	"xgp2",
++	"xgp3",
++	"crypto",
++	"fe",
++	"trgpll",
++	"sgmii_tx250m",
++	"sgmii_rx250m",
++	"sgmii_cdr_ref",
++	"sgmii_cdr_fb",
++	"sgmii2_tx250m",
++	"sgmii2_rx250m",
++	"sgmii2_cdr_ref",
++	"sgmii2_cdr_fb",
++	"sgmii_ck",
++	"eth2pll",
++	"wocpu0",
++	"wocpu1",
++	"netsys0",
++	"netsys1",
++	"ethwarp_wocpu2",
++	"ethwarp_wocpu1",
++	"ethwarp_wocpu0",
++	"top_usxgmii0_sel",
++	"top_usxgmii1_sel",
++	"top_sgm0_sel",
++	"top_sgm1_sel",
++	"top_xfi_phy0_xtal_sel",
++	"top_xfi_phy1_xtal_sel",
++	"top_eth_gmii_sel",
++	"top_eth_refck_50m_sel",
++	"top_eth_sys_200m_sel",
++	"top_eth_sys_sel",
++	"top_eth_xgmii_sel",
++	"top_eth_mii_sel",
++	"top_netsys_sel",
++	"top_netsys_500m_sel",
++	"top_netsys_pao_2x_sel",
++	"top_netsys_sync_250m_sel",
++	"top_netsys_ppefb_250m_sel",
++	"top_netsys_warp_sel",
+ };
+ 
+ void mtk_w32(struct mtk_eth *eth, u32 val, unsigned reg)
+@@ -1207,10 +1299,19 @@ static void mtk_tx_set_dma_desc_v2(struc
+ 		data |= TX_DMA_LS0;
+ 	WRITE_ONCE(desc->txd3, data);
+ 
+-	if (mac->id == MTK_GMAC3_ID)
+-		data = PSE_GDM3_PORT;
+-	else
+-		data = (mac->id + 1) << TX_DMA_FPORT_SHIFT_V2; /* forward port */
++	 /* set forward port */
++	switch (mac->id) {
++	case MTK_GMAC1_ID:
++		data = PSE_GDM1_PORT << TX_DMA_FPORT_SHIFT_V2;
++		break;
++	case MTK_GMAC2_ID:
++		data = PSE_GDM2_PORT << TX_DMA_FPORT_SHIFT_V2;
++		break;
++	case MTK_GMAC3_ID:
++		data = PSE_GDM3_PORT << TX_DMA_FPORT_SHIFT_V2;
++		break;
++	}
++
+ 	data |= TX_DMA_SWC_V2 | QID_BITS_V2(info->qid);
+ 	WRITE_ONCE(desc->txd4, data);
+ 
+@@ -4964,6 +5065,25 @@ static const struct mtk_soc_data mt7986_
+ 	},
+ };
+ 
++static const struct mtk_soc_data mt7988_data = {
++	.reg_map = &mt7988_reg_map,
++	.ana_rgc3 = 0x128,
++	.caps = MT7988_CAPS,
++	.hw_features = MTK_HW_FEATURES,
++	.required_clks = MT7988_CLKS_BITMAP,
++	.required_pctl = false,
++	.num_devs = 3,
++	.txrx = {
++		.txd_size = sizeof(struct mtk_tx_dma_v2),
++		.rxd_size = sizeof(struct mtk_rx_dma_v2),
++		.rx_irq_done_mask = MTK_RX_DONE_INT_V2,
++		.rx_dma_l4_valid = RX_DMA_L4_VALID_V2,
++		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
++		.dma_len_offset = 8,
++	},
++};
++
++
+ static const struct mtk_soc_data rt5350_data = {
+ 	.reg_map = &mt7628_reg_map,
+ 	.caps = MT7628_CAPS,
+@@ -4982,14 +5102,15 @@ static const struct mtk_soc_data rt5350_
+ };
+ 
+ const struct of_device_id of_mtk_match[] = {
+-	{ .compatible = "mediatek,mt2701-eth", .data = &mt2701_data},
+-	{ .compatible = "mediatek,mt7621-eth", .data = &mt7621_data},
+-	{ .compatible = "mediatek,mt7622-eth", .data = &mt7622_data},
+-	{ .compatible = "mediatek,mt7623-eth", .data = &mt7623_data},
+-	{ .compatible = "mediatek,mt7629-eth", .data = &mt7629_data},
+-	{ .compatible = "mediatek,mt7981-eth", .data = &mt7981_data},
+-	{ .compatible = "mediatek,mt7986-eth", .data = &mt7986_data},
+-	{ .compatible = "ralink,rt5350-eth", .data = &rt5350_data},
++	{ .compatible = "mediatek,mt2701-eth", .data = &mt2701_data },
++	{ .compatible = "mediatek,mt7621-eth", .data = &mt7621_data },
++	{ .compatible = "mediatek,mt7622-eth", .data = &mt7622_data },
++	{ .compatible = "mediatek,mt7623-eth", .data = &mt7623_data },
++	{ .compatible = "mediatek,mt7629-eth", .data = &mt7629_data },
++	{ .compatible = "mediatek,mt7981-eth", .data = &mt7981_data },
++	{ .compatible = "mediatek,mt7986-eth", .data = &mt7986_data },
++	{ .compatible = "mediatek,mt7988-eth", .data = &mt7988_data },
++	{ .compatible = "ralink,rt5350-eth", .data = &rt5350_data },
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(of, of_mtk_match);
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -116,7 +116,8 @@
+ #define MTK_CDMP_EG_CTRL	0x404
+ 
+ /* GDM Exgress Control Register */
+-#define MTK_GDMA_FWD_CFG(x)	(0x500 + (x * 0x1000))
++#define MTK_GDMA_FWD_CFG(x)	((x == MTK_GMAC3_ID) ?		\
++				 0x540 : 0x500 + (x * 0x1000))
+ #define MTK_GDMA_SPECIAL_TAG	BIT(24)
+ #define MTK_GDMA_ICS_EN		BIT(22)
+ #define MTK_GDMA_TCS_EN		BIT(21)
+@@ -650,6 +651,11 @@ enum mtk_clks_map {
+ 	MTK_CLK_GP0,
+ 	MTK_CLK_GP1,
+ 	MTK_CLK_GP2,
++	MTK_CLK_GP3,
++	MTK_CLK_XGP1,
++	MTK_CLK_XGP2,
++	MTK_CLK_XGP3,
++	MTK_CLK_CRYPTO,
+ 	MTK_CLK_FE,
+ 	MTK_CLK_TRGPLL,
+ 	MTK_CLK_SGMII_TX_250M,
+@@ -666,57 +672,108 @@ enum mtk_clks_map {
+ 	MTK_CLK_WOCPU1,
+ 	MTK_CLK_NETSYS0,
+ 	MTK_CLK_NETSYS1,
++	MTK_CLK_ETHWARP_WOCPU2,
++	MTK_CLK_ETHWARP_WOCPU1,
++	MTK_CLK_ETHWARP_WOCPU0,
++	MTK_CLK_TOP_USXGMII_SBUS_0_SEL,
++	MTK_CLK_TOP_USXGMII_SBUS_1_SEL,
++	MTK_CLK_TOP_SGM_0_SEL,
++	MTK_CLK_TOP_SGM_1_SEL,
++	MTK_CLK_TOP_XFI_PHY_0_XTAL_SEL,
++	MTK_CLK_TOP_XFI_PHY_1_XTAL_SEL,
++	MTK_CLK_TOP_ETH_GMII_SEL,
++	MTK_CLK_TOP_ETH_REFCK_50M_SEL,
++	MTK_CLK_TOP_ETH_SYS_200M_SEL,
++	MTK_CLK_TOP_ETH_SYS_SEL,
++	MTK_CLK_TOP_ETH_XGMII_SEL,
++	MTK_CLK_TOP_ETH_MII_SEL,
++	MTK_CLK_TOP_NETSYS_SEL,
++	MTK_CLK_TOP_NETSYS_500M_SEL,
++	MTK_CLK_TOP_NETSYS_PAO_2X_SEL,
++	MTK_CLK_TOP_NETSYS_SYNC_250M_SEL,
++	MTK_CLK_TOP_NETSYS_PPEFB_250M_SEL,
++	MTK_CLK_TOP_NETSYS_WARP_SEL,
+ 	MTK_CLK_MAX
+ };
+ 
+-#define MT7623_CLKS_BITMAP	(BIT(MTK_CLK_ETHIF) | BIT(MTK_CLK_ESW) |  \
+-				 BIT(MTK_CLK_GP1) | BIT(MTK_CLK_GP2) | \
+-				 BIT(MTK_CLK_TRGPLL))
+-#define MT7622_CLKS_BITMAP	(BIT(MTK_CLK_ETHIF) | BIT(MTK_CLK_ESW) |  \
+-				 BIT(MTK_CLK_GP0) | BIT(MTK_CLK_GP1) | \
+-				 BIT(MTK_CLK_GP2) | \
+-				 BIT(MTK_CLK_SGMII_TX_250M) | \
+-				 BIT(MTK_CLK_SGMII_RX_250M) | \
+-				 BIT(MTK_CLK_SGMII_CDR_REF) | \
+-				 BIT(MTK_CLK_SGMII_CDR_FB) | \
+-				 BIT(MTK_CLK_SGMII_CK) | \
+-				 BIT(MTK_CLK_ETH2PLL))
++#define MT7623_CLKS_BITMAP	(BIT_ULL(MTK_CLK_ETHIF) | BIT_ULL(MTK_CLK_ESW) |  \
++				 BIT_ULL(MTK_CLK_GP1) | BIT_ULL(MTK_CLK_GP2) | \
++				 BIT_ULL(MTK_CLK_TRGPLL))
++#define MT7622_CLKS_BITMAP	(BIT_ULL(MTK_CLK_ETHIF) | BIT_ULL(MTK_CLK_ESW) |  \
++				 BIT_ULL(MTK_CLK_GP0) | BIT_ULL(MTK_CLK_GP1) | \
++				 BIT_ULL(MTK_CLK_GP2) | \
++				 BIT_ULL(MTK_CLK_SGMII_TX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII_RX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII_CDR_REF) | \
++				 BIT_ULL(MTK_CLK_SGMII_CDR_FB) | \
++				 BIT_ULL(MTK_CLK_SGMII_CK) | \
++				 BIT_ULL(MTK_CLK_ETH2PLL))
+ #define MT7621_CLKS_BITMAP	(0)
+ #define MT7628_CLKS_BITMAP	(0)
+-#define MT7629_CLKS_BITMAP	(BIT(MTK_CLK_ETHIF) | BIT(MTK_CLK_ESW) |  \
+-				 BIT(MTK_CLK_GP0) | BIT(MTK_CLK_GP1) | \
+-				 BIT(MTK_CLK_GP2) | BIT(MTK_CLK_FE) | \
+-				 BIT(MTK_CLK_SGMII_TX_250M) | \
+-				 BIT(MTK_CLK_SGMII_RX_250M) | \
+-				 BIT(MTK_CLK_SGMII_CDR_REF) | \
+-				 BIT(MTK_CLK_SGMII_CDR_FB) | \
+-				 BIT(MTK_CLK_SGMII2_TX_250M) | \
+-				 BIT(MTK_CLK_SGMII2_RX_250M) | \
+-				 BIT(MTK_CLK_SGMII2_CDR_REF) | \
+-				 BIT(MTK_CLK_SGMII2_CDR_FB) | \
+-				 BIT(MTK_CLK_SGMII_CK) | \
+-				 BIT(MTK_CLK_ETH2PLL) | BIT(MTK_CLK_SGMIITOP))
+-#define MT7981_CLKS_BITMAP	(BIT(MTK_CLK_FE) | BIT(MTK_CLK_GP2) | BIT(MTK_CLK_GP1) | \
+-				 BIT(MTK_CLK_WOCPU0) | \
+-				 BIT(MTK_CLK_SGMII_TX_250M) | \
+-				 BIT(MTK_CLK_SGMII_RX_250M) | \
+-				 BIT(MTK_CLK_SGMII_CDR_REF) | \
+-				 BIT(MTK_CLK_SGMII_CDR_FB) | \
+-				 BIT(MTK_CLK_SGMII2_TX_250M) | \
+-				 BIT(MTK_CLK_SGMII2_RX_250M) | \
+-				 BIT(MTK_CLK_SGMII2_CDR_REF) | \
+-				 BIT(MTK_CLK_SGMII2_CDR_FB) | \
+-				 BIT(MTK_CLK_SGMII_CK))
+-#define MT7986_CLKS_BITMAP	(BIT(MTK_CLK_FE) | BIT(MTK_CLK_GP2) | BIT(MTK_CLK_GP1) | \
+-				 BIT(MTK_CLK_WOCPU1) | BIT(MTK_CLK_WOCPU0) | \
+-				 BIT(MTK_CLK_SGMII_TX_250M) | \
+-				 BIT(MTK_CLK_SGMII_RX_250M) | \
+-				 BIT(MTK_CLK_SGMII_CDR_REF) | \
+-				 BIT(MTK_CLK_SGMII_CDR_FB) | \
+-				 BIT(MTK_CLK_SGMII2_TX_250M) | \
+-				 BIT(MTK_CLK_SGMII2_RX_250M) | \
+-				 BIT(MTK_CLK_SGMII2_CDR_REF) | \
+-				 BIT(MTK_CLK_SGMII2_CDR_FB))
++#define MT7629_CLKS_BITMAP	(BIT_ULL(MTK_CLK_ETHIF) | BIT_ULL(MTK_CLK_ESW) |  \
++				 BIT_ULL(MTK_CLK_GP0) | BIT_ULL(MTK_CLK_GP1) | \
++				 BIT_ULL(MTK_CLK_GP2) | BIT_ULL(MTK_CLK_FE) | \
++				 BIT_ULL(MTK_CLK_SGMII_TX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII_RX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII_CDR_REF) | \
++				 BIT_ULL(MTK_CLK_SGMII_CDR_FB) | \
++				 BIT_ULL(MTK_CLK_SGMII2_TX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII2_RX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII2_CDR_REF) | \
++				 BIT_ULL(MTK_CLK_SGMII2_CDR_FB) | \
++				 BIT_ULL(MTK_CLK_SGMII_CK) | \
++				 BIT_ULL(MTK_CLK_ETH2PLL) | BIT_ULL(MTK_CLK_SGMIITOP))
++#define MT7981_CLKS_BITMAP	(BIT_ULL(MTK_CLK_FE) | BIT_ULL(MTK_CLK_GP2) | BIT_ULL(MTK_CLK_GP1) | \
++				 BIT_ULL(MTK_CLK_WOCPU0) | \
++				 BIT_ULL(MTK_CLK_SGMII_TX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII_RX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII_CDR_REF) | \
++				 BIT_ULL(MTK_CLK_SGMII_CDR_FB) | \
++				 BIT_ULL(MTK_CLK_SGMII2_TX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII2_RX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII2_CDR_REF) | \
++				 BIT_ULL(MTK_CLK_SGMII2_CDR_FB) | \
++				 BIT_ULL(MTK_CLK_SGMII_CK))
++#define MT7986_CLKS_BITMAP	(BIT_ULL(MTK_CLK_FE) | BIT_ULL(MTK_CLK_GP2) | BIT_ULL(MTK_CLK_GP1) | \
++				 BIT_ULL(MTK_CLK_WOCPU1) | BIT_ULL(MTK_CLK_WOCPU0) | \
++				 BIT_ULL(MTK_CLK_SGMII_TX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII_RX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII_CDR_REF) | \
++				 BIT_ULL(MTK_CLK_SGMII_CDR_FB) | \
++				 BIT_ULL(MTK_CLK_SGMII2_TX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII2_RX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII2_CDR_REF) | \
++				 BIT_ULL(MTK_CLK_SGMII2_CDR_FB))
++#define MT7988_CLKS_BITMAP	(BIT_ULL(MTK_CLK_FE) | BIT_ULL(MTK_CLK_ESW) | \
++				 BIT_ULL(MTK_CLK_GP1) | BIT_ULL(MTK_CLK_GP2) | \
++				 BIT_ULL(MTK_CLK_GP3) | BIT_ULL(MTK_CLK_XGP1) | \
++				 BIT_ULL(MTK_CLK_XGP2) | BIT_ULL(MTK_CLK_XGP3) | \
++				 BIT_ULL(MTK_CLK_CRYPTO) | \
++				 BIT_ULL(MTK_CLK_SGMII_TX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII_RX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII2_TX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII2_RX_250M) | \
++				 BIT_ULL(MTK_CLK_ETHWARP_WOCPU2) | \
++				 BIT_ULL(MTK_CLK_ETHWARP_WOCPU1) | \
++				 BIT_ULL(MTK_CLK_ETHWARP_WOCPU0) | \
++				 BIT_ULL(MTK_CLK_TOP_USXGMII_SBUS_0_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_USXGMII_SBUS_1_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_SGM_0_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_SGM_1_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_XFI_PHY_0_XTAL_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_XFI_PHY_1_XTAL_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_ETH_GMII_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_ETH_REFCK_50M_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_ETH_SYS_200M_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_ETH_SYS_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_ETH_XGMII_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_ETH_MII_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_NETSYS_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_NETSYS_500M_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_NETSYS_PAO_2X_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_NETSYS_SYNC_250M_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_NETSYS_PPEFB_250M_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_NETSYS_WARP_SEL))
+ 
+ enum mtk_dev_state {
+ 	MTK_HW_INIT,
+@@ -844,6 +901,7 @@ enum mkt_eth_capabilities {
+ 	MTK_RGMII_BIT = 0,
+ 	MTK_TRGMII_BIT,
+ 	MTK_SGMII_BIT,
++	MTK_USXGMII_BIT,
+ 	MTK_ESW_BIT,
+ 	MTK_GEPHY_BIT,
+ 	MTK_MUX_BIT,
+@@ -866,6 +924,8 @@ enum mkt_eth_capabilities {
+ 	MTK_ETH_MUX_U3_GMAC2_TO_QPHY_BIT,
+ 	MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII_BIT,
+ 	MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII_BIT,
++	MTK_ETH_MUX_GMAC123_TO_GEPHY_SGMII_BIT,
++	MTK_ETH_MUX_GMAC123_TO_USXGMII_BIT,
+ 
+ 	/* PATH BITS */
+ 	MTK_ETH_PATH_GMAC1_RGMII_BIT,
+@@ -874,13 +934,18 @@ enum mkt_eth_capabilities {
+ 	MTK_ETH_PATH_GMAC2_RGMII_BIT,
+ 	MTK_ETH_PATH_GMAC2_SGMII_BIT,
+ 	MTK_ETH_PATH_GMAC2_GEPHY_BIT,
++	MTK_ETH_PATH_GMAC3_SGMII_BIT,
+ 	MTK_ETH_PATH_GDM1_ESW_BIT,
++	MTK_ETH_PATH_GMAC1_USXGMII_BIT,
++	MTK_ETH_PATH_GMAC2_USXGMII_BIT,
++	MTK_ETH_PATH_GMAC3_USXGMII_BIT,
+ };
+ 
+ /* Supported hardware group on SoCs */
+ #define MTK_RGMII		BIT_ULL(MTK_RGMII_BIT)
+ #define MTK_TRGMII		BIT_ULL(MTK_TRGMII_BIT)
+ #define MTK_SGMII		BIT_ULL(MTK_SGMII_BIT)
++#define MTK_USXGMII		BIT_ULL(MTK_USXGMII_BIT)
+ #define MTK_ESW			BIT_ULL(MTK_ESW_BIT)
+ #define MTK_GEPHY		BIT_ULL(MTK_GEPHY_BIT)
+ #define MTK_MUX			BIT_ULL(MTK_MUX_BIT)
+@@ -907,6 +972,10 @@ enum mkt_eth_capabilities {
+ 	BIT_ULL(MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII_BIT)
+ #define MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII	\
+ 	BIT_ULL(MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII_BIT)
++#define MTK_ETH_MUX_GMAC123_TO_GEPHY_SGMII	\
++	BIT_ULL(MTK_ETH_MUX_GMAC123_TO_GEPHY_SGMII_BIT)
++#define MTK_ETH_MUX_GMAC123_TO_USXGMII	\
++	BIT_ULL(MTK_ETH_MUX_GMAC123_TO_USXGMII_BIT)
+ 
+ /* Supported path present on SoCs */
+ #define MTK_ETH_PATH_GMAC1_RGMII	BIT_ULL(MTK_ETH_PATH_GMAC1_RGMII_BIT)
+@@ -915,7 +984,11 @@ enum mkt_eth_capabilities {
+ #define MTK_ETH_PATH_GMAC2_RGMII	BIT_ULL(MTK_ETH_PATH_GMAC2_RGMII_BIT)
+ #define MTK_ETH_PATH_GMAC2_SGMII	BIT_ULL(MTK_ETH_PATH_GMAC2_SGMII_BIT)
+ #define MTK_ETH_PATH_GMAC2_GEPHY	BIT_ULL(MTK_ETH_PATH_GMAC2_GEPHY_BIT)
++#define MTK_ETH_PATH_GMAC3_SGMII	BIT_ULL(MTK_ETH_PATH_GMAC3_SGMII_BIT)
+ #define MTK_ETH_PATH_GDM1_ESW		BIT_ULL(MTK_ETH_PATH_GDM1_ESW_BIT)
++#define MTK_ETH_PATH_GMAC1_USXGMII	BIT_ULL(MTK_ETH_PATH_GMAC1_USXGMII_BIT)
++#define MTK_ETH_PATH_GMAC2_USXGMII	BIT_ULL(MTK_ETH_PATH_GMAC2_USXGMII_BIT)
++#define MTK_ETH_PATH_GMAC3_USXGMII	BIT_ULL(MTK_ETH_PATH_GMAC3_USXGMII_BIT)
+ 
+ #define MTK_GMAC1_RGMII		(MTK_ETH_PATH_GMAC1_RGMII | MTK_RGMII)
+ #define MTK_GMAC1_TRGMII	(MTK_ETH_PATH_GMAC1_TRGMII | MTK_TRGMII)
+@@ -923,7 +996,11 @@ enum mkt_eth_capabilities {
+ #define MTK_GMAC2_RGMII		(MTK_ETH_PATH_GMAC2_RGMII | MTK_RGMII)
+ #define MTK_GMAC2_SGMII		(MTK_ETH_PATH_GMAC2_SGMII | MTK_SGMII)
+ #define MTK_GMAC2_GEPHY		(MTK_ETH_PATH_GMAC2_GEPHY | MTK_GEPHY)
++#define MTK_GMAC3_SGMII		(MTK_ETH_PATH_GMAC3_SGMII | MTK_SGMII)
+ #define MTK_GDM1_ESW		(MTK_ETH_PATH_GDM1_ESW | MTK_ESW)
++#define MTK_GMAC1_USXGMII	(MTK_ETH_PATH_GMAC1_USXGMII | MTK_USXGMII)
++#define MTK_GMAC2_USXGMII	(MTK_ETH_PATH_GMAC2_USXGMII | MTK_USXGMII)
++#define MTK_GMAC3_USXGMII	(MTK_ETH_PATH_GMAC3_USXGMII | MTK_USXGMII)
+ 
+ /* MUXes present on SoCs */
+ /* 0: GDM1 -> GMAC1, 1: GDM1 -> ESW */
+@@ -946,6 +1023,12 @@ enum mkt_eth_capabilities {
+ #define MTK_MUX_GMAC12_TO_GEPHY_SGMII   \
+ 	(MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII | MTK_MUX)
+ 
++#define MTK_MUX_GMAC123_TO_GEPHY_SGMII   \
++	(MTK_ETH_MUX_GMAC123_TO_GEPHY_SGMII | MTK_MUX)
++
++#define MTK_MUX_GMAC123_TO_USXGMII   \
++	(MTK_ETH_MUX_GMAC123_TO_USXGMII | MTK_MUX | MTK_INFRA)
++
+ #ifdef CONFIG_SOC_MT7621
+ #define MTK_CAP_MASK MTK_NETSYS_V2
+ #else
+@@ -984,9 +1067,17 @@ enum mkt_eth_capabilities {
+ 		      MTK_MUX_U3_GMAC2_TO_QPHY | MTK_U3_COPHY_V2 | \
+ 		      MTK_NETSYS_V2 | MTK_RSTCTRL_PPE1)
+ 
+-#define MT7986_CAPS  (MTK_GMAC1_SGMII | MTK_GMAC2_SGMII | \
+-		      MTK_MUX_GMAC12_TO_GEPHY_SGMII | MTK_QDMA | \
+-		      MTK_NETSYS_V2 | MTK_RSTCTRL_PPE1)
++#define MT7986_CAPS  (MTK_GMAC1_SGMII | MTK_GMAC2_SGMII |	\
++		      MTK_MUX_GMAC12_TO_GEPHY_SGMII |		\
++		      MTK_QDMA | MTK_NETSYS_V2 |		\
++		      MTK_RSTCTRL_PPE1)
++
++#define MT7988_CAPS   (MTK_GMAC1_SGMII | MTK_GMAC2_SGMII |	\
++		       MTK_GMAC3_SGMII | MTK_QDMA |		\
++		       MTK_MUX_GMAC123_TO_GEPHY_SGMII |		\
++		       MTK_NETSYS_V3 | MTK_RSTCTRL_PPE1 |	\
++		       MTK_GMAC1_USXGMII | MTK_GMAC2_USXGMII |	\
++		       MTK_GMAC3_USXGMII | MTK_MUX_GMAC123_TO_USXGMII)
+ 
+ struct mtk_tx_dma_desc_info {
+ 	dma_addr_t	addr;
+@@ -1072,7 +1163,7 @@ struct mtk_soc_data {
+ 	const struct mtk_reg_map *reg_map;
+ 	u32             ana_rgc3;
+ 	u64		caps;
+-	u32		required_clks;
++	u64		required_clks;
+ 	bool		required_pctl;
+ 	u8		offload_version;
+ 	u8		hash_offset;
diff --git a/target/linux/generic/pending-5.15/737-07-net-ethernet-mtk_eth_soc-add-paths-and-SerDes-modes-.patch b/target/linux/generic/pending-5.15/737-07-net-ethernet-mtk_eth_soc-add-paths-and-SerDes-modes-.patch
new file mode 100644
index 00000000000000..0185bed089774d
--- /dev/null
+++ b/target/linux/generic/pending-5.15/737-07-net-ethernet-mtk_eth_soc-add-paths-and-SerDes-modes-.patch
@@ -0,0 +1,1867 @@
+From 3d833ad2cfc1ab503d9aae2967b7f10811bb3c9c Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Wed, 1 Mar 2023 11:56:04 +0000
+Subject: [PATCH 7/7] net: ethernet: mtk_eth_soc: add paths and SerDes modes 
+ for MT7988
+
+MT7988 comes with a built-in 2.5G PHY as well as
+USXGMII/10GBase-KR/5GBase-KR compatible SerDes lanes for external PHYs.
+Add support for configuring the MAC and SerDes parts for the new paths.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/ethernet/mediatek/Kconfig        |   7 +
+ drivers/net/ethernet/mediatek/Makefile       |   1 +
+ drivers/net/ethernet/mediatek/mtk_eth_path.c | 154 +++-
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c  | 270 +++++-
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h  | 194 ++++-
+ drivers/net/ethernet/mediatek/mtk_usxgmii.c  | 835 +++++++++++++++++++
+ 6 files changed, 1428 insertions(+), 33 deletions(-)
+ create mode 100644 drivers/net/ethernet/mediatek/mtk_usxgmii.c
+
+--- a/drivers/net/ethernet/mediatek/Kconfig
++++ b/drivers/net/ethernet/mediatek/Kconfig
+@@ -24,6 +24,13 @@ config NET_MEDIATEK_SOC
+ 	  This driver supports the gigabit ethernet MACs in the
+ 	  MediaTek SoC family.
+ 
++config NET_MEDIATEK_SOC_USXGMII
++	bool "Support USXGMII SerDes on MT7988"
++	depends on (ARCH_MEDIATEK && ARM64) || COMPILE_TEST
++	def_bool NET_MEDIATEK_SOC != n
++	help
++	  Include support for 10G SerDes which can be found on MT7988.
++
+ config NET_MEDIATEK_STAR_EMAC
+ 	tristate "MediaTek STAR Ethernet MAC support"
+ 	select PHYLIB
+--- a/drivers/net/ethernet/mediatek/Makefile
++++ b/drivers/net/ethernet/mediatek/Makefile
+@@ -5,6 +5,7 @@
+ 
+ obj-$(CONFIG_NET_MEDIATEK_SOC) += mtk_eth.o
+ mtk_eth-y := mtk_eth_soc.o mtk_eth_path.o mtk_ppe.o mtk_ppe_debugfs.o mtk_ppe_offload.o
++mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_USXGMII) += mtk_usxgmii.o
+ mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed.o mtk_wed_mcu.o mtk_wed_wo.o
+ ifdef CONFIG_DEBUG_FS
+ mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed_debugfs.o
+--- a/drivers/net/ethernet/mediatek/mtk_eth_path.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_path.c
+@@ -31,10 +31,20 @@ static const char *mtk_eth_path_name(u64
+ 		return "gmac2_rgmii";
+ 	case MTK_ETH_PATH_GMAC2_SGMII:
+ 		return "gmac2_sgmii";
++	case MTK_ETH_PATH_GMAC2_2P5GPHY:
++		return "gmac2_2p5gphy";
+ 	case MTK_ETH_PATH_GMAC2_GEPHY:
+ 		return "gmac2_gephy";
++	case MTK_ETH_PATH_GMAC3_SGMII:
++		return "gmac3_sgmii";
+ 	case MTK_ETH_PATH_GDM1_ESW:
+ 		return "gdm1_esw";
++	case MTK_ETH_PATH_GMAC1_USXGMII:
++		return "gmac1_usxgmii";
++	case MTK_ETH_PATH_GMAC2_USXGMII:
++		return "gmac2_usxgmii";
++	case MTK_ETH_PATH_GMAC3_USXGMII:
++		return "gmac3_usxgmii";
+ 	default:
+ 		return "unknown path";
+ 	}
+@@ -42,8 +52,8 @@ static const char *mtk_eth_path_name(u64
+ 
+ static int set_mux_gdm1_to_gmac1_esw(struct mtk_eth *eth, u64 path)
+ {
++	u32 val, mask, set, reg;
+ 	bool updated = true;
+-	u32 val, mask, set;
+ 
+ 	switch (path) {
+ 	case MTK_ETH_PATH_GMAC1_SGMII:
+@@ -59,10 +69,15 @@ static int set_mux_gdm1_to_gmac1_esw(str
+ 		break;
+ 	}
+ 
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3))
++		reg = MTK_MAC_MISC_V3;
++	else
++		reg = MTK_MAC_MISC;
++
+ 	if (updated) {
+-		val = mtk_r32(eth, MTK_MAC_MISC);
++		val = mtk_r32(eth, reg);
+ 		val = (val & mask) | set;
+-		mtk_w32(eth, val, MTK_MAC_MISC);
++		mtk_w32(eth, val, reg);
+ 	}
+ 
+ 	dev_dbg(eth->dev, "path %s in %s updated = %d\n",
+@@ -125,6 +140,31 @@ static int set_mux_u3_gmac2_to_qphy(stru
+ 	return 0;
+ }
+ 
++static int set_mux_gmac2_to_2p5gphy(struct mtk_eth *eth, u64 path)
++{
++	unsigned int val = 0;
++	bool updated = true;
++	int mac_id = 0;
++
++	regmap_read(eth->ethsys, ETHSYS_SYSCFG0, &val);
++
++	switch (path) {
++	case MTK_ETH_PATH_GMAC2_2P5GPHY:
++		val &= ~(u32)SYSCFG0_SGMII_GMAC2_V2;
++		mac_id = MTK_GMAC2_ID;
++		break;
++	default:
++		updated = false;
++		break;
++	};
++
++	if (updated)
++		regmap_update_bits(eth->ethsys, ETHSYS_SYSCFG0,
++				   SYSCFG0_SGMII_MASK, val);
++
++	return 0;
++}
++
+ static int set_mux_gmac1_gmac2_to_sgmii_rgmii(struct mtk_eth *eth, u64 path)
+ {
+ 	unsigned int val = 0;
+@@ -163,7 +203,61 @@ static int set_mux_gmac1_gmac2_to_sgmii_
+ 	return 0;
+ }
+ 
+-static int set_mux_gmac12_to_gephy_sgmii(struct mtk_eth *eth, u64 path)
++static int set_mux_gmac123_to_usxgmii(struct mtk_eth *eth, u64 path)
++{
++	unsigned int val = 0;
++	bool updated = true;
++	int mac_id = 0;
++
++	dev_dbg(eth->dev, "path %s in %s updated = %d\n",
++		mtk_eth_path_name(path), __func__, updated);
++
++	/* Disable SYSCFG1 SGMII */
++	regmap_read(eth->ethsys, ETHSYS_SYSCFG0, &val);
++
++	switch (path) {
++	case MTK_ETH_PATH_GMAC1_USXGMII:
++		val &= ~(u32)SYSCFG0_SGMII_GMAC1_V2;
++		mac_id = MTK_GMAC1_ID;
++		break;
++	case MTK_ETH_PATH_GMAC2_USXGMII:
++		val &= ~(u32)SYSCFG0_SGMII_GMAC2_V2;
++		mac_id = MTK_GMAC2_ID;
++		break;
++	case MTK_ETH_PATH_GMAC3_USXGMII:
++		val &= ~(u32)SYSCFG0_SGMII_GMAC3_V2;
++		mac_id = MTK_GMAC3_ID;
++		break;
++	default:
++		updated = false;
++	};
++
++	if (updated) {
++		regmap_update_bits(eth->ethsys, ETHSYS_SYSCFG0,
++				   SYSCFG0_SGMII_MASK, val);
++
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3) &&
++		    mac_id == MTK_GMAC2_ID) {
++			regmap_update_bits(eth->infra,
++					   TOP_MISC_NETSYS_PCS_MUX,
++					   NETSYS_PCS_MUX_MASK,
++					   MUX_G2_USXGMII_SEL);
++		}
++	}
++
++	/* Enable XGDM Path */
++	val = mtk_r32(eth, MTK_GDMA_EG_CTRL(mac_id));
++	val |= MTK_GDMA_XGDM_SEL;
++	mtk_w32(eth, val, MTK_GDMA_EG_CTRL(mac_id));
++
++	dev_dbg(eth->dev, "path %s in %s updated = %d\n",
++		mtk_eth_path_name(path), __func__, updated);
++
++
++	return 0;
++}
++
++static int set_mux_gmac123_to_gephy_sgmii(struct mtk_eth *eth, u64 path)
+ {
+ 	unsigned int val = 0;
+ 	bool updated = true;
+@@ -180,6 +274,9 @@ static int set_mux_gmac12_to_gephy_sgmii
+ 	case MTK_ETH_PATH_GMAC2_SGMII:
+ 		val |= SYSCFG0_SGMII_GMAC2_V2;
+ 		break;
++	case MTK_ETH_PATH_GMAC3_SGMII:
++		val |= SYSCFG0_SGMII_GMAC3_V2;
++		break;
+ 	default:
+ 		updated = false;
+ 	}
+@@ -208,13 +305,25 @@ static const struct mtk_eth_muxc mtk_eth
+ 		.cap_bit = MTK_ETH_MUX_U3_GMAC2_TO_QPHY,
+ 		.set_path = set_mux_u3_gmac2_to_qphy,
+ 	}, {
++		.name = "mux_gmac2_to_2p5gphy",
++		.cap_bit = MTK_ETH_MUX_GMAC2_TO_2P5GPHY,
++		.set_path = set_mux_gmac2_to_2p5gphy,
++	}, {
+ 		.name = "mux_gmac1_gmac2_to_sgmii_rgmii",
+ 		.cap_bit = MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII,
+ 		.set_path = set_mux_gmac1_gmac2_to_sgmii_rgmii,
+ 	}, {
+ 		.name = "mux_gmac12_to_gephy_sgmii",
+ 		.cap_bit = MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII,
+-		.set_path = set_mux_gmac12_to_gephy_sgmii,
++		.set_path = set_mux_gmac123_to_gephy_sgmii,
++	}, {
++		.name = "mux_gmac123_to_gephy_sgmii",
++		.cap_bit = MTK_ETH_MUX_GMAC123_TO_GEPHY_SGMII,
++		.set_path = set_mux_gmac123_to_gephy_sgmii,
++	}, {
++		.name = "mux_gmac123_to_usxgmii",
++		.cap_bit = MTK_ETH_MUX_GMAC123_TO_USXGMII,
++		.set_path = set_mux_gmac123_to_usxgmii,
+ 	},
+ };
+ 
+@@ -243,16 +352,46 @@ static int mtk_eth_mux_setup(struct mtk_
+ 		}
+ 	}
+ 
++	dev_dbg(eth->dev, "leaving mux_setup %s\n",
++		mtk_eth_path_name(path));
++
+ out:
+ 	return err;
+ }
+ 
++int mtk_gmac_usxgmii_path_setup(struct mtk_eth *eth, int mac_id)
++{
++	u64 path;
++
++	path = (mac_id == MTK_GMAC1_ID) ?  MTK_ETH_PATH_GMAC1_USXGMII :
++	       (mac_id == MTK_GMAC2_ID) ?  MTK_ETH_PATH_GMAC2_USXGMII :
++					   MTK_ETH_PATH_GMAC3_USXGMII;
++
++	/* Setup proper MUXes along the path */
++	return mtk_eth_mux_setup(eth, path);
++}
++
+ int mtk_gmac_sgmii_path_setup(struct mtk_eth *eth, int mac_id)
+ {
+ 	u64 path;
+ 
+-	path = (mac_id == 0) ?  MTK_ETH_PATH_GMAC1_SGMII :
+-				MTK_ETH_PATH_GMAC2_SGMII;
++	path = (mac_id == MTK_GMAC1_ID) ? MTK_ETH_PATH_GMAC1_SGMII :
++	       (mac_id == MTK_GMAC2_ID) ? MTK_ETH_PATH_GMAC2_SGMII :
++					  MTK_ETH_PATH_GMAC3_SGMII;
++
++	/* Setup proper MUXes along the path */
++	return mtk_eth_mux_setup(eth, path);
++}
++
++int mtk_gmac_2p5gphy_path_setup(struct mtk_eth *eth, int mac_id)
++{
++	u64 path = 0;
++
++	if (mac_id == MTK_GMAC2_ID)
++		path = MTK_ETH_PATH_GMAC2_2P5GPHY;
++
++	if (!path)
++		return -EINVAL;
+ 
+ 	/* Setup proper MUXes along the path */
+ 	return mtk_eth_mux_setup(eth, path);
+@@ -282,4 +421,3 @@ int mtk_gmac_rgmii_path_setup(struct mtk
+ 	/* Setup proper MUXes along the path */
+ 	return mtk_eth_mux_setup(eth, path);
+ }
+-
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -437,6 +437,23 @@ static void mtk_gmac0_rgmii_adjust(struc
+ 	mtk_w32(eth, val, TRGMII_TCK_CTRL);
+ }
+ 
++static void mtk_setup_bridge_switch(struct mtk_eth *eth)
++{
++	int val;
++
++	/* Force Port1 XGMAC Link Up */
++	val = mtk_r32(eth, MTK_XGMAC_STS(MTK_GMAC1_ID));
++	mtk_w32(eth, val | MTK_XGMAC_FORCE_LINK(MTK_GMAC1_ID),
++		MTK_XGMAC_STS(MTK_GMAC1_ID));
++
++	/* Adjust GSW bridge IPG to 11*/
++	val = mtk_r32(eth, MTK_GSW_CFG);
++	val &= ~(GSWTX_IPG_MASK | GSWRX_IPG_MASK);
++	val |= (GSW_IPG_11 << GSWTX_IPG_SHIFT) |
++	       (GSW_IPG_11 << GSWRX_IPG_SHIFT);
++	mtk_w32(eth, val, MTK_GSW_CFG);
++}
++
+ static struct phylink_pcs *mtk_mac_select_pcs(struct phylink_config *config,
+ 					      phy_interface_t interface)
+ {
+@@ -451,6 +468,12 @@ static struct phylink_pcs *mtk_mac_selec
+ 		       0 : mac->id;
+ 
+ 		return eth->sgmii_pcs[sid];
++	} else if ((interface == PHY_INTERFACE_MODE_USXGMII ||
++		    interface == PHY_INTERFACE_MODE_10GKR ||
++		    interface == PHY_INTERFACE_MODE_5GBASER) &&
++		   MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3) &&
++		   mac->id != MTK_GMAC1_ID) {
++			return mtk_usxgmii_select_pcs(eth, mac->id);
+ 	}
+ 
+ 	return NULL;
+@@ -462,7 +485,7 @@ static void mtk_mac_config(struct phylin
+ 	struct mtk_mac *mac = container_of(config, struct mtk_mac,
+ 					   phylink_config);
+ 	struct mtk_eth *eth = mac->hw;
+-	int val, ge_mode, err = 0;
++	int val, ge_mode, force_link, err = 0;
+ 	u32 i;
+ 
+ 	/* MT76x8 has no hardware settings between for the MAC */
+@@ -506,6 +529,23 @@ static void mtk_mac_config(struct phylin
+ 					goto init_err;
+ 			}
+ 			break;
++		case PHY_INTERFACE_MODE_USXGMII:
++		case PHY_INTERFACE_MODE_10GKR:
++		case PHY_INTERFACE_MODE_5GBASER:
++			if (MTK_HAS_CAPS(eth->soc->caps, MTK_USXGMII)) {
++				err = mtk_gmac_usxgmii_path_setup(eth, mac->id);
++				if (err)
++					goto init_err;
++			}
++			break;
++		case PHY_INTERFACE_MODE_INTERNAL:
++			if (mac->id == MTK_GMAC2_ID &&
++			    MTK_HAS_CAPS(eth->soc->caps, MTK_2P5GPHY)) {
++				err = mtk_gmac_2p5gphy_path_setup(eth, mac->id);
++				if (err)
++					goto init_err;
++			}
++			break;
+ 		default:
+ 			goto err_phy;
+ 		}
+@@ -584,14 +624,78 @@ static void mtk_mac_config(struct phylin
+ 				   SYSCFG0_SGMII_MASK,
+ 				   ~(u32)SYSCFG0_SGMII_MASK);
+ 
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3)) {
++			mtk_xfi_pll_enable(eth);
++			mtk_sgmii_reset(eth, mac->id);
++			if (phylink_autoneg_inband(mode))
++				mtk_sgmii_setup_phya_gen1(eth, mac->id);
++			else
++				mtk_sgmii_setup_phya_gen2(eth, mac->id);
++		}
+ 		/* Save the syscfg0 value for mac_finish */
+ 		mac->syscfg0 = val;
+-	} else if (phylink_autoneg_inband(mode)) {
++	} else if (state->interface != PHY_INTERFACE_MODE_USXGMII &&
++		   state->interface != PHY_INTERFACE_MODE_10GKR &&
++		   state->interface != PHY_INTERFACE_MODE_5GBASER &&
++		   phylink_autoneg_inband(mode)) {
+ 		dev_err(eth->dev,
+-			"In-band mode not supported in non SGMII mode!\n");
++			"In-band mode not supported in non-SerDes modes!\n");
+ 		return;
+ 	}
+ 
++	/* Setup gmac */
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3) &&
++	    (mtk_interface_mode_is_xgmii(state->interface) ||
++	     mac->interface == PHY_INTERFACE_MODE_INTERNAL)) {
++		mtk_w32(mac->hw, MTK_GDMA_XGDM_SEL, MTK_GDMA_EG_CTRL(mac->id));
++		mtk_w32(mac->hw, MAC_MCR_FORCE_LINK_DOWN, MTK_MAC_MCR(mac->id));
++
++		switch (mac->id) {
++		case MTK_GMAC1_ID:
++			mtk_setup_bridge_switch(eth);
++			break;
++		case MTK_GMAC2_ID:
++			force_link = (mac->interface ==
++				      PHY_INTERFACE_MODE_INTERNAL) ?
++				      MTK_XGMAC_FORCE_LINK(mac->id) : 0;
++			val = mtk_r32(eth, MTK_XGMAC_STS(mac->id));
++			mtk_w32(eth, val | force_link,
++				MTK_XGMAC_STS(mac->id));
++			break;
++		case MTK_GMAC3_ID:
++			val = mtk_r32(eth, MTK_XGMAC_STS(mac->id));
++			mtk_w32(eth, val | MTK_XGMAC_FORCE_LINK(mac->id),
++				MTK_XGMAC_STS(mac->id));
++			break;
++		}
++	} else {
++		val = mtk_r32(eth, MTK_GDMA_EG_CTRL(mac->id));
++		mtk_w32(eth, val & ~MTK_GDMA_XGDM_SEL,
++			MTK_GDMA_EG_CTRL(mac->id));
++
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3)) {
++			switch (mac->id) {
++			case MTK_GMAC2_ID:
++			case MTK_GMAC3_ID:
++				val = mtk_r32(eth, MTK_XGMAC_STS(mac->id));
++				mtk_w32(eth,
++					val & ~MTK_XGMAC_FORCE_LINK(mac->id),
++					MTK_XGMAC_STS(mac->id));
++				break;
++			}
++		}
++
++/*
++		if (mac->type != mac_type) {
++			if (atomic_read(&reset_pending) == 0) {
++				atomic_inc(&force);
++				schedule_work(&eth->pending_work);
++				atomic_inc(&reset_pending);
++			} else
++				atomic_dec(&reset_pending);
++		}
++*/
++	}
+ 	return;
+ 
+ err_phy:
+@@ -632,11 +736,40 @@ static int mtk_mac_finish(struct phylink
+ 	return 0;
+ }
+ 
+-static void mtk_mac_pcs_get_state(struct phylink_config *config,
++static void mtk_xgdm_pcs_get_state(struct mtk_mac *mac,
++				  struct phylink_link_state *state)
++{
++	u32 sts = mtk_r32(mac->hw, MTK_XGMAC_STS(mac->id));
++
++	if (mac->id == MTK_GMAC2_ID)
++		sts = sts >> 16;
++
++	state->link = FIELD_GET(MTK_USXGMII_PCS_LINK, sts);
++	if (!state->link)
++		return;
++
++	state->duplex = DUPLEX_FULL;
++	state->interface = mac->interface;
++
++	switch (FIELD_GET(MTK_USXGMII_PCS_MODE, sts)) {
++	case 0:
++		state->speed = SPEED_10000;
++		break;
++	case 1:
++		state->speed = SPEED_5000;
++		break;
++	case 2:
++		state->speed = SPEED_2500;
++		break;
++	case 3:
++		state->speed = SPEED_1000;
++		break;
++	}
++}
++
++static void mtk_gdm_pcs_get_state(struct mtk_mac *mac,
+ 				  struct phylink_link_state *state)
+ {
+-	struct mtk_mac *mac = container_of(config, struct mtk_mac,
+-					   phylink_config);
+ 	u32 pmsr = mtk_r32(mac->hw, MTK_MAC_MSR(mac->id));
+ 
+ 	state->link = (pmsr & MAC_MSR_LINK);
+@@ -664,15 +797,35 @@ static void mtk_mac_pcs_get_state(struct
+ 		state->pause |= MLO_PAUSE_TX;
+ }
+ 
++static void mtk_mac_pcs_get_state(struct phylink_config *config,
++				  struct phylink_link_state *state)
++{
++	struct mtk_mac *mac = container_of(config, struct mtk_mac,
++					   phylink_config);
++
++	if (mtk_interface_mode_is_xgmii(state->interface))
++		mtk_xgdm_pcs_get_state(mac, state);
++	else
++		mtk_gdm_pcs_get_state(mac, state);
++}
++
+ static void mtk_mac_link_down(struct phylink_config *config, unsigned int mode,
+ 			      phy_interface_t interface)
+ {
+ 	struct mtk_mac *mac = container_of(config, struct mtk_mac,
+ 					   phylink_config);
+-	u32 mcr = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id));
++	u32 mcr;
+ 
+-	mcr &= ~(MAC_MCR_TX_EN | MAC_MCR_RX_EN);
+-	mtk_w32(mac->hw, mcr, MTK_MAC_MCR(mac->id));
++	if (!mtk_interface_mode_is_xgmii(interface)) {
++		mcr = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id));
++		mcr &= ~(MAC_MCR_TX_EN | MAC_MCR_RX_EN);
++		mtk_w32(mac->hw, mcr, MTK_MAC_MCR(mac->id));
++	} else if (mac->id != MTK_GMAC1_ID) {
++		mcr = mtk_r32(mac->hw, MTK_XMAC_MCR(mac->id));
++		mcr &= 0xfffffff0;
++		mcr |= XMAC_MCR_TRX_DISABLE;
++		mtk_w32(mac->hw, mcr, MTK_XMAC_MCR(mac->id));
++	}
+ }
+ 
+ static void mtk_set_queue_speed(struct mtk_eth *eth, unsigned int idx,
+@@ -744,13 +897,11 @@ static void mtk_set_queue_speed(struct m
+ 	mtk_w32(eth, val, soc->reg_map->qdma.qtx_sch + ofs);
+ }
+ 
+-static void mtk_mac_link_up(struct phylink_config *config,
+-			    struct phy_device *phy,
+-			    unsigned int mode, phy_interface_t interface,
+-			    int speed, int duplex, bool tx_pause, bool rx_pause)
++static void mtk_gdm_mac_link_up(struct mtk_mac *mac,
++				struct phy_device *phy,
++				unsigned int mode, phy_interface_t interface,
++				int speed, int duplex, bool tx_pause, bool rx_pause)
+ {
+-	struct mtk_mac *mac = container_of(config, struct mtk_mac,
+-					   phylink_config);
+ 	u32 mcr;
+ 
+ 	mcr = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id));
+@@ -784,6 +935,47 @@ static void mtk_mac_link_up(struct phyli
+ 	mtk_w32(mac->hw, mcr, MTK_MAC_MCR(mac->id));
+ }
+ 
++static void mtk_xgdm_mac_link_up(struct mtk_mac *mac,
++				 struct phy_device *phy,
++				 unsigned int mode, phy_interface_t interface,
++				 int speed, int duplex, bool tx_pause, bool rx_pause)
++{
++	u32 mcr;
++
++	if (mac->id == MTK_GMAC1_ID)
++		return;
++
++	mcr = mtk_r32(mac->hw, MTK_XMAC_MCR(mac->id));
++
++	mcr &= ~(XMAC_MCR_FORCE_TX_FC |	XMAC_MCR_FORCE_RX_FC);
++	/* Configure pause modes -
++	 * phylink will avoid these for half duplex
++	 */
++	if (tx_pause)
++		mcr |= XMAC_MCR_FORCE_TX_FC;
++	if (rx_pause)
++		mcr |= XMAC_MCR_FORCE_RX_FC;
++
++	mcr &= ~(XMAC_MCR_TRX_DISABLE);
++	mtk_w32(mac->hw, mcr, MTK_XMAC_MCR(mac->id));
++}
++
++static void mtk_mac_link_up(struct phylink_config *config,
++			    struct phy_device *phy,
++			    unsigned int mode, phy_interface_t interface,
++			    int speed, int duplex, bool tx_pause, bool rx_pause)
++{
++	struct mtk_mac *mac = container_of(config, struct mtk_mac,
++					   phylink_config);
++
++	if (mtk_interface_mode_is_xgmii(interface))
++		mtk_xgdm_mac_link_up(mac, phy, mode, interface, speed, duplex,
++				     tx_pause, rx_pause);
++	else
++		mtk_gdm_mac_link_up(mac, phy, mode, interface, speed, duplex,
++				    tx_pause, rx_pause);
++}
++
+ static const struct phylink_mac_ops mtk_phylink_ops = {
+ 	.validate = phylink_generic_validate,
+ 	.mac_select_pcs = mtk_mac_select_pcs,
+@@ -836,10 +1028,21 @@ static int mtk_mdio_init(struct mtk_eth
+ 	}
+ 	divider = min_t(unsigned int, DIV_ROUND_UP(MDC_MAX_FREQ, max_clk), 63);
+ 
++	/* Configure MDC Turbo Mode */
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3)) {
++		val = mtk_r32(eth, MTK_MAC_MISC_V3);
++		val |= MISC_MDC_TURBO;
++		mtk_w32(eth, val, MTK_MAC_MISC_V3);
++	} else {
++		val = mtk_r32(eth, MTK_PPSC);
++		val |= PPSC_MDC_TURBO;
++		mtk_w32(eth, val, MTK_PPSC);
++	}
++
+ 	/* Configure MDC Divider */
+ 	val = mtk_r32(eth, MTK_PPSC);
+ 	val &= ~PPSC_MDC_CFG;
+-	val |= FIELD_PREP(PPSC_MDC_CFG, divider) | PPSC_MDC_TURBO;
++	val |= FIELD_PREP(PPSC_MDC_CFG, divider);
+ 	mtk_w32(eth, val, MTK_PPSC);
+ 
+ 	dev_dbg(eth->dev, "MDC is running on %d Hz\n", MDC_MAX_FREQ / divider);
+@@ -4433,8 +4636,8 @@ static int mtk_add_mac(struct mtk_eth *e
+ 	const __be32 *_id = of_get_property(np, "reg", NULL);
+ 	phy_interface_t phy_mode;
+ 	struct phylink *phylink;
+-	struct mtk_mac *mac;
+ 	int id, err;
++	struct mtk_mac *mac;
+ 	int txqs = 1;
+ 
+ 	if (!_id) {
+@@ -4525,6 +4728,32 @@ static int mtk_add_mac(struct mtk_eth *e
+ 			  mac->phylink_config.supported_interfaces);
+ 	}
+ 
++	if (MTK_HAS_CAPS(mac->hw->soc->caps, MTK_USXGMII)) {
++		if (id == MTK_GMAC1_ID) {
++			mac->phylink_config.mac_capabilities = MAC_ASYM_PAUSE |
++							       MAC_SYM_PAUSE |
++							       MAC_10000FD;
++			phy_interface_zero(
++				mac->phylink_config.supported_interfaces);
++			__set_bit(PHY_INTERFACE_MODE_INTERNAL,
++				  mac->phylink_config.supported_interfaces);
++		} else {
++			mac->phylink_config.mac_capabilities |= MAC_5000FD | MAC_10000FD;
++			__set_bit(PHY_INTERFACE_MODE_5GBASER,
++				  mac->phylink_config.supported_interfaces);
++			__set_bit(PHY_INTERFACE_MODE_10GKR,
++				  mac->phylink_config.supported_interfaces);
++			__set_bit(PHY_INTERFACE_MODE_USXGMII,
++				  mac->phylink_config.supported_interfaces);
++		}
++	}
++
++	if (MTK_HAS_CAPS(mac->hw->soc->caps, MTK_2P5GPHY)) {
++		if (id == MTK_GMAC2_ID)
++			__set_bit(PHY_INTERFACE_MODE_INTERNAL,
++				  mac->phylink_config.supported_interfaces);
++	}
++
+ 	phylink = phylink_create(&mac->phylink_config,
+ 				 of_fwnode_handle(mac->of_node),
+ 				 phy_mode, &mtk_phylink_ops);
+@@ -4712,6 +4941,13 @@ static int mtk_probe(struct platform_dev
+ 
+ 		if (err)
+ 			return err;
++	}
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_USXGMII)) {
++		err = mtk_usxgmii_init(eth);
++
++		if (err)
++			return err;
+ 	}
+ 
+ 	if (eth->soc->required_pctl) {
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -126,6 +126,11 @@
+ #define MTK_GDMA_TO_PDMA	0x0
+ #define MTK_GDMA_DROP_ALL       0x7777
+ 
++/* GDM Egress Control Register */
++#define MTK_GDMA_EG_CTRL(x)	((x == MTK_GMAC3_ID) ?		\
++				 0x544 : 0x504 + (x * 0x1000))
++#define MTK_GDMA_XGDM_SEL	BIT(31)
++
+ /* Unicast Filter MAC Address Register - Low */
+ #define MTK_GDMA_MAC_ADRL(x)	(0x508 + (x * 0x1000))
+ 
+@@ -386,7 +391,26 @@
+ #define PHY_IAC_TIMEOUT		HZ
+ 
+ #define MTK_MAC_MISC		0x1000c
++#define MTK_MAC_MISC_V3		0x10010
+ #define MTK_MUX_TO_ESW		BIT(0)
++#define MISC_MDC_TURBO		BIT(4)
++
++/* XMAC status registers */
++#define MTK_XGMAC_STS(x)	((x == MTK_GMAC3_ID) ? 0x1001C : 0x1000C)
++#define MTK_XGMAC_FORCE_LINK(x)	((x == MTK_GMAC2_ID) ? BIT(31) : BIT(15))
++#define MTK_USXGMII_PCS_LINK	BIT(8)
++#define MTK_XGMAC_RX_FC		BIT(5)
++#define MTK_XGMAC_TX_FC		BIT(4)
++#define MTK_USXGMII_PCS_MODE	GENMASK(3, 1)
++#define MTK_XGMAC_LINK_STS	BIT(0)
++
++/* GSW bridge registers */
++#define MTK_GSW_CFG		(0x10080)
++#define GSWTX_IPG_MASK		GENMASK(19, 16)
++#define GSWTX_IPG_SHIFT		16
++#define GSWRX_IPG_MASK		GENMASK(3, 0)
++#define GSWRX_IPG_SHIFT		0
++#define GSW_IPG_11		11
+ 
+ /* Mac control registers */
+ #define MTK_MAC_MCR(x)		(0x10100 + (x * 0x100))
+@@ -411,6 +435,17 @@
+ #define MAC_MCR_FORCE_LINK	BIT(0)
+ #define MAC_MCR_FORCE_LINK_DOWN	(MAC_MCR_FORCE_MODE)
+ 
++/* Mac EEE control registers */
++#define MTK_MAC_EEE(x)		(0x10104 + (x * 0x100))
++#define MAC_EEE_WAKEUP_TIME_1000	GENMASK(31, 24)
++#define MAC_EEE_WAKEUP_TIME_100	GENMASK(23, 16)
++#define MAC_EEE_LPI_TXIDLE_THD	GENMASK(15, 8)
++#define MAC_EEE_RESV0		GENMASK(7, 4)
++#define MAC_EEE_CKG_TXILDE	BIT(3)
++#define MAC_EEE_CKG_RXLPI	BIT(2)
++#define MAC_EEE_TX_DOWN_REQ	BIT(1)
++#define MAC_EEE_LPI_MODE	BIT(0)
++
+ /* Mac status registers */
+ #define MTK_MAC_MSR(x)		(0x10108 + (x * 0x100))
+ #define MAC_MSR_EEE1G		BIT(7)
+@@ -455,6 +490,12 @@
+ #define INTF_MODE_RGMII_1000    (TRGMII_MODE | TRGMII_CENTRAL_ALIGNED)
+ #define INTF_MODE_RGMII_10_100  0
+ 
++/* XFI Mac control registers */
++#define MTK_XMAC_MCR(x)		(0x12000 + ((x - 1) * 0x1000))
++#define XMAC_MCR_TRX_DISABLE	0xf
++#define XMAC_MCR_FORCE_TX_FC	BIT(5)
++#define XMAC_MCR_FORCE_RX_FC	BIT(4)
++
+ /* GPIO port control registers for GMAC 2*/
+ #define GPIO_OD33_CTRL8		0x4c0
+ #define GPIO_BIAS_CTRL		0xed0
+@@ -480,6 +521,7 @@
+ #define SYSCFG0_SGMII_GMAC2    ((3 << 8) & SYSCFG0_SGMII_MASK)
+ #define SYSCFG0_SGMII_GMAC1_V2 BIT(9)
+ #define SYSCFG0_SGMII_GMAC2_V2 BIT(8)
++#define SYSCFG0_SGMII_GMAC3_V2 BIT(7)
+ 
+ 
+ /* ethernet subsystem clock register */
+@@ -506,16 +548,91 @@
+ #define ETHSYS_DMA_AG_MAP_QDMA	BIT(1)
+ #define ETHSYS_DMA_AG_MAP_PPE	BIT(2)
+ 
++/* USXGMII subsystem config registers */
++/* Register to control speed */
++#define RG_PHY_TOP_SPEED_CTRL1	0x80C
++#define USXGMII_RATE_UPDATE_MODE	BIT(31)
++#define USXGMII_MAC_CK_GATED	BIT(29)
++#define USXGMII_IF_FORCE_EN	BIT(28)
++#define USXGMII_RATE_ADAPT_MODE	GENMASK(10, 8)
++#define USXGMII_RATE_ADAPT_MODE_X1	0
++#define USXGMII_RATE_ADAPT_MODE_X2	1
++#define USXGMII_RATE_ADAPT_MODE_X4	2
++#define USXGMII_RATE_ADAPT_MODE_X10	3
++#define USXGMII_RATE_ADAPT_MODE_X100	4
++#define USXGMII_RATE_ADAPT_MODE_X5	5
++#define USXGMII_RATE_ADAPT_MODE_X50	6
++#define USXGMII_XFI_RX_MODE	GENMASK(6, 4)
++#define USXGMII_XFI_RX_MODE_10G	0
++#define USXGMII_XFI_RX_MODE_5G	1
++#define USXGMII_XFI_TX_MODE	GENMASK(2, 0)
++#define USXGMII_XFI_TX_MODE_10G	0
++#define USXGMII_XFI_TX_MODE_5G	1
++
++/* Register to control PCS AN */
++#define RG_PCS_AN_CTRL0		0x810
++#define USXGMII_AN_RESTART	BIT(31)
++#define USXGMII_AN_SYNC_CNT	GENMASK(30, 11)
++#define USXGMII_AN_ENABLE	BIT(0)
++
++#define RG_PCS_AN_CTRL2		0x818
++#define USXGMII_LINK_TIMER_IDLE_DETECT	GENMASK(29, 20)
++#define USXGMII_LINK_TIMER_COMP_ACK_DETECT	GENMASK(19, 10)
++#define USXGMII_LINK_TIMER_AN_RESTART	GENMASK(9, 0)
++
++/* Register to read PCS AN status */
++#define RG_PCS_AN_STS0		0x81c
++#define USXGMII_LPA_SPEED_MASK	GENMASK(11, 9)
++#define USXGMII_LPA_SPEED_10	0
++#define USXGMII_LPA_SPEED_100	1
++#define USXGMII_LPA_SPEED_1000	2
++#define USXGMII_LPA_SPEED_10000	3
++#define USXGMII_LPA_SPEED_2500	4
++#define USXGMII_LPA_SPEED_5000	5
++#define USXGMII_LPA_DUPLEX	BIT(12)
++#define USXGMII_LPA_LINK	BIT(15)
++#define USXGMII_LPA_LATCH	BIT(31)
++
++/* Register to control USXGMII XFI PLL digital */
++#define XFI_PLL_DIG_GLB8	0x08
++#define RG_XFI_PLL_EN		BIT(31)
++
++/* Register to control USXGMII XFI PLL analog */
++#define XFI_PLL_ANA_GLB8	0x108
++#define RG_XFI_PLL_ANA_SWWA	0x02283248
++
+ /* Infrasys subsystem config registers */
+ #define INFRA_MISC2            0x70c
+ #define CO_QPHY_SEL            BIT(0)
+ #define GEPHY_MAC_SEL          BIT(1)
+ 
++/* Toprgu subsystem config registers */
++#define TOPRGU_SWSYSRST		0x18
++#define SWSYSRST_UNLOCK_KEY	GENMASK(31, 24)
++#define SWSYSRST_XFI_PLL_GRST	BIT(16)
++#define SWSYSRST_XFI_PEXPT1_GRST	BIT(15)
++#define SWSYSRST_XFI_PEXPT0_GRST	BIT(14)
++#define SWSYSRST_XFI1_GRST	BIT(13)
++#define SWSYSRST_XFI0_GRST	BIT(12)
++#define SWSYSRST_SGMII1_GRST	BIT(2)
++#define SWSYSRST_SGMII0_GRST	BIT(1)
++#define TOPRGU_SWSYSRST_EN		0xFC
++
+ /* Top misc registers */
++#define TOP_MISC_NETSYS_PCS_MUX	0x84
++#define NETSYS_PCS_MUX_MASK	GENMASK(1, 0)
++#define	MUX_G2_USXGMII_SEL	BIT(1)
++#define MUX_HSGMII1_G1_SEL	BIT(0)
++
+ #define USB_PHY_SWITCH_REG	0x218
+ #define QPHY_SEL_MASK		GENMASK(1, 0)
+ #define SGMII_QPHY_SEL		0x2
+ 
++/* MDIO control */
++#define MII_MMD_ACC_CTL_REG	0x0d
++#define MII_MMD_ADDR_DATA_REG	0x0e
++#define MMD_OP_MODE_DATA	BIT(14)
++
+ /* MT7628/88 specific stuff */
+ #define MT7628_PDMA_OFFSET	0x0800
+ #define MT7628_SDM_OFFSET	0x0c00
+@@ -809,13 +926,6 @@ enum mtk_gmac_id {
+ 	MTK_GMAC_ID_MAX
+ };
+ 
+-/* GDM Type */
+-enum mtk_gdm_type {
+-	MTK_GDM_TYPE = 0,
+-	MTK_XGDM_TYPE,
+-	MTK_GDM_TYPE_MAX
+-};
+-
+ enum mtk_tx_buf_type {
+ 	MTK_TYPE_SKB,
+ 	MTK_TYPE_XDP_TX,
+@@ -902,6 +1012,7 @@ enum mkt_eth_capabilities {
+ 	MTK_TRGMII_BIT,
+ 	MTK_SGMII_BIT,
+ 	MTK_USXGMII_BIT,
++	MTK_2P5GPHY_BIT,
+ 	MTK_ESW_BIT,
+ 	MTK_GEPHY_BIT,
+ 	MTK_MUX_BIT,
+@@ -922,6 +1033,7 @@ enum mkt_eth_capabilities {
+ 	MTK_ETH_MUX_GDM1_TO_GMAC1_ESW_BIT,
+ 	MTK_ETH_MUX_GMAC2_GMAC0_TO_GEPHY_BIT,
+ 	MTK_ETH_MUX_U3_GMAC2_TO_QPHY_BIT,
++	MTK_ETH_MUX_GMAC2_TO_2P5GPHY_BIT,
+ 	MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII_BIT,
+ 	MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII_BIT,
+ 	MTK_ETH_MUX_GMAC123_TO_GEPHY_SGMII_BIT,
+@@ -933,6 +1045,7 @@ enum mkt_eth_capabilities {
+ 	MTK_ETH_PATH_GMAC1_SGMII_BIT,
+ 	MTK_ETH_PATH_GMAC2_RGMII_BIT,
+ 	MTK_ETH_PATH_GMAC2_SGMII_BIT,
++	MTK_ETH_PATH_GMAC2_2P5GPHY_BIT,
+ 	MTK_ETH_PATH_GMAC2_GEPHY_BIT,
+ 	MTK_ETH_PATH_GMAC3_SGMII_BIT,
+ 	MTK_ETH_PATH_GDM1_ESW_BIT,
+@@ -946,6 +1059,7 @@ enum mkt_eth_capabilities {
+ #define MTK_TRGMII		BIT_ULL(MTK_TRGMII_BIT)
+ #define MTK_SGMII		BIT_ULL(MTK_SGMII_BIT)
+ #define MTK_USXGMII		BIT_ULL(MTK_USXGMII_BIT)
++#define MTK_2P5GPHY		BIT_ULL(MTK_2P5GPHY_BIT)
+ #define MTK_ESW			BIT_ULL(MTK_ESW_BIT)
+ #define MTK_GEPHY		BIT_ULL(MTK_GEPHY_BIT)
+ #define MTK_MUX			BIT_ULL(MTK_MUX_BIT)
+@@ -968,6 +1082,8 @@ enum mkt_eth_capabilities {
+ 	BIT_ULL(MTK_ETH_MUX_GMAC2_GMAC0_TO_GEPHY_BIT)
+ #define MTK_ETH_MUX_U3_GMAC2_TO_QPHY		\
+ 	BIT_ULL(MTK_ETH_MUX_U3_GMAC2_TO_QPHY_BIT)
++#define MTK_ETH_MUX_GMAC2_TO_2P5GPHY		\
++	BIT_ULL(MTK_ETH_MUX_GMAC2_TO_2P5GPHY_BIT)
+ #define MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII	\
+ 	BIT_ULL(MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII_BIT)
+ #define MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII	\
+@@ -983,6 +1099,7 @@ enum mkt_eth_capabilities {
+ #define MTK_ETH_PATH_GMAC1_SGMII	BIT_ULL(MTK_ETH_PATH_GMAC1_SGMII_BIT)
+ #define MTK_ETH_PATH_GMAC2_RGMII	BIT_ULL(MTK_ETH_PATH_GMAC2_RGMII_BIT)
+ #define MTK_ETH_PATH_GMAC2_SGMII	BIT_ULL(MTK_ETH_PATH_GMAC2_SGMII_BIT)
++#define MTK_ETH_PATH_GMAC2_2P5GPHY	BIT_ULL(MTK_ETH_PATH_GMAC2_2P5GPHY_BIT)
+ #define MTK_ETH_PATH_GMAC2_GEPHY	BIT_ULL(MTK_ETH_PATH_GMAC2_GEPHY_BIT)
+ #define MTK_ETH_PATH_GMAC3_SGMII	BIT_ULL(MTK_ETH_PATH_GMAC3_SGMII_BIT)
+ #define MTK_ETH_PATH_GDM1_ESW		BIT_ULL(MTK_ETH_PATH_GDM1_ESW_BIT)
+@@ -996,6 +1113,7 @@ enum mkt_eth_capabilities {
+ #define MTK_GMAC2_RGMII		(MTK_ETH_PATH_GMAC2_RGMII | MTK_RGMII)
+ #define MTK_GMAC2_SGMII		(MTK_ETH_PATH_GMAC2_SGMII | MTK_SGMII)
+ #define MTK_GMAC2_GEPHY		(MTK_ETH_PATH_GMAC2_GEPHY | MTK_GEPHY)
++#define MTK_GMAC2_2P5GPHY	(MTK_ETH_PATH_GMAC2_2P5GPHY | MTK_2P5GPHY)
+ #define MTK_GMAC3_SGMII		(MTK_ETH_PATH_GMAC3_SGMII | MTK_SGMII)
+ #define MTK_GDM1_ESW		(MTK_ETH_PATH_GDM1_ESW | MTK_ESW)
+ #define MTK_GMAC1_USXGMII	(MTK_ETH_PATH_GMAC1_USXGMII | MTK_USXGMII)
+@@ -1019,6 +1137,10 @@ enum mkt_eth_capabilities {
+ 	(MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII | MTK_MUX | \
+ 	MTK_SHARED_SGMII)
+ 
++/* 2: GMAC2 -> XGMII */
++#define MTK_MUX_GMAC2_TO_2P5GPHY      \
++	(MTK_ETH_MUX_GMAC2_TO_2P5GPHY | MTK_MUX | MTK_INFRA)
++
+ /* 0: GMACx -> GEPHY, 1: GMACx -> SGMII where x is 1 or 2 */
+ #define MTK_MUX_GMAC12_TO_GEPHY_SGMII   \
+ 	(MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII | MTK_MUX)
+@@ -1077,7 +1199,8 @@ enum mkt_eth_capabilities {
+ 		       MTK_MUX_GMAC123_TO_GEPHY_SGMII |		\
+ 		       MTK_NETSYS_V3 | MTK_RSTCTRL_PPE1 |	\
+ 		       MTK_GMAC1_USXGMII | MTK_GMAC2_USXGMII |	\
+-		       MTK_GMAC3_USXGMII | MTK_MUX_GMAC123_TO_USXGMII)
++		       MTK_GMAC3_USXGMII | MTK_MUX_GMAC123_TO_USXGMII | \
++		       MTK_GMAC2_2P5GPHY | MTK_MUX_GMAC2_TO_2P5GPHY)
+ 
+ struct mtk_tx_dma_desc_info {
+ 	dma_addr_t	addr;
+@@ -1183,6 +1306,22 @@ struct mtk_soc_data {
+ 
+ #define MTK_DMA_MONITOR_TIMEOUT		msecs_to_jiffies(1000)
+ 
++/* struct mtk_usxgmii_pcs - This structure holds each usxgmii regmap and
++ *			associated data
++ * @regmap:		The register map pointing at the range used to setup
++ *			USXGMII modes
++ * @interface:		Currently selected interface mode
++ * @id:			The element is used to record the index of PCS
++ * @pcs:		Phylink PCS structure
++ */
++struct mtk_usxgmii_pcs {
++	struct mtk_eth		*eth;
++	struct regmap		*regmap;
++	phy_interface_t		interface;
++	u8			id;
++	struct phylink_pcs	pcs;
++};
++
+ /* struct mtk_eth -	This is the main datasructure for holding the state
+  *			of the driver
+  * @dev:		The device pointer
+@@ -1203,6 +1342,11 @@ struct mtk_soc_data {
+  * @infra:              The register map pointing at the range used to setup
+  *                      SGMII and GePHY path
+  * @sgmii_pcs:		Pointers to mtk-pcs-lynxi phylink_pcs instances
++ * @usxgmii_pll:	The register map pointing at the range used to control
++ *			the USXGMII SerDes PLL
++ * @regmap_pextp:	The register map pointing at the range used to setup
++ *			PHYA
++ * @usxgmii_pcs:	Pointer to array of pointers to struct for USXGMII PCS
+  * @pctl:		The register map pointing at the range used to setup
+  *			GMAC port drive/slew values
+  * @dma_refcnt:		track how many netdevs are using the DMA engine
+@@ -1244,7 +1388,11 @@ struct mtk_eth {
+ 	unsigned long			sysclk;
+ 	struct regmap			*ethsys;
+ 	struct regmap			*infra;
++	struct regmap			*toprgu;
+ 	struct phylink_pcs		**sgmii_pcs;
++	struct regmap			*usxgmii_pll;
++	struct regmap			**regmap_pextp;
++	struct mtk_usxgmii_pcs		**usxgmii_pcs;
+ 	struct regmap			*pctl;
+ 	bool				hwlro;
+ 	refcount_t			dma_refcnt;
+@@ -1400,6 +1548,19 @@ static inline u32 mtk_get_ib2_multicast_
+ 	return MTK_FOE_IB2_MULTICAST;
+ }
+ 
++static inline bool mtk_interface_mode_is_xgmii(phy_interface_t interface)
++{
++	switch (interface) {
++	case PHY_INTERFACE_MODE_USXGMII:
++	case PHY_INTERFACE_MODE_10GKR:
++	case PHY_INTERFACE_MODE_5GBASER:
++		return true;
++		break;
++	default:
++		return false;
++	}
++}
++
+ /* read the hardware status register */
+ void mtk_stats_update_mac(struct mtk_mac *mac);
+ 
+@@ -1407,8 +1568,10 @@ void mtk_w32(struct mtk_eth *eth, u32 va
+ u32 mtk_r32(struct mtk_eth *eth, unsigned reg);
+ 
+ int mtk_gmac_sgmii_path_setup(struct mtk_eth *eth, int mac_id);
++int mtk_gmac_2p5gphy_path_setup(struct mtk_eth *eth, int mac_id);
+ int mtk_gmac_gephy_path_setup(struct mtk_eth *eth, int mac_id);
+ int mtk_gmac_rgmii_path_setup(struct mtk_eth *eth, int mac_id);
++int mtk_gmac_usxgmii_path_setup(struct mtk_eth *eth, int mac_id);
+ 
+ int mtk_eth_offload_init(struct mtk_eth *eth);
+ int mtk_eth_setup_tc(struct net_device *dev, enum tc_setup_type type,
+@@ -1418,5 +1581,20 @@ int mtk_flow_offload_cmd(struct mtk_eth
+ void mtk_flow_offload_cleanup(struct mtk_eth *eth, struct list_head *list);
+ void mtk_eth_set_dma_device(struct mtk_eth *eth, struct device *dma_dev);
+ 
++#ifdef CONFIG_NET_MEDIATEK_SOC_USXGMII
++struct phylink_pcs *mtk_usxgmii_select_pcs(struct mtk_eth *eth, int id);
++int mtk_usxgmii_init(struct mtk_eth *eth);
++int mtk_xfi_pll_enable(struct mtk_eth *eth);
++void mtk_sgmii_setup_phya_gen1(struct mtk_eth *eth, int mac_id);
++void mtk_sgmii_setup_phya_gen2(struct mtk_eth *eth, int mac_id);
++void mtk_sgmii_reset(struct mtk_eth *eth, int mac_id);
++#else
++static inline struct phylink_pcs *mtk_usxgmii_select_pcs(struct mtk_eth *eth, int id) { return NULL; }
++static inline int mtk_usxgmii_init(struct mtk_eth *eth) { return 0; }
++static inline int mtk_xfi_pll_enable(struct mtk_eth *eth) { return 0; }
++static inline void mtk_sgmii_setup_phya_gen1(struct mtk_eth *eth, int mac_id) { }
++static inline void mtk_sgmii_setup_phya_gen2(struct mtk_eth *eth, int mac_id) { }
++static inline void mtk_sgmii_reset(struct mtk_eth *eth, int mac_id) { }
++#endif /* NET_MEDIATEK_SOC_USXGMII */
+ 
+ #endif /* MTK_ETH_H */
+--- /dev/null
++++ b/drivers/net/ethernet/mediatek/mtk_usxgmii.c
+@@ -0,0 +1,835 @@
++/* SPDX-License-Identifier: GPL-2.0
++ *
++ * Copyright (c) 2022 MediaTek Inc.
++ * Author: Henry Yen <henry.yen@mediatek.com>
++ *         Daniel Golle <daniel@makrotopia.org>
++ */
++
++#include <linux/mfd/syscon.h>
++#include <linux/of.h>
++#include <linux/regmap.h>
++#include "mtk_eth_soc.h"
++
++static struct mtk_usxgmii_pcs *pcs_to_mtk_usxgmii_pcs(struct phylink_pcs *pcs)
++{
++	return container_of(pcs, struct mtk_usxgmii_pcs, pcs);
++}
++
++static int mtk_xfi_pextp_init(struct mtk_eth *eth)
++{
++	struct device *dev = eth->dev;
++	struct device_node *r = dev->of_node;
++	struct device_node *np;
++	int i;
++
++	eth->regmap_pextp = devm_kcalloc(dev, eth->soc->num_devs, sizeof(eth->regmap_pextp), GFP_KERNEL);
++	if (!eth->regmap_pextp)
++		return -ENOMEM;
++
++	for (i = 0; i < eth->soc->num_devs; i++) {
++		np = of_parse_phandle(r, "mediatek,xfi_pextp", i);
++		if (!np)
++			break;
++
++		eth->regmap_pextp[i] = syscon_node_to_regmap(np);
++		if (IS_ERR(eth->regmap_pextp[i]))
++			return PTR_ERR(eth->regmap_pextp[i]);
++	}
++
++	return 0;
++}
++
++static int mtk_xfi_pll_init(struct mtk_eth *eth)
++{
++	struct device_node *r = eth->dev->of_node;
++	struct device_node *np;
++
++	np = of_parse_phandle(r, "mediatek,xfi_pll", 0);
++	if (!np)
++		return -1;
++
++	eth->usxgmii_pll = syscon_node_to_regmap(np);
++	if (IS_ERR(eth->usxgmii_pll))
++		return PTR_ERR(eth->usxgmii_pll);
++
++	return 0;
++}
++
++static int mtk_toprgu_init(struct mtk_eth *eth)
++{
++	struct device_node *r = eth->dev->of_node;
++	struct device_node *np;
++
++	np = of_parse_phandle(r, "mediatek,toprgu", 0);
++	if (!np)
++		return -1;
++
++	eth->toprgu = syscon_node_to_regmap(np);
++	if (IS_ERR(eth->toprgu))
++		return PTR_ERR(eth->toprgu);
++
++	return 0;
++}
++
++int mtk_xfi_pll_enable(struct mtk_eth *eth)
++{
++	u32 val = 0;
++
++	if (!eth->usxgmii_pll)
++		return -EINVAL;
++
++	/* Add software workaround for USXGMII PLL TCL issue */
++	regmap_write(eth->usxgmii_pll, XFI_PLL_ANA_GLB8, RG_XFI_PLL_ANA_SWWA);
++
++	regmap_read(eth->usxgmii_pll, XFI_PLL_DIG_GLB8, &val);
++	val |= RG_XFI_PLL_EN;
++	regmap_write(eth->usxgmii_pll, XFI_PLL_DIG_GLB8, val);
++
++	return 0;
++}
++
++static int mtk_mac2xgmii_id(struct mtk_eth *eth, int mac_id)
++{
++	int xgmii_id = mac_id;
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3)) {
++		switch (mac_id) {
++		case MTK_GMAC1_ID:
++		case MTK_GMAC2_ID:
++			xgmii_id = 1;
++			break;
++		case MTK_GMAC3_ID:
++			xgmii_id = 0;
++			break;
++		default:
++			xgmii_id = -1;
++		}
++	}
++
++	return xgmii_id;
++}
++
++static int mtk_xgmii2mac_id(struct mtk_eth *eth, int xgmii_id)
++{
++	int mac_id = xgmii_id;
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3)) {
++		switch (xgmii_id) {
++		case 0:
++			mac_id = 2;
++			break;
++		case 1:
++			mac_id = 1;
++			break;
++		default:
++			mac_id = -1;
++		}
++	}
++
++	return mac_id;
++}
++
++
++static void mtk_usxgmii_setup_phya_usxgmii(struct mtk_usxgmii_pcs *mpcs)
++{
++	struct regmap *pextp;
++
++	if (!mpcs->eth)
++		return;
++
++	pextp = mpcs->eth->regmap_pextp[mpcs->id];
++	if (!pextp)
++		return;
++
++	/* Setup operation mode */
++	regmap_write(pextp, 0x9024, 0x00C9071C);
++	regmap_write(pextp, 0x2020, 0xAA8585AA);
++	regmap_write(pextp, 0x2030, 0x0C020707);
++	regmap_write(pextp, 0x2034, 0x0E050F0F);
++	regmap_write(pextp, 0x2040, 0x00140032);
++	regmap_write(pextp, 0x50F0, 0x00C014AA);
++	regmap_write(pextp, 0x50E0, 0x3777C12B);
++	regmap_write(pextp, 0x506C, 0x005F9CFF);
++	regmap_write(pextp, 0x5070, 0x9D9DFAFA);
++	regmap_write(pextp, 0x5074, 0x27273F3F);
++	regmap_write(pextp, 0x5078, 0xA7883C68);
++	regmap_write(pextp, 0x507C, 0x11661166);
++	regmap_write(pextp, 0x5080, 0x0E000AAF);
++	regmap_write(pextp, 0x5084, 0x08080D0D);
++	regmap_write(pextp, 0x5088, 0x02030909);
++	regmap_write(pextp, 0x50E4, 0x0C0C0000);
++	regmap_write(pextp, 0x50E8, 0x04040000);
++	regmap_write(pextp, 0x50EC, 0x0F0F0C06);
++	regmap_write(pextp, 0x50A8, 0x506E8C8C);
++	regmap_write(pextp, 0x6004, 0x18190000);
++	regmap_write(pextp, 0x00F8, 0x01423342);
++	/* Force SGDT_OUT off and select PCS */
++	regmap_write(pextp, 0x00F4, 0x80201F20);
++	/* Force GLB_CKDET_OUT */
++	regmap_write(pextp, 0x0030, 0x00050C00);
++	/* Force AEQ on */
++	regmap_write(pextp, 0x0070, 0x02002800);
++	ndelay(1020);
++	/* Setup DA default value */
++	regmap_write(pextp, 0x30B0, 0x00000020);
++	regmap_write(pextp, 0x3028, 0x00008A01);
++	regmap_write(pextp, 0x302C, 0x0000A884);
++	regmap_write(pextp, 0x3024, 0x00083002);
++	regmap_write(pextp, 0x3010, 0x00022220);
++	regmap_write(pextp, 0x5064, 0x0F020A01);
++	regmap_write(pextp, 0x50B4, 0x06100600);
++	regmap_write(pextp, 0x3048, 0x40704000);
++	regmap_write(pextp, 0x3050, 0xA8000000);
++	regmap_write(pextp, 0x3054, 0x000000AA);
++	regmap_write(pextp, 0x306C, 0x00000F00);
++	regmap_write(pextp, 0xA060, 0x00040000);
++	regmap_write(pextp, 0x90D0, 0x00000001);
++	/* Release reset */
++	regmap_write(pextp, 0x0070, 0x0200E800);
++	udelay(150);
++	/* Switch to P0 */
++	regmap_write(pextp, 0x0070, 0x0200C111);
++	ndelay(1020);
++	regmap_write(pextp, 0x0070, 0x0200C101);
++	udelay(15);
++	/* Switch to Gen3 */
++	regmap_write(pextp, 0x0070, 0x0202C111);
++	ndelay(1020);
++	regmap_write(pextp, 0x0070, 0x0202C101);
++	udelay(100);
++	regmap_write(pextp, 0x30B0, 0x00000030);
++	regmap_write(pextp, 0x00F4, 0x80201F00);
++	regmap_write(pextp, 0x3040, 0x30000000);
++	udelay(400);
++}
++
++static void mtk_usxgmii_setup_phya_5gbaser(struct mtk_usxgmii_pcs *mpcs)
++{
++	struct regmap *pextp;
++
++	if (!mpcs->eth)
++		return;
++
++	pextp = mpcs->eth->regmap_pextp[mpcs->id];
++	if (!pextp)
++		return;
++
++	/* Setup operation mode */
++	regmap_write(pextp, 0x9024, 0x00D9071C);
++	regmap_write(pextp, 0x2020, 0xAAA5A5AA);
++	regmap_write(pextp, 0x2030, 0x0C020707);
++	regmap_write(pextp, 0x2034, 0x0E050F0F);
++	regmap_write(pextp, 0x2040, 0x00140032);
++	regmap_write(pextp, 0x50F0, 0x00C018AA);
++	regmap_write(pextp, 0x50E0, 0x3777812B);
++	regmap_write(pextp, 0x506C, 0x005C9CFF);
++	regmap_write(pextp, 0x5070, 0x9DFAFAFA);
++	regmap_write(pextp, 0x5074, 0x273F3F3F);
++	regmap_write(pextp, 0x5078, 0xA8883868);
++	regmap_write(pextp, 0x507C, 0x14661466);
++	regmap_write(pextp, 0x5080, 0x0E001ABF);
++	regmap_write(pextp, 0x5084, 0x080B0D0D);
++	regmap_write(pextp, 0x5088, 0x02050909);
++	regmap_write(pextp, 0x50E4, 0x0C000000);
++	regmap_write(pextp, 0x50E8, 0x04000000);
++	regmap_write(pextp, 0x50EC, 0x0F0F0C06);
++	regmap_write(pextp, 0x50A8, 0x50808C8C);
++	regmap_write(pextp, 0x6004, 0x18000000);
++	regmap_write(pextp, 0x00F8, 0x00A132A1);
++	/* Force SGDT_OUT off and select PCS */
++	regmap_write(pextp, 0x00F4, 0x80201F20);
++	/* Force GLB_CKDET_OUT */
++	regmap_write(pextp, 0x0030, 0x00050C00);
++	/* Force AEQ on */
++	regmap_write(pextp, 0x0070, 0x02002800);
++	ndelay(1020);
++	/* Setup DA default value */
++	regmap_write(pextp, 0x30B0, 0x00000020);
++	regmap_write(pextp, 0x3028, 0x00008A01);
++	regmap_write(pextp, 0x302C, 0x0000A884);
++	regmap_write(pextp, 0x3024, 0x00083002);
++	regmap_write(pextp, 0x3010, 0x00022220);
++	regmap_write(pextp, 0x5064, 0x0F020A01);
++	regmap_write(pextp, 0x50B4, 0x06100600);
++	regmap_write(pextp, 0x3048, 0x40704000);
++	regmap_write(pextp, 0x3050, 0xA8000000);
++	regmap_write(pextp, 0x3054, 0x000000AA);
++	regmap_write(pextp, 0x306C, 0x00000F00);
++	regmap_write(pextp, 0xA060, 0x00040000);
++	regmap_write(pextp, 0x90D0, 0x00000003);
++	/* Release reset */
++	regmap_write(pextp, 0x0070, 0x0200E800);
++	udelay(150);
++	/* Switch to P0 */
++	regmap_write(pextp, 0x0070, 0x0200C111);
++	ndelay(1020);
++	regmap_write(pextp, 0x0070, 0x0200C101);
++	udelay(15);
++	/* Switch to Gen3 */
++	regmap_write(pextp, 0x0070, 0x0202C111);
++	ndelay(1020);
++	regmap_write(pextp, 0x0070, 0x0202C101);
++	udelay(100);
++	regmap_write(pextp, 0x30B0, 0x00000030);
++	regmap_write(pextp, 0x00F4, 0x80201F00);
++	regmap_write(pextp, 0x3040, 0x30000000);
++	udelay(400);
++}
++
++static void mtk_usxgmii_setup_phya_10gbaser(struct mtk_usxgmii_pcs *mpcs)
++{
++	struct regmap *pextp;
++
++	if (!mpcs->eth)
++		return;
++
++	pextp = mpcs->eth->regmap_pextp[mpcs->id];
++	if (!pextp)
++		return;
++
++	/* Setup operation mode */
++	regmap_write(pextp, 0x9024, 0x00C9071C);
++	regmap_write(pextp, 0x2020, 0xAA8585AA);
++	regmap_write(pextp, 0x2030, 0x0C020707);
++	regmap_write(pextp, 0x2034, 0x0E050F0F);
++	regmap_write(pextp, 0x2040, 0x00140032);
++	regmap_write(pextp, 0x50F0, 0x00C014AA);
++	regmap_write(pextp, 0x50E0, 0x3777C12B);
++	regmap_write(pextp, 0x506C, 0x005F9CFF);
++	regmap_write(pextp, 0x5070, 0x9D9DFAFA);
++	regmap_write(pextp, 0x5074, 0x27273F3F);
++	regmap_write(pextp, 0x5078, 0xA7883C68);
++	regmap_write(pextp, 0x507C, 0x11661166);
++	regmap_write(pextp, 0x5080, 0x0E000AAF);
++	regmap_write(pextp, 0x5084, 0x08080D0D);
++	regmap_write(pextp, 0x5088, 0x02030909);
++	regmap_write(pextp, 0x50E4, 0x0C0C0000);
++	regmap_write(pextp, 0x50E8, 0x04040000);
++	regmap_write(pextp, 0x50EC, 0x0F0F0C06);
++	regmap_write(pextp, 0x50A8, 0x506E8C8C);
++	regmap_write(pextp, 0x6004, 0x18190000);
++	regmap_write(pextp, 0x00F8, 0x01423342);
++	/* Force SGDT_OUT off and select PCS */
++	regmap_write(pextp, 0x00F4, 0x80201F20);
++	/* Force GLB_CKDET_OUT */
++	regmap_write(pextp, 0x0030, 0x00050C00);
++	/* Force AEQ on */
++	regmap_write(pextp, 0x0070, 0x02002800);
++	ndelay(1020);
++	/* Setup DA default value */
++	regmap_write(pextp, 0x30B0, 0x00000020);
++	regmap_write(pextp, 0x3028, 0x00008A01);
++	regmap_write(pextp, 0x302C, 0x0000A884);
++	regmap_write(pextp, 0x3024, 0x00083002);
++	regmap_write(pextp, 0x3010, 0x00022220);
++	regmap_write(pextp, 0x5064, 0x0F020A01);
++	regmap_write(pextp, 0x50B4, 0x06100600);
++	regmap_write(pextp, 0x3048, 0x47684100);
++	regmap_write(pextp, 0x3050, 0x00000000);
++	regmap_write(pextp, 0x3054, 0x00000000);
++	regmap_write(pextp, 0x306C, 0x00000F00);
++	if (mpcs->id == 0)
++		regmap_write(pextp, 0xA008, 0x0007B400);
++
++	regmap_write(pextp, 0xA060, 0x00040000);
++	regmap_write(pextp, 0x90D0, 0x00000001);
++	/* Release reset */
++	regmap_write(pextp, 0x0070, 0x0200E800);
++	udelay(150);
++	/* Switch to P0 */
++	regmap_write(pextp, 0x0070, 0x0200C111);
++	ndelay(1020);
++	regmap_write(pextp, 0x0070, 0x0200C101);
++	udelay(15);
++	/* Switch to Gen3 */
++	regmap_write(pextp, 0x0070, 0x0202C111);
++	ndelay(1020);
++	regmap_write(pextp, 0x0070, 0x0202C101);
++	udelay(100);
++	regmap_write(pextp, 0x30B0, 0x00000030);
++	regmap_write(pextp, 0x00F4, 0x80201F00);
++	regmap_write(pextp, 0x3040, 0x30000000);
++	udelay(400);
++}
++
++void mtk_sgmii_setup_phya_gen1(struct mtk_eth *eth, int mac_id)
++{
++	u32 id = mtk_mac2xgmii_id(eth, mac_id);
++	struct regmap *pextp;
++
++	if (id >= eth->soc->num_devs)
++		return;
++
++	pextp = eth->regmap_pextp[id];
++	if (!pextp)
++		return;
++
++	/* Setup operation mode */
++	regmap_write(pextp, 0x9024, 0x00D9071C);
++	regmap_write(pextp, 0x2020, 0xAA8585AA);
++	regmap_write(pextp, 0x2030, 0x0C020207);
++	regmap_write(pextp, 0x2034, 0x0E05050F);
++	regmap_write(pextp, 0x2040, 0x00200032);
++	regmap_write(pextp, 0x50F0, 0x00C014BA);
++	regmap_write(pextp, 0x50E0, 0x3777C12B);
++	regmap_write(pextp, 0x506C, 0x005F9CFF);
++	regmap_write(pextp, 0x5070, 0x9D9DFAFA);
++	regmap_write(pextp, 0x5074, 0x27273F3F);
++	regmap_write(pextp, 0x5078, 0xA7883C68);
++	regmap_write(pextp, 0x507C, 0x11661166);
++	regmap_write(pextp, 0x5080, 0x0E000EAF);
++	regmap_write(pextp, 0x5084, 0x08080E0D);
++	regmap_write(pextp, 0x5088, 0x02030B09);
++	regmap_write(pextp, 0x50E4, 0x0C0C0000);
++	regmap_write(pextp, 0x50E8, 0x04040000);
++	regmap_write(pextp, 0x50EC, 0x0F0F0606);
++	regmap_write(pextp, 0x50A8, 0x506E8C8C);
++	regmap_write(pextp, 0x6004, 0x18190000);
++	regmap_write(pextp, 0x00F8, 0x00FA32FA);
++	/* Force SGDT_OUT off and select PCS */
++	regmap_write(pextp, 0x00F4, 0x80201F21);
++	/* Force GLB_CKDET_OUT */
++	regmap_write(pextp, 0x0030, 0x00050C00);
++	/* Force AEQ on */
++	regmap_write(pextp, 0x0070, 0x02002800);
++	ndelay(1020);
++	/* Setup DA default value */
++	regmap_write(pextp, 0x30B0, 0x00000020);
++	regmap_write(pextp, 0x3028, 0x00008A01);
++	regmap_write(pextp, 0x302C, 0x0000A884);
++	regmap_write(pextp, 0x3024, 0x00083002);
++	regmap_write(pextp, 0x3010, 0x00011110);
++	regmap_write(pextp, 0x3048, 0x40704000);
++	regmap_write(pextp, 0x3064, 0x0000C000);
++	regmap_write(pextp, 0x3050, 0xA8000000);
++	regmap_write(pextp, 0x3054, 0x000000AA);
++	regmap_write(pextp, 0x306C, 0x20200F00);
++	regmap_write(pextp, 0xA060, 0x00050000);
++	regmap_write(pextp, 0x90D0, 0x00000007);
++	/* Release reset */
++	regmap_write(pextp, 0x0070, 0x0200E800);
++	udelay(150);
++	/* Switch to P0 */
++	regmap_write(pextp, 0x0070, 0x0200C111);
++	ndelay(1020);
++	regmap_write(pextp, 0x0070, 0x0200C101);
++	udelay(15);
++	/* Switch to Gen2 */
++	regmap_write(pextp, 0x0070, 0x0201C111);
++	ndelay(1020);
++	regmap_write(pextp, 0x0070, 0x0201C101);
++	udelay(100);
++	regmap_write(pextp, 0x30B0, 0x00000030);
++	regmap_write(pextp, 0x00F4, 0x80201F01);
++	regmap_write(pextp, 0x3040, 0x30000000);
++	udelay(400);
++}
++
++void mtk_sgmii_setup_phya_gen2(struct mtk_eth *eth, int mac_id)
++{
++	u32 id = mtk_mac2xgmii_id(eth, mac_id);
++	struct regmap *pextp;
++
++	if (id >= eth->soc->num_devs)
++		return;
++
++	pextp = eth->regmap_pextp[id];
++	if (!pextp)
++		return;
++
++	/* Setup operation mode */
++	regmap_write(pextp, 0x9024, 0x00D9071C);
++	regmap_write(pextp, 0x2020, 0xAA8585AA);
++	regmap_write(pextp, 0x2030, 0x0C020707);
++	regmap_write(pextp, 0x2034, 0x0E050F0F);
++	regmap_write(pextp, 0x2040, 0x00140032);
++	regmap_write(pextp, 0x50F0, 0x00C014AA);
++	regmap_write(pextp, 0x50E0, 0x3777C12B);
++	regmap_write(pextp, 0x506C, 0x005F9CFF);
++	regmap_write(pextp, 0x5070, 0x9D9DFAFA);
++	regmap_write(pextp, 0x5074, 0x27273F3F);
++	regmap_write(pextp, 0x5078, 0xA7883C68);
++	regmap_write(pextp, 0x507C, 0x11661166);
++	regmap_write(pextp, 0x5080, 0x0E000AAF);
++	regmap_write(pextp, 0x5084, 0x08080D0D);
++	regmap_write(pextp, 0x5088, 0x02030909);
++	regmap_write(pextp, 0x50E4, 0x0C0C0000);
++	regmap_write(pextp, 0x50E8, 0x04040000);
++	regmap_write(pextp, 0x50EC, 0x0F0F0C06);
++	regmap_write(pextp, 0x50A8, 0x506E8C8C);
++	regmap_write(pextp, 0x6004, 0x18190000);
++	regmap_write(pextp, 0x00F8, 0x009C329C);
++	/* Force SGDT_OUT off and select PCS */
++	regmap_write(pextp, 0x00F4, 0x80201F21);
++	/* Force GLB_CKDET_OUT */
++	regmap_write(pextp, 0x0030, 0x00050C00);
++	/* Force AEQ on */
++	regmap_write(pextp, 0x0070, 0x02002800);
++	ndelay(1020);
++	/* Setup DA default value */
++	regmap_write(pextp, 0x30B0, 0x00000020);
++	regmap_write(pextp, 0x3028, 0x00008A01);
++	regmap_write(pextp, 0x302C, 0x0000A884);
++	regmap_write(pextp, 0x3024, 0x00083002);
++	regmap_write(pextp, 0x3010, 0x00011110);
++	regmap_write(pextp, 0x3048, 0x40704000);
++	regmap_write(pextp, 0x3050, 0xA8000000);
++	regmap_write(pextp, 0x3054, 0x000000AA);
++	regmap_write(pextp, 0x306C, 0x22000F00);
++	regmap_write(pextp, 0xA060, 0x00050000);
++	regmap_write(pextp, 0x90D0, 0x00000005);
++	/* Release reset */
++	regmap_write(pextp, 0x0070, 0x0200E800);
++	udelay(150);
++	/* Switch to P0 */
++	regmap_write(pextp, 0x0070, 0x0200C111);
++	ndelay(1020);
++	regmap_write(pextp, 0x0070, 0x0200C101);
++	udelay(15);
++	/* Switch to Gen2 */
++	regmap_write(pextp, 0x0070, 0x0201C111);
++	ndelay(1020);
++	regmap_write(pextp, 0x0070, 0x0201C101);
++	udelay(100);
++	regmap_write(pextp, 0x30B0, 0x00000030);
++	regmap_write(pextp, 0x00F4, 0x80201F01);
++	regmap_write(pextp, 0x3040, 0x30000000);
++	udelay(400);
++}
++
++static void mtk_usxgmii_reset(struct mtk_eth *eth, int id)
++{
++	u32 val = 0;
++
++	if (id >= eth->soc->num_devs || !eth->toprgu)
++		return;
++
++	switch (id) {
++	case 0:
++		/* Enable software reset */
++		regmap_read(eth->toprgu, TOPRGU_SWSYSRST_EN, &val);
++		val |= SWSYSRST_XFI_PEXPT0_GRST |
++		       SWSYSRST_XFI0_GRST;
++		regmap_write(eth->toprgu, TOPRGU_SWSYSRST_EN, val);
++
++		/* Assert USXGMII reset */
++		regmap_read(eth->toprgu, TOPRGU_SWSYSRST, &val);
++		val |= FIELD_PREP(SWSYSRST_UNLOCK_KEY, 0x88) |
++		       SWSYSRST_XFI_PEXPT0_GRST |
++		       SWSYSRST_XFI0_GRST;
++		regmap_write(eth->toprgu, TOPRGU_SWSYSRST, val);
++
++		udelay(100);
++
++		/* De-assert USXGMII reset */
++		regmap_read(eth->toprgu, TOPRGU_SWSYSRST, &val);
++		val |= FIELD_PREP(SWSYSRST_UNLOCK_KEY, 0x88);
++		val &= ~(SWSYSRST_XFI_PEXPT0_GRST |
++			 SWSYSRST_XFI0_GRST);
++		regmap_write(eth->toprgu, TOPRGU_SWSYSRST, val);
++
++		/* Disable software reset */
++		regmap_read(eth->toprgu, TOPRGU_SWSYSRST_EN, &val);
++		val &= ~(SWSYSRST_XFI_PEXPT0_GRST |
++			 SWSYSRST_XFI0_GRST);
++		regmap_write(eth->toprgu, TOPRGU_SWSYSRST_EN, val);
++		break;
++	case 1:
++		/* Enable software reset */
++		regmap_read(eth->toprgu, TOPRGU_SWSYSRST_EN, &val);
++		val |= SWSYSRST_XFI_PEXPT1_GRST |
++		       SWSYSRST_XFI1_GRST;
++		regmap_write(eth->toprgu, TOPRGU_SWSYSRST_EN, val);
++
++		/* Assert USXGMII reset */
++		regmap_read(eth->toprgu, TOPRGU_SWSYSRST, &val);
++		val |= FIELD_PREP(SWSYSRST_UNLOCK_KEY, 0x88) |
++		       SWSYSRST_XFI_PEXPT1_GRST |
++		       SWSYSRST_XFI1_GRST;
++		regmap_write(eth->toprgu, TOPRGU_SWSYSRST, val);
++
++		udelay(100);
++
++		/* De-assert USXGMII reset */
++		regmap_read(eth->toprgu, TOPRGU_SWSYSRST, &val);
++		val |= FIELD_PREP(SWSYSRST_UNLOCK_KEY, 0x88);
++		val &= ~(SWSYSRST_XFI_PEXPT1_GRST |
++			 SWSYSRST_XFI1_GRST);
++		regmap_write(eth->toprgu, TOPRGU_SWSYSRST, val);
++
++		/* Disable software reset */
++		regmap_read(eth->toprgu, TOPRGU_SWSYSRST_EN, &val);
++		val &= ~(SWSYSRST_XFI_PEXPT1_GRST |
++			 SWSYSRST_XFI1_GRST);
++		regmap_write(eth->toprgu, TOPRGU_SWSYSRST_EN, val);
++		break;
++	}
++
++	mdelay(10);
++}
++
++void mtk_sgmii_reset(struct mtk_eth *eth, int mac_id)
++{
++	u32 xgmii_id = mtk_mac2xgmii_id(eth, mac_id);
++
++	mtk_usxgmii_reset(eth, xgmii_id);
++}
++
++
++static int mtk_usxgmii_pcs_config(struct phylink_pcs *pcs, unsigned int mode,
++				  phy_interface_t interface,
++				  const unsigned long *advertising,
++				  bool permit_pause_to_mac)
++{
++	struct mtk_usxgmii_pcs *mpcs = pcs_to_mtk_usxgmii_pcs(pcs);
++	struct mtk_eth *eth = mpcs->eth;
++	unsigned int an_ctrl = 0, link_timer = 0, xfi_mode = 0, adapt_mode = 0;
++	bool mode_changed = false;
++
++	if (interface == PHY_INTERFACE_MODE_USXGMII) {
++		an_ctrl = FIELD_PREP(USXGMII_AN_SYNC_CNT, 0x1FF) |
++			  USXGMII_AN_ENABLE;
++		link_timer = FIELD_PREP(USXGMII_LINK_TIMER_IDLE_DETECT, 0x7B) |
++			     FIELD_PREP(USXGMII_LINK_TIMER_COMP_ACK_DETECT, 0x7B) |
++			     FIELD_PREP(USXGMII_LINK_TIMER_AN_RESTART, 0x7B);
++		xfi_mode = FIELD_PREP(USXGMII_XFI_RX_MODE, USXGMII_XFI_RX_MODE_10G) |
++			   FIELD_PREP(USXGMII_XFI_TX_MODE, USXGMII_XFI_TX_MODE_10G);
++	} else if (interface == PHY_INTERFACE_MODE_10GKR) {
++		an_ctrl = FIELD_PREP(USXGMII_AN_SYNC_CNT, 0x1FF);
++		link_timer = FIELD_PREP(USXGMII_LINK_TIMER_IDLE_DETECT, 0x7B) |
++			     FIELD_PREP(USXGMII_LINK_TIMER_COMP_ACK_DETECT, 0x7B) |
++			     FIELD_PREP(USXGMII_LINK_TIMER_AN_RESTART, 0x7B);
++		xfi_mode = FIELD_PREP(USXGMII_XFI_RX_MODE, USXGMII_XFI_RX_MODE_10G) |
++			   FIELD_PREP(USXGMII_XFI_TX_MODE, USXGMII_XFI_TX_MODE_10G);
++		adapt_mode = USXGMII_RATE_UPDATE_MODE;
++	} else if (interface == PHY_INTERFACE_MODE_5GBASER) {
++		an_ctrl = FIELD_PREP(USXGMII_AN_SYNC_CNT, 0xFF);
++		link_timer = FIELD_PREP(USXGMII_LINK_TIMER_IDLE_DETECT, 0x3D) |
++			     FIELD_PREP(USXGMII_LINK_TIMER_COMP_ACK_DETECT, 0x3D) |
++			     FIELD_PREP(USXGMII_LINK_TIMER_AN_RESTART, 0x3D);
++		xfi_mode = FIELD_PREP(USXGMII_XFI_RX_MODE, USXGMII_XFI_RX_MODE_5G) |
++			   FIELD_PREP(USXGMII_XFI_TX_MODE, USXGMII_XFI_TX_MODE_5G);
++		adapt_mode = USXGMII_RATE_UPDATE_MODE;
++	} else
++		return -EINVAL;
++
++	adapt_mode |= FIELD_PREP(USXGMII_RATE_ADAPT_MODE, USXGMII_RATE_ADAPT_MODE_X1);
++
++	if (mpcs->interface != interface) {
++		mpcs->interface = interface;
++		mode_changed = true;
++	}
++
++	mtk_xfi_pll_enable(eth);
++	mtk_usxgmii_reset(eth, mpcs->id);
++
++	/* Setup USXGMII AN ctrl */
++	regmap_update_bits(mpcs->regmap, RG_PCS_AN_CTRL0,
++			   USXGMII_AN_SYNC_CNT | USXGMII_AN_ENABLE,
++			   an_ctrl);
++
++	regmap_update_bits(mpcs->regmap, RG_PCS_AN_CTRL2,
++			   USXGMII_LINK_TIMER_IDLE_DETECT |
++			   USXGMII_LINK_TIMER_COMP_ACK_DETECT |
++			   USXGMII_LINK_TIMER_AN_RESTART,
++			   link_timer);
++
++	/* Gated MAC CK */
++	regmap_update_bits(mpcs->regmap, RG_PHY_TOP_SPEED_CTRL1,
++			   USXGMII_MAC_CK_GATED, USXGMII_MAC_CK_GATED);
++
++	/* Enable interface force mode */
++	regmap_update_bits(mpcs->regmap, RG_PHY_TOP_SPEED_CTRL1,
++			   USXGMII_IF_FORCE_EN, USXGMII_IF_FORCE_EN);
++
++	/* Setup USXGMII adapt mode */
++	regmap_update_bits(mpcs->regmap, RG_PHY_TOP_SPEED_CTRL1,
++			   USXGMII_RATE_UPDATE_MODE | USXGMII_RATE_ADAPT_MODE,
++			   adapt_mode);
++
++	/* Setup USXGMII speed */
++	regmap_update_bits(mpcs->regmap, RG_PHY_TOP_SPEED_CTRL1,
++			   USXGMII_XFI_RX_MODE | USXGMII_XFI_TX_MODE,
++			   xfi_mode);
++
++	udelay(1);
++
++	/* Un-gated MAC CK */
++	regmap_update_bits(mpcs->regmap, RG_PHY_TOP_SPEED_CTRL1,
++			   USXGMII_MAC_CK_GATED, 0);
++
++	udelay(1);
++
++	/* Disable interface force mode for the AN mode */
++	if (an_ctrl & USXGMII_AN_ENABLE)
++		regmap_update_bits(mpcs->regmap, RG_PHY_TOP_SPEED_CTRL1,
++				   USXGMII_IF_FORCE_EN, 0);
++
++	/* Setup USXGMIISYS with the determined property */
++	if (interface == PHY_INTERFACE_MODE_USXGMII)
++		mtk_usxgmii_setup_phya_usxgmii(mpcs);
++	else if (interface == PHY_INTERFACE_MODE_10GKR)
++		mtk_usxgmii_setup_phya_10gbaser(mpcs);
++	else if (interface == PHY_INTERFACE_MODE_5GBASER)
++		mtk_usxgmii_setup_phya_5gbaser(mpcs);
++
++	return mode_changed;
++}
++
++static void mtk_usxgmii_pcs_get_state(struct phylink_pcs *pcs,
++				    struct phylink_link_state *state)
++{
++	struct mtk_usxgmii_pcs *mpcs = pcs_to_mtk_usxgmii_pcs(pcs);
++	struct mtk_eth *eth = mpcs->eth;
++	struct mtk_mac *mac = eth->mac[mtk_xgmii2mac_id(eth, mpcs->id)];
++	u32 val = 0;
++
++	regmap_read(mpcs->regmap, RG_PCS_AN_CTRL0, &val);
++	if (FIELD_GET(USXGMII_AN_ENABLE, val)) {
++		/* Refresh LPA by inverting LPA_LATCH */
++		regmap_read(mpcs->regmap, RG_PCS_AN_STS0, &val);
++		regmap_update_bits(mpcs->regmap, RG_PCS_AN_STS0,
++				   USXGMII_LPA_LATCH,
++				   !(val & USXGMII_LPA_LATCH));
++
++		regmap_read(mpcs->regmap, RG_PCS_AN_STS0, &val);
++
++		state->interface = mpcs->interface;
++		state->link = FIELD_GET(USXGMII_LPA_LINK, val);
++		state->duplex = FIELD_GET(USXGMII_LPA_DUPLEX, val);
++
++		switch (FIELD_GET(USXGMII_LPA_SPEED_MASK, val)) {
++		case USXGMII_LPA_SPEED_10:
++			state->speed = SPEED_10;
++			break;
++		case USXGMII_LPA_SPEED_100:
++			state->speed = SPEED_100;
++			break;
++		case USXGMII_LPA_SPEED_1000:
++			state->speed = SPEED_1000;
++			break;
++		case USXGMII_LPA_SPEED_2500:
++			state->speed = SPEED_2500;
++			break;
++		case USXGMII_LPA_SPEED_5000:
++			state->speed = SPEED_5000;
++			break;
++		case USXGMII_LPA_SPEED_10000:
++			state->speed = SPEED_10000;
++			break;
++		}
++	} else {
++		val = mtk_r32(mac->hw, MTK_XGMAC_STS(mac->id));
++
++		if (mac->id == MTK_GMAC2_ID)
++			val = val >> 16;
++
++		switch (FIELD_GET(MTK_USXGMII_PCS_MODE, val)) {
++		case 0:
++			state->speed = SPEED_10000;
++			break;
++		case 1:
++			state->speed = SPEED_5000;
++			break;
++		case 2:
++			state->speed = SPEED_2500;
++			break;
++		case 3:
++			state->speed = SPEED_1000;
++			break;
++		}
++
++		state->interface = mpcs->interface;
++		state->link = FIELD_GET(MTK_USXGMII_PCS_LINK, val);
++		state->duplex = DUPLEX_FULL;
++	}
++
++	if (state->link == 0)
++		mtk_usxgmii_pcs_config(pcs, MLO_AN_INBAND,
++				       state->interface, NULL, false);
++}
++
++static void mtk_usxgmii_pcs_restart_an(struct phylink_pcs *pcs)
++{
++	struct mtk_usxgmii_pcs *mpcs = pcs_to_mtk_usxgmii_pcs(pcs);
++	unsigned int val = 0;
++
++	if (!mpcs->regmap)
++		return;
++
++	regmap_read(mpcs->regmap, RG_PCS_AN_CTRL0, &val);
++	val |= USXGMII_AN_RESTART;
++	regmap_write(mpcs->regmap, RG_PCS_AN_CTRL0, val);
++}
++
++static void mtk_usxgmii_pcs_link_up(struct phylink_pcs *pcs, unsigned int mode,
++				    phy_interface_t interface,
++				    int speed, int duplex)
++{
++	/* Reconfiguring USXGMII to ensure the quality of the RX signal
++	 * after the line side link up.
++	 */
++	mtk_usxgmii_pcs_config(pcs, mode,
++			       interface, NULL, false);
++}
++
++static const struct phylink_pcs_ops mtk_usxgmii_pcs_ops = {
++	.pcs_config = mtk_usxgmii_pcs_config,
++	.pcs_get_state = mtk_usxgmii_pcs_get_state,
++	.pcs_an_restart = mtk_usxgmii_pcs_restart_an,
++	.pcs_link_up = mtk_usxgmii_pcs_link_up,
++};
++
++int mtk_usxgmii_init(struct mtk_eth *eth)
++{
++	struct device_node *r = eth->dev->of_node;
++	struct device *dev = eth->dev;
++	struct device_node *np;
++	int i, ret;
++
++	eth->usxgmii_pcs = devm_kcalloc(dev, eth->soc->num_devs, sizeof(eth->usxgmii_pcs), GFP_KERNEL);
++	if (!eth->usxgmii_pcs)
++		return -ENOMEM;
++
++	for (i = 0; i < eth->soc->num_devs; i++) {
++		np = of_parse_phandle(r, "mediatek,usxgmiisys", i);
++		if (!np)
++			break;
++
++		eth->usxgmii_pcs[i] = devm_kzalloc(dev, sizeof(*eth->usxgmii_pcs), GFP_KERNEL);
++		if (!eth->usxgmii_pcs[i])
++			return -ENOMEM;
++
++		eth->usxgmii_pcs[i]->id = i;
++		eth->usxgmii_pcs[i]->eth = eth;
++		eth->usxgmii_pcs[i]->regmap = syscon_node_to_regmap(np);
++		if (IS_ERR(eth->usxgmii_pcs[i]->regmap))
++			return PTR_ERR(eth->usxgmii_pcs[i]->regmap);
++
++		eth->usxgmii_pcs[i]->pcs.ops = &mtk_usxgmii_pcs_ops;
++		eth->usxgmii_pcs[i]->pcs.poll = true;
++		eth->usxgmii_pcs[i]->interface = PHY_INTERFACE_MODE_NA;
++
++		of_node_put(np);
++	}
++
++	ret = mtk_xfi_pextp_init(eth);
++	if (ret)
++		return ret;
++
++	ret = mtk_xfi_pll_init(eth);
++	if (ret)
++		return ret;
++
++	return mtk_toprgu_init(eth);
++}
++
++struct phylink_pcs *mtk_usxgmii_select_pcs(struct mtk_eth *eth, int mac_id)
++{
++	u32 xgmii_id = mtk_mac2xgmii_id(eth, mac_id);
++
++	if (!eth->usxgmii_pcs[xgmii_id]->regmap)
++		return NULL;
++
++	return &eth->usxgmii_pcs[xgmii_id]->pcs;
++}
diff --git a/target/linux/generic/pending-5.15/750-skb-Do-mix-page-pool-and-page-referenced-frags-in-GR.patch b/target/linux/generic/pending-5.15/750-skb-Do-mix-page-pool-and-page-referenced-frags-in-GR.patch
new file mode 100644
index 00000000000000..6f28e19a48351a
--- /dev/null
+++ b/target/linux/generic/pending-5.15/750-skb-Do-mix-page-pool-and-page-referenced-frags-in-GR.patch
@@ -0,0 +1,35 @@
+From: Alexander Duyck <alexanderduyck@fb.com>
+Date: Thu, 26 Jan 2023 11:06:59 -0800
+Subject: [PATCH] skb: Do mix page pool and page referenced frags in GRO
+
+GSO should not merge page pool recycled frames with standard reference
+counted frames. Traditionally this didn't occur, at least not often.
+However as we start looking at adding support for wireless adapters there
+becomes the potential to mix the two due to A-MSDU repartitioning frames in
+the receive path. There are possibly other places where this may have
+occurred however I suspect they must be few and far between as we have not
+seen this issue until now.
+
+Fixes: 53e0961da1c7 ("page_pool: add frag page recycling support in page pool")
+Reported-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Alexander Duyck <alexanderduyck@fb.com>
+---
+
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -4347,6 +4347,15 @@ int skb_gro_receive(struct sk_buff *p, s
+ 	if (unlikely(p->len + len >= 65536 || NAPI_GRO_CB(skb)->flush))
+ 		return -E2BIG;
+ 
++	/* Do not splice page pool based packets w/ non-page pool
++	 * packets. This can result in reference count issues as page
++	 * pool pages will not decrement the reference count and will
++	 * instead be immediately returned to the pool or have frag
++	 * count decremented.
++	 */
++	if (p->pp_recycle != skb->pp_recycle)
++		return -ETOOMANYREFS;
++
+ 	lp = NAPI_GRO_CB(p)->last;
+ 	pinfo = skb_shinfo(lp);
+ 
diff --git a/target/linux/generic/pending-5.15/760-net-core-add-optional-threading-for-backlog-processi.patch b/target/linux/generic/pending-5.15/760-net-core-add-optional-threading-for-backlog-processi.patch
new file mode 100644
index 00000000000000..d846a05a2487bc
--- /dev/null
+++ b/target/linux/generic/pending-5.15/760-net-core-add-optional-threading-for-backlog-processi.patch
@@ -0,0 +1,232 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 16 Feb 2023 18:39:04 +0100
+Subject: [PATCH] net/core: add optional threading for backlog processing
+
+When dealing with few flows or an imbalance on CPU utilization, static RPS
+CPU assignment can be too inflexible. Add support for enabling threaded NAPI
+for backlog processing in order to allow the scheduler to better balance
+processing. This helps better spread the load across idle CPUs.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -502,6 +502,7 @@ static inline bool napi_complete(struct
+ }
+ 
+ int dev_set_threaded(struct net_device *dev, bool threaded);
++int backlog_set_threaded(bool threaded);
+ 
+ /**
+  *	napi_disable - prevent NAPI from scheduling
+@@ -3368,6 +3369,7 @@ struct softnet_data {
+ 	unsigned int		processed;
+ 	unsigned int		time_squeeze;
+ 	unsigned int		received_rps;
++	unsigned int		process_queue_empty;
+ #ifdef CONFIG_RPS
+ 	struct softnet_data	*rps_ipi_list;
+ #endif
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4578,7 +4578,7 @@ static int rps_ipi_queued(struct softnet
+ #ifdef CONFIG_RPS
+ 	struct softnet_data *mysd = this_cpu_ptr(&softnet_data);
+ 
+-	if (sd != mysd) {
++	if (sd != mysd && !test_bit(NAPI_STATE_THREADED, &sd->backlog.state)) {
+ 		sd->rps_ipi_next = mysd->rps_ipi_list;
+ 		mysd->rps_ipi_list = sd;
+ 
+@@ -5759,6 +5759,8 @@ static DEFINE_PER_CPU(struct work_struct
+ /* Network device is going away, flush any packets still pending */
+ static void flush_backlog(struct work_struct *work)
+ {
++	unsigned int process_queue_empty;
++	bool threaded, flush_processq;
+ 	struct sk_buff *skb, *tmp;
+ 	struct softnet_data *sd;
+ 
+@@ -5774,9 +5776,18 @@ static void flush_backlog(struct work_st
+ 			input_queue_head_incr(sd);
+ 		}
+ 	}
++
++	threaded = test_bit(NAPI_STATE_THREADED, &sd->backlog.state);
++	flush_processq = threaded &&
++			 !skb_queue_empty_lockless(&sd->process_queue);
++	if (flush_processq)
++		process_queue_empty = sd->process_queue_empty;
+ 	rps_unlock(sd);
+ 	local_irq_enable();
+ 
++	if (threaded)
++		goto out;
++
+ 	skb_queue_walk_safe(&sd->process_queue, skb, tmp) {
+ 		if (skb->dev->reg_state == NETREG_UNREGISTERING) {
+ 			__skb_unlink(skb, &sd->process_queue);
+@@ -5784,7 +5795,18 @@ static void flush_backlog(struct work_st
+ 			input_queue_head_incr(sd);
+ 		}
+ 	}
++
++out:
+ 	local_bh_enable();
++
++	while (flush_processq) {
++		msleep(1);
++		local_irq_disable();
++		rps_lock(sd);
++		flush_processq = process_queue_empty == sd->process_queue_empty;
++		rps_unlock(sd);
++		local_irq_enable();
++	}
+ }
+ 
+ static bool flush_required(int cpu)
+@@ -6467,6 +6489,7 @@ static int process_backlog(struct napi_s
+ 
+ 		local_irq_disable();
+ 		rps_lock(sd);
++		sd->process_queue_empty++;
+ 		if (skb_queue_empty(&sd->input_pkt_queue)) {
+ 			/*
+ 			 * Inline a custom version of __napi_complete().
+@@ -6476,7 +6499,8 @@ static int process_backlog(struct napi_s
+ 			 * We can use a plain write instead of clear_bit(),
+ 			 * and we dont need an smp_mb() memory barrier.
+ 			 */
+-			napi->state = 0;
++			napi->state &= ~(NAPIF_STATE_SCHED |
++					 NAPIF_STATE_SCHED_THREADED);
+ 			again = false;
+ 		} else {
+ 			skb_queue_splice_tail_init(&sd->input_pkt_queue,
+@@ -6893,6 +6917,57 @@ int dev_set_threaded(struct net_device *
+ }
+ EXPORT_SYMBOL(dev_set_threaded);
+ 
++int backlog_set_threaded(bool threaded)
++{
++	static bool backlog_threaded;
++	int err = 0;
++	int i;
++
++	if (backlog_threaded == threaded)
++		return 0;
++
++	for_each_possible_cpu(i) {
++		struct softnet_data *sd = &per_cpu(softnet_data, i);
++		struct napi_struct *n = &sd->backlog;
++
++		if (n->thread)
++			continue;
++		n->thread = kthread_run(napi_threaded_poll, n, "napi/backlog-%d", i);
++		if (IS_ERR(n->thread)) {
++			err = PTR_ERR(n->thread);
++			pr_err("kthread_run failed with err %d\n", err);
++			n->thread = NULL;
++			threaded = false;
++			break;
++		}
++
++	}
++
++	backlog_threaded = threaded;
++
++	/* Make sure kthread is created before THREADED bit
++	 * is set.
++	 */
++	smp_mb__before_atomic();
++
++	for_each_possible_cpu(i) {
++		struct softnet_data *sd = &per_cpu(softnet_data, i);
++		struct napi_struct *n = &sd->backlog;
++		unsigned long flags;
++
++		local_irq_save(flags);
++		rps_lock(sd);
++		if (threaded)
++			n->state |= NAPIF_STATE_THREADED;
++		else
++			n->state &= ~NAPIF_STATE_THREADED;
++		rps_unlock(sd);
++		local_irq_restore(flags);
++	}
++
++	return err;
++}
++
+ void netif_napi_add(struct net_device *dev, struct napi_struct *napi,
+ 		    int (*poll)(struct napi_struct *, int), int weight)
+ {
+@@ -11371,6 +11446,9 @@ static int dev_cpu_dead(unsigned int old
+ 	raise_softirq_irqoff(NET_TX_SOFTIRQ);
+ 	local_irq_enable();
+ 
++	if (test_bit(NAPI_STATE_THREADED, &oldsd->backlog.state))
++		return 0;
++
+ #ifdef CONFIG_RPS
+ 	remsd = oldsd->rps_ipi_list;
+ 	oldsd->rps_ipi_list = NULL;
+@@ -11710,6 +11788,7 @@ static int __init net_dev_init(void)
+ 		sd->cpu = i;
+ #endif
+ 
++		INIT_LIST_HEAD(&sd->backlog.poll_list);
+ 		init_gro_hash(&sd->backlog);
+ 		sd->backlog.poll = process_backlog;
+ 		sd->backlog.weight = weight_p;
+--- a/net/core/sysctl_net_core.c
++++ b/net/core/sysctl_net_core.c
+@@ -28,6 +28,7 @@ static int int_3600 = 3600;
+ static int min_sndbuf = SOCK_MIN_SNDBUF;
+ static int min_rcvbuf = SOCK_MIN_RCVBUF;
+ static int max_skb_frags = MAX_SKB_FRAGS;
++static int backlog_threaded;
+ static long long_one __maybe_unused = 1;
+ static long long_max __maybe_unused = LONG_MAX;
+ 
+@@ -114,6 +115,23 @@ static int rps_sock_flow_sysctl(struct c
+ }
+ #endif /* CONFIG_RPS */
+ 
++static int backlog_threaded_sysctl(struct ctl_table *table, int write,
++			       void *buffer, size_t *lenp, loff_t *ppos)
++{
++	static DEFINE_MUTEX(backlog_threaded_mutex);
++	int ret;
++
++	mutex_lock(&backlog_threaded_mutex);
++
++	ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
++	if (write && !ret)
++		ret = backlog_set_threaded(backlog_threaded);
++
++	mutex_unlock(&backlog_threaded_mutex);
++
++	return ret;
++}
++
+ #ifdef CONFIG_NET_FLOW_LIMIT
+ static DEFINE_MUTEX(flow_limit_update_mutex);
+ 
+@@ -470,6 +488,15 @@ static struct ctl_table net_core_table[]
+ 		.proc_handler	= rps_sock_flow_sysctl
+ 	},
+ #endif
++	{
++		.procname	= "backlog_threaded",
++		.data		= &backlog_threaded,
++		.maxlen		= sizeof(unsigned int),
++		.mode		= 0644,
++		.proc_handler	= backlog_threaded_sysctl,
++		.extra1		= SYSCTL_ZERO,
++		.extra2		= SYSCTL_ONE
++	},
+ #ifdef CONFIG_NET_FLOW_LIMIT
+ 	{
+ 		.procname	= "flow_limit_cpu_bitmap",
diff --git a/target/linux/generic/pending-5.15/768-net-dsa-mv88e6xxx-Request-assisted-learning-on-CPU-port.patch b/target/linux/generic/pending-5.15/768-net-dsa-mv88e6xxx-Request-assisted-learning-on-CPU-port.patch
index 8a718a02f213ec..18933de3a03d67 100644
--- a/target/linux/generic/pending-5.15/768-net-dsa-mv88e6xxx-Request-assisted-learning-on-CPU-port.patch
+++ b/target/linux/generic/pending-5.15/768-net-dsa-mv88e6xxx-Request-assisted-learning-on-CPU-port.patch
@@ -17,7 +17,7 @@ Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
-@@ -6319,6 +6319,7 @@ static int mv88e6xxx_register_switch(str
+@@ -6333,6 +6333,7 @@ static int mv88e6xxx_register_switch(str
  	ds->ops = &mv88e6xxx_switch_ops;
  	ds->ageing_time_min = chip->info->age_time_coeff;
  	ds->ageing_time_max = chip->info->age_time_coeff * U8_MAX;
diff --git a/target/linux/generic/pending-5.15/772-net-dsa-b53-add-support-for-BCM63xx-RGMIIs.patch b/target/linux/generic/pending-5.15/772-net-dsa-b53-add-support-for-BCM63xx-RGMIIs.patch
new file mode 100644
index 00000000000000..ca963d1260c538
--- /dev/null
+++ b/target/linux/generic/pending-5.15/772-net-dsa-b53-add-support-for-BCM63xx-RGMIIs.patch
@@ -0,0 +1,174 @@
+From patchwork Sun Mar 19 22:08:05 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=
+ <noltari@gmail.com>
+X-Patchwork-Id: 13180645
+X-Patchwork-Delegate: kuba@kernel.org
+Return-Path: <netdev-owner@vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id A7A46C6FD1F
+	for <netdev@archiver.kernel.org>; Sun, 19 Mar 2023 22:08:15 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S230223AbjCSWIN (ORCPT <rfc822;netdev@archiver.kernel.org>);
+        Sun, 19 Mar 2023 18:08:13 -0400
+Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32878 "EHLO
+        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S229565AbjCSWIM (ORCPT
+        <rfc822;netdev@vger.kernel.org>); Sun, 19 Mar 2023 18:08:12 -0400
+Received: from mail-wr1-x42e.google.com (mail-wr1-x42e.google.com
+ [IPv6:2a00:1450:4864:20::42e])
+        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 605D3E062;
+        Sun, 19 Mar 2023 15:08:10 -0700 (PDT)
+Received: by mail-wr1-x42e.google.com with SMTP id h17so8695188wrt.8;
+        Sun, 19 Mar 2023 15:08:10 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20210112; t=1679263689;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:from:to:cc:subject:date
+         :message-id:reply-to;
+        bh=GmPK75Q9ZD3h3IYflWYuDwS99V2e532KgDlnNucAoJg=;
+        b=PSdrywW48P4Lq8z9wOSPXFB/ZdO/JfuyiGlw3Gz1Iriy+Smo/cBnJ0Ve9zKkX3AKTO
+         Tr7/g8xhSQX8sU5WAOEPC13uVjKpO4VZsamXHTmMKL4mmfII3K/piAsQcMQkkNpgouab
+         Ci9yr+7ASSmqEUHIbYTM6sl6a47rPwqk3b3DcTIE2CwJsPPNXnpQ/aSVbJAcEdhcZICc
+         X4rAmjrYjcsl8coFIGHHPlrMH9ShekQWxB84vEb6bO1nXOORNPizOHuY1vJ3wa3WgXsx
+         YwlvutMFVIUXfgL2ZwCmQAKWJPiAaFk+CCk3oxSeOYoAzkjcbMyapz9VnooStfvR2aV3
+         k+2g==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20210112; t=1679263689;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
+         :subject:date:message-id:reply-to;
+        bh=GmPK75Q9ZD3h3IYflWYuDwS99V2e532KgDlnNucAoJg=;
+        b=NGjqrGERyaxRwINtevHaY97h9X9W+1UY62YYwotqwv5+cfvB8myjBbD3WH2WzaqMes
+         o9MMER9RE8/arW3jIVlBv4ORDUuEZ7AeGgy5UbFyQZIPHlp+hJ/sxFrGvYUwamg4Qrr9
+         ojargh8ORsEiMeqaf+5AkmEagNhrrV3ax0pUuWDzbJ3vXGoHjfCetHz5xyNL46dvXBfb
+         l/OZqjv9IYob552uUoUmCy/TbEQDqvmjkFrROFK9gtBNxgxUJkwbyiWIOVsf6RR8OarP
+         f7bbvSJYkvTvzx2u/g0Up7NW5ZyihMGBmDs377M3yW6AnSxW6jlfl30QmMU1aEigYXvy
+         v3mA==
+X-Gm-Message-State: AO0yUKUm1PYmYa4xlHuVD23mZcZm83a+xbhcbs0Xryi3yF/+UnjM4Cho
+        GAfqSh5MZ/rlOAm3Vnpn//9hOG5Lc8vLYg==
+X-Google-Smtp-Source: 
+ AK7set+5pTahGGgk1hF/mHGkGBhsMf0//oQjZd4QFHx+HaeSgP5f6q7g0bRUcTX8kRtgHH0T7l1/hQ==
+X-Received: by 2002:a5d:474f:0:b0:2d6:2ae8:70d with SMTP id
+ o15-20020a5d474f000000b002d62ae8070dmr2382593wrs.39.1679263688549;
+        Sun, 19 Mar 2023 15:08:08 -0700 (PDT)
+Received: from atlantis.lan (255.red-79-146-124.dynamicip.rima-tde.net.
+ [79.146.124.255])
+        by smtp.gmail.com with ESMTPSA id
+ d6-20020a5d6dc6000000b002c53f6c7599sm7354727wrz.29.2023.03.19.15.08.07
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Sun, 19 Mar 2023 15:08:07 -0700 (PDT)
+From: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+To: f.fainelli@gmail.com, jonas.gorski@gmail.com, andrew@lunn.ch,
+        olteanv@gmail.com, davem@davemloft.net, edumazet@google.com,
+        kuba@kernel.org, pabeni@redhat.com, netdev@vger.kernel.org,
+        linux-kernel@vger.kernel.org
+Cc: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+Subject: [PATCH v2] net: dsa: b53: add support for BCM63xx RGMIIs
+Date: Sun, 19 Mar 2023 23:08:05 +0100
+Message-Id: <20230319220805.124024-1-noltari@gmail.com>
+X-Mailer: git-send-email 2.30.2
+In-Reply-To: <20230319183330.761251-1-noltari@gmail.com>
+References: <20230319183330.761251-1-noltari@gmail.com>
+MIME-Version: 1.0
+Precedence: bulk
+List-ID: <netdev.vger.kernel.org>
+X-Mailing-List: netdev@vger.kernel.org
+X-Patchwork-Delegate: kuba@kernel.org
+
+BCM63xx RGMII ports require additional configuration in order to work.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+---
+ v2: add changes suggested by Andrew:
+  - Use a switch statement.
+  - Use dev_dbg() instead of dev_info().
+
+ drivers/net/dsa/b53/b53_common.c | 46 ++++++++++++++++++++++++++++++++
+ drivers/net/dsa/b53/b53_priv.h   |  1 +
+ 2 files changed, 47 insertions(+)
+
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -1209,6 +1209,46 @@ static void b53_force_port_config(struct
+ 	b53_write8(dev, B53_CTRL_PAGE, off, reg);
+ }
+ 
++static void b53_adjust_63xx_rgmii(struct dsa_switch *ds, int port,
++				  phy_interface_t interface)
++{
++	struct b53_device *dev = ds->priv;
++	u8 rgmii_ctrl = 0, off;
++
++	if (port == dev->imp_port)
++		off = B53_RGMII_CTRL_IMP;
++	else
++		off = B53_RGMII_CTRL_P(port);
++
++	b53_read8(dev, B53_CTRL_PAGE, off, &rgmii_ctrl);
++
++	switch (interface) {
++	case PHY_INTERFACE_MODE_RGMII_ID:
++		rgmii_ctrl |= (RGMII_CTRL_DLL_RXC | RGMII_CTRL_DLL_TXC);
++		break;
++	case PHY_INTERFACE_MODE_RGMII_RXID:
++		rgmii_ctrl &= ~(RGMII_CTRL_DLL_TXC);
++		rgmii_ctrl |= RGMII_CTRL_DLL_RXC;
++		break;
++	case PHY_INTERFACE_MODE_RGMII_TXID:
++		rgmii_ctrl &= ~(RGMII_CTRL_DLL_RXC);
++		rgmii_ctrl |= RGMII_CTRL_DLL_TXC;
++		break;
++	case PHY_INTERFACE_MODE_RGMII:
++	default:
++		rgmii_ctrl &= ~(RGMII_CTRL_DLL_RXC | RGMII_CTRL_DLL_TXC);
++		break;
++	}
++
++	if (port != dev->imp_port)
++		rgmii_ctrl |= RGMII_CTRL_ENABLE_GMII;
++
++	b53_write8(dev, B53_CTRL_PAGE, off, rgmii_ctrl);
++
++	dev_dbg(ds->dev, "Configured port %d for %s\n", port,
++		phy_modes(interface));
++}
++
+ static void b53_adjust_link(struct dsa_switch *ds, int port,
+ 			    struct phy_device *phydev)
+ {
+@@ -1235,6 +1275,9 @@ static void b53_adjust_link(struct dsa_s
+ 			      tx_pause, rx_pause);
+ 	b53_force_link(dev, port, phydev->link);
+ 
++	if (is63xx(dev) && port >= B53_63XX_RGMII0)
++		b53_adjust_63xx_rgmii(ds, port, phydev->interface);
++
+ 	if (is531x5(dev) && phy_interface_is_rgmii(phydev)) {
+ 		if (port == dev->imp_port)
+ 			off = B53_RGMII_CTRL_IMP;
+@@ -1419,6 +1462,9 @@ void b53_phylink_mac_link_up(struct dsa_
+ {
+ 	struct b53_device *dev = ds->priv;
+ 
++	if (is63xx(dev) && port >= B53_63XX_RGMII0)
++		b53_adjust_63xx_rgmii(ds, port, interface);
++
+ 	if (mode == MLO_AN_PHY)
+ 		return;
+ 
+--- a/drivers/net/dsa/b53/b53_priv.h
++++ b/drivers/net/dsa/b53/b53_priv.h
+@@ -206,6 +206,7 @@ static inline int is58xx(struct b53_devi
+ 		dev->chip_id == BCM7278_DEVICE_ID;
+ }
+ 
++#define B53_63XX_RGMII0	4
+ #define B53_CPU_PORT_25	5
+ #define B53_CPU_PORT	8
+ 
diff --git a/target/linux/generic/pending-5.15/773-net-dsa-b53-mmap-add-more-63xx-SoCs.patch b/target/linux/generic/pending-5.15/773-net-dsa-b53-mmap-add-more-63xx-SoCs.patch
new file mode 100644
index 00000000000000..e2da4e7f0552a6
--- /dev/null
+++ b/target/linux/generic/pending-5.15/773-net-dsa-b53-mmap-add-more-63xx-SoCs.patch
@@ -0,0 +1,108 @@
+From patchwork Tue Mar 21 17:33:57 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=
+ <noltari@gmail.com>
+X-Patchwork-Id: 13183003
+X-Patchwork-Delegate: kuba@kernel.org
+Return-Path: <netdev-owner@vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id 823A1C761AF
+	for <netdev@archiver.kernel.org>; Tue, 21 Mar 2023 17:35:06 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S230490AbjCURfE (ORCPT <rfc822;netdev@archiver.kernel.org>);
+        Tue, 21 Mar 2023 13:35:04 -0400
+Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47440 "EHLO
+        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S230357AbjCURex (ORCPT
+        <rfc822;netdev@vger.kernel.org>); Tue, 21 Mar 2023 13:34:53 -0400
+Received: from mail-wr1-x430.google.com (mail-wr1-x430.google.com
+ [IPv6:2a00:1450:4864:20::430])
+        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C9A45559D8;
+        Tue, 21 Mar 2023 10:34:26 -0700 (PDT)
+Received: by mail-wr1-x430.google.com with SMTP id m2so14547588wrh.6;
+        Tue, 21 Mar 2023 10:34:26 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20210112; t=1679420063;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:from:to:cc:subject:date
+         :message-id:reply-to;
+        bh=cUvnluVaZPzfEQB9fMRuYo+4/361t/7po7nyUBBJfxc=;
+        b=F0pa8JmQZ1FeXVtdpCygur8UmLrgKwxCcjaMn312u5zNvsXsEPeCAIDqP2tvNNTwv/
+         UYjaNaoZ77HSvv/gSqeG808AXGyNs1PvLuHZYuUTJRNuLaMixKtkNFi4ypheCdk0WCiE
+         IWz0DIm6ojmdwMqafDUKQ6Qwkv5R0vo8Wh5vpjimEmCelOyMvfuLZNqubsiGqpnCguBp
+         uWlmKh95/VubCGgiGG2xK1IXQayL14ENuWseDds7nVpVK50NycrFgJbL17Bd6qJKYkbo
+         m70IC+9jM0hjwKXpyi6ipCBNcW+1E6JIwILVC04Xi+BTpOGhbUAQ59Yn2hyq7tQM7dzs
+         4PLg==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20210112; t=1679420063;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
+         :subject:date:message-id:reply-to;
+        bh=cUvnluVaZPzfEQB9fMRuYo+4/361t/7po7nyUBBJfxc=;
+        b=SCX78yTuGjdnE5nuL0p7+kxGnOzsCExsigLdaV+x/JswmwxSpZvxn223i1yM95klj9
+         Rk0RnXqATLF1wZA7L1YmbeZ66zxUwW/osnCjJHPeEF8AGgjK/qawtLl/HJQHN67NaRNQ
+         bDsRn2nWQ2GRTRFpvD+iGRy4uyQCDu9HFxLbn43fBsBmRnXWGPQP5cEb90tL83/Onp4D
+         Lx/XcyZOh9QRfJNhj+G1BAeRCLRA/sdA0W3Ecu5SCFs+LtS6uvLVGWDKEDfnZhYY8Xqf
+         Mx9evWzdW2OorEN2FI6+xTglvnEBcVhHIJ7XEGAhCG6ocgMZeck++774S8RWumWl8xpy
+         /K9Q==
+X-Gm-Message-State: AO0yUKUORAlGfbkNwnYmQnTWcGPqW6sp4g9WfgQmRZGCV+9tCB0OebSP
+        ICq6v4YPmUPNRl/WNnVCbps=
+X-Google-Smtp-Source: 
+ AK7set8pFDl8fHRwGPhAguqxIfqnQ4PY+b57IHEsybIaQ/HPNwdJ1cs1+IPBGHe3TL14dTS4aVNpHA==
+X-Received: by 2002:a5d:6991:0:b0:2ce:aab5:f96b with SMTP id
+ g17-20020a5d6991000000b002ceaab5f96bmr2965175wru.67.1679420062764;
+        Tue, 21 Mar 2023 10:34:22 -0700 (PDT)
+Received: from atlantis.lan (255.red-79-146-124.dynamicip.rima-tde.net.
+ [79.146.124.255])
+        by smtp.gmail.com with ESMTPSA id
+ b13-20020a056000054d00b002da1261aa44sm184775wrf.48.2023.03.21.10.34.21
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Tue, 21 Mar 2023 10:34:21 -0700 (PDT)
+From: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+To: f.fainelli@gmail.com, jonas.gorski@gmail.com, andrew@lunn.ch,
+        olteanv@gmail.com, davem@davemloft.net, edumazet@google.com,
+        kuba@kernel.org, pabeni@redhat.com, robh+dt@kernel.org,
+        krzysztof.kozlowski+dt@linaro.org, netdev@vger.kernel.org,
+        devicetree@vger.kernel.org, linux-kernel@vger.kernel.org
+Cc: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+Subject: [PATCH v2 2/4] net: dsa: b53: mmap: add more 63xx SoCs
+Date: Tue, 21 Mar 2023 18:33:57 +0100
+Message-Id: <20230321173359.251778-3-noltari@gmail.com>
+X-Mailer: git-send-email 2.30.2
+In-Reply-To: <20230321173359.251778-1-noltari@gmail.com>
+References: <20230320155024.164523-1-noltari@gmail.com>
+ <20230321173359.251778-1-noltari@gmail.com>
+MIME-Version: 1.0
+Precedence: bulk
+List-ID: <netdev.vger.kernel.org>
+X-Mailing-List: netdev@vger.kernel.org
+X-Patchwork-Delegate: kuba@kernel.org
+
+BCM6318, BCM6362 and BCM63268 are SoCs with a B53 MMAP switch.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ v2: no changes.
+
+ drivers/net/dsa/b53/b53_mmap.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/dsa/b53/b53_mmap.c
++++ b/drivers/net/dsa/b53/b53_mmap.c
+@@ -347,8 +347,11 @@ static void b53_mmap_shutdown(struct pla
+ 
+ static const struct of_device_id b53_mmap_of_table[] = {
+ 	{ .compatible = "brcm,bcm3384-switch" },
++	{ .compatible = "brcm,bcm6318-switch" },
+ 	{ .compatible = "brcm,bcm6328-switch" },
++	{ .compatible = "brcm,bcm6362-switch" },
+ 	{ .compatible = "brcm,bcm6368-switch" },
++	{ .compatible = "brcm,bcm63268-switch" },
+ 	{ .compatible = "brcm,bcm63xx-switch" },
+ 	{ /* sentinel */ },
+ };
diff --git a/target/linux/generic/pending-5.15/774-net-dsa-b53-mmap-allow-passing-a-chip-ID.patch b/target/linux/generic/pending-5.15/774-net-dsa-b53-mmap-allow-passing-a-chip-ID.patch
new file mode 100644
index 00000000000000..456643f05d6d31
--- /dev/null
+++ b/target/linux/generic/pending-5.15/774-net-dsa-b53-mmap-allow-passing-a-chip-ID.patch
@@ -0,0 +1,195 @@
+From patchwork Tue Mar 21 17:33:58 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=
+ <noltari@gmail.com>
+X-Patchwork-Id: 13183004
+X-Patchwork-Delegate: kuba@kernel.org
+Return-Path: <netdev-owner@vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id B2B12C74A5B
+	for <netdev@archiver.kernel.org>; Tue, 21 Mar 2023 17:35:12 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S230297AbjCURfK (ORCPT <rfc822;netdev@archiver.kernel.org>);
+        Tue, 21 Mar 2023 13:35:10 -0400
+Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47438 "EHLO
+        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S230374AbjCURex (ORCPT
+        <rfc822;netdev@vger.kernel.org>); Tue, 21 Mar 2023 13:34:53 -0400
+Received: from mail-wr1-x432.google.com (mail-wr1-x432.google.com
+ [IPv6:2a00:1450:4864:20::432])
+        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C906B5550A;
+        Tue, 21 Mar 2023 10:34:26 -0700 (PDT)
+Received: by mail-wr1-x432.google.com with SMTP id y14so14546846wrq.4;
+        Tue, 21 Mar 2023 10:34:26 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20210112; t=1679420064;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:from:to:cc:subject:date
+         :message-id:reply-to;
+        bh=vnvnwWc5Tmg09HBQo/m9RbRM6yM8KLx8r1VA+Abfg3k=;
+        b=eFv+mwe94Y2YZMiJP5gydXVrGlbIAR5HCrY0rdcoGoMPzQUHLFckZeYCgEKudI55I7
+         gMLZYCtLwvDXvKeHM2AUigsq2YuJSeF5QwICPrhTnMwUGBg4yyyltrc3+J0lSd6/4kQv
+         h0yM1Oo4v0d8CuqjBU6bXienIk34AFVJfsPq+vWQTjAbUL7ht4WHZ2Ez2MFoTvZpkIJA
+         5iWMyVoMbugZl6eqNRjvDHFmtBtrZIv8AFs10r2Ca6+Yxm+aq0v33DRkbSVVqgFPNEzy
+         q5QOXOeLBPL6BvyovOpmVSWGoHf1zFV7lrzcqi+uc+FuYxQ9dyN3ND73DrrhWSkLaSg9
+         r8yA==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20210112; t=1679420064;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
+         :subject:date:message-id:reply-to;
+        bh=vnvnwWc5Tmg09HBQo/m9RbRM6yM8KLx8r1VA+Abfg3k=;
+        b=jIRB8pIlrLA/ovhnEoePs/6SX8fn6l7l4fY2CxX2pLrTbP1JI8AAetPavvrNVQTr2M
+         Vm0iLbKyL/VpTq9+bSN1SMjaoi4lAMj0pgafoHrwABMVZpFauYvtCfSYTstZ2pw4Dr1j
+         wYQGj3BUSpFIYHtSIDMkb5449WA3T3TONhaQLRFAUCBD6gAFyEky5fY+DIHrGaj352B6
+         9ST/tkqHgPpuFlmromr42KQWoTFU+Pj0Uhyp7ru4BsnF7tTshWroZZIHUJmSACudEadr
+         fBPiuurX9jgp9zNqj8Oy0HjiVUnULFCapj8yICGp5s44uDAK/XFqFXpOuJ8ptS6uPazU
+         xUwg==
+X-Gm-Message-State: AO0yUKX2w6QZfaGDHtlZAlY/U8F8VuJa3HwlgXbxgGChgdgvIoFThawv
+        oDyFAhWbVfe4DxwXTwxgJ/I=
+X-Google-Smtp-Source: 
+ AK7set+sH60XiJYup7bqrZTzFJVNe1YGcX/UTfjWV9xfGwNyodc34cHvKpqNagw5J+vEpv6CKvNHaA==
+X-Received: by 2002:adf:f344:0:b0:2cd:de25:1c76 with SMTP id
+ e4-20020adff344000000b002cdde251c76mr12989754wrp.17.1679420064464;
+        Tue, 21 Mar 2023 10:34:24 -0700 (PDT)
+Received: from atlantis.lan (255.red-79-146-124.dynamicip.rima-tde.net.
+ [79.146.124.255])
+        by smtp.gmail.com with ESMTPSA id
+ b13-20020a056000054d00b002da1261aa44sm184775wrf.48.2023.03.21.10.34.22
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Tue, 21 Mar 2023 10:34:23 -0700 (PDT)
+From: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+To: f.fainelli@gmail.com, jonas.gorski@gmail.com, andrew@lunn.ch,
+        olteanv@gmail.com, davem@davemloft.net, edumazet@google.com,
+        kuba@kernel.org, pabeni@redhat.com, robh+dt@kernel.org,
+        krzysztof.kozlowski+dt@linaro.org, netdev@vger.kernel.org,
+        devicetree@vger.kernel.org, linux-kernel@vger.kernel.org
+Cc: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+Subject: [PATCH v2 3/4] net: dsa: b53: mmap: allow passing a chip ID
+Date: Tue, 21 Mar 2023 18:33:58 +0100
+Message-Id: <20230321173359.251778-4-noltari@gmail.com>
+X-Mailer: git-send-email 2.30.2
+In-Reply-To: <20230321173359.251778-1-noltari@gmail.com>
+References: <20230320155024.164523-1-noltari@gmail.com>
+ <20230321173359.251778-1-noltari@gmail.com>
+MIME-Version: 1.0
+Precedence: bulk
+List-ID: <netdev.vger.kernel.org>
+X-Mailing-List: netdev@vger.kernel.org
+X-Patchwork-Delegate: kuba@kernel.org
+
+BCM6318 and BCM63268 SoCs require a special handling for their RGMIIs, so we
+should be able to identify them as a special BCM63xx switch.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ v2:
+  - Add missing chip to b53_switch_chips[].
+  - Fix device_get_match_data() casting warning.
+  - Add BCM63268_DEVICE_ID to BCM6318 too.
+  - Add BCM6318 in commit description.
+
+ drivers/net/dsa/b53/b53_common.c | 13 +++++++++++++
+ drivers/net/dsa/b53/b53_mmap.c   | 32 +++++++++++++++++++++++---------
+ drivers/net/dsa/b53/b53_priv.h   |  9 ++++++++-
+ 3 files changed, 44 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -2461,6 +2461,19 @@ static const struct b53_chip_data b53_sw
+ 		.jumbo_size_reg = B53_JUMBO_MAX_SIZE_63XX,
+ 	},
+ 	{
++		.chip_id = BCM63268_DEVICE_ID,
++		.dev_name = "BCM63268",
++		.vlans = 4096,
++		.enabled_ports = 0, /* pdata must provide them */
++		.arl_bins = 4,
++		.arl_buckets = 1024,
++		.imp_port = 8,
++		.vta_regs = B53_VTA_REGS_63XX,
++		.duplex_reg = B53_DUPLEX_STAT_63XX,
++		.jumbo_pm_reg = B53_JUMBO_PORT_MASK_63XX,
++		.jumbo_size_reg = B53_JUMBO_MAX_SIZE_63XX,
++	},
++	{
+ 		.chip_id = BCM53010_DEVICE_ID,
+ 		.dev_name = "BCM53010",
+ 		.vlans = 4096,
+--- a/drivers/net/dsa/b53/b53_mmap.c
++++ b/drivers/net/dsa/b53/b53_mmap.c
+@@ -262,7 +262,7 @@ static int b53_mmap_probe_of(struct plat
+ 		return -ENOMEM;
+ 
+ 	pdata->regs = mem;
+-	pdata->chip_id = BCM63XX_DEVICE_ID;
++	pdata->chip_id = (u32)(unsigned long)device_get_match_data(dev);
+ 	pdata->big_endian = of_property_read_bool(np, "big-endian");
+ 
+ 	of_ports = of_get_child_by_name(np, "ports");
+@@ -346,14 +346,28 @@ static void b53_mmap_shutdown(struct pla
+ }
+ 
+ static const struct of_device_id b53_mmap_of_table[] = {
+-	{ .compatible = "brcm,bcm3384-switch" },
+-	{ .compatible = "brcm,bcm6318-switch" },
+-	{ .compatible = "brcm,bcm6328-switch" },
+-	{ .compatible = "brcm,bcm6362-switch" },
+-	{ .compatible = "brcm,bcm6368-switch" },
+-	{ .compatible = "brcm,bcm63268-switch" },
+-	{ .compatible = "brcm,bcm63xx-switch" },
+-	{ /* sentinel */ },
++	{
++		.compatible = "brcm,bcm3384-switch",
++		.data = (void *)BCM63XX_DEVICE_ID,
++	}, {
++		.compatible = "brcm,bcm6318-switch",
++		.data = (void *)BCM63268_DEVICE_ID,
++	}, {
++		.compatible = "brcm,bcm6328-switch",
++		.data = (void *)BCM63XX_DEVICE_ID,
++	}, {
++		.compatible = "brcm,bcm6362-switch",
++		.data = (void *)BCM63XX_DEVICE_ID,
++	}, {
++		.compatible = "brcm,bcm6368-switch",
++		.data = (void *)BCM63XX_DEVICE_ID,
++	}, {
++		.compatible = "brcm,bcm63268-switch",
++		.data = (void *)BCM63268_DEVICE_ID,
++	}, {
++		.compatible = "brcm,bcm63xx-switch",
++		.data = (void *)BCM63XX_DEVICE_ID,
++	}, { /* sentinel */ }
+ };
+ MODULE_DEVICE_TABLE(of, b53_mmap_of_table);
+ 
+--- a/drivers/net/dsa/b53/b53_priv.h
++++ b/drivers/net/dsa/b53/b53_priv.h
+@@ -75,6 +75,7 @@ enum {
+ 	BCM53125_DEVICE_ID = 0x53125,
+ 	BCM53128_DEVICE_ID = 0x53128,
+ 	BCM63XX_DEVICE_ID = 0x6300,
++	BCM63268_DEVICE_ID = 0x63268,
+ 	BCM53010_DEVICE_ID = 0x53010,
+ 	BCM53011_DEVICE_ID = 0x53011,
+ 	BCM53012_DEVICE_ID = 0x53012,
+@@ -186,7 +187,13 @@ static inline int is531x5(struct b53_dev
+ 
+ static inline int is63xx(struct b53_device *dev)
+ {
+-	return dev->chip_id == BCM63XX_DEVICE_ID;
++	return dev->chip_id == BCM63XX_DEVICE_ID ||
++		dev->chip_id == BCM63268_DEVICE_ID;
++}
++
++static inline int is63268(struct b53_device *dev)
++{
++	return dev->chip_id == BCM63268_DEVICE_ID;
+ }
+ 
+ static inline int is5301x(struct b53_device *dev)
diff --git a/target/linux/generic/pending-5.15/775-net-dsa-b53-add-BCM63268-RGMII-configuration.patch b/target/linux/generic/pending-5.15/775-net-dsa-b53-add-BCM63268-RGMII-configuration.patch
new file mode 100644
index 00000000000000..d90d757fb2c2ae
--- /dev/null
+++ b/target/linux/generic/pending-5.15/775-net-dsa-b53-add-BCM63268-RGMII-configuration.patch
@@ -0,0 +1,123 @@
+From patchwork Tue Mar 21 17:33:59 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=
+ <noltari@gmail.com>
+X-Patchwork-Id: 13183005
+X-Patchwork-Delegate: kuba@kernel.org
+Return-Path: <netdev-owner@vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id 31BE4C761A6
+	for <netdev@archiver.kernel.org>; Tue, 21 Mar 2023 17:35:16 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S229674AbjCURfN (ORCPT <rfc822;netdev@archiver.kernel.org>);
+        Tue, 21 Mar 2023 13:35:13 -0400
+Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47684 "EHLO
+        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S230327AbjCURfB (ORCPT
+        <rfc822;netdev@vger.kernel.org>); Tue, 21 Mar 2023 13:35:01 -0400
+Received: from mail-wr1-x436.google.com (mail-wr1-x436.google.com
+ [IPv6:2a00:1450:4864:20::436])
+        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E1D855507D;
+        Tue, 21 Mar 2023 10:34:27 -0700 (PDT)
+Received: by mail-wr1-x436.google.com with SMTP id i9so14537769wrp.3;
+        Tue, 21 Mar 2023 10:34:27 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20210112; t=1679420066;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:from:to:cc:subject:date
+         :message-id:reply-to;
+        bh=asmFs22xWYwR1Ql9m/IrNv+MPUNDn8hSjmwDRYvO7mE=;
+        b=Cqj2C6aG5vEOlhh9N3ybvDA0CV38nhQODnfdnr7utNddd323iDagoJty1Wmi3MAzj1
+         5ORmYT5fQvUnild7C4RhcCNTBn+MoYZ+wDZwZYelu6BKHkW11YFK949ax5B50by+ASR2
+         z+rGI3wR5fVXd4VDgmcsT6zF5x69wKyhbhqIfrhG9BVFTctfaBgDS/l+bX1C56kSqv82
+         bQkKSSAehSLGpFoCU3q62OGoZVi3jDe6HDb5M1Dp2mgHhqsW19otZpJ57DjtZ1CmtPai
+         o7T/ew6WoIYSl6whBmV36jeNaDJ3TItOBrKc4nMJBDWaCg4DNzUSe0ei5Xz7Oik5lb3p
+         y9ew==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20210112; t=1679420066;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
+         :subject:date:message-id:reply-to;
+        bh=asmFs22xWYwR1Ql9m/IrNv+MPUNDn8hSjmwDRYvO7mE=;
+        b=UdI2iQNBYwRf40ivf3ROR132t95BU/p3RUzXdZLCyz6c6JWtECQ5byyGeEwoX10n5u
+         HlepoNTJxMFLYrAHGvNLDPpWPuLXMa645S1mCVZ7NyWp8W96XzSynNZPeXHuJdb464QU
+         A7UTRSW3mlvKe9OR3EcB2CfBZv0yHWR0ldbnxcxGUFw8z78PNqpOVnITtjBdfpGesJ9c
+         VJw+fiM6hCcahor4nk9LLcAryPm8xmhDLxBKaLILO8wyTUiHY8G9hsXnFCtcpetnF5wS
+         pW13beAE+odb7ZZaXZUYpWGYhCe/hLzNjbo8YpgzHwadZthxPrT5YvNIYwyrvoViLM0n
+         KDRQ==
+X-Gm-Message-State: AO0yUKW+9H/kqcAUyWeZhZJhiJjsBcYn1THmZaSDrPrk/pNuGXJXGtJd
+        NgsGZW8iSqLEv81yK+U5Os8=
+X-Google-Smtp-Source: 
+ AK7set/lzQZwCSxVaOe5dZ+7TR3xaQty/vg5xvZDpRW8TwTiPQblIbw5kJJTPLp67RySehrPIlCqSg==
+X-Received: by 2002:a5d:65c9:0:b0:2ce:ac31:54ff with SMTP id
+ e9-20020a5d65c9000000b002ceac3154ffmr2776515wrw.2.1679420066191;
+        Tue, 21 Mar 2023 10:34:26 -0700 (PDT)
+Received: from atlantis.lan (255.red-79-146-124.dynamicip.rima-tde.net.
+ [79.146.124.255])
+        by smtp.gmail.com with ESMTPSA id
+ b13-20020a056000054d00b002da1261aa44sm184775wrf.48.2023.03.21.10.34.24
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Tue, 21 Mar 2023 10:34:25 -0700 (PDT)
+From: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+To: f.fainelli@gmail.com, jonas.gorski@gmail.com, andrew@lunn.ch,
+        olteanv@gmail.com, davem@davemloft.net, edumazet@google.com,
+        kuba@kernel.org, pabeni@redhat.com, robh+dt@kernel.org,
+        krzysztof.kozlowski+dt@linaro.org, netdev@vger.kernel.org,
+        devicetree@vger.kernel.org, linux-kernel@vger.kernel.org
+Cc: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>,
+ Simon Horman <simon.horman@corigine.com>
+Subject: [PATCH v2 4/4] net: dsa: b53: add BCM63268 RGMII configuration
+Date: Tue, 21 Mar 2023 18:33:59 +0100
+Message-Id: <20230321173359.251778-5-noltari@gmail.com>
+X-Mailer: git-send-email 2.30.2
+In-Reply-To: <20230321173359.251778-1-noltari@gmail.com>
+References: <20230320155024.164523-1-noltari@gmail.com>
+ <20230321173359.251778-1-noltari@gmail.com>
+MIME-Version: 1.0
+Precedence: bulk
+List-ID: <netdev.vger.kernel.org>
+X-Mailing-List: netdev@vger.kernel.org
+X-Patchwork-Delegate: kuba@kernel.org
+
+BCM63268 requires special RGMII configuration to work.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+---
+ v2: no changes.
+
+ drivers/net/dsa/b53/b53_common.c | 6 +++++-
+ drivers/net/dsa/b53/b53_regs.h   | 1 +
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -1240,8 +1240,12 @@ static void b53_adjust_63xx_rgmii(struct
+ 		break;
+ 	}
+ 
+-	if (port != dev->imp_port)
++	if (port != dev->imp_port) {
++		if (is63268(dev))
++			rgmii_ctrl |= RGMII_CTRL_MII_OVERRIDE;
++
+ 		rgmii_ctrl |= RGMII_CTRL_ENABLE_GMII;
++	}
+ 
+ 	b53_write8(dev, B53_CTRL_PAGE, off, rgmii_ctrl);
+ 
+--- a/drivers/net/dsa/b53/b53_regs.h
++++ b/drivers/net/dsa/b53/b53_regs.h
+@@ -138,6 +138,7 @@
+ 
+ #define B53_RGMII_CTRL_IMP		0x60
+ #define   RGMII_CTRL_ENABLE_GMII	BIT(7)
++#define   RGMII_CTRL_MII_OVERRIDE	BIT(6)
+ #define   RGMII_CTRL_TIMING_SEL		BIT(2)
+ #define   RGMII_CTRL_DLL_RXC		BIT(1)
+ #define   RGMII_CTRL_DLL_TXC		BIT(0)
diff --git a/target/linux/generic/pending-5.15/777-net-dsa-b53-mdio-add-support-for-BCM53134.patch b/target/linux/generic/pending-5.15/777-net-dsa-b53-mdio-add-support-for-BCM53134.patch
new file mode 100644
index 00000000000000..53494eca6ed52f
--- /dev/null
+++ b/target/linux/generic/pending-5.15/777-net-dsa-b53-mdio-add-support-for-BCM53134.patch
@@ -0,0 +1,189 @@
+From patchwork Fri Mar 24 08:41:38 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=
+ <noltari@gmail.com>
+X-Patchwork-Id: 13186549
+X-Patchwork-Delegate: kuba@kernel.org
+Return-Path: <netdev-owner@vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id EF744C76195
+	for <netdev@archiver.kernel.org>; Fri, 24 Mar 2023 08:42:01 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S231807AbjCXImA (ORCPT <rfc822;netdev@archiver.kernel.org>);
+        Fri, 24 Mar 2023 04:42:00 -0400
+Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32956 "EHLO
+        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S231272AbjCXIly (ORCPT
+        <rfc822;netdev@vger.kernel.org>); Fri, 24 Mar 2023 04:41:54 -0400
+Received: from mail-ed1-x535.google.com (mail-ed1-x535.google.com
+ [IPv6:2a00:1450:4864:20::535])
+        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 113A517CF3;
+        Fri, 24 Mar 2023 01:41:46 -0700 (PDT)
+Received: by mail-ed1-x535.google.com with SMTP id ek18so4877175edb.6;
+        Fri, 24 Mar 2023 01:41:45 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20210112; t=1679647304;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:from:to:cc:subject:date
+         :message-id:reply-to;
+        bh=OfUWRaFIQIQw/lRivER+LHryfdLliXzvabGrcmkQVEU=;
+        b=JMrl6Eay1FS0JZqgPHsbcVzuNAbFELc0SLNGyzYtOVQXcI+YwKDM9Ls7I9PsQVEPoZ
+         CthomCTYoz5G9DU7uBuia207rnjOhssZJRu0syrCoU+O/ZiQyGLJDvq61z5oZJxC2S40
+         kzRsUsC6MRjn64DKPWmxhsSTMKLzn2+P233LKNFbHtfi3NWF5Qu/85sUkxMurnfUgja0
+         qQhl25qYY7ZIvmlFHYefaI5UkITQFuiybrqJW9tztCdHf/gS+f33YkkvQ8njmMQa1DW0
+         ppedfOUotX+6kmHZGX1yea2V5ezEGGvRourZtYMoecTiD0E5d1J1bKhktKslVLIDm0ig
+         oc2g==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20210112; t=1679647304;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
+         :subject:date:message-id:reply-to;
+        bh=OfUWRaFIQIQw/lRivER+LHryfdLliXzvabGrcmkQVEU=;
+        b=b3Gmga5ZDbnmQfnw1GCz+eU2JwgsVzfciZuSmfYAiVxpW4c6cur3MHbpzDPhi99wzA
+         ZYAM7ryLv88rXl/tQB5g2Nte5rvMfxUeHXsT/JpsRcSSocFRbRrk0QJyiA/Xj86NiD5N
+         C1sKz50Im190FmrvPcBh6OHQbv/3MQyE+1fQx+9q3jW5rQiAWQaYk4Ng8GlWA7gtG3jB
+         fHO6Fuoenn32pgkveJbQLYL/2t2f53wGf3QLQ3IeKW7jdfIHNThwrwqBMxdHoIDaTBT9
+         UWMeJuiYtylIibo/3zbORbWOgIERlWxZRf3BCOFpnzUn4eBzio4LgjtNxZ77ITRxsmbk
+         3+Hg==
+X-Gm-Message-State: AAQBX9dfyBfbR7Sdd5wqxMiAv3Yhk47pK1XzD87MZyAF3AxyoFyKcMaF
+        EbwJLyRvTGQEFdVWCGw1eMU=
+X-Google-Smtp-Source: 
+ AKy350bpDVLq7k1FxG2Mek/VIobZL4KhufiKx8qfmpxpcWmLI3bLg8wfQKEAKJRNJBleo/7CZuCL5g==
+X-Received: by 2002:aa7:c711:0:b0:4a2:588f:b3c5 with SMTP id
+ i17-20020aa7c711000000b004a2588fb3c5mr2261236edq.21.1679647304260;
+        Fri, 24 Mar 2023 01:41:44 -0700 (PDT)
+Received: from atlantis.lan (255.red-79-146-124.dynamicip.rima-tde.net.
+ [79.146.124.255])
+        by smtp.gmail.com with ESMTPSA id
+ z21-20020a50cd15000000b004acbda55f6bsm10323728edi.27.2023.03.24.01.41.43
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Fri, 24 Mar 2023 01:41:43 -0700 (PDT)
+From: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+To: paul.geurts@prodrive-technologies.com, f.fainelli@gmail.com,
+        jonas.gorski@gmail.com, andrew@lunn.ch, olteanv@gmail.com,
+        davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
+        pabeni@redhat.com, robh+dt@kernel.org,
+        krzysztof.kozlowski+dt@linaro.org, netdev@vger.kernel.org,
+        devicetree@vger.kernel.org, linux-kernel@vger.kernel.org
+Cc: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+Subject: [PATCH v2 2/2] net: dsa: b53: mdio: add support for BCM53134
+Date: Fri, 24 Mar 2023 09:41:38 +0100
+Message-Id: <20230324084138.664285-3-noltari@gmail.com>
+X-Mailer: git-send-email 2.30.2
+In-Reply-To: <20230324084138.664285-1-noltari@gmail.com>
+References: <20230323121804.2249605-1-noltari@gmail.com>
+ <20230324084138.664285-1-noltari@gmail.com>
+MIME-Version: 1.0
+Precedence: bulk
+List-ID: <netdev.vger.kernel.org>
+X-Mailing-List: netdev@vger.kernel.org
+X-Patchwork-Delegate: kuba@kernel.org
+
+From: Paul Geurts <paul.geurts@prodrive-technologies.com>
+
+Add support for the BCM53134 Ethernet switch in the existing b53 dsa driver.
+BCM53134 is very similar to the BCM58XX series.
+
+Signed-off-by: Paul Geurts <paul.geurts@prodrive-technologies.com>
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ v2: add BCM53134 to is531x5() and remove special RGMII config
+
+ drivers/net/dsa/b53/b53_common.c | 15 +++++++++++++++
+ drivers/net/dsa/b53/b53_mdio.c   |  5 ++++-
+ drivers/net/dsa/b53/b53_priv.h   |  7 +++++--
+ 3 files changed, 24 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -2609,6 +2609,20 @@ static const struct b53_chip_data b53_sw
+ 		.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
+ 		.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+ 	},
++	{
++		.chip_id = BCM53134_DEVICE_ID,
++		.dev_name = "BCM53134",
++		.vlans = 4096,
++		.enabled_ports = 0x12f,
++		.imp_port = 8,
++		.cpu_port = B53_CPU_PORT,
++		.vta_regs = B53_VTA_REGS,
++		.arl_bins = 4,
++		.arl_buckets = 1024,
++		.duplex_reg = B53_DUPLEX_STAT_GE,
++		.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
++		.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
++	},
+ };
+ 
+ static int b53_switch_init(struct b53_device *dev)
+@@ -2785,6 +2799,7 @@ int b53_switch_detect(struct b53_device
+ 		case BCM53012_DEVICE_ID:
+ 		case BCM53018_DEVICE_ID:
+ 		case BCM53019_DEVICE_ID:
++		case BCM53134_DEVICE_ID:
+ 			dev->chip_id = id32;
+ 			break;
+ 		default:
+--- a/drivers/net/dsa/b53/b53_mdio.c
++++ b/drivers/net/dsa/b53/b53_mdio.c
+@@ -286,6 +286,7 @@ static const struct b53_io_ops b53_mdio_
+ #define B53_BRCM_OUI_2	0x03625c00
+ #define B53_BRCM_OUI_3	0x00406000
+ #define B53_BRCM_OUI_4	0x01410c00
++#define B53_BRCM_OUI_5	0xae025000
+ 
+ static int b53_mdio_probe(struct mdio_device *mdiodev)
+ {
+@@ -313,7 +314,8 @@ static int b53_mdio_probe(struct mdio_de
+ 	if ((phy_id & 0xfffffc00) != B53_BRCM_OUI_1 &&
+ 	    (phy_id & 0xfffffc00) != B53_BRCM_OUI_2 &&
+ 	    (phy_id & 0xfffffc00) != B53_BRCM_OUI_3 &&
+-	    (phy_id & 0xfffffc00) != B53_BRCM_OUI_4) {
++	    (phy_id & 0xfffffc00) != B53_BRCM_OUI_4 &&
++	    (phy_id & 0xfffffc00) != B53_BRCM_OUI_5) {
+ 		dev_err(&mdiodev->dev, "Unsupported device: 0x%08x\n", phy_id);
+ 		return -ENODEV;
+ 	}
+@@ -377,6 +379,7 @@ static const struct of_device_id b53_of_
+ 	{ .compatible = "brcm,bcm53115" },
+ 	{ .compatible = "brcm,bcm53125" },
+ 	{ .compatible = "brcm,bcm53128" },
++	{ .compatible = "brcm,bcm53134" },
+ 	{ .compatible = "brcm,bcm5365" },
+ 	{ .compatible = "brcm,bcm5389" },
+ 	{ .compatible = "brcm,bcm5395" },
+--- a/drivers/net/dsa/b53/b53_priv.h
++++ b/drivers/net/dsa/b53/b53_priv.h
+@@ -85,6 +85,7 @@ enum {
+ 	BCM583XX_DEVICE_ID = 0x58300,
+ 	BCM7445_DEVICE_ID = 0x7445,
+ 	BCM7278_DEVICE_ID = 0x7278,
++	BCM53134_DEVICE_ID = 0x5075,
+ };
+ 
+ #define B53_N_PORTS	9
+@@ -182,7 +183,8 @@ static inline int is531x5(struct b53_dev
+ {
+ 	return dev->chip_id == BCM53115_DEVICE_ID ||
+ 		dev->chip_id == BCM53125_DEVICE_ID ||
+-		dev->chip_id == BCM53128_DEVICE_ID;
++		dev->chip_id == BCM53128_DEVICE_ID ||
++		dev->chip_id == BCM53134_DEVICE_ID;
+ }
+ 
+ static inline int is63xx(struct b53_device *dev)
+@@ -210,7 +212,8 @@ static inline int is58xx(struct b53_devi
+ 	return dev->chip_id == BCM58XX_DEVICE_ID ||
+ 		dev->chip_id == BCM583XX_DEVICE_ID ||
+ 		dev->chip_id == BCM7445_DEVICE_ID ||
+-		dev->chip_id == BCM7278_DEVICE_ID;
++		dev->chip_id == BCM7278_DEVICE_ID ||
++		dev->chip_id == BCM53134_DEVICE_ID;
+ }
+ 
+ #define B53_63XX_RGMII0	4
diff --git a/target/linux/generic/pending-5.15/790-bus-mhi-core-add-SBL-state-callback.patch b/target/linux/generic/pending-5.15/790-bus-mhi-core-add-SBL-state-callback.patch
new file mode 100644
index 00000000000000..2f728fefd73e0c
--- /dev/null
+++ b/target/linux/generic/pending-5.15/790-bus-mhi-core-add-SBL-state-callback.patch
@@ -0,0 +1,48 @@
+From 5f7c5e1c0d7a79be144e5efc1f24728ddd7fc25c Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Sat, 5 Nov 2022 20:02:56 +0100
+Subject: [PATCH 1/2] bus: mhi: core: add SBL state callback
+
+Add support for SBL state callback in MHI core.
+
+It is required for ath11k MHI devices in order to be able to set QRTR
+instance ID in the SBL state so that QRTR instance ID-s dont conflict in
+case of multiple PCI/MHI cards or AHB + PCI/MHI card.
+Setting QRTR instance ID is only possible in SBL state and there is
+currently no way to ensure that we are in that state, so provide a
+callback that the controller can trigger off.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/bus/mhi/host/main.c | 1 +
+ include/linux/mhi.h         | 2 ++
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/bus/mhi/host/main.c
++++ b/drivers/bus/mhi/host/main.c
+@@ -891,6 +891,7 @@ int mhi_process_ctrl_ev_ring(struct mhi_
+ 			switch (event) {
+ 			case MHI_EE_SBL:
+ 				st = DEV_ST_TRANSITION_SBL;
++				mhi_cntrl->status_cb(mhi_cntrl, MHI_CB_EE_SBL_MODE);
+ 				break;
+ 			case MHI_EE_WFW:
+ 			case MHI_EE_AMSS:
+--- a/include/linux/mhi.h
++++ b/include/linux/mhi.h
+@@ -34,6 +34,7 @@ struct mhi_buf_info;
+  * @MHI_CB_SYS_ERROR: MHI device entered error state (may recover)
+  * @MHI_CB_FATAL_ERROR: MHI device entered fatal error state
+  * @MHI_CB_BW_REQ: Received a bandwidth switch request from device
++ * @MHI_CB_EE_SBL_MODE: MHI device entered SBL mode
+  */
+ enum mhi_callback {
+ 	MHI_CB_IDLE,
+@@ -45,6 +46,7 @@ enum mhi_callback {
+ 	MHI_CB_SYS_ERROR,
+ 	MHI_CB_FATAL_ERROR,
+ 	MHI_CB_BW_REQ,
++	MHI_CB_EE_SBL_MODE,
+ };
+ 
+ /**
diff --git a/target/linux/generic/pending-5.15/795-mt7530-register-OF-node-for-internal-MDIO-bus.patch b/target/linux/generic/pending-5.15/795-mt7530-register-OF-node-for-internal-MDIO-bus.patch
new file mode 100644
index 00000000000000..8a64a2a985eaf4
--- /dev/null
+++ b/target/linux/generic/pending-5.15/795-mt7530-register-OF-node-for-internal-MDIO-bus.patch
@@ -0,0 +1,43 @@
+From 1d81e51d6d79d9098013b2e8cdd677bae998c5d8 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Fri, 28 Apr 2023 02:22:59 +0200
+Subject: [PATCH 1/2] mt7530: register OF node for internal MDIO bus
+
+The MT753x switches provide a switch-internal MDIO bus for the embedded
+PHYs.
+
+Register a OF sub-node on the switch OF-node for this internal MDIO bus.
+This allows to configure the embedded PHYs using device-tree.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ drivers/net/dsa/mt7530.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -2121,10 +2121,13 @@ mt7530_setup_mdio(struct mt7530_priv *pr
+ {
+ 	struct dsa_switch *ds = priv->ds;
+ 	struct device *dev = priv->dev;
++	struct device_node *np, *mnp;
+ 	struct mii_bus *bus;
+ 	static int idx;
+ 	int ret;
+ 
++	np = priv->dev->of_node;
++
+ 	bus = devm_mdiobus_alloc(dev);
+ 	if (!bus)
+ 		return -ENOMEM;
+@@ -2141,7 +2144,9 @@ mt7530_setup_mdio(struct mt7530_priv *pr
+ 	if (priv->irq)
+ 		mt7530_setup_mdio_irq(priv);
+ 
+-	ret = devm_mdiobus_register(dev, bus);
++	mnp = of_get_child_by_name(np, "mdio");
++	ret = devm_of_mdiobus_register(dev, bus, mnp);
++	of_node_put(mnp);
+ 	if (ret) {
+ 		dev_err(dev, "failed to register MDIO bus: %d\n", ret);
+ 		if (priv->irq)
diff --git a/target/linux/generic/pending-5.15/802-nvmem-u-boot-env-align-endianness-of-crc32-values.patch b/target/linux/generic/pending-5.15/802-nvmem-u-boot-env-align-endianness-of-crc32-values.patch
new file mode 100644
index 00000000000000..9b111050eeff01
--- /dev/null
+++ b/target/linux/generic/pending-5.15/802-nvmem-u-boot-env-align-endianness-of-crc32-values.patch
@@ -0,0 +1,47 @@
+From 0e71cac033bb7689c4dfa2e6814191337ef770f5 Mon Sep 17 00:00:00 2001
+From: INAGAKI Hiroshi <musashino.open@gmail.com>
+Date: Thu, 13 Oct 2022 00:51:33 +0900
+Subject: [PATCH] nvmem: u-boot-env: align endianness of crc32 values
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This patch fixes crc32 error on Big-Endianness system by conversion of
+calculated crc32 value.
+
+Little-Endianness system:
+
+  obtained crc32: Little
+calculated crc32: Little
+
+Big-Endianness system:
+
+  obtained crc32: Little
+calculated crc32: Big
+
+log (APRESIA ApresiaLightGS120GT-SS, RTL8382M, Big-Endianness):
+
+[    8.570000] u_boot_env 18001200.spi:flash@0:partitions:partition@c0000: Invalid calculated CRC32: 0x88cd6f09 (expected: 0x096fcd88)
+[    8.580000] u_boot_env: probe of 18001200.spi:flash@0:partitions:partition@c0000 failed with error -22
+
+Fixes: f955dc1445069 ("nvmem: add driver handling U-Boot environment variables")
+
+Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
+Acked-by: Rafał Miłecki <rafal@milecki.pl>
+Tested-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+---
+ drivers/nvmem/u-boot-env.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/u-boot-env.c
++++ b/drivers/nvmem/u-boot-env.c
+@@ -182,7 +182,7 @@ static int u_boot_env_parse(struct u_boo
+ 	crc32_data_len = priv->mtd->size - crc32_data_offset;
+ 	data_len = priv->mtd->size - data_offset;
+ 
+-	calc = crc32(~0, buf + crc32_data_offset, crc32_data_len) ^ ~0L;
++	calc = le32_to_cpu((__le32)crc32(~0, buf + crc32_data_offset, crc32_data_len) ^ ~0L);
+ 	if (calc != crc32) {
+ 		dev_err(dev, "Invalid calculated CRC32: 0x%08x (expected: 0x%08x)\n", calc, crc32);
+ 		err = -EINVAL;
diff --git a/target/linux/generic/pending-5.15/834-ledtrig-libata.patch b/target/linux/generic/pending-5.15/834-ledtrig-libata.patch
index 3977b57d9faa84..9c85862a4bd822 100644
--- a/target/linux/generic/pending-5.15/834-ledtrig-libata.patch
+++ b/target/linux/generic/pending-5.15/834-ledtrig-libata.patch
@@ -65,7 +65,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  /**
   *	ata_build_rw_tf - Build ATA taskfile for given read/write request
   *	@tf: Target ATA taskfile
-@@ -4576,6 +4589,9 @@ struct ata_queued_cmd *ata_qc_new_init(s
+@@ -4580,6 +4593,9 @@ struct ata_queued_cmd *ata_qc_new_init(s
  		if (tag < 0)
  			return NULL;
  	}
@@ -75,7 +75,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  	qc = __ata_qc_from_tag(ap, tag);
  	qc->tag = qc->hw_tag = tag;
-@@ -5354,6 +5370,9 @@ struct ata_port *ata_port_alloc(struct a
+@@ -5358,6 +5374,9 @@ struct ata_port *ata_port_alloc(struct a
  	ap->stats.unhandled_irq = 1;
  	ap->stats.idle_irq = 1;
  #endif
@@ -85,7 +85,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	ata_sff_port_init(ap);
  
  	return ap;
-@@ -5389,6 +5408,12 @@ static void ata_host_release(struct kref
+@@ -5393,6 +5412,12 @@ static void ata_host_release(struct kref
  
  		kfree(ap->pmp_link);
  		kfree(ap->slave_link);
@@ -98,7 +98,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		kfree(ap);
  		host->ports[i] = NULL;
  	}
-@@ -5795,7 +5820,23 @@ int ata_host_register(struct ata_host *h
+@@ -5799,7 +5824,23 @@ int ata_host_register(struct ata_host *h
  		host->ports[i]->print_id = atomic_inc_return(&ata_print_id);
  		host->ports[i]->local_port_no = i + 1;
  	}
@@ -134,7 +134,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  /*
   * Define if arch has non-standard setup.  This is a _PCI_ standard
-@@ -888,6 +891,12 @@ struct ata_port {
+@@ -894,6 +897,12 @@ struct ata_port {
  #ifdef CONFIG_ATA_ACPI
  	struct ata_acpi_gtm	__acpi_init_gtm; /* use ata_acpi_init_gtm() */
  #endif
diff --git a/target/linux/generic/pending-5.15/850-dt-bindings-clk-add-BCM63268-timer-clock-definitions.patch b/target/linux/generic/pending-5.15/850-dt-bindings-clk-add-BCM63268-timer-clock-definitions.patch
new file mode 100644
index 00000000000000..cc6f1e0d9dbec4
--- /dev/null
+++ b/target/linux/generic/pending-5.15/850-dt-bindings-clk-add-BCM63268-timer-clock-definitions.patch
@@ -0,0 +1,114 @@
+From patchwork Wed Mar 22 17:15:12 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=
+ <noltari@gmail.com>
+X-Patchwork-Id: 13184389
+Return-Path: <linux-clk-owner@vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id 73F2DC6FD1C
+	for <linux-clk@archiver.kernel.org>; Wed, 22 Mar 2023 17:15:59 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S231363AbjCVRP5 (ORCPT <rfc822;linux-clk@archiver.kernel.org>);
+        Wed, 22 Mar 2023 13:15:57 -0400
+Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58824 "EHLO
+        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S231408AbjCVRPy (ORCPT
+        <rfc822;linux-clk@vger.kernel.org>); Wed, 22 Mar 2023 13:15:54 -0400
+Received: from mail-wm1-x32d.google.com (mail-wm1-x32d.google.com
+ [IPv6:2a00:1450:4864:20::32d])
+        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 70E4C64B28;
+        Wed, 22 Mar 2023 10:15:24 -0700 (PDT)
+Received: by mail-wm1-x32d.google.com with SMTP id n19so1740892wms.0;
+        Wed, 22 Mar 2023 10:15:24 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20210112; t=1679505322;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:from:to:cc:subject:date
+         :message-id:reply-to;
+        bh=dEknM98Izmc8d/crPsoJ+ejZxfl78958Ei6SPYhYDHs=;
+        b=LTOQ75W3s5nYo+nEfiJAKqytSopONB4jCtU3zRygzPMasugVOrYFMsUR+WrpsAjuRT
+         v4HgWpJxEsIWeRXrUN9W21mFXhGgJLJXSxRnrio0CsZZBNMdkebbNOphgKXIWAdm+2iM
+         PzqAdGm5t38wT2mmm6V/9hCy90+12raHM82tNFdhhiezfg2cukVOKP3j/TeOVCwas0gQ
+         iFc+CuZB6y73zYXvMUMUpTsqI5vev4xJsSMHIQJVmUxJAwqhOBhN9JCRo7Ao+wayjn2d
+         Fxo6AV3A8v68nVfoQ0K0I+eWXG48nMCX45iWh/lVvVTOFcR99kn4va7NY1oVnPsh+WQz
+         WcLA==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20210112; t=1679505322;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
+         :subject:date:message-id:reply-to;
+        bh=dEknM98Izmc8d/crPsoJ+ejZxfl78958Ei6SPYhYDHs=;
+        b=wv2NSR1B5RnsdoEE7mgJSHAfSs1JHZbQ1HPMldyaGWAk1dcucqh/uDzM3Flz+ADRi1
+         19NoaB2Ur7QaWZejbuplnIOK/nte3PnmqJ9ZNw8HejmuS4eU8mB1V1aJUSKSPGsfUi4a
+         LYe3HSw87l0jrAC7ptdKvdUtzBoIkX0CeFvfguTQQkDhUTyAFIG144hY6uPXY9Mga96b
+         gnNe2dLCzHQLbEJpaDaavT7FEEcLDxaq7jNcR2xqEEZaIwfcew+Q05t4xL/3i8GAj9Ru
+         6ivQjIbBKfYQF88o7KnOW9o1wjrGsk+Nd4Iy0OLZix3JQasCJGrKV7ib5awI9J39upYV
+         fa4A==
+X-Gm-Message-State: AO0yUKWw75I1M5Vjrd4vXq4GTruQu0H84pycgyi2CT3bczTYRJpWmEWg
+        +bHDhvp1n5IWW85GI9vKWpbclB13a/S0RQ==
+X-Google-Smtp-Source: 
+ AK7set9T/2oJsVetUb2L4mPEWu8YqDrnK8EzHK5bJf1ABIa1Et8f7BFJ7AA3j14ITZuf8cH0HqlRtg==
+X-Received: by 2002:a05:600c:2304:b0:3ed:2949:985b with SMTP id
+ 4-20020a05600c230400b003ed2949985bmr206833wmo.23.1679505322457;
+        Wed, 22 Mar 2023 10:15:22 -0700 (PDT)
+Received: from atlantis.lan (255.red-79-146-124.dynamicip.rima-tde.net.
+ [79.146.124.255])
+        by smtp.gmail.com with ESMTPSA id
+ v10-20020a05600c470a00b003ee11ac2288sm8414333wmo.21.2023.03.22.10.15.21
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Wed, 22 Mar 2023 10:15:22 -0700 (PDT)
+From: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+To: mturquette@baylibre.com, sboyd@kernel.org, robh+dt@kernel.org,
+        krzysztof.kozlowski+dt@linaro.org, p.zabel@pengutronix.de,
+        f.fainelli@gmail.com, jonas.gorski@gmail.com,
+        william.zhang@broadcom.com, linux-clk@vger.kernel.org,
+        devicetree@vger.kernel.org, linux-kernel@vger.kernel.org
+Cc: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>,
+ Rob Herring <robh@kernel.org>
+Subject: [PATCH v4 1/4] dt-bindings: clk: add BCM63268 timer clock definitions
+Date: Wed, 22 Mar 2023 18:15:12 +0100
+Message-Id: <20230322171515.120353-2-noltari@gmail.com>
+X-Mailer: git-send-email 2.30.2
+In-Reply-To: <20230322171515.120353-1-noltari@gmail.com>
+References: <20230322171515.120353-1-noltari@gmail.com>
+MIME-Version: 1.0
+Precedence: bulk
+List-ID: <linux-clk.vger.kernel.org>
+X-Mailing-List: linux-clk@vger.kernel.org
+
+Add missing timer clock definitions for BCM63268.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Acked-by: Rob Herring <robh@kernel.org>
+---
+ v4: no changes
+ v3: no changes
+ v2: change commit title, as suggested by Stephen Boyd
+
+ include/dt-bindings/clock/bcm63268-clock.h | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/include/dt-bindings/clock/bcm63268-clock.h
++++ b/include/dt-bindings/clock/bcm63268-clock.h
+@@ -27,4 +27,17 @@
+ #define BCM63268_CLK_TBUS	27
+ #define BCM63268_CLK_ROBOSW250	31
+ 
++#define BCM63268_TCLK_EPHY1		0
++#define BCM63268_TCLK_EPHY2		1
++#define BCM63268_TCLK_EPHY3		2
++#define BCM63268_TCLK_GPHY1		3
++#define BCM63268_TCLK_DSL		4
++#define BCM63268_TCLK_WAKEON_EPHY	6
++#define BCM63268_TCLK_WAKEON_DSL	7
++#define BCM63268_TCLK_FAP1		11
++#define BCM63268_TCLK_FAP2		15
++#define BCM63268_TCLK_UTO_50		16
++#define BCM63268_TCLK_UTO_EXTIN		17
++#define BCM63268_TCLK_USB_REF		18
++
+ #endif /* __DT_BINDINGS_CLOCK_BCM63268_H */
diff --git a/target/linux/generic/pending-5.15/851-dt-bindings-reset-add-BCM63268-timer-reset-definitions.patch b/target/linux/generic/pending-5.15/851-dt-bindings-reset-add-BCM63268-timer-reset-definitions.patch
new file mode 100644
index 00000000000000..5f1be105ac7295
--- /dev/null
+++ b/target/linux/generic/pending-5.15/851-dt-bindings-reset-add-BCM63268-timer-reset-definitions.patch
@@ -0,0 +1,107 @@
+From patchwork Wed Mar 22 17:15:13 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=
+ <noltari@gmail.com>
+X-Patchwork-Id: 13184390
+Return-Path: <linux-clk-owner@vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id D0B1AC6FD1C
+	for <linux-clk@archiver.kernel.org>; Wed, 22 Mar 2023 17:16:08 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S231472AbjCVRQI (ORCPT <rfc822;linux-clk@archiver.kernel.org>);
+        Wed, 22 Mar 2023 13:16:08 -0400
+Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58934 "EHLO
+        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S231435AbjCVRP5 (ORCPT
+        <rfc822;linux-clk@vger.kernel.org>); Wed, 22 Mar 2023 13:15:57 -0400
+Received: from mail-wm1-x329.google.com (mail-wm1-x329.google.com
+ [IPv6:2a00:1450:4864:20::329])
+        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9655064863;
+        Wed, 22 Mar 2023 10:15:25 -0700 (PDT)
+Received: by mail-wm1-x329.google.com with SMTP id
+ v4-20020a05600c470400b003ee4f06428fso2424553wmo.4;
+        Wed, 22 Mar 2023 10:15:25 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20210112; t=1679505324;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:from:to:cc:subject:date
+         :message-id:reply-to;
+        bh=C7ykhArT1dO7P8wtmI92eo4c7KtPZI9w182/5+cB3T0=;
+        b=WRZRU2SM9n1LfUj4SgTPfQczADC2pfvoIrOsNpBLTym2eOfmkTetb/WbGSla5kw2Wb
+         SH5MIC2fFeScJg6T5FFAUOOLmRVW9xvl8Q3T3NKb3z/9wvPHO767nrdIbffRWMJFs7gW
+         wT/kuTpn8GYdfY0sZ/dMTkq41DVusEkxfX6GxtG85O98ZP8xMHQog8aPs9fRfUvI5ZKB
+         eGYcRz/Wn1cHhjey9jtWzQEEmZ/BT3b0HQTF9Tl88oofhiEgbyjFXr91+vRsLbsJpGXH
+         /1FjjaLG5DnonKubV9rmbuCU8KzwH331gi2KuRjvLD2V+OMewqSa5i+GvgVv8x2zC8y+
+         /mLQ==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20210112; t=1679505324;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
+         :subject:date:message-id:reply-to;
+        bh=C7ykhArT1dO7P8wtmI92eo4c7KtPZI9w182/5+cB3T0=;
+        b=bhd0fNh0jDOMlGSC4F+p5igV8AUlGEPj2cXUwgdgqRfSSuUy9z+Li8cT0MbY/aWH5Z
+         qInRVA+R1cWV3ubrDyKag6oEc0LDU234bnMFcP9b7MRlrM8Dpit9TFSyqJU4sDUWNDs5
+         KOe2k/SNIdat6munC9VOuEBDO0eB/UDMN+repKwXNdHChp/Toq9qMvW4Uy8uHxosbQlD
+         8P88GbKFjynb1E8I8croGjfub7+y8PPsWB0xNUcafIv6xs3MnVOP1Mk4KwBCbqS509la
+         mfjsriXtIybO8XFqtn100ungjvbFWdogEplLdSPVdgAqdfF5J8gHxAoApoeYejYkL5/R
+         kOhQ==
+X-Gm-Message-State: AO0yUKWdzr3dMmjKhD8tF+ec4Dfdq9VGZ/WCU4d85npKQvxSwhNPZZ1J
+        5WYRIqivh0suFC1OqEidwenpiJYvXedYjw==
+X-Google-Smtp-Source: 
+ AK7set87ew2/mKWeShXTTW/YBbBJNR2zeGFV0CfuqLXhiJEU6tqFuyKcW+vFEoKHIbNUS8wRy1SzLA==
+X-Received: by 2002:a05:600c:290:b0:3ee:6d88:774a with SMTP id
+ 16-20020a05600c029000b003ee6d88774amr160734wmk.14.1679505323514;
+        Wed, 22 Mar 2023 10:15:23 -0700 (PDT)
+Received: from atlantis.lan (255.red-79-146-124.dynamicip.rima-tde.net.
+ [79.146.124.255])
+        by smtp.gmail.com with ESMTPSA id
+ v10-20020a05600c470a00b003ee11ac2288sm8414333wmo.21.2023.03.22.10.15.22
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Wed, 22 Mar 2023 10:15:23 -0700 (PDT)
+From: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+To: mturquette@baylibre.com, sboyd@kernel.org, robh+dt@kernel.org,
+        krzysztof.kozlowski+dt@linaro.org, p.zabel@pengutronix.de,
+        f.fainelli@gmail.com, jonas.gorski@gmail.com,
+        william.zhang@broadcom.com, linux-clk@vger.kernel.org,
+        devicetree@vger.kernel.org, linux-kernel@vger.kernel.org
+Cc: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>,
+ Rob Herring <robh@kernel.org>
+Subject: [PATCH v4 2/4] dt-bindings: reset: add BCM63268 timer reset
+ definitions
+Date: Wed, 22 Mar 2023 18:15:13 +0100
+Message-Id: <20230322171515.120353-3-noltari@gmail.com>
+X-Mailer: git-send-email 2.30.2
+In-Reply-To: <20230322171515.120353-1-noltari@gmail.com>
+References: <20230322171515.120353-1-noltari@gmail.com>
+MIME-Version: 1.0
+Precedence: bulk
+List-ID: <linux-clk.vger.kernel.org>
+X-Mailing-List: linux-clk@vger.kernel.org
+
+Add missing timer reset definitions for BCM63268.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Acked-by: Rob Herring <robh@kernel.org>
+---
+ v4: no changes
+ v3: no changes
+ v2: change commit title, as suggested by Stephen Boyd
+
+ include/dt-bindings/reset/bcm63268-reset.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/include/dt-bindings/reset/bcm63268-reset.h
++++ b/include/dt-bindings/reset/bcm63268-reset.h
+@@ -23,4 +23,8 @@
+ #define BCM63268_RST_PCIE_HARD	17
+ #define BCM63268_RST_GPHY	18
+ 
++#define BCM63268_TRST_SW	29
++#define BCM63268_TRST_HW	30
++#define BCM63268_TRST_POR	31
++
+ #endif /* __DT_BINDINGS_RESET_BCM63268_H */
diff --git a/target/linux/generic/pending-5.15/852-clk-bcm-Add-BCM63268-timer-clock-and-reset-driver.patch b/target/linux/generic/pending-5.15/852-clk-bcm-Add-BCM63268-timer-clock-and-reset-driver.patch
new file mode 100644
index 00000000000000..7e500cd1b58c85
--- /dev/null
+++ b/target/linux/generic/pending-5.15/852-clk-bcm-Add-BCM63268-timer-clock-and-reset-driver.patch
@@ -0,0 +1,345 @@
+From patchwork Wed Mar 22 17:15:15 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=
+ <noltari@gmail.com>
+X-Patchwork-Id: 13184392
+Return-Path: <linux-clk-owner@vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id 199D9C76196
+	for <linux-clk@archiver.kernel.org>; Wed, 22 Mar 2023 17:16:11 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S231512AbjCVRQJ (ORCPT <rfc822;linux-clk@archiver.kernel.org>);
+        Wed, 22 Mar 2023 13:16:09 -0400
+Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58942 "EHLO
+        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S231442AbjCVRP5 (ORCPT
+        <rfc822;linux-clk@vger.kernel.org>); Wed, 22 Mar 2023 13:15:57 -0400
+Received: from mail-wm1-x32c.google.com (mail-wm1-x32c.google.com
+ [IPv6:2a00:1450:4864:20::32c])
+        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1DDB36487D;
+        Wed, 22 Mar 2023 10:15:27 -0700 (PDT)
+Received: by mail-wm1-x32c.google.com with SMTP id
+ i5-20020a05600c354500b003edd24054e0so6717370wmq.4;
+        Wed, 22 Mar 2023 10:15:27 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20210112; t=1679505325;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:from:to:cc:subject:date
+         :message-id:reply-to;
+        bh=rkv/eZYA1ncHp5FnV2ZWc3hgYnAx28S86QA9vmcXFCY=;
+        b=Y1mva2Bt3sUbKxLgEUS331CJbGxUc4z8kTQW8qiHWGhYlFKtm+d5z4sT40E5BeZAnU
+         zmTbCI7jbroe9NYBxGUmSli6LNVDPjND80ChbhWTqbqMQTmeQFWut9KmeBWK6Oze2lC/
+         XMSOorUzowjcU2xtHNrzoq2KH2pstW573lsB8WnzFVfhMaRkE9DfRr6WNyA7zC8DyxM5
+         ezxlCQtCmgPfCqlyksbIDKrgrRf3GiUR0yUd6xRU+MssyvH1FkYGDCerPctDto6lGHBz
+         8Y15jT3l6OnQMT6dkekgpPF5/XrSUY93u9g0B4U8+0dhNj+K7vmDen+jqdess+tpLnq/
+         gFrA==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20210112; t=1679505325;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
+         :subject:date:message-id:reply-to;
+        bh=rkv/eZYA1ncHp5FnV2ZWc3hgYnAx28S86QA9vmcXFCY=;
+        b=Ym4+u8bbTQGNkewUBrLf+89vE0EFJBQp2f1crwUxZFboKTROF9ltZonY1CGepo7b0B
+         fkx3TbWQy5X65g3ScuieqtClCI8WanPeNBJ48+JipJYO3ODVNBxnVaTuW/0FOIcahfqe
+         sG5GvggHhzRz+Yeybsbnupmzxnw8Ez0BpMl3p7zcjHL7BGZDdOOX2Zbw3zfyYa5sg2nX
+         UXYJT36zy2h39gxUsy9QkhQ76CG3w6omniohZpYidpojpiDjbOy0nKFky4kUe+YyA1fF
+         4IBhjAm6mH+uh6wHSG1qj+NAXHs0xDDJps16PbJwAgL7Qt9K5WW+R/UAYPmHFgaRIHOw
+         /seA==
+X-Gm-Message-State: AO0yUKXRtoYO8Nfus6Ca8lhM39P1Xn6TGkhatEfoISd1YNOkTJJN2hW+
+        xRphLgxlzNfCLcVPlpGK9dk=
+X-Google-Smtp-Source: 
+ AK7set9VnMEykugk8ZYnkXuqK41bX1dzlvKsAXHEjr8i2NZBld0buKhQLcGYEcwxnBgVTtC7eRGfXw==
+X-Received: by 2002:a1c:7c0b:0:b0:3e2:1dac:b071 with SMTP id
+ x11-20020a1c7c0b000000b003e21dacb071mr178053wmc.13.1679505325582;
+        Wed, 22 Mar 2023 10:15:25 -0700 (PDT)
+Received: from atlantis.lan (255.red-79-146-124.dynamicip.rima-tde.net.
+ [79.146.124.255])
+        by smtp.gmail.com with ESMTPSA id
+ v10-20020a05600c470a00b003ee11ac2288sm8414333wmo.21.2023.03.22.10.15.24
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Wed, 22 Mar 2023 10:15:25 -0700 (PDT)
+From: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+To: mturquette@baylibre.com, sboyd@kernel.org, robh+dt@kernel.org,
+        krzysztof.kozlowski+dt@linaro.org, p.zabel@pengutronix.de,
+        f.fainelli@gmail.com, jonas.gorski@gmail.com,
+        william.zhang@broadcom.com, linux-clk@vger.kernel.org,
+        devicetree@vger.kernel.org, linux-kernel@vger.kernel.org
+Cc: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+Subject: [PATCH v4 4/4] clk: bcm: Add BCM63268 timer clock and reset driver
+Date: Wed, 22 Mar 2023 18:15:15 +0100
+Message-Id: <20230322171515.120353-5-noltari@gmail.com>
+X-Mailer: git-send-email 2.30.2
+In-Reply-To: <20230322171515.120353-1-noltari@gmail.com>
+References: <20230322171515.120353-1-noltari@gmail.com>
+MIME-Version: 1.0
+Precedence: bulk
+List-ID: <linux-clk.vger.kernel.org>
+X-Mailing-List: linux-clk@vger.kernel.org
+
+Add driver for BCM63268 timer clock and reset controller.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ v4: add changes suggested by Stephen Boyd:
+  - Usage of of_device_get_match_data() isn't needed.
+  - Use devm_clk_hw_register_gate().
+  - Drop clk_hw_unregister_gate().
+ v3: add missing <linux/io.h> include to fix build warning
+ v2: add changes suggested by Stephen Boyd
+
+ drivers/clk/bcm/Kconfig              |   9 ++
+ drivers/clk/bcm/Makefile             |   1 +
+ drivers/clk/bcm/clk-bcm63268-timer.c | 215 +++++++++++++++++++++++++++
+ 3 files changed, 225 insertions(+)
+ create mode 100644 drivers/clk/bcm/clk-bcm63268-timer.c
+
+--- a/drivers/clk/bcm/Kconfig
++++ b/drivers/clk/bcm/Kconfig
+@@ -37,6 +37,15 @@ config CLK_BCM_63XX_GATE
+ 	  Enable common clock framework support for Broadcom BCM63xx DSL SoCs
+ 	  based on the MIPS architecture
+ 
++config CLK_BCM63268_TIMER
++	bool "Broadcom BCM63268 timer clock and reset support"
++	depends on BMIPS_GENERIC || COMPILE_TEST
++	default BMIPS_GENERIC
++	select RESET_CONTROLLER
++	help
++	  Enable timer clock and reset support for Broadcom BCM63268 DSL SoCs
++	  based on the MIPS architecture.
++
+ config CLK_BCM_KONA
+ 	bool "Broadcom Kona CCU clock support"
+ 	depends on ARCH_BCM_MOBILE || COMPILE_TEST
+--- a/drivers/clk/bcm/Makefile
++++ b/drivers/clk/bcm/Makefile
+@@ -1,6 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ obj-$(CONFIG_CLK_BCM_63XX)	+= clk-bcm63xx.o
+ obj-$(CONFIG_CLK_BCM_63XX_GATE)	+= clk-bcm63xx-gate.o
++obj-$(CONFIG_CLK_BCM63268_TIMER) += clk-bcm63268-timer.o
+ obj-$(CONFIG_CLK_BCM_KONA)	+= clk-kona.o
+ obj-$(CONFIG_CLK_BCM_KONA)	+= clk-kona-setup.o
+ obj-$(CONFIG_CLK_BCM_KONA)	+= clk-bcm281xx.o
+--- /dev/null
++++ b/drivers/clk/bcm/clk-bcm63268-timer.c
+@@ -0,0 +1,215 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * BCM63268 Timer Clock and Reset Controller Driver
++ *
++ * Copyright (C) 2023 Álvaro Fernández Rojas <noltari@gmail.com>
++ */
++
++#include <linux/clk-provider.h>
++#include <linux/delay.h>
++#include <linux/io.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
++#include <linux/platform_device.h>
++#include <linux/reset-controller.h>
++
++#include <dt-bindings/clock/bcm63268-clock.h>
++
++#define BCM63268_TIMER_RESET_SLEEP_MIN_US	10000
++#define BCM63268_TIMER_RESET_SLEEP_MAX_US	20000
++
++struct bcm63268_tclkrst_hw {
++	void __iomem *regs;
++	spinlock_t lock;
++
++	struct reset_controller_dev rcdev;
++	struct clk_hw_onecell_data data;
++};
++
++struct bcm63268_tclk_table_entry {
++	const char * const name;
++	u8 bit;
++};
++
++static const struct bcm63268_tclk_table_entry bcm63268_timer_clocks[] = {
++	{
++		.name = "ephy1",
++		.bit = BCM63268_TCLK_EPHY1,
++	}, {
++		.name = "ephy2",
++		.bit = BCM63268_TCLK_EPHY2,
++	}, {
++		.name = "ephy3",
++		.bit = BCM63268_TCLK_EPHY3,
++	}, {
++		.name = "gphy1",
++		.bit = BCM63268_TCLK_GPHY1,
++	}, {
++		.name = "dsl",
++		.bit = BCM63268_TCLK_DSL,
++	}, {
++		.name = "wakeon_ephy",
++		.bit = BCM63268_TCLK_WAKEON_EPHY,
++	}, {
++		.name = "wakeon_dsl",
++		.bit = BCM63268_TCLK_WAKEON_DSL,
++	}, {
++		.name = "fap1_pll",
++		.bit = BCM63268_TCLK_FAP1,
++	}, {
++		.name = "fap2_pll",
++		.bit = BCM63268_TCLK_FAP2,
++	}, {
++		.name = "uto_50",
++		.bit = BCM63268_TCLK_UTO_50,
++	}, {
++		.name = "uto_extin",
++		.bit = BCM63268_TCLK_UTO_EXTIN,
++	}, {
++		.name = "usb_ref",
++		.bit = BCM63268_TCLK_USB_REF,
++	}, {
++		/* sentinel */
++	}
++};
++
++static inline struct bcm63268_tclkrst_hw *
++to_bcm63268_timer_reset(struct reset_controller_dev *rcdev)
++{
++	return container_of(rcdev, struct bcm63268_tclkrst_hw, rcdev);
++}
++
++static int bcm63268_timer_reset_update(struct reset_controller_dev *rcdev,
++				unsigned long id, bool assert)
++{
++	struct bcm63268_tclkrst_hw *reset = to_bcm63268_timer_reset(rcdev);
++	unsigned long flags;
++	uint32_t val;
++
++	spin_lock_irqsave(&reset->lock, flags);
++	val = __raw_readl(reset->regs);
++	if (assert)
++		val &= ~BIT(id);
++	else
++		val |= BIT(id);
++	__raw_writel(val, reset->regs);
++	spin_unlock_irqrestore(&reset->lock, flags);
++
++	return 0;
++}
++
++static int bcm63268_timer_reset_assert(struct reset_controller_dev *rcdev,
++				unsigned long id)
++{
++	return bcm63268_timer_reset_update(rcdev, id, true);
++}
++
++static int bcm63268_timer_reset_deassert(struct reset_controller_dev *rcdev,
++				  unsigned long id)
++{
++	return bcm63268_timer_reset_update(rcdev, id, false);
++}
++
++static int bcm63268_timer_reset_reset(struct reset_controller_dev *rcdev,
++			       unsigned long id)
++{
++	bcm63268_timer_reset_update(rcdev, id, true);
++	usleep_range(BCM63268_TIMER_RESET_SLEEP_MIN_US,
++		     BCM63268_TIMER_RESET_SLEEP_MAX_US);
++
++	bcm63268_timer_reset_update(rcdev, id, false);
++	/*
++	 * Ensure component is taken out reset state by sleeping also after
++	 * deasserting the reset. Otherwise, the component may not be ready
++	 * for operation.
++	 */
++	usleep_range(BCM63268_TIMER_RESET_SLEEP_MIN_US,
++		     BCM63268_TIMER_RESET_SLEEP_MAX_US);
++
++	return 0;
++}
++
++static int bcm63268_timer_reset_status(struct reset_controller_dev *rcdev,
++				unsigned long id)
++{
++	struct bcm63268_tclkrst_hw *reset = to_bcm63268_timer_reset(rcdev);
++
++	return !(__raw_readl(reset->regs) & BIT(id));
++}
++
++static struct reset_control_ops bcm63268_timer_reset_ops = {
++	.assert = bcm63268_timer_reset_assert,
++	.deassert = bcm63268_timer_reset_deassert,
++	.reset = bcm63268_timer_reset_reset,
++	.status = bcm63268_timer_reset_status,
++};
++
++static int bcm63268_tclk_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	const struct bcm63268_tclk_table_entry *entry;
++	struct bcm63268_tclkrst_hw *hw;
++	struct clk_hw *clk;
++	u8 maxbit = 0;
++	int i, ret;
++
++	for (entry = bcm63268_timer_clocks; entry->name; entry++)
++		maxbit = max(maxbit, entry->bit);
++	maxbit++;
++
++	hw = devm_kzalloc(&pdev->dev, struct_size(hw, data.hws, maxbit),
++			  GFP_KERNEL);
++	if (!hw)
++		return -ENOMEM;
++
++	platform_set_drvdata(pdev, hw);
++
++	spin_lock_init(&hw->lock);
++
++	hw->data.num = maxbit;
++	for (i = 0; i < maxbit; i++)
++		hw->data.hws[i] = ERR_PTR(-ENODEV);
++
++	hw->regs = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(hw->regs))
++		return PTR_ERR(hw->regs);
++
++	for (entry = bcm63268_timer_clocks; entry->name; entry++) {
++		clk = devm_clk_hw_register_gate(dev, entry->name, NULL, 0,
++						hw->regs, entry->bit,
++						CLK_GATE_BIG_ENDIAN,
++						&hw->lock);
++		if (IS_ERR(clk))
++			return PTR_ERR(clk);
++
++		hw->data.hws[entry->bit] = clk;
++	}
++
++	ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_onecell_get,
++					  &hw->data);
++	if (ret)
++		return ret;
++
++	hw->rcdev.of_node = dev->of_node;
++	hw->rcdev.ops = &bcm63268_timer_reset_ops;
++
++	ret = devm_reset_controller_register(dev, &hw->rcdev);
++	if (ret)
++		dev_err(dev, "Failed to register reset controller\n");
++
++	return 0;
++}
++
++static const struct of_device_id bcm63268_tclk_dt_ids[] = {
++	{ .compatible = "brcm,bcm63268-timer-clocks" },
++	{ /* sentinel */ }
++};
++
++static struct platform_driver bcm63268_tclk = {
++	.probe = bcm63268_tclk_probe,
++	.driver = {
++		.name = "bcm63268-timer-clock",
++		.of_match_table = bcm63268_tclk_dt_ids,
++	},
++};
++builtin_platform_driver(bcm63268_tclk);
diff --git a/target/linux/generic/pending-5.15/920-mangle_bootargs.patch b/target/linux/generic/pending-5.15/920-mangle_bootargs.patch
index 2a02efe0aa989f..5f0a106ae4e9d8 100644
--- a/target/linux/generic/pending-5.15/920-mangle_bootargs.patch
+++ b/target/linux/generic/pending-5.15/920-mangle_bootargs.patch
@@ -13,7 +13,7 @@ Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
 
 --- a/init/Kconfig
 +++ b/init/Kconfig
-@@ -1810,6 +1810,15 @@ config EMBEDDED
+@@ -1814,6 +1814,15 @@ config EMBEDDED
  	  an embedded system so certain expert options are available
  	  for configuration.
  
diff --git a/target/linux/generic/pending-6.1/100-compiler.h-only-include-asm-rwonce.h-for-kernel-code.patch b/target/linux/generic/pending-6.1/100-compiler.h-only-include-asm-rwonce.h-for-kernel-code.patch
new file mode 100644
index 00000000000000..7b342e69623314
--- /dev/null
+++ b/target/linux/generic/pending-6.1/100-compiler.h-only-include-asm-rwonce.h-for-kernel-code.patch
@@ -0,0 +1,29 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 22 Oct 2020 22:00:03 +0200
+Subject: [PATCH] compiler.h: only include asm/rwonce.h for kernel code
+
+This header file is not in uapi, which makes any user space code that includes
+linux/compiler.h to fail with the error 'asm/rwonce.h: No such file or directory'
+
+Fixes: e506ea451254 ("compiler.h: Split {READ,WRITE}_ONCE definitions out into rwonce.h")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -203,6 +203,8 @@ void ftrace_likely_update(struct ftrace_
+ 	__v;								\
+ })
+ 
++#include <asm/rwonce.h>
++
+ #endif /* __KERNEL__ */
+ 
+ /*
+@@ -243,6 +245,4 @@ static inline void *offset_to_ptr(const
+  */
+ #define prevent_tail_call_optimization()	mb()
+ 
+-#include <asm/rwonce.h>
+-
+ #endif /* __LINUX_COMPILER_H */
diff --git a/target/linux/generic/pending-6.1/102-MIPS-only-process-negative-stack-offsets-on-stack-tr.patch b/target/linux/generic/pending-6.1/102-MIPS-only-process-negative-stack-offsets-on-stack-tr.patch
new file mode 100644
index 00000000000000..7ce3d491cd3270
--- /dev/null
+++ b/target/linux/generic/pending-6.1/102-MIPS-only-process-negative-stack-offsets-on-stack-tr.patch
@@ -0,0 +1,57 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 18 Apr 2018 10:50:05 +0200
+Subject: [PATCH] MIPS: only process negative stack offsets on stack traces
+
+Fixes endless back traces in cases where the compiler emits a stack
+pointer increase in a branch delay slot (probably for some form of
+function return).
+
+[    3.475442] BUG: MAX_STACK_TRACE_ENTRIES too low!
+[    3.480070] turning off the locking correctness validator.
+[    3.485521] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.14.34 #0
+[    3.491475] Stack : 00000000 00000000 00000000 00000000 80e0fce2 00000034 00000000 00000000
+[    3.499764]         87c3838c 80696377 8061047c 00000000 00000001 00000001 87c2d850 6534689f
+[    3.508059]         00000000 00000000 80e10000 00000000 00000000 000000cf 0000000f 00000000
+[    3.516353]         00000000 806a0000 00076891 00000000 00000000 00000000 ffffffff 00000000
+[    3.524648]         806c0000 00000004 80e10000 806a0000 00000003 80690000 00000000 80700000
+[    3.532942]         ...
+[    3.535362] Call Trace:
+[    3.537818] [<80010a48>] show_stack+0x58/0x100
+[    3.542207] [<804c2f78>] dump_stack+0xe8/0x170
+[    3.546613] [<80079f90>] save_trace+0xf0/0x110
+[    3.551010] [<8007b1ec>] mark_lock+0x33c/0x78c
+[    3.555413] [<8007bf48>] __lock_acquire+0x2ac/0x1a08
+[    3.560337] [<8007de60>] lock_acquire+0x64/0x8c
+[    3.564846] [<804e1570>] _raw_spin_lock_irqsave+0x54/0x78
+[    3.570186] [<801b618c>] kernfs_notify+0x94/0xac
+[    3.574770] [<801b7b10>] sysfs_notify+0x74/0xa0
+[    3.579257] [<801b618c>] kernfs_notify+0x94/0xac
+[    3.583839] [<801b7b10>] sysfs_notify+0x74/0xa0
+[    3.588329] [<801b618c>] kernfs_notify+0x94/0xac
+[    3.592911] [<801b7b10>] sysfs_notify+0x74/0xa0
+[    3.597401] [<801b618c>] kernfs_notify+0x94/0xac
+[    3.601983] [<801b7b10>] sysfs_notify+0x74/0xa0
+[    3.606473] [<801b618c>] kernfs_notify+0x94/0xac
+[    3.611055] [<801b7b10>] sysfs_notify+0x74/0xa0
+[    3.615545] [<801b618c>] kernfs_notify+0x94/0xac
+[    3.620125] [<801b7b10>] sysfs_notify+0x74/0xa0
+[    3.624619] [<801b618c>] kernfs_notify+0x94/0xac
+[    3.629197] [<801b7b10>] sysfs_notify+0x74/0xa0
+[    3.633691] [<801b618c>] kernfs_notify+0x94/0xac
+[    3.638269] [<801b7b10>] sysfs_notify+0x74/0xa0
+[    3.642763] [<801b618c>] kernfs_notify+0x94/0xac
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/arch/mips/kernel/process.c
++++ b/arch/mips/kernel/process.c
+@@ -394,6 +394,8 @@ static inline int is_sp_move_ins(union m
+ 
+ 	if (ip->i_format.opcode == addiu_op ||
+ 	    ip->i_format.opcode == daddiu_op) {
++		if (ip->i_format.simmediate > 0)
++			return 0;
+ 		*frame_size = -ip->i_format.simmediate;
+ 		return 1;
+ 	}
diff --git a/target/linux/generic/pending-6.1/103-kbuild-export-SUBARCH.patch b/target/linux/generic/pending-6.1/103-kbuild-export-SUBARCH.patch
new file mode 100644
index 00000000000000..e6480ac03e331b
--- /dev/null
+++ b/target/linux/generic/pending-6.1/103-kbuild-export-SUBARCH.patch
@@ -0,0 +1,21 @@
+From 173019b66dcc9d68ad9333aa744dad1e369b5aa8 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 9 Jul 2017 00:26:53 +0200
+Subject: [PATCH 34/34] kernel: add compile fix for linux 4.9 on x86
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/Makefile
++++ b/Makefile
+@@ -606,7 +606,7 @@ endif
+ # Allows the usage of unstable features in stable compilers.
+ export RUSTC_BOOTSTRAP := 1
+ 
+-export ARCH SRCARCH CONFIG_SHELL BASH HOSTCC KBUILD_HOSTCFLAGS CROSS_COMPILE LD CC HOSTPKG_CONFIG
++export ARCH SRCARCH SUBARCH CONFIG_SHELL BASH HOSTCC KBUILD_HOSTCFLAGS CROSS_COMPILE LD CC HOSTPKG_CONFIG
+ export RUSTC RUSTDOC RUSTFMT RUSTC_OR_CLIPPY_QUIET RUSTC_OR_CLIPPY BINDGEN CARGO
+ export HOSTRUSTC KBUILD_HOSTRUSTFLAGS
+ export CPP AR NM STRIP OBJCOPY OBJDUMP READELF PAHOLE RESOLVE_BTFIDS LEX YACC AWK INSTALLKERNEL
diff --git a/target/linux/generic/pending-6.1/110-v6.3-0001-spidev-Add-Silicon-Labs-EM3581-device-compatible.patch b/target/linux/generic/pending-6.1/110-v6.3-0001-spidev-Add-Silicon-Labs-EM3581-device-compatible.patch
new file mode 100644
index 00000000000000..ebeeae2f8fd636
--- /dev/null
+++ b/target/linux/generic/pending-6.1/110-v6.3-0001-spidev-Add-Silicon-Labs-EM3581-device-compatible.patch
@@ -0,0 +1,32 @@
+From f7982c726e02001afc19052fe48f642dfcbc00b2 Mon Sep 17 00:00:00 2001
+From: Vincent Tremblay <vincent@vtremblay.dev>
+Date: Mon, 26 Dec 2022 21:10:37 -0500
+Subject: [PATCH 1/2] spidev: Add Silicon Labs EM3581 device compatible
+
+Add compatible string for Silicon Labs EM3581 device.
+
+Note: This patch is adapted from a patch submitted to the for-next branch (v6.3).
+
+Signed-off-by: Vincent Tremblay <vincent@vtremblay.dev>
+---
+ drivers/spi/spidev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -700,6 +700,7 @@ static const struct spi_device_id spidev
+ 	{ .name = "m53cpld" },
+ 	{ .name = "spi-petra" },
+ 	{ .name = "spi-authenta" },
++	{ .name = "em3581" },
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(spi, spidev_spi_ids);
+@@ -726,6 +727,7 @@ static const struct of_device_id spidev_
+ 	{ .compatible = "menlo,m53cpld", .data = &spidev_of_check },
+ 	{ .compatible = "cisco,spi-petra", .data = &spidev_of_check },
+ 	{ .compatible = "micron,spi-authenta", .data = &spidev_of_check },
++	{ .compatible = "silabs,em3581", .data = &spidev_of_check },
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(of, spidev_dt_ids);
diff --git a/target/linux/generic/pending-6.1/110-v6.3-0002-spidev-Add-Silicon-Labs-SI3210-device-compatible.patch b/target/linux/generic/pending-6.1/110-v6.3-0002-spidev-Add-Silicon-Labs-SI3210-device-compatible.patch
new file mode 100644
index 00000000000000..db5b5800f4b1a0
--- /dev/null
+++ b/target/linux/generic/pending-6.1/110-v6.3-0002-spidev-Add-Silicon-Labs-SI3210-device-compatible.patch
@@ -0,0 +1,32 @@
+From 536581825219e97fa2ae0c4de35605d2f6311416 Mon Sep 17 00:00:00 2001
+From: Vincent Tremblay <vincent@vtremblay.dev>
+Date: Tue, 27 Dec 2022 09:00:58 -0500
+Subject: [PATCH 2/2] spidev: Add Silicon Labs SI3210 device compatible
+
+Add compatible string for Silicon Labs SI3210 device.
+
+Note: This patch is adapted from a patch submitted to the for-next branch (v6.3).
+
+Signed-off-by: Vincent Tremblay <vincent@vtremblay.dev>
+---
+ drivers/spi/spidev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -701,6 +701,7 @@ static const struct spi_device_id spidev
+ 	{ .name = "spi-petra" },
+ 	{ .name = "spi-authenta" },
+ 	{ .name = "em3581" },
++	{ .name = "si3210" },
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(spi, spidev_spi_ids);
+@@ -728,6 +729,7 @@ static const struct of_device_id spidev_
+ 	{ .compatible = "cisco,spi-petra", .data = &spidev_of_check },
+ 	{ .compatible = "micron,spi-authenta", .data = &spidev_of_check },
+ 	{ .compatible = "silabs,em3581", .data = &spidev_of_check },
++	{ .compatible = "silabs,si3210", .data = &spidev_of_check },
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(of, spidev_dt_ids);
diff --git a/target/linux/generic/pending-6.1/111-watchdog-max63xx_wdt-Add-support-for-specifying-WDI-.patch b/target/linux/generic/pending-6.1/111-watchdog-max63xx_wdt-Add-support-for-specifying-WDI-.patch
new file mode 100644
index 00000000000000..d6b10491f830e5
--- /dev/null
+++ b/target/linux/generic/pending-6.1/111-watchdog-max63xx_wdt-Add-support-for-specifying-WDI-.patch
@@ -0,0 +1,75 @@
+From bd1b9f66d5134e518419f4c4dacf1884c1616983 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
+Date: Thu, 28 Apr 2022 11:13:23 +0200
+Subject: [PATCH] watchdog: max63xx_wdt: Add support for specifying WDI logic
+ via GPIO
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+On some boards is WDI logic of max6370 chip connected via GPIO.
+So extend max63xx_wdt driver to allow specifying WDI logic via GPIO.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+---
+ drivers/watchdog/max63xx_wdt.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/drivers/watchdog/max63xx_wdt.c
++++ b/drivers/watchdog/max63xx_wdt.c
+@@ -27,6 +27,7 @@
+ #include <linux/io.h>
+ #include <linux/slab.h>
+ #include <linux/property.h>
++#include <linux/gpio/consumer.h>
+ 
+ #define DEFAULT_HEARTBEAT 60
+ #define MAX_HEARTBEAT     60
+@@ -53,6 +54,9 @@ struct max63xx_wdt {
+ 	void __iomem *base;
+ 	spinlock_t lock;
+ 
++	/* GPIOs */
++	struct gpio_desc *gpio_wdi;
++
+ 	/* WDI and WSET bits write access routines */
+ 	void (*ping)(struct max63xx_wdt *wdt);
+ 	void (*set)(struct max63xx_wdt *wdt, u8 set);
+@@ -158,6 +162,17 @@ static const struct watchdog_info max63x
+ 	.identity = "max63xx Watchdog",
+ };
+ 
++static void max63xx_gpio_ping(struct max63xx_wdt *wdt)
++{
++	spin_lock(&wdt->lock);
++
++	gpiod_set_value(wdt->gpio_wdi, 1);
++	udelay(1);
++	gpiod_set_value(wdt->gpio_wdi, 0);
++
++	spin_unlock(&wdt->lock);
++}
++
+ static void max63xx_mmap_ping(struct max63xx_wdt *wdt)
+ {
+ 	u8 val;
+@@ -225,10 +240,19 @@ static int max63xx_wdt_probe(struct plat
+ 		return -EINVAL;
+ 	}
+ 
++	wdt->gpio_wdi = devm_gpiod_get(dev, NULL, GPIOD_FLAGS_BIT_DIR_OUT);
++	if (IS_ERR(wdt->gpio_wdi) && PTR_ERR(wdt->gpio_wdi) != -ENOENT)
++		return dev_err_probe(dev, PTR_ERR(wdt->gpio_wdi),
++				     "unable to request gpio: %ld\n",
++				     PTR_ERR(wdt->gpio_wdi));
++
+ 	err = max63xx_mmap_init(pdev, wdt);
+ 	if (err)
+ 		return err;
+ 
++	if (!IS_ERR(wdt->gpio_wdi))
++		wdt->ping = max63xx_gpio_ping;
++
+ 	platform_set_drvdata(pdev, &wdt->wdd);
+ 	watchdog_set_drvdata(&wdt->wdd, wdt);
+ 
diff --git a/target/linux/generic/pending-6.1/120-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch b/target/linux/generic/pending-6.1/120-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch
new file mode 100644
index 00000000000000..c381bcf8e1923a
--- /dev/null
+++ b/target/linux/generic/pending-6.1/120-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch
@@ -0,0 +1,82 @@
+From: Tobias Wolf <dev-NTEO@vplace.de>
+Subject: mm: Fix alloc_node_mem_map with ARCH_PFN_OFFSET calculation
+
+An rt288x (ralink) based router (Belkin F5D8235 v1) does not boot with any
+kernel beyond version 4.3 resulting in:
+
+BUG: Bad page state in process swapper  pfn:086ac
+
+bisect resulted in:
+
+a1c34a3bf00af2cede839879502e12dc68491ad5 is the first bad commit
+commit a1c34a3bf00af2cede839879502e12dc68491ad5
+Author: Laura Abbott <laura@labbott.name>
+Date:   Thu Nov 5 18:48:46 2015 -0800
+
+    mm: Don't offset memmap for flatmem
+
+    Srinivas Kandagatla reported bad page messages when trying to remove the
+    bottom 2MB on an ARM based IFC6410 board
+
+      BUG: Bad page state in process swapper  pfn:fffa8
+      page:ef7fb500 count:0 mapcount:0 mapping:  (null) index:0x0
+      flags: 0x96640253(locked|error|dirty|active|arch_1|reclaim|mlocked)
+      page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
+      bad because of flags:
+      flags: 0x200041(locked|active|mlocked)
+      Modules linked in:
+      CPU: 0 PID: 0 Comm: swapper Not tainted 3.19.0-rc3-00007-g412f9ba-dirty
+#816
+      Hardware name: Qualcomm (Flattened Device Tree)
+        unwind_backtrace
+        show_stack
+        dump_stack
+        bad_page
+        free_pages_prepare
+        free_hot_cold_page
+        __free_pages
+        free_highmem_page
+        mem_init
+        start_kernel
+      Disabling lock debugging due to kernel taint
+    [...]
+:040000 040000 2de013c372345fd471cd58f0553c9b38b0ef1cc4
+0a8156f848733dfa21e16c196dfb6c0a76290709 M      mm
+
+This fix for ARM does not account ARCH_PFN_OFFSET for mem_map as later used by
+page_to_pfn anymore.
+
+The following output was generated with two hacked in printk statements:
+
+printk("before %p vs. %p or %p\n", mem_map, mem_map - offset, mem_map -
+(pgdat->node_start_pfn - ARCH_PFN_OFFSET));
+		if (page_to_pfn(mem_map) != pgdat->node_start_pfn)
+			mem_map -= offset + (pgdat->node_start_pfn - ARCH_PFN_OFFSET);
+printk("after %p\n", mem_map);
+
+Output:
+
+[    0.000000] before 8861b280 vs. 8861b280 or 8851b280
+[    0.000000] after 8851b280
+
+As seen in the first line mem_map with subtraction of offset does not equal the
+mem_map after subtraction of ARCH_PFN_OFFSET.
+
+After adding the offset of ARCH_PFN_OFFSET as well to mem_map as the
+previously calculated offset is zero for the named platform it is able to boot
+4.4 and 4.9-rc7 again.
+
+Signed-off-by: Tobias Wolf <dev-NTEO@vplace.de>
+---
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -7911,7 +7911,7 @@ static void __init alloc_node_mem_map(st
+ 	if (pgdat == NODE_DATA(0)) {
+ 		mem_map = NODE_DATA(0)->node_mem_map;
+ 		if (page_to_pfn(mem_map) != pgdat->node_start_pfn)
+-			mem_map -= offset;
++			mem_map -= offset + (pgdat->node_start_pfn - ARCH_PFN_OFFSET);
+ 	}
+ #endif
+ }
diff --git a/target/linux/generic/pending-6.1/140-jffs2-use-.rename2-and-add-RENAME_WHITEOUT-support.patch b/target/linux/generic/pending-6.1/140-jffs2-use-.rename2-and-add-RENAME_WHITEOUT-support.patch
new file mode 100644
index 00000000000000..8f40ae3ba2400d
--- /dev/null
+++ b/target/linux/generic/pending-6.1/140-jffs2-use-.rename2-and-add-RENAME_WHITEOUT-support.patch
@@ -0,0 +1,81 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: jffs2: use .rename2 and add RENAME_WHITEOUT support
+
+It is required for renames on overlayfs
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/fs/jffs2/dir.c
++++ b/fs/jffs2/dir.c
+@@ -614,8 +614,8 @@ static int jffs2_rmdir (struct inode *di
+ 	return ret;
+ }
+ 
+-static int jffs2_mknod (struct user_namespace *mnt_userns, struct inode *dir_i,
+-		        struct dentry *dentry, umode_t mode, dev_t rdev)
++static int __jffs2_mknod (struct user_namespace *mnt_userns, struct inode *dir_i,
++			  struct dentry *dentry, umode_t mode, dev_t rdev, bool whiteout)
+ {
+ 	struct jffs2_inode_info *f, *dir_f;
+ 	struct jffs2_sb_info *c;
+@@ -754,7 +754,11 @@ static int jffs2_mknod (struct user_name
+ 	mutex_unlock(&dir_f->sem);
+ 	jffs2_complete_reservation(c);
+ 
+-	d_instantiate_new(dentry, inode);
++	if (!whiteout)
++		d_instantiate_new(dentry, inode);
++	else
++		unlock_new_inode(inode);
++
+ 	return 0;
+ 
+  fail:
+@@ -762,6 +766,19 @@ static int jffs2_mknod (struct user_name
+ 	return ret;
+ }
+ 
++static int jffs2_mknod (struct user_namespace *mnt_userns, struct inode *dir_i,
++			  struct dentry *dentry, umode_t mode, dev_t rdev)
++{
++	return __jffs2_mknod(mnt_userns, dir_i, dentry, mode, rdev, false);
++}
++
++static int jffs2_whiteout (struct user_namespace *mnt_userns, struct inode *old_dir,
++			    struct dentry *old_dentry)
++{
++	return __jffs2_mknod(mnt_userns, old_dir, old_dentry, S_IFCHR | WHITEOUT_MODE,
++			     WHITEOUT_DEV, true);
++}
++
+ static int jffs2_rename (struct user_namespace *mnt_userns,
+ 			 struct inode *old_dir_i, struct dentry *old_dentry,
+ 			 struct inode *new_dir_i, struct dentry *new_dentry,
+@@ -773,7 +790,7 @@ static int jffs2_rename (struct user_nam
+ 	uint8_t type;
+ 	uint32_t now;
+ 
+-	if (flags & ~RENAME_NOREPLACE)
++	if (flags & ~(RENAME_NOREPLACE|RENAME_WHITEOUT))
+ 		return -EINVAL;
+ 
+ 	/* The VFS will check for us and prevent trying to rename a
+@@ -839,9 +856,14 @@ static int jffs2_rename (struct user_nam
+ 	if (d_is_dir(old_dentry) && !victim_f)
+ 		inc_nlink(new_dir_i);
+ 
+-	/* Unlink the original */
+-	ret = jffs2_do_unlink(c, JFFS2_INODE_INFO(old_dir_i),
+-			      old_dentry->d_name.name, old_dentry->d_name.len, NULL, now);
++	if (flags & RENAME_WHITEOUT)
++		/* Replace with whiteout */
++		ret = jffs2_whiteout(mnt_userns, old_dir_i, old_dentry);
++	else
++		/* Unlink the original */
++		ret = jffs2_do_unlink(c, JFFS2_INODE_INFO(old_dir_i),
++				      old_dentry->d_name.name,
++				      old_dentry->d_name.len, NULL, now);
+ 
+ 	/* We don't touch inode->i_nlink */
+ 
diff --git a/target/linux/generic/pending-6.1/141-jffs2-add-RENAME_EXCHANGE-support.patch b/target/linux/generic/pending-6.1/141-jffs2-add-RENAME_EXCHANGE-support.patch
new file mode 100644
index 00000000000000..f58fc791d28157
--- /dev/null
+++ b/target/linux/generic/pending-6.1/141-jffs2-add-RENAME_EXCHANGE-support.patch
@@ -0,0 +1,73 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: jffs2: add RENAME_EXCHANGE support
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/fs/jffs2/dir.c
++++ b/fs/jffs2/dir.c
+@@ -787,18 +787,31 @@ static int jffs2_rename (struct user_nam
+ 	int ret;
+ 	struct jffs2_sb_info *c = JFFS2_SB_INFO(old_dir_i->i_sb);
+ 	struct jffs2_inode_info *victim_f = NULL;
++	struct inode *fst_inode = d_inode(old_dentry);
++	struct inode *snd_inode = d_inode(new_dentry);
+ 	uint8_t type;
+ 	uint32_t now;
+ 
+-	if (flags & ~(RENAME_NOREPLACE|RENAME_WHITEOUT))
++	if (flags & ~(RENAME_NOREPLACE|RENAME_WHITEOUT|RENAME_EXCHANGE))
+ 		return -EINVAL;
+ 
++	if ((flags & RENAME_EXCHANGE) && (old_dir_i != new_dir_i)) {
++		if (S_ISDIR(fst_inode->i_mode) && !S_ISDIR(snd_inode->i_mode)) {
++			inc_nlink(new_dir_i);
++			drop_nlink(old_dir_i);
++		}
++		else if (!S_ISDIR(fst_inode->i_mode) && S_ISDIR(snd_inode->i_mode)) {
++			drop_nlink(new_dir_i);
++			inc_nlink(old_dir_i);
++		}
++	}
++
+ 	/* The VFS will check for us and prevent trying to rename a
+ 	 * file over a directory and vice versa, but if it's a directory,
+ 	 * the VFS can't check whether the victim is empty. The filesystem
+ 	 * needs to do that for itself.
+ 	 */
+-	if (d_really_is_positive(new_dentry)) {
++	if (d_really_is_positive(new_dentry) && !(flags & RENAME_EXCHANGE)) {
+ 		victim_f = JFFS2_INODE_INFO(d_inode(new_dentry));
+ 		if (d_is_dir(new_dentry)) {
+ 			struct jffs2_full_dirent *fd;
+@@ -833,7 +846,7 @@ static int jffs2_rename (struct user_nam
+ 	if (ret)
+ 		return ret;
+ 
+-	if (victim_f) {
++	if (victim_f && !(flags & RENAME_EXCHANGE)) {
+ 		/* There was a victim. Kill it off nicely */
+ 		if (d_is_dir(new_dentry))
+ 			clear_nlink(d_inode(new_dentry));
+@@ -859,6 +872,12 @@ static int jffs2_rename (struct user_nam
+ 	if (flags & RENAME_WHITEOUT)
+ 		/* Replace with whiteout */
+ 		ret = jffs2_whiteout(mnt_userns, old_dir_i, old_dentry);
++	else if (flags & RENAME_EXCHANGE)
++		/* Replace the original */
++		ret = jffs2_do_link(c, JFFS2_INODE_INFO(old_dir_i),
++				    d_inode(new_dentry)->i_ino, type,
++				    old_dentry->d_name.name, old_dentry->d_name.len,
++				    now);
+ 	else
+ 		/* Unlink the original */
+ 		ret = jffs2_do_unlink(c, JFFS2_INODE_INFO(old_dir_i),
+@@ -890,7 +909,7 @@ static int jffs2_rename (struct user_nam
+ 		return ret;
+ 	}
+ 
+-	if (d_is_dir(old_dentry))
++	if (d_is_dir(old_dentry) && !(flags & RENAME_EXCHANGE))
+ 		drop_nlink(old_dir_i);
+ 
+ 	new_dir_i->i_mtime = new_dir_i->i_ctime = old_dir_i->i_mtime = old_dir_i->i_ctime = ITIME(now);
diff --git a/target/linux/generic/pending-6.1/142-jffs2-add-splice-ops.patch b/target/linux/generic/pending-6.1/142-jffs2-add-splice-ops.patch
new file mode 100644
index 00000000000000..de847a1f5cd1fc
--- /dev/null
+++ b/target/linux/generic/pending-6.1/142-jffs2-add-splice-ops.patch
@@ -0,0 +1,20 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: jffs2: add splice ops
+
+Add splice_read using generic_file_splice_read.
+Add splice_write using iter_file_splice_write
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/fs/jffs2/file.c
++++ b/fs/jffs2/file.c
+@@ -53,6 +53,8 @@ const struct file_operations jffs2_file_
+ 	.open =		generic_file_open,
+  	.read_iter =	generic_file_read_iter,
+  	.write_iter =	generic_file_write_iter,
++	.splice_read =	generic_file_splice_read,
++	.splice_write =	iter_file_splice_write,
+ 	.unlocked_ioctl=jffs2_ioctl,
+ 	.mmap =		generic_file_readonly_mmap,
+ 	.fsync =	jffs2_fsync,
diff --git a/target/linux/generic/pending-6.1/143-jffs2-reduce-stack-usage-in-jffs2_build_xattr_subsys.patch b/target/linux/generic/pending-6.1/143-jffs2-reduce-stack-usage-in-jffs2_build_xattr_subsys.patch
new file mode 100644
index 00000000000000..e5a86dd29fe174
--- /dev/null
+++ b/target/linux/generic/pending-6.1/143-jffs2-reduce-stack-usage-in-jffs2_build_xattr_subsys.patch
@@ -0,0 +1,121 @@
+From eee53f6eb7561f516b9c4bac829ce31c48096130 Mon Sep 17 00:00:00 2001
+From: Fabian Frederick <fabf@skynet.be>
+Date: Tue, 9 May 2017 22:30:03 +0200
+Subject: [PATCH] jffs2: reduce stack usage in jffs2_build_xattr_subsystem()
+
+Use kcalloc() for allocation/flush of 128 pointers table to
+reduce stack usage.
+
+Function now returns -ENOMEM or 0 on success.
+
+stackusage
+Before:
+./fs/jffs2/xattr.c:775  jffs2_build_xattr_subsystem     1208
+dynamic,bounded
+
+After:
+./fs/jffs2/xattr.c:775  jffs2_build_xattr_subsystem     192
+dynamic,bounded
+
+Also update definition when CONFIG_JFFS2_FS_XATTR is not enabled
+
+Tested with an MTD mount point and some user set/getfattr.
+
+Many current target on OpenWRT also suffer from a compilation warning
+(that become an error with CONFIG_WERROR) with the following output:
+
+fs/jffs2/xattr.c: In function 'jffs2_build_xattr_subsystem':
+fs/jffs2/xattr.c:887:1: error: the frame size of 1088 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
+  887 | }
+      | ^
+
+Using dynamic allocation fix this compilation warning.
+
+Fixes: c9f700f840bd ("[JFFS2][XATTR] using 'delete marker' for xdatum/xref deletion")
+Reported-by: Tim Gardner <tim.gardner@canonical.com>
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Ron Economos <re@w6rz.net>
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Fabian Frederick <fabf@skynet.be>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Cc: stable@vger.kernel.org
+---
+ fs/jffs2/build.c |  5 ++++-
+ fs/jffs2/xattr.c | 13 +++++++++----
+ fs/jffs2/xattr.h |  4 ++--
+ 3 files changed, 15 insertions(+), 7 deletions(-)
+
+--- a/fs/jffs2/build.c
++++ b/fs/jffs2/build.c
+@@ -211,7 +211,10 @@ static int jffs2_build_filesystem(struct
+ 		ic->scan_dents = NULL;
+ 		cond_resched();
+ 	}
+-	jffs2_build_xattr_subsystem(c);
++	ret = jffs2_build_xattr_subsystem(c);
++	if (ret)
++		goto exit;
++
+ 	c->flags &= ~JFFS2_SB_FLAG_BUILDING;
+ 
+ 	dbg_fsbuild("FS build complete\n");
+--- a/fs/jffs2/xattr.c
++++ b/fs/jffs2/xattr.c
+@@ -772,10 +772,10 @@ void jffs2_clear_xattr_subsystem(struct
+ }
+ 
+ #define XREF_TMPHASH_SIZE	(128)
+-void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
++int jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
+ {
+ 	struct jffs2_xattr_ref *ref, *_ref;
+-	struct jffs2_xattr_ref *xref_tmphash[XREF_TMPHASH_SIZE];
++	struct jffs2_xattr_ref **xref_tmphash;
+ 	struct jffs2_xattr_datum *xd, *_xd;
+ 	struct jffs2_inode_cache *ic;
+ 	struct jffs2_raw_node_ref *raw;
+@@ -784,9 +784,12 @@ void jffs2_build_xattr_subsystem(struct
+ 
+ 	BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
+ 
++	xref_tmphash = kcalloc(XREF_TMPHASH_SIZE,
++			       sizeof(struct jffs2_xattr_ref *), GFP_KERNEL);
++	if (!xref_tmphash)
++		return -ENOMEM;
++
+ 	/* Phase.1 : Merge same xref */
+-	for (i=0; i < XREF_TMPHASH_SIZE; i++)
+-		xref_tmphash[i] = NULL;
+ 	for (ref=c->xref_temp; ref; ref=_ref) {
+ 		struct jffs2_xattr_ref *tmp;
+ 
+@@ -884,6 +887,8 @@ void jffs2_build_xattr_subsystem(struct
+ 		     "%u of xref (%u dead, %u orphan) found.\n",
+ 		     xdatum_count, xdatum_unchecked_count, xdatum_orphan_count,
+ 		     xref_count, xref_dead_count, xref_orphan_count);
++	kfree(xref_tmphash);
++	return 0;
+ }
+ 
+ struct jffs2_xattr_datum *jffs2_setup_xattr_datum(struct jffs2_sb_info *c,
+--- a/fs/jffs2/xattr.h
++++ b/fs/jffs2/xattr.h
+@@ -71,7 +71,7 @@ static inline int is_xattr_ref_dead(stru
+ #ifdef CONFIG_JFFS2_FS_XATTR
+ 
+ extern void jffs2_init_xattr_subsystem(struct jffs2_sb_info *c);
+-extern void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c);
++extern int jffs2_build_xattr_subsystem(struct jffs2_sb_info *c);
+ extern void jffs2_clear_xattr_subsystem(struct jffs2_sb_info *c);
+ 
+ extern struct jffs2_xattr_datum *jffs2_setup_xattr_datum(struct jffs2_sb_info *c,
+@@ -103,7 +103,7 @@ extern ssize_t jffs2_listxattr(struct de
+ #else
+ 
+ #define jffs2_init_xattr_subsystem(c)
+-#define jffs2_build_xattr_subsystem(c)
++#define jffs2_build_xattr_subsystem(c)		(0)
+ #define jffs2_clear_xattr_subsystem(c)
+ 
+ #define jffs2_xattr_do_crccheck_inode(c, ic)
diff --git a/target/linux/generic/pending-6.1/150-bridge_allow_receiption_on_disabled_port.patch b/target/linux/generic/pending-6.1/150-bridge_allow_receiption_on_disabled_port.patch
new file mode 100644
index 00000000000000..93a2d146b5ad84
--- /dev/null
+++ b/target/linux/generic/pending-6.1/150-bridge_allow_receiption_on_disabled_port.patch
@@ -0,0 +1,45 @@
+From: Stephen Hemminger <stephen@networkplumber.org>
+Subject: bridge: allow receiption on disabled port
+
+When an ethernet device is enslaved to a bridge, and the bridge STP
+detects loss of carrier (or operational state down), then normally
+packet receiption is blocked.
+
+This breaks control applications like WPA which maybe expecting to
+receive packets to negotiate to bring link up. The bridge needs to
+block forwarding packets from these disabled ports, but there is no
+hard requirement to not allow local packet delivery.
+
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -222,6 +222,9 @@ static void __br_handle_local_finish(str
+ /* note: already called with rcu_read_lock */
+ static int br_handle_local_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
+ {
++	struct net_bridge_port *p = br_port_get_rcu(skb->dev);
++
++	if (p->state != BR_STATE_DISABLED)
+ 	__br_handle_local_finish(skb);
+ 
+ 	/* return 1 to signal the okfn() was called so it's ok to use the skb */
+@@ -390,6 +393,17 @@ forward:
+ 		goto defer_stp_filtering;
+ 
+ 	switch (p->state) {
++	case BR_STATE_DISABLED:
++		if (ether_addr_equal(p->br->dev->dev_addr, dest))
++			skb->pkt_type = PACKET_HOST;
++
++		if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING,
++			dev_net(skb->dev), NULL, skb, skb->dev, NULL,
++			br_handle_local_finish) == 1) {
++			return RX_HANDLER_PASS;
++		}
++		break;
++
+ 	case BR_STATE_FORWARDING:
+ 	case BR_STATE_LEARNING:
+ defer_stp_filtering:
diff --git a/target/linux/generic/pending-6.1/160-workqueue-fix-enum-type-for-gcc-13.patch b/target/linux/generic/pending-6.1/160-workqueue-fix-enum-type-for-gcc-13.patch
new file mode 100644
index 00000000000000..82076121ac3c41
--- /dev/null
+++ b/target/linux/generic/pending-6.1/160-workqueue-fix-enum-type-for-gcc-13.patch
@@ -0,0 +1,44 @@
+From 525ff9c2965770762b81d679820552a208070d59 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Tue, 17 Jan 2023 17:40:35 +0100
+Subject: workqueue: fix enum type for gcc-13
+
+In gcc-13, the WORK_STRUCT_WQ_DATA_MASK constant is a signed 64-bit
+type on 32-bit architectures because the enum definition has both
+negative numbers and numbers above LONG_MAX in it:
+
+kernel/workqueue.c: In function 'get_work_pwq':
+kernel/workqueue.c:709:24: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
+  709 |                 return (void *)(data & WORK_STRUCT_WQ_DATA_MASK);
+      |                        ^
+kernel/workqueue.c: In function 'get_work_pool':
+kernel/workqueue.c:737:25: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
+  737 |                 return ((struct pool_workqueue *)
+      |                         ^
+kernel/workqueue.c: In function 'get_work_pool_id':
+kernel/workqueue.c:759:25: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
+  759 |                 return ((struct pool_workqueue *)
+      |                         ^
+
+Change the enum definition to ensure all values can fit into
+the range of 'unsigned long' on all architectures.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Tested-by: Thierry Reding <treding@nvidia.com>
+Tested-by: Lai Jiangshan<jiangshanlai@gmail.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+---
+ include/linux/workqueue.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/workqueue.h
++++ b/include/linux/workqueue.h
+@@ -83,7 +83,7 @@ enum {
+ 
+ 	/* convenience constants */
+ 	WORK_STRUCT_FLAG_MASK	= (1UL << WORK_STRUCT_FLAG_BITS) - 1,
+-	WORK_STRUCT_WQ_DATA_MASK = ~WORK_STRUCT_FLAG_MASK,
++	WORK_STRUCT_WQ_DATA_MASK = (unsigned long)~WORK_STRUCT_FLAG_MASK,
+ 	WORK_STRUCT_NO_POOL	= (unsigned long)WORK_OFFQ_POOL_NONE << WORK_OFFQ_POOL_SHIFT,
+ 
+ 	/* bit mask for work_busy() return values */
diff --git a/target/linux/generic/pending-6.1/190-rtc-rs5c372-support_alarms_up_to_1_week.patch b/target/linux/generic/pending-6.1/190-rtc-rs5c372-support_alarms_up_to_1_week.patch
new file mode 100644
index 00000000000000..2f5c2228c7a4e2
--- /dev/null
+++ b/target/linux/generic/pending-6.1/190-rtc-rs5c372-support_alarms_up_to_1_week.patch
@@ -0,0 +1,94 @@
+From: Daniel González Cabanelas <dgcbueu@gmail.com>
+Subject: [PATCH 1/2] rtc: rs5c372: support alarms up to 1 week
+
+The Ricoh R2221x, R2223x, RS5C372, RV5C387A chips can handle 1 week
+alarms.
+
+Read the "wday" alarm register and convert it to a date to support up 1
+week in our driver.
+
+Signed-off-by: Daniel González Cabanelas <dgcbueu@gmail.com>
+---
+ drivers/rtc/rtc-rs5c372.c | 48 ++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 42 insertions(+), 6 deletions(-)
+
+--- a/drivers/rtc/rtc-rs5c372.c
++++ b/drivers/rtc/rtc-rs5c372.c
+@@ -399,7 +399,9 @@ static int rs5c_read_alarm(struct device
+ {
+ 	struct i2c_client	*client = to_i2c_client(dev);
+ 	struct rs5c372		*rs5c = i2c_get_clientdata(client);
+-	int			status;
++	int			status, wday_offs;
++	struct rtc_time 	rtc;
++	unsigned long 		alarm_secs;
+ 
+ 	status = rs5c_get_regs(rs5c);
+ 	if (status < 0)
+@@ -409,6 +411,30 @@ static int rs5c_read_alarm(struct device
+ 	t->time.tm_sec = 0;
+ 	t->time.tm_min = bcd2bin(rs5c->regs[RS5C_REG_ALARM_A_MIN] & 0x7f);
+ 	t->time.tm_hour = rs5c_reg2hr(rs5c, rs5c->regs[RS5C_REG_ALARM_A_HOURS]);
++	t->time.tm_wday = ffs(rs5c->regs[RS5C_REG_ALARM_A_WDAY] & 0x7f) - 1;
++
++	/* determine the day, month and year based on alarm wday, taking as a
++	 * reference the current time from the rtc
++	 */
++	status = rs5c372_rtc_read_time(dev, &rtc);
++	if (status < 0)
++		return status;
++
++	wday_offs = t->time.tm_wday - rtc.tm_wday;
++	alarm_secs = mktime64(rtc.tm_year + 1900,
++			      rtc.tm_mon + 1,
++			      rtc.tm_mday + wday_offs,
++			      t->time.tm_hour,
++			      t->time.tm_min,
++			      t->time.tm_sec);
++
++	if (wday_offs < 0 || (wday_offs == 0 &&
++			      (t->time.tm_hour < rtc.tm_hour ||
++			       (t->time.tm_hour == rtc.tm_hour &&
++				t->time.tm_min <= rtc.tm_min))))
++		alarm_secs += 7 * 86400;
++
++	rtc_time64_to_tm(alarm_secs, &t->time);
+ 
+ 	/* ... and status */
+ 	t->enabled = !!(rs5c->regs[RS5C_REG_CTRL1] & RS5C_CTRL1_AALE);
+@@ -423,12 +449,20 @@ static int rs5c_set_alarm(struct device
+ 	struct rs5c372		*rs5c = i2c_get_clientdata(client);
+ 	int			status, addr, i;
+ 	unsigned char		buf[3];
++	struct rtc_time 	rtc_tm;
++	unsigned long 		rtc_secs, alarm_secs;
+ 
+-	/* only handle up to 24 hours in the future, like RTC_ALM_SET */
+-	if (t->time.tm_mday != -1
+-			|| t->time.tm_mon != -1
+-			|| t->time.tm_year != -1)
++	/* chip only can handle alarms up to one week in the future*/
++	status = rs5c372_rtc_read_time(dev, &rtc_tm);
++	if (status)
++		return status;
++	rtc_secs = rtc_tm_to_time64(&rtc_tm);
++	alarm_secs = rtc_tm_to_time64(&t->time);
++	if (alarm_secs >= rtc_secs + 7 * 86400) {
++		dev_err(dev, "%s: alarm maximum is one week in the future (%d)\n",
++			__func__, status);
+ 		return -EINVAL;
++	}
+ 
+ 	/* REVISIT: round up tm_sec */
+ 
+@@ -449,7 +483,9 @@ static int rs5c_set_alarm(struct device
+ 	/* set alarm */
+ 	buf[0] = bin2bcd(t->time.tm_min);
+ 	buf[1] = rs5c_hr2reg(rs5c, t->time.tm_hour);
+-	buf[2] = 0x7f;	/* any/all days */
++	/* each bit is the day of the week, 0x7f means all days */
++	buf[2] = (t->time.tm_wday >= 0 && t->time.tm_wday < 7) ?
++		  BIT(t->time.tm_wday) : 0x7f;
+ 
+ 	for (i = 0; i < sizeof(buf); i++) {
+ 		addr = RS5C_ADDR(RS5C_REG_ALARM_A_MIN + i);
diff --git a/target/linux/generic/pending-6.1/191-rtc-rs5c372-let_the_alarm_to_be_used_as_wakeup_source.patch b/target/linux/generic/pending-6.1/191-rtc-rs5c372-let_the_alarm_to_be_used_as_wakeup_source.patch
new file mode 100644
index 00000000000000..a9a5cdf8ba2421
--- /dev/null
+++ b/target/linux/generic/pending-6.1/191-rtc-rs5c372-let_the_alarm_to_be_used_as_wakeup_source.patch
@@ -0,0 +1,71 @@
+From: Daniel González Cabanelas <dgcbueu@gmail.com>
+Subject: [PATCH 2/2] rtc: rs5c372: let the alarm to be used as wakeup source
+
+Currently there is no use for the interrupts on the rs5c372 RTC and the
+wakealarm isn't enabled. There are some devices like NASes which use this
+RTC to wake up from the power off state when the INTR pin is activated by
+the alarm clock.
+
+Enable the alarm and let to be used as a wakeup source.
+
+Tested on a Buffalo LS421DE NAS.
+
+Signed-off-by: Daniel González Cabanelas <dgcbueu@gmail.com>
+---
+ drivers/rtc/rtc-rs5c372.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/rtc/rtc-rs5c372.c
++++ b/drivers/rtc/rtc-rs5c372.c
+@@ -833,6 +833,7 @@ static int rs5c372_probe(struct i2c_clie
+ 	int err = 0;
+ 	int smbus_mode = 0;
+ 	struct rs5c372 *rs5c372;
++	bool rs5c372_can_wakeup_device = false;
+ 
+ 	dev_dbg(&client->dev, "%s\n", __func__);
+ 
+@@ -868,6 +869,12 @@ static int rs5c372_probe(struct i2c_clie
+ 	else
+ 		rs5c372->type = id->driver_data;
+ 
++#ifdef CONFIG_OF
++	if(of_property_read_bool(client->dev.of_node,
++					      "wakeup-source"))
++		rs5c372_can_wakeup_device = true;
++#endif
++
+ 	/* we read registers 0x0f then 0x00-0x0f; skip the first one */
+ 	rs5c372->regs = &rs5c372->buf[1];
+ 	rs5c372->smbus = smbus_mode;
+@@ -901,6 +908,8 @@ static int rs5c372_probe(struct i2c_clie
+ 		goto exit;
+ 	}
+ 
++	rs5c372->has_irq = 1;
++
+ 	/* if the oscillator lost power and no other software (like
+ 	 * the bootloader) set it up, do it here.
+ 	 *
+@@ -927,6 +936,10 @@ static int rs5c372_probe(struct i2c_clie
+ 			);
+ 
+ 	/* REVISIT use client->irq to register alarm irq ... */
++	if (rs5c372_can_wakeup_device) {
++		device_init_wakeup(&client->dev, true);
++	}
++
+ 	rs5c372->rtc = devm_rtc_device_register(&client->dev,
+ 					rs5c372_driver.driver.name,
+ 					&rs5c372_rtc_ops, THIS_MODULE);
+@@ -940,6 +953,10 @@ static int rs5c372_probe(struct i2c_clie
+ 	if (err)
+ 		goto exit;
+ 
++	/* the rs5c372 alarm only supports a minute accuracy */
++	set_bit(RTC_FEATURE_ALARM_RES_MINUTE, rs5c372->rtc->features);
++	clear_bit(RTC_FEATURE_UPDATE_INTERRUPT, rs5c372->rtc->features);
++
+ 	return 0;
+ 
+ exit:
diff --git a/target/linux/generic/pending-6.1/203-kallsyms_uncompressed.patch b/target/linux/generic/pending-6.1/203-kallsyms_uncompressed.patch
new file mode 100644
index 00000000000000..7b7aea060160ca
--- /dev/null
+++ b/target/linux/generic/pending-6.1/203-kallsyms_uncompressed.patch
@@ -0,0 +1,118 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: kernel: add a config option for keeping the kallsyms table uncompressed, saving ~9kb kernel size after lzma on ar71xx
+
+[john@phrozen.org: added to my upstream queue 30.12.2016]
+lede-commit: e0e3509b5ce2ccf93d4d67ea907613f5f7ec2eed
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ init/Kconfig            | 11 +++++++++++
+ kernel/kallsyms.c       |  8 ++++++++
+ scripts/kallsyms.c      | 12 ++++++++++++
+ scripts/link-vmlinux.sh |  4 ++++
+ 4 files changed, 35 insertions(+)
+
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1481,6 +1481,17 @@ config SYSCTL_ARCH_UNALIGN_ALLOW
+ 	  the unaligned access emulation.
+ 	  see arch/parisc/kernel/unaligned.c for reference
+ 
++config KALLSYMS_UNCOMPRESSED
++	bool "Keep kallsyms uncompressed"
++	depends on KALLSYMS
++	help
++		Normally kallsyms contains compressed symbols (using a token table),
++		reducing the uncompressed kernel image size. Keeping the symbol table
++		uncompressed significantly improves the size of this part in compressed
++		kernel images.
++
++		Say N unless you need compressed kernel images to be small.
++
+ config HAVE_PCSPKR_PLATFORM
+ 	bool
+ 
+--- a/kernel/kallsyms.c
++++ b/kernel/kallsyms.c
+@@ -69,6 +69,11 @@ static unsigned int kallsyms_expand_symb
+ 	 * For every byte on the compressed symbol data, copy the table
+ 	 * entry for that byte.
+ 	 */
++#ifdef CONFIG_KALLSYMS_UNCOMPRESSED
++	memcpy(result, data + 1, len - 1);
++	result += len - 1;
++	len = 0;
++#endif
+ 	while (len) {
+ 		tptr = &kallsyms_token_table[kallsyms_token_index[*data]];
+ 		data++;
+@@ -101,6 +106,9 @@ tail:
+  */
+ static char kallsyms_get_symbol_type(unsigned int off)
+ {
++#ifdef CONFIG_KALLSYMS_UNCOMPRESSED
++	return kallsyms_names[off + 1];
++#endif
+ 	/*
+ 	 * Get just the first code, look it up in the token table,
+ 	 * and return the first char from this token.
+--- a/scripts/kallsyms.c
++++ b/scripts/kallsyms.c
+@@ -75,6 +75,7 @@ static struct addr_range percpu_range =
+ static struct sym_entry **table;
+ static unsigned int table_size, table_cnt;
+ static int all_symbols;
++static int uncompressed;
+ static int absolute_percpu;
+ static int base_relative;
+ 
+@@ -535,6 +536,9 @@ static void write_src(void)
+ 
+ 	free(markers);
+ 
++	if (uncompressed)
++		return;
++
+ 	output_label("kallsyms_token_table");
+ 	off = 0;
+ 	for (i = 0; i < 256; i++) {
+@@ -586,6 +590,9 @@ static unsigned char *find_token(unsigne
+ {
+ 	int i;
+ 
++	if (uncompressed)
++		return NULL;
++
+ 	for (i = 0; i < len - 1; i++) {
+ 		if (str[i] == token[0] && str[i+1] == token[1])
+ 			return &str[i];
+@@ -658,6 +665,9 @@ static void optimize_result(void)
+ {
+ 	int i, best;
+ 
++	if (uncompressed)
++		return;
++
+ 	/* using the '\0' symbol last allows compress_symbols to use standard
+ 	 * fast string functions */
+ 	for (i = 255; i >= 0; i--) {
+@@ -818,6 +828,7 @@ int main(int argc, char **argv)
+ 			{"all-symbols",     no_argument, &all_symbols,     1},
+ 			{"absolute-percpu", no_argument, &absolute_percpu, 1},
+ 			{"base-relative",   no_argument, &base_relative,   1},
++			{"uncompressed",   no_argument, &uncompressed,   1},
+ 			{},
+ 		};
+ 
+--- a/scripts/link-vmlinux.sh
++++ b/scripts/link-vmlinux.sh
+@@ -156,6 +156,10 @@ kallsyms()
+ 		kallsymopt="${kallsymopt} --base-relative"
+ 	fi
+ 
++	if is_enabled CONFIG_KALLSYMS_UNCOMPRESSED; then
++		kallsymopt="${kallsymopt} --uncompressed"
++	fi
++
+ 	info KSYMS ${2}
+ 	scripts/kallsyms ${kallsymopt} ${1} > ${2}
+ }
diff --git a/target/linux/generic/pending-6.1/205-backtrace_module_info.patch b/target/linux/generic/pending-6.1/205-backtrace_module_info.patch
new file mode 100644
index 00000000000000..27a1347981960e
--- /dev/null
+++ b/target/linux/generic/pending-6.1/205-backtrace_module_info.patch
@@ -0,0 +1,41 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: kernel: when KALLSYMS is disabled, print module address + size for matching backtrace entries
+
+[john@phrozen.org: felix will add this to his upstream queue]
+
+lede-commit 53827cdc824556cda910b23ce5030c363b8f1461
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ lib/vsprintf.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+--- a/lib/vsprintf.c
++++ b/lib/vsprintf.c
+@@ -985,8 +985,10 @@ char *symbol_string(char *buf, char *end
+ 		    struct printf_spec spec, const char *fmt)
+ {
+ 	unsigned long value;
+-#ifdef CONFIG_KALLSYMS
+ 	char sym[KSYM_SYMBOL_LEN];
++#ifndef CONFIG_KALLSYMS
++	struct module *mod;
++	int len;
+ #endif
+ 
+ 	if (fmt[1] == 'R')
+@@ -1007,8 +1009,14 @@ char *symbol_string(char *buf, char *end
+ 
+ 	return string_nocheck(buf, end, sym, spec);
+ #else
+-	return special_hex_number(buf, end, value, sizeof(void *));
++	len = snprintf(sym, sizeof(sym), "0x%lx", value);
++	mod = __module_address(value);
++	if (mod)
++		snprintf(sym + len, sizeof(sym) - len, " [%s@%p+0x%x]",
++			 mod->name, mod->core_layout.base,
++			 mod->core_layout.size);
+ #endif
++	return string(buf, end, sym, spec);
+ }
+ 
+ static const struct printf_spec default_str_spec = {
diff --git a/target/linux/generic/pending-6.1/240-remove-unsane-filenames-from-deps_initramfs-list.patch b/target/linux/generic/pending-6.1/240-remove-unsane-filenames-from-deps_initramfs-list.patch
new file mode 100644
index 00000000000000..9e78284ecf707b
--- /dev/null
+++ b/target/linux/generic/pending-6.1/240-remove-unsane-filenames-from-deps_initramfs-list.patch
@@ -0,0 +1,30 @@
+From: Gabor Juhos <juhosg@openwrt.org>
+Subject: usr: sanitize deps_initramfs list
+
+If any filename in the intramfs dependency
+list contains a colon, that causes a kernel
+build error like this:
+
+/devel/openwrt/build_dir/linux-ar71xx_generic/linux-3.6.6/usr/Makefile:58: *** multiple target patterns.  Stop.
+make[5]: *** [usr] Error 2
+
+Fix it by removing such filenames from the
+deps_initramfs list.
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ usr/Makefile | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/usr/Makefile
++++ b/usr/Makefile
+@@ -56,6 +56,8 @@ hostprogs := gen_init_cpio
+ # The dependency list is generated by gen_initramfs.sh -l
+ -include $(obj)/.initramfs_data.cpio.d
+ 
++deps_initramfs := $(foreach v,$(deps_initramfs),$(if $(findstring :,$(v)),,$(v)))
++
+ # do not try to update files included in initramfs
+ $(deps_initramfs): ;
+ 
diff --git a/target/linux/generic/pending-6.1/261-enable_wilink_platform_without_drivers.patch b/target/linux/generic/pending-6.1/261-enable_wilink_platform_without_drivers.patch
new file mode 100644
index 00000000000000..cd31f9d9342925
--- /dev/null
+++ b/target/linux/generic/pending-6.1/261-enable_wilink_platform_without_drivers.patch
@@ -0,0 +1,20 @@
+From: Imre Kaloz <kaloz@openwrt.org>
+Subject: [PATCH] hack: net: wireless: make the wl12xx glue code available with
+ compat-wireless, too
+
+Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
+---
+ drivers/net/wireless/ti/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ti/Kconfig
++++ b/drivers/net/wireless/ti/Kconfig
+@@ -20,7 +20,7 @@ source "drivers/net/wireless/ti/wlcore/K
+ 
+ config WILINK_PLATFORM_DATA
+ 	bool "TI WiLink platform data"
+-	depends on WLCORE_SDIO || WL1251_SDIO
++	depends on WLCORE_SDIO || WL1251_SDIO || ARCH_OMAP2PLUS
+ 	default y
+ 	help
+ 	Small platform data bit needed to pass data to the sdio modules.
diff --git a/target/linux/generic/pending-6.1/270-platform-mikrotik-build-bits.patch b/target/linux/generic/pending-6.1/270-platform-mikrotik-build-bits.patch
new file mode 100644
index 00000000000000..997e6142a70e62
--- /dev/null
+++ b/target/linux/generic/pending-6.1/270-platform-mikrotik-build-bits.patch
@@ -0,0 +1,31 @@
+From c2deb5ef01a0ef09088832744cbace9e239a6ee0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Thibaut=20VAR=C3=88NE?= <hacks@slashdirt.org>
+Date: Sat, 28 Mar 2020 12:11:50 +0100
+Subject: [PATCH] generic: platform/mikrotik build bits (5.4)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This patch adds platform/mikrotik kernel build bits
+
+Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
+---
+ drivers/platform/Kconfig  | 2 ++
+ drivers/platform/Makefile | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/platform/Kconfig
++++ b/drivers/platform/Kconfig
+@@ -16,3 +16,5 @@ source "drivers/platform/olpc/Kconfig"
+ source "drivers/platform/surface/Kconfig"
+ 
+ source "drivers/platform/x86/Kconfig"
++
++source "drivers/platform/mikrotik/Kconfig"
+--- a/drivers/platform/Makefile
++++ b/drivers/platform/Makefile
+@@ -11,3 +11,4 @@ obj-$(CONFIG_OLPC_EC)		+= olpc/
+ obj-$(CONFIG_GOLDFISH)		+= goldfish/
+ obj-$(CONFIG_CHROME_PLATFORMS)	+= chrome/
+ obj-$(CONFIG_SURFACE_PLATFORMS)	+= surface/
++obj-$(CONFIG_MIKROTIK)		+= mikrotik/
diff --git a/target/linux/generic/pending-6.1/300-mips_expose_boot_raw.patch b/target/linux/generic/pending-6.1/300-mips_expose_boot_raw.patch
new file mode 100644
index 00000000000000..a4413e919b4b74
--- /dev/null
+++ b/target/linux/generic/pending-6.1/300-mips_expose_boot_raw.patch
@@ -0,0 +1,40 @@
+From: Mark Miller <mark@mirell.org>
+Subject: mips: expose CONFIG_BOOT_RAW
+
+This exposes the CONFIG_BOOT_RAW symbol in Kconfig. This is needed on
+certain Broadcom chipsets running CFE in order to load the kernel.
+
+Signed-off-by: Mark Miller <mark@mirell.org>
+Acked-by: Rob Landley <rob@landley.net>
+---
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -1032,9 +1032,6 @@ config FW_ARC
+ config ARCH_MAY_HAVE_PC_FDC
+ 	bool
+ 
+-config BOOT_RAW
+-	bool
+-
+ config CEVT_BCM1480
+ 	bool
+ 
+@@ -3089,6 +3086,18 @@ choice
+ 		bool "Extend builtin kernel arguments with bootloader arguments"
+ endchoice
+ 
++config BOOT_RAW
++	bool "Enable the kernel to be executed from the load address"
++	default n
++	help
++	 Allow the kernel to be executed from the load address for
++	 bootloaders which cannot read the ELF format. This places
++	 a jump to start_kernel at the load address.
++
++	 If unsure, say N.
++
++
++
+ endmenu
+ 
+ config LOCKDEP_SUPPORT
diff --git a/target/linux/generic/pending-6.1/301-MIPS-Add-barriers-between-dcache-icache-flushes.patch b/target/linux/generic/pending-6.1/301-MIPS-Add-barriers-between-dcache-icache-flushes.patch
new file mode 100644
index 00000000000000..bd56adad3a057e
--- /dev/null
+++ b/target/linux/generic/pending-6.1/301-MIPS-Add-barriers-between-dcache-icache-flushes.patch
@@ -0,0 +1,71 @@
+From e6e6ef4275978823ec3a84133fc91f4ffbef5c84 Mon Sep 17 00:00:00 2001
+From: Paul Burton <paul.burton@imgtec.com>
+Date: Mon, 22 Feb 2016 18:09:44 +0000
+Subject: [PATCH] MIPS: Add barriers between dcache & icache flushes
+
+Index-based cache operations may be arbitrarily reordered by out of
+order CPUs. Thus code which writes back the dcache & then invalidates
+the icache using indexed cache ops must include a barrier between
+operating on the 2 caches in order to prevent the scenario in which:
+
+  - icache invalidation occurs.
+
+  - icache fetch occurs, due to speculation.
+
+  - dcache writeback occurs.
+
+If the above were allowed to happen then the icache would contain stale
+data. Forcing the dcache writeback to complete before the icache
+invalidation avoids this.
+
+Signed-off-by: Paul Burton <paul.burton@imgtec.com>
+Cc: James Hogan <james.hogan@imgtec.com>
+---
+ arch/mips/mm/c-r4k.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -514,6 +514,7 @@ static inline void local_r4k___flush_cac
+ 
+ 	default:
+ 		r4k_blast_dcache();
++		mb(); /* cache instructions may be reordered */
+ 		r4k_blast_icache();
+ 		break;
+ 	}
+@@ -594,8 +595,10 @@ static inline void local_r4k_flush_cache
+ 	if (cpu_has_dc_aliases || (exec && !cpu_has_ic_fills_f_dc))
+ 		r4k_blast_dcache();
+ 	/* If executable, blast stale lines from icache */
+-	if (exec)
++	if (exec) {
++		mb(); /* cache instructions may be reordered */
+ 		r4k_blast_icache();
++	}
+ }
+ 
+ static void r4k_flush_cache_range(struct vm_area_struct *vma,
+@@ -696,8 +699,13 @@ static inline void local_r4k_flush_cache
+ 	if (cpu_has_dc_aliases || (exec && !cpu_has_ic_fills_f_dc)) {
+ 		vaddr ? r4k_blast_dcache_page(addr) :
+ 			r4k_blast_dcache_user_page(addr);
+-		if (exec && !cpu_icache_snoops_remote_store)
++		if (exec)
++			mb(); /* cache instructions may be reordered */
++
++		if (exec && !cpu_icache_snoops_remote_store) {
+ 			r4k_blast_scache_page(addr);
++			mb(); /* cache instructions may be reordered */
++		}
+ 	}
+ 	if (exec) {
+ 		if (vaddr && cpu_has_vtag_icache && mm == current->active_mm) {
+@@ -764,6 +772,7 @@ static inline void __local_r4k_flush_ica
+ 			else
+ 				blast_dcache_range(start, end);
+ 		}
++		mb(); /* cache instructions may be reordered */
+ 	}
+ 
+ 	if (type == R4K_INDEX ||
diff --git a/target/linux/generic/pending-6.1/302-mips_no_branch_likely.patch b/target/linux/generic/pending-6.1/302-mips_no_branch_likely.patch
new file mode 100644
index 00000000000000..542fba651f29db
--- /dev/null
+++ b/target/linux/generic/pending-6.1/302-mips_no_branch_likely.patch
@@ -0,0 +1,22 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: mips: use -mno-branch-likely for kernel and userspace
+
+saves ~11k kernel size after lzma and ~12k squashfs size in the
+
+lede-commit: 41a039f46450ffae9483d6216422098669da2900
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ arch/mips/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/mips/Makefile
++++ b/arch/mips/Makefile
+@@ -94,7 +94,7 @@ all-$(CONFIG_SYS_SUPPORTS_ZBOOT)+= vmlin
+ # machines may also.  Since BFD is incredibly buggy with respect to
+ # crossformat linking we rely on the elf2ecoff tool for format conversion.
+ #
+-cflags-y			+= -G 0 -mno-abicalls -fno-pic -pipe
++cflags-y			+= -G 0 -mno-abicalls -fno-pic -pipe -mno-branch-likely
+ cflags-y			+= -msoft-float
+ LDFLAGS_vmlinux			+= -G 0 -static -n -nostdlib
+ KBUILD_AFLAGS_MODULE		+= -mlong-calls
diff --git a/target/linux/generic/pending-6.1/305-mips_module_reloc.patch b/target/linux/generic/pending-6.1/305-mips_module_reloc.patch
new file mode 100644
index 00000000000000..5de9019677e1ca
--- /dev/null
+++ b/target/linux/generic/pending-6.1/305-mips_module_reloc.patch
@@ -0,0 +1,370 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: mips: replace -mlong-calls with -mno-long-calls to make function calls faster in kernel modules to achieve this, try to
+
+lede-commit: 3b3d64743ba2a874df9d70cd19e242205b0a788c
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ arch/mips/Makefile             |   5 +
+ arch/mips/include/asm/module.h |   5 +
+ arch/mips/kernel/module.c      | 279 ++++++++++++++++++++++++++++++++++++++++-
+ 3 files changed, 284 insertions(+), 5 deletions(-)
+
+--- a/arch/mips/Makefile
++++ b/arch/mips/Makefile
+@@ -97,8 +97,18 @@ all-$(CONFIG_SYS_SUPPORTS_ZBOOT)+= vmlin
+ cflags-y			+= -G 0 -mno-abicalls -fno-pic -pipe -mno-branch-likely
+ cflags-y			+= -msoft-float
+ LDFLAGS_vmlinux			+= -G 0 -static -n -nostdlib
++ifdef CONFIG_64BIT
+ KBUILD_AFLAGS_MODULE		+= -mlong-calls
+ KBUILD_CFLAGS_MODULE		+= -mlong-calls
++else
++  ifdef CONFIG_DYNAMIC_FTRACE
++    KBUILD_AFLAGS_MODULE	+= -mlong-calls
++    KBUILD_CFLAGS_MODULE	+= -mlong-calls
++  else
++    KBUILD_AFLAGS_MODULE	+= -mno-long-calls
++    KBUILD_CFLAGS_MODULE	+= -mno-long-calls
++  endif
++endif
+ 
+ ifeq ($(CONFIG_RELOCATABLE),y)
+ LDFLAGS_vmlinux			+= --emit-relocs
+--- a/arch/mips/include/asm/module.h
++++ b/arch/mips/include/asm/module.h
+@@ -12,6 +12,11 @@ struct mod_arch_specific {
+ 	const struct exception_table_entry *dbe_start;
+ 	const struct exception_table_entry *dbe_end;
+ 	struct mips_hi16 *r_mips_hi16_list;
++
++	void *phys_plt_tbl;
++	void *virt_plt_tbl;
++	unsigned int phys_plt_offset;
++	unsigned int virt_plt_offset;
+ };
+ 
+ typedef uint8_t Elf64_Byte;		/* Type for a 8-bit quantity.  */
+--- a/arch/mips/kernel/module.c
++++ b/arch/mips/kernel/module.c
+@@ -32,23 +32,261 @@ struct mips_hi16 {
+ static LIST_HEAD(dbe_list);
+ static DEFINE_SPINLOCK(dbe_lock);
+ 
+-#ifdef MODULE_START
++/*
++ * Get the potential max trampolines size required of the init and
++ * non-init sections. Only used if we cannot find enough contiguous
++ * physically mapped memory to put the module into.
++ */
++static unsigned int
++get_plt_size(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
++             const char *secstrings, unsigned int symindex, bool is_init)
++{
++	unsigned long ret = 0;
++	unsigned int i, j;
++	Elf_Sym *syms;
++
++	/* Everything marked ALLOC (this includes the exported symbols) */
++	for (i = 1; i < hdr->e_shnum; ++i) {
++		unsigned int info = sechdrs[i].sh_info;
++
++		if (sechdrs[i].sh_type != SHT_REL
++		    && sechdrs[i].sh_type != SHT_RELA)
++			continue;
++
++		/* Not a valid relocation section? */
++		if (info >= hdr->e_shnum)
++			continue;
++
++		/* Don't bother with non-allocated sections */
++		if (!(sechdrs[info].sh_flags & SHF_ALLOC))
++			continue;
++
++		/* If it's called *.init*, and we're not init, we're
++                   not interested */
++		if ((strstr(secstrings + sechdrs[i].sh_name, ".init") != 0)
++		    != is_init)
++			continue;
++
++		syms = (Elf_Sym *) sechdrs[symindex].sh_addr;
++		if (sechdrs[i].sh_type == SHT_REL) {
++			Elf_Mips_Rel *rel = (void *) sechdrs[i].sh_addr;
++			unsigned int size = sechdrs[i].sh_size / sizeof(*rel);
++
++			for (j = 0; j < size; ++j) {
++				Elf_Sym *sym;
++
++				if (ELF_MIPS_R_TYPE(rel[j]) != R_MIPS_26)
++					continue;
++
++				sym = syms + ELF_MIPS_R_SYM(rel[j]);
++				if (!is_init && sym->st_shndx != SHN_UNDEF)
++					continue;
++
++				ret += 4 * sizeof(int);
++			}
++		} else {
++			Elf_Mips_Rela *rela = (void *) sechdrs[i].sh_addr;
++			unsigned int size = sechdrs[i].sh_size / sizeof(*rela);
++
++			for (j = 0; j < size; ++j) {
++				Elf_Sym *sym;
++
++				if (ELF_MIPS_R_TYPE(rela[j]) != R_MIPS_26)
++					continue;
++
++				sym = syms + ELF_MIPS_R_SYM(rela[j]);
++				if (!is_init && sym->st_shndx != SHN_UNDEF)
++					continue;
++
++				ret += 4 * sizeof(int);
++			}
++		}
++	}
++
++	return ret;
++}
++
++#ifndef MODULE_START
++static void *alloc_phys(unsigned long size)
++{
++	unsigned order;
++	struct page *page;
++	struct page *p;
++
++	size = PAGE_ALIGN(size);
++	order = get_order(size);
++
++	page = alloc_pages(GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN |
++			__GFP_THISNODE, order);
++	if (!page)
++		return NULL;
++
++	split_page(page, order);
++
++	/* mark all pages except for the last one */
++	for (p = page; p + 1 < page + (size >> PAGE_SHIFT); ++p)
++		set_bit(PG_owner_priv_1, &p->flags);
++
++	for (p = page + (size >> PAGE_SHIFT); p < page + (1 << order); ++p)
++		__free_page(p);
++
++	return page_address(page);
++}
++#endif
++
++static void free_phys(void *ptr)
++{
++	struct page *page;
++	bool free;
++
++	page = virt_to_page(ptr);
++	do {
++		free = test_and_clear_bit(PG_owner_priv_1, &page->flags);
++		__free_page(page);
++		page++;
++	} while (free);
++}
++
++
+ void *module_alloc(unsigned long size)
+ {
++#ifdef MODULE_START
+ 	return __vmalloc_node_range(size, 1, MODULE_START, MODULE_END,
+ 				GFP_KERNEL, PAGE_KERNEL, 0, NUMA_NO_NODE,
+ 				__builtin_return_address(0));
++#else
++	void *ptr;
++
++	if (size == 0)
++		return NULL;
++
++	ptr = alloc_phys(size);
++
++	/* If we failed to allocate physically contiguous memory,
++	 * fall back to regular vmalloc. The module loader code will
++	 * create jump tables to handle long jumps */
++	if (!ptr)
++		return vmalloc(size);
++
++	return ptr;
++#endif
+ }
++
++static inline bool is_phys_addr(void *ptr)
++{
++#ifdef CONFIG_64BIT
++	return (KSEGX((unsigned long)ptr) == CKSEG0);
++#else
++	return (KSEGX(ptr) == KSEG0);
+ #endif
++}
++
++/* Free memory returned from module_alloc */
++void module_memfree(void *module_region)
++{
++	if (is_phys_addr(module_region))
++		free_phys(module_region);
++	else
++		vfree(module_region);
++}
++
++static void *__module_alloc(int size, bool phys)
++{
++	void *ptr;
++
++	if (phys)
++		ptr = kmalloc(size, GFP_KERNEL);
++	else
++		ptr = vmalloc(size);
++	return ptr;
++}
++
++static void __module_free(void *ptr)
++{
++	if (is_phys_addr(ptr))
++		kfree(ptr);
++	else
++		vfree(ptr);
++}
++
++int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
++			      char *secstrings, struct module *mod)
++{
++	unsigned int symindex = 0;
++	unsigned int core_size, init_size;
++	int i;
++
++	mod->arch.phys_plt_offset = 0;
++	mod->arch.virt_plt_offset = 0;
++	mod->arch.phys_plt_tbl = NULL;
++	mod->arch.virt_plt_tbl = NULL;
++
++	if (IS_ENABLED(CONFIG_64BIT))
++		return 0;
++
++	for (i = 1; i < hdr->e_shnum; i++)
++		if (sechdrs[i].sh_type == SHT_SYMTAB)
++			symindex = i;
++
++	core_size = get_plt_size(hdr, sechdrs, secstrings, symindex, false);
++	init_size = get_plt_size(hdr, sechdrs, secstrings, symindex, true);
++
++	if ((core_size + init_size) == 0)
++		return 0;
++
++	mod->arch.phys_plt_tbl = __module_alloc(core_size + init_size, 1);
++	if (!mod->arch.phys_plt_tbl)
++		return -ENOMEM;
++
++	mod->arch.virt_plt_tbl = __module_alloc(core_size + init_size, 0);
++	if (!mod->arch.virt_plt_tbl) {
++		__module_free(mod->arch.phys_plt_tbl);
++		mod->arch.phys_plt_tbl = NULL;
++		return -ENOMEM;
++	}
++
++	return 0;
++}
+ 
+ static void apply_r_mips_32(u32 *location, u32 base, Elf_Addr v)
+ {
+ 	*location = base + v;
+ }
+ 
++static Elf_Addr add_plt_entry_to(unsigned *plt_offset,
++				 void *start, Elf_Addr v)
++{
++	unsigned *tramp = start + *plt_offset;
++	*plt_offset += 4 * sizeof(int);
++
++	/* adjust carry for addiu */
++	if (v & 0x00008000)
++		v += 0x10000;
++
++	tramp[0] = 0x3c190000 | (v >> 16);      /* lui t9, hi16 */
++	tramp[1] = 0x27390000 | (v & 0xffff);   /* addiu t9, t9, lo16 */
++	tramp[2] = 0x03200008;                  /* jr t9 */
++	tramp[3] = 0x00000000;                  /* nop */
++
++	return (Elf_Addr) tramp;
++}
++
++static Elf_Addr add_plt_entry(struct module *me, void *location, Elf_Addr v)
++{
++	if (is_phys_addr(location))
++		return add_plt_entry_to(&me->arch.phys_plt_offset,
++				me->arch.phys_plt_tbl, v);
++	else
++		return add_plt_entry_to(&me->arch.virt_plt_offset,
++				me->arch.virt_plt_tbl, v);
++
++}
++
+ static int apply_r_mips_26(struct module *me, u32 *location, u32 base,
+ 			   Elf_Addr v)
+ {
++	u32 ofs = base & 0x03ffffff;
++
+ 	if (v % 4) {
+ 		pr_err("module %s: dangerous R_MIPS_26 relocation\n",
+ 		       me->name);
+@@ -56,13 +294,17 @@ static int apply_r_mips_26(struct module
+ 	}
+ 
+ 	if ((v & 0xf0000000) != (((unsigned long)location + 4) & 0xf0000000)) {
+-		pr_err("module %s: relocation overflow\n",
+-		       me->name);
+-		return -ENOEXEC;
++		v = add_plt_entry(me, location, v + (ofs << 2));
++		if (!v) {
++			pr_err("module %s: relocation overflow\n",
++			       me->name);
++			return -ENOEXEC;
++		}
++		ofs = 0;
+ 	}
+ 
+ 	*location = (*location & ~0x03ffffff) |
+-		    ((base + (v >> 2)) & 0x03ffffff);
++		    ((ofs + (v >> 2)) & 0x03ffffff);
+ 
+ 	return 0;
+ }
+@@ -442,9 +684,36 @@ int module_finalize(const Elf_Ehdr *hdr,
+ 		list_add(&me->arch.dbe_list, &dbe_list);
+ 		spin_unlock_irq(&dbe_lock);
+ 	}
++
++	/* Get rid of the fixup trampoline if we're running the module
++	 * from physically mapped address space */
++	if (me->arch.phys_plt_offset == 0) {
++		__module_free(me->arch.phys_plt_tbl);
++		me->arch.phys_plt_tbl = NULL;
++	}
++	if (me->arch.virt_plt_offset == 0) {
++		__module_free(me->arch.virt_plt_tbl);
++		me->arch.virt_plt_tbl = NULL;
++	}
++
+ 	return 0;
+ }
+ 
++void module_arch_freeing_init(struct module *mod)
++{
++	if (mod->state == MODULE_STATE_LIVE)
++		return;
++
++	if (mod->arch.phys_plt_tbl) {
++		__module_free(mod->arch.phys_plt_tbl);
++		mod->arch.phys_plt_tbl = NULL;
++	}
++	if (mod->arch.virt_plt_tbl) {
++		__module_free(mod->arch.virt_plt_tbl);
++		mod->arch.virt_plt_tbl = NULL;
++	}
++}
++
+ void module_arch_cleanup(struct module *mod)
+ {
+ 	spin_lock_irq(&dbe_lock);
diff --git a/target/linux/generic/pending-6.1/307-mips_highmem_offset.patch b/target/linux/generic/pending-6.1/307-mips_highmem_offset.patch
new file mode 100644
index 00000000000000..0529b0c5c8aa88
--- /dev/null
+++ b/target/linux/generic/pending-6.1/307-mips_highmem_offset.patch
@@ -0,0 +1,19 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: kernel: adjust mips highmem offset to avoid the need for -mlong-calls on systems with >256M RAM
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ arch/mips/include/asm/mach-generic/spaces.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/mips/include/asm/mach-generic/spaces.h
++++ b/arch/mips/include/asm/mach-generic/spaces.h
+@@ -46,7 +46,7 @@
+  * Memory above this physical address will be considered highmem.
+  */
+ #ifndef HIGHMEM_START
+-#define HIGHMEM_START		_AC(0x20000000, UL)
++#define HIGHMEM_START		_AC(0x10000000, UL)
+ #endif
+ 
+ #endif /* CONFIG_32BIT */
diff --git a/target/linux/generic/pending-6.1/308-mips32r2_tune.patch b/target/linux/generic/pending-6.1/308-mips32r2_tune.patch
new file mode 100644
index 00000000000000..db410a6bc06dc3
--- /dev/null
+++ b/target/linux/generic/pending-6.1/308-mips32r2_tune.patch
@@ -0,0 +1,22 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: kernel: add -mtune=34kc to MIPS CFLAGS when building for mips32r2
+
+This provides a good tradeoff across at least 24Kc-74Kc, while also
+producing smaller code.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ arch/mips/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/mips/Makefile
++++ b/arch/mips/Makefile
+@@ -172,7 +172,7 @@ cflags-$(CONFIG_CPU_R4300)	+= -march=r43
+ cflags-$(CONFIG_CPU_R4X00)	+= -march=r4600 -Wa,--trap
+ cflags-$(CONFIG_CPU_TX49XX)	+= -march=r4600 -Wa,--trap
+ cflags-$(CONFIG_CPU_MIPS32_R1)	+= -march=mips32 -Wa,--trap
+-cflags-$(CONFIG_CPU_MIPS32_R2)	+= -march=mips32r2 -Wa,--trap
++cflags-$(CONFIG_CPU_MIPS32_R2)	+= -march=mips32r2 -mtune=34kc -Wa,--trap
+ cflags-$(CONFIG_CPU_MIPS32_R5)	+= -march=mips32r5 -Wa,--trap -modd-spreg
+ cflags-$(CONFIG_CPU_MIPS32_R6)	+= -march=mips32r6 -Wa,--trap -modd-spreg
+ cflags-$(CONFIG_CPU_MIPS64_R1)	+= -march=mips64 -Wa,--trap
diff --git a/target/linux/generic/pending-6.1/310-arm_module_unresolved_weak_sym.patch b/target/linux/generic/pending-6.1/310-arm_module_unresolved_weak_sym.patch
new file mode 100644
index 00000000000000..54cc9ba64767d8
--- /dev/null
+++ b/target/linux/generic/pending-6.1/310-arm_module_unresolved_weak_sym.patch
@@ -0,0 +1,22 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: fix errors in unresolved weak symbols on arm
+
+lede-commit: 570699d4838a907c3ef9f2819bf19eb72997b32f
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ arch/arm/kernel/module.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm/kernel/module.c
++++ b/arch/arm/kernel/module.c
+@@ -146,6 +146,10 @@ apply_relocate(Elf32_Shdr *sechdrs, cons
+ 			return -ENOEXEC;
+ 		}
+ 
++		if ((IS_ERR_VALUE(sym->st_value) || !sym->st_value) &&
++		    ELF_ST_BIND(sym->st_info) == STB_WEAK)
++			continue;
++
+ 		loc = dstsec->sh_addr + rel->r_offset;
+ 
+ 		switch (ELF32_R_TYPE(rel->r_info)) {
diff --git a/target/linux/generic/pending-6.1/330-MIPS-kexec-Accept-command-line-parameters-from-users.patch b/target/linux/generic/pending-6.1/330-MIPS-kexec-Accept-command-line-parameters-from-users.patch
new file mode 100644
index 00000000000000..3f553b28b34be7
--- /dev/null
+++ b/target/linux/generic/pending-6.1/330-MIPS-kexec-Accept-command-line-parameters-from-users.patch
@@ -0,0 +1,282 @@
+From: Yousong Zhou <yszhou4tech@gmail.com>
+Subject: MIPS: kexec: Accept command line parameters from userspace.
+
+Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
+---
+ arch/mips/kernel/machine_kexec.c   |  153 +++++++++++++++++++++++++++++++-----
+ arch/mips/kernel/machine_kexec.h   |   20 +++++
+ arch/mips/kernel/relocate_kernel.S |   21 +++--
+ 3 files changed, 167 insertions(+), 27 deletions(-)
+ create mode 100644 arch/mips/kernel/machine_kexec.h
+
+--- a/arch/mips/kernel/machine_kexec.c
++++ b/arch/mips/kernel/machine_kexec.c
+@@ -9,14 +9,11 @@
+ #include <linux/delay.h>
+ #include <linux/libfdt.h>
+ 
++#include <asm/bootinfo.h>
+ #include <asm/cacheflush.h>
+ #include <asm/page.h>
+-
+-extern const unsigned char relocate_new_kernel[];
+-extern const size_t relocate_new_kernel_size;
+-
+-extern unsigned long kexec_start_address;
+-extern unsigned long kexec_indirection_page;
++#include <linux/uaccess.h>
++#include "machine_kexec.h"
+ 
+ static unsigned long reboot_code_buffer;
+ 
+@@ -30,6 +27,101 @@ void (*_crash_smp_send_stop)(void) = NUL
+ void (*_machine_kexec_shutdown)(void) = NULL;
+ void (*_machine_crash_shutdown)(struct pt_regs *regs) = NULL;
+ 
++static void machine_kexec_print_args(void)
++{
++	unsigned long argc = (int)kexec_args[0];
++	int i;
++
++	pr_info("kexec_args[0] (argc): %lu\n", argc);
++	pr_info("kexec_args[1] (argv): %p\n", (void *)kexec_args[1]);
++	pr_info("kexec_args[2] (env ): %p\n", (void *)kexec_args[2]);
++	pr_info("kexec_args[3] (desc): %p\n", (void *)kexec_args[3]);
++
++	for (i = 0; i < argc; i++) {
++		pr_info("kexec_argv[%d] = %p, %s\n",
++				i, kexec_argv[i], kexec_argv[i]);
++	}
++}
++
++static void machine_kexec_init_argv(struct kimage *image)
++{
++	void __user *buf = NULL;
++	size_t bufsz;
++	size_t size;
++	int i;
++
++	bufsz = 0;
++	for (i = 0; i < image->nr_segments; i++) {
++		struct kexec_segment *seg;
++
++		seg = &image->segment[i];
++		if (seg->bufsz < 6)
++			continue;
++
++		if (strncmp((char *) seg->buf, "kexec ", 6))
++			continue;
++
++		buf = seg->buf;
++		bufsz = seg->bufsz;
++		break;
++	}
++
++	if (!buf)
++		return;
++
++	size = KEXEC_COMMAND_LINE_SIZE;
++	size = min(size, bufsz);
++	if (size < bufsz)
++		pr_warn("kexec command line truncated to %zd bytes\n", size);
++
++	/* Copy to kernel space */
++	if (copy_from_user(kexec_argv_buf, buf, size))
++		pr_warn("kexec command line copy to kernel space failed\n");
++
++	kexec_argv_buf[size - 1] = 0;
++}
++
++static void machine_kexec_parse_argv(struct kimage *image)
++{
++	char *reboot_code_buffer;
++	int reloc_delta;
++	char *ptr;
++	int argc;
++	int i;
++
++	ptr = kexec_argv_buf;
++	argc = 0;
++
++	/*
++	 * convert command line string to array of parameters
++	 * (as bootloader does).
++	 */
++	while (ptr && *ptr && (KEXEC_MAX_ARGC > argc)) {
++		if (*ptr == ' ') {
++			*ptr++ = '\0';
++			continue;
++		}
++
++		kexec_argv[argc++] = ptr;
++		ptr = strchr(ptr, ' ');
++	}
++
++	if (!argc)
++		return;
++
++	kexec_args[0] = argc;
++	kexec_args[1] = (unsigned long)kexec_argv;
++	kexec_args[2] = 0;
++	kexec_args[3] = 0;
++
++	reboot_code_buffer = page_address(image->control_code_page);
++	reloc_delta = reboot_code_buffer - (char *)kexec_relocate_new_kernel;
++
++	kexec_args[1] += reloc_delta;
++	for (i = 0; i < argc; i++)
++		kexec_argv[i] += reloc_delta;
++}
++
+ static void kexec_image_info(const struct kimage *kimage)
+ {
+ 	unsigned long i;
+@@ -99,6 +191,18 @@ machine_kexec_prepare(struct kimage *kim
+ #endif
+ 
+ 	kexec_image_info(kimage);
++	/*
++	 * Whenever arguments passed from kexec-tools, Init the arguments as
++	 * the original ones to try avoiding booting failure.
++	 */
++
++	kexec_args[0] = fw_arg0;
++	kexec_args[1] = fw_arg1;
++	kexec_args[2] = fw_arg2;
++	kexec_args[3] = fw_arg3;
++
++	machine_kexec_init_argv(kimage);
++	machine_kexec_parse_argv(kimage);
+ 
+ 	if (_machine_kexec_prepare)
+ 		return _machine_kexec_prepare(kimage);
+@@ -161,7 +265,7 @@ machine_crash_shutdown(struct pt_regs *r
+ void kexec_nonboot_cpu_jump(void)
+ {
+ 	local_flush_icache_range((unsigned long)relocated_kexec_smp_wait,
+-				 reboot_code_buffer + relocate_new_kernel_size);
++				 reboot_code_buffer + KEXEC_RELOCATE_NEW_KERNEL_SIZE);
+ 
+ 	relocated_kexec_smp_wait(NULL);
+ }
+@@ -199,7 +303,7 @@ void kexec_reboot(void)
+ 	 * machine_kexec() CPU.
+ 	 */
+ 	local_flush_icache_range(reboot_code_buffer,
+-				 reboot_code_buffer + relocate_new_kernel_size);
++				 reboot_code_buffer + KEXEC_RELOCATE_NEW_KERNEL_SIZE);
+ 
+ 	do_kexec = (void *)reboot_code_buffer;
+ 	do_kexec();
+@@ -212,10 +316,12 @@ machine_kexec(struct kimage *image)
+ 	unsigned long *ptr;
+ 
+ 	reboot_code_buffer =
+-	  (unsigned long)page_address(image->control_code_page);
++		(unsigned long)page_address(image->control_code_page);
++	pr_info("reboot_code_buffer = %p\n", (void *)reboot_code_buffer);
+ 
+ 	kexec_start_address =
+ 		(unsigned long) phys_to_virt(image->start);
++	pr_info("kexec_start_address = %p\n", (void *)kexec_start_address);
+ 
+ 	if (image->type == KEXEC_TYPE_DEFAULT) {
+ 		kexec_indirection_page =
+@@ -223,9 +329,19 @@ machine_kexec(struct kimage *image)
+ 	} else {
+ 		kexec_indirection_page = (unsigned long)&image->head;
+ 	}
++	pr_info("kexec_indirection_page = %p\n", (void *)kexec_indirection_page);
+ 
+-	memcpy((void*)reboot_code_buffer, relocate_new_kernel,
+-	       relocate_new_kernel_size);
++	pr_info("Where is memcpy: %p\n", memcpy);
++	pr_info("kexec_relocate_new_kernel = %p, kexec_relocate_new_kernel_end = %p\n",
++		(void *)kexec_relocate_new_kernel, &kexec_relocate_new_kernel_end);
++	pr_info("Copy %lu bytes from %p to %p\n", KEXEC_RELOCATE_NEW_KERNEL_SIZE,
++		(void *)kexec_relocate_new_kernel, (void *)reboot_code_buffer);
++	memcpy((void*)reboot_code_buffer, kexec_relocate_new_kernel,
++	       KEXEC_RELOCATE_NEW_KERNEL_SIZE);
++
++	pr_info("Before _print_args().\n");
++	machine_kexec_print_args();
++	pr_info("Before eval loop.\n");
+ 
+ 	/*
+ 	 * The generic kexec code builds a page list with physical
+@@ -256,7 +372,7 @@ machine_kexec(struct kimage *image)
+ #ifdef CONFIG_SMP
+ 	/* All secondary cpus now may jump to kexec_wait cycle */
+ 	relocated_kexec_smp_wait = reboot_code_buffer +
+-		(void *)(kexec_smp_wait - relocate_new_kernel);
++		(void *)(kexec_smp_wait - kexec_relocate_new_kernel);
+ 	smp_wmb();
+ 	atomic_set(&kexec_ready_to_reboot, 1);
+ #endif
+--- /dev/null
++++ b/arch/mips/kernel/machine_kexec.h
+@@ -0,0 +1,20 @@
++#ifndef _MACHINE_KEXEC_H
++#define _MACHINE_KEXEC_H
++
++#ifndef __ASSEMBLY__
++extern const unsigned char kexec_relocate_new_kernel[];
++extern unsigned long kexec_relocate_new_kernel_end;
++extern unsigned long kexec_start_address;
++extern unsigned long kexec_indirection_page;
++
++extern char kexec_argv_buf[];
++extern char *kexec_argv[];
++
++#define KEXEC_RELOCATE_NEW_KERNEL_SIZE	((unsigned long)&kexec_relocate_new_kernel_end - (unsigned long)kexec_relocate_new_kernel)
++#endif /* !__ASSEMBLY__ */
++
++#define KEXEC_COMMAND_LINE_SIZE		256
++#define KEXEC_ARGV_SIZE			(KEXEC_COMMAND_LINE_SIZE / 16)
++#define KEXEC_MAX_ARGC			(KEXEC_ARGV_SIZE / sizeof(long))
++
++#endif
+--- a/arch/mips/kernel/relocate_kernel.S
++++ b/arch/mips/kernel/relocate_kernel.S
+@@ -10,10 +10,11 @@
+ #include <asm/mipsregs.h>
+ #include <asm/stackframe.h>
+ #include <asm/addrspace.h>
++#include "machine_kexec.h"
+ 
+ #include <kernel-entry-init.h>
+ 
+-LEAF(relocate_new_kernel)
++LEAF(kexec_relocate_new_kernel)
+ 	PTR_L a0,	arg0
+ 	PTR_L a1,	arg1
+ 	PTR_L a2,	arg2
+@@ -98,7 +99,7 @@ done:
+ #endif
+ 	/* jump to kexec_start_address */
+ 	j		s1
+-	END(relocate_new_kernel)
++	END(kexec_relocate_new_kernel)
+ 
+ #ifdef CONFIG_SMP
+ /*
+@@ -177,8 +178,15 @@ EXPORT(kexec_indirection_page)
+ 	PTR_WD		0
+ 	.size		kexec_indirection_page, PTRSIZE
+ 
+-relocate_new_kernel_end:
++kexec_argv_buf:
++	EXPORT(kexec_argv_buf)
++	.skip		KEXEC_COMMAND_LINE_SIZE
++	.size		kexec_argv_buf, KEXEC_COMMAND_LINE_SIZE
++
++kexec_argv:
++	EXPORT(kexec_argv)
++	.skip		KEXEC_ARGV_SIZE
++	.size		kexec_argv, KEXEC_ARGV_SIZE
+ 
+-EXPORT(relocate_new_kernel_size)
+-	PTR_WD		relocate_new_kernel_end - relocate_new_kernel
+-	.size		relocate_new_kernel_size, PTRSIZE
++kexec_relocate_new_kernel_end:
++	EXPORT(kexec_relocate_new_kernel_end)
diff --git a/target/linux/generic/pending-6.1/332-arc-add-OWRTDTB-section.patch b/target/linux/generic/pending-6.1/332-arc-add-OWRTDTB-section.patch
new file mode 100644
index 00000000000000..30158cf399b1f2
--- /dev/null
+++ b/target/linux/generic/pending-6.1/332-arc-add-OWRTDTB-section.patch
@@ -0,0 +1,84 @@
+From bb0c3b0175240bf152fd7c644821a0cf9f77c37c Mon Sep 17 00:00:00 2001
+From: Evgeniy Didin <Evgeniy.Didin@synopsys.com>
+Date: Fri, 15 Mar 2019 18:53:38 +0300
+Subject: [PATCH] arc add OWRTDTB section
+
+This change allows OpenWRT to patch resulting kernel binary with
+external .dtb.
+
+That allows us to re-use exactky the same vmlinux on different boards
+given its ARC core configurations match (at least cache line sizes etc).
+
+""patch-dtb" searches for ASCII "OWRTDTB:" strign and copies external
+.dtb right after it, keeping the string in place.
+
+Signed-off-by: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
+Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
+Signed-off-by: Evgeniy Didin <Evgeniy.Didin@synopsys.com>
+---
+ arch/arc/kernel/head.S        | 10 ++++++++++
+ arch/arc/kernel/setup.c       |  4 +++-
+ arch/arc/kernel/vmlinux.lds.S | 13 +++++++++++++
+ 3 files changed, 26 insertions(+), 1 deletion(-)
+
+--- a/arch/arc/kernel/head.S
++++ b/arch/arc/kernel/head.S
+@@ -88,6 +88,16 @@
+ 	DSP_EARLY_INIT
+ .endm
+ 
++	; Here "patch-dtb" will embed external .dtb
++	; Note "patch-dtb" searches for ASCII "OWRTDTB:" string
++	; and pastes .dtb right after it, hense the string precedes
++	; __image_dtb symbol.
++	.section .owrt, "aw",@progbits
++	.ascii  "OWRTDTB:"
++ENTRY(__image_dtb)
++	.fill   0x4000
++END(__image_dtb)
++
+ 	.section .init.text, "ax",@progbits
+ 
+ ;----------------------------------------------------------------
+--- a/arch/arc/kernel/setup.c
++++ b/arch/arc/kernel/setup.c
+@@ -495,6 +495,8 @@ static inline bool uboot_arg_invalid(uns
+ /* We always pass 0 as magic from U-boot */
+ #define UBOOT_MAGIC_VALUE	0
+ 
++extern struct boot_param_header __image_dtb;
++
+ void __init handle_uboot_args(void)
+ {
+ 	bool use_embedded_dtb = true;
+@@ -533,7 +535,7 @@ void __init handle_uboot_args(void)
+ ignore_uboot_args:
+ 
+ 	if (use_embedded_dtb) {
+-		machine_desc = setup_machine_fdt(__dtb_start);
++		machine_desc = setup_machine_fdt(&__image_dtb);
+ 		if (!machine_desc)
+ 			panic("Embedded DT invalid\n");
+ 	}
+--- a/arch/arc/kernel/vmlinux.lds.S
++++ b/arch/arc/kernel/vmlinux.lds.S
+@@ -27,6 +27,19 @@ SECTIONS
+ 
+ 	. = CONFIG_LINUX_LINK_BASE;
+ 
++	/*
++	* In OpenWRT we want to patch built binary embedding .dtb of choice.
++	* This is implemented with "patch-dtb" utility which searches for
++	* "OWRTDTB:" string in first 16k of image and if it is found
++	* copies .dtb right after mentioned string.
++	*
++	* Note: "OWRTDTB:" won't be overwritten with .dtb, .dtb will follow it.
++	*/
++ 	.owrt : {
++		*(.owrt)
++	. = ALIGN(PAGE_SIZE);
++	}
++
+ 	_int_vec_base_lds = .;
+ 	.vector : {
+ 		*(.vector)
diff --git a/target/linux/generic/pending-6.1/333-arc-enable-unaligned-access-in-kernel-mode.patch b/target/linux/generic/pending-6.1/333-arc-enable-unaligned-access-in-kernel-mode.patch
new file mode 100644
index 00000000000000..1848a84cc4970f
--- /dev/null
+++ b/target/linux/generic/pending-6.1/333-arc-enable-unaligned-access-in-kernel-mode.patch
@@ -0,0 +1,24 @@
+From: Alexey Brodkin <abrodkin@synopsys.com>
+Subject: arc: enable unaligned access in kernel mode
+
+This enables misaligned access handling even in kernel mode.
+Some wireless drivers (ath9k-htc and mt7601u) use misaligned accesses
+here and there and to cope with that without fixing stuff in the drivers
+we're just gracefully handling it on ARC.
+
+Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
+---
+ arch/arc/kernel/unaligned.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arc/kernel/unaligned.c
++++ b/arch/arc/kernel/unaligned.c
+@@ -202,7 +202,7 @@ int misaligned_fixup(unsigned long addre
+ 	char buf[TASK_COMM_LEN];
+ 
+ 	/* handle user mode only and only if enabled by sysadmin */
+-	if (!user_mode(regs) || !unaligned_enabled)
++	if (!unaligned_enabled)
+ 		return 1;
+ 
+ 	if (no_unaligned_warning) {
diff --git a/target/linux/generic/pending-6.1/342-powerpc-Enable-kernel-XZ-compression-option-on-PPC_8.patch b/target/linux/generic/pending-6.1/342-powerpc-Enable-kernel-XZ-compression-option-on-PPC_8.patch
new file mode 100644
index 00000000000000..e9b47d185d2a4a
--- /dev/null
+++ b/target/linux/generic/pending-6.1/342-powerpc-Enable-kernel-XZ-compression-option-on-PPC_8.patch
@@ -0,0 +1,25 @@
+From 66770a004afe10df11d3902e16eaa0c2c39436bb Mon Sep 17 00:00:00 2001
+From: Pawel Dembicki <paweldembicki@gmail.com>
+Date: Fri, 24 May 2019 17:56:19 +0200
+Subject: [PATCH] powerpc: Enable kernel XZ compression option on PPC_85xx
+
+Enable kernel XZ compression option on PPC_85xx. Tested with
+simpleImage on TP-Link TL-WDR4900 (Freescale P1014 processor).
+
+Suggested-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+---
+ arch/powerpc/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -229,7 +229,7 @@ config PPC
+ 	select HAVE_KERNEL_GZIP
+ 	select HAVE_KERNEL_LZMA			if DEFAULT_UIMAGE
+ 	select HAVE_KERNEL_LZO			if DEFAULT_UIMAGE
+-	select HAVE_KERNEL_XZ			if PPC_BOOK3S || 44x
++	select HAVE_KERNEL_XZ			if PPC_BOOK3S || 44x || PPC_85xx
+ 	select HAVE_KPROBES
+ 	select HAVE_KPROBES_ON_FTRACE
+ 	select HAVE_KRETPROBES
diff --git a/target/linux/generic/pending-6.1/351-irqchip-bcm-6345-l1-request-memory-region.patch b/target/linux/generic/pending-6.1/351-irqchip-bcm-6345-l1-request-memory-region.patch
new file mode 100644
index 00000000000000..91654cc294c31f
--- /dev/null
+++ b/target/linux/generic/pending-6.1/351-irqchip-bcm-6345-l1-request-memory-region.patch
@@ -0,0 +1,113 @@
+From patchwork Thu Mar 16 19:28:33 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=
+ <noltari@gmail.com>
+X-Patchwork-Id: 13178238
+Return-Path: <linux-mips-owner@vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id 5EF2AC6FD19
+	for <linux-mips@archiver.kernel.org>; Thu, 16 Mar 2023 19:28:43 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S230076AbjCPT2l (ORCPT <rfc822;linux-mips@archiver.kernel.org>);
+        Thu, 16 Mar 2023 15:28:41 -0400
+Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56412 "EHLO
+        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S230039AbjCPT2k (ORCPT
+        <rfc822;linux-mips@vger.kernel.org>); Thu, 16 Mar 2023 15:28:40 -0400
+Received: from mail-wr1-x42f.google.com (mail-wr1-x42f.google.com
+ [IPv6:2a00:1450:4864:20::42f])
+        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7259B7D9F;
+        Thu, 16 Mar 2023 12:28:38 -0700 (PDT)
+Received: by mail-wr1-x42f.google.com with SMTP id y14so2539231wrq.4;
+        Thu, 16 Mar 2023 12:28:38 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20210112; t=1678994917;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:from:to:cc:subject:date
+         :message-id:reply-to;
+        bh=j8afldfRZftLeVmekmQfoh01jVdumsVP7nkKoPaU3Q0=;
+        b=FzMRr5ekh/fDiJqTlezNj6nLjzvn5z92FtYeB8MquVSMB8PuvarccnyqAzsXiccf+v
+         uwRFIomnTWNLGVjzc1xrB2hGiCKD3jBo5n1u8p/yEV6rpolbxVjfM7eTHXyAHXGXz7ZJ
+         TPeVbWfAlxiSD6+BPtXr/efehcdI64fIoL6G/U1WHNMo01Tzr/Obf3y5tug17N0fGcXg
+         CH6E5a2HguZUtwrm26LcK9IOV/7xEx5eIE1cOvTLMxPbGWaZwEjjP16HylJr06xRLhaf
+         RpiYBT3mXwwuOx0jLOhqavY/2kZ9GVbZRWMMwZrZv9xNO13SBwc1VUVgD4k3FntnSk7Z
+         AaOQ==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20210112; t=1678994917;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
+         :subject:date:message-id:reply-to;
+        bh=j8afldfRZftLeVmekmQfoh01jVdumsVP7nkKoPaU3Q0=;
+        b=OaA5DMgqalrfqO5iOtmmxFPsH90MkN7l4EJpyVnzuiO1Wd6rSCpqPOR7xpxZno8OPP
+         tdfm4vzn9Ie4AUDbFKDTUlPG+tgkmIruo3K9C0VnY9DD2PRZMEYBbWaJKU1otqKt0NKu
+         IAAHNvxvQvCESKzbXFLYwWbRKFScOSMGmGBTDfgThz51A18Ff1hJy/BmnuZk7M2TLgHO
+         wQpy9t7oeB/Hkxl41y46emLc/nESsvwvAG/fx/zPzCe9UiaQLrdZq+BKeOwSBedktzK5
+         U/ZTfgzU2UGSI67aGRqqGnI0uXq+MAJMK18qzM0VByxj6W+AXJ6BJr5P0quljeQ8upSg
+         bEUg==
+X-Gm-Message-State: AO0yUKWnqTlccBDnqwCSRdqOBGc2FyfiLy1Tg7EjPENlISpzXuDYwW/R
+        lJSI06rrfq+Vel/SigfpGJI=
+X-Google-Smtp-Source: 
+ AK7set/jYfYl9ttVzIXJO+ZQVfa6cE/yOsP8fx4teiTmGNNWyVlIJRzMAlF3IUGqRAXAmY3hAabIuQ==
+X-Received: by 2002:a5d:40ce:0:b0:2cd:ceab:df1a with SMTP id
+ b14-20020a5d40ce000000b002cdceabdf1amr381006wrq.32.1678994916642;
+        Thu, 16 Mar 2023 12:28:36 -0700 (PDT)
+Received: from atlantis.lan (255.red-79-146-124.dynamicip.rima-tde.net.
+ [79.146.124.255])
+        by smtp.gmail.com with ESMTPSA id
+ l10-20020a5d4bca000000b002cfea3c49d5sm180041wrt.52.2023.03.16.12.28.35
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Thu, 16 Mar 2023 12:28:35 -0700 (PDT)
+From: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+To: f.fainelli@gmail.com, jonas.gorski@gmail.com,
+        bcm-kernel-feedback-list@broadcom.com, tglx@linutronix.de,
+        maz@kernel.org, linux-mips@vger.kernel.org,
+        linux-kernel@vger.kernel.org
+Cc: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+Subject: [PATCH v2] irqchip/bcm-6345-l1: request memory region
+Date: Thu, 16 Mar 2023 20:28:33 +0100
+Message-Id: <20230316192833.1603149-1-noltari@gmail.com>
+X-Mailer: git-send-email 2.30.2
+In-Reply-To: <20230316180701.783785-1-noltari@gmail.com>
+References: <20230316180701.783785-1-noltari@gmail.com>
+MIME-Version: 1.0
+Precedence: bulk
+List-ID: <linux-mips.vger.kernel.org>
+X-Mailing-List: linux-mips@vger.kernel.org
+
+Request memory region in order to display it in /proc/iomem.
+Also stop printing the MMIO address since it just displays (ptrval).
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ v2: request memory region and stop displaying MMIO address.
+
+ drivers/irqchip/irq-bcm6345-l1.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/irqchip/irq-bcm6345-l1.c
++++ b/drivers/irqchip/irq-bcm6345-l1.c
+@@ -257,6 +257,9 @@ static int __init bcm6345_l1_init_one(st
+ 	if (!cpu->map_base)
+ 		return -ENOMEM;
+ 
++	if (!request_mem_region(res.start, sz, res.name))
++		pr_err("failed to request intc memory");
++
+ 	for (i = 0; i < n_words; i++) {
+ 		cpu->enable_cache[i] = 0;
+ 		__raw_writel(0, cpu->map_base + reg_enable(intc, i));
+@@ -335,8 +338,7 @@ static int __init bcm6345_l1_of_init(str
+ 	for_each_cpu(idx, &intc->cpumask) {
+ 		struct bcm6345_l1_cpu *cpu = intc->cpus[idx];
+ 
+-		pr_info("  CPU%u at MMIO 0x%p (irq = %d)\n", idx,
+-				cpu->map_base, cpu->parent_irq);
++		pr_info("  CPU%u (irq = %d)\n", idx, cpu->parent_irq);
+ 	}
+ 
+ 	return 0;
diff --git a/target/linux/generic/pending-6.1/400-mtd-mtdsplit-support.patch b/target/linux/generic/pending-6.1/400-mtd-mtdsplit-support.patch
new file mode 100644
index 00000000000000..c619d12ce53985
--- /dev/null
+++ b/target/linux/generic/pending-6.1/400-mtd-mtdsplit-support.patch
@@ -0,0 +1,328 @@
+From 39717277d5c87bdb183cf2f258957b44ba99b4df Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 11:47:35 +0200
+Subject: [PATCH] mtd: mtdsplit support
+
+---
+ drivers/mtd/Kconfig            |  19 ++++
+ drivers/mtd/Makefile           |   2 +
+ drivers/mtd/mtdpart.c          | 169 ++++++++++++++++++++++++++++-----
+ include/linux/mtd/mtd.h        |  25 +++++
+ include/linux/mtd/partitions.h |   7 ++
+ 5 files changed, 197 insertions(+), 25 deletions(-)
+
+--- a/drivers/mtd/Kconfig
++++ b/drivers/mtd/Kconfig
+@@ -12,6 +12,25 @@ menuconfig MTD
+ 
+ if MTD
+ 
++menu "OpenWrt specific MTD options"
++
++config MTD_ROOTFS_ROOT_DEV
++	bool "Automatically set 'rootfs' partition to be root filesystem"
++	default y
++
++config MTD_SPLIT_FIRMWARE
++	bool "Automatically split firmware partition for kernel+rootfs"
++	default y
++
++config MTD_SPLIT_FIRMWARE_NAME
++	string "Firmware partition name"
++	depends on MTD_SPLIT_FIRMWARE
++	default "firmware"
++
++source "drivers/mtd/mtdsplit/Kconfig"
++
++endmenu
++
+ config MTD_TESTS
+ 	tristate "MTD tests support (DANGEROUS)"
+ 	depends on m
+--- a/drivers/mtd/Makefile
++++ b/drivers/mtd/Makefile
+@@ -9,6 +9,8 @@ mtd-y				:= mtdcore.o mtdsuper.o mtdconc
+ 
+ obj-y				+= parsers/
+ 
++obj-$(CONFIG_MTD_SPLIT)		+= mtdsplit/
++
+ # 'Users' - code which presents functionality to userspace.
+ obj-$(CONFIG_MTD_BLKDEVS)	+= mtd_blkdevs.o
+ obj-$(CONFIG_MTD_BLOCK)		+= mtdblock.o
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -15,11 +15,13 @@
+ #include <linux/kmod.h>
+ #include <linux/mtd/mtd.h>
+ #include <linux/mtd/partitions.h>
++#include <linux/magic.h>
+ #include <linux/err.h>
+ #include <linux/of.h>
+ #include <linux/of_platform.h>
+ 
+ #include "mtdcore.h"
++#include "mtdsplit/mtdsplit.h"
+ 
+ /*
+  * MTD methods which simply translate the effective address and pass through
+@@ -236,6 +238,147 @@ static int mtd_add_partition_attrs(struc
+ 	return ret;
+ }
+ 
++static DEFINE_SPINLOCK(part_parser_lock);
++static LIST_HEAD(part_parsers);
++
++static struct mtd_part_parser *mtd_part_parser_get(const char *name)
++{
++	struct mtd_part_parser *p, *ret = NULL;
++
++	spin_lock(&part_parser_lock);
++
++	list_for_each_entry(p, &part_parsers, list)
++		if (!strcmp(p->name, name) && try_module_get(p->owner)) {
++			ret = p;
++			break;
++		}
++
++	spin_unlock(&part_parser_lock);
++
++	return ret;
++}
++
++static inline void mtd_part_parser_put(const struct mtd_part_parser *p)
++{
++	module_put(p->owner);
++}
++
++static struct mtd_part_parser *
++get_partition_parser_by_type(enum mtd_parser_type type,
++			     struct mtd_part_parser *start)
++{
++	struct mtd_part_parser *p, *ret = NULL;
++
++	spin_lock(&part_parser_lock);
++
++	p = list_prepare_entry(start, &part_parsers, list);
++	if (start)
++		mtd_part_parser_put(start);
++
++	list_for_each_entry_continue(p, &part_parsers, list) {
++		if (p->type == type && try_module_get(p->owner)) {
++			ret = p;
++			break;
++		}
++	}
++
++	spin_unlock(&part_parser_lock);
++
++	return ret;
++}
++
++static int parse_mtd_partitions_by_type(struct mtd_info *master,
++					enum mtd_parser_type type,
++					const struct mtd_partition **pparts,
++					struct mtd_part_parser_data *data)
++{
++	struct mtd_part_parser *prev = NULL;
++	int ret = 0;
++
++	while (1) {
++		struct mtd_part_parser *parser;
++
++		parser = get_partition_parser_by_type(type, prev);
++		if (!parser)
++			break;
++
++		ret = (*parser->parse_fn)(master, pparts, data);
++
++		if (ret > 0) {
++			mtd_part_parser_put(parser);
++			printk(KERN_NOTICE
++			       "%d %s partitions found on MTD device %s\n",
++			       ret, parser->name, master->name);
++			break;
++		}
++
++		prev = parser;
++	}
++
++	return ret;
++}
++
++static int
++run_parsers_by_type(struct mtd_info *child, enum mtd_parser_type type)
++{
++	struct mtd_partition *parts;
++	int nr_parts;
++	int i;
++
++	nr_parts = parse_mtd_partitions_by_type(child, type, (const struct mtd_partition **)&parts,
++						NULL);
++	if (nr_parts <= 0)
++		return nr_parts;
++
++	if (WARN_ON(!parts))
++		return 0;
++
++	for (i = 0; i < nr_parts; i++) {
++		/* adjust partition offsets */
++		parts[i].offset += child->part.offset;
++
++		mtd_add_partition(child->parent,
++				  parts[i].name,
++				  parts[i].offset,
++				  parts[i].size);
++	}
++
++	kfree(parts);
++
++	return nr_parts;
++}
++
++#ifdef CONFIG_MTD_SPLIT_FIRMWARE_NAME
++#define SPLIT_FIRMWARE_NAME	CONFIG_MTD_SPLIT_FIRMWARE_NAME
++#else
++#define SPLIT_FIRMWARE_NAME	"unused"
++#endif
++
++static void split_firmware(struct mtd_info *master, struct mtd_info *part)
++{
++	run_parsers_by_type(part, MTD_PARSER_TYPE_FIRMWARE);
++}
++
++static void mtd_partition_split(struct mtd_info *master, struct mtd_info *part)
++{
++	static int rootfs_found = 0;
++
++	if (rootfs_found)
++		return;
++
++	if (of_find_property(mtd_get_of_node(part), "linux,rootfs", NULL) ||
++	    !strcmp(part->name, "rootfs")) {
++		run_parsers_by_type(part, MTD_PARSER_TYPE_ROOTFS);
++
++		rootfs_found = 1;
++	}
++
++	if (IS_ENABLED(CONFIG_MTD_SPLIT_FIRMWARE) &&
++	    !strcmp(part->name, SPLIT_FIRMWARE_NAME) &&
++	    !of_find_property(mtd_get_of_node(part), "compatible", NULL))
++		split_firmware(master, part);
++}
++
+ int mtd_add_partition(struct mtd_info *parent, const char *name,
+ 		      long long offset, long long length)
+ {
+@@ -274,6 +417,7 @@ int mtd_add_partition(struct mtd_info *p
+ 	if (ret)
+ 		goto err_remove_part;
+ 
++	mtd_partition_split(parent, child);
+ 	mtd_add_partition_attrs(child);
+ 
+ 	return 0;
+@@ -422,6 +566,7 @@ int add_mtd_partitions(struct mtd_info *
+ 			goto err_del_partitions;
+ 		}
+ 
++		mtd_partition_split(master, child);
+ 		mtd_add_partition_attrs(child);
+ 
+ 		/* Look for subpartitions */
+@@ -438,31 +583,6 @@ err_del_partitions:
+ 	return ret;
+ }
+ 
+-static DEFINE_SPINLOCK(part_parser_lock);
+-static LIST_HEAD(part_parsers);
+-
+-static struct mtd_part_parser *mtd_part_parser_get(const char *name)
+-{
+-	struct mtd_part_parser *p, *ret = NULL;
+-
+-	spin_lock(&part_parser_lock);
+-
+-	list_for_each_entry(p, &part_parsers, list)
+-		if (!strcmp(p->name, name) && try_module_get(p->owner)) {
+-			ret = p;
+-			break;
+-		}
+-
+-	spin_unlock(&part_parser_lock);
+-
+-	return ret;
+-}
+-
+-static inline void mtd_part_parser_put(const struct mtd_part_parser *p)
+-{
+-	module_put(p->owner);
+-}
+-
+ /*
+  * Many partition parsers just expected the core to kfree() all their data in
+  * one chunk. Do that by default.
+--- a/include/linux/mtd/mtd.h
++++ b/include/linux/mtd/mtd.h
+@@ -615,6 +615,24 @@ static inline void mtd_align_erase_req(s
+ 		req->len += mtd->erasesize - mod;
+ }
+ 
++static inline uint64_t mtd_roundup_to_eb(uint64_t sz, struct mtd_info *mtd)
++{
++	if (mtd_mod_by_eb(sz, mtd) == 0)
++		return sz;
++
++	/* Round up to next erase block */
++	return (mtd_div_by_eb(sz, mtd) + 1) * mtd->erasesize;
++}
++
++static inline uint64_t mtd_rounddown_to_eb(uint64_t sz, struct mtd_info *mtd)
++{
++	if (mtd_mod_by_eb(sz, mtd) == 0)
++		return sz;
++
++	/* Round down to the start of the current erase block */
++	return (mtd_div_by_eb(sz, mtd)) * mtd->erasesize;
++}
++
+ static inline uint32_t mtd_div_by_ws(uint64_t sz, struct mtd_info *mtd)
+ {
+ 	if (mtd->writesize_shift)
+@@ -688,6 +706,13 @@ extern struct mtd_info *of_get_mtd_devic
+ extern struct mtd_info *get_mtd_device_nm(const char *name);
+ extern void put_mtd_device(struct mtd_info *mtd);
+ 
++static inline uint64_t mtdpart_get_offset(const struct mtd_info *mtd)
++{
++	if (!mtd_is_partition(mtd))
++		return 0;
++
++	return mtd->part.offset;
++}
+ 
+ struct mtd_notifier {
+ 	void (*add)(struct mtd_info *mtd);
+--- a/include/linux/mtd/partitions.h
++++ b/include/linux/mtd/partitions.h
+@@ -75,6 +75,12 @@ struct mtd_part_parser_data {
+  * Functions dealing with the various ways of partitioning the space
+  */
+ 
++enum mtd_parser_type {
++	MTD_PARSER_TYPE_DEVICE = 0,
++	MTD_PARSER_TYPE_ROOTFS,
++	MTD_PARSER_TYPE_FIRMWARE,
++};
++
+ struct mtd_part_parser {
+ 	struct list_head list;
+ 	struct module *owner;
+@@ -83,6 +89,7 @@ struct mtd_part_parser {
+ 	int (*parse_fn)(struct mtd_info *, const struct mtd_partition **,
+ 			struct mtd_part_parser_data *);
+ 	void (*cleanup)(const struct mtd_partition *pparts, int nr_parts);
++	enum mtd_parser_type type;
+ };
+ 
+ /* Container for passing around a set of parsed partitions */
diff --git a/target/linux/generic/pending-6.1/402-mtd-spi-nor-write-support-for-minor-aligned-partitions.patch b/target/linux/generic/pending-6.1/402-mtd-spi-nor-write-support-for-minor-aligned-partitions.patch
new file mode 100644
index 00000000000000..f04da4000ccb88
--- /dev/null
+++ b/target/linux/generic/pending-6.1/402-mtd-spi-nor-write-support-for-minor-aligned-partitions.patch
@@ -0,0 +1,245 @@
+From acacdac272927ae1d96e0bca51eb82899671eaea Mon Sep 17 00:00:00 2001
+From: John Thomson <git@johnthomson.fastmail.com.au>
+Date: Fri, 25 Dec 2020 18:50:08 +1000
+Subject: [PATCH] mtd: spi-nor: write support for minor aligned partitions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Do not prevent writing to mtd partitions where a partition boundary sits
+on a minor erasesize boundary.
+This addresses a FIXME that has been present since the start of the
+linux git history:
+/* Doesn't start on a boundary of major erase size */
+/* FIXME: Let it be writable if it is on a boundary of
+ * _minor_ erase size though */
+
+Allow a uniform erase region spi-nor device to be configured
+to use the non-uniform erase regions code path for an erase with:
+CONFIG_MTD_SPI_NOR_USE_VARIABLE_ERASE=y
+
+On supporting hardware (SECT_4K: majority of current SPI-NOR device)
+provide the facility for an erase to use the least number
+of SPI-NOR operations, as well as access to 4K erase without
+requiring CONFIG_MTD_SPI_NOR_USE_4K_SECTORS
+
+Introduce erasesize_minor to the mtd struct,
+the smallest erasesize supported by the device
+
+On existing devices, this is useful where write support is wanted
+for data on a 4K partition, such as some u-boot-env partitions,
+or RouterBoot soft_config, while still netting the performance
+benefits of using 64K sectors
+
+Performance:
+time mtd erase firmware
+OpenWrt 5.10 ramips MT7621 w25q128jv 0xfc0000 partition length
+
+Without this patch
+MTD_SPI_NOR_USE_4K_SECTORS=y	|n
+real    2m 11.66s		|0m 50.86s
+user    0m 0.00s		|0m 0.00s
+sys     1m 56.20s		|0m 50.80s
+
+With this patch
+MTD_SPI_NOR_USE_VARIABLE_ERASE=n|y		|4K_SECTORS=y
+real    0m 51.68s		|0m 50.85s	|2m 12.89s
+user    0m 0.00s		|0m 0.00s	|0m 0.01s
+sys     0m 46.94s		|0m 50.38s	|2m 12.46s
+
+Signed-off-by: John Thomson <git@johnthomson.fastmail.com.au>
+Signed-off-by: Thibaut VARÈNE <hacks+kernel@slashdirt.org>
+
+---
+
+checkpatch does not like the printk(KERN_WARNING
+these should be changed separately beforehand?
+
+Changes v1 -> v2:
+Added mtdcore sysfs for erasesize_minor
+Removed finding minor erasesize for variable erase regions device,
+as untested and no responses regarding it.
+Moved IF_ENABLED for SPINOR variable erase to guard setting
+erasesize_minor in spi-nor/core.c
+Removed setting erasesize to minor where partition boundaries require
+minor erase to be writable
+Simplified minor boundary check by relying on minor being a factor of
+major
+
+Changes RFC -> v1:
+Fix uninitialized variable smatch warning
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+---
+ drivers/mtd/mtdcore.c       | 10 ++++++++++
+ drivers/mtd/mtdpart.c       | 35 +++++++++++++++++++++++++----------
+ drivers/mtd/spi-nor/Kconfig | 10 ++++++++++
+ drivers/mtd/spi-nor/core.c  | 11 +++++++++--
+ include/linux/mtd/mtd.h     |  2 ++
+ 5 files changed, 56 insertions(+), 12 deletions(-)
+
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -169,6 +169,15 @@ static ssize_t mtd_erasesize_show(struct
+ }
+ MTD_DEVICE_ATTR_RO(erasesize);
+ 
++static ssize_t mtd_erasesize_minor_show(struct device *dev,
++		struct device_attribute *attr, char *buf)
++{
++	struct mtd_info *mtd = dev_get_drvdata(dev);
++
++	return sysfs_emit(buf, "%lu\n", (unsigned long)mtd->erasesize_minor);
++}
++MTD_DEVICE_ATTR_RO(erasesize_minor);
++
+ static ssize_t mtd_writesize_show(struct device *dev,
+ 		struct device_attribute *attr, char *buf)
+ {
+@@ -314,6 +323,7 @@ static struct attribute *mtd_attrs[] = {
+ 	&dev_attr_flags.attr,
+ 	&dev_attr_size.attr,
+ 	&dev_attr_erasesize.attr,
++	&dev_attr_erasesize_minor.attr,
+ 	&dev_attr_writesize.attr,
+ 	&dev_attr_subpagesize.attr,
+ 	&dev_attr_oobsize.attr,
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -41,6 +41,7 @@ static struct mtd_info *allocate_partiti
+ 	struct mtd_info *master = mtd_get_master(parent);
+ 	int wr_alignment = (parent->flags & MTD_NO_ERASE) ?
+ 			   master->writesize : master->erasesize;
++	int wr_alignment_minor = 0;
+ 	u64 parent_size = mtd_is_partition(parent) ?
+ 			  parent->part.size : parent->size;
+ 	struct mtd_info *child;
+@@ -165,6 +166,7 @@ static struct mtd_info *allocate_partiti
+ 	} else {
+ 		/* Single erase size */
+ 		child->erasesize = master->erasesize;
++		child->erasesize_minor = master->erasesize_minor;
+ 	}
+ 
+ 	/*
+@@ -172,26 +174,39 @@ static struct mtd_info *allocate_partiti
+ 	 * exposes several regions with different erasesize. Adjust
+ 	 * wr_alignment accordingly.
+ 	 */
+-	if (!(child->flags & MTD_NO_ERASE))
++	if (!(child->flags & MTD_NO_ERASE)) {
+ 		wr_alignment = child->erasesize;
++		wr_alignment_minor = child->erasesize_minor;
++	}
+ 
+ 	tmp = mtd_get_master_ofs(child, 0);
+ 	remainder = do_div(tmp, wr_alignment);
+ 	if ((child->flags & MTD_WRITEABLE) && remainder) {
+-		/* Doesn't start on a boundary of major erase size */
+-		/* FIXME: Let it be writable if it is on a boundary of
+-		 * _minor_ erase size though */
+-		child->flags &= ~MTD_WRITEABLE;
+-		printk(KERN_WARNING"mtd: partition \"%s\" doesn't start on an erase/write block boundary -- force read-only\n",
+-			part->name);
++		if (wr_alignment_minor) {
++			/* rely on minor being a factor of major erasesize */
++			tmp = remainder;
++			remainder = do_div(tmp, wr_alignment_minor);
++		}
++		if (remainder) {
++			child->flags &= ~MTD_WRITEABLE;
++			printk(KERN_WARNING"mtd: partition \"%s\" doesn't start on an erase/write block boundary -- force read-only\n",
++				part->name);
++		}
+ 	}
+ 
+ 	tmp = mtd_get_master_ofs(child, 0) + child->part.size;
+ 	remainder = do_div(tmp, wr_alignment);
+ 	if ((child->flags & MTD_WRITEABLE) && remainder) {
+-		child->flags &= ~MTD_WRITEABLE;
+-		printk(KERN_WARNING"mtd: partition \"%s\" doesn't end on an erase/write block -- force read-only\n",
+-			part->name);
++		if (wr_alignment_minor) {
++			tmp = remainder;
++			remainder = do_div(tmp, wr_alignment_minor);
++		}
++
++		if (remainder) {
++			child->flags &= ~MTD_WRITEABLE;
++			printk(KERN_WARNING"mtd: partition \"%s\" doesn't end on an erase/write block -- force read-only\n",
++				part->name);
++		}
+ 	}
+ 
+ 	child->size = child->part.size;
+--- a/drivers/mtd/spi-nor/Kconfig
++++ b/drivers/mtd/spi-nor/Kconfig
+@@ -10,6 +10,16 @@ menuconfig MTD_SPI_NOR
+ 
+ if MTD_SPI_NOR
+ 
++config MTD_SPI_NOR_USE_VARIABLE_ERASE
++	bool "Disable uniform_erase to allow use of all hardware supported erasesizes"
++	depends on !MTD_SPI_NOR_USE_4K_SECTORS
++	default n
++	help
++	  Allow mixed use of all hardware supported erasesizes,
++	  by forcing spi_nor to use the multiple eraseregions code path.
++	  For example: A 68K erase will use one 64K erase, and one 4K erase
++	  on supporting hardware.
++
+ config MTD_SPI_NOR_USE_4K_SECTORS
+ 	bool "Use small 4096 B erase sectors"
+ 	default y
+--- a/drivers/mtd/spi-nor/core.c
++++ b/drivers/mtd/spi-nor/core.c
+@@ -1049,6 +1049,8 @@ static u8 spi_nor_convert_3to4_erase(u8
+ 
+ static bool spi_nor_has_uniform_erase(const struct spi_nor *nor)
+ {
++	if (IS_ENABLED(CONFIG_MTD_SPI_NOR_USE_VARIABLE_ERASE))
++		return false;
+ 	return !!nor->params->erase_map.uniform_erase_type;
+ }
+ 
+@@ -2157,6 +2159,7 @@ static int spi_nor_select_erase(struct s
+ {
+ 	struct spi_nor_erase_map *map = &nor->params->erase_map;
+ 	const struct spi_nor_erase_type *erase = NULL;
++	const struct spi_nor_erase_type *erase_minor = NULL;
+ 	struct mtd_info *mtd = &nor->mtd;
+ 	u32 wanted_size = nor->info->sector_size;
+ 	int i;
+@@ -2189,8 +2192,9 @@ static int spi_nor_select_erase(struct s
+ 	 */
+ 	for (i = SNOR_ERASE_TYPE_MAX - 1; i >= 0; i--) {
+ 		if (map->erase_type[i].size) {
+-			erase = &map->erase_type[i];
+-			break;
++			if (!erase)
++				erase = &map->erase_type[i];
++			erase_minor = &map->erase_type[i];
+ 		}
+ 	}
+ 
+@@ -2198,6 +2202,9 @@ static int spi_nor_select_erase(struct s
+ 		return -EINVAL;
+ 
+ 	mtd->erasesize = erase->size;
++	if (IS_ENABLED(CONFIG_MTD_SPI_NOR_USE_VARIABLE_ERASE) &&
++			erase_minor && erase_minor->size < erase->size)
++		mtd->erasesize_minor = erase_minor->size;
+ 	return 0;
+ }
+ 
+--- a/include/linux/mtd/mtd.h
++++ b/include/linux/mtd/mtd.h
+@@ -245,6 +245,8 @@ struct mtd_info {
+ 	 * information below if they desire
+ 	 */
+ 	uint32_t erasesize;
++	/* "Minor" (smallest) erase size supported by the whole device */
++	uint32_t erasesize_minor;
+ 	/* Minimal writable flash unit size. In case of NOR flash it is 1 (even
+ 	 * though individual bits can be cleared), in case of NAND flash it is
+ 	 * one NAND page (or half, or one-fourths of it), in case of ECC-ed NOR
diff --git a/target/linux/generic/pending-6.1/420-mtd-redboot_space.patch b/target/linux/generic/pending-6.1/420-mtd-redboot_space.patch
new file mode 100644
index 00000000000000..5518ea71dd51f9
--- /dev/null
+++ b/target/linux/generic/pending-6.1/420-mtd-redboot_space.patch
@@ -0,0 +1,41 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: add patch for including unpartitioned space in the rootfs partition for redboot devices (if applicable)
+
+[john@phrozen.org: used by ixp and others]
+
+lede-commit: 394918851f84e4d00fa16eb900e7700e95091f00
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ drivers/mtd/redboot.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+--- a/drivers/mtd/parsers/redboot.c
++++ b/drivers/mtd/parsers/redboot.c
+@@ -278,14 +278,21 @@ nogood:
+ #endif
+ 		names += strlen(names) + 1;
+ 
+-#ifdef CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED
+ 		if (fl->next && fl->img->flash_base + fl->img->size + master->erasesize <= fl->next->img->flash_base) {
+-			i++;
+-			parts[i].offset = parts[i - 1].size + parts[i - 1].offset;
+-			parts[i].size = fl->next->img->flash_base - parts[i].offset;
+-			parts[i].name = nullname;
+-		}
++			if (!strcmp(parts[i].name, "rootfs")) {
++				parts[i].size = fl->next->img->flash_base;
++				parts[i].size &= ~(master->erasesize - 1);
++				parts[i].size -= parts[i].offset;
++#ifdef CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED
++				nrparts--;
++			} else {
++				i++;
++				parts[i].offset = parts[i-1].size + parts[i-1].offset;
++				parts[i].size = fl->next->img->flash_base - parts[i].offset;
++				parts[i].name = nullname;
+ #endif
++			}
++		}
+ 		tmp_fl = fl;
+ 		fl = fl->next;
+ 		kfree(tmp_fl);
diff --git a/target/linux/generic/pending-6.1/430-mtd-add-myloader-partition-parser.patch b/target/linux/generic/pending-6.1/430-mtd-add-myloader-partition-parser.patch
new file mode 100644
index 00000000000000..c8cf3f5d3be58e
--- /dev/null
+++ b/target/linux/generic/pending-6.1/430-mtd-add-myloader-partition-parser.patch
@@ -0,0 +1,229 @@
+From: Florian Fainelli <f.fainelli@gmail.com>
+Subject: Add myloader partition table parser
+
+[john@phozen.org: shoud be upstreamable]
+
+lede-commit: d8bf22859b51faa09d22c056fe221a45d2f7a3b8
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+[adjust for kernel 5.4, add myloader.c to patch]
+Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
+
+--- a/drivers/mtd/parsers/Kconfig
++++ b/drivers/mtd/parsers/Kconfig
+@@ -67,6 +67,22 @@ config MTD_CMDLINE_PARTS
+ 
+ 	  If unsure, say 'N'.
+ 
++config MTD_MYLOADER_PARTS
++	tristate "MyLoader partition parsing"
++	depends on ADM5120 || ATH25 || ATH79
++	help
++	  MyLoader is a bootloader which allows the user to define partitions
++	  in flash devices, by putting a table in the second erase block
++	  on the device, similar to a partition table. This table gives the
++	  offsets and lengths of the user defined partitions.
++
++	  If you need code which can detect and parse these tables, and
++	  register MTD 'partitions' corresponding to each image detected,
++	  enable this option.
++
++	  You will still need the parsing functions to be called by the driver
++	  for your particular device. It won't happen automatically.
++
+ config MTD_OF_PARTS
+ 	tristate "OpenFirmware (device tree) partitioning parser"
+ 	default y
+--- a/drivers/mtd/parsers/Makefile
++++ b/drivers/mtd/parsers/Makefile
+@@ -4,6 +4,7 @@ obj-$(CONFIG_MTD_BCM47XX_PARTS)		+= bcm4
+ obj-$(CONFIG_MTD_BCM63XX_PARTS)		+= bcm63xxpart.o
+ obj-$(CONFIG_MTD_BRCM_U_BOOT)		+= brcm_u-boot.o
+ obj-$(CONFIG_MTD_CMDLINE_PARTS)		+= cmdlinepart.o
++obj-$(CONFIG_MTD_MYLOADER_PARTS)		+= myloader.o
+ obj-$(CONFIG_MTD_OF_PARTS)		+= ofpart.o
+ ofpart-y				+= ofpart_core.o
+ ofpart-$(CONFIG_MTD_OF_PARTS_BCM4908)	+= ofpart_bcm4908.o
+--- /dev/null
++++ b/drivers/mtd/parsers/myloader.c
+@@ -0,0 +1,181 @@
++/*
++ *  Parse MyLoader-style flash partition tables and produce a Linux partition
++ *  array to match.
++ *
++ *  Copyright (C) 2007-2009 Gabor Juhos <juhosg@openwrt.org>
++ *
++ *  This file was based on drivers/mtd/redboot.c
++ *  Author: Red Hat, Inc. - David Woodhouse <dwmw2@cambridge.redhat.com>
++ *
++ *  This program is free software; you can redistribute it and/or modify it
++ *  under the terms of the GNU General Public License version 2 as published
++ *  by the Free Software Foundation.
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/version.h>
++#include <linux/slab.h>
++#include <linux/init.h>
++#include <linux/vmalloc.h>
++#include <linux/mtd/mtd.h>
++#include <linux/mtd/partitions.h>
++#include <linux/byteorder/generic.h>
++#include <linux/myloader.h>
++
++#define BLOCK_LEN_MIN		0x10000
++#define PART_NAME_LEN		32
++
++struct part_data {
++	struct mylo_partition_table	tab;
++	char names[MYLO_MAX_PARTITIONS][PART_NAME_LEN];
++};
++
++static int myloader_parse_partitions(struct mtd_info *master,
++				     const struct mtd_partition **pparts,
++				     struct mtd_part_parser_data *data)
++{
++	struct part_data *buf;
++	struct mylo_partition_table *tab;
++	struct mylo_partition *part;
++	struct mtd_partition *mtd_parts;
++	struct mtd_partition *mtd_part;
++	int num_parts;
++	int ret, i;
++	size_t retlen;
++	char *names;
++	unsigned long offset;
++	unsigned long blocklen;
++
++	buf = vmalloc(sizeof(*buf));
++	if (!buf) {
++		return -ENOMEM;
++		goto out;
++	}
++	tab = &buf->tab;
++
++	blocklen = master->erasesize;
++	if (blocklen < BLOCK_LEN_MIN)
++		blocklen = BLOCK_LEN_MIN;
++
++	offset = blocklen;
++
++	/* Find the partition table */
++	for (i = 0; i < 4; i++, offset += blocklen) {
++		printk(KERN_DEBUG "%s: searching for MyLoader partition table"
++				" at offset 0x%lx\n", master->name, offset);
++
++		ret = mtd_read(master, offset, sizeof(*buf), &retlen,
++			       (void *)buf);
++		if (ret)
++			goto out_free_buf;
++
++		if (retlen != sizeof(*buf)) {
++			ret = -EIO;
++			goto out_free_buf;
++		}
++
++		/* Check for Partition Table magic number */
++		if (tab->magic == le32_to_cpu(MYLO_MAGIC_PARTITIONS))
++			break;
++
++	}
++
++	if (tab->magic != le32_to_cpu(MYLO_MAGIC_PARTITIONS)) {
++		printk(KERN_DEBUG "%s: no MyLoader partition table found\n",
++			master->name);
++		ret = 0;
++		goto out_free_buf;
++	}
++
++	/* The MyLoader and the Partition Table is always present */
++	num_parts = 2;
++
++	/* Detect number of used partitions */
++	for (i = 0; i < MYLO_MAX_PARTITIONS; i++) {
++		part = &tab->partitions[i];
++
++		if (le16_to_cpu(part->type) == PARTITION_TYPE_FREE)
++			continue;
++
++		num_parts++;
++	}
++
++	mtd_parts = kzalloc((num_parts * sizeof(*mtd_part) +
++				num_parts * PART_NAME_LEN), GFP_KERNEL);
++
++	if (!mtd_parts) {
++		ret = -ENOMEM;
++		goto out_free_buf;
++	}
++
++	mtd_part = mtd_parts;
++	names = (char *)&mtd_parts[num_parts];
++
++	strncpy(names, "myloader", PART_NAME_LEN);
++	mtd_part->name = names;
++	mtd_part->offset = 0;
++	mtd_part->size = offset;
++	mtd_part->mask_flags = MTD_WRITEABLE;
++	mtd_part++;
++	names += PART_NAME_LEN;
++
++	strncpy(names, "partition_table", PART_NAME_LEN);
++	mtd_part->name = names;
++	mtd_part->offset = offset;
++	mtd_part->size = blocklen;
++	mtd_part->mask_flags = MTD_WRITEABLE;
++	mtd_part++;
++	names += PART_NAME_LEN;
++
++	for (i = 0; i < MYLO_MAX_PARTITIONS; i++) {
++		part = &tab->partitions[i];
++
++		if (le16_to_cpu(part->type) == PARTITION_TYPE_FREE)
++			continue;
++
++		if ((buf->names[i][0]) && (buf->names[i][0] != '\xff'))
++			strncpy(names, buf->names[i], PART_NAME_LEN);
++		else
++			snprintf(names, PART_NAME_LEN, "partition%d", i);
++
++		mtd_part->offset = le32_to_cpu(part->addr);
++		mtd_part->size = le32_to_cpu(part->size);
++		mtd_part->name = names;
++		mtd_part++;
++		names += PART_NAME_LEN;
++	}
++
++	*pparts = mtd_parts;
++	ret = num_parts;
++
++ out_free_buf:
++	vfree(buf);
++ out:
++	return ret;
++}
++
++static struct mtd_part_parser myloader_mtd_parser = {
++	.owner		= THIS_MODULE,
++	.parse_fn	= myloader_parse_partitions,
++	.name		= "MyLoader",
++};
++
++static int __init myloader_mtd_parser_init(void)
++{
++	register_mtd_parser(&myloader_mtd_parser);
++
++	return 0;
++}
++
++static void __exit myloader_mtd_parser_exit(void)
++{
++	deregister_mtd_parser(&myloader_mtd_parser);
++}
++
++module_init(myloader_mtd_parser_init);
++module_exit(myloader_mtd_parser_exit);
++
++MODULE_AUTHOR("Gabor Juhos <juhosg@openwrt.org>");
++MODULE_DESCRIPTION("Parsing code for MyLoader partition tables");
++MODULE_LICENSE("GPL v2");
diff --git a/target/linux/generic/pending-6.1/431-mtd-bcm47xxpart-check-for-bad-blocks-when-calculatin.patch b/target/linux/generic/pending-6.1/431-mtd-bcm47xxpart-check-for-bad-blocks-when-calculatin.patch
new file mode 100644
index 00000000000000..bcea45d009bb11
--- /dev/null
+++ b/target/linux/generic/pending-6.1/431-mtd-bcm47xxpart-check-for-bad-blocks-when-calculatin.patch
@@ -0,0 +1,68 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Subject: [PATCH] mtd: bcm47xxpart: check for bad blocks when calculating offsets
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+---
+
+--- a/drivers/mtd/parsers/parser_trx.c
++++ b/drivers/mtd/parsers/parser_trx.c
+@@ -25,6 +25,33 @@ struct trx_header {
+ 	uint32_t offset[3];
+ } __packed;
+ 
++/*
++ * Calculate real end offset (address) for a given amount of data. It checks
++ * all blocks skipping bad ones.
++ */
++static size_t parser_trx_real_offset(struct mtd_info *mtd, size_t bytes)
++{
++	size_t real_offset = 0;
++
++	if (mtd_block_isbad(mtd, real_offset))
++		pr_warn("Base offset shouldn't be at bad block");
++
++	while (bytes >= mtd->erasesize) {
++		bytes -= mtd->erasesize;
++		real_offset += mtd->erasesize;
++		while (mtd_block_isbad(mtd, real_offset)) {
++			real_offset += mtd->erasesize;
++
++			if (real_offset >= mtd->size)
++				return real_offset - mtd->erasesize;
++		}
++	}
++
++	real_offset += bytes;
++
++	return real_offset;
++}
++
+ static const char *parser_trx_data_part_name(struct mtd_info *master,
+ 					     size_t offset)
+ {
+@@ -86,21 +113,21 @@ static int parser_trx_parse(struct mtd_i
+ 	if (trx.offset[2]) {
+ 		part = &parts[curr_part++];
+ 		part->name = "loader";
+-		part->offset = trx.offset[i];
++		part->offset = parser_trx_real_offset(mtd, trx.offset[i]);
+ 		i++;
+ 	}
+ 
+ 	if (trx.offset[i]) {
+ 		part = &parts[curr_part++];
+ 		part->name = "linux";
+-		part->offset = trx.offset[i];
++		part->offset = parser_trx_real_offset(mtd, trx.offset[i]);
+ 		i++;
+ 	}
+ 
+ 	if (trx.offset[i]) {
+ 		part = &parts[curr_part++];
+-		part->name = parser_trx_data_part_name(mtd, trx.offset[i]);
+-		part->offset = trx.offset[i];
++		part->offset = parser_trx_real_offset(mtd, trx.offset[i]);
++		part->name = parser_trx_data_part_name(mtd, part->offset);
+ 		i++;
+ 	}
+ 
diff --git a/target/linux/generic/pending-6.1/432-mtd-bcm47xxpart-detect-T_Meter-partition.patch b/target/linux/generic/pending-6.1/432-mtd-bcm47xxpart-detect-T_Meter-partition.patch
new file mode 100644
index 00000000000000..852654d924a8ce
--- /dev/null
+++ b/target/linux/generic/pending-6.1/432-mtd-bcm47xxpart-detect-T_Meter-partition.patch
@@ -0,0 +1,37 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Subject: mtd: bcm47xxpart: detect T_Meter partition
+
+It can be found on many Netgear devices. It consists of many 0x30 blocks
+starting with 4D 54.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+---
+ drivers/mtd/bcm47xxpart.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/mtd/parsers/bcm47xxpart.c
++++ b/drivers/mtd/parsers/bcm47xxpart.c
+@@ -35,6 +35,7 @@
+ #define NVRAM_HEADER			0x48534C46	/* FLSH */
+ #define POT_MAGIC1			0x54544f50	/* POTT */
+ #define POT_MAGIC2			0x504f		/* OP */
++#define T_METER_MAGIC			0x4D540000	/* MT */
+ #define ML_MAGIC1			0x39685a42
+ #define ML_MAGIC2			0x26594131
+ #define TRX_MAGIC			0x30524448
+@@ -178,6 +179,15 @@ static int bcm47xxpart_parse(struct mtd_
+ 					     MTD_WRITEABLE);
+ 			continue;
+ 		}
++
++		/* T_Meter */
++		if ((le32_to_cpu(buf[0x000 / 4]) & 0xFFFF0000) == T_METER_MAGIC &&
++		    (le32_to_cpu(buf[0x030 / 4]) & 0xFFFF0000) == T_METER_MAGIC &&
++		    (le32_to_cpu(buf[0x060 / 4]) & 0xFFFF0000) == T_METER_MAGIC) {
++			bcm47xxpart_add_part(&parts[curr_part++], "T_Meter", offset,
++					     MTD_WRITEABLE);
++			continue;
++		}
+ 
+ 		/* TRX */
+ 		if (buf[0x000 / 4] == TRX_MAGIC) {
diff --git a/target/linux/generic/pending-6.1/435-mtd-add-routerbootpart-parser-config.patch b/target/linux/generic/pending-6.1/435-mtd-add-routerbootpart-parser-config.patch
new file mode 100644
index 00000000000000..a42dcc868f7baf
--- /dev/null
+++ b/target/linux/generic/pending-6.1/435-mtd-add-routerbootpart-parser-config.patch
@@ -0,0 +1,38 @@
+From 4437e01fb6bca63fccdba5d6c44888b0935885c2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Thibaut=20VAR=C3=88NE?= <hacks@slashdirt.org>
+Date: Tue, 24 Mar 2020 11:45:07 +0100
+Subject: [PATCH] generic: routerboot partition build bits (5.4)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This patch adds routerbootpart kernel build bits
+
+Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
+---
+ drivers/mtd/parsers/Kconfig  | 9 +++++++++
+ drivers/mtd/parsers/Makefile | 1 +
+ 2 files changed, 10 insertions(+)
+
+--- a/drivers/mtd/parsers/Kconfig
++++ b/drivers/mtd/parsers/Kconfig
+@@ -236,3 +236,12 @@ config MTD_SERCOMM_PARTS
+ 	  partition map. This partition table contains real partition
+ 	  offsets, which may differ from device to device depending on the
+ 	  number and location of bad blocks on NAND.
++
++config MTD_ROUTERBOOT_PARTS
++	tristate "RouterBoot flash partition parser"
++	depends on MTD && OF
++	help
++	 MikroTik RouterBoot is implemented as a multi segment system on the
++	 flash, some of which are fixed and some of which are located at
++	 variable offsets. This parser handles both cases via properly
++	 formatted DTS.
+--- a/drivers/mtd/parsers/Makefile
++++ b/drivers/mtd/parsers/Makefile
+@@ -17,3 +17,4 @@ obj-$(CONFIG_MTD_SERCOMM_PARTS)		+= scpa
+ obj-$(CONFIG_MTD_SHARPSL_PARTS)		+= sharpslpart.o
+ obj-$(CONFIG_MTD_REDBOOT_PARTS)		+= redboot.o
+ obj-$(CONFIG_MTD_QCOMSMEM_PARTS)	+= qcomsmempart.o
++obj-$(CONFIG_MTD_ROUTERBOOT_PARTS)		+= routerbootpart.o
diff --git a/target/linux/generic/pending-6.1/460-mtd-cfi_cmdset_0002-no-erase_suspend.patch b/target/linux/generic/pending-6.1/460-mtd-cfi_cmdset_0002-no-erase_suspend.patch
new file mode 100644
index 00000000000000..1b653fb735c9e8
--- /dev/null
+++ b/target/linux/generic/pending-6.1/460-mtd-cfi_cmdset_0002-no-erase_suspend.patch
@@ -0,0 +1,25 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: kernel: disable cfi cmdset 0002 erase suspend
+
+on some platforms, erase suspend leads to data corruption and lockups when write
+ops collide with erase ops. this has been observed on the buffalo wzr-hp-g300nh.
+rather than play whack-a-mole with a hard to reproduce issue on a variety of devices,
+simply disable erase suspend, as it will usually not produce any useful gain on
+the small filesystems used on embedded hardware.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ drivers/mtd/chips/cfi_cmdset_0002.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/chips/cfi_cmdset_0002.c
++++ b/drivers/mtd/chips/cfi_cmdset_0002.c
+@@ -908,7 +908,7 @@ static int get_chip(struct map_info *map
+ 		return 0;
+ 
+ 	case FL_ERASING:
+-		if (!cfip || !(cfip->EraseSuspend & (0x1|0x2)) ||
++		if (1 /* no suspend */ || !cfip || !(cfip->EraseSuspend & (0x1|0x2)) ||
+ 		    !(mode == FL_READY || mode == FL_POINT ||
+ 		    (mode == FL_WRITING && (cfip->EraseSuspend & 0x2))))
+ 			goto sleep;
diff --git a/target/linux/generic/pending-6.1/461-mtd-cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch b/target/linux/generic/pending-6.1/461-mtd-cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch
new file mode 100644
index 00000000000000..f2788c5214083b
--- /dev/null
+++ b/target/linux/generic/pending-6.1/461-mtd-cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch
@@ -0,0 +1,17 @@
+From: George Kashperko <george@znau.edu.ua>
+Subject: Issue map read after Write Buffer Load command to ensure chip is ready to receive data.
+
+Signed-off-by: George Kashperko <george@znau.edu.ua>
+---
+ drivers/mtd/chips/cfi_cmdset_0002.c |    1 +
+ 1 file changed, 1 insertion(+)
+--- a/drivers/mtd/chips/cfi_cmdset_0002.c
++++ b/drivers/mtd/chips/cfi_cmdset_0002.c
+@@ -2052,6 +2052,7 @@ static int __xipram do_write_buffer(stru
+ 
+ 	/* Write Buffer Load */
+ 	map_write(map, CMD(0x25), cmd_adr);
++	(void) map_read(map, cmd_adr);
+ 
+ 	chip->state = FL_WRITING_TO_BUFFER;
+ 
diff --git a/target/linux/generic/pending-6.1/465-m25p80-mx-disable-software-protection.patch b/target/linux/generic/pending-6.1/465-m25p80-mx-disable-software-protection.patch
new file mode 100644
index 00000000000000..1e280773381cc1
--- /dev/null
+++ b/target/linux/generic/pending-6.1/465-m25p80-mx-disable-software-protection.patch
@@ -0,0 +1,18 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: Disable software protection bits for Macronix flashes.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ drivers/mtd/spi-nor/spi-nor.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mtd/spi-nor/macronix.c
++++ b/drivers/mtd/spi-nor/macronix.c
+@@ -106,6 +106,7 @@ static void macronix_nor_default_init(st
+ {
+ 	nor->params->quad_enable = spi_nor_sr1_bit6_quad_enable;
+ 	nor->params->set_4byte_addr_mode = spi_nor_set_4byte_addr_mode;
++	nor->flags |= SNOR_F_HAS_LOCK;
+ }
+ 
+ static const struct spi_nor_fixups macronix_nor_fixups = {
diff --git a/target/linux/generic/pending-6.1/476-mtd-spi-nor-add-eon-en25q128.patch b/target/linux/generic/pending-6.1/476-mtd-spi-nor-add-eon-en25q128.patch
new file mode 100644
index 00000000000000..303e488433a07a
--- /dev/null
+++ b/target/linux/generic/pending-6.1/476-mtd-spi-nor-add-eon-en25q128.patch
@@ -0,0 +1,19 @@
+From: Piotr Dymacz <pepe2k@gmail.com>
+Subject: kernel/mtd: add support for EON EN25Q128
+
+Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
+---
+ drivers/mtd/spi-nor/spi-nor.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mtd/spi-nor/eon.c
++++ b/drivers/mtd/spi-nor/eon.c
+@@ -17,6 +17,8 @@ static const struct flash_info eon_nor_p
+ 	{ "en25p64",    INFO(0x1c2017, 0, 64 * 1024,  128) },
+ 	{ "en25q64",    INFO(0x1c3017, 0, 64 * 1024,  128)
+ 		NO_SFDP_FLAGS(SECT_4K) },
++	{ "en25q128",   INFO(0x1c3018, 0, 64 * 1024,  256)
++		NO_SFDP_FLAGS(SECT_4K) },
+ 	{ "en25q80a",   INFO(0x1c3014, 0, 64 * 1024,   16)
+ 		NO_SFDP_FLAGS(SECT_4K | SPI_NOR_DUAL_READ) },
+ 	{ "en25qh16",   INFO(0x1c7015, 0, 64 * 1024,   32)
diff --git a/target/linux/generic/pending-6.1/477-mtd-spi-nor-add-eon-en25qx128a.patch b/target/linux/generic/pending-6.1/477-mtd-spi-nor-add-eon-en25qx128a.patch
new file mode 100644
index 00000000000000..6740d1d7beb9f7
--- /dev/null
+++ b/target/linux/generic/pending-6.1/477-mtd-spi-nor-add-eon-en25qx128a.patch
@@ -0,0 +1,21 @@
+From: Christian Marangi <ansuelsmth@gmail.com>
+Subject: kernel/mtd: add support for EON EN25QX128A
+
+Add support for EON EN25QX128A with no flags as it does
+support SFDP parsing.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/mtd/spi-nor/spi-nor.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mtd/spi-nor/eon.c
++++ b/drivers/mtd/spi-nor/eon.c
+@@ -19,6 +19,7 @@ static const struct flash_info eon_nor_p
+ 		NO_SFDP_FLAGS(SECT_4K) },
+ 	{ "en25q128",   INFO(0x1c3018, 0, 64 * 1024,  256)
+ 		NO_SFDP_FLAGS(SECT_4K) },
++	{ "en25qx128a", INFO(0x1c7118, 0, 64 * 1024, 256) },
+ 	{ "en25q80a",   INFO(0x1c3014, 0, 64 * 1024,   16)
+ 		NO_SFDP_FLAGS(SECT_4K | SPI_NOR_DUAL_READ) },
+ 	{ "en25qh16",   INFO(0x1c7015, 0, 64 * 1024,   32)
diff --git a/target/linux/generic/pending-6.1/479-mtd-spi-nor-add-xtx-xt25f128b.patch b/target/linux/generic/pending-6.1/479-mtd-spi-nor-add-xtx-xt25f128b.patch
new file mode 100644
index 00000000000000..0ec6aa7fb65052
--- /dev/null
+++ b/target/linux/generic/pending-6.1/479-mtd-spi-nor-add-xtx-xt25f128b.patch
@@ -0,0 +1,81 @@
+From patchwork Thu Feb  6 17:19:41 2020
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 1234465
+Date: Thu, 6 Feb 2020 19:19:41 +0200
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-mtd@lists.infradead.org
+Subject: [PATCH v2] mtd: spi-nor: Add support for xt25f128b chip
+Message-ID: <20200206171941.GA2398@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+List-Subscribe: <http://lists.infradead.org/mailman/listinfo/linux-mtd>,
+ <mailto:linux-mtd-request@lists.infradead.org?subject=subscribe>
+Cc: Eitan Cohen <eitan@neot-semadar.com>, Piotr Dymacz <pepe2k@gmail.com>,
+ Tudor Ambarus <tudor.ambarus@microchip.com>
+Sender: "linux-mtd" <linux-mtd-bounces@lists.infradead.org>
+Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org
+
+Add XT25F128B made by XTX Technology (Shenzhen) Limited.
+This chip supports dual and quad read and uniform 4K-byte erase.
+Verified on Teltonika RUT955 which comes with XT25F128B in recent
+versions of the device.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ drivers/mtd/spi-nor/spi-nor.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/mtd/spi-nor/Makefile
++++ b/drivers/mtd/spi-nor/Makefile
+@@ -17,6 +17,7 @@ spi-nor-objs			+= sst.o
+ spi-nor-objs			+= winbond.o
+ spi-nor-objs			+= xilinx.o
+ spi-nor-objs			+= xmc.o
++spi-nor-objs			+= xtx.o
+ spi-nor-$(CONFIG_DEBUG_FS)	+= debugfs.o
+ obj-$(CONFIG_MTD_SPI_NOR)	+= spi-nor.o
+ 
+--- /dev/null
++++ b/drivers/mtd/spi-nor/xtx.c
+@@ -0,0 +1,17 @@
++// SPDX-License-Identifier: GPL-2.0
++#include <linux/mtd/spi-nor.h>
++
++#include "core.h"
++
++static const struct flash_info xtx_parts[] = {
++	/* XTX Technology (Shenzhen) Limited */
++	{ "xt25f128b", INFO(0x0B4018, 0, 64 * 1024, 256)
++		NO_SFDP_FLAGS(SECT_4K | SPI_NOR_DUAL_READ |
++			      SPI_NOR_QUAD_READ) },
++};
++
++const struct spi_nor_manufacturer spi_nor_xtx = {
++	.name = "xtx",
++	.parts = xtx_parts,
++	.nparts = ARRAY_SIZE(xtx_parts),
++};
+--- a/drivers/mtd/spi-nor/core.c
++++ b/drivers/mtd/spi-nor/core.c
+@@ -1635,6 +1635,7 @@ static const struct spi_nor_manufacturer
+ 	&spi_nor_winbond,
+ 	&spi_nor_xilinx,
+ 	&spi_nor_xmc,
++	&spi_nor_xtx,
+ };
+ 
+ static const struct flash_info *spi_nor_match_id(struct spi_nor *nor,
+--- a/drivers/mtd/spi-nor/core.h
++++ b/drivers/mtd/spi-nor/core.h
+@@ -633,6 +633,7 @@ extern const struct spi_nor_manufacturer
+ extern const struct spi_nor_manufacturer spi_nor_winbond;
+ extern const struct spi_nor_manufacturer spi_nor_xilinx;
+ extern const struct spi_nor_manufacturer spi_nor_xmc;
++extern const struct spi_nor_manufacturer spi_nor_xtx;
+ 
+ extern const struct attribute_group *spi_nor_sysfs_groups[];
+ 
diff --git a/target/linux/generic/pending-6.1/481-mtd-spi-nor-add-support-for-Gigadevice-GD25D05.patch b/target/linux/generic/pending-6.1/481-mtd-spi-nor-add-support-for-Gigadevice-GD25D05.patch
new file mode 100644
index 00000000000000..581e06190b5a19
--- /dev/null
+++ b/target/linux/generic/pending-6.1/481-mtd-spi-nor-add-support-for-Gigadevice-GD25D05.patch
@@ -0,0 +1,23 @@
+From d68b4aa22e8c625685bfad642dd7337948dc0ad1 Mon Sep 17 00:00:00 2001
+From: Koen Vandeputte <koen.vandeputte@ncentric.com>
+Date: Mon, 6 Jan 2020 13:07:56 +0100
+Subject: [PATCH] mtd: spi-nor: add support for Gigadevice GD25D05
+
+Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
+---
+ drivers/mtd/spi-nor/spi-nor.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/mtd/spi-nor/gigadevice.c
++++ b/drivers/mtd/spi-nor/gigadevice.c
+@@ -34,6 +34,10 @@ static const struct spi_nor_fixups gd25q
+ };
+ 
+ static const struct flash_info gigadevice_nor_parts[] = {
++	{ "gd25q05", INFO(0xc84010, 0, 64 * 1024,  1)
++		FLAGS(SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB) 
++		NO_SFDP_FLAGS(SECT_4K | SPI_NOR_DUAL_READ |
++			      SPI_NOR_QUAD_READ) },
+ 	{ "gd25q16", INFO(0xc84015, 0, 64 * 1024,  32)
+ 		FLAGS(SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB)
+ 		NO_SFDP_FLAGS(SECT_4K | SPI_NOR_DUAL_READ |
diff --git a/target/linux/generic/pending-6.1/482-mtd-spi-nor-add-gd25q512.patch b/target/linux/generic/pending-6.1/482-mtd-spi-nor-add-gd25q512.patch
new file mode 100644
index 00000000000000..ddd3405ae71dd9
--- /dev/null
+++ b/target/linux/generic/pending-6.1/482-mtd-spi-nor-add-gd25q512.patch
@@ -0,0 +1,23 @@
+From f8943df3beb0d3f9754bb35320c3a378727175a8 Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Thu, 14 Jul 2022 08:38:07 +0200
+Subject: [PATCH] spi-nor/gigadevic: add gd25q512
+
+---
+ drivers/mtd/spi-nor/gigadevice.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/mtd/spi-nor/gigadevice.c
++++ b/drivers/mtd/spi-nor/gigadevice.c
+@@ -71,6 +71,11 @@ static const struct flash_info gigadevic
+ 		FLAGS(SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB | SPI_NOR_TB_SR_BIT6)
+ 		FIXUP_FLAGS(SPI_NOR_4B_OPCODES)
+ 		.fixups = &gd25q256_fixups },
++	{ "gd25q512", INFO(0xc84020, 0, 64 * 1024, 1024)
++		FLAGS(SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB)
++		FIXUP_FLAGS(SPI_NOR_4B_OPCODES)
++		NO_SFDP_FLAGS(SECT_4K | SPI_NOR_DUAL_READ |
++			      SPI_NOR_QUAD_READ) },
+ };
+ 
+ const struct spi_nor_manufacturer spi_nor_gigadevice = {
diff --git a/target/linux/generic/pending-6.1/484-mtd-spi-nor-add-esmt-f25l16pa.patch b/target/linux/generic/pending-6.1/484-mtd-spi-nor-add-esmt-f25l16pa.patch
new file mode 100644
index 00000000000000..d5ebe203097376
--- /dev/null
+++ b/target/linux/generic/pending-6.1/484-mtd-spi-nor-add-esmt-f25l16pa.patch
@@ -0,0 +1,24 @@
+From 87363cc0e522de3294ea6ae10fb468d2a8d6fb2f Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 12:17:21 +0200
+Subject: [PATCH] spi-nor/esmt.c: add esmt f25l16pa
+
+This fixes support for Dongwon T&I DW02-412H which uses F25L16PA(2S)
+flash.
+
+---
+ drivers/mtd/spi-nor/esmt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/mtd/spi-nor/esmt.c
++++ b/drivers/mtd/spi-nor/esmt.c
+@@ -10,6 +10,9 @@
+ 
+ static const struct flash_info esmt_nor_parts[] = {
+ 	/* ESMT */
++	{ "f25l16pa-2s", INFO(0x8c2115, 0, 64 * 1024, 32)
++			FLAGS(SPI_NOR_HAS_LOCK)
++			NO_SFDP_FLAGS(SECT_4K) },
+ 	{ "f25l32pa", INFO(0x8c2016, 0, 64 * 1024, 64)
+ 		FLAGS(SPI_NOR_HAS_LOCK | SPI_NOR_SWP_IS_VOLATILE)
+ 		NO_SFDP_FLAGS(SECT_4K) },
diff --git a/target/linux/generic/pending-6.1/485-mtd-spi-nor-add-xmc-xm25qh128c.patch b/target/linux/generic/pending-6.1/485-mtd-spi-nor-add-xmc-xm25qh128c.patch
new file mode 100644
index 00000000000000..e8583cc2571abc
--- /dev/null
+++ b/target/linux/generic/pending-6.1/485-mtd-spi-nor-add-xmc-xm25qh128c.patch
@@ -0,0 +1,25 @@
+From f6b33d850f7f12555df2fa0e3349b33427bf5890 Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 12:19:01 +0200
+Subject: [PATCH] spi-nor/xmc.c: add xm25qh128c
+
+The XMC XM25QH128C is a 16MB SPI NOR chip. The patch is verified on
+Ruijie RG-EW3200GX PRO.
+Datasheet available at https://www.xmcwh.com/uploads/435/XM25QH128C.pdf
+
+---
+ drivers/mtd/spi-nor/xmc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/mtd/spi-nor/xmc.c
++++ b/drivers/mtd/spi-nor/xmc.c
+@@ -16,6 +16,9 @@ static const struct flash_info xmc_nor_p
+ 	{ "XM25QH128A", INFO(0x207018, 0, 64 * 1024, 256)
+ 		NO_SFDP_FLAGS(SECT_4K | SPI_NOR_DUAL_READ |
+ 			      SPI_NOR_QUAD_READ) },
++	{ "XM25QH128C", INFO(0x204018, 0, 64 * 1024, 256)
++		NO_SFDP_FLAGS(SECT_4K | SPI_NOR_DUAL_READ |
++			      SPI_NOR_QUAD_READ) },
+ };
+ 
+ const struct spi_nor_manufacturer spi_nor_xmc = {
diff --git a/target/linux/generic/pending-6.1/486-01-mtd-spinand-add-support-for-ESMT-F50x1G41LB.patch b/target/linux/generic/pending-6.1/486-01-mtd-spinand-add-support-for-ESMT-F50x1G41LB.patch
new file mode 100644
index 00000000000000..b8116db84205e2
--- /dev/null
+++ b/target/linux/generic/pending-6.1/486-01-mtd-spinand-add-support-for-ESMT-F50x1G41LB.patch
@@ -0,0 +1,143 @@
+From a43b844cb40bf1b783055fdc81b7f991e21e7e76 Mon Sep 17 00:00:00 2001
+From: Chuanhong Guo <gch981213@gmail.com>
+Date: Wed, 13 Apr 2022 11:58:17 +0800
+Subject: [PATCH] mtd: spinand: add support for ESMT F50x1G41LB
+
+This patch adds support for ESMT F50L1G41LB and F50D1G41LB.
+It seems that ESMT likes to use random JEDEC ID from other vendors.
+Their 1G chips uses 0xc8 from GigaDevice and 2G/4G chips uses 0x2c from
+Micron. For this reason, the ESMT entry is named esmt_c8 with explicit
+JEDEC ID in variable name.
+
+Datasheets:
+https://www.esmt.com.tw/upload/pdf/ESMT/datasheets/F50L1G41LB(2M).pdf
+https://www.esmt.com.tw/upload/pdf/ESMT/datasheets/F50D1G41LB(2M).pdf
+
+Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
+---
+ drivers/mtd/nand/spi/Makefile |  2 +-
+ drivers/mtd/nand/spi/core.c   |  1 +
+ drivers/mtd/nand/spi/esmt.c   | 89 +++++++++++++++++++++++++++++++++++
+ include/linux/mtd/spinand.h   |  1 +
+ 4 files changed, 92 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/mtd/nand/spi/esmt.c
+
+--- a/drivers/mtd/nand/spi/Makefile
++++ b/drivers/mtd/nand/spi/Makefile
+@@ -1,3 +1,3 @@
+ # SPDX-License-Identifier: GPL-2.0
+-spinand-objs := core.o ato.o gigadevice.o macronix.o micron.o paragon.o toshiba.o winbond.o xtx.o
++spinand-objs := core.o ato.o esmt.o gigadevice.o macronix.o micron.o paragon.o toshiba.o winbond.o xtx.o
+ obj-$(CONFIG_MTD_SPI_NAND) += spinand.o
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -938,6 +938,7 @@ static const struct nand_ops spinand_ops
+ 
+ static const struct spinand_manufacturer *spinand_manufacturers[] = {
+ 	&ato_spinand_manufacturer,
++	&esmt_c8_spinand_manufacturer,
+ 	&gigadevice_spinand_manufacturer,
+ 	&macronix_spinand_manufacturer,
+ 	&micron_spinand_manufacturer,
+--- /dev/null
++++ b/drivers/mtd/nand/spi/esmt.c
+@@ -0,0 +1,89 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Author:
++ *	Chuanhong Guo <gch981213@gmail.com>
++ */
++
++#include <linux/device.h>
++#include <linux/kernel.h>
++#include <linux/mtd/spinand.h>
++
++/* ESMT uses GigaDevice 0xc8 JECDEC ID on some SPI NANDs */
++#define SPINAND_MFR_ESMT_C8			0xc8
++
++static SPINAND_OP_VARIANTS(read_cache_variants,
++			   SPINAND_PAGE_READ_FROM_CACHE_QUADIO_OP(0, 2, NULL, 0),
++			   SPINAND_PAGE_READ_FROM_CACHE_X4_OP(0, 1, NULL, 0),
++			   SPINAND_PAGE_READ_FROM_CACHE_DUALIO_OP(0, 1, NULL, 0),
++			   SPINAND_PAGE_READ_FROM_CACHE_X2_OP(0, 1, NULL, 0),
++			   SPINAND_PAGE_READ_FROM_CACHE_OP(true, 0, 1, NULL, 0),
++			   SPINAND_PAGE_READ_FROM_CACHE_OP(false, 0, 1, NULL, 0));
++
++static SPINAND_OP_VARIANTS(write_cache_variants,
++			   SPINAND_PROG_LOAD_X4(true, 0, NULL, 0),
++			   SPINAND_PROG_LOAD(true, 0, NULL, 0));
++
++static SPINAND_OP_VARIANTS(update_cache_variants,
++			   SPINAND_PROG_LOAD_X4(false, 0, NULL, 0),
++			   SPINAND_PROG_LOAD(false, 0, NULL, 0));
++
++static int f50l1g41lb_ooblayout_ecc(struct mtd_info *mtd, int section,
++				    struct mtd_oob_region *region)
++{
++	if (section > 3)
++		return -ERANGE;
++
++	region->offset = 16 * section + 8;
++	region->length = 8;
++
++	return 0;
++}
++
++static int f50l1g41lb_ooblayout_free(struct mtd_info *mtd, int section,
++				     struct mtd_oob_region *region)
++{
++	if (section > 3)
++		return -ERANGE;
++
++	region->offset = 16 * section + 2;
++	region->length = 6;
++
++	return 0;
++}
++
++static const struct mtd_ooblayout_ops f50l1g41lb_ooblayout = {
++	.ecc = f50l1g41lb_ooblayout_ecc,
++	.free = f50l1g41lb_ooblayout_free,
++};
++
++static const struct spinand_info esmt_c8_spinand_table[] = {
++	SPINAND_INFO("F50L1G41LB",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_ADDR, 0x01),
++		     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
++		     NAND_ECCREQ(1, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     0,
++		     SPINAND_ECCINFO(&f50l1g41lb_ooblayout, NULL)),
++	SPINAND_INFO("F50D1G41LB",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_ADDR, 0x11),
++		     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
++		     NAND_ECCREQ(1, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     0,
++		     SPINAND_ECCINFO(&f50l1g41lb_ooblayout, NULL)),
++};
++
++static const struct spinand_manufacturer_ops esmt_spinand_manuf_ops = {
++};
++
++const struct spinand_manufacturer esmt_c8_spinand_manufacturer = {
++	.id = SPINAND_MFR_ESMT_C8,
++	.name = "ESMT",
++	.chips = esmt_c8_spinand_table,
++	.nchips = ARRAY_SIZE(esmt_c8_spinand_table),
++	.ops = &esmt_spinand_manuf_ops,
++};
+--- a/include/linux/mtd/spinand.h
++++ b/include/linux/mtd/spinand.h
+@@ -261,6 +261,7 @@ struct spinand_manufacturer {
+ 
+ /* SPI NAND manufacturers */
+ extern const struct spinand_manufacturer ato_spinand_manufacturer;
++extern const struct spinand_manufacturer esmt_c8_spinand_manufacturer;
+ extern const struct spinand_manufacturer gigadevice_spinand_manufacturer;
+ extern const struct spinand_manufacturer macronix_spinand_manufacturer;
+ extern const struct spinand_manufacturer micron_spinand_manufacturer;
diff --git a/target/linux/generic/pending-6.1/487-mtd-spinand-Add-support-for-Etron-EM73D044VCx.patch b/target/linux/generic/pending-6.1/487-mtd-spinand-Add-support-for-Etron-EM73D044VCx.patch
new file mode 100644
index 00000000000000..81378fba868ff2
--- /dev/null
+++ b/target/linux/generic/pending-6.1/487-mtd-spinand-Add-support-for-Etron-EM73D044VCx.patch
@@ -0,0 +1,168 @@
+From f32085fc0b87049491b07e198d924d738a1a2834 Mon Sep 17 00:00:00 2001
+From: Daniel Danzberger <daniel@dd-wrt.com>
+Date: Wed, 3 Aug 2022 17:31:03 +0200
+Subject: [PATCH] mtd: spinand: Add support for Etron EM73D044VCx
+
+Airoha is a new ARM platform based on Cortex-A53 which has recently been
+merged into linux-next.
+
+Due to BootROM limitations on this platform, the Cortex-A53 can't run in
+Aarch64 mode and code must be compiled for 32-Bit ARM.
+
+This support is based mostly on those linux-next commits backported
+for kernel 5.15.
+
+Patches:
+1 - platform support = linux-next
+2 - clock driver = linux-next
+3 - gpio driver = linux-next
+4 - linux,usable-memory-range dts support = linux-next
+5 - mtd spinand driver
+6 - spi driver
+7 - pci driver (kconfig only, uses mediatek PCI) = linux-next
+
+Still missing:
+- Ethernet driver
+- Sysupgrade support
+
+A.t.m there exists one subtarget EN7523 with only one evaluation
+board.
+
+The initramfs can be run with the following commands from u-boot:
+-
+u-boot> setenv bootfile \
+	openwrt-airoha-airoha_en7523-evb-initramfs-kernel.bin
+u-boot> tftpboot
+u-boot> bootm 0x81800000
+-
+
+Submitted-by: Daniel Danzberger <daniel@dd-wrt.com>
+
+--- a/drivers/mtd/nand/spi/Makefile
++++ b/drivers/mtd/nand/spi/Makefile
+@@ -1,3 +1,3 @@
+ # SPDX-License-Identifier: GPL-2.0
+-spinand-objs := core.o ato.o esmt.o gigadevice.o macronix.o micron.o paragon.o toshiba.o winbond.o xtx.o
++spinand-objs := core.o ato.o esmt.o etron.o gigadevice.o macronix.o micron.o paragon.o toshiba.o winbond.o xtx.o
+ obj-$(CONFIG_MTD_SPI_NAND) += spinand.o
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -939,6 +939,7 @@ static const struct nand_ops spinand_ops
+ static const struct spinand_manufacturer *spinand_manufacturers[] = {
+ 	&ato_spinand_manufacturer,
+ 	&esmt_c8_spinand_manufacturer,
++	&etron_spinand_manufacturer,
+ 	&gigadevice_spinand_manufacturer,
+ 	&macronix_spinand_manufacturer,
+ 	&micron_spinand_manufacturer,
+--- /dev/null
++++ b/drivers/mtd/nand/spi/etron.c
+@@ -0,0 +1,98 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <linux/device.h>
++#include <linux/kernel.h>
++#include <linux/mtd/spinand.h>
++
++#define SPINAND_MFR_ETRON			0xd5
++
++
++static SPINAND_OP_VARIANTS(read_cache_variants,
++		SPINAND_PAGE_READ_FROM_CACHE_QUADIO_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_X4_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_DUALIO_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_X2_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_OP(true, 0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_OP(false, 0, 1, NULL, 0));
++
++static SPINAND_OP_VARIANTS(write_cache_variants,
++		SPINAND_PROG_LOAD_X4(true, 0, NULL, 0),
++		SPINAND_PROG_LOAD(true, 0, NULL, 0));
++
++static SPINAND_OP_VARIANTS(update_cache_variants,
++		SPINAND_PROG_LOAD_X4(false, 0, NULL, 0),
++		SPINAND_PROG_LOAD(false, 0, NULL, 0));
++
++static int etron_ooblayout_ecc(struct mtd_info *mtd, int section,
++					struct mtd_oob_region *oobregion)
++{
++	if (section)
++		return -ERANGE;
++
++	oobregion->offset = 72;
++	oobregion->length = 56;
++
++	return 0;
++}
++
++static int etron_ooblayout_free(struct mtd_info *mtd, int section,
++			   struct mtd_oob_region *oobregion)
++{
++	if (section)
++		return -ERANGE;
++
++	oobregion->offset = 1;
++	oobregion->length = 71;
++
++	return 0;
++}
++
++static int etron_ecc_get_status(struct spinand_device *spinand, u8 status)
++{
++	switch (status & STATUS_ECC_MASK) {
++	case STATUS_ECC_NO_BITFLIPS:
++		return 0;
++
++	case STATUS_ECC_HAS_BITFLIPS:
++		/* Between 1-7 bitflips were corrected */
++		return 7;
++
++	case STATUS_ECC_MASK:
++		/* Maximum bitflips were corrected */
++		return 8;
++
++	case STATUS_ECC_UNCOR_ERROR:
++		return -EBADMSG;
++	}
++
++	return -EINVAL;
++}
++
++static const struct mtd_ooblayout_ops etron_ooblayout = {
++	.ecc = etron_ooblayout_ecc,
++	.free = etron_ooblayout_free,
++};
++
++static const struct spinand_info etron_spinand_table[] = {
++	SPINAND_INFO("EM73D044VCx",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_ADDR, 0x1f),
++		     // bpc, pagesize, oobsize, pagesperblock, bperlun, maxbadplun, ppl, lpt, #t
++		     NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&etron_ooblayout, etron_ecc_get_status)),
++};
++
++static const struct spinand_manufacturer_ops etron_spinand_manuf_ops = {
++};
++
++const struct spinand_manufacturer etron_spinand_manufacturer = {
++	.id = SPINAND_MFR_ETRON,
++	.name = "Etron",
++	.chips = etron_spinand_table,
++	.nchips = ARRAY_SIZE(etron_spinand_table),
++	.ops = &etron_spinand_manuf_ops,
++};
+--- a/include/linux/mtd/spinand.h
++++ b/include/linux/mtd/spinand.h
+@@ -262,6 +262,7 @@ struct spinand_manufacturer {
+ /* SPI NAND manufacturers */
+ extern const struct spinand_manufacturer ato_spinand_manufacturer;
+ extern const struct spinand_manufacturer esmt_c8_spinand_manufacturer;
++extern const struct spinand_manufacturer etron_spinand_manufacturer;
+ extern const struct spinand_manufacturer gigadevice_spinand_manufacturer;
+ extern const struct spinand_manufacturer macronix_spinand_manufacturer;
+ extern const struct spinand_manufacturer micron_spinand_manufacturer;
diff --git a/target/linux/generic/pending-6.1/488-mtd-spi-nor-add-xmc-xm25qh64c.patch b/target/linux/generic/pending-6.1/488-mtd-spi-nor-add-xmc-xm25qh64c.patch
new file mode 100644
index 00000000000000..e1e4f25e1192bc
--- /dev/null
+++ b/target/linux/generic/pending-6.1/488-mtd-spi-nor-add-xmc-xm25qh64c.patch
@@ -0,0 +1,23 @@
+From: Joe Mullally <jwmullally@gmail.com>
+Subject: mtd/spi-nor/xmc: add support for XMC XM25QH64C
+
+The XMC XM25QH64C is a 8MB SPI NOR chip. The patch is verified on TL-WPA8631P v3.
+Datasheet available at https://www.xmcwh.com/uploads/442/XM25QH64C.pdf
+
+Signed-off-by: Joe Mullally <jwmullally@gmail.com>
+---
+ drivers/mtd/spi-nor/xmc.c                             | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/mtd/spi-nor/xmc.c
++++ b/drivers/mtd/spi-nor/xmc.c
+@@ -13,6 +13,9 @@ static const struct flash_info xmc_nor_p
+ 	{ "XM25QH64A", INFO(0x207017, 0, 64 * 1024, 128)
+ 		NO_SFDP_FLAGS(SECT_4K | SPI_NOR_DUAL_READ |
+ 			      SPI_NOR_QUAD_READ) },
++	{ "XM25QH64C", INFO(0x204017, 0, 64 * 1024, 128)
++		NO_SFDP_FLAGS(SECT_4K | SPI_NOR_DUAL_READ |
++			      SPI_NOR_QUAD_READ) },
+ 	{ "XM25QH128A", INFO(0x207018, 0, 64 * 1024, 256)
+ 		NO_SFDP_FLAGS(SECT_4K | SPI_NOR_DUAL_READ |
+ 			      SPI_NOR_QUAD_READ) },
diff --git a/target/linux/generic/pending-6.1/490-ubi-auto-attach-mtd-device-named-ubi-or-data-on-boot.patch b/target/linux/generic/pending-6.1/490-ubi-auto-attach-mtd-device-named-ubi-or-data-on-boot.patch
new file mode 100644
index 00000000000000..99a03e31c373a0
--- /dev/null
+++ b/target/linux/generic/pending-6.1/490-ubi-auto-attach-mtd-device-named-ubi-or-data-on-boot.patch
@@ -0,0 +1,97 @@
+From: Daniel Golle <daniel@makrotopia.org>
+Subject: ubi: auto-attach mtd device named "ubi" or "data" on boot
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/mtd/ubi/build.c | 36 ++++++++++++++++++++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+
+--- a/drivers/mtd/ubi/build.c
++++ b/drivers/mtd/ubi/build.c
+@@ -1205,6 +1205,73 @@ static struct mtd_info * __init open_mtd
+ 	return mtd;
+ }
+ 
++/*
++ * This function tries attaching mtd partitions named either "ubi" or "data"
++ * during boot.
++ */
++static void __init ubi_auto_attach(void)
++{
++	int err;
++	struct mtd_info *mtd;
++	loff_t offset = 0;
++	size_t len;
++	char magic[4];
++
++	/* try attaching mtd device named "ubi" or "data" */
++	mtd = open_mtd_device("ubi");
++	if (IS_ERR(mtd))
++		mtd = open_mtd_device("data");
++
++	if (IS_ERR(mtd))
++		return;
++
++	/* get the first not bad block */
++	if (mtd_can_have_bb(mtd))
++		while (mtd_block_isbad(mtd, offset)) {
++			offset += mtd->erasesize;
++
++			if (offset > mtd->size) {
++				pr_err("UBI error: Failed to find a non-bad "
++				       "block on mtd%d\n", mtd->index);
++				goto cleanup;
++			}
++		}
++
++	/* check if the read from flash was successful */
++	err = mtd_read(mtd, offset, 4, &len, (void *) magic);
++	if ((err && !mtd_is_bitflip(err)) || len != 4) {
++		pr_err("UBI error: unable to read from mtd%d\n", mtd->index);
++		goto cleanup;
++	}
++
++	/* check for a valid ubi magic */
++	if (strncmp(magic, "UBI#", 4)) {
++		pr_err("UBI error: no valid UBI magic found inside mtd%d\n", mtd->index);
++		goto cleanup;
++	}
++
++	/* don't auto-add media types where UBI doesn't makes sense */
++	if (mtd->type != MTD_NANDFLASH &&
++	    mtd->type != MTD_NORFLASH &&
++	    mtd->type != MTD_DATAFLASH &&
++	    mtd->type != MTD_MLCNANDFLASH)
++		goto cleanup;
++
++	mutex_lock(&ubi_devices_mutex);
++	pr_notice("UBI: auto-attach mtd%d\n", mtd->index);
++	err = ubi_attach_mtd_dev(mtd, UBI_DEV_NUM_AUTO, 0, 0, false);
++	mutex_unlock(&ubi_devices_mutex);
++	if (err < 0) {
++		pr_err("UBI error: cannot attach mtd%d\n", mtd->index);
++		goto cleanup;
++	}
++
++	return;
++
++cleanup:
++	put_mtd_device(mtd);
++}
++
+ static int __init ubi_init(void)
+ {
+ 	int err, i, k;
+@@ -1289,6 +1356,12 @@ static int __init ubi_init(void)
+ 		}
+ 	}
+ 
++	/* auto-attach mtd devices only if built-in to the kernel and no ubi.mtd
++	 * parameter was given */
++	if (IS_ENABLED(CONFIG_MTD_ROOTFS_ROOT_DEV) &&
++	    !ubi_is_module() && !mtd_devs)
++		ubi_auto_attach();
++
+ 	err = ubiblock_init();
+ 	if (err) {
+ 		pr_err("UBI error: block: cannot initialize, error %d\n", err);
diff --git a/target/linux/generic/pending-6.1/491-ubi-auto-create-ubiblock-device-for-rootfs.patch b/target/linux/generic/pending-6.1/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
new file mode 100644
index 00000000000000..17e8d8bedb6c16
--- /dev/null
+++ b/target/linux/generic/pending-6.1/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
@@ -0,0 +1,69 @@
+From: Daniel Golle <daniel@makrotopia.org>
+Subject: ubi: auto-create ubiblock device for rootfs
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/mtd/ubi/block.c | 42 ++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 42 insertions(+)
+
+--- a/drivers/mtd/ubi/block.c
++++ b/drivers/mtd/ubi/block.c
+@@ -653,6 +653,47 @@ static void __init ubiblock_create_from_
+ 	}
+ }
+ 
++#define UBIFS_NODE_MAGIC  0x06101831
++static inline int ubi_vol_is_ubifs(struct ubi_volume_desc *desc)
++{
++	int ret;
++	uint32_t magic_of, magic;
++	ret = ubi_read(desc, 0, (char *)&magic_of, 0, 4);
++	if (ret)
++		return 0;
++	magic = le32_to_cpu(magic_of);
++	return magic == UBIFS_NODE_MAGIC;
++}
++
++static void __init ubiblock_create_auto_rootfs(void)
++{
++	int ubi_num, ret, is_ubifs;
++	struct ubi_volume_desc *desc;
++	struct ubi_volume_info vi;
++
++	for (ubi_num = 0; ubi_num < UBI_MAX_DEVICES; ubi_num++) {
++		desc = ubi_open_volume_nm(ubi_num, "rootfs", UBI_READONLY);
++		if (IS_ERR(desc))
++			desc = ubi_open_volume_nm(ubi_num, "fit", UBI_READONLY);;
++
++		if (IS_ERR(desc))
++			continue;
++
++		ubi_get_volume_info(desc, &vi);
++		is_ubifs = ubi_vol_is_ubifs(desc);
++		ubi_close_volume(desc);
++		if (is_ubifs)
++			break;
++
++		ret = ubiblock_create(&vi);
++		if (ret)
++			pr_err("UBI error: block: can't add '%s' volume, err=%d\n",
++				vi.name, ret);
++		/* always break if we get here */
++		break;
++	}
++}
++
+ static void ubiblock_remove_all(void)
+ {
+ 	struct ubiblock *next;
+@@ -685,6 +726,10 @@ int __init ubiblock_init(void)
+ 	 */
+ 	ubiblock_create_from_param();
+ 
++	/* auto-attach "rootfs" volume if existing and non-ubifs */
++	if (IS_ENABLED(CONFIG_MTD_ROOTFS_ROOT_DEV))
++		ubiblock_create_auto_rootfs();
++
+ 	/*
+ 	 * Block devices are only created upon user requests, so we ignore
+ 	 * existing volumes.
diff --git a/target/linux/generic/pending-6.1/492-try-auto-mounting-ubi0-rootfs-in-init-do_mounts.c.patch b/target/linux/generic/pending-6.1/492-try-auto-mounting-ubi0-rootfs-in-init-do_mounts.c.patch
new file mode 100644
index 00000000000000..f95ec46f14eb5b
--- /dev/null
+++ b/target/linux/generic/pending-6.1/492-try-auto-mounting-ubi0-rootfs-in-init-do_mounts.c.patch
@@ -0,0 +1,53 @@
+From: Daniel Golle <daniel@makrotopia.org>
+Subject: try auto-mounting ubi0:rootfs in init/do_mounts.c
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ init/do_mounts.c | 26 +++++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+--- a/init/do_mounts.c
++++ b/init/do_mounts.c
+@@ -446,7 +446,30 @@ retry:
+ out:
+ 	put_page(page);
+ }
+- 
++
++#ifdef CONFIG_MTD_ROOTFS_ROOT_DEV
++static int __init mount_ubi_rootfs(void)
++{
++	int flags = MS_SILENT;
++	int err, tried = 0;
++
++	while (tried < 2) {
++		err = do_mount_root("ubi0:rootfs", "ubifs", flags, \
++					root_mount_data);
++		switch (err) {
++			case -EACCES:
++				flags |= MS_RDONLY;
++				tried++;
++				break;
++			default:
++				return err;
++		}
++	}
++
++	return -EINVAL;
++}
++#endif
++
+ #ifdef CONFIG_ROOT_NFS
+ 
+ #define NFSROOT_TIMEOUT_MIN	5
+@@ -579,6 +602,10 @@ void __init mount_root(void)
+ 		return;
+ 	}
+ #endif
++#ifdef CONFIG_MTD_ROOTFS_ROOT_DEV
++	if (!mount_ubi_rootfs())
++		return;
++#endif
+ 	if (ROOT_DEV == 0 && root_device_name && root_fs_names) {
+ 		if (mount_nodev_root() == 0)
+ 			return;
diff --git a/target/linux/generic/pending-6.1/493-ubi-set-ROOT_DEV-to-ubiblock-rootfs-if-unset.patch b/target/linux/generic/pending-6.1/493-ubi-set-ROOT_DEV-to-ubiblock-rootfs-if-unset.patch
new file mode 100644
index 00000000000000..e3493ef19ef8ca
--- /dev/null
+++ b/target/linux/generic/pending-6.1/493-ubi-set-ROOT_DEV-to-ubiblock-rootfs-if-unset.patch
@@ -0,0 +1,34 @@
+From: Daniel Golle <daniel@makrotopia.org>
+Subject: ubi: set ROOT_DEV to ubiblock "rootfs" if unset
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/mtd/ubi/block.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/mtd/ubi/block.c
++++ b/drivers/mtd/ubi/block.c
+@@ -42,6 +42,7 @@
+ #include <linux/scatterlist.h>
+ #include <linux/idr.h>
+ #include <asm/div64.h>
++#include <linux/root_dev.h>
+ 
+ #include "ubi-media.h"
+ #include "ubi.h"
+@@ -459,6 +460,15 @@ int ubiblock_create(struct ubi_volume_in
+ 	dev_info(disk_to_dev(dev->gd), "created from ubi%d:%d(%s)",
+ 		 dev->ubi_num, dev->vol_id, vi->name);
+ 	mutex_unlock(&devices_mutex);
++
++	if (!strcmp(vi->name, "rootfs") &&
++	    IS_ENABLED(CONFIG_MTD_ROOTFS_ROOT_DEV) &&
++	    ROOT_DEV == 0) {
++		pr_notice("ubiblock: device ubiblock%d_%d (%s) set to be root filesystem\n",
++			  dev->ubi_num, dev->vol_id, vi->name);
++		ROOT_DEV = MKDEV(gd->major, gd->first_minor);
++	}
++
+ 	return 0;
+ 
+ out_destroy_wq:
diff --git a/target/linux/generic/pending-6.1/494-mtd-ubi-add-EOF-marker-support.patch b/target/linux/generic/pending-6.1/494-mtd-ubi-add-EOF-marker-support.patch
new file mode 100644
index 00000000000000..413431755f1d2c
--- /dev/null
+++ b/target/linux/generic/pending-6.1/494-mtd-ubi-add-EOF-marker-support.patch
@@ -0,0 +1,60 @@
+From: Gabor Juhos <juhosg@openwrt.org>
+Subject: mtd: add EOF marker support to the UBI layer
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/mtd/ubi/attach.c | 25 ++++++++++++++++++++++---
+ drivers/mtd/ubi/ubi.h    |  1 +
+ 2 files changed, 23 insertions(+), 3 deletions(-)
+
+--- a/drivers/mtd/ubi/attach.c
++++ b/drivers/mtd/ubi/attach.c
+@@ -926,6 +926,13 @@ static bool vol_ignored(int vol_id)
+ #endif
+ }
+ 
++static bool ec_hdr_has_eof(struct ubi_ec_hdr *ech)
++{
++	return ech->padding1[0] == 'E' &&
++	       ech->padding1[1] == 'O' &&
++	       ech->padding1[2] == 'F';
++}
++
+ /**
+  * scan_peb - scan and process UBI headers of a PEB.
+  * @ubi: UBI device description object
+@@ -958,9 +965,21 @@ static int scan_peb(struct ubi_device *u
+ 		return 0;
+ 	}
+ 
+-	err = ubi_io_read_ec_hdr(ubi, pnum, ech, 0);
+-	if (err < 0)
+-		return err;
++	if (!ai->eof_found) {
++		err = ubi_io_read_ec_hdr(ubi, pnum, ech, 0);
++		if (err < 0)
++			return err;
++
++		if (ec_hdr_has_eof(ech)) {
++			pr_notice("UBI: EOF marker found, PEBs from %d will be erased\n",
++				pnum);
++			ai->eof_found = true;
++		}
++	}
++
++	if (ai->eof_found)
++		err = UBI_IO_FF_BITFLIPS;
++
+ 	switch (err) {
+ 	case 0:
+ 		break;
+--- a/drivers/mtd/ubi/ubi.h
++++ b/drivers/mtd/ubi/ubi.h
+@@ -778,6 +778,7 @@ struct ubi_attach_info {
+ 	int mean_ec;
+ 	uint64_t ec_sum;
+ 	int ec_count;
++	bool eof_found;
+ 	struct kmem_cache *aeb_slab_cache;
+ 	struct ubi_ec_hdr *ech;
+ 	struct ubi_vid_io_buf *vidb;
diff --git a/target/linux/generic/pending-6.1/496-dt-bindings-add-bindings-for-mtd-concat-devices.patch b/target/linux/generic/pending-6.1/496-dt-bindings-add-bindings-for-mtd-concat-devices.patch
new file mode 100644
index 00000000000000..01f3b9ec2da0ce
--- /dev/null
+++ b/target/linux/generic/pending-6.1/496-dt-bindings-add-bindings-for-mtd-concat-devices.patch
@@ -0,0 +1,52 @@
+From 5734c6669fba7ddb5ef491ccff7159d15dba0b59 Mon Sep 17 00:00:00 2001
+From: Bernhard Frauendienst <kernel@nospam.obeliks.de>
+Date: Wed, 5 Sep 2018 01:32:51 +0200
+Subject: [PATCH 496/497] dt-bindings: add bindings for mtd-concat devices
+
+Document virtual mtd-concat device bindings.
+
+Signed-off-by: Bernhard Frauendienst <kernel@nospam.obeliks.de>
+---
+ .../devicetree/bindings/mtd/mtd-concat.txt    | 36 +++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/mtd/mtd-concat.txt
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/mtd/mtd-concat.txt
+@@ -0,0 +1,36 @@
++Virtual MTD concat device
++
++Requires properties:
++- devices: list of phandles to mtd nodes that should be concatenated
++
++Example:
++
++&spi {
++	flash0: flash@0 {
++		...
++	};
++	flash1: flash@1 {
++		...
++	};
++};
++
++flash {
++	compatible = "mtd-concat";
++
++	devices = <&flash0 &flash1>;
++
++	partitions {
++		compatible = "fixed-partitions";
++
++		partition@0 {
++			label = "boot";
++			reg = <0x0000000 0x0040000>;
++			read-only;
++		};
++
++		partition@40000 {
++			label = "firmware";
++			reg = <0x0040000 0x1fc0000>;
++		};
++	}
++}
diff --git a/target/linux/generic/pending-6.1/497-mtd-mtdconcat-add-dt-driver-for-concat-devices.patch b/target/linux/generic/pending-6.1/497-mtd-mtdconcat-add-dt-driver-for-concat-devices.patch
new file mode 100644
index 00000000000000..e0cbc4508b0607
--- /dev/null
+++ b/target/linux/generic/pending-6.1/497-mtd-mtdconcat-add-dt-driver-for-concat-devices.patch
@@ -0,0 +1,216 @@
+From e53f712d8eac71f54399b61038ccf87d2cee99d7 Mon Sep 17 00:00:00 2001
+From: Bernhard Frauendienst <kernel@nospam.obeliks.de>
+Date: Sat, 25 Aug 2018 12:35:22 +0200
+Subject: [PATCH 497/497] mtd: mtdconcat: add dt driver for concat devices
+
+Some mtd drivers like physmap variants have support for concatenating
+multiple mtd devices, but there is no generic way to define such a
+concat device from within the device tree.
+
+This is useful for some SoC boards that use multiple flash chips as
+memory banks of a single mtd device, with partitions spanning chip
+borders.
+
+This commit adds a driver for creating virtual mtd-concat devices. They
+must have a compatible = "mtd-concat" line, and define a list of devices
+to concat in the 'devices' property, for example:
+
+flash {
+  compatible = "mtd-concat";
+
+  devices = <&flash0 &flash1>;
+
+  partitions {
+    ...
+  };
+};
+
+The driver is added to the very end of the mtd Makefile to increase the
+likelyhood of all child devices already being loaded at the time of
+probing, preventing unnecessary deferred probes.
+
+Signed-off-by: Bernhard Frauendienst <kernel@nospam.obeliks.de>
+---
+ drivers/mtd/Kconfig                 |   2 +
+ drivers/mtd/Makefile                |   3 +
+ drivers/mtd/composite/Kconfig       |  12 +++
+ drivers/mtd/composite/Makefile      |   6 ++
+ drivers/mtd/composite/virt_concat.c | 128 ++++++++++++++++++++++++++++
+ 5 files changed, 151 insertions(+)
+ create mode 100644 drivers/mtd/composite/Kconfig
+ create mode 100644 drivers/mtd/composite/Makefile
+ create mode 100644 drivers/mtd/composite/virt_concat.c
+
+--- a/drivers/mtd/Kconfig
++++ b/drivers/mtd/Kconfig
+@@ -241,4 +241,6 @@ source "drivers/mtd/ubi/Kconfig"
+ 
+ source "drivers/mtd/hyperbus/Kconfig"
+ 
++source "drivers/mtd/composite/Kconfig"
++
+ endif # MTD
+--- a/drivers/mtd/Makefile
++++ b/drivers/mtd/Makefile
+@@ -33,3 +33,6 @@ obj-y		+= chips/ lpddr/ maps/ devices/ n
+ obj-$(CONFIG_MTD_SPI_NOR)	+= spi-nor/
+ obj-$(CONFIG_MTD_UBI)		+= ubi/
+ obj-$(CONFIG_MTD_HYPERBUS)	+= hyperbus/
++
++# Composite drivers must be loaded last
++obj-y				+= composite/
+--- /dev/null
++++ b/drivers/mtd/composite/Kconfig
+@@ -0,0 +1,12 @@
++menu "Composite MTD device drivers"
++	depends on MTD!=n
++
++config MTD_VIRT_CONCAT
++	tristate "Virtual concat MTD device"
++	help
++	  This driver allows creation of a virtual MTD concat device, which
++	  concatenates multiple underlying MTD devices to a single device.
++	  This is required by some SoC boards where multiple memory banks are
++	  used as one device with partitions spanning across device boundaries.
++
++endmenu
+--- /dev/null
++++ b/drivers/mtd/composite/Makefile
+@@ -0,0 +1,6 @@
++# SPDX-License-Identifier: GPL-2.0
++#
++# linux/drivers/mtd/composite/Makefile
++#
++
++obj-$(CONFIG_MTD_VIRT_CONCAT)   += virt_concat.o
+--- /dev/null
++++ b/drivers/mtd/composite/virt_concat.c
+@@ -0,0 +1,128 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Virtual concat MTD device driver
++ *
++ * Copyright (C) 2018 Bernhard Frauendienst
++ * Author: Bernhard Frauendienst, kernel@nospam.obeliks.de
++ */
++
++#include <linux/module.h>
++#include <linux/device.h>
++#include <linux/mtd/concat.h>
++#include <linux/mtd/mtd.h>
++#include <linux/mtd/partitions.h>
++#include <linux/of.h>
++#include <linux/of_platform.h>
++#include <linux/slab.h>
++
++/*
++ * struct of_virt_concat - platform device driver data.
++ * @cmtd the final mtd_concat device
++ * @num_devices the number of devices in @devices
++ * @devices points to an array of devices already loaded
++ */
++struct of_virt_concat {
++	struct mtd_info	*cmtd;
++	int num_devices;
++	struct mtd_info	**devices;
++};
++
++static int virt_concat_remove(struct platform_device *pdev)
++{
++	struct of_virt_concat *info;
++	int i;
++
++	info = platform_get_drvdata(pdev);
++	if (!info)
++		return 0;
++
++	// unset data for when this is called after a probe error
++	platform_set_drvdata(pdev, NULL);
++
++	if (info->cmtd) {
++		mtd_device_unregister(info->cmtd);
++		mtd_concat_destroy(info->cmtd);
++	}
++
++	if (info->devices) {
++		for (i = 0; i < info->num_devices; i++)
++			put_mtd_device(info->devices[i]);
++	}
++
++	return 0;
++}
++
++static int virt_concat_probe(struct platform_device *pdev)
++{
++	struct device_node *node = pdev->dev.of_node;
++	struct of_phandle_iterator it;
++	struct of_virt_concat *info;
++	struct mtd_info *mtd;
++	int err = 0, count;
++
++	count = of_count_phandle_with_args(node, "devices", NULL);
++	if (count <= 0)
++		return -EINVAL;
++
++	info = devm_kzalloc(&pdev->dev, sizeof(*info), GFP_KERNEL);
++	if (!info)
++		return -ENOMEM;
++	info->devices = devm_kcalloc(&pdev->dev, count,
++				     sizeof(*(info->devices)), GFP_KERNEL);
++	if (!info->devices) {
++		err = -ENOMEM;
++		goto err_remove;
++	}
++
++	platform_set_drvdata(pdev, info);
++
++	of_for_each_phandle(&it, err, node, "devices", NULL, 0) {
++		mtd = of_get_mtd_device_by_node(it.node);
++		if (IS_ERR(mtd)) {
++			of_node_put(it.node);
++			err = -EPROBE_DEFER;
++			goto err_remove;
++		}
++
++		info->devices[info->num_devices++] = mtd;
++	}
++
++	info->cmtd = mtd_concat_create(info->devices, info->num_devices,
++				       dev_name(&pdev->dev));
++	if (!info->cmtd) {
++		err = -ENXIO;
++		goto err_remove;
++	}
++
++	info->cmtd->dev.parent = &pdev->dev;
++	mtd_set_of_node(info->cmtd, node);
++	mtd_device_register(info->cmtd, NULL, 0);
++
++	return 0;
++
++err_remove:
++	virt_concat_remove(pdev);
++
++	return err;
++}
++
++static const struct of_device_id virt_concat_of_match[] = {
++	{ .compatible = "mtd-concat", },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, virt_concat_of_match);
++
++static struct platform_driver virt_concat_driver = {
++	.probe = virt_concat_probe,
++	.remove = virt_concat_remove,
++	.driver	 = {
++		.name   = "virt-mtdconcat",
++		.of_match_table = virt_concat_of_match,
++	},
++};
++
++module_platform_driver(virt_concat_driver);
++
++MODULE_LICENSE("GPL v2");
++MODULE_AUTHOR("Bernhard Frauendienst <kernel@nospam.obeliks.de>");
++MODULE_DESCRIPTION("Virtual concat MTD device driver");
diff --git a/target/linux/generic/pending-6.1/498-mtd-spi-nor-locking-support-for-MX25L6405D.patch b/target/linux/generic/pending-6.1/498-mtd-spi-nor-locking-support-for-MX25L6405D.patch
new file mode 100644
index 00000000000000..1a4d5a766f2281
--- /dev/null
+++ b/target/linux/generic/pending-6.1/498-mtd-spi-nor-locking-support-for-MX25L6405D.patch
@@ -0,0 +1,32 @@
+From 8bf2ce6ea4ee840b70f55a27f80e1cd308051b13 Mon Sep 17 00:00:00 2001
+From: Nick Hainke <vincent@systemli.org>
+Date: Mon, 27 Dec 2021 00:38:13 +0100
+Subject: [PATCH 1/2] mtd: spi-nor: locking support for MX25L6405D
+
+Macronix MX25L6405D supports locking with four block-protection bits.
+Currently, the driver only sets three bits.  If the bootloader does not
+sustain the flash chip in an unlocked state, the flash might be
+non-writeable. Add the corresponding flag to enable locking support with
+four bits in the status register.
+
+Tested on Nanostation M2 XM.
+
+Similar to commit 7ea40b54e83b ("mtd: spi-nor: enable locking support for
+MX25L12805D")
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+Signed-off-by: Nick Hainke <vincent@systemli.org>
+---
+ drivers/mtd/spi-nor/macronix.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/spi-nor/macronix.c
++++ b/drivers/mtd/spi-nor/macronix.c
+@@ -48,6 +48,7 @@ static const struct flash_info macronix_
+ 	{ "mx25l3255e",  INFO(0xc29e16, 0, 64 * 1024,  64)
+ 		NO_SFDP_FLAGS(SECT_4K) },
+ 	{ "mx25l6405d",  INFO(0xc22017, 0, 64 * 1024, 128)
++		FLAGS(SPI_NOR_HAS_LOCK | SPI_NOR_4BIT_BP)
+ 		NO_SFDP_FLAGS(SECT_4K) },
+ 	{ "mx25u2033e",  INFO(0xc22532, 0, 64 * 1024,   4)
+ 		NO_SFDP_FLAGS(SECT_4K) },
diff --git a/target/linux/generic/pending-6.1/499-mtd-spi-nor-disable-16-bit-sr-for-macronix.patch b/target/linux/generic/pending-6.1/499-mtd-spi-nor-disable-16-bit-sr-for-macronix.patch
new file mode 100644
index 00000000000000..99e0fc72bf718a
--- /dev/null
+++ b/target/linux/generic/pending-6.1/499-mtd-spi-nor-disable-16-bit-sr-for-macronix.patch
@@ -0,0 +1,30 @@
+From 245224608b5368c10407da07557e546743d3c489 Mon Sep 17 00:00:00 2001
+From: Nick Hainke <vincent@systemli.org>
+Date: Mon, 27 Dec 2021 09:33:13 +0100
+Subject: [PATCH 2/2] mtd: spi-nor: disable 16-bit-sr for macronix
+
+Macronix flash chips seem to consist of only one status register.
+These chips will not work with the "16-bit Write Status (01h) Command".
+Disable SNOR_F_HAS_16BIT_SR for all Macronix chips.
+
+Tested with MX25L6405D.
+
+Fixes: 39d1e3340c73 ("mtd: spi-nor: Fix clearing of QE bit on
+lock()/unlock()")
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+Signed-off-by: Nick Hainke <vincent@systemli.org>
+---
+ drivers/mtd/spi-nor/macronix.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mtd/spi-nor/macronix.c
++++ b/drivers/mtd/spi-nor/macronix.c
+@@ -107,6 +107,7 @@ static void macronix_nor_default_init(st
+ {
+ 	nor->params->quad_enable = spi_nor_sr1_bit6_quad_enable;
+ 	nor->params->set_4byte_addr_mode = spi_nor_set_4byte_addr_mode;
++	nor->flags &= ~SNOR_F_HAS_16BIT_SR;
+ 	nor->flags |= SNOR_F_HAS_LOCK;
+ }
+ 
diff --git a/target/linux/generic/pending-6.1/500-fs_cdrom_dependencies.patch b/target/linux/generic/pending-6.1/500-fs_cdrom_dependencies.patch
new file mode 100644
index 00000000000000..2053c0fbe2e095
--- /dev/null
+++ b/target/linux/generic/pending-6.1/500-fs_cdrom_dependencies.patch
@@ -0,0 +1,52 @@
+From af7b91bcecce0eae24e90acd35d96ecee73e1407 Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 12:21:15 +0200
+Subject: [PATCH] fs: add cdrom dependency
+
+---
+ fs/hfs/Kconfig     | 1 +
+ fs/hfsplus/Kconfig | 1 +
+ fs/isofs/Kconfig   | 1 +
+ fs/udf/Kconfig     | 1 +
+ 4 files changed, 4 insertions(+)
+
+--- a/fs/hfs/Kconfig
++++ b/fs/hfs/Kconfig
+@@ -2,6 +2,7 @@
+ config HFS_FS
+ 	tristate "Apple Macintosh file system support"
+ 	depends on BLOCK
++	select CDROM
+ 	select NLS
+ 	help
+ 	  If you say Y here, you will be able to mount Macintosh-formatted
+--- a/fs/hfsplus/Kconfig
++++ b/fs/hfsplus/Kconfig
+@@ -2,6 +2,7 @@
+ config HFSPLUS_FS
+ 	tristate "Apple Extended HFS file system support"
+ 	depends on BLOCK
++	select CDROM
+ 	select NLS
+ 	select NLS_UTF8
+ 	help
+--- a/fs/isofs/Kconfig
++++ b/fs/isofs/Kconfig
+@@ -1,6 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ config ISO9660_FS
+ 	tristate "ISO 9660 CDROM file system support"
++	select CDROM
+ 	help
+ 	  This is the standard file system used on CD-ROMs.  It was previously
+ 	  known as "High Sierra File System" and is called "hsfs" on other
+--- a/fs/udf/Kconfig
++++ b/fs/udf/Kconfig
+@@ -1,6 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ config UDF_FS
+ 	tristate "UDF file system support"
++	select CDROM
+ 	select CRC_ITU_T
+ 	select NLS
+ 	help
diff --git a/target/linux/generic/pending-6.1/530-jffs2_make_lzma_available.patch b/target/linux/generic/pending-6.1/530-jffs2_make_lzma_available.patch
new file mode 100644
index 00000000000000..b6b75d4ac5133e
--- /dev/null
+++ b/target/linux/generic/pending-6.1/530-jffs2_make_lzma_available.patch
@@ -0,0 +1,5180 @@
+From: Alexandros C. Couloumbis <alex@ozo.com>
+Subject: fs: add jffs2/lzma support (not activated by default yet)
+
+lede-commit: c2c88d315fa0e881f8b19da07b62859b915b11b2
+Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
+---
+ fs/jffs2/Kconfig             |    9 +
+ fs/jffs2/Makefile            |    3 +
+ fs/jffs2/compr.c             |    6 +
+ fs/jffs2/compr.h             |   10 +-
+ fs/jffs2/compr_lzma.c        |  128 +++
+ fs/jffs2/super.c             |   33 +-
+ include/linux/lzma.h         |   62 ++
+ include/linux/lzma/LzFind.h  |  115 +++
+ include/linux/lzma/LzHash.h  |   54 +
+ include/linux/lzma/LzmaDec.h |  231 +++++
+ include/linux/lzma/LzmaEnc.h |   80 ++
+ include/linux/lzma/Types.h   |  226 +++++
+ include/uapi/linux/jffs2.h   |    1 +
+ lib/Kconfig                  |    6 +
+ lib/Makefile                 |   12 +
+ lib/lzma/LzFind.c            |  761 ++++++++++++++
+ lib/lzma/LzmaDec.c           |  999 +++++++++++++++++++
+ lib/lzma/LzmaEnc.c           | 2271 ++++++++++++++++++++++++++++++++++++++++++
+ lib/lzma/Makefile            |    7 +
+ 19 files changed, 5008 insertions(+), 6 deletions(-)
+ create mode 100644 fs/jffs2/compr_lzma.c
+ create mode 100644 include/linux/lzma.h
+ create mode 100644 include/linux/lzma/LzFind.h
+ create mode 100644 include/linux/lzma/LzHash.h
+ create mode 100644 include/linux/lzma/LzmaDec.h
+ create mode 100644 include/linux/lzma/LzmaEnc.h
+ create mode 100644 include/linux/lzma/Types.h
+ create mode 100644 lib/lzma/LzFind.c
+ create mode 100644 lib/lzma/LzmaDec.c
+ create mode 100644 lib/lzma/LzmaEnc.c
+ create mode 100644 lib/lzma/Makefile
+
+--- a/fs/jffs2/Kconfig
++++ b/fs/jffs2/Kconfig
+@@ -136,6 +136,15 @@ config JFFS2_LZO
+ 	  This feature was added in July, 2007. Say 'N' if you need
+ 	  compatibility with older bootloaders or kernels.
+ 
++config JFFS2_LZMA
++	bool "JFFS2 LZMA compression support" if JFFS2_COMPRESSION_OPTIONS
++	select LZMA_COMPRESS
++	select LZMA_DECOMPRESS
++	depends on JFFS2_FS
++	default n
++	help
++	  JFFS2 wrapper to the LZMA C SDK
++
+ config JFFS2_RTIME
+ 	bool "JFFS2 RTIME compression support" if JFFS2_COMPRESSION_OPTIONS
+ 	depends on JFFS2_FS
+--- a/fs/jffs2/Makefile
++++ b/fs/jffs2/Makefile
+@@ -19,4 +19,7 @@ jffs2-$(CONFIG_JFFS2_RUBIN)	+= compr_rub
+ jffs2-$(CONFIG_JFFS2_RTIME)	+= compr_rtime.o
+ jffs2-$(CONFIG_JFFS2_ZLIB)	+= compr_zlib.o
+ jffs2-$(CONFIG_JFFS2_LZO)	+= compr_lzo.o
++jffs2-$(CONFIG_JFFS2_LZMA)	+= compr_lzma.o
+ jffs2-$(CONFIG_JFFS2_SUMMARY)   += summary.o
++
++CFLAGS_compr_lzma.o += -Iinclude/linux -Ilib/lzma
+--- a/fs/jffs2/compr.c
++++ b/fs/jffs2/compr.c
+@@ -378,6 +378,9 @@ int __init jffs2_compressors_init(void)
+ #ifdef CONFIG_JFFS2_LZO
+ 	jffs2_lzo_init();
+ #endif
++#ifdef CONFIG_JFFS2_LZMA
++	jffs2_lzma_init();
++#endif
+ /* Setting default compression mode */
+ #ifdef CONFIG_JFFS2_CMODE_NONE
+ 	jffs2_compression_mode = JFFS2_COMPR_MODE_NONE;
+@@ -401,6 +404,9 @@ int __init jffs2_compressors_init(void)
+ int jffs2_compressors_exit(void)
+ {
+ /* Unregistering compressors */
++#ifdef CONFIG_JFFS2_LZMA
++	jffs2_lzma_exit();
++#endif
+ #ifdef CONFIG_JFFS2_LZO
+ 	jffs2_lzo_exit();
+ #endif
+--- a/fs/jffs2/compr.h
++++ b/fs/jffs2/compr.h
+@@ -29,9 +29,9 @@
+ #define JFFS2_DYNRUBIN_PRIORITY  20
+ #define JFFS2_LZARI_PRIORITY     30
+ #define JFFS2_RTIME_PRIORITY     50
+-#define JFFS2_ZLIB_PRIORITY      60
+-#define JFFS2_LZO_PRIORITY       80
+-
++#define JFFS2_LZMA_PRIORITY      70
++#define JFFS2_ZLIB_PRIORITY      80
++#define JFFS2_LZO_PRIORITY       90
+ 
+ #define JFFS2_RUBINMIPS_DISABLED /* RUBINs will be used only */
+ #define JFFS2_DYNRUBIN_DISABLED  /*	   for decompression */
+@@ -101,5 +101,9 @@ void jffs2_zlib_exit(void);
+ int jffs2_lzo_init(void);
+ void jffs2_lzo_exit(void);
+ #endif
++#ifdef CONFIG_JFFS2_LZMA
++int jffs2_lzma_init(void);
++void jffs2_lzma_exit(void);
++#endif
+ 
+ #endif /* __JFFS2_COMPR_H__ */
+--- /dev/null
++++ b/fs/jffs2/compr_lzma.c
+@@ -0,0 +1,128 @@
++/*
++ * JFFS2 -- Journalling Flash File System, Version 2.
++ *
++ * For licensing information, see the file 'LICENCE' in this directory.
++ *
++ * JFFS2 wrapper to the LZMA C SDK
++ *
++ */
++
++#include <linux/lzma.h>
++#include "compr.h"
++
++#ifdef __KERNEL__
++	static DEFINE_MUTEX(deflate_mutex);
++#endif
++
++CLzmaEncHandle *p;
++Byte propsEncoded[LZMA_PROPS_SIZE];
++SizeT propsSize = sizeof(propsEncoded);
++
++STATIC void lzma_free_workspace(void)
++{
++	LzmaEnc_Destroy(p, &lzma_alloc, &lzma_alloc);
++}
++
++STATIC int INIT lzma_alloc_workspace(CLzmaEncProps *props)
++{
++	if ((p = (CLzmaEncHandle *)LzmaEnc_Create(&lzma_alloc)) == NULL)
++	{
++		PRINT_ERROR("Failed to allocate lzma deflate workspace\n");
++		return -ENOMEM;
++	}
++
++	if (LzmaEnc_SetProps(p, props) != SZ_OK)
++	{
++		lzma_free_workspace();
++		return -1;
++	}
++
++	if (LzmaEnc_WriteProperties(p, propsEncoded, &propsSize) != SZ_OK)
++	{
++		lzma_free_workspace();
++		return -1;
++	}
++
++	return 0;
++}
++
++STATIC int jffs2_lzma_compress(unsigned char *data_in, unsigned char *cpage_out,
++			      uint32_t *sourcelen, uint32_t *dstlen)
++{
++	SizeT compress_size = (SizeT)(*dstlen);
++	int ret;
++
++	#ifdef __KERNEL__
++		mutex_lock(&deflate_mutex);
++	#endif
++
++	ret = LzmaEnc_MemEncode(p, cpage_out, &compress_size, data_in, *sourcelen,
++		0, NULL, &lzma_alloc, &lzma_alloc);
++
++	#ifdef __KERNEL__
++		mutex_unlock(&deflate_mutex);
++	#endif
++
++	if (ret != SZ_OK)
++		return -1;
++
++	*dstlen = (uint32_t)compress_size;
++
++	return 0;
++}
++
++STATIC int jffs2_lzma_decompress(unsigned char *data_in, unsigned char *cpage_out,
++				 uint32_t srclen, uint32_t destlen)
++{
++	int ret;
++	SizeT dl = (SizeT)destlen;
++	SizeT sl = (SizeT)srclen;
++	ELzmaStatus status;
++
++	ret = LzmaDecode(cpage_out, &dl, data_in, &sl, propsEncoded,
++		propsSize, LZMA_FINISH_ANY, &status, &lzma_alloc);
++
++	if (ret != SZ_OK || status == LZMA_STATUS_NOT_FINISHED || dl != (SizeT)destlen)
++		return -1;
++
++	return 0;
++}
++
++static struct jffs2_compressor jffs2_lzma_comp = {
++	.priority = JFFS2_LZMA_PRIORITY,
++	.name = "lzma",
++	.compr = JFFS2_COMPR_LZMA,
++	.compress = &jffs2_lzma_compress,
++	.decompress = &jffs2_lzma_decompress,
++	.disabled = 0,
++};
++
++int INIT jffs2_lzma_init(void)
++{
++	int ret;
++	CLzmaEncProps props;
++	LzmaEncProps_Init(&props);
++
++	props.dictSize = LZMA_BEST_DICT(0x2000);
++	props.level = LZMA_BEST_LEVEL;
++	props.lc = LZMA_BEST_LC;
++	props.lp = LZMA_BEST_LP;
++	props.pb = LZMA_BEST_PB;
++	props.fb = LZMA_BEST_FB;
++
++	ret = lzma_alloc_workspace(&props);
++	if (ret < 0)
++		return ret;
++
++	ret = jffs2_register_compressor(&jffs2_lzma_comp);
++	if (ret)
++		lzma_free_workspace();
++
++	return ret;
++}
++
++void jffs2_lzma_exit(void)
++{
++	jffs2_unregister_compressor(&jffs2_lzma_comp);
++	lzma_free_workspace();
++}
+--- a/fs/jffs2/super.c
++++ b/fs/jffs2/super.c
+@@ -374,14 +374,41 @@ static int __init init_jffs2_fs(void)
+ 	BUILD_BUG_ON(sizeof(struct jffs2_raw_inode) != 68);
+ 	BUILD_BUG_ON(sizeof(struct jffs2_raw_summary) != 32);
+ 
+-	pr_info("version 2.2."
++	pr_info("version 2.2"
+ #ifdef CONFIG_JFFS2_FS_WRITEBUFFER
+ 	       " (NAND)"
+ #endif
+ #ifdef CONFIG_JFFS2_SUMMARY
+-	       " (SUMMARY) "
++	       " (SUMMARY)"
+ #endif
+-	       " © 2001-2006 Red Hat, Inc.\n");
++#ifdef CONFIG_JFFS2_ZLIB
++	       " (ZLIB)"
++#endif
++#ifdef CONFIG_JFFS2_LZO
++	       " (LZO)"
++#endif
++#ifdef CONFIG_JFFS2_LZMA
++	       " (LZMA)"
++#endif
++#ifdef CONFIG_JFFS2_RTIME
++	       " (RTIME)"
++#endif
++#ifdef CONFIG_JFFS2_RUBIN
++	       " (RUBIN)"
++#endif
++#ifdef  CONFIG_JFFS2_CMODE_NONE
++	       " (CMODE_NONE)"
++#endif
++#ifdef CONFIG_JFFS2_CMODE_PRIORITY
++	       " (CMODE_PRIORITY)"
++#endif
++#ifdef CONFIG_JFFS2_CMODE_SIZE
++	       " (CMODE_SIZE)"
++#endif
++#ifdef CONFIG_JFFS2_CMODE_FAVOURLZO
++	       " (CMODE_FAVOURLZO)"
++#endif
++	       " (c) 2001-2006 Red Hat, Inc.\n");
+ 
+ 	jffs2_inode_cachep = kmem_cache_create("jffs2_i",
+ 					     sizeof(struct jffs2_inode_info),
+--- /dev/null
++++ b/include/linux/lzma.h
+@@ -0,0 +1,62 @@
++#ifndef __LZMA_H__
++#define __LZMA_H__
++
++#ifdef __KERNEL__
++	#include <linux/kernel.h>
++	#include <linux/sched.h>
++	#include <linux/slab.h>
++	#include <linux/vmalloc.h>
++	#include <linux/init.h>
++	#define LZMA_MALLOC vmalloc
++	#define LZMA_FREE vfree
++	#define PRINT_ERROR(msg) printk(KERN_WARNING #msg)
++	#define INIT __init
++	#define STATIC static
++#else
++	#include <stdint.h>
++	#include <stdlib.h>
++	#include <stdio.h>
++	#include <unistd.h>
++	#include <string.h>
++	#include <asm/types.h>
++	#include <errno.h>
++	#include <linux/jffs2.h>
++	#ifndef PAGE_SIZE
++		extern int page_size;
++		#define PAGE_SIZE page_size
++	#endif
++	#define LZMA_MALLOC malloc
++	#define LZMA_FREE free
++	#define PRINT_ERROR(msg) fprintf(stderr, msg)
++	#define INIT
++	#define STATIC
++#endif
++
++#include "lzma/LzmaDec.h"
++#include "lzma/LzmaEnc.h"
++
++#define LZMA_BEST_LEVEL (9)
++#define LZMA_BEST_LC    (0)
++#define LZMA_BEST_LP    (0)
++#define LZMA_BEST_PB    (0)
++#define LZMA_BEST_FB  (273)
++
++#define LZMA_BEST_DICT(n) (((int)((n) / 2)) * 2)
++
++static void *p_lzma_malloc(void *p, size_t size)
++{
++	if (size == 0)
++		return NULL;
++
++	return LZMA_MALLOC(size);
++}
++
++static void p_lzma_free(void *p, void *address)
++{
++	if (address != NULL)
++		LZMA_FREE(address);
++}
++
++static ISzAlloc lzma_alloc = {p_lzma_malloc, p_lzma_free};
++
++#endif
+--- /dev/null
++++ b/include/linux/lzma/LzFind.h
+@@ -0,0 +1,115 @@
++/* LzFind.h -- Match finder for LZ algorithms
++2009-04-22 : Igor Pavlov : Public domain */
++
++#ifndef __LZ_FIND_H
++#define __LZ_FIND_H
++
++#include "Types.h"
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++typedef UInt32 CLzRef;
++
++typedef struct _CMatchFinder
++{
++  Byte *buffer;
++  UInt32 pos;
++  UInt32 posLimit;
++  UInt32 streamPos;
++  UInt32 lenLimit;
++
++  UInt32 cyclicBufferPos;
++  UInt32 cyclicBufferSize; /* it must be = (historySize + 1) */
++
++  UInt32 matchMaxLen;
++  CLzRef *hash;
++  CLzRef *son;
++  UInt32 hashMask;
++  UInt32 cutValue;
++
++  Byte *bufferBase;
++  ISeqInStream *stream;
++  int streamEndWasReached;
++
++  UInt32 blockSize;
++  UInt32 keepSizeBefore;
++  UInt32 keepSizeAfter;
++
++  UInt32 numHashBytes;
++  int directInput;
++  size_t directInputRem;
++  int btMode;
++  int bigHash;
++  UInt32 historySize;
++  UInt32 fixedHashSize;
++  UInt32 hashSizeSum;
++  UInt32 numSons;
++  SRes result;
++  UInt32 crc[256];
++} CMatchFinder;
++
++#define Inline_MatchFinder_GetPointerToCurrentPos(p) ((p)->buffer)
++#define Inline_MatchFinder_GetIndexByte(p, index) ((p)->buffer[(Int32)(index)])
++
++#define Inline_MatchFinder_GetNumAvailableBytes(p) ((p)->streamPos - (p)->pos)
++
++int MatchFinder_NeedMove(CMatchFinder *p);
++Byte *MatchFinder_GetPointerToCurrentPos(CMatchFinder *p);
++void MatchFinder_MoveBlock(CMatchFinder *p);
++void MatchFinder_ReadIfRequired(CMatchFinder *p);
++
++void MatchFinder_Construct(CMatchFinder *p);
++
++/* Conditions:
++     historySize <= 3 GB
++     keepAddBufferBefore + matchMaxLen + keepAddBufferAfter < 511MB
++*/
++int MatchFinder_Create(CMatchFinder *p, UInt32 historySize,
++    UInt32 keepAddBufferBefore, UInt32 matchMaxLen, UInt32 keepAddBufferAfter,
++    ISzAlloc *alloc);
++void MatchFinder_Free(CMatchFinder *p, ISzAlloc *alloc);
++void MatchFinder_Normalize3(UInt32 subValue, CLzRef *items, UInt32 numItems);
++void MatchFinder_ReduceOffsets(CMatchFinder *p, UInt32 subValue);
++
++UInt32 * GetMatchesSpec1(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *buffer, CLzRef *son,
++    UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 _cutValue,
++    UInt32 *distances, UInt32 maxLen);
++
++/*
++Conditions:
++  Mf_GetNumAvailableBytes_Func must be called before each Mf_GetMatchLen_Func.
++  Mf_GetPointerToCurrentPos_Func's result must be used only before any other function
++*/
++
++typedef void (*Mf_Init_Func)(void *object);
++typedef Byte (*Mf_GetIndexByte_Func)(void *object, Int32 index);
++typedef UInt32 (*Mf_GetNumAvailableBytes_Func)(void *object);
++typedef const Byte * (*Mf_GetPointerToCurrentPos_Func)(void *object);
++typedef UInt32 (*Mf_GetMatches_Func)(void *object, UInt32 *distances);
++typedef void (*Mf_Skip_Func)(void *object, UInt32);
++
++typedef struct _IMatchFinder
++{
++  Mf_Init_Func Init;
++  Mf_GetIndexByte_Func GetIndexByte;
++  Mf_GetNumAvailableBytes_Func GetNumAvailableBytes;
++  Mf_GetPointerToCurrentPos_Func GetPointerToCurrentPos;
++  Mf_GetMatches_Func GetMatches;
++  Mf_Skip_Func Skip;
++} IMatchFinder;
++
++void MatchFinder_CreateVTable(CMatchFinder *p, IMatchFinder *vTable);
++
++void MatchFinder_Init(CMatchFinder *p);
++UInt32 Bt3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances);
++UInt32 Hc3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances);
++void Bt3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num);
++void Hc3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif
+--- /dev/null
++++ b/include/linux/lzma/LzHash.h
+@@ -0,0 +1,54 @@
++/* LzHash.h -- HASH functions for LZ algorithms
++2009-02-07 : Igor Pavlov : Public domain */
++
++#ifndef __LZ_HASH_H
++#define __LZ_HASH_H
++
++#define kHash2Size (1 << 10)
++#define kHash3Size (1 << 16)
++#define kHash4Size (1 << 20)
++
++#define kFix3HashSize (kHash2Size)
++#define kFix4HashSize (kHash2Size + kHash3Size)
++#define kFix5HashSize (kHash2Size + kHash3Size + kHash4Size)
++
++#define HASH2_CALC hashValue = cur[0] | ((UInt32)cur[1] << 8);
++
++#define HASH3_CALC { \
++  UInt32 temp = p->crc[cur[0]] ^ cur[1]; \
++  hash2Value = temp & (kHash2Size - 1); \
++  hashValue = (temp ^ ((UInt32)cur[2] << 8)) & p->hashMask; }
++
++#define HASH4_CALC { \
++  UInt32 temp = p->crc[cur[0]] ^ cur[1]; \
++  hash2Value = temp & (kHash2Size - 1); \
++  hash3Value = (temp ^ ((UInt32)cur[2] << 8)) & (kHash3Size - 1); \
++  hashValue = (temp ^ ((UInt32)cur[2] << 8) ^ (p->crc[cur[3]] << 5)) & p->hashMask; }
++
++#define HASH5_CALC { \
++  UInt32 temp = p->crc[cur[0]] ^ cur[1]; \
++  hash2Value = temp & (kHash2Size - 1); \
++  hash3Value = (temp ^ ((UInt32)cur[2] << 8)) & (kHash3Size - 1); \
++  hash4Value = (temp ^ ((UInt32)cur[2] << 8) ^ (p->crc[cur[3]] << 5)); \
++  hashValue = (hash4Value ^ (p->crc[cur[4]] << 3)) & p->hashMask; \
++  hash4Value &= (kHash4Size - 1); }
++
++/* #define HASH_ZIP_CALC hashValue = ((cur[0] | ((UInt32)cur[1] << 8)) ^ p->crc[cur[2]]) & 0xFFFF; */
++#define HASH_ZIP_CALC hashValue = ((cur[2] | ((UInt32)cur[0] << 8)) ^ p->crc[cur[1]]) & 0xFFFF;
++
++
++#define MT_HASH2_CALC \
++  hash2Value = (p->crc[cur[0]] ^ cur[1]) & (kHash2Size - 1);
++
++#define MT_HASH3_CALC { \
++  UInt32 temp = p->crc[cur[0]] ^ cur[1]; \
++  hash2Value = temp & (kHash2Size - 1); \
++  hash3Value = (temp ^ ((UInt32)cur[2] << 8)) & (kHash3Size - 1); }
++
++#define MT_HASH4_CALC { \
++  UInt32 temp = p->crc[cur[0]] ^ cur[1]; \
++  hash2Value = temp & (kHash2Size - 1); \
++  hash3Value = (temp ^ ((UInt32)cur[2] << 8)) & (kHash3Size - 1); \
++  hash4Value = (temp ^ ((UInt32)cur[2] << 8) ^ (p->crc[cur[3]] << 5)) & (kHash4Size - 1); }
++
++#endif
+--- /dev/null
++++ b/include/linux/lzma/LzmaDec.h
+@@ -0,0 +1,231 @@
++/* LzmaDec.h -- LZMA Decoder
++2009-02-07 : Igor Pavlov : Public domain */
++
++#ifndef __LZMA_DEC_H
++#define __LZMA_DEC_H
++
++#include "Types.h"
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++/* #define _LZMA_PROB32 */
++/* _LZMA_PROB32 can increase the speed on some CPUs,
++   but memory usage for CLzmaDec::probs will be doubled in that case */
++
++#ifdef _LZMA_PROB32
++#define CLzmaProb UInt32
++#else
++#define CLzmaProb UInt16
++#endif
++
++
++/* ---------- LZMA Properties ---------- */
++
++#define LZMA_PROPS_SIZE 5
++
++typedef struct _CLzmaProps
++{
++  unsigned lc, lp, pb;
++  UInt32 dicSize;
++} CLzmaProps;
++
++/* LzmaProps_Decode - decodes properties
++Returns:
++  SZ_OK
++  SZ_ERROR_UNSUPPORTED - Unsupported properties
++*/
++
++SRes LzmaProps_Decode(CLzmaProps *p, const Byte *data, unsigned size);
++
++
++/* ---------- LZMA Decoder state ---------- */
++
++/* LZMA_REQUIRED_INPUT_MAX = number of required input bytes for worst case.
++   Num bits = log2((2^11 / 31) ^ 22) + 26 < 134 + 26 = 160; */
++
++#define LZMA_REQUIRED_INPUT_MAX 20
++
++typedef struct
++{
++  CLzmaProps prop;
++  CLzmaProb *probs;
++  Byte *dic;
++  const Byte *buf;
++  UInt32 range, code;
++  SizeT dicPos;
++  SizeT dicBufSize;
++  UInt32 processedPos;
++  UInt32 checkDicSize;
++  unsigned state;
++  UInt32 reps[4];
++  unsigned remainLen;
++  int needFlush;
++  int needInitState;
++  UInt32 numProbs;
++  unsigned tempBufSize;
++  Byte tempBuf[LZMA_REQUIRED_INPUT_MAX];
++} CLzmaDec;
++
++#define LzmaDec_Construct(p) { (p)->dic = 0; (p)->probs = 0; }
++
++void LzmaDec_Init(CLzmaDec *p);
++
++/* There are two types of LZMA streams:
++     0) Stream with end mark. That end mark adds about 6 bytes to compressed size.
++     1) Stream without end mark. You must know exact uncompressed size to decompress such stream. */
++
++typedef enum
++{
++  LZMA_FINISH_ANY,   /* finish at any point */
++  LZMA_FINISH_END    /* block must be finished at the end */
++} ELzmaFinishMode;
++
++/* ELzmaFinishMode has meaning only if the decoding reaches output limit !!!
++
++   You must use LZMA_FINISH_END, when you know that current output buffer
++   covers last bytes of block. In other cases you must use LZMA_FINISH_ANY.
++
++   If LZMA decoder sees end marker before reaching output limit, it returns SZ_OK,
++   and output value of destLen will be less than output buffer size limit.
++   You can check status result also.
++
++   You can use multiple checks to test data integrity after full decompression:
++     1) Check Result and "status" variable.
++     2) Check that output(destLen) = uncompressedSize, if you know real uncompressedSize.
++     3) Check that output(srcLen) = compressedSize, if you know real compressedSize.
++        You must use correct finish mode in that case. */
++
++typedef enum
++{
++  LZMA_STATUS_NOT_SPECIFIED,               /* use main error code instead */
++  LZMA_STATUS_FINISHED_WITH_MARK,          /* stream was finished with end mark. */
++  LZMA_STATUS_NOT_FINISHED,                /* stream was not finished */
++  LZMA_STATUS_NEEDS_MORE_INPUT,            /* you must provide more input bytes */
++  LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK  /* there is probability that stream was finished without end mark */
++} ELzmaStatus;
++
++/* ELzmaStatus is used only as output value for function call */
++
++
++/* ---------- Interfaces ---------- */
++
++/* There are 3 levels of interfaces:
++     1) Dictionary Interface
++     2) Buffer Interface
++     3) One Call Interface
++   You can select any of these interfaces, but don't mix functions from different
++   groups for same object. */
++
++
++/* There are two variants to allocate state for Dictionary Interface:
++     1) LzmaDec_Allocate / LzmaDec_Free
++     2) LzmaDec_AllocateProbs / LzmaDec_FreeProbs
++   You can use variant 2, if you set dictionary buffer manually.
++   For Buffer Interface you must always use variant 1.
++
++LzmaDec_Allocate* can return:
++  SZ_OK
++  SZ_ERROR_MEM         - Memory allocation error
++  SZ_ERROR_UNSUPPORTED - Unsupported properties
++*/
++
++SRes LzmaDec_AllocateProbs(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc);
++void LzmaDec_FreeProbs(CLzmaDec *p, ISzAlloc *alloc);
++
++SRes LzmaDec_Allocate(CLzmaDec *state, const Byte *prop, unsigned propsSize, ISzAlloc *alloc);
++void LzmaDec_Free(CLzmaDec *state, ISzAlloc *alloc);
++
++/* ---------- Dictionary Interface ---------- */
++
++/* You can use it, if you want to eliminate the overhead for data copying from
++   dictionary to some other external buffer.
++   You must work with CLzmaDec variables directly in this interface.
++
++   STEPS:
++     LzmaDec_Constr()
++     LzmaDec_Allocate()
++     for (each new stream)
++     {
++       LzmaDec_Init()
++       while (it needs more decompression)
++       {
++         LzmaDec_DecodeToDic()
++         use data from CLzmaDec::dic and update CLzmaDec::dicPos
++       }
++     }
++     LzmaDec_Free()
++*/
++
++/* LzmaDec_DecodeToDic
++
++   The decoding to internal dictionary buffer (CLzmaDec::dic).
++   You must manually update CLzmaDec::dicPos, if it reaches CLzmaDec::dicBufSize !!!
++
++finishMode:
++  It has meaning only if the decoding reaches output limit (dicLimit).
++  LZMA_FINISH_ANY - Decode just dicLimit bytes.
++  LZMA_FINISH_END - Stream must be finished after dicLimit.
++
++Returns:
++  SZ_OK
++    status:
++      LZMA_STATUS_FINISHED_WITH_MARK
++      LZMA_STATUS_NOT_FINISHED
++      LZMA_STATUS_NEEDS_MORE_INPUT
++      LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK
++  SZ_ERROR_DATA - Data error
++*/
++
++SRes LzmaDec_DecodeToDic(CLzmaDec *p, SizeT dicLimit,
++    const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status);
++
++
++/* ---------- Buffer Interface ---------- */
++
++/* It's zlib-like interface.
++   See LzmaDec_DecodeToDic description for information about STEPS and return results,
++   but you must use LzmaDec_DecodeToBuf instead of LzmaDec_DecodeToDic and you don't need
++   to work with CLzmaDec variables manually.
++
++finishMode:
++  It has meaning only if the decoding reaches output limit (*destLen).
++  LZMA_FINISH_ANY - Decode just destLen bytes.
++  LZMA_FINISH_END - Stream must be finished after (*destLen).
++*/
++
++SRes LzmaDec_DecodeToBuf(CLzmaDec *p, Byte *dest, SizeT *destLen,
++    const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status);
++
++
++/* ---------- One Call Interface ---------- */
++
++/* LzmaDecode
++
++finishMode:
++  It has meaning only if the decoding reaches output limit (*destLen).
++  LZMA_FINISH_ANY - Decode just destLen bytes.
++  LZMA_FINISH_END - Stream must be finished after (*destLen).
++
++Returns:
++  SZ_OK
++    status:
++      LZMA_STATUS_FINISHED_WITH_MARK
++      LZMA_STATUS_NOT_FINISHED
++      LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK
++  SZ_ERROR_DATA - Data error
++  SZ_ERROR_MEM  - Memory allocation error
++  SZ_ERROR_UNSUPPORTED - Unsupported properties
++  SZ_ERROR_INPUT_EOF - It needs more bytes in input buffer (src).
++*/
++
++SRes LzmaDecode(Byte *dest, SizeT *destLen, const Byte *src, SizeT *srcLen,
++    const Byte *propData, unsigned propSize, ELzmaFinishMode finishMode,
++    ELzmaStatus *status, ISzAlloc *alloc);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif
+--- /dev/null
++++ b/include/linux/lzma/LzmaEnc.h
+@@ -0,0 +1,80 @@
++/*  LzmaEnc.h -- LZMA Encoder
++2009-02-07 : Igor Pavlov : Public domain */
++
++#ifndef __LZMA_ENC_H
++#define __LZMA_ENC_H
++
++#include "Types.h"
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++#define LZMA_PROPS_SIZE 5
++
++typedef struct _CLzmaEncProps
++{
++  int level;       /*  0 <= level <= 9 */
++  UInt32 dictSize; /* (1 << 12) <= dictSize <= (1 << 27) for 32-bit version
++                      (1 << 12) <= dictSize <= (1 << 30) for 64-bit version
++                       default = (1 << 24) */
++  int lc;          /* 0 <= lc <= 8, default = 3 */
++  int lp;          /* 0 <= lp <= 4, default = 0 */
++  int pb;          /* 0 <= pb <= 4, default = 2 */
++  int algo;        /* 0 - fast, 1 - normal, default = 1 */
++  int fb;          /* 5 <= fb <= 273, default = 32 */
++  int btMode;      /* 0 - hashChain Mode, 1 - binTree mode - normal, default = 1 */
++  int numHashBytes; /* 2, 3 or 4, default = 4 */
++  UInt32 mc;        /* 1 <= mc <= (1 << 30), default = 32 */
++  unsigned writeEndMark;  /* 0 - do not write EOPM, 1 - write EOPM, default = 0 */
++  int numThreads;  /* 1 or 2, default = 2 */
++} CLzmaEncProps;
++
++void LzmaEncProps_Init(CLzmaEncProps *p);
++void LzmaEncProps_Normalize(CLzmaEncProps *p);
++UInt32 LzmaEncProps_GetDictSize(const CLzmaEncProps *props2);
++
++
++/* ---------- CLzmaEncHandle Interface ---------- */
++
++/* LzmaEnc_* functions can return the following exit codes:
++Returns:
++  SZ_OK           - OK
++  SZ_ERROR_MEM    - Memory allocation error
++  SZ_ERROR_PARAM  - Incorrect paramater in props
++  SZ_ERROR_WRITE  - Write callback error.
++  SZ_ERROR_PROGRESS - some break from progress callback
++  SZ_ERROR_THREAD - errors in multithreading functions (only for Mt version)
++*/
++
++typedef void * CLzmaEncHandle;
++
++CLzmaEncHandle LzmaEnc_Create(ISzAlloc *alloc);
++void LzmaEnc_Destroy(CLzmaEncHandle p, ISzAlloc *alloc, ISzAlloc *allocBig);
++SRes LzmaEnc_SetProps(CLzmaEncHandle p, const CLzmaEncProps *props);
++SRes LzmaEnc_WriteProperties(CLzmaEncHandle p, Byte *properties, SizeT *size);
++SRes LzmaEnc_Encode(CLzmaEncHandle p, ISeqOutStream *outStream, ISeqInStream *inStream,
++    ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig);
++SRes LzmaEnc_MemEncode(CLzmaEncHandle p, Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
++    int writeEndMark, ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig);
++
++/* ---------- One Call Interface ---------- */
++
++/* LzmaEncode
++Return code:
++  SZ_OK               - OK
++  SZ_ERROR_MEM        - Memory allocation error
++  SZ_ERROR_PARAM      - Incorrect paramater
++  SZ_ERROR_OUTPUT_EOF - output buffer overflow
++  SZ_ERROR_THREAD     - errors in multithreading functions (only for Mt version)
++*/
++
++SRes LzmaEncode(Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
++    const CLzmaEncProps *props, Byte *propsEncoded, SizeT *propsSize, int writeEndMark,
++    ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif
+--- /dev/null
++++ b/include/linux/lzma/Types.h
+@@ -0,0 +1,226 @@
++/* Types.h -- Basic types
++2009-11-23 : Igor Pavlov : Public domain */
++
++#ifndef __7Z_TYPES_H
++#define __7Z_TYPES_H
++
++#include <stddef.h>
++
++#ifdef _WIN32
++#include <windows.h>
++#endif
++
++#ifndef EXTERN_C_BEGIN
++#ifdef __cplusplus
++#define EXTERN_C_BEGIN extern "C" {
++#define EXTERN_C_END }
++#else
++#define EXTERN_C_BEGIN
++#define EXTERN_C_END
++#endif
++#endif
++
++EXTERN_C_BEGIN
++
++#define SZ_OK 0
++
++#define SZ_ERROR_DATA 1
++#define SZ_ERROR_MEM 2
++#define SZ_ERROR_CRC 3
++#define SZ_ERROR_UNSUPPORTED 4
++#define SZ_ERROR_PARAM 5
++#define SZ_ERROR_INPUT_EOF 6
++#define SZ_ERROR_OUTPUT_EOF 7
++#define SZ_ERROR_READ 8
++#define SZ_ERROR_WRITE 9
++#define SZ_ERROR_PROGRESS 10
++#define SZ_ERROR_FAIL 11
++#define SZ_ERROR_THREAD 12
++
++#define SZ_ERROR_ARCHIVE 16
++#define SZ_ERROR_NO_ARCHIVE 17
++
++typedef int SRes;
++
++#ifdef _WIN32
++typedef DWORD WRes;
++#else
++typedef int WRes;
++#endif
++
++#ifndef RINOK
++#define RINOK(x) { int __result__ = (x); if (__result__ != 0) return __result__; }
++#endif
++
++typedef unsigned char Byte;
++typedef short Int16;
++typedef unsigned short UInt16;
++
++#ifdef _LZMA_UINT32_IS_ULONG
++typedef long Int32;
++typedef unsigned long UInt32;
++#else
++typedef int Int32;
++typedef unsigned int UInt32;
++#endif
++
++#ifdef _SZ_NO_INT_64
++
++/* define _SZ_NO_INT_64, if your compiler doesn't support 64-bit integers.
++   NOTES: Some code will work incorrectly in that case! */
++
++typedef long Int64;
++typedef unsigned long UInt64;
++
++#else
++
++#if defined(_MSC_VER) || defined(__BORLANDC__)
++typedef __int64 Int64;
++typedef unsigned __int64 UInt64;
++#else
++typedef long long int Int64;
++typedef unsigned long long int UInt64;
++#endif
++
++#endif
++
++#ifdef _LZMA_NO_SYSTEM_SIZE_T
++typedef UInt32 SizeT;
++#else
++typedef size_t SizeT;
++#endif
++
++typedef int Bool;
++#define True 1
++#define False 0
++
++
++#ifdef _WIN32
++#define MY_STD_CALL __stdcall
++#else
++#define MY_STD_CALL
++#endif
++
++#ifdef _MSC_VER
++
++#if _MSC_VER >= 1300
++#define MY_NO_INLINE __declspec(noinline)
++#else
++#define MY_NO_INLINE
++#endif
++
++#define MY_CDECL __cdecl
++#define MY_FAST_CALL __fastcall
++
++#else
++
++#define MY_CDECL
++#define MY_FAST_CALL
++
++#endif
++
++
++/* The following interfaces use first parameter as pointer to structure */
++
++typedef struct
++{
++  SRes (*Read)(void *p, void *buf, size_t *size);
++    /* if (input(*size) != 0 && output(*size) == 0) means end_of_stream.
++       (output(*size) < input(*size)) is allowed */
++} ISeqInStream;
++
++/* it can return SZ_ERROR_INPUT_EOF */
++SRes SeqInStream_Read(ISeqInStream *stream, void *buf, size_t size);
++SRes SeqInStream_Read2(ISeqInStream *stream, void *buf, size_t size, SRes errorType);
++SRes SeqInStream_ReadByte(ISeqInStream *stream, Byte *buf);
++
++typedef struct
++{
++  size_t (*Write)(void *p, const void *buf, size_t size);
++    /* Returns: result - the number of actually written bytes.
++       (result < size) means error */
++} ISeqOutStream;
++
++typedef enum
++{
++  SZ_SEEK_SET = 0,
++  SZ_SEEK_CUR = 1,
++  SZ_SEEK_END = 2
++} ESzSeek;
++
++typedef struct
++{
++  SRes (*Read)(void *p, void *buf, size_t *size);  /* same as ISeqInStream::Read */
++  SRes (*Seek)(void *p, Int64 *pos, ESzSeek origin);
++} ISeekInStream;
++
++typedef struct
++{
++  SRes (*Look)(void *p, void **buf, size_t *size);
++    /* if (input(*size) != 0 && output(*size) == 0) means end_of_stream.
++       (output(*size) > input(*size)) is not allowed
++       (output(*size) < input(*size)) is allowed */
++  SRes (*Skip)(void *p, size_t offset);
++    /* offset must be <= output(*size) of Look */
++
++  SRes (*Read)(void *p, void *buf, size_t *size);
++    /* reads directly (without buffer). It's same as ISeqInStream::Read */
++  SRes (*Seek)(void *p, Int64 *pos, ESzSeek origin);
++} ILookInStream;
++
++SRes LookInStream_LookRead(ILookInStream *stream, void *buf, size_t *size);
++SRes LookInStream_SeekTo(ILookInStream *stream, UInt64 offset);
++
++/* reads via ILookInStream::Read */
++SRes LookInStream_Read2(ILookInStream *stream, void *buf, size_t size, SRes errorType);
++SRes LookInStream_Read(ILookInStream *stream, void *buf, size_t size);
++
++#define LookToRead_BUF_SIZE (1 << 14)
++
++typedef struct
++{
++  ILookInStream s;
++  ISeekInStream *realStream;
++  size_t pos;
++  size_t size;
++  Byte buf[LookToRead_BUF_SIZE];
++} CLookToRead;
++
++void LookToRead_CreateVTable(CLookToRead *p, int lookahead);
++void LookToRead_Init(CLookToRead *p);
++
++typedef struct
++{
++  ISeqInStream s;
++  ILookInStream *realStream;
++} CSecToLook;
++
++void SecToLook_CreateVTable(CSecToLook *p);
++
++typedef struct
++{
++  ISeqInStream s;
++  ILookInStream *realStream;
++} CSecToRead;
++
++void SecToRead_CreateVTable(CSecToRead *p);
++
++typedef struct
++{
++  SRes (*Progress)(void *p, UInt64 inSize, UInt64 outSize);
++    /* Returns: result. (result != SZ_OK) means break.
++       Value (UInt64)(Int64)-1 for size means unknown value. */
++} ICompressProgress;
++
++typedef struct
++{
++  void *(*Alloc)(void *p, size_t size);
++  void (*Free)(void *p, void *address); /* address can be 0 */
++} ISzAlloc;
++
++#define IAlloc_Alloc(p, size) (p)->Alloc((p), size)
++#define IAlloc_Free(p, a) (p)->Free((p), a)
++
++EXTERN_C_END
++
++#endif
+--- a/include/uapi/linux/jffs2.h
++++ b/include/uapi/linux/jffs2.h
+@@ -46,6 +46,7 @@
+ #define JFFS2_COMPR_DYNRUBIN	0x05
+ #define JFFS2_COMPR_ZLIB	0x06
+ #define JFFS2_COMPR_LZO		0x07
++#define JFFS2_COMPR_LZMA	0x08
+ /* Compatibility flags. */
+ #define JFFS2_COMPAT_MASK 0xc000      /* What do to if an unknown nodetype is found */
+ #define JFFS2_NODE_ACCURATE 0x2000
+--- a/lib/Kconfig
++++ b/lib/Kconfig
+@@ -354,6 +354,12 @@ config ZSTD_DECOMPRESS
+ 
+ source "lib/xz/Kconfig"
+ 
++config LZMA_COMPRESS
++    tristate
++
++config LZMA_DECOMPRESS
++    tristate
++
+ #
+ # These all provide a common interface (hence the apparent duplication with
+ # ZLIB_INFLATE; DECOMPRESS_GZIP is just a wrapper.)
+--- a/lib/Makefile
++++ b/lib/Makefile
+@@ -134,6 +134,16 @@ CFLAGS_kobject.o += -DDEBUG
+ CFLAGS_kobject_uevent.o += -DDEBUG
+ endif
+ 
++ifdef CONFIG_JFFS2_ZLIB
++  CONFIG_ZLIB_INFLATE:=y
++  CONFIG_ZLIB_DEFLATE:=y
++endif
++
++ifdef CONFIG_JFFS2_LZMA
++  CONFIG_LZMA_DECOMPRESS:=y
++  CONFIG_LZMA_COMPRESS:=y
++endif
++
+ obj-$(CONFIG_DEBUG_INFO_REDUCED) += debug_info.o
+ CFLAGS_debug_info.o += $(call cc-option, -femit-struct-debug-detailed=any)
+ 
+@@ -194,6 +204,8 @@ obj-$(CONFIG_ZSTD_COMPRESS) += zstd/
+ obj-$(CONFIG_ZSTD_DECOMPRESS) += zstd/
+ obj-$(CONFIG_XZ_DEC) += xz/
+ obj-$(CONFIG_RAID6_PQ) += raid6/
++obj-$(CONFIG_LZMA_COMPRESS) += lzma/
++obj-$(CONFIG_LZMA_DECOMPRESS) += lzma/
+ 
+ lib-$(CONFIG_DECOMPRESS_GZIP) += decompress_inflate.o
+ lib-$(CONFIG_DECOMPRESS_BZIP2) += decompress_bunzip2.o
+--- /dev/null
++++ b/lib/lzma/LzFind.c
+@@ -0,0 +1,761 @@
++/* LzFind.c -- Match finder for LZ algorithms
++2009-04-22 : Igor Pavlov : Public domain */
++
++#include <string.h>
++
++#include "LzFind.h"
++#include "LzHash.h"
++
++#define kEmptyHashValue 0
++#define kMaxValForNormalize ((UInt32)0xFFFFFFFF)
++#define kNormalizeStepMin (1 << 10) /* it must be power of 2 */
++#define kNormalizeMask (~(kNormalizeStepMin - 1))
++#define kMaxHistorySize ((UInt32)3 << 30)
++
++#define kStartMaxLen 3
++
++static void LzInWindow_Free(CMatchFinder *p, ISzAlloc *alloc)
++{
++  if (!p->directInput)
++  {
++    alloc->Free(alloc, p->bufferBase);
++    p->bufferBase = 0;
++  }
++}
++
++/* keepSizeBefore + keepSizeAfter + keepSizeReserv must be < 4G) */
++
++static int LzInWindow_Create(CMatchFinder *p, UInt32 keepSizeReserv, ISzAlloc *alloc)
++{
++  UInt32 blockSize = p->keepSizeBefore + p->keepSizeAfter + keepSizeReserv;
++  if (p->directInput)
++  {
++    p->blockSize = blockSize;
++    return 1;
++  }
++  if (p->bufferBase == 0 || p->blockSize != blockSize)
++  {
++    LzInWindow_Free(p, alloc);
++    p->blockSize = blockSize;
++    p->bufferBase = (Byte *)alloc->Alloc(alloc, (size_t)blockSize);
++  }
++  return (p->bufferBase != 0);
++}
++
++Byte *MatchFinder_GetPointerToCurrentPos(CMatchFinder *p) { return p->buffer; }
++Byte MatchFinder_GetIndexByte(CMatchFinder *p, Int32 index) { return p->buffer[index]; }
++
++UInt32 MatchFinder_GetNumAvailableBytes(CMatchFinder *p) { return p->streamPos - p->pos; }
++
++void MatchFinder_ReduceOffsets(CMatchFinder *p, UInt32 subValue)
++{
++  p->posLimit -= subValue;
++  p->pos -= subValue;
++  p->streamPos -= subValue;
++}
++
++static void MatchFinder_ReadBlock(CMatchFinder *p)
++{
++  if (p->streamEndWasReached || p->result != SZ_OK)
++    return;
++  if (p->directInput)
++  {
++    UInt32 curSize = 0xFFFFFFFF - p->streamPos;
++    if (curSize > p->directInputRem)
++      curSize = (UInt32)p->directInputRem;
++    p->directInputRem -= curSize;
++    p->streamPos += curSize;
++    if (p->directInputRem == 0)
++      p->streamEndWasReached = 1;
++    return;
++  }
++  for (;;)
++  {
++    Byte *dest = p->buffer + (p->streamPos - p->pos);
++    size_t size = (p->bufferBase + p->blockSize - dest);
++    if (size == 0)
++      return;
++    p->result = p->stream->Read(p->stream, dest, &size);
++    if (p->result != SZ_OK)
++      return;
++    if (size == 0)
++    {
++      p->streamEndWasReached = 1;
++      return;
++    }
++    p->streamPos += (UInt32)size;
++    if (p->streamPos - p->pos > p->keepSizeAfter)
++      return;
++  }
++}
++
++void MatchFinder_MoveBlock(CMatchFinder *p)
++{
++  memmove(p->bufferBase,
++    p->buffer - p->keepSizeBefore,
++    (size_t)(p->streamPos - p->pos + p->keepSizeBefore));
++  p->buffer = p->bufferBase + p->keepSizeBefore;
++}
++
++int MatchFinder_NeedMove(CMatchFinder *p)
++{
++  if (p->directInput)
++    return 0;
++  /* if (p->streamEndWasReached) return 0; */
++  return ((size_t)(p->bufferBase + p->blockSize - p->buffer) <= p->keepSizeAfter);
++}
++
++void MatchFinder_ReadIfRequired(CMatchFinder *p)
++{
++  if (p->streamEndWasReached)
++    return;
++  if (p->keepSizeAfter >= p->streamPos - p->pos)
++    MatchFinder_ReadBlock(p);
++}
++
++static void MatchFinder_CheckAndMoveAndRead(CMatchFinder *p)
++{
++  if (MatchFinder_NeedMove(p))
++    MatchFinder_MoveBlock(p);
++  MatchFinder_ReadBlock(p);
++}
++
++static void MatchFinder_SetDefaultSettings(CMatchFinder *p)
++{
++  p->cutValue = 32;
++  p->btMode = 1;
++  p->numHashBytes = 4;
++  p->bigHash = 0;
++}
++
++#define kCrcPoly 0xEDB88320
++
++void MatchFinder_Construct(CMatchFinder *p)
++{
++  UInt32 i;
++  p->bufferBase = 0;
++  p->directInput = 0;
++  p->hash = 0;
++  MatchFinder_SetDefaultSettings(p);
++
++  for (i = 0; i < 256; i++)
++  {
++    UInt32 r = i;
++    int j;
++    for (j = 0; j < 8; j++)
++      r = (r >> 1) ^ (kCrcPoly & ~((r & 1) - 1));
++    p->crc[i] = r;
++  }
++}
++
++static void MatchFinder_FreeThisClassMemory(CMatchFinder *p, ISzAlloc *alloc)
++{
++  alloc->Free(alloc, p->hash);
++  p->hash = 0;
++}
++
++void MatchFinder_Free(CMatchFinder *p, ISzAlloc *alloc)
++{
++  MatchFinder_FreeThisClassMemory(p, alloc);
++  LzInWindow_Free(p, alloc);
++}
++
++static CLzRef* AllocRefs(UInt32 num, ISzAlloc *alloc)
++{
++  size_t sizeInBytes = (size_t)num * sizeof(CLzRef);
++  if (sizeInBytes / sizeof(CLzRef) != num)
++    return 0;
++  return (CLzRef *)alloc->Alloc(alloc, sizeInBytes);
++}
++
++int MatchFinder_Create(CMatchFinder *p, UInt32 historySize,
++    UInt32 keepAddBufferBefore, UInt32 matchMaxLen, UInt32 keepAddBufferAfter,
++    ISzAlloc *alloc)
++{
++  UInt32 sizeReserv;
++  if (historySize > kMaxHistorySize)
++  {
++    MatchFinder_Free(p, alloc);
++    return 0;
++  }
++  sizeReserv = historySize >> 1;
++  if (historySize > ((UInt32)2 << 30))
++    sizeReserv = historySize >> 2;
++  sizeReserv += (keepAddBufferBefore + matchMaxLen + keepAddBufferAfter) / 2 + (1 << 19);
++
++  p->keepSizeBefore = historySize + keepAddBufferBefore + 1;
++  p->keepSizeAfter = matchMaxLen + keepAddBufferAfter;
++  /* we need one additional byte, since we use MoveBlock after pos++ and before dictionary using */
++  if (LzInWindow_Create(p, sizeReserv, alloc))
++  {
++    UInt32 newCyclicBufferSize = historySize + 1;
++    UInt32 hs;
++    p->matchMaxLen = matchMaxLen;
++    {
++      p->fixedHashSize = 0;
++      if (p->numHashBytes == 2)
++        hs = (1 << 16) - 1;
++      else
++      {
++        hs = historySize - 1;
++        hs |= (hs >> 1);
++        hs |= (hs >> 2);
++        hs |= (hs >> 4);
++        hs |= (hs >> 8);
++        hs >>= 1;
++        hs |= 0xFFFF; /* don't change it! It's required for Deflate */
++        if (hs > (1 << 24))
++        {
++          if (p->numHashBytes == 3)
++            hs = (1 << 24) - 1;
++          else
++            hs >>= 1;
++        }
++      }
++      p->hashMask = hs;
++      hs++;
++      if (p->numHashBytes > 2) p->fixedHashSize += kHash2Size;
++      if (p->numHashBytes > 3) p->fixedHashSize += kHash3Size;
++      if (p->numHashBytes > 4) p->fixedHashSize += kHash4Size;
++      hs += p->fixedHashSize;
++    }
++
++    {
++      UInt32 prevSize = p->hashSizeSum + p->numSons;
++      UInt32 newSize;
++      p->historySize = historySize;
++      p->hashSizeSum = hs;
++      p->cyclicBufferSize = newCyclicBufferSize;
++      p->numSons = (p->btMode ? newCyclicBufferSize * 2 : newCyclicBufferSize);
++      newSize = p->hashSizeSum + p->numSons;
++      if (p->hash != 0 && prevSize == newSize)
++        return 1;
++      MatchFinder_FreeThisClassMemory(p, alloc);
++      p->hash = AllocRefs(newSize, alloc);
++      if (p->hash != 0)
++      {
++        p->son = p->hash + p->hashSizeSum;
++        return 1;
++      }
++    }
++  }
++  MatchFinder_Free(p, alloc);
++  return 0;
++}
++
++static void MatchFinder_SetLimits(CMatchFinder *p)
++{
++  UInt32 limit = kMaxValForNormalize - p->pos;
++  UInt32 limit2 = p->cyclicBufferSize - p->cyclicBufferPos;
++  if (limit2 < limit)
++    limit = limit2;
++  limit2 = p->streamPos - p->pos;
++  if (limit2 <= p->keepSizeAfter)
++  {
++    if (limit2 > 0)
++      limit2 = 1;
++  }
++  else
++    limit2 -= p->keepSizeAfter;
++  if (limit2 < limit)
++    limit = limit2;
++  {
++    UInt32 lenLimit = p->streamPos - p->pos;
++    if (lenLimit > p->matchMaxLen)
++      lenLimit = p->matchMaxLen;
++    p->lenLimit = lenLimit;
++  }
++  p->posLimit = p->pos + limit;
++}
++
++void MatchFinder_Init(CMatchFinder *p)
++{
++  UInt32 i;
++  for (i = 0; i < p->hashSizeSum; i++)
++    p->hash[i] = kEmptyHashValue;
++  p->cyclicBufferPos = 0;
++  p->buffer = p->bufferBase;
++  p->pos = p->streamPos = p->cyclicBufferSize;
++  p->result = SZ_OK;
++  p->streamEndWasReached = 0;
++  MatchFinder_ReadBlock(p);
++  MatchFinder_SetLimits(p);
++}
++
++static UInt32 MatchFinder_GetSubValue(CMatchFinder *p)
++{
++  return (p->pos - p->historySize - 1) & kNormalizeMask;
++}
++
++void MatchFinder_Normalize3(UInt32 subValue, CLzRef *items, UInt32 numItems)
++{
++  UInt32 i;
++  for (i = 0; i < numItems; i++)
++  {
++    UInt32 value = items[i];
++    if (value <= subValue)
++      value = kEmptyHashValue;
++    else
++      value -= subValue;
++    items[i] = value;
++  }
++}
++
++static void MatchFinder_Normalize(CMatchFinder *p)
++{
++  UInt32 subValue = MatchFinder_GetSubValue(p);
++  MatchFinder_Normalize3(subValue, p->hash, p->hashSizeSum + p->numSons);
++  MatchFinder_ReduceOffsets(p, subValue);
++}
++
++static void MatchFinder_CheckLimits(CMatchFinder *p)
++{
++  if (p->pos == kMaxValForNormalize)
++    MatchFinder_Normalize(p);
++  if (!p->streamEndWasReached && p->keepSizeAfter == p->streamPos - p->pos)
++    MatchFinder_CheckAndMoveAndRead(p);
++  if (p->cyclicBufferPos == p->cyclicBufferSize)
++    p->cyclicBufferPos = 0;
++  MatchFinder_SetLimits(p);
++}
++
++static UInt32 * Hc_GetMatchesSpec(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *cur, CLzRef *son,
++    UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 cutValue,
++    UInt32 *distances, UInt32 maxLen)
++{
++  son[_cyclicBufferPos] = curMatch;
++  for (;;)
++  {
++    UInt32 delta = pos - curMatch;
++    if (cutValue-- == 0 || delta >= _cyclicBufferSize)
++      return distances;
++    {
++      const Byte *pb = cur - delta;
++      curMatch = son[_cyclicBufferPos - delta + ((delta > _cyclicBufferPos) ? _cyclicBufferSize : 0)];
++      if (pb[maxLen] == cur[maxLen] && *pb == *cur)
++      {
++        UInt32 len = 0;
++        while (++len != lenLimit)
++          if (pb[len] != cur[len])
++            break;
++        if (maxLen < len)
++        {
++          *distances++ = maxLen = len;
++          *distances++ = delta - 1;
++          if (len == lenLimit)
++            return distances;
++        }
++      }
++    }
++  }
++}
++
++UInt32 * GetMatchesSpec1(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *cur, CLzRef *son,
++    UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 cutValue,
++    UInt32 *distances, UInt32 maxLen)
++{
++  CLzRef *ptr0 = son + (_cyclicBufferPos << 1) + 1;
++  CLzRef *ptr1 = son + (_cyclicBufferPos << 1);
++  UInt32 len0 = 0, len1 = 0;
++  for (;;)
++  {
++    UInt32 delta = pos - curMatch;
++    if (cutValue-- == 0 || delta >= _cyclicBufferSize)
++    {
++      *ptr0 = *ptr1 = kEmptyHashValue;
++      return distances;
++    }
++    {
++      CLzRef *pair = son + ((_cyclicBufferPos - delta + ((delta > _cyclicBufferPos) ? _cyclicBufferSize : 0)) << 1);
++      const Byte *pb = cur - delta;
++      UInt32 len = (len0 < len1 ? len0 : len1);
++      if (pb[len] == cur[len])
++      {
++        if (++len != lenLimit && pb[len] == cur[len])
++          while (++len != lenLimit)
++            if (pb[len] != cur[len])
++              break;
++        if (maxLen < len)
++        {
++          *distances++ = maxLen = len;
++          *distances++ = delta - 1;
++          if (len == lenLimit)
++          {
++            *ptr1 = pair[0];
++            *ptr0 = pair[1];
++            return distances;
++          }
++        }
++      }
++      if (pb[len] < cur[len])
++      {
++        *ptr1 = curMatch;
++        ptr1 = pair + 1;
++        curMatch = *ptr1;
++        len1 = len;
++      }
++      else
++      {
++        *ptr0 = curMatch;
++        ptr0 = pair;
++        curMatch = *ptr0;
++        len0 = len;
++      }
++    }
++  }
++}
++
++static void SkipMatchesSpec(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *cur, CLzRef *son,
++    UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 cutValue)
++{
++  CLzRef *ptr0 = son + (_cyclicBufferPos << 1) + 1;
++  CLzRef *ptr1 = son + (_cyclicBufferPos << 1);
++  UInt32 len0 = 0, len1 = 0;
++  for (;;)
++  {
++    UInt32 delta = pos - curMatch;
++    if (cutValue-- == 0 || delta >= _cyclicBufferSize)
++    {
++      *ptr0 = *ptr1 = kEmptyHashValue;
++      return;
++    }
++    {
++      CLzRef *pair = son + ((_cyclicBufferPos - delta + ((delta > _cyclicBufferPos) ? _cyclicBufferSize : 0)) << 1);
++      const Byte *pb = cur - delta;
++      UInt32 len = (len0 < len1 ? len0 : len1);
++      if (pb[len] == cur[len])
++      {
++        while (++len != lenLimit)
++          if (pb[len] != cur[len])
++            break;
++        {
++          if (len == lenLimit)
++          {
++            *ptr1 = pair[0];
++            *ptr0 = pair[1];
++            return;
++          }
++        }
++      }
++      if (pb[len] < cur[len])
++      {
++        *ptr1 = curMatch;
++        ptr1 = pair + 1;
++        curMatch = *ptr1;
++        len1 = len;
++      }
++      else
++      {
++        *ptr0 = curMatch;
++        ptr0 = pair;
++        curMatch = *ptr0;
++        len0 = len;
++      }
++    }
++  }
++}
++
++#define MOVE_POS \
++  ++p->cyclicBufferPos; \
++  p->buffer++; \
++  if (++p->pos == p->posLimit) MatchFinder_CheckLimits(p);
++
++#define MOVE_POS_RET MOVE_POS return offset;
++
++static void MatchFinder_MovePos(CMatchFinder *p) { MOVE_POS; }
++
++#define GET_MATCHES_HEADER2(minLen, ret_op) \
++  UInt32 lenLimit; UInt32 hashValue; const Byte *cur; UInt32 curMatch; \
++  lenLimit = p->lenLimit; { if (lenLimit < minLen) { MatchFinder_MovePos(p); ret_op; }} \
++  cur = p->buffer;
++
++#define GET_MATCHES_HEADER(minLen) GET_MATCHES_HEADER2(minLen, return 0)
++#define SKIP_HEADER(minLen)        GET_MATCHES_HEADER2(minLen, continue)
++
++#define MF_PARAMS(p) p->pos, p->buffer, p->son, p->cyclicBufferPos, p->cyclicBufferSize, p->cutValue
++
++#define GET_MATCHES_FOOTER(offset, maxLen) \
++  offset = (UInt32)(GetMatchesSpec1(lenLimit, curMatch, MF_PARAMS(p), \
++  distances + offset, maxLen) - distances); MOVE_POS_RET;
++
++#define SKIP_FOOTER \
++  SkipMatchesSpec(lenLimit, curMatch, MF_PARAMS(p)); MOVE_POS;
++
++static UInt32 Bt2_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 offset;
++  GET_MATCHES_HEADER(2)
++  HASH2_CALC;
++  curMatch = p->hash[hashValue];
++  p->hash[hashValue] = p->pos;
++  offset = 0;
++  GET_MATCHES_FOOTER(offset, 1)
++}
++
++UInt32 Bt3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 offset;
++  GET_MATCHES_HEADER(3)
++  HASH_ZIP_CALC;
++  curMatch = p->hash[hashValue];
++  p->hash[hashValue] = p->pos;
++  offset = 0;
++  GET_MATCHES_FOOTER(offset, 2)
++}
++
++static UInt32 Bt3_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 hash2Value, delta2, maxLen, offset;
++  GET_MATCHES_HEADER(3)
++
++  HASH3_CALC;
++
++  delta2 = p->pos - p->hash[hash2Value];
++  curMatch = p->hash[kFix3HashSize + hashValue];
++
++  p->hash[hash2Value] =
++  p->hash[kFix3HashSize + hashValue] = p->pos;
++
++
++  maxLen = 2;
++  offset = 0;
++  if (delta2 < p->cyclicBufferSize && *(cur - delta2) == *cur)
++  {
++    for (; maxLen != lenLimit; maxLen++)
++      if (cur[(ptrdiff_t)maxLen - delta2] != cur[maxLen])
++        break;
++    distances[0] = maxLen;
++    distances[1] = delta2 - 1;
++    offset = 2;
++    if (maxLen == lenLimit)
++    {
++      SkipMatchesSpec(lenLimit, curMatch, MF_PARAMS(p));
++      MOVE_POS_RET;
++    }
++  }
++  GET_MATCHES_FOOTER(offset, maxLen)
++}
++
++static UInt32 Bt4_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 hash2Value, hash3Value, delta2, delta3, maxLen, offset;
++  GET_MATCHES_HEADER(4)
++
++  HASH4_CALC;
++
++  delta2 = p->pos - p->hash[                hash2Value];
++  delta3 = p->pos - p->hash[kFix3HashSize + hash3Value];
++  curMatch = p->hash[kFix4HashSize + hashValue];
++
++  p->hash[                hash2Value] =
++  p->hash[kFix3HashSize + hash3Value] =
++  p->hash[kFix4HashSize + hashValue] = p->pos;
++
++  maxLen = 1;
++  offset = 0;
++  if (delta2 < p->cyclicBufferSize && *(cur - delta2) == *cur)
++  {
++    distances[0] = maxLen = 2;
++    distances[1] = delta2 - 1;
++    offset = 2;
++  }
++  if (delta2 != delta3 && delta3 < p->cyclicBufferSize && *(cur - delta3) == *cur)
++  {
++    maxLen = 3;
++    distances[offset + 1] = delta3 - 1;
++    offset += 2;
++    delta2 = delta3;
++  }
++  if (offset != 0)
++  {
++    for (; maxLen != lenLimit; maxLen++)
++      if (cur[(ptrdiff_t)maxLen - delta2] != cur[maxLen])
++        break;
++    distances[offset - 2] = maxLen;
++    if (maxLen == lenLimit)
++    {
++      SkipMatchesSpec(lenLimit, curMatch, MF_PARAMS(p));
++      MOVE_POS_RET;
++    }
++  }
++  if (maxLen < 3)
++    maxLen = 3;
++  GET_MATCHES_FOOTER(offset, maxLen)
++}
++
++static UInt32 Hc4_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 hash2Value, hash3Value, delta2, delta3, maxLen, offset;
++  GET_MATCHES_HEADER(4)
++
++  HASH4_CALC;
++
++  delta2 = p->pos - p->hash[                hash2Value];
++  delta3 = p->pos - p->hash[kFix3HashSize + hash3Value];
++  curMatch = p->hash[kFix4HashSize + hashValue];
++
++  p->hash[                hash2Value] =
++  p->hash[kFix3HashSize + hash3Value] =
++  p->hash[kFix4HashSize + hashValue] = p->pos;
++
++  maxLen = 1;
++  offset = 0;
++  if (delta2 < p->cyclicBufferSize && *(cur - delta2) == *cur)
++  {
++    distances[0] = maxLen = 2;
++    distances[1] = delta2 - 1;
++    offset = 2;
++  }
++  if (delta2 != delta3 && delta3 < p->cyclicBufferSize && *(cur - delta3) == *cur)
++  {
++    maxLen = 3;
++    distances[offset + 1] = delta3 - 1;
++    offset += 2;
++    delta2 = delta3;
++  }
++  if (offset != 0)
++  {
++    for (; maxLen != lenLimit; maxLen++)
++      if (cur[(ptrdiff_t)maxLen - delta2] != cur[maxLen])
++        break;
++    distances[offset - 2] = maxLen;
++    if (maxLen == lenLimit)
++    {
++      p->son[p->cyclicBufferPos] = curMatch;
++      MOVE_POS_RET;
++    }
++  }
++  if (maxLen < 3)
++    maxLen = 3;
++  offset = (UInt32)(Hc_GetMatchesSpec(lenLimit, curMatch, MF_PARAMS(p),
++    distances + offset, maxLen) - (distances));
++  MOVE_POS_RET
++}
++
++UInt32 Hc3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 offset;
++  GET_MATCHES_HEADER(3)
++  HASH_ZIP_CALC;
++  curMatch = p->hash[hashValue];
++  p->hash[hashValue] = p->pos;
++  offset = (UInt32)(Hc_GetMatchesSpec(lenLimit, curMatch, MF_PARAMS(p),
++    distances, 2) - (distances));
++  MOVE_POS_RET
++}
++
++static void Bt2_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    SKIP_HEADER(2)
++    HASH2_CALC;
++    curMatch = p->hash[hashValue];
++    p->hash[hashValue] = p->pos;
++    SKIP_FOOTER
++  }
++  while (--num != 0);
++}
++
++void Bt3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    SKIP_HEADER(3)
++    HASH_ZIP_CALC;
++    curMatch = p->hash[hashValue];
++    p->hash[hashValue] = p->pos;
++    SKIP_FOOTER
++  }
++  while (--num != 0);
++}
++
++static void Bt3_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    UInt32 hash2Value;
++    SKIP_HEADER(3)
++    HASH3_CALC;
++    curMatch = p->hash[kFix3HashSize + hashValue];
++    p->hash[hash2Value] =
++    p->hash[kFix3HashSize + hashValue] = p->pos;
++    SKIP_FOOTER
++  }
++  while (--num != 0);
++}
++
++static void Bt4_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    UInt32 hash2Value, hash3Value;
++    SKIP_HEADER(4)
++    HASH4_CALC;
++    curMatch = p->hash[kFix4HashSize + hashValue];
++    p->hash[                hash2Value] =
++    p->hash[kFix3HashSize + hash3Value] = p->pos;
++    p->hash[kFix4HashSize + hashValue] = p->pos;
++    SKIP_FOOTER
++  }
++  while (--num != 0);
++}
++
++static void Hc4_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    UInt32 hash2Value, hash3Value;
++    SKIP_HEADER(4)
++    HASH4_CALC;
++    curMatch = p->hash[kFix4HashSize + hashValue];
++    p->hash[                hash2Value] =
++    p->hash[kFix3HashSize + hash3Value] =
++    p->hash[kFix4HashSize + hashValue] = p->pos;
++    p->son[p->cyclicBufferPos] = curMatch;
++    MOVE_POS
++  }
++  while (--num != 0);
++}
++
++void Hc3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    SKIP_HEADER(3)
++    HASH_ZIP_CALC;
++    curMatch = p->hash[hashValue];
++    p->hash[hashValue] = p->pos;
++    p->son[p->cyclicBufferPos] = curMatch;
++    MOVE_POS
++  }
++  while (--num != 0);
++}
++
++void MatchFinder_CreateVTable(CMatchFinder *p, IMatchFinder *vTable)
++{
++  vTable->Init = (Mf_Init_Func)MatchFinder_Init;
++  vTable->GetIndexByte = (Mf_GetIndexByte_Func)MatchFinder_GetIndexByte;
++  vTable->GetNumAvailableBytes = (Mf_GetNumAvailableBytes_Func)MatchFinder_GetNumAvailableBytes;
++  vTable->GetPointerToCurrentPos = (Mf_GetPointerToCurrentPos_Func)MatchFinder_GetPointerToCurrentPos;
++  if (!p->btMode)
++  {
++    vTable->GetMatches = (Mf_GetMatches_Func)Hc4_MatchFinder_GetMatches;
++    vTable->Skip = (Mf_Skip_Func)Hc4_MatchFinder_Skip;
++  }
++  else if (p->numHashBytes == 2)
++  {
++    vTable->GetMatches = (Mf_GetMatches_Func)Bt2_MatchFinder_GetMatches;
++    vTable->Skip = (Mf_Skip_Func)Bt2_MatchFinder_Skip;
++  }
++  else if (p->numHashBytes == 3)
++  {
++    vTable->GetMatches = (Mf_GetMatches_Func)Bt3_MatchFinder_GetMatches;
++    vTable->Skip = (Mf_Skip_Func)Bt3_MatchFinder_Skip;
++  }
++  else
++  {
++    vTable->GetMatches = (Mf_GetMatches_Func)Bt4_MatchFinder_GetMatches;
++    vTable->Skip = (Mf_Skip_Func)Bt4_MatchFinder_Skip;
++  }
++}
+--- /dev/null
++++ b/lib/lzma/LzmaDec.c
+@@ -0,0 +1,999 @@
++/* LzmaDec.c -- LZMA Decoder
++2009-09-20 : Igor Pavlov : Public domain */
++
++#include "LzmaDec.h"
++
++#include <string.h>
++
++#define kNumTopBits 24
++#define kTopValue ((UInt32)1 << kNumTopBits)
++
++#define kNumBitModelTotalBits 11
++#define kBitModelTotal (1 << kNumBitModelTotalBits)
++#define kNumMoveBits 5
++
++#define RC_INIT_SIZE 5
++
++#define NORMALIZE if (range < kTopValue) { range <<= 8; code = (code << 8) | (*buf++); }
++
++#define IF_BIT_0(p) ttt = *(p); NORMALIZE; bound = (range >> kNumBitModelTotalBits) * ttt; if (code < bound)
++#define UPDATE_0(p) range = bound; *(p) = (CLzmaProb)(ttt + ((kBitModelTotal - ttt) >> kNumMoveBits));
++#define UPDATE_1(p) range -= bound; code -= bound; *(p) = (CLzmaProb)(ttt - (ttt >> kNumMoveBits));
++#define GET_BIT2(p, i, A0, A1) IF_BIT_0(p) \
++  { UPDATE_0(p); i = (i + i); A0; } else \
++  { UPDATE_1(p); i = (i + i) + 1; A1; }
++#define GET_BIT(p, i) GET_BIT2(p, i, ; , ;)
++
++#define TREE_GET_BIT(probs, i) { GET_BIT((probs + i), i); }
++#define TREE_DECODE(probs, limit, i) \
++  { i = 1; do { TREE_GET_BIT(probs, i); } while (i < limit); i -= limit; }
++
++/* #define _LZMA_SIZE_OPT */
++
++#ifdef _LZMA_SIZE_OPT
++#define TREE_6_DECODE(probs, i) TREE_DECODE(probs, (1 << 6), i)
++#else
++#define TREE_6_DECODE(probs, i) \
++  { i = 1; \
++  TREE_GET_BIT(probs, i); \
++  TREE_GET_BIT(probs, i); \
++  TREE_GET_BIT(probs, i); \
++  TREE_GET_BIT(probs, i); \
++  TREE_GET_BIT(probs, i); \
++  TREE_GET_BIT(probs, i); \
++  i -= 0x40; }
++#endif
++
++#define NORMALIZE_CHECK if (range < kTopValue) { if (buf >= bufLimit) return DUMMY_ERROR; range <<= 8; code = (code << 8) | (*buf++); }
++
++#define IF_BIT_0_CHECK(p) ttt = *(p); NORMALIZE_CHECK; bound = (range >> kNumBitModelTotalBits) * ttt; if (code < bound)
++#define UPDATE_0_CHECK range = bound;
++#define UPDATE_1_CHECK range -= bound; code -= bound;
++#define GET_BIT2_CHECK(p, i, A0, A1) IF_BIT_0_CHECK(p) \
++  { UPDATE_0_CHECK; i = (i + i); A0; } else \
++  { UPDATE_1_CHECK; i = (i + i) + 1; A1; }
++#define GET_BIT_CHECK(p, i) GET_BIT2_CHECK(p, i, ; , ;)
++#define TREE_DECODE_CHECK(probs, limit, i) \
++  { i = 1; do { GET_BIT_CHECK(probs + i, i) } while (i < limit); i -= limit; }
++
++
++#define kNumPosBitsMax 4
++#define kNumPosStatesMax (1 << kNumPosBitsMax)
++
++#define kLenNumLowBits 3
++#define kLenNumLowSymbols (1 << kLenNumLowBits)
++#define kLenNumMidBits 3
++#define kLenNumMidSymbols (1 << kLenNumMidBits)
++#define kLenNumHighBits 8
++#define kLenNumHighSymbols (1 << kLenNumHighBits)
++
++#define LenChoice 0
++#define LenChoice2 (LenChoice + 1)
++#define LenLow (LenChoice2 + 1)
++#define LenMid (LenLow + (kNumPosStatesMax << kLenNumLowBits))
++#define LenHigh (LenMid + (kNumPosStatesMax << kLenNumMidBits))
++#define kNumLenProbs (LenHigh + kLenNumHighSymbols)
++
++
++#define kNumStates 12
++#define kNumLitStates 7
++
++#define kStartPosModelIndex 4
++#define kEndPosModelIndex 14
++#define kNumFullDistances (1 << (kEndPosModelIndex >> 1))
++
++#define kNumPosSlotBits 6
++#define kNumLenToPosStates 4
++
++#define kNumAlignBits 4
++#define kAlignTableSize (1 << kNumAlignBits)
++
++#define kMatchMinLen 2
++#define kMatchSpecLenStart (kMatchMinLen + kLenNumLowSymbols + kLenNumMidSymbols + kLenNumHighSymbols)
++
++#define IsMatch 0
++#define IsRep (IsMatch + (kNumStates << kNumPosBitsMax))
++#define IsRepG0 (IsRep + kNumStates)
++#define IsRepG1 (IsRepG0 + kNumStates)
++#define IsRepG2 (IsRepG1 + kNumStates)
++#define IsRep0Long (IsRepG2 + kNumStates)
++#define PosSlot (IsRep0Long + (kNumStates << kNumPosBitsMax))
++#define SpecPos (PosSlot + (kNumLenToPosStates << kNumPosSlotBits))
++#define Align (SpecPos + kNumFullDistances - kEndPosModelIndex)
++#define LenCoder (Align + kAlignTableSize)
++#define RepLenCoder (LenCoder + kNumLenProbs)
++#define Literal (RepLenCoder + kNumLenProbs)
++
++#define LZMA_BASE_SIZE 1846
++#define LZMA_LIT_SIZE 768
++
++#define LzmaProps_GetNumProbs(p) ((UInt32)LZMA_BASE_SIZE + (LZMA_LIT_SIZE << ((p)->lc + (p)->lp)))
++
++#if Literal != LZMA_BASE_SIZE
++StopCompilingDueBUG
++#endif
++
++#define LZMA_DIC_MIN (1 << 12)
++
++/* First LZMA-symbol is always decoded.
++And it decodes new LZMA-symbols while (buf < bufLimit), but "buf" is without last normalization
++Out:
++  Result:
++    SZ_OK - OK
++    SZ_ERROR_DATA - Error
++  p->remainLen:
++    < kMatchSpecLenStart : normal remain
++    = kMatchSpecLenStart : finished
++    = kMatchSpecLenStart + 1 : Flush marker
++    = kMatchSpecLenStart + 2 : State Init Marker
++*/
++
++static int MY_FAST_CALL LzmaDec_DecodeReal(CLzmaDec *p, SizeT limit, const Byte *bufLimit)
++{
++  CLzmaProb *probs = p->probs;
++
++  unsigned state = p->state;
++  UInt32 rep0 = p->reps[0], rep1 = p->reps[1], rep2 = p->reps[2], rep3 = p->reps[3];
++  unsigned pbMask = ((unsigned)1 << (p->prop.pb)) - 1;
++  unsigned lpMask = ((unsigned)1 << (p->prop.lp)) - 1;
++  unsigned lc = p->prop.lc;
++
++  Byte *dic = p->dic;
++  SizeT dicBufSize = p->dicBufSize;
++  SizeT dicPos = p->dicPos;
++
++  UInt32 processedPos = p->processedPos;
++  UInt32 checkDicSize = p->checkDicSize;
++  unsigned len = 0;
++
++  const Byte *buf = p->buf;
++  UInt32 range = p->range;
++  UInt32 code = p->code;
++
++  do
++  {
++    CLzmaProb *prob;
++    UInt32 bound;
++    unsigned ttt;
++    unsigned posState = processedPos & pbMask;
++
++    prob = probs + IsMatch + (state << kNumPosBitsMax) + posState;
++    IF_BIT_0(prob)
++    {
++      unsigned symbol;
++      UPDATE_0(prob);
++      prob = probs + Literal;
++      if (checkDicSize != 0 || processedPos != 0)
++        prob += (LZMA_LIT_SIZE * (((processedPos & lpMask) << lc) +
++        (dic[(dicPos == 0 ? dicBufSize : dicPos) - 1] >> (8 - lc))));
++
++      if (state < kNumLitStates)
++      {
++        state -= (state < 4) ? state : 3;
++        symbol = 1;
++        do { GET_BIT(prob + symbol, symbol) } while (symbol < 0x100);
++      }
++      else
++      {
++        unsigned matchByte = p->dic[(dicPos - rep0) + ((dicPos < rep0) ? dicBufSize : 0)];
++        unsigned offs = 0x100;
++        state -= (state < 10) ? 3 : 6;
++        symbol = 1;
++        do
++        {
++          unsigned bit;
++          CLzmaProb *probLit;
++          matchByte <<= 1;
++          bit = (matchByte & offs);
++          probLit = prob + offs + bit + symbol;
++          GET_BIT2(probLit, symbol, offs &= ~bit, offs &= bit)
++        }
++        while (symbol < 0x100);
++      }
++      dic[dicPos++] = (Byte)symbol;
++      processedPos++;
++      continue;
++    }
++    else
++    {
++      UPDATE_1(prob);
++      prob = probs + IsRep + state;
++      IF_BIT_0(prob)
++      {
++        UPDATE_0(prob);
++        state += kNumStates;
++        prob = probs + LenCoder;
++      }
++      else
++      {
++        UPDATE_1(prob);
++        if (checkDicSize == 0 && processedPos == 0)
++          return SZ_ERROR_DATA;
++        prob = probs + IsRepG0 + state;
++        IF_BIT_0(prob)
++        {
++          UPDATE_0(prob);
++          prob = probs + IsRep0Long + (state << kNumPosBitsMax) + posState;
++          IF_BIT_0(prob)
++          {
++            UPDATE_0(prob);
++            dic[dicPos] = dic[(dicPos - rep0) + ((dicPos < rep0) ? dicBufSize : 0)];
++            dicPos++;
++            processedPos++;
++            state = state < kNumLitStates ? 9 : 11;
++            continue;
++          }
++          UPDATE_1(prob);
++        }
++        else
++        {
++          UInt32 distance;
++          UPDATE_1(prob);
++          prob = probs + IsRepG1 + state;
++          IF_BIT_0(prob)
++          {
++            UPDATE_0(prob);
++            distance = rep1;
++          }
++          else
++          {
++            UPDATE_1(prob);
++            prob = probs + IsRepG2 + state;
++            IF_BIT_0(prob)
++            {
++              UPDATE_0(prob);
++              distance = rep2;
++            }
++            else
++            {
++              UPDATE_1(prob);
++              distance = rep3;
++              rep3 = rep2;
++            }
++            rep2 = rep1;
++          }
++          rep1 = rep0;
++          rep0 = distance;
++        }
++        state = state < kNumLitStates ? 8 : 11;
++        prob = probs + RepLenCoder;
++      }
++      {
++        unsigned limit, offset;
++        CLzmaProb *probLen = prob + LenChoice;
++        IF_BIT_0(probLen)
++        {
++          UPDATE_0(probLen);
++          probLen = prob + LenLow + (posState << kLenNumLowBits);
++          offset = 0;
++          limit = (1 << kLenNumLowBits);
++        }
++        else
++        {
++          UPDATE_1(probLen);
++          probLen = prob + LenChoice2;
++          IF_BIT_0(probLen)
++          {
++            UPDATE_0(probLen);
++            probLen = prob + LenMid + (posState << kLenNumMidBits);
++            offset = kLenNumLowSymbols;
++            limit = (1 << kLenNumMidBits);
++          }
++          else
++          {
++            UPDATE_1(probLen);
++            probLen = prob + LenHigh;
++            offset = kLenNumLowSymbols + kLenNumMidSymbols;
++            limit = (1 << kLenNumHighBits);
++          }
++        }
++        TREE_DECODE(probLen, limit, len);
++        len += offset;
++      }
++
++      if (state >= kNumStates)
++      {
++        UInt32 distance;
++        prob = probs + PosSlot +
++            ((len < kNumLenToPosStates ? len : kNumLenToPosStates - 1) << kNumPosSlotBits);
++        TREE_6_DECODE(prob, distance);
++        if (distance >= kStartPosModelIndex)
++        {
++          unsigned posSlot = (unsigned)distance;
++          int numDirectBits = (int)(((distance >> 1) - 1));
++          distance = (2 | (distance & 1));
++          if (posSlot < kEndPosModelIndex)
++          {
++            distance <<= numDirectBits;
++            prob = probs + SpecPos + distance - posSlot - 1;
++            {
++              UInt32 mask = 1;
++              unsigned i = 1;
++              do
++              {
++                GET_BIT2(prob + i, i, ; , distance |= mask);
++                mask <<= 1;
++              }
++              while (--numDirectBits != 0);
++            }
++          }
++          else
++          {
++            numDirectBits -= kNumAlignBits;
++            do
++            {
++              NORMALIZE
++              range >>= 1;
++
++              {
++                UInt32 t;
++                code -= range;
++                t = (0 - ((UInt32)code >> 31)); /* (UInt32)((Int32)code >> 31) */
++                distance = (distance << 1) + (t + 1);
++                code += range & t;
++              }
++              /*
++              distance <<= 1;
++              if (code >= range)
++              {
++                code -= range;
++                distance |= 1;
++              }
++              */
++            }
++            while (--numDirectBits != 0);
++            prob = probs + Align;
++            distance <<= kNumAlignBits;
++            {
++              unsigned i = 1;
++              GET_BIT2(prob + i, i, ; , distance |= 1);
++              GET_BIT2(prob + i, i, ; , distance |= 2);
++              GET_BIT2(prob + i, i, ; , distance |= 4);
++              GET_BIT2(prob + i, i, ; , distance |= 8);
++            }
++            if (distance == (UInt32)0xFFFFFFFF)
++            {
++              len += kMatchSpecLenStart;
++              state -= kNumStates;
++              break;
++            }
++          }
++        }
++        rep3 = rep2;
++        rep2 = rep1;
++        rep1 = rep0;
++        rep0 = distance + 1;
++        if (checkDicSize == 0)
++        {
++          if (distance >= processedPos)
++            return SZ_ERROR_DATA;
++        }
++        else if (distance >= checkDicSize)
++          return SZ_ERROR_DATA;
++        state = (state < kNumStates + kNumLitStates) ? kNumLitStates : kNumLitStates + 3;
++      }
++
++      len += kMatchMinLen;
++
++      if (limit == dicPos)
++        return SZ_ERROR_DATA;
++      {
++        SizeT rem = limit - dicPos;
++        unsigned curLen = ((rem < len) ? (unsigned)rem : len);
++        SizeT pos = (dicPos - rep0) + ((dicPos < rep0) ? dicBufSize : 0);
++
++        processedPos += curLen;
++
++        len -= curLen;
++        if (pos + curLen <= dicBufSize)
++        {
++          Byte *dest = dic + dicPos;
++          ptrdiff_t src = (ptrdiff_t)pos - (ptrdiff_t)dicPos;
++          const Byte *lim = dest + curLen;
++          dicPos += curLen;
++          do
++            *(dest) = (Byte)*(dest + src);
++          while (++dest != lim);
++        }
++        else
++        {
++          do
++          {
++            dic[dicPos++] = dic[pos];
++            if (++pos == dicBufSize)
++              pos = 0;
++          }
++          while (--curLen != 0);
++        }
++      }
++    }
++  }
++  while (dicPos < limit && buf < bufLimit);
++  NORMALIZE;
++  p->buf = buf;
++  p->range = range;
++  p->code = code;
++  p->remainLen = len;
++  p->dicPos = dicPos;
++  p->processedPos = processedPos;
++  p->reps[0] = rep0;
++  p->reps[1] = rep1;
++  p->reps[2] = rep2;
++  p->reps[3] = rep3;
++  p->state = state;
++
++  return SZ_OK;
++}
++
++static void MY_FAST_CALL LzmaDec_WriteRem(CLzmaDec *p, SizeT limit)
++{
++  if (p->remainLen != 0 && p->remainLen < kMatchSpecLenStart)
++  {
++    Byte *dic = p->dic;
++    SizeT dicPos = p->dicPos;
++    SizeT dicBufSize = p->dicBufSize;
++    unsigned len = p->remainLen;
++    UInt32 rep0 = p->reps[0];
++    if (limit - dicPos < len)
++      len = (unsigned)(limit - dicPos);
++
++    if (p->checkDicSize == 0 && p->prop.dicSize - p->processedPos <= len)
++      p->checkDicSize = p->prop.dicSize;
++
++    p->processedPos += len;
++    p->remainLen -= len;
++    while (len-- != 0)
++    {
++      dic[dicPos] = dic[(dicPos - rep0) + ((dicPos < rep0) ? dicBufSize : 0)];
++      dicPos++;
++    }
++    p->dicPos = dicPos;
++  }
++}
++
++static int MY_FAST_CALL LzmaDec_DecodeReal2(CLzmaDec *p, SizeT limit, const Byte *bufLimit)
++{
++  do
++  {
++    SizeT limit2 = limit;
++    if (p->checkDicSize == 0)
++    {
++      UInt32 rem = p->prop.dicSize - p->processedPos;
++      if (limit - p->dicPos > rem)
++        limit2 = p->dicPos + rem;
++    }
++    RINOK(LzmaDec_DecodeReal(p, limit2, bufLimit));
++    if (p->processedPos >= p->prop.dicSize)
++      p->checkDicSize = p->prop.dicSize;
++    LzmaDec_WriteRem(p, limit);
++  }
++  while (p->dicPos < limit && p->buf < bufLimit && p->remainLen < kMatchSpecLenStart);
++
++  if (p->remainLen > kMatchSpecLenStart)
++  {
++    p->remainLen = kMatchSpecLenStart;
++  }
++  return 0;
++}
++
++typedef enum
++{
++  DUMMY_ERROR, /* unexpected end of input stream */
++  DUMMY_LIT,
++  DUMMY_MATCH,
++  DUMMY_REP
++} ELzmaDummy;
++
++static ELzmaDummy LzmaDec_TryDummy(const CLzmaDec *p, const Byte *buf, SizeT inSize)
++{
++  UInt32 range = p->range;
++  UInt32 code = p->code;
++  const Byte *bufLimit = buf + inSize;
++  CLzmaProb *probs = p->probs;
++  unsigned state = p->state;
++  ELzmaDummy res;
++
++  {
++    CLzmaProb *prob;
++    UInt32 bound;
++    unsigned ttt;
++    unsigned posState = (p->processedPos) & ((1 << p->prop.pb) - 1);
++
++    prob = probs + IsMatch + (state << kNumPosBitsMax) + posState;
++    IF_BIT_0_CHECK(prob)
++    {
++      UPDATE_0_CHECK
++
++      /* if (bufLimit - buf >= 7) return DUMMY_LIT; */
++
++      prob = probs + Literal;
++      if (p->checkDicSize != 0 || p->processedPos != 0)
++        prob += (LZMA_LIT_SIZE *
++          ((((p->processedPos) & ((1 << (p->prop.lp)) - 1)) << p->prop.lc) +
++          (p->dic[(p->dicPos == 0 ? p->dicBufSize : p->dicPos) - 1] >> (8 - p->prop.lc))));
++
++      if (state < kNumLitStates)
++      {
++        unsigned symbol = 1;
++        do { GET_BIT_CHECK(prob + symbol, symbol) } while (symbol < 0x100);
++      }
++      else
++      {
++        unsigned matchByte = p->dic[p->dicPos - p->reps[0] +
++            ((p->dicPos < p->reps[0]) ? p->dicBufSize : 0)];
++        unsigned offs = 0x100;
++        unsigned symbol = 1;
++        do
++        {
++          unsigned bit;
++          CLzmaProb *probLit;
++          matchByte <<= 1;
++          bit = (matchByte & offs);
++          probLit = prob + offs + bit + symbol;
++          GET_BIT2_CHECK(probLit, symbol, offs &= ~bit, offs &= bit)
++        }
++        while (symbol < 0x100);
++      }
++      res = DUMMY_LIT;
++    }
++    else
++    {
++      unsigned len;
++      UPDATE_1_CHECK;
++
++      prob = probs + IsRep + state;
++      IF_BIT_0_CHECK(prob)
++      {
++        UPDATE_0_CHECK;
++        state = 0;
++        prob = probs + LenCoder;
++        res = DUMMY_MATCH;
++      }
++      else
++      {
++        UPDATE_1_CHECK;
++        res = DUMMY_REP;
++        prob = probs + IsRepG0 + state;
++        IF_BIT_0_CHECK(prob)
++        {
++          UPDATE_0_CHECK;
++          prob = probs + IsRep0Long + (state << kNumPosBitsMax) + posState;
++          IF_BIT_0_CHECK(prob)
++          {
++            UPDATE_0_CHECK;
++            NORMALIZE_CHECK;
++            return DUMMY_REP;
++          }
++          else
++          {
++            UPDATE_1_CHECK;
++          }
++        }
++        else
++        {
++          UPDATE_1_CHECK;
++          prob = probs + IsRepG1 + state;
++          IF_BIT_0_CHECK(prob)
++          {
++            UPDATE_0_CHECK;
++          }
++          else
++          {
++            UPDATE_1_CHECK;
++            prob = probs + IsRepG2 + state;
++            IF_BIT_0_CHECK(prob)
++            {
++              UPDATE_0_CHECK;
++            }
++            else
++            {
++              UPDATE_1_CHECK;
++            }
++          }
++        }
++        state = kNumStates;
++        prob = probs + RepLenCoder;
++      }
++      {
++        unsigned limit, offset;
++        CLzmaProb *probLen = prob + LenChoice;
++        IF_BIT_0_CHECK(probLen)
++        {
++          UPDATE_0_CHECK;
++          probLen = prob + LenLow + (posState << kLenNumLowBits);
++          offset = 0;
++          limit = 1 << kLenNumLowBits;
++        }
++        else
++        {
++          UPDATE_1_CHECK;
++          probLen = prob + LenChoice2;
++          IF_BIT_0_CHECK(probLen)
++          {
++            UPDATE_0_CHECK;
++            probLen = prob + LenMid + (posState << kLenNumMidBits);
++            offset = kLenNumLowSymbols;
++            limit = 1 << kLenNumMidBits;
++          }
++          else
++          {
++            UPDATE_1_CHECK;
++            probLen = prob + LenHigh;
++            offset = kLenNumLowSymbols + kLenNumMidSymbols;
++            limit = 1 << kLenNumHighBits;
++          }
++        }
++        TREE_DECODE_CHECK(probLen, limit, len);
++        len += offset;
++      }
++
++      if (state < 4)
++      {
++        unsigned posSlot;
++        prob = probs + PosSlot +
++            ((len < kNumLenToPosStates ? len : kNumLenToPosStates - 1) <<
++            kNumPosSlotBits);
++        TREE_DECODE_CHECK(prob, 1 << kNumPosSlotBits, posSlot);
++        if (posSlot >= kStartPosModelIndex)
++        {
++          int numDirectBits = ((posSlot >> 1) - 1);
++
++          /* if (bufLimit - buf >= 8) return DUMMY_MATCH; */
++
++          if (posSlot < kEndPosModelIndex)
++          {
++            prob = probs + SpecPos + ((2 | (posSlot & 1)) << numDirectBits) - posSlot - 1;
++          }
++          else
++          {
++            numDirectBits -= kNumAlignBits;
++            do
++            {
++              NORMALIZE_CHECK
++              range >>= 1;
++              code -= range & (((code - range) >> 31) - 1);
++              /* if (code >= range) code -= range; */
++            }
++            while (--numDirectBits != 0);
++            prob = probs + Align;
++            numDirectBits = kNumAlignBits;
++          }
++          {
++            unsigned i = 1;
++            do
++            {
++              GET_BIT_CHECK(prob + i, i);
++            }
++            while (--numDirectBits != 0);
++          }
++        }
++      }
++    }
++  }
++  NORMALIZE_CHECK;
++  return res;
++}
++
++
++static void LzmaDec_InitRc(CLzmaDec *p, const Byte *data)
++{
++  p->code = ((UInt32)data[1] << 24) | ((UInt32)data[2] << 16) | ((UInt32)data[3] << 8) | ((UInt32)data[4]);
++  p->range = 0xFFFFFFFF;
++  p->needFlush = 0;
++}
++
++void LzmaDec_InitDicAndState(CLzmaDec *p, Bool initDic, Bool initState)
++{
++  p->needFlush = 1;
++  p->remainLen = 0;
++  p->tempBufSize = 0;
++
++  if (initDic)
++  {
++    p->processedPos = 0;
++    p->checkDicSize = 0;
++    p->needInitState = 1;
++  }
++  if (initState)
++    p->needInitState = 1;
++}
++
++void LzmaDec_Init(CLzmaDec *p)
++{
++  p->dicPos = 0;
++  LzmaDec_InitDicAndState(p, True, True);
++}
++
++static void LzmaDec_InitStateReal(CLzmaDec *p)
++{
++  UInt32 numProbs = Literal + ((UInt32)LZMA_LIT_SIZE << (p->prop.lc + p->prop.lp));
++  UInt32 i;
++  CLzmaProb *probs = p->probs;
++  for (i = 0; i < numProbs; i++)
++    probs[i] = kBitModelTotal >> 1;
++  p->reps[0] = p->reps[1] = p->reps[2] = p->reps[3] = 1;
++  p->state = 0;
++  p->needInitState = 0;
++}
++
++SRes LzmaDec_DecodeToDic(CLzmaDec *p, SizeT dicLimit, const Byte *src, SizeT *srcLen,
++    ELzmaFinishMode finishMode, ELzmaStatus *status)
++{
++  SizeT inSize = *srcLen;
++  (*srcLen) = 0;
++  LzmaDec_WriteRem(p, dicLimit);
++
++  *status = LZMA_STATUS_NOT_SPECIFIED;
++
++  while (p->remainLen != kMatchSpecLenStart)
++  {
++      int checkEndMarkNow;
++
++      if (p->needFlush != 0)
++      {
++        for (; inSize > 0 && p->tempBufSize < RC_INIT_SIZE; (*srcLen)++, inSize--)
++          p->tempBuf[p->tempBufSize++] = *src++;
++        if (p->tempBufSize < RC_INIT_SIZE)
++        {
++          *status = LZMA_STATUS_NEEDS_MORE_INPUT;
++          return SZ_OK;
++        }
++        if (p->tempBuf[0] != 0)
++          return SZ_ERROR_DATA;
++
++        LzmaDec_InitRc(p, p->tempBuf);
++        p->tempBufSize = 0;
++      }
++
++      checkEndMarkNow = 0;
++      if (p->dicPos >= dicLimit)
++      {
++        if (p->remainLen == 0 && p->code == 0)
++        {
++          *status = LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK;
++          return SZ_OK;
++        }
++        if (finishMode == LZMA_FINISH_ANY)
++        {
++          *status = LZMA_STATUS_NOT_FINISHED;
++          return SZ_OK;
++        }
++        if (p->remainLen != 0)
++        {
++          *status = LZMA_STATUS_NOT_FINISHED;
++          return SZ_ERROR_DATA;
++        }
++        checkEndMarkNow = 1;
++      }
++
++      if (p->needInitState)
++        LzmaDec_InitStateReal(p);
++
++      if (p->tempBufSize == 0)
++      {
++        SizeT processed;
++        const Byte *bufLimit;
++        if (inSize < LZMA_REQUIRED_INPUT_MAX || checkEndMarkNow)
++        {
++          int dummyRes = LzmaDec_TryDummy(p, src, inSize);
++          if (dummyRes == DUMMY_ERROR)
++          {
++            memcpy(p->tempBuf, src, inSize);
++            p->tempBufSize = (unsigned)inSize;
++            (*srcLen) += inSize;
++            *status = LZMA_STATUS_NEEDS_MORE_INPUT;
++            return SZ_OK;
++          }
++          if (checkEndMarkNow && dummyRes != DUMMY_MATCH)
++          {
++            *status = LZMA_STATUS_NOT_FINISHED;
++            return SZ_ERROR_DATA;
++          }
++          bufLimit = src;
++        }
++        else
++          bufLimit = src + inSize - LZMA_REQUIRED_INPUT_MAX;
++        p->buf = src;
++        if (LzmaDec_DecodeReal2(p, dicLimit, bufLimit) != 0)
++          return SZ_ERROR_DATA;
++        processed = (SizeT)(p->buf - src);
++        (*srcLen) += processed;
++        src += processed;
++        inSize -= processed;
++      }
++      else
++      {
++        unsigned rem = p->tempBufSize, lookAhead = 0;
++        while (rem < LZMA_REQUIRED_INPUT_MAX && lookAhead < inSize)
++          p->tempBuf[rem++] = src[lookAhead++];
++        p->tempBufSize = rem;
++        if (rem < LZMA_REQUIRED_INPUT_MAX || checkEndMarkNow)
++        {
++          int dummyRes = LzmaDec_TryDummy(p, p->tempBuf, rem);
++          if (dummyRes == DUMMY_ERROR)
++          {
++            (*srcLen) += lookAhead;
++            *status = LZMA_STATUS_NEEDS_MORE_INPUT;
++            return SZ_OK;
++          }
++          if (checkEndMarkNow && dummyRes != DUMMY_MATCH)
++          {
++            *status = LZMA_STATUS_NOT_FINISHED;
++            return SZ_ERROR_DATA;
++          }
++        }
++        p->buf = p->tempBuf;
++        if (LzmaDec_DecodeReal2(p, dicLimit, p->buf) != 0)
++          return SZ_ERROR_DATA;
++        lookAhead -= (rem - (unsigned)(p->buf - p->tempBuf));
++        (*srcLen) += lookAhead;
++        src += lookAhead;
++        inSize -= lookAhead;
++        p->tempBufSize = 0;
++      }
++  }
++  if (p->code == 0)
++    *status = LZMA_STATUS_FINISHED_WITH_MARK;
++  return (p->code == 0) ? SZ_OK : SZ_ERROR_DATA;
++}
++
++SRes LzmaDec_DecodeToBuf(CLzmaDec *p, Byte *dest, SizeT *destLen, const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status)
++{
++  SizeT outSize = *destLen;
++  SizeT inSize = *srcLen;
++  *srcLen = *destLen = 0;
++  for (;;)
++  {
++    SizeT inSizeCur = inSize, outSizeCur, dicPos;
++    ELzmaFinishMode curFinishMode;
++    SRes res;
++    if (p->dicPos == p->dicBufSize)
++      p->dicPos = 0;
++    dicPos = p->dicPos;
++    if (outSize > p->dicBufSize - dicPos)
++    {
++      outSizeCur = p->dicBufSize;
++      curFinishMode = LZMA_FINISH_ANY;
++    }
++    else
++    {
++      outSizeCur = dicPos + outSize;
++      curFinishMode = finishMode;
++    }
++
++    res = LzmaDec_DecodeToDic(p, outSizeCur, src, &inSizeCur, curFinishMode, status);
++    src += inSizeCur;
++    inSize -= inSizeCur;
++    *srcLen += inSizeCur;
++    outSizeCur = p->dicPos - dicPos;
++    memcpy(dest, p->dic + dicPos, outSizeCur);
++    dest += outSizeCur;
++    outSize -= outSizeCur;
++    *destLen += outSizeCur;
++    if (res != 0)
++      return res;
++    if (outSizeCur == 0 || outSize == 0)
++      return SZ_OK;
++  }
++}
++
++void LzmaDec_FreeProbs(CLzmaDec *p, ISzAlloc *alloc)
++{
++  alloc->Free(alloc, p->probs);
++  p->probs = 0;
++}
++
++static void LzmaDec_FreeDict(CLzmaDec *p, ISzAlloc *alloc)
++{
++  alloc->Free(alloc, p->dic);
++  p->dic = 0;
++}
++
++void LzmaDec_Free(CLzmaDec *p, ISzAlloc *alloc)
++{
++  LzmaDec_FreeProbs(p, alloc);
++  LzmaDec_FreeDict(p, alloc);
++}
++
++SRes LzmaProps_Decode(CLzmaProps *p, const Byte *data, unsigned size)
++{
++  UInt32 dicSize;
++  Byte d;
++
++  if (size < LZMA_PROPS_SIZE)
++    return SZ_ERROR_UNSUPPORTED;
++  else
++    dicSize = data[1] | ((UInt32)data[2] << 8) | ((UInt32)data[3] << 16) | ((UInt32)data[4] << 24);
++
++  if (dicSize < LZMA_DIC_MIN)
++    dicSize = LZMA_DIC_MIN;
++  p->dicSize = dicSize;
++
++  d = data[0];
++  if (d >= (9 * 5 * 5))
++    return SZ_ERROR_UNSUPPORTED;
++
++  p->lc = d % 9;
++  d /= 9;
++  p->pb = d / 5;
++  p->lp = d % 5;
++
++  return SZ_OK;
++}
++
++static SRes LzmaDec_AllocateProbs2(CLzmaDec *p, const CLzmaProps *propNew, ISzAlloc *alloc)
++{
++  UInt32 numProbs = LzmaProps_GetNumProbs(propNew);
++  if (p->probs == 0 || numProbs != p->numProbs)
++  {
++    LzmaDec_FreeProbs(p, alloc);
++    p->probs = (CLzmaProb *)alloc->Alloc(alloc, numProbs * sizeof(CLzmaProb));
++    p->numProbs = numProbs;
++    if (p->probs == 0)
++      return SZ_ERROR_MEM;
++  }
++  return SZ_OK;
++}
++
++SRes LzmaDec_AllocateProbs(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc)
++{
++  CLzmaProps propNew;
++  RINOK(LzmaProps_Decode(&propNew, props, propsSize));
++  RINOK(LzmaDec_AllocateProbs2(p, &propNew, alloc));
++  p->prop = propNew;
++  return SZ_OK;
++}
++
++SRes LzmaDec_Allocate(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc)
++{
++  CLzmaProps propNew;
++  SizeT dicBufSize;
++  RINOK(LzmaProps_Decode(&propNew, props, propsSize));
++  RINOK(LzmaDec_AllocateProbs2(p, &propNew, alloc));
++  dicBufSize = propNew.dicSize;
++  if (p->dic == 0 || dicBufSize != p->dicBufSize)
++  {
++    LzmaDec_FreeDict(p, alloc);
++    p->dic = (Byte *)alloc->Alloc(alloc, dicBufSize);
++    if (p->dic == 0)
++    {
++      LzmaDec_FreeProbs(p, alloc);
++      return SZ_ERROR_MEM;
++    }
++  }
++  p->dicBufSize = dicBufSize;
++  p->prop = propNew;
++  return SZ_OK;
++}
++
++SRes LzmaDecode(Byte *dest, SizeT *destLen, const Byte *src, SizeT *srcLen,
++    const Byte *propData, unsigned propSize, ELzmaFinishMode finishMode,
++    ELzmaStatus *status, ISzAlloc *alloc)
++{
++  CLzmaDec p;
++  SRes res;
++  SizeT inSize = *srcLen;
++  SizeT outSize = *destLen;
++  *srcLen = *destLen = 0;
++  if (inSize < RC_INIT_SIZE)
++    return SZ_ERROR_INPUT_EOF;
++
++  LzmaDec_Construct(&p);
++  res = LzmaDec_AllocateProbs(&p, propData, propSize, alloc);
++  if (res != 0)
++    return res;
++  p.dic = dest;
++  p.dicBufSize = outSize;
++
++  LzmaDec_Init(&p);
++
++  *srcLen = inSize;
++  res = LzmaDec_DecodeToDic(&p, outSize, src, srcLen, finishMode, status);
++
++  if (res == SZ_OK && *status == LZMA_STATUS_NEEDS_MORE_INPUT)
++    res = SZ_ERROR_INPUT_EOF;
++
++  (*destLen) = p.dicPos;
++  LzmaDec_FreeProbs(&p, alloc);
++  return res;
++}
+--- /dev/null
++++ b/lib/lzma/LzmaEnc.c
+@@ -0,0 +1,2271 @@
++/* LzmaEnc.c -- LZMA Encoder
++2009-11-24 : Igor Pavlov : Public domain */
++
++#include <string.h>
++
++/* #define SHOW_STAT */
++/* #define SHOW_STAT2 */
++
++#if defined(SHOW_STAT) || defined(SHOW_STAT2)
++#include <stdio.h>
++#endif
++
++#include "LzmaEnc.h"
++
++/* disable MT */
++#define _7ZIP_ST
++
++#include "LzFind.h"
++#ifndef _7ZIP_ST
++#include "LzFindMt.h"
++#endif
++
++#ifdef SHOW_STAT
++static int ttt = 0;
++#endif
++
++#define kBlockSizeMax ((1 << LZMA_NUM_BLOCK_SIZE_BITS) - 1)
++
++#define kBlockSize (9 << 10)
++#define kUnpackBlockSize (1 << 18)
++#define kMatchArraySize (1 << 21)
++#define kMatchRecordMaxSize ((LZMA_MATCH_LEN_MAX * 2 + 3) * LZMA_MATCH_LEN_MAX)
++
++#define kNumMaxDirectBits (31)
++
++#define kNumTopBits 24
++#define kTopValue ((UInt32)1 << kNumTopBits)
++
++#define kNumBitModelTotalBits 11
++#define kBitModelTotal (1 << kNumBitModelTotalBits)
++#define kNumMoveBits 5
++#define kProbInitValue (kBitModelTotal >> 1)
++
++#define kNumMoveReducingBits 4
++#define kNumBitPriceShiftBits 4
++#define kBitPrice (1 << kNumBitPriceShiftBits)
++
++void LzmaEncProps_Init(CLzmaEncProps *p)
++{
++  p->level = 5;
++  p->dictSize = p->mc = 0;
++  p->lc = p->lp = p->pb = p->algo = p->fb = p->btMode = p->numHashBytes = p->numThreads = -1;
++  p->writeEndMark = 0;
++}
++
++void LzmaEncProps_Normalize(CLzmaEncProps *p)
++{
++  int level = p->level;
++  if (level < 0) level = 5;
++  p->level = level;
++  if (p->dictSize == 0) p->dictSize = (level <= 5 ? (1 << (level * 2 + 14)) : (level == 6 ? (1 << 25) : (1 << 26)));
++  if (p->lc < 0) p->lc = 3;
++  if (p->lp < 0) p->lp = 0;
++  if (p->pb < 0) p->pb = 2;
++  if (p->algo < 0) p->algo = (level < 5 ? 0 : 1);
++  if (p->fb < 0) p->fb = (level < 7 ? 32 : 64);
++  if (p->btMode < 0) p->btMode = (p->algo == 0 ? 0 : 1);
++  if (p->numHashBytes < 0) p->numHashBytes = 4;
++  if (p->mc == 0)  p->mc = (16 + (p->fb >> 1)) >> (p->btMode ? 0 : 1);
++  if (p->numThreads < 0)
++    p->numThreads =
++      #ifndef _7ZIP_ST
++      ((p->btMode && p->algo) ? 2 : 1);
++      #else
++      1;
++      #endif
++}
++
++UInt32 LzmaEncProps_GetDictSize(const CLzmaEncProps *props2)
++{
++  CLzmaEncProps props = *props2;
++  LzmaEncProps_Normalize(&props);
++  return props.dictSize;
++}
++
++/* #define LZMA_LOG_BSR */
++/* Define it for Intel's CPU */
++
++
++#ifdef LZMA_LOG_BSR
++
++#define kDicLogSizeMaxCompress 30
++
++#define BSR2_RET(pos, res) { unsigned long i; _BitScanReverse(&i, (pos)); res = (i + i) + ((pos >> (i - 1)) & 1); }
++
++UInt32 GetPosSlot1(UInt32 pos)
++{
++  UInt32 res;
++  BSR2_RET(pos, res);
++  return res;
++}
++#define GetPosSlot2(pos, res) { BSR2_RET(pos, res); }
++#define GetPosSlot(pos, res) { if (pos < 2) res = pos; else BSR2_RET(pos, res); }
++
++#else
++
++#define kNumLogBits (9 + (int)sizeof(size_t) / 2)
++#define kDicLogSizeMaxCompress ((kNumLogBits - 1) * 2 + 7)
++
++void LzmaEnc_FastPosInit(Byte *g_FastPos)
++{
++  int c = 2, slotFast;
++  g_FastPos[0] = 0;
++  g_FastPos[1] = 1;
++
++  for (slotFast = 2; slotFast < kNumLogBits * 2; slotFast++)
++  {
++    UInt32 k = (1 << ((slotFast >> 1) - 1));
++    UInt32 j;
++    for (j = 0; j < k; j++, c++)
++      g_FastPos[c] = (Byte)slotFast;
++  }
++}
++
++#define BSR2_RET(pos, res) { UInt32 i = 6 + ((kNumLogBits - 1) & \
++  (0 - (((((UInt32)1 << (kNumLogBits + 6)) - 1) - pos) >> 31))); \
++  res = p->g_FastPos[pos >> i] + (i * 2); }
++/*
++#define BSR2_RET(pos, res) { res = (pos < (1 << (kNumLogBits + 6))) ? \
++  p->g_FastPos[pos >> 6] + 12 : \
++  p->g_FastPos[pos >> (6 + kNumLogBits - 1)] + (6 + (kNumLogBits - 1)) * 2; }
++*/
++
++#define GetPosSlot1(pos) p->g_FastPos[pos]
++#define GetPosSlot2(pos, res) { BSR2_RET(pos, res); }
++#define GetPosSlot(pos, res) { if (pos < kNumFullDistances) res = p->g_FastPos[pos]; else BSR2_RET(pos, res); }
++
++#endif
++
++
++#define LZMA_NUM_REPS 4
++
++typedef unsigned CState;
++
++typedef struct
++{
++  UInt32 price;
++
++  CState state;
++  int prev1IsChar;
++  int prev2;
++
++  UInt32 posPrev2;
++  UInt32 backPrev2;
++
++  UInt32 posPrev;
++  UInt32 backPrev;
++  UInt32 backs[LZMA_NUM_REPS];
++} COptimal;
++
++#define kNumOpts (1 << 12)
++
++#define kNumLenToPosStates 4
++#define kNumPosSlotBits 6
++#define kDicLogSizeMin 0
++#define kDicLogSizeMax 32
++#define kDistTableSizeMax (kDicLogSizeMax * 2)
++
++
++#define kNumAlignBits 4
++#define kAlignTableSize (1 << kNumAlignBits)
++#define kAlignMask (kAlignTableSize - 1)
++
++#define kStartPosModelIndex 4
++#define kEndPosModelIndex 14
++#define kNumPosModels (kEndPosModelIndex - kStartPosModelIndex)
++
++#define kNumFullDistances (1 << (kEndPosModelIndex >> 1))
++
++#ifdef _LZMA_PROB32
++#define CLzmaProb UInt32
++#else
++#define CLzmaProb UInt16
++#endif
++
++#define LZMA_PB_MAX 4
++#define LZMA_LC_MAX 8
++#define LZMA_LP_MAX 4
++
++#define LZMA_NUM_PB_STATES_MAX (1 << LZMA_PB_MAX)
++
++
++#define kLenNumLowBits 3
++#define kLenNumLowSymbols (1 << kLenNumLowBits)
++#define kLenNumMidBits 3
++#define kLenNumMidSymbols (1 << kLenNumMidBits)
++#define kLenNumHighBits 8
++#define kLenNumHighSymbols (1 << kLenNumHighBits)
++
++#define kLenNumSymbolsTotal (kLenNumLowSymbols + kLenNumMidSymbols + kLenNumHighSymbols)
++
++#define LZMA_MATCH_LEN_MIN 2
++#define LZMA_MATCH_LEN_MAX (LZMA_MATCH_LEN_MIN + kLenNumSymbolsTotal - 1)
++
++#define kNumStates 12
++
++typedef struct
++{
++  CLzmaProb choice;
++  CLzmaProb choice2;
++  CLzmaProb low[LZMA_NUM_PB_STATES_MAX << kLenNumLowBits];
++  CLzmaProb mid[LZMA_NUM_PB_STATES_MAX << kLenNumMidBits];
++  CLzmaProb high[kLenNumHighSymbols];
++} CLenEnc;
++
++typedef struct
++{
++  CLenEnc p;
++  UInt32 prices[LZMA_NUM_PB_STATES_MAX][kLenNumSymbolsTotal];
++  UInt32 tableSize;
++  UInt32 counters[LZMA_NUM_PB_STATES_MAX];
++} CLenPriceEnc;
++
++typedef struct
++{
++  UInt32 range;
++  Byte cache;
++  UInt64 low;
++  UInt64 cacheSize;
++  Byte *buf;
++  Byte *bufLim;
++  Byte *bufBase;
++  ISeqOutStream *outStream;
++  UInt64 processed;
++  SRes res;
++} CRangeEnc;
++
++typedef struct
++{
++  CLzmaProb *litProbs;
++
++  CLzmaProb isMatch[kNumStates][LZMA_NUM_PB_STATES_MAX];
++  CLzmaProb isRep[kNumStates];
++  CLzmaProb isRepG0[kNumStates];
++  CLzmaProb isRepG1[kNumStates];
++  CLzmaProb isRepG2[kNumStates];
++  CLzmaProb isRep0Long[kNumStates][LZMA_NUM_PB_STATES_MAX];
++
++  CLzmaProb posSlotEncoder[kNumLenToPosStates][1 << kNumPosSlotBits];
++  CLzmaProb posEncoders[kNumFullDistances - kEndPosModelIndex];
++  CLzmaProb posAlignEncoder[1 << kNumAlignBits];
++
++  CLenPriceEnc lenEnc;
++  CLenPriceEnc repLenEnc;
++
++  UInt32 reps[LZMA_NUM_REPS];
++  UInt32 state;
++} CSaveState;
++
++typedef struct
++{
++  IMatchFinder matchFinder;
++  void *matchFinderObj;
++
++  #ifndef _7ZIP_ST
++  Bool mtMode;
++  CMatchFinderMt matchFinderMt;
++  #endif
++
++  CMatchFinder matchFinderBase;
++
++  #ifndef _7ZIP_ST
++  Byte pad[128];
++  #endif
++
++  UInt32 optimumEndIndex;
++  UInt32 optimumCurrentIndex;
++
++  UInt32 longestMatchLength;
++  UInt32 numPairs;
++  UInt32 numAvail;
++  COptimal opt[kNumOpts];
++
++  #ifndef LZMA_LOG_BSR
++  Byte g_FastPos[1 << kNumLogBits];
++  #endif
++
++  UInt32 ProbPrices[kBitModelTotal >> kNumMoveReducingBits];
++  UInt32 matches[LZMA_MATCH_LEN_MAX * 2 + 2 + 1];
++  UInt32 numFastBytes;
++  UInt32 additionalOffset;
++  UInt32 reps[LZMA_NUM_REPS];
++  UInt32 state;
++
++  UInt32 posSlotPrices[kNumLenToPosStates][kDistTableSizeMax];
++  UInt32 distancesPrices[kNumLenToPosStates][kNumFullDistances];
++  UInt32 alignPrices[kAlignTableSize];
++  UInt32 alignPriceCount;
++
++  UInt32 distTableSize;
++
++  unsigned lc, lp, pb;
++  unsigned lpMask, pbMask;
++
++  CLzmaProb *litProbs;
++
++  CLzmaProb isMatch[kNumStates][LZMA_NUM_PB_STATES_MAX];
++  CLzmaProb isRep[kNumStates];
++  CLzmaProb isRepG0[kNumStates];
++  CLzmaProb isRepG1[kNumStates];
++  CLzmaProb isRepG2[kNumStates];
++  CLzmaProb isRep0Long[kNumStates][LZMA_NUM_PB_STATES_MAX];
++
++  CLzmaProb posSlotEncoder[kNumLenToPosStates][1 << kNumPosSlotBits];
++  CLzmaProb posEncoders[kNumFullDistances - kEndPosModelIndex];
++  CLzmaProb posAlignEncoder[1 << kNumAlignBits];
++
++  CLenPriceEnc lenEnc;
++  CLenPriceEnc repLenEnc;
++
++  unsigned lclp;
++
++  Bool fastMode;
++
++  CRangeEnc rc;
++
++  Bool writeEndMark;
++  UInt64 nowPos64;
++  UInt32 matchPriceCount;
++  Bool finished;
++  Bool multiThread;
++
++  SRes result;
++  UInt32 dictSize;
++  UInt32 matchFinderCycles;
++
++  int needInit;
++
++  CSaveState saveState;
++} CLzmaEnc;
++
++void LzmaEnc_SaveState(CLzmaEncHandle pp)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  CSaveState *dest = &p->saveState;
++  int i;
++  dest->lenEnc = p->lenEnc;
++  dest->repLenEnc = p->repLenEnc;
++  dest->state = p->state;
++
++  for (i = 0; i < kNumStates; i++)
++  {
++    memcpy(dest->isMatch[i], p->isMatch[i], sizeof(p->isMatch[i]));
++    memcpy(dest->isRep0Long[i], p->isRep0Long[i], sizeof(p->isRep0Long[i]));
++  }
++  for (i = 0; i < kNumLenToPosStates; i++)
++    memcpy(dest->posSlotEncoder[i], p->posSlotEncoder[i], sizeof(p->posSlotEncoder[i]));
++  memcpy(dest->isRep, p->isRep, sizeof(p->isRep));
++  memcpy(dest->isRepG0, p->isRepG0, sizeof(p->isRepG0));
++  memcpy(dest->isRepG1, p->isRepG1, sizeof(p->isRepG1));
++  memcpy(dest->isRepG2, p->isRepG2, sizeof(p->isRepG2));
++  memcpy(dest->posEncoders, p->posEncoders, sizeof(p->posEncoders));
++  memcpy(dest->posAlignEncoder, p->posAlignEncoder, sizeof(p->posAlignEncoder));
++  memcpy(dest->reps, p->reps, sizeof(p->reps));
++  memcpy(dest->litProbs, p->litProbs, (0x300 << p->lclp) * sizeof(CLzmaProb));
++}
++
++void LzmaEnc_RestoreState(CLzmaEncHandle pp)
++{
++  CLzmaEnc *dest = (CLzmaEnc *)pp;
++  const CSaveState *p = &dest->saveState;
++  int i;
++  dest->lenEnc = p->lenEnc;
++  dest->repLenEnc = p->repLenEnc;
++  dest->state = p->state;
++
++  for (i = 0; i < kNumStates; i++)
++  {
++    memcpy(dest->isMatch[i], p->isMatch[i], sizeof(p->isMatch[i]));
++    memcpy(dest->isRep0Long[i], p->isRep0Long[i], sizeof(p->isRep0Long[i]));
++  }
++  for (i = 0; i < kNumLenToPosStates; i++)
++    memcpy(dest->posSlotEncoder[i], p->posSlotEncoder[i], sizeof(p->posSlotEncoder[i]));
++  memcpy(dest->isRep, p->isRep, sizeof(p->isRep));
++  memcpy(dest->isRepG0, p->isRepG0, sizeof(p->isRepG0));
++  memcpy(dest->isRepG1, p->isRepG1, sizeof(p->isRepG1));
++  memcpy(dest->isRepG2, p->isRepG2, sizeof(p->isRepG2));
++  memcpy(dest->posEncoders, p->posEncoders, sizeof(p->posEncoders));
++  memcpy(dest->posAlignEncoder, p->posAlignEncoder, sizeof(p->posAlignEncoder));
++  memcpy(dest->reps, p->reps, sizeof(p->reps));
++  memcpy(dest->litProbs, p->litProbs, (0x300 << dest->lclp) * sizeof(CLzmaProb));
++}
++
++SRes LzmaEnc_SetProps(CLzmaEncHandle pp, const CLzmaEncProps *props2)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  CLzmaEncProps props = *props2;
++  LzmaEncProps_Normalize(&props);
++
++  if (props.lc > LZMA_LC_MAX || props.lp > LZMA_LP_MAX || props.pb > LZMA_PB_MAX ||
++      props.dictSize > (1 << kDicLogSizeMaxCompress) || props.dictSize > (1 << 30))
++    return SZ_ERROR_PARAM;
++  p->dictSize = props.dictSize;
++  p->matchFinderCycles = props.mc;
++  {
++    unsigned fb = props.fb;
++    if (fb < 5)
++      fb = 5;
++    if (fb > LZMA_MATCH_LEN_MAX)
++      fb = LZMA_MATCH_LEN_MAX;
++    p->numFastBytes = fb;
++  }
++  p->lc = props.lc;
++  p->lp = props.lp;
++  p->pb = props.pb;
++  p->fastMode = (props.algo == 0);
++  p->matchFinderBase.btMode = props.btMode;
++  {
++    UInt32 numHashBytes = 4;
++    if (props.btMode)
++    {
++      if (props.numHashBytes < 2)
++        numHashBytes = 2;
++      else if (props.numHashBytes < 4)
++        numHashBytes = props.numHashBytes;
++    }
++    p->matchFinderBase.numHashBytes = numHashBytes;
++  }
++
++  p->matchFinderBase.cutValue = props.mc;
++
++  p->writeEndMark = props.writeEndMark;
++
++  #ifndef _7ZIP_ST
++  /*
++  if (newMultiThread != _multiThread)
++  {
++    ReleaseMatchFinder();
++    _multiThread = newMultiThread;
++  }
++  */
++  p->multiThread = (props.numThreads > 1);
++  #endif
++
++  return SZ_OK;
++}
++
++static const int kLiteralNextStates[kNumStates] = {0, 0, 0, 0, 1, 2, 3, 4,  5,  6,   4, 5};
++static const int kMatchNextStates[kNumStates]   = {7, 7, 7, 7, 7, 7, 7, 10, 10, 10, 10, 10};
++static const int kRepNextStates[kNumStates]     = {8, 8, 8, 8, 8, 8, 8, 11, 11, 11, 11, 11};
++static const int kShortRepNextStates[kNumStates]= {9, 9, 9, 9, 9, 9, 9, 11, 11, 11, 11, 11};
++
++#define IsCharState(s) ((s) < 7)
++
++#define GetLenToPosState(len) (((len) < kNumLenToPosStates + 1) ? (len) - 2 : kNumLenToPosStates - 1)
++
++#define kInfinityPrice (1 << 30)
++
++static void RangeEnc_Construct(CRangeEnc *p)
++{
++  p->outStream = 0;
++  p->bufBase = 0;
++}
++
++#define RangeEnc_GetProcessed(p) ((p)->processed + ((p)->buf - (p)->bufBase) + (p)->cacheSize)
++
++#define RC_BUF_SIZE (1 << 16)
++static int RangeEnc_Alloc(CRangeEnc *p, ISzAlloc *alloc)
++{
++  if (p->bufBase == 0)
++  {
++    p->bufBase = (Byte *)alloc->Alloc(alloc, RC_BUF_SIZE);
++    if (p->bufBase == 0)
++      return 0;
++    p->bufLim = p->bufBase + RC_BUF_SIZE;
++  }
++  return 1;
++}
++
++static void RangeEnc_Free(CRangeEnc *p, ISzAlloc *alloc)
++{
++  alloc->Free(alloc, p->bufBase);
++  p->bufBase = 0;
++}
++
++static void RangeEnc_Init(CRangeEnc *p)
++{
++  /* Stream.Init(); */
++  p->low = 0;
++  p->range = 0xFFFFFFFF;
++  p->cacheSize = 1;
++  p->cache = 0;
++
++  p->buf = p->bufBase;
++
++  p->processed = 0;
++  p->res = SZ_OK;
++}
++
++static void RangeEnc_FlushStream(CRangeEnc *p)
++{
++  size_t num;
++  if (p->res != SZ_OK)
++    return;
++  num = p->buf - p->bufBase;
++  if (num != p->outStream->Write(p->outStream, p->bufBase, num))
++    p->res = SZ_ERROR_WRITE;
++  p->processed += num;
++  p->buf = p->bufBase;
++}
++
++static void MY_FAST_CALL RangeEnc_ShiftLow(CRangeEnc *p)
++{
++  if ((UInt32)p->low < (UInt32)0xFF000000 || (int)(p->low >> 32) != 0)
++  {
++    Byte temp = p->cache;
++    do
++    {
++      Byte *buf = p->buf;
++      *buf++ = (Byte)(temp + (Byte)(p->low >> 32));
++      p->buf = buf;
++      if (buf == p->bufLim)
++        RangeEnc_FlushStream(p);
++      temp = 0xFF;
++    }
++    while (--p->cacheSize != 0);
++    p->cache = (Byte)((UInt32)p->low >> 24);
++  }
++  p->cacheSize++;
++  p->low = (UInt32)p->low << 8;
++}
++
++static void RangeEnc_FlushData(CRangeEnc *p)
++{
++  int i;
++  for (i = 0; i < 5; i++)
++    RangeEnc_ShiftLow(p);
++}
++
++static void RangeEnc_EncodeDirectBits(CRangeEnc *p, UInt32 value, int numBits)
++{
++  do
++  {
++    p->range >>= 1;
++    p->low += p->range & (0 - ((value >> --numBits) & 1));
++    if (p->range < kTopValue)
++    {
++      p->range <<= 8;
++      RangeEnc_ShiftLow(p);
++    }
++  }
++  while (numBits != 0);
++}
++
++static void RangeEnc_EncodeBit(CRangeEnc *p, CLzmaProb *prob, UInt32 symbol)
++{
++  UInt32 ttt = *prob;
++  UInt32 newBound = (p->range >> kNumBitModelTotalBits) * ttt;
++  if (symbol == 0)
++  {
++    p->range = newBound;
++    ttt += (kBitModelTotal - ttt) >> kNumMoveBits;
++  }
++  else
++  {
++    p->low += newBound;
++    p->range -= newBound;
++    ttt -= ttt >> kNumMoveBits;
++  }
++  *prob = (CLzmaProb)ttt;
++  if (p->range < kTopValue)
++  {
++    p->range <<= 8;
++    RangeEnc_ShiftLow(p);
++  }
++}
++
++static void LitEnc_Encode(CRangeEnc *p, CLzmaProb *probs, UInt32 symbol)
++{
++  symbol |= 0x100;
++  do
++  {
++    RangeEnc_EncodeBit(p, probs + (symbol >> 8), (symbol >> 7) & 1);
++    symbol <<= 1;
++  }
++  while (symbol < 0x10000);
++}
++
++static void LitEnc_EncodeMatched(CRangeEnc *p, CLzmaProb *probs, UInt32 symbol, UInt32 matchByte)
++{
++  UInt32 offs = 0x100;
++  symbol |= 0x100;
++  do
++  {
++    matchByte <<= 1;
++    RangeEnc_EncodeBit(p, probs + (offs + (matchByte & offs) + (symbol >> 8)), (symbol >> 7) & 1);
++    symbol <<= 1;
++    offs &= ~(matchByte ^ symbol);
++  }
++  while (symbol < 0x10000);
++}
++
++void LzmaEnc_InitPriceTables(UInt32 *ProbPrices)
++{
++  UInt32 i;
++  for (i = (1 << kNumMoveReducingBits) / 2; i < kBitModelTotal; i += (1 << kNumMoveReducingBits))
++  {
++    const int kCyclesBits = kNumBitPriceShiftBits;
++    UInt32 w = i;
++    UInt32 bitCount = 0;
++    int j;
++    for (j = 0; j < kCyclesBits; j++)
++    {
++      w = w * w;
++      bitCount <<= 1;
++      while (w >= ((UInt32)1 << 16))
++      {
++        w >>= 1;
++        bitCount++;
++      }
++    }
++    ProbPrices[i >> kNumMoveReducingBits] = ((kNumBitModelTotalBits << kCyclesBits) - 15 - bitCount);
++  }
++}
++
++
++#define GET_PRICE(prob, symbol) \
++  p->ProbPrices[((prob) ^ (((-(int)(symbol))) & (kBitModelTotal - 1))) >> kNumMoveReducingBits];
++
++#define GET_PRICEa(prob, symbol) \
++  ProbPrices[((prob) ^ ((-((int)(symbol))) & (kBitModelTotal - 1))) >> kNumMoveReducingBits];
++
++#define GET_PRICE_0(prob) p->ProbPrices[(prob) >> kNumMoveReducingBits]
++#define GET_PRICE_1(prob) p->ProbPrices[((prob) ^ (kBitModelTotal - 1)) >> kNumMoveReducingBits]
++
++#define GET_PRICE_0a(prob) ProbPrices[(prob) >> kNumMoveReducingBits]
++#define GET_PRICE_1a(prob) ProbPrices[((prob) ^ (kBitModelTotal - 1)) >> kNumMoveReducingBits]
++
++static UInt32 LitEnc_GetPrice(const CLzmaProb *probs, UInt32 symbol, UInt32 *ProbPrices)
++{
++  UInt32 price = 0;
++  symbol |= 0x100;
++  do
++  {
++    price += GET_PRICEa(probs[symbol >> 8], (symbol >> 7) & 1);
++    symbol <<= 1;
++  }
++  while (symbol < 0x10000);
++  return price;
++}
++
++static UInt32 LitEnc_GetPriceMatched(const CLzmaProb *probs, UInt32 symbol, UInt32 matchByte, UInt32 *ProbPrices)
++{
++  UInt32 price = 0;
++  UInt32 offs = 0x100;
++  symbol |= 0x100;
++  do
++  {
++    matchByte <<= 1;
++    price += GET_PRICEa(probs[offs + (matchByte & offs) + (symbol >> 8)], (symbol >> 7) & 1);
++    symbol <<= 1;
++    offs &= ~(matchByte ^ symbol);
++  }
++  while (symbol < 0x10000);
++  return price;
++}
++
++
++static void RcTree_Encode(CRangeEnc *rc, CLzmaProb *probs, int numBitLevels, UInt32 symbol)
++{
++  UInt32 m = 1;
++  int i;
++  for (i = numBitLevels; i != 0;)
++  {
++    UInt32 bit;
++    i--;
++    bit = (symbol >> i) & 1;
++    RangeEnc_EncodeBit(rc, probs + m, bit);
++    m = (m << 1) | bit;
++  }
++}
++
++static void RcTree_ReverseEncode(CRangeEnc *rc, CLzmaProb *probs, int numBitLevels, UInt32 symbol)
++{
++  UInt32 m = 1;
++  int i;
++  for (i = 0; i < numBitLevels; i++)
++  {
++    UInt32 bit = symbol & 1;
++    RangeEnc_EncodeBit(rc, probs + m, bit);
++    m = (m << 1) | bit;
++    symbol >>= 1;
++  }
++}
++
++static UInt32 RcTree_GetPrice(const CLzmaProb *probs, int numBitLevels, UInt32 symbol, UInt32 *ProbPrices)
++{
++  UInt32 price = 0;
++  symbol |= (1 << numBitLevels);
++  while (symbol != 1)
++  {
++    price += GET_PRICEa(probs[symbol >> 1], symbol & 1);
++    symbol >>= 1;
++  }
++  return price;
++}
++
++static UInt32 RcTree_ReverseGetPrice(const CLzmaProb *probs, int numBitLevels, UInt32 symbol, UInt32 *ProbPrices)
++{
++  UInt32 price = 0;
++  UInt32 m = 1;
++  int i;
++  for (i = numBitLevels; i != 0; i--)
++  {
++    UInt32 bit = symbol & 1;
++    symbol >>= 1;
++    price += GET_PRICEa(probs[m], bit);
++    m = (m << 1) | bit;
++  }
++  return price;
++}
++
++
++static void LenEnc_Init(CLenEnc *p)
++{
++  unsigned i;
++  p->choice = p->choice2 = kProbInitValue;
++  for (i = 0; i < (LZMA_NUM_PB_STATES_MAX << kLenNumLowBits); i++)
++    p->low[i] = kProbInitValue;
++  for (i = 0; i < (LZMA_NUM_PB_STATES_MAX << kLenNumMidBits); i++)
++    p->mid[i] = kProbInitValue;
++  for (i = 0; i < kLenNumHighSymbols; i++)
++    p->high[i] = kProbInitValue;
++}
++
++static void LenEnc_Encode(CLenEnc *p, CRangeEnc *rc, UInt32 symbol, UInt32 posState)
++{
++  if (symbol < kLenNumLowSymbols)
++  {
++    RangeEnc_EncodeBit(rc, &p->choice, 0);
++    RcTree_Encode(rc, p->low + (posState << kLenNumLowBits), kLenNumLowBits, symbol);
++  }
++  else
++  {
++    RangeEnc_EncodeBit(rc, &p->choice, 1);
++    if (symbol < kLenNumLowSymbols + kLenNumMidSymbols)
++    {
++      RangeEnc_EncodeBit(rc, &p->choice2, 0);
++      RcTree_Encode(rc, p->mid + (posState << kLenNumMidBits), kLenNumMidBits, symbol - kLenNumLowSymbols);
++    }
++    else
++    {
++      RangeEnc_EncodeBit(rc, &p->choice2, 1);
++      RcTree_Encode(rc, p->high, kLenNumHighBits, symbol - kLenNumLowSymbols - kLenNumMidSymbols);
++    }
++  }
++}
++
++static void LenEnc_SetPrices(CLenEnc *p, UInt32 posState, UInt32 numSymbols, UInt32 *prices, UInt32 *ProbPrices)
++{
++  UInt32 a0 = GET_PRICE_0a(p->choice);
++  UInt32 a1 = GET_PRICE_1a(p->choice);
++  UInt32 b0 = a1 + GET_PRICE_0a(p->choice2);
++  UInt32 b1 = a1 + GET_PRICE_1a(p->choice2);
++  UInt32 i = 0;
++  for (i = 0; i < kLenNumLowSymbols; i++)
++  {
++    if (i >= numSymbols)
++      return;
++    prices[i] = a0 + RcTree_GetPrice(p->low + (posState << kLenNumLowBits), kLenNumLowBits, i, ProbPrices);
++  }
++  for (; i < kLenNumLowSymbols + kLenNumMidSymbols; i++)
++  {
++    if (i >= numSymbols)
++      return;
++    prices[i] = b0 + RcTree_GetPrice(p->mid + (posState << kLenNumMidBits), kLenNumMidBits, i - kLenNumLowSymbols, ProbPrices);
++  }
++  for (; i < numSymbols; i++)
++    prices[i] = b1 + RcTree_GetPrice(p->high, kLenNumHighBits, i - kLenNumLowSymbols - kLenNumMidSymbols, ProbPrices);
++}
++
++static void MY_FAST_CALL LenPriceEnc_UpdateTable(CLenPriceEnc *p, UInt32 posState, UInt32 *ProbPrices)
++{
++  LenEnc_SetPrices(&p->p, posState, p->tableSize, p->prices[posState], ProbPrices);
++  p->counters[posState] = p->tableSize;
++}
++
++static void LenPriceEnc_UpdateTables(CLenPriceEnc *p, UInt32 numPosStates, UInt32 *ProbPrices)
++{
++  UInt32 posState;
++  for (posState = 0; posState < numPosStates; posState++)
++    LenPriceEnc_UpdateTable(p, posState, ProbPrices);
++}
++
++static void LenEnc_Encode2(CLenPriceEnc *p, CRangeEnc *rc, UInt32 symbol, UInt32 posState, Bool updatePrice, UInt32 *ProbPrices)
++{
++  LenEnc_Encode(&p->p, rc, symbol, posState);
++  if (updatePrice)
++    if (--p->counters[posState] == 0)
++      LenPriceEnc_UpdateTable(p, posState, ProbPrices);
++}
++
++
++
++
++static void MovePos(CLzmaEnc *p, UInt32 num)
++{
++  #ifdef SHOW_STAT
++  ttt += num;
++  printf("\n MovePos %d", num);
++  #endif
++  if (num != 0)
++  {
++    p->additionalOffset += num;
++    p->matchFinder.Skip(p->matchFinderObj, num);
++  }
++}
++
++static UInt32 ReadMatchDistances(CLzmaEnc *p, UInt32 *numDistancePairsRes)
++{
++  UInt32 lenRes = 0, numPairs;
++  p->numAvail = p->matchFinder.GetNumAvailableBytes(p->matchFinderObj);
++  numPairs = p->matchFinder.GetMatches(p->matchFinderObj, p->matches);
++  #ifdef SHOW_STAT
++  printf("\n i = %d numPairs = %d    ", ttt, numPairs / 2);
++  ttt++;
++  {
++    UInt32 i;
++    for (i = 0; i < numPairs; i += 2)
++      printf("%2d %6d   | ", p->matches[i], p->matches[i + 1]);
++  }
++  #endif
++  if (numPairs > 0)
++  {
++    lenRes = p->matches[numPairs - 2];
++    if (lenRes == p->numFastBytes)
++    {
++      const Byte *pby = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - 1;
++      UInt32 distance = p->matches[numPairs - 1] + 1;
++      UInt32 numAvail = p->numAvail;
++      if (numAvail > LZMA_MATCH_LEN_MAX)
++        numAvail = LZMA_MATCH_LEN_MAX;
++      {
++        const Byte *pby2 = pby - distance;
++        for (; lenRes < numAvail && pby[lenRes] == pby2[lenRes]; lenRes++);
++      }
++    }
++  }
++  p->additionalOffset++;
++  *numDistancePairsRes = numPairs;
++  return lenRes;
++}
++
++
++#define MakeAsChar(p) (p)->backPrev = (UInt32)(-1); (p)->prev1IsChar = False;
++#define MakeAsShortRep(p) (p)->backPrev = 0; (p)->prev1IsChar = False;
++#define IsShortRep(p) ((p)->backPrev == 0)
++
++static UInt32 GetRepLen1Price(CLzmaEnc *p, UInt32 state, UInt32 posState)
++{
++  return
++    GET_PRICE_0(p->isRepG0[state]) +
++    GET_PRICE_0(p->isRep0Long[state][posState]);
++}
++
++static UInt32 GetPureRepPrice(CLzmaEnc *p, UInt32 repIndex, UInt32 state, UInt32 posState)
++{
++  UInt32 price;
++  if (repIndex == 0)
++  {
++    price = GET_PRICE_0(p->isRepG0[state]);
++    price += GET_PRICE_1(p->isRep0Long[state][posState]);
++  }
++  else
++  {
++    price = GET_PRICE_1(p->isRepG0[state]);
++    if (repIndex == 1)
++      price += GET_PRICE_0(p->isRepG1[state]);
++    else
++    {
++      price += GET_PRICE_1(p->isRepG1[state]);
++      price += GET_PRICE(p->isRepG2[state], repIndex - 2);
++    }
++  }
++  return price;
++}
++
++static UInt32 GetRepPrice(CLzmaEnc *p, UInt32 repIndex, UInt32 len, UInt32 state, UInt32 posState)
++{
++  return p->repLenEnc.prices[posState][len - LZMA_MATCH_LEN_MIN] +
++    GetPureRepPrice(p, repIndex, state, posState);
++}
++
++static UInt32 Backward(CLzmaEnc *p, UInt32 *backRes, UInt32 cur)
++{
++  UInt32 posMem = p->opt[cur].posPrev;
++  UInt32 backMem = p->opt[cur].backPrev;
++  p->optimumEndIndex = cur;
++  do
++  {
++    if (p->opt[cur].prev1IsChar)
++    {
++      MakeAsChar(&p->opt[posMem])
++      p->opt[posMem].posPrev = posMem - 1;
++      if (p->opt[cur].prev2)
++      {
++        p->opt[posMem - 1].prev1IsChar = False;
++        p->opt[posMem - 1].posPrev = p->opt[cur].posPrev2;
++        p->opt[posMem - 1].backPrev = p->opt[cur].backPrev2;
++      }
++    }
++    {
++      UInt32 posPrev = posMem;
++      UInt32 backCur = backMem;
++
++      backMem = p->opt[posPrev].backPrev;
++      posMem = p->opt[posPrev].posPrev;
++
++      p->opt[posPrev].backPrev = backCur;
++      p->opt[posPrev].posPrev = cur;
++      cur = posPrev;
++    }
++  }
++  while (cur != 0);
++  *backRes = p->opt[0].backPrev;
++  p->optimumCurrentIndex  = p->opt[0].posPrev;
++  return p->optimumCurrentIndex;
++}
++
++#define LIT_PROBS(pos, prevByte) (p->litProbs + ((((pos) & p->lpMask) << p->lc) + ((prevByte) >> (8 - p->lc))) * 0x300)
++
++static UInt32 GetOptimum(CLzmaEnc *p, UInt32 position, UInt32 *backRes)
++{
++  UInt32 numAvail, mainLen, numPairs, repMaxIndex, i, posState, lenEnd, len, cur;
++  UInt32 matchPrice, repMatchPrice, normalMatchPrice;
++  UInt32 reps[LZMA_NUM_REPS], repLens[LZMA_NUM_REPS];
++  UInt32 *matches;
++  const Byte *data;
++  Byte curByte, matchByte;
++  if (p->optimumEndIndex != p->optimumCurrentIndex)
++  {
++    const COptimal *opt = &p->opt[p->optimumCurrentIndex];
++    UInt32 lenRes = opt->posPrev - p->optimumCurrentIndex;
++    *backRes = opt->backPrev;
++    p->optimumCurrentIndex = opt->posPrev;
++    return lenRes;
++  }
++  p->optimumCurrentIndex = p->optimumEndIndex = 0;
++
++  if (p->additionalOffset == 0)
++    mainLen = ReadMatchDistances(p, &numPairs);
++  else
++  {
++    mainLen = p->longestMatchLength;
++    numPairs = p->numPairs;
++  }
++
++  numAvail = p->numAvail;
++  if (numAvail < 2)
++  {
++    *backRes = (UInt32)(-1);
++    return 1;
++  }
++  if (numAvail > LZMA_MATCH_LEN_MAX)
++    numAvail = LZMA_MATCH_LEN_MAX;
++
++  data = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - 1;
++  repMaxIndex = 0;
++  for (i = 0; i < LZMA_NUM_REPS; i++)
++  {
++    UInt32 lenTest;
++    const Byte *data2;
++    reps[i] = p->reps[i];
++    data2 = data - (reps[i] + 1);
++    if (data[0] != data2[0] || data[1] != data2[1])
++    {
++      repLens[i] = 0;
++      continue;
++    }
++    for (lenTest = 2; lenTest < numAvail && data[lenTest] == data2[lenTest]; lenTest++);
++    repLens[i] = lenTest;
++    if (lenTest > repLens[repMaxIndex])
++      repMaxIndex = i;
++  }
++  if (repLens[repMaxIndex] >= p->numFastBytes)
++  {
++    UInt32 lenRes;
++    *backRes = repMaxIndex;
++    lenRes = repLens[repMaxIndex];
++    MovePos(p, lenRes - 1);
++    return lenRes;
++  }
++
++  matches = p->matches;
++  if (mainLen >= p->numFastBytes)
++  {
++    *backRes = matches[numPairs - 1] + LZMA_NUM_REPS;
++    MovePos(p, mainLen - 1);
++    return mainLen;
++  }
++  curByte = *data;
++  matchByte = *(data - (reps[0] + 1));
++
++  if (mainLen < 2 && curByte != matchByte && repLens[repMaxIndex] < 2)
++  {
++    *backRes = (UInt32)-1;
++    return 1;
++  }
++
++  p->opt[0].state = (CState)p->state;
++
++  posState = (position & p->pbMask);
++
++  {
++    const CLzmaProb *probs = LIT_PROBS(position, *(data - 1));
++    p->opt[1].price = GET_PRICE_0(p->isMatch[p->state][posState]) +
++        (!IsCharState(p->state) ?
++          LitEnc_GetPriceMatched(probs, curByte, matchByte, p->ProbPrices) :
++          LitEnc_GetPrice(probs, curByte, p->ProbPrices));
++  }
++
++  MakeAsChar(&p->opt[1]);
++
++  matchPrice = GET_PRICE_1(p->isMatch[p->state][posState]);
++  repMatchPrice = matchPrice + GET_PRICE_1(p->isRep[p->state]);
++
++  if (matchByte == curByte)
++  {
++    UInt32 shortRepPrice = repMatchPrice + GetRepLen1Price(p, p->state, posState);
++    if (shortRepPrice < p->opt[1].price)
++    {
++      p->opt[1].price = shortRepPrice;
++      MakeAsShortRep(&p->opt[1]);
++    }
++  }
++  lenEnd = ((mainLen >= repLens[repMaxIndex]) ? mainLen : repLens[repMaxIndex]);
++
++  if (lenEnd < 2)
++  {
++    *backRes = p->opt[1].backPrev;
++    return 1;
++  }
++
++  p->opt[1].posPrev = 0;
++  for (i = 0; i < LZMA_NUM_REPS; i++)
++    p->opt[0].backs[i] = reps[i];
++
++  len = lenEnd;
++  do
++    p->opt[len--].price = kInfinityPrice;
++  while (len >= 2);
++
++  for (i = 0; i < LZMA_NUM_REPS; i++)
++  {
++    UInt32 repLen = repLens[i];
++    UInt32 price;
++    if (repLen < 2)
++      continue;
++    price = repMatchPrice + GetPureRepPrice(p, i, p->state, posState);
++    do
++    {
++      UInt32 curAndLenPrice = price + p->repLenEnc.prices[posState][repLen - 2];
++      COptimal *opt = &p->opt[repLen];
++      if (curAndLenPrice < opt->price)
++      {
++        opt->price = curAndLenPrice;
++        opt->posPrev = 0;
++        opt->backPrev = i;
++        opt->prev1IsChar = False;
++      }
++    }
++    while (--repLen >= 2);
++  }
++
++  normalMatchPrice = matchPrice + GET_PRICE_0(p->isRep[p->state]);
++
++  len = ((repLens[0] >= 2) ? repLens[0] + 1 : 2);
++  if (len <= mainLen)
++  {
++    UInt32 offs = 0;
++    while (len > matches[offs])
++      offs += 2;
++    for (; ; len++)
++    {
++      COptimal *opt;
++      UInt32 distance = matches[offs + 1];
++
++      UInt32 curAndLenPrice = normalMatchPrice + p->lenEnc.prices[posState][len - LZMA_MATCH_LEN_MIN];
++      UInt32 lenToPosState = GetLenToPosState(len);
++      if (distance < kNumFullDistances)
++        curAndLenPrice += p->distancesPrices[lenToPosState][distance];
++      else
++      {
++        UInt32 slot;
++        GetPosSlot2(distance, slot);
++        curAndLenPrice += p->alignPrices[distance & kAlignMask] + p->posSlotPrices[lenToPosState][slot];
++      }
++      opt = &p->opt[len];
++      if (curAndLenPrice < opt->price)
++      {
++        opt->price = curAndLenPrice;
++        opt->posPrev = 0;
++        opt->backPrev = distance + LZMA_NUM_REPS;
++        opt->prev1IsChar = False;
++      }
++      if (len == matches[offs])
++      {
++        offs += 2;
++        if (offs == numPairs)
++          break;
++      }
++    }
++  }
++
++  cur = 0;
++
++    #ifdef SHOW_STAT2
++    if (position >= 0)
++    {
++      unsigned i;
++      printf("\n pos = %4X", position);
++      for (i = cur; i <= lenEnd; i++)
++      printf("\nprice[%4X] = %d", position - cur + i, p->opt[i].price);
++    }
++    #endif
++
++  for (;;)
++  {
++    UInt32 numAvailFull, newLen, numPairs, posPrev, state, posState, startLen;
++    UInt32 curPrice, curAnd1Price, matchPrice, repMatchPrice;
++    Bool nextIsChar;
++    Byte curByte, matchByte;
++    const Byte *data;
++    COptimal *curOpt;
++    COptimal *nextOpt;
++
++    cur++;
++    if (cur == lenEnd)
++      return Backward(p, backRes, cur);
++
++    newLen = ReadMatchDistances(p, &numPairs);
++    if (newLen >= p->numFastBytes)
++    {
++      p->numPairs = numPairs;
++      p->longestMatchLength = newLen;
++      return Backward(p, backRes, cur);
++    }
++    position++;
++    curOpt = &p->opt[cur];
++    posPrev = curOpt->posPrev;
++    if (curOpt->prev1IsChar)
++    {
++      posPrev--;
++      if (curOpt->prev2)
++      {
++        state = p->opt[curOpt->posPrev2].state;
++        if (curOpt->backPrev2 < LZMA_NUM_REPS)
++          state = kRepNextStates[state];
++        else
++          state = kMatchNextStates[state];
++      }
++      else
++        state = p->opt[posPrev].state;
++      state = kLiteralNextStates[state];
++    }
++    else
++      state = p->opt[posPrev].state;
++    if (posPrev == cur - 1)
++    {
++      if (IsShortRep(curOpt))
++        state = kShortRepNextStates[state];
++      else
++        state = kLiteralNextStates[state];
++    }
++    else
++    {
++      UInt32 pos;
++      const COptimal *prevOpt;
++      if (curOpt->prev1IsChar && curOpt->prev2)
++      {
++        posPrev = curOpt->posPrev2;
++        pos = curOpt->backPrev2;
++        state = kRepNextStates[state];
++      }
++      else
++      {
++        pos = curOpt->backPrev;
++        if (pos < LZMA_NUM_REPS)
++          state = kRepNextStates[state];
++        else
++          state = kMatchNextStates[state];
++      }
++      prevOpt = &p->opt[posPrev];
++      if (pos < LZMA_NUM_REPS)
++      {
++        UInt32 i;
++        reps[0] = prevOpt->backs[pos];
++        for (i = 1; i <= pos; i++)
++          reps[i] = prevOpt->backs[i - 1];
++        for (; i < LZMA_NUM_REPS; i++)
++          reps[i] = prevOpt->backs[i];
++      }
++      else
++      {
++        UInt32 i;
++        reps[0] = (pos - LZMA_NUM_REPS);
++        for (i = 1; i < LZMA_NUM_REPS; i++)
++          reps[i] = prevOpt->backs[i - 1];
++      }
++    }
++    curOpt->state = (CState)state;
++
++    curOpt->backs[0] = reps[0];
++    curOpt->backs[1] = reps[1];
++    curOpt->backs[2] = reps[2];
++    curOpt->backs[3] = reps[3];
++
++    curPrice = curOpt->price;
++    nextIsChar = False;
++    data = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - 1;
++    curByte = *data;
++    matchByte = *(data - (reps[0] + 1));
++
++    posState = (position & p->pbMask);
++
++    curAnd1Price = curPrice + GET_PRICE_0(p->isMatch[state][posState]);
++    {
++      const CLzmaProb *probs = LIT_PROBS(position, *(data - 1));
++      curAnd1Price +=
++        (!IsCharState(state) ?
++          LitEnc_GetPriceMatched(probs, curByte, matchByte, p->ProbPrices) :
++          LitEnc_GetPrice(probs, curByte, p->ProbPrices));
++    }
++
++    nextOpt = &p->opt[cur + 1];
++
++    if (curAnd1Price < nextOpt->price)
++    {
++      nextOpt->price = curAnd1Price;
++      nextOpt->posPrev = cur;
++      MakeAsChar(nextOpt);
++      nextIsChar = True;
++    }
++
++    matchPrice = curPrice + GET_PRICE_1(p->isMatch[state][posState]);
++    repMatchPrice = matchPrice + GET_PRICE_1(p->isRep[state]);
++
++    if (matchByte == curByte && !(nextOpt->posPrev < cur && nextOpt->backPrev == 0))
++    {
++      UInt32 shortRepPrice = repMatchPrice + GetRepLen1Price(p, state, posState);
++      if (shortRepPrice <= nextOpt->price)
++      {
++        nextOpt->price = shortRepPrice;
++        nextOpt->posPrev = cur;
++        MakeAsShortRep(nextOpt);
++        nextIsChar = True;
++      }
++    }
++    numAvailFull = p->numAvail;
++    {
++      UInt32 temp = kNumOpts - 1 - cur;
++      if (temp < numAvailFull)
++        numAvailFull = temp;
++    }
++
++    if (numAvailFull < 2)
++      continue;
++    numAvail = (numAvailFull <= p->numFastBytes ? numAvailFull : p->numFastBytes);
++
++    if (!nextIsChar && matchByte != curByte) /* speed optimization */
++    {
++      /* try Literal + rep0 */
++      UInt32 temp;
++      UInt32 lenTest2;
++      const Byte *data2 = data - (reps[0] + 1);
++      UInt32 limit = p->numFastBytes + 1;
++      if (limit > numAvailFull)
++        limit = numAvailFull;
++
++      for (temp = 1; temp < limit && data[temp] == data2[temp]; temp++);
++      lenTest2 = temp - 1;
++      if (lenTest2 >= 2)
++      {
++        UInt32 state2 = kLiteralNextStates[state];
++        UInt32 posStateNext = (position + 1) & p->pbMask;
++        UInt32 nextRepMatchPrice = curAnd1Price +
++            GET_PRICE_1(p->isMatch[state2][posStateNext]) +
++            GET_PRICE_1(p->isRep[state2]);
++        /* for (; lenTest2 >= 2; lenTest2--) */
++        {
++          UInt32 curAndLenPrice;
++          COptimal *opt;
++          UInt32 offset = cur + 1 + lenTest2;
++          while (lenEnd < offset)
++            p->opt[++lenEnd].price = kInfinityPrice;
++          curAndLenPrice = nextRepMatchPrice + GetRepPrice(p, 0, lenTest2, state2, posStateNext);
++          opt = &p->opt[offset];
++          if (curAndLenPrice < opt->price)
++          {
++            opt->price = curAndLenPrice;
++            opt->posPrev = cur + 1;
++            opt->backPrev = 0;
++            opt->prev1IsChar = True;
++            opt->prev2 = False;
++          }
++        }
++      }
++    }
++
++    startLen = 2; /* speed optimization */
++    {
++    UInt32 repIndex;
++    for (repIndex = 0; repIndex < LZMA_NUM_REPS; repIndex++)
++    {
++      UInt32 lenTest;
++      UInt32 lenTestTemp;
++      UInt32 price;
++      const Byte *data2 = data - (reps[repIndex] + 1);
++      if (data[0] != data2[0] || data[1] != data2[1])
++        continue;
++      for (lenTest = 2; lenTest < numAvail && data[lenTest] == data2[lenTest]; lenTest++);
++      while (lenEnd < cur + lenTest)
++        p->opt[++lenEnd].price = kInfinityPrice;
++      lenTestTemp = lenTest;
++      price = repMatchPrice + GetPureRepPrice(p, repIndex, state, posState);
++      do
++      {
++        UInt32 curAndLenPrice = price + p->repLenEnc.prices[posState][lenTest - 2];
++        COptimal *opt = &p->opt[cur + lenTest];
++        if (curAndLenPrice < opt->price)
++        {
++          opt->price = curAndLenPrice;
++          opt->posPrev = cur;
++          opt->backPrev = repIndex;
++          opt->prev1IsChar = False;
++        }
++      }
++      while (--lenTest >= 2);
++      lenTest = lenTestTemp;
++
++      if (repIndex == 0)
++        startLen = lenTest + 1;
++
++      /* if (_maxMode) */
++        {
++          UInt32 lenTest2 = lenTest + 1;
++          UInt32 limit = lenTest2 + p->numFastBytes;
++          UInt32 nextRepMatchPrice;
++          if (limit > numAvailFull)
++            limit = numAvailFull;
++          for (; lenTest2 < limit && data[lenTest2] == data2[lenTest2]; lenTest2++);
++          lenTest2 -= lenTest + 1;
++          if (lenTest2 >= 2)
++          {
++            UInt32 state2 = kRepNextStates[state];
++            UInt32 posStateNext = (position + lenTest) & p->pbMask;
++            UInt32 curAndLenCharPrice =
++                price + p->repLenEnc.prices[posState][lenTest - 2] +
++                GET_PRICE_0(p->isMatch[state2][posStateNext]) +
++                LitEnc_GetPriceMatched(LIT_PROBS(position + lenTest, data[lenTest - 1]),
++                    data[lenTest], data2[lenTest], p->ProbPrices);
++            state2 = kLiteralNextStates[state2];
++            posStateNext = (position + lenTest + 1) & p->pbMask;
++            nextRepMatchPrice = curAndLenCharPrice +
++                GET_PRICE_1(p->isMatch[state2][posStateNext]) +
++                GET_PRICE_1(p->isRep[state2]);
++
++            /* for (; lenTest2 >= 2; lenTest2--) */
++            {
++              UInt32 curAndLenPrice;
++              COptimal *opt;
++              UInt32 offset = cur + lenTest + 1 + lenTest2;
++              while (lenEnd < offset)
++                p->opt[++lenEnd].price = kInfinityPrice;
++              curAndLenPrice = nextRepMatchPrice + GetRepPrice(p, 0, lenTest2, state2, posStateNext);
++              opt = &p->opt[offset];
++              if (curAndLenPrice < opt->price)
++              {
++                opt->price = curAndLenPrice;
++                opt->posPrev = cur + lenTest + 1;
++                opt->backPrev = 0;
++                opt->prev1IsChar = True;
++                opt->prev2 = True;
++                opt->posPrev2 = cur;
++                opt->backPrev2 = repIndex;
++              }
++            }
++          }
++        }
++    }
++    }
++    /* for (UInt32 lenTest = 2; lenTest <= newLen; lenTest++) */
++    if (newLen > numAvail)
++    {
++      newLen = numAvail;
++      for (numPairs = 0; newLen > matches[numPairs]; numPairs += 2);
++      matches[numPairs] = newLen;
++      numPairs += 2;
++    }
++    if (newLen >= startLen)
++    {
++      UInt32 normalMatchPrice = matchPrice + GET_PRICE_0(p->isRep[state]);
++      UInt32 offs, curBack, posSlot;
++      UInt32 lenTest;
++      while (lenEnd < cur + newLen)
++        p->opt[++lenEnd].price = kInfinityPrice;
++
++      offs = 0;
++      while (startLen > matches[offs])
++        offs += 2;
++      curBack = matches[offs + 1];
++      GetPosSlot2(curBack, posSlot);
++      for (lenTest = /*2*/ startLen; ; lenTest++)
++      {
++        UInt32 curAndLenPrice = normalMatchPrice + p->lenEnc.prices[posState][lenTest - LZMA_MATCH_LEN_MIN];
++        UInt32 lenToPosState = GetLenToPosState(lenTest);
++        COptimal *opt;
++        if (curBack < kNumFullDistances)
++          curAndLenPrice += p->distancesPrices[lenToPosState][curBack];
++        else
++          curAndLenPrice += p->posSlotPrices[lenToPosState][posSlot] + p->alignPrices[curBack & kAlignMask];
++
++        opt = &p->opt[cur + lenTest];
++        if (curAndLenPrice < opt->price)
++        {
++          opt->price = curAndLenPrice;
++          opt->posPrev = cur;
++          opt->backPrev = curBack + LZMA_NUM_REPS;
++          opt->prev1IsChar = False;
++        }
++
++        if (/*_maxMode && */lenTest == matches[offs])
++        {
++          /* Try Match + Literal + Rep0 */
++          const Byte *data2 = data - (curBack + 1);
++          UInt32 lenTest2 = lenTest + 1;
++          UInt32 limit = lenTest2 + p->numFastBytes;
++          UInt32 nextRepMatchPrice;
++          if (limit > numAvailFull)
++            limit = numAvailFull;
++          for (; lenTest2 < limit && data[lenTest2] == data2[lenTest2]; lenTest2++);
++          lenTest2 -= lenTest + 1;
++          if (lenTest2 >= 2)
++          {
++            UInt32 state2 = kMatchNextStates[state];
++            UInt32 posStateNext = (position + lenTest) & p->pbMask;
++            UInt32 curAndLenCharPrice = curAndLenPrice +
++                GET_PRICE_0(p->isMatch[state2][posStateNext]) +
++                LitEnc_GetPriceMatched(LIT_PROBS(position + lenTest, data[lenTest - 1]),
++                    data[lenTest], data2[lenTest], p->ProbPrices);
++            state2 = kLiteralNextStates[state2];
++            posStateNext = (posStateNext + 1) & p->pbMask;
++            nextRepMatchPrice = curAndLenCharPrice +
++                GET_PRICE_1(p->isMatch[state2][posStateNext]) +
++                GET_PRICE_1(p->isRep[state2]);
++
++            /* for (; lenTest2 >= 2; lenTest2--) */
++            {
++              UInt32 offset = cur + lenTest + 1 + lenTest2;
++              UInt32 curAndLenPrice;
++              COptimal *opt;
++              while (lenEnd < offset)
++                p->opt[++lenEnd].price = kInfinityPrice;
++              curAndLenPrice = nextRepMatchPrice + GetRepPrice(p, 0, lenTest2, state2, posStateNext);
++              opt = &p->opt[offset];
++              if (curAndLenPrice < opt->price)
++              {
++                opt->price = curAndLenPrice;
++                opt->posPrev = cur + lenTest + 1;
++                opt->backPrev = 0;
++                opt->prev1IsChar = True;
++                opt->prev2 = True;
++                opt->posPrev2 = cur;
++                opt->backPrev2 = curBack + LZMA_NUM_REPS;
++              }
++            }
++          }
++          offs += 2;
++          if (offs == numPairs)
++            break;
++          curBack = matches[offs + 1];
++          if (curBack >= kNumFullDistances)
++            GetPosSlot2(curBack, posSlot);
++        }
++      }
++    }
++  }
++}
++
++#define ChangePair(smallDist, bigDist) (((bigDist) >> 7) > (smallDist))
++
++static UInt32 GetOptimumFast(CLzmaEnc *p, UInt32 *backRes)
++{
++  UInt32 numAvail, mainLen, mainDist, numPairs, repIndex, repLen, i;
++  const Byte *data;
++  const UInt32 *matches;
++
++  if (p->additionalOffset == 0)
++    mainLen = ReadMatchDistances(p, &numPairs);
++  else
++  {
++    mainLen = p->longestMatchLength;
++    numPairs = p->numPairs;
++  }
++
++  numAvail = p->numAvail;
++  *backRes = (UInt32)-1;
++  if (numAvail < 2)
++    return 1;
++  if (numAvail > LZMA_MATCH_LEN_MAX)
++    numAvail = LZMA_MATCH_LEN_MAX;
++  data = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - 1;
++
++  repLen = repIndex = 0;
++  for (i = 0; i < LZMA_NUM_REPS; i++)
++  {
++    UInt32 len;
++    const Byte *data2 = data - (p->reps[i] + 1);
++    if (data[0] != data2[0] || data[1] != data2[1])
++      continue;
++    for (len = 2; len < numAvail && data[len] == data2[len]; len++);
++    if (len >= p->numFastBytes)
++    {
++      *backRes = i;
++      MovePos(p, len - 1);
++      return len;
++    }
++    if (len > repLen)
++    {
++      repIndex = i;
++      repLen = len;
++    }
++  }
++
++  matches = p->matches;
++  if (mainLen >= p->numFastBytes)
++  {
++    *backRes = matches[numPairs - 1] + LZMA_NUM_REPS;
++    MovePos(p, mainLen - 1);
++    return mainLen;
++  }
++
++  mainDist = 0; /* for GCC */
++  if (mainLen >= 2)
++  {
++    mainDist = matches[numPairs - 1];
++    while (numPairs > 2 && mainLen == matches[numPairs - 4] + 1)
++    {
++      if (!ChangePair(matches[numPairs - 3], mainDist))
++        break;
++      numPairs -= 2;
++      mainLen = matches[numPairs - 2];
++      mainDist = matches[numPairs - 1];
++    }
++    if (mainLen == 2 && mainDist >= 0x80)
++      mainLen = 1;
++  }
++
++  if (repLen >= 2 && (
++        (repLen + 1 >= mainLen) ||
++        (repLen + 2 >= mainLen && mainDist >= (1 << 9)) ||
++        (repLen + 3 >= mainLen && mainDist >= (1 << 15))))
++  {
++    *backRes = repIndex;
++    MovePos(p, repLen - 1);
++    return repLen;
++  }
++
++  if (mainLen < 2 || numAvail <= 2)
++    return 1;
++
++  p->longestMatchLength = ReadMatchDistances(p, &p->numPairs);
++  if (p->longestMatchLength >= 2)
++  {
++    UInt32 newDistance = matches[p->numPairs - 1];
++    if ((p->longestMatchLength >= mainLen && newDistance < mainDist) ||
++        (p->longestMatchLength == mainLen + 1 && !ChangePair(mainDist, newDistance)) ||
++        (p->longestMatchLength > mainLen + 1) ||
++        (p->longestMatchLength + 1 >= mainLen && mainLen >= 3 && ChangePair(newDistance, mainDist)))
++      return 1;
++  }
++
++  data = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - 1;
++  for (i = 0; i < LZMA_NUM_REPS; i++)
++  {
++    UInt32 len, limit;
++    const Byte *data2 = data - (p->reps[i] + 1);
++    if (data[0] != data2[0] || data[1] != data2[1])
++      continue;
++    limit = mainLen - 1;
++    for (len = 2; len < limit && data[len] == data2[len]; len++);
++    if (len >= limit)
++      return 1;
++  }
++  *backRes = mainDist + LZMA_NUM_REPS;
++  MovePos(p, mainLen - 2);
++  return mainLen;
++}
++
++static void WriteEndMarker(CLzmaEnc *p, UInt32 posState)
++{
++  UInt32 len;
++  RangeEnc_EncodeBit(&p->rc, &p->isMatch[p->state][posState], 1);
++  RangeEnc_EncodeBit(&p->rc, &p->isRep[p->state], 0);
++  p->state = kMatchNextStates[p->state];
++  len = LZMA_MATCH_LEN_MIN;
++  LenEnc_Encode2(&p->lenEnc, &p->rc, len - LZMA_MATCH_LEN_MIN, posState, !p->fastMode, p->ProbPrices);
++  RcTree_Encode(&p->rc, p->posSlotEncoder[GetLenToPosState(len)], kNumPosSlotBits, (1 << kNumPosSlotBits) - 1);
++  RangeEnc_EncodeDirectBits(&p->rc, (((UInt32)1 << 30) - 1) >> kNumAlignBits, 30 - kNumAlignBits);
++  RcTree_ReverseEncode(&p->rc, p->posAlignEncoder, kNumAlignBits, kAlignMask);
++}
++
++static SRes CheckErrors(CLzmaEnc *p)
++{
++  if (p->result != SZ_OK)
++    return p->result;
++  if (p->rc.res != SZ_OK)
++    p->result = SZ_ERROR_WRITE;
++  if (p->matchFinderBase.result != SZ_OK)
++    p->result = SZ_ERROR_READ;
++  if (p->result != SZ_OK)
++    p->finished = True;
++  return p->result;
++}
++
++static SRes Flush(CLzmaEnc *p, UInt32 nowPos)
++{
++  /* ReleaseMFStream(); */
++  p->finished = True;
++  if (p->writeEndMark)
++    WriteEndMarker(p, nowPos & p->pbMask);
++  RangeEnc_FlushData(&p->rc);
++  RangeEnc_FlushStream(&p->rc);
++  return CheckErrors(p);
++}
++
++static void FillAlignPrices(CLzmaEnc *p)
++{
++  UInt32 i;
++  for (i = 0; i < kAlignTableSize; i++)
++    p->alignPrices[i] = RcTree_ReverseGetPrice(p->posAlignEncoder, kNumAlignBits, i, p->ProbPrices);
++  p->alignPriceCount = 0;
++}
++
++static void FillDistancesPrices(CLzmaEnc *p)
++{
++  UInt32 tempPrices[kNumFullDistances];
++  UInt32 i, lenToPosState;
++  for (i = kStartPosModelIndex; i < kNumFullDistances; i++)
++  {
++    UInt32 posSlot = GetPosSlot1(i);
++    UInt32 footerBits = ((posSlot >> 1) - 1);
++    UInt32 base = ((2 | (posSlot & 1)) << footerBits);
++    tempPrices[i] = RcTree_ReverseGetPrice(p->posEncoders + base - posSlot - 1, footerBits, i - base, p->ProbPrices);
++  }
++
++  for (lenToPosState = 0; lenToPosState < kNumLenToPosStates; lenToPosState++)
++  {
++    UInt32 posSlot;
++    const CLzmaProb *encoder = p->posSlotEncoder[lenToPosState];
++    UInt32 *posSlotPrices = p->posSlotPrices[lenToPosState];
++    for (posSlot = 0; posSlot < p->distTableSize; posSlot++)
++      posSlotPrices[posSlot] = RcTree_GetPrice(encoder, kNumPosSlotBits, posSlot, p->ProbPrices);
++    for (posSlot = kEndPosModelIndex; posSlot < p->distTableSize; posSlot++)
++      posSlotPrices[posSlot] += ((((posSlot >> 1) - 1) - kNumAlignBits) << kNumBitPriceShiftBits);
++
++    {
++      UInt32 *distancesPrices = p->distancesPrices[lenToPosState];
++      UInt32 i;
++      for (i = 0; i < kStartPosModelIndex; i++)
++        distancesPrices[i] = posSlotPrices[i];
++      for (; i < kNumFullDistances; i++)
++        distancesPrices[i] = posSlotPrices[GetPosSlot1(i)] + tempPrices[i];
++    }
++  }
++  p->matchPriceCount = 0;
++}
++
++void LzmaEnc_Construct(CLzmaEnc *p)
++{
++  RangeEnc_Construct(&p->rc);
++  MatchFinder_Construct(&p->matchFinderBase);
++  #ifndef _7ZIP_ST
++  MatchFinderMt_Construct(&p->matchFinderMt);
++  p->matchFinderMt.MatchFinder = &p->matchFinderBase;
++  #endif
++
++  {
++    CLzmaEncProps props;
++    LzmaEncProps_Init(&props);
++    LzmaEnc_SetProps(p, &props);
++  }
++
++  #ifndef LZMA_LOG_BSR
++  LzmaEnc_FastPosInit(p->g_FastPos);
++  #endif
++
++  LzmaEnc_InitPriceTables(p->ProbPrices);
++  p->litProbs = 0;
++  p->saveState.litProbs = 0;
++}
++
++CLzmaEncHandle LzmaEnc_Create(ISzAlloc *alloc)
++{
++  void *p;
++  p = alloc->Alloc(alloc, sizeof(CLzmaEnc));
++  if (p != 0)
++    LzmaEnc_Construct((CLzmaEnc *)p);
++  return p;
++}
++
++void LzmaEnc_FreeLits(CLzmaEnc *p, ISzAlloc *alloc)
++{
++  alloc->Free(alloc, p->litProbs);
++  alloc->Free(alloc, p->saveState.litProbs);
++  p->litProbs = 0;
++  p->saveState.litProbs = 0;
++}
++
++void LzmaEnc_Destruct(CLzmaEnc *p, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  #ifndef _7ZIP_ST
++  MatchFinderMt_Destruct(&p->matchFinderMt, allocBig);
++  #endif
++  MatchFinder_Free(&p->matchFinderBase, allocBig);
++  LzmaEnc_FreeLits(p, alloc);
++  RangeEnc_Free(&p->rc, alloc);
++}
++
++void LzmaEnc_Destroy(CLzmaEncHandle p, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  LzmaEnc_Destruct((CLzmaEnc *)p, alloc, allocBig);
++  alloc->Free(alloc, p);
++}
++
++static SRes LzmaEnc_CodeOneBlock(CLzmaEnc *p, Bool useLimits, UInt32 maxPackSize, UInt32 maxUnpackSize)
++{
++  UInt32 nowPos32, startPos32;
++  if (p->needInit)
++  {
++    p->matchFinder.Init(p->matchFinderObj);
++    p->needInit = 0;
++  }
++
++  if (p->finished)
++    return p->result;
++  RINOK(CheckErrors(p));
++
++  nowPos32 = (UInt32)p->nowPos64;
++  startPos32 = nowPos32;
++
++  if (p->nowPos64 == 0)
++  {
++    UInt32 numPairs;
++    Byte curByte;
++    if (p->matchFinder.GetNumAvailableBytes(p->matchFinderObj) == 0)
++      return Flush(p, nowPos32);
++    ReadMatchDistances(p, &numPairs);
++    RangeEnc_EncodeBit(&p->rc, &p->isMatch[p->state][0], 0);
++    p->state = kLiteralNextStates[p->state];
++    curByte = p->matchFinder.GetIndexByte(p->matchFinderObj, 0 - p->additionalOffset);
++    LitEnc_Encode(&p->rc, p->litProbs, curByte);
++    p->additionalOffset--;
++    nowPos32++;
++  }
++
++  if (p->matchFinder.GetNumAvailableBytes(p->matchFinderObj) != 0)
++  for (;;)
++  {
++    UInt32 pos, len, posState;
++
++    if (p->fastMode)
++      len = GetOptimumFast(p, &pos);
++    else
++      len = GetOptimum(p, nowPos32, &pos);
++
++    #ifdef SHOW_STAT2
++    printf("\n pos = %4X,   len = %d   pos = %d", nowPos32, len, pos);
++    #endif
++
++    posState = nowPos32 & p->pbMask;
++    if (len == 1 && pos == (UInt32)-1)
++    {
++      Byte curByte;
++      CLzmaProb *probs;
++      const Byte *data;
++
++      RangeEnc_EncodeBit(&p->rc, &p->isMatch[p->state][posState], 0);
++      data = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - p->additionalOffset;
++      curByte = *data;
++      probs = LIT_PROBS(nowPos32, *(data - 1));
++      if (IsCharState(p->state))
++        LitEnc_Encode(&p->rc, probs, curByte);
++      else
++        LitEnc_EncodeMatched(&p->rc, probs, curByte, *(data - p->reps[0] - 1));
++      p->state = kLiteralNextStates[p->state];
++    }
++    else
++    {
++      RangeEnc_EncodeBit(&p->rc, &p->isMatch[p->state][posState], 1);
++      if (pos < LZMA_NUM_REPS)
++      {
++        RangeEnc_EncodeBit(&p->rc, &p->isRep[p->state], 1);
++        if (pos == 0)
++        {
++          RangeEnc_EncodeBit(&p->rc, &p->isRepG0[p->state], 0);
++          RangeEnc_EncodeBit(&p->rc, &p->isRep0Long[p->state][posState], ((len == 1) ? 0 : 1));
++        }
++        else
++        {
++          UInt32 distance = p->reps[pos];
++          RangeEnc_EncodeBit(&p->rc, &p->isRepG0[p->state], 1);
++          if (pos == 1)
++            RangeEnc_EncodeBit(&p->rc, &p->isRepG1[p->state], 0);
++          else
++          {
++            RangeEnc_EncodeBit(&p->rc, &p->isRepG1[p->state], 1);
++            RangeEnc_EncodeBit(&p->rc, &p->isRepG2[p->state], pos - 2);
++            if (pos == 3)
++              p->reps[3] = p->reps[2];
++            p->reps[2] = p->reps[1];
++          }
++          p->reps[1] = p->reps[0];
++          p->reps[0] = distance;
++        }
++        if (len == 1)
++          p->state = kShortRepNextStates[p->state];
++        else
++        {
++          LenEnc_Encode2(&p->repLenEnc, &p->rc, len - LZMA_MATCH_LEN_MIN, posState, !p->fastMode, p->ProbPrices);
++          p->state = kRepNextStates[p->state];
++        }
++      }
++      else
++      {
++        UInt32 posSlot;
++        RangeEnc_EncodeBit(&p->rc, &p->isRep[p->state], 0);
++        p->state = kMatchNextStates[p->state];
++        LenEnc_Encode2(&p->lenEnc, &p->rc, len - LZMA_MATCH_LEN_MIN, posState, !p->fastMode, p->ProbPrices);
++        pos -= LZMA_NUM_REPS;
++        GetPosSlot(pos, posSlot);
++        RcTree_Encode(&p->rc, p->posSlotEncoder[GetLenToPosState(len)], kNumPosSlotBits, posSlot);
++
++        if (posSlot >= kStartPosModelIndex)
++        {
++          UInt32 footerBits = ((posSlot >> 1) - 1);
++          UInt32 base = ((2 | (posSlot & 1)) << footerBits);
++          UInt32 posReduced = pos - base;
++
++          if (posSlot < kEndPosModelIndex)
++            RcTree_ReverseEncode(&p->rc, p->posEncoders + base - posSlot - 1, footerBits, posReduced);
++          else
++          {
++            RangeEnc_EncodeDirectBits(&p->rc, posReduced >> kNumAlignBits, footerBits - kNumAlignBits);
++            RcTree_ReverseEncode(&p->rc, p->posAlignEncoder, kNumAlignBits, posReduced & kAlignMask);
++            p->alignPriceCount++;
++          }
++        }
++        p->reps[3] = p->reps[2];
++        p->reps[2] = p->reps[1];
++        p->reps[1] = p->reps[0];
++        p->reps[0] = pos;
++        p->matchPriceCount++;
++      }
++    }
++    p->additionalOffset -= len;
++    nowPos32 += len;
++    if (p->additionalOffset == 0)
++    {
++      UInt32 processed;
++      if (!p->fastMode)
++      {
++        if (p->matchPriceCount >= (1 << 7))
++          FillDistancesPrices(p);
++        if (p->alignPriceCount >= kAlignTableSize)
++          FillAlignPrices(p);
++      }
++      if (p->matchFinder.GetNumAvailableBytes(p->matchFinderObj) == 0)
++        break;
++      processed = nowPos32 - startPos32;
++      if (useLimits)
++      {
++        if (processed + kNumOpts + 300 >= maxUnpackSize ||
++            RangeEnc_GetProcessed(&p->rc) + kNumOpts * 2 >= maxPackSize)
++          break;
++      }
++      else if (processed >= (1 << 15))
++      {
++        p->nowPos64 += nowPos32 - startPos32;
++        return CheckErrors(p);
++      }
++    }
++  }
++  p->nowPos64 += nowPos32 - startPos32;
++  return Flush(p, nowPos32);
++}
++
++#define kBigHashDicLimit ((UInt32)1 << 24)
++
++static SRes LzmaEnc_Alloc(CLzmaEnc *p, UInt32 keepWindowSize, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  UInt32 beforeSize = kNumOpts;
++  Bool btMode;
++  if (!RangeEnc_Alloc(&p->rc, alloc))
++    return SZ_ERROR_MEM;
++  btMode = (p->matchFinderBase.btMode != 0);
++  #ifndef _7ZIP_ST
++  p->mtMode = (p->multiThread && !p->fastMode && btMode);
++  #endif
++
++  {
++    unsigned lclp = p->lc + p->lp;
++    if (p->litProbs == 0 || p->saveState.litProbs == 0 || p->lclp != lclp)
++    {
++      LzmaEnc_FreeLits(p, alloc);
++      p->litProbs = (CLzmaProb *)alloc->Alloc(alloc, (0x300 << lclp) * sizeof(CLzmaProb));
++      p->saveState.litProbs = (CLzmaProb *)alloc->Alloc(alloc, (0x300 << lclp) * sizeof(CLzmaProb));
++      if (p->litProbs == 0 || p->saveState.litProbs == 0)
++      {
++        LzmaEnc_FreeLits(p, alloc);
++        return SZ_ERROR_MEM;
++      }
++      p->lclp = lclp;
++    }
++  }
++
++  p->matchFinderBase.bigHash = (p->dictSize > kBigHashDicLimit);
++
++  if (beforeSize + p->dictSize < keepWindowSize)
++    beforeSize = keepWindowSize - p->dictSize;
++
++  #ifndef _7ZIP_ST
++  if (p->mtMode)
++  {
++    RINOK(MatchFinderMt_Create(&p->matchFinderMt, p->dictSize, beforeSize, p->numFastBytes, LZMA_MATCH_LEN_MAX, allocBig));
++    p->matchFinderObj = &p->matchFinderMt;
++    MatchFinderMt_CreateVTable(&p->matchFinderMt, &p->matchFinder);
++  }
++  else
++  #endif
++  {
++    if (!MatchFinder_Create(&p->matchFinderBase, p->dictSize, beforeSize, p->numFastBytes, LZMA_MATCH_LEN_MAX, allocBig))
++      return SZ_ERROR_MEM;
++    p->matchFinderObj = &p->matchFinderBase;
++    MatchFinder_CreateVTable(&p->matchFinderBase, &p->matchFinder);
++  }
++  return SZ_OK;
++}
++
++void LzmaEnc_Init(CLzmaEnc *p)
++{
++  UInt32 i;
++  p->state = 0;
++  for (i = 0 ; i < LZMA_NUM_REPS; i++)
++    p->reps[i] = 0;
++
++  RangeEnc_Init(&p->rc);
++
++
++  for (i = 0; i < kNumStates; i++)
++  {
++    UInt32 j;
++    for (j = 0; j < LZMA_NUM_PB_STATES_MAX; j++)
++    {
++      p->isMatch[i][j] = kProbInitValue;
++      p->isRep0Long[i][j] = kProbInitValue;
++    }
++    p->isRep[i] = kProbInitValue;
++    p->isRepG0[i] = kProbInitValue;
++    p->isRepG1[i] = kProbInitValue;
++    p->isRepG2[i] = kProbInitValue;
++  }
++
++  {
++    UInt32 num = 0x300 << (p->lp + p->lc);
++    for (i = 0; i < num; i++)
++      p->litProbs[i] = kProbInitValue;
++  }
++
++  {
++    for (i = 0; i < kNumLenToPosStates; i++)
++    {
++      CLzmaProb *probs = p->posSlotEncoder[i];
++      UInt32 j;
++      for (j = 0; j < (1 << kNumPosSlotBits); j++)
++        probs[j] = kProbInitValue;
++    }
++  }
++  {
++    for (i = 0; i < kNumFullDistances - kEndPosModelIndex; i++)
++      p->posEncoders[i] = kProbInitValue;
++  }
++
++  LenEnc_Init(&p->lenEnc.p);
++  LenEnc_Init(&p->repLenEnc.p);
++
++  for (i = 0; i < (1 << kNumAlignBits); i++)
++    p->posAlignEncoder[i] = kProbInitValue;
++
++  p->optimumEndIndex = 0;
++  p->optimumCurrentIndex = 0;
++  p->additionalOffset = 0;
++
++  p->pbMask = (1 << p->pb) - 1;
++  p->lpMask = (1 << p->lp) - 1;
++}
++
++void LzmaEnc_InitPrices(CLzmaEnc *p)
++{
++  if (!p->fastMode)
++  {
++    FillDistancesPrices(p);
++    FillAlignPrices(p);
++  }
++
++  p->lenEnc.tableSize =
++  p->repLenEnc.tableSize =
++      p->numFastBytes + 1 - LZMA_MATCH_LEN_MIN;
++  LenPriceEnc_UpdateTables(&p->lenEnc, 1 << p->pb, p->ProbPrices);
++  LenPriceEnc_UpdateTables(&p->repLenEnc, 1 << p->pb, p->ProbPrices);
++}
++
++static SRes LzmaEnc_AllocAndInit(CLzmaEnc *p, UInt32 keepWindowSize, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  UInt32 i;
++  for (i = 0; i < (UInt32)kDicLogSizeMaxCompress; i++)
++    if (p->dictSize <= ((UInt32)1 << i))
++      break;
++  p->distTableSize = i * 2;
++
++  p->finished = False;
++  p->result = SZ_OK;
++  RINOK(LzmaEnc_Alloc(p, keepWindowSize, alloc, allocBig));
++  LzmaEnc_Init(p);
++  LzmaEnc_InitPrices(p);
++  p->nowPos64 = 0;
++  return SZ_OK;
++}
++
++static SRes LzmaEnc_Prepare(CLzmaEncHandle pp, ISeqOutStream *outStream, ISeqInStream *inStream,
++    ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  p->matchFinderBase.stream = inStream;
++  p->needInit = 1;
++  p->rc.outStream = outStream;
++  return LzmaEnc_AllocAndInit(p, 0, alloc, allocBig);
++}
++
++SRes LzmaEnc_PrepareForLzma2(CLzmaEncHandle pp,
++    ISeqInStream *inStream, UInt32 keepWindowSize,
++    ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  p->matchFinderBase.stream = inStream;
++  p->needInit = 1;
++  return LzmaEnc_AllocAndInit(p, keepWindowSize, alloc, allocBig);
++}
++
++static void LzmaEnc_SetInputBuf(CLzmaEnc *p, const Byte *src, SizeT srcLen)
++{
++  p->matchFinderBase.directInput = 1;
++  p->matchFinderBase.bufferBase = (Byte *)src;
++  p->matchFinderBase.directInputRem = srcLen;
++}
++
++SRes LzmaEnc_MemPrepare(CLzmaEncHandle pp, const Byte *src, SizeT srcLen,
++    UInt32 keepWindowSize, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  LzmaEnc_SetInputBuf(p, src, srcLen);
++  p->needInit = 1;
++
++  return LzmaEnc_AllocAndInit(p, keepWindowSize, alloc, allocBig);
++}
++
++void LzmaEnc_Finish(CLzmaEncHandle pp)
++{
++  #ifndef _7ZIP_ST
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  if (p->mtMode)
++    MatchFinderMt_ReleaseStream(&p->matchFinderMt);
++  #else
++  pp = pp;
++  #endif
++}
++
++typedef struct
++{
++  ISeqOutStream funcTable;
++  Byte *data;
++  SizeT rem;
++  Bool overflow;
++} CSeqOutStreamBuf;
++
++static size_t MyWrite(void *pp, const void *data, size_t size)
++{
++  CSeqOutStreamBuf *p = (CSeqOutStreamBuf *)pp;
++  if (p->rem < size)
++  {
++    size = p->rem;
++    p->overflow = True;
++  }
++  memcpy(p->data, data, size);
++  p->rem -= size;
++  p->data += size;
++  return size;
++}
++
++
++UInt32 LzmaEnc_GetNumAvailableBytes(CLzmaEncHandle pp)
++{
++  const CLzmaEnc *p = (CLzmaEnc *)pp;
++  return p->matchFinder.GetNumAvailableBytes(p->matchFinderObj);
++}
++
++const Byte *LzmaEnc_GetCurBuf(CLzmaEncHandle pp)
++{
++  const CLzmaEnc *p = (CLzmaEnc *)pp;
++  return p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - p->additionalOffset;
++}
++
++SRes LzmaEnc_CodeOneMemBlock(CLzmaEncHandle pp, Bool reInit,
++    Byte *dest, size_t *destLen, UInt32 desiredPackSize, UInt32 *unpackSize)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  UInt64 nowPos64;
++  SRes res;
++  CSeqOutStreamBuf outStream;
++
++  outStream.funcTable.Write = MyWrite;
++  outStream.data = dest;
++  outStream.rem = *destLen;
++  outStream.overflow = False;
++
++  p->writeEndMark = False;
++  p->finished = False;
++  p->result = SZ_OK;
++
++  if (reInit)
++    LzmaEnc_Init(p);
++  LzmaEnc_InitPrices(p);
++  nowPos64 = p->nowPos64;
++  RangeEnc_Init(&p->rc);
++  p->rc.outStream = &outStream.funcTable;
++
++  res = LzmaEnc_CodeOneBlock(p, True, desiredPackSize, *unpackSize);
++
++  *unpackSize = (UInt32)(p->nowPos64 - nowPos64);
++  *destLen -= outStream.rem;
++  if (outStream.overflow)
++    return SZ_ERROR_OUTPUT_EOF;
++
++  return res;
++}
++
++static SRes LzmaEnc_Encode2(CLzmaEnc *p, ICompressProgress *progress)
++{
++  SRes res = SZ_OK;
++
++  #ifndef _7ZIP_ST
++  Byte allocaDummy[0x300];
++  int i = 0;
++  for (i = 0; i < 16; i++)
++    allocaDummy[i] = (Byte)i;
++  #endif
++
++  for (;;)
++  {
++    res = LzmaEnc_CodeOneBlock(p, False, 0, 0);
++    if (res != SZ_OK || p->finished != 0)
++      break;
++    if (progress != 0)
++    {
++      res = progress->Progress(progress, p->nowPos64, RangeEnc_GetProcessed(&p->rc));
++      if (res != SZ_OK)
++      {
++        res = SZ_ERROR_PROGRESS;
++        break;
++      }
++    }
++  }
++  LzmaEnc_Finish(p);
++  return res;
++}
++
++SRes LzmaEnc_Encode(CLzmaEncHandle pp, ISeqOutStream *outStream, ISeqInStream *inStream, ICompressProgress *progress,
++    ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  RINOK(LzmaEnc_Prepare(pp, outStream, inStream, alloc, allocBig));
++  return LzmaEnc_Encode2((CLzmaEnc *)pp, progress);
++}
++
++SRes LzmaEnc_WriteProperties(CLzmaEncHandle pp, Byte *props, SizeT *size)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  int i;
++  UInt32 dictSize = p->dictSize;
++  if (*size < LZMA_PROPS_SIZE)
++    return SZ_ERROR_PARAM;
++  *size = LZMA_PROPS_SIZE;
++  props[0] = (Byte)((p->pb * 5 + p->lp) * 9 + p->lc);
++
++  for (i = 11; i <= 30; i++)
++  {
++    if (dictSize <= ((UInt32)2 << i))
++    {
++      dictSize = (2 << i);
++      break;
++    }
++    if (dictSize <= ((UInt32)3 << i))
++    {
++      dictSize = (3 << i);
++      break;
++    }
++  }
++
++  for (i = 0; i < 4; i++)
++    props[1 + i] = (Byte)(dictSize >> (8 * i));
++  return SZ_OK;
++}
++
++SRes LzmaEnc_MemEncode(CLzmaEncHandle pp, Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
++    int writeEndMark, ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  SRes res;
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++
++  CSeqOutStreamBuf outStream;
++
++  LzmaEnc_SetInputBuf(p, src, srcLen);
++
++  outStream.funcTable.Write = MyWrite;
++  outStream.data = dest;
++  outStream.rem = *destLen;
++  outStream.overflow = False;
++
++  p->writeEndMark = writeEndMark;
++
++  p->rc.outStream = &outStream.funcTable;
++  res = LzmaEnc_MemPrepare(pp, src, srcLen, 0, alloc, allocBig);
++  if (res == SZ_OK)
++    res = LzmaEnc_Encode2(p, progress);
++
++  *destLen -= outStream.rem;
++  if (outStream.overflow)
++    return SZ_ERROR_OUTPUT_EOF;
++  return res;
++}
++
++SRes LzmaEncode(Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
++    const CLzmaEncProps *props, Byte *propsEncoded, SizeT *propsSize, int writeEndMark,
++    ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  CLzmaEnc *p = (CLzmaEnc *)LzmaEnc_Create(alloc);
++  SRes res;
++  if (p == 0)
++    return SZ_ERROR_MEM;
++
++  res = LzmaEnc_SetProps(p, props);
++  if (res == SZ_OK)
++  {
++    res = LzmaEnc_WriteProperties(p, propsEncoded, propsSize);
++    if (res == SZ_OK)
++      res = LzmaEnc_MemEncode(p, dest, destLen, src, srcLen,
++          writeEndMark, progress, alloc, allocBig);
++  }
++
++  LzmaEnc_Destroy(p, alloc, allocBig);
++  return res;
++}
+--- /dev/null
++++ b/lib/lzma/Makefile
+@@ -0,0 +1,7 @@
++lzma_compress-objs := LzFind.o LzmaEnc.o
++lzma_decompress-objs := LzmaDec.o
++
++obj-$(CONFIG_LZMA_COMPRESS) += lzma_compress.o
++obj-$(CONFIG_LZMA_DECOMPRESS) += lzma_decompress.o
++
++EXTRA_CFLAGS += -Iinclude/linux -Iinclude/linux/lzma -include types.h
diff --git a/target/linux/generic/pending-6.1/532-jffs2_eofdetect.patch b/target/linux/generic/pending-6.1/532-jffs2_eofdetect.patch
new file mode 100644
index 00000000000000..744fbd0e21790b
--- /dev/null
+++ b/target/linux/generic/pending-6.1/532-jffs2_eofdetect.patch
@@ -0,0 +1,65 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: fs: jffs2: EOF marker
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ fs/jffs2/build.c | 10 ++++++++++
+ fs/jffs2/scan.c  | 21 +++++++++++++++++++--
+ 2 files changed, 29 insertions(+), 2 deletions(-)
+
+--- a/fs/jffs2/build.c
++++ b/fs/jffs2/build.c
+@@ -117,6 +117,16 @@ static int jffs2_build_filesystem(struct
+ 	dbg_fsbuild("scanned flash completely\n");
+ 	jffs2_dbg_dump_block_lists_nolock(c);
+ 
++	if (c->flags & (1 << 7)) {
++		printk("%s(): unlocking the mtd device... ", __func__);
++		mtd_unlock(c->mtd, 0, c->mtd->size);
++		printk("done.\n");
++
++		printk("%s(): erasing all blocks after the end marker... ", __func__);
++		jffs2_erase_pending_blocks(c, -1);
++		printk("done.\n");
++	}
++
+ 	dbg_fsbuild("pass 1 starting\n");
+ 	c->flags |= JFFS2_SB_FLAG_BUILDING;
+ 	/* Now scan the directory tree, increasing nlink according to every dirent found. */
+--- a/fs/jffs2/scan.c
++++ b/fs/jffs2/scan.c
+@@ -148,8 +148,14 @@ int jffs2_scan_medium(struct jffs2_sb_in
+ 		/* reset summary info for next eraseblock scan */
+ 		jffs2_sum_reset_collected(s);
+ 
+-		ret = jffs2_scan_eraseblock(c, jeb, buf_size?flashbuf:(flashbuf+jeb->offset),
+-						buf_size, s);
++		if (c->flags & (1 << 7)) {
++			if (mtd_block_isbad(c->mtd, jeb->offset))
++				ret = BLK_STATE_BADBLOCK;
++			else
++				ret = BLK_STATE_ALLFF;
++		} else
++			ret = jffs2_scan_eraseblock(c, jeb, buf_size?flashbuf:(flashbuf+jeb->offset),
++							buf_size, s);
+ 
+ 		if (ret < 0)
+ 			goto out;
+@@ -567,6 +573,17 @@ full_scan:
+ 			return err;
+ 	}
+ 
++	if ((buf[0] == 0xde) &&
++		(buf[1] == 0xad) &&
++		(buf[2] == 0xc0) &&
++		(buf[3] == 0xde)) {
++		/* end of filesystem. erase everything after this point */
++		printk("%s(): End of filesystem marker found at 0x%x\n", __func__, jeb->offset);
++		c->flags |= (1 << 7);
++
++		return BLK_STATE_ALLFF;
++	}
++
+ 	/* We temporarily use 'ofs' as a pointer into the buffer/jeb */
+ 	ofs = 0;
+ 	max_ofs = EMPTY_SCAN_SIZE(c->sector_size);
diff --git a/target/linux/generic/pending-6.1/600-netfilter_conntrack_flush.patch b/target/linux/generic/pending-6.1/600-netfilter_conntrack_flush.patch
new file mode 100644
index 00000000000000..d7548c14199789
--- /dev/null
+++ b/target/linux/generic/pending-6.1/600-netfilter_conntrack_flush.patch
@@ -0,0 +1,90 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: netfilter: add support for flushing conntrack via /proc
+
+lede-commit 8193bbe59a74d34d6a26d4a8cb857b1952905314
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ net/netfilter/nf_conntrack_standalone.c | 59 ++++++++++++++++++++++++++++++++-
+ 1 file changed, 58 insertions(+), 1 deletion(-)
+
+--- a/net/netfilter/nf_conntrack_standalone.c
++++ b/net/netfilter/nf_conntrack_standalone.c
+@@ -9,6 +9,7 @@
+ #include <linux/percpu.h>
+ #include <linux/netdevice.h>
+ #include <linux/security.h>
++#include <linux/inet.h>
+ #include <net/net_namespace.h>
+ #ifdef CONFIG_SYSCTL
+ #include <linux/sysctl.h>
+@@ -465,6 +466,58 @@ static int ct_cpu_seq_show(struct seq_fi
+ 	return 0;
+ }
+ 
++struct kill_request {
++	u16 family;
++	union nf_inet_addr addr;
++};
++
++static int kill_matching(struct nf_conn *i, void *data)
++{
++	struct kill_request *kr = data;
++	struct nf_conntrack_tuple *t1 = &i->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
++	struct nf_conntrack_tuple *t2 = &i->tuplehash[IP_CT_DIR_REPLY].tuple;
++
++	if (!kr->family)
++		return 1;
++
++	if (t1->src.l3num != kr->family)
++		return 0;
++
++	return (nf_inet_addr_cmp(&kr->addr, &t1->src.u3) ||
++	        nf_inet_addr_cmp(&kr->addr, &t1->dst.u3) ||
++	        nf_inet_addr_cmp(&kr->addr, &t2->src.u3) ||
++	        nf_inet_addr_cmp(&kr->addr, &t2->dst.u3));
++}
++
++static int ct_file_write(struct file *file, char *buf, size_t count)
++{
++	struct seq_file *seq = file->private_data;
++	struct nf_ct_iter_data iter_data;
++	struct kill_request kr = { };
++
++	if (count == 0)
++		return 0;
++
++	if (count >= INET6_ADDRSTRLEN)
++		count = INET6_ADDRSTRLEN - 1;
++
++	if (strnchr(buf, count, ':')) {
++		kr.family = AF_INET6;
++		if (!in6_pton(buf, count, (void *)&kr.addr, '\n', NULL))
++			return -EINVAL;
++	} else if (strnchr(buf, count, '.')) {
++		kr.family = AF_INET;
++		if (!in4_pton(buf, count, (void *)&kr.addr, '\n', NULL))
++			return -EINVAL;
++	}
++
++	iter_data.net = seq_file_net(seq);
++	iter_data.data = &kr;
++	nf_ct_iterate_cleanup_net(kill_matching, &iter_data);
++
++	return 0;
++}
++
+ static const struct seq_operations ct_cpu_seq_ops = {
+ 	.start	= ct_cpu_seq_start,
+ 	.next	= ct_cpu_seq_next,
+@@ -478,8 +531,9 @@ static int nf_conntrack_standalone_init_
+ 	kuid_t root_uid;
+ 	kgid_t root_gid;
+ 
+-	pde = proc_create_net("nf_conntrack", 0440, net->proc_net, &ct_seq_ops,
+-			sizeof(struct ct_iter_state));
++	pde = proc_create_net_data_write("nf_conntrack", 0440, net->proc_net,
++					 &ct_seq_ops, &ct_file_write,
++					 sizeof(struct ct_iter_state), NULL);
+ 	if (!pde)
+ 		goto out_nf_conntrack;
+ 
diff --git a/target/linux/generic/pending-6.1/610-netfilter_match_bypass_default_checks.patch b/target/linux/generic/pending-6.1/610-netfilter_match_bypass_default_checks.patch
new file mode 100644
index 00000000000000..7e34ef37133c2f
--- /dev/null
+++ b/target/linux/generic/pending-6.1/610-netfilter_match_bypass_default_checks.patch
@@ -0,0 +1,110 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: kernel: add a new version of my netfilter speedup patches for linux 2.6.39 and 3.0
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ include/uapi/linux/netfilter_ipv4/ip_tables.h |  1 +
+ net/ipv4/netfilter/ip_tables.c                | 37 +++++++++++++++++++++++++++
+ 2 files changed, 38 insertions(+)
+
+--- a/include/uapi/linux/netfilter_ipv4/ip_tables.h
++++ b/include/uapi/linux/netfilter_ipv4/ip_tables.h
+@@ -89,6 +89,7 @@ struct ipt_ip {
+ #define IPT_F_FRAG		0x01	/* Set if rule is a fragment rule */
+ #define IPT_F_GOTO		0x02	/* Set if jump is a goto */
+ #define IPT_F_MASK		0x03	/* All possible flag bits mask. */
++#define IPT_F_NO_DEF_MATCH	0x80	/* Internal: no default match rules present */
+ 
+ /* Values for "inv" field in struct ipt_ip. */
+ #define IPT_INV_VIA_IN		0x01	/* Invert the sense of IN IFACE. */
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -50,6 +50,9 @@ ip_packet_match(const struct iphdr *ip,
+ {
+ 	unsigned long ret;
+ 
++	if (ipinfo->flags & IPT_F_NO_DEF_MATCH)
++		return true;
++
+ 	if (NF_INVF(ipinfo, IPT_INV_SRCIP,
+ 		    (ip->saddr & ipinfo->smsk.s_addr) != ipinfo->src.s_addr) ||
+ 	    NF_INVF(ipinfo, IPT_INV_DSTIP,
+@@ -80,6 +83,29 @@ ip_packet_match(const struct iphdr *ip,
+ 	return true;
+ }
+ 
++static void
++ip_checkdefault(struct ipt_ip *ip)
++{
++	static const char iface_mask[IFNAMSIZ] = {};
++
++	if (ip->invflags || ip->flags & IPT_F_FRAG)
++		return;
++
++	if (memcmp(ip->iniface_mask, iface_mask, IFNAMSIZ) != 0)
++		return;
++
++	if (memcmp(ip->outiface_mask, iface_mask, IFNAMSIZ) != 0)
++		return;
++
++	if (ip->smsk.s_addr || ip->dmsk.s_addr)
++		return;
++
++	if (ip->proto)
++		return;
++
++	ip->flags |= IPT_F_NO_DEF_MATCH;
++}
++
+ static bool
+ ip_checkentry(const struct ipt_ip *ip)
+ {
+@@ -525,6 +551,8 @@ find_check_entry(struct ipt_entry *e, st
+ 	struct xt_mtchk_param mtpar;
+ 	struct xt_entry_match *ematch;
+ 
++	ip_checkdefault(&e->ip);
++
+ 	if (!xt_percpu_counter_alloc(alloc_state, &e->counters))
+ 		return -ENOMEM;
+ 
+@@ -819,6 +847,7 @@ copy_entries_to_user(unsigned int total_
+ 	const struct xt_table_info *private = table->private;
+ 	int ret = 0;
+ 	const void *loc_cpu_entry;
++	u8 flags;
+ 
+ 	counters = alloc_counters(table);
+ 	if (IS_ERR(counters))
+@@ -846,6 +875,14 @@ copy_entries_to_user(unsigned int total_
+ 			goto free_counters;
+ 		}
+ 
++		flags = e->ip.flags & IPT_F_MASK;
++		if (copy_to_user(userptr + off
++				 + offsetof(struct ipt_entry, ip.flags),
++				 &flags, sizeof(flags)) != 0) {
++			ret = -EFAULT;
++			goto free_counters;
++		}
++
+ 		for (i = sizeof(struct ipt_entry);
+ 		     i < e->target_offset;
+ 		     i += m->u.match_size) {
+@@ -1223,12 +1260,15 @@ compat_copy_entry_to_user(struct ipt_ent
+ 	compat_uint_t origsize;
+ 	const struct xt_entry_match *ematch;
+ 	int ret = 0;
++	u8 flags = e->ip.flags & IPT_F_MASK;
+ 
+ 	origsize = *size;
+ 	ce = *dstptr;
+ 	if (copy_to_user(ce, e, sizeof(struct ipt_entry)) != 0 ||
+ 	    copy_to_user(&ce->counters, &counters[i],
+-	    sizeof(counters[i])) != 0)
++	    sizeof(counters[i])) != 0 ||
++	    copy_to_user(&ce->ip.flags, &flags,
++	    sizeof(flags)) != 0)
+ 		return -EFAULT;
+ 
+ 	*dstptr += sizeof(struct compat_ipt_entry);
diff --git a/target/linux/generic/pending-6.1/611-netfilter_match_bypass_default_table.patch b/target/linux/generic/pending-6.1/611-netfilter_match_bypass_default_table.patch
new file mode 100644
index 00000000000000..dd557fd3eaae32
--- /dev/null
+++ b/target/linux/generic/pending-6.1/611-netfilter_match_bypass_default_table.patch
@@ -0,0 +1,106 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: netfilter: match bypass default table
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ net/ipv4/netfilter/ip_tables.c | 79 +++++++++++++++++++++++++++++++-----------
+ 1 file changed, 58 insertions(+), 21 deletions(-)
+
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -246,6 +246,33 @@ struct ipt_entry *ipt_next_entry(const s
+ 	return (void *)entry + entry->next_offset;
+ }
+ 
++static bool
++ipt_handle_default_rule(struct ipt_entry *e, unsigned int *verdict)
++{
++	struct xt_entry_target *t;
++	struct xt_standard_target *st;
++
++	if (e->target_offset != sizeof(struct ipt_entry))
++		return false;
++
++	if (!(e->ip.flags & IPT_F_NO_DEF_MATCH))
++		return false;
++
++	t = ipt_get_target(e);
++	if (t->u.kernel.target->target)
++		return false;
++
++	st = (struct xt_standard_target *) t;
++	if (st->verdict == XT_RETURN)
++		return false;
++
++	if (st->verdict >= 0)
++		return false;
++
++	*verdict = (unsigned)(-st->verdict) - 1;
++	return true;
++}
++
+ /* Returns one of the generic firewall policies, like NF_ACCEPT. */
+ unsigned int
+ ipt_do_table(void *priv,
+@@ -267,27 +294,28 @@ ipt_do_table(void *priv,
+ 	unsigned int addend;
+ 
+ 	/* Initialization */
++	WARN_ON(!(table->valid_hooks & (1 << hook)));
++	local_bh_disable();
++	private = READ_ONCE(table->private); /* Address dependency. */
++	cpu        = smp_processor_id();
++	table_base = private->entries;
++
++	e = get_entry(table_base, private->hook_entry[hook]);
++	if (ipt_handle_default_rule(e, &verdict)) {
++		struct xt_counters *counter;
++
++		counter = xt_get_this_cpu_counter(&e->counters);
++		ADD_COUNTER(*counter, skb->len, 1);
++		local_bh_enable();
++		return verdict;
++	}
++
+ 	stackidx = 0;
+ 	ip = ip_hdr(skb);
+ 	indev = state->in ? state->in->name : nulldevname;
+ 	outdev = state->out ? state->out->name : nulldevname;
+-	/* We handle fragments by dealing with the first fragment as
+-	 * if it was a normal packet.  All other fragments are treated
+-	 * normally, except that they will NEVER match rules that ask
+-	 * things we don't know, ie. tcp syn flag or ports).  If the
+-	 * rule is also a fragment-specific rule, non-fragments won't
+-	 * match it. */
+-	acpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
+-	acpar.thoff   = ip_hdrlen(skb);
+-	acpar.hotdrop = false;
+-	acpar.state   = state;
+ 
+-	WARN_ON(!(table->valid_hooks & (1 << hook)));
+-	local_bh_disable();
+ 	addend = xt_write_recseq_begin();
+-	private = READ_ONCE(table->private); /* Address dependency. */
+-	cpu        = smp_processor_id();
+-	table_base = private->entries;
+ 	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
+ 
+ 	/* Switch to alternate jumpstack if we're being invoked via TEE.
+@@ -300,7 +328,16 @@ ipt_do_table(void *priv,
+ 	if (static_key_false(&xt_tee_enabled))
+ 		jumpstack += private->stacksize * __this_cpu_read(nf_skb_duplicated);
+ 
+-	e = get_entry(table_base, private->hook_entry[hook]);
++	/* We handle fragments by dealing with the first fragment as
++	 * if it was a normal packet.  All other fragments are treated
++	 * normally, except that they will NEVER match rules that ask
++	 * things we don't know, ie. tcp syn flag or ports).  If the
++	 * rule is also a fragment-specific rule, non-fragments won't
++	 * match it. */
++	acpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
++	acpar.thoff   = ip_hdrlen(skb);
++	acpar.hotdrop = false;
++	acpar.state   = state;
+ 
+ 	do {
+ 		const struct xt_entry_target *t;
diff --git a/target/linux/generic/pending-6.1/612-netfilter_match_reduce_memory_access.patch b/target/linux/generic/pending-6.1/612-netfilter_match_reduce_memory_access.patch
new file mode 100644
index 00000000000000..79da6778b684a5
--- /dev/null
+++ b/target/linux/generic/pending-6.1/612-netfilter_match_reduce_memory_access.patch
@@ -0,0 +1,22 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: netfilter: reduce match memory access
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ net/ipv4/netfilter/ip_tables.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -53,9 +53,9 @@ ip_packet_match(const struct iphdr *ip,
+ 	if (ipinfo->flags & IPT_F_NO_DEF_MATCH)
+ 		return true;
+ 
+-	if (NF_INVF(ipinfo, IPT_INV_SRCIP,
++	if (NF_INVF(ipinfo, IPT_INV_SRCIP, ipinfo->smsk.s_addr &&
+ 		    (ip->saddr & ipinfo->smsk.s_addr) != ipinfo->src.s_addr) ||
+-	    NF_INVF(ipinfo, IPT_INV_DSTIP,
++	    NF_INVF(ipinfo, IPT_INV_DSTIP, ipinfo->dmsk.s_addr &&
+ 		    (ip->daddr & ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr))
+ 		return false;
+ 
diff --git a/target/linux/generic/pending-6.1/620-net_sched-codel-do-not-defer-queue-length-update.patch b/target/linux/generic/pending-6.1/620-net_sched-codel-do-not-defer-queue-length-update.patch
new file mode 100644
index 00000000000000..4b4825ae3b9a4a
--- /dev/null
+++ b/target/linux/generic/pending-6.1/620-net_sched-codel-do-not-defer-queue-length-update.patch
@@ -0,0 +1,86 @@
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Date: Mon, 21 Aug 2017 11:14:14 +0300
+Subject: [PATCH] net_sched/codel: do not defer queue length update
+
+When codel wants to drop last packet in ->dequeue() it cannot call
+qdisc_tree_reduce_backlog() right away - it will notify parent qdisc
+about zero qlen and HTB/HFSC will deactivate class. The same class will
+be deactivated second time by caller of ->dequeue(). Currently codel and
+fq_codel defer update. This triggers warning in HFSC when it's qlen != 0
+but there is no active classes.
+
+This patch update parent queue length immediately: just temporary increase
+qlen around qdisc_tree_reduce_backlog() to prevent first class deactivation
+if we have skb to return.
+
+This might open another problem in HFSC - now operation peek could fail and
+deactivate parent class.
+
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=109581
+---
+
+--- a/net/sched/sch_codel.c
++++ b/net/sched/sch_codel.c
+@@ -95,11 +95,17 @@ static struct sk_buff *codel_qdisc_deque
+ 			    &q->stats, qdisc_pkt_len, codel_get_enqueue_time,
+ 			    drop_func, dequeue_func);
+ 
+-	/* We cant call qdisc_tree_reduce_backlog() if our qlen is 0,
+-	 * or HTB crashes. Defer it for next round.
++	/* If our qlen is 0 qdisc_tree_reduce_backlog() will deactivate
++	 * parent class, dequeue in parent qdisc will do the same if we
++	 * return skb. Temporary increment qlen if we have skb.
+ 	 */
+-	if (q->stats.drop_count && sch->q.qlen) {
+-		qdisc_tree_reduce_backlog(sch, q->stats.drop_count, q->stats.drop_len);
++	if (q->stats.drop_count) {
++		if (skb)
++			sch->q.qlen++;
++		qdisc_tree_reduce_backlog(sch, q->stats.drop_count,
++					  q->stats.drop_len);
++		if (skb)
++			sch->q.qlen--;
+ 		q->stats.drop_count = 0;
+ 		q->stats.drop_len = 0;
+ 	}
+--- a/net/sched/sch_fq_codel.c
++++ b/net/sched/sch_fq_codel.c
+@@ -304,6 +304,21 @@ begin:
+ 			    &flow->cvars, &q->cstats, qdisc_pkt_len,
+ 			    codel_get_enqueue_time, drop_func, dequeue_func);
+ 
++	/* If our qlen is 0 qdisc_tree_reduce_backlog() will deactivate
++	 * parent class, dequeue in parent qdisc will do the same if we
++	 * return skb. Temporary increment qlen if we have skb.
++	 */
++	if (q->cstats.drop_count) {
++		if (skb)
++			sch->q.qlen++;
++		qdisc_tree_reduce_backlog(sch, q->cstats.drop_count,
++					  q->cstats.drop_len);
++		if (skb)
++			sch->q.qlen--;
++		q->cstats.drop_count = 0;
++		q->cstats.drop_len = 0;
++	}
++
+ 	if (!skb) {
+ 		/* force a pass through old_flows to prevent starvation */
+ 		if ((head == &q->new_flows) && !list_empty(&q->old_flows))
+@@ -314,15 +329,6 @@ begin:
+ 	}
+ 	qdisc_bstats_update(sch, skb);
+ 	flow->deficit -= qdisc_pkt_len(skb);
+-	/* We cant call qdisc_tree_reduce_backlog() if our qlen is 0,
+-	 * or HTB crashes. Defer it for next round.
+-	 */
+-	if (q->cstats.drop_count && sch->q.qlen) {
+-		qdisc_tree_reduce_backlog(sch, q->cstats.drop_count,
+-					  q->cstats.drop_len);
+-		q->cstats.drop_count = 0;
+-		q->cstats.drop_len = 0;
+-	}
+ 	return skb;
+ }
+ 
diff --git a/target/linux/generic/pending-6.1/630-packet_socket_type.patch b/target/linux/generic/pending-6.1/630-packet_socket_type.patch
new file mode 100644
index 00000000000000..8e667fb4dde270
--- /dev/null
+++ b/target/linux/generic/pending-6.1/630-packet_socket_type.patch
@@ -0,0 +1,138 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: net: add an optimization for dealing with raw sockets
+
+lede-commit: 4898039703d7315f0f3431c860123338ec3be0f6
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ include/uapi/linux/if_packet.h |  3 +++
+ net/packet/af_packet.c         | 34 +++++++++++++++++++++++++++-------
+ net/packet/internal.h          |  1 +
+ 3 files changed, 31 insertions(+), 7 deletions(-)
+
+--- a/include/uapi/linux/if_packet.h
++++ b/include/uapi/linux/if_packet.h
+@@ -33,6 +33,8 @@ struct sockaddr_ll {
+ #define PACKET_KERNEL		7		/* To kernel space	*/
+ /* Unused, PACKET_FASTROUTE and PACKET_LOOPBACK are invisible to user space */
+ #define PACKET_FASTROUTE	6		/* Fastrouted frame	*/
++#define PACKET_MASK_ANY		0xffffffff	/* mask for packet type bits */
++
+ 
+ /* Packet socket options */
+ 
+@@ -59,6 +61,7 @@ struct sockaddr_ll {
+ #define PACKET_ROLLOVER_STATS		21
+ #define PACKET_FANOUT_DATA		22
+ #define PACKET_IGNORE_OUTGOING		23
++#define PACKET_RECV_TYPE		24
+ 
+ #define PACKET_FANOUT_HASH		0
+ #define PACKET_FANOUT_LB		1
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1862,6 +1862,7 @@ static int packet_rcv_spkt(struct sk_buf
+ {
+ 	struct sock *sk;
+ 	struct sockaddr_pkt *spkt;
++	struct packet_sock *po;
+ 
+ 	/*
+ 	 *	When we registered the protocol we saved the socket in the data
+@@ -1869,6 +1870,7 @@ static int packet_rcv_spkt(struct sk_buf
+ 	 */
+ 
+ 	sk = pt->af_packet_priv;
++	po = pkt_sk(sk);
+ 
+ 	/*
+ 	 *	Yank back the headers [hope the device set this
+@@ -1881,7 +1883,7 @@ static int packet_rcv_spkt(struct sk_buf
+ 	 *	so that this procedure is noop.
+ 	 */
+ 
+-	if (skb->pkt_type == PACKET_LOOPBACK)
++	if (!(po->pkt_type & (1 << skb->pkt_type)))
+ 		goto out;
+ 
+ 	if (!net_eq(dev_net(dev), sock_net(sk)))
+@@ -2127,12 +2129,12 @@ static int packet_rcv(struct sk_buff *sk
+ 	unsigned int snaplen, res;
+ 	bool is_drop_n_account = false;
+ 
+-	if (skb->pkt_type == PACKET_LOOPBACK)
+-		goto drop;
+-
+ 	sk = pt->af_packet_priv;
+ 	po = pkt_sk(sk);
+ 
++	if (!(po->pkt_type & (1 << skb->pkt_type)))
++		goto drop;
++
+ 	if (!net_eq(dev_net(dev), sock_net(sk)))
+ 		goto drop;
+ 
+@@ -2259,12 +2261,12 @@ static int tpacket_rcv(struct sk_buff *s
+ 	BUILD_BUG_ON(TPACKET_ALIGN(sizeof(*h.h2)) != 32);
+ 	BUILD_BUG_ON(TPACKET_ALIGN(sizeof(*h.h3)) != 48);
+ 
+-	if (skb->pkt_type == PACKET_LOOPBACK)
+-		goto drop;
+-
+ 	sk = pt->af_packet_priv;
+ 	po = pkt_sk(sk);
+ 
++	if (!(po->pkt_type & (1 << skb->pkt_type)))
++		goto drop;
++
+ 	if (!net_eq(dev_net(dev), sock_net(sk)))
+ 		goto drop;
+ 
+@@ -3374,6 +3376,7 @@ static int packet_create(struct net *net
+ 	mutex_init(&po->pg_vec_lock);
+ 	po->rollover = NULL;
+ 	po->prot_hook.func = packet_rcv;
++	po->pkt_type = PACKET_MASK_ANY & ~(1 << PACKET_LOOPBACK);
+ 
+ 	if (sock->type == SOCK_PACKET)
+ 		po->prot_hook.func = packet_rcv_spkt;
+@@ -4009,6 +4012,16 @@ packet_setsockopt(struct socket *sock, i
+ 		WRITE_ONCE(po->xmit, val ? packet_direct_xmit : dev_queue_xmit);
+ 		return 0;
+ 	}
++	case PACKET_RECV_TYPE:
++	{
++		unsigned int val;
++		if (optlen != sizeof(val))
++			return -EINVAL;
++		if (copy_from_sockptr(&val, optval, sizeof(val)))
++			return -EFAULT;
++		po->pkt_type = val & ~BIT(PACKET_LOOPBACK);
++		return 0;
++	}
+ 	default:
+ 		return -ENOPROTOOPT;
+ 	}
+@@ -4065,6 +4078,13 @@ static int packet_getsockopt(struct sock
+ 	case PACKET_VNET_HDR:
+ 		val = po->has_vnet_hdr;
+ 		break;
++	case PACKET_RECV_TYPE:
++		if (len > sizeof(unsigned int))
++			len = sizeof(unsigned int);
++		val = po->pkt_type;
++
++		data = &val;
++		break;
+ 	case PACKET_VERSION:
+ 		val = po->tp_version;
+ 		break;
+--- a/net/packet/internal.h
++++ b/net/packet/internal.h
+@@ -136,6 +136,7 @@ struct packet_sock {
+ 	int			(*xmit)(struct sk_buff *skb);
+ 	struct packet_type	prot_hook ____cacheline_aligned_in_smp;
+ 	atomic_t		tp_drops ____cacheline_aligned_in_smp;
++	unsigned int		pkt_type;
+ };
+ 
+ static inline struct packet_sock *pkt_sk(struct sock *sk)
diff --git a/target/linux/generic/pending-6.1/655-increase_skb_pad.patch b/target/linux/generic/pending-6.1/655-increase_skb_pad.patch
new file mode 100644
index 00000000000000..85e9e4a1a3c52a
--- /dev/null
+++ b/target/linux/generic/pending-6.1/655-increase_skb_pad.patch
@@ -0,0 +1,20 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: kernel: add a few patches for avoiding unnecessary skb reallocations - significantly improves ethernet<->wireless performance
+
+lede-commit: 6f89cffc9add6939d44a6b54cf9a5e77849aa7fd
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ include/linux/skbuff.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -2998,7 +2998,7 @@ static inline int pskb_network_may_pull(
+  * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
+  */
+ #ifndef NET_SKB_PAD
+-#define NET_SKB_PAD	max(32, L1_CACHE_BYTES)
++#define NET_SKB_PAD	max(64, L1_CACHE_BYTES)
+ #endif
+ 
+ int ___pskb_trim(struct sk_buff *skb, unsigned int len);
diff --git a/target/linux/generic/pending-6.1/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch b/target/linux/generic/pending-6.1/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
new file mode 100644
index 00000000000000..2bc25eb4fa6684
--- /dev/null
+++ b/target/linux/generic/pending-6.1/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
@@ -0,0 +1,511 @@
+From: Steven Barth <steven@midlink.org>
+Subject: Add support for MAP-E FMRs (mesh mode)
+
+MAP-E FMRs (draft-ietf-softwire-map-10) are rules for IPv4-communication
+between MAP CEs (mesh mode) without the need to forward such data to a
+border relay. This is similar to how 6rd works but for IPv4 over IPv6.
+
+Signed-off-by: Steven Barth <cyrus@openwrt.org>
+---
+ include/net/ip6_tunnel.h       |  13 ++
+ include/uapi/linux/if_tunnel.h |  13 ++
+ net/ipv6/ip6_tunnel.c          | 276 +++++++++++++++++++++++++++++++++++++++--
+ 3 files changed, 291 insertions(+), 11 deletions(-)
+
+--- a/include/net/ip6_tunnel.h
++++ b/include/net/ip6_tunnel.h
+@@ -18,6 +18,18 @@
+ /* determine capability on a per-packet basis */
+ #define IP6_TNL_F_CAP_PER_PACKET 0x40000
+ 
++/* IPv6 tunnel FMR */
++struct __ip6_tnl_fmr {
++	struct __ip6_tnl_fmr *next; /* next fmr in list */
++	struct in6_addr ip6_prefix;
++	struct in_addr ip4_prefix;
++
++	__u8 ip6_prefix_len;
++	__u8 ip4_prefix_len;
++	__u8 ea_len;
++	__u8 offset;
++};
++
+ struct __ip6_tnl_parm {
+ 	char name[IFNAMSIZ];	/* name of tunnel device */
+ 	int link;		/* ifindex of underlying L2 interface */
+@@ -29,6 +41,7 @@ struct __ip6_tnl_parm {
+ 	__u32 flags;		/* tunnel flags */
+ 	struct in6_addr laddr;	/* local tunnel end-point address */
+ 	struct in6_addr raddr;	/* remote tunnel end-point address */
++	struct __ip6_tnl_fmr *fmrs;	/* FMRs */
+ 
+ 	__be16			i_flags;
+ 	__be16			o_flags;
+--- a/include/uapi/linux/if_tunnel.h
++++ b/include/uapi/linux/if_tunnel.h
+@@ -77,10 +77,23 @@ enum {
+ 	IFLA_IPTUN_ENCAP_DPORT,
+ 	IFLA_IPTUN_COLLECT_METADATA,
+ 	IFLA_IPTUN_FWMARK,
++	IFLA_IPTUN_FMRS,
+ 	__IFLA_IPTUN_MAX,
+ };
+ #define IFLA_IPTUN_MAX	(__IFLA_IPTUN_MAX - 1)
+ 
++enum {
++	IFLA_IPTUN_FMR_UNSPEC,
++	IFLA_IPTUN_FMR_IP6_PREFIX,
++	IFLA_IPTUN_FMR_IP4_PREFIX,
++	IFLA_IPTUN_FMR_IP6_PREFIX_LEN,
++	IFLA_IPTUN_FMR_IP4_PREFIX_LEN,
++	IFLA_IPTUN_FMR_EA_LEN,
++	IFLA_IPTUN_FMR_OFFSET,
++	__IFLA_IPTUN_FMR_MAX,
++};
++#define IFLA_IPTUN_FMR_MAX (__IFLA_IPTUN_FMR_MAX - 1)
++
+ enum tunnel_encap_types {
+ 	TUNNEL_ENCAP_NONE,
+ 	TUNNEL_ENCAP_FOU,
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -11,6 +11,9 @@
+  *      linux/net/ipv6/sit.c and linux/net/ipv4/ipip.c
+  *
+  *      RFC 2473
++ *
++ *      Changes:
++ *      Steven Barth <cyrus@openwrt.org>:           MAP-E FMR support
+  */
+ 
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+@@ -67,9 +70,9 @@ static bool log_ecn_error = true;
+ module_param(log_ecn_error, bool, 0644);
+ MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
+ 
+-static u32 HASH(const struct in6_addr *addr1, const struct in6_addr *addr2)
++static u32 HASH(const struct in6_addr *addr)
+ {
+-	u32 hash = ipv6_addr_hash(addr1) ^ ipv6_addr_hash(addr2);
++	u32 hash = ipv6_addr_hash(addr);
+ 
+ 	return hash_32(hash, IP6_TUNNEL_HASH_SIZE_SHIFT);
+ }
+@@ -114,17 +117,33 @@ static struct ip6_tnl *
+ ip6_tnl_lookup(struct net *net, int link,
+ 	       const struct in6_addr *remote, const struct in6_addr *local)
+ {
+-	unsigned int hash = HASH(remote, local);
++	unsigned int hash = HASH(local);
+ 	struct ip6_tnl *t, *cand = NULL;
+ 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
+ 	struct in6_addr any;
+ 
+ 	for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
+ 		if (!ipv6_addr_equal(local, &t->parms.laddr) ||
+-		    !ipv6_addr_equal(remote, &t->parms.raddr) ||
+ 		    !(t->dev->flags & IFF_UP))
+ 			continue;
+ 
++		if (!ipv6_addr_equal(remote, &t->parms.raddr)) {
++			struct __ip6_tnl_fmr *fmr;
++			bool found = false;
++
++			for (fmr = t->parms.fmrs; fmr; fmr = fmr->next) {
++				if (!ipv6_prefix_equal(remote, &fmr->ip6_prefix,
++						       fmr->ip6_prefix_len))
++					continue;
++
++				found = true;
++				break;
++			}
++
++			if (!found)
++				continue;
++		}
++
+ 		if (link == t->parms.link)
+ 			return t;
+ 		else
+@@ -132,7 +151,7 @@ ip6_tnl_lookup(struct net *net, int link
+ 	}
+ 
+ 	memset(&any, 0, sizeof(any));
+-	hash = HASH(&any, local);
++	hash = HASH(local);
+ 	for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
+ 		if (!ipv6_addr_equal(local, &t->parms.laddr) ||
+ 		    !ipv6_addr_any(&t->parms.raddr) ||
+@@ -145,7 +164,7 @@ ip6_tnl_lookup(struct net *net, int link
+ 			cand = t;
+ 	}
+ 
+-	hash = HASH(remote, &any);
++	hash = HASH(&any);
+ 	for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
+ 		if (!ipv6_addr_equal(remote, &t->parms.raddr) ||
+ 		    !ipv6_addr_any(&t->parms.laddr) ||
+@@ -194,7 +213,7 @@ ip6_tnl_bucket(struct ip6_tnl_net *ip6n,
+ 
+ 	if (!ipv6_addr_any(remote) || !ipv6_addr_any(local)) {
+ 		prio = 1;
+-		h = HASH(remote, local);
++		h = HASH(local);
+ 	}
+ 	return &ip6n->tnls[prio][h];
+ }
+@@ -376,6 +395,12 @@ ip6_tnl_dev_uninit(struct net_device *de
+ 	struct net *net = t->net;
+ 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
+ 
++	while (t->parms.fmrs) {
++		struct __ip6_tnl_fmr *next = t->parms.fmrs->next;
++		kfree(t->parms.fmrs);
++		t->parms.fmrs = next;
++	}
++
+ 	if (dev == ip6n->fb_tnl_dev)
+ 		RCU_INIT_POINTER(ip6n->tnls_wc[0], NULL);
+ 	else
+@@ -788,6 +813,107 @@ int ip6_tnl_rcv_ctl(struct ip6_tnl *t,
+ }
+ EXPORT_SYMBOL_GPL(ip6_tnl_rcv_ctl);
+ 
++/**
++ * ip4ip6_fmr_calc - calculate target / source IPv6-address based on FMR
++ *   @dest: destination IPv6 address buffer
++ *   @skb: received socket buffer
++ *   @fmr: MAP FMR
++ *   @xmit: Calculate for xmit or rcv
++ **/
++static void ip4ip6_fmr_calc(struct in6_addr *dest,
++		const struct iphdr *iph, const uint8_t *end,
++		const struct __ip6_tnl_fmr *fmr, bool xmit)
++{
++	int psidlen = fmr->ea_len - (32 - fmr->ip4_prefix_len);
++	u8 *portp = NULL;
++	bool use_dest_addr;
++	const struct iphdr *dsth = iph;
++
++	if ((u8*)dsth >= end)
++		return;
++
++	/* find significant IP header */
++	if (iph->protocol == IPPROTO_ICMP) {
++		struct icmphdr *ih = (struct icmphdr*)(((u8*)dsth) + dsth->ihl * 4);
++		if (ih && ((u8*)&ih[1]) <= end && (
++			ih->type == ICMP_DEST_UNREACH ||
++			ih->type == ICMP_SOURCE_QUENCH ||
++			ih->type == ICMP_TIME_EXCEEDED ||
++			ih->type == ICMP_PARAMETERPROB ||
++			ih->type == ICMP_REDIRECT))
++				dsth = (const struct iphdr*)&ih[1];
++	}
++
++	/* in xmit-path use dest port by default and source port only if
++		this is an ICMP reply to something else; vice versa in rcv-path */
++	use_dest_addr = (xmit && dsth == iph) || (!xmit && dsth != iph);
++
++	/* get dst port */
++	if (((u8*)&dsth[1]) <= end && (
++		dsth->protocol == IPPROTO_UDP ||
++		dsth->protocol == IPPROTO_TCP ||
++		dsth->protocol == IPPROTO_SCTP ||
++		dsth->protocol == IPPROTO_DCCP)) {
++			/* for UDP, TCP, SCTP and DCCP source and dest port
++			follow IPv4 header directly */
++			portp = ((u8*)dsth) + dsth->ihl * 4;
++
++			if (use_dest_addr)
++				portp += sizeof(u16);
++	} else if (iph->protocol == IPPROTO_ICMP) {
++		struct icmphdr *ih = (struct icmphdr*)(((u8*)dsth) + dsth->ihl * 4);
++
++		/* use icmp identifier as port */
++		if (((u8*)&ih) <= end && (
++		    (use_dest_addr && (
++		    ih->type == ICMP_ECHOREPLY ||
++			ih->type == ICMP_TIMESTAMPREPLY ||
++			ih->type == ICMP_INFO_REPLY ||
++			ih->type == ICMP_ADDRESSREPLY)) ||
++			(!use_dest_addr && (
++			ih->type == ICMP_ECHO ||
++			ih->type == ICMP_TIMESTAMP ||
++			ih->type == ICMP_INFO_REQUEST ||
++			ih->type == ICMP_ADDRESS)
++			)))
++				portp = (u8*)&ih->un.echo.id;
++	}
++
++	if ((portp && &portp[2] <= end) || psidlen == 0) {
++		int frombyte = fmr->ip6_prefix_len / 8;
++		int fromrem = fmr->ip6_prefix_len % 8;
++		int bytes = sizeof(struct in6_addr) - frombyte;
++		const u32 *addr = (use_dest_addr) ? &iph->daddr : &iph->saddr;
++		u64 eabits = ((u64)ntohl(*addr)) << (32 + fmr->ip4_prefix_len);
++		u64 t = 0;
++
++		/* extract PSID from port and add it to eabits */
++		u16 psidbits = 0;
++		if (psidlen > 0) {
++			psidbits = ((u16)portp[0]) << 8 | ((u16)portp[1]);
++			psidbits >>= 16 - psidlen - fmr->offset;
++			psidbits = (u16)(psidbits << (16 - psidlen));
++			eabits |= ((u64)psidbits) << (48 - (fmr->ea_len - psidlen));
++		}
++
++		/* rewrite destination address */
++		*dest = fmr->ip6_prefix;
++		memcpy(&dest->s6_addr[10], addr, sizeof(*addr));
++		dest->s6_addr16[7] = htons(psidbits >> (16 - psidlen));
++
++		if (bytes > sizeof(u64))
++			bytes = sizeof(u64);
++
++		/* insert eabits */
++		memcpy(&t, &dest->s6_addr[frombyte], bytes);
++		t = be64_to_cpu(t) & ~(((((u64)1) << fmr->ea_len) - 1)
++			<< (64 - fmr->ea_len - fromrem));
++		t = cpu_to_be64(t | (eabits >> fromrem));
++		memcpy(&dest->s6_addr[frombyte], &t, bytes);
++	}
++}
++
++
+ static int __ip6_tnl_rcv(struct ip6_tnl *tunnel, struct sk_buff *skb,
+ 			 const struct tnl_ptk_info *tpi,
+ 			 struct metadata_dst *tun_dst,
+@@ -840,6 +966,27 @@ static int __ip6_tnl_rcv(struct ip6_tnl
+ 	skb_reset_network_header(skb);
+ 	memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
+ 
++	if (tpi->proto == htons(ETH_P_IP) && tunnel->parms.fmrs &&
++		!ipv6_addr_equal(&ipv6h->saddr, &tunnel->parms.raddr)) {
++			/* Packet didn't come from BR, so lookup FMR */
++			struct __ip6_tnl_fmr *fmr;
++			struct in6_addr expected = tunnel->parms.raddr;
++			for (fmr = tunnel->parms.fmrs; fmr; fmr = fmr->next)
++				if (ipv6_prefix_equal(&ipv6h->saddr,
++					&fmr->ip6_prefix, fmr->ip6_prefix_len))
++						break;
++
++			/* Check that IPv6 matches IPv4 source to prevent spoofing */
++			if (fmr)
++				ip4ip6_fmr_calc(&expected, ip_hdr(skb),
++						skb_tail_pointer(skb), fmr, false);
++
++			if (!ipv6_addr_equal(&ipv6h->saddr, &expected)) {
++				rcu_read_unlock();
++				goto drop;
++			}
++	}
++
+ 	__skb_tunnel_rx(skb, tunnel->dev, tunnel->net);
+ 
+ 	err = dscp_ecn_decapsulate(tunnel, ipv6h, skb);
+@@ -987,6 +1134,7 @@ static void init_tel_txopt(struct ipv6_t
+ 	opt->ops.opt_nflen = 8;
+ }
+ 
++
+ /**
+  * ip6_tnl_addr_conflict - compare packet addresses to tunnel's own
+  *   @t: the outgoing tunnel device
+@@ -1278,6 +1426,7 @@ ipxip6_tnl_xmit(struct sk_buff *skb, str
+ 		u8 protocol)
+ {
+ 	struct ip6_tnl *t = netdev_priv(dev);
++	struct __ip6_tnl_fmr *fmr;
+ 	struct ipv6hdr *ipv6h;
+ 	const struct iphdr  *iph;
+ 	int encap_limit = -1;
+@@ -1377,6 +1526,18 @@ ipxip6_tnl_xmit(struct sk_buff *skb, str
+ 	fl6.flowi6_uid = sock_net_uid(dev_net(dev), NULL);
+ 	dsfield = INET_ECN_encapsulate(dsfield, orig_dsfield);
+ 
++	/* try to find matching FMR */
++	for (fmr = t->parms.fmrs; fmr; fmr = fmr->next) {
++		unsigned mshift = 32 - fmr->ip4_prefix_len;
++		if (ntohl(fmr->ip4_prefix.s_addr) >> mshift ==
++				ntohl(ip_hdr(skb)->daddr) >> mshift)
++			break;
++	}
++
++	/* change dstaddr according to FMR */
++	if (fmr)
++		ip4ip6_fmr_calc(&fl6.daddr, ip_hdr(skb), skb_tail_pointer(skb), fmr, true);
++
+ 	if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
+ 		return -1;
+ 
+@@ -1530,6 +1691,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
+ 	t->parms.link = p->link;
+ 	t->parms.proto = p->proto;
+ 	t->parms.fwmark = p->fwmark;
++
++	while (t->parms.fmrs) {
++		struct __ip6_tnl_fmr *next = t->parms.fmrs->next;
++		kfree(t->parms.fmrs);
++		t->parms.fmrs = next;
++	}
++	t->parms.fmrs = p->fmrs;
++
+ 	dst_cache_reset(&t->dst_cache);
+ 	ip6_tnl_link_config(t);
+ }
+@@ -1564,6 +1733,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
+ 	p->flowinfo = u->flowinfo;
+ 	p->link = u->link;
+ 	p->proto = u->proto;
++	p->fmrs = NULL;
+ 	memcpy(p->name, u->name, sizeof(u->name));
+ }
+ 
+@@ -1950,6 +2120,15 @@ static int ip6_tnl_validate(struct nlatt
+ 	return 0;
+ }
+ 
++static const struct nla_policy ip6_tnl_fmr_policy[IFLA_IPTUN_FMR_MAX + 1] = {
++	[IFLA_IPTUN_FMR_IP6_PREFIX] = { .len = sizeof(struct in6_addr) },
++	[IFLA_IPTUN_FMR_IP4_PREFIX] = { .len = sizeof(struct in_addr) },
++	[IFLA_IPTUN_FMR_IP6_PREFIX_LEN] = { .type = NLA_U8 },
++	[IFLA_IPTUN_FMR_IP4_PREFIX_LEN] = { .type = NLA_U8 },
++	[IFLA_IPTUN_FMR_EA_LEN] = { .type = NLA_U8 },
++	[IFLA_IPTUN_FMR_OFFSET] = { .type = NLA_U8 }
++};
++
+ static void ip6_tnl_netlink_parms(struct nlattr *data[],
+ 				  struct __ip6_tnl_parm *parms)
+ {
+@@ -1987,6 +2166,46 @@ static void ip6_tnl_netlink_parms(struct
+ 
+ 	if (data[IFLA_IPTUN_FWMARK])
+ 		parms->fwmark = nla_get_u32(data[IFLA_IPTUN_FWMARK]);
++
++	if (data[IFLA_IPTUN_FMRS]) {
++		unsigned rem;
++		struct nlattr *fmr;
++		nla_for_each_nested(fmr, data[IFLA_IPTUN_FMRS], rem) {
++			struct nlattr *fmrd[IFLA_IPTUN_FMR_MAX + 1], *c;
++			struct __ip6_tnl_fmr *nfmr;
++
++			nla_parse_nested(fmrd, IFLA_IPTUN_FMR_MAX,
++				fmr, ip6_tnl_fmr_policy, NULL);
++
++			if (!(nfmr = kzalloc(sizeof(*nfmr), GFP_KERNEL)))
++				continue;
++
++			nfmr->offset = 6;
++
++			if ((c = fmrd[IFLA_IPTUN_FMR_IP6_PREFIX]))
++				nla_memcpy(&nfmr->ip6_prefix, fmrd[IFLA_IPTUN_FMR_IP6_PREFIX],
++					sizeof(nfmr->ip6_prefix));
++
++			if ((c = fmrd[IFLA_IPTUN_FMR_IP4_PREFIX]))
++				nla_memcpy(&nfmr->ip4_prefix, fmrd[IFLA_IPTUN_FMR_IP4_PREFIX],
++					sizeof(nfmr->ip4_prefix));
++
++			if ((c = fmrd[IFLA_IPTUN_FMR_IP6_PREFIX_LEN]))
++				nfmr->ip6_prefix_len = nla_get_u8(c);
++
++			if ((c = fmrd[IFLA_IPTUN_FMR_IP4_PREFIX_LEN]))
++				nfmr->ip4_prefix_len = nla_get_u8(c);
++
++			if ((c = fmrd[IFLA_IPTUN_FMR_EA_LEN]))
++				nfmr->ea_len = nla_get_u8(c);
++
++			if ((c = fmrd[IFLA_IPTUN_FMR_OFFSET]))
++				nfmr->offset = nla_get_u8(c);
++
++			nfmr->next = parms->fmrs;
++			parms->fmrs = nfmr;
++		}
++	}
+ }
+ 
+ static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
+@@ -2070,6 +2289,12 @@ static void ip6_tnl_dellink(struct net_d
+ 
+ static size_t ip6_tnl_get_size(const struct net_device *dev)
+ {
++	const struct ip6_tnl *t = netdev_priv(dev);
++	struct __ip6_tnl_fmr *c;
++	int fmrs = 0;
++	for (c = t->parms.fmrs; c; c = c->next)
++		++fmrs;
++
+ 	return
+ 		/* IFLA_IPTUN_LINK */
+ 		nla_total_size(4) +
+@@ -2099,6 +2324,24 @@ static size_t ip6_tnl_get_size(const str
+ 		nla_total_size(0) +
+ 		/* IFLA_IPTUN_FWMARK */
+ 		nla_total_size(4) +
++		/* IFLA_IPTUN_FMRS */
++		nla_total_size(0) +
++		(
++			/* nest */
++			nla_total_size(0) +
++			/* IFLA_IPTUN_FMR_IP6_PREFIX */
++			nla_total_size(sizeof(struct in6_addr)) +
++			/* IFLA_IPTUN_FMR_IP4_PREFIX */
++			nla_total_size(sizeof(struct in_addr)) +
++			/* IFLA_IPTUN_FMR_EA_LEN */
++			nla_total_size(1) +
++			/* IFLA_IPTUN_FMR_IP6_PREFIX_LEN */
++			nla_total_size(1) +
++			/* IFLA_IPTUN_FMR_IP4_PREFIX_LEN */
++			nla_total_size(1) +
++			/* IFLA_IPTUN_FMR_OFFSET */
++			nla_total_size(1)
++		) * fmrs +
+ 		0;
+ }
+ 
+@@ -2106,6 +2349,9 @@ static int ip6_tnl_fill_info(struct sk_b
+ {
+ 	struct ip6_tnl *tunnel = netdev_priv(dev);
+ 	struct __ip6_tnl_parm *parm = &tunnel->parms;
++	struct __ip6_tnl_fmr *c;
++	int fmrcnt = 0;
++	struct nlattr *fmrs;
+ 
+ 	if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
+ 	    nla_put_in6_addr(skb, IFLA_IPTUN_LOCAL, &parm->laddr) ||
+@@ -2115,9 +2361,27 @@ static int ip6_tnl_fill_info(struct sk_b
+ 	    nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) ||
+ 	    nla_put_u32(skb, IFLA_IPTUN_FLAGS, parm->flags) ||
+ 	    nla_put_u8(skb, IFLA_IPTUN_PROTO, parm->proto) ||
+-	    nla_put_u32(skb, IFLA_IPTUN_FWMARK, parm->fwmark))
++	    nla_put_u32(skb, IFLA_IPTUN_FWMARK, parm->fwmark) ||
++	    !(fmrs = nla_nest_start(skb, IFLA_IPTUN_FMRS)))
+ 		goto nla_put_failure;
+ 
++	for (c = parm->fmrs; c; c = c->next) {
++		struct nlattr *fmr = nla_nest_start(skb, ++fmrcnt);
++		if (!fmr ||
++			nla_put(skb, IFLA_IPTUN_FMR_IP6_PREFIX,
++				sizeof(c->ip6_prefix), &c->ip6_prefix) ||
++			nla_put(skb, IFLA_IPTUN_FMR_IP4_PREFIX,
++				sizeof(c->ip4_prefix), &c->ip4_prefix) ||
++			nla_put_u8(skb, IFLA_IPTUN_FMR_IP6_PREFIX_LEN, c->ip6_prefix_len) ||
++			nla_put_u8(skb, IFLA_IPTUN_FMR_IP4_PREFIX_LEN, c->ip4_prefix_len) ||
++			nla_put_u8(skb, IFLA_IPTUN_FMR_EA_LEN, c->ea_len) ||
++			nla_put_u8(skb, IFLA_IPTUN_FMR_OFFSET, c->offset))
++				goto nla_put_failure;
++
++		nla_nest_end(skb, fmr);
++	}
++	nla_nest_end(skb, fmrs);
++
+ 	if (nla_put_u16(skb, IFLA_IPTUN_ENCAP_TYPE, tunnel->encap.type) ||
+ 	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_SPORT, tunnel->encap.sport) ||
+ 	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_DPORT, tunnel->encap.dport) ||
+@@ -2157,6 +2421,7 @@ static const struct nla_policy ip6_tnl_p
+ 	[IFLA_IPTUN_ENCAP_DPORT]	= { .type = NLA_U16 },
+ 	[IFLA_IPTUN_COLLECT_METADATA]	= { .type = NLA_FLAG },
+ 	[IFLA_IPTUN_FWMARK]		= { .type = NLA_U32 },
++	[IFLA_IPTUN_FMRS]		= { .type = NLA_NESTED },
+ };
+ 
+ static struct rtnl_link_ops ip6_link_ops __read_mostly = {
diff --git a/target/linux/generic/pending-6.1/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch b/target/linux/generic/pending-6.1/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
new file mode 100644
index 00000000000000..e5103570f1f7e7
--- /dev/null
+++ b/target/linux/generic/pending-6.1/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
@@ -0,0 +1,263 @@
+From: Jonas Gorski <jogo@openwrt.org>
+Subject: ipv6: allow rejecting with "source address failed policy"
+
+RFC6204 L-14 requires rejecting traffic from invalid addresses with
+ICMPv6 Destination Unreachable, Code 5 (Source address failed ingress/
+egress policy) on the LAN side, so add an appropriate rule for that.
+
+Signed-off-by: Jonas Gorski <jogo@openwrt.org>
+---
+ include/net/netns/ipv6.h       |  1 +
+ include/uapi/linux/fib_rules.h |  4 +++
+ include/uapi/linux/rtnetlink.h |  1 +
+ net/ipv4/fib_semantics.c       |  4 +++
+ net/ipv4/fib_trie.c            |  1 +
+ net/ipv4/ipmr.c                |  1 +
+ net/ipv6/fib6_rules.c          |  4 +++
+ net/ipv6/ip6mr.c               |  2 ++
+ net/ipv6/route.c               | 58 +++++++++++++++++++++++++++++++++++++++++-
+ 9 files changed, 75 insertions(+), 1 deletion(-)
+
+--- a/include/net/netns/ipv6.h
++++ b/include/net/netns/ipv6.h
+@@ -85,6 +85,7 @@ struct netns_ipv6 {
+ 	unsigned int		fib6_routes_require_src;
+ #endif
+ 	struct rt6_info         *ip6_prohibit_entry;
++	struct rt6_info		*ip6_policy_failed_entry;
+ 	struct rt6_info         *ip6_blk_hole_entry;
+ 	struct fib6_table       *fib6_local_tbl;
+ 	struct fib_rules_ops    *fib6_rules_ops;
+--- a/include/uapi/linux/fib_rules.h
++++ b/include/uapi/linux/fib_rules.h
+@@ -82,6 +82,10 @@ enum {
+ 	FR_ACT_BLACKHOLE,	/* Drop without notification */
+ 	FR_ACT_UNREACHABLE,	/* Drop with ENETUNREACH */
+ 	FR_ACT_PROHIBIT,	/* Drop with EACCES */
++	FR_ACT_RES9,
++	FR_ACT_RES10,
++	FR_ACT_RES11,
++	FR_ACT_POLICY_FAILED,	/* Drop with EACCES */
+ 	__FR_ACT_MAX,
+ };
+ 
+--- a/include/uapi/linux/rtnetlink.h
++++ b/include/uapi/linux/rtnetlink.h
+@@ -265,6 +265,7 @@ enum {
+ 	RTN_THROW,		/* Not in this table		*/
+ 	RTN_NAT,		/* Translate this address	*/
+ 	RTN_XRESOLVE,		/* Use external resolver	*/
++	RTN_POLICY_FAILED,	/* Failed ingress/egress policy */
+ 	__RTN_MAX
+ };
+ 
+--- a/net/ipv4/fib_semantics.c
++++ b/net/ipv4/fib_semantics.c
+@@ -145,6 +145,10 @@ const struct fib_prop fib_props[RTN_MAX
+ 		.error	= -EINVAL,
+ 		.scope	= RT_SCOPE_NOWHERE,
+ 	},
++	[RTN_POLICY_FAILED] = {
++		.error	= -EACCES,
++		.scope	= RT_SCOPE_UNIVERSE,
++	},
+ };
+ 
+ static void rt_fibinfo_free(struct rtable __rcu **rtp)
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -2778,6 +2778,7 @@ static const char *const rtn_type_names[
+ 	[RTN_THROW] = "THROW",
+ 	[RTN_NAT] = "NAT",
+ 	[RTN_XRESOLVE] = "XRESOLVE",
++	[RTN_POLICY_FAILED] = "POLICY_FAILED",
+ };
+ 
+ static inline const char *rtn_type(char *buf, size_t len, unsigned int t)
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -180,6 +180,7 @@ static int ipmr_rule_action(struct fib_r
+ 	case FR_ACT_UNREACHABLE:
+ 		return -ENETUNREACH;
+ 	case FR_ACT_PROHIBIT:
++	case FR_ACT_POLICY_FAILED:
+ 		return -EACCES;
+ 	case FR_ACT_BLACKHOLE:
+ 	default:
+--- a/net/ipv6/fib6_rules.c
++++ b/net/ipv6/fib6_rules.c
+@@ -221,6 +221,10 @@ static int __fib6_rule_action(struct fib
+ 		err = -EACCES;
+ 		rt = net->ipv6.ip6_prohibit_entry;
+ 		goto discard_pkt;
++	case FR_ACT_POLICY_FAILED:
++		err = -EACCES;
++		rt = net->ipv6.ip6_policy_failed_entry;
++		goto discard_pkt;
+ 	}
+ 
+ 	tb_id = fib_rule_get_table(rule, arg);
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -170,6 +170,8 @@ static int ip6mr_rule_action(struct fib_
+ 		return -ENETUNREACH;
+ 	case FR_ACT_PROHIBIT:
+ 		return -EACCES;
++	case FR_ACT_POLICY_FAILED:
++		return -EACCES;
+ 	case FR_ACT_BLACKHOLE:
+ 	default:
+ 		return -EINVAL;
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -97,6 +97,8 @@ static int		ip6_pkt_discard(struct sk_bu
+ static int		ip6_pkt_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb);
+ static int		ip6_pkt_prohibit(struct sk_buff *skb);
+ static int		ip6_pkt_prohibit_out(struct net *net, struct sock *sk, struct sk_buff *skb);
++static int		ip6_pkt_policy_failed(struct sk_buff *skb);
++static int		ip6_pkt_policy_failed_out(struct net *net, struct sock *sk, struct sk_buff *skb);
+ static void		ip6_link_failure(struct sk_buff *skb);
+ static void		ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
+ 					   struct sk_buff *skb, u32 mtu,
+@@ -317,6 +319,18 @@ static const struct rt6_info ip6_prohibi
+ 	.rt6i_flags	= (RTF_REJECT | RTF_NONEXTHOP),
+ };
+ 
++static const struct rt6_info ip6_policy_failed_entry_template = {
++	.dst = {
++		.__refcnt	= ATOMIC_INIT(1),
++		.__use		= 1,
++		.obsolete	= DST_OBSOLETE_FORCE_CHK,
++		.error		= -EACCES,
++		.input		= ip6_pkt_policy_failed,
++		.output		= ip6_pkt_policy_failed_out,
++	},
++	.rt6i_flags	= (RTF_REJECT | RTF_NONEXTHOP),
++};
++
+ static const struct rt6_info ip6_blk_hole_entry_template = {
+ 	.dst = {
+ 		.__refcnt	= ATOMIC_INIT(1),
+@@ -1036,6 +1050,7 @@ static const int fib6_prop[RTN_MAX + 1]
+ 	[RTN_BLACKHOLE]	= -EINVAL,
+ 	[RTN_UNREACHABLE] = -EHOSTUNREACH,
+ 	[RTN_PROHIBIT]	= -EACCES,
++	[RTN_POLICY_FAILED] = -EACCES,
+ 	[RTN_THROW]	= -EAGAIN,
+ 	[RTN_NAT]	= -EINVAL,
+ 	[RTN_XRESOLVE]	= -EINVAL,
+@@ -1071,6 +1086,10 @@ static void ip6_rt_init_dst_reject(struc
+ 		rt->dst.output = ip6_pkt_prohibit_out;
+ 		rt->dst.input = ip6_pkt_prohibit;
+ 		break;
++	case RTN_POLICY_FAILED:
++		rt->dst.output = ip6_pkt_policy_failed_out;
++		rt->dst.input = ip6_pkt_policy_failed;
++		break;
+ 	case RTN_THROW:
+ 	case RTN_UNREACHABLE:
+ 	default:
+@@ -4539,6 +4558,17 @@ static int ip6_pkt_prohibit_out(struct n
+ 	return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_OUTNOROUTES);
+ }
+ 
++static int ip6_pkt_policy_failed(struct sk_buff *skb)
++{
++	return ip6_pkt_drop(skb, ICMPV6_POLICY_FAIL, IPSTATS_MIB_INNOROUTES);
++}
++
++static int ip6_pkt_policy_failed_out(struct net *net, struct sock *sk, struct sk_buff *skb)
++{
++	skb->dev = skb_dst(skb)->dev;
++	return ip6_pkt_drop(skb, ICMPV6_POLICY_FAIL, IPSTATS_MIB_OUTNOROUTES);
++}
++
+ /*
+  *	Allocate a dst for local (unicast / anycast) address.
+  */
+@@ -5032,7 +5062,8 @@ static int rtm_to_fib6_config(struct sk_
+ 	if (rtm->rtm_type == RTN_UNREACHABLE ||
+ 	    rtm->rtm_type == RTN_BLACKHOLE ||
+ 	    rtm->rtm_type == RTN_PROHIBIT ||
+-	    rtm->rtm_type == RTN_THROW)
++	    rtm->rtm_type == RTN_THROW ||
++	    rtm->rtm_type == RTN_POLICY_FAILED)
+ 		cfg->fc_flags |= RTF_REJECT;
+ 
+ 	if (rtm->rtm_type == RTN_LOCAL)
+@@ -6286,6 +6317,8 @@ static int ip6_route_dev_notify(struct n
+ #ifdef CONFIG_IPV6_MULTIPLE_TABLES
+ 		net->ipv6.ip6_prohibit_entry->dst.dev = dev;
+ 		net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
++		net->ipv6.ip6_policy_failed_entry->dst.dev = dev;
++		net->ipv6.ip6_policy_failed_entry->rt6i_idev = in6_dev_get(dev);
+ 		net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
+ 		net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
+ #endif
+@@ -6297,6 +6330,7 @@ static int ip6_route_dev_notify(struct n
+ 		in6_dev_put_clear(&net->ipv6.ip6_null_entry->rt6i_idev);
+ #ifdef CONFIG_IPV6_MULTIPLE_TABLES
+ 		in6_dev_put_clear(&net->ipv6.ip6_prohibit_entry->rt6i_idev);
++		in6_dev_put_clear(&net->ipv6.ip6_policy_failed_entry->rt6i_idev);
+ 		in6_dev_put_clear(&net->ipv6.ip6_blk_hole_entry->rt6i_idev);
+ #endif
+ 	}
+@@ -6488,6 +6522,8 @@ static int __net_init ip6_route_net_init
+ 
+ #ifdef CONFIG_IPV6_MULTIPLE_TABLES
+ 	net->ipv6.fib6_has_custom_rules = false;
++
++
+ 	net->ipv6.ip6_prohibit_entry = kmemdup(&ip6_prohibit_entry_template,
+ 					       sizeof(*net->ipv6.ip6_prohibit_entry),
+ 					       GFP_KERNEL);
+@@ -6498,11 +6534,21 @@ static int __net_init ip6_route_net_init
+ 			 ip6_template_metrics, true);
+ 	INIT_LIST_HEAD(&net->ipv6.ip6_prohibit_entry->rt6i_uncached);
+ 
++	net->ipv6.ip6_policy_failed_entry =
++				kmemdup(&ip6_policy_failed_entry_template,
++				sizeof(*net->ipv6.ip6_policy_failed_entry), GFP_KERNEL);
++	if (!net->ipv6.ip6_policy_failed_entry)
++		goto out_ip6_prohibit_entry;
++	net->ipv6.ip6_policy_failed_entry->dst.ops = &net->ipv6.ip6_dst_ops;
++	dst_init_metrics(&net->ipv6.ip6_policy_failed_entry->dst,
++			 ip6_template_metrics, true);
++	INIT_LIST_HEAD(&net->ipv6.ip6_policy_failed_entry->rt6i_uncached);
++
+ 	net->ipv6.ip6_blk_hole_entry = kmemdup(&ip6_blk_hole_entry_template,
+ 					       sizeof(*net->ipv6.ip6_blk_hole_entry),
+ 					       GFP_KERNEL);
+ 	if (!net->ipv6.ip6_blk_hole_entry)
+-		goto out_ip6_prohibit_entry;
++		goto out_ip6_policy_failed_entry;
+ 	net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
+ 	dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
+ 			 ip6_template_metrics, true);
+@@ -6529,6 +6575,8 @@ out:
+ 	return ret;
+ 
+ #ifdef CONFIG_IPV6_MULTIPLE_TABLES
++out_ip6_policy_failed_entry:
++	kfree(net->ipv6.ip6_policy_failed_entry);
+ out_ip6_prohibit_entry:
+ 	kfree(net->ipv6.ip6_prohibit_entry);
+ out_ip6_null_entry:
+@@ -6548,6 +6596,7 @@ static void __net_exit ip6_route_net_exi
+ 	kfree(net->ipv6.ip6_null_entry);
+ #ifdef CONFIG_IPV6_MULTIPLE_TABLES
+ 	kfree(net->ipv6.ip6_prohibit_entry);
++	kfree(net->ipv6.ip6_policy_failed_entry);
+ 	kfree(net->ipv6.ip6_blk_hole_entry);
+ #endif
+ 	dst_entries_destroy(&net->ipv6.ip6_dst_ops);
+@@ -6631,6 +6680,9 @@ void __init ip6_route_init_special_entri
+ 	init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
+ 	init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
+ 	init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
++	init_net.ipv6.ip6_policy_failed_entry->dst.dev = init_net.loopback_dev;
++	init_net.ipv6.ip6_policy_failed_entry->rt6i_idev =
++		in6_dev_get(init_net.loopback_dev);
+   #endif
+ }
+ 
diff --git a/target/linux/generic/pending-6.1/671-net-provide-defines-for-_POLICY_FAILED-until-all-cod.patch b/target/linux/generic/pending-6.1/671-net-provide-defines-for-_POLICY_FAILED-until-all-cod.patch
new file mode 100644
index 00000000000000..94416a5d70e536
--- /dev/null
+++ b/target/linux/generic/pending-6.1/671-net-provide-defines-for-_POLICY_FAILED-until-all-cod.patch
@@ -0,0 +1,50 @@
+From: Jonas Gorski <jogo@openwrt.org>
+Subject: net: provide defines for _POLICY_FAILED until all code is updated
+
+Upstream introduced ICMPV6_POLICY_FAIL for code 5 of destination
+unreachable, conflicting with our name.
+
+Add appropriate defines to allow our code to build with the new
+name until we have updated our local patches for older kernels
+and userspace packages.
+
+Signed-off-by: Jonas Gorski <jogo@openwrt.org>
+---
+ include/uapi/linux/fib_rules.h | 2 ++
+ include/uapi/linux/icmpv6.h    | 2 ++
+ include/uapi/linux/rtnetlink.h | 2 ++
+ 3 files changed, 6 insertions(+)
+
+--- a/include/uapi/linux/fib_rules.h
++++ b/include/uapi/linux/fib_rules.h
+@@ -89,6 +89,8 @@ enum {
+ 	__FR_ACT_MAX,
+ };
+ 
++#define FR_ACT_FAILED_POLICY FR_ACT_POLICY_FAILED
++
+ #define FR_ACT_MAX (__FR_ACT_MAX - 1)
+ 
+ #endif
+--- a/include/uapi/linux/icmpv6.h
++++ b/include/uapi/linux/icmpv6.h
+@@ -126,6 +126,8 @@ struct icmp6hdr {
+ #define ICMPV6_POLICY_FAIL		5
+ #define ICMPV6_REJECT_ROUTE		6
+ 
++#define ICMPV6_FAILED_POLICY		ICMPV6_POLICY_FAIL
++
+ /*
+  *	Codes for Time Exceeded
+  */
+--- a/include/uapi/linux/rtnetlink.h
++++ b/include/uapi/linux/rtnetlink.h
+@@ -269,6 +269,8 @@ enum {
+ 	__RTN_MAX
+ };
+ 
++#define RTN_FAILED_POLICY RTN_POLICY_FAILED
++
+ #define RTN_MAX (__RTN_MAX - 1)
+ 
+ 
diff --git a/target/linux/generic/pending-6.1/680-NET-skip-GRO-for-foreign-MAC-addresses.patch b/target/linux/generic/pending-6.1/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
new file mode 100644
index 00000000000000..9b264b3a05a631
--- /dev/null
+++ b/target/linux/generic/pending-6.1/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
@@ -0,0 +1,151 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: net: replace GRO optimization patch with a new one that supports VLANs/bridges with different MAC addresses
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ include/linux/netdevice.h |  2 ++
+ include/linux/skbuff.h    |  3 ++-
+ net/core/dev.c            | 48 +++++++++++++++++++++++++++++++++++++++++++++++
+ net/ethernet/eth.c        | 18 +++++++++++++++++-
+ 4 files changed, 69 insertions(+), 2 deletions(-)
+
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -2135,6 +2135,8 @@ struct net_device {
+ 	struct netdev_hw_addr_list	mc;
+ 	struct netdev_hw_addr_list	dev_addrs;
+ 
++	unsigned char		local_addr_mask[MAX_ADDR_LEN];
++
+ #ifdef CONFIG_SYSFS
+ 	struct kset		*queues_kset;
+ #endif
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -964,6 +964,7 @@ struct sk_buff {
+ #ifdef CONFIG_IPV6_NDISC_NODETYPE
+ 	__u8			ndisc_nodetype:2;
+ #endif
++	__u8			gro_skip:1;
+ 
+ 	__u8			ipvs_property:1;
+ 	__u8			inner_protocol_type:1;
+--- a/net/core/gro.c
++++ b/net/core/gro.c
+@@ -491,6 +491,9 @@ static enum gro_result dev_gro_receive(s
+ 	int same_flow;
+ 	int grow;
+ 
++	if (skb->gro_skip)
++		goto normal;
++
+ 	if (netif_elide_gro(skb->dev))
+ 		goto normal;
+ 
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -7608,6 +7608,48 @@ static void __netdev_adjacent_dev_unlink
+ 					   &upper_dev->adj_list.lower);
+ }
+ 
++static void __netdev_addr_mask(unsigned char *mask, const unsigned char *addr,
++			       struct net_device *dev)
++{
++	int i;
++
++	for (i = 0; i < dev->addr_len; i++)
++		mask[i] |= addr[i] ^ dev->dev_addr[i];
++}
++
++static void __netdev_upper_mask(unsigned char *mask, struct net_device *dev,
++				struct net_device *lower)
++{
++	struct net_device *cur;
++	struct list_head *iter;
++
++	netdev_for_each_upper_dev_rcu(dev, cur, iter) {
++		__netdev_addr_mask(mask, cur->dev_addr, lower);
++		__netdev_upper_mask(mask, cur, lower);
++	}
++}
++
++static void __netdev_update_addr_mask(struct net_device *dev)
++{
++	unsigned char mask[MAX_ADDR_LEN];
++	struct net_device *cur;
++	struct list_head *iter;
++
++	memset(mask, 0, sizeof(mask));
++	__netdev_upper_mask(mask, dev, dev);
++	memcpy(dev->local_addr_mask, mask, dev->addr_len);
++
++	netdev_for_each_lower_dev(dev, cur, iter)
++		__netdev_update_addr_mask(cur);
++}
++
++static void netdev_update_addr_mask(struct net_device *dev)
++{
++	rcu_read_lock();
++	__netdev_update_addr_mask(dev);
++	rcu_read_unlock();
++}
++
+ static int __netdev_upper_dev_link(struct net_device *dev,
+ 				   struct net_device *upper_dev, bool master,
+ 				   void *upper_priv, void *upper_info,
+@@ -7659,6 +7701,7 @@ static int __netdev_upper_dev_link(struc
+ 	if (ret)
+ 		return ret;
+ 
++	netdev_update_addr_mask(dev);
+ 	ret = call_netdevice_notifiers_info(NETDEV_CHANGEUPPER,
+ 					    &changeupper_info.info);
+ 	ret = notifier_to_errno(ret);
+@@ -7755,6 +7798,7 @@ static void __netdev_upper_dev_unlink(st
+ 
+ 	__netdev_adjacent_dev_unlink_neighbour(dev, upper_dev);
+ 
++	netdev_update_addr_mask(dev);
+ 	call_netdevice_notifiers_info(NETDEV_CHANGEUPPER,
+ 				      &changeupper_info.info);
+ 
+@@ -8807,6 +8851,7 @@ int dev_set_mac_address(struct net_devic
+ 	if (err)
+ 		return err;
+ 	dev->addr_assign_type = NET_ADDR_SET;
++	netdev_update_addr_mask(dev);
+ 	call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
+ 	add_device_randomness(dev->dev_addr, dev->addr_len);
+ 	return 0;
+--- a/net/ethernet/eth.c
++++ b/net/ethernet/eth.c
+@@ -143,6 +143,18 @@ u32 eth_get_headlen(const struct net_dev
+ }
+ EXPORT_SYMBOL(eth_get_headlen);
+ 
++static inline bool
++eth_check_local_mask(const void *addr1, const void *addr2, const void *mask)
++{
++	const u16 *a1 = addr1;
++	const u16 *a2 = addr2;
++	const u16 *m = mask;
++
++	return (((a1[0] ^ a2[0]) & ~m[0]) |
++		((a1[1] ^ a2[1]) & ~m[1]) |
++		((a1[2] ^ a2[2]) & ~m[2]));
++}
++
+ /**
+  * eth_type_trans - determine the packet's protocol ID.
+  * @skb: received socket data
+@@ -174,6 +186,10 @@ __be16 eth_type_trans(struct sk_buff *sk
+ 		} else {
+ 			skb->pkt_type = PACKET_OTHERHOST;
+ 		}
++
++		if (eth_check_local_mask(eth->h_dest, dev->dev_addr,
++					 dev->local_addr_mask))
++			skb->gro_skip = 1;
+ 	}
+ 
+ 	/*
diff --git a/target/linux/generic/pending-6.1/682-of_net-add-mac-address-increment-support.patch b/target/linux/generic/pending-6.1/682-of_net-add-mac-address-increment-support.patch
new file mode 100644
index 00000000000000..f6ae9f31f1fa5d
--- /dev/null
+++ b/target/linux/generic/pending-6.1/682-of_net-add-mac-address-increment-support.patch
@@ -0,0 +1,90 @@
+From 844c273286f328acf0dab5fbd5d864366b4904dc Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Tue, 30 Mar 2021 18:21:14 +0200
+Subject: [PATCH] of_net: add mac-address-increment support
+
+Lots of embedded devices use the mac-address of other interface
+extracted from nvmem cells and increments it by one or two. Add two
+bindings to integrate this and directly use the right mac-address for
+the interface. Some example are some routers that use the gmac
+mac-address stored in the art partition and increments it by one for the
+wifi. mac-address-increment-byte bindings is used to tell what byte of
+the mac-address has to be increased (if not defined the last byte is
+increased) and mac-address-increment tells how much the byte decided
+early has to be increased.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+---
+ net/core/of_net.c | 43 +++++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 39 insertions(+), 4 deletions(-)
+
+--- a/net/core/of_net.c
++++ b/net/core/of_net.c
+@@ -119,28 +119,63 @@ static int of_get_mac_addr_nvmem(struct
+  * this case, the real MAC is in 'local-mac-address', and 'mac-address' exists
+  * but is all zeros.
+  *
++ * DT can tell the system to increment the mac-address after is extracted by
++ * using:
++ * - mac-address-increment-byte to decide what byte to increase
++ *   (if not defined is increased the last byte)
++ * - mac-address-increment to decide how much to increase. The value WILL
++ *   overflow to other bytes if the increment is over 255 or the total
++ *   increment will exceed 255 of the current byte.
++ *   (example 00:01:02:03:04:ff + 1 == 00:01:02:03:05:00)
++ *   (example 00:01:02:03:04:fe + 5 == 00:01:02:03:05:03)
++ *
+  * Return: 0 on success and errno in case of error.
+ */
+ int of_get_mac_address(struct device_node *np, u8 *addr)
+ {
++	u32 inc_idx, mac_inc, mac_val;
+ 	int ret;
+ 
++	/* Check first if the increment byte is present and valid.
++	 * If not set assume to increment the last byte if found.
++	 */
++	if (of_property_read_u32(np, "mac-address-increment-byte", &inc_idx))
++		inc_idx = 5;
++	if (inc_idx < 3 || inc_idx > 5)
++		return -EINVAL;
++
+ 	if (!np)
+ 		return -ENODEV;
+ 
+ 	ret = of_get_mac_addr(np, "mac-address", addr);
+ 	if (!ret)
+-		return 0;
++		goto found;
+ 
+ 	ret = of_get_mac_addr(np, "local-mac-address", addr);
+ 	if (!ret)
+-		return 0;
++		goto found;
+ 
+ 	ret = of_get_mac_addr(np, "address", addr);
+ 	if (!ret)
+-		return 0;
++		goto found;
++
++	ret = of_get_mac_addr_nvmem(np, addr);
++	if (ret)
++		return ret;
++
++found:
++	if (!of_property_read_u32(np, "mac-address-increment", &mac_inc)) {
++		/* Convert to a contiguous value */
++		mac_val = (addr[3] << 16) + (addr[4] << 8) + addr[5];
++		mac_val += mac_inc << 8 * (5-inc_idx);
++
++		/* Apply the incremented value handling overflow case */
++		addr[3] = (mac_val >> 16) & 0xff;
++		addr[4] = (mac_val >> 8) & 0xff;
++		addr[5] = (mac_val >> 0) & 0xff;
++	}
+ 
+-	return of_get_mac_addr_nvmem(np, addr);
++	return ret;
+ }
+ EXPORT_SYMBOL(of_get_mac_address);
+ 
diff --git a/target/linux/generic/pending-6.1/683-of_net-add-mac-address-to-of-tree.patch b/target/linux/generic/pending-6.1/683-of_net-add-mac-address-to-of-tree.patch
new file mode 100644
index 00000000000000..f7ef06a14ad560
--- /dev/null
+++ b/target/linux/generic/pending-6.1/683-of_net-add-mac-address-to-of-tree.patch
@@ -0,0 +1,55 @@
+From 8585756342caa6d27008d1ad0c18023e4211a40a Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 12:22:48 +0200
+Subject: [PATCH] of/of_net: write back netdev MAC-address to device-tree
+
+The label-mac logic relies on the mac-address property of a netdev
+devices of-node. However, the mac address can also be stored as a
+different property or read from e.g. an mtd device.
+
+Create this node when reading a mac-address from OF if it does not
+already exist and copy the mac-address used for the device to this
+property. This way, the MAC address can be accessed using procfs.
+
+---
+ net/core/of_net.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+--- a/net/core/of_net.c
++++ b/net/core/of_net.c
+@@ -95,6 +95,27 @@ static int of_get_mac_addr_nvmem(struct
+ 	return 0;
+ }
+ 
++static int of_add_mac_address(struct device_node *np, u8* addr)
++{
++	struct property *prop;
++
++	prop = kzalloc(sizeof(*prop), GFP_KERNEL);
++	if (!prop)
++		return -ENOMEM;
++
++	prop->name = "mac-address";
++	prop->length = ETH_ALEN;
++	prop->value = kmemdup(addr, ETH_ALEN, GFP_KERNEL);
++	if (!prop->value || of_update_property(np, prop))
++		goto free;
++
++	return 0;
++free:
++	kfree(prop->value);
++	kfree(prop);
++	return -ENOMEM;
++}
++
+ /**
+  * of_get_mac_address()
+  * @np:		Caller's Device Node
+@@ -175,6 +196,7 @@ found:
+ 		addr[5] = (mac_val >> 0) & 0xff;
+ 	}
+ 
++	of_add_mac_address(np, addr);
+ 	return ret;
+ }
+ EXPORT_SYMBOL(of_get_mac_address);
diff --git a/target/linux/generic/pending-6.1/684-of_net-do-mac-address-increment-only-once.patch b/target/linux/generic/pending-6.1/684-of_net-do-mac-address-increment-only-once.patch
new file mode 100644
index 00000000000000..44d88e31a2e750
--- /dev/null
+++ b/target/linux/generic/pending-6.1/684-of_net-do-mac-address-increment-only-once.patch
@@ -0,0 +1,31 @@
+From dd07dd394d8bfdb5d527fab18ca54f20815ec4e4 Mon Sep 17 00:00:00 2001
+From: Will Moss <willormos@gmail.com>
+Date: Wed, 3 Aug 2022 13:48:55 +0000
+Subject: [PATCH] of_net: do mac-address-increment only once
+
+Remove mac-address-increment and mac-address-increment-byte
+DT property after incrementing process to make sure MAC address
+would not get incremented more if this function is stared again.
+It could happen if device initialization is deferred after
+unsuccessful attempt.
+
+Signed-off-by: Will Moss <willormos@gmail.com>
+---
+ drivers/of/of_net.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/core/of_net.c
++++ b/net/core/of_net.c
+@@ -194,6 +194,12 @@ found:
+ 		addr[3] = (mac_val >> 16) & 0xff;
+ 		addr[4] = (mac_val >> 8) & 0xff;
+ 		addr[5] = (mac_val >> 0) & 0xff;
++
++		/* Remove mac-address-increment and mac-address-increment-byte
++		 * DT property to make sure MAC address would not get incremented
++		 * more if this function is stared again. */
++		of_remove_property(np, of_find_property(np, "mac-address-increment", NULL));
++		of_remove_property(np, of_find_property(np, "mac-address-increment-byte", NULL));
+ 	}
+ 
+ 	of_add_mac_address(np, addr);
diff --git a/target/linux/generic/pending-6.1/700-netfilter-nft_flow_offload-handle-netdevice-events-f.patch b/target/linux/generic/pending-6.1/700-netfilter-nft_flow_offload-handle-netdevice-events-f.patch
new file mode 100644
index 00000000000000..182a0cbc6a76b6
--- /dev/null
+++ b/target/linux/generic/pending-6.1/700-netfilter-nft_flow_offload-handle-netdevice-events-f.patch
@@ -0,0 +1,110 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Thu, 25 Jan 2018 12:58:55 +0100
+Subject: [PATCH] netfilter: nft_flow_offload: handle netdevice events from
+ nf_flow_table
+
+Move the code that deals with device events to the core.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -659,6 +659,23 @@ static struct pernet_operations nf_flow_
+ 	.exit_batch = nf_flow_table_pernet_exit,
+ };
+ 
++static int nf_flow_table_netdev_event(struct notifier_block *this,
++				      unsigned long event, void *ptr)
++{
++	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
++
++	if (event != NETDEV_DOWN)
++		return NOTIFY_DONE;
++
++	nf_flow_table_cleanup(dev);
++
++	return NOTIFY_DONE;
++}
++
++static struct notifier_block flow_offload_netdev_notifier = {
++	.notifier_call	= nf_flow_table_netdev_event,
++};
++
+ static int __init nf_flow_table_module_init(void)
+ {
+ 	int ret;
+@@ -671,8 +688,14 @@ static int __init nf_flow_table_module_i
+ 	if (ret)
+ 		goto out_offload;
+ 
++	ret = register_netdevice_notifier(&flow_offload_netdev_notifier);
++	if (ret)
++		goto out_offload_init;
++
+ 	return 0;
+ 
++out_offload_init:
++	nf_flow_table_offload_exit();
+ out_offload:
+ 	unregister_pernet_subsys(&nf_flow_table_net_ops);
+ 	return ret;
+@@ -680,6 +703,7 @@ out_offload:
+ 
+ static void __exit nf_flow_table_module_exit(void)
+ {
++	unregister_netdevice_notifier(&flow_offload_netdev_notifier);
+ 	nf_flow_table_offload_exit();
+ 	unregister_pernet_subsys(&nf_flow_table_net_ops);
+ }
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -468,47 +468,14 @@ static struct nft_expr_type nft_flow_off
+ 	.owner		= THIS_MODULE,
+ };
+ 
+-static int flow_offload_netdev_event(struct notifier_block *this,
+-				     unsigned long event, void *ptr)
+-{
+-	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+-
+-	if (event != NETDEV_DOWN)
+-		return NOTIFY_DONE;
+-
+-	nf_flow_table_cleanup(dev);
+-
+-	return NOTIFY_DONE;
+-}
+-
+-static struct notifier_block flow_offload_netdev_notifier = {
+-	.notifier_call	= flow_offload_netdev_event,
+-};
+-
+ static int __init nft_flow_offload_module_init(void)
+ {
+-	int err;
+-
+-	err = register_netdevice_notifier(&flow_offload_netdev_notifier);
+-	if (err)
+-		goto err;
+-
+-	err = nft_register_expr(&nft_flow_offload_type);
+-	if (err < 0)
+-		goto register_expr;
+-
+-	return 0;
+-
+-register_expr:
+-	unregister_netdevice_notifier(&flow_offload_netdev_notifier);
+-err:
+-	return err;
++	return nft_register_expr(&nft_flow_offload_type);
+ }
+ 
+ static void __exit nft_flow_offload_module_exit(void)
+ {
+ 	nft_unregister_expr(&nft_flow_offload_type);
+-	unregister_netdevice_notifier(&flow_offload_netdev_notifier);
+ }
+ 
+ module_init(nft_flow_offload_module_init);
diff --git a/target/linux/generic/pending-6.1/702-net-ethernet-mtk_eth_soc-enable-threaded-NAPI.patch b/target/linux/generic/pending-6.1/702-net-ethernet-mtk_eth_soc-enable-threaded-NAPI.patch
new file mode 100644
index 00000000000000..7d603f5de3a68b
--- /dev/null
+++ b/target/linux/generic/pending-6.1/702-net-ethernet-mtk_eth_soc-enable-threaded-NAPI.patch
@@ -0,0 +1,41 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 21 Mar 2022 20:39:59 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: enable threaded NAPI
+
+This can improve performance under load by ensuring that NAPI processing is
+not pinned on CPU 0.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3048,8 +3048,8 @@ static irqreturn_t mtk_handle_irq_rx(int
+ 
+ 	eth->rx_events++;
+ 	if (likely(napi_schedule_prep(&eth->rx_napi))) {
+-		__napi_schedule(&eth->rx_napi);
+ 		mtk_rx_irq_disable(eth, eth->soc->txrx.rx_irq_done_mask);
++		__napi_schedule(&eth->rx_napi);
+ 	}
+ 
+ 	return IRQ_HANDLED;
+@@ -3061,8 +3061,8 @@ static irqreturn_t mtk_handle_irq_tx(int
+ 
+ 	eth->tx_events++;
+ 	if (likely(napi_schedule_prep(&eth->tx_napi))) {
+-		__napi_schedule(&eth->tx_napi);
+ 		mtk_tx_irq_disable(eth, MTK_TX_DONE_INT);
++		__napi_schedule(&eth->tx_napi);
+ 	}
+ 
+ 	return IRQ_HANDLED;
+@@ -4727,6 +4727,8 @@ static int mtk_probe(struct platform_dev
+ 	 * for NAPI to work
+ 	 */
+ 	init_dummy_netdev(&eth->dummy_dev);
++	eth->dummy_dev.threaded = 1;
++	strcpy(eth->dummy_dev.name, "mtk_eth");
+ 	netif_napi_add(&eth->dummy_dev, &eth->tx_napi, mtk_napi_tx);
+ 	netif_napi_add(&eth->dummy_dev, &eth->rx_napi, mtk_napi_rx);
+ 
diff --git a/target/linux/generic/pending-6.1/703-phy-add-detach-callback-to-struct-phy_driver.patch b/target/linux/generic/pending-6.1/703-phy-add-detach-callback-to-struct-phy_driver.patch
new file mode 100644
index 00000000000000..8d2803158ece1d
--- /dev/null
+++ b/target/linux/generic/pending-6.1/703-phy-add-detach-callback-to-struct-phy_driver.patch
@@ -0,0 +1,38 @@
+From: Gabor Juhos <juhosg@openwrt.org>
+Subject: generic: add detach callback to struct phy_driver
+
+lede-commit: fe61fc2d7d0b3fb348b502f68f98243b3ddf5867
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/phy/phy_device.c | 3 +++
+ include/linux/phy.h          | 6 ++++++
+ 2 files changed, 9 insertions(+)
+
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -1753,6 +1753,9 @@ void phy_detach(struct phy_device *phyde
+ 	struct module *ndev_owner = NULL;
+ 	struct mii_bus *bus;
+ 
++	if (phydev->drv && phydev->drv->detach)
++		phydev->drv->detach(phydev);
++
+ 	if (phydev->sysfs_links) {
+ 		if (dev)
+ 			sysfs_remove_link(&dev->dev.kobj, "phydev");
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -878,6 +878,12 @@ struct phy_driver {
+ 	/** @handle_interrupt: Override default interrupt handling */
+ 	irqreturn_t (*handle_interrupt)(struct phy_device *phydev);
+ 
++	/*
++	 * Called before an ethernet device is detached
++	 * from the PHY.
++	 */
++	void (*detach)(struct phy_device *phydev);
++
+ 	/** @remove: Clears up any memory if needed */
+ 	void (*remove)(struct phy_device *phydev);
+ 
diff --git a/target/linux/generic/pending-6.1/705-net-dsa-tag_mtk-add-padding-for-tx-packets.patch b/target/linux/generic/pending-6.1/705-net-dsa-tag_mtk-add-padding-for-tx-packets.patch
new file mode 100644
index 00000000000000..d444b2027cb462
--- /dev/null
+++ b/target/linux/generic/pending-6.1/705-net-dsa-tag_mtk-add-padding-for-tx-packets.patch
@@ -0,0 +1,28 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 6 May 2022 21:38:42 +0200
+Subject: [PATCH] net: dsa: tag_mtk: add padding for tx packets
+
+Padding for transmitted packets needs to account for the special tag.
+With not enough padding, garbage bytes are inserted by the switch at the
+end of small packets.
+
+Fixes: 5cd8985a1909 ("net-next: dsa: add Mediatek tag RX/TX handler")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/dsa/tag_mtk.c
++++ b/net/dsa/tag_mtk.c
+@@ -27,6 +27,13 @@ static struct sk_buff *mtk_tag_xmit(stru
+ 
+ 	skb_set_queue_mapping(skb, dp->index);
+ 
++	/* The Ethernet switch we are interfaced with needs packets to be at
++	 * least 64 bytes (including FCS) otherwise their padding might be
++	 * corrupted. With tags enabled, we need to make sure that packets are
++	 * at least 68 bytes (including FCS and tag).
++	 */
++	eth_skb_pad(skb);
++
+ 	/* Build the special tag after the MAC Source Address. If VLAN header
+ 	 * is present, it's required that VLAN header and special tag is
+ 	 * being combined. Only in this way we can allow the switch can parse
diff --git a/target/linux/generic/pending-6.1/710-bridge-add-knob-for-filtering-rx-tx-BPDU-pack.patch b/target/linux/generic/pending-6.1/710-bridge-add-knob-for-filtering-rx-tx-BPDU-pack.patch
new file mode 100644
index 00000000000000..7eb3d8653fad13
--- /dev/null
+++ b/target/linux/generic/pending-6.1/710-bridge-add-knob-for-filtering-rx-tx-BPDU-pack.patch
@@ -0,0 +1,174 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 27 Aug 2021 12:22:32 +0200
+Subject: [PATCH] bridge: add knob for filtering rx/tx BPDU packets on a port
+
+Some devices (e.g. wireless APs) can't have devices behind them be part of
+a bridge topology with redundant links, due to address limitations.
+Additionally, broadcast traffic on these devices is somewhat expensive, due to
+the low data rate and wakeups of clients in powersave mode.
+This knob can be used to ensure that BPDU packets are never sent or forwarded
+to/from these devices
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/linux/if_bridge.h
++++ b/include/linux/if_bridge.h
+@@ -59,6 +59,7 @@ struct br_ip_list {
+ #define BR_MRP_LOST_IN_CONT	BIT(19)
+ #define BR_TX_FWD_OFFLOAD	BIT(20)
+ #define BR_PORT_LOCKED		BIT(21)
++#define BR_BPDU_FILTER		BIT(22)
+ 
+ #define BR_DEFAULT_AGEING_TIME	(300 * HZ)
+ 
+--- a/net/bridge/br_forward.c
++++ b/net/bridge/br_forward.c
+@@ -199,6 +199,7 @@ out:
+ void br_flood(struct net_bridge *br, struct sk_buff *skb,
+ 	      enum br_pkt_type pkt_type, bool local_rcv, bool local_orig)
+ {
++	const unsigned char *dest = eth_hdr(skb)->h_dest;
+ 	struct net_bridge_port *prev = NULL;
+ 	struct net_bridge_port *p;
+ 
+@@ -214,6 +215,10 @@ void br_flood(struct net_bridge *br, str
+ 		case BR_PKT_MULTICAST:
+ 			if (!(p->flags & BR_MCAST_FLOOD) && skb->dev != br->dev)
+ 				continue;
++			if ((p->flags & BR_BPDU_FILTER) &&
++			    unlikely(is_link_local_ether_addr(dest) &&
++				     dest[5] == 0))
++				continue;
+ 			break;
+ 		case BR_PKT_BROADCAST:
+ 			if (!(p->flags & BR_BCAST_FLOOD) && skb->dev != br->dev)
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -344,6 +344,8 @@ static rx_handler_result_t br_handle_fra
+ 		fwd_mask |= p->group_fwd_mask;
+ 		switch (dest[5]) {
+ 		case 0x00:	/* Bridge Group Address */
++			if (p->flags & BR_BPDU_FILTER)
++				goto drop;
+ 			/* If STP is turned off,
+ 			   then must forward to keep loop detection */
+ 			if (p->br->stp_enabled == BR_NO_STP ||
+--- a/net/bridge/br_sysfs_if.c
++++ b/net/bridge/br_sysfs_if.c
+@@ -240,6 +240,7 @@ BRPORT_ATTR_FLAG(multicast_flood, BR_MCA
+ BRPORT_ATTR_FLAG(broadcast_flood, BR_BCAST_FLOOD);
+ BRPORT_ATTR_FLAG(neigh_suppress, BR_NEIGH_SUPPRESS);
+ BRPORT_ATTR_FLAG(isolated, BR_ISOLATED);
++BRPORT_ATTR_FLAG(bpdu_filter, BR_BPDU_FILTER);
+ 
+ #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+ static ssize_t show_multicast_router(struct net_bridge_port *p, char *buf)
+@@ -292,6 +293,7 @@ static const struct brport_attribute *br
+ 	&brport_attr_group_fwd_mask,
+ 	&brport_attr_neigh_suppress,
+ 	&brport_attr_isolated,
++	&brport_attr_bpdu_filter,
+ 	&brport_attr_backup_port,
+ 	NULL
+ };
+--- a/net/bridge/br_stp_bpdu.c
++++ b/net/bridge/br_stp_bpdu.c
+@@ -80,7 +80,8 @@ void br_send_config_bpdu(struct net_brid
+ {
+ 	unsigned char buf[35];
+ 
+-	if (p->br->stp_enabled != BR_KERNEL_STP)
++	if (p->br->stp_enabled != BR_KERNEL_STP ||
++	    (p->flags & BR_BPDU_FILTER))
+ 		return;
+ 
+ 	buf[0] = 0;
+@@ -127,7 +128,8 @@ void br_send_tcn_bpdu(struct net_bridge_
+ {
+ 	unsigned char buf[4];
+ 
+-	if (p->br->stp_enabled != BR_KERNEL_STP)
++	if (p->br->stp_enabled != BR_KERNEL_STP ||
++	    (p->flags & BR_BPDU_FILTER))
+ 		return;
+ 
+ 	buf[0] = 0;
+@@ -172,6 +174,9 @@ void br_stp_rcv(const struct stp_proto *
+ 	if (!(br->dev->flags & IFF_UP))
+ 		goto out;
+ 
++	if (p->flags & BR_BPDU_FILTER)
++		goto out;
++
+ 	if (p->state == BR_STATE_DISABLED)
+ 		goto out;
+ 
+--- a/include/uapi/linux/if_link.h
++++ b/include/uapi/linux/if_link.h
+@@ -561,6 +561,7 @@ enum {
+ 	IFLA_BRPORT_MCAST_EHT_HOSTS_LIMIT,
+ 	IFLA_BRPORT_MCAST_EHT_HOSTS_CNT,
+ 	IFLA_BRPORT_LOCKED,
++	IFLA_BRPORT_BPDU_FILTER,
+ 	__IFLA_BRPORT_MAX
+ };
+ #define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1)
+--- a/net/bridge/br_netlink.c
++++ b/net/bridge/br_netlink.c
+@@ -188,6 +188,7 @@ static inline size_t br_port_info_size(v
+ 		+ nla_total_size(1)	/* IFLA_BRPORT_NEIGH_SUPPRESS */
+ 		+ nla_total_size(1)	/* IFLA_BRPORT_ISOLATED */
+ 		+ nla_total_size(1)	/* IFLA_BRPORT_LOCKED */
++		+ nla_total_size(1)	/* IFLA_BRPORT_BPDU_FILTER */
+ 		+ nla_total_size(sizeof(struct ifla_bridge_id))	/* IFLA_BRPORT_ROOT_ID */
+ 		+ nla_total_size(sizeof(struct ifla_bridge_id))	/* IFLA_BRPORT_BRIDGE_ID */
+ 		+ nla_total_size(sizeof(u16))	/* IFLA_BRPORT_DESIGNATED_PORT */
+@@ -274,7 +275,8 @@ static int br_port_fill_attrs(struct sk_
+ 	    nla_put_u8(skb, IFLA_BRPORT_MRP_IN_OPEN,
+ 		       !!(p->flags & BR_MRP_LOST_IN_CONT)) ||
+ 	    nla_put_u8(skb, IFLA_BRPORT_ISOLATED, !!(p->flags & BR_ISOLATED)) ||
+-	    nla_put_u8(skb, IFLA_BRPORT_LOCKED, !!(p->flags & BR_PORT_LOCKED)))
++	    nla_put_u8(skb, IFLA_BRPORT_LOCKED, !!(p->flags & BR_PORT_LOCKED)) ||
++	    nla_put_u8(skb, IFLA_BRPORT_BPDU_FILTER, !!(p->flags & BR_BPDU_FILTER)))
+ 		return -EMSGSIZE;
+ 
+ 	timerval = br_timer_value(&p->message_age_timer);
+@@ -878,6 +880,7 @@ static const struct nla_policy br_port_p
+ 	[IFLA_BRPORT_LOCKED] = { .type = NLA_U8 },
+ 	[IFLA_BRPORT_BACKUP_PORT] = { .type = NLA_U32 },
+ 	[IFLA_BRPORT_MCAST_EHT_HOSTS_LIMIT] = { .type = NLA_U32 },
++	[IFLA_BRPORT_BPDU_FILTER] = { .type = NLA_U8 },
+ };
+ 
+ /* Change the state of the port and notify spanning tree */
+@@ -943,6 +946,7 @@ static int br_setport(struct net_bridge_
+ 	br_set_port_flag(p, tb, IFLA_BRPORT_NEIGH_SUPPRESS, BR_NEIGH_SUPPRESS);
+ 	br_set_port_flag(p, tb, IFLA_BRPORT_ISOLATED, BR_ISOLATED);
+ 	br_set_port_flag(p, tb, IFLA_BRPORT_LOCKED, BR_PORT_LOCKED);
++	br_set_port_flag(p, tb, IFLA_BRPORT_BPDU_FILTER, BR_BPDU_FILTER);
+ 
+ 	changed_mask = old_flags ^ p->flags;
+ 
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -57,7 +57,7 @@
+ #include "dev.h"
+ 
+ #define RTNL_MAX_TYPE		50
+-#define RTNL_SLAVE_MAX_TYPE	40
++#define RTNL_SLAVE_MAX_TYPE	41
+ 
+ struct rtnl_link {
+ 	rtnl_doit_func		doit;
+@@ -4817,7 +4817,9 @@ int ndo_dflt_bridge_getlink(struct sk_bu
+ 	    brport_nla_put_flag(skb, flags, mask,
+ 				IFLA_BRPORT_MCAST_FLOOD, BR_MCAST_FLOOD) ||
+ 	    brport_nla_put_flag(skb, flags, mask,
+-				IFLA_BRPORT_BCAST_FLOOD, BR_BCAST_FLOOD)) {
++				IFLA_BRPORT_BCAST_FLOOD, BR_BCAST_FLOOD) ||
++	    brport_nla_put_flag(skb, flags, mask,
++				IFLA_BRPORT_BPDU_FILTER, BR_BPDU_FILTER)) {
+ 		nla_nest_cancel(skb, protinfo);
+ 		goto nla_put_failure;
+ 	}
diff --git a/target/linux/generic/pending-6.1/721-net-phy-realtek-rtl8221-allow-to-configure-SERDES-mo.patch b/target/linux/generic/pending-6.1/721-net-phy-realtek-rtl8221-allow-to-configure-SERDES-mo.patch
new file mode 100644
index 00000000000000..f29e690350cb0d
--- /dev/null
+++ b/target/linux/generic/pending-6.1/721-net-phy-realtek-rtl8221-allow-to-configure-SERDES-mo.patch
@@ -0,0 +1,106 @@
+From ace6abaa0f9203083fe4c0a6a74da2d96410b625 Mon Sep 17 00:00:00 2001
+From: Alexander Couzens <lynxis@fe80.eu>
+Date: Sat, 13 Aug 2022 12:49:33 +0200
+Subject: [PATCH 01/10] net: phy: realtek: rtl8221: allow to configure SERDES
+ mode
+
+The rtl8221 supports multiple SERDES modes:
+- SGMII
+- 2500base-x
+- HiSGMII
+
+Further it supports rate adaption on SERDES links to allow
+slow ethernet speeds (10/100/1000mbit) to work on 2500base-x/HiSGMII
+links without reducing the SERDES speed.
+
+When operating without rate adapters the SERDES link will follow the
+ethernet speed.
+
+Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
+---
+ drivers/net/phy/realtek.c | 48 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 48 insertions(+)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -53,6 +53,15 @@
+ 						 RTL8201F_ISR_LINK)
+ #define RTL8201F_IER				0x13
+ 
++#define RTL8221B_MMD_SERDES_CTRL		MDIO_MMD_VEND1
++#define RTL8221B_MMD_PHY_CTRL			MDIO_MMD_VEND2
++#define RTL8221B_SERDES_OPTION			0x697a
++#define RTL8221B_SERDES_OPTION_MODE_MASK	GENMASK(5, 0)
++#define RTL8221B_SERDES_OPTION_MODE_2500BASEX_SGMII	0
++#define RTL8221B_SERDES_OPTION_MODE_HISGMII_SGMII	1
++#define RTL8221B_SERDES_OPTION_MODE_2500BASEX		2
++#define RTL8221B_SERDES_OPTION_MODE_HISGMII		3
++
+ #define RTL8366RB_POWER_SAVE			0x15
+ #define RTL8366RB_POWER_SAVE_ON			BIT(12)
+ 
+@@ -849,6 +858,48 @@ static irqreturn_t rtl9000a_handle_inter
+ 	return IRQ_HANDLED;
+ }
+ 
++static int rtl8221b_config_init(struct phy_device *phydev)
++{
++	u16 option_mode;
++
++	switch (phydev->interface) {
++	case PHY_INTERFACE_MODE_2500BASEX:
++		if (!phydev->is_c45) {
++			option_mode = RTL8221B_SERDES_OPTION_MODE_2500BASEX;
++			break;
++		}
++		fallthrough;
++	case PHY_INTERFACE_MODE_SGMII:
++		option_mode = RTL8221B_SERDES_OPTION_MODE_2500BASEX_SGMII;
++		break;
++	default:
++		return 0;
++	}
++
++	phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL,
++		      0x75f3, 0);
++
++	phy_modify_mmd_changed(phydev, RTL8221B_MMD_SERDES_CTRL,
++			       RTL8221B_SERDES_OPTION,
++			       RTL8221B_SERDES_OPTION_MODE_MASK, option_mode);
++	switch (option_mode) {
++	case RTL8221B_SERDES_OPTION_MODE_2500BASEX_SGMII:
++	case RTL8221B_SERDES_OPTION_MODE_2500BASEX:
++		phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x6a04, 0x0503);
++		phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x6f10, 0xd455);
++		phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x6f11, 0x8020);
++		break;
++	case RTL8221B_SERDES_OPTION_MODE_HISGMII_SGMII:
++	case RTL8221B_SERDES_OPTION_MODE_HISGMII:
++		phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x6a04, 0x0503);
++		phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x6f10, 0xd433);
++		phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x6f11, 0x8020);
++		break;
++	}
++
++	return 0;
++}
++
+ static struct phy_driver realtek_drvs[] = {
+ 	{
+ 		PHY_ID_MATCH_EXACT(0x00008201),
+@@ -1001,6 +1052,7 @@ static struct phy_driver realtek_drvs[]
+ 		PHY_ID_MATCH_EXACT(0x001cc849),
+ 		.name           = "RTL8221B-VB-CG 2.5Gbps PHY",
+ 		.get_features   = rtl822x_get_features,
++		.config_init    = rtl8221b_config_init,
+ 		.config_aneg    = rtl822x_config_aneg,
+ 		.read_status    = rtl822x_read_status,
+ 		.suspend        = genphy_suspend,
+@@ -1012,6 +1064,7 @@ static struct phy_driver realtek_drvs[]
+ 		.name           = "RTL8221B-VM-CG 2.5Gbps PHY",
+ 		.get_features   = rtl822x_get_features,
+ 		.config_aneg    = rtl822x_config_aneg,
++		.config_init    = rtl8221b_config_init,
+ 		.read_status    = rtl822x_read_status,
+ 		.suspend        = genphy_suspend,
+ 		.resume         = rtlgen_resume,
diff --git a/target/linux/generic/pending-6.1/722-net-phy-realtek-support-switching-between-SGMII-and-.patch b/target/linux/generic/pending-6.1/722-net-phy-realtek-support-switching-between-SGMII-and-.patch
new file mode 100644
index 00000000000000..b236c0816c291c
--- /dev/null
+++ b/target/linux/generic/pending-6.1/722-net-phy-realtek-support-switching-between-SGMII-and-.patch
@@ -0,0 +1,61 @@
+From 312753d0aadba0f58841ae513b80fdbabc887523 Mon Sep 17 00:00:00 2001
+From: Chukun Pan <amadeus@jmu.edu.cn>
+Date: Wed, 8 Feb 2023 16:32:18 +0800
+Subject: [PATCH] net: phy: realtek: support switching between SGMII and
+ 2500BASE-X for RTL822x series
+
+After commit ace6aba ("net: phy: realtek: rtl8221: allow to configure
+SERDES mode"), the rtl8221 phy can work in SGMII and 2500base-x modes
+respectively. So add interface automatic switching for rtl8221 phy to
+match various wire speeds.
+
+Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
+---
+ drivers/net/phy/realtek.c | 26 ++++++++++++++++++++++++--
+ 1 file changed, 24 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -684,6 +684,25 @@ static int rtl822x_config_aneg(struct ph
+ 	return __genphy_config_aneg(phydev, ret);
+ }
+ 
++static void rtl822x_update_interface(struct phy_device *phydev)
++{
++	/* Automatically switch SERDES interface between
++	 * SGMII and 2500-BaseX according to speed.
++	 */
++	switch (phydev->speed) {
++	case SPEED_2500:
++		phydev->interface = PHY_INTERFACE_MODE_2500BASEX;
++		break;
++	case SPEED_1000:
++	case SPEED_100:
++	case SPEED_10:
++		phydev->interface = PHY_INTERFACE_MODE_SGMII;
++		break;
++	default:
++		break;
++	}
++}
++
+ static int rtl822x_read_status(struct phy_device *phydev)
+ {
+ 	int ret;
+@@ -702,11 +721,14 @@ static int rtl822x_read_status(struct ph
+ 			phydev->lp_advertising, lpadv & RTL_LPADV_2500FULL);
+ 	}
+ 
+-	ret = genphy_read_status(phydev);
++	ret = rtlgen_read_status(phydev);
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	return rtlgen_get_speed(phydev);
++	if (phydev->is_c45 && phydev->link)
++		rtl822x_update_interface(phydev);
++
++	return 0;
+ }
+ 
+ static bool rtlgen_supports_2_5gbps(struct phy_device *phydev)
diff --git a/target/linux/generic/pending-6.1/723-net-mt7531-ensure-all-MACs-are-powered-down-before-r.patch b/target/linux/generic/pending-6.1/723-net-mt7531-ensure-all-MACs-are-powered-down-before-r.patch
new file mode 100644
index 00000000000000..00a43e3e55187b
--- /dev/null
+++ b/target/linux/generic/pending-6.1/723-net-mt7531-ensure-all-MACs-are-powered-down-before-r.patch
@@ -0,0 +1,28 @@
+From 3fb8841513c4ec3a2e5d366df86230c45f239a57 Mon Sep 17 00:00:00 2001
+From: Alexander Couzens <lynxis@fe80.eu>
+Date: Sat, 13 Aug 2022 13:08:22 +0200
+Subject: [PATCH 03/10] net: mt7531: ensure all MACs are powered down before
+ reset
+
+The datasheet [1] explicit describes it as requirement for a reset.
+
+[1] MT7531 Reference Manual for Development Board rev 1.0, page 735
+
+Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
+---
+ drivers/net/dsa/mt7530.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -2236,6 +2236,10 @@ mt7530_setup(struct dsa_switch *ds)
+ 		return -ENODEV;
+ 	}
+ 
++	/* all MACs must be forced link-down before sw reset */
++	for (i = 0; i < MT7530_NUM_PORTS; i++)
++		mt7530_write(priv, MT7530_PMCR_P(i), MT7531_FORCE_LNK);
++
+ 	/* Reset the switch through internal reset */
+ 	mt7530_write(priv, MT7530_SYS_CTRL,
+ 		     SYS_CTRL_PHY_RST | SYS_CTRL_SW_RST |
diff --git a/target/linux/generic/pending-6.1/724-net-phy-realtek-use-genphy_soft_reset-for-2.5G-PHYs.patch b/target/linux/generic/pending-6.1/724-net-phy-realtek-use-genphy_soft_reset-for-2.5G-PHYs.patch
new file mode 100644
index 00000000000000..cdc181763780c6
--- /dev/null
+++ b/target/linux/generic/pending-6.1/724-net-phy-realtek-use-genphy_soft_reset-for-2.5G-PHYs.patch
@@ -0,0 +1,65 @@
+From 85cd45580f5e3b26068cccb7d6173f200e754dc0 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sun, 2 Apr 2023 23:56:16 +0100
+Subject: [PATCH 1/2] net: phy: realtek: use genphy_soft_reset for 2.5G PHYs
+
+Some vendor bootloaders do weird things with those PHYs which result in
+link modes being reported wrongly. Start from a clean sheet by resetting
+the PHY.
+
+Reported-by: Yevhen Kolomeiko <jarvis2709@gmail.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/realtek.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -1038,6 +1038,7 @@ static struct phy_driver realtek_drvs[]
+ 		.write_page	= rtl821x_write_page,
+ 		.read_mmd	= rtl822x_read_mmd,
+ 		.write_mmd	= rtl822x_write_mmd,
++		.soft_reset     = genphy_soft_reset,
+ 	}, {
+ 		PHY_ID_MATCH_EXACT(0x001cc840),
+ 		.name		= "RTL8226B_RTL8221B 2.5Gbps PHY",
+@@ -1050,6 +1051,7 @@ static struct phy_driver realtek_drvs[]
+ 		.write_page	= rtl821x_write_page,
+ 		.read_mmd	= rtl822x_read_mmd,
+ 		.write_mmd	= rtl822x_write_mmd,
++		.soft_reset     = genphy_soft_reset,
+ 	}, {
+ 		PHY_ID_MATCH_EXACT(0x001cc838),
+ 		.name           = "RTL8226-CG 2.5Gbps PHY",
+@@ -1060,6 +1062,7 @@ static struct phy_driver realtek_drvs[]
+ 		.resume         = rtlgen_resume,
+ 		.read_page      = rtl821x_read_page,
+ 		.write_page     = rtl821x_write_page,
++		.soft_reset     = genphy_soft_reset,
+ 	}, {
+ 		PHY_ID_MATCH_EXACT(0x001cc848),
+ 		.name           = "RTL8226B-CG_RTL8221B-CG 2.5Gbps PHY",
+@@ -1070,6 +1073,7 @@ static struct phy_driver realtek_drvs[]
+ 		.resume         = rtlgen_resume,
+ 		.read_page      = rtl821x_read_page,
+ 		.write_page     = rtl821x_write_page,
++		.soft_reset     = genphy_soft_reset,
+ 	}, {
+ 		PHY_ID_MATCH_EXACT(0x001cc849),
+ 		.name           = "RTL8221B-VB-CG 2.5Gbps PHY",
+@@ -1081,6 +1085,7 @@ static struct phy_driver realtek_drvs[]
+ 		.resume         = rtlgen_resume,
+ 		.read_page      = rtl821x_read_page,
+ 		.write_page     = rtl821x_write_page,
++		.soft_reset     = genphy_soft_reset,
+ 	}, {
+ 		PHY_ID_MATCH_EXACT(0x001cc84a),
+ 		.name           = "RTL8221B-VM-CG 2.5Gbps PHY",
+@@ -1092,6 +1097,7 @@ static struct phy_driver realtek_drvs[]
+ 		.resume         = rtlgen_resume,
+ 		.read_page      = rtl821x_read_page,
+ 		.write_page     = rtl821x_write_page,
++		.soft_reset     = genphy_soft_reset,
+ 	}, {
+ 		PHY_ID_MATCH_EXACT(0x001cc961),
+ 		.name		= "RTL8366RB Gigabit Ethernet",
diff --git a/target/linux/generic/pending-6.1/725-net-phy-realtek-disable-SGMII-in-band-AN-for-2-5G-PHYs.patch b/target/linux/generic/pending-6.1/725-net-phy-realtek-disable-SGMII-in-band-AN-for-2-5G-PHYs.patch
new file mode 100644
index 00000000000000..d709a79099945e
--- /dev/null
+++ b/target/linux/generic/pending-6.1/725-net-phy-realtek-disable-SGMII-in-band-AN-for-2-5G-PHYs.patch
@@ -0,0 +1,43 @@
+From 2b1b8c4c215af7988136401c902338d091d408a1 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 01:21:57 +0300
+Subject: [PATCH 2/2] net: phy: realtek: disable SGMII in-band AN for 2.5G PHYs
+
+MAC drivers don't use SGMII in-band autonegotiation unless told to do so
+in device tree using 'managed = "in-band-status"'. When using MDIO to
+access a PHY, in-band-status is unneeded as we have link-status via
+MDIO. Switch off SGMII in-band autonegotiation using magic values.
+
+Reported-by: Chen Minqiang <ptpt52@gmail.com>
+Reported-by: Chukun Pan <amadeus@jmu.edu.cn>
+Reported-by: Yevhen Kolomeiko <jarvis2709@gmail.com>
+Tested-by: Yevhen Kolomeiko <jarvis2709@gmail.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/realtek.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -883,6 +883,7 @@ static irqreturn_t rtl9000a_handle_inter
+ static int rtl8221b_config_init(struct phy_device *phydev)
+ {
+ 	u16 option_mode;
++	int val;
+ 
+ 	switch (phydev->interface) {
+ 	case PHY_INTERFACE_MODE_2500BASEX:
+@@ -919,6 +920,13 @@ static int rtl8221b_config_init(struct p
+ 		break;
+ 	}
+ 
++	/* Disable SGMII AN */
++	phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x7588, 0x2);
++	phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x7589, 0x71d0);
++	phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, 0x7587, 0x3);
++	phy_read_mmd_poll_timeout(phydev, RTL8221B_MMD_SERDES_CTRL, 0x7587,
++				  val, !(val & BIT(0)), 500, 100000, false);
++
+ 	return 0;
+ }
+ 
diff --git a/target/linux/generic/pending-6.1/726-net-phy-realtek-make-sure-paged-read-is-protected-by.patch b/target/linux/generic/pending-6.1/726-net-phy-realtek-make-sure-paged-read-is-protected-by.patch
new file mode 100644
index 00000000000000..986e842e1c3665
--- /dev/null
+++ b/target/linux/generic/pending-6.1/726-net-phy-realtek-make-sure-paged-read-is-protected-by.patch
@@ -0,0 +1,35 @@
+From 4dd2cc9b91ecb25f278a2c55e07e6455e9000e6b Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 22 Apr 2023 01:21:14 +0100
+Subject: [PATCH] net: phy: realtek: make sure paged read is protected by mutex
+
+As we cannot rely on phy_read_paged function before the PHY is
+identified, the paged read in rtlgen_supports_2_5gbps needs to be open
+coded as it is being called by the match_phy_device function, ie. before
+.read_page and .write_page have been populated.
+
+Make sure it is also protected by the MDIO bus mutex and use
+rtl821x_write_page instead of 3 individually locked MDIO bus operations.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/realtek.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -735,9 +735,11 @@ static bool rtlgen_supports_2_5gbps(stru
+ {
+ 	int val;
+ 
+-	phy_write(phydev, RTL821x_PAGE_SELECT, 0xa61);
+-	val = phy_read(phydev, 0x13);
+-	phy_write(phydev, RTL821x_PAGE_SELECT, 0);
++	mutex_lock(&phydev->mdio.bus->mdio_lock);
++	rtl821x_write_page(phydev, 0xa61);
++	val = __phy_read(phydev, 0x13);
++	rtl821x_write_page(phydev, 0);
++	mutex_unlock(&phydev->mdio.bus->mdio_lock);
+ 
+ 	return val >= 0 && val & RTL_SUPPORTS_2500FULL;
+ }
diff --git a/target/linux/generic/pending-6.1/727-net-phy-realtek-use-inline-functions-for-10GbE-adver.patch b/target/linux/generic/pending-6.1/727-net-phy-realtek-use-inline-functions-for-10GbE-adver.patch
new file mode 100644
index 00000000000000..717ece0d5e6243
--- /dev/null
+++ b/target/linux/generic/pending-6.1/727-net-phy-realtek-use-inline-functions-for-10GbE-adver.patch
@@ -0,0 +1,60 @@
+From 92c8b9d558160d94b981dd8a2b9c47657627ffdc Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 22 Apr 2023 01:23:08 +0100
+Subject: [PATCH 2/3] net: phy: realtek: use inline functions for 10GbE
+ advertisement
+
+Use existing generic inline functions to encode local advertisement
+of 10GbE link modes as well as to decode link-partner advertisement.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/realtek.c | 22 +++++-----------------
+ 1 file changed, 5 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -68,10 +68,6 @@
+ #define RTL_SUPPORTS_5000FULL			BIT(14)
+ #define RTL_SUPPORTS_2500FULL			BIT(13)
+ #define RTL_SUPPORTS_10000FULL			BIT(0)
+-#define RTL_ADV_2500FULL			BIT(7)
+-#define RTL_LPADV_10000FULL			BIT(11)
+-#define RTL_LPADV_5000FULL			BIT(6)
+-#define RTL_LPADV_2500FULL			BIT(5)
+ 
+ #define RTL9000A_GINMR				0x14
+ #define RTL9000A_GINMR_LINK_STATUS		BIT(4)
+@@ -669,14 +665,11 @@ static int rtl822x_config_aneg(struct ph
+ 	int ret = 0;
+ 
+ 	if (phydev->autoneg == AUTONEG_ENABLE) {
+-		u16 adv2500 = 0;
+-
+-		if (linkmode_test_bit(ETHTOOL_LINK_MODE_2500baseT_Full_BIT,
+-				      phydev->advertising))
+-			adv2500 = RTL_ADV_2500FULL;
+-
+ 		ret = phy_modify_paged_changed(phydev, 0xa5d, 0x12,
+-					       RTL_ADV_2500FULL, adv2500);
++					       MDIO_AN_10GBT_CTRL_ADV10G |
++					       MDIO_AN_10GBT_CTRL_ADV5G |
++					       MDIO_AN_10GBT_CTRL_ADV2_5G,
++			linkmode_adv_to_mii_10gbt_adv_t(phydev->advertising));
+ 		if (ret < 0)
+ 			return ret;
+ 	}
+@@ -713,12 +706,7 @@ static int rtl822x_read_status(struct ph
+ 		if (lpadv < 0)
+ 			return lpadv;
+ 
+-		linkmode_mod_bit(ETHTOOL_LINK_MODE_10000baseT_Full_BIT,
+-			phydev->lp_advertising, lpadv & RTL_LPADV_10000FULL);
+-		linkmode_mod_bit(ETHTOOL_LINK_MODE_5000baseT_Full_BIT,
+-			phydev->lp_advertising, lpadv & RTL_LPADV_5000FULL);
+-		linkmode_mod_bit(ETHTOOL_LINK_MODE_2500baseT_Full_BIT,
+-			phydev->lp_advertising, lpadv & RTL_LPADV_2500FULL);
++		mii_10gbt_stat_mod_linkmode_lpa_t(phydev->lp_advertising, lpadv);
+ 	}
+ 
+ 	ret = rtlgen_read_status(phydev);
diff --git a/target/linux/generic/pending-6.1/728-net-phy-realtek-check-validity-of-10GbE-link-partner.patch b/target/linux/generic/pending-6.1/728-net-phy-realtek-check-validity-of-10GbE-link-partner.patch
new file mode 100644
index 00000000000000..bae24a2ec998fb
--- /dev/null
+++ b/target/linux/generic/pending-6.1/728-net-phy-realtek-check-validity-of-10GbE-link-partner.patch
@@ -0,0 +1,28 @@
+From 929bb4d3cfbc7878326c0771a01a636d49c54b40 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 22 Apr 2023 01:25:39 +0100
+Subject: [PATCH 3/3] net: phy: realtek: check validity of 10GbE link-partner
+ advertisement
+
+Only use link-partner advertisement bits for 10GbE modes if they are
+actually valid. Check LOCALOK and REMOTEOK bits and clear 10GbE modes
+unless both of them are set.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/realtek.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -706,6 +706,10 @@ static int rtl822x_read_status(struct ph
+ 		if (lpadv < 0)
+ 			return lpadv;
+ 
++		if (!(lpadv & MDIO_AN_10GBT_STAT_REMOK) ||
++		    !(lpadv & MDIO_AN_10GBT_STAT_LOCOK))
++			lpadv = 0;
++
+ 		mii_10gbt_stat_mod_linkmode_lpa_t(phydev->lp_advertising, lpadv);
+ 	}
+ 
diff --git a/target/linux/generic/pending-6.1/729-net-phy-realtek-introduce-rtl822x_probe.patch b/target/linux/generic/pending-6.1/729-net-phy-realtek-introduce-rtl822x_probe.patch
new file mode 100644
index 00000000000000..b5dbfa383a2b64
--- /dev/null
+++ b/target/linux/generic/pending-6.1/729-net-phy-realtek-introduce-rtl822x_probe.patch
@@ -0,0 +1,100 @@
+From 9155098547fb1172d4fa536f3f6bc9d42f59d08c Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 22 Apr 2023 03:26:01 +0100
+Subject: [PATCH] net: phy: realtek: setup ALDPS on RTL822x
+
+Setup Link Down Power Saving Mode according the DTS property
+just like for RTL821x 1GE PHYs.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/realtek.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -62,6 +62,10 @@
+ #define RTL8221B_SERDES_OPTION_MODE_2500BASEX		2
+ #define RTL8221B_SERDES_OPTION_MODE_HISGMII		3
+ 
++#define RTL8221B_PHYCR1				0xa430
++#define RTL8221B_PHYCR1_ALDPS_EN		BIT(2)
++#define RTL8221B_PHYCR1_ALDPS_XTAL_OFF_EN	BIT(12)
++
+ #define RTL8366RB_POWER_SAVE			0x15
+ #define RTL8366RB_POWER_SAVE_ON			BIT(12)
+ 
+@@ -748,6 +752,25 @@ static int rtl8226_match_phy_device(stru
+ 	       rtlgen_supports_2_5gbps(phydev);
+ }
+ 
++static int rtl822x_probe(struct phy_device *phydev)
++{
++	struct device *dev = &phydev->mdio.dev;
++	int val;
++
++	val = phy_read_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, RTL8221B_PHYCR1);
++	if (val < 0)
++		return val;
++
++	if (of_property_read_bool(dev->of_node, "realtek,aldps-enable"))
++		val |= RTL8221B_PHYCR1_ALDPS_EN | RTL8221B_PHYCR1_ALDPS_XTAL_OFF_EN;
++	else
++		val &= ~(RTL8221B_PHYCR1_ALDPS_EN | RTL8221B_PHYCR1_ALDPS_XTAL_OFF_EN);
++
++	phy_write_mmd(phydev, RTL8221B_MMD_SERDES_CTRL, RTL8221B_PHYCR1, val);
++
++	return 0;
++}
++
+ static int rtlgen_resume(struct phy_device *phydev)
+ {
+ 	int ret = genphy_resume(phydev);
+@@ -1033,6 +1056,7 @@ static struct phy_driver realtek_drvs[]
+ 		.match_phy_device = rtl8226_match_phy_device,
+ 		.get_features	= rtl822x_get_features,
+ 		.config_aneg	= rtl822x_config_aneg,
++		.probe          = rtl822x_probe,
+ 		.read_status	= rtl822x_read_status,
+ 		.suspend	= genphy_suspend,
+ 		.resume		= rtlgen_resume,
+@@ -1046,6 +1070,7 @@ static struct phy_driver realtek_drvs[]
+ 		.name		= "RTL8226B_RTL8221B 2.5Gbps PHY",
+ 		.get_features	= rtl822x_get_features,
+ 		.config_aneg	= rtl822x_config_aneg,
++		.probe          = rtl822x_probe,
+ 		.read_status	= rtl822x_read_status,
+ 		.suspend	= genphy_suspend,
+ 		.resume		= rtlgen_resume,
+@@ -1059,6 +1084,7 @@ static struct phy_driver realtek_drvs[]
+ 		.name           = "RTL8226-CG 2.5Gbps PHY",
+ 		.get_features   = rtl822x_get_features,
+ 		.config_aneg    = rtl822x_config_aneg,
++		.probe          = rtl822x_probe,
+ 		.read_status    = rtl822x_read_status,
+ 		.suspend        = genphy_suspend,
+ 		.resume         = rtlgen_resume,
+@@ -1070,6 +1096,7 @@ static struct phy_driver realtek_drvs[]
+ 		.name           = "RTL8226B-CG_RTL8221B-CG 2.5Gbps PHY",
+ 		.get_features   = rtl822x_get_features,
+ 		.config_aneg    = rtl822x_config_aneg,
++		.probe          = rtl822x_probe,
+ 		.read_status    = rtl822x_read_status,
+ 		.suspend        = genphy_suspend,
+ 		.resume         = rtlgen_resume,
+@@ -1082,6 +1109,7 @@ static struct phy_driver realtek_drvs[]
+ 		.get_features   = rtl822x_get_features,
+ 		.config_init    = rtl8221b_config_init,
+ 		.config_aneg    = rtl822x_config_aneg,
++		.probe          = rtl822x_probe,
+ 		.read_status    = rtl822x_read_status,
+ 		.suspend        = genphy_suspend,
+ 		.resume         = rtlgen_resume,
+@@ -1094,6 +1122,7 @@ static struct phy_driver realtek_drvs[]
+ 		.get_features   = rtl822x_get_features,
+ 		.config_aneg    = rtl822x_config_aneg,
+ 		.config_init    = rtl8221b_config_init,
++		.probe          = rtl822x_probe,
+ 		.read_status    = rtl822x_read_status,
+ 		.suspend        = genphy_suspend,
+ 		.resume         = rtlgen_resume,
diff --git a/target/linux/generic/pending-6.1/730-net-phy-realtek-detect-early-version-of-RTL8221B.patch b/target/linux/generic/pending-6.1/730-net-phy-realtek-detect-early-version-of-RTL8221B.patch
new file mode 100644
index 00000000000000..ac385551516f1f
--- /dev/null
+++ b/target/linux/generic/pending-6.1/730-net-phy-realtek-detect-early-version-of-RTL8221B.patch
@@ -0,0 +1,63 @@
+From 0de82310d2b32e78ff79d42c08b1122a6ede3778 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sun, 30 Apr 2023 00:15:41 +0100
+Subject: [PATCH] net: phy: realtek: detect early version of RTL8221B
+
+Early versions (?) of the RTL8221B PHY cannot be identified in a regular
+Clause-45 bus scan as the PHY doesn't report the implemented MMDs
+correctly but returns 0 instead.
+Implement custom identify function using the PKGID instead of iterating
+over the implemented MMDs.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -752,6 +752,38 @@ static int rtl8226_match_phy_device(stru
+ 	       rtlgen_supports_2_5gbps(phydev);
+ }
+ 
++static int rtl8221b_vb_cg_match_phy_device(struct phy_device *phydev)
++{
++	int val;
++	u32 id;
++
++	if (phydev->mdio.bus->probe_capabilities >= MDIOBUS_C45) {
++		val = phy_read_mmd(phydev, MDIO_MMD_PMAPMD, MDIO_PKGID1);
++		if (val < 0)
++			return 0;
++
++		id = val << 16;
++		val = phy_read_mmd(phydev, MDIO_MMD_PMAPMD, MDIO_PKGID2);
++		if (val < 0)
++			return 0;
++
++		id |= val;
++	} else {
++		val = phy_read(phydev, MII_PHYSID1);
++		if (val < 0)
++			return 0;
++
++		id = val << 16;
++		val = phy_read(phydev, MII_PHYSID2);
++		if (val < 0)
++			return 0;
++
++		id |= val;
++	}
++
++	return (id == 0x001cc849);
++}
++
+ static int rtl822x_probe(struct phy_device *phydev)
+ {
+ 	struct device *dev = &phydev->mdio.dev;
+@@ -1104,7 +1136,7 @@ static struct phy_driver realtek_drvs[]
+ 		.write_page     = rtl821x_write_page,
+ 		.soft_reset     = genphy_soft_reset,
+ 	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc849),
++		.match_phy_device = rtl8221b_vb_cg_match_phy_device,
+ 		.name           = "RTL8221B-VB-CG 2.5Gbps PHY",
+ 		.get_features   = rtl822x_get_features,
+ 		.config_init    = rtl8221b_config_init,
diff --git a/target/linux/generic/pending-6.1/731-net-ethernet-mediatek-ppe-add-support-for-flow-accou.patch b/target/linux/generic/pending-6.1/731-net-ethernet-mediatek-ppe-add-support-for-flow-accou.patch
new file mode 100644
index 00000000000000..e18b1d0ee8ed62
--- /dev/null
+++ b/target/linux/generic/pending-6.1/731-net-ethernet-mediatek-ppe-add-support-for-flow-accou.patch
@@ -0,0 +1,428 @@
+From patchwork Wed Nov  2 00:58:01 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 13027653
+X-Patchwork-Delegate: kuba@kernel.org
+Return-Path: <netdev-owner@kernel.org>
+Date: Wed, 2 Nov 2022 00:58:01 +0000
+From: Daniel Golle <daniel@makrotopia.org>
+To: Felix Fietkau <nbd@nbd.name>, John Crispin <john@phrozen.org>,
+        Sean Wang <sean.wang@mediatek.com>,
+        Mark Lee <Mark-MC.Lee@mediatek.com>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Matthias Brugger <matthias.bgg@gmail.com>,
+        netdev@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
+        linux-mediatek@lists.infradead.org, linux-kernel@vger.kernel.org
+Subject: [PATCH v4] net: ethernet: mediatek: ppe: add support for flow
+ accounting
+Message-ID: <Y2HAmYYPd77dz+K5@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+Precedence: bulk
+List-ID: <netdev.vger.kernel.org>
+X-Mailing-List: netdev@vger.kernel.org
+X-Patchwork-Delegate: kuba@kernel.org
+
+The PPE units found in MT7622 and newer support packet and byte
+accounting of hw-offloaded flows. Add support for reading those
+counters as found in MediaTek's SDK[1].
+
+[1]: https://git01.mediatek.com/plugins/gitiles/openwrt/feeds/mtk-openwrt-feeds/+/bc6a6a375c800dc2b80e1a325a2c732d1737df92
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+v4: declare function mtk_mib_entry_read as static
+v3: don't bother to set 'false' values in any zero-initialized struct
+    use mtk_foe_entry_ib2
+    both changes were requested by Felix Fietkau
+
+v2: fix wrong variable name in return value check spotted by Denis Kirjanov
+
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c   |   7 +-
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h   |   1 +
+ drivers/net/ethernet/mediatek/mtk_ppe.c       | 110 +++++++++++++++++-
+ drivers/net/ethernet/mediatek/mtk_ppe.h       |  23 +++-
+ .../net/ethernet/mediatek/mtk_ppe_debugfs.c   |   9 +-
+ .../net/ethernet/mediatek/mtk_ppe_offload.c   |   7 ++
+ drivers/net/ethernet/mediatek/mtk_ppe_regs.h  |  14 +++
+ 7 files changed, 166 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -4696,8 +4696,8 @@ static int mtk_probe(struct platform_dev
+ 		for (i = 0; i < num_ppe; i++) {
+ 			u32 ppe_addr = eth->soc->reg_map->ppe_base + i * 0x400;
+ 
+-			eth->ppe[i] = mtk_ppe_init(eth, eth->base + ppe_addr,
+-						   eth->soc->offload_version, i);
++			eth->ppe[i] = mtk_ppe_init(eth, eth->base + ppe_addr, i);
++
+ 			if (!eth->ppe[i]) {
+ 				err = -ENOMEM;
+ 				goto err_deinit_ppe;
+@@ -4823,6 +4823,7 @@ static const struct mtk_soc_data mt7622_
+ 	.required_pctl = false,
+ 	.offload_version = 2,
+ 	.hash_offset = 2,
++	.has_accounting = true,
+ 	.foe_entry_size = sizeof(struct mtk_foe_entry) - 16,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+@@ -4860,6 +4861,7 @@ static const struct mtk_soc_data mt7629_
+ 	.hw_features = MTK_HW_FEATURES,
+ 	.required_clks = MT7629_CLKS_BITMAP,
+ 	.required_pctl = false,
++	.has_accounting = true,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+ 		.rxd_size = sizeof(struct mtk_rx_dma),
+@@ -4880,6 +4882,7 @@ static const struct mtk_soc_data mt7981_
+ 	.offload_version = 2,
+ 	.hash_offset = 4,
+ 	.foe_entry_size = sizeof(struct mtk_foe_entry),
++	.has_accounting = true,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma_v2),
+ 		.rxd_size = sizeof(struct mtk_rx_dma_v2),
+@@ -4899,6 +4902,7 @@ static const struct mtk_soc_data mt7986_
+ 	.required_pctl = false,
+ 	.hash_offset = 4,
+ 	.foe_entry_size = sizeof(struct mtk_foe_entry),
++	.has_accounting = true,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma_v2),
+ 		.rxd_size = sizeof(struct mtk_rx_dma_v2),
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -1017,6 +1017,8 @@ struct mtk_reg_map {
+  *				the extra setup for those pins used by GMAC.
+  * @hash_offset			Flow table hash offset.
+  * @foe_entry_size		Foe table entry size.
++ * @has_accounting		Bool indicating support for accounting of
++ *				offloaded flows.
+  * @txd_size			Tx DMA descriptor size.
+  * @rxd_size			Rx DMA descriptor size.
+  * @rx_irq_done_mask		Rx irq done register mask.
+@@ -1034,6 +1036,7 @@ struct mtk_soc_data {
+ 	u8		hash_offset;
+ 	u16		foe_entry_size;
+ 	netdev_features_t hw_features;
++	bool		has_accounting;
+ 	struct {
+ 		u32	txd_size;
+ 		u32	rxd_size;
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -74,6 +74,48 @@ static int mtk_ppe_wait_busy(struct mtk_
+ 	return ret;
+ }
+ 
++static int mtk_ppe_mib_wait_busy(struct mtk_ppe *ppe)
++{
++	int ret;
++	u32 val;
++
++	ret = readl_poll_timeout(ppe->base + MTK_PPE_MIB_SER_CR, val,
++				 !(val & MTK_PPE_MIB_SER_CR_ST),
++				 20, MTK_PPE_WAIT_TIMEOUT_US);
++
++	if (ret)
++		dev_err(ppe->dev, "MIB table busy");
++
++	return ret;
++}
++
++static int mtk_mib_entry_read(struct mtk_ppe *ppe, u16 index, u64 *bytes, u64 *packets)
++{
++	u32 byte_cnt_low, byte_cnt_high, pkt_cnt_low, pkt_cnt_high;
++	u32 val, cnt_r0, cnt_r1, cnt_r2;
++	int ret;
++
++	val = FIELD_PREP(MTK_PPE_MIB_SER_CR_ADDR, index) | MTK_PPE_MIB_SER_CR_ST;
++	ppe_w32(ppe, MTK_PPE_MIB_SER_CR, val);
++
++	ret = mtk_ppe_mib_wait_busy(ppe);
++	if (ret)
++		return ret;
++
++	cnt_r0 = readl(ppe->base + MTK_PPE_MIB_SER_R0);
++	cnt_r1 = readl(ppe->base + MTK_PPE_MIB_SER_R1);
++	cnt_r2 = readl(ppe->base + MTK_PPE_MIB_SER_R2);
++
++	byte_cnt_low = FIELD_GET(MTK_PPE_MIB_SER_R0_BYTE_CNT_LOW, cnt_r0);
++	byte_cnt_high = FIELD_GET(MTK_PPE_MIB_SER_R1_BYTE_CNT_HIGH, cnt_r1);
++	pkt_cnt_low = FIELD_GET(MTK_PPE_MIB_SER_R1_PKT_CNT_LOW, cnt_r1);
++	pkt_cnt_high = FIELD_GET(MTK_PPE_MIB_SER_R2_PKT_CNT_HIGH, cnt_r2);
++	*bytes = ((u64)byte_cnt_high << 32) | byte_cnt_low;
++	*packets = (pkt_cnt_high << 16) | pkt_cnt_low;
++
++	return 0;
++}
++
+ static void mtk_ppe_cache_clear(struct mtk_ppe *ppe)
+ {
+ 	ppe_set(ppe, MTK_PPE_CACHE_CTL, MTK_PPE_CACHE_CTL_CLEAR);
+@@ -459,6 +501,13 @@ __mtk_foe_entry_clear(struct mtk_ppe *pp
+ 		hwe->ib1 |= FIELD_PREP(MTK_FOE_IB1_STATE, MTK_FOE_STATE_INVALID);
+ 		dma_wmb();
+ 		mtk_ppe_cache_clear(ppe);
++		if (ppe->accounting) {
++			struct mtk_foe_accounting *acct;
++
++			acct = ppe->acct_table + entry->hash * sizeof(*acct);
++			acct->packets = 0;
++			acct->bytes = 0;
++		}
+ 	}
+ 	entry->hash = 0xffff;
+ 
+@@ -566,6 +615,9 @@ __mtk_foe_entry_commit(struct mtk_ppe *p
+ 	wmb();
+ 	hwe->ib1 = entry->ib1;
+ 
++	if (ppe->accounting)
++		*mtk_foe_entry_ib2(eth, hwe) |= MTK_FOE_IB2_MIB_CNT;
++
+ 	dma_wmb();
+ 
+ 	mtk_ppe_cache_clear(ppe);
+@@ -757,11 +809,39 @@ int mtk_ppe_prepare_reset(struct mtk_ppe
+ 	return mtk_ppe_wait_busy(ppe);
+ }
+ 
+-struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base,
+-			     int version, int index)
++struct mtk_foe_accounting *mtk_foe_entry_get_mib(struct mtk_ppe *ppe, u32 index,
++						 struct mtk_foe_accounting *diff)
++{
++	struct mtk_foe_accounting *acct;
++	int size = sizeof(struct mtk_foe_accounting);
++	u64 bytes, packets;
++
++	if (!ppe->accounting)
++		return NULL;
++
++	if (mtk_mib_entry_read(ppe, index, &bytes, &packets))
++		return NULL;
++
++	acct = ppe->acct_table + index * size;
++
++	acct->bytes += bytes;
++	acct->packets += packets;
++
++	if (diff) {
++		diff->bytes = bytes;
++		diff->packets = packets;
++	}
++
++	return acct;
++}
++
++struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base, int index)
+ {
++	bool accounting = eth->soc->has_accounting;
+ 	const struct mtk_soc_data *soc = eth->soc;
++	struct mtk_foe_accounting *acct;
+ 	struct device *dev = eth->dev;
++	struct mtk_mib_entry *mib;
+ 	struct mtk_ppe *ppe;
+ 	u32 foe_flow_size;
+ 	void *foe;
+@@ -778,7 +858,8 @@ struct mtk_ppe *mtk_ppe_init(struct mtk_
+ 	ppe->base = base;
+ 	ppe->eth = eth;
+ 	ppe->dev = dev;
+-	ppe->version = version;
++	ppe->version = eth->soc->offload_version;
++	ppe->accounting = accounting;
+ 
+ 	foe = dmam_alloc_coherent(ppe->dev,
+ 				  MTK_PPE_ENTRIES * soc->foe_entry_size,
+@@ -794,6 +875,23 @@ struct mtk_ppe *mtk_ppe_init(struct mtk_
+ 	if (!ppe->foe_flow)
+ 		goto err_free_l2_flows;
+ 
++	if (accounting) {
++		mib = dmam_alloc_coherent(ppe->dev, MTK_PPE_ENTRIES * sizeof(*mib),
++					  &ppe->mib_phys, GFP_KERNEL);
++		if (!mib)
++			return NULL;
++
++		ppe->mib_table = mib;
++
++		acct = devm_kzalloc(dev, MTK_PPE_ENTRIES * sizeof(*acct),
++				    GFP_KERNEL);
++
++		if (!acct)
++			return NULL;
++
++		ppe->acct_table = acct;
++	}
++
+ 	mtk_ppe_debugfs_init(ppe, index);
+ 
+ 	return ppe;
+@@ -923,6 +1021,16 @@ void mtk_ppe_start(struct mtk_ppe *ppe)
+ 		ppe_w32(ppe, MTK_PPE_DEFAULT_CPU_PORT1, 0xcb777);
+ 		ppe_w32(ppe, MTK_PPE_SBW_CTRL, 0x7f);
+ 	}
++
++	if (ppe->accounting && ppe->mib_phys) {
++		ppe_w32(ppe, MTK_PPE_MIB_TB_BASE, ppe->mib_phys);
++		ppe_m32(ppe, MTK_PPE_MIB_CFG, MTK_PPE_MIB_CFG_EN,
++			MTK_PPE_MIB_CFG_EN);
++		ppe_m32(ppe, MTK_PPE_MIB_CFG, MTK_PPE_MIB_CFG_RD_CLR,
++			MTK_PPE_MIB_CFG_RD_CLR);
++		ppe_m32(ppe, MTK_PPE_MIB_CACHE_CTL, MTK_PPE_MIB_CACHE_CTL_EN,
++			MTK_PPE_MIB_CFG_RD_CLR);
++	}
+ }
+ 
+ int mtk_ppe_stop(struct mtk_ppe *ppe)
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h
+@@ -57,6 +57,7 @@ enum {
+ #define MTK_FOE_IB2_MULTICAST		BIT(8)
+ 
+ #define MTK_FOE_IB2_WDMA_QID2		GENMASK(13, 12)
++#define MTK_FOE_IB2_MIB_CNT		BIT(15)
+ #define MTK_FOE_IB2_WDMA_DEVIDX		BIT(16)
+ #define MTK_FOE_IB2_WDMA_WINFO		BIT(17)
+ 
+@@ -285,16 +286,34 @@ struct mtk_flow_entry {
+ 	unsigned long cookie;
+ };
+ 
++struct mtk_mib_entry {
++	u32	byt_cnt_l;
++	u16	byt_cnt_h;
++	u32	pkt_cnt_l;
++	u8	pkt_cnt_h;
++	u8	_rsv0;
++	u32	_rsv1;
++} __packed;
++
++struct mtk_foe_accounting {
++	u64	bytes;
++	u64	packets;
++};
++
+ struct mtk_ppe {
+ 	struct mtk_eth *eth;
+ 	struct device *dev;
+ 	void __iomem *base;
+ 	int version;
+ 	char dirname[5];
++	bool accounting;
+ 
+ 	void *foe_table;
+ 	dma_addr_t foe_phys;
+ 
++	struct mtk_mib_entry *mib_table;
++	dma_addr_t mib_phys;
++
+ 	u16 foe_check_time[MTK_PPE_ENTRIES];
+ 	struct hlist_head *foe_flow;
+ 
+@@ -303,8 +322,7 @@ struct mtk_ppe {
+ 	void *acct_table;
+ };
+ 
+-struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base,
+-			     int version, int index);
++struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base, int index);
+ void mtk_ppe_deinit(struct mtk_eth *eth);
+ void mtk_ppe_start(struct mtk_ppe *ppe);
+ int mtk_ppe_stop(struct mtk_ppe *ppe);
+@@ -359,5 +377,7 @@ int mtk_foe_entry_commit(struct mtk_ppe
+ void mtk_foe_entry_clear(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+ int mtk_foe_entry_idle_time(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+ int mtk_ppe_debugfs_init(struct mtk_ppe *ppe, int index);
++struct mtk_foe_accounting *mtk_foe_entry_get_mib(struct mtk_ppe *ppe, u32 index,
++						 struct mtk_foe_accounting *diff);
+ 
+ #endif
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_debugfs.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_debugfs.c
+@@ -82,6 +82,7 @@ mtk_ppe_debugfs_foe_show(struct seq_file
+ 		struct mtk_foe_entry *entry = mtk_foe_get_entry(ppe, i);
+ 		struct mtk_foe_mac_info *l2;
+ 		struct mtk_flow_addr_info ai = {};
++		struct mtk_foe_accounting *acct;
+ 		unsigned char h_source[ETH_ALEN];
+ 		unsigned char h_dest[ETH_ALEN];
+ 		int type, state;
+@@ -95,6 +96,8 @@ mtk_ppe_debugfs_foe_show(struct seq_file
+ 		if (bind && state != MTK_FOE_STATE_BIND)
+ 			continue;
+ 
++		acct = mtk_foe_entry_get_mib(ppe, i, NULL);
++
+ 		type = FIELD_GET(MTK_FOE_IB1_PACKET_TYPE, entry->ib1);
+ 		seq_printf(m, "%05x %s %7s", i,
+ 			   mtk_foe_entry_state_str(state),
+@@ -153,9 +156,11 @@ mtk_ppe_debugfs_foe_show(struct seq_file
+ 		*((__be16 *)&h_dest[4]) = htons(l2->dest_mac_lo);
+ 
+ 		seq_printf(m, " eth=%pM->%pM etype=%04x"
+-			      " vlan=%d,%d ib1=%08x ib2=%08x\n",
++			      " vlan=%d,%d ib1=%08x ib2=%08x"
++			      " packets=%llu bytes=%llu\n",
+ 			   h_source, h_dest, ntohs(l2->etype),
+-			   l2->vlan1, l2->vlan2, entry->ib1, ib2);
++			   l2->vlan1, l2->vlan2, entry->ib1, ib2,
++			   acct ? acct->packets : 0, acct ? acct->bytes : 0);
+ 	}
+ 
+ 	return 0;
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
+@@ -497,6 +497,7 @@ static int
+ mtk_flow_offload_stats(struct mtk_eth *eth, struct flow_cls_offload *f)
+ {
+ 	struct mtk_flow_entry *entry;
++	struct mtk_foe_accounting diff;
+ 	u32 idle;
+ 
+ 	entry = rhashtable_lookup(&eth->flow_table, &f->cookie,
+@@ -507,6 +508,13 @@ mtk_flow_offload_stats(struct mtk_eth *e
+ 	idle = mtk_foe_entry_idle_time(eth->ppe[entry->ppe_index], entry);
+ 	f->stats.lastused = jiffies - idle * HZ;
+ 
++	if (entry->hash != 0xFFFF &&
++	    mtk_foe_entry_get_mib(eth->ppe[entry->ppe_index], entry->hash,
++				  &diff)) {
++		f->stats.pkts += diff.packets;
++		f->stats.bytes += diff.bytes;
++	}
++
+ 	return 0;
+ }
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_regs.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_regs.h
+@@ -149,6 +149,20 @@ enum {
+ 
+ #define MTK_PPE_MIB_TB_BASE			0x338
+ 
++#define MTK_PPE_MIB_SER_CR			0x33C
++#define MTK_PPE_MIB_SER_CR_ST			BIT(16)
++#define MTK_PPE_MIB_SER_CR_ADDR			GENMASK(13, 0)
++
++#define MTK_PPE_MIB_SER_R0			0x340
++#define MTK_PPE_MIB_SER_R0_BYTE_CNT_LOW		GENMASK(31, 0)
++
++#define MTK_PPE_MIB_SER_R1			0x344
++#define MTK_PPE_MIB_SER_R1_PKT_CNT_LOW		GENMASK(31, 16)
++#define MTK_PPE_MIB_SER_R1_BYTE_CNT_HIGH	GENMASK(15, 0)
++
++#define MTK_PPE_MIB_SER_R2			0x348
++#define MTK_PPE_MIB_SER_R2_PKT_CNT_HIGH		GENMASK(23, 0)
++
+ #define MTK_PPE_MIB_CACHE_CTL			0x350
+ #define MTK_PPE_MIB_CACHE_CTL_EN		BIT(0)
+ #define MTK_PPE_MIB_CACHE_CTL_FLUSH		BIT(2)
diff --git a/target/linux/generic/pending-6.1/731-net-permit-ieee80211_ptr-even-with-no-CFG82111-suppo.patch b/target/linux/generic/pending-6.1/731-net-permit-ieee80211_ptr-even-with-no-CFG82111-suppo.patch
new file mode 100644
index 00000000000000..d1203d76ce80e0
--- /dev/null
+++ b/target/linux/generic/pending-6.1/731-net-permit-ieee80211_ptr-even-with-no-CFG82111-suppo.patch
@@ -0,0 +1,59 @@
+From 686c603f67ae87bf21a61b5e4b1564443f41c3ee Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 20 Oct 2022 03:34:43 +0200
+Subject: [PATCH] net: permit ieee80211_ptr even with no CFG82111 support
+
+Introduce a new flag CONFIG_CFG80211_HEADERS to compile in ieee80211_ptr
+even if CFG80211 support is not compiled in. This is needed for the
+backports project and for any downstream wireless driver that loads in
+the kernel dynamically.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ include/linux/netdevice.h       | 2 +-
+ net/batman-adv/hard-interface.c | 2 +-
+ net/wireless/Kconfig            | 4 ++++
+ 3 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -2170,7 +2170,7 @@ struct net_device {
+ #if IS_ENABLED(CONFIG_AX25)
+ 	void			*ax25_ptr;
+ #endif
+-#if IS_ENABLED(CONFIG_CFG80211)
++#if IS_ENABLED(CONFIG_CFG80211_HEADERS)
+ 	struct wireless_dev	*ieee80211_ptr;
+ #endif
+ #if IS_ENABLED(CONFIG_IEEE802154) || IS_ENABLED(CONFIG_6LOWPAN)
+--- a/net/batman-adv/hard-interface.c
++++ b/net/batman-adv/hard-interface.c
+@@ -308,7 +308,7 @@ static bool batadv_is_cfg80211_netdev(st
+ 	if (!net_device)
+ 		return false;
+ 
+-#if IS_ENABLED(CONFIG_CFG80211)
++#if IS_ENABLED(CONFIG_CFG80211_HEADERS)
+ 	/* cfg80211 drivers have to set ieee80211_ptr */
+ 	if (net_device->ieee80211_ptr)
+ 		return true;
+--- a/net/wireless/Kconfig
++++ b/net/wireless/Kconfig
+@@ -26,6 +26,7 @@ config CFG80211
+ 	# using a different algorithm, though right now they shouldn't
+ 	# (this is here rather than below to allow it to be a module)
+ 	select CRYPTO_SHA256 if CFG80211_USE_KERNEL_REGDB_KEYS
++	select CFG80211_HEADERS
+ 	help
+ 	  cfg80211 is the Linux wireless LAN (802.11) configuration API.
+ 	  Enable this if you have a wireless device.
+@@ -36,6 +37,9 @@ config CFG80211
+ 
+ 	  When built as a module it will be called cfg80211.
+ 
++config CFG80211_HEADERS
++	bool "cfg80211 - headers support"
++
+ if CFG80211
+ 
+ config NL80211_TESTMODE
diff --git a/target/linux/generic/pending-6.1/732-00-net-ethernet-mtk_eth_soc-drop-generic-vlan-rx-offloa.patch b/target/linux/generic/pending-6.1/732-00-net-ethernet-mtk_eth_soc-drop-generic-vlan-rx-offloa.patch
new file mode 100644
index 00000000000000..e55375f3a2ae34
--- /dev/null
+++ b/target/linux/generic/pending-6.1/732-00-net-ethernet-mtk_eth_soc-drop-generic-vlan-rx-offloa.patch
@@ -0,0 +1,201 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 20 Nov 2022 23:01:00 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: drop generic vlan rx offload,
+ only use DSA untagging
+
+Through testing I found out that hardware vlan rx offload support seems to
+have some hardware issues. At least when using multiple MACs and when receiving
+tagged packets on the secondary MAC, the hardware can sometimes start to emit
+wrong tags on the first MAC as well.
+
+In order to avoid such issues, drop the feature configuration and use the
+offload feature only for DSA hardware untagging on MT7621/MT7622 devices which
+only use one MAC.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1898,9 +1898,7 @@ static int mtk_poll_rx(struct napi_struc
+ 
+ 	while (done < budget) {
+ 		unsigned int pktlen, *rxdcsum;
+-		bool has_hwaccel_tag = false;
+ 		struct net_device *netdev;
+-		u16 vlan_proto, vlan_tci;
+ 		dma_addr_t dma_addr;
+ 		u32 hash, reason;
+ 		int mac = 0;
+@@ -2035,36 +2033,21 @@ static int mtk_poll_rx(struct napi_struc
+ 			skb_checksum_none_assert(skb);
+ 		skb->protocol = eth_type_trans(skb, netdev);
+ 
+-		if (reason == MTK_PPE_CPU_REASON_HIT_UNBIND_RATE_REACHED)
+-			mtk_ppe_check_skb(eth->ppe[0], skb, hash);
+-
+-		if (netdev->features & NETIF_F_HW_VLAN_CTAG_RX) {
+-			if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+-				if (trxd.rxd3 & RX_DMA_VTAG_V2) {
+-					vlan_proto = RX_DMA_VPID(trxd.rxd4);
+-					vlan_tci = RX_DMA_VID(trxd.rxd4);
+-					has_hwaccel_tag = true;
+-				}
+-			} else if (trxd.rxd2 & RX_DMA_VTAG) {
+-				vlan_proto = RX_DMA_VPID(trxd.rxd3);
+-				vlan_tci = RX_DMA_VID(trxd.rxd3);
+-				has_hwaccel_tag = true;
+-			}
+-		}
+-
+ 		/* When using VLAN untagging in combination with DSA, the
+ 		 * hardware treats the MTK special tag as a VLAN and untags it.
+ 		 */
+-		if (has_hwaccel_tag && netdev_uses_dsa(netdev)) {
+-			unsigned int port = vlan_proto & GENMASK(2, 0);
++		if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2) &&
++		    (trxd.rxd2 & RX_DMA_VTAG) && netdev_uses_dsa(netdev)) {
++			unsigned int port = RX_DMA_VPID(trxd.rxd3) & GENMASK(2, 0);
+ 
+ 			if (port < ARRAY_SIZE(eth->dsa_meta) &&
+ 			    eth->dsa_meta[port])
+ 				skb_dst_set_noref(skb, &eth->dsa_meta[port]->dst);
+-		} else if (has_hwaccel_tag) {
+-			__vlan_hwaccel_put_tag(skb, htons(vlan_proto), vlan_tci);
+ 		}
+ 
++		if (reason == MTK_PPE_CPU_REASON_HIT_UNBIND_RATE_REACHED)
++			mtk_ppe_check_skb(eth->ppe[0], skb, hash);
++
+ 		skb_record_rx_queue(skb, 0);
+ 		napi_gro_receive(napi, skb);
+ 
+@@ -2887,29 +2870,11 @@ static netdev_features_t mtk_fix_feature
+ 
+ static int mtk_set_features(struct net_device *dev, netdev_features_t features)
+ {
+-	struct mtk_mac *mac = netdev_priv(dev);
+-	struct mtk_eth *eth = mac->hw;
+ 	netdev_features_t diff = dev->features ^ features;
+-	int i;
+ 
+ 	if ((diff & NETIF_F_LRO) && !(features & NETIF_F_LRO))
+ 		mtk_hwlro_netdev_disable(dev);
+ 
+-	/* Set RX VLAN offloading */
+-	if (!(diff & NETIF_F_HW_VLAN_CTAG_RX))
+-		return 0;
+-
+-	mtk_w32(eth, !!(features & NETIF_F_HW_VLAN_CTAG_RX),
+-		MTK_CDMP_EG_CTRL);
+-
+-	/* sync features with other MAC */
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
+-		if (!eth->netdev[i] || eth->netdev[i] == dev)
+-			continue;
+-		eth->netdev[i]->features &= ~NETIF_F_HW_VLAN_CTAG_RX;
+-		eth->netdev[i]->features |= features & NETIF_F_HW_VLAN_CTAG_RX;
+-	}
+-
+ 	return 0;
+ }
+ 
+@@ -3223,30 +3188,6 @@ static int mtk_open(struct net_device *d
+ 	struct mtk_eth *eth = mac->hw;
+ 	int i, err;
+ 
+-	if (mtk_uses_dsa(dev) && !eth->prog) {
+-		for (i = 0; i < ARRAY_SIZE(eth->dsa_meta); i++) {
+-			struct metadata_dst *md_dst = eth->dsa_meta[i];
+-
+-			if (md_dst)
+-				continue;
+-
+-			md_dst = metadata_dst_alloc(0, METADATA_HW_PORT_MUX,
+-						    GFP_KERNEL);
+-			if (!md_dst)
+-				return -ENOMEM;
+-
+-			md_dst->u.port_info.port_id = i;
+-			eth->dsa_meta[i] = md_dst;
+-		}
+-	} else {
+-		/* Hardware special tag parsing needs to be disabled if at least
+-		 * one MAC does not use DSA.
+-		 */
+-		u32 val = mtk_r32(eth, MTK_CDMP_IG_CTRL);
+-		val &= ~MTK_CDMP_STAG_EN;
+-		mtk_w32(eth, val, MTK_CDMP_IG_CTRL);
+-	}
+-
+ 	err = phylink_of_phy_connect(mac->phylink, mac->of_node, 0);
+ 	if (err) {
+ 		netdev_err(dev, "%s: could not attach PHY: %d\n", __func__,
+@@ -3285,6 +3226,35 @@ static int mtk_open(struct net_device *d
+ 	phylink_start(mac->phylink);
+ 	netif_tx_start_all_queues(dev);
+ 
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++		return 0;
++
++	if (mtk_uses_dsa(dev) && !eth->prog) {
++		for (i = 0; i < ARRAY_SIZE(eth->dsa_meta); i++) {
++			struct metadata_dst *md_dst = eth->dsa_meta[i];
++
++			if (md_dst)
++				continue;
++
++			md_dst = metadata_dst_alloc(0, METADATA_HW_PORT_MUX,
++						    GFP_KERNEL);
++			if (!md_dst)
++				return -ENOMEM;
++
++			md_dst->u.port_info.port_id = i;
++			eth->dsa_meta[i] = md_dst;
++		}
++	} else {
++		/* Hardware special tag parsing needs to be disabled if at least
++		 * one MAC does not use DSA.
++		 */
++		u32 val = mtk_r32(eth, MTK_CDMP_IG_CTRL);
++		val &= ~MTK_CDMP_STAG_EN;
++		mtk_w32(eth, val, MTK_CDMP_IG_CTRL);
++
++		mtk_w32(eth, 0, MTK_CDMP_EG_CTRL);
++	}
++
+ 	return 0;
+ }
+ 
+@@ -3769,10 +3739,9 @@ static int mtk_hw_init(struct mtk_eth *e
+ 	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+ 		val = mtk_r32(eth, MTK_CDMP_IG_CTRL);
+ 		mtk_w32(eth, val | MTK_CDMP_STAG_EN, MTK_CDMP_IG_CTRL);
+-	}
+ 
+-	/* Enable RX VLan Offloading */
+-	mtk_w32(eth, 1, MTK_CDMP_EG_CTRL);
++		mtk_w32(eth, 1, MTK_CDMP_EG_CTRL);
++	}
+ 
+ 	/* set interrupt delays based on current Net DIM sample */
+ 	mtk_dim_rx(&eth->rx_dim.work);
+@@ -4419,7 +4388,7 @@ static int mtk_add_mac(struct mtk_eth *e
+ 		eth->netdev[id]->hw_features |= NETIF_F_LRO;
+ 
+ 	eth->netdev[id]->vlan_features = eth->soc->hw_features &
+-		~(NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX);
++		~NETIF_F_HW_VLAN_CTAG_TX;
+ 	eth->netdev[id]->features |= eth->soc->hw_features;
+ 	eth->netdev[id]->ethtool_ops = &mtk_ethtool_ops;
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -48,7 +48,6 @@
+ #define MTK_HW_FEATURES		(NETIF_F_IP_CSUM | \
+ 				 NETIF_F_RXCSUM | \
+ 				 NETIF_F_HW_VLAN_CTAG_TX | \
+-				 NETIF_F_HW_VLAN_CTAG_RX | \
+ 				 NETIF_F_SG | NETIF_F_TSO | \
+ 				 NETIF_F_TSO6 | \
+ 				 NETIF_F_IPV6_CSUM |\
diff --git a/target/linux/generic/pending-6.1/732-01-net-ethernet-mtk_eth_soc-work-around-issue-with-send.patch b/target/linux/generic/pending-6.1/732-01-net-ethernet-mtk_eth_soc-work-around-issue-with-send.patch
new file mode 100644
index 00000000000000..c0a5a93a456302
--- /dev/null
+++ b/target/linux/generic/pending-6.1/732-01-net-ethernet-mtk_eth_soc-work-around-issue-with-send.patch
@@ -0,0 +1,94 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 3 Nov 2022 12:38:49 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: work around issue with sending
+ small fragments
+
+When lots of frames are sent with a number of very small fragments, an
+internal FIFO can overflow, causing the DMA engine to lock up lock up and
+transmit attempts time out.
+
+Fix this on MT7986 by increasing the reserved FIFO space.
+Fix this on older chips by detecting the presence of small fragments and use
+skb_gso_segment + skb_linearize to deal with them.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1469,12 +1469,28 @@ static void mtk_wake_queue(struct mtk_et
+ 	}
+ }
+ 
++static bool mtk_skb_has_small_frag(struct sk_buff *skb)
++{
++	int min_size = 16;
++	int i;
++
++	if (skb_headlen(skb) < min_size)
++		return true;
++
++	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
++		if (skb_frag_size(&skb_shinfo(skb)->frags[i]) < min_size)
++			return true;
++
++	return false;
++}
++
+ static netdev_tx_t mtk_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ 	struct mtk_mac *mac = netdev_priv(dev);
+ 	struct mtk_eth *eth = mac->hw;
+ 	struct mtk_tx_ring *ring = &eth->tx_ring;
+ 	struct net_device_stats *stats = &dev->stats;
++	struct sk_buff *segs, *next;
+ 	bool gso = false;
+ 	int tx_num;
+ 
+@@ -1496,6 +1512,18 @@ static netdev_tx_t mtk_start_xmit(struct
+ 		return NETDEV_TX_BUSY;
+ 	}
+ 
++	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2) &&
++	    skb_is_gso(skb) && mtk_skb_has_small_frag(skb)) {
++		segs = skb_gso_segment(skb, dev->features & ~NETIF_F_ALL_TSO);
++		if (IS_ERR(segs))
++			goto drop;
++
++		if (segs) {
++			consume_skb(skb);
++			skb = segs;
++		}
++	}
++
+ 	/* TSO: fill MSS info in tcp checksum field */
+ 	if (skb_is_gso(skb)) {
+ 		if (skb_cow_head(skb, 0)) {
+@@ -1511,8 +1539,14 @@ static netdev_tx_t mtk_start_xmit(struct
+ 		}
+ 	}
+ 
+-	if (mtk_tx_map(skb, dev, tx_num, ring, gso) < 0)
+-		goto drop;
++	skb_list_walk_safe(skb, skb, next) {
++		if ((!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2) &&
++		     mtk_skb_has_small_frag(skb) && skb_linearize(skb)) ||
++		    mtk_tx_map(skb, dev, tx_num, ring, gso) < 0) {
++				stats->tx_dropped++;
++				dev_kfree_skb_any(skb);
++		}
++	}
+ 
+ 	if (unlikely(atomic_read(&ring->free_count) <= ring->thresh))
+ 		netif_tx_stop_all_queues(dev);
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -258,7 +258,7 @@
+ #define MTK_CHK_DDONE_EN	BIT(28)
+ #define MTK_DMAD_WR_WDONE	BIT(26)
+ #define MTK_WCOMP_EN		BIT(24)
+-#define MTK_RESV_BUF		(0x40 << 16)
++#define MTK_RESV_BUF		(0x80 << 16)
+ #define MTK_MUTLI_CNT		(0x4 << 12)
+ #define MTK_LEAKY_BUCKET_EN	BIT(11)
+ 
diff --git a/target/linux/generic/pending-6.1/732-02-net-ethernet-mtk_eth_soc-set-NETIF_F_ALL_TSO.patch b/target/linux/generic/pending-6.1/732-02-net-ethernet-mtk_eth_soc-set-NETIF_F_ALL_TSO.patch
new file mode 100644
index 00000000000000..3c6359ee419a76
--- /dev/null
+++ b/target/linux/generic/pending-6.1/732-02-net-ethernet-mtk_eth_soc-set-NETIF_F_ALL_TSO.patch
@@ -0,0 +1,21 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 28 Oct 2022 12:54:48 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: set NETIF_F_ALL_TSO
+
+Significantly improves performance by avoiding unnecessary segmentation
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -48,8 +48,7 @@
+ #define MTK_HW_FEATURES		(NETIF_F_IP_CSUM | \
+ 				 NETIF_F_RXCSUM | \
+ 				 NETIF_F_HW_VLAN_CTAG_TX | \
+-				 NETIF_F_SG | NETIF_F_TSO | \
+-				 NETIF_F_TSO6 | \
++				 NETIF_F_SG | NETIF_F_ALL_TSO | \
+ 				 NETIF_F_IPV6_CSUM |\
+ 				 NETIF_F_HW_TC)
+ #define MTK_HW_FEATURES_MT7628	(NETIF_F_SG | NETIF_F_RXCSUM)
diff --git a/target/linux/generic/pending-6.1/732-03-net-ethernet-mtk_eth_soc-fix-remaining-throughput-re.patch b/target/linux/generic/pending-6.1/732-03-net-ethernet-mtk_eth_soc-fix-remaining-throughput-re.patch
new file mode 100644
index 00000000000000..77973180f63998
--- /dev/null
+++ b/target/linux/generic/pending-6.1/732-03-net-ethernet-mtk_eth_soc-fix-remaining-throughput-re.patch
@@ -0,0 +1,42 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 29 Mar 2023 16:02:54 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: fix remaining throughput
+ regression
+
+Based on further tests, it seems that the QDMA shaper is not able to
+perform shaping close to the MAC link rate without throughput loss.
+This cannot be compensated by increasing the shaping rate, so it seems
+to be an internal limit.
+
+Fix the remaining throughput regression by detecting that condition and
+limiting shaping to ports with lower link speed.
+
+This patch intentionally ignores link speed gain from TRGMII, because
+even on such links, shaping to 1000 Mbit/s incurs some throughput
+degradation.
+
+Fixes: f63959c7eec3 ("net: ethernet: mtk_eth_soc: implement multi-queue support for per-port queues")
+Reported-by: Frank Wunderlich <frank-w@public-files.de>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -710,6 +710,7 @@ static void mtk_mac_link_up(struct phyli
+ 		 MAC_MCR_FORCE_RX_FC);
+ 
+ 	/* Configure speed */
++	mac->speed = speed;
+ 	switch (speed) {
+ 	case SPEED_2500:
+ 	case SPEED_1000:
+@@ -3201,6 +3202,9 @@ found:
+ 	if (dp->index >= MTK_QDMA_NUM_QUEUES)
+ 		return NOTIFY_DONE;
+ 
++	if (mac->speed > 0 && mac->speed <= s.base.speed)
++		s.base.speed = 0;
++
+ 	mtk_set_queue_speed(eth, dp->index + 3, s.base.speed);
+ 
+ 	return NOTIFY_DONE;
diff --git a/target/linux/generic/pending-6.1/734-net-ethernet-mtk_eth_soc-ppe-fix-L2-offloading-with-.patch b/target/linux/generic/pending-6.1/734-net-ethernet-mtk_eth_soc-ppe-fix-L2-offloading-with-.patch
new file mode 100644
index 00000000000000..dc2163959d1328
--- /dev/null
+++ b/target/linux/generic/pending-6.1/734-net-ethernet-mtk_eth_soc-ppe-fix-L2-offloading-with-.patch
@@ -0,0 +1,33 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 27 Dec 2022 15:02:51 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: ppe: fix L2 offloading with DSA
+ untagging offload enabled
+
+Check for skb metadata in order to detect the case where the DSA header is not
+present.
+
+Fixes: 2d7605a72906 ("net: ethernet: mtk_eth_soc: enable hardware DSA untagging")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -8,6 +8,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/if_ether.h>
+ #include <linux/if_vlan.h>
++#include <net/dst_metadata.h>
+ #include <net/dsa.h>
+ #include "mtk_eth_soc.h"
+ #include "mtk_ppe.h"
+@@ -752,7 +753,9 @@ void __mtk_ppe_check_skb(struct mtk_ppe
+ 		    skb->dev->dsa_ptr->tag_ops->proto != DSA_TAG_PROTO_MTK)
+ 			goto out;
+ 
+-		tag += 4;
++		if (!skb_metadata_dst(skb))
++			tag += 4;
++
+ 		if (get_unaligned_be16(tag) != ETH_P_8021Q)
+ 			break;
+ 
diff --git a/target/linux/generic/pending-6.1/736-01-net-ethernet-mtk_eth_soc-add-code-for-offloading-flo.patch b/target/linux/generic/pending-6.1/736-01-net-ethernet-mtk_eth_soc-add-code-for-offloading-flo.patch
new file mode 100644
index 00000000000000..c5654a60619a92
--- /dev/null
+++ b/target/linux/generic/pending-6.1/736-01-net-ethernet-mtk_eth_soc-add-code-for-offloading-flo.patch
@@ -0,0 +1,266 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 20 Mar 2023 11:44:30 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: add code for offloading flows
+ from wlan devices
+
+WED version 2 (on MT7986 and later) can offload flows originating from wireless
+devices. In order to make that work, ndo_setup_tc needs to be implemented on
+the netdevs. This adds the required code to offload flows coming in from WED,
+while keeping track of the incoming wed index used for selecting the correct
+PPE device.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -1280,6 +1280,9 @@ int mtk_gmac_rgmii_path_setup(struct mtk
+ int mtk_eth_offload_init(struct mtk_eth *eth);
+ int mtk_eth_setup_tc(struct net_device *dev, enum tc_setup_type type,
+ 		     void *type_data);
++int mtk_flow_offload_cmd(struct mtk_eth *eth, struct flow_cls_offload *cls,
++			 int ppe_index);
++void mtk_flow_offload_cleanup(struct mtk_eth *eth, struct list_head *list);
+ void mtk_eth_set_dma_device(struct mtk_eth *eth, struct device *dma_dev);
+ 
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
+@@ -235,7 +235,8 @@ out:
+ }
+ 
+ static int
+-mtk_flow_offload_replace(struct mtk_eth *eth, struct flow_cls_offload *f)
++mtk_flow_offload_replace(struct mtk_eth *eth, struct flow_cls_offload *f,
++			 int ppe_index)
+ {
+ 	struct flow_rule *rule = flow_cls_offload_flow_rule(f);
+ 	struct flow_action_entry *act;
+@@ -452,6 +453,7 @@ mtk_flow_offload_replace(struct mtk_eth
+ 	entry->cookie = f->cookie;
+ 	memcpy(&entry->data, &foe, sizeof(entry->data));
+ 	entry->wed_index = wed_index;
++	entry->ppe_index = ppe_index;
+ 
+ 	err = mtk_foe_entry_commit(eth->ppe[entry->ppe_index], entry);
+ 	if (err < 0)
+@@ -520,25 +522,15 @@ mtk_flow_offload_stats(struct mtk_eth *e
+ 
+ static DEFINE_MUTEX(mtk_flow_offload_mutex);
+ 
+-static int
+-mtk_eth_setup_tc_block_cb(enum tc_setup_type type, void *type_data, void *cb_priv)
++int mtk_flow_offload_cmd(struct mtk_eth *eth, struct flow_cls_offload *cls,
++			 int ppe_index)
+ {
+-	struct flow_cls_offload *cls = type_data;
+-	struct net_device *dev = cb_priv;
+-	struct mtk_mac *mac = netdev_priv(dev);
+-	struct mtk_eth *eth = mac->hw;
+ 	int err;
+ 
+-	if (!tc_can_offload(dev))
+-		return -EOPNOTSUPP;
+-
+-	if (type != TC_SETUP_CLSFLOWER)
+-		return -EOPNOTSUPP;
+-
+ 	mutex_lock(&mtk_flow_offload_mutex);
+ 	switch (cls->command) {
+ 	case FLOW_CLS_REPLACE:
+-		err = mtk_flow_offload_replace(eth, cls);
++		err = mtk_flow_offload_replace(eth, cls, ppe_index);
+ 		break;
+ 	case FLOW_CLS_DESTROY:
+ 		err = mtk_flow_offload_destroy(eth, cls);
+@@ -556,6 +548,23 @@ mtk_eth_setup_tc_block_cb(enum tc_setup_
+ }
+ 
+ static int
++mtk_eth_setup_tc_block_cb(enum tc_setup_type type, void *type_data, void *cb_priv)
++{
++	struct flow_cls_offload *cls = type_data;
++	struct net_device *dev = cb_priv;
++	struct mtk_mac *mac = netdev_priv(dev);
++	struct mtk_eth *eth = mac->hw;
++
++	if (!tc_can_offload(dev))
++		return -EOPNOTSUPP;
++
++	if (type != TC_SETUP_CLSFLOWER)
++		return -EOPNOTSUPP;
++
++	return mtk_flow_offload_cmd(eth, cls, 0);
++}
++
++static int
+ mtk_eth_setup_tc_block(struct net_device *dev, struct flow_block_offload *f)
+ {
+ 	struct mtk_mac *mac = netdev_priv(dev);
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -13,6 +13,8 @@
+ #include <linux/mfd/syscon.h>
+ #include <linux/debugfs.h>
+ #include <linux/soc/mediatek/mtk_wed.h>
++#include <net/flow_offload.h>
++#include <net/pkt_cls.h>
+ #include "mtk_eth_soc.h"
+ #include "mtk_wed_regs.h"
+ #include "mtk_wed.h"
+@@ -41,6 +43,11 @@
+ static struct mtk_wed_hw *hw_list[2];
+ static DEFINE_MUTEX(hw_lock);
+ 
++struct mtk_wed_flow_block_priv {
++	struct mtk_wed_hw *hw;
++	struct net_device *dev;
++};
++
+ static void
+ wed_m32(struct mtk_wed_device *dev, u32 reg, u32 mask, u32 val)
+ {
+@@ -1745,6 +1752,99 @@ out:
+ 	mutex_unlock(&hw_lock);
+ }
+ 
++static int
++mtk_wed_setup_tc_block_cb(enum tc_setup_type type, void *type_data, void *cb_priv)
++{
++	struct mtk_wed_flow_block_priv *priv = cb_priv;
++	struct flow_cls_offload *cls = type_data;
++	struct mtk_wed_hw *hw = priv->hw;
++
++	if (!tc_can_offload(priv->dev))
++		return -EOPNOTSUPP;
++
++	if (type != TC_SETUP_CLSFLOWER)
++		return -EOPNOTSUPP;
++
++	return mtk_flow_offload_cmd(hw->eth, cls, hw->index);
++}
++
++static int
++mtk_wed_setup_tc_block(struct mtk_wed_hw *hw, struct net_device *dev,
++		       struct flow_block_offload *f)
++{
++	struct mtk_wed_flow_block_priv *priv;
++	static LIST_HEAD(block_cb_list);
++	struct flow_block_cb *block_cb;
++	struct mtk_eth *eth = hw->eth;
++	flow_setup_cb_t *cb;
++
++	if (!eth->soc->offload_version)
++		return -EOPNOTSUPP;
++
++	if (f->binder_type != FLOW_BLOCK_BINDER_TYPE_CLSACT_INGRESS)
++		return -EOPNOTSUPP;
++
++	cb = mtk_wed_setup_tc_block_cb;
++	f->driver_block_list = &block_cb_list;
++
++	switch (f->command) {
++	case FLOW_BLOCK_BIND:
++		block_cb = flow_block_cb_lookup(f->block, cb, dev);
++		if (block_cb) {
++			flow_block_cb_incref(block_cb);
++			return 0;
++		}
++
++		priv = kzalloc(sizeof(*priv), GFP_KERNEL);
++		if (!priv)
++			return -ENOMEM;
++
++		priv->hw = hw;
++		priv->dev = dev;
++		block_cb = flow_block_cb_alloc(cb, dev, priv, NULL);
++		if (IS_ERR(block_cb)) {
++			kfree(priv);
++			return PTR_ERR(block_cb);
++		}
++
++		flow_block_cb_incref(block_cb);
++		flow_block_cb_add(block_cb, f);
++		list_add_tail(&block_cb->driver_list, &block_cb_list);
++		return 0;
++	case FLOW_BLOCK_UNBIND:
++		block_cb = flow_block_cb_lookup(f->block, cb, dev);
++		if (!block_cb)
++			return -ENOENT;
++
++		if (!flow_block_cb_decref(block_cb)) {
++			flow_block_cb_remove(block_cb, f);
++			list_del(&block_cb->driver_list);
++			kfree(block_cb->cb_priv);
++		}
++		return 0;
++	default:
++		return -EOPNOTSUPP;
++	}
++}
++
++static int
++mtk_wed_setup_tc(struct mtk_wed_device *wed, struct net_device *dev,
++		 enum tc_setup_type type, void *type_data)
++{
++	struct mtk_wed_hw *hw = wed->hw;
++
++	if (hw->version < 2)
++		return -EOPNOTSUPP;
++
++	switch (type) {
++	case TC_SETUP_BLOCK:
++	case TC_SETUP_FT:
++		return mtk_wed_setup_tc_block(hw, dev, type_data);
++	default:
++		return -EOPNOTSUPP;
++	}
++}
++
+ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
+ 		    void __iomem *wdma, phys_addr_t wdma_phy,
+ 		    int index)
+@@ -1764,6 +1864,7 @@ void mtk_wed_add_hw(struct device_node *
+ 		.irq_set_mask = mtk_wed_irq_set_mask,
+ 		.detach = mtk_wed_detach,
+ 		.ppe_check = mtk_wed_ppe_check,
++		.setup_tc = mtk_wed_setup_tc,
+ 	};
+ 	struct device_node *eth_np = eth->dev->of_node;
+ 	struct platform_device *pdev;
+--- a/include/linux/soc/mediatek/mtk_wed.h
++++ b/include/linux/soc/mediatek/mtk_wed.h
+@@ -6,6 +6,7 @@
+ #include <linux/regmap.h>
+ #include <linux/pci.h>
+ #include <linux/skbuff.h>
++#include <linux/netdevice.h>
+ 
+ #define MTK_WED_TX_QUEUES		2
+ #define MTK_WED_RX_QUEUES		2
+@@ -180,6 +181,8 @@ struct mtk_wed_ops {
+ 
+ 	u32 (*irq_get)(struct mtk_wed_device *dev, u32 mask);
+ 	void (*irq_set_mask)(struct mtk_wed_device *dev, u32 mask);
++	int (*setup_tc)(struct mtk_wed_device *wed, struct net_device *dev,
++			enum tc_setup_type type, void *type_data);
+ };
+ 
+ extern const struct mtk_wed_ops __rcu *mtk_soc_wed_ops;
+@@ -238,6 +241,8 @@ mtk_wed_get_rx_capa(struct mtk_wed_devic
+ 	(_dev)->ops->msg_update(_dev, _id, _msg, _len)
+ #define mtk_wed_device_stop(_dev) (_dev)->ops->stop(_dev)
+ #define mtk_wed_device_dma_reset(_dev) (_dev)->ops->reset_dma(_dev)
++#define mtk_wed_device_setup_tc(_dev, _netdev, _type, _type_data) \
++	(_dev)->ops->setup_tc(_dev, _netdev, _type, _type_data)
+ #else
+ static inline bool mtk_wed_device_active(struct mtk_wed_device *dev)
+ {
+@@ -256,6 +261,7 @@ static inline bool mtk_wed_device_active
+ #define mtk_wed_device_update_msg(_dev, _id, _msg, _len) -ENODEV
+ #define mtk_wed_device_stop(_dev) do {} while (0)
+ #define mtk_wed_device_dma_reset(_dev) do {} while (0)
++#define mtk_wed_device_setup_tc(_dev, _netdev, _type, _type_data) -EOPNOTSUPP
+ #endif
+ 
+ #endif
diff --git a/target/linux/generic/pending-6.1/736-02-net-ethernet-mediatek-mtk_ppe-prefer-newly-added-l2-.patch b/target/linux/generic/pending-6.1/736-02-net-ethernet-mediatek-mtk_ppe-prefer-newly-added-l2-.patch
new file mode 100644
index 00000000000000..08036e0b17d9cf
--- /dev/null
+++ b/target/linux/generic/pending-6.1/736-02-net-ethernet-mediatek-mtk_ppe-prefer-newly-added-l2-.patch
@@ -0,0 +1,37 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 20 Mar 2023 15:37:55 +0100
+Subject: [PATCH] net: ethernet: mediatek: mtk_ppe: prefer newly added l2
+ flows over existing ones
+
+When a device is roaming between interfaces and a new flow entry is created,
+we should assume that its output device is more up to date than whatever
+entry existed already.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -634,10 +634,20 @@ void mtk_foe_entry_clear(struct mtk_ppe
+ static int
+ mtk_foe_entry_commit_l2(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
+ {
++	struct mtk_flow_entry *prev;
++
+ 	entry->type = MTK_FLOW_TYPE_L2;
+ 
+-	return rhashtable_insert_fast(&ppe->l2_flows, &entry->l2_node,
+-				      mtk_flow_l2_ht_params);
++	prev = rhashtable_lookup_get_insert_fast(&ppe->l2_flows, &entry->l2_node,
++						 mtk_flow_l2_ht_params);
++	if (likely(!prev))
++		return 0;
++
++	if (IS_ERR(prev))
++		return PTR_ERR(prev);
++
++	return rhashtable_replace_fast(&ppe->l2_flows, &prev->l2_node,
++				       &entry->l2_node, mtk_flow_l2_ht_params);
+ }
+ 
+ int mtk_foe_entry_commit(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
diff --git a/target/linux/generic/pending-6.1/736-03-net-ethernet-mtk_eth_soc-improve-keeping-track-of-of.patch b/target/linux/generic/pending-6.1/736-03-net-ethernet-mtk_eth_soc-improve-keeping-track-of-of.patch
new file mode 100644
index 00000000000000..ec04fb354256bc
--- /dev/null
+++ b/target/linux/generic/pending-6.1/736-03-net-ethernet-mtk_eth_soc-improve-keeping-track-of-of.patch
@@ -0,0 +1,331 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 23 Mar 2023 10:24:11 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: improve keeping track of
+ offloaded flows
+
+Unify tracking of L2 and L3 flows. Use the generic list field in struct
+mtk_foe_entry for tracking L2 subflows. Preparation for improving
+flow accounting support.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -460,42 +460,43 @@ int mtk_foe_entry_set_queue(struct mtk_e
+ 	return 0;
+ }
+ 
++static int
++mtk_flow_entry_match_len(struct mtk_eth *eth, struct mtk_foe_entry *entry)
++{
++	int type = mtk_get_ib1_pkt_type(eth, entry->ib1);
++
++	if (type > MTK_PPE_PKT_TYPE_IPV4_DSLITE)
++		return offsetof(struct mtk_foe_entry, ipv6._rsv);
++	else
++		return offsetof(struct mtk_foe_entry, ipv4.ib2);
++}
++
+ static bool
+ mtk_flow_entry_match(struct mtk_eth *eth, struct mtk_flow_entry *entry,
+-		     struct mtk_foe_entry *data)
++		     struct mtk_foe_entry *data, int len)
+ {
+-	int type, len;
+-
+ 	if ((data->ib1 ^ entry->data.ib1) & MTK_FOE_IB1_UDP)
+ 		return false;
+ 
+-	type = mtk_get_ib1_pkt_type(eth, entry->data.ib1);
+-	if (type > MTK_PPE_PKT_TYPE_IPV4_DSLITE)
+-		len = offsetof(struct mtk_foe_entry, ipv6._rsv);
+-	else
+-		len = offsetof(struct mtk_foe_entry, ipv4.ib2);
+-
+ 	return !memcmp(&entry->data.data, &data->data, len - 4);
+ }
+ 
+ static void
+-__mtk_foe_entry_clear(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
++__mtk_foe_entry_clear(struct mtk_ppe *ppe, struct mtk_flow_entry *entry,
++		      bool set_state)
+ {
+-	struct hlist_head *head;
+ 	struct hlist_node *tmp;
+ 
+ 	if (entry->type == MTK_FLOW_TYPE_L2) {
+ 		rhashtable_remove_fast(&ppe->l2_flows, &entry->l2_node,
+ 				       mtk_flow_l2_ht_params);
+ 
+-		head = &entry->l2_flows;
+-		hlist_for_each_entry_safe(entry, tmp, head, l2_data.list)
+-			__mtk_foe_entry_clear(ppe, entry);
++		hlist_for_each_entry_safe(entry, tmp, &entry->l2_flows, l2_list)
++			__mtk_foe_entry_clear(ppe, entry, set_state);
+ 		return;
+ 	}
+ 
+-	hlist_del_init(&entry->list);
+-	if (entry->hash != 0xffff) {
++	if (entry->hash != 0xffff && set_state) {
+ 		struct mtk_foe_entry *hwe = mtk_foe_get_entry(ppe, entry->hash);
+ 
+ 		hwe->ib1 &= ~MTK_FOE_IB1_STATE;
+@@ -515,7 +516,8 @@ __mtk_foe_entry_clear(struct mtk_ppe *pp
+ 	if (entry->type != MTK_FLOW_TYPE_L2_SUBFLOW)
+ 		return;
+ 
+-	hlist_del_init(&entry->l2_data.list);
++	hlist_del_init(&entry->l2_list);
++	hlist_del_init(&entry->list);
+ 	kfree(entry);
+ }
+ 
+@@ -531,66 +533,55 @@ static int __mtk_foe_entry_idle_time(str
+ 		return now - timestamp;
+ }
+ 
++static bool
++mtk_flow_entry_update(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
++{
++	struct mtk_foe_entry foe = {};
++	struct mtk_foe_entry *hwe;
++	u16 hash = entry->hash;
++	int len;
++
++	if (hash == 0xffff)
++		return false;
++
++	hwe = mtk_foe_get_entry(ppe, hash);
++	len = mtk_flow_entry_match_len(ppe->eth, &entry->data);
++	memcpy(&foe, hwe, len);
++
++	if (!mtk_flow_entry_match(ppe->eth, entry, &foe, len) ||
++	    FIELD_GET(MTK_FOE_IB1_STATE, foe.ib1) != MTK_FOE_STATE_BIND)
++		return false;
++
++	entry->data.ib1 = foe.ib1;
++
++	return true;
++}
++
+ static void
+ mtk_flow_entry_update_l2(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
+ {
+ 	u32 ib1_ts_mask = mtk_get_ib1_ts_mask(ppe->eth);
+ 	struct mtk_flow_entry *cur;
+-	struct mtk_foe_entry *hwe;
+ 	struct hlist_node *tmp;
+ 	int idle;
+ 
+ 	idle = __mtk_foe_entry_idle_time(ppe, entry->data.ib1);
+-	hlist_for_each_entry_safe(cur, tmp, &entry->l2_flows, l2_data.list) {
++	hlist_for_each_entry_safe(cur, tmp, &entry->l2_flows, l2_list) {
+ 		int cur_idle;
+-		u32 ib1;
+-
+-		hwe = mtk_foe_get_entry(ppe, cur->hash);
+-		ib1 = READ_ONCE(hwe->ib1);
+ 
+-		if (FIELD_GET(MTK_FOE_IB1_STATE, ib1) != MTK_FOE_STATE_BIND) {
+-			cur->hash = 0xffff;
+-			__mtk_foe_entry_clear(ppe, cur);
++		if (!mtk_flow_entry_update(ppe, cur)) {
++			__mtk_foe_entry_clear(ppe, entry, false);
+ 			continue;
+ 		}
+ 
+-		cur_idle = __mtk_foe_entry_idle_time(ppe, ib1);
++		cur_idle = __mtk_foe_entry_idle_time(ppe, cur->data.ib1);
+ 		if (cur_idle >= idle)
+ 			continue;
+ 
+ 		idle = cur_idle;
+ 		entry->data.ib1 &= ~ib1_ts_mask;
+-		entry->data.ib1 |= hwe->ib1 & ib1_ts_mask;
+-	}
+-}
+-
+-static void
+-mtk_flow_entry_update(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
+-{
+-	struct mtk_foe_entry foe = {};
+-	struct mtk_foe_entry *hwe;
+-
+-	spin_lock_bh(&ppe_lock);
+-
+-	if (entry->type == MTK_FLOW_TYPE_L2) {
+-		mtk_flow_entry_update_l2(ppe, entry);
+-		goto out;
++		entry->data.ib1 |= cur->data.ib1 & ib1_ts_mask;
+ 	}
+-
+-	if (entry->hash == 0xffff)
+-		goto out;
+-
+-	hwe = mtk_foe_get_entry(ppe, entry->hash);
+-	memcpy(&foe, hwe, ppe->eth->soc->foe_entry_size);
+-	if (!mtk_flow_entry_match(ppe->eth, entry, &foe)) {
+-		entry->hash = 0xffff;
+-		goto out;
+-	}
+-
+-	entry->data.ib1 = foe.ib1;
+-
+-out:
+-	spin_unlock_bh(&ppe_lock);
+ }
+ 
+ static void
+@@ -627,7 +618,8 @@ __mtk_foe_entry_commit(struct mtk_ppe *p
+ void mtk_foe_entry_clear(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
+ {
+ 	spin_lock_bh(&ppe_lock);
+-	__mtk_foe_entry_clear(ppe, entry);
++	__mtk_foe_entry_clear(ppe, entry, true);
++	hlist_del_init(&entry->list);
+ 	spin_unlock_bh(&ppe_lock);
+ }
+ 
+@@ -674,8 +666,8 @@ mtk_foe_entry_commit_subflow(struct mtk_
+ {
+ 	const struct mtk_soc_data *soc = ppe->eth->soc;
+ 	struct mtk_flow_entry *flow_info;
+-	struct mtk_foe_entry foe = {}, *hwe;
+ 	struct mtk_foe_mac_info *l2;
++	struct mtk_foe_entry *hwe;
+ 	u32 ib1_mask = mtk_get_ib1_pkt_type_mask(ppe->eth) | MTK_FOE_IB1_UDP;
+ 	int type;
+ 
+@@ -683,30 +675,30 @@ mtk_foe_entry_commit_subflow(struct mtk_
+ 	if (!flow_info)
+ 		return;
+ 
+-	flow_info->l2_data.base_flow = entry;
+ 	flow_info->type = MTK_FLOW_TYPE_L2_SUBFLOW;
+ 	flow_info->hash = hash;
+ 	hlist_add_head(&flow_info->list,
+ 		       &ppe->foe_flow[hash / soc->hash_offset]);
+-	hlist_add_head(&flow_info->l2_data.list, &entry->l2_flows);
++	hlist_add_head(&flow_info->l2_list, &entry->l2_flows);
+ 
+ 	hwe = mtk_foe_get_entry(ppe, hash);
+-	memcpy(&foe, hwe, soc->foe_entry_size);
+-	foe.ib1 &= ib1_mask;
+-	foe.ib1 |= entry->data.ib1 & ~ib1_mask;
++	memcpy(&flow_info->data, hwe, soc->foe_entry_size);
++	flow_info->data.ib1 &= ib1_mask;
++	flow_info->data.ib1 |= entry->data.ib1 & ~ib1_mask;
+ 
+-	l2 = mtk_foe_entry_l2(ppe->eth, &foe);
++	l2 = mtk_foe_entry_l2(ppe->eth, &flow_info->data);
+ 	memcpy(l2, &entry->data.bridge.l2, sizeof(*l2));
+ 
+-	type = mtk_get_ib1_pkt_type(ppe->eth, foe.ib1);
++	type = mtk_get_ib1_pkt_type(ppe->eth, flow_info->data.ib1);
+ 	if (type == MTK_PPE_PKT_TYPE_IPV4_HNAPT)
+-		memcpy(&foe.ipv4.new, &foe.ipv4.orig, sizeof(foe.ipv4.new));
++		memcpy(&flow_info->data.ipv4.new, &flow_info->data.ipv4.orig,
++		       sizeof(flow_info->data.ipv4.new));
+ 	else if (type >= MTK_PPE_PKT_TYPE_IPV6_ROUTE_3T && l2->etype == ETH_P_IP)
+ 		l2->etype = ETH_P_IPV6;
+ 
+-	*mtk_foe_entry_ib2(ppe->eth, &foe) = entry->data.bridge.ib2;
++	*mtk_foe_entry_ib2(ppe->eth, &flow_info->data) = entry->data.bridge.ib2;
+ 
+-	__mtk_foe_entry_commit(ppe, &foe, hash);
++	__mtk_foe_entry_commit(ppe, &flow_info->data, hash);
+ }
+ 
+ void __mtk_ppe_check_skb(struct mtk_ppe *ppe, struct sk_buff *skb, u16 hash)
+@@ -716,9 +708,11 @@ void __mtk_ppe_check_skb(struct mtk_ppe
+ 	struct mtk_foe_entry *hwe = mtk_foe_get_entry(ppe, hash);
+ 	struct mtk_flow_entry *entry;
+ 	struct mtk_foe_bridge key = {};
++	struct mtk_foe_entry foe = {};
+ 	struct hlist_node *n;
+ 	struct ethhdr *eh;
+ 	bool found = false;
++	int entry_len;
+ 	u8 *tag;
+ 
+ 	spin_lock_bh(&ppe_lock);
+@@ -726,20 +720,14 @@ void __mtk_ppe_check_skb(struct mtk_ppe
+ 	if (FIELD_GET(MTK_FOE_IB1_STATE, hwe->ib1) == MTK_FOE_STATE_BIND)
+ 		goto out;
+ 
+-	hlist_for_each_entry_safe(entry, n, head, list) {
+-		if (entry->type == MTK_FLOW_TYPE_L2_SUBFLOW) {
+-			if (unlikely(FIELD_GET(MTK_FOE_IB1_STATE, hwe->ib1) ==
+-				     MTK_FOE_STATE_BIND))
+-				continue;
+-
+-			entry->hash = 0xffff;
+-			__mtk_foe_entry_clear(ppe, entry);
+-			continue;
+-		}
++	entry_len = mtk_flow_entry_match_len(ppe->eth, hwe);
++	memcpy(&foe, hwe, entry_len);
+ 
+-		if (found || !mtk_flow_entry_match(ppe->eth, entry, hwe)) {
++	hlist_for_each_entry_safe(entry, n, head, list) {
++		if (found ||
++		    !mtk_flow_entry_match(ppe->eth, entry, &foe, entry_len)) {
+ 			if (entry->hash != 0xffff)
+-				entry->hash = 0xffff;
++				__mtk_foe_entry_clear(ppe, entry, false);
+ 			continue;
+ 		}
+ 
+@@ -790,9 +778,17 @@ out:
+ 
+ int mtk_foe_entry_idle_time(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
+ {
+-	mtk_flow_entry_update(ppe, entry);
++	int idle;
++
++	spin_lock_bh(&ppe_lock);
++	if (entry->type == MTK_FLOW_TYPE_L2)
++		mtk_flow_entry_update_l2(ppe, entry);
++	else
++		mtk_flow_entry_update(ppe, entry);
++	idle = __mtk_foe_entry_idle_time(ppe, entry->data.ib1);
++	spin_unlock_bh(&ppe_lock);
+ 
+-	return __mtk_foe_entry_idle_time(ppe, entry->data.ib1);
++	return idle;
+ }
+ 
+ int mtk_ppe_prepare_reset(struct mtk_ppe *ppe)
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h
+@@ -265,7 +265,12 @@ enum {
+ 
+ struct mtk_flow_entry {
+ 	union {
+-		struct hlist_node list;
++		/* regular flows + L2 subflows */
++		struct {
++			struct hlist_node list;
++			struct hlist_node l2_list;
++		};
++		/* L2 flows */
+ 		struct {
+ 			struct rhash_head l2_node;
+ 			struct hlist_head l2_flows;
+@@ -275,13 +280,7 @@ struct mtk_flow_entry {
+ 	s8 wed_index;
+ 	u8 ppe_index;
+ 	u16 hash;
+-	union {
+-		struct mtk_foe_entry data;
+-		struct {
+-			struct mtk_flow_entry *base_flow;
+-			struct hlist_node list;
+-		} l2_data;
+-	};
++	struct mtk_foe_entry data;
+ 	struct rhash_head node;
+ 	unsigned long cookie;
+ };
diff --git a/target/linux/generic/pending-6.1/736-04-net-ethernet-mediatek-fix-ppe-flow-accounting-for-L2.patch b/target/linux/generic/pending-6.1/736-04-net-ethernet-mediatek-fix-ppe-flow-accounting-for-L2.patch
new file mode 100644
index 00000000000000..79386d6cf909e2
--- /dev/null
+++ b/target/linux/generic/pending-6.1/736-04-net-ethernet-mediatek-fix-ppe-flow-accounting-for-L2.patch
@@ -0,0 +1,333 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 23 Mar 2023 11:05:22 +0100
+Subject: [PATCH] net: ethernet: mediatek: fix ppe flow accounting for L2
+ flows
+
+For L2 flows, the packet/byte counters should report the sum of the
+counters of their subflows, both current and expired.
+In order to make this work, change the way that accounting data is tracked.
+Reset counters when a flow enters bind. Once it expires (or enters unbind),
+store the last counter value in struct mtk_flow_entry.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -80,9 +80,9 @@ static int mtk_ppe_mib_wait_busy(struct
+ 	int ret;
+ 	u32 val;
+ 
+-	ret = readl_poll_timeout(ppe->base + MTK_PPE_MIB_SER_CR, val,
+-				 !(val & MTK_PPE_MIB_SER_CR_ST),
+-				 20, MTK_PPE_WAIT_TIMEOUT_US);
++	ret = readl_poll_timeout_atomic(ppe->base + MTK_PPE_MIB_SER_CR, val,
++					!(val & MTK_PPE_MIB_SER_CR_ST),
++					20, MTK_PPE_WAIT_TIMEOUT_US);
+ 
+ 	if (ret)
+ 		dev_err(ppe->dev, "MIB table busy");
+@@ -90,18 +90,32 @@ static int mtk_ppe_mib_wait_busy(struct
+ 	return ret;
+ }
+ 
+-static int mtk_mib_entry_read(struct mtk_ppe *ppe, u16 index, u64 *bytes, u64 *packets)
++static inline struct mtk_foe_accounting *
++mtk_ppe_acct_data(struct mtk_ppe *ppe, u16 index)
++{
++	if (!ppe->acct_table)
++		return NULL;
++
++	return ppe->acct_table + index * sizeof(struct mtk_foe_accounting);
++}
++
++struct mtk_foe_accounting *mtk_ppe_mib_entry_read(struct mtk_ppe *ppe, u16 index)
+ {
+ 	u32 byte_cnt_low, byte_cnt_high, pkt_cnt_low, pkt_cnt_high;
+ 	u32 val, cnt_r0, cnt_r1, cnt_r2;
++	struct mtk_foe_accounting *acct;
+ 	int ret;
+ 
+ 	val = FIELD_PREP(MTK_PPE_MIB_SER_CR_ADDR, index) | MTK_PPE_MIB_SER_CR_ST;
+ 	ppe_w32(ppe, MTK_PPE_MIB_SER_CR, val);
+ 
++	acct = mtk_ppe_acct_data(ppe, index);
++	if (!acct)
++		return NULL;
++
+ 	ret = mtk_ppe_mib_wait_busy(ppe);
+ 	if (ret)
+-		return ret;
++		return acct;
+ 
+ 	cnt_r0 = readl(ppe->base + MTK_PPE_MIB_SER_R0);
+ 	cnt_r1 = readl(ppe->base + MTK_PPE_MIB_SER_R1);
+@@ -111,10 +125,11 @@ static int mtk_mib_entry_read(struct mtk
+ 	byte_cnt_high = FIELD_GET(MTK_PPE_MIB_SER_R1_BYTE_CNT_HIGH, cnt_r1);
+ 	pkt_cnt_low = FIELD_GET(MTK_PPE_MIB_SER_R1_PKT_CNT_LOW, cnt_r1);
+ 	pkt_cnt_high = FIELD_GET(MTK_PPE_MIB_SER_R2_PKT_CNT_HIGH, cnt_r2);
+-	*bytes = ((u64)byte_cnt_high << 32) | byte_cnt_low;
+-	*packets = (pkt_cnt_high << 16) | pkt_cnt_low;
+ 
+-	return 0;
++	acct->bytes += ((u64)byte_cnt_high << 32) | byte_cnt_low;
++	acct->packets += (pkt_cnt_high << 16) | pkt_cnt_low;
++
++	return acct;
+ }
+ 
+ static void mtk_ppe_cache_clear(struct mtk_ppe *ppe)
+@@ -503,13 +518,6 @@ __mtk_foe_entry_clear(struct mtk_ppe *pp
+ 		hwe->ib1 |= FIELD_PREP(MTK_FOE_IB1_STATE, MTK_FOE_STATE_INVALID);
+ 		dma_wmb();
+ 		mtk_ppe_cache_clear(ppe);
+-		if (ppe->accounting) {
+-			struct mtk_foe_accounting *acct;
+-
+-			acct = ppe->acct_table + entry->hash * sizeof(*acct);
+-			acct->packets = 0;
+-			acct->bytes = 0;
+-		}
+ 	}
+ 	entry->hash = 0xffff;
+ 
+@@ -534,11 +542,14 @@ static int __mtk_foe_entry_idle_time(str
+ }
+ 
+ static bool
+-mtk_flow_entry_update(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
++mtk_flow_entry_update(struct mtk_ppe *ppe, struct mtk_flow_entry *entry,
++		      u64 *packets, u64 *bytes)
+ {
++	struct mtk_foe_accounting *acct;
+ 	struct mtk_foe_entry foe = {};
+ 	struct mtk_foe_entry *hwe;
+ 	u16 hash = entry->hash;
++	bool ret = false;
+ 	int len;
+ 
+ 	if (hash == 0xffff)
+@@ -549,18 +560,35 @@ mtk_flow_entry_update(struct mtk_ppe *pp
+ 	memcpy(&foe, hwe, len);
+ 
+ 	if (!mtk_flow_entry_match(ppe->eth, entry, &foe, len) ||
+-	    FIELD_GET(MTK_FOE_IB1_STATE, foe.ib1) != MTK_FOE_STATE_BIND)
+-		return false;
++	    FIELD_GET(MTK_FOE_IB1_STATE, foe.ib1) != MTK_FOE_STATE_BIND) {
++		acct = mtk_ppe_acct_data(ppe, hash);
++		if (acct) {
++			entry->prev_packets += acct->packets;
++			entry->prev_bytes += acct->bytes;
++		}
++
++		goto out;
++	}
+ 
+ 	entry->data.ib1 = foe.ib1;
++	acct = mtk_ppe_mib_entry_read(ppe, hash);
++	ret = true;
++
++out:
++	if (acct) {
++		*packets += acct->packets;
++		*bytes += acct->bytes;
++	}
+ 
+-	return true;
++	return ret;
+ }
+ 
+ static void
+ mtk_flow_entry_update_l2(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
+ {
+ 	u32 ib1_ts_mask = mtk_get_ib1_ts_mask(ppe->eth);
++	u64 *packets = &entry->packets;
++	u64 *bytes = &entry->bytes;
+ 	struct mtk_flow_entry *cur;
+ 	struct hlist_node *tmp;
+ 	int idle;
+@@ -569,7 +597,9 @@ mtk_flow_entry_update_l2(struct mtk_ppe
+ 	hlist_for_each_entry_safe(cur, tmp, &entry->l2_flows, l2_list) {
+ 		int cur_idle;
+ 
+-		if (!mtk_flow_entry_update(ppe, cur)) {
++		if (!mtk_flow_entry_update(ppe, cur, packets, bytes)) {
++			entry->prev_packets += cur->prev_packets;
++			entry->prev_bytes += cur->prev_bytes;
+ 			__mtk_foe_entry_clear(ppe, entry, false);
+ 			continue;
+ 		}
+@@ -584,10 +614,29 @@ mtk_flow_entry_update_l2(struct mtk_ppe
+ 	}
+ }
+ 
++void mtk_foe_entry_get_stats(struct mtk_ppe *ppe, struct mtk_flow_entry *entry,
++			     int *idle)
++{
++	entry->packets = entry->prev_packets;
++	entry->bytes = entry->prev_bytes;
++
++	spin_lock_bh(&ppe_lock);
++
++	if (entry->type == MTK_FLOW_TYPE_L2)
++		mtk_flow_entry_update_l2(ppe, entry);
++	else
++		mtk_flow_entry_update(ppe, entry, &entry->packets, &entry->bytes);
++
++	*idle = __mtk_foe_entry_idle_time(ppe, entry->data.ib1);
++
++	spin_unlock_bh(&ppe_lock);
++}
++
+ static void
+ __mtk_foe_entry_commit(struct mtk_ppe *ppe, struct mtk_foe_entry *entry,
+ 		       u16 hash)
+ {
++	struct mtk_foe_accounting *acct;
+ 	struct mtk_eth *eth = ppe->eth;
+ 	u16 timestamp = mtk_eth_timestamp(eth);
+ 	struct mtk_foe_entry *hwe;
+@@ -612,6 +661,12 @@ __mtk_foe_entry_commit(struct mtk_ppe *p
+ 
+ 	dma_wmb();
+ 
++	acct = mtk_ppe_mib_entry_read(ppe, hash);
++	if (acct) {
++		acct->packets = 0;
++		acct->bytes = 0;
++	}
++
+ 	mtk_ppe_cache_clear(ppe);
+ }
+ 
+@@ -776,21 +831,6 @@ out:
+ 	spin_unlock_bh(&ppe_lock);
+ }
+ 
+-int mtk_foe_entry_idle_time(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
+-{
+-	int idle;
+-
+-	spin_lock_bh(&ppe_lock);
+-	if (entry->type == MTK_FLOW_TYPE_L2)
+-		mtk_flow_entry_update_l2(ppe, entry);
+-	else
+-		mtk_flow_entry_update(ppe, entry);
+-	idle = __mtk_foe_entry_idle_time(ppe, entry->data.ib1);
+-	spin_unlock_bh(&ppe_lock);
+-
+-	return idle;
+-}
+-
+ int mtk_ppe_prepare_reset(struct mtk_ppe *ppe)
+ {
+ 	if (!ppe)
+@@ -818,32 +858,6 @@ int mtk_ppe_prepare_reset(struct mtk_ppe
+ 	return mtk_ppe_wait_busy(ppe);
+ }
+ 
+-struct mtk_foe_accounting *mtk_foe_entry_get_mib(struct mtk_ppe *ppe, u32 index,
+-						 struct mtk_foe_accounting *diff)
+-{
+-	struct mtk_foe_accounting *acct;
+-	int size = sizeof(struct mtk_foe_accounting);
+-	u64 bytes, packets;
+-
+-	if (!ppe->accounting)
+-		return NULL;
+-
+-	if (mtk_mib_entry_read(ppe, index, &bytes, &packets))
+-		return NULL;
+-
+-	acct = ppe->acct_table + index * size;
+-
+-	acct->bytes += bytes;
+-	acct->packets += packets;
+-
+-	if (diff) {
+-		diff->bytes = bytes;
+-		diff->packets = packets;
+-	}
+-
+-	return acct;
+-}
+-
+ struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base, int index)
+ {
+ 	bool accounting = eth->soc->has_accounting;
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h
+@@ -283,6 +283,8 @@ struct mtk_flow_entry {
+ 	struct mtk_foe_entry data;
+ 	struct rhash_head node;
+ 	unsigned long cookie;
++	u64 prev_packets, prev_bytes;
++	u64 packets, bytes;
+ };
+ 
+ struct mtk_mib_entry {
+@@ -326,6 +328,7 @@ void mtk_ppe_deinit(struct mtk_eth *eth)
+ void mtk_ppe_start(struct mtk_ppe *ppe);
+ int mtk_ppe_stop(struct mtk_ppe *ppe);
+ int mtk_ppe_prepare_reset(struct mtk_ppe *ppe);
++struct mtk_foe_accounting *mtk_ppe_mib_entry_read(struct mtk_ppe *ppe, u16 index);
+ 
+ void __mtk_ppe_check_skb(struct mtk_ppe *ppe, struct sk_buff *skb, u16 hash);
+ 
+@@ -374,9 +377,8 @@ int mtk_foe_entry_set_queue(struct mtk_e
+ 			    unsigned int queue);
+ int mtk_foe_entry_commit(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+ void mtk_foe_entry_clear(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+-int mtk_foe_entry_idle_time(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+ int mtk_ppe_debugfs_init(struct mtk_ppe *ppe, int index);
+-struct mtk_foe_accounting *mtk_foe_entry_get_mib(struct mtk_ppe *ppe, u32 index,
+-						 struct mtk_foe_accounting *diff);
++void mtk_foe_entry_get_stats(struct mtk_ppe *ppe, struct mtk_flow_entry *entry,
++			     int *idle);
+ 
+ #endif
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_debugfs.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_debugfs.c
+@@ -96,7 +96,7 @@ mtk_ppe_debugfs_foe_show(struct seq_file
+ 		if (bind && state != MTK_FOE_STATE_BIND)
+ 			continue;
+ 
+-		acct = mtk_foe_entry_get_mib(ppe, i, NULL);
++		acct = mtk_ppe_mib_entry_read(ppe, i);
+ 
+ 		type = FIELD_GET(MTK_FOE_IB1_PACKET_TYPE, entry->ib1);
+ 		seq_printf(m, "%05x %s %7s", i,
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
+@@ -499,24 +499,21 @@ static int
+ mtk_flow_offload_stats(struct mtk_eth *eth, struct flow_cls_offload *f)
+ {
+ 	struct mtk_flow_entry *entry;
+-	struct mtk_foe_accounting diff;
+-	u32 idle;
++	u64 packets, bytes;
++	int idle;
+ 
+ 	entry = rhashtable_lookup(&eth->flow_table, &f->cookie,
+ 				  mtk_flow_ht_params);
+ 	if (!entry)
+ 		return -ENOENT;
+ 
+-	idle = mtk_foe_entry_idle_time(eth->ppe[entry->ppe_index], entry);
++	packets = entry->packets;
++	bytes = entry->bytes;
++	mtk_foe_entry_get_stats(eth->ppe[entry->ppe_index], entry, &idle);
++	f->stats.pkts += entry->packets - packets;
++	f->stats.bytes += entry->bytes - bytes;
+ 	f->stats.lastused = jiffies - idle * HZ;
+ 
+-	if (entry->hash != 0xFFFF &&
+-	    mtk_foe_entry_get_mib(eth->ppe[entry->ppe_index], entry->hash,
+-				  &diff)) {
+-		f->stats.pkts += diff.packets;
+-		f->stats.bytes += diff.bytes;
+-	}
+-
+ 	return 0;
+ }
+ 
diff --git a/target/linux/generic/pending-6.1/736-06-net-ethernet-mediatek-fix-ppe-flow-accounting-for-v1.patch b/target/linux/generic/pending-6.1/736-06-net-ethernet-mediatek-fix-ppe-flow-accounting-for-v1.patch
new file mode 100644
index 00000000000000..33c9838327280e
--- /dev/null
+++ b/target/linux/generic/pending-6.1/736-06-net-ethernet-mediatek-fix-ppe-flow-accounting-for-v1.patch
@@ -0,0 +1,51 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 23 Mar 2023 21:45:43 +0100
+Subject: [PATCH] net: ethernet: mediatek: fix ppe flow accounting for v1
+ hardware
+
+Older chips (like MT7622) use a different bit in ib2 to enable hardware
+counter support.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -640,6 +640,7 @@ __mtk_foe_entry_commit(struct mtk_ppe *p
+ 	struct mtk_eth *eth = ppe->eth;
+ 	u16 timestamp = mtk_eth_timestamp(eth);
+ 	struct mtk_foe_entry *hwe;
++	u32 val;
+ 
+ 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+ 		entry->ib1 &= ~MTK_FOE_IB1_BIND_TIMESTAMP_V2;
+@@ -656,8 +657,13 @@ __mtk_foe_entry_commit(struct mtk_ppe *p
+ 	wmb();
+ 	hwe->ib1 = entry->ib1;
+ 
+-	if (ppe->accounting)
+-		*mtk_foe_entry_ib2(eth, hwe) |= MTK_FOE_IB2_MIB_CNT;
++	if (ppe->accounting) {
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++			val = MTK_FOE_IB2_MIB_CNT_V2;
++		else
++			val = MTK_FOE_IB2_MIB_CNT;
++		*mtk_foe_entry_ib2(eth, hwe) |= val;
++	}
+ 
+ 	dma_wmb();
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h
+@@ -55,9 +55,10 @@ enum {
+ #define MTK_FOE_IB2_PSE_QOS		BIT(4)
+ #define MTK_FOE_IB2_DEST_PORT		GENMASK(7, 5)
+ #define MTK_FOE_IB2_MULTICAST		BIT(8)
++#define MTK_FOE_IB2_MIB_CNT		BIT(10)
+ 
+ #define MTK_FOE_IB2_WDMA_QID2		GENMASK(13, 12)
+-#define MTK_FOE_IB2_MIB_CNT		BIT(15)
++#define MTK_FOE_IB2_MIB_CNT_V2		BIT(15)
+ #define MTK_FOE_IB2_WDMA_DEVIDX		BIT(16)
+ #define MTK_FOE_IB2_WDMA_WINFO		BIT(17)
+ 
diff --git a/target/linux/generic/pending-6.1/737-01-net-ethernet-mtk_eth_soc-add-MTK_NETSYS_V1-capabilit.patch b/target/linux/generic/pending-6.1/737-01-net-ethernet-mtk_eth_soc-add-MTK_NETSYS_V1-capabilit.patch
new file mode 100644
index 00000000000000..bf1bc78b23aec6
--- /dev/null
+++ b/target/linux/generic/pending-6.1/737-01-net-ethernet-mtk_eth_soc-add-MTK_NETSYS_V1-capabilit.patch
@@ -0,0 +1,223 @@
+From 663fa1b7e0cb2c929008482014a70c6625caad75 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 7 Mar 2023 15:55:13 +0000
+Subject: [PATCH 1/7] net: ethernet: mtk_eth_soc: add MTK_NETSYS_V1 capability
+ bit
+
+Introduce MTK_NETSYS_V1 bit in the device capabilities for
+MT7621/MT7622/MT7623/MT7628/MT7629 SoCs.
+Use !MTK_NETSYS_V1 instead of MTK_NETSYS_V2 in the driver codebase.
+This is a preliminary patch to introduce support for MT7988 SoC.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 30 +++++++-------
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h | 45 ++++++++++++---------
+ 2 files changed, 41 insertions(+), 34 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -640,7 +640,7 @@ static void mtk_set_queue_speed(struct m
+ 	      FIELD_PREP(MTK_QTX_SCH_MIN_RATE_MAN, 1) |
+ 	      FIELD_PREP(MTK_QTX_SCH_MIN_RATE_EXP, 4) |
+ 	      MTK_QTX_SCH_LEAKY_BUCKET_SIZE;
+-	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1))
+ 		val |= MTK_QTX_SCH_LEAKY_BUCKET_EN;
+ 
+ 	if (IS_ENABLED(CONFIG_SOC_MT7621)) {
+@@ -1018,7 +1018,7 @@ static bool mtk_rx_get_desc(struct mtk_e
+ 	rxd->rxd1 = READ_ONCE(dma_rxd->rxd1);
+ 	rxd->rxd3 = READ_ONCE(dma_rxd->rxd3);
+ 	rxd->rxd4 = READ_ONCE(dma_rxd->rxd4);
+-	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1)) {
+ 		rxd->rxd5 = READ_ONCE(dma_rxd->rxd5);
+ 		rxd->rxd6 = READ_ONCE(dma_rxd->rxd6);
+ 	}
+@@ -1076,7 +1076,7 @@ static int mtk_init_fq_dma(struct mtk_et
+ 
+ 		txd->txd3 = TX_DMA_PLEN0(MTK_QDMA_PAGE_SIZE);
+ 		txd->txd4 = 0;
+-		if (MTK_HAS_CAPS(soc->caps, MTK_NETSYS_V2)) {
++		if (!MTK_HAS_CAPS(soc->caps, MTK_NETSYS_V1)) {
+ 			txd->txd5 = 0;
+ 			txd->txd6 = 0;
+ 			txd->txd7 = 0;
+@@ -1267,7 +1267,7 @@ static void mtk_tx_set_dma_desc(struct n
+ 	struct mtk_mac *mac = netdev_priv(dev);
+ 	struct mtk_eth *eth = mac->hw;
+ 
+-	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1))
+ 		mtk_tx_set_dma_desc_v2(dev, txd, info);
+ 	else
+ 		mtk_tx_set_dma_desc_v1(dev, txd, info);
+@@ -1950,7 +1950,7 @@ static int mtk_poll_rx(struct napi_struc
+ 			break;
+ 
+ 		/* find out which mac the packet come from. values start at 1 */
+-		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++		if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1))
+ 			mac = RX_DMA_GET_SPORT_V2(trxd.rxd5) - 1;
+ 		else if (!MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628) &&
+ 			 !(trxd.rxd4 & RX_DMA_SPECIAL_TAG))
+@@ -2046,7 +2046,7 @@ static int mtk_poll_rx(struct napi_struc
+ 		skb->dev = netdev;
+ 		bytes += skb->len;
+ 
+-		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++		if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1)) {
+ 			reason = FIELD_GET(MTK_RXD5_PPE_CPU_REASON, trxd.rxd5);
+ 			hash = trxd.rxd5 & MTK_RXD5_FOE_ENTRY;
+ 			if (hash != MTK_RXD5_FOE_ENTRY)
+@@ -2071,7 +2071,7 @@ static int mtk_poll_rx(struct napi_struc
+ 		/* When using VLAN untagging in combination with DSA, the
+ 		 * hardware treats the MTK special tag as a VLAN and untags it.
+ 		 */
+-		if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2) &&
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1) &&
+ 		    (trxd.rxd2 & RX_DMA_VTAG) && netdev_uses_dsa(netdev)) {
+ 			unsigned int port = RX_DMA_VPID(trxd.rxd3) & GENMASK(2, 0);
+ 
+@@ -2382,7 +2382,7 @@ static int mtk_tx_alloc(struct mtk_eth *
+ 		txd->txd2 = next_ptr;
+ 		txd->txd3 = TX_DMA_LS0 | TX_DMA_OWNER_CPU;
+ 		txd->txd4 = 0;
+-		if (MTK_HAS_CAPS(soc->caps, MTK_NETSYS_V2)) {
++		if (!MTK_HAS_CAPS(soc->caps, MTK_NETSYS_V1)) {
+ 			txd->txd5 = 0;
+ 			txd->txd6 = 0;
+ 			txd->txd7 = 0;
+@@ -2435,7 +2435,7 @@ static int mtk_tx_alloc(struct mtk_eth *
+ 			      FIELD_PREP(MTK_QTX_SCH_MIN_RATE_MAN, 1) |
+ 			      FIELD_PREP(MTK_QTX_SCH_MIN_RATE_EXP, 4) |
+ 			      MTK_QTX_SCH_LEAKY_BUCKET_SIZE;
+-			if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++			if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1))
+ 				val |= MTK_QTX_SCH_LEAKY_BUCKET_EN;
+ 			mtk_w32(eth, val, soc->reg_map->qdma.qtx_sch + ofs);
+ 			ofs += MTK_QTX_OFFSET;
+@@ -2571,7 +2571,7 @@ static int mtk_rx_alloc(struct mtk_eth *
+ 
+ 		rxd->rxd3 = 0;
+ 		rxd->rxd4 = 0;
+-		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++		if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1)) {
+ 			rxd->rxd5 = 0;
+ 			rxd->rxd6 = 0;
+ 			rxd->rxd7 = 0;
+@@ -3119,7 +3119,7 @@ static int mtk_start_dma(struct mtk_eth
+ 		       MTK_TX_BT_32DWORDS | MTK_NDP_CO_PRO |
+ 		       MTK_RX_2B_OFFSET | MTK_TX_WB_DDONE;
+ 
+-		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++		if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1))
+ 			val |= MTK_MUTLI_CNT | MTK_RESV_BUF |
+ 			       MTK_WCOMP_EN | MTK_DMAD_WR_WDONE |
+ 			       MTK_CHK_DDONE_EN | MTK_LEAKY_BUCKET_EN;
+@@ -3529,7 +3529,7 @@ static void mtk_hw_reset(struct mtk_eth
+ {
+ 	u32 val;
+ 
+-	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1)) {
+ 		regmap_write(eth->ethsys, ETHSYS_FE_RST_CHK_IDLE_EN, 0);
+ 		val = RSTCTRL_PPE0_V2;
+ 	} else {
+@@ -3541,7 +3541,7 @@ static void mtk_hw_reset(struct mtk_eth
+ 
+ 	ethsys_reset(eth, RSTCTRL_ETH | RSTCTRL_FE | val);
+ 
+-	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1))
+ 		regmap_write(eth->ethsys, ETHSYS_FE_RST_CHK_IDLE_EN,
+ 			     0x3ffffff);
+ }
+@@ -3737,7 +3737,7 @@ static int mtk_hw_init(struct mtk_eth *e
+ 	else
+ 		mtk_hw_reset(eth);
+ 
+-	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1)) {
+ 		/* Set FE to PDMAv2 if necessary */
+ 		val = mtk_r32(eth, MTK_FE_GLO_MISC);
+ 		mtk_w32(eth,  val | BIT(4), MTK_FE_GLO_MISC);
+@@ -3774,7 +3774,7 @@ static int mtk_hw_init(struct mtk_eth *e
+ 	 */
+ 	val = mtk_r32(eth, MTK_CDMQ_IG_CTRL);
+ 	mtk_w32(eth, val | MTK_CDMQ_STAG_EN, MTK_CDMQ_IG_CTRL);
+-	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1)) {
+ 		val = mtk_r32(eth, MTK_CDMP_IG_CTRL);
+ 		mtk_w32(eth, val | MTK_CDMP_STAG_EN, MTK_CDMP_IG_CTRL);
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -819,6 +819,7 @@ enum mkt_eth_capabilities {
+ 	MTK_SHARED_INT_BIT,
+ 	MTK_TRGMII_MT7621_CLK_BIT,
+ 	MTK_QDMA_BIT,
++	MTK_NETSYS_V1_BIT,
+ 	MTK_NETSYS_V2_BIT,
+ 	MTK_SOC_MT7628_BIT,
+ 	MTK_RSTCTRL_PPE1_BIT,
+@@ -854,6 +855,7 @@ enum mkt_eth_capabilities {
+ #define MTK_SHARED_INT		BIT(MTK_SHARED_INT_BIT)
+ #define MTK_TRGMII_MT7621_CLK	BIT(MTK_TRGMII_MT7621_CLK_BIT)
+ #define MTK_QDMA		BIT(MTK_QDMA_BIT)
++#define MTK_NETSYS_V1		BIT(MTK_NETSYS_V1_BIT)
+ #define MTK_NETSYS_V2		BIT(MTK_NETSYS_V2_BIT)
+ #define MTK_SOC_MT7628		BIT(MTK_SOC_MT7628_BIT)
+ #define MTK_RSTCTRL_PPE1	BIT(MTK_RSTCTRL_PPE1_BIT)
+@@ -916,25 +918,30 @@ enum mkt_eth_capabilities {
+ 
+ #define MTK_HAS_CAPS(caps, _x)		(((caps) & (_x) & ~(MTK_CAP_MASK)) == (_x))
+ 
+-#define MT7621_CAPS  (MTK_GMAC1_RGMII | MTK_GMAC1_TRGMII | \
+-		      MTK_GMAC2_RGMII | MTK_SHARED_INT | \
+-		      MTK_TRGMII_MT7621_CLK | MTK_QDMA)
+-
+-#define MT7622_CAPS  (MTK_GMAC1_RGMII | MTK_GMAC1_SGMII | MTK_GMAC2_RGMII | \
+-		      MTK_GMAC2_SGMII | MTK_GDM1_ESW | \
+-		      MTK_MUX_GDM1_TO_GMAC1_ESW | \
+-		      MTK_MUX_GMAC1_GMAC2_TO_SGMII_RGMII | MTK_QDMA)
+-
+-#define MT7623_CAPS  (MTK_GMAC1_RGMII | MTK_GMAC1_TRGMII | MTK_GMAC2_RGMII | \
+-		      MTK_QDMA)
+-
+-#define MT7628_CAPS  (MTK_SHARED_INT | MTK_SOC_MT7628)
+-
+-#define MT7629_CAPS  (MTK_GMAC1_SGMII | MTK_GMAC2_SGMII | MTK_GMAC2_GEPHY | \
+-		      MTK_GDM1_ESW | MTK_MUX_GDM1_TO_GMAC1_ESW | \
+-		      MTK_MUX_GMAC2_GMAC0_TO_GEPHY | \
+-		      MTK_MUX_U3_GMAC2_TO_QPHY | \
+-		      MTK_MUX_GMAC12_TO_GEPHY_SGMII | MTK_QDMA)
++#define MT7621_CAPS  (MTK_GMAC1_RGMII | MTK_GMAC1_TRGMII |	\
++		      MTK_GMAC2_RGMII | MTK_SHARED_INT |	\
++		      MTK_TRGMII_MT7621_CLK | MTK_QDMA |	\
++		      MTK_NETSYS_V1)
++
++#define MT7622_CAPS  (MTK_GMAC1_RGMII | MTK_GMAC1_SGMII |	\
++		      MTK_GMAC2_RGMII | MTK_GMAC2_SGMII |	\
++		      MTK_GDM1_ESW | MTK_MUX_GDM1_TO_GMAC1_ESW |\
++		      MTK_MUX_GMAC1_GMAC2_TO_SGMII_RGMII |	\
++		      MTK_QDMA | MTK_NETSYS_V1)
++
++#define MT7623_CAPS  (MTK_GMAC1_RGMII | MTK_GMAC1_TRGMII |	\
++		      MTK_GMAC2_RGMII | MTK_QDMA |		\
++		      MTK_NETSYS_V1)
++
++#define MT7628_CAPS  (MTK_SHARED_INT | MTK_SOC_MT7628 |		\
++		      MTK_NETSYS_V1)
++
++#define MT7629_CAPS  (MTK_GMAC1_SGMII | MTK_GMAC2_SGMII |	\
++		      MTK_GMAC2_GEPHY | MTK_GDM1_ESW |		\
++		      MTK_MUX_GMAC2_GMAC0_TO_GEPHY | MTK_QDMA |	\
++		      MTK_MUX_U3_GMAC2_TO_QPHY | MTK_NETSYS_V1 |\
++		      MTK_MUX_GDM1_TO_GMAC1_ESW |		\
++		      MTK_MUX_GMAC12_TO_GEPHY_SGMII)
+ 
+ #define MT7981_CAPS  (MTK_GMAC1_SGMII | MTK_GMAC2_SGMII | MTK_GMAC2_GEPHY | \
+ 		      MTK_MUX_GMAC12_TO_GEPHY_SGMII | MTK_QDMA | \
diff --git a/target/linux/generic/pending-6.1/737-02-net-ethernet-mtk_eth_soc-move-MAX_DEVS-in-mtk_soc_da.patch b/target/linux/generic/pending-6.1/737-02-net-ethernet-mtk_eth_soc-move-MAX_DEVS-in-mtk_soc_da.patch
new file mode 100644
index 00000000000000..82848a7c972425
--- /dev/null
+++ b/target/linux/generic/pending-6.1/737-02-net-ethernet-mtk_eth_soc-move-MAX_DEVS-in-mtk_soc_da.patch
@@ -0,0 +1,181 @@
+From 5af2b2dc4d6ba0ff7696e79f18e5b2bf862194eb Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 7 Mar 2023 15:55:24 +0000
+Subject: [PATCH 2/7] net: ethernet: mtk_eth_soc: move MAX_DEVS in mtk_soc_data
+
+This is a preliminary patch to add MT7988 SoC support since it runs 3
+macs instead of 2.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 34 +++++++++++++++++++--
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h | 11 +++----
+ 2 files changed, 36 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -4043,7 +4043,10 @@ static void mtk_sgmii_destroy(struct mtk
+ {
+ 	int i;
+ 
+-	for (i = 0; i < MTK_MAX_DEVS; i++)
++	if (!eth->sgmii_pcs)
++		return;
++
++	for (i = 0; i < eth->soc->num_devs; i++)
+ 		mtk_pcs_lynxi_destroy(eth->sgmii_pcs[i]);
+ }
+ 
+@@ -4486,7 +4489,12 @@ static int mtk_sgmii_init(struct mtk_eth
+ 	u32 flags;
+ 	int i;
+ 
+-	for (i = 0; i < MTK_MAX_DEVS; i++) {
++	eth->sgmii_pcs = devm_kzalloc(eth->dev,
++				      sizeof(*eth->sgmii_pcs) *
++				      eth->soc->num_devs,
++				      GFP_KERNEL);
++
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		np = of_parse_phandle(eth->dev->of_node, "mediatek,sgmiisys", i);
+ 		if (!np)
+ 			break;
+@@ -4531,6 +4539,18 @@ static int mtk_probe(struct platform_dev
+ 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628))
+ 		eth->ip_align = NET_IP_ALIGN;
+ 
++	eth->netdev = devm_kzalloc(eth->dev,
++				   sizeof(*eth->netdev) * eth->soc->num_devs,
++				   GFP_KERNEL);
++	if (!eth->netdev)
++		return -ENOMEM;
++
++	eth->mac = devm_kzalloc(eth->dev,
++				sizeof(*eth->mac) * eth->soc->num_devs,
++				GFP_KERNEL);
++	if (!eth->mac)
++		return -ENOMEM;
++
+ 	spin_lock_init(&eth->page_lock);
+ 	spin_lock_init(&eth->tx_irq_lock);
+ 	spin_lock_init(&eth->rx_irq_lock);
+@@ -4716,7 +4736,7 @@ static int mtk_probe(struct platform_dev
+ 			goto err_deinit_ppe;
+ 	}
+ 
+-	for (i = 0; i < MTK_MAX_DEVS; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		if (!eth->netdev[i])
+ 			continue;
+ 
+@@ -4792,6 +4812,7 @@ static const struct mtk_soc_data mt2701_
+ 	.hw_features = MTK_HW_FEATURES,
+ 	.required_clks = MT7623_CLKS_BITMAP,
+ 	.required_pctl = true,
++	.num_devs = 2,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+ 		.rxd_size = sizeof(struct mtk_rx_dma),
+@@ -4810,6 +4831,7 @@ static const struct mtk_soc_data mt7621_
+ 	.required_pctl = false,
+ 	.offload_version = 1,
+ 	.hash_offset = 2,
++	.num_devs = 2,
+ 	.foe_entry_size = sizeof(struct mtk_foe_entry) - 16,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+@@ -4831,6 +4853,7 @@ static const struct mtk_soc_data mt7622_
+ 	.offload_version = 2,
+ 	.hash_offset = 2,
+ 	.has_accounting = true,
++	.num_devs = 2,
+ 	.foe_entry_size = sizeof(struct mtk_foe_entry) - 16,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+@@ -4850,6 +4873,7 @@ static const struct mtk_soc_data mt7623_
+ 	.required_pctl = true,
+ 	.offload_version = 1,
+ 	.hash_offset = 2,
++	.num_devs = 2,
+ 	.foe_entry_size = sizeof(struct mtk_foe_entry) - 16,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+@@ -4869,6 +4893,7 @@ static const struct mtk_soc_data mt7629_
+ 	.required_clks = MT7629_CLKS_BITMAP,
+ 	.required_pctl = false,
+ 	.has_accounting = true,
++	.num_devs = 2,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+ 		.rxd_size = sizeof(struct mtk_rx_dma),
+@@ -4890,6 +4915,7 @@ static const struct mtk_soc_data mt7981_
+ 	.hash_offset = 4,
+ 	.foe_entry_size = sizeof(struct mtk_foe_entry),
+ 	.has_accounting = true,
++	.num_devs = 2,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma_v2),
+ 		.rxd_size = sizeof(struct mtk_rx_dma_v2),
+@@ -4908,6 +4934,7 @@ static const struct mtk_soc_data mt7986_
+ 	.required_clks = MT7986_CLKS_BITMAP,
+ 	.required_pctl = false,
+ 	.hash_offset = 4,
++	.num_devs = 2,
+ 	.foe_entry_size = sizeof(struct mtk_foe_entry),
+ 	.has_accounting = true,
+ 	.txrx = {
+@@ -4926,6 +4953,7 @@ static const struct mtk_soc_data rt5350_
+ 	.hw_features = MTK_HW_FEATURES_MT7628,
+ 	.required_clks = MT7628_CLKS_BITMAP,
+ 	.required_pctl = false,
++	.num_devs = 2,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+ 		.rxd_size = sizeof(struct mtk_rx_dma),
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -1021,6 +1021,7 @@ struct mtk_reg_map {
+  * @required_pctl		A bool value to show whether the SoC requires
+  *				the extra setup for those pins used by GMAC.
+  * @hash_offset			Flow table hash offset.
++ * @num_devs			SoC number of macs.
+  * @foe_entry_size		Foe table entry size.
+  * @has_accounting		Bool indicating support for accounting of
+  *				offloaded flows.
+@@ -1039,6 +1040,7 @@ struct mtk_soc_data {
+ 	bool		required_pctl;
+ 	u8		offload_version;
+ 	u8		hash_offset;
++	u8		num_devs;
+ 	u16		foe_entry_size;
+ 	netdev_features_t hw_features;
+ 	bool		has_accounting;
+@@ -1054,9 +1056,6 @@ struct mtk_soc_data {
+ 
+ #define MTK_DMA_MONITOR_TIMEOUT		msecs_to_jiffies(1000)
+ 
+-/* currently no SoC has more than 2 macs */
+-#define MTK_MAX_DEVS			2
+-
+ /* struct mtk_eth -	This is the main datasructure for holding the state
+  *			of the driver
+  * @dev:		The device pointer
+@@ -1111,14 +1110,14 @@ struct mtk_eth {
+ 	spinlock_t			tx_irq_lock;
+ 	spinlock_t			rx_irq_lock;
+ 	struct net_device		dummy_dev;
+-	struct net_device		*netdev[MTK_MAX_DEVS];
+-	struct mtk_mac			*mac[MTK_MAX_DEVS];
++	struct net_device		**netdev;
++	struct mtk_mac			**mac;
+ 	int				irq[3];
+ 	u32				msg_enable;
+ 	unsigned long			sysclk;
+ 	struct regmap			*ethsys;
+ 	struct regmap			*infra;
+-	struct phylink_pcs		*sgmii_pcs[MTK_MAX_DEVS];
++	struct phylink_pcs		**sgmii_pcs;
+ 	struct regmap			*pctl;
+ 	bool				hwlro;
+ 	refcount_t			dma_refcnt;
diff --git a/target/linux/generic/pending-6.1/737-03-net-ethernet-mtk_eth_soc-rely-on-num_devs-and-remove.patch b/target/linux/generic/pending-6.1/737-03-net-ethernet-mtk_eth_soc-rely-on-num_devs-and-remove.patch
new file mode 100644
index 00000000000000..be12aa5c06672e
--- /dev/null
+++ b/target/linux/generic/pending-6.1/737-03-net-ethernet-mtk_eth_soc-rely-on-num_devs-and-remove.patch
@@ -0,0 +1,153 @@
+From 4e35e80750b33727e606be9e7ce447bde2e0deb7 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 7 Mar 2023 15:55:35 +0000
+Subject: [PATCH 3/7] net: ethernet: mtk_eth_soc: rely on num_devs and remove
+ MTK_MAC_COUNT
+
+Get rid of MTK_MAC_COUNT since it is a duplicated of eth->soc->num_devs.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 30 ++++++++++-----------
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h |  1 -
+ 2 files changed, 15 insertions(+), 16 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -944,7 +944,7 @@ static void mtk_stats_update(struct mtk_
+ {
+ 	int i;
+ 
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		if (!eth->mac[i] || !eth->mac[i]->hw_stats)
+ 			continue;
+ 		if (spin_trylock(&eth->mac[i]->hw_stats->stats_lock)) {
+@@ -1449,7 +1449,7 @@ static int mtk_queue_stopped(struct mtk_
+ {
+ 	int i;
+ 
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		if (!eth->netdev[i])
+ 			continue;
+ 		if (netif_queue_stopped(eth->netdev[i]))
+@@ -1463,7 +1463,7 @@ static void mtk_wake_queue(struct mtk_et
+ {
+ 	int i;
+ 
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		if (!eth->netdev[i])
+ 			continue;
+ 		netif_tx_wake_all_queues(eth->netdev[i]);
+@@ -1956,7 +1956,7 @@ static int mtk_poll_rx(struct napi_struc
+ 			 !(trxd.rxd4 & RX_DMA_SPECIAL_TAG))
+ 			mac = RX_DMA_GET_SPORT(trxd.rxd4) - 1;
+ 
+-		if (unlikely(mac < 0 || mac >= MTK_MAC_COUNT ||
++		if (unlikely(mac < 0 || mac >= eth->soc->num_devs ||
+ 			     !eth->netdev[mac]))
+ 			goto release_desc;
+ 
+@@ -2993,7 +2993,7 @@ static void mtk_dma_free(struct mtk_eth
+ 	const struct mtk_soc_data *soc = eth->soc;
+ 	int i;
+ 
+-	for (i = 0; i < MTK_MAC_COUNT; i++)
++	for (i = 0; i < soc->num_devs; i++)
+ 		if (eth->netdev[i])
+ 			netdev_reset_queue(eth->netdev[i]);
+ 	if (eth->scratch_ring) {
+@@ -3147,7 +3147,7 @@ static void mtk_gdm_config(struct mtk_et
+ 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628))
+ 		return;
+ 
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		u32 val = mtk_r32(eth, MTK_GDMA_FWD_CFG(i));
+ 
+ 		/* default setup the forward port to send frame to PDMA */
+@@ -3758,7 +3758,7 @@ static int mtk_hw_init(struct mtk_eth *e
+ 	 * up with the more appropriate value when mtk_mac_config call is being
+ 	 * invoked.
+ 	 */
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		struct net_device *dev = eth->netdev[i];
+ 
+ 		mtk_w32(eth, MAC_MCR_FORCE_LINK_DOWN, MTK_MAC_MCR(i));
+@@ -3963,7 +3963,7 @@ static void mtk_pending_work(struct work
+ 	mtk_prepare_for_reset(eth);
+ 
+ 	/* stop all devices to make sure that dma is properly shut down */
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		if (!eth->netdev[i] || !netif_running(eth->netdev[i]))
+ 			continue;
+ 
+@@ -3979,7 +3979,7 @@ static void mtk_pending_work(struct work
+ 	mtk_hw_init(eth, true);
+ 
+ 	/* restart DMA and enable IRQs */
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		if (!test_bit(i, &restart))
+ 			continue;
+ 
+@@ -4007,7 +4007,7 @@ static int mtk_free_dev(struct mtk_eth *
+ {
+ 	int i;
+ 
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		if (!eth->netdev[i])
+ 			continue;
+ 		free_netdev(eth->netdev[i]);
+@@ -4026,7 +4026,7 @@ static int mtk_unreg_dev(struct mtk_eth
+ {
+ 	int i;
+ 
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		struct mtk_mac *mac;
+ 		if (!eth->netdev[i])
+ 			continue;
+@@ -4331,7 +4331,7 @@ static int mtk_add_mac(struct mtk_eth *e
+ 	}
+ 
+ 	id = be32_to_cpup(_id);
+-	if (id >= MTK_MAC_COUNT) {
++	if (id >= eth->soc->num_devs) {
+ 		dev_err(eth->dev, "%d is not a valid mac id\n", id);
+ 		return -EINVAL;
+ 	}
+@@ -4461,7 +4461,7 @@ void mtk_eth_set_dma_device(struct mtk_e
+ 
+ 	rtnl_lock();
+ 
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		dev = eth->netdev[i];
+ 
+ 		if (!dev || !(dev->flags & IFF_UP))
+@@ -4787,7 +4787,7 @@ static int mtk_remove(struct platform_de
+ 	int i;
+ 
+ 	/* stop all devices to make sure that dma is properly shut down */
+-	for (i = 0; i < MTK_MAC_COUNT; i++) {
++	for (i = 0; i < eth->soc->num_devs; i++) {
+ 		if (!eth->netdev[i])
+ 			continue;
+ 		mtk_stop(eth->netdev[i]);
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -33,7 +33,6 @@
+ #define MTK_TX_DMA_BUF_LEN_V2	0xffff
+ #define MTK_QDMA_RING_SIZE	2048
+ #define MTK_DMA_SIZE		512
+-#define MTK_MAC_COUNT		2
+ #define MTK_RX_ETH_HLEN		(VLAN_ETH_HLEN + ETH_FCS_LEN)
+ #define MTK_RX_HLEN		(NET_SKB_PAD + MTK_RX_ETH_HLEN + NET_IP_ALIGN)
+ #define MTK_DMA_DUMMY_DESC	0xffffffff
diff --git a/target/linux/generic/pending-6.1/737-04-net-ethernet-mtk_eth_soc-add-MTK_NETSYS_V3-capabilit.patch b/target/linux/generic/pending-6.1/737-04-net-ethernet-mtk_eth_soc-add-MTK_NETSYS_V3-capabilit.patch
new file mode 100644
index 00000000000000..a383a5e4ef8808
--- /dev/null
+++ b/target/linux/generic/pending-6.1/737-04-net-ethernet-mtk_eth_soc-add-MTK_NETSYS_V3-capabilit.patch
@@ -0,0 +1,292 @@
+From ab817f559d505329d8a413c7d29250f6d87d77a0 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 7 Mar 2023 15:55:47 +0000
+Subject: [PATCH 4/7] net: ethernet: mtk_eth_soc: add MTK_NETSYS_V3 capability
+ bit
+
+Introduce MTK_NETSYS_V3 bit in the device capabilities.
+This is a preliminary patch to introduce support for MT7988 SoC.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 115 ++++++++++++++++----
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h |  44 +++++++-
+ 2 files changed, 134 insertions(+), 25 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -924,17 +924,32 @@ void mtk_stats_update_mac(struct mtk_mac
+ 			mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x20 + offs);
+ 		hw_stats->rx_flow_control_packets +=
+ 			mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x24 + offs);
+-		hw_stats->tx_skip +=
+-			mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x28 + offs);
+-		hw_stats->tx_collisions +=
+-			mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x2c + offs);
+-		hw_stats->tx_bytes +=
+-			mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x30 + offs);
+-		stats =  mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x34 + offs);
+-		if (stats)
+-			hw_stats->tx_bytes += (stats << 32);
+-		hw_stats->tx_packets +=
+-			mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x38 + offs);
++
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3)) {
++			hw_stats->tx_skip +=
++				mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x50 + offs);
++			hw_stats->tx_collisions +=
++				mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x54 + offs);
++			hw_stats->tx_bytes +=
++				mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x40 + offs);
++			stats =  mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x44 + offs);
++			if (stats)
++				hw_stats->tx_bytes += (stats << 32);
++			hw_stats->tx_packets +=
++				mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x48 + offs);
++		} else {
++			hw_stats->tx_skip +=
++				mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x28 + offs);
++			hw_stats->tx_collisions +=
++				mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x2c + offs);
++			hw_stats->tx_bytes +=
++				mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x30 + offs);
++			stats =  mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x34 + offs);
++			if (stats)
++				hw_stats->tx_bytes += (stats << 32);
++			hw_stats->tx_packets +=
++				mtk_r32(mac->hw, reg_map->gdm1_cnt + 0x38 + offs);
++		}
+ 	}
+ 
+ 	u64_stats_update_end(&hw_stats->syncp);
+@@ -1238,7 +1253,10 @@ static void mtk_tx_set_dma_desc_v2(struc
+ 		data |= TX_DMA_LS0;
+ 	WRITE_ONCE(desc->txd3, data);
+ 
+-	data = (mac->id + 1) << TX_DMA_FPORT_SHIFT_V2; /* forward port */
++	if (mac->id == MTK_GMAC3_ID)
++		data = PSE_GDM3_PORT;
++	else
++		data = (mac->id + 1) << TX_DMA_FPORT_SHIFT_V2; /* forward port */
+ 	data |= TX_DMA_SWC_V2 | QID_BITS_V2(info->qid);
+ 	WRITE_ONCE(desc->txd4, data);
+ 
+@@ -1249,6 +1267,9 @@ static void mtk_tx_set_dma_desc_v2(struc
+ 		/* tx checksum offload */
+ 		if (info->csum)
+ 			data |= TX_DMA_CHKSUM_V2;
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3) &&
++		    netdev_uses_dsa(dev))
++			data |= TX_DMA_SPTAG_V3;
+ 	}
+ 	WRITE_ONCE(desc->txd5, data);
+ 
+@@ -1314,8 +1335,13 @@ static int mtk_tx_map(struct sk_buff *sk
+ 	mtk_tx_set_dma_desc(dev, itxd, &txd_info);
+ 
+ 	itx_buf->flags |= MTK_TX_FLAGS_SINGLE0;
+-	itx_buf->flags |= (!mac->id) ? MTK_TX_FLAGS_FPORT0 :
+-			  MTK_TX_FLAGS_FPORT1;
++	if (mac->id == MTK_GMAC1_ID)
++		itx_buf->flags |= MTK_TX_FLAGS_FPORT0;
++	else if (mac->id == MTK_GMAC2_ID)
++		itx_buf->flags |= MTK_TX_FLAGS_FPORT1;
++	else
++		itx_buf->flags |= MTK_TX_FLAGS_FPORT2;
++
+ 	setup_tx_buf(eth, itx_buf, itxd_pdma, txd_info.addr, txd_info.size,
+ 		     k++);
+ 
+@@ -1363,8 +1389,13 @@ static int mtk_tx_map(struct sk_buff *sk
+ 				memset(tx_buf, 0, sizeof(*tx_buf));
+ 			tx_buf->data = (void *)MTK_DMA_DUMMY_DESC;
+ 			tx_buf->flags |= MTK_TX_FLAGS_PAGE0;
+-			tx_buf->flags |= (!mac->id) ? MTK_TX_FLAGS_FPORT0 :
+-					 MTK_TX_FLAGS_FPORT1;
++
++			if (mac->id == MTK_GMAC1_ID)
++				tx_buf->flags |= MTK_TX_FLAGS_FPORT0;
++			else if (mac->id == MTK_GMAC2_ID)
++				tx_buf->flags |= MTK_TX_FLAGS_FPORT1;
++			else
++				tx_buf->flags |= MTK_TX_FLAGS_FPORT2;
+ 
+ 			setup_tx_buf(eth, tx_buf, txd_pdma, txd_info.addr,
+ 				     txd_info.size, k++);
+@@ -1950,11 +1981,24 @@ static int mtk_poll_rx(struct napi_struc
+ 			break;
+ 
+ 		/* find out which mac the packet come from. values start at 1 */
+-		if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1))
+-			mac = RX_DMA_GET_SPORT_V2(trxd.rxd5) - 1;
+-		else if (!MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628) &&
+-			 !(trxd.rxd4 & RX_DMA_SPECIAL_TAG))
++		if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V1)) {
++			u32 val = RX_DMA_GET_SPORT_V2(trxd.rxd5);
++
++			switch (val) {
++			case PSE_GDM1_PORT:
++			case PSE_GDM2_PORT:
++				mac = val - 1;
++				break;
++			case PSE_GDM3_PORT:
++				mac = MTK_GMAC3_ID;
++				break;
++			default:
++				break;
++			}
++		} else if (!MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628) &&
++			 !(trxd.rxd4 & RX_DMA_SPECIAL_TAG)) {
+ 			mac = RX_DMA_GET_SPORT(trxd.rxd4) - 1;
++		}
+ 
+ 		if (unlikely(mac < 0 || mac >= eth->soc->num_devs ||
+ 			     !eth->netdev[mac]))
+@@ -2185,7 +2229,9 @@ static int mtk_poll_tx_qdma(struct mtk_e
+ 		tx_buf = mtk_desc_to_tx_buf(ring, desc,
+ 					    eth->soc->txrx.txd_size);
+ 		if (tx_buf->flags & MTK_TX_FLAGS_FPORT1)
+-			mac = 1;
++			mac = MTK_GMAC2_ID;
++		else if (tx_buf->flags & MTK_TX_FLAGS_FPORT2)
++			mac = MTK_GMAC3_ID;
+ 
+ 		if (!tx_buf->data)
+ 			break;
+@@ -3796,7 +3842,26 @@ static int mtk_hw_init(struct mtk_eth *e
+ 	mtk_w32(eth, eth->soc->txrx.rx_irq_done_mask, reg_map->qdma.int_grp + 4);
+ 	mtk_w32(eth, 0x21021000, MTK_FE_INT_GRP);
+ 
+-	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3)) {
++		/* PSE should not drop port1, port8 and port9 packets */
++		mtk_w32(eth, 0x00000302, PSE_DROP_CFG);
++
++		/* GDM and CDM Threshold */
++		mtk_w32(eth, 0x00000707, MTK_CDMW0_THRES);
++		mtk_w32(eth, 0x00000077, MTK_CDMW1_THRES);
++
++		/* Disable GDM1 RX CRC stripping */
++		val = mtk_r32(eth, MTK_GDMA_FWD_CFG(0));
++		val &= ~MTK_GDMA_STRP_CRC;
++		mtk_w32(eth, val, MTK_GDMA_FWD_CFG(0));
++
++		/* PSE GDM3 MIB counter has incorrect hw default values,
++		 * so the driver ought to read clear the values beforehand
++		 * in case ethtool retrieve wrong mib values.
++		 */
++		for (i = 0; i < 0x80; i += 0x4)
++			mtk_r32(eth, reg_map->gdm1_cnt + 0x100 + i);
++	} else if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+ 		/* PSE should not drop port8 and port9 packets from WDMA Tx */
+ 		mtk_w32(eth, 0x00000300, PSE_DROP_CFG);
+ 
+@@ -4368,7 +4433,11 @@ static int mtk_add_mac(struct mtk_eth *e
+ 	}
+ 	spin_lock_init(&mac->hw_stats->stats_lock);
+ 	u64_stats_init(&mac->hw_stats->syncp);
+-	mac->hw_stats->reg_offset = id * MTK_STAT_OFFSET;
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3))
++		mac->hw_stats->reg_offset = id * 0x80;
++	else
++		mac->hw_stats->reg_offset = id * 0x40;
+ 
+ 	/* phylink create */
+ 	err = of_get_phy_mode(np, &phy_mode);
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -121,6 +121,7 @@
+ #define MTK_GDMA_ICS_EN		BIT(22)
+ #define MTK_GDMA_TCS_EN		BIT(21)
+ #define MTK_GDMA_UCS_EN		BIT(20)
++#define MTK_GDMA_STRP_CRC	BIT(16)
+ #define MTK_GDMA_TO_PDMA	0x0
+ #define MTK_GDMA_DROP_ALL       0x7777
+ 
+@@ -286,8 +287,6 @@
+ /* QDMA Interrupt grouping registers */
+ #define MTK_RLS_DONE_INT	BIT(0)
+ 
+-#define MTK_STAT_OFFSET		0x40
+-
+ /* QDMA TX NUM */
+ #define QID_BITS_V2(x)		(((x) & 0x3f) << 16)
+ #define MTK_QDMA_GMAC2_QID	8
+@@ -300,6 +299,8 @@
+ #define TX_DMA_CHKSUM_V2	(0x7 << 28)
+ #define TX_DMA_TSO_V2		BIT(31)
+ 
++#define TX_DMA_SPTAG_V3         BIT(27)
++
+ /* QDMA V2 descriptor txd4 */
+ #define TX_DMA_FPORT_SHIFT_V2	8
+ #define TX_DMA_FPORT_MASK_V2	0xf
+@@ -639,6 +640,7 @@ enum mtk_tx_flags {
+ 	 */
+ 	MTK_TX_FLAGS_FPORT0	= 0x04,
+ 	MTK_TX_FLAGS_FPORT1	= 0x08,
++	MTK_TX_FLAGS_FPORT2	= 0x10,
+ };
+ 
+ /* This enum allows us to identify how the clock is defined on the array of the
+@@ -724,6 +726,42 @@ enum mtk_dev_state {
+ 	MTK_RESETTING
+ };
+ 
++/* PSE Port Definition */
++enum mtk_pse_port {
++	PSE_ADMA_PORT = 0,
++	PSE_GDM1_PORT,
++	PSE_GDM2_PORT,
++	PSE_PPE0_PORT,
++	PSE_PPE1_PORT,
++	PSE_QDMA_TX_PORT,
++	PSE_QDMA_RX_PORT,
++	PSE_DROP_PORT,
++	PSE_WDMA0_PORT,
++	PSE_WDMA1_PORT,
++	PSE_TDMA_PORT,
++	PSE_NONE_PORT,
++	PSE_PPE2_PORT,
++	PSE_WDMA2_PORT,
++	PSE_EIP197_PORT,
++	PSE_GDM3_PORT,
++	PSE_PORT_MAX
++};
++
++/* GMAC Identifier */
++enum mtk_gmac_id {
++	MTK_GMAC1_ID = 0,
++	MTK_GMAC2_ID,
++	MTK_GMAC3_ID,
++	MTK_GMAC_ID_MAX
++};
++
++/* GDM Type */
++enum mtk_gdm_type {
++	MTK_GDM_TYPE = 0,
++	MTK_XGDM_TYPE,
++	MTK_GDM_TYPE_MAX
++};
++
+ enum mtk_tx_buf_type {
+ 	MTK_TYPE_SKB,
+ 	MTK_TYPE_XDP_TX,
+@@ -820,6 +858,7 @@ enum mkt_eth_capabilities {
+ 	MTK_QDMA_BIT,
+ 	MTK_NETSYS_V1_BIT,
+ 	MTK_NETSYS_V2_BIT,
++	MTK_NETSYS_V3_BIT,
+ 	MTK_SOC_MT7628_BIT,
+ 	MTK_RSTCTRL_PPE1_BIT,
+ 	MTK_U3_COPHY_V2_BIT,
+@@ -856,6 +895,7 @@ enum mkt_eth_capabilities {
+ #define MTK_QDMA		BIT(MTK_QDMA_BIT)
+ #define MTK_NETSYS_V1		BIT(MTK_NETSYS_V1_BIT)
+ #define MTK_NETSYS_V2		BIT(MTK_NETSYS_V2_BIT)
++#define MTK_NETSYS_V3		BIT(MTK_NETSYS_V3_BIT)
+ #define MTK_SOC_MT7628		BIT(MTK_SOC_MT7628_BIT)
+ #define MTK_RSTCTRL_PPE1	BIT(MTK_RSTCTRL_PPE1_BIT)
+ #define MTK_U3_COPHY_V2		BIT(MTK_U3_COPHY_V2_BIT)
diff --git a/target/linux/generic/pending-6.1/737-05-net-ethernet-mtk_eth_soc-convert-caps-in-mtk_soc_dat.patch b/target/linux/generic/pending-6.1/737-05-net-ethernet-mtk_eth_soc-convert-caps-in-mtk_soc_dat.patch
new file mode 100644
index 00000000000000..068201cf7dfb24
--- /dev/null
+++ b/target/linux/generic/pending-6.1/737-05-net-ethernet-mtk_eth_soc-convert-caps-in-mtk_soc_dat.patch
@@ -0,0 +1,197 @@
+From 45b575fd9e6a455090820248bf1b98b1f2c7b6c8 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 7 Mar 2023 15:56:00 +0000
+Subject: [PATCH 5/7] net: ethernet: mtk_eth_soc: convert caps in mtk_soc_data
+ struct to u64
+
+This is a preliminary patch to introduce support for MT7988 SoC.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_path.c | 22 +++----
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h  | 62 ++++++++++----------
+ 2 files changed, 42 insertions(+), 42 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_path.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_path.c
+@@ -15,10 +15,10 @@
+ struct mtk_eth_muxc {
+ 	const char	*name;
+ 	int		cap_bit;
+-	int		(*set_path)(struct mtk_eth *eth, int path);
++	int		(*set_path)(struct mtk_eth *eth, u64 path);
+ };
+ 
+-static const char *mtk_eth_path_name(int path)
++static const char *mtk_eth_path_name(u64 path)
+ {
+ 	switch (path) {
+ 	case MTK_ETH_PATH_GMAC1_RGMII:
+@@ -40,7 +40,7 @@ static const char *mtk_eth_path_name(int
+ 	}
+ }
+ 
+-static int set_mux_gdm1_to_gmac1_esw(struct mtk_eth *eth, int path)
++static int set_mux_gdm1_to_gmac1_esw(struct mtk_eth *eth, u64 path)
+ {
+ 	bool updated = true;
+ 	u32 val, mask, set;
+@@ -71,7 +71,7 @@ static int set_mux_gdm1_to_gmac1_esw(str
+ 	return 0;
+ }
+ 
+-static int set_mux_gmac2_gmac0_to_gephy(struct mtk_eth *eth, int path)
++static int set_mux_gmac2_gmac0_to_gephy(struct mtk_eth *eth, u64 path)
+ {
+ 	unsigned int val = 0;
+ 	bool updated = true;
+@@ -94,7 +94,7 @@ static int set_mux_gmac2_gmac0_to_gephy(
+ 	return 0;
+ }
+ 
+-static int set_mux_u3_gmac2_to_qphy(struct mtk_eth *eth, int path)
++static int set_mux_u3_gmac2_to_qphy(struct mtk_eth *eth, u64 path)
+ {
+ 	unsigned int val = 0, mask = 0, reg = 0;
+ 	bool updated = true;
+@@ -125,7 +125,7 @@ static int set_mux_u3_gmac2_to_qphy(stru
+ 	return 0;
+ }
+ 
+-static int set_mux_gmac1_gmac2_to_sgmii_rgmii(struct mtk_eth *eth, int path)
++static int set_mux_gmac1_gmac2_to_sgmii_rgmii(struct mtk_eth *eth, u64 path)
+ {
+ 	unsigned int val = 0;
+ 	bool updated = true;
+@@ -163,7 +163,7 @@ static int set_mux_gmac1_gmac2_to_sgmii_
+ 	return 0;
+ }
+ 
+-static int set_mux_gmac12_to_gephy_sgmii(struct mtk_eth *eth, int path)
++static int set_mux_gmac12_to_gephy_sgmii(struct mtk_eth *eth, u64 path)
+ {
+ 	unsigned int val = 0;
+ 	bool updated = true;
+@@ -218,7 +218,7 @@ static const struct mtk_eth_muxc mtk_eth
+ 	},
+ };
+ 
+-static int mtk_eth_mux_setup(struct mtk_eth *eth, int path)
++static int mtk_eth_mux_setup(struct mtk_eth *eth, u64 path)
+ {
+ 	int i, err = 0;
+ 
+@@ -249,7 +249,7 @@ out:
+ 
+ int mtk_gmac_sgmii_path_setup(struct mtk_eth *eth, int mac_id)
+ {
+-	int path;
++	u64 path;
+ 
+ 	path = (mac_id == 0) ?  MTK_ETH_PATH_GMAC1_SGMII :
+ 				MTK_ETH_PATH_GMAC2_SGMII;
+@@ -260,7 +260,7 @@ int mtk_gmac_sgmii_path_setup(struct mtk
+ 
+ int mtk_gmac_gephy_path_setup(struct mtk_eth *eth, int mac_id)
+ {
+-	int path = 0;
++	u64 path = 0;
+ 
+ 	if (mac_id == 1)
+ 		path = MTK_ETH_PATH_GMAC2_GEPHY;
+@@ -274,7 +274,7 @@ int mtk_gmac_gephy_path_setup(struct mtk
+ 
+ int mtk_gmac_rgmii_path_setup(struct mtk_eth *eth, int mac_id)
+ {
+-	int path;
++	u64 path;
+ 
+ 	path = (mac_id == 0) ?  MTK_ETH_PATH_GMAC1_RGMII :
+ 				MTK_ETH_PATH_GMAC2_RGMII;
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -881,44 +881,44 @@ enum mkt_eth_capabilities {
+ };
+ 
+ /* Supported hardware group on SoCs */
+-#define MTK_RGMII		BIT(MTK_RGMII_BIT)
+-#define MTK_TRGMII		BIT(MTK_TRGMII_BIT)
+-#define MTK_SGMII		BIT(MTK_SGMII_BIT)
+-#define MTK_ESW			BIT(MTK_ESW_BIT)
+-#define MTK_GEPHY		BIT(MTK_GEPHY_BIT)
+-#define MTK_MUX			BIT(MTK_MUX_BIT)
+-#define MTK_INFRA		BIT(MTK_INFRA_BIT)
+-#define MTK_SHARED_SGMII	BIT(MTK_SHARED_SGMII_BIT)
+-#define MTK_HWLRO		BIT(MTK_HWLRO_BIT)
+-#define MTK_SHARED_INT		BIT(MTK_SHARED_INT_BIT)
+-#define MTK_TRGMII_MT7621_CLK	BIT(MTK_TRGMII_MT7621_CLK_BIT)
+-#define MTK_QDMA		BIT(MTK_QDMA_BIT)
+-#define MTK_NETSYS_V1		BIT(MTK_NETSYS_V1_BIT)
+-#define MTK_NETSYS_V2		BIT(MTK_NETSYS_V2_BIT)
+-#define MTK_NETSYS_V3		BIT(MTK_NETSYS_V3_BIT)
+-#define MTK_SOC_MT7628		BIT(MTK_SOC_MT7628_BIT)
+-#define MTK_RSTCTRL_PPE1	BIT(MTK_RSTCTRL_PPE1_BIT)
+-#define MTK_U3_COPHY_V2		BIT(MTK_U3_COPHY_V2_BIT)
++#define MTK_RGMII		BIT_ULL(MTK_RGMII_BIT)
++#define MTK_TRGMII		BIT_ULL(MTK_TRGMII_BIT)
++#define MTK_SGMII		BIT_ULL(MTK_SGMII_BIT)
++#define MTK_ESW			BIT_ULL(MTK_ESW_BIT)
++#define MTK_GEPHY		BIT_ULL(MTK_GEPHY_BIT)
++#define MTK_MUX			BIT_ULL(MTK_MUX_BIT)
++#define MTK_INFRA		BIT_ULL(MTK_INFRA_BIT)
++#define MTK_SHARED_SGMII	BIT_ULL(MTK_SHARED_SGMII_BIT)
++#define MTK_HWLRO		BIT_ULL(MTK_HWLRO_BIT)
++#define MTK_SHARED_INT		BIT_ULL(MTK_SHARED_INT_BIT)
++#define MTK_TRGMII_MT7621_CLK	BIT_ULL(MTK_TRGMII_MT7621_CLK_BIT)
++#define MTK_QDMA		BIT_ULL(MTK_QDMA_BIT)
++#define MTK_NETSYS_V1		BIT_ULL(MTK_NETSYS_V1_BIT)
++#define MTK_NETSYS_V2		BIT_ULL(MTK_NETSYS_V2_BIT)
++#define MTK_NETSYS_V3		BIT_ULL(MTK_NETSYS_V3_BIT)
++#define MTK_SOC_MT7628		BIT_ULL(MTK_SOC_MT7628_BIT)
++#define MTK_RSTCTRL_PPE1	BIT_ULL(MTK_RSTCTRL_PPE1_BIT)
++#define MTK_U3_COPHY_V2		BIT_ULL(MTK_U3_COPHY_V2_BIT)
+ 
+ #define MTK_ETH_MUX_GDM1_TO_GMAC1_ESW		\
+-	BIT(MTK_ETH_MUX_GDM1_TO_GMAC1_ESW_BIT)
++	BIT_ULL(MTK_ETH_MUX_GDM1_TO_GMAC1_ESW_BIT)
+ #define MTK_ETH_MUX_GMAC2_GMAC0_TO_GEPHY	\
+-	BIT(MTK_ETH_MUX_GMAC2_GMAC0_TO_GEPHY_BIT)
++	BIT_ULL(MTK_ETH_MUX_GMAC2_GMAC0_TO_GEPHY_BIT)
+ #define MTK_ETH_MUX_U3_GMAC2_TO_QPHY		\
+-	BIT(MTK_ETH_MUX_U3_GMAC2_TO_QPHY_BIT)
++	BIT_ULL(MTK_ETH_MUX_U3_GMAC2_TO_QPHY_BIT)
+ #define MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII	\
+-	BIT(MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII_BIT)
++	BIT_ULL(MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII_BIT)
+ #define MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII	\
+-	BIT(MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII_BIT)
++	BIT_ULL(MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII_BIT)
+ 
+ /* Supported path present on SoCs */
+-#define MTK_ETH_PATH_GMAC1_RGMII	BIT(MTK_ETH_PATH_GMAC1_RGMII_BIT)
+-#define MTK_ETH_PATH_GMAC1_TRGMII	BIT(MTK_ETH_PATH_GMAC1_TRGMII_BIT)
+-#define MTK_ETH_PATH_GMAC1_SGMII	BIT(MTK_ETH_PATH_GMAC1_SGMII_BIT)
+-#define MTK_ETH_PATH_GMAC2_RGMII	BIT(MTK_ETH_PATH_GMAC2_RGMII_BIT)
+-#define MTK_ETH_PATH_GMAC2_SGMII	BIT(MTK_ETH_PATH_GMAC2_SGMII_BIT)
+-#define MTK_ETH_PATH_GMAC2_GEPHY	BIT(MTK_ETH_PATH_GMAC2_GEPHY_BIT)
+-#define MTK_ETH_PATH_GDM1_ESW		BIT(MTK_ETH_PATH_GDM1_ESW_BIT)
++#define MTK_ETH_PATH_GMAC1_RGMII	BIT_ULL(MTK_ETH_PATH_GMAC1_RGMII_BIT)
++#define MTK_ETH_PATH_GMAC1_TRGMII	BIT_ULL(MTK_ETH_PATH_GMAC1_TRGMII_BIT)
++#define MTK_ETH_PATH_GMAC1_SGMII	BIT_ULL(MTK_ETH_PATH_GMAC1_SGMII_BIT)
++#define MTK_ETH_PATH_GMAC2_RGMII	BIT_ULL(MTK_ETH_PATH_GMAC2_RGMII_BIT)
++#define MTK_ETH_PATH_GMAC2_SGMII	BIT_ULL(MTK_ETH_PATH_GMAC2_SGMII_BIT)
++#define MTK_ETH_PATH_GMAC2_GEPHY	BIT_ULL(MTK_ETH_PATH_GMAC2_GEPHY_BIT)
++#define MTK_ETH_PATH_GDM1_ESW		BIT_ULL(MTK_ETH_PATH_GDM1_ESW_BIT)
+ 
+ #define MTK_GMAC1_RGMII		(MTK_ETH_PATH_GMAC1_RGMII | MTK_RGMII)
+ #define MTK_GMAC1_TRGMII	(MTK_ETH_PATH_GMAC1_TRGMII | MTK_TRGMII)
+@@ -1074,7 +1074,7 @@ struct mtk_reg_map {
+ struct mtk_soc_data {
+ 	const struct mtk_reg_map *reg_map;
+ 	u32             ana_rgc3;
+-	u32		caps;
++	u64		caps;
+ 	u32		required_clks;
+ 	bool		required_pctl;
+ 	u8		offload_version;
diff --git a/target/linux/generic/pending-6.1/737-06-net-ethernet-mtk_eth_soc-add-support-for-MT7988-SoC.patch b/target/linux/generic/pending-6.1/737-06-net-ethernet-mtk_eth_soc-add-support-for-MT7988-SoC.patch
new file mode 100644
index 00000000000000..4e52e0da547a46
--- /dev/null
+++ b/target/linux/generic/pending-6.1/737-06-net-ethernet-mtk_eth_soc-add-support-for-MT7988-SoC.patch
@@ -0,0 +1,495 @@
+From 661bacf4363ca68939c15e20056b5f72fbd034e7 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 25 Feb 2023 00:08:24 +0100
+Subject: [PATCH 6/7] net: ethernet: mtk_eth_soc: add support for MT7988 SoC
+
+Introduce support for ethernet chip available in MT7988 SoC to
+mtk_eth_soc driver.
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 153 ++++++++++++++--
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h | 193 ++++++++++++++------
+ 2 files changed, 279 insertions(+), 67 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -152,6 +152,54 @@ static const struct mtk_reg_map mt7986_r
+ 	.pse_oq_sta		= 0x01a0,
+ };
+ 
++static const struct mtk_reg_map mt7988_reg_map = {
++	.tx_irq_mask		= 0x461c,
++	.tx_irq_status		= 0x4618,
++	.pdma = {
++		.rx_ptr		= 0x6900,
++		.rx_cnt_cfg	= 0x6904,
++		.pcrx_ptr	= 0x6908,
++		.glo_cfg	= 0x6a04,
++		.rst_idx	= 0x6a08,
++		.delay_irq	= 0x6a0c,
++		.irq_status	= 0x6a20,
++		.irq_mask	= 0x6a28,
++		.adma_rx_dbg0	= 0x6a38,
++		.int_grp	= 0x6a50,
++	},
++	.qdma = {
++		.qtx_cfg	= 0x4400,
++		.qtx_sch	= 0x4404,
++		.rx_ptr		= 0x4500,
++		.rx_cnt_cfg	= 0x4504,
++		.qcrx_ptr	= 0x4508,
++		.glo_cfg	= 0x4604,
++		.rst_idx	= 0x4608,
++		.delay_irq	= 0x460c,
++		.fc_th		= 0x4610,
++		.int_grp	= 0x4620,
++		.hred		= 0x4644,
++		.ctx_ptr	= 0x4700,
++		.dtx_ptr	= 0x4704,
++		.crx_ptr	= 0x4710,
++		.drx_ptr	= 0x4714,
++		.fq_head	= 0x4720,
++		.fq_tail	= 0x4724,
++		.fq_count	= 0x4728,
++		.fq_blen	= 0x472c,
++		.tx_sch_rate	= 0x4798,
++	},
++	.gdm1_cnt		= 0x1c00,
++	.gdma_to_ppe		= 0x3333,
++	.ppe_base		= 0x2200,
++	.wdma_base = {
++		[0]		= 0x4800,
++		[1]		= 0x4c00,
++	},
++	.pse_iq_sta		= 0x0180,
++	.pse_oq_sta		= 0x01a0,
++};
++
+ /* strings used by ethtool */
+ static const struct mtk_ethtool_stats {
+ 	char str[ETH_GSTRING_LEN];
+@@ -179,10 +227,54 @@ static const struct mtk_ethtool_stats {
+ };
+ 
+ static const char * const mtk_clks_source_name[] = {
+-	"ethif", "sgmiitop", "esw", "gp0", "gp1", "gp2", "fe", "trgpll",
+-	"sgmii_tx250m", "sgmii_rx250m", "sgmii_cdr_ref", "sgmii_cdr_fb",
+-	"sgmii2_tx250m", "sgmii2_rx250m", "sgmii2_cdr_ref", "sgmii2_cdr_fb",
+-	"sgmii_ck", "eth2pll", "wocpu0", "wocpu1", "netsys0", "netsys1"
++	"ethif",
++	"sgmiitop",
++	"esw",
++	"gp0",
++	"gp1",
++	"gp2",
++	"gp3",
++	"xgp1",
++	"xgp2",
++	"xgp3",
++	"crypto",
++	"fe",
++	"trgpll",
++	"sgmii_tx250m",
++	"sgmii_rx250m",
++	"sgmii_cdr_ref",
++	"sgmii_cdr_fb",
++	"sgmii2_tx250m",
++	"sgmii2_rx250m",
++	"sgmii2_cdr_ref",
++	"sgmii2_cdr_fb",
++	"sgmii_ck",
++	"eth2pll",
++	"wocpu0",
++	"wocpu1",
++	"netsys0",
++	"netsys1",
++	"ethwarp_wocpu2",
++	"ethwarp_wocpu1",
++	"ethwarp_wocpu0",
++	"top_usxgmii0_sel",
++	"top_usxgmii1_sel",
++	"top_sgm0_sel",
++	"top_sgm1_sel",
++	"top_xfi_phy0_xtal_sel",
++	"top_xfi_phy1_xtal_sel",
++	"top_eth_gmii_sel",
++	"top_eth_refck_50m_sel",
++	"top_eth_sys_200m_sel",
++	"top_eth_sys_sel",
++	"top_eth_xgmii_sel",
++	"top_eth_mii_sel",
++	"top_netsys_sel",
++	"top_netsys_500m_sel",
++	"top_netsys_pao_2x_sel",
++	"top_netsys_sync_250m_sel",
++	"top_netsys_ppefb_250m_sel",
++	"top_netsys_warp_sel",
+ };
+ 
+ void mtk_w32(struct mtk_eth *eth, u32 val, unsigned reg)
+@@ -1253,10 +1345,19 @@ static void mtk_tx_set_dma_desc_v2(struc
+ 		data |= TX_DMA_LS0;
+ 	WRITE_ONCE(desc->txd3, data);
+ 
+-	if (mac->id == MTK_GMAC3_ID)
+-		data = PSE_GDM3_PORT;
+-	else
+-		data = (mac->id + 1) << TX_DMA_FPORT_SHIFT_V2; /* forward port */
++	 /* set forward port */
++	switch (mac->id) {
++	case MTK_GMAC1_ID:
++		data = PSE_GDM1_PORT << TX_DMA_FPORT_SHIFT_V2;
++		break;
++	case MTK_GMAC2_ID:
++		data = PSE_GDM2_PORT << TX_DMA_FPORT_SHIFT_V2;
++		break;
++	case MTK_GMAC3_ID:
++		data = PSE_GDM3_PORT << TX_DMA_FPORT_SHIFT_V2;
++		break;
++	}
++
+ 	data |= TX_DMA_SWC_V2 | QID_BITS_V2(info->qid);
+ 	WRITE_ONCE(desc->txd4, data);
+ 
+@@ -5016,6 +5117,25 @@ static const struct mtk_soc_data mt7986_
+ 	},
+ };
+ 
++static const struct mtk_soc_data mt7988_data = {
++	.reg_map = &mt7988_reg_map,
++	.ana_rgc3 = 0x128,
++	.caps = MT7988_CAPS,
++	.hw_features = MTK_HW_FEATURES,
++	.required_clks = MT7988_CLKS_BITMAP,
++	.required_pctl = false,
++	.num_devs = 3,
++	.txrx = {
++		.txd_size = sizeof(struct mtk_tx_dma_v2),
++		.rxd_size = sizeof(struct mtk_rx_dma_v2),
++		.rx_irq_done_mask = MTK_RX_DONE_INT_V2,
++		.rx_dma_l4_valid = RX_DMA_L4_VALID_V2,
++		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
++		.dma_len_offset = 8,
++	},
++};
++
++
+ static const struct mtk_soc_data rt5350_data = {
+ 	.reg_map = &mt7628_reg_map,
+ 	.caps = MT7628_CAPS,
+@@ -5034,14 +5154,15 @@ static const struct mtk_soc_data rt5350_
+ };
+ 
+ const struct of_device_id of_mtk_match[] = {
+-	{ .compatible = "mediatek,mt2701-eth", .data = &mt2701_data},
+-	{ .compatible = "mediatek,mt7621-eth", .data = &mt7621_data},
+-	{ .compatible = "mediatek,mt7622-eth", .data = &mt7622_data},
+-	{ .compatible = "mediatek,mt7623-eth", .data = &mt7623_data},
+-	{ .compatible = "mediatek,mt7629-eth", .data = &mt7629_data},
+-	{ .compatible = "mediatek,mt7981-eth", .data = &mt7981_data},
+-	{ .compatible = "mediatek,mt7986-eth", .data = &mt7986_data},
+-	{ .compatible = "ralink,rt5350-eth", .data = &rt5350_data},
++	{ .compatible = "mediatek,mt2701-eth", .data = &mt2701_data },
++	{ .compatible = "mediatek,mt7621-eth", .data = &mt7621_data },
++	{ .compatible = "mediatek,mt7622-eth", .data = &mt7622_data },
++	{ .compatible = "mediatek,mt7623-eth", .data = &mt7623_data },
++	{ .compatible = "mediatek,mt7629-eth", .data = &mt7629_data },
++	{ .compatible = "mediatek,mt7981-eth", .data = &mt7981_data },
++	{ .compatible = "mediatek,mt7986-eth", .data = &mt7986_data },
++	{ .compatible = "mediatek,mt7988-eth", .data = &mt7988_data },
++	{ .compatible = "ralink,rt5350-eth", .data = &rt5350_data },
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(of, of_mtk_match);
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -116,7 +116,8 @@
+ #define MTK_CDMP_EG_CTRL	0x404
+ 
+ /* GDM Exgress Control Register */
+-#define MTK_GDMA_FWD_CFG(x)	(0x500 + (x * 0x1000))
++#define MTK_GDMA_FWD_CFG(x)	((x == MTK_GMAC3_ID) ?		\
++				 0x540 : 0x500 + (x * 0x1000))
+ #define MTK_GDMA_SPECIAL_TAG	BIT(24)
+ #define MTK_GDMA_ICS_EN		BIT(22)
+ #define MTK_GDMA_TCS_EN		BIT(21)
+@@ -653,6 +654,11 @@ enum mtk_clks_map {
+ 	MTK_CLK_GP0,
+ 	MTK_CLK_GP1,
+ 	MTK_CLK_GP2,
++	MTK_CLK_GP3,
++	MTK_CLK_XGP1,
++	MTK_CLK_XGP2,
++	MTK_CLK_XGP3,
++	MTK_CLK_CRYPTO,
+ 	MTK_CLK_FE,
+ 	MTK_CLK_TRGPLL,
+ 	MTK_CLK_SGMII_TX_250M,
+@@ -669,57 +675,108 @@ enum mtk_clks_map {
+ 	MTK_CLK_WOCPU1,
+ 	MTK_CLK_NETSYS0,
+ 	MTK_CLK_NETSYS1,
++	MTK_CLK_ETHWARP_WOCPU2,
++	MTK_CLK_ETHWARP_WOCPU1,
++	MTK_CLK_ETHWARP_WOCPU0,
++	MTK_CLK_TOP_USXGMII_SBUS_0_SEL,
++	MTK_CLK_TOP_USXGMII_SBUS_1_SEL,
++	MTK_CLK_TOP_SGM_0_SEL,
++	MTK_CLK_TOP_SGM_1_SEL,
++	MTK_CLK_TOP_XFI_PHY_0_XTAL_SEL,
++	MTK_CLK_TOP_XFI_PHY_1_XTAL_SEL,
++	MTK_CLK_TOP_ETH_GMII_SEL,
++	MTK_CLK_TOP_ETH_REFCK_50M_SEL,
++	MTK_CLK_TOP_ETH_SYS_200M_SEL,
++	MTK_CLK_TOP_ETH_SYS_SEL,
++	MTK_CLK_TOP_ETH_XGMII_SEL,
++	MTK_CLK_TOP_ETH_MII_SEL,
++	MTK_CLK_TOP_NETSYS_SEL,
++	MTK_CLK_TOP_NETSYS_500M_SEL,
++	MTK_CLK_TOP_NETSYS_PAO_2X_SEL,
++	MTK_CLK_TOP_NETSYS_SYNC_250M_SEL,
++	MTK_CLK_TOP_NETSYS_PPEFB_250M_SEL,
++	MTK_CLK_TOP_NETSYS_WARP_SEL,
+ 	MTK_CLK_MAX
+ };
+ 
+-#define MT7623_CLKS_BITMAP	(BIT(MTK_CLK_ETHIF) | BIT(MTK_CLK_ESW) |  \
+-				 BIT(MTK_CLK_GP1) | BIT(MTK_CLK_GP2) | \
+-				 BIT(MTK_CLK_TRGPLL))
+-#define MT7622_CLKS_BITMAP	(BIT(MTK_CLK_ETHIF) | BIT(MTK_CLK_ESW) |  \
+-				 BIT(MTK_CLK_GP0) | BIT(MTK_CLK_GP1) | \
+-				 BIT(MTK_CLK_GP2) | \
+-				 BIT(MTK_CLK_SGMII_TX_250M) | \
+-				 BIT(MTK_CLK_SGMII_RX_250M) | \
+-				 BIT(MTK_CLK_SGMII_CDR_REF) | \
+-				 BIT(MTK_CLK_SGMII_CDR_FB) | \
+-				 BIT(MTK_CLK_SGMII_CK) | \
+-				 BIT(MTK_CLK_ETH2PLL))
++#define MT7623_CLKS_BITMAP	(BIT_ULL(MTK_CLK_ETHIF) | BIT_ULL(MTK_CLK_ESW) |  \
++				 BIT_ULL(MTK_CLK_GP1) | BIT_ULL(MTK_CLK_GP2) | \
++				 BIT_ULL(MTK_CLK_TRGPLL))
++#define MT7622_CLKS_BITMAP	(BIT_ULL(MTK_CLK_ETHIF) | BIT_ULL(MTK_CLK_ESW) |  \
++				 BIT_ULL(MTK_CLK_GP0) | BIT_ULL(MTK_CLK_GP1) | \
++				 BIT_ULL(MTK_CLK_GP2) | \
++				 BIT_ULL(MTK_CLK_SGMII_TX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII_RX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII_CDR_REF) | \
++				 BIT_ULL(MTK_CLK_SGMII_CDR_FB) | \
++				 BIT_ULL(MTK_CLK_SGMII_CK) | \
++				 BIT_ULL(MTK_CLK_ETH2PLL))
+ #define MT7621_CLKS_BITMAP	(0)
+ #define MT7628_CLKS_BITMAP	(0)
+-#define MT7629_CLKS_BITMAP	(BIT(MTK_CLK_ETHIF) | BIT(MTK_CLK_ESW) |  \
+-				 BIT(MTK_CLK_GP0) | BIT(MTK_CLK_GP1) | \
+-				 BIT(MTK_CLK_GP2) | BIT(MTK_CLK_FE) | \
+-				 BIT(MTK_CLK_SGMII_TX_250M) | \
+-				 BIT(MTK_CLK_SGMII_RX_250M) | \
+-				 BIT(MTK_CLK_SGMII_CDR_REF) | \
+-				 BIT(MTK_CLK_SGMII_CDR_FB) | \
+-				 BIT(MTK_CLK_SGMII2_TX_250M) | \
+-				 BIT(MTK_CLK_SGMII2_RX_250M) | \
+-				 BIT(MTK_CLK_SGMII2_CDR_REF) | \
+-				 BIT(MTK_CLK_SGMII2_CDR_FB) | \
+-				 BIT(MTK_CLK_SGMII_CK) | \
+-				 BIT(MTK_CLK_ETH2PLL) | BIT(MTK_CLK_SGMIITOP))
+-#define MT7981_CLKS_BITMAP	(BIT(MTK_CLK_FE) | BIT(MTK_CLK_GP2) | BIT(MTK_CLK_GP1) | \
+-				 BIT(MTK_CLK_WOCPU0) | \
+-				 BIT(MTK_CLK_SGMII_TX_250M) | \
+-				 BIT(MTK_CLK_SGMII_RX_250M) | \
+-				 BIT(MTK_CLK_SGMII_CDR_REF) | \
+-				 BIT(MTK_CLK_SGMII_CDR_FB) | \
+-				 BIT(MTK_CLK_SGMII2_TX_250M) | \
+-				 BIT(MTK_CLK_SGMII2_RX_250M) | \
+-				 BIT(MTK_CLK_SGMII2_CDR_REF) | \
+-				 BIT(MTK_CLK_SGMII2_CDR_FB) | \
+-				 BIT(MTK_CLK_SGMII_CK))
+-#define MT7986_CLKS_BITMAP	(BIT(MTK_CLK_FE) | BIT(MTK_CLK_GP2) | BIT(MTK_CLK_GP1) | \
+-				 BIT(MTK_CLK_WOCPU1) | BIT(MTK_CLK_WOCPU0) | \
+-				 BIT(MTK_CLK_SGMII_TX_250M) | \
+-				 BIT(MTK_CLK_SGMII_RX_250M) | \
+-				 BIT(MTK_CLK_SGMII_CDR_REF) | \
+-				 BIT(MTK_CLK_SGMII_CDR_FB) | \
+-				 BIT(MTK_CLK_SGMII2_TX_250M) | \
+-				 BIT(MTK_CLK_SGMII2_RX_250M) | \
+-				 BIT(MTK_CLK_SGMII2_CDR_REF) | \
+-				 BIT(MTK_CLK_SGMII2_CDR_FB))
++#define MT7629_CLKS_BITMAP	(BIT_ULL(MTK_CLK_ETHIF) | BIT_ULL(MTK_CLK_ESW) |  \
++				 BIT_ULL(MTK_CLK_GP0) | BIT_ULL(MTK_CLK_GP1) | \
++				 BIT_ULL(MTK_CLK_GP2) | BIT_ULL(MTK_CLK_FE) | \
++				 BIT_ULL(MTK_CLK_SGMII_TX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII_RX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII_CDR_REF) | \
++				 BIT_ULL(MTK_CLK_SGMII_CDR_FB) | \
++				 BIT_ULL(MTK_CLK_SGMII2_TX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII2_RX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII2_CDR_REF) | \
++				 BIT_ULL(MTK_CLK_SGMII2_CDR_FB) | \
++				 BIT_ULL(MTK_CLK_SGMII_CK) | \
++				 BIT_ULL(MTK_CLK_ETH2PLL) | BIT_ULL(MTK_CLK_SGMIITOP))
++#define MT7981_CLKS_BITMAP	(BIT_ULL(MTK_CLK_FE) | BIT_ULL(MTK_CLK_GP2) | BIT_ULL(MTK_CLK_GP1) | \
++				 BIT_ULL(MTK_CLK_WOCPU0) | \
++				 BIT_ULL(MTK_CLK_SGMII_TX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII_RX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII_CDR_REF) | \
++				 BIT_ULL(MTK_CLK_SGMII_CDR_FB) | \
++				 BIT_ULL(MTK_CLK_SGMII2_TX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII2_RX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII2_CDR_REF) | \
++				 BIT_ULL(MTK_CLK_SGMII2_CDR_FB) | \
++				 BIT_ULL(MTK_CLK_SGMII_CK))
++#define MT7986_CLKS_BITMAP	(BIT_ULL(MTK_CLK_FE) | BIT_ULL(MTK_CLK_GP2) | BIT_ULL(MTK_CLK_GP1) | \
++				 BIT_ULL(MTK_CLK_WOCPU1) | BIT_ULL(MTK_CLK_WOCPU0) | \
++				 BIT_ULL(MTK_CLK_SGMII_TX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII_RX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII_CDR_REF) | \
++				 BIT_ULL(MTK_CLK_SGMII_CDR_FB) | \
++				 BIT_ULL(MTK_CLK_SGMII2_TX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII2_RX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII2_CDR_REF) | \
++				 BIT_ULL(MTK_CLK_SGMII2_CDR_FB))
++#define MT7988_CLKS_BITMAP	(BIT_ULL(MTK_CLK_FE) | BIT_ULL(MTK_CLK_ESW) | \
++				 BIT_ULL(MTK_CLK_GP1) | BIT_ULL(MTK_CLK_GP2) | \
++				 BIT_ULL(MTK_CLK_GP3) | BIT_ULL(MTK_CLK_XGP1) | \
++				 BIT_ULL(MTK_CLK_XGP2) | BIT_ULL(MTK_CLK_XGP3) | \
++				 BIT_ULL(MTK_CLK_CRYPTO) | \
++				 BIT_ULL(MTK_CLK_SGMII_TX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII_RX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII2_TX_250M) | \
++				 BIT_ULL(MTK_CLK_SGMII2_RX_250M) | \
++				 BIT_ULL(MTK_CLK_ETHWARP_WOCPU2) | \
++				 BIT_ULL(MTK_CLK_ETHWARP_WOCPU1) | \
++				 BIT_ULL(MTK_CLK_ETHWARP_WOCPU0) | \
++				 BIT_ULL(MTK_CLK_TOP_USXGMII_SBUS_0_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_USXGMII_SBUS_1_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_SGM_0_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_SGM_1_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_XFI_PHY_0_XTAL_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_XFI_PHY_1_XTAL_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_ETH_GMII_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_ETH_REFCK_50M_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_ETH_SYS_200M_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_ETH_SYS_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_ETH_XGMII_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_ETH_MII_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_NETSYS_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_NETSYS_500M_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_NETSYS_PAO_2X_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_NETSYS_SYNC_250M_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_NETSYS_PPEFB_250M_SEL) | \
++				 BIT_ULL(MTK_CLK_TOP_NETSYS_WARP_SEL))
+ 
+ enum mtk_dev_state {
+ 	MTK_HW_INIT,
+@@ -847,6 +904,7 @@ enum mkt_eth_capabilities {
+ 	MTK_RGMII_BIT = 0,
+ 	MTK_TRGMII_BIT,
+ 	MTK_SGMII_BIT,
++	MTK_USXGMII_BIT,
+ 	MTK_ESW_BIT,
+ 	MTK_GEPHY_BIT,
+ 	MTK_MUX_BIT,
+@@ -869,6 +927,8 @@ enum mkt_eth_capabilities {
+ 	MTK_ETH_MUX_U3_GMAC2_TO_QPHY_BIT,
+ 	MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII_BIT,
+ 	MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII_BIT,
++	MTK_ETH_MUX_GMAC123_TO_GEPHY_SGMII_BIT,
++	MTK_ETH_MUX_GMAC123_TO_USXGMII_BIT,
+ 
+ 	/* PATH BITS */
+ 	MTK_ETH_PATH_GMAC1_RGMII_BIT,
+@@ -877,13 +937,18 @@ enum mkt_eth_capabilities {
+ 	MTK_ETH_PATH_GMAC2_RGMII_BIT,
+ 	MTK_ETH_PATH_GMAC2_SGMII_BIT,
+ 	MTK_ETH_PATH_GMAC2_GEPHY_BIT,
++	MTK_ETH_PATH_GMAC3_SGMII_BIT,
+ 	MTK_ETH_PATH_GDM1_ESW_BIT,
++	MTK_ETH_PATH_GMAC1_USXGMII_BIT,
++	MTK_ETH_PATH_GMAC2_USXGMII_BIT,
++	MTK_ETH_PATH_GMAC3_USXGMII_BIT,
+ };
+ 
+ /* Supported hardware group on SoCs */
+ #define MTK_RGMII		BIT_ULL(MTK_RGMII_BIT)
+ #define MTK_TRGMII		BIT_ULL(MTK_TRGMII_BIT)
+ #define MTK_SGMII		BIT_ULL(MTK_SGMII_BIT)
++#define MTK_USXGMII		BIT_ULL(MTK_USXGMII_BIT)
+ #define MTK_ESW			BIT_ULL(MTK_ESW_BIT)
+ #define MTK_GEPHY		BIT_ULL(MTK_GEPHY_BIT)
+ #define MTK_MUX			BIT_ULL(MTK_MUX_BIT)
+@@ -910,6 +975,10 @@ enum mkt_eth_capabilities {
+ 	BIT_ULL(MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII_BIT)
+ #define MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII	\
+ 	BIT_ULL(MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII_BIT)
++#define MTK_ETH_MUX_GMAC123_TO_GEPHY_SGMII	\
++	BIT_ULL(MTK_ETH_MUX_GMAC123_TO_GEPHY_SGMII_BIT)
++#define MTK_ETH_MUX_GMAC123_TO_USXGMII	\
++	BIT_ULL(MTK_ETH_MUX_GMAC123_TO_USXGMII_BIT)
+ 
+ /* Supported path present on SoCs */
+ #define MTK_ETH_PATH_GMAC1_RGMII	BIT_ULL(MTK_ETH_PATH_GMAC1_RGMII_BIT)
+@@ -918,7 +987,11 @@ enum mkt_eth_capabilities {
+ #define MTK_ETH_PATH_GMAC2_RGMII	BIT_ULL(MTK_ETH_PATH_GMAC2_RGMII_BIT)
+ #define MTK_ETH_PATH_GMAC2_SGMII	BIT_ULL(MTK_ETH_PATH_GMAC2_SGMII_BIT)
+ #define MTK_ETH_PATH_GMAC2_GEPHY	BIT_ULL(MTK_ETH_PATH_GMAC2_GEPHY_BIT)
++#define MTK_ETH_PATH_GMAC3_SGMII	BIT_ULL(MTK_ETH_PATH_GMAC3_SGMII_BIT)
+ #define MTK_ETH_PATH_GDM1_ESW		BIT_ULL(MTK_ETH_PATH_GDM1_ESW_BIT)
++#define MTK_ETH_PATH_GMAC1_USXGMII	BIT_ULL(MTK_ETH_PATH_GMAC1_USXGMII_BIT)
++#define MTK_ETH_PATH_GMAC2_USXGMII	BIT_ULL(MTK_ETH_PATH_GMAC2_USXGMII_BIT)
++#define MTK_ETH_PATH_GMAC3_USXGMII	BIT_ULL(MTK_ETH_PATH_GMAC3_USXGMII_BIT)
+ 
+ #define MTK_GMAC1_RGMII		(MTK_ETH_PATH_GMAC1_RGMII | MTK_RGMII)
+ #define MTK_GMAC1_TRGMII	(MTK_ETH_PATH_GMAC1_TRGMII | MTK_TRGMII)
+@@ -926,7 +999,11 @@ enum mkt_eth_capabilities {
+ #define MTK_GMAC2_RGMII		(MTK_ETH_PATH_GMAC2_RGMII | MTK_RGMII)
+ #define MTK_GMAC2_SGMII		(MTK_ETH_PATH_GMAC2_SGMII | MTK_SGMII)
+ #define MTK_GMAC2_GEPHY		(MTK_ETH_PATH_GMAC2_GEPHY | MTK_GEPHY)
++#define MTK_GMAC3_SGMII		(MTK_ETH_PATH_GMAC3_SGMII | MTK_SGMII)
+ #define MTK_GDM1_ESW		(MTK_ETH_PATH_GDM1_ESW | MTK_ESW)
++#define MTK_GMAC1_USXGMII	(MTK_ETH_PATH_GMAC1_USXGMII | MTK_USXGMII)
++#define MTK_GMAC2_USXGMII	(MTK_ETH_PATH_GMAC2_USXGMII | MTK_USXGMII)
++#define MTK_GMAC3_USXGMII	(MTK_ETH_PATH_GMAC3_USXGMII | MTK_USXGMII)
+ 
+ /* MUXes present on SoCs */
+ /* 0: GDM1 -> GMAC1, 1: GDM1 -> ESW */
+@@ -949,6 +1026,12 @@ enum mkt_eth_capabilities {
+ #define MTK_MUX_GMAC12_TO_GEPHY_SGMII   \
+ 	(MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII | MTK_MUX)
+ 
++#define MTK_MUX_GMAC123_TO_GEPHY_SGMII   \
++	(MTK_ETH_MUX_GMAC123_TO_GEPHY_SGMII | MTK_MUX)
++
++#define MTK_MUX_GMAC123_TO_USXGMII   \
++	(MTK_ETH_MUX_GMAC123_TO_USXGMII | MTK_MUX | MTK_INFRA)
++
+ #ifdef CONFIG_SOC_MT7621
+ #define MTK_CAP_MASK MTK_NETSYS_V2
+ #else
+@@ -987,9 +1070,17 @@ enum mkt_eth_capabilities {
+ 		      MTK_MUX_U3_GMAC2_TO_QPHY | MTK_U3_COPHY_V2 | \
+ 		      MTK_NETSYS_V2 | MTK_RSTCTRL_PPE1)
+ 
+-#define MT7986_CAPS  (MTK_GMAC1_SGMII | MTK_GMAC2_SGMII | \
+-		      MTK_MUX_GMAC12_TO_GEPHY_SGMII | MTK_QDMA | \
+-		      MTK_NETSYS_V2 | MTK_RSTCTRL_PPE1)
++#define MT7986_CAPS  (MTK_GMAC1_SGMII | MTK_GMAC2_SGMII |	\
++		      MTK_MUX_GMAC12_TO_GEPHY_SGMII |		\
++		      MTK_QDMA | MTK_NETSYS_V2 |		\
++		      MTK_RSTCTRL_PPE1)
++
++#define MT7988_CAPS   (MTK_GMAC1_SGMII | MTK_GMAC2_SGMII |	\
++		       MTK_GMAC3_SGMII | MTK_QDMA |		\
++		       MTK_MUX_GMAC123_TO_GEPHY_SGMII |		\
++		       MTK_NETSYS_V3 | MTK_RSTCTRL_PPE1 |	\
++		       MTK_GMAC1_USXGMII | MTK_GMAC2_USXGMII |	\
++		       MTK_GMAC3_USXGMII | MTK_MUX_GMAC123_TO_USXGMII)
+ 
+ struct mtk_tx_dma_desc_info {
+ 	dma_addr_t	addr;
+@@ -1075,7 +1166,7 @@ struct mtk_soc_data {
+ 	const struct mtk_reg_map *reg_map;
+ 	u32             ana_rgc3;
+ 	u64		caps;
+-	u32		required_clks;
++	u64		required_clks;
+ 	bool		required_pctl;
+ 	u8		offload_version;
+ 	u8		hash_offset;
diff --git a/target/linux/generic/pending-6.1/737-07-net-ethernet-mtk_eth_soc-add-paths-and-SerDes-modes-.patch b/target/linux/generic/pending-6.1/737-07-net-ethernet-mtk_eth_soc-add-paths-and-SerDes-modes-.patch
new file mode 100644
index 00000000000000..abde00cf617c00
--- /dev/null
+++ b/target/linux/generic/pending-6.1/737-07-net-ethernet-mtk_eth_soc-add-paths-and-SerDes-modes-.patch
@@ -0,0 +1,1867 @@
+From 3d833ad2cfc1ab503d9aae2967b7f10811bb3c9c Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Wed, 1 Mar 2023 11:56:04 +0000
+Subject: [PATCH 7/7] net: ethernet: mtk_eth_soc: add paths and SerDes modes 
+ for MT7988
+
+MT7988 comes with a built-in 2.5G PHY as well as
+USXGMII/10GBase-KR/5GBase-KR compatible SerDes lanes for external PHYs.
+Add support for configuring the MAC and SerDes parts for the new paths.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/ethernet/mediatek/Kconfig        |   7 +
+ drivers/net/ethernet/mediatek/Makefile       |   1 +
+ drivers/net/ethernet/mediatek/mtk_eth_path.c | 154 +++-
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c  | 270 +++++-
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h  | 194 ++++-
+ drivers/net/ethernet/mediatek/mtk_usxgmii.c  | 835 +++++++++++++++++++
+ 6 files changed, 1428 insertions(+), 33 deletions(-)
+ create mode 100644 drivers/net/ethernet/mediatek/mtk_usxgmii.c
+
+--- a/drivers/net/ethernet/mediatek/Kconfig
++++ b/drivers/net/ethernet/mediatek/Kconfig
+@@ -25,6 +25,13 @@ config NET_MEDIATEK_SOC
+ 	  This driver supports the gigabit ethernet MACs in the
+ 	  MediaTek SoC family.
+ 
++config NET_MEDIATEK_SOC_USXGMII
++	bool "Support USXGMII SerDes on MT7988"
++	depends on (ARCH_MEDIATEK && ARM64) || COMPILE_TEST
++	def_bool NET_MEDIATEK_SOC != n
++	help
++	  Include support for 10G SerDes which can be found on MT7988.
++
+ config NET_MEDIATEK_STAR_EMAC
+ 	tristate "MediaTek STAR Ethernet MAC support"
+ 	select PHYLIB
+--- a/drivers/net/ethernet/mediatek/Makefile
++++ b/drivers/net/ethernet/mediatek/Makefile
+@@ -5,6 +5,7 @@
+ 
+ obj-$(CONFIG_NET_MEDIATEK_SOC) += mtk_eth.o
+ mtk_eth-y := mtk_eth_soc.o mtk_eth_path.o mtk_ppe.o mtk_ppe_debugfs.o mtk_ppe_offload.o
++mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_USXGMII) += mtk_usxgmii.o
+ mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed.o mtk_wed_mcu.o mtk_wed_wo.o
+ ifdef CONFIG_DEBUG_FS
+ mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed_debugfs.o
+--- a/drivers/net/ethernet/mediatek/mtk_eth_path.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_path.c
+@@ -31,10 +31,20 @@ static const char *mtk_eth_path_name(u64
+ 		return "gmac2_rgmii";
+ 	case MTK_ETH_PATH_GMAC2_SGMII:
+ 		return "gmac2_sgmii";
++	case MTK_ETH_PATH_GMAC2_2P5GPHY:
++		return "gmac2_2p5gphy";
+ 	case MTK_ETH_PATH_GMAC2_GEPHY:
+ 		return "gmac2_gephy";
++	case MTK_ETH_PATH_GMAC3_SGMII:
++		return "gmac3_sgmii";
+ 	case MTK_ETH_PATH_GDM1_ESW:
+ 		return "gdm1_esw";
++	case MTK_ETH_PATH_GMAC1_USXGMII:
++		return "gmac1_usxgmii";
++	case MTK_ETH_PATH_GMAC2_USXGMII:
++		return "gmac2_usxgmii";
++	case MTK_ETH_PATH_GMAC3_USXGMII:
++		return "gmac3_usxgmii";
+ 	default:
+ 		return "unknown path";
+ 	}
+@@ -42,8 +52,8 @@ static const char *mtk_eth_path_name(u64
+ 
+ static int set_mux_gdm1_to_gmac1_esw(struct mtk_eth *eth, u64 path)
+ {
++	u32 val, mask, set, reg;
+ 	bool updated = true;
+-	u32 val, mask, set;
+ 
+ 	switch (path) {
+ 	case MTK_ETH_PATH_GMAC1_SGMII:
+@@ -59,10 +69,15 @@ static int set_mux_gdm1_to_gmac1_esw(str
+ 		break;
+ 	}
+ 
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3))
++		reg = MTK_MAC_MISC_V3;
++	else
++		reg = MTK_MAC_MISC;
++
+ 	if (updated) {
+-		val = mtk_r32(eth, MTK_MAC_MISC);
++		val = mtk_r32(eth, reg);
+ 		val = (val & mask) | set;
+-		mtk_w32(eth, val, MTK_MAC_MISC);
++		mtk_w32(eth, val, reg);
+ 	}
+ 
+ 	dev_dbg(eth->dev, "path %s in %s updated = %d\n",
+@@ -125,6 +140,31 @@ static int set_mux_u3_gmac2_to_qphy(stru
+ 	return 0;
+ }
+ 
++static int set_mux_gmac2_to_2p5gphy(struct mtk_eth *eth, u64 path)
++{
++	unsigned int val = 0;
++	bool updated = true;
++	int mac_id = 0;
++
++	regmap_read(eth->ethsys, ETHSYS_SYSCFG0, &val);
++
++	switch (path) {
++	case MTK_ETH_PATH_GMAC2_2P5GPHY:
++		val &= ~(u32)SYSCFG0_SGMII_GMAC2_V2;
++		mac_id = MTK_GMAC2_ID;
++		break;
++	default:
++		updated = false;
++		break;
++	};
++
++	if (updated)
++		regmap_update_bits(eth->ethsys, ETHSYS_SYSCFG0,
++				   SYSCFG0_SGMII_MASK, val);
++
++	return 0;
++}
++
+ static int set_mux_gmac1_gmac2_to_sgmii_rgmii(struct mtk_eth *eth, u64 path)
+ {
+ 	unsigned int val = 0;
+@@ -163,7 +203,61 @@ static int set_mux_gmac1_gmac2_to_sgmii_
+ 	return 0;
+ }
+ 
+-static int set_mux_gmac12_to_gephy_sgmii(struct mtk_eth *eth, u64 path)
++static int set_mux_gmac123_to_usxgmii(struct mtk_eth *eth, u64 path)
++{
++	unsigned int val = 0;
++	bool updated = true;
++	int mac_id = 0;
++
++	dev_dbg(eth->dev, "path %s in %s updated = %d\n",
++		mtk_eth_path_name(path), __func__, updated);
++
++	/* Disable SYSCFG1 SGMII */
++	regmap_read(eth->ethsys, ETHSYS_SYSCFG0, &val);
++
++	switch (path) {
++	case MTK_ETH_PATH_GMAC1_USXGMII:
++		val &= ~(u32)SYSCFG0_SGMII_GMAC1_V2;
++		mac_id = MTK_GMAC1_ID;
++		break;
++	case MTK_ETH_PATH_GMAC2_USXGMII:
++		val &= ~(u32)SYSCFG0_SGMII_GMAC2_V2;
++		mac_id = MTK_GMAC2_ID;
++		break;
++	case MTK_ETH_PATH_GMAC3_USXGMII:
++		val &= ~(u32)SYSCFG0_SGMII_GMAC3_V2;
++		mac_id = MTK_GMAC3_ID;
++		break;
++	default:
++		updated = false;
++	};
++
++	if (updated) {
++		regmap_update_bits(eth->ethsys, ETHSYS_SYSCFG0,
++				   SYSCFG0_SGMII_MASK, val);
++
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3) &&
++		    mac_id == MTK_GMAC2_ID) {
++			regmap_update_bits(eth->infra,
++					   TOP_MISC_NETSYS_PCS_MUX,
++					   NETSYS_PCS_MUX_MASK,
++					   MUX_G2_USXGMII_SEL);
++		}
++	}
++
++	/* Enable XGDM Path */
++	val = mtk_r32(eth, MTK_GDMA_EG_CTRL(mac_id));
++	val |= MTK_GDMA_XGDM_SEL;
++	mtk_w32(eth, val, MTK_GDMA_EG_CTRL(mac_id));
++
++	dev_dbg(eth->dev, "path %s in %s updated = %d\n",
++		mtk_eth_path_name(path), __func__, updated);
++
++
++	return 0;
++}
++
++static int set_mux_gmac123_to_gephy_sgmii(struct mtk_eth *eth, u64 path)
+ {
+ 	unsigned int val = 0;
+ 	bool updated = true;
+@@ -180,6 +274,9 @@ static int set_mux_gmac12_to_gephy_sgmii
+ 	case MTK_ETH_PATH_GMAC2_SGMII:
+ 		val |= SYSCFG0_SGMII_GMAC2_V2;
+ 		break;
++	case MTK_ETH_PATH_GMAC3_SGMII:
++		val |= SYSCFG0_SGMII_GMAC3_V2;
++		break;
+ 	default:
+ 		updated = false;
+ 	}
+@@ -208,13 +305,25 @@ static const struct mtk_eth_muxc mtk_eth
+ 		.cap_bit = MTK_ETH_MUX_U3_GMAC2_TO_QPHY,
+ 		.set_path = set_mux_u3_gmac2_to_qphy,
+ 	}, {
++		.name = "mux_gmac2_to_2p5gphy",
++		.cap_bit = MTK_ETH_MUX_GMAC2_TO_2P5GPHY,
++		.set_path = set_mux_gmac2_to_2p5gphy,
++	}, {
+ 		.name = "mux_gmac1_gmac2_to_sgmii_rgmii",
+ 		.cap_bit = MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII,
+ 		.set_path = set_mux_gmac1_gmac2_to_sgmii_rgmii,
+ 	}, {
+ 		.name = "mux_gmac12_to_gephy_sgmii",
+ 		.cap_bit = MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII,
+-		.set_path = set_mux_gmac12_to_gephy_sgmii,
++		.set_path = set_mux_gmac123_to_gephy_sgmii,
++	}, {
++		.name = "mux_gmac123_to_gephy_sgmii",
++		.cap_bit = MTK_ETH_MUX_GMAC123_TO_GEPHY_SGMII,
++		.set_path = set_mux_gmac123_to_gephy_sgmii,
++	}, {
++		.name = "mux_gmac123_to_usxgmii",
++		.cap_bit = MTK_ETH_MUX_GMAC123_TO_USXGMII,
++		.set_path = set_mux_gmac123_to_usxgmii,
+ 	},
+ };
+ 
+@@ -243,16 +352,46 @@ static int mtk_eth_mux_setup(struct mtk_
+ 		}
+ 	}
+ 
++	dev_dbg(eth->dev, "leaving mux_setup %s\n",
++		mtk_eth_path_name(path));
++
+ out:
+ 	return err;
+ }
+ 
++int mtk_gmac_usxgmii_path_setup(struct mtk_eth *eth, int mac_id)
++{
++	u64 path;
++
++	path = (mac_id == MTK_GMAC1_ID) ?  MTK_ETH_PATH_GMAC1_USXGMII :
++	       (mac_id == MTK_GMAC2_ID) ?  MTK_ETH_PATH_GMAC2_USXGMII :
++					   MTK_ETH_PATH_GMAC3_USXGMII;
++
++	/* Setup proper MUXes along the path */
++	return mtk_eth_mux_setup(eth, path);
++}
++
+ int mtk_gmac_sgmii_path_setup(struct mtk_eth *eth, int mac_id)
+ {
+ 	u64 path;
+ 
+-	path = (mac_id == 0) ?  MTK_ETH_PATH_GMAC1_SGMII :
+-				MTK_ETH_PATH_GMAC2_SGMII;
++	path = (mac_id == MTK_GMAC1_ID) ? MTK_ETH_PATH_GMAC1_SGMII :
++	       (mac_id == MTK_GMAC2_ID) ? MTK_ETH_PATH_GMAC2_SGMII :
++					  MTK_ETH_PATH_GMAC3_SGMII;
++
++	/* Setup proper MUXes along the path */
++	return mtk_eth_mux_setup(eth, path);
++}
++
++int mtk_gmac_2p5gphy_path_setup(struct mtk_eth *eth, int mac_id)
++{
++	u64 path = 0;
++
++	if (mac_id == MTK_GMAC2_ID)
++		path = MTK_ETH_PATH_GMAC2_2P5GPHY;
++
++	if (!path)
++		return -EINVAL;
+ 
+ 	/* Setup proper MUXes along the path */
+ 	return mtk_eth_mux_setup(eth, path);
+@@ -282,4 +421,3 @@ int mtk_gmac_rgmii_path_setup(struct mtk
+ 	/* Setup proper MUXes along the path */
+ 	return mtk_eth_mux_setup(eth, path);
+ }
+-
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -480,6 +480,23 @@ static void mtk_gmac0_rgmii_adjust(struc
+ 	mtk_w32(eth, val, TRGMII_TCK_CTRL);
+ }
+ 
++static void mtk_setup_bridge_switch(struct mtk_eth *eth)
++{
++	int val;
++
++	/* Force Port1 XGMAC Link Up */
++	val = mtk_r32(eth, MTK_XGMAC_STS(MTK_GMAC1_ID));
++	mtk_w32(eth, val | MTK_XGMAC_FORCE_LINK(MTK_GMAC1_ID),
++		MTK_XGMAC_STS(MTK_GMAC1_ID));
++
++	/* Adjust GSW bridge IPG to 11*/
++	val = mtk_r32(eth, MTK_GSW_CFG);
++	val &= ~(GSWTX_IPG_MASK | GSWRX_IPG_MASK);
++	val |= (GSW_IPG_11 << GSWTX_IPG_SHIFT) |
++	       (GSW_IPG_11 << GSWRX_IPG_SHIFT);
++	mtk_w32(eth, val, MTK_GSW_CFG);
++}
++
+ static struct phylink_pcs *mtk_mac_select_pcs(struct phylink_config *config,
+ 					      phy_interface_t interface)
+ {
+@@ -494,6 +511,12 @@ static struct phylink_pcs *mtk_mac_selec
+ 		       0 : mac->id;
+ 
+ 		return eth->sgmii_pcs[sid];
++	} else if ((interface == PHY_INTERFACE_MODE_USXGMII ||
++		    interface == PHY_INTERFACE_MODE_10GKR ||
++		    interface == PHY_INTERFACE_MODE_5GBASER) &&
++		   MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3) &&
++		   mac->id != MTK_GMAC1_ID) {
++			return mtk_usxgmii_select_pcs(eth, mac->id);
+ 	}
+ 
+ 	return NULL;
+@@ -505,7 +528,7 @@ static void mtk_mac_config(struct phylin
+ 	struct mtk_mac *mac = container_of(config, struct mtk_mac,
+ 					   phylink_config);
+ 	struct mtk_eth *eth = mac->hw;
+-	int val, ge_mode, err = 0;
++	int val, ge_mode, force_link, err = 0;
+ 	u32 i;
+ 
+ 	/* MT76x8 has no hardware settings between for the MAC */
+@@ -549,6 +572,23 @@ static void mtk_mac_config(struct phylin
+ 					goto init_err;
+ 			}
+ 			break;
++		case PHY_INTERFACE_MODE_USXGMII:
++		case PHY_INTERFACE_MODE_10GKR:
++		case PHY_INTERFACE_MODE_5GBASER:
++			if (MTK_HAS_CAPS(eth->soc->caps, MTK_USXGMII)) {
++				err = mtk_gmac_usxgmii_path_setup(eth, mac->id);
++				if (err)
++					goto init_err;
++			}
++			break;
++		case PHY_INTERFACE_MODE_INTERNAL:
++			if (mac->id == MTK_GMAC2_ID &&
++			    MTK_HAS_CAPS(eth->soc->caps, MTK_2P5GPHY)) {
++				err = mtk_gmac_2p5gphy_path_setup(eth, mac->id);
++				if (err)
++					goto init_err;
++			}
++			break;
+ 		default:
+ 			goto err_phy;
+ 		}
+@@ -627,14 +667,78 @@ static void mtk_mac_config(struct phylin
+ 				   SYSCFG0_SGMII_MASK,
+ 				   ~(u32)SYSCFG0_SGMII_MASK);
+ 
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3)) {
++			mtk_xfi_pll_enable(eth);
++			mtk_sgmii_reset(eth, mac->id);
++			if (phylink_autoneg_inband(mode))
++				mtk_sgmii_setup_phya_gen1(eth, mac->id);
++			else
++				mtk_sgmii_setup_phya_gen2(eth, mac->id);
++		}
+ 		/* Save the syscfg0 value for mac_finish */
+ 		mac->syscfg0 = val;
+-	} else if (phylink_autoneg_inband(mode)) {
++	} else if (state->interface != PHY_INTERFACE_MODE_USXGMII &&
++		   state->interface != PHY_INTERFACE_MODE_10GKR &&
++		   state->interface != PHY_INTERFACE_MODE_5GBASER &&
++		   phylink_autoneg_inband(mode)) {
+ 		dev_err(eth->dev,
+-			"In-band mode not supported in non SGMII mode!\n");
++			"In-band mode not supported in non-SerDes modes!\n");
+ 		return;
+ 	}
+ 
++	/* Setup gmac */
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3) &&
++	    (mtk_interface_mode_is_xgmii(state->interface) ||
++	     mac->interface == PHY_INTERFACE_MODE_INTERNAL)) {
++		mtk_w32(mac->hw, MTK_GDMA_XGDM_SEL, MTK_GDMA_EG_CTRL(mac->id));
++		mtk_w32(mac->hw, MAC_MCR_FORCE_LINK_DOWN, MTK_MAC_MCR(mac->id));
++
++		switch (mac->id) {
++		case MTK_GMAC1_ID:
++			mtk_setup_bridge_switch(eth);
++			break;
++		case MTK_GMAC2_ID:
++			force_link = (mac->interface ==
++				      PHY_INTERFACE_MODE_INTERNAL) ?
++				      MTK_XGMAC_FORCE_LINK(mac->id) : 0;
++			val = mtk_r32(eth, MTK_XGMAC_STS(mac->id));
++			mtk_w32(eth, val | force_link,
++				MTK_XGMAC_STS(mac->id));
++			break;
++		case MTK_GMAC3_ID:
++			val = mtk_r32(eth, MTK_XGMAC_STS(mac->id));
++			mtk_w32(eth, val | MTK_XGMAC_FORCE_LINK(mac->id),
++				MTK_XGMAC_STS(mac->id));
++			break;
++		}
++	} else {
++		val = mtk_r32(eth, MTK_GDMA_EG_CTRL(mac->id));
++		mtk_w32(eth, val & ~MTK_GDMA_XGDM_SEL,
++			MTK_GDMA_EG_CTRL(mac->id));
++
++		if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3)) {
++			switch (mac->id) {
++			case MTK_GMAC2_ID:
++			case MTK_GMAC3_ID:
++				val = mtk_r32(eth, MTK_XGMAC_STS(mac->id));
++				mtk_w32(eth,
++					val & ~MTK_XGMAC_FORCE_LINK(mac->id),
++					MTK_XGMAC_STS(mac->id));
++				break;
++			}
++		}
++
++/*
++		if (mac->type != mac_type) {
++			if (atomic_read(&reset_pending) == 0) {
++				atomic_inc(&force);
++				schedule_work(&eth->pending_work);
++				atomic_inc(&reset_pending);
++			} else
++				atomic_dec(&reset_pending);
++		}
++*/
++	}
+ 	return;
+ 
+ err_phy:
+@@ -675,11 +779,40 @@ static int mtk_mac_finish(struct phylink
+ 	return 0;
+ }
+ 
+-static void mtk_mac_pcs_get_state(struct phylink_config *config,
++static void mtk_xgdm_pcs_get_state(struct mtk_mac *mac,
++				  struct phylink_link_state *state)
++{
++	u32 sts = mtk_r32(mac->hw, MTK_XGMAC_STS(mac->id));
++
++	if (mac->id == MTK_GMAC2_ID)
++		sts = sts >> 16;
++
++	state->link = FIELD_GET(MTK_USXGMII_PCS_LINK, sts);
++	if (!state->link)
++		return;
++
++	state->duplex = DUPLEX_FULL;
++	state->interface = mac->interface;
++
++	switch (FIELD_GET(MTK_USXGMII_PCS_MODE, sts)) {
++	case 0:
++		state->speed = SPEED_10000;
++		break;
++	case 1:
++		state->speed = SPEED_5000;
++		break;
++	case 2:
++		state->speed = SPEED_2500;
++		break;
++	case 3:
++		state->speed = SPEED_1000;
++		break;
++	}
++}
++
++static void mtk_gdm_pcs_get_state(struct mtk_mac *mac,
+ 				  struct phylink_link_state *state)
+ {
+-	struct mtk_mac *mac = container_of(config, struct mtk_mac,
+-					   phylink_config);
+ 	u32 pmsr = mtk_r32(mac->hw, MTK_MAC_MSR(mac->id));
+ 
+ 	state->link = (pmsr & MAC_MSR_LINK);
+@@ -707,15 +840,35 @@ static void mtk_mac_pcs_get_state(struct
+ 		state->pause |= MLO_PAUSE_TX;
+ }
+ 
++static void mtk_mac_pcs_get_state(struct phylink_config *config,
++				  struct phylink_link_state *state)
++{
++	struct mtk_mac *mac = container_of(config, struct mtk_mac,
++					   phylink_config);
++
++	if (mtk_interface_mode_is_xgmii(state->interface))
++		mtk_xgdm_pcs_get_state(mac, state);
++	else
++		mtk_gdm_pcs_get_state(mac, state);
++}
++
+ static void mtk_mac_link_down(struct phylink_config *config, unsigned int mode,
+ 			      phy_interface_t interface)
+ {
+ 	struct mtk_mac *mac = container_of(config, struct mtk_mac,
+ 					   phylink_config);
+-	u32 mcr = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id));
++	u32 mcr;
+ 
+-	mcr &= ~(MAC_MCR_TX_EN | MAC_MCR_RX_EN);
+-	mtk_w32(mac->hw, mcr, MTK_MAC_MCR(mac->id));
++	if (!mtk_interface_mode_is_xgmii(interface)) {
++		mcr = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id));
++		mcr &= ~(MAC_MCR_TX_EN | MAC_MCR_RX_EN);
++		mtk_w32(mac->hw, mcr, MTK_MAC_MCR(mac->id));
++	} else if (mac->id != MTK_GMAC1_ID) {
++		mcr = mtk_r32(mac->hw, MTK_XMAC_MCR(mac->id));
++		mcr &= 0xfffffff0;
++		mcr |= XMAC_MCR_TRX_DISABLE;
++		mtk_w32(mac->hw, mcr, MTK_XMAC_MCR(mac->id));
++	}
+ }
+ 
+ static void mtk_set_queue_speed(struct mtk_eth *eth, unsigned int idx,
+@@ -787,13 +940,11 @@ static void mtk_set_queue_speed(struct m
+ 	mtk_w32(eth, val, soc->reg_map->qdma.qtx_sch + ofs);
+ }
+ 
+-static void mtk_mac_link_up(struct phylink_config *config,
+-			    struct phy_device *phy,
+-			    unsigned int mode, phy_interface_t interface,
+-			    int speed, int duplex, bool tx_pause, bool rx_pause)
++static void mtk_gdm_mac_link_up(struct mtk_mac *mac,
++				struct phy_device *phy,
++				unsigned int mode, phy_interface_t interface,
++				int speed, int duplex, bool tx_pause, bool rx_pause)
+ {
+-	struct mtk_mac *mac = container_of(config, struct mtk_mac,
+-					   phylink_config);
+ 	u32 mcr;
+ 
+ 	mcr = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id));
+@@ -827,6 +978,47 @@ static void mtk_mac_link_up(struct phyli
+ 	mtk_w32(mac->hw, mcr, MTK_MAC_MCR(mac->id));
+ }
+ 
++static void mtk_xgdm_mac_link_up(struct mtk_mac *mac,
++				 struct phy_device *phy,
++				 unsigned int mode, phy_interface_t interface,
++				 int speed, int duplex, bool tx_pause, bool rx_pause)
++{
++	u32 mcr;
++
++	if (mac->id == MTK_GMAC1_ID)
++		return;
++
++	mcr = mtk_r32(mac->hw, MTK_XMAC_MCR(mac->id));
++
++	mcr &= ~(XMAC_MCR_FORCE_TX_FC |	XMAC_MCR_FORCE_RX_FC);
++	/* Configure pause modes -
++	 * phylink will avoid these for half duplex
++	 */
++	if (tx_pause)
++		mcr |= XMAC_MCR_FORCE_TX_FC;
++	if (rx_pause)
++		mcr |= XMAC_MCR_FORCE_RX_FC;
++
++	mcr &= ~(XMAC_MCR_TRX_DISABLE);
++	mtk_w32(mac->hw, mcr, MTK_XMAC_MCR(mac->id));
++}
++
++static void mtk_mac_link_up(struct phylink_config *config,
++			    struct phy_device *phy,
++			    unsigned int mode, phy_interface_t interface,
++			    int speed, int duplex, bool tx_pause, bool rx_pause)
++{
++	struct mtk_mac *mac = container_of(config, struct mtk_mac,
++					   phylink_config);
++
++	if (mtk_interface_mode_is_xgmii(interface))
++		mtk_xgdm_mac_link_up(mac, phy, mode, interface, speed, duplex,
++				     tx_pause, rx_pause);
++	else
++		mtk_gdm_mac_link_up(mac, phy, mode, interface, speed, duplex,
++				    tx_pause, rx_pause);
++}
++
+ static const struct phylink_mac_ops mtk_phylink_ops = {
+ 	.validate = phylink_generic_validate,
+ 	.mac_select_pcs = mtk_mac_select_pcs,
+@@ -880,10 +1072,21 @@ static int mtk_mdio_init(struct mtk_eth
+ 	}
+ 	divider = min_t(unsigned int, DIV_ROUND_UP(MDC_MAX_FREQ, max_clk), 63);
+ 
++	/* Configure MDC Turbo Mode */
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3)) {
++		val = mtk_r32(eth, MTK_MAC_MISC_V3);
++		val |= MISC_MDC_TURBO;
++		mtk_w32(eth, val, MTK_MAC_MISC_V3);
++	} else {
++		val = mtk_r32(eth, MTK_PPSC);
++		val |= PPSC_MDC_TURBO;
++		mtk_w32(eth, val, MTK_PPSC);
++	}
++
+ 	/* Configure MDC Divider */
+ 	val = mtk_r32(eth, MTK_PPSC);
+ 	val &= ~PPSC_MDC_CFG;
+-	val |= FIELD_PREP(PPSC_MDC_CFG, divider) | PPSC_MDC_TURBO;
++	val |= FIELD_PREP(PPSC_MDC_CFG, divider);
+ 	mtk_w32(eth, val, MTK_PPSC);
+ 
+ 	dev_dbg(eth->dev, "MDC is running on %d Hz\n", MDC_MAX_FREQ / divider);
+@@ -4487,8 +4690,8 @@ static int mtk_add_mac(struct mtk_eth *e
+ 	const __be32 *_id = of_get_property(np, "reg", NULL);
+ 	phy_interface_t phy_mode;
+ 	struct phylink *phylink;
+-	struct mtk_mac *mac;
+ 	int id, err;
++	struct mtk_mac *mac;
+ 	int txqs = 1;
+ 
+ 	if (!_id) {
+@@ -4579,6 +4782,32 @@ static int mtk_add_mac(struct mtk_eth *e
+ 			  mac->phylink_config.supported_interfaces);
+ 	}
+ 
++	if (MTK_HAS_CAPS(mac->hw->soc->caps, MTK_USXGMII)) {
++		if (id == MTK_GMAC1_ID) {
++			mac->phylink_config.mac_capabilities = MAC_ASYM_PAUSE |
++							       MAC_SYM_PAUSE |
++							       MAC_10000FD;
++			phy_interface_zero(
++				mac->phylink_config.supported_interfaces);
++			__set_bit(PHY_INTERFACE_MODE_INTERNAL,
++				  mac->phylink_config.supported_interfaces);
++		} else {
++			mac->phylink_config.mac_capabilities |= MAC_5000FD | MAC_10000FD;
++			__set_bit(PHY_INTERFACE_MODE_5GBASER,
++				  mac->phylink_config.supported_interfaces);
++			__set_bit(PHY_INTERFACE_MODE_10GKR,
++				  mac->phylink_config.supported_interfaces);
++			__set_bit(PHY_INTERFACE_MODE_USXGMII,
++				  mac->phylink_config.supported_interfaces);
++		}
++	}
++
++	if (MTK_HAS_CAPS(mac->hw->soc->caps, MTK_2P5GPHY)) {
++		if (id == MTK_GMAC2_ID)
++			__set_bit(PHY_INTERFACE_MODE_INTERNAL,
++				  mac->phylink_config.supported_interfaces);
++	}
++
+ 	phylink = phylink_create(&mac->phylink_config,
+ 				 of_fwnode_handle(mac->of_node),
+ 				 phy_mode, &mtk_phylink_ops);
+@@ -4766,6 +4995,13 @@ static int mtk_probe(struct platform_dev
+ 
+ 		if (err)
+ 			return err;
++	}
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_USXGMII)) {
++		err = mtk_usxgmii_init(eth);
++
++		if (err)
++			return err;
+ 	}
+ 
+ 	if (eth->soc->required_pctl) {
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -126,6 +126,11 @@
+ #define MTK_GDMA_TO_PDMA	0x0
+ #define MTK_GDMA_DROP_ALL       0x7777
+ 
++/* GDM Egress Control Register */
++#define MTK_GDMA_EG_CTRL(x)	((x == MTK_GMAC3_ID) ?		\
++				 0x544 : 0x504 + (x * 0x1000))
++#define MTK_GDMA_XGDM_SEL	BIT(31)
++
+ /* Unicast Filter MAC Address Register - Low */
+ #define MTK_GDMA_MAC_ADRL(x)	(0x508 + (x * 0x1000))
+ 
+@@ -389,7 +394,26 @@
+ #define PHY_IAC_TIMEOUT		HZ
+ 
+ #define MTK_MAC_MISC		0x1000c
++#define MTK_MAC_MISC_V3		0x10010
+ #define MTK_MUX_TO_ESW		BIT(0)
++#define MISC_MDC_TURBO		BIT(4)
++
++/* XMAC status registers */
++#define MTK_XGMAC_STS(x)	((x == MTK_GMAC3_ID) ? 0x1001C : 0x1000C)
++#define MTK_XGMAC_FORCE_LINK(x)	((x == MTK_GMAC2_ID) ? BIT(31) : BIT(15))
++#define MTK_USXGMII_PCS_LINK	BIT(8)
++#define MTK_XGMAC_RX_FC		BIT(5)
++#define MTK_XGMAC_TX_FC		BIT(4)
++#define MTK_USXGMII_PCS_MODE	GENMASK(3, 1)
++#define MTK_XGMAC_LINK_STS	BIT(0)
++
++/* GSW bridge registers */
++#define MTK_GSW_CFG		(0x10080)
++#define GSWTX_IPG_MASK		GENMASK(19, 16)
++#define GSWTX_IPG_SHIFT		16
++#define GSWRX_IPG_MASK		GENMASK(3, 0)
++#define GSWRX_IPG_SHIFT		0
++#define GSW_IPG_11		11
+ 
+ /* Mac control registers */
+ #define MTK_MAC_MCR(x)		(0x10100 + (x * 0x100))
+@@ -414,6 +438,17 @@
+ #define MAC_MCR_FORCE_LINK	BIT(0)
+ #define MAC_MCR_FORCE_LINK_DOWN	(MAC_MCR_FORCE_MODE)
+ 
++/* Mac EEE control registers */
++#define MTK_MAC_EEE(x)		(0x10104 + (x * 0x100))
++#define MAC_EEE_WAKEUP_TIME_1000	GENMASK(31, 24)
++#define MAC_EEE_WAKEUP_TIME_100	GENMASK(23, 16)
++#define MAC_EEE_LPI_TXIDLE_THD	GENMASK(15, 8)
++#define MAC_EEE_RESV0		GENMASK(7, 4)
++#define MAC_EEE_CKG_TXILDE	BIT(3)
++#define MAC_EEE_CKG_RXLPI	BIT(2)
++#define MAC_EEE_TX_DOWN_REQ	BIT(1)
++#define MAC_EEE_LPI_MODE	BIT(0)
++
+ /* Mac status registers */
+ #define MTK_MAC_MSR(x)		(0x10108 + (x * 0x100))
+ #define MAC_MSR_EEE1G		BIT(7)
+@@ -458,6 +493,12 @@
+ #define INTF_MODE_RGMII_1000    (TRGMII_MODE | TRGMII_CENTRAL_ALIGNED)
+ #define INTF_MODE_RGMII_10_100  0
+ 
++/* XFI Mac control registers */
++#define MTK_XMAC_MCR(x)		(0x12000 + ((x - 1) * 0x1000))
++#define XMAC_MCR_TRX_DISABLE	0xf
++#define XMAC_MCR_FORCE_TX_FC	BIT(5)
++#define XMAC_MCR_FORCE_RX_FC	BIT(4)
++
+ /* GPIO port control registers for GMAC 2*/
+ #define GPIO_OD33_CTRL8		0x4c0
+ #define GPIO_BIAS_CTRL		0xed0
+@@ -483,6 +524,7 @@
+ #define SYSCFG0_SGMII_GMAC2    ((3 << 8) & SYSCFG0_SGMII_MASK)
+ #define SYSCFG0_SGMII_GMAC1_V2 BIT(9)
+ #define SYSCFG0_SGMII_GMAC2_V2 BIT(8)
++#define SYSCFG0_SGMII_GMAC3_V2 BIT(7)
+ 
+ 
+ /* ethernet subsystem clock register */
+@@ -509,16 +551,91 @@
+ #define ETHSYS_DMA_AG_MAP_QDMA	BIT(1)
+ #define ETHSYS_DMA_AG_MAP_PPE	BIT(2)
+ 
++/* USXGMII subsystem config registers */
++/* Register to control speed */
++#define RG_PHY_TOP_SPEED_CTRL1	0x80C
++#define USXGMII_RATE_UPDATE_MODE	BIT(31)
++#define USXGMII_MAC_CK_GATED	BIT(29)
++#define USXGMII_IF_FORCE_EN	BIT(28)
++#define USXGMII_RATE_ADAPT_MODE	GENMASK(10, 8)
++#define USXGMII_RATE_ADAPT_MODE_X1	0
++#define USXGMII_RATE_ADAPT_MODE_X2	1
++#define USXGMII_RATE_ADAPT_MODE_X4	2
++#define USXGMII_RATE_ADAPT_MODE_X10	3
++#define USXGMII_RATE_ADAPT_MODE_X100	4
++#define USXGMII_RATE_ADAPT_MODE_X5	5
++#define USXGMII_RATE_ADAPT_MODE_X50	6
++#define USXGMII_XFI_RX_MODE	GENMASK(6, 4)
++#define USXGMII_XFI_RX_MODE_10G	0
++#define USXGMII_XFI_RX_MODE_5G	1
++#define USXGMII_XFI_TX_MODE	GENMASK(2, 0)
++#define USXGMII_XFI_TX_MODE_10G	0
++#define USXGMII_XFI_TX_MODE_5G	1
++
++/* Register to control PCS AN */
++#define RG_PCS_AN_CTRL0		0x810
++#define USXGMII_AN_RESTART	BIT(31)
++#define USXGMII_AN_SYNC_CNT	GENMASK(30, 11)
++#define USXGMII_AN_ENABLE	BIT(0)
++
++#define RG_PCS_AN_CTRL2		0x818
++#define USXGMII_LINK_TIMER_IDLE_DETECT	GENMASK(29, 20)
++#define USXGMII_LINK_TIMER_COMP_ACK_DETECT	GENMASK(19, 10)
++#define USXGMII_LINK_TIMER_AN_RESTART	GENMASK(9, 0)
++
++/* Register to read PCS AN status */
++#define RG_PCS_AN_STS0		0x81c
++#define USXGMII_LPA_SPEED_MASK	GENMASK(11, 9)
++#define USXGMII_LPA_SPEED_10	0
++#define USXGMII_LPA_SPEED_100	1
++#define USXGMII_LPA_SPEED_1000	2
++#define USXGMII_LPA_SPEED_10000	3
++#define USXGMII_LPA_SPEED_2500	4
++#define USXGMII_LPA_SPEED_5000	5
++#define USXGMII_LPA_DUPLEX	BIT(12)
++#define USXGMII_LPA_LINK	BIT(15)
++#define USXGMII_LPA_LATCH	BIT(31)
++
++/* Register to control USXGMII XFI PLL digital */
++#define XFI_PLL_DIG_GLB8	0x08
++#define RG_XFI_PLL_EN		BIT(31)
++
++/* Register to control USXGMII XFI PLL analog */
++#define XFI_PLL_ANA_GLB8	0x108
++#define RG_XFI_PLL_ANA_SWWA	0x02283248
++
+ /* Infrasys subsystem config registers */
+ #define INFRA_MISC2            0x70c
+ #define CO_QPHY_SEL            BIT(0)
+ #define GEPHY_MAC_SEL          BIT(1)
+ 
++/* Toprgu subsystem config registers */
++#define TOPRGU_SWSYSRST		0x18
++#define SWSYSRST_UNLOCK_KEY	GENMASK(31, 24)
++#define SWSYSRST_XFI_PLL_GRST	BIT(16)
++#define SWSYSRST_XFI_PEXPT1_GRST	BIT(15)
++#define SWSYSRST_XFI_PEXPT0_GRST	BIT(14)
++#define SWSYSRST_XFI1_GRST	BIT(13)
++#define SWSYSRST_XFI0_GRST	BIT(12)
++#define SWSYSRST_SGMII1_GRST	BIT(2)
++#define SWSYSRST_SGMII0_GRST	BIT(1)
++#define TOPRGU_SWSYSRST_EN		0xFC
++
+ /* Top misc registers */
++#define TOP_MISC_NETSYS_PCS_MUX	0x84
++#define NETSYS_PCS_MUX_MASK	GENMASK(1, 0)
++#define	MUX_G2_USXGMII_SEL	BIT(1)
++#define MUX_HSGMII1_G1_SEL	BIT(0)
++
+ #define USB_PHY_SWITCH_REG	0x218
+ #define QPHY_SEL_MASK		GENMASK(1, 0)
+ #define SGMII_QPHY_SEL		0x2
+ 
++/* MDIO control */
++#define MII_MMD_ACC_CTL_REG	0x0d
++#define MII_MMD_ADDR_DATA_REG	0x0e
++#define MMD_OP_MODE_DATA	BIT(14)
++
+ /* MT7628/88 specific stuff */
+ #define MT7628_PDMA_OFFSET	0x0800
+ #define MT7628_SDM_OFFSET	0x0c00
+@@ -812,13 +929,6 @@ enum mtk_gmac_id {
+ 	MTK_GMAC_ID_MAX
+ };
+ 
+-/* GDM Type */
+-enum mtk_gdm_type {
+-	MTK_GDM_TYPE = 0,
+-	MTK_XGDM_TYPE,
+-	MTK_GDM_TYPE_MAX
+-};
+-
+ enum mtk_tx_buf_type {
+ 	MTK_TYPE_SKB,
+ 	MTK_TYPE_XDP_TX,
+@@ -905,6 +1015,7 @@ enum mkt_eth_capabilities {
+ 	MTK_TRGMII_BIT,
+ 	MTK_SGMII_BIT,
+ 	MTK_USXGMII_BIT,
++	MTK_2P5GPHY_BIT,
+ 	MTK_ESW_BIT,
+ 	MTK_GEPHY_BIT,
+ 	MTK_MUX_BIT,
+@@ -925,6 +1036,7 @@ enum mkt_eth_capabilities {
+ 	MTK_ETH_MUX_GDM1_TO_GMAC1_ESW_BIT,
+ 	MTK_ETH_MUX_GMAC2_GMAC0_TO_GEPHY_BIT,
+ 	MTK_ETH_MUX_U3_GMAC2_TO_QPHY_BIT,
++	MTK_ETH_MUX_GMAC2_TO_2P5GPHY_BIT,
+ 	MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII_BIT,
+ 	MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII_BIT,
+ 	MTK_ETH_MUX_GMAC123_TO_GEPHY_SGMII_BIT,
+@@ -936,6 +1048,7 @@ enum mkt_eth_capabilities {
+ 	MTK_ETH_PATH_GMAC1_SGMII_BIT,
+ 	MTK_ETH_PATH_GMAC2_RGMII_BIT,
+ 	MTK_ETH_PATH_GMAC2_SGMII_BIT,
++	MTK_ETH_PATH_GMAC2_2P5GPHY_BIT,
+ 	MTK_ETH_PATH_GMAC2_GEPHY_BIT,
+ 	MTK_ETH_PATH_GMAC3_SGMII_BIT,
+ 	MTK_ETH_PATH_GDM1_ESW_BIT,
+@@ -949,6 +1062,7 @@ enum mkt_eth_capabilities {
+ #define MTK_TRGMII		BIT_ULL(MTK_TRGMII_BIT)
+ #define MTK_SGMII		BIT_ULL(MTK_SGMII_BIT)
+ #define MTK_USXGMII		BIT_ULL(MTK_USXGMII_BIT)
++#define MTK_2P5GPHY		BIT_ULL(MTK_2P5GPHY_BIT)
+ #define MTK_ESW			BIT_ULL(MTK_ESW_BIT)
+ #define MTK_GEPHY		BIT_ULL(MTK_GEPHY_BIT)
+ #define MTK_MUX			BIT_ULL(MTK_MUX_BIT)
+@@ -971,6 +1085,8 @@ enum mkt_eth_capabilities {
+ 	BIT_ULL(MTK_ETH_MUX_GMAC2_GMAC0_TO_GEPHY_BIT)
+ #define MTK_ETH_MUX_U3_GMAC2_TO_QPHY		\
+ 	BIT_ULL(MTK_ETH_MUX_U3_GMAC2_TO_QPHY_BIT)
++#define MTK_ETH_MUX_GMAC2_TO_2P5GPHY		\
++	BIT_ULL(MTK_ETH_MUX_GMAC2_TO_2P5GPHY_BIT)
+ #define MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII	\
+ 	BIT_ULL(MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII_BIT)
+ #define MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII	\
+@@ -986,6 +1102,7 @@ enum mkt_eth_capabilities {
+ #define MTK_ETH_PATH_GMAC1_SGMII	BIT_ULL(MTK_ETH_PATH_GMAC1_SGMII_BIT)
+ #define MTK_ETH_PATH_GMAC2_RGMII	BIT_ULL(MTK_ETH_PATH_GMAC2_RGMII_BIT)
+ #define MTK_ETH_PATH_GMAC2_SGMII	BIT_ULL(MTK_ETH_PATH_GMAC2_SGMII_BIT)
++#define MTK_ETH_PATH_GMAC2_2P5GPHY	BIT_ULL(MTK_ETH_PATH_GMAC2_2P5GPHY_BIT)
+ #define MTK_ETH_PATH_GMAC2_GEPHY	BIT_ULL(MTK_ETH_PATH_GMAC2_GEPHY_BIT)
+ #define MTK_ETH_PATH_GMAC3_SGMII	BIT_ULL(MTK_ETH_PATH_GMAC3_SGMII_BIT)
+ #define MTK_ETH_PATH_GDM1_ESW		BIT_ULL(MTK_ETH_PATH_GDM1_ESW_BIT)
+@@ -999,6 +1116,7 @@ enum mkt_eth_capabilities {
+ #define MTK_GMAC2_RGMII		(MTK_ETH_PATH_GMAC2_RGMII | MTK_RGMII)
+ #define MTK_GMAC2_SGMII		(MTK_ETH_PATH_GMAC2_SGMII | MTK_SGMII)
+ #define MTK_GMAC2_GEPHY		(MTK_ETH_PATH_GMAC2_GEPHY | MTK_GEPHY)
++#define MTK_GMAC2_2P5GPHY	(MTK_ETH_PATH_GMAC2_2P5GPHY | MTK_2P5GPHY)
+ #define MTK_GMAC3_SGMII		(MTK_ETH_PATH_GMAC3_SGMII | MTK_SGMII)
+ #define MTK_GDM1_ESW		(MTK_ETH_PATH_GDM1_ESW | MTK_ESW)
+ #define MTK_GMAC1_USXGMII	(MTK_ETH_PATH_GMAC1_USXGMII | MTK_USXGMII)
+@@ -1022,6 +1140,10 @@ enum mkt_eth_capabilities {
+ 	(MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII | MTK_MUX | \
+ 	MTK_SHARED_SGMII)
+ 
++/* 2: GMAC2 -> XGMII */
++#define MTK_MUX_GMAC2_TO_2P5GPHY      \
++	(MTK_ETH_MUX_GMAC2_TO_2P5GPHY | MTK_MUX | MTK_INFRA)
++
+ /* 0: GMACx -> GEPHY, 1: GMACx -> SGMII where x is 1 or 2 */
+ #define MTK_MUX_GMAC12_TO_GEPHY_SGMII   \
+ 	(MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII | MTK_MUX)
+@@ -1080,7 +1202,8 @@ enum mkt_eth_capabilities {
+ 		       MTK_MUX_GMAC123_TO_GEPHY_SGMII |		\
+ 		       MTK_NETSYS_V3 | MTK_RSTCTRL_PPE1 |	\
+ 		       MTK_GMAC1_USXGMII | MTK_GMAC2_USXGMII |	\
+-		       MTK_GMAC3_USXGMII | MTK_MUX_GMAC123_TO_USXGMII)
++		       MTK_GMAC3_USXGMII | MTK_MUX_GMAC123_TO_USXGMII | \
++		       MTK_GMAC2_2P5GPHY | MTK_MUX_GMAC2_TO_2P5GPHY)
+ 
+ struct mtk_tx_dma_desc_info {
+ 	dma_addr_t	addr;
+@@ -1186,6 +1309,22 @@ struct mtk_soc_data {
+ 
+ #define MTK_DMA_MONITOR_TIMEOUT		msecs_to_jiffies(1000)
+ 
++/* struct mtk_usxgmii_pcs - This structure holds each usxgmii regmap and
++ *			associated data
++ * @regmap:		The register map pointing at the range used to setup
++ *			USXGMII modes
++ * @interface:		Currently selected interface mode
++ * @id:			The element is used to record the index of PCS
++ * @pcs:		Phylink PCS structure
++ */
++struct mtk_usxgmii_pcs {
++	struct mtk_eth		*eth;
++	struct regmap		*regmap;
++	phy_interface_t		interface;
++	u8			id;
++	struct phylink_pcs	pcs;
++};
++
+ /* struct mtk_eth -	This is the main datasructure for holding the state
+  *			of the driver
+  * @dev:		The device pointer
+@@ -1206,6 +1345,11 @@ struct mtk_soc_data {
+  * @infra:              The register map pointing at the range used to setup
+  *                      SGMII and GePHY path
+  * @sgmii_pcs:		Pointers to mtk-pcs-lynxi phylink_pcs instances
++ * @usxgmii_pll:	The register map pointing at the range used to control
++ *			the USXGMII SerDes PLL
++ * @regmap_pextp:	The register map pointing at the range used to setup
++ *			PHYA
++ * @usxgmii_pcs:	Pointer to array of pointers to struct for USXGMII PCS
+  * @pctl:		The register map pointing at the range used to setup
+  *			GMAC port drive/slew values
+  * @dma_refcnt:		track how many netdevs are using the DMA engine
+@@ -1247,7 +1391,11 @@ struct mtk_eth {
+ 	unsigned long			sysclk;
+ 	struct regmap			*ethsys;
+ 	struct regmap			*infra;
++	struct regmap			*toprgu;
+ 	struct phylink_pcs		**sgmii_pcs;
++	struct regmap			*usxgmii_pll;
++	struct regmap			**regmap_pextp;
++	struct mtk_usxgmii_pcs		**usxgmii_pcs;
+ 	struct regmap			*pctl;
+ 	bool				hwlro;
+ 	refcount_t			dma_refcnt;
+@@ -1403,6 +1551,19 @@ static inline u32 mtk_get_ib2_multicast_
+ 	return MTK_FOE_IB2_MULTICAST;
+ }
+ 
++static inline bool mtk_interface_mode_is_xgmii(phy_interface_t interface)
++{
++	switch (interface) {
++	case PHY_INTERFACE_MODE_USXGMII:
++	case PHY_INTERFACE_MODE_10GKR:
++	case PHY_INTERFACE_MODE_5GBASER:
++		return true;
++		break;
++	default:
++		return false;
++	}
++}
++
+ /* read the hardware status register */
+ void mtk_stats_update_mac(struct mtk_mac *mac);
+ 
+@@ -1410,8 +1571,10 @@ void mtk_w32(struct mtk_eth *eth, u32 va
+ u32 mtk_r32(struct mtk_eth *eth, unsigned reg);
+ 
+ int mtk_gmac_sgmii_path_setup(struct mtk_eth *eth, int mac_id);
++int mtk_gmac_2p5gphy_path_setup(struct mtk_eth *eth, int mac_id);
+ int mtk_gmac_gephy_path_setup(struct mtk_eth *eth, int mac_id);
+ int mtk_gmac_rgmii_path_setup(struct mtk_eth *eth, int mac_id);
++int mtk_gmac_usxgmii_path_setup(struct mtk_eth *eth, int mac_id);
+ 
+ int mtk_eth_offload_init(struct mtk_eth *eth);
+ int mtk_eth_setup_tc(struct net_device *dev, enum tc_setup_type type,
+@@ -1421,5 +1584,20 @@ int mtk_flow_offload_cmd(struct mtk_eth
+ void mtk_flow_offload_cleanup(struct mtk_eth *eth, struct list_head *list);
+ void mtk_eth_set_dma_device(struct mtk_eth *eth, struct device *dma_dev);
+ 
++#ifdef CONFIG_NET_MEDIATEK_SOC_USXGMII
++struct phylink_pcs *mtk_usxgmii_select_pcs(struct mtk_eth *eth, int id);
++int mtk_usxgmii_init(struct mtk_eth *eth);
++int mtk_xfi_pll_enable(struct mtk_eth *eth);
++void mtk_sgmii_setup_phya_gen1(struct mtk_eth *eth, int mac_id);
++void mtk_sgmii_setup_phya_gen2(struct mtk_eth *eth, int mac_id);
++void mtk_sgmii_reset(struct mtk_eth *eth, int mac_id);
++#else
++static inline struct phylink_pcs *mtk_usxgmii_select_pcs(struct mtk_eth *eth, int id) { return NULL; }
++static inline int mtk_usxgmii_init(struct mtk_eth *eth) { return 0; }
++static inline int mtk_xfi_pll_enable(struct mtk_eth *eth) { return 0; }
++static inline void mtk_sgmii_setup_phya_gen1(struct mtk_eth *eth, int mac_id) { }
++static inline void mtk_sgmii_setup_phya_gen2(struct mtk_eth *eth, int mac_id) { }
++static inline void mtk_sgmii_reset(struct mtk_eth *eth, int mac_id) { }
++#endif /* NET_MEDIATEK_SOC_USXGMII */
+ 
+ #endif /* MTK_ETH_H */
+--- /dev/null
++++ b/drivers/net/ethernet/mediatek/mtk_usxgmii.c
+@@ -0,0 +1,835 @@
++/* SPDX-License-Identifier: GPL-2.0
++ *
++ * Copyright (c) 2022 MediaTek Inc.
++ * Author: Henry Yen <henry.yen@mediatek.com>
++ *         Daniel Golle <daniel@makrotopia.org>
++ */
++
++#include <linux/mfd/syscon.h>
++#include <linux/of.h>
++#include <linux/regmap.h>
++#include "mtk_eth_soc.h"
++
++static struct mtk_usxgmii_pcs *pcs_to_mtk_usxgmii_pcs(struct phylink_pcs *pcs)
++{
++	return container_of(pcs, struct mtk_usxgmii_pcs, pcs);
++}
++
++static int mtk_xfi_pextp_init(struct mtk_eth *eth)
++{
++	struct device *dev = eth->dev;
++	struct device_node *r = dev->of_node;
++	struct device_node *np;
++	int i;
++
++	eth->regmap_pextp = devm_kcalloc(dev, eth->soc->num_devs, sizeof(eth->regmap_pextp), GFP_KERNEL);
++	if (!eth->regmap_pextp)
++		return -ENOMEM;
++
++	for (i = 0; i < eth->soc->num_devs; i++) {
++		np = of_parse_phandle(r, "mediatek,xfi_pextp", i);
++		if (!np)
++			break;
++
++		eth->regmap_pextp[i] = syscon_node_to_regmap(np);
++		if (IS_ERR(eth->regmap_pextp[i]))
++			return PTR_ERR(eth->regmap_pextp[i]);
++	}
++
++	return 0;
++}
++
++static int mtk_xfi_pll_init(struct mtk_eth *eth)
++{
++	struct device_node *r = eth->dev->of_node;
++	struct device_node *np;
++
++	np = of_parse_phandle(r, "mediatek,xfi_pll", 0);
++	if (!np)
++		return -1;
++
++	eth->usxgmii_pll = syscon_node_to_regmap(np);
++	if (IS_ERR(eth->usxgmii_pll))
++		return PTR_ERR(eth->usxgmii_pll);
++
++	return 0;
++}
++
++static int mtk_toprgu_init(struct mtk_eth *eth)
++{
++	struct device_node *r = eth->dev->of_node;
++	struct device_node *np;
++
++	np = of_parse_phandle(r, "mediatek,toprgu", 0);
++	if (!np)
++		return -1;
++
++	eth->toprgu = syscon_node_to_regmap(np);
++	if (IS_ERR(eth->toprgu))
++		return PTR_ERR(eth->toprgu);
++
++	return 0;
++}
++
++int mtk_xfi_pll_enable(struct mtk_eth *eth)
++{
++	u32 val = 0;
++
++	if (!eth->usxgmii_pll)
++		return -EINVAL;
++
++	/* Add software workaround for USXGMII PLL TCL issue */
++	regmap_write(eth->usxgmii_pll, XFI_PLL_ANA_GLB8, RG_XFI_PLL_ANA_SWWA);
++
++	regmap_read(eth->usxgmii_pll, XFI_PLL_DIG_GLB8, &val);
++	val |= RG_XFI_PLL_EN;
++	regmap_write(eth->usxgmii_pll, XFI_PLL_DIG_GLB8, val);
++
++	return 0;
++}
++
++static int mtk_mac2xgmii_id(struct mtk_eth *eth, int mac_id)
++{
++	int xgmii_id = mac_id;
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3)) {
++		switch (mac_id) {
++		case MTK_GMAC1_ID:
++		case MTK_GMAC2_ID:
++			xgmii_id = 1;
++			break;
++		case MTK_GMAC3_ID:
++			xgmii_id = 0;
++			break;
++		default:
++			xgmii_id = -1;
++		}
++	}
++
++	return xgmii_id;
++}
++
++static int mtk_xgmii2mac_id(struct mtk_eth *eth, int xgmii_id)
++{
++	int mac_id = xgmii_id;
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3)) {
++		switch (xgmii_id) {
++		case 0:
++			mac_id = 2;
++			break;
++		case 1:
++			mac_id = 1;
++			break;
++		default:
++			mac_id = -1;
++		}
++	}
++
++	return mac_id;
++}
++
++
++static void mtk_usxgmii_setup_phya_usxgmii(struct mtk_usxgmii_pcs *mpcs)
++{
++	struct regmap *pextp;
++
++	if (!mpcs->eth)
++		return;
++
++	pextp = mpcs->eth->regmap_pextp[mpcs->id];
++	if (!pextp)
++		return;
++
++	/* Setup operation mode */
++	regmap_write(pextp, 0x9024, 0x00C9071C);
++	regmap_write(pextp, 0x2020, 0xAA8585AA);
++	regmap_write(pextp, 0x2030, 0x0C020707);
++	regmap_write(pextp, 0x2034, 0x0E050F0F);
++	regmap_write(pextp, 0x2040, 0x00140032);
++	regmap_write(pextp, 0x50F0, 0x00C014AA);
++	regmap_write(pextp, 0x50E0, 0x3777C12B);
++	regmap_write(pextp, 0x506C, 0x005F9CFF);
++	regmap_write(pextp, 0x5070, 0x9D9DFAFA);
++	regmap_write(pextp, 0x5074, 0x27273F3F);
++	regmap_write(pextp, 0x5078, 0xA7883C68);
++	regmap_write(pextp, 0x507C, 0x11661166);
++	regmap_write(pextp, 0x5080, 0x0E000AAF);
++	regmap_write(pextp, 0x5084, 0x08080D0D);
++	regmap_write(pextp, 0x5088, 0x02030909);
++	regmap_write(pextp, 0x50E4, 0x0C0C0000);
++	regmap_write(pextp, 0x50E8, 0x04040000);
++	regmap_write(pextp, 0x50EC, 0x0F0F0C06);
++	regmap_write(pextp, 0x50A8, 0x506E8C8C);
++	regmap_write(pextp, 0x6004, 0x18190000);
++	regmap_write(pextp, 0x00F8, 0x01423342);
++	/* Force SGDT_OUT off and select PCS */
++	regmap_write(pextp, 0x00F4, 0x80201F20);
++	/* Force GLB_CKDET_OUT */
++	regmap_write(pextp, 0x0030, 0x00050C00);
++	/* Force AEQ on */
++	regmap_write(pextp, 0x0070, 0x02002800);
++	ndelay(1020);
++	/* Setup DA default value */
++	regmap_write(pextp, 0x30B0, 0x00000020);
++	regmap_write(pextp, 0x3028, 0x00008A01);
++	regmap_write(pextp, 0x302C, 0x0000A884);
++	regmap_write(pextp, 0x3024, 0x00083002);
++	regmap_write(pextp, 0x3010, 0x00022220);
++	regmap_write(pextp, 0x5064, 0x0F020A01);
++	regmap_write(pextp, 0x50B4, 0x06100600);
++	regmap_write(pextp, 0x3048, 0x40704000);
++	regmap_write(pextp, 0x3050, 0xA8000000);
++	regmap_write(pextp, 0x3054, 0x000000AA);
++	regmap_write(pextp, 0x306C, 0x00000F00);
++	regmap_write(pextp, 0xA060, 0x00040000);
++	regmap_write(pextp, 0x90D0, 0x00000001);
++	/* Release reset */
++	regmap_write(pextp, 0x0070, 0x0200E800);
++	udelay(150);
++	/* Switch to P0 */
++	regmap_write(pextp, 0x0070, 0x0200C111);
++	ndelay(1020);
++	regmap_write(pextp, 0x0070, 0x0200C101);
++	udelay(15);
++	/* Switch to Gen3 */
++	regmap_write(pextp, 0x0070, 0x0202C111);
++	ndelay(1020);
++	regmap_write(pextp, 0x0070, 0x0202C101);
++	udelay(100);
++	regmap_write(pextp, 0x30B0, 0x00000030);
++	regmap_write(pextp, 0x00F4, 0x80201F00);
++	regmap_write(pextp, 0x3040, 0x30000000);
++	udelay(400);
++}
++
++static void mtk_usxgmii_setup_phya_5gbaser(struct mtk_usxgmii_pcs *mpcs)
++{
++	struct regmap *pextp;
++
++	if (!mpcs->eth)
++		return;
++
++	pextp = mpcs->eth->regmap_pextp[mpcs->id];
++	if (!pextp)
++		return;
++
++	/* Setup operation mode */
++	regmap_write(pextp, 0x9024, 0x00D9071C);
++	regmap_write(pextp, 0x2020, 0xAAA5A5AA);
++	regmap_write(pextp, 0x2030, 0x0C020707);
++	regmap_write(pextp, 0x2034, 0x0E050F0F);
++	regmap_write(pextp, 0x2040, 0x00140032);
++	regmap_write(pextp, 0x50F0, 0x00C018AA);
++	regmap_write(pextp, 0x50E0, 0x3777812B);
++	regmap_write(pextp, 0x506C, 0x005C9CFF);
++	regmap_write(pextp, 0x5070, 0x9DFAFAFA);
++	regmap_write(pextp, 0x5074, 0x273F3F3F);
++	regmap_write(pextp, 0x5078, 0xA8883868);
++	regmap_write(pextp, 0x507C, 0x14661466);
++	regmap_write(pextp, 0x5080, 0x0E001ABF);
++	regmap_write(pextp, 0x5084, 0x080B0D0D);
++	regmap_write(pextp, 0x5088, 0x02050909);
++	regmap_write(pextp, 0x50E4, 0x0C000000);
++	regmap_write(pextp, 0x50E8, 0x04000000);
++	regmap_write(pextp, 0x50EC, 0x0F0F0C06);
++	regmap_write(pextp, 0x50A8, 0x50808C8C);
++	regmap_write(pextp, 0x6004, 0x18000000);
++	regmap_write(pextp, 0x00F8, 0x00A132A1);
++	/* Force SGDT_OUT off and select PCS */
++	regmap_write(pextp, 0x00F4, 0x80201F20);
++	/* Force GLB_CKDET_OUT */
++	regmap_write(pextp, 0x0030, 0x00050C00);
++	/* Force AEQ on */
++	regmap_write(pextp, 0x0070, 0x02002800);
++	ndelay(1020);
++	/* Setup DA default value */
++	regmap_write(pextp, 0x30B0, 0x00000020);
++	regmap_write(pextp, 0x3028, 0x00008A01);
++	regmap_write(pextp, 0x302C, 0x0000A884);
++	regmap_write(pextp, 0x3024, 0x00083002);
++	regmap_write(pextp, 0x3010, 0x00022220);
++	regmap_write(pextp, 0x5064, 0x0F020A01);
++	regmap_write(pextp, 0x50B4, 0x06100600);
++	regmap_write(pextp, 0x3048, 0x40704000);
++	regmap_write(pextp, 0x3050, 0xA8000000);
++	regmap_write(pextp, 0x3054, 0x000000AA);
++	regmap_write(pextp, 0x306C, 0x00000F00);
++	regmap_write(pextp, 0xA060, 0x00040000);
++	regmap_write(pextp, 0x90D0, 0x00000003);
++	/* Release reset */
++	regmap_write(pextp, 0x0070, 0x0200E800);
++	udelay(150);
++	/* Switch to P0 */
++	regmap_write(pextp, 0x0070, 0x0200C111);
++	ndelay(1020);
++	regmap_write(pextp, 0x0070, 0x0200C101);
++	udelay(15);
++	/* Switch to Gen3 */
++	regmap_write(pextp, 0x0070, 0x0202C111);
++	ndelay(1020);
++	regmap_write(pextp, 0x0070, 0x0202C101);
++	udelay(100);
++	regmap_write(pextp, 0x30B0, 0x00000030);
++	regmap_write(pextp, 0x00F4, 0x80201F00);
++	regmap_write(pextp, 0x3040, 0x30000000);
++	udelay(400);
++}
++
++static void mtk_usxgmii_setup_phya_10gbaser(struct mtk_usxgmii_pcs *mpcs)
++{
++	struct regmap *pextp;
++
++	if (!mpcs->eth)
++		return;
++
++	pextp = mpcs->eth->regmap_pextp[mpcs->id];
++	if (!pextp)
++		return;
++
++	/* Setup operation mode */
++	regmap_write(pextp, 0x9024, 0x00C9071C);
++	regmap_write(pextp, 0x2020, 0xAA8585AA);
++	regmap_write(pextp, 0x2030, 0x0C020707);
++	regmap_write(pextp, 0x2034, 0x0E050F0F);
++	regmap_write(pextp, 0x2040, 0x00140032);
++	regmap_write(pextp, 0x50F0, 0x00C014AA);
++	regmap_write(pextp, 0x50E0, 0x3777C12B);
++	regmap_write(pextp, 0x506C, 0x005F9CFF);
++	regmap_write(pextp, 0x5070, 0x9D9DFAFA);
++	regmap_write(pextp, 0x5074, 0x27273F3F);
++	regmap_write(pextp, 0x5078, 0xA7883C68);
++	regmap_write(pextp, 0x507C, 0x11661166);
++	regmap_write(pextp, 0x5080, 0x0E000AAF);
++	regmap_write(pextp, 0x5084, 0x08080D0D);
++	regmap_write(pextp, 0x5088, 0x02030909);
++	regmap_write(pextp, 0x50E4, 0x0C0C0000);
++	regmap_write(pextp, 0x50E8, 0x04040000);
++	regmap_write(pextp, 0x50EC, 0x0F0F0C06);
++	regmap_write(pextp, 0x50A8, 0x506E8C8C);
++	regmap_write(pextp, 0x6004, 0x18190000);
++	regmap_write(pextp, 0x00F8, 0x01423342);
++	/* Force SGDT_OUT off and select PCS */
++	regmap_write(pextp, 0x00F4, 0x80201F20);
++	/* Force GLB_CKDET_OUT */
++	regmap_write(pextp, 0x0030, 0x00050C00);
++	/* Force AEQ on */
++	regmap_write(pextp, 0x0070, 0x02002800);
++	ndelay(1020);
++	/* Setup DA default value */
++	regmap_write(pextp, 0x30B0, 0x00000020);
++	regmap_write(pextp, 0x3028, 0x00008A01);
++	regmap_write(pextp, 0x302C, 0x0000A884);
++	regmap_write(pextp, 0x3024, 0x00083002);
++	regmap_write(pextp, 0x3010, 0x00022220);
++	regmap_write(pextp, 0x5064, 0x0F020A01);
++	regmap_write(pextp, 0x50B4, 0x06100600);
++	regmap_write(pextp, 0x3048, 0x47684100);
++	regmap_write(pextp, 0x3050, 0x00000000);
++	regmap_write(pextp, 0x3054, 0x00000000);
++	regmap_write(pextp, 0x306C, 0x00000F00);
++	if (mpcs->id == 0)
++		regmap_write(pextp, 0xA008, 0x0007B400);
++
++	regmap_write(pextp, 0xA060, 0x00040000);
++	regmap_write(pextp, 0x90D0, 0x00000001);
++	/* Release reset */
++	regmap_write(pextp, 0x0070, 0x0200E800);
++	udelay(150);
++	/* Switch to P0 */
++	regmap_write(pextp, 0x0070, 0x0200C111);
++	ndelay(1020);
++	regmap_write(pextp, 0x0070, 0x0200C101);
++	udelay(15);
++	/* Switch to Gen3 */
++	regmap_write(pextp, 0x0070, 0x0202C111);
++	ndelay(1020);
++	regmap_write(pextp, 0x0070, 0x0202C101);
++	udelay(100);
++	regmap_write(pextp, 0x30B0, 0x00000030);
++	regmap_write(pextp, 0x00F4, 0x80201F00);
++	regmap_write(pextp, 0x3040, 0x30000000);
++	udelay(400);
++}
++
++void mtk_sgmii_setup_phya_gen1(struct mtk_eth *eth, int mac_id)
++{
++	u32 id = mtk_mac2xgmii_id(eth, mac_id);
++	struct regmap *pextp;
++
++	if (id >= eth->soc->num_devs)
++		return;
++
++	pextp = eth->regmap_pextp[id];
++	if (!pextp)
++		return;
++
++	/* Setup operation mode */
++	regmap_write(pextp, 0x9024, 0x00D9071C);
++	regmap_write(pextp, 0x2020, 0xAA8585AA);
++	regmap_write(pextp, 0x2030, 0x0C020207);
++	regmap_write(pextp, 0x2034, 0x0E05050F);
++	regmap_write(pextp, 0x2040, 0x00200032);
++	regmap_write(pextp, 0x50F0, 0x00C014BA);
++	regmap_write(pextp, 0x50E0, 0x3777C12B);
++	regmap_write(pextp, 0x506C, 0x005F9CFF);
++	regmap_write(pextp, 0x5070, 0x9D9DFAFA);
++	regmap_write(pextp, 0x5074, 0x27273F3F);
++	regmap_write(pextp, 0x5078, 0xA7883C68);
++	regmap_write(pextp, 0x507C, 0x11661166);
++	regmap_write(pextp, 0x5080, 0x0E000EAF);
++	regmap_write(pextp, 0x5084, 0x08080E0D);
++	regmap_write(pextp, 0x5088, 0x02030B09);
++	regmap_write(pextp, 0x50E4, 0x0C0C0000);
++	regmap_write(pextp, 0x50E8, 0x04040000);
++	regmap_write(pextp, 0x50EC, 0x0F0F0606);
++	regmap_write(pextp, 0x50A8, 0x506E8C8C);
++	regmap_write(pextp, 0x6004, 0x18190000);
++	regmap_write(pextp, 0x00F8, 0x00FA32FA);
++	/* Force SGDT_OUT off and select PCS */
++	regmap_write(pextp, 0x00F4, 0x80201F21);
++	/* Force GLB_CKDET_OUT */
++	regmap_write(pextp, 0x0030, 0x00050C00);
++	/* Force AEQ on */
++	regmap_write(pextp, 0x0070, 0x02002800);
++	ndelay(1020);
++	/* Setup DA default value */
++	regmap_write(pextp, 0x30B0, 0x00000020);
++	regmap_write(pextp, 0x3028, 0x00008A01);
++	regmap_write(pextp, 0x302C, 0x0000A884);
++	regmap_write(pextp, 0x3024, 0x00083002);
++	regmap_write(pextp, 0x3010, 0x00011110);
++	regmap_write(pextp, 0x3048, 0x40704000);
++	regmap_write(pextp, 0x3064, 0x0000C000);
++	regmap_write(pextp, 0x3050, 0xA8000000);
++	regmap_write(pextp, 0x3054, 0x000000AA);
++	regmap_write(pextp, 0x306C, 0x20200F00);
++	regmap_write(pextp, 0xA060, 0x00050000);
++	regmap_write(pextp, 0x90D0, 0x00000007);
++	/* Release reset */
++	regmap_write(pextp, 0x0070, 0x0200E800);
++	udelay(150);
++	/* Switch to P0 */
++	regmap_write(pextp, 0x0070, 0x0200C111);
++	ndelay(1020);
++	regmap_write(pextp, 0x0070, 0x0200C101);
++	udelay(15);
++	/* Switch to Gen2 */
++	regmap_write(pextp, 0x0070, 0x0201C111);
++	ndelay(1020);
++	regmap_write(pextp, 0x0070, 0x0201C101);
++	udelay(100);
++	regmap_write(pextp, 0x30B0, 0x00000030);
++	regmap_write(pextp, 0x00F4, 0x80201F01);
++	regmap_write(pextp, 0x3040, 0x30000000);
++	udelay(400);
++}
++
++void mtk_sgmii_setup_phya_gen2(struct mtk_eth *eth, int mac_id)
++{
++	u32 id = mtk_mac2xgmii_id(eth, mac_id);
++	struct regmap *pextp;
++
++	if (id >= eth->soc->num_devs)
++		return;
++
++	pextp = eth->regmap_pextp[id];
++	if (!pextp)
++		return;
++
++	/* Setup operation mode */
++	regmap_write(pextp, 0x9024, 0x00D9071C);
++	regmap_write(pextp, 0x2020, 0xAA8585AA);
++	regmap_write(pextp, 0x2030, 0x0C020707);
++	regmap_write(pextp, 0x2034, 0x0E050F0F);
++	regmap_write(pextp, 0x2040, 0x00140032);
++	regmap_write(pextp, 0x50F0, 0x00C014AA);
++	regmap_write(pextp, 0x50E0, 0x3777C12B);
++	regmap_write(pextp, 0x506C, 0x005F9CFF);
++	regmap_write(pextp, 0x5070, 0x9D9DFAFA);
++	regmap_write(pextp, 0x5074, 0x27273F3F);
++	regmap_write(pextp, 0x5078, 0xA7883C68);
++	regmap_write(pextp, 0x507C, 0x11661166);
++	regmap_write(pextp, 0x5080, 0x0E000AAF);
++	regmap_write(pextp, 0x5084, 0x08080D0D);
++	regmap_write(pextp, 0x5088, 0x02030909);
++	regmap_write(pextp, 0x50E4, 0x0C0C0000);
++	regmap_write(pextp, 0x50E8, 0x04040000);
++	regmap_write(pextp, 0x50EC, 0x0F0F0C06);
++	regmap_write(pextp, 0x50A8, 0x506E8C8C);
++	regmap_write(pextp, 0x6004, 0x18190000);
++	regmap_write(pextp, 0x00F8, 0x009C329C);
++	/* Force SGDT_OUT off and select PCS */
++	regmap_write(pextp, 0x00F4, 0x80201F21);
++	/* Force GLB_CKDET_OUT */
++	regmap_write(pextp, 0x0030, 0x00050C00);
++	/* Force AEQ on */
++	regmap_write(pextp, 0x0070, 0x02002800);
++	ndelay(1020);
++	/* Setup DA default value */
++	regmap_write(pextp, 0x30B0, 0x00000020);
++	regmap_write(pextp, 0x3028, 0x00008A01);
++	regmap_write(pextp, 0x302C, 0x0000A884);
++	regmap_write(pextp, 0x3024, 0x00083002);
++	regmap_write(pextp, 0x3010, 0x00011110);
++	regmap_write(pextp, 0x3048, 0x40704000);
++	regmap_write(pextp, 0x3050, 0xA8000000);
++	regmap_write(pextp, 0x3054, 0x000000AA);
++	regmap_write(pextp, 0x306C, 0x22000F00);
++	regmap_write(pextp, 0xA060, 0x00050000);
++	regmap_write(pextp, 0x90D0, 0x00000005);
++	/* Release reset */
++	regmap_write(pextp, 0x0070, 0x0200E800);
++	udelay(150);
++	/* Switch to P0 */
++	regmap_write(pextp, 0x0070, 0x0200C111);
++	ndelay(1020);
++	regmap_write(pextp, 0x0070, 0x0200C101);
++	udelay(15);
++	/* Switch to Gen2 */
++	regmap_write(pextp, 0x0070, 0x0201C111);
++	ndelay(1020);
++	regmap_write(pextp, 0x0070, 0x0201C101);
++	udelay(100);
++	regmap_write(pextp, 0x30B0, 0x00000030);
++	regmap_write(pextp, 0x00F4, 0x80201F01);
++	regmap_write(pextp, 0x3040, 0x30000000);
++	udelay(400);
++}
++
++static void mtk_usxgmii_reset(struct mtk_eth *eth, int id)
++{
++	u32 val = 0;
++
++	if (id >= eth->soc->num_devs || !eth->toprgu)
++		return;
++
++	switch (id) {
++	case 0:
++		/* Enable software reset */
++		regmap_read(eth->toprgu, TOPRGU_SWSYSRST_EN, &val);
++		val |= SWSYSRST_XFI_PEXPT0_GRST |
++		       SWSYSRST_XFI0_GRST;
++		regmap_write(eth->toprgu, TOPRGU_SWSYSRST_EN, val);
++
++		/* Assert USXGMII reset */
++		regmap_read(eth->toprgu, TOPRGU_SWSYSRST, &val);
++		val |= FIELD_PREP(SWSYSRST_UNLOCK_KEY, 0x88) |
++		       SWSYSRST_XFI_PEXPT0_GRST |
++		       SWSYSRST_XFI0_GRST;
++		regmap_write(eth->toprgu, TOPRGU_SWSYSRST, val);
++
++		udelay(100);
++
++		/* De-assert USXGMII reset */
++		regmap_read(eth->toprgu, TOPRGU_SWSYSRST, &val);
++		val |= FIELD_PREP(SWSYSRST_UNLOCK_KEY, 0x88);
++		val &= ~(SWSYSRST_XFI_PEXPT0_GRST |
++			 SWSYSRST_XFI0_GRST);
++		regmap_write(eth->toprgu, TOPRGU_SWSYSRST, val);
++
++		/* Disable software reset */
++		regmap_read(eth->toprgu, TOPRGU_SWSYSRST_EN, &val);
++		val &= ~(SWSYSRST_XFI_PEXPT0_GRST |
++			 SWSYSRST_XFI0_GRST);
++		regmap_write(eth->toprgu, TOPRGU_SWSYSRST_EN, val);
++		break;
++	case 1:
++		/* Enable software reset */
++		regmap_read(eth->toprgu, TOPRGU_SWSYSRST_EN, &val);
++		val |= SWSYSRST_XFI_PEXPT1_GRST |
++		       SWSYSRST_XFI1_GRST;
++		regmap_write(eth->toprgu, TOPRGU_SWSYSRST_EN, val);
++
++		/* Assert USXGMII reset */
++		regmap_read(eth->toprgu, TOPRGU_SWSYSRST, &val);
++		val |= FIELD_PREP(SWSYSRST_UNLOCK_KEY, 0x88) |
++		       SWSYSRST_XFI_PEXPT1_GRST |
++		       SWSYSRST_XFI1_GRST;
++		regmap_write(eth->toprgu, TOPRGU_SWSYSRST, val);
++
++		udelay(100);
++
++		/* De-assert USXGMII reset */
++		regmap_read(eth->toprgu, TOPRGU_SWSYSRST, &val);
++		val |= FIELD_PREP(SWSYSRST_UNLOCK_KEY, 0x88);
++		val &= ~(SWSYSRST_XFI_PEXPT1_GRST |
++			 SWSYSRST_XFI1_GRST);
++		regmap_write(eth->toprgu, TOPRGU_SWSYSRST, val);
++
++		/* Disable software reset */
++		regmap_read(eth->toprgu, TOPRGU_SWSYSRST_EN, &val);
++		val &= ~(SWSYSRST_XFI_PEXPT1_GRST |
++			 SWSYSRST_XFI1_GRST);
++		regmap_write(eth->toprgu, TOPRGU_SWSYSRST_EN, val);
++		break;
++	}
++
++	mdelay(10);
++}
++
++void mtk_sgmii_reset(struct mtk_eth *eth, int mac_id)
++{
++	u32 xgmii_id = mtk_mac2xgmii_id(eth, mac_id);
++
++	mtk_usxgmii_reset(eth, xgmii_id);
++}
++
++
++static int mtk_usxgmii_pcs_config(struct phylink_pcs *pcs, unsigned int mode,
++				  phy_interface_t interface,
++				  const unsigned long *advertising,
++				  bool permit_pause_to_mac)
++{
++	struct mtk_usxgmii_pcs *mpcs = pcs_to_mtk_usxgmii_pcs(pcs);
++	struct mtk_eth *eth = mpcs->eth;
++	unsigned int an_ctrl = 0, link_timer = 0, xfi_mode = 0, adapt_mode = 0;
++	bool mode_changed = false;
++
++	if (interface == PHY_INTERFACE_MODE_USXGMII) {
++		an_ctrl = FIELD_PREP(USXGMII_AN_SYNC_CNT, 0x1FF) |
++			  USXGMII_AN_ENABLE;
++		link_timer = FIELD_PREP(USXGMII_LINK_TIMER_IDLE_DETECT, 0x7B) |
++			     FIELD_PREP(USXGMII_LINK_TIMER_COMP_ACK_DETECT, 0x7B) |
++			     FIELD_PREP(USXGMII_LINK_TIMER_AN_RESTART, 0x7B);
++		xfi_mode = FIELD_PREP(USXGMII_XFI_RX_MODE, USXGMII_XFI_RX_MODE_10G) |
++			   FIELD_PREP(USXGMII_XFI_TX_MODE, USXGMII_XFI_TX_MODE_10G);
++	} else if (interface == PHY_INTERFACE_MODE_10GKR) {
++		an_ctrl = FIELD_PREP(USXGMII_AN_SYNC_CNT, 0x1FF);
++		link_timer = FIELD_PREP(USXGMII_LINK_TIMER_IDLE_DETECT, 0x7B) |
++			     FIELD_PREP(USXGMII_LINK_TIMER_COMP_ACK_DETECT, 0x7B) |
++			     FIELD_PREP(USXGMII_LINK_TIMER_AN_RESTART, 0x7B);
++		xfi_mode = FIELD_PREP(USXGMII_XFI_RX_MODE, USXGMII_XFI_RX_MODE_10G) |
++			   FIELD_PREP(USXGMII_XFI_TX_MODE, USXGMII_XFI_TX_MODE_10G);
++		adapt_mode = USXGMII_RATE_UPDATE_MODE;
++	} else if (interface == PHY_INTERFACE_MODE_5GBASER) {
++		an_ctrl = FIELD_PREP(USXGMII_AN_SYNC_CNT, 0xFF);
++		link_timer = FIELD_PREP(USXGMII_LINK_TIMER_IDLE_DETECT, 0x3D) |
++			     FIELD_PREP(USXGMII_LINK_TIMER_COMP_ACK_DETECT, 0x3D) |
++			     FIELD_PREP(USXGMII_LINK_TIMER_AN_RESTART, 0x3D);
++		xfi_mode = FIELD_PREP(USXGMII_XFI_RX_MODE, USXGMII_XFI_RX_MODE_5G) |
++			   FIELD_PREP(USXGMII_XFI_TX_MODE, USXGMII_XFI_TX_MODE_5G);
++		adapt_mode = USXGMII_RATE_UPDATE_MODE;
++	} else
++		return -EINVAL;
++
++	adapt_mode |= FIELD_PREP(USXGMII_RATE_ADAPT_MODE, USXGMII_RATE_ADAPT_MODE_X1);
++
++	if (mpcs->interface != interface) {
++		mpcs->interface = interface;
++		mode_changed = true;
++	}
++
++	mtk_xfi_pll_enable(eth);
++	mtk_usxgmii_reset(eth, mpcs->id);
++
++	/* Setup USXGMII AN ctrl */
++	regmap_update_bits(mpcs->regmap, RG_PCS_AN_CTRL0,
++			   USXGMII_AN_SYNC_CNT | USXGMII_AN_ENABLE,
++			   an_ctrl);
++
++	regmap_update_bits(mpcs->regmap, RG_PCS_AN_CTRL2,
++			   USXGMII_LINK_TIMER_IDLE_DETECT |
++			   USXGMII_LINK_TIMER_COMP_ACK_DETECT |
++			   USXGMII_LINK_TIMER_AN_RESTART,
++			   link_timer);
++
++	/* Gated MAC CK */
++	regmap_update_bits(mpcs->regmap, RG_PHY_TOP_SPEED_CTRL1,
++			   USXGMII_MAC_CK_GATED, USXGMII_MAC_CK_GATED);
++
++	/* Enable interface force mode */
++	regmap_update_bits(mpcs->regmap, RG_PHY_TOP_SPEED_CTRL1,
++			   USXGMII_IF_FORCE_EN, USXGMII_IF_FORCE_EN);
++
++	/* Setup USXGMII adapt mode */
++	regmap_update_bits(mpcs->regmap, RG_PHY_TOP_SPEED_CTRL1,
++			   USXGMII_RATE_UPDATE_MODE | USXGMII_RATE_ADAPT_MODE,
++			   adapt_mode);
++
++	/* Setup USXGMII speed */
++	regmap_update_bits(mpcs->regmap, RG_PHY_TOP_SPEED_CTRL1,
++			   USXGMII_XFI_RX_MODE | USXGMII_XFI_TX_MODE,
++			   xfi_mode);
++
++	udelay(1);
++
++	/* Un-gated MAC CK */
++	regmap_update_bits(mpcs->regmap, RG_PHY_TOP_SPEED_CTRL1,
++			   USXGMII_MAC_CK_GATED, 0);
++
++	udelay(1);
++
++	/* Disable interface force mode for the AN mode */
++	if (an_ctrl & USXGMII_AN_ENABLE)
++		regmap_update_bits(mpcs->regmap, RG_PHY_TOP_SPEED_CTRL1,
++				   USXGMII_IF_FORCE_EN, 0);
++
++	/* Setup USXGMIISYS with the determined property */
++	if (interface == PHY_INTERFACE_MODE_USXGMII)
++		mtk_usxgmii_setup_phya_usxgmii(mpcs);
++	else if (interface == PHY_INTERFACE_MODE_10GKR)
++		mtk_usxgmii_setup_phya_10gbaser(mpcs);
++	else if (interface == PHY_INTERFACE_MODE_5GBASER)
++		mtk_usxgmii_setup_phya_5gbaser(mpcs);
++
++	return mode_changed;
++}
++
++static void mtk_usxgmii_pcs_get_state(struct phylink_pcs *pcs,
++				    struct phylink_link_state *state)
++{
++	struct mtk_usxgmii_pcs *mpcs = pcs_to_mtk_usxgmii_pcs(pcs);
++	struct mtk_eth *eth = mpcs->eth;
++	struct mtk_mac *mac = eth->mac[mtk_xgmii2mac_id(eth, mpcs->id)];
++	u32 val = 0;
++
++	regmap_read(mpcs->regmap, RG_PCS_AN_CTRL0, &val);
++	if (FIELD_GET(USXGMII_AN_ENABLE, val)) {
++		/* Refresh LPA by inverting LPA_LATCH */
++		regmap_read(mpcs->regmap, RG_PCS_AN_STS0, &val);
++		regmap_update_bits(mpcs->regmap, RG_PCS_AN_STS0,
++				   USXGMII_LPA_LATCH,
++				   !(val & USXGMII_LPA_LATCH));
++
++		regmap_read(mpcs->regmap, RG_PCS_AN_STS0, &val);
++
++		state->interface = mpcs->interface;
++		state->link = FIELD_GET(USXGMII_LPA_LINK, val);
++		state->duplex = FIELD_GET(USXGMII_LPA_DUPLEX, val);
++
++		switch (FIELD_GET(USXGMII_LPA_SPEED_MASK, val)) {
++		case USXGMII_LPA_SPEED_10:
++			state->speed = SPEED_10;
++			break;
++		case USXGMII_LPA_SPEED_100:
++			state->speed = SPEED_100;
++			break;
++		case USXGMII_LPA_SPEED_1000:
++			state->speed = SPEED_1000;
++			break;
++		case USXGMII_LPA_SPEED_2500:
++			state->speed = SPEED_2500;
++			break;
++		case USXGMII_LPA_SPEED_5000:
++			state->speed = SPEED_5000;
++			break;
++		case USXGMII_LPA_SPEED_10000:
++			state->speed = SPEED_10000;
++			break;
++		}
++	} else {
++		val = mtk_r32(mac->hw, MTK_XGMAC_STS(mac->id));
++
++		if (mac->id == MTK_GMAC2_ID)
++			val = val >> 16;
++
++		switch (FIELD_GET(MTK_USXGMII_PCS_MODE, val)) {
++		case 0:
++			state->speed = SPEED_10000;
++			break;
++		case 1:
++			state->speed = SPEED_5000;
++			break;
++		case 2:
++			state->speed = SPEED_2500;
++			break;
++		case 3:
++			state->speed = SPEED_1000;
++			break;
++		}
++
++		state->interface = mpcs->interface;
++		state->link = FIELD_GET(MTK_USXGMII_PCS_LINK, val);
++		state->duplex = DUPLEX_FULL;
++	}
++
++	if (state->link == 0)
++		mtk_usxgmii_pcs_config(pcs, MLO_AN_INBAND,
++				       state->interface, NULL, false);
++}
++
++static void mtk_usxgmii_pcs_restart_an(struct phylink_pcs *pcs)
++{
++	struct mtk_usxgmii_pcs *mpcs = pcs_to_mtk_usxgmii_pcs(pcs);
++	unsigned int val = 0;
++
++	if (!mpcs->regmap)
++		return;
++
++	regmap_read(mpcs->regmap, RG_PCS_AN_CTRL0, &val);
++	val |= USXGMII_AN_RESTART;
++	regmap_write(mpcs->regmap, RG_PCS_AN_CTRL0, val);
++}
++
++static void mtk_usxgmii_pcs_link_up(struct phylink_pcs *pcs, unsigned int mode,
++				    phy_interface_t interface,
++				    int speed, int duplex)
++{
++	/* Reconfiguring USXGMII to ensure the quality of the RX signal
++	 * after the line side link up.
++	 */
++	mtk_usxgmii_pcs_config(pcs, mode,
++			       interface, NULL, false);
++}
++
++static const struct phylink_pcs_ops mtk_usxgmii_pcs_ops = {
++	.pcs_config = mtk_usxgmii_pcs_config,
++	.pcs_get_state = mtk_usxgmii_pcs_get_state,
++	.pcs_an_restart = mtk_usxgmii_pcs_restart_an,
++	.pcs_link_up = mtk_usxgmii_pcs_link_up,
++};
++
++int mtk_usxgmii_init(struct mtk_eth *eth)
++{
++	struct device_node *r = eth->dev->of_node;
++	struct device *dev = eth->dev;
++	struct device_node *np;
++	int i, ret;
++
++	eth->usxgmii_pcs = devm_kcalloc(dev, eth->soc->num_devs, sizeof(eth->usxgmii_pcs), GFP_KERNEL);
++	if (!eth->usxgmii_pcs)
++		return -ENOMEM;
++
++	for (i = 0; i < eth->soc->num_devs; i++) {
++		np = of_parse_phandle(r, "mediatek,usxgmiisys", i);
++		if (!np)
++			break;
++
++		eth->usxgmii_pcs[i] = devm_kzalloc(dev, sizeof(*eth->usxgmii_pcs), GFP_KERNEL);
++		if (!eth->usxgmii_pcs[i])
++			return -ENOMEM;
++
++		eth->usxgmii_pcs[i]->id = i;
++		eth->usxgmii_pcs[i]->eth = eth;
++		eth->usxgmii_pcs[i]->regmap = syscon_node_to_regmap(np);
++		if (IS_ERR(eth->usxgmii_pcs[i]->regmap))
++			return PTR_ERR(eth->usxgmii_pcs[i]->regmap);
++
++		eth->usxgmii_pcs[i]->pcs.ops = &mtk_usxgmii_pcs_ops;
++		eth->usxgmii_pcs[i]->pcs.poll = true;
++		eth->usxgmii_pcs[i]->interface = PHY_INTERFACE_MODE_NA;
++
++		of_node_put(np);
++	}
++
++	ret = mtk_xfi_pextp_init(eth);
++	if (ret)
++		return ret;
++
++	ret = mtk_xfi_pll_init(eth);
++	if (ret)
++		return ret;
++
++	return mtk_toprgu_init(eth);
++}
++
++struct phylink_pcs *mtk_usxgmii_select_pcs(struct mtk_eth *eth, int mac_id)
++{
++	u32 xgmii_id = mtk_mac2xgmii_id(eth, mac_id);
++
++	if (!eth->usxgmii_pcs[xgmii_id]->regmap)
++		return NULL;
++
++	return &eth->usxgmii_pcs[xgmii_id]->pcs;
++}
diff --git a/target/linux/generic/pending-6.1/760-net-core-add-optional-threading-for-backlog-processi.patch b/target/linux/generic/pending-6.1/760-net-core-add-optional-threading-for-backlog-processi.patch
new file mode 100644
index 00000000000000..d4fb672eaa38e1
--- /dev/null
+++ b/target/linux/generic/pending-6.1/760-net-core-add-optional-threading-for-backlog-processi.patch
@@ -0,0 +1,227 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 16 Feb 2023 18:39:04 +0100
+Subject: [PATCH] net/core: add optional threading for backlog processing
+
+When dealing with few flows or an imbalance on CPU utilization, static RPS
+CPU assignment can be too inflexible. Add support for enabling threaded NAPI
+for backlog processing in order to allow the scheduler to better balance
+processing. This helps better spread the load across idle CPUs.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -520,6 +520,7 @@ static inline bool napi_complete(struct
+ }
+ 
+ int dev_set_threaded(struct net_device *dev, bool threaded);
++int backlog_set_threaded(bool threaded);
+ 
+ /**
+  *	napi_disable - prevent NAPI from scheduling
+@@ -3130,6 +3131,7 @@ struct softnet_data {
+ 	unsigned int		processed;
+ 	unsigned int		time_squeeze;
+ 	unsigned int		received_rps;
++	unsigned int		process_queue_empty;
+ #ifdef CONFIG_RPS
+ 	struct softnet_data	*rps_ipi_list;
+ #endif
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4608,7 +4608,7 @@ static int napi_schedule_rps(struct soft
+ 	struct softnet_data *mysd = this_cpu_ptr(&softnet_data);
+ 
+ #ifdef CONFIG_RPS
+-	if (sd != mysd) {
++	if (sd != mysd && !test_bit(NAPI_STATE_THREADED, &sd->backlog.state)) {
+ 		sd->rps_ipi_next = mysd->rps_ipi_list;
+ 		mysd->rps_ipi_list = sd;
+ 
+@@ -5789,6 +5789,8 @@ static DEFINE_PER_CPU(struct work_struct
+ /* Network device is going away, flush any packets still pending */
+ static void flush_backlog(struct work_struct *work)
+ {
++	unsigned int process_queue_empty;
++	bool threaded, flush_processq;
+ 	struct sk_buff *skb, *tmp;
+ 	struct softnet_data *sd;
+ 
+@@ -5803,8 +5805,17 @@ static void flush_backlog(struct work_st
+ 			input_queue_head_incr(sd);
+ 		}
+ 	}
++
++	threaded = test_bit(NAPI_STATE_THREADED, &sd->backlog.state);
++	flush_processq = threaded &&
++			 !skb_queue_empty_lockless(&sd->process_queue);
++	if (flush_processq)
++		process_queue_empty = sd->process_queue_empty;
+ 	rps_unlock_irq_enable(sd);
+ 
++	if (threaded)
++		goto out;
++
+ 	skb_queue_walk_safe(&sd->process_queue, skb, tmp) {
+ 		if (skb->dev->reg_state == NETREG_UNREGISTERING) {
+ 			__skb_unlink(skb, &sd->process_queue);
+@@ -5812,7 +5823,16 @@ static void flush_backlog(struct work_st
+ 			input_queue_head_incr(sd);
+ 		}
+ 	}
++
++out:
+ 	local_bh_enable();
++
++	while (flush_processq) {
++		msleep(1);
++		rps_lock_irq_disable(sd);
++		flush_processq = process_queue_empty == sd->process_queue_empty;
++		rps_unlock_irq_enable(sd);
++	}
+ }
+ 
+ static bool flush_required(int cpu)
+@@ -5944,6 +5964,7 @@ static int process_backlog(struct napi_s
+ 		}
+ 
+ 		rps_lock_irq_disable(sd);
++		sd->process_queue_empty++;
+ 		if (skb_queue_empty(&sd->input_pkt_queue)) {
+ 			/*
+ 			 * Inline a custom version of __napi_complete().
+@@ -5953,7 +5974,8 @@ static int process_backlog(struct napi_s
+ 			 * We can use a plain write instead of clear_bit(),
+ 			 * and we dont need an smp_mb() memory barrier.
+ 			 */
+-			napi->state = 0;
++			napi->state &= ~(NAPIF_STATE_SCHED |
++					 NAPIF_STATE_SCHED_THREADED);
+ 			again = false;
+ 		} else {
+ 			skb_queue_splice_tail_init(&sd->input_pkt_queue,
+@@ -6369,6 +6391,55 @@ int dev_set_threaded(struct net_device *
+ }
+ EXPORT_SYMBOL(dev_set_threaded);
+ 
++int backlog_set_threaded(bool threaded)
++{
++	static bool backlog_threaded;
++	int err = 0;
++	int i;
++
++	if (backlog_threaded == threaded)
++		return 0;
++
++	for_each_possible_cpu(i) {
++		struct softnet_data *sd = &per_cpu(softnet_data, i);
++		struct napi_struct *n = &sd->backlog;
++
++		if (n->thread)
++			continue;
++		n->thread = kthread_run(napi_threaded_poll, n, "napi/backlog-%d", i);
++		if (IS_ERR(n->thread)) {
++			err = PTR_ERR(n->thread);
++			pr_err("kthread_run failed with err %d\n", err);
++			n->thread = NULL;
++			threaded = false;
++			break;
++		}
++
++	}
++
++	backlog_threaded = threaded;
++
++	/* Make sure kthread is created before THREADED bit
++	 * is set.
++	 */
++	smp_mb__before_atomic();
++
++	for_each_possible_cpu(i) {
++		struct softnet_data *sd = &per_cpu(softnet_data, i);
++		struct napi_struct *n = &sd->backlog;
++		unsigned long flags;
++
++		rps_lock_irqsave(sd, &flags);
++		if (threaded)
++			n->state |= NAPIF_STATE_THREADED;
++		else
++			n->state &= ~NAPIF_STATE_THREADED;
++		rps_unlock_irq_restore(sd, &flags);
++	}
++
++	return err;
++}
++
+ void netif_napi_add_weight(struct net_device *dev, struct napi_struct *napi,
+ 			   int (*poll)(struct napi_struct *, int), int weight)
+ {
+@@ -11141,6 +11212,9 @@ static int dev_cpu_dead(unsigned int old
+ 	raise_softirq_irqoff(NET_TX_SOFTIRQ);
+ 	local_irq_enable();
+ 
++	if (test_bit(NAPI_STATE_THREADED, &oldsd->backlog.state))
++		return 0;
++
+ #ifdef CONFIG_RPS
+ 	remsd = oldsd->rps_ipi_list;
+ 	oldsd->rps_ipi_list = NULL;
+@@ -11444,6 +11518,7 @@ static int __init net_dev_init(void)
+ 		INIT_CSD(&sd->defer_csd, trigger_rx_softirq, sd);
+ 		spin_lock_init(&sd->defer_lock);
+ 
++		INIT_LIST_HEAD(&sd->backlog.poll_list);
+ 		init_gro_hash(&sd->backlog);
+ 		sd->backlog.poll = process_backlog;
+ 		sd->backlog.weight = weight_p;
+--- a/net/core/sysctl_net_core.c
++++ b/net/core/sysctl_net_core.c
+@@ -29,6 +29,7 @@ static int int_3600 = 3600;
+ static int min_sndbuf = SOCK_MIN_SNDBUF;
+ static int min_rcvbuf = SOCK_MIN_RCVBUF;
+ static int max_skb_frags = MAX_SKB_FRAGS;
++static int backlog_threaded;
+ 
+ static int net_msg_warn;	/* Unused, but still a sysctl */
+ 
+@@ -112,6 +113,23 @@ static int rps_sock_flow_sysctl(struct c
+ }
+ #endif /* CONFIG_RPS */
+ 
++static int backlog_threaded_sysctl(struct ctl_table *table, int write,
++			       void *buffer, size_t *lenp, loff_t *ppos)
++{
++	static DEFINE_MUTEX(backlog_threaded_mutex);
++	int ret;
++
++	mutex_lock(&backlog_threaded_mutex);
++
++	ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
++	if (write && !ret)
++		ret = backlog_set_threaded(backlog_threaded);
++
++	mutex_unlock(&backlog_threaded_mutex);
++
++	return ret;
++}
++
+ #ifdef CONFIG_NET_FLOW_LIMIT
+ static DEFINE_MUTEX(flow_limit_update_mutex);
+ 
+@@ -473,6 +491,15 @@ static struct ctl_table net_core_table[]
+ 		.proc_handler	= rps_sock_flow_sysctl
+ 	},
+ #endif
++	{
++		.procname	= "backlog_threaded",
++		.data		= &backlog_threaded,
++		.maxlen		= sizeof(unsigned int),
++		.mode		= 0644,
++		.proc_handler	= backlog_threaded_sysctl,
++		.extra1		= SYSCTL_ZERO,
++		.extra2		= SYSCTL_ONE
++	},
+ #ifdef CONFIG_NET_FLOW_LIMIT
+ 	{
+ 		.procname	= "flow_limit_cpu_bitmap",
diff --git a/target/linux/generic/pending-6.1/768-net-dsa-mv88e6xxx-Request-assisted-learning-on-CPU-port.patch b/target/linux/generic/pending-6.1/768-net-dsa-mv88e6xxx-Request-assisted-learning-on-CPU-port.patch
new file mode 100644
index 00000000000000..c2f48627fb3620
--- /dev/null
+++ b/target/linux/generic/pending-6.1/768-net-dsa-mv88e6xxx-Request-assisted-learning-on-CPU-port.patch
@@ -0,0 +1,27 @@
+From:   Tobias Waldekranz <tobias@waldekranz.com>
+Subject: [RFC net-next 7/7] net: dsa: mv88e6xxx: Request assisted learning on CPU port
+Date:   Sat, 16 Jan 2021 02:25:15 +0100
+Archived-At: <https://lore.kernel.org/netdev/20210116012515.3152-8-tobias@waldekranz.com/>
+
+While the hardware is capable of performing learning on the CPU port,
+it requires alot of additions to the bridge's forwarding path in order
+to handle multi-destination traffic correctly.
+
+Until that is in place, opt for the next best thing and let DSA sync
+the relevant addresses down to the hardware FDB.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -6973,6 +6973,7 @@ static int mv88e6xxx_register_switch(str
+ 	ds->ops = &mv88e6xxx_switch_ops;
+ 	ds->ageing_time_min = chip->info->age_time_coeff;
+ 	ds->ageing_time_max = chip->info->age_time_coeff * U8_MAX;
++	ds->assisted_learning_on_cpu_port = true;
+ 
+ 	/* Some chips support up to 32, but that requires enabling the
+ 	 * 5-bit port mode, which we do not support. 640k^W16 ought to
diff --git a/target/linux/generic/pending-6.1/772-net-dsa-b53-add-support-for-BCM63xx-RGMIIs.patch b/target/linux/generic/pending-6.1/772-net-dsa-b53-add-support-for-BCM63xx-RGMIIs.patch
new file mode 100644
index 00000000000000..23859816fa8525
--- /dev/null
+++ b/target/linux/generic/pending-6.1/772-net-dsa-b53-add-support-for-BCM63xx-RGMIIs.patch
@@ -0,0 +1,174 @@
+From patchwork Sun Mar 19 22:08:05 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=
+ <noltari@gmail.com>
+X-Patchwork-Id: 13180645
+X-Patchwork-Delegate: kuba@kernel.org
+Return-Path: <netdev-owner@vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id A7A46C6FD1F
+	for <netdev@archiver.kernel.org>; Sun, 19 Mar 2023 22:08:15 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S230223AbjCSWIN (ORCPT <rfc822;netdev@archiver.kernel.org>);
+        Sun, 19 Mar 2023 18:08:13 -0400
+Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32878 "EHLO
+        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S229565AbjCSWIM (ORCPT
+        <rfc822;netdev@vger.kernel.org>); Sun, 19 Mar 2023 18:08:12 -0400
+Received: from mail-wr1-x42e.google.com (mail-wr1-x42e.google.com
+ [IPv6:2a00:1450:4864:20::42e])
+        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 605D3E062;
+        Sun, 19 Mar 2023 15:08:10 -0700 (PDT)
+Received: by mail-wr1-x42e.google.com with SMTP id h17so8695188wrt.8;
+        Sun, 19 Mar 2023 15:08:10 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20210112; t=1679263689;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:from:to:cc:subject:date
+         :message-id:reply-to;
+        bh=GmPK75Q9ZD3h3IYflWYuDwS99V2e532KgDlnNucAoJg=;
+        b=PSdrywW48P4Lq8z9wOSPXFB/ZdO/JfuyiGlw3Gz1Iriy+Smo/cBnJ0Ve9zKkX3AKTO
+         Tr7/g8xhSQX8sU5WAOEPC13uVjKpO4VZsamXHTmMKL4mmfII3K/piAsQcMQkkNpgouab
+         Ci9yr+7ASSmqEUHIbYTM6sl6a47rPwqk3b3DcTIE2CwJsPPNXnpQ/aSVbJAcEdhcZICc
+         X4rAmjrYjcsl8coFIGHHPlrMH9ShekQWxB84vEb6bO1nXOORNPizOHuY1vJ3wa3WgXsx
+         YwlvutMFVIUXfgL2ZwCmQAKWJPiAaFk+CCk3oxSeOYoAzkjcbMyapz9VnooStfvR2aV3
+         k+2g==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20210112; t=1679263689;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
+         :subject:date:message-id:reply-to;
+        bh=GmPK75Q9ZD3h3IYflWYuDwS99V2e532KgDlnNucAoJg=;
+        b=NGjqrGERyaxRwINtevHaY97h9X9W+1UY62YYwotqwv5+cfvB8myjBbD3WH2WzaqMes
+         o9MMER9RE8/arW3jIVlBv4ORDUuEZ7AeGgy5UbFyQZIPHlp+hJ/sxFrGvYUwamg4Qrr9
+         ojargh8ORsEiMeqaf+5AkmEagNhrrV3ax0pUuWDzbJ3vXGoHjfCetHz5xyNL46dvXBfb
+         l/OZqjv9IYob552uUoUmCy/TbEQDqvmjkFrROFK9gtBNxgxUJkwbyiWIOVsf6RR8OarP
+         f7bbvSJYkvTvzx2u/g0Up7NW5ZyihMGBmDs377M3yW6AnSxW6jlfl30QmMU1aEigYXvy
+         v3mA==
+X-Gm-Message-State: AO0yUKUm1PYmYa4xlHuVD23mZcZm83a+xbhcbs0Xryi3yF/+UnjM4Cho
+        GAfqSh5MZ/rlOAm3Vnpn//9hOG5Lc8vLYg==
+X-Google-Smtp-Source: 
+ AK7set+5pTahGGgk1hF/mHGkGBhsMf0//oQjZd4QFHx+HaeSgP5f6q7g0bRUcTX8kRtgHH0T7l1/hQ==
+X-Received: by 2002:a5d:474f:0:b0:2d6:2ae8:70d with SMTP id
+ o15-20020a5d474f000000b002d62ae8070dmr2382593wrs.39.1679263688549;
+        Sun, 19 Mar 2023 15:08:08 -0700 (PDT)
+Received: from atlantis.lan (255.red-79-146-124.dynamicip.rima-tde.net.
+ [79.146.124.255])
+        by smtp.gmail.com with ESMTPSA id
+ d6-20020a5d6dc6000000b002c53f6c7599sm7354727wrz.29.2023.03.19.15.08.07
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Sun, 19 Mar 2023 15:08:07 -0700 (PDT)
+From: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+To: f.fainelli@gmail.com, jonas.gorski@gmail.com, andrew@lunn.ch,
+        olteanv@gmail.com, davem@davemloft.net, edumazet@google.com,
+        kuba@kernel.org, pabeni@redhat.com, netdev@vger.kernel.org,
+        linux-kernel@vger.kernel.org
+Cc: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+Subject: [PATCH v2] net: dsa: b53: add support for BCM63xx RGMIIs
+Date: Sun, 19 Mar 2023 23:08:05 +0100
+Message-Id: <20230319220805.124024-1-noltari@gmail.com>
+X-Mailer: git-send-email 2.30.2
+In-Reply-To: <20230319183330.761251-1-noltari@gmail.com>
+References: <20230319183330.761251-1-noltari@gmail.com>
+MIME-Version: 1.0
+Precedence: bulk
+List-ID: <netdev.vger.kernel.org>
+X-Mailing-List: netdev@vger.kernel.org
+X-Patchwork-Delegate: kuba@kernel.org
+
+BCM63xx RGMII ports require additional configuration in order to work.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+---
+ v2: add changes suggested by Andrew:
+  - Use a switch statement.
+  - Use dev_dbg() instead of dev_info().
+
+ drivers/net/dsa/b53/b53_common.c | 46 ++++++++++++++++++++++++++++++++
+ drivers/net/dsa/b53/b53_priv.h   |  1 +
+ 2 files changed, 47 insertions(+)
+
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -1209,6 +1209,46 @@ static void b53_force_port_config(struct
+ 	b53_write8(dev, B53_CTRL_PAGE, off, reg);
+ }
+ 
++static void b53_adjust_63xx_rgmii(struct dsa_switch *ds, int port,
++				  phy_interface_t interface)
++{
++	struct b53_device *dev = ds->priv;
++	u8 rgmii_ctrl = 0, off;
++
++	if (port == dev->imp_port)
++		off = B53_RGMII_CTRL_IMP;
++	else
++		off = B53_RGMII_CTRL_P(port);
++
++	b53_read8(dev, B53_CTRL_PAGE, off, &rgmii_ctrl);
++
++	switch (interface) {
++	case PHY_INTERFACE_MODE_RGMII_ID:
++		rgmii_ctrl |= (RGMII_CTRL_DLL_RXC | RGMII_CTRL_DLL_TXC);
++		break;
++	case PHY_INTERFACE_MODE_RGMII_RXID:
++		rgmii_ctrl &= ~(RGMII_CTRL_DLL_TXC);
++		rgmii_ctrl |= RGMII_CTRL_DLL_RXC;
++		break;
++	case PHY_INTERFACE_MODE_RGMII_TXID:
++		rgmii_ctrl &= ~(RGMII_CTRL_DLL_RXC);
++		rgmii_ctrl |= RGMII_CTRL_DLL_TXC;
++		break;
++	case PHY_INTERFACE_MODE_RGMII:
++	default:
++		rgmii_ctrl &= ~(RGMII_CTRL_DLL_RXC | RGMII_CTRL_DLL_TXC);
++		break;
++	}
++
++	if (port != dev->imp_port)
++		rgmii_ctrl |= RGMII_CTRL_ENABLE_GMII;
++
++	b53_write8(dev, B53_CTRL_PAGE, off, rgmii_ctrl);
++
++	dev_dbg(ds->dev, "Configured port %d for %s\n", port,
++		phy_modes(interface));
++}
++
+ static void b53_adjust_link(struct dsa_switch *ds, int port,
+ 			    struct phy_device *phydev)
+ {
+@@ -1235,6 +1275,9 @@ static void b53_adjust_link(struct dsa_s
+ 			      tx_pause, rx_pause);
+ 	b53_force_link(dev, port, phydev->link);
+ 
++	if (is63xx(dev) && port >= B53_63XX_RGMII0)
++		b53_adjust_63xx_rgmii(ds, port, phydev->interface);
++
+ 	if (is531x5(dev) && phy_interface_is_rgmii(phydev)) {
+ 		if (port == dev->imp_port)
+ 			off = B53_RGMII_CTRL_IMP;
+@@ -1402,6 +1445,9 @@ void b53_phylink_mac_link_up(struct dsa_
+ {
+ 	struct b53_device *dev = ds->priv;
+ 
++	if (is63xx(dev) && port >= B53_63XX_RGMII0)
++		b53_adjust_63xx_rgmii(ds, port, interface);
++
+ 	if (mode == MLO_AN_PHY)
+ 		return;
+ 
+--- a/drivers/net/dsa/b53/b53_priv.h
++++ b/drivers/net/dsa/b53/b53_priv.h
+@@ -211,6 +211,7 @@ static inline int is58xx(struct b53_devi
+ 		dev->chip_id == BCM7278_DEVICE_ID;
+ }
+ 
++#define B53_63XX_RGMII0	4
+ #define B53_CPU_PORT_25	5
+ #define B53_CPU_PORT	8
+ 
diff --git a/target/linux/generic/pending-6.1/773-net-dsa-b53-mmap-add-more-63xx-SoCs.patch b/target/linux/generic/pending-6.1/773-net-dsa-b53-mmap-add-more-63xx-SoCs.patch
new file mode 100644
index 00000000000000..8ab701ef563a7a
--- /dev/null
+++ b/target/linux/generic/pending-6.1/773-net-dsa-b53-mmap-add-more-63xx-SoCs.patch
@@ -0,0 +1,108 @@
+From patchwork Tue Mar 21 17:33:57 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=
+ <noltari@gmail.com>
+X-Patchwork-Id: 13183003
+X-Patchwork-Delegate: kuba@kernel.org
+Return-Path: <netdev-owner@vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id 823A1C761AF
+	for <netdev@archiver.kernel.org>; Tue, 21 Mar 2023 17:35:06 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S230490AbjCURfE (ORCPT <rfc822;netdev@archiver.kernel.org>);
+        Tue, 21 Mar 2023 13:35:04 -0400
+Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47440 "EHLO
+        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S230357AbjCURex (ORCPT
+        <rfc822;netdev@vger.kernel.org>); Tue, 21 Mar 2023 13:34:53 -0400
+Received: from mail-wr1-x430.google.com (mail-wr1-x430.google.com
+ [IPv6:2a00:1450:4864:20::430])
+        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C9A45559D8;
+        Tue, 21 Mar 2023 10:34:26 -0700 (PDT)
+Received: by mail-wr1-x430.google.com with SMTP id m2so14547588wrh.6;
+        Tue, 21 Mar 2023 10:34:26 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20210112; t=1679420063;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:from:to:cc:subject:date
+         :message-id:reply-to;
+        bh=cUvnluVaZPzfEQB9fMRuYo+4/361t/7po7nyUBBJfxc=;
+        b=F0pa8JmQZ1FeXVtdpCygur8UmLrgKwxCcjaMn312u5zNvsXsEPeCAIDqP2tvNNTwv/
+         UYjaNaoZ77HSvv/gSqeG808AXGyNs1PvLuHZYuUTJRNuLaMixKtkNFi4ypheCdk0WCiE
+         IWz0DIm6ojmdwMqafDUKQ6Qwkv5R0vo8Wh5vpjimEmCelOyMvfuLZNqubsiGqpnCguBp
+         uWlmKh95/VubCGgiGG2xK1IXQayL14ENuWseDds7nVpVK50NycrFgJbL17Bd6qJKYkbo
+         m70IC+9jM0hjwKXpyi6ipCBNcW+1E6JIwILVC04Xi+BTpOGhbUAQ59Yn2hyq7tQM7dzs
+         4PLg==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20210112; t=1679420063;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
+         :subject:date:message-id:reply-to;
+        bh=cUvnluVaZPzfEQB9fMRuYo+4/361t/7po7nyUBBJfxc=;
+        b=SCX78yTuGjdnE5nuL0p7+kxGnOzsCExsigLdaV+x/JswmwxSpZvxn223i1yM95klj9
+         Rk0RnXqATLF1wZA7L1YmbeZ66zxUwW/osnCjJHPeEF8AGgjK/qawtLl/HJQHN67NaRNQ
+         bDsRn2nWQ2GRTRFpvD+iGRy4uyQCDu9HFxLbn43fBsBmRnXWGPQP5cEb90tL83/Onp4D
+         Lx/XcyZOh9QRfJNhj+G1BAeRCLRA/sdA0W3Ecu5SCFs+LtS6uvLVGWDKEDfnZhYY8Xqf
+         Mx9evWzdW2OorEN2FI6+xTglvnEBcVhHIJ7XEGAhCG6ocgMZeck++774S8RWumWl8xpy
+         /K9Q==
+X-Gm-Message-State: AO0yUKUORAlGfbkNwnYmQnTWcGPqW6sp4g9WfgQmRZGCV+9tCB0OebSP
+        ICq6v4YPmUPNRl/WNnVCbps=
+X-Google-Smtp-Source: 
+ AK7set8pFDl8fHRwGPhAguqxIfqnQ4PY+b57IHEsybIaQ/HPNwdJ1cs1+IPBGHe3TL14dTS4aVNpHA==
+X-Received: by 2002:a5d:6991:0:b0:2ce:aab5:f96b with SMTP id
+ g17-20020a5d6991000000b002ceaab5f96bmr2965175wru.67.1679420062764;
+        Tue, 21 Mar 2023 10:34:22 -0700 (PDT)
+Received: from atlantis.lan (255.red-79-146-124.dynamicip.rima-tde.net.
+ [79.146.124.255])
+        by smtp.gmail.com with ESMTPSA id
+ b13-20020a056000054d00b002da1261aa44sm184775wrf.48.2023.03.21.10.34.21
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Tue, 21 Mar 2023 10:34:21 -0700 (PDT)
+From: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+To: f.fainelli@gmail.com, jonas.gorski@gmail.com, andrew@lunn.ch,
+        olteanv@gmail.com, davem@davemloft.net, edumazet@google.com,
+        kuba@kernel.org, pabeni@redhat.com, robh+dt@kernel.org,
+        krzysztof.kozlowski+dt@linaro.org, netdev@vger.kernel.org,
+        devicetree@vger.kernel.org, linux-kernel@vger.kernel.org
+Cc: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+Subject: [PATCH v2 2/4] net: dsa: b53: mmap: add more 63xx SoCs
+Date: Tue, 21 Mar 2023 18:33:57 +0100
+Message-Id: <20230321173359.251778-3-noltari@gmail.com>
+X-Mailer: git-send-email 2.30.2
+In-Reply-To: <20230321173359.251778-1-noltari@gmail.com>
+References: <20230320155024.164523-1-noltari@gmail.com>
+ <20230321173359.251778-1-noltari@gmail.com>
+MIME-Version: 1.0
+Precedence: bulk
+List-ID: <netdev.vger.kernel.org>
+X-Mailing-List: netdev@vger.kernel.org
+X-Patchwork-Delegate: kuba@kernel.org
+
+BCM6318, BCM6362 and BCM63268 are SoCs with a B53 MMAP switch.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ v2: no changes.
+
+ drivers/net/dsa/b53/b53_mmap.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/dsa/b53/b53_mmap.c
++++ b/drivers/net/dsa/b53/b53_mmap.c
+@@ -345,8 +345,11 @@ static void b53_mmap_shutdown(struct pla
+ 
+ static const struct of_device_id b53_mmap_of_table[] = {
+ 	{ .compatible = "brcm,bcm3384-switch" },
++	{ .compatible = "brcm,bcm6318-switch" },
+ 	{ .compatible = "brcm,bcm6328-switch" },
++	{ .compatible = "brcm,bcm6362-switch" },
+ 	{ .compatible = "brcm,bcm6368-switch" },
++	{ .compatible = "brcm,bcm63268-switch" },
+ 	{ .compatible = "brcm,bcm63xx-switch" },
+ 	{ /* sentinel */ },
+ };
diff --git a/target/linux/generic/pending-6.1/774-net-dsa-b53-mmap-allow-passing-a-chip-ID.patch b/target/linux/generic/pending-6.1/774-net-dsa-b53-mmap-allow-passing-a-chip-ID.patch
new file mode 100644
index 00000000000000..de237374af96b3
--- /dev/null
+++ b/target/linux/generic/pending-6.1/774-net-dsa-b53-mmap-allow-passing-a-chip-ID.patch
@@ -0,0 +1,195 @@
+From patchwork Tue Mar 21 17:33:58 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=
+ <noltari@gmail.com>
+X-Patchwork-Id: 13183004
+X-Patchwork-Delegate: kuba@kernel.org
+Return-Path: <netdev-owner@vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id B2B12C74A5B
+	for <netdev@archiver.kernel.org>; Tue, 21 Mar 2023 17:35:12 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S230297AbjCURfK (ORCPT <rfc822;netdev@archiver.kernel.org>);
+        Tue, 21 Mar 2023 13:35:10 -0400
+Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47438 "EHLO
+        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S230374AbjCURex (ORCPT
+        <rfc822;netdev@vger.kernel.org>); Tue, 21 Mar 2023 13:34:53 -0400
+Received: from mail-wr1-x432.google.com (mail-wr1-x432.google.com
+ [IPv6:2a00:1450:4864:20::432])
+        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C906B5550A;
+        Tue, 21 Mar 2023 10:34:26 -0700 (PDT)
+Received: by mail-wr1-x432.google.com with SMTP id y14so14546846wrq.4;
+        Tue, 21 Mar 2023 10:34:26 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20210112; t=1679420064;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:from:to:cc:subject:date
+         :message-id:reply-to;
+        bh=vnvnwWc5Tmg09HBQo/m9RbRM6yM8KLx8r1VA+Abfg3k=;
+        b=eFv+mwe94Y2YZMiJP5gydXVrGlbIAR5HCrY0rdcoGoMPzQUHLFckZeYCgEKudI55I7
+         gMLZYCtLwvDXvKeHM2AUigsq2YuJSeF5QwICPrhTnMwUGBg4yyyltrc3+J0lSd6/4kQv
+         h0yM1Oo4v0d8CuqjBU6bXienIk34AFVJfsPq+vWQTjAbUL7ht4WHZ2Ez2MFoTvZpkIJA
+         5iWMyVoMbugZl6eqNRjvDHFmtBtrZIv8AFs10r2Ca6+Yxm+aq0v33DRkbSVVqgFPNEzy
+         q5QOXOeLBPL6BvyovOpmVSWGoHf1zFV7lrzcqi+uc+FuYxQ9dyN3ND73DrrhWSkLaSg9
+         r8yA==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20210112; t=1679420064;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
+         :subject:date:message-id:reply-to;
+        bh=vnvnwWc5Tmg09HBQo/m9RbRM6yM8KLx8r1VA+Abfg3k=;
+        b=jIRB8pIlrLA/ovhnEoePs/6SX8fn6l7l4fY2CxX2pLrTbP1JI8AAetPavvrNVQTr2M
+         Vm0iLbKyL/VpTq9+bSN1SMjaoi4lAMj0pgafoHrwABMVZpFauYvtCfSYTstZ2pw4Dr1j
+         wYQGj3BUSpFIYHtSIDMkb5449WA3T3TONhaQLRFAUCBD6gAFyEky5fY+DIHrGaj352B6
+         9ST/tkqHgPpuFlmromr42KQWoTFU+Pj0Uhyp7ru4BsnF7tTshWroZZIHUJmSACudEadr
+         fBPiuurX9jgp9zNqj8Oy0HjiVUnULFCapj8yICGp5s44uDAK/XFqFXpOuJ8ptS6uPazU
+         xUwg==
+X-Gm-Message-State: AO0yUKX2w6QZfaGDHtlZAlY/U8F8VuJa3HwlgXbxgGChgdgvIoFThawv
+        oDyFAhWbVfe4DxwXTwxgJ/I=
+X-Google-Smtp-Source: 
+ AK7set+sH60XiJYup7bqrZTzFJVNe1YGcX/UTfjWV9xfGwNyodc34cHvKpqNagw5J+vEpv6CKvNHaA==
+X-Received: by 2002:adf:f344:0:b0:2cd:de25:1c76 with SMTP id
+ e4-20020adff344000000b002cdde251c76mr12989754wrp.17.1679420064464;
+        Tue, 21 Mar 2023 10:34:24 -0700 (PDT)
+Received: from atlantis.lan (255.red-79-146-124.dynamicip.rima-tde.net.
+ [79.146.124.255])
+        by smtp.gmail.com with ESMTPSA id
+ b13-20020a056000054d00b002da1261aa44sm184775wrf.48.2023.03.21.10.34.22
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Tue, 21 Mar 2023 10:34:23 -0700 (PDT)
+From: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+To: f.fainelli@gmail.com, jonas.gorski@gmail.com, andrew@lunn.ch,
+        olteanv@gmail.com, davem@davemloft.net, edumazet@google.com,
+        kuba@kernel.org, pabeni@redhat.com, robh+dt@kernel.org,
+        krzysztof.kozlowski+dt@linaro.org, netdev@vger.kernel.org,
+        devicetree@vger.kernel.org, linux-kernel@vger.kernel.org
+Cc: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+Subject: [PATCH v2 3/4] net: dsa: b53: mmap: allow passing a chip ID
+Date: Tue, 21 Mar 2023 18:33:58 +0100
+Message-Id: <20230321173359.251778-4-noltari@gmail.com>
+X-Mailer: git-send-email 2.30.2
+In-Reply-To: <20230321173359.251778-1-noltari@gmail.com>
+References: <20230320155024.164523-1-noltari@gmail.com>
+ <20230321173359.251778-1-noltari@gmail.com>
+MIME-Version: 1.0
+Precedence: bulk
+List-ID: <netdev.vger.kernel.org>
+X-Mailing-List: netdev@vger.kernel.org
+X-Patchwork-Delegate: kuba@kernel.org
+
+BCM6318 and BCM63268 SoCs require a special handling for their RGMIIs, so we
+should be able to identify them as a special BCM63xx switch.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ v2:
+  - Add missing chip to b53_switch_chips[].
+  - Fix device_get_match_data() casting warning.
+  - Add BCM63268_DEVICE_ID to BCM6318 too.
+  - Add BCM6318 in commit description.
+
+ drivers/net/dsa/b53/b53_common.c | 13 +++++++++++++
+ drivers/net/dsa/b53/b53_mmap.c   | 32 +++++++++++++++++++++++---------
+ drivers/net/dsa/b53/b53_priv.h   |  9 ++++++++-
+ 3 files changed, 44 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -2466,6 +2466,19 @@ static const struct b53_chip_data b53_sw
+ 		.jumbo_size_reg = B53_JUMBO_MAX_SIZE_63XX,
+ 	},
+ 	{
++		.chip_id = BCM63268_DEVICE_ID,
++		.dev_name = "BCM63268",
++		.vlans = 4096,
++		.enabled_ports = 0, /* pdata must provide them */
++		.arl_bins = 4,
++		.arl_buckets = 1024,
++		.imp_port = 8,
++		.vta_regs = B53_VTA_REGS_63XX,
++		.duplex_reg = B53_DUPLEX_STAT_63XX,
++		.jumbo_pm_reg = B53_JUMBO_PORT_MASK_63XX,
++		.jumbo_size_reg = B53_JUMBO_MAX_SIZE_63XX,
++	},
++	{
+ 		.chip_id = BCM53010_DEVICE_ID,
+ 		.dev_name = "BCM53010",
+ 		.vlans = 4096,
+--- a/drivers/net/dsa/b53/b53_mmap.c
++++ b/drivers/net/dsa/b53/b53_mmap.c
+@@ -262,7 +262,7 @@ static int b53_mmap_probe_of(struct plat
+ 		return -ENOMEM;
+ 
+ 	pdata->regs = mem;
+-	pdata->chip_id = BCM63XX_DEVICE_ID;
++	pdata->chip_id = (u32)(unsigned long)device_get_match_data(dev);
+ 	pdata->big_endian = of_property_read_bool(np, "big-endian");
+ 
+ 	of_ports = of_get_child_by_name(np, "ports");
+@@ -344,14 +344,28 @@ static void b53_mmap_shutdown(struct pla
+ }
+ 
+ static const struct of_device_id b53_mmap_of_table[] = {
+-	{ .compatible = "brcm,bcm3384-switch" },
+-	{ .compatible = "brcm,bcm6318-switch" },
+-	{ .compatible = "brcm,bcm6328-switch" },
+-	{ .compatible = "brcm,bcm6362-switch" },
+-	{ .compatible = "brcm,bcm6368-switch" },
+-	{ .compatible = "brcm,bcm63268-switch" },
+-	{ .compatible = "brcm,bcm63xx-switch" },
+-	{ /* sentinel */ },
++	{
++		.compatible = "brcm,bcm3384-switch",
++		.data = (void *)BCM63XX_DEVICE_ID,
++	}, {
++		.compatible = "brcm,bcm6318-switch",
++		.data = (void *)BCM63268_DEVICE_ID,
++	}, {
++		.compatible = "brcm,bcm6328-switch",
++		.data = (void *)BCM63XX_DEVICE_ID,
++	}, {
++		.compatible = "brcm,bcm6362-switch",
++		.data = (void *)BCM63XX_DEVICE_ID,
++	}, {
++		.compatible = "brcm,bcm6368-switch",
++		.data = (void *)BCM63XX_DEVICE_ID,
++	}, {
++		.compatible = "brcm,bcm63268-switch",
++		.data = (void *)BCM63268_DEVICE_ID,
++	}, {
++		.compatible = "brcm,bcm63xx-switch",
++		.data = (void *)BCM63XX_DEVICE_ID,
++	}, { /* sentinel */ }
+ };
+ MODULE_DEVICE_TABLE(of, b53_mmap_of_table);
+ 
+--- a/drivers/net/dsa/b53/b53_priv.h
++++ b/drivers/net/dsa/b53/b53_priv.h
+@@ -70,6 +70,7 @@ enum {
+ 	BCM53125_DEVICE_ID = 0x53125,
+ 	BCM53128_DEVICE_ID = 0x53128,
+ 	BCM63XX_DEVICE_ID = 0x6300,
++	BCM63268_DEVICE_ID = 0x63268,
+ 	BCM53010_DEVICE_ID = 0x53010,
+ 	BCM53011_DEVICE_ID = 0x53011,
+ 	BCM53012_DEVICE_ID = 0x53012,
+@@ -191,7 +192,13 @@ static inline int is531x5(struct b53_dev
+ 
+ static inline int is63xx(struct b53_device *dev)
+ {
+-	return dev->chip_id == BCM63XX_DEVICE_ID;
++	return dev->chip_id == BCM63XX_DEVICE_ID ||
++		dev->chip_id == BCM63268_DEVICE_ID;
++}
++
++static inline int is63268(struct b53_device *dev)
++{
++	return dev->chip_id == BCM63268_DEVICE_ID;
+ }
+ 
+ static inline int is5301x(struct b53_device *dev)
diff --git a/target/linux/generic/pending-6.1/775-net-dsa-b53-add-BCM63268-RGMII-configuration.patch b/target/linux/generic/pending-6.1/775-net-dsa-b53-add-BCM63268-RGMII-configuration.patch
new file mode 100644
index 00000000000000..d90d757fb2c2ae
--- /dev/null
+++ b/target/linux/generic/pending-6.1/775-net-dsa-b53-add-BCM63268-RGMII-configuration.patch
@@ -0,0 +1,123 @@
+From patchwork Tue Mar 21 17:33:59 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=
+ <noltari@gmail.com>
+X-Patchwork-Id: 13183005
+X-Patchwork-Delegate: kuba@kernel.org
+Return-Path: <netdev-owner@vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id 31BE4C761A6
+	for <netdev@archiver.kernel.org>; Tue, 21 Mar 2023 17:35:16 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S229674AbjCURfN (ORCPT <rfc822;netdev@archiver.kernel.org>);
+        Tue, 21 Mar 2023 13:35:13 -0400
+Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47684 "EHLO
+        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S230327AbjCURfB (ORCPT
+        <rfc822;netdev@vger.kernel.org>); Tue, 21 Mar 2023 13:35:01 -0400
+Received: from mail-wr1-x436.google.com (mail-wr1-x436.google.com
+ [IPv6:2a00:1450:4864:20::436])
+        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E1D855507D;
+        Tue, 21 Mar 2023 10:34:27 -0700 (PDT)
+Received: by mail-wr1-x436.google.com with SMTP id i9so14537769wrp.3;
+        Tue, 21 Mar 2023 10:34:27 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20210112; t=1679420066;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:from:to:cc:subject:date
+         :message-id:reply-to;
+        bh=asmFs22xWYwR1Ql9m/IrNv+MPUNDn8hSjmwDRYvO7mE=;
+        b=Cqj2C6aG5vEOlhh9N3ybvDA0CV38nhQODnfdnr7utNddd323iDagoJty1Wmi3MAzj1
+         5ORmYT5fQvUnild7C4RhcCNTBn+MoYZ+wDZwZYelu6BKHkW11YFK949ax5B50by+ASR2
+         z+rGI3wR5fVXd4VDgmcsT6zF5x69wKyhbhqIfrhG9BVFTctfaBgDS/l+bX1C56kSqv82
+         bQkKSSAehSLGpFoCU3q62OGoZVi3jDe6HDb5M1Dp2mgHhqsW19otZpJ57DjtZ1CmtPai
+         o7T/ew6WoIYSl6whBmV36jeNaDJ3TItOBrKc4nMJBDWaCg4DNzUSe0ei5Xz7Oik5lb3p
+         y9ew==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20210112; t=1679420066;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
+         :subject:date:message-id:reply-to;
+        bh=asmFs22xWYwR1Ql9m/IrNv+MPUNDn8hSjmwDRYvO7mE=;
+        b=UdI2iQNBYwRf40ivf3ROR132t95BU/p3RUzXdZLCyz6c6JWtECQ5byyGeEwoX10n5u
+         HlepoNTJxMFLYrAHGvNLDPpWPuLXMa645S1mCVZ7NyWp8W96XzSynNZPeXHuJdb464QU
+         A7UTRSW3mlvKe9OR3EcB2CfBZv0yHWR0ldbnxcxGUFw8z78PNqpOVnITtjBdfpGesJ9c
+         VJw+fiM6hCcahor4nk9LLcAryPm8xmhDLxBKaLILO8wyTUiHY8G9hsXnFCtcpetnF5wS
+         pW13beAE+odb7ZZaXZUYpWGYhCe/hLzNjbo8YpgzHwadZthxPrT5YvNIYwyrvoViLM0n
+         KDRQ==
+X-Gm-Message-State: AO0yUKW+9H/kqcAUyWeZhZJhiJjsBcYn1THmZaSDrPrk/pNuGXJXGtJd
+        NgsGZW8iSqLEv81yK+U5Os8=
+X-Google-Smtp-Source: 
+ AK7set/lzQZwCSxVaOe5dZ+7TR3xaQty/vg5xvZDpRW8TwTiPQblIbw5kJJTPLp67RySehrPIlCqSg==
+X-Received: by 2002:a5d:65c9:0:b0:2ce:ac31:54ff with SMTP id
+ e9-20020a5d65c9000000b002ceac3154ffmr2776515wrw.2.1679420066191;
+        Tue, 21 Mar 2023 10:34:26 -0700 (PDT)
+Received: from atlantis.lan (255.red-79-146-124.dynamicip.rima-tde.net.
+ [79.146.124.255])
+        by smtp.gmail.com with ESMTPSA id
+ b13-20020a056000054d00b002da1261aa44sm184775wrf.48.2023.03.21.10.34.24
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Tue, 21 Mar 2023 10:34:25 -0700 (PDT)
+From: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+To: f.fainelli@gmail.com, jonas.gorski@gmail.com, andrew@lunn.ch,
+        olteanv@gmail.com, davem@davemloft.net, edumazet@google.com,
+        kuba@kernel.org, pabeni@redhat.com, robh+dt@kernel.org,
+        krzysztof.kozlowski+dt@linaro.org, netdev@vger.kernel.org,
+        devicetree@vger.kernel.org, linux-kernel@vger.kernel.org
+Cc: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>,
+ Simon Horman <simon.horman@corigine.com>
+Subject: [PATCH v2 4/4] net: dsa: b53: add BCM63268 RGMII configuration
+Date: Tue, 21 Mar 2023 18:33:59 +0100
+Message-Id: <20230321173359.251778-5-noltari@gmail.com>
+X-Mailer: git-send-email 2.30.2
+In-Reply-To: <20230321173359.251778-1-noltari@gmail.com>
+References: <20230320155024.164523-1-noltari@gmail.com>
+ <20230321173359.251778-1-noltari@gmail.com>
+MIME-Version: 1.0
+Precedence: bulk
+List-ID: <netdev.vger.kernel.org>
+X-Mailing-List: netdev@vger.kernel.org
+X-Patchwork-Delegate: kuba@kernel.org
+
+BCM63268 requires special RGMII configuration to work.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+---
+ v2: no changes.
+
+ drivers/net/dsa/b53/b53_common.c | 6 +++++-
+ drivers/net/dsa/b53/b53_regs.h   | 1 +
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -1240,8 +1240,12 @@ static void b53_adjust_63xx_rgmii(struct
+ 		break;
+ 	}
+ 
+-	if (port != dev->imp_port)
++	if (port != dev->imp_port) {
++		if (is63268(dev))
++			rgmii_ctrl |= RGMII_CTRL_MII_OVERRIDE;
++
+ 		rgmii_ctrl |= RGMII_CTRL_ENABLE_GMII;
++	}
+ 
+ 	b53_write8(dev, B53_CTRL_PAGE, off, rgmii_ctrl);
+ 
+--- a/drivers/net/dsa/b53/b53_regs.h
++++ b/drivers/net/dsa/b53/b53_regs.h
+@@ -138,6 +138,7 @@
+ 
+ #define B53_RGMII_CTRL_IMP		0x60
+ #define   RGMII_CTRL_ENABLE_GMII	BIT(7)
++#define   RGMII_CTRL_MII_OVERRIDE	BIT(6)
+ #define   RGMII_CTRL_TIMING_SEL		BIT(2)
+ #define   RGMII_CTRL_DLL_RXC		BIT(1)
+ #define   RGMII_CTRL_DLL_TXC		BIT(0)
diff --git a/target/linux/generic/pending-6.1/777-net-dsa-b53-mdio-add-support-for-BCM53134.patch b/target/linux/generic/pending-6.1/777-net-dsa-b53-mdio-add-support-for-BCM53134.patch
new file mode 100644
index 00000000000000..f0ae2defcecda0
--- /dev/null
+++ b/target/linux/generic/pending-6.1/777-net-dsa-b53-mdio-add-support-for-BCM53134.patch
@@ -0,0 +1,189 @@
+From patchwork Fri Mar 24 08:41:38 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=
+ <noltari@gmail.com>
+X-Patchwork-Id: 13186549
+X-Patchwork-Delegate: kuba@kernel.org
+Return-Path: <netdev-owner@vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id EF744C76195
+	for <netdev@archiver.kernel.org>; Fri, 24 Mar 2023 08:42:01 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S231807AbjCXImA (ORCPT <rfc822;netdev@archiver.kernel.org>);
+        Fri, 24 Mar 2023 04:42:00 -0400
+Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32956 "EHLO
+        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S231272AbjCXIly (ORCPT
+        <rfc822;netdev@vger.kernel.org>); Fri, 24 Mar 2023 04:41:54 -0400
+Received: from mail-ed1-x535.google.com (mail-ed1-x535.google.com
+ [IPv6:2a00:1450:4864:20::535])
+        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 113A517CF3;
+        Fri, 24 Mar 2023 01:41:46 -0700 (PDT)
+Received: by mail-ed1-x535.google.com with SMTP id ek18so4877175edb.6;
+        Fri, 24 Mar 2023 01:41:45 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20210112; t=1679647304;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:from:to:cc:subject:date
+         :message-id:reply-to;
+        bh=OfUWRaFIQIQw/lRivER+LHryfdLliXzvabGrcmkQVEU=;
+        b=JMrl6Eay1FS0JZqgPHsbcVzuNAbFELc0SLNGyzYtOVQXcI+YwKDM9Ls7I9PsQVEPoZ
+         CthomCTYoz5G9DU7uBuia207rnjOhssZJRu0syrCoU+O/ZiQyGLJDvq61z5oZJxC2S40
+         kzRsUsC6MRjn64DKPWmxhsSTMKLzn2+P233LKNFbHtfi3NWF5Qu/85sUkxMurnfUgja0
+         qQhl25qYY7ZIvmlFHYefaI5UkITQFuiybrqJW9tztCdHf/gS+f33YkkvQ8njmMQa1DW0
+         ppedfOUotX+6kmHZGX1yea2V5ezEGGvRourZtYMoecTiD0E5d1J1bKhktKslVLIDm0ig
+         oc2g==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20210112; t=1679647304;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
+         :subject:date:message-id:reply-to;
+        bh=OfUWRaFIQIQw/lRivER+LHryfdLliXzvabGrcmkQVEU=;
+        b=b3Gmga5ZDbnmQfnw1GCz+eU2JwgsVzfciZuSmfYAiVxpW4c6cur3MHbpzDPhi99wzA
+         ZYAM7ryLv88rXl/tQB5g2Nte5rvMfxUeHXsT/JpsRcSSocFRbRrk0QJyiA/Xj86NiD5N
+         C1sKz50Im190FmrvPcBh6OHQbv/3MQyE+1fQx+9q3jW5rQiAWQaYk4Ng8GlWA7gtG3jB
+         fHO6Fuoenn32pgkveJbQLYL/2t2f53wGf3QLQ3IeKW7jdfIHNThwrwqBMxdHoIDaTBT9
+         UWMeJuiYtylIibo/3zbORbWOgIERlWxZRf3BCOFpnzUn4eBzio4LgjtNxZ77ITRxsmbk
+         3+Hg==
+X-Gm-Message-State: AAQBX9dfyBfbR7Sdd5wqxMiAv3Yhk47pK1XzD87MZyAF3AxyoFyKcMaF
+        EbwJLyRvTGQEFdVWCGw1eMU=
+X-Google-Smtp-Source: 
+ AKy350bpDVLq7k1FxG2Mek/VIobZL4KhufiKx8qfmpxpcWmLI3bLg8wfQKEAKJRNJBleo/7CZuCL5g==
+X-Received: by 2002:aa7:c711:0:b0:4a2:588f:b3c5 with SMTP id
+ i17-20020aa7c711000000b004a2588fb3c5mr2261236edq.21.1679647304260;
+        Fri, 24 Mar 2023 01:41:44 -0700 (PDT)
+Received: from atlantis.lan (255.red-79-146-124.dynamicip.rima-tde.net.
+ [79.146.124.255])
+        by smtp.gmail.com with ESMTPSA id
+ z21-20020a50cd15000000b004acbda55f6bsm10323728edi.27.2023.03.24.01.41.43
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Fri, 24 Mar 2023 01:41:43 -0700 (PDT)
+From: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+To: paul.geurts@prodrive-technologies.com, f.fainelli@gmail.com,
+        jonas.gorski@gmail.com, andrew@lunn.ch, olteanv@gmail.com,
+        davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
+        pabeni@redhat.com, robh+dt@kernel.org,
+        krzysztof.kozlowski+dt@linaro.org, netdev@vger.kernel.org,
+        devicetree@vger.kernel.org, linux-kernel@vger.kernel.org
+Cc: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+Subject: [PATCH v2 2/2] net: dsa: b53: mdio: add support for BCM53134
+Date: Fri, 24 Mar 2023 09:41:38 +0100
+Message-Id: <20230324084138.664285-3-noltari@gmail.com>
+X-Mailer: git-send-email 2.30.2
+In-Reply-To: <20230324084138.664285-1-noltari@gmail.com>
+References: <20230323121804.2249605-1-noltari@gmail.com>
+ <20230324084138.664285-1-noltari@gmail.com>
+MIME-Version: 1.0
+Precedence: bulk
+List-ID: <netdev.vger.kernel.org>
+X-Mailing-List: netdev@vger.kernel.org
+X-Patchwork-Delegate: kuba@kernel.org
+
+From: Paul Geurts <paul.geurts@prodrive-technologies.com>
+
+Add support for the BCM53134 Ethernet switch in the existing b53 dsa driver.
+BCM53134 is very similar to the BCM58XX series.
+
+Signed-off-by: Paul Geurts <paul.geurts@prodrive-technologies.com>
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ v2: add BCM53134 to is531x5() and remove special RGMII config
+
+ drivers/net/dsa/b53/b53_common.c | 15 +++++++++++++++
+ drivers/net/dsa/b53/b53_mdio.c   |  5 ++++-
+ drivers/net/dsa/b53/b53_priv.h   |  7 +++++--
+ 3 files changed, 24 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -2613,6 +2613,20 @@ static const struct b53_chip_data b53_sw
+ 		.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
+ 		.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+ 	},
++	{
++		.chip_id = BCM53134_DEVICE_ID,
++		.dev_name = "BCM53134",
++		.vlans = 4096,
++		.enabled_ports = 0x12f,
++		.imp_port = 8,
++		.cpu_port = B53_CPU_PORT,
++		.vta_regs = B53_VTA_REGS,
++		.arl_bins = 4,
++		.arl_buckets = 1024,
++		.duplex_reg = B53_DUPLEX_STAT_GE,
++		.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
++		.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
++	},
+ };
+ 
+ static int b53_switch_init(struct b53_device *dev)
+@@ -2790,6 +2804,7 @@ int b53_switch_detect(struct b53_device
+ 		case BCM53012_DEVICE_ID:
+ 		case BCM53018_DEVICE_ID:
+ 		case BCM53019_DEVICE_ID:
++		case BCM53134_DEVICE_ID:
+ 			dev->chip_id = id32;
+ 			break;
+ 		default:
+--- a/drivers/net/dsa/b53/b53_mdio.c
++++ b/drivers/net/dsa/b53/b53_mdio.c
+@@ -286,6 +286,7 @@ static const struct b53_io_ops b53_mdio_
+ #define B53_BRCM_OUI_2	0x03625c00
+ #define B53_BRCM_OUI_3	0x00406000
+ #define B53_BRCM_OUI_4	0x01410c00
++#define B53_BRCM_OUI_5	0xae025000
+ 
+ static int b53_mdio_probe(struct mdio_device *mdiodev)
+ {
+@@ -313,7 +314,8 @@ static int b53_mdio_probe(struct mdio_de
+ 	if ((phy_id & 0xfffffc00) != B53_BRCM_OUI_1 &&
+ 	    (phy_id & 0xfffffc00) != B53_BRCM_OUI_2 &&
+ 	    (phy_id & 0xfffffc00) != B53_BRCM_OUI_3 &&
+-	    (phy_id & 0xfffffc00) != B53_BRCM_OUI_4) {
++	    (phy_id & 0xfffffc00) != B53_BRCM_OUI_4 &&
++	    (phy_id & 0xfffffc00) != B53_BRCM_OUI_5) {
+ 		dev_err(&mdiodev->dev, "Unsupported device: 0x%08x\n", phy_id);
+ 		return -ENODEV;
+ 	}
+@@ -375,6 +377,7 @@ static const struct of_device_id b53_of_
+ 	{ .compatible = "brcm,bcm53115" },
+ 	{ .compatible = "brcm,bcm53125" },
+ 	{ .compatible = "brcm,bcm53128" },
++	{ .compatible = "brcm,bcm53134" },
+ 	{ .compatible = "brcm,bcm5365" },
+ 	{ .compatible = "brcm,bcm5389" },
+ 	{ .compatible = "brcm,bcm5395" },
+--- a/drivers/net/dsa/b53/b53_priv.h
++++ b/drivers/net/dsa/b53/b53_priv.h
+@@ -80,6 +80,7 @@ enum {
+ 	BCM583XX_DEVICE_ID = 0x58300,
+ 	BCM7445_DEVICE_ID = 0x7445,
+ 	BCM7278_DEVICE_ID = 0x7278,
++	BCM53134_DEVICE_ID = 0x5075,
+ };
+ 
+ struct b53_pcs {
+@@ -187,7 +188,8 @@ static inline int is531x5(struct b53_dev
+ {
+ 	return dev->chip_id == BCM53115_DEVICE_ID ||
+ 		dev->chip_id == BCM53125_DEVICE_ID ||
+-		dev->chip_id == BCM53128_DEVICE_ID;
++		dev->chip_id == BCM53128_DEVICE_ID ||
++		dev->chip_id == BCM53134_DEVICE_ID;
+ }
+ 
+ static inline int is63xx(struct b53_device *dev)
+@@ -215,7 +217,8 @@ static inline int is58xx(struct b53_devi
+ 	return dev->chip_id == BCM58XX_DEVICE_ID ||
+ 		dev->chip_id == BCM583XX_DEVICE_ID ||
+ 		dev->chip_id == BCM7445_DEVICE_ID ||
+-		dev->chip_id == BCM7278_DEVICE_ID;
++		dev->chip_id == BCM7278_DEVICE_ID ||
++		dev->chip_id == BCM53134_DEVICE_ID;
+ }
+ 
+ #define B53_63XX_RGMII0	4
diff --git a/target/linux/generic/pending-6.1/780-ARM-kirkwood-add-missing-linux-if_ether.h-for-ETH_AL.patch b/target/linux/generic/pending-6.1/780-ARM-kirkwood-add-missing-linux-if_ether.h-for-ETH_AL.patch
new file mode 100644
index 00000000000000..39ba71606ec235
--- /dev/null
+++ b/target/linux/generic/pending-6.1/780-ARM-kirkwood-add-missing-linux-if_ether.h-for-ETH_AL.patch
@@ -0,0 +1,61 @@
+From patchwork Thu Aug  5 22:23:30 2021
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12422209
+Date: Thu, 5 Aug 2021 23:23:30 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-arm-kernel@lists.infradead.org, netdev@vger.kernel.org,
+ linux-kernel@vger.kernel.org
+Cc: "David S. Miller" <davem@davemloft.net>, Andrew Lunn <andrew@lunn.ch>,
+ Michael Walle <michael@walle.cc>
+Subject: [PATCH] ARM: kirkwood: add missing <linux/if_ether.h> for ETH_ALEN
+Message-ID: <YQxk4jrbm31NM1US@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+X-BeenThere: linux-arm-kernel@lists.infradead.org
+X-Mailman-Version: 2.1.34
+Precedence: list
+List-Id: <linux-arm-kernel.lists.infradead.org>
+List-Archive: <http://lists.infradead.org/pipermail/linux-arm-kernel/>
+Sender: "linux-arm-kernel" <linux-arm-kernel-bounces@lists.infradead.org>
+
+After commit 83216e3988cd1 ("of: net: pass the dst buffer to
+of_get_mac_address()") build fails for kirkwood as ETH_ALEN is not
+defined.
+
+arch/arm/mach-mvebu/kirkwood.c: In function 'kirkwood_dt_eth_fixup':
+arch/arm/mach-mvebu/kirkwood.c:87:13: error: 'ETH_ALEN' undeclared (first use in this function); did you mean 'ESTALE'?
+   u8 tmpmac[ETH_ALEN];
+             ^~~~~~~~
+             ESTALE
+arch/arm/mach-mvebu/kirkwood.c:87:13: note: each undeclared identifier is reported only once for each function it appears in
+arch/arm/mach-mvebu/kirkwood.c:87:6: warning: unused variable 'tmpmac' [-Wunused-variable]
+   u8 tmpmac[ETH_ALEN];
+      ^~~~~~
+make[5]: *** [scripts/Makefile.build:262: arch/arm/mach-mvebu/kirkwood.o] Error 1
+make[5]: *** Waiting for unfinished jobs....
+
+Add missing #include <linux/if_ether.h> to fix this.
+
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Andrew Lunn <andrew@lunn.ch>
+Cc: Michael Walle <michael@walle.cc>
+Reported-by: https://buildbot.openwrt.org/master/images/#/builders/56/builds/220/steps/44/logs/stdio
+Fixes: 83216e3988cd1 ("of: net: pass the dst buffer to of_get_mac_address()")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ arch/arm/mach-mvebu/kirkwood.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/mach-mvebu/kirkwood.c
++++ b/arch/arm/mach-mvebu/kirkwood.c
+@@ -11,6 +11,7 @@
+ #include <linux/kernel.h>
+ #include <linux/init.h>
+ #include <linux/mbus.h>
++#include <linux/if_ether.h>
+ #include <linux/of.h>
+ #include <linux/of_address.h>
+ #include <linux/of_net.h>
diff --git a/target/linux/generic/pending-6.1/790-bus-mhi-core-add-SBL-state-callback.patch b/target/linux/generic/pending-6.1/790-bus-mhi-core-add-SBL-state-callback.patch
new file mode 100644
index 00000000000000..874df43e7ce6fc
--- /dev/null
+++ b/target/linux/generic/pending-6.1/790-bus-mhi-core-add-SBL-state-callback.patch
@@ -0,0 +1,48 @@
+From 5f7c5e1c0d7a79be144e5efc1f24728ddd7fc25c Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Sat, 5 Nov 2022 20:02:56 +0100
+Subject: [PATCH 1/2] bus: mhi: core: add SBL state callback
+
+Add support for SBL state callback in MHI core.
+
+It is required for ath11k MHI devices in order to be able to set QRTR
+instance ID in the SBL state so that QRTR instance ID-s dont conflict in
+case of multiple PCI/MHI cards or AHB + PCI/MHI card.
+Setting QRTR instance ID is only possible in SBL state and there is
+currently no way to ensure that we are in that state, so provide a
+callback that the controller can trigger off.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/bus/mhi/host/main.c | 1 +
+ include/linux/mhi.h         | 2 ++
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/bus/mhi/host/main.c
++++ b/drivers/bus/mhi/host/main.c
+@@ -900,6 +900,7 @@ int mhi_process_ctrl_ev_ring(struct mhi_
+ 			switch (event) {
+ 			case MHI_EE_SBL:
+ 				st = DEV_ST_TRANSITION_SBL;
++				mhi_cntrl->status_cb(mhi_cntrl, MHI_CB_EE_SBL_MODE);
+ 				break;
+ 			case MHI_EE_WFW:
+ 			case MHI_EE_AMSS:
+--- a/include/linux/mhi.h
++++ b/include/linux/mhi.h
+@@ -34,6 +34,7 @@ struct mhi_buf_info;
+  * @MHI_CB_SYS_ERROR: MHI device entered error state (may recover)
+  * @MHI_CB_FATAL_ERROR: MHI device entered fatal error state
+  * @MHI_CB_BW_REQ: Received a bandwidth switch request from device
++ * @MHI_CB_EE_SBL_MODE: MHI device entered SBL mode
+  */
+ enum mhi_callback {
+ 	MHI_CB_IDLE,
+@@ -45,6 +46,7 @@ enum mhi_callback {
+ 	MHI_CB_SYS_ERROR,
+ 	MHI_CB_FATAL_ERROR,
+ 	MHI_CB_BW_REQ,
++	MHI_CB_EE_SBL_MODE,
+ };
+ 
+ /**
diff --git a/target/linux/generic/pending-6.1/795-mt7530-register-OF-node-for-internal-MDIO-bus.patch b/target/linux/generic/pending-6.1/795-mt7530-register-OF-node-for-internal-MDIO-bus.patch
new file mode 100644
index 00000000000000..26f40d9f87ba78
--- /dev/null
+++ b/target/linux/generic/pending-6.1/795-mt7530-register-OF-node-for-internal-MDIO-bus.patch
@@ -0,0 +1,43 @@
+From 1d81e51d6d79d9098013b2e8cdd677bae998c5d8 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Fri, 28 Apr 2023 02:22:59 +0200
+Subject: [PATCH 1/2] mt7530: register OF node for internal MDIO bus
+
+The MT753x switches provide a switch-internal MDIO bus for the embedded
+PHYs.
+
+Register a OF sub-node on the switch OF-node for this internal MDIO bus.
+This allows to configure the embedded PHYs using device-tree.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ drivers/net/dsa/mt7530.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -2126,10 +2126,13 @@ mt7530_setup_mdio(struct mt7530_priv *pr
+ {
+ 	struct dsa_switch *ds = priv->ds;
+ 	struct device *dev = priv->dev;
++	struct device_node *np, *mnp;
+ 	struct mii_bus *bus;
+ 	static int idx;
+ 	int ret;
+ 
++	np = priv->dev->of_node;
++
+ 	bus = devm_mdiobus_alloc(dev);
+ 	if (!bus)
+ 		return -ENOMEM;
+@@ -2146,7 +2149,9 @@ mt7530_setup_mdio(struct mt7530_priv *pr
+ 	if (priv->irq)
+ 		mt7530_setup_mdio_irq(priv);
+ 
+-	ret = devm_mdiobus_register(dev, bus);
++	mnp = of_get_child_by_name(np, "mdio");
++	ret = devm_of_mdiobus_register(dev, bus, mnp);
++	of_node_put(mnp);
+ 	if (ret) {
+ 		dev_err(dev, "failed to register MDIO bus: %d\n", ret);
+ 		if (priv->irq)
diff --git a/target/linux/generic/pending-6.1/800-bcma-get-SoC-device-struct-copy-its-DMA-params-to-th.patch b/target/linux/generic/pending-6.1/800-bcma-get-SoC-device-struct-copy-its-DMA-params-to-th.patch
new file mode 100644
index 00000000000000..478a2cb27d8014
--- /dev/null
+++ b/target/linux/generic/pending-6.1/800-bcma-get-SoC-device-struct-copy-its-DMA-params-to-th.patch
@@ -0,0 +1,73 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Subject: [PATCH] bcma: get SoC device struct & copy its DMA params to the
+ subdevices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+For bus devices to be fully usable it's required to set their DMA
+parameters.
+
+For years it has been missing and remained unnoticed because of
+mips_dma_alloc_coherent() silently handling the empty coherent_dma_mask.
+Kernel 4.19 came with a lot of DMA changes and caused a regression on
+the bcm47xx. Starting with the commit f8c55dc6e828 ("MIPS: use generic
+dma noncoherent ops for simple noncoherent platforms") DMA coherent
+allocations just fail. Example:
+[    1.114914] bgmac_bcma bcma0:2: Allocation of TX ring 0x200 failed
+[    1.121215] bgmac_bcma bcma0:2: Unable to alloc memory for DMA
+[    1.127626] bgmac_bcma: probe of bcma0:2 failed with error -12
+[    1.133838] bgmac_bcma: Broadcom 47xx GBit MAC driver loaded
+
+This change fixes above regression in addition to the MIPS bcm47xx
+commit 321c46b91550 ("MIPS: BCM47XX: Setup struct device for the SoC").
+
+It also fixes another *old* GPIO regression caused by a parent pointing
+to the NULL:
+[    0.157054] missing gpiochip .dev parent pointer
+[    0.157287] bcma: bus0: Error registering GPIO driver: -22
+introduced by the commit 74f4e0cc6108 ("bcma: switch GPIO portions to
+use GPIOLIB_IRQCHIP").
+
+Fixes: f8c55dc6e828 ("MIPS: use generic dma noncoherent ops for simple noncoherent platforms")
+Fixes: 74f4e0cc6108 ("bcma: switch GPIO portions to use GPIOLIB_IRQCHIP")
+Cc: linux-mips@linux-mips.org
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+
+--- a/drivers/bcma/host_soc.c
++++ b/drivers/bcma/host_soc.c
+@@ -191,6 +191,8 @@ int __init bcma_host_soc_init(struct bcm
+ 	struct bcma_bus *bus = &soc->bus;
+ 	int err;
+ 
++	bus->dev = soc->dev;
++
+ 	/* Scan bus and initialize it */
+ 	err = bcma_bus_early_register(bus);
+ 	if (err)
+--- a/drivers/bcma/main.c
++++ b/drivers/bcma/main.c
+@@ -236,13 +236,17 @@ EXPORT_SYMBOL(bcma_core_irq);
+ 
+ void bcma_prepare_core(struct bcma_bus *bus, struct bcma_device *core)
+ {
+-	device_initialize(&core->dev);
++	struct device *dev = &core->dev;
++
++	device_initialize(dev);
+ 	core->dev.release = bcma_release_core_dev;
+ 	core->dev.bus = &bcma_bus_type;
+-	dev_set_name(&core->dev, "bcma%d:%d", bus->num, core->core_index);
++	dev_set_name(dev, "bcma%d:%d", bus->num, core->core_index);
+ 	core->dev.parent = bus->dev;
+-	if (bus->dev)
++	if (bus->dev) {
+ 		bcma_of_fill_device(bus->dev, core);
++		dma_coerce_mask_and_coherent(dev, bus->dev->coherent_dma_mask);
++	}
+ 
+ 	switch (bus->hosttype) {
+ 	case BCMA_HOSTTYPE_PCI:
diff --git a/target/linux/generic/pending-6.1/801-gpio-gpio-cascade-add-generic-GPIO-cascade.patch b/target/linux/generic/pending-6.1/801-gpio-gpio-cascade-add-generic-GPIO-cascade.patch
new file mode 100644
index 00000000000000..a13d405e647494
--- /dev/null
+++ b/target/linux/generic/pending-6.1/801-gpio-gpio-cascade-add-generic-GPIO-cascade.patch
@@ -0,0 +1,222 @@
+From fc23ea48ba52c24f201fe5ca0132ee1a3de5a70a Mon Sep 17 00:00:00 2001
+From: Mauri Sandberg <maukka@ext.kapsi.fi>
+Date: Thu, 25 Mar 2021 11:48:05 +0200
+Subject: [PATCH 2/2] gpio: gpio-cascade: add generic GPIO cascade
+
+Adds support for building cascades of GPIO lines. That is, it allows
+setups when there is one upstream line and multiple cascaded lines, out
+of which one can be chosen at a time. The status of the upstream line
+can be conveyed to the selected cascaded line or, vice versa, the status
+of the cascaded line can be conveyed to the upstream line.
+
+A multiplexer is being used to select, which cascaded GPIO line is being
+used at any given time.
+
+At the moment only input direction is supported. In future it should be
+possible to add support for output direction, too.
+
+Signed-off-by: Mauri Sandberg <maukka@ext.kapsi.fi>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+---
+v7 -> v8:
+ - rearrange members in struct gpio_cascade
+ - cosmetic changes in file header and in one function declaration
+ - added Reviewed-by tags by Linus and Andy
+v6 -> v7:
+ - In Kconfig add info about module name
+ - adhere to new convention that allows lines longer than 80 chars
+ - use dev_probe_err with upstream gpio line too
+ - refactor for cleaner exit of probe function.
+v5 -> v6:
+ - In Kconfig, remove dependency to OF_GPIO and select only MULTIPLEXER
+ - refactor code preferring one-liners
+ - clean up prints, removing them from success-path.
+ - don't explicitly set gpio_chip.of_node as it's done in the GPIO library
+ - use devm_gpiochip_add_data instead of gpiochip_add
+v4 -> v5:
+ - renamed gpio-mux-input -> gpio-cascade. refactored code accordingly
+   here and there and changed to use new bindings and compatible string
+   - ambigious and vague 'pin' was rename to 'upstream_line'
+ - dropped Tested-by and Reviewed-by due to changes in bindings
+ - dropped Reported-by suggested by an automatic bot as it was not really
+   appropriate to begin with
+ - functionally it's the same as v4
+v3 -> v4:
+ - Changed author email
+ - Included Tested-by and Reviewed-by from Drew
+v2 -> v3:
+ - use managed device resources
+ - update Kconfig description
+v1 -> v2:
+ - removed .owner from platform_driver as per test bot's instruction
+ - added MODULE_AUTHOR, MODULE_DESCRIPTION, MODULE_LICENSE
+ - added gpio_mux_input_get_direction as it's recommended for all chips
+ - removed because this is input only chip: gpio_mux_input_set_value
+ - removed because they are not needed for input/output only chips:
+     gpio_mux_input_direction_input
+     gpio_mux_input_direction_output
+ - fixed typo in an error message
+ - added info message about successful registration
+ - removed can_sleep flag as this does not sleep while getting GPIO value
+   like I2C or SPI do
+ - Updated description in Kconfig
+---
+ drivers/gpio/Kconfig        |  15 +++++
+ drivers/gpio/Makefile       |   1 +
+ drivers/gpio/gpio-cascade.c | 117 ++++++++++++++++++++++++++++++++++++
+ 3 files changed, 133 insertions(+)
+ create mode 100644 drivers/gpio/gpio-cascade.c
+
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -1711,4 +1711,19 @@ config GPIO_SIM
+ 
+ endmenu
+ 
++comment "Other GPIO expanders"
++
++config GPIO_CASCADE
++	tristate "General GPIO cascade"
++	select MULTIPLEXER
++	help
++	  Say yes here to enable support for generic GPIO cascade.
++
++	  This allows building one-to-many cascades of GPIO lines using
++	  different types of multiplexers readily available. At the
++	  moment only input lines are supported.
++
++	  To build the driver as a module choose 'm' and the resulting module
++	  will be called 'gpio-cascade'.
++
+ endif
+--- a/drivers/gpio/Makefile
++++ b/drivers/gpio/Makefile
+@@ -43,6 +43,7 @@ obj-$(CONFIG_GPIO_BD9571MWV)		+= gpio-bd
+ obj-$(CONFIG_GPIO_BRCMSTB)		+= gpio-brcmstb.o
+ obj-$(CONFIG_GPIO_BT8XX)		+= gpio-bt8xx.o
+ obj-$(CONFIG_GPIO_CADENCE)		+= gpio-cadence.o
++obj-$(CONFIG_GPIO_CASCADE)		+= gpio-cascade.o
+ obj-$(CONFIG_GPIO_CLPS711X)		+= gpio-clps711x.o
+ obj-$(CONFIG_GPIO_SNPS_CREG)		+= gpio-creg-snps.o
+ obj-$(CONFIG_GPIO_CRYSTAL_COVE)		+= gpio-crystalcove.o
+--- /dev/null
++++ b/drivers/gpio/gpio-cascade.c
+@@ -0,0 +1,117 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ *  A generic GPIO cascade driver
++ *
++ *  Copyright (C) 2021 Mauri Sandberg <maukka@ext.kapsi.fi>
++ *
++ * This allows building cascades of GPIO lines in a manner illustrated
++ * below:
++ *
++ *                 /|---- Cascaded GPIO line 0
++ *  Upstream      | |---- Cascaded GPIO line 1
++ *  GPIO line ----+ | .
++ *                | | .
++ *                 \|---- Cascaded GPIO line n
++ *
++ * A multiplexer is being used to select, which cascaded line is being
++ * addressed at any given time.
++ *
++ * At the moment only input mode is supported due to lack of means for
++ * testing output functionality. At least theoretically output should be
++ * possible with open drain constructions.
++ */
++
++#include <linux/module.h>
++#include <linux/slab.h>
++#include <linux/platform_device.h>
++#include <linux/mux/consumer.h>
++
++#include <linux/gpio/consumer.h>
++#include <linux/gpio/driver.h>
++
++struct gpio_cascade {
++	struct gpio_chip	gpio_chip;
++	struct device		*parent;
++	struct mux_control	*mux_control;
++	struct gpio_desc	*upstream_line;
++};
++
++static struct gpio_cascade *chip_to_cascade(struct gpio_chip *gc)
++{
++	return container_of(gc, struct gpio_cascade, gpio_chip);
++}
++
++static int gpio_cascade_get_direction(struct gpio_chip *gc, unsigned int offset)
++{
++	return GPIO_LINE_DIRECTION_IN;
++}
++
++static int gpio_cascade_get_value(struct gpio_chip *gc, unsigned int offset)
++{
++	struct gpio_cascade *cas = chip_to_cascade(gc);
++	int ret;
++
++	ret = mux_control_select(cas->mux_control, offset);
++	if (ret)
++		return ret;
++
++	ret = gpiod_get_value(cas->upstream_line);
++	mux_control_deselect(cas->mux_control);
++	return ret;
++}
++
++static int gpio_cascade_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct gpio_cascade *cas;
++	struct mux_control *mc;
++	struct gpio_desc *upstream;
++	struct gpio_chip *gc;
++
++	cas = devm_kzalloc(dev, sizeof(*cas), GFP_KERNEL);
++	if (!cas)
++		return -ENOMEM;
++
++	mc = devm_mux_control_get(dev, NULL);
++	if (IS_ERR(mc))
++		return dev_err_probe(dev, PTR_ERR(mc), "unable to get mux-control\n");
++
++	cas->mux_control = mc;
++	upstream = devm_gpiod_get(dev, "upstream",  GPIOD_IN);
++	if (IS_ERR(upstream))
++		return dev_err_probe(dev, PTR_ERR(upstream), "unable to claim upstream GPIO line\n");
++
++	cas->upstream_line = upstream;
++	cas->parent = dev;
++
++	gc = &cas->gpio_chip;
++	gc->get = gpio_cascade_get_value;
++	gc->get_direction = gpio_cascade_get_direction;
++	gc->base = -1;
++	gc->ngpio = mux_control_states(mc);
++	gc->label = dev_name(cas->parent);
++	gc->parent = cas->parent;
++	gc->owner = THIS_MODULE;
++
++	platform_set_drvdata(pdev, cas);
++	return devm_gpiochip_add_data(dev, &cas->gpio_chip, NULL);
++}
++
++static const struct of_device_id gpio_cascade_id[] = {
++	{ .compatible = "gpio-cascade" },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, gpio_cascade_id);
++
++static struct platform_driver gpio_cascade_driver = {
++	.driver	= {
++		.name		= "gpio-cascade",
++		.of_match_table = gpio_cascade_id,
++	},
++	.probe	= gpio_cascade_probe,
++};
++module_platform_driver(gpio_cascade_driver);
++
++MODULE_AUTHOR("Mauri Sandberg <maukka@ext.kapsi.fi>");
++MODULE_DESCRIPTION("Generic GPIO cascade");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/generic/pending-6.1/802-OPP-Provide-old-opp-to-config_clks-on-_set_opp.patch b/target/linux/generic/pending-6.1/802-OPP-Provide-old-opp-to-config_clks-on-_set_opp.patch
new file mode 100644
index 00000000000000..2b3e4bbf716259
--- /dev/null
+++ b/target/linux/generic/pending-6.1/802-OPP-Provide-old-opp-to-config_clks-on-_set_opp.patch
@@ -0,0 +1,108 @@
+From fd59b838dd90452f61a17dc9e5ff175205003068 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 15 Sep 2022 18:49:43 +0200
+Subject: [PATCH] OPP: Provide old opp to config_clks on _set_opp
+
+With the target opp, also pass the old opp to config_clks function.
+This can be useful when a driver needs to take decision on what fequency
+to set based on what is the current frequency without using a
+clk_get_freq call.
+Update the only user of custom config_clks (tegra30 devfreq driver) to
+this new implementation.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/devfreq/tegra30-devfreq.c |  5 +++--
+ drivers/opp/core.c                | 11 ++++++-----
+ include/linux/pm_opp.h            | 11 ++++++-----
+ 3 files changed, 15 insertions(+), 12 deletions(-)
+
+--- a/drivers/devfreq/tegra30-devfreq.c
++++ b/drivers/devfreq/tegra30-devfreq.c
+@@ -823,8 +823,9 @@ static int devm_tegra_devfreq_init_hw(st
+ 
+ static int tegra_devfreq_config_clks_nop(struct device *dev,
+ 					 struct opp_table *opp_table,
+-					 struct dev_pm_opp *opp, void *data,
+-					 bool scaling_down)
++					 struct dev_pm_opp *old_opp,
++					 struct dev_pm_opp *opp,
++					 void *data, bool scaling_down)
+ {
+ 	/* We want to skip clk configuration via dev_pm_opp_set_opp() */
+ 	return 0;
+--- a/drivers/opp/core.c
++++ b/drivers/opp/core.c
+@@ -816,7 +816,8 @@ static int _set_opp_voltage(struct devic
+ 
+ static int
+ _opp_config_clk_single(struct device *dev, struct opp_table *opp_table,
+-		       struct dev_pm_opp *opp, void *data, bool scaling_down)
++		       struct dev_pm_opp *old_opp, struct dev_pm_opp *opp,
++		       void *data, bool scaling_down)
+ {
+ 	unsigned long *target = data;
+ 	unsigned long freq;
+@@ -848,8 +849,8 @@ _opp_config_clk_single(struct device *de
+  * the order in which they are present in the array while scaling up.
+  */
+ int dev_pm_opp_config_clks_simple(struct device *dev,
+-		struct opp_table *opp_table, struct dev_pm_opp *opp, void *data,
+-		bool scaling_down)
++		struct opp_table *opp_table, struct dev_pm_opp *old_opp,
++		struct dev_pm_opp *opp, void *data, bool scaling_down)
+ {
+ 	int ret, i;
+ 
+@@ -1121,7 +1122,7 @@ static int _set_opp(struct device *dev,
+ 	}
+ 
+ 	if (opp_table->config_clks) {
+-		ret = opp_table->config_clks(dev, opp_table, opp, clk_data, scaling_down);
++		ret = opp_table->config_clks(dev, opp_table, old_opp, opp, clk_data, scaling_down);
+ 		if (ret)
+ 			return ret;
+ 	}
+@@ -1196,7 +1197,7 @@ int dev_pm_opp_set_rate(struct device *d
+ 		 * equivalent to a clk_set_rate()
+ 		 */
+ 		if (!_get_opp_count(opp_table)) {
+-			ret = opp_table->config_clks(dev, opp_table, NULL,
++			ret = opp_table->config_clks(dev, opp_table, NULL, NULL,
+ 						     &target_freq, false);
+ 			goto put_opp_table;
+ 		}
+--- a/include/linux/pm_opp.h
++++ b/include/linux/pm_opp.h
+@@ -61,7 +61,8 @@ typedef int (*config_regulators_t)(struc
+ 			struct dev_pm_opp *old_opp, struct dev_pm_opp *new_opp,
+ 			struct regulator **regulators, unsigned int count);
+ 
+-typedef int (*config_clks_t)(struct device *dev, struct opp_table *opp_table,
++typedef int (*config_clks_t)(struct device *dev,
++			struct opp_table *opp_table, struct dev_pm_opp *old_opp, 
+ 			struct dev_pm_opp *opp, void *data, bool scaling_down);
+ 
+ /**
+@@ -160,8 +161,8 @@ int dev_pm_opp_set_config(struct device
+ int devm_pm_opp_set_config(struct device *dev, struct dev_pm_opp_config *config);
+ void dev_pm_opp_clear_config(int token);
+ int dev_pm_opp_config_clks_simple(struct device *dev,
+-		struct opp_table *opp_table, struct dev_pm_opp *opp, void *data,
+-		bool scaling_down);
++		struct opp_table *opp_table, struct dev_pm_opp *old_opp,
++		struct dev_pm_opp *opp, void *data, bool scaling_down);
+ 
+ struct dev_pm_opp *dev_pm_opp_xlate_required_opp(struct opp_table *src_table, struct opp_table *dst_table, struct dev_pm_opp *src_opp);
+ int dev_pm_opp_xlate_performance_state(struct opp_table *src_table, struct opp_table *dst_table, unsigned int pstate);
+@@ -346,8 +347,8 @@ static inline int devm_pm_opp_set_config
+ static inline void dev_pm_opp_clear_config(int token) {}
+ 
+ static inline int dev_pm_opp_config_clks_simple(struct device *dev,
+-		struct opp_table *opp_table, struct dev_pm_opp *opp, void *data,
+-		bool scaling_down)
++		struct opp_table *opp_table, struct dev_pm_opp *old_opp,
++		struct dev_pm_opp *opp, void *data, bool scaling_down)
+ {
+ 	return -EOPNOTSUPP;
+ }
diff --git a/target/linux/generic/pending-6.1/802-nvmem-u-boot-env-align-endianness-of-crc32-values.patch b/target/linux/generic/pending-6.1/802-nvmem-u-boot-env-align-endianness-of-crc32-values.patch
new file mode 100644
index 00000000000000..9b111050eeff01
--- /dev/null
+++ b/target/linux/generic/pending-6.1/802-nvmem-u-boot-env-align-endianness-of-crc32-values.patch
@@ -0,0 +1,47 @@
+From 0e71cac033bb7689c4dfa2e6814191337ef770f5 Mon Sep 17 00:00:00 2001
+From: INAGAKI Hiroshi <musashino.open@gmail.com>
+Date: Thu, 13 Oct 2022 00:51:33 +0900
+Subject: [PATCH] nvmem: u-boot-env: align endianness of crc32 values
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This patch fixes crc32 error on Big-Endianness system by conversion of
+calculated crc32 value.
+
+Little-Endianness system:
+
+  obtained crc32: Little
+calculated crc32: Little
+
+Big-Endianness system:
+
+  obtained crc32: Little
+calculated crc32: Big
+
+log (APRESIA ApresiaLightGS120GT-SS, RTL8382M, Big-Endianness):
+
+[    8.570000] u_boot_env 18001200.spi:flash@0:partitions:partition@c0000: Invalid calculated CRC32: 0x88cd6f09 (expected: 0x096fcd88)
+[    8.580000] u_boot_env: probe of 18001200.spi:flash@0:partitions:partition@c0000 failed with error -22
+
+Fixes: f955dc1445069 ("nvmem: add driver handling U-Boot environment variables")
+
+Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
+Acked-by: Rafał Miłecki <rafal@milecki.pl>
+Tested-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+---
+ drivers/nvmem/u-boot-env.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvmem/u-boot-env.c
++++ b/drivers/nvmem/u-boot-env.c
+@@ -182,7 +182,7 @@ static int u_boot_env_parse(struct u_boo
+ 	crc32_data_len = priv->mtd->size - crc32_data_offset;
+ 	data_len = priv->mtd->size - data_offset;
+ 
+-	calc = crc32(~0, buf + crc32_data_offset, crc32_data_len) ^ ~0L;
++	calc = le32_to_cpu((__le32)crc32(~0, buf + crc32_data_offset, crc32_data_len) ^ ~0L);
+ 	if (calc != crc32) {
+ 		dev_err(dev, "Invalid calculated CRC32: 0x%08x (expected: 0x%08x)\n", calc, crc32);
+ 		err = -EINVAL;
diff --git a/target/linux/generic/pending-6.1/810-pci_disable_common_quirks.patch b/target/linux/generic/pending-6.1/810-pci_disable_common_quirks.patch
new file mode 100644
index 00000000000000..33d2c6254790b4
--- /dev/null
+++ b/target/linux/generic/pending-6.1/810-pci_disable_common_quirks.patch
@@ -0,0 +1,62 @@
+From: Gabor Juhos <juhosg@openwrt.org>
+Subject: debloat: add kernel config option to disabling common PCI quirks
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/pci/Kconfig  | 6 ++++++
+ drivers/pci/quirks.c | 6 ++++++
+ 2 files changed, 12 insertions(+)
+
+--- a/drivers/pci/Kconfig
++++ b/drivers/pci/Kconfig
+@@ -118,6 +118,13 @@ config XEN_PCIDEV_FRONTEND
+ 	  The PCI device frontend driver allows the kernel to import arbitrary
+ 	  PCI devices from a PCI backend to support PCI driver domains.
+ 
++config PCI_DISABLE_COMMON_QUIRKS
++	bool "PCI disable common quirks"
++	depends on PCI
++	help
++	  If you don't know what to do here, say N.
++
++
+ config PCI_ATS
+ 	bool
+ 
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -207,6 +207,7 @@ static void quirk_mmio_always_on(struct
+ DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_ANY_ID, PCI_ANY_ID,
+ 				PCI_CLASS_BRIDGE_HOST, 8, quirk_mmio_always_on);
+ 
++#ifndef CONFIG_PCI_DISABLE_COMMON_QUIRKS
+ /*
+  * The Mellanox Tavor device gives false positive parity errors.  Disable
+  * parity error reporting.
+@@ -3388,6 +3389,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65f9, quirk_intel_mc_errata);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65fa, quirk_intel_mc_errata);
+ 
++#endif /* !CONFIG_PCI_DISABLE_COMMON_QUIRKS */
++
+ /*
+  * Ivytown NTB BAR sizes are misreported by the hardware due to an erratum.
+  * To work around this, query the size it should be configured to by the
+@@ -3413,6 +3416,8 @@ static void quirk_intel_ntb(struct pci_d
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0e08, quirk_intel_ntb);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0e0d, quirk_intel_ntb);
+ 
++#ifndef CONFIG_PCI_DISABLE_COMMON_QUIRKS
++
+ /*
+  * Some BIOS implementations leave the Intel GPU interrupts enabled, even
+  * though no one is handling them (e.g., if the i915 driver is never
+@@ -3451,6 +3456,8 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_IN
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0152, disable_igfx_irq);
+ 
++#endif /* !CONFIG_PCI_DISABLE_COMMON_QUIRKS */
++
+ /*
+  * PCI devices which are on Intel chips can skip the 10ms delay
+  * before entering D3 mode.
diff --git a/target/linux/generic/pending-6.1/811-pci_disable_usb_common_quirks.patch b/target/linux/generic/pending-6.1/811-pci_disable_usb_common_quirks.patch
new file mode 100644
index 00000000000000..98ea4c06d9f8ce
--- /dev/null
+++ b/target/linux/generic/pending-6.1/811-pci_disable_usb_common_quirks.patch
@@ -0,0 +1,115 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: debloat: disable common USB quirks
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ drivers/usb/host/pci-quirks.c | 16 ++++++++++++++++
+ drivers/usb/host/pci-quirks.h | 18 +++++++++++++++++-
+ include/linux/usb/hcd.h       |  7 +++++++
+ 3 files changed, 40 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -128,6 +128,8 @@ struct amd_chipset_type {
+ 	u8 rev;
+ };
+ 
++#ifndef CONFIG_PCI_DISABLE_COMMON_QUIRKS
++
+ static struct amd_chipset_info {
+ 	struct pci_dev	*nb_dev;
+ 	struct pci_dev	*smbus_dev;
+@@ -633,6 +635,10 @@ bool usb_amd_pt_check_port(struct device
+ }
+ EXPORT_SYMBOL_GPL(usb_amd_pt_check_port);
+ 
++#endif /* CONFIG_PCI_DISABLE_COMMON_QUIRKS */
++
++#if IS_ENABLED(CONFIG_USB_UHCI_HCD)
++
+ /*
+  * Make sure the controller is completely inactive, unable to
+  * generate interrupts or do DMA.
+@@ -712,8 +718,17 @@ reset_needed:
+ 	uhci_reset_hc(pdev, base);
+ 	return 1;
+ }
++#else
++int uhci_check_and_reset_hc(struct pci_dev *pdev, unsigned long base)
++{
++	return 0;
++}
++
++#endif
+ EXPORT_SYMBOL_GPL(uhci_check_and_reset_hc);
+ 
++#ifndef CONFIG_PCI_DISABLE_COMMON_QUIRKS
++
+ static inline int io_type_enabled(struct pci_dev *pdev, unsigned int mask)
+ {
+ 	u16 cmd;
+@@ -1285,3 +1300,4 @@ static void quirk_usb_early_handoff(stru
+ }
+ DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_ANY_ID, PCI_ANY_ID,
+ 			PCI_CLASS_SERIAL_USB, 8, quirk_usb_early_handoff);
++#endif
+--- a/drivers/usb/host/pci-quirks.h
++++ b/drivers/usb/host/pci-quirks.h
+@@ -5,6 +5,9 @@
+ #ifdef CONFIG_USB_PCI
+ void uhci_reset_hc(struct pci_dev *pdev, unsigned long base);
+ int uhci_check_and_reset_hc(struct pci_dev *pdev, unsigned long base);
++#endif  /* CONFIG_USB_PCI */
++
++#if defined(CONFIG_USB_PCI) && !defined(CONFIG_PCI_DISABLE_COMMON_QUIRKS)
+ int usb_hcd_amd_remote_wakeup_quirk(struct pci_dev *pdev);
+ bool usb_amd_hang_symptom_quirk(void);
+ bool usb_amd_prefetch_quirk(void);
+@@ -19,6 +22,18 @@ void sb800_prefetch(struct device *dev,
+ bool usb_amd_pt_check_port(struct device *device, int port);
+ #else
+ struct pci_dev;
++static inline int usb_amd_quirk_pll_check(void)
++{
++	return 0;
++}
++static inline bool usb_amd_hang_symptom_quirk(void)
++{
++	return false;
++}
++static inline bool usb_amd_prefetch_quirk(void)
++{
++	return false;
++}
+ static inline void usb_amd_quirk_pll_disable(void) {}
+ static inline void usb_amd_quirk_pll_enable(void) {}
+ static inline void usb_asmedia_modifyflowcontrol(struct pci_dev *pdev) {}
+@@ -29,6 +44,11 @@ static inline bool usb_amd_pt_check_port
+ {
+ 	return false;
+ }
++static inline void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev) {}
++static inline bool usb_xhci_needs_pci_reset(struct pci_dev *pdev)
++{
++	return false;
++}
+ #endif  /* CONFIG_USB_PCI */
+ 
+ #endif  /*  __LINUX_USB_PCI_QUIRKS_H  */
+--- a/include/linux/usb/hcd.h
++++ b/include/linux/usb/hcd.h
+@@ -483,7 +483,14 @@ extern int usb_hcd_pci_probe(struct pci_
+ extern void usb_hcd_pci_remove(struct pci_dev *dev);
+ extern void usb_hcd_pci_shutdown(struct pci_dev *dev);
+ 
++#ifndef CONFIG_PCI_DISABLE_COMMON_QUIRKS
+ extern int usb_hcd_amd_remote_wakeup_quirk(struct pci_dev *dev);
++#else
++static inline int usb_hcd_amd_remote_wakeup_quirk(struct pci_dev *dev)
++{
++	return 0;
++}
++#endif
+ 
+ #ifdef CONFIG_PM
+ extern const struct dev_pm_ops usb_hcd_pci_pm_ops;
diff --git a/target/linux/generic/pending-6.1/820-w1-gpio-fix-problem-with-platfom-data-in-w1-gpio.patch b/target/linux/generic/pending-6.1/820-w1-gpio-fix-problem-with-platfom-data-in-w1-gpio.patch
new file mode 100644
index 00000000000000..33eb34c913ea4a
--- /dev/null
+++ b/target/linux/generic/pending-6.1/820-w1-gpio-fix-problem-with-platfom-data-in-w1-gpio.patch
@@ -0,0 +1,26 @@
+From d9c8bc8c1408f3e8529db6e4e04017b4c579c342 Mon Sep 17 00:00:00 2001
+From: Pawel Dembicki <paweldembicki@gmail.com>
+Date: Sun, 18 Feb 2018 17:08:04 +0100
+Subject: [PATCH] w1: gpio: fix problem with platfom data in w1-gpio
+
+In devices, where fdt is used, is impossible to apply platform data
+without proper fdt node.
+
+This patch allow to use platform data in devices with fdt.
+
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+---
+ drivers/w1/masters/w1-gpio.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/w1/masters/w1-gpio.c
++++ b/drivers/w1/masters/w1-gpio.c
+@@ -76,7 +76,7 @@ static int w1_gpio_probe(struct platform
+ 	enum gpiod_flags gflags = GPIOD_OUT_LOW_OPEN_DRAIN;
+ 	int err;
+ 
+-	if (of_have_populated_dt()) {
++	if (of_have_populated_dt() && !dev_get_platdata(&pdev->dev)) {
+ 		pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
+ 		if (!pdata)
+ 			return -ENOMEM;
diff --git a/target/linux/generic/pending-6.1/834-ledtrig-libata.patch b/target/linux/generic/pending-6.1/834-ledtrig-libata.patch
new file mode 100644
index 00000000000000..f3c0b1802b35dd
--- /dev/null
+++ b/target/linux/generic/pending-6.1/834-ledtrig-libata.patch
@@ -0,0 +1,149 @@
+From: Daniel Golle <daniel@makrotopia.org>
+Subject: libata: add ledtrig support
+
+This adds a LED trigger for each ATA port indicating disk activity.
+
+As this is needed only on specific platforms (NAS SoCs and such),
+these platforms should define ARCH_WANTS_LIBATA_LEDS if there
+are boards with LED(s) intended to indicate ATA disk activity and
+need the OS to take care of that.
+In that way, if not selected, LED trigger support not will be
+included in libata-core and both, codepaths and structures remain
+untouched.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/ata/Kconfig       | 16 ++++++++++++++++
+ drivers/ata/libata-core.c | 41 +++++++++++++++++++++++++++++++++++++++++
+ include/linux/libata.h    |  9 +++++++++
+ 3 files changed, 66 insertions(+)
+
+--- a/drivers/ata/Kconfig
++++ b/drivers/ata/Kconfig
+@@ -67,6 +67,22 @@ config ATA_FORCE
+ 
+ 	  If unsure, say Y.
+ 
++config ARCH_WANT_LIBATA_LEDS
++	bool
++
++config ATA_LEDS
++	bool "support ATA port LED triggers"
++	depends on ARCH_WANT_LIBATA_LEDS
++	select NEW_LEDS
++	select LEDS_CLASS
++	select LEDS_TRIGGERS
++	default y
++	help
++	  This option adds a LED trigger for each registered ATA port.
++	  It is used to drive disk activity leds connected via GPIO.
++
++	  If unsure, say N.
++
+ config ATA_ACPI
+ 	bool "ATA ACPI Support"
+ 	depends on ACPI
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -663,6 +663,19 @@ u64 ata_tf_read_block(const struct ata_t
+ 	return block;
+ }
+ 
++#ifdef CONFIG_ATA_LEDS
++#define LIBATA_BLINK_DELAY 20 /* ms */
++static inline void ata_led_act(struct ata_port *ap)
++{
++	unsigned long led_delay = LIBATA_BLINK_DELAY;
++
++	if (unlikely(!ap->ledtrig))
++		return;
++
++	led_trigger_blink_oneshot(ap->ledtrig, &led_delay, &led_delay, 0);
++}
++#endif
++
+ /**
+  *	ata_build_rw_tf - Build ATA taskfile for given read/write request
+  *	@qc: Metadata associated with the taskfile to build
+@@ -4622,6 +4635,9 @@ void __ata_qc_complete(struct ata_queued
+ 		link->active_tag = ATA_TAG_POISON;
+ 		ap->nr_active_links--;
+ 	}
++#ifdef CONFIG_ATA_LEDS
++	ata_led_act(ap);
++#endif
+ 
+ 	/* clear exclusive status */
+ 	if (unlikely(qc->flags & ATA_QCFLAG_CLEAR_EXCL &&
+@@ -5328,6 +5344,9 @@ struct ata_port *ata_port_alloc(struct a
+ 	ap->stats.unhandled_irq = 1;
+ 	ap->stats.idle_irq = 1;
+ #endif
++#ifdef CONFIG_ATA_LEDS
++	ap->ledtrig = kzalloc(sizeof(struct led_trigger), GFP_KERNEL);
++#endif
+ 	ata_sff_port_init(ap);
+ 
+ 	return ap;
+@@ -5363,6 +5382,12 @@ static void ata_host_release(struct kref
+ 
+ 		kfree(ap->pmp_link);
+ 		kfree(ap->slave_link);
++#ifdef CONFIG_ATA_LEDS
++		if (ap->ledtrig) {
++			led_trigger_unregister(ap->ledtrig);
++			kfree(ap->ledtrig);
++		};
++#endif
+ 		kfree(ap);
+ 		host->ports[i] = NULL;
+ 	}
+@@ -5765,7 +5790,23 @@ int ata_host_register(struct ata_host *h
+ 		host->ports[i]->print_id = atomic_inc_return(&ata_print_id);
+ 		host->ports[i]->local_port_no = i + 1;
+ 	}
++#ifdef CONFIG_ATA_LEDS
++	for (i = 0; i < host->n_ports; i++) {
++		if (unlikely(!host->ports[i]->ledtrig))
++			continue;
+ 
++		snprintf(host->ports[i]->ledtrig_name,
++			sizeof(host->ports[i]->ledtrig_name), "ata%u",
++			host->ports[i]->print_id);
++
++		host->ports[i]->ledtrig->name = host->ports[i]->ledtrig_name;
++
++		if (led_trigger_register(host->ports[i]->ledtrig)) {
++			kfree(host->ports[i]->ledtrig);
++			host->ports[i]->ledtrig = NULL;
++		}
++	}
++#endif
+ 	/* Create associated sysfs transport objects  */
+ 	for (i = 0; i < host->n_ports; i++) {
+ 		rc = ata_tport_add(host->dev,host->ports[i]);
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -23,6 +23,9 @@
+ #include <linux/cdrom.h>
+ #include <linux/sched.h>
+ #include <linux/async.h>
++#ifdef CONFIG_ATA_LEDS
++#include <linux/leds.h>
++#endif
+ 
+ /*
+  * Define if arch has non-standard setup.  This is a _PCI_ standard
+@@ -857,6 +860,12 @@ struct ata_port {
+ #ifdef CONFIG_ATA_ACPI
+ 	struct ata_acpi_gtm	__acpi_init_gtm; /* use ata_acpi_init_gtm() */
+ #endif
++
++#ifdef CONFIG_ATA_LEDS
++	struct led_trigger	*ledtrig;
++	char			ledtrig_name[8];
++#endif
++
+ 	/* owned by EH */
+ 	u8			sector_buf[ATA_SECT_SIZE] ____cacheline_aligned;
+ };
diff --git a/target/linux/generic/pending-6.1/840-hwrng-bcm2835-set-quality-to-1000.patch b/target/linux/generic/pending-6.1/840-hwrng-bcm2835-set-quality-to-1000.patch
new file mode 100644
index 00000000000000..5ca8933d6fef4b
--- /dev/null
+++ b/target/linux/generic/pending-6.1/840-hwrng-bcm2835-set-quality-to-1000.patch
@@ -0,0 +1,26 @@
+From d6988cf1d16faac56899918bb2b1be8d85155e3f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Sat, 20 Feb 2021 18:36:38 +0100
+Subject: [PATCH] hwrng: bcm2835: set quality to 1000
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This allows devices without a high precission timer to reduce boot from >100s
+to <30s.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ drivers/char/hw_random/bcm2835-rng.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/char/hw_random/bcm2835-rng.c
++++ b/drivers/char/hw_random/bcm2835-rng.c
+@@ -170,6 +170,7 @@ static int bcm2835_rng_probe(struct plat
+ 	priv->rng.init = bcm2835_rng_init;
+ 	priv->rng.read = bcm2835_rng_read;
+ 	priv->rng.cleanup = bcm2835_rng_cleanup;
++	priv->rng.quality = 1000;
+ 
+ 	if (dev_of_node(dev)) {
+ 		rng_id = of_match_node(bcm2835_rng_of_match, dev->of_node);
diff --git a/target/linux/generic/pending-6.1/850-0023-PCI-aardvark-Make-main-irq_chip-structure-a-static-d.patch b/target/linux/generic/pending-6.1/850-0023-PCI-aardvark-Make-main-irq_chip-structure-a-static-d.patch
new file mode 100644
index 00000000000000..fc61ee202a509a
--- /dev/null
+++ b/target/linux/generic/pending-6.1/850-0023-PCI-aardvark-Make-main-irq_chip-structure-a-static-d.patch
@@ -0,0 +1,102 @@
+From 663b9f99bb35dbc0c7b685f71ee3668a60d31320 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Marek=20Beh=C3=BAn?= <kabel@kernel.org>
+Date: Mon, 10 Jan 2022 02:02:00 +0100
+Subject: [PATCH] PCI: aardvark: Make main irq_chip structure a static driver
+ structure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Marc Zyngier says [1] that we should use struct irq_chip as a global
+static struct in the driver. Even though the structure currently
+contains a dynamic member (parent_device), Marc says [2] that he plans
+to kill it and make the structure completely static.
+
+We have already converted others irq_chip structures in this driver in
+this way, but we omitted this one because the .name member is
+dynamically created from device's name, and the name is displayed in
+sysfs, so changing it would break sysfs ABI.
+
+The rationale for changing the name (to "advk-INT") in spite of sysfs
+ABI, and thus allowing to convert to a static structure, is that after
+the other changes we made in this series, the IRQ chip is basically
+something different: it no logner generates ERR and PME interrupts (they
+are generated by emulated bridge's rp_irq_chip).
+
+[1] https://lore.kernel.org/linux-pci/877dbcvngf.wl-maz@kernel.org/
+[2] https://lore.kernel.org/linux-pci/874k6gvkhz.wl-maz@kernel.org/
+
+Signed-off-by: Marek Behún <kabel@kernel.org>
+---
+ drivers/pci/controller/pci-aardvark.c | 25 +++++++------------------
+ 1 file changed, 7 insertions(+), 18 deletions(-)
+
+--- a/drivers/pci/controller/pci-aardvark.c
++++ b/drivers/pci/controller/pci-aardvark.c
+@@ -277,7 +277,6 @@ struct advk_pcie {
+ 	u8 wins_count;
+ 	struct irq_domain *rp_irq_domain;
+ 	struct irq_domain *irq_domain;
+-	struct irq_chip irq_chip;
+ 	raw_spinlock_t irq_lock;
+ 	struct irq_domain *msi_domain;
+ 	struct irq_domain *msi_inner_domain;
+@@ -1426,14 +1425,19 @@ static void advk_pcie_irq_unmask(struct
+ 	raw_spin_unlock_irqrestore(&pcie->irq_lock, flags);
+ }
+ 
++static struct irq_chip advk_irq_chip = {
++	.name		= "advk-INT",
++	.irq_mask	= advk_pcie_irq_mask,
++	.irq_unmask	= advk_pcie_irq_unmask,
++};
++
+ static int advk_pcie_irq_map(struct irq_domain *h,
+ 			     unsigned int virq, irq_hw_number_t hwirq)
+ {
+ 	struct advk_pcie *pcie = h->host_data;
+ 
+ 	irq_set_status_flags(virq, IRQ_LEVEL);
+-	irq_set_chip_and_handler(virq, &pcie->irq_chip,
+-				 handle_level_irq);
++	irq_set_chip_and_handler(virq, &advk_irq_chip, handle_level_irq);
+ 	irq_set_chip_data(virq, pcie);
+ 
+ 	return 0;
+@@ -1492,7 +1496,6 @@ static int advk_pcie_init_irq_domain(str
+ 	struct device *dev = &pcie->pdev->dev;
+ 	struct device_node *node = dev->of_node;
+ 	struct device_node *pcie_intc_node;
+-	struct irq_chip *irq_chip;
+ 	int ret = 0;
+ 
+ 	raw_spin_lock_init(&pcie->irq_lock);
+@@ -1503,28 +1506,14 @@ static int advk_pcie_init_irq_domain(str
+ 		return -ENODEV;
+ 	}
+ 
+-	irq_chip = &pcie->irq_chip;
+-
+-	irq_chip->name = devm_kasprintf(dev, GFP_KERNEL, "%s-irq",
+-					dev_name(dev));
+-	if (!irq_chip->name) {
+-		ret = -ENOMEM;
+-		goto out_put_node;
+-	}
+-
+-	irq_chip->irq_mask = advk_pcie_irq_mask;
+-	irq_chip->irq_unmask = advk_pcie_irq_unmask;
+-
+ 	pcie->irq_domain =
+ 		irq_domain_add_linear(pcie_intc_node, PCI_NUM_INTX,
+ 				      &advk_pcie_irq_domain_ops, pcie);
+ 	if (!pcie->irq_domain) {
+ 		dev_err(dev, "Failed to get a INTx IRQ domain\n");
+ 		ret = -ENOMEM;
+-		goto out_put_node;
+ 	}
+ 
+-out_put_node:
+ 	of_node_put(pcie_intc_node);
+ 	return ret;
+ }
diff --git a/target/linux/generic/pending-6.1/850-dt-bindings-clk-add-BCM63268-timer-clock-definitions.patch b/target/linux/generic/pending-6.1/850-dt-bindings-clk-add-BCM63268-timer-clock-definitions.patch
new file mode 100644
index 00000000000000..cc6f1e0d9dbec4
--- /dev/null
+++ b/target/linux/generic/pending-6.1/850-dt-bindings-clk-add-BCM63268-timer-clock-definitions.patch
@@ -0,0 +1,114 @@
+From patchwork Wed Mar 22 17:15:12 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=
+ <noltari@gmail.com>
+X-Patchwork-Id: 13184389
+Return-Path: <linux-clk-owner@vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id 73F2DC6FD1C
+	for <linux-clk@archiver.kernel.org>; Wed, 22 Mar 2023 17:15:59 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S231363AbjCVRP5 (ORCPT <rfc822;linux-clk@archiver.kernel.org>);
+        Wed, 22 Mar 2023 13:15:57 -0400
+Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58824 "EHLO
+        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S231408AbjCVRPy (ORCPT
+        <rfc822;linux-clk@vger.kernel.org>); Wed, 22 Mar 2023 13:15:54 -0400
+Received: from mail-wm1-x32d.google.com (mail-wm1-x32d.google.com
+ [IPv6:2a00:1450:4864:20::32d])
+        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 70E4C64B28;
+        Wed, 22 Mar 2023 10:15:24 -0700 (PDT)
+Received: by mail-wm1-x32d.google.com with SMTP id n19so1740892wms.0;
+        Wed, 22 Mar 2023 10:15:24 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20210112; t=1679505322;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:from:to:cc:subject:date
+         :message-id:reply-to;
+        bh=dEknM98Izmc8d/crPsoJ+ejZxfl78958Ei6SPYhYDHs=;
+        b=LTOQ75W3s5nYo+nEfiJAKqytSopONB4jCtU3zRygzPMasugVOrYFMsUR+WrpsAjuRT
+         v4HgWpJxEsIWeRXrUN9W21mFXhGgJLJXSxRnrio0CsZZBNMdkebbNOphgKXIWAdm+2iM
+         PzqAdGm5t38wT2mmm6V/9hCy90+12raHM82tNFdhhiezfg2cukVOKP3j/TeOVCwas0gQ
+         iFc+CuZB6y73zYXvMUMUpTsqI5vev4xJsSMHIQJVmUxJAwqhOBhN9JCRo7Ao+wayjn2d
+         Fxo6AV3A8v68nVfoQ0K0I+eWXG48nMCX45iWh/lVvVTOFcR99kn4va7NY1oVnPsh+WQz
+         WcLA==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20210112; t=1679505322;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
+         :subject:date:message-id:reply-to;
+        bh=dEknM98Izmc8d/crPsoJ+ejZxfl78958Ei6SPYhYDHs=;
+        b=wv2NSR1B5RnsdoEE7mgJSHAfSs1JHZbQ1HPMldyaGWAk1dcucqh/uDzM3Flz+ADRi1
+         19NoaB2Ur7QaWZejbuplnIOK/nte3PnmqJ9ZNw8HejmuS4eU8mB1V1aJUSKSPGsfUi4a
+         LYe3HSw87l0jrAC7ptdKvdUtzBoIkX0CeFvfguTQQkDhUTyAFIG144hY6uPXY9Mga96b
+         gnNe2dLCzHQLbEJpaDaavT7FEEcLDxaq7jNcR2xqEEZaIwfcew+Q05t4xL/3i8GAj9Ru
+         6ivQjIbBKfYQF88o7KnOW9o1wjrGsk+Nd4Iy0OLZix3JQasCJGrKV7ib5awI9J39upYV
+         fa4A==
+X-Gm-Message-State: AO0yUKWw75I1M5Vjrd4vXq4GTruQu0H84pycgyi2CT3bczTYRJpWmEWg
+        +bHDhvp1n5IWW85GI9vKWpbclB13a/S0RQ==
+X-Google-Smtp-Source: 
+ AK7set9T/2oJsVetUb2L4mPEWu8YqDrnK8EzHK5bJf1ABIa1Et8f7BFJ7AA3j14ITZuf8cH0HqlRtg==
+X-Received: by 2002:a05:600c:2304:b0:3ed:2949:985b with SMTP id
+ 4-20020a05600c230400b003ed2949985bmr206833wmo.23.1679505322457;
+        Wed, 22 Mar 2023 10:15:22 -0700 (PDT)
+Received: from atlantis.lan (255.red-79-146-124.dynamicip.rima-tde.net.
+ [79.146.124.255])
+        by smtp.gmail.com with ESMTPSA id
+ v10-20020a05600c470a00b003ee11ac2288sm8414333wmo.21.2023.03.22.10.15.21
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Wed, 22 Mar 2023 10:15:22 -0700 (PDT)
+From: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+To: mturquette@baylibre.com, sboyd@kernel.org, robh+dt@kernel.org,
+        krzysztof.kozlowski+dt@linaro.org, p.zabel@pengutronix.de,
+        f.fainelli@gmail.com, jonas.gorski@gmail.com,
+        william.zhang@broadcom.com, linux-clk@vger.kernel.org,
+        devicetree@vger.kernel.org, linux-kernel@vger.kernel.org
+Cc: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>,
+ Rob Herring <robh@kernel.org>
+Subject: [PATCH v4 1/4] dt-bindings: clk: add BCM63268 timer clock definitions
+Date: Wed, 22 Mar 2023 18:15:12 +0100
+Message-Id: <20230322171515.120353-2-noltari@gmail.com>
+X-Mailer: git-send-email 2.30.2
+In-Reply-To: <20230322171515.120353-1-noltari@gmail.com>
+References: <20230322171515.120353-1-noltari@gmail.com>
+MIME-Version: 1.0
+Precedence: bulk
+List-ID: <linux-clk.vger.kernel.org>
+X-Mailing-List: linux-clk@vger.kernel.org
+
+Add missing timer clock definitions for BCM63268.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Acked-by: Rob Herring <robh@kernel.org>
+---
+ v4: no changes
+ v3: no changes
+ v2: change commit title, as suggested by Stephen Boyd
+
+ include/dt-bindings/clock/bcm63268-clock.h | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/include/dt-bindings/clock/bcm63268-clock.h
++++ b/include/dt-bindings/clock/bcm63268-clock.h
+@@ -27,4 +27,17 @@
+ #define BCM63268_CLK_TBUS	27
+ #define BCM63268_CLK_ROBOSW250	31
+ 
++#define BCM63268_TCLK_EPHY1		0
++#define BCM63268_TCLK_EPHY2		1
++#define BCM63268_TCLK_EPHY3		2
++#define BCM63268_TCLK_GPHY1		3
++#define BCM63268_TCLK_DSL		4
++#define BCM63268_TCLK_WAKEON_EPHY	6
++#define BCM63268_TCLK_WAKEON_DSL	7
++#define BCM63268_TCLK_FAP1		11
++#define BCM63268_TCLK_FAP2		15
++#define BCM63268_TCLK_UTO_50		16
++#define BCM63268_TCLK_UTO_EXTIN		17
++#define BCM63268_TCLK_USB_REF		18
++
+ #endif /* __DT_BINDINGS_CLOCK_BCM63268_H */
diff --git a/target/linux/generic/pending-6.1/851-dt-bindings-reset-add-BCM63268-timer-reset-definitions.patch b/target/linux/generic/pending-6.1/851-dt-bindings-reset-add-BCM63268-timer-reset-definitions.patch
new file mode 100644
index 00000000000000..5f1be105ac7295
--- /dev/null
+++ b/target/linux/generic/pending-6.1/851-dt-bindings-reset-add-BCM63268-timer-reset-definitions.patch
@@ -0,0 +1,107 @@
+From patchwork Wed Mar 22 17:15:13 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=
+ <noltari@gmail.com>
+X-Patchwork-Id: 13184390
+Return-Path: <linux-clk-owner@vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id D0B1AC6FD1C
+	for <linux-clk@archiver.kernel.org>; Wed, 22 Mar 2023 17:16:08 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S231472AbjCVRQI (ORCPT <rfc822;linux-clk@archiver.kernel.org>);
+        Wed, 22 Mar 2023 13:16:08 -0400
+Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58934 "EHLO
+        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S231435AbjCVRP5 (ORCPT
+        <rfc822;linux-clk@vger.kernel.org>); Wed, 22 Mar 2023 13:15:57 -0400
+Received: from mail-wm1-x329.google.com (mail-wm1-x329.google.com
+ [IPv6:2a00:1450:4864:20::329])
+        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9655064863;
+        Wed, 22 Mar 2023 10:15:25 -0700 (PDT)
+Received: by mail-wm1-x329.google.com with SMTP id
+ v4-20020a05600c470400b003ee4f06428fso2424553wmo.4;
+        Wed, 22 Mar 2023 10:15:25 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20210112; t=1679505324;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:from:to:cc:subject:date
+         :message-id:reply-to;
+        bh=C7ykhArT1dO7P8wtmI92eo4c7KtPZI9w182/5+cB3T0=;
+        b=WRZRU2SM9n1LfUj4SgTPfQczADC2pfvoIrOsNpBLTym2eOfmkTetb/WbGSla5kw2Wb
+         SH5MIC2fFeScJg6T5FFAUOOLmRVW9xvl8Q3T3NKb3z/9wvPHO767nrdIbffRWMJFs7gW
+         wT/kuTpn8GYdfY0sZ/dMTkq41DVusEkxfX6GxtG85O98ZP8xMHQog8aPs9fRfUvI5ZKB
+         eGYcRz/Wn1cHhjey9jtWzQEEmZ/BT3b0HQTF9Tl88oofhiEgbyjFXr91+vRsLbsJpGXH
+         /1FjjaLG5DnonKubV9rmbuCU8KzwH331gi2KuRjvLD2V+OMewqSa5i+GvgVv8x2zC8y+
+         /mLQ==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20210112; t=1679505324;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
+         :subject:date:message-id:reply-to;
+        bh=C7ykhArT1dO7P8wtmI92eo4c7KtPZI9w182/5+cB3T0=;
+        b=bhd0fNh0jDOMlGSC4F+p5igV8AUlGEPj2cXUwgdgqRfSSuUy9z+Li8cT0MbY/aWH5Z
+         qInRVA+R1cWV3ubrDyKag6oEc0LDU234bnMFcP9b7MRlrM8Dpit9TFSyqJU4sDUWNDs5
+         KOe2k/SNIdat6munC9VOuEBDO0eB/UDMN+repKwXNdHChp/Toq9qMvW4Uy8uHxosbQlD
+         8P88GbKFjynb1E8I8croGjfub7+y8PPsWB0xNUcafIv6xs3MnVOP1Mk4KwBCbqS509la
+         mfjsriXtIybO8XFqtn100ungjvbFWdogEplLdSPVdgAqdfF5J8gHxAoApoeYejYkL5/R
+         kOhQ==
+X-Gm-Message-State: AO0yUKWdzr3dMmjKhD8tF+ec4Dfdq9VGZ/WCU4d85npKQvxSwhNPZZ1J
+        5WYRIqivh0suFC1OqEidwenpiJYvXedYjw==
+X-Google-Smtp-Source: 
+ AK7set87ew2/mKWeShXTTW/YBbBJNR2zeGFV0CfuqLXhiJEU6tqFuyKcW+vFEoKHIbNUS8wRy1SzLA==
+X-Received: by 2002:a05:600c:290:b0:3ee:6d88:774a with SMTP id
+ 16-20020a05600c029000b003ee6d88774amr160734wmk.14.1679505323514;
+        Wed, 22 Mar 2023 10:15:23 -0700 (PDT)
+Received: from atlantis.lan (255.red-79-146-124.dynamicip.rima-tde.net.
+ [79.146.124.255])
+        by smtp.gmail.com with ESMTPSA id
+ v10-20020a05600c470a00b003ee11ac2288sm8414333wmo.21.2023.03.22.10.15.22
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Wed, 22 Mar 2023 10:15:23 -0700 (PDT)
+From: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+To: mturquette@baylibre.com, sboyd@kernel.org, robh+dt@kernel.org,
+        krzysztof.kozlowski+dt@linaro.org, p.zabel@pengutronix.de,
+        f.fainelli@gmail.com, jonas.gorski@gmail.com,
+        william.zhang@broadcom.com, linux-clk@vger.kernel.org,
+        devicetree@vger.kernel.org, linux-kernel@vger.kernel.org
+Cc: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>,
+ Rob Herring <robh@kernel.org>
+Subject: [PATCH v4 2/4] dt-bindings: reset: add BCM63268 timer reset
+ definitions
+Date: Wed, 22 Mar 2023 18:15:13 +0100
+Message-Id: <20230322171515.120353-3-noltari@gmail.com>
+X-Mailer: git-send-email 2.30.2
+In-Reply-To: <20230322171515.120353-1-noltari@gmail.com>
+References: <20230322171515.120353-1-noltari@gmail.com>
+MIME-Version: 1.0
+Precedence: bulk
+List-ID: <linux-clk.vger.kernel.org>
+X-Mailing-List: linux-clk@vger.kernel.org
+
+Add missing timer reset definitions for BCM63268.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Acked-by: Rob Herring <robh@kernel.org>
+---
+ v4: no changes
+ v3: no changes
+ v2: change commit title, as suggested by Stephen Boyd
+
+ include/dt-bindings/reset/bcm63268-reset.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/include/dt-bindings/reset/bcm63268-reset.h
++++ b/include/dt-bindings/reset/bcm63268-reset.h
+@@ -23,4 +23,8 @@
+ #define BCM63268_RST_PCIE_HARD	17
+ #define BCM63268_RST_GPHY	18
+ 
++#define BCM63268_TRST_SW	29
++#define BCM63268_TRST_HW	30
++#define BCM63268_TRST_POR	31
++
+ #endif /* __DT_BINDINGS_RESET_BCM63268_H */
diff --git a/target/linux/generic/pending-6.1/852-clk-bcm-Add-BCM63268-timer-clock-and-reset-driver.patch b/target/linux/generic/pending-6.1/852-clk-bcm-Add-BCM63268-timer-clock-and-reset-driver.patch
new file mode 100644
index 00000000000000..7e500cd1b58c85
--- /dev/null
+++ b/target/linux/generic/pending-6.1/852-clk-bcm-Add-BCM63268-timer-clock-and-reset-driver.patch
@@ -0,0 +1,345 @@
+From patchwork Wed Mar 22 17:15:15 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=
+ <noltari@gmail.com>
+X-Patchwork-Id: 13184392
+Return-Path: <linux-clk-owner@vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id 199D9C76196
+	for <linux-clk@archiver.kernel.org>; Wed, 22 Mar 2023 17:16:11 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S231512AbjCVRQJ (ORCPT <rfc822;linux-clk@archiver.kernel.org>);
+        Wed, 22 Mar 2023 13:16:09 -0400
+Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58942 "EHLO
+        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S231442AbjCVRP5 (ORCPT
+        <rfc822;linux-clk@vger.kernel.org>); Wed, 22 Mar 2023 13:15:57 -0400
+Received: from mail-wm1-x32c.google.com (mail-wm1-x32c.google.com
+ [IPv6:2a00:1450:4864:20::32c])
+        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1DDB36487D;
+        Wed, 22 Mar 2023 10:15:27 -0700 (PDT)
+Received: by mail-wm1-x32c.google.com with SMTP id
+ i5-20020a05600c354500b003edd24054e0so6717370wmq.4;
+        Wed, 22 Mar 2023 10:15:27 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20210112; t=1679505325;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:from:to:cc:subject:date
+         :message-id:reply-to;
+        bh=rkv/eZYA1ncHp5FnV2ZWc3hgYnAx28S86QA9vmcXFCY=;
+        b=Y1mva2Bt3sUbKxLgEUS331CJbGxUc4z8kTQW8qiHWGhYlFKtm+d5z4sT40E5BeZAnU
+         zmTbCI7jbroe9NYBxGUmSli6LNVDPjND80ChbhWTqbqMQTmeQFWut9KmeBWK6Oze2lC/
+         XMSOorUzowjcU2xtHNrzoq2KH2pstW573lsB8WnzFVfhMaRkE9DfRr6WNyA7zC8DyxM5
+         ezxlCQtCmgPfCqlyksbIDKrgrRf3GiUR0yUd6xRU+MssyvH1FkYGDCerPctDto6lGHBz
+         8Y15jT3l6OnQMT6dkekgpPF5/XrSUY93u9g0B4U8+0dhNj+K7vmDen+jqdess+tpLnq/
+         gFrA==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20210112; t=1679505325;
+        h=content-transfer-encoding:mime-version:references:in-reply-to
+         :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
+         :subject:date:message-id:reply-to;
+        bh=rkv/eZYA1ncHp5FnV2ZWc3hgYnAx28S86QA9vmcXFCY=;
+        b=Ym4+u8bbTQGNkewUBrLf+89vE0EFJBQp2f1crwUxZFboKTROF9ltZonY1CGepo7b0B
+         fkx3TbWQy5X65g3ScuieqtClCI8WanPeNBJ48+JipJYO3ODVNBxnVaTuW/0FOIcahfqe
+         sG5GvggHhzRz+Yeybsbnupmzxnw8Ez0BpMl3p7zcjHL7BGZDdOOX2Zbw3zfyYa5sg2nX
+         UXYJT36zy2h39gxUsy9QkhQ76CG3w6omniohZpYidpojpiDjbOy0nKFky4kUe+YyA1fF
+         4IBhjAm6mH+uh6wHSG1qj+NAXHs0xDDJps16PbJwAgL7Qt9K5WW+R/UAYPmHFgaRIHOw
+         /seA==
+X-Gm-Message-State: AO0yUKXRtoYO8Nfus6Ca8lhM39P1Xn6TGkhatEfoISd1YNOkTJJN2hW+
+        xRphLgxlzNfCLcVPlpGK9dk=
+X-Google-Smtp-Source: 
+ AK7set9VnMEykugk8ZYnkXuqK41bX1dzlvKsAXHEjr8i2NZBld0buKhQLcGYEcwxnBgVTtC7eRGfXw==
+X-Received: by 2002:a1c:7c0b:0:b0:3e2:1dac:b071 with SMTP id
+ x11-20020a1c7c0b000000b003e21dacb071mr178053wmc.13.1679505325582;
+        Wed, 22 Mar 2023 10:15:25 -0700 (PDT)
+Received: from atlantis.lan (255.red-79-146-124.dynamicip.rima-tde.net.
+ [79.146.124.255])
+        by smtp.gmail.com with ESMTPSA id
+ v10-20020a05600c470a00b003ee11ac2288sm8414333wmo.21.2023.03.22.10.15.24
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Wed, 22 Mar 2023 10:15:25 -0700 (PDT)
+From: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+To: mturquette@baylibre.com, sboyd@kernel.org, robh+dt@kernel.org,
+        krzysztof.kozlowski+dt@linaro.org, p.zabel@pengutronix.de,
+        f.fainelli@gmail.com, jonas.gorski@gmail.com,
+        william.zhang@broadcom.com, linux-clk@vger.kernel.org,
+        devicetree@vger.kernel.org, linux-kernel@vger.kernel.org
+Cc: =?utf-8?q?=C3=81lvaro_Fern=C3=A1ndez_Rojas?=  <noltari@gmail.com>
+Subject: [PATCH v4 4/4] clk: bcm: Add BCM63268 timer clock and reset driver
+Date: Wed, 22 Mar 2023 18:15:15 +0100
+Message-Id: <20230322171515.120353-5-noltari@gmail.com>
+X-Mailer: git-send-email 2.30.2
+In-Reply-To: <20230322171515.120353-1-noltari@gmail.com>
+References: <20230322171515.120353-1-noltari@gmail.com>
+MIME-Version: 1.0
+Precedence: bulk
+List-ID: <linux-clk.vger.kernel.org>
+X-Mailing-List: linux-clk@vger.kernel.org
+
+Add driver for BCM63268 timer clock and reset controller.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ v4: add changes suggested by Stephen Boyd:
+  - Usage of of_device_get_match_data() isn't needed.
+  - Use devm_clk_hw_register_gate().
+  - Drop clk_hw_unregister_gate().
+ v3: add missing <linux/io.h> include to fix build warning
+ v2: add changes suggested by Stephen Boyd
+
+ drivers/clk/bcm/Kconfig              |   9 ++
+ drivers/clk/bcm/Makefile             |   1 +
+ drivers/clk/bcm/clk-bcm63268-timer.c | 215 +++++++++++++++++++++++++++
+ 3 files changed, 225 insertions(+)
+ create mode 100644 drivers/clk/bcm/clk-bcm63268-timer.c
+
+--- a/drivers/clk/bcm/Kconfig
++++ b/drivers/clk/bcm/Kconfig
+@@ -37,6 +37,15 @@ config CLK_BCM_63XX_GATE
+ 	  Enable common clock framework support for Broadcom BCM63xx DSL SoCs
+ 	  based on the MIPS architecture
+ 
++config CLK_BCM63268_TIMER
++	bool "Broadcom BCM63268 timer clock and reset support"
++	depends on BMIPS_GENERIC || COMPILE_TEST
++	default BMIPS_GENERIC
++	select RESET_CONTROLLER
++	help
++	  Enable timer clock and reset support for Broadcom BCM63268 DSL SoCs
++	  based on the MIPS architecture.
++
+ config CLK_BCM_KONA
+ 	bool "Broadcom Kona CCU clock support"
+ 	depends on ARCH_BCM_MOBILE || COMPILE_TEST
+--- a/drivers/clk/bcm/Makefile
++++ b/drivers/clk/bcm/Makefile
+@@ -1,6 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ obj-$(CONFIG_CLK_BCM_63XX)	+= clk-bcm63xx.o
+ obj-$(CONFIG_CLK_BCM_63XX_GATE)	+= clk-bcm63xx-gate.o
++obj-$(CONFIG_CLK_BCM63268_TIMER) += clk-bcm63268-timer.o
+ obj-$(CONFIG_CLK_BCM_KONA)	+= clk-kona.o
+ obj-$(CONFIG_CLK_BCM_KONA)	+= clk-kona-setup.o
+ obj-$(CONFIG_CLK_BCM_KONA)	+= clk-bcm281xx.o
+--- /dev/null
++++ b/drivers/clk/bcm/clk-bcm63268-timer.c
+@@ -0,0 +1,215 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * BCM63268 Timer Clock and Reset Controller Driver
++ *
++ * Copyright (C) 2023 Álvaro Fernández Rojas <noltari@gmail.com>
++ */
++
++#include <linux/clk-provider.h>
++#include <linux/delay.h>
++#include <linux/io.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
++#include <linux/platform_device.h>
++#include <linux/reset-controller.h>
++
++#include <dt-bindings/clock/bcm63268-clock.h>
++
++#define BCM63268_TIMER_RESET_SLEEP_MIN_US	10000
++#define BCM63268_TIMER_RESET_SLEEP_MAX_US	20000
++
++struct bcm63268_tclkrst_hw {
++	void __iomem *regs;
++	spinlock_t lock;
++
++	struct reset_controller_dev rcdev;
++	struct clk_hw_onecell_data data;
++};
++
++struct bcm63268_tclk_table_entry {
++	const char * const name;
++	u8 bit;
++};
++
++static const struct bcm63268_tclk_table_entry bcm63268_timer_clocks[] = {
++	{
++		.name = "ephy1",
++		.bit = BCM63268_TCLK_EPHY1,
++	}, {
++		.name = "ephy2",
++		.bit = BCM63268_TCLK_EPHY2,
++	}, {
++		.name = "ephy3",
++		.bit = BCM63268_TCLK_EPHY3,
++	}, {
++		.name = "gphy1",
++		.bit = BCM63268_TCLK_GPHY1,
++	}, {
++		.name = "dsl",
++		.bit = BCM63268_TCLK_DSL,
++	}, {
++		.name = "wakeon_ephy",
++		.bit = BCM63268_TCLK_WAKEON_EPHY,
++	}, {
++		.name = "wakeon_dsl",
++		.bit = BCM63268_TCLK_WAKEON_DSL,
++	}, {
++		.name = "fap1_pll",
++		.bit = BCM63268_TCLK_FAP1,
++	}, {
++		.name = "fap2_pll",
++		.bit = BCM63268_TCLK_FAP2,
++	}, {
++		.name = "uto_50",
++		.bit = BCM63268_TCLK_UTO_50,
++	}, {
++		.name = "uto_extin",
++		.bit = BCM63268_TCLK_UTO_EXTIN,
++	}, {
++		.name = "usb_ref",
++		.bit = BCM63268_TCLK_USB_REF,
++	}, {
++		/* sentinel */
++	}
++};
++
++static inline struct bcm63268_tclkrst_hw *
++to_bcm63268_timer_reset(struct reset_controller_dev *rcdev)
++{
++	return container_of(rcdev, struct bcm63268_tclkrst_hw, rcdev);
++}
++
++static int bcm63268_timer_reset_update(struct reset_controller_dev *rcdev,
++				unsigned long id, bool assert)
++{
++	struct bcm63268_tclkrst_hw *reset = to_bcm63268_timer_reset(rcdev);
++	unsigned long flags;
++	uint32_t val;
++
++	spin_lock_irqsave(&reset->lock, flags);
++	val = __raw_readl(reset->regs);
++	if (assert)
++		val &= ~BIT(id);
++	else
++		val |= BIT(id);
++	__raw_writel(val, reset->regs);
++	spin_unlock_irqrestore(&reset->lock, flags);
++
++	return 0;
++}
++
++static int bcm63268_timer_reset_assert(struct reset_controller_dev *rcdev,
++				unsigned long id)
++{
++	return bcm63268_timer_reset_update(rcdev, id, true);
++}
++
++static int bcm63268_timer_reset_deassert(struct reset_controller_dev *rcdev,
++				  unsigned long id)
++{
++	return bcm63268_timer_reset_update(rcdev, id, false);
++}
++
++static int bcm63268_timer_reset_reset(struct reset_controller_dev *rcdev,
++			       unsigned long id)
++{
++	bcm63268_timer_reset_update(rcdev, id, true);
++	usleep_range(BCM63268_TIMER_RESET_SLEEP_MIN_US,
++		     BCM63268_TIMER_RESET_SLEEP_MAX_US);
++
++	bcm63268_timer_reset_update(rcdev, id, false);
++	/*
++	 * Ensure component is taken out reset state by sleeping also after
++	 * deasserting the reset. Otherwise, the component may not be ready
++	 * for operation.
++	 */
++	usleep_range(BCM63268_TIMER_RESET_SLEEP_MIN_US,
++		     BCM63268_TIMER_RESET_SLEEP_MAX_US);
++
++	return 0;
++}
++
++static int bcm63268_timer_reset_status(struct reset_controller_dev *rcdev,
++				unsigned long id)
++{
++	struct bcm63268_tclkrst_hw *reset = to_bcm63268_timer_reset(rcdev);
++
++	return !(__raw_readl(reset->regs) & BIT(id));
++}
++
++static struct reset_control_ops bcm63268_timer_reset_ops = {
++	.assert = bcm63268_timer_reset_assert,
++	.deassert = bcm63268_timer_reset_deassert,
++	.reset = bcm63268_timer_reset_reset,
++	.status = bcm63268_timer_reset_status,
++};
++
++static int bcm63268_tclk_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	const struct bcm63268_tclk_table_entry *entry;
++	struct bcm63268_tclkrst_hw *hw;
++	struct clk_hw *clk;
++	u8 maxbit = 0;
++	int i, ret;
++
++	for (entry = bcm63268_timer_clocks; entry->name; entry++)
++		maxbit = max(maxbit, entry->bit);
++	maxbit++;
++
++	hw = devm_kzalloc(&pdev->dev, struct_size(hw, data.hws, maxbit),
++			  GFP_KERNEL);
++	if (!hw)
++		return -ENOMEM;
++
++	platform_set_drvdata(pdev, hw);
++
++	spin_lock_init(&hw->lock);
++
++	hw->data.num = maxbit;
++	for (i = 0; i < maxbit; i++)
++		hw->data.hws[i] = ERR_PTR(-ENODEV);
++
++	hw->regs = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(hw->regs))
++		return PTR_ERR(hw->regs);
++
++	for (entry = bcm63268_timer_clocks; entry->name; entry++) {
++		clk = devm_clk_hw_register_gate(dev, entry->name, NULL, 0,
++						hw->regs, entry->bit,
++						CLK_GATE_BIG_ENDIAN,
++						&hw->lock);
++		if (IS_ERR(clk))
++			return PTR_ERR(clk);
++
++		hw->data.hws[entry->bit] = clk;
++	}
++
++	ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_onecell_get,
++					  &hw->data);
++	if (ret)
++		return ret;
++
++	hw->rcdev.of_node = dev->of_node;
++	hw->rcdev.ops = &bcm63268_timer_reset_ops;
++
++	ret = devm_reset_controller_register(dev, &hw->rcdev);
++	if (ret)
++		dev_err(dev, "Failed to register reset controller\n");
++
++	return 0;
++}
++
++static const struct of_device_id bcm63268_tclk_dt_ids[] = {
++	{ .compatible = "brcm,bcm63268-timer-clocks" },
++	{ /* sentinel */ }
++};
++
++static struct platform_driver bcm63268_tclk = {
++	.probe = bcm63268_tclk_probe,
++	.driver = {
++		.name = "bcm63268-timer-clock",
++		.of_match_table = bcm63268_tclk_dt_ids,
++	},
++};
++builtin_platform_driver(bcm63268_tclk);
diff --git a/target/linux/generic/pending-6.1/920-mangle_bootargs.patch b/target/linux/generic/pending-6.1/920-mangle_bootargs.patch
new file mode 100644
index 00000000000000..60ceff00d66be2
--- /dev/null
+++ b/target/linux/generic/pending-6.1/920-mangle_bootargs.patch
@@ -0,0 +1,71 @@
+From: Imre Kaloz <kaloz@openwrt.org>
+Subject: init: add CONFIG_MANGLE_BOOTARGS and disable it by default
+
+Enabling this option renames the bootloader supplied root=
+and rootfstype= variables, which might have to be know but
+would break the automatisms OpenWrt uses.
+
+Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
+---
+ init/Kconfig |  9 +++++++++
+ init/main.c  | 24 ++++++++++++++++++++++++
+ 2 files changed, 33 insertions(+)
+
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1826,6 +1826,15 @@ config EMBEDDED
+ 	  an embedded system so certain expert options are available
+ 	  for configuration.
+ 
++config MANGLE_BOOTARGS
++	bool "Rename offending bootargs"
++	depends on EXPERT
++	help
++	  Sometimes the bootloader passed bogus root= and rootfstype=
++	  parameters to the kernel, and while you want to ignore them,
++	  you need to know the values f.e. to support dual firmware
++	  layouts on the flash.
++
+ config HAVE_PERF_EVENTS
+ 	bool
+ 	help
+--- a/init/main.c
++++ b/init/main.c
+@@ -609,6 +609,29 @@ static inline void setup_nr_cpu_ids(void
+ static inline void smp_prepare_cpus(unsigned int maxcpus) { }
+ #endif
+ 
++#ifdef CONFIG_MANGLE_BOOTARGS
++static void __init mangle_bootargs(char *command_line)
++{
++	char *rootdev;
++	char *rootfs;
++
++	rootdev = strstr(command_line, "root=/dev/mtdblock");
++
++	if (rootdev)
++		strncpy(rootdev, "mangled_rootblock=", 18);
++
++	rootfs = strstr(command_line, "rootfstype");
++
++	if (rootfs)
++		strncpy(rootfs, "mangled_fs", 10);
++
++}
++#else
++static void __init mangle_bootargs(char *command_line)
++{
++}
++#endif
++
+ /*
+  * We need to store the untouched command line for future reference.
+  * We also need to store the touched command line since the parameter
+@@ -957,6 +980,7 @@ asmlinkage __visible void __init __no_sa
+ 	pr_notice("%s", linux_banner);
+ 	early_security_init();
+ 	setup_arch(&command_line);
++	mangle_bootargs(command_line);
+ 	setup_boot_config();
+ 	setup_command_line(command_line);
+ 	setup_nr_cpu_ids();
diff --git a/target/linux/imx/config-5.15 b/target/linux/imx/config-5.15
index 0c9b7d22b4e54d..7caaacbed7098a 100644
--- a/target/linux/imx/config-5.15
+++ b/target/linux/imx/config-5.15
@@ -41,6 +41,7 @@ CONFIG_ATAGS=y
 CONFIG_AUTO_ZRELADDR=y
 CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK=y
 CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_SD=y
 CONFIG_BLK_PM=y
 CONFIG_CACHE_L2X0=y
 CONFIG_CLKSRC_IMX_GPT=y
@@ -233,7 +234,6 @@ CONFIG_IMX_SDMA=y
 CONFIG_IMX_THERMAL=y
 # CONFIG_IMX_WEIM is not set
 CONFIG_INITRAMFS_SOURCE=""
-CONFIG_IO_URING=y
 CONFIG_IRQCHIP=y
 CONFIG_IRQ_DOMAIN=y
 CONFIG_IRQ_DOMAIN_HIERARCHY=y
@@ -295,6 +295,7 @@ CONFIG_NR_CPUS=4
 CONFIG_NVMEM=y
 # CONFIG_NVMEM_IMX_IIM is not set
 CONFIG_NVMEM_IMX_OCOTP=y
+# CONFIG_NVMEM_IMX_OCOTP_ELE is not set
 # CONFIG_NVMEM_SNVS_LPGPR is not set
 CONFIG_NVMEM_SYSFS=y
 CONFIG_OF=y
@@ -421,6 +422,7 @@ CONFIG_USB_MXS_PHY=y
 CONFIG_USB_OTG=y
 CONFIG_USB_PHY=y
 CONFIG_USB_ROLE_SWITCH=y
+CONFIG_USB_STORAGE=y
 CONFIG_USB_SUPPORT=y
 CONFIG_USB_ULPI_BUS=y
 CONFIG_USE_OF=y
diff --git a/target/linux/imx/image/bootscript-ventana b/target/linux/imx/image/bootscript-ventana
index 734f74a30c5feb..44a425d3484f40 100644
--- a/target/linux/imx/image/bootscript-ventana
+++ b/target/linux/imx/image/bootscript-ventana
@@ -44,7 +44,7 @@ if itest.s "x${dtype}" == "xnand" ; then
 	setenv root "ubi0:ubi ubi.mtd=2 rootfstype=squashfs,ubifs"
 else
 	setenv fsload "${fs}load ${dtype} ${disk}:1"
-	part uuid ${dtype} ${disk}:1 uuid
+	part uuid ${dtype} ${disk}:2 uuid
 	if test -z "${uuid}"; then
 		# fallback to bootdev
 		if test -n "$bootdev" ; then
@@ -60,7 +60,7 @@ else
 	else
 		setenv root "root=PARTUUID=${uuid}"
 	fi
-	setenv root "$root rootfstype=${fs} rootwait rw"
+	setenv root "$root rootfstype=squashfs rootwait"
 fi
 
 setenv bootargs "${bootargs}" "${root}" "${video}" "${extra}"
diff --git a/target/linux/imx/image/cortexa7.mk b/target/linux/imx/image/cortexa7.mk
index b4ac1b6904d571..d5a23fc6e9ed38 100644
--- a/target/linux/imx/image/cortexa7.mk
+++ b/target/linux/imx/image/cortexa7.mk
@@ -21,7 +21,7 @@ define Device/technexion_imx7d-pico-pi
   DEVICE_PACKAGES := kmod-sound-core kmod-sound-soc-imx kmod-sound-soc-imx-sgtl5000 \
 	kmod-can kmod-can-flexcan kmod-can-raw kmod-leds-gpio \
 	kmod-input-touchscreen-edt-ft5x06 kmod-usb-hid kmod-btsdio \
-	kmod-brcmfmac cypress-firmware-4339-sdio cypress-nvram-4339-pico-pi-imx7d
+	kmod-brcmfmac brcmfmac-firmware-4339-sdio cypress-nvram-4339-sdio
   FILESYSTEMS := squashfs
   IMAGES := combined.bin sysupgrade.bin
   IMAGE/combined.bin := append-rootfs | pad-extra 128k | imx-sdcard-raw-uboot
diff --git a/target/linux/imx/image/cortexa9.mk b/target/linux/imx/image/cortexa9.mk
index 78079aa746b9ec..2edbbaac4765cf 100644
--- a/target/linux/imx/image/cortexa9.mk
+++ b/target/linux/imx/image/cortexa9.mk
@@ -52,6 +52,29 @@ define Build/apalis-emmc
 	$(Build/imx-combined-image-clean)
 endef
 
+define Build/ventana-img
+	rm -rf $@.boot
+	mkdir -p $@.boot/boot
+	$(CP) $(IMAGE_KERNEL) $@.boot/boot/uImage
+	$(foreach dts,$(DEVICE_DTS), \
+		$(CP) \
+			$(DTS_DIR)/$(dts).dtb \
+			$@.boot/boot/;
+	)
+	mkimage -A arm -O linux -T script -C none -a 0 -e 0 \
+		-n '$(DEVICE_ID) OpenWrt bootscript' \
+		-d bootscript-$(DEVICE_NAME) \
+		$@.boot/boot/6x_bootscript-ventana
+	cp $@ $@.fs
+
+	$(SCRIPT_DIR)/gen_image_generic.sh $@ \
+		$(CONFIG_TARGET_KERNEL_PARTSIZE) \
+		$@.boot \
+		$(CONFIG_TARGET_ROOTFS_PARTSIZE) \
+		$@.fs \
+		1024
+	$(Build/imx-combined-image-clean)
+endef
 
 define Device/Default
   PROFILES := Default
@@ -99,10 +122,11 @@ define Device/gateworks_ventana
 	kmod-sound-soc-imx-sgtl5000 kmod-can kmod-can-flexcan kmod-can-raw \
 	kmod-hwmon-gsc kmod-leds-gpio kmod-pps-gpio kobs-ng
   KERNEL += | boot-overlay
-  IMAGES := nand.ubi bootfs.tar.gz dtb
+  IMAGES := img.gz nand.ubi bootfs.tar.gz dtb
   IMAGE/nand.ubi := append-ubi
   IMAGE/bootfs.tar.gz := bootfs.tar.gz
   IMAGE/dtb := install-dtb
+  IMAGE/img.gz := append-rootfs | pad-extra 128k | ventana-img | gzip
   UBINIZE_PARTS = boot=$$(KDIR_KERNEL_IMAGE).boot.ubifs=15
   PAGESIZE := 2048
   BLOCKSIZE := 128k
diff --git a/target/linux/ipq40xx/Makefile b/target/linux/ipq40xx/Makefile
index 6eb9c0022328b3..53b2f909aeb3ba 100644
--- a/target/linux/ipq40xx/Makefile
+++ b/target/linux/ipq40xx/Makefile
@@ -15,8 +15,8 @@ KERNELNAME:=zImage Image dtbs
 include $(INCLUDE_DIR)/target.mk
 DEFAULT_PACKAGES += \
 	kmod-usb-dwc3-qcom \
-	kmod-leds-gpio kmod-gpio-button-hotplug swconfig \
-	kmod-ath10k-ct wpad-basic-wolfssl \
+	kmod-leds-gpio kmod-gpio-button-hotplug \
+	kmod-ath10k-ct wpad-basic-mbedtls \
 	kmod-usb3 kmod-usb-dwc3 ath10k-firmware-qca4019-ct \
 	uboot-envtools
 
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/01_leds b/target/linux/ipq40xx/base-files/etc/board.d/01_leds
index 0e473534f5b1ec..1ba5d2b1a77eb5 100644
--- a/target/linux/ipq40xx/base-files/etc/board.d/01_leds
+++ b/target/linux/ipq40xx/base-files/etc/board.d/01_leds
@@ -10,13 +10,14 @@ board=$(board_name)
 
 case "$board" in
 alfa-network,ap120c-ac)
-	ucidef_set_led_netdev "wan" "WAN" "amber:wan" "eth1"
+	ucidef_set_led_netdev "wan" "WAN" "amber:wan" "wan"
 	;;
 asus,rt-ac42u)
-	ucidef_set_led_switch "lan1" "LAN1" "blue:lan-1" "switch0" "0x02"
-	ucidef_set_led_switch "lan2" "LAN2" "blue:lan-2" "switch0" "0x04"
-	ucidef_set_led_switch "lan3" "LAN3" "blue:lan-3" "switch0" "0x08"
-	ucidef_set_led_switch "lan4" "LAN4" "blue:lan-4" "switch0" "0x10"
+	ucidef_set_led_netdev "lan1" "LAN1" "blue:lan-1" "lan1"
+	ucidef_set_led_netdev "lan2" "LAN2" "blue:lan-2" "lan2"
+	ucidef_set_led_netdev "lan3" "LAN3" "blue:lan-3" "lan3"
+	ucidef_set_led_netdev "lan4" "LAN4" "blue:lan-4" "lan4"
+	ucidef_set_led_netdev "wan" "WAN" "blue:wan" "wan"
 	;;
 asus,rt-ac58u)
 	ucidef_set_led_netdev "wan" "WAN" "blue:wan" "eth1"
@@ -24,12 +25,11 @@ asus,rt-ac58u)
 	;;
 avm,fritzbox-4040)
 	ucidef_set_led_wlan "wlan" "WLAN" "green:wlan" "phy0tpt" "phy1tpt"
-	ucidef_set_led_netdev "wan" "WAN" "green:wan" "eth1"
+	ucidef_set_led_netdev "wan" "WAN" "green:wan" "wan"
 	ucidef_set_led_switch "lan" "LAN" "green:lan" "switch0" "0x1e"
 	;;
-avm,fritzbox-7530 |\
-glinet,gl-b1300 |\
-mikrotik,lhgg-60ad)
+avm,fritzbox-7530)
+	ucidef_set_led_netdev "dsl" "DSL" "green:info" "dsl0"
 	ucidef_set_led_wlan "wlan" "WLAN" "green:wlan" "phy0tpt"
 	;;
 edgecore,oap100)
@@ -53,24 +53,36 @@ engenius,ens620ext)
 	ucidef_set_led_netdev "lan2" "LAN2" "green:lan2" "eth1"
 	;;
 glinet,gl-ap1300)
-	ucidef_set_led_netdev "wan" "WAN" "green:wan" "eth1"
+	ucidef_set_led_netdev "wan" "WAN" "white:wan" "wan"
+	;;
+glinet,gl-b1300 |\
+mikrotik,lhgg-60ad)
+	ucidef_set_led_wlan "wlan" "WLAN" "green:wlan" "phy0tpt"
 	;;
 mikrotik,cap-ac)
 	ucidef_set_led_default "power" "POWER" "blue:power" "1"
 	ucidef_set_led_default "user" "USER" "green:user" "0"
-	ucidef_set_led_switch "eth1" "ETH1" "green:eth1" "switch0" "0x20"
-	ucidef_set_led_switch "eth2" "ETH2" "green:eth2" "switch0" "0x10"
+	ucidef_set_led_netdev "eth1" "ETH1" "green:eth1" "wan"
+	ucidef_set_led_netdev "eth2" "ETH2" "green:eth2" "lan"
 	ucidef_set_led_wlan "wlan2g" "WLAN2G" "green:wlan2g" "phy0tpt"
 	ucidef_set_led_wlan "wlan5g" "WLAN5G" "green:wlan5g" "phy1tpt"
 	;;
 mikrotik,hap-ac3)
-	ucidef_set_led_netdev "wan" "WAN" "green:wan" "eth1"
-	ucidef_set_led_switch "lan1" "LAN1" "green:lan1" "switch0" "0x10"
-	ucidef_set_led_switch "lan2" "LAN2" "green:lan2" "switch0" "0x08"
-	ucidef_set_led_switch "lan3" "LAN3" "green:lan3" "switch0" "0x04"
-	ucidef_set_led_switch "lan4" "LAN4" "green:lan4" "switch0" "0x02"
+	ucidef_set_led_netdev "wan" "WAN" "green:wan" "eth0"
+	ucidef_set_led_netdev "lan1" "LAN1" "green:lan1" "lan1"
+	ucidef_set_led_netdev "lan2" "LAN2" "green:lan2" "lan2"
+	ucidef_set_led_netdev "lan3" "LAN3" "green:lan3" "lan3"
+	ucidef_set_led_netdev "lan4" "LAN4" "green:lan4" "lan4"
 	ucidef_set_led_gpio "poe" "POE" "red:poe" "452" "0"
 	;;
+mikrotik,hap-ac3-lte6-kit)
+        ucidef_set_led_netdev "wan" "WAN" "green:wan" "wan"
+        ucidef_set_led_netdev "lan1" "LAN1" "green:lan1" "lan1"
+        ucidef_set_led_netdev "lan2" "LAN2" "green:lan2" "lan2"
+        ucidef_set_led_netdev "lan3" "LAN3" "green:lan3" "lan3"
+        ucidef_set_led_netdev "lan4" "LAN4" "green:lan4" "lan4"
+        ;;
+
 mikrotik,sxtsq-5-ac)
 	ucidef_set_rssimon "wlan0" "200000" "1"
 	ucidef_set_led_rssi "rssilow" "rssilow" "green:rssilow" "wlan0" "1" "100"
@@ -80,9 +92,9 @@ mikrotik,sxtsq-5-ac)
 	ucidef_set_led_rssi "rssihigh" "rssihigh" "green:rssihigh" "wlan0" "81" "100"
 	;;
 mobipromo,cm520-79f)
-	ucidef_set_led_netdev "wan" "WAN" "blue:wan" "eth1"
-	ucidef_set_led_switch "lan1" "LAN1" "blue:lan1" "switch0" "0x10"
-	ucidef_set_led_switch "lan2" "LAN2" "blue:lan2" "switch0" "0x08"
+	ucidef_set_led_netdev "wan" "WAN" "blue:wan" "wan"
+	ucidef_set_led_netdev "lan1" "LAN1" "blue:lan1" "lan1"
+	ucidef_set_led_netdev "lan2" "LAN2" "blue:lan2" "lan2"
 	;;
 netgear,ex6100v2 |\
 netgear,ex6150v2)
@@ -94,6 +106,11 @@ qxwlan,e2600ac-c2)
 	ucidef_set_led_wlan "wlan2g" "WLAN0" "green:wlan0" "phy0tpt"
 	ucidef_set_led_wlan "wlan5g" "WLAN1" "green:wlan1" "phy1tpt"
 	;;
+sony,ncp-hg100-cellular)
+	ucidef_set_led_netdev "lan" "LAN" "green:lan" "lan"
+	ucidef_set_led_netdev "wan" "WAN" "green:wan" "wan"
+	ucidef_set_led_netdev "wwan" "WWAN" "green:wan-4" "wwan0"
+	;;
 zyxel,nbg6617 |\
 zyxel,wre6606)
 	ucidef_set_led_wlan "wlan2g" "WLAN2G" "green:wlan2g" "phy0tpt"
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/02_network b/target/linux/ipq40xx/base-files/etc/board.d/02_network
index db58eb9363bfc0..b131d0d6182fe4 100644
--- a/target/linux/ipq40xx/base-files/etc/board.d/02_network
+++ b/target/linux/ipq40xx/base-files/etc/board.d/02_network
@@ -12,153 +12,100 @@ ipq40xx_setup_interfaces()
 
 	case "$board" in
 	8dev,habanero-dvk|\
+	avm,fritzbox-4040|\
+	asus,rt-ac42u|\
+	asus,rt-ac58u|\
+	linksys,ea6350v3|\
+	linksys,ea8300|\
+	linksys,mr8300|\
+	mikrotik,hap-ac2|\
+	mikrotik,hap-ac3|\
+	mikrotik,hap-ac3-lte6-kit|\
+	p2w,r619ac-64m|\
+	p2w,r619ac-128m|\
+	pakedge,wr-1|\
+	zyxel,nbg6617)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" "wan"
+		;;
 	8dev,jalapeno|\
 	alfa-network,ap120c-ac|\
-	engenius,emr3500|\
-	engenius,ens620ext|\
+	asus,map-ac2200|\
+	cilab,meshpoint-one|\
+	edgecore,ecw5211|\
+	glinet,gl-ap1300|\
+	glinet,gl-b2200|\
+	google,wifi|\
+	linksys,whw03v2|\
 	luma,wrtq-329acn|\
+	mikrotik,cap-ac|\
 	netgear,wac510|\
-	plasmacloud,pa1200|\
-	plasmacloud,pa2200)
-		ucidef_set_interfaces_lan_wan "eth0" "eth1"
+	sony,ncp-hg100-cellular|\
+	wallys,dr40x9|\
+	zte,mf18a|\
+	zte,mf289f)
+		ucidef_set_interfaces_lan_wan "lan" "wan"
 		;;
 	aruba,ap-303|\
 	aruba,ap-365|\
 	avm,fritzrepeater-1200|\
-	dlink,dap-2610 |\
-	engenius,eap1300|\
-	engenius,emd1|\
+	dlink,dap-2610|\
 	extreme-networks,ws-ap3915i|\
 	meraki,mr33|\
 	meraki,mr74|\
 	mikrotik,lhgg-60ad|\
 	mikrotik,sxtsq-5-ac|\
 	netgear,ex6100v2|\
-	netgear,ex6150v2|\
-	zyxel,wre6606)
-		ucidef_set_interface_lan "eth0"
-		;;
-	aruba,ap-303h|\
-	teltonika,rutx10)
-		ucidef_set_interfaces_lan_wan "eth0" "eth1"
-		ucidef_add_switch "switch0" \
-			"0u@eth0" "2:lan:1" "3:lan:2" "4:lan:3" "0u@eth1" "5:wan"
-		;;
-	asus,map-ac2200|\
-	cilab,meshpoint-one|\
-	edgecore,ecw5211|\
-	edgecore,oap100|\
-	google,wifi|\
-	openmesh,a42|\
-	openmesh,a62)
-		ucidef_set_interfaces_lan_wan "eth1" "eth0"
-		;;
-	mikrotik,cap-ac)
-		ucidef_add_switch "switch0" \
-			"0t@eth0" "4:lan" "5:wan"
-		;;
-	asus,rt-ac42u|\
-	asus,rt-ac58u|\
-	mikrotik,hap-ac2|\
-	mikrotik,hap-ac3|\
-	p2w,r619ac-64m|\
-	p2w,r619ac-128m|\
-	zyxel,nbg6617)
-		ucidef_set_interfaces_lan_wan "eth0" "eth1"
-		ucidef_add_switch "switch0" \
-			"0u@eth0" "1:lan:4" "2:lan:3" "3:lan:2" "4:lan:1"
-		;;
-	avm,fritzbox-4040|\
-	linksys,ea6350v3|\
-	linksys,ea8300)
-		ucidef_set_interfaces_lan_wan "eth0" "eth1"
-		ucidef_add_switch "switch0" \
-			"0u@eth0" "1:lan" "2:lan" "3:lan" "4:lan"
-		;;
-	linksys,mr8300)
-		ucidef_set_interfaces_lan_wan "eth0" "eth1"
-		ucidef_add_switch "switch0" \
-			"0u@eth0" "1:lan" "2:lan" "3:lan" "4:lan" "0u@eth1" "5:wan"
+	netgear,ex6150v2)
+		ucidef_set_interface_lan "lan"
 		;;
 	avm,fritzbox-7530)
-		ucidef_add_switch "switch0" \
-			"0u@eth0" "1:lan:4" "2:lan:3" "3:lan:2" "4:lan:1"
+		ucidef_set_interface_lan "lan1 lan2 lan3 lan4"
 		;;
 	avm,fritzrepeater-3000|\
-	linksys,whw01-v1)
-		ucidef_add_switch "switch0" \
-			"0u@eth0" "4:lan:1" "5:lan:2"
-		;;
-	compex,wpj419|\
-	compex,wpj428|\
-	engenius,eap2200|\
-	mikrotik,wap-ac)
-		ucidef_set_interface_lan "eth0 eth1"
-		;;
-	buffalo,wtr-m2133hp)
-		ucidef_set_interfaces_lan_wan "eth0" "eth1"
-		ucidef_add_switch "switch0" \
-			"0u@eth0" "2:lan:3" "3:lan:2" "4:lan:1"
-		;;
 	cellc,rtl30vw)
-		ucidef_set_interface_lan "eth0"
-		ucidef_add_switch "switch0" \
-			"0u@eth0" "3:lan" "4:lan"
+		ucidef_set_interface_lan "lan1 lan2"
 		;;
-	devolo,magic-2-wifi-next)
-		ucidef_set_interface_lan "eth0 eth1 eth2"
+	compex,wpj428)
+		ucidef_set_interface_lan "lan1 lan2"
 		;;
-	ezviz,cs-w3-wd1200g-eup)
-		ucidef_set_interfaces_lan_wan "eth0" "eth1"
-		ucidef_add_switch "switch0" \
-			"0u@eth0" "2:lan:3" "3:lan:2" "4:lan:1" "0u@eth1" "5:wan"
-		;;
-	glinet,gl-ap1300 |\
-	glinet,gl-b1300 |\
-	glinet,gl-s1300)
-		ucidef_set_interfaces_lan_wan "eth0" "eth1"
-		ucidef_add_switch "switch0" \
-			"0u@eth0" "3:lan" "4:lan"
-		;;
-	glinet,gl-b2200)
-		ucidef_set_interfaces_lan_wan "eth0" "eth1"
-		ucidef_add_switch "switch0" \
-			"0u@eth0" "1:lan" "2:lan" "3:lan" "5:lan" "0u@eth1" "4:wan"
+	linksys,whw01)
+		ucidef_set_interface_lan "eth1 eth2"
 		;;
+	glinet,gl-a1300|\
+	glinet,gl-b1300|\
 	mobipromo,cm520-79f)
-		ucidef_add_switch "switch0" \
-			"0u@eth0" "3:lan:2" "4:lan:1"
-		ucidef_set_interface_wan "eth1"
+		ucidef_set_interfaces_lan_wan "lan1 lan2" "wan"
 		;;
+	mikrotik,wap-ac|\
+	mikrotik,wap-ac-lte|\
+	mikrotik,wap-r-ac)
+		ucidef_set_interface_lan "sw-eth1 sw-eth2"
+		;;
+	aruba,ap-303h|\
+	buffalo,wtr-m2133hp|\
+	ezviz,cs-w3-wd1200g-eup|\
 	netgear,rbr50|\
 	netgear,rbs50|\
 	netgear,srr60|\
 	netgear,srs60)
-		ucidef_add_switch "switch0" \
-			"0u@eth0" "2:lan" "3:lan" "4:lan"
-		ucidef_set_interface_wan "eth1"
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" "wan"
 		;;
-	pakedge,wr-1)
-		ucidef_set_interfaces_lan_wan "eth0" "eth1"
-		ucidef_add_switch "switch0" \
-			"0u@eth0" "1:lan:4" "2:lan:3" "3:lan:2" "4:lan:1" "0u@eth1" "5:wan"
+	openmesh,a42|\
+	openmesh,a62)
+		ucidef_set_interfaces_lan_wan "ethernet2" "ethernet1"
 		;;
-	qxwlan,e2600ac-c1 |\
-	qxwlan,e2600ac-c2)
-		ucidef_set_interfaces_lan_wan "eth0" "eth1"
-		ucidef_add_switch "switch0" \
-			"0u@eth0" "3:lan" "4:lan" "0u@eth1" "5:wan"
+	plasmacloud,pa1200|\
+	plasmacloud,pa2200)
+		ucidef_set_interfaces_lan_wan "ethernet1" "ethernet2"
 		;;
-	unielec,u4019-32m |\
-	tel,x1pro)
-		ucidef_set_interfaces_lan_wan "eth0" "eth1"
-		ucidef_add_switch "switch0" \
-			"0u@eth0" "1:lan" "2:lan" "3:lan" "4:lan" "0u@eth1" "5:wan"
+	qxwlan,e2600ac-c1)
+		ucidef_set_interfaces_lan_wan "sw-eth1" "sw-eth2"
+		;;
+	qxwlan,e2600ac-c2)
+		ucidef_set_interfaces_lan_wan "sw-eth1 sw-eth2" "sw-eth3"
 		;;
 	zte,mf286d)
-		ucidef_set_interfaces_lan_wan "eth0" "eth1"
-		ucidef_add_switch "switch0" \
-			"0u@eth0" "2:lan:4" "3:lan:3" "4:lan:2" "0u@eth1" "5:wan"
+		ucidef_set_interfaces_lan_wan "lan2 lan3 lan4" "wan"
 		;;
 	*)
 		echo "Unsupported hardware. Network interfaces not initialized"
@@ -166,6 +113,26 @@ ipq40xx_setup_interfaces()
 	esac
 }
 
+ipq40xx_setup_dsl()
+{
+	local board="$1"
+	local annex="j"
+	local tone="b"
+	local xfer_mode=""
+
+	case "$board" in
+	avm,fritzbox-7530)
+		;;
+	*)
+		return 0
+		;;
+	esac
+
+	ucidef_add_atm_bridge "1" "32" "llc" "bridged" "dsl"
+	ucidef_add_vdsl_modem "$annex" "$tone" "$xfer_mode"
+	ucidef_set_interface_wan "dsl0" "pppoe"
+}
+
 ipq40xx_setup_macs()
 {
 	local board="$1"
@@ -177,11 +144,18 @@ ipq40xx_setup_macs()
 	8dev,habanero-dvk)
 		label_mac=$(mtd_get_mac_binary "ART" 0x1006)
 		;;
+	asus,rt-ac42u)
+		label_mac=$(mtd_get_mac_binary_ubi Factory 0x1006)
+		;;
 	asus,rt-ac58u)
 		wan_mac=$(mtd_get_mac_binary_ubi Factory 0x1006)
 		lan_mac=$(mtd_get_mac_binary_ubi Factory 0x5006)
 		label_mac=$wan_mac
 		;;
+	avm,fritzbox-7530)
+		local tffsdev=$(find_mtd_chardev "nand-tffs")
+		wan_mac=$(/usr/bin/fritz_tffs_nand -b -d $tffsdev -n macdsl)
+		;;
 	cilab,meshpoint-one)
 		label_mac=$(mtd_get_mac_binary "ART" 0x1006)
 		;;
@@ -210,13 +184,20 @@ ipq40xx_setup_macs()
 	ezviz,cs-w3-wd1200g-eup)
 		label_mac=$(mtd_get_mac_binary "ART" 0x6)
 		;;
-	linksys,ea6350v3)
+	google,wifi)
+		wan_mac=$(get_mac_label)
+		lan_mac=$(macaddr_add "$wan_mac" 1)
+		;;
+	linksys,ea6350v3|\
+	linksys,ea8300  |\
+	linksys,mr8300)
 		wan_mac=$(mtd_get_mac_ascii devinfo hw_mac_addr)
 		lan_mac=$(macaddr_add "$wan_mac" 1)
 		;;
 	mikrotik,cap-ac |\
 	mikrotik,hap-ac2|\
-	mikrotik,hap-ac3)
+	mikrotik,hap-ac3|\
+	mikrotik,hap-ac3-lte6-kit)
 		wan_mac=$(cat /sys/firmware/mikrotik/hard_config/mac_base)
 		lan_mac=$(macaddr_add $wan_mac 1)
 		label_mac="$wan_mac"
@@ -226,8 +207,13 @@ ipq40xx_setup_macs()
 		lan_mac=$(cat /sys/firmware/mikrotik/hard_config/mac_base)
 		label_mac="$lan_mac"
 		;;
+	netgear,rbr50|\
+	netgear,rbs50|\
+	netgear,srr60|\
+	netgear,srs60|\
 	pakedge,wr-1)
 		wan_mac=$(macaddr_add $(get_mac_label) 1)
+		;;
 	esac
 
 	[ -n "$lan_mac" ] && ucidef_set_interface_macaddr "lan" $lan_mac
@@ -238,6 +224,7 @@ ipq40xx_setup_macs()
 board_config_update
 board=$(board_name)
 ipq40xx_setup_interfaces $board
+ipq40xx_setup_dsl $board
 ipq40xx_setup_macs $board
 board_config_flush
 
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches b/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches
index a52a33d2f4dcaf..f76fe9402df322 100644
--- a/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches
+++ b/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches
@@ -24,7 +24,19 @@ mikrotik,cap-ac)
 mikrotik,hap-ac3)
 	ucidef_add_gpio_switch "poe_passtrough" "PoE Passthrough" "452" "0"
 	;;
-zte,mf286d)
+mikrotik,hap-ac3-lte6-kit)
+	ucidef_add_gpio_switch "lte_ant_sw1" "LTE Antenna SW 1" "457" "0"
+	ucidef_add_gpio_switch "lte_ant_sw2" "LTE Antenna SW 2" "458" "0"
+	ucidef_add_gpio_switch "lte_reset" "LTE reset" "461" "0"
+	;;
+sony,ncp-hg100-cellular)
+	ucidef_add_gpio_switch "uart_dbgcon_en" "debug console enable" "427" "1"
+	;;
+wallys,dr40x9)
+	ucidef_add_gpio_switch "sim_card_select" "SIM card select" "423" "0"
+	;;
+zte,mf286d|\
+zte,mf289f)
 	ucidef_add_gpio_switch "power_btn_block" "Power button blocker" "421" "0"
 	;;
 esac
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/05_compat-version b/target/linux/ipq40xx/base-files/etc/board.d/05_compat-version
new file mode 100644
index 00000000000000..70272f99ed5d86
--- /dev/null
+++ b/target/linux/ipq40xx/base-files/etc/board.d/05_compat-version
@@ -0,0 +1,18 @@
+#
+# Copyright (C) 2022 OpenWrt.org
+#
+
+. /lib/functions.sh
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+	*)
+		ucidef_set_compat_version "1.1"
+		;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
index a0280b7f225a99..7f41bdcfcc58c2 100644
--- a/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+++ b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
@@ -13,7 +13,6 @@ case "$FIRMWARE" in
 	meraki,mr74)
 		caldata_extract_ubi "ART" 0x9000 0x844
 		caldata_valid "4408" || caldata_extract "ART" 0x9000 0x844
-		ath10k_patch_mac $(macaddr_add $(get_mac_binary "/sys/bus/i2c/devices/0-0050/eeprom" 0x66) 1)
 		;;
 	esac
 	;;
@@ -35,10 +34,6 @@ case "$FIRMWARE" in
 		/usr/bin/fritz_cal_extract -i 1 -s 0x3C800 -e 0x212 -l 12064 -o /lib/firmware/$FIRMWARE $(find_mtd_chardev "urlader1") || \
 		/usr/bin/fritz_cal_extract -i 1 -s 0x3C000 -e 0x212 -l 12064 -o /lib/firmware/$FIRMWARE $(find_mtd_chardev "urlader1")
 		;;
-	openmesh,a62 |\
-	plasmacloud,pa2200)
-		caldata_extract "0:ART" 0x9000 0x2f20
-		;;
 	linksys,ea8300 |\
 	linksys,mr8300)
 		caldata_extract "ART" 0x9000 0x2f20
@@ -77,11 +72,7 @@ case "$FIRMWARE" in
 		/usr/bin/fritz_cal_extract -i 1 -s 0x3C800 -e 0x207 -l 12064 -o /lib/firmware/$FIRMWARE $(find_mtd_chardev "urlader1") || \
 		/usr/bin/fritz_cal_extract -i 1 -s 0x3D000 -e 0x207 -l 12064 -o /lib/firmware/$FIRMWARE $(find_mtd_chardev "urlader1")
 		;;
-	cellc,rtl30vw |\
-	openmesh,a42 |\
-	openmesh,a62 |\
-	plasmacloud,pa1200 |\
-	plasmacloud,pa2200)
+	cellc,rtl30vw)
 		caldata_extract "0:ART" 0x1000 0x2f20
 		;;
 	devolo,magic-2-wifi-next)
@@ -117,12 +108,14 @@ case "$FIRMWARE" in
 	meraki,mr74)
 		caldata_extract_ubi "ART" 0x1000 0x2f20
 		caldata_valid "202f" || caldata_extract "ART" 0x1000 0x2f20
-		ath10k_patch_mac $(macaddr_add $(get_mac_binary "/sys/bus/i2c/devices/0-0050/eeprom" 0x66) 2)
 		;;
 	mikrotik,cap-ac |\
 	mikrotik,hap-ac2 |\
 	mikrotik,hap-ac3 |\
-	mikrotik,wap-ac)
+	mikrotik,hap-ac3-lte6-kit |\
+	mikrotik,wap-ac |\
+	mikrotik,wap-ac-lte |\
+	mikrotik,wap-r-ac)
 		wlan_data="/sys/firmware/mikrotik/hard_config/wlan_data"
 		( [ -f "$wlan_data" ] && caldata_sysfsload_from_file "$wlan_data" 0x0 0x2f20 ) || \
 		( [ -d "$wlan_data" ] && caldata_sysfsload_from_file "$wlan_data/data_0" 0x0 0x2f20 )
@@ -138,6 +131,13 @@ case "$FIRMWARE" in
 		caldata_extract "0:ART" 0x1000 0x2f20
 		ath10k_patch_mac $(macaddr_add $(get_mac_label) 2)
 		;;
+	teltonika,rutx10)
+		caldata_extract "0:ART" 0x1000 0x2f20
+		ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary "0:CONFIG" 0x0) 2)
+		;;
+	sony,ncp-hg100-cellular)
+		caldata_extract_mmc "0:ART" 0x1000 0x2f20
+		;;
 	zyxel,nbg6617 |\
 	zyxel,wre6606)
 		caldata_extract "ART" 0x1000 0x2f20
@@ -167,11 +167,7 @@ case "$FIRMWARE" in
 		/usr/bin/fritz_cal_extract -i 1 -s 0x3D000 -e 0x208 -l 12064 -o /lib/firmware/$FIRMWARE $(find_mtd_chardev "urlader1") || \
 		/usr/bin/fritz_cal_extract -i 1 -s 0x3C000 -e 0x208 -l 12064 -o /lib/firmware/$FIRMWARE $(find_mtd_chardev "urlader1")
 		;;
-	cellc,rtl30vw |\
-	openmesh,a42 |\
-	openmesh,a62 |\
-	plasmacloud,pa1200 |\
-	plasmacloud,pa2200)
+	cellc,rtl30vw)
 		caldata_extract "0:ART" 0x5000 0x2f20
 		;;
 	devolo,magic-2-wifi-next)
@@ -207,13 +203,15 @@ case "$FIRMWARE" in
 	meraki,mr74)
 		caldata_extract_ubi "ART" 0x5000 0x2f20
 		caldata_valid "202f" || caldata_extract "ART" 0x5000 0x2f20
-		ath10k_patch_mac $(macaddr_add $(get_mac_binary "/sys/bus/i2c/devices/0-0050/eeprom" 0x66) 3)
 		;;
 	mikrotik,cap-ac |\
 	mikrotik,hap-ac2 |\
 	mikrotik,hap-ac3 |\
+	mikrotik,hap-ac3-lte6-kit |\
 	mikrotik,sxtsq-5-ac |\
-	mikrotik,wap-ac)
+	mikrotik,wap-ac |\
+	mikrotik,wap-ac-lte |\
+	mikrotik,wap-r-ac)
 		wlan_data="/sys/firmware/mikrotik/hard_config/wlan_data"
 		( [ -f "$wlan_data" ] && caldata_sysfsload_from_file "$wlan_data" 0x8000 0x2f20 ) || \
 		( [ -d "$wlan_data" ] && caldata_sysfsload_from_file "$wlan_data/data_2" 0x0 0x2f20 )
@@ -229,6 +227,13 @@ case "$FIRMWARE" in
 		caldata_extract "0:ART" 0x5000 0x2f20
 		ath10k_patch_mac $(macaddr_add $(get_mac_label) 4)
 		;;
+	teltonika,rutx10)
+		caldata_extract "0:ART" 0x5000 0x2f20
+		ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary "0:CONFIG" 0x0) 3)
+		;;
+	sony,ncp-hg100-cellular)
+		caldata_extract_mmc "0:ART" 0x5000 0x2f20
+		;;
 	zyxel,nbg6617 |\
 	zyxel,wre6606)
 		caldata_extract "ART" 0x5000 0x2f20
@@ -241,7 +246,10 @@ case "$FIRMWARE" in
 	mikrotik,cap-ac |\
 	mikrotik,hap-ac2 |\
 	mikrotik,hap-ac3 |\
-	mikrotik,wap-ac)
+	mikrotik,hap-ac3-lte6-kit |\
+	mikrotik,wap-ac |\
+	mikrotik,wap-ac-lte |\
+	mikrotik,wap-r-ac)
 		wlan_data="/sys/firmware/mikrotik/hard_config/wlan_data"
 		( [ -f "$wlan_data" ] && caldata_sysfsload_from_file "$wlan_data" 0x2f20 0x2f20 ) || \
 		( [ -d "$wlan_data" ] && caldata_sysfsload_from_file "$wlan_data/data_0" 0x2f20 0x2f20 )
@@ -253,8 +261,11 @@ case "$FIRMWARE" in
 	mikrotik,cap-ac |\
 	mikrotik,hap-ac2 |\
 	mikrotik,hap-ac3 |\
+        mikrotik,hap-ac3-lte6-kit |\
 	mikrotik,sxtsq-5-ac |\
-	mikrotik,wap-ac)
+	mikrotik,wap-ac |\
+	mikrotik,wap-ac-lte |\
+	mikrotik,wap-r-ac)
 		wlan_data="/sys/firmware/mikrotik/hard_config/wlan_data"
 		( [ -f "$wlan_data" ] && caldata_sysfsload_from_file "$wlan_data" 0xaf20 0x2f20 ) || \
 		( [ -d "$wlan_data" ] && caldata_sysfsload_from_file "$wlan_data/data_2" 0x2f20 0x2f20 )
diff --git a/target/linux/ipq40xx/base-files/etc/init.d/bootcount b/target/linux/ipq40xx/base-files/etc/init.d/bootcount
index 367ccfcd0cabba..df656c9b85b71c 100755
--- a/target/linux/ipq40xx/base-files/etc/init.d/bootcount
+++ b/target/linux/ipq40xx/base-files/etc/init.d/bootcount
@@ -11,7 +11,8 @@ boot() {
 	linksys,ea6350v3|\
 	linksys,ea8300|\
 	linksys,mr8300|\
-	linksys,whw01-v1)
+	linksys,whw01|\
+	linksys,whw03v2)
 		mtd resetbc s_env || true
 		;;
 	netgear,wac510)
diff --git a/target/linux/ipq40xx/base-files/etc/uci-defaults/05_fix-compat-version b/target/linux/ipq40xx/base-files/etc/uci-defaults/05_fix-compat-version
index 44873b9df43f12..c011920897120c 100644
--- a/target/linux/ipq40xx/base-files/etc/uci-defaults/05_fix-compat-version
+++ b/target/linux/ipq40xx/base-files/etc/uci-defaults/05_fix-compat-version
@@ -1,6 +1,9 @@
 . /lib/functions.sh
 
 case "$(board_name)" in
+linksys,ea6350v3|\
+linksys,ea8300|\
+linksys,mr8300|\
 ezviz,cs-w3-wd1200g-eup)
 	uci set system.@system[0].compat_version="2.0"
 	uci commit system
diff --git a/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh b/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh
index 940af0528d513f..ce0b55bb80915e 100644
--- a/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh
+++ b/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh
@@ -8,8 +8,13 @@ preinit_set_mac_address() {
 		ip link set dev eth1 address $(macaddr_add "$base_mac" 3)
 		;;
 	asus,rt-ac42u)
-		ip link set dev eth0 address $(mtd_get_mac_binary_ubi Factory 0x1006)
-		ip link set dev eth1 address $(mtd_get_mac_binary_ubi Factory 0x9006)
+		base_mac=$(mtd_get_mac_binary_ubi Factory 0x1006)
+		ip link set dev eth0 address $base_mac
+		ip link set dev lan1 address $base_mac
+		ip link set dev lan2 address $base_mac
+		ip link set dev lan3 address $base_mac
+		ip link set dev lan4 address $base_mac
+		ip link set dev wan address $(mtd_get_mac_binary_ubi Factory 0x9006)
 		;;
 	engenius,eap2200)
 		base_mac=$(cat /sys/class/net/eth0/address)
@@ -21,18 +26,15 @@ preinit_set_mac_address() {
 	linksys,ea8300|\
 	linksys,mr8300)
 		base_mac=$(mtd_get_mac_ascii devinfo hw_mac_addr)
-		ip link set dev eth0 address "$base_mac"
-		ip link set dev eth1 address $(macaddr_add "$base_mac" 1)
+		ip link set dev lan1 address $(macaddr_add "$base_mac" 1)
+		ip link set dev eth0 address $(macaddr_setbit "$base_mac" 7)
 		;;
-	meraki,mr33|\
-	meraki,mr74)
-		mac_lan=$(get_mac_binary "/sys/bus/i2c/devices/0-0050/eeprom" 0x66)
-		[ -n "$mac_lan" ] && ip link set dev eth0 address "$mac_lan"
-		;;
-	mikrotik,wap-ac)
+	mikrotik,wap-ac|\
+	mikrotik,wap-ac-lte|\
+	mikrotik,wap-r-ac)
 		base_mac=$(cat /sys/firmware/mikrotik/hard_config/mac_base)
-		ip link set dev eth0 address "$base_mac"
-		ip link set dev eth1 address $(macaddr_add "$base_mac" 1)
+		ip link set dev sw-eth1 address "$base_mac"
+		ip link set dev sw-eth2 address $(macaddr_add "$base_mac" 1)
 		;;
 	zyxel,nbg6617)
 		base_mac=$(cat /sys/class/net/eth0/address)
diff --git a/target/linux/ipq40xx/base-files/lib/upgrade/linksys.sh b/target/linux/ipq40xx/base-files/lib/upgrade/linksys.sh
index f1dc81f7c9d677..18366fc622a478 100755
--- a/target/linux/ipq40xx/base-files/lib/upgrade/linksys.sh
+++ b/target/linux/ipq40xx/base-files/lib/upgrade/linksys.sh
@@ -3,7 +3,7 @@ linksys_get_target_firmware() {
 
 	cur_boot_part="$(/usr/sbin/fw_printenv -n boot_part)"
 	if [ -z "${cur_boot_part}" ]; then
-		mtd_ubi0=$(cat /sys/devices/virtual/ubi/ubi0/mtd_num)
+		mtd_ubi0=$(cat /sys/class/ubi/ubi0/mtd_num)
 		case "$(grep -E "^mtd${mtd_ubi0}:" /proc/mtd | cut -d '"' -f 2)" in
 		kernel|rootfs)
 			cur_boot_part=1
@@ -47,6 +47,14 @@ linksys_get_target_firmware() {
 	esac
 }
 
+linksys_is_factory_image() {
+	local board=$(board_name)
+	board=${board##*,}
+
+	# check matching footer signature
+	tail -c 256 $1 | grep -q -i "\.LINKSYS\.........${board}"
+}
+
 platform_do_upgrade_linksys() {
 	local magic_long="$(get_magic_long "$1")"
 
@@ -92,11 +100,26 @@ platform_do_upgrade_linksys() {
 		fi
 
 		# complete std upgrade
-		nand_upgrade_tar "$1"
+		if nand_upgrade_tar "$1" ; then
+			nand_do_upgrade_success
+		else
+			nand_do_upgrade_failed
+		fi
+
 	}
 
 	[ "$magic_long" = "27051956" ] && {
 		echo "writing \"$1\" image to \"$part_label\""
 		get_image "$1" | mtd write - "$part_label"
 	}
+
+	[ "$magic_long" = "d00dfeed" ] && {
+		if ! linksys_is_factory_image "$1"; then
+			echo "factory image doesn't match device"
+			return 1
+		fi
+
+		echo "writing \"$1\" factory image to \"$part_label\""
+		get_image "$1" | mtd -e "$part_label" write - "$part_label"
+	}
 }
diff --git a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
index 0fa30db7cfc949..988921fa8c1976 100644
--- a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
@@ -25,7 +25,9 @@ Once this is done. Retry.
 EOF
 		return 1
 		;;
-	zte,mf286d)
+	zte,mf18a |\
+	zte,mf286d |\
+	zte,mf289f)
 		CI_UBIPART="rootfs"
 		local mtdnum="$( find_mtd_index $CI_UBIPART )"
 		[ ! "$mtdnum" ] && return 1
@@ -110,13 +112,15 @@ platform_do_upgrade() {
 	edgecore,ecw5211 |\
 	edgecore,oap100 |\
 	engenius,eap2200 |\
+	glinet,gl-a1300 |\
 	glinet,gl-ap1300 |\
 	luma,wrtq-329acn |\
 	mobipromo,cm520-79f |\
 	netgear,wac510 |\
 	p2w,r619ac-64m |\
 	p2w,r619ac-128m |\
-	qxwlan,e2600ac-c2)
+	qxwlan,e2600ac-c2 |\
+	wallys,dr40x9)
 		nand_do_upgrade "$1"
 		;;
 	glinet,gl-b2200)
@@ -162,7 +166,8 @@ platform_do_upgrade() {
 	linksys,ea6350v3 |\
 	linksys,ea8300 |\
 	linksys,mr8300 |\
-	linksys,whw01-v1)
+	linksys,whw01 |\
+	linksys,whw03v2)
 		platform_do_upgrade_linksys "$1"
 		;;
 	meraki,mr33 |\
@@ -172,9 +177,12 @@ platform_do_upgrade() {
 		;;
 	mikrotik,cap-ac|\
 	mikrotik,hap-ac2|\
+	mikrotik,hap-ac3-lte6-kit|\
 	mikrotik,lhgg-60ad|\
 	mikrotik,sxtsq-5-ac|\
-	mikrotik,wap-ac)
+	mikrotik,wap-ac|\
+	mikrotik,wap-ac-lte|\
+	mikrotik,wap-r-ac)
 		[ "$(rootfs_type)" = "tmpfs" ] && mtd erase firmware
 		default_do_upgrade "$1"
 		;;
@@ -194,8 +202,13 @@ platform_do_upgrade() {
 		PART_NAME="inactive"
 		platform_do_upgrade_dualboot_datachk "$1"
 		;;
+	sony,ncp-hg100-cellular)
+		sony_emmc_do_upgrade "$1"
+		;;
 	teltonika,rutx10 |\
-	zte,mf286d)
+	zte,mf18a |\
+	zte,mf286d |\
+	zte,mf289f)
 		CI_UBIPART="rootfs"
 		nand_do_upgrade "$1"
 		;;
diff --git a/target/linux/ipq40xx/base-files/lib/upgrade/sony.sh b/target/linux/ipq40xx/base-files/lib/upgrade/sony.sh
new file mode 100644
index 00000000000000..8ff9df0faccabe
--- /dev/null
+++ b/target/linux/ipq40xx/base-files/lib/upgrade/sony.sh
@@ -0,0 +1,91 @@
+. /lib/functions.sh
+
+update_bootconfig() {
+	local offset=$1
+	local index="$2"
+	local cfgpart=$(find_mmc_part "0:BOOTCONFIG")
+	local cur_index
+
+	if [ -z "$cfgpart" ]; then
+		echo "failed to get the partition: \"0:BOOTCONFIG\""
+		return 1
+	fi
+
+	cur_index=$(dd if=${cfgpart} bs=1 count=1 skip=$offset 2> /dev/null | hexdump -e '"%d"')
+	if [ ${index} != ${cur_index} ]; then
+		echo "updating \"0:BOOTCONFIG\""
+		echo -en "\x0${index}" | \
+			dd of=${cfgpart} bs=1 count=1 seek=$offset conv=notrunc 2>/dev/null
+	fi
+
+	# also update 0:BOOTCONFIG1 if exists
+	cfgpart=$(find_mmc_part "0:BOOTCONFIG1")
+	[ -z "$cfgpart" ] && return
+
+	cur_index=$(dd if=${cfgpart} bs=1 count=1 skip=$offset 2> /dev/null | hexdump -e '"%d"')
+	if [ ${index} != ${cur_index} ]; then
+		echo "updating \"0:BOOTCONFIG1\""
+		echo -en "\x0${index}" | \
+			dd of=${cfgpart} bs=1 count=1 seek=$offset conv=notrunc 2>/dev/null
+	fi
+}
+
+### Note ###
+# After the commit bad1835f27ec31dbc30060b03cc714212275168a in fstools,
+# p17 (label: "rootfs_data") is mounted as a rootfs_data on boot instead
+# of the loop device labeled as "rootfs_data" in p15 (label: "rootfs").
+#
+# cmdline flag is added to avoid mount "rootfs_data" partition by the
+# commit 964d1e3af0e111bad6d393f8a3be702e334c2398 in fstools, but
+# NCP-HG100 doesn't use it because it has a large (abount 1.6GB)
+# "rootfs_data" partition and the advantage is larger than the
+# disadvantages, such as overwriting the stock data in "rootfs_data"
+# partition.
+sony_emmc_do_upgrade() {
+	local tar_file=$1
+	local kernel_dev
+	local rootfs_dev
+	local board_dir
+
+	kernel_dev=$(find_mmc_part "0:HLOS")
+	rootfs_dev=$(find_mmc_part "rootfs")
+	rootfs_data_dev=$(find_mmc_part "rootfs_data")
+
+	if [ -z "$kernel_dev" ] || [ -z "$rootfs_dev" ] || [ -z "$rootfs_data_dev" ]; then
+		echo "The partition name for kernel or rootfs or rootfs_data is not specified or failed to get the mmc device."
+		exit 1
+	fi
+
+	# use first partitions of kernel/rootfs for NCP-HG100
+	# - offset  88 (0x58): 0:HLOS (kernel)
+	# - offset 108 (0x6c): rootfs
+	update_bootconfig 88 0 || exit 1
+	update_bootconfig 108 0 || exit 1
+
+	board_dir=$(tar tf $tar_file | grep -m 1 '^sysupgrade-.*/$')
+	board_dir=${board_dir%/}
+
+	echo "Flashing kernel to ${kernel_dev}"
+	tar xf $tar_file ${board_dir}/kernel -O > $kernel_dev
+
+	echo "Flashing rootfs to ${rootfs_dev}"
+	tar xf $tar_file ${board_dir}/root -O > $rootfs_dev
+
+	echo "Format new rootfs_data"
+	mkfs.ext4 -F -L rootfs_data $rootfs_data_dev
+
+	if [ -e "$UPGRADE_BACKUP" ]; then
+		mkdir /tmp/new_root
+		mount -t ext4 $rootfs_data_dev /tmp/new_root && {
+			echo "Saving configurations to rootfs_data"
+			cp "$UPGRADE_BACKUP" "/tmp/new_root/$BACKUP_FILE"
+			umount /tmp/new_root
+		}
+	fi
+
+	echo "sysupgrade successful"
+
+	sync
+	umount -a
+	reboot -f
+}
diff --git a/target/linux/ipq40xx/config-5.15 b/target/linux/ipq40xx/config-5.15
index 82a3f9f8a3bac4..d5bde551783e8b 100644
--- a/target/linux/ipq40xx/config-5.15
+++ b/target/linux/ipq40xx/config-5.15
@@ -1,7 +1,6 @@
 CONFIG_ALIGNMENT_TRAP=y
 # CONFIG_APQ_GCC_8084 is not set
 # CONFIG_APQ_MMCC_8084 is not set
-CONFIG_AR40XX_PHY=y
 CONFIG_ARCH_32BIT_OFF_T=y
 CONFIG_ARCH_HIBERNATION_POSSIBLE=y
 CONFIG_ARCH_IPQ40XX=y
@@ -145,11 +144,9 @@ CONFIG_DMA_SHARED_BUFFER=y
 CONFIG_DMA_VIRTUAL_CHANNELS=y
 CONFIG_DTC=y
 CONFIG_DT_IDLE_STATES=y
-CONFIG_DYNAMIC_DEBUG=y
 CONFIG_EDAC_ATOMIC_SCRUB=y
 CONFIG_EDAC_SUPPORT=y
 CONFIG_EEPROM_AT24=y
-CONFIG_ESSEDMA=y
 CONFIG_EXTCON=y
 CONFIG_FIXED_PHY=y
 CONFIG_FIX_EARLYCON_MEM=y
@@ -187,6 +184,7 @@ CONFIG_GPIO_74X164=y
 CONFIG_GPIO_CDEV=y
 CONFIG_GPIO_WATCHDOG=y
 CONFIG_GPIO_WATCHDOG_ARCH_INITCALL=y
+CONFIG_GRO_CELLS=y
 CONFIG_HANDLE_DOMAIN_IRQ=y
 CONFIG_HARDEN_BRANCH_PREDICTOR=y
 CONFIG_HARDIRQS_SW_RESEND=y
@@ -212,7 +210,6 @@ CONFIG_INITRAMFS_SOURCE=""
 # CONFIG_IOMMU_IO_PGTABLE_ARMV7S is not set
 # CONFIG_IOMMU_IO_PGTABLE_LPAE is not set
 CONFIG_IOMMU_SUPPORT=y
-CONFIG_IO_URING=y
 # CONFIG_IPQ_APSS_PLL is not set
 CONFIG_IPQ_GCC_4019=y
 # CONFIG_IPQ_GCC_6018 is not set
@@ -296,15 +293,21 @@ CONFIG_MTD_UBI_WL_THRESHOLD=4096
 CONFIG_MUTEX_SPIN_ON_OWNER=y
 CONFIG_NEED_DMA_MAP_STATE=y
 CONFIG_NEON=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_QCA8K_IPQ4019=y
+CONFIG_NET_DSA_TAG_IPQ4019=y
 CONFIG_NET_FLOW_LIMIT=y
 CONFIG_NET_PTP_CLASSIFY=y
 CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
 CONFIG_NLS=y
 CONFIG_NO_HZ=y
 CONFIG_NO_HZ_COMMON=y
 CONFIG_NO_HZ_IDLE=y
 CONFIG_NR_CPUS=4
 CONFIG_NVMEM=y
+CONFIG_NVMEM_QCOM_QFPROM=y
 # CONFIG_NVMEM_SPMI_SDAM is not set
 CONFIG_NVMEM_SYSFS=y
 CONFIG_OF=y
@@ -335,6 +338,7 @@ CONFIG_PCI_MSI_IRQ_DOMAIN=y
 CONFIG_PERF_USE_VMALLOC=y
 CONFIG_PGTABLE_LEVELS=2
 CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
 # CONFIG_PHY_QCOM_APQ8064_SATA is not set
 CONFIG_PHY_QCOM_IPQ4019_USB=y
 # CONFIG_PHY_QCOM_IPQ806X_SATA is not set
@@ -389,10 +393,10 @@ CONFIG_QCOM_BAM_DMA=y
 # CONFIG_QCOM_GSBI is not set
 # CONFIG_QCOM_HFPLL is not set
 # CONFIG_QCOM_IOMMU is not set
+CONFIG_QCOM_IPQ4019_ESS_EDMA=y
 # CONFIG_QCOM_LLCC is not set
 # CONFIG_QCOM_OCMEM is not set
 # CONFIG_QCOM_PDC is not set
-CONFIG_QCOM_QFPROM=y
 # CONFIG_QCOM_RMTFS_MEM is not set
 # CONFIG_QCOM_RPMH is not set
 CONFIG_QCOM_SCM=y
@@ -466,8 +470,6 @@ CONFIG_SPMI=y
 CONFIG_SPMI_MSM_PMIC_ARB=y
 # CONFIG_SPMI_PMIC_CLKDIV is not set
 CONFIG_SRCU=y
-CONFIG_SWCONFIG=y
-CONFIG_SWCONFIG_LEDS=y
 CONFIG_SWPHY=y
 CONFIG_SWP_EMULATE=y
 CONFIG_SYS_SUPPORTS_APM_EMULATION=y
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-a42.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-a42.dts
index f571da510eea6d..b6ff09a0420066 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-a42.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-a42.dts
@@ -17,14 +17,6 @@
 			status = "okay";
 		};
 
-		mdio@90000 {
-			status = "okay";
-		};
-
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@194b000 {
 			/* select hostmode */
 			compatible = "qcom,tcsr";
@@ -62,14 +54,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -87,6 +71,7 @@
 		led-failsafe = &led_status_green;
 		led-running = &led_status_green;
 		led-upgrade = &led_status_green;
+		label-mac-device = &swport5;
 	};
 
 	leds {
@@ -160,7 +145,32 @@
 		compatible = "jedec,spi-nor";
 		reg = <0>;
 		spi-max-frequency = <24000000>;
+
 		/* partitions are passed via bootloader */
+		partitions {
+			partition-art {
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+				label = "0:ART";
+
+				precal_art_1000: precal@1000 {
+					reg = <0x1000 0x2f20>;
+				};
+
+				precal_art_5000: precal@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+
+				macaddr_gmac0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_gmac1: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+			};
+		};
 	};
 };
 
@@ -174,32 +184,50 @@
 	status = "okay";
 };
 
-&gmac0 {
-	qcom,phy_mdio_addr = <4>;
-	qcom,poll_required = <1>;
-	qcom,forced_speed = <1000>;
-	qcom,forced_duplex = <1>;
-	vlan_tag = <2 0x20>;
+&usb2_hs_phy {
+	status = "okay";
 };
 
-&gmac1 {
-	qcom,phy_mdio_addr = <3>;
-	qcom,poll_required = <1>;
-	qcom,forced_speed = <1000>;
-	qcom,forced_duplex = <1>;
-	vlan_tag = <1 0x10>;
+&mdio {
+	status = "okay";
 };
 
-&usb2_hs_phy {
+&gmac {
+	status = "okay";
+};
+
+&switch {
 	status = "okay";
 };
 
+&swport4 {
+	status = "okay";
+	label = "ethernet2";
+
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_gmac1>;
+};
+
+&swport5 {
+	status = "okay";
+	label = "ethernet1";
+
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_gmac0>;
+};
+
 &wifi0 {
 	status = "okay";
 	qcom,ath10k-calibration-variant = "OM-A42";
+
+	nvmem-cell-names = "pre-calibration";
+	nvmem-cells = <&precal_art_1000>;
 };
 
 &wifi1 {
 	status = "okay";
 	qcom,ath10k-calibration-variant = "OM-A42";
+
+	nvmem-cell-names = "pre-calibration";
+	nvmem-cells = <&precal_art_5000>;
 };
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-ap120c-ac.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-ap120c-ac.dts
index b2d8aa49993587..def0401ac5c9f3 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-ap120c-ac.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-ap120c-ac.dts
@@ -14,6 +14,7 @@
 		led-failsafe = &status;
 		led-running = &status;
 		led-upgrade = &status;
+		ethernet1 = &swport5;
 	};
 
 	keys {
@@ -65,10 +66,6 @@
 			pinctrl-names = "default";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		counter@4a1000 {
 			compatible = "qcom,qca-gcnt";
 			reg = <0x4a1000 0x4>;
@@ -118,17 +115,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-
-			switch_lan_bmp = <0x10>;
-			switch_wan_bmp = <0x20>;
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 };
 
@@ -277,22 +263,6 @@
 	#gpio-cells = <2>;
 };
 
-&gmac0 {
-	qcom,forced_duplex = <1>;
-	qcom,forced_speed = <1000>;
-	qcom,phy_mdio_addr = <3>;
-	qcom,poll_required = <1>;
-	vlan_tag = <1 0x10>;
-};
-
-&gmac1 {
-	qcom,forced_duplex = <1>;
-	qcom,forced_speed = <1000>;
-	qcom,phy_mdio_addr = <4>;
-	qcom,poll_required = <1>;
-	vlan_tag = <2 0x20>;
-};
-
 &tlmm {
 	i2c0_pins: i2c0_pinmux {
 		mux_i2c {
@@ -351,6 +321,24 @@
 	status = "okay";
 };
 
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+
+	label = "lan";
+};
+
+&swport5 {
+	status = "okay";
+};
+
 &wifi0 {
 	status = "okay";
 	nvmem-cell-names = "pre-calibration";
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-cap-ac.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-cap-ac.dts
index b18ba4d46a2798..0609324310888d 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-cap-ac.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-cap-ac.dts
@@ -61,16 +61,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-			qcom,poll_required = <0>;
-			qcom,num_gmac = <1>;
-		};
 	};
 
 	keys {
@@ -222,10 +212,6 @@
 	status = "okay";
 };
 
-&gmac0 {
-	vlan_tag = <0 0x3f>;
-};
-
 &ethphy3 {
 	gpio-controller;
 	#gpio-cells = <2>;
@@ -236,6 +222,24 @@
 	#gpio-cells = <2>;
 };
 
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+
+	label = "lan";
+};
+
+&swport5 {
+	status = "okay";
+};
+
 &wifi0 {
 	status = "okay";
 
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-cs-w3-wd1200g-eup.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-cs-w3-wd1200g-eup.dts
index 52311755b743f9..22a48c12c44ef4 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-cs-w3-wd1200g-eup.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-cs-w3-wd1200g-eup.dts
@@ -29,10 +29,6 @@
 			reset-delay-us = <5000>;
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -64,14 +60,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	leds {
@@ -251,6 +239,42 @@
 	status = "okay";
 };
 
+&gmac {
+	status = "okay";
+	nvmem-cells = <&macaddr_art_0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport2 {
+	status = "okay";
+	label = "lan3";
+};
+
+&swport3 {
+	status = "okay";
+	label = "lan2";
+};
+
+&swport4 {
+	status = "okay";
+	label = "lan1";
+};
+
+&swport5 {
+	status = "okay";
+	label = "wan";
+	nvmem-cells = <&macaddr_art_6>;
+	nvmem-cell-names = "mac-address";
+};
+
+&ethphy0 {
+	status = "disabled";
+};
+
 &wifi0 {
 	status = "okay";
 	qcom,ath10k-calibration-variant = "ezviz-cs-w3-wd1200g-eup";
@@ -264,13 +288,3 @@
 	nvmem-cell-names = "pre-calibration";
 	nvmem-cells = <&precal_art_5000>;
 };
-
-&gmac0 {
-	nvmem-cell-names = "mac-address";
-	nvmem-cells = <&macaddr_art_6>;
-};
-
-&gmac1 {
-	nvmem-cell-names = "mac-address";
-	nvmem-cells = <&macaddr_art_0>;
-};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-dap-2610.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-dap-2610.dts
index e3afddb37680b3..493905d56d8f0a 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-dap-2610.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-dap-2610.dts
@@ -17,11 +17,6 @@
 	};
 
 	soc {
-		edma@c080000 {
-			qcom,num_gmac = <1>;
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -51,16 +46,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-			switch_lan_bmp = <0x20>;
-			switch_wan_bmp = <0x00>;
-		};
-
-		ess-psgmii@98000 {
-			status = "okay";
-		};
 	};
 
 	leds {
@@ -192,18 +177,24 @@
 	status = "okay";
 };
 
-&gmac0 {
-	qcom,phy_mdio_addr = <4>;
-	qcom,poll_required = <1>;
-	qcom,forced_speed = <1000>;
-	qcom,forced_duplex = <1>;
-	vlan_tag = <1 0x20>;
+&mdio {
+	status = "okay";
 };
 
-&mdio {
+&gmac {
+	status = "okay";
+};
+
+&switch {
 	status = "okay";
 };
 
+&swport5 {
+	status = "okay";
+
+	label = "lan";
+};
+
 &tlmm {
 	serial_pins: serial_pinmux {
 		mux {
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-ea6350v3.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-ea6350v3.dts
index a99aa90b61f7d3..cd5b4c6ccc3754 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-ea6350v3.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-ea6350v3.dts
@@ -25,10 +25,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -68,14 +64,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -114,6 +102,34 @@
 	status = "okay";
 };
 
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport1 {
+	status = "okay";
+};
+
+&swport2 {
+	status = "okay";
+};
+
+&swport3 {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+};
+
+&swport5 {
+	status = "okay";
+};
+
 &wifi0 {
 	status = "okay";
 	nvmem-cell-names = "pre-calibration";
@@ -253,17 +269,17 @@
 				label = "kernel";
 				reg = <0x00000000 0x02800000>;
 			};
-			rootfs@300000 {
+			rootfs@500000 {
 				label = "rootfs";
-				reg = <0x00300000 0x02500000>;
+				reg = <0x00500000 0x02300000>;
 			};
 			alt_kernel@2800000 {
 				label = "alt_kernel";
 				reg = <0x02800000 0x02800000>;
 			};
-			alt_rootfs@2b00000 {
+			alt_rootfs@2d00000 {
 				label = "alt_rootfs";
-				reg = <0x02b00000 0x02500000>;
+				reg = <0x02d00000 0x02300000>;
 			};
 			sysdiag@5000000 {
 				label = "sysdiag";
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-eap1300.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-eap1300.dts
index 6a7f4e5b0f41f5..a8f24aa00e60e3 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-eap1300.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-eap1300.dts
@@ -18,10 +18,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -47,14 +43,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -227,14 +215,6 @@
 	status = "okay";
 };
 
-&gmac0 {
-	vlan_tag = <2 0x20>;
-};
-
-&gmac1 {
-	vlan_tag = <1 0x10>;
-};
-
 &wifi0 {
 	status = "okay";
 	nvmem-cell-names = "pre-calibration";
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-ecw5211.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-ecw5211.dts
index 6f4d7b5f32e9cf..3060b7bd1c803c 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-ecw5211.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-ecw5211.dts
@@ -14,7 +14,8 @@
 		led-failsafe = &led_power;
 		led-running = &led_power;
 		led-upgrade = &led_power;
-		label-mac-device = &gmac0;
+		ethernet0 = &swport5;
+		ethernet1 = &gmac;
 	};
 
 	chosen {
@@ -57,10 +58,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		counter@4a1000 {
 			compatible = "qcom,qca-gcnt";
 			reg = <0x4a1000 0x4>;
@@ -110,17 +107,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-
-			switch_lan_bmp = <0x10>;
-			switch_wan_bmp = <0x20>;
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 };
 
@@ -303,16 +289,22 @@
 	pinctrl-names = "default";
 };
 
-&gmac0 {
-	qcom,poll_required = <1>;
-	qcom,phy_mdio_addr = <4>;
-	vlan_tag = <2 0x20>;
+&gmac {
+	status = "okay";
 };
 
-&gmac1 {
-	qcom,poll_required = <1>;
-	qcom,phy_mdio_addr = <3>;
-	vlan_tag = <1 0x10>;
+&switch {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+
+	label = "lan";
+};
+
+&swport5 {
+	status = "okay";
 };
 
 &wifi0 {
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-emd1.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-emd1.dts
index b405867134973f..396595ba5185c5 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-emd1.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-emd1.dts
@@ -25,10 +25,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -54,17 +50,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-			switch_lan_bmp = <0x20>;
-			switch_wan_bmp = <0x00>;
-		};
-
-		edma@c080000 {
-			status = "okay";
-			qcom,num_gmac = <1>;
-		};
 	};
 
 	keys {
@@ -210,14 +195,6 @@
 	status = "okay";
 };
 
-&gmac0 {
-	qcom,phy_mdio_addr = <4>;
-	qcom,poll_required = <1>;
-	qcom,forced_speed = <1000>;
-	qcom,forced_duplex = <1>;
-	vlan_tag = <1 0x20>;
-};
-
 &cryptobam {
 	status = "okay";
 };
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-emr3500.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-emr3500.dts
index 848e5c23638517..3616149451456d 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-emr3500.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-emr3500.dts
@@ -18,10 +18,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -51,14 +47,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -212,14 +200,6 @@
 	status = "okay";
 };
 
-&gmac0 {
-	vlan_tag = <1 0x10>;
-};
-
-&gmac1 {
-	vlan_tag = <2 0x20>;
-};
-
 &usb2_hs_phy {
 	status = "okay";
 };
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-ens620ext.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-ens620ext.dts
index b765d68b51ca1f..69275e24b8cd31 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-ens620ext.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-ens620ext.dts
@@ -26,14 +26,6 @@
 			status = "okay";
 		};
 
-		mdio@90000 {
-			status = "okay";
-		};
-
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -60,14 +52,6 @@
 			status = "okay";
 		};
 
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
-
 		/*
 		 * Disable the broken restart as a workaround for the buggy
 		 * 3.0.0/3.0.1 U-boots that ship with the device.
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-ex61x0v2.dtsi b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-ex61x0v2.dtsi
index eb97130c27d84c..dc5c25c84ab704 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-ex61x0v2.dtsi
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-ex61x0v2.dtsi
@@ -33,10 +33,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -62,15 +58,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-			qcom,num_gmac = <1>;
-		};
 	};
 
 	aliases {
@@ -78,7 +65,7 @@
 		led-failsafe = &power_amber;
 		led-running = &power_green;
 		led-upgrade = &power_amber;
-		label-mac-device = &gmac0;
+		label-mac-device = &gmac;
 	};
 
 	keys {
@@ -337,3 +324,16 @@
 	nvmem-cell-names = "pre-calibration", "mac-address";
 	nvmem-cells = <&precal_art_5000>, <&macaddr_dnidata_c>;
 };
+
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+	label = "lan";
+};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-fritzbox-4040.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-fritzbox-4040.dts
index 77b1810f09c6a7..e448206c369e22 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-fritzbox-4040.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-fritzbox-4040.dts
@@ -14,7 +14,6 @@
 		led-failsafe = &flash;
 		led-running = &power;
 		led-upgrade = &flash;
-		label-mac-device = &gmac0;
 	};
 
 	soc {
@@ -26,10 +25,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -69,14 +64,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -286,6 +273,34 @@
 	#gpio-cells = <2>;
 };
 
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport1 {
+	status = "okay";
+};
+
+&swport2 {
+	status = "okay";
+};
+
+&swport3 {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+};
+
+&swport5 {
+	status = "okay";
+};
+
 &usb3_ss_phy {
 	status = "okay";
 };
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-gl-a1300.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-gl-a1300.dts
new file mode 100644
index 00000000000000..ad3d1ac120a584
--- /dev/null
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-gl-a1300.dts
@@ -0,0 +1,334 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq4019.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	model = "GL.iNet GL-A1300";
+	compatible = "glinet,gl-a1300", "qcom,ipq4019";
+
+	aliases {
+		led-boot = &led_run;
+		led-failsafe = &led_run;
+		led-running = &led_run;
+		led-upgrade = &led_run;
+		label-mac-device = &swport4;
+	};
+
+	chosen {
+		bootargs-append = " ubi.mtd=ubi root=/dev/ubiblock0_1";
+	};
+
+	soc {
+		tcsr@1949000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1949000 0x100>;
+			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
+		};
+
+		tcsr@194b000 {
+			/* select hostmode */
+			compatible = "qcom,tcsr";
+			reg = <0x194b000 0x100>;
+			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
+			status = "okay";
+		};
+
+		ess_tcsr@1953000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1953000 0x1000>;
+			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
+		};
+
+		tcsr@1957000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1957000 0x100>;
+			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 63 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		switch {
+			label = "switch-button";
+			gpios = <&tlmm 0 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_SETUP>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_run: blue {
+			label = "blue:status";
+			gpios = <&tlmm 2 GPIO_ACTIVE_HIGH>;
+		};
+
+		white {
+			label = "white:status";
+			gpios = <&tlmm 1 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	gpio_export {
+		compatible = "gpio-export";
+
+		usb {
+			gpio-export,name = "usb_power";
+			gpio-export,output = <1>;
+			gpios = <&tlmm 4 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&prng {
+	status = "okay";
+};
+
+&mdio {
+	status = "okay";
+};
+
+&blsp_dma {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&blsp1_spi1 {
+	status = "okay";
+
+	pinctrl-0 = <&spi0_pins>;
+	pinctrl-names = "default";
+	cs-gpios = <&tlmm 54 GPIO_ACTIVE_HIGH>, <&tlmm 5 GPIO_ACTIVE_HIGH>;
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <24000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "SBL1";
+				reg = <0x00000000 0x00040000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "MIBIB";
+				reg = <0x00040000 0x00020000>;
+				read-only;
+			};
+
+			partition@60000 {
+				label = "QSEE";
+				reg = <0x00060000 0x00060000>;
+				read-only;
+			};
+
+			partition@c0000 {
+				label = "CDT";
+				reg = <0x000c0000 0x00010000>;
+				read-only;
+			};
+
+			partition@d0000 {
+				label = "DDRPARAMS";
+				reg = <0x000d0000 0x00010000>;
+				read-only;
+			};
+
+			partition@e0000 {
+				label = "APPSBLENV"; /* uboot env*/
+				reg = <0x000e0000 0x00010000>;
+			};
+
+			partition@f0000 {
+				label = "APPSBL"; /* uboot */
+				reg = <0x000f0000 0x00080000>;
+				read-only;
+			};
+
+			partition@170000 {
+				label = "ART";
+				reg = <0x00170000 0x00010000>;
+				read-only;
+				compatible = "nvmem-cells";
+
+				precal_art_1000: precal@1000 {
+					reg = <0x1000 0x2f20>;
+				};
+
+				precal_art_5000: precal@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+
+				macaddr_gmac0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_gmac1: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+			};
+
+			partition@180000 {
+				label = "log";
+				reg = <0x00180000 0x00020000>;
+			};
+		};
+	};
+
+	spi-nand@1 {
+		compatible = "spi-nand";
+		reg = <1>;
+		spi-max-frequency = <24000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "ubi";
+				reg = <0x00000000 0x08000000>;
+			};
+		};
+	};
+};
+
+&blsp1_uart1 {
+	pinctrl-0 = <&serial_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&tlmm {
+	serial_pins: serial_pinmux {
+		mux {
+			pins = "gpio60", "gpio61";
+			function = "blsp_uart0";
+			bias-disable;
+		};
+	};
+
+	i2c_0_pins: i2c_0_pinmux {
+		pinmux {
+			pins = "gpio58", "gpio59";
+			function = "blsp_i2c0";
+			bias-disable;
+		};
+	};
+
+	spi0_pins: spi0_pinmux {
+		mux_spi {
+			function = "blsp_spi0";
+			pins = "gpio55", "gpio56", "gpio57";
+			drive-strength = <12>;
+			bias-disable;
+		};
+
+		mux_cs {
+			function = "gpio";
+			pins = "gpio54", "gpio5";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+};
+
+&blsp1_i2c3 {
+	status = "okay";
+	pinctrl-0 = <&i2c_0_pins>;
+	pinctrl-names = "default";
+};
+
+&usb2 {
+	status = "okay";
+};
+
+&usb3 {
+	status = "okay";
+};
+
+&usb2_hs_phy {
+	status = "okay";
+};
+
+&usb3_hs_phy {
+	status = "okay";
+};
+
+&usb3_ss_phy {
+	status = "okay";
+};
+
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport3 {
+	status = "okay";
+
+	label = "lan2";
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_gmac0>;
+	mac-address-increment = <2>;
+};
+
+&swport4 {
+	status = "okay";
+
+	label = "lan1";
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_gmac0>;
+};
+
+&swport5 {
+	status = "okay";
+
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_gmac1>;
+};
+
+&wifi0 {
+	status = "okay";
+	nvmem-cell-names = "pre-calibration";
+	nvmem-cells = <&precal_art_1000>;
+	qcom,ath10k-calibration-variant = "GL-A1300";
+};
+
+&wifi1 {
+	status = "okay";
+	nvmem-cell-names = "pre-calibration";
+	nvmem-cells = <&precal_art_5000>;
+	qcom,ath10k-calibration-variant = "GL-A1300";
+};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-gl-ap1300.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-gl-ap1300.dts
index b96f014dd26b7e..6f5d4d8a5784f3 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-gl-ap1300.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-gl-ap1300.dts
@@ -14,7 +14,6 @@
 		led-failsafe = &led_power;
 		led-running = &led_power;
 		led-upgrade = &led_power;
-		label-mac-device = &gmac0;
 	};
 
 	memory {
@@ -35,10 +34,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -80,16 +75,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-			switch_lan_bmp = <0x18>;
-			switch_wan_bmp = <0x20>;
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -106,13 +91,13 @@
 		compatible = "gpio-leds";
 
 		led_power: power {
-			label = "green:power";
+			label = "white:power";
 			gpios = <&tlmm 2 GPIO_ACTIVE_HIGH>;
 			default-state = "on";
 		};
 
 		wan {
-			label = "green:wan";
+			label = "white:wan";
 			gpios = <&tlmm 3 GPIO_ACTIVE_HIGH>;
 		};
 	};
@@ -194,6 +179,14 @@
 				#address-cells = <1>;
 				#size-cells = <1>;
 
+				macaddr_art_0: mac-address@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_art_6: mac-address@6 {
+					reg = <0x6 0x6>;
+				};
+
 				precal_art_1000: precal@1000 {
 					reg = <0x1000 0x2f20>;
 				};
@@ -270,6 +263,30 @@
 	status = "okay";
 };
 
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+	label = "lan";
+
+	nvmem-cells = <&macaddr_art_0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&swport5 {
+	status = "okay";
+	label = "wan";
+
+	nvmem-cells = <&macaddr_art_6>;
+	nvmem-cell-names = "mac-address";
+};
+
 &wifi0 {
 	status = "okay";
 	nvmem-cell-names = "pre-calibration";
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-hap-ac2.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-hap-ac2.dts
index b5818cef39a0a2..c8868d8b301c97 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-hap-ac2.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-hap-ac2.dts
@@ -78,14 +78,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -259,6 +251,38 @@
 	qcom,single-led-10;
 };
 
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport1 {
+	status = "okay";
+	label = "lan4";
+};
+
+&swport2 {
+	status = "okay";
+	label = "lan3";
+};
+
+&swport3 {
+	status = "okay";
+	label = "lan2";
+};
+
+&swport4 {
+	status = "okay";
+	label = "lan1";
+};
+
+&swport5 {
+	status = "okay";
+};
+
 &wifi0 {
 	status = "okay";
 
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-jalapeno.dtsi b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-jalapeno.dtsi
index da09e53cc3a747..4d09e86dd66fe2 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-jalapeno.dtsi
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-jalapeno.dtsi
@@ -7,6 +7,10 @@
 #include <dt-bindings/soc/qcom,tcsr.h>
 
 / {
+	aliases {
+		ethernet1 = &swport5;
+	};
+
 	soc {
 		rng@22000 {
 			status = "okay";
@@ -19,10 +23,6 @@
 			pinctrl-names = "default";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		counter@4a1000 {
 			compatible = "qcom,qca-gcnt";
 			reg = <0x4a1000 0x4>;
@@ -69,16 +69,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-
-			switch_lan_bmp = <0x10>; /* lan port bitmap */
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 };
 
@@ -241,18 +231,22 @@
 	status = "okay";
 };
 
-&gmac0 {
-	qcom,poll_required = <1>;
-	qcom,poll_required_dynamic = <1>;
-	qcom,phy_mdio_addr = <3>;
-	vlan_tag = <1 0x10>;
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+
+	label = "lan";
 };
 
-&gmac1 {
-	qcom,poll_required = <1>;
-	qcom,poll_required_dynamic = <1>;
-	qcom,phy_mdio_addr = <4>;
-	vlan_tag = <2 0x20>;
+&swport5 {
+	status = "okay";
 };
 
 &wifi0 {
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-magic-2-wifi-next.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-magic-2-wifi-next.dts
index 2709aef5026080..29d51aa9e1c57e 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-magic-2-wifi-next.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-magic-2-wifi-next.dts
@@ -24,13 +24,6 @@
 			pinctrl-names = "default";
 			reset-gpios = <&tlmm 59 GPIO_ACTIVE_LOW>;
 			reset-delay-us = <2000>;
-
-			/delete-node/ ethernet-phy@0;
-			/delete-node/ ethernet-phy@1;
-		};
-
-		ess-psgmii@98000 {
-			status = "okay";
 		};
 
 		crypto@8e3a000 {
@@ -41,42 +34,6 @@
 			status = "okay";
 		};
 
-		ess-switch@c000000 {
-			status = "okay";
-			switch_lan_bmp = <0x3e>;
-			switch_wan_bmp = <0x0>;
-		};
-
-		edma@c080000 {
-			status = "okay";
-			qcom,num_gmac = <3>;
-
-			gmac0 {
-				qcom,phy_mdio_addr = <3>;
-				qcom,poll_required = <1>;
-				/delete-property/ qcom,forced_speed;
-				/delete-property/ qcom,forced_duplex;
-				vlan_tag = <1 0x10>;
-			};
-
-			gmac1 {
-				qcom,phy_mdio_addr = <2>;
-				qcom,poll_required = <1>;
-				/delete-property/ qcom,forced_speed;
-				/delete-property/ qcom,forced_duplex;
-				vlan_tag = <1 0x08>;
-			};
-
-			gmac2 {
-				local-mac-address = [00 00 00 00 00 00];
-				qcom,phy_mdio_addr = <4>;
-				qcom,poll_required = <1>;
-				/delete-property/ qcom,forced_speed;
-				/delete-property/ qcom,forced_duplex;
-				vlan_tag = <1 0x20>;
-			};
-		};
-
 		gpio_export {
 			compatible = "gpio-export";
 			#size-cells = <0>;
@@ -192,6 +149,14 @@
 	status = "okay";
 };
 
+&ethphy0 {
+	status = "disabled";
+};
+
+&ethphy1 {
+	status = "disabled";
+};
+
 &wifi0 {
 	status = "okay";
 	qcom,ath10k-calibration-variant = "devolo,magic-2-wifi-next";
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-nbg6617.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-nbg6617.dts
index caafc1beb44d58..ff7252d696ecfe 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-nbg6617.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-nbg6617.dts
@@ -35,10 +35,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -103,14 +99,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -314,6 +302,42 @@
 	status = "okay";
 };
 
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport1 {
+	status = "okay";
+
+	label = "lan4";
+};
+
+&swport2 {
+	status = "okay";
+
+	label = "lan3";
+};
+
+&swport3 {
+	status = "okay";
+
+	label = "lan2";
+};
+
+&swport4 {
+	status = "okay";
+
+	label = "lan1";
+};
+
+&swport5 {
+	status = "okay";
+};
+
 &wifi0 {
 	status = "okay";
 	qcom,ath10k-calibration-variant = "ZyXEL-NBG6617";
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-pa1200.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-pa1200.dts
index bcb9552ce777d1..af4a7b196ba002 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-pa1200.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-pa1200.dts
@@ -17,14 +17,6 @@
 			status = "okay";
 		};
 
-		mdio@90000 {
-			status = "okay";
-		};
-
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@194b000 {
 			/* select hostmode */
 			compatible = "qcom,tcsr";
@@ -62,14 +54,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -87,6 +71,7 @@
 		led-failsafe = &led_status_yellow;
 		led-running = &led_status_cyan;
 		led-upgrade = &led_status_yellow;
+		label-mac-device = &swport5;
 	};
 
 	leds {
@@ -152,7 +137,32 @@
 		compatible = "jedec,spi-nor";
 		reg = <0>;
 		spi-max-frequency = <24000000>;
+
 		/* partitions are passed via bootloader */
+		partitions {
+			partition-art {
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+				label = "0:ART";
+
+				precal_art_1000: precal@1000 {
+					reg = <0x1000 0x2f20>;
+				};
+
+				precal_art_5000: precal@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+
+				macaddr_gmac0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_gmac1: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+			};
+		};
 	};
 };
 
@@ -166,32 +176,50 @@
 	status = "okay";
 };
 
-&gmac0 {
-	qcom,phy_mdio_addr = <4>;
-	qcom,poll_required = <1>;
-	qcom,forced_speed = <1000>;
-	qcom,forced_duplex = <1>;
-	vlan_tag = <2 0x20>;
+&usb2_hs_phy {
+	status = "okay";
 };
 
-&gmac1 {
-	qcom,phy_mdio_addr = <3>;
-	qcom,poll_required = <1>;
-	qcom,forced_speed = <1000>;
-	qcom,forced_duplex = <1>;
-	vlan_tag = <1 0x10>;
+&mdio {
+	status = "okay";
 };
 
-&usb2_hs_phy {
+&gmac {
+	status = "okay";
+};
+
+&switch {
 	status = "okay";
 };
 
+&swport4 {
+	status = "okay";
+	label = "ethernet2";
+
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_gmac1>;
+};
+
+&swport5 {
+	status = "okay";
+	label = "ethernet1";
+
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_gmac0>;
+};
+
 &wifi0 {
 	status = "okay";
 	qcom,ath10k-calibration-variant = "PlasmaCloud-PA1200";
+
+	nvmem-cell-names = "pre-calibration";
+	nvmem-cells = <&precal_art_1000>;
 };
 
 &wifi1 {
 	status = "okay";
 	qcom,ath10k-calibration-variant = "PlasmaCloud-PA1200";
+
+	nvmem-cell-names = "pre-calibration";
+	nvmem-cells = <&precal_art_5000>;
 };
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-rt-ac58u.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-rt-ac58u.dts
index ac4d4a139ced41..87705e5f607434 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-rt-ac58u.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-rt-ac58u.dts
@@ -30,10 +30,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -84,14 +80,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -289,6 +277,34 @@
 	status = "okay";
 };
 
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport1 {
+	status = "okay";
+};
+
+&swport2 {
+	status = "okay";
+};
+
+&swport3 {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+};
+
+&swport5 {
+	status = "okay";
+};
+
 &wifi0 {
 	status = "okay";
 	qcom,ath10k-calibration-variant = "RT-AC58U";
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-rutx.dtsi b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-rutx.dtsi
index ebb2d08e738df3..230b62a94ee3c1 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-rutx.dtsi
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-rutx.dtsi
@@ -6,10 +6,6 @@
 #include <dt-bindings/input/input.h>
 
 / {
-	aliases {
-		label-mac-device = &gmac0;
-	};
-
 	memory {
 		device_type = "memory";
 		reg = <0x80000000 0x10000000>;
@@ -188,30 +184,12 @@
 				label = "0:ART";
 				reg = <0x2e0000 0x10000>;
 				read-only;
-				compatible = "nvmem-cells";
-				#address-cells = <1>;
-				#size-cells = <1>;
-
-				precal_art_1000: precal@1000 {
-					reg = <0x1000 0x2f20>;
-				};
-
-				precal_art_5000: precal@5000 {
-					reg = <0x5000 0x2f20>;
-				};
 			};
 
 			config: partition@2f0000 {
 				label = "0:CONFIG";
 				reg = <0x2f0000 0x10000>;
 				read-only;
-				compatible = "nvmem-cells";
-				#address-cells = <1>;
-				#size-cells = <1>;
-
-				macaddr_config_0: macaddr@0 {
-					reg = <0x0 0x6>;
-				};
 			};
 
 			partition@300000 {
@@ -267,15 +245,3 @@
 	pinctrl-names = "default";
 	phy-reset-gpio = <&tlmm 62 0>;
 };
-
-&wifi0 {
-	nvmem-cell-names = "pre-calibration", "mac-address";
-	nvmem-cells = <&precal_art_1000>, <&macaddr_config_0>;
-	mac-address-increment = <2>;
-};
-
-&wifi1 {
-	nvmem-cell-names = "pre-calibration", "mac-address";
-	nvmem-cells = <&precal_art_5000>, <&macaddr_config_0>;
-	mac-address-increment = <3>;
-};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-rutx10.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-rutx10.dts
index d1d632568c6c9b..31d14aa6ae1847 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-rutx10.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-rutx10.dts
@@ -24,3 +24,13 @@
 		};
 	};
 };
+
+&wifi0 {
+	status = "okay";
+	qcom,ath10k-calibration-variant = "Teltonika-RUTX10";
+};
+
+&wifi1 {
+	status = "okay";
+	qcom,ath10k-calibration-variant = "Teltonika-RUTX10";
+};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-sxtsq-5-ac.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-sxtsq-5-ac.dts
index 87bceecbba539f..de3fa96922e7c2 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-sxtsq-5-ac.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-sxtsq-5-ac.dts
@@ -49,7 +49,7 @@
 		ess_tcsr@1953000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1953000 0x1000>;
-			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
+			qcom,ess-interface-select = <TCSR_ESS_PSGMII_RGMII4>;
 		};
 
 		tcsr@1957000 {
@@ -65,17 +65,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-			phy-mode = "rgmii";
-			qcom,num_gmac = <1>;
-			qcom,single-phy;
-		};
 	};
 
 	keys {
@@ -228,14 +217,23 @@
 	qcom,ath10k-calibration-variant = "MikroTik-SXTsq-5-ac";
 };
 
-&gmac0 {
-	qcom,phy_mdio_addr = <4>;
-	qcom,poll_required = <1>;
-	qcom,forced_speed = <1000>;
-	qcom,forced_duplex = <1>;
-	vlan_tag = <1 0x20>;
+&mdio {
+	status = "okay";
 };
 
-&mdio {
+&gmac {
 	status = "okay";
 };
+
+&switch {
+	status = "okay";
+
+	/delete-property/ psgmii-ethphy;
+};
+
+&swport5 {
+	status = "okay";
+
+	label = "lan";
+	phy-mode = "rgmii";
+};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wac510.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wac510.dts
index d7972cd53ddd24..2dbfaa086ef846 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wac510.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wac510.dts
@@ -16,7 +16,7 @@
 		led-failsafe = &led_power_amber;
 		led-running = &led_power_green;
 		led-upgrade = &led_power_amber;
-		label-mac-device = &gmac0;
+		ethernet1 = &swport5;
 	};
 
 	chosen {
@@ -28,10 +28,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		counter@4a1000 {
 			compatible = "qcom,qca-gcnt";
 			reg = <0x4a1000 0x4>;
@@ -62,14 +58,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -114,7 +102,7 @@
 
 		led_power_green: led-1 {
 			label = "green:power";
-			color = <LED_COLOR_ID_AMBER>;
+			color = <LED_COLOR_ID_GREEN>;
 			function = LED_FUNCTION_POWER;
 			gpios = <&ssr 5 GPIO_ACTIVE_LOW>;
 		};
@@ -349,6 +337,24 @@
 	status = "okay";
 };
 
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+
+	label = "lan";
+};
+
+&swport5 {
+	status = "okay";
+};
+
 &mdio {
 	status = "okay";
 
@@ -358,14 +364,6 @@
 	reset-delay-us = <2000>;
 };
 
-&gmac0 {
-	qcom,forced_duplex = <1>;
-	qcom,forced_speed = <1000>;
-	qcom,phy_mdio_addr = <3>;
-	qcom,poll_required = <1>;
-	vlan_tag = <1 0x10>;
-};
-
 &wifi0 {
 	status = "okay";
 	nvmem-cell-names = "pre-calibration", "mac-address";
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wap-ac-lte.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wap-ac-lte.dts
new file mode 100644
index 00000000000000..8ff18d92b77d8d
--- /dev/null
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wap-ac-lte.dts
@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/* Copyright (c) 2022, Alexander Couzens <lynxis@fe80.eu> */
+
+#include "qcom-ipq4018-wap-ac.dtsi"
+
+/ {
+	model = "MikroTik wAP ac LTE";
+	compatible = "mikrotik,wap-ac-lte";
+
+	soc {
+		tcsr@194b000 {
+			/* select hostmode */
+			compatible = "qcom,tcsr";
+			reg = <0x194b000 0x100>;
+			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
+			status = "okay";
+		};
+
+		usb3@8af8800 {
+			status = "okay";
+
+			dwc3@8a00000 {
+				phys = <&usb3_hs_phy>;
+				phy-names = "usb2-phy";
+			};
+		};
+	};
+};
+
+&tlmm {
+	enable-usb-power {
+		gpio-hog;
+		gpios = <2 GPIO_ACTIVE_HIGH>;
+		output-high;
+		line-name = "enable USB power";
+	};
+};
+
+&usb3_hs_phy {
+	status = "okay";
+};
+
+&usb3 {
+	status = "okay";
+};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wap-ac.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wap-ac.dts
index a77b85aa54a07f..1bfcbf1e334553 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wap-ac.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wap-ac.dts
@@ -1,221 +1,9 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 /* Copyright (c) 2020, Robert Marko <robimarko@gmail.com> */
 
-#include "qcom-ipq4019.dtsi"
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
-#include <dt-bindings/soc/qcom,tcsr.h>
+#include "qcom-ipq4018-wap-ac.dtsi"
 
 / {
 	model = "MikroTik wAP ac";
 	compatible = "mikrotik,wap-ac";
-
-	memory {
-		device_type = "memory";
-		reg = <0x80000000 0x08000000>;
-	};
-
-	chosen {
-		stdout-path = "serial0:115200n8";
-	};
-
-	aliases {
-		led-boot = &led_user;
-		led-failsafe = &led_user;
-		led-running = &led_user;
-		led-upgrade = &led_user;
-	};
-
-	soc {
-		counter@4a1000 {
-			compatible = "qcom,qca-gcnt";
-			reg = <0x4a1000 0x4>;
-		};
-
-		tcsr@1949000 {
-			compatible = "qcom,tcsr";
-			reg = <0x1949000 0x100>;
-			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
-		};
-
-		ess_tcsr@1953000 {
-			compatible = "qcom,tcsr";
-			reg = <0x1953000 0x1000>;
-			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
-		};
-
-		tcsr@1957000 {
-			compatible = "qcom,tcsr";
-			reg = <0x1957000 0x100>;
-			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
-		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
-	};
-
-	keys {
-		compatible = "gpio-keys";
-
-		reset {
-			label = "reset";
-			gpios = <&tlmm 63 GPIO_ACTIVE_LOW>;
-			linux,code = <KEY_RESTART>;
-		};
-	};
-
-	leds {
-		compatible = "gpio-leds";
-
-		power {
-			label = "blue:power";
-			gpios = <&tlmm 0 GPIO_ACTIVE_HIGH>;
-			default-state = "keep";
-		};
-
-		led_user: user {
-			label = "green:user";
-			gpios = <&tlmm 3 GPIO_ACTIVE_HIGH>;
-			panic-indicator;
-		};
-	};
-};
-
-&prng {
-	status = "okay";
-};
-
-&tlmm {
-	serial_pins: serial_pinmux {
-		mux {
-			pins = "gpio60", "gpio61";
-			function = "blsp_uart0";
-			bias-disable;
-		};
-	};
-
-	spi_0_pins: spi_0_pinmux {
-		pin {
-			function = "blsp_spi0";
-			pins = "gpio55", "gpio56", "gpio57";
-			drive-strength = <2>;
-			bias-disable;
-		};
-		pin_cs {
-			function = "gpio";
-			pins = "gpio54";
-			drive-strength = <2>;
-			bias-disable;
-			output-high;
-		};
-	};
-};
-
-&blsp_dma {
-	status = "okay";
-};
-
-&blsp1_spi1 {
-	status = "okay";
-
-	pinctrl-0 = <&spi_0_pins>;
-	pinctrl-names = "default";
-	cs-gpios = <&tlmm 54 GPIO_ACTIVE_HIGH>;
-
-	flash@0 {
-		reg = <0>;
-		compatible = "jedec,spi-nor";
-		spi-max-frequency = <40000000>;
-
-		partitions {
-			compatible = "fixed-partitions";
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			partition@0 {
-				label = "Qualcomm";
-				reg = <0x0 0x80000>;
-				read-only;
-			};
-
-			partition@80000 {
-				compatible = "mikrotik,routerboot-partitions";
-				#address-cells = <1>;
-				#size-cells = <1>;
-				label = "RouterBoot";
-				reg = <0x80000 0x80000>;
-
-				hard_config {
-					read-only;
-					size = <0x2000>;
-				};
-
-				dtb_config {
-					read-only;
-				};
-
-				soft_config {
-				};
-			};
-
-			partition@100000 {
-				compatible = "mikrotik,minor";
-				label = "firmware";
-				reg = <0x100000 0xf00000>;
-			};
-		};
-	};
-};
-
-&blsp1_uart1 {
-	status = "okay";
-
-	pinctrl-0 = <&serial_pins>;
-	pinctrl-names = "default";
-};
-
-&cryptobam {
-	status = "okay";
-};
-
-&crypto {
-	status = "okay";
-};
-
-&watchdog {
-	status = "okay";
-};
-
-&mdio {
-	status = "okay";
-};
-
-&gmac0 {
-	qcom,phy_mdio_addr = <4>;
-	qcom,poll_required = <1>;
-	qcom,forced_speed = <1000>;
-	qcom,forced_duplex = <1>;
-	vlan_tag = <2 0x20>;
-};
-
-&gmac1 {
-	qcom,phy_mdio_addr = <3>;
-	vlan_tag = <1 0x10>;
-};
-
-&wifi0 {
-	status = "okay";
-
-	qcom,ath10k-calibration-variant = "MikroTik-wAP-ac";
-};
-
-&wifi1 {
-	status = "okay";
-
-	qcom,ath10k-calibration-variant = "MikroTik-wAP-ac";
 };
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wap-ac.dtsi b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wap-ac.dtsi
new file mode 100644
index 00000000000000..777f46e3af25dc
--- /dev/null
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wap-ac.dtsi
@@ -0,0 +1,215 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/* Copyright (c) 2020, Robert Marko <robimarko@gmail.com> */
+
+#include "qcom-ipq4019.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	memory {
+		device_type = "memory";
+		reg = <0x80000000 0x08000000>;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	aliases {
+		led-boot = &led_user;
+		led-failsafe = &led_user;
+		led-running = &led_user;
+		led-upgrade = &led_user;
+	};
+
+	soc {
+		counter@4a1000 {
+			compatible = "qcom,qca-gcnt";
+			reg = <0x4a1000 0x4>;
+		};
+
+		tcsr@1949000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1949000 0x100>;
+			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
+		};
+
+		ess_tcsr@1953000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1953000 0x1000>;
+			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
+		};
+
+		tcsr@1957000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1957000 0x100>;
+			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 63 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		power {
+			label = "blue:power";
+			gpios = <&tlmm 0 GPIO_ACTIVE_HIGH>;
+			default-state = "keep";
+		};
+
+		led_user: user {
+			label = "green:user";
+			gpios = <&tlmm 3 GPIO_ACTIVE_HIGH>;
+			panic-indicator;
+		};
+	};
+};
+
+&prng {
+	status = "okay";
+};
+
+&tlmm {
+	serial_pins: serial_pinmux {
+		mux {
+			pins = "gpio60", "gpio61";
+			function = "blsp_uart0";
+			bias-disable;
+		};
+	};
+
+	spi_0_pins: spi_0_pinmux {
+		pin {
+			function = "blsp_spi0";
+			pins = "gpio55", "gpio56", "gpio57";
+			drive-strength = <2>;
+			bias-disable;
+		};
+		pin_cs {
+			function = "gpio";
+			pins = "gpio54";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+};
+
+&blsp_dma {
+	status = "okay";
+};
+
+&blsp1_spi1 {
+	status = "okay";
+
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+	cs-gpios = <&tlmm 54 GPIO_ACTIVE_HIGH>;
+
+	flash@0 {
+		reg = <0>;
+		compatible = "jedec,spi-nor";
+		spi-max-frequency = <40000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "Qualcomm";
+				reg = <0x0 0x80000>;
+				read-only;
+			};
+
+			partition@80000 {
+				compatible = "mikrotik,routerboot-partitions";
+				#address-cells = <1>;
+				#size-cells = <1>;
+				label = "RouterBoot";
+				reg = <0x80000 0x80000>;
+
+				hard_config {
+					read-only;
+					size = <0x2000>;
+				};
+
+				dtb_config {
+					read-only;
+				};
+
+				soft_config {
+				};
+			};
+
+			partition@100000 {
+				compatible = "mikrotik,minor";
+				label = "firmware";
+				reg = <0x100000 0xf00000>;
+			};
+		};
+	};
+};
+
+&blsp1_uart1 {
+	status = "okay";
+
+	pinctrl-0 = <&serial_pins>;
+	pinctrl-names = "default";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&mdio {
+	status = "okay";
+};
+
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+	label = "sw-eth2";
+};
+
+&swport5 {
+	status = "okay";
+	label = "sw-eth1";
+};
+
+&wifi0 {
+	status = "okay";
+
+	qcom,ath10k-calibration-variant = "MikroTik-wAP-ac";
+};
+
+&wifi1 {
+	status = "okay";
+
+	qcom,ath10k-calibration-variant = "MikroTik-wAP-ac";
+};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wap-r-ac.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wap-r-ac.dts
new file mode 100644
index 00000000000000..e7f28f23cf494a
--- /dev/null
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wap-r-ac.dts
@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/* Copyright (c) 2022, Alexander Couzens <lynxis@fe80.eu> */
+
+#include "qcom-ipq4018-wap-ac.dtsi"
+
+/ {
+	model = "MikroTik wAP R ac";
+	compatible = "mikrotik,wap-r-ac";
+
+	soc {
+		tcsr@194b000 {
+			/* select hostmode */
+			compatible = "qcom,tcsr";
+			reg = <0x194b000 0x100>;
+			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
+			status = "okay";
+		};
+
+		usb3@8af8800 {
+			status = "okay";
+
+			dwc3@8a00000 {
+				phys = <&usb3_hs_phy>;
+				phy-names = "usb2-phy";
+			};
+		};
+	};
+};
+
+&tlmm {
+	enable-usb-power {
+		gpio-hog;
+		gpios = <2 GPIO_ACTIVE_HIGH>;
+		output-high;
+		line-name = "enable USB power";
+	};
+};
+
+&usb3_hs_phy {
+	status = "okay";
+};
+
+&usb3 {
+	status = "okay";
+};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-whw01.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-whw01.dts
new file mode 100644
index 00000000000000..5859548254fc43
--- /dev/null
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-whw01.dts
@@ -0,0 +1,336 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq4019.dtsi"
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Linksys WHW01";
+	compatible = "linksys,whw01";
+
+	aliases {
+		serial0 = &blsp1_uart1;
+		led-boot = &led_system_blue;
+		led-running = &led_system_blue;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs-append = " root=/dev/ubiblock0_0";
+	};
+
+	soc {
+		keys {
+			compatible = "gpio-keys";
+
+			reset {
+				label = "reset";
+				gpios = <&tlmm 63 GPIO_ACTIVE_LOW>;
+				linux,code = <KEY_RESTART>;
+			};
+		};
+
+		ess_tcsr@1953000 {
+			status = "okay";
+		};
+	};
+};
+
+&blsp_dma {
+	status = "okay";
+};
+
+&blsp1_i2c3 {
+	status = "okay";
+	pinctrl-0 = <&i2c_0_pins>;
+	pinctrl-1 = <&i2c_0_pins>;
+	pinctrl-names = "i2c_active", "i2c_sleep";
+
+	leds@62 {
+		compatible = "nxp,pca9633";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0x62>;
+
+		/* RGB? */
+		led@0 {
+			reg = <0>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_POWER;
+		};
+
+		led@1 {
+			reg = <1>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_POWER;
+		};
+
+		led_system_blue: led@2 {
+			reg = <2>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_POWER;
+			linux,default-trigger = "default-on";
+		};
+	};
+};
+
+&blsp1_spi1 {
+	status = "okay";
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+	cs-gpios = <&tlmm 54 GPIO_ACTIVE_HIGH>, <&tlmm 4 GPIO_ACTIVE_HIGH>;
+
+	nor@0 {
+		reg = <0>;
+		compatible = "jedec,spi-nor";
+		spi-max-frequency = <24000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "0:SBL1";
+				reg = <0x0 0x40000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "0:MIBIB";
+				reg = <0x40000 0x20000>;
+				read-only;
+			};
+
+			partition@60000 {
+				label = "0:QSEE";
+				reg = <0x60000 0x60000>;
+				read-only;
+			};
+
+			partition@c0000 {
+				label = "0:CDT";
+				reg = <0xc0000 0x10000>;
+				read-only;
+			};
+
+			partition@d0000 {
+				label = "APPSBL";
+				reg = <0xd0000 0xa0000>;
+				read-only;
+			};
+
+			partition@170000 {
+				label = "0:ART";
+				reg = <0x170000 0x10000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				precal_art_1000: precal@1000 {
+					reg = <0x1000 0x2f20>;
+				};
+
+				precal_art_5000: precal@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+			};
+
+			partition@180000 {
+				label = "u_env";
+				reg = <0x180000 0x40000>;
+			};
+
+			partition@1c0000 {
+				label = "s_env";
+				reg = <0x1c0000 0x20000>;
+			};
+
+			partition@1e0000 {
+				label = "devinfo";
+				reg = <0x1e0000 0x20000>;
+				read-only;
+			};
+		};
+	};
+
+	nand@1 {
+		reg = <1>;
+		compatible = "spi-nand";
+		spi-max-frequency = <24000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "kernel";
+				reg = <0x0000000 0x5000000>;
+			};
+
+			partition@600000 {
+				label = "rootfs";
+				reg = <0x0600000 0x4a00000>;
+			};
+
+			partition@5000000 {
+				label = "alt_kernel";
+				reg = <0x5000000 0x5000000>;
+			};
+
+			partition@5600000 {
+				label = "alt_rootfs";
+				reg = <0x5600000 0x4a00000>;
+			};
+
+			partition@a000000 {
+				label = "sysdiag";
+				reg = <0xa000000 0x0200000>;
+				read-only;
+			};
+
+			partition@a200000 {
+				label = "syscfg";
+				reg = <0xa200000 0x5e00000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&blsp1_uart1 {
+	pinctrl-0 = <&serial_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&mdio {
+	status = "okay";
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	phy-reset-gpio = <&tlmm 62 GPIO_ACTIVE_HIGH>;
+};
+
+&tlmm {
+	mdio_pins: mdio_pinmux {
+		mux_mdio {
+			pins = "gpio53";
+			function = "mdio";
+			bias-pull-up;
+		};
+
+		mux_mdc {
+			pins = "gpio52";
+			function = "mdc";
+			bias-pull-up;
+		};
+	};
+
+	serial_pins: serial_pinmux {
+		mux {
+			pins = "gpio60", "gpio61";
+			function = "blsp_uart0";
+			bias-disable;
+		};
+	};
+
+	spi_0_pins: spi_0_pinmux {
+		pinmux {
+			function = "blsp_spi0";
+			pins = "gpio55", "gpio56", "gpio57";
+		};
+
+		pinmux_cs {
+			function = "gpio";
+			pins = "gpio54", "gpio4";
+		};
+
+		pinconf {
+			pins = "gpio55", "gpio56", "gpio57";
+			drive-strength = <12>;
+			bias-disable;
+		};
+
+		pinconf_cs {
+			pins = "gpio54", "gpio4";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+
+	i2c_0_pins: i2c_0_pinmux {
+		mux {
+			function = "blsp_i2c0";
+			pins = "gpio58", "gpio59";
+			bias-disable;
+		};
+	};
+
+	reset_pinmux {
+		mux {
+			pins = "gpio63";
+			bias-pull-up;
+		};
+	};
+};
+
+&usb2 {
+	status = "okay";
+};
+
+&usb2_hs_phy {
+	status = "okay";
+};
+
+&usb3 {
+	status = "okay";
+};
+
+&usb3_hs_phy {
+	status = "okay";
+};
+
+&usb3_ss_phy {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi0 {
+	status = "okay";
+	qcom,ath10k-calibration-variant = "linksys-whw01-v1";
+	nvmem-cell-names = "pre-calibration";
+	nvmem-cells = <&precal_art_1000>;
+};
+
+&wifi1 {
+	status = "okay";
+	qcom,ath10k-calibration-variant = "linksys-whw01-v1";
+	nvmem-cell-names = "pre-calibration";
+	nvmem-cells = <&precal_art_5000>;
+};
+
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+	label = "eth1";
+};
+
+&swport5 {
+	status = "okay";
+	label = "eth2";
+};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wr-1.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wr-1.dts
index be2f619b39dcc6..16951da47fc013 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wr-1.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wr-1.dts
@@ -11,7 +11,7 @@
 	compatible = "pakedge,wr-1";
 
 	aliases {
-		label-mac-device = &gmac0;
+		label-mac-device = &gmac;
 		led-boot = &led_power;
 		led-failsafe = &led_power;
 		led-running = &led_power;
@@ -60,10 +60,6 @@
 	};
 
 	soc {
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -87,14 +83,6 @@
 			reg = <0x1957000 0x100>;
 			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 };
 
@@ -190,6 +178,10 @@
 	status = "okay";
 };
 
+&gmac {
+	status = "okay";
+};
+
 &mdio {
 	status = "okay";
 };
@@ -198,6 +190,38 @@
 	status = "okay";
 };
 
+&switch {
+	status = "okay";
+};
+
+&swport1 {
+	status = "okay";
+
+	label = "lan4";
+};
+
+&swport2 {
+	status = "okay";
+
+	label = "lan3";
+};
+
+&swport3 {
+	status = "okay";
+
+	label = "lan2";
+};
+
+&swport4 {
+	status = "okay";
+
+	label = "lan1";
+};
+
+&swport5 {
+	status = "okay";
+};
+
 &tlmm {
 	key_pins: key_pinmux {
 		mux {
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wre6606.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wre6606.dts
index 8fa5a31908607c..efb267ae369225 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wre6606.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wre6606.dts
@@ -44,10 +44,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -73,15 +69,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-			qcom,num_gmac = <1>;
-		};
 	};
 
 	leds {
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wrtq-329acn.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wrtq-329acn.dts
index 5b0c8cf106900b..4694c568191459 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wrtq-329acn.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wrtq-329acn.dts
@@ -45,18 +45,6 @@
 			status = "okay";
 		};
 
-		mdio@90000 {
-			status = "okay";
-
-			/delete-node/ ethernet-phy@0;
-			/delete-node/ ethernet-phy@1;
-			/delete-node/ ethernet-phy@3;
-		};
-
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -96,17 +84,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-
-			switch_lan_bmp = <0x1e>;
-			switch_wan_bmp = <0x20>;
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 };
 
@@ -182,6 +159,14 @@
 				#address-cells = <1>;
 				#size-cells = <1>;
 
+				macaddr_art_0: macaddr@0{
+					reg = <0x0000 0x0006>;
+				};
+
+				macaddr_art_6: macaddr@6{
+					reg = <0x0006 0x0006>;
+				};
+
 				precal_art_1000: precal@1000 {
 					reg = <0x1000 0x2f20>;
 				};
@@ -224,14 +209,43 @@
 	status = "okay";
 };
 
-&gmac0 {
-	qcom,phy_mdio_addr = <2>;
-	qcom,poll_required = <1>;
+&gmac {
+	status = "okay";
 };
 
-&gmac1 {
-	qcom,phy_mdio_addr = <4>;
-	qcom,poll_required = <1>;
+&ethphy0 {
+	status = "disabled";
+};
+
+&ethphy1 {
+	status = "disabled";
+};
+
+&ethphy3 {
+	status = "disabled";
+};
+
+&mdio {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport3 {
+	status = "okay";
+
+	label = "lan";
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_art_6>;
+};
+
+&swport5 {
+	status = "okay";
+
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_art_0>;
 };
 
 &tlmm {
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-a62.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-a62.dts
index 279050fa158f6a..d3481011101454 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-a62.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-a62.dts
@@ -17,14 +17,6 @@
 			status = "okay";
 		};
 
-		mdio@90000 {
-			status = "okay";
-		};
-
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@194b000 {
 			/* select hostmode */
 			compatible = "qcom,tcsr";
@@ -62,17 +54,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			switch_lan_bmp = <0x10>;
-			switch_wan_bmp = <0x20>;
-
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -90,6 +71,7 @@
 		led-failsafe = &led_status_green;
 		led-running = &led_status_green;
 		led-upgrade = &led_status_green;
+		label-mac-device = &swport4;
 	};
 
 	leds {
@@ -170,7 +152,36 @@
 		compatible = "jedec,spi-nor";
 		reg = <0>;
 		spi-max-frequency = <24000000>;
+
 		/* partitions are passed via bootloader */
+		partitions {
+			partition-art {
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+				label = "0:ART";
+
+				precal_art_1000: precal@1000 {
+					reg = <0x1000 0x2f20>;
+				};
+
+				precal_art_5000: precal@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+
+				precal_art_9000: precal@9000 {
+					reg = <0x9000 0x2f20>;
+				};
+
+				macaddr_gmac0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_gmac1: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+			};
+		};
 	};
 };
 
@@ -184,14 +195,6 @@
 	status = "okay";
 };
 
-&gmac0 {
-	qcom,phy_mdio_addr = <3>;
-	qcom,poll_required = <1>;
-	qcom,forced_speed = <1000>;
-	qcom,forced_duplex = <1>;
-	vlan_tag = <1 0x10>;
-};
-
 &usb2_hs_phy {
 	status = "okay";
 };
@@ -213,17 +216,54 @@
 			reg = <0x00010000 0 0 0 0>;
 			qcom,ath10k-calibration-variant = "OM-A62";
 			ieee80211-freq-limit = <5170000 5350000>;
+
+			nvmem-cell-names = "pre-calibration";
+			nvmem-cells = <&precal_art_9000>;
 		};
 	};
 };
 
+&mdio {
+	status = "okay";
+};
+
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+	label = "ethernet1";
+
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_gmac0>;
+};
+
+&swport5 {
+	status = "okay";
+	label = "ethernet2";
+
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_gmac1>;
+};
+
 &wifi0 {
 	status = "okay";
 	qcom,ath10k-calibration-variant = "OM-A62";
+
+	nvmem-cell-names = "pre-calibration";
+	nvmem-cells = <&precal_art_1000>;
 };
 
 &wifi1 {
 	status = "okay";
 	qcom,ath10k-calibration-variant = "OM-A62";
 	ieee80211-freq-limit = <5470000 5875000>;
+
+	nvmem-cell-names = "pre-calibration";
+	nvmem-cells = <&precal_art_5000>;
 };
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-cm520-79f.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-cm520-79f.dts
index ba6aabdc9c1dc2..1dde17e293fd3c 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-cm520-79f.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-cm520-79f.dts
@@ -29,10 +29,6 @@
 			reset-delay-us = <1000>;
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -97,14 +93,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	led_spi {
@@ -196,16 +184,6 @@
 	status = "okay";
 };
 
-&gmac0 {
-	nvmem-cells = <&macaddr_art_1006>;
-	nvmem-cell-names = "mac-address";
-};
-
-&gmac1 {
-	nvmem-cells = <&macaddr_art_5006>;
-	nvmem-cell-names = "mac-address";
-};
-
 &nand {
 	pinctrl-0 = <&nand_pins>;
 	pinctrl-names = "default";
@@ -364,6 +342,36 @@
 	status = "okay";
 };
 
+&gmac {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_art_1006>;
+	nvmem-cell-names = "mac-address";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport3 {
+	status = "okay";
+
+	label = "lan2";
+};
+
+&swport4 {
+	status = "okay";
+
+	label = "lan1";
+};
+
+&swport5 {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_art_5006>;
+	nvmem-cell-names = "mac-address";
+};
+
 &wifi0 {
 	status = "okay";
 	nvmem-cell-names = "pre-calibration";
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-e2600ac-c1.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-e2600ac-c1.dts
index f9205c28fa4f9d..70e05c7eef3ab9 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-e2600ac-c1.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-e2600ac-c1.dts
@@ -79,6 +79,14 @@
 				precal_art_5000: precal@5000 {
 					reg = <0x5000 0x2f20>;
 				};
+
+				macaddr_gmac0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_gmac1: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
 			};
 			partition@180000 {
 				compatible = "denx,fit";
@@ -102,3 +110,27 @@
 	nvmem-cells = <&precal_art_5000>;
 	qcom,ath10k-calibration-variant = "Qxwlan-E2600AC-C1";
 };
+
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+	label = "sw-eth1";
+
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_gmac0>;
+};
+
+&swport5 {
+	status = "okay";
+
+	label = "sw-eth2";
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_gmac1>;
+};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-e2600ac-c2.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-e2600ac-c2.dts
index 1f88322a4f1e8c..2ad794e8ecb3a2 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-e2600ac-c2.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-e2600ac-c2.dts
@@ -79,6 +79,14 @@
 				precal_art_5000: precal@5000 {
 					reg = <0x5000 0x2f20>;
 				};
+
+				macaddr_gmac0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_gmac1: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
 			};
 		};
 	};
@@ -137,3 +145,35 @@
 	nvmem-cells = <&precal_art_5000>;
 	qcom,ath10k-calibration-variant = "Qxwlan-E2600AC-C2";
 };
+
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport2 {
+	status = "okay";
+	label = "sw-eth1";
+
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_gmac0>;
+};
+
+&swport4 {
+	status = "okay";
+	label = "sw-eth2";
+
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_gmac0>;
+};
+
+&swport5 {
+	status = "okay";
+
+	label = "sw-eth3";
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_gmac1>;
+};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-e2600ac.dtsi b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-e2600ac.dtsi
index 5bfb758e50dc52..9689bc566fde22 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-e2600ac.dtsi
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-e2600ac.dtsi
@@ -30,10 +30,6 @@
 			pinctrl-names = "default";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -120,14 +116,6 @@
 			status = "okay";
 		};
 
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
-
 		leds {
 			compatible = "gpio-leds";
 
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-eap2200.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-eap2200.dts
index c8112c04fea74f..dc144a15847cbf 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-eap2200.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-eap2200.dts
@@ -76,10 +76,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		crypto@8e3a000 {
 			status = "okay";
 		};
@@ -87,15 +83,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-			switch_lan_bmp = <0x10>;
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 };
 
@@ -189,10 +176,6 @@
 	status = "okay";
 };
 
-&gmac0 {
-	vlan_tag = <1 0x10>;
-};
-
 &nand {
 	pinctrl-0 = <&nand_pins>;
 	pinctrl-names = "default";
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-fritzbox-7530.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-fritzbox-7530.dts
index 27c7d071dc4c3d..336da52f27248c 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-fritzbox-7530.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-fritzbox-7530.dts
@@ -9,11 +9,15 @@
 	model = "AVM FRITZ!Box 7530";
 	compatible = "avm,fritzbox-7530";
 
+	chosen {
+		bootargs-append = " coherent_pool=4M";
+	};
+
 	aliases {
 		led-boot = &power_green;
 		led-failsafe = &info_red;
 		led-running = &power_green;
-		led-upgrade = &info_green;
+		led-upgrade = &info_red;
 	};
 
 	soc {
@@ -25,10 +29,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -64,15 +64,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-			qcom,num_gmac = <1>;
-		};
 	};
 
 	keys {
@@ -105,7 +96,7 @@
 			gpios = <&tlmm 32 GPIO_ACTIVE_LOW>;
 		};
 
-		info_green: info {
+		info {
 			label = "green:info";
 			gpios = <&tlmm 33 GPIO_ACTIVE_LOW>;
 		};
@@ -275,6 +266,30 @@
 	status = "okay";
 };
 
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport1 {
+	status = "okay";
+};
+
+&swport2 {
+	status = "okay";
+};
+
+&swport3 {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+};
+
 &wifi0 {
 	status = "okay";
 	qcom,ath10k-calibration-variant = "AVM-FRITZBox-7530";
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-fritzrepeater-1200.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-fritzrepeater-1200.dts
index 2d20d5928aeacb..723f2161c61472 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-fritzrepeater-1200.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-fritzrepeater-1200.dts
@@ -27,11 +27,9 @@
 			pinctrl-0 = <&mdio_pins>;
 			pinctrl-names = "default";
 
-			/delete-node/ ethernet-phy@1;
-			/delete-node/ ethernet-phy@2;
-			/delete-node/ ethernet-phy@3;
-			/delete-node/ ethernet-phy@4;
-			/delete-node/ psgmii-phy@5;
+			ethphy: ethernet-phy@0 {
+				reg = <0x0>;
+			};
 		};
 
 		tcsr@1949000 {
@@ -59,19 +57,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			switch_mac_mode = <0x3>; /* mac mode for RGMII RMII */
-			switch_lan_bmp = <0x0>; /* lan port bitmap */
-			switch_wan_bmp = <0x10>; /* wan port bitmap */
-		};
-
-		edma@c080000 {
-			status = "okay";
-			phy-mode = "rgmii-id";
-			qcom,num_gmac = <1>;
-			qcom,single-phy;
-		};
 	};
 
 	key {
@@ -266,8 +251,40 @@
 	qcom,ath10k-calibration-variant = "AVM-FRITZRepeater-1200";
 };
 
-&gmac0 {
-	qcom,phy_mdio_addr = <0>;
-	qcom,poll_required = <1>;
-	vlan_tag = <0 0x20>;
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+
+	/delete-property/ psgmii-ethphy;
+};
+
+&swport5 {
+	status = "okay";
+
+	label = "lan";
+	phy-handle = <&ethphy>;
+	phy-mode = "rgmii-id";
+};
+
+&ethphy1 {
+	status = "disabled";
+};
+
+&ethphy2 {
+	status = "disabled";
+};
+
+&ethphy3 {
+	status = "disabled";
+};
+
+&ethphy4 {
+	status = "disabled";
+};
+
+&psgmiiphy {
+	status = "disabled";
 };
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-fritzrepeater-3000.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-fritzrepeater-3000.dts
index 2e4bfd69bada34..8d88bc1521109f 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-fritzrepeater-3000.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-fritzrepeater-3000.dts
@@ -25,10 +25,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -54,18 +50,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-
-			switch_lan_bmp = <0x30>;
-			switch_wan_bmp = <0x02>;
-		};
-
-		edma@c080000 {
-			status = "okay";
-			qcom,num_gmac = <1>;
-		};
 	};
 
 	key {
@@ -210,10 +194,6 @@
 	};
 };
 
-&gmac0 {
-	vlan_tag = <1 0x30>;
-};
-
 &cryptobam {
 	status = "okay";
 };
@@ -267,3 +247,23 @@
 		};
 	};
 };
+
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+
+	label = "lan1";
+};
+
+&swport5 {
+	status = "okay";
+
+	label = "lan2";
+};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-gl-b2200.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-gl-b2200.dts
index 9d7259c35470b6..96ab73962e98ab 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-gl-b2200.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-gl-b2200.dts
@@ -18,6 +18,10 @@
 		bootargs-append = " root=/dev/mmcblk0p2 rw rootwait clk_ignore_unused";
 	};
 
+	aliases {
+		ethernet1 = &swport4;
+	};
+
 	soc {
 		rng@22000 {
 			status = "okay";
@@ -27,10 +31,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -60,16 +60,6 @@
 		crypto@8e3a000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-			switch_lan_bmp = <0x2e>;
-			switch_wan_bmp = <0x10>;
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -113,18 +103,6 @@
 	};
 };
 
-&gmac1 {
-	qcom,phy_mdio_addr = <3>;
-	qcom,poll_required = <1>;
-	qcom,forced_speed = <1000>;
-	qcom,forced_duplex = <1>;
-	vlan_tag = <2 0x10>;
-};
-
-&gmac0 {
-	vlan_tag = <1 0x2e>;
-};
-
 &vqmmc {
 	status = "okay";
 };
@@ -233,7 +211,7 @@
 	status = "okay";
 
 	spidev1: spi@0 {
-		compatible = "siliconlabs,si3210";
+		compatible = "silabs,si3210";
 		reg = <0>;
 		spi-max-frequency = <24000000>;
 	};
@@ -372,6 +350,26 @@
 	};
 };
 
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+
+	label = "wan";
+};
+
+&swport5 {
+	status = "okay";
+
+	label = "lan";
+};
+
 &wifi0 {
 	status = "okay";
 	nvmem-cell-names = "pre-calibration";
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-habanero-dvk.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-habanero-dvk.dts
index 2a2cfb9ac2811c..23a654dcff5a05 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-habanero-dvk.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-habanero-dvk.dts
@@ -15,6 +15,7 @@
 		led-failsafe = &led_status;
 		led-running = &led_status;
 		led-upgrade = &led_upgrade;
+		ethernet1 = &swport5;
 	};
 
 	soc {
@@ -29,10 +30,6 @@
 			pinctrl-names = "default";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		counter@4a1000 {
 			compatible = "qcom,qca-gcnt";
 			reg = <0x4a1000 0x4>;
@@ -79,14 +76,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -343,6 +332,34 @@
 	};
 };
 
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport1 {
+	status = "okay";
+};
+
+&swport2 {
+	status = "okay";
+};
+
+&swport3 {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+};
+
+&swport5 {
+	status = "okay";
+};
+
 &wifi0 {
 	status = "okay";
 	nvmem-cell-names = "pre-calibration";
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-hap-ac3-lte6-kit.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-hap-ac3-lte6-kit.dts
new file mode 100644
index 00000000000000..6459fc3b927ec9
--- /dev/null
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-hap-ac3-lte6-kit.dts
@@ -0,0 +1,312 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/* Copyright (c) 2021, Robert Marko <robimarko@gmail.com> */
+
+#include "qcom-ipq4019.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	model = "MikroTik hAP ac3 LTE6 kit";
+	compatible = "mikrotik,hap-ac3-lte6-kit";
+
+	memory {
+		device_type = "memory";
+		reg = <0x80000000 0x10000000>;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	aliases {
+		led-boot = &led_status_blue;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_blue;
+		led-upgrade = &led_status_red;
+	};
+
+	soc {
+		counter@4a1000 {
+			compatible = "qcom,qca-gcnt";
+			reg = <0x4a1000 0x4>;
+		};
+
+		tcsr@1949000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1949000 0x100>;
+			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
+		};
+
+		tcsr@194b000 {
+			/* select hostmode */
+			compatible = "qcom,tcsr";
+			reg = <0x194b000 0x100>;
+			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
+			status = "okay";
+		};
+
+		ess_tcsr@1953000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1953000 0x1000>;
+			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
+		};
+
+		tcsr@1957000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1957000 0x100>;
+			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 5 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_blue: status-blue {
+			label = "blue:status";
+			gpios = <&tlmm 0 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_red: status-red {
+			label = "red:status";
+			gpios = <&tlmm 1 GPIO_ACTIVE_HIGH>;
+			panic-indicator;
+		};
+
+		led_status_green: status-green {
+			label = "green:status";
+			gpios = <&tlmm 3 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan {
+			label = "green:wlan";
+			gpios = <&tlmm 23 GPIO_ACTIVE_HIGH>;
+		};
+
+		ethernet {
+			label = "green:ethernet";
+			gpios = <&tlmm 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan {
+			label = "green:wan";
+			gpios = <&tlmm 28 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan1 {
+			label = "green:lan1";
+			gpios = <&tlmm 29 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan2 {
+			label = "green:lan2";
+			gpios = <&tlmm 30 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan3 {
+			label = "green:lan3";
+			gpios = <&tlmm 31 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan4 {
+			label = "green:lan4";
+			gpios = <&tlmm 32 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&tlmm {
+	serial_pins: serial_pinmux {
+		mux {
+			pins = "gpio16", "gpio17";
+			function = "blsp_uart0";
+			bias-disable;
+		};
+	};
+
+	spi_0_pins: spi_0_pinmux {
+		pin {
+			function = "blsp_spi0";
+			pins = "gpio13", "gpio14", "gpio15";
+			drive-strength = <12>;
+			bias-disable;
+		};
+
+		pin_cs {
+			function = "gpio";
+			pins = "gpio12";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+
+	enable-usb-power {
+		gpio-hog;
+		gpios = <44 GPIO_ACTIVE_HIGH>;
+		output-high;
+		line-name = "enable USB power";
+	};
+
+	enable-mpcie-power {
+		gpio-hog;
+		gpios = <51 GPIO_ACTIVE_HIGH>;
+		output-high;
+		line-name = "enable mPCI-E power";
+	};
+
+};
+
+&blsp_dma {
+	status = "okay";
+};
+
+&blsp1_spi1 {
+	status = "okay";
+
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+	cs-gpios = <&tlmm 12 GPIO_ACTIVE_HIGH>;
+
+	flash@0 {
+		reg = <0>;
+		compatible = "jedec,spi-nor";
+		spi-max-frequency = <10000000>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+
+		partitions {
+			compatible = "fixed-partitions";
+
+			partition@0 {
+				label = "Qualcomm";
+				reg = <0x0 0x80000>;
+				read-only;
+			};
+
+			partition@80000 {
+				compatible = "mikrotik,routerboot-partitions";
+				label = "RouterBoot";
+				reg = <0x80000 0x80000>;
+
+				hard_config {
+					size = <0x2000>;
+				};
+
+				dtb_config {
+					read-only;
+				};
+
+				soft_config {
+				};
+			};
+
+			partition@110000 {
+				compatible = "mikrotik,minor";
+				label = "firmware";
+				reg = <0x110000 0xef0000>;
+			};
+		};
+	};
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&blsp1_uart1 {
+	status = "okay";
+	pinctrl-0 = <&serial_pins>;
+	pinctrl-names = "default";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&usb3_ss_phy {
+	status = "okay";
+};
+
+&usb3_hs_phy {
+	status = "okay";
+};
+
+&usb3 {
+	status = "okay";
+};
+
+&usb2_hs_phy {
+	status = "okay";
+};
+
+&usb2 {
+	status = "okay";
+};
+
+&mdio {
+	status = "okay";
+};
+
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport1 {
+	status = "okay";
+	label = "lan4";
+};
+
+&swport2 {
+	status = "okay";
+	label = "lan3";
+};
+
+&swport3 {
+	status = "okay";
+	label = "lan2";
+};
+
+&swport4 {
+	status = "okay";
+	label = "lan1";
+};
+
+&swport5 {
+	status = "okay";
+};
+
+&wifi0 {
+	status = "okay";
+};
+
+&wifi1 {
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&prng {
+	status = "okay";
+};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-hap-ac3.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-hap-ac3.dts
index c8b7e202fd78d7..35c4c26a2cb4bb 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-hap-ac3.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-hap-ac3.dts
@@ -73,14 +73,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -314,6 +306,38 @@
 	status = "okay";
 };
 
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport1 {
+	status = "okay";
+	label = "lan4";
+};
+
+&swport2 {
+	status = "okay";
+	label = "lan3";
+};
+
+&swport3 {
+	status = "okay";
+	label = "lan2";
+};
+
+&swport4 {
+	status = "okay";
+	label = "lan1";
+};
+
+&swport5 {
+	status = "okay";
+};
+
 &wifi0 {
 	status = "okay";
 
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-lhgg-60ad.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-lhgg-60ad.dts
index aecbb673bf0236..38bacfa2bafb6a 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-lhgg-60ad.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-lhgg-60ad.dts
@@ -47,12 +47,6 @@
 
 		mdio@90000 {
 			status = "okay";
-
-			/delete-node/ ethernet-phy@1;
-			/delete-node/ ethernet-phy@2;
-			/delete-node/ ethernet-phy@3;
-			/delete-node/ ethernet-phy@4;
-			/delete-node/ psgmii-phy@5;
 		};
 
 		counter@4a1000 {
@@ -85,19 +79,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			switch_mac_mode = <0x3>; /* mac mode for RGMII RMII */
-			switch_lan_bmp = <0x0>; /* lan port bitmap */
-			switch_wan_bmp = <0x10>; /* wan port bitmap */
-		};
-
-		edma@c080000 {
-			status = "okay";
-			phy-mode = "rgmii-id";
-			qcom,num_gmac = <1>;
-			qcom,single-phy;
-		};
 	};
 
 	keys {
@@ -261,8 +242,40 @@
 	};
 };
 
-&gmac0 {
-	qcom,phy_mdio_addr = <0>;
-	qcom,poll_required = <1>;
-	vlan_tag = <0 0x20>;
+&ethphy1 {
+	status = "disabled";
+};
+
+&ethphy2 {
+	status = "disabled";
+};
+
+&ethphy3 {
+	status = "disabled";
+};
+
+&ethphy4 {
+	status = "disabled";
+};
+
+&psgmiiphy {
+	status = "disabled";
+};
+
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+
+	/delete-property/ psgmii-ethphy;
+};
+
+&swport5 {
+	status = "okay";
+
+	label = "lan";
+	phy-handle = <&ethphy0>;
+	phy-mode = "rgmii-id";
 };
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-map-ac2200.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-map-ac2200.dts
index 433048dd4bc61d..32f0473fb169ae 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-map-ac2200.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-map-ac2200.dts
@@ -15,6 +15,7 @@
 		led-failsafe = &led_red0;
 		led-running = &led_blue0;
 		led-upgrade = &led_red0;
+		ethernet1 = &swport4;
 	};
 
 	soc {
@@ -26,10 +27,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -59,14 +56,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -352,3 +341,23 @@
 	pinctrl-names = "default";
 	status = "okay";
 };
+
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+
+	label = "wan";
+};
+
+&swport5 {
+	status = "okay";
+
+	label = "lan";
+};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-mf18a.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-mf18a.dts
new file mode 100644
index 00000000000000..80d71ac0cc8a71
--- /dev/null
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-mf18a.dts
@@ -0,0 +1,483 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+// Copyright (c) 2022, Pawel Dembicki <paweldembicki@gmail.com>.
+// Copyright (c) 2022, Marcin Gajda <mgajda@o2.pl>.
+
+
+#include "qcom-ipq4019.dtsi"
+#include <dt-bindings/soc/qcom,tcsr.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	model = "ZTE MF18A";
+	compatible = "zte,mf18a";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	chosen {
+		/*
+		 * bootargs forced by u-boot bootipq command:
+		 * 'ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait'
+		 */
+		bootargs-append = " root=/dev/ubiblock0_1";
+	};
+
+	gpio-restart {
+		compatible = "gpio-restart";
+		gpios = <&tlmm 8 GPIO_ACTIVE_HIGH>;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_internal: led-0 {
+			label = "blue:internal";
+			gpios = <&tlmm 10 GPIO_ACTIVE_LOW>;
+			default-state = "keep";
+		};
+
+		led_power: led-1 {
+			label = "blue:power";
+			gpios = <&tlmm 48 GPIO_ACTIVE_HIGH>;
+			default-state = "keep";
+		};
+
+		led-2 {
+			function = LED_FUNCTION_WLAN;
+			label = "blue:wlan";
+			gpios = <&tlmm 23 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led-3 {
+			label = "red:wlan";
+			gpios = <&tlmm 26 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-4 {
+			function = LED_FUNCTION_WLAN;
+			label = "blue:smart";
+			gpios = <&tlmm 22 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		led-5 {
+			label = "red:smart";
+			gpios = <&tlmm 25 GPIO_ACTIVE_HIGH>;
+		};
+
+		resetzwave {
+			label = "resetzwave";
+			gpios = <&tlmm 11 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&tlmm 18 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&tlmm 68 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	soc {
+		rng@22000 {
+			status = "okay";
+		};
+
+		mdio@90000 {
+			status = "okay";
+			pinctrl-0 = <&mdio_pins>;
+			pinctrl-names = "default";
+			reset-gpios = <&tlmm 47 GPIO_ACTIVE_LOW>;
+			reset-delay-us = <2000>;
+		};
+
+		tcsr@1949000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1949000 0x100>;
+			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
+		};
+
+		tcsr@194b000 {
+			/* select hostmode */
+			compatible = "qcom,tcsr";
+			reg = <0x194b000 0x100>;
+			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
+			status = "okay";
+		};
+
+		ess_tcsr@1953000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1953000 0x1000>;
+			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
+		};
+
+		tcsr@1957000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1957000 0x100>;
+			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
+		};
+
+		usb2@60f8800 {
+			status = "okay";
+		};
+
+		usb3@8af8800 {
+			status = "okay";
+		};
+
+		crypto@8e3a000 {
+			status = "okay";
+		};
+
+		watchdog@b017000 {
+			status = "okay";
+		};
+	};
+};
+
+&blsp_dma {
+	status = "okay";
+};
+
+&blsp1_spi1 {
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+	cs-gpios = <&tlmm 12 GPIO_ACTIVE_HIGH>;
+
+	flash@0 {
+		/* u-boot is looking for "n25q128a11" property */
+		compatible = "jedec,spi-nor", "n25q128a11";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+		spi-max-frequency = <24000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "0:SBL1";
+				reg = <0x0 0x40000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "0:MIBIB";
+				reg = <0x40000 0x20000>;
+				read-only;
+			};
+
+			partition@60000 {
+				label = "0:QSEE";
+				reg = <0x60000 0x60000>;
+				read-only;
+				};
+
+			partition@c0000 {
+				label = "0:CDT";
+				reg = <0xc0000 0x10000>;
+				read-only;
+			};
+
+			partition@d0000 {
+				label = "0:DDRPARAMS";
+				reg = <0xd0000 0x10000>;
+				read-only;
+			};
+
+			partition@e0000 {
+				label = "0:APPSBLENV";
+				reg = <0xe0000 0x10000>;
+				read-only;
+			};
+
+			partition@f0000 {
+				label = "0:APPSBL";
+				reg = <0xf0000 0xc0000>;
+				read-only;
+			};
+
+			partition@1b0000 {
+				label = "0:reserved1";
+				reg = <0x1b0000 0x50000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&blsp1_uart1 {
+	pinctrl-0 = <&serial_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&gmac {
+	status = "okay";
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_config_0>;
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport2 {
+	status = "okay";
+
+	label = "wan";
+
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_config_0>;
+	mac-address-increment = <1>;
+};
+
+&swport3 {
+	status = "okay";
+
+	label = "lan";
+};
+
+&nand {
+	pinctrl-0 = <&nand_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+
+	nand@0 {
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "fota-flag";
+				reg = <0x0 0xa0000>;
+				read-only;
+			};
+
+			partition@a0000 {
+				label = "ART";
+				reg = <0xa0000 0x80000>;
+				read-only;
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				precal_art_1000: precal@1000 {
+					reg = <0x1000 0x2f20>;
+				};
+
+				precal_art_9000: precal@9000 {
+					reg = <0x9000 0x2f20>;
+				};
+			};
+
+			partition@120000 {
+				label = "mac";
+				reg = <0x120000 0x80000>;
+				read-only;
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_config_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+			};
+
+			partition@1a0000 {
+				label = "reserved2";
+				reg = <0x1a0000 0xc0000>;
+				read-only;
+			};
+
+			partition@260000 {
+				label = "cfg-param";
+				reg = <0x260000 0x400000>;
+				read-only;
+			};
+
+			partition@660000 {
+				label = "log";
+				reg = <0x660000 0x400000>;
+			};
+
+			partition@a60000 {
+				label = "oops";
+				reg = <0xa60000 0xa0000>;
+			};
+
+			partition@b00000 {
+				label = "reserved3";
+				reg = <0xb00000 0x500000>;
+				read-only;
+			};
+
+			partition@1000000 {
+				label = "web";
+				reg = <0x1000000 0x800000>;
+			};
+
+			partition@1800000 {
+				label = "rootfs";
+				reg = <0x1800000 0x1d00000>;
+			};
+
+			partition@3500000 {
+				label = "data";
+				reg = <0x3500000 0x1900000>;
+			};
+
+			partition@4e00000 {
+				label = "fota";
+				reg = <0x4e00000 0x2800000>;
+
+			};
+			partition@7600000 {
+				label = "iot-db";
+				reg = <0x7600000 0xa00000>;
+			};
+		};
+	};
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&tlmm {
+	i2c_0_pins: i2c_0_pinmux {
+		mux {
+			pins = "gpio20", "gpio21";
+			function = "blsp_i2c0";
+			bias-disable;
+		};
+	};
+
+	mdio_pins: mdio_pinmux {
+		mux_1 {
+			pins = "gpio6";
+			function = "mdio";
+			bias-pull-up;
+		};
+
+		mux_2 {
+			pins = "gpio7";
+			function = "mdc";
+			bias-pull-up;
+		};
+	};
+
+	nand_pins: nand_pins {
+		pullups {
+			pins =	"gpio52", "gpio53", "gpio58",
+				"gpio59";
+			function = "qpic";
+			bias-pull-up;
+		};
+
+		pulldowns {
+			pins =	"gpio54", "gpio55", "gpio56",
+				"gpio57", "gpio60",
+				"gpio62", "gpio63", "gpio64",
+				"gpio65", "gpio66", "gpio67",
+				"gpio69";
+			function = "qpic";
+			bias-pull-down;
+		};
+	};
+
+	serial_pins: serial_pinmux {
+		mux {
+			pins = "gpio16", "gpio17";
+			function = "blsp_uart0";
+			bias-disable;
+		};
+	};
+
+	spi_0_pins: spi_0_pinmux {
+		pinmux {
+			function = "blsp_spi0";
+			pins = "gpio13", "gpio14", "gpio15";
+			drive-strength = <12>;
+			bias-disable;
+		};
+
+		pinmux_cs {
+			function = "gpio";
+			pins = "gpio12";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+};
+
+&usb2_hs_phy {
+	status = "okay";
+};
+
+&usb3_ss_phy {
+	status = "okay";
+};
+
+&usb3_hs_phy {
+	status = "okay";
+};
+
+&wifi0 {
+	status = "okay";
+	nvmem-cell-names = "pre-calibration", "mac-address";
+	nvmem-cells = <&precal_art_1000>, <&macaddr_config_0>;
+	mac-address-increment = <2>;
+	qcom,ath10k-calibration-variant = "ZTE-MF18A";
+};
+
+//* This node is used for 5Ghz on QCA9982 */
+&pcie0 {
+	status = "okay";
+	perst-gpio = <&tlmm 38 GPIO_ACTIVE_LOW>;
+	wake-gpio = <&tlmm 40 GPIO_ACTIVE_LOW>;
+	clkreq-gpio = <&tlmm 39 GPIO_ACTIVE_LOW>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi2: wifi@1,0 {
+			compatible = "pci168c,0040";
+			nvmem-cell-names = "pre-calibration", "mac-address";
+			nvmem-cells = <&precal_art_9000>, <&macaddr_config_0>;
+			mac-address-increment = <3>;
+			qcom,ath10k-calibration-variant = "ZTE-MF18A";
+			reg = <0x00010000 0 0 0 0>;
+		};
+	};
+};
+
+
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-mf286d.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-mf286d.dts
index 8d1505cfe95841..ff04279a600b1e 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-mf286d.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-mf286d.dts
@@ -85,10 +85,6 @@
 			reset-delay-us = <2000>;
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -130,14 +126,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 };
 
@@ -225,15 +213,10 @@
 	status = "okay";
 };
 
-&gmac0 {
-	nvmem-cell-names = "mac-address";
-	nvmem-cells = <&macaddr_config_0>;
-};
-
-&gmac1 {
+&gmac {
+	status = "okay";
 	nvmem-cell-names = "mac-address";
 	nvmem-cells = <&macaddr_config_0>;
-	mac-address-increment = <1>;
 };
 
 &nand {
@@ -338,6 +321,36 @@
 	status = "okay";
 };
 
+&switch {
+	status = "okay";
+};
+
+&swport2 {
+	status = "okay";
+
+	label = "lan4";
+};
+
+&swport3 {
+	status = "okay";
+
+	label = "lan3";
+};
+
+&swport4 {
+	status = "okay";
+
+	label = "lan2";
+};
+
+&swport5 {
+	status = "okay";
+
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_config_0>;
+	mac-address-increment = <1>;
+};
+
 &tlmm {
 	i2c_0_pins: i2c_0_pinmux {
 		mux {
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-mf289f.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-mf289f.dts
new file mode 100644
index 00000000000000..0d9f24ad705924
--- /dev/null
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-mf289f.dts
@@ -0,0 +1,440 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+// Copyright (c) 2022, Pawel Dembicki <paweldembicki@gmail.com>.
+// Copyright (c) 2022, Giammarco Marzano <stich86@gmail.com>.
+
+#include "qcom-ipq4019.dtsi"
+#include <dt-bindings/soc/qcom,tcsr.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	model = "ZTE MF289F";
+	compatible = "zte,mf289f";
+
+	aliases {
+		led-boot = &led_status;
+		led-failsafe = &led_status;
+		led-running = &led_status;
+		led-upgrade = &led_status;
+	};
+
+	chosen {
+		/*
+		 * bootargs forced by u-boot bootipq command:
+		 * 'ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait'
+		 */
+		bootargs-append = " root=/dev/ubiblock0_1";
+	};
+
+	/*
+	 * This node is used to restart modem module to avoid anomalous
+	 * behaviours on initial communication.
+	 */
+	gpio-restart {
+		compatible = "gpio-restart";
+		gpios = <&tlmm 8 GPIO_ACTIVE_HIGH>;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status: led-0 {
+			label = "blue:power";
+			function = LED_FUNCTION_POWER;
+			color = <LED_COLOR_ID_BLUE>;
+			gpios = <&tlmm 35 GPIO_ACTIVE_LOW>;
+		};
+
+		led-1 {
+			function = LED_FUNCTION_WLAN;
+			color = <LED_COLOR_ID_BLUE>;
+			gpios = <&tlmm 61 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		key-reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&tlmm 18 GPIO_ACTIVE_LOW>;
+		};
+
+		key-wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&tlmm 68 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	soc {
+		tcsr@1949000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1949000 0x100>;
+			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
+		};
+
+		tcsr@194b000 {
+			/* select hostmode */
+			compatible = "qcom,tcsr";
+			reg = <0x194b000 0x100>;
+			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
+			status = "okay";
+		};
+
+		ess_tcsr@1953000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1953000 0x1000>;
+			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
+		};
+
+		tcsr@1957000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1957000 0x100>;
+			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
+		};
+	};
+};
+
+&prng {
+	status = "okay";
+};
+
+&mdio {
+	status = "okay";
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	reset-gpios = <&tlmm 47 GPIO_ACTIVE_LOW>;
+	reset-delay-us = <2000>;
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&blsp_dma {
+	status = "okay";
+};
+
+&usb2 {
+	status = "okay";
+};
+
+&usb3 {
+	status = "okay";
+};
+
+&blsp1_spi1 {
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+	cs-gpios = <&tlmm 12 GPIO_ACTIVE_HIGH>,
+		   <&tlmm 54 GPIO_ACTIVE_HIGH>;
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+		spi-max-frequency = <24000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "0:SBL1";
+				reg = <0x0 0x40000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "0:MIBIB";
+				reg = <0x40000 0x20000>;
+				read-only;
+			};
+
+			partition@60000 {
+				label = "0:QSEE";
+				reg = <0x60000 0x60000>;
+				read-only;
+			};
+
+			partition@c0000 {
+				label = "0:CDT";
+				reg = <0xc0000 0x10000>;
+				read-only;
+			};
+
+			partition@d0000 {
+				label = "0:DDRPARAMS";
+				reg = <0xd0000 0x10000>;
+				read-only;
+			};
+
+			partition@e0000 {
+				label = "0:APPSBLENV";
+				reg = <0xe0000 0x10000>;
+				read-only;
+			};
+
+			partition@f0000 {
+				label = "0:APPSBL";
+				reg = <0xf0000 0xc0000>;
+				read-only;
+			};
+
+			partition@1b0000 {
+				label = "0:reserved1";
+				reg = <0x1b0000 0x50000>;
+				read-only;
+			};
+		};
+	};
+
+	spi-nand@1 { /* flash@1 ? */
+		compatible = "spi-nand";
+		reg = <1>;
+		spi-max-frequency = <24000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "fota-flag";
+				reg = <0x0 0xa0000>;
+				read-only;
+			};
+
+			partition@a0000 {
+				label = "ART";
+				reg = <0xa0000 0x80000>;
+				read-only;
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				precal_art_1000: precal@1000 {
+					reg = <0x1000 0x2f20>;
+				};
+
+				precal_art_5000: precal@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+			};
+
+			partition@120000 {
+				label = "mac";
+				reg = <0x120000 0x80000>;
+				read-only;
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_mac_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+			};
+
+			partition@1a0000 {
+				label = "reserved2";
+				reg = <0x1a0000 0xc0000>;
+				read-only;
+			};
+
+			partition@260000 {
+				label = "cfg-param";
+				reg = <0x260000 0x400000>;
+				read-only;
+			};
+
+			partition@660000 {
+				label = "log";
+				reg = <0x660000 0x400000>;
+			};
+
+			partition@a60000 {
+				label = "oops";
+				reg = <0xa60000 0xa0000>;
+			};
+
+			partition@b00000 {
+				label = "reserved3";
+				reg = <0xb00000 0x500000>;
+				read-only;
+			};
+
+			partition@1000000 {
+				label = "web";
+				reg = <0x1000000 0x800000>;
+			};
+
+			partition@1800000 {
+				label = "rootfs";
+				reg = <0x1800000 0x1d00000>;
+			};
+
+			partition@3500000 {
+				label = "data";
+				reg = <0x3500000 0x1900000>;
+			};
+
+			partition@4e00000 {
+				label = "fota";
+				reg = <0x4e00000 0x3200000>;
+			};
+		};
+	};
+};
+
+&blsp1_uart1 {
+	pinctrl-0 = <&serial_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&gmac {
+	status = "okay";
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_mac_0>;
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport2 {
+	status = "okay";
+
+	label = "wan";
+
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_mac_0>;
+	mac-address-increment = <1>;
+};
+
+&swport5 {
+	status = "okay";
+
+	label = "lan";
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&tlmm {
+	i2c_0_pins: i2c_0_pinmux {
+		mux {
+			pins = "gpio20", "gpio21";
+			function = "blsp_i2c0";
+			bias-disable;
+		};
+	};
+
+	mdio_pins: mdio_pinmux {
+		mux_1 {
+			pins = "gpio6";
+			function = "mdio";
+			bias-pull-up;
+		};
+
+		mux_2 {
+			pins = "gpio7";
+			function = "mdc";
+			bias-pull-up;
+		};
+	};
+
+	serial_pins: serial_pinmux {
+		mux {
+			pins = "gpio16", "gpio17";
+			function = "blsp_uart0";
+			bias-disable;
+		};
+	};
+
+	spi_0_pins: spi_0_pinmux {
+		pinmux {
+			function = "blsp_spi0";
+			pins = "gpio13", "gpio14", "gpio15";
+			drive-strength = <12>;
+			bias-disable;
+		};
+
+		pinmux_cs {
+			function = "gpio";
+			pins = "gpio12", "gpio54";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+};
+
+&usb2_hs_phy {
+	status = "okay";
+};
+
+&usb3_ss_phy {
+	status = "okay";
+};
+
+&usb3_hs_phy {
+	status = "okay";
+};
+
+&wifi0 {
+	status = "okay";
+	nvmem-cell-names = "pre-calibration", "mac-address";
+	nvmem-cells = <&precal_art_1000>, <&macaddr_mac_0>;
+	mac-address-increment = <2>;
+	qcom,ath10k-calibration-variant = "zte,mf289f";
+};
+
+/* This node is used only on AT2 version for 5Ghz on IPQ4019 with board-id=21 */
+&wifi1 {
+	status = "okay";
+	nvmem-cell-names = "pre-calibration", "mac-address";
+	nvmem-cells = <&precal_art_5000>, <&macaddr_mac_0>;
+	mac-address-increment = <3>;
+	qcom,ath10k-calibration-variant = "zte,mf289f";
+};
+
+/* This node is used only on AT1 version for 5Ghz on QCA9984 */
+&pcie0 {
+	status = "okay";
+	perst-gpio = <&tlmm 38 GPIO_ACTIVE_LOW>;
+	wake-gpio = <&tlmm 40 GPIO_ACTIVE_LOW>;
+	clkreq-gpio = <&tlmm 39 GPIO_ACTIVE_LOW>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi2: wifi@1,0 {
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_mac_0>;
+			mac-address-increment = <4>;
+			compatible = "qcom,ath10k";
+			reg = <0x00010000 0 0 0 0>;
+			qcom,ath10k-calibration-variant = "zte,mf289f";
+		};
+	};
+};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-ncp-hg100-cellular.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-ncp-hg100-cellular.dts
new file mode 100644
index 00000000000000..ea27defea3de85
--- /dev/null
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-ncp-hg100-cellular.dts
@@ -0,0 +1,635 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+#include "qcom-ipq4019.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	model = "Sony NCP-HG100/Cellular";
+	compatible = "sony,ncp-hg100-cellular";
+
+	aliases {
+		led-boot = &led_cloud_green;
+		led-failsafe = &led_cloud_red;
+		led-running = &led_cloud_green;
+		led-upgrade = &led_cloud_green;
+		label-mac-device = &gmac;
+	};
+
+	chosen {
+		bootargs = "console=ttyMSM0,115200n8 root=/dev/mmcblk0p15 rootfstype=squashfs,ext4";
+	};
+
+	memory {
+		device_type = "memory";
+		reg = <0x80000000 0x20000000>;
+	};
+
+	soc {
+		tcsr@1949000 {
+			status = "okay";
+			compatible = "qcom,tcsr";
+			reg = <0x1949000 0x100>;
+			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
+		};
+
+		tcsr@194b000 {
+			status = "okay";
+			compatible = "qcom,tcsr";
+			reg = <0x194b000 0x100>;
+			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
+		};
+
+		ess_tcsr@1953000 {
+			status = "okay";
+			compatible = "qcom,tcsr";
+			reg = <0x1953000 0x1000>;
+			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
+		};
+
+		tcsr@1957000 {
+			status = "okay";
+			compatible = "qcom,tcsr";
+			reg = <0x1957000 0x100>;
+			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
+		};
+
+		dma@7984000 {
+			status = "okay";
+		};
+	};
+
+	keys-repeat {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&keys_pins>;
+		pinctrl-names = "default";
+		autorepeat;
+
+		key-volup {
+			label = "volume up";
+			linux,code = <KEY_VOLUMEUP>;
+			gpios = <&tlmm 39 GPIO_ACTIVE_HIGH>;
+			linux,input-type = <EV_KEY>;
+		};
+
+		key-voldown {
+			label = "volume down";
+			linux,code = <KEY_VOLUMEDOWN>;
+			gpios = <&tlmm 40 GPIO_ACTIVE_HIGH>;
+			linux,input-type = <EV_KEY>;
+		};
+
+		key-alexatrigger {
+			label = "alexa trigger";
+			linux,code = <BTN_0>;
+			gpios = <&tlmm 42 GPIO_ACTIVE_HIGH>;
+			linux,input-type = <EV_KEY>;
+		};
+
+		key-mute {
+			label = "mic mute";
+			linux,code = <BTN_1>;
+			gpios = <&tlmm 47 GPIO_ACTIVE_LOW>;
+			linux,input-type = <EV_SW>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		key-reset {
+			label = "reset";
+			gpios = <&tlmm 2 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		key-wps {
+			label = "setup";
+			gpios = <&tlmm 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+};
+
+&tlmm {
+	pinctrl-0 = <&bt_pins>, <&aud_pins>, <&mcu_pins>;
+	pinctrl-names = "default";
+
+	/*
+	 * uart0 is shared for debug console and Z-Wave,
+	 * use only for debug console in OpenWrt.
+	 *
+	 * 1: debug console
+	 * 0: Z-Wave
+	 */
+	uart0_ctrl_pins: uart0_ctrl_pinmux {
+		mux {
+			pins = "gpio15";
+			function = "gpio";
+			output-high;
+		};
+	};
+
+	serial_pins: serial_pinmux {
+		mux {
+			pins = "gpio16", "gpio17";
+			function = "blsp_uart0";
+			bias-disable;
+		};
+	};
+
+	/*
+	 * reset pin for Z-Wave
+	 * active-low, >= 20ns
+	 */
+	zwave_pins: zwave_pinmux {
+		mux {
+			pins = "gpio59";
+			function = "gpio";
+			output-high;
+		};
+	};
+
+	serial_1_pins: serial1_pinmux {
+		mux {
+			pins = "gpio8", "gpio9",
+				"gpio10", "gpio11";
+			function = "blsp_uart1";
+			bias-disable;
+		};
+	};
+
+	bt_pins: bt_pinmux {
+		mux_reset {
+			pins = "gpio66";
+			function = "gpio";
+			output-high;
+		};
+
+		mux_pwr {
+			pins = "gpio68";
+			function = "gpio";
+			output-high;
+		};
+	};
+
+	mdio_pins: mdio_pinmux {
+		mux_1 {
+			pins = "gpio6";
+			function = "mdio";
+			bias-pull-up;
+		};
+
+		mux_2 {
+			pins = "gpio7";
+			function = "mdc";
+			bias-pull-up;
+		};
+	};
+
+	i2c_1_pins: i2c_1_pinmux {
+		mux {
+			pins = "gpio12", "gpio13";
+			function = "blsp_i2c1";
+			bias-disable;
+		};
+	};
+
+	keys_pins: keys_pinmux {
+		mux_1 {
+			pins = "gpio39", "gpio40", "gpio42", "gpio47";
+			function = "gpio";
+			bias-disable;
+		};
+
+		mux_2 {
+			pins = "gpio2";
+			function = "gpio";
+			input;
+		};
+	};
+
+	sd_pins: sd_pins {
+		mux {
+			function = "sdio";
+			pins = "gpio23", "gpio24", "gpio25", "gpio26",
+				"gpio28", "gpio29", "gpio30", "gpio31";
+			drive-strength = <4>;
+		};
+
+		mux_sd_clk {
+			function = "sdio";
+			pins = "gpio27";
+			drive-strength = <16>;
+		};
+
+		mux_sd7 {
+			function = "sdio";
+			pins = "gpio32";
+			drive-strength = <4>;
+			bias-disable;
+		};
+	};
+
+	aud_pins: aud_pinmux {
+		mux {
+			pins = "gpio48", "gpio49", "gpio50", "gpio51";
+			function = "aud_pin";
+		};
+	};
+
+	alc1304_pins: alc1304_pinmux {
+		mux_1 {
+			pins = "gpio44";
+			function = "gpio";
+			bias-disable;
+		};
+
+		mux_2 {
+			pins = "gpio45";
+			function = "gpio";
+			bias-disable;
+		};
+	};
+
+	cx2902x_reset: cx2902x_pinmux {
+		mux_1 {
+			pins = "gpio64";
+			function = "gpio";
+			bias-disable;
+		};
+
+		mux_2 {
+			pins = "gpio65";
+			function = "gpio";
+			bias-disable;
+		};
+	};
+
+	lte_pins: lte_pinmux {
+		mux_en {
+			pins = "gpio20";
+			function = "gpio";
+			output-high;
+		};
+
+		mux_reset {
+			pins = "gpio35";
+			function = "gpio";
+			input;
+		};
+	};
+
+	usb3_pins: usb3_pinmux {
+		mux_en {
+			pins = "gpio36";
+			function = "gpio";
+			output-high;
+		};
+
+		mux_flt {
+			pins = "gpio4";
+			function = "gpio";
+			input;
+		};
+	};
+
+	mcu_pins: mcu_pinmux {
+		mux_boot {
+			pins = "gpio38";
+			function = "gpio";
+			output-low;
+		};
+
+		mux_reset {
+			pins = "gpio5";
+			function = "gpio";
+			output-high;
+		};
+	};
+};
+
+&blsp_dma {
+	status = "okay";
+};
+
+&blsp1_i2c4 {
+	/*
+	 * There is no driver for the following devices:
+	 * - CY8C4014LQI@14	: Touch-Sensor for buttons on top
+	 * - MINI54FDE@15	: MCU for Fan/RGB LED/Thermal control
+	 * - ALC5629@18		: I2S/PCM Audio DAC
+	 * - CX20924@41		: Voice Input Processor
+	 */
+	pinctrl-0 = <&i2c_1_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+
+	led-controller@32 {
+		compatible = "ti,lp55231";
+		reg = <0x32>;
+		clock-mode = /bits/ 8 <0>;
+		enable-gpio = <&tlmm 1 GPIO_ACTIVE_HIGH>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		led@0 {
+			chan-name = "green:wan";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x0>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WAN;
+		};
+
+		led@1 {
+			chan-name = "blue:wan";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x1>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WAN;
+		};
+
+		led@2 {
+			chan-name = "green:lan";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x2>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_LAN;
+		};
+
+		led@3 {
+			chan-name = "blue:lan";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x3>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_LAN;
+		};
+
+		led@4 {
+			chan-name = "green:wlan-2";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x4>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <2>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led@5 {
+			chan-name = "blue:wlan-2";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x5>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <2>;
+		};
+
+		led@6 {
+			chan-name = "red:wan";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x6>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WAN;
+		};
+
+		led@7 {
+			chan-name = "red:lan";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x7>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_LAN;
+		};
+
+		led@8 {
+			chan-name = "red:wlan-2";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x8>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <2>;
+		};
+	};
+
+	led-controller@33 {
+		compatible = "ti,lp55231";
+		reg = <0x33>;
+		clock-mode = /bits/ 8 <0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		led@0 {
+			chan-name = "green:wlan-5";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x0>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN;
+			linux,default-trigger = "phy1tpt";
+			function-enumerator = <5>;
+		};
+
+		led@1 {
+			chan-name = "blue:wlan-5";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x1>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <5>;
+		};
+
+		led@2 {
+			chan-name = "green:wan-4";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x2>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WAN; /* WWAN/LTE/4G */
+			function-enumerator = <4>; /* WWAN/LTE/4G */
+		};
+
+		led@3 {
+			chan-name = "blue:wan-4";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x3>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WAN; /* WWAN/LTE/4G */
+			function-enumerator = <4>; /* WWAN/LTE/4G */
+		};
+
+		led_cloud_green: led@4 {
+			chan-name = "green:power";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x4>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_POWER;
+		};
+
+		led@5 {
+			chan-name = "blue:power";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x5>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_POWER;
+		};
+
+		led@6 {
+			chan-name = "red:wlan-5";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x6>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <5>;
+		};
+
+		led@7 {
+			chan-name = "red:wan-4";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x7>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WAN; /* WWAN/LTE/4G */
+			function-enumerator = <4>; /* WWAN/LTE/4G */
+		};
+
+		led_cloud_red: led@8 {
+			chan-name = "red:power";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x8>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_POWER;
+		};
+	};
+};
+
+&blsp1_uart1 {
+	pinctrl-0 = <&serial_pins>, <&uart0_ctrl_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&blsp1_uart2 {
+	pinctrl-0 = <&serial_1_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&mdio {
+	status = "okay";
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	reset-gpios = <&tlmm 41 GPIO_ACTIVE_LOW>;
+};
+
+&prng {
+	status = "okay";
+};
+
+&vqmmc {
+	status = "okay";
+};
+
+&sdhci {
+	status = "okay";
+	pinctrl-0 = <&sd_pins>;
+	pinctrl-names = "default";
+	vqmmc-supply = <&vqmmc>;
+	non-removable;
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	emmc@0 {
+		compatible = "mmc-card";
+		reg = <0>;
+	};
+};
+
+&usb2 {
+	status = "okay";
+};
+
+&usb2_hs_phy {
+	status = "okay";
+};
+
+&usb3 {
+	status = "okay";
+
+	pinctrl-0 = <&usb3_pins>, <&lte_pins>;
+	pinctrl-names = "default";
+
+	dwc3@8a00000 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		device@1 {
+			compatible = "usb1bc7,1900";
+			reg = <1>;
+		};
+	};
+};
+
+&usb3_hs_phy {
+	status = "okay";
+};
+
+&usb3_ss_phy {
+	status = "okay";
+};
+
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+	label = "lan";
+};
+
+&swport5 {
+	status = "okay";
+	label = "wan";
+};
+
+&wifi0 {
+	status = "okay";
+	qcom,ath10k-calibration-variant = "Sony-NCP-HG100-Cellular";
+};
+
+&wifi1 {
+	status = "okay";
+	qcom,ath10k-calibration-variant = "Sony-NCP-HG100-Cellular";
+};
+
+&watchdog {
+	status = "okay";
+};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-oap100.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-oap100.dts
index bdcc31fef7b629..beb168eb492117 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-oap100.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-oap100.dts
@@ -27,10 +27,6 @@
 			pinctrl-names = "default";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -97,17 +93,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-			switch_mac_mode = <0x0>; /* mac mode for RGMII RMII */
-			switch_initvlas = <0x0007c 0x54>; /* port0 status */
-			switch_lan_bmp = <0x10>;
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	key {
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-orbi.dtsi b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-orbi.dtsi
index bdbee7f83702a8..44dbfef529d9af 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-orbi.dtsi
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-orbi.dtsi
@@ -11,6 +11,7 @@
 		led-failsafe = &led_status_red;
 		led-running = &led_status_green;
 		led-upgrade = &led_status_blue;
+		label-mac-device = &gmac;
 	};
 
 	soc {
@@ -25,10 +26,6 @@
 			pinctrl-names = "default";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		counter@4a1000 {
 			compatible = "qcom,qca-gcnt";
 			reg = <0x4a1000 0x4>;
@@ -67,17 +64,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-
-			switch_lan_bmp = <0x1c>;
-			switch_wan_bmp = <0x02>;
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -281,13 +267,40 @@
 	status = "okay";
 };
 
-&gmac0 {
-	vlan_tag = <1 0x1c>;
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport1 {
+	status = "okay";
+
+	label = "wan";
+};
+
+&swport2 {
+	status = "okay";
+
+	label = "lan1";
+};
+
+&swport3 {
+	status = "okay";
+
+	label = "lan2";
+};
+
+&swport4 {
+	status = "okay";
+
+	label = "lan3";
 };
 
-&gmac1 {
-	qcom,phy_mdio_addr = <0>;
-	vlan_tag = <2 0x02>;
+&ethphy4 {
+	status = "disabled";
 };
 
 &pcie0 {
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-pa2200.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-pa2200.dts
index 2d0655114b4e07..259ea7bb47abd9 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-pa2200.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-pa2200.dts
@@ -17,14 +17,6 @@
 			status = "okay";
 		};
 
-		mdio@90000 {
-			status = "okay";
-		};
-
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -50,17 +42,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			switch_lan_bmp = <0x10>;
-			switch_wan_bmp = <0x20>;
-
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -78,6 +59,7 @@
 		led-failsafe = &led_status_blue;
 		led-running = &led_power_orange;
 		led-upgrade = &led_status_blue;
+		label-mac-device = &swport4;
 	};
 
 	leds {
@@ -155,7 +137,36 @@
 		compatible = "jedec,spi-nor";
 		reg = <0>;
 		spi-max-frequency = <24000000>;
+
 		/* partitions are passed via bootloader */
+		partitions {
+			partition-art {
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+				label = "0:ART";
+
+				precal_art_1000: precal@1000 {
+					reg = <0x1000 0x2f20>;
+				};
+
+				precal_art_5000: precal@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+
+				precal_art_9000: precal@9000 {
+					reg = <0x9000 0x2f20>;
+				};
+
+				macaddr_gmac0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_gmac1: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+			};
+		};
 	};
 };
 
@@ -169,14 +180,6 @@
 	status = "okay";
 };
 
-&gmac0 {
-	qcom,phy_mdio_addr = <3>;
-	qcom,poll_required = <1>;
-	qcom,forced_speed = <1000>;
-	qcom,forced_duplex = <1>;
-	vlan_tag = <1 0x10>;
-};
-
 &pcie0 {
 	status = "okay";
 	perst-gpio = <&tlmm 38 GPIO_ACTIVE_LOW>;
@@ -194,17 +197,54 @@
 			reg = <0x00010000 0 0 0 0>;
 			qcom,ath10k-calibration-variant = "PlasmaCloud-PA2200";
 			ieee80211-freq-limit = <5170000 5350000>;
+
+			nvmem-cell-names = "pre-calibration";
+			nvmem-cells = <&precal_art_9000>;
 		};
 	};
 };
 
+&mdio {
+	status = "okay";
+};
+
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+	label = "ethernet1";
+
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_gmac0>;
+};
+
+&swport5 {
+	status = "okay";
+	label = "ethernet2";
+
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_gmac1>;
+};
+
 &wifi0 {
 	status = "okay";
 	qcom,ath10k-calibration-variant = "PlasmaCloud-PA2200";
+
+	nvmem-cell-names = "pre-calibration";
+	nvmem-cells = <&precal_art_1000>;
 };
 
 &wifi1 {
 	status = "okay";
 	qcom,ath10k-calibration-variant = "PlasmaCloud-PA2200";
 	ieee80211-freq-limit = <5470000 5875000>;
+
+	nvmem-cell-names = "pre-calibration";
+	nvmem-cells = <&precal_art_5000>;
 };
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-r619ac.dtsi b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-r619ac.dtsi
index 87e0d103b71b53..d7a987f98dbc11 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-r619ac.dtsi
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-r619ac.dtsi
@@ -16,7 +16,6 @@
 		led-failsafe = &led_sys;
 		led-running = &led_sys;
 		led-upgrade = &led_sys;
-		label-mac-device = &gmac0;
 	};
 
 	soc {
@@ -30,10 +29,6 @@
 			pinctrl-names = "default";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -73,14 +68,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	leds {
@@ -333,6 +320,42 @@
 	qcom,single-led-10;
 };
 
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport1 {
+	status = "okay";
+
+	label = "lan4";
+};
+
+&swport2 {
+	status = "okay";
+
+	label = "lan3";
+};
+
+&swport3 {
+	status = "okay";
+
+	label = "lan2";
+};
+
+&swport4 {
+	status = "okay";
+
+	label = "lan1";
+};
+
+&swport5 {
+	status = "okay";
+};
+
 &usb3_ss_phy {
 	status = "okay";
 };
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-rt-ac42u.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-rt-ac42u.dts
index 3d58eac09ed3b3..f746acfbb950db 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-rt-ac42u.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-rt-ac42u.dts
@@ -31,10 +31,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -85,14 +81,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -282,6 +270,34 @@
 	status = "okay";
 };
 
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport1 {
+	status = "okay";
+};
+
+&swport2 {
+	status = "okay";
+};
+
+&swport3 {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+};
+
+&swport5 {
+	status = "okay";
+};
+
 &wifi0 {
 	status = "okay";
 	qcom,ath10k-calibration-variant = "ASUS-RT-AC42U";
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-rtl30vw.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-rtl30vw.dts
index 0caa0255d039ae..6fce4ae87b5162 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-rtl30vw.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-rtl30vw.dts
@@ -142,10 +142,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -187,14 +183,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 };
 
@@ -383,3 +371,23 @@
 	status = "okay";
 	qcom,ath10k-calibration-variant = "cellc,rtl30vw";
 };
+
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport3 {
+	status = "okay";
+
+	label = "lan1";
+};
+
+&swport4 {
+	status = "okay";
+
+	label = "lan2";
+};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-u4019.dtsi b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-u4019.dtsi
index ece80571bddf8a..c7439b87ec968f 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-u4019.dtsi
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-u4019.dtsi
@@ -21,10 +21,6 @@
 			reset-delay-us = <2000>;
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -87,14 +83,6 @@
 			status = "okay";
 		};
 
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
-
 		aliases {
 			led-boot = &led_status;
 			led-failsafe = &led_status;
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-whw03v2.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-whw03v2.dts
new file mode 100644
index 00000000000000..1f0572b8798f68
--- /dev/null
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-whw03v2.dts
@@ -0,0 +1,519 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq4019.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	model = "Linksys WHW03 V2 (Velop)";
+	compatible = "linksys,whw03v2", "qcom,ipq4019";
+
+	aliases {
+		led-boot = &led_blue;
+		led-failsafe = &led_red;
+		led-running = &led_green;
+		led-upgrade = &led_red;
+	};
+
+	// The arguments rootfstype and ro are needed
+	// to override the default bootargs
+	chosen {
+		bootargs-append = " root=/dev/ubiblock0_0 rootfstype=squashfs ro";
+		stdout-path = &blsp1_uart1;
+	};
+
+	soc {
+		ess-tcsr@1953000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1953000 0x1000>;
+			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
+		};
+
+
+		tcsr@1949000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1949000 0x100>;
+			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
+		};
+
+		tcsr@194b000 {
+			compatible = "qcom,tcsr";
+			reg = <0x194b000 0x100>;
+			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
+		};
+
+		tcsr@1957000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1957000 0x100>;
+			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
+		};
+	};
+
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+};
+
+
+&tlmm {
+	mdio_pins: mdio-pinmux {
+		mux-1 {
+			pins = "gpio6";
+			function = "mdio";
+			bias-pull-up;
+		};
+
+		mux-2 {
+			pins = "gpio7";
+			function = "mdc";
+			bias-pull-up;
+		};
+	};
+
+	i2c_0_pins: i2c-0-pinmux {
+		mux {
+			function = "blsp_i2c0";
+			pins = "gpio20", "gpio21";
+			bias-disable;
+		};
+	};
+
+	serial_0_pins: serial0-pinmux {
+		mux {
+			pins = "gpio16", "gpio17";
+			function = "blsp_uart0";
+			bias-disable;
+		};
+	};
+
+	serial_1_pins: serial1-pinmux {
+		mux {
+			pins = "gpio8", "gpio9", "gpio10", "gpio11";
+			function = "blsp_uart1";
+			bias-disable;
+		};
+	};
+
+	spi_0_pins: spi-0-pinmux {
+		mux {
+			function = "blsp_spi0";
+			pins = "gpio13", "gpio14", "gpio15";
+			drive-strength = <12>;
+			bias-disable;
+		};
+
+		mux-cs {
+			pins = "gpio12";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+
+	spi_1_pins: spi-1-pinmux {
+		mux-1 {
+			function = "blsp_spi1";
+			pins = "gpio44", "gpio46","gpio47";
+			bias-disable;
+		};
+
+		mux-2 {
+			pins = "gpio31", "gpio45", "gpio49";
+			function = "gpio";
+			bias-pull-up;
+			output-high;
+		};
+
+		host-interrupt {
+			pins = "gpio42";
+			function = "gpio";
+			input;
+		};
+	};
+
+	wifi_0_pins: wifi0-pinmux {
+		btcoexist {
+			bias-pull-up;
+			drive-strength = <6>;
+			function = "gpio";
+			output-high;
+			pins = "gpio52";
+		};
+	};
+
+	zigbee-0 {
+		gpio-hog;
+		gpios = <29 GPIO_ACTIVE_HIGH>;
+		bias-disable;
+		output-low;
+	};
+
+	zigbee-1 {
+		gpio-hog;
+		gpios = <50 GPIO_ACTIVE_HIGH>;
+		bias-disable;
+		input;
+	};
+
+	bluetooth-enable {
+		gpio-hog;
+		gpios = <32 GPIO_ACTIVE_HIGH>;
+		output-high;
+	};
+};
+
+&mdio {
+	status = "okay";
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	phy-reset-gpios = <&tlmm 19 GPIO_ACTIVE_LOW>;
+};
+
+&ethphy0 {
+	status = "disabled";
+};
+
+&ethphy1 {
+	status = "disabled";
+};
+
+&ethphy2 {
+	status = "disabled";
+};
+
+&ethphy3 {
+	reg = <0x1b>;
+};
+
+&ethphy4 {
+	reg = <0x1c>;
+};
+
+&psgmiiphy {
+	reg = <0x1d>;
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&prng {
+	status = "okay";
+};
+
+&blsp_dma {
+	status = "okay";
+};
+
+&cryptobam {
+	num-channels = <4>;
+	qcom,num-ees = <2>;
+
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&blsp1_uart1 {
+	status = "okay";
+	pinctrl-0 = <&serial_0_pins>;
+	pinctrl-names = "default";
+};
+
+&blsp1_uart2 {
+	status = "okay";
+	pinctrl-0 = <&serial_1_pins>;
+	pinctrl-names = "default";
+
+	bluetooth {
+		compatible = "csr,8811";
+
+		enable-gpios = <&tlmm 32 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&blsp1_spi2 {
+	pinctrl-0 = <&spi_1_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+
+	cs-gpios = <&tlmm 45 GPIO_ACTIVE_HIGH>;
+
+	zigbee@0 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		compatible = "silabs,em3581";
+		reg = <0>;
+		spi-max-frequency = <12000000>;
+	};
+};
+
+&blsp1_i2c3 {
+	pinctrl-0 = <&i2c_0_pins>;
+	pinctrl-names = "default";
+
+	status = "okay";
+
+	// RGB LEDs
+	pca9633: led-controller {
+		compatible = "nxp,pca9633";
+		nxp,hw-blink;
+		reg = <0x62>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		led_red: red@0 {
+			label = "red";
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_INDICATOR;
+			linux,default-trigger = "none";
+			reg = <0>;
+		};
+
+		led_green: green@1 {
+			label = "green";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_INDICATOR;
+			linux,default-trigger = "none";
+			reg = <1>;
+		};
+
+		led_blue: blue@2 {
+			label = "blue";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_INDICATOR;
+			linux,default-trigger = "default-on";
+			reg = <2>;
+		};
+	};
+};
+
+&usb3_ss_phy {
+	status = "okay";
+};
+
+&usb3_hs_phy {
+	status = "okay";
+};
+
+&usb2_hs_phy {
+	status = "okay";
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "SBL1";
+				reg = <0x0 0x100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "MIBIB";
+				reg = <0x100000 0x100000>;
+				read-only;
+			};
+
+			partition@200000 {
+				label = "QSEE";
+				reg = <0x200000 0x100000>;
+				read-only;
+			};
+
+			partition@300000 {
+				label = "CDT";
+				reg = <0x300000 0x80000>;
+				read-only;
+			};
+
+			partition@380000 {
+				label = "APPSBL";
+				reg = <0x380000 0x200000>;
+				read-only;
+			};
+
+			partition@580000 {
+				label = "ART";
+				reg = <0x580000 0x80000>;
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+				read-only;
+
+				precal_art_1000: precal@1000 {
+					reg = <0x1000 0x2f20>;
+				};
+
+				precal_art_5000: precal@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+
+				precal_art_9000: precal@9000 {
+					reg = <0x9000 0x2f20>;
+				};
+
+				macaddr_gmac0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_gmac1: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+			};
+
+			partition@600000 {
+				label = "u_env";
+				reg = <0x600000 0x80000>;
+			};
+
+			partition@680000 {
+				label = "s_env";
+				reg = <0x680000 0x40000>;
+			};
+
+			partition@6c0000 {
+				label = "devinfo";
+				reg = <0x6c0000 0x40000>;
+				read-only;
+			};
+
+			partition@700000 {
+				label = "kernel";
+				reg = <0x700000 0xa100000>;
+			};
+
+			partition@d00000 {
+				label = "rootfs";
+				reg = <0xd00000 0x9b00000>;
+			};
+
+			partition@a800000 {
+				label = "alt_kernel";
+				reg = <0xa800000 0xa100000>;
+			};
+
+			partition@ae00000 {
+				label = "alt_rootfs";
+				reg = <0xae00000 0x9b00000>;
+			};
+
+			partition@14900000 {
+				label = "sysdiag";
+				reg = <0x14900000 0x200000>;
+				read-only;
+			};
+
+			partition@14b00000 {
+				label = "syscfg";
+				reg = <0x14b00000 0xb500000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&pcie0 {
+	status = "okay";
+
+	perst-gpios = <&tlmm 38 GPIO_ACTIVE_LOW>;
+	wake-gpios = <&tlmm 40 GPIO_ACTIVE_LOW>;
+	clkreq-gpios = <&tlmm 39 GPIO_ACTIVE_LOW>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi2: wifi@1,0 {
+			compatible = "qcom,ath10k";
+			reg = <0x00010000 0 0 0 0>;
+		};
+	};
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+	label = "lan";
+
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_gmac1>;
+};
+
+&swport5 {
+	status = "okay";
+	label = "wan";
+
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_gmac0>;
+};
+
+&wifi0 {
+	pinctrl-0 = <&wifi_0_pins>;
+	pinctrl-names = "default";
+
+	status = "okay";
+
+	qcom,coexist-support = <1>;
+	qcom,coexist-gpio-pin = <0x34>;
+
+	ieee80211-freq-limit = <2401000 2473000>;
+	qcom,ath10k-calibration-variant = "linksys-whw03v2";
+
+	nvmem-cell-names = "pre-calibration", "mac-address";
+	nvmem-cells = <&precal_art_1000>, <&macaddr_gmac0>;
+	mac-address-increment = <1>;
+};
+
+&wifi1 {
+	status = "okay";
+
+	ieee80211-freq-limit = <5170000 5250000>;
+	qcom,ath10k-calibration-variant = "linksys-whw03v2";
+
+	nvmem-cell-names = "pre-calibration", "mac-address";
+	nvmem-cells = <&precal_art_5000>, <&macaddr_gmac0>;
+	mac-address-increment = <2>;
+};
+
+&wifi2 {
+	status = "okay";
+
+	ieee80211-freq-limit = <5735000 5835000>;
+	qcom,ath10k-calibration-variant = "linksys-whw03v2";
+
+	nvmem-cell-names = "pre-calibration", "mac-address";
+	nvmem-cells = <&precal_art_9000>, <&macaddr_gmac0>;
+	mac-address-increment = <3>;
+};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-wifi.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-wifi.dts
index 9448e5145e29c3..f92c28973810a5 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-wifi.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-wifi.dts
@@ -13,6 +13,14 @@
 	model = "Google WiFi (Gale)";
 	compatible = "google,wifi", "google,gale-v2", "qcom,ipq4019";
 
+	aliases {
+		label-mac-device = &gmac0;
+		led-boot = &led0_blue;
+		led-failsafe = &led0_red;
+		led-running = &led0_blue;
+		led-upgrade = &led0_red;
+	};
+
 	chosen {
 		/*
 		 * rootwait: in case we're booting from slow/async USB storage.
@@ -27,28 +35,47 @@
 	};
 
 	soc {
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
 		edma@c080000 {
-			status = "okay";
+			/*
+			 * Factory bootloader (depthcharge) will fail to boot
+			 * if this exact path (soc/edma@c080000/gmac0) doesn't
+			 * exist.
+			 */
+			gmac0: gmac0 {
+			};
+
+			/*
+			 * Factory bootloader (depthcharge) will fail to boot
+			 * if this exact path (soc/edma@c080000/gmac1) doesn't
+			 * exist.
+			 */
+			gmac1 {
+			};
 		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&fw_pinmux>;
+		pinctrl-names = "default";
 
-		ess-psgmii@98000 {
-			status = "okay";
+		reset {
+			label = "reset";
+			gpios = <&tlmm 57 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
 		};
 	};
 };
 
 &tlmm {
-	fw_pinmux {
+	fw_pinmux: fw_pinmux {
 		wp {
 			pins = "gpio53";
 			output-low;
 		};
 		recovery {
 			pins = "gpio57";
+			function = "gpio";
 			bias-none;
 		};
 		developer {
@@ -232,12 +259,13 @@
 		clock-mode = /bits/ 8 <1>;
 
 #if 1
-		led@0 {
+		led0_red: led@0 {
 			reg = <0>;
 			chan-name = "LED0_Red";
 			led-cur = /bits/ 8 <0x64>;
 			max-cur = /bits/ 8 <0x78>;
 			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_FAULT;
 		};
 
 		led@1 {
@@ -248,12 +276,13 @@
 			color = <LED_COLOR_ID_GREEN>;
 		};
 
-		led@2 {
+		led0_blue: led@2 {
 			reg = <2>;
 			chan-name = "LED0_Blue";
 			led-cur = /bits/ 8 <0x64>;
 			max-cur = /bits/ 8 <0x78>;
 			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_POWER;
 		};
 #else
 		/*
@@ -262,6 +291,7 @@
 		 * # echo 255 > /sys/class/leds/tricolor/brightness
 		 */
 		multi-led@2 {
+			function = LED_FUNCTION_POWER;
 			reg = <2>;
 			color = <LED_COLOR_ID_RGB>;
 			#address-cells = <1>;
@@ -339,18 +369,8 @@
 	status = "okay";
 };
 
-&gmac0 {
-	qcom,phy_mdio_addr = <4>;
-	qcom,poll_required = <1>;
-	qcom,forced_speed = <1000>;
-	qcom,forced_duplex = <1>;
-	vlan_tag = <2 0x20>;
-};
-
-&gmac1 {
-	qcom,phy_mdio_addr = <3>;
-	qcom,forced_duplex = <1>;
-	vlan_tag = <1 0x10>;
+&gmac {
+	status = "okay";
 };
 
 &mdio {
@@ -372,6 +392,20 @@
 	non-removable;
 };
 
+&switch {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+
+	label = "lan";
+};
+
+&swport5 {
+	status = "okay";
+};
+
 &usb2 {
 	status = "okay";
 };
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-wpj419.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-wpj419.dts
index 4a4c18322fd0a5..ca37884db23e1f 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-wpj419.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-wpj419.dts
@@ -253,10 +253,6 @@
 			reset-delay-us = <5000>;
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@194b000 {
 			/* select hostmode */
 			compatible = "qcom,tcsr";
@@ -333,16 +329,6 @@
 			status = "okay";
 		};
 
-		ess-switch@c000000 {
-			switch_lan_bmp = <0x1e>;
-			switch_wan_bmp = <0x20>;
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
-
 		qpic_bam: dma@7984000 {
 			status = "okay";
 		};
@@ -371,22 +357,6 @@
 	status = "okay";
 };
 
-&gmac0 {
-	qcom,phy_mdio_addr = <4>;
-	qcom,poll_required = <1>;
-	qcom,forced_speed = <1000>;
-	qcom,forced_duplex = <1>;
-	vlan_tag = <2 0x20>;
-};
-
-&gmac1 {
-	qcom,phy_mdio_addr = <3>;
-	qcom,poll_required = <1>;
-	qcom,forced_speed = <1000>;
-	qcom,forced_duplex = <1>;
-	vlan_tag = <1 0x10>;
-};
-
 &wifi0 {
 	status = "okay";
 	nvmem-cell-names = "pre-calibration";
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-wtr-m2133hp.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-wtr-m2133hp.dts
index 1f8c830d902e7d..3260de23bd4089 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-wtr-m2133hp.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-wtr-m2133hp.dts
@@ -32,7 +32,6 @@
 		led-failsafe = &led_power_orange;
 		led-running = &led_power_white;
 		led-upgrade = &led_power_blue;
-		label-mac-device = &gmac0;
 	};
 
 	soc {
@@ -73,19 +72,6 @@
 			status = "okay";
 		};
 
-		ess-switch@c000000 {
-			status = "okay";
-			switch_lan_bmp = <0x1c>;
-		};
-
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
-
 		usb3@8af8800 {
 			status = "okay";
 		};
@@ -431,21 +417,40 @@
 	qcom,ath10k-calibration-variant = "Buffalo-WTR-M2133HP";
 };
 
-&mdio {
+&switch {
 	status = "okay";
-	pinctrl-0 = <&mdio_pins>;
-	pinctrl-names = "default";
-	reset-gpios = <&tlmm 47 GPIO_ACTIVE_LOW>;
 };
 
-&gmac0 {
-	nvmem-cells = <&macaddr_orgdata_20>;
-	nvmem-cell-names = "mac-address";
+&swport2 {
+	status = "okay";
+	label = "lan3";
 };
 
-&gmac1 {
-	nvmem-cells = <&macaddr_orgdata_20>;
+&swport3 {
+	status = "okay";
+	label = "lan2";
+};
+
+&swport4 {
+	status = "okay";
+	label = "lan1";
+};
+
+&swport5 {
+	status = "okay";
+};
+
+&gmac {
+	status = "okay";
 	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_orgdata_20>;
+};
+
+&mdio {
+	status = "okay";
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	reset-gpios = <&tlmm 47 GPIO_ACTIVE_LOW>;
 };
 
 &usb3_ss_phy {
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-x1pro.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-x1pro.dts
index 95a0ded6d97eed..681300c502bf18 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-x1pro.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-x1pro.dts
@@ -87,17 +87,3 @@
 		};
 	};
 };
-
-&gmac0 {
-	status = "okay";
-
-	mtd-mac-address = <&art 0x5006>;
-	mtd-mac-address-increment = <2>;
-};
-
-&gmac1 {
-	status = "okay";
-
-	mtd-mac-address = <&art 0x5006>;
-	mtd-mac-address-increment = <3>;
-};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-x1pro.dtsi b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-x1pro.dtsi
index 4edd88cde045a2..3de6a10433714b 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-x1pro.dtsi
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-x1pro.dtsi
@@ -15,7 +15,7 @@
 		serial0 = &blsp1_uart1;
 		serial1 = &blsp1_uart2;
 	};
-	
+
 	soc {
 
 		rng@22000 {
@@ -30,10 +30,6 @@
 			reset-delay-us = <2000>;
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -96,14 +92,6 @@
 			status = "okay";
 		};
 
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
-
 		leds {
 			compatible = "gpio-leds";
 			pinctrl-0 = <&led_pins>;
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-xx8300.dtsi b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-xx8300.dtsi
index 8f971e505c3c7d..141ea604425a5e 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-xx8300.dtsi
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-xx8300.dtsi
@@ -3,7 +3,7 @@
 /*
  * Device Tree Source for Linksys xx8300 (Dallas)
  *
- * Copyright (C) 2019 Jeff Kletsky
+ * Copyright (C) 2019, 2022 Jeff Kletsky
  * Updated 2020 Hans Geiblinger
  *
  */
@@ -35,10 +35,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -103,14 +99,16 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
+	};
 
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
+	regulator-usb-vbus {
+		compatible = "regulator-fixed";
+		regulator-name = "USB_VBUS";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		regulator-always-on;
+		regulator-boot-on;
+		gpio = <&tlmm 68 GPIO_ACTIVE_LOW>;
 	};
 };
 
@@ -207,9 +205,9 @@
 				reg = <0x780000 0x5800000>;
 			};
 
-			partition@a80000 {
+			partition@c80000 {
 				label = "rootfs";
-				reg = <0xa80000 0x5500000>;
+				reg = <0xc80000 0x5300000>;
 			};
 
 			partition@5f80000 {
@@ -217,9 +215,9 @@
 				reg = <0x5f80000 0x5800000>;
 			};
 
-			partition@6280000 {
+			partition@6480000 {
 				label = "alt_rootfs";
-				reg = <0x6280000 0x5500000>;
+				reg = <0x6480000 0x5300000>;
 			};
 
 			partition@b780000 {
@@ -280,7 +278,7 @@
 			pins =  "gpio55", "gpio56", "gpio57",
 				"gpio60", "gpio62", "gpio63",
 				"gpio64", "gpio65", "gpio66",
-				"gpio67", "gpio68", "gpio69";
+				"gpio67", "gpio69";
 			function = "qpic";
 			bias-pull-down;
 		};
@@ -298,3 +296,31 @@
 &usb3_ss_phy {
 	status = "okay";
 };
+
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport1 {
+	status = "okay";
+};
+
+&swport2 {
+	status = "okay";
+};
+
+&swport3 {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+};
+
+&swport5 {
+	status = "okay";
+};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4028-wpj428.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4028-wpj428.dts
index 3892c9bd8179ee..48b5cd53d80bd4 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4028-wpj428.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4028-wpj428.dts
@@ -38,10 +38,6 @@
 			reset-delay-us = <2000>;
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@194b000 {
 			/* select hostmode */
 			compatible = "qcom,tcsr";
@@ -83,17 +79,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			switch_lan_bmp = <0x10>;
-			switch_wan_bmp = <0x20>;
-
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -242,6 +227,14 @@
 				precal_art_5000: precal@5000 {
 					reg = <0x5000 0x2f20>;
 				};
+
+				macaddr_art_e010: mac-address@e010 {
+					reg = <0xe010 0x6>;
+				};
+
+				macaddr_art_e018: mac-address@e018 {
+					reg = <0xe018 0x6>;
+				};
 			};
 			partition6@180000 {
 				compatible = "denx,fit";
@@ -262,20 +255,28 @@
 	status = "okay";
 };
 
-&gmac0 {
-	qcom,phy_mdio_addr = <4>;
-	qcom,poll_required = <1>;
-	qcom,forced_speed = <1000>;
-	qcom,forced_duplex = <1>;
-	vlan_tag = <2 0x20>;
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+	label = "lan1";
+
+	nvmem-cells = <&macaddr_art_e018>;
+	nvmem-cell-names = "mac-address";
 };
 
-&gmac1 {
-	qcom,phy_mdio_addr = <3>;
-	qcom,poll_required = <1>;
-	qcom,forced_speed = <1000>;
-	qcom,forced_duplex = <1>;
-	vlan_tag = <1 0x10>;
+&swport5 {
+	status = "okay";
+	label = "lan2";
+
+	nvmem-cells = <&macaddr_art_e010>;
+	nvmem-cell-names = "mac-address";
 };
 
 &usb3_ss_phy {
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-ap-303h.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-ap-303h.dts
index 201ce97cd94c71..23abb3537cb758 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-ap-303h.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-ap-303h.dts
@@ -76,14 +76,6 @@
 			status = "okay";
 		};
 
-		ess-switch@c000000 {
-			status = "okay";
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
-
 		i2c_0: i2c@78b7000 {
 			pinctrl-0 = <&i2c_0_pins>;
 			pinctrl-names = "default";
@@ -100,7 +92,7 @@
 				/* No driver */
 				compatible = "isl,isl28022";
 				reg = <0x40>;
-		    };
+			};
 		};
 	};
 
@@ -367,6 +359,10 @@
 				macaddr_mfginfo_1d: macaddr@1d {
 					reg = <0x1d 0x6>;
 				};
+
+				macaddr_mfginfo_45: macaddr@45 {
+					reg = <0x45 0x6>;
+				};
 			};
 
 			partition@3a0000 {
@@ -428,19 +424,49 @@
 	status = "okay";
 };
 
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport2 {
+	status = "okay";
+
+	label = "lan1";
+};
+
+&swport3 {
+	status = "okay";
+
+	label = "lan2";
+};
+
+&swport4 {
+	status = "okay";
+
+	label = "lan3";
+};
+
+&swport5 {
+	status = "okay";
+
+	label = "wan";
+};
+
 &wifi0 {
 	status = "okay";
-	qcom,ath10k-calibration-variant = "Aruba-AP-303";
 	nvmem-cell-names = "pre-calibration", "mac-address";
-	nvmem-cells = <&precal_art_1000>, <&macaddr_mfginfo_1d>;
+	nvmem-cells = <&precal_art_1000>, <&macaddr_mfginfo_45>;
 	qcom,ath10k-calibration-variant = "Aruba-AP-303";
 };
 
 &wifi1 {
 	status = "okay";
-	qcom,ath10k-calibration-variant = "Aruba-AP-303";
 	nvmem-cell-names = "pre-calibration", "mac-address";
-	nvmem-cells = <&precal_art_5000>, <&macaddr_mfginfo_1d>;
+	nvmem-cells = <&precal_art_5000>, <&macaddr_mfginfo_45>;
 	mac-address-increment = <1>;
 	qcom,ath10k-calibration-variant = "Aruba-AP-303";
 };
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-aruba-glenmorangie.dtsi b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-aruba-glenmorangie.dtsi
index 0b94aafc83f9c4..41de6bb218b925 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-aruba-glenmorangie.dtsi
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-aruba-glenmorangie.dtsi
@@ -21,14 +21,7 @@
 			pinctrl-0 = <&mdio_pins>;
 			pinctrl-names = "default";
 
-			/delete-node/ ethernet-phy@0;
-			/delete-node/ ethernet-phy@1;
-			/delete-node/ ethernet-phy@2;
-			/delete-node/ ethernet-phy@3;
-			/delete-node/ ethernet-phy@4;
-			/delete-node/ psgmii-phy@5;
-
-			ethernet-phy@5 {
+			ethphy: ethernet-phy@5 {
 				reg = <0x5>;
 			};
 		};
@@ -64,19 +57,6 @@
 			status = "okay";
 		};
 
-		ess-switch@c000000 {
-			switch_mac_mode = <0x3>; /* mac mode for RGMII RMII */
-			switch_lan_bmp = <0x0>; /* lan port bitmap */
-			switch_wan_bmp = <0x10>; /* wan port bitmap */
-		};
-
-		edma@c080000 {
-			qcom,single-phy;
-			qcom,num_gmac = <1>;
-			phy-mode = "rgmii-id";
-			status = "okay";
-		};
-
 		i2c_0: i2c@78b7000 {
 			pinctrl-0 = <&i2c_0_pins>;
 			pinctrl-names = "default";
@@ -123,12 +103,6 @@
 	status = "okay";
 };
 
-&gmac0 {
-	qcom,phy_mdio_addr = <5>;
-	qcom,poll_required = <1>;
-	vlan_tag = <0 0x20>;
-};
-
 &qpic_bam {
 	status = "okay";
 };
@@ -240,6 +214,48 @@
 	};
 };
 
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+
+	/delete-property/ psgmii-ethphy;
+};
+
+&swport5 {
+	status = "okay";
+
+	label = "lan";
+	phy-handle = <&ethphy>;
+	phy-mode = "rgmii-id";
+};
+
+&ethphy0 {
+	status = "disabled";
+};
+
+&ethphy1 {
+	status = "disabled";
+};
+
+&ethphy2 {
+	status = "disabled";
+};
+
+&ethphy3 {
+	status = "disabled";
+};
+
+&ethphy4 {
+	status = "disabled";
+};
+
+&psgmiiphy {
+	status = "disabled";
+};
+
 &wifi0 {
 	status = "okay";
 	nvmem-cell-names = "pre-calibration", "mac-address";
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-gl-b1300.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-gl-b1300.dts
index 6e087ba024f9da..7e4519a746617d 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-gl-b1300.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-gl-b1300.dts
@@ -28,6 +28,7 @@
 		led-failsafe = &power;
 		led-running = &power;
 		led-upgrade = &power;
+		label-mac-device = &swport4;
 	};
 
 	memory {
@@ -44,10 +45,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -89,16 +86,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-			switch_lan_bmp = <0x18>;
-			switch_wan_bmp = <0x20>;
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -219,6 +206,14 @@
 				precal_art_5000: precal@5000 {
 					reg = <0x5000 0x2f20>;
 				};
+
+				macaddr_gmac0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_gmac1: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
 			};
 
 			firmware@180000 {
@@ -280,6 +275,38 @@
 	status = "okay";
 };
 
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport3 {
+	status = "okay";
+
+	label = "lan2";
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_gmac0>;
+	mac-address-increment = <2>;
+};
+
+&swport4 {
+	status = "okay";
+
+	label = "lan1";
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_gmac0>;
+};
+
+&swport5 {
+	status = "okay";
+
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_gmac1>;
+};
+
 &wifi0 {
 	status = "okay";
 	nvmem-cell-names = "pre-calibration";
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-gl-s1300.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-gl-s1300.dts
index e9490c2690939a..0e7f4c970f474a 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-gl-s1300.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-gl-s1300.dts
@@ -30,10 +30,6 @@
 			status = "okay";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -75,16 +71,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-			switch_lan_bmp = <0x18>;
-			switch_wan_bmp = <0x20>;
-		};
-
-		edma@c080000 {
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -235,7 +221,7 @@
 	status = "okay";
 
 	spidev1: spi@0 {
-		compatible = "siliconlabs,si3210";
+		compatible = "silabs,si3210";
 		reg = <0>;
 		spi-max-frequency = <24000000>;
 	};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-insect-common.dtsi b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-insect-common.dtsi
index 47646e4b3cd910..ebfab171f51cc4 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-insect-common.dtsi
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-insect-common.dtsi
@@ -86,19 +86,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			switch_mac_mode = <0x3>; /* mac mode for RGMII RMII */
-			switch_lan_bmp = <0x0>; /* lan port bitmap */
-			switch_wan_bmp = <0x10>; /* wan port bitmap */
-		};
-
-		edma@c080000 {
-			qcom,single-phy;
-			qcom,num_gmac = <1>;
-			phy-mode = "rgmii-rxid";
-			status = "okay";
-		};
 	};
 
 	keys {
@@ -136,21 +123,22 @@
 	status = "okay";
 };
 
-&gmac0 {
-	qcom,phy_mdio_addr = <1>;
-	qcom,poll_required = <1>;
-	vlan_tag = <0 0x20>;
-};
-
 &blsp1_i2c3 {
 	pinctrl-0 = <&i2c_0_pins>;
 	pinctrl-names = "default";
 	status = "okay";
-	at24@50 {
+
+	eeprom@50 {
 		compatible = "atmel,24c64";
 		pagesize = <32>;
 		reg = <0x50>;
 		read-only; /* This holds our MAC & Meraki board-data */
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		mac_address: mac-address@66 {
+			reg = <0x66 0x6>;
+		};
 	};
 };
 
@@ -296,6 +284,9 @@
 			compatible = "qcom,ath10k";
 			status = "okay";
 			reg = <0x00010000 0 0 0 0>;
+			nvmem-cells = <&mac_address>;
+			nvmem-cell-names = "mac-address";
+			mac-address-increment = <1>;
 		};
 	};
 };
@@ -399,9 +390,55 @@
 &wifi0 {
 	status = "okay";
 	qcom,ath10k-calibration-variant = "Meraki-MR33";
+	nvmem-cells = <&mac_address>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <2>;
 };
 
 &wifi1 {
 	status = "okay";
 	qcom,ath10k-calibration-variant = "Meraki-MR33";
+	nvmem-cells = <&mac_address>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <3>;
+};
+
+&gmac {
+	status = "okay";
+	nvmem-cells = <&mac_address>;
+	nvmem-cell-names = "mac-address";
+};
+
+&switch {
+	status = "okay";
+
+	/delete-property/ psgmii-ethphy;
+};
+
+&swport5 {
+	status = "okay";
+
+	label = "lan";
+	phy-handle = <&ethphy1>;
+	phy-mode = "rgmii-rxid";
+};
+
+&ethphy0 {
+	status = "disabled";
+};
+
+&ethphy2 {
+	status = "disabled";
+};
+
+&ethphy3 {
+	status = "disabled";
+};
+
+&ethphy4 {
+	status = "disabled";
+};
+
+&psgmiiphy {
+	status = "disabled";
 };
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-ws-ap3915i.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-ws-ap3915i.dts
index c14023559be098..8794d839a87b57 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-ws-ap3915i.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4029-ws-ap3915i.dts
@@ -14,7 +14,6 @@
 		led-failsafe = &led_system_amber;
 		led-running = &led_system_green;
 		led-upgrade = &led_system_amber;
-		label-mac-device = &gmac0;
 	};
 
 	soc {
@@ -28,10 +27,6 @@
 			pinctrl-names = "default";
 		};
 
-		ess-psgmii@98000 {
-			status = "okay";
-		};
-
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1949000 0x100>;
@@ -57,17 +52,6 @@
 		watchdog@b017000 {
 			status = "okay";
 		};
-
-		ess-switch@c000000 {
-			status = "okay";
-			switch_lan_bmp = <0x20>;
-			switch_wan_bmp = <0x00>;
-		};
-
-		edma@c080000 {
-			status = "okay";
-			qcom,num_gmac = <1>;
-		};
 	};
 
 	leds {
@@ -140,6 +124,20 @@
 	status = "okay";
 };
 
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport5 {
+	status = "okay";
+
+	label = "lan";
+};
+
 &tlmm {
 	mdio_pins: mdio_pinmux {
 		mux_1 {
@@ -262,11 +260,3 @@
 		};
 	};
 };
-
-&gmac0 {
-	qcom,phy_mdio_addr = <4>;
-	qcom,poll_required = <1>;
-	qcom,forced_speed = <1000>;
-	qcom,forced_duplex = <1>;
-	vlan_tag = <1 0x20>;
-};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq40x9-dr40x9.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq40x9-dr40x9.dts
new file mode 100644
index 00000000000000..b90b6b28c32e8c
--- /dev/null
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq40x9-dr40x9.dts
@@ -0,0 +1,422 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq4019.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	model = "Wallystech DR40X9";
+	compatible = "wallys,dr40x9";
+
+	chosen {
+		bootargs-append = " ubi.mtd=ubi root=/dev/ubiblock0_1";
+	};
+
+	soc {
+		counter@4a1000 {
+			compatible = "qcom,qca-gcnt";
+			reg = <0x4a1000 0x4>;
+		};
+
+		tcsr@1949000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1949000 0x100>;
+			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
+		};
+
+		tcsr@194b000 {
+			status = "okay";
+
+			/* select hostmode */
+			compatible = "qcom,tcsr";
+			reg = <0x194b000 0x100>;
+			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
+		};
+
+		ess_tcsr@1953000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1953000 0x1000>;
+			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
+		};
+
+		tcsr@1957000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1957000 0x100>;
+			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		wlan2g {
+			label = "dr4029:green:wlan2g";
+			gpios = <&tlmm 32 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wlan5g {
+			label = "dr4029:green:wlan5g";
+			gpios = <&tlmm 50 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		wlan2g-strength {
+			label = "dr4029:green:wlan2g-strength";
+			gpios = <&tlmm 36 GPIO_ACTIVE_LOW>;
+		};
+
+		wlan5g-strength {
+			label = "dr4029:green:wlan5g-strength";
+			gpios = <&tlmm 39 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&tlmm {
+	mdio_pins: mdio_pinmux {
+		mux_1 {
+			pins = "gpio6";
+			function = "mdio";
+			bias-pull-up;
+		};
+		mux_2 {
+			pins = "gpio7";
+			function = "mdc";
+			bias-pull-up;
+		};
+	};
+
+	serial0_pins: serial0_pinmux {
+		mux {
+			pins = "gpio16", "gpio17";
+			function = "blsp_uart0";
+			bias-disable;
+		};
+	};
+
+	serial1_pins: serial1_pinmux {
+		mux {
+			pins = "gpio8", "gpio9";
+			function = "blsp_uart1";
+			bias-disable;
+		};
+	};
+
+	spi_0_pins: spi_0_pinmux {
+		pinmux {
+			function = "blsp_spi0";
+			pins = "gpio13", "gpio14", "gpio15";
+			drive-strength = <12>;
+			bias-disable;
+		};
+		pinmux_cs {
+			function = "gpio";
+			pins = "gpio12";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+
+	nand_pins: nand_pins {
+		pullups {
+			pins =  "gpio52", "gpio53", "gpio58", "gpio59";
+			function = "qpic";
+			bias-pull-up;
+		};
+
+		pulldowns {
+			pins = "gpio54", "gpio55", "gpio56", "gpio57",
+				"gpio60", "gpio62", "gpio63", "gpio64",
+				"gpio65", "gpio66", "gpio67", "gpio68",
+				"gpio69";
+			function = "qpic";
+			bias-pull-down;
+		};
+	};
+
+	sd_pins: sd_pins {
+		pinmux {
+			function = "sdio";
+			pins = "gpio23", "gpio24", "gpio25", "gpio26",
+				"gpio28", "gpio29", "gpio30", "gpio31";
+			drive-strength = <10>;
+		};
+		pinmux_sd_clk {
+			function = "sdio";
+			pins = "gpio27";
+			drive-strength = <16>;
+		};
+		pinmux_sd7 {
+			function = "sdio";
+			pins = "gpio32";
+			drive-strength = <10>;
+			bias-disable;
+		};
+	};
+};
+
+&blsp_dma {
+	status = "okay";
+};
+
+&blsp1_spi1 {
+	status = "okay";
+
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+
+	cs-gpios = <&tlmm 12 GPIO_ACTIVE_HIGH>;
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		spi-max-frequency = <24000000>;
+		reg = <0>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition0@0 {
+				label = "0:SBL1";
+				reg = <0x00000000 0x00040000>;
+				read-only;
+			};
+
+			partition1@40000 {
+				label = "0:MIBIB";
+				reg = <0x00040000 0x00020000>;
+				read-only;
+			};
+
+			partition2@60000 {
+				label = "0:QSEE";
+				reg = <0x00060000 0x00060000>;
+				read-only;
+			};
+
+			partition3@c0000 {
+				label = "0:CDT";
+				reg = <0x000c0000 0x00010000>;
+				read-only;
+			};
+
+			partition4@d0000 {
+				label = "0:DDRPARAMS";
+				reg = <0x000d0000 0x00010000>;
+				read-only;
+			};
+
+			partition5@e0000 {
+				label = "0:APPSBLENV"; /* uboot env */
+				reg = <0x000e0000 0x00010000>;
+				read-only;
+			};
+
+			partition6@f0000 {
+				label = "0:APPSBL"; /* uboot */
+				reg = <0x000f0000 0x00080000>;
+				read-only;
+			};
+
+			partition7@170000 {
+				label = "0:ART";
+				reg = <0x00170000 0x00010000>;
+				read-only;
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				precal_art_1000: precal@1000 {
+					reg = <0x1000 0x2f20>;
+				};
+
+				precal_art_5000: precal@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+
+				macaddr_art_0: mac-address@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_art_6: mac-address@6 {
+					reg = <0x6 0x6>;
+				};
+
+				macaddr_art_1006: mac-address@1006 {
+					reg = <0x1006 0x6>;
+				};
+
+				macaddr_art_5006: mac-address@5006 {
+					reg = <0x5006 0x6>;
+				};
+
+			};
+
+			partition8@180000 {
+				label = "0:CONFIG";
+				reg = <0x00180000 0x00010000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&nand {
+	status = "okay";
+
+	pinctrl-0 = <&nand_pins>;
+	pinctrl-names = "default";
+
+	nand@0 {
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "ubi";
+				reg = <0x00000000 0x04000000>;
+			};
+		};
+	};
+};
+
+&blsp1_uart1 {
+	status = "okay";
+	pinctrl-0 = <&serial0_pins>;
+	pinctrl-names = "default";
+};
+
+&blsp1_uart2 {
+	status = "okay";
+	pinctrl-0 = <&serial1_pins>;
+	pinctrl-names = "default";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&cryptobam {
+	num-channels = <4>;
+	qcom,num-ees = <2>;
+	status = "okay";
+};
+
+&mdio {
+	status = "okay";
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	reset-gpios = <&tlmm 41 GPIO_ACTIVE_LOW>;
+	reset-delay-us = <2000>;
+};
+
+&pcie0 {
+	status = "okay";
+
+	perst-gpio = <&tlmm 38 GPIO_ACTIVE_LOW>;
+	wake-gpio = <&tlmm 40 GPIO_ACTIVE_LOW>;
+
+	/* Unpolulated slot */
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+	};
+};
+
+&vqmmc {
+	status = "okay";
+};
+
+&sdhci {
+	status = "okay";
+	pinctrl-0 = <&sd_pins>;
+	pinctrl-names = "default";
+	cd-gpios = <&tlmm 22 GPIO_ACTIVE_LOW>;
+	vqmmc-supply = <&vqmmc>;
+};
+
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+	label = "wan";
+	nvmem-cells = <&macaddr_art_0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&swport5 {
+	status = "okay";
+	label = "lan";
+	nvmem-cells = <&macaddr_art_6>;
+	nvmem-cell-names = "mac-address";
+};
+
+&wifi0 {
+	status = "okay";
+	nvmem-cells = <&precal_art_1000>, <&macaddr_art_1006>;
+	nvmem-cell-names = "pre-calibration", "mac-address";
+	qcom,ath10k-calibration-variant = "Wallys-DR40X9";
+};
+
+&wifi1 {
+	status = "okay";
+	nvmem-cell-names = "pre-calibration", "mac-address";
+	nvmem-cells = <&precal_art_5000>, <&macaddr_art_5006>;
+	qcom,ath10k-calibration-variant = "Wallys-DR40X9";
+};
+
+&usb2 {
+	status = "okay";
+};
+
+&usb2_hs_phy {
+	status = "okay";
+};
+
+&usb3 {
+	status = "okay";
+};
+
+&usb3_ss_phy {
+	status = "okay";
+};
+
+&usb3_hs_phy {
+	status = "okay";
+};
+
+&prng {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
diff --git a/target/linux/ipq40xx/files/drivers/net/dsa/qca/qca8k-ipq4019.c b/target/linux/ipq40xx/files/drivers/net/dsa/qca/qca8k-ipq4019.c
new file mode 100644
index 00000000000000..202d1a582cb5e0
--- /dev/null
+++ b/target/linux/ipq40xx/files/drivers/net/dsa/qca/qca8k-ipq4019.c
@@ -0,0 +1,1655 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (C) 2009 Felix Fietkau <nbd@nbd.name>
+ * Copyright (C) 2011-2012, 2020-2021 Gabor Juhos <juhosg@openwrt.org>
+ * Copyright (c) 2015, 2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2016 John Crispin <john@phrozen.org>
+ * Copyright (c) 2021 Robert Marko <robert.marko@sartura.hr>
+ */
+
+#include <linux/version.h>
+#include <linux/etherdevice.h>
+#include <linux/if_bridge.h>
+#include <linux/mdio.h>
+#include <linux/mfd/syscon.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/of_mdio.h>
+#include <linux/of_net.h>
+#include <linux/of_platform.h>
+#include <linux/phy.h>
+#include <linux/phylink.h>
+#include <linux/reset.h>
+#include <net/dsa.h>
+
+#include "qca8k-ipq4019.h"
+
+#define MIB_DESC(_s, _o, _n)	\
+	{			\
+		.size = (_s),	\
+		.offset = (_o),	\
+		.name = (_n),	\
+	}
+
+static const struct qca8k_mib_desc ar8327_mib[] = {
+	MIB_DESC(1, 0x00, "RxBroad"),
+	MIB_DESC(1, 0x04, "RxPause"),
+	MIB_DESC(1, 0x08, "RxMulti"),
+	MIB_DESC(1, 0x0c, "RxFcsErr"),
+	MIB_DESC(1, 0x10, "RxAlignErr"),
+	MIB_DESC(1, 0x14, "RxRunt"),
+	MIB_DESC(1, 0x18, "RxFragment"),
+	MIB_DESC(1, 0x1c, "Rx64Byte"),
+	MIB_DESC(1, 0x20, "Rx128Byte"),
+	MIB_DESC(1, 0x24, "Rx256Byte"),
+	MIB_DESC(1, 0x28, "Rx512Byte"),
+	MIB_DESC(1, 0x2c, "Rx1024Byte"),
+	MIB_DESC(1, 0x30, "Rx1518Byte"),
+	MIB_DESC(1, 0x34, "RxMaxByte"),
+	MIB_DESC(1, 0x38, "RxTooLong"),
+	MIB_DESC(2, 0x3c, "RxGoodByte"),
+	MIB_DESC(2, 0x44, "RxBadByte"),
+	MIB_DESC(1, 0x4c, "RxOverFlow"),
+	MIB_DESC(1, 0x50, "Filtered"),
+	MIB_DESC(1, 0x54, "TxBroad"),
+	MIB_DESC(1, 0x58, "TxPause"),
+	MIB_DESC(1, 0x5c, "TxMulti"),
+	MIB_DESC(1, 0x60, "TxUnderRun"),
+	MIB_DESC(1, 0x64, "Tx64Byte"),
+	MIB_DESC(1, 0x68, "Tx128Byte"),
+	MIB_DESC(1, 0x6c, "Tx256Byte"),
+	MIB_DESC(1, 0x70, "Tx512Byte"),
+	MIB_DESC(1, 0x74, "Tx1024Byte"),
+	MIB_DESC(1, 0x78, "Tx1518Byte"),
+	MIB_DESC(1, 0x7c, "TxMaxByte"),
+	MIB_DESC(1, 0x80, "TxOverSize"),
+	MIB_DESC(2, 0x84, "TxByte"),
+	MIB_DESC(1, 0x8c, "TxCollision"),
+	MIB_DESC(1, 0x90, "TxAbortCol"),
+	MIB_DESC(1, 0x94, "TxMultiCol"),
+	MIB_DESC(1, 0x98, "TxSingleCol"),
+	MIB_DESC(1, 0x9c, "TxExcDefer"),
+	MIB_DESC(1, 0xa0, "TxDefer"),
+	MIB_DESC(1, 0xa4, "TxLateCol"),
+	MIB_DESC(1, 0xa8, "RXUnicast"),
+	MIB_DESC(1, 0xac, "TXunicast"),
+};
+
+static int
+qca8k_read(struct qca8k_priv *priv, u32 reg, u32 *val)
+{
+	return regmap_read(priv->regmap, reg, val);
+}
+
+static int
+qca8k_write(struct qca8k_priv *priv, u32 reg, u32 val)
+{
+	return regmap_write(priv->regmap, reg, val);
+}
+
+static int
+qca8k_rmw(struct qca8k_priv *priv, u32 reg, u32 mask, u32 write_val)
+{
+	return regmap_update_bits(priv->regmap, reg, mask, write_val);
+}
+
+static int
+qca8k_reg_set(struct qca8k_priv *priv, u32 reg, u32 val)
+{
+	return regmap_set_bits(priv->regmap, reg, val);
+}
+
+static int
+qca8k_reg_clear(struct qca8k_priv *priv, u32 reg, u32 val)
+{
+	return regmap_clear_bits(priv->regmap, reg, val);
+}
+
+static const struct regmap_range qca8k_readable_ranges[] = {
+	regmap_reg_range(0x0000, 0x00e4), /* Global control */
+	regmap_reg_range(0x0100, 0x0168), /* EEE control */
+	regmap_reg_range(0x0200, 0x0270), /* Parser control */
+	regmap_reg_range(0x0400, 0x0454), /* ACL */
+	regmap_reg_range(0x0600, 0x0718), /* Lookup */
+	regmap_reg_range(0x0800, 0x0b70), /* QM */
+	regmap_reg_range(0x0c00, 0x0c80), /* PKT */
+	regmap_reg_range(0x0e00, 0x0e98), /* L3 */
+	regmap_reg_range(0x1000, 0x10ac), /* MIB - Port0 */
+	regmap_reg_range(0x1100, 0x11ac), /* MIB - Port1 */
+	regmap_reg_range(0x1200, 0x12ac), /* MIB - Port2 */
+	regmap_reg_range(0x1300, 0x13ac), /* MIB - Port3 */
+	regmap_reg_range(0x1400, 0x14ac), /* MIB - Port4 */
+	regmap_reg_range(0x1500, 0x15ac), /* MIB - Port5 */
+	regmap_reg_range(0x1600, 0x16ac), /* MIB - Port6 */
+
+};
+
+static const struct regmap_access_table qca8k_readable_table = {
+	.yes_ranges = qca8k_readable_ranges,
+	.n_yes_ranges = ARRAY_SIZE(qca8k_readable_ranges),
+};
+
+static struct regmap_config qca8k_ipq4019_regmap_config = {
+	.reg_bits = 32,
+	.val_bits = 32,
+	.reg_stride = 4,
+	.max_register = 0x16ac, /* end MIB - Port6 range */
+	.rd_table = &qca8k_readable_table,
+};
+
+static struct regmap_config qca8k_ipq4019_psgmii_phy_regmap_config = {
+	.name = "psgmii-phy",
+	.reg_bits = 32,
+	.val_bits = 32,
+	.reg_stride = 4,
+	.max_register = 0x7fc,
+};
+
+static int
+qca8k_busy_wait(struct qca8k_priv *priv, u32 reg, u32 mask)
+{
+	u32 val;
+
+	return regmap_read_poll_timeout(priv->regmap, reg, val,
+					!(val & mask),
+					0,
+					QCA8K_BUSY_WAIT_TIMEOUT);
+}
+
+static int
+qca8k_fdb_read(struct qca8k_priv *priv, struct qca8k_fdb *fdb)
+{
+	u32 reg[4], val;
+	int i, ret;
+
+	/* load the ARL table into an array */
+	for (i = 0; i < 4; i++) {
+		ret = qca8k_read(priv, QCA8K_REG_ATU_DATA0 + (i * 4), &val);
+		if (ret < 0)
+			return ret;
+
+		reg[i] = val;
+	}
+
+	/* vid - 83:72 */
+	fdb->vid = (reg[2] >> QCA8K_ATU_VID_S) & QCA8K_ATU_VID_M;
+	/* aging - 67:64 */
+	fdb->aging = reg[2] & QCA8K_ATU_STATUS_M;
+	/* portmask - 54:48 */
+	fdb->port_mask = (reg[1] >> QCA8K_ATU_PORT_S) & QCA8K_ATU_PORT_M;
+	/* mac - 47:0 */
+	fdb->mac[0] = (reg[1] >> QCA8K_ATU_ADDR0_S) & 0xff;
+	fdb->mac[1] = reg[1] & 0xff;
+	fdb->mac[2] = (reg[0] >> QCA8K_ATU_ADDR2_S) & 0xff;
+	fdb->mac[3] = (reg[0] >> QCA8K_ATU_ADDR3_S) & 0xff;
+	fdb->mac[4] = (reg[0] >> QCA8K_ATU_ADDR4_S) & 0xff;
+	fdb->mac[5] = reg[0] & 0xff;
+
+	return 0;
+}
+
+static void
+qca8k_fdb_write(struct qca8k_priv *priv, u16 vid, u8 port_mask, const u8 *mac,
+		u8 aging)
+{
+	u32 reg[3] = { 0 };
+	int i;
+
+	/* vid - 83:72 */
+	reg[2] = (vid & QCA8K_ATU_VID_M) << QCA8K_ATU_VID_S;
+	/* aging - 67:64 */
+	reg[2] |= aging & QCA8K_ATU_STATUS_M;
+	/* portmask - 54:48 */
+	reg[1] = (port_mask & QCA8K_ATU_PORT_M) << QCA8K_ATU_PORT_S;
+	/* mac - 47:0 */
+	reg[1] |= mac[0] << QCA8K_ATU_ADDR0_S;
+	reg[1] |= mac[1];
+	reg[0] |= mac[2] << QCA8K_ATU_ADDR2_S;
+	reg[0] |= mac[3] << QCA8K_ATU_ADDR3_S;
+	reg[0] |= mac[4] << QCA8K_ATU_ADDR4_S;
+	reg[0] |= mac[5];
+
+	/* load the array into the ARL table */
+	for (i = 0; i < 3; i++)
+		qca8k_write(priv, QCA8K_REG_ATU_DATA0 + (i * 4), reg[i]);
+}
+
+static int
+qca8k_fdb_access(struct qca8k_priv *priv, enum qca8k_fdb_cmd cmd, int port)
+{
+	u32 reg;
+	int ret;
+
+	/* Set the command and FDB index */
+	reg = QCA8K_ATU_FUNC_BUSY;
+	reg |= cmd;
+	if (port >= 0) {
+		reg |= QCA8K_ATU_FUNC_PORT_EN;
+		reg |= (port & QCA8K_ATU_FUNC_PORT_M) << QCA8K_ATU_FUNC_PORT_S;
+	}
+
+	/* Write the function register triggering the table access */
+	ret = qca8k_write(priv, QCA8K_REG_ATU_FUNC, reg);
+	if (ret)
+		return ret;
+
+	/* wait for completion */
+	ret = qca8k_busy_wait(priv, QCA8K_REG_ATU_FUNC, QCA8K_ATU_FUNC_BUSY);
+	if (ret)
+		return ret;
+
+	/* Check for table full violation when adding an entry */
+	if (cmd == QCA8K_FDB_LOAD) {
+		ret = qca8k_read(priv, QCA8K_REG_ATU_FUNC, &reg);
+		if (ret < 0)
+			return ret;
+		if (reg & QCA8K_ATU_FUNC_FULL)
+			return -1;
+	}
+
+	return 0;
+}
+
+static int
+qca8k_fdb_next(struct qca8k_priv *priv, struct qca8k_fdb *fdb, int port)
+{
+	int ret;
+
+	qca8k_fdb_write(priv, fdb->vid, fdb->port_mask, fdb->mac, fdb->aging);
+	ret = qca8k_fdb_access(priv, QCA8K_FDB_NEXT, port);
+	if (ret < 0)
+		return ret;
+
+	return qca8k_fdb_read(priv, fdb);
+}
+
+static int
+qca8k_fdb_add(struct qca8k_priv *priv, const u8 *mac, u16 port_mask,
+	      u16 vid, u8 aging)
+{
+	int ret;
+
+	mutex_lock(&priv->reg_mutex);
+	qca8k_fdb_write(priv, vid, port_mask, mac, aging);
+	ret = qca8k_fdb_access(priv, QCA8K_FDB_LOAD, -1);
+	mutex_unlock(&priv->reg_mutex);
+
+	return ret;
+}
+
+static int
+qca8k_fdb_del(struct qca8k_priv *priv, const u8 *mac, u16 port_mask, u16 vid)
+{
+	int ret;
+
+	mutex_lock(&priv->reg_mutex);
+	qca8k_fdb_write(priv, vid, port_mask, mac, 0);
+	ret = qca8k_fdb_access(priv, QCA8K_FDB_PURGE, -1);
+	mutex_unlock(&priv->reg_mutex);
+
+	return ret;
+}
+
+static void
+qca8k_fdb_flush(struct qca8k_priv *priv)
+{
+	mutex_lock(&priv->reg_mutex);
+	qca8k_fdb_access(priv, QCA8K_FDB_FLUSH, -1);
+	mutex_unlock(&priv->reg_mutex);
+}
+
+static int
+qca8k_vlan_access(struct qca8k_priv *priv, enum qca8k_vlan_cmd cmd, u16 vid)
+{
+	u32 reg;
+	int ret;
+
+	/* Set the command and VLAN index */
+	reg = QCA8K_VTU_FUNC1_BUSY;
+	reg |= cmd;
+	reg |= vid << QCA8K_VTU_FUNC1_VID_S;
+
+	/* Write the function register triggering the table access */
+	ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC1, reg);
+	if (ret)
+		return ret;
+
+	/* wait for completion */
+	ret = qca8k_busy_wait(priv, QCA8K_REG_VTU_FUNC1, QCA8K_VTU_FUNC1_BUSY);
+	if (ret)
+		return ret;
+
+	/* Check for table full violation when adding an entry */
+	if (cmd == QCA8K_VLAN_LOAD) {
+		ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC1, &reg);
+		if (ret < 0)
+			return ret;
+		if (reg & QCA8K_VTU_FUNC1_FULL)
+			return -ENOMEM;
+	}
+
+	return 0;
+}
+
+static int
+qca8k_vlan_add(struct qca8k_priv *priv, u8 port, u16 vid, bool untagged)
+{
+	u32 reg;
+	int ret;
+
+	/*
+	   We do the right thing with VLAN 0 and treat it as untagged while
+	   preserving the tag on egress.
+	 */
+	if (vid == 0)
+		return 0;
+
+	mutex_lock(&priv->reg_mutex);
+	ret = qca8k_vlan_access(priv, QCA8K_VLAN_READ, vid);
+	if (ret < 0)
+		goto out;
+
+	ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC0, &reg);
+	if (ret < 0)
+		goto out;
+	reg |= QCA8K_VTU_FUNC0_VALID | QCA8K_VTU_FUNC0_IVL_EN;
+	reg &= ~(QCA8K_VTU_FUNC0_EG_MODE_MASK << QCA8K_VTU_FUNC0_EG_MODE_S(port));
+	if (untagged)
+		reg |= QCA8K_VTU_FUNC0_EG_MODE_UNTAG <<
+				QCA8K_VTU_FUNC0_EG_MODE_S(port);
+	else
+		reg |= QCA8K_VTU_FUNC0_EG_MODE_TAG <<
+				QCA8K_VTU_FUNC0_EG_MODE_S(port);
+
+	ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC0, reg);
+	if (ret)
+		goto out;
+	ret = qca8k_vlan_access(priv, QCA8K_VLAN_LOAD, vid);
+
+out:
+	mutex_unlock(&priv->reg_mutex);
+
+	return ret;
+}
+
+static int
+qca8k_vlan_del(struct qca8k_priv *priv, u8 port, u16 vid)
+{
+	u32 reg, mask;
+	int ret, i;
+	bool del;
+
+	mutex_lock(&priv->reg_mutex);
+	ret = qca8k_vlan_access(priv, QCA8K_VLAN_READ, vid);
+	if (ret < 0)
+		goto out;
+
+	ret = qca8k_read(priv, QCA8K_REG_VTU_FUNC0, &reg);
+	if (ret < 0)
+		goto out;
+	reg &= ~(3 << QCA8K_VTU_FUNC0_EG_MODE_S(port));
+	reg |= QCA8K_VTU_FUNC0_EG_MODE_NOT <<
+			QCA8K_VTU_FUNC0_EG_MODE_S(port);
+
+	/* Check if we're the last member to be removed */
+	del = true;
+	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+		mask = QCA8K_VTU_FUNC0_EG_MODE_NOT;
+		mask <<= QCA8K_VTU_FUNC0_EG_MODE_S(i);
+
+		if ((reg & mask) != mask) {
+			del = false;
+			break;
+		}
+	}
+
+	if (del) {
+		ret = qca8k_vlan_access(priv, QCA8K_VLAN_PURGE, vid);
+	} else {
+		ret = qca8k_write(priv, QCA8K_REG_VTU_FUNC0, reg);
+		if (ret)
+			goto out;
+		ret = qca8k_vlan_access(priv, QCA8K_VLAN_LOAD, vid);
+	}
+
+out:
+	mutex_unlock(&priv->reg_mutex);
+
+	return ret;
+}
+
+static int
+qca8k_mib_init(struct qca8k_priv *priv)
+{
+	int ret;
+
+	mutex_lock(&priv->reg_mutex);
+	ret = qca8k_reg_set(priv, QCA8K_REG_MIB, QCA8K_MIB_FLUSH | QCA8K_MIB_BUSY);
+	if (ret)
+		goto exit;
+
+	ret = qca8k_busy_wait(priv, QCA8K_REG_MIB, QCA8K_MIB_BUSY);
+	if (ret)
+		goto exit;
+
+	ret = qca8k_reg_set(priv, QCA8K_REG_MIB, QCA8K_MIB_CPU_KEEP);
+	if (ret)
+		goto exit;
+
+	ret = qca8k_write(priv, QCA8K_REG_MODULE_EN, QCA8K_MODULE_EN_MIB);
+
+exit:
+	mutex_unlock(&priv->reg_mutex);
+	return ret;
+}
+
+static void
+qca8k_port_set_status(struct qca8k_priv *priv, int port, int enable)
+{
+	u32 mask = QCA8K_PORT_STATUS_TXMAC | QCA8K_PORT_STATUS_RXMAC;
+
+	/* Port 0 is internally connected to the CPU
+	 * TODO: Probably check for RGMII as well if it doesnt work
+	 * in RGMII mode.
+	 */
+	if (port > QCA8K_CPU_PORT)
+		mask |= QCA8K_PORT_STATUS_LINK_AUTO;
+
+	if (enable)
+		qca8k_reg_set(priv, QCA8K_REG_PORT_STATUS(port), mask);
+	else
+		qca8k_reg_clear(priv, QCA8K_REG_PORT_STATUS(port), mask);
+}
+
+static int
+qca8k_setup_port(struct dsa_switch *ds, int port)
+{
+	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+	int ret;
+
+	/* CPU port gets connected to all user ports of the switch */
+	if (dsa_is_cpu_port(ds, port)) {
+		ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(QCA8K_CPU_PORT),
+				QCA8K_PORT_LOOKUP_MEMBER, dsa_user_ports(ds));
+		if (ret)
+			return ret;
+
+		/* Disable CPU ARP Auto-learning by default */
+		ret = qca8k_reg_clear(priv, QCA8K_PORT_LOOKUP_CTRL(QCA8K_CPU_PORT),
+				      QCA8K_PORT_LOOKUP_LEARN);
+		if (ret)
+			return ret;
+	}
+
+	/* Individual user ports get connected to CPU port only */
+	if (dsa_is_user_port(ds, port)) {
+		int shift = 16 * (port % 2);
+
+		ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+				QCA8K_PORT_LOOKUP_MEMBER,
+				BIT(QCA8K_CPU_PORT));
+		if (ret)
+			return ret;
+
+		/* Enable ARP Auto-learning by default */
+		ret = qca8k_reg_set(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+				    QCA8K_PORT_LOOKUP_LEARN);
+		if (ret)
+			return ret;
+
+		/* For port based vlans to work we need to set the
+		 * default egress vid
+		 */
+		ret = qca8k_rmw(priv, QCA8K_EGRESS_VLAN(port),
+				0xfff << shift,
+				QCA8K_PORT_VID_DEF << shift);
+		if (ret)
+			return ret;
+
+		ret = qca8k_write(priv, QCA8K_REG_PORT_VLAN_CTRL0(port),
+				  QCA8K_PORT_VLAN_CVID(QCA8K_PORT_VID_DEF) |
+				  QCA8K_PORT_VLAN_SVID(QCA8K_PORT_VID_DEF));
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+static int
+qca8k_setup(struct dsa_switch *ds)
+{
+	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+	int ret, i;
+
+	/* Make sure that port 0 is the cpu port */
+	if (!dsa_is_cpu_port(ds, 0)) {
+		dev_err(priv->dev, "port 0 is not the CPU port");
+		return -EINVAL;
+	}
+
+	/* Enable CPU Port */
+	ret = qca8k_reg_set(priv, QCA8K_REG_GLOBAL_FW_CTRL0,
+			    QCA8K_GLOBAL_FW_CTRL0_CPU_PORT_EN);
+	if (ret) {
+		dev_err(priv->dev, "failed enabling CPU port");
+		return ret;
+	}
+
+	/* Enable MIB counters */
+	ret = qca8k_mib_init(priv);
+	if (ret)
+		dev_warn(priv->dev, "MIB init failed");
+
+	/* Enable QCA header mode on the cpu port */
+	ret = qca8k_write(priv, QCA8K_REG_PORT_HDR_CTRL(QCA8K_CPU_PORT),
+			  QCA8K_PORT_HDR_CTRL_ALL << QCA8K_PORT_HDR_CTRL_TX_S |
+			  QCA8K_PORT_HDR_CTRL_ALL << QCA8K_PORT_HDR_CTRL_RX_S);
+	if (ret) {
+		dev_err(priv->dev, "failed enabling QCA header mode");
+		return ret;
+	}
+
+	/* Disable forwarding by default on all ports */
+	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+		ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(i),
+				QCA8K_PORT_LOOKUP_MEMBER, 0);
+		if (ret)
+			return ret;
+	}
+
+	/* Disable MAC by default on all ports */
+	for (i = 1; i < QCA8K_NUM_PORTS; i++)
+		qca8k_port_set_status(priv, i, 0);
+
+	/* Forward all unknown frames to CPU port for Linux processing */
+	ret = qca8k_write(priv, QCA8K_REG_GLOBAL_FW_CTRL1,
+			  BIT(QCA8K_CPU_PORT) << QCA8K_GLOBAL_FW_CTRL1_IGMP_DP_S |
+			  BIT(QCA8K_CPU_PORT) << QCA8K_GLOBAL_FW_CTRL1_BC_DP_S |
+			  BIT(QCA8K_CPU_PORT) << QCA8K_GLOBAL_FW_CTRL1_MC_DP_S |
+			  BIT(QCA8K_CPU_PORT) << QCA8K_GLOBAL_FW_CTRL1_UC_DP_S);
+	if (ret)
+		return ret;
+
+	/* Setup connection between CPU port & user ports */
+	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+		ret = qca8k_setup_port(ds, i);
+		if (ret)
+			return ret;
+	}
+
+	/* Setup our port MTUs to match power on defaults */
+	for (i = 0; i < QCA8K_NUM_PORTS; i++)
+		/* Set per port MTU to 1500 as the MTU change function
+		 * will add the overhead and if its set to 1518 then it
+		 * will apply the overhead again and we will end up with
+		 * MTU of 1536 instead of 1518
+		 */
+		priv->port_mtu[i] = ETH_DATA_LEN;
+	ret = qca8k_write(priv, QCA8K_MAX_FRAME_SIZE, ETH_FRAME_LEN + ETH_FCS_LEN);
+	if (ret)
+		dev_warn(priv->dev, "failed setting MTU settings");
+
+	/* Flush the FDB table */
+	qca8k_fdb_flush(priv);
+
+	/* We don't have interrupts for link changes, so we need to poll */
+	ds->pcs_poll = true;
+
+	/* CPU port HW learning doesnt work correctly, so let DSA handle it */
+	ds->assisted_learning_on_cpu_port = true;
+
+	return 0;
+}
+
+static int psgmii_vco_calibrate(struct qca8k_priv *priv)
+{
+	int val, ret;
+
+	if (!priv->psgmii_ethphy) {
+		dev_err(priv->dev, "PSGMII eth PHY missing, calibration failed!\n");
+		return -ENODEV;
+	}
+
+	/* Fix PSGMII RX 20bit */
+	ret = phy_write(priv->psgmii_ethphy, MII_BMCR, 0x5b);
+	/* Reset PHY PSGMII */
+	ret = phy_write(priv->psgmii_ethphy, MII_BMCR, 0x1b);
+	/* Release PHY PSGMII reset */
+	ret = phy_write(priv->psgmii_ethphy, MII_BMCR, 0x5b);
+
+	/* Poll for VCO PLL calibration finish - Malibu(QCA8075) */
+	ret = phy_read_mmd_poll_timeout(priv->psgmii_ethphy,
+					MDIO_MMD_PMAPMD,
+					0x28, val,
+					(val & BIT(0)),
+					10000, 1000000,
+					false);
+	if (ret) {
+		dev_err(priv->dev, "QCA807x PSGMII VCO calibration PLL not ready\n");
+		return ret;
+	}
+	mdelay(50);
+
+	/* Freeze PSGMII RX CDR */
+	ret = phy_write(priv->psgmii_ethphy, MII_RESV2, 0x2230);
+
+	/* Start PSGMIIPHY VCO PLL calibration */
+	ret = regmap_set_bits(priv->psgmii,
+			PSGMIIPHY_VCO_CALIBRATION_CONTROL_REGISTER_1,
+			PSGMIIPHY_REG_PLL_VCO_CALIB_RESTART);
+
+	/* Poll for PSGMIIPHY PLL calibration finish - Dakota(IPQ40xx) */
+	ret = regmap_read_poll_timeout(priv->psgmii,
+				       PSGMIIPHY_VCO_CALIBRATION_CONTROL_REGISTER_2,
+				       val, val & PSGMIIPHY_REG_PLL_VCO_CALIB_READY,
+				       10000, 1000000);
+	if (ret) {
+		dev_err(priv->dev, "IPQ PSGMIIPHY VCO calibration PLL not ready\n");
+		return ret;
+	}
+	mdelay(50);
+
+	/* Release PSGMII RX CDR */
+	ret = phy_write(priv->psgmii_ethphy, MII_RESV2, 0x3230);
+	/* Release PSGMII RX 20bit */
+	ret = phy_write(priv->psgmii_ethphy, MII_BMCR, 0x5f);
+	mdelay(200);
+
+	return ret;
+}
+
+static void
+qca8k_switch_port_loopback_on_off(struct qca8k_priv *priv, int port, int on)
+{
+	u32 val = QCA8K_PORT_LOOKUP_LOOPBACK;
+
+	if (on == 0)
+		val = 0;
+
+	qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+		  QCA8K_PORT_LOOKUP_LOOPBACK, val);
+}
+
+static int
+qca8k_wait_for_phy_link_state(struct phy_device *phy, int need_status)
+{
+	int a;
+	u16 status;
+
+	for (a = 0; a < 100; a++) {
+		status = phy_read(phy, MII_QCA8075_SSTATUS);
+		status &= QCA8075_PHY_SPEC_STATUS_LINK;
+		status = !!status;
+		if (status == need_status)
+			return 0;
+		mdelay(8);
+	}
+
+	return -1;
+}
+
+static void
+qca8k_phy_loopback_on_off(struct qca8k_priv *priv, struct phy_device *phy,
+			  int sw_port, int on)
+{
+	if (on) {
+		phy_write(phy, MII_BMCR, BMCR_ANENABLE | BMCR_RESET);
+		phy_modify(phy, MII_BMCR, BMCR_PDOWN, BMCR_PDOWN);
+		qca8k_wait_for_phy_link_state(phy, 0);
+		qca8k_write(priv, QCA8K_REG_PORT_STATUS(sw_port), 0);
+		phy_write(phy, MII_BMCR,
+			BMCR_SPEED1000 |
+			BMCR_FULLDPLX |
+			BMCR_LOOPBACK);
+		qca8k_wait_for_phy_link_state(phy, 1);
+		qca8k_write(priv, QCA8K_REG_PORT_STATUS(sw_port),
+			QCA8K_PORT_STATUS_SPEED_1000 |
+			QCA8K_PORT_STATUS_TXMAC |
+			QCA8K_PORT_STATUS_RXMAC |
+			QCA8K_PORT_STATUS_DUPLEX);
+		qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(sw_port),
+			QCA8K_PORT_LOOKUP_STATE_FORWARD,
+			QCA8K_PORT_LOOKUP_STATE_FORWARD);
+	} else { /* off */
+		qca8k_write(priv, QCA8K_REG_PORT_STATUS(sw_port), 0);
+		qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(sw_port),
+			QCA8K_PORT_LOOKUP_STATE_DISABLED,
+			QCA8K_PORT_LOOKUP_STATE_DISABLED);
+		phy_write(phy, MII_BMCR, BMCR_SPEED1000 | BMCR_ANENABLE | BMCR_RESET);
+		/* turn off the power of the phys - so that unused
+			 ports do not raise links */
+		phy_modify(phy, MII_BMCR, BMCR_PDOWN, BMCR_PDOWN);
+	}
+}
+
+static void
+qca8k_phy_pkt_gen_prep(struct qca8k_priv *priv, struct phy_device *phy,
+		       int pkts_num, int on)
+{
+	if (on) {
+		/* enable CRC checker and packets counters */
+		phy_write_mmd(phy, MDIO_MMD_AN, QCA8075_MMD7_CRC_AND_PKTS_COUNT, 0);
+		phy_write_mmd(phy, MDIO_MMD_AN, QCA8075_MMD7_CRC_AND_PKTS_COUNT,
+			QCA8075_MMD7_CNT_FRAME_CHK_EN | QCA8075_MMD7_CNT_SELFCLR);
+		qca8k_wait_for_phy_link_state(phy, 1);
+		/* packet number */
+		phy_write_mmd(phy, MDIO_MMD_AN, QCA8075_MMD7_PKT_GEN_PKT_NUMB, pkts_num);
+		/* pkt size - 1504 bytes + 20 bytes */
+		phy_write_mmd(phy, MDIO_MMD_AN, QCA8075_MMD7_PKT_GEN_PKT_SIZE, 1504);
+	} else { /* off */
+		/* packet number */
+		phy_write_mmd(phy, MDIO_MMD_AN, QCA8075_MMD7_PKT_GEN_PKT_NUMB, 0);
+		/* disable CRC checker and packet counter */
+		phy_write_mmd(phy, MDIO_MMD_AN, QCA8075_MMD7_CRC_AND_PKTS_COUNT, 0);
+		/* disable traffic gen */
+		phy_write_mmd(phy, MDIO_MMD_AN, QCA8075_MMD7_PKT_GEN_CTRL, 0);
+	}
+}
+
+static void
+qca8k_wait_for_phy_pkt_gen_fin(struct qca8k_priv *priv, struct phy_device *phy)
+{
+	int val;
+	/* wait for all traffic end: 4096(pkt num)*1524(size)*8ns(125MHz)=49938us */
+	phy_read_mmd_poll_timeout(phy, MDIO_MMD_AN, QCA8075_MMD7_PKT_GEN_CTRL,
+				  val, !(val & QCA8075_MMD7_PKT_GEN_INPROGR),
+				  50000, 1000000, true);
+}
+
+static void
+qca8k_start_phy_pkt_gen(struct phy_device *phy)
+{
+	/* start traffic gen */
+	phy_write_mmd(phy, MDIO_MMD_AN, QCA8075_MMD7_PKT_GEN_CTRL,
+		      QCA8075_MMD7_PKT_GEN_START | QCA8075_MMD7_PKT_GEN_INPROGR);
+}
+
+static int
+qca8k_start_all_phys_pkt_gens(struct qca8k_priv *priv)
+{
+	struct phy_device *phy;
+	phy = phy_device_create(priv->bus, QCA8075_MDIO_BRDCST_PHY_ADDR,
+		0, 0, NULL);
+	if (!phy) {
+		dev_err(priv->dev, "unable to create mdio broadcast PHY(0x%x)\n",
+			QCA8075_MDIO_BRDCST_PHY_ADDR);
+		return -ENODEV;
+	}
+
+	qca8k_start_phy_pkt_gen(phy);
+
+	phy_device_free(phy);
+	return 0;
+}
+
+static int
+qca8k_get_phy_pkt_gen_test_result(struct phy_device *phy, int pkts_num)
+{
+	u32 tx_ok, tx_error;
+	u32 rx_ok, rx_error;
+	u32 tx_ok_high16;
+	u32 rx_ok_high16;
+	u32 tx_all_ok, rx_all_ok;
+
+	/* check counters */
+	tx_ok = phy_read_mmd(phy, MDIO_MMD_AN, QCA8075_MMD7_EG_FRAME_RECV_CNT_LO);
+	tx_ok_high16 = phy_read_mmd(phy, MDIO_MMD_AN, QCA8075_MMD7_EG_FRAME_RECV_CNT_HI);
+	tx_error = phy_read_mmd(phy, MDIO_MMD_AN, QCA8075_MMD7_EG_FRAME_ERR_CNT);
+	rx_ok = phy_read_mmd(phy, MDIO_MMD_AN, QCA8075_MMD7_IG_FRAME_RECV_CNT_LO);
+	rx_ok_high16 = phy_read_mmd(phy, MDIO_MMD_AN, QCA8075_MMD7_IG_FRAME_RECV_CNT_HI);
+	rx_error = phy_read_mmd(phy, MDIO_MMD_AN, QCA8075_MMD7_IG_FRAME_ERR_CNT);
+	tx_all_ok = tx_ok + (tx_ok_high16 << 16);
+	rx_all_ok = rx_ok + (rx_ok_high16 << 16);
+
+	if (tx_all_ok < pkts_num)
+		return -1;
+	if(rx_all_ok < pkts_num)
+		return -2;
+	if(tx_error)
+		return -3;
+	if(rx_error)
+		return -4;
+	return 0; /* test is ok */
+}
+
+static
+void qca8k_phy_broadcast_write_on_off(struct qca8k_priv *priv,
+				      struct phy_device *phy, int on)
+{
+	u32 val;
+
+	val = phy_read_mmd(phy, MDIO_MMD_AN, QCA8075_MMD7_MDIO_BRDCST_WRITE);
+
+	if (on == 0)
+		val &= ~QCA8075_MMD7_MDIO_BRDCST_WRITE_EN;
+	else
+		val |= QCA8075_MMD7_MDIO_BRDCST_WRITE_EN;
+
+	phy_write_mmd(phy, MDIO_MMD_AN, QCA8075_MMD7_MDIO_BRDCST_WRITE, val);
+}
+
+static int
+qca8k_test_dsa_port_for_errors(struct qca8k_priv *priv, struct phy_device *phy,
+			       int port, int test_phase)
+{
+	int res = 0;
+	const int test_pkts_num = QCA8075_PKT_GEN_PKTS_COUNT;
+
+	if (test_phase == 1) { /* start test preps */
+		qca8k_phy_loopback_on_off(priv, phy, port, 1);
+		qca8k_switch_port_loopback_on_off(priv, port, 1);
+		qca8k_phy_broadcast_write_on_off(priv, phy, 1);
+		qca8k_phy_pkt_gen_prep(priv, phy, test_pkts_num, 1);
+	} else if (test_phase == 2) {
+		/* wait for test results, collect it and cleanup */
+		qca8k_wait_for_phy_pkt_gen_fin(priv, phy);
+		res = qca8k_get_phy_pkt_gen_test_result(phy, test_pkts_num);
+		qca8k_phy_pkt_gen_prep(priv, phy, test_pkts_num, 0);
+		qca8k_phy_broadcast_write_on_off(priv, phy, 0);
+		qca8k_switch_port_loopback_on_off(priv, port, 0);
+		qca8k_phy_loopback_on_off(priv, phy, port, 0);
+	}
+
+	return res;
+}
+
+static int
+qca8k_do_dsa_sw_ports_self_test(struct qca8k_priv *priv, int parallel_test)
+{
+	struct device_node *dn = priv->dev->of_node;
+	struct device_node *ports, *port;
+	struct device_node *phy_dn;
+	struct phy_device *phy;
+	int reg, err = 0, test_phase;
+	u32 tests_result = 0;
+
+	ports = of_get_child_by_name(dn, "ports");
+	if (!ports) {
+		dev_err(priv->dev, "no ports child node found\n");
+			return -EINVAL;
+	}
+
+	for (test_phase = 1; test_phase <= 2; test_phase++) {
+		if (parallel_test && test_phase == 2) {
+			err = qca8k_start_all_phys_pkt_gens(priv);
+			if (err)
+				goto error;
+		}
+		for_each_available_child_of_node(ports, port) {
+			err = of_property_read_u32(port, "reg", &reg);
+			if (err)
+				goto error;
+			if (reg >= QCA8K_NUM_PORTS) {
+				err = -EINVAL;
+				goto error;
+			}
+			phy_dn = of_parse_phandle(port, "phy-handle", 0);
+			if (phy_dn) {
+				phy = of_phy_find_device(phy_dn);
+				of_node_put(phy_dn);
+				if (phy) {
+					int result;
+					result = qca8k_test_dsa_port_for_errors(priv,
+						phy, reg, test_phase);
+					if (!parallel_test && test_phase == 1)
+						qca8k_start_phy_pkt_gen(phy);
+					put_device(&phy->mdio.dev);
+					if (test_phase == 2) {
+						tests_result <<= 1;
+						if (result)
+							tests_result |= 1;
+					}
+				}
+			}
+		}
+	}
+
+end:
+	of_node_put(ports);
+	qca8k_fdb_flush(priv);
+	return tests_result;
+error:
+	tests_result |= 0xf000;
+	goto end;
+}
+
+static int
+psgmii_vco_calibrate_and_test(struct dsa_switch *ds)
+{
+	int ret, a, test_result;
+	struct qca8k_priv *priv = ds->priv;
+
+	for (a = 0; a <= QCA8K_PSGMII_CALB_NUM; a++) {
+		ret = psgmii_vco_calibrate(priv);
+		if (ret)
+			return ret;
+		/* first we run serial test */
+		test_result = qca8k_do_dsa_sw_ports_self_test(priv, 0);
+		/* and if it is ok then we run the test in parallel */
+		if (!test_result)
+			test_result = qca8k_do_dsa_sw_ports_self_test(priv, 1);
+		if (!test_result) {
+			if (a > 0) {
+				dev_warn(priv->dev, "PSGMII work was stabilized after %d "
+					"calibration retries !\n", a);
+			}
+			return 0;
+		} else {
+			schedule();
+			if (a > 0 && a % 10 == 0) {
+				dev_err(priv->dev, "PSGMII work is unstable !!! "
+					"Let's try to wait a bit ... %d\n", a);
+				set_current_state(TASK_INTERRUPTIBLE);
+				schedule_timeout(msecs_to_jiffies(a * 100));
+			}
+		}
+	}
+
+	panic("PSGMII work is unstable !!! "
+		"Repeated recalibration attempts did not help(0x%x) !\n",
+		test_result);
+
+	return -EFAULT;
+}
+
+static int
+ipq4019_psgmii_configure(struct dsa_switch *ds)
+{
+	struct qca8k_priv *priv = ds->priv;
+	int ret;
+
+	if (!priv->psgmii_calibrated) {
+		ret = psgmii_vco_calibrate_and_test(ds);
+
+		ret = regmap_clear_bits(priv->psgmii, PSGMIIPHY_MODE_CONTROL,
+					PSGMIIPHY_MODE_ATHR_CSCO_MODE_25M);
+		ret = regmap_write(priv->psgmii, PSGMIIPHY_TX_CONTROL,
+				   PSGMIIPHY_TX_CONTROL_MAGIC_VALUE);
+
+		priv->psgmii_calibrated = true;
+
+		return ret;
+	}
+
+	return 0;
+}
+
+static void
+qca8k_phylink_mac_config(struct dsa_switch *ds, int port, unsigned int mode,
+			 const struct phylink_link_state *state)
+{
+	struct qca8k_priv *priv = ds->priv;
+
+	switch (port) {
+	case 0:
+		/* CPU port, no configuration needed */
+		return;
+	case 1:
+	case 2:
+	case 3:
+		if (state->interface == PHY_INTERFACE_MODE_PSGMII)
+			if (ipq4019_psgmii_configure(ds))
+				dev_err(ds->dev, "PSGMII configuration failed!\n");
+		return;
+	case 4:
+	case 5:
+		if (state->interface == PHY_INTERFACE_MODE_RGMII ||
+		    state->interface == PHY_INTERFACE_MODE_RGMII_ID ||
+		    state->interface == PHY_INTERFACE_MODE_RGMII_RXID ||
+		    state->interface == PHY_INTERFACE_MODE_RGMII_TXID) {
+			qca8k_reg_set(priv, QCA8K_REG_RGMII_CTRL, QCA8K_RGMII_CTRL_CLK);
+		}
+
+		if (state->interface == PHY_INTERFACE_MODE_PSGMII)
+			if (ipq4019_psgmii_configure(ds))
+				dev_err(ds->dev, "PSGMII configuration failed!\n");
+		return;
+	default:
+		dev_err(ds->dev, "%s: unsupported port: %i\n", __func__, port);
+		return;
+	}
+}
+
+static void
+qca8k_phylink_validate(struct dsa_switch *ds, int port,
+		       unsigned long *supported,
+		       struct phylink_link_state *state)
+{
+	__ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
+
+	switch (port) {
+	case 0: /* CPU port */
+		if (state->interface != PHY_INTERFACE_MODE_INTERNAL)
+			goto unsupported;
+		break;
+	case 1:
+	case 2:
+	case 3:
+		/* Only PSGMII mode is supported */
+		if (state->interface != PHY_INTERFACE_MODE_PSGMII)
+			goto unsupported;
+		break;
+	case 4:
+	case 5:
+		/* PSGMII and RGMII modes are supported */
+		if (state->interface != PHY_INTERFACE_MODE_PSGMII &&
+		    state->interface != PHY_INTERFACE_MODE_RGMII &&
+		    state->interface != PHY_INTERFACE_MODE_RGMII_ID &&
+		    state->interface != PHY_INTERFACE_MODE_RGMII_RXID &&
+		    state->interface != PHY_INTERFACE_MODE_RGMII_TXID)
+			goto unsupported;
+		break;
+	default:
+unsupported:
+		dev_warn(ds->dev, "interface '%s' (%d) on port %d is not supported\n",
+			 phy_modes(state->interface), state->interface, port);
+		linkmode_zero(supported);
+		return;
+	}
+
+	if (port == 0) {
+		phylink_set_port_modes(mask);
+
+		phylink_set(mask, 1000baseT_Full);
+
+		phylink_set(mask, Pause);
+		phylink_set(mask, Asym_Pause);
+
+		linkmode_and(supported, supported, mask);
+		linkmode_and(state->advertising, state->advertising, mask);
+	} else {
+		/* Simply copy what PHYs tell us */
+		linkmode_copy(state->advertising, supported);
+	}
+}
+
+static int
+qca8k_phylink_mac_link_state(struct dsa_switch *ds, int port,
+			     struct phylink_link_state *state)
+{
+	struct qca8k_priv *priv = ds->priv;
+	u32 reg;
+	int ret;
+
+	ret = qca8k_read(priv, QCA8K_REG_PORT_STATUS(port), &reg);
+	if (ret < 0)
+		return ret;
+
+	state->link = !!(reg & QCA8K_PORT_STATUS_LINK_UP);
+	state->an_complete = state->link;
+	state->an_enabled = !!(reg & QCA8K_PORT_STATUS_LINK_AUTO);
+	state->duplex = (reg & QCA8K_PORT_STATUS_DUPLEX) ? DUPLEX_FULL :
+							   DUPLEX_HALF;
+
+	switch (reg & QCA8K_PORT_STATUS_SPEED) {
+	case QCA8K_PORT_STATUS_SPEED_10:
+		state->speed = SPEED_10;
+		break;
+	case QCA8K_PORT_STATUS_SPEED_100:
+		state->speed = SPEED_100;
+		break;
+	case QCA8K_PORT_STATUS_SPEED_1000:
+		state->speed = SPEED_1000;
+		break;
+	default:
+		state->speed = SPEED_UNKNOWN;
+		break;
+	}
+
+	state->pause = MLO_PAUSE_NONE;
+	if (reg & QCA8K_PORT_STATUS_RXFLOW)
+		state->pause |= MLO_PAUSE_RX;
+	if (reg & QCA8K_PORT_STATUS_TXFLOW)
+		state->pause |= MLO_PAUSE_TX;
+
+	return 1;
+}
+
+static void
+qca8k_phylink_mac_link_down(struct dsa_switch *ds, int port, unsigned int mode,
+			    phy_interface_t interface)
+{
+	struct qca8k_priv *priv = ds->priv;
+
+	qca8k_port_set_status(priv, port, 0);
+}
+
+static void
+qca8k_phylink_mac_link_up(struct dsa_switch *ds, int port, unsigned int mode,
+			  phy_interface_t interface, struct phy_device *phydev,
+			  int speed, int duplex, bool tx_pause, bool rx_pause)
+{
+	struct qca8k_priv *priv = ds->priv;
+	u32 reg;
+
+	if (phylink_autoneg_inband(mode)) {
+		reg = QCA8K_PORT_STATUS_LINK_AUTO;
+	} else {
+		switch (speed) {
+		case SPEED_10:
+			reg = QCA8K_PORT_STATUS_SPEED_10;
+			break;
+		case SPEED_100:
+			reg = QCA8K_PORT_STATUS_SPEED_100;
+			break;
+		case SPEED_1000:
+			reg = QCA8K_PORT_STATUS_SPEED_1000;
+			break;
+		default:
+			reg = QCA8K_PORT_STATUS_LINK_AUTO;
+			break;
+		}
+
+		if (duplex == DUPLEX_FULL)
+			reg |= QCA8K_PORT_STATUS_DUPLEX;
+
+		if (rx_pause || dsa_is_cpu_port(ds, port))
+			reg |= QCA8K_PORT_STATUS_RXFLOW;
+
+		if (tx_pause || dsa_is_cpu_port(ds, port))
+			reg |= QCA8K_PORT_STATUS_TXFLOW;
+	}
+
+	reg |= QCA8K_PORT_STATUS_TXMAC | QCA8K_PORT_STATUS_RXMAC;
+
+	qca8k_write(priv, QCA8K_REG_PORT_STATUS(port), reg);
+}
+
+static void
+qca8k_get_strings(struct dsa_switch *ds, int port, u32 stringset, uint8_t *data)
+{
+	int i;
+
+	if (stringset != ETH_SS_STATS)
+		return;
+
+	for (i = 0; i < ARRAY_SIZE(ar8327_mib); i++)
+		strncpy(data + i * ETH_GSTRING_LEN, ar8327_mib[i].name,
+			ETH_GSTRING_LEN);
+}
+
+static void
+qca8k_get_ethtool_stats(struct dsa_switch *ds, int port,
+			uint64_t *data)
+{
+	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+	const struct qca8k_mib_desc *mib;
+	u32 reg, i, val;
+	u32 hi = 0;
+	int ret;
+
+	for (i = 0; i < ARRAY_SIZE(ar8327_mib); i++) {
+		mib = &ar8327_mib[i];
+		reg = QCA8K_PORT_MIB_COUNTER(port) + mib->offset;
+
+		ret = qca8k_read(priv, reg, &val);
+		if (ret < 0)
+			continue;
+
+		if (mib->size == 2) {
+			ret = qca8k_read(priv, reg + 4, &hi);
+			if (ret < 0)
+				continue;
+		}
+
+		data[i] = val;
+		if (mib->size == 2)
+			data[i] |= (u64)hi << 32;
+	}
+}
+
+static int
+qca8k_get_sset_count(struct dsa_switch *ds, int port, int sset)
+{
+	if (sset != ETH_SS_STATS)
+		return 0;
+
+	return ARRAY_SIZE(ar8327_mib);
+}
+
+static int
+qca8k_set_mac_eee(struct dsa_switch *ds, int port, struct ethtool_eee *eee)
+{
+	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+	u32 lpi_en = QCA8K_REG_EEE_CTRL_LPI_EN(port);
+	u32 reg;
+	int ret;
+
+	mutex_lock(&priv->reg_mutex);
+	ret = qca8k_read(priv, QCA8K_REG_EEE_CTRL, &reg);
+	if (ret < 0)
+		goto exit;
+
+	if (eee->eee_enabled)
+		reg |= lpi_en;
+	else
+		reg &= ~lpi_en;
+	ret = qca8k_write(priv, QCA8K_REG_EEE_CTRL, reg);
+
+exit:
+	mutex_unlock(&priv->reg_mutex);
+	return ret;
+}
+
+static int
+qca8k_get_mac_eee(struct dsa_switch *ds, int port, struct ethtool_eee *e)
+{
+	/* Nothing to do on the port's MAC */
+	return 0;
+}
+
+static void
+qca8k_port_stp_state_set(struct dsa_switch *ds, int port, u8 state)
+{
+	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+	u32 stp_state;
+
+	switch (state) {
+	case BR_STATE_DISABLED:
+		stp_state = QCA8K_PORT_LOOKUP_STATE_DISABLED;
+		break;
+	case BR_STATE_BLOCKING:
+		stp_state = QCA8K_PORT_LOOKUP_STATE_BLOCKING;
+		break;
+	case BR_STATE_LISTENING:
+		stp_state = QCA8K_PORT_LOOKUP_STATE_LISTENING;
+		break;
+	case BR_STATE_LEARNING:
+		stp_state = QCA8K_PORT_LOOKUP_STATE_LEARNING;
+		break;
+	case BR_STATE_FORWARDING:
+	default:
+		stp_state = QCA8K_PORT_LOOKUP_STATE_FORWARD;
+		break;
+	}
+
+	qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+		  QCA8K_PORT_LOOKUP_STATE_MASK, stp_state);
+}
+
+static int
+qca8k_port_bridge_join(struct dsa_switch *ds, int port, struct net_device *br)
+{
+	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+	int port_mask, cpu_port;
+	int i, ret;
+
+	cpu_port = dsa_to_port(ds, port)->cpu_dp->index;
+	port_mask = BIT(cpu_port);
+
+	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+		if (dsa_is_cpu_port(ds, i))
+			continue;
+		if (dsa_to_port(ds, i)->bridge_dev != br)
+			continue;
+		/* Add this port to the portvlan mask of the other ports
+		 * in the bridge
+		 */
+		ret = qca8k_reg_set(priv,
+				    QCA8K_PORT_LOOKUP_CTRL(i),
+				    BIT(port));
+		if (ret)
+			return ret;
+		if (i != port)
+			port_mask |= BIT(i);
+	}
+
+	/* Add all other ports to this ports portvlan mask */
+	ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+			QCA8K_PORT_LOOKUP_MEMBER, port_mask);
+
+	return ret;
+}
+
+static void
+qca8k_port_bridge_leave(struct dsa_switch *ds, int port, struct net_device *br)
+{
+	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+	int cpu_port, i;
+
+	cpu_port = dsa_to_port(ds, port)->cpu_dp->index;
+
+	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+		if (dsa_is_cpu_port(ds, i))
+			continue;
+		if (dsa_to_port(ds, i)->bridge_dev != br)
+			continue;
+		/* Remove this port to the portvlan mask of the other ports
+		 * in the bridge
+		 */
+		qca8k_reg_clear(priv,
+				QCA8K_PORT_LOOKUP_CTRL(i),
+				BIT(port));
+	}
+
+	/* Set the cpu port to be the only one in the portvlan mask of
+	 * this port
+	 */
+	qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+		  QCA8K_PORT_LOOKUP_MEMBER, BIT(cpu_port));
+}
+
+static int
+qca8k_port_enable(struct dsa_switch *ds, int port,
+		  struct phy_device *phy)
+{
+	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+
+	qca8k_port_set_status(priv, port, 1);
+	priv->port_sts[port].enabled = 1;
+
+	if (dsa_is_user_port(ds, port))
+		phy_support_asym_pause(phy);
+
+	return 0;
+}
+
+static void
+qca8k_port_disable(struct dsa_switch *ds, int port)
+{
+	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+
+	qca8k_port_set_status(priv, port, 0);
+	priv->port_sts[port].enabled = 0;
+}
+
+static int
+qca8k_port_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
+{
+	struct qca8k_priv *priv = ds->priv;
+	int i, mtu = 0;
+
+	priv->port_mtu[port] = new_mtu;
+
+	for (i = 0; i < QCA8K_NUM_PORTS; i++)
+		if (priv->port_mtu[i] > mtu)
+			mtu = priv->port_mtu[i];
+
+	/* Include L2 header / FCS length */
+	return qca8k_write(priv, QCA8K_MAX_FRAME_SIZE, mtu + ETH_HLEN + ETH_FCS_LEN);
+}
+
+static int
+qca8k_port_max_mtu(struct dsa_switch *ds, int port)
+{
+	return QCA8K_MAX_MTU;
+}
+
+static int
+qca8k_port_fdb_insert(struct qca8k_priv *priv, const u8 *addr,
+		      u16 port_mask, u16 vid)
+{
+	/* Set the vid to the port vlan id if no vid is set */
+	if (!vid)
+		vid = QCA8K_PORT_VID_DEF;
+
+	return qca8k_fdb_add(priv, addr, port_mask, vid,
+			     QCA8K_ATU_STATUS_STATIC);
+}
+
+static int
+qca8k_port_fdb_add(struct dsa_switch *ds, int port,
+		   const unsigned char *addr, u16 vid)
+{
+	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+	u16 port_mask = BIT(port);
+
+	return qca8k_port_fdb_insert(priv, addr, port_mask, vid);
+}
+
+static int
+qca8k_port_fdb_del(struct dsa_switch *ds, int port,
+		   const unsigned char *addr, u16 vid)
+{
+	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+	u16 port_mask = BIT(port);
+
+	if (!vid)
+		vid = QCA8K_PORT_VID_DEF;
+
+	return qca8k_fdb_del(priv, addr, port_mask, vid);
+}
+
+static int
+qca8k_port_fdb_dump(struct dsa_switch *ds, int port,
+		    dsa_fdb_dump_cb_t *cb, void *data)
+{
+	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+	struct qca8k_fdb _fdb = { 0 };
+	int cnt = QCA8K_NUM_FDB_RECORDS;
+	bool is_static;
+	int ret = 0;
+
+	mutex_lock(&priv->reg_mutex);
+	while (cnt-- && !qca8k_fdb_next(priv, &_fdb, port)) {
+		if (!_fdb.aging)
+			break;
+		is_static = (_fdb.aging == QCA8K_ATU_STATUS_STATIC);
+		ret = cb(_fdb.mac, _fdb.vid, is_static, data);
+		if (ret)
+			break;
+	}
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+static int
+qca8k_port_vlan_filtering(struct dsa_switch *ds, int port, bool vlan_filtering,
+                          struct netlink_ext_ack *extack)
+{
+	struct qca8k_priv *priv = ds->priv;
+
+	if (vlan_filtering) {
+		qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+			  QCA8K_PORT_LOOKUP_VLAN_MODE,
+			  QCA8K_PORT_LOOKUP_VLAN_MODE_SECURE);
+	} else {
+		qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+			  QCA8K_PORT_LOOKUP_VLAN_MODE,
+			  QCA8K_PORT_LOOKUP_VLAN_MODE_NONE);
+	}
+
+	return 0;
+}
+
+static int
+qca8k_port_vlan_add(struct dsa_switch *ds, int port,
+		    const struct switchdev_obj_port_vlan *vlan,
+		    struct netlink_ext_ack *extack)
+{
+	bool untagged = vlan->flags & BRIDGE_VLAN_INFO_UNTAGGED;
+	bool pvid = vlan->flags & BRIDGE_VLAN_INFO_PVID;
+	struct qca8k_priv *priv = ds->priv;
+	int ret = 0;
+
+	ret = qca8k_vlan_add(priv, port, vlan->vid, untagged);
+	if (ret) {
+		dev_err(priv->dev, "Failed to add VLAN to port %d (%d)", port, ret);
+		return ret;
+	}
+
+	if (pvid) {
+		int shift = 16 * (port % 2);
+
+		qca8k_rmw(priv, QCA8K_EGRESS_VLAN(port),
+			  0xfff << shift, vlan->vid << shift);
+		qca8k_write(priv, QCA8K_REG_PORT_VLAN_CTRL0(port),
+			    QCA8K_PORT_VLAN_CVID(vlan->vid) |
+			    QCA8K_PORT_VLAN_SVID(vlan->vid));
+	}
+	return 0;
+}
+
+static int
+qca8k_port_vlan_del(struct dsa_switch *ds, int port,
+		    const struct switchdev_obj_port_vlan *vlan)
+{
+	struct qca8k_priv *priv = ds->priv;
+	int ret = 0;
+
+	ret = qca8k_vlan_del(priv, port, vlan->vid);
+	if (ret)
+		dev_err(priv->dev, "Failed to delete VLAN from port %d (%d)", port, ret);
+
+	return ret;
+}
+
+static enum dsa_tag_protocol
+qca8k_get_tag_protocol(struct dsa_switch *ds, int port,
+		       enum dsa_tag_protocol mp)
+{
+	return DSA_TAG_PROTO_IPQ4019;
+}
+
+static const struct dsa_switch_ops qca8k_switch_ops = {
+	.get_tag_protocol	= qca8k_get_tag_protocol,
+	.setup			= qca8k_setup,
+	.get_strings		= qca8k_get_strings,
+	.get_ethtool_stats	= qca8k_get_ethtool_stats,
+	.get_sset_count		= qca8k_get_sset_count,
+	.get_mac_eee		= qca8k_get_mac_eee,
+	.set_mac_eee		= qca8k_set_mac_eee,
+	.port_enable		= qca8k_port_enable,
+	.port_disable		= qca8k_port_disable,
+	.port_change_mtu	= qca8k_port_change_mtu,
+	.port_max_mtu		= qca8k_port_max_mtu,
+	.port_stp_state_set	= qca8k_port_stp_state_set,
+	.port_bridge_join	= qca8k_port_bridge_join,
+	.port_bridge_leave	= qca8k_port_bridge_leave,
+	.port_fdb_add		= qca8k_port_fdb_add,
+	.port_fdb_del		= qca8k_port_fdb_del,
+	.port_fdb_dump		= qca8k_port_fdb_dump,
+	.port_vlan_filtering	= qca8k_port_vlan_filtering,
+	.port_vlan_add		= qca8k_port_vlan_add,
+	.port_vlan_del		= qca8k_port_vlan_del,
+	.phylink_validate	= qca8k_phylink_validate,
+	.phylink_mac_link_state	= qca8k_phylink_mac_link_state,
+	.phylink_mac_config	= qca8k_phylink_mac_config,
+	.phylink_mac_link_down	= qca8k_phylink_mac_link_down,
+	.phylink_mac_link_up	= qca8k_phylink_mac_link_up,
+};
+
+static int
+qca8k_ipq4019_probe(struct platform_device *pdev)
+{
+	struct qca8k_priv *priv;
+	void __iomem *base, *psgmii;
+	struct device_node *np = pdev->dev.of_node, *mdio_np, *psgmii_ethphy_np;
+	int ret;
+
+	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	priv->dev = &pdev->dev;
+
+	base = devm_platform_ioremap_resource_byname(pdev, "base");
+	if (IS_ERR(base))
+		return PTR_ERR(base);
+
+	priv->regmap = devm_regmap_init_mmio(priv->dev, base,
+					     &qca8k_ipq4019_regmap_config);
+	if (IS_ERR(priv->regmap)) {
+		ret = PTR_ERR(priv->regmap);
+		dev_err(priv->dev, "base regmap initialization failed, %d\n", ret);
+		return ret;
+	}
+
+	psgmii = devm_platform_ioremap_resource_byname(pdev, "psgmii_phy");
+	if (IS_ERR(psgmii))
+		return PTR_ERR(psgmii);
+
+	priv->psgmii = devm_regmap_init_mmio(priv->dev, psgmii,
+					     &qca8k_ipq4019_psgmii_phy_regmap_config);
+	if (IS_ERR(priv->psgmii)) {
+		ret = PTR_ERR(priv->psgmii);
+		dev_err(priv->dev, "PSGMII regmap initialization failed, %d\n", ret);
+		return ret;
+	}
+
+	mdio_np = of_parse_phandle(np, "mdio", 0);
+	if (!mdio_np) {
+		dev_err(&pdev->dev, "unable to get MDIO bus phandle\n");
+		of_node_put(mdio_np);
+		return -EINVAL;
+	}
+
+	priv->bus = of_mdio_find_bus(mdio_np);
+	of_node_put(mdio_np);
+	if (!priv->bus) {
+		dev_err(&pdev->dev, "unable to find MDIO bus\n");
+		return -EPROBE_DEFER;
+	}
+
+	psgmii_ethphy_np = of_parse_phandle(np, "psgmii-ethphy", 0);
+	if (!psgmii_ethphy_np) {
+		dev_dbg(&pdev->dev, "unable to get PSGMII eth PHY phandle\n");
+		of_node_put(psgmii_ethphy_np);
+	}
+
+	if (psgmii_ethphy_np) {
+		priv->psgmii_ethphy = of_phy_find_device(psgmii_ethphy_np);
+		of_node_put(psgmii_ethphy_np);
+		if (!priv->psgmii_ethphy) {
+			dev_err(&pdev->dev, "unable to get PSGMII eth PHY\n");
+			return -ENODEV;
+		}
+	}
+
+	priv->ds = devm_kzalloc(priv->dev, sizeof(*priv->ds), GFP_KERNEL);
+	if (!priv->ds)
+		return -ENOMEM;
+
+	priv->ds->dev = priv->dev;
+	priv->ds->num_ports = QCA8K_NUM_PORTS;
+	priv->ds->priv = priv;
+	priv->ops = qca8k_switch_ops;
+	priv->ds->ops = &priv->ops;
+
+	mutex_init(&priv->reg_mutex);
+	platform_set_drvdata(pdev, priv);
+
+	return dsa_register_switch(priv->ds);
+}
+
+static int
+qca8k_ipq4019_remove(struct platform_device *pdev)
+{
+	struct qca8k_priv *priv = dev_get_drvdata(&pdev->dev);
+	int i;
+
+	if (!priv)
+		return 0;
+
+	for (i = 0; i < QCA8K_NUM_PORTS; i++)
+		qca8k_port_set_status(priv, i, 0);
+
+	dsa_unregister_switch(priv->ds);
+
+	dev_set_drvdata(&pdev->dev, NULL);
+
+	return 0;
+}
+
+static const struct of_device_id qca8k_ipq4019_of_match[] = {
+	{ .compatible = "qca,ipq4019-qca8337n" },
+	{ /* sentinel */ },
+};
+
+static struct platform_driver qca8k_ipq4019_driver = {
+	.probe = qca8k_ipq4019_probe,
+	.remove = qca8k_ipq4019_remove,
+	.driver = {
+		.name = "qca8k-ipq4019",
+		.of_match_table = qca8k_ipq4019_of_match,
+	},
+};
+
+module_platform_driver(qca8k_ipq4019_driver);
+
+MODULE_AUTHOR("Mathieu Olivari, John Crispin <john@phrozen.org>");
+MODULE_AUTHOR("Gabor Juhos <j4g8y7@gmail.com>, Robert Marko <robert.marko@sartura.hr>");
+MODULE_DESCRIPTION("Qualcomm IPQ4019 built-in switch driver");
+MODULE_LICENSE("GPL v2");
diff --git a/target/linux/ipq40xx/files/drivers/net/dsa/qca/qca8k-ipq4019.h b/target/linux/ipq40xx/files/drivers/net/dsa/qca/qca8k-ipq4019.h
new file mode 100644
index 00000000000000..1133501335badf
--- /dev/null
+++ b/target/linux/ipq40xx/files/drivers/net/dsa/qca/qca8k-ipq4019.h
@@ -0,0 +1,289 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2009 Felix Fietkau <nbd@nbd.name>
+ * Copyright (C) 2011-2012 Gabor Juhos <juhosg@openwrt.org>
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __QCA8K_H
+#define __QCA8K_H
+
+#include <linux/regmap.h>
+
+#define QCA8K_NUM_PORTS					6
+#define QCA8K_CPU_PORT					0
+#define QCA8K_MAX_MTU					9000
+
+#define QCA8K_BUSY_WAIT_TIMEOUT				2000
+
+#define QCA8K_NUM_FDB_RECORDS				2048
+
+#define QCA8K_PORT_VID_DEF				1
+
+/* Global control registers */
+#define QCA8K_REG_MASK_CTRL				0x000
+#define   QCA8K_MASK_CTRL_REV_ID_MASK			GENMASK(7, 0)
+#define   QCA8K_MASK_CTRL_REV_ID(x)			((x) >> 0)
+#define   QCA8K_MASK_CTRL_DEVICE_ID_MASK		GENMASK(15, 8)
+#define   QCA8K_MASK_CTRL_DEVICE_ID(x)			((x) >> 8)
+#define QCA8K_REG_RGMII_CTRL				0x004
+#define   QCA8K_RGMII_CTRL_RGMII_RXC			GENMASK(1, 0)
+#define   QCA8K_RGMII_CTRL_RGMII_TXC			GENMASK(9, 8)
+/* Some kind of CLK selection
+ * 0: gcc_ess_dly2ns
+ * 1: gcc_ess_clk
+ */
+#define   QCA8K_RGMII_CTRL_CLK				BIT(10)
+#define   QCA8K_RGMII_CTRL_DELAY_RMII0			GENMASK(17, 16)
+#define   QCA8K_RGMII_CTRL_INVERT_RMII0_REF_CLK		BIT(18)
+#define   QCA8K_RGMII_CTRL_DELAY_RMII1			GENMASK(20, 19)
+#define   QCA8K_RGMII_CTRL_INVERT_RMII1_REF_CLK		BIT(21)
+#define   QCA8K_RGMII_CTRL_INVERT_RMII0_MASTER_EN	BIT(24)
+#define   QCA8K_RGMII_CTRL_INVERT_RMII1_MASTER_EN	BIT(25)
+#define QCA8K_REG_MODULE_EN				0x030
+#define   QCA8K_MODULE_EN_MIB				BIT(0)
+#define QCA8K_REG_MIB					0x034
+#define   QCA8K_MIB_FLUSH				BIT(24)
+#define   QCA8K_MIB_CPU_KEEP				BIT(20)
+#define   QCA8K_MIB_BUSY				BIT(17)
+#define QCA8K_GOL_MAC_ADDR0				0x60
+#define QCA8K_GOL_MAC_ADDR1				0x64
+#define QCA8K_MAX_FRAME_SIZE				0x78
+#define QCA8K_REG_PORT_STATUS(_i)			(0x07c + (_i) * 4)
+#define   QCA8K_PORT_STATUS_SPEED			GENMASK(1, 0)
+#define   QCA8K_PORT_STATUS_SPEED_10			0
+#define   QCA8K_PORT_STATUS_SPEED_100			0x1
+#define   QCA8K_PORT_STATUS_SPEED_1000			0x2
+#define   QCA8K_PORT_STATUS_TXMAC			BIT(2)
+#define   QCA8K_PORT_STATUS_RXMAC			BIT(3)
+#define   QCA8K_PORT_STATUS_TXFLOW			BIT(4)
+#define   QCA8K_PORT_STATUS_RXFLOW			BIT(5)
+#define   QCA8K_PORT_STATUS_DUPLEX			BIT(6)
+#define   QCA8K_PORT_STATUS_LINK_UP			BIT(8)
+#define   QCA8K_PORT_STATUS_LINK_AUTO			BIT(9)
+#define   QCA8K_PORT_STATUS_LINK_PAUSE			BIT(10)
+#define   QCA8K_PORT_STATUS_FLOW_AUTO			BIT(12)
+#define QCA8K_REG_PORT_HDR_CTRL(_i)			(0x9c + (_i * 4))
+#define   QCA8K_PORT_HDR_CTRL_RX_MASK			GENMASK(3, 2)
+#define   QCA8K_PORT_HDR_CTRL_RX_S			2
+#define   QCA8K_PORT_HDR_CTRL_TX_MASK			GENMASK(1, 0)
+#define   QCA8K_PORT_HDR_CTRL_TX_S			0
+#define   QCA8K_PORT_HDR_CTRL_ALL			2
+#define   QCA8K_PORT_HDR_CTRL_MGMT			1
+#define   QCA8K_PORT_HDR_CTRL_NONE			0
+#define QCA8K_REG_SGMII_CTRL				0x0e0
+#define   QCA8K_SGMII_EN_PLL				BIT(1)
+#define   QCA8K_SGMII_EN_RX				BIT(2)
+#define   QCA8K_SGMII_EN_TX				BIT(3)
+#define   QCA8K_SGMII_EN_SD				BIT(4)
+#define   QCA8K_SGMII_CLK125M_DELAY			BIT(7)
+#define   QCA8K_SGMII_MODE_CTRL_MASK			(BIT(22) | BIT(23))
+#define   QCA8K_SGMII_MODE_CTRL_BASEX			(0 << 22)
+#define   QCA8K_SGMII_MODE_CTRL_PHY			(1 << 22)
+#define   QCA8K_SGMII_MODE_CTRL_MAC			(2 << 22)
+
+/* EEE control registers */
+#define QCA8K_REG_EEE_CTRL				0x100
+#define  QCA8K_REG_EEE_CTRL_LPI_EN(_i)			((_i + 1) * 2)
+
+/* ACL registers */
+#define QCA8K_REG_PORT_VLAN_CTRL0(_i)			(0x420 + (_i * 8))
+#define   QCA8K_PORT_VLAN_CVID(x)			(x << 16)
+#define   QCA8K_PORT_VLAN_SVID(x)			x
+#define QCA8K_REG_PORT_VLAN_CTRL1(_i)			(0x424 + (_i * 8))
+#define QCA8K_REG_IPV4_PRI_BASE_ADDR			0x470
+#define QCA8K_REG_IPV4_PRI_ADDR_MASK			0x474
+
+/* Lookup registers */
+#define QCA8K_REG_ATU_DATA0				0x600
+#define   QCA8K_ATU_ADDR2_S				24
+#define   QCA8K_ATU_ADDR3_S				16
+#define   QCA8K_ATU_ADDR4_S				8
+#define QCA8K_REG_ATU_DATA1				0x604
+#define   QCA8K_ATU_PORT_M				0x7f
+#define   QCA8K_ATU_PORT_S				16
+#define   QCA8K_ATU_ADDR0_S				8
+#define QCA8K_REG_ATU_DATA2				0x608
+#define   QCA8K_ATU_VID_M				0xfff
+#define   QCA8K_ATU_VID_S				8
+#define   QCA8K_ATU_STATUS_M				0xf
+#define   QCA8K_ATU_STATUS_STATIC			0xf
+#define QCA8K_REG_ATU_FUNC				0x60c
+#define   QCA8K_ATU_FUNC_BUSY				BIT(31)
+#define   QCA8K_ATU_FUNC_PORT_EN			BIT(14)
+#define   QCA8K_ATU_FUNC_MULTI_EN			BIT(13)
+#define   QCA8K_ATU_FUNC_FULL				BIT(12)
+#define   QCA8K_ATU_FUNC_PORT_M				0xf
+#define   QCA8K_ATU_FUNC_PORT_S				8
+#define QCA8K_REG_VTU_FUNC0				0x610
+#define   QCA8K_VTU_FUNC0_VALID				BIT(20)
+#define   QCA8K_VTU_FUNC0_IVL_EN			BIT(19)
+#define   QCA8K_VTU_FUNC0_EG_MODE_S(_i)			(4 + (_i) * 2)
+#define   QCA8K_VTU_FUNC0_EG_MODE_MASK			3
+#define   QCA8K_VTU_FUNC0_EG_MODE_UNMOD			0
+#define   QCA8K_VTU_FUNC0_EG_MODE_UNTAG			1
+#define   QCA8K_VTU_FUNC0_EG_MODE_TAG			2
+#define   QCA8K_VTU_FUNC0_EG_MODE_NOT			3
+#define QCA8K_REG_VTU_FUNC1				0x614
+#define   QCA8K_VTU_FUNC1_BUSY				BIT(31)
+#define   QCA8K_VTU_FUNC1_VID_S				16
+#define   QCA8K_VTU_FUNC1_FULL				BIT(4)
+#define QCA8K_REG_GLOBAL_FW_CTRL0			0x620
+#define   QCA8K_GLOBAL_FW_CTRL0_CPU_PORT_EN		BIT(10)
+#define QCA8K_REG_GLOBAL_FW_CTRL1			0x624
+#define   QCA8K_GLOBAL_FW_CTRL1_IGMP_DP_S		24
+#define   QCA8K_GLOBAL_FW_CTRL1_BC_DP_S			16
+#define   QCA8K_GLOBAL_FW_CTRL1_MC_DP_S			8
+#define   QCA8K_GLOBAL_FW_CTRL1_UC_DP_S			0
+#define QCA8K_PORT_LOOKUP_CTRL(_i)			(0x660 + (_i) * 0xc)
+#define   QCA8K_PORT_LOOKUP_MEMBER			GENMASK(6, 0)
+#define   QCA8K_PORT_LOOKUP_VLAN_MODE			GENMASK(9, 8)
+#define   QCA8K_PORT_LOOKUP_VLAN_MODE_NONE		(0 << 8)
+#define   QCA8K_PORT_LOOKUP_VLAN_MODE_FALLBACK		(1 << 8)
+#define   QCA8K_PORT_LOOKUP_VLAN_MODE_CHECK		(2 << 8)
+#define   QCA8K_PORT_LOOKUP_VLAN_MODE_SECURE		(3 << 8)
+#define   QCA8K_PORT_LOOKUP_STATE_MASK			GENMASK(18, 16)
+#define   QCA8K_PORT_LOOKUP_STATE_DISABLED		(0 << 16)
+#define   QCA8K_PORT_LOOKUP_STATE_BLOCKING		(1 << 16)
+#define   QCA8K_PORT_LOOKUP_STATE_LISTENING		(2 << 16)
+#define   QCA8K_PORT_LOOKUP_STATE_LEARNING		(3 << 16)
+#define   QCA8K_PORT_LOOKUP_STATE_FORWARD		(4 << 16)
+#define   QCA8K_PORT_LOOKUP_STATE			GENMASK(18, 16)
+#define   QCA8K_PORT_LOOKUP_LEARN			BIT(20)
+#define   QCA8K_PORT_LOOKUP_LOOPBACK	BIT(21)
+
+#define QCA8K_REG_GLOBAL_FC_THRESH			0x800
+#define   QCA8K_GLOBAL_FC_GOL_XON_THRES(x)		((x) << 16)
+#define   QCA8K_GLOBAL_FC_GOL_XON_THRES_S		GENMASK(24, 16)
+#define   QCA8K_GLOBAL_FC_GOL_XOFF_THRES(x)		((x) << 0)
+#define   QCA8K_GLOBAL_FC_GOL_XOFF_THRES_S		GENMASK(8, 0)
+
+#define QCA8K_REG_PORT_HOL_CTRL0(_i)			(0x970 + (_i) * 0x8)
+#define   QCA8K_PORT_HOL_CTRL0_EG_PRI0_BUF		GENMASK(3, 0)
+#define   QCA8K_PORT_HOL_CTRL0_EG_PRI0(x)		((x) << 0)
+#define   QCA8K_PORT_HOL_CTRL0_EG_PRI1_BUF		GENMASK(7, 4)
+#define   QCA8K_PORT_HOL_CTRL0_EG_PRI1(x)		((x) << 4)
+#define   QCA8K_PORT_HOL_CTRL0_EG_PRI2_BUF		GENMASK(11, 8)
+#define   QCA8K_PORT_HOL_CTRL0_EG_PRI2(x)		((x) << 8)
+#define   QCA8K_PORT_HOL_CTRL0_EG_PRI3_BUF		GENMASK(15, 12)
+#define   QCA8K_PORT_HOL_CTRL0_EG_PRI3(x)		((x) << 12)
+#define   QCA8K_PORT_HOL_CTRL0_EG_PRI4_BUF		GENMASK(19, 16)
+#define   QCA8K_PORT_HOL_CTRL0_EG_PRI4(x)		((x) << 16)
+#define   QCA8K_PORT_HOL_CTRL0_EG_PRI5_BUF		GENMASK(23, 20)
+#define   QCA8K_PORT_HOL_CTRL0_EG_PRI5(x)		((x) << 20)
+#define   QCA8K_PORT_HOL_CTRL0_EG_PORT_BUF		GENMASK(29, 24)
+#define   QCA8K_PORT_HOL_CTRL0_EG_PORT(x)		((x) << 24)
+
+#define QCA8K_REG_PORT_HOL_CTRL1(_i)			(0x974 + (_i) * 0x8)
+#define   QCA8K_PORT_HOL_CTRL1_ING_BUF			GENMASK(3, 0)
+#define   QCA8K_PORT_HOL_CTRL1_ING(x)			((x) << 0)
+#define   QCA8K_PORT_HOL_CTRL1_EG_PRI_BUF_EN		BIT(6)
+#define   QCA8K_PORT_HOL_CTRL1_EG_PORT_BUF_EN		BIT(7)
+#define   QCA8K_PORT_HOL_CTRL1_WRED_EN			BIT(8)
+#define   QCA8K_PORT_HOL_CTRL1_EG_MIRROR_EN		BIT(16)
+
+/* Pkt edit registers */
+#define QCA8K_EGRESS_VLAN(x)				(0x0c70 + (4 * (x / 2)))
+
+/* L3 registers */
+#define QCA8K_HROUTER_CONTROL				0xe00
+#define   QCA8K_HROUTER_CONTROL_GLB_LOCKTIME_M		GENMASK(17, 16)
+#define   QCA8K_HROUTER_CONTROL_GLB_LOCKTIME_S		16
+#define   QCA8K_HROUTER_CONTROL_ARP_AGE_MODE		1
+#define QCA8K_HROUTER_PBASED_CONTROL1			0xe08
+#define QCA8K_HROUTER_PBASED_CONTROL2			0xe0c
+#define QCA8K_HNAT_CONTROL				0xe38
+
+/* MIB registers */
+#define QCA8K_PORT_MIB_COUNTER(_i)			(0x1000 + (_i) * 0x100)
+
+/* IPQ4019 PSGMII PHY registers */
+#define PSGMIIPHY_MODE_CONTROL				0x1b4
+#define   PSGMIIPHY_MODE_ATHR_CSCO_MODE_25M		BIT(0)
+#define PSGMIIPHY_TX_CONTROL				0x288
+#define   PSGMIIPHY_TX_CONTROL_MAGIC_VALUE		0x8380
+#define PSGMIIPHY_VCO_CALIBRATION_CONTROL_REGISTER_1	0x9c
+#define   PSGMIIPHY_REG_PLL_VCO_CALIB_RESTART		BIT(14)
+#define PSGMIIPHY_VCO_CALIBRATION_CONTROL_REGISTER_2	0xa0
+#define   PSGMIIPHY_REG_PLL_VCO_CALIB_READY		BIT(0)
+
+#define   QCA8K_PSGMII_CALB_NUM				100
+#define   MII_QCA8075_SSTATUS				0x11
+#define   QCA8075_PHY_SPEC_STATUS_LINK			BIT(10)
+#define   QCA8075_MMD7_CRC_AND_PKTS_COUNT		0x8029
+#define   QCA8075_MMD7_PKT_GEN_PKT_NUMB			0x8021
+#define   QCA8075_MMD7_PKT_GEN_PKT_SIZE			0x8062
+#define   QCA8075_MMD7_PKT_GEN_CTRL			0x8020
+#define   QCA8075_MMD7_CNT_SELFCLR			BIT(1)
+#define   QCA8075_MMD7_CNT_FRAME_CHK_EN			BIT(0)
+#define   QCA8075_MMD7_PKT_GEN_START			BIT(13)
+#define   QCA8075_MMD7_PKT_GEN_INPROGR			BIT(15)
+#define   QCA8075_MMD7_IG_FRAME_RECV_CNT_HI		0x802a
+#define   QCA8075_MMD7_IG_FRAME_RECV_CNT_LO		0x802b
+#define   QCA8075_MMD7_IG_FRAME_ERR_CNT			0x802c
+#define   QCA8075_MMD7_EG_FRAME_RECV_CNT_HI		0x802d
+#define   QCA8075_MMD7_EG_FRAME_RECV_CNT_LO		0x802e
+#define   QCA8075_MMD7_EG_FRAME_ERR_CNT			0x802f
+#define   QCA8075_MMD7_MDIO_BRDCST_WRITE		0x8028
+#define   QCA8075_MMD7_MDIO_BRDCST_WRITE_EN 		BIT(15)
+#define   QCA8075_MDIO_BRDCST_PHY_ADDR			0x1f
+#define   QCA8075_PKT_GEN_PKTS_COUNT			4096
+
+enum {
+	QCA8K_PORT_SPEED_10M = 0,
+	QCA8K_PORT_SPEED_100M = 1,
+	QCA8K_PORT_SPEED_1000M = 2,
+	QCA8K_PORT_SPEED_ERR = 3,
+};
+
+enum qca8k_fdb_cmd {
+	QCA8K_FDB_FLUSH	= 1,
+	QCA8K_FDB_LOAD = 2,
+	QCA8K_FDB_PURGE = 3,
+	QCA8K_FDB_NEXT = 6,
+	QCA8K_FDB_SEARCH = 7,
+};
+
+enum qca8k_vlan_cmd {
+	QCA8K_VLAN_FLUSH = 1,
+	QCA8K_VLAN_LOAD = 2,
+	QCA8K_VLAN_PURGE = 3,
+	QCA8K_VLAN_REMOVE_PORT = 4,
+	QCA8K_VLAN_NEXT = 5,
+	QCA8K_VLAN_READ = 6,
+};
+
+struct ar8xxx_port_status {
+	int enabled;
+};
+
+struct qca8k_priv {
+	struct regmap *regmap;
+	struct mii_bus *bus;
+	struct ar8xxx_port_status port_sts[QCA8K_NUM_PORTS];
+	struct dsa_switch *ds;
+	struct mutex reg_mutex;
+	struct device *dev;
+	struct dsa_switch_ops ops;
+	unsigned int port_mtu[QCA8K_NUM_PORTS];
+
+	/* IPQ4019 specific */
+	struct regmap *psgmii;
+	bool psgmii_calibrated;
+	struct phy_device *psgmii_ethphy;
+};
+
+struct qca8k_mib_desc {
+	unsigned int size;
+	unsigned int offset;
+	const char *name;
+};
+
+struct qca8k_fdb {
+	u16 vid;
+	u8 port_mask;
+	u8 aging;
+	u8 mac[6];
+};
+
+#endif /* __QCA8K_H */
diff --git a/target/linux/ipq40xx/files/drivers/net/ethernet/qualcomm/ipqess/Makefile b/target/linux/ipq40xx/files/drivers/net/ethernet/qualcomm/ipqess/Makefile
new file mode 100644
index 00000000000000..4f2db7283ebffd
--- /dev/null
+++ b/target/linux/ipq40xx/files/drivers/net/ethernet/qualcomm/ipqess/Makefile
@@ -0,0 +1,8 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Makefile for the IPQ ESS driver
+#
+
+obj-$(CONFIG_QCOM_IPQ4019_ESS_EDMA) += ipq_ess.o
+
+ipq_ess-objs := ipqess.o ipqess_ethtool.o
diff --git a/target/linux/ipq40xx/files/drivers/net/ethernet/qualcomm/ipqess/ipqess.c b/target/linux/ipq40xx/files/drivers/net/ethernet/qualcomm/ipqess/ipqess.c
new file mode 100644
index 00000000000000..ee33bb01667f55
--- /dev/null
+++ b/target/linux/ipq40xx/files/drivers/net/ethernet/qualcomm/ipqess/ipqess.c
@@ -0,0 +1,1336 @@
+// SPDX-License-Identifier: (GPL-2.0 OR ISC)
+/* Copyright (c) 2014 - 2017, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017 - 2018, John Crispin <john@phrozen.org>
+ * Copyright (c) 2018 - 2019, Christian Lamparter <chunkeey@gmail.com>
+ * Copyright (c) 2020 - 2021, Gabor Juhos <j4g8y7@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/bitfield.h>
+#include <linux/clk.h>
+#include <linux/dsa/ipq4019.h>
+#include <linux/if_vlan.h>
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/of_mdio.h>
+#include <linux/of_net.h>
+#include <linux/phylink.h>
+#include <linux/platform_device.h>
+#include <linux/reset.h>
+#include <linux/skbuff.h>
+#include <linux/vmalloc.h>
+#include <net/checksum.h>
+#include <net/dsa.h>
+#include <net/ip6_checksum.h>
+
+#include "ipqess.h"
+
+#define IPQESS_RRD_SIZE		16
+#define IPQESS_NEXT_IDX(X, Y)  (((X) + 1) & ((Y) - 1))
+#define IPQESS_TX_DMA_BUF_LEN	0x3fff
+
+static void ipqess_w32(struct ipqess *ess, u32 reg, u32 val)
+{
+	writel(val, ess->hw_addr + reg);
+}
+
+static u32 ipqess_r32(struct ipqess *ess, u16 reg)
+{
+	return readl(ess->hw_addr + reg);
+}
+
+static void ipqess_m32(struct ipqess *ess, u32 mask, u32 val, u16 reg)
+{
+	u32 _val = ipqess_r32(ess, reg);
+	_val &= ~mask;
+	_val |= val;
+	ipqess_w32(ess, reg, _val);
+}
+
+void ipqess_update_hw_stats(struct ipqess *ess)
+{
+	uint32_t *p;
+	u32 stat;
+	int i;
+
+	lockdep_assert_held(&ess->stats_lock);
+
+	p = (uint32_t *)&(ess->ipqessstats);
+	for (i = 0; i < IPQESS_MAX_TX_QUEUE; i++) {
+		stat = ipqess_r32(ess, IPQESS_REG_TX_STAT_PKT_Q(i));
+		*p += stat;
+		p++;
+	}
+
+	for (i = 0; i < IPQESS_MAX_TX_QUEUE; i++) {
+		stat = ipqess_r32(ess, IPQESS_REG_TX_STAT_BYTE_Q(i));
+		*p += stat;
+		p++;
+	}
+
+	for (i = 0; i < IPQESS_MAX_RX_QUEUE; i++) {
+		stat = ipqess_r32(ess, IPQESS_REG_RX_STAT_PKT_Q(i));
+		*p += stat;
+		p++;
+	}
+
+	for (i = 0; i < IPQESS_MAX_RX_QUEUE; i++) {
+		stat = ipqess_r32(ess, IPQESS_REG_RX_STAT_BYTE_Q(i));
+		*p += stat;
+		p++;
+	}
+}
+
+static int ipqess_tx_ring_alloc(struct ipqess *ess)
+{
+	struct device *dev = &ess->pdev->dev;
+	int i;
+
+	for (i = 0; i < IPQESS_NETDEV_QUEUES; i++) {
+		struct ipqess_tx_ring *tx_ring = &ess->tx_ring[i];
+		size_t size;
+		u32 idx;
+
+		tx_ring->ess = ess;
+		tx_ring->ring_id = i;
+		tx_ring->idx = i * 4;
+		tx_ring->count = IPQESS_TX_RING_SIZE;
+		tx_ring->nq = netdev_get_tx_queue(ess->netdev, i);
+
+		size = sizeof(struct ipqess_buf) * IPQESS_TX_RING_SIZE;
+		tx_ring->buf = devm_kzalloc(dev, size, GFP_KERNEL);
+		if (!tx_ring->buf) {
+			netdev_err(ess->netdev, "buffer alloc of tx ring failed");
+			return -ENOMEM;
+		}
+
+		size = sizeof(struct ipqess_tx_desc) * IPQESS_TX_RING_SIZE;
+		tx_ring->hw_desc = dmam_alloc_coherent(dev, size, &tx_ring->dma,
+						       GFP_KERNEL | __GFP_ZERO);
+		if (!tx_ring->hw_desc) {
+			netdev_err(ess->netdev, "descriptor allocation for tx ring failed");
+			return -ENOMEM;
+		}
+
+		ipqess_w32(ess, IPQESS_REG_TPD_BASE_ADDR_Q(tx_ring->idx),
+			 (u32)tx_ring->dma);
+
+		idx = ipqess_r32(ess, IPQESS_REG_TPD_IDX_Q(tx_ring->idx));
+		idx >>= IPQESS_TPD_CONS_IDX_SHIFT; /* need u32 here */
+		idx &= 0xffff;
+		tx_ring->head = tx_ring->tail = idx;
+
+		ipqess_m32(ess, IPQESS_TPD_PROD_IDX_MASK << IPQESS_TPD_PROD_IDX_SHIFT,
+			 idx, IPQESS_REG_TPD_IDX_Q(tx_ring->idx));
+		ipqess_w32(ess, IPQESS_REG_TX_SW_CONS_IDX_Q(tx_ring->idx), idx);
+		ipqess_w32(ess, IPQESS_REG_TPD_RING_SIZE, IPQESS_TX_RING_SIZE);
+	}
+
+	return 0;
+}
+
+static int ipqess_tx_unmap_and_free(struct device *dev, struct ipqess_buf *buf)
+{
+	int len = 0;
+
+	if (buf->flags & IPQESS_DESC_SINGLE)
+		dma_unmap_single(dev, buf->dma,	buf->length, DMA_TO_DEVICE);
+	else if (buf->flags & IPQESS_DESC_PAGE)
+		dma_unmap_page(dev, buf->dma, buf->length, DMA_TO_DEVICE);
+
+	if (buf->flags & IPQESS_DESC_LAST) {
+		len = buf->skb->len;
+		dev_kfree_skb_any(buf->skb);
+	}
+
+	buf->flags = 0;
+
+	return len;
+}
+
+static void ipqess_tx_ring_free(struct ipqess *ess)
+{
+	int i;
+
+	for (i = 0; i < IPQESS_NETDEV_QUEUES; i++) {
+		int j;
+
+		if (ess->tx_ring[i].hw_desc)
+			continue;
+
+		for (j = 0; j < IPQESS_TX_RING_SIZE; j++) {
+			struct ipqess_buf *buf = &ess->tx_ring[i].buf[j];
+
+			ipqess_tx_unmap_and_free(&ess->pdev->dev, buf);
+		}
+
+		ess->tx_ring[i].buf = NULL;
+	}
+}
+
+static int ipqess_rx_buf_prepare(struct ipqess_buf *buf,
+	struct ipqess_rx_ring *rx_ring)
+{
+	/* Clean the HW DESC header, otherwise we might end up
+	 * with a spurious desc because of random garbage */
+	memset(buf->skb->data, 0, sizeof(struct ipqess_rx_desc));
+
+	buf->dma = dma_map_single(rx_ring->ppdev, buf->skb->data,
+				  IPQESS_RX_HEAD_BUFF_SIZE, DMA_FROM_DEVICE);
+	if (dma_mapping_error(rx_ring->ppdev, buf->dma)) {
+		dev_err_once(rx_ring->ppdev,
+			"IPQESS DMA mapping failed for linear address %x",
+			buf->dma);
+		dev_kfree_skb_any(buf->skb);
+		buf->skb = NULL;
+		return -EFAULT;
+	}
+
+	buf->length = IPQESS_RX_HEAD_BUFF_SIZE;
+	rx_ring->hw_desc[rx_ring->head] = (struct ipqess_rx_desc *)buf->dma;
+	rx_ring->head = (rx_ring->head + 1) % IPQESS_RX_RING_SIZE;
+
+	ipqess_m32(rx_ring->ess, IPQESS_RFD_PROD_IDX_BITS,
+		 (rx_ring->head + IPQESS_RX_RING_SIZE - 1) % IPQESS_RX_RING_SIZE,
+		 IPQESS_REG_RFD_IDX_Q(rx_ring->idx));
+
+	return 0;
+}
+
+/* locking is handled by the caller */
+static int ipqess_rx_buf_alloc_napi(struct ipqess_rx_ring *rx_ring)
+{
+	struct ipqess_buf *buf = &rx_ring->buf[rx_ring->head];
+
+	buf->skb = napi_alloc_skb(&rx_ring->napi_rx,
+		IPQESS_RX_HEAD_BUFF_SIZE);
+	if (!buf->skb)
+		return -ENOMEM;
+
+	return ipqess_rx_buf_prepare(buf, rx_ring);
+}
+
+static int ipqess_rx_buf_alloc(struct ipqess_rx_ring *rx_ring)
+{
+	struct ipqess_buf *buf = &rx_ring->buf[rx_ring->head];
+
+	buf->skb = netdev_alloc_skb_ip_align(rx_ring->ess->netdev,
+		IPQESS_RX_HEAD_BUFF_SIZE);
+	if (!buf->skb)
+		return -ENOMEM;
+
+	return ipqess_rx_buf_prepare(buf, rx_ring);
+}
+
+static void ipqess_refill_work(struct work_struct *work)
+{
+	struct ipqess_rx_ring_refill *rx_refill = container_of(work,
+		struct ipqess_rx_ring_refill, refill_work);
+	struct ipqess_rx_ring *rx_ring = rx_refill->rx_ring;
+	int refill = 0;
+
+	/* don't let this loop by accident. */
+	while (atomic_dec_and_test(&rx_ring->refill_count)) {
+		napi_disable(&rx_ring->napi_rx);
+		if (ipqess_rx_buf_alloc(rx_ring)) {
+			refill++;
+			dev_dbg(rx_ring->ppdev,
+				"Not all buffers were reallocated");
+		}
+		napi_enable(&rx_ring->napi_rx);
+	}
+
+	if (atomic_add_return(refill, &rx_ring->refill_count))
+		schedule_work(&rx_refill->refill_work);
+}
+
+
+static int ipqess_rx_ring_alloc(struct ipqess *ess)
+{
+	int i;
+
+	for (i = 0; i < IPQESS_NETDEV_QUEUES; i++) {
+		int j;
+
+		ess->rx_ring[i].ess = ess;
+		ess->rx_ring[i].ppdev = &ess->pdev->dev;
+		ess->rx_ring[i].ring_id = i;
+		ess->rx_ring[i].idx = i * 2;
+
+		ess->rx_ring[i].buf = devm_kzalloc(&ess->pdev->dev,
+			sizeof(struct ipqess_buf) * IPQESS_RX_RING_SIZE,
+			GFP_KERNEL);
+		if (!ess->rx_ring[i].buf)
+			return -ENOMEM;
+
+		ess->rx_ring[i].hw_desc = dmam_alloc_coherent(&ess->pdev->dev,
+			sizeof(struct ipqess_rx_desc) * IPQESS_RX_RING_SIZE,
+			&ess->rx_ring[i].dma, GFP_KERNEL);
+		if (!ess->rx_ring[i].hw_desc)
+			return -ENOMEM;
+
+		for (j = 0; j < IPQESS_RX_RING_SIZE; j++)
+			if (ipqess_rx_buf_alloc(&ess->rx_ring[i]) < 0)
+				return -ENOMEM;
+
+		ess->rx_refill[i].rx_ring = &ess->rx_ring[i];
+		INIT_WORK(&ess->rx_refill[i].refill_work, ipqess_refill_work);
+
+		ipqess_w32(ess, IPQESS_REG_RFD_BASE_ADDR_Q(ess->rx_ring[i].idx),
+			 (u32)(ess->rx_ring[i].dma));
+	}
+
+	ipqess_w32(ess, IPQESS_REG_RX_DESC0,
+		 (IPQESS_RX_HEAD_BUFF_SIZE << IPQESS_RX_BUF_SIZE_SHIFT) |
+		 (IPQESS_RX_RING_SIZE << IPQESS_RFD_RING_SIZE_SHIFT));
+
+	return 0;
+}
+
+static void ipqess_rx_ring_free(struct ipqess *ess)
+{
+	int i;
+
+	for (i = 0; i < IPQESS_NETDEV_QUEUES; i++) {
+		int j;
+
+		atomic_set(&ess->rx_ring[i].refill_count, 0);
+		cancel_work_sync(&ess->rx_refill[i].refill_work);
+
+		for (j = 0; j < IPQESS_RX_RING_SIZE; j++) {
+			dma_unmap_single(&ess->pdev->dev,
+					 ess->rx_ring[i].buf[j].dma,
+					 ess->rx_ring[i].buf[j].length,
+					 DMA_FROM_DEVICE);
+			dev_kfree_skb_any(ess->rx_ring[i].buf[j].skb);
+		}
+	}
+}
+
+static struct net_device_stats *ipqess_get_stats(struct net_device *netdev)
+{
+	struct ipqess *ess = netdev_priv(netdev);
+
+	spin_lock(&ess->stats_lock);
+	ipqess_update_hw_stats(ess);
+	spin_unlock(&ess->stats_lock);
+
+	return &ess->stats;
+}
+
+static int ipqess_rx_poll(struct ipqess_rx_ring *rx_ring, int budget)
+{
+	u32 length = 0, num_desc, tail, rx_ring_tail;
+	int done = 0;
+
+	rx_ring_tail = rx_ring->tail;
+
+	tail = ipqess_r32(rx_ring->ess, IPQESS_REG_RFD_IDX_Q(rx_ring->idx));
+	tail >>= IPQESS_RFD_CONS_IDX_SHIFT;
+	tail &= IPQESS_RFD_CONS_IDX_MASK;
+
+	while (done < budget) {
+		struct sk_buff *skb;
+		struct ipqess_rx_desc *rd;
+
+		if (rx_ring_tail == tail)
+			break;
+
+		dma_unmap_single(rx_ring->ppdev,
+				 rx_ring->buf[rx_ring_tail].dma,
+				 rx_ring->buf[rx_ring_tail].length,
+				 DMA_FROM_DEVICE);
+
+		skb = xchg(&rx_ring->buf[rx_ring_tail].skb, NULL);
+		rd = (struct ipqess_rx_desc *)skb->data;
+		rx_ring_tail = IPQESS_NEXT_IDX(rx_ring_tail, IPQESS_RX_RING_SIZE);
+
+		/* Check if RRD is valid */
+		if (!(rd->rrd7 & IPQESS_RRD_DESC_VALID)) {
+			num_desc = 1;
+			dev_kfree_skb_any(skb);
+			goto skip;
+		}
+
+		num_desc = rd->rrd1 & IPQESS_RRD_NUM_RFD_MASK;
+		length = rd->rrd6 & IPQESS_RRD_PKT_SIZE_MASK;
+
+		skb_reserve(skb, IPQESS_RRD_SIZE);
+		if (num_desc > 1) {
+			/* can we use build_skb here ? */
+			struct sk_buff *skb_prev = NULL;
+			int size_remaining;
+			int i;
+
+			skb->data_len = 0;
+			skb->tail += (IPQESS_RX_HEAD_BUFF_SIZE - IPQESS_RRD_SIZE);
+			skb->len = skb->truesize = length;
+			size_remaining = length - (IPQESS_RX_HEAD_BUFF_SIZE - IPQESS_RRD_SIZE);
+
+			for (i = 1; i < num_desc; i++) {
+				/* TODO: use build_skb ? */
+				struct sk_buff *skb_temp = rx_ring->buf[rx_ring_tail].skb;
+
+				dma_unmap_single(rx_ring->ppdev,
+						 rx_ring->buf[rx_ring_tail].dma,
+						 rx_ring->buf[rx_ring_tail].length,
+						 DMA_FROM_DEVICE);
+
+				skb_put(skb_temp, min(size_remaining, IPQESS_RX_HEAD_BUFF_SIZE));
+				if (skb_prev)
+					skb_prev->next = rx_ring->buf[rx_ring_tail].skb;
+				else
+					skb_shinfo(skb)->frag_list = rx_ring->buf[rx_ring_tail].skb;
+				skb_prev = rx_ring->buf[rx_ring_tail].skb;
+				rx_ring->buf[rx_ring_tail].skb->next = NULL;
+
+				skb->data_len += rx_ring->buf[rx_ring_tail].skb->len;
+				size_remaining -= rx_ring->buf[rx_ring_tail].skb->len;
+
+				rx_ring_tail = IPQESS_NEXT_IDX(rx_ring_tail, IPQESS_RX_RING_SIZE);
+			}
+
+		} else {
+			skb_put(skb, length);
+		}
+
+		skb->dev = rx_ring->ess->netdev;
+		skb->protocol = eth_type_trans(skb, rx_ring->ess->netdev);
+		skb_record_rx_queue(skb, rx_ring->ring_id);
+
+		if (rd->rrd6 & IPQESS_RRD_CSUM_FAIL_MASK)
+			skb_checksum_none_assert(skb);
+		else
+			skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+		if (rd->rrd7 & IPQESS_RRD_CVLAN) {
+			__vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), rd->rrd4);
+		} else if (rd->rrd1 & IPQESS_RRD_SVLAN) {
+			__vlan_hwaccel_put_tag(skb, htons(ETH_P_8021AD), rd->rrd4);
+		}
+		napi_gro_receive(&rx_ring->napi_rx, skb);
+
+		/* TODO: do we need to have these here ? */
+		rx_ring->ess->stats.rx_packets++;
+		rx_ring->ess->stats.rx_bytes += length;
+
+		done++;
+skip:
+
+		num_desc += atomic_xchg(&rx_ring->refill_count, 0);
+		while (num_desc) {
+			if (ipqess_rx_buf_alloc_napi(rx_ring)) {
+				num_desc = atomic_add_return(num_desc,
+					 &rx_ring->refill_count);
+				if (num_desc >= ((4 * IPQESS_RX_RING_SIZE + 6) / 7))
+					schedule_work(&rx_ring->ess->rx_refill[rx_ring->ring_id].refill_work);
+				break;
+			}
+			num_desc--;
+		}
+	}
+
+	ipqess_w32(rx_ring->ess, IPQESS_REG_RX_SW_CONS_IDX_Q(rx_ring->idx),
+		   rx_ring_tail);
+	rx_ring->tail = rx_ring_tail;
+
+	return done;
+}
+
+static int ipqess_tx_complete(struct ipqess_tx_ring *tx_ring, int budget)
+{
+	u32 tail;
+	int done = 0;
+	int total = 0, ret;
+
+	tail = ipqess_r32(tx_ring->ess, IPQESS_REG_TPD_IDX_Q(tx_ring->idx));
+	tail >>= IPQESS_TPD_CONS_IDX_SHIFT;
+	tail &= IPQESS_TPD_CONS_IDX_MASK;
+
+	while ((tx_ring->tail != tail) && (done < budget)) {
+		//pr_info("freeing txq:%d tail:%d tailbuf:%p\n", tx_ring->idx, tx_ring->tail, &tx_ring->buf[tx_ring->tail]);
+		ret = ipqess_tx_unmap_and_free(&tx_ring->ess->pdev->dev,
+				       &tx_ring->buf[tx_ring->tail]);
+		tx_ring->tail = IPQESS_NEXT_IDX(tx_ring->tail, tx_ring->count);
+		if (ret) {
+			total += ret;
+			done++;
+		}
+	}
+
+	ipqess_w32(tx_ring->ess,
+		 IPQESS_REG_TX_SW_CONS_IDX_Q(tx_ring->idx),
+		 tx_ring->tail);
+
+	if (netif_tx_queue_stopped(tx_ring->nq)) {
+		netdev_dbg(tx_ring->ess->netdev, "waking up tx queue %d\n",
+			   tx_ring->idx);
+		netif_tx_wake_queue(tx_ring->nq);
+	}
+
+	netdev_tx_completed_queue(tx_ring->nq, done, total);
+
+	return done;
+}
+
+static int ipqess_tx_napi(struct napi_struct *napi, int budget)
+{
+	struct ipqess_tx_ring *tx_ring = container_of(napi, struct ipqess_tx_ring,
+						    napi_tx);
+	u32 tx_status;
+	int work_done = 0;
+
+	tx_status = ipqess_r32(tx_ring->ess, IPQESS_REG_TX_ISR);
+	tx_status &= BIT(tx_ring->idx);
+
+	work_done = ipqess_tx_complete(tx_ring, budget);
+
+	ipqess_w32(tx_ring->ess, IPQESS_REG_TX_ISR, tx_status);
+
+	if (likely(work_done < budget)) {
+		if (napi_complete_done(napi, work_done))
+			ipqess_w32(tx_ring->ess,
+				   IPQESS_REG_TX_INT_MASK_Q(tx_ring->idx), 0x1);
+	}
+
+	return work_done;
+}
+
+static int ipqess_rx_napi(struct napi_struct *napi, int budget)
+{
+	struct ipqess_rx_ring *rx_ring = container_of(napi, struct ipqess_rx_ring,
+						    napi_rx);
+	struct ipqess *ess = rx_ring->ess;
+	int remain_budget = budget;
+	int rx_done;
+	u32 rx_mask = BIT(rx_ring->idx);
+	u32 status;
+
+poll_again:
+	ipqess_w32(ess, IPQESS_REG_RX_ISR, rx_mask);
+	rx_done = ipqess_rx_poll(rx_ring, remain_budget);
+
+	if (rx_done == remain_budget)
+		return budget;
+
+	status = ipqess_r32(ess, IPQESS_REG_RX_ISR);
+	if (status & rx_mask) {
+		remain_budget -= rx_done;
+		goto poll_again;
+	}
+
+	if (napi_complete_done(napi, rx_done + budget - remain_budget))
+		ipqess_w32(ess, IPQESS_REG_RX_INT_MASK_Q(rx_ring->idx), 0x1);
+
+	return rx_done + budget - remain_budget;
+}
+
+static irqreturn_t ipqess_interrupt_tx(int irq, void *priv)
+{
+	struct ipqess_tx_ring *tx_ring = (struct ipqess_tx_ring *) priv;
+
+	if (likely(napi_schedule_prep(&tx_ring->napi_tx))) {
+		ipqess_w32(tx_ring->ess,
+			 IPQESS_REG_TX_INT_MASK_Q(tx_ring->idx),
+			 0x0);
+		__napi_schedule(&tx_ring->napi_tx);
+	}
+
+	return IRQ_HANDLED;
+}
+
+static irqreturn_t ipqess_interrupt_rx(int irq, void *priv)
+{
+	struct ipqess_rx_ring *rx_ring = (struct ipqess_rx_ring *) priv;
+
+	if (likely(napi_schedule_prep(&rx_ring->napi_rx))) {
+		ipqess_w32(rx_ring->ess,
+			 IPQESS_REG_RX_INT_MASK_Q(rx_ring->idx),
+			 0x0);
+		__napi_schedule(&rx_ring->napi_rx);
+	}
+
+	return IRQ_HANDLED;
+}
+
+static void ipqess_irq_enable(struct ipqess *ess)
+{
+	int i;
+
+	ipqess_w32(ess, IPQESS_REG_RX_ISR, 0xff);
+	ipqess_w32(ess, IPQESS_REG_TX_ISR, 0xffff);
+	for (i = 0; i < IPQESS_NETDEV_QUEUES; i++) {
+		ipqess_w32(ess, IPQESS_REG_RX_INT_MASK_Q(ess->rx_ring[i].idx), 1);
+		ipqess_w32(ess, IPQESS_REG_TX_INT_MASK_Q(ess->tx_ring[i].idx), 1);
+	}
+}
+
+static void ipqess_irq_disable(struct ipqess *ess)
+{
+	int i;
+
+	for (i = 0; i < IPQESS_NETDEV_QUEUES; i++) {
+		ipqess_w32(ess, IPQESS_REG_RX_INT_MASK_Q(ess->rx_ring[i].idx), 0);
+		ipqess_w32(ess, IPQESS_REG_TX_INT_MASK_Q(ess->tx_ring[i].idx), 0);
+	}
+}
+
+static int __init ipqess_init(struct net_device *netdev)
+{
+	struct ipqess *ess = netdev_priv(netdev);
+	struct device_node *of_node = ess->pdev->dev.of_node;
+	return phylink_of_phy_connect(ess->phylink, of_node, 0);
+}
+
+static void ipqess_uninit(struct net_device *netdev)
+{
+	struct ipqess *ess = netdev_priv(netdev);
+
+	phylink_disconnect_phy(ess->phylink);
+}
+
+static int ipqess_open(struct net_device *netdev)
+{
+	struct ipqess *ess = netdev_priv(netdev);
+	int i;
+
+	for (i = 0; i < IPQESS_NETDEV_QUEUES; i++) {
+		napi_enable(&ess->tx_ring[i].napi_tx);
+		napi_enable(&ess->rx_ring[i].napi_rx);
+	}
+	ipqess_irq_enable(ess);
+	phylink_start(ess->phylink);
+	netif_tx_start_all_queues(netdev);
+
+	return 0;
+}
+
+static int ipqess_stop(struct net_device *netdev)
+{
+	struct ipqess *ess = netdev_priv(netdev);
+	int i;
+
+	netif_tx_stop_all_queues(netdev);
+	phylink_stop(ess->phylink);
+	ipqess_irq_disable(ess);
+	for (i = 0; i < IPQESS_NETDEV_QUEUES; i++) {
+		napi_disable(&ess->tx_ring[i].napi_tx);
+		napi_disable(&ess->rx_ring[i].napi_rx);
+	}
+
+	return 0;
+}
+
+static int ipqess_do_ioctl(struct net_device *netdev, struct ifreq *ifr, int cmd)
+{
+	struct ipqess *ess = netdev_priv(netdev);
+
+	switch (cmd) {
+	case SIOCGMIIPHY:
+	case SIOCGMIIREG:
+	case SIOCSMIIREG:
+		return phylink_mii_ioctl(ess->phylink, ifr, cmd);
+	default:
+		break;
+	}
+
+	return -EOPNOTSUPP;
+}
+
+
+static inline u16 ipqess_tx_desc_available(struct ipqess_tx_ring *tx_ring)
+{
+	u16 count = 0;
+
+	if (tx_ring->tail <= tx_ring->head)
+		count = IPQESS_TX_RING_SIZE;
+
+	count += tx_ring->tail - tx_ring->head - 1;
+
+	return count;
+}
+
+static inline int ipqess_cal_txd_req(struct sk_buff *skb)
+{
+	int tpds;
+
+	/* one TPD for the header, and one for each fragments */
+	tpds = 1 + skb_shinfo(skb)->nr_frags;
+	if (skb_is_gso(skb) && skb_is_gso_v6(skb)) {
+		/* for LSOv2 one extra TPD is needed */
+		tpds++;
+	}
+
+	return tpds;
+}
+
+static struct ipqess_buf *ipqess_get_tx_buffer(struct ipqess_tx_ring *tx_ring,
+					       struct ipqess_tx_desc *desc)
+{
+	return &tx_ring->buf[desc - tx_ring->hw_desc];
+}
+
+static struct ipqess_tx_desc *ipqess_tx_desc_next(struct ipqess_tx_ring *tx_ring)
+{
+	struct ipqess_tx_desc *desc;
+
+	desc = &tx_ring->hw_desc[tx_ring->head];
+	tx_ring->head = IPQESS_NEXT_IDX(tx_ring->head, tx_ring->count);
+
+	return desc;
+}
+
+static void ipqess_rollback_tx(struct ipqess *eth,
+			    struct ipqess_tx_desc *first_desc, int ring_id)
+{
+	struct ipqess_tx_ring *tx_ring = &eth->tx_ring[ring_id];
+	struct ipqess_buf *buf;
+	struct ipqess_tx_desc *desc = NULL;
+	u16 start_index, index;
+
+	start_index = first_desc - tx_ring->hw_desc;
+
+	index = start_index;
+	while (index != tx_ring->head) {
+		desc = &tx_ring->hw_desc[index];
+		buf = &tx_ring->buf[index];
+		ipqess_tx_unmap_and_free(&eth->pdev->dev, buf);
+		memset(desc, 0, sizeof(struct ipqess_tx_desc));
+		if (++index == tx_ring->count)
+			index = 0;
+	}
+	tx_ring->head = start_index;
+}
+
+static bool ipqess_process_dsa_tag_sh(struct sk_buff *skb, u32 *word3)
+{
+	struct skb_shared_info *shinfo = skb_shinfo(skb);
+	struct ipq40xx_dsa_tag_data *tag_data;
+
+	if (shinfo->dsa_tag_proto != DSA_TAG_PROTO_IPQ4019)
+		return false;
+
+	tag_data = (struct ipq40xx_dsa_tag_data *)shinfo->dsa_tag_data;
+
+	pr_debug("SH tag @ %08x, dp:%02x from_cpu:%u\n",
+		 (u32)tag_data, tag_data->dp, tag_data->from_cpu);
+
+	*word3 |= tag_data->dp << IPQESS_TPD_PORT_BITMAP_SHIFT;
+	if (tag_data->from_cpu)
+		*word3 |= BIT(IPQESS_TPD_FROM_CPU_SHIFT);
+
+	return true;
+}
+
+static void ipqess_get_dp_info(struct ipqess *ess, struct sk_buff *skb,
+			       u32 *word3)
+{
+	if (netdev_uses_dsa(ess->netdev)) {
+
+		if (ipqess_process_dsa_tag_sh(skb, word3))
+			return;
+	}
+
+	*word3 |= 0x3e << IPQESS_TPD_PORT_BITMAP_SHIFT;
+}
+
+static int ipqess_tx_map_and_fill(struct ipqess_tx_ring *tx_ring, struct sk_buff *skb)
+{
+	struct ipqess_buf *buf = NULL;
+	struct platform_device *pdev = tx_ring->ess->pdev;
+	struct ipqess_tx_desc *desc = NULL, *first_desc = NULL;
+	u32 word1 = 0, word3 = 0, lso_word1 = 0, svlan_tag = 0;
+	u16 len;
+	int i;
+
+	ipqess_get_dp_info(tx_ring->ess, skb, &word3);
+
+	if (skb_is_gso(skb)) {
+		if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4) {
+			lso_word1 |= IPQESS_TPD_IPV4_EN;
+			ip_hdr(skb)->check = 0;
+			tcp_hdr(skb)->check = ~csum_tcpudp_magic(ip_hdr(skb)->saddr,
+				ip_hdr(skb)->daddr, 0, IPPROTO_TCP, 0);
+		} else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) {
+			lso_word1 |= IPQESS_TPD_LSO_V2_EN;
+			ipv6_hdr(skb)->payload_len = 0;
+			tcp_hdr(skb)->check = ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
+				&ipv6_hdr(skb)->daddr, 0, IPPROTO_TCP, 0);
+		}
+
+		lso_word1 |= IPQESS_TPD_LSO_EN |
+			     ((skb_shinfo(skb)->gso_size & IPQESS_TPD_MSS_MASK) << IPQESS_TPD_MSS_SHIFT) |
+			     (skb_transport_offset(skb) << IPQESS_TPD_HDR_SHIFT);
+	} else if (likely(skb->ip_summed == CHECKSUM_PARTIAL)) {
+			u8 css, cso;
+			cso = skb_checksum_start_offset(skb);
+			css = cso + skb->csum_offset;
+
+			word1 |= (IPQESS_TPD_CUSTOM_CSUM_EN);
+			word1 |= (cso >> 1) << IPQESS_TPD_HDR_SHIFT;
+			word1 |= ((css >> 1) << IPQESS_TPD_CUSTOM_CSUM_SHIFT);
+	}
+
+	if (skb_vlan_tag_present(skb)) {
+		switch (skb->vlan_proto) {
+		case htons(ETH_P_8021Q):
+			word3 |= BIT(IPQESS_TX_INS_CVLAN);
+			word3 |= skb_vlan_tag_get(skb) << IPQESS_TX_CVLAN_TAG_SHIFT;
+			break;
+		case htons(ETH_P_8021AD):
+			word1 |= BIT(IPQESS_TX_INS_SVLAN);
+			svlan_tag = skb_vlan_tag_get(skb);
+			break;
+		default:
+			dev_err(&pdev->dev, "no ctag or stag present\n");
+			goto vlan_tag_error;
+		}
+	}
+
+	if (eth_type_vlan(skb->protocol))
+		word1 |= IPQESS_TPD_VLAN_TAGGED;
+
+        if (skb->protocol == htons(ETH_P_PPP_SES))
+                word1 |= IPQESS_TPD_PPPOE_EN;
+
+	len = skb_headlen(skb);
+
+	first_desc = desc = ipqess_tx_desc_next(tx_ring);
+	if (lso_word1 & IPQESS_TPD_LSO_V2_EN) {
+		desc->addr = cpu_to_le16(skb->len);
+		desc->word1 = word1 | lso_word1;
+		desc->svlan_tag = svlan_tag;
+		desc->word3 = word3;
+		desc = ipqess_tx_desc_next(tx_ring);
+	}
+
+	buf = ipqess_get_tx_buffer(tx_ring, desc);
+	buf->length = len;
+	buf->dma = dma_map_single(&pdev->dev,
+				skb->data, len, DMA_TO_DEVICE);
+	if (dma_mapping_error(&pdev->dev, buf->dma))
+		goto dma_error;
+
+	desc->addr = cpu_to_le32(buf->dma);
+	desc->len  = cpu_to_le16(len);
+
+	buf->flags |= IPQESS_DESC_SINGLE;
+	desc->word1 = word1 | lso_word1;
+	desc->svlan_tag = svlan_tag;
+	desc->word3 = word3;
+
+	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+		skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+		len = skb_frag_size(frag);
+		desc = ipqess_tx_desc_next(tx_ring);
+		buf = ipqess_get_tx_buffer(tx_ring, desc);
+		buf->length = len;
+		buf->flags |= IPQESS_DESC_PAGE;
+		buf->dma = skb_frag_dma_map(&pdev->dev, frag, 0, len, DMA_TO_DEVICE);
+		if (dma_mapping_error(&pdev->dev, buf->dma))
+			goto dma_error;
+
+		desc->addr = cpu_to_le32(buf->dma);
+		desc->len  = cpu_to_le16(len);
+		desc->svlan_tag = svlan_tag;
+		desc->word1 = word1 | lso_word1;
+		desc->word3 = word3;
+	}
+	desc->word1 |= 1 << IPQESS_TPD_EOP_SHIFT;
+	buf->skb = skb;
+	buf->flags |= IPQESS_DESC_LAST;
+
+	return 0;
+
+dma_error:
+	ipqess_rollback_tx(tx_ring->ess, first_desc, tx_ring->ring_id);
+	dev_err(&pdev->dev, "TX DMA map failed\n");
+
+vlan_tag_error:
+	return -ENOMEM;
+}
+
+static inline void ipqess_kick_tx(struct ipqess_tx_ring *tx_ring)
+{
+	/* Ensure that all TPDs has been written completely */
+	dma_wmb();
+
+	/* update software producer index */
+	ipqess_w32(tx_ring->ess, IPQESS_REG_TPD_IDX_Q(tx_ring->idx),
+		   tx_ring->head);
+}
+
+static netdev_tx_t ipqess_xmit(struct sk_buff *skb,
+			     struct net_device *netdev)
+{
+	struct ipqess *ess = netdev_priv(netdev);
+	struct ipqess_tx_ring *tx_ring;
+	int avail;
+	int tx_num;
+	int ret;
+
+	tx_ring = &ess->tx_ring[skb_get_queue_mapping(skb)];
+	tx_num = ipqess_cal_txd_req(skb);
+	avail = ipqess_tx_desc_available(tx_ring);
+	if (avail < tx_num) {
+		netdev_dbg(netdev,
+			   "stopping tx queue %d, avail=%d req=%d im=%x\n",
+			   tx_ring->idx, avail, tx_num,
+			   ipqess_r32(tx_ring->ess,
+				      IPQESS_REG_TX_INT_MASK_Q(tx_ring->idx)));
+		netif_tx_stop_queue(tx_ring->nq);
+		ipqess_w32(tx_ring->ess, IPQESS_REG_TX_INT_MASK_Q(tx_ring->idx), 0x1);
+		ipqess_kick_tx(tx_ring);
+		return NETDEV_TX_BUSY;
+	}
+
+	ret = ipqess_tx_map_and_fill(tx_ring, skb);
+	if (ret) {
+		dev_kfree_skb_any(skb);
+		ess->stats.tx_errors++;
+		goto err_out;
+	}
+
+	ess->stats.tx_packets++;
+	ess->stats.tx_bytes += skb->len;
+	netdev_tx_sent_queue(tx_ring->nq, skb->len);
+
+	if (!netdev_xmit_more() || netif_xmit_stopped(tx_ring->nq))
+		ipqess_kick_tx(tx_ring);
+
+err_out:
+	return NETDEV_TX_OK;
+}
+
+static int ipqess_set_mac_address(struct net_device *netdev, void *p)
+{
+	int ret = eth_mac_addr(netdev, p);
+	struct ipqess *ess = netdev_priv(netdev);
+	const char *macaddr = netdev->dev_addr;
+
+	if (ret)
+		return ret;
+
+//	spin_lock_bh(&mac->hw->page_lock);
+	ipqess_w32(ess, IPQESS_REG_MAC_CTRL1,
+		 (macaddr[0] << 8) | macaddr[1]);
+	ipqess_w32(ess, IPQESS_REG_MAC_CTRL0,
+		 (macaddr[2] << 24) | (macaddr[3] << 16) |
+		 (macaddr[4] << 8) | macaddr[5]);
+//	spin_unlock_bh(&mac->hw->page_lock);
+
+	return 0;
+}
+
+static void ipqess_tx_timeout(struct net_device *netdev, unsigned int txq_id)
+{
+	struct ipqess *ess = netdev_priv(netdev);
+	struct ipqess_tx_ring *tr = &ess->tx_ring[txq_id];
+
+	netdev_warn(netdev, "hardware queue %d is in stuck?\n",
+		    tr->idx);
+
+	/* TODO: dump hardware queue */
+}
+
+static const struct net_device_ops ipqess_axi_netdev_ops = {
+	.ndo_init		= ipqess_init,
+	.ndo_uninit		= ipqess_uninit,
+	.ndo_open		= ipqess_open,
+	.ndo_stop		= ipqess_stop,
+	.ndo_do_ioctl		= ipqess_do_ioctl,
+	.ndo_start_xmit		= ipqess_xmit,
+	.ndo_get_stats		= ipqess_get_stats,
+	.ndo_set_mac_address	= ipqess_set_mac_address,
+	.ndo_tx_timeout		= ipqess_tx_timeout,
+};
+
+static void ipqess_hw_stop(struct ipqess *ess)
+{
+	int i;
+
+	/* disable all RX queue IRQs */
+	for (i = 0; i < IPQESS_MAX_RX_QUEUE; i++)
+		ipqess_w32(ess, IPQESS_REG_RX_INT_MASK_Q(i), 0);
+
+	/* disable all TX queue IRQs */
+	for (i = 0; i < IPQESS_MAX_TX_QUEUE; i++)
+		ipqess_w32(ess, IPQESS_REG_TX_INT_MASK_Q(i), 0);
+
+	/* disable all other IRQs */
+	ipqess_w32(ess, IPQESS_REG_MISC_IMR, 0);
+	ipqess_w32(ess, IPQESS_REG_WOL_IMR, 0);
+
+	/* clear the IRQ status registers */
+	ipqess_w32(ess, IPQESS_REG_RX_ISR, 0xff);
+	ipqess_w32(ess, IPQESS_REG_TX_ISR, 0xffff);
+	ipqess_w32(ess, IPQESS_REG_MISC_ISR, 0x1fff);
+	ipqess_w32(ess, IPQESS_REG_WOL_ISR, 0x1);
+	ipqess_w32(ess, IPQESS_REG_WOL_CTRL, 0);
+
+	/* disable RX and TX queues */
+	ipqess_m32(ess, IPQESS_RXQ_CTRL_EN_MASK, 0, IPQESS_REG_RXQ_CTRL);
+	ipqess_m32(ess, IPQESS_TXQ_CTRL_TXQ_EN, 0, IPQESS_REG_TXQ_CTRL);
+}
+
+static int ipqess_hw_init(struct ipqess *ess)
+{
+	u32 tmp;
+	int i, err;
+
+	ipqess_hw_stop(ess);
+
+	ipqess_m32(ess, BIT(IPQESS_INTR_SW_IDX_W_TYP_SHIFT),
+		 IPQESS_INTR_SW_IDX_W_TYPE << IPQESS_INTR_SW_IDX_W_TYP_SHIFT,
+		 IPQESS_REG_INTR_CTRL);
+
+	/* enable IRQ delay slot */
+	ipqess_w32(ess, IPQESS_REG_IRQ_MODRT_TIMER_INIT,
+		 (IPQESS_TX_IMT << IPQESS_IRQ_MODRT_TX_TIMER_SHIFT) |
+		 (IPQESS_RX_IMT << IPQESS_IRQ_MODRT_RX_TIMER_SHIFT));
+
+	/* Set Customer and Service VLAN TPIDs */
+	ipqess_w32(ess, IPQESS_REG_VLAN_CFG,
+		   (ETH_P_8021Q << IPQESS_VLAN_CFG_CVLAN_TPID_SHIFT) |
+		   (ETH_P_8021AD << IPQESS_VLAN_CFG_SVLAN_TPID_SHIFT));
+
+	/* Configure the TX Queue bursting */
+	ipqess_w32(ess, IPQESS_REG_TXQ_CTRL,
+		 (IPQESS_TPD_BURST << IPQESS_TXQ_NUM_TPD_BURST_SHIFT) |
+		 (IPQESS_TXF_BURST << IPQESS_TXQ_TXF_BURST_NUM_SHIFT) |
+		 IPQESS_TXQ_CTRL_TPD_BURST_EN);
+
+	/* Set RSS type */
+	ipqess_w32(ess, IPQESS_REG_RSS_TYPE,
+		 IPQESS_RSS_TYPE_IPV4TCP | IPQESS_RSS_TYPE_IPV6_TCP |
+		 IPQESS_RSS_TYPE_IPV4_UDP | IPQESS_RSS_TYPE_IPV6UDP |
+		 IPQESS_RSS_TYPE_IPV4 | IPQESS_RSS_TYPE_IPV6);
+
+	/* Set RFD ring burst and threshold */
+	ipqess_w32(ess, IPQESS_REG_RX_DESC1,
+		(IPQESS_RFD_BURST << IPQESS_RXQ_RFD_BURST_NUM_SHIFT) |
+		(IPQESS_RFD_THR << IPQESS_RXQ_RFD_PF_THRESH_SHIFT) |
+		(IPQESS_RFD_LTHR << IPQESS_RXQ_RFD_LOW_THRESH_SHIFT));
+
+	/* Set Rx FIFO
+	 * - threshold to start to DMA data to host
+	 */
+	ipqess_w32(ess, IPQESS_REG_RXQ_CTRL,
+		 IPQESS_FIFO_THRESH_128_BYTE | IPQESS_RXQ_CTRL_RMV_VLAN);
+
+	err = ipqess_rx_ring_alloc(ess);
+	if (err)
+		return err;
+
+	err = ipqess_tx_ring_alloc(ess);
+	if (err)
+		return err;
+
+	/* Load all of ring base addresses above into the dma engine */
+	ipqess_m32(ess, 0, BIT(IPQESS_LOAD_PTR_SHIFT),
+		 IPQESS_REG_TX_SRAM_PART);
+
+	/* Disable TX FIFO low watermark and high watermark */
+	ipqess_w32(ess, IPQESS_REG_TXF_WATER_MARK, 0);
+
+	/* Configure RSS indirection table.
+	 * 128 hash will be configured in the following
+	 * pattern: hash{0,1,2,3} = {Q0,Q2,Q4,Q6} respectively
+	 * and so on
+	 */
+	for (i = 0; i < IPQESS_NUM_IDT; i++)
+		ipqess_w32(ess, IPQESS_REG_RSS_IDT(i), IPQESS_RSS_IDT_VALUE);
+
+	/* Configure load balance mapping table.
+	 * 4 table entry will be configured according to the
+	 * following pattern: load_balance{0,1,2,3} = {Q0,Q1,Q3,Q4}
+	 * respectively.
+	 */
+	ipqess_w32(ess, IPQESS_REG_LB_RING, IPQESS_LB_REG_VALUE);
+
+	/* Configure Virtual queue for Tx rings */
+	ipqess_w32(ess, IPQESS_REG_VQ_CTRL0, IPQESS_VQ_REG_VALUE);
+	ipqess_w32(ess, IPQESS_REG_VQ_CTRL1, IPQESS_VQ_REG_VALUE);
+
+	/* Configure Max AXI Burst write size to 128 bytes*/
+	ipqess_w32(ess, IPQESS_REG_AXIW_CTRL_MAXWRSIZE,
+		 IPQESS_AXIW_MAXWRSIZE_VALUE);
+
+	/* Enable TX queues */
+	ipqess_m32(ess, 0, IPQESS_TXQ_CTRL_TXQ_EN, IPQESS_REG_TXQ_CTRL);
+
+	/* Enable RX queues */
+	tmp = 0;
+	for (i = 0; i < IPQESS_NETDEV_QUEUES; i++)
+		tmp |= IPQESS_RXQ_CTRL_EN(ess->rx_ring[i].idx);
+
+	ipqess_m32(ess, IPQESS_RXQ_CTRL_EN_MASK, tmp, IPQESS_REG_RXQ_CTRL);
+
+	return 0;
+}
+
+static void ipqess_validate(struct phylink_config *config,
+			    unsigned long *supported,
+			    struct phylink_link_state *state)
+{
+	struct ipqess *ess = container_of(config, struct ipqess, phylink_config);
+	__ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
+
+	if (state->interface != PHY_INTERFACE_MODE_INTERNAL) {
+		dev_err(&ess->pdev->dev, "unsupported interface mode: %d\n",
+			state->interface);
+		linkmode_zero(supported);
+		return;
+	}
+
+	phylink_set_port_modes(mask);
+	phylink_set(mask, 1000baseT_Full);
+	phylink_set(mask, Pause);
+	phylink_set(mask, Asym_Pause);
+
+	linkmode_and(supported, supported, mask);
+	linkmode_and(state->advertising, state->advertising, mask);
+}
+
+static void ipqess_mac_config(struct phylink_config *config, unsigned int mode,
+			      const struct phylink_link_state *state)
+{
+	/* TODO */
+}
+
+static void ipqess_mac_link_down(struct phylink_config *config,
+				 unsigned int mode,
+				 phy_interface_t interface)
+{
+	/* TODO */
+}
+
+static void ipqess_mac_link_up(struct phylink_config *config,
+			       struct phy_device *phy, unsigned int mode,
+			       phy_interface_t interface,
+			       int speed, int duplex,
+			       bool tx_pause, bool rx_pause)
+{
+	/* TODO */
+}
+
+static struct phylink_mac_ops ipqess_phylink_mac_ops = {
+	.validate		= ipqess_validate,
+	.mac_config		= ipqess_mac_config,
+	.mac_link_up		= ipqess_mac_link_up,
+	.mac_link_down		= ipqess_mac_link_down,
+};
+
+static void ipqess_cleanup(struct ipqess *ess)
+{
+	ipqess_hw_stop(ess);
+	unregister_netdev(ess->netdev);
+
+	ipqess_tx_ring_free(ess);
+	ipqess_rx_ring_free(ess);
+
+	if (!IS_ERR_OR_NULL(ess->phylink))
+		phylink_destroy(ess->phylink);
+}
+
+static void ess_reset(struct ipqess *ess)
+{
+	reset_control_assert(ess->ess_rst);
+
+	mdelay(10);
+
+	reset_control_deassert(ess->ess_rst);
+
+	/* Waiting for all inner tables to be flushed and reinitialized.
+	 * This takes between 5 and 10ms.
+	 */
+	mdelay(10);
+}
+
+static int ipqess_axi_probe(struct platform_device *pdev)
+{
+	struct device_node *np = pdev->dev.of_node;
+	struct ipqess *ess;
+	struct net_device *netdev;
+	struct resource *res;
+	int i, err = 0;
+
+	netdev = devm_alloc_etherdev_mqs(&pdev->dev, sizeof(struct ipqess),
+					 IPQESS_NETDEV_QUEUES,
+					 IPQESS_NETDEV_QUEUES);
+	if (!netdev)
+		return -ENOMEM;
+
+	ess = netdev_priv(netdev);
+	ess->netdev = netdev;
+	ess->pdev = pdev;
+	spin_lock_init(&ess->stats_lock);
+	SET_NETDEV_DEV(netdev, &pdev->dev);
+	platform_set_drvdata(pdev, netdev);
+
+	err = of_get_mac_address(np, netdev->dev_addr);
+	if (err == -EPROBE_DEFER)
+		return -EPROBE_DEFER;
+
+	if (err) {
+
+		random_ether_addr(netdev->dev_addr);
+		dev_info(&ess->pdev->dev, "generated random MAC address %pM\n",
+			netdev->dev_addr);
+		netdev->addr_assign_type = NET_ADDR_RANDOM;
+	}
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	ess->hw_addr = devm_ioremap_resource(&pdev->dev, res);
+	if (IS_ERR(ess->hw_addr)) {
+		err = PTR_ERR(ess->hw_addr);
+		goto err_out;
+	}
+
+	ess->ess_clk = of_clk_get_by_name(np, "ess_clk");
+	if (IS_ERR(ess->ess_clk)) {
+		dev_err(&pdev->dev, "Failed to get ess_clk\n");
+		return PTR_ERR(ess->ess_clk);
+	}
+
+	ess->ess_rst = devm_reset_control_get(&pdev->dev, "ess_rst");
+	if (IS_ERR(ess->ess_rst)) {
+		dev_err(&pdev->dev, "Failed to get ess_rst control!\n");
+		return PTR_ERR(ess->ess_rst);
+	}
+
+	clk_prepare_enable(ess->ess_clk);
+
+	ess_reset(ess);
+
+	ess->phylink_config.dev = &netdev->dev;
+	ess->phylink_config.type = PHYLINK_NETDEV;
+	ess->phylink_config.pcs_poll = true;
+
+	ess->phylink = phylink_create(&ess->phylink_config,
+				      of_fwnode_handle(np),
+				      PHY_INTERFACE_MODE_INTERNAL,
+				      &ipqess_phylink_mac_ops);
+	if (IS_ERR(ess->phylink)) {
+		err = PTR_ERR(ess->phylink);
+		goto err_out;
+	}
+
+	for (i = 0; i < IPQESS_MAX_TX_QUEUE; i++) {
+		ess->tx_irq[i] = platform_get_irq(pdev, i);
+		scnprintf(ess->tx_irq_names[i], sizeof(ess->tx_irq_names[i]),
+			 "%s:txq%d", pdev->name, i);
+	}
+
+	for (i = 0; i < IPQESS_MAX_RX_QUEUE; i++) {
+		ess->rx_irq[i] = platform_get_irq(pdev, i + IPQESS_MAX_TX_QUEUE);
+		scnprintf(ess->rx_irq_names[i], sizeof(ess->rx_irq_names[i]),
+			 "%s:rxq%d", pdev->name, i);
+	}
+
+#undef NETIF_F_TSO6
+#define NETIF_F_TSO6 0
+
+	netdev->netdev_ops = &ipqess_axi_netdev_ops;
+	netdev->features = NETIF_F_HW_CSUM | NETIF_F_RXCSUM |
+			   NETIF_F_HW_VLAN_CTAG_RX |
+			   NETIF_F_HW_VLAN_CTAG_TX |
+			   NETIF_F_TSO | NETIF_F_TSO6 |
+			   NETIF_F_GRO | NETIF_F_SG;
+	/* feature change is not supported yet */
+	netdev->hw_features = 0;
+	netdev->vlan_features = NETIF_F_HW_CSUM | NETIF_F_SG | NETIF_F_RXCSUM |
+				NETIF_F_TSO | NETIF_F_TSO6 |
+				NETIF_F_GRO;
+	netdev->watchdog_timeo = 5 * HZ;
+	netdev->base_addr = (u32) ess->hw_addr;
+	netdev->max_mtu = 9000;
+	netdev->gso_max_segs = IPQESS_TX_RING_SIZE / 2;
+
+	ipqess_set_ethtool_ops(netdev);
+
+	err = register_netdev(netdev);
+	if (err)
+		goto err_out;
+
+	err = ipqess_hw_init(ess);
+	if (err)
+		goto err_out;
+
+	dev_set_threaded(netdev, true);
+
+	for (i = 0; i < IPQESS_NETDEV_QUEUES; i++) {
+		int qid;
+
+		netif_tx_napi_add(netdev, &ess->tx_ring[i].napi_tx,
+				  ipqess_tx_napi, 64);
+		netif_napi_add(netdev,
+			       &ess->rx_ring[i].napi_rx,
+			       ipqess_rx_napi, 64);
+
+		qid = ess->tx_ring[i].idx;
+		err = devm_request_irq(&ess->netdev->dev, ess->tx_irq[qid],
+			ipqess_interrupt_tx, 0, ess->tx_irq_names[qid],
+			&ess->tx_ring[i]);
+		if (err)
+			goto err_out;
+
+		qid = ess->rx_ring[i].idx;
+		err = devm_request_irq(&ess->netdev->dev, ess->rx_irq[qid],
+			ipqess_interrupt_rx, 0, ess->rx_irq_names[qid],
+			&ess->rx_ring[i]);
+		if (err)
+			goto err_out;
+	}
+
+	return 0;
+
+err_out:
+	ipqess_cleanup(ess);
+	return err;
+}
+
+static int ipqess_axi_remove(struct platform_device *pdev)
+{
+	const struct net_device *netdev = platform_get_drvdata(pdev);
+	struct ipqess *ess = netdev_priv(netdev);
+
+	ipqess_cleanup(ess);
+
+	return 0;
+}
+
+static const struct of_device_id ipqess_of_mtable[] = {
+	{.compatible = "qcom,ipq4019-ess-edma" },
+	{}
+};
+MODULE_DEVICE_TABLE(of, ipqess_of_mtable);
+
+static struct platform_driver ipqess_axi_driver = {
+	.driver = {
+		.name    = "ipqess-edma",
+		.of_match_table = ipqess_of_mtable,
+	},
+	.probe    = ipqess_axi_probe,
+	.remove   = ipqess_axi_remove,
+};
+
+module_platform_driver(ipqess_axi_driver);
+
+MODULE_AUTHOR("Qualcomm Atheros Inc");
+MODULE_AUTHOR("John Crispin <john@phrozen.org>");
+MODULE_AUTHOR("Christian Lamparter <chunkeey@gmail.com>");
+MODULE_AUTHOR("Gabor Juhos <j4g8y7@gmail.com>");
+MODULE_LICENSE("GPL");
diff --git a/target/linux/ipq40xx/files/drivers/net/ethernet/qualcomm/ipqess/ipqess.h b/target/linux/ipq40xx/files/drivers/net/ethernet/qualcomm/ipqess/ipqess.h
new file mode 100644
index 00000000000000..ca4cb7b2d42073
--- /dev/null
+++ b/target/linux/ipq40xx/files/drivers/net/ethernet/qualcomm/ipqess/ipqess.h
@@ -0,0 +1,530 @@
+// SPDX-License-Identifier: (GPL-2.0 OR ISC)
+/* Copyright (c) 2014 - 2016, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017 - 2018, John Crispin <john@phrozen.org>
+ * Copyright (c) 2018 - 2019, Christian Lamparter <chunkeey@gmail.com>
+ * Copyright (c) 2020 - 2021, Gabor Juhos <j4g8y7@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _IPQESS_H_
+#define _IPQESS_H_
+
+#define IPQESS_NETDEV_QUEUES	4
+
+#define IPQESS_TPD_EOP_SHIFT 31
+
+#define IPQESS_PORT_ID_SHIFT 12
+#define IPQESS_PORT_ID_MASK 0x7
+
+/* tpd word 3 bit 18-28 */
+#define IPQESS_TPD_PORT_BITMAP_SHIFT 18
+
+#define IPQESS_TPD_FROM_CPU_SHIFT 25
+
+#define IPQESS_RX_RING_SIZE 128
+#define IPQESS_RX_HEAD_BUFF_SIZE 1540
+#define IPQESS_TX_RING_SIZE 128
+#define IPQESS_MAX_RX_QUEUE 8
+#define IPQESS_MAX_TX_QUEUE 16
+
+
+/* Configurations */
+#define IPQESS_INTR_CLEAR_TYPE 0
+#define IPQESS_INTR_SW_IDX_W_TYPE 0
+#define IPQESS_FIFO_THRESH_TYPE 0
+#define IPQESS_RSS_TYPE 0
+#define IPQESS_RX_IMT 0x0020
+#define IPQESS_TX_IMT 0x0050
+#define IPQESS_TPD_BURST 5
+#define IPQESS_TXF_BURST 0x100
+#define IPQESS_RFD_BURST 8
+#define IPQESS_RFD_THR 16
+#define IPQESS_RFD_LTHR 0
+
+/* Flags used in transmit direction */
+#define IPQESS_DESC_LAST 0x1
+#define IPQESS_DESC_SINGLE 0x2
+#define IPQESS_DESC_PAGE 0x4
+
+struct ipqesstool_statistics {
+	u32 tx_q0_pkt;
+	u32 tx_q1_pkt;
+	u32 tx_q2_pkt;
+	u32 tx_q3_pkt;
+	u32 tx_q4_pkt;
+	u32 tx_q5_pkt;
+	u32 tx_q6_pkt;
+	u32 tx_q7_pkt;
+	u32 tx_q8_pkt;
+	u32 tx_q9_pkt;
+	u32 tx_q10_pkt;
+	u32 tx_q11_pkt;
+	u32 tx_q12_pkt;
+	u32 tx_q13_pkt;
+	u32 tx_q14_pkt;
+	u32 tx_q15_pkt;
+	u32 tx_q0_byte;
+	u32 tx_q1_byte;
+	u32 tx_q2_byte;
+	u32 tx_q3_byte;
+	u32 tx_q4_byte;
+	u32 tx_q5_byte;
+	u32 tx_q6_byte;
+	u32 tx_q7_byte;
+	u32 tx_q8_byte;
+	u32 tx_q9_byte;
+	u32 tx_q10_byte;
+	u32 tx_q11_byte;
+	u32 tx_q12_byte;
+	u32 tx_q13_byte;
+	u32 tx_q14_byte;
+	u32 tx_q15_byte;
+	u32 rx_q0_pkt;
+	u32 rx_q1_pkt;
+	u32 rx_q2_pkt;
+	u32 rx_q3_pkt;
+	u32 rx_q4_pkt;
+	u32 rx_q5_pkt;
+	u32 rx_q6_pkt;
+	u32 rx_q7_pkt;
+	u32 rx_q0_byte;
+	u32 rx_q1_byte;
+	u32 rx_q2_byte;
+	u32 rx_q3_byte;
+	u32 rx_q4_byte;
+	u32 rx_q5_byte;
+	u32 rx_q6_byte;
+	u32 rx_q7_byte;
+	u32 tx_desc_error;
+};
+
+struct ipqess_tx_desc {
+	__le16  len;
+	__le16  svlan_tag;
+	__le32  word1;
+	__le32  addr;
+	__le32  word3;
+} __aligned(16) __packed;
+
+struct ipqess_rx_desc {
+	u16 rrd0;
+	u16 rrd1;
+	u16 rrd2;
+	u16 rrd3;
+	u16 rrd4;
+	u16 rrd5;
+	u16 rrd6;
+	u16 rrd7;
+} __aligned(16) __packed;
+
+struct ipqess_buf {
+	struct sk_buff *skb;
+	dma_addr_t dma;
+	u32 flags;
+	u16 length;
+};
+
+struct ipqess_tx_ring {
+	struct napi_struct napi_tx;
+	u32 idx;
+	int ring_id;
+	struct ipqess *ess;
+	struct netdev_queue *nq;
+	struct ipqess_tx_desc *hw_desc;
+	struct ipqess_buf *buf;
+	dma_addr_t dma;
+	u16 count;
+	u16 head;
+	u16 tail;
+};
+
+struct ipqess_rx_ring {
+	struct napi_struct napi_rx;
+	u32 idx;
+	int ring_id;
+	struct ipqess *ess;
+	struct device *ppdev;
+	struct ipqess_rx_desc **hw_desc;
+	struct ipqess_buf *buf;
+	dma_addr_t dma;
+	u16 head;
+	u16 tail;
+	atomic_t refill_count;
+};
+
+struct ipqess_rx_ring_refill {
+	struct ipqess_rx_ring *rx_ring;
+	struct work_struct refill_work;
+};
+
+#define IPQESS_IRQ_NAME_LEN	32
+
+struct ipqess {
+	struct net_device *netdev;
+	void __iomem *hw_addr;
+	struct clk *ess_clk;
+	struct reset_control *ess_rst;
+
+	struct ipqess_rx_ring rx_ring[IPQESS_NETDEV_QUEUES];
+
+	struct platform_device *pdev;
+	struct phylink *phylink;
+	struct phylink_config phylink_config;
+	struct ipqess_tx_ring tx_ring[IPQESS_NETDEV_QUEUES];
+
+	struct ipqesstool_statistics ipqessstats;
+	spinlock_t stats_lock;
+	struct net_device_stats stats;
+
+	struct ipqess_rx_ring_refill rx_refill[IPQESS_NETDEV_QUEUES];
+	u32 tx_irq[IPQESS_MAX_TX_QUEUE];
+	char tx_irq_names[IPQESS_MAX_TX_QUEUE][IPQESS_IRQ_NAME_LEN];
+	u32 rx_irq[IPQESS_MAX_RX_QUEUE];
+	char rx_irq_names[IPQESS_MAX_TX_QUEUE][IPQESS_IRQ_NAME_LEN];
+};
+
+static inline void build_test(void)
+{
+	struct ipqess *ess;
+	BUILD_BUG_ON(ARRAY_SIZE(ess->rx_ring) != ARRAY_SIZE(ess->rx_refill));
+}
+
+void ipqess_set_ethtool_ops(struct net_device *netdev);
+void ipqess_update_hw_stats(struct ipqess *ess);
+
+/* register definition */
+#define IPQESS_REG_MAS_CTRL 0x0
+#define IPQESS_REG_TIMEOUT_CTRL 0x004
+#define IPQESS_REG_DBG0 0x008
+#define IPQESS_REG_DBG1 0x00C
+#define IPQESS_REG_SW_CTRL0 0x100
+#define IPQESS_REG_SW_CTRL1 0x104
+
+/* Interrupt Status Register */
+#define IPQESS_REG_RX_ISR 0x200
+#define IPQESS_REG_TX_ISR 0x208
+#define IPQESS_REG_MISC_ISR 0x210
+#define IPQESS_REG_WOL_ISR 0x218
+
+#define IPQESS_MISC_ISR_RX_URG_Q(x) (1 << x)
+
+#define IPQESS_MISC_ISR_AXIR_TIMEOUT 0x00000100
+#define IPQESS_MISC_ISR_AXIR_ERR 0x00000200
+#define IPQESS_MISC_ISR_TXF_DEAD 0x00000400
+#define IPQESS_MISC_ISR_AXIW_ERR 0x00000800
+#define IPQESS_MISC_ISR_AXIW_TIMEOUT 0x00001000
+
+#define IPQESS_WOL_ISR 0x00000001
+
+/* Interrupt Mask Register */
+#define IPQESS_REG_MISC_IMR 0x214
+#define IPQESS_REG_WOL_IMR 0x218
+
+#define IPQESS_RX_IMR_NORMAL_MASK 0x1
+#define IPQESS_TX_IMR_NORMAL_MASK 0x1
+#define IPQESS_MISC_IMR_NORMAL_MASK 0x80001FFF
+#define IPQESS_WOL_IMR_NORMAL_MASK 0x1
+
+/* Edma receive consumer index */
+#define IPQESS_REG_RX_SW_CONS_IDX_Q(x) (0x220 + ((x) << 2)) /* x is the queue id */
+
+/* Edma transmit consumer index */
+#define IPQESS_REG_TX_SW_CONS_IDX_Q(x) (0x240 + ((x) << 2)) /* x is the queue id */
+
+/* IRQ Moderator Initial Timer Register */
+#define IPQESS_REG_IRQ_MODRT_TIMER_INIT 0x280
+#define IPQESS_IRQ_MODRT_TIMER_MASK 0xFFFF
+#define IPQESS_IRQ_MODRT_RX_TIMER_SHIFT 0
+#define IPQESS_IRQ_MODRT_TX_TIMER_SHIFT 16
+
+/* Interrupt Control Register */
+#define IPQESS_REG_INTR_CTRL 0x284
+#define IPQESS_INTR_CLR_TYP_SHIFT 0
+#define IPQESS_INTR_SW_IDX_W_TYP_SHIFT 1
+#define IPQESS_INTR_CLEAR_TYPE_W1 0
+#define IPQESS_INTR_CLEAR_TYPE_R 1
+
+/* RX Interrupt Mask Register */
+#define IPQESS_REG_RX_INT_MASK_Q(x) (0x300 + ((x) << 2)) /* x = queue id */
+
+/* TX Interrupt mask register */
+#define IPQESS_REG_TX_INT_MASK_Q(x) (0x340 + ((x) << 2)) /* x = queue id */
+
+/* Load Ptr Register
+ * Software sets this bit after the initialization of the head and tail
+ */
+#define IPQESS_REG_TX_SRAM_PART 0x400
+#define IPQESS_LOAD_PTR_SHIFT 16
+
+/* TXQ Control Register */
+#define IPQESS_REG_TXQ_CTRL 0x404
+#define IPQESS_TXQ_CTRL_IP_OPTION_EN 0x10
+#define IPQESS_TXQ_CTRL_TXQ_EN 0x20
+#define IPQESS_TXQ_CTRL_ENH_MODE 0x40
+#define IPQESS_TXQ_CTRL_LS_8023_EN 0x80
+#define IPQESS_TXQ_CTRL_TPD_BURST_EN 0x100
+#define IPQESS_TXQ_CTRL_LSO_BREAK_EN 0x200
+#define IPQESS_TXQ_NUM_TPD_BURST_MASK 0xF
+#define IPQESS_TXQ_TXF_BURST_NUM_MASK 0xFFFF
+#define IPQESS_TXQ_NUM_TPD_BURST_SHIFT 0
+#define IPQESS_TXQ_TXF_BURST_NUM_SHIFT 16
+
+#define	IPQESS_REG_TXF_WATER_MARK 0x408 /* In 8-bytes */
+#define IPQESS_TXF_WATER_MARK_MASK 0x0FFF
+#define IPQESS_TXF_LOW_WATER_MARK_SHIFT 0
+#define IPQESS_TXF_HIGH_WATER_MARK_SHIFT 16
+#define IPQESS_TXQ_CTRL_BURST_MODE_EN 0x80000000
+
+/* WRR Control Register */
+#define IPQESS_REG_WRR_CTRL_Q0_Q3 0x40c
+#define IPQESS_REG_WRR_CTRL_Q4_Q7 0x410
+#define IPQESS_REG_WRR_CTRL_Q8_Q11 0x414
+#define IPQESS_REG_WRR_CTRL_Q12_Q15 0x418
+
+/* Weight round robin(WRR), it takes queue as input, and computes
+ * starting bits where we need to write the weight for a particular
+ * queue
+ */
+#define IPQESS_WRR_SHIFT(x) (((x) * 5) % 20)
+
+/* Tx Descriptor Control Register */
+#define IPQESS_REG_TPD_RING_SIZE 0x41C
+#define IPQESS_TPD_RING_SIZE_SHIFT 0
+#define IPQESS_TPD_RING_SIZE_MASK 0xFFFF
+
+/* Transmit descriptor base address */
+#define IPQESS_REG_TPD_BASE_ADDR_Q(x) (0x420 + ((x) << 2)) /* x = queue id */
+
+/* TPD Index Register */
+#define IPQESS_REG_TPD_IDX_Q(x) (0x460 + ((x) << 2)) /* x = queue id */
+
+#define IPQESS_TPD_PROD_IDX_BITS 0x0000FFFF
+#define IPQESS_TPD_CONS_IDX_BITS 0xFFFF0000
+#define IPQESS_TPD_PROD_IDX_MASK 0xFFFF
+#define IPQESS_TPD_CONS_IDX_MASK 0xFFFF
+#define IPQESS_TPD_PROD_IDX_SHIFT 0
+#define IPQESS_TPD_CONS_IDX_SHIFT 16
+
+/* TX Virtual Queue Mapping Control Register */
+#define IPQESS_REG_VQ_CTRL0 0x4A0
+#define IPQESS_REG_VQ_CTRL1 0x4A4
+
+/* Virtual QID shift, it takes queue as input, and computes
+ * Virtual QID position in virtual qid control register
+ */
+#define IPQESS_VQ_ID_SHIFT(i) (((i) * 3) % 24)
+
+/* Virtual Queue Default Value */
+#define IPQESS_VQ_REG_VALUE 0x240240
+
+/* Tx side Port Interface Control Register */
+#define IPQESS_REG_PORT_CTRL 0x4A8
+#define IPQESS_PAD_EN_SHIFT 15
+
+/* Tx side VLAN Configuration Register */
+#define IPQESS_REG_VLAN_CFG 0x4AC
+
+#define IPQESS_VLAN_CFG_SVLAN_TPID_SHIFT 0
+#define IPQESS_VLAN_CFG_SVLAN_TPID_MASK 0xffff
+#define IPQESS_VLAN_CFG_CVLAN_TPID_SHIFT 16
+#define IPQESS_VLAN_CFG_CVLAN_TPID_MASK 0xffff
+
+#define IPQESS_TX_CVLAN 16
+#define IPQESS_TX_INS_CVLAN 17
+#define IPQESS_TX_CVLAN_TAG_SHIFT 0
+
+#define IPQESS_TX_SVLAN 14
+#define IPQESS_TX_INS_SVLAN 15
+#define IPQESS_TX_SVLAN_TAG_SHIFT 16
+
+/* Tx Queue Packet Statistic Register */
+#define IPQESS_REG_TX_STAT_PKT_Q(x) (0x700 + ((x) << 3)) /* x = queue id */
+
+#define IPQESS_TX_STAT_PKT_MASK 0xFFFFFF
+
+/* Tx Queue Byte Statistic Register */
+#define IPQESS_REG_TX_STAT_BYTE_Q(x) (0x704 + ((x) << 3)) /* x = queue id */
+
+/* Load Balance Based Ring Offset Register */
+#define IPQESS_REG_LB_RING 0x800
+#define IPQESS_LB_RING_ENTRY_MASK 0xff
+#define IPQESS_LB_RING_ID_MASK 0x7
+#define IPQESS_LB_RING_PROFILE_ID_MASK 0x3
+#define IPQESS_LB_RING_ENTRY_BIT_OFFSET 8
+#define IPQESS_LB_RING_ID_OFFSET 0
+#define IPQESS_LB_RING_PROFILE_ID_OFFSET 3
+#define IPQESS_LB_REG_VALUE 0x6040200
+
+/* Load Balance Priority Mapping Register */
+#define IPQESS_REG_LB_PRI_START 0x804
+#define IPQESS_REG_LB_PRI_END 0x810
+#define IPQESS_LB_PRI_REG_INC 4
+#define IPQESS_LB_PRI_ENTRY_BIT_OFFSET 4
+#define IPQESS_LB_PRI_ENTRY_MASK 0xf
+
+/* RSS Priority Mapping Register */
+#define IPQESS_REG_RSS_PRI 0x820
+#define IPQESS_RSS_PRI_ENTRY_MASK 0xf
+#define IPQESS_RSS_RING_ID_MASK 0x7
+#define IPQESS_RSS_PRI_ENTRY_BIT_OFFSET 4
+
+/* RSS Indirection Register */
+#define IPQESS_REG_RSS_IDT(x) (0x840 + ((x) << 2)) /* x = No. of indirection table */
+#define IPQESS_NUM_IDT 16
+#define IPQESS_RSS_IDT_VALUE 0x64206420
+
+/* Default RSS Ring Register */
+#define IPQESS_REG_DEF_RSS 0x890
+#define IPQESS_DEF_RSS_MASK 0x7
+
+/* RSS Hash Function Type Register */
+#define IPQESS_REG_RSS_TYPE 0x894
+#define IPQESS_RSS_TYPE_NONE 0x01
+#define IPQESS_RSS_TYPE_IPV4TCP 0x02
+#define IPQESS_RSS_TYPE_IPV6_TCP 0x04
+#define IPQESS_RSS_TYPE_IPV4_UDP 0x08
+#define IPQESS_RSS_TYPE_IPV6UDP 0x10
+#define IPQESS_RSS_TYPE_IPV4 0x20
+#define IPQESS_RSS_TYPE_IPV6 0x40
+#define IPQESS_RSS_HASH_MODE_MASK 0x7f
+
+#define IPQESS_REG_RSS_HASH_VALUE 0x8C0
+
+#define IPQESS_REG_RSS_TYPE_RESULT 0x8C4
+
+#define IPQESS_HASH_TYPE_START 0
+#define IPQESS_HASH_TYPE_END 5
+#define IPQESS_HASH_TYPE_SHIFT 12
+
+#define IPQESS_RFS_FLOW_ENTRIES 1024
+#define IPQESS_RFS_FLOW_ENTRIES_MASK (IPQESS_RFS_FLOW_ENTRIES - 1)
+#define IPQESS_RFS_EXPIRE_COUNT_PER_CALL 128
+
+/* RFD Base Address Register */
+#define IPQESS_REG_RFD_BASE_ADDR_Q(x) (0x950 + ((x) << 2)) /* x = queue id */
+
+/* RFD Index Register */
+#define IPQESS_REG_RFD_IDX_Q(x) (0x9B0 + ((x) << 2)) /* x = queue id */
+
+#define IPQESS_RFD_PROD_IDX_BITS 0x00000FFF
+#define IPQESS_RFD_CONS_IDX_BITS 0x0FFF0000
+#define IPQESS_RFD_PROD_IDX_MASK 0xFFF
+#define IPQESS_RFD_CONS_IDX_MASK 0xFFF
+#define IPQESS_RFD_PROD_IDX_SHIFT 0
+#define IPQESS_RFD_CONS_IDX_SHIFT 16
+
+/* Rx Descriptor Control Register */
+#define IPQESS_REG_RX_DESC0 0xA10
+#define IPQESS_RFD_RING_SIZE_MASK 0xFFF
+#define IPQESS_RX_BUF_SIZE_MASK 0xFFFF
+#define IPQESS_RFD_RING_SIZE_SHIFT 0
+#define IPQESS_RX_BUF_SIZE_SHIFT 16
+
+#define IPQESS_REG_RX_DESC1 0xA14
+#define IPQESS_RXQ_RFD_BURST_NUM_MASK 0x3F
+#define IPQESS_RXQ_RFD_PF_THRESH_MASK 0x1F
+#define IPQESS_RXQ_RFD_LOW_THRESH_MASK 0xFFF
+#define IPQESS_RXQ_RFD_BURST_NUM_SHIFT 0
+#define IPQESS_RXQ_RFD_PF_THRESH_SHIFT 8
+#define IPQESS_RXQ_RFD_LOW_THRESH_SHIFT 16
+
+/* RXQ Control Register */
+#define IPQESS_REG_RXQ_CTRL 0xA18
+#define IPQESS_FIFO_THRESH_TYPE_SHIF 0
+#define IPQESS_FIFO_THRESH_128_BYTE 0x0
+#define IPQESS_FIFO_THRESH_64_BYTE 0x1
+#define IPQESS_RXQ_CTRL_RMV_VLAN 0x00000002
+#define IPQESS_RXQ_CTRL_EN_MASK			GENMASK(15, 8)
+#define IPQESS_RXQ_CTRL_EN(__qid)		BIT(8 + (__qid))
+
+/* AXI Burst Size Config */
+#define IPQESS_REG_AXIW_CTRL_MAXWRSIZE 0xA1C
+#define IPQESS_AXIW_MAXWRSIZE_VALUE 0x0
+
+/* Rx Statistics Register */
+#define IPQESS_REG_RX_STAT_BYTE_Q(x) (0xA30 + ((x) << 2)) /* x = queue id */
+#define IPQESS_REG_RX_STAT_PKT_Q(x) (0xA50 + ((x) << 2)) /* x = queue id */
+
+/* WoL Pattern Length Register */
+#define IPQESS_REG_WOL_PATTERN_LEN0 0xC00
+#define IPQESS_WOL_PT_LEN_MASK 0xFF
+#define IPQESS_WOL_PT0_LEN_SHIFT 0
+#define IPQESS_WOL_PT1_LEN_SHIFT 8
+#define IPQESS_WOL_PT2_LEN_SHIFT 16
+#define IPQESS_WOL_PT3_LEN_SHIFT 24
+
+#define IPQESS_REG_WOL_PATTERN_LEN1 0xC04
+#define IPQESS_WOL_PT4_LEN_SHIFT 0
+#define IPQESS_WOL_PT5_LEN_SHIFT 8
+#define IPQESS_WOL_PT6_LEN_SHIFT 16
+
+/* WoL Control Register */
+#define IPQESS_REG_WOL_CTRL 0xC08
+#define IPQESS_WOL_WK_EN 0x00000001
+#define IPQESS_WOL_MG_EN 0x00000002
+#define IPQESS_WOL_PT0_EN 0x00000004
+#define IPQESS_WOL_PT1_EN 0x00000008
+#define IPQESS_WOL_PT2_EN 0x00000010
+#define IPQESS_WOL_PT3_EN 0x00000020
+#define IPQESS_WOL_PT4_EN 0x00000040
+#define IPQESS_WOL_PT5_EN 0x00000080
+#define IPQESS_WOL_PT6_EN 0x00000100
+
+/* MAC Control Register */
+#define IPQESS_REG_MAC_CTRL0 0xC20
+#define IPQESS_REG_MAC_CTRL1 0xC24
+
+/* WoL Pattern Register */
+#define IPQESS_REG_WOL_PATTERN_START 0x5000
+#define IPQESS_PATTERN_PART_REG_OFFSET 0x40
+
+
+/* TX descriptor fields */
+#define IPQESS_TPD_HDR_SHIFT 0
+#define IPQESS_TPD_PPPOE_EN 0x00000100
+#define IPQESS_TPD_IP_CSUM_EN 0x00000200
+#define IPQESS_TPD_TCP_CSUM_EN 0x0000400
+#define IPQESS_TPD_UDP_CSUM_EN 0x00000800
+#define IPQESS_TPD_CUSTOM_CSUM_EN 0x00000C00
+#define IPQESS_TPD_LSO_EN 0x00001000
+#define IPQESS_TPD_LSO_V2_EN 0x00002000
+/* The VLAN_TAGGED bit is not used in the publicly available
+ * drivers. The definition has been stolen from the Atheros
+ * 'alx' driver (drivers/net/ethernet/atheros/alx/hw.h). It
+ * seems that it has the same meaning in regard to the EDMA
+ * hardware.
+ */
+#define IPQESS_TPD_VLAN_TAGGED 0x00004000
+#define IPQESS_TPD_IPV4_EN 0x00010000
+#define IPQESS_TPD_MSS_MASK 0x1FFF
+#define IPQESS_TPD_MSS_SHIFT 18
+#define IPQESS_TPD_CUSTOM_CSUM_SHIFT 18
+
+/* RRD descriptor fields */
+#define IPQESS_RRD_NUM_RFD_MASK 0x000F
+#define IPQESS_RRD_PKT_SIZE_MASK 0x3FFF
+#define IPQESS_RRD_SRC_PORT_NUM_MASK 0x4000
+#define IPQESS_RRD_SVLAN 0x8000
+#define IPQESS_RRD_FLOW_COOKIE_MASK 0x07FF;
+
+#define IPQESS_RRD_PKT_SIZE_MASK 0x3FFF
+#define IPQESS_RRD_CSUM_FAIL_MASK 0xC000
+#define IPQESS_RRD_CVLAN 0x0001
+#define IPQESS_RRD_DESC_VALID 0x8000
+
+#define IPQESS_RRD_PRIORITY_SHIFT 4
+#define IPQESS_RRD_PRIORITY_MASK 0x7
+#define IPQESS_RRD_PORT_TYPE_SHIFT 7
+#define IPQESS_RRD_PORT_TYPE_MASK 0x1F
+
+#endif
diff --git a/target/linux/ipq40xx/files/drivers/net/ethernet/qualcomm/ipqess/ipqess_ethtool.c b/target/linux/ipq40xx/files/drivers/net/ethernet/qualcomm/ipqess/ipqess_ethtool.c
new file mode 100644
index 00000000000000..da5fb4deed8976
--- /dev/null
+++ b/target/linux/ipq40xx/files/drivers/net/ethernet/qualcomm/ipqess/ipqess_ethtool.c
@@ -0,0 +1,175 @@
+// SPDX-License-Identifier: (GPL-2.0 OR ISC)
+/* Copyright (c) 2015 - 2016, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017 - 2018, John Crispin <john@phrozen.org>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/ethtool.h>
+#include <linux/netdevice.h>
+#include <linux/string.h>
+#include <linux/phylink.h>
+
+#include "ipqess.h"
+
+struct ipqesstool_stats {
+	uint8_t string[ETH_GSTRING_LEN];
+	uint32_t offset;
+};
+
+#define IPQESS_STAT(m)    offsetof(struct ipqesstool_statistics, m)
+#define DRVINFO_LEN	32
+
+static const struct ipqesstool_stats ipqess_stats[] = {
+	{"tx_q0_pkt", IPQESS_STAT(tx_q0_pkt)},
+	{"tx_q1_pkt", IPQESS_STAT(tx_q1_pkt)},
+	{"tx_q2_pkt", IPQESS_STAT(tx_q2_pkt)},
+	{"tx_q3_pkt", IPQESS_STAT(tx_q3_pkt)},
+	{"tx_q4_pkt", IPQESS_STAT(tx_q4_pkt)},
+	{"tx_q5_pkt", IPQESS_STAT(tx_q5_pkt)},
+	{"tx_q6_pkt", IPQESS_STAT(tx_q6_pkt)},
+	{"tx_q7_pkt", IPQESS_STAT(tx_q7_pkt)},
+	{"tx_q8_pkt", IPQESS_STAT(tx_q8_pkt)},
+	{"tx_q9_pkt", IPQESS_STAT(tx_q9_pkt)},
+	{"tx_q10_pkt", IPQESS_STAT(tx_q10_pkt)},
+	{"tx_q11_pkt", IPQESS_STAT(tx_q11_pkt)},
+	{"tx_q12_pkt", IPQESS_STAT(tx_q12_pkt)},
+	{"tx_q13_pkt", IPQESS_STAT(tx_q13_pkt)},
+	{"tx_q14_pkt", IPQESS_STAT(tx_q14_pkt)},
+	{"tx_q15_pkt", IPQESS_STAT(tx_q15_pkt)},
+	{"tx_q0_byte", IPQESS_STAT(tx_q0_byte)},
+	{"tx_q1_byte", IPQESS_STAT(tx_q1_byte)},
+	{"tx_q2_byte", IPQESS_STAT(tx_q2_byte)},
+	{"tx_q3_byte", IPQESS_STAT(tx_q3_byte)},
+	{"tx_q4_byte", IPQESS_STAT(tx_q4_byte)},
+	{"tx_q5_byte", IPQESS_STAT(tx_q5_byte)},
+	{"tx_q6_byte", IPQESS_STAT(tx_q6_byte)},
+	{"tx_q7_byte", IPQESS_STAT(tx_q7_byte)},
+	{"tx_q8_byte", IPQESS_STAT(tx_q8_byte)},
+	{"tx_q9_byte", IPQESS_STAT(tx_q9_byte)},
+	{"tx_q10_byte", IPQESS_STAT(tx_q10_byte)},
+	{"tx_q11_byte", IPQESS_STAT(tx_q11_byte)},
+	{"tx_q12_byte", IPQESS_STAT(tx_q12_byte)},
+	{"tx_q13_byte", IPQESS_STAT(tx_q13_byte)},
+	{"tx_q14_byte", IPQESS_STAT(tx_q14_byte)},
+	{"tx_q15_byte", IPQESS_STAT(tx_q15_byte)},
+	{"rx_q0_pkt", IPQESS_STAT(rx_q0_pkt)},
+	{"rx_q1_pkt", IPQESS_STAT(rx_q1_pkt)},
+	{"rx_q2_pkt", IPQESS_STAT(rx_q2_pkt)},
+	{"rx_q3_pkt", IPQESS_STAT(rx_q3_pkt)},
+	{"rx_q4_pkt", IPQESS_STAT(rx_q4_pkt)},
+	{"rx_q5_pkt", IPQESS_STAT(rx_q5_pkt)},
+	{"rx_q6_pkt", IPQESS_STAT(rx_q6_pkt)},
+	{"rx_q7_pkt", IPQESS_STAT(rx_q7_pkt)},
+	{"rx_q0_byte", IPQESS_STAT(rx_q0_byte)},
+	{"rx_q1_byte", IPQESS_STAT(rx_q1_byte)},
+	{"rx_q2_byte", IPQESS_STAT(rx_q2_byte)},
+	{"rx_q3_byte", IPQESS_STAT(rx_q3_byte)},
+	{"rx_q4_byte", IPQESS_STAT(rx_q4_byte)},
+	{"rx_q5_byte", IPQESS_STAT(rx_q5_byte)},
+	{"rx_q6_byte", IPQESS_STAT(rx_q6_byte)},
+	{"rx_q7_byte", IPQESS_STAT(rx_q7_byte)},
+	{"tx_desc_error", IPQESS_STAT(tx_desc_error)},
+};
+
+static int ipqess_get_strset_count(struct net_device *netdev, int sset)
+{
+	switch (sset) {
+	case ETH_SS_STATS:
+		return ARRAY_SIZE(ipqess_stats);
+	default:
+		netdev_dbg(netdev, "%s: Invalid string set", __func__);
+		return -EOPNOTSUPP;
+	}
+}
+
+static void ipqess_get_strings(struct net_device *netdev, uint32_t stringset,
+			       uint8_t *data)
+{
+	uint8_t *p = data;
+	uint32_t i;
+
+	switch (stringset) {
+	case ETH_SS_STATS:
+		for (i = 0; i < ARRAY_SIZE(ipqess_stats); i++) {
+			memcpy(p, ipqess_stats[i].string,
+			       min((size_t)ETH_GSTRING_LEN,
+			       strlen(ipqess_stats[i].string) + 1));
+			p += ETH_GSTRING_LEN;
+		}
+		break;
+	}
+}
+
+static void ipqess_get_ethtool_stats(struct net_device *netdev,
+				     struct ethtool_stats *stats,
+				     uint64_t *data)
+{
+	struct ipqess *ess = netdev_priv(netdev);
+	u32 *essstats = (u32 *)&ess->ipqessstats;
+	int i;
+
+	spin_lock(&ess->stats_lock);
+
+	ipqess_update_hw_stats(ess);
+
+	for (i = 0; i < ARRAY_SIZE(ipqess_stats); i++)
+		data[i] = *(u32 *)(essstats + (ipqess_stats[i].offset / sizeof(u32)));
+
+	spin_unlock(&ess->stats_lock);
+}
+
+static void ipqess_get_drvinfo(struct net_device *dev,
+			       struct ethtool_drvinfo *info)
+{
+	strlcpy(info->driver, "qca_ipqess", DRVINFO_LEN);
+	strlcpy(info->bus_info, "axi", ETHTOOL_BUSINFO_LEN);
+}
+
+static int ipqess_get_settings(struct net_device *netdev,
+			       struct ethtool_link_ksettings *cmd)
+{
+	struct ipqess *ess = netdev_priv(netdev);
+
+	return phylink_ethtool_ksettings_get(ess->phylink, cmd);
+}
+
+static int ipqess_set_settings(struct net_device *netdev,
+			    const struct ethtool_link_ksettings *cmd)
+{
+	struct ipqess *ess = netdev_priv(netdev);
+
+	return phylink_ethtool_ksettings_set(ess->phylink, cmd);
+}
+
+static void ipqess_get_ringparam(struct net_device *netdev,
+			       struct ethtool_ringparam *ring)
+{
+	ring->tx_max_pending = IPQESS_TX_RING_SIZE;
+	ring->rx_max_pending = IPQESS_RX_RING_SIZE;
+}
+
+static const struct ethtool_ops ipqesstool_ops = {
+	.get_drvinfo = &ipqess_get_drvinfo,
+	.get_link = &ethtool_op_get_link,
+	.get_link_ksettings = &ipqess_get_settings,
+	.set_link_ksettings = &ipqess_set_settings,
+	.get_strings = &ipqess_get_strings,
+	.get_sset_count = &ipqess_get_strset_count,
+	.get_ethtool_stats = &ipqess_get_ethtool_stats,
+	.get_ringparam = ipqess_get_ringparam,
+};
+
+void ipqess_set_ethtool_ops(struct net_device *netdev)
+{
+	netdev->ethtool_ops = &ipqesstool_ops;
+}
diff --git a/target/linux/ipq40xx/files/drivers/net/phy/qca807x.c b/target/linux/ipq40xx/files/drivers/net/phy/qca807x.c
index 8d523548e52fc9..23b0ca74f7142f 100644
--- a/target/linux/ipq40xx/files/drivers/net/phy/qca807x.c
+++ b/target/linux/ipq40xx/files/drivers/net/phy/qca807x.c
@@ -12,9 +12,7 @@
 #include <linux/of.h>
 #include <linux/phy.h>
 #include <linux/bitfield.h>
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,8,0)
 #include <linux/ethtool_netlink.h>
-#endif
 #include <linux/gpio.h>
 #include <linux/sfp.h>
 
@@ -64,6 +62,8 @@
 
 #define QCA807X_CHIP_CONFIGURATION				0x1f
 #define QCA807X_BT_BX_REG_SEL					BIT(15)
+#define QCA807X_BT_BX_REG_SEL_FIBER				0
+#define QCA807X_BT_BX_REG_SEL_COPPER				1
 #define QCA807X_CHIP_CONFIGURATION_MODE_CFG_MASK		GENMASK(3, 0)
 #define QCA807X_CHIP_CONFIGURATION_MODE_QSGMII_SGMII		4
 #define QCA807X_CHIP_CONFIGURATION_MODE_PSGMII_FIBER		3
@@ -119,7 +119,7 @@
 #define PSGMII_QSGMII_DRIVE_CONTROL_1			0xb
 #define PSGMII_QSGMII_TX_DRIVER_MASK			GENMASK(7, 4)
 #define PSGMII_MODE_CTRL				0x6d
-#define PSGMII_MODE_CTRL_AZ_WORKAROUND_MASK		GENMASK(3, 0)
+#define PSGMII_MODE_CTRL_AZ_WORKAROUND_MASK		BIT(0)
 #define PSGMII_MMD3_SERDES_CONTROL			0x805a
 
 struct qca807x_gpio_priv {
@@ -189,7 +189,6 @@ static int qca807x_set_tunable(struct phy_device *phydev,
 	}
 }
 
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,8,0)
 static bool qca807x_distance_valid(int result)
 {
 	switch (result) {
@@ -322,16 +321,11 @@ static int qca807x_cable_test_start(struct phy_device *phydev)
 
 	return ret;
 }
-#endif
 
 #ifdef CONFIG_GPIOLIB
 static int qca807x_gpio_get_direction(struct gpio_chip *gc, unsigned int offset)
 {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,5,0)
 	return GPIO_LINE_DIRECTION_OUT;
-#else
-	return GPIOF_DIR_OUT;
-#endif
 }
 
 static int qca807x_gpio_get_reg(unsigned int offset)
@@ -400,19 +394,9 @@ static int qca807x_gpio(struct phy_device *phydev)
 }
 #endif
 
-static int qca807x_read_copper_status(struct phy_device *phydev, bool combo_port)
+static int qca807x_read_copper_status(struct phy_device *phydev)
 {
-	int ss, err, page, old_link = phydev->link;
-
-	/* Only combo port has dual pages */
-	if (combo_port) {
-		/* Check whether copper page is set and set if needed */
-		page = phy_read(phydev, QCA807X_CHIP_CONFIGURATION);
-		if (!(page & QCA807X_BT_BX_REG_SEL)) {
-			page |= QCA807X_BT_BX_REG_SEL;
-			phy_write(phydev, QCA807X_CHIP_CONFIGURATION, page);
-		}
-	}
+	int ss, err, old_link = phydev->link;
 
 	/* Update the link, but return if there was an error */
 	err = genphy_update_link(phydev);
@@ -487,16 +471,9 @@ static int qca807x_read_copper_status(struct phy_device *phydev, bool combo_port
 	return 0;
 }
 
-static int qca807x_read_fiber_status(struct phy_device *phydev, bool combo_port)
+static int qca807x_read_fiber_status(struct phy_device *phydev)
 {
-	int ss, err, page, lpa, old_link = phydev->link;
-
-	/* Check whether fiber page is set and set if needed */
-	page = phy_read(phydev, QCA807X_CHIP_CONFIGURATION);
-	if (page & QCA807X_BT_BX_REG_SEL) {
-		page &= ~QCA807X_BT_BX_REG_SEL;
-		phy_write(phydev, QCA807X_CHIP_CONFIGURATION, page);
-	}
+	int ss, err, lpa, old_link = phydev->link;
 
 	/* Update the link, but return if there was an error */
 	err = genphy_update_link(phydev);
@@ -559,28 +536,17 @@ static int qca807x_read_fiber_status(struct phy_device *phydev, bool combo_port)
 
 static int qca807x_read_status(struct phy_device *phydev)
 {
-	int val;
-
-	/* Check for Combo port */
-	if (phy_read(phydev, QCA807X_CHIP_CONFIGURATION)) {
-		/* Check for fiber mode first */
-		if (linkmode_test_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, phydev->supported)) {
-			/* Check for actual detected media */
-			val = phy_read(phydev, QCA807X_MEDIA_SELECT_STATUS);
-			if (val & QCA807X_MEDIA_DETECTED_COPPER) {
-				qca807x_read_copper_status(phydev, true);
-			} else if ((val & QCA807X_MEDIA_DETECTED_1000_BASE_X) ||
-				   (val & QCA807X_MEDIA_DETECTED_100_BASE_FX)) {
-				qca807x_read_fiber_status(phydev, true);
-			}
-		} else {
-			qca807x_read_copper_status(phydev, true);
+	if (linkmode_test_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, phydev->supported)) {
+		switch (phydev->port) {
+		case PORT_FIBRE:
+			return qca807x_read_fiber_status(phydev);
+		case PORT_TP:
+			return qca807x_read_copper_status(phydev);
+		default:
+			return -EINVAL;
 		}
-	} else {
-		qca807x_read_copper_status(phydev, false);
-	}
-
-	return 0;
+	} else
+		return qca807x_read_copper_status(phydev);
 }
 
 static int qca807x_config_intr(struct phy_device *phydev)
@@ -610,16 +576,6 @@ static int qca807x_config_intr(struct phy_device *phydev)
 	return ret;
 }
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5,12,0)
-static int qca807x_ack_intr(struct phy_device *phydev)
-{
-	int ret;
-
-	ret = phy_read(phydev, QCA807X_INTR_STATUS);
-
-	return (ret < 0) ? ret : 0;
-}
-#else
 static irqreturn_t qca807x_handle_interrupt(struct phy_device *phydev)
 {
 	int irq_status, int_enabled;
@@ -645,7 +601,6 @@ static irqreturn_t qca807x_handle_interrupt(struct phy_device *phydev)
 
 	return IRQ_HANDLED;
 }
-#endif
 
 static int qca807x_led_config(struct phy_device *phydev)
 {
@@ -683,9 +638,63 @@ static int qca807x_led_config(struct phy_device *phydev)
 		return 0;
 }
 
+static int qca807x_sfp_insert(void *upstream, const struct sfp_eeprom_id *id)
+{
+	struct phy_device *phydev = upstream;
+	__ETHTOOL_DECLARE_LINK_MODE_MASK(support) = { 0, };
+	phy_interface_t iface;
+	int ret;
+
+	sfp_parse_support(phydev->sfp_bus, id, support);
+	iface = sfp_select_interface(phydev->sfp_bus, support);
+
+	dev_info(&phydev->mdio.dev, "%s SFP module inserted\n", phy_modes(iface));
+
+	switch (iface) {
+	case PHY_INTERFACE_MODE_1000BASEX:
+	case PHY_INTERFACE_MODE_100BASEX:
+		/* Set PHY mode to PSGMII combo (1/4 copper + combo ports) mode */
+		ret = phy_modify(phydev,
+				 QCA807X_CHIP_CONFIGURATION,
+				 QCA807X_CHIP_CONFIGURATION_MODE_CFG_MASK,
+				 QCA807X_CHIP_CONFIGURATION_MODE_PSGMII_FIBER);
+		/* Enable fiber mode autodection (1000Base-X or 100Base-FX) */
+		ret = phy_set_bits_mmd(phydev,
+				       MDIO_MMD_AN,
+				       QCA807X_MMD7_FIBER_MODE_AUTO_DETECTION,
+				       QCA807X_MMD7_FIBER_MODE_AUTO_DETECTION_EN);
+		/* Select fiber page */
+		ret = phy_clear_bits(phydev,
+				     QCA807X_CHIP_CONFIGURATION,
+				     QCA807X_BT_BX_REG_SEL);
+
+		phydev->port = PORT_FIBRE;
+		break;
+	default:
+		dev_err(&phydev->mdio.dev, "Incompatible SFP module inserted\n");
+		return -EINVAL;
+	}
+
+	return ret;
+}
+
+static void qca807x_sfp_remove(void *upstream)
+{
+	struct phy_device *phydev = upstream;
+
+	/* Select copper page */
+	phy_set_bits(phydev,
+		     QCA807X_CHIP_CONFIGURATION,
+		     QCA807X_BT_BX_REG_SEL);
+
+	phydev->port = PORT_TP;
+}
+
 static const struct sfp_upstream_ops qca807x_sfp_ops = {
 	.attach = phy_sfp_attach,
 	.detach = phy_sfp_detach,
+	.module_insert = qca807x_sfp_insert,
+	.module_remove = qca807x_sfp_remove,
 };
 
 static int qca807x_config(struct phy_device *phydev)
@@ -696,28 +705,7 @@ static int qca807x_config(struct phy_device *phydev)
 
 	/* Check for Combo port */
 	if (phy_read(phydev, QCA807X_CHIP_CONFIGURATION)) {
-		int fiber_mode_autodect;
 		int psgmii_serdes;
-		int chip_config;
-
-		if (of_property_read_bool(node, "qcom,fiber-enable")) {
-			/* Enable fiber mode autodection (1000Base-X or 100Base-FX) */
-			fiber_mode_autodect = phy_read_mmd(phydev, MDIO_MMD_AN,
-							   QCA807X_MMD7_FIBER_MODE_AUTO_DETECTION);
-			fiber_mode_autodect |= QCA807X_MMD7_FIBER_MODE_AUTO_DETECTION_EN;
-			phy_write_mmd(phydev, MDIO_MMD_AN, QCA807X_MMD7_FIBER_MODE_AUTO_DETECTION,
-				      fiber_mode_autodect);
-
-			/* Enable 4 copper + combo port mode */
-			chip_config = phy_read(phydev, QCA807X_CHIP_CONFIGURATION);
-			chip_config &= ~QCA807X_CHIP_CONFIGURATION_MODE_CFG_MASK;
-			chip_config |= FIELD_PREP(QCA807X_CHIP_CONFIGURATION_MODE_CFG_MASK,
-						  QCA807X_CHIP_CONFIGURATION_MODE_PSGMII_FIBER);
-			phy_write(phydev, QCA807X_CHIP_CONFIGURATION, chip_config);
-
-			linkmode_set_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, phydev->supported);
-			linkmode_set_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, phydev->advertising);
-		}
 
 		/* Prevent PSGMII going into hibernation via PSGMII self test */
 		psgmii_serdes = phy_read_mmd(phydev, MDIO_MMD_PCS, PSGMII_MMD3_SERDES_CONTROL);
@@ -761,9 +749,10 @@ static int qca807x_probe(struct phy_device *phydev)
 	}
 
 	/* Attach SFP bus on combo port*/
-	if (of_property_read_bool(node, "qcom,fiber-enable")) {
-		if (phy_read(phydev, QCA807X_CHIP_CONFIGURATION))
-			ret = phy_sfp_probe(phydev, &qca807x_sfp_ops);
+	if (phy_read(phydev, QCA807X_CHIP_CONFIGURATION)) {
+		ret = phy_sfp_probe(phydev, &qca807x_sfp_ops);
+		linkmode_set_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, phydev->supported);
+		linkmode_set_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, phydev->advertising);
 	}
 
 	return ret;
@@ -772,17 +761,14 @@ static int qca807x_probe(struct phy_device *phydev)
 static int qca807x_psgmii_config(struct phy_device *phydev)
 {
 	struct device_node *node = phydev->mdio.dev.of_node;
-	int psgmii_az, tx_amp, ret = 0;
+	int tx_amp, ret = 0;
 	u32 tx_driver_strength;
 
 	/* Workaround to enable AZ transmitting ability */
-	if (of_property_read_bool(node, "qcom,psgmii-az")) {
-		psgmii_az = phy_read_mmd(phydev, MDIO_MMD_PMAPMD, PSGMII_MODE_CTRL);
-		psgmii_az &= ~PSGMII_MODE_CTRL_AZ_WORKAROUND_MASK;
-		psgmii_az |= FIELD_PREP(PSGMII_MODE_CTRL_AZ_WORKAROUND_MASK, 0xc);
-		ret = phy_write_mmd(phydev, MDIO_MMD_PMAPMD, PSGMII_MODE_CTRL, psgmii_az);
-		psgmii_az = phy_read_mmd(phydev, MDIO_MMD_PMAPMD, PSGMII_MODE_CTRL);
-	}
+	ret = phy_clear_bits_mmd(phydev,
+				 MDIO_MMD_PMAPMD,
+				 PSGMII_MODE_CTRL,
+				 PSGMII_MODE_CTRL_AZ_WORKAROUND_MASK);
 
 	/* PSGMII/QSGMII TX amp set to DT defined value instead of default 600mV */
 	if (!of_property_read_u32(node, "qcom,tx-driver-strength", &tx_driver_strength)) {
@@ -799,50 +785,38 @@ static struct phy_driver qca807x_drivers[] = {
 	{
 		PHY_ID_MATCH_EXACT(PHY_ID_QCA8072),
 		.name           = "Qualcomm QCA8072",
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,8,0)
 		.flags		= PHY_POLL_CABLE_TEST,
-#endif
 		/* PHY_GBIT_FEATURES */
 		.probe		= qca807x_probe,
 		.config_init	= qca807x_config,
 		.read_status	= qca807x_read_status,
 		.config_intr	= qca807x_config_intr,
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5,12,0)
-		.ack_interrupt	= qca807x_ack_intr,
-#else
 		.handle_interrupt = qca807x_handle_interrupt,
-#endif
 		.soft_reset	= genphy_soft_reset,
 		.get_tunable	= qca807x_get_tunable,
 		.set_tunable	= qca807x_set_tunable,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,8,0)
+		.resume		= genphy_resume,
+		.suspend	= genphy_suspend,
 		.cable_test_start	= qca807x_cable_test_start,
 		.cable_test_get_status	= qca807x_cable_test_get_status,
-#endif
 	},
 	{
 		PHY_ID_MATCH_EXACT(PHY_ID_QCA8075),
 		.name           = "Qualcomm QCA8075",
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,8,0)
 		.flags		= PHY_POLL_CABLE_TEST,
-#endif
 		/* PHY_GBIT_FEATURES */
 		.probe		= qca807x_probe,
 		.config_init	= qca807x_config,
 		.read_status	= qca807x_read_status,
 		.config_intr	= qca807x_config_intr,
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5,12,0)
-		.ack_interrupt	= qca807x_ack_intr,
-#else
 		.handle_interrupt = qca807x_handle_interrupt,
-#endif
 		.soft_reset	= genphy_soft_reset,
 		.get_tunable	= qca807x_get_tunable,
 		.set_tunable	= qca807x_set_tunable,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,8,0)
+		.resume		= genphy_resume,
+		.suspend	= genphy_suspend,
 		.cable_test_start	= qca807x_cable_test_start,
 		.cable_test_get_status	= qca807x_cable_test_get_status,
-#endif
 	},
 	{
 		PHY_ID_MATCH_EXACT(PHY_ID_QCA807X_PSGMII),
diff --git a/target/linux/ipq40xx/image/Makefile b/target/linux/ipq40xx/image/Makefile
index 5851b298753680..2ba4c779a0576c 100644
--- a/target/linux/ipq40xx/image/Makefile
+++ b/target/linux/ipq40xx/image/Makefile
@@ -10,6 +10,8 @@ define Device/Default
 	IMAGES := sysupgrade.bin
 	IMAGE/sysupgrade.bin = sysupgrade-tar | append-metadata
 	IMAGE/sysupgrade.bin/squashfs :=
+	DEVICE_COMPAT_VERSION := 1.1
+	DEVICE_COMPAT_MESSAGE := Config cannot be migrated from swconfig to DSA
 endef
 
 include $(SUBTARGET).mk
diff --git a/target/linux/ipq40xx/image/chromium.mk b/target/linux/ipq40xx/image/chromium.mk
index 2abd2df02ae4dd..f6ac69ecf1433a 100644
--- a/target/linux/ipq40xx/image/chromium.mk
+++ b/target/linux/ipq40xx/image/chromium.mk
@@ -30,7 +30,11 @@ define Device/google_wifi
 	KERNEL_NAME := zImage
 	IMAGES += factory.bin
 	IMAGE/factory.bin := cros-gpt | append-kernel-part | append-rootfs
+	# Note: Chromium/Depthcharge-based bootloaders insert a reserved-memory
+	# ramoops node into the Device Tree automatically, so we can use
+	# kmod-ramoops.
 	DEVICE_PACKAGES := partx-utils mkf2fs e2fsprogs \
-			   kmod-fs-ext4 kmod-fs-f2fs kmod-google-firmware
+			   kmod-fs-ext4 kmod-fs-f2fs kmod-google-firmware \
+			   kmod-ramoops
 endef
 TARGET_DEVICES += google_wifi
diff --git a/target/linux/ipq40xx/image/generic.mk b/target/linux/ipq40xx/image/generic.mk
index 8e15f7ea20da0a..59d4f082ff8b48 100644
--- a/target/linux/ipq40xx/image/generic.mk
+++ b/target/linux/ipq40xx/image/generic.mk
@@ -4,28 +4,28 @@ DEVICE_VARS += RAS_BOARD RAS_ROOTFS_SIZE RAS_VERSION
 DEVICE_VARS += WRGG_DEVNAME WRGG_SIGNATURE
 
 define Device/FitImage
-	KERNEL_SUFFIX := -fit-uImage.itb
+	KERNEL_SUFFIX := -uImage.itb
 	KERNEL = kernel-bin | gzip | fit gzip $$(KDIR)/image-$$(DEVICE_DTS).dtb
 	KERNEL_NAME := Image
 endef
 
 define Device/FitImageLzma
-	KERNEL_SUFFIX := -fit-uImage.itb
+	KERNEL_SUFFIX := -uImage.itb
 	KERNEL = kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(DEVICE_DTS).dtb
 	KERNEL_NAME := Image
 endef
 
 define Device/FitzImage
-	KERNEL_SUFFIX := -fit-zImage.itb
+	KERNEL_SUFFIX := -zImage.itb
 	KERNEL = kernel-bin | fit none $$(KDIR)/image-$$(DEVICE_DTS).dtb
 	KERNEL_NAME := zImage
 endef
 
 define Device/UbiFit
 	KERNEL_IN_UBI := 1
-	IMAGES := nand-factory.ubi nand-sysupgrade.bin
-	IMAGE/nand-factory.ubi := append-ubi
-	IMAGE/nand-sysupgrade.bin := sysupgrade-tar | append-metadata
+	IMAGES := factory.ubi sysupgrade.bin
+	IMAGE/factory.ubi := append-ubi
+	IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
 endef
 
 define Device/DniImage
@@ -160,8 +160,8 @@ define Device/alfa-network_ap120c-ac
 	BLOCKSIZE := 128k
 	PAGESIZE := 2048
 	IMAGE_SIZE := 65536k
-	IMAGES := nand-factory.bin nand-sysupgrade.bin
-	IMAGE/nand-factory.bin := append-ubi | qsdk-ipq-factory-nand
+	IMAGES := factory.bin sysupgrade.bin
+	IMAGE/factory.bin := append-ubi | qsdk-ipq-factory-nand
 endef
 TARGET_DEVICES += alfa-network_ap120c-ac
 
@@ -186,7 +186,7 @@ TARGET_DEVICES += aruba_ap-303h
 define Device/aruba_ap-365
 	$(call Device/aruba_glenmorangie)
 	DEVICE_MODEL := AP-365
-	DEVICE_PACKAGES := kmod-hwmon-ad7418 ipq-wifi-aruba_ap-365
+	DEVICE_PACKAGES := kmod-hwmon-ad7418
 endef
 TARGET_DEVICES += aruba_ap-365
 
@@ -273,7 +273,7 @@ define Device/avm_fritzbox-7530
 	DEVICE_ALT0_VENDOR := AVM
 	DEVICE_ALT0_MODEL := FRITZ!Box 7520
 	SOC := qcom-ipq4019
-	DEVICE_PACKAGES := fritz-caldata fritz-tffs-nand
+	DEVICE_PACKAGES := fritz-caldata fritz-tffs-nand ltq-vdsl-vr11-app
 endef
 TARGET_DEVICES += avm_fritzbox-7530
 
@@ -308,14 +308,14 @@ endef
 TARGET_DEVICES += buffalo_wtr-m2133hp
 
 define Device/cellc_rtl30vw
-	KERNEL_SUFFIX := -fit-zImage.itb
+	KERNEL_SUFFIX := -zImage.itb
 	KERNEL_INITRAMFS = kernel-bin | gzip | fit gzip $$(KDIR)/image-$$(DEVICE_DTS).dtb
 	KERNEL = kernel-bin | fit none $$(KDIR)/image-$$(DEVICE_DTS).dtb | uImage lzma | pad-to 2048
 	KERNEL_NAME := zImage
 	KERNEL_IN_UBI :=
-	IMAGES := nand-factory.bin nand-sysupgrade.bin
-	IMAGE/nand-factory.bin := append-rootfshdr kernel | append-ubi | qsdk-ipq-factory-nand-askey kernel
-	IMAGE/nand-sysupgrade.bin := append-rootfshdr kernel | sysupgrade-tar kernel=$$$$@.kernel | append-metadata
+	IMAGES := factory.bin sysupgrade.bin
+	IMAGE/factory.bin := append-rootfshdr kernel | append-ubi | qsdk-ipq-factory-nand-askey kernel
+	IMAGE/sysupgrade.bin := append-rootfshdr kernel | sysupgrade-tar kernel=$$$$@.kernel | append-metadata
 	DEVICE_VENDOR := Cell C
 	DEVICE_MODEL := RTL30VW
 	SOC := qcom-ipq4019
@@ -333,9 +333,10 @@ define Device/cilab_meshpoint-one
 	$(call Device/8dev_jalapeno-common)
 	DEVICE_VENDOR := Crisis Innovation Lab
 	DEVICE_MODEL := MeshPoint.One
-	DEVICE_PACKAGES := kmod-i2c-gpio kmod-iio-bmp280-i2c kmod-hwmon-ina2xx kmod-rtc-pcf2127
+	DEVICE_PACKAGES += kmod-i2c-gpio kmod-iio-bmp280-i2c kmod-hwmon-ina2xx kmod-rtc-pcf2127
 endef
-TARGET_DEVICES += cilab_meshpoint-one
+# Missing DSA Setup
+#TARGET_DEVICES += cilab_meshpoint-one
 
 define Device/compex_wpj419
 	$(call Device/FitImage)
@@ -349,7 +350,8 @@ define Device/compex_wpj419
 	PAGESIZE := 2048
 	FILESYSTEMS := squashfs
 endef
-TARGET_DEVICES += compex_wpj419
+# Missing DSA Setup
+#TARGET_DEVICES += compex_wpj419
 
 define Device/compex_wpj428
 	$(call Device/FitImage)
@@ -383,10 +385,10 @@ define Device/devolo_magic-2-wifi-next
 	IMAGE_SIZE := 26624k
 	IMAGES := sysupgrade.bin
 	IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | append-metadata
-	DEVICE_PACKAGES := ipq-wifi-devolo_magic-2-wifi-next
 	DEFAULT := n
 endef
-TARGET_DEVICES += devolo_magic-2-wifi-next
+# Missing DSA Setup
+#TARGET_DEVICES += devolo_magic-2-wifi-next
 
 define Device/dlink_dap-2610
 	$(call Device/FitImageLzma)
@@ -435,11 +437,12 @@ define Device/edgecore_oap100
 	SOC := qcom-ipq4019
 	BLOCKSIZE := 128k
 	PAGESIZE := 2048
-	IMAGES := nand-sysupgrade.bin
+	IMAGES := sysupgrade.bin
 	DEVICE_DTS_CONFIG := config@ap.dk07.1-c1
-	DEVICE_PACKAGES := ipq-wifi-edgecore_oap100 kmod-usb-acm kmod-usb-net kmod-usb-net-cdc-qmi uqmi
+	DEVICE_PACKAGES := kmod-usb-acm kmod-usb-net kmod-usb-net-cdc-qmi uqmi
 endef
-TARGET_DEVICES += edgecore_oap100
+# Missing DSA Setup
+#TARGET_DEVICES += edgecore_oap100
 
 define Device/engenius_eap1300
 	$(call Device/FitImage)
@@ -452,7 +455,8 @@ define Device/engenius_eap1300
 	IMAGE_SIZE := 25344k
 	IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | append-metadata
 endef
-TARGET_DEVICES += engenius_eap1300
+# Missing DSA Setup
+#TARGET_DEVICES += engenius_eap1300
 
 define Device/engenius_eap2200
 	$(call Device/FitImage)
@@ -464,7 +468,8 @@ define Device/engenius_eap2200
 	PAGESIZE := 2048
 	DEVICE_PACKAGES := ath10k-firmware-qca9888-ct -kmod-ath10k-ct kmod-ath10k-ct-smallbuffers
 endef
-TARGET_DEVICES += engenius_eap2200
+# Missing DSA Setup
+#TARGET_DEVICES += engenius_eap2200
 
 define Device/engenius_emd1
 	$(call Device/FitImage)
@@ -477,7 +482,8 @@ define Device/engenius_emd1
 	IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | append-metadata
 	IMAGE/factory.bin := qsdk-ipq-factory-nor | check-size
 endef
-TARGET_DEVICES += engenius_emd1
+# Missing DSA Setup
+#TARGET_DEVICES += engenius_emd1
 
 define Device/engenius_emr3500
 	$(call Device/FitImage)
@@ -492,7 +498,8 @@ define Device/engenius_emr3500
 	IMAGE/factory.bin := qsdk-ipq-factory-nor | check-size
 	DEFAULT := n
 endef
-TARGET_DEVICES += engenius_emr3500
+# Missing DSA Setup
+#TARGET_DEVICES += engenius_emr3500
 
 define Device/engenius_ens620ext
 	$(call Device/FitImage)
@@ -518,7 +525,8 @@ define Device/engenius_ens620ext
 	IMAGE/factory_30.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-rootfs | pad-rootfs | check-size | SenaoFW $$$$(PRODUCT_ID) $$$$(FW_VER)
 	IMAGE/factory_35.bin := qsdk-ipq-factory-nor | check-size | SenaoFW $$$$(PRODUCT_ID_NEW) $$$$(FW_VER_NEW)
 endef
-TARGET_DEVICES += engenius_ens620ext
+# Missing DSA Setup
+#TARGET_DEVICES += engenius_ens620ext
 
 define Device/extreme-networks_ws-ap3915i
 	$(call Device/FitImage)
@@ -528,7 +536,6 @@ define Device/extreme-networks_ws-ap3915i
 	SOC := qcom-ipq4029
 	BLOCKSIZE := 128k
 	IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | check-size | append-metadata
-	DEVICE_PACKAGES := ipq-wifi-extreme-networks_ws-ap3915i
 endef
 TARGET_DEVICES += extreme-networks_ws-ap3915i
 
@@ -549,6 +556,19 @@ define Device/ezviz_cs-w3-wd1200g-eup
 endef
 TARGET_DEVICES += ezviz_cs-w3-wd1200g-eup
 
+define Device/glinet_gl-a1300
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := GL.iNet
+	DEVICE_MODEL := GL-A1300
+	SOC := qcom-ipq4018
+	DEVICE_DTS_CONFIG := config@ap.dk01.1-c2
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	IMAGE_SIZE := 131072k
+endef
+TARGET_DEVICES += glinet_gl-a1300
+
 define Device/glinet_gl-ap1300
 	$(call Device/FitImage)
 	$(call Device/UbiFit)
@@ -560,7 +580,7 @@ define Device/glinet_gl-ap1300
 	PAGESIZE := 2048
 	IMAGE_SIZE := 131072k
 	KERNEL_INSTALL := 1
-	DEVICE_PACKAGES := ipq-wifi-glinet_gl-ap1300 kmod-usb-net-qmi-wwan kmod-usb-serial-option uqmi
+	DEVICE_PACKAGES := kmod-usb-net-qmi-wwan kmod-usb-serial-option uqmi
 endef
 TARGET_DEVICES += glinet_gl-ap1300
 
@@ -603,9 +623,21 @@ define Device/glinet_gl-s1300
 	IMAGE_SIZE := 26624k
 	IMAGES := sysupgrade.bin
 	IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | append-metadata
-	DEVICE_PACKAGES := ipq-wifi-glinet_gl-s1300 kmod-fs-ext4 kmod-mmc kmod-spi-dev
+	DEVICE_PACKAGES := kmod-fs-ext4 kmod-mmc kmod-spi-dev
+endef
+# Missing DSA Setup
+#TARGET_DEVICES += glinet_gl-s1300
+
+define Device/kernel-size-6350-8300
+	DEVICE_COMPAT_VERSION := 2.0
+	DEVICE_COMPAT_MESSAGE := Kernel partition size must be increased for \
+	this OpenWrt version. Before continuing, you MUST issue either the \
+	command "fw_setenv kernsize 500000" from the OpenWrt command line, \
+	or "setenv kernsize 500000 ; saveenv" from the U-Boot serial console. \
+	Instead of the sysupgrade image, you must then install the OpenWrt \
+	factory image, setting the force flag and wiping the configuration. \
+	(e.g. "sysupgrade -n -F openwrt-squashfs-factory.bin" on command line)
 endef
-TARGET_DEVICES += glinet_gl-s1300
 
 define Device/linksys_ea6350v3
 	# The Linksys EA6350v3 has a uboot bootloader that does not
@@ -613,30 +645,32 @@ define Device/linksys_ea6350v3
 	# partitions. This uboot, however, supports raw kernel images and
 	# gzipped images.
 	#
-	# As for the time of writing this, the device will boot the kernel
-	# from a fixed address with a fixed length of 3MiB. Also, the
-	# device has a hard-coded kernel command line that requieres the
+	# As configured by the OEM factory, the device will boot the kernel
+	# from a fixed address with a fixed length of 3 MiB. Also, the
+	# device has a hard-coded kernel command line that requires the
 	# rootfs and alt_rootfs to be in mtd11 and mtd13 respectively.
 	# Oh... and the kernel partition overlaps with the rootfs
 	# partition (the same for alt_kernel and alt_rootfs).
 	#
 	# If you are planing re-partitioning the device, you may want to
-	# keep those details in mind:
-	# 1. The kernel adresses you should honor are 0x00000000 and
+	# keep these details in mind:
+	# 1. The kernel addresses you should honor are 0x00000000 and
 	#    0x02800000 respectively.
-	# 2. The kernel size (plus the dtb) cannot exceed 3.00MiB in size.
+	# 2. The kernel size (plus the dtb) cannot exceed 3 MiB in size
+	#    unless the uboot environment variable "kernsize" is increased.
 	# 3. You can use 'zImage', but not a raw 'Image' packed with lzma.
 	# 4. The kernel command line from uboot is harcoded to boot with
 	#    rootfs either in mtd11 or mtd13.
 	$(call Device/FitzImage)
+	$(call Device/kernel-size-6350-8300)
 	DEVICE_VENDOR := Linksys
 	DEVICE_MODEL := EA6350
 	DEVICE_VARIANT := v3
 	SOC := qcom-ipq4018
 	BLOCKSIZE := 128k
 	PAGESIZE := 2048
-	KERNEL_SIZE := 3072k
-	IMAGE_SIZE := 37888k
+	KERNEL_SIZE := 5120k
+	IMAGE_SIZE := 35840k
 	UBINIZE_OPTS := -E 5
 	IMAGES += factory.bin
 	IMAGE/factory.bin := append-kernel | append-uImage-fakehdr filesystem | pad-to $$$$(KERNEL_SIZE) | append-ubi | linksys-image type=EA6350v3
@@ -645,27 +679,29 @@ TARGET_DEVICES += linksys_ea6350v3
 
 define Device/linksys_ea8300
 	$(call Device/FitzImage)
+	$(call Device/kernel-size-6350-8300)
 	DEVICE_VENDOR := Linksys
 	DEVICE_MODEL := EA8300
 	SOC := qcom-ipq4019
-	KERNEL_SIZE := 3072k
-	IMAGE_SIZE := 87040k
+	KERNEL_SIZE := 5120k
+	IMAGE_SIZE := 84992k
 	BLOCKSIZE := 128k
 	PAGESIZE := 2048
 	UBINIZE_OPTS := -E 5    # EOD marks to "hide" factory sig at EOF
 	IMAGES += factory.bin
 	IMAGE/factory.bin  := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-ubi | linksys-image type=EA8300
-	DEVICE_PACKAGES := ath10k-firmware-qca9888-ct ipq-wifi-linksys_ea8300 kmod-usb-ledtrig-usbport
+	DEVICE_PACKAGES := ath10k-firmware-qca9888-ct kmod-usb-ledtrig-usbport
 endef
 TARGET_DEVICES += linksys_ea8300
 
 define Device/linksys_mr8300
 	$(call Device/FitzImage)
+	$(call Device/kernel-size-6350-8300)
 	DEVICE_VENDOR := Linksys
 	DEVICE_MODEL := MR8300
 	SOC := qcom-ipq4019
-	KERNEL_SIZE := 3072k
-	IMAGE_SIZE := 87040k
+	KERNEL_SIZE := 5120k
+	IMAGE_SIZE := 84992k
 	BLOCKSIZE := 128k
 	PAGESIZE := 2048
 	UBINIZE_OPTS := -E 5    # EOD marks to "hide" factory sig at EOF
@@ -675,24 +711,38 @@ define Device/linksys_mr8300
 endef
 TARGET_DEVICES += linksys_mr8300
 
-define Device/linksys_whw01-v1
+define Device/linksys_whw03v2
+	$(call Device/FitzImage)
+	DEVICE_VENDOR := Linksys
+	DEVICE_MODEL := WHW03
+	DEVICE_VARIANT := V2
+	SOC := qcom-ipq4019
+	KERNEL_SIZE := 6144k
+	IMAGE_SIZE := 158720k
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	UBINIZE_OPTS := -E 5    # EOD marks to "hide" factory sig at EOF
+	IMAGES += factory.bin
+	IMAGE/factory.bin  := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-ubi | linksys-image type=WHW03v2
+	DEVICE_PACKAGES := ath10k-firmware-qca9888-ct kmod-leds-pca963x kmod-spi-dev kmod-bluetooth
+endef
+TARGET_DEVICES += linksys_whw03v2
+
+define Device/linksys_whw01
 	$(call Device/FitzImage)
 	DEVICE_VENDOR := Linksys
 	DEVICE_MODEL := WHW01
-	DEVICE_VARIANT := v1
 	KERNEL_SIZE := 6144k
-	IMAGE_SIZE := 28704512  # 28032k minus linksys signature (256-bytes).
+	IMAGE_SIZE := 75776K
 	SOC := qcom-ipq4018
 	BLOCKSIZE := 128k
 	PAGESIZE := 2048
 	UBINIZE_OPTS := -E 5    # EOD marks to "hide" factory sig at EOF
 	IMAGES += factory.bin
-	IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | \
-		append-ubi | linksys-image type=WHW01 | pad-to $$$$(PAGESIZE) | \
-		check-size
+	IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-ubi | linksys-image type=WHW01
 	DEVICE_PACKAGES := uboot-envtools kmod-leds-pca963x
 endef
-TARGET_DEVICES += linksys_whw01-v1
+TARGET_DEVICES += linksys_whw01
 
 define Device/luma_wrtq-329acn
 	$(call Device/FitImage)
@@ -832,8 +882,8 @@ define Device/netgear_wac510
 	DEVICE_DTS_CONFIG := config@5
 	BLOCKSIZE := 128k
 	PAGESIZE := 2048
-	IMAGES += nand-factory.tar
-	IMAGE/nand-factory.tar := append-ubi | wac5xx-netgear-tar
+	IMAGES += factory.tar
+	IMAGE/factory.tar := append-ubi | wac5xx-netgear-tar
 	DEVICE_PACKAGES := uboot-envtools
 endef
 TARGET_DEVICES += netgear_wac510
@@ -878,14 +928,13 @@ define Device/p2w_r619ac
 	DEVICE_DTS_CONFIG := config@10
 	BLOCKSIZE := 128k
 	PAGESIZE := 2048
-	DEVICE_PACKAGES := ipq-wifi-p2w_r619ac
 endef
 
 define Device/p2w_r619ac-64m
 	$(call Device/p2w_r619ac)
 	DEVICE_VARIANT := 64M NAND
-	IMAGES += nand-factory.bin
-	IMAGE/nand-factory.bin := append-ubi | qsdk-ipq-factory-nand
+	IMAGES += factory.bin
+	IMAGE/factory.bin := append-ubi | qsdk-ipq-factory-nand
 endef
 TARGET_DEVICES += p2w_r619ac-64m
 
@@ -900,7 +949,6 @@ define Device/pakedge_wr-1
 	DEVICE_VENDOR := Pakedge
 	DEVICE_MODEL := WR-1
 	DEVICE_DTS_CONFIG := config@ap.dk01.1-c1
-	DEVICE_PACKAGES := ipq-wifi-pakedge_wr-1
 	SOC := qcom-ipq4018
 	BLOCKSIZE := 64k
 	IMAGE_SIZE := 31232k
@@ -979,11 +1027,8 @@ define Device/qxwlan_e2600ac-c1
 	DEVICE_VARIANT := C1
 	BOARD_NAME := e2600ac-c1
 	SOC := qcom-ipq4019
-	KERNEL_SIZE := 4096k
 	IMAGE_SIZE := 31232k
 	IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | append-metadata
-	DEVICE_PACKAGES := ipq-wifi-qxwlan_e2600ac-c1
-	DEFAULT := n
 endef
 TARGET_DEVICES += qxwlan_e2600ac-c1
 
@@ -997,10 +1042,21 @@ define Device/qxwlan_e2600ac-c2
 	KERNEL_INSTALL := 1
 	BLOCKSIZE := 128k
 	PAGESIZE := 2048
-	DEVICE_PACKAGES := ipq-wifi-qxwlan_e2600ac-c2
 endef
 TARGET_DEVICES += qxwlan_e2600ac-c2
 
+define Device/sony_ncp-hg100-cellular
+	$(call Device/FitImage)
+	DEVICE_VENDOR := Sony
+	DEVICE_MODEL := NCP-HG100/Cellular
+	DEVICE_DTS_CONFIG := config@ap.dk04.1-c4
+	SOC := qcom-ipq4019
+	KERNEL_SIZE := 8192k
+	IMAGE_SIZE := 128m
+	DEVICE_PACKAGES := e2fsprogs kmod-fs-ext4 uqmi
+endef
+TARGET_DEVICES += sony_ncp-hg100-cellular
+
 define Device/teltonika_rutx10
 	$(call Device/FitImage)
 	$(call Device/UbiFit)
@@ -1012,10 +1068,11 @@ define Device/teltonika_rutx10
 	BLOCKSIZE := 128k
 	PAGESIZE := 2048
 	FILESYSTEMS := squashfs
-	IMAGE/nand-factory.ubi := append-ubi | qsdk-ipq-factory-nand | append-rutx-metadata
-	DEVICE_PACKAGES := ipq-wifi-teltonika_rutx kmod-bluetooth
+	IMAGE/factory.ubi := append-ubi | qsdk-ipq-factory-nand | append-rutx-metadata
+	DEVICE_PACKAGES := kmod-bluetooth
 endef
-TARGET_DEVICES += teltonika_rutx10
+# Missing DSA Setup
+#TARGET_DEVICES += teltonika_rutx10
 
 define Device/tel_x1pro
 	$(call Device/FitImage)
@@ -1028,7 +1085,8 @@ define Device/tel_x1pro
 	DEVICE_PACKAGES := kmod-usb-net-qmi-wwan kmod-usb-serial-option uqmi
 	DEFAULT := n
 endef
-TARGET_DEVICES += tel_x1pro
+# Missing DSA Setup
+#TARGET_DEVICES += tel_x1pro
 
 define Device/unielec_u4019-32m
 	$(call Device/FitImage)
@@ -1042,12 +1100,38 @@ define Device/unielec_u4019-32m
 	IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | append-metadata
 	DEFAULT := n
 endef
-TARGET_DEVICES += unielec_u4019-32m
+# Missing DSA Setup
+#TARGET_DEVICES += unielec_u4019-32m
 
-define Device/zte_mf286d
+define Device/wallys_dr40x9
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Wallys
+	DEVICE_MODEL := DR40X9
+	SOC := qcom-ipq40x9
+	DEVICE_DTS_CONFIG := config@ap.dk07.1-c1
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_PACKAGES := ipq-wifi-wallys_dr40x9
+endef
+TARGET_DEVICES += wallys_dr40x9
+
+define Device/zte_mf18a
+	$(call Device/FitImage)
+	DEVICE_VENDOR := ZTE
+	DEVICE_MODEL := MF18A
+	SOC := qcom-ipq4019
+	DEVICE_DTS_CONFIG := config@ap.dk04.1-c1
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	KERNEL_IN_UBI := 1
+	DEVICE_PACKAGES := ath10k-firmware-qca99x0-ct
+endef
+TARGET_DEVICES += zte_mf18a
+
+define Device/zte_mf28x_common
 	$(call Device/FitzImage)
 	DEVICE_VENDOR := ZTE
-	DEVICE_MODEL := MF286D
 	SOC := qcom-ipq4019
 	DEVICE_DTS_CONFIG := config@ap.dk04.1-c1
 	BLOCKSIZE := 128k
@@ -1055,8 +1139,20 @@ define Device/zte_mf286d
 	KERNEL_IN_UBI := 1
 	DEVICE_PACKAGES := kmod-usb-net-qmi-wwan kmod-usb-serial-option uqmi
 endef
+
+define Device/zte_mf286d
+	$(call Device/zte_mf28x_common)
+	DEVICE_MODEL := MF286D
+endef
 TARGET_DEVICES += zte_mf286d
 
+define Device/zte_mf289f
+	$(call Device/zte_mf28x_common)
+	DEVICE_MODEL := MF289F
+	DEVICE_PACKAGES += ath10k-firmware-qca9984-ct
+endef
+TARGET_DEVICES += zte_mf289f
+
 define Device/zyxel_nbg6617
 	$(call Device/FitImageLzma)
 	DEVICE_VENDOR := ZyXEL
@@ -1089,4 +1185,5 @@ define Device/zyxel_wre6606
 	IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | check-size | append-metadata
 	DEVICE_PACKAGES := -kmod-ath10k-ct kmod-ath10k-ct-smallbuffers
 endef
-TARGET_DEVICES += zyxel_wre6606
+# Missing DSA Setup
+#TARGET_DEVICES += zyxel_wre6606
diff --git a/target/linux/ipq40xx/image/mikrotik.mk b/target/linux/ipq40xx/image/mikrotik.mk
index d1f0829cd3f3d4..f0e1f1aad34d92 100644
--- a/target/linux/ipq40xx/image/mikrotik.mk
+++ b/target/linux/ipq40xx/image/mikrotik.mk
@@ -16,8 +16,8 @@ define Device/mikrotik_nand
 	KERNEL_INITRAMFS := kernel-bin | append-dtb-elf
 	KERNEL := kernel-bin | append-dtb-elf | package-kernel-ubifs | \
 		ubinize-kernel
-	IMAGES := nand-sysupgrade.bin
-	IMAGE/nand-sysupgrade.bin := sysupgrade-tar | append-metadata
+	IMAGES := sysupgrade.bin
+	IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
 endef
 
 define Device/mikrotik_cap-ac
@@ -47,6 +47,14 @@ define Device/mikrotik_hap-ac3
 endef
 TARGET_DEVICES += mikrotik_hap-ac3
 
+define Device/mikrotik_hap-ac3-lte6-kit
+        $(call Device/mikrotik_nor)
+        DEVICE_MODEL := hAP ac3 LTE6 kit
+        SOC := qcom-ipq4019
+        DEVICE_PACKAGES := kmod-ledtrig-gpio kmod-usb-acm kmod-usb-net-rndis
+endef
+TARGET_DEVICES += mikrotik_hap-ac3-lte6-kit
+
 define Device/mikrotik_lhgg-60ad
 	$(call Device/mikrotik_nor)
 	DEVICE_MODEL := Wireless Wire Dish LHGG-60ad
@@ -70,3 +78,23 @@ define Device/mikrotik_wap-ac
 	DEVICE_PACKAGES := -kmod-ath10k-ct kmod-ath10k-ct-smallbuffers
 endef
 TARGET_DEVICES += mikrotik_wap-ac
+
+define Device/mikrotik_wap-r-ac
+	$(call Device/mikrotik_wap-ac)
+	DEVICE_MODEL := wAP R ac
+	DEVICE_PACKAGES := kmod-usb-net-qmi-wwan kmod-usb-serial-option uqmi \
+		kmod-usb-acm kmod-usb-net-rndis
+	DEVICE_DTS := qcom-ipq4018-wap-r-ac
+endef
+TARGET_DEVICES += mikrotik_wap-r-ac
+
+define Device/mikrotik_wap-ac-lte
+	$(call Device/mikrotik_wap-ac)
+	DEVICE_MODEL := wAP ac LTE
+	DEVICE_PACKAGES := kmod-usb-net-qmi-wwan kmod-usb-serial-option uqmi \
+		kmod-usb-acm kmod-usb-net-rndis
+	DEVICE_DTS := qcom-ipq4018-wap-ac-lte
+	DEVICE_ALT0_VENDOR = Mikrotik
+	DEVICE_ALT0_MODEL := wAP ac LTE6
+endef
+TARGET_DEVICES += mikrotik_wap-ac-lte
diff --git a/target/linux/ipq40xx/patches-5.15/301-arm-compressed-add-appended-DTB-section.patch b/target/linux/ipq40xx/patches-5.15/301-arm-compressed-add-appended-DTB-section.patch
index 99e33632c4ce9a..0448574e7e5e0e 100644
--- a/target/linux/ipq40xx/patches-5.15/301-arm-compressed-add-appended-DTB-section.patch
+++ b/target/linux/ipq40xx/patches-5.15/301-arm-compressed-add-appended-DTB-section.patch
@@ -26,7 +26,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 
 --- a/arch/arm/boot/compressed/vmlinux.lds.S
 +++ b/arch/arm/boot/compressed/vmlinux.lds.S
-@@ -101,6 +101,13 @@ SECTIONS
+@@ -103,6 +103,13 @@ SECTIONS
  
    _edata = .;
  
@@ -40,7 +40,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
    /*
     * The image_end section appears after any additional loadable sections
     * that the linker may decide to insert in the binary image.  Having
-@@ -138,4 +145,4 @@ SECTIONS
+@@ -140,4 +147,4 @@ SECTIONS
  
    ARM_ASSERTS
  }
diff --git a/target/linux/ipq40xx/patches-5.15/400-mmc-sdhci-sdhci-msm-use-sdhci_set_clock-instead-of-s.patch b/target/linux/ipq40xx/patches-5.15/400-mmc-sdhci-sdhci-msm-use-sdhci_set_clock-instead-of-s.patch
index 23fef71b2b486c..3a3be91709eb97 100644
--- a/target/linux/ipq40xx/patches-5.15/400-mmc-sdhci-sdhci-msm-use-sdhci_set_clock-instead-of-s.patch
+++ b/target/linux/ipq40xx/patches-5.15/400-mmc-sdhci-sdhci-msm-use-sdhci_set_clock-instead-of-s.patch
@@ -13,7 +13,7 @@ Signed-off-by: Robert Marko <robert.marko@sartura.hr>
 
 --- a/drivers/mmc/host/sdhci-msm.c
 +++ b/drivers/mmc/host/sdhci-msm.c
-@@ -2446,7 +2446,7 @@ MODULE_DEVICE_TABLE(of, sdhci_msm_dt_mat
+@@ -2447,7 +2447,7 @@ MODULE_DEVICE_TABLE(of, sdhci_msm_dt_mat
  
  static const struct sdhci_ops sdhci_msm_ops = {
  	.reset = sdhci_msm_reset,
diff --git a/target/linux/ipq40xx/patches-5.15/401-mmc-sdhci-msm-comment-unused-sdhci_msm_set_clock.patch b/target/linux/ipq40xx/patches-5.15/401-mmc-sdhci-msm-comment-unused-sdhci_msm_set_clock.patch
new file mode 100644
index 00000000000000..b297600171a8c6
--- /dev/null
+++ b/target/linux/ipq40xx/patches-5.15/401-mmc-sdhci-msm-comment-unused-sdhci_msm_set_clock.patch
@@ -0,0 +1,108 @@
+From 28edd829133766eb3cefaf2e49d3ee701968061b Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 9 May 2023 01:57:17 +0200
+Subject: [PATCH] mmc: sdhci-msm: comment unused sdhci_msm_set_clock
+
+comment unused sdhci_msm_set_clock and __sdhci_msm_set_clock as due to some
+current problem, we are forced to use sdhci_set_clock.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/mmc/host/sdhci-msm.c | 86 ++++++++++++++++++------------------
+ 1 file changed, 43 insertions(+), 43 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -1751,49 +1751,49 @@ static unsigned int sdhci_msm_get_min_cl
+ 	return SDHCI_MSM_MIN_CLOCK;
+ }
+ 
+-/*
+- * __sdhci_msm_set_clock - sdhci_msm clock control.
+- *
+- * Description:
+- * MSM controller does not use internal divider and
+- * instead directly control the GCC clock as per
+- * HW recommendation.
+- **/
+-static void __sdhci_msm_set_clock(struct sdhci_host *host, unsigned int clock)
+-{
+-	u16 clk;
+-
+-	sdhci_writew(host, 0, SDHCI_CLOCK_CONTROL);
+-
+-	if (clock == 0)
+-		return;
+-
+-	/*
+-	 * MSM controller do not use clock divider.
+-	 * Thus read SDHCI_CLOCK_CONTROL and only enable
+-	 * clock with no divider value programmed.
+-	 */
+-	clk = sdhci_readw(host, SDHCI_CLOCK_CONTROL);
+-	sdhci_enable_clk(host, clk);
+-}
+-
+-/* sdhci_msm_set_clock - Called with (host->lock) spinlock held. */
+-static void sdhci_msm_set_clock(struct sdhci_host *host, unsigned int clock)
+-{
+-	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+-	struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
+-
+-	if (!clock) {
+-		host->mmc->actual_clock = msm_host->clk_rate = 0;
+-		goto out;
+-	}
+-
+-	sdhci_msm_hc_select_mode(host);
+-
+-	msm_set_clock_rate_for_bus_mode(host, clock);
+-out:
+-	__sdhci_msm_set_clock(host, clock);
+-}
++// /*
++//  * __sdhci_msm_set_clock - sdhci_msm clock control.
++//  *
++//  * Description:
++//  * MSM controller does not use internal divider and
++//  * instead directly control the GCC clock as per
++//  * HW recommendation.
++//  **/
++// static void __sdhci_msm_set_clock(struct sdhci_host *host, unsigned int clock)
++// {
++// 	u16 clk;
++
++// 	sdhci_writew(host, 0, SDHCI_CLOCK_CONTROL);
++
++// 	if (clock == 0)
++// 		return;
++
++// 	/*
++// 	 * MSM controller do not use clock divider.
++// 	 * Thus read SDHCI_CLOCK_CONTROL and only enable
++// 	 * clock with no divider value programmed.
++// 	 */
++// 	clk = sdhci_readw(host, SDHCI_CLOCK_CONTROL);
++// 	sdhci_enable_clk(host, clk);
++// }
++
++// /* sdhci_msm_set_clock - Called with (host->lock) spinlock held. */
++// static void sdhci_msm_set_clock(struct sdhci_host *host, unsigned int clock)
++// {
++// 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
++// 	struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
++
++// 	if (!clock) {
++// 		host->mmc->actual_clock = msm_host->clk_rate = 0;
++// 		goto out;
++// 	}
++
++// 	sdhci_msm_hc_select_mode(host);
++
++// 	msm_set_clock_rate_for_bus_mode(host, clock);
++// out:
++// 	__sdhci_msm_set_clock(host, clock);
++// }
+ 
+ /*****************************************************************************\
+  *                                                                           *
diff --git a/target/linux/ipq40xx/patches-5.15/700-skbuff-add-DSA-specific-data-to-struct-skb_shared_in.patch b/target/linux/ipq40xx/patches-5.15/700-skbuff-add-DSA-specific-data-to-struct-skb_shared_in.patch
new file mode 100644
index 00000000000000..385364c076eaeb
--- /dev/null
+++ b/target/linux/ipq40xx/patches-5.15/700-skbuff-add-DSA-specific-data-to-struct-skb_shared_in.patch
@@ -0,0 +1,43 @@
+From da75807ac41175e9db8c95f7a172b4133763b744 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <j4g8y7@gmail.com>
+Date: Mon, 11 Jan 2021 17:49:36 +0100
+Subject: [PATCH] skbuff: add DSA specific data to struct skb_shared_info
+
+All of the already existing DSA tagging protocol drivers
+are storing the tagging data directly into the skb. In most
+cases that is the only way to send the required information
+to the underlying ethernet switch.
+
+However on certain platforms (like the Qualcomm IPQ40xx
+SoCs) the built-in ethernet switch is connected directly
+to an ethernet MAC, and the tagging information must be
+sent out-of-band which is done directly via the hardware
+TX descriptors of the ethernet MAC.
+
+In such cases, putting the information into the skb causes
+unneccesary overhead, because the ethernet driver must
+remove that before sending the ethernet frame towards to
+the hardware.
+
+This change adds two new DSA specific fields to struct
+skb_shared_info which makes it possible to send the
+tagging information via skb->shinfo. With this approach,
+the twofold modifications of the skb data can be avoided.
+
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+---
+ include/linux/skbuff.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -564,6 +564,9 @@ struct skb_shared_info {
+ 	unsigned int	gso_type;
+ 	u32		tskey;
+ 
++	unsigned int	dsa_tag_proto;
++	unsigned char	dsa_tag_data[8];
++
+ 	/*
+ 	 * Warning : all fields before dataref are cleared in __alloc_skb()
+ 	 */
diff --git a/target/linux/ipq40xx/patches-5.15/701-net-dsa-tag_ipq4019-add-shinfo-based-tagging-driver-.patch b/target/linux/ipq40xx/patches-5.15/701-net-dsa-tag_ipq4019-add-shinfo-based-tagging-driver-.patch
new file mode 100644
index 00000000000000..74079d68a13d5e
--- /dev/null
+++ b/target/linux/ipq40xx/patches-5.15/701-net-dsa-tag_ipq4019-add-shinfo-based-tagging-driver-.patch
@@ -0,0 +1,187 @@
+From 29a0c2fae991cab142575c92276c0afdeb260ebe Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <j4g8y7@gmail.com>
+Date: Thu, 28 Oct 2021 21:44:52 +0200
+Subject: [PATCH] net: dsa: tag_ipq4019: add shinfo based tagging driver for
+ IPQ40xx
+
+This change adds a tagging protocol driver for the built-in
+ethernet switch of the Qualcomm Atheros IPQ4019 SoCs.
+
+In comparison to the existing tagging protocols this hardware
+requires a slightly different approach because the switch does
+not use in-band tags.
+
+On the receive path, the source port information is embedded
+into the RX descriptors of the ethernet MAC hardware. Similarly,
+the destination port mask must be sent via the TX descriptors
+of the ethernet MAC when a packet is sent towards the switch.
+
+In order to support this special requirements, this patch
+adds a new tagging protocol driver.
+
+The driver extracts the source port information directly
+from the 'receive return descriptor' of the ethernet MAC.
+It is possible because that descriptor is part of the skb
+received from the ethernet driver.
+
+Unfortunatley, it is not possible to put the destination
+port information directly to the TX descriptors, because
+those are handled internally by the driver of the ethernet
+hardware.
+
+To overcome this limitation, this tagging driver uses the
+DSA specific fields in skb->shinfo to send the destination
+port information to the ethernet driver.
+
+A similar tagging driver is exist but that uses skb
+extensions which causes unnecessary overhead.
+
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+---
+ include/linux/dsa/ipq4019.h | 11 ++++++
+ include/net/dsa.h           |  2 +
+ net/dsa/Kconfig             |  6 +++
+ net/dsa/Makefile            |  1 +
+ net/dsa/tag_ipq4019.c       | 79 +++++++++++++++++++++++++++++++++++++
+ 5 files changed, 99 insertions(+)
+ create mode 100644 include/linux/dsa/ipq4019.h
+ create mode 100644 net/dsa/tag_ipq4019.c
+
+--- /dev/null
++++ b/include/linux/dsa/ipq4019.h
+@@ -0,0 +1,11 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++#ifndef DSA_IPQ40XX_H
++#define DSA_IPQ40XX_H
++
++struct ipq40xx_dsa_tag_data {
++	u8 from_cpu;
++	u8 dp;
++};
++
++#endif /* DSA_IPQ40XX_H */
+--- a/include/net/dsa.h
++++ b/include/net/dsa.h
+@@ -51,6 +51,7 @@ struct phylink_link_state;
+ #define DSA_TAG_PROTO_SEVILLE_VALUE		21
+ #define DSA_TAG_PROTO_BRCM_LEGACY_VALUE		22
+ #define DSA_TAG_PROTO_SJA1110_VALUE		23
++#define DSA_TAG_PROTO_IPQ4019_VALUE		24
+ 
+ enum dsa_tag_protocol {
+ 	DSA_TAG_PROTO_NONE		= DSA_TAG_PROTO_NONE_VALUE,
+@@ -77,6 +78,7 @@ enum dsa_tag_protocol {
+ 	DSA_TAG_PROTO_OCELOT_8021Q	= DSA_TAG_PROTO_OCELOT_8021Q_VALUE,
+ 	DSA_TAG_PROTO_SEVILLE		= DSA_TAG_PROTO_SEVILLE_VALUE,
+ 	DSA_TAG_PROTO_SJA1110		= DSA_TAG_PROTO_SJA1110_VALUE,
++	DSA_TAG_PROTO_IPQ4019		= DSA_TAG_PROTO_IPQ4019_VALUE,
+ };
+ 
+ struct dsa_switch;
+--- a/net/dsa/Kconfig
++++ b/net/dsa/Kconfig
+@@ -57,6 +57,12 @@ config NET_DSA_TAG_HELLCREEK
+ 	  Say Y or M if you want to enable support for tagging frames
+ 	  for the Hirschmann Hellcreek TSN switches.
+ 
++config NET_DSA_TAG_IPQ4019
++	tristate "Tag driver for Qualcomm Atheros IPQ4019 SoC built-in switch"
++	help
++	  Say Y or M if you want to enable support for tagging frames for
++	  the built-in switch of the Qualcomm Atheros IPQ4019 SoC-s.
++
+ config NET_DSA_TAG_GSWIP
+ 	tristate "Tag driver for Lantiq / Intel GSWIP switches"
+ 	help
+--- a/net/dsa/Makefile
++++ b/net/dsa/Makefile
+@@ -8,6 +8,7 @@ obj-$(CONFIG_NET_DSA_TAG_AR9331) += tag_
+ obj-$(CONFIG_NET_DSA_TAG_BRCM_COMMON) += tag_brcm.o
+ obj-$(CONFIG_NET_DSA_TAG_DSA_COMMON) += tag_dsa.o
+ obj-$(CONFIG_NET_DSA_TAG_GSWIP) += tag_gswip.o
++obj-$(CONFIG_NET_DSA_TAG_IPQ4019) += tag_ipq4019.o
+ obj-$(CONFIG_NET_DSA_TAG_HELLCREEK) += tag_hellcreek.o
+ obj-$(CONFIG_NET_DSA_TAG_KSZ) += tag_ksz.o
+ obj-$(CONFIG_NET_DSA_TAG_RTL4_A) += tag_rtl4_a.o
+--- /dev/null
++++ b/net/dsa/tag_ipq4019.c
+@@ -0,0 +1,78 @@
++// SPDX-License-Identifier: GPL-2.0-only
++
++/* Copyright (c) 2021, Gabor Juhos <j4g8y7@gmail.com> */
++
++#include <linux/bitfield.h>
++#include <linux/dsa/ipq4019.h>
++
++#include "dsa_priv.h"
++
++/* Receive Return Descriptor */
++struct edma_rrd {
++	u16 rrd0;
++	u16 rrd1;
++	u16 rrd2;
++	u16 rrd3;
++	u16 rrd4;
++	u16 rrd5;
++	u16 rrd6;
++	u16 rrd7;
++} __packed;
++
++#define EDMA_RRD_SIZE			sizeof(struct edma_rrd)
++
++#define EDMA_RRD1_PORT_ID_MASK		GENMASK(14, 12)
++
++static struct sk_buff *ipq4019_sh_tag_xmit(struct sk_buff *skb,
++					   struct net_device *dev)
++{
++	struct dsa_port *dp = dsa_slave_to_port(dev);
++	struct ipq40xx_dsa_tag_data *tag_data;
++
++	BUILD_BUG_ON(sizeof_field(struct skb_shared_info, dsa_tag_data) <
++		     sizeof(struct ipq40xx_dsa_tag_data));
++
++	skb_shinfo(skb)->dsa_tag_proto = DSA_TAG_PROTO_IPQ4019;
++	tag_data = (struct ipq40xx_dsa_tag_data *)skb_shinfo(skb)->dsa_tag_data;
++
++	tag_data->from_cpu = 1;
++	/* set the destination port information */
++	tag_data->dp = BIT(dp->index);
++
++	return skb;
++}
++
++static struct sk_buff *ipq4019_sh_tag_rcv(struct sk_buff *skb,
++					  struct net_device *dev)
++{
++	struct edma_rrd *rrd;
++	int offset;
++	int port;
++
++	offset = EDMA_RRD_SIZE + ETH_HLEN;
++	if (unlikely(skb_headroom(skb) < offset))
++		return NULL;
++
++	rrd = (struct edma_rrd *)(skb->data - offset);
++	port = FIELD_GET(EDMA_RRD1_PORT_ID_MASK, rrd->rrd1);
++
++	skb->dev = dsa_master_find_slave(dev, 0, port);
++	if (!skb->dev)
++		return NULL;
++
++	return skb;
++}
++
++const struct dsa_device_ops ipq4019_sh_tag_dsa_ops = {
++	.name	= "ipq4019-sh",
++	.proto	= DSA_TAG_PROTO_IPQ4019,
++	.xmit	= ipq4019_sh_tag_xmit,
++	.rcv	= ipq4019_sh_tag_rcv,
++};
++
++MODULE_LICENSE("GPL v2");
++MODULE_DESCRIPTION("DSA tag driver for the IPQ4019 SoC built-in ethernet switch");
++MODULE_AUTHOR("Gabor Juhos <j4g8y7@gmail.com>");
++MODULE_ALIAS_DSA_TAG_DRIVER(DSA_TAG_PROTO_IPQ4019);
++
++module_dsa_tag_driver(ipq4019_sh_tag_dsa_ops);
diff --git a/target/linux/ipq40xx/patches-5.15/702-net-ethernet-qualcomm-add-IPQESS-support.patch b/target/linux/ipq40xx/patches-5.15/702-net-ethernet-qualcomm-add-IPQESS-support.patch
new file mode 100644
index 00000000000000..72e9345118e859
--- /dev/null
+++ b/target/linux/ipq40xx/patches-5.15/702-net-ethernet-qualcomm-add-IPQESS-support.patch
@@ -0,0 +1,43 @@
+From 4f488235f498db43f2412116dea6e02c7fb20216 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Mon, 1 Nov 2021 12:36:51 +0100
+Subject: [PATCH] net: ethernet: qualcomm: add IPQESS support
+
+Allow compiling the IPQESS driver that supports the
+Qualcomm IPQ40xx SoC built-in ethernet controller.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+---
+ drivers/net/ethernet/qualcomm/Kconfig  | 11 +++++++++++
+ drivers/net/ethernet/qualcomm/Makefile |  1 +
+ 2 files changed, 12 insertions(+)
+
+--- a/drivers/net/ethernet/qualcomm/Kconfig
++++ b/drivers/net/ethernet/qualcomm/Kconfig
+@@ -60,6 +60,17 @@ config QCOM_EMAC
+ 	  low power, Receive-Side Scaling (RSS), and IEEE 1588-2008
+ 	  Precision Clock Synchronization Protocol.
+ 
++config QCOM_IPQ4019_ESS_EDMA
++	tristate "Qualcomm Atheros IPQ4019 ESS EDMA support"
++	depends on OF
++	select PHYLINK
++	help
++	  This driver supports the Qualcomm Atheros IPQ40xx built-in
++	  ESS EDMA ethernet controller.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called ipqess.
++
+ source "drivers/net/ethernet/qualcomm/rmnet/Kconfig"
+ 
+ endif # NET_VENDOR_QUALCOMM
+--- a/drivers/net/ethernet/qualcomm/Makefile
++++ b/drivers/net/ethernet/qualcomm/Makefile
+@@ -10,5 +10,6 @@ obj-$(CONFIG_QCA7000_UART) += qcauart.o
+ qcauart-objs := qca_uart.o
+ 
+ obj-y += emac/
++obj-y += ipqess/
+ 
+ obj-$(CONFIG_RMNET) += rmnet/
diff --git a/target/linux/ipq40xx/patches-5.15/703-arm-dts-ipq4019-add-ethernet-controller-DT-node.patch b/target/linux/ipq40xx/patches-5.15/703-arm-dts-ipq4019-add-ethernet-controller-DT-node.patch
new file mode 100644
index 00000000000000..68fb4eb4ceeb84
--- /dev/null
+++ b/target/linux/ipq40xx/patches-5.15/703-arm-dts-ipq4019-add-ethernet-controller-DT-node.patch
@@ -0,0 +1,81 @@
+From 44327d7098d4f32c24ec8c528e5aff6e030956bc Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Wed, 20 Oct 2021 13:21:45 +0200
+Subject: [PATCH] arm: dts: ipq4019: add ethernet controller DT node
+
+Since IPQ40xx SoC built-in ethernet controller now has a driver,
+add its DT node so it can be used.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 48 +++++++++++++++++++++++++++++
+ 1 file changed, 48 insertions(+)
+
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -38,6 +38,7 @@
+ 		spi1 = &blsp1_spi2;
+ 		i2c0 = &blsp1_i2c3;
+ 		i2c1 = &blsp1_i2c4;
++		ethernet0 = &gmac;
+ 	};
+ 
+ 	cpus {
+@@ -589,6 +590,57 @@
+ 			status = "disabled";
+ 		};
+ 
++		gmac: ethernet@c080000 {
++			compatible = "qcom,ipq4019-ess-edma";
++			reg = <0xc080000 0x8000>;
++			resets = <&gcc ESS_RESET>;
++			reset-names = "ess_rst";
++			clocks = <&gcc GCC_ESS_CLK>;
++			clock-names = "ess_clk";
++			interrupts = <GIC_SPI  65 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI  66 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI  67 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI  68 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI  69 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI  70 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI  71 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI  72 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI  73 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI  74 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI  75 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI  76 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI  77 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI  78 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI  79 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI  80 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 240 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 241 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 242 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 243 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 244 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 245 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 246 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 247 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 248 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 249 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 250 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 251 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 252 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 253 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 254 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 255 IRQ_TYPE_EDGE_RISING>;
++
++			status = "disabled";
++
++			phy-mode = "internal";
++			fixed-link {
++				speed = <1000>;
++				full-duplex;
++				pause;
++				asym-pause;
++			};
++		};
++
+ 		mdio: mdio@90000 {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
diff --git a/target/linux/ipq40xx/patches-5.15/704-net-phy-define-PSGMII-PHY-interface-mode.patch b/target/linux/ipq40xx/patches-5.15/704-net-phy-define-PSGMII-PHY-interface-mode.patch
new file mode 100644
index 00000000000000..7fbf38a7e34f31
--- /dev/null
+++ b/target/linux/ipq40xx/patches-5.15/704-net-phy-define-PSGMII-PHY-interface-mode.patch
@@ -0,0 +1,69 @@
+From 157ac9f52fd9b9a22cf12f7755a905fb34ef72f7 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <j4g8y7@gmail.com>
+Date: Fri, 25 Dec 2020 08:02:47 +0100
+Subject: [PATCH] net: phy: define PSGMII PHY interface mode
+
+The PSGMII interface is similar to QSGMII. The main difference
+is that the PSGMII interface combines five SGMII lines into a
+single link while in QSGMII only four lines are combined.
+
+Similarly to the QSGMII, this interface mode might also needs
+special handling within the MAC driver.
+
+Add definitions for the PHY layer to allow to express this type
+of connection between the MAC and PHY.
+
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+---
+ Documentation/devicetree/bindings/net/ethernet-controller.yaml | 1 +
+ drivers/net/phy/phylink.c                                      | 2 ++
+ include/linux/phy.h                                            | 3 +++
+ 3 files changed, 6 insertions(+)
+
+--- a/Documentation/devicetree/bindings/net/ethernet-controller.yaml
++++ b/Documentation/devicetree/bindings/net/ethernet-controller.yaml
+@@ -64,6 +64,7 @@ properties:
+       - mii
+       - gmii
+       - sgmii
++      - psgmii
+       - qsgmii
+       - tbi
+       - rev-mii
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -366,6 +366,7 @@ void phylink_get_linkmodes(unsigned long
+ 	case PHY_INTERFACE_MODE_RGMII_RXID:
+ 	case PHY_INTERFACE_MODE_RGMII_ID:
+ 	case PHY_INTERFACE_MODE_RGMII:
++	case PHY_INTERFACE_MODE_PSGMII:
+ 	case PHY_INTERFACE_MODE_QSGMII:
+ 	case PHY_INTERFACE_MODE_SGMII:
+ 	case PHY_INTERFACE_MODE_GMII:
+@@ -629,6 +630,7 @@ static int phylink_parse_mode(struct phy
+ 
+ 		switch (pl->link_config.interface) {
+ 		case PHY_INTERFACE_MODE_SGMII:
++		case PHY_INTERFACE_MODE_PSGMII:
+ 		case PHY_INTERFACE_MODE_QSGMII:
+ 			phylink_set(pl->supported, 10baseT_Half);
+ 			phylink_set(pl->supported, 10baseT_Full);
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -139,6 +139,7 @@ typedef enum {
+ 	PHY_INTERFACE_MODE_XGMII,
+ 	PHY_INTERFACE_MODE_XLGMII,
+ 	PHY_INTERFACE_MODE_MOCA,
++	PHY_INTERFACE_MODE_PSGMII,
+ 	PHY_INTERFACE_MODE_QSGMII,
+ 	PHY_INTERFACE_MODE_TRGMII,
+ 	PHY_INTERFACE_MODE_100BASEX,
+@@ -244,6 +245,8 @@ static inline const char *phy_modes(phy_
+ 		return "xlgmii";
+ 	case PHY_INTERFACE_MODE_MOCA:
+ 		return "moca";
++	case PHY_INTERFACE_MODE_PSGMII:
++		return "psgmii";
+ 	case PHY_INTERFACE_MODE_QSGMII:
+ 		return "qsgmii";
+ 	case PHY_INTERFACE_MODE_TRGMII:
diff --git a/target/linux/ipq40xx/patches-5.15/705-net-dsa-add-Qualcomm-IPQ4019-built-in-switch-support.patch b/target/linux/ipq40xx/patches-5.15/705-net-dsa-add-Qualcomm-IPQ4019-built-in-switch-support.patch
new file mode 100644
index 00000000000000..13b169e576c479
--- /dev/null
+++ b/target/linux/ipq40xx/patches-5.15/705-net-dsa-add-Qualcomm-IPQ4019-built-in-switch-support.patch
@@ -0,0 +1,57 @@
+From b5f71652b85a85ea53162e9e2b760b84fd0d254f Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Mon, 1 Nov 2021 18:10:28 +0100
+Subject: [PATCH] net: dsa: add Qualcomm IPQ4019 built-in switch support
+
+Qualcomm IPQ40xx SoC-s have a variant of QCA8337N switch built-in.
+
+It shares most of the stuff with its external counterpart, however it is
+modified for the SoC.
+Namely, it doesn't have second CPU port (Port 6), so it has 6 ports
+instead of 7.
+It also has no built-in PHY-s but rather requires external PSGMII based
+companion PHY-s (QCA8072 and QCA8075) for which it first needs to carry
+out calibration before using them.
+PSGMII has a SoC built-in PHY that is used to connect to the PHY-s which
+unfortunately requires some magic values as the datasheet doesnt document
+the bits that are being set or the register at all.
+
+Since its built-in it is MMIO like other peripherals and doesn't have its
+own MDIO bus but depends on the SoC provided one.
+
+CPU connection is at Port 0 and it uses some kind of a internal connection
+and no traditional RGMII/SGMII.
+It also doesn't use in-band tagging like other qca8k switches so a shinfo
+based tagger is used.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+---
+ drivers/net/dsa/qca/Kconfig  | 9 +++++++++
+ drivers/net/dsa/qca/Makefile | 1 +
+ 2 files changed, 10 insertions(+)
+
+--- a/drivers/net/dsa/qca/Kconfig
++++ b/drivers/net/dsa/qca/Kconfig
+@@ -23,3 +23,13 @@ config NET_DSA_QCA8K_LEDS_SUPPORT
+ 	help
+ 	  This enabled support for LEDs present on the Qualcomm Atheros
+ 	  QCA8K Ethernet switch chips.
++
++config NET_DSA_QCA8K_IPQ4019
++	tristate "Qualcomm Atheros IPQ4019 built-in Ethernet switch support"
++	depends on HAS_IOMEM && NET_DSA
++	select NET_DSA_TAG_IPQ4019
++	select REGMAP
++	help
++	  This enables support for the Qualcomm Atheros IPQ4019 SoC built-in
++	  Ethernet switch.
++
+--- a/drivers/net/dsa/qca/Makefile
++++ b/drivers/net/dsa/qca/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ obj-$(CONFIG_NET_DSA_AR9331)	+= ar9331.o
++obj-$(CONFIG_NET_DSA_QCA8K_IPQ4019)	+= qca8k-ipq4019.o
+ obj-$(CONFIG_NET_DSA_QCA8K)	+= qca8k.o
+ qca8k-y 			+= qca8k-common.o qca8k-8xxx.o
+ ifdef CONFIG_NET_DSA_QCA8K_LEDS_SUPPORT
diff --git a/target/linux/ipq40xx/patches-5.15/706-arm-dts-ipq4019-add-switch-node.patch b/target/linux/ipq40xx/patches-5.15/706-arm-dts-ipq4019-add-switch-node.patch
new file mode 100644
index 00000000000000..a231c7331bfda8
--- /dev/null
+++ b/target/linux/ipq40xx/patches-5.15/706-arm-dts-ipq4019-add-switch-node.patch
@@ -0,0 +1,98 @@
+From ebb62523990a27b3a25e422fa575619f7f725a20 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Mon, 1 Nov 2021 18:15:04 +0100
+Subject: [PATCH] arm: dts: ipq4019: add switch node
+
+Since the built-in IPQ40xx switch now has a driver, add the required node
+for it to work.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 78 +++++++++++++++++++++++++++++
+ 1 file changed, 78 insertions(+)
+
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -590,6 +590,82 @@
+ 			status = "disabled";
+ 		};
+ 
++		switch: switch@c000000 {
++			compatible = "qca,ipq4019-qca8337n";
++			reg = <0xc000000 0x80000>, <0x98000 0x800>;
++			reg-names = "base", "psgmii_phy";
++			resets = <&gcc ESS_PSGMII_ARES>;
++			reset-names = "psgmii_rst";
++			mdio = <&mdio>;
++			psgmii-ethphy = <&psgmiiphy>;
++
++			status = "disabled";
++
++			ports {
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				port@0 { /* MAC0 */
++					reg = <0>;
++					label = "cpu";
++					ethernet = <&gmac>;
++					phy-mode = "internal";
++
++					fixed-link {
++						speed = <1000>;
++						full-duplex;
++						pause;
++						asym-pause;
++					};
++				};
++
++				swport1: port@1 { /* MAC1 */
++					reg = <1>;
++					label = "lan1";
++					phy-handle = <&ethphy0>;
++					phy-mode = "psgmii";
++
++					status = "disabled";
++				};
++
++				swport2: port@2 { /* MAC2 */
++					reg = <2>;
++					label = "lan2";
++					phy-handle = <&ethphy1>;
++					phy-mode = "psgmii";
++
++					status = "disabled";
++				};
++
++				swport3: port@3 { /* MAC3 */
++					reg = <3>;
++					label = "lan3";
++					phy-handle = <&ethphy2>;
++					phy-mode = "psgmii";
++
++					status = "disabled";
++				};
++
++				swport4: port@4 { /* MAC4 */
++					reg = <4>;
++					label = "lan4";
++					phy-handle = <&ethphy3>;
++					phy-mode = "psgmii";
++
++					status = "disabled";
++				};
++
++				swport5: port@5 { /* MAC5 */
++					reg = <5>;
++					label = "wan";
++					phy-handle = <&ethphy4>;
++					phy-mode = "psgmii";
++
++					status = "disabled";
++				};
++			};
++		};
++
+ 		gmac: ethernet@c080000 {
+ 			compatible = "qcom,ipq4019-ess-edma";
+ 			reg = <0xc080000 0x8000>;
diff --git a/target/linux/ipq40xx/patches-5.15/707-dt-bindings-net-add-QCA807x-PHY.patch b/target/linux/ipq40xx/patches-5.15/707-dt-bindings-net-add-QCA807x-PHY.patch
new file mode 100644
index 00000000000000..dfb8d692abe8a0
--- /dev/null
+++ b/target/linux/ipq40xx/patches-5.15/707-dt-bindings-net-add-QCA807x-PHY.patch
@@ -0,0 +1,61 @@
+From c66863c1ba8995b61e6d727d78a241c734f5bb57 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Thu, 1 Oct 2020 15:05:35 +0200
+Subject: [PATCH] dt-bindings: net: add QCA807x PHY
+
+Add DT bindings for Qualcomm QCA807x PHY series.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+---
+ include/dt-bindings/net/qcom-qca807x.h | 45 ++++++++++++++++++++++++++
+ 1 file changed, 45 insertions(+)
+ create mode 100644 include/dt-bindings/net/qcom-qca807x.h
+
+--- /dev/null
++++ b/include/dt-bindings/net/qcom-qca807x.h
+@@ -0,0 +1,45 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++/*
++ * Device Tree constants for the Qualcomm QCA807X PHYs
++ */
++
++#ifndef _DT_BINDINGS_QCOM_QCA807X_H
++#define _DT_BINDINGS_QCOM_QCA807X_H
++
++#define PSGMII_QSGMII_TX_DRIVER_140MV	0
++#define PSGMII_QSGMII_TX_DRIVER_160MV	1
++#define PSGMII_QSGMII_TX_DRIVER_180MV	2
++#define PSGMII_QSGMII_TX_DRIVER_200MV	3
++#define PSGMII_QSGMII_TX_DRIVER_220MV	4
++#define PSGMII_QSGMII_TX_DRIVER_240MV	5
++#define PSGMII_QSGMII_TX_DRIVER_260MV	6
++#define PSGMII_QSGMII_TX_DRIVER_280MV	7
++#define PSGMII_QSGMII_TX_DRIVER_300MV	8
++#define PSGMII_QSGMII_TX_DRIVER_320MV	9
++#define PSGMII_QSGMII_TX_DRIVER_400MV	10
++#define PSGMII_QSGMII_TX_DRIVER_500MV	11
++/* Default value */
++#define PSGMII_QSGMII_TX_DRIVER_600MV	12
++
++/* Full amplitude, full bias current */
++#define QCA807X_CONTROL_DAC_FULL_VOLT_BIAS		0
++/* Amplitude follow DSP (amplitude is adjusted based on cable length), half bias current */
++#define QCA807X_CONTROL_DAC_DSP_VOLT_HALF_BIAS		1
++/* Full amplitude, bias current follow DSP (bias current is adjusted based on cable length) */
++#define QCA807X_CONTROL_DAC_FULL_VOLT_DSP_BIAS		2
++/* Both amplitude and bias current follow DSP */
++#define QCA807X_CONTROL_DAC_DSP_VOLT_BIAS		3
++/* Full amplitude, half bias current */
++#define QCA807X_CONTROL_DAC_FULL_VOLT_HALF_BIAS		4
++/* Amplitude follow DSP setting; 1/4 bias current when cable<10m,
++ * otherwise half bias current
++ */
++#define QCA807X_CONTROL_DAC_DSP_VOLT_QUARTER_BIAS	5
++/* Full amplitude; same bias current setting with “010” and “011”,
++ * but half more bias is reduced when cable <10m
++ */
++#define QCA807X_CONTROL_DAC_FULL_VOLT_HALF_BIAS_SHORT	6
++/* Amplitude follow DSP; same bias current setting with “110”, default value */
++#define QCA807X_CONTROL_DAC_DSP_VOLT_HALF_BIAS_SHORT	7
++
++#endif
diff --git a/target/linux/ipq40xx/patches-5.15/708-net-phy-Add-Qualcom-QCA807x-driver.patch b/target/linux/ipq40xx/patches-5.15/708-net-phy-Add-Qualcom-QCA807x-driver.patch
new file mode 100644
index 00000000000000..6a92a103d644ba
--- /dev/null
+++ b/target/linux/ipq40xx/patches-5.15/708-net-phy-Add-Qualcom-QCA807x-driver.patch
@@ -0,0 +1,50 @@
+From f825cdc8bfde7616a14e2163f16303a8973031d2 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Wed, 7 Oct 2020 17:38:48 +0200
+Subject: [PATCH] net: phy: Add Qualcom QCA807x driver
+
+This adds driver for the Qualcomm QCA8072 and QCA8075 PHY-s.
+
+They are 2 or 5 port IEEE 802.3 clause 22 compliant 10BASE-Te, 100BASE-TX and 1000BASE-T PHY-s.
+
+They feature 2 SerDes, one for PSGMII or QSGMII connection with MAC, while second one is SGMII for connection to MAC or fiber.
+
+Both models have a combo port that supports 1000BASE-X and 100BASE-FX fiber.
+
+Each PHY inside of QCA807x series has 4 digitally controlled output only pins that natively drive LED-s.
+But some vendors used these to driver generic LED-s controlled by userspace,
+so lets enable registering each PHY as GPIO controller and add driver for it.
+
+These are commonly used in Qualcomm IPQ40xx, IPQ60xx and IPQ807x boards.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+---
+ drivers/net/phy/Kconfig  | 6 ++++++
+ drivers/net/phy/Makefile | 1 +
+ 2 files changed, 7 insertions(+)
+
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -347,6 +347,12 @@ config AT803X_PHY
+ 	  Currently supports the AR8030, AR8031, AR8033, AR8035 and internal
+ 	  QCA8337(Internal qca8k PHY) model
+ 
++config QCA807X_PHY
++	tristate "Qualcomm QCA807X PHYs"
++	depends on OF_MDIO
++	help
++	  Currently supports the QCA8072 and QCA8075 models.
++
+ config QSEMI_PHY
+ 	tristate "Quality Semiconductor PHYs"
+ 	help
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -92,6 +92,7 @@ obj-$(CONFIG_NATIONAL_PHY)	+= national.o
+ obj-$(CONFIG_NXP_C45_TJA11XX_PHY)	+= nxp-c45-tja11xx.o
+ obj-$(CONFIG_NXP_TJA11XX_PHY)	+= nxp-tja11xx.o
+ obj-$(CONFIG_QSEMI_PHY)		+= qsemi.o
++obj-$(CONFIG_QCA807X_PHY)		+= qca807x.o
+ obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
+ obj-$(CONFIG_RENESAS_PHY)	+= uPD60620.o
+ obj-$(CONFIG_ROCKCHIP_PHY)	+= rockchip.o
diff --git a/target/linux/ipq40xx/patches-5.15/709-arm-dts-ipq4019-QCA807x-properties.patch b/target/linux/ipq40xx/patches-5.15/709-arm-dts-ipq4019-QCA807x-properties.patch
new file mode 100644
index 00000000000000..cc4b44b393a92a
--- /dev/null
+++ b/target/linux/ipq40xx/patches-5.15/709-arm-dts-ipq4019-QCA807x-properties.patch
@@ -0,0 +1,61 @@
+From e0fa88eaa3c176b71e563da68949ac2ab45aaa61 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Fri, 2 Oct 2020 10:43:26 +0200
+Subject: [PATCH] arm: dts: ipq4019: QCA807x properties
+
+This adds necessary DT properties for QCA807x PHY-s to IPQ4019 DTSI.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -8,6 +8,7 @@
+ #include <dt-bindings/clock/qcom,gcc-ipq4019.h>
+ #include <dt-bindings/interrupt-controller/arm-gic.h>
+ #include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/net/qcom-qca807x.h>
+ 
+ / {
+ 	#address-cells = <1>;
+@@ -726,22 +727,38 @@
+ 
+ 			ethphy0: ethernet-phy@0 {
+ 				reg = <0>;
++
++				qcom,control-dac = <QCA807X_CONTROL_DAC_DSP_VOLT_QUARTER_BIAS>;
+ 			};
+ 
+ 			ethphy1: ethernet-phy@1 {
+ 				reg = <1>;
++
++				qcom,control-dac = <QCA807X_CONTROL_DAC_DSP_VOLT_QUARTER_BIAS>;
+ 			};
+ 
+ 			ethphy2: ethernet-phy@2 {
+ 				reg = <2>;
++
++				qcom,control-dac = <QCA807X_CONTROL_DAC_DSP_VOLT_QUARTER_BIAS>;
+ 			};
+ 
+ 			ethphy3: ethernet-phy@3 {
+ 				reg = <3>;
++
++				qcom,control-dac = <QCA807X_CONTROL_DAC_DSP_VOLT_QUARTER_BIAS>;
+ 			};
+ 
+ 			ethphy4: ethernet-phy@4 {
+ 				reg = <4>;
++
++				qcom,control-dac = <QCA807X_CONTROL_DAC_DSP_VOLT_QUARTER_BIAS>;
++			};
++
++			psgmiiphy: psgmii-phy@5 {
++				reg = <5>;
++
++				qcom,tx-driver-strength = <PSGMII_QSGMII_TX_DRIVER_300MV>;
+ 			};
+ 		};
+ 
diff --git a/target/linux/ipq40xx/patches-5.15/850-soc-add-qualcomm-syscon.patch b/target/linux/ipq40xx/patches-5.15/850-soc-add-qualcomm-syscon.patch
index 33ea97dde4a44d..9b44a4c885c408 100644
--- a/target/linux/ipq40xx/patches-5.15/850-soc-add-qualcomm-syscon.patch
+++ b/target/linux/ipq40xx/patches-5.15/850-soc-add-qualcomm-syscon.patch
@@ -12,7 +12,7 @@ Subject: SoC: add qualcomm syscon
  obj-$(CONFIG_QCOM_RPMHPD) += rpmhpd.o
 --- a/drivers/soc/qcom/Kconfig
 +++ b/drivers/soc/qcom/Kconfig
-@@ -191,6 +191,13 @@ config QCOM_SOCINFO
+@@ -192,6 +192,13 @@ config QCOM_SOCINFO
  	 Say yes here to support the Qualcomm socinfo driver, providing
  	 information about the SoC to user space.
  
diff --git a/target/linux/ipq40xx/patches-5.15/900-dts-ipq4019-ap-dk01.1.patch b/target/linux/ipq40xx/patches-5.15/900-dts-ipq4019-ap-dk01.1.patch
index 650bdafe0e632d..145d3f49edbcc7 100644
--- a/target/linux/ipq40xx/patches-5.15/900-dts-ipq4019-ap-dk01.1.patch
+++ b/target/linux/ipq40xx/patches-5.15/900-dts-ipq4019-ap-dk01.1.patch
@@ -56,7 +56,7 @@
  		};
  
  		serial@78af000 {
-@@ -109,5 +128,41 @@
+@@ -109,5 +128,29 @@
  		wifi@a800000 {
  			status = "okay";
  		};
@@ -65,18 +65,6 @@
 +			status = "okay";
 +		};
 +
-+		ess-switch@c000000 {
-+			status = "okay";
-+		};
-+
-+		ess-psgmii@98000 {
-+			status = "okay";
-+		};
-+
-+		edma@c080000 {
-+			status = "okay";
-+		};
-+
 +		usb3_ss_phy: ssphy@9a000 {
 +			status = "okay";
 +		};
diff --git a/target/linux/ipq40xx/patches-5.15/910-Revert-firmware-qcom_scm-Clear-download-bit-during-r.patch b/target/linux/ipq40xx/patches-5.15/910-Revert-firmware-qcom_scm-Clear-download-bit-during-r.patch
new file mode 100644
index 00000000000000..e24895deeca209
--- /dev/null
+++ b/target/linux/ipq40xx/patches-5.15/910-Revert-firmware-qcom_scm-Clear-download-bit-during-r.patch
@@ -0,0 +1,27 @@
+From c87df89a82c17411cd6b98e5afaa1203ee9508dc Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Thu, 18 May 2023 12:16:02 +0200
+Subject: [PATCH] Revert "firmware: qcom_scm: Clear download bit during reboot"
+
+This reverts commit a3ea89b5978dbcd0fa55f675c5a1e04611093709.
+
+It is breaking reboot on IPQ4019 boards, so revert until a proper fix
+is found.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/firmware/qcom_scm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/firmware/qcom_scm.c
++++ b/drivers/firmware/qcom_scm.c
+@@ -1352,7 +1352,8 @@ static int qcom_scm_probe(struct platfor
+ static void qcom_scm_shutdown(struct platform_device *pdev)
+ {
+ 	/* Clean shutdown, disable download mode to allow normal restart */
+-	qcom_scm_set_download_mode(false);
++	if (download_mode)
++		qcom_scm_set_download_mode(false);
+ }
+ 
+ static const struct of_device_id qcom_scm_dt_match[] = {
diff --git a/target/linux/ipq40xx/patches-5.15/998-lantiq-atm-hacks.patch b/target/linux/ipq40xx/patches-5.15/998-lantiq-atm-hacks.patch
new file mode 100644
index 00000000000000..c15a4b3ae3e0b7
--- /dev/null
+++ b/target/linux/ipq40xx/patches-5.15/998-lantiq-atm-hacks.patch
@@ -0,0 +1,43 @@
+From: John Crispin <blogic@openwrt.org>
+Date: Fri, 3 Aug 2012 10:27:25 +0200
+Subject: [PATCH 04/36] MIPS: lantiq: add atm hack
+
+Signed-off-by: John Crispin <blogic@openwrt.org>
+--- a/include/uapi/linux/atm.h
++++ b/include/uapi/linux/atm.h
+@@ -131,8 +131,14 @@
+ #define ATM_ABR		4
+ #define ATM_ANYCLASS	5		/* compatible with everything */
+ 
++#define ATM_VBR_NRT     ATM_VBR
++#define ATM_VBR_RT      6
++#define ATM_UBR_PLUS    7
++#define ATM_GFR         8
++
+ #define ATM_MAX_PCR	-1		/* maximum available PCR */
+ 
++
+ struct atm_trafprm {
+ 	unsigned char	traffic_class;	/* traffic class (ATM_UBR, ...) */
+ 	int		max_pcr;	/* maximum PCR in cells per second */
+@@ -155,6 +161,9 @@ struct atm_trafprm {
+ 	unsigned int adtf      :10;     /* ACR Decrease Time Factor (10-bit) */
+ 	unsigned int cdf       :3;      /* Cutoff Decrease Factor (3-bit) */
+         unsigned int spare     :9;      /* spare bits */ 
++	int		scr;		/* sustained rate in cells per second */
++	int		mbs;		/* maximum burst size (MBS) in cells */
++	int		cdv;		/* Cell delay variation */
+ };
+ 
+ struct atm_qos {
+--- a/net/atm/proc.c
++++ b/net/atm/proc.c
+@@ -141,7 +141,7 @@ static void *vcc_seq_next(struct seq_fil
+ static void pvc_info(struct seq_file *seq, struct atm_vcc *vcc)
+ {
+ 	static const char *const class_name[] = {
+-		"off", "UBR", "CBR", "VBR", "ABR"};
++		"off","UBR","CBR","NTR-VBR","ABR","ANY","RT-VBR","UBR+","GFR"};
+ 	static const char *const aal_name[] = {
+ 		"---",	"1",	"2",	"3/4",	/*  0- 3 */
+ 		"???",	"5",	"???",	"???",	/*  4- 7 */
diff --git a/target/linux/ipq40xx/patches-5.15/999-atm-mpoa-intel-dsl-phy-support.patch b/target/linux/ipq40xx/patches-5.15/999-atm-mpoa-intel-dsl-phy-support.patch
new file mode 100644
index 00000000000000..b774fc39d8cb44
--- /dev/null
+++ b/target/linux/ipq40xx/patches-5.15/999-atm-mpoa-intel-dsl-phy-support.patch
@@ -0,0 +1,137 @@
+From: Subhra Banerjee <subhrax.banerjee@intel.com>
+Date: Fri, 31 Aug 2018 12:01:19 +0530
+Subject: [PATCH] UGW_SW-29163: ATM oam support
+
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -2952,6 +2952,22 @@ char *ppp_dev_name(struct ppp_channel *c
+ 	return name;
+ }
+ 
++/*
++ * Return the PPP device interface pointer
++ */
++struct net_device *ppp_device(struct ppp_channel *chan)
++{
++	struct channel *pch = chan->ppp;
++	struct net_device *dev = NULL;
++
++	if (pch) {
++		read_lock_bh(&pch->upl);
++		if (pch->ppp && pch->ppp->dev)
++			dev = pch->ppp->dev;
++		read_unlock_bh(&pch->upl);
++	}
++	return dev;
++}
+ 
+ /*
+  * Disconnect a channel from the generic layer.
+@@ -3598,6 +3614,7 @@ EXPORT_SYMBOL(ppp_unregister_channel);
+ EXPORT_SYMBOL(ppp_channel_index);
+ EXPORT_SYMBOL(ppp_unit_number);
+ EXPORT_SYMBOL(ppp_dev_name);
++EXPORT_SYMBOL(ppp_device);
+ EXPORT_SYMBOL(ppp_input);
+ EXPORT_SYMBOL(ppp_input_error);
+ EXPORT_SYMBOL(ppp_output_wakeup);
+--- a/include/linux/ppp_channel.h
++++ b/include/linux/ppp_channel.h
+@@ -74,6 +74,9 @@ extern int ppp_unit_number(struct ppp_ch
+ /* Get the device name associated with a channel, or NULL if none */
+ extern char *ppp_dev_name(struct ppp_channel *);
+ 
++/* Get the device pointer associated with a channel, or NULL if none */
++extern struct net_device *ppp_device(struct ppp_channel *);
++
+ /*
+  * SMP locking notes:
+  * The channel code must ensure that when it calls ppp_unregister_channel,
+--- a/net/atm/Kconfig
++++ b/net/atm/Kconfig
+@@ -56,6 +56,12 @@ config ATM_MPOA
+ 	  subnetwork boundaries. These shortcut connections bypass routers
+ 	  enhancing overall network performance.
+ 
++config ATM_MPOA_INTEL_DSL_PHY_SUPPORT
++	bool "Intel DSL Phy MPOA support"
++	depends on ATM && INET && ATM_MPOA!=n
++	help
++	  Add support for Intel DSL Phy ATM MPOA
++
+ config ATM_BR2684
+ 	tristate "RFC1483/2684 Bridged protocols"
+ 	depends on ATM && INET
+--- a/net/atm/br2684.c
++++ b/net/atm/br2684.c
+@@ -596,6 +596,11 @@ static int br2684_regvcc(struct atm_vcc
+ 	atmvcc->push = br2684_push;
+ 	atmvcc->pop = br2684_pop;
+ 	atmvcc->release_cb = br2684_release_cb;
++#if IS_ENABLED(CONFIG_ATM_MPOA_INTEL_DSL_PHY_SUPPORT)
++	if (atm_hook_mpoa_setup) /* IPoA or EoA w/o FCS */
++		atm_hook_mpoa_setup(atmvcc, brdev->payload == p_routed ? 3 : 0,
++			brvcc->encaps == BR2684_ENCAPS_LLC ? 1 : 0, net_dev);
++#endif
+ 	atmvcc->owner = THIS_MODULE;
+ 
+ 	/* initialize netdev carrier state */
+--- a/net/atm/common.c
++++ b/net/atm/common.c
+@@ -137,6 +137,11 @@ static struct proto vcc_proto = {
+ 	.release_cb = vcc_release_cb,
+ };
+ 
++#if IS_ENABLED(CONFIG_ATM_MPOA_INTEL_DSL_PHY_SUPPORT)
++void (*atm_hook_mpoa_setup)(struct atm_vcc *, int, int, struct net_device *) = NULL;
++EXPORT_SYMBOL(atm_hook_mpoa_setup);
++#endif
++
+ int vcc_create(struct net *net, struct socket *sock, int protocol, int family, int kern)
+ {
+ 	struct sock *sk;
+--- a/net/atm/common.h
++++ b/net/atm/common.h
+@@ -53,4 +53,6 @@ int svc_change_qos(struct atm_vcc *vcc,s
+ 
+ void atm_dev_release_vccs(struct atm_dev *dev);
+ 
++extern void (*atm_hook_mpoa_setup)(struct atm_vcc *, int, int, struct net_device *);
++
+ #endif
+--- a/net/atm/mpc.c
++++ b/net/atm/mpc.c
+@@ -31,6 +31,7 @@
+ /* Modular too */
+ #include <linux/module.h>
+ 
++#include "common.h"
+ #include "lec.h"
+ #include "mpc.h"
+ #include "resources.h"
+@@ -645,6 +646,10 @@ static int atm_mpoa_vcc_attach(struct at
+ 	vcc->proto_data = mpc->dev;
+ 	vcc->push = mpc_push;
+ 
++#if IS_ENABLED(CONFIG_ATM_MPOA_INTEL_DSL_PHY_SUPPORT)
++	if (atm_hook_mpoa_setup) /* IPoA, LLC */
++		atm_hook_mpoa_setup(vcc, 3, 1, mpc->dev);
++#endif
+ 	return 0;
+ }
+ 
+--- a/net/atm/pppoatm.c
++++ b/net/atm/pppoatm.c
+@@ -422,6 +422,12 @@ static int pppoatm_assign_vcc(struct atm
+ 	atmvcc->user_back = pvcc;
+ 	atmvcc->push = pppoatm_push;
+ 	atmvcc->pop = pppoatm_pop;
++#if IS_ENABLED(CONFIG_ATM_MPOA_INTEL_DSL_PHY_SUPPORT)
++	if (atm_hook_mpoa_setup) /* PPPoA */
++		atm_hook_mpoa_setup(atmvcc, 2,
++			pvcc->encaps == e_llc ? 1 : 0,
++			ppp_device(&pvcc->chan));
++#endif
+ 	atmvcc->release_cb = pppoatm_release_cb;
+ 	__module_get(THIS_MODULE);
+ 	atmvcc->owner = THIS_MODULE;
diff --git a/target/linux/ipq806x/Makefile b/target/linux/ipq806x/Makefile
index 665a830e348f40..81fda2964db269 100644
--- a/target/linux/ipq806x/Makefile
+++ b/target/linux/ipq806x/Makefile
@@ -5,13 +5,13 @@ include $(TOPDIR)/rules.mk
 ARCH:=arm
 BOARD:=ipq806x
 BOARDNAME:=Qualcomm Atheros IPQ806X
-FEATURES:=squashfs nand fpu ramdisk
+FEATURES:=squashfs fpu ramdisk
 CPU_TYPE:=cortex-a15
 CPU_SUBTYPE:=neon-vfpv4
-SUBTARGETS:=generic
+SUBTARGETS:=generic chromium
 
-KERNEL_PATCHVER:=5.10
-KERNEL_TESTING_PATCHVER:=5.15
+KERNEL_PATCHVER:=5.15
+KERNEL_TESTING_PATCHVER:=6.1
 
 KERNELNAME:=zImage Image dtbs
 
@@ -21,7 +21,7 @@ DEFAULT_PACKAGES += \
 	kmod-ata-ahci kmod-ata-ahci-platform \
 	kmod-usb-ohci kmod-usb2 kmod-usb-ledtrig-usbport \
 	kmod-phy-qcom-ipq806x-usb kmod-usb3 kmod-usb-dwc3-qcom \
-	kmod-ath10k-ct wpad-basic-wolfssl \
+	kmod-ath10k-ct wpad-basic-mbedtls \
 	uboot-envtools
 
 $(eval $(call BuildTarget))
diff --git a/target/linux/ipq806x/base-files/etc/board.d/01_leds b/target/linux/ipq806x/base-files/etc/board.d/01_leds
index 2b259b90361465..d4d40bd6463241 100644
--- a/target/linux/ipq806x/base-files/etc/board.d/01_leds
+++ b/target/linux/ipq806x/base-files/etc/board.d/01_leds
@@ -37,12 +37,21 @@ netgear,d7800 |\
 netgear,r7500 |\
 netgear,r7500v2 |\
 netgear,r7800 |\
+netgear,xr450 |\
 netgear,xr500)
 	ucidef_set_led_usbport "usb1" "USB 1" "white:usb1" "usb1-port1" "usb2-port1"
 	ucidef_set_led_usbport "usb2" "USB 2" "white:usb2" "usb3-port1" "usb4-port1"
 	ucidef_set_led_switch "wan" "WAN" "white:wan" "switch0" "0x20"
 	ucidef_set_led_ide "esata" "eSATA" "white:esata"
 	;;
+nokia,ac400i)
+	ucidef_set_led_wlan "wlan5g" "5G" "green:wlan5g" "wlan0"
+	ucidef_set_led_wlan "wlan2g" "2.4G" "green:wlan2g" "wlan1"
+	ucidef_set_led_netdev "eth1" "ETH1" "green:eth1" "eth0"
+	ucidef_set_led_netdev "eth2" "ETH2" "green:eth2" "eth1"
+	ucidef_set_led_default "ctrl" "CTRL" "green:ctrl" "0"
+	ucidef_set_led_default "pwr" "PWR" "green:power" "1"
+	;;
 tplink,ad7200)
 	ucidef_set_led_usbport "usb1" "USB 1" "blue:usb1" "usb1-port1" "usb2-port1"
 	ucidef_set_led_usbport "usb2" "USB 2" "blue:usb3" "usb3-port1" "usb4-port1"
diff --git a/target/linux/ipq806x/base-files/etc/board.d/02_network b/target/linux/ipq806x/base-files/etc/board.d/02_network
index dbff854731a4d1..70812a1013c9c3 100644
--- a/target/linux/ipq806x/base-files/etc/board.d/02_network
+++ b/target/linux/ipq806x/base-files/etc/board.d/02_network
@@ -59,6 +59,7 @@ nec,wg2600hp3)
 		"2:lan" "3:lan" "4:lan" "5:lan" "0@eth1" "1:wan" "6@eth0"
 	;;
 netgear,r7800 |\
+netgear,xr450 |\
 netgear,xr500 |\
 tplink,c2600 |\
 tplink,vr2600v)
@@ -79,6 +80,13 @@ tplink,ad7200)
 	ucidef_add_switch "switch0" \
 		"2:lan:1" "3:lan:2" "4:lan:3" "5:lan:4" "6@eth1" "1:wan" "0@eth0"
 	;;
+asus,onhub |\
+tplink,onhub)
+	ucidef_set_interfaces_lan_wan "eth1" "eth0"
+	ucidef_add_switch "switch0" \
+		"1:lan" "6@eth1" "2:wan" "0@eth0"
+	;;
+nokia,ac400i |\
 ubnt,unifi-ac-hd)
 	ucidef_set_interface_lan "eth0 eth1"
 	;;
diff --git a/target/linux/ipq806x/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ipq806x/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
index 398ddf9a290a36..4c5019cf5bd247 100644
--- a/target/linux/ipq806x/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+++ b/target/linux/ipq806x/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
@@ -6,9 +6,32 @@
 
 board=$(board_name)
 
+dt_base64_extract() {
+	local target_dir="/sys$DEVPATH"
+	local source="$target_dir/../../of_node/qcom,ath10k-calibration-data-base64"
+
+	[ -e "$source" ] || caldata_die "cannot find base64 calibration data: $source"
+	[ -d "$target_dir" ] || \
+		caldata_die "no sysfs dir to write: $target"
+
+	echo 1 > "$target_dir/loading"
+	base64decode.uc "$source" > "$target_dir/data"
+	if [ $? != 0 ]; then
+		echo 1 > "$target_dir/loading"
+		caldata_die \
+			"failed to write calibration data to $target_dir/data"
+	else
+		echo 0 > "$target_dir/loading"
+	fi
+}
+
 case "$FIRMWARE" in
 "ath10k/cal-pci-0000:01:00.0.bin")
 	case "$board" in
+	asus,onhub |\
+	tplink,onhub)
+		dt_base64_extract
+		;;
 	meraki,mr52)
 		CI_UBIPART=art
 		caldata_extract_ubi "ART" 0x1000 0x844
@@ -29,12 +52,24 @@ case "$FIRMWARE" in
 		CI_UBIPART=art
 		caldata_extract_ubi "ART" 0x1000 0x2f20
 		;;
+	nokia,ac400i)
+		caldata_extract "0:art" 0x1000 0x2f20
+		ath10k_patch_mac $(macaddr_add $(mtd_get_mac_ascii 0:appsblenv ethaddr) +2)
+		;;
 	zyxel,nbg6817)
 		caldata_extract "0:art" 0x1000 0x2f20
 		ath10k_patch_mac $(macaddr_add $(mtd_get_mac_ascii 0:appsblenv ethaddr) 1)
 		;;
 	esac
 	;;
+"ath10k/cal-pci-0001:01:00.0.bin")
+	case "$board" in
+	asus,onhub |\
+	tplink,onhub)
+		dt_base64_extract
+		;;
+	esac
+	;;
 "ath10k/pre-cal-pci-0001:01:00.0.bin")
 	case $board in
 	asrock,g10)
@@ -53,6 +88,10 @@ case "$FIRMWARE" in
 		CI_UBIPART=art
 		caldata_extract_ubi "ART" 0x5000 0x2f20
 		;;
+	nokia,ac400i)
+		caldata_extract "0:art" 0x5000 0x2f20
+		ath10k_patch_mac $(macaddr_add $(mtd_get_mac_ascii 0:appsblenv ethaddr) +3)
+		;;
 	zyxel,nbg6817)
 		caldata_extract "0:art" 0x5000 0x2f20
 		ath10k_patch_mac $(mtd_get_mac_ascii 0:appsblenv ethaddr)
@@ -61,6 +100,10 @@ case "$FIRMWARE" in
 	;;
 "ath10k/cal-pci-0002:01:00.0.bin")
 	case "$board" in
+	asus,onhub |\
+	tplink,onhub)
+		dt_base64_extract
+		;;
 	meraki,mr42)
 		CI_UBIPART=art
 		caldata_extract_ubi "ART" 0x9000 0x844
diff --git a/target/linux/ipq806x/base-files/lib/upgrade/linksys.sh b/target/linux/ipq806x/base-files/lib/upgrade/linksys.sh
index 1feffc7aa2420b..21d22c6f1bc40a 100644
--- a/target/linux/ipq806x/base-files/lib/upgrade/linksys.sh
+++ b/target/linux/ipq806x/base-files/lib/upgrade/linksys.sh
@@ -8,7 +8,7 @@ linksys_get_target_firmware() {
 
 	cur_boot_part=$(/usr/sbin/fw_printenv -n boot_part)
 	if [ -z "${cur_boot_part}" ] ; then
-		mtd_ubi0=$(cat /sys/devices/virtual/ubi/ubi0/mtd_num)
+		mtd_ubi0=$(cat /sys/class/ubi/ubi0/mtd_num)
 		case $(grep -E ^mtd${mtd_ubi0}: /proc/mtd | cut -d '"' -f 2) in
 		kernel1|rootfs1)
 			cur_boot_part=1
@@ -94,7 +94,12 @@ platform_do_upgrade_linksys() {
 
 
 		# complete std upgrade
-		nand_upgrade_tar "$1"
+		if nand_upgrade_tar "$1" ; then
+			nand_do_upgrade_success
+		else
+			nand_do_upgrade_failed
+		fi
+
 	}
 	[ "$magic_long" = "27051956" ] && {
 		get_image "$1" | mtd write - $part_label
diff --git a/target/linux/ipq806x/base-files/lib/upgrade/platform.sh b/target/linux/ipq806x/base-files/lib/upgrade/platform.sh
index f9e592f4bd8f92..108b0b763077a3 100644
--- a/target/linux/ipq806x/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ipq806x/base-files/lib/upgrade/platform.sh
@@ -17,7 +17,9 @@ platform_do_upgrade() {
 	netgear,r7500 |\
 	netgear,r7500v2 |\
 	netgear,r7800 |\
+	netgear,xr450 |\
 	netgear,xr500 |\
+	nokia,ac400i |\
 	qcom,ipq8064-ap148 |\
 	qcom,ipq8064-ap161)
 		nand_do_upgrade "$1"
@@ -57,6 +59,15 @@ platform_do_upgrade() {
 		MTD_CONFIG_ARGS="-s 0x200000"
 		default_do_upgrade "$1"
 		;;
+	asus,onhub |\
+	tplink,onhub)
+		export_bootdevice
+		export_partdevice CI_ROOTDEV 0
+		CI_KERNPART="kernel"
+		CI_ROOTPART="rootfs"
+		CI_DATAPART="rootfs_data"
+		emmc_do_upgrade "$1"
+		;;
 	tplink,vr2600v)
 		MTD_CONFIG_ARGS="-s 0x200000"
 		default_do_upgrade "$1"
@@ -69,3 +80,13 @@ platform_do_upgrade() {
 		;;
 	esac
 }
+
+platform_copy_config() {
+	case "${board_name}" in
+	asus,onhub |\
+	tplink,onhub)
+		emmc_copy_config
+		;;
+	esac
+	return 0
+}
diff --git a/target/linux/ipq806x/base-files/usr/bin/base64decode.uc b/target/linux/ipq806x/base-files/usr/bin/base64decode.uc
new file mode 100644
index 00000000000000..7dcf30986c045d
--- /dev/null
+++ b/target/linux/ipq806x/base-files/usr/bin/base64decode.uc
@@ -0,0 +1,23 @@
+#!/usr/bin/ucode
+
+import { stdin, open, error } from 'fs';
+
+if (length(ARGV) == 0 && stdin.isatty()) {
+	warn("usage: b64decode [stdin|path]\n");
+	exit(1);
+}
+
+let fp = stdin;
+let source = ARGV[0];
+
+if (source) {
+	fp = open(source);
+	if (!fp) {
+		warn('b64decode: unable to open ${source}: ${error()}\n');
+		exit(1);
+	}
+}
+
+print(b64dec(fp.read("all")));
+fp.close();
+exit(0);
diff --git a/target/linux/ipq806x/chromium/config-default b/target/linux/ipq806x/chromium/config-default
new file mode 100644
index 00000000000000..d7db9f7db35a1e
--- /dev/null
+++ b/target/linux/ipq806x/chromium/config-default
@@ -0,0 +1,13 @@
+CONFIG_BLK_DEV_SD=y
+CONFIG_LEDS_LP5523=y
+CONFIG_LEDS_LP55XX_COMMON=y
+CONFIG_PHY_QCOM_IPQ806X_USB=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+CONFIG_SG_POOL=y
+CONFIG_USB_DWC3=y
+CONFIG_USB_DWC3_HOST=y
+CONFIG_USB_DWC3_QCOM=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_PLATFORM=y
diff --git a/target/linux/ipq806x/chromium/target.mk b/target/linux/ipq806x/chromium/target.mk
new file mode 100644
index 00000000000000..3983a9281a5d20
--- /dev/null
+++ b/target/linux/ipq806x/chromium/target.mk
@@ -0,0 +1,2 @@
+BOARDNAME:=Google Chromium
+FEATURES += emmc boot-part rootfs-part
diff --git a/target/linux/ipq806x/config-5.15 b/target/linux/ipq806x/config-5.15
index 967abbfb08de8e..1f456b2ce9f150 100644
--- a/target/linux/ipq806x/config-5.15
+++ b/target/linux/ipq806x/config-5.15
@@ -32,15 +32,16 @@ CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE=y
 CONFIG_ARM_CPUIDLE=y
 CONFIG_ARM_CPU_SUSPEND=y
 # CONFIG_ARM_CPU_TOPOLOGY is not set
+CONFIG_ARM_CRYPTO=y
 CONFIG_ARM_GIC=y
 CONFIG_ARM_HAS_SG_CHAIN=y
+CONFIG_ARM_IPQ806X_FAB_DEVFREQ=y
+CONFIG_ARM_KRAIT_CACHE_DEVFREQ=y
 CONFIG_ARM_L1_CACHE_SHIFT=6
 CONFIG_ARM_L1_CACHE_SHIFT_6=y
-CONFIG_ARM_MODULE_PLTS=y
 CONFIG_ARM_PATCH_IDIV=y
 CONFIG_ARM_PATCH_PHYS_VIRT=y
 # CONFIG_ARM_QCOM_CPUFREQ_HW is not set
-CONFIG_ARM_QCOM_CPUFREQ_KRAIT=y
 CONFIG_ARM_QCOM_CPUFREQ_NVMEM=y
 CONFIG_ARM_QCOM_SPM_CPUIDLE=y
 # CONFIG_ARM_SMMU is not set
@@ -70,8 +71,8 @@ CONFIG_CPU_COPY_V6=y
 CONFIG_CPU_CP15=y
 CONFIG_CPU_CP15_MMU=y
 CONFIG_CPU_FREQ=y
-CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
-# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
 CONFIG_CPU_FREQ_GOV_ATTR_SET=y
 CONFIG_CPU_FREQ_GOV_COMMON=y
 # CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set
@@ -98,13 +99,11 @@ CONFIG_CRC16=y
 # CONFIG_CRC32_SARWATE is not set
 CONFIG_CRC32_SLICEBY8=y
 CONFIG_CRC8=y
-CONFIG_CRYPTO_BLAKE2S=y
 CONFIG_CRYPTO_DEFLATE=y
 CONFIG_CRYPTO_DEV_QCOM_RNG=y
 CONFIG_CRYPTO_DRBG=y
 CONFIG_CRYPTO_DRBG_HMAC=y
 CONFIG_CRYPTO_DRBG_MENU=y
-CONFIG_CRYPTO_GF128MUL=y
 CONFIG_CRYPTO_HASH_INFO=y
 CONFIG_CRYPTO_HMAC=y
 CONFIG_CRYPTO_HW=y
@@ -112,7 +111,6 @@ CONFIG_CRYPTO_JITTERENTROPY=y
 CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
 CONFIG_CRYPTO_LIB_SHA256=y
 CONFIG_CRYPTO_LZO=y
-CONFIG_CRYPTO_NULL2=y
 CONFIG_CRYPTO_RNG=y
 CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_SHA256=y
@@ -121,7 +119,7 @@ CONFIG_CRYPTO_ZSTD=y
 CONFIG_DCACHE_WORD_ACCESS=y
 CONFIG_DEBUG_GPIO=y
 CONFIG_DEBUG_LL_INCLUDE="mach/debug-macro.S"
-# CONFIG_DEVFREQ_GOV_PASSIVE is not set
+CONFIG_DEVFREQ_GOV_PASSIVE=y
 # CONFIG_DEVFREQ_GOV_PERFORMANCE is not set
 # CONFIG_DEVFREQ_GOV_POWERSAVE is not set
 # CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND is not set
@@ -138,9 +136,9 @@ CONFIG_DT_IDLE_STATES=y
 # CONFIG_DWMAC_GENERIC is not set
 CONFIG_DWMAC_IPQ806X=y
 # CONFIG_DWMAC_QCOM_ETHQOS is not set
-CONFIG_DYNAMIC_DEBUG=y
 CONFIG_EDAC_ATOMIC_SCRUB=y
 CONFIG_EDAC_SUPPORT=y
+CONFIG_ETHERNET_PACKET_MANGLE=y
 CONFIG_FIXED_PHY=y
 CONFIG_FIX_EARLYCON_MEM=y
 CONFIG_FWNODE_MDIO=y
@@ -150,10 +148,12 @@ CONFIG_GENERIC_BUG=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
 CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
 CONFIG_GENERIC_EARLY_IOREMAP=y
 CONFIG_GENERIC_GETTIMEOFDAY=y
 CONFIG_GENERIC_IDLE_POLL_SETUP=y
 CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
 CONFIG_GENERIC_IRQ_MULTI_HANDLER=y
 CONFIG_GENERIC_IRQ_SHOW=y
 CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
@@ -171,6 +171,7 @@ CONFIG_GENERIC_STRNCPY_FROM_USER=y
 CONFIG_GENERIC_STRNLEN_USER=y
 CONFIG_GENERIC_TIME_VSYSCALL=y
 CONFIG_GENERIC_VDSO_32=y
+CONFIG_GLOB=y
 CONFIG_GPIOLIB_IRQCHIP=y
 CONFIG_GPIO_CDEV=y
 CONFIG_GRO_CELLS=y
@@ -183,6 +184,7 @@ CONFIG_HAS_IOPORT_MAP=y
 CONFIG_HAVE_SMP=y
 CONFIG_HIGHMEM=y
 # CONFIG_HIGHPTE is not set
+CONFIG_HOTPLUG_CPU=y
 CONFIG_HWMON=y
 CONFIG_HWSPINLOCK=y
 CONFIG_HWSPINLOCK_QCOM=y
@@ -212,12 +214,12 @@ CONFIG_IRQ_FASTEOI_HIERARCHY_HANDLERS=y
 CONFIG_IRQ_FORCED_THREADING=y
 CONFIG_IRQ_WORK=y
 CONFIG_KMAP_LOCAL=y
+CONFIG_KMAP_LOCAL_NON_LINEAR_PTE_ARRAY=y
 CONFIG_KPSS_XCC=y
 CONFIG_KRAITCC=y
 CONFIG_KRAIT_CLOCKS=y
 CONFIG_KRAIT_L2_ACCESSORS=y
 CONFIG_LIBFDT=y
-CONFIG_LLD_VERSION=0
 CONFIG_LOCK_DEBUGGING_SUPPORT=y
 CONFIG_LOCK_SPIN_ON_OWNER=y
 CONFIG_LZO_COMPRESS=y
@@ -285,6 +287,7 @@ CONFIG_NEON=y
 CONFIG_NET_DEVLINK=y
 CONFIG_NET_DSA=y
 CONFIG_NET_DSA_QCA8K=y
+CONFIG_NET_DSA_QCA8K_LEDS_SUPPORT=y
 CONFIG_NET_DSA_TAG_QCA=y
 CONFIG_NET_FLOW_LIMIT=y
 CONFIG_NET_PTP_CLASSIFY=y
@@ -296,7 +299,9 @@ CONFIG_NO_HZ_COMMON=y
 CONFIG_NO_HZ_IDLE=y
 CONFIG_NR_CPUS=2
 CONFIG_NVMEM=y
+CONFIG_NVMEM_QCOM_QFPROM=y
 # CONFIG_NVMEM_SPMI_SDAM is not set
+CONFIG_NVMEM_SYSFS=y
 CONFIG_OF=y
 CONFIG_OF_ADDRESS=y
 CONFIG_OF_EARLY_FLATTREE=y
@@ -305,7 +310,6 @@ CONFIG_OF_GPIO=y
 CONFIG_OF_IRQ=y
 CONFIG_OF_KOBJ=y
 CONFIG_OF_MDIO=y
-CONFIG_OF_NET=y
 CONFIG_OLD_SIGACTION=y
 CONFIG_OLD_SIGSUSPEND3=y
 CONFIG_PADATA=y
@@ -387,7 +391,6 @@ CONFIG_QCOM_HFPLL=y
 # CONFIG_QCOM_LLCC is not set
 # CONFIG_QCOM_OCMEM is not set
 # CONFIG_QCOM_PDC is not set
-CONFIG_QCOM_QFPROM=y
 # CONFIG_QCOM_RMTFS_MEM is not set
 CONFIG_QCOM_RPMCC=y
 # CONFIG_QCOM_RPMH is not set
@@ -395,7 +398,7 @@ CONFIG_QCOM_SCM=y
 # CONFIG_QCOM_SCM_DOWNLOAD_MODE_DEFAULT is not set
 CONFIG_QCOM_SMEM=y
 # CONFIG_QCOM_SMSM is not set
-# CONFIG_QCOM_SOCINFO is not set
+CONFIG_QCOM_SOCINFO=y
 CONFIG_QCOM_TCSR=y
 CONFIG_QCOM_TSENS=y
 CONFIG_QCOM_WDT=y
@@ -450,6 +453,7 @@ CONFIG_SMP_ON_UP=y
 # CONFIG_SM_VIDEOCC_8150 is not set
 # CONFIG_SM_VIDEOCC_8250 is not set
 CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOC_BUS=y
 CONFIG_SPARSE_IRQ=y
 CONFIG_SPI=y
 CONFIG_SPI_MASTER=y
diff --git a/target/linux/ipq806x/config-6.1 b/target/linux/ipq806x/config-6.1
new file mode 100644
index 00000000000000..559de1cf48a1f3
--- /dev/null
+++ b/target/linux/ipq806x/config-6.1
@@ -0,0 +1,531 @@
+CONFIG_ALIGNMENT_TRAP=y
+# CONFIG_APQ_GCC_8084 is not set
+# CONFIG_APQ_MMCC_8084 is not set
+CONFIG_AR8216_PHY=y
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_FORCE_MAX_ORDER=11
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+# CONFIG_ARCH_IPQ40XX is not set
+CONFIG_ARCH_IPQ806X=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+# CONFIG_ARCH_MDM9615 is not set
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+# CONFIG_ARCH_MSM8909 is not set
+# CONFIG_ARCH_MSM8916 is not set
+CONFIG_ARCH_MSM8960=y
+CONFIG_ARCH_MSM8974=y
+CONFIG_ARCH_MSM8X60=y
+CONFIG_ARCH_MULTIPLATFORM=y
+CONFIG_ARCH_MULTI_V6_V7=y
+CONFIG_ARCH_MULTI_V7=y
+CONFIG_ARCH_NR_GPIO=0
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX=y
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT=y
+CONFIG_ARCH_QCOM=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARM=y
+CONFIG_ARM_AMBA=y
+CONFIG_ARM_APPENDED_DTB=y
+CONFIG_ARM_ARCH_TIMER=y
+CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+CONFIG_ARM_ATAG_DTB_COMPAT=y
+# CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_FROM_BOOTLOADER is not set
+CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE=y
+CONFIG_ARM_CPUIDLE=y
+CONFIG_ARM_CPU_SUSPEND=y
+# CONFIG_ARM_CPU_TOPOLOGY is not set
+CONFIG_ARM_CRYPTO=y
+CONFIG_ARM_GIC=y
+CONFIG_ARM_HAS_SG_CHAIN=y
+CONFIG_ARM_IPQ806X_FAB_DEVFREQ=y
+CONFIG_ARM_KRAIT_CACHE_DEVFREQ=y
+CONFIG_ARM_L1_CACHE_SHIFT=6
+CONFIG_ARM_L1_CACHE_SHIFT_6=y
+CONFIG_ARM_PATCH_IDIV=y
+CONFIG_ARM_PATCH_PHYS_VIRT=y
+# CONFIG_ARM_QCOM_CPUFREQ_HW is not set
+CONFIG_ARM_QCOM_CPUFREQ_NVMEM=y
+CONFIG_ARM_QCOM_SPM_CPUIDLE=y
+# CONFIG_ARM_SMMU is not set
+CONFIG_ARM_THUMB=y
+CONFIG_ARM_UNWIND=y
+CONFIG_ARM_VIRT_EXT=y
+CONFIG_AT803X_PHY=y
+CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BOUNCE=y
+# CONFIG_CACHE_L2X0 is not set
+CONFIG_CLKSRC_QCOM=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CMDLINE_OVERRIDE=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMMON_CLK_QCOM=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+CONFIG_CPU_32v6K=y
+CONFIG_CPU_32v7=y
+CONFIG_CPU_ABRT_EV7=y
+CONFIG_CPU_CACHE_V7=y
+CONFIG_CPU_CACHE_VIPT=y
+CONFIG_CPU_COPY_V6=y
+CONFIG_CPU_CP15=y
+CONFIG_CPU_CP15_MMU=y
+CONFIG_CPU_FREQ=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+# CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+# CONFIG_CPU_FREQ_GOV_POWERSAVE is not set
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+# CONFIG_CPU_FREQ_GOV_USERSPACE is not set
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_HAS_ASID=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_IDLE_MULTIPLE_DRIVERS=y
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_PABRT_V7=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SPECTRE=y
+CONFIG_CPU_THERMAL=y
+CONFIG_CPU_THUMB_CAPABLE=y
+CONFIG_CPU_TLB_V7=y
+CONFIG_CPU_V7=y
+CONFIG_CRC16=y
+# CONFIG_CRC32_SARWATE is not set
+CONFIG_CRC32_SLICEBY8=y
+CONFIG_CRC8=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_DEV_QCOM_RNG=y
+CONFIG_CRYPTO_DRBG=y
+CONFIG_CRYPTO_DRBG_HMAC=y
+CONFIG_CRYPTO_DRBG_MENU=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_HW=y
+CONFIG_CRYPTO_JITTERENTROPY=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DEBUG_GPIO=y
+CONFIG_DEBUG_LL_INCLUDE="mach/debug-macro.S"
+CONFIG_DEVFREQ_GOV_PASSIVE=y
+# CONFIG_DEVFREQ_GOV_PERFORMANCE is not set
+# CONFIG_DEVFREQ_GOV_POWERSAVE is not set
+# CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND is not set
+# CONFIG_DEVFREQ_GOV_USERSPACE is not set
+# CONFIG_DEVFREQ_THERMAL is not set
+CONFIG_DMADEVICES=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_OPS=y
+CONFIG_DMA_REMAP=y
+CONFIG_DMA_VIRTUAL_CHANNELS=y
+CONFIG_DTC=y
+CONFIG_DT_IDLE_STATES=y
+# CONFIG_DWMAC_GENERIC is not set
+CONFIG_DWMAC_IPQ806X=y
+# CONFIG_DWMAC_QCOM_ETHQOS is not set
+CONFIG_EDAC_ATOMIC_SCRUB=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_ETHERNET_PACKET_MANGLE=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_GENERIC_IRQ_MULTI_HANDLER=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_MSI_IRQ=y
+CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GENERIC_VDSO_32=y
+CONFIG_GLOB=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_GRO_CELLS=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDEN_BRANCH_PREDICTOR=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HAVE_SMP=y
+CONFIG_HIGHMEM=y
+# CONFIG_HIGHPTE is not set
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HWMON=y
+CONFIG_HWSPINLOCK=y
+CONFIG_HWSPINLOCK_QCOM=y
+CONFIG_HW_RANDOM=y
+CONFIG_HZ_FIXED=0
+CONFIG_I2C=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_HELPER_AUTO=y
+# CONFIG_I2C_QCOM_CCI is not set
+CONFIG_I2C_QUP=y
+CONFIG_INITRAMFS_SOURCE=""
+# CONFIG_IOMMU_DEBUGFS is not set
+# CONFIG_IOMMU_IO_PGTABLE_ARMV7S is not set
+# CONFIG_IOMMU_IO_PGTABLE_LPAE is not set
+CONFIG_IOMMU_SUPPORT=y
+# CONFIG_IPQ_APSS_PLL is not set
+# CONFIG_IPQ_GCC_4019 is not set
+# CONFIG_IPQ_GCC_6018 is not set
+CONFIG_IPQ_GCC_806X=y
+# CONFIG_IPQ_GCC_8074 is not set
+# CONFIG_IPQ_LCC_806X is not set
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FASTEOI_HIERARCHY_HANDLERS=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+CONFIG_KMAP_LOCAL=y
+CONFIG_KMAP_LOCAL_NON_LINEAR_PTE_ARRAY=y
+CONFIG_KPSS_XCC=y
+CONFIG_KRAITCC=y
+CONFIG_KRAIT_CLOCKS=y
+CONFIG_KRAIT_L2_ACCESSORS=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MDIO_BITBANG=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MDIO_GPIO=y
+CONFIG_MDIO_IPQ8064=y
+# CONFIG_MDM_GCC_9615 is not set
+# CONFIG_MDM_LCC_9615 is not set
+CONFIG_MEMFD_CREATE=y
+# CONFIG_MFD_HI6421_SPMI is not set
+CONFIG_MFD_QCOM_RPM=y
+# CONFIG_MFD_SPMI_PMIC is not set
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGHT_HAVE_CACHE_L2X0=y
+CONFIG_MIGRATION=y
+CONFIG_MMC=y
+CONFIG_MMC_ARMMMCI=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_BLOCK_MINORS=16
+CONFIG_MMC_CQHCI=y
+CONFIG_MMC_QCOM_DML=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_IO_ACCESSORS=y
+CONFIG_MMC_SDHCI_MSM=y
+# CONFIG_MMC_SDHCI_PCI is not set
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MSM_GCC_8660=y
+# CONFIG_MSM_GCC_8909 is not set
+# CONFIG_MSM_GCC_8916 is not set
+# CONFIG_MSM_GCC_8939 is not set
+# CONFIG_MSM_GCC_8960 is not set
+# CONFIG_MSM_GCC_8974 is not set
+# CONFIG_MSM_GCC_8976 is not set
+# CONFIG_MSM_GCC_8994 is not set
+# CONFIG_MSM_GCC_8996 is not set
+# CONFIG_MSM_GCC_8998 is not set
+# CONFIG_MSM_GPUCC_8998 is not set
+# CONFIG_MSM_IOMMU is not set
+# CONFIG_MSM_LCC_8960 is not set
+# CONFIG_MSM_MMCC_8960 is not set
+# CONFIG_MSM_MMCC_8974 is not set
+# CONFIG_MSM_MMCC_8996 is not set
+# CONFIG_MSM_MMCC_8998 is not set
+CONFIG_MTD_CMDLINE_PARTS=y
+CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_NAND_ECC_SW_HAMMING=y
+CONFIG_MTD_NAND_QCOM=y
+CONFIG_MTD_QCOMSMEM_PARTS=y
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPLIT_FIRMWARE=y
+CONFIG_MTD_SPLIT_FIT_FW=y
+CONFIG_MTD_SPLIT_UIMAGE_FW=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_LIMIT=20
+CONFIG_MTD_UBI_BLOCK=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEON=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_QCA8K=y
+CONFIG_NET_DSA_QCA8K_LEDS_SUPPORT=y
+CONFIG_NET_DSA_TAG_QCA=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_PTP_CLASSIFY=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NLS=y
+CONFIG_NO_HZ=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NR_CPUS=2
+CONFIG_NVMEM=y
+CONFIG_NVMEM_QCOM_QFPROM=y
+# CONFIG_NVMEM_SPMI_SDAM is not set
+CONFIG_NVMEM_SYSFS=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_OLD_SIGACTION=y
+CONFIG_OLD_SIGSUSPEND3=y
+CONFIG_PADATA=y
+CONFIG_PAGE_OFFSET=0xC0000000
+CONFIG_PAGE_POOL=y
+CONFIG_PCI=y
+CONFIG_PCIEAER=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_DW=y
+CONFIG_PCIE_DW_HOST=y
+CONFIG_PCIE_QCOM=y
+CONFIG_PCI_DEBUG=y
+CONFIG_PCI_DISABLE_COMMON_QUIRKS=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PCI_MSI=y
+CONFIG_PCI_MSI_IRQ_DOMAIN=y
+CONFIG_PCS_XPCS=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PHYS_OFFSET=0x42000000
+# CONFIG_PHY_QCOM_APQ8064_SATA is not set
+# CONFIG_PHY_QCOM_EDP is not set
+# CONFIG_PHY_QCOM_IPQ4019_USB is not set
+CONFIG_PHY_QCOM_IPQ806X_SATA=y
+# CONFIG_PHY_QCOM_IPQ806X_USB is not set
+# CONFIG_PHY_QCOM_PCIE2 is not set
+# CONFIG_PHY_QCOM_QMP is not set
+# CONFIG_PHY_QCOM_QUSB2 is not set
+# CONFIG_PHY_QCOM_USB_HS_28NM is not set
+# CONFIG_PHY_QCOM_USB_SNPS_FEMTO_V2 is not set
+# CONFIG_PHY_QCOM_USB_SS is not set
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_APQ8064 is not set
+# CONFIG_PINCTRL_APQ8084 is not set
+# CONFIG_PINCTRL_IPQ4019 is not set
+# CONFIG_PINCTRL_IPQ6018 is not set
+CONFIG_PINCTRL_IPQ8064=y
+# CONFIG_PINCTRL_IPQ8074 is not set
+# CONFIG_PINCTRL_MDM9615 is not set
+CONFIG_PINCTRL_MSM=y
+# CONFIG_PINCTRL_MSM8226 is not set
+# CONFIG_PINCTRL_MSM8660 is not set
+# CONFIG_PINCTRL_MSM8909 is not set
+# CONFIG_PINCTRL_MSM8916 is not set
+# CONFIG_PINCTRL_MSM8960 is not set
+# CONFIG_PINCTRL_MSM8976 is not set
+# CONFIG_PINCTRL_MSM8994 is not set
+# CONFIG_PINCTRL_MSM8996 is not set
+# CONFIG_PINCTRL_MSM8998 is not set
+# CONFIG_PINCTRL_QCOM_SPMI_PMIC is not set
+# CONFIG_PINCTRL_QCOM_SSBI_PMIC is not set
+# CONFIG_PINCTRL_QCS404 is not set
+# CONFIG_PINCTRL_SC7180 is not set
+# CONFIG_PINCTRL_SDM660 is not set
+# CONFIG_PINCTRL_SDM845 is not set
+# CONFIG_PINCTRL_SDX65 is not set
+# CONFIG_PINCTRL_SM8150 is not set
+# CONFIG_PINCTRL_SM8250 is not set
+CONFIG_PM_DEVFREQ=y
+# CONFIG_PM_DEVFREQ_EVENT is not set
+CONFIG_PM_OPP=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_MSM=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PPS=y
+CONFIG_PRINTK_TIME=y
+CONFIG_PTP_1588_CLOCK=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+# CONFIG_QCM_DISPCC_2290 is not set
+# CONFIG_QCM_GCC_2290 is not set
+# CONFIG_QCOM_A53PLL is not set
+CONFIG_QCOM_ADM=y
+CONFIG_QCOM_BAM_DMA=y
+CONFIG_QCOM_CLK_RPM=y
+# CONFIG_QCOM_COMMAND_DB is not set
+# CONFIG_QCOM_CPR is not set
+# CONFIG_QCOM_EBI2 is not set
+# CONFIG_QCOM_GENI_SE is not set
+CONFIG_QCOM_GSBI=y
+CONFIG_QCOM_HFPLL=y
+# CONFIG_QCOM_ICC_BWMON is not set
+# CONFIG_QCOM_IOMMU is not set
+# CONFIG_QCOM_LLCC is not set
+# CONFIG_QCOM_OCMEM is not set
+# CONFIG_QCOM_PDC is not set
+# CONFIG_QCOM_RMTFS_MEM is not set
+CONFIG_QCOM_RPMCC=y
+# CONFIG_QCOM_RPMH is not set
+CONFIG_QCOM_SCM=y
+# CONFIG_QCOM_SCM_DOWNLOAD_MODE_DEFAULT is not set
+CONFIG_QCOM_SMEM=y
+# CONFIG_QCOM_SMSM is not set
+CONFIG_QCOM_SOCINFO=y
+# CONFIG_QCOM_STATS is not set
+CONFIG_QCOM_TCSR=y
+CONFIG_QCOM_TSENS=y
+CONFIG_QCOM_WDT=y
+# CONFIG_QCS_GCC_404 is not set
+# CONFIG_QCS_Q6SSTOP_404 is not set
+# CONFIG_QCS_TURING_404 is not set
+CONFIG_RAS=y
+CONFIG_RATIONAL=y
+CONFIG_RCU_CPU_STALL_TIMEOUT=21
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+# CONFIG_REGULATOR_QCOM_LABIBB is not set
+CONFIG_REGULATOR_QCOM_RPM=y
+# CONFIG_REGULATOR_QCOM_SPMI is not set
+# CONFIG_REGULATOR_QCOM_USB_VBUS is not set
+# CONFIG_REGULATOR_VQMMC_IPQ4019 is not set
+CONFIG_RESET_CONTROLLER=y
+# CONFIG_RESET_QCOM_AOSS is not set
+# CONFIG_RESET_QCOM_PDC is not set
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RTC_MC146818_LIB=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+# CONFIG_SC_CAMCC_7280 is not set
+# CONFIG_SC_DISPCC_7180 is not set
+# CONFIG_SC_GCC_7180 is not set
+# CONFIG_SC_GCC_8280XP is not set
+# CONFIG_SC_GPUCC_7180 is not set
+# CONFIG_SC_LPASSCC_7280 is not set
+# CONFIG_SC_LPASS_CORECC_7180 is not set
+# CONFIG_SC_LPASS_CORECC_7280 is not set
+# CONFIG_SC_MSS_7180 is not set
+# CONFIG_SC_VIDEOCC_7180 is not set
+# CONFIG_SDM_CAMCC_845 is not set
+# CONFIG_SDM_DISPCC_845 is not set
+# CONFIG_SDM_GCC_660 is not set
+# CONFIG_SDM_GCC_845 is not set
+# CONFIG_SDM_GPUCC_845 is not set
+# CONFIG_SDM_LPASSCC_845 is not set
+# CONFIG_SDM_VIDEOCC_845 is not set
+# CONFIG_SDX_GCC_65 is not set
+CONFIG_SERIAL_8250_FSL=y
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_MSM=y
+CONFIG_SERIAL_MSM_CONSOLE=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SMP=y
+CONFIG_SMP_ON_UP=y
+# CONFIG_SM_CAMCC_8450 is not set
+# CONFIG_SM_GCC_8150 is not set
+# CONFIG_SM_GCC_8250 is not set
+# CONFIG_SM_GCC_8450 is not set
+# CONFIG_SM_GPUCC_6350 is not set
+# CONFIG_SM_GPUCC_8150 is not set
+# CONFIG_SM_GPUCC_8250 is not set
+# CONFIG_SM_GPUCC_8350 is not set
+# CONFIG_SM_VIDEOCC_8150 is not set
+# CONFIG_SM_VIDEOCC_8250 is not set
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOC_BUS=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SPI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SPI_QUP=y
+CONFIG_SPMI=y
+# CONFIG_SPMI_HISI3670 is not set
+CONFIG_SPMI_MSM_PMIC_ARB=y
+# CONFIG_SPMI_PMIC_CLKDIV is not set
+CONFIG_SRCU=y
+CONFIG_STMMAC_ETH=y
+CONFIG_STMMAC_PLATFORM=y
+CONFIG_SWCONFIG=y
+CONFIG_SWCONFIG_LEDS=y
+CONFIG_SWPHY=y
+CONFIG_SWP_EMULATE=y
+CONFIG_SYS_SUPPORTS_APM_EMULATION=y
+CONFIG_THERMAL=y
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_GOV_STEP_WISE=y
+CONFIG_THERMAL_HWMON=y
+CONFIG_THERMAL_OF=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UBIFS_FS=y
+CONFIG_UBIFS_FS_ADVANCED_COMPR=y
+# CONFIG_UCLAMP_TASK is not set
+CONFIG_UEVENT_HELPER_PATH=""
+CONFIG_UNCOMPRESS_INCLUDE="debug/uncompress.h"
+CONFIG_UNWINDER_ARM=y
+CONFIG_USB=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_OF=y
+CONFIG_VFP=y
+CONFIG_VFPv3=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_XZ_DEC_ARM=y
+CONFIG_XZ_DEC_BCJ=y
+CONFIG_ZBOOT_ROM_BSS=0
+CONFIG_ZBOOT_ROM_TEXT=0
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8062-wg2600hp3.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8062-wg2600hp3.dts
new file mode 100644
index 00000000000000..c55287a4f129b8
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8062-wg2600hp3.dts
@@ -0,0 +1,510 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq8062-smb208.dtsi"
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "NEC Platforms Aterm WG2600HP3";
+	compatible = "nec,wg2600hp3", "qcom,ipq8062", "qcom,ipq8064";
+
+	memory {
+		device_type = "memory";
+		reg =  <0x42000000 0x1e000000>;
+	};
+
+	aliases {
+		label-mac-device = &gmac2;
+
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_red;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		pinctrl-0 = <&buttons_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 22 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		mode0 {
+			label = "mode0";
+			gpios = <&qcom_pinmux 40 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+			linux,input-type = <EV_SW>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		mode1 {
+			label = "mode1";
+			gpios = <&qcom_pinmux 41 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_1>;
+			linux,input-type = <EV_SW>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		pinctrl-0 = <&leds_pins>;
+		pinctrl-names = "default";
+
+		led_power_green: power_green {
+			label = "green:power";
+			gpios = <&qcom_pinmux 14 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_power_red: power_red {
+			label = "red:power";
+			gpios = <&qcom_pinmux 35 GPIO_ACTIVE_HIGH>;
+		};
+
+		active_green {
+			label = "green:active";
+			gpios = <&qcom_pinmux 42 GPIO_ACTIVE_HIGH>;
+		};
+
+		active_red {
+			label = "red:active";
+			gpios = <&qcom_pinmux 38 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan2g_green {
+			label = "green:wlan2g";
+			gpios = <&qcom_pinmux 55 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		wlan2g_red {
+			label = "red:wlan2g";
+			gpios = <&qcom_pinmux 56 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan5g_green {
+			label = "green:wlan5g";
+			gpios = <&qcom_pinmux 57 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wlan5g_red {
+			label = "red:wlan5g";
+			gpios = <&qcom_pinmux 58 GPIO_ACTIVE_HIGH>;
+		};
+
+		tv_green {
+			label = "green:tv";
+			gpios = <&qcom_pinmux 46 GPIO_ACTIVE_HIGH>;
+		};
+
+		tv_red {
+			label = "red:tv";
+			gpios = <&qcom_pinmux 36 GPIO_ACTIVE_HIGH>;
+		};
+
+		converter_green {
+			label = "green:converter";
+			gpios = <&qcom_pinmux 43 GPIO_ACTIVE_HIGH>;
+		};
+
+		converter_red {
+			label = "red:converter";
+			gpios = <&qcom_pinmux 15 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+/* nand_pins are used for leds_pins, empty the node
+ * from ipq8064.dtsi
+ */
+&nand_pins {
+	/delete-property/ disable;
+	/delete-property/ pullups;
+	/delete-property/ hold;
+};
+
+&qcom_pinmux {
+	pinctrl-0 = <&akro_pins>;
+	pinctrl-names = "default";
+
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19", "gpio21";
+			function = "gsbi5";
+			bias-pull-down;
+		};
+
+		data {
+			pins = "gpio18", "gpio19";
+			drive-strength = <10>;
+		};
+
+		cs {
+			pins = "gpio20";
+			drive-strength = <10>;
+		};
+
+		clk {
+			pins = "gpio21";
+			drive-strength = <12>;
+		};
+	};
+
+	buttons_pins: buttons_pins {
+		mux {
+			pins = "gpio22", "gpio24", "gpio40",
+				"gpio41";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	leds_pins: leds_pins {
+		mux {
+			pins = "gpio14", "gpio15", "gpio35",
+				"gpio36", "gpio38", "gpio42",
+				"gpio43", "gpio46", "gpio55",
+				"gpio56", "gpio57", "gpio58";
+			function = "gpio";
+			bias-pull-down;
+		};
+
+		akro2 {
+			pins = "gpio15", "gpio35", "gpio38",
+				"gpio42", "gpio43", "gpio46",
+				"gpio55", "gpio56", "gpio57",
+				"gpio58";
+			drive-strength = <2>;
+		};
+
+		akro4 {
+			pins = "gpio14", "gpio36";
+			drive-strength = <4>;
+		};
+	};
+
+	/*
+	 * Stock firmware has the following settings, so let's do the same.
+	 * I don't sure why these are required.
+	 */
+	akro_pins: akro_pinmux {
+		akro {
+			pins = "gpio17", "gpio26", "gpio47";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+
+		reset {
+			pins = "gpio45";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-disable;
+			output-low;
+		};
+
+		gmac0_rgmii {
+			pins = "gpio25";
+			function = "gpio";
+			drive-strength = <8>;
+			bias-disable;
+		};
+	};
+};
+
+&gsbi5 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_SPI>;
+
+	spi@1a280000 {
+		status = "okay";
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
+
+		flash@0 {
+			compatible = "jedec,spi-nor";
+			reg = <0>;
+			spi-max-frequency = <50000000>;
+			m25p,fast-read;
+
+			partitions {
+				compatible = "fixed-partitions";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				partition@0 {
+					label = "SBL1";
+					reg = <0x0000000 0x0020000>;
+					read-only;
+				};
+
+				partition@20000 {
+					label = "MIBIB";
+					reg = <0x0020000 0x0020000>;
+					read-only;
+				};
+
+				partition@40000 {
+					label = "SBL2";
+					reg = <0x0040000 0x0040000>;
+					read-only;
+				};
+
+				partition@80000 {
+					label = "SBL3";
+					reg = <0x0080000 0x0080000>;
+					read-only;
+				};
+
+				partition@100000 {
+					label = "DDRCONFIG";
+					reg = <0x0100000 0x0010000>;
+					read-only;
+				};
+
+				partition@110000 {
+					label = "SSD";
+					reg = <0x0110000 0x0010000>;
+					read-only;
+				};
+
+				partition@120000 {
+					label = "TZ";
+					reg = <0x0120000 0x0080000>;
+					read-only;
+				};
+
+				partition@1a0000 {
+					label = "RPM";
+					reg = <0x01a0000 0x0080000>;
+					read-only;
+				};
+
+				partition@220000 {
+					label = "APPSBL";
+					reg = <0x0220000 0x0080000>;
+					read-only;
+				};
+
+				partition@2a0000 {
+					label = "APPSBLENV";
+					reg = <0x02a0000 0x0010000>;
+					read-only;
+				};
+
+				factory: partition@2b0000 {
+					label = "PRODUCTDATA";
+					reg = <0x02b0000 0x0030000>;
+					read-only;
+				};
+
+				partition@2e0000 {
+					label = "ART";
+					reg = <0x02e0000 0x0040000>;
+					read-only;
+					compatible = "nvmem-cells";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					precal_ART_1000: precal@1000 {
+						reg = <0x1000 0x2f20>;
+					};
+
+					precal_ART_5000: precal@5000 {
+						reg = <0x5000 0x2f20>;
+					};
+				};
+
+				partition@320000 {
+					label = "TP";
+					reg = <0x0320000 0x0040000>;
+					read-only;
+				};
+
+				partition@360000 {
+					label = "TINY";
+					reg = <0x0360000 0x0500000>;
+					read-only;
+				};
+
+				partition@860000 {
+					compatible = "denx,uimage";
+					label = "firmware";
+					reg = <0x0860000 0x17a0000>;
+				};
+			};
+		};
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "qcom,ath10k";
+			reg = <0x00010000 0 0 0 0>;
+
+			qcom,ath10k-calibration-variant = "NEC-Platforms-WG2600HP3";
+
+			nvmem-cells = <&macaddr_PRODUCTDATA_12>, <&precal_ART_1000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+	force_gen1 = <1>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "qcom,ath10k";
+			reg = <0x00010000 0 0 0 0>;
+
+			ieee80211-freq-limit = <2400000 2483000>;
+			qcom,ath10k-calibration-variant = "NEC-Platforms-WG2600HP3";
+
+			nvmem-cells = <&macaddr_PRODUCTDATA_c>, <&precal_ART_5000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x04 0x80080080  /* PAD0_MODE */
+			0x0c 0x06000000  /* PAD6_MODE */
+			0x10 0x002613a0  /* PWS_REG */
+			0x50 0xcc36cc36  /* LED_CTRL0 */
+			0x54 0xca36ca36  /* LED_CTRL1 */
+			0x58 0xc936c936  /* LED_CTRL2 */
+			0x5c 0x03ffff00  /* LED_CTRL3 */
+			0x7c 0x0000004e  /* PORT0_STATUS */
+			0x94 0x0000004e  /* PORT6_STATUS */
+			0xe0 0xc74164de  /* SGMII_CTRL */
+			0xe4 0x0006a545  /* MAC_PWR_SEL */
+			>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+	mdiobus = <&mdio0>;
+	nvmem-cells = <&macaddr_factory_0>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+	mdiobus = <&mdio0>;
+	nvmem-cells = <&macaddr_factory_6>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_0: macaddr@0 {
+		reg = <0x0 0x6>;
+	};
+
+	macaddr_factory_6: macaddr@6 {
+		reg = <0x6 0x6>;
+	};
+
+	macaddr_PRODUCTDATA_c: macaddr@c {
+		reg = <0xc 0x6>;
+	};
+
+	macaddr_PRODUCTDATA_12: macaddr@12 {
+		reg = <0x12 0x6>;
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-ad7200-c2600.dtsi b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-ad7200-c2600.dtsi
new file mode 100644
index 00000000000000..3494b2bde2f28e
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-ad7200-c2600.dtsi
@@ -0,0 +1,402 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	reserved-memory {
+		ramoops@42100000 {
+			compatible = "ramoops";
+			reg = <0x42100000 0x40000>;
+			record-size = <0x4000>;
+			console-size = <0x4000>;
+			ftrace-size = <0x4000>;
+			pmsg-size = <0x4000>;
+		};
+	};
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+		label-mac-device = &gmac2;
+	};
+};
+
+&qcom_pinmux {
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19", "gpio21";
+			function = "gsbi5";
+			bias-pull-down;
+		};
+
+		data {
+			pins = "gpio18", "gpio19";
+			drive-strength = <10>;
+		};
+
+		cs {
+			pins = "gpio20";
+			function = "gpio";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+
+		clk {
+			pins = "gpio21";
+			drive-strength = <12>;
+		};
+	};
+
+	usb0_pwr_en_pin: usb0_pwr_en_pin {
+		mux {
+			pins = "gpio25";
+			function = "gpio";
+			drive-strength = <10>;
+			bias-pull-up;
+			output-high;
+		};
+	};
+
+	usb1_pwr_en_pin: usb1_pwr_en_pin {
+		mux {
+			pins = "gpio23";
+			function = "gpio";
+			drive-strength = <10>;
+			bias-pull-up;
+			output-high;
+		};
+	};
+};
+
+&gsbi5 {
+	qcom,mode = <GSBI_PROT_SPI>;
+	status = "okay";
+
+	spi@1a280000 {
+		status = "okay";
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
+
+		flash@0 {
+			compatible = "jedec,spi-nor";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			spi-max-frequency = <50000000>;
+			reg = <0>;
+
+			partitions {
+				compatible = "fixed-partitions";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				partition@0 {
+					label = "SBL1";
+					reg = <0x0 0x20000>;
+					read-only;
+				};
+
+				partition@20000 {
+					label = "MIBIB";
+					reg = <0x20000 0x20000>;
+					read-only;
+				};
+
+				partition@40000 {
+					label = "SBL2";
+					reg = <0x40000 0x20000>;
+					read-only;
+				};
+
+				partition@60000 {
+					label = "SBL3";
+					reg = <0x60000 0x30000>;
+					read-only;
+				};
+
+				partition@90000 {
+					label = "DDRCONFIG";
+					reg = <0x90000 0x10000>;
+					read-only;
+				};
+
+				partition@a0000 {
+					label = "SSD";
+					reg = <0xa0000 0x10000>;
+					read-only;
+				};
+
+				partition@b0000 {
+					label = "TZ";
+					reg = <0xb0000 0x30000>;
+					read-only;
+				};
+
+				partition@e0000 {
+					label = "RPM";
+					reg = <0xe0000 0x20000>;
+					read-only;
+				};
+
+				partition@100000 {
+					label = "fs-uboot";
+					reg = <0x100000 0x70000>;
+					read-only;
+				};
+
+				partition@170000 {
+					label = "uboot-env";
+					reg = <0x170000 0x40000>;
+					read-only;
+				};
+
+				partition@1b0000 {
+					label = "radio";
+					reg = <0x1b0000 0x40000>;
+					read-only;
+					compatible = "nvmem-cells";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					precal_radio_1000: precal@1000 {
+						reg = <0x1000 0x2f20>;
+					};
+
+					precal_radio_5000: precal@5000 {
+						reg = <0x5000 0x2f20>;
+					};
+				};
+
+				partition@1f0000 {
+					label = "os-image";
+					reg = <0x1f0000 0x400000>;
+				};
+
+				partition@5f0000 {
+					label = "rootfs";
+					reg = <0x5f0000 0x1900000>;
+				};
+
+				defaultmac: partition@1ef0000 {
+					label = "default-mac";
+					reg = <0x1ef0000 0x00200>;
+					read-only;
+				};
+
+				partition@1ef0200 {
+					label = "pin";
+					reg = <0x1ef0200 0x00200>;
+					read-only;
+				};
+
+				partition@1ef0400 {
+					label = "product-info";
+					reg = <0x1ef0400 0x0fc00>;
+					read-only;
+				};
+
+				partition@1f00000 {
+					label = "partition-table";
+					reg = <0x1f00000 0x10000>;
+					read-only;
+				};
+
+				partition@1f10000 {
+					label = "soft-version";
+					reg = <0x1f10000 0x10000>;
+					read-only;
+				};
+
+				partition@1f20000 {
+					label = "support-list";
+					reg = <0x1f20000 0x10000>;
+					read-only;
+				};
+
+				partition@1f30000 {
+					label = "profile";
+					reg = <0x1f30000 0x10000>;
+					read-only;
+				};
+
+				partition@1f40000 {
+					label = "default-config";
+					reg = <0x1f40000 0x10000>;
+					read-only;
+				};
+
+				partition@1f50000 {
+					label = "user-config";
+					reg = <0x1f50000 0x40000>;
+					read-only;
+				};
+
+				partition@1f90000 {
+					label = "qos-db";
+					reg = <0x1f90000 0x40000>;
+					read-only;
+				};
+
+				partition@1fd0000 {
+					label = "usb-config";
+					reg = <0x1fd0000 0x10000>;
+					read-only;
+				};
+
+				partition@1fe0000 {
+					label = "log";
+					reg = <0x1fe0000 0x20000>;
+					read-only;
+				};
+			};
+		};
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+
+	pinctrl-0 = <&usb0_pwr_en_pin>;
+	pinctrl-names = "default";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+
+	pinctrl-0 = <&usb1_pwr_en_pin>;
+	pinctrl-names = "default";
+};
+
+&pcie0 {
+	status = "okay";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_defaultmac_8>, <&precal_radio_1000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+			mac-address-increment = <(-1)>;
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+	max-link-speed = <1>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_defaultmac_8>, <&precal_radio_5000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	nvmem-cells = <&macaddr_defaultmac_8>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <1>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	nvmem-cells = <&macaddr_defaultmac_8>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&defaultmac {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_defaultmac_8: macaddr@8 {
+		reg = <0x8 0x6>;
+	};
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-ad7200.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-ad7200.dts
new file mode 100644
index 00000000000000..6cb21fc4f3f08a
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-ad7200.dts
@@ -0,0 +1,135 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq8064-ad7200-c2600.dtsi"
+
+/ {
+	model = "TP-Link Talon AD7200";
+	compatible = "tplink,ad7200", "qcom,ipq8064";
+
+	aliases {
+		led-boot = &led_status;
+		led-failsafe = &led_status;
+		led-running = &led_status;
+		led-upgrade = &led_status;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wifi {
+			label = "wifi";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 67 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		led_enable {
+			label = "led-enable";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_LIGHTS_TOGGLE>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		lan {
+			label = "blue:lan";
+			gpios = <&qcom_pinmux 2 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb1 {
+			label = "blue:usb1";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan5g {
+			label = "blue:wlan5g";
+			gpios = <&qcom_pinmux 15 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb3 {
+			label = "blue:usb3";
+			gpios = <&qcom_pinmux 16 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan2g {
+			label = "blue:wlan2g";
+			gpios = <&qcom_pinmux 17 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan_orange {
+			label = "orange:wan";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_LOW>;
+		};
+
+		wan_blue {
+			label = "blue:wan";
+			gpios = <&qcom_pinmux 33 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "blue:wps";
+			gpios = <&qcom_pinmux 55 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan60g {
+			label = "blue:wlan60g";
+			gpios = <&qcom_pinmux 56 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status: status {
+			label = "blue:status";
+			gpios = <&qcom_pinmux 66 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio53", "gpio54", "gpio67";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio2", "gpio8", "gpio15", "gpio16", "gpio17", "gpio26",
+					"gpio33", "gpio55", "gpio56", "gpio66";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+};
+
+&pcie2 {
+	status = "okay";
+	max-link-speed = <1>;
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-ap148.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-ap148.dts
new file mode 100644
index 00000000000000..d3b7c44877e2ea
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-ap148.dts
@@ -0,0 +1,134 @@
+#include "qcom-ipq8064-v1.0.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. IPQ8064/AP-148";
+	compatible = "qcom,ipq8064-ap148", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	reserved-memory {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+		rsvd@41200000 {
+			reg = <0x41200000 0x300000>;
+			no-map;
+		};
+	};
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&flash {
+	partitions {
+		compatible = "qcom,smem-part";
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+};
+
+&pcie1 {
+	status = "okay";
+	max-link-speed = <1>;
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		partitions {
+			compatible = "qcom,smem-part";
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-ap161.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-ap161.dts
new file mode 100644
index 00000000000000..02ddbf31180fc1
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-ap161.dts
@@ -0,0 +1,172 @@
+#include "qcom-ipq8064-v1.0.dtsi"
+
+/ {
+	model = "Qualcomm IPQ8064/AP161";
+	compatible = "qcom,ipq8064-ap161", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	reserved-memory {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+		rsvd@41200000 {
+			reg = <0x41200000 0x300000>;
+			no-map;
+		};
+	};
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+	};
+};
+
+&qcom_pinmux {
+	rgmii2_pins: rgmii2-pins {
+		mux {
+			pins = "gpio27", "gpio28", "gpio29",
+			       "gpio30", "gpio31", "gpio32",
+			       "gpio51", "gpio52", "gpio59",
+			       "gpio60", "gpio61", "gpio62",
+			       "gpio2", "gpio66";
+		};
+	};
+};
+
+&flash {
+	partitions {
+		compatible = "qcom,smem-part";
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+};
+
+&pcie1 {
+	status = "okay";
+	max-link-speed = <1>;
+};
+
+&pcie2 {
+	status = "okay";
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		partitions {
+			compatible = "qcom,smem-part";
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x20080     /* PAD6_MODE */
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+		qca,phy-rgmii-en;
+		qca,txclk-delay-en;
+		qca,rxclk-delay-en;
+	};
+
+	phy3: ethernet-phy@3 {
+		device_type = "ethernet-phy";
+		reg = <3>;
+	};
+};
+
+&gmac0 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <0>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+	mdiobus = <&mdio0>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+	mdiobus = <&mdio0>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+	mdiobus = <&mdio0>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-asus-onhub.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-asus-onhub.dts
new file mode 100644
index 00000000000000..442bcf19a675b1
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-asus-onhub.dts
@@ -0,0 +1,92 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright 2014 The ChromiumOS Authors
+ */
+
+#include "qcom-ipq8064-onhub.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/soc/qcom,gsbi.h>
+
+/ {
+	model = "ASUS OnHub";
+	compatible = "asus,onhub", "google,arkham", "qcom,ipq8064";
+};
+
+&qcom_pinmux {
+	ap3223_pins: ap3223_pinmux {
+		pins = "gpio22";
+		function = "gpio";
+		bias-none;
+	};
+
+	i2c7_pins: i2c7_pinmux {
+		mux {
+			pins = "gpio8", "gpio9";
+			function = "gsbi7";
+		};
+		data {
+			pins = "gpio8";
+			bias-disable;
+		};
+		clk {
+			pins = "gpio9";
+			bias-disable;
+		};
+	};
+};
+
+&gsbi7 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_I2C_UART>;
+};
+
+&gsbi7_i2c {
+	status = "okay";
+	clock-frequency = <100000>;
+	pinctrl-0 = <&i2c7_pins>;
+	pinctrl-names = "default";
+
+	ap3223@1c {
+		compatible = "dynaimage,ap3223";
+		reg = <0x1c>;
+
+		pinctrl-0 = <&ap3223_pins>;
+		pinctrl-names = "default";
+
+		int-gpio = <&qcom_pinmux 22 GPIO_ACTIVE_LOW>;
+	};
+
+	led-controller@32 {
+		compatible = "national,lp5523";
+		reg = <0x32>;
+		clock-mode = /bits/ 8 <1>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		led@4 {
+			reg = <4>;
+			color = <LED_COLOR_ID_GREEN>;
+			chan-name = "green:status";
+			linux,default-trigger = "default-on";
+			led-cur = /bits/ 8 <0xfa>;
+			max-cur = /bits/ 8 <0xff>;
+		};
+
+		led@5 {
+			reg = <5>;
+			color = <LED_COLOR_ID_BLUE>;
+			chan-name = "blue:status";
+			led-cur = /bits/ 8 <0xfa>;
+			max-cur = /bits/ 8 <0xff>;
+		};
+
+		led@8 {
+			reg = <8>;
+			color = <LED_COLOR_ID_RED>;
+			chan-name = "red:status";
+			led-cur = /bits/ 8 <0xfa>;
+			max-cur = /bits/ 8 <0xff>;
+		};
+	};
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-c2600.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-c2600.dts
new file mode 100644
index 00000000000000..cef1aba34445d3
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-c2600.dts
@@ -0,0 +1,119 @@
+#include "qcom-ipq8064-ad7200-c2600.dtsi"
+
+/ {
+	model = "TP-Link Archer C2600";
+	compatible = "tplink,c2600", "qcom,ipq8064";
+
+	aliases {
+		led-boot = &power;
+		led-failsafe = &general;
+		led-running = &power;
+		led-upgrade = &general;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wifi {
+			label = "wifi";
+			gpios = <&qcom_pinmux 49 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		ledswitch {
+			label = "ledswitch";
+			gpios = <&qcom_pinmux 16 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_LIGHTS_TOGGLE>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		lan {
+			label = "white:lan";
+			gpios = <&qcom_pinmux 6 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb4 {
+			label = "white:usb_4";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb2 {
+			label = "white:usb_2";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+
+		wps {
+			label = "white:wps";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan_amber {
+			label = "amber:wan";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_LOW>;
+		};
+
+		wan_white {
+			label = "white:wan";
+			gpios = <&qcom_pinmux 33 GPIO_ACTIVE_LOW>;
+		};
+
+		power: power {
+			label = "white:power";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+			default-state = "keep";
+		};
+
+		general: general {
+			label = "white:general";
+			gpios = <&qcom_pinmux 66 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio16", "gpio54", "gpio65";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio6", "gpio7", "gpio8", "gpio9", "gpio26", "gpio33",
+					"gpio53", "gpio66";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-d7800.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-d7800.dts
new file mode 100644
index 00000000000000..b8273c614ae92c
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-d7800.dts
@@ -0,0 +1,394 @@
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Netgear Nighthawk X4 D7800";
+	compatible = "netgear,d7800", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	reserved-memory {
+		rsvd@5fe00000 {
+			reg = <0x5fe00000 0x200000>;
+			reusable;
+		};
+	};
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+
+		led-boot = &power_white;
+		led-failsafe = &power_amber;
+		led-running = &power_white;
+		led-upgrade = &power_amber;
+	};
+
+	chosen {
+		bootargs = "rootfstype=squashfs noinitrd";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wifi {
+			label = "wifi";
+			gpios = <&qcom_pinmux 6 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		usb1 {
+			label = "white:usb1";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb2 {
+			label = "white:usb2";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+
+		power_amber: power_amber {
+			label = "amber:power";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan_white {
+			label = "white:wan";
+			gpios = <&qcom_pinmux 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan_amber {
+			label = "amber:wan";
+			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_HIGH>;
+		};
+
+		wps {
+			label = "white:wps";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_HIGH>;
+		};
+
+		esata {
+			label = "white:esata";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_HIGH>;
+		};
+
+		power_white: power_white {
+			label = "white:power";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+			default-state = "keep";
+		};
+
+		wifi {
+			label = "white:wifi";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio6", "gpio54", "gpio65";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio7", "gpio8", "gpio9", "gpio22", "gpio23",
+				"gpio24","gpio26", "gpio53", "gpio64";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	usb0_pwr_en_pins: usb0_pwr_en_pins {
+		mux {
+			pins = "gpio15";
+			function = "gpio";
+			drive-strength = <12>;
+			bias-pull-down;
+			output-high;
+		};
+	};
+
+	usb1_pwr_en_pins: usb1_pwr_en_pins {
+		mux {
+			pins = "gpio16", "gpio68";
+			function = "gpio";
+			drive-strength = <12>;
+			bias-pull-down;
+			output-high;
+		};
+	};
+};
+
+&sata_phy {
+	status = "okay";
+};
+
+&sata {
+	status = "okay";
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+
+	pinctrl-0 = <&usb0_pwr_en_pins>;
+	pinctrl-names = "default";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+
+	pinctrl-0 = <&usb1_pwr_en_pins>;
+	pinctrl-names = "default";
+};
+
+&pcie0 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 3 GPIO_ACTIVE_HIGH>;
+	pinctrl-0 = <&pcie0_pins>;
+	pinctrl-names = "default";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_art_6>, <&precal_art_1000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+			mac-address-increment = <(1)>;
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 48 GPIO_ACTIVE_HIGH>;
+	pinctrl-0 = <&pcie1_pins>;
+	pinctrl-names = "default";
+	max-link-speed = <1>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_art_6>, <&precal_art_5000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+			mac-address-increment = <(2)>;
+		};
+	};
+};
+
+&pcie2 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 63 GPIO_ACTIVE_HIGH>;
+	pinctrl-0 = <&pcie2_pins>;
+	pinctrl-names = "default";
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		nand-is-boot-medium;
+		qcom,boot-partitions = <0x0 0x1180000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			qcadata@0 {
+				label = "qcadata";
+				reg = <0x0000000 0x0c80000>;
+				read-only;
+			};
+
+			APPSBL@c80000 {
+				label = "APPSBL";
+				reg = <0x0c80000 0x0500000>;
+				read-only;
+			};
+
+			APPSBLENV@1180000 {
+				label = "APPSBLENV";
+				reg = <0x1180000 0x0080000>;
+				read-only;
+			};
+
+			art@1200000 {
+				label = "art";
+				reg = <0x1200000 0x0140000>;
+				read-only;
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_art_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_art_6: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+
+				precal_art_1000: precal@1000 {
+					reg = <0x1000 0x2f20>;
+				};
+
+				precal_art_5000: precal@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+			};
+
+			artbak: art@1340000 {
+				label = "artbak";
+				reg = <0x1340000 0x0140000>;
+				read-only;
+			};
+
+			kernel@1480000 {
+				label = "kernel";
+				reg = <0x1480000 0x0400000>;
+			};
+
+			ubi@1880000 {
+				label = "ubi";
+				reg = <0x1880000 0x6080000>;
+			};
+
+			reserve@7900000 {
+				label = "reserve";
+				reg = <0x7900000 0x0700000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	nvmem-cells = <&macaddr_art_6>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	nvmem-cells = <&macaddr_art_0>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-db149.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-db149.dts
new file mode 100644
index 00000000000000..f628df919b4872
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-db149.dts
@@ -0,0 +1,179 @@
+#include "qcom-ipq8064-v1.0.dtsi"
+
+/ {
+	model = "Qualcomm IPQ8064/DB149";
+	compatible = "qcom,ipq8064-db149", "qcom,ipq8064";
+
+	aliases {
+		serial0 = &gsbi2_serial;
+	};
+
+	reserved-memory {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+		rsvd@41200000 {
+			reg = <0x41200000 0x300000>;
+			no-map;
+		};
+	};
+};
+
+&qcom_pinmux {
+	rgmii0_pins: rgmii0_pins {
+		mux {
+			pins = "gpio2", "gpio66";
+			drive-strength = <8>;
+			bias-disable;
+		};
+	};
+};
+
+&gsbi2 {
+	qcom,mode = <GSBI_PROT_I2C_UART>;
+	status = "okay";
+
+	gsbi2_serial: serial@12490000 {
+		status = "okay";
+	};
+};
+
+&gsbi4 {
+	status = "disabled";
+};
+
+&gsbi4_serial {
+	status = "disabled";
+};
+
+&flash {
+	m25p,fast-read;
+
+	partition@0 {
+		label = "lowlevel_init";
+		reg = <0x0 0x1b0000>;
+	};
+
+	partition@1 {
+		label = "u-boot";
+		reg = <0x1b0000 0x80000>;
+	};
+
+	partition@2 {
+		label = "u-boot-env";
+		reg = <0x230000 0x40000>;
+	};
+
+	partition@3 {
+		label = "caldata";
+		reg = <0x270000 0x40000>;
+	};
+
+	partition@4 {
+		label = "firmware";
+		reg = <0x2b0000 0x1d50000>;
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+};
+
+&pcie1 {
+	status = "okay";
+};
+
+&pcie2 {
+	status = "okay";
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+		>;
+	};
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+
+	phy6: ethernet-phy@6 {
+		reg = <6>;
+	};
+
+	phy7: ethernet-phy@7 {
+		reg = <7>;
+	};
+};
+
+&gmac0 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <0>;
+	phy-handle = <&phy4>;
+
+	pinctrl-0 = <&rgmii0_pins>;
+	pinctrl-names = "default";
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <1>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+	phy-handle = <&phy6>;
+};
+
+&gmac3 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <3>;
+	phy-handle = <&phy7>;
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-ea7500-v1.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-ea7500-v1.dts
new file mode 100644
index 00000000000000..9d82d52d273ffd
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-ea7500-v1.dts
@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq8064-eax500.dtsi"
+
+/ {
+	model = "Linksys EA7500 V1 WiFi Router";
+	compatible = "linksys,ea7500-v1", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0xe000000>;
+		device_type = "memory";
+	};
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	chosen {
+		/* look for root deviceblock nbr in this bootarg */
+		find-rootblock = "ubi.mtd=";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 68 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		led_power: power {
+			label = "white:power";
+			gpios = <&qcom_pinmux 6 GPIO_ACTIVE_LOW>;
+			default-state = "keep";
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio65", "gpio68";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio6";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+};
+
+&partitions {
+	partition@5f80000 {
+		label = "sysdiag";
+		reg = <0x5f80000 0x100000>;
+	};
+
+	partition@6080000 {
+		label = "syscfg";
+		reg = <0x6080000 0x1f80000>;
+	};
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-ea8500.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-ea8500.dts
new file mode 100644
index 00000000000000..1c6a4bdacd02c2
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-ea8500.dts
@@ -0,0 +1,128 @@
+#include "qcom-ipq8064-eax500.dtsi"
+
+/ {
+	model = "Linksys EA8500 WiFi Router";
+	compatible = "linksys,ea8500", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wifi {
+			label = "wifi";
+			gpios = <&qcom_pinmux 67 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 68 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		wps {
+			label = "green:wps";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_power: power {
+			label = "white:power";
+			gpios = <&qcom_pinmux 6 GPIO_ACTIVE_LOW>;
+			default-state = "keep";
+		};
+
+		wifi {
+			label = "green:wifi";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio65", "gpio67", "gpio68";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio6", "gpio53", "gpio54";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+};
+
+&sata_phy {
+	status = "okay";
+};
+
+&sata {
+	status = "okay";
+};
+
+&partitions {
+	partition@5f80000 {
+		label = "syscfg";
+		reg = <0x5f80000 0x2080000>;
+	};
+};
+
+&mdio0 {
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&gmac1 {
+	qcom,phy_mdio_addr = <4>;
+	qcom,poll_required = <1>;
+	qcom,rgmii_delay = <0>;
+	qcom,emulation = <0>;
+};
+
+/* LAN */
+&gmac2 {
+	qcom,phy_mdio_addr = <0>;	/* none */
+	qcom,poll_required = <0>;	/* no polling */
+	qcom,rgmii_delay = <0>;
+	qcom,emulation = <0>;
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-eax500.dtsi b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-eax500.dtsi
new file mode 100644
index 00000000000000..910bd86bc5ff2c
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-eax500.dtsi
@@ -0,0 +1,232 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	chosen {
+		bootargs = "console=ttyMSM0,115200n8";
+		/* append to bootargs adding the root deviceblock nbr from bootloader */
+		append-rootblock = "ubi.mtd=";
+	};
+};
+
+&qcom_pinmux {
+	/* eax500 routers reuse the pcie2 reset pin for switch reset pin */
+	switch_reset: switch_reset_pins {
+		mux {
+			pins = "gpio63";
+			function = "gpio";
+			drive-strength = <12>;
+			bias-pull-up;
+		};
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+
+	max-link-speed = <1>;
+};
+
+&pcie1 {
+	status = "okay";
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		nand-is-boot-medium;
+		qcom,boot-partitions = <0x0 0x0c80000>;
+
+		partitions: partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "SBL1";
+				reg = <0x0000000 0x0040000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "MIBIB";
+				reg = <0x0040000 0x0140000>;
+				read-only;
+			};
+
+			partition@180000 {
+				label = "SBL2";
+				reg = <0x0180000 0x0140000>;
+				read-only;
+			};
+
+			partition@2c0000 {
+				label = "SBL3";
+				reg = <0x02c0000 0x0280000>;
+				read-only;
+			};
+
+			partition@540000 {
+				label = "DDRCONFIG";
+				reg = <0x0540000 0x0120000>;
+				read-only;
+			};
+
+			partition@660000 {
+				label = "SSD";
+				reg = <0x0660000 0x0120000>;
+				read-only;
+			};
+
+			partition@780000 {
+				label = "TZ";
+				reg = <0x0780000 0x0280000>;
+				read-only;
+			};
+
+			partition@a00000 {
+				label = "RPM";
+				reg = <0x0a00000 0x0280000>;
+				read-only;
+			};
+
+			art: partition@c80000 {
+				label = "art";
+				reg = <0x0c80000 0x0140000>;
+				read-only;
+			};
+
+			partition@dc0000 {
+				label = "APPSBL";
+				reg = <0x0dc0000 0x0100000>;
+				read-only;
+			};
+
+			partition@ec0000 {
+				label = "u_env";
+				reg = <0x0ec0000 0x0040000>;
+			};
+
+			partition@f00000 {
+				label = "s_env";
+				reg = <0x0f00000 0x0040000>;
+			};
+
+			partition@f40000 {
+				label = "devinfo";
+				reg = <0x0f40000 0x0040000>;
+			};
+
+			partition@f80000 {
+				label = "kernel1";
+				reg = <0x0f80000 0x2800000>;  /* 4 MB, spill to rootfs */
+			};
+
+			partition@1380000 {
+				label = "rootfs1";
+				reg = <0x1380000 0x2400000>;
+			};
+
+			partition@3780000 {
+				label = "kernel2";
+				reg = <0x3780000 0x2800000>;
+			};
+
+			partition@3b80000 {
+				label = "rootfs2";
+				reg = <0x3b80000 0x2400000>;
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	/* Switch from documentation require at least 10ms for reset */
+	reset-gpios = <&qcom_pinmux 63 GPIO_ACTIVE_HIGH>;
+	reset-post-delay-us = <12000>;
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x00010 0x2613a0    /* PWS_REG */
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-g10.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-g10.dts
new file mode 100644
index 00000000000000..63a72b53ae734b
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-g10.dts
@@ -0,0 +1,292 @@
+// SPDX-License-Identifier: GPL-2.0
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	compatible = "asrock,g10", "qcom,ipq8064";
+	model = "ASRock G10";
+
+	aliases {
+		ethernet0 = &gmac1;
+		ethernet1 = &gmac0;
+
+		led-boot = &led_status_blue;
+		led-failsafe = &led_status_amber;
+		led-running = &led_status_blue;
+		led-upgrade = &led_status_amber;
+	};
+
+	chosen {
+		bootargs-override = "console=ttyMSM0,115200n8";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		/*
+		 * this is a bit misleading. Because there are about seven
+		 * multicolor LEDs connected all wired together in parallel.
+		 */
+
+		status_yellow {
+			label = "yellow:status";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_amber: status_amber {
+			label = "amber:status";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_blue: status_blue {
+			label = "blue:status";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		/*
+		 * LED is declared in vendors boardfile but it's not
+		 * working and the manual doesn't mention anything
+		 * about the LED being white.
+
+		status_white {
+			label = "white:status";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_HIGH>;
+		};
+		*/
+	};
+
+	i2c-gpio {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		compatible = "i2c-gpio";
+		gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>, /* sda */
+			<&qcom_pinmux 54 GPIO_ACTIVE_HIGH>; /* scl */
+		i2c-gpio,delay-us = <5>;
+		i2c-gpio,scl-output-only;
+
+		mcu@50 {
+			reg = <0x50>;
+			compatible = "sonix,sn8f25e21";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		ir-remote {
+			label = "ir-remote";
+			gpios = <&qcom_pinmux 15 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 16 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps5g {
+			label = "wps5g";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps2g {
+			label = "wps2g";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&gmac1 {
+	status = "okay";
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gsbi4_serial {
+	pinctrl-0 = <&uart0_pins>;
+	pinctrl-names = "default";
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		nand-is-boot-medium;
+		qcom,boot-partitions = <0x0 0x1200000>;
+
+		partitions {
+			compatible = "qcom,smem-part";
+		};
+	};
+};
+
+&pcie0 {
+	status = "okay";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi5g: wifi@1,0 {
+			reg = <0x00010000 0 0 0 0>;
+			compatible = "qcom,ath10k";
+			qcom,ath10k-calibration-variant = "ASRock-G10";
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi2g: wifi@1,0 {
+			reg = <0x00010000 0 0 0 0>;
+			compatible = "qcom,ath10k";
+			qcom,ath10k-calibration-variant = "ASRock-G10";
+		};
+	};
+};
+
+&qcom_pinmux {
+	led_pins: led_pins {
+		mux {
+			pins = "gpio7", "gpio8", "gpio9", "gpio26";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	button_pins: button_pins {
+		mux {
+			pins = "gpio15", "gpio16", "gpio64", "gpio65";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	uart0_pins: uart0_pins {
+		mux {
+			pins = "gpio10", "gpio11";
+			function = "gsbi4";
+			drive-strength = <10>;
+			bias-disable;
+		};
+	};
+};
+
+&rpm {
+	pinctrl-0 = <&i2c4_pins>;
+	pinctrl-names = "default";
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&tcsr {
+	qcom,usb-ctrl-select = <TCSR_USB_SELECT_USB3_DUAL>;
+};
+
+/delete-node/ &pcie2_pins;
+/delete-node/ &pcie2;
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-onhub.dtsi b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-onhub.dtsi
new file mode 100644
index 00000000000000..549c46202619b6
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-onhub.dtsi
@@ -0,0 +1,491 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright 2014 The ChromiumOS Authors
+ */
+
+#include "qcom-ipq8064-smb208.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	aliases {
+		ethernet0 = &gmac0;
+		ethernet1 = &gmac2;
+		mdio-gpio0 = &mdio;
+		serial0 = &gsbi4_serial;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	reserved-memory {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+
+		rsvd@41200000 {
+			reg = <0x41200000 0x300000>;
+			no-map;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 16 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		dev {
+			label = "dev";
+			gpios = <&qcom_pinmux 15 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_CONFIG>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	mdio: mdio {
+		compatible = "virtual,mdio-gpio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		gpios = <&qcom_pinmux 1 GPIO_ACTIVE_HIGH>,
+			<&qcom_pinmux 0 GPIO_ACTIVE_HIGH>;
+		pinctrl-0 = <&mdio_pins>;
+		pinctrl-names = "default";
+
+		phy0: ethernet-phy@0 {
+			reg = <0>;
+			qca,ar8327-initvals = <
+				0x00004 0x7600000   /* PAD0_MODE */
+				0x00008 0x1000000   /* PAD5_MODE */
+				0x0000c 0x80        /* PAD6_MODE */
+				0x000e4 0xaa545     /* MAC_POWER_SEL */
+				0x000e0 0xc74164de  /* SGMII_CTRL */
+				0x0007c 0x4e        /* PORT0_STATUS */
+				0x00094 0x4e        /* PORT6_STATUS */
+				>;
+		};
+
+		phy1: ethernet-phy@1 {
+			reg = <1>;
+		};
+	};
+
+	soc {
+		rng@1a500000 {
+			status = "disabled";
+		};
+
+		sound {
+			compatible = "google,storm-audio";
+			qcom,model = "ipq806x-storm";
+			cpu = <&lpass>;
+			codec = <&max98357a>;
+		};
+
+		lpass: lpass@28100000 {
+			status = "okay";
+			pinctrl-names = "default", "idle";
+			pinctrl-0 = <&mi2s_default>;
+			pinctrl-1 = <&mi2s_idle>;
+		};
+
+		max98357a: max98357a {
+			compatible = "maxim,max98357a";
+			#sound-dai-cells = <1>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sdmode_pins>;
+			sdmode-gpios = <&qcom_pinmux 25 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	rgmii0_pins: rgmii0_pins {
+		mux {
+			pins = "gpio2", "gpio66";
+			drive-strength = <8>;
+			bias-disable;
+		};
+	};
+	mi2s_pins {
+		mi2s_default: mi2s_default {
+			dout {
+				pins = "gpio32";
+				function = "mi2s";
+				drive-strength = <16>;
+				bias-disable;
+			};
+			sync {
+				pins = "gpio27";
+				function = "mi2s";
+				drive-strength = <16>;
+				bias-disable;
+			};
+			clk {
+				pins = "gpio28";
+				function = "mi2s";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+		mi2s_idle: mi2s_idle {
+			dout {
+				pins = "gpio32";
+				function = "mi2s";
+				drive-strength = <2>;
+				bias-pull-down;
+			};
+			sync {
+				pins = "gpio27";
+				function = "mi2s";
+				drive-strength = <2>;
+				bias-pull-down;
+			};
+			clk {
+				pins = "gpio28";
+				function = "mi2s";
+				drive-strength = <2>;
+				bias-pull-down;
+			};
+		};
+	};
+
+	mdio_pins: mdio_pins {
+		mux {
+			pins = "gpio0", "gpio1";
+			function = "gpio";
+			drive-strength = <8>;
+			bias-disable;
+		};
+		rst {
+			pins = "gpio26";
+			output-low;
+		};
+	};
+
+	sdmode_pins: sdmode_pinmux {
+		pins = "gpio25";
+		function = "gpio";
+		drive-strength = <16>;
+		bias-disable;
+	};
+
+	sdcc1_pins: sdcc1_pinmux {
+		mux {
+			pins = "gpio38", "gpio39", "gpio40",
+			       "gpio41", "gpio42", "gpio43",
+			       "gpio44", "gpio45", "gpio46",
+			       "gpio47";
+			function = "sdc1";
+		};
+		cmd {
+			pins = "gpio45";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+		data {
+			pins = "gpio38", "gpio39", "gpio40",
+			       "gpio41", "gpio43", "gpio44",
+			       "gpio46", "gpio47";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+		clk {
+			pins = "gpio42";
+			drive-strength = <16>;
+			bias-pull-down;
+		};
+	};
+
+	i2c1_pins: i2c1_pinmux {
+		pins = "gpio53", "gpio54";
+		function = "gsbi1";
+		bias-disable;
+	};
+
+	rpm_i2c_pinmux: rpm_i2c_pinmux {
+		mux {
+			pins = "gpio12", "gpio13";
+			function = "gsbi4";
+			drive-strength = <12>;
+			bias-disable;
+		};
+	};
+
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19", "gpio21";
+			function = "gsbi5";
+			bias-pull-down;
+			/delete-property/ bias-none;
+			/delete-property/ drive-strength;
+		};
+		data {
+			pins = "gpio18", "gpio19";
+			drive-strength = <10>;
+		};
+		cs {
+			pins = "gpio20";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+		clk {
+			pins = "gpio21";
+			drive-strength = <12>;
+		};
+	};
+
+	fw_pinmux {
+		wp {
+			pins = "gpio17";
+			output-low;
+		};
+	};
+
+	button_pins: button_pins {
+		recovery {
+			pins = "gpio16";
+			function = "gpio";
+			bias-none;
+		};
+		developer {
+			pins = "gpio15";
+			function = "gpio";
+			bias-none;
+		};
+	};
+
+	spi6_pins: spi6_pins {
+		mux {
+			pins = "gpio55", "gpio56", "gpio58";
+			function = "gsbi6";
+			bias-pull-down;
+		};
+		data {
+			pins = "gpio55", "gpio56";
+			drive-strength = <10>;
+		};
+		cs {
+			pins = "gpio57";
+			drive-strength = <10>;
+			bias-pull-up;
+			output-high;
+		};
+		clk {
+			pins = "gpio58";
+			drive-strength = <12>;
+		};
+	};
+};
+
+&gmac0 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <0>;
+	phy-handle = <&phy1>;
+
+	pinctrl-0 = <&rgmii0_pins>;
+	pinctrl-names = "default";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+	phy-handle = <&phy0>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gsbi1 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_I2C_UART>;
+};
+
+&gsbi1_i2c {
+	status = "okay";
+
+	clock-frequency = <100000>;
+
+	pinctrl-0 = <&i2c1_pins>;
+	pinctrl-names = "default";
+
+	tpm@20 {
+		compatible = "infineon,slb9645tt";
+		reg = <0x20>;
+		powered-while-suspended;
+	};
+};
+
+&gsbi4 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_I2C_UART>;
+};
+
+&gsbi4_serial {
+	status = "okay";
+};
+
+&gsbi5 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_SPI>;
+
+	spi4: spi@1a280000 {
+		status = "okay";
+		spi-max-frequency = <50000000>;
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 0>;
+
+		flash: flash@0 {
+			compatible = "jedec,spi-nor";
+			spi-max-frequency = <50000000>;
+			reg = <0>;
+		};
+	};
+};
+
+&gsbi6 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_SPI>;
+};
+
+&gsbi6_spi {
+	status = "okay";
+	spi-max-frequency = <25000000>;
+
+	pinctrl-0 = <&spi6_pins>;
+	pinctrl-names = "default";
+
+	cs-gpios = <&qcom_pinmux 57 GPIO_ACTIVE_HIGH>;
+
+	dmas = <&adm_dma 8 0xb>,
+	       <&adm_dma 7 0x14>;
+	dma-names = "rx", "tx";
+
+	/*
+	 * This "spidev" was included in the manufacturer device tree. I suspect
+	 * it's the (unused) Zigbee radio -- SiliconLabs EM3581 Zigbee? There's
+	 * no driver or binding for this at the moment.
+	 */
+	spidev@0 {
+		compatible = "spidev";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+	};
+};
+
+&pcie0 {
+	status = "okay";
+
+	pcie@0 {
+		reg = <0 0 0 0 0>;
+		#interrupt-cells = <1>;
+		#size-cells = <2>;
+		#address-cells = <3>;
+		device_type = "pci";
+
+		ath10k@0,0 {
+			reg = <0 0 0 0 0>;
+			device_type = "pci";
+			qcom,ath10k-sa-gpio = <2 3 4 0>;
+			qcom,ath10k-sa-gpio-func = <5 5 5 0>;
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+
+	pcie@0 {
+		reg = <0 0 0 0 0>;
+		#interrupt-cells = <1>;
+		#size-cells = <2>;
+		#address-cells = <3>;
+		device_type = "pci";
+
+		ath10k@0,0 {
+			reg = <0 0 0 0 0>;
+			device_type = "pci";
+			qcom,ath10k-sa-gpio = <2 3 4 0>;
+			qcom,ath10k-sa-gpio-func = <5 5 5 0>;
+		};
+	};
+};
+
+&pcie2 {
+	status = "okay";
+
+	pcie@0 {
+		reg = <0 0 0 0 0>;
+		#interrupt-cells = <1>;
+		#size-cells = <2>;
+		#address-cells = <3>;
+		device_type = "pci";
+
+		ath10k@0,0 {
+			reg = <0 0 0 0 0>;
+			device_type = "pci";
+		};
+	};
+};
+
+&rpm {
+	pinctrl-0 = <&rpm_i2c_pinmux>;
+	pinctrl-names = "default";
+};
+
+&sdcc1 {
+	status = "okay";
+	pinctrl-0 = <&sdcc1_pins>;
+	pinctrl-names = "default";
+	/delete-property/ mmc-ddr-1_8v;
+};
+
+&tcsr {
+	compatible = "qcom,tcsr-ipq8064", "qcom,tcsr", "syscon";
+	qcom,usb-ctrl-select = <TCSR_USB_SELECT_USB3_DUAL>;
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-r7500.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-r7500.dts
new file mode 100644
index 00000000000000..7bea5b6bcebb24
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-r7500.dts
@@ -0,0 +1,327 @@
+#include "qcom-ipq8064-v1.0.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	model = "Netgear Nighthawk X4 R7500";
+	compatible = "netgear,r7500", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0xe000000>;
+		device_type = "memory";
+	};
+
+	reserved-memory {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+		rsvd@41200000 {
+			reg = <0x41200000 0x300000>;
+			no-map;
+		};
+	};
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+
+		led-boot = &power_white;
+		led-failsafe = &power_amber;
+		led-running = &power_white;
+		led-upgrade = &power_amber;
+	};
+
+	chosen {
+		bootargs = "rootfstype=squashfs noinitrd";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wifi {
+			label = "wifi";
+			gpios = <&qcom_pinmux 6 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		usb1 {
+			label = "white:usb1";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb2 {
+			label = "white:usb2";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+
+		power_amber: power_amber {
+			label = "amber:power";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan_white {
+			label = "white:wan";
+			gpios = <&qcom_pinmux 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan_amber {
+			label = "amber:wan";
+			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_HIGH>;
+		};
+
+		wps {
+			label = "white:wps";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_HIGH>;
+		};
+
+		esata {
+			label = "white:esata";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_HIGH>;
+		};
+
+		power_white: power_white {
+			label = "white:power";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+			default-state = "keep";
+		};
+
+		wifi {
+			label = "white:wifi";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio6", "gpio54", "gpio65";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio7", "gpio8", "gpio9", "gpio22", "gpio23",
+				"gpio24","gpio26", "gpio53", "gpio64";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+};
+
+&gsbi5 {
+	status = "disabled";
+
+	spi@1a280000 {
+		status = "disabled";
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+};
+
+&pcie1 {
+	status = "okay";
+	max-link-speed = <1>;
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		nand-is-boot-medium;
+		qcom,boot-partitions = <0x0 0x1180000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			qcadata@0 {
+				label = "qcadata";
+				reg = <0x0000000 0x0c80000>;
+				read-only;
+			};
+
+			APPSBL@c80000 {
+				label = "APPSBL";
+				reg = <0x0c80000 0x0500000>;
+				read-only;
+			};
+
+			APPSBLENV@1180000 {
+				label = "APPSBLENV";
+				reg = <0x1180000 0x0080000>;
+				read-only;
+			};
+
+			art: art@1200000 {
+				label = "art";
+				reg = <0x1200000 0x0140000>;
+				read-only;
+			};
+
+			kernel@1340000 {
+				label = "kernel";
+				reg = <0x1340000 0x0400000>;
+			};
+
+			ubi@1740000 {
+				label = "ubi";
+				reg = <0x1740000 0x1600000>;
+			};
+
+			netgear@2d40000 {
+				label = "netgear";
+				reg = <0x2d40000 0x0c00000>;
+				read-only;
+			};
+
+			reserve@3940000 {
+				label = "reserve";
+				reg = <0x3940000 0x46c0000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	nvmem-cells = <&macaddr_art_6>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	nvmem-cells = <&macaddr_art_0>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&tcsr {
+	qcom,usb-ctrl-select = <TCSR_USB_SELECT_USB3_DUAL>;
+	compatible = "qcom,tcsr";
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&art {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_art_0: macaddr@0 {
+		reg = <0x0 0x6>;
+	};
+
+	macaddr_art_6: macaddr@6 {
+		reg = <0x6 0x6>;
+	};
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-r7500v2.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-r7500v2.dts
new file mode 100644
index 00000000000000..6f0ba09c8725c5
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-r7500v2.dts
@@ -0,0 +1,387 @@
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Netgear Nighthawk X4 R7500v2";
+	compatible = "netgear,r7500v2", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	reserved-memory {
+		rsvd@5fe00000 {
+			reg = <0x5fe00000 0x200000>;
+			reusable;
+		};
+	};
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+
+		led-boot = &power;
+		led-failsafe = &power;
+		led-running = &power;
+		led-upgrade = &power;
+	};
+
+	chosen {
+		bootargs = "rootfstype=squashfs noinitrd";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wifi {
+			label = "wifi";
+			gpios = <&qcom_pinmux 6 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		usb1 {
+			label = "amber:usb1";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb3 {
+			label = "amber:usb3";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+
+		status {
+			label = "amber:status";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		internet {
+			label = "white:internet";
+			gpios = <&qcom_pinmux 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan {
+			label = "white:wan";
+			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_HIGH>;
+		};
+
+		wps {
+			label = "white:wps";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_HIGH>;
+		};
+
+		esata {
+			label = "white:esata";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_HIGH>;
+		};
+
+		power: power {
+			label = "white:power";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+			default-state = "keep";
+		};
+
+		wifi {
+			label = "white:wifi";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio6", "gpio54", "gpio65";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio7", "gpio8", "gpio9", "gpio22", "gpio23",
+				"gpio24","gpio26", "gpio53", "gpio64";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	usb0_pwr_en_pins: usb0_pwr_en_pins {
+		mux {
+			pins = "gpio15";
+			function = "gpio";
+			drive-strength = <12>;
+			bias-pull-down;
+			output-high;
+		};
+	};
+
+	usb1_pwr_en_pins: usb1_pwr_en_pins {
+		mux {
+			pins = "gpio16", "gpio68";
+			function = "gpio";
+			drive-strength = <12>;
+			bias-pull-down;
+			output-high;
+		};
+	};
+};
+
+&sata_phy {
+	status = "okay";
+};
+
+&sata {
+	status = "okay";
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+
+	pinctrl-0 = <&usb0_pwr_en_pins>;
+	pinctrl-names = "default";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+
+	pinctrl-0 = <&usb1_pwr_en_pins>;
+	pinctrl-names = "default";
+};
+
+&pcie0 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 3 GPIO_ACTIVE_LOW>;
+	pinctrl-0 = <&pcie0_pins>;
+	pinctrl-names = "default";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_art_6>, <&precal_art_1000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+			mac-address-increment = <(1)>;
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 48 GPIO_ACTIVE_LOW>;
+	pinctrl-0 = <&pcie1_pins>;
+	pinctrl-names = "default";
+	max-link-speed = <1>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_art_6>, <&precal_art_5000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+			mac-address-increment = <(2)>;
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		nand-is-boot-medium;
+		qcom,boot-partitions = <0x0 0x1180000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			qcadata@0 {
+				label = "qcadata";
+				reg = <0x0000000 0x0c80000>;
+				read-only;
+			};
+
+			APPSBL@c80000 {
+				label = "APPSBL";
+				reg = <0x0c80000 0x0500000>;
+				read-only;
+			};
+
+			APPSBLENV@1180000 {
+				label = "APPSBLENV";
+				reg = <0x1180000 0x0080000>;
+				read-only;
+			};
+
+			art@1200000 {
+				label = "art";
+				reg = <0x1200000 0x0140000>;
+				read-only;
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_art_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_art_6: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+
+				precal_art_1000: precal@1000 {
+					reg = <0x1000 0x2f20>;
+				};
+
+				precal_art_5000: precal@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+			};
+
+			artbak: art@1340000 {
+				label = "artbak";
+				reg = <0x1340000 0x0140000>;
+				read-only;
+			};
+
+			kernel@1480000 {
+				label = "kernel";
+				reg = <0x1480000 0x0400000>;
+			};
+
+			ubi@1880000 {
+				label = "ubi";
+				reg = <0x1880000 0x6080000>;
+			};
+
+			reserve@7900000 {
+				label = "reserve";
+				reg = <0x7900000 0x0700000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0xaa545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	nvmem-cells = <&macaddr_art_6>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	nvmem-cells = <&macaddr_art_0>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-tplink-onhub.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-tplink-onhub.dts
new file mode 100644
index 00000000000000..6adc6be4aec61b
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-tplink-onhub.dts
@@ -0,0 +1,209 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright 2014 The ChromiumOS Authors
+ */
+
+#include "qcom-ipq8064-onhub.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/soc/qcom,gsbi.h>
+
+/ {
+	model = "TP-Link OnHub";
+	compatible = "tplink,onhub", "google,whirlwind-sp5", "qcom,ipq8064";
+};
+
+&qcom_pinmux {
+	i2c7_pins: i2c7_pinmux {
+		mux {
+			pins = "gpio8", "gpio9";
+			function = "gsbi7";
+		};
+		data {
+			pins = "gpio8";
+			bias-disable;
+		};
+		clk {
+			pins = "gpio9";
+			bias-disable;
+		};
+	};
+};
+
+&gsbi7 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_I2C_UART>;
+};
+
+&gsbi7_i2c {
+	status = "okay";
+	clock-frequency = <100000>;
+	pinctrl-0 = <&i2c7_pins>;
+	pinctrl-names = "default";
+
+	led-controller@32 {
+		compatible = "national,lp5523";
+		reg = <0x32>;
+		clock-mode = /bits/ 8 <1>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		led@0 {
+			reg = <0>;
+			color = <LED_COLOR_ID_RED>;
+			chan-name = "red:status-0";
+			linux,default-trigger = "default-on";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@1 {
+			reg = <1>;
+			color = <LED_COLOR_ID_GREEN>;
+			chan-name = "green:status-0";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@2 {
+			reg = <2>;
+			color = <LED_COLOR_ID_BLUE>;
+			chan-name = "blue:status-0";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@3 {
+			reg = <3>;
+			color = <LED_COLOR_ID_RED>;
+			chan-name = "red:status-1";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@4 {
+			reg = <4>;
+			color = <LED_COLOR_ID_GREEN>;
+			chan-name = "green:status-1";
+			linux,default-trigger = "default-on";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@5 {
+			reg = <5>;
+			color = <LED_COLOR_ID_BLUE>;
+			chan-name = "blue:status-1";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@6 {
+			reg = <6>;
+			color = <LED_COLOR_ID_RED>;
+			chan-name = "red:status-2";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@7 {
+			reg = <7>;
+			color = <LED_COLOR_ID_GREEN>;
+			chan-name = "green:status-2";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@8 {
+			reg = <8>;
+			color = <LED_COLOR_ID_BLUE>;
+			chan-name = "blue:status-2";
+			linux,default-trigger = "default-on";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+	};
+
+	led-controller@33 {
+		compatible = "national,lp5523";
+		reg = <0x33>;
+		clock-mode = /bits/ 8 <1>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		led@0 {
+			reg = <0>;
+			color = <LED_COLOR_ID_RED>;
+			chan-name = "red:status-3";
+			linux,default-trigger = "default-on";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@1 {
+			reg = <1>;
+			color = <LED_COLOR_ID_GREEN>;
+			chan-name = "green:status-3";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@2 {
+			reg = <2>;
+			color = <LED_COLOR_ID_BLUE>;
+			chan-name = "blue:status-3";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@3 {
+			reg = <3>;
+			color = <LED_COLOR_ID_RED>;
+			chan-name = "red:status-4";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@4 {
+			reg = <4>;
+			color = <LED_COLOR_ID_GREEN>;
+			chan-name = "green:status-4";
+			linux,default-trigger = "default-on";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@5 {
+			reg = <5>;
+			color = <LED_COLOR_ID_BLUE>;
+			chan-name = "blue:status-4";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@6 {
+			reg = <6>;
+			color = <LED_COLOR_ID_RED>;
+			chan-name = "red:status-5";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@7 {
+			reg = <7>;
+			color = <LED_COLOR_ID_GREEN>;
+			chan-name = "green:status-5";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@8 {
+			reg = <8>;
+			color = <LED_COLOR_ID_BLUE>;
+			chan-name = "blue:status-5";
+			linux,default-trigger = "default-on";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+	};
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-unifi-ac-hd.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-unifi-ac-hd.dts
new file mode 100644
index 00000000000000..90927ddb856cc8
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-unifi-ac-hd.dts
@@ -0,0 +1,315 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Ubiquiti UniFi AC HD";
+	compatible = "ubnt,unifi-ac-hd", "qcom,ipq8064";
+
+	aliases {
+		label-mac-device = &gmac2;
+		led-boot = &led_dome_white;
+		led-failsafe = &led_dome_white;
+		led-running = &led_dome_blue;
+		led-upgrade = &led_dome_blue;
+		mdio-gpio0 = &mdio0;
+		ethernet0 = &gmac2;
+		ethernet1 = &gmac1;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		led_dome_blue: dome_blue {
+			label = "blue:dome";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_dome_white: dome_white {
+			label = "white:dome";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 68 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio68";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio9", "gpio53";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+			output-low;
+		};
+	};
+
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19", "gpio21";
+			function = "gsbi5";
+			drive-strength = <10>;
+			bias-none;
+		};
+
+		cs {
+			pins = "gpio20";
+			drive-strength = <12>;
+		};
+	};
+};
+
+&CPU_SPC {
+	status = "disabled";
+};
+
+&gsbi5 {
+	status = "okay";
+
+	qcom,mode = <GSBI_PROT_SPI>;
+
+	spi@1a280000 {
+		status = "okay";
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+		cs-gpios = <&qcom_pinmux 20 0>;
+
+		flash@0 {
+			compatible = "mx25u25635f", "jedec,spi-nor";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			spi-max-frequency = <50000000>;
+			reg = <0>;
+			m25p,fast-read;
+
+			partitions {
+				compatible = "fixed-partitions";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				partition@0 {
+					label = "SBL1";
+					reg = <0x0 0x20000>;
+					read-only;
+				};
+
+				partition@20000 {
+					label = "MIBIB";
+					reg = <0x20000 0x10000>;
+					read-only;
+				};
+
+				partition@30000 {
+					label = "SBL2";
+					reg = <0x30000 0x20000>;
+					read-only;
+				};
+
+				partition@50000 {
+					label = "SBL3";
+					reg = <0x50000 0x30000>;
+					read-only;
+				};
+
+				partition@80000 {
+					label = "DDRCONFIG";
+					reg = <0x80000 0x10000>;
+					read-only;
+				};
+
+				partition@90000 {
+					label = "SSD";
+					reg = <0x90000 0x10000>;
+					read-only;
+				};
+
+				partition@a0000 {
+					label = "TZ";
+					reg = <0xa0000 0x30000>;
+					read-only;
+				};
+
+				partition@d0000 {
+					label = "RPM";
+					reg = <0xd0000 0x20000>;
+					read-only;
+				};
+
+				partition@f0000 {
+					label = "APPSBL";
+					reg = <0xf0000 0xc0000>;
+					read-only;
+				};
+
+				partition@1b0000 {
+					label = "APPSBLENV";
+					reg = <0x1b0000 0x10000>;
+					read-only;
+				};
+
+				eeprom: partition@1c0000 {
+					label = "EEPROM";
+					reg = <0x1c0000 0x10000>;
+					read-only;
+				};
+
+				partition@1d0000 {
+					label = "bootselect";
+					reg = <0x1d0000 0x10000>;
+				};
+
+				partition@1e0000 {
+					compatible = "denx,fit";
+					label = "firmware";
+					reg = <0x1e0000 0xe70000>;
+				};
+
+				partition@1050000 {
+					label = "kernel1";
+					reg = <0x1050000 0xe70000>;
+					read-only;
+				};
+
+				partition@1ec0000 {
+					label = "debug";
+					reg = <0x1ec0000 0x100000>;
+					read-only;
+				};
+
+				partition@1fc0000 {
+					label = "cfg";
+					reg = <0x1fc0000 0x40000>;
+					read-only;
+				};
+			};
+		};
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&nand {
+	status = "okay";
+
+	nand-ecc-strength = <4>;
+	nand-bus-width = <8>;
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+
+	phy5: ethernet-phy@5 {
+		reg = <5>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+
+	mdiobus = <&mdio0>;
+	phy-handle = <&phy5>;
+	phy-mode = "sgmii";
+	qcom,id = <1>;
+
+	nvmem-cells = <&macaddr_eeprom_6>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac2 {
+	status = "okay";
+
+	mdiobus = <&mdio0>;
+	phy-handle = <&phy4>;
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	nvmem-cells = <&macaddr_eeprom_0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&pcie0 {
+	status = "okay";
+};
+
+&pcie1 {
+	status = "okay";
+};
+
+&tcsr {
+	status = "okay";
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&eeprom {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_eeprom_0: macaddr@0 {
+		reg = <0x0 0x6>;
+	};
+
+	macaddr_eeprom_6: macaddr@6 {
+		reg = <0x6 0x6>;
+	};
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-vr2600v.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-vr2600v.dts
new file mode 100644
index 00000000000000..b0db8c88635cd6
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-vr2600v.dts
@@ -0,0 +1,424 @@
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "TP-Link Archer VR2600v";
+	compatible = "tplink,vr2600v", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+
+		led-boot = &power;
+		led-failsafe = &general;
+		led-running = &power;
+		led-upgrade = &general;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wifi {
+			label = "wifi";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		dect {
+			label = "dect";
+			gpios = <&qcom_pinmux 67 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_PHONE>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		ledswitch {
+			label = "ledswitch";
+			gpios = <&qcom_pinmux 68 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_LIGHTS_TOGGLE>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		dsl {
+			label = "white:dsl";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb {
+			label = "white:usb";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan {
+			label = "white:lan";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan2g {
+			label = "white:wlan2g";
+			gpios = <&qcom_pinmux 16 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan5g {
+			label = "white:wlan5g";
+			gpios = <&qcom_pinmux 17 GPIO_ACTIVE_HIGH>;
+		};
+
+		power: power {
+			label = "white:power";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_HIGH>;
+			default-state = "keep";
+		};
+
+		phone {
+			label = "white:phone";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan {
+			label = "white:wan";
+			gpios = <&qcom_pinmux 56 GPIO_ACTIVE_HIGH>;
+		};
+
+		general: general {
+			label = "white:general";
+			gpios = <&qcom_pinmux 66 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	led_pins: led_pins {
+		mux {
+			pins = "gpio7", "gpio8", "gpio9", "gpio16", "gpio17",
+				"gpio26", "gpio53", "gpio56", "gpio66";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	button_pins: button_pins {
+		mux {
+			pins = "gpio54", "gpio64", "gpio65", "gpio67", "gpio68";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19", "gpio21";
+			function = "gsbi5";
+			bias-pull-down;
+		};
+
+		data {
+			pins = "gpio18", "gpio19";
+			drive-strength = <10>;
+		};
+
+		cs {
+			pins = "gpio20";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+
+		clk {
+			pins = "gpio21";
+			drive-strength = <12>;
+		};
+	};
+};
+
+&gsbi5 {
+	qcom,mode = <GSBI_PROT_SPI>;
+	status = "okay";
+
+	spi4: spi@1a280000 {
+		status = "okay";
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
+
+		flash@0 {
+			compatible = "jedec,spi-nor";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			spi-max-frequency = <50000000>;
+			reg = <0>;
+
+			partitions {
+				compatible = "fixed-partitions";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				partition@0 {
+					label = "SBL1";
+					reg = <0x0 0x20000>;
+					read-only;
+				};
+
+				partition@20000 {
+					label = "MIBIB";
+					reg = <0x20000 0x20000>;
+					read-only;
+				};
+
+				partition@40000 {
+					label = "SBL2";
+					reg = <0x40000 0x40000>;
+					read-only;
+				};
+
+				partition@80000 {
+					label = "SBL3";
+					reg = <0x80000 0x80000>;
+					read-only;
+				};
+
+				partition@100000 {
+					label = "DDRCONFIG";
+					reg = <0x100000 0x10000>;
+					read-only;
+				};
+
+				partition@110000 {
+					label = "SSD";
+					reg = <0x110000 0x10000>;
+					read-only;
+				};
+
+				partition@120000 {
+					label = "TZ";
+					reg = <0x120000 0x80000>;
+					read-only;
+				};
+
+				partition@1a0000 {
+					label = "RPM";
+					reg = <0x1a0000 0x80000>;
+					read-only;
+				};
+
+				partition@220000 {
+					label = "APPSBL";
+					reg = <0x220000 0x80000>;
+					read-only;
+				};
+
+				partition@2a0000 {
+					label = "APPSBLENV";
+					reg = <0x2a0000 0x40000>;
+					read-only;
+				};
+
+				partition@2e0000 {
+					label = "OLDART";
+					reg = <0x2e0000 0x40000>;
+					read-only;
+				};
+
+				partition@320000 {
+					label = "firmware";
+					reg = <0x320000 0xc60000>;
+					compatible = "openwrt,uimage";
+					openwrt,offset = <512>; /* account for pad-extra 512 */
+				};
+
+				/* hole 0xf80000 - 0xfaf100 */
+
+				partition@faf100 {
+					label = "default-mac";
+					reg = <0xfaf100 0x00200>;
+					read-only;
+
+					compatible = "nvmem-cells";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_defaultmac_0: macaddr@0 {
+						reg = <0x0 0x6>;
+					};
+				};
+
+				partition@fc0000 {
+					label = "ART";
+					reg = <0xfc0000 0x40000>;
+					read-only;
+
+					compatible = "nvmem-cells";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					precal_ART_1000: precal@1000 {
+						reg = <0x1000 0x2f20>;
+					};
+
+					precal_ART_5000: precal@5000 {
+						reg = <0x5000 0x2f20>;
+					};
+				};
+			};
+		};
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_defaultmac_0>, <&precal_ART_1000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+			mac-address-increment = <(-1)>;
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+	max-link-speed = <1>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_defaultmac_0>, <&precal_ART_5000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	nvmem-cells = <&macaddr_defaultmac_0>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <1>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	nvmem-cells = <&macaddr_defaultmac_0>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-wg2600hp.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-wg2600hp.dts
new file mode 100644
index 00000000000000..431c9cd9af8480
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-wg2600hp.dts
@@ -0,0 +1,463 @@
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "NEC Aterm WG2600HP";
+	compatible = "nec,wg2600hp", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+
+		led-boot = &power_green;
+		led-failsafe = &power_red;
+		led-running = &power_green;
+		led-upgrade = &power_green;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 16 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		bridge {
+			label = "bridge";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+			linux,input-type = <EV_SW>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		converter {
+			label = "converter";
+			gpios = <&qcom_pinmux 25 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+			linux,input-type = <EV_SW>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		converter_green {
+			label = "green:converter";
+			gpios = <&qcom_pinmux 6 GPIO_ACTIVE_HIGH>;
+		};
+
+		power_red: power_red {
+			label = "red:power";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		active_green {
+			label = "green:active";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+
+		active_red {
+			label = "red:active";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		power_green: power_green {
+			label = "green:power";
+			gpios = <&qcom_pinmux 14 GPIO_ACTIVE_HIGH>;
+		};
+
+		converter_red {
+			label = "red:converter";
+			gpios = <&qcom_pinmux 15 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan2g_green {
+			label = "green:wlan2g";
+			gpios = <&qcom_pinmux 55 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan2g_red {
+			label = "red:wlan2g";
+			gpios = <&qcom_pinmux 56 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan5g_green {
+			label = "green:wlan5g";
+			gpios = <&qcom_pinmux 57 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan5g_red {
+			label = "red:wlan5g";
+			gpios = <&qcom_pinmux 58 GPIO_ACTIVE_HIGH>;
+		};
+
+		tv_green {
+			label = "green:tv";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_HIGH>;
+		};
+
+		tv_red {
+			label = "red:tv";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&CPU_SPC {
+	status = "disabled";
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x06000000  /* PAD0_MODE */
+			0x0000c 0x00080080  /* PAD6_MODE */
+			0x000e4 0x0006a545  /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x0000004e  /* PORT0_STATUS */
+			0x00094 0x0000004e  /* PORT6_STATUS */
+			>;
+	};
+
+	ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	nvmem-cells = <&macaddr_PRODUCTDATA_6>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	nvmem-cells = <&macaddr_PRODUCTDATA_0>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gsbi5 {
+	status = "okay";
+
+	qcom,mode = <GSBI_PROT_SPI>;
+
+	spi@1a280000 {
+		status = "okay";
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
+
+		flash@0 {
+			compatible = "jedec,spi-nor";
+			spi-max-frequency = <50000000>;
+			reg = <0>;
+
+			partitions {
+				compatible = "fixed-partitions";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				SBL1@0 {
+					label = "SBL1";
+					reg = <0x0 0x20000>;
+					read-only;
+				};
+
+				MIBIB@20000 {
+					label = "MIBIB";
+					reg = <0x20000 0x20000>;
+					read-only;
+				};
+
+				SBL2@40000 {
+					label = "SBL2";
+					reg = <0x40000 0x40000>;
+					read-only;
+				};
+
+				SBL3@80000 {
+					label = "SBL3";
+					reg = <0x80000 0x80000>;
+					read-only;
+				};
+
+				DDRCONFIG@100000 {
+					label = "DDRCONFIG";
+					reg = <0x100000 0x10000>;
+					read-only;
+				};
+
+				SSD@110000 {
+					label = "SSD";
+					reg = <0x110000 0x10000>;
+					read-only;
+				};
+
+				TZ@120000 {
+					label = "TZ";
+					reg = <0x120000 0x80000>;
+					read-only;
+				};
+
+				RPM@1a0000 {
+					label = "RPM";
+					reg = <0x1a0000 0x80000>;
+					read-only;
+				};
+
+				APPSBL@220000 {
+					label = "APPSBL";
+					reg = <0x220000 0x80000>;
+					read-only;
+				};
+
+				APPSBLENV@2a0000 {
+					label = "APPSBLENV";
+					reg = <0x2a0000 0x10000>;
+				};
+
+				PRODUCTDATA: PRODUCTDATA@2b0000 {
+					label = "PRODUCTDATA";
+					reg = <0x2b0000 0x30000>;
+					read-only;
+				};
+
+				ART@2e0000 {
+					label = "ART";
+					reg = <0x2e0000 0x40000>;
+					read-only;
+					compatible = "nvmem-cells";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					precal_ART_1000: precal@1000 {
+						reg = <0x1000 0x2f20>;
+					};
+
+					precal_ART_5000: precal@5000 {
+						reg = <0x5000 0x2f20>;
+					};
+				};
+
+				TP@320000 {
+					label = "TP";
+					reg = <0x320000 0x40000>;
+					read-only;
+				};
+
+				TINY@360000 {
+					label = "TINY";
+					reg = <0x360000 0x500000>;
+					read-only;
+				};
+
+				firmware@860000 {
+					compatible = "denx,uimage";
+					label = "firmware";
+					reg = <0x860000 0x17a0000>;
+				};
+			};
+		};
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+
+	pinctrl-0 = <&usb_pwr_en_pins>;
+	pinctrl-names = "default";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_PRODUCTDATA_12>, <&precal_ART_1000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+	max-link-speed = <1>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_PRODUCTDATA_c>, <&precal_ART_5000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio16", "gpio54", "gpio24", "gpio25";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio6", "gpio7", "gpio8", "gpio9", "gpio14",
+				"gpio15", "gpio55", "gpio56", "gpio57", "gpio58",
+				"gpio64", "gpio65";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+	};
+
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19", "gpio21";
+			function = "gsbi5";
+			bias-pull-down;
+		};
+
+		data {
+			pins = "gpio18", "gpio19";
+			drive-strength = <10>;
+		};
+
+		cs {
+			pins = "gpio20";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+
+		clk {
+			pins = "gpio21";
+			drive-strength = <12>;
+		};
+	};
+
+	usb_pwr_en_pins: usb_pwr_en_pins {
+		mux {
+			pins = "gpio22";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+			output-high;
+		};
+	};
+};
+
+&PRODUCTDATA {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_PRODUCTDATA_0: macaddr@0 {
+		reg = <0x0 0x6>;
+	};
+
+	macaddr_PRODUCTDATA_6: macaddr@6 {
+		reg = <0x6 0x6>;
+	};
+
+	macaddr_PRODUCTDATA_c: macaddr@c {
+		reg = <0xc 0x6>;
+	};
+
+	macaddr_PRODUCTDATA_12: macaddr@12 {
+		reg = <0x12 0x6>;
+	};
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-wpq864.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-wpq864.dts
new file mode 100644
index 00000000000000..359b4cd470ca92
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-wpq864.dts
@@ -0,0 +1,473 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ *  Copyright (C) 2017 Christian Mehlis <christian@m3hlis.de>
+ *  Copyright (C) 2018 Mathias Kresin <dev@kresin.me>
+ *  All rights reserved.
+ */
+
+#include "qcom-ipq8064-v1.0.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	compatible = "compex,wpq864", "qcom,ipq8064";
+	model = "Compex WPQ864";
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+		ethernet0 = &gmac1;
+		ethernet1 = &gmac0;
+
+		led-boot = &led_pass;
+		led-failsafe = &led_fail;
+		led-running = &led_pass;
+		led-upgrade = &led_pass;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		rss4 {
+			label = "green:rss4";
+			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_HIGH>;
+		};
+
+		rss3 {
+			label = "green:rss3";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_HIGH>;
+			default-state = "keep";
+		};
+
+		rss2 {
+			label = "orange:rss2";
+			gpios = <&qcom_pinmux 25 GPIO_ACTIVE_HIGH>;
+		};
+
+		rss1 {
+			label = "red:rss1";
+			gpios = <&qcom_pinmux 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_pass: pass {
+			label = "green:pass";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_fail: fail {
+			label = "green:fail";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb {
+			label = "green:usb";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb-pcie {
+			label = "green:usb-pcie";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	beeper {
+		compatible = "gpio-beeper";
+
+		pinctrl-0 = <&beeper_pins>;
+		pinctrl-names = "default";
+
+		gpios = <&qcom_pinmux 55 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&rpm {
+	pinctrl-0 = <&rpm_pins>;
+	pinctrl-names = "default";
+};
+
+&nand {
+	status = "okay";
+
+	pinctrl-0 = <&nand_pins>;
+	pinctrl-names = "default";
+
+	mt29f2g08abbeah4@0 {
+		compatible = "qcom,nandcs";
+
+		reg = <0>;
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		nand-is-boot-medium;
+		qcom,boot-partitions = <0x0 0x1180000 0x5340000 0x10c0000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "0:SBL1";
+				reg = <0x0000000 0x0040000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "0:MIBIB";
+				reg = <0x0040000 0x0140000>;
+				read-only;
+			};
+
+			partition@180000 {
+				label = "0:SBL2";
+				reg = <0x0180000 0x0140000>;
+				read-only;
+			};
+
+			partition@2c0000 {
+				label = "0:SBL3";
+				reg = <0x02c0000 0x0280000>;
+				read-only;
+			};
+
+			partition@540000 {
+				label = "0:DDRCONFIG";
+				reg = <0x0540000 0x0120000>;
+				read-only;
+			};
+
+			partition@660000 {
+				label = "0:SSD";
+				reg = <0x0660000 0x0120000>;
+				read-only;
+			};
+
+			partition@780000 {
+				label = "0:TZ";
+				reg = <0x0780000 0x0280000>;
+				read-only;
+			};
+
+			partition@a00000 {
+				label = "0:RPM";
+				reg = <0x0a00000 0x0280000>;
+				read-only;
+			};
+
+			partition@c80000 {
+				label = "0:APPSBL";
+				reg = <0x0c80000 0x0500000>;
+				read-only;
+			};
+
+			partition@1180000 {
+				label = "0:APPSBLENV";
+				reg = <0x1180000 0x0080000>;
+			};
+
+			partition@1200000 {
+				label = "0:ART";
+				reg = <0x1200000 0x0140000>;
+			};
+
+			partition@1340000 {
+				label = "ubi";
+				reg = <0x1340000 0x4000000>;
+			};
+
+			partition@5340000 {
+				label = "0:BOOTCONFIG";
+				reg = <0x5340000 0x0060000>;
+			};
+
+			partition@53a0000 {
+				label = "0:SBL2_1";
+				reg = <0x53a0000 0x0140000>;
+				read-only;
+			};
+
+			partition@54e0000 {
+				label = "0:SBL3_1";
+				reg = <0x54e0000 0x0280000>;
+				read-only;
+			};
+
+			partition@5760000 {
+				label = "0:DDRCONFIG_1";
+				reg = <0x5760000 0x0120000>;
+				read-only;
+			};
+
+			partition@5880000 {
+				label = "0:SSD_1";
+				reg = <0x5880000 0x0120000>;
+				read-only;
+			};
+
+			partition@59a0000 {
+				label = "0:TZ_1";
+				reg = <0x59a0000 0x0280000>;
+				read-only;
+			};
+
+			partition@5c20000 {
+				label = "0:RPM_1";
+				reg = <0x5c20000 0x0280000>;
+				read-only;
+			};
+
+			partition@5ea0000 {
+				label = "0:BOOTCONFIG1";
+				reg = <0x5ea0000 0x0060000>;
+			};
+
+			partition@5f00000 {
+				label = "0:APPSBL_1";
+				reg = <0x5f00000 0x0500000>;
+				read-only;
+			};
+
+			partition@6400000 {
+				label = "ubi_1";
+				reg = <0x6400000 0x4000000>;
+			};
+
+			partition@a400000 {
+				label = "unused";
+				reg = <0xa400000 0x5c00000>;
+			};
+		};
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+
+	ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gsbi4_serial {
+	pinctrl-0 = <&uart0_pins>;
+	pinctrl-names = "default";
+};
+
+&flash {
+	compatible = "jedec,spi-nor";
+};
+
+&sata_phy {
+	status = "disabled";
+};
+
+&sata {
+	status = "disabled";
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+
+	rx_eq = <2>;
+	tx_deamp_3_5db = <32>;
+	mpll = <160>;
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+
+	rx_eq = <2>;
+	tx_deamp_3_5db = <32>;
+	mpll = <160>;
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+
+	/delete-property/ pinctrl-0;
+	/delete-property/ pinctrl-names;
+	/delete-property/ perst-gpios;
+};
+
+&pcie1 {
+	status = "okay";
+};
+
+&pcie2 {
+	status = "okay";
+
+	/delete-property/ pinctrl-0;
+	/delete-property/ pinctrl-names;
+	/delete-property/ perst-gpios;
+};
+
+&qcom_pinmux {
+	pinctrl-names = "default";
+	pinctrl-0 = <&state_default>;
+
+	state_default: pinctrl0 {
+		pcie0_pcie2_perst {
+			pins = "gpio3";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio7", "gpio8", "gpio9", "gpio22",
+			       "gpio23", "gpio24", "gpio25", "gpio53";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	button_pins: button_pins {
+		mux {
+			pins = "gpio54";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	beeper_pins: beeper_pins {
+		mux {
+			pins = "gpio55";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	rpm_pins: rpm_pins {
+		mux {
+			pins = "gpio12", "gpio13";
+			function = "gsbi4";
+			drive-strength = <10>;
+			bias-disable;
+		};
+	};
+
+	uart0_pins: uart0_pins {
+		mux {
+			pins = "gpio10", "gpio11";
+			function = "gsbi4";
+			drive-strength = <10>;
+			bias-disable;
+		};
+	};
+
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19";
+			function = "gsbi5";
+			drive-strength = <10>;
+			bias-pull-down;
+		};
+
+		clk {
+			pins = "gpio21";
+			function = "gsbi5";
+			drive-strength = <12>;
+			bias-pull-down;
+		};
+
+		cs {
+			pins = "gpio20";
+			function = "gpio";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+	};
+};
+
+&tcsr {
+	qcom,usb-ctrl-select = <TCSR_USB_SELECT_USB3_DUAL>;
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-wxr-2533dhp.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-wxr-2533dhp.dts
new file mode 100644
index 00000000000000..39fd81fe5537f3
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-wxr-2533dhp.dts
@@ -0,0 +1,539 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Buffalo WXR-2533DHP";
+	compatible = "buffalo,wxr-2533dhp", "qcom,ipq8064";
+
+	memory@42000000 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	aliases {
+		led-boot = &power;
+		led-failsafe = &diag;
+		led-running = &power;
+		led-upgrade = &power;
+	};
+
+	chosen {
+		/* use "ubi_rootfs" volume in "ubi" partition as rootfs */
+		bootargs = "ubi.block=0,1 root=/dev/ubiblock0_1 rootfstype=squashfs";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		usb {
+			label = "green:usb";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "usbport";
+			trigger-sources = <&hub_port0 &hub_port1>;
+		};
+
+		guestport {
+			label = "green:guestport";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+
+		diag: diag {
+			label = "orange:diag";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		internet_orange {
+			label = "orange:internet";
+			gpios = <&qcom_pinmux 16 GPIO_ACTIVE_HIGH>;
+		};
+
+		internet_white {
+			label = "white:internet";
+			gpios = <&qcom_pinmux 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		wireless_orange {
+			label = "orange:wireless";
+			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_HIGH>;
+		};
+
+		wireless_white {
+			label = "white:wireless";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_HIGH>;
+		};
+
+		router_orange {
+			label = "orange:router";
+			gpios = <&qcom_pinmux 25 GPIO_ACTIVE_HIGH>;
+		};
+
+		router_white {
+			label = "white:router";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_LOW>;
+		};
+
+		power: power {
+			label = "white:power";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		power {
+			label = "power";
+			gpios = <&qcom_pinmux 58 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_POWER>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		eject {
+			label = "eject";
+			gpios = <&qcom_pinmux 6 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_EJECTCD>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		guest {
+			label = "guest";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		ap {
+			label = "ap";
+			gpios = <&qcom_pinmux 55 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_1>;
+			linux,input-type = <EV_SW>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		router {
+			label = "router";
+			gpios = <&qcom_pinmux 56 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_1>;
+			linux,input-type = <EV_SW>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		auto {
+			label = "auto";
+			gpios = <&qcom_pinmux 57 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_1>;
+			linux,input-type = <EV_SW>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	cs@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			ubi@0 {
+				label = "ubi";
+				reg = <0x0000000 0x4000000>;
+			};
+
+			rootfs_1@4000000 {
+				label = "rootfs_1";
+				reg = <0x4000000 0x4000000>;
+			};
+		};
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x07600000  /* PAD0_MODE */
+			0x00008 0x01000000  /* PAD5_MODE */
+			0x0000c 0x00000080  /* PAD6_MODE */
+			0x00050 0xcc35cc35  /* LED_CTRL0 */
+			0x00054 0xca35ca35  /* LED_CTRL1 */
+			0x00058 0xc935c935  /* LED_CTRL2 */
+			0x0005c 0x03ffff00  /* LED_CTRL3 */
+			0x000e4 0x0006a545  /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x0000007e  /* PORT0_STATUS */
+			0x00094 0x0000007e  /* PORT6_STATUS */
+			>;
+	};
+
+	ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	nvmem-cells = <&macaddr_ART_6>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	nvmem-cells = <&macaddr_ART_0>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gsbi4_serial {
+	pinctrl-0 = <&uart0_pins>;
+	pinctrl-names = "default";
+};
+
+&gsbi5 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_SPI>;
+
+	spi@1a280000 {
+		status = "okay";
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
+
+		flash@0 {
+			compatible = "jedec,spi-nor";
+			spi-max-frequency = <50000000>;
+			reg = <0>;
+
+			partitions {
+				compatible = "fixed-partitions";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				SBL1@0 {
+					label = "SBL1";
+					reg = <0x0 0x10000>;
+					read-only;
+				};
+
+				MIBIB@10000 {
+					label = "MIBIB";
+					reg = <0x10000 0x20000>;
+					read-only;
+				};
+
+				SBL2@30000 {
+					label = "SBL2";
+					reg = <0x30000 0x30000>;
+					read-only;
+				};
+
+				SBL3@60000 {
+					label = "SBL3";
+					reg = <0x60000 0x30000>;
+					read-only;
+				};
+
+				DDRCONFIG@90000 {
+					label = "DDRCONFIG";
+					reg = <0x90000 0x10000>;
+					read-only;
+				};
+
+				SSD@a0000 {
+					label = "SSD";
+					reg = <0xa0000 0x10000>;
+					read-only;
+				};
+
+				TZ@b0000 {
+					label = "TZ";
+					reg = <0xb0000 0x30000>;
+					read-only;
+				};
+
+				RPM@e0000 {
+					label = "RPM";
+					reg = <0xe0000 0x20000>;
+					read-only;
+				};
+
+				APPSBL@100000 {
+					label = "APPSBL";
+					reg = <0x100000 0x70000>;
+					read-only;
+				};
+
+				APPSBLENV@170000 {
+					label = "APPSBLENV";
+					reg = <0x170000 0x10000>;
+					read-only;
+				};
+
+				ART@180000 {
+					label = "ART";
+					reg = <0x180000 0x40000>;
+					read-only;
+
+					compatible = "nvmem-cells";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_ART_0: macaddr@0 {
+						reg = <0x0 0x6>;
+					};
+
+					macaddr_ART_6: macaddr@6 {
+						reg = <0x6 0x6>;
+					};
+
+					macaddr_ART_18: macaddr@18 {
+						reg = <0x18 0x6>;
+					};
+
+					macaddr_ART_1e: macaddr@1e {
+						reg = <0x1e 0x6>;
+					};
+
+					precal_ART_1000: precal@1000 {
+						reg = <0x1000 0x2f20>;
+					};
+
+					precal_ART_5000: precal@5000 {
+						reg = <0x5000 0x2f20>;
+					};
+				};
+
+				BOOTCONFIG@1c0000 {
+					label = "BOOTCONFIG";
+					reg = <0x1c0000 0x10000>;
+					read-only;
+				};
+
+				APPSBL_1@1d0000 {
+					label = "APPSBL_1";
+					reg = <0x1d0000 0x70000>;
+					read-only;
+				};
+			};
+		};
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+
+	pinctrl-0 = <&usb_pwr_en_pins>;
+	pinctrl-names = "default";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&dwc3_0 {
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	hub_port0: port@1 {
+		reg = <1>;
+		#trigger-source-cells = <0>;
+	};
+};
+
+&dwc3_1 {
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	hub_port1: port@1 {
+		reg = <1>;
+		#trigger-source-cells = <0>;
+	};
+};
+
+&pcie0 {
+	status = "okay";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_ART_1e>, <&precal_ART_1000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+	max-link-speed = <1>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_ART_18>, <&precal_ART_5000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio6", "gpio54", "gpio55", "gpio56", "gpio57",
+				"gpio58", "gpio64", "gpio65";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio7", "gpio8", "gpio9", "gpio16", "gpio22",
+				"gpio23", "gpio24", "gpio25", "gpio26", "gpio53";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	uart0_pins: uart0_pins {
+		mux {
+			pins = "gpio10", "gpio11";
+			function = "gsbi4";
+			drive-strength = <12>;
+			bias-disable;
+		};
+	};
+
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19", "gpio21";
+			function = "gsbi5";
+			bias-pull-down;
+		};
+
+		data {
+			pins = "gpio18", "gpio19";
+			drive-strength = <10>;
+		};
+
+		cs{
+			pins = "gpio20";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+
+		clk {
+			pins = "gpio21";
+			drive-strength = <12>;
+		};
+	};
+
+	usb_pwr_en_pins: usb_pwr_en_pins {
+		mux{
+			pins = "gpio68";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+			output-high;
+		};
+	};
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-ac400i.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-ac400i.dts
new file mode 100644
index 00000000000000..7151f8de525bb7
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-ac400i.dts
@@ -0,0 +1,318 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq8065-smb208.dtsi"
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Nokia AC400i";
+	compatible = "nokia,ac400i", "qcom,ipq8065", "qcom,ipq8064";
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+		ethernet0 = &gmac0;
+		ethernet1 = &gmac1;
+
+		led-boot = &pwr_red;
+		led-failsafe = &pwr_red;
+		led-running = &pwr_green;
+		led-upgrade = &pwr_green;
+	};
+
+	chosen {
+		bootargs-override = " console=ttyMSM0,115200n8 ubi.mtd=ubi root=/dev/ubiblock0_2";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 15 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		5g_red {
+			label = "red:5g";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_HIGH>;
+		};
+
+		5g_green {
+			label = "green:5g";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_HIGH>;
+		};
+
+		2g_red {
+			label = "red:2g";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+		};
+
+		2g_green {
+			label = "green:2g";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_HIGH>;
+		};
+
+		eth1_red {
+			label = "red:eth1";
+			gpios = <&qcom_pinmux 68 GPIO_ACTIVE_HIGH>;
+		};
+
+		eth1_green {
+			label = "green:eth1";
+			gpios = <&qcom_pinmux 22 GPIO_ACTIVE_LOW>;
+		};
+
+		eth2_red {
+			label = "red:eth2";
+			gpios = <&qcom_pinmux 67 GPIO_ACTIVE_HIGH>;
+		};
+
+		eth2_green {
+			label = "green:eth2";
+			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_LOW>;
+		};
+
+		ctrl_red {
+			label = "red:ctrl";
+			gpios = <&qcom_pinmux 55 GPIO_ACTIVE_HIGH>;
+		};
+
+		ctrl_green {
+			label = "green:ctrl";
+			gpios = <&qcom_pinmux 56 GPIO_ACTIVE_HIGH>;
+		};
+
+		pwr_red: pwr_red {
+			label = "red:pwr";
+			gpios = <&qcom_pinmux 2 GPIO_ACTIVE_LOW>;
+		};
+
+		pwr_green: pwr_green {
+			label = "green:pwr";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19";
+			function = "gsbi5";
+			drive-strength = <10>;
+			bias-pull-down;
+		};
+
+		clk {
+			pins = "gpio21";
+			function = "gsbi5";
+			drive-strength = <12>;
+			bias-pull-down;
+		};
+
+		cs {
+			pins = "gpio20";
+			function = "gpio";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio65", "gpio64",
+				   "gpio53", "gpio54",
+				   "gpio68", "gpio22",
+				   "gpio67", "gpio23",
+				   "gpio55", "gpio56",
+				   "gpio2", "gpio26";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	button_pins: button_pins {
+		mux {
+			pins = "gpio15";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+};
+
+&gsbi5 {
+	qcom,mode = <GSBI_PROT_SPI>;
+	status = "okay";
+
+	spi4: spi@1a280000 {
+		status = "okay";
+		spi-max-frequency = <50000000>;
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
+
+		m25p80@0 {
+			compatible = "jedec,spi-nor";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			spi-max-frequency = <50000000>;
+			reg = <0>;
+
+			partitions {
+				compatible = "qcom,smem-part";
+			};
+		};
+	};
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+
+	/delete-property/ pinctrl-0;
+	/delete-property/ pinctrl-names;
+	/delete-property/ perst-gpios;
+
+	bridge@0,0 {
+			reg = <0x00000000 0 0 0 0>;
+			#address-cells = <3>;
+			#size-cells = <2>;
+			ranges;
+
+			wifi@1,0 {
+					compatible = "qcom,ath10k";
+					status = "okay";
+					reg = <0x00010000 0 0 0 0>;
+					qcom,ath10k-calibration-variant = "Nokia-AC400i";
+			};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+
+	/delete-property/ pinctrl-0;
+	/delete-property/ pinctrl-names;
+	/delete-property/ perst-gpios;
+
+	bridge@0,0 {
+			reg = <0x00000000 0 0 0 0>;
+			#address-cells = <3>;
+			#size-cells = <2>;
+			ranges;
+
+			wifi@1,0 {
+					compatible = "qcom,ath10k";
+					status = "okay";
+					reg = <0x00010000 0 0 0 0>;
+					qcom,ath10k-calibration-variant = "Nokia-AC400i";
+			};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+	};
+
+	phy1: ethernet-phy@1 {
+		reg = <1>;
+	};
+
+};
+
+//POE
+&gmac0 {
+	status = "okay";
+	qcom,id = <0>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	mdiobus = <&mdio0>;
+	phy-handle = <&phy0>;
+	phy-mode = "rgmii";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+//LAN1
+&gmac1 {
+	status = "okay";
+	qcom,id = <1>;
+
+	mdiobus = <&mdio0>;
+	phy-handle = <&phy1>;
+	phy-mode = "rgmii";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&nand {
+	status = "okay";
+	pinctrl-0 = <&nand_pins>;
+	pinctrl-names = "default";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			rootfs@0 {
+				label = "rootfs";
+				reg = <0x0000000 0x4000000>;
+			};
+
+			rootfs_1@4000000 {
+				label = "rootfs_1";
+				reg = <0x4000000 0x4000000>;
+			};
+
+			cfg@8000000 {
+				label = "cfg";
+				reg = <0x8000000 0x8000000>;
+			};
+		};
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-nbg6817.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-nbg6817.dts
new file mode 100644
index 00000000000000..162b28d27fbc6d
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-nbg6817.dts
@@ -0,0 +1,332 @@
+#include "qcom-ipq8065-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "ZyXEL NBG6817";
+	compatible = "zyxel,nbg6817", "qcom,ipq8065", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+		sdcc1 = &sdcc1;
+
+		led-boot = &power;
+		led-failsafe = &power;
+		led-running = &power;
+		led-upgrade = &power;
+	};
+
+	chosen {
+		bootargs = "rootfstype=squashfs,ext4 rootwait noinitrd fstools_ignore_partname=1";
+		append-rootblock = "root=/dev/mmcblk0p";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wifi {
+			label = "wifi";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			linux,input-type = <EV_SW>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		internet {
+			label = "white:internet";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_HIGH>;
+		};
+
+		power: power {
+			label = "white:power";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+			default-state = "keep";
+		};
+
+		wifi2g {
+			label = "amber:wifi2g";
+			gpios = <&qcom_pinmux 33 GPIO_ACTIVE_HIGH>;
+		};
+
+		/* wifi2g amber from the manual is missing */
+
+		wifi5g {
+			label = "amber:wifi5g";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_HIGH>;
+		};
+
+		/* wifi5g amber from the manual is missing */
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio53", "gpio54", "gpio65";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio9", "gpio26", "gpio33", "gpio64";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+	};
+
+	mdio0_pins: mdio0-pins {
+		clk {
+			pins = "gpio1";
+			input-disable;
+		};
+	};
+
+	rgmii2_pins: rgmii2-pins {
+		tx {
+			pins = "gpio27", "gpio28", "gpio29", "gpio30", "gpio31", "gpio32" ;
+			input-disable;
+		};
+	};
+
+	spi_pins: spi_pins {
+		cs {
+			pins = "gpio20";
+			drive-strength = <12>;
+		};
+	};
+
+	usb0_pwr_en_pins: usb0_pwr_en_pins {
+		mux {
+			pins = "gpio16", "gpio17";
+			function = "gpio";
+			drive-strength = <12>;
+		};
+
+		pwr {
+			pins = "gpio17";
+			bias-pull-down;
+			output-high;
+		};
+
+		ovc {
+			pins = "gpio16";
+			bias-pull-up;
+		};
+	};
+
+	usb1_pwr_en_pins: usb1_pwr_en_pins {
+		mux {
+			pins = "gpio14", "gpio15";
+			function = "gpio";
+			drive-strength = <12>;
+		};
+
+		pwr {
+			pins = "gpio14";
+			bias-pull-down;
+			output-high;
+		};
+
+		ovc {
+			pins = "gpio15";
+			bias-pull-up;
+		};
+	};
+};
+
+&gsbi5 {
+	qcom,mode = <GSBI_PROT_SPI>;
+	status = "okay";
+
+	spi4: spi@1a280000 {
+		status = "okay";
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
+
+		m25p80@0 {
+			compatible = "jedec,spi-nor";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			spi-max-frequency = <51200000>;
+			reg = <0>;
+
+			partitions {
+				compatible = "qcom,smem-part";
+			};
+		};
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+
+	pinctrl-0 = <&usb0_pwr_en_pins>;
+	pinctrl-names = "default";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+
+	pinctrl-0 = <&usb1_pwr_en_pins>;
+	pinctrl-names = "default";
+};
+
+&pcie0 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 3 GPIO_ACTIVE_LOW>;
+	pinctrl-0 = <&pcie0_pins>;
+	pinctrl-names = "default";
+};
+
+&pcie1 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 48 GPIO_ACTIVE_LOW>;
+	pinctrl-0 = <&pcie1_pins>;
+	pinctrl-names = "default";
+	max-link-speed = <1>;
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0xaa545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			0x00970 0x1e864443  /* QM_PORT0_CTRL0 */
+			0x00974 0x000001c6  /* QM_PORT0_CTRL1 */
+			0x00978 0x19008643  /* QM_PORT1_CTRL0 */
+			0x0097c 0x000001c6  /* QM_PORT1_CTRL1 */
+			0x00980 0x19008643  /* QM_PORT2_CTRL0 */
+			0x00984 0x000001c6  /* QM_PORT2_CTRL1 */
+			0x00988 0x19008643  /* QM_PORT3_CTRL0 */
+			0x0098c 0x000001c6  /* QM_PORT3_CTRL1 */
+			0x00990 0x19008643  /* QM_PORT4_CTRL0 */
+			0x00994 0x000001c6  /* QM_PORT4_CTRL1 */
+			0x00998 0x1e864443  /* QM_PORT5_CTRL0 */
+			0x0099c 0x000001c6  /* QM_PORT5_CTRL1 */
+			0x009a0 0x1e864443  /* QM_PORT6_CTRL0 */
+			0x009a4 0x000001c6  /* QM_PORT6_CTRL1 */
+			>;
+	};
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+		qca,ar8327-initvals = <
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x0000c 0x80        /* PAD6_MODE */
+			>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+	qcom,phy_mdio_addr = <4>;
+	qcom,poll_required = <0>;
+	qcom,rgmii_delay = <1>;
+	qcom,phy_mii_type = <0>;
+	qcom,emulation = <0>;
+	qcom,irq = <255>;
+	mdiobus = <&mdio0>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+	qcom,phy_mdio_addr = <0>;	/* none */
+	qcom,poll_required = <0>;	/* no polling */
+	qcom,rgmii_delay = <0>;
+	qcom,phy_mii_type = <1>;
+	qcom,emulation = <0>;
+	qcom,irq = <258>;
+	mdiobus = <&mdio0>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&amba {
+	sdcc1: sdcc@12400000 {
+		status = "okay";
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-nighthawk.dtsi b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-nighthawk.dtsi
new file mode 100644
index 00000000000000..2328c497ea1629
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-nighthawk.dtsi
@@ -0,0 +1,466 @@
+#include "qcom-ipq8065-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	reserved-memory {
+		rsvd@5fe00000 {
+			reg = <0x5fe00000 0x200000>;
+			reusable;
+		};
+
+		ramoops@42100000 {
+			compatible = "ramoops";
+			reg = <0x42100000 0x40000>;
+			record-size = <0x4000>;
+			console-size = <0x4000>;
+			ftrace-size = <0x4000>;
+			pmsg-size = <0x4000>;
+		};
+	};
+
+	aliases {
+		label-mac-device = &gmac2;
+
+		led-boot = &power_white;
+		led-failsafe = &power_amber;
+		led-running = &power_white;
+		led-upgrade = &power_amber;
+
+		mdio-gpio0 = &mdio0;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wifi {
+			label = "wifi";
+			gpios = <&qcom_pinmux 6 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds: leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		power_white: power_white {
+			label = "white:power";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+			default-state = "keep";
+		};
+
+		power_amber: power_amber {
+			label = "amber:power";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan_white {
+			label = "white:wan";
+			gpios = <&qcom_pinmux 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan_amber {
+			label = "amber:wan";
+			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_HIGH>;
+		};
+
+		wifi {
+			label = "white:wifi";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_HIGH>;
+		};
+
+		wps {
+			label = "white:wps";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio6", "gpio54", "gpio65";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio7", "gpio8", "gpio9",
+				"gpio22", "gpio23", "gpio24",
+				"gpio26", "gpio53", "gpio64";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+	};
+
+	mdio0_pins: mdio0-pins {
+		clk {
+			pins = "gpio1";
+			input-disable;
+		};
+	};
+
+	rgmii2_pins: rgmii2-pins {
+		tx {
+			pins = "gpio27", "gpio28", "gpio29",
+				"gpio30", "gpio31", "gpio32";
+			input-disable;
+		};
+	};
+
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19", "gpio21";
+			function = "gsbi5";
+			bias-pull-down;
+		};
+
+		data {
+			pins = "gpio18", "gpio19";
+			drive-strength = <10>;
+		};
+
+		cs {
+			pins = "gpio20";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+
+		clk {
+			pins = "gpio21";
+			drive-strength = <12>;
+		};
+	};
+
+	spi6_pins: spi6_pins {
+		mux {
+			pins = "gpio55", "gpio56", "gpio58";
+			function = "gsbi6";
+			bias-pull-down;
+		};
+
+		mosi {
+			pins = "gpio55";
+			drive-strength = <12>;
+		};
+
+		miso {
+			pins = "gpio56";
+			drive-strength = <14>;
+		};
+
+		cs {
+			pins = "gpio57";
+			drive-strength = <12>;
+			bias-pull-up;
+		};
+
+		clk {
+			pins = "gpio58";
+			drive-strength = <12>;
+		};
+
+		reset {
+			pins = "gpio33";
+			drive-strength = <10>;
+			bias-pull-down;
+			output-high;
+		};
+	};
+
+	usb0_pwr_en_pins: usb0_pwr_en_pins {
+		mux {
+			pins = "gpio15";
+			function = "gpio";
+			drive-strength = <12>;
+			bias-pull-down;
+			output-high;
+		};
+	};
+
+	usb1_pwr_en_pins: usb1_pwr_en_pins {
+		mux {
+			pins = "gpio16", "gpio68";
+			function = "gpio";
+			drive-strength = <12>;
+			bias-pull-down;
+			output-high;
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		nand-is-boot-medium;
+		qcom,boot-partitions = <0x0 0x1180000>;
+
+		partitions: partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "qcadata";
+				reg = <0x0000000 0x0c80000>;
+				read-only;
+			};
+
+			partition@c80000 {
+				label = "APPSBL";
+				reg = <0x0c80000 0x0500000>;
+				read-only;
+			};
+
+			partition@1180000 {
+				label = "APPSBLENV";
+				reg = <0x1180000 0x0080000>;
+				read-only;
+			};
+
+			art: partition@1200000 {
+				label = "art";
+				reg = <0x1200000 0x0140000>;
+				read-only;
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_art_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_art_6: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+
+				precal_art_1000: precal@1000 {
+					reg = <0x1000 0x2f20>;
+				};
+
+				precal_art_5000: precal@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+			};
+
+			partition@1340000 {
+				label = "artbak";
+				reg = <0x1340000 0x0140000>;
+				read-only;
+			};
+
+			partition@1480000 {
+				label = "kernel";
+				reg = <0x1480000 0x0400000>;
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0xaa545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			0x00970 0x1e864443  /* QM_PORT0_CTRL0 */
+			0x00974 0x000001c6  /* QM_PORT0_CTRL1 */
+			0x00978 0x19008643  /* QM_PORT1_CTRL0 */
+			0x0097c 0x000001c6  /* QM_PORT1_CTRL1 */
+			0x00980 0x19008643  /* QM_PORT2_CTRL0 */
+			0x00984 0x000001c6  /* QM_PORT2_CTRL1 */
+			0x00988 0x19008643  /* QM_PORT3_CTRL0 */
+			0x0098c 0x000001c6  /* QM_PORT3_CTRL1 */
+			0x00990 0x19008643  /* QM_PORT4_CTRL0 */
+			0x00994 0x000001c6  /* QM_PORT4_CTRL1 */
+			0x00998 0x1e864443  /* QM_PORT5_CTRL0 */
+			0x0099c 0x000001c6  /* QM_PORT5_CTRL1 */
+			0x009a0 0x1e864443  /* QM_PORT6_CTRL0 */
+			0x009a4 0x000001c6  /* QM_PORT6_CTRL1 */
+			>;
+		qca,ar8327-vlans = <
+			0x1	0x5e	    /* VLAN1 Ports 1/2/3/4/6 */
+			0x2	0x21	    /* VLAN2 Ports 0/5 */
+		>;
+	};
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+		qca,ar8327-initvals = <
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x0000c 0x80        /* PAD6_MODE */
+			>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+	qcom,phy_mdio_addr = <4>;
+	qcom,poll_required = <0>;
+	qcom,rgmii_delay = <1>;
+	qcom,phy_mii_type = <0>;
+	qcom,emulation = <0>;
+	qcom,irq = <255>;
+	mdiobus = <&mdio0>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	nvmem-cells = <&macaddr_art_6>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+	qcom,phy_mdio_addr = <0>;	/* none */
+	qcom,poll_required = <0>;	/* no polling */
+	qcom,rgmii_delay = <0>;
+	qcom,phy_mii_type = <1>;
+	qcom,emulation = <0>;
+	qcom,irq = <258>;
+	mdiobus = <&mdio0>;
+
+	nvmem-cells = <&macaddr_art_0>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&sata_phy {
+	status = "okay";
+};
+
+&sata {
+	status = "okay";
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+
+	pinctrl-0 = <&usb0_pwr_en_pins>;
+	pinctrl-names = "default";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+
+	pinctrl-0 = <&usb1_pwr_en_pins>;
+	pinctrl-names = "default";
+};
+
+&pcie0 {
+	status = "okay";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi0: wifi@1,0 {
+			compatible = "pci168c,0046";
+			reg = <0x00010000 0 0 0 0>;
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+
+	max-link-speed = <1>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi1: wifi@1,0 {
+			compatible = "pci168c,0046";
+			reg = <0x00010000 0 0 0 0>;
+		};
+	};
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-r7800.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-r7800.dts
new file mode 100644
index 00000000000000..bf7c963944b72d
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-r7800.dts
@@ -0,0 +1,48 @@
+#include "qcom-ipq8065-nighthawk.dtsi"
+
+/ {
+	model = "Netgear Nighthawk X4S R7800";
+	compatible = "netgear,r7800", "qcom,ipq8065", "qcom,ipq8064";
+};
+
+&leds {
+	usb1 {
+		label = "white:usb1";
+		gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+	};
+
+	usb2 {
+		label = "white:usb2";
+		gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+	};
+
+	esata {
+		label = "white:esata";
+		gpios = <&qcom_pinmux 26 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&partitions {
+	partition@1880000 {
+		label = "ubi";
+		reg = <0x1880000 0x6080000>;
+	};
+
+	partition@7900000 {
+		label = "reserve";
+		reg = <0x7900000 0x0700000>;
+		read-only;
+	};
+};
+
+&wifi0 {
+	nvmem-cells = <&macaddr_art_6>, <&precal_art_1000>;
+	nvmem-cell-names = "mac-address", "pre-calibration";
+	mac-address-increment = <(1)>;
+};
+
+&wifi1 {
+	nvmem-cells = <&macaddr_art_6>, <&precal_art_5000>;
+	nvmem-cell-names = "mac-address", "pre-calibration";
+	mac-address-increment = <(2)>;
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-rt4230w-rev6.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-rt4230w-rev6.dts
new file mode 100644
index 00000000000000..8d9601b6324728
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-rt4230w-rev6.dts
@@ -0,0 +1,418 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "qcom-ipq8065-smb208.dtsi"
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Askey RT4230W REV6";
+	compatible = "askey,rt4230w-rev6", "qcom,ipq8065", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0x3e000000>;
+		device_type = "memory";
+	};
+
+	aliases {
+		led-boot = &ledctrl3;
+		led-failsafe = &ledctrl1;
+		led-running = &ledctrl2;
+		led-upgrade = &ledctrl3;
+	};
+
+	chosen {
+		bootargs = "rootfstype=squashfs noinitrd";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 68 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		ledctrl1: ledctrl1 {
+			label = "ledctrl1";
+			gpios = <&qcom_pinmux 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		ledctrl2: ledctrl2 {
+			label = "ledctrl2";
+			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_HIGH>;
+		};
+
+		ledctrl3: ledctrl3 {
+			label = "ledctrl3";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio54", "gpio68";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio22", "gpio23", "gpio24";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+	};
+
+	rgmii2_pins: rgmii2-pins {
+		mux {
+			pins = "gpio27", "gpio28", "gpio29", "gpio30", "gpio31",
+				"gpio51", "gpio52", "gpio59", "gpio60", "gpio61", "gpio62";
+			function = "rgmii2";
+			drive-strength = <8>;
+			bias-disable;
+		};
+
+		tx {
+			pins = "gpio27", "gpio28", "gpio29", "gpio30", "gpio31", "gpio32";
+			input-disable;
+		};
+	};
+
+	spi_pins: spi_pins {
+		cs {
+			pins = "gpio20";
+			drive-strength = <12>;
+		};
+	};
+};
+
+&gsbi5 {
+	qcom,mode = <GSBI_PROT_SPI>;
+	status = "okay";
+
+	spi@1a280000 {
+		status = "okay";
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
+
+		flash@0 {
+			compatible = "everspin,mr25h256";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			spi-max-frequency = <40000000>;
+			reg = <0>;
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		qcom,boot-partitions = <0x0 0x1180000 0x1340000 0x10c0000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "0:SBL1";
+				reg = <0x0000000 0x0040000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "0:MIBIB";
+				reg = <0x0040000 0x0140000>;
+				read-only;
+			};
+
+			partition@180000 {
+				label = "0:SBL2";
+				reg = <0x0180000 0x0140000>;
+				read-only;
+			};
+
+			partition@2c0000 {
+				label = "0:SBL3";
+				reg = <0x02c0000 0x0280000>;
+				read-only;
+			};
+
+			partition@540000 {
+				label = "0:DDRCONFIG";
+				reg = <0x0540000 0x0120000>;
+				read-only;
+			};
+
+			partition@660000 {
+				label = "0:SSD";
+				reg = <0x0660000 0x0120000>;
+				read-only;
+			};
+
+			partition@780000 {
+				label = "0:TZ";
+				reg = <0x0780000 0x0280000>;
+				read-only;
+			};
+
+			partition@a00000 {
+				label = "0:RPM";
+				reg = <0x0a00000 0x0280000>;
+				read-only;
+			};
+
+			partition@c80000 {
+				label = "0:APPSBL";
+				reg = <0x0c80000 0x0500000>;
+				read-only;
+			};
+
+			partition@1180000 {
+				label = "0:APPSBLENV";
+				reg = <0x1180000 0x0080000>;
+			};
+
+			partition@1200000 {
+				label = "0:ART";
+				reg = <0x1200000 0x0140000>;
+				read-only;
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_ART_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_ART_6: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+
+				precal_ART_1000: precal@1000 {
+					reg = <0x1000 0x2f20>;
+				};
+
+				precal_ART_5000: precal@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+			};
+
+			partition@1340000 {
+				label = "0:BOOTCONFIG";
+				reg = <0x1340000 0x0060000>;
+				read-only;
+			};
+
+			partition@13a0000 {
+				label = "0:SBL2_1";
+				reg = <0x13a0000 0x0140000>;
+				read-only;
+			};
+
+			partition@14e0000 {
+				label = "0:SBL3_1";
+				reg = <0x14e0000 0x0280000>;
+				read-only;
+			};
+
+			partition@1760000 {
+				label = "0:DDRCONFIG_1";
+				reg = <0x1760000 0x0120000>;
+				read-only;
+			};
+
+			partition@1880000 {
+				label = "0:SSD_1";
+				reg = <0x1880000 0x0120000>;
+				read-only;
+			};
+
+			partition@19a0000 {
+				label = "0:TZ_1";
+				reg = <0x19a0000 0x0280000>;
+				read-only;
+			};
+
+			partition@1c20000 {
+				label = "0:RPM_1";
+				reg = <0x1c20000 0x0280000>;
+				read-only;
+			};
+
+			partition@1ea0000 {
+				label = "0:BOOTCONFIG1";
+				reg = <0x1ea0000 0x0060000>;
+				read-only;
+			};
+
+			partition@1f00000 {
+				label = "0:APPSBL_1";
+				reg = <0x1f00000 0x0500000>;
+				read-only;
+			};
+
+			partition@2400000 {
+				label = "ubi";
+				reg = <0x2400000 0x1a000000>;
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0x0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0xaa545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			0x00050 0xcf02cf02  /* LED_CTRL_0 */
+			0x00054 0xc832c832  /* LED_CTRL_1 */
+			>;
+	};
+};
+
+&gmac0 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <0>;
+
+	nvmem-cells = <&macaddr_ART_0>;
+	nvmem-cell-names = "mac-address";
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <1>;
+
+	nvmem-cells = <&macaddr_ART_6>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 3 GPIO_ACTIVE_HIGH>;
+	pinctrl-0 = <&pcie0_pins>;
+	pinctrl-names = "default";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi0: wifi@1,0 {
+			compatible = "pci168c,0046";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&precal_ART_1000>;
+			nvmem-cell-names = "pre-calibration";
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 48 GPIO_ACTIVE_HIGH>;
+	pinctrl-0 = <&pcie1_pins>;
+	pinctrl-names = "default";
+	max-link-speed = <1>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi1: wifi@1,0 {
+			compatible = "pci168c,0046";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&precal_ART_5000>;
+			nvmem-cell-names = "pre-calibration";
+		};
+	};
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-tr4400-v2.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-tr4400-v2.dts
new file mode 100644
index 00000000000000..7b236af253e640
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-tr4400-v2.dts
@@ -0,0 +1,432 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "qcom-ipq8065-smb208.dtsi"
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Arris TR4400 v2";
+	compatible = "arris,tr4400-v2", "qcom,ipq8065", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	aliases {
+		led-boot = &led_status_blue;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_blue;
+		led-upgrade = &led_status_red;
+	};
+
+	chosen {
+		bootargs = "rootfstype=squashfs noinitrd";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 6 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		led_status_red: status_red {
+			label = "red:status";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_blue: status_blue {
+			label = "blue:status";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio6", "gpio54";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio7", "gpio8";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+	};
+
+	rgmii2_pins: rgmii2-pins {
+		tx {
+			pins = "gpio27", "gpio28", "gpio29", "gpio30", "gpio31", "gpio32";
+			input-disable;
+		};
+	};
+
+	spi_pins: spi_pins {
+		cs {
+			pins = "gpio20";
+			drive-strength = <12>;
+		};
+	};
+};
+
+&gsbi5 {
+	qcom,mode = <GSBI_PROT_SPI>;
+	status = "okay";
+
+	spi@1a280000 {
+		status = "okay";
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
+
+		flash@0 {
+			compatible = "everspin,mr25h256";
+			spi-max-frequency = <40000000>;
+			reg = <0>;
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		qcom,boot-partitions = <0x0 0x1180000 0x5340000 0x10c0000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "0:SBL1";
+				reg = <0x0000000 0x0040000>;
+				read-only;
+			};
+			partition@40000 {
+				label = "0:MIBIB";
+				reg = <0x0040000 0x0140000>;
+				read-only;
+			};
+			partition@180000 {
+				label = "0:SBL2";
+				reg = <0x0180000 0x0140000>;
+				read-only;
+			};
+			partition@2c0000 {
+				label = "0:SBL3";
+				reg = <0x02c0000 0x0280000>;
+				read-only;
+			};
+			partition@540000 {
+				label = "0:DDRCONFIG";
+				reg = <0x0540000 0x0120000>;
+				read-only;
+			};
+			partition@660000 {
+				label = "0:SSD";
+				reg = <0x0660000 0x0120000>;
+				read-only;
+			};
+			partition@780000 {
+				label = "0:TZ";
+				reg = <0x0780000 0x0280000>;
+				read-only;
+			};
+			partition@a00000 {
+				label = "0:RPM";
+				reg = <0x0a00000 0x0280000>;
+				read-only;
+			};
+			partition@c80000 {
+				label = "0:APPSBL";
+				reg = <0x0c80000 0x0500000>;
+				read-only;
+			};
+			partition@1180000 {
+				label = "0:APPSBLENV";
+				reg = <0x1180000 0x0080000>;
+			};
+			partition@1200000 {
+				label = "0:ART";
+				reg = <0x1200000 0x0140000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				precal_ART_1000: precal@1000 {
+					reg = <0x1000 0x2f20>;
+				};
+				precal_ART_5000: precal@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+			};
+			stock_partition@1340000 {
+				label = "stock_rootfs";
+				reg = <0x1340000 0x4000000>;
+			};
+			partition@5340000 {
+				label = "0:BOOTCONFIG";
+				reg = <0x5340000 0x0060000>;
+				read-only;
+			};
+			partition@53a0000 {
+				label = "0:SBL2_1";
+				reg = <0x53a0000 0x0140000>;
+				read-only;
+			};
+			partition@54e0000 {
+				label = "0:SBL3_1";
+				reg = <0x54e0000 0x0280000>;
+				read-only;
+			};
+			partition@5760000 {
+				label = "0:DDRCONFIG_1";
+				reg = <0x5760000 0x0120000>;
+				read-only;
+			};
+			partition@5880000 {
+				label = "0:SSD_1";
+				reg = <0x5880000 0x0120000>;
+				read-only;
+			};
+			partition@59a0000 {
+				label = "0:TZ_1";
+				reg = <0x59a0000 0x0280000>;
+				read-only;
+			};
+			partition@5c20000 {
+				label = "0:RPM_1";
+				reg = <0x5c20000 0x0280000>;
+				read-only;
+			};
+			partition@5ea0000 {
+				label = "0:BOOTCONFIG1";
+				reg = <0x5ea0000 0x0060000>;
+				read-only;
+			};
+			partition@5f00000 {
+				label = "0:APPSBL_1";
+				reg = <0x5f00000 0x0500000>;
+				read-only;
+			};
+			stock_partition@6400000 {
+				label = "stock_rootfs_1";
+				reg = <0x6400000 0x4000000>;
+			};
+			stock_partition@a400000 {
+				label = "stock_fw_env";
+				reg = <0xa400000 0x0100000>;
+			};
+			stock_partition@a500000 {
+				label = "stock_config";
+				reg = <0xa500000 0x0800000>;
+			};
+			stock_partition@ad00000 {
+				label = "stock_PKI";
+				reg = <0xad00000 0x0200000>;
+			};
+			stock_partition@af00000 {
+				label = "stock_scfgmgr";
+				reg = <0xaf00000 0x0100000>;
+			};
+
+			partition@6400000 {
+				label = "fw_env";
+				reg = <0x6400000 0x0100000>;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_fw_env_0: macaddr@0 {
+					reg = <0x00 0x6>;
+				};
+				macaddr_fw_env_6: macaddr@6 {
+					reg = <0x06 0x6>;
+				};
+				macaddr_fw_env_c: macaddr@c {
+					reg = <0x0c 0x6>;
+				};
+				macaddr_fw_env_12: macaddr@12 {
+					reg = <0x12 0x6>;
+				};
+				macaddr_fw_env_18: macaddr@18 {
+					reg = <0x18 0x6>;
+				};
+			};
+			partition@6500000 {
+				label = "ubi";
+				reg = <0x6500000 0x9b00000>;
+			};
+			partition@1340000 {
+				label = "extra";
+				reg = <0x1340000 0x4000000>;
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	ethernet-phy@0 {
+		reg = <0x0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0xaa545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+
+	phy7: ethernet-phy@7 {
+		reg = <7>;
+	};
+};
+
+&gmac0 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <0>;
+
+	nvmem-cells = <&macaddr_fw_env_18>;
+	nvmem-cell-names = "mac-address";
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <1>;
+
+	nvmem-cells = <&macaddr_fw_env_0>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac3 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <3>;
+	phy-handle = <&phy7>;
+
+	nvmem-cells = <&macaddr_fw_env_6>;
+	nvmem-cell-names = "mac-address";
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 3 GPIO_ACTIVE_HIGH>;
+	pinctrl-0 = <&pcie0_pins>;
+	pinctrl-names = "default";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi0: wifi@1,0 {
+			compatible = "pci168c,0046";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&precal_ART_1000>, <&macaddr_fw_env_12>;
+			nvmem-cell-names = "pre-calibration", "mac-address";
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 48 GPIO_ACTIVE_HIGH>;
+	pinctrl-0 = <&pcie1_pins>;
+	pinctrl-names = "default";
+	max-link-speed = <1>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi1: wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&precal_ART_5000>, <&macaddr_fw_env_c>;
+			nvmem-cell-names = "pre-calibration", "mac-address";
+		};
+	};
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-xr450.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-xr450.dts
new file mode 100644
index 00000000000000..4353aec7ac0906
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-xr450.dts
@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq8065-nighthawk.dtsi"
+
+/ {
+	model = "Netgear Nighthawk XR450";
+	compatible = "netgear,xr450", "qcom,ipq8065", "qcom,ipq8064";
+
+};
+
+&leds {
+	usb1 {
+		label = "white:usb1";
+		gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+	};
+
+	usb2 {
+		label = "white:usb2";
+		gpios = <&qcom_pinmux 26 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&partitions {
+	partition@1880000 {
+		label = "ubi";
+		reg = <0x1880000 0xce00000>;
+	};
+
+	partition@e680000 {
+		label = "reserve";
+		reg = <0xe680000 0x0780000>;
+		read-only;
+	};
+};
+
+&wifi0 {
+	nvmem-cells = <&macaddr_art_c>, <&precal_art_1000>;
+	nvmem-cell-names = "mac-address", "pre-calibration";
+};
+
+&wifi1 {
+	nvmem-cells = <&macaddr_art_0>, <&precal_art_5000>;
+	nvmem-cell-names = "mac-address", "pre-calibration";
+};
+
+&art {
+	macaddr_art_c: macaddr@c {
+		reg = <0xc 0x6>;
+	};
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-xr500.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-xr500.dts
new file mode 100644
index 00000000000000..f584735e155e9f
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8065-xr500.dts
@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq8065-nighthawk.dtsi"
+
+/ {
+	model = "Netgear Nighthawk XR500";
+	compatible = "netgear,xr500", "qcom,ipq8065", "qcom,ipq8064";
+
+};
+
+&leds {
+	usb1 {
+		label = "white:usb1";
+		gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+	};
+
+	usb2 {
+		label = "white:usb2";
+		gpios = <&qcom_pinmux 26 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&partitions {
+	partition@1880000 {
+		label = "ubi";
+		reg = <0x1880000 0xce00000>;
+	};
+
+	partition@e680000 {
+		label = "reserve";
+		reg = <0xe680000 0x0780000>;
+		read-only;
+	};
+};
+
+&wifi0 {
+	nvmem-cells = <&macaddr_art_c>, <&precal_art_1000>;
+	nvmem-cell-names = "mac-address", "pre-calibration";
+};
+
+&wifi1 {
+	nvmem-cells = <&macaddr_art_0>, <&precal_art_5000>;
+	nvmem-cell-names = "mac-address", "pre-calibration";
+};
+
+&art {
+	macaddr_art_c: macaddr@c {
+		reg = <0xc 0x6>;
+	};
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8068-cryptid-common.dtsi b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8068-cryptid-common.dtsi
new file mode 100644
index 00000000000000..a8f43591f90535
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8068-cryptid-common.dtsi
@@ -0,0 +1,236 @@
+// SPDX-License-Identifier: GPL-2.0 OR MIT
+
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+/ {
+	memory {
+		device_type = "memory";
+		linux,usable-memory = <0x41500000 0x1ea00000>;
+		reg = <0x40000000 0x20000000>;
+	};
+
+	cpus {
+		idle-states {
+			CPU_SPC: spc {
+				status = "disabled";
+			};
+		};
+	};
+
+	chosen {
+		bootargs-append = " console=ttyMSM0,115200n8 ubi.mtd=ubi ubi.mtd=art";
+	};
+};
+
+&qcom_pinmux {
+	mdio0_pins_active: mdio0_pins_active {
+		mux {
+			pins = "gpio0", "gpio1";
+			function = "mdio";
+			drive-strength = <2>;
+			bias-pull-down;
+			output-low;
+		};
+
+		clk {
+			pins = "gpio1";
+			input-disable;
+		};
+	};
+
+	phy_active: phy_active {
+		phy {
+			pins = "gpio6", "gpio7";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+			output-high;
+		};
+	};
+
+	uart1_pins: uart1_pins {
+		mux {
+			pins = "gpio51", "gpio52";
+			function = "gsbi1";
+			drive-strength = <4>;
+			bias-disable;
+		};
+	};
+};
+
+&gsbi1 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_UART_W_FC>;
+
+	serial@12450000 {
+		status = "okay";
+
+		pinctrl-0 = <&uart1_pins>;
+		pinctrl-names = "default";
+	};
+};
+
+&pcie0 {
+	status = "okay";
+
+	/delete-property/ pinctrl-0;
+	/delete-property/ pinctrl-names;
+	/delete-property/ perst-gpios;
+
+	bridge@0,0 {
+		reg = <0x0 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi0: wifi@1,0 {
+			compatible = "qcom,ath10k";
+			status = "okay";
+			reg = <0x10000 0 0 0 0>;
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+
+	/delete-property/ pinctrl-0;
+	/delete-property/ pinctrl-names;
+	/delete-property/ perst-gpios;
+
+	bridge@0,0 {
+		reg = <0x0 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi1: wifi@1,0 {
+			compatible = "qcom,ath10k";
+			status = "okay";
+			reg = <0x10000 0 0 0 0>;
+		};
+	};
+};
+
+&pcie2 {
+	status = "okay";
+
+	/delete-property/ pinctrl-0;
+	/delete-property/ pinctrl-names;
+	/delete-property/ perst-gpios;
+
+	bridge@0,0 {
+		reg = <0x0 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi2: wifi@1,0 {
+			compatible = "qcom,ath10k";
+			status = "okay";
+			reg = <0x10000 0 0 0 0>;
+		};
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		compatible = "qcom,nandcs";
+
+		reg = <0>;
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		nand-is-boot-medium;
+		qcom,boot-partitions = <0x0 0x2140000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "sbl1";
+				reg = <0x0 0x40000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "mibib";
+				reg = <0x40000 0x140000>;
+				read-only;
+			};
+
+			partition@180000 {
+				label = "sbl2";
+				reg = <0x180000 0x140000>;
+				read-only;
+			};
+
+			partition@2c0000 {
+				label = "sbl3";
+				reg = <0x2c0000 0x280000>;
+				read-only;
+			};
+
+			partition@540000 {
+				label = "ddrconfig";
+				reg = <0x540000 0x120000>;
+				read-only;
+			};
+
+			partition@660000 {
+				label = "ssd";
+				reg = <0x660000 0x120000>;
+				read-only;
+			};
+
+			partition@780000 {
+				label = "tz";
+				reg = <0x780000 0x280000>;
+				read-only;
+			};
+
+			partition@a00000 {
+				label = "rpm";
+				reg = <0xa00000 0x280000>;
+				read-only;
+			};
+
+			partition@1fc0000 {
+				label = "u-boot";
+				reg = <0x1fc0000 0x180000>;
+				read-only;
+			};
+
+			partition@21c0000 {
+				label = "bootkernel1";
+				reg = <0x21c0000 0xa80000>;
+			};
+
+			partition@2c40000 {
+				label = "bootkernel2";
+				reg = <0x2c40000 0xa80000>;
+			};
+
+			partition@36c0000 {
+				label = "ubi";
+				reg = <0x36c0000 0x46c0000>;
+			};
+
+			partition@7d80000 {
+				label = "art";
+				reg = <0x7d80000 0x200000>;
+				read-only;
+			};
+		};
+	};
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8068-ecw5410.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8068-ecw5410.dts
new file mode 100644
index 00000000000000..50c1d37c29287e
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8068-ecw5410.dts
@@ -0,0 +1,329 @@
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	model = "Edgecore ECW5410";
+	compatible = "edgecore,ecw5410", "qcom,ipq8064";
+
+	reserved-memory {
+		nss@40000000 {
+			reg = <0x40000000 0x1000000>;
+			no-map;
+		};
+
+		smem: smem@41000000 {
+			reg = <0x41000000 0x200000>;
+			no-map;
+		};
+
+		wifi_dump@44000000 {
+			reg = <0x44000000 0x600000>;
+			no-map;
+		};
+	};
+
+	cpus {
+		idle-states {
+			CPU_SPC: spc {
+				status = "disabled";
+			};
+		};
+	};
+
+	aliases {
+		serial1 = &gsbi1_serial;
+		ethernet0 = &gmac2;
+		ethernet1 = &gmac3;
+
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_green;
+	};
+
+	chosen {
+		bootargs-append = " console=ttyMSM0,115200n8 root=/dev/ubiblock0_1";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 25 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		led_power_green: power_green {
+			label = "green:power";
+			gpios = <&qcom_pinmux 16 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan2g_green {
+			label = "green:wlan2g";
+			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_LOW>;
+		};
+
+		wlan2g_yellow {
+			label = "yellow:wlan2g";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_LOW>;
+		};
+
+		wlan5g_green {
+			label = "green:wlan5g";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_red: power_red {
+			label = "red:power";
+			gpios = <&qcom_pinmux 28 GPIO_ACTIVE_LOW>;
+		};
+
+		wlan5g_yellow {
+			label = "yellow:wlan5g";
+			gpios = <&qcom_pinmux 59 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+
+&qcom_pinmux {
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19";
+			function = "gsbi5";
+			drive-strength = <10>;
+			bias-pull-down;
+		};
+
+		clk {
+			pins = "gpio21";
+			function = "gsbi5";
+			drive-strength = <12>;
+			bias-pull-down;
+		};
+
+		cs {
+			pins = "gpio20";
+			function = "gpio";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio16", "gpio23", "gpio24", "gpio26",
+				   "gpio28", "gpio59";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	button_pins: button_pins {
+		mux {
+			pins = "gpio25";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	uart1_pins: uart1_pins {
+		mux {
+			pins = "gpio51", "gpio52", "gpio53", "gpio54";
+			function = "gsbi1";
+			drive-strength = <12>;
+			bias-none;
+		};
+	};
+};
+
+&gsbi1 {
+	qcom,mode = <GSBI_PROT_UART_W_FC>;
+	status = "okay";
+
+	serial@12450000 {
+		status = "okay";
+
+		pinctrl-0 = <&uart1_pins>;
+		pinctrl-names = "default";
+	};
+};
+
+&gsbi5 {
+	qcom,mode = <GSBI_PROT_SPI>;
+	status = "okay";
+
+	spi4: spi@1a280000 {
+		status = "okay";
+		spi-max-frequency = <50000000>;
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
+
+		m25p80@0 {
+			compatible = "jedec,spi-nor";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			spi-max-frequency = <50000000>;
+			reg = <0>;
+
+			partitions {
+				compatible = "qcom,smem-part";
+			};
+		};
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie1 {
+	status = "okay";
+
+	/delete-property/ pinctrl-0;
+	/delete-property/ pinctrl-names;
+	/delete-property/ perst-gpios;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "qcom,ath10k";
+			status = "okay";
+			reg = <0x00010000 0 0 0 0>;
+			qcom,ath10k-calibration-variant = "Edgecore-ECW5410-L";
+		};
+	};
+};
+
+&pcie2 {
+	status = "okay";
+
+	/delete-property/ pinctrl-0;
+	/delete-property/ pinctrl-names;
+	/delete-property/ perst-gpios;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "qcom,ath10k";
+			status = "okay";
+			reg = <0x00010000 0 0 0 0>;
+			qcom,ath10k-calibration-variant = "Edgecore-ECW5410-L";
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		compatible = "qcom,nandcs";
+
+		reg = <0>;
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			rootfs1@0 {
+				label = "rootfs1";
+				reg = <0x0000000 0x4000000>;
+			};
+
+			rootfs2@4000000 {
+				label = "rootfs2";
+				reg = <0x4000000 0x4000000>;
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+	};
+
+	phy1: ethernet-phy@1 {
+		reg = <1>;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+
+	qcom,id = <2>;
+	mdiobus = <&mdio0>;
+
+	phy-mode = "sgmii";
+	phy-handle = <&phy1>;
+};
+
+&gmac3 {
+	status = "okay";
+
+	qcom,id = <3>;
+	mdiobus = <&mdio0>;
+
+	phy-mode = "sgmii";
+	phy-handle = <&phy0>;
+};
+
+&adm_dma {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8068-mr42.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8068-mr42.dts
new file mode 100644
index 00000000000000..cfbfafb1793a07
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8068-mr42.dts
@@ -0,0 +1,228 @@
+// SPDX-License-Identifier: GPL-2.0 OR MIT
+
+#include "qcom-ipq8068-cryptid-common.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Meraki MR42";
+	compatible = "meraki,mr42", "qcom,ipq8064";
+
+	aliases {
+		serial1 = &gsbi1_serial;
+		ethernet0 = &gmac3;
+
+		led-boot = &led_active;
+		led-failsafe = &led_power;
+		led-running = &led_active;
+		led-upgrade = &led_active;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		led_power: power {
+			label = "orange:power";
+			gpios = <&qcom_pinmux 31 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_active: active {
+			label = "white:active";
+			gpios = <&qcom_pinmux 32 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&gmac3 {
+	status = "okay";
+
+	qcom,id = <3>;
+	mdiobus = <&mdio0>;
+
+	phy-mode = "sgmii";
+	phy-handle = <&phy2>;
+
+	nvmem-cells = <&mac_address>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gsbi2 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_I2C>;
+};
+
+&gsbi2_i2c {
+	status = "okay";
+
+	pinctrl-0 = <&i2c0_pins>;
+	pinctrl-names = "default";
+
+	ina2xx@40 {
+		compatible = "ina219";
+		shunt-resistor = <40000>;
+		reg = <0x40>;
+	};
+
+	eeprom@56 {
+		compatible = "atmel,24c64";
+		pagesize = <32>;
+		reg = <0x56>;
+		read-only;
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		mac_address: mac-address@66 {
+			reg = <0x66 0x6>;
+		};
+	};
+};
+
+&gsbi6 {
+	qcom,mode = <GSBI_PROT_I2C>;
+	status = "okay";
+};
+
+&gsbi6_i2c {
+	status = "okay";
+
+	pinctrl-0 = <&i2c1_pins>;
+	pinctrl-names = "default";
+
+	tlc591xx@40 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		compatible = "ti,tlc59108";
+		reg = <0x40>;
+
+		red@0 {
+			label = "red:user";
+			reg = <0x0>;
+		};
+
+		green@1 {
+			label = "green:user";
+			reg = <0x1>;
+		};
+
+		blue@2 {
+			label = "blue:user";
+			reg = <0x2>;
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins_active>, <&phy_active>;
+	pinctrl-names = "default";
+
+	phy2: ethernet-phy2 {
+		reg = <2>;
+
+		reset-gpios = <&qcom_pinmux 6 GPIO_ACTIVE_LOW>;
+		reset-assert-us = <24000>;
+
+		eee-broken-100tx;
+		eee-broken-1000t;
+	};
+};
+
+&qcom_pinmux {
+	i2c0_pins: i2c0_pins {
+		mux {
+			pins = "gpio24", "gpio25";
+			function = "gsbi2";
+			drive-strength = <2>;
+			bias-pull-up;
+			input;
+		};
+	};
+
+	button_pins: button_pins {
+		mux {
+			pins = "gpio26";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	i2c1_pins: i2c1_pins {
+		mux {
+			pins = "gpio29", "gpio30";
+			function = "gsbi6";
+			drive-strength = <2>;
+			bias-pull-up;
+			input;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio31", "gpio32";
+			function = "gpio";
+			drive-strength = <12>;
+			bias-pull-down;
+			output-low;
+		};
+	};
+};
+
+&wifi0 {
+	nvmem-cells = <&mac_address>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <1>;
+};
+
+&wifi1 {
+	nvmem-cells = <&mac_address>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <2>;
+};
+
+&wifi2 {
+	nvmem-cells = <&mac_address>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <3>;
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8068-mr52.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8068-mr52.dts
new file mode 100644
index 00000000000000..f81e3ef690dcc3
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8068-mr52.dts
@@ -0,0 +1,254 @@
+// SPDX-License-Identifier: GPL-2.0 OR MIT
+
+#include "qcom-ipq8068-cryptid-common.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Meraki MR52";
+	compatible = "meraki,mr52", "qcom,ipq8064";
+
+	aliases {
+		serial1 = &gsbi1_serial;
+		mdio-gpio0 = &mdio_gpio0;
+		ethernet0 = &gmac2;
+		ethernet1 = &gmac3;
+
+		led-boot = &led_active;
+		led-failsafe = &led_power;
+		led-running = &led_active;
+		led-upgrade = &led_active;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 25 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		led_power: power {
+			label = "orange:power";
+			gpios = <&qcom_pinmux 19 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan2_green {
+			label = "green:lan2";
+			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan1_green {
+			label = "green:lan1";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_active: active {
+			label = "white:active";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_LOW>;
+		};
+
+		lan2_orange {
+			label = "orange:lan2";
+			gpios = <&qcom_pinmux 60 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan1_orange {
+			label = "orange:lan1";
+			gpios = <&qcom_pinmux 62 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&gmac2 {
+	status = "okay";
+
+	qcom,id = <2>;
+	mdiobus = <&mdio0>;
+
+	phy-mode = "sgmii";
+	phy-handle = <&phy0>;
+
+	nvmem-cells = <&mac_address>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac3 {
+	status = "okay";
+
+	qcom,id = <3>;
+	mdiobus = <&mdio_gpio0>;
+
+	phy-mode = "sgmii";
+	phy-handle = <&phy4>;
+
+	nvmem-cells = <&mac_address>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <1>;
+};
+
+&gsbi7 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_I2C>;
+};
+
+&gsbi7_i2c {
+	status = "okay";
+
+	pinctrl-0 = <&i2c_pins>;
+	pinctrl-names = "default";
+
+	ina2xx@45 {
+		compatible = "ina219";
+		shunt-resistor = <80000>;
+		reg = <0x45>;
+	};
+
+	tlc591xx@49 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		compatible = "ti,tlc59108";
+		reg = <0x49>;
+
+		red@0 {
+			label = "red:user";
+			reg = <0x0>;
+		};
+
+		green@1 {
+			label = "green:user";
+			reg = <0x1>;
+		};
+
+		blue@2 {
+			label = "blue:user";
+			reg = <0x2>;
+		};
+	};
+
+	eeprom@52 {
+		compatible = "atmel,24c64";
+		pagesize = <32>;
+		reg = <0x52>;
+		read-only;
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		mac_address: mac-address@66 {
+			reg = <0x66 0x6>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	i2c_pins: i2c_pins {
+		mux {
+			pins = "gpio8", "gpio9";
+			function = "gsbi7";
+			drive-strength = <2>;
+			bias-pull-up;
+			input;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio19", "gpio26";
+			function = "gpio";
+			drive-strength = <12>;
+			bias-pull-down;
+			output-low;
+		};
+	};
+
+	button_pins: button_pins {
+		mux {
+			pins = "gpio25";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+			input;
+		};
+	};
+};
+
+&soc {
+	mdio_gpio0: mdio {
+		compatible = "virtual,mdio-gpio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "okay";
+
+		pinctrl-0 = <&mdio0_pins_active>, <&phy_active>;
+		pinctrl-names = "default";
+
+		gpios = <&qcom_pinmux 1 GPIO_ACTIVE_HIGH
+			 &qcom_pinmux 0 GPIO_ACTIVE_HIGH>;
+
+		phy0: ethernet-phy0 {
+			reg = <0>;
+			reset-gpios = <&qcom_pinmux 7 GPIO_ACTIVE_LOW>;
+			reset-assert-us = <24000>;
+		};
+
+		phy4: ethernet-phy4 {
+			reg = <4>;
+			reset-gpios = <&qcom_pinmux 6 GPIO_ACTIVE_LOW>;
+			reset-assert-us = <24000>;
+		};
+	};
+};
+
+&wifi0 {
+	nvmem-cells = <&mac_address>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <4>;
+};
+
+&wifi1 {
+	nvmem-cells = <&mac_address>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <3>;
+};
+
+&wifi2 {
+	nvmem-cells = <&mac_address>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <2>;
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8062-wg2600hp3.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8062-wg2600hp3.dts
new file mode 100644
index 00000000000000..c55287a4f129b8
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8062-wg2600hp3.dts
@@ -0,0 +1,510 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq8062-smb208.dtsi"
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "NEC Platforms Aterm WG2600HP3";
+	compatible = "nec,wg2600hp3", "qcom,ipq8062", "qcom,ipq8064";
+
+	memory {
+		device_type = "memory";
+		reg =  <0x42000000 0x1e000000>;
+	};
+
+	aliases {
+		label-mac-device = &gmac2;
+
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_red;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		pinctrl-0 = <&buttons_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 22 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		mode0 {
+			label = "mode0";
+			gpios = <&qcom_pinmux 40 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+			linux,input-type = <EV_SW>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		mode1 {
+			label = "mode1";
+			gpios = <&qcom_pinmux 41 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_1>;
+			linux,input-type = <EV_SW>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		pinctrl-0 = <&leds_pins>;
+		pinctrl-names = "default";
+
+		led_power_green: power_green {
+			label = "green:power";
+			gpios = <&qcom_pinmux 14 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_power_red: power_red {
+			label = "red:power";
+			gpios = <&qcom_pinmux 35 GPIO_ACTIVE_HIGH>;
+		};
+
+		active_green {
+			label = "green:active";
+			gpios = <&qcom_pinmux 42 GPIO_ACTIVE_HIGH>;
+		};
+
+		active_red {
+			label = "red:active";
+			gpios = <&qcom_pinmux 38 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan2g_green {
+			label = "green:wlan2g";
+			gpios = <&qcom_pinmux 55 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		wlan2g_red {
+			label = "red:wlan2g";
+			gpios = <&qcom_pinmux 56 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan5g_green {
+			label = "green:wlan5g";
+			gpios = <&qcom_pinmux 57 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wlan5g_red {
+			label = "red:wlan5g";
+			gpios = <&qcom_pinmux 58 GPIO_ACTIVE_HIGH>;
+		};
+
+		tv_green {
+			label = "green:tv";
+			gpios = <&qcom_pinmux 46 GPIO_ACTIVE_HIGH>;
+		};
+
+		tv_red {
+			label = "red:tv";
+			gpios = <&qcom_pinmux 36 GPIO_ACTIVE_HIGH>;
+		};
+
+		converter_green {
+			label = "green:converter";
+			gpios = <&qcom_pinmux 43 GPIO_ACTIVE_HIGH>;
+		};
+
+		converter_red {
+			label = "red:converter";
+			gpios = <&qcom_pinmux 15 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+/* nand_pins are used for leds_pins, empty the node
+ * from ipq8064.dtsi
+ */
+&nand_pins {
+	/delete-property/ disable;
+	/delete-property/ pullups;
+	/delete-property/ hold;
+};
+
+&qcom_pinmux {
+	pinctrl-0 = <&akro_pins>;
+	pinctrl-names = "default";
+
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19", "gpio21";
+			function = "gsbi5";
+			bias-pull-down;
+		};
+
+		data {
+			pins = "gpio18", "gpio19";
+			drive-strength = <10>;
+		};
+
+		cs {
+			pins = "gpio20";
+			drive-strength = <10>;
+		};
+
+		clk {
+			pins = "gpio21";
+			drive-strength = <12>;
+		};
+	};
+
+	buttons_pins: buttons_pins {
+		mux {
+			pins = "gpio22", "gpio24", "gpio40",
+				"gpio41";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	leds_pins: leds_pins {
+		mux {
+			pins = "gpio14", "gpio15", "gpio35",
+				"gpio36", "gpio38", "gpio42",
+				"gpio43", "gpio46", "gpio55",
+				"gpio56", "gpio57", "gpio58";
+			function = "gpio";
+			bias-pull-down;
+		};
+
+		akro2 {
+			pins = "gpio15", "gpio35", "gpio38",
+				"gpio42", "gpio43", "gpio46",
+				"gpio55", "gpio56", "gpio57",
+				"gpio58";
+			drive-strength = <2>;
+		};
+
+		akro4 {
+			pins = "gpio14", "gpio36";
+			drive-strength = <4>;
+		};
+	};
+
+	/*
+	 * Stock firmware has the following settings, so let's do the same.
+	 * I don't sure why these are required.
+	 */
+	akro_pins: akro_pinmux {
+		akro {
+			pins = "gpio17", "gpio26", "gpio47";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+
+		reset {
+			pins = "gpio45";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-disable;
+			output-low;
+		};
+
+		gmac0_rgmii {
+			pins = "gpio25";
+			function = "gpio";
+			drive-strength = <8>;
+			bias-disable;
+		};
+	};
+};
+
+&gsbi5 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_SPI>;
+
+	spi@1a280000 {
+		status = "okay";
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
+
+		flash@0 {
+			compatible = "jedec,spi-nor";
+			reg = <0>;
+			spi-max-frequency = <50000000>;
+			m25p,fast-read;
+
+			partitions {
+				compatible = "fixed-partitions";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				partition@0 {
+					label = "SBL1";
+					reg = <0x0000000 0x0020000>;
+					read-only;
+				};
+
+				partition@20000 {
+					label = "MIBIB";
+					reg = <0x0020000 0x0020000>;
+					read-only;
+				};
+
+				partition@40000 {
+					label = "SBL2";
+					reg = <0x0040000 0x0040000>;
+					read-only;
+				};
+
+				partition@80000 {
+					label = "SBL3";
+					reg = <0x0080000 0x0080000>;
+					read-only;
+				};
+
+				partition@100000 {
+					label = "DDRCONFIG";
+					reg = <0x0100000 0x0010000>;
+					read-only;
+				};
+
+				partition@110000 {
+					label = "SSD";
+					reg = <0x0110000 0x0010000>;
+					read-only;
+				};
+
+				partition@120000 {
+					label = "TZ";
+					reg = <0x0120000 0x0080000>;
+					read-only;
+				};
+
+				partition@1a0000 {
+					label = "RPM";
+					reg = <0x01a0000 0x0080000>;
+					read-only;
+				};
+
+				partition@220000 {
+					label = "APPSBL";
+					reg = <0x0220000 0x0080000>;
+					read-only;
+				};
+
+				partition@2a0000 {
+					label = "APPSBLENV";
+					reg = <0x02a0000 0x0010000>;
+					read-only;
+				};
+
+				factory: partition@2b0000 {
+					label = "PRODUCTDATA";
+					reg = <0x02b0000 0x0030000>;
+					read-only;
+				};
+
+				partition@2e0000 {
+					label = "ART";
+					reg = <0x02e0000 0x0040000>;
+					read-only;
+					compatible = "nvmem-cells";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					precal_ART_1000: precal@1000 {
+						reg = <0x1000 0x2f20>;
+					};
+
+					precal_ART_5000: precal@5000 {
+						reg = <0x5000 0x2f20>;
+					};
+				};
+
+				partition@320000 {
+					label = "TP";
+					reg = <0x0320000 0x0040000>;
+					read-only;
+				};
+
+				partition@360000 {
+					label = "TINY";
+					reg = <0x0360000 0x0500000>;
+					read-only;
+				};
+
+				partition@860000 {
+					compatible = "denx,uimage";
+					label = "firmware";
+					reg = <0x0860000 0x17a0000>;
+				};
+			};
+		};
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "qcom,ath10k";
+			reg = <0x00010000 0 0 0 0>;
+
+			qcom,ath10k-calibration-variant = "NEC-Platforms-WG2600HP3";
+
+			nvmem-cells = <&macaddr_PRODUCTDATA_12>, <&precal_ART_1000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+	force_gen1 = <1>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "qcom,ath10k";
+			reg = <0x00010000 0 0 0 0>;
+
+			ieee80211-freq-limit = <2400000 2483000>;
+			qcom,ath10k-calibration-variant = "NEC-Platforms-WG2600HP3";
+
+			nvmem-cells = <&macaddr_PRODUCTDATA_c>, <&precal_ART_5000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x04 0x80080080  /* PAD0_MODE */
+			0x0c 0x06000000  /* PAD6_MODE */
+			0x10 0x002613a0  /* PWS_REG */
+			0x50 0xcc36cc36  /* LED_CTRL0 */
+			0x54 0xca36ca36  /* LED_CTRL1 */
+			0x58 0xc936c936  /* LED_CTRL2 */
+			0x5c 0x03ffff00  /* LED_CTRL3 */
+			0x7c 0x0000004e  /* PORT0_STATUS */
+			0x94 0x0000004e  /* PORT6_STATUS */
+			0xe0 0xc74164de  /* SGMII_CTRL */
+			0xe4 0x0006a545  /* MAC_PWR_SEL */
+			>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+	mdiobus = <&mdio0>;
+	nvmem-cells = <&macaddr_factory_0>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+	mdiobus = <&mdio0>;
+	nvmem-cells = <&macaddr_factory_6>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_0: macaddr@0 {
+		reg = <0x0 0x6>;
+	};
+
+	macaddr_factory_6: macaddr@6 {
+		reg = <0x6 0x6>;
+	};
+
+	macaddr_PRODUCTDATA_c: macaddr@c {
+		reg = <0xc 0x6>;
+	};
+
+	macaddr_PRODUCTDATA_12: macaddr@12 {
+		reg = <0x12 0x6>;
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-ad7200-c2600.dtsi b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-ad7200-c2600.dtsi
new file mode 100644
index 00000000000000..3494b2bde2f28e
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-ad7200-c2600.dtsi
@@ -0,0 +1,402 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	reserved-memory {
+		ramoops@42100000 {
+			compatible = "ramoops";
+			reg = <0x42100000 0x40000>;
+			record-size = <0x4000>;
+			console-size = <0x4000>;
+			ftrace-size = <0x4000>;
+			pmsg-size = <0x4000>;
+		};
+	};
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+		label-mac-device = &gmac2;
+	};
+};
+
+&qcom_pinmux {
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19", "gpio21";
+			function = "gsbi5";
+			bias-pull-down;
+		};
+
+		data {
+			pins = "gpio18", "gpio19";
+			drive-strength = <10>;
+		};
+
+		cs {
+			pins = "gpio20";
+			function = "gpio";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+
+		clk {
+			pins = "gpio21";
+			drive-strength = <12>;
+		};
+	};
+
+	usb0_pwr_en_pin: usb0_pwr_en_pin {
+		mux {
+			pins = "gpio25";
+			function = "gpio";
+			drive-strength = <10>;
+			bias-pull-up;
+			output-high;
+		};
+	};
+
+	usb1_pwr_en_pin: usb1_pwr_en_pin {
+		mux {
+			pins = "gpio23";
+			function = "gpio";
+			drive-strength = <10>;
+			bias-pull-up;
+			output-high;
+		};
+	};
+};
+
+&gsbi5 {
+	qcom,mode = <GSBI_PROT_SPI>;
+	status = "okay";
+
+	spi@1a280000 {
+		status = "okay";
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
+
+		flash@0 {
+			compatible = "jedec,spi-nor";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			spi-max-frequency = <50000000>;
+			reg = <0>;
+
+			partitions {
+				compatible = "fixed-partitions";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				partition@0 {
+					label = "SBL1";
+					reg = <0x0 0x20000>;
+					read-only;
+				};
+
+				partition@20000 {
+					label = "MIBIB";
+					reg = <0x20000 0x20000>;
+					read-only;
+				};
+
+				partition@40000 {
+					label = "SBL2";
+					reg = <0x40000 0x20000>;
+					read-only;
+				};
+
+				partition@60000 {
+					label = "SBL3";
+					reg = <0x60000 0x30000>;
+					read-only;
+				};
+
+				partition@90000 {
+					label = "DDRCONFIG";
+					reg = <0x90000 0x10000>;
+					read-only;
+				};
+
+				partition@a0000 {
+					label = "SSD";
+					reg = <0xa0000 0x10000>;
+					read-only;
+				};
+
+				partition@b0000 {
+					label = "TZ";
+					reg = <0xb0000 0x30000>;
+					read-only;
+				};
+
+				partition@e0000 {
+					label = "RPM";
+					reg = <0xe0000 0x20000>;
+					read-only;
+				};
+
+				partition@100000 {
+					label = "fs-uboot";
+					reg = <0x100000 0x70000>;
+					read-only;
+				};
+
+				partition@170000 {
+					label = "uboot-env";
+					reg = <0x170000 0x40000>;
+					read-only;
+				};
+
+				partition@1b0000 {
+					label = "radio";
+					reg = <0x1b0000 0x40000>;
+					read-only;
+					compatible = "nvmem-cells";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					precal_radio_1000: precal@1000 {
+						reg = <0x1000 0x2f20>;
+					};
+
+					precal_radio_5000: precal@5000 {
+						reg = <0x5000 0x2f20>;
+					};
+				};
+
+				partition@1f0000 {
+					label = "os-image";
+					reg = <0x1f0000 0x400000>;
+				};
+
+				partition@5f0000 {
+					label = "rootfs";
+					reg = <0x5f0000 0x1900000>;
+				};
+
+				defaultmac: partition@1ef0000 {
+					label = "default-mac";
+					reg = <0x1ef0000 0x00200>;
+					read-only;
+				};
+
+				partition@1ef0200 {
+					label = "pin";
+					reg = <0x1ef0200 0x00200>;
+					read-only;
+				};
+
+				partition@1ef0400 {
+					label = "product-info";
+					reg = <0x1ef0400 0x0fc00>;
+					read-only;
+				};
+
+				partition@1f00000 {
+					label = "partition-table";
+					reg = <0x1f00000 0x10000>;
+					read-only;
+				};
+
+				partition@1f10000 {
+					label = "soft-version";
+					reg = <0x1f10000 0x10000>;
+					read-only;
+				};
+
+				partition@1f20000 {
+					label = "support-list";
+					reg = <0x1f20000 0x10000>;
+					read-only;
+				};
+
+				partition@1f30000 {
+					label = "profile";
+					reg = <0x1f30000 0x10000>;
+					read-only;
+				};
+
+				partition@1f40000 {
+					label = "default-config";
+					reg = <0x1f40000 0x10000>;
+					read-only;
+				};
+
+				partition@1f50000 {
+					label = "user-config";
+					reg = <0x1f50000 0x40000>;
+					read-only;
+				};
+
+				partition@1f90000 {
+					label = "qos-db";
+					reg = <0x1f90000 0x40000>;
+					read-only;
+				};
+
+				partition@1fd0000 {
+					label = "usb-config";
+					reg = <0x1fd0000 0x10000>;
+					read-only;
+				};
+
+				partition@1fe0000 {
+					label = "log";
+					reg = <0x1fe0000 0x20000>;
+					read-only;
+				};
+			};
+		};
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+
+	pinctrl-0 = <&usb0_pwr_en_pin>;
+	pinctrl-names = "default";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+
+	pinctrl-0 = <&usb1_pwr_en_pin>;
+	pinctrl-names = "default";
+};
+
+&pcie0 {
+	status = "okay";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_defaultmac_8>, <&precal_radio_1000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+			mac-address-increment = <(-1)>;
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+	max-link-speed = <1>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_defaultmac_8>, <&precal_radio_5000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	nvmem-cells = <&macaddr_defaultmac_8>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <1>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	nvmem-cells = <&macaddr_defaultmac_8>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&defaultmac {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_defaultmac_8: macaddr@8 {
+		reg = <0x8 0x6>;
+	};
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-ad7200.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-ad7200.dts
new file mode 100644
index 00000000000000..6cb21fc4f3f08a
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-ad7200.dts
@@ -0,0 +1,135 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq8064-ad7200-c2600.dtsi"
+
+/ {
+	model = "TP-Link Talon AD7200";
+	compatible = "tplink,ad7200", "qcom,ipq8064";
+
+	aliases {
+		led-boot = &led_status;
+		led-failsafe = &led_status;
+		led-running = &led_status;
+		led-upgrade = &led_status;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wifi {
+			label = "wifi";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 67 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		led_enable {
+			label = "led-enable";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_LIGHTS_TOGGLE>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		lan {
+			label = "blue:lan";
+			gpios = <&qcom_pinmux 2 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb1 {
+			label = "blue:usb1";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan5g {
+			label = "blue:wlan5g";
+			gpios = <&qcom_pinmux 15 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb3 {
+			label = "blue:usb3";
+			gpios = <&qcom_pinmux 16 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan2g {
+			label = "blue:wlan2g";
+			gpios = <&qcom_pinmux 17 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan_orange {
+			label = "orange:wan";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_LOW>;
+		};
+
+		wan_blue {
+			label = "blue:wan";
+			gpios = <&qcom_pinmux 33 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "blue:wps";
+			gpios = <&qcom_pinmux 55 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan60g {
+			label = "blue:wlan60g";
+			gpios = <&qcom_pinmux 56 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status: status {
+			label = "blue:status";
+			gpios = <&qcom_pinmux 66 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio53", "gpio54", "gpio67";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio2", "gpio8", "gpio15", "gpio16", "gpio17", "gpio26",
+					"gpio33", "gpio55", "gpio56", "gpio66";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+};
+
+&pcie2 {
+	status = "okay";
+	max-link-speed = <1>;
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-ap148.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-ap148.dts
new file mode 100644
index 00000000000000..d3b7c44877e2ea
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-ap148.dts
@@ -0,0 +1,134 @@
+#include "qcom-ipq8064-v1.0.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. IPQ8064/AP-148";
+	compatible = "qcom,ipq8064-ap148", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	reserved-memory {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+		rsvd@41200000 {
+			reg = <0x41200000 0x300000>;
+			no-map;
+		};
+	};
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&flash {
+	partitions {
+		compatible = "qcom,smem-part";
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+};
+
+&pcie1 {
+	status = "okay";
+	max-link-speed = <1>;
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		partitions {
+			compatible = "qcom,smem-part";
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-ap161.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-ap161.dts
new file mode 100644
index 00000000000000..02ddbf31180fc1
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-ap161.dts
@@ -0,0 +1,172 @@
+#include "qcom-ipq8064-v1.0.dtsi"
+
+/ {
+	model = "Qualcomm IPQ8064/AP161";
+	compatible = "qcom,ipq8064-ap161", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	reserved-memory {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+		rsvd@41200000 {
+			reg = <0x41200000 0x300000>;
+			no-map;
+		};
+	};
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+	};
+};
+
+&qcom_pinmux {
+	rgmii2_pins: rgmii2-pins {
+		mux {
+			pins = "gpio27", "gpio28", "gpio29",
+			       "gpio30", "gpio31", "gpio32",
+			       "gpio51", "gpio52", "gpio59",
+			       "gpio60", "gpio61", "gpio62",
+			       "gpio2", "gpio66";
+		};
+	};
+};
+
+&flash {
+	partitions {
+		compatible = "qcom,smem-part";
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+};
+
+&pcie1 {
+	status = "okay";
+	max-link-speed = <1>;
+};
+
+&pcie2 {
+	status = "okay";
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		partitions {
+			compatible = "qcom,smem-part";
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x20080     /* PAD6_MODE */
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+		qca,phy-rgmii-en;
+		qca,txclk-delay-en;
+		qca,rxclk-delay-en;
+	};
+
+	phy3: ethernet-phy@3 {
+		device_type = "ethernet-phy";
+		reg = <3>;
+	};
+};
+
+&gmac0 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <0>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+	mdiobus = <&mdio0>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+	mdiobus = <&mdio0>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+	mdiobus = <&mdio0>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-asus-onhub.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-asus-onhub.dts
new file mode 100644
index 00000000000000..442bcf19a675b1
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-asus-onhub.dts
@@ -0,0 +1,92 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright 2014 The ChromiumOS Authors
+ */
+
+#include "qcom-ipq8064-onhub.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/soc/qcom,gsbi.h>
+
+/ {
+	model = "ASUS OnHub";
+	compatible = "asus,onhub", "google,arkham", "qcom,ipq8064";
+};
+
+&qcom_pinmux {
+	ap3223_pins: ap3223_pinmux {
+		pins = "gpio22";
+		function = "gpio";
+		bias-none;
+	};
+
+	i2c7_pins: i2c7_pinmux {
+		mux {
+			pins = "gpio8", "gpio9";
+			function = "gsbi7";
+		};
+		data {
+			pins = "gpio8";
+			bias-disable;
+		};
+		clk {
+			pins = "gpio9";
+			bias-disable;
+		};
+	};
+};
+
+&gsbi7 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_I2C_UART>;
+};
+
+&gsbi7_i2c {
+	status = "okay";
+	clock-frequency = <100000>;
+	pinctrl-0 = <&i2c7_pins>;
+	pinctrl-names = "default";
+
+	ap3223@1c {
+		compatible = "dynaimage,ap3223";
+		reg = <0x1c>;
+
+		pinctrl-0 = <&ap3223_pins>;
+		pinctrl-names = "default";
+
+		int-gpio = <&qcom_pinmux 22 GPIO_ACTIVE_LOW>;
+	};
+
+	led-controller@32 {
+		compatible = "national,lp5523";
+		reg = <0x32>;
+		clock-mode = /bits/ 8 <1>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		led@4 {
+			reg = <4>;
+			color = <LED_COLOR_ID_GREEN>;
+			chan-name = "green:status";
+			linux,default-trigger = "default-on";
+			led-cur = /bits/ 8 <0xfa>;
+			max-cur = /bits/ 8 <0xff>;
+		};
+
+		led@5 {
+			reg = <5>;
+			color = <LED_COLOR_ID_BLUE>;
+			chan-name = "blue:status";
+			led-cur = /bits/ 8 <0xfa>;
+			max-cur = /bits/ 8 <0xff>;
+		};
+
+		led@8 {
+			reg = <8>;
+			color = <LED_COLOR_ID_RED>;
+			chan-name = "red:status";
+			led-cur = /bits/ 8 <0xfa>;
+			max-cur = /bits/ 8 <0xff>;
+		};
+	};
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-c2600.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-c2600.dts
new file mode 100644
index 00000000000000..cef1aba34445d3
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-c2600.dts
@@ -0,0 +1,119 @@
+#include "qcom-ipq8064-ad7200-c2600.dtsi"
+
+/ {
+	model = "TP-Link Archer C2600";
+	compatible = "tplink,c2600", "qcom,ipq8064";
+
+	aliases {
+		led-boot = &power;
+		led-failsafe = &general;
+		led-running = &power;
+		led-upgrade = &general;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wifi {
+			label = "wifi";
+			gpios = <&qcom_pinmux 49 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		ledswitch {
+			label = "ledswitch";
+			gpios = <&qcom_pinmux 16 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_LIGHTS_TOGGLE>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		lan {
+			label = "white:lan";
+			gpios = <&qcom_pinmux 6 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb4 {
+			label = "white:usb_4";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb2 {
+			label = "white:usb_2";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+
+		wps {
+			label = "white:wps";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan_amber {
+			label = "amber:wan";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_LOW>;
+		};
+
+		wan_white {
+			label = "white:wan";
+			gpios = <&qcom_pinmux 33 GPIO_ACTIVE_LOW>;
+		};
+
+		power: power {
+			label = "white:power";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+			default-state = "keep";
+		};
+
+		general: general {
+			label = "white:general";
+			gpios = <&qcom_pinmux 66 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio16", "gpio54", "gpio65";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio6", "gpio7", "gpio8", "gpio9", "gpio26", "gpio33",
+					"gpio53", "gpio66";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-d7800.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-d7800.dts
new file mode 100644
index 00000000000000..b8273c614ae92c
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-d7800.dts
@@ -0,0 +1,394 @@
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Netgear Nighthawk X4 D7800";
+	compatible = "netgear,d7800", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	reserved-memory {
+		rsvd@5fe00000 {
+			reg = <0x5fe00000 0x200000>;
+			reusable;
+		};
+	};
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+
+		led-boot = &power_white;
+		led-failsafe = &power_amber;
+		led-running = &power_white;
+		led-upgrade = &power_amber;
+	};
+
+	chosen {
+		bootargs = "rootfstype=squashfs noinitrd";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wifi {
+			label = "wifi";
+			gpios = <&qcom_pinmux 6 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		usb1 {
+			label = "white:usb1";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb2 {
+			label = "white:usb2";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+
+		power_amber: power_amber {
+			label = "amber:power";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan_white {
+			label = "white:wan";
+			gpios = <&qcom_pinmux 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan_amber {
+			label = "amber:wan";
+			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_HIGH>;
+		};
+
+		wps {
+			label = "white:wps";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_HIGH>;
+		};
+
+		esata {
+			label = "white:esata";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_HIGH>;
+		};
+
+		power_white: power_white {
+			label = "white:power";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+			default-state = "keep";
+		};
+
+		wifi {
+			label = "white:wifi";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio6", "gpio54", "gpio65";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio7", "gpio8", "gpio9", "gpio22", "gpio23",
+				"gpio24","gpio26", "gpio53", "gpio64";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	usb0_pwr_en_pins: usb0_pwr_en_pins {
+		mux {
+			pins = "gpio15";
+			function = "gpio";
+			drive-strength = <12>;
+			bias-pull-down;
+			output-high;
+		};
+	};
+
+	usb1_pwr_en_pins: usb1_pwr_en_pins {
+		mux {
+			pins = "gpio16", "gpio68";
+			function = "gpio";
+			drive-strength = <12>;
+			bias-pull-down;
+			output-high;
+		};
+	};
+};
+
+&sata_phy {
+	status = "okay";
+};
+
+&sata {
+	status = "okay";
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+
+	pinctrl-0 = <&usb0_pwr_en_pins>;
+	pinctrl-names = "default";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+
+	pinctrl-0 = <&usb1_pwr_en_pins>;
+	pinctrl-names = "default";
+};
+
+&pcie0 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 3 GPIO_ACTIVE_HIGH>;
+	pinctrl-0 = <&pcie0_pins>;
+	pinctrl-names = "default";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_art_6>, <&precal_art_1000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+			mac-address-increment = <(1)>;
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 48 GPIO_ACTIVE_HIGH>;
+	pinctrl-0 = <&pcie1_pins>;
+	pinctrl-names = "default";
+	max-link-speed = <1>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_art_6>, <&precal_art_5000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+			mac-address-increment = <(2)>;
+		};
+	};
+};
+
+&pcie2 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 63 GPIO_ACTIVE_HIGH>;
+	pinctrl-0 = <&pcie2_pins>;
+	pinctrl-names = "default";
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		nand-is-boot-medium;
+		qcom,boot-partitions = <0x0 0x1180000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			qcadata@0 {
+				label = "qcadata";
+				reg = <0x0000000 0x0c80000>;
+				read-only;
+			};
+
+			APPSBL@c80000 {
+				label = "APPSBL";
+				reg = <0x0c80000 0x0500000>;
+				read-only;
+			};
+
+			APPSBLENV@1180000 {
+				label = "APPSBLENV";
+				reg = <0x1180000 0x0080000>;
+				read-only;
+			};
+
+			art@1200000 {
+				label = "art";
+				reg = <0x1200000 0x0140000>;
+				read-only;
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_art_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_art_6: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+
+				precal_art_1000: precal@1000 {
+					reg = <0x1000 0x2f20>;
+				};
+
+				precal_art_5000: precal@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+			};
+
+			artbak: art@1340000 {
+				label = "artbak";
+				reg = <0x1340000 0x0140000>;
+				read-only;
+			};
+
+			kernel@1480000 {
+				label = "kernel";
+				reg = <0x1480000 0x0400000>;
+			};
+
+			ubi@1880000 {
+				label = "ubi";
+				reg = <0x1880000 0x6080000>;
+			};
+
+			reserve@7900000 {
+				label = "reserve";
+				reg = <0x7900000 0x0700000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	nvmem-cells = <&macaddr_art_6>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	nvmem-cells = <&macaddr_art_0>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-db149.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-db149.dts
new file mode 100644
index 00000000000000..f628df919b4872
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-db149.dts
@@ -0,0 +1,179 @@
+#include "qcom-ipq8064-v1.0.dtsi"
+
+/ {
+	model = "Qualcomm IPQ8064/DB149";
+	compatible = "qcom,ipq8064-db149", "qcom,ipq8064";
+
+	aliases {
+		serial0 = &gsbi2_serial;
+	};
+
+	reserved-memory {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+		rsvd@41200000 {
+			reg = <0x41200000 0x300000>;
+			no-map;
+		};
+	};
+};
+
+&qcom_pinmux {
+	rgmii0_pins: rgmii0_pins {
+		mux {
+			pins = "gpio2", "gpio66";
+			drive-strength = <8>;
+			bias-disable;
+		};
+	};
+};
+
+&gsbi2 {
+	qcom,mode = <GSBI_PROT_I2C_UART>;
+	status = "okay";
+
+	gsbi2_serial: serial@12490000 {
+		status = "okay";
+	};
+};
+
+&gsbi4 {
+	status = "disabled";
+};
+
+&gsbi4_serial {
+	status = "disabled";
+};
+
+&flash {
+	m25p,fast-read;
+
+	partition@0 {
+		label = "lowlevel_init";
+		reg = <0x0 0x1b0000>;
+	};
+
+	partition@1 {
+		label = "u-boot";
+		reg = <0x1b0000 0x80000>;
+	};
+
+	partition@2 {
+		label = "u-boot-env";
+		reg = <0x230000 0x40000>;
+	};
+
+	partition@3 {
+		label = "caldata";
+		reg = <0x270000 0x40000>;
+	};
+
+	partition@4 {
+		label = "firmware";
+		reg = <0x2b0000 0x1d50000>;
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+};
+
+&pcie1 {
+	status = "okay";
+};
+
+&pcie2 {
+	status = "okay";
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+		>;
+	};
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+
+	phy6: ethernet-phy@6 {
+		reg = <6>;
+	};
+
+	phy7: ethernet-phy@7 {
+		reg = <7>;
+	};
+};
+
+&gmac0 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <0>;
+	phy-handle = <&phy4>;
+
+	pinctrl-0 = <&rgmii0_pins>;
+	pinctrl-names = "default";
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <1>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+	phy-handle = <&phy6>;
+};
+
+&gmac3 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <3>;
+	phy-handle = <&phy7>;
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-ea7500-v1.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-ea7500-v1.dts
new file mode 100644
index 00000000000000..9d82d52d273ffd
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-ea7500-v1.dts
@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq8064-eax500.dtsi"
+
+/ {
+	model = "Linksys EA7500 V1 WiFi Router";
+	compatible = "linksys,ea7500-v1", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0xe000000>;
+		device_type = "memory";
+	};
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	chosen {
+		/* look for root deviceblock nbr in this bootarg */
+		find-rootblock = "ubi.mtd=";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 68 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		led_power: power {
+			label = "white:power";
+			gpios = <&qcom_pinmux 6 GPIO_ACTIVE_LOW>;
+			default-state = "keep";
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio65", "gpio68";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio6";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+};
+
+&partitions {
+	partition@5f80000 {
+		label = "sysdiag";
+		reg = <0x5f80000 0x100000>;
+	};
+
+	partition@6080000 {
+		label = "syscfg";
+		reg = <0x6080000 0x1f80000>;
+	};
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-ea8500.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-ea8500.dts
new file mode 100644
index 00000000000000..1c6a4bdacd02c2
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-ea8500.dts
@@ -0,0 +1,128 @@
+#include "qcom-ipq8064-eax500.dtsi"
+
+/ {
+	model = "Linksys EA8500 WiFi Router";
+	compatible = "linksys,ea8500", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wifi {
+			label = "wifi";
+			gpios = <&qcom_pinmux 67 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 68 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		wps {
+			label = "green:wps";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_power: power {
+			label = "white:power";
+			gpios = <&qcom_pinmux 6 GPIO_ACTIVE_LOW>;
+			default-state = "keep";
+		};
+
+		wifi {
+			label = "green:wifi";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio65", "gpio67", "gpio68";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio6", "gpio53", "gpio54";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+};
+
+&sata_phy {
+	status = "okay";
+};
+
+&sata {
+	status = "okay";
+};
+
+&partitions {
+	partition@5f80000 {
+		label = "syscfg";
+		reg = <0x5f80000 0x2080000>;
+	};
+};
+
+&mdio0 {
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&gmac1 {
+	qcom,phy_mdio_addr = <4>;
+	qcom,poll_required = <1>;
+	qcom,rgmii_delay = <0>;
+	qcom,emulation = <0>;
+};
+
+/* LAN */
+&gmac2 {
+	qcom,phy_mdio_addr = <0>;	/* none */
+	qcom,poll_required = <0>;	/* no polling */
+	qcom,rgmii_delay = <0>;
+	qcom,emulation = <0>;
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-eax500.dtsi b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-eax500.dtsi
new file mode 100644
index 00000000000000..910bd86bc5ff2c
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-eax500.dtsi
@@ -0,0 +1,232 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	chosen {
+		bootargs = "console=ttyMSM0,115200n8";
+		/* append to bootargs adding the root deviceblock nbr from bootloader */
+		append-rootblock = "ubi.mtd=";
+	};
+};
+
+&qcom_pinmux {
+	/* eax500 routers reuse the pcie2 reset pin for switch reset pin */
+	switch_reset: switch_reset_pins {
+		mux {
+			pins = "gpio63";
+			function = "gpio";
+			drive-strength = <12>;
+			bias-pull-up;
+		};
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+
+	max-link-speed = <1>;
+};
+
+&pcie1 {
+	status = "okay";
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		nand-is-boot-medium;
+		qcom,boot-partitions = <0x0 0x0c80000>;
+
+		partitions: partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "SBL1";
+				reg = <0x0000000 0x0040000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "MIBIB";
+				reg = <0x0040000 0x0140000>;
+				read-only;
+			};
+
+			partition@180000 {
+				label = "SBL2";
+				reg = <0x0180000 0x0140000>;
+				read-only;
+			};
+
+			partition@2c0000 {
+				label = "SBL3";
+				reg = <0x02c0000 0x0280000>;
+				read-only;
+			};
+
+			partition@540000 {
+				label = "DDRCONFIG";
+				reg = <0x0540000 0x0120000>;
+				read-only;
+			};
+
+			partition@660000 {
+				label = "SSD";
+				reg = <0x0660000 0x0120000>;
+				read-only;
+			};
+
+			partition@780000 {
+				label = "TZ";
+				reg = <0x0780000 0x0280000>;
+				read-only;
+			};
+
+			partition@a00000 {
+				label = "RPM";
+				reg = <0x0a00000 0x0280000>;
+				read-only;
+			};
+
+			art: partition@c80000 {
+				label = "art";
+				reg = <0x0c80000 0x0140000>;
+				read-only;
+			};
+
+			partition@dc0000 {
+				label = "APPSBL";
+				reg = <0x0dc0000 0x0100000>;
+				read-only;
+			};
+
+			partition@ec0000 {
+				label = "u_env";
+				reg = <0x0ec0000 0x0040000>;
+			};
+
+			partition@f00000 {
+				label = "s_env";
+				reg = <0x0f00000 0x0040000>;
+			};
+
+			partition@f40000 {
+				label = "devinfo";
+				reg = <0x0f40000 0x0040000>;
+			};
+
+			partition@f80000 {
+				label = "kernel1";
+				reg = <0x0f80000 0x2800000>;  /* 4 MB, spill to rootfs */
+			};
+
+			partition@1380000 {
+				label = "rootfs1";
+				reg = <0x1380000 0x2400000>;
+			};
+
+			partition@3780000 {
+				label = "kernel2";
+				reg = <0x3780000 0x2800000>;
+			};
+
+			partition@3b80000 {
+				label = "rootfs2";
+				reg = <0x3b80000 0x2400000>;
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	/* Switch from documentation require at least 10ms for reset */
+	reset-gpios = <&qcom_pinmux 63 GPIO_ACTIVE_HIGH>;
+	reset-post-delay-us = <12000>;
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x00010 0x2613a0    /* PWS_REG */
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-g10.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-g10.dts
new file mode 100644
index 00000000000000..63a72b53ae734b
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-g10.dts
@@ -0,0 +1,292 @@
+// SPDX-License-Identifier: GPL-2.0
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	compatible = "asrock,g10", "qcom,ipq8064";
+	model = "ASRock G10";
+
+	aliases {
+		ethernet0 = &gmac1;
+		ethernet1 = &gmac0;
+
+		led-boot = &led_status_blue;
+		led-failsafe = &led_status_amber;
+		led-running = &led_status_blue;
+		led-upgrade = &led_status_amber;
+	};
+
+	chosen {
+		bootargs-override = "console=ttyMSM0,115200n8";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		/*
+		 * this is a bit misleading. Because there are about seven
+		 * multicolor LEDs connected all wired together in parallel.
+		 */
+
+		status_yellow {
+			label = "yellow:status";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_amber: status_amber {
+			label = "amber:status";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_blue: status_blue {
+			label = "blue:status";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		/*
+		 * LED is declared in vendors boardfile but it's not
+		 * working and the manual doesn't mention anything
+		 * about the LED being white.
+
+		status_white {
+			label = "white:status";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_HIGH>;
+		};
+		*/
+	};
+
+	i2c-gpio {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		compatible = "i2c-gpio";
+		gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>, /* sda */
+			<&qcom_pinmux 54 GPIO_ACTIVE_HIGH>; /* scl */
+		i2c-gpio,delay-us = <5>;
+		i2c-gpio,scl-output-only;
+
+		mcu@50 {
+			reg = <0x50>;
+			compatible = "sonix,sn8f25e21";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		ir-remote {
+			label = "ir-remote";
+			gpios = <&qcom_pinmux 15 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 16 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps5g {
+			label = "wps5g";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps2g {
+			label = "wps2g";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&gmac1 {
+	status = "okay";
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gsbi4_serial {
+	pinctrl-0 = <&uart0_pins>;
+	pinctrl-names = "default";
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		nand-is-boot-medium;
+		qcom,boot-partitions = <0x0 0x1200000>;
+
+		partitions {
+			compatible = "qcom,smem-part";
+		};
+	};
+};
+
+&pcie0 {
+	status = "okay";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi5g: wifi@1,0 {
+			reg = <0x00010000 0 0 0 0>;
+			compatible = "qcom,ath10k";
+			qcom,ath10k-calibration-variant = "ASRock-G10";
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi2g: wifi@1,0 {
+			reg = <0x00010000 0 0 0 0>;
+			compatible = "qcom,ath10k";
+			qcom,ath10k-calibration-variant = "ASRock-G10";
+		};
+	};
+};
+
+&qcom_pinmux {
+	led_pins: led_pins {
+		mux {
+			pins = "gpio7", "gpio8", "gpio9", "gpio26";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	button_pins: button_pins {
+		mux {
+			pins = "gpio15", "gpio16", "gpio64", "gpio65";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	uart0_pins: uart0_pins {
+		mux {
+			pins = "gpio10", "gpio11";
+			function = "gsbi4";
+			drive-strength = <10>;
+			bias-disable;
+		};
+	};
+};
+
+&rpm {
+	pinctrl-0 = <&i2c4_pins>;
+	pinctrl-names = "default";
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&tcsr {
+	qcom,usb-ctrl-select = <TCSR_USB_SELECT_USB3_DUAL>;
+};
+
+/delete-node/ &pcie2_pins;
+/delete-node/ &pcie2;
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-onhub.dtsi b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-onhub.dtsi
new file mode 100644
index 00000000000000..549c46202619b6
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-onhub.dtsi
@@ -0,0 +1,491 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright 2014 The ChromiumOS Authors
+ */
+
+#include "qcom-ipq8064-smb208.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	aliases {
+		ethernet0 = &gmac0;
+		ethernet1 = &gmac2;
+		mdio-gpio0 = &mdio;
+		serial0 = &gsbi4_serial;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	reserved-memory {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+
+		rsvd@41200000 {
+			reg = <0x41200000 0x300000>;
+			no-map;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 16 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		dev {
+			label = "dev";
+			gpios = <&qcom_pinmux 15 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_CONFIG>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	mdio: mdio {
+		compatible = "virtual,mdio-gpio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		gpios = <&qcom_pinmux 1 GPIO_ACTIVE_HIGH>,
+			<&qcom_pinmux 0 GPIO_ACTIVE_HIGH>;
+		pinctrl-0 = <&mdio_pins>;
+		pinctrl-names = "default";
+
+		phy0: ethernet-phy@0 {
+			reg = <0>;
+			qca,ar8327-initvals = <
+				0x00004 0x7600000   /* PAD0_MODE */
+				0x00008 0x1000000   /* PAD5_MODE */
+				0x0000c 0x80        /* PAD6_MODE */
+				0x000e4 0xaa545     /* MAC_POWER_SEL */
+				0x000e0 0xc74164de  /* SGMII_CTRL */
+				0x0007c 0x4e        /* PORT0_STATUS */
+				0x00094 0x4e        /* PORT6_STATUS */
+				>;
+		};
+
+		phy1: ethernet-phy@1 {
+			reg = <1>;
+		};
+	};
+
+	soc {
+		rng@1a500000 {
+			status = "disabled";
+		};
+
+		sound {
+			compatible = "google,storm-audio";
+			qcom,model = "ipq806x-storm";
+			cpu = <&lpass>;
+			codec = <&max98357a>;
+		};
+
+		lpass: lpass@28100000 {
+			status = "okay";
+			pinctrl-names = "default", "idle";
+			pinctrl-0 = <&mi2s_default>;
+			pinctrl-1 = <&mi2s_idle>;
+		};
+
+		max98357a: max98357a {
+			compatible = "maxim,max98357a";
+			#sound-dai-cells = <1>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sdmode_pins>;
+			sdmode-gpios = <&qcom_pinmux 25 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	rgmii0_pins: rgmii0_pins {
+		mux {
+			pins = "gpio2", "gpio66";
+			drive-strength = <8>;
+			bias-disable;
+		};
+	};
+	mi2s_pins {
+		mi2s_default: mi2s_default {
+			dout {
+				pins = "gpio32";
+				function = "mi2s";
+				drive-strength = <16>;
+				bias-disable;
+			};
+			sync {
+				pins = "gpio27";
+				function = "mi2s";
+				drive-strength = <16>;
+				bias-disable;
+			};
+			clk {
+				pins = "gpio28";
+				function = "mi2s";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+		mi2s_idle: mi2s_idle {
+			dout {
+				pins = "gpio32";
+				function = "mi2s";
+				drive-strength = <2>;
+				bias-pull-down;
+			};
+			sync {
+				pins = "gpio27";
+				function = "mi2s";
+				drive-strength = <2>;
+				bias-pull-down;
+			};
+			clk {
+				pins = "gpio28";
+				function = "mi2s";
+				drive-strength = <2>;
+				bias-pull-down;
+			};
+		};
+	};
+
+	mdio_pins: mdio_pins {
+		mux {
+			pins = "gpio0", "gpio1";
+			function = "gpio";
+			drive-strength = <8>;
+			bias-disable;
+		};
+		rst {
+			pins = "gpio26";
+			output-low;
+		};
+	};
+
+	sdmode_pins: sdmode_pinmux {
+		pins = "gpio25";
+		function = "gpio";
+		drive-strength = <16>;
+		bias-disable;
+	};
+
+	sdcc1_pins: sdcc1_pinmux {
+		mux {
+			pins = "gpio38", "gpio39", "gpio40",
+			       "gpio41", "gpio42", "gpio43",
+			       "gpio44", "gpio45", "gpio46",
+			       "gpio47";
+			function = "sdc1";
+		};
+		cmd {
+			pins = "gpio45";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+		data {
+			pins = "gpio38", "gpio39", "gpio40",
+			       "gpio41", "gpio43", "gpio44",
+			       "gpio46", "gpio47";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+		clk {
+			pins = "gpio42";
+			drive-strength = <16>;
+			bias-pull-down;
+		};
+	};
+
+	i2c1_pins: i2c1_pinmux {
+		pins = "gpio53", "gpio54";
+		function = "gsbi1";
+		bias-disable;
+	};
+
+	rpm_i2c_pinmux: rpm_i2c_pinmux {
+		mux {
+			pins = "gpio12", "gpio13";
+			function = "gsbi4";
+			drive-strength = <12>;
+			bias-disable;
+		};
+	};
+
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19", "gpio21";
+			function = "gsbi5";
+			bias-pull-down;
+			/delete-property/ bias-none;
+			/delete-property/ drive-strength;
+		};
+		data {
+			pins = "gpio18", "gpio19";
+			drive-strength = <10>;
+		};
+		cs {
+			pins = "gpio20";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+		clk {
+			pins = "gpio21";
+			drive-strength = <12>;
+		};
+	};
+
+	fw_pinmux {
+		wp {
+			pins = "gpio17";
+			output-low;
+		};
+	};
+
+	button_pins: button_pins {
+		recovery {
+			pins = "gpio16";
+			function = "gpio";
+			bias-none;
+		};
+		developer {
+			pins = "gpio15";
+			function = "gpio";
+			bias-none;
+		};
+	};
+
+	spi6_pins: spi6_pins {
+		mux {
+			pins = "gpio55", "gpio56", "gpio58";
+			function = "gsbi6";
+			bias-pull-down;
+		};
+		data {
+			pins = "gpio55", "gpio56";
+			drive-strength = <10>;
+		};
+		cs {
+			pins = "gpio57";
+			drive-strength = <10>;
+			bias-pull-up;
+			output-high;
+		};
+		clk {
+			pins = "gpio58";
+			drive-strength = <12>;
+		};
+	};
+};
+
+&gmac0 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <0>;
+	phy-handle = <&phy1>;
+
+	pinctrl-0 = <&rgmii0_pins>;
+	pinctrl-names = "default";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+	phy-handle = <&phy0>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gsbi1 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_I2C_UART>;
+};
+
+&gsbi1_i2c {
+	status = "okay";
+
+	clock-frequency = <100000>;
+
+	pinctrl-0 = <&i2c1_pins>;
+	pinctrl-names = "default";
+
+	tpm@20 {
+		compatible = "infineon,slb9645tt";
+		reg = <0x20>;
+		powered-while-suspended;
+	};
+};
+
+&gsbi4 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_I2C_UART>;
+};
+
+&gsbi4_serial {
+	status = "okay";
+};
+
+&gsbi5 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_SPI>;
+
+	spi4: spi@1a280000 {
+		status = "okay";
+		spi-max-frequency = <50000000>;
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 0>;
+
+		flash: flash@0 {
+			compatible = "jedec,spi-nor";
+			spi-max-frequency = <50000000>;
+			reg = <0>;
+		};
+	};
+};
+
+&gsbi6 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_SPI>;
+};
+
+&gsbi6_spi {
+	status = "okay";
+	spi-max-frequency = <25000000>;
+
+	pinctrl-0 = <&spi6_pins>;
+	pinctrl-names = "default";
+
+	cs-gpios = <&qcom_pinmux 57 GPIO_ACTIVE_HIGH>;
+
+	dmas = <&adm_dma 8 0xb>,
+	       <&adm_dma 7 0x14>;
+	dma-names = "rx", "tx";
+
+	/*
+	 * This "spidev" was included in the manufacturer device tree. I suspect
+	 * it's the (unused) Zigbee radio -- SiliconLabs EM3581 Zigbee? There's
+	 * no driver or binding for this at the moment.
+	 */
+	spidev@0 {
+		compatible = "spidev";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+	};
+};
+
+&pcie0 {
+	status = "okay";
+
+	pcie@0 {
+		reg = <0 0 0 0 0>;
+		#interrupt-cells = <1>;
+		#size-cells = <2>;
+		#address-cells = <3>;
+		device_type = "pci";
+
+		ath10k@0,0 {
+			reg = <0 0 0 0 0>;
+			device_type = "pci";
+			qcom,ath10k-sa-gpio = <2 3 4 0>;
+			qcom,ath10k-sa-gpio-func = <5 5 5 0>;
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+
+	pcie@0 {
+		reg = <0 0 0 0 0>;
+		#interrupt-cells = <1>;
+		#size-cells = <2>;
+		#address-cells = <3>;
+		device_type = "pci";
+
+		ath10k@0,0 {
+			reg = <0 0 0 0 0>;
+			device_type = "pci";
+			qcom,ath10k-sa-gpio = <2 3 4 0>;
+			qcom,ath10k-sa-gpio-func = <5 5 5 0>;
+		};
+	};
+};
+
+&pcie2 {
+	status = "okay";
+
+	pcie@0 {
+		reg = <0 0 0 0 0>;
+		#interrupt-cells = <1>;
+		#size-cells = <2>;
+		#address-cells = <3>;
+		device_type = "pci";
+
+		ath10k@0,0 {
+			reg = <0 0 0 0 0>;
+			device_type = "pci";
+		};
+	};
+};
+
+&rpm {
+	pinctrl-0 = <&rpm_i2c_pinmux>;
+	pinctrl-names = "default";
+};
+
+&sdcc1 {
+	status = "okay";
+	pinctrl-0 = <&sdcc1_pins>;
+	pinctrl-names = "default";
+	/delete-property/ mmc-ddr-1_8v;
+};
+
+&tcsr {
+	compatible = "qcom,tcsr-ipq8064", "qcom,tcsr", "syscon";
+	qcom,usb-ctrl-select = <TCSR_USB_SELECT_USB3_DUAL>;
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-r7500.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-r7500.dts
new file mode 100644
index 00000000000000..7bea5b6bcebb24
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-r7500.dts
@@ -0,0 +1,327 @@
+#include "qcom-ipq8064-v1.0.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	model = "Netgear Nighthawk X4 R7500";
+	compatible = "netgear,r7500", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0xe000000>;
+		device_type = "memory";
+	};
+
+	reserved-memory {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+		rsvd@41200000 {
+			reg = <0x41200000 0x300000>;
+			no-map;
+		};
+	};
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+
+		led-boot = &power_white;
+		led-failsafe = &power_amber;
+		led-running = &power_white;
+		led-upgrade = &power_amber;
+	};
+
+	chosen {
+		bootargs = "rootfstype=squashfs noinitrd";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wifi {
+			label = "wifi";
+			gpios = <&qcom_pinmux 6 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		usb1 {
+			label = "white:usb1";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb2 {
+			label = "white:usb2";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+
+		power_amber: power_amber {
+			label = "amber:power";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan_white {
+			label = "white:wan";
+			gpios = <&qcom_pinmux 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan_amber {
+			label = "amber:wan";
+			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_HIGH>;
+		};
+
+		wps {
+			label = "white:wps";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_HIGH>;
+		};
+
+		esata {
+			label = "white:esata";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_HIGH>;
+		};
+
+		power_white: power_white {
+			label = "white:power";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+			default-state = "keep";
+		};
+
+		wifi {
+			label = "white:wifi";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio6", "gpio54", "gpio65";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio7", "gpio8", "gpio9", "gpio22", "gpio23",
+				"gpio24","gpio26", "gpio53", "gpio64";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+};
+
+&gsbi5 {
+	status = "disabled";
+
+	spi@1a280000 {
+		status = "disabled";
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+};
+
+&pcie1 {
+	status = "okay";
+	max-link-speed = <1>;
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		nand-is-boot-medium;
+		qcom,boot-partitions = <0x0 0x1180000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			qcadata@0 {
+				label = "qcadata";
+				reg = <0x0000000 0x0c80000>;
+				read-only;
+			};
+
+			APPSBL@c80000 {
+				label = "APPSBL";
+				reg = <0x0c80000 0x0500000>;
+				read-only;
+			};
+
+			APPSBLENV@1180000 {
+				label = "APPSBLENV";
+				reg = <0x1180000 0x0080000>;
+				read-only;
+			};
+
+			art: art@1200000 {
+				label = "art";
+				reg = <0x1200000 0x0140000>;
+				read-only;
+			};
+
+			kernel@1340000 {
+				label = "kernel";
+				reg = <0x1340000 0x0400000>;
+			};
+
+			ubi@1740000 {
+				label = "ubi";
+				reg = <0x1740000 0x1600000>;
+			};
+
+			netgear@2d40000 {
+				label = "netgear";
+				reg = <0x2d40000 0x0c00000>;
+				read-only;
+			};
+
+			reserve@3940000 {
+				label = "reserve";
+				reg = <0x3940000 0x46c0000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	nvmem-cells = <&macaddr_art_6>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	nvmem-cells = <&macaddr_art_0>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&tcsr {
+	qcom,usb-ctrl-select = <TCSR_USB_SELECT_USB3_DUAL>;
+	compatible = "qcom,tcsr";
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&art {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_art_0: macaddr@0 {
+		reg = <0x0 0x6>;
+	};
+
+	macaddr_art_6: macaddr@6 {
+		reg = <0x6 0x6>;
+	};
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-r7500v2.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-r7500v2.dts
new file mode 100644
index 00000000000000..6f0ba09c8725c5
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-r7500v2.dts
@@ -0,0 +1,387 @@
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Netgear Nighthawk X4 R7500v2";
+	compatible = "netgear,r7500v2", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	reserved-memory {
+		rsvd@5fe00000 {
+			reg = <0x5fe00000 0x200000>;
+			reusable;
+		};
+	};
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+
+		led-boot = &power;
+		led-failsafe = &power;
+		led-running = &power;
+		led-upgrade = &power;
+	};
+
+	chosen {
+		bootargs = "rootfstype=squashfs noinitrd";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wifi {
+			label = "wifi";
+			gpios = <&qcom_pinmux 6 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		usb1 {
+			label = "amber:usb1";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb3 {
+			label = "amber:usb3";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+
+		status {
+			label = "amber:status";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		internet {
+			label = "white:internet";
+			gpios = <&qcom_pinmux 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan {
+			label = "white:wan";
+			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_HIGH>;
+		};
+
+		wps {
+			label = "white:wps";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_HIGH>;
+		};
+
+		esata {
+			label = "white:esata";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_HIGH>;
+		};
+
+		power: power {
+			label = "white:power";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+			default-state = "keep";
+		};
+
+		wifi {
+			label = "white:wifi";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio6", "gpio54", "gpio65";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio7", "gpio8", "gpio9", "gpio22", "gpio23",
+				"gpio24","gpio26", "gpio53", "gpio64";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	usb0_pwr_en_pins: usb0_pwr_en_pins {
+		mux {
+			pins = "gpio15";
+			function = "gpio";
+			drive-strength = <12>;
+			bias-pull-down;
+			output-high;
+		};
+	};
+
+	usb1_pwr_en_pins: usb1_pwr_en_pins {
+		mux {
+			pins = "gpio16", "gpio68";
+			function = "gpio";
+			drive-strength = <12>;
+			bias-pull-down;
+			output-high;
+		};
+	};
+};
+
+&sata_phy {
+	status = "okay";
+};
+
+&sata {
+	status = "okay";
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+
+	pinctrl-0 = <&usb0_pwr_en_pins>;
+	pinctrl-names = "default";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+
+	pinctrl-0 = <&usb1_pwr_en_pins>;
+	pinctrl-names = "default";
+};
+
+&pcie0 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 3 GPIO_ACTIVE_LOW>;
+	pinctrl-0 = <&pcie0_pins>;
+	pinctrl-names = "default";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_art_6>, <&precal_art_1000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+			mac-address-increment = <(1)>;
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 48 GPIO_ACTIVE_LOW>;
+	pinctrl-0 = <&pcie1_pins>;
+	pinctrl-names = "default";
+	max-link-speed = <1>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_art_6>, <&precal_art_5000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+			mac-address-increment = <(2)>;
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		nand-is-boot-medium;
+		qcom,boot-partitions = <0x0 0x1180000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			qcadata@0 {
+				label = "qcadata";
+				reg = <0x0000000 0x0c80000>;
+				read-only;
+			};
+
+			APPSBL@c80000 {
+				label = "APPSBL";
+				reg = <0x0c80000 0x0500000>;
+				read-only;
+			};
+
+			APPSBLENV@1180000 {
+				label = "APPSBLENV";
+				reg = <0x1180000 0x0080000>;
+				read-only;
+			};
+
+			art@1200000 {
+				label = "art";
+				reg = <0x1200000 0x0140000>;
+				read-only;
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_art_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_art_6: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+
+				precal_art_1000: precal@1000 {
+					reg = <0x1000 0x2f20>;
+				};
+
+				precal_art_5000: precal@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+			};
+
+			artbak: art@1340000 {
+				label = "artbak";
+				reg = <0x1340000 0x0140000>;
+				read-only;
+			};
+
+			kernel@1480000 {
+				label = "kernel";
+				reg = <0x1480000 0x0400000>;
+			};
+
+			ubi@1880000 {
+				label = "ubi";
+				reg = <0x1880000 0x6080000>;
+			};
+
+			reserve@7900000 {
+				label = "reserve";
+				reg = <0x7900000 0x0700000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0xaa545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	nvmem-cells = <&macaddr_art_6>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	nvmem-cells = <&macaddr_art_0>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-tplink-onhub.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-tplink-onhub.dts
new file mode 100644
index 00000000000000..6adc6be4aec61b
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-tplink-onhub.dts
@@ -0,0 +1,209 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright 2014 The ChromiumOS Authors
+ */
+
+#include "qcom-ipq8064-onhub.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/soc/qcom,gsbi.h>
+
+/ {
+	model = "TP-Link OnHub";
+	compatible = "tplink,onhub", "google,whirlwind-sp5", "qcom,ipq8064";
+};
+
+&qcom_pinmux {
+	i2c7_pins: i2c7_pinmux {
+		mux {
+			pins = "gpio8", "gpio9";
+			function = "gsbi7";
+		};
+		data {
+			pins = "gpio8";
+			bias-disable;
+		};
+		clk {
+			pins = "gpio9";
+			bias-disable;
+		};
+	};
+};
+
+&gsbi7 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_I2C_UART>;
+};
+
+&gsbi7_i2c {
+	status = "okay";
+	clock-frequency = <100000>;
+	pinctrl-0 = <&i2c7_pins>;
+	pinctrl-names = "default";
+
+	led-controller@32 {
+		compatible = "national,lp5523";
+		reg = <0x32>;
+		clock-mode = /bits/ 8 <1>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		led@0 {
+			reg = <0>;
+			color = <LED_COLOR_ID_RED>;
+			chan-name = "red:status-0";
+			linux,default-trigger = "default-on";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@1 {
+			reg = <1>;
+			color = <LED_COLOR_ID_GREEN>;
+			chan-name = "green:status-0";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@2 {
+			reg = <2>;
+			color = <LED_COLOR_ID_BLUE>;
+			chan-name = "blue:status-0";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@3 {
+			reg = <3>;
+			color = <LED_COLOR_ID_RED>;
+			chan-name = "red:status-1";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@4 {
+			reg = <4>;
+			color = <LED_COLOR_ID_GREEN>;
+			chan-name = "green:status-1";
+			linux,default-trigger = "default-on";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@5 {
+			reg = <5>;
+			color = <LED_COLOR_ID_BLUE>;
+			chan-name = "blue:status-1";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@6 {
+			reg = <6>;
+			color = <LED_COLOR_ID_RED>;
+			chan-name = "red:status-2";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@7 {
+			reg = <7>;
+			color = <LED_COLOR_ID_GREEN>;
+			chan-name = "green:status-2";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@8 {
+			reg = <8>;
+			color = <LED_COLOR_ID_BLUE>;
+			chan-name = "blue:status-2";
+			linux,default-trigger = "default-on";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+	};
+
+	led-controller@33 {
+		compatible = "national,lp5523";
+		reg = <0x33>;
+		clock-mode = /bits/ 8 <1>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		led@0 {
+			reg = <0>;
+			color = <LED_COLOR_ID_RED>;
+			chan-name = "red:status-3";
+			linux,default-trigger = "default-on";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@1 {
+			reg = <1>;
+			color = <LED_COLOR_ID_GREEN>;
+			chan-name = "green:status-3";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@2 {
+			reg = <2>;
+			color = <LED_COLOR_ID_BLUE>;
+			chan-name = "blue:status-3";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@3 {
+			reg = <3>;
+			color = <LED_COLOR_ID_RED>;
+			chan-name = "red:status-4";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@4 {
+			reg = <4>;
+			color = <LED_COLOR_ID_GREEN>;
+			chan-name = "green:status-4";
+			linux,default-trigger = "default-on";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@5 {
+			reg = <5>;
+			color = <LED_COLOR_ID_BLUE>;
+			chan-name = "blue:status-4";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@6 {
+			reg = <6>;
+			color = <LED_COLOR_ID_RED>;
+			chan-name = "red:status-5";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@7 {
+			reg = <7>;
+			color = <LED_COLOR_ID_GREEN>;
+			chan-name = "green:status-5";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@8 {
+			reg = <8>;
+			color = <LED_COLOR_ID_BLUE>;
+			chan-name = "blue:status-5";
+			linux,default-trigger = "default-on";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+	};
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-unifi-ac-hd.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-unifi-ac-hd.dts
new file mode 100644
index 00000000000000..90927ddb856cc8
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-unifi-ac-hd.dts
@@ -0,0 +1,315 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Ubiquiti UniFi AC HD";
+	compatible = "ubnt,unifi-ac-hd", "qcom,ipq8064";
+
+	aliases {
+		label-mac-device = &gmac2;
+		led-boot = &led_dome_white;
+		led-failsafe = &led_dome_white;
+		led-running = &led_dome_blue;
+		led-upgrade = &led_dome_blue;
+		mdio-gpio0 = &mdio0;
+		ethernet0 = &gmac2;
+		ethernet1 = &gmac1;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		led_dome_blue: dome_blue {
+			label = "blue:dome";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_dome_white: dome_white {
+			label = "white:dome";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 68 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio68";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio9", "gpio53";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+			output-low;
+		};
+	};
+
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19", "gpio21";
+			function = "gsbi5";
+			drive-strength = <10>;
+			bias-none;
+		};
+
+		cs {
+			pins = "gpio20";
+			drive-strength = <12>;
+		};
+	};
+};
+
+&CPU_SPC {
+	status = "disabled";
+};
+
+&gsbi5 {
+	status = "okay";
+
+	qcom,mode = <GSBI_PROT_SPI>;
+
+	spi@1a280000 {
+		status = "okay";
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+		cs-gpios = <&qcom_pinmux 20 0>;
+
+		flash@0 {
+			compatible = "mx25u25635f", "jedec,spi-nor";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			spi-max-frequency = <50000000>;
+			reg = <0>;
+			m25p,fast-read;
+
+			partitions {
+				compatible = "fixed-partitions";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				partition@0 {
+					label = "SBL1";
+					reg = <0x0 0x20000>;
+					read-only;
+				};
+
+				partition@20000 {
+					label = "MIBIB";
+					reg = <0x20000 0x10000>;
+					read-only;
+				};
+
+				partition@30000 {
+					label = "SBL2";
+					reg = <0x30000 0x20000>;
+					read-only;
+				};
+
+				partition@50000 {
+					label = "SBL3";
+					reg = <0x50000 0x30000>;
+					read-only;
+				};
+
+				partition@80000 {
+					label = "DDRCONFIG";
+					reg = <0x80000 0x10000>;
+					read-only;
+				};
+
+				partition@90000 {
+					label = "SSD";
+					reg = <0x90000 0x10000>;
+					read-only;
+				};
+
+				partition@a0000 {
+					label = "TZ";
+					reg = <0xa0000 0x30000>;
+					read-only;
+				};
+
+				partition@d0000 {
+					label = "RPM";
+					reg = <0xd0000 0x20000>;
+					read-only;
+				};
+
+				partition@f0000 {
+					label = "APPSBL";
+					reg = <0xf0000 0xc0000>;
+					read-only;
+				};
+
+				partition@1b0000 {
+					label = "APPSBLENV";
+					reg = <0x1b0000 0x10000>;
+					read-only;
+				};
+
+				eeprom: partition@1c0000 {
+					label = "EEPROM";
+					reg = <0x1c0000 0x10000>;
+					read-only;
+				};
+
+				partition@1d0000 {
+					label = "bootselect";
+					reg = <0x1d0000 0x10000>;
+				};
+
+				partition@1e0000 {
+					compatible = "denx,fit";
+					label = "firmware";
+					reg = <0x1e0000 0xe70000>;
+				};
+
+				partition@1050000 {
+					label = "kernel1";
+					reg = <0x1050000 0xe70000>;
+					read-only;
+				};
+
+				partition@1ec0000 {
+					label = "debug";
+					reg = <0x1ec0000 0x100000>;
+					read-only;
+				};
+
+				partition@1fc0000 {
+					label = "cfg";
+					reg = <0x1fc0000 0x40000>;
+					read-only;
+				};
+			};
+		};
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&nand {
+	status = "okay";
+
+	nand-ecc-strength = <4>;
+	nand-bus-width = <8>;
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+
+	phy5: ethernet-phy@5 {
+		reg = <5>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+
+	mdiobus = <&mdio0>;
+	phy-handle = <&phy5>;
+	phy-mode = "sgmii";
+	qcom,id = <1>;
+
+	nvmem-cells = <&macaddr_eeprom_6>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac2 {
+	status = "okay";
+
+	mdiobus = <&mdio0>;
+	phy-handle = <&phy4>;
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	nvmem-cells = <&macaddr_eeprom_0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&pcie0 {
+	status = "okay";
+};
+
+&pcie1 {
+	status = "okay";
+};
+
+&tcsr {
+	status = "okay";
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&eeprom {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_eeprom_0: macaddr@0 {
+		reg = <0x0 0x6>;
+	};
+
+	macaddr_eeprom_6: macaddr@6 {
+		reg = <0x6 0x6>;
+	};
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-vr2600v.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-vr2600v.dts
new file mode 100644
index 00000000000000..b0db8c88635cd6
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-vr2600v.dts
@@ -0,0 +1,424 @@
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "TP-Link Archer VR2600v";
+	compatible = "tplink,vr2600v", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+
+		led-boot = &power;
+		led-failsafe = &general;
+		led-running = &power;
+		led-upgrade = &general;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wifi {
+			label = "wifi";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		dect {
+			label = "dect";
+			gpios = <&qcom_pinmux 67 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_PHONE>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		ledswitch {
+			label = "ledswitch";
+			gpios = <&qcom_pinmux 68 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_LIGHTS_TOGGLE>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		dsl {
+			label = "white:dsl";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb {
+			label = "white:usb";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan {
+			label = "white:lan";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan2g {
+			label = "white:wlan2g";
+			gpios = <&qcom_pinmux 16 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan5g {
+			label = "white:wlan5g";
+			gpios = <&qcom_pinmux 17 GPIO_ACTIVE_HIGH>;
+		};
+
+		power: power {
+			label = "white:power";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_HIGH>;
+			default-state = "keep";
+		};
+
+		phone {
+			label = "white:phone";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan {
+			label = "white:wan";
+			gpios = <&qcom_pinmux 56 GPIO_ACTIVE_HIGH>;
+		};
+
+		general: general {
+			label = "white:general";
+			gpios = <&qcom_pinmux 66 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	led_pins: led_pins {
+		mux {
+			pins = "gpio7", "gpio8", "gpio9", "gpio16", "gpio17",
+				"gpio26", "gpio53", "gpio56", "gpio66";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	button_pins: button_pins {
+		mux {
+			pins = "gpio54", "gpio64", "gpio65", "gpio67", "gpio68";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19", "gpio21";
+			function = "gsbi5";
+			bias-pull-down;
+		};
+
+		data {
+			pins = "gpio18", "gpio19";
+			drive-strength = <10>;
+		};
+
+		cs {
+			pins = "gpio20";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+
+		clk {
+			pins = "gpio21";
+			drive-strength = <12>;
+		};
+	};
+};
+
+&gsbi5 {
+	qcom,mode = <GSBI_PROT_SPI>;
+	status = "okay";
+
+	spi4: spi@1a280000 {
+		status = "okay";
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
+
+		flash@0 {
+			compatible = "jedec,spi-nor";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			spi-max-frequency = <50000000>;
+			reg = <0>;
+
+			partitions {
+				compatible = "fixed-partitions";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				partition@0 {
+					label = "SBL1";
+					reg = <0x0 0x20000>;
+					read-only;
+				};
+
+				partition@20000 {
+					label = "MIBIB";
+					reg = <0x20000 0x20000>;
+					read-only;
+				};
+
+				partition@40000 {
+					label = "SBL2";
+					reg = <0x40000 0x40000>;
+					read-only;
+				};
+
+				partition@80000 {
+					label = "SBL3";
+					reg = <0x80000 0x80000>;
+					read-only;
+				};
+
+				partition@100000 {
+					label = "DDRCONFIG";
+					reg = <0x100000 0x10000>;
+					read-only;
+				};
+
+				partition@110000 {
+					label = "SSD";
+					reg = <0x110000 0x10000>;
+					read-only;
+				};
+
+				partition@120000 {
+					label = "TZ";
+					reg = <0x120000 0x80000>;
+					read-only;
+				};
+
+				partition@1a0000 {
+					label = "RPM";
+					reg = <0x1a0000 0x80000>;
+					read-only;
+				};
+
+				partition@220000 {
+					label = "APPSBL";
+					reg = <0x220000 0x80000>;
+					read-only;
+				};
+
+				partition@2a0000 {
+					label = "APPSBLENV";
+					reg = <0x2a0000 0x40000>;
+					read-only;
+				};
+
+				partition@2e0000 {
+					label = "OLDART";
+					reg = <0x2e0000 0x40000>;
+					read-only;
+				};
+
+				partition@320000 {
+					label = "firmware";
+					reg = <0x320000 0xc60000>;
+					compatible = "openwrt,uimage";
+					openwrt,offset = <512>; /* account for pad-extra 512 */
+				};
+
+				/* hole 0xf80000 - 0xfaf100 */
+
+				partition@faf100 {
+					label = "default-mac";
+					reg = <0xfaf100 0x00200>;
+					read-only;
+
+					compatible = "nvmem-cells";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_defaultmac_0: macaddr@0 {
+						reg = <0x0 0x6>;
+					};
+				};
+
+				partition@fc0000 {
+					label = "ART";
+					reg = <0xfc0000 0x40000>;
+					read-only;
+
+					compatible = "nvmem-cells";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					precal_ART_1000: precal@1000 {
+						reg = <0x1000 0x2f20>;
+					};
+
+					precal_ART_5000: precal@5000 {
+						reg = <0x5000 0x2f20>;
+					};
+				};
+			};
+		};
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_defaultmac_0>, <&precal_ART_1000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+			mac-address-increment = <(-1)>;
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+	max-link-speed = <1>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_defaultmac_0>, <&precal_ART_5000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	nvmem-cells = <&macaddr_defaultmac_0>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <1>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	nvmem-cells = <&macaddr_defaultmac_0>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-wg2600hp.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-wg2600hp.dts
new file mode 100644
index 00000000000000..431c9cd9af8480
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-wg2600hp.dts
@@ -0,0 +1,463 @@
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "NEC Aterm WG2600HP";
+	compatible = "nec,wg2600hp", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+
+		led-boot = &power_green;
+		led-failsafe = &power_red;
+		led-running = &power_green;
+		led-upgrade = &power_green;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 16 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		bridge {
+			label = "bridge";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+			linux,input-type = <EV_SW>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		converter {
+			label = "converter";
+			gpios = <&qcom_pinmux 25 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+			linux,input-type = <EV_SW>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		converter_green {
+			label = "green:converter";
+			gpios = <&qcom_pinmux 6 GPIO_ACTIVE_HIGH>;
+		};
+
+		power_red: power_red {
+			label = "red:power";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		active_green {
+			label = "green:active";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+
+		active_red {
+			label = "red:active";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		power_green: power_green {
+			label = "green:power";
+			gpios = <&qcom_pinmux 14 GPIO_ACTIVE_HIGH>;
+		};
+
+		converter_red {
+			label = "red:converter";
+			gpios = <&qcom_pinmux 15 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan2g_green {
+			label = "green:wlan2g";
+			gpios = <&qcom_pinmux 55 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan2g_red {
+			label = "red:wlan2g";
+			gpios = <&qcom_pinmux 56 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan5g_green {
+			label = "green:wlan5g";
+			gpios = <&qcom_pinmux 57 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan5g_red {
+			label = "red:wlan5g";
+			gpios = <&qcom_pinmux 58 GPIO_ACTIVE_HIGH>;
+		};
+
+		tv_green {
+			label = "green:tv";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_HIGH>;
+		};
+
+		tv_red {
+			label = "red:tv";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&CPU_SPC {
+	status = "disabled";
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x06000000  /* PAD0_MODE */
+			0x0000c 0x00080080  /* PAD6_MODE */
+			0x000e4 0x0006a545  /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x0000004e  /* PORT0_STATUS */
+			0x00094 0x0000004e  /* PORT6_STATUS */
+			>;
+	};
+
+	ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	nvmem-cells = <&macaddr_PRODUCTDATA_6>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	nvmem-cells = <&macaddr_PRODUCTDATA_0>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gsbi5 {
+	status = "okay";
+
+	qcom,mode = <GSBI_PROT_SPI>;
+
+	spi@1a280000 {
+		status = "okay";
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
+
+		flash@0 {
+			compatible = "jedec,spi-nor";
+			spi-max-frequency = <50000000>;
+			reg = <0>;
+
+			partitions {
+				compatible = "fixed-partitions";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				SBL1@0 {
+					label = "SBL1";
+					reg = <0x0 0x20000>;
+					read-only;
+				};
+
+				MIBIB@20000 {
+					label = "MIBIB";
+					reg = <0x20000 0x20000>;
+					read-only;
+				};
+
+				SBL2@40000 {
+					label = "SBL2";
+					reg = <0x40000 0x40000>;
+					read-only;
+				};
+
+				SBL3@80000 {
+					label = "SBL3";
+					reg = <0x80000 0x80000>;
+					read-only;
+				};
+
+				DDRCONFIG@100000 {
+					label = "DDRCONFIG";
+					reg = <0x100000 0x10000>;
+					read-only;
+				};
+
+				SSD@110000 {
+					label = "SSD";
+					reg = <0x110000 0x10000>;
+					read-only;
+				};
+
+				TZ@120000 {
+					label = "TZ";
+					reg = <0x120000 0x80000>;
+					read-only;
+				};
+
+				RPM@1a0000 {
+					label = "RPM";
+					reg = <0x1a0000 0x80000>;
+					read-only;
+				};
+
+				APPSBL@220000 {
+					label = "APPSBL";
+					reg = <0x220000 0x80000>;
+					read-only;
+				};
+
+				APPSBLENV@2a0000 {
+					label = "APPSBLENV";
+					reg = <0x2a0000 0x10000>;
+				};
+
+				PRODUCTDATA: PRODUCTDATA@2b0000 {
+					label = "PRODUCTDATA";
+					reg = <0x2b0000 0x30000>;
+					read-only;
+				};
+
+				ART@2e0000 {
+					label = "ART";
+					reg = <0x2e0000 0x40000>;
+					read-only;
+					compatible = "nvmem-cells";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					precal_ART_1000: precal@1000 {
+						reg = <0x1000 0x2f20>;
+					};
+
+					precal_ART_5000: precal@5000 {
+						reg = <0x5000 0x2f20>;
+					};
+				};
+
+				TP@320000 {
+					label = "TP";
+					reg = <0x320000 0x40000>;
+					read-only;
+				};
+
+				TINY@360000 {
+					label = "TINY";
+					reg = <0x360000 0x500000>;
+					read-only;
+				};
+
+				firmware@860000 {
+					compatible = "denx,uimage";
+					label = "firmware";
+					reg = <0x860000 0x17a0000>;
+				};
+			};
+		};
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+
+	pinctrl-0 = <&usb_pwr_en_pins>;
+	pinctrl-names = "default";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_PRODUCTDATA_12>, <&precal_ART_1000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+	max-link-speed = <1>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_PRODUCTDATA_c>, <&precal_ART_5000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio16", "gpio54", "gpio24", "gpio25";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio6", "gpio7", "gpio8", "gpio9", "gpio14",
+				"gpio15", "gpio55", "gpio56", "gpio57", "gpio58",
+				"gpio64", "gpio65";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+	};
+
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19", "gpio21";
+			function = "gsbi5";
+			bias-pull-down;
+		};
+
+		data {
+			pins = "gpio18", "gpio19";
+			drive-strength = <10>;
+		};
+
+		cs {
+			pins = "gpio20";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+
+		clk {
+			pins = "gpio21";
+			drive-strength = <12>;
+		};
+	};
+
+	usb_pwr_en_pins: usb_pwr_en_pins {
+		mux {
+			pins = "gpio22";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+			output-high;
+		};
+	};
+};
+
+&PRODUCTDATA {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_PRODUCTDATA_0: macaddr@0 {
+		reg = <0x0 0x6>;
+	};
+
+	macaddr_PRODUCTDATA_6: macaddr@6 {
+		reg = <0x6 0x6>;
+	};
+
+	macaddr_PRODUCTDATA_c: macaddr@c {
+		reg = <0xc 0x6>;
+	};
+
+	macaddr_PRODUCTDATA_12: macaddr@12 {
+		reg = <0x12 0x6>;
+	};
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-wpq864.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-wpq864.dts
new file mode 100644
index 00000000000000..359b4cd470ca92
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-wpq864.dts
@@ -0,0 +1,473 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ *  Copyright (C) 2017 Christian Mehlis <christian@m3hlis.de>
+ *  Copyright (C) 2018 Mathias Kresin <dev@kresin.me>
+ *  All rights reserved.
+ */
+
+#include "qcom-ipq8064-v1.0.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	compatible = "compex,wpq864", "qcom,ipq8064";
+	model = "Compex WPQ864";
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+		ethernet0 = &gmac1;
+		ethernet1 = &gmac0;
+
+		led-boot = &led_pass;
+		led-failsafe = &led_fail;
+		led-running = &led_pass;
+		led-upgrade = &led_pass;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		rss4 {
+			label = "green:rss4";
+			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_HIGH>;
+		};
+
+		rss3 {
+			label = "green:rss3";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_HIGH>;
+			default-state = "keep";
+		};
+
+		rss2 {
+			label = "orange:rss2";
+			gpios = <&qcom_pinmux 25 GPIO_ACTIVE_HIGH>;
+		};
+
+		rss1 {
+			label = "red:rss1";
+			gpios = <&qcom_pinmux 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_pass: pass {
+			label = "green:pass";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_fail: fail {
+			label = "green:fail";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb {
+			label = "green:usb";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb-pcie {
+			label = "green:usb-pcie";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	beeper {
+		compatible = "gpio-beeper";
+
+		pinctrl-0 = <&beeper_pins>;
+		pinctrl-names = "default";
+
+		gpios = <&qcom_pinmux 55 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&rpm {
+	pinctrl-0 = <&rpm_pins>;
+	pinctrl-names = "default";
+};
+
+&nand {
+	status = "okay";
+
+	pinctrl-0 = <&nand_pins>;
+	pinctrl-names = "default";
+
+	mt29f2g08abbeah4@0 {
+		compatible = "qcom,nandcs";
+
+		reg = <0>;
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		nand-is-boot-medium;
+		qcom,boot-partitions = <0x0 0x1180000 0x5340000 0x10c0000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "0:SBL1";
+				reg = <0x0000000 0x0040000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "0:MIBIB";
+				reg = <0x0040000 0x0140000>;
+				read-only;
+			};
+
+			partition@180000 {
+				label = "0:SBL2";
+				reg = <0x0180000 0x0140000>;
+				read-only;
+			};
+
+			partition@2c0000 {
+				label = "0:SBL3";
+				reg = <0x02c0000 0x0280000>;
+				read-only;
+			};
+
+			partition@540000 {
+				label = "0:DDRCONFIG";
+				reg = <0x0540000 0x0120000>;
+				read-only;
+			};
+
+			partition@660000 {
+				label = "0:SSD";
+				reg = <0x0660000 0x0120000>;
+				read-only;
+			};
+
+			partition@780000 {
+				label = "0:TZ";
+				reg = <0x0780000 0x0280000>;
+				read-only;
+			};
+
+			partition@a00000 {
+				label = "0:RPM";
+				reg = <0x0a00000 0x0280000>;
+				read-only;
+			};
+
+			partition@c80000 {
+				label = "0:APPSBL";
+				reg = <0x0c80000 0x0500000>;
+				read-only;
+			};
+
+			partition@1180000 {
+				label = "0:APPSBLENV";
+				reg = <0x1180000 0x0080000>;
+			};
+
+			partition@1200000 {
+				label = "0:ART";
+				reg = <0x1200000 0x0140000>;
+			};
+
+			partition@1340000 {
+				label = "ubi";
+				reg = <0x1340000 0x4000000>;
+			};
+
+			partition@5340000 {
+				label = "0:BOOTCONFIG";
+				reg = <0x5340000 0x0060000>;
+			};
+
+			partition@53a0000 {
+				label = "0:SBL2_1";
+				reg = <0x53a0000 0x0140000>;
+				read-only;
+			};
+
+			partition@54e0000 {
+				label = "0:SBL3_1";
+				reg = <0x54e0000 0x0280000>;
+				read-only;
+			};
+
+			partition@5760000 {
+				label = "0:DDRCONFIG_1";
+				reg = <0x5760000 0x0120000>;
+				read-only;
+			};
+
+			partition@5880000 {
+				label = "0:SSD_1";
+				reg = <0x5880000 0x0120000>;
+				read-only;
+			};
+
+			partition@59a0000 {
+				label = "0:TZ_1";
+				reg = <0x59a0000 0x0280000>;
+				read-only;
+			};
+
+			partition@5c20000 {
+				label = "0:RPM_1";
+				reg = <0x5c20000 0x0280000>;
+				read-only;
+			};
+
+			partition@5ea0000 {
+				label = "0:BOOTCONFIG1";
+				reg = <0x5ea0000 0x0060000>;
+			};
+
+			partition@5f00000 {
+				label = "0:APPSBL_1";
+				reg = <0x5f00000 0x0500000>;
+				read-only;
+			};
+
+			partition@6400000 {
+				label = "ubi_1";
+				reg = <0x6400000 0x4000000>;
+			};
+
+			partition@a400000 {
+				label = "unused";
+				reg = <0xa400000 0x5c00000>;
+			};
+		};
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+
+	ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gsbi4_serial {
+	pinctrl-0 = <&uart0_pins>;
+	pinctrl-names = "default";
+};
+
+&flash {
+	compatible = "jedec,spi-nor";
+};
+
+&sata_phy {
+	status = "disabled";
+};
+
+&sata {
+	status = "disabled";
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+
+	rx_eq = <2>;
+	tx_deamp_3_5db = <32>;
+	mpll = <160>;
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+
+	rx_eq = <2>;
+	tx_deamp_3_5db = <32>;
+	mpll = <160>;
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+
+	/delete-property/ pinctrl-0;
+	/delete-property/ pinctrl-names;
+	/delete-property/ perst-gpios;
+};
+
+&pcie1 {
+	status = "okay";
+};
+
+&pcie2 {
+	status = "okay";
+
+	/delete-property/ pinctrl-0;
+	/delete-property/ pinctrl-names;
+	/delete-property/ perst-gpios;
+};
+
+&qcom_pinmux {
+	pinctrl-names = "default";
+	pinctrl-0 = <&state_default>;
+
+	state_default: pinctrl0 {
+		pcie0_pcie2_perst {
+			pins = "gpio3";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio7", "gpio8", "gpio9", "gpio22",
+			       "gpio23", "gpio24", "gpio25", "gpio53";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	button_pins: button_pins {
+		mux {
+			pins = "gpio54";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	beeper_pins: beeper_pins {
+		mux {
+			pins = "gpio55";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	rpm_pins: rpm_pins {
+		mux {
+			pins = "gpio12", "gpio13";
+			function = "gsbi4";
+			drive-strength = <10>;
+			bias-disable;
+		};
+	};
+
+	uart0_pins: uart0_pins {
+		mux {
+			pins = "gpio10", "gpio11";
+			function = "gsbi4";
+			drive-strength = <10>;
+			bias-disable;
+		};
+	};
+
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19";
+			function = "gsbi5";
+			drive-strength = <10>;
+			bias-pull-down;
+		};
+
+		clk {
+			pins = "gpio21";
+			function = "gsbi5";
+			drive-strength = <12>;
+			bias-pull-down;
+		};
+
+		cs {
+			pins = "gpio20";
+			function = "gpio";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+	};
+};
+
+&tcsr {
+	qcom,usb-ctrl-select = <TCSR_USB_SELECT_USB3_DUAL>;
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-wxr-2533dhp.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-wxr-2533dhp.dts
new file mode 100644
index 00000000000000..39fd81fe5537f3
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8064-wxr-2533dhp.dts
@@ -0,0 +1,539 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Buffalo WXR-2533DHP";
+	compatible = "buffalo,wxr-2533dhp", "qcom,ipq8064";
+
+	memory@42000000 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	aliases {
+		led-boot = &power;
+		led-failsafe = &diag;
+		led-running = &power;
+		led-upgrade = &power;
+	};
+
+	chosen {
+		/* use "ubi_rootfs" volume in "ubi" partition as rootfs */
+		bootargs = "ubi.block=0,1 root=/dev/ubiblock0_1 rootfstype=squashfs";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		usb {
+			label = "green:usb";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "usbport";
+			trigger-sources = <&hub_port0 &hub_port1>;
+		};
+
+		guestport {
+			label = "green:guestport";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+
+		diag: diag {
+			label = "orange:diag";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		internet_orange {
+			label = "orange:internet";
+			gpios = <&qcom_pinmux 16 GPIO_ACTIVE_HIGH>;
+		};
+
+		internet_white {
+			label = "white:internet";
+			gpios = <&qcom_pinmux 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		wireless_orange {
+			label = "orange:wireless";
+			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_HIGH>;
+		};
+
+		wireless_white {
+			label = "white:wireless";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_HIGH>;
+		};
+
+		router_orange {
+			label = "orange:router";
+			gpios = <&qcom_pinmux 25 GPIO_ACTIVE_HIGH>;
+		};
+
+		router_white {
+			label = "white:router";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_LOW>;
+		};
+
+		power: power {
+			label = "white:power";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		power {
+			label = "power";
+			gpios = <&qcom_pinmux 58 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_POWER>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		eject {
+			label = "eject";
+			gpios = <&qcom_pinmux 6 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_EJECTCD>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		guest {
+			label = "guest";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		ap {
+			label = "ap";
+			gpios = <&qcom_pinmux 55 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_1>;
+			linux,input-type = <EV_SW>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		router {
+			label = "router";
+			gpios = <&qcom_pinmux 56 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_1>;
+			linux,input-type = <EV_SW>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		auto {
+			label = "auto";
+			gpios = <&qcom_pinmux 57 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_1>;
+			linux,input-type = <EV_SW>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	cs@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			ubi@0 {
+				label = "ubi";
+				reg = <0x0000000 0x4000000>;
+			};
+
+			rootfs_1@4000000 {
+				label = "rootfs_1";
+				reg = <0x4000000 0x4000000>;
+			};
+		};
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x07600000  /* PAD0_MODE */
+			0x00008 0x01000000  /* PAD5_MODE */
+			0x0000c 0x00000080  /* PAD6_MODE */
+			0x00050 0xcc35cc35  /* LED_CTRL0 */
+			0x00054 0xca35ca35  /* LED_CTRL1 */
+			0x00058 0xc935c935  /* LED_CTRL2 */
+			0x0005c 0x03ffff00  /* LED_CTRL3 */
+			0x000e4 0x0006a545  /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x0000007e  /* PORT0_STATUS */
+			0x00094 0x0000007e  /* PORT6_STATUS */
+			>;
+	};
+
+	ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	nvmem-cells = <&macaddr_ART_6>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+
+	nvmem-cells = <&macaddr_ART_0>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gsbi4_serial {
+	pinctrl-0 = <&uart0_pins>;
+	pinctrl-names = "default";
+};
+
+&gsbi5 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_SPI>;
+
+	spi@1a280000 {
+		status = "okay";
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
+
+		flash@0 {
+			compatible = "jedec,spi-nor";
+			spi-max-frequency = <50000000>;
+			reg = <0>;
+
+			partitions {
+				compatible = "fixed-partitions";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				SBL1@0 {
+					label = "SBL1";
+					reg = <0x0 0x10000>;
+					read-only;
+				};
+
+				MIBIB@10000 {
+					label = "MIBIB";
+					reg = <0x10000 0x20000>;
+					read-only;
+				};
+
+				SBL2@30000 {
+					label = "SBL2";
+					reg = <0x30000 0x30000>;
+					read-only;
+				};
+
+				SBL3@60000 {
+					label = "SBL3";
+					reg = <0x60000 0x30000>;
+					read-only;
+				};
+
+				DDRCONFIG@90000 {
+					label = "DDRCONFIG";
+					reg = <0x90000 0x10000>;
+					read-only;
+				};
+
+				SSD@a0000 {
+					label = "SSD";
+					reg = <0xa0000 0x10000>;
+					read-only;
+				};
+
+				TZ@b0000 {
+					label = "TZ";
+					reg = <0xb0000 0x30000>;
+					read-only;
+				};
+
+				RPM@e0000 {
+					label = "RPM";
+					reg = <0xe0000 0x20000>;
+					read-only;
+				};
+
+				APPSBL@100000 {
+					label = "APPSBL";
+					reg = <0x100000 0x70000>;
+					read-only;
+				};
+
+				APPSBLENV@170000 {
+					label = "APPSBLENV";
+					reg = <0x170000 0x10000>;
+					read-only;
+				};
+
+				ART@180000 {
+					label = "ART";
+					reg = <0x180000 0x40000>;
+					read-only;
+
+					compatible = "nvmem-cells";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_ART_0: macaddr@0 {
+						reg = <0x0 0x6>;
+					};
+
+					macaddr_ART_6: macaddr@6 {
+						reg = <0x6 0x6>;
+					};
+
+					macaddr_ART_18: macaddr@18 {
+						reg = <0x18 0x6>;
+					};
+
+					macaddr_ART_1e: macaddr@1e {
+						reg = <0x1e 0x6>;
+					};
+
+					precal_ART_1000: precal@1000 {
+						reg = <0x1000 0x2f20>;
+					};
+
+					precal_ART_5000: precal@5000 {
+						reg = <0x5000 0x2f20>;
+					};
+				};
+
+				BOOTCONFIG@1c0000 {
+					label = "BOOTCONFIG";
+					reg = <0x1c0000 0x10000>;
+					read-only;
+				};
+
+				APPSBL_1@1d0000 {
+					label = "APPSBL_1";
+					reg = <0x1d0000 0x70000>;
+					read-only;
+				};
+			};
+		};
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+
+	pinctrl-0 = <&usb_pwr_en_pins>;
+	pinctrl-names = "default";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&dwc3_0 {
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	hub_port0: port@1 {
+		reg = <1>;
+		#trigger-source-cells = <0>;
+	};
+};
+
+&dwc3_1 {
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	hub_port1: port@1 {
+		reg = <1>;
+		#trigger-source-cells = <0>;
+	};
+};
+
+&pcie0 {
+	status = "okay";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_ART_1e>, <&precal_ART_1000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+	max-link-speed = <1>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&macaddr_ART_18>, <&precal_ART_5000>;
+			nvmem-cell-names = "mac-address", "pre-calibration";
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio6", "gpio54", "gpio55", "gpio56", "gpio57",
+				"gpio58", "gpio64", "gpio65";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio7", "gpio8", "gpio9", "gpio16", "gpio22",
+				"gpio23", "gpio24", "gpio25", "gpio26", "gpio53";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	uart0_pins: uart0_pins {
+		mux {
+			pins = "gpio10", "gpio11";
+			function = "gsbi4";
+			drive-strength = <12>;
+			bias-disable;
+		};
+	};
+
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19", "gpio21";
+			function = "gsbi5";
+			bias-pull-down;
+		};
+
+		data {
+			pins = "gpio18", "gpio19";
+			drive-strength = <10>;
+		};
+
+		cs{
+			pins = "gpio20";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+
+		clk {
+			pins = "gpio21";
+			drive-strength = <12>;
+		};
+	};
+
+	usb_pwr_en_pins: usb_pwr_en_pins {
+		mux{
+			pins = "gpio68";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+			output-high;
+		};
+	};
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-ac400i.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-ac400i.dts
new file mode 100644
index 00000000000000..7151f8de525bb7
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-ac400i.dts
@@ -0,0 +1,318 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq8065-smb208.dtsi"
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Nokia AC400i";
+	compatible = "nokia,ac400i", "qcom,ipq8065", "qcom,ipq8064";
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+		ethernet0 = &gmac0;
+		ethernet1 = &gmac1;
+
+		led-boot = &pwr_red;
+		led-failsafe = &pwr_red;
+		led-running = &pwr_green;
+		led-upgrade = &pwr_green;
+	};
+
+	chosen {
+		bootargs-override = " console=ttyMSM0,115200n8 ubi.mtd=ubi root=/dev/ubiblock0_2";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 15 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		5g_red {
+			label = "red:5g";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_HIGH>;
+		};
+
+		5g_green {
+			label = "green:5g";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_HIGH>;
+		};
+
+		2g_red {
+			label = "red:2g";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+		};
+
+		2g_green {
+			label = "green:2g";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_HIGH>;
+		};
+
+		eth1_red {
+			label = "red:eth1";
+			gpios = <&qcom_pinmux 68 GPIO_ACTIVE_HIGH>;
+		};
+
+		eth1_green {
+			label = "green:eth1";
+			gpios = <&qcom_pinmux 22 GPIO_ACTIVE_LOW>;
+		};
+
+		eth2_red {
+			label = "red:eth2";
+			gpios = <&qcom_pinmux 67 GPIO_ACTIVE_HIGH>;
+		};
+
+		eth2_green {
+			label = "green:eth2";
+			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_LOW>;
+		};
+
+		ctrl_red {
+			label = "red:ctrl";
+			gpios = <&qcom_pinmux 55 GPIO_ACTIVE_HIGH>;
+		};
+
+		ctrl_green {
+			label = "green:ctrl";
+			gpios = <&qcom_pinmux 56 GPIO_ACTIVE_HIGH>;
+		};
+
+		pwr_red: pwr_red {
+			label = "red:pwr";
+			gpios = <&qcom_pinmux 2 GPIO_ACTIVE_LOW>;
+		};
+
+		pwr_green: pwr_green {
+			label = "green:pwr";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19";
+			function = "gsbi5";
+			drive-strength = <10>;
+			bias-pull-down;
+		};
+
+		clk {
+			pins = "gpio21";
+			function = "gsbi5";
+			drive-strength = <12>;
+			bias-pull-down;
+		};
+
+		cs {
+			pins = "gpio20";
+			function = "gpio";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio65", "gpio64",
+				   "gpio53", "gpio54",
+				   "gpio68", "gpio22",
+				   "gpio67", "gpio23",
+				   "gpio55", "gpio56",
+				   "gpio2", "gpio26";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	button_pins: button_pins {
+		mux {
+			pins = "gpio15";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+};
+
+&gsbi5 {
+	qcom,mode = <GSBI_PROT_SPI>;
+	status = "okay";
+
+	spi4: spi@1a280000 {
+		status = "okay";
+		spi-max-frequency = <50000000>;
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
+
+		m25p80@0 {
+			compatible = "jedec,spi-nor";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			spi-max-frequency = <50000000>;
+			reg = <0>;
+
+			partitions {
+				compatible = "qcom,smem-part";
+			};
+		};
+	};
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+
+	/delete-property/ pinctrl-0;
+	/delete-property/ pinctrl-names;
+	/delete-property/ perst-gpios;
+
+	bridge@0,0 {
+			reg = <0x00000000 0 0 0 0>;
+			#address-cells = <3>;
+			#size-cells = <2>;
+			ranges;
+
+			wifi@1,0 {
+					compatible = "qcom,ath10k";
+					status = "okay";
+					reg = <0x00010000 0 0 0 0>;
+					qcom,ath10k-calibration-variant = "Nokia-AC400i";
+			};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+
+	/delete-property/ pinctrl-0;
+	/delete-property/ pinctrl-names;
+	/delete-property/ perst-gpios;
+
+	bridge@0,0 {
+			reg = <0x00000000 0 0 0 0>;
+			#address-cells = <3>;
+			#size-cells = <2>;
+			ranges;
+
+			wifi@1,0 {
+					compatible = "qcom,ath10k";
+					status = "okay";
+					reg = <0x00010000 0 0 0 0>;
+					qcom,ath10k-calibration-variant = "Nokia-AC400i";
+			};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+	};
+
+	phy1: ethernet-phy@1 {
+		reg = <1>;
+	};
+
+};
+
+//POE
+&gmac0 {
+	status = "okay";
+	qcom,id = <0>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	mdiobus = <&mdio0>;
+	phy-handle = <&phy0>;
+	phy-mode = "rgmii";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+//LAN1
+&gmac1 {
+	status = "okay";
+	qcom,id = <1>;
+
+	mdiobus = <&mdio0>;
+	phy-handle = <&phy1>;
+	phy-mode = "rgmii";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&nand {
+	status = "okay";
+	pinctrl-0 = <&nand_pins>;
+	pinctrl-names = "default";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			rootfs@0 {
+				label = "rootfs";
+				reg = <0x0000000 0x4000000>;
+			};
+
+			rootfs_1@4000000 {
+				label = "rootfs_1";
+				reg = <0x4000000 0x4000000>;
+			};
+
+			cfg@8000000 {
+				label = "cfg";
+				reg = <0x8000000 0x8000000>;
+			};
+		};
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-nbg6817.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-nbg6817.dts
new file mode 100644
index 00000000000000..60a949f44e30e7
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-nbg6817.dts
@@ -0,0 +1,330 @@
+#include "qcom-ipq8065-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "ZyXEL NBG6817";
+	compatible = "zyxel,nbg6817", "qcom,ipq8065", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	aliases {
+		mdio-gpio0 = &mdio0;
+		sdcc1 = &sdcc1;
+
+		led-boot = &power;
+		led-failsafe = &power;
+		led-running = &power;
+		led-upgrade = &power;
+	};
+
+	chosen {
+		bootargs = "rootfstype=squashfs,ext4 rootwait noinitrd fstools_ignore_partname=1";
+		append-rootblock = "root=/dev/mmcblk0p";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wifi {
+			label = "wifi";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			linux,input-type = <EV_SW>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		internet {
+			label = "white:internet";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_HIGH>;
+		};
+
+		power: power {
+			label = "white:power";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+			default-state = "keep";
+		};
+
+		wifi2g {
+			label = "amber:wifi2g";
+			gpios = <&qcom_pinmux 33 GPIO_ACTIVE_HIGH>;
+		};
+
+		/* wifi2g amber from the manual is missing */
+
+		wifi5g {
+			label = "amber:wifi5g";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_HIGH>;
+		};
+
+		/* wifi5g amber from the manual is missing */
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio53", "gpio54", "gpio65";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio9", "gpio26", "gpio33", "gpio64";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+	};
+
+	mdio0_pins: mdio0-pins {
+		clk {
+			pins = "gpio1";
+			input-disable;
+		};
+	};
+
+	rgmii2_pins: rgmii2-pins {
+		tx {
+			pins = "gpio27", "gpio28", "gpio29", "gpio30", "gpio31", "gpio32" ;
+			input-disable;
+		};
+	};
+
+	spi_pins: spi_pins {
+		cs {
+			pins = "gpio20";
+			drive-strength = <12>;
+		};
+	};
+
+	usb0_pwr_en_pins: usb0_pwr_en_pins {
+		mux {
+			pins = "gpio16", "gpio17";
+			function = "gpio";
+			drive-strength = <12>;
+		};
+
+		pwr {
+			pins = "gpio17";
+			bias-pull-down;
+			output-high;
+		};
+
+		ovc {
+			pins = "gpio16";
+			bias-pull-up;
+		};
+	};
+
+	usb1_pwr_en_pins: usb1_pwr_en_pins {
+		mux {
+			pins = "gpio14", "gpio15";
+			function = "gpio";
+			drive-strength = <12>;
+		};
+
+		pwr {
+			pins = "gpio14";
+			bias-pull-down;
+			output-high;
+		};
+
+		ovc {
+			pins = "gpio15";
+			bias-pull-up;
+		};
+	};
+};
+
+&gsbi5 {
+	qcom,mode = <GSBI_PROT_SPI>;
+	status = "okay";
+
+	spi4: spi@1a280000 {
+		status = "okay";
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
+
+		m25p80@0 {
+			compatible = "jedec,spi-nor";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			spi-max-frequency = <51200000>;
+			reg = <0>;
+
+			partitions {
+				compatible = "qcom,smem-part";
+			};
+		};
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+
+	pinctrl-0 = <&usb0_pwr_en_pins>;
+	pinctrl-names = "default";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+
+	pinctrl-0 = <&usb1_pwr_en_pins>;
+	pinctrl-names = "default";
+};
+
+&pcie0 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 3 GPIO_ACTIVE_LOW>;
+	pinctrl-0 = <&pcie0_pins>;
+	pinctrl-names = "default";
+};
+
+&pcie1 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 48 GPIO_ACTIVE_LOW>;
+	pinctrl-0 = <&pcie1_pins>;
+	pinctrl-names = "default";
+	max-link-speed = <1>;
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0xaa545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			0x00970 0x1e864443  /* QM_PORT0_CTRL0 */
+			0x00974 0x000001c6  /* QM_PORT0_CTRL1 */
+			0x00978 0x19008643  /* QM_PORT1_CTRL0 */
+			0x0097c 0x000001c6  /* QM_PORT1_CTRL1 */
+			0x00980 0x19008643  /* QM_PORT2_CTRL0 */
+			0x00984 0x000001c6  /* QM_PORT2_CTRL1 */
+			0x00988 0x19008643  /* QM_PORT3_CTRL0 */
+			0x0098c 0x000001c6  /* QM_PORT3_CTRL1 */
+			0x00990 0x19008643  /* QM_PORT4_CTRL0 */
+			0x00994 0x000001c6  /* QM_PORT4_CTRL1 */
+			0x00998 0x1e864443  /* QM_PORT5_CTRL0 */
+			0x0099c 0x000001c6  /* QM_PORT5_CTRL1 */
+			0x009a0 0x1e864443  /* QM_PORT6_CTRL0 */
+			0x009a4 0x000001c6  /* QM_PORT6_CTRL1 */
+			>;
+	};
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+		qca,ar8327-initvals = <
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x0000c 0x80        /* PAD6_MODE */
+			>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+	qcom,phy_mdio_addr = <4>;
+	qcom,poll_required = <0>;
+	qcom,rgmii_delay = <1>;
+	qcom,phy_mii_type = <0>;
+	qcom,emulation = <0>;
+	qcom,irq = <255>;
+	mdiobus = <&mdio0>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+	qcom,phy_mdio_addr = <0>;	/* none */
+	qcom,poll_required = <0>;	/* no polling */
+	qcom,rgmii_delay = <0>;
+	qcom,phy_mii_type = <1>;
+	qcom,emulation = <0>;
+	qcom,irq = <258>;
+	mdiobus = <&mdio0>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&sdcc1 {
+	status = "okay";
+};
+
+&adm_dma {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-nighthawk.dtsi b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-nighthawk.dtsi
new file mode 100644
index 00000000000000..2328c497ea1629
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-nighthawk.dtsi
@@ -0,0 +1,466 @@
+#include "qcom-ipq8065-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	reserved-memory {
+		rsvd@5fe00000 {
+			reg = <0x5fe00000 0x200000>;
+			reusable;
+		};
+
+		ramoops@42100000 {
+			compatible = "ramoops";
+			reg = <0x42100000 0x40000>;
+			record-size = <0x4000>;
+			console-size = <0x4000>;
+			ftrace-size = <0x4000>;
+			pmsg-size = <0x4000>;
+		};
+	};
+
+	aliases {
+		label-mac-device = &gmac2;
+
+		led-boot = &power_white;
+		led-failsafe = &power_amber;
+		led-running = &power_white;
+		led-upgrade = &power_amber;
+
+		mdio-gpio0 = &mdio0;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wifi {
+			label = "wifi";
+			gpios = <&qcom_pinmux 6 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 65 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds: leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		power_white: power_white {
+			label = "white:power";
+			gpios = <&qcom_pinmux 53 GPIO_ACTIVE_HIGH>;
+			default-state = "keep";
+		};
+
+		power_amber: power_amber {
+			label = "amber:power";
+			gpios = <&qcom_pinmux 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan_white {
+			label = "white:wan";
+			gpios = <&qcom_pinmux 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan_amber {
+			label = "amber:wan";
+			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_HIGH>;
+		};
+
+		wifi {
+			label = "white:wifi";
+			gpios = <&qcom_pinmux 64 GPIO_ACTIVE_HIGH>;
+		};
+
+		wps {
+			label = "white:wps";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio6", "gpio54", "gpio65";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio7", "gpio8", "gpio9",
+				"gpio22", "gpio23", "gpio24",
+				"gpio26", "gpio53", "gpio64";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+	};
+
+	mdio0_pins: mdio0-pins {
+		clk {
+			pins = "gpio1";
+			input-disable;
+		};
+	};
+
+	rgmii2_pins: rgmii2-pins {
+		tx {
+			pins = "gpio27", "gpio28", "gpio29",
+				"gpio30", "gpio31", "gpio32";
+			input-disable;
+		};
+	};
+
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19", "gpio21";
+			function = "gsbi5";
+			bias-pull-down;
+		};
+
+		data {
+			pins = "gpio18", "gpio19";
+			drive-strength = <10>;
+		};
+
+		cs {
+			pins = "gpio20";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+
+		clk {
+			pins = "gpio21";
+			drive-strength = <12>;
+		};
+	};
+
+	spi6_pins: spi6_pins {
+		mux {
+			pins = "gpio55", "gpio56", "gpio58";
+			function = "gsbi6";
+			bias-pull-down;
+		};
+
+		mosi {
+			pins = "gpio55";
+			drive-strength = <12>;
+		};
+
+		miso {
+			pins = "gpio56";
+			drive-strength = <14>;
+		};
+
+		cs {
+			pins = "gpio57";
+			drive-strength = <12>;
+			bias-pull-up;
+		};
+
+		clk {
+			pins = "gpio58";
+			drive-strength = <12>;
+		};
+
+		reset {
+			pins = "gpio33";
+			drive-strength = <10>;
+			bias-pull-down;
+			output-high;
+		};
+	};
+
+	usb0_pwr_en_pins: usb0_pwr_en_pins {
+		mux {
+			pins = "gpio15";
+			function = "gpio";
+			drive-strength = <12>;
+			bias-pull-down;
+			output-high;
+		};
+	};
+
+	usb1_pwr_en_pins: usb1_pwr_en_pins {
+		mux {
+			pins = "gpio16", "gpio68";
+			function = "gpio";
+			drive-strength = <12>;
+			bias-pull-down;
+			output-high;
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		nand-is-boot-medium;
+		qcom,boot-partitions = <0x0 0x1180000>;
+
+		partitions: partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "qcadata";
+				reg = <0x0000000 0x0c80000>;
+				read-only;
+			};
+
+			partition@c80000 {
+				label = "APPSBL";
+				reg = <0x0c80000 0x0500000>;
+				read-only;
+			};
+
+			partition@1180000 {
+				label = "APPSBLENV";
+				reg = <0x1180000 0x0080000>;
+				read-only;
+			};
+
+			art: partition@1200000 {
+				label = "art";
+				reg = <0x1200000 0x0140000>;
+				read-only;
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_art_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_art_6: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+
+				precal_art_1000: precal@1000 {
+					reg = <0x1000 0x2f20>;
+				};
+
+				precal_art_5000: precal@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+			};
+
+			partition@1340000 {
+				label = "artbak";
+				reg = <0x1340000 0x0140000>;
+				read-only;
+			};
+
+			partition@1480000 {
+				label = "kernel";
+				reg = <0x1480000 0x0400000>;
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0xaa545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			0x00970 0x1e864443  /* QM_PORT0_CTRL0 */
+			0x00974 0x000001c6  /* QM_PORT0_CTRL1 */
+			0x00978 0x19008643  /* QM_PORT1_CTRL0 */
+			0x0097c 0x000001c6  /* QM_PORT1_CTRL1 */
+			0x00980 0x19008643  /* QM_PORT2_CTRL0 */
+			0x00984 0x000001c6  /* QM_PORT2_CTRL1 */
+			0x00988 0x19008643  /* QM_PORT3_CTRL0 */
+			0x0098c 0x000001c6  /* QM_PORT3_CTRL1 */
+			0x00990 0x19008643  /* QM_PORT4_CTRL0 */
+			0x00994 0x000001c6  /* QM_PORT4_CTRL1 */
+			0x00998 0x1e864443  /* QM_PORT5_CTRL0 */
+			0x0099c 0x000001c6  /* QM_PORT5_CTRL1 */
+			0x009a0 0x1e864443  /* QM_PORT6_CTRL0 */
+			0x009a4 0x000001c6  /* QM_PORT6_CTRL1 */
+			>;
+		qca,ar8327-vlans = <
+			0x1	0x5e	    /* VLAN1 Ports 1/2/3/4/6 */
+			0x2	0x21	    /* VLAN2 Ports 0/5 */
+		>;
+	};
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+		qca,ar8327-initvals = <
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x0000c 0x80        /* PAD6_MODE */
+			>;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+
+	phy-mode = "rgmii";
+	qcom,id = <1>;
+	qcom,phy_mdio_addr = <4>;
+	qcom,poll_required = <0>;
+	qcom,rgmii_delay = <1>;
+	qcom,phy_mii_type = <0>;
+	qcom,emulation = <0>;
+	qcom,irq = <255>;
+	mdiobus = <&mdio0>;
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	nvmem-cells = <&macaddr_art_6>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+	qcom,phy_mdio_addr = <0>;	/* none */
+	qcom,poll_required = <0>;	/* no polling */
+	qcom,rgmii_delay = <0>;
+	qcom,phy_mii_type = <1>;
+	qcom,emulation = <0>;
+	qcom,irq = <258>;
+	mdiobus = <&mdio0>;
+
+	nvmem-cells = <&macaddr_art_0>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&sata_phy {
+	status = "okay";
+};
+
+&sata {
+	status = "okay";
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+
+	pinctrl-0 = <&usb0_pwr_en_pins>;
+	pinctrl-names = "default";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+
+	pinctrl-0 = <&usb1_pwr_en_pins>;
+	pinctrl-names = "default";
+};
+
+&pcie0 {
+	status = "okay";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi0: wifi@1,0 {
+			compatible = "pci168c,0046";
+			reg = <0x00010000 0 0 0 0>;
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+
+	max-link-speed = <1>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi1: wifi@1,0 {
+			compatible = "pci168c,0046";
+			reg = <0x00010000 0 0 0 0>;
+		};
+	};
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-r7800.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-r7800.dts
new file mode 100644
index 00000000000000..bf7c963944b72d
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-r7800.dts
@@ -0,0 +1,48 @@
+#include "qcom-ipq8065-nighthawk.dtsi"
+
+/ {
+	model = "Netgear Nighthawk X4S R7800";
+	compatible = "netgear,r7800", "qcom,ipq8065", "qcom,ipq8064";
+};
+
+&leds {
+	usb1 {
+		label = "white:usb1";
+		gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+	};
+
+	usb2 {
+		label = "white:usb2";
+		gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+	};
+
+	esata {
+		label = "white:esata";
+		gpios = <&qcom_pinmux 26 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&partitions {
+	partition@1880000 {
+		label = "ubi";
+		reg = <0x1880000 0x6080000>;
+	};
+
+	partition@7900000 {
+		label = "reserve";
+		reg = <0x7900000 0x0700000>;
+		read-only;
+	};
+};
+
+&wifi0 {
+	nvmem-cells = <&macaddr_art_6>, <&precal_art_1000>;
+	nvmem-cell-names = "mac-address", "pre-calibration";
+	mac-address-increment = <(1)>;
+};
+
+&wifi1 {
+	nvmem-cells = <&macaddr_art_6>, <&precal_art_5000>;
+	nvmem-cell-names = "mac-address", "pre-calibration";
+	mac-address-increment = <(2)>;
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-rt4230w-rev6.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-rt4230w-rev6.dts
new file mode 100644
index 00000000000000..8d9601b6324728
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-rt4230w-rev6.dts
@@ -0,0 +1,418 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "qcom-ipq8065-smb208.dtsi"
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Askey RT4230W REV6";
+	compatible = "askey,rt4230w-rev6", "qcom,ipq8065", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0x3e000000>;
+		device_type = "memory";
+	};
+
+	aliases {
+		led-boot = &ledctrl3;
+		led-failsafe = &ledctrl1;
+		led-running = &ledctrl2;
+		led-upgrade = &ledctrl3;
+	};
+
+	chosen {
+		bootargs = "rootfstype=squashfs noinitrd";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 68 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		ledctrl1: ledctrl1 {
+			label = "ledctrl1";
+			gpios = <&qcom_pinmux 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		ledctrl2: ledctrl2 {
+			label = "ledctrl2";
+			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_HIGH>;
+		};
+
+		ledctrl3: ledctrl3 {
+			label = "ledctrl3";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio54", "gpio68";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio22", "gpio23", "gpio24";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+	};
+
+	rgmii2_pins: rgmii2-pins {
+		mux {
+			pins = "gpio27", "gpio28", "gpio29", "gpio30", "gpio31",
+				"gpio51", "gpio52", "gpio59", "gpio60", "gpio61", "gpio62";
+			function = "rgmii2";
+			drive-strength = <8>;
+			bias-disable;
+		};
+
+		tx {
+			pins = "gpio27", "gpio28", "gpio29", "gpio30", "gpio31", "gpio32";
+			input-disable;
+		};
+	};
+
+	spi_pins: spi_pins {
+		cs {
+			pins = "gpio20";
+			drive-strength = <12>;
+		};
+	};
+};
+
+&gsbi5 {
+	qcom,mode = <GSBI_PROT_SPI>;
+	status = "okay";
+
+	spi@1a280000 {
+		status = "okay";
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
+
+		flash@0 {
+			compatible = "everspin,mr25h256";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			spi-max-frequency = <40000000>;
+			reg = <0>;
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		qcom,boot-partitions = <0x0 0x1180000 0x1340000 0x10c0000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "0:SBL1";
+				reg = <0x0000000 0x0040000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "0:MIBIB";
+				reg = <0x0040000 0x0140000>;
+				read-only;
+			};
+
+			partition@180000 {
+				label = "0:SBL2";
+				reg = <0x0180000 0x0140000>;
+				read-only;
+			};
+
+			partition@2c0000 {
+				label = "0:SBL3";
+				reg = <0x02c0000 0x0280000>;
+				read-only;
+			};
+
+			partition@540000 {
+				label = "0:DDRCONFIG";
+				reg = <0x0540000 0x0120000>;
+				read-only;
+			};
+
+			partition@660000 {
+				label = "0:SSD";
+				reg = <0x0660000 0x0120000>;
+				read-only;
+			};
+
+			partition@780000 {
+				label = "0:TZ";
+				reg = <0x0780000 0x0280000>;
+				read-only;
+			};
+
+			partition@a00000 {
+				label = "0:RPM";
+				reg = <0x0a00000 0x0280000>;
+				read-only;
+			};
+
+			partition@c80000 {
+				label = "0:APPSBL";
+				reg = <0x0c80000 0x0500000>;
+				read-only;
+			};
+
+			partition@1180000 {
+				label = "0:APPSBLENV";
+				reg = <0x1180000 0x0080000>;
+			};
+
+			partition@1200000 {
+				label = "0:ART";
+				reg = <0x1200000 0x0140000>;
+				read-only;
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_ART_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_ART_6: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+
+				precal_ART_1000: precal@1000 {
+					reg = <0x1000 0x2f20>;
+				};
+
+				precal_ART_5000: precal@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+			};
+
+			partition@1340000 {
+				label = "0:BOOTCONFIG";
+				reg = <0x1340000 0x0060000>;
+				read-only;
+			};
+
+			partition@13a0000 {
+				label = "0:SBL2_1";
+				reg = <0x13a0000 0x0140000>;
+				read-only;
+			};
+
+			partition@14e0000 {
+				label = "0:SBL3_1";
+				reg = <0x14e0000 0x0280000>;
+				read-only;
+			};
+
+			partition@1760000 {
+				label = "0:DDRCONFIG_1";
+				reg = <0x1760000 0x0120000>;
+				read-only;
+			};
+
+			partition@1880000 {
+				label = "0:SSD_1";
+				reg = <0x1880000 0x0120000>;
+				read-only;
+			};
+
+			partition@19a0000 {
+				label = "0:TZ_1";
+				reg = <0x19a0000 0x0280000>;
+				read-only;
+			};
+
+			partition@1c20000 {
+				label = "0:RPM_1";
+				reg = <0x1c20000 0x0280000>;
+				read-only;
+			};
+
+			partition@1ea0000 {
+				label = "0:BOOTCONFIG1";
+				reg = <0x1ea0000 0x0060000>;
+				read-only;
+			};
+
+			partition@1f00000 {
+				label = "0:APPSBL_1";
+				reg = <0x1f00000 0x0500000>;
+				read-only;
+			};
+
+			partition@2400000 {
+				label = "ubi";
+				reg = <0x2400000 0x1a000000>;
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0x0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0xaa545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			0x00050 0xcf02cf02  /* LED_CTRL_0 */
+			0x00054 0xc832c832  /* LED_CTRL_1 */
+			>;
+	};
+};
+
+&gmac0 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <0>;
+
+	nvmem-cells = <&macaddr_ART_0>;
+	nvmem-cell-names = "mac-address";
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <1>;
+
+	nvmem-cells = <&macaddr_ART_6>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 3 GPIO_ACTIVE_HIGH>;
+	pinctrl-0 = <&pcie0_pins>;
+	pinctrl-names = "default";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi0: wifi@1,0 {
+			compatible = "pci168c,0046";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&precal_ART_1000>;
+			nvmem-cell-names = "pre-calibration";
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 48 GPIO_ACTIVE_HIGH>;
+	pinctrl-0 = <&pcie1_pins>;
+	pinctrl-names = "default";
+	max-link-speed = <1>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi1: wifi@1,0 {
+			compatible = "pci168c,0046";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&precal_ART_5000>;
+			nvmem-cell-names = "pre-calibration";
+		};
+	};
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-tr4400-v2.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-tr4400-v2.dts
new file mode 100644
index 00000000000000..7b236af253e640
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-tr4400-v2.dts
@@ -0,0 +1,432 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "qcom-ipq8065-smb208.dtsi"
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Arris TR4400 v2";
+	compatible = "arris,tr4400-v2", "qcom,ipq8065", "qcom,ipq8064";
+
+	memory@0 {
+		reg = <0x42000000 0x1e000000>;
+		device_type = "memory";
+	};
+
+	aliases {
+		led-boot = &led_status_blue;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_blue;
+		led-upgrade = &led_status_red;
+	};
+
+	chosen {
+		bootargs = "rootfstype=squashfs noinitrd";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 6 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&qcom_pinmux 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		led_status_red: status_red {
+			label = "red:status";
+			gpios = <&qcom_pinmux 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_blue: status_blue {
+			label = "blue:status";
+			gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	button_pins: button_pins {
+		mux {
+			pins = "gpio6", "gpio54";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio7", "gpio8";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+	};
+
+	rgmii2_pins: rgmii2-pins {
+		tx {
+			pins = "gpio27", "gpio28", "gpio29", "gpio30", "gpio31", "gpio32";
+			input-disable;
+		};
+	};
+
+	spi_pins: spi_pins {
+		cs {
+			pins = "gpio20";
+			drive-strength = <12>;
+		};
+	};
+};
+
+&gsbi5 {
+	qcom,mode = <GSBI_PROT_SPI>;
+	status = "okay";
+
+	spi@1a280000 {
+		status = "okay";
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
+
+		flash@0 {
+			compatible = "everspin,mr25h256";
+			spi-max-frequency = <40000000>;
+			reg = <0>;
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		compatible = "qcom,nandcs";
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		qcom,boot-partitions = <0x0 0x1180000 0x5340000 0x10c0000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "0:SBL1";
+				reg = <0x0000000 0x0040000>;
+				read-only;
+			};
+			partition@40000 {
+				label = "0:MIBIB";
+				reg = <0x0040000 0x0140000>;
+				read-only;
+			};
+			partition@180000 {
+				label = "0:SBL2";
+				reg = <0x0180000 0x0140000>;
+				read-only;
+			};
+			partition@2c0000 {
+				label = "0:SBL3";
+				reg = <0x02c0000 0x0280000>;
+				read-only;
+			};
+			partition@540000 {
+				label = "0:DDRCONFIG";
+				reg = <0x0540000 0x0120000>;
+				read-only;
+			};
+			partition@660000 {
+				label = "0:SSD";
+				reg = <0x0660000 0x0120000>;
+				read-only;
+			};
+			partition@780000 {
+				label = "0:TZ";
+				reg = <0x0780000 0x0280000>;
+				read-only;
+			};
+			partition@a00000 {
+				label = "0:RPM";
+				reg = <0x0a00000 0x0280000>;
+				read-only;
+			};
+			partition@c80000 {
+				label = "0:APPSBL";
+				reg = <0x0c80000 0x0500000>;
+				read-only;
+			};
+			partition@1180000 {
+				label = "0:APPSBLENV";
+				reg = <0x1180000 0x0080000>;
+			};
+			partition@1200000 {
+				label = "0:ART";
+				reg = <0x1200000 0x0140000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				precal_ART_1000: precal@1000 {
+					reg = <0x1000 0x2f20>;
+				};
+				precal_ART_5000: precal@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+			};
+			stock_partition@1340000 {
+				label = "stock_rootfs";
+				reg = <0x1340000 0x4000000>;
+			};
+			partition@5340000 {
+				label = "0:BOOTCONFIG";
+				reg = <0x5340000 0x0060000>;
+				read-only;
+			};
+			partition@53a0000 {
+				label = "0:SBL2_1";
+				reg = <0x53a0000 0x0140000>;
+				read-only;
+			};
+			partition@54e0000 {
+				label = "0:SBL3_1";
+				reg = <0x54e0000 0x0280000>;
+				read-only;
+			};
+			partition@5760000 {
+				label = "0:DDRCONFIG_1";
+				reg = <0x5760000 0x0120000>;
+				read-only;
+			};
+			partition@5880000 {
+				label = "0:SSD_1";
+				reg = <0x5880000 0x0120000>;
+				read-only;
+			};
+			partition@59a0000 {
+				label = "0:TZ_1";
+				reg = <0x59a0000 0x0280000>;
+				read-only;
+			};
+			partition@5c20000 {
+				label = "0:RPM_1";
+				reg = <0x5c20000 0x0280000>;
+				read-only;
+			};
+			partition@5ea0000 {
+				label = "0:BOOTCONFIG1";
+				reg = <0x5ea0000 0x0060000>;
+				read-only;
+			};
+			partition@5f00000 {
+				label = "0:APPSBL_1";
+				reg = <0x5f00000 0x0500000>;
+				read-only;
+			};
+			stock_partition@6400000 {
+				label = "stock_rootfs_1";
+				reg = <0x6400000 0x4000000>;
+			};
+			stock_partition@a400000 {
+				label = "stock_fw_env";
+				reg = <0xa400000 0x0100000>;
+			};
+			stock_partition@a500000 {
+				label = "stock_config";
+				reg = <0xa500000 0x0800000>;
+			};
+			stock_partition@ad00000 {
+				label = "stock_PKI";
+				reg = <0xad00000 0x0200000>;
+			};
+			stock_partition@af00000 {
+				label = "stock_scfgmgr";
+				reg = <0xaf00000 0x0100000>;
+			};
+
+			partition@6400000 {
+				label = "fw_env";
+				reg = <0x6400000 0x0100000>;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_fw_env_0: macaddr@0 {
+					reg = <0x00 0x6>;
+				};
+				macaddr_fw_env_6: macaddr@6 {
+					reg = <0x06 0x6>;
+				};
+				macaddr_fw_env_c: macaddr@c {
+					reg = <0x0c 0x6>;
+				};
+				macaddr_fw_env_12: macaddr@12 {
+					reg = <0x12 0x6>;
+				};
+				macaddr_fw_env_18: macaddr@18 {
+					reg = <0x18 0x6>;
+				};
+			};
+			partition@6500000 {
+				label = "ubi";
+				reg = <0x6500000 0x9b00000>;
+			};
+			partition@1340000 {
+				label = "extra";
+				reg = <0x1340000 0x4000000>;
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	ethernet-phy@0 {
+		reg = <0x0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0xaa545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
+	};
+
+	phy7: ethernet-phy@7 {
+		reg = <7>;
+	};
+};
+
+&gmac0 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <0>;
+
+	nvmem-cells = <&macaddr_fw_env_18>;
+	nvmem-cell-names = "mac-address";
+
+	pinctrl-0 = <&rgmii2_pins>;
+	pinctrl-names = "default";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <1>;
+
+	nvmem-cells = <&macaddr_fw_env_0>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac3 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <3>;
+	phy-handle = <&phy7>;
+
+	nvmem-cells = <&macaddr_fw_env_6>;
+	nvmem-cell-names = "mac-address";
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 3 GPIO_ACTIVE_HIGH>;
+	pinctrl-0 = <&pcie0_pins>;
+	pinctrl-names = "default";
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi0: wifi@1,0 {
+			compatible = "pci168c,0046";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&precal_ART_1000>, <&macaddr_fw_env_12>;
+			nvmem-cell-names = "pre-calibration", "mac-address";
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+	reset-gpio = <&qcom_pinmux 48 GPIO_ACTIVE_HIGH>;
+	pinctrl-0 = <&pcie1_pins>;
+	pinctrl-names = "default";
+	max-link-speed = <1>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi1: wifi@1,0 {
+			compatible = "pci168c,0040";
+			reg = <0x00010000 0 0 0 0>;
+
+			nvmem-cells = <&precal_ART_5000>, <&macaddr_fw_env_c>;
+			nvmem-cell-names = "pre-calibration", "mac-address";
+		};
+	};
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-xr450.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-xr450.dts
new file mode 100644
index 00000000000000..4353aec7ac0906
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-xr450.dts
@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq8065-nighthawk.dtsi"
+
+/ {
+	model = "Netgear Nighthawk XR450";
+	compatible = "netgear,xr450", "qcom,ipq8065", "qcom,ipq8064";
+
+};
+
+&leds {
+	usb1 {
+		label = "white:usb1";
+		gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+	};
+
+	usb2 {
+		label = "white:usb2";
+		gpios = <&qcom_pinmux 26 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&partitions {
+	partition@1880000 {
+		label = "ubi";
+		reg = <0x1880000 0xce00000>;
+	};
+
+	partition@e680000 {
+		label = "reserve";
+		reg = <0xe680000 0x0780000>;
+		read-only;
+	};
+};
+
+&wifi0 {
+	nvmem-cells = <&macaddr_art_c>, <&precal_art_1000>;
+	nvmem-cell-names = "mac-address", "pre-calibration";
+};
+
+&wifi1 {
+	nvmem-cells = <&macaddr_art_0>, <&precal_art_5000>;
+	nvmem-cell-names = "mac-address", "pre-calibration";
+};
+
+&art {
+	macaddr_art_c: macaddr@c {
+		reg = <0xc 0x6>;
+	};
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-xr500.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-xr500.dts
new file mode 100644
index 00000000000000..f584735e155e9f
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8065-xr500.dts
@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq8065-nighthawk.dtsi"
+
+/ {
+	model = "Netgear Nighthawk XR500";
+	compatible = "netgear,xr500", "qcom,ipq8065", "qcom,ipq8064";
+
+};
+
+&leds {
+	usb1 {
+		label = "white:usb1";
+		gpios = <&qcom_pinmux 8 GPIO_ACTIVE_HIGH>;
+	};
+
+	usb2 {
+		label = "white:usb2";
+		gpios = <&qcom_pinmux 26 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&partitions {
+	partition@1880000 {
+		label = "ubi";
+		reg = <0x1880000 0xce00000>;
+	};
+
+	partition@e680000 {
+		label = "reserve";
+		reg = <0xe680000 0x0780000>;
+		read-only;
+	};
+};
+
+&wifi0 {
+	nvmem-cells = <&macaddr_art_c>, <&precal_art_1000>;
+	nvmem-cell-names = "mac-address", "pre-calibration";
+};
+
+&wifi1 {
+	nvmem-cells = <&macaddr_art_0>, <&precal_art_5000>;
+	nvmem-cell-names = "mac-address", "pre-calibration";
+};
+
+&art {
+	macaddr_art_c: macaddr@c {
+		reg = <0xc 0x6>;
+	};
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8068-cryptid-common.dtsi b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8068-cryptid-common.dtsi
new file mode 100644
index 00000000000000..a8f43591f90535
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8068-cryptid-common.dtsi
@@ -0,0 +1,236 @@
+// SPDX-License-Identifier: GPL-2.0 OR MIT
+
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+/ {
+	memory {
+		device_type = "memory";
+		linux,usable-memory = <0x41500000 0x1ea00000>;
+		reg = <0x40000000 0x20000000>;
+	};
+
+	cpus {
+		idle-states {
+			CPU_SPC: spc {
+				status = "disabled";
+			};
+		};
+	};
+
+	chosen {
+		bootargs-append = " console=ttyMSM0,115200n8 ubi.mtd=ubi ubi.mtd=art";
+	};
+};
+
+&qcom_pinmux {
+	mdio0_pins_active: mdio0_pins_active {
+		mux {
+			pins = "gpio0", "gpio1";
+			function = "mdio";
+			drive-strength = <2>;
+			bias-pull-down;
+			output-low;
+		};
+
+		clk {
+			pins = "gpio1";
+			input-disable;
+		};
+	};
+
+	phy_active: phy_active {
+		phy {
+			pins = "gpio6", "gpio7";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+			output-high;
+		};
+	};
+
+	uart1_pins: uart1_pins {
+		mux {
+			pins = "gpio51", "gpio52";
+			function = "gsbi1";
+			drive-strength = <4>;
+			bias-disable;
+		};
+	};
+};
+
+&gsbi1 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_UART_W_FC>;
+
+	serial@12450000 {
+		status = "okay";
+
+		pinctrl-0 = <&uart1_pins>;
+		pinctrl-names = "default";
+	};
+};
+
+&pcie0 {
+	status = "okay";
+
+	/delete-property/ pinctrl-0;
+	/delete-property/ pinctrl-names;
+	/delete-property/ perst-gpios;
+
+	bridge@0,0 {
+		reg = <0x0 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi0: wifi@1,0 {
+			compatible = "qcom,ath10k";
+			status = "okay";
+			reg = <0x10000 0 0 0 0>;
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+
+	/delete-property/ pinctrl-0;
+	/delete-property/ pinctrl-names;
+	/delete-property/ perst-gpios;
+
+	bridge@0,0 {
+		reg = <0x0 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi1: wifi@1,0 {
+			compatible = "qcom,ath10k";
+			status = "okay";
+			reg = <0x10000 0 0 0 0>;
+		};
+	};
+};
+
+&pcie2 {
+	status = "okay";
+
+	/delete-property/ pinctrl-0;
+	/delete-property/ pinctrl-names;
+	/delete-property/ perst-gpios;
+
+	bridge@0,0 {
+		reg = <0x0 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi2: wifi@1,0 {
+			compatible = "qcom,ath10k";
+			status = "okay";
+			reg = <0x10000 0 0 0 0>;
+		};
+	};
+};
+
+&adm_dma {
+	status = "okay";
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		compatible = "qcom,nandcs";
+
+		reg = <0>;
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		nand-is-boot-medium;
+		qcom,boot-partitions = <0x0 0x2140000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "sbl1";
+				reg = <0x0 0x40000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "mibib";
+				reg = <0x40000 0x140000>;
+				read-only;
+			};
+
+			partition@180000 {
+				label = "sbl2";
+				reg = <0x180000 0x140000>;
+				read-only;
+			};
+
+			partition@2c0000 {
+				label = "sbl3";
+				reg = <0x2c0000 0x280000>;
+				read-only;
+			};
+
+			partition@540000 {
+				label = "ddrconfig";
+				reg = <0x540000 0x120000>;
+				read-only;
+			};
+
+			partition@660000 {
+				label = "ssd";
+				reg = <0x660000 0x120000>;
+				read-only;
+			};
+
+			partition@780000 {
+				label = "tz";
+				reg = <0x780000 0x280000>;
+				read-only;
+			};
+
+			partition@a00000 {
+				label = "rpm";
+				reg = <0xa00000 0x280000>;
+				read-only;
+			};
+
+			partition@1fc0000 {
+				label = "u-boot";
+				reg = <0x1fc0000 0x180000>;
+				read-only;
+			};
+
+			partition@21c0000 {
+				label = "bootkernel1";
+				reg = <0x21c0000 0xa80000>;
+			};
+
+			partition@2c40000 {
+				label = "bootkernel2";
+				reg = <0x2c40000 0xa80000>;
+			};
+
+			partition@36c0000 {
+				label = "ubi";
+				reg = <0x36c0000 0x46c0000>;
+			};
+
+			partition@7d80000 {
+				label = "art";
+				reg = <0x7d80000 0x200000>;
+				read-only;
+			};
+		};
+	};
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8068-ecw5410.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8068-ecw5410.dts
new file mode 100644
index 00000000000000..50c1d37c29287e
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8068-ecw5410.dts
@@ -0,0 +1,329 @@
+#include "qcom-ipq8064-v2.0-smb208.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	model = "Edgecore ECW5410";
+	compatible = "edgecore,ecw5410", "qcom,ipq8064";
+
+	reserved-memory {
+		nss@40000000 {
+			reg = <0x40000000 0x1000000>;
+			no-map;
+		};
+
+		smem: smem@41000000 {
+			reg = <0x41000000 0x200000>;
+			no-map;
+		};
+
+		wifi_dump@44000000 {
+			reg = <0x44000000 0x600000>;
+			no-map;
+		};
+	};
+
+	cpus {
+		idle-states {
+			CPU_SPC: spc {
+				status = "disabled";
+			};
+		};
+	};
+
+	aliases {
+		serial1 = &gsbi1_serial;
+		ethernet0 = &gmac2;
+		ethernet1 = &gmac3;
+
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_green;
+	};
+
+	chosen {
+		bootargs-append = " console=ttyMSM0,115200n8 root=/dev/ubiblock0_1";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 25 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		led_power_green: power_green {
+			label = "green:power";
+			gpios = <&qcom_pinmux 16 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan2g_green {
+			label = "green:wlan2g";
+			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_LOW>;
+		};
+
+		wlan2g_yellow {
+			label = "yellow:wlan2g";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_LOW>;
+		};
+
+		wlan5g_green {
+			label = "green:wlan5g";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_red: power_red {
+			label = "red:power";
+			gpios = <&qcom_pinmux 28 GPIO_ACTIVE_LOW>;
+		};
+
+		wlan5g_yellow {
+			label = "yellow:wlan5g";
+			gpios = <&qcom_pinmux 59 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+
+&qcom_pinmux {
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19";
+			function = "gsbi5";
+			drive-strength = <10>;
+			bias-pull-down;
+		};
+
+		clk {
+			pins = "gpio21";
+			function = "gsbi5";
+			drive-strength = <12>;
+			bias-pull-down;
+		};
+
+		cs {
+			pins = "gpio20";
+			function = "gpio";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio16", "gpio23", "gpio24", "gpio26",
+				   "gpio28", "gpio59";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	button_pins: button_pins {
+		mux {
+			pins = "gpio25";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	uart1_pins: uart1_pins {
+		mux {
+			pins = "gpio51", "gpio52", "gpio53", "gpio54";
+			function = "gsbi1";
+			drive-strength = <12>;
+			bias-none;
+		};
+	};
+};
+
+&gsbi1 {
+	qcom,mode = <GSBI_PROT_UART_W_FC>;
+	status = "okay";
+
+	serial@12450000 {
+		status = "okay";
+
+		pinctrl-0 = <&uart1_pins>;
+		pinctrl-names = "default";
+	};
+};
+
+&gsbi5 {
+	qcom,mode = <GSBI_PROT_SPI>;
+	status = "okay";
+
+	spi4: spi@1a280000 {
+		status = "okay";
+		spi-max-frequency = <50000000>;
+
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
+
+		m25p80@0 {
+			compatible = "jedec,spi-nor";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			spi-max-frequency = <50000000>;
+			reg = <0>;
+
+			partitions {
+				compatible = "qcom,smem-part";
+			};
+		};
+	};
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
+
+&pcie1 {
+	status = "okay";
+
+	/delete-property/ pinctrl-0;
+	/delete-property/ pinctrl-names;
+	/delete-property/ perst-gpios;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "qcom,ath10k";
+			status = "okay";
+			reg = <0x00010000 0 0 0 0>;
+			qcom,ath10k-calibration-variant = "Edgecore-ECW5410-L";
+		};
+	};
+};
+
+&pcie2 {
+	status = "okay";
+
+	/delete-property/ pinctrl-0;
+	/delete-property/ pinctrl-names;
+	/delete-property/ perst-gpios;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			compatible = "qcom,ath10k";
+			status = "okay";
+			reg = <0x00010000 0 0 0 0>;
+			qcom,ath10k-calibration-variant = "Edgecore-ECW5410-L";
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	nand@0 {
+		compatible = "qcom,nandcs";
+
+		reg = <0>;
+
+		nand-ecc-strength = <4>;
+		nand-bus-width = <8>;
+		nand-ecc-step-size = <512>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			rootfs1@0 {
+				label = "rootfs1";
+				reg = <0x0000000 0x4000000>;
+			};
+
+			rootfs2@4000000 {
+				label = "rootfs2";
+				reg = <0x4000000 0x4000000>;
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+	};
+
+	phy1: ethernet-phy@1 {
+		reg = <1>;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+
+	qcom,id = <2>;
+	mdiobus = <&mdio0>;
+
+	phy-mode = "sgmii";
+	phy-handle = <&phy1>;
+};
+
+&gmac3 {
+	status = "okay";
+
+	qcom,id = <3>;
+	mdiobus = <&mdio0>;
+
+	phy-mode = "sgmii";
+	phy-handle = <&phy0>;
+};
+
+&adm_dma {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8068-mr42.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8068-mr42.dts
new file mode 100644
index 00000000000000..cfbfafb1793a07
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8068-mr42.dts
@@ -0,0 +1,228 @@
+// SPDX-License-Identifier: GPL-2.0 OR MIT
+
+#include "qcom-ipq8068-cryptid-common.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Meraki MR42";
+	compatible = "meraki,mr42", "qcom,ipq8064";
+
+	aliases {
+		serial1 = &gsbi1_serial;
+		ethernet0 = &gmac3;
+
+		led-boot = &led_active;
+		led-failsafe = &led_power;
+		led-running = &led_active;
+		led-upgrade = &led_active;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		led_power: power {
+			label = "orange:power";
+			gpios = <&qcom_pinmux 31 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_active: active {
+			label = "white:active";
+			gpios = <&qcom_pinmux 32 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&gmac3 {
+	status = "okay";
+
+	qcom,id = <3>;
+	mdiobus = <&mdio0>;
+
+	phy-mode = "sgmii";
+	phy-handle = <&phy2>;
+
+	nvmem-cells = <&mac_address>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gsbi2 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_I2C>;
+};
+
+&gsbi2_i2c {
+	status = "okay";
+
+	pinctrl-0 = <&i2c0_pins>;
+	pinctrl-names = "default";
+
+	ina2xx@40 {
+		compatible = "ina219";
+		shunt-resistor = <40000>;
+		reg = <0x40>;
+	};
+
+	eeprom@56 {
+		compatible = "atmel,24c64";
+		pagesize = <32>;
+		reg = <0x56>;
+		read-only;
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		mac_address: mac-address@66 {
+			reg = <0x66 0x6>;
+		};
+	};
+};
+
+&gsbi6 {
+	qcom,mode = <GSBI_PROT_I2C>;
+	status = "okay";
+};
+
+&gsbi6_i2c {
+	status = "okay";
+
+	pinctrl-0 = <&i2c1_pins>;
+	pinctrl-names = "default";
+
+	tlc591xx@40 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		compatible = "ti,tlc59108";
+		reg = <0x40>;
+
+		red@0 {
+			label = "red:user";
+			reg = <0x0>;
+		};
+
+		green@1 {
+			label = "green:user";
+			reg = <0x1>;
+		};
+
+		blue@2 {
+			label = "blue:user";
+			reg = <0x2>;
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-0 = <&mdio0_pins_active>, <&phy_active>;
+	pinctrl-names = "default";
+
+	phy2: ethernet-phy2 {
+		reg = <2>;
+
+		reset-gpios = <&qcom_pinmux 6 GPIO_ACTIVE_LOW>;
+		reset-assert-us = <24000>;
+
+		eee-broken-100tx;
+		eee-broken-1000t;
+	};
+};
+
+&qcom_pinmux {
+	i2c0_pins: i2c0_pins {
+		mux {
+			pins = "gpio24", "gpio25";
+			function = "gsbi2";
+			drive-strength = <2>;
+			bias-pull-up;
+			input;
+		};
+	};
+
+	button_pins: button_pins {
+		mux {
+			pins = "gpio26";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	i2c1_pins: i2c1_pins {
+		mux {
+			pins = "gpio29", "gpio30";
+			function = "gsbi6";
+			drive-strength = <2>;
+			bias-pull-up;
+			input;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio31", "gpio32";
+			function = "gpio";
+			drive-strength = <12>;
+			bias-pull-down;
+			output-low;
+		};
+	};
+};
+
+&wifi0 {
+	nvmem-cells = <&mac_address>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <1>;
+};
+
+&wifi1 {
+	nvmem-cells = <&mac_address>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <2>;
+};
+
+&wifi2 {
+	nvmem-cells = <&mac_address>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <3>;
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8068-mr52.dts b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8068-mr52.dts
new file mode 100644
index 00000000000000..f81e3ef690dcc3
--- /dev/null
+++ b/target/linux/ipq806x/files-6.1/arch/arm/boot/dts/qcom-ipq8068-mr52.dts
@@ -0,0 +1,254 @@
+// SPDX-License-Identifier: GPL-2.0 OR MIT
+
+#include "qcom-ipq8068-cryptid-common.dtsi"
+
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Meraki MR52";
+	compatible = "meraki,mr52", "qcom,ipq8064";
+
+	aliases {
+		serial1 = &gsbi1_serial;
+		mdio-gpio0 = &mdio_gpio0;
+		ethernet0 = &gmac2;
+		ethernet1 = &gmac3;
+
+		led-boot = &led_active;
+		led-failsafe = &led_power;
+		led-running = &led_active;
+		led-upgrade = &led_active;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&qcom_pinmux 25 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		led_power: power {
+			label = "orange:power";
+			gpios = <&qcom_pinmux 19 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan2_green {
+			label = "green:lan2";
+			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan1_green {
+			label = "green:lan1";
+			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_active: active {
+			label = "white:active";
+			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_LOW>;
+		};
+
+		lan2_orange {
+			label = "orange:lan2";
+			gpios = <&qcom_pinmux 60 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan1_orange {
+			label = "orange:lan1";
+			gpios = <&qcom_pinmux 62 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&gmac2 {
+	status = "okay";
+
+	qcom,id = <2>;
+	mdiobus = <&mdio0>;
+
+	phy-mode = "sgmii";
+	phy-handle = <&phy0>;
+
+	nvmem-cells = <&mac_address>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac3 {
+	status = "okay";
+
+	qcom,id = <3>;
+	mdiobus = <&mdio_gpio0>;
+
+	phy-mode = "sgmii";
+	phy-handle = <&phy4>;
+
+	nvmem-cells = <&mac_address>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <1>;
+};
+
+&gsbi7 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_I2C>;
+};
+
+&gsbi7_i2c {
+	status = "okay";
+
+	pinctrl-0 = <&i2c_pins>;
+	pinctrl-names = "default";
+
+	ina2xx@45 {
+		compatible = "ina219";
+		shunt-resistor = <80000>;
+		reg = <0x45>;
+	};
+
+	tlc591xx@49 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		compatible = "ti,tlc59108";
+		reg = <0x49>;
+
+		red@0 {
+			label = "red:user";
+			reg = <0x0>;
+		};
+
+		green@1 {
+			label = "green:user";
+			reg = <0x1>;
+		};
+
+		blue@2 {
+			label = "blue:user";
+			reg = <0x2>;
+		};
+	};
+
+	eeprom@52 {
+		compatible = "atmel,24c64";
+		pagesize = <32>;
+		reg = <0x52>;
+		read-only;
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		mac_address: mac-address@66 {
+			reg = <0x66 0x6>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	i2c_pins: i2c_pins {
+		mux {
+			pins = "gpio8", "gpio9";
+			function = "gsbi7";
+			drive-strength = <2>;
+			bias-pull-up;
+			input;
+		};
+	};
+
+	led_pins: led_pins {
+		mux {
+			pins = "gpio19", "gpio26";
+			function = "gpio";
+			drive-strength = <12>;
+			bias-pull-down;
+			output-low;
+		};
+	};
+
+	button_pins: button_pins {
+		mux {
+			pins = "gpio25";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+			input;
+		};
+	};
+};
+
+&soc {
+	mdio_gpio0: mdio {
+		compatible = "virtual,mdio-gpio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "okay";
+
+		pinctrl-0 = <&mdio0_pins_active>, <&phy_active>;
+		pinctrl-names = "default";
+
+		gpios = <&qcom_pinmux 1 GPIO_ACTIVE_HIGH
+			 &qcom_pinmux 0 GPIO_ACTIVE_HIGH>;
+
+		phy0: ethernet-phy0 {
+			reg = <0>;
+			reset-gpios = <&qcom_pinmux 7 GPIO_ACTIVE_LOW>;
+			reset-assert-us = <24000>;
+		};
+
+		phy4: ethernet-phy4 {
+			reg = <4>;
+			reset-gpios = <&qcom_pinmux 6 GPIO_ACTIVE_LOW>;
+			reset-assert-us = <24000>;
+		};
+	};
+};
+
+&wifi0 {
+	nvmem-cells = <&mac_address>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <4>;
+};
+
+&wifi1 {
+	nvmem-cells = <&mac_address>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <3>;
+};
+
+&wifi2 {
+	nvmem-cells = <&mac_address>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <2>;
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/generic/target.mk b/target/linux/ipq806x/generic/target.mk
index f5cb1fb19b943f..4de636f0e0ae6d 100644
--- a/target/linux/ipq806x/generic/target.mk
+++ b/target/linux/ipq806x/generic/target.mk
@@ -1 +1,2 @@
 BOARDNAME:=Generic
+FEATURES += nand
diff --git a/target/linux/ipq806x/image/Makefile b/target/linux/ipq806x/image/Makefile
index f4f829b35c65fd..8c1fc88010cd0a 100644
--- a/target/linux/ipq806x/image/Makefile
+++ b/target/linux/ipq806x/image/Makefile
@@ -5,7 +5,6 @@ include $(INCLUDE_DIR)/image.mk
 
 define Device/Default
 	PROFILES := Default
-	KERNEL_DEPENDS = $$(wildcard $(DTS_DIR)/$$(DEVICE_DTS).dts)
 	KERNEL_LOADADDR = 0x42208000
 	DEVICE_DTS = $$(SOC)-$(lastword $(subst _, ,$(1)))
 	DEVICE_DTS_CONFIG := config@1
@@ -22,13 +21,13 @@ endef
 
 define Device/FitImage
 	KERNEL_SUFFIX := -fit-uImage.itb
-	KERNEL = kernel-bin | gzip | fit gzip $$(DTS_DIR)/$$(DEVICE_DTS).dtb
+	KERNEL = kernel-bin | gzip | fit gzip $$(KDIR)/image-$$(DEVICE_DTS).dtb
 	KERNEL_NAME := Image
 endef
 
 define Device/FitImageLzma
 	KERNEL_SUFFIX := -fit-uImage.itb
-	KERNEL = kernel-bin | lzma | fit lzma $$(DTS_DIR)/$$(DEVICE_DTS).dtb
+	KERNEL = kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(DEVICE_DTS).dtb
 	KERNEL_NAME := Image
 endef
 
diff --git a/target/linux/ipq806x/image/chromium.mk b/target/linux/ipq806x/image/chromium.mk
new file mode 100644
index 00000000000000..ba989299760ea5
--- /dev/null
+++ b/target/linux/ipq806x/image/chromium.mk
@@ -0,0 +1,64 @@
+define Build/cros-gpt
+	cp $@ $@.tmp 2>/dev/null || true
+	ptgen -o $@.tmp -g \
+		-T cros_kernel	-N kernel -p $(CONFIG_TARGET_KERNEL_PARTSIZE)m \
+				-N rootfs -p $(CONFIG_TARGET_ROOTFS_PARTSIZE)m \
+				-N rootfs_data -p \
+				$$((3687-$(CONFIG_TARGET_ROOTFS_PARTSIZE)-\
+				         $(CONFIG_TARGET_KERNEL_PARTSIZE)))m
+	cat $@.tmp >> $@
+	rm $@.tmp
+endef
+
+define Build/append-kernel-part
+	dd if=$(IMAGE_KERNEL) bs=$(CONFIG_TARGET_KERNEL_PARTSIZE)M conv=sync >> $@
+endef
+
+# NB: Chrome OS bootloaders replace the '%U' in command lines with the UUID of
+# the kernel partition it chooses to boot from. This gives a flexible way to
+# consistently build and sign kernels that always use the subsequent
+# (PARTNROFF=1) partition as their rootfs.
+define Build/cros-vboot
+	$(STAGING_DIR_HOST)/bin/cros-vbutil \
+		-k $@ \
+		-c "root=PARTUUID=%U/PARTNROFF=1 rootwait fstools_partname_fallback_scan=1" \
+		-o $@.new
+	@mv $@.new $@
+endef
+
+define Device/OnhubImage
+	KERNEL_LOADADDR = 0x44208000
+	SOC := qcom-ipq8064
+	KERNEL_SUFFIX := -fit-zImage.itb.vboot
+	KERNEL_NAME := zImage
+	KERNEL = kernel-bin | fit none $$(KDIR)/image-$$(DEVICE_DTS).dtb | cros-vboot
+	IMAGES := factory.bin sysupgrade.bin
+	IMAGE/factory.bin := cros-gpt | append-kernel-part | append-rootfs
+	IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+	# Note: Chromium/Depthcharge-based bootloaders insert a reserved-memory
+	# ramoops node into the Device Tree automatically, so we can use
+	# kmod-ramoops.
+	DEVICE_PACKAGES := ath10k-firmware-qca988x-ct e2fsprogs kmod-fs-ext4 losetup \
+			   partx-utils mkf2fs kmod-fs-f2fs \
+			   ucode kmod-google-firmware kmod-tpm-i2c-infineon \
+			   kmod-sound-soc-ipq8064-storm kmod-usb-storage \
+			   kmod-ramoops
+endef
+
+define Device/asus_onhub
+	$(call Device/OnhubImage)
+	DEVICE_VENDOR := ASUS
+	DEVICE_MODEL := OnHub SRT-AC1900
+	DEVICE_DTS := $$(SOC)-asus-onhub
+	BOARD_NAME := asus-onhub
+endef
+TARGET_DEVICES += asus_onhub
+
+define Device/tplink_onhub
+	$(call Device/OnhubImage)
+	DEVICE_VENDOR := TP-Link
+	DEVICE_MODEL := OnHub AC1900 Cloud Router
+	DEVICE_DTS := $$(SOC)-tplink-onhub
+	BOARD_NAME := tplink-onhub
+endef
+TARGET_DEVICES += tplink_onhub
diff --git a/target/linux/ipq806x/image/generic.mk b/target/linux/ipq806x/image/generic.mk
index 58eb8b25176056..a3e9eb59e72365 100644
--- a/target/linux/ipq806x/image/generic.mk
+++ b/target/linux/ipq806x/image/generic.mk
@@ -141,8 +141,7 @@ define Device/edgecore_ecw5410
 	BLOCKSIZE := 128k
 	PAGESIZE := 2048
 	DEVICE_DTS_CONFIG := config@v2.0-ap160
-	DEVICE_PACKAGES := ath10k-firmware-qca9984-ct \
-		ipq-wifi-edgecore_ecw5410
+	DEVICE_PACKAGES := ath10k-firmware-qca9984-ct
 endef
 TARGET_DEVICES += edgecore_ecw5410
 
@@ -246,7 +245,7 @@ define Device/nec_wg2600hp3
 		pad-rootfs | append-metadata
 	DEVICE_PACKAGES := -kmod-ata-ahci -kmod-ata-ahci-platform \
 		-kmod-usb-ohci -kmod-usb2 -kmod-usb-ledtrig-usbport \
-		-kmod-usb-phy-qcom-dwc3 -kmod-usb3 -kmod-usb-dwc3-qcom \
+		-kmod-phy-qcom-ipq806x-usb -kmod-usb3 -kmod-usb-dwc3-qcom \
 		ath10k-firmware-qca9984-ct
 endef
 TARGET_DEVICES += nec_wg2600hp3
@@ -321,6 +320,20 @@ define Device/netgear_r7800
 endef
 TARGET_DEVICES += netgear_r7800
 
+define Device/netgear_xr450
+	$(call Device/DniImage)
+	DEVICE_VENDOR := NETGEAR
+	DEVICE_MODEL := Nighthawk XR450
+	SOC := qcom-ipq8065
+	KERNEL_SIZE := 4096k
+	NETGEAR_BOARD_ID := XR450
+	NETGEAR_HW_ID := 29764958+0+256+512+4x4+4x4+cascade
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_PACKAGES := ath10k-firmware-qca9984-ct kmod-ramoops
+endef
+TARGET_DEVICES += netgear_xr450
+
 define Device/netgear_xr500
 	$(call Device/DniImage)
 	DEVICE_VENDOR := NETGEAR
@@ -335,6 +348,20 @@ define Device/netgear_xr500
 endef
 TARGET_DEVICES += netgear_xr500
 
+define Device/nokia_ac400i
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Nokia
+	DEVICE_MODEL := AC400i
+	SOC := qcom-ipq8065
+	DEVICE_DTS := qcom-ipq8065-ac400i
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	BOARD_NAME := ac400i
+	DEVICE_PACKAGES := ath10k-firmware-qca9984-ct
+endef
+TARGET_DEVICES += nokia_ac400i
+
 define Device/qcom_ipq8064-ap148
 	$(call Device/FitImage)
 	$(call Device/UbiFit)
@@ -407,7 +434,7 @@ define Device/tplink_ad7200
 	BLOCKSIZE := 128k
 	PAGESIZE := 2048
 	TPLINK_BOARD_ID := AD7200
-	DEVICE_PACKAGES := ath10k-firmware-qca99x0-ct kmod-wil6210
+	DEVICE_PACKAGES := ath10k-firmware-qca99x0-ct kmod-ramoops kmod-wil6210
 endef
 TARGET_DEVICES += tplink_ad7200
 
@@ -422,7 +449,7 @@ define Device/tplink_c2600
 	BOARD_NAME := c2600
 	SUPPORTED_DEVICES += c2600
 	TPLINK_BOARD_ID := C2600
-	DEVICE_PACKAGES := ath10k-firmware-qca99x0-ct
+	DEVICE_PACKAGES := ath10k-firmware-qca99x0-ct kmod-ramoops
 endef
 TARGET_DEVICES += tplink_c2600
 
diff --git a/target/linux/ipq806x/modules.mk b/target/linux/ipq806x/modules.mk
index 605504b0c33867..a2b844d0f03cc3 100644
--- a/target/linux/ipq806x/modules.mk
+++ b/target/linux/ipq806x/modules.mk
@@ -14,3 +14,32 @@ define KernelPackage/phy-qcom-ipq806x-usb/description
 endef
 
 $(eval $(call KernelPackage,phy-qcom-ipq806x-usb))
+
+
+define KernelPackage/sound-soc-ipq8064-storm
+  TITLE:=Qualcomm IPQ8064 SoC support for Google Storm
+  DEPENDS:=@TARGET_ipq806x +kmod-sound-soc-core
+  KCONFIG:=\
+	CONFIG_IPQ_LCC_806X \
+	CONFIG_SND_SOC_QCOM \
+	CONFIG_SND_SOC_STORM \
+	CONFIG_SND_SOC_APQ8016_SBC=n \
+	CONFIG_SND_SOC_SC7180=n
+  FILES:=\
+	$(LINUX_DIR)/drivers/clk/qcom/lcc-ipq806x.ko \
+	$(LINUX_DIR)/sound/soc/codecs/snd-soc-max98357a.ko \
+	$(LINUX_DIR)/sound/soc/qcom/snd-soc-lpass-cpu.ko \
+	$(LINUX_DIR)/sound/soc/qcom/snd-soc-lpass-ipq806x.ko \
+	$(LINUX_DIR)/sound/soc/qcom/snd-soc-lpass-platform.ko \
+	$(LINUX_DIR)/sound/soc/qcom/snd-soc-storm.ko
+  AUTOLOAD:=$(call AutoProbe,lcc-ipq806x \
+	snd-soc-max98357a snd-soc-lpass-ipq806x snd-soc-storm)
+  $(call AddDepends/sound)
+endef
+
+define KernelPackage/sound-soc-ipq8064-storm/description
+ Provides sound support for the Google Storm platform, with a Qualcomm IPQ8064
+ SoC.
+endef
+
+$(eval $(call KernelPackage,sound-soc-ipq8064-storm))
diff --git a/target/linux/ipq806x/patches-5.15/0067-generic-Mangle-bootloader-s-kernel-arguments.patch b/target/linux/ipq806x/patches-5.15/0067-generic-Mangle-bootloader-s-kernel-arguments.patch
index 4758c25bbf05a9..df5d4811a8852a 100644
--- a/target/linux/ipq806x/patches-5.15/0067-generic-Mangle-bootloader-s-kernel-arguments.patch
+++ b/target/linux/ipq806x/patches-5.15/0067-generic-Mangle-bootloader-s-kernel-arguments.patch
@@ -51,10 +51,52 @@ Signed-off-by: Adrian Panella <ianchi74@outlook.com>
  #else
  #define do_extend_cmdline 0
  #endif
-@@ -69,6 +71,80 @@ static uint32_t get_cell_size(const void
- 	return cell_size;
+@@ -20,6 +22,7 @@ static int node_offset(void *fdt, const
+ 	return offset;
  }
  
++#ifndef CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
+ static int setprop(void *fdt, const char *node_path, const char *property,
+ 		   void *val_array, int size)
+ {
+@@ -28,6 +31,7 @@ static int setprop(void *fdt, const char
+ 		return offset;
+ 	return fdt_setprop(fdt, offset, property, val_array, size);
+ }
++#endif
+ 
+ static int setprop_string(void *fdt, const char *node_path,
+ 			  const char *property, const char *string)
+@@ -38,6 +42,7 @@ static int setprop_string(void *fdt, con
+ 	return fdt_setprop_string(fdt, offset, property, string);
+ }
+ 
++#ifndef CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
+ static int setprop_cell(void *fdt, const char *node_path,
+ 			const char *property, uint32_t val)
+ {
+@@ -46,6 +51,7 @@ static int setprop_cell(void *fdt, const
+ 		return offset;
+ 	return fdt_setprop_cell(fdt, offset, property, val);
+ }
++#endif
+ 
+ static const void *getprop(const void *fdt, const char *node_path,
+ 			   const char *property, int *len)
+@@ -58,6 +64,7 @@ static const void *getprop(const void *f
+ 	return fdt_getprop(fdt, offset, property, len);
+ }
+ 
++#ifndef CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
+ static uint32_t get_cell_size(const void *fdt)
+ {
+ 	int len;
+@@ -68,6 +75,81 @@ static uint32_t get_cell_size(const void
+ 		cell_size = fdt32_to_cpu(*size_len);
+ 	return cell_size;
+ }
++#endif
++
 +#if defined(CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE)
 +/**
 + * taken from arch/x86/boot/string.c
@@ -82,13 +124,13 @@ Signed-off-by: Adrian Panella <ianchi74@outlook.com>
 +static char *append_rootblock(char *dest, const char *str, int len, void *fdt)
 +{
 +	char *ptr, *end, *tmp;
-+	char *root="root=";
-+	char *find_rootblock;
++	const char *root="root=";
++	const char *find_rootblock;
 +	int i, l;
 +	const char *rootblock;
 +
 +	find_rootblock = getprop(fdt, "/chosen", "find-rootblock", &l);
-+	if(!find_rootblock)
++	if (!find_rootblock)
 +		find_rootblock = root;
 +
 +	//ARM doesn't have __HAVE_ARCH_STRSTR, so it was copied from x86
@@ -128,11 +170,10 @@ Signed-off-by: Adrian Panella <ianchi74@outlook.com>
 +	return dest;
 +}
 +#endif
-+
+ 
  static void merge_fdt_bootargs(void *fdt, const char *fdt_cmdline)
  {
- 	char cmdline[COMMAND_LINE_SIZE];
-@@ -88,12 +164,21 @@ static void merge_fdt_bootargs(void *fdt
+@@ -88,18 +170,28 @@ static void merge_fdt_bootargs(void *fdt
  
  	/* and append the ATAG_CMDLINE */
  	if (fdt_cmdline) {
@@ -154,7 +195,36 @@ Signed-off-by: Adrian Panella <ianchi74@outlook.com>
  	}
  	*ptr = '\0';
  
-@@ -168,7 +253,9 @@ int atags_to_fdt(void *atag_list, void *
+ 	setprop_string(fdt, "/chosen", "bootargs", cmdline);
+ }
+ 
++#ifndef CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
+ static void hex_str(char *out, uint32_t value)
+ {
+ 	uint32_t digit;
+@@ -117,6 +209,7 @@ static void hex_str(char *out, uint32_t
+ 	}
+ 	*out = '\0';
+ }
++#endif
+ 
+ /*
+  * Convert and fold provided ATAGs into the provided FDT.
+@@ -131,9 +224,11 @@ int atags_to_fdt(void *atag_list, void *
+ 	struct tag *atag = atag_list;
+ 	/* In the case of 64 bits memory size, need to reserve 2 cells for
+ 	 * address and size for each bank */
++#ifndef CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
+ 	__be32 mem_reg_property[2 * 2 * NR_BANKS];
+-	int memcount = 0;
+-	int ret, memsize;
++	int memsize, memcount = 0;
++#endif
++	int ret;
+ 
+ 	/* make sure we've got an aligned pointer */
+ 	if ((u32)atag_list & 0x3)
+@@ -168,7 +263,9 @@ int atags_to_fdt(void *atag_list, void *
  			else
  				setprop_string(fdt, "/chosen", "bootargs",
  					       atag->u.cmdline.cmdline);
@@ -165,7 +235,7 @@ Signed-off-by: Adrian Panella <ianchi74@outlook.com>
  			if (memcount >= sizeof(mem_reg_property)/4)
  				continue;
  			if (!atag->u.mem.size)
-@@ -212,6 +299,10 @@ int atags_to_fdt(void *atag_list, void *
+@@ -212,6 +309,10 @@ int atags_to_fdt(void *atag_list, void *
  		setprop(fdt, "/memory", "reg", mem_reg_property,
  			4 * memcount * memsize);
  	}
diff --git a/target/linux/ipq806x/patches-5.15/100-v5.18-04-linux-next-clk-qcom-gcc-ipq806x-fix-wrong-naming-for-gcc_pxo_pl.patch b/target/linux/ipq806x/patches-5.15/100-v5.18-04-linux-next-clk-qcom-gcc-ipq806x-fix-wrong-naming-for-gcc_pxo_pl.patch
new file mode 100644
index 00000000000000..f3f3ea30da8c04
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/100-v5.18-04-linux-next-clk-qcom-gcc-ipq806x-fix-wrong-naming-for-gcc_pxo_pl.patch
@@ -0,0 +1,109 @@
+From e95e825333eda345d812b461301dad50021d5487 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sat, 26 Feb 2022 14:52:24 +0100
+Subject: [PATCH 04/14] clk: qcom: gcc-ipq806x: fix wrong naming for
+ gcc_pxo_pll8_pll0
+
+Parent gcc_pxo_pll8_pll0 had the parent definition and parent map
+swapped. Fix this naming error.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220226135235.10051-5-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/gcc-ipq806x.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+--- a/drivers/clk/qcom/gcc-ipq806x.c
++++ b/drivers/clk/qcom/gcc-ipq806x.c
+@@ -291,13 +291,13 @@ static const char * const gcc_pxo_pll3[]
+ 	"pll3",
+ };
+ 
+-static const struct parent_map gcc_pxo_pll8_pll0[] = {
++static const struct parent_map gcc_pxo_pll8_pll0_map[] = {
+ 	{ P_PXO, 0 },
+ 	{ P_PLL8, 3 },
+ 	{ P_PLL0, 2 }
+ };
+ 
+-static const char * const gcc_pxo_pll8_pll0_map[] = {
++static const char * const gcc_pxo_pll8_pll0[] = {
+ 	"pxo",
+ 	"pll8_vote",
+ 	"pll0_vote",
+@@ -1993,7 +1993,7 @@ static struct clk_rcg usb30_master_clk_s
+ 	},
+ 	.s = {
+ 		.src_sel_shift = 0,
+-		.parent_map = gcc_pxo_pll8_pll0,
++		.parent_map = gcc_pxo_pll8_pll0_map,
+ 	},
+ 	.freq_tbl = clk_tbl_usb30_master,
+ 	.clkr = {
+@@ -2001,7 +2001,7 @@ static struct clk_rcg usb30_master_clk_s
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "usb30_master_ref_src",
+-			.parent_names = gcc_pxo_pll8_pll0_map,
++			.parent_names = gcc_pxo_pll8_pll0,
+ 			.num_parents = 3,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+@@ -2063,7 +2063,7 @@ static struct clk_rcg usb30_utmi_clk = {
+ 	},
+ 	.s = {
+ 		.src_sel_shift = 0,
+-		.parent_map = gcc_pxo_pll8_pll0,
++		.parent_map = gcc_pxo_pll8_pll0_map,
+ 	},
+ 	.freq_tbl = clk_tbl_usb30_utmi,
+ 	.clkr = {
+@@ -2071,7 +2071,7 @@ static struct clk_rcg usb30_utmi_clk = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "usb30_utmi_clk",
+-			.parent_names = gcc_pxo_pll8_pll0_map,
++			.parent_names = gcc_pxo_pll8_pll0,
+ 			.num_parents = 3,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+@@ -2133,7 +2133,7 @@ static struct clk_rcg usb_hs1_xcvr_clk_s
+ 	},
+ 	.s = {
+ 		.src_sel_shift = 0,
+-		.parent_map = gcc_pxo_pll8_pll0,
++		.parent_map = gcc_pxo_pll8_pll0_map,
+ 	},
+ 	.freq_tbl = clk_tbl_usb,
+ 	.clkr = {
+@@ -2141,7 +2141,7 @@ static struct clk_rcg usb_hs1_xcvr_clk_s
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "usb_hs1_xcvr_src",
+-			.parent_names = gcc_pxo_pll8_pll0_map,
++			.parent_names = gcc_pxo_pll8_pll0,
+ 			.num_parents = 3,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+@@ -2197,7 +2197,7 @@ static struct clk_rcg usb_fs1_xcvr_clk_s
+ 	},
+ 	.s = {
+ 		.src_sel_shift = 0,
+-		.parent_map = gcc_pxo_pll8_pll0,
++		.parent_map = gcc_pxo_pll8_pll0_map,
+ 	},
+ 	.freq_tbl = clk_tbl_usb,
+ 	.clkr = {
+@@ -2205,7 +2205,7 @@ static struct clk_rcg usb_fs1_xcvr_clk_s
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "usb_fs1_xcvr_src",
+-			.parent_names = gcc_pxo_pll8_pll0_map,
++			.parent_names = gcc_pxo_pll8_pll0,
+ 			.num_parents = 3,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
diff --git a/target/linux/ipq806x/patches-5.15/100-v5.18-05-linux-next-clk-qcom-gcc-ipq806x-convert-parent_names-to-parent_.patch b/target/linux/ipq806x/patches-5.15/100-v5.18-05-linux-next-clk-qcom-gcc-ipq806x-convert-parent_names-to-parent_.patch
new file mode 100644
index 00000000000000..d99ac9992f3bfc
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/100-v5.18-05-linux-next-clk-qcom-gcc-ipq806x-convert-parent_names-to-parent_.patch
@@ -0,0 +1,921 @@
+From cb02866f9a740fb9fb8ff19698a69290da4057e5 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sat, 26 Feb 2022 14:52:25 +0100
+Subject: [PATCH 05/14] clk: qcom: gcc-ipq806x: convert parent_names to
+ parent_data
+
+Convert parent_names to parent_data to modernize the driver.
+Where possible use parent_hws directly.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220226135235.10051-6-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/gcc-ipq806x.c | 286 ++++++++++++++++++++-------------
+ 1 file changed, 173 insertions(+), 113 deletions(-)
+
+--- a/drivers/clk/qcom/gcc-ipq806x.c
++++ b/drivers/clk/qcom/gcc-ipq806x.c
+@@ -25,6 +25,10 @@
+ #include "clk-hfpll.h"
+ #include "reset.h"
+ 
++static const struct clk_parent_data gcc_pxo[] = {
++	{ .fw_name = "pxo", .name = "pxo" },
++};
++
+ static struct clk_pll pll0 = {
+ 	.l_reg = 0x30c4,
+ 	.m_reg = 0x30c8,
+@@ -35,7 +39,7 @@ static struct clk_pll pll0 = {
+ 	.status_bit = 16,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "pll0",
+-		.parent_names = (const char *[]){ "pxo" },
++		.parent_data = gcc_pxo,
+ 		.num_parents = 1,
+ 		.ops = &clk_pll_ops,
+ 	},
+@@ -46,7 +50,9 @@ static struct clk_regmap pll0_vote = {
+ 	.enable_mask = BIT(0),
+ 	.hw.init = &(struct clk_init_data){
+ 		.name = "pll0_vote",
+-		.parent_names = (const char *[]){ "pll0" },
++		.parent_hws = (const struct clk_hw*[]){
++			&pll0.clkr.hw,
++		},
+ 		.num_parents = 1,
+ 		.ops = &clk_pll_vote_ops,
+ 	},
+@@ -62,7 +68,7 @@ static struct clk_pll pll3 = {
+ 	.status_bit = 16,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "pll3",
+-		.parent_names = (const char *[]){ "pxo" },
++		.parent_data = gcc_pxo,
+ 		.num_parents = 1,
+ 		.ops = &clk_pll_ops,
+ 	},
+@@ -89,7 +95,7 @@ static struct clk_pll pll8 = {
+ 	.status_bit = 16,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "pll8",
+-		.parent_names = (const char *[]){ "pxo" },
++		.parent_data = gcc_pxo,
+ 		.num_parents = 1,
+ 		.ops = &clk_pll_ops,
+ 	},
+@@ -100,7 +106,9 @@ static struct clk_regmap pll8_vote = {
+ 	.enable_mask = BIT(8),
+ 	.hw.init = &(struct clk_init_data){
+ 		.name = "pll8_vote",
+-		.parent_names = (const char *[]){ "pll8" },
++		.parent_hws = (const struct clk_hw*[]){
++			&pll8.clkr.hw,
++		},
+ 		.num_parents = 1,
+ 		.ops = &clk_pll_vote_ops,
+ 	},
+@@ -123,7 +131,7 @@ static struct hfpll_data hfpll0_data = {
+ static struct clk_hfpll hfpll0 = {
+ 	.d = &hfpll0_data,
+ 	.clkr.hw.init = &(struct clk_init_data){
+-		.parent_names = (const char *[]){ "pxo" },
++		.parent_data = gcc_pxo,
+ 		.num_parents = 1,
+ 		.name = "hfpll0",
+ 		.ops = &clk_ops_hfpll,
+@@ -149,7 +157,7 @@ static struct hfpll_data hfpll1_data = {
+ static struct clk_hfpll hfpll1 = {
+ 	.d = &hfpll1_data,
+ 	.clkr.hw.init = &(struct clk_init_data){
+-		.parent_names = (const char *[]){ "pxo" },
++		.parent_data = gcc_pxo,
+ 		.num_parents = 1,
+ 		.name = "hfpll1",
+ 		.ops = &clk_ops_hfpll,
+@@ -175,7 +183,7 @@ static struct hfpll_data hfpll_l2_data =
+ static struct clk_hfpll hfpll_l2 = {
+ 	.d = &hfpll_l2_data,
+ 	.clkr.hw.init = &(struct clk_init_data){
+-		.parent_names = (const char *[]){ "pxo" },
++		.parent_data = gcc_pxo,
+ 		.num_parents = 1,
+ 		.name = "hfpll_l2",
+ 		.ops = &clk_ops_hfpll,
+@@ -194,7 +202,7 @@ static struct clk_pll pll14 = {
+ 	.status_bit = 16,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "pll14",
+-		.parent_names = (const char *[]){ "pxo" },
++		.parent_data = gcc_pxo,
+ 		.num_parents = 1,
+ 		.ops = &clk_pll_ops,
+ 	},
+@@ -205,7 +213,9 @@ static struct clk_regmap pll14_vote = {
+ 	.enable_mask = BIT(14),
+ 	.hw.init = &(struct clk_init_data){
+ 		.name = "pll14_vote",
+-		.parent_names = (const char *[]){ "pll14" },
++		.parent_hws = (const struct clk_hw*[]){
++			&pll14.clkr.hw,
++		},
+ 		.num_parents = 1,
+ 		.ops = &clk_pll_vote_ops,
+ 	},
+@@ -238,7 +248,7 @@ static struct clk_pll pll18 = {
+ 	.freq_tbl = pll18_freq_tbl,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "pll18",
+-		.parent_names = (const char *[]){ "pxo" },
++		.parent_data = gcc_pxo,
+ 		.num_parents = 1,
+ 		.ops = &clk_pll_ops,
+ 	},
+@@ -259,9 +269,9 @@ static const struct parent_map gcc_pxo_p
+ 	{ P_PLL8, 3 }
+ };
+ 
+-static const char * const gcc_pxo_pll8[] = {
+-	"pxo",
+-	"pll8_vote",
++static const struct clk_parent_data gcc_pxo_pll8[] = {
++	{ .fw_name = "pxo", .name = "pxo" },
++	{ .hw = &pll8_vote.hw },
+ };
+ 
+ static const struct parent_map gcc_pxo_pll8_cxo_map[] = {
+@@ -270,10 +280,10 @@ static const struct parent_map gcc_pxo_p
+ 	{ P_CXO, 5 }
+ };
+ 
+-static const char * const gcc_pxo_pll8_cxo[] = {
+-	"pxo",
+-	"pll8_vote",
+-	"cxo",
++static const struct clk_parent_data gcc_pxo_pll8_cxo[] = {
++	{ .fw_name = "pxo", .name = "pxo" },
++	{ .hw = &pll8_vote.hw },
++	{ .fw_name = "cxo", .name = "cxo" },
+ };
+ 
+ static const struct parent_map gcc_pxo_pll3_map[] = {
+@@ -286,9 +296,9 @@ static const struct parent_map gcc_pxo_p
+ 	{ P_PLL3, 6 }
+ };
+ 
+-static const char * const gcc_pxo_pll3[] = {
+-	"pxo",
+-	"pll3",
++static const struct clk_parent_data gcc_pxo_pll3[] = {
++	{ .fw_name = "pxo", .name = "pxo" },
++	{ .hw = &pll3.clkr.hw },
+ };
+ 
+ static const struct parent_map gcc_pxo_pll8_pll0_map[] = {
+@@ -297,10 +307,10 @@ static const struct parent_map gcc_pxo_p
+ 	{ P_PLL0, 2 }
+ };
+ 
+-static const char * const gcc_pxo_pll8_pll0[] = {
+-	"pxo",
+-	"pll8_vote",
+-	"pll0_vote",
++static const struct clk_parent_data gcc_pxo_pll8_pll0[] = {
++	{ .fw_name = "pxo", .name = "pxo" },
++	{ .hw = &pll8_vote.hw },
++	{ .hw = &pll0_vote.hw },
+ };
+ 
+ static const struct parent_map gcc_pxo_pll8_pll14_pll18_pll0_map[] = {
+@@ -311,12 +321,12 @@ static const struct parent_map gcc_pxo_p
+ 	{ P_PLL18, 1 }
+ };
+ 
+-static const char * const gcc_pxo_pll8_pll14_pll18_pll0[] = {
+-	"pxo",
+-	"pll8_vote",
+-	"pll0_vote",
+-	"pll14",
+-	"pll18",
++static const struct clk_parent_data gcc_pxo_pll8_pll14_pll18_pll0[] = {
++	{ .fw_name = "pxo", .name = "pxo" },
++	{ .hw = &pll8_vote.hw },
++	{ .hw = &pll0_vote.hw },
++	{ .hw = &pll14.clkr.hw },
++	{ .hw = &pll18.clkr.hw },
+ };
+ 
+ static struct freq_tbl clk_tbl_gsbi_uart[] = {
+@@ -362,7 +372,7 @@ static struct clk_rcg gsbi1_uart_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi1_uart_src",
+-			.parent_names = gcc_pxo_pll8,
++			.parent_data = gcc_pxo_pll8,
+ 			.num_parents = 2,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+@@ -378,8 +388,8 @@ static struct clk_branch gsbi1_uart_clk
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi1_uart_clk",
+-			.parent_names = (const char *[]){
+-				"gsbi1_uart_src",
++			.parent_hws = (const struct clk_hw*[]){
++				&gsbi1_uart_src.clkr.hw,
+ 			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+@@ -413,7 +423,7 @@ static struct clk_rcg gsbi2_uart_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi2_uart_src",
+-			.parent_names = gcc_pxo_pll8,
++			.parent_data = gcc_pxo_pll8,
+ 			.num_parents = 2,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+@@ -429,8 +439,8 @@ static struct clk_branch gsbi2_uart_clk
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi2_uart_clk",
+-			.parent_names = (const char *[]){
+-				"gsbi2_uart_src",
++			.parent_hws = (const struct clk_hw*[]){
++				&gsbi2_uart_src.clkr.hw,
+ 			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+@@ -464,7 +474,7 @@ static struct clk_rcg gsbi4_uart_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi4_uart_src",
+-			.parent_names = gcc_pxo_pll8,
++			.parent_data = gcc_pxo_pll8,
+ 			.num_parents = 2,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+@@ -480,8 +490,8 @@ static struct clk_branch gsbi4_uart_clk
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi4_uart_clk",
+-			.parent_names = (const char *[]){
+-				"gsbi4_uart_src",
++			.parent_hws = (const struct clk_hw*[]){
++				&gsbi4_uart_src.clkr.hw,
+ 			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+@@ -515,7 +525,7 @@ static struct clk_rcg gsbi5_uart_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi5_uart_src",
+-			.parent_names = gcc_pxo_pll8,
++			.parent_data = gcc_pxo_pll8,
+ 			.num_parents = 2,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+@@ -531,8 +541,8 @@ static struct clk_branch gsbi5_uart_clk
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi5_uart_clk",
+-			.parent_names = (const char *[]){
+-				"gsbi5_uart_src",
++			.parent_hws = (const struct clk_hw*[]){
++				&gsbi5_uart_src.clkr.hw,
+ 			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+@@ -566,7 +576,7 @@ static struct clk_rcg gsbi6_uart_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi6_uart_src",
+-			.parent_names = gcc_pxo_pll8,
++			.parent_data = gcc_pxo_pll8,
+ 			.num_parents = 2,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+@@ -582,8 +592,8 @@ static struct clk_branch gsbi6_uart_clk
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi6_uart_clk",
+-			.parent_names = (const char *[]){
+-				"gsbi6_uart_src",
++			.parent_hws = (const struct clk_hw*[]){
++				&gsbi6_uart_src.clkr.hw,
+ 			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+@@ -617,7 +627,7 @@ static struct clk_rcg gsbi7_uart_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi7_uart_src",
+-			.parent_names = gcc_pxo_pll8,
++			.parent_data = gcc_pxo_pll8,
+ 			.num_parents = 2,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+@@ -633,8 +643,8 @@ static struct clk_branch gsbi7_uart_clk
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi7_uart_clk",
+-			.parent_names = (const char *[]){
+-				"gsbi7_uart_src",
++			.parent_hws = (const struct clk_hw*[]){
++				&gsbi7_uart_src.clkr.hw,
+ 			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+@@ -681,7 +691,7 @@ static struct clk_rcg gsbi1_qup_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi1_qup_src",
+-			.parent_names = gcc_pxo_pll8,
++			.parent_data = gcc_pxo_pll8,
+ 			.num_parents = 2,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+@@ -697,7 +707,9 @@ static struct clk_branch gsbi1_qup_clk =
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi1_qup_clk",
+-			.parent_names = (const char *[]){ "gsbi1_qup_src" },
++			.parent_hws = (const struct clk_hw*[]){
++				&gsbi1_qup_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -730,7 +742,7 @@ static struct clk_rcg gsbi2_qup_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi2_qup_src",
+-			.parent_names = gcc_pxo_pll8,
++			.parent_data = gcc_pxo_pll8,
+ 			.num_parents = 2,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+@@ -746,7 +758,9 @@ static struct clk_branch gsbi2_qup_clk =
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi2_qup_clk",
+-			.parent_names = (const char *[]){ "gsbi2_qup_src" },
++			.parent_hws = (const struct clk_hw*[]){
++				&gsbi2_qup_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -779,7 +793,7 @@ static struct clk_rcg gsbi4_qup_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi4_qup_src",
+-			.parent_names = gcc_pxo_pll8,
++			.parent_data = gcc_pxo_pll8,
+ 			.num_parents = 2,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+@@ -795,7 +809,9 @@ static struct clk_branch gsbi4_qup_clk =
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi4_qup_clk",
+-			.parent_names = (const char *[]){ "gsbi4_qup_src" },
++			.parent_hws = (const struct clk_hw*[]){
++				&gsbi4_qup_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -828,7 +844,7 @@ static struct clk_rcg gsbi5_qup_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi5_qup_src",
+-			.parent_names = gcc_pxo_pll8,
++			.parent_data = gcc_pxo_pll8,
+ 			.num_parents = 2,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+@@ -844,7 +860,9 @@ static struct clk_branch gsbi5_qup_clk =
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi5_qup_clk",
+-			.parent_names = (const char *[]){ "gsbi5_qup_src" },
++			.parent_hws = (const struct clk_hw*[]){
++				&gsbi5_qup_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -877,7 +895,7 @@ static struct clk_rcg gsbi6_qup_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi6_qup_src",
+-			.parent_names = gcc_pxo_pll8,
++			.parent_data = gcc_pxo_pll8,
+ 			.num_parents = 2,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+@@ -893,7 +911,9 @@ static struct clk_branch gsbi6_qup_clk =
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi6_qup_clk",
+-			.parent_names = (const char *[]){ "gsbi6_qup_src" },
++			.parent_hws = (const struct clk_hw*[]){
++				&gsbi6_qup_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -926,7 +946,7 @@ static struct clk_rcg gsbi7_qup_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi7_qup_src",
+-			.parent_names = gcc_pxo_pll8,
++			.parent_data = gcc_pxo_pll8,
+ 			.num_parents = 2,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+@@ -942,7 +962,9 @@ static struct clk_branch gsbi7_qup_clk =
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi7_qup_clk",
+-			.parent_names = (const char *[]){ "gsbi7_qup_src" },
++			.parent_hws = (const struct clk_hw*[]){
++				&gsbi7_qup_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1076,7 +1098,7 @@ static struct clk_rcg gp0_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gp0_src",
+-			.parent_names = gcc_pxo_pll8_cxo,
++			.parent_data = gcc_pxo_pll8_cxo,
+ 			.num_parents = 3,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+@@ -1092,7 +1114,9 @@ static struct clk_branch gp0_clk = {
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gp0_clk",
+-			.parent_names = (const char *[]){ "gp0_src" },
++			.parent_hws = (const struct clk_hw*[]){
++				&gp0_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1125,7 +1149,7 @@ static struct clk_rcg gp1_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gp1_src",
+-			.parent_names = gcc_pxo_pll8_cxo,
++			.parent_data = gcc_pxo_pll8_cxo,
+ 			.num_parents = 3,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+@@ -1141,7 +1165,9 @@ static struct clk_branch gp1_clk = {
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gp1_clk",
+-			.parent_names = (const char *[]){ "gp1_src" },
++			.parent_hws = (const struct clk_hw*[]){
++				&gp1_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1174,7 +1200,7 @@ static struct clk_rcg gp2_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gp2_src",
+-			.parent_names = gcc_pxo_pll8_cxo,
++			.parent_data = gcc_pxo_pll8_cxo,
+ 			.num_parents = 3,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+@@ -1190,7 +1216,9 @@ static struct clk_branch gp2_clk = {
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gp2_clk",
+-			.parent_names = (const char *[]){ "gp2_src" },
++			.parent_hws = (const struct clk_hw*[]){
++				&gp2_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1228,7 +1256,7 @@ static struct clk_rcg prng_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "prng_src",
+-			.parent_names = gcc_pxo_pll8,
++			.parent_data = gcc_pxo_pll8,
+ 			.num_parents = 2,
+ 			.ops = &clk_rcg_ops,
+ 		},
+@@ -1244,7 +1272,9 @@ static struct clk_branch prng_clk = {
+ 		.enable_mask = BIT(10),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "prng_clk",
+-			.parent_names = (const char *[]){ "prng_src" },
++			.parent_hws = (const struct clk_hw*[]){
++				&prng_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 		},
+@@ -1290,7 +1320,7 @@ static struct clk_rcg sdc1_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "sdc1_src",
+-			.parent_names = gcc_pxo_pll8,
++			.parent_data = gcc_pxo_pll8,
+ 			.num_parents = 2,
+ 			.ops = &clk_rcg_ops,
+ 		},
+@@ -1305,7 +1335,9 @@ static struct clk_branch sdc1_clk = {
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "sdc1_clk",
+-			.parent_names = (const char *[]){ "sdc1_src" },
++			.parent_hws = (const struct clk_hw*[]){
++				&sdc1_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1338,7 +1370,7 @@ static struct clk_rcg sdc3_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "sdc3_src",
+-			.parent_names = gcc_pxo_pll8,
++			.parent_data = gcc_pxo_pll8,
+ 			.num_parents = 2,
+ 			.ops = &clk_rcg_ops,
+ 		},
+@@ -1353,7 +1385,9 @@ static struct clk_branch sdc3_clk = {
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "sdc3_clk",
+-			.parent_names = (const char *[]){ "sdc3_src" },
++			.parent_hws = (const struct clk_hw*[]){
++				&sdc3_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1421,7 +1455,7 @@ static struct clk_rcg tsif_ref_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "tsif_ref_src",
+-			.parent_names = gcc_pxo_pll8,
++			.parent_data = gcc_pxo_pll8,
+ 			.num_parents = 2,
+ 			.ops = &clk_rcg_ops,
+ 		},
+@@ -1436,7 +1470,9 @@ static struct clk_branch tsif_ref_clk =
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "tsif_ref_clk",
+-			.parent_names = (const char *[]){ "tsif_ref_src" },
++			.parent_hws = (const struct clk_hw*[]){
++				&tsif_ref_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1583,7 +1619,7 @@ static struct clk_rcg pcie_ref_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "pcie_ref_src",
+-			.parent_names = gcc_pxo_pll3,
++			.parent_data = gcc_pxo_pll3,
+ 			.num_parents = 2,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+@@ -1599,7 +1635,9 @@ static struct clk_branch pcie_ref_src_cl
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "pcie_ref_src_clk",
+-			.parent_names = (const char *[]){ "pcie_ref_src" },
++			.parent_hws = (const struct clk_hw*[]){
++				&pcie_ref_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1675,7 +1713,7 @@ static struct clk_rcg pcie1_ref_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "pcie1_ref_src",
+-			.parent_names = gcc_pxo_pll3,
++			.parent_data = gcc_pxo_pll3,
+ 			.num_parents = 2,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+@@ -1691,7 +1729,9 @@ static struct clk_branch pcie1_ref_src_c
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "pcie1_ref_src_clk",
+-			.parent_names = (const char *[]){ "pcie1_ref_src" },
++			.parent_hws = (const struct clk_hw*[]){
++				&pcie1_ref_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1767,7 +1807,7 @@ static struct clk_rcg pcie2_ref_src = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "pcie2_ref_src",
+-			.parent_names = gcc_pxo_pll3,
++			.parent_data = gcc_pxo_pll3,
+ 			.num_parents = 2,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+@@ -1783,7 +1823,9 @@ static struct clk_branch pcie2_ref_src_c
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "pcie2_ref_src_clk",
+-			.parent_names = (const char *[]){ "pcie2_ref_src" },
++			.parent_hws = (const struct clk_hw*[]){
++				&pcie2_ref_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1864,7 +1906,7 @@ static struct clk_rcg sata_ref_src = {
+ 		.enable_mask = BIT(7),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "sata_ref_src",
+-			.parent_names = gcc_pxo_pll3,
++			.parent_data = gcc_pxo_pll3,
+ 			.num_parents = 2,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+@@ -1880,7 +1922,9 @@ static struct clk_branch sata_rxoob_clk
+ 		.enable_mask = BIT(4),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "sata_rxoob_clk",
+-			.parent_names = (const char *[]){ "sata_ref_src" },
++			.parent_hws = (const struct clk_hw*[]){
++				&sata_ref_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1896,7 +1940,9 @@ static struct clk_branch sata_pmalive_cl
+ 		.enable_mask = BIT(4),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "sata_pmalive_clk",
+-			.parent_names = (const char *[]){ "sata_ref_src" },
++			.parent_hws = (const struct clk_hw*[]){
++				&sata_ref_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1912,7 +1958,7 @@ static struct clk_branch sata_phy_ref_cl
+ 		.enable_mask = BIT(4),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "sata_phy_ref_clk",
+-			.parent_names = (const char *[]){ "pxo" },
++			.parent_data = gcc_pxo,
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 		},
+@@ -2001,7 +2047,7 @@ static struct clk_rcg usb30_master_clk_s
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "usb30_master_ref_src",
+-			.parent_names = gcc_pxo_pll8_pll0,
++			.parent_data = gcc_pxo_pll8_pll0,
+ 			.num_parents = 3,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+@@ -2017,7 +2063,9 @@ static struct clk_branch usb30_0_branch_
+ 		.enable_mask = BIT(4),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "usb30_0_branch_clk",
+-			.parent_names = (const char *[]){ "usb30_master_ref_src", },
++			.parent_hws = (const struct clk_hw*[]){
++				&usb30_master_clk_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -2033,7 +2081,9 @@ static struct clk_branch usb30_1_branch_
+ 		.enable_mask = BIT(4),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "usb30_1_branch_clk",
+-			.parent_names = (const char *[]){ "usb30_master_ref_src", },
++			.parent_hws = (const struct clk_hw*[]){
++				&usb30_master_clk_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -2071,7 +2121,7 @@ static struct clk_rcg usb30_utmi_clk = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "usb30_utmi_clk",
+-			.parent_names = gcc_pxo_pll8_pll0,
++			.parent_data = gcc_pxo_pll8_pll0,
+ 			.num_parents = 3,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+@@ -2087,7 +2137,9 @@ static struct clk_branch usb30_0_utmi_cl
+ 		.enable_mask = BIT(4),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "usb30_0_utmi_clk_ctl",
+-			.parent_names = (const char *[]){ "usb30_utmi_clk", },
++			.parent_hws = (const struct clk_hw*[]){
++				&usb30_utmi_clk.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -2103,7 +2155,9 @@ static struct clk_branch usb30_1_utmi_cl
+ 		.enable_mask = BIT(4),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "usb30_1_utmi_clk_ctl",
+-			.parent_names = (const char *[]){ "usb30_utmi_clk", },
++			.parent_hws = (const struct clk_hw*[]){
++				&usb30_utmi_clk.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -2141,7 +2195,7 @@ static struct clk_rcg usb_hs1_xcvr_clk_s
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "usb_hs1_xcvr_src",
+-			.parent_names = gcc_pxo_pll8_pll0,
++			.parent_data = gcc_pxo_pll8_pll0,
+ 			.num_parents = 3,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+@@ -2157,7 +2211,9 @@ static struct clk_branch usb_hs1_xcvr_cl
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "usb_hs1_xcvr_clk",
+-			.parent_names = (const char *[]){ "usb_hs1_xcvr_src" },
++			.parent_hws = (const struct clk_hw*[]){
++				&usb_hs1_xcvr_clk_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -2205,7 +2261,7 @@ static struct clk_rcg usb_fs1_xcvr_clk_s
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "usb_fs1_xcvr_src",
+-			.parent_names = gcc_pxo_pll8_pll0,
++			.parent_data = gcc_pxo_pll8_pll0,
+ 			.num_parents = 3,
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+@@ -2221,7 +2277,9 @@ static struct clk_branch usb_fs1_xcvr_cl
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "usb_fs1_xcvr_clk",
+-			.parent_names = (const char *[]){ "usb_fs1_xcvr_src", },
++			.parent_hws = (const struct clk_hw*[]){
++				&usb_fs1_xcvr_clk_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -2237,7 +2295,9 @@ static struct clk_branch usb_fs1_sys_clk
+ 		.enable_mask = BIT(4),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "usb_fs1_sys_clk",
+-			.parent_names = (const char *[]){ "usb_fs1_xcvr_src", },
++			.parent_hws = (const struct clk_hw*[]){
++				&usb_fs1_xcvr_clk_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -2337,7 +2397,7 @@ static struct clk_dyn_rcg gmac_core1_src
+ 		.enable_mask = BIT(1),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gmac_core1_src",
+-			.parent_names = gcc_pxo_pll8_pll14_pll18_pll0,
++			.parent_data = gcc_pxo_pll8_pll14_pll18_pll0,
+ 			.num_parents = 5,
+ 			.ops = &clk_dyn_rcg_ops,
+ 		},
+@@ -2354,8 +2414,8 @@ static struct clk_branch gmac_core1_clk
+ 		.enable_mask = BIT(4),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gmac_core1_clk",
+-			.parent_names = (const char *[]){
+-				"gmac_core1_src",
++			.parent_hws = (const struct clk_hw*[]){
++				&gmac_core1_src.clkr.hw,
+ 			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+@@ -2409,7 +2469,7 @@ static struct clk_dyn_rcg gmac_core2_src
+ 		.enable_mask = BIT(1),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gmac_core2_src",
+-			.parent_names = gcc_pxo_pll8_pll14_pll18_pll0,
++			.parent_data = gcc_pxo_pll8_pll14_pll18_pll0,
+ 			.num_parents = 5,
+ 			.ops = &clk_dyn_rcg_ops,
+ 		},
+@@ -2426,8 +2486,8 @@ static struct clk_branch gmac_core2_clk
+ 		.enable_mask = BIT(4),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gmac_core2_clk",
+-			.parent_names = (const char *[]){
+-				"gmac_core2_src",
++			.parent_hws = (const struct clk_hw*[]){
++				&gmac_core2_src.clkr.hw,
+ 			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+@@ -2481,7 +2541,7 @@ static struct clk_dyn_rcg gmac_core3_src
+ 		.enable_mask = BIT(1),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gmac_core3_src",
+-			.parent_names = gcc_pxo_pll8_pll14_pll18_pll0,
++			.parent_data = gcc_pxo_pll8_pll14_pll18_pll0,
+ 			.num_parents = 5,
+ 			.ops = &clk_dyn_rcg_ops,
+ 		},
+@@ -2498,8 +2558,8 @@ static struct clk_branch gmac_core3_clk
+ 		.enable_mask = BIT(4),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gmac_core3_clk",
+-			.parent_names = (const char *[]){
+-				"gmac_core3_src",
++			.parent_hws = (const struct clk_hw*[]){
++				&gmac_core3_src.clkr.hw,
+ 			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+@@ -2553,7 +2613,7 @@ static struct clk_dyn_rcg gmac_core4_src
+ 		.enable_mask = BIT(1),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gmac_core4_src",
+-			.parent_names = gcc_pxo_pll8_pll14_pll18_pll0,
++			.parent_data = gcc_pxo_pll8_pll14_pll18_pll0,
+ 			.num_parents = 5,
+ 			.ops = &clk_dyn_rcg_ops,
+ 		},
+@@ -2570,8 +2630,8 @@ static struct clk_branch gmac_core4_clk
+ 		.enable_mask = BIT(4),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gmac_core4_clk",
+-			.parent_names = (const char *[]){
+-				"gmac_core4_src",
++			.parent_hws = (const struct clk_hw*[]){
++				&gmac_core4_src.clkr.hw,
+ 			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+@@ -2613,7 +2673,7 @@ static struct clk_dyn_rcg nss_tcm_src =
+ 		.enable_mask = BIT(1),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "nss_tcm_src",
+-			.parent_names = gcc_pxo_pll8_pll14_pll18_pll0,
++			.parent_data = gcc_pxo_pll8_pll14_pll18_pll0,
+ 			.num_parents = 5,
+ 			.ops = &clk_dyn_rcg_ops,
+ 		},
+@@ -2628,8 +2688,8 @@ static struct clk_branch nss_tcm_clk = {
+ 		.enable_mask = BIT(6) | BIT(4),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "nss_tcm_clk",
+-			.parent_names = (const char *[]){
+-				"nss_tcm_src",
++			.parent_hws = (const struct clk_hw*[]){
++				&nss_tcm_src.clkr.hw,
+ 			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+@@ -2691,7 +2751,7 @@ static struct clk_dyn_rcg ubi32_core1_sr
+ 		.enable_mask = BIT(1),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "ubi32_core1_src_clk",
+-			.parent_names = gcc_pxo_pll8_pll14_pll18_pll0,
++			.parent_data = gcc_pxo_pll8_pll14_pll18_pll0,
+ 			.num_parents = 5,
+ 			.ops = &clk_dyn_rcg_ops,
+ 			.flags = CLK_SET_RATE_PARENT | CLK_GET_RATE_NOCACHE,
+@@ -2744,7 +2804,7 @@ static struct clk_dyn_rcg ubi32_core2_sr
+ 		.enable_mask = BIT(1),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "ubi32_core2_src_clk",
+-			.parent_names = gcc_pxo_pll8_pll14_pll18_pll0,
++			.parent_data = gcc_pxo_pll8_pll14_pll18_pll0,
+ 			.num_parents = 5,
+ 			.ops = &clk_dyn_rcg_ops,
+ 			.flags = CLK_SET_RATE_PARENT | CLK_GET_RATE_NOCACHE,
diff --git a/target/linux/ipq806x/patches-5.15/100-v5.18-06-linux-next-clk-qcom-gcc-ipq806x-use-ARRAY_SIZE-for-num_parents.patch b/target/linux/ipq806x/patches-5.15/100-v5.18-06-linux-next-clk-qcom-gcc-ipq806x-use-ARRAY_SIZE-for-num_parents.patch
new file mode 100644
index 00000000000000..6e6cec7db5c370
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/100-v5.18-06-linux-next-clk-qcom-gcc-ipq806x-use-ARRAY_SIZE-for-num_parents.patch
@@ -0,0 +1,325 @@
+From a6aedd6532131bc81d47bbf63385dfcf2a0e9faa Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sat, 26 Feb 2022 14:52:26 +0100
+Subject: [PATCH 06/14] clk: qcom: gcc-ipq806x: use ARRAY_SIZE for num_parents
+
+Use ARRAY_SIZE for num_parents instead of hardcoding the value.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220226135235.10051-7-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/gcc-ipq806x.c | 68 +++++++++++++++++-----------------
+ 1 file changed, 34 insertions(+), 34 deletions(-)
+
+--- a/drivers/clk/qcom/gcc-ipq806x.c
++++ b/drivers/clk/qcom/gcc-ipq806x.c
+@@ -373,7 +373,7 @@ static struct clk_rcg gsbi1_uart_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi1_uart_src",
+ 			.parent_data = gcc_pxo_pll8,
+-			.num_parents = 2,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+ 		},
+@@ -424,7 +424,7 @@ static struct clk_rcg gsbi2_uart_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi2_uart_src",
+ 			.parent_data = gcc_pxo_pll8,
+-			.num_parents = 2,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+ 		},
+@@ -475,7 +475,7 @@ static struct clk_rcg gsbi4_uart_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi4_uart_src",
+ 			.parent_data = gcc_pxo_pll8,
+-			.num_parents = 2,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+ 		},
+@@ -526,7 +526,7 @@ static struct clk_rcg gsbi5_uart_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi5_uart_src",
+ 			.parent_data = gcc_pxo_pll8,
+-			.num_parents = 2,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+ 		},
+@@ -577,7 +577,7 @@ static struct clk_rcg gsbi6_uart_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi6_uart_src",
+ 			.parent_data = gcc_pxo_pll8,
+-			.num_parents = 2,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+ 		},
+@@ -628,7 +628,7 @@ static struct clk_rcg gsbi7_uart_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi7_uart_src",
+ 			.parent_data = gcc_pxo_pll8,
+-			.num_parents = 2,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+ 		},
+@@ -692,7 +692,7 @@ static struct clk_rcg gsbi1_qup_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi1_qup_src",
+ 			.parent_data = gcc_pxo_pll8,
+-			.num_parents = 2,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+ 		},
+@@ -743,7 +743,7 @@ static struct clk_rcg gsbi2_qup_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi2_qup_src",
+ 			.parent_data = gcc_pxo_pll8,
+-			.num_parents = 2,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+ 		},
+@@ -794,7 +794,7 @@ static struct clk_rcg gsbi4_qup_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi4_qup_src",
+ 			.parent_data = gcc_pxo_pll8,
+-			.num_parents = 2,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+ 		},
+@@ -845,7 +845,7 @@ static struct clk_rcg gsbi5_qup_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi5_qup_src",
+ 			.parent_data = gcc_pxo_pll8,
+-			.num_parents = 2,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+ 		},
+@@ -896,7 +896,7 @@ static struct clk_rcg gsbi6_qup_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi6_qup_src",
+ 			.parent_data = gcc_pxo_pll8,
+-			.num_parents = 2,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+ 		},
+@@ -947,7 +947,7 @@ static struct clk_rcg gsbi7_qup_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi7_qup_src",
+ 			.parent_data = gcc_pxo_pll8,
+-			.num_parents = 2,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+ 		},
+@@ -1099,7 +1099,7 @@ static struct clk_rcg gp0_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gp0_src",
+ 			.parent_data = gcc_pxo_pll8_cxo,
+-			.num_parents = 3,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8_cxo),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_PARENT_GATE,
+ 		},
+@@ -1150,7 +1150,7 @@ static struct clk_rcg gp1_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gp1_src",
+ 			.parent_data = gcc_pxo_pll8_cxo,
+-			.num_parents = 3,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8_cxo),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+ 		},
+@@ -1201,7 +1201,7 @@ static struct clk_rcg gp2_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gp2_src",
+ 			.parent_data = gcc_pxo_pll8_cxo,
+-			.num_parents = 3,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8_cxo),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+ 		},
+@@ -1257,7 +1257,7 @@ static struct clk_rcg prng_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "prng_src",
+ 			.parent_data = gcc_pxo_pll8,
+-			.num_parents = 2,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8),
+ 			.ops = &clk_rcg_ops,
+ 		},
+ 	},
+@@ -1321,7 +1321,7 @@ static struct clk_rcg sdc1_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "sdc1_src",
+ 			.parent_data = gcc_pxo_pll8,
+-			.num_parents = 2,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8),
+ 			.ops = &clk_rcg_ops,
+ 		},
+ 	}
+@@ -1371,7 +1371,7 @@ static struct clk_rcg sdc3_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "sdc3_src",
+ 			.parent_data = gcc_pxo_pll8,
+-			.num_parents = 2,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8),
+ 			.ops = &clk_rcg_ops,
+ 		},
+ 	}
+@@ -1456,7 +1456,7 @@ static struct clk_rcg tsif_ref_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "tsif_ref_src",
+ 			.parent_data = gcc_pxo_pll8,
+-			.num_parents = 2,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8),
+ 			.ops = &clk_rcg_ops,
+ 		},
+ 	}
+@@ -1620,7 +1620,7 @@ static struct clk_rcg pcie_ref_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "pcie_ref_src",
+ 			.parent_data = gcc_pxo_pll3,
+-			.num_parents = 2,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll3),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+ 		},
+@@ -1714,7 +1714,7 @@ static struct clk_rcg pcie1_ref_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "pcie1_ref_src",
+ 			.parent_data = gcc_pxo_pll3,
+-			.num_parents = 2,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll3),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+ 		},
+@@ -1808,7 +1808,7 @@ static struct clk_rcg pcie2_ref_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "pcie2_ref_src",
+ 			.parent_data = gcc_pxo_pll3,
+-			.num_parents = 2,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll3),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+ 		},
+@@ -1907,7 +1907,7 @@ static struct clk_rcg sata_ref_src = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "sata_ref_src",
+ 			.parent_data = gcc_pxo_pll3,
+-			.num_parents = 2,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll3),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+ 		},
+@@ -2048,7 +2048,7 @@ static struct clk_rcg usb30_master_clk_s
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "usb30_master_ref_src",
+ 			.parent_data = gcc_pxo_pll8_pll0,
+-			.num_parents = 3,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8_pll0),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+ 		},
+@@ -2122,7 +2122,7 @@ static struct clk_rcg usb30_utmi_clk = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "usb30_utmi_clk",
+ 			.parent_data = gcc_pxo_pll8_pll0,
+-			.num_parents = 3,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8_pll0),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+ 		},
+@@ -2196,7 +2196,7 @@ static struct clk_rcg usb_hs1_xcvr_clk_s
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "usb_hs1_xcvr_src",
+ 			.parent_data = gcc_pxo_pll8_pll0,
+-			.num_parents = 3,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8_pll0),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+ 		},
+@@ -2262,7 +2262,7 @@ static struct clk_rcg usb_fs1_xcvr_clk_s
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "usb_fs1_xcvr_src",
+ 			.parent_data = gcc_pxo_pll8_pll0,
+-			.num_parents = 3,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8_pll0),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+ 		},
+@@ -2398,7 +2398,7 @@ static struct clk_dyn_rcg gmac_core1_src
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gmac_core1_src",
+ 			.parent_data = gcc_pxo_pll8_pll14_pll18_pll0,
+-			.num_parents = 5,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8_pll14_pll18_pll0),
+ 			.ops = &clk_dyn_rcg_ops,
+ 		},
+ 	},
+@@ -2470,7 +2470,7 @@ static struct clk_dyn_rcg gmac_core2_src
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gmac_core2_src",
+ 			.parent_data = gcc_pxo_pll8_pll14_pll18_pll0,
+-			.num_parents = 5,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8_pll14_pll18_pll0),
+ 			.ops = &clk_dyn_rcg_ops,
+ 		},
+ 	},
+@@ -2542,7 +2542,7 @@ static struct clk_dyn_rcg gmac_core3_src
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gmac_core3_src",
+ 			.parent_data = gcc_pxo_pll8_pll14_pll18_pll0,
+-			.num_parents = 5,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8_pll14_pll18_pll0),
+ 			.ops = &clk_dyn_rcg_ops,
+ 		},
+ 	},
+@@ -2614,7 +2614,7 @@ static struct clk_dyn_rcg gmac_core4_src
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gmac_core4_src",
+ 			.parent_data = gcc_pxo_pll8_pll14_pll18_pll0,
+-			.num_parents = 5,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8_pll14_pll18_pll0),
+ 			.ops = &clk_dyn_rcg_ops,
+ 		},
+ 	},
+@@ -2674,7 +2674,7 @@ static struct clk_dyn_rcg nss_tcm_src =
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "nss_tcm_src",
+ 			.parent_data = gcc_pxo_pll8_pll14_pll18_pll0,
+-			.num_parents = 5,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8_pll14_pll18_pll0),
+ 			.ops = &clk_dyn_rcg_ops,
+ 		},
+ 	},
+@@ -2752,7 +2752,7 @@ static struct clk_dyn_rcg ubi32_core1_sr
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "ubi32_core1_src_clk",
+ 			.parent_data = gcc_pxo_pll8_pll14_pll18_pll0,
+-			.num_parents = 5,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8_pll14_pll18_pll0),
+ 			.ops = &clk_dyn_rcg_ops,
+ 			.flags = CLK_SET_RATE_PARENT | CLK_GET_RATE_NOCACHE,
+ 		},
+@@ -2805,7 +2805,7 @@ static struct clk_dyn_rcg ubi32_core2_sr
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "ubi32_core2_src_clk",
+ 			.parent_data = gcc_pxo_pll8_pll14_pll18_pll0,
+-			.num_parents = 5,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8_pll14_pll18_pll0),
+ 			.ops = &clk_dyn_rcg_ops,
+ 			.flags = CLK_SET_RATE_PARENT | CLK_GET_RATE_NOCACHE,
+ 		},
diff --git a/target/linux/ipq806x/patches-5.15/100-v5.18-07-linux-next-clk-qcom-gcc-ipq806x-add-additional-freq-nss-cores.patch b/target/linux/ipq806x/patches-5.15/100-v5.18-07-linux-next-clk-qcom-gcc-ipq806x-add-additional-freq-nss-cores.patch
new file mode 100644
index 00000000000000..b0f09ec34dc546
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/100-v5.18-07-linux-next-clk-qcom-gcc-ipq806x-add-additional-freq-nss-cores.patch
@@ -0,0 +1,88 @@
+From 512ea2edfe15ffa2cd839b3a31d768145f2edc20 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sat, 26 Feb 2022 14:52:27 +0100
+Subject: [PATCH 07/14] clk: qcom: gcc-ipq806x: add additional freq nss cores
+
+Ipq8065 SoC (an evolution of ipq8064 SoC) contains nss cores that can be
+clocked to 800MHz. Add these missing freq to the gcc driver.
+Set the freq_tbl for the ubi32_cores to the correct values based on the
+machine compatible.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220226135235.10051-8-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/gcc-ipq806x.c | 24 +++++++++++++++++++++---
+ 1 file changed, 21 insertions(+), 3 deletions(-)
+
+--- a/drivers/clk/qcom/gcc-ipq806x.c
++++ b/drivers/clk/qcom/gcc-ipq806x.c
+@@ -232,7 +232,9 @@ static struct clk_regmap pll14_vote = {
+ 
+ static struct pll_freq_tbl pll18_freq_tbl[] = {
+ 	NSS_PLL_RATE(550000000, 44, 0, 1, 0x01495625),
++	NSS_PLL_RATE(600000000, 48, 0, 1, 0x01495625),
+ 	NSS_PLL_RATE(733000000, 58, 16, 25, 0x014b5625),
++	NSS_PLL_RATE(800000000, 64, 0, 1, 0x01495625),
+ };
+ 
+ static struct clk_pll pll18 = {
+@@ -2698,7 +2700,7 @@ static struct clk_branch nss_tcm_clk = {
+ 	},
+ };
+ 
+-static const struct freq_tbl clk_tbl_nss[] = {
++static const struct freq_tbl clk_tbl_nss_ipq8064[] = {
+ 	{ 110000000, P_PLL18, 1, 1, 5 },
+ 	{ 275000000, P_PLL18, 2, 0, 0 },
+ 	{ 550000000, P_PLL18, 1, 0, 0 },
+@@ -2706,6 +2708,14 @@ static const struct freq_tbl clk_tbl_nss
+ 	{ }
+ };
+ 
++static const struct freq_tbl clk_tbl_nss_ipq8065[] = {
++	{ 110000000, P_PLL18, 1, 1, 5 },
++	{ 275000000, P_PLL18, 2, 0, 0 },
++	{ 600000000, P_PLL18, 1, 0, 0 },
++	{ 800000000, P_PLL18, 1, 0, 0 },
++	{ }
++};
++
+ static struct clk_dyn_rcg ubi32_core1_src_clk = {
+ 	.ns_reg[0] = 0x3d2c,
+ 	.ns_reg[1] = 0x3d30,
+@@ -2745,7 +2755,7 @@ static struct clk_dyn_rcg ubi32_core1_sr
+ 		.pre_div_width = 2,
+ 	},
+ 	.mux_sel_bit = 0,
+-	.freq_tbl = clk_tbl_nss,
++	/* nss freq table is selected based on the SoC compatible */
+ 	.clkr = {
+ 		.enable_reg = 0x3d20,
+ 		.enable_mask = BIT(1),
+@@ -2798,7 +2808,7 @@ static struct clk_dyn_rcg ubi32_core2_sr
+ 		.pre_div_width = 2,
+ 	},
+ 	.mux_sel_bit = 0,
+-	.freq_tbl = clk_tbl_nss,
++	/* nss freq table is selected based on the SoC compatible */
+ 	.clkr = {
+ 		.enable_reg = 0x3d40,
+ 		.enable_mask = BIT(1),
+@@ -3131,6 +3141,14 @@ static int gcc_ipq806x_probe(struct plat
+ 	if (ret)
+ 		return ret;
+ 
++	if (of_machine_is_compatible("qcom,ipq8065")) {
++		ubi32_core1_src_clk.freq_tbl = clk_tbl_nss_ipq8065;
++		ubi32_core2_src_clk.freq_tbl = clk_tbl_nss_ipq8065;
++	} else {
++		ubi32_core1_src_clk.freq_tbl = clk_tbl_nss_ipq8064;
++		ubi32_core2_src_clk.freq_tbl = clk_tbl_nss_ipq8064;
++	}
++
+ 	ret = qcom_cc_probe(pdev, &gcc_ipq806x_desc);
+ 	if (ret)
+ 		return ret;
diff --git a/target/linux/ipq806x/patches-5.15/100-v5.18-08-linux-next-clk-qcom-gcc-ipq806x-add-unusued-flag-for-critical-c.patch b/target/linux/ipq806x/patches-5.15/100-v5.18-08-linux-next-clk-qcom-gcc-ipq806x-add-unusued-flag-for-critical-c.patch
new file mode 100644
index 00000000000000..3d55cb421a1ec8
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/100-v5.18-08-linux-next-clk-qcom-gcc-ipq806x-add-unusued-flag-for-critical-c.patch
@@ -0,0 +1,65 @@
+From 28aa450d38e521de45be951df052d2c49a17fae2 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sat, 26 Feb 2022 14:52:28 +0100
+Subject: [PATCH 08/14] clk: qcom: gcc-ipq806x: add unusued flag for critical
+ clock
+
+Some clocks are used by other devices present on the SoC. For example
+the gsbi4_h_clk is used by RPM and is if disabled cause the RPM to
+reject any regulator change command. These clock should never be
+disabled.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220226135235.10051-9-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/gcc-ipq806x.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/clk/qcom/gcc-ipq806x.c
++++ b/drivers/clk/qcom/gcc-ipq806x.c
+@@ -798,7 +798,7 @@ static struct clk_rcg gsbi4_qup_src = {
+ 			.parent_data = gcc_pxo_pll8,
+ 			.num_parents = ARRAY_SIZE(gcc_pxo_pll8),
+ 			.ops = &clk_rcg_ops,
+-			.flags = CLK_SET_PARENT_GATE,
++			.flags = CLK_SET_PARENT_GATE | CLK_IGNORE_UNUSED,
+ 		},
+ 	},
+ };
+@@ -816,7 +816,7 @@ static struct clk_branch gsbi4_qup_clk =
+ 			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+-			.flags = CLK_SET_RATE_PARENT,
++			.flags = CLK_SET_RATE_PARENT | CLK_IGNORE_UNUSED,
+ 		},
+ 	},
+ };
+@@ -900,7 +900,7 @@ static struct clk_rcg gsbi6_qup_src = {
+ 			.parent_data = gcc_pxo_pll8,
+ 			.num_parents = ARRAY_SIZE(gcc_pxo_pll8),
+ 			.ops = &clk_rcg_ops,
+-			.flags = CLK_SET_PARENT_GATE,
++			.flags = CLK_SET_PARENT_GATE | CLK_IGNORE_UNUSED,
+ 		},
+ 	},
+ };
+@@ -969,7 +969,7 @@ static struct clk_branch gsbi7_qup_clk =
+ 			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+-			.flags = CLK_SET_RATE_PARENT,
++			.flags = CLK_SET_RATE_PARENT | CLK_IGNORE_UNUSED,
+ 		},
+ 	},
+ };
+@@ -1015,6 +1015,7 @@ static struct clk_branch gsbi4_h_clk = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gsbi4_h_clk",
+ 			.ops = &clk_branch_ops,
++			.flags = CLK_IGNORE_UNUSED,
+ 		},
+ 	},
+ };
diff --git a/target/linux/ipq806x/patches-5.15/100-v5.18-09-linux-next-clk-qcom-clk-rcg-add-clk_rcg_floor_ops-ops.patch b/target/linux/ipq806x/patches-5.15/100-v5.18-09-linux-next-clk-qcom-clk-rcg-add-clk_rcg_floor_ops-ops.patch
new file mode 100644
index 00000000000000..22bd040d1bfa72
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/100-v5.18-09-linux-next-clk-qcom-clk-rcg-add-clk_rcg_floor_ops-ops.patch
@@ -0,0 +1,69 @@
+From 33958ad3fc02aeb06a4634e59689a9559d968e1f Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sat, 26 Feb 2022 14:52:29 +0100
+Subject: [PATCH 09/14] clk: qcom: clk-rcg: add clk_rcg_floor_ops ops
+
+Add clk_rcg_floor_ops for clock that can't provide a stable freq and
+require to use a floor freq to provide the requested frequency.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220226135235.10051-10-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/clk-rcg.c | 24 ++++++++++++++++++++++++
+ drivers/clk/qcom/clk-rcg.h |  1 +
+ 2 files changed, 25 insertions(+)
+
+--- a/drivers/clk/qcom/clk-rcg.c
++++ b/drivers/clk/qcom/clk-rcg.c
+@@ -526,6 +526,19 @@ static int clk_rcg_set_rate(struct clk_h
+ 	return __clk_rcg_set_rate(rcg, f);
+ }
+ 
++static int clk_rcg_set_floor_rate(struct clk_hw *hw, unsigned long rate,
++				  unsigned long parent_rate)
++{
++	struct clk_rcg *rcg = to_clk_rcg(hw);
++	const struct freq_tbl *f;
++
++	f = qcom_find_freq_floor(rcg->freq_tbl, rate);
++	if (!f)
++		return -EINVAL;
++
++	return __clk_rcg_set_rate(rcg, f);
++}
++
+ static int clk_rcg_bypass_set_rate(struct clk_hw *hw, unsigned long rate,
+ 				unsigned long parent_rate)
+ {
+@@ -816,6 +829,17 @@ const struct clk_ops clk_rcg_ops = {
+ };
+ EXPORT_SYMBOL_GPL(clk_rcg_ops);
+ 
++const struct clk_ops clk_rcg_floor_ops = {
++	.enable = clk_enable_regmap,
++	.disable = clk_disable_regmap,
++	.get_parent = clk_rcg_get_parent,
++	.set_parent = clk_rcg_set_parent,
++	.recalc_rate = clk_rcg_recalc_rate,
++	.determine_rate = clk_rcg_determine_rate,
++	.set_rate = clk_rcg_set_floor_rate,
++};
++EXPORT_SYMBOL_GPL(clk_rcg_floor_ops);
++
+ const struct clk_ops clk_rcg_bypass_ops = {
+ 	.enable = clk_enable_regmap,
+ 	.disable = clk_disable_regmap,
+--- a/drivers/clk/qcom/clk-rcg.h
++++ b/drivers/clk/qcom/clk-rcg.h
+@@ -86,6 +86,7 @@ struct clk_rcg {
+ };
+ 
+ extern const struct clk_ops clk_rcg_ops;
++extern const struct clk_ops clk_rcg_floor_ops;
+ extern const struct clk_ops clk_rcg_bypass_ops;
+ extern const struct clk_ops clk_rcg_bypass2_ops;
+ extern const struct clk_ops clk_rcg_pixel_ops;
diff --git a/target/linux/ipq806x/patches-5.15/100-v5.18-10-linux-next-clk-qcom-gcc-ipq806x-add-additional-freq-for-sdc-tab.patch b/target/linux/ipq806x/patches-5.15/100-v5.18-10-linux-next-clk-qcom-gcc-ipq806x-add-additional-freq-for-sdc-tab.patch
new file mode 100644
index 00000000000000..3bb5e57c87a700
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/100-v5.18-10-linux-next-clk-qcom-gcc-ipq806x-add-additional-freq-for-sdc-tab.patch
@@ -0,0 +1,38 @@
+From 7e726f34c782b2ca28a29ca9870e34e4319d65bc Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sat, 26 Feb 2022 14:52:30 +0100
+Subject: [PATCH 10/14] clk: qcom: gcc-ipq806x: add additional freq for sdc
+ table
+
+Add additional freq supported for the sdc table. The ops are changed to
+the floor_ops to handle a freq request of 52kHz where we need to provide
+a freq of 51.2kHz instead for stability reason.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220226135235.10051-11-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/gcc-ipq806x.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/qcom/gcc-ipq806x.c
++++ b/drivers/clk/qcom/gcc-ipq806x.c
+@@ -1292,6 +1292,7 @@ static const struct freq_tbl clk_tbl_sdc
+ 	{  20210000, P_PLL8,  1, 1,  19 },
+ 	{  24000000, P_PLL8,  4, 1,   4 },
+ 	{  48000000, P_PLL8,  4, 1,   2 },
++	{  51200000, P_PLL8,  1, 2,  15 },
+ 	{  64000000, P_PLL8,  3, 1,   2 },
+ 	{  96000000, P_PLL8,  4, 0,   0 },
+ 	{ 192000000, P_PLL8,  2, 0,   0 },
+@@ -1325,7 +1326,7 @@ static struct clk_rcg sdc1_src = {
+ 			.name = "sdc1_src",
+ 			.parent_data = gcc_pxo_pll8,
+ 			.num_parents = ARRAY_SIZE(gcc_pxo_pll8),
+-			.ops = &clk_rcg_ops,
++			.ops = &clk_rcg_floor_ops,
+ 		},
+ 	}
+ };
diff --git a/target/linux/ipq806x/patches-5.15/100-v5.18-11-linux-next-dt-bindings-clock-add-ipq8064-ce5-clk-define.patch b/target/linux/ipq806x/patches-5.15/100-v5.18-11-linux-next-dt-bindings-clock-add-ipq8064-ce5-clk-define.patch
new file mode 100644
index 00000000000000..858c6f78a52d45
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/100-v5.18-11-linux-next-dt-bindings-clock-add-ipq8064-ce5-clk-define.patch
@@ -0,0 +1,39 @@
+From b565d66403e3df303a058c0d8d00d0fc6aeb2ddc Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sat, 26 Feb 2022 14:52:31 +0100
+Subject: [PATCH 11/14] dt-bindings: clock: add ipq8064 ce5 clk define
+
+Add ipq8064 ce5 clk define needed for CryptoEngine in gcc driver.
+Define CE5_SRC is not used so it's OK to change and we align it to
+the QSDK naming.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220226135235.10051-12-ansuelsmth@gmail.com
+---
+ include/dt-bindings/clock/qcom,gcc-ipq806x.h | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/include/dt-bindings/clock/qcom,gcc-ipq806x.h
++++ b/include/dt-bindings/clock/qcom,gcc-ipq806x.h
+@@ -240,7 +240,7 @@
+ #define PLL14					232
+ #define PLL14_VOTE				233
+ #define PLL18					234
+-#define CE5_SRC					235
++#define CE5_A_CLK				235
+ #define CE5_H_CLK				236
+ #define CE5_CORE_CLK				237
+ #define CE3_SLEEP_CLK				238
+@@ -283,5 +283,8 @@
+ #define EBI2_AON_CLK				281
+ #define NSSTCM_CLK_SRC				282
+ #define NSSTCM_CLK				283
++#define CE5_A_CLK_SRC				285
++#define CE5_H_CLK_SRC				286
++#define CE5_CORE_CLK_SRC			287
+ 
+ #endif
diff --git a/target/linux/ipq806x/patches-5.15/100-v5.18-12-linux-next-clk-qcom-gcc-ipq806x-add-CryptoEngine-clocks.patch b/target/linux/ipq806x/patches-5.15/100-v5.18-12-linux-next-clk-qcom-gcc-ipq806x-add-CryptoEngine-clocks.patch
new file mode 100644
index 00000000000000..3ded707bf0cb50
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/100-v5.18-12-linux-next-clk-qcom-gcc-ipq806x-add-CryptoEngine-clocks.patch
@@ -0,0 +1,304 @@
+From b293510f3961b90dcab59965f57779be93ceda7c Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sat, 26 Feb 2022 14:52:32 +0100
+Subject: [PATCH 12/14] clk: qcom: gcc-ipq806x: add CryptoEngine clocks
+
+Add missing CryptoEngine clocks and pll11 required clock.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220226135235.10051-13-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/gcc-ipq806x.c | 244 +++++++++++++++++++++++++++++++++
+ 1 file changed, 244 insertions(+)
+
+--- a/drivers/clk/qcom/gcc-ipq806x.c
++++ b/drivers/clk/qcom/gcc-ipq806x.c
+@@ -256,6 +256,24 @@ static struct clk_pll pll18 = {
+ 	},
+ };
+ 
++static struct clk_pll pll11 = {
++	.l_reg = 0x3184,
++	.m_reg = 0x3188,
++	.n_reg = 0x318c,
++	.config_reg = 0x3194,
++	.mode_reg = 0x3180,
++	.status_reg = 0x3198,
++	.status_bit = 16,
++	.clkr.hw.init = &(struct clk_init_data){
++		.name = "pll11",
++		.parent_data = &(const struct clk_parent_data){
++			.fw_name = "pxo",
++		},
++		.num_parents = 1,
++		.ops = &clk_pll_ops,
++	},
++};
++
+ enum {
+ 	P_PXO,
+ 	P_PLL8,
+@@ -264,6 +282,7 @@ enum {
+ 	P_CXO,
+ 	P_PLL14,
+ 	P_PLL18,
++	P_PLL11,
+ };
+ 
+ static const struct parent_map gcc_pxo_pll8_map[] = {
+@@ -331,6 +350,44 @@ static const struct clk_parent_data gcc_
+ 	{ .hw = &pll18.clkr.hw },
+ };
+ 
++static const struct parent_map gcc_pxo_pll8_pll0_pll14_pll18_pll11_map[] = {
++	{ P_PXO, 0 },
++	{ P_PLL8, 4 },
++	{ P_PLL0, 2 },
++	{ P_PLL14, 5 },
++	{ P_PLL18, 1 },
++	{ P_PLL11, 3 },
++};
++
++static const struct clk_parent_data gcc_pxo_pll8_pll0_pll14_pll18_pll11[] = {
++	{ .fw_name = "pxo" },
++	{ .hw = &pll8_vote.hw },
++	{ .hw = &pll0_vote.hw },
++	{ .hw = &pll14.clkr.hw },
++	{ .hw = &pll18.clkr.hw },
++	{ .hw = &pll11.clkr.hw },
++
++};
++
++static const struct parent_map gcc_pxo_pll3_pll0_pll14_pll18_pll11_map[] = {
++	{ P_PXO, 0 },
++	{ P_PLL3, 6 },
++	{ P_PLL0, 2 },
++	{ P_PLL14, 5 },
++	{ P_PLL18, 1 },
++	{ P_PLL11, 3 },
++};
++
++static const struct clk_parent_data gcc_pxo_pll3_pll0_pll14_pll18_pll11[] = {
++	{ .fw_name = "pxo" },
++	{ .hw = &pll3.clkr.hw },
++	{ .hw = &pll0_vote.hw },
++	{ .hw = &pll14.clkr.hw },
++	{ .hw = &pll18.clkr.hw },
++	{ .hw = &pll11.clkr.hw },
++
++};
++
+ static struct freq_tbl clk_tbl_gsbi_uart[] = {
+ 	{  1843200, P_PLL8, 2,  6, 625 },
+ 	{  3686400, P_PLL8, 2, 12, 625 },
+@@ -2824,6 +2881,186 @@ static struct clk_dyn_rcg ubi32_core2_sr
+ 	},
+ };
+ 
++static const struct freq_tbl clk_tbl_ce5_core[] = {
++	{ 150000000, P_PLL3, 8, 1, 1 },
++	{ 213200000, P_PLL11, 5, 1, 1 },
++	{ }
++};
++
++static struct clk_dyn_rcg ce5_core_src = {
++	.ns_reg[0] = 0x36C4,
++	.ns_reg[1] = 0x36C8,
++	.bank_reg = 0x36C0,
++	.s[0] = {
++		.src_sel_shift = 0,
++		.parent_map = gcc_pxo_pll3_pll0_pll14_pll18_pll11_map,
++	},
++	.s[1] = {
++		.src_sel_shift = 0,
++		.parent_map = gcc_pxo_pll3_pll0_pll14_pll18_pll11_map,
++	},
++	.p[0] = {
++		.pre_div_shift = 3,
++		.pre_div_width = 4,
++	},
++	.p[1] = {
++		.pre_div_shift = 3,
++		.pre_div_width = 4,
++	},
++	.mux_sel_bit = 0,
++	.freq_tbl = clk_tbl_ce5_core,
++	.clkr = {
++		.enable_reg = 0x36C0,
++		.enable_mask = BIT(1),
++		.hw.init = &(struct clk_init_data){
++			.name = "ce5_core_src",
++			.parent_data = gcc_pxo_pll3_pll0_pll14_pll18_pll11,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll3_pll0_pll14_pll18_pll11),
++			.ops = &clk_dyn_rcg_ops,
++		},
++	},
++};
++
++static struct clk_branch ce5_core_clk = {
++	.halt_reg = 0x2FDC,
++	.halt_bit = 5,
++	.hwcg_reg = 0x36CC,
++	.hwcg_bit = 6,
++	.clkr = {
++		.enable_reg = 0x36CC,
++		.enable_mask = BIT(4),
++		.hw.init = &(struct clk_init_data){
++			.name = "ce5_core_clk",
++			.parent_hws = (const struct clk_hw*[]){
++				&ce5_core_src.clkr.hw,
++			},
++			.num_parents = 1,
++			.ops = &clk_branch_ops,
++			.flags = CLK_SET_RATE_PARENT,
++		},
++	},
++};
++
++static const struct freq_tbl clk_tbl_ce5_a_clk[] = {
++	{ 160000000, P_PLL0, 5, 1, 1 },
++	{ 213200000, P_PLL11, 5, 1, 1 },
++	{ }
++};
++
++static struct clk_dyn_rcg ce5_a_clk_src = {
++	.ns_reg[0] = 0x3d84,
++	.ns_reg[1] = 0x3d88,
++	.bank_reg = 0x3d80,
++	.s[0] = {
++		.src_sel_shift = 0,
++		.parent_map = gcc_pxo_pll8_pll0_pll14_pll18_pll11_map,
++	},
++	.s[1] = {
++		.src_sel_shift = 0,
++		.parent_map = gcc_pxo_pll8_pll0_pll14_pll18_pll11_map,
++	},
++	.p[0] = {
++		.pre_div_shift = 3,
++		.pre_div_width = 4,
++	},
++	.p[1] = {
++		.pre_div_shift = 3,
++		.pre_div_width = 4,
++	},
++	.mux_sel_bit = 0,
++	.freq_tbl = clk_tbl_ce5_a_clk,
++	.clkr = {
++		.enable_reg = 0x3d80,
++		.enable_mask = BIT(1),
++		.hw.init = &(struct clk_init_data){
++			.name = "ce5_a_clk_src",
++			.parent_data = gcc_pxo_pll8_pll0_pll14_pll18_pll11,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8_pll0_pll14_pll18_pll11),
++			.ops = &clk_dyn_rcg_ops,
++		},
++	},
++};
++
++static struct clk_branch ce5_a_clk = {
++	.halt_reg = 0x3c20,
++	.halt_bit = 12,
++	.hwcg_reg = 0x3d8c,
++	.hwcg_bit = 6,
++	.clkr = {
++		.enable_reg = 0x3d8c,
++		.enable_mask = BIT(4),
++		.hw.init = &(struct clk_init_data){
++			.name = "ce5_a_clk",
++			.parent_hws = (const struct clk_hw*[]){
++				&ce5_a_clk_src.clkr.hw,
++			},
++			.num_parents = 1,
++			.ops = &clk_branch_ops,
++			.flags = CLK_SET_RATE_PARENT,
++		},
++	},
++};
++
++static const struct freq_tbl clk_tbl_ce5_h_clk[] = {
++	{ 160000000, P_PLL0, 5, 1, 1 },
++	{ 213200000, P_PLL11, 5, 1, 1 },
++	{ }
++};
++
++static struct clk_dyn_rcg ce5_h_clk_src = {
++	.ns_reg[0] = 0x3c64,
++	.ns_reg[1] = 0x3c68,
++	.bank_reg = 0x3c60,
++	.s[0] = {
++		.src_sel_shift = 0,
++		.parent_map = gcc_pxo_pll8_pll0_pll14_pll18_pll11_map,
++	},
++	.s[1] = {
++		.src_sel_shift = 0,
++		.parent_map = gcc_pxo_pll8_pll0_pll14_pll18_pll11_map,
++	},
++	.p[0] = {
++		.pre_div_shift = 3,
++		.pre_div_width = 4,
++	},
++	.p[1] = {
++		.pre_div_shift = 3,
++		.pre_div_width = 4,
++	},
++	.mux_sel_bit = 0,
++	.freq_tbl = clk_tbl_ce5_h_clk,
++	.clkr = {
++		.enable_reg = 0x3c60,
++		.enable_mask = BIT(1),
++		.hw.init = &(struct clk_init_data){
++			.name = "ce5_h_clk_src",
++			.parent_data = gcc_pxo_pll8_pll0_pll14_pll18_pll11,
++			.num_parents = ARRAY_SIZE(gcc_pxo_pll8_pll0_pll14_pll18_pll11),
++			.ops = &clk_dyn_rcg_ops,
++		},
++	},
++};
++
++static struct clk_branch ce5_h_clk = {
++	.halt_reg = 0x3c20,
++	.halt_bit = 11,
++	.hwcg_reg = 0x3c6c,
++	.hwcg_bit = 6,
++	.clkr = {
++		.enable_reg = 0x3c6c,
++		.enable_mask = BIT(4),
++		.hw.init = &(struct clk_init_data){
++			.name = "ce5_h_clk",
++			.parent_hws = (const struct clk_hw*[]){
++				&ce5_h_clk_src.clkr.hw,
++			},
++			.num_parents = 1,
++			.ops = &clk_branch_ops,
++			.flags = CLK_SET_RATE_PARENT,
++		},
++	},
++};
++
+ static struct clk_regmap *gcc_ipq806x_clks[] = {
+ 	[PLL0] = &pll0.clkr,
+ 	[PLL0_VOTE] = &pll0_vote,
+@@ -2831,6 +3068,7 @@ static struct clk_regmap *gcc_ipq806x_cl
+ 	[PLL4_VOTE] = &pll4_vote,
+ 	[PLL8] = &pll8.clkr,
+ 	[PLL8_VOTE] = &pll8_vote,
++	[PLL11] = &pll11.clkr,
+ 	[PLL14] = &pll14.clkr,
+ 	[PLL14_VOTE] = &pll14_vote,
+ 	[PLL18] = &pll18.clkr,
+@@ -2945,6 +3183,12 @@ static struct clk_regmap *gcc_ipq806x_cl
+ 	[PLL9] = &hfpll0.clkr,
+ 	[PLL10] = &hfpll1.clkr,
+ 	[PLL12] = &hfpll_l2.clkr,
++	[CE5_A_CLK_SRC] = &ce5_a_clk_src.clkr,
++	[CE5_A_CLK] = &ce5_a_clk.clkr,
++	[CE5_H_CLK_SRC] = &ce5_h_clk_src.clkr,
++	[CE5_H_CLK] = &ce5_h_clk.clkr,
++	[CE5_CORE_CLK_SRC] = &ce5_core_src.clkr,
++	[CE5_CORE_CLK] = &ce5_core_clk.clkr,
+ };
+ 
+ static const struct qcom_reset_map gcc_ipq806x_resets[] = {
diff --git a/target/linux/ipq806x/patches-5.15/100-v5.18-13-linux-next-dt-bindings-reset-add-ipq8064-ce5-resets.patch b/target/linux/ipq806x/patches-5.15/100-v5.18-13-linux-next-dt-bindings-reset-add-ipq8064-ce5-resets.patch
new file mode 100644
index 00000000000000..5d05c2b3af30ed
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/100-v5.18-13-linux-next-dt-bindings-reset-add-ipq8064-ce5-resets.patch
@@ -0,0 +1,29 @@
+From f4a7e56f4956f0450b9f671ed93d45ffcc15aa62 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Tue, 18 Jan 2022 01:22:05 +0100
+Subject: [PATCH v6 13/15] dt-bindings: reset: add ipq8064 ce5 resets
+
+Add ipq8064 ce5 resets needed for CryptoEngine gcc driver.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Acked-by: Philipp Zabel <p.zabel@pengutronix.de>
+Acked-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+---
+ include/dt-bindings/reset/qcom,gcc-ipq806x.h | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/include/dt-bindings/reset/qcom,gcc-ipq806x.h
++++ b/include/dt-bindings/reset/qcom,gcc-ipq806x.h
+@@ -163,5 +163,10 @@
+ #define NSS_CAL_PRBS_RST_N_RESET			154
+ #define NSS_LCKDT_RST_N_RESET				155
+ #define NSS_SRDS_N_RESET				156
++#define CRYPTO_ENG1_RESET				157
++#define CRYPTO_ENG2_RESET				158
++#define CRYPTO_ENG3_RESET				159
++#define CRYPTO_ENG4_RESET				160
++#define CRYPTO_AHB_RESET				161
+ 
+ #endif
diff --git a/target/linux/ipq806x/patches-5.15/100-v5.18-14-linux-next-clk-qcom-gcc-ipq806x-add-CryptoEngine-resets.patch b/target/linux/ipq806x/patches-5.15/100-v5.18-14-linux-next-clk-qcom-gcc-ipq806x-add-CryptoEngine-resets.patch
new file mode 100644
index 00000000000000..a26f67e36e0482
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/100-v5.18-14-linux-next-clk-qcom-gcc-ipq806x-add-CryptoEngine-resets.patch
@@ -0,0 +1,30 @@
+From 4f865bdcb44fb18951de94be5c2ec37a891a8d03 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sat, 26 Feb 2022 14:52:34 +0100
+Subject: [PATCH 14/14] clk: qcom: gcc-ipq806x: add CryptoEngine resets
+
+Add missing CryptoEngine resets.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220226135235.10051-15-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/gcc-ipq806x.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/clk/qcom/gcc-ipq806x.c
++++ b/drivers/clk/qcom/gcc-ipq806x.c
+@@ -3320,6 +3320,11 @@ static const struct qcom_reset_map gcc_i
+ 	[GMAC_CORE3_RESET] = { 0x3cfc, 0 },
+ 	[GMAC_CORE4_RESET] = { 0x3d1c, 0 },
+ 	[GMAC_AHB_RESET] = { 0x3e24, 0 },
++	[CRYPTO_ENG1_RESET] = { 0x3e00, 0},
++	[CRYPTO_ENG2_RESET] = { 0x3e04, 0},
++	[CRYPTO_ENG3_RESET] = { 0x3e08, 0},
++	[CRYPTO_ENG4_RESET] = { 0x3e0c, 0},
++	[CRYPTO_AHB_RESET] = { 0x3e10, 0},
+ 	[NSS_CH0_RST_RX_CLK_N_RESET] = { 0x3b60, 0 },
+ 	[NSS_CH0_RST_TX_CLK_N_RESET] = { 0x3b60, 1 },
+ 	[NSS_CH0_RST_RX_125M_N_RESET] = { 0x3b60, 2 },
diff --git a/target/linux/ipq806x/patches-5.15/101-v6.0-01-net-ethernet-stmmac-add-missing-sgmii-configure-for-.patch b/target/linux/ipq806x/patches-5.15/101-v6.0-01-net-ethernet-stmmac-add-missing-sgmii-configure-for-.patch
new file mode 100644
index 00000000000000..bd492ca1ecdff8
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/101-v6.0-01-net-ethernet-stmmac-add-missing-sgmii-configure-for-.patch
@@ -0,0 +1,151 @@
+From 9ec092d2feb69045dd289845024301fb91c064ee Mon Sep 17 00:00:00 2001
+From: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
+Date: Tue, 14 Jun 2022 13:22:27 +0200
+Subject: [PATCH 1/2] net: ethernet: stmmac: add missing sgmii configure for
+ ipq806x
+
+The different gmacid require different configuration based on the soc
+and on the gmac id. Add these missing configuration taken from the
+original driver.
+
+Signed-off-by: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
+Link: https://lore.kernel.org/r/20220614112228.1998-1-ansuelsmth@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/stmicro/stmmac/Kconfig   |  1 +
+ .../ethernet/stmicro/stmmac/dwmac-ipq806x.c   | 93 +++++++++++++++----
+ 2 files changed, 78 insertions(+), 16 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig
++++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig
+@@ -83,6 +83,7 @@ config DWMAC_IPQ806X
+ 	default ARCH_QCOM
+ 	depends on OF && (ARCH_QCOM || COMPILE_TEST)
+ 	select MFD_SYSCON
++	select QCOM_SOCINFO
+ 	help
+ 	  Support for QCA IPQ806X DWMAC Ethernet.
+ 
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+@@ -27,6 +27,8 @@
+ #include <linux/stmmac.h>
+ #include <linux/of_mdio.h>
+ #include <linux/module.h>
++#include <linux/sys_soc.h>
++#include <linux/bitfield.h>
+ 
+ #include "stmmac_platform.h"
+ 
+@@ -75,11 +77,20 @@
+ #define QSGMII_PHY_RX_SIGNAL_DETECT_EN		BIT(2)
+ #define QSGMII_PHY_TX_DRIVER_EN			BIT(3)
+ #define QSGMII_PHY_QSGMII_EN			BIT(7)
+-#define QSGMII_PHY_PHASE_LOOP_GAIN_OFFSET	12
+-#define QSGMII_PHY_RX_DC_BIAS_OFFSET		18
+-#define QSGMII_PHY_RX_INPUT_EQU_OFFSET		20
+-#define QSGMII_PHY_CDR_PI_SLEW_OFFSET		22
+-#define QSGMII_PHY_TX_DRV_AMP_OFFSET		28
++#define QSGMII_PHY_DEEMPHASIS_LVL_MASK		GENMASK(11, 10)
++#define QSGMII_PHY_DEEMPHASIS_LVL(x)		FIELD_PREP(QSGMII_PHY_DEEMPHASIS_LVL_MASK, (x))
++#define QSGMII_PHY_PHASE_LOOP_GAIN_MASK		GENMASK(14, 12)
++#define QSGMII_PHY_PHASE_LOOP_GAIN(x)		FIELD_PREP(QSGMII_PHY_PHASE_LOOP_GAIN_MASK, (x))
++#define QSGMII_PHY_RX_DC_BIAS_MASK		GENMASK(19, 18)
++#define QSGMII_PHY_RX_DC_BIAS(x)		FIELD_PREP(QSGMII_PHY_RX_DC_BIAS_MASK, (x))
++#define QSGMII_PHY_RX_INPUT_EQU_MASK		GENMASK(21, 20)
++#define QSGMII_PHY_RX_INPUT_EQU(x)		FIELD_PREP(QSGMII_PHY_RX_INPUT_EQU_MASK, (x))
++#define QSGMII_PHY_CDR_PI_SLEW_MASK		GENMASK(23, 22)
++#define QSGMII_PHY_CDR_PI_SLEW(x)		FIELD_PREP(QSGMII_PHY_CDR_PI_SLEW_MASK, (x))
++#define QSGMII_PHY_TX_SLEW_MASK			GENMASK(27, 26)
++#define QSGMII_PHY_TX_SLEW(x)			FIELD_PREP(QSGMII_PHY_TX_SLEW_MASK, (x))
++#define QSGMII_PHY_TX_DRV_AMP_MASK		GENMASK(31, 28)
++#define QSGMII_PHY_TX_DRV_AMP(x)		FIELD_PREP(QSGMII_PHY_TX_DRV_AMP_MASK, (x))
+ 
+ struct ipq806x_gmac {
+ 	struct platform_device *pdev;
+@@ -242,6 +253,64 @@ static void ipq806x_gmac_fix_mac_speed(v
+ 	ipq806x_gmac_set_speed(gmac, speed);
+ }
+ 
++static const struct soc_device_attribute ipq806x_gmac_soc_v1[] = {
++	{
++		.revision = "1.*",
++	},
++	{
++		/* sentinel */
++	}
++};
++
++static int
++ipq806x_gmac_configure_qsgmii_params(struct ipq806x_gmac *gmac)
++{
++	struct platform_device *pdev = gmac->pdev;
++	const struct soc_device_attribute *soc;
++	struct device *dev = &pdev->dev;
++	u32 qsgmii_param;
++
++	switch (gmac->id) {
++	case 1:
++		soc = soc_device_match(ipq806x_gmac_soc_v1);
++
++		if (soc)
++			qsgmii_param = QSGMII_PHY_TX_DRV_AMP(0xc) |
++				       QSGMII_PHY_TX_SLEW(0x2) |
++				       QSGMII_PHY_DEEMPHASIS_LVL(0x2);
++		else
++			qsgmii_param = QSGMII_PHY_TX_DRV_AMP(0xd) |
++				       QSGMII_PHY_TX_SLEW(0x0) |
++				       QSGMII_PHY_DEEMPHASIS_LVL(0x0);
++
++		qsgmii_param |= QSGMII_PHY_RX_DC_BIAS(0x2);
++		break;
++	case 2:
++	case 3:
++		qsgmii_param = QSGMII_PHY_RX_DC_BIAS(0x3) |
++			       QSGMII_PHY_TX_DRV_AMP(0xc);
++		break;
++	default: /* gmac 0 can't be set in SGMII mode */
++		dev_err(dev, "gmac id %d can't be in SGMII mode", gmac->id);
++		return -EINVAL;
++	}
++
++	/* Common params across all gmac id */
++	qsgmii_param |= QSGMII_PHY_CDR_EN |
++			QSGMII_PHY_RX_FRONT_EN |
++			QSGMII_PHY_RX_SIGNAL_DETECT_EN |
++			QSGMII_PHY_TX_DRIVER_EN |
++			QSGMII_PHY_QSGMII_EN |
++			QSGMII_PHY_PHASE_LOOP_GAIN(0x4) |
++			QSGMII_PHY_RX_INPUT_EQU(0x1) |
++			QSGMII_PHY_CDR_PI_SLEW(0x2);
++
++	regmap_write(gmac->qsgmii_csr, QSGMII_PHY_SGMII_CTL(gmac->id),
++		     qsgmii_param);
++
++	return 0;
++}
++
+ static int ipq806x_gmac_probe(struct platform_device *pdev)
+ {
+ 	struct plat_stmmacenet_data *plat_dat;
+@@ -328,17 +397,9 @@ static int ipq806x_gmac_probe(struct pla
+ 	regmap_write(gmac->nss_common, NSS_COMMON_CLK_GATE, val);
+ 
+ 	if (gmac->phy_mode == PHY_INTERFACE_MODE_SGMII) {
+-		regmap_write(gmac->qsgmii_csr, QSGMII_PHY_SGMII_CTL(gmac->id),
+-			     QSGMII_PHY_CDR_EN |
+-			     QSGMII_PHY_RX_FRONT_EN |
+-			     QSGMII_PHY_RX_SIGNAL_DETECT_EN |
+-			     QSGMII_PHY_TX_DRIVER_EN |
+-			     QSGMII_PHY_QSGMII_EN |
+-			     0x4ul << QSGMII_PHY_PHASE_LOOP_GAIN_OFFSET |
+-			     0x3ul << QSGMII_PHY_RX_DC_BIAS_OFFSET |
+-			     0x1ul << QSGMII_PHY_RX_INPUT_EQU_OFFSET |
+-			     0x2ul << QSGMII_PHY_CDR_PI_SLEW_OFFSET |
+-			     0xCul << QSGMII_PHY_TX_DRV_AMP_OFFSET);
++		err = ipq806x_gmac_configure_qsgmii_params(gmac);
++		if (err)
++			goto err_remove_config_dt;
+ 	}
+ 
+ 	plat_dat->has_gmac = true;
diff --git a/target/linux/ipq806x/patches-5.15/101-v6.0-02-net-ethernet-stmmac-reset-force-speed-bit-for-ipq806.patch b/target/linux/ipq806x/patches-5.15/101-v6.0-02-net-ethernet-stmmac-reset-force-speed-bit-for-ipq806.patch
new file mode 100644
index 00000000000000..d444553452ce95
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/101-v6.0-02-net-ethernet-stmmac-reset-force-speed-bit-for-ipq806.patch
@@ -0,0 +1,110 @@
+From 8bca458990dd8c6d001b2fb52063aa18e8ca7444 Mon Sep 17 00:00:00 2001
+From: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
+Date: Tue, 14 Jun 2022 13:22:28 +0200
+Subject: [PATCH 2/2] net: ethernet: stmmac: reset force speed bit for ipq806x
+
+Some bootloader may set the force speed regs even if the actual
+interface should use autonegotiation between PCS and PHY.
+This cause the complete malfuction of the interface.
+
+To fix this correctly reset the force speed regs if a fixed-link is not
+defined in the DTS. With a fixed-link node correctly configure the
+forced speed regs to handle any misconfiguration by the bootloader.
+
+Reported-by: Mark Mentovai <mark@moxienet.com>
+Co-developed-by: Mark Mentovai <mark@moxienet.com>
+Signed-off-by: Mark Mentovai <mark@moxienet.com>
+Signed-off-by: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
+Link: https://lore.kernel.org/r/20220614112228.1998-2-ansuelsmth@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ .../ethernet/stmicro/stmmac/dwmac-ipq806x.c   | 64 +++++++++++++++++++
+ 1 file changed, 64 insertions(+)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+@@ -66,6 +66,17 @@
+ #define NSS_COMMON_CLK_DIV_SGMII_100		4
+ #define NSS_COMMON_CLK_DIV_SGMII_10		49
+ 
++#define QSGMII_PCS_ALL_CH_CTL			0x80
++#define QSGMII_PCS_CH_SPEED_FORCE		BIT(1)
++#define QSGMII_PCS_CH_SPEED_10			0x0
++#define QSGMII_PCS_CH_SPEED_100			BIT(2)
++#define QSGMII_PCS_CH_SPEED_1000		BIT(3)
++#define QSGMII_PCS_CH_SPEED_MASK		(QSGMII_PCS_CH_SPEED_FORCE | \
++						 QSGMII_PCS_CH_SPEED_10 | \
++						 QSGMII_PCS_CH_SPEED_100 | \
++						 QSGMII_PCS_CH_SPEED_1000)
++#define QSGMII_PCS_CH_SPEED_SHIFT(x)		((x) * 4)
++
+ #define QSGMII_PCS_CAL_LCKDT_CTL		0x120
+ #define QSGMII_PCS_CAL_LCKDT_CTL_RST		BIT(19)
+ 
+@@ -253,6 +264,55 @@ static void ipq806x_gmac_fix_mac_speed(v
+ 	ipq806x_gmac_set_speed(gmac, speed);
+ }
+ 
++static int
++ipq806x_gmac_configure_qsgmii_pcs_speed(struct ipq806x_gmac *gmac)
++{
++	struct platform_device *pdev = gmac->pdev;
++	struct device *dev = &pdev->dev;
++	struct device_node *dn;
++	int link_speed;
++	int val = 0;
++	int ret;
++
++	/* Some bootloader may apply wrong configuration and cause
++	 * not functioning port. If fixed link is not set,
++	 * reset the force speed bit.
++	 */
++	if (!of_phy_is_fixed_link(pdev->dev.of_node))
++		goto write;
++
++	dn = of_get_child_by_name(pdev->dev.of_node, "fixed-link");
++	ret = of_property_read_u32(dn, "speed", &link_speed);
++	of_node_put(dn);
++	if (ret) {
++		dev_err(dev, "found fixed-link node with no speed");
++		return ret;
++	}
++
++	val = QSGMII_PCS_CH_SPEED_FORCE;
++
++	switch (link_speed) {
++	case SPEED_1000:
++		val |= QSGMII_PCS_CH_SPEED_1000;
++		break;
++	case SPEED_100:
++		val |= QSGMII_PCS_CH_SPEED_100;
++		break;
++	case SPEED_10:
++		val |= QSGMII_PCS_CH_SPEED_10;
++		break;
++	}
++
++write:
++	regmap_update_bits(gmac->qsgmii_csr, QSGMII_PCS_ALL_CH_CTL,
++			   QSGMII_PCS_CH_SPEED_MASK <<
++			   QSGMII_PCS_CH_SPEED_SHIFT(gmac->id),
++			   val <<
++			   QSGMII_PCS_CH_SPEED_SHIFT(gmac->id));
++
++	return 0;
++}
++
+ static const struct soc_device_attribute ipq806x_gmac_soc_v1[] = {
+ 	{
+ 		.revision = "1.*",
+@@ -400,6 +460,10 @@ static int ipq806x_gmac_probe(struct pla
+ 		err = ipq806x_gmac_configure_qsgmii_params(gmac);
+ 		if (err)
+ 			goto err_remove_config_dt;
++
++		err = ipq806x_gmac_configure_qsgmii_pcs_speed(gmac);
++		if (err)
++			goto err_remove_config_dt;
+ 	}
+ 
+ 	plat_dat->has_gmac = true;
diff --git a/target/linux/ipq806x/patches-5.15/103-v5.19-ARM-dts-qcom-add-syscon-and-cxo-pxo-clock-to-gcc-nod.patch b/target/linux/ipq806x/patches-5.15/103-v5.19-ARM-dts-qcom-add-syscon-and-cxo-pxo-clock-to-gcc-nod.patch
new file mode 100644
index 00000000000000..2ce526b6ca7650
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/103-v5.19-ARM-dts-qcom-add-syscon-and-cxo-pxo-clock-to-gcc-nod.patch
@@ -0,0 +1,48 @@
+From a5ba119455c77a07e05f2fe0af446c8bf43d1a00 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sat, 26 Feb 2022 14:52:35 +0100
+Subject: [PATCH] ARM: dts: qcom: add syscon and cxo/pxo clock to gcc node for
+ ipq8064
+
+Add syscon compatible required for tsens driver to correctly probe driver
+and access the reg. Also add cxo and pxo tag and declare them as gcc clock
+now requires them for the ipq8064 gcc driver that has now been modernized.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220226135235.10051-16-ansuelsmth@gmail.com
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -298,13 +298,13 @@
+ 	};
+ 
+ 	clocks {
+-		cxo_board {
++		cxo_board: cxo_board {
+ 			compatible = "fixed-clock";
+ 			#clock-cells = <0>;
+ 			clock-frequency = <25000000>;
+ 		};
+ 
+-		pxo_board {
++		pxo_board: pxo_board {
+ 			compatible = "fixed-clock";
+ 			#clock-cells = <0>;
+ 			clock-frequency = <25000000>;
+@@ -736,7 +736,9 @@
+ 		};
+ 
+ 		gcc: clock-controller@900000 {
+-			compatible = "qcom,gcc-ipq8064";
++			compatible = "qcom,gcc-ipq8064", "syscon";
++			clocks = <&pxo_board>, <&cxo_board>;
++			clock-names = "pxo", "cxo";
+ 			reg = <0x00900000 0x4000>;
+ 			#clock-cells = <1>;
+ 			#reset-cells = <1>;
diff --git a/target/linux/ipq806x/patches-5.15/103-v6.0-01-ARM-dts-qcom-replace-gcc-PXO-with-pxo_board-fixed-cl.patch b/target/linux/ipq806x/patches-5.15/103-v6.0-01-ARM-dts-qcom-replace-gcc-PXO-with-pxo_board-fixed-cl.patch
new file mode 100644
index 00000000000000..d0bc34c07fa9f8
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/103-v6.0-01-ARM-dts-qcom-replace-gcc-PXO-with-pxo_board-fixed-cl.patch
@@ -0,0 +1,29 @@
+From eb9e93937756a05787977875830c0dc482cb57e0 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sat, 30 Apr 2022 07:51:17 +0200
+Subject: [PATCH] ARM: dts: qcom: replace gcc PXO with pxo_board fixed clock
+
+Replace gcc PXO phandle to pxo_board fixed clock declared in the dts.
+gcc driver doesn't provide PXO_SRC as it's a fixed-clock. This cause a
+kernel panic if any driver actually try to use it.
+
+Fixes: 40cf5c884a96 ("ARM: dts: qcom: add L2CC and RPM for IPQ8064")
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220430055118.1947-2-ansuelsmth@gmail.com
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -784,7 +784,7 @@
+ 		l2cc: clock-controller@2011000 {
+ 			compatible = "qcom,kpss-gcc", "syscon";
+ 			reg = <0x2011000 0x1000>;
+-			clocks = <&gcc PLL8_VOTE>, <&gcc PXO_SRC>;
++			clocks = <&gcc PLL8_VOTE>, <&pxo_board>;
+ 			clock-names = "pll8_vote", "pxo";
+ 			clock-output-names = "acpu_l2_aux";
+ 		};
diff --git a/target/linux/ipq806x/patches-5.15/104-v6.0-01-ARM-dts-qcom-ipq8064-add-multiple-missing-pin-defini.patch b/target/linux/ipq806x/patches-5.15/104-v6.0-01-ARM-dts-qcom-ipq8064-add-multiple-missing-pin-defini.patch
new file mode 100644
index 00000000000000..5dad164e3c280f
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/104-v6.0-01-ARM-dts-qcom-ipq8064-add-multiple-missing-pin-defini.patch
@@ -0,0 +1,101 @@
+From 4af1defb305798d1a064a5ea0d0c9b30e5eee185 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 7 Jul 2022 03:09:35 +0200
+Subject: [PATCH 1/8] ARM: dts: qcom: ipq8064: add multiple missing pin
+ definition
+
+Add missing definition for mdio0 pins used for gpio-bitbang driver,i2c4
+pins and rgmii2 pins for ipq8064.
+
+Drop i2c4_pins node from ipq8064-ap148 dts as it's now moved to ipq8064
+dtsi.
+
+Drop mdio0_pins node from ipq8064-rb3011 dts as it's now moved to
+ipq8064 dtsi.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220707010943.20857-2-ansuelsmth@gmail.com
+---
+ arch/arm/boot/dts/qcom-ipq8064-ap148.dts  |  6 -----
+ arch/arm/boot/dts/qcom-ipq8064-rb3011.dts |  9 -------
+ arch/arm/boot/dts/qcom-ipq8064.dtsi       | 32 +++++++++++++++++++++++
+ 3 files changed, 32 insertions(+), 15 deletions(-)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064-rb3011.dts
++++ b/arch/arm/boot/dts/qcom-ipq8064-rb3011.dts
+@@ -305,15 +305,6 @@
+ 		};
+ 	};
+ 
+-	mdio0_pins: mdio0_pins {
+-		mux {
+-			pins = "gpio0", "gpio1";
+-			function = "gpio";
+-			drive-strength = <8>;
+-			bias-disable;
+-		};
+-	};
+-
+ 	mdio1_pins: mdio1_pins {
+ 		mux {
+ 			pins = "gpio10", "gpio11";
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -382,6 +382,13 @@
+ 				};
+ 			};
+ 
++			i2c4_pins: i2c4-default {
++				pins = "gpio12", "gpio13";
++				function = "gsbi4";
++				drive-strength = <12>;
++				bias-disable;
++			};
++
+ 			spi_pins: spi_pins {
+ 				mux {
+ 					pins = "gpio18", "gpio19", "gpio21";
+@@ -424,6 +431,8 @@
+ 
+ 				pullups {
+ 					pins = "gpio39";
++					function = "nand";
++					drive-strength = <10>;
+ 					bias-pull-up;
+ 				};
+ 
+@@ -431,9 +440,32 @@
+ 					pins = "gpio40", "gpio41", "gpio42",
+ 					       "gpio43", "gpio44", "gpio45",
+ 					       "gpio46", "gpio47";
++					function = "nand";
++					drive-strength = <10>;
+ 					bias-bus-hold;
+ 				};
+ 			};
++
++			mdio0_pins: mdio0-pins {
++				mux {
++					pins = "gpio0", "gpio1";
++					function = "mdio";
++					drive-strength = <8>;
++					bias-disable;
++				};
++			};
++
++			rgmii2_pins: rgmii2-pins {
++				mux {
++					pins = "gpio27", "gpio28", "gpio29",
++					       "gpio30", "gpio31", "gpio32",
++					       "gpio51", "gpio52", "gpio59",
++					       "gpio60", "gpio61", "gpio62";
++					function = "rgmii2";
++					drive-strength = <8>;
++					bias-disable;
++				};
++			};
+ 		};
+ 
+ 		intc: interrupt-controller@2000000 {
diff --git a/target/linux/ipq806x/patches-5.15/104-v6.0-02-ARM-dts-qcom-ipq8064-add-gsbi6-missing-definition.patch b/target/linux/ipq806x/patches-5.15/104-v6.0-02-ARM-dts-qcom-ipq8064-add-gsbi6-missing-definition.patch
new file mode 100644
index 00000000000000..1f4e288fb81e84
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/104-v6.0-02-ARM-dts-qcom-ipq8064-add-gsbi6-missing-definition.patch
@@ -0,0 +1,67 @@
+From d883a12a547b6d42e795ff3b5ac87cfd013b5423 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 7 Jul 2022 03:09:36 +0200
+Subject: [PATCH 2/8] ARM: dts: qcom: ipq8064: add gsbi6 missing definition
+
+Add gsbi6 missing definition for ipq8064.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220707010943.20857-3-ansuelsmth@gmail.com
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 43 +++++++++++++++++++++++++++++
+ 1 file changed, 43 insertions(+)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -663,6 +663,49 @@
+ 			};
+ 		};
+ 
++		gsbi6: gsbi@16500000 {
++			compatible = "qcom,gsbi-v1.0.0";
++			reg = <0x16500000 0x100>;
++			cell-index = <6>;
++			clocks = <&gcc GSBI6_H_CLK>;
++			clock-names = "iface";
++			#address-cells = <1>;
++			#size-cells = <1>;
++			ranges;
++
++			syscon-tcsr = <&tcsr>;
++
++			status = "disabled";
++
++			gsbi6_i2c: i2c@16580000 {
++				compatible = "qcom,i2c-qup-v1.1.1";
++				reg = <0x16580000 0x1000>;
++				interrupts = <GIC_SPI 157 IRQ_TYPE_LEVEL_HIGH>;
++
++				clocks = <&gcc GSBI6_QUP_CLK>, <&gcc GSBI6_H_CLK>;
++				clock-names = "core", "iface";
++
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				status = "disabled";
++			};
++
++			gsbi6_spi: spi@16580000 {
++				compatible = "qcom,spi-qup-v1.1.1";
++				reg = <0x16580000 0x1000>;
++				interrupts = <GIC_SPI 157 IRQ_TYPE_LEVEL_HIGH>;
++
++				clocks = <&gcc GSBI6_QUP_CLK>, <&gcc GSBI6_H_CLK>;
++				clock-names = "core", "iface";
++
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				status = "disabled";
++			};
++		};
++
+ 		gsbi7: gsbi@16600000 {
+ 			status = "disabled";
+ 			compatible = "qcom,gsbi-v1.0.0";
diff --git a/target/linux/ipq806x/patches-5.15/104-v6.0-03-ARM-dts-qcom-ipq8064-add-specific-dtsi-with-smb208-r.patch b/target/linux/ipq806x/patches-5.15/104-v6.0-03-ARM-dts-qcom-ipq8064-add-specific-dtsi-with-smb208-r.patch
new file mode 100644
index 00000000000000..dbba722caafb06
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/104-v6.0-03-ARM-dts-qcom-ipq8064-add-specific-dtsi-with-smb208-r.patch
@@ -0,0 +1,66 @@
+From 5c47a46d5e942ea6b041c8b7727b201817c1ff76 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 7 Jul 2022 03:09:37 +0200
+Subject: [PATCH 3/8] ARM: dts: qcom: ipq8064: add specific dtsi with smb208
+ rpm regulators
+
+Add specific ipq8064 dtsi with smb208 rpm regulators.
+
+Qcom advise to use this configuration but it's not mandatory and OEM
+can decide to implement their own regulators.
+smb208 regulators are used to scale CPU voltage, L2 cache voltage and
+Ubi32 cores.
+
+There regulators are controlled by rpm and to correctly works gsbi4-i2c
+require to be NEVER disabled or rpm will reject any regulator change
+request.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220707010943.20857-4-ansuelsmth@gmail.com
+---
+ arch/arm/boot/dts/qcom-ipq8064-smb208.dtsi | 37 ++++++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+ create mode 100644 arch/arm/boot/dts/qcom-ipq8064-smb208.dtsi
+
+--- /dev/null
++++ b/arch/arm/boot/dts/qcom-ipq8064-smb208.dtsi
+@@ -0,0 +1,37 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include "qcom-ipq8064.dtsi"
++
++&rpm {
++	smb208_regulators: regulators {
++		compatible = "qcom,rpm-smb208-regulators";
++
++		smb208_s1a: s1a {
++			regulator-min-microvolt = <1050000>;
++			regulator-max-microvolt = <1150000>;
++
++			qcom,switch-mode-frequency = <1200000>;
++		};
++
++		smb208_s1b: s1b {
++			regulator-min-microvolt = <1050000>;
++			regulator-max-microvolt = <1150000>;
++
++			qcom,switch-mode-frequency = <1200000>;
++		};
++
++		smb208_s2a: s2a {
++			regulator-min-microvolt = < 800000>;
++			regulator-max-microvolt = <1250000>;
++
++			qcom,switch-mode-frequency = <1200000>;
++		};
++
++		smb208_s2b: s2b {
++			regulator-min-microvolt = < 800000>;
++			regulator-max-microvolt = <1250000>;
++
++			qcom,switch-mode-frequency = <1200000>;
++		};
++	};
++};
diff --git a/target/linux/ipq806x/patches-5.15/104-v6.0-04-ARM-dts-qcom-ipq8064-add-missing-snps-dwmac-compatib.patch b/target/linux/ipq806x/patches-5.15/104-v6.0-04-ARM-dts-qcom-ipq8064-add-missing-snps-dwmac-compatib.patch
new file mode 100644
index 00000000000000..1a3185f500d648
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/104-v6.0-04-ARM-dts-qcom-ipq8064-add-missing-snps-dwmac-compatib.patch
@@ -0,0 +1,56 @@
+From 0ce34e0c13e99c239cce6099f64b0e95697f36b1 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 7 Jul 2022 03:09:38 +0200
+Subject: [PATCH 4/8] ARM: dts: qcom: ipq8064: add missing snps,dwmac
+ compatible for gmac
+
+Add missing snps,dwmac compatible for gmac ipq8064 dtsi.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220707010943.20857-5-ansuelsmth@gmail.com
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -1042,7 +1042,7 @@
+ 
+ 		gmac0: ethernet@37000000 {
+ 			device_type = "network";
+-			compatible = "qcom,ipq806x-gmac";
++			compatible = "qcom,ipq806x-gmac", "snps,dwmac";
+ 			reg = <0x37000000 0x200000>;
+ 			interrupts = <GIC_SPI 220 IRQ_TYPE_LEVEL_HIGH>;
+ 			interrupt-names = "macirq";
+@@ -1066,7 +1066,7 @@
+ 
+ 		gmac1: ethernet@37200000 {
+ 			device_type = "network";
+-			compatible = "qcom,ipq806x-gmac";
++			compatible = "qcom,ipq806x-gmac", "snps,dwmac";
+ 			reg = <0x37200000 0x200000>;
+ 			interrupts = <GIC_SPI 223 IRQ_TYPE_LEVEL_HIGH>;
+ 			interrupt-names = "macirq";
+@@ -1090,7 +1090,7 @@
+ 
+ 		gmac2: ethernet@37400000 {
+ 			device_type = "network";
+-			compatible = "qcom,ipq806x-gmac";
++			compatible = "qcom,ipq806x-gmac", "snps,dwmac";
+ 			reg = <0x37400000 0x200000>;
+ 			interrupts = <GIC_SPI 226 IRQ_TYPE_LEVEL_HIGH>;
+ 			interrupt-names = "macirq";
+@@ -1114,7 +1114,7 @@
+ 
+ 		gmac3: ethernet@37600000 {
+ 			device_type = "network";
+-			compatible = "qcom,ipq806x-gmac";
++			compatible = "qcom,ipq806x-gmac", "snps,dwmac";
+ 			reg = <0x37600000 0x200000>;
+ 			interrupts = <GIC_SPI 229 IRQ_TYPE_LEVEL_HIGH>;
+ 			interrupt-names = "macirq";
diff --git a/target/linux/ipq806x/patches-5.15/104-v6.0-05-ARM-dts-qcom-ipq8064-disable-usb-phy-by-default.patch b/target/linux/ipq806x/patches-5.15/104-v6.0-05-ARM-dts-qcom-ipq8064-disable-usb-phy-by-default.patch
new file mode 100644
index 00000000000000..43dac4b7fa2171
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/104-v6.0-05-ARM-dts-qcom-ipq8064-disable-usb-phy-by-default.patch
@@ -0,0 +1,37 @@
+From d63d3124c0a5cdbe8b91d81b922fe56b2462e1b9 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 7 Jul 2022 03:09:39 +0200
+Subject: [PATCH 5/8] ARM: dts: qcom: ipq8064: disable usb phy by default
+
+Disable usb phy by default. When the usb phy were pushed, half of them
+were flagged as disabled by mistake.
+Correctly disable all usb phy and enable them only if a device actually
+use them.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220707010943.20857-6-ansuelsmth@gmail.com
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -1188,6 +1188,8 @@
+ 			clocks = <&gcc USB30_1_UTMI_CLK>;
+ 			clock-names = "ref";
+ 			#phy-cells = <0>;
++
++			status = "disabled";
+ 		};
+ 
+ 		ss_phy_1: phy@110f8830 {
+@@ -1196,6 +1198,8 @@
+ 			clocks = <&gcc USB30_1_MASTER_CLK>;
+ 			clock-names = "ref";
+ 			#phy-cells = <0>;
++
++			status = "disabled";
+ 		};
+ 
+ 		usb3_1: usb3@110f8800 {
diff --git a/target/linux/ipq806x/patches-5.15/104-v6.0-07-ARM-dts-qcom-ipq8064-fix-and-add-some-missing-gsbi-n.patch b/target/linux/ipq806x/patches-5.15/104-v6.0-07-ARM-dts-qcom-ipq8064-fix-and-add-some-missing-gsbi-n.patch
new file mode 100644
index 00000000000000..ca5e5aa3c4cd13
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/104-v6.0-07-ARM-dts-qcom-ipq8064-fix-and-add-some-missing-gsbi-n.patch
@@ -0,0 +1,94 @@
+From 6c421a9c08286389bb331fe783e2625c9efcc187 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 7 Jul 2022 03:09:41 +0200
+Subject: [PATCH 7/8] ARM: dts: qcom: ipq8064: fix and add some missing gsbi
+ node
+
+Add some tag for gsbi to make them usable for ipq8064 SoC. Add missing
+gsbi7 i2c node and gsbi1 node.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220707010943.20857-8-ansuelsmth@gmail.com
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 54 ++++++++++++++++++++++++++++-
+ 1 file changed, 53 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -539,6 +539,44 @@
+ 			regulator;
+ 		};
+ 
++		gsbi1: gsbi@12440000 {
++			compatible = "qcom,gsbi-v1.0.0";
++			reg = <0x12440000 0x100>;
++			cell-index = <1>;
++			clocks = <&gcc GSBI1_H_CLK>;
++			clock-names = "iface";
++			#address-cells = <1>;
++			#size-cells = <1>;
++			ranges;
++
++			syscon-tcsr = <&tcsr>;
++
++			status = "disabled";
++
++			gsbi1_serial: serial@12450000 {
++				compatible = "qcom,msm-uartdm-v1.3", "qcom,msm-uartdm";
++				reg = <0x12450000 0x100>,
++				      <0x12400000 0x03>;
++				interrupts = <GIC_SPI 193 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&gcc GSBI1_UART_CLK>, <&gcc GSBI1_H_CLK>;
++				clock-names = "core", "iface";
++
++				status = "disabled";
++			};
++
++			gsbi1_i2c: i2c@12460000 {
++				compatible = "qcom,i2c-qup-v1.1.1";
++				reg = <0x12460000 0x1000>;
++				interrupts = <GIC_SPI 194 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&gcc GSBI1_QUP_CLK>, <&gcc GSBI1_H_CLK>;
++				clock-names = "core", "iface";
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				status = "disabled";
++			};
++		};
++
+ 		gsbi2: gsbi@12480000 {
+ 			compatible = "qcom,gsbi-v1.0.0";
+ 			cell-index = <2>;
+@@ -562,7 +600,7 @@
+ 				status = "disabled";
+ 			};
+ 
+-			i2c@124a0000 {
++			gsbi2_i2c: i2c@124a0000 {
+ 				compatible = "qcom,i2c-qup-v1.1.1";
+ 				reg = <0x124a0000 0x1000>;
+ 				interrupts = <GIC_SPI 196 IRQ_TYPE_LEVEL_HIGH>;
+@@ -727,6 +765,20 @@
+ 				clock-names = "core", "iface";
+ 				status = "disabled";
+ 			};
++
++			gsbi7_i2c: i2c@16680000 {
++				compatible = "qcom,i2c-qup-v1.1.1";
++				reg = <0x16680000 0x1000>;
++				interrupts = <GIC_SPI 159 IRQ_TYPE_LEVEL_HIGH>;
++
++				clocks = <&gcc GSBI7_QUP_CLK>, <&gcc GSBI7_H_CLK>;
++				clock-names = "core", "iface";
++
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				status = "disabled";
++			};
+ 		};
+ 
+ 		rng@1a500000 {
diff --git a/target/linux/ipq806x/patches-5.15/104-v6.0-08-ARM-dts-qcom-ipq8064-add-speedbin-efuse-nvmem-node.patch b/target/linux/ipq806x/patches-5.15/104-v6.0-08-ARM-dts-qcom-ipq8064-add-speedbin-efuse-nvmem-node.patch
new file mode 100644
index 00000000000000..463c3d4a65828a
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/104-v6.0-08-ARM-dts-qcom-ipq8064-add-speedbin-efuse-nvmem-node.patch
@@ -0,0 +1,28 @@
+From 7f5aecdd4ffcc018f73171bc0e028cd4e3361acd Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 7 Jul 2022 03:09:43 +0200
+Subject: [PATCH 8/8] ARM: dts: qcom: ipq8064: add speedbin efuse nvmem node
+
+Add speedbin efuse nvmem cell needed for the opp table for the CPU
+freqs.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220707010943.20857-10-ansuelsmth@gmail.com
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -854,6 +854,9 @@
+ 			reg = <0x00700000 0x1000>;
+ 			#address-cells = <1>;
+ 			#size-cells = <1>;
++			speedbin_efuse: speedbin@c0 {
++				reg = <0xc0 0x4>;
++			};
+ 			tsens_calib: calib@400 {
+ 				reg = <0x400 0xb>;
+ 			};
diff --git a/target/linux/ipq806x/patches-5.15/105-v6.0-01-hwspinlock-qcom-Add-support-for-mmio-usage-to-sfpb-m.patch b/target/linux/ipq806x/patches-5.15/105-v6.0-01-hwspinlock-qcom-Add-support-for-mmio-usage-to-sfpb-m.patch
new file mode 100644
index 00000000000000..2c6f6b10c48e72
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/105-v6.0-01-hwspinlock-qcom-Add-support-for-mmio-usage-to-sfpb-m.patch
@@ -0,0 +1,71 @@
+From cdab30b44518513003607ecfc8a22de3dbbb78ed Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 7 Jul 2022 12:20:38 +0200
+Subject: [PATCH 1/1] hwspinlock: qcom: Add support for mmio usage to
+ sfpb-mutex
+
+Allow sfpb-mutex to use mmio in addition to syscon.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220707102040.1859-1-ansuelsmth@gmail.com
+---
+ drivers/hwspinlock/qcom_hwspinlock.c | 28 +++++++++++++++++++++++-----
+ 1 file changed, 23 insertions(+), 5 deletions(-)
+
+--- a/drivers/hwspinlock/qcom_hwspinlock.c
++++ b/drivers/hwspinlock/qcom_hwspinlock.c
+@@ -19,6 +19,11 @@
+ #define QCOM_MUTEX_APPS_PROC_ID	1
+ #define QCOM_MUTEX_NUM_LOCKS	32
+ 
++struct qcom_hwspinlock_of_data {
++	u32 offset;
++	u32 stride;
++};
++
+ static int qcom_hwspinlock_trylock(struct hwspinlock *lock)
+ {
+ 	struct regmap_field *field = lock->priv;
+@@ -63,9 +68,20 @@ static const struct hwspinlock_ops qcom_
+ 	.unlock		= qcom_hwspinlock_unlock,
+ };
+ 
++static const struct qcom_hwspinlock_of_data of_sfpb_mutex = {
++	.offset = 0x4,
++	.stride = 0x4,
++};
++
++/* All modern platform has offset 0 and stride of 4k */
++static const struct qcom_hwspinlock_of_data of_tcsr_mutex = {
++	.offset = 0,
++	.stride = 0x1000,
++};
++
+ static const struct of_device_id qcom_hwspinlock_of_match[] = {
+-	{ .compatible = "qcom,sfpb-mutex" },
+-	{ .compatible = "qcom,tcsr-mutex" },
++	{ .compatible = "qcom,sfpb-mutex", .data = &of_sfpb_mutex },
++	{ .compatible = "qcom,tcsr-mutex", .data = &of_tcsr_mutex },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(of, qcom_hwspinlock_of_match);
+@@ -112,12 +128,14 @@ static const struct regmap_config tcsr_m
+ static struct regmap *qcom_hwspinlock_probe_mmio(struct platform_device *pdev,
+ 						 u32 *offset, u32 *stride)
+ {
++	const struct qcom_hwspinlock_of_data *data;
+ 	struct device *dev = &pdev->dev;
+ 	void __iomem *base;
+ 
+-	/* All modern platform has offset 0 and stride of 4k */
+-	*offset = 0;
+-	*stride = 0x1000;
++	data = of_device_get_match_data(dev);
++
++	*offset = data->offset;
++	*stride = data->stride;
+ 
+ 	base = devm_platform_ioremap_resource(pdev, 0);
+ 	if (IS_ERR(base))
diff --git a/target/linux/ipq806x/patches-5.15/105-v6.0-02-ARM-dts-qcom-ipq8064-add-missing-hwlock.patch b/target/linux/ipq806x/patches-5.15/105-v6.0-02-ARM-dts-qcom-ipq8064-add-missing-hwlock.patch
new file mode 100644
index 00000000000000..d8303442f7e36f
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/105-v6.0-02-ARM-dts-qcom-ipq8064-add-missing-hwlock.patch
@@ -0,0 +1,31 @@
+From fbe4be367b2169602f6a5949a20d2917b25714d4 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 7 Jul 2022 12:20:39 +0200
+Subject: [PATCH 1/2] ARM: dts: qcom: ipq8064: add missing hwlock
+
+Add missing hwlock for ipq8064 dtsi provided by qcom,sfpb-mutex.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+[bjorn: Moved the node inside /soc]
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220707102040.1859-2-ansuelsmth@gmail.com
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -1357,5 +1357,12 @@
+ 				dma-names = "tx", "rx";
+ 			};
+ 		};
++
++		sfpb_mutex: hwlock@1200600 {
++			compatible = "qcom,sfpb-mutex";
++			reg = <0x01200600 0x100>;
++
++			#hwlock-cells = <1>;
++		};
+ 	};
+ };
diff --git a/target/linux/ipq806x/patches-5.15/105-v6.0-03-ARM-dts-qcom-ipq8064-add-missing-smem-compatible.patch b/target/linux/ipq806x/patches-5.15/105-v6.0-03-ARM-dts-qcom-ipq8064-add-missing-smem-compatible.patch
new file mode 100644
index 00000000000000..8b91eeb51166aa
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/105-v6.0-03-ARM-dts-qcom-ipq8064-add-missing-smem-compatible.patch
@@ -0,0 +1,30 @@
+From 4fefb5434c4b735daf913abaef12431405368031 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 7 Jul 2022 12:20:40 +0200
+Subject: [PATCH 2/2] ARM: dts: qcom: ipq8064: add missing smem compatible
+
+Add missing smem compatible and hwlocks phandle for ipq8064 dtsi
+smem node.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220707102040.1859-3-ansuelsmth@gmail.com
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -292,8 +292,11 @@
+ 		};
+ 
+ 		smem: smem@41000000 {
++			compatible = "qcom,smem";
+ 			reg = <0x41000000 0x200000>;
+ 			no-map;
++
++			hwlocks = <&sfpb_mutex 3>;
+ 		};
+ 	};
+ 
diff --git a/target/linux/ipq806x/patches-5.15/106-v6.1-01-ARM-dts-qcom-ipq8064-add-v2-dtsi-variant.patch b/target/linux/ipq806x/patches-5.15/106-v6.1-01-ARM-dts-qcom-ipq8064-add-v2-dtsi-variant.patch
new file mode 100644
index 00000000000000..8b20a550f6f8f1
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/106-v6.1-01-ARM-dts-qcom-ipq8064-add-v2-dtsi-variant.patch
@@ -0,0 +1,129 @@
+From 9f7097a8b1948533a6db1b53b5c0480cc75bbd16 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 18 Jul 2022 18:05:16 +0200
+Subject: [PATCH 1/3] ARM: dts: qcom: ipq8064: add v2 dtsi variant
+
+Add ipq8064-v2.0 dtsi variant that differ from original ipq8064 SoC for
+some additional pcie, sata and usb configuration values, additional
+reserved memory and serial output.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ .../boot/dts/qcom-ipq8064-v2.0-smb208.dtsi    | 37 ++++++++++
+ arch/arm/boot/dts/qcom-ipq8064-v2.0.dtsi      | 69 +++++++++++++++++++
+ 2 files changed, 106 insertions(+)
+ create mode 100644 arch/arm/boot/dts/qcom-ipq8064-v2.0-smb208.dtsi
+ create mode 100644 arch/arm/boot/dts/qcom-ipq8064-v2.0.dtsi
+
+--- /dev/null
++++ b/arch/arm/boot/dts/qcom-ipq8064-v2.0-smb208.dtsi
+@@ -0,0 +1,37 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include "qcom-ipq8064-v2.0.dtsi"
++
++&rpm {
++	smb208_regulators: regulators {
++		compatible = "qcom,rpm-smb208-regulators";
++
++		smb208_s1a: s1a {
++			regulator-min-microvolt = <1050000>;
++			regulator-max-microvolt = <1150000>;
++
++			qcom,switch-mode-frequency = <1200000>;
++		};
++
++		smb208_s1b: s1b {
++			regulator-min-microvolt = <1050000>;
++			regulator-max-microvolt = <1150000>;
++
++			qcom,switch-mode-frequency = <1200000>;
++		};
++
++		smb208_s2a: s2a {
++			regulator-min-microvolt = < 800000>;
++			regulator-max-microvolt = <1250000>;
++
++			qcom,switch-mode-frequency = <1200000>;
++		};
++
++		smb208_s2b: s2b {
++			regulator-min-microvolt = < 800000>;
++			regulator-max-microvolt = <1250000>;
++
++			qcom,switch-mode-frequency = <1200000>;
++		};
++	};
++};
+--- /dev/null
++++ b/arch/arm/boot/dts/qcom-ipq8064-v2.0.dtsi
+@@ -0,0 +1,69 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include "qcom-ipq8064.dtsi"
++
++/ {
++	model = "Qualcomm Technologies, Inc. IPQ8064-v2.0";
++
++	aliases {
++		serial0 = &gsbi4_serial;
++	};
++
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
++	reserved-memory {
++		#address-cells = <1>;
++		#size-cells = <1>;
++		ranges;
++
++		rsvd@41200000 {
++			reg = <0x41200000 0x300000>;
++			no-map;
++		};
++	};
++};
++
++&gsbi4 {
++	qcom,mode = <GSBI_PROT_I2C_UART>;
++	status = "okay";
++
++	serial@16340000 {
++		status = "okay";
++	};
++	/*
++	 * The i2c device on gsbi4 should not be enabled.
++	 * On ipq806x designs gsbi4 i2c is meant for exclusive
++	 * RPM usage. Turning this on in kernel manifests as
++	 * i2c failure for the RPM.
++	 */
++};
++
++&pcie0 {
++	compatible = "qcom,pcie-ipq8064-v2";
++};
++
++&pcie1 {
++	compatible = "qcom,pcie-ipq8064-v2";
++};
++
++&pcie2 {
++	compatible = "qcom,pcie-ipq8064-v2";
++};
++
++&sata {
++	ports-implemented = <0x1>;
++};
++
++&ss_phy_0 {
++	qcom,rx-eq = <2>;
++	qcom,tx-deamp_3_5db = <32>;
++	qcom,mpll = <5>;
++};
++
++&ss_phy_1 {
++	qcom,rx-eq = <2>;
++	qcom,tx-deamp_3_5db = <32>;
++	qcom,mpll = <5>;
++};
diff --git a/target/linux/ipq806x/patches-5.15/106-v6.1-02-ARM-dts-qcom-ipq8064-add-ipq8062-variant.patch b/target/linux/ipq806x/patches-5.15/106-v6.1-02-ARM-dts-qcom-ipq8064-add-ipq8062-variant.patch
new file mode 100644
index 00000000000000..fdff292480ef66
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/106-v6.1-02-ARM-dts-qcom-ipq8064-add-ipq8062-variant.patch
@@ -0,0 +1,67 @@
+From 41d9fa8de7845bd92d9c963196fdfd7ea9232bb2 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 18 Jul 2022 18:07:26 +0200
+Subject: [PATCH 2/3] ARM: dts: qcom: ipq8064: add ipq8062 variant
+
+ipq8062 SoC is based on ipq8064-v2.0 with lower supported freq, lack of
+usb port and a reduced voltage output with the smb208 regulators.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ arch/arm/boot/dts/qcom-ipq8062-smb208.dtsi | 37 ++++++++++++++++++++++
+ arch/arm/boot/dts/qcom-ipq8062.dtsi        |  8 +++++
+ 2 files changed, 45 insertions(+)
+ create mode 100644 arch/arm/boot/dts/qcom-ipq8062-smb208.dtsi
+ create mode 100644 arch/arm/boot/dts/qcom-ipq8062.dtsi
+
+--- /dev/null
++++ b/arch/arm/boot/dts/qcom-ipq8062-smb208.dtsi
+@@ -0,0 +1,37 @@
++// SPDX-License-Identifier: GPL-2.0-only
++
++#include "qcom-ipq8062.dtsi"
++
++&rpm {
++	smb208_regulators: regulators {
++		compatible = "qcom,rpm-smb208-regulators";
++
++		smb208_s1a: s1a {
++			regulator-min-microvolt = <1050000>;
++			regulator-max-microvolt = <1150000>;
++
++			qcom,switch-mode-frequency = <1200000>;
++		};
++
++		smb208_s1b: s1b {
++			regulator-min-microvolt = <1050000>;
++			regulator-max-microvolt = <1150000>;
++
++			qcom,switch-mode-frequency = <1200000>;
++		};
++
++		smb208_s2a: s2a {
++			regulator-min-microvolt = < 800000>;
++			regulator-max-microvolt = <1150000>;
++
++			qcom,switch-mode-frequency = <1200000>;
++		};
++
++		smb208_s2b: s2b {
++			regulator-min-microvolt = < 800000>;
++			regulator-max-microvolt = <1150000>;
++
++			qcom,switch-mode-frequency = <1200000>;
++		};
++	};
++};
+--- /dev/null
++++ b/arch/arm/boot/dts/qcom-ipq8062.dtsi
+@@ -0,0 +1,8 @@
++// SPDX-License-Identifier: GPL-2.0-only
++
++#include "qcom-ipq8064-v2.0.dtsi"
++
++/ {
++	model = "Qualcomm Technologies, Inc. IPQ8062";
++	compatible = "qcom,ipq8062", "qcom,ipq8064";
++};
diff --git a/target/linux/ipq806x/patches-5.15/106-v6.1-03-ARM-dts-qcom-ipq8064-add-ipq8065-variant.patch b/target/linux/ipq806x/patches-5.15/106-v6.1-03-ARM-dts-qcom-ipq8064-add-ipq8065-variant.patch
new file mode 100644
index 00000000000000..bccc577b91c3ea
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/106-v6.1-03-ARM-dts-qcom-ipq8064-add-ipq8065-variant.patch
@@ -0,0 +1,67 @@
+From 01e7aa3fe6f76f7960f2382038136235eee9c6cd Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 18 Jul 2022 18:09:35 +0200
+Subject: [PATCH 3/3] ARM: dts: qcom: ipq8064: add ipq8065 variant
+
+ipq8065 SoC is based on ipq8064-v2.0 with a more clocked CPU and
+an increased voltage output with the smb208 regulators.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ arch/arm/boot/dts/qcom-ipq8065-smb208.dtsi | 37 ++++++++++++++++++++++
+ arch/arm/boot/dts/qcom-ipq8065.dtsi        |  8 +++++
+ 2 files changed, 45 insertions(+)
+ create mode 100644 arch/arm/boot/dts/qcom-ipq8065-smb208.dtsi
+ create mode 100644 arch/arm/boot/dts/qcom-ipq8065.dtsi
+
+--- /dev/null
++++ b/arch/arm/boot/dts/qcom-ipq8065-smb208.dtsi
+@@ -0,0 +1,37 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include "qcom-ipq8065.dtsi"
++
++&rpm {
++	smb208_regulators: regulators {
++		compatible = "qcom,rpm-smb208-regulators";
++
++		smb208_s1a: s1a {
++			regulator-min-microvolt = <1050000>;
++			regulator-max-microvolt = <1150000>;
++
++			qcom,switch-mode-frequency = <1200000>;
++		};
++
++		smb208_s1b: s1b {
++			regulator-min-microvolt = <1050000>;
++			regulator-max-microvolt = <1150000>;
++
++			qcom,switch-mode-frequency = <1200000>;
++		};
++
++		smb208_s2a: s2a {
++			regulator-min-microvolt = <775000>;
++			regulator-max-microvolt = <1275000>;
++
++			qcom,switch-mode-frequency = <1200000>;
++		};
++
++		smb208_s2b: s2b {
++			regulator-min-microvolt = <775000>;
++			regulator-max-microvolt = <1275000>;
++
++			qcom,switch-mode-frequency = <1200000>;
++		};
++	};
++};
+--- /dev/null
++++ b/arch/arm/boot/dts/qcom-ipq8065.dtsi
+@@ -0,0 +1,8 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include "qcom-ipq8064-v2.0.dtsi"
++
++/ {
++	model = "Qualcomm Technologies, Inc. IPQ8065";
++	compatible = "qcom,ipq8065", "qcom,ipq8064";
++};
diff --git a/target/linux/ipq806x/patches-5.15/107-10-ARM-dts-qcom-add-saw-for-l2-cache-and-kraitcc-for.patch b/target/linux/ipq806x/patches-5.15/107-10-ARM-dts-qcom-add-saw-for-l2-cache-and-kraitcc-for.patch
new file mode 100644
index 00000000000000..418d6b26ce7a96
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/107-10-ARM-dts-qcom-add-saw-for-l2-cache-and-kraitcc-for.patch
@@ -0,0 +1,95 @@
+From bef5018abb7cf94efafdc05087b4c998891ae4ec Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Mon, 17 Jan 2022 23:39:34 +0100
+Subject: [PATCH v3 10/18] ARM: dts: qcom: add saw for l2 cache and kraitcc for
+ ipq8064
+
+Add saw compatible for l2 cache and kraitcc node for ipq8064 dtsi.
+Also declare clock-output-names for acc0 and acc1 and qsb fixed clock
+for the secondary mux.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 34 +++++++++++++++++++++++++++--
+ 1 file changed, 32 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -301,6 +301,12 @@
+ 	};
+ 
+ 	clocks {
++		qsb: qsb {
++			compatible = "fixed-clock";
++			clock-frequency = <225000000>;
++			#clock-cells = <0>;
++		};
++
+ 		cxo_board: cxo_board {
+ 			compatible = "fixed-clock";
+ 			#clock-cells = <0>;
+@@ -503,11 +509,19 @@
+ 		acc0: clock-controller@2088000 {
+ 			compatible = "qcom,kpss-acc-v1";
+ 			reg = <0x02088000 0x1000>, <0x02008000 0x1000>;
++			clock-output-names = "acpu0_aux";
++			clocks = <&gcc PLL8_VOTE>, <&pxo_board>;
++			clock-names = "pll8_vote", "pxo";
++			#clock-cells = <0>;
+ 		};
+ 
+ 		acc1: clock-controller@2098000 {
+ 			compatible = "qcom,kpss-acc-v1";
+ 			reg = <0x02098000 0x1000>, <0x02008000 0x1000>;
++			clock-output-names = "acpu1_aux";
++			clocks = <&gcc PLL8_VOTE>, <&pxo_board>;
++			clock-names = "pll8_vote", "pxo";
++			#clock-cells = <0>;
+ 		};
+ 
+ 		adm_dma: dma-controller@18300000 {
+@@ -531,17 +545,23 @@
+ 		};
+ 
+ 		saw0: regulator@2089000 {
+-			compatible = "qcom,saw2";
++			compatible = "qcom,saw2", "qcom,apq8064-saw2-v1.1-cpu", "syscon";
+ 			reg = <0x02089000 0x1000>, <0x02009000 0x1000>;
+ 			regulator;
+ 		};
+ 
+ 		saw1: regulator@2099000 {
+-			compatible = "qcom,saw2";
++			compatible = "qcom,saw2", "qcom,apq8064-saw2-v1.1-cpu", "syscon";
+ 			reg = <0x02099000 0x1000>, <0x02009000 0x1000>;
+ 			regulator;
+ 		};
+ 
++		saw_l2: regulator@02012000 {
++			compatible = "qcom,saw2", "syscon";
++			reg = <0x02012000 0x1000>;
++			regulator;
++		};
++
+ 		gsbi1: gsbi@12440000 {
+ 			compatible = "qcom,gsbi-v1.0.0";
+ 			reg = <0x12440000 0x100>;
+@@ -920,6 +940,17 @@
+ 			clocks = <&gcc PLL8_VOTE>, <&pxo_board>;
+ 			clock-names = "pll8_vote", "pxo";
+ 			clock-output-names = "acpu_l2_aux";
++			#clock-cells = <0>;
++		};
++
++		kraitcc: clock-controller {
++			compatible = "qcom,krait-cc-v1";
++			clocks = <&gcc PLL9>, <&gcc PLL10>, <&gcc PLL12>,
++				 <&acc0>, <&acc1>, <&l2cc>, <&qsb>, <&pxo_board>;
++			clock-names = "hfpll0", "hfpll1", "hfpll_l2",
++				      "acpu0_aux", "acpu1_aux", "acpu_l2_aux",
++				      "qsb", "pxo";
++			#clock-cells = <1>;
+ 		};
+ 
+ 		lcc: clock-controller@28000000 {
diff --git a/target/linux/ipq806x/patches-5.15/107-13-ARM-dts-qcom-add-opp-table-for-cpu-and-l2-for-ipq.patch b/target/linux/ipq806x/patches-5.15/107-13-ARM-dts-qcom-add-opp-table-for-cpu-and-l2-for-ipq.patch
new file mode 100644
index 00000000000000..f3c8f18f1de35d
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/107-13-ARM-dts-qcom-add-opp-table-for-cpu-and-l2-for-ipq.patch
@@ -0,0 +1,268 @@
+From 076ebb6e1799c4c7a1d2e07510d88b9e9b57b551 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Tue, 18 Jan 2022 00:03:47 +0100
+Subject: [PATCH v3 13/18] ARM: dts: qcom: add opp table for cpu and l2 for
+ ipq8064
+
+Add opp table for cpu and l2 cache. While the current cpufreq is
+the generic one that doesn't scale the L2 cache, we add the l2
+cache opp anyway for the sake of completeness. This will be handy in the
+future when a dedicated cpufreq driver is introduced for krait cores
+that will correctly scale l2 cache with the core freq.
+
+Opp-level is set based on the logic of
+0: idle level
+1: normal level
+2: turbo level
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 99 +++++++++++++++++++++++++++++
+ 1 file changed, 99 insertions(+)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -48,6 +48,105 @@
+ 		};
+ 	};
+ 
++	opp_table_l2: opp_table_l2 {
++		compatible = "operating-points-v2";
++
++		opp-384000000 {
++			opp-hz = /bits/ 64 <384000000>;
++			opp-microvolt = <1100000>;
++			clock-latency-ns = <100000>;
++			opp-level = <0>;
++		};
++
++		opp-1000000000 {
++			opp-hz = /bits/ 64 <1000000000>;
++			opp-microvolt = <1100000>;
++			clock-latency-ns = <100000>;
++			opp-level = <1>;
++		};
++
++		opp-1200000000 {
++			opp-hz = /bits/ 64 <1200000000>;
++			opp-microvolt = <1150000>;
++			clock-latency-ns = <100000>;
++			opp-level = <2>;
++		};
++	};
++
++	opp_table0: opp_table0 {
++		compatible = "operating-points-v2-kryo-cpu";
++		nvmem-cells = <&speedbin_efuse>;
++
++		/*
++		 * Voltage thresholds are <target min max>
++		 */
++		opp-384000000 {
++			opp-hz = /bits/ 64 <384000000>;
++			opp-microvolt-speed0-pvs0-v0 = <1000000 950000 1050000>;
++			opp-microvolt-speed0-pvs1-v0 = <925000 878750 971250>;
++			opp-microvolt-speed0-pvs2-v0 = <875000 831250 918750>;
++			opp-microvolt-speed0-pvs3-v0 = <800000 760000 840000>;
++			opp-supported-hw = <0x1>;
++			clock-latency-ns = <100000>;
++			opp-level = <0>;
++		};
++
++		opp-600000000 {
++			opp-hz = /bits/ 64 <600000000>;
++			opp-microvolt-speed0-pvs0-v0 = <1050000 997500 1102500>;
++			opp-microvolt-speed0-pvs1-v0 = <975000 926250 1023750>;
++			opp-microvolt-speed0-pvs2-v0 = <925000 878750 971250>;
++			opp-microvolt-speed0-pvs3-v0 = <850000 807500 892500>;
++			opp-supported-hw = <0x1>;
++			clock-latency-ns = <100000>;
++			opp-level = <1>;
++		};
++
++		opp-800000000 {
++			opp-hz = /bits/ 64 <800000000>;
++			opp-microvolt-speed0-pvs0-v0 = <1100000 1045000 1155000>;
++			opp-microvolt-speed0-pvs1-v0 = <1025000 973750 1076250>;
++			opp-microvolt-speed0-pvs2-v0 = <995000 945250 1044750>;
++			opp-microvolt-speed0-pvs3-v0 = <900000 855000 945000>;
++			opp-supported-hw = <0x1>;
++			clock-latency-ns = <100000>;
++			opp-level = <1>;
++		};
++
++		opp-1000000000 {
++			opp-hz = /bits/ 64 <1000000000>;
++			opp-microvolt-speed0-pvs0-v0 = <1150000 1092500 1207500>;
++			opp-microvolt-speed0-pvs1-v0 = <1075000 1021250 1128750>;
++			opp-microvolt-speed0-pvs2-v0 = <1025000 973750 1076250>;
++			opp-microvolt-speed0-pvs3-v0 = <950000 902500 997500>;
++			opp-supported-hw = <0x1>;
++			clock-latency-ns = <100000>;
++			opp-level = <1>;
++		};
++
++		opp-1200000000 {
++			opp-hz = /bits/ 64 <1200000000>;
++			opp-microvolt-speed0-pvs0-v0 = <1200000 1140000 1260000>;
++			opp-microvolt-speed0-pvs1-v0 = <1125000 1068750 1181250>;
++			opp-microvolt-speed0-pvs2-v0 = <1075000 1021250 1128750>;
++			opp-microvolt-speed0-pvs3-v0 = <1000000 950000 1050000>;
++			opp-supported-hw = <0x1>;
++			clock-latency-ns = <100000>;
++			opp-level = <2>;
++		};
++
++		opp-1400000000 {
++			opp-hz = /bits/ 64 <1400000000>;
++			opp-microvolt-speed0-pvs0-v0 = <1250000 1187500 1312500>;
++			opp-microvolt-speed0-pvs1-v0 = <1175000 1116250 1233750>;
++			opp-microvolt-speed0-pvs2-v0 = <1125000 1068750 1181250>;
++			opp-microvolt-speed0-pvs3-v0 = <1050000 997500 1102500>;
++			opp-supported-hw = <0x1>;
++			clock-latency-ns = <100000>;
++			opp-level = <2>;
++		};
++	};
++
+ 	thermal-zones {
+ 		tsens_tz_sensor0 {
+ 			polling-delay-passive = <0>;
+--- a/arch/arm/boot/dts/qcom-ipq8065.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8065.dtsi
+@@ -6,3 +6,92 @@
+ 	model = "Qualcomm Technologies, Inc. IPQ8065";
+ 	compatible = "qcom,ipq8065", "qcom,ipq8064";
+ };
++
++&opp_table_l2 {
++	/delete-node/opp-1200000000;
++
++	opp-1400000000 {
++		opp-hz = /bits/ 64 <1400000000>;
++		opp-microvolt = <1150000>;
++		clock-latency-ns = <100000>;
++		opp-level = <2>;
++	};
++};
++
++&opp_table0 {
++	/*
++	 * On ipq8065 1.2 ghz freq is not present
++	 * Remove it to make cpufreq work and not
++	 * complain for missing definition
++	 */
++
++	/delete-node/opp-1200000000;
++
++	/*
++	 * Voltage thresholds are <target min max>
++	 */
++	opp-384000000 {
++		opp-microvolt-speed0-pvs0-v0 = <975000 926250 1023750>;
++		opp-microvolt-speed0-pvs1-v0 = <950000 902500 997500>;
++		opp-microvolt-speed0-pvs2-v0 = <925000 878750 971250>;
++		opp-microvolt-speed0-pvs3-v0 = <900000 855000 945000>;
++		opp-microvolt-speed0-pvs4-v0 = <875000 831250 918750>;
++		opp-microvolt-speed0-pvs5-v0 = <825000 783750 866250>;
++		opp-microvolt-speed0-pvs6-v0 = <775000 736250 813750>;
++	};
++
++	opp-600000000 {
++		opp-microvolt-speed0-pvs0-v0 = <1000000 950000 1050000>;
++		opp-microvolt-speed0-pvs1-v0 = <975000 926250 1023750>;
++		opp-microvolt-speed0-pvs2-v0 = <950000 902500 997500>;
++		opp-microvolt-speed0-pvs3-v0 = <925000 878750 971250>;
++		opp-microvolt-speed0-pvs4-v0 = <900000 855000 945000>;
++		opp-microvolt-speed0-pvs5-v0 = <850000 807500 892500>;
++		opp-microvolt-speed0-pvs6-v0 = <800000 760000 840000>;
++	};
++
++	opp-800000000 {
++		opp-microvolt-speed0-pvs0-v0 = <1050000 997500 1102500>;
++		opp-microvolt-speed0-pvs1-v0 = <1025000 973750 1076250>;
++		opp-microvolt-speed0-pvs2-v0 = <1000000 950000 1050000>;
++		opp-microvolt-speed0-pvs3-v0 = <975000 926250 1023750>;
++		opp-microvolt-speed0-pvs4-v0 = <950000 902500 997500>;
++		opp-microvolt-speed0-pvs5-v0 = <900000 855000 945000>;
++		opp-microvolt-speed0-pvs6-v0 = <850000 807500 892500>;
++	};
++
++	opp-1000000000 {
++		opp-microvolt-speed0-pvs0-v0 = <1100000 1045000 1155000>;
++		opp-microvolt-speed0-pvs1-v0 = <1075000 1021250 1128750>;
++		opp-microvolt-speed0-pvs2-v0 = <1050000 997500 1102500>;
++		opp-microvolt-speed0-pvs3-v0 = <1025000 973750 1076250>;
++		opp-microvolt-speed0-pvs4-v0 = <1000000 950000 1050000>;
++		opp-microvolt-speed0-pvs5-v0 = <950000 902500 997500>;
++		opp-microvolt-speed0-pvs6-v0 = <900000 855000 945000>;
++	};
++
++	opp-1400000000 {
++		opp-microvolt-speed0-pvs0-v0 = <1175000 1116250 1233750>;
++		opp-microvolt-speed0-pvs1-v0 = <1150000 1092500 1207500>;
++		opp-microvolt-speed0-pvs2-v0 = <1125000 1068750 1181250>;
++		opp-microvolt-speed0-pvs3-v0 = <1100000 1045000 1155000>;
++		opp-microvolt-speed0-pvs4-v0 = <1075000 1021250 1128750>;
++		opp-microvolt-speed0-pvs5-v0 = <1025000 973750 1076250>;
++		opp-microvolt-speed0-pvs6-v0 = <975000 926250 1023750>;
++		opp-level = <1>;
++	};
++
++	opp-1725000000 {
++		opp-hz = /bits/ 64 <1725000000>;
++		opp-microvolt-speed0-pvs0-v0 = <1262500 1199375 1325625>;
++		opp-microvolt-speed0-pvs1-v0 = <1225000 1163750 1286250>;
++		opp-microvolt-speed0-pvs2-v0 = <1200000 1140000 1260000>;
++		opp-microvolt-speed0-pvs3-v0 = <1175000 1116250 1233750>;
++		opp-microvolt-speed0-pvs4-v0 = <1150000 1092500 1207500>;
++		opp-microvolt-speed0-pvs5-v0 = <1100000 1045000 1155000>;
++		opp-microvolt-speed0-pvs6-v0 = <1050000 997500 1102500>;
++		opp-supported-hw = <0x1>;
++		clock-latency-ns = <100000>;
++		opp-level = <2>;
++	};
++};
+--- a/arch/arm/boot/dts/qcom-ipq8062.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8062.dtsi
+@@ -6,3 +6,39 @@
+ 	model = "Qualcomm Technologies, Inc. IPQ8062";
+ 	compatible = "qcom,ipq8062", "qcom,ipq8064";
+ };
++
++&opp_table0 {
++	/delete-node/opp-1200000000;
++	/delete-node/opp-1400000000;
++
++	/*
++	 * Voltage thresholds are <target min max>
++	 */
++	opp-384000000 {
++		opp-microvolt-speed0-pvs0-v0 = <1000000 950000 1050000>;
++		opp-microvolt-speed0-pvs1-v0 = < 925000 878750  971250>;
++		opp-microvolt-speed0-pvs2-v0 = < 875000 831250  918750>;
++		opp-microvolt-speed0-pvs3-v0 = < 800000 760000  840000>;
++	};
++
++	opp-600000000 {
++		opp-microvolt-speed0-pvs0-v0 = <1050000 997500 1102500>;
++		opp-microvolt-speed0-pvs1-v0 = < 975000 926250 1023750>;
++		opp-microvolt-speed0-pvs2-v0 = < 925000 878750  971250>;
++		opp-microvolt-speed0-pvs3-v0 = < 850000 807500  892500>;
++	};
++
++	opp-800000000 {
++		opp-microvolt-speed0-pvs0-v0 = <1100000 1045000 1155000>;
++		opp-microvolt-speed0-pvs1-v0 = <1025000  973750 1076250>;
++		opp-microvolt-speed0-pvs2-v0 = < 995000  945250 1044750>;
++		opp-microvolt-speed0-pvs3-v0 = < 900000  855000  945000>;
++	};
++
++	opp-1000000000 {
++		opp-microvolt-speed0-pvs0-v0 = <1150000 1092500 1207500>;
++		opp-microvolt-speed0-pvs1-v0 = <1075000 1021250 1128750>;
++		opp-microvolt-speed0-pvs2-v0 = <1025000  973750 1076250>;
++		opp-microvolt-speed0-pvs3-v0 = < 950000  902500  997500>;
++	};
++};
diff --git a/target/linux/ipq806x/patches-5.15/107-15-ARM-dts-qcom-add-multiple-missing-binding-for-cpu.patch b/target/linux/ipq806x/patches-5.15/107-15-ARM-dts-qcom-add-multiple-missing-binding-for-cpu.patch
new file mode 100644
index 00000000000000..cf27aaa08b63b4
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/107-15-ARM-dts-qcom-add-multiple-missing-binding-for-cpu.patch
@@ -0,0 +1,153 @@
+From 211fc0c0a63c99b68663a27182e643316c2d8cbe Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Tue, 18 Jan 2022 00:07:57 +0100
+Subject: [PATCH v3 15/18] ARM: dts: qcom: add multiple missing binding for cpu
+ and l2 for ipq8064
+
+Add multiple binding for cpu node, l2 node and add idle-states
+definition for ipq8064 dtsi.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 36 +++++++++++++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -30,6 +30,15 @@
+ 			next-level-cache = <&L2>;
+ 			qcom,acc = <&acc0>;
+ 			qcom,saw = <&saw0>;
++			clocks = <&kraitcc 0>, <&kraitcc 4>;
++			clock-names = "cpu", "l2";
++			clock-latency = <100000>;
++			operating-points-v2 = <&opp_table0>;
++			voltage-tolerance = <5>;
++			cooling-min-state = <0>;
++			cooling-max-state = <10>;
++			#cooling-cells = <2>;
++			cpu-idle-states = <&CPU_SPC>;
+ 		};
+ 
+ 		cpu1: cpu@1 {
+@@ -40,11 +49,35 @@
+ 			next-level-cache = <&L2>;
+ 			qcom,acc = <&acc1>;
+ 			qcom,saw = <&saw1>;
++			clocks = <&kraitcc 1>, <&kraitcc 4>;
++			clock-names = "cpu", "l2";
++			clock-latency = <100000>;
++			operating-points-v2 = <&opp_table0>;
++			voltage-tolerance = <5>;
++			cooling-min-state = <0>;
++			cooling-max-state = <10>;
++			#cooling-cells = <2>;
++			cpu-idle-states = <&CPU_SPC>;
++		};
++
++		idle-states {
++			CPU_SPC: spc {
++				compatible = "qcom,idle-state-spc";
++				status = "disabled";
++				entry-latency-us = <400>;
++				exit-latency-us = <900>;
++				min-residency-us = <3000>;
++			};
+ 		};
+ 
+ 		L2: l2-cache {
+ 			compatible = "cache";
+ 			cache-level = <2>;
++			qcom,saw = <&saw_l2>;
++
++			clocks = <&kraitcc 4>;
++			clock-names = "l2";
++			operating-points-v2 = <&opp_table_l2>;
+ 		};
+ 	};
+ 
+--- a/arch/arm/boot/dts/qcom-ipq8064-smb208.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064-smb208.dtsi
+@@ -2,6 +2,18 @@
+ 
+ #include "qcom-ipq8064.dtsi"
+ 
++&cpu0 {
++	cpu-supply = <&smb208_s2a>;
++};
++
++&cpu1 {
++	cpu-supply = <&smb208_s2b>;
++};
++
++&L2 {
++	l2-supply = <&smb208_s1a>;
++};
++
+ &rpm {
+ 	smb208_regulators: regulators {
+ 		compatible = "qcom,rpm-smb208-regulators";
+--- a/arch/arm/boot/dts/qcom-ipq8064-v2.0-smb208.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064-v2.0-smb208.dtsi
+@@ -2,6 +2,18 @@
+ 
+ #include "qcom-ipq8064-v2.0.dtsi"
+ 
++&cpu0 {
++	cpu-supply = <&smb208_s2a>;
++};
++
++&cpu1 {
++	cpu-supply = <&smb208_s2b>;
++};
++
++&L2 {
++	l2-supply = <&smb208_s1a>;
++};
++
+ &rpm {
+ 	smb208_regulators: regulators {
+ 		compatible = "qcom,rpm-smb208-regulators";
+--- a/arch/arm/boot/dts/qcom-ipq8062-smb208.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8062-smb208.dtsi
+@@ -2,6 +2,18 @@
+ 
+ #include "qcom-ipq8062.dtsi"
+ 
++&cpu0 {
++	cpu-supply = <&smb208_s2a>;
++};
++
++&cpu1 {
++	cpu-supply = <&smb208_s2b>;
++};
++
++&L2 {
++	l2-supply = <&smb208_s1a>;
++};
++
+ &rpm {
+ 	smb208_regulators: regulators {
+ 		compatible = "qcom,rpm-smb208-regulators";
+--- a/arch/arm/boot/dts/qcom-ipq8065-smb208.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8065-smb208.dtsi
+@@ -2,6 +2,18 @@
+ 
+ #include "qcom-ipq8065.dtsi"
+ 
++&cpu0 {
++	cpu-supply = <&smb208_s2a>;
++};
++
++&cpu1 {
++	cpu-supply = <&smb208_s2b>;
++};
++
++&L2 {
++	l2-supply = <&smb208_s1a>;
++};
++
+ &rpm {
+ 	smb208_regulators: regulators {
+ 		compatible = "qcom,rpm-smb208-regulators";
diff --git a/target/linux/ipq806x/patches-5.15/108-01-ARM-dts-qcom-fix-wrong-nad_pins-definition-for-ipq80.patch b/target/linux/ipq806x/patches-5.15/108-01-ARM-dts-qcom-fix-wrong-nad_pins-definition-for-ipq80.patch
new file mode 100644
index 00000000000000..d3f821a6a0ffb4
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/108-01-ARM-dts-qcom-fix-wrong-nad_pins-definition-for-ipq80.patch
@@ -0,0 +1,29 @@
+From 6c94e0184e56f9e9f1f5d5f54b20758433e498d2 Mon Sep 17 00:00:00 2001
+From: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
+Date: Wed, 15 Jun 2022 16:47:09 +0200
+Subject: [PATCH 1/2] ARM: dts: qcom: fix wrong nad_pins definition for ipq806x
+
+Fix wrong nand_pings definition for bias-disable pins.
+
+Signed-off-by: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -559,12 +559,9 @@
+ 			};
+ 
+ 			nand_pins: nand_pins {
+-				mux {
++				disable {
+ 					pins = "gpio34", "gpio35", "gpio36",
+-					       "gpio37", "gpio38", "gpio39",
+-					       "gpio40", "gpio41", "gpio42",
+-					       "gpio43", "gpio44", "gpio45",
+-					       "gpio46", "gpio47";
++					       "gpio37", "gpio38";
+ 					function = "nand";
+ 					drive-strength = <10>;
+ 					bias-disable;
diff --git a/target/linux/ipq806x/patches-5.15/108-02-ARM-dts-qcom-add-MDIO-dedicated-controller-node-for-.patch b/target/linux/ipq806x/patches-5.15/108-02-ARM-dts-qcom-add-MDIO-dedicated-controller-node-for-.patch
new file mode 100644
index 00000000000000..4a57fc0330b18c
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/108-02-ARM-dts-qcom-add-MDIO-dedicated-controller-node-for-.patch
@@ -0,0 +1,188 @@
+From 504188183408fac0f61b59f5ed8ea1773fe43669 Mon Sep 17 00:00:00 2001
+From: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
+Date: Wed, 15 Jun 2022 16:59:30 +0200
+Subject: [PATCH 2/2] ARM: dts: qcom: add MDIO dedicated controller node for
+ ipq806x
+
+Add MDIO dedicated controller attached to gmac0 and fix rb3011 dts to
+correctly use the new tag.
+
+Signed-off-by: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
+---
+ arch/arm/boot/dts/qcom-ipq8064-rb3011.dts | 134 +++++++++++-----------
+ arch/arm/boot/dts/qcom-ipq8064.dtsi       |  14 +++
+ 2 files changed, 81 insertions(+), 67 deletions(-)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064-rb3011.dts
++++ b/arch/arm/boot/dts/qcom-ipq8064-rb3011.dts
+@@ -24,73 +24,6 @@
+ 		device_type = "memory";
+ 	};
+ 
+-	mdio0: mdio-0 {
+-		status = "okay";
+-		compatible = "virtual,mdio-gpio";
+-		gpios = <&qcom_pinmux 1 GPIO_ACTIVE_HIGH>,
+-			<&qcom_pinmux 0 GPIO_ACTIVE_HIGH>;
+-		#address-cells = <1>;
+-		#size-cells = <0>;
+-
+-		pinctrl-0 = <&mdio0_pins>;
+-		pinctrl-names = "default";
+-
+-		switch0: switch@10 {
+-			compatible = "qca,qca8337";
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-
+-			dsa,member = <0 0>;
+-
+-			pinctrl-0 = <&sw0_reset_pin>;
+-			pinctrl-names = "default";
+-
+-			reset-gpios = <&qcom_pinmux 16 GPIO_ACTIVE_LOW>;
+-			reg = <0x10>;
+-
+-			ports {
+-				#address-cells = <1>;
+-				#size-cells = <0>;
+-
+-				switch0cpu: port@0 {
+-					reg = <0>;
+-					label = "cpu";
+-					ethernet = <&gmac0>;
+-					phy-mode = "rgmii-id";
+-					fixed-link {
+-						speed = <1000>;
+-						full-duplex;
+-					};
+-				};
+-
+-				port@1 {
+-					reg = <1>;
+-					label = "sw1";
+-				};
+-
+-				port@2 {
+-					reg = <2>;
+-					label = "sw2";
+-				};
+-
+-				port@3 {
+-					reg = <3>;
+-					label = "sw3";
+-				};
+-
+-				port@4 {
+-					reg = <4>;
+-					label = "sw4";
+-				};
+-
+-				port@5 {
+-					reg = <5>;
+-					label = "sw5";
+-				};
+-			};
+-		};
+-	};
+-
+ 	mdio1: mdio-1 {
+ 		status = "okay";
+ 		compatible = "virtual,mdio-gpio";
+@@ -220,6 +153,73 @@
+ 	status = "okay";
+ };
+ 
++&mdio0 {
++	status = "okay";
++	compatible = "virtual,mdio-gpio";
++	gpios = <&qcom_pinmux 1 GPIO_ACTIVE_HIGH>,
++		<&qcom_pinmux 0 GPIO_ACTIVE_HIGH>;
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	pinctrl-0 = <&mdio0_pins>;
++	pinctrl-names = "default";
++
++	switch0: switch@10 {
++		compatible = "qca,qca8337";
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		dsa,member = <0 0>;
++
++		pinctrl-0 = <&sw0_reset_pin>;
++		pinctrl-names = "default";
++
++		reset-gpios = <&qcom_pinmux 16 GPIO_ACTIVE_LOW>;
++		reg = <0x10>;
++
++		ports {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			switch0cpu: port@0 {
++				reg = <0>;
++				label = "cpu";
++				ethernet = <&gmac0>;
++				phy-mode = "rgmii-id";
++				fixed-link {
++					speed = <1000>;
++					full-duplex;
++				};
++			};
++
++			port@1 {
++				reg = <1>;
++				label = "sw1";
++			};
++
++			port@2 {
++				reg = <2>;
++				label = "sw2";
++			};
++
++			port@3 {
++				reg = <3>;
++				label = "sw3";
++			};
++
++			port@4 {
++				reg = <4>;
++				label = "sw4";
++			};
++
++			port@5 {
++				reg = <5>;
++				label = "sw5";
++			};
++		};
++	};
++};
++
+ &gmac0 {
+ 	status = "okay";
+ 
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -1446,6 +1446,20 @@
+ 			};
+ 		};
+ 
++		mdio0: mdio@37000000 {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			compatible = "qcom,ipq8064-mdio", "syscon";
++			reg = <0x37000000 0x200000>;
++			resets = <&gcc GMAC_CORE1_RESET>;
++			reset-names = "stmmaceth";
++			clocks = <&gcc GMAC_CORE1_CLK>;
++			clock-names = "stmmaceth";
++
++			status = "disabled";
++		};
++
+ 		vsdcc_fixed: vsdcc-regulator {
+ 			compatible = "regulator-fixed";
+ 			regulator-name = "SDCC Power";
diff --git a/target/linux/ipq806x/patches-5.15/109-v6.1-01-dt-bindings-clock-add-pcm-reset-for-ipq806x-lcc.patch b/target/linux/ipq806x/patches-5.15/109-v6.1-01-dt-bindings-clock-add-pcm-reset-for-ipq806x-lcc.patch
new file mode 100644
index 00000000000000..72e70b613c88b9
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/109-v6.1-01-dt-bindings-clock-add-pcm-reset-for-ipq806x-lcc.patch
@@ -0,0 +1,29 @@
+From fc7dc1d0c10e8e3d72b68ddae8a61c8aa02a62c1 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 15 Jun 2022 17:13:32 +0200
+Subject: [PATCH v4 1/3] dt-bindings: clock: add pcm reset for ipq806x lcc
+
+Add pcm reset define for ipq806x lcc.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Acked-by: Rob Herring <robh@kernel.org>
+---
+v3:
+ - Added review tag
+ - Added ack tag
+v2:
+ - Fix Sob tag
+
+ include/dt-bindings/clock/qcom,lcc-ipq806x.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/include/dt-bindings/clock/qcom,lcc-ipq806x.h
++++ b/include/dt-bindings/clock/qcom,lcc-ipq806x.h
+@@ -19,4 +19,6 @@
+ #define SPDIF_CLK			10
+ #define AHBIX_CLK			11
+ 
++#define LCC_PCM_RESET			0
++
+ #endif
diff --git a/target/linux/ipq806x/patches-5.15/109-v6.1-02-clk-qcom-lcc-ipq806x-add-reset-definition.patch b/target/linux/ipq806x/patches-5.15/109-v6.1-02-clk-qcom-lcc-ipq806x-add-reset-definition.patch
new file mode 100644
index 00000000000000..23936513064389
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/109-v6.1-02-clk-qcom-lcc-ipq806x-add-reset-definition.patch
@@ -0,0 +1,48 @@
+From 3587d768bdf4683a53244be1acca5d095044671f Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 15 Jun 2022 17:19:55 +0200
+Subject: [PATCH v4 2/3] clk: qcom: lcc-ipq806x: add reset definition
+
+Add reset definition for lcc-ipq806x.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+---
+v3:
+ - Added review tag
+v2:
+ - Fix Sob tag
+
+ drivers/clk/qcom/lcc-ipq806x.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/clk/qcom/lcc-ipq806x.c
++++ b/drivers/clk/qcom/lcc-ipq806x.c
+@@ -22,6 +22,7 @@
+ #include "clk-branch.h"
+ #include "clk-regmap-divider.h"
+ #include "clk-regmap-mux.h"
++#include "reset.h"
+ 
+ static struct clk_pll pll4 = {
+ 	.l_reg = 0x4,
+@@ -405,6 +406,10 @@ static struct clk_regmap *lcc_ipq806x_cl
+ 	[AHBIX_CLK] = &ahbix_clk.clkr,
+ };
+ 
++static const struct qcom_reset_map lcc_ipq806x_resets[] = {
++	[LCC_PCM_RESET] = { 0x54, 13 },
++};
++
+ static const struct regmap_config lcc_ipq806x_regmap_config = {
+ 	.reg_bits	= 32,
+ 	.reg_stride	= 4,
+@@ -417,6 +422,8 @@ static const struct qcom_cc_desc lcc_ipq
+ 	.config = &lcc_ipq806x_regmap_config,
+ 	.clks = lcc_ipq806x_clks,
+ 	.num_clks = ARRAY_SIZE(lcc_ipq806x_clks),
++	.resets = lcc_ipq806x_resets,
++	.num_resets = ARRAY_SIZE(lcc_ipq806x_resets),
+ };
+ 
+ static const struct of_device_id lcc_ipq806x_match_table[] = {
diff --git a/target/linux/ipq806x/patches-5.15/109-v6.1-03-clk-qcom-lcc-ipq806x-convert-to-parent-data.patch b/target/linux/ipq806x/patches-5.15/109-v6.1-03-clk-qcom-lcc-ipq806x-convert-to-parent-data.patch
new file mode 100644
index 00000000000000..905dc5bf40b5f4
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/109-v6.1-03-clk-qcom-lcc-ipq806x-convert-to-parent-data.patch
@@ -0,0 +1,217 @@
+From 92ef900a4a53b62e0dc32554eb088a422657606c Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 15 Jun 2022 17:35:13 +0200
+Subject: [PATCH v5 3/3] clk: qcom: lcc-ipq806x: convert to parent data
+
+Convert lcc-ipq806x driver to parent_data API.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+v5:
+- Fix the same compilation error (don't know what the hell happen
+  to my buildroot)
+v4:
+- Fix compilation error
+v3:
+ - Inline pxo pll4 parent
+ - Change .name from pxo to pxo_board
+
+ drivers/clk/qcom/lcc-ipq806x.c | 77 ++++++++++++++++++----------------
+ 1 file changed, 42 insertions(+), 35 deletions(-)
+
+--- a/drivers/clk/qcom/lcc-ipq806x.c
++++ b/drivers/clk/qcom/lcc-ipq806x.c
+@@ -34,7 +34,9 @@ static struct clk_pll pll4 = {
+ 	.status_bit = 16,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "pll4",
+-		.parent_names = (const char *[]){ "pxo" },
++		.parent_data = &(const struct clk_parent_data) {
++			.fw_name = "pxo", .name = "pxo_board",
++		},
+ 		.num_parents = 1,
+ 		.ops = &clk_pll_ops,
+ 	},
+@@ -64,9 +66,9 @@ static const struct parent_map lcc_pxo_p
+ 	{ P_PLL4, 2 }
+ };
+ 
+-static const char * const lcc_pxo_pll4[] = {
+-	"pxo",
+-	"pll4_vote",
++static const struct clk_parent_data lcc_pxo_pll4[] = {
++	{ .fw_name = "pxo", .name = "pxo" },
++	{ .fw_name = "pll4_vote", .name = "pll4_vote" },
+ };
+ 
+ static struct freq_tbl clk_tbl_aif_mi2s[] = {
+@@ -131,18 +133,14 @@ static struct clk_rcg mi2s_osr_src = {
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "mi2s_osr_src",
+-			.parent_names = lcc_pxo_pll4,
+-			.num_parents = 2,
++			.parent_data = lcc_pxo_pll4,
++			.num_parents = ARRAY_SIZE(lcc_pxo_pll4),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+ 		},
+ 	},
+ };
+ 
+-static const char * const lcc_mi2s_parents[] = {
+-	"mi2s_osr_src",
+-};
+-
+ static struct clk_branch mi2s_osr_clk = {
+ 	.halt_reg = 0x50,
+ 	.halt_bit = 1,
+@@ -152,7 +150,9 @@ static struct clk_branch mi2s_osr_clk =
+ 		.enable_mask = BIT(17),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "mi2s_osr_clk",
+-			.parent_names = lcc_mi2s_parents,
++			.parent_hws = (const struct clk_hw*[]){
++				&mi2s_osr_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -167,7 +167,9 @@ static struct clk_regmap_div mi2s_div_cl
+ 	.clkr = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "mi2s_div_clk",
+-			.parent_names = lcc_mi2s_parents,
++			.parent_hws = (const struct clk_hw*[]){
++				&mi2s_osr_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_regmap_div_ops,
+ 		},
+@@ -183,7 +185,9 @@ static struct clk_branch mi2s_bit_div_cl
+ 		.enable_mask = BIT(15),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "mi2s_bit_div_clk",
+-			.parent_names = (const char *[]){ "mi2s_div_clk" },
++			.parent_hws = (const struct clk_hw*[]){
++				&mi2s_div_clk.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -191,6 +195,10 @@ static struct clk_branch mi2s_bit_div_cl
+ 	},
+ };
+ 
++static const struct clk_parent_data lcc_mi2s_bit_div_codec_clk[] = {
++	{ .hw = &mi2s_bit_div_clk.clkr.hw, },
++	{ .fw_name = "mi2s_codec_clk", .name = "mi2s_codec_clk" },
++};
+ 
+ static struct clk_regmap_mux mi2s_bit_clk = {
+ 	.reg = 0x48,
+@@ -199,11 +207,8 @@ static struct clk_regmap_mux mi2s_bit_cl
+ 	.clkr = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "mi2s_bit_clk",
+-			.parent_names = (const char *[]){
+-				"mi2s_bit_div_clk",
+-				"mi2s_codec_clk",
+-			},
+-			.num_parents = 2,
++			.parent_data = lcc_mi2s_bit_div_codec_clk,
++			.num_parents = ARRAY_SIZE(lcc_mi2s_bit_div_codec_clk),
+ 			.ops = &clk_regmap_mux_closest_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 		},
+@@ -245,8 +250,8 @@ static struct clk_rcg pcm_src = {
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "pcm_src",
+-			.parent_names = lcc_pxo_pll4,
+-			.num_parents = 2,
++			.parent_data = lcc_pxo_pll4,
++			.num_parents = ARRAY_SIZE(lcc_pxo_pll4),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+ 		},
+@@ -262,7 +267,9 @@ static struct clk_branch pcm_clk_out = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "pcm_clk_out",
+-			.parent_names = (const char *[]){ "pcm_src" },
++			.parent_hws = (const struct clk_hw*[]){
++				&pcm_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -270,6 +277,11 @@ static struct clk_branch pcm_clk_out = {
+ 	},
+ };
+ 
++static const struct clk_parent_data lcc_pcm_clk_out_codec_clk[] = {
++	{ .hw = &pcm_clk_out.clkr.hw, },
++	{ .fw_name = "pcm_codec_clk", .name = "pcm_codec_clk" },
++};
++
+ static struct clk_regmap_mux pcm_clk = {
+ 	.reg = 0x54,
+ 	.shift = 10,
+@@ -277,11 +289,8 @@ static struct clk_regmap_mux pcm_clk = {
+ 	.clkr = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "pcm_clk",
+-			.parent_names = (const char *[]){
+-				"pcm_clk_out",
+-				"pcm_codec_clk",
+-			},
+-			.num_parents = 2,
++			.parent_data = lcc_pcm_clk_out_codec_clk,
++			.num_parents = ARRAY_SIZE(lcc_pcm_clk_out_codec_clk),
+ 			.ops = &clk_regmap_mux_closest_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 		},
+@@ -325,18 +334,14 @@ static struct clk_rcg spdif_src = {
+ 		.enable_mask = BIT(9),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "spdif_src",
+-			.parent_names = lcc_pxo_pll4,
+-			.num_parents = 2,
++			.parent_data = lcc_pxo_pll4,
++			.num_parents = ARRAY_SIZE(lcc_pxo_pll4),
+ 			.ops = &clk_rcg_ops,
+ 			.flags = CLK_SET_RATE_GATE,
+ 		},
+ 	},
+ };
+ 
+-static const char * const lcc_spdif_parents[] = {
+-	"spdif_src",
+-};
+-
+ static struct clk_branch spdif_clk = {
+ 	.halt_reg = 0xd4,
+ 	.halt_bit = 1,
+@@ -346,7 +351,9 @@ static struct clk_branch spdif_clk = {
+ 		.enable_mask = BIT(12),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "spdif_clk",
+-			.parent_names = lcc_spdif_parents,
++			.parent_hws = (const struct clk_hw*[]){
++				&spdif_src.clkr.hw,
++			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -384,8 +391,8 @@ static struct clk_rcg ahbix_clk = {
+ 		.enable_mask = BIT(11),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "ahbix",
+-			.parent_names = lcc_pxo_pll4,
+-			.num_parents = 2,
++			.parent_data = lcc_pxo_pll4,
++			.num_parents = ARRAY_SIZE(lcc_pxo_pll4),
+ 			.ops = &clk_rcg_lcc_ops,
+ 		},
+ 	},
diff --git a/target/linux/ipq806x/patches-5.15/110-01-thermal-qcom-tsens-init-debugfs-only-with-successful.patch b/target/linux/ipq806x/patches-5.15/110-01-thermal-qcom-tsens-init-debugfs-only-with-successful.patch
new file mode 100644
index 00000000000000..4caa2a9560e26e
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/110-01-thermal-qcom-tsens-init-debugfs-only-with-successful.patch
@@ -0,0 +1,41 @@
+From 8f32d48a309246a80bdca505968085a484d54408 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Mon, 19 Apr 2021 03:01:53 +0200
+Subject: [thermal-next PATCH v2 1/2] thermal: qcom: tsens: init debugfs only with
+ successful probe
+
+calibrate and tsens_register can fail or PROBE_DEFER. This will cause a
+double or a wrong init of the debugfs information. Init debugfs only
+with successful probe fixing warning about directory already present.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Acked-by: Thara Gopinath <thara.gopinath@linaro.org>
+---
+ drivers/thermal/qcom/tsens.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/thermal/qcom/tsens.c
++++ b/drivers/thermal/qcom/tsens.c
+@@ -917,8 +917,6 @@ int __init init_common(struct tsens_priv
+ 	if (tsens_version(priv) >= VER_0_1)
+ 		tsens_enable_irq(priv);
+ 
+-	tsens_debug_init(op);
+-
+ err_put_device:
+ 	put_device(&op->dev);
+ 	return ret;
+@@ -1163,7 +1161,12 @@ static int tsens_probe(struct platform_d
+ 		}
+ 	}
+ 
+-	return tsens_register(priv);
++	ret = tsens_register(priv);
++
++	if (!ret)
++		tsens_debug_init(pdev);
++
++	return ret;
+ }
+ 
+ static int tsens_remove(struct platform_device *pdev)
diff --git a/target/linux/ipq806x/patches-5.15/110-02-thermal-qcom-tsens-simplify-debugfs-init-function.patch b/target/linux/ipq806x/patches-5.15/110-02-thermal-qcom-tsens-simplify-debugfs-init-function.patch
new file mode 100644
index 00000000000000..add2ab4598767e
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/110-02-thermal-qcom-tsens-simplify-debugfs-init-function.patch
@@ -0,0 +1,54 @@
+From 4204f22060f7a5d42c6ccb4d4c25a6a875571099 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Mon, 19 Apr 2021 03:08:37 +0200
+Subject: [thermal-next PATCH v2 2/2] thermal: qcom: tsens: simplify debugfs init
+ function
+
+Simplify debugfs init function.
+- Add check for existing dev directory.
+- Fix wrong version in dbg_version_show (with version 0.0.0, 0.1.0 was
+  incorrectly reported)
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Thara Gopinath <thara.gopinath@linaro.org>
+---
+ drivers/thermal/qcom/tsens.c | 16 +++++++---------
+ 1 file changed, 7 insertions(+), 9 deletions(-)
+
+--- a/drivers/thermal/qcom/tsens.c
++++ b/drivers/thermal/qcom/tsens.c
+@@ -691,7 +691,7 @@ static int dbg_version_show(struct seq_f
+ 			return ret;
+ 		seq_printf(s, "%d.%d.%d\n", maj_ver, min_ver, step_ver);
+ 	} else {
+-		seq_puts(s, "0.1.0\n");
++		seq_printf(s, "0.%d.0\n", priv->feat->ver_major);
+ 	}
+ 
+ 	return 0;
+@@ -703,21 +703,17 @@ DEFINE_SHOW_ATTRIBUTE(dbg_sensors);
+ static void tsens_debug_init(struct platform_device *pdev)
+ {
+ 	struct tsens_priv *priv = platform_get_drvdata(pdev);
+-	struct dentry *root, *file;
+ 
+-	root = debugfs_lookup("tsens", NULL);
+-	if (!root)
++	priv->debug_root = debugfs_lookup("tsens", NULL);
++	if (!priv->debug_root)
+ 		priv->debug_root = debugfs_create_dir("tsens", NULL);
+-	else
+-		priv->debug_root = root;
+ 
+-	file = debugfs_lookup("version", priv->debug_root);
+-	if (!file)
++	if (!debugfs_lookup("version", priv->debug_root))
+ 		debugfs_create_file("version", 0444, priv->debug_root,
+ 				    pdev, &dbg_version_fops);
+ 
+ 	/* A directory for each instance of the TSENS IP */
+-	priv->debug = debugfs_create_dir(dev_name(&pdev->dev), priv->debug_root);
++	priv->debug = debugfs_lookup(dev_name(&pdev->dev), priv->debug_root);
+ 	debugfs_create_file("sensors", 0444, priv->debug, pdev, &dbg_sensors_fops);
+ }
+ #else
diff --git a/target/linux/ipq806x/patches-5.15/111-v5.19-01-PM-devfreq-Export-devfreq_get_freq_range-symbol-with.patch b/target/linux/ipq806x/patches-5.15/111-v5.19-01-PM-devfreq-Export-devfreq_get_freq_range-symbol-with.patch
new file mode 100644
index 00000000000000..6b7a68952eaf7a
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/111-v5.19-01-PM-devfreq-Export-devfreq_get_freq_range-symbol-with.patch
@@ -0,0 +1,113 @@
+From 713472e53e6e53c985e283782b0fd76b8ecfd47e Mon Sep 17 00:00:00 2001
+From: Chanwoo Choi <cw00.choi@samsung.com>
+Date: Mon, 1 Mar 2021 02:07:29 +0900
+Subject: [PATCH 1/5] PM / devfreq: Export devfreq_get_freq_range symbol within
+ devfreq
+
+In order to get frequency range within devfreq governors,
+export devfreq_get_freq_range symbol within devfreq.
+
+Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
+Tested-by: Chen-Yu Tsai <wenst@chromium.org>
+Tested-by: Johnson Wang <johnson.wang@mediatek.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+---
+ drivers/devfreq/devfreq.c  | 20 ++++++++++++--------
+ drivers/devfreq/governor.h |  2 ++
+ 2 files changed, 14 insertions(+), 8 deletions(-)
+
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -112,16 +112,16 @@ static unsigned long find_available_max_
+ }
+ 
+ /**
+- * get_freq_range() - Get the current freq range
++ * devfreq_get_freq_range() - Get the current freq range
+  * @devfreq:	the devfreq instance
+  * @min_freq:	the min frequency
+  * @max_freq:	the max frequency
+  *
+  * This takes into consideration all constraints.
+  */
+-static void get_freq_range(struct devfreq *devfreq,
+-			   unsigned long *min_freq,
+-			   unsigned long *max_freq)
++void devfreq_get_freq_range(struct devfreq *devfreq,
++			    unsigned long *min_freq,
++			    unsigned long *max_freq)
+ {
+ 	unsigned long *freq_table = devfreq->profile->freq_table;
+ 	s32 qos_min_freq, qos_max_freq;
+@@ -158,6 +158,7 @@ static void get_freq_range(struct devfre
+ 	if (*min_freq > *max_freq)
+ 		*min_freq = *max_freq;
+ }
++EXPORT_SYMBOL(devfreq_get_freq_range);
+ 
+ /**
+  * devfreq_get_freq_level() - Lookup freq_table for the frequency
+@@ -418,7 +419,7 @@ int devfreq_update_target(struct devfreq
+ 	err = devfreq->governor->get_target_freq(devfreq, &freq);
+ 	if (err)
+ 		return err;
+-	get_freq_range(devfreq, &min_freq, &max_freq);
++	devfreq_get_freq_range(devfreq, &min_freq, &max_freq);
+ 
+ 	if (freq < min_freq) {
+ 		freq = min_freq;
+@@ -784,6 +785,7 @@ struct devfreq *devfreq_add_device(struc
+ {
+ 	struct devfreq *devfreq;
+ 	struct devfreq_governor *governor;
++	unsigned long min_freq, max_freq;
+ 	int err = 0;
+ 
+ 	if (!dev || !profile || !governor_name) {
+@@ -848,6 +850,8 @@ struct devfreq *devfreq_add_device(struc
+ 		goto err_dev;
+ 	}
+ 
++	devfreq_get_freq_range(devfreq, &min_freq, &max_freq);
++
+ 	devfreq->suspend_freq = dev_pm_opp_get_suspend_opp_freq(dev);
+ 	devfreq->opp_table = dev_pm_opp_get_opp_table(dev);
+ 	if (IS_ERR(devfreq->opp_table))
+@@ -1559,7 +1563,7 @@ static ssize_t min_freq_show(struct devi
+ 	unsigned long min_freq, max_freq;
+ 
+ 	mutex_lock(&df->lock);
+-	get_freq_range(df, &min_freq, &max_freq);
++	devfreq_get_freq_range(df, &min_freq, &max_freq);
+ 	mutex_unlock(&df->lock);
+ 
+ 	return sprintf(buf, "%lu\n", min_freq);
+@@ -1613,7 +1617,7 @@ static ssize_t max_freq_show(struct devi
+ 	unsigned long min_freq, max_freq;
+ 
+ 	mutex_lock(&df->lock);
+-	get_freq_range(df, &min_freq, &max_freq);
++	devfreq_get_freq_range(df, &min_freq, &max_freq);
+ 	mutex_unlock(&df->lock);
+ 
+ 	return sprintf(buf, "%lu\n", max_freq);
+@@ -1927,7 +1931,7 @@ static int devfreq_summary_show(struct s
+ 
+ 		mutex_lock(&devfreq->lock);
+ 		cur_freq = devfreq->previous_freq;
+-		get_freq_range(devfreq, &min_freq, &max_freq);
++		devfreq_get_freq_range(devfreq, &min_freq, &max_freq);
+ 		timer = devfreq->profile->timer;
+ 
+ 		if (IS_SUPPORTED_ATTR(devfreq->governor->attrs, POLLING_INTERVAL))
+--- a/drivers/devfreq/governor.h
++++ b/drivers/devfreq/governor.h
+@@ -86,6 +86,8 @@ int devfreq_remove_governor(struct devfr
+ 
+ int devfreq_update_status(struct devfreq *devfreq, unsigned long freq);
+ int devfreq_update_target(struct devfreq *devfreq, unsigned long freq);
++void devfreq_get_freq_range(struct devfreq *devfreq, unsigned long *min_freq,
++			    unsigned long *max_freq);
+ 
+ static inline int devfreq_update_stats(struct devfreq *df)
+ {
diff --git a/target/linux/ipq806x/patches-5.15/111-v5.19-02-PM-devfreq-Add-cpu-based-scaling-support-to-passive-.patch b/target/linux/ipq806x/patches-5.15/111-v5.19-02-PM-devfreq-Add-cpu-based-scaling-support-to-passive-.patch
new file mode 100644
index 00000000000000..3dd61985b2833b
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/111-v5.19-02-PM-devfreq-Add-cpu-based-scaling-support-to-passive-.patch
@@ -0,0 +1,461 @@
+From a03dacb0316f74400846aaf144d6c73f4217ca08 Mon Sep 17 00:00:00 2001
+From: Saravana Kannan <skannan@codeaurora.org>
+Date: Tue, 2 Mar 2021 15:58:21 +0900
+Subject: [PATCH 2/5] PM / devfreq: Add cpu based scaling support to passive
+ governor
+
+Many CPU architectures have caches that can scale independent of the
+CPUs. Frequency scaling of the caches is necessary to make sure that the
+cache is not a performance bottleneck that leads to poor performance and
+power. The same idea applies for RAM/DDR.
+
+To achieve this, this patch adds support for cpu based scaling to the
+passive governor. This is accomplished by taking the current frequency
+of each CPU frequency domain and then adjust the frequency of the cache
+(or any devfreq device) based on the frequency of the CPUs. It listens
+to CPU frequency transition notifiers to keep itself up to date on the
+current CPU frequency.
+
+To decide the frequency of the device, the governor does one of the
+following:
+* Derives the optimal devfreq device opp from required-opps property of
+  the parent cpu opp_table.
+
+* Scales the device frequency in proportion to the CPU frequency. So, if
+  the CPUs are running at their max frequency, the device runs at its
+  max frequency. If the CPUs are running at their min frequency, the
+  device runs at its min frequency. It is interpolated for frequencies
+  in between.
+
+Tested-by: Chen-Yu Tsai <wenst@chromium.org>
+Tested-by: Johnson Wang <johnson.wang@mediatek.com>
+Signed-off-by: Saravana Kannan <skannan@codeaurora.org>
+[Sibi: Integrated cpu-freqmap governor into passive_governor]
+Signed-off-by: Sibi Sankar <sibis@codeaurora.org>
+[Chanwoo: Fix conflict with latest code and cleanup code]
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+---
+ drivers/devfreq/governor.h         |  22 +++
+ drivers/devfreq/governor_passive.c | 298 +++++++++++++++++++++++++++--
+ include/linux/devfreq.h            |  17 +-
+ 3 files changed, 323 insertions(+), 14 deletions(-)
+
+--- a/drivers/devfreq/governor.h
++++ b/drivers/devfreq/governor.h
+@@ -48,6 +48,28 @@
+ #define DEVFREQ_GOV_ATTR_TIMER				BIT(1)
+ 
+ /**
++ * struct devfreq_cpu_data - Hold the per-cpu data
++ * @dev:	reference to cpu device.
++ * @first_cpu:	the cpumask of the first cpu of a policy.
++ * @opp_table:	reference to cpu opp table.
++ * @cur_freq:	the current frequency of the cpu.
++ * @min_freq:	the min frequency of the cpu.
++ * @max_freq:	the max frequency of the cpu.
++ *
++ * This structure stores the required cpu_data of a cpu.
++ * This is auto-populated by the governor.
++ */
++struct devfreq_cpu_data {
++	struct device *dev;
++	unsigned int first_cpu;
++
++	struct opp_table *opp_table;
++	unsigned int cur_freq;
++	unsigned int min_freq;
++	unsigned int max_freq;
++};
++
++/**
+  * struct devfreq_governor - Devfreq policy governor
+  * @node:		list node - contains registered devfreq governors
+  * @name:		Governor's name
+--- a/drivers/devfreq/governor_passive.c
++++ b/drivers/devfreq/governor_passive.c
+@@ -8,11 +8,85 @@
+  */
+ 
+ #include <linux/module.h>
++#include <linux/cpu.h>
++#include <linux/cpufreq.h>
++#include <linux/cpumask.h>
++#include <linux/slab.h>
+ #include <linux/device.h>
+ #include <linux/devfreq.h>
+ #include "governor.h"
+ 
+-static int devfreq_passive_get_target_freq(struct devfreq *devfreq,
++#define HZ_PER_KHZ	1000
++
++static unsigned long get_target_freq_by_required_opp(struct device *p_dev,
++						struct opp_table *p_opp_table,
++						struct opp_table *opp_table,
++						unsigned long *freq)
++{
++	struct dev_pm_opp *opp = NULL, *p_opp = NULL;
++	unsigned long target_freq;
++
++	if (!p_dev || !p_opp_table || !opp_table || !freq)
++		return 0;
++
++	p_opp = devfreq_recommended_opp(p_dev, freq, 0);
++	if (IS_ERR(p_opp))
++		return 0;
++
++	opp = dev_pm_opp_xlate_required_opp(p_opp_table, opp_table, p_opp);
++	dev_pm_opp_put(p_opp);
++
++	if (IS_ERR(opp))
++		return 0;
++
++	target_freq = dev_pm_opp_get_freq(opp);
++	dev_pm_opp_put(opp);
++
++	return target_freq;
++}
++
++static int get_target_freq_with_cpufreq(struct devfreq *devfreq,
++					unsigned long *target_freq)
++{
++	struct devfreq_passive_data *p_data =
++				(struct devfreq_passive_data *)devfreq->data;
++	struct devfreq_cpu_data *parent_cpu_data;
++	unsigned long cpu, cpu_cur, cpu_min, cpu_max, cpu_percent;
++	unsigned long dev_min, dev_max;
++	unsigned long freq = 0;
++
++	for_each_online_cpu(cpu) {
++		parent_cpu_data = p_data->parent_cpu_data[cpu];
++		if (!parent_cpu_data || parent_cpu_data->first_cpu != cpu)
++			continue;
++
++		/* Get target freq via required opps */
++		cpu_cur = parent_cpu_data->cur_freq * HZ_PER_KHZ;
++		freq = get_target_freq_by_required_opp(parent_cpu_data->dev,
++					parent_cpu_data->opp_table,
++					devfreq->opp_table, &cpu_cur);
++		if (freq) {
++			*target_freq = max(freq, *target_freq);
++			continue;
++		}
++
++		/* Use interpolation if required opps is not available */
++		devfreq_get_freq_range(devfreq, &dev_min, &dev_max);
++
++		cpu_min = parent_cpu_data->min_freq;
++		cpu_max = parent_cpu_data->max_freq;
++		cpu_cur = parent_cpu_data->cur_freq;
++
++		cpu_percent = ((cpu_cur - cpu_min) * 100) / (cpu_max - cpu_min);
++		freq = dev_min + mult_frac(dev_max - dev_min, cpu_percent, 100);
++
++		*target_freq = max(freq, *target_freq);
++	}
++
++	return 0;
++}
++
++static int get_target_freq_with_devfreq(struct devfreq *devfreq,
+ 					unsigned long *freq)
+ {
+ 	struct devfreq_passive_data *p_data
+@@ -99,6 +173,181 @@ no_required_opp:
+ 	return 0;
+ }
+ 
++static int devfreq_passive_get_target_freq(struct devfreq *devfreq,
++					   unsigned long *freq)
++{
++	struct devfreq_passive_data *p_data =
++				(struct devfreq_passive_data *)devfreq->data;
++	int ret;
++
++	if (!p_data)
++		return -EINVAL;
++
++	/*
++	 * If the devfreq device with passive governor has the specific method
++	 * to determine the next frequency, should use the get_target_freq()
++	 * of struct devfreq_passive_data.
++	 */
++	if (p_data->get_target_freq)
++		return p_data->get_target_freq(devfreq, freq);
++
++	switch (p_data->parent_type) {
++	case DEVFREQ_PARENT_DEV:
++		ret = get_target_freq_with_devfreq(devfreq, freq);
++		break;
++	case CPUFREQ_PARENT_DEV:
++		ret = get_target_freq_with_cpufreq(devfreq, freq);
++		break;
++	default:
++		ret = -EINVAL;
++		dev_err(&devfreq->dev, "Invalid parent type\n");
++		break;
++	}
++
++	return ret;
++}
++
++static int cpufreq_passive_notifier_call(struct notifier_block *nb,
++					 unsigned long event, void *ptr)
++{
++	struct devfreq_passive_data *p_data =
++			container_of(nb, struct devfreq_passive_data, nb);
++	struct devfreq *devfreq = (struct devfreq *)p_data->this;
++	struct devfreq_cpu_data *parent_cpu_data;
++	struct cpufreq_freqs *freqs = ptr;
++	unsigned int cur_freq;
++	int ret;
++
++	if (event != CPUFREQ_POSTCHANGE || !freqs ||
++		!p_data->parent_cpu_data[freqs->policy->cpu])
++		return 0;
++
++	parent_cpu_data = p_data->parent_cpu_data[freqs->policy->cpu];
++	if (parent_cpu_data->cur_freq == freqs->new)
++		return 0;
++
++	cur_freq = parent_cpu_data->cur_freq;
++	parent_cpu_data->cur_freq = freqs->new;
++
++	mutex_lock(&devfreq->lock);
++	ret = devfreq_update_target(devfreq, freqs->new);
++	mutex_unlock(&devfreq->lock);
++	if (ret) {
++		parent_cpu_data->cur_freq = cur_freq;
++		dev_err(&devfreq->dev, "failed to update the frequency.\n");
++		return ret;
++	}
++
++	return 0;
++}
++
++static int cpufreq_passive_unregister_notifier(struct devfreq *devfreq)
++{
++	struct devfreq_passive_data *p_data
++			= (struct devfreq_passive_data *)devfreq->data;
++	struct devfreq_cpu_data *parent_cpu_data;
++	int cpu, ret;
++
++	if (p_data->nb.notifier_call) {
++		ret = cpufreq_unregister_notifier(&p_data->nb,
++					CPUFREQ_TRANSITION_NOTIFIER);
++		if (ret < 0)
++			return ret;
++	}
++
++	for_each_possible_cpu(cpu) {
++		parent_cpu_data = p_data->parent_cpu_data[cpu];
++		if (!parent_cpu_data)
++			continue;
++
++		if (parent_cpu_data->opp_table)
++			dev_pm_opp_put_opp_table(parent_cpu_data->opp_table);
++		kfree(parent_cpu_data);
++	}
++
++	return 0;
++}
++
++static int cpufreq_passive_register_notifier(struct devfreq *devfreq)
++{
++	struct devfreq_passive_data *p_data
++			= (struct devfreq_passive_data *)devfreq->data;
++	struct device *dev = devfreq->dev.parent;
++	struct opp_table *opp_table = NULL;
++	struct devfreq_cpu_data *parent_cpu_data;
++	struct cpufreq_policy *policy;
++	struct device *cpu_dev;
++	unsigned int cpu;
++	int ret;
++
++	p_data->nb.notifier_call = cpufreq_passive_notifier_call;
++	ret = cpufreq_register_notifier(&p_data->nb, CPUFREQ_TRANSITION_NOTIFIER);
++	if (ret) {
++		dev_err(dev, "failed to register cpufreq notifier\n");
++		p_data->nb.notifier_call = NULL;
++		goto err;
++	}
++
++	for_each_possible_cpu(cpu) {
++		if (p_data->parent_cpu_data[cpu])
++			continue;
++
++		policy = cpufreq_cpu_get(cpu);
++		if (!policy) {
++			ret = -EPROBE_DEFER;
++			goto err;
++		}
++
++		parent_cpu_data = kzalloc(sizeof(*parent_cpu_data),
++						GFP_KERNEL);
++		if (!parent_cpu_data) {
++			ret = -ENOMEM;
++			goto err_put_policy;
++		}
++
++		cpu_dev = get_cpu_device(cpu);
++		if (!cpu_dev) {
++			dev_err(dev, "failed to get cpu device\n");
++			ret = -ENODEV;
++			goto err_free_cpu_data;
++		}
++
++		opp_table = dev_pm_opp_get_opp_table(cpu_dev);
++		if (IS_ERR(opp_table)) {
++			dev_err(dev, "failed to get opp_table of cpu%d\n", cpu);
++			ret = PTR_ERR(opp_table);
++			goto err_free_cpu_data;
++		}
++
++		parent_cpu_data->dev = cpu_dev;
++		parent_cpu_data->opp_table = opp_table;
++		parent_cpu_data->first_cpu = cpumask_first(policy->related_cpus);
++		parent_cpu_data->cur_freq = policy->cur;
++		parent_cpu_data->min_freq = policy->cpuinfo.min_freq;
++		parent_cpu_data->max_freq = policy->cpuinfo.max_freq;
++
++		p_data->parent_cpu_data[cpu] = parent_cpu_data;
++		cpufreq_cpu_put(policy);
++	}
++
++	mutex_lock(&devfreq->lock);
++	ret = devfreq_update_target(devfreq, 0L);
++	mutex_unlock(&devfreq->lock);
++	if (ret)
++		dev_err(dev, "failed to update the frequency\n");
++
++	return ret;
++
++err_free_cpu_data:
++	kfree(parent_cpu_data);
++err_put_policy:
++	cpufreq_cpu_put(policy);
++err:
++	WARN_ON(cpufreq_passive_unregister_notifier(devfreq));
++
++	return ret;
++}
++
+ static int devfreq_passive_notifier_call(struct notifier_block *nb,
+ 				unsigned long event, void *ptr)
+ {
+@@ -131,30 +380,55 @@ static int devfreq_passive_notifier_call
+ 	return NOTIFY_DONE;
+ }
+ 
+-static int devfreq_passive_event_handler(struct devfreq *devfreq,
+-				unsigned int event, void *data)
++static int devfreq_passive_unregister_notifier(struct devfreq *devfreq)
++{
++	struct devfreq_passive_data *p_data
++			= (struct devfreq_passive_data *)devfreq->data;
++	struct devfreq *parent = (struct devfreq *)p_data->parent;
++	struct notifier_block *nb = &p_data->nb;
++
++	return devfreq_unregister_notifier(parent, nb, DEVFREQ_TRANSITION_NOTIFIER);
++}
++
++static int devfreq_passive_register_notifier(struct devfreq *devfreq)
+ {
+ 	struct devfreq_passive_data *p_data
+ 			= (struct devfreq_passive_data *)devfreq->data;
+ 	struct devfreq *parent = (struct devfreq *)p_data->parent;
+ 	struct notifier_block *nb = &p_data->nb;
+-	int ret = 0;
+ 
+ 	if (!parent)
+ 		return -EPROBE_DEFER;
+ 
++	nb->notifier_call = devfreq_passive_notifier_call;
++	return devfreq_register_notifier(parent, nb, DEVFREQ_TRANSITION_NOTIFIER);
++}
++
++static int devfreq_passive_event_handler(struct devfreq *devfreq,
++				unsigned int event, void *data)
++{
++	struct devfreq_passive_data *p_data
++			= (struct devfreq_passive_data *)devfreq->data;
++	int ret = -EINVAL;
++
++	if (!p_data)
++		return -EINVAL;
++
++	if (!p_data->this)
++		p_data->this = devfreq;
++
+ 	switch (event) {
+ 	case DEVFREQ_GOV_START:
+-		if (!p_data->this)
+-			p_data->this = devfreq;
+-
+-		nb->notifier_call = devfreq_passive_notifier_call;
+-		ret = devfreq_register_notifier(parent, nb,
+-					DEVFREQ_TRANSITION_NOTIFIER);
++		if (p_data->parent_type == DEVFREQ_PARENT_DEV)
++			ret = devfreq_passive_register_notifier(devfreq);
++		else if (p_data->parent_type == CPUFREQ_PARENT_DEV)
++			ret = cpufreq_passive_register_notifier(devfreq);
+ 		break;
+ 	case DEVFREQ_GOV_STOP:
+-		WARN_ON(devfreq_unregister_notifier(parent, nb,
+-					DEVFREQ_TRANSITION_NOTIFIER));
++		if (p_data->parent_type == DEVFREQ_PARENT_DEV)
++			WARN_ON(devfreq_passive_unregister_notifier(devfreq));
++		else if (p_data->parent_type == CPUFREQ_PARENT_DEV)
++			WARN_ON(cpufreq_passive_unregister_notifier(devfreq));
+ 		break;
+ 	default:
+ 		break;
+--- a/include/linux/devfreq.h
++++ b/include/linux/devfreq.h
+@@ -38,6 +38,7 @@ enum devfreq_timer {
+ 
+ struct devfreq;
+ struct devfreq_governor;
++struct devfreq_cpu_data;
+ struct thermal_cooling_device;
+ 
+ /**
+@@ -289,6 +290,11 @@ struct devfreq_simple_ondemand_data {
+ #endif
+ 
+ #if IS_ENABLED(CONFIG_DEVFREQ_GOV_PASSIVE)
++enum devfreq_parent_dev_type {
++	DEVFREQ_PARENT_DEV,
++	CPUFREQ_PARENT_DEV,
++};
++
+ /**
+  * struct devfreq_passive_data - ``void *data`` fed to struct devfreq
+  *	and devfreq_add_device
+@@ -300,8 +306,11 @@ struct devfreq_simple_ondemand_data {
+  *			using governors except for passive governor.
+  *			If the devfreq device has the specific method to decide
+  *			the next frequency, should use this callback.
+- * @this:	the devfreq instance of own device.
+- * @nb:		the notifier block for DEVFREQ_TRANSITION_NOTIFIER list
++ * @parent_type:	the parent type of the device.
++ * @this:		the devfreq instance of own device.
++ * @nb:			the notifier block for DEVFREQ_TRANSITION_NOTIFIER or
++ *			CPUFREQ_TRANSITION_NOTIFIER list.
++ * @parent_cpu_data:	the state min/max/current frequency of all online cpu's.
+  *
+  * The devfreq_passive_data have to set the devfreq instance of parent
+  * device with governors except for the passive governor. But, don't need to
+@@ -315,9 +324,13 @@ struct devfreq_passive_data {
+ 	/* Optional callback to decide the next frequency of passvice device */
+ 	int (*get_target_freq)(struct devfreq *this, unsigned long *freq);
+ 
++	/* Should set the type of parent device */
++	enum devfreq_parent_dev_type parent_type;
++
+ 	/* For passive governor's internal use. Don't need to set them */
+ 	struct devfreq *this;
+ 	struct notifier_block nb;
++	struct devfreq_cpu_data *parent_cpu_data[NR_CPUS];
+ };
+ #endif
+ 
diff --git a/target/linux/ipq806x/patches-5.15/111-v5.19-03-PM-devfreq-passive-Reduce-duplicate-code-when-passiv.patch b/target/linux/ipq806x/patches-5.15/111-v5.19-03-PM-devfreq-passive-Reduce-duplicate-code-when-passiv.patch
new file mode 100644
index 00000000000000..cb10bd1b62cd2a
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/111-v5.19-03-PM-devfreq-passive-Reduce-duplicate-code-when-passiv.patch
@@ -0,0 +1,110 @@
+From 05723e71234b60a1a47313ea1a889797ec648f1c Mon Sep 17 00:00:00 2001
+From: Chanwoo Choi <cw00.choi@samsung.com>
+Date: Tue, 2 Mar 2021 17:22:50 +0900
+Subject: [PATCH 3/5] PM / devfreq: passive: Reduce duplicate code when
+ passive_devfreq case
+
+In order to keep the consistent coding style between passive_devfreq
+and passive_cpufreq, use common code for handling required opp property.
+Also remove the unneed conditional statement and unify the comment
+of both passive_devfreq and passive_cpufreq when getting the target frequency.
+
+Tested-by: Chen-Yu Tsai <wenst@chromium.org>
+Tested-by: Johnson Wang <johnson.wang@mediatek.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+---
+ drivers/devfreq/governor_passive.c | 66 ++++--------------------------
+ 1 file changed, 8 insertions(+), 58 deletions(-)
+
+--- a/drivers/devfreq/governor_passive.c
++++ b/drivers/devfreq/governor_passive.c
+@@ -93,65 +93,16 @@ static int get_target_freq_with_devfreq(
+ 			= (struct devfreq_passive_data *)devfreq->data;
+ 	struct devfreq *parent_devfreq = (struct devfreq *)p_data->parent;
+ 	unsigned long child_freq = ULONG_MAX;
+-	struct dev_pm_opp *opp, *p_opp;
+ 	int i, count;
+ 
+-	/*
+-	 * If the devfreq device with passive governor has the specific method
+-	 * to determine the next frequency, should use the get_target_freq()
+-	 * of struct devfreq_passive_data.
+-	 */
+-	if (p_data->get_target_freq)
+-		return p_data->get_target_freq(devfreq, freq);
+-
+-	/*
+-	 * If the parent and passive devfreq device uses the OPP table,
+-	 * get the next frequency by using the OPP table.
+-	 */
+-
+-	/*
+-	 * - parent devfreq device uses the governors except for passive.
+-	 * - passive devfreq device uses the passive governor.
+-	 *
+-	 * Each devfreq has the OPP table. After deciding the new frequency
+-	 * from the governor of parent devfreq device, the passive governor
+-	 * need to get the index of new frequency on OPP table of parent
+-	 * device. And then the index is used for getting the suitable
+-	 * new frequency for passive devfreq device.
+-	 */
+-	if (!devfreq->profile || !devfreq->profile->freq_table
+-		|| devfreq->profile->max_state <= 0)
+-		return -EINVAL;
+-
+-	/*
+-	 * The passive governor have to get the correct frequency from OPP
+-	 * list of parent device. Because in this case, *freq is temporary
+-	 * value which is decided by ondemand governor.
+-	 */
+-	if (devfreq->opp_table && parent_devfreq->opp_table) {
+-		p_opp = devfreq_recommended_opp(parent_devfreq->dev.parent,
+-						freq, 0);
+-		if (IS_ERR(p_opp))
+-			return PTR_ERR(p_opp);
+-
+-		opp = dev_pm_opp_xlate_required_opp(parent_devfreq->opp_table,
+-						    devfreq->opp_table, p_opp);
+-		dev_pm_opp_put(p_opp);
+-
+-		if (IS_ERR(opp))
+-			goto no_required_opp;
+-
+-		*freq = dev_pm_opp_get_freq(opp);
+-		dev_pm_opp_put(opp);
+-
+-		return 0;
+-	}
++	/* Get target freq via required opps */
++	child_freq = get_target_freq_by_required_opp(parent_devfreq->dev.parent,
++						parent_devfreq->opp_table,
++						devfreq->opp_table, freq);
++	if (child_freq)
++		goto out;
+ 
+-no_required_opp:
+-	/*
+-	 * Get the OPP table's index of decided frequency by governor
+-	 * of parent device.
+-	 */
++	/* Use interpolation if required opps is not available */
+ 	for (i = 0; i < parent_devfreq->profile->max_state; i++)
+ 		if (parent_devfreq->profile->freq_table[i] == *freq)
+ 			break;
+@@ -159,7 +110,6 @@ no_required_opp:
+ 	if (i == parent_devfreq->profile->max_state)
+ 		return -EINVAL;
+ 
+-	/* Get the suitable frequency by using index of parent device. */
+ 	if (i < devfreq->profile->max_state) {
+ 		child_freq = devfreq->profile->freq_table[i];
+ 	} else {
+@@ -167,7 +117,7 @@ no_required_opp:
+ 		child_freq = devfreq->profile->freq_table[count - 1];
+ 	}
+ 
+-	/* Return the suitable frequency for passive device. */
++out:
+ 	*freq = child_freq;
+ 
+ 	return 0;
diff --git a/target/linux/ipq806x/patches-5.15/111-v5.19-04-PM-devfreq-passive-Keep-cpufreq_policy-for-possible-.patch b/target/linux/ipq806x/patches-5.15/111-v5.19-04-PM-devfreq-passive-Keep-cpufreq_policy-for-possible-.patch
new file mode 100644
index 00000000000000..9ef02d0ea35d69
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/111-v5.19-04-PM-devfreq-passive-Keep-cpufreq_policy-for-possible-.patch
@@ -0,0 +1,232 @@
+From 26984d9d581e5049bd75091d2e789b9cc3ea12e0 Mon Sep 17 00:00:00 2001
+From: Chanwoo Choi <cw00.choi@samsung.com>
+Date: Wed, 27 Apr 2022 03:49:19 +0900
+Subject: [PATCH 4/5] PM / devfreq: passive: Keep cpufreq_policy for possible
+ cpus
+
+The passive governor requires the cpu data to get the next target frequency
+of devfreq device if depending on cpu. In order to reduce the unnecessary
+memory data, keep cpufreq_policy data for possible cpus instead of NR_CPU.
+
+Tested-by: Chen-Yu Tsai <wenst@chromium.org>
+Tested-by: Johnson Wang <johnson.wang@mediatek.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+---
+ drivers/devfreq/governor.h         |  3 ++
+ drivers/devfreq/governor_passive.c | 75 +++++++++++++++++++++++-------
+ include/linux/devfreq.h            |  4 +-
+ 3 files changed, 64 insertions(+), 18 deletions(-)
+
+--- a/drivers/devfreq/governor.h
++++ b/drivers/devfreq/governor.h
+@@ -49,6 +49,7 @@
+ 
+ /**
+  * struct devfreq_cpu_data - Hold the per-cpu data
++ * @node:	list node
+  * @dev:	reference to cpu device.
+  * @first_cpu:	the cpumask of the first cpu of a policy.
+  * @opp_table:	reference to cpu opp table.
+@@ -60,6 +61,8 @@
+  * This is auto-populated by the governor.
+  */
+ struct devfreq_cpu_data {
++	struct list_head node;
++
+ 	struct device *dev;
+ 	unsigned int first_cpu;
+ 
+--- a/drivers/devfreq/governor_passive.c
++++ b/drivers/devfreq/governor_passive.c
+@@ -1,4 +1,4 @@
+-// SPDX-License-Identifier: GPL-2.0-only
++	// SPDX-License-Identifier: GPL-2.0-only
+ /*
+  * linux/drivers/devfreq/governor_passive.c
+  *
+@@ -18,6 +18,22 @@
+ 
+ #define HZ_PER_KHZ	1000
+ 
++static struct devfreq_cpu_data *
++get_parent_cpu_data(struct devfreq_passive_data *p_data,
++		    struct cpufreq_policy *policy)
++{
++	struct devfreq_cpu_data *parent_cpu_data;
++
++	if (!p_data || !policy)
++		return NULL;
++
++	list_for_each_entry(parent_cpu_data, &p_data->cpu_data_list, node)
++		if (parent_cpu_data->first_cpu == cpumask_first(policy->related_cpus))
++			return parent_cpu_data;
++
++	return NULL;
++}
++
+ static unsigned long get_target_freq_by_required_opp(struct device *p_dev,
+ 						struct opp_table *p_opp_table,
+ 						struct opp_table *opp_table,
+@@ -51,14 +67,24 @@ static int get_target_freq_with_cpufreq(
+ 	struct devfreq_passive_data *p_data =
+ 				(struct devfreq_passive_data *)devfreq->data;
+ 	struct devfreq_cpu_data *parent_cpu_data;
++	struct cpufreq_policy *policy;
+ 	unsigned long cpu, cpu_cur, cpu_min, cpu_max, cpu_percent;
+ 	unsigned long dev_min, dev_max;
+ 	unsigned long freq = 0;
++	int ret = 0;
+ 
+ 	for_each_online_cpu(cpu) {
+-		parent_cpu_data = p_data->parent_cpu_data[cpu];
+-		if (!parent_cpu_data || parent_cpu_data->first_cpu != cpu)
++		policy = cpufreq_cpu_get(cpu);
++		if (!policy) {
++			ret = -EINVAL;
++			continue;
++		}
++
++		parent_cpu_data = get_parent_cpu_data(p_data, policy);
++		if (!parent_cpu_data) {
++			cpufreq_cpu_put(policy);
+ 			continue;
++		}
+ 
+ 		/* Get target freq via required opps */
+ 		cpu_cur = parent_cpu_data->cur_freq * HZ_PER_KHZ;
+@@ -67,6 +93,7 @@ static int get_target_freq_with_cpufreq(
+ 					devfreq->opp_table, &cpu_cur);
+ 		if (freq) {
+ 			*target_freq = max(freq, *target_freq);
++			cpufreq_cpu_put(policy);
+ 			continue;
+ 		}
+ 
+@@ -81,9 +108,10 @@ static int get_target_freq_with_cpufreq(
+ 		freq = dev_min + mult_frac(dev_max - dev_min, cpu_percent, 100);
+ 
+ 		*target_freq = max(freq, *target_freq);
++		cpufreq_cpu_put(policy);
+ 	}
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ static int get_target_freq_with_devfreq(struct devfreq *devfreq,
+@@ -168,12 +196,11 @@ static int cpufreq_passive_notifier_call
+ 	unsigned int cur_freq;
+ 	int ret;
+ 
+-	if (event != CPUFREQ_POSTCHANGE || !freqs ||
+-		!p_data->parent_cpu_data[freqs->policy->cpu])
++	if (event != CPUFREQ_POSTCHANGE || !freqs)
+ 		return 0;
+ 
+-	parent_cpu_data = p_data->parent_cpu_data[freqs->policy->cpu];
+-	if (parent_cpu_data->cur_freq == freqs->new)
++	parent_cpu_data = get_parent_cpu_data(p_data, freqs->policy);
++	if (!parent_cpu_data || parent_cpu_data->cur_freq == freqs->new)
+ 		return 0;
+ 
+ 	cur_freq = parent_cpu_data->cur_freq;
+@@ -196,7 +223,7 @@ static int cpufreq_passive_unregister_no
+ 	struct devfreq_passive_data *p_data
+ 			= (struct devfreq_passive_data *)devfreq->data;
+ 	struct devfreq_cpu_data *parent_cpu_data;
+-	int cpu, ret;
++	int cpu, ret = 0;
+ 
+ 	if (p_data->nb.notifier_call) {
+ 		ret = cpufreq_unregister_notifier(&p_data->nb,
+@@ -206,16 +233,26 @@ static int cpufreq_passive_unregister_no
+ 	}
+ 
+ 	for_each_possible_cpu(cpu) {
+-		parent_cpu_data = p_data->parent_cpu_data[cpu];
+-		if (!parent_cpu_data)
++		struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
++		if (!policy) {
++			ret = -EINVAL;
++			continue;
++		}
++
++		parent_cpu_data = get_parent_cpu_data(p_data, policy);
++		if (!parent_cpu_data) {
++			cpufreq_cpu_put(policy);
+ 			continue;
++		}
+ 
++		list_del(&parent_cpu_data->node);
+ 		if (parent_cpu_data->opp_table)
+ 			dev_pm_opp_put_opp_table(parent_cpu_data->opp_table);
+ 		kfree(parent_cpu_data);
++		cpufreq_cpu_put(policy);
+ 	}
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ static int cpufreq_passive_register_notifier(struct devfreq *devfreq)
+@@ -230,6 +267,9 @@ static int cpufreq_passive_register_noti
+ 	unsigned int cpu;
+ 	int ret;
+ 
++	p_data->cpu_data_list
++		= (struct list_head)LIST_HEAD_INIT(p_data->cpu_data_list);
++
+ 	p_data->nb.notifier_call = cpufreq_passive_notifier_call;
+ 	ret = cpufreq_register_notifier(&p_data->nb, CPUFREQ_TRANSITION_NOTIFIER);
+ 	if (ret) {
+@@ -239,15 +279,18 @@ static int cpufreq_passive_register_noti
+ 	}
+ 
+ 	for_each_possible_cpu(cpu) {
+-		if (p_data->parent_cpu_data[cpu])
+-			continue;
+-
+ 		policy = cpufreq_cpu_get(cpu);
+ 		if (!policy) {
+ 			ret = -EPROBE_DEFER;
+ 			goto err;
+ 		}
+ 
++		parent_cpu_data = get_parent_cpu_data(p_data, policy);
++		if (parent_cpu_data) {
++			cpufreq_cpu_put(policy);
++			continue;
++		}
++
+ 		parent_cpu_data = kzalloc(sizeof(*parent_cpu_data),
+ 						GFP_KERNEL);
+ 		if (!parent_cpu_data) {
+@@ -276,7 +319,7 @@ static int cpufreq_passive_register_noti
+ 		parent_cpu_data->min_freq = policy->cpuinfo.min_freq;
+ 		parent_cpu_data->max_freq = policy->cpuinfo.max_freq;
+ 
+-		p_data->parent_cpu_data[cpu] = parent_cpu_data;
++		list_add_tail(&parent_cpu_data->node, &p_data->cpu_data_list);
+ 		cpufreq_cpu_put(policy);
+ 	}
+ 
+--- a/include/linux/devfreq.h
++++ b/include/linux/devfreq.h
+@@ -310,7 +310,7 @@ enum devfreq_parent_dev_type {
+  * @this:		the devfreq instance of own device.
+  * @nb:			the notifier block for DEVFREQ_TRANSITION_NOTIFIER or
+  *			CPUFREQ_TRANSITION_NOTIFIER list.
+- * @parent_cpu_data:	the state min/max/current frequency of all online cpu's.
++ * @cpu_data_list:	the list of cpu frequency data for all cpufreq_policy.
+  *
+  * The devfreq_passive_data have to set the devfreq instance of parent
+  * device with governors except for the passive governor. But, don't need to
+@@ -330,7 +330,7 @@ struct devfreq_passive_data {
+ 	/* For passive governor's internal use. Don't need to set them */
+ 	struct devfreq *this;
+ 	struct notifier_block nb;
+-	struct devfreq_cpu_data *parent_cpu_data[NR_CPUS];
++	struct list_head cpu_data_list;
+ };
+ #endif
+ 
diff --git a/target/linux/ipq806x/patches-5.15/111-v5.19-05-PM-devfreq-passive-Return-non-error-when-not-support.patch b/target/linux/ipq806x/patches-5.15/111-v5.19-05-PM-devfreq-passive-Return-non-error-when-not-support.patch
new file mode 100644
index 00000000000000..69160fd77a57b1
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/111-v5.19-05-PM-devfreq-passive-Return-non-error-when-not-support.patch
@@ -0,0 +1,31 @@
+From 42d2607d91c4ec37ea1970899c2d614824f3014b Mon Sep 17 00:00:00 2001
+From: Chanwoo Choi <cw00.choi@samsung.com>
+Date: Thu, 19 May 2022 10:07:53 +0900
+Subject: [PATCH 5/5] PM / devfreq: passive: Return non-error when
+ not-supported event is required
+
+Each devfreq governor specifies the supported governor event
+such as GOV_START and GOV_STOP. When not-supported event is required,
+just return non-error. But, commit ce9a0d88d97a ("PM / devfreq: Add
+cpu based scaling support to passive governor") returned the error
+value. So that return non-error value when not-supported event is required.
+
+Fixes: ce9a0d88d97a ("PM / devfreq: Add cpu based scaling support to passive governor")
+Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+---
+ drivers/devfreq/governor_passive.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/devfreq/governor_passive.c
++++ b/drivers/devfreq/governor_passive.c
+@@ -402,7 +402,7 @@ static int devfreq_passive_event_handler
+ {
+ 	struct devfreq_passive_data *p_data
+ 			= (struct devfreq_passive_data *)devfreq->data;
+-	int ret = -EINVAL;
++	int ret = 0;
+ 
+ 	if (!p_data)
+ 		return -EINVAL;
diff --git a/target/linux/ipq806x/patches-5.15/112-v5.19-PM-devfreq-Fix-kernel-warning-with-cpufreq-passive-r.patch b/target/linux/ipq806x/patches-5.15/112-v5.19-PM-devfreq-Fix-kernel-warning-with-cpufreq-passive-r.patch
new file mode 100644
index 00000000000000..3d2bb2de05b0bc
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/112-v5.19-PM-devfreq-Fix-kernel-warning-with-cpufreq-passive-r.patch
@@ -0,0 +1,31 @@
+From 82c66d2bbbeda9e493487e7413769087a0b46250 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 20 Jun 2022 00:29:39 +0200
+Subject: [PATCH 1/1] PM / devfreq: Fix kernel warning with cpufreq passive
+ register fail
+
+Remove cpufreq_passive_unregister_notifier from
+cpufreq_passive_register_notifier in case of error as devfreq core
+already call unregister on GOV_START fail.
+
+This fix the kernel always printing a WARN on governor PROBE_DEFER as
+cpufreq_passive_unregister_notifier is called two times and return
+error on the second call as the cpufreq is already unregistered.
+
+Fixes: a03dacb0316f ("PM / devfreq: Add cpu based scaling support to passive governor")
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+---
+ drivers/devfreq/governor_passive.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/devfreq/governor_passive.c
++++ b/drivers/devfreq/governor_passive.c
+@@ -336,7 +336,6 @@ err_free_cpu_data:
+ err_put_policy:
+ 	cpufreq_cpu_put(policy);
+ err:
+-	WARN_ON(cpufreq_passive_unregister_notifier(devfreq));
+ 
+ 	return ret;
+ }
diff --git a/target/linux/ipq806x/patches-5.15/113-v5.19-01-PM-devfreq-Fix-cpufreq-passive-unregister-errorin.patch b/target/linux/ipq806x/patches-5.15/113-v5.19-01-PM-devfreq-Fix-cpufreq-passive-unregister-errorin.patch
new file mode 100644
index 00000000000000..088342454869b6
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/113-v5.19-01-PM-devfreq-Fix-cpufreq-passive-unregister-errorin.patch
@@ -0,0 +1,85 @@
+From 8953603eb5447be52f6fc3d8fcae1b3ce9899189 Mon Sep 17 00:00:00 2001
+From: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
+Date: Mon, 6 Jun 2022 11:58:49 +0200
+Subject: [PATCH v4 1/4] PM / devfreq: Fix cpufreq passive unregister erroring
+ on PROBE_DEFER
+
+With the passive governor, the cpu based scaling can PROBE_DEFER due to
+the fact that CPU policy are not ready.
+The cpufreq passive unregister notifier is called both from the
+GOV_START errors and for the GOV_STOP and assume the notifier is
+successfully registred every time. With GOV_START failing it's wrong to
+loop over each possible CPU since the register path has failed for
+some CPU policy not ready. Change the logic and unregister the notifer
+based on the current allocated parent_cpu_data list to correctly handle
+errors and the governor unregister path.
+
+Fixes: a03dacb0316f ("PM / devfreq: Add cpu based scaling support to passive governor")
+Signed-off-by: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
+---
+ drivers/devfreq/governor_passive.c | 39 +++++++++++++-----------------
+ 1 file changed, 17 insertions(+), 22 deletions(-)
+
+--- a/drivers/devfreq/governor_passive.c
++++ b/drivers/devfreq/governor_passive.c
+@@ -34,6 +34,20 @@ get_parent_cpu_data(struct devfreq_passi
+ 	return NULL;
+ }
+ 
++static void delete_parent_cpu_data(struct devfreq_passive_data *p_data)
++{
++	struct devfreq_cpu_data *parent_cpu_data, *tmp;
++
++	list_for_each_entry_safe(parent_cpu_data, tmp, &p_data->cpu_data_list, node) {
++		list_del(&parent_cpu_data->node);
++
++		if (parent_cpu_data->opp_table)
++			dev_pm_opp_put_opp_table(parent_cpu_data->opp_table);
++
++		kfree(parent_cpu_data);
++	}
++}
++
+ static unsigned long get_target_freq_by_required_opp(struct device *p_dev,
+ 						struct opp_table *p_opp_table,
+ 						struct opp_table *opp_table,
+@@ -222,8 +236,7 @@ static int cpufreq_passive_unregister_no
+ {
+ 	struct devfreq_passive_data *p_data
+ 			= (struct devfreq_passive_data *)devfreq->data;
+-	struct devfreq_cpu_data *parent_cpu_data;
+-	int cpu, ret = 0;
++	int ret;
+ 
+ 	if (p_data->nb.notifier_call) {
+ 		ret = cpufreq_unregister_notifier(&p_data->nb,
+@@ -232,27 +245,9 @@ static int cpufreq_passive_unregister_no
+ 			return ret;
+ 	}
+ 
+-	for_each_possible_cpu(cpu) {
+-		struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
+-		if (!policy) {
+-			ret = -EINVAL;
+-			continue;
+-		}
+-
+-		parent_cpu_data = get_parent_cpu_data(p_data, policy);
+-		if (!parent_cpu_data) {
+-			cpufreq_cpu_put(policy);
+-			continue;
+-		}
+-
+-		list_del(&parent_cpu_data->node);
+-		if (parent_cpu_data->opp_table)
+-			dev_pm_opp_put_opp_table(parent_cpu_data->opp_table);
+-		kfree(parent_cpu_data);
+-		cpufreq_cpu_put(policy);
+-	}
++	delete_parent_cpu_data(p_data);
+ 
+-	return ret;
++	return 0;
+ }
+ 
+ static int cpufreq_passive_register_notifier(struct devfreq *devfreq)
diff --git a/target/linux/ipq806x/patches-5.15/113-v5.19-02-PM-devfreq-Fix-kernel-panic-with-cpu-based-scaling-t.patch b/target/linux/ipq806x/patches-5.15/113-v5.19-02-PM-devfreq-Fix-kernel-panic-with-cpu-based-scaling-t.patch
new file mode 100644
index 00000000000000..867ea83e0c91d3
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/113-v5.19-02-PM-devfreq-Fix-kernel-panic-with-cpu-based-scaling-t.patch
@@ -0,0 +1,34 @@
+From 57e00b40033a376de3f3cf0bb9bf7590d2dd679d Mon Sep 17 00:00:00 2001
+From: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
+Date: Tue, 14 Jun 2022 13:06:59 +0200
+Subject: [PATCH 1/1] PM / devfreq: Fix kernel panic with cpu based scaling to
+ passive gov
+
+The cpufreq passive register notifier can PROBE_DEFER and the devfreq
+struct is freed and then reallocaed on probe retry.
+The current logic assume that the code can't PROBE_DEFER so the devfreq
+struct in the this variable in devfreq_passive_data is assumed to be
+(if already set) always correct.
+This cause kernel panic as the code try to access the wrong address.
+To correctly handle this, update the this variable in
+devfreq_passive_data to the devfreq reallocated struct.
+
+Fixes: a03dacb0316f ("PM / devfreq: Add cpu based scaling support to passive governor")
+Signed-off-by: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+---
+ drivers/devfreq/governor_passive.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/devfreq/governor_passive.c
++++ b/drivers/devfreq/governor_passive.c
+@@ -401,8 +401,7 @@ static int devfreq_passive_event_handler
+ 	if (!p_data)
+ 		return -EINVAL;
+ 
+-	if (!p_data->this)
+-		p_data->this = devfreq;
++	p_data->this = devfreq;
+ 
+ 	switch (event) {
+ 	case DEVFREQ_GOV_START:
diff --git a/target/linux/ipq806x/patches-5.15/113-v5.19-03-PM-devfreq-Rework-freq_table-to-be-local-to-devfr.patch b/target/linux/ipq806x/patches-5.15/113-v5.19-03-PM-devfreq-Rework-freq_table-to-be-local-to-devfr.patch
new file mode 100644
index 00000000000000..210f57bd7e65d7
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/113-v5.19-03-PM-devfreq-Rework-freq_table-to-be-local-to-devfr.patch
@@ -0,0 +1,269 @@
+From 46d05776a1a5dd8eb479e868f5ff4f4b97d68238 Mon Sep 17 00:00:00 2001
+From: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
+Date: Mon, 6 Jun 2022 12:39:19 +0200
+Subject: [PATCH v4 3/4] PM / devfreq: Rework freq_table to be local to devfreq
+ struct
+
+Currently we reference the freq_table to the profile defined one and we
+make changes on it. Devfreq never supported PROBE_DEFER before the cpu
+based scaling support to the passive governor and assumed that a devfreq
+device could only had error and be done with it.
+Now that a device can PROBE_DEFER a rework to the freq_table logic is
+required.
+
+If a device PROBE_DEFER on the GOV_START, the freq_table is already set
+in the device profile struct and its init is skipped. This is due to the
+fact that it's common for devs to declare this kind of struct static.
+This cause the devfreq logic to find a freq table declared (freq_table
+not NULL) with random data and poiting to the old addrs freed by devm.
+
+This problem CAN be solved by devs by clearing the freq_table in their
+profile struct on driver exit path but it should not be trusted and it
+looks to use a flawed logic.
+
+A better solution is to move the freq_table and max_state to the
+devfreq struct and never change the profile struct.
+This permit to correctly handle PROBE_DEFER since the devfreq struct is
+reallocated and contains new values.
+Also the profile struct should only be used to init the driver and should
+not be used by the devfreq to write the freq_table if it's not provided
+by the driver.
+
+Fixes: a03dacb0316f ("PM / devfreq: Add cpu based scaling support to passive governor")
+Signed-off-by: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
+---
+ drivers/devfreq/devfreq.c          | 71 ++++++++++++++----------------
+ drivers/devfreq/governor_passive.c | 14 +++---
+ include/linux/devfreq.h            |  4 ++
+ 3 files changed, 45 insertions(+), 44 deletions(-)
+
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -123,7 +123,7 @@ void devfreq_get_freq_range(struct devfr
+ 			    unsigned long *min_freq,
+ 			    unsigned long *max_freq)
+ {
+-	unsigned long *freq_table = devfreq->profile->freq_table;
++	unsigned long *freq_table = devfreq->freq_table;
+ 	s32 qos_min_freq, qos_max_freq;
+ 
+ 	lockdep_assert_held(&devfreq->lock);
+@@ -133,11 +133,11 @@ void devfreq_get_freq_range(struct devfr
+ 	 * The devfreq drivers can initialize this in either ascending or
+ 	 * descending order and devfreq core supports both.
+ 	 */
+-	if (freq_table[0] < freq_table[devfreq->profile->max_state - 1]) {
++	if (freq_table[0] < freq_table[devfreq->max_state - 1]) {
+ 		*min_freq = freq_table[0];
+-		*max_freq = freq_table[devfreq->profile->max_state - 1];
++		*max_freq = freq_table[devfreq->max_state - 1];
+ 	} else {
+-		*min_freq = freq_table[devfreq->profile->max_state - 1];
++		*min_freq = freq_table[devfreq->max_state - 1];
+ 		*max_freq = freq_table[0];
+ 	}
+ 
+@@ -169,8 +169,8 @@ static int devfreq_get_freq_level(struct
+ {
+ 	int lev;
+ 
+-	for (lev = 0; lev < devfreq->profile->max_state; lev++)
+-		if (freq == devfreq->profile->freq_table[lev])
++	for (lev = 0; lev < devfreq->max_state; lev++)
++		if (freq == devfreq->freq_table[lev])
+ 			return lev;
+ 
+ 	return -EINVAL;
+@@ -178,7 +178,6 @@ static int devfreq_get_freq_level(struct
+ 
+ static int set_freq_table(struct devfreq *devfreq)
+ {
+-	struct devfreq_dev_profile *profile = devfreq->profile;
+ 	struct dev_pm_opp *opp;
+ 	unsigned long freq;
+ 	int i, count;
+@@ -188,25 +187,22 @@ static int set_freq_table(struct devfreq
+ 	if (count <= 0)
+ 		return -EINVAL;
+ 
+-	profile->max_state = count;
+-	profile->freq_table = devm_kcalloc(devfreq->dev.parent,
+-					profile->max_state,
+-					sizeof(*profile->freq_table),
+-					GFP_KERNEL);
+-	if (!profile->freq_table) {
+-		profile->max_state = 0;
++	devfreq->max_state = count;
++	devfreq->freq_table = devm_kcalloc(devfreq->dev.parent,
++					   devfreq->max_state,
++					   sizeof(*devfreq->freq_table),
++					   GFP_KERNEL);
++	if (!devfreq->freq_table)
+ 		return -ENOMEM;
+-	}
+ 
+-	for (i = 0, freq = 0; i < profile->max_state; i++, freq++) {
++	for (i = 0, freq = 0; i < devfreq->max_state; i++, freq++) {
+ 		opp = dev_pm_opp_find_freq_ceil(devfreq->dev.parent, &freq);
+ 		if (IS_ERR(opp)) {
+-			devm_kfree(devfreq->dev.parent, profile->freq_table);
+-			profile->max_state = 0;
++			devm_kfree(devfreq->dev.parent, devfreq->freq_table);
+ 			return PTR_ERR(opp);
+ 		}
+ 		dev_pm_opp_put(opp);
+-		profile->freq_table[i] = freq;
++		devfreq->freq_table[i] = freq;
+ 	}
+ 
+ 	return 0;
+@@ -246,7 +242,7 @@ int devfreq_update_status(struct devfreq
+ 
+ 	if (lev != prev_lev) {
+ 		devfreq->stats.trans_table[
+-			(prev_lev * devfreq->profile->max_state) + lev]++;
++			(prev_lev * devfreq->max_state) + lev]++;
+ 		devfreq->stats.total_trans++;
+ 	}
+ 
+@@ -834,6 +830,9 @@ struct devfreq *devfreq_add_device(struc
+ 		if (err < 0)
+ 			goto err_dev;
+ 		mutex_lock(&devfreq->lock);
++	} else {
++		devfreq->freq_table = devfreq->profile->freq_table;
++		devfreq->max_state = devfreq->profile->max_state;
+ 	}
+ 
+ 	devfreq->scaling_min_freq = find_available_min_freq(devfreq);
+@@ -869,8 +868,8 @@ struct devfreq *devfreq_add_device(struc
+ 
+ 	devfreq->stats.trans_table = devm_kzalloc(&devfreq->dev,
+ 			array3_size(sizeof(unsigned int),
+-				    devfreq->profile->max_state,
+-				    devfreq->profile->max_state),
++				    devfreq->max_state,
++				    devfreq->max_state),
+ 			GFP_KERNEL);
+ 	if (!devfreq->stats.trans_table) {
+ 		mutex_unlock(&devfreq->lock);
+@@ -879,7 +878,7 @@ struct devfreq *devfreq_add_device(struc
+ 	}
+ 
+ 	devfreq->stats.time_in_state = devm_kcalloc(&devfreq->dev,
+-			devfreq->profile->max_state,
++			devfreq->max_state,
+ 			sizeof(*devfreq->stats.time_in_state),
+ 			GFP_KERNEL);
+ 	if (!devfreq->stats.time_in_state) {
+@@ -1637,9 +1636,9 @@ static ssize_t available_frequencies_sho
+ 
+ 	mutex_lock(&df->lock);
+ 
+-	for (i = 0; i < df->profile->max_state; i++)
++	for (i = 0; i < df->max_state; i++)
+ 		count += scnprintf(&buf[count], (PAGE_SIZE - count - 2),
+-				"%lu ", df->profile->freq_table[i]);
++				"%lu ", df->freq_table[i]);
+ 
+ 	mutex_unlock(&df->lock);
+ 	/* Truncate the trailing space */
+@@ -1662,7 +1661,7 @@ static ssize_t trans_stat_show(struct de
+ 
+ 	if (!df->profile)
+ 		return -EINVAL;
+-	max_state = df->profile->max_state;
++	max_state = df->max_state;
+ 
+ 	if (max_state == 0)
+ 		return sprintf(buf, "Not Supported.\n");
+@@ -1679,19 +1678,17 @@ static ssize_t trans_stat_show(struct de
+ 	len += sprintf(buf + len, "           :");
+ 	for (i = 0; i < max_state; i++)
+ 		len += sprintf(buf + len, "%10lu",
+-				df->profile->freq_table[i]);
++				df->freq_table[i]);
+ 
+ 	len += sprintf(buf + len, "   time(ms)\n");
+ 
+ 	for (i = 0; i < max_state; i++) {
+-		if (df->profile->freq_table[i]
+-					== df->previous_freq) {
++		if (df->freq_table[i] == df->previous_freq)
+ 			len += sprintf(buf + len, "*");
+-		} else {
++		else
+ 			len += sprintf(buf + len, " ");
+-		}
+-		len += sprintf(buf + len, "%10lu:",
+-				df->profile->freq_table[i]);
++
++		len += sprintf(buf + len, "%10lu:", df->freq_table[i]);
+ 		for (j = 0; j < max_state; j++)
+ 			len += sprintf(buf + len, "%10u",
+ 				df->stats.trans_table[(i * max_state) + j]);
+@@ -1715,7 +1712,7 @@ static ssize_t trans_stat_store(struct d
+ 	if (!df->profile)
+ 		return -EINVAL;
+ 
+-	if (df->profile->max_state == 0)
++	if (df->max_state == 0)
+ 		return count;
+ 
+ 	err = kstrtoint(buf, 10, &value);
+@@ -1723,11 +1720,11 @@ static ssize_t trans_stat_store(struct d
+ 		return -EINVAL;
+ 
+ 	mutex_lock(&df->lock);
+-	memset(df->stats.time_in_state, 0, (df->profile->max_state *
++	memset(df->stats.time_in_state, 0, (df->max_state *
+ 					sizeof(*df->stats.time_in_state)));
+ 	memset(df->stats.trans_table, 0, array3_size(sizeof(unsigned int),
+-					df->profile->max_state,
+-					df->profile->max_state));
++					df->max_state,
++					df->max_state));
+ 	df->stats.total_trans = 0;
+ 	df->stats.last_update = get_jiffies_64();
+ 	mutex_unlock(&df->lock);
+--- a/drivers/devfreq/governor_passive.c
++++ b/drivers/devfreq/governor_passive.c
+@@ -145,18 +145,18 @@ static int get_target_freq_with_devfreq(
+ 		goto out;
+ 
+ 	/* Use interpolation if required opps is not available */
+-	for (i = 0; i < parent_devfreq->profile->max_state; i++)
+-		if (parent_devfreq->profile->freq_table[i] == *freq)
++	for (i = 0; i < parent_devfreq->max_state; i++)
++		if (parent_devfreq->freq_table[i] == *freq)
+ 			break;
+ 
+-	if (i == parent_devfreq->profile->max_state)
++	if (i == parent_devfreq->max_state)
+ 		return -EINVAL;
+ 
+-	if (i < devfreq->profile->max_state) {
+-		child_freq = devfreq->profile->freq_table[i];
++	if (i < devfreq->max_state) {
++		child_freq = devfreq->freq_table[i];
+ 	} else {
+-		count = devfreq->profile->max_state;
+-		child_freq = devfreq->profile->freq_table[count - 1];
++		count = devfreq->max_state;
++		child_freq = devfreq->freq_table[count - 1];
+ 	}
+ 
+ out:
+--- a/include/linux/devfreq.h
++++ b/include/linux/devfreq.h
+@@ -185,6 +185,10 @@ struct devfreq {
+ 	struct notifier_block nb;
+ 	struct delayed_work work;
+ 
++	/* devfreq local freq_table */
++	unsigned long *freq_table;
++	unsigned int max_state;
++
+ 	unsigned long previous_freq;
+ 	struct devfreq_dev_status last_status;
+ 
diff --git a/target/linux/ipq806x/patches-5.15/113-v5.19-04-PM-devfreq-Mute-warning-on-governor-PROBE_DEFER.patch b/target/linux/ipq806x/patches-5.15/113-v5.19-04-PM-devfreq-Mute-warning-on-governor-PROBE_DEFER.patch
new file mode 100644
index 00000000000000..591340c6f225f0
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/113-v5.19-04-PM-devfreq-Mute-warning-on-governor-PROBE_DEFER.patch
@@ -0,0 +1,28 @@
+From eee9f767c41b03a2744d4b0f0c1a144e4ff41e78 Mon Sep 17 00:00:00 2001
+From: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
+Date: Mon, 6 Jun 2022 13:01:02 +0200
+Subject: [PATCH v4 4/4] PM / devfreq: Mute warning on governor PROBE_DEFER
+
+Don't print warning when a governor PROBE_DEFER as it's not a real
+GOV_START fail.
+
+Fixes: a03dacb0316f ("PM / devfreq: Add cpu based scaling support to passive governor")
+Signed-off-by: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
+---
+ drivers/devfreq/devfreq.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -930,8 +930,9 @@ struct devfreq *devfreq_add_device(struc
+ 	err = devfreq->governor->event_handler(devfreq, DEVFREQ_GOV_START,
+ 						NULL);
+ 	if (err) {
+-		dev_err(dev, "%s: Unable to start governor for the device\n",
+-			__func__);
++		dev_err_probe(dev, err,
++			      "%s: Unable to start governor for the device\n",
++			      __func__);
+ 		goto err_init;
+ 	}
+ 	create_sysfs_files(devfreq, devfreq->governor);
diff --git a/target/linux/ipq806x/patches-5.15/114-01-devfreq-qcom-Add-L2-Krait-Cache-devfreq-scaling-driv.patch b/target/linux/ipq806x/patches-5.15/114-01-devfreq-qcom-Add-L2-Krait-Cache-devfreq-scaling-driv.patch
new file mode 100644
index 00000000000000..85feb89148ba62
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/114-01-devfreq-qcom-Add-L2-Krait-Cache-devfreq-scaling-driv.patch
@@ -0,0 +1,242 @@
+From b044ae89862132a86fb511648e9c52ea3cdf8c30 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 5 Aug 2020 14:19:23 +0200
+Subject: [PATCH 1/4] devfreq: qcom: Add L2 Krait Cache devfreq scaling driver
+
+Qcom L2 Krait CPUs use the generic cpufreq-dt driver and doesn't actually
+scale the Cache frequency when the CPU frequency is changed. This
+devfreq driver register with the cpu notifier and scale the Cache
+based on the max Freq across all core as the CPU cache is shared across
+all of them. If provided this also scale the voltage of the regulator
+attached to the CPU cache. The scaling logic is based on the CPU freq
+and the 3 scaling interval are set by the device dts.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/devfreq/Kconfig               |  11 ++
+ drivers/devfreq/Makefile              |   1 +
+ drivers/devfreq/krait-cache-devfreq.c | 188 ++++++++++++++++++++++++++
+ 3 files changed, 200 insertions(+)
+ create mode 100644 drivers/devfreq/krait-cache-devfreq.c
+
+--- a/drivers/devfreq/Kconfig
++++ b/drivers/devfreq/Kconfig
+@@ -132,6 +132,17 @@ config ARM_RK3399_DMC_DEVFREQ
+ 	  It sets the frequency for the memory controller and reads the usage counts
+ 	  from hardware.
+ 
++config ARM_KRAIT_CACHE_DEVFREQ
++	tristate "Scaling support for Krait CPU Cache Devfreq"
++	depends on ARCH_QCOM || COMPILE_TEST
++	select DEVFREQ_GOV_PASSIVE
++	help
++	  This adds the DEVFREQ driver for the Krait CPU L2 Cache shared by all cores.
++
++	  The driver register with the cpufreq notifier and find the right frequency
++	  based on the max frequency across all core and the range set in the device
++	  dts. If provided this scale also the regulator attached to the l2 cache.
++
+ source "drivers/devfreq/event/Kconfig"
+ 
+ endif # PM_DEVFREQ
+--- a/drivers/devfreq/Makefile
++++ b/drivers/devfreq/Makefile
+@@ -13,6 +13,7 @@ obj-$(CONFIG_ARM_IMX_BUS_DEVFREQ)	+= imx
+ obj-$(CONFIG_ARM_IMX8M_DDRC_DEVFREQ)	+= imx8m-ddrc.o
+ obj-$(CONFIG_ARM_RK3399_DMC_DEVFREQ)	+= rk3399_dmc.o
+ obj-$(CONFIG_ARM_TEGRA_DEVFREQ)		+= tegra30-devfreq.o
++obj-$(CONFIG_ARM_KRAIT_CACHE_DEVFREQ)	+= krait-cache-devfreq.o
+ 
+ # DEVFREQ Event Drivers
+ obj-$(CONFIG_PM_DEVFREQ_EVENT)		+= event/
+--- /dev/null
++++ b/drivers/devfreq/krait-cache-devfreq.c
+@@ -0,0 +1,188 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/cpufreq.h>
++#include <linux/devfreq.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/clk.h>
++#include <linux/slab.h>
++#include <linux/regulator/consumer.h>
++#include <linux/pm_opp.h>
++
++#include "governor.h"
++
++struct krait_cache_data {
++	struct clk *clk;
++	unsigned long idle_freq;
++};
++
++static int krait_cache_set_opp(struct dev_pm_set_opp_data *data)
++{
++	unsigned long old_freq = data->old_opp.rate, freq = data->new_opp.rate;
++	struct dev_pm_opp_supply *supply = &data->new_opp.supplies[0];
++	struct regulator *reg = data->regulators[0];
++	struct krait_cache_data *kdata;
++	struct clk *clk = data->clk;
++	unsigned long idle_freq;
++	int ret;
++
++	kdata = dev_get_drvdata(data->dev);
++	idle_freq = kdata->idle_freq;
++
++	if (reg) {
++		ret = regulator_set_voltage_triplet(reg, supply->u_volt_min,
++						    supply->u_volt,
++						    supply->u_volt_max);
++		if (ret)
++			goto exit;
++	}
++
++	/*
++	 * Set to idle bin if switching from normal to high bin
++	 * or vice versa. It has been notice that a bug is triggered
++	 * in cache scaling when more than one bin is scaled, to fix
++	 * this we first need to transition to the base rate and then
++	 * to target rate
++	 */
++	if (likely(freq != idle_freq && old_freq != idle_freq)) {
++		ret = clk_set_rate(clk, idle_freq);
++		if (ret)
++			goto exit;
++	}
++
++	ret = clk_set_rate(clk, freq);
++	if (ret)
++		goto exit;
++
++exit:
++	return ret;
++};
++
++static int krait_cache_get_cur_freq(struct device *dev, unsigned long *freq)
++{
++	struct krait_cache_data *data = dev_get_drvdata(dev);
++
++	*freq = clk_get_rate(data->clk);
++
++	return 0;
++};
++
++static int krait_cache_target(struct device *dev, unsigned long *freq,
++			      u32 flags)
++{
++	struct dev_pm_opp *opp;
++
++	opp = dev_pm_opp_find_freq_ceil(dev, freq);
++	if (unlikely(IS_ERR(opp)))
++		return PTR_ERR(opp);
++
++	dev_pm_opp_put(opp);
++
++	return dev_pm_opp_set_rate(dev, *freq);
++};
++
++static int krait_cache_get_dev_status(struct device *dev,
++				      struct devfreq_dev_status *stat)
++{
++	struct krait_cache_data *data = dev_get_drvdata(dev);
++
++	stat->busy_time = 0;
++	stat->total_time = 0;
++	stat->current_frequency = clk_get_rate(data->clk);
++
++	return 0;
++};
++
++static struct devfreq_dev_profile krait_cache_devfreq_profile = {
++	.target = krait_cache_target,
++	.get_dev_status = krait_cache_get_dev_status,
++	.get_cur_freq = krait_cache_get_cur_freq
++};
++
++static struct devfreq_passive_data devfreq_gov_data = {
++	.parent_type = CPUFREQ_PARENT_DEV,
++};
++
++static int krait_cache_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct krait_cache_data *data;
++	struct opp_table *table;
++	struct devfreq *devfreq;
++	struct dev_pm_opp *opp;
++	struct clk *clk;
++	int ret;
++
++	krait_cache_devfreq_profile.freq_table = NULL;
++
++	data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
++	if (!data)
++		return -ENOMEM;
++
++	clk = devm_clk_get(dev, "l2");
++	if (IS_ERR(clk))
++		return PTR_ERR(clk);
++
++	table = dev_pm_opp_set_regulators(dev, (const char *[]){ "l2" }, 1);
++	if (IS_ERR(table)) {
++		ret = PTR_ERR(table);
++		dev_err_probe(dev, -EPROBE_DEFER, "failed to set regulators %d\n", ret);
++		return ret;
++	}
++
++	ret = PTR_ERR_OR_ZERO(
++		dev_pm_opp_register_set_opp_helper(dev, krait_cache_set_opp));
++	if (ret)
++		return ret;
++
++	ret = dev_pm_opp_of_add_table(dev);
++	if (ret) {
++		dev_err(dev, "failed to parse L2 freq thresholds\n");
++		return ret;
++	}
++
++	data->clk = clk;
++	opp = dev_pm_opp_find_freq_ceil(dev, &data->idle_freq);
++	dev_pm_opp_put(opp);
++
++	dev_set_drvdata(dev, data);
++
++	devfreq = devm_devfreq_add_device(&pdev->dev, &krait_cache_devfreq_profile,
++					  DEVFREQ_GOV_PASSIVE, &devfreq_gov_data);
++	if (IS_ERR(devfreq)) {
++		dev_pm_opp_remove_table(dev);
++		dev_pm_opp_put_regulators(table);
++		dev_pm_opp_unregister_set_opp_helper(table);
++	}
++
++	return PTR_ERR_OR_ZERO(devfreq);
++};
++
++static int krait_cache_remove(struct platform_device *pdev)
++{
++	dev_pm_opp_remove_table(&pdev->dev);
++
++	return 0;
++};
++
++static const struct of_device_id krait_cache_match_table[] = {
++	{ .compatible = "qcom,krait-cache" },
++	{}
++};
++
++static struct platform_driver krait_cache_driver = {
++	.probe		= krait_cache_probe,
++	.remove		= krait_cache_remove,
++	.driver		= {
++		.name   = "krait-cache-scaling",
++		.of_match_table = krait_cache_match_table,
++	},
++};
++module_platform_driver(krait_cache_driver);
++
++MODULE_DESCRIPTION("Krait CPU Cache Scaling driver");
++MODULE_AUTHOR("Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>");
++MODULE_LICENSE("GPL v2");
diff --git a/target/linux/ipq806x/patches-5.15/114-02-ARM-dts-qcom-add-krait-cache-compatible-for-ipq806x-.patch b/target/linux/ipq806x/patches-5.15/114-02-ARM-dts-qcom-add-krait-cache-compatible-for-ipq806x-.patch
new file mode 100644
index 00000000000000..f42729fd50936d
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/114-02-ARM-dts-qcom-add-krait-cache-compatible-for-ipq806x-.patch
@@ -0,0 +1,50 @@
+From ef124ad0ff8abfbf4ebe3fe6d7dcef4541dec13a Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 16 Jun 2022 18:39:21 +0200
+Subject: [PATCH] ARM: dts: qcom: add krait-cache compatible for ipq806x dtsi
+
+Add qcom,krait-cache compatible to enable cache devfreq driver for
+ipq806x SoC and move the L2 node to the soc node to make the devfreq
+driver correctly probe.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -69,16 +69,6 @@
+ 				min-residency-us = <3000>;
+ 			};
+ 		};
+-
+-		L2: l2-cache {
+-			compatible = "cache";
+-			cache-level = <2>;
+-			qcom,saw = <&saw_l2>;
+-
+-			clocks = <&kraitcc 4>;
+-			clock-names = "l2";
+-			operating-points-v2 = <&opp_table_l2>;
+-		};
+ 	};
+ 
+ 	opp_table_l2: opp_table_l2 {
+@@ -470,6 +460,16 @@
+ 		ranges;
+ 		compatible = "simple-bus";
+ 
++		L2: l2-cache {
++			compatible = "cache", "qcom,krait-cache";
++			cache-level = <2>;
++			qcom,saw = <&saw_l2>;
++
++			clocks = <&kraitcc 4>;
++			clock-names = "l2";
++			operating-points-v2 = <&opp_table_l2>;
++		};
++
+ 		lpass@28100000 {
+ 			compatible = "qcom,lpass-cpu";
+ 			status = "disabled";
diff --git a/target/linux/ipq806x/patches-5.15/115-01-devfreq-add-ipq806x-fabric-scaling-driver.patch b/target/linux/ipq806x/patches-5.15/115-01-devfreq-add-ipq806x-fabric-scaling-driver.patch
new file mode 100644
index 00000000000000..340c58a0c1888e
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/115-01-devfreq-add-ipq806x-fabric-scaling-driver.patch
@@ -0,0 +1,203 @@
+From 13f075999935bb696dbab63243923179f06fa05e Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 16 Jun 2022 19:56:08 +0200
+Subject: [PATCH 3/4] devfreq: add ipq806x fabric scaling driver
+
+Add ipq806x fabric scaling driver using the devfreq passive governor.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/devfreq/Kconfig               |  11 ++
+ drivers/devfreq/Makefile              |   1 +
+ drivers/devfreq/ipq806x-fab-devfreq.c | 155 ++++++++++++++++++++++++++
+ 3 files changed, 167 insertions(+)
+ create mode 100644 drivers/devfreq/ipq806x-fab-devfreq.c
+
+--- a/drivers/devfreq/Kconfig
++++ b/drivers/devfreq/Kconfig
+@@ -143,6 +143,17 @@ config ARM_KRAIT_CACHE_DEVFREQ
+ 	  based on the max frequency across all core and the range set in the device
+ 	  dts. If provided this scale also the regulator attached to the l2 cache.
+ 
++config ARM_IPQ806X_FAB_DEVFREQ
++	tristate "Scaling support for ipq806x Soc Fabric"
++	depends on ARCH_QCOM || COMPILE_TEST
++	select DEVFREQ_GOV_PASSIVE
++	help
++	  This adds the DEVFREQ driver for the ipq806x Soc Fabric.
++
++	  The driver register with the cpufreq notifier and find the right frequency
++	  based on the max frequency across all core and the range set in the device
++	  dts.
++
+ source "drivers/devfreq/event/Kconfig"
+ 
+ endif # PM_DEVFREQ
+--- a/drivers/devfreq/Makefile
++++ b/drivers/devfreq/Makefile
+@@ -14,6 +14,7 @@ obj-$(CONFIG_ARM_IMX8M_DDRC_DEVFREQ)	+=
+ obj-$(CONFIG_ARM_RK3399_DMC_DEVFREQ)	+= rk3399_dmc.o
+ obj-$(CONFIG_ARM_TEGRA_DEVFREQ)		+= tegra30-devfreq.o
+ obj-$(CONFIG_ARM_KRAIT_CACHE_DEVFREQ)	+= krait-cache-devfreq.o
++obj-$(CONFIG_ARM_IPQ806X_FAB_DEVFREQ)	+= ipq806x-fab-devfreq.o
+ 
+ # DEVFREQ Event Drivers
+ obj-$(CONFIG_PM_DEVFREQ_EVENT)		+= event/
+--- /dev/null
++++ b/drivers/devfreq/ipq806x-fab-devfreq.c
+@@ -0,0 +1,155 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/cpufreq.h>
++#include <linux/devfreq.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/clk.h>
++#include <linux/slab.h>
++#include <linux/pm_opp.h>
++
++#include "governor.h"
++
++struct ipq806x_fab_data {
++	struct clk *fab_clk;
++	struct clk *ddr_clk;
++};
++
++static int ipq806x_fab_get_cur_freq(struct device *dev, unsigned long *freq)
++{
++	struct ipq806x_fab_data *data = dev_get_drvdata(dev);
++
++	*freq = clk_get_rate(data->fab_clk);
++
++	return 0;
++};
++
++static int ipq806x_fab_target(struct device *dev, unsigned long *freq,
++			      u32 flags)
++{
++	struct ipq806x_fab_data *data = dev_get_drvdata(dev);
++	struct dev_pm_opp *opp;
++	int ret;
++
++	opp = dev_pm_opp_find_freq_ceil(dev, freq);
++	if (unlikely(IS_ERR(opp)))
++		return PTR_ERR(opp);
++
++	dev_pm_opp_put(opp);
++
++	ret = clk_set_rate(data->fab_clk, *freq);
++	if (ret)
++		return ret;
++
++	return clk_set_rate(data->ddr_clk, *freq);
++};
++
++static int ipq806x_fab_get_dev_status(struct device *dev,
++				      struct devfreq_dev_status *stat)
++{
++	struct ipq806x_fab_data *data = dev_get_drvdata(dev);
++
++	stat->busy_time = 0;
++	stat->total_time = 0;
++	stat->current_frequency = clk_get_rate(data->fab_clk);
++
++	return 0;
++};
++
++static struct devfreq_dev_profile ipq806x_fab_devfreq_profile = {
++	.target = ipq806x_fab_target,
++	.get_dev_status = ipq806x_fab_get_dev_status,
++	.get_cur_freq = ipq806x_fab_get_cur_freq
++};
++
++static struct devfreq_passive_data devfreq_gov_data = {
++	.parent_type = CPUFREQ_PARENT_DEV,
++};
++
++static int ipq806x_fab_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct ipq806x_fab_data *data;
++	struct devfreq *devfreq;
++	struct clk *clk;
++	int ret;
++
++	data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
++	if (!data)
++		return -ENOMEM;
++
++	clk = devm_clk_get(dev, "apps-fab-clk");
++	if (IS_ERR(clk)) {
++		dev_err_probe(dev, PTR_ERR(clk), "failed to get apps fab clk\n");
++		return PTR_ERR(clk);
++	}
++
++	clk_prepare_enable(clk);
++	data->fab_clk = clk;
++
++	clk = devm_clk_get(dev, "ddr-fab-clk");
++	if (IS_ERR(clk)) {
++		dev_err_probe(dev, PTR_ERR(clk), "failed to get ddr fab clk\n");
++		goto err_ddr;
++	}
++
++	clk_prepare_enable(clk);
++	data->ddr_clk = clk;
++
++	ret = dev_pm_opp_of_add_table(dev);
++	if (ret) {
++		dev_err(dev, "failed to parse fab freq thresholds\n");
++		return ret;
++	}
++
++	dev_set_drvdata(dev, data);
++
++	devfreq = devm_devfreq_add_device(&pdev->dev, &ipq806x_fab_devfreq_profile,
++					  DEVFREQ_GOV_PASSIVE, &devfreq_gov_data);
++	if (IS_ERR(devfreq))
++		dev_pm_opp_remove_table(dev);
++
++	return PTR_ERR_OR_ZERO(devfreq);
++
++err_ddr:
++	clk_unprepare(data->fab_clk);
++	clk_put(data->fab_clk);
++	return PTR_ERR(clk);
++};
++
++static int ipq806x_fab_remove(struct platform_device *pdev)
++{
++	struct ipq806x_fab_data *data = dev_get_drvdata(&pdev->dev);
++
++	clk_unprepare(data->fab_clk);
++	clk_put(data->fab_clk);
++
++	clk_unprepare(data->ddr_clk);
++	clk_put(data->ddr_clk);
++
++	dev_pm_opp_remove_table(&pdev->dev);
++
++	return 0;
++};
++
++static const struct of_device_id ipq806x_fab_match_table[] = {
++	{ .compatible = "qcom,fab-scaling" },
++	{}
++};
++
++static struct platform_driver ipq806x_fab_driver = {
++	.probe		= ipq806x_fab_probe,
++	.remove		= ipq806x_fab_remove,
++	.driver		= {
++		.name   = "ipq806x-fab-scaling",
++		.of_match_table = ipq806x_fab_match_table,
++	},
++};
++module_platform_driver(ipq806x_fab_driver);
++
++MODULE_DESCRIPTION("ipq806x Fab Scaling driver");
++MODULE_AUTHOR("Christian Marangi <ansuelsmth@gmail.com>");
++MODULE_LICENSE("GPL v2");
diff --git a/target/linux/ipq806x/patches-5.15/115-02-ARM-dts-qcom-add-fab-scaling-node-for-ipq806x.patch b/target/linux/ipq806x/patches-5.15/115-02-ARM-dts-qcom-add-fab-scaling-node-for-ipq806x.patch
new file mode 100644
index 00000000000000..f4de1dbb52c9f9
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/115-02-ARM-dts-qcom-add-fab-scaling-node-for-ipq806x.patch
@@ -0,0 +1,48 @@
+From c3573f0907dadb0a6e9933aae2a46a489abcbd48 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 16 Jun 2022 20:03:05 +0200
+Subject: [PATCH 4/4] ARM: dts: qcom: add fab scaling node for ipq806x
+
+Add fabric scaling node for ipq806x to correctly scale apps and ddr
+fabric clk.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -170,6 +170,18 @@
+ 		};
+ 	};
+ 
++	opp_table_fab: opp_table_fab {
++		compatible = "operating-points-v2";
++
++		opp-533000000 {
++			opp-hz = /bits/ 64 <533000000>;
++		};
++
++		opp-400000000 {
++			opp-hz = /bits/ 64 <400000000>;
++		};
++	};
++
+ 	thermal-zones {
+ 		tsens_tz_sensor0 {
+ 			polling-delay-passive = <0>;
+@@ -470,6 +482,13 @@
+ 			operating-points-v2 = <&opp_table_l2>;
+ 		};
+ 
++		fab-scaling {
++			compatible = "qcom,fab-scaling";
++			clocks = <&rpmcc RPM_APPS_FABRIC_A_CLK>, <&rpmcc RPM_EBI1_A_CLK>;
++			clock-names = "apps-fab-clk", "ddr-fab-clk";
++			operating-points-v2 = <&opp_table_fab>;
++		};
++
+ 		lpass@28100000 {
+ 			compatible = "qcom,lpass-cpu";
+ 			status = "disabled";
diff --git a/target/linux/ipq806x/patches-5.15/116-v6.0-01-mtd-nand-raw-qcom_nandc-reorder-qcom_nand_host-struc.patch b/target/linux/ipq806x/patches-5.15/116-v6.0-01-mtd-nand-raw-qcom_nandc-reorder-qcom_nand_host-struc.patch
new file mode 100644
index 00000000000000..c595b10dd74c7d
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/116-v6.0-01-mtd-nand-raw-qcom_nandc-reorder-qcom_nand_host-struc.patch
@@ -0,0 +1,268 @@
+From b360514edb4743cbf86fc377699c75e98b1264c7 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 16 Jun 2022 02:18:33 +0200
+Subject: [PATCH 1/2] mtd: nand: raw: qcom_nandc: reorder qcom_nand_host struct
+
+Reorder structs in nandc driver to save holes.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220616001835.24393-2-ansuelsmth@gmail.com
+---
+ drivers/mtd/nand/raw/qcom_nandc.c | 107 +++++++++++++++++-------------
+ 1 file changed, 62 insertions(+), 45 deletions(-)
+
+--- a/drivers/mtd/nand/raw/qcom_nandc.c
++++ b/drivers/mtd/nand/raw/qcom_nandc.c
+@@ -237,6 +237,9 @@ nandc_set_reg(chip, reg,			\
+  * @bam_ce - the array of BAM command elements
+  * @cmd_sgl - sgl for NAND BAM command pipe
+  * @data_sgl - sgl for NAND BAM consumer/producer pipe
++ * @last_data_desc - last DMA desc in data channel (tx/rx).
++ * @last_cmd_desc - last DMA desc in command channel.
++ * @txn_done - completion for NAND transfer.
+  * @bam_ce_pos - the index in bam_ce which is available for next sgl
+  * @bam_ce_start - the index in bam_ce which marks the start position ce
+  *		   for current sgl. It will be used for size calculation
+@@ -249,14 +252,14 @@ nandc_set_reg(chip, reg,			\
+  * @rx_sgl_start - start index in data sgl for rx.
+  * @wait_second_completion - wait for second DMA desc completion before making
+  *			     the NAND transfer completion.
+- * @txn_done - completion for NAND transfer.
+- * @last_data_desc - last DMA desc in data channel (tx/rx).
+- * @last_cmd_desc - last DMA desc in command channel.
+  */
+ struct bam_transaction {
+ 	struct bam_cmd_element *bam_ce;
+ 	struct scatterlist *cmd_sgl;
+ 	struct scatterlist *data_sgl;
++	struct dma_async_tx_descriptor *last_data_desc;
++	struct dma_async_tx_descriptor *last_cmd_desc;
++	struct completion txn_done;
+ 	u32 bam_ce_pos;
+ 	u32 bam_ce_start;
+ 	u32 cmd_sgl_pos;
+@@ -266,25 +269,23 @@ struct bam_transaction {
+ 	u32 rx_sgl_pos;
+ 	u32 rx_sgl_start;
+ 	bool wait_second_completion;
+-	struct completion txn_done;
+-	struct dma_async_tx_descriptor *last_data_desc;
+-	struct dma_async_tx_descriptor *last_cmd_desc;
+ };
+ 
+ /*
+  * This data type corresponds to the nand dma descriptor
++ * @dma_desc - low level DMA engine descriptor
+  * @list - list for desc_info
+- * @dir - DMA transfer direction
++ *
+  * @adm_sgl - sgl which will be used for single sgl dma descriptor. Only used by
+  *	      ADM
+  * @bam_sgl - sgl which will be used for dma descriptor. Only used by BAM
+  * @sgl_cnt - number of SGL in bam_sgl. Only used by BAM
+- * @dma_desc - low level DMA engine descriptor
++ * @dir - DMA transfer direction
+  */
+ struct desc_info {
++	struct dma_async_tx_descriptor *dma_desc;
+ 	struct list_head node;
+ 
+-	enum dma_data_direction dir;
+ 	union {
+ 		struct scatterlist adm_sgl;
+ 		struct {
+@@ -292,7 +293,7 @@ struct desc_info {
+ 			int sgl_cnt;
+ 		};
+ 	};
+-	struct dma_async_tx_descriptor *dma_desc;
++	enum dma_data_direction dir;
+ };
+ 
+ /*
+@@ -336,52 +337,64 @@ struct nandc_regs {
+ /*
+  * NAND controller data struct
+  *
+- * @controller:			base controller structure
+- * @host_list:			list containing all the chips attached to the
+- *				controller
+  * @dev:			parent device
++ *
+  * @base:			MMIO base
+- * @base_phys:			physical base address of controller registers
+- * @base_dma:			dma base address of controller registers
++ *
+  * @core_clk:			controller clock
+  * @aon_clk:			another controller clock
+  *
++ * @regs:			a contiguous chunk of memory for DMA register
++ *				writes. contains the register values to be
++ *				written to controller
++ *
++ * @props:			properties of current NAND controller,
++ *				initialized via DT match data
++ *
++ * @controller:			base controller structure
++ * @host_list:			list containing all the chips attached to the
++ *				controller
++ *
+  * @chan:			dma channel
+  * @cmd_crci:			ADM DMA CRCI for command flow control
+  * @data_crci:			ADM DMA CRCI for data flow control
++ *
+  * @desc_list:			DMA descriptor list (list of desc_infos)
+  *
+  * @data_buffer:		our local DMA buffer for page read/writes,
+  *				used when we can't use the buffer provided
+  *				by upper layers directly
+- * @buf_size/count/start:	markers for chip->legacy.read_buf/write_buf
+- *				functions
+  * @reg_read_buf:		local buffer for reading back registers via DMA
++ *
++ * @base_phys:			physical base address of controller registers
++ * @base_dma:			dma base address of controller registers
+  * @reg_read_dma:		contains dma address for register read buffer
+- * @reg_read_pos:		marker for data read in reg_read_buf
+  *
+- * @regs:			a contiguous chunk of memory for DMA register
+- *				writes. contains the register values to be
+- *				written to controller
+- * @cmd1/vld:			some fixed controller register values
+- * @props:			properties of current NAND controller,
+- *				initialized via DT match data
++ * @buf_size/count/start:	markers for chip->legacy.read_buf/write_buf
++ *				functions
+  * @max_cwperpage:		maximum QPIC codewords required. calculated
+  *				from all connected NAND devices pagesize
++ *
++ * @reg_read_pos:		marker for data read in reg_read_buf
++ *
++ * @cmd1/vld:			some fixed controller register values
+  */
+ struct qcom_nand_controller {
+-	struct nand_controller controller;
+-	struct list_head host_list;
+-
+ 	struct device *dev;
+ 
+ 	void __iomem *base;
+-	phys_addr_t base_phys;
+-	dma_addr_t base_dma;
+ 
+ 	struct clk *core_clk;
+ 	struct clk *aon_clk;
+ 
++	struct nandc_regs *regs;
++	struct bam_transaction *bam_txn;
++
++	const struct qcom_nandc_props *props;
++
++	struct nand_controller controller;
++	struct list_head host_list;
++
+ 	union {
+ 		/* will be used only by QPIC for BAM DMA */
+ 		struct {
+@@ -399,22 +412,22 @@ struct qcom_nand_controller {
+ 	};
+ 
+ 	struct list_head desc_list;
+-	struct bam_transaction *bam_txn;
+ 
+ 	u8		*data_buffer;
++	__le32		*reg_read_buf;
++
++	phys_addr_t base_phys;
++	dma_addr_t base_dma;
++	dma_addr_t reg_read_dma;
++
+ 	int		buf_size;
+ 	int		buf_count;
+ 	int		buf_start;
+ 	unsigned int	max_cwperpage;
+ 
+-	__le32 *reg_read_buf;
+-	dma_addr_t reg_read_dma;
+ 	int reg_read_pos;
+ 
+-	struct nandc_regs *regs;
+-
+ 	u32 cmd1, vld;
+-	const struct qcom_nandc_props *props;
+ };
+ 
+ /*
+@@ -430,19 +443,21 @@ struct qcom_nand_controller {
+  *				and reserved bytes
+  * @cw_data:			the number of bytes within a codeword protected
+  *				by ECC
+- * @use_ecc:			request the controller to use ECC for the
+- *				upcoming read/write
+- * @bch_enabled:		flag to tell whether BCH ECC mode is used
+  * @ecc_bytes_hw:		ECC bytes used by controller hardware for this
+  *				chip
+- * @status:			value to be returned if NAND_CMD_STATUS command
+- *				is executed
++ *
+  * @last_command:		keeps track of last command on this chip. used
+  *				for reading correct status
+  *
+  * @cfg0, cfg1, cfg0_raw..:	NANDc register configurations needed for
+  *				ecc/non-ecc mode for the current nand flash
+  *				device
++ *
++ * @status:			value to be returned if NAND_CMD_STATUS command
++ *				is executed
++ * @use_ecc:			request the controller to use ECC for the
++ *				upcoming read/write
++ * @bch_enabled:		flag to tell whether BCH ECC mode is used
+  */
+ struct qcom_nand_host {
+ 	struct nand_chip chip;
+@@ -451,12 +466,10 @@ struct qcom_nand_host {
+ 	int cs;
+ 	int cw_size;
+ 	int cw_data;
+-	bool use_ecc;
+-	bool bch_enabled;
+ 	int ecc_bytes_hw;
+ 	int spare_bytes;
+ 	int bbm_size;
+-	u8 status;
++
+ 	int last_command;
+ 
+ 	u32 cfg0, cfg1;
+@@ -465,23 +478,27 @@ struct qcom_nand_host {
+ 	u32 ecc_bch_cfg;
+ 	u32 clrflashstatus;
+ 	u32 clrreadstatus;
++
++	u8 status;
++	bool use_ecc;
++	bool bch_enabled;
+ };
+ 
+ /*
+  * This data type corresponds to the NAND controller properties which varies
+  * among different NAND controllers.
+  * @ecc_modes - ecc mode for NAND
++ * @dev_cmd_reg_start - NAND_DEV_CMD_* registers starting offset
+  * @is_bam - whether NAND controller is using BAM
+  * @is_qpic - whether NAND CTRL is part of qpic IP
+  * @qpic_v2 - flag to indicate QPIC IP version 2
+- * @dev_cmd_reg_start - NAND_DEV_CMD_* registers starting offset
+  */
+ struct qcom_nandc_props {
+ 	u32 ecc_modes;
++	u32 dev_cmd_reg_start;
+ 	bool is_bam;
+ 	bool is_qpic;
+ 	bool qpic_v2;
+-	u32 dev_cmd_reg_start;
+ };
+ 
+ /* Frees the BAM transaction memory */
diff --git a/target/linux/ipq806x/patches-5.15/116-v6.0-02-mtd-nand-raw-qcom_nandc-add-support-for-unprotected-.patch b/target/linux/ipq806x/patches-5.15/116-v6.0-02-mtd-nand-raw-qcom_nandc-add-support-for-unprotected-.patch
new file mode 100644
index 00000000000000..2a6619530446df
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/116-v6.0-02-mtd-nand-raw-qcom_nandc-add-support-for-unprotected-.patch
@@ -0,0 +1,406 @@
+From 862bdedd7f4b8aebf00fdb422062e64896e97809 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 16 Jun 2022 02:18:34 +0200
+Subject: [PATCH 2/2] mtd: nand: raw: qcom_nandc: add support for unprotected
+ spare data pages
+
+IPQ8064 nand have special pages where a different layout scheme is used.
+These special page are used by boot partition and on reading them
+lots of warning are reported about wrong ECC data and if written to
+results in broken data and not bootable device.
+
+The layout scheme used by these special page consist in using 512 bytes
+as the codeword size (even for the last codeword) while writing to CFG0
+register. This forces the NAND controller to unprotect the 4 bytes of
+spare data.
+
+Since the kernel is unaware of this different layout for these special
+page, it does try to protect the spare data too during read/write and
+warn about CRC errors.
+
+Add support for this by permitting the user to declare these special
+pages in dts by declaring offset and size of the partition. The driver
+internally will convert these value to nand pages.
+
+On user read/write the page is checked and if it's a boot page the
+correct layout is used.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220616001835.24393-3-ansuelsmth@gmail.com
+---
+ drivers/mtd/nand/raw/qcom_nandc.c | 199 +++++++++++++++++++++++++++++-
+ 1 file changed, 194 insertions(+), 5 deletions(-)
+
+--- a/drivers/mtd/nand/raw/qcom_nandc.c
++++ b/drivers/mtd/nand/raw/qcom_nandc.c
+@@ -79,8 +79,10 @@
+ #define	DISABLE_STATUS_AFTER_WRITE	4
+ #define	CW_PER_PAGE			6
+ #define	UD_SIZE_BYTES			9
++#define	UD_SIZE_BYTES_MASK		GENMASK(18, 9)
+ #define	ECC_PARITY_SIZE_BYTES_RS	19
+ #define	SPARE_SIZE_BYTES		23
++#define	SPARE_SIZE_BYTES_MASK		GENMASK(26, 23)
+ #define	NUM_ADDR_CYCLES			27
+ #define	STATUS_BFR_READ			30
+ #define	SET_RD_MODE_AFTER_STATUS	31
+@@ -101,6 +103,7 @@
+ #define	ECC_MODE			4
+ #define	ECC_PARITY_SIZE_BYTES_BCH	8
+ #define	ECC_NUM_DATA_BYTES		16
++#define	ECC_NUM_DATA_BYTES_MASK		GENMASK(25, 16)
+ #define	ECC_FORCE_CLK_OPEN		30
+ 
+ /* NAND_DEV_CMD1 bits */
+@@ -431,12 +434,31 @@ struct qcom_nand_controller {
+ };
+ 
+ /*
++ * NAND special boot partitions
++ *
++ * @page_offset:		offset of the partition where spare data is not protected
++ *				by ECC (value in pages)
++ * @page_offset:		size of the partition where spare data is not protected
++ *				by ECC (value in pages)
++ */
++struct qcom_nand_boot_partition {
++	u32 page_offset;
++	u32 page_size;
++};
++
++/*
+  * NAND chip structure
+  *
++ * @boot_partitions:		array of boot partitions where offset and size of the
++ *				boot partitions are stored
++ *
+  * @chip:			base NAND chip structure
+  * @node:			list node to add itself to host_list in
+  *				qcom_nand_controller
+  *
++ * @nr_boot_partitions:		count of the boot partitions where spare data is not
++ *				protected by ECC
++ *
+  * @cs:				chip select value for this chip
+  * @cw_size:			the number of bytes in a single step/codeword
+  *				of a page, consisting of all data, ecc, spare
+@@ -455,14 +477,20 @@ struct qcom_nand_controller {
+  *
+  * @status:			value to be returned if NAND_CMD_STATUS command
+  *				is executed
++ * @codeword_fixup:		keep track of the current layout used by
++ *				the driver for read/write operation.
+  * @use_ecc:			request the controller to use ECC for the
+  *				upcoming read/write
+  * @bch_enabled:		flag to tell whether BCH ECC mode is used
+  */
+ struct qcom_nand_host {
++	struct qcom_nand_boot_partition *boot_partitions;
++
+ 	struct nand_chip chip;
+ 	struct list_head node;
+ 
++	int nr_boot_partitions;
++
+ 	int cs;
+ 	int cw_size;
+ 	int cw_data;
+@@ -480,6 +508,7 @@ struct qcom_nand_host {
+ 	u32 clrreadstatus;
+ 
+ 	u8 status;
++	bool codeword_fixup;
+ 	bool use_ecc;
+ 	bool bch_enabled;
+ };
+@@ -492,6 +521,7 @@ struct qcom_nand_host {
+  * @is_bam - whether NAND controller is using BAM
+  * @is_qpic - whether NAND CTRL is part of qpic IP
+  * @qpic_v2 - flag to indicate QPIC IP version 2
++ * @use_codeword_fixup - whether NAND has different layout for boot partitions
+  */
+ struct qcom_nandc_props {
+ 	u32 ecc_modes;
+@@ -499,6 +529,7 @@ struct qcom_nandc_props {
+ 	bool is_bam;
+ 	bool is_qpic;
+ 	bool qpic_v2;
++	bool use_codeword_fixup;
+ };
+ 
+ /* Frees the BAM transaction memory */
+@@ -1708,7 +1739,7 @@ qcom_nandc_read_cw_raw(struct mtd_info *
+ 	data_size1 = mtd->writesize - host->cw_size * (ecc->steps - 1);
+ 	oob_size1 = host->bbm_size;
+ 
+-	if (qcom_nandc_is_last_cw(ecc, cw)) {
++	if (qcom_nandc_is_last_cw(ecc, cw) && !host->codeword_fixup) {
+ 		data_size2 = ecc->size - data_size1 -
+ 			     ((ecc->steps - 1) * 4);
+ 		oob_size2 = (ecc->steps * 4) + host->ecc_bytes_hw +
+@@ -1789,7 +1820,7 @@ check_for_erased_page(struct qcom_nand_h
+ 	}
+ 
+ 	for_each_set_bit(cw, &uncorrectable_cws, ecc->steps) {
+-		if (qcom_nandc_is_last_cw(ecc, cw)) {
++		if (qcom_nandc_is_last_cw(ecc, cw) && !host->codeword_fixup) {
+ 			data_size = ecc->size - ((ecc->steps - 1) * 4);
+ 			oob_size = (ecc->steps * 4) + host->ecc_bytes_hw;
+ 		} else {
+@@ -1947,7 +1978,7 @@ static int read_page_ecc(struct qcom_nan
+ 	for (i = 0; i < ecc->steps; i++) {
+ 		int data_size, oob_size;
+ 
+-		if (qcom_nandc_is_last_cw(ecc, i)) {
++		if (qcom_nandc_is_last_cw(ecc, i) && !host->codeword_fixup) {
+ 			data_size = ecc->size - ((ecc->steps - 1) << 2);
+ 			oob_size = (ecc->steps << 2) + host->ecc_bytes_hw +
+ 				   host->spare_bytes;
+@@ -2044,6 +2075,69 @@ static int copy_last_cw(struct qcom_nand
+ 	return ret;
+ }
+ 
++static bool qcom_nandc_is_boot_partition(struct qcom_nand_host *host, int page)
++{
++	struct qcom_nand_boot_partition *boot_partition;
++	u32 start, end;
++	int i;
++
++	/*
++	 * Since the frequent access will be to the non-boot partitions like rootfs,
++	 * optimize the page check by:
++	 *
++	 * 1. Checking if the page lies after the last boot partition.
++	 * 2. Checking from the boot partition end.
++	 */
++
++	/* First check the last boot partition */
++	boot_partition = &host->boot_partitions[host->nr_boot_partitions - 1];
++	start = boot_partition->page_offset;
++	end = start + boot_partition->page_size;
++
++	/* Page is after the last boot partition end. This is NOT a boot partition */
++	if (page > end)
++		return false;
++
++	/* Actually check if it's a boot partition */
++	if (page < end && page >= start)
++		return true;
++
++	/* Check the other boot partitions starting from the second-last partition */
++	for (i = host->nr_boot_partitions - 2; i >= 0; i--) {
++		boot_partition = &host->boot_partitions[i];
++		start = boot_partition->page_offset;
++		end = start + boot_partition->page_size;
++
++		if (page < end && page >= start)
++			return true;
++	}
++
++	return false;
++}
++
++static void qcom_nandc_codeword_fixup(struct qcom_nand_host *host, int page)
++{
++	bool codeword_fixup = qcom_nandc_is_boot_partition(host, page);
++
++	/* Skip conf write if we are already in the correct mode */
++	if (codeword_fixup == host->codeword_fixup)
++		return;
++
++	host->codeword_fixup = codeword_fixup;
++
++	host->cw_data = codeword_fixup ? 512 : 516;
++	host->spare_bytes = host->cw_size - host->ecc_bytes_hw -
++			    host->bbm_size - host->cw_data;
++
++	host->cfg0 &= ~(SPARE_SIZE_BYTES_MASK | UD_SIZE_BYTES_MASK);
++	host->cfg0 |= host->spare_bytes << SPARE_SIZE_BYTES |
++		      host->cw_data << UD_SIZE_BYTES;
++
++	host->ecc_bch_cfg &= ~ECC_NUM_DATA_BYTES_MASK;
++	host->ecc_bch_cfg |= host->cw_data << ECC_NUM_DATA_BYTES;
++	host->ecc_buf_cfg = (host->cw_data - 1) << NUM_STEPS;
++}
++
+ /* implements ecc->read_page() */
+ static int qcom_nandc_read_page(struct nand_chip *chip, uint8_t *buf,
+ 				int oob_required, int page)
+@@ -2052,6 +2146,9 @@ static int qcom_nandc_read_page(struct n
+ 	struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
+ 	u8 *data_buf, *oob_buf = NULL;
+ 
++	if (host->nr_boot_partitions)
++		qcom_nandc_codeword_fixup(host, page);
++
+ 	nand_read_page_op(chip, page, 0, NULL, 0);
+ 	data_buf = buf;
+ 	oob_buf = oob_required ? chip->oob_poi : NULL;
+@@ -2071,6 +2168,9 @@ static int qcom_nandc_read_page_raw(stru
+ 	int cw, ret;
+ 	u8 *data_buf = buf, *oob_buf = chip->oob_poi;
+ 
++	if (host->nr_boot_partitions)
++		qcom_nandc_codeword_fixup(host, page);
++
+ 	for (cw = 0; cw < ecc->steps; cw++) {
+ 		ret = qcom_nandc_read_cw_raw(mtd, chip, data_buf, oob_buf,
+ 					     page, cw);
+@@ -2091,6 +2191,9 @@ static int qcom_nandc_read_oob(struct na
+ 	struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
+ 	struct nand_ecc_ctrl *ecc = &chip->ecc;
+ 
++	if (host->nr_boot_partitions)
++		qcom_nandc_codeword_fixup(host, page);
++
+ 	clear_read_regs(nandc);
+ 	clear_bam_transaction(nandc);
+ 
+@@ -2111,6 +2214,9 @@ static int qcom_nandc_write_page(struct
+ 	u8 *data_buf, *oob_buf;
+ 	int i, ret;
+ 
++	if (host->nr_boot_partitions)
++		qcom_nandc_codeword_fixup(host, page);
++
+ 	nand_prog_page_begin_op(chip, page, 0, NULL, 0);
+ 
+ 	clear_read_regs(nandc);
+@@ -2126,7 +2232,7 @@ static int qcom_nandc_write_page(struct
+ 	for (i = 0; i < ecc->steps; i++) {
+ 		int data_size, oob_size;
+ 
+-		if (qcom_nandc_is_last_cw(ecc, i)) {
++		if (qcom_nandc_is_last_cw(ecc, i) && !host->codeword_fixup) {
+ 			data_size = ecc->size - ((ecc->steps - 1) << 2);
+ 			oob_size = (ecc->steps << 2) + host->ecc_bytes_hw +
+ 				   host->spare_bytes;
+@@ -2183,6 +2289,9 @@ static int qcom_nandc_write_page_raw(str
+ 	u8 *data_buf, *oob_buf;
+ 	int i, ret;
+ 
++	if (host->nr_boot_partitions)
++		qcom_nandc_codeword_fixup(host, page);
++
+ 	nand_prog_page_begin_op(chip, page, 0, NULL, 0);
+ 	clear_read_regs(nandc);
+ 	clear_bam_transaction(nandc);
+@@ -2201,7 +2310,7 @@ static int qcom_nandc_write_page_raw(str
+ 		data_size1 = mtd->writesize - host->cw_size * (ecc->steps - 1);
+ 		oob_size1 = host->bbm_size;
+ 
+-		if (qcom_nandc_is_last_cw(ecc, i)) {
++		if (qcom_nandc_is_last_cw(ecc, i) && !host->codeword_fixup) {
+ 			data_size2 = ecc->size - data_size1 -
+ 				     ((ecc->steps - 1) << 2);
+ 			oob_size2 = (ecc->steps << 2) + host->ecc_bytes_hw +
+@@ -2261,6 +2370,9 @@ static int qcom_nandc_write_oob(struct n
+ 	int data_size, oob_size;
+ 	int ret;
+ 
++	if (host->nr_boot_partitions)
++		qcom_nandc_codeword_fixup(host, page);
++
+ 	host->use_ecc = true;
+ 	clear_bam_transaction(nandc);
+ 
+@@ -2922,6 +3034,74 @@ static int qcom_nandc_setup(struct qcom_
+ 
+ static const char * const probes[] = { "cmdlinepart", "ofpart", "qcomsmem", NULL };
+ 
++static int qcom_nand_host_parse_boot_partitions(struct qcom_nand_controller *nandc,
++						struct qcom_nand_host *host,
++						struct device_node *dn)
++{
++	struct nand_chip *chip = &host->chip;
++	struct mtd_info *mtd = nand_to_mtd(chip);
++	struct qcom_nand_boot_partition *boot_partition;
++	struct device *dev = nandc->dev;
++	int partitions_count, i, j, ret;
++
++	if (!of_find_property(dn, "qcom,boot-partitions", NULL))
++		return 0;
++
++	partitions_count = of_property_count_u32_elems(dn, "qcom,boot-partitions");
++	if (partitions_count <= 0) {
++		dev_err(dev, "Error parsing boot partition\n");
++		return partitions_count ? partitions_count : -EINVAL;
++	}
++
++	host->nr_boot_partitions = partitions_count / 2;
++	host->boot_partitions = devm_kcalloc(dev, host->nr_boot_partitions,
++					     sizeof(*host->boot_partitions), GFP_KERNEL);
++	if (!host->boot_partitions) {
++		host->nr_boot_partitions = 0;
++		return -ENOMEM;
++	}
++
++	for (i = 0, j = 0; i < host->nr_boot_partitions; i++, j += 2) {
++		boot_partition = &host->boot_partitions[i];
++
++		ret = of_property_read_u32_index(dn, "qcom,boot-partitions", j,
++						 &boot_partition->page_offset);
++		if (ret) {
++			dev_err(dev, "Error parsing boot partition offset at index %d\n", i);
++			host->nr_boot_partitions = 0;
++			return ret;
++		}
++
++		if (boot_partition->page_offset % mtd->writesize) {
++			dev_err(dev, "Boot partition offset not multiple of writesize at index %i\n",
++				i);
++			host->nr_boot_partitions = 0;
++			return -EINVAL;
++		}
++		/* Convert offset to nand pages */
++		boot_partition->page_offset /= mtd->writesize;
++
++		ret = of_property_read_u32_index(dn, "qcom,boot-partitions", j + 1,
++						 &boot_partition->page_size);
++		if (ret) {
++			dev_err(dev, "Error parsing boot partition size at index %d\n", i);
++			host->nr_boot_partitions = 0;
++			return ret;
++		}
++
++		if (boot_partition->page_size % mtd->writesize) {
++			dev_err(dev, "Boot partition size not multiple of writesize at index %i\n",
++				i);
++			host->nr_boot_partitions = 0;
++			return -EINVAL;
++		}
++		/* Convert size to nand pages */
++		boot_partition->page_size /= mtd->writesize;
++	}
++
++	return 0;
++}
++
+ static int qcom_nand_host_init_and_register(struct qcom_nand_controller *nandc,
+ 					    struct qcom_nand_host *host,
+ 					    struct device_node *dn)
+@@ -2979,6 +3159,14 @@ static int qcom_nand_host_init_and_regis
+ 	if (ret)
+ 		nand_cleanup(chip);
+ 
++	if (nandc->props->use_codeword_fixup) {
++		ret = qcom_nand_host_parse_boot_partitions(nandc, host, dn);
++		if (ret) {
++			nand_cleanup(chip);
++			return ret;
++		}
++	}
++
+ 	return ret;
+ }
+ 
+@@ -3144,6 +3332,7 @@ static int qcom_nandc_remove(struct plat
+ static const struct qcom_nandc_props ipq806x_nandc_props = {
+ 	.ecc_modes = (ECC_RS_4BIT | ECC_BCH_8BIT),
+ 	.is_bam = false,
++	.use_codeword_fixup = true,
+ 	.dev_cmd_reg_start = 0x0,
+ };
+ 
diff --git a/target/linux/ipq806x/patches-5.15/117-v6.0-01-clk-qcom-clk-hfpll-use-poll_timeout-macro.patch b/target/linux/ipq806x/patches-5.15/117-v6.0-01-clk-qcom-clk-hfpll-use-poll_timeout-macro.patch
new file mode 100644
index 00000000000000..3008fff9b7fadf
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/117-v6.0-01-clk-qcom-clk-hfpll-use-poll_timeout-macro.patch
@@ -0,0 +1,41 @@
+From fcfbfe373d41b4728ffec075f8f91b6572a88c27 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sat, 30 Apr 2022 07:44:56 +0200
+Subject: [PATCH 1/3] clk: qcom: clk-hfpll: use poll_timeout macro
+
+Use regmap_read_poll_timeout macro instead of do-while structure to tidy
+things up. Also set a timeout to prevent any sort of system stall.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220430054458.31321-2-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/clk-hfpll.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/drivers/clk/qcom/clk-hfpll.c
++++ b/drivers/clk/qcom/clk-hfpll.c
+@@ -72,13 +72,16 @@ static void __clk_hfpll_enable(struct cl
+ 	regmap_update_bits(regmap, hd->mode_reg, PLL_RESET_N, PLL_RESET_N);
+ 
+ 	/* Wait for PLL to lock. */
+-	if (hd->status_reg) {
+-		do {
+-			regmap_read(regmap, hd->status_reg, &val);
+-		} while (!(val & BIT(hd->lock_bit)));
+-	} else {
++	if (hd->status_reg)
++		/*
++		 * Busy wait. Should never timeout, we add a timeout to
++		 * prevent any sort of stall.
++		 */
++		regmap_read_poll_timeout(regmap, hd->status_reg, val,
++					 !(val & BIT(hd->lock_bit)), 0,
++					 100 * USEC_PER_MSEC);
++	else
+ 		udelay(60);
+-	}
+ 
+ 	/* Enable PLL output. */
+ 	regmap_update_bits(regmap, hd->mode_reg, PLL_OUTCTRL, PLL_OUTCTRL);
diff --git a/target/linux/ipq806x/patches-5.15/117-v6.0-03-clk-qcom-clk-krait-add-apq-ipq8064-errata-workaround.patch b/target/linux/ipq806x/patches-5.15/117-v6.0-03-clk-qcom-clk-krait-add-apq-ipq8064-errata-workaround.patch
new file mode 100644
index 00000000000000..4012e16f9bc0eb
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/117-v6.0-03-clk-qcom-clk-krait-add-apq-ipq8064-errata-workaround.patch
@@ -0,0 +1,86 @@
+From 898d0d6483a9360f1968e0a900465c1fa152a4a9 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sat, 30 Apr 2022 07:44:58 +0200
+Subject: [PATCH 3/3] clk: qcom: clk-krait: add apq/ipq8064 errata workaround
+
+Add apq/ipq8064 errata workaround where the sec_src clock gating needs to
+be disabled during switching. krait-cc compatible is not enough to
+handle this and limit this workaround to apq/ipq8064. We check machine
+compatible to handle this.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220430054458.31321-4-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/clk-krait.c | 16 ++++++++++++++++
+ drivers/clk/qcom/clk-krait.h |  1 +
+ drivers/clk/qcom/krait-cc.c  |  8 ++++++++
+ 3 files changed, 25 insertions(+)
+
+--- a/drivers/clk/qcom/clk-krait.c
++++ b/drivers/clk/qcom/clk-krait.c
+@@ -18,13 +18,23 @@
+ static DEFINE_SPINLOCK(krait_clock_reg_lock);
+ 
+ #define LPL_SHIFT	8
++#define SECCLKAGD	BIT(4)
++
+ static void __krait_mux_set_sel(struct krait_mux_clk *mux, int sel)
+ {
+ 	unsigned long flags;
+ 	u32 regval;
+ 
+ 	spin_lock_irqsave(&krait_clock_reg_lock, flags);
++
+ 	regval = krait_get_l2_indirect_reg(mux->offset);
++
++	/* apq/ipq8064 Errata: disable sec_src clock gating during switch. */
++	if (mux->disable_sec_src_gating) {
++		regval |= SECCLKAGD;
++		krait_set_l2_indirect_reg(mux->offset, regval);
++	}
++
+ 	regval &= ~(mux->mask << mux->shift);
+ 	regval |= (sel & mux->mask) << mux->shift;
+ 	if (mux->lpl) {
+@@ -33,6 +43,12 @@ static void __krait_mux_set_sel(struct k
+ 	}
+ 	krait_set_l2_indirect_reg(mux->offset, regval);
+ 
++	/* apq/ipq8064 Errata: re-enabled sec_src clock gating. */
++	if (mux->disable_sec_src_gating) {
++		regval &= ~SECCLKAGD;
++		krait_set_l2_indirect_reg(mux->offset, regval);
++	}
++
+ 	/* Wait for switch to complete. */
+ 	mb();
+ 	udelay(1);
+--- a/drivers/clk/qcom/clk-krait.h
++++ b/drivers/clk/qcom/clk-krait.h
+@@ -15,6 +15,7 @@ struct krait_mux_clk {
+ 	u8		safe_sel;
+ 	u8		old_index;
+ 	bool		reparent;
++	bool		disable_sec_src_gating;
+ 
+ 	struct clk_hw	hw;
+ 	struct notifier_block   clk_nb;
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -139,6 +139,14 @@ krait_add_sec_mux(struct device *dev, in
+ 	mux->hw.init = &init;
+ 	mux->safe_sel = 0;
+ 
++	/* Checking for qcom,krait-cc-v1 or qcom,krait-cc-v2 is not
++	 * enough to limit this to apq/ipq8064. Directly check machine
++	 * compatible to correctly handle this errata.
++	 */
++	if (of_machine_is_compatible("qcom,ipq8064") ||
++	    of_machine_is_compatible("qcom,apq8064"))
++		mux->disable_sec_src_gating = true;
++
+ 	init.name = kasprintf(GFP_KERNEL, "krait%s_sec_mux", s);
+ 	if (!init.name)
+ 		return -ENOMEM;
diff --git a/target/linux/ipq806x/patches-5.15/118-v6.1-03-clk-introduce-devm_-hw_register_mux_parent_data_tabl.patch b/target/linux/ipq806x/patches-5.15/118-v6.1-03-clk-introduce-devm_-hw_register_mux_parent_data_tabl.patch
new file mode 100644
index 00000000000000..8567d0802bcc6a
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/118-v6.1-03-clk-introduce-devm_-hw_register_mux_parent_data_tabl.patch
@@ -0,0 +1,46 @@
+From e4cacac0cae3ce7399b70df3bce92eac03151624 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 12 Apr 2022 16:48:39 +0200
+Subject: [PATCH 3/4] clk: introduce (devm_)hw_register_mux_parent_data_table
+ API
+
+Introduce (devm_)hw_register_mux_parent_data_table new API. We have
+basic support for clk_register_mux using parent_data but we lack any API
+to provide a custom parent_map. Add these 2 new API to correctly handle
+these special configuration instead of using the generic
+__(devm_)clk_hw_register_mux API.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ include/linux/clk-provider.h | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/include/linux/clk-provider.h
++++ b/include/linux/clk-provider.h
+@@ -955,12 +955,26 @@ struct clk *clk_register_mux_table(struc
+ 	__clk_hw_register_mux((dev), NULL, (name), (num_parents), NULL, NULL, \
+ 			      (parent_data), (flags), (reg), (shift),	      \
+ 			      BIT((width)) - 1, (clk_mux_flags), NULL, (lock))
++#define clk_hw_register_mux_parent_data_table(dev, name, parent_data,	      \
++					      num_parents, flags, reg, shift, \
++					      width, clk_mux_flags, table,    \
++					      lock)			      \
++	__clk_hw_register_mux((dev), NULL, (name), (num_parents), NULL, NULL, \
++			      (parent_data), (flags), (reg), (shift),	      \
++			      BIT((width)) - 1, (clk_mux_flags), table, (lock))
+ #define devm_clk_hw_register_mux(dev, name, parent_names, num_parents, flags, reg, \
+ 			    shift, width, clk_mux_flags, lock)		      \
+ 	__devm_clk_hw_register_mux((dev), NULL, (name), (num_parents),	      \
+ 			      (parent_names), NULL, NULL, (flags), (reg),     \
+ 			      (shift), BIT((width)) - 1, (clk_mux_flags),     \
+ 			      NULL, (lock))
++#define devm_clk_hw_register_mux_parent_data_table(dev, name, parent_data,    \
++					      num_parents, flags, reg, shift, \
++					      width, clk_mux_flags, table,    \
++					      lock)			      \
++	__devm_clk_hw_register_mux((dev), NULL, (name), (num_parents), NULL,  \
++			      NULL, (parent_data), (flags), (reg), (shift),   \
++			      BIT((width)) - 1, (clk_mux_flags), table, (lock))
+ 
+ int clk_mux_val_to_index(struct clk_hw *hw, u32 *table, unsigned int flags,
+ 			 unsigned int val);
diff --git a/target/linux/ipq806x/patches-5.15/118-v6.1-04-clk-qcom-kpss-xcc-convert-to-parent-data-API.patch b/target/linux/ipq806x/patches-5.15/118-v6.1-04-clk-qcom-kpss-xcc-convert-to-parent-data-API.patch
new file mode 100644
index 00000000000000..6c5f5ea96b240a
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/118-v6.1-04-clk-qcom-kpss-xcc-convert-to-parent-data-API.patch
@@ -0,0 +1,70 @@
+From d08c79b818767f24c3c9cbba585d8a3ec896c1a1 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 17 Feb 2022 22:43:34 +0100
+Subject: [PATCH 4/4] clk: qcom: kpss-xcc: convert to parent data API
+
+Convert the driver to parent data API. From the Documentation pll8_vote
+and pxo should be declared in the DTS so fw_name can be used instead of
+parent_names. Name is still used to save regression on old definition.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/clk/qcom/kpss-xcc.c | 26 +++++++++-----------------
+ 1 file changed, 9 insertions(+), 17 deletions(-)
+
+--- a/drivers/clk/qcom/kpss-xcc.c
++++ b/drivers/clk/qcom/kpss-xcc.c
+@@ -12,9 +12,9 @@
+ #include <linux/clk.h>
+ #include <linux/clk-provider.h>
+ 
+-static const char *aux_parents[] = {
+-	"pll8_vote",
+-	"pxo",
++static const struct clk_parent_data aux_parents[] = {
++	{ .name = "pll8_vote", .fw_name = "pll8_vote" },
++	{ .name = "pxo", .fw_name = "pxo" },
+ };
+ 
+ static unsigned int aux_parent_map[] = {
+@@ -32,9 +32,9 @@ MODULE_DEVICE_TABLE(of, kpss_xcc_match_t
+ static int kpss_xcc_driver_probe(struct platform_device *pdev)
+ {
+ 	const struct of_device_id *id;
+-	struct clk *clk;
+ 	struct resource *res;
+ 	void __iomem *base;
++	struct clk_hw *hw;
+ 	const char *name;
+ 
+ 	id = of_match_device(kpss_xcc_match_table, &pdev->dev);
+@@ -57,24 +57,16 @@ static int kpss_xcc_driver_probe(struct
+ 		base += 0x28;
+ 	}
+ 
+-	clk = clk_register_mux_table(&pdev->dev, name, aux_parents,
+-				     ARRAY_SIZE(aux_parents), 0, base, 0, 0x3,
+-				     0, aux_parent_map, NULL);
++	hw = devm_clk_hw_register_mux_parent_data_table(&pdev->dev, name, aux_parents,
++							ARRAY_SIZE(aux_parents), 0,
++							base, 0, 0x3,
++							0, aux_parent_map, NULL);
+ 
+-	platform_set_drvdata(pdev, clk);
+-
+-	return PTR_ERR_OR_ZERO(clk);
+-}
+-
+-static int kpss_xcc_driver_remove(struct platform_device *pdev)
+-{
+-	clk_unregister_mux(platform_get_drvdata(pdev));
+-	return 0;
++	return PTR_ERR_OR_ZERO(hw);
+ }
+ 
+ static struct platform_driver kpss_xcc_driver = {
+ 	.probe = kpss_xcc_driver_probe,
+-	.remove = kpss_xcc_driver_remove,
+ 	.driver = {
+ 		.name = "kpss-xcc",
+ 		.of_match_table = kpss_xcc_match_table,
diff --git a/target/linux/ipq806x/patches-5.15/119-v6.0-02-ARM-dts-qcom-add-rpmcc-missing-clocks-for-apq-ipq806.patch b/target/linux/ipq806x/patches-5.15/119-v6.0-02-ARM-dts-qcom-add-rpmcc-missing-clocks-for-apq-ipq806.patch
new file mode 100644
index 00000000000000..f853b5d2f24579
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/119-v6.0-02-ARM-dts-qcom-add-rpmcc-missing-clocks-for-apq-ipq806.patch
@@ -0,0 +1,61 @@
+From aa7fd3bb6017b343585e97a909f9b7d2fe174018 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 7 Jul 2022 00:53:19 +0200
+Subject: [PATCH] ARM: dts: qcom: add rpmcc missing clocks for apq/ipq8064 and
+ msm8660
+
+Add missing rpmcc pxo and cxo clock for apq8064, ipq8064 and
+msm8660 dtsi.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220706225321.26215-3-ansuelsmth@gmail.com
+---
+ arch/arm/boot/dts/qcom-apq8064.dtsi | 2 ++
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 2 ++
+ arch/arm/boot/dts/qcom-msm8660.dtsi | 4 +++-
+ 3 files changed, 7 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/qcom-apq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-apq8064.dtsi
+@@ -862,6 +862,8 @@
+ 			rpmcc: clock-controller {
+ 				compatible	= "qcom,rpmcc-apq8064", "qcom,rpmcc";
+ 				#clock-cells = <1>;
++				clocks = <&pxo_board>, <&cxo_board>;
++				clock-names = "pxo", "cxo";
+ 			};
+ 
+ 			regulators {
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -1074,6 +1074,8 @@
+ 			rpmcc: clock-controller {
+ 				compatible = "qcom,rpmcc-ipq806x", "qcom,rpmcc";
+ 				#clock-cells = <1>;
++				clocks = <&pxo_board>;
++				clock-names = "pxo";
+ 			};
+ 		};
+ 
+--- a/arch/arm/boot/dts/qcom-msm8660.dtsi
++++ b/arch/arm/boot/dts/qcom-msm8660.dtsi
+@@ -56,7 +56,7 @@
+ 			clock-frequency = <19200000>;
+ 		};
+ 
+-		pxo_board {
++		pxo_board: pxo_board {
+ 			compatible = "fixed-clock";
+ 			#clock-cells = <0>;
+ 			clock-frequency = <27000000>;
+@@ -420,6 +420,8 @@
+ 			rpmcc: clock-controller {
+ 				compatible	= "qcom,rpmcc-msm8660", "qcom,rpmcc";
+ 				#clock-cells = <1>;
++				clocks = <&pxo_board>;
++				clock-names = "pxo";
+ 			};
+ 
+ 			pm8901-regulators {
diff --git a/target/linux/ipq806x/patches-5.15/119-v6.0-03-clk-qcom-clk-rpm-convert-to-parent_data-API.patch b/target/linux/ipq806x/patches-5.15/119-v6.0-03-clk-qcom-clk-rpm-convert-to-parent_data-API.patch
new file mode 100644
index 00000000000000..8481b636708de7
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/119-v6.0-03-clk-qcom-clk-rpm-convert-to-parent_data-API.patch
@@ -0,0 +1,78 @@
+From 129d9cd9c25041f8b8681fd6e8584fa47c385f3b Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 7 Jul 2022 00:53:20 +0200
+Subject: [PATCH] clk: qcom: clk-rpm: convert to parent_data API
+
+Convert clk-rpm driver to parent_data API.
+We keep the old pxo/cxo_board parent naming to keep compatibility with
+old DT and we use the new pxo/cxo for new implementation where these
+clock are defined in DTS.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220706225321.26215-4-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/clk-rpm.c | 24 ++++++++++++++++--------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+--- a/drivers/clk/qcom/clk-rpm.c
++++ b/drivers/clk/qcom/clk-rpm.c
+@@ -23,6 +23,14 @@
+ #define QCOM_RPM_SCALING_ENABLE_ID			0x2
+ #define QCOM_RPM_XO_MODE_ON				0x2
+ 
++static const struct clk_parent_data gcc_pxo[] = {
++	{ .fw_name = "pxo", .name = "pxo_board" },
++};
++
++static const struct clk_parent_data gcc_cxo[] = {
++	{ .fw_name = "cxo", .name = "cxo_board" },
++};
++
+ #define DEFINE_CLK_RPM(_platform, _name, _active, r_id)			      \
+ 	static struct clk_rpm _platform##_##_active;			      \
+ 	static struct clk_rpm _platform##_##_name = {			      \
+@@ -32,8 +40,8 @@
+ 		.hw.init = &(struct clk_init_data){			      \
+ 			.ops = &clk_rpm_ops,				      \
+ 			.name = #_name,					      \
+-			.parent_names = (const char *[]){ "pxo_board" },      \
+-			.num_parents = 1,				      \
++			.parent_data = gcc_pxo,				      \
++			.num_parents = ARRAY_SIZE(gcc_pxo),		      \
+ 		},							      \
+ 	};								      \
+ 	static struct clk_rpm _platform##_##_active = {			      \
+@@ -44,8 +52,8 @@
+ 		.hw.init = &(struct clk_init_data){			      \
+ 			.ops = &clk_rpm_ops,				      \
+ 			.name = #_active,				      \
+-			.parent_names = (const char *[]){ "pxo_board" },      \
+-			.num_parents = 1,				      \
++			.parent_data = gcc_pxo,				      \
++			.num_parents = ARRAY_SIZE(gcc_pxo),		      \
+ 		},							      \
+ 	}
+ 
+@@ -56,8 +64,8 @@
+ 		.hw.init = &(struct clk_init_data){			      \
+ 			.ops = &clk_rpm_xo_ops,			      \
+ 			.name = #_name,					      \
+-			.parent_names = (const char *[]){ "cxo_board" },      \
+-			.num_parents = 1,				      \
++			.parent_data = gcc_cxo,				      \
++			.num_parents = ARRAY_SIZE(gcc_cxo),		      \
+ 		},							      \
+ 	}
+ 
+@@ -68,8 +76,8 @@
+ 		.hw.init = &(struct clk_init_data){			      \
+ 			.ops = &clk_rpm_fixed_ops,			      \
+ 			.name = #_name,					      \
+-			.parent_names = (const char *[]){ "pxo" },	      \
+-			.num_parents = 1,				      \
++			.parent_data = gcc_pxo,				      \
++			.num_parents = ARRAY_SIZE(gcc_pxo),		      \
+ 		},							      \
+ 	}
+ 
diff --git a/target/linux/ipq806x/patches-5.15/120-v6.2-clk-qcom-kpss-xcc-register-it-as-clk-provider.patch b/target/linux/ipq806x/patches-5.15/120-v6.2-clk-qcom-kpss-xcc-register-it-as-clk-provider.patch
new file mode 100644
index 00000000000000..ace313663d51fc
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/120-v6.2-clk-qcom-kpss-xcc-register-it-as-clk-provider.patch
@@ -0,0 +1,61 @@
+From 09be1a39e685d8c5edd471fd1cac9a8f8280d2de Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 8 Nov 2022 22:17:34 +0100
+Subject: [PATCH] clk: qcom: kpss-xcc: register it as clk provider
+
+krait-cc use this driver for the secondary mux. Register it as a clk
+provider to correctly use this clk in other drivers.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221108211734.3707-1-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/kpss-xcc.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/clk/qcom/kpss-xcc.c
++++ b/drivers/clk/qcom/kpss-xcc.c
+@@ -31,13 +31,14 @@ MODULE_DEVICE_TABLE(of, kpss_xcc_match_t
+ 
+ static int kpss_xcc_driver_probe(struct platform_device *pdev)
+ {
++	struct device *dev = &pdev->dev;
+ 	const struct of_device_id *id;
+ 	struct resource *res;
+ 	void __iomem *base;
+ 	struct clk_hw *hw;
+ 	const char *name;
+ 
+-	id = of_match_device(kpss_xcc_match_table, &pdev->dev);
++	id = of_match_device(kpss_xcc_match_table, dev);
+ 	if (!id)
+ 		return -ENODEV;
+ 
+@@ -47,7 +48,7 @@ static int kpss_xcc_driver_probe(struct
+ 		return PTR_ERR(base);
+ 
+ 	if (id->data) {
+-		if (of_property_read_string_index(pdev->dev.of_node,
++		if (of_property_read_string_index(dev->of_node,
+ 						  "clock-output-names",
+ 						  0, &name))
+ 			return -ENODEV;
+@@ -57,12 +58,16 @@ static int kpss_xcc_driver_probe(struct
+ 		base += 0x28;
+ 	}
+ 
+-	hw = devm_clk_hw_register_mux_parent_data_table(&pdev->dev, name, aux_parents,
++	hw = devm_clk_hw_register_mux_parent_data_table(dev, name, aux_parents,
+ 							ARRAY_SIZE(aux_parents), 0,
+ 							base, 0, 0x3,
+ 							0, aux_parent_map, NULL);
++	if (IS_ERR(hw))
++		return PTR_ERR(hw);
+ 
+-	return PTR_ERR_OR_ZERO(hw);
++	of_clk_add_hw_provider(dev->of_node, of_clk_hw_simple_get, hw);
++
++	return 0;
+ }
+ 
+ static struct platform_driver kpss_xcc_driver = {
diff --git a/target/linux/ipq806x/patches-5.15/121-v6.2-01-clk-qcom-krait-cc-use-devm-variant-for-clk-notifier-.patch b/target/linux/ipq806x/patches-5.15/121-v6.2-01-clk-qcom-krait-cc-use-devm-variant-for-clk-notifier-.patch
new file mode 100644
index 00000000000000..65c1fc17f21279
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/121-v6.2-01-clk-qcom-krait-cc-use-devm-variant-for-clk-notifier-.patch
@@ -0,0 +1,27 @@
+From 3198106a99e73dbc4c02bd5128cec0997c73af82 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 8 Nov 2022 22:58:27 +0100
+Subject: [PATCH 1/6] clk: qcom: krait-cc: use devm variant for clk notifier
+ register
+
+Use devm variant for clk notifier register and correctly handle free
+resource on driver remove.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221108215827.30475-1-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/krait-cc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -62,7 +62,7 @@ static int krait_notifier_register(struc
+ 	int ret = 0;
+ 
+ 	mux->clk_nb.notifier_call = krait_notifier_cb;
+-	ret = clk_notifier_register(clk, &mux->clk_nb);
++	ret = devm_clk_notifier_register(dev, clk, &mux->clk_nb);
+ 	if (ret)
+ 		dev_err(dev, "failed to register clock notifier: %d\n", ret);
+ 
diff --git a/target/linux/ipq806x/patches-5.15/121-v6.2-02-clk-qcom-krait-cc-fix-wrong-parent-order-for-seconda.patch b/target/linux/ipq806x/patches-5.15/121-v6.2-02-clk-qcom-krait-cc-fix-wrong-parent-order-for-seconda.patch
new file mode 100644
index 00000000000000..2dcb69399cfeb3
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/121-v6.2-02-clk-qcom-krait-cc-fix-wrong-parent-order-for-seconda.patch
@@ -0,0 +1,46 @@
+From 8e456411abcbf899c04740b9dbb3dcefcd61c946 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 9 Nov 2022 01:56:27 +0100
+Subject: [PATCH 2/6] clk: qcom: krait-cc: fix wrong parent order for secondary
+ mux
+
+The secondary mux parent order is swapped.
+This currently doesn't cause problems as the secondary mux is used for idle
+clk and as a safe clk source while reprogramming the hfpll.
+
+Each mux have 2 or more output but he always have a safe source to
+switch while reprogramming the connected pll. We use a clk notifier to
+switch to the correct parent before clk core can apply the correct rate.
+The parent to switch is hardcoded in the mux struct.
+
+For the secondary mux the safe source to use is the qsb parent as it's
+the only fixed clk as the acpus_aux is a pll that can source from pxo or
+from pll8.
+
+The hardcoded safe parent for the secondary mux is set to index 0 that
+in the secondary mux map is set to 2.
+
+But the index 0 is actually acpu_aux in the parent list.
+
+Fix the swapped parents to correctly handle idle frequency and output a
+sane clk_summary report.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221109005631.3189-1-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/krait-cc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -116,8 +116,8 @@ krait_add_sec_mux(struct device *dev, in
+ 	int ret;
+ 	struct krait_mux_clk *mux;
+ 	static const char *sec_mux_list[] = {
+-		"acpu_aux",
+ 		"qsb",
++		"acpu_aux",
+ 	};
+ 	struct clk_init_data init = {
+ 		.parent_names = sec_mux_list,
diff --git a/target/linux/ipq806x/patches-5.15/121-v6.2-03-clk-qcom-krait-cc-also-enable-secondary-mux-and-div-.patch b/target/linux/ipq806x/patches-5.15/121-v6.2-03-clk-qcom-krait-cc-also-enable-secondary-mux-and-div-.patch
new file mode 100644
index 00000000000000..6261a940d7196d
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/121-v6.2-03-clk-qcom-krait-cc-also-enable-secondary-mux-and-div-.patch
@@ -0,0 +1,68 @@
+From 18ae57b1e8abee6c453381470f6e18991d2901a8 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 9 Nov 2022 01:56:28 +0100
+Subject: [PATCH 3/6] clk: qcom: krait-cc: also enable secondary mux and div
+ clk
+
+clk-krait ignore any rate change if clk is not flagged as enabled.
+Correctly enable the secondary mux and div clk to correctly change rate
+instead of silently ignoring the request.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221109005631.3189-2-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/krait-cc.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -80,6 +80,7 @@ krait_add_div(struct device *dev, int id
+ 	};
+ 	const char *p_names[1];
+ 	struct clk *clk;
++	int cpu;
+ 
+ 	div = devm_kzalloc(dev, sizeof(*div), GFP_KERNEL);
+ 	if (!div)
+@@ -103,6 +104,17 @@ krait_add_div(struct device *dev, int id
+ 	}
+ 
+ 	clk = devm_clk_register(dev, &div->hw);
++	if (IS_ERR(clk))
++		goto err;
++
++	/* clk-krait ignore any rate change if mux is not flagged as enabled */
++	if (id < 0)
++		for_each_online_cpu(cpu)
++			clk_prepare_enable(div->hw.clk);
++	else
++		clk_prepare_enable(div->hw.clk);
++
++err:
+ 	kfree(p_names[0]);
+ 	kfree(init.name);
+ 
+@@ -113,7 +125,7 @@ static int
+ krait_add_sec_mux(struct device *dev, int id, const char *s,
+ 		  unsigned int offset, bool unique_aux)
+ {
+-	int ret;
++	int cpu, ret;
+ 	struct krait_mux_clk *mux;
+ 	static const char *sec_mux_list[] = {
+ 		"qsb",
+@@ -165,6 +177,13 @@ krait_add_sec_mux(struct device *dev, in
+ 	if (ret)
+ 		goto unique_aux;
+ 
++	/* clk-krait ignore any rate change if mux is not flagged as enabled */
++	if (id < 0)
++		for_each_online_cpu(cpu)
++			clk_prepare_enable(mux->hw.clk);
++	else
++		clk_prepare_enable(mux->hw.clk);
++
+ unique_aux:
+ 	if (unique_aux)
+ 		kfree(sec_mux_list[0]);
diff --git a/target/linux/ipq806x/patches-5.15/121-v6.2-04-clk-qcom-krait-cc-handle-secondary-mux-sourcing-out-.patch b/target/linux/ipq806x/patches-5.15/121-v6.2-04-clk-qcom-krait-cc-handle-secondary-mux-sourcing-out-.patch
new file mode 100644
index 00000000000000..fabb299f427776
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/121-v6.2-04-clk-qcom-krait-cc-handle-secondary-mux-sourcing-out-.patch
@@ -0,0 +1,48 @@
+From e5dc1a4c01510da8438dddfdf4200b79d73990dc Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 9 Nov 2022 01:56:29 +0100
+Subject: [PATCH 4/6] clk: qcom: krait-cc: handle secondary mux sourcing out of
+ acpu_aux
+
+Some bootloader may leave the system in an even more undefined state
+with the secondary mux of L2 or other cores sourcing out of the acpu_aux
+parent. This results in the clk set to the PXO rate or a PLL8 rate.
+
+The current logic to reset the mux and set them to a defined state only
+handle if the mux are configured to source out of QSB. Change this and
+force a new and defined state if the current clk is lower than the aux
+rate. This way we can handle any wrong configuration where the mux is
+sourcing out of QSB (rate 225MHz, currently set to a virtual rate of 1),
+PXO rate (rate 25MHz) or PLL8 (needs to be configured to run at 384Mhz).
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221109005631.3189-3-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/krait-cc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -383,8 +383,8 @@ static int krait_cc_probe(struct platfor
+ 	 */
+ 	cur_rate = clk_get_rate(l2_pri_mux_clk);
+ 	aux_rate = 384000000;
+-	if (cur_rate == 1) {
+-		pr_info("L2 @ QSB rate. Forcing new rate.\n");
++	if (cur_rate < aux_rate) {
++		pr_info("L2 @ Undefined rate. Forcing new rate.\n");
+ 		cur_rate = aux_rate;
+ 	}
+ 	clk_set_rate(l2_pri_mux_clk, aux_rate);
+@@ -394,8 +394,8 @@ static int krait_cc_probe(struct platfor
+ 	for_each_possible_cpu(cpu) {
+ 		clk = clks[cpu];
+ 		cur_rate = clk_get_rate(clk);
+-		if (cur_rate == 1) {
+-			pr_info("CPU%d @ QSB rate. Forcing new rate.\n", cpu);
++		if (cur_rate < aux_rate) {
++			pr_info("CPU%d @ Undefined rate. Forcing new rate.\n", cpu);
+ 			cur_rate = aux_rate;
+ 		}
+ 
diff --git a/target/linux/ipq806x/patches-5.15/121-v6.2-05-clk-qcom-krait-cc-convert-to-devm_clk_hw_register.patch b/target/linux/ipq806x/patches-5.15/121-v6.2-05-clk-qcom-krait-cc-convert-to-devm_clk_hw_register.patch
new file mode 100644
index 00000000000000..049b1fa49f1200
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/121-v6.2-05-clk-qcom-krait-cc-convert-to-devm_clk_hw_register.patch
@@ -0,0 +1,104 @@
+From 8ea9fb841a7e528bc8ae79d726ce951dcf7b46e2 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 9 Nov 2022 01:56:30 +0100
+Subject: [PATCH 5/6] clk: qcom: krait-cc: convert to devm_clk_hw_register
+
+clk_register is now deprecated. Convert the driver to devm_clk_hw_register.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221109005631.3189-4-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/krait-cc.c | 31 +++++++++++++++++++------------
+ 1 file changed, 19 insertions(+), 12 deletions(-)
+
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -79,8 +79,7 @@ krait_add_div(struct device *dev, int id
+ 		.flags = CLK_SET_RATE_PARENT,
+ 	};
+ 	const char *p_names[1];
+-	struct clk *clk;
+-	int cpu;
++	int cpu, ret;
+ 
+ 	div = devm_kzalloc(dev, sizeof(*div), GFP_KERNEL);
+ 	if (!div)
+@@ -103,8 +102,8 @@ krait_add_div(struct device *dev, int id
+ 		return -ENOMEM;
+ 	}
+ 
+-	clk = devm_clk_register(dev, &div->hw);
+-	if (IS_ERR(clk))
++	ret = devm_clk_hw_register(dev, &div->hw);
++	if (ret)
+ 		goto err;
+ 
+ 	/* clk-krait ignore any rate change if mux is not flagged as enabled */
+@@ -118,7 +117,7 @@ err:
+ 	kfree(p_names[0]);
+ 	kfree(init.name);
+ 
+-	return PTR_ERR_OR_ZERO(clk);
++	return ret;
+ }
+ 
+ static int
+@@ -137,7 +136,6 @@ krait_add_sec_mux(struct device *dev, in
+ 		.ops = &krait_mux_clk_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+ 	};
+-	struct clk *clk;
+ 
+ 	mux = devm_kzalloc(dev, sizeof(*mux), GFP_KERNEL);
+ 	if (!mux)
+@@ -166,14 +164,16 @@ krait_add_sec_mux(struct device *dev, in
+ 	if (unique_aux) {
+ 		sec_mux_list[0] = kasprintf(GFP_KERNEL, "acpu%s_aux", s);
+ 		if (!sec_mux_list[0]) {
+-			clk = ERR_PTR(-ENOMEM);
++			ret = -ENOMEM;
+ 			goto err_aux;
+ 		}
+ 	}
+ 
+-	clk = devm_clk_register(dev, &mux->hw);
++	ret = devm_clk_hw_register(dev, &mux->hw);
++	if (ret)
++		goto unique_aux;
+ 
+-	ret = krait_notifier_register(dev, clk, mux);
++	ret = krait_notifier_register(dev, mux->hw.clk, mux);
+ 	if (ret)
+ 		goto unique_aux;
+ 
+@@ -189,7 +189,7 @@ unique_aux:
+ 		kfree(sec_mux_list[0]);
+ err_aux:
+ 	kfree(init.name);
+-	return PTR_ERR_OR_ZERO(clk);
++	return ret;
+ }
+ 
+ static struct clk *
+@@ -241,11 +241,18 @@ krait_add_pri_mux(struct device *dev, in
+ 		goto err_p2;
+ 	}
+ 
+-	clk = devm_clk_register(dev, &mux->hw);
++	ret = devm_clk_hw_register(dev, &mux->hw);
++	if (ret) {
++		clk = ERR_PTR(ret);
++		goto err_p3;
++	}
++
++	clk = mux->hw.clk;
+ 
+ 	ret = krait_notifier_register(dev, clk, mux);
+ 	if (ret)
+-		goto err_p3;
++		clk = ERR_PTR(ret);
++
+ err_p3:
+ 	kfree(p_names[2]);
+ err_p2:
diff --git a/target/linux/ipq806x/patches-5.15/121-v6.2-06-clk-qcom-krait-cc-convert-to-parent_data-API.patch b/target/linux/ipq806x/patches-5.15/121-v6.2-06-clk-qcom-krait-cc-convert-to-parent_data-API.patch
new file mode 100644
index 00000000000000..453a37dfc08b7f
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/121-v6.2-06-clk-qcom-krait-cc-convert-to-parent_data-API.patch
@@ -0,0 +1,414 @@
+From 56a655e1c41a86445cf2de656649ad93424b2a63 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 9 Nov 2022 01:56:31 +0100
+Subject: [PATCH 6/6] clk: qcom: krait-cc: convert to parent_data API
+
+Modernize the krait-cc driver to parent-data API and refactor to drop
+any use of parent_names. From Documentation all the required clocks should
+be declared in DTS so fw_name can be correctly used to get the parents
+for all the muxes. .name is also declared to save compatibility with old
+DT.
+
+While at it also drop some hardcoded index and introduce an enum to make
+index values more clear.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221109005631.3189-5-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/krait-cc.c | 202 ++++++++++++++++++++----------------
+ 1 file changed, 112 insertions(+), 90 deletions(-)
+
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -15,6 +15,16 @@
+ 
+ #include "clk-krait.h"
+ 
++enum {
++	cpu0_mux = 0,
++	cpu1_mux,
++	cpu2_mux,
++	cpu3_mux,
++	l2_mux,
++
++	clks_max,
++};
++
+ static unsigned int sec_mux_map[] = {
+ 	2,
+ 	0,
+@@ -69,21 +79,23 @@ static int krait_notifier_register(struc
+ 	return ret;
+ }
+ 
+-static int
++static struct clk_hw *
+ krait_add_div(struct device *dev, int id, const char *s, unsigned int offset)
+ {
+ 	struct krait_div2_clk *div;
++	static struct clk_parent_data p_data[1];
+ 	struct clk_init_data init = {
+-		.num_parents = 1,
++		.num_parents = ARRAY_SIZE(p_data),
+ 		.ops = &krait_div2_clk_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+ 	};
+-	const char *p_names[1];
++	struct clk_hw *clk;
++	char *parent_name;
+ 	int cpu, ret;
+ 
+ 	div = devm_kzalloc(dev, sizeof(*div), GFP_KERNEL);
+ 	if (!div)
+-		return -ENOMEM;
++		return ERR_PTR(-ENOMEM);
+ 
+ 	div->width = 2;
+ 	div->shift = 6;
+@@ -93,18 +105,25 @@ krait_add_div(struct device *dev, int id
+ 
+ 	init.name = kasprintf(GFP_KERNEL, "hfpll%s_div", s);
+ 	if (!init.name)
+-		return -ENOMEM;
++		return ERR_PTR(-ENOMEM);
+ 
+-	init.parent_names = p_names;
+-	p_names[0] = kasprintf(GFP_KERNEL, "hfpll%s", s);
+-	if (!p_names[0]) {
+-		kfree(init.name);
+-		return -ENOMEM;
++	init.parent_data = p_data;
++	parent_name = kasprintf(GFP_KERNEL, "hfpll%s", s);
++	if (!parent_name) {
++		clk = ERR_PTR(-ENOMEM);
++		goto err_parent_name;
+ 	}
+ 
++	p_data[0].fw_name = parent_name;
++	p_data[0].name = parent_name;
++
+ 	ret = devm_clk_hw_register(dev, &div->hw);
+-	if (ret)
+-		goto err;
++	if (ret) {
++		clk = ERR_PTR(ret);
++		goto err_clk;
++	}
++
++	clk = &div->hw;
+ 
+ 	/* clk-krait ignore any rate change if mux is not flagged as enabled */
+ 	if (id < 0)
+@@ -113,33 +132,36 @@ krait_add_div(struct device *dev, int id
+ 	else
+ 		clk_prepare_enable(div->hw.clk);
+ 
+-err:
+-	kfree(p_names[0]);
++err_clk:
++	kfree(parent_name);
++err_parent_name:
+ 	kfree(init.name);
+ 
+-	return ret;
++	return clk;
+ }
+ 
+-static int
++static struct clk_hw *
+ krait_add_sec_mux(struct device *dev, int id, const char *s,
+ 		  unsigned int offset, bool unique_aux)
+ {
+ 	int cpu, ret;
+ 	struct krait_mux_clk *mux;
+-	static const char *sec_mux_list[] = {
+-		"qsb",
+-		"acpu_aux",
++	static struct clk_parent_data sec_mux_list[2] = {
++		{ .name = "qsb", .fw_name = "qsb" },
++		{},
+ 	};
+ 	struct clk_init_data init = {
+-		.parent_names = sec_mux_list,
++		.parent_data = sec_mux_list,
+ 		.num_parents = ARRAY_SIZE(sec_mux_list),
+ 		.ops = &krait_mux_clk_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+ 	};
++	struct clk_hw *clk;
++	char *parent_name;
+ 
+ 	mux = devm_kzalloc(dev, sizeof(*mux), GFP_KERNEL);
+ 	if (!mux)
+-		return -ENOMEM;
++		return ERR_PTR(-ENOMEM);
+ 
+ 	mux->offset = offset;
+ 	mux->lpl = id >= 0;
+@@ -159,23 +181,33 @@ krait_add_sec_mux(struct device *dev, in
+ 
+ 	init.name = kasprintf(GFP_KERNEL, "krait%s_sec_mux", s);
+ 	if (!init.name)
+-		return -ENOMEM;
++		return ERR_PTR(-ENOMEM);
+ 
+ 	if (unique_aux) {
+-		sec_mux_list[0] = kasprintf(GFP_KERNEL, "acpu%s_aux", s);
+-		if (!sec_mux_list[0]) {
+-			ret = -ENOMEM;
++		parent_name = kasprintf(GFP_KERNEL, "acpu%s_aux", s);
++		if (!parent_name) {
++			clk = ERR_PTR(-ENOMEM);
+ 			goto err_aux;
+ 		}
++		sec_mux_list[1].fw_name = parent_name;
++		sec_mux_list[1].name = parent_name;
++	} else {
++		sec_mux_list[1].name = "apu_aux";
+ 	}
+ 
+ 	ret = devm_clk_hw_register(dev, &mux->hw);
+-	if (ret)
+-		goto unique_aux;
++	if (ret) {
++		clk = ERR_PTR(ret);
++		goto err_clk;
++	}
++
++	clk = &mux->hw;
+ 
+ 	ret = krait_notifier_register(dev, mux->hw.clk, mux);
+-	if (ret)
+-		goto unique_aux;
++	if (ret) {
++		clk = ERR_PTR(ret);
++		goto err_clk;
++	}
+ 
+ 	/* clk-krait ignore any rate change if mux is not flagged as enabled */
+ 	if (id < 0)
+@@ -184,28 +216,29 @@ krait_add_sec_mux(struct device *dev, in
+ 	else
+ 		clk_prepare_enable(mux->hw.clk);
+ 
+-unique_aux:
++err_clk:
+ 	if (unique_aux)
+-		kfree(sec_mux_list[0]);
++		kfree(parent_name);
+ err_aux:
+ 	kfree(init.name);
+-	return ret;
++	return clk;
+ }
+ 
+-static struct clk *
+-krait_add_pri_mux(struct device *dev, int id, const char *s,
+-		  unsigned int offset)
++static struct clk_hw *
++krait_add_pri_mux(struct device *dev, struct clk_hw *hfpll_div, struct clk_hw *sec_mux,
++		  int id, const char *s, unsigned int offset)
+ {
+ 	int ret;
+ 	struct krait_mux_clk *mux;
+-	const char *p_names[3];
++	static struct clk_parent_data p_data[3];
+ 	struct clk_init_data init = {
+-		.parent_names = p_names,
+-		.num_parents = ARRAY_SIZE(p_names),
++		.parent_data = p_data,
++		.num_parents = ARRAY_SIZE(p_data),
+ 		.ops = &krait_mux_clk_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+ 	};
+-	struct clk *clk;
++	struct clk_hw *clk;
++	char *hfpll_name;
+ 
+ 	mux = devm_kzalloc(dev, sizeof(*mux), GFP_KERNEL);
+ 	if (!mux)
+@@ -223,55 +256,44 @@ krait_add_pri_mux(struct device *dev, in
+ 	if (!init.name)
+ 		return ERR_PTR(-ENOMEM);
+ 
+-	p_names[0] = kasprintf(GFP_KERNEL, "hfpll%s", s);
+-	if (!p_names[0]) {
++	hfpll_name = kasprintf(GFP_KERNEL, "hfpll%s", s);
++	if (!hfpll_name) {
+ 		clk = ERR_PTR(-ENOMEM);
+-		goto err_p0;
++		goto err_hfpll;
+ 	}
+ 
+-	p_names[1] = kasprintf(GFP_KERNEL, "hfpll%s_div", s);
+-	if (!p_names[1]) {
+-		clk = ERR_PTR(-ENOMEM);
+-		goto err_p1;
+-	}
++	p_data[0].fw_name = hfpll_name;
++	p_data[0].name = hfpll_name;
+ 
+-	p_names[2] = kasprintf(GFP_KERNEL, "krait%s_sec_mux", s);
+-	if (!p_names[2]) {
+-		clk = ERR_PTR(-ENOMEM);
+-		goto err_p2;
+-	}
++	p_data[1].hw = hfpll_div;
++	p_data[2].hw = sec_mux;
+ 
+ 	ret = devm_clk_hw_register(dev, &mux->hw);
+ 	if (ret) {
+ 		clk = ERR_PTR(ret);
+-		goto err_p3;
++		goto err_clk;
+ 	}
+ 
+-	clk = mux->hw.clk;
++	clk = &mux->hw;
+ 
+-	ret = krait_notifier_register(dev, clk, mux);
++	ret = krait_notifier_register(dev, mux->hw.clk, mux);
+ 	if (ret)
+ 		clk = ERR_PTR(ret);
+ 
+-err_p3:
+-	kfree(p_names[2]);
+-err_p2:
+-	kfree(p_names[1]);
+-err_p1:
+-	kfree(p_names[0]);
+-err_p0:
++err_clk:
++	kfree(hfpll_name);
++err_hfpll:
+ 	kfree(init.name);
+ 	return clk;
+ }
+ 
+ /* id < 0 for L2, otherwise id == physical CPU number */
+-static struct clk *krait_add_clks(struct device *dev, int id, bool unique_aux)
++static struct clk_hw *krait_add_clks(struct device *dev, int id, bool unique_aux)
+ {
+-	int ret;
++	struct clk_hw *hfpll_div, *sec_mux, *pri_mux;
+ 	unsigned int offset;
+ 	void *p = NULL;
+ 	const char *s;
+-	struct clk *clk;
+ 
+ 	if (id >= 0) {
+ 		offset = 0x4501 + (0x1000 * id);
+@@ -283,22 +305,23 @@ static struct clk *krait_add_clks(struct
+ 		s = "_l2";
+ 	}
+ 
+-	ret = krait_add_div(dev, id, s, offset);
+-	if (ret) {
+-		clk = ERR_PTR(ret);
++	hfpll_div = krait_add_div(dev, id, s, offset);
++	if (IS_ERR(hfpll_div)) {
++		pri_mux = hfpll_div;
+ 		goto err;
+ 	}
+ 
+-	ret = krait_add_sec_mux(dev, id, s, offset, unique_aux);
+-	if (ret) {
+-		clk = ERR_PTR(ret);
++	sec_mux = krait_add_sec_mux(dev, id, s, offset, unique_aux);
++	if (IS_ERR(sec_mux)) {
++		pri_mux = sec_mux;
+ 		goto err;
+ 	}
+ 
+-	clk = krait_add_pri_mux(dev, id, s, offset);
++	pri_mux = krait_add_pri_mux(dev, hfpll_div, sec_mux, id, s, offset);
++
+ err:
+ 	kfree(p);
+-	return clk;
++	return pri_mux;
+ }
+ 
+ static struct clk *krait_of_get(struct of_phandle_args *clkspec, void *data)
+@@ -306,7 +329,7 @@ static struct clk *krait_of_get(struct o
+ 	unsigned int idx = clkspec->args[0];
+ 	struct clk **clks = data;
+ 
+-	if (idx >= 5) {
++	if (idx >= clks_max) {
+ 		pr_err("%s: invalid clock index %d\n", __func__, idx);
+ 		return ERR_PTR(-EINVAL);
+ 	}
+@@ -327,9 +350,8 @@ static int krait_cc_probe(struct platfor
+ 	const struct of_device_id *id;
+ 	unsigned long cur_rate, aux_rate;
+ 	int cpu;
+-	struct clk *clk;
+-	struct clk **clks;
+-	struct clk *l2_pri_mux_clk;
++	struct clk_hw *mux, *l2_pri_mux;
++	struct clk *clk, **clks;
+ 
+ 	id = of_match_device(krait_cc_match_table, dev);
+ 	if (!id)
+@@ -348,21 +370,21 @@ static int krait_cc_probe(struct platfor
+ 	}
+ 
+ 	/* Krait configurations have at most 4 CPUs and one L2 */
+-	clks = devm_kcalloc(dev, 5, sizeof(*clks), GFP_KERNEL);
++	clks = devm_kcalloc(dev, clks_max, sizeof(*clks), GFP_KERNEL);
+ 	if (!clks)
+ 		return -ENOMEM;
+ 
+ 	for_each_possible_cpu(cpu) {
+-		clk = krait_add_clks(dev, cpu, id->data);
++		mux = krait_add_clks(dev, cpu, id->data);
+ 		if (IS_ERR(clk))
+ 			return PTR_ERR(clk);
+-		clks[cpu] = clk;
++		clks[cpu] = mux->clk;
+ 	}
+ 
+-	l2_pri_mux_clk = krait_add_clks(dev, -1, id->data);
+-	if (IS_ERR(l2_pri_mux_clk))
+-		return PTR_ERR(l2_pri_mux_clk);
+-	clks[4] = l2_pri_mux_clk;
++	l2_pri_mux = krait_add_clks(dev, -1, id->data);
++	if (IS_ERR(l2_pri_mux))
++		return PTR_ERR(l2_pri_mux);
++	clks[l2_mux] = l2_pri_mux->clk;
+ 
+ 	/*
+ 	 * We don't want the CPU or L2 clocks to be turned off at late init
+@@ -372,7 +394,7 @@ static int krait_cc_probe(struct platfor
+ 	 * they take over.
+ 	 */
+ 	for_each_online_cpu(cpu) {
+-		clk_prepare_enable(l2_pri_mux_clk);
++		clk_prepare_enable(clks[l2_mux]);
+ 		WARN(clk_prepare_enable(clks[cpu]),
+ 		     "Unable to turn on CPU%d clock", cpu);
+ 	}
+@@ -388,16 +410,16 @@ static int krait_cc_probe(struct platfor
+ 	 * two different rates to force a HFPLL reinit under all
+ 	 * circumstances.
+ 	 */
+-	cur_rate = clk_get_rate(l2_pri_mux_clk);
++	cur_rate = clk_get_rate(clks[l2_mux]);
+ 	aux_rate = 384000000;
+ 	if (cur_rate < aux_rate) {
+ 		pr_info("L2 @ Undefined rate. Forcing new rate.\n");
+ 		cur_rate = aux_rate;
+ 	}
+-	clk_set_rate(l2_pri_mux_clk, aux_rate);
+-	clk_set_rate(l2_pri_mux_clk, 2);
+-	clk_set_rate(l2_pri_mux_clk, cur_rate);
+-	pr_info("L2 @ %lu KHz\n", clk_get_rate(l2_pri_mux_clk) / 1000);
++	clk_set_rate(clks[l2_mux], aux_rate);
++	clk_set_rate(clks[l2_mux], 2);
++	clk_set_rate(clks[l2_mux], cur_rate);
++	pr_info("L2 @ %lu KHz\n", clk_get_rate(clks[l2_mux]) / 1000);
+ 	for_each_possible_cpu(cpu) {
+ 		clk = clks[cpu];
+ 		cur_rate = clk_get_rate(clk);
diff --git a/target/linux/ipq806x/patches-5.15/122-01-clk-qcom-krait-cc-handle-qsb-clock-defined-in-DTS.patch b/target/linux/ipq806x/patches-5.15/122-01-clk-qcom-krait-cc-handle-qsb-clock-defined-in-DTS.patch
new file mode 100644
index 00000000000000..c30c245d0a55f6
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/122-01-clk-qcom-krait-cc-handle-qsb-clock-defined-in-DTS.patch
@@ -0,0 +1,47 @@
+From 666c1b745e93ccddde841d5057c33f97b29a316a Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 15 Sep 2022 02:19:28 +0200
+Subject: [PATCH 3/9] clk: qcom: krait-cc: handle qsb clock defined in DTS
+
+qsb fixed clk may be defined in DTS and correctly passed in the clocks
+list. Add related code to handle this and modify the logic to
+dynamically read qsb clock frequency.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/clk/qcom/krait-cc.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -348,7 +348,7 @@ static int krait_cc_probe(struct platfor
+ {
+ 	struct device *dev = &pdev->dev;
+ 	const struct of_device_id *id;
+-	unsigned long cur_rate, aux_rate;
++	unsigned long cur_rate, aux_rate, qsb_rate;
+ 	int cpu;
+ 	struct clk_hw *mux, *l2_pri_mux;
+ 	struct clk *clk, **clks;
+@@ -357,11 +357,19 @@ static int krait_cc_probe(struct platfor
+ 	if (!id)
+ 		return -ENODEV;
+ 
+-	/* Rate is 1 because 0 causes problems for __clk_mux_determine_rate */
+-	clk = clk_register_fixed_rate(dev, "qsb", NULL, 0, 1);
++	/*
++	 * Per Documentation qsb should be provided from DTS.
++	 * To address old implementation, register the fixed clock anyway.
++	 * Rate is 1 because 0 causes problems for __clk_mux_determine_rate
++	 */
++	clk = clk_get(dev, "qsb");
++	if (IS_ERR(clk))
++		clk = clk_register_fixed_rate(dev, "qsb", NULL, 0, 1);
+ 	if (IS_ERR(clk))
+ 		return PTR_ERR(clk);
+ 
++	qsb_rate = clk_get_rate(clk);
++
+ 	if (!id->data) {
+ 		clk = clk_register_fixed_factor(dev, "acpu_aux",
+ 						"gpll0_vote", 0, 1, 2);
diff --git a/target/linux/ipq806x/patches-5.15/122-02-clk-qcom-krait-cc-register-REAL-qsb-fixed-clock.patch b/target/linux/ipq806x/patches-5.15/122-02-clk-qcom-krait-cc-register-REAL-qsb-fixed-clock.patch
new file mode 100644
index 00000000000000..e2f78f79fb1a06
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/122-02-clk-qcom-krait-cc-register-REAL-qsb-fixed-clock.patch
@@ -0,0 +1,36 @@
+From fca6f185a9d9ef0892a719bc6da955b22d326ec7 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 15 Sep 2022 02:24:33 +0200
+Subject: [PATCH 4/9] clk: qcom: krait-cc: register REAL qsb fixed clock
+
+With some tools it was discovered the real frequency of the qsb fixed
+clock. While not 100% correct it's still better than using 1 as a dummy
+frequency.
+Correctly register the qsb fixed clock with the frequency of 225 MHz
+instead of 1.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/clk/qcom/krait-cc.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -25,6 +25,8 @@ enum {
+ 	clks_max,
+ };
+ 
++#define QSB_RATE	2250000000
++
+ static unsigned int sec_mux_map[] = {
+ 	2,
+ 	0,
+@@ -364,7 +366,7 @@ static int krait_cc_probe(struct platfor
+ 	 */
+ 	clk = clk_get(dev, "qsb");
+ 	if (IS_ERR(clk))
+-		clk = clk_register_fixed_rate(dev, "qsb", NULL, 0, 1);
++		clk = clk_register_fixed_rate(dev, "qsb", NULL, 0, QSB_RATE);
+ 	if (IS_ERR(clk))
+ 		return PTR_ERR(clk);
+ 
diff --git a/target/linux/ipq806x/patches-5.15/122-03-clk-qcom-krait-cc-drop-pr_info-and-use-dev_info.patch b/target/linux/ipq806x/patches-5.15/122-03-clk-qcom-krait-cc-drop-pr_info-and-use-dev_info.patch
new file mode 100644
index 00000000000000..d95a63fc44fd8a
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/122-03-clk-qcom-krait-cc-drop-pr_info-and-use-dev_info.patch
@@ -0,0 +1,44 @@
+From 2399d181557d94ae9a2686926cd25768f132e4b4 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Fri, 18 Mar 2022 16:12:14 +0100
+Subject: [PATCH 7/9] clk: qcom: krait-cc: drop pr_info and use dev_info
+
+Replace pr_info() with dev_info() to provide better diagnostics.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/clk/qcom/krait-cc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -423,25 +423,25 @@ static int krait_cc_probe(struct platfor
+ 	cur_rate = clk_get_rate(clks[l2_mux]);
+ 	aux_rate = 384000000;
+ 	if (cur_rate < aux_rate) {
+-		pr_info("L2 @ Undefined rate. Forcing new rate.\n");
++		dev_info(dev, "L2 @ Undefined rate. Forcing new rate.\n");
+ 		cur_rate = aux_rate;
+ 	}
+ 	clk_set_rate(clks[l2_mux], aux_rate);
+ 	clk_set_rate(clks[l2_mux], 2);
+ 	clk_set_rate(clks[l2_mux], cur_rate);
+-	pr_info("L2 @ %lu KHz\n", clk_get_rate(clks[l2_mux]) / 1000);
++	dev_info(dev, "L2 @ %lu KHz\n", clk_get_rate(clks[l2_mux]) / 1000);
+ 	for_each_possible_cpu(cpu) {
+ 		clk = clks[cpu];
+ 		cur_rate = clk_get_rate(clk);
+ 		if (cur_rate < aux_rate) {
+-			pr_info("CPU%d @ Undefined rate. Forcing new rate.\n", cpu);
++			dev_info(dev, "CPU%d @ Undefined rate. Forcing new rate.\n", cpu);
+ 			cur_rate = aux_rate;
+ 		}
+ 
+ 		clk_set_rate(clk, aux_rate);
+ 		clk_set_rate(clk, 2);
+ 		clk_set_rate(clk, cur_rate);
+-		pr_info("CPU%d @ %lu KHz\n", cpu, clk_get_rate(clk) / 1000);
++		dev_info(dev, "CPU%d @ %lu KHz\n", cpu, clk_get_rate(clk) / 1000);
+ 	}
+ 
+ 	of_clk_add_provider(dev->of_node, krait_of_get, clks);
diff --git a/target/linux/ipq806x/patches-5.15/122-04-clk-qcom-krait-cc-rework-mux-reset-logic-and-reset-h.patch b/target/linux/ipq806x/patches-5.15/122-04-clk-qcom-krait-cc-rework-mux-reset-logic-and-reset-h.patch
new file mode 100644
index 00000000000000..8f88e069912218
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/122-04-clk-qcom-krait-cc-rework-mux-reset-logic-and-reset-h.patch
@@ -0,0 +1,88 @@
+From 6a77cf3f5f95ec0058e1b4d1ada018748cb0b83b Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 15 Sep 2022 03:33:13 +0200
+Subject: [PATCH 9/9] clk: qcom: krait-cc: rework mux reset logic and reset
+ hfpll
+
+Rework and clean mux reset logic.
+Compact it to a for loop to handle both CPU and L2 in one place.
+Move hardcoded aux_rate to define and add a new hfpll_rate value to
+reset hfpll settings.
+Change logic to now reset the hfpll to the lowest value of 600 Mhz and
+then restoring the previous frequency. This permits to reset the hfpll if
+the primary mux was set to source out of the secondary mux.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/clk/qcom/krait-cc.c | 50 +++++++++++++++++--------------------
+ 1 file changed, 23 insertions(+), 27 deletions(-)
+
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -25,7 +25,9 @@ enum {
+ 	clks_max,
+ };
+ 
+-#define QSB_RATE	2250000000
++#define QSB_RATE	225000000
++#define AUX_RATE	384000000
++#define HFPLL_RATE	600000000
+ 
+ static unsigned int sec_mux_map[] = {
+ 	2,
+@@ -350,7 +352,7 @@ static int krait_cc_probe(struct platfor
+ {
+ 	struct device *dev = &pdev->dev;
+ 	const struct of_device_id *id;
+-	unsigned long cur_rate, aux_rate, qsb_rate;
++	unsigned long cur_rate, qsb_rate;
+ 	int cpu;
+ 	struct clk_hw *mux, *l2_pri_mux;
+ 	struct clk *clk, **clks;
+@@ -420,28 +422,29 @@ static int krait_cc_probe(struct platfor
+ 	 * two different rates to force a HFPLL reinit under all
+ 	 * circumstances.
+ 	 */
+-	cur_rate = clk_get_rate(clks[l2_mux]);
+-	aux_rate = 384000000;
+-	if (cur_rate < aux_rate) {
+-		dev_info(dev, "L2 @ Undefined rate. Forcing new rate.\n");
+-		cur_rate = aux_rate;
+-	}
+-	clk_set_rate(clks[l2_mux], aux_rate);
+-	clk_set_rate(clks[l2_mux], 2);
+-	clk_set_rate(clks[l2_mux], cur_rate);
+-	dev_info(dev, "L2 @ %lu KHz\n", clk_get_rate(clks[l2_mux]) / 1000);
+-	for_each_possible_cpu(cpu) {
++	for (cpu = 0; cpu < 5; cpu++) {
++		const char *l2_s = "L2";
++		char cpu_s[5];
++
+ 		clk = clks[cpu];
++		if (!clk)
++			continue;
++
++		if (cpu < 4)
++			snprintf(cpu_s, 5, "CPU%d", cpu);
++
+ 		cur_rate = clk_get_rate(clk);
+-		if (cur_rate < aux_rate) {
+-			dev_info(dev, "CPU%d @ Undefined rate. Forcing new rate.\n", cpu);
+-			cur_rate = aux_rate;
++		if (cur_rate < AUX_RATE) {
++			dev_info(dev, "%s @ Undefined rate. Forcing new rate.\n",
++				 cpu < 4 ? cpu_s : l2_s);
++			cur_rate = AUX_RATE;
+ 		}
+ 
+-		clk_set_rate(clk, aux_rate);
+-		clk_set_rate(clk, 2);
++		clk_set_rate(clk, AUX_RATE);
++		clk_set_rate(clk, HFPLL_RATE);
+ 		clk_set_rate(clk, cur_rate);
+-		dev_info(dev, "CPU%d @ %lu KHz\n", cpu, clk_get_rate(clk) / 1000);
++		dev_info(dev, "%s @ %lu KHz\n", cpu < 4 ? cpu_s : l2_s,
++			 clk_get_rate(clk) / 1000);
+ 	}
+ 
+ 	of_clk_add_provider(dev->of_node, krait_of_get, clks);
diff --git a/target/linux/ipq806x/patches-5.15/122-05-clk-qcom-clk-krait-generilize-div-functions.patch b/target/linux/ipq806x/patches-5.15/122-05-clk-qcom-clk-krait-generilize-div-functions.patch
new file mode 100644
index 00000000000000..a7c0f046c8421d
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/122-05-clk-qcom-clk-krait-generilize-div-functions.patch
@@ -0,0 +1,156 @@
+From 908c361b3c3a139eb3e6a798cb620a6da7514d5c Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Fri, 23 Sep 2022 19:05:39 +0200
+Subject: [PATCH 2/4] clk: qcom: clk-krait: generilize div functions
+
+Generilize div functions and remove hardcode to a divisor of 2.
+This is just a cleanup and permit to make it more clear the settings of
+the devisor when used by the krait-cc driver.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/clk/qcom/clk-krait.c | 57 ++++++++++++++++++++----------------
+ drivers/clk/qcom/clk-krait.h | 11 ++++---
+ drivers/clk/qcom/krait-cc.c  |  7 +++--
+ 3 files changed, 42 insertions(+), 33 deletions(-)
+
+--- a/drivers/clk/qcom/clk-krait.c
++++ b/drivers/clk/qcom/clk-krait.c
+@@ -97,53 +97,58 @@ const struct clk_ops krait_mux_clk_ops =
+ EXPORT_SYMBOL_GPL(krait_mux_clk_ops);
+ 
+ /* The divider can divide by 2, 4, 6 and 8. But we only really need div-2. */
+-static long krait_div2_round_rate(struct clk_hw *hw, unsigned long rate,
++static long krait_div_round_rate(struct clk_hw *hw, unsigned long rate,
+ 				  unsigned long *parent_rate)
+ {
+-	*parent_rate = clk_hw_round_rate(clk_hw_get_parent(hw), rate * 2);
+-	return DIV_ROUND_UP(*parent_rate, 2);
++	struct krait_div_clk *d = to_krait_div_clk(hw);
++
++	*parent_rate = clk_hw_round_rate(clk_hw_get_parent(hw),
++					 rate * d->divisor);
++
++	return DIV_ROUND_UP(*parent_rate, d->divisor);
+ }
+ 
+-static int krait_div2_set_rate(struct clk_hw *hw, unsigned long rate,
++static int krait_div_set_rate(struct clk_hw *hw, unsigned long rate,
+ 			       unsigned long parent_rate)
+ {
+-	struct krait_div2_clk *d = to_krait_div2_clk(hw);
++	struct krait_div_clk *d = to_krait_div_clk(hw);
++	u8 div_val = krait_div_to_val(d->divisor);
+ 	unsigned long flags;
+-	u32 val;
+-	u32 mask = BIT(d->width) - 1;
+-
+-	if (d->lpl)
+-		mask = mask << (d->shift + LPL_SHIFT) | mask << d->shift;
+-	else
+-		mask <<= d->shift;
++	u32 regval;
+ 
+ 	spin_lock_irqsave(&krait_clock_reg_lock, flags);
+-	val = krait_get_l2_indirect_reg(d->offset);
+-	val &= ~mask;
+-	krait_set_l2_indirect_reg(d->offset, val);
++	regval = krait_get_l2_indirect_reg(d->offset);
++
++	regval &= ~(d->mask << d->shift);
++	regval |= (div_val & d->mask) << d->shift;
++
++	if (d->lpl) {
++		regval &= ~(d->mask << (d->shift + LPL_SHIFT));
++		regval |= (div_val & d->mask) << (d->shift + LPL_SHIFT);
++	}
++
++	krait_set_l2_indirect_reg(d->offset, regval);
+ 	spin_unlock_irqrestore(&krait_clock_reg_lock, flags);
+ 
+ 	return 0;
+ }
+ 
+ static unsigned long
+-krait_div2_recalc_rate(struct clk_hw *hw, unsigned long parent_rate)
++krait_div_recalc_rate(struct clk_hw *hw, unsigned long parent_rate)
+ {
+-	struct krait_div2_clk *d = to_krait_div2_clk(hw);
+-	u32 mask = BIT(d->width) - 1;
++	struct krait_div_clk *d = to_krait_div_clk(hw);
+ 	u32 div;
+ 
+ 	div = krait_get_l2_indirect_reg(d->offset);
+ 	div >>= d->shift;
+-	div &= mask;
+-	div = (div + 1) * 2;
++	div &= d->mask;
+ 
+-	return DIV_ROUND_UP(parent_rate, div);
++	return DIV_ROUND_UP(parent_rate, krait_val_to_div(div));
+ }
+ 
+-const struct clk_ops krait_div2_clk_ops = {
+-	.round_rate = krait_div2_round_rate,
+-	.set_rate = krait_div2_set_rate,
+-	.recalc_rate = krait_div2_recalc_rate,
++const struct clk_ops krait_div_clk_ops = {
++	.round_rate = krait_div_round_rate,
++	.set_rate = krait_div_set_rate,
++	.recalc_rate = krait_div_recalc_rate,
+ };
+-EXPORT_SYMBOL_GPL(krait_div2_clk_ops);
++EXPORT_SYMBOL_GPL(krait_div_clk_ops);
+--- a/drivers/clk/qcom/clk-krait.h
++++ b/drivers/clk/qcom/clk-krait.h
+@@ -25,17 +25,20 @@ struct krait_mux_clk {
+ 
+ extern const struct clk_ops krait_mux_clk_ops;
+ 
+-struct krait_div2_clk {
++struct krait_div_clk {
+ 	u32		offset;
+-	u8		width;
++	u32		mask;
++	u8		divisor;
+ 	u32		shift;
+ 	bool		lpl;
+ 
+ 	struct clk_hw	hw;
+ };
+ 
+-#define to_krait_div2_clk(_hw) container_of(_hw, struct krait_div2_clk, hw)
++#define to_krait_div_clk(_hw) container_of(_hw, struct krait_div_clk, hw)
++#define krait_div_to_val(_div)		((_div) / 2) - 1
++#define krait_val_to_div(_val)		((_val) + 1) * 2
+ 
+-extern const struct clk_ops krait_div2_clk_ops;
++extern const struct clk_ops krait_div_clk_ops;
+ 
+ #endif
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -86,11 +86,11 @@ static int krait_notifier_register(struc
+ static struct clk_hw *
+ krait_add_div(struct device *dev, int id, const char *s, unsigned int offset)
+ {
+-	struct krait_div2_clk *div;
++	struct krait_div_clk *div;
+ 	static struct clk_parent_data p_data[1];
+ 	struct clk_init_data init = {
+ 		.num_parents = ARRAY_SIZE(p_data),
+-		.ops = &krait_div2_clk_ops,
++		.ops = &krait_div_clk_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+ 	};
+ 	struct clk_hw *clk;
+@@ -101,7 +101,8 @@ krait_add_div(struct device *dev, int id
+ 	if (!div)
+ 		return ERR_PTR(-ENOMEM);
+ 
+-	div->width = 2;
++	div->mask = 0x3;
++	div->divisor = 2;
+ 	div->shift = 6;
+ 	div->lpl = id >= 0;
+ 	div->offset = offset;
diff --git a/target/linux/ipq806x/patches-5.15/123-clk-qcom-gcc-ipq806x-remove-cc_register_board-for.patch b/target/linux/ipq806x/patches-5.15/123-clk-qcom-gcc-ipq806x-remove-cc_register_board-for.patch
new file mode 100644
index 00000000000000..20e7440ace88ec
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/123-clk-qcom-gcc-ipq806x-remove-cc_register_board-for.patch
@@ -0,0 +1,31 @@
+From ac84ac819a2e8fd3d87122b452c502a386c54437 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 5 Jul 2022 18:30:18 +0200
+Subject: [PATCH v2 4/4] clk: qcom: gcc-ipq806x: remove cc_register_board for
+ pxo and cxo
+
+Now that these clock are defined as fixed clk in dts, we can drop the
+register_board_clk for cxo_board and pxo_board in gcc_ipq806x_probe.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/clk/qcom/gcc-ipq806x.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+--- a/drivers/clk/qcom/gcc-ipq806x.c
++++ b/drivers/clk/qcom/gcc-ipq806x.c
+@@ -3384,14 +3384,6 @@ static int gcc_ipq806x_probe(struct plat
+ 	struct regmap *regmap;
+ 	int ret;
+ 
+-	ret = qcom_cc_register_board_clk(dev, "cxo_board", "cxo", 25000000);
+-	if (ret)
+-		return ret;
+-
+-	ret = qcom_cc_register_board_clk(dev, "pxo_board", "pxo", 25000000);
+-	if (ret)
+-		return ret;
+-
+ 	if (of_machine_is_compatible("qcom,ipq8065")) {
+ 		ubi32_core1_src_clk.freq_tbl = clk_tbl_nss_ipq8065;
+ 		ubi32_core2_src_clk.freq_tbl = clk_tbl_nss_ipq8065;
diff --git a/target/linux/ipq806x/patches-5.15/130-6.1-mtd-rawnand-qcom-handle-ret-from-parse-with-codeword.patch b/target/linux/ipq806x/patches-5.15/130-6.1-mtd-rawnand-qcom-handle-ret-from-parse-with-codeword.patch
new file mode 100644
index 00000000000000..2e7e6833bb8edc
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/130-6.1-mtd-rawnand-qcom-handle-ret-from-parse-with-codeword.patch
@@ -0,0 +1,55 @@
+From 7df140e84a75c89962feef659d686303d3ce75e5 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Fri, 21 Oct 2022 18:53:04 +0200
+Subject: [PATCH] mtd: rawnand: qcom: handle ret from parse with codeword_fixup
+
+With use_codeword_fixup enabled, any return from
+mtd_device_parse_register gets overwritten. Aside from the clear bug, this
+is also problematic as a parser can EPROBE_DEFER and because this is not
+correctly handled, the nand is never rescanned later in the bootup
+process.
+
+An example of this problem is when smem requires additional time to be
+probed and nandc use qcomsmempart as parser. Parser will return
+EPROBE_DEFER but in the current code this ret gets overwritten by
+qcom_nand_host_parse_boot_partitions and qcom_nand_host_init_and_register
+return 0.
+
+Correctly handle the return code from mtd_device_parse_register so that
+any error from this function is not ignored.
+
+Fixes: 862bdedd7f4b ("mtd: nand: raw: qcom_nandc: add support for unprotected spare data pages")
+Cc: stable@vger.kernel.org # v6.0+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20221021165304.19991-1-ansuelsmth@gmail.com
+---
+ drivers/mtd/nand/raw/qcom_nandc.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/mtd/nand/raw/qcom_nandc.c
++++ b/drivers/mtd/nand/raw/qcom_nandc.c
+@@ -3157,16 +3157,18 @@ static int qcom_nand_host_init_and_regis
+ 
+ 	ret = mtd_device_parse_register(mtd, probes, NULL, NULL, 0);
+ 	if (ret)
+-		nand_cleanup(chip);
++		goto err;
+ 
+ 	if (nandc->props->use_codeword_fixup) {
+ 		ret = qcom_nand_host_parse_boot_partitions(nandc, host, dn);
+-		if (ret) {
+-			nand_cleanup(chip);
+-			return ret;
+-		}
++		if (ret)
++			goto err;
+ 	}
+ 
++	return 0;
++
++err:
++	nand_cleanup(chip);
+ 	return ret;
+ }
+ 
diff --git a/target/linux/ipq806x/patches-5.15/131-6.2-ARM-dts-qcom-ipq8064-disable-mmc-ddr-1_8v-for-sdcc1.patch b/target/linux/ipq806x/patches-5.15/131-6.2-ARM-dts-qcom-ipq8064-disable-mmc-ddr-1_8v-for-sdcc1.patch
new file mode 100644
index 00000000000000..8493f380fe06ea
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/131-6.2-ARM-dts-qcom-ipq8064-disable-mmc-ddr-1_8v-for-sdcc1.patch
@@ -0,0 +1,28 @@
+From c9713e4ede1e5d044b64fe4d3cbb84223625637f Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 25 Oct 2022 01:38:17 +0200
+Subject: [PATCH] ARM: dts: qcom: ipq8064: disable mmc-ddr-1_8v for sdcc1
+
+It was reported non working mmc with this option enabled.
+Both mmc for ipq8064 are supplied by a fixed 3.3v regulator so mmc can't
+be run at 1.8v.
+Disable it to restore correct functionality of this SoC feature.
+
+Tested-by: Hendrik Koerner <koerhen@web.de>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221024233817.27410-1-ansuelsmth@gmail.com
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -1529,7 +1529,6 @@
+ 				non-removable;
+ 				cap-sd-highspeed;
+ 				cap-mmc-highspeed;
+-				mmc-ddr-1_8v;
+ 				vmmc-supply = <&vsdcc_fixed>;
+ 				dmas = <&sdcc1bam 2>, <&sdcc1bam 1>;
+ 				dma-names = "tx", "rx";
diff --git a/target/linux/ipq806x/patches-5.15/850-soc-add-qualcomm-syscon.patch b/target/linux/ipq806x/patches-5.15/850-soc-add-qualcomm-syscon.patch
index d433cb49b85fac..0d983410ec1b78 100644
--- a/target/linux/ipq806x/patches-5.15/850-soc-add-qualcomm-syscon.patch
+++ b/target/linux/ipq806x/patches-5.15/850-soc-add-qualcomm-syscon.patch
@@ -12,7 +12,7 @@ Subject: SoC: add qualcomm syscon
  obj-$(CONFIG_QCOM_RPMHPD) += rpmhpd.o
 --- a/drivers/soc/qcom/Kconfig
 +++ b/drivers/soc/qcom/Kconfig
-@@ -191,6 +191,13 @@ config QCOM_SOCINFO
+@@ -192,6 +192,13 @@ config QCOM_SOCINFO
  	 Say yes here to support the Qualcomm socinfo driver, providing
  	 information about the SoC to user space.
  
diff --git a/target/linux/ipq806x/patches-5.15/900-arm-add-cmdline-override.patch b/target/linux/ipq806x/patches-5.15/900-arm-add-cmdline-override.patch
new file mode 100644
index 00000000000000..23cec10f445ab4
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/900-arm-add-cmdline-override.patch
@@ -0,0 +1,37 @@
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1740,6 +1740,14 @@ config ARM_ATAG_DTB_COMPAT_CMDLINE_MANGL
+ 
+ endchoice
+ 
++config CMDLINE_OVERRIDE
++	bool "Use alternative cmdline from device tree"
++	help
++	  Some bootloaders may have uneditable bootargs. While CMDLINE_FORCE can
++	  be used, this is not a good option for kernels that are shared across
++	  devices. This setting enables using "chosen/cmdline-override" as the
++	  cmdline if it exists in the device tree.
++
+ config CMDLINE
+ 	string "Default kernel command string"
+ 	default ""
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -1162,6 +1162,17 @@ int __init early_init_dt_scan_chosen(uns
+ 	if (p != NULL && l > 0)
+ 		strlcat(data, p, min_t(int, strlen(data) + (int)l, COMMAND_LINE_SIZE));
+ 
++    /* CONFIG_CMDLINE_OVERRIDE is used to fallback to a different
++     * device tree option of chosen/bootargs-override. This is
++     * helpful on boards where u-boot sets bootargs, and is unable
++     * to be modified.
++     */
++#ifdef CONFIG_CMDLINE_OVERRIDE
++	p = of_get_flat_dt_prop(node, "bootargs-override", &l);
++	if (p != NULL && l > 0)
++		strlcpy(data, p, min((int)l, COMMAND_LINE_SIZE));
++#endif
++
+ 	/*
+ 	 * CONFIG_CMDLINE is meant to be a default in case nothing else
+ 	 * managed to set the command line, unless CONFIG_CMDLINE_FORCE
diff --git a/target/linux/ipq806x/patches-6.1/0060-ARM-mach-qcom-fix-support-for-ipq806x.patch b/target/linux/ipq806x/patches-6.1/0060-ARM-mach-qcom-fix-support-for-ipq806x.patch
new file mode 100644
index 00000000000000..384eee6215bce5
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/0060-ARM-mach-qcom-fix-support-for-ipq806x.patch
@@ -0,0 +1,60 @@
+From 9c896e9fc2ef1209e4a56d8c9fdd183847c2c814 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 18 Oct 2022 22:02:46 +0200
+Subject: [PATCH] ARM: mach-qcom: fix support for ipq806x
+
+Add a specific config flag for Qcom IPQ806x as this SoC can't use
+AUTO_ZRELADDR and require the PHYS_OFFSET set to 0x42000000.
+
+This is needed as some legacy board (or some wrongly configured
+bootloader) pass the wrong memory map and doesn't exclude the first
+~20MB of RAM reserved for the hardware network accellerators.
+
+With this change we can correctly support each board and prevent any
+kind of misconfiguration done by the OEM.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ arch/arm/Kconfig           |  3 ++-
+ arch/arm/mach-qcom/Kconfig | 13 +++++++++++++
+ 2 files changed, 15 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -283,6 +283,7 @@ config PHYS_OFFSET
+ 	default 0x30000000 if ARCH_S3C24XX
+ 	default 0xa0000000 if ARCH_IOP32X || ARCH_PXA
+ 	default 0xc0000000 if ARCH_EP93XX || ARCH_SA1100
++	default 0x42000000 if ARCH_IPQ806X
+ 	default 0
+ 	help
+ 	  Please provide the physical address corresponding to the
+@@ -1702,7 +1703,7 @@ config CRASH_DUMP
+ 
+ config AUTO_ZRELADDR
+ 	bool "Auto calculation of the decompressed kernel image address" if !ARCH_MULTIPLATFORM
+-	default !(ARCH_FOOTBRIDGE || ARCH_RPC || ARCH_SA1100)
++	default !(ARCH_FOOTBRIDGE || ARCH_RPC || ARCH_SA1100 || ARCH_IPQ806X)
+ 	help
+ 	  ZRELADDR is the physical address where the decompressed kernel
+ 	  image will be placed. If AUTO_ZRELADDR is selected, the address
+--- a/arch/arm/mach-qcom/Kconfig
++++ b/arch/arm/mach-qcom/Kconfig
+@@ -46,4 +46,17 @@ config ARCH_MDM9615
+ 	bool "Enable support for MDM9615"
+ 	select CLKSRC_QCOM
+ 
++config ARCH_IPQ806X
++	bool "Enable support for IPQ806x"
++	help
++	  Enable support for the Qualcomm IPQ806x.
++
++	  IPQ806x require special PHYS_OFFSET and can't use AUTO_ZRELADDR.
++	  The first ~20MB of RAM is reserved for the hardware network accelerators,
++	  and the bootloader removes this section from the layout passed from the
++	  ATAGS (when used by some bootloader doesn't even do that).
++
++	  To support every system and handle legacy systems, hardcode PHYS_OFFSET and
++	  disable AUTO_ZRELADDR.
++
+ endif
diff --git a/target/linux/ipq806x/patches-6.1/0067-generic-Mangle-bootloader-s-kernel-arguments.patch b/target/linux/ipq806x/patches-6.1/0067-generic-Mangle-bootloader-s-kernel-arguments.patch
new file mode 100644
index 00000000000000..e40b43b968d932
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/0067-generic-Mangle-bootloader-s-kernel-arguments.patch
@@ -0,0 +1,280 @@
+From 71270226b14733a4b1f2cde58ea9265caa50b38d Mon Sep 17 00:00:00 2001
+From: Adrian Panella <ianchi74@outlook.com>
+Date: Thu, 9 Mar 2017 09:37:17 +0100
+Subject: [PATCH 67/69] generic: Mangle bootloader's kernel arguments
+
+The command-line arguments provided by the boot loader will be
+appended to a new device tree property: bootloader-args.
+If there is a property "append-rootblock" in DT under /chosen
+and a root= option in bootloaders command line it will be parsed
+and added to DT bootargs with the form: <append-rootblock>XX.
+Only command line ATAG will be processed, the rest of the ATAGs
+sent by bootloader will be ignored.
+This is usefull in dual boot systems, to get the current root partition
+without afecting the rest of the system.
+
+Signed-off-by: Adrian Panella <ianchi74@outlook.com>
+---
+ arch/arm/Kconfig                        | 11 +++++
+ arch/arm/boot/compressed/atags_to_fdt.c | 72 ++++++++++++++++++++++++++++++++-
+ init/main.c                             | 16 ++++++++
+ 3 files changed, 98 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1586,6 +1586,17 @@ config ARM_ATAG_DTB_COMPAT_CMDLINE_EXTEN
+ 	  The command-line arguments provided by the boot loader will be
+ 	  appended to the the device tree bootargs property.
+ 
++config ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
++	bool "Append rootblock parsing bootloader's kernel arguments"
++	help
++	  The command-line arguments provided by the boot loader will be
++	  appended to a new device tree property: bootloader-args.
++	  If there is a property "append-rootblock" in DT under /chosen
++	  and a root= option in bootloaders command line it will be parsed
++	  and added to DT bootargs with the form: <append-rootblock>XX.
++	  Only command line ATAG will be processed, the rest of the ATAGs
++	  sent by bootloader will be ignored.
++
+ endchoice
+ 
+ config CMDLINE
+--- a/arch/arm/boot/compressed/atags_to_fdt.c
++++ b/arch/arm/boot/compressed/atags_to_fdt.c
+@@ -5,6 +5,8 @@
+ 
+ #if defined(CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_EXTEND)
+ #define do_extend_cmdline 1
++#elif defined(CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE)
++#define do_extend_cmdline 1
+ #else
+ #define do_extend_cmdline 0
+ #endif
+@@ -20,6 +22,7 @@ static int node_offset(void *fdt, const
+ 	return offset;
+ }
+ 
++#ifndef CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
+ static int setprop(void *fdt, const char *node_path, const char *property,
+ 		   void *val_array, int size)
+ {
+@@ -28,6 +31,7 @@ static int setprop(void *fdt, const char
+ 		return offset;
+ 	return fdt_setprop(fdt, offset, property, val_array, size);
+ }
++#endif
+ 
+ static int setprop_string(void *fdt, const char *node_path,
+ 			  const char *property, const char *string)
+@@ -38,6 +42,7 @@ static int setprop_string(void *fdt, con
+ 	return fdt_setprop_string(fdt, offset, property, string);
+ }
+ 
++#ifndef CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
+ static int setprop_cell(void *fdt, const char *node_path,
+ 			const char *property, uint32_t val)
+ {
+@@ -46,6 +51,7 @@ static int setprop_cell(void *fdt, const
+ 		return offset;
+ 	return fdt_setprop_cell(fdt, offset, property, val);
+ }
++#endif
+ 
+ static const void *getprop(const void *fdt, const char *node_path,
+ 			   const char *property, int *len)
+@@ -58,6 +64,7 @@ static const void *getprop(const void *f
+ 	return fdt_getprop(fdt, offset, property, len);
+ }
+ 
++#ifndef CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
+ static uint32_t get_cell_size(const void *fdt)
+ {
+ 	int len;
+@@ -68,6 +75,81 @@ static uint32_t get_cell_size(const void
+ 		cell_size = fdt32_to_cpu(*size_len);
+ 	return cell_size;
+ }
++#endif
++
++#if defined(CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE)
++/**
++ * taken from arch/x86/boot/string.c
++ * local_strstr - Find the first substring in a %NUL terminated string
++ * @s1: The string to be searched
++ * @s2: The string to search for
++ */
++static char *local_strstr(const char *s1, const char *s2)
++{
++	size_t l1, l2;
++
++	l2 = strlen(s2);
++	if (!l2)
++		return (char *)s1;
++	l1 = strlen(s1);
++	while (l1 >= l2) {
++		l1--;
++		if (!memcmp(s1, s2, l2))
++			return (char *)s1;
++		s1++;
++	}
++	return NULL;
++}
++
++static char *append_rootblock(char *dest, const char *str, int len, void *fdt)
++{
++	char *ptr, *end, *tmp;
++	const char *root="root=";
++	const char *find_rootblock;
++	int i, l;
++	const char *rootblock;
++
++	find_rootblock = getprop(fdt, "/chosen", "find-rootblock", &l);
++	if (!find_rootblock)
++		find_rootblock = root;
++
++	//ARM doesn't have __HAVE_ARCH_STRSTR, so it was copied from x86
++	ptr = local_strstr(str, find_rootblock);
++
++	if(!ptr)
++		return dest;
++
++	end = strchr(ptr, ' ');
++	end = end ? (end - 1) : (strchr(ptr, 0) - 1);
++
++	// Some boards ubi.mtd=XX,ZZZZ, so let's check for '," too.
++	tmp = strchr(ptr, ',');
++
++	if(tmp)
++		end = end < tmp ? end : tmp - 1;
++
++	//find partition number (assumes format root=/dev/mtdXX | /dev/mtdblockXX | yy:XX | ubi.mtd=XX,ZZZZ )
++	for( i = 0; end >= ptr && *end >= '0' && *end <= '9'; end--, i++);
++	ptr = end + 1;
++
++	/* if append-rootblock property is set use it to append to command line */
++	rootblock = getprop(fdt, "/chosen", "append-rootblock", &l);
++	if(rootblock != NULL) {
++		if(*dest != ' ') {
++			*dest = ' ';
++			dest++;
++			len++;
++		}
++		if (len + l + i <= COMMAND_LINE_SIZE) {
++			memcpy(dest, rootblock, l);
++			dest += l - 1;
++			memcpy(dest, ptr, i);
++			dest += i;
++		}
++	}
++	return dest;
++}
++#endif
+ 
+ static void merge_fdt_bootargs(void *fdt, const char *fdt_cmdline)
+ {
+@@ -88,18 +170,28 @@ static void merge_fdt_bootargs(void *fdt
+ 
+ 	/* and append the ATAG_CMDLINE */
+ 	if (fdt_cmdline) {
++
++#if defined(CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE)
++		//save original bootloader args
++		//and append ubi.mtd with root partition number to current cmdline
++		setprop_string(fdt, "/chosen", "bootloader-args", fdt_cmdline);
++		ptr = append_rootblock(ptr, fdt_cmdline, len, fdt);
++
++#else
+ 		len = strlen(fdt_cmdline);
+ 		if (ptr - cmdline + len + 2 < COMMAND_LINE_SIZE) {
+ 			*ptr++ = ' ';
+ 			memcpy(ptr, fdt_cmdline, len);
+ 			ptr += len;
+ 		}
++#endif
+ 	}
+ 	*ptr = '\0';
+ 
+ 	setprop_string(fdt, "/chosen", "bootargs", cmdline);
+ }
+ 
++#ifndef CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
+ static void hex_str(char *out, uint32_t value)
+ {
+ 	uint32_t digit;
+@@ -117,6 +209,7 @@ static void hex_str(char *out, uint32_t
+ 	}
+ 	*out = '\0';
+ }
++#endif
+ 
+ /*
+  * Convert and fold provided ATAGs into the provided FDT.
+@@ -131,9 +224,11 @@ int atags_to_fdt(void *atag_list, void *
+ 	struct tag *atag = atag_list;
+ 	/* In the case of 64 bits memory size, need to reserve 2 cells for
+ 	 * address and size for each bank */
++#ifndef CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
+ 	__be32 mem_reg_property[2 * 2 * NR_BANKS];
+-	int memcount = 0;
+-	int ret, memsize;
++	int memsize, memcount = 0;
++#endif
++	int ret;
+ 
+ 	/* make sure we've got an aligned pointer */
+ 	if ((u32)atag_list & 0x3)
+@@ -168,7 +263,9 @@ int atags_to_fdt(void *atag_list, void *
+ 			else
+ 				setprop_string(fdt, "/chosen", "bootargs",
+ 					       atag->u.cmdline.cmdline);
+-		} else if (atag->hdr.tag == ATAG_MEM) {
++		}
++#ifndef CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
++		else if (atag->hdr.tag == ATAG_MEM) {
+ 			if (memcount >= sizeof(mem_reg_property)/4)
+ 				continue;
+ 			if (!atag->u.mem.size)
+@@ -212,6 +309,10 @@ int atags_to_fdt(void *atag_list, void *
+ 		setprop(fdt, "/memory", "reg", mem_reg_property,
+ 			4 * memcount * memsize);
+ 	}
++#else
++
++	}
++#endif
+ 
+ 	return fdt_pack(fdt);
+ }
+--- a/init/main.c
++++ b/init/main.c
+@@ -114,6 +114,10 @@
+ 
+ #include <kunit/test.h>
+ 
++#if defined(CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE)
++#include <linux/of.h>
++#endif
++
+ static int kernel_init(void *);
+ 
+ extern void init_IRQ(void);
+@@ -994,6 +998,18 @@ asmlinkage __visible void __init __no_sa
+ 	pr_notice("Kernel command line: %s\n", saved_command_line);
+ 	/* parameters may set static keys */
+ 	jump_label_init();
++
++#if defined(CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE)
++	//Show bootloader's original command line for reference
++	if(of_chosen) {
++		const char *prop = of_get_property(of_chosen, "bootloader-args", NULL);
++		if(prop)
++			pr_notice("Bootloader command line (ignored): %s\n", prop);
++		else
++			pr_notice("Bootloader command line not present\n");
++	}
++#endif
++
+ 	parse_early_param();
+ 	after_dashes = parse_args("Booting kernel",
+ 				  static_command_line, __start___param,
diff --git a/target/linux/ipq806x/patches-6.1/102-mtd-rootfs-conflicts-with-OpenWrt-auto-mounting.patch b/target/linux/ipq806x/patches-6.1/102-mtd-rootfs-conflicts-with-OpenWrt-auto-mounting.patch
new file mode 100644
index 00000000000000..e0c195f1ab9420
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/102-mtd-rootfs-conflicts-with-OpenWrt-auto-mounting.patch
@@ -0,0 +1,25 @@
+From 5001f2e1a325b68dbf225bd17f69a4d3d975cca5 Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Thu, 9 Mar 2017 09:31:44 +0100
+Subject: [PATCH 61/69] mtd: "rootfs" conflicts with OpenWrt auto mounting
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ drivers/mtd/mtdpart.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -51,7 +51,11 @@ static struct mtd_info *allocate_partiti
+ 
+ 	/* allocate the partition structure */
+ 	child = kzalloc(sizeof(*child), GFP_KERNEL);
+-	name = kstrdup(part->name, GFP_KERNEL);
++	/* "rootfs" conflicts with OpenWrt auto mounting */
++	if (mtd_type_is_nand(parent) && !strcmp(part->name, "rootfs"))
++		name = "ubi";
++	else
++		name = kstrdup(part->name, GFP_KERNEL);
+ 	if (!name || !child) {
+ 		printk(KERN_ERR"memory allocation error while creating partitions for \"%s\"\n",
+ 		       parent->name);
diff --git a/target/linux/ipq806x/patches-6.1/107-10-ARM-dts-qcom-add-saw-for-l2-cache-and-kraitcc-for.patch b/target/linux/ipq806x/patches-6.1/107-10-ARM-dts-qcom-add-saw-for-l2-cache-and-kraitcc-for.patch
new file mode 100644
index 00000000000000..0a594b268886db
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/107-10-ARM-dts-qcom-add-saw-for-l2-cache-and-kraitcc-for.patch
@@ -0,0 +1,89 @@
+From bef5018abb7cf94efafdc05087b4c998891ae4ec Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Mon, 17 Jan 2022 23:39:34 +0100
+Subject: [PATCH v3 10/18] ARM: dts: qcom: add saw for l2 cache and kraitcc for
+ ipq8064
+
+Add saw compatible for l2 cache and kraitcc node for ipq8064 dtsi.
+Also declare clock-output-names for acc0 and acc1 and qsb fixed clock
+for the secondary mux.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 34 +++++++++++++++++++++++++++--
+ 1 file changed, 32 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -301,6 +301,12 @@
+ 	};
+ 
+ 	clocks {
++		qsb: qsb {
++			compatible = "fixed-clock";
++			clock-frequency = <225000000>;
++			#clock-cells = <0>;
++		};
++
+ 		cxo_board: cxo_board {
+ 			compatible = "fixed-clock";
+ 			#clock-cells = <0>;
+@@ -575,15 +581,30 @@
+ 			clocks = <&gcc PLL8_VOTE>, <&pxo_board>;
+ 			clock-names = "pll8_vote", "pxo";
+ 			clock-output-names = "acpu_l2_aux";
++			#clock-cells = <0>;
++		};
++
++		kraitcc: clock-controller {
++			compatible = "qcom,krait-cc-v1";
++			clocks = <&gcc PLL9>, <&gcc PLL10>, <&gcc PLL12>,
++				 <&acc0>, <&acc1>, <&l2cc>, <&qsb>, <&pxo_board>;
++			clock-names = "hfpll0", "hfpll1", "hfpll_l2",
++				      "acpu0_aux", "acpu1_aux", "acpu_l2_aux",
++				      "qsb", "pxo";
++			#clock-cells = <1>;
+ 		};
+ 
+ 		acc0: clock-controller@2088000 {
+ 			compatible = "qcom,kpss-acc-v1";
+ 			reg = <0x02088000 0x1000>, <0x02008000 0x1000>;
++			clock-output-names = "acpu0_aux";
++			clocks = <&gcc PLL8_VOTE>, <&pxo_board>;
++			clock-names = "pll8_vote", "pxo";
++			#clock-cells = <0>;
+ 		};
+ 
+ 		saw0: regulator@2089000 {
+-			compatible = "qcom,saw2";
++			compatible = "qcom,saw2", "qcom,apq8064-saw2-v1.1-cpu", "syscon";
+ 			reg = <0x02089000 0x1000>, <0x02009000 0x1000>;
+ 			regulator;
+ 		};
+@@ -591,14 +612,24 @@
+ 		acc1: clock-controller@2098000 {
+ 			compatible = "qcom,kpss-acc-v1";
+ 			reg = <0x02098000 0x1000>, <0x02008000 0x1000>;
++			clock-output-names = "acpu1_aux";
++			clocks = <&gcc PLL8_VOTE>, <&pxo_board>;
++			clock-names = "pll8_vote", "pxo";
++			#clock-cells = <0>;
+ 		};
+ 
+ 		saw1: regulator@2099000 {
+-			compatible = "qcom,saw2";
++			compatible = "qcom,saw2", "qcom,apq8064-saw2-v1.1-cpu", "syscon";
+ 			reg = <0x02099000 0x1000>, <0x02009000 0x1000>;
+ 			regulator;
+ 		};
+ 
++		saw_l2: regulator@02012000 {
++			compatible = "qcom,saw2", "syscon";
++			reg = <0x02012000 0x1000>;
++			regulator;
++		};
++
+ 		nss_common: syscon@03000000 {
+ 			compatible = "syscon";
+ 			reg = <0x03000000 0x0000FFFF>;
diff --git a/target/linux/ipq806x/patches-6.1/107-13-ARM-dts-qcom-add-opp-table-for-cpu-and-l2-for-ipq.patch b/target/linux/ipq806x/patches-6.1/107-13-ARM-dts-qcom-add-opp-table-for-cpu-and-l2-for-ipq.patch
new file mode 100644
index 00000000000000..16e924b303d047
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/107-13-ARM-dts-qcom-add-opp-table-for-cpu-and-l2-for-ipq.patch
@@ -0,0 +1,268 @@
+From 076ebb6e1799c4c7a1d2e07510d88b9e9b57b551 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Tue, 18 Jan 2022 00:03:47 +0100
+Subject: [PATCH v3 13/18] ARM: dts: qcom: add opp table for cpu and l2 for
+ ipq8064
+
+Add opp table for cpu and l2 cache. While the current cpufreq is
+the generic one that doesn't scale the L2 cache, we add the l2
+cache opp anyway for the sake of completeness. This will be handy in the
+future when a dedicated cpufreq driver is introduced for krait cores
+that will correctly scale l2 cache with the core freq.
+
+Opp-level is set based on the logic of
+0: idle level
+1: normal level
+2: turbo level
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 99 +++++++++++++++++++++++++++++
+ 1 file changed, 99 insertions(+)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -48,6 +48,105 @@
+ 		};
+ 	};
+ 
++	opp_table_l2: opp_table_l2 {
++		compatible = "operating-points-v2";
++
++		opp-384000000 {
++			opp-hz = /bits/ 64 <384000000>;
++			opp-microvolt = <1100000>;
++			clock-latency-ns = <100000>;
++			opp-level = <0>;
++		};
++
++		opp-1000000000 {
++			opp-hz = /bits/ 64 <1000000000>;
++			opp-microvolt = <1100000>;
++			clock-latency-ns = <100000>;
++			opp-level = <1>;
++		};
++
++		opp-1200000000 {
++			opp-hz = /bits/ 64 <1200000000>;
++			opp-microvolt = <1150000>;
++			clock-latency-ns = <100000>;
++			opp-level = <2>;
++		};
++	};
++
++	opp_table0: opp_table0 {
++		compatible = "operating-points-v2-kryo-cpu";
++		nvmem-cells = <&speedbin_efuse>;
++
++		/*
++		 * Voltage thresholds are <target min max>
++		 */
++		opp-384000000 {
++			opp-hz = /bits/ 64 <384000000>;
++			opp-microvolt-speed0-pvs0-v0 = <1000000 950000 1050000>;
++			opp-microvolt-speed0-pvs1-v0 = <925000 878750 971250>;
++			opp-microvolt-speed0-pvs2-v0 = <875000 831250 918750>;
++			opp-microvolt-speed0-pvs3-v0 = <800000 760000 840000>;
++			opp-supported-hw = <0x1>;
++			clock-latency-ns = <100000>;
++			opp-level = <0>;
++		};
++
++		opp-600000000 {
++			opp-hz = /bits/ 64 <600000000>;
++			opp-microvolt-speed0-pvs0-v0 = <1050000 997500 1102500>;
++			opp-microvolt-speed0-pvs1-v0 = <975000 926250 1023750>;
++			opp-microvolt-speed0-pvs2-v0 = <925000 878750 971250>;
++			opp-microvolt-speed0-pvs3-v0 = <850000 807500 892500>;
++			opp-supported-hw = <0x1>;
++			clock-latency-ns = <100000>;
++			opp-level = <1>;
++		};
++
++		opp-800000000 {
++			opp-hz = /bits/ 64 <800000000>;
++			opp-microvolt-speed0-pvs0-v0 = <1100000 1045000 1155000>;
++			opp-microvolt-speed0-pvs1-v0 = <1025000 973750 1076250>;
++			opp-microvolt-speed0-pvs2-v0 = <995000 945250 1044750>;
++			opp-microvolt-speed0-pvs3-v0 = <900000 855000 945000>;
++			opp-supported-hw = <0x1>;
++			clock-latency-ns = <100000>;
++			opp-level = <1>;
++		};
++
++		opp-1000000000 {
++			opp-hz = /bits/ 64 <1000000000>;
++			opp-microvolt-speed0-pvs0-v0 = <1150000 1092500 1207500>;
++			opp-microvolt-speed0-pvs1-v0 = <1075000 1021250 1128750>;
++			opp-microvolt-speed0-pvs2-v0 = <1025000 973750 1076250>;
++			opp-microvolt-speed0-pvs3-v0 = <950000 902500 997500>;
++			opp-supported-hw = <0x1>;
++			clock-latency-ns = <100000>;
++			opp-level = <1>;
++		};
++
++		opp-1200000000 {
++			opp-hz = /bits/ 64 <1200000000>;
++			opp-microvolt-speed0-pvs0-v0 = <1200000 1140000 1260000>;
++			opp-microvolt-speed0-pvs1-v0 = <1125000 1068750 1181250>;
++			opp-microvolt-speed0-pvs2-v0 = <1075000 1021250 1128750>;
++			opp-microvolt-speed0-pvs3-v0 = <1000000 950000 1050000>;
++			opp-supported-hw = <0x1>;
++			clock-latency-ns = <100000>;
++			opp-level = <2>;
++		};
++
++		opp-1400000000 {
++			opp-hz = /bits/ 64 <1400000000>;
++			opp-microvolt-speed0-pvs0-v0 = <1250000 1187500 1312500>;
++			opp-microvolt-speed0-pvs1-v0 = <1175000 1116250 1233750>;
++			opp-microvolt-speed0-pvs2-v0 = <1125000 1068750 1181250>;
++			opp-microvolt-speed0-pvs3-v0 = <1050000 997500 1102500>;
++			opp-supported-hw = <0x1>;
++			clock-latency-ns = <100000>;
++			opp-level = <2>;
++		};
++	};
++
+ 	thermal-zones {
+ 		sensor0-thermal {
+ 			polling-delay-passive = <0>;
+--- a/arch/arm/boot/dts/qcom-ipq8065.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8065.dtsi
+@@ -6,3 +6,92 @@
+ 	model = "Qualcomm Technologies, Inc. IPQ8065";
+ 	compatible = "qcom,ipq8065", "qcom,ipq8064";
+ };
++
++&opp_table_l2 {
++	/delete-node/opp-1200000000;
++
++	opp-1400000000 {
++		opp-hz = /bits/ 64 <1400000000>;
++		opp-microvolt = <1150000>;
++		clock-latency-ns = <100000>;
++		opp-level = <2>;
++	};
++};
++
++&opp_table0 {
++	/*
++	 * On ipq8065 1.2 ghz freq is not present
++	 * Remove it to make cpufreq work and not
++	 * complain for missing definition
++	 */
++
++	/delete-node/opp-1200000000;
++
++	/*
++	 * Voltage thresholds are <target min max>
++	 */
++	opp-384000000 {
++		opp-microvolt-speed0-pvs0-v0 = <975000 926250 1023750>;
++		opp-microvolt-speed0-pvs1-v0 = <950000 902500 997500>;
++		opp-microvolt-speed0-pvs2-v0 = <925000 878750 971250>;
++		opp-microvolt-speed0-pvs3-v0 = <900000 855000 945000>;
++		opp-microvolt-speed0-pvs4-v0 = <875000 831250 918750>;
++		opp-microvolt-speed0-pvs5-v0 = <825000 783750 866250>;
++		opp-microvolt-speed0-pvs6-v0 = <775000 736250 813750>;
++	};
++
++	opp-600000000 {
++		opp-microvolt-speed0-pvs0-v0 = <1000000 950000 1050000>;
++		opp-microvolt-speed0-pvs1-v0 = <975000 926250 1023750>;
++		opp-microvolt-speed0-pvs2-v0 = <950000 902500 997500>;
++		opp-microvolt-speed0-pvs3-v0 = <925000 878750 971250>;
++		opp-microvolt-speed0-pvs4-v0 = <900000 855000 945000>;
++		opp-microvolt-speed0-pvs5-v0 = <850000 807500 892500>;
++		opp-microvolt-speed0-pvs6-v0 = <800000 760000 840000>;
++	};
++
++	opp-800000000 {
++		opp-microvolt-speed0-pvs0-v0 = <1050000 997500 1102500>;
++		opp-microvolt-speed0-pvs1-v0 = <1025000 973750 1076250>;
++		opp-microvolt-speed0-pvs2-v0 = <1000000 950000 1050000>;
++		opp-microvolt-speed0-pvs3-v0 = <975000 926250 1023750>;
++		opp-microvolt-speed0-pvs4-v0 = <950000 902500 997500>;
++		opp-microvolt-speed0-pvs5-v0 = <900000 855000 945000>;
++		opp-microvolt-speed0-pvs6-v0 = <850000 807500 892500>;
++	};
++
++	opp-1000000000 {
++		opp-microvolt-speed0-pvs0-v0 = <1100000 1045000 1155000>;
++		opp-microvolt-speed0-pvs1-v0 = <1075000 1021250 1128750>;
++		opp-microvolt-speed0-pvs2-v0 = <1050000 997500 1102500>;
++		opp-microvolt-speed0-pvs3-v0 = <1025000 973750 1076250>;
++		opp-microvolt-speed0-pvs4-v0 = <1000000 950000 1050000>;
++		opp-microvolt-speed0-pvs5-v0 = <950000 902500 997500>;
++		opp-microvolt-speed0-pvs6-v0 = <900000 855000 945000>;
++	};
++
++	opp-1400000000 {
++		opp-microvolt-speed0-pvs0-v0 = <1175000 1116250 1233750>;
++		opp-microvolt-speed0-pvs1-v0 = <1150000 1092500 1207500>;
++		opp-microvolt-speed0-pvs2-v0 = <1125000 1068750 1181250>;
++		opp-microvolt-speed0-pvs3-v0 = <1100000 1045000 1155000>;
++		opp-microvolt-speed0-pvs4-v0 = <1075000 1021250 1128750>;
++		opp-microvolt-speed0-pvs5-v0 = <1025000 973750 1076250>;
++		opp-microvolt-speed0-pvs6-v0 = <975000 926250 1023750>;
++		opp-level = <1>;
++	};
++
++	opp-1725000000 {
++		opp-hz = /bits/ 64 <1725000000>;
++		opp-microvolt-speed0-pvs0-v0 = <1262500 1199375 1325625>;
++		opp-microvolt-speed0-pvs1-v0 = <1225000 1163750 1286250>;
++		opp-microvolt-speed0-pvs2-v0 = <1200000 1140000 1260000>;
++		opp-microvolt-speed0-pvs3-v0 = <1175000 1116250 1233750>;
++		opp-microvolt-speed0-pvs4-v0 = <1150000 1092500 1207500>;
++		opp-microvolt-speed0-pvs5-v0 = <1100000 1045000 1155000>;
++		opp-microvolt-speed0-pvs6-v0 = <1050000 997500 1102500>;
++		opp-supported-hw = <0x1>;
++		clock-latency-ns = <100000>;
++		opp-level = <2>;
++	};
++};
+--- a/arch/arm/boot/dts/qcom-ipq8062.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8062.dtsi
+@@ -6,3 +6,39 @@
+ 	model = "Qualcomm Technologies, Inc. IPQ8062";
+ 	compatible = "qcom,ipq8062", "qcom,ipq8064";
+ };
++
++&opp_table0 {
++	/delete-node/opp-1200000000;
++	/delete-node/opp-1400000000;
++
++	/*
++	 * Voltage thresholds are <target min max>
++	 */
++	opp-384000000 {
++		opp-microvolt-speed0-pvs0-v0 = <1000000 950000 1050000>;
++		opp-microvolt-speed0-pvs1-v0 = < 925000 878750  971250>;
++		opp-microvolt-speed0-pvs2-v0 = < 875000 831250  918750>;
++		opp-microvolt-speed0-pvs3-v0 = < 800000 760000  840000>;
++	};
++
++	opp-600000000 {
++		opp-microvolt-speed0-pvs0-v0 = <1050000 997500 1102500>;
++		opp-microvolt-speed0-pvs1-v0 = < 975000 926250 1023750>;
++		opp-microvolt-speed0-pvs2-v0 = < 925000 878750  971250>;
++		opp-microvolt-speed0-pvs3-v0 = < 850000 807500  892500>;
++	};
++
++	opp-800000000 {
++		opp-microvolt-speed0-pvs0-v0 = <1100000 1045000 1155000>;
++		opp-microvolt-speed0-pvs1-v0 = <1025000  973750 1076250>;
++		opp-microvolt-speed0-pvs2-v0 = < 995000  945250 1044750>;
++		opp-microvolt-speed0-pvs3-v0 = < 900000  855000  945000>;
++	};
++
++	opp-1000000000 {
++		opp-microvolt-speed0-pvs0-v0 = <1150000 1092500 1207500>;
++		opp-microvolt-speed0-pvs1-v0 = <1075000 1021250 1128750>;
++		opp-microvolt-speed0-pvs2-v0 = <1025000  973750 1076250>;
++		opp-microvolt-speed0-pvs3-v0 = < 950000  902500  997500>;
++	};
++};
diff --git a/target/linux/ipq806x/patches-6.1/107-15-ARM-dts-qcom-add-multiple-missing-binding-for-cpu.patch b/target/linux/ipq806x/patches-6.1/107-15-ARM-dts-qcom-add-multiple-missing-binding-for-cpu.patch
new file mode 100644
index 00000000000000..cf27aaa08b63b4
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/107-15-ARM-dts-qcom-add-multiple-missing-binding-for-cpu.patch
@@ -0,0 +1,153 @@
+From 211fc0c0a63c99b68663a27182e643316c2d8cbe Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Tue, 18 Jan 2022 00:07:57 +0100
+Subject: [PATCH v3 15/18] ARM: dts: qcom: add multiple missing binding for cpu
+ and l2 for ipq8064
+
+Add multiple binding for cpu node, l2 node and add idle-states
+definition for ipq8064 dtsi.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 36 +++++++++++++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -30,6 +30,15 @@
+ 			next-level-cache = <&L2>;
+ 			qcom,acc = <&acc0>;
+ 			qcom,saw = <&saw0>;
++			clocks = <&kraitcc 0>, <&kraitcc 4>;
++			clock-names = "cpu", "l2";
++			clock-latency = <100000>;
++			operating-points-v2 = <&opp_table0>;
++			voltage-tolerance = <5>;
++			cooling-min-state = <0>;
++			cooling-max-state = <10>;
++			#cooling-cells = <2>;
++			cpu-idle-states = <&CPU_SPC>;
+ 		};
+ 
+ 		cpu1: cpu@1 {
+@@ -40,11 +49,35 @@
+ 			next-level-cache = <&L2>;
+ 			qcom,acc = <&acc1>;
+ 			qcom,saw = <&saw1>;
++			clocks = <&kraitcc 1>, <&kraitcc 4>;
++			clock-names = "cpu", "l2";
++			clock-latency = <100000>;
++			operating-points-v2 = <&opp_table0>;
++			voltage-tolerance = <5>;
++			cooling-min-state = <0>;
++			cooling-max-state = <10>;
++			#cooling-cells = <2>;
++			cpu-idle-states = <&CPU_SPC>;
++		};
++
++		idle-states {
++			CPU_SPC: spc {
++				compatible = "qcom,idle-state-spc";
++				status = "disabled";
++				entry-latency-us = <400>;
++				exit-latency-us = <900>;
++				min-residency-us = <3000>;
++			};
+ 		};
+ 
+ 		L2: l2-cache {
+ 			compatible = "cache";
+ 			cache-level = <2>;
++			qcom,saw = <&saw_l2>;
++
++			clocks = <&kraitcc 4>;
++			clock-names = "l2";
++			operating-points-v2 = <&opp_table_l2>;
+ 		};
+ 	};
+ 
+--- a/arch/arm/boot/dts/qcom-ipq8064-smb208.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064-smb208.dtsi
+@@ -2,6 +2,18 @@
+ 
+ #include "qcom-ipq8064.dtsi"
+ 
++&cpu0 {
++	cpu-supply = <&smb208_s2a>;
++};
++
++&cpu1 {
++	cpu-supply = <&smb208_s2b>;
++};
++
++&L2 {
++	l2-supply = <&smb208_s1a>;
++};
++
+ &rpm {
+ 	smb208_regulators: regulators {
+ 		compatible = "qcom,rpm-smb208-regulators";
+--- a/arch/arm/boot/dts/qcom-ipq8064-v2.0-smb208.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064-v2.0-smb208.dtsi
+@@ -2,6 +2,18 @@
+ 
+ #include "qcom-ipq8064-v2.0.dtsi"
+ 
++&cpu0 {
++	cpu-supply = <&smb208_s2a>;
++};
++
++&cpu1 {
++	cpu-supply = <&smb208_s2b>;
++};
++
++&L2 {
++	l2-supply = <&smb208_s1a>;
++};
++
+ &rpm {
+ 	smb208_regulators: regulators {
+ 		compatible = "qcom,rpm-smb208-regulators";
+--- a/arch/arm/boot/dts/qcom-ipq8062-smb208.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8062-smb208.dtsi
+@@ -2,6 +2,18 @@
+ 
+ #include "qcom-ipq8062.dtsi"
+ 
++&cpu0 {
++	cpu-supply = <&smb208_s2a>;
++};
++
++&cpu1 {
++	cpu-supply = <&smb208_s2b>;
++};
++
++&L2 {
++	l2-supply = <&smb208_s1a>;
++};
++
+ &rpm {
+ 	smb208_regulators: regulators {
+ 		compatible = "qcom,rpm-smb208-regulators";
+--- a/arch/arm/boot/dts/qcom-ipq8065-smb208.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8065-smb208.dtsi
+@@ -2,6 +2,18 @@
+ 
+ #include "qcom-ipq8065.dtsi"
+ 
++&cpu0 {
++	cpu-supply = <&smb208_s2a>;
++};
++
++&cpu1 {
++	cpu-supply = <&smb208_s2b>;
++};
++
++&L2 {
++	l2-supply = <&smb208_s1a>;
++};
++
+ &rpm {
+ 	smb208_regulators: regulators {
+ 		compatible = "qcom,rpm-smb208-regulators";
diff --git a/target/linux/ipq806x/patches-6.1/108-01-ARM-dts-qcom-fix-wrong-nad_pins-definition-for-ipq80.patch b/target/linux/ipq806x/patches-6.1/108-01-ARM-dts-qcom-fix-wrong-nad_pins-definition-for-ipq80.patch
new file mode 100644
index 00000000000000..6be9334e7d7f6a
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/108-01-ARM-dts-qcom-fix-wrong-nad_pins-definition-for-ipq80.patch
@@ -0,0 +1,29 @@
+From 6c94e0184e56f9e9f1f5d5f54b20758433e498d2 Mon Sep 17 00:00:00 2001
+From: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
+Date: Wed, 15 Jun 2022 16:47:09 +0200
+Subject: [PATCH 1/2] ARM: dts: qcom: fix wrong nad_pins definition for ipq806x
+
+Fix wrong nand_pings definition for bias-disable pins.
+
+Signed-off-by: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -599,12 +599,9 @@
+ 			};
+ 
+ 			nand_pins: nand_pins {
+-				mux {
++				disable {
+ 					pins = "gpio34", "gpio35", "gpio36",
+-					       "gpio37", "gpio38", "gpio39",
+-					       "gpio40", "gpio41", "gpio42",
+-					       "gpio43", "gpio44", "gpio45",
+-					       "gpio46", "gpio47";
++					       "gpio37", "gpio38";
+ 					function = "nand";
+ 					drive-strength = <10>;
+ 					bias-disable;
diff --git a/target/linux/ipq806x/patches-6.1/108-02-ARM-dts-qcom-add-MDIO-dedicated-controller-node-for-.patch b/target/linux/ipq806x/patches-6.1/108-02-ARM-dts-qcom-add-MDIO-dedicated-controller-node-for-.patch
new file mode 100644
index 00000000000000..a35bb3874fe9e0
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/108-02-ARM-dts-qcom-add-MDIO-dedicated-controller-node-for-.patch
@@ -0,0 +1,188 @@
+From 504188183408fac0f61b59f5ed8ea1773fe43669 Mon Sep 17 00:00:00 2001
+From: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
+Date: Wed, 15 Jun 2022 16:59:30 +0200
+Subject: [PATCH 2/2] ARM: dts: qcom: add MDIO dedicated controller node for
+ ipq806x
+
+Add MDIO dedicated controller attached to gmac0 and fix rb3011 dts to
+correctly use the new tag.
+
+Signed-off-by: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
+---
+ arch/arm/boot/dts/qcom-ipq8064-rb3011.dts | 134 +++++++++++-----------
+ arch/arm/boot/dts/qcom-ipq8064.dtsi       |  14 +++
+ 2 files changed, 81 insertions(+), 67 deletions(-)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064-rb3011.dts
++++ b/arch/arm/boot/dts/qcom-ipq8064-rb3011.dts
+@@ -25,73 +25,6 @@
+ 		device_type = "memory";
+ 	};
+ 
+-	mdio0: mdio-0 {
+-		status = "okay";
+-		compatible = "virtual,mdio-gpio";
+-		gpios = <&qcom_pinmux 1 GPIO_ACTIVE_HIGH>,
+-			<&qcom_pinmux 0 GPIO_ACTIVE_HIGH>;
+-		#address-cells = <1>;
+-		#size-cells = <0>;
+-
+-		pinctrl-0 = <&mdio0_pins>;
+-		pinctrl-names = "default";
+-
+-		switch0: switch@10 {
+-			compatible = "qca,qca8337";
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-
+-			dsa,member = <0 0>;
+-
+-			pinctrl-0 = <&sw0_reset_pin>;
+-			pinctrl-names = "default";
+-
+-			reset-gpios = <&qcom_pinmux 16 GPIO_ACTIVE_LOW>;
+-			reg = <0x10>;
+-
+-			ports {
+-				#address-cells = <1>;
+-				#size-cells = <0>;
+-
+-				switch0cpu: port@0 {
+-					reg = <0>;
+-					label = "cpu";
+-					ethernet = <&gmac0>;
+-					phy-mode = "rgmii-id";
+-					fixed-link {
+-						speed = <1000>;
+-						full-duplex;
+-					};
+-				};
+-
+-				port@1 {
+-					reg = <1>;
+-					label = "sw1";
+-				};
+-
+-				port@2 {
+-					reg = <2>;
+-					label = "sw2";
+-				};
+-
+-				port@3 {
+-					reg = <3>;
+-					label = "sw3";
+-				};
+-
+-				port@4 {
+-					reg = <4>;
+-					label = "sw4";
+-				};
+-
+-				port@5 {
+-					reg = <5>;
+-					label = "sw5";
+-				};
+-			};
+-		};
+-	};
+-
+ 	mdio1: mdio-1 {
+ 		status = "okay";
+ 		compatible = "virtual,mdio-gpio";
+@@ -222,6 +155,73 @@
+ 	status = "okay";
+ };
+ 
++&mdio0 {
++	status = "okay";
++	compatible = "virtual,mdio-gpio";
++	gpios = <&qcom_pinmux 1 GPIO_ACTIVE_HIGH>,
++		<&qcom_pinmux 0 GPIO_ACTIVE_HIGH>;
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	pinctrl-0 = <&mdio0_pins>;
++	pinctrl-names = "default";
++
++	switch0: switch@10 {
++		compatible = "qca,qca8337";
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		dsa,member = <0 0>;
++
++		pinctrl-0 = <&sw0_reset_pin>;
++		pinctrl-names = "default";
++
++		reset-gpios = <&qcom_pinmux 16 GPIO_ACTIVE_LOW>;
++		reg = <0x10>;
++
++		ports {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			switch0cpu: port@0 {
++				reg = <0>;
++				label = "cpu";
++				ethernet = <&gmac0>;
++				phy-mode = "rgmii-id";
++				fixed-link {
++					speed = <1000>;
++					full-duplex;
++				};
++			};
++
++			port@1 {
++				reg = <1>;
++				label = "sw1";
++			};
++
++			port@2 {
++				reg = <2>;
++				label = "sw2";
++			};
++
++			port@3 {
++				reg = <3>;
++				label = "sw3";
++			};
++
++			port@4 {
++				reg = <4>;
++				label = "sw4";
++			};
++
++			port@5 {
++				reg = <5>;
++				label = "sw5";
++			};
++		};
++	};
++};
++
+ &gmac0 {
+ 	status = "okay";
+ 
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -476,6 +476,20 @@
+ 			snps,blen = <16 0 0 0 0 0 0>;
+ 		};
+ 
++		mdio0: mdio@37000000 {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			compatible = "qcom,ipq8064-mdio", "syscon";
++			reg = <0x37000000 0x200000>;
++			resets = <&gcc GMAC_CORE1_RESET>;
++			reset-names = "stmmaceth";
++			clocks = <&gcc GMAC_CORE1_CLK>;
++			clock-names = "stmmaceth";
++
++			status = "disabled";
++		};
++
+ 		vsdcc_fixed: vsdcc-regulator {
+ 			compatible = "regulator-fixed";
+ 			regulator-name = "SDCC Power";
diff --git a/target/linux/ipq806x/patches-6.1/110-01-thermal-qcom-tsens-init-debugfs-only-with-successful.patch b/target/linux/ipq806x/patches-6.1/110-01-thermal-qcom-tsens-init-debugfs-only-with-successful.patch
new file mode 100644
index 00000000000000..c9b20a0222095d
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/110-01-thermal-qcom-tsens-init-debugfs-only-with-successful.patch
@@ -0,0 +1,41 @@
+From 8f32d48a309246a80bdca505968085a484d54408 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Mon, 19 Apr 2021 03:01:53 +0200
+Subject: [thermal-next PATCH v2 1/2] thermal: qcom: tsens: init debugfs only with
+ successful probe
+
+calibrate and tsens_register can fail or PROBE_DEFER. This will cause a
+double or a wrong init of the debugfs information. Init debugfs only
+with successful probe fixing warning about directory already present.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Acked-by: Thara Gopinath <thara.gopinath@linaro.org>
+---
+ drivers/thermal/qcom/tsens.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/thermal/qcom/tsens.c
++++ b/drivers/thermal/qcom/tsens.c
+@@ -918,8 +918,6 @@ int __init init_common(struct tsens_priv
+ 	if (tsens_version(priv) >= VER_0_1)
+ 		tsens_enable_irq(priv);
+ 
+-	tsens_debug_init(op);
+-
+ err_put_device:
+ 	put_device(&op->dev);
+ 	return ret;
+@@ -1156,7 +1154,12 @@ static int tsens_probe(struct platform_d
+ 		}
+ 	}
+ 
+-	return tsens_register(priv);
++	ret = tsens_register(priv);
++
++	if (!ret)
++		tsens_debug_init(pdev);
++
++	return ret;
+ }
+ 
+ static int tsens_remove(struct platform_device *pdev)
diff --git a/target/linux/ipq806x/patches-6.1/110-02-thermal-qcom-tsens-simplify-debugfs-init-function.patch b/target/linux/ipq806x/patches-6.1/110-02-thermal-qcom-tsens-simplify-debugfs-init-function.patch
new file mode 100644
index 00000000000000..0fbc4bd8cad85f
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/110-02-thermal-qcom-tsens-simplify-debugfs-init-function.patch
@@ -0,0 +1,54 @@
+From 4204f22060f7a5d42c6ccb4d4c25a6a875571099 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Mon, 19 Apr 2021 03:08:37 +0200
+Subject: [thermal-next PATCH v2 2/2] thermal: qcom: tsens: simplify debugfs init
+ function
+
+Simplify debugfs init function.
+- Add check for existing dev directory.
+- Fix wrong version in dbg_version_show (with version 0.0.0, 0.1.0 was
+  incorrectly reported)
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Thara Gopinath <thara.gopinath@linaro.org>
+---
+ drivers/thermal/qcom/tsens.c | 16 +++++++---------
+ 1 file changed, 7 insertions(+), 9 deletions(-)
+
+--- a/drivers/thermal/qcom/tsens.c
++++ b/drivers/thermal/qcom/tsens.c
+@@ -692,7 +692,7 @@ static int dbg_version_show(struct seq_f
+ 			return ret;
+ 		seq_printf(s, "%d.%d.%d\n", maj_ver, min_ver, step_ver);
+ 	} else {
+-		seq_puts(s, "0.1.0\n");
++		seq_printf(s, "0.%d.0\n", priv->feat->ver_major);
+ 	}
+ 
+ 	return 0;
+@@ -704,21 +704,17 @@ DEFINE_SHOW_ATTRIBUTE(dbg_sensors);
+ static void tsens_debug_init(struct platform_device *pdev)
+ {
+ 	struct tsens_priv *priv = platform_get_drvdata(pdev);
+-	struct dentry *root, *file;
+ 
+-	root = debugfs_lookup("tsens", NULL);
+-	if (!root)
++	priv->debug_root = debugfs_lookup("tsens", NULL);
++	if (!priv->debug_root)
+ 		priv->debug_root = debugfs_create_dir("tsens", NULL);
+-	else
+-		priv->debug_root = root;
+ 
+-	file = debugfs_lookup("version", priv->debug_root);
+-	if (!file)
++	if (!debugfs_lookup("version", priv->debug_root))
+ 		debugfs_create_file("version", 0444, priv->debug_root,
+ 				    pdev, &dbg_version_fops);
+ 
+ 	/* A directory for each instance of the TSENS IP */
+-	priv->debug = debugfs_create_dir(dev_name(&pdev->dev), priv->debug_root);
++	priv->debug = debugfs_lookup(dev_name(&pdev->dev), priv->debug_root);
+ 	debugfs_create_file("sensors", 0444, priv->debug, pdev, &dbg_sensors_fops);
+ }
+ #else
diff --git a/target/linux/ipq806x/patches-6.1/114-01-devfreq-qcom-Add-L2-Krait-Cache-devfreq-scaling-driv.patch b/target/linux/ipq806x/patches-6.1/114-01-devfreq-qcom-Add-L2-Krait-Cache-devfreq-scaling-driv.patch
new file mode 100644
index 00000000000000..9de73288799c19
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/114-01-devfreq-qcom-Add-L2-Krait-Cache-devfreq-scaling-driv.patch
@@ -0,0 +1,235 @@
+From b044ae89862132a86fb511648e9c52ea3cdf8c30 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 5 Aug 2020 14:19:23 +0200
+Subject: [PATCH 1/4] devfreq: qcom: Add L2 Krait Cache devfreq scaling driver
+
+Qcom L2 Krait CPUs use the generic cpufreq-dt driver and doesn't actually
+scale the Cache frequency when the CPU frequency is changed. This
+devfreq driver register with the cpu notifier and scale the Cache
+based on the max Freq across all core as the CPU cache is shared across
+all of them. If provided this also scale the voltage of the regulator
+attached to the CPU cache. The scaling logic is based on the CPU freq
+and the 3 scaling interval are set by the device dts.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/devfreq/Kconfig               |  11 ++
+ drivers/devfreq/Makefile              |   1 +
+ drivers/devfreq/krait-cache-devfreq.c | 188 ++++++++++++++++++++++++++
+ 3 files changed, 200 insertions(+)
+ create mode 100644 drivers/devfreq/krait-cache-devfreq.c
+
+--- a/drivers/devfreq/Kconfig
++++ b/drivers/devfreq/Kconfig
+@@ -151,6 +151,17 @@ config ARM_SUN8I_A33_MBUS_DEVFREQ
+ 	  This adds the DEVFREQ driver for the MBUS controller in some
+ 	  Allwinner sun8i (A33 through H3) and sun50i (A64 and H5) SoCs.
+ 
++config ARM_KRAIT_CACHE_DEVFREQ
++	tristate "Scaling support for Krait CPU Cache Devfreq"
++	depends on ARCH_QCOM || COMPILE_TEST
++	select DEVFREQ_GOV_PASSIVE
++	help
++	  This adds the DEVFREQ driver for the Krait CPU L2 Cache shared by all cores.
++
++	  The driver register with the cpufreq notifier and find the right frequency
++	  based on the max frequency across all core and the range set in the device
++	  dts. If provided this scale also the regulator attached to the l2 cache.
++
+ source "drivers/devfreq/event/Kconfig"
+ 
+ endif # PM_DEVFREQ
+--- a/drivers/devfreq/Makefile
++++ b/drivers/devfreq/Makefile
+@@ -15,6 +15,7 @@ obj-$(CONFIG_ARM_MEDIATEK_CCI_DEVFREQ)	+
+ obj-$(CONFIG_ARM_RK3399_DMC_DEVFREQ)	+= rk3399_dmc.o
+ obj-$(CONFIG_ARM_SUN8I_A33_MBUS_DEVFREQ)	+= sun8i-a33-mbus.o
+ obj-$(CONFIG_ARM_TEGRA_DEVFREQ)		+= tegra30-devfreq.o
++obj-$(CONFIG_ARM_KRAIT_CACHE_DEVFREQ)	+= krait-cache-devfreq.o
+ 
+ # DEVFREQ Event Drivers
+ obj-$(CONFIG_PM_DEVFREQ_EVENT)		+= event/
+--- /dev/null
++++ b/drivers/devfreq/krait-cache-devfreq.c
+@@ -0,0 +1,181 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/cpufreq.h>
++#include <linux/devfreq.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/clk.h>
++#include <linux/slab.h>
++#include <linux/regulator/consumer.h>
++#include <linux/pm_opp.h>
++
++#include "governor.h"
++
++struct krait_cache_data {
++	struct clk *clk;
++	unsigned long idle_freq;
++	int token;
++};
++
++static int krait_cache_config_clk(struct device *dev, struct opp_table *opp_table,
++			struct dev_pm_opp *old_opp, struct dev_pm_opp *opp,
++			void *data, bool scaling_down)
++{
++	struct krait_cache_data *kdata;
++	unsigned long old_freq, freq;
++	unsigned long idle_freq;
++	struct clk *clk;
++	int ret;
++
++	kdata = dev_get_drvdata(dev);
++	idle_freq = kdata->idle_freq;
++	clk = kdata->clk;
++
++	old_freq = dev_pm_opp_get_freq(old_opp);
++	freq = dev_pm_opp_get_freq(opp);
++
++	/*
++	 * Set to idle bin if switching from normal to high bin
++	 * or vice versa. It has been notice that a bug is triggered
++	 * in cache scaling when more than one bin is scaled, to fix
++	 * this we first need to transition to the base rate and then
++	 * to target rate
++	 */
++	if (likely(freq != idle_freq && old_freq != idle_freq)) {
++		ret = clk_set_rate(clk, idle_freq);
++		if (ret)
++			return ret;
++	}
++
++	return clk_set_rate(clk, freq);
++};
++
++static int krait_cache_get_cur_freq(struct device *dev, unsigned long *freq)
++{
++	struct krait_cache_data *data = dev_get_drvdata(dev);
++
++	*freq = clk_get_rate(data->clk);
++
++	return 0;
++};
++
++static int krait_cache_target(struct device *dev, unsigned long *freq,
++			      u32 flags)
++{
++	struct dev_pm_opp *opp;
++
++	opp = dev_pm_opp_find_freq_ceil(dev, freq);
++	if (unlikely(IS_ERR(opp)))
++		return PTR_ERR(opp);
++
++	dev_pm_opp_put(opp);
++
++	return dev_pm_opp_set_rate(dev, *freq);
++};
++
++static int krait_cache_get_dev_status(struct device *dev,
++				      struct devfreq_dev_status *stat)
++{
++	struct krait_cache_data *data = dev_get_drvdata(dev);
++
++	stat->busy_time = 0;
++	stat->total_time = 0;
++	stat->current_frequency = clk_get_rate(data->clk);
++
++	return 0;
++};
++
++static struct devfreq_dev_profile krait_cache_devfreq_profile = {
++	.target = krait_cache_target,
++	.get_dev_status = krait_cache_get_dev_status,
++	.get_cur_freq = krait_cache_get_cur_freq
++};
++
++static struct devfreq_passive_data devfreq_gov_data = {
++	.parent_type = CPUFREQ_PARENT_DEV,
++};
++
++static int krait_cache_probe(struct platform_device *pdev)
++{
++	struct dev_pm_opp_config config = { };
++	struct device *dev = &pdev->dev;
++	struct krait_cache_data *data;
++	struct devfreq *devfreq;
++	struct dev_pm_opp *opp;
++	struct clk *clk;
++	int ret, token;
++
++	data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
++	if (!data)
++		return -ENOMEM;
++
++	clk = devm_clk_get(dev, "l2");
++	if (IS_ERR(clk))
++		return PTR_ERR(clk);
++
++	config.regulator_names = (const char *[]){ "l2", NULL };
++	config.clk_names = (const char *[]){ "l2", NULL };
++	config.config_clks = krait_cache_config_clk;
++
++	token = dev_pm_opp_set_config(dev, &config);
++	if (token < 0)
++		return token;
++
++	ret = devm_pm_opp_of_add_table(dev);
++	if (ret)
++		goto free_opp;
++
++	opp = dev_pm_opp_find_freq_ceil(dev, &data->idle_freq);
++	if (IS_ERR(opp)) {
++		ret = PTR_ERR(opp);
++		goto free_opp;
++	}
++	dev_pm_opp_put(opp);
++
++	data->token = token;
++	data->clk = clk;
++	dev_set_drvdata(dev, data);
++	devfreq = devm_devfreq_add_device(dev, &krait_cache_devfreq_profile,
++					  DEVFREQ_GOV_PASSIVE, &devfreq_gov_data);
++	if (IS_ERR(devfreq)) {
++		ret = PTR_ERR(devfreq);
++		goto free_opp;
++	}
++
++	return 0;
++
++free_opp:
++	dev_pm_opp_clear_config(token);
++	return ret;
++};
++
++static int krait_cache_remove(struct platform_device *pdev)
++{
++	struct krait_cache_data *data = dev_get_drvdata(&pdev->dev);
++
++	dev_pm_opp_clear_config(data->token);
++
++	return 0;
++};
++
++static const struct of_device_id krait_cache_match_table[] = {
++	{ .compatible = "qcom,krait-cache" },
++	{}
++};
++
++static struct platform_driver krait_cache_driver = {
++	.probe		= krait_cache_probe,
++	.remove		= krait_cache_remove,
++	.driver		= {
++		.name   = "krait-cache-scaling",
++		.of_match_table = krait_cache_match_table,
++	},
++};
++module_platform_driver(krait_cache_driver);
++
++MODULE_DESCRIPTION("Krait CPU Cache Scaling driver");
++MODULE_AUTHOR("Christian Marangi <ansuelsmth@gmail.com>");
++MODULE_LICENSE("GPL v2");
diff --git a/target/linux/ipq806x/patches-6.1/114-02-ARM-dts-qcom-add-krait-cache-compatible-for-ipq806x-.patch b/target/linux/ipq806x/patches-6.1/114-02-ARM-dts-qcom-add-krait-cache-compatible-for-ipq806x-.patch
new file mode 100644
index 00000000000000..3a6c28179336f6
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/114-02-ARM-dts-qcom-add-krait-cache-compatible-for-ipq806x-.patch
@@ -0,0 +1,50 @@
+From ef124ad0ff8abfbf4ebe3fe6d7dcef4541dec13a Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 16 Jun 2022 18:39:21 +0200
+Subject: [PATCH] ARM: dts: qcom: add krait-cache compatible for ipq806x dtsi
+
+Add qcom,krait-cache compatible to enable cache devfreq driver for
+ipq806x SoC and move the L2 node to the soc node to make the devfreq
+driver correctly probe.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -69,16 +69,6 @@
+ 				min-residency-us = <3000>;
+ 			};
+ 		};
+-
+-		L2: l2-cache {
+-			compatible = "cache";
+-			cache-level = <2>;
+-			qcom,saw = <&saw_l2>;
+-
+-			clocks = <&kraitcc 4>;
+-			clock-names = "l2";
+-			operating-points-v2 = <&opp_table_l2>;
+-		};
+ 	};
+ 
+ 	opp_table_l2: opp_table_l2 {
+@@ -1410,6 +1400,16 @@
+ 			#reset-cells = <1>;
+ 		};
+ 
++		L2: l2-cache {
++			compatible = "cache", "qcom,krait-cache";
++			cache-level = <2>;
++			qcom,saw = <&saw_l2>;
++
++			clocks = <&kraitcc 4>;
++			clock-names = "l2";
++			operating-points-v2 = <&opp_table_l2>;
++		};
++
+ 		lpass@28100000 {
+ 			compatible = "qcom,lpass-cpu";
+ 			status = "disabled";
diff --git a/target/linux/ipq806x/patches-6.1/115-01-devfreq-add-ipq806x-fabric-scaling-driver.patch b/target/linux/ipq806x/patches-6.1/115-01-devfreq-add-ipq806x-fabric-scaling-driver.patch
new file mode 100644
index 00000000000000..c9cd3ebdf7377b
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/115-01-devfreq-add-ipq806x-fabric-scaling-driver.patch
@@ -0,0 +1,203 @@
+From 13f075999935bb696dbab63243923179f06fa05e Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 16 Jun 2022 19:56:08 +0200
+Subject: [PATCH 3/4] devfreq: add ipq806x fabric scaling driver
+
+Add ipq806x fabric scaling driver using the devfreq passive governor.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/devfreq/Kconfig               |  11 ++
+ drivers/devfreq/Makefile              |   1 +
+ drivers/devfreq/ipq806x-fab-devfreq.c | 155 ++++++++++++++++++++++++++
+ 3 files changed, 167 insertions(+)
+ create mode 100644 drivers/devfreq/ipq806x-fab-devfreq.c
+
+--- a/drivers/devfreq/Kconfig
++++ b/drivers/devfreq/Kconfig
+@@ -162,6 +162,17 @@ config ARM_KRAIT_CACHE_DEVFREQ
+ 	  based on the max frequency across all core and the range set in the device
+ 	  dts. If provided this scale also the regulator attached to the l2 cache.
+ 
++config ARM_IPQ806X_FAB_DEVFREQ
++	tristate "Scaling support for ipq806x Soc Fabric"
++	depends on ARCH_QCOM || COMPILE_TEST
++	select DEVFREQ_GOV_PASSIVE
++	help
++	  This adds the DEVFREQ driver for the ipq806x Soc Fabric.
++
++	  The driver register with the cpufreq notifier and find the right frequency
++	  based on the max frequency across all core and the range set in the device
++	  dts.
++
+ source "drivers/devfreq/event/Kconfig"
+ 
+ endif # PM_DEVFREQ
+--- a/drivers/devfreq/Makefile
++++ b/drivers/devfreq/Makefile
+@@ -16,6 +16,7 @@ obj-$(CONFIG_ARM_RK3399_DMC_DEVFREQ)	+=
+ obj-$(CONFIG_ARM_SUN8I_A33_MBUS_DEVFREQ)	+= sun8i-a33-mbus.o
+ obj-$(CONFIG_ARM_TEGRA_DEVFREQ)		+= tegra30-devfreq.o
+ obj-$(CONFIG_ARM_KRAIT_CACHE_DEVFREQ)	+= krait-cache-devfreq.o
++obj-$(CONFIG_ARM_IPQ806X_FAB_DEVFREQ)	+= ipq806x-fab-devfreq.o
+ 
+ # DEVFREQ Event Drivers
+ obj-$(CONFIG_PM_DEVFREQ_EVENT)		+= event/
+--- /dev/null
++++ b/drivers/devfreq/ipq806x-fab-devfreq.c
+@@ -0,0 +1,155 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/cpufreq.h>
++#include <linux/devfreq.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/clk.h>
++#include <linux/slab.h>
++#include <linux/pm_opp.h>
++
++#include "governor.h"
++
++struct ipq806x_fab_data {
++	struct clk *fab_clk;
++	struct clk *ddr_clk;
++};
++
++static int ipq806x_fab_get_cur_freq(struct device *dev, unsigned long *freq)
++{
++	struct ipq806x_fab_data *data = dev_get_drvdata(dev);
++
++	*freq = clk_get_rate(data->fab_clk);
++
++	return 0;
++};
++
++static int ipq806x_fab_target(struct device *dev, unsigned long *freq,
++			      u32 flags)
++{
++	struct ipq806x_fab_data *data = dev_get_drvdata(dev);
++	struct dev_pm_opp *opp;
++	int ret;
++
++	opp = dev_pm_opp_find_freq_ceil(dev, freq);
++	if (unlikely(IS_ERR(opp)))
++		return PTR_ERR(opp);
++
++	dev_pm_opp_put(opp);
++
++	ret = clk_set_rate(data->fab_clk, *freq);
++	if (ret)
++		return ret;
++
++	return clk_set_rate(data->ddr_clk, *freq);
++};
++
++static int ipq806x_fab_get_dev_status(struct device *dev,
++				      struct devfreq_dev_status *stat)
++{
++	struct ipq806x_fab_data *data = dev_get_drvdata(dev);
++
++	stat->busy_time = 0;
++	stat->total_time = 0;
++	stat->current_frequency = clk_get_rate(data->fab_clk);
++
++	return 0;
++};
++
++static struct devfreq_dev_profile ipq806x_fab_devfreq_profile = {
++	.target = ipq806x_fab_target,
++	.get_dev_status = ipq806x_fab_get_dev_status,
++	.get_cur_freq = ipq806x_fab_get_cur_freq
++};
++
++static struct devfreq_passive_data devfreq_gov_data = {
++	.parent_type = CPUFREQ_PARENT_DEV,
++};
++
++static int ipq806x_fab_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct ipq806x_fab_data *data;
++	struct devfreq *devfreq;
++	struct clk *clk;
++	int ret;
++
++	data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
++	if (!data)
++		return -ENOMEM;
++
++	clk = devm_clk_get(dev, "apps-fab-clk");
++	if (IS_ERR(clk)) {
++		dev_err_probe(dev, PTR_ERR(clk), "failed to get apps fab clk\n");
++		return PTR_ERR(clk);
++	}
++
++	clk_prepare_enable(clk);
++	data->fab_clk = clk;
++
++	clk = devm_clk_get(dev, "ddr-fab-clk");
++	if (IS_ERR(clk)) {
++		dev_err_probe(dev, PTR_ERR(clk), "failed to get ddr fab clk\n");
++		goto err_ddr;
++	}
++
++	clk_prepare_enable(clk);
++	data->ddr_clk = clk;
++
++	ret = dev_pm_opp_of_add_table(dev);
++	if (ret) {
++		dev_err(dev, "failed to parse fab freq thresholds\n");
++		return ret;
++	}
++
++	dev_set_drvdata(dev, data);
++
++	devfreq = devm_devfreq_add_device(&pdev->dev, &ipq806x_fab_devfreq_profile,
++					  DEVFREQ_GOV_PASSIVE, &devfreq_gov_data);
++	if (IS_ERR(devfreq))
++		dev_pm_opp_remove_table(dev);
++
++	return PTR_ERR_OR_ZERO(devfreq);
++
++err_ddr:
++	clk_unprepare(data->fab_clk);
++	clk_put(data->fab_clk);
++	return PTR_ERR(clk);
++};
++
++static int ipq806x_fab_remove(struct platform_device *pdev)
++{
++	struct ipq806x_fab_data *data = dev_get_drvdata(&pdev->dev);
++
++	clk_unprepare(data->fab_clk);
++	clk_put(data->fab_clk);
++
++	clk_unprepare(data->ddr_clk);
++	clk_put(data->ddr_clk);
++
++	dev_pm_opp_remove_table(&pdev->dev);
++
++	return 0;
++};
++
++static const struct of_device_id ipq806x_fab_match_table[] = {
++	{ .compatible = "qcom,fab-scaling" },
++	{}
++};
++
++static struct platform_driver ipq806x_fab_driver = {
++	.probe		= ipq806x_fab_probe,
++	.remove		= ipq806x_fab_remove,
++	.driver		= {
++		.name   = "ipq806x-fab-scaling",
++		.of_match_table = ipq806x_fab_match_table,
++	},
++};
++module_platform_driver(ipq806x_fab_driver);
++
++MODULE_DESCRIPTION("ipq806x Fab Scaling driver");
++MODULE_AUTHOR("Christian Marangi <ansuelsmth@gmail.com>");
++MODULE_LICENSE("GPL v2");
diff --git a/target/linux/ipq806x/patches-6.1/115-02-ARM-dts-qcom-add-fab-scaling-node-for-ipq806x.patch b/target/linux/ipq806x/patches-6.1/115-02-ARM-dts-qcom-add-fab-scaling-node-for-ipq806x.patch
new file mode 100644
index 00000000000000..a324b6facf34c9
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/115-02-ARM-dts-qcom-add-fab-scaling-node-for-ipq806x.patch
@@ -0,0 +1,48 @@
+From c3573f0907dadb0a6e9933aae2a46a489abcbd48 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 16 Jun 2022 20:03:05 +0200
+Subject: [PATCH 4/4] ARM: dts: qcom: add fab scaling node for ipq806x
+
+Add fabric scaling node for ipq806x to correctly scale apps and ddr
+fabric clk.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -170,6 +170,18 @@
+ 		};
+ 	};
+ 
++	opp_table_fab: opp_table_fab {
++		compatible = "operating-points-v2";
++
++		opp-533000000 {
++			opp-hz = /bits/ 64 <533000000>;
++		};
++
++		opp-400000000 {
++			opp-hz = /bits/ 64 <400000000>;
++		};
++	};
++
+ 	thermal-zones {
+ 		sensor0-thermal {
+ 			polling-delay-passive = <0>;
+@@ -1410,6 +1422,13 @@
+ 			operating-points-v2 = <&opp_table_l2>;
+ 		};
+ 
++		fab-scaling {
++			compatible = "qcom,fab-scaling";
++			clocks = <&rpmcc RPM_APPS_FABRIC_A_CLK>, <&rpmcc RPM_EBI1_A_CLK>;
++			clock-names = "apps-fab-clk", "ddr-fab-clk";
++			operating-points-v2 = <&opp_table_fab>;
++		};
++
+ 		lpass@28100000 {
+ 			compatible = "qcom,lpass-cpu";
+ 			status = "disabled";
diff --git a/target/linux/ipq806x/patches-6.1/120-v6.2-clk-qcom-kpss-xcc-register-it-as-clk-provider.patch b/target/linux/ipq806x/patches-6.1/120-v6.2-clk-qcom-kpss-xcc-register-it-as-clk-provider.patch
new file mode 100644
index 00000000000000..9395f1b241e7c0
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/120-v6.2-clk-qcom-kpss-xcc-register-it-as-clk-provider.patch
@@ -0,0 +1,60 @@
+From 09be1a39e685d8c5edd471fd1cac9a8f8280d2de Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 8 Nov 2022 22:17:34 +0100
+Subject: [PATCH] clk: qcom: kpss-xcc: register it as clk provider
+
+krait-cc use this driver for the secondary mux. Register it as a clk
+provider to correctly use this clk in other drivers.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221108211734.3707-1-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/kpss-xcc.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/clk/qcom/kpss-xcc.c
++++ b/drivers/clk/qcom/kpss-xcc.c
+@@ -31,12 +31,13 @@ MODULE_DEVICE_TABLE(of, kpss_xcc_match_t
+ 
+ static int kpss_xcc_driver_probe(struct platform_device *pdev)
+ {
++	struct device *dev = &pdev->dev;
+ 	const struct of_device_id *id;
+ 	void __iomem *base;
+ 	struct clk_hw *hw;
+ 	const char *name;
+ 
+-	id = of_match_device(kpss_xcc_match_table, &pdev->dev);
++	id = of_match_device(kpss_xcc_match_table, dev);
+ 	if (!id)
+ 		return -ENODEV;
+ 
+@@ -45,7 +46,7 @@ static int kpss_xcc_driver_probe(struct
+ 		return PTR_ERR(base);
+ 
+ 	if (id->data) {
+-		if (of_property_read_string_index(pdev->dev.of_node,
++		if (of_property_read_string_index(dev->of_node,
+ 						  "clock-output-names",
+ 						  0, &name))
+ 			return -ENODEV;
+@@ -55,12 +56,16 @@ static int kpss_xcc_driver_probe(struct
+ 		base += 0x28;
+ 	}
+ 
+-	hw = devm_clk_hw_register_mux_parent_data_table(&pdev->dev, name, aux_parents,
++	hw = devm_clk_hw_register_mux_parent_data_table(dev, name, aux_parents,
+ 							ARRAY_SIZE(aux_parents), 0,
+ 							base, 0, 0x3,
+ 							0, aux_parent_map, NULL);
++	if (IS_ERR(hw))
++		return PTR_ERR(hw);
+ 
+-	return PTR_ERR_OR_ZERO(hw);
++	of_clk_add_hw_provider(dev->of_node, of_clk_hw_simple_get, hw);
++
++	return 0;
+ }
+ 
+ static struct platform_driver kpss_xcc_driver = {
diff --git a/target/linux/ipq806x/patches-6.1/121-v6.2-01-clk-qcom-krait-cc-use-devm-variant-for-clk-notifier-.patch b/target/linux/ipq806x/patches-6.1/121-v6.2-01-clk-qcom-krait-cc-use-devm-variant-for-clk-notifier-.patch
new file mode 100644
index 00000000000000..65c1fc17f21279
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/121-v6.2-01-clk-qcom-krait-cc-use-devm-variant-for-clk-notifier-.patch
@@ -0,0 +1,27 @@
+From 3198106a99e73dbc4c02bd5128cec0997c73af82 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 8 Nov 2022 22:58:27 +0100
+Subject: [PATCH 1/6] clk: qcom: krait-cc: use devm variant for clk notifier
+ register
+
+Use devm variant for clk notifier register and correctly handle free
+resource on driver remove.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221108215827.30475-1-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/krait-cc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -62,7 +62,7 @@ static int krait_notifier_register(struc
+ 	int ret = 0;
+ 
+ 	mux->clk_nb.notifier_call = krait_notifier_cb;
+-	ret = clk_notifier_register(clk, &mux->clk_nb);
++	ret = devm_clk_notifier_register(dev, clk, &mux->clk_nb);
+ 	if (ret)
+ 		dev_err(dev, "failed to register clock notifier: %d\n", ret);
+ 
diff --git a/target/linux/ipq806x/patches-6.1/121-v6.2-02-clk-qcom-krait-cc-fix-wrong-parent-order-for-seconda.patch b/target/linux/ipq806x/patches-6.1/121-v6.2-02-clk-qcom-krait-cc-fix-wrong-parent-order-for-seconda.patch
new file mode 100644
index 00000000000000..2dcb69399cfeb3
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/121-v6.2-02-clk-qcom-krait-cc-fix-wrong-parent-order-for-seconda.patch
@@ -0,0 +1,46 @@
+From 8e456411abcbf899c04740b9dbb3dcefcd61c946 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 9 Nov 2022 01:56:27 +0100
+Subject: [PATCH 2/6] clk: qcom: krait-cc: fix wrong parent order for secondary
+ mux
+
+The secondary mux parent order is swapped.
+This currently doesn't cause problems as the secondary mux is used for idle
+clk and as a safe clk source while reprogramming the hfpll.
+
+Each mux have 2 or more output but he always have a safe source to
+switch while reprogramming the connected pll. We use a clk notifier to
+switch to the correct parent before clk core can apply the correct rate.
+The parent to switch is hardcoded in the mux struct.
+
+For the secondary mux the safe source to use is the qsb parent as it's
+the only fixed clk as the acpus_aux is a pll that can source from pxo or
+from pll8.
+
+The hardcoded safe parent for the secondary mux is set to index 0 that
+in the secondary mux map is set to 2.
+
+But the index 0 is actually acpu_aux in the parent list.
+
+Fix the swapped parents to correctly handle idle frequency and output a
+sane clk_summary report.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221109005631.3189-1-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/krait-cc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -116,8 +116,8 @@ krait_add_sec_mux(struct device *dev, in
+ 	int ret;
+ 	struct krait_mux_clk *mux;
+ 	static const char *sec_mux_list[] = {
+-		"acpu_aux",
+ 		"qsb",
++		"acpu_aux",
+ 	};
+ 	struct clk_init_data init = {
+ 		.parent_names = sec_mux_list,
diff --git a/target/linux/ipq806x/patches-6.1/121-v6.2-03-clk-qcom-krait-cc-also-enable-secondary-mux-and-div-.patch b/target/linux/ipq806x/patches-6.1/121-v6.2-03-clk-qcom-krait-cc-also-enable-secondary-mux-and-div-.patch
new file mode 100644
index 00000000000000..6261a940d7196d
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/121-v6.2-03-clk-qcom-krait-cc-also-enable-secondary-mux-and-div-.patch
@@ -0,0 +1,68 @@
+From 18ae57b1e8abee6c453381470f6e18991d2901a8 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 9 Nov 2022 01:56:28 +0100
+Subject: [PATCH 3/6] clk: qcom: krait-cc: also enable secondary mux and div
+ clk
+
+clk-krait ignore any rate change if clk is not flagged as enabled.
+Correctly enable the secondary mux and div clk to correctly change rate
+instead of silently ignoring the request.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221109005631.3189-2-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/krait-cc.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -80,6 +80,7 @@ krait_add_div(struct device *dev, int id
+ 	};
+ 	const char *p_names[1];
+ 	struct clk *clk;
++	int cpu;
+ 
+ 	div = devm_kzalloc(dev, sizeof(*div), GFP_KERNEL);
+ 	if (!div)
+@@ -103,6 +104,17 @@ krait_add_div(struct device *dev, int id
+ 	}
+ 
+ 	clk = devm_clk_register(dev, &div->hw);
++	if (IS_ERR(clk))
++		goto err;
++
++	/* clk-krait ignore any rate change if mux is not flagged as enabled */
++	if (id < 0)
++		for_each_online_cpu(cpu)
++			clk_prepare_enable(div->hw.clk);
++	else
++		clk_prepare_enable(div->hw.clk);
++
++err:
+ 	kfree(p_names[0]);
+ 	kfree(init.name);
+ 
+@@ -113,7 +125,7 @@ static int
+ krait_add_sec_mux(struct device *dev, int id, const char *s,
+ 		  unsigned int offset, bool unique_aux)
+ {
+-	int ret;
++	int cpu, ret;
+ 	struct krait_mux_clk *mux;
+ 	static const char *sec_mux_list[] = {
+ 		"qsb",
+@@ -165,6 +177,13 @@ krait_add_sec_mux(struct device *dev, in
+ 	if (ret)
+ 		goto unique_aux;
+ 
++	/* clk-krait ignore any rate change if mux is not flagged as enabled */
++	if (id < 0)
++		for_each_online_cpu(cpu)
++			clk_prepare_enable(mux->hw.clk);
++	else
++		clk_prepare_enable(mux->hw.clk);
++
+ unique_aux:
+ 	if (unique_aux)
+ 		kfree(sec_mux_list[0]);
diff --git a/target/linux/ipq806x/patches-6.1/121-v6.2-04-clk-qcom-krait-cc-handle-secondary-mux-sourcing-out-.patch b/target/linux/ipq806x/patches-6.1/121-v6.2-04-clk-qcom-krait-cc-handle-secondary-mux-sourcing-out-.patch
new file mode 100644
index 00000000000000..fabb299f427776
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/121-v6.2-04-clk-qcom-krait-cc-handle-secondary-mux-sourcing-out-.patch
@@ -0,0 +1,48 @@
+From e5dc1a4c01510da8438dddfdf4200b79d73990dc Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 9 Nov 2022 01:56:29 +0100
+Subject: [PATCH 4/6] clk: qcom: krait-cc: handle secondary mux sourcing out of
+ acpu_aux
+
+Some bootloader may leave the system in an even more undefined state
+with the secondary mux of L2 or other cores sourcing out of the acpu_aux
+parent. This results in the clk set to the PXO rate or a PLL8 rate.
+
+The current logic to reset the mux and set them to a defined state only
+handle if the mux are configured to source out of QSB. Change this and
+force a new and defined state if the current clk is lower than the aux
+rate. This way we can handle any wrong configuration where the mux is
+sourcing out of QSB (rate 225MHz, currently set to a virtual rate of 1),
+PXO rate (rate 25MHz) or PLL8 (needs to be configured to run at 384Mhz).
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221109005631.3189-3-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/krait-cc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -383,8 +383,8 @@ static int krait_cc_probe(struct platfor
+ 	 */
+ 	cur_rate = clk_get_rate(l2_pri_mux_clk);
+ 	aux_rate = 384000000;
+-	if (cur_rate == 1) {
+-		pr_info("L2 @ QSB rate. Forcing new rate.\n");
++	if (cur_rate < aux_rate) {
++		pr_info("L2 @ Undefined rate. Forcing new rate.\n");
+ 		cur_rate = aux_rate;
+ 	}
+ 	clk_set_rate(l2_pri_mux_clk, aux_rate);
+@@ -394,8 +394,8 @@ static int krait_cc_probe(struct platfor
+ 	for_each_possible_cpu(cpu) {
+ 		clk = clks[cpu];
+ 		cur_rate = clk_get_rate(clk);
+-		if (cur_rate == 1) {
+-			pr_info("CPU%d @ QSB rate. Forcing new rate.\n", cpu);
++		if (cur_rate < aux_rate) {
++			pr_info("CPU%d @ Undefined rate. Forcing new rate.\n", cpu);
+ 			cur_rate = aux_rate;
+ 		}
+ 
diff --git a/target/linux/ipq806x/patches-6.1/121-v6.2-05-clk-qcom-krait-cc-convert-to-devm_clk_hw_register.patch b/target/linux/ipq806x/patches-6.1/121-v6.2-05-clk-qcom-krait-cc-convert-to-devm_clk_hw_register.patch
new file mode 100644
index 00000000000000..049b1fa49f1200
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/121-v6.2-05-clk-qcom-krait-cc-convert-to-devm_clk_hw_register.patch
@@ -0,0 +1,104 @@
+From 8ea9fb841a7e528bc8ae79d726ce951dcf7b46e2 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 9 Nov 2022 01:56:30 +0100
+Subject: [PATCH 5/6] clk: qcom: krait-cc: convert to devm_clk_hw_register
+
+clk_register is now deprecated. Convert the driver to devm_clk_hw_register.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221109005631.3189-4-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/krait-cc.c | 31 +++++++++++++++++++------------
+ 1 file changed, 19 insertions(+), 12 deletions(-)
+
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -79,8 +79,7 @@ krait_add_div(struct device *dev, int id
+ 		.flags = CLK_SET_RATE_PARENT,
+ 	};
+ 	const char *p_names[1];
+-	struct clk *clk;
+-	int cpu;
++	int cpu, ret;
+ 
+ 	div = devm_kzalloc(dev, sizeof(*div), GFP_KERNEL);
+ 	if (!div)
+@@ -103,8 +102,8 @@ krait_add_div(struct device *dev, int id
+ 		return -ENOMEM;
+ 	}
+ 
+-	clk = devm_clk_register(dev, &div->hw);
+-	if (IS_ERR(clk))
++	ret = devm_clk_hw_register(dev, &div->hw);
++	if (ret)
+ 		goto err;
+ 
+ 	/* clk-krait ignore any rate change if mux is not flagged as enabled */
+@@ -118,7 +117,7 @@ err:
+ 	kfree(p_names[0]);
+ 	kfree(init.name);
+ 
+-	return PTR_ERR_OR_ZERO(clk);
++	return ret;
+ }
+ 
+ static int
+@@ -137,7 +136,6 @@ krait_add_sec_mux(struct device *dev, in
+ 		.ops = &krait_mux_clk_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+ 	};
+-	struct clk *clk;
+ 
+ 	mux = devm_kzalloc(dev, sizeof(*mux), GFP_KERNEL);
+ 	if (!mux)
+@@ -166,14 +164,16 @@ krait_add_sec_mux(struct device *dev, in
+ 	if (unique_aux) {
+ 		sec_mux_list[0] = kasprintf(GFP_KERNEL, "acpu%s_aux", s);
+ 		if (!sec_mux_list[0]) {
+-			clk = ERR_PTR(-ENOMEM);
++			ret = -ENOMEM;
+ 			goto err_aux;
+ 		}
+ 	}
+ 
+-	clk = devm_clk_register(dev, &mux->hw);
++	ret = devm_clk_hw_register(dev, &mux->hw);
++	if (ret)
++		goto unique_aux;
+ 
+-	ret = krait_notifier_register(dev, clk, mux);
++	ret = krait_notifier_register(dev, mux->hw.clk, mux);
+ 	if (ret)
+ 		goto unique_aux;
+ 
+@@ -189,7 +189,7 @@ unique_aux:
+ 		kfree(sec_mux_list[0]);
+ err_aux:
+ 	kfree(init.name);
+-	return PTR_ERR_OR_ZERO(clk);
++	return ret;
+ }
+ 
+ static struct clk *
+@@ -241,11 +241,18 @@ krait_add_pri_mux(struct device *dev, in
+ 		goto err_p2;
+ 	}
+ 
+-	clk = devm_clk_register(dev, &mux->hw);
++	ret = devm_clk_hw_register(dev, &mux->hw);
++	if (ret) {
++		clk = ERR_PTR(ret);
++		goto err_p3;
++	}
++
++	clk = mux->hw.clk;
+ 
+ 	ret = krait_notifier_register(dev, clk, mux);
+ 	if (ret)
+-		goto err_p3;
++		clk = ERR_PTR(ret);
++
+ err_p3:
+ 	kfree(p_names[2]);
+ err_p2:
diff --git a/target/linux/ipq806x/patches-6.1/121-v6.2-06-clk-qcom-krait-cc-convert-to-parent_data-API.patch b/target/linux/ipq806x/patches-6.1/121-v6.2-06-clk-qcom-krait-cc-convert-to-parent_data-API.patch
new file mode 100644
index 00000000000000..453a37dfc08b7f
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/121-v6.2-06-clk-qcom-krait-cc-convert-to-parent_data-API.patch
@@ -0,0 +1,414 @@
+From 56a655e1c41a86445cf2de656649ad93424b2a63 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 9 Nov 2022 01:56:31 +0100
+Subject: [PATCH 6/6] clk: qcom: krait-cc: convert to parent_data API
+
+Modernize the krait-cc driver to parent-data API and refactor to drop
+any use of parent_names. From Documentation all the required clocks should
+be declared in DTS so fw_name can be correctly used to get the parents
+for all the muxes. .name is also declared to save compatibility with old
+DT.
+
+While at it also drop some hardcoded index and introduce an enum to make
+index values more clear.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221109005631.3189-5-ansuelsmth@gmail.com
+---
+ drivers/clk/qcom/krait-cc.c | 202 ++++++++++++++++++++----------------
+ 1 file changed, 112 insertions(+), 90 deletions(-)
+
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -15,6 +15,16 @@
+ 
+ #include "clk-krait.h"
+ 
++enum {
++	cpu0_mux = 0,
++	cpu1_mux,
++	cpu2_mux,
++	cpu3_mux,
++	l2_mux,
++
++	clks_max,
++};
++
+ static unsigned int sec_mux_map[] = {
+ 	2,
+ 	0,
+@@ -69,21 +79,23 @@ static int krait_notifier_register(struc
+ 	return ret;
+ }
+ 
+-static int
++static struct clk_hw *
+ krait_add_div(struct device *dev, int id, const char *s, unsigned int offset)
+ {
+ 	struct krait_div2_clk *div;
++	static struct clk_parent_data p_data[1];
+ 	struct clk_init_data init = {
+-		.num_parents = 1,
++		.num_parents = ARRAY_SIZE(p_data),
+ 		.ops = &krait_div2_clk_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+ 	};
+-	const char *p_names[1];
++	struct clk_hw *clk;
++	char *parent_name;
+ 	int cpu, ret;
+ 
+ 	div = devm_kzalloc(dev, sizeof(*div), GFP_KERNEL);
+ 	if (!div)
+-		return -ENOMEM;
++		return ERR_PTR(-ENOMEM);
+ 
+ 	div->width = 2;
+ 	div->shift = 6;
+@@ -93,18 +105,25 @@ krait_add_div(struct device *dev, int id
+ 
+ 	init.name = kasprintf(GFP_KERNEL, "hfpll%s_div", s);
+ 	if (!init.name)
+-		return -ENOMEM;
++		return ERR_PTR(-ENOMEM);
+ 
+-	init.parent_names = p_names;
+-	p_names[0] = kasprintf(GFP_KERNEL, "hfpll%s", s);
+-	if (!p_names[0]) {
+-		kfree(init.name);
+-		return -ENOMEM;
++	init.parent_data = p_data;
++	parent_name = kasprintf(GFP_KERNEL, "hfpll%s", s);
++	if (!parent_name) {
++		clk = ERR_PTR(-ENOMEM);
++		goto err_parent_name;
+ 	}
+ 
++	p_data[0].fw_name = parent_name;
++	p_data[0].name = parent_name;
++
+ 	ret = devm_clk_hw_register(dev, &div->hw);
+-	if (ret)
+-		goto err;
++	if (ret) {
++		clk = ERR_PTR(ret);
++		goto err_clk;
++	}
++
++	clk = &div->hw;
+ 
+ 	/* clk-krait ignore any rate change if mux is not flagged as enabled */
+ 	if (id < 0)
+@@ -113,33 +132,36 @@ krait_add_div(struct device *dev, int id
+ 	else
+ 		clk_prepare_enable(div->hw.clk);
+ 
+-err:
+-	kfree(p_names[0]);
++err_clk:
++	kfree(parent_name);
++err_parent_name:
+ 	kfree(init.name);
+ 
+-	return ret;
++	return clk;
+ }
+ 
+-static int
++static struct clk_hw *
+ krait_add_sec_mux(struct device *dev, int id, const char *s,
+ 		  unsigned int offset, bool unique_aux)
+ {
+ 	int cpu, ret;
+ 	struct krait_mux_clk *mux;
+-	static const char *sec_mux_list[] = {
+-		"qsb",
+-		"acpu_aux",
++	static struct clk_parent_data sec_mux_list[2] = {
++		{ .name = "qsb", .fw_name = "qsb" },
++		{},
+ 	};
+ 	struct clk_init_data init = {
+-		.parent_names = sec_mux_list,
++		.parent_data = sec_mux_list,
+ 		.num_parents = ARRAY_SIZE(sec_mux_list),
+ 		.ops = &krait_mux_clk_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+ 	};
++	struct clk_hw *clk;
++	char *parent_name;
+ 
+ 	mux = devm_kzalloc(dev, sizeof(*mux), GFP_KERNEL);
+ 	if (!mux)
+-		return -ENOMEM;
++		return ERR_PTR(-ENOMEM);
+ 
+ 	mux->offset = offset;
+ 	mux->lpl = id >= 0;
+@@ -159,23 +181,33 @@ krait_add_sec_mux(struct device *dev, in
+ 
+ 	init.name = kasprintf(GFP_KERNEL, "krait%s_sec_mux", s);
+ 	if (!init.name)
+-		return -ENOMEM;
++		return ERR_PTR(-ENOMEM);
+ 
+ 	if (unique_aux) {
+-		sec_mux_list[0] = kasprintf(GFP_KERNEL, "acpu%s_aux", s);
+-		if (!sec_mux_list[0]) {
+-			ret = -ENOMEM;
++		parent_name = kasprintf(GFP_KERNEL, "acpu%s_aux", s);
++		if (!parent_name) {
++			clk = ERR_PTR(-ENOMEM);
+ 			goto err_aux;
+ 		}
++		sec_mux_list[1].fw_name = parent_name;
++		sec_mux_list[1].name = parent_name;
++	} else {
++		sec_mux_list[1].name = "apu_aux";
+ 	}
+ 
+ 	ret = devm_clk_hw_register(dev, &mux->hw);
+-	if (ret)
+-		goto unique_aux;
++	if (ret) {
++		clk = ERR_PTR(ret);
++		goto err_clk;
++	}
++
++	clk = &mux->hw;
+ 
+ 	ret = krait_notifier_register(dev, mux->hw.clk, mux);
+-	if (ret)
+-		goto unique_aux;
++	if (ret) {
++		clk = ERR_PTR(ret);
++		goto err_clk;
++	}
+ 
+ 	/* clk-krait ignore any rate change if mux is not flagged as enabled */
+ 	if (id < 0)
+@@ -184,28 +216,29 @@ krait_add_sec_mux(struct device *dev, in
+ 	else
+ 		clk_prepare_enable(mux->hw.clk);
+ 
+-unique_aux:
++err_clk:
+ 	if (unique_aux)
+-		kfree(sec_mux_list[0]);
++		kfree(parent_name);
+ err_aux:
+ 	kfree(init.name);
+-	return ret;
++	return clk;
+ }
+ 
+-static struct clk *
+-krait_add_pri_mux(struct device *dev, int id, const char *s,
+-		  unsigned int offset)
++static struct clk_hw *
++krait_add_pri_mux(struct device *dev, struct clk_hw *hfpll_div, struct clk_hw *sec_mux,
++		  int id, const char *s, unsigned int offset)
+ {
+ 	int ret;
+ 	struct krait_mux_clk *mux;
+-	const char *p_names[3];
++	static struct clk_parent_data p_data[3];
+ 	struct clk_init_data init = {
+-		.parent_names = p_names,
+-		.num_parents = ARRAY_SIZE(p_names),
++		.parent_data = p_data,
++		.num_parents = ARRAY_SIZE(p_data),
+ 		.ops = &krait_mux_clk_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+ 	};
+-	struct clk *clk;
++	struct clk_hw *clk;
++	char *hfpll_name;
+ 
+ 	mux = devm_kzalloc(dev, sizeof(*mux), GFP_KERNEL);
+ 	if (!mux)
+@@ -223,55 +256,44 @@ krait_add_pri_mux(struct device *dev, in
+ 	if (!init.name)
+ 		return ERR_PTR(-ENOMEM);
+ 
+-	p_names[0] = kasprintf(GFP_KERNEL, "hfpll%s", s);
+-	if (!p_names[0]) {
++	hfpll_name = kasprintf(GFP_KERNEL, "hfpll%s", s);
++	if (!hfpll_name) {
+ 		clk = ERR_PTR(-ENOMEM);
+-		goto err_p0;
++		goto err_hfpll;
+ 	}
+ 
+-	p_names[1] = kasprintf(GFP_KERNEL, "hfpll%s_div", s);
+-	if (!p_names[1]) {
+-		clk = ERR_PTR(-ENOMEM);
+-		goto err_p1;
+-	}
++	p_data[0].fw_name = hfpll_name;
++	p_data[0].name = hfpll_name;
+ 
+-	p_names[2] = kasprintf(GFP_KERNEL, "krait%s_sec_mux", s);
+-	if (!p_names[2]) {
+-		clk = ERR_PTR(-ENOMEM);
+-		goto err_p2;
+-	}
++	p_data[1].hw = hfpll_div;
++	p_data[2].hw = sec_mux;
+ 
+ 	ret = devm_clk_hw_register(dev, &mux->hw);
+ 	if (ret) {
+ 		clk = ERR_PTR(ret);
+-		goto err_p3;
++		goto err_clk;
+ 	}
+ 
+-	clk = mux->hw.clk;
++	clk = &mux->hw;
+ 
+-	ret = krait_notifier_register(dev, clk, mux);
++	ret = krait_notifier_register(dev, mux->hw.clk, mux);
+ 	if (ret)
+ 		clk = ERR_PTR(ret);
+ 
+-err_p3:
+-	kfree(p_names[2]);
+-err_p2:
+-	kfree(p_names[1]);
+-err_p1:
+-	kfree(p_names[0]);
+-err_p0:
++err_clk:
++	kfree(hfpll_name);
++err_hfpll:
+ 	kfree(init.name);
+ 	return clk;
+ }
+ 
+ /* id < 0 for L2, otherwise id == physical CPU number */
+-static struct clk *krait_add_clks(struct device *dev, int id, bool unique_aux)
++static struct clk_hw *krait_add_clks(struct device *dev, int id, bool unique_aux)
+ {
+-	int ret;
++	struct clk_hw *hfpll_div, *sec_mux, *pri_mux;
+ 	unsigned int offset;
+ 	void *p = NULL;
+ 	const char *s;
+-	struct clk *clk;
+ 
+ 	if (id >= 0) {
+ 		offset = 0x4501 + (0x1000 * id);
+@@ -283,22 +305,23 @@ static struct clk *krait_add_clks(struct
+ 		s = "_l2";
+ 	}
+ 
+-	ret = krait_add_div(dev, id, s, offset);
+-	if (ret) {
+-		clk = ERR_PTR(ret);
++	hfpll_div = krait_add_div(dev, id, s, offset);
++	if (IS_ERR(hfpll_div)) {
++		pri_mux = hfpll_div;
+ 		goto err;
+ 	}
+ 
+-	ret = krait_add_sec_mux(dev, id, s, offset, unique_aux);
+-	if (ret) {
+-		clk = ERR_PTR(ret);
++	sec_mux = krait_add_sec_mux(dev, id, s, offset, unique_aux);
++	if (IS_ERR(sec_mux)) {
++		pri_mux = sec_mux;
+ 		goto err;
+ 	}
+ 
+-	clk = krait_add_pri_mux(dev, id, s, offset);
++	pri_mux = krait_add_pri_mux(dev, hfpll_div, sec_mux, id, s, offset);
++
+ err:
+ 	kfree(p);
+-	return clk;
++	return pri_mux;
+ }
+ 
+ static struct clk *krait_of_get(struct of_phandle_args *clkspec, void *data)
+@@ -306,7 +329,7 @@ static struct clk *krait_of_get(struct o
+ 	unsigned int idx = clkspec->args[0];
+ 	struct clk **clks = data;
+ 
+-	if (idx >= 5) {
++	if (idx >= clks_max) {
+ 		pr_err("%s: invalid clock index %d\n", __func__, idx);
+ 		return ERR_PTR(-EINVAL);
+ 	}
+@@ -327,9 +350,8 @@ static int krait_cc_probe(struct platfor
+ 	const struct of_device_id *id;
+ 	unsigned long cur_rate, aux_rate;
+ 	int cpu;
+-	struct clk *clk;
+-	struct clk **clks;
+-	struct clk *l2_pri_mux_clk;
++	struct clk_hw *mux, *l2_pri_mux;
++	struct clk *clk, **clks;
+ 
+ 	id = of_match_device(krait_cc_match_table, dev);
+ 	if (!id)
+@@ -348,21 +370,21 @@ static int krait_cc_probe(struct platfor
+ 	}
+ 
+ 	/* Krait configurations have at most 4 CPUs and one L2 */
+-	clks = devm_kcalloc(dev, 5, sizeof(*clks), GFP_KERNEL);
++	clks = devm_kcalloc(dev, clks_max, sizeof(*clks), GFP_KERNEL);
+ 	if (!clks)
+ 		return -ENOMEM;
+ 
+ 	for_each_possible_cpu(cpu) {
+-		clk = krait_add_clks(dev, cpu, id->data);
++		mux = krait_add_clks(dev, cpu, id->data);
+ 		if (IS_ERR(clk))
+ 			return PTR_ERR(clk);
+-		clks[cpu] = clk;
++		clks[cpu] = mux->clk;
+ 	}
+ 
+-	l2_pri_mux_clk = krait_add_clks(dev, -1, id->data);
+-	if (IS_ERR(l2_pri_mux_clk))
+-		return PTR_ERR(l2_pri_mux_clk);
+-	clks[4] = l2_pri_mux_clk;
++	l2_pri_mux = krait_add_clks(dev, -1, id->data);
++	if (IS_ERR(l2_pri_mux))
++		return PTR_ERR(l2_pri_mux);
++	clks[l2_mux] = l2_pri_mux->clk;
+ 
+ 	/*
+ 	 * We don't want the CPU or L2 clocks to be turned off at late init
+@@ -372,7 +394,7 @@ static int krait_cc_probe(struct platfor
+ 	 * they take over.
+ 	 */
+ 	for_each_online_cpu(cpu) {
+-		clk_prepare_enable(l2_pri_mux_clk);
++		clk_prepare_enable(clks[l2_mux]);
+ 		WARN(clk_prepare_enable(clks[cpu]),
+ 		     "Unable to turn on CPU%d clock", cpu);
+ 	}
+@@ -388,16 +410,16 @@ static int krait_cc_probe(struct platfor
+ 	 * two different rates to force a HFPLL reinit under all
+ 	 * circumstances.
+ 	 */
+-	cur_rate = clk_get_rate(l2_pri_mux_clk);
++	cur_rate = clk_get_rate(clks[l2_mux]);
+ 	aux_rate = 384000000;
+ 	if (cur_rate < aux_rate) {
+ 		pr_info("L2 @ Undefined rate. Forcing new rate.\n");
+ 		cur_rate = aux_rate;
+ 	}
+-	clk_set_rate(l2_pri_mux_clk, aux_rate);
+-	clk_set_rate(l2_pri_mux_clk, 2);
+-	clk_set_rate(l2_pri_mux_clk, cur_rate);
+-	pr_info("L2 @ %lu KHz\n", clk_get_rate(l2_pri_mux_clk) / 1000);
++	clk_set_rate(clks[l2_mux], aux_rate);
++	clk_set_rate(clks[l2_mux], 2);
++	clk_set_rate(clks[l2_mux], cur_rate);
++	pr_info("L2 @ %lu KHz\n", clk_get_rate(clks[l2_mux]) / 1000);
+ 	for_each_possible_cpu(cpu) {
+ 		clk = clks[cpu];
+ 		cur_rate = clk_get_rate(clk);
diff --git a/target/linux/ipq806x/patches-6.1/122-01-clk-qcom-krait-cc-handle-qsb-clock-defined-in-DTS.patch b/target/linux/ipq806x/patches-6.1/122-01-clk-qcom-krait-cc-handle-qsb-clock-defined-in-DTS.patch
new file mode 100644
index 00000000000000..c30c245d0a55f6
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/122-01-clk-qcom-krait-cc-handle-qsb-clock-defined-in-DTS.patch
@@ -0,0 +1,47 @@
+From 666c1b745e93ccddde841d5057c33f97b29a316a Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 15 Sep 2022 02:19:28 +0200
+Subject: [PATCH 3/9] clk: qcom: krait-cc: handle qsb clock defined in DTS
+
+qsb fixed clk may be defined in DTS and correctly passed in the clocks
+list. Add related code to handle this and modify the logic to
+dynamically read qsb clock frequency.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/clk/qcom/krait-cc.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -348,7 +348,7 @@ static int krait_cc_probe(struct platfor
+ {
+ 	struct device *dev = &pdev->dev;
+ 	const struct of_device_id *id;
+-	unsigned long cur_rate, aux_rate;
++	unsigned long cur_rate, aux_rate, qsb_rate;
+ 	int cpu;
+ 	struct clk_hw *mux, *l2_pri_mux;
+ 	struct clk *clk, **clks;
+@@ -357,11 +357,19 @@ static int krait_cc_probe(struct platfor
+ 	if (!id)
+ 		return -ENODEV;
+ 
+-	/* Rate is 1 because 0 causes problems for __clk_mux_determine_rate */
+-	clk = clk_register_fixed_rate(dev, "qsb", NULL, 0, 1);
++	/*
++	 * Per Documentation qsb should be provided from DTS.
++	 * To address old implementation, register the fixed clock anyway.
++	 * Rate is 1 because 0 causes problems for __clk_mux_determine_rate
++	 */
++	clk = clk_get(dev, "qsb");
++	if (IS_ERR(clk))
++		clk = clk_register_fixed_rate(dev, "qsb", NULL, 0, 1);
+ 	if (IS_ERR(clk))
+ 		return PTR_ERR(clk);
+ 
++	qsb_rate = clk_get_rate(clk);
++
+ 	if (!id->data) {
+ 		clk = clk_register_fixed_factor(dev, "acpu_aux",
+ 						"gpll0_vote", 0, 1, 2);
diff --git a/target/linux/ipq806x/patches-6.1/122-02-clk-qcom-krait-cc-register-REAL-qsb-fixed-clock.patch b/target/linux/ipq806x/patches-6.1/122-02-clk-qcom-krait-cc-register-REAL-qsb-fixed-clock.patch
new file mode 100644
index 00000000000000..e2f78f79fb1a06
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/122-02-clk-qcom-krait-cc-register-REAL-qsb-fixed-clock.patch
@@ -0,0 +1,36 @@
+From fca6f185a9d9ef0892a719bc6da955b22d326ec7 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 15 Sep 2022 02:24:33 +0200
+Subject: [PATCH 4/9] clk: qcom: krait-cc: register REAL qsb fixed clock
+
+With some tools it was discovered the real frequency of the qsb fixed
+clock. While not 100% correct it's still better than using 1 as a dummy
+frequency.
+Correctly register the qsb fixed clock with the frequency of 225 MHz
+instead of 1.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/clk/qcom/krait-cc.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -25,6 +25,8 @@ enum {
+ 	clks_max,
+ };
+ 
++#define QSB_RATE	2250000000
++
+ static unsigned int sec_mux_map[] = {
+ 	2,
+ 	0,
+@@ -364,7 +366,7 @@ static int krait_cc_probe(struct platfor
+ 	 */
+ 	clk = clk_get(dev, "qsb");
+ 	if (IS_ERR(clk))
+-		clk = clk_register_fixed_rate(dev, "qsb", NULL, 0, 1);
++		clk = clk_register_fixed_rate(dev, "qsb", NULL, 0, QSB_RATE);
+ 	if (IS_ERR(clk))
+ 		return PTR_ERR(clk);
+ 
diff --git a/target/linux/ipq806x/patches-6.1/122-03-clk-qcom-krait-cc-drop-pr_info-and-use-dev_info.patch b/target/linux/ipq806x/patches-6.1/122-03-clk-qcom-krait-cc-drop-pr_info-and-use-dev_info.patch
new file mode 100644
index 00000000000000..d95a63fc44fd8a
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/122-03-clk-qcom-krait-cc-drop-pr_info-and-use-dev_info.patch
@@ -0,0 +1,44 @@
+From 2399d181557d94ae9a2686926cd25768f132e4b4 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Fri, 18 Mar 2022 16:12:14 +0100
+Subject: [PATCH 7/9] clk: qcom: krait-cc: drop pr_info and use dev_info
+
+Replace pr_info() with dev_info() to provide better diagnostics.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/clk/qcom/krait-cc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -423,25 +423,25 @@ static int krait_cc_probe(struct platfor
+ 	cur_rate = clk_get_rate(clks[l2_mux]);
+ 	aux_rate = 384000000;
+ 	if (cur_rate < aux_rate) {
+-		pr_info("L2 @ Undefined rate. Forcing new rate.\n");
++		dev_info(dev, "L2 @ Undefined rate. Forcing new rate.\n");
+ 		cur_rate = aux_rate;
+ 	}
+ 	clk_set_rate(clks[l2_mux], aux_rate);
+ 	clk_set_rate(clks[l2_mux], 2);
+ 	clk_set_rate(clks[l2_mux], cur_rate);
+-	pr_info("L2 @ %lu KHz\n", clk_get_rate(clks[l2_mux]) / 1000);
++	dev_info(dev, "L2 @ %lu KHz\n", clk_get_rate(clks[l2_mux]) / 1000);
+ 	for_each_possible_cpu(cpu) {
+ 		clk = clks[cpu];
+ 		cur_rate = clk_get_rate(clk);
+ 		if (cur_rate < aux_rate) {
+-			pr_info("CPU%d @ Undefined rate. Forcing new rate.\n", cpu);
++			dev_info(dev, "CPU%d @ Undefined rate. Forcing new rate.\n", cpu);
+ 			cur_rate = aux_rate;
+ 		}
+ 
+ 		clk_set_rate(clk, aux_rate);
+ 		clk_set_rate(clk, 2);
+ 		clk_set_rate(clk, cur_rate);
+-		pr_info("CPU%d @ %lu KHz\n", cpu, clk_get_rate(clk) / 1000);
++		dev_info(dev, "CPU%d @ %lu KHz\n", cpu, clk_get_rate(clk) / 1000);
+ 	}
+ 
+ 	of_clk_add_provider(dev->of_node, krait_of_get, clks);
diff --git a/target/linux/ipq806x/patches-6.1/122-04-clk-qcom-krait-cc-rework-mux-reset-logic-and-reset-h.patch b/target/linux/ipq806x/patches-6.1/122-04-clk-qcom-krait-cc-rework-mux-reset-logic-and-reset-h.patch
new file mode 100644
index 00000000000000..8f88e069912218
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/122-04-clk-qcom-krait-cc-rework-mux-reset-logic-and-reset-h.patch
@@ -0,0 +1,88 @@
+From 6a77cf3f5f95ec0058e1b4d1ada018748cb0b83b Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 15 Sep 2022 03:33:13 +0200
+Subject: [PATCH 9/9] clk: qcom: krait-cc: rework mux reset logic and reset
+ hfpll
+
+Rework and clean mux reset logic.
+Compact it to a for loop to handle both CPU and L2 in one place.
+Move hardcoded aux_rate to define and add a new hfpll_rate value to
+reset hfpll settings.
+Change logic to now reset the hfpll to the lowest value of 600 Mhz and
+then restoring the previous frequency. This permits to reset the hfpll if
+the primary mux was set to source out of the secondary mux.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/clk/qcom/krait-cc.c | 50 +++++++++++++++++--------------------
+ 1 file changed, 23 insertions(+), 27 deletions(-)
+
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -25,7 +25,9 @@ enum {
+ 	clks_max,
+ };
+ 
+-#define QSB_RATE	2250000000
++#define QSB_RATE	225000000
++#define AUX_RATE	384000000
++#define HFPLL_RATE	600000000
+ 
+ static unsigned int sec_mux_map[] = {
+ 	2,
+@@ -350,7 +352,7 @@ static int krait_cc_probe(struct platfor
+ {
+ 	struct device *dev = &pdev->dev;
+ 	const struct of_device_id *id;
+-	unsigned long cur_rate, aux_rate, qsb_rate;
++	unsigned long cur_rate, qsb_rate;
+ 	int cpu;
+ 	struct clk_hw *mux, *l2_pri_mux;
+ 	struct clk *clk, **clks;
+@@ -420,28 +422,29 @@ static int krait_cc_probe(struct platfor
+ 	 * two different rates to force a HFPLL reinit under all
+ 	 * circumstances.
+ 	 */
+-	cur_rate = clk_get_rate(clks[l2_mux]);
+-	aux_rate = 384000000;
+-	if (cur_rate < aux_rate) {
+-		dev_info(dev, "L2 @ Undefined rate. Forcing new rate.\n");
+-		cur_rate = aux_rate;
+-	}
+-	clk_set_rate(clks[l2_mux], aux_rate);
+-	clk_set_rate(clks[l2_mux], 2);
+-	clk_set_rate(clks[l2_mux], cur_rate);
+-	dev_info(dev, "L2 @ %lu KHz\n", clk_get_rate(clks[l2_mux]) / 1000);
+-	for_each_possible_cpu(cpu) {
++	for (cpu = 0; cpu < 5; cpu++) {
++		const char *l2_s = "L2";
++		char cpu_s[5];
++
+ 		clk = clks[cpu];
++		if (!clk)
++			continue;
++
++		if (cpu < 4)
++			snprintf(cpu_s, 5, "CPU%d", cpu);
++
+ 		cur_rate = clk_get_rate(clk);
+-		if (cur_rate < aux_rate) {
+-			dev_info(dev, "CPU%d @ Undefined rate. Forcing new rate.\n", cpu);
+-			cur_rate = aux_rate;
++		if (cur_rate < AUX_RATE) {
++			dev_info(dev, "%s @ Undefined rate. Forcing new rate.\n",
++				 cpu < 4 ? cpu_s : l2_s);
++			cur_rate = AUX_RATE;
+ 		}
+ 
+-		clk_set_rate(clk, aux_rate);
+-		clk_set_rate(clk, 2);
++		clk_set_rate(clk, AUX_RATE);
++		clk_set_rate(clk, HFPLL_RATE);
+ 		clk_set_rate(clk, cur_rate);
+-		dev_info(dev, "CPU%d @ %lu KHz\n", cpu, clk_get_rate(clk) / 1000);
++		dev_info(dev, "%s @ %lu KHz\n", cpu < 4 ? cpu_s : l2_s,
++			 clk_get_rate(clk) / 1000);
+ 	}
+ 
+ 	of_clk_add_provider(dev->of_node, krait_of_get, clks);
diff --git a/target/linux/ipq806x/patches-6.1/122-05-clk-qcom-clk-krait-generilize-div-functions.patch b/target/linux/ipq806x/patches-6.1/122-05-clk-qcom-clk-krait-generilize-div-functions.patch
new file mode 100644
index 00000000000000..a7c0f046c8421d
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/122-05-clk-qcom-clk-krait-generilize-div-functions.patch
@@ -0,0 +1,156 @@
+From 908c361b3c3a139eb3e6a798cb620a6da7514d5c Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Fri, 23 Sep 2022 19:05:39 +0200
+Subject: [PATCH 2/4] clk: qcom: clk-krait: generilize div functions
+
+Generilize div functions and remove hardcode to a divisor of 2.
+This is just a cleanup and permit to make it more clear the settings of
+the devisor when used by the krait-cc driver.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/clk/qcom/clk-krait.c | 57 ++++++++++++++++++++----------------
+ drivers/clk/qcom/clk-krait.h | 11 ++++---
+ drivers/clk/qcom/krait-cc.c  |  7 +++--
+ 3 files changed, 42 insertions(+), 33 deletions(-)
+
+--- a/drivers/clk/qcom/clk-krait.c
++++ b/drivers/clk/qcom/clk-krait.c
+@@ -97,53 +97,58 @@ const struct clk_ops krait_mux_clk_ops =
+ EXPORT_SYMBOL_GPL(krait_mux_clk_ops);
+ 
+ /* The divider can divide by 2, 4, 6 and 8. But we only really need div-2. */
+-static long krait_div2_round_rate(struct clk_hw *hw, unsigned long rate,
++static long krait_div_round_rate(struct clk_hw *hw, unsigned long rate,
+ 				  unsigned long *parent_rate)
+ {
+-	*parent_rate = clk_hw_round_rate(clk_hw_get_parent(hw), rate * 2);
+-	return DIV_ROUND_UP(*parent_rate, 2);
++	struct krait_div_clk *d = to_krait_div_clk(hw);
++
++	*parent_rate = clk_hw_round_rate(clk_hw_get_parent(hw),
++					 rate * d->divisor);
++
++	return DIV_ROUND_UP(*parent_rate, d->divisor);
+ }
+ 
+-static int krait_div2_set_rate(struct clk_hw *hw, unsigned long rate,
++static int krait_div_set_rate(struct clk_hw *hw, unsigned long rate,
+ 			       unsigned long parent_rate)
+ {
+-	struct krait_div2_clk *d = to_krait_div2_clk(hw);
++	struct krait_div_clk *d = to_krait_div_clk(hw);
++	u8 div_val = krait_div_to_val(d->divisor);
+ 	unsigned long flags;
+-	u32 val;
+-	u32 mask = BIT(d->width) - 1;
+-
+-	if (d->lpl)
+-		mask = mask << (d->shift + LPL_SHIFT) | mask << d->shift;
+-	else
+-		mask <<= d->shift;
++	u32 regval;
+ 
+ 	spin_lock_irqsave(&krait_clock_reg_lock, flags);
+-	val = krait_get_l2_indirect_reg(d->offset);
+-	val &= ~mask;
+-	krait_set_l2_indirect_reg(d->offset, val);
++	regval = krait_get_l2_indirect_reg(d->offset);
++
++	regval &= ~(d->mask << d->shift);
++	regval |= (div_val & d->mask) << d->shift;
++
++	if (d->lpl) {
++		regval &= ~(d->mask << (d->shift + LPL_SHIFT));
++		regval |= (div_val & d->mask) << (d->shift + LPL_SHIFT);
++	}
++
++	krait_set_l2_indirect_reg(d->offset, regval);
+ 	spin_unlock_irqrestore(&krait_clock_reg_lock, flags);
+ 
+ 	return 0;
+ }
+ 
+ static unsigned long
+-krait_div2_recalc_rate(struct clk_hw *hw, unsigned long parent_rate)
++krait_div_recalc_rate(struct clk_hw *hw, unsigned long parent_rate)
+ {
+-	struct krait_div2_clk *d = to_krait_div2_clk(hw);
+-	u32 mask = BIT(d->width) - 1;
++	struct krait_div_clk *d = to_krait_div_clk(hw);
+ 	u32 div;
+ 
+ 	div = krait_get_l2_indirect_reg(d->offset);
+ 	div >>= d->shift;
+-	div &= mask;
+-	div = (div + 1) * 2;
++	div &= d->mask;
+ 
+-	return DIV_ROUND_UP(parent_rate, div);
++	return DIV_ROUND_UP(parent_rate, krait_val_to_div(div));
+ }
+ 
+-const struct clk_ops krait_div2_clk_ops = {
+-	.round_rate = krait_div2_round_rate,
+-	.set_rate = krait_div2_set_rate,
+-	.recalc_rate = krait_div2_recalc_rate,
++const struct clk_ops krait_div_clk_ops = {
++	.round_rate = krait_div_round_rate,
++	.set_rate = krait_div_set_rate,
++	.recalc_rate = krait_div_recalc_rate,
+ };
+-EXPORT_SYMBOL_GPL(krait_div2_clk_ops);
++EXPORT_SYMBOL_GPL(krait_div_clk_ops);
+--- a/drivers/clk/qcom/clk-krait.h
++++ b/drivers/clk/qcom/clk-krait.h
+@@ -25,17 +25,20 @@ struct krait_mux_clk {
+ 
+ extern const struct clk_ops krait_mux_clk_ops;
+ 
+-struct krait_div2_clk {
++struct krait_div_clk {
+ 	u32		offset;
+-	u8		width;
++	u32		mask;
++	u8		divisor;
+ 	u32		shift;
+ 	bool		lpl;
+ 
+ 	struct clk_hw	hw;
+ };
+ 
+-#define to_krait_div2_clk(_hw) container_of(_hw, struct krait_div2_clk, hw)
++#define to_krait_div_clk(_hw) container_of(_hw, struct krait_div_clk, hw)
++#define krait_div_to_val(_div)		((_div) / 2) - 1
++#define krait_val_to_div(_val)		((_val) + 1) * 2
+ 
+-extern const struct clk_ops krait_div2_clk_ops;
++extern const struct clk_ops krait_div_clk_ops;
+ 
+ #endif
+--- a/drivers/clk/qcom/krait-cc.c
++++ b/drivers/clk/qcom/krait-cc.c
+@@ -86,11 +86,11 @@ static int krait_notifier_register(struc
+ static struct clk_hw *
+ krait_add_div(struct device *dev, int id, const char *s, unsigned int offset)
+ {
+-	struct krait_div2_clk *div;
++	struct krait_div_clk *div;
+ 	static struct clk_parent_data p_data[1];
+ 	struct clk_init_data init = {
+ 		.num_parents = ARRAY_SIZE(p_data),
+-		.ops = &krait_div2_clk_ops,
++		.ops = &krait_div_clk_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+ 	};
+ 	struct clk_hw *clk;
+@@ -101,7 +101,8 @@ krait_add_div(struct device *dev, int id
+ 	if (!div)
+ 		return ERR_PTR(-ENOMEM);
+ 
+-	div->width = 2;
++	div->mask = 0x3;
++	div->divisor = 2;
+ 	div->shift = 6;
+ 	div->lpl = id >= 0;
+ 	div->offset = offset;
diff --git a/target/linux/ipq806x/patches-6.1/123-clk-qcom-gcc-ipq806x-remove-cc_register_board-for.patch b/target/linux/ipq806x/patches-6.1/123-clk-qcom-gcc-ipq806x-remove-cc_register_board-for.patch
new file mode 100644
index 00000000000000..0df29a07877d35
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/123-clk-qcom-gcc-ipq806x-remove-cc_register_board-for.patch
@@ -0,0 +1,31 @@
+From ac84ac819a2e8fd3d87122b452c502a386c54437 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 5 Jul 2022 18:30:18 +0200
+Subject: [PATCH v2 4/4] clk: qcom: gcc-ipq806x: remove cc_register_board for
+ pxo and cxo
+
+Now that these clock are defined as fixed clk in dts, we can drop the
+register_board_clk for cxo_board and pxo_board in gcc_ipq806x_probe.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/clk/qcom/gcc-ipq806x.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+--- a/drivers/clk/qcom/gcc-ipq806x.c
++++ b/drivers/clk/qcom/gcc-ipq806x.c
+@@ -3386,14 +3386,6 @@ static int gcc_ipq806x_probe(struct plat
+ 	struct regmap *regmap;
+ 	int ret;
+ 
+-	ret = qcom_cc_register_board_clk(dev, "cxo_board", "cxo", 25000000);
+-	if (ret)
+-		return ret;
+-
+-	ret = qcom_cc_register_board_clk(dev, "pxo_board", "pxo", 25000000);
+-	if (ret)
+-		return ret;
+-
+ 	if (of_machine_is_compatible("qcom,ipq8065")) {
+ 		ubi32_core1_src_clk.freq_tbl = clk_tbl_nss_ipq8065;
+ 		ubi32_core2_src_clk.freq_tbl = clk_tbl_nss_ipq8065;
diff --git a/target/linux/ipq806x/patches-6.1/131-6.2-ARM-dts-qcom-ipq8064-disable-mmc-ddr-1_8v-for-sdcc1.patch b/target/linux/ipq806x/patches-6.1/131-6.2-ARM-dts-qcom-ipq8064-disable-mmc-ddr-1_8v-for-sdcc1.patch
new file mode 100644
index 00000000000000..e5424210858477
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/131-6.2-ARM-dts-qcom-ipq8064-disable-mmc-ddr-1_8v-for-sdcc1.patch
@@ -0,0 +1,28 @@
+From c9713e4ede1e5d044b64fe4d3cbb84223625637f Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 25 Oct 2022 01:38:17 +0200
+Subject: [PATCH] ARM: dts: qcom: ipq8064: disable mmc-ddr-1_8v for sdcc1
+
+It was reported non working mmc with this option enabled.
+Both mmc for ipq8064 are supplied by a fixed 3.3v regulator so mmc can't
+be run at 1.8v.
+Disable it to restore correct functionality of this SoC feature.
+
+Tested-by: Hendrik Koerner <koerhen@web.de>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221024233817.27410-1-ansuelsmth@gmail.com
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -932,7 +932,6 @@
+ 				non-removable;
+ 				cap-sd-highspeed;
+ 				cap-mmc-highspeed;
+-				mmc-ddr-1_8v;
+ 				vmmc-supply = <&vsdcc_fixed>;
+ 				dmas = <&sdcc1bam 2>, <&sdcc1bam 1>;
+ 				dma-names = "tx", "rx";
diff --git a/target/linux/ipq806x/patches-6.1/850-soc-add-qualcomm-syscon.patch b/target/linux/ipq806x/patches-6.1/850-soc-add-qualcomm-syscon.patch
new file mode 100644
index 00000000000000..397c4481ab1956
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/850-soc-add-qualcomm-syscon.patch
@@ -0,0 +1,121 @@
+From: Christian Lamparter <chunkeey@googlemail.com>
+Subject: SoC: add qualcomm syscon
+--- a/drivers/soc/qcom/Makefile
++++ b/drivers/soc/qcom/Makefile
+@@ -23,6 +23,7 @@ obj-$(CONFIG_QCOM_SOCINFO)	+= socinfo.o
+ obj-$(CONFIG_QCOM_SPM)		+= spm.o
+ obj-$(CONFIG_QCOM_STATS)	+= qcom_stats.o
+ obj-$(CONFIG_QCOM_WCNSS_CTRL) += wcnss_ctrl.o
++obj-$(CONFIG_QCOM_TCSR)	 += qcom_tcsr.o
+ obj-$(CONFIG_QCOM_APR) += apr.o
+ obj-$(CONFIG_QCOM_LLCC) += llcc-qcom.o
+ obj-$(CONFIG_QCOM_RPMHPD) += rpmhpd.o
+--- a/drivers/soc/qcom/Kconfig
++++ b/drivers/soc/qcom/Kconfig
+@@ -213,6 +213,13 @@ config QCOM_STATS
+ 	  various SoC level low power modes statistics and export to debugfs
+ 	  interface.
+ 
++config QCOM_TCSR
++	tristate "QCOM Top Control and Status Registers"
++	depends on ARCH_QCOM
++	help
++	  Say y here to enable TCSR support.  The TCSR provides control
++	  functions for various peripherals.
++
+ config QCOM_WCNSS_CTRL
+ 	tristate "Qualcomm WCNSS control driver"
+ 	depends on ARCH_QCOM || COMPILE_TEST
+--- /dev/null
++++ b/drivers/soc/qcom/qcom_tcsr.c
+@@ -0,0 +1,64 @@
++/*
++ * Copyright (c) 2014, The Linux foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License rev 2 and
++ * only rev 2 as published by the free Software foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or fITNESS fOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#include <linux/clk.h>
++#include <linux/err.h>
++#include <linux/io.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/of_platform.h>
++#include <linux/platform_device.h>
++
++#define TCSR_USB_PORT_SEL	0xb0
++
++static int tcsr_probe(struct platform_device *pdev)
++{
++	struct resource *res;
++	const struct device_node *node = pdev->dev.of_node;
++	void __iomem *base;
++	u32 val;
++
++	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	base = devm_ioremap_resource(&pdev->dev, res);
++	if (IS_ERR(base))
++		return PTR_ERR(base);
++
++	if (!of_property_read_u32(node, "qcom,usb-ctrl-select", &val)) {
++		dev_err(&pdev->dev, "setting usb port select = %d\n", val);
++		writel(val, base + TCSR_USB_PORT_SEL);
++	}
++
++	return 0;
++}
++
++static const struct of_device_id tcsr_dt_match[] = {
++	{ .compatible = "qcom,tcsr", },
++	{ },
++};
++
++MODULE_DEVICE_TABLE(of, tcsr_dt_match);
++
++static struct platform_driver tcsr_driver = {
++	.driver = {
++		.name		= "tcsr",
++		.owner		= THIS_MODULE,
++		.of_match_table	= tcsr_dt_match,
++	},
++	.probe = tcsr_probe,
++};
++
++module_platform_driver(tcsr_driver);
++
++MODULE_AUTHOR("Andy Gross <agross@codeaurora.org>");
++MODULE_DESCRIPTION("QCOM TCSR driver");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/include/dt-bindings/soc/qcom,tcsr.h
+@@ -0,0 +1,23 @@
++/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++#ifndef __DT_BINDINGS_QCOM_TCSR_H
++#define __DT_BINDINGS_QCOM_TCSR_H
++
++#define TCSR_USB_SELECT_USB3_P0		0x1
++#define TCSR_USB_SELECT_USB3_P1		0x2
++#define TCSR_USB_SELECT_USB3_DUAL	0x3
++
++/* TCSR A/B REG */
++#define IPQ806X_TCSR_REG_A_ADM_CRCI_MUX_SEL     0
++#define IPQ806X_TCSR_REG_B_ADM_CRCI_MUX_SEL     1
++
++#endif
diff --git a/target/linux/ipq806x/patches-6.1/900-arm-add-cmdline-override.patch b/target/linux/ipq806x/patches-6.1/900-arm-add-cmdline-override.patch
new file mode 100644
index 00000000000000..6361cfcbd918f2
--- /dev/null
+++ b/target/linux/ipq806x/patches-6.1/900-arm-add-cmdline-override.patch
@@ -0,0 +1,37 @@
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1599,6 +1599,14 @@ config ARM_ATAG_DTB_COMPAT_CMDLINE_MANGL
+ 
+ endchoice
+ 
++config CMDLINE_OVERRIDE
++	bool "Use alternative cmdline from device tree"
++	help
++	  Some bootloaders may have uneditable bootargs. While CMDLINE_FORCE can
++	  be used, this is not a good option for kernels that are shared across
++	  devices. This setting enables using "chosen/cmdline-override" as the
++	  cmdline if it exists in the device tree.
++
+ config CMDLINE
+ 	string "Default kernel command string"
+ 	default ""
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -1187,6 +1187,17 @@ int __init early_init_dt_scan_chosen(cha
+ 	if (p != NULL && l > 0)
+ 		strlcat(cmdline, p, min_t(int, strlen(cmdline) + (int)l, COMMAND_LINE_SIZE));
+ 
++    /* CONFIG_CMDLINE_OVERRIDE is used to fallback to a different
++     * device tree option of chosen/bootargs-override. This is
++     * helpful on boards where u-boot sets bootargs, and is unable
++     * to be modified.
++     */
++#ifdef CONFIG_CMDLINE_OVERRIDE
++	p = of_get_flat_dt_prop(node, "bootargs-override", &l);
++	if (p != NULL && l > 0)
++		strlcpy(cmdline, p, min((int)l, COMMAND_LINE_SIZE));
++#endif
++
+ handle_cmdline:
+ 	/*
+ 	 * CONFIG_CMDLINE is meant to be a default in case nothing else
diff --git a/target/linux/kirkwood/Makefile b/target/linux/kirkwood/Makefile
index c7a25451c9cde1..133208dd258e82 100644
--- a/target/linux/kirkwood/Makefile
+++ b/target/linux/kirkwood/Makefile
@@ -9,9 +9,9 @@ BOARD:=kirkwood
 BOARDNAME:=Marvell Kirkwood
 FEATURES:=usb nand squashfs ramdisk
 CPU_TYPE:=xscale
+SUBTARGETS:=generic
 
-KERNEL_PATCHVER:=5.10
-KERNEL_TESTING_PATCHVER:=5.15
+KERNEL_PATCHVER:=5.15
 
 include $(INCLUDE_DIR)/target.mk
 
diff --git a/target/linux/kirkwood/base-files/etc/board.d/02_network b/target/linux/kirkwood/base-files/etc/board.d/02_network
index df38694f40ca00..15f75df6a8108a 100644
--- a/target/linux/kirkwood/base-files/etc/board.d/02_network
+++ b/target/linux/kirkwood/base-files/etc/board.d/02_network
@@ -37,6 +37,9 @@ kirkwood_setup_interfaces()
 	endian,4i-edge-200)
 		ucidef_set_interface_lan "port1 port2 port3 port4 eth1"
 		;;
+	iom,ix4-200d)
+		ucidef_set_interface_lan "eth0 eth1" "dhcp"
+		;;
 	linksys,e4200-v2|\
 	linksys,ea3500|\
 	linksys,ea4500)
diff --git a/target/linux/kirkwood/base-files/lib/upgrade/linksys.sh b/target/linux/kirkwood/base-files/lib/upgrade/linksys.sh
index 7e20276fe5f6f3..207a65d713249c 100644
--- a/target/linux/kirkwood/base-files/lib/upgrade/linksys.sh
+++ b/target/linux/kirkwood/base-files/lib/upgrade/linksys.sh
@@ -8,7 +8,7 @@ linksys_get_target_firmware() {
 
 	cur_boot_part=$(/usr/sbin/fw_printenv -n boot_part)
 	if [ -z "${cur_boot_part}" ] ; then
-		mtd_ubi0=$(cat /sys/devices/virtual/ubi/ubi0/mtd_num)
+		mtd_ubi0=$(cat /sys/class/ubi/ubi0/mtd_num)
 		case $(grep -E ^mtd${mtd_ubi0}: /proc/mtd | cut -d '"' -f 2) in
 		kernel|rootfs)
 			cur_boot_part=1
@@ -68,7 +68,12 @@ platform_do_upgrade_linksys() {
 			CI_UBIPART="rootfs2"
 		fi
 
-		nand_upgrade_tar "$1"
+		if nand_upgrade_tar "$1" ; then
+			nand_do_upgrade_success
+		else
+			nand_do_upgrade_failed
+		fi
+
 	}
 	[ "$magic_long" = "27051956" ] && {
 		get_image "$1" | mtd write - $part_label
diff --git a/target/linux/kirkwood/config-5.15 b/target/linux/kirkwood/config-5.15
index 409010b957c5e0..ce19fce6ee662a 100644
--- a/target/linux/kirkwood/config-5.15
+++ b/target/linux/kirkwood/config-5.15
@@ -21,6 +21,7 @@ CONFIG_ARM=y
 CONFIG_ARM_APPENDED_DTB=y
 CONFIG_ARM_ATAG_DTB_COMPAT=y
 CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_FROM_BOOTLOADER=y
+CONFIG_ARM_CRYPTO=y
 CONFIG_ARM_HAS_SG_CHAIN=y
 # CONFIG_ARM_KIRKWOOD_CPUIDLE is not set
 CONFIG_ARM_L1_CACHE_SHIFT=5
@@ -60,7 +61,6 @@ CONFIG_CPU_USE_DOMAINS=y
 CONFIG_CRC16=y
 # CONFIG_CRC32_SARWATE is not set
 CONFIG_CRC32_SLICEBY8=y
-CONFIG_CRYPTO_BLAKE2S=y
 CONFIG_CRYPTO_CRC32C=y
 CONFIG_CRYPTO_DEFLATE=y
 CONFIG_CRYPTO_DES=y
@@ -238,8 +238,6 @@ CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_MV=y
 CONFIG_RTC_I2C_AND_SPI=y
 CONFIG_RTC_MC146818_LIB=y
-CONFIG_SATA_HOST=y
-CONFIG_SATA_PMP=y
 CONFIG_SCSI=y
 CONFIG_SCSI_COMMON=y
 CONFIG_SERIAL_8250_DEPRECATED_OPTIONS=y
diff --git a/target/linux/kirkwood/files/arch/arm/boot/dts/kirkwood-ea3500.dts b/target/linux/kirkwood/files/arch/arm/boot/dts/kirkwood-ea3500.dts
index f8f940dfc613ea..d0f2e35343ad0d 100644
--- a/target/linux/kirkwood/files/arch/arm/boot/dts/kirkwood-ea3500.dts
+++ b/target/linux/kirkwood/files/arch/arm/boot/dts/kirkwood-ea3500.dts
@@ -125,7 +125,6 @@
 
 			port@5 {
 				reg = <5>;
-				label = "cpu";
 				ethernet = <&eth0port>;
 				fixed-link {
 					speed = <1000>;
diff --git a/target/linux/kirkwood/files/arch/arm/boot/dts/kirkwood-ix4-200d.dts b/target/linux/kirkwood/files/arch/arm/boot/dts/kirkwood-ix4-200d.dts
new file mode 100644
index 00000000000000..c63742a1a8814e
--- /dev/null
+++ b/target/linux/kirkwood/files/arch/arm/boot/dts/kirkwood-ix4-200d.dts
@@ -0,0 +1,202 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/dts-v1/;
+
+#include "kirkwood.dtsi"
+#include "kirkwood-6281.dtsi"
+#include <dt-bindings/leds/common.h>
+
+/ {
+	model = "Iomega ix4-200d";
+	compatible = "iom,ix4-200d", "marvell,kirkwood-88f6281", "marvell,kirkwood";
+
+	aliases {
+		led-boot = &led_status_white;
+		led-failsafe = &led_status_red;
+		led-running = &led_power_white;
+		led-upgrade = &led_status_red;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200n8 earlyprintk";
+		stdout-path = &uart0;
+	};
+
+	memory {
+		device_type = "memory";
+		reg = <0x00000000 0x20000000>;
+	};
+
+	ocp@f1000000 {
+		i2c@11000 {
+			status = "okay";
+
+			adt7473@2e {
+				compatible = "adi,adt7473";
+				reg = <0x2e>;
+			};
+		};
+
+		pinctrl: pin-controller@10000 {
+			pmx_spi: pmx-spi {
+				marvell,pins = "mpp12", "mpp13", "mpp14";
+				marvell,function = "gpio";
+			};
+
+			pmx_keys: pmx-keys {
+				marvell,pins = "mpp16", "mpp29", "mpp47", "mpp49";
+				marvell,function = "gpio";
+			};
+		};
+
+		sata@80000 {
+			status = "okay";
+			nr-ports = <2>;
+		};
+
+		serial@12000 {
+			status = "okay";
+		};
+
+		spi3 {
+			compatible = "spi-gpio";
+			#address-cells = <0x1>;
+			ranges;
+			status = "okay";
+			sck-gpios = <&gpio0 13 GPIO_ACTIVE_LOW>;
+			mosi-gpios = <&gpio0 12 GPIO_ACTIVE_LOW>;
+			cs-gpios = <&gpio0 14 GPIO_ACTIVE_LOW>;
+			num-chipselects = <1>;
+			#size-cells = <0>;
+
+			gpio_spi: gpio_spi@0 {
+				compatible = "fairchild,74hc595";
+				reg = <0>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				registers-number = <1>;
+				spi-max-frequency = <100000>;
+			};
+		};
+
+		gpio-keys {
+			compatible = "gpio-keys";
+			pinctrl-0 = <&pmx_keys>;
+			pinctrl-names = "default";
+
+			button-0 {
+				label = "Next Button";
+				linux,code = <BTN_0>;
+				gpios = <&gpio0 16 GPIO_ACTIVE_HIGH>;
+			};
+
+			button-1 {
+				label = "Reset Button";
+				linux,code = <KEY_RESTART>;
+				gpios = <&gpio0 29 GPIO_ACTIVE_HIGH>;
+			};
+
+			button-2 {
+				label = "Cancel Button";
+				linux,code = <BTN_1>;
+				gpios = <&gpio1 15 GPIO_ACTIVE_LOW>;
+			};
+
+			button-3 {
+				label = "Power Button";
+				linux,code = <KEY_POWER2>;
+				gpios = <&gpio1 17 GPIO_ACTIVE_LOW>;
+			};
+		};
+
+		gpio-leds {
+			compatible = "gpio-leds";
+
+			led_status_white: led-0 {
+				label = "status:white";
+				function = LED_FUNCTION_STATUS;
+				color = <LED_COLOR_ID_WHITE>;
+				gpios = <&gpio_spi 4 GPIO_ACTIVE_LOW>;
+			};
+
+			led_status_red: led-1 {
+				label = "status:red";
+				function = LED_FUNCTION_STATUS;
+				color = <LED_COLOR_ID_RED>;
+				gpios = <&gpio_spi 5 GPIO_ACTIVE_LOW>;
+			};
+
+			led_power_white: led-2 {
+				label = "power:white";
+				function = LED_FUNCTION_POWER;
+				color = <LED_COLOR_ID_WHITE>;
+				gpios = <&gpio_spi 7 GPIO_ACTIVE_HIGH>;
+			};
+		};
+	};
+};
+
+&eth0 {
+	status = "okay";
+	ethernet0-port@0 {
+		phy-handle = <&ethphy0>;
+	};
+};
+
+&eth1 {
+	status = "okay";
+	ethernet1-port@0 {
+		phy-handle = <&ethphy1>;
+	};
+};
+
+&mdio {
+	status = "okay";
+
+	ethphy0: ethernet-phy@8 {
+		reg = <8>;
+	};
+
+	ethphy1: ethernet-phy@9 {
+		reg = <9>;
+	};
+};
+
+&nand {
+	status = "okay";
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "u-boot";
+			reg = <0x0000000 0x100000>;
+			read-only;
+		};
+
+		partition@a0000 {
+			label = "u-boot environment";
+			reg = <0xa0000 0x20000>;
+			read-only;
+		};
+
+		partition@100000 {
+			label = "kernel";
+			reg = <0x100000 0x300000>;
+		};
+
+		partition@400000 {
+			label = "ubi";
+			reg = <0x400000 0x1C00000>;
+		};
+	};
+};
+
+&pciec {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+};
diff --git a/target/linux/kirkwood/generic/target.mk b/target/linux/kirkwood/generic/target.mk
new file mode 100644
index 00000000000000..f5cb1fb19b943f
--- /dev/null
+++ b/target/linux/kirkwood/generic/target.mk
@@ -0,0 +1 @@
+BOARDNAME:=Generic
diff --git a/target/linux/kirkwood/image/Makefile b/target/linux/kirkwood/image/Makefile
index 60e8654ad3f818..0fa14b89f32cf1 100644
--- a/target/linux/kirkwood/image/Makefile
+++ b/target/linux/kirkwood/image/Makefile
@@ -93,7 +93,7 @@ define Device/checkpoint_l-50
   DEVICE_VENDOR := Check Point
   DEVICE_MODEL := L-50
   DEVICE_PACKAGES := kmod-ath9k kmod-gpio-button-hotplug kmod-mvsdio \
-	kmod-rtc-s35390a kmod-usb-ledtrig-usbport wpad-basic-wolfssl
+	kmod-rtc-s35390a kmod-usb-ledtrig-usbport wpad-basic-mbedtls
   IMAGES := sysupgrade.bin
 endef
 TARGET_DEVICES += checkpoint_l-50
@@ -145,7 +145,7 @@ define Device/endian_4i-edge-200
   DEVICE_MODEL := 4i Edge 200
   DEVICE_ALT0_VENDOR := Endian
   DEVICE_ALT0_MODEL := UTM Mini Firewall
-  DEVICE_PACKAGES := kmod-ath9k kmod-mvsdio wpad-basic-wolfssl
+  DEVICE_PACKAGES := kmod-ath9k kmod-mvsdio wpad-basic-mbedtls
   KERNEL_SIZE := 4096k
   IMAGES := sysupgrade.bin
 endef
@@ -184,6 +184,24 @@ define Device/iom_ix2-200
 endef
 TARGET_DEVICES += iom_ix2-200
 
+define Device/iom_ix4-200d
+  DEVICE_VENDOR := Iomega
+  DEVICE_MODEL := StorCenter ix4-200d
+  DEVICE_PACKAGES := kmod-ata-marvell-sata kmod-fs-ext4 \
+	kmod-gpio-button-hotplug kmod-gpio-nxp-74hc164 \
+	kmod-hwmon-adt7475 kmod-mvsdio kmod-spi-gpio
+  PAGESIZE := 512
+  SUBPAGESIZE := 256
+  BLOCKSIZE := 16k
+  KERNEL_SIZE := 3072k
+  KERNEL_IN_UBI :=
+  UBINIZE_OPTS := -E 5
+  IMAGE_SIZE := 31744k
+  IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-ubi | \
+	check-size
+endef
+TARGET_DEVICES += iom_ix4-200d
+
 define Device/iptime_nas1
   DEVICE_VENDOR := ipTIME
   DEVICE_MODEL := NAS1
@@ -201,7 +219,7 @@ TARGET_DEVICES += iptime_nas1
 
 define Device/linksys
   DEVICE_VENDOR := Linksys
-  DEVICE_PACKAGES := kmod-mwl8k wpad-basic-wolfssl kmod-gpio-button-hotplug
+  DEVICE_PACKAGES := kmod-mwl8k wpad-basic-mbedtls kmod-gpio-button-hotplug
   KERNEL_IN_UBI :=
   UBINIZE_OPTS := -E 5
   IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-ubi
diff --git a/target/linux/kirkwood/modules.mk b/target/linux/kirkwood/modules.mk
new file mode 100644
index 00000000000000..1543098cd4bd37
--- /dev/null
+++ b/target/linux/kirkwood/modules.mk
@@ -0,0 +1,30 @@
+define KernelPackage/ata-marvell-sata
+  TITLE:=Marvell Serial ATA support
+  DEPENDS:=@TARGET_kirkwood
+  KCONFIG:=CONFIG_SATA_MV CONFIG_SATA_PMP=y
+  FILES:=$(LINUX_DIR)/drivers/ata/sata_mv.ko
+  AUTOLOAD:=$(call AutoLoad,41,sata_mv,1)
+  $(call AddDepends/ata)
+endef
+
+define KernelPackage/ata-marvell-sata/description
+ SATA support for marvell chipsets
+endef
+
+$(eval $(call KernelPackage,ata-marvell-sata))
+
+define KernelPackage/mvsdio
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Marvell MMC/SD/SDIO host driver
+  DEPENDS:=+kmod-mmc @TARGET_kirkwood
+  KCONFIG:= CONFIG_MMC_MVSDIO
+  FILES:= \
+	$(LINUX_DIR)/drivers/mmc/host/mvsdio.ko
+  AUTOLOAD:=$(call AutoProbe,mvsdio,1)
+endef
+
+define KernelPackage/mvsdio/description
+ Kernel support for the Marvell SDIO host driver.
+endef
+
+$(eval $(call KernelPackage,mvsdio))
diff --git a/target/linux/kirkwood/patches-5.15/001-5.18-Add-Ctera-C-200-V1-board.patch b/target/linux/kirkwood/patches-5.15/001-5.18-Add-Ctera-C-200-V1-board.patch
new file mode 100644
index 00000000000000..453915e8cf3fa6
--- /dev/null
+++ b/target/linux/kirkwood/patches-5.15/001-5.18-Add-Ctera-C-200-V1-board.patch
@@ -0,0 +1,350 @@
+From 5fc74dbdf8f640a7ca7fb92345ac6fbeaa078d65 Mon Sep 17 00:00:00 2001
+From: Pawel Dembicki <paweldembicki@gmail.com>
+Date: Tue, 15 Feb 2022 17:39:22 +0100
+Subject: [PATCH] ARM: dts: kirkwood: Add Ctera C-200 V1 board
+
+Ctera C200 V1 is kirkwood-based 2-Bay NAS.
+
+Hardware:
+  - SoC: Marvell 88F6281-A1 ARMv5TE Processor 1.2GHz
+  - Ram: 512MB (4x Nanya NT5TU128M8GE-AC)
+  - NAND Flash: 256MB (Samsung 216 K9F2G08U0C)
+  - Lan: 1x GBE (Marvell 88E1116R-NNC1)
+  - Storage: 2x SATA HDD 3.5" Slot
+  - USB: 2x USB 2.0 port
+  - Console: Internal J3 connector (1: Vcc, 2: Rx, 3: Tx, 4: GND)
+  - LEDs: 13x GPIO controlled
+  - Buttons: 2x GPIO controlled
+
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+---
+ arch/arm/boot/dts/Makefile             |   1 +
+ arch/arm/boot/dts/kirkwood-c200-v1.dts | 310 +++++++++++++++++++++++++
+ 2 files changed, 311 insertions(+)
+ create mode 100644 arch/arm/boot/dts/kirkwood-c200-v1.dts
+
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -267,6 +267,7 @@ dtb-$(CONFIG_ARCH_KEYSTONE) += \
+ dtb-$(CONFIG_MACH_KIRKWOOD) += \
+ 	kirkwood-b3.dtb \
+ 	kirkwood-blackarmor-nas220.dtb \
++	kirkwood-c200-v1.dtb \
+ 	kirkwood-cloudbox.dtb \
+ 	kirkwood-d2net.dtb \
+ 	kirkwood-db-88f6281.dtb \
+--- /dev/null
++++ b/arch/arm/boot/dts/kirkwood-c200-v1.dts
+@@ -0,0 +1,310 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * Ctera C200 V1 Board Description
++ * Copyright 2021-2022 Pawel Dembicki <paweldembicki@gmail.com>
++ */
++
++/dts-v1/;
++
++#include "kirkwood.dtsi"
++#include "kirkwood-6281.dtsi"
++#include <dt-bindings/leds/common.h>
++
++/ {
++	model = "Ctera C200 V1";
++	compatible = "ctera,c200-v1", "marvell,kirkwood-88f6281", "marvell,kirkwood";
++
++	chosen {
++		bootargs = "console=ttyS0,115200";
++		stdout-path = &uart0;
++	};
++
++	memory@0 {
++		device_type = "memory";
++		reg = <0x00000000 0x20000000>;
++	};
++
++	keys {
++		compatible = "gpio-keys";
++		pinctrl-0 = <&pmx_buttons>;
++		pinctrl-names = "default";
++
++		power {
++			label = "Power Button";
++			linux,code = <KEY_POWER>;
++			gpios = <&gpio1 16 GPIO_ACTIVE_HIGH>;
++		};
++
++		reset {
++			label = "Reset Button";
++			linux,code = <KEY_RESTART>;
++			gpios = <&gpio1 17 GPIO_ACTIVE_LOW>;
++		};
++
++		usb1 {
++			label = "USB1 Button";
++			linux,code = <BTN_0>;
++			gpios = <&gpio0 28 GPIO_ACTIVE_LOW>;
++		};
++
++		usb2 {
++			label = "USB2 Button";
++			linux,code = <BTN_1>;
++			gpios = <&gpio0 29 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	gpio-poweroff {
++		compatible = "gpio-poweroff";
++		pinctrl-0 = <&pmx_poweroff>;
++		pinctrl-names = "default";
++		gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
++	};
++
++	leds {
++		compatible = "gpio-leds";
++		pinctrl-0 = <&pmx_leds>;
++		pinctrl-names = "default";
++
++		led-0 {
++			function = LED_FUNCTION_DISK;
++			function-enumerator = <2>;
++			color = <LED_COLOR_ID_RED>;
++			gpios = <&gpio0 14 GPIO_ACTIVE_LOW>;
++		};
++
++		led-1 {
++			function = LED_FUNCTION_DISK;
++			function-enumerator = <1>;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&gpio0 15 GPIO_ACTIVE_LOW>;
++		};
++
++		led-2 {
++			function = LED_FUNCTION_DISK;
++			function-enumerator = <2>;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&gpio0 16 GPIO_ACTIVE_LOW>;
++		};
++
++		led-3 {
++			function = LED_FUNCTION_DISK;
++			function-enumerator = <1>;
++			color = <LED_COLOR_ID_RED>;
++			gpios = <&gpio0 17 GPIO_ACTIVE_LOW>;
++		};
++
++		led-4 {
++			function = LED_FUNCTION_STATUS;
++			color = <LED_COLOR_ID_RED>;
++			gpios = <&gpio1 6 GPIO_ACTIVE_LOW>;
++		};
++
++		led-5 {
++			function = LED_FUNCTION_STATUS;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&gpio1 7 GPIO_ACTIVE_LOW>;
++		};
++
++		led-6 {
++			function = LED_FUNCTION_INDICATOR;
++			color = <LED_COLOR_ID_BLUE>;
++			gpios = <&gpio1 8 GPIO_ACTIVE_LOW>;
++		};
++
++		led-7 {
++			function = LED_FUNCTION_DISK_ERR;
++			color = <LED_COLOR_ID_RED>;
++			gpios = <&gpio1 10 GPIO_ACTIVE_LOW>;
++		};
++
++		led-8 {
++			function = LED_FUNCTION_DISK_ERR;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&gpio1 11 GPIO_ACTIVE_LOW>;
++		};
++
++		led-9 {
++			function = LED_FUNCTION_USB;
++			function-enumerator = <1>;
++			color = <LED_COLOR_ID_RED>;
++			gpios = <&gpio1 12 GPIO_ACTIVE_LOW>;
++		};
++
++		led-10 {
++			function = LED_FUNCTION_USB;
++			function-enumerator = <1>;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&gpio1 13 GPIO_ACTIVE_LOW>;
++			linux,default-trigger = "usbport";
++			trigger-sources = <&hub_port2>;
++		};
++
++		led-11 {
++			function = LED_FUNCTION_USB;
++			function-enumerator = <2>;
++			color = <LED_COLOR_ID_RED>;
++			gpios = <&gpio1 14 GPIO_ACTIVE_LOW>;
++		};
++
++		led-12 {
++			function = LED_FUNCTION_USB;
++			function-enumerator = <2>;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&gpio1 15 GPIO_ACTIVE_LOW>;
++			linux,default-trigger = "usbport";
++			trigger-sources = <&hub_port1>;
++		};
++	};
++};
++
++&eth0 {
++	status = "okay";
++};
++
++&eth0port {
++	phy-handle = <&ethphy9>;
++};
++
++&i2c0 {
++	status = "okay";
++
++	rtc@30 {
++		compatible = "s35390a";
++		reg = <0x30>;
++	};
++
++	lm63@4c {
++		compatible = "national,lm63";
++		reg = <0x4c>;
++	};
++};
++
++&mdio {
++	status = "okay";
++
++	ethphy9: ethernet-phy@9 {
++		reg = <9>;
++	};
++};
++
++&nand {
++	status = "okay";
++	chip-delay = <40>;
++
++	partition@0 {
++		label = "uboot";
++		reg = <0x0000000 0x200000>;
++	};
++
++	partition@200000 {
++		label = "certificate";
++		reg = <0x0200000 0x100000>;
++	};
++
++	partition@300000 {
++		label = "preset_cfg";
++		reg = <0x0300000 0x100000>;
++	};
++
++	partition@400000 {
++		label = "dev_params";
++		reg = <0x0400000 0x100000>;
++	};
++
++	partition@500000 {
++		label = "active_bank";
++		reg = <0x0500000 0x0100000>;
++	};
++
++	partition@600000 {
++		label = "magic";
++		reg = <0x0600000 0x0100000>;
++	};
++
++	partition@700000 {
++		label = "bank1";
++		reg = <0x0700000 0x2800000>;
++	};
++
++	partition@2f00000 {
++		label = "bank2";
++		reg = <0x2f00000 0x2800000>;
++	};
++
++	/* 0x5700000-0x5a00000 undefined in vendor firmware */
++
++	partition@5a00000 {
++		label = "reserved";
++		reg = <0x5a00000 0x2000000>;
++	};
++
++	partition@7a00000 {
++		label = "rootfs";
++		reg = <0x7a00000 0x8600000>;
++	};
++};
++
++&pinctrl {
++	/* Buzzer gpios are connected to two pins of buzzer.
++	 * This buzzer require a modulated signal from gpio.
++	 * Leave it as is due lack of proper driver.
++	 */
++	pmx_buzzer: pmx-buzzer {
++		marvell,pins = "mpp12", "mpp13";
++		marvell,function = "gpio";
++	};
++
++	pmx_leds: pmx-leds {
++		marvell,pins = "mpp14", "mpp15", "mpp16", "mpp17", "mpp38",
++			       "mpp39", "mpp40", "mpp42", "mpp43", "mpp44",
++			       "mpp45", "mpp46", "mpp47";
++		marvell,function = "gpio";
++	};
++
++	pmx_buttons: pmx-buttons {
++		marvell,pins = "mpp28", "mpp29", "mpp48", "mpp49";
++		marvell,function = "gpio";
++	};
++
++	pmx_poweroff: pmx-poweroff {
++		marvell,pins = "mpp34";
++		marvell,function = "gpio";
++	};
++};
++
++&rtc {
++	status = "disabled";
++};
++
++&sata {
++	status = "okay";
++	nr-ports = <2>;
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&usb0 {
++	#address-cells = <1>;
++	#size-cells = <0>;
++	status = "okay";
++
++	port@1 {
++		#address-cells = <1>;
++		#size-cells = <0>;
++		reg = <1>;
++		#trigger-source-cells = <0>;
++
++		hub_port1: port@1 {
++			reg = <1>;
++			#trigger-source-cells = <0>;
++		};
++
++		hub_port2: port@2 {
++			reg = <2>;
++			#trigger-source-cells = <0>;
++		};
++	};
++};
diff --git a/target/linux/kirkwood/patches-5.15/002-6.2-ARM-dts-kirkwood-Add-Zyxel-NSA310S-board.patch b/target/linux/kirkwood/patches-5.15/002-6.2-ARM-dts-kirkwood-Add-Zyxel-NSA310S-board.patch
new file mode 100644
index 00000000000000..b745ea104fd5e5
--- /dev/null
+++ b/target/linux/kirkwood/patches-5.15/002-6.2-ARM-dts-kirkwood-Add-Zyxel-NSA310S-board.patch
@@ -0,0 +1,301 @@
+From e977a103840c57d72b52cbc8c17f87f86ef9aa8d Mon Sep 17 00:00:00 2001
+From: Pawel Dembicki <paweldembicki@gmail.com>
+Date: Sat, 29 Oct 2022 22:57:38 +0200
+Subject: [PATCH] ARM: dts: kirkwood: Add Zyxel NSA310S board
+
+Zyxel NSA310S is a NAS based on Marvell kirkwood SoC.
+
+Specification:
+ - Processor Marvell 88F6702 1 GHz
+ - 256MB RAM
+ - 128MB NAND
+ - 1x GBE LAN port (PHY: Marvell 88E1318)
+ - 2x USB 2.0
+ - 1x SATA
+ - 3x button
+ - 7x leds
+ - serial on J1 connector (115200 8N1) (GND-NOPIN-RX-TX-VCC)
+
+Tested-by: Tony Dinh <mibodhi@gmail.com>
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+Acked-by: Adam Baker <linux@baker-net.org.uk>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+---
+ arch/arm/boot/dts/Makefile             |   1 +
+ arch/arm/boot/dts/kirkwood-nsa310s.dts | 259 +++++++++++++++++++++++++
+ 2 files changed, 260 insertions(+)
+ create mode 100644 arch/arm/boot/dts/kirkwood-nsa310s.dts
+
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -320,6 +320,7 @@ dtb-$(CONFIG_MACH_KIRKWOOD) += \
+ 	kirkwood-ns2mini.dtb \
+ 	kirkwood-nsa310.dtb \
+ 	kirkwood-nsa310a.dtb \
++	kirkwood-nsa310s.dtb \
+ 	kirkwood-nsa320.dtb \
+ 	kirkwood-nsa325.dtb \
+ 	kirkwood-openblocks_a6.dtb \
+--- /dev/null
++++ b/arch/arm/boot/dts/kirkwood-nsa310s.dts
+@@ -0,0 +1,259 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * ZyXEL NSA310S Board Description
++ * Copyright 2020-2022 Pawel Dembicki <paweldembicki@gmail.com>
++ * Copyright (c) 2015-2021, Tony Dinh <mibodhi@gmail.com>
++ * Copyright (c) 2014, Adam Baker <linux@baker-net.org.uk>
++ * Based upon the board setup file created by Peter Schildmann
++ */
++/dts-v1/;
++
++#include "kirkwood.dtsi"
++#include "kirkwood-6281.dtsi"
++#include <dt-bindings/leds/common.h>
++
++/ {
++	model = "ZyXEL NSA310S";
++	compatible = "zyxel,nsa310s", "marvell,kirkwood-88f6702", "marvell,kirkwood";
++
++	memory {
++		device_type = "memory";
++		reg = <0x00000000 0x10000000>;
++	};
++
++	chosen {
++		bootargs = "console=ttyS0,115200n8 earlyprintk";
++		stdout-path = &uart0;
++	};
++
++	gpio_poweroff {
++		compatible = "gpio-poweroff";
++		pinctrl-0 = <&pmx_pwr_off>;
++		pinctrl-names = "default";
++		gpios = <&gpio0 27 GPIO_ACTIVE_HIGH>;
++	};
++
++	keys {
++		compatible = "gpio-keys";
++		#address-cells = <1>;
++		#size-cells = <0>;
++		pinctrl-0 = <&pmx_buttons>;
++		pinctrl-names = "default";
++
++		power {
++			label = "Power Button";
++			linux,code = <KEY_POWER>;
++			gpios = <&gpio0 26 GPIO_ACTIVE_HIGH>;
++		};
++
++		copy {
++			label = "Copy Button";
++			linux,code = <KEY_COPY>;
++			gpios = <&gpio0 25 GPIO_ACTIVE_LOW>;
++		};
++
++		reset {
++			label = "Reset Button";
++			linux,code = <KEY_RESTART>;
++			gpios = <&gpio0 24 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	leds {
++		compatible = "gpio-leds";
++		pinctrl-0 = <&pmx_leds>;
++		pinctrl-names = "default";
++
++		led-1 {
++			function = LED_FUNCTION_DISK_ERR;
++			color = <LED_COLOR_ID_RED>;
++			gpios = <&gpio0 13 GPIO_ACTIVE_HIGH>;
++		};
++
++		led-2 {
++			function = LED_FUNCTION_USB;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&gpio0 15 GPIO_ACTIVE_HIGH>;
++			linux,default-trigger = "usb-host";
++		};
++
++		led-3 {
++			function = LED_FUNCTION_DISK;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&gpio0 16 GPIO_ACTIVE_HIGH>;
++			linux,default-trigger = "ata1";
++		};
++
++		led-4 {
++			function = LED_FUNCTION_INDICATOR;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&gpio0 22 GPIO_ACTIVE_HIGH>;
++		};
++
++		led-5 {
++			function = LED_FUNCTION_INDICATOR;
++			color = <LED_COLOR_ID_RED>;
++			gpios = <&gpio0 23 GPIO_ACTIVE_HIGH>;
++		};
++
++		led-6 {
++			function = LED_FUNCTION_STATUS;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&gpio0 28 GPIO_ACTIVE_HIGH>;
++			linux,default-trigger = "default-on";
++		};
++
++		led-7 {
++			function = LED_FUNCTION_STATUS;
++			color = <LED_COLOR_ID_RED>;
++			gpios = <&gpio0 29 GPIO_ACTIVE_HIGH>;
++		};
++	};
++
++	usb0_power: regulator@1 {
++		compatible = "regulator-fixed";
++		regulator-name = "USB Power";
++
++		regulator-min-microvolt = <5000000>;
++		regulator-max-microvolt = <5000000>;
++		regulator-always-on;
++		regulator-boot-on;
++		gpio = <&gpio0 21 GPIO_ACTIVE_HIGH>;
++	};
++
++	sata1_power: regulator@2 {
++		compatible = "regulator-fixed";
++		regulator-name = "SATA1 Power";
++
++		regulator-min-microvolt = <5000000>;
++		regulator-max-microvolt = <5000000>;
++		regulator-always-on;
++		regulator-boot-on;
++		gpio = <&gpio1 1 GPIO_ACTIVE_HIGH>;
++	};
++
++	thermal-zones {
++		disk-thermal {
++			polling-delay = <20000>;
++			polling-delay-passive = <2000>;
++
++			thermal-sensors = <&hdd_temp>;
++
++			trips {
++				disk_alert: disk-alert {
++					temperature = <40000>;
++					hysteresis = <5000>;
++					type = "active";
++				};
++				disk_crit: disk-crit {
++					temperature = <60000>;
++					hysteresis = <2000>;
++					type = "critical";
++				};
++			};
++		};
++	};
++};
++
++
++&eth0 {
++	status = "okay";
++
++	ethernet0-port@0 {
++		phy-handle = <&ethphy0>;
++	};
++};
++
++&i2c0 {
++	status = "okay";
++
++	rtc@68 {
++		compatible = "htk,ht1382";
++		reg = <0x68>;
++	};
++};
++
++&mdio {
++	status = "okay";
++
++	ethphy0: ethernet-phy@1 {
++		reg = <1>;
++		phy-mode = "rgmii-id";
++		marvell,reg-init = <0x1 0x16 0x0 0x3>,
++				   <0x1 0x10 0x0 0x1017>,
++				   <0x1 0x11 0x0 0x4408>,
++				   <0x1 0x16 0x0 0x0>;
++	};
++};
++
++&nand {
++	status = "okay";
++	chip-delay = <35>;
++
++	partition@0 {
++		label = "uboot";
++		reg = <0x0000000 0x00c0000>;
++		read-only;
++	};
++	partition@c0000 {
++		label = "uboot_env";
++		reg = <0x00c0000 0x0080000>;
++	};
++	partition@140000 {
++		label = "ubi";
++		reg = <0x0140000 0x7ec0000>;
++	};
++};
++
++&pciec {
++	status = "okay";
++};
++
++&pcie0 {
++	status = "okay";
++};
++
++&pinctrl {
++	pinctrl-names = "default";
++
++	pmx_buttons: pmx-buttons {
++		marvell,pins = "mpp24", "mpp25", "mpp26";
++		marvell,function = "gpio";
++	};
++
++	pmx_leds: pmx-leds {
++		marvell,pins = "mpp13", "mpp15", "mpp16", "mpp22", "mpp23",
++						"mpp28", "mpp29";
++		marvell,function = "gpio";
++	};
++
++	pmx_power: pmx-power {
++		marvell,pins = "mpp21", "mpp33";
++		marvell,function = "gpio";
++	};
++
++	pmx_pwr_off: pmx-pwr-off {
++		marvell,pins = "mpp27";
++		marvell,function = "gpio";
++	};
++};
++
++&rtc {
++	status = "disabled";
++};
++
++&sata {
++	status = "okay";
++	nr-ports = <1>;
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	hdd_temp: sata-port@0 {
++		reg = <0>;
++		#thermal-sensor-cells = <0>;
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
diff --git a/target/linux/kirkwood/patches-5.15/003-6.5-ARM-dts-kirkwood-Add-Endian-4i-Edge-200-board.patch b/target/linux/kirkwood/patches-5.15/003-6.5-ARM-dts-kirkwood-Add-Endian-4i-Edge-200-board.patch
new file mode 100644
index 00000000000000..4b0f46bb6dd547
--- /dev/null
+++ b/target/linux/kirkwood/patches-5.15/003-6.5-ARM-dts-kirkwood-Add-Endian-4i-Edge-200-board.patch
@@ -0,0 +1,249 @@
+From 5668d088ee4ea05db9daaae0645d1d1f579b20f9 Mon Sep 17 00:00:00 2001
+From: Pawel Dembicki <paweldembicki@gmail.com>
+Date: Mon, 3 Oct 2022 09:34:43 +0200
+Subject: ARM: dts: kirkwood: Add Endian 4i Edge 200 board
+
+Add Endian 4i Edge 200 is 5-port firewall.
+It have also clone: Endian UTM Mini (The same hardware, with added WLAN
+card).
+
+Hardware:
+  - SoC: Marvell 88F6281-A1 ARMv5TE Processor 1.2GHz
+  - Ram: 512MB (4x Nanya NT5TU128M8GE-AC)
+  - NAND Flash: 512MB (Micron 29F4G08AAC)
+  - Lan 1-4: 4x GBE (Marvell 88E6171R-TFJ2)
+  - Lan 5: 1x GBE (Marvell 88E1116R-NNC1)
+  - Storage: MicroSD Slot
+  - MCPIE: MiniPCIe Slot present [fitted with SparkLan WPEA-110N/E
+          (Atheros AR9280 chipset) in Endian UTM Mini WLAN only]
+  - USB: 1x USB 2.0 port
+  - Console: RJ-45 port
+  - LEDs: 3x GPIO controlled
+
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+---
+ arch/arm/boot/dts/Makefile                 |   1 +
+ arch/arm/boot/dts/kirkwood-4i-edge-200.dts | 205 +++++++++++++++++++++++++++++
+ 2 files changed, 206 insertions(+)
+ create mode 100644 arch/arm/boot/dts/kirkwood-4i-edge-200.dts
+
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -265,6 +265,7 @@ dtb-$(CONFIG_ARCH_KEYSTONE) += \
+ 	keystone-k2g-evm.dtb \
+ 	keystone-k2g-ice.dtb
+ dtb-$(CONFIG_MACH_KIRKWOOD) += \
++	kirkwood-4i-edge-200.dtb \
+ 	kirkwood-b3.dtb \
+ 	kirkwood-blackarmor-nas220.dtb \
+ 	kirkwood-c200-v1.dtb \
+--- /dev/null
++++ b/arch/arm/boot/dts/kirkwood-4i-edge-200.dts
+@@ -0,0 +1,205 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Endian 4i Edge 200 Board Description
++ * Note: Endian UTM Mini is hardware clone of Endian Edge 200
++ * Copyright 2021-2022 Pawel Dembicki <paweldembicki@gmail.com>
++ */
++
++/dts-v1/;
++
++#include "kirkwood.dtsi"
++#include "kirkwood-6281.dtsi"
++#include <dt-bindings/leds/common.h>
++
++/ {
++	model = "Endian 4i Edge 200";
++	compatible = "endian,4i-edge-200", "marvell,kirkwood-88f6281", "marvell,kirkwood";
++
++	memory {
++		device_type = "memory";
++		reg = <0x00000000 0x20000000>;
++	};
++
++	chosen {
++		bootargs = "console=ttyS0,115200n8";
++		stdout-path = &uart0;
++	};
++
++	leds {
++		compatible = "gpio-leds";
++		pinctrl-0 = <&pmx_led>;
++		pinctrl-names = "default";
++
++		led-1 {
++			function = LED_FUNCTION_SD;
++			color = <LED_COLOR_ID_AMBER>;
++			gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
++			linux,default-trigger = "mmc0";
++		};
++
++		led-2 {
++			function = LED_FUNCTION_STATUS;
++			color = <LED_COLOR_ID_AMBER>;
++			gpios = <&gpio1 3 GPIO_ACTIVE_HIGH>;
++		};
++
++		led-3 {
++			function = LED_FUNCTION_STATUS;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&gpio1 17 GPIO_ACTIVE_HIGH>;
++		};
++	};
++};
++
++&eth0 {
++	status = "okay";
++};
++
++&eth0port {
++	speed = <1000>;
++	duplex = <1>;
++};
++
++&eth1 {
++	status = "okay";
++};
++
++&eth1port {
++	phy-handle = <&ethphyb>;
++};
++
++&mdio {
++	status = "okay";
++
++	ethphyb: ethernet-phy@b {
++		reg = <0x0b>;
++
++		marvell,reg-init =
++			/* link-activity, bi-color mode 4 */
++			<3 0x10 0xfff0 0xf>; /* Reg 3,16 <- 0xzzzf */
++	};
++
++	switch0: switch@11 {
++		compatible = "marvell,mv88e6085";
++		reg = <0x11>;
++
++		ports {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			port@0 {
++				reg = <0>;
++				label = "port1";
++			};
++
++			port@1 {
++				reg = <1>;
++				label = "port2";
++			};
++
++			port@2 {
++				reg = <2>;
++				label = "port3";
++			};
++
++			port@3 {
++				reg = <3>;
++				label = "port4";
++			};
++
++			port@5 {
++				reg = <5>;
++				phy-mode = "rgmii-id";
++				ethernet = <&eth0port>;
++
++				fixed-link {
++					speed = <1000>;
++					full-duplex;
++				};
++			};
++		};
++	};
++};
++
++&nand {
++	status = "okay";
++	pinctrl-0 = <&pmx_nand>;
++	pinctrl-names = "default";
++
++	partition@0 {
++		label = "u-boot";
++		reg = <0x00000000 0x000a0000>;
++		read-only;
++	};
++
++	partition@a0000 {
++		label = "u-boot-env";
++		reg = <0x000a0000 0x00060000>;
++		read-only;
++	};
++
++	partition@100000 {
++		label = "kernel";
++		reg = <0x00100000 0x00400000>;
++	};
++
++	partition@500000 {
++		label = "ubi";
++		reg = <0x00500000 0x1fb00000>;
++	};
++};
++
++&pciec {
++	status = "okay";
++};
++
++&pcie0 {
++	status = "okay";
++};
++
++&pinctrl {
++	pinctrl-0 = <&pmx_sysrst>;
++	pinctrl-names = "default";
++
++	pmx_sysrst: pmx-sysrst {
++		marvell,pins = "mpp6";
++		marvell,function = "sysrst";
++	};
++
++	pmx_sdio_cd: pmx-sdio-cd {
++		marvell,pins = "mpp28";
++		marvell,function = "gpio";
++	};
++
++	pmx_led: pmx-led {
++		marvell,pins = "mpp34", "mpp35", "mpp49";
++		marvell,function = "gpio";
++	};
++};
++
++&rtc {
++	status = "okay";
++};
++
++&sata_phy0 {
++	status = "disabled";
++};
++
++&sata_phy1 {
++	status = "disabled";
++};
++
++&sdio {
++	pinctrl-0 = <&pmx_sdio_cd>;
++	pinctrl-names = "default";
++	status = "okay";
++	cd-gpios = <&gpio0 28 9>;
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&usb0 {
++	status = "okay";
++};
diff --git a/target/linux/kirkwood/patches-5.15/114-ctera-c-200-v1.patch b/target/linux/kirkwood/patches-5.15/114-ctera-c-200-v1.patch
new file mode 100644
index 00000000000000..23922b8d883b56
--- /dev/null
+++ b/target/linux/kirkwood/patches-5.15/114-ctera-c-200-v1.patch
@@ -0,0 +1,51 @@
+--- a/arch/arm/boot/dts/kirkwood-c200-v1.dts
++++ b/arch/arm/boot/dts/kirkwood-c200-v1.dts
+@@ -14,6 +14,14 @@
+ 	model = "Ctera C200 V1";
+ 	compatible = "ctera,c200-v1", "marvell,kirkwood-88f6281", "marvell,kirkwood";
+ 
++
++	aliases {
++		led-boot = &led_status_green;
++		led-failsafe = &led_status_red;
++		led-running = &led_status_green;
++		led-upgrade = &led_status_red;
++	};
++
+ 	chosen {
+ 		bootargs = "console=ttyS0,115200";
+ 		stdout-path = &uart0;
+@@ -78,6 +86,7 @@
+ 			function-enumerator = <1>;
+ 			color = <LED_COLOR_ID_GREEN>;
+ 			gpios = <&gpio0 15 GPIO_ACTIVE_LOW>;
++			linux,default-trigger = "ata1";
+ 		};
+ 
+ 		led-2 {
+@@ -85,6 +94,7 @@
+ 			function-enumerator = <2>;
+ 			color = <LED_COLOR_ID_GREEN>;
+ 			gpios = <&gpio0 16 GPIO_ACTIVE_LOW>;
++			linux,default-trigger = "ata2";
+ 		};
+ 
+ 		led-3 {
+@@ -94,13 +104,15 @@
+ 			gpios = <&gpio0 17 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		led-4 {
++		led_status_red: led-4 {
++			label = "red:status";
+ 			function = LED_FUNCTION_STATUS;
+ 			color = <LED_COLOR_ID_RED>;
+ 			gpios = <&gpio1 6 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+-		led-5 {
++		led_status_green: led-5 {
++			label = "green:status";
+ 			function = LED_FUNCTION_STATUS;
+ 			color = <LED_COLOR_ID_GREEN>;
+ 			gpios = <&gpio1 7 GPIO_ACTIVE_LOW>;
diff --git a/target/linux/kirkwood/patches-5.15/115-nsa310s.patch b/target/linux/kirkwood/patches-5.15/115-nsa310s.patch
new file mode 100644
index 00000000000000..4c6e08f49cbcfc
--- /dev/null
+++ b/target/linux/kirkwood/patches-5.15/115-nsa310s.patch
@@ -0,0 +1,35 @@
+--- a/arch/arm/boot/dts/kirkwood-nsa310s.dts
++++ b/arch/arm/boot/dts/kirkwood-nsa310s.dts
+@@ -16,6 +16,13 @@
+ 	model = "ZyXEL NSA310S";
+ 	compatible = "zyxel,nsa310s", "marvell,kirkwood-88f6702", "marvell,kirkwood";
+ 
++	aliases {
++		led-boot = &led_green_sys;
++		led-failsafe = &led_red_sys;
++		led-running = &led_green_sys;
++		led-upgrade = &led_red_sys;
++	};
++
+ 	memory {
+ 		device_type = "memory";
+ 		reg = <0x00000000 0x10000000>;
+@@ -96,14 +103,16 @@
+ 			gpios = <&gpio0 23 GPIO_ACTIVE_HIGH>;
+ 		};
+ 
+-		led-6 {
++		led_green_sys: led-6 {
++			label = "nsa310s:green:sys";
+ 			function = LED_FUNCTION_STATUS;
+ 			color = <LED_COLOR_ID_GREEN>;
+ 			gpios = <&gpio0 28 GPIO_ACTIVE_HIGH>;
+ 			linux,default-trigger = "default-on";
+ 		};
+ 
+-		led-7 {
++		led_red_sys: led-7 {
++			label = "nsa310s:red:sys";
+ 			function = LED_FUNCTION_STATUS;
+ 			color = <LED_COLOR_ID_RED>;
+ 			gpios = <&gpio0 29 GPIO_ACTIVE_HIGH>;
diff --git a/target/linux/kirkwood/patches-5.15/116-4i-edge-200.patch b/target/linux/kirkwood/patches-5.15/116-4i-edge-200.patch
new file mode 100644
index 00000000000000..ffc46c29dc863f
--- /dev/null
+++ b/target/linux/kirkwood/patches-5.15/116-4i-edge-200.patch
@@ -0,0 +1,34 @@
+--- a/arch/arm/boot/dts/kirkwood-4i-edge-200.dts
++++ b/arch/arm/boot/dts/kirkwood-4i-edge-200.dts
+@@ -20,6 +20,13 @@
+ 		reg = <0x00000000 0x20000000>;
+ 	};
+ 
++	aliases {
++		led-boot = &led_status_green;
++		led-failsafe = &led_status_orange;
++		led-running = &led_status_green;
++		led-upgrade = &led_status_orange;
++	};
++
+ 	chosen {
+ 		bootargs = "console=ttyS0,115200n8";
+ 		stdout-path = &uart0;
+@@ -37,13 +44,15 @@
+ 			linux,default-trigger = "mmc0";
+ 		};
+ 
+-		led-2 {
++		led_status_orange: led-2 {
++			label = "orange:status";
+ 			function = LED_FUNCTION_STATUS;
+ 			color = <LED_COLOR_ID_AMBER>;
+ 			gpios = <&gpio1 3 GPIO_ACTIVE_HIGH>;
+ 		};
+ 
+-		led-3 {
++		led_status_green: led-3 {
++			label = "green:status";
+ 			function = LED_FUNCTION_STATUS;
+ 			color = <LED_COLOR_ID_GREEN>;
+ 			gpios = <&gpio1 17 GPIO_ACTIVE_HIGH>;
diff --git a/target/linux/lantiq/Makefile b/target/linux/lantiq/Makefile
index 89f457ec5f448c..2e166a5f373902 100644
--- a/target/linux/lantiq/Makefile
+++ b/target/linux/lantiq/Makefile
@@ -9,8 +9,7 @@ BOARDNAME:=Lantiq
 FEATURES:=squashfs
 SUBTARGETS:=xrx200 xway xway_legacy falcon ase
 
-KERNEL_PATCHVER:=5.10
-KERNEL_TESTING_PATCHVER:=5.10
+KERNEL_PATCHVER:=5.15
 
 define Target/Description
 	Build firmware images for Lantiq SoC
diff --git a/target/linux/lantiq/ase/config-5.15 b/target/linux/lantiq/ase/config-5.15
new file mode 100644
index 00000000000000..195e49df692006
--- /dev/null
+++ b/target/linux/lantiq/ase/config-5.15
@@ -0,0 +1,25 @@
+CONFIG_ADM6996_PHY=y
+CONFIG_CPU_MIPS32_R1=y
+# CONFIG_CPU_MIPS32_R2 is not set
+CONFIG_CPU_MIPSR1=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_ACOMP2=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_FIRMWARE_MEMMAP=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_HW_RANDOM=y
+# CONFIG_ISDN is not set
+CONFIG_LANTIQ_ETOP=y
+CONFIG_NLS=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SOC_AMAZON_SE=y
+CONFIG_SOC_TYPE_XWAY=y
+CONFIG_SWCONFIG=y
+CONFIG_TARGET_ISA_REV=1
+CONFIG_USB=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_SUPPORT=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
diff --git a/target/linux/lantiq/config-5.15 b/target/linux/lantiq/config-5.15
new file mode 100644
index 00000000000000..c37a543e1e763f
--- /dev/null
+++ b/target/linux/lantiq/config-5.15
@@ -0,0 +1,225 @@
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_CLOCKSOURCE_DATA=y
+CONFIG_ARCH_HAS_DMA_COHERENT_TO_PFN=y
+CONFIG_ARCH_HAS_DMA_PREP_COHERENT=y
+CONFIG_ARCH_HAS_DMA_WRITE_COMBINE=y
+CONFIG_ARCH_HAS_ELF_RANDOMIZE=y
+CONFIG_ARCH_HAS_RESET_CONTROLLER=y
+CONFIG_ARCH_HAS_SYNC_DMA_FOR_DEVICE=y
+CONFIG_ARCH_HAS_UNCACHED_SEGMENT=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_ARCH_SUPPORTS_UPROBES=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARCH_USE_BUILTIN_BSWAP=y
+CONFIG_ARCH_USE_MEMREMAP_PROT=y
+CONFIG_ARCH_USE_QUEUED_RWLOCKS=y
+CONFIG_ARCH_USE_QUEUED_SPINLOCKS=y
+CONFIG_ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT=y
+CONFIG_ARCH_WANT_IPC_PARSE_VERSION=y
+CONFIG_CEVT_R4K=y
+CONFIG_CLKDEV_LOOKUP=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_LOAD_STORE_LR=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_RIXI=y
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_MIPS32=y
+# CONFIG_CPU_MIPS32_R1 is not set
+CONFIG_CPU_MIPS32_R2=y
+CONFIG_CPU_MIPSR2=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CPU_SUPPORTS_MSA=y
+CONFIG_CRYPTO_BLAKE2S=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CSRC_R4K=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_DMA_NONCOHERENT_CACHE_SYNC=y
+CONFIG_DTC=y
+# CONFIG_DT_EASY50712 is not set
+CONFIG_EARLY_PRINTK=y
+CONFIG_EFI_EARLYCON=y
+CONFIG_FIXED_PHY=y
+CONFIG_FONT_8x16=y
+CONFIG_FONT_AUTOSELECT=y
+CONFIG_FONT_SUPPORT=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GPIO_MM_LANTIQ=y
+CONFIG_GPIO_STP_XWAY=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDWARE_WATCHPOINTS=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HAVE_ARCH_COMPILER_H=y
+CONFIG_HAVE_ARCH_JUMP_LABEL=y
+CONFIG_HAVE_ARCH_KGDB=y
+CONFIG_HAVE_ARCH_SECCOMP_FILTER=y
+CONFIG_HAVE_ARCH_TRACEHOOK=y
+CONFIG_HAVE_ASM_MODVERSIONS=y
+CONFIG_HAVE_CLK=y
+CONFIG_HAVE_CONTEXT_TRACKING=y
+CONFIG_HAVE_COPY_THREAD_TLS=y
+CONFIG_HAVE_C_RECORDMCOUNT=y
+CONFIG_HAVE_DEBUG_KMEMLEAK=y
+CONFIG_HAVE_DEBUG_STACKOVERFLOW=y
+CONFIG_HAVE_DMA_CONTIGUOUS=y
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_FAST_GUP=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
+CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
+CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_GENERIC_VDSO=y
+CONFIG_HAVE_IDE=y
+CONFIG_HAVE_IOREMAP_PROT=y
+CONFIG_HAVE_IRQ_EXIT_ON_IRQ_STACK=y
+CONFIG_HAVE_IRQ_TIME_ACCOUNTING=y
+CONFIG_HAVE_KVM=y
+CONFIG_HAVE_LD_DEAD_CODE_DATA_ELIMINATION=y
+CONFIG_HAVE_MEMBLOCK_NODE_MAP=y
+CONFIG_HAVE_MOD_ARCH_SPECIFIC=y
+CONFIG_HAVE_NET_DSA=y
+CONFIG_HAVE_OPROFILE=y
+CONFIG_HAVE_PCI=y
+CONFIG_HAVE_PERF_EVENTS=y
+CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y
+CONFIG_HAVE_RSEQ=y
+CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
+CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+CONFIG_LANTIQ=y
+CONFIG_LANTIQ_DT_NONE=y
+# CONFIG_LANTIQ_ETOP is not set
+CONFIG_LANTIQ_WDT=y
+# CONFIG_LANTIQ_XRX200 is not set
+CONFIG_LEDS_GPIO=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_CORE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+CONFIG_MIPS_CBPF_JIT=y
+CONFIG_MIPS_CLOCK_VSYSCALL=y
+# CONFIG_MIPS_CMDLINE_DTB_EXTEND is not set
+# CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER is not set
+CONFIG_MIPS_CMDLINE_FROM_DTB=y
+# CONFIG_MIPS_ELF_APPENDED_DTB is not set
+CONFIG_MIPS_L1_CACHE_SHIFT=5
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+# CONFIG_MIPS_MT_SMP is not set
+# CONFIG_MIPS_NO_APPENDED_DTB is not set
+CONFIG_MIPS_RAW_APPENDED_DTB=y
+CONFIG_MIPS_SPRAM=y
+# CONFIG_MIPS_VPE_LOADER is not set
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_GEOMETRY=y
+CONFIG_MTD_CMDLINE_PARTS=y
+CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_LANTIQ=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPLIT_BRNIMAGE_FW=y
+CONFIG_MTD_SPLIT_EVA_FW=y
+CONFIG_MTD_SPLIT_FIRMWARE=y
+CONFIG_MTD_SPLIT_TPLINK_FW=y
+CONFIG_MTD_SPLIT_UIMAGE_FW=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_PER_CPU_KM=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_OF_NET=y
+# CONFIG_PCIE_LANTIQ is not set
+CONFIG_PCI_DRIVERS_LEGACY=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHY_LANTIQ_RCU_USB2=y
+# CONFIG_PHY_LANTIQ_VRX200_PCIE is not set
+CONFIG_PINCTRL=y
+CONFIG_PINCTRL_LANTIQ=y
+# CONFIG_PINCTRL_SINGLE is not set
+CONFIG_PINCTRL_XWAY=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RESET_LANTIQ=y
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIAL_LANTIQ=y
+CONFIG_SERIAL_LANTIQ_CONSOLE=y
+# CONFIG_SOC_AMAZON_SE is not set
+# CONFIG_SOC_FALCON is not set
+# CONFIG_SOC_XWAY is not set
+CONFIG_SPI=y
+CONFIG_SPI_LANTIQ_SSC=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRCU=y
+CONFIG_SWAP_IO_SPACE=y
+CONFIG_SWPHY=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYS_HAS_CPU_MIPS32_R1=y
+CONFIG_SYS_HAS_CPU_MIPS32_R2=y
+CONFIG_SYS_HAS_EARLY_PRINTK=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+CONFIG_SYS_SUPPORTS_MIPS16=y
+CONFIG_SYS_SUPPORTS_MULTITHREADING=y
+CONFIG_SYS_SUPPORTS_VPE_LOADER=y
+CONFIG_TARGET_ISA_REV=2
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TINY_SRCU=y
+CONFIG_USE_OF=y
+CONFIG_WATCHDOG_CORE=y
diff --git a/target/linux/lantiq/falcon/config-5.15 b/target/linux/lantiq/falcon/config-5.15
new file mode 100644
index 00000000000000..3041c65dbdcd77
--- /dev/null
+++ b/target/linux/lantiq/falcon/config-5.15
@@ -0,0 +1,9 @@
+CONFIG_CPU_HAS_DIEI=y
+CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_NAND_ECC_SW_HAMMING=y
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_SPLIT_FIRMWARE_NAME="linux"
+CONFIG_PINCTRL_FALCON=y
+CONFIG_SOC_FALCON=y
+CONFIG_SPI_FALCON=y
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9.dtsi b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9.dtsi
index a35bd17a967f4a..b12005ff6bf61f 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9.dtsi
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9.dtsi
@@ -44,8 +44,8 @@
 			#interrupt-cells = <1>;
 			interrupt-controller;
 			compatible = "lantiq,icu";
-			/* TODO: AR9 should have ICU1 (like VR9) too */
-			reg = <0x80200 0xc8>;
+			reg = <0x80200 0xc8	/* icu0 */
+				0x80300 0xc8>;	/* icu1 */
 		};
 
 		watchdog@803f0 {
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9_avm_fritz7320.dts b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9_avm_fritz7320.dts
index 44b8a18dae966c..cd7b29ca6d1d60 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9_avm_fritz7320.dts
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9_avm_fritz7320.dts
@@ -98,9 +98,20 @@
 
 &gsw {
 	phy-mode = "mii";
+	phy-handle = <&phy0>;
 	nvmem-cells = <&macaddr_ath9k_cal_a91>;
 	nvmem-cell-names = "mac-address";
 	mac-address-increment = <(-2)>;
+
+	mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		phy0: ethernet-phy@0 {
+			reg = <0>;
+			reset-gpios = <&gpio 36 GPIO_ACTIVE_LOW>;
+		};
+	};
 };
 
 &gpio {
@@ -108,6 +119,12 @@
 	pinctrl-0 = <&state_default>;
 
 	state_default: pinmux {
+		phy-rst {
+			lantiq,pins = "io36";
+			lantiq,pull = <0>;
+			lantiq,open-drain;
+			lantiq,output = <1>;
+		};
 		usb0_vbus {
 			lantiq,pins = "io50";
 			lantiq,pull = <0>;
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9.dtsi b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9.dtsi
index 1089cdc80c2c1e..e4c9be8f87df96 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9.dtsi
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9.dtsi
@@ -447,8 +447,13 @@
 
 				port@6 {
 					reg = <0x6>;
-					label = "cpu";
+					phy-mode = "internal";
 					ethernet = <&eth0>;
+
+					fixed-link {
+						speed = <1000>;
+						full-duplex;
+					};
 				};
 			};
 
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_arcadyan_vgv7510kw22.dtsi b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_arcadyan_vgv7510kw22.dtsi
index 1158aa371ec3d7..1a7a11db42068b 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_arcadyan_vgv7510kw22.dtsi
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_arcadyan_vgv7510kw22.dtsi
@@ -80,6 +80,7 @@
 		wifi: wifi {
 			label = "green:wlan";
 			gpios = <&gpio 20 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
 		};
 
 		power_red: power2 {
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz7360-v2.dts b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz7360-v2.dts
index 063d6dca5e0d25..a30746cde2b430 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz7360-v2.dts
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz7360-v2.dts
@@ -42,6 +42,18 @@
 				label = "urlader";
 				reg = <0x00000 0x20000>;
 				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				cal_urlader_985: cal@985 {
+					reg = <0x985 0x440>;
+				};
+
+				macaddr_urlader_a91: macaddr@a91 {
+					reg = <0xa91 0x6>;
+				};
 			};
 
 			partition@20000 {
@@ -78,12 +90,8 @@
 	reset-gpios = <&gpio 44 GPIO_ACTIVE_LOW>;
 };
 
-&urlader {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_urlader_a91: macaddr@a91 {
-		reg = <0xa91 0x6>;
-	};
+&wifi {
+	/delete-property/ qca,no-eeprom;
+	nvmem-cells = <&cal_urlader_985>;
+	nvmem-cell-names = "calibration";
 };
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz736x.dtsi b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz736x.dtsi
index 73f6e152bfac3e..7324127d2a8ece 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz736x.dtsi
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz736x.dtsi
@@ -151,7 +151,7 @@
 		#address-cells = <2>;
 		device_type = "pci";
 
-		wifi@168c,002e {
+		wifi: wifi@168c,002e {
 			compatible = "pci168c,002e";
 			reg = <0 0 0 0 0>;
 			qca,no-eeprom; /* load from ath9k-eeprom-pci-0000:01:00.0.bin */
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_bt_homehub-v5a.dts b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_bt_homehub-v5a.dts
index 1cd0f2c6b6cea4..be44cb716197e2 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_bt_homehub-v5a.dts
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_bt_homehub-v5a.dts
@@ -174,13 +174,17 @@
 	port@0 {
 		reg = <0>;
 		label = "lan3";
-		phy-mode = "rgmii";
+		phy-mode = "rgmii-id";
+		tx-internal-delay-ps = <1500>;
+		rx-internal-delay-ps = <1500>;
 		phy-handle = <&phy0>;
 	};
 	port@1 {
 		reg = <1>;
 		label = "lan4";
-		phy-mode = "rgmii";
+		phy-mode = "rgmii-id";
+		tx-internal-delay-ps = <1500>;
+		rx-internal-delay-ps = <1500>;
 		phy-handle = <&phy1>;
 	};
 	port@2 {
@@ -198,7 +202,9 @@
 	port@5 {
 		reg = <5>;
 		label = "wan";
-		phy-mode = "rgmii";
+		phy-mode = "rgmii-id";
+		tx-internal-delay-ps = <1500>;
+		rx-internal-delay-ps = <1500>;
 		phy-handle = <&phy5>;
 	};
 };
diff --git a/target/linux/lantiq/image/Makefile b/target/linux/lantiq/image/Makefile
index facc3fbe099f5f..9fdb949392a156 100644
--- a/target/linux/lantiq/image/Makefile
+++ b/target/linux/lantiq/image/Makefile
@@ -49,22 +49,31 @@ define Build/fullimage
 	rm $@.tmp
 endef
 
-define Build/loader-okli-compile
+define Build/loader-common
 	rm -rf $@.src
 	$(MAKE) -C lzma-loader \
 		PKG_BUILD_DIR="$@.src" \
 		TARGET_DIR="$(dir $@)" LOADER_NAME="$(notdir $@)" \
-		PLATFORM="lantiq" \
+		BOARD="$(BOARDNAME)" PLATFORM="lantiq" \
 		LZMA_TEXT_START=0x82000000 \
 		LOADADDR=0x80002000 \
-		FLASH_START=0x10000000 \
-		FLASH_OFFS=$(LOADER_FLASH_OFFS) \
-		FLASH_MAX=0x0 \
 		$(1) compile loader.bin
 	mv "$@.bin" "$@"
 	rm -rf $@.src
 endef
 
+define Build/loader-kernel
+	$(call Build/loader-common,LOADER_DATA="$@")
+endef
+
+define Build/loader-okli-compile
+	$(call Build/loader-common, \
+		FLASH_START=0x10000000 \
+		FLASH_OFFS=$(LOADER_FLASH_OFFS) \
+		FLASH_MAX=0x0 \
+	)
+endef
+
 define Build/prepend-loader-okli
 	cat "$(KDIR)/loader-$(word 1,$(1)).bin" "$@" >> "$@.new"
 	mv "$@.new" "$@"
diff --git a/target/linux/lantiq/image/ar9.mk b/target/linux/lantiq/image/ar9.mk
index 434dacb12159eb..3a301f3655b9d3 100644
--- a/target/linux/lantiq/image/ar9.mk
+++ b/target/linux/lantiq/image/ar9.mk
@@ -4,11 +4,11 @@ define Device/avm_fritz7312
   SOC := ar9
   IMAGE_SIZE := 15744k
   LOADER_FLASH_OFFS := 0x31000
-  DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader wpad-basic-wolfssl \
+  DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader wpad-basic-mbedtls \
 	kmod-ltq-adsl-ar9-mei kmod-ltq-adsl-ar9 \
 	kmod-ltq-adsl-ar9-fw-b kmod-ltq-atm-ar9 \
 	ltq-adsl-app ppp-mod-pppoa \
-	kmod-ltq-deu-ar9 -swconfig
+	kmod-ltq-deu-ar9 fritz-tffs -swconfig
 endef
 TARGET_DEVICES += avm_fritz7312
 
@@ -17,14 +17,16 @@ define Device/avm_fritz7320
   DEVICE_MODEL := FRITZ!Box 7320
   DEVICE_ALT0_VENDOR := 1&1
   DEVICE_ALT0_MODEL := HomeServer
+  DEVICE_ALT1_VENDOR := AVM
+  DEVICE_ALT1_MODEL := Fritz!Box 7330
   SOC := ar9
   IMAGE_SIZE := 15744k
   LOADER_FLASH_OFFS := 0x31000
-  DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader wpad-basic-wolfssl \
+  DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader wpad-basic-mbedtls \
 	kmod-ltq-adsl-ar9-mei kmod-ltq-adsl-ar9 \
 	kmod-ltq-adsl-ar9-fw-b kmod-ltq-atm-ar9 \
 	ltq-adsl-app ppp-mod-pppoa \
-	kmod-ltq-deu-ar9 kmod-usb-dwc2 -swconfig
+	kmod-ltq-deu-ar9 kmod-usb-dwc2 fritz-tffs -swconfig
   SUPPORTED_DEVICES += FRITZ7320
 endef
 TARGET_DEVICES += avm_fritz7320
@@ -42,7 +44,7 @@ define Device/bt_homehub-v3a
 	kmod-ltq-adsl-ar9-fw-a kmod-ltq-atm-ar9 \
 	kmod-ltq-deu-ar9 \
 	ltq-adsl-app ppp-mod-pppoa \
-	kmod-ath9k kmod-owl-loader wpad-basic-wolfssl \
+	kmod-ath9k kmod-owl-loader wpad-basic-mbedtls \
 	uboot-envtools
   SUPPORTED_DEVICES += BTHOMEHUBV3A
   DEFAULT := n
@@ -60,7 +62,7 @@ define Device/buffalo_wbmr-hp-g300h-a
 	kmod-ltq-adsl-ar9-mei kmod-ltq-adsl-ar9 \
 	kmod-ltq-adsl-ar9-fw-a kmod-ltq-atm-ar9 \
 	ltq-adsl-app ppp-mod-pppoa \
-	kmod-ath9k kmod-owl-loader wpad-basic-wolfssl
+	kmod-ath9k kmod-owl-loader wpad-basic-mbedtls
   SUPPORTED_DEVICES := WBMR buffalo,wbmr-hp-g300h
 endef
 TARGET_DEVICES += buffalo_wbmr-hp-g300h-a
@@ -76,7 +78,7 @@ define Device/buffalo_wbmr-hp-g300h-b
 	kmod-ltq-adsl-ar9-mei kmod-ltq-adsl-ar9 \
 	kmod-ltq-adsl-ar9-fw-b kmod-ltq-atm-ar9 \
 	ltq-adsl-app ppp-mod-pppoa \
-	kmod-ath9k kmod-owl-loader wpad-basic-wolfssl
+	kmod-ath9k kmod-owl-loader wpad-basic-mbedtls
   SUPPORTED_DEVICES := WBMR buffalo,wbmr-hp-g300h
 endef
 TARGET_DEVICES += buffalo_wbmr-hp-g300h-b
@@ -88,6 +90,8 @@ define Device/netgear_dgn3500
   DEVICE_MODEL := DGN3500
   SOC := ar9
   IMAGE_SIZE := 16000k
+  KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | uImage none
+  KERNEL_INITRAMFS := $$(KERNEL)
   IMAGES := \
 	sysupgrade-na.bin sysupgrade.bin \
 	factory-na.img factory.img
@@ -106,7 +110,7 @@ define Device/netgear_dgn3500
 	dgn3500-sercom-footer $(DGN3500_KERNEL_OFFSET_HEX) "WW" | pad-rootfs | \
 	check-size 16320k | pad-to 16384k
   DEVICE_PACKAGES := kmod-usb-dwc2 kmod-usb-ledtrig-usbport \
-	kmod-ath9k kmod-owl-loader wpad-basic-wolfssl \
+	kmod-ath9k kmod-owl-loader wpad-basic-mbedtls \
 	kmod-ltq-adsl-ar9-mei kmod-ltq-adsl-ar9 \
 	kmod-ltq-adsl-ar9-fw-a kmod-ltq-atm-ar9 \
 	kmod-ltq-deu-ar9 ltq-adsl-app ppp-mod-pppoa
@@ -119,6 +123,8 @@ define Device/netgear_dgn3500b
   DEVICE_MODEL := DGN3500B
   SOC := ar9
   IMAGE_SIZE := 16000k
+  KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | uImage none
+  KERNEL_INITRAMFS := $$(KERNEL)
   IMAGES += factory.img
   IMAGE/sysupgrade.bin := \
 	append-kernel | append-rootfs | dgn3500-sercom-footer 0x0 "DE" | \
@@ -128,7 +134,7 @@ define Device/netgear_dgn3500b
 	dgn3500-sercom-footer $(DGN3500_KERNEL_OFFSET_HEX) "DE" | pad-rootfs | \
 	check-size 16320k | pad-to 16384k
   DEVICE_PACKAGES := kmod-usb-dwc2 kmod-usb-ledtrig-usbport \
-	kmod-ath9k kmod-owl-loader wpad-basic-wolfssl \
+	kmod-ath9k kmod-owl-loader wpad-basic-mbedtls \
 	kmod-ltq-adsl-ar9-mei kmod-ltq-adsl-ar9 \
 	kmod-ltq-adsl-ar9-fw-b kmod-ltq-atm-ar9 \
 	kmod-ltq-deu-ar9 ltq-adsl-app ppp-mod-pppoa
@@ -141,13 +147,14 @@ define Device/zte_h201l
   DEVICE_MODEL := H201L
   IMAGE_SIZE := 7808k
   SOC := ar9
-  DEVICE_PACKAGES := kmod-ath9k-htc wpad-basic-wolfssl \
+  DEVICE_PACKAGES := kmod-ath9k-htc wpad-basic-mbedtls \
 	kmod-ltq-adsl-ar9-mei kmod-ltq-adsl-ar9 \
 	kmod-ltq-adsl-ar9-fw-b kmod-ltq-atm-ar9 \
 	kmod-ltq-deu-ar9 ltq-adsl-app ppp-mod-pppoe \
 	kmod-usb-dwc2 kmod-usb-ledtrig-usbport \
 	kmod-ltq-tapi kmod-ltq-vmmc
   SUPPORTED_DEVICES += H201L
+  DEFAULT := n
 endef
 TARGET_DEVICES += zte_h201l
 
@@ -157,7 +164,7 @@ define Device/zyxel_p-2601hn
   DEVICE_VARIANT := F1/F3
   IMAGE_SIZE := 15616k
   SOC := ar9
-  DEVICE_PACKAGES := kmod-rt2800-usb wpad-basic-wolfssl \
+  DEVICE_PACKAGES := kmod-rt2800-usb wpad-basic-mbedtls \
 	kmod-ltq-adsl-ar9-mei kmod-ltq-adsl-ar9 \
 	kmod-ltq-adsl-ar9-fw-b kmod-ltq-atm-ar9 \
 	kmod-ltq-deu-ar9 ltq-adsl-app ppp-mod-pppoe \
diff --git a/target/linux/lantiq/image/danube.mk b/target/linux/lantiq/image/danube.mk
index 9cafd2b258acff..c2bf7e798bbcba 100644
--- a/target/linux/lantiq/image/danube.mk
+++ b/target/linux/lantiq/image/danube.mk
@@ -10,8 +10,9 @@ define Device/arcadyan_arv4510pw
 	kmod-ltq-adsl-danube-fw-a kmod-ltq-atm-danube \
 	ltq-adsl-app ppp-mod-pppoa \
 	kmod-ltq-tapi kmod-ltq-vmmc \
-	kmod-rt2800-pci kmod-ath5k wpad-basic-wolfssl
+	kmod-rt2800-pci kmod-ath5k wpad-basic-mbedtls
   SUPPORTED_DEVICES += ARV4510PW
+  DEFAULT := n
 endef
 TARGET_DEVICES += arcadyan_arv4510pw
 
@@ -43,7 +44,7 @@ define Device/arcadyan_arv7506pw11
   DEVICE_PACKAGES := kmod-ltq-adsl-danube-mei kmod-ltq-adsl-danube \
 	kmod-ltq-adsl-danube-fw-b kmod-ltq-atm-danube \
 	ltq-adsl-app ppp-mod-pppoa \
-	kmod-rt2800-pci wpad-basic-wolfssl
+	kmod-rt2800-pci wpad-basic-mbedtls
   SUPPORTED_DEVICES += ARV7506PW11
 endef
 TARGET_DEVICES += arcadyan_arv7506pw11
@@ -60,7 +61,7 @@ define Device/arcadyan_arv7510pw22
 	kmod-ltq-adsl-danube-fw-a kmod-ltq-atm-danube \
 	ltq-adsl-app ppp-mod-pppoa \
 	kmod-ltq-tapi kmod-ltq-vmmc \
-	kmod-rt2800-pci wpad-basic-wolfssl \
+	kmod-rt2800-pci wpad-basic-mbedtls \
 	kmod-usb-uhci kmod-usb2 kmod-usb2-pci
   SUPPORTED_DEVICES += ARV7510PW22
 endef
@@ -77,7 +78,7 @@ define Device/arcadyan_arv7518pw
 	kmod-ltq-adsl-danube-mei kmod-ltq-adsl-danube \
 	kmod-ltq-adsl-danube-fw-a kmod-ltq-atm-danube \
 	ltq-adsl-app ppp-mod-pppoa \
-	kmod-ath9k kmod-owl-loader wpad-basic-wolfssl
+	kmod-ath9k kmod-owl-loader wpad-basic-mbedtls
   SUPPORTED_DEVICES += ARV7518PW
 endef
 TARGET_DEVICES += arcadyan_arv7518pw
@@ -93,7 +94,7 @@ define Device/arcadyan_arv7519pw
 	kmod-ltq-adsl-danube-mei kmod-ltq-adsl-danube \
 	kmod-ltq-adsl-danube-fw-a kmod-ltq-atm-danube \
 	ltq-adsl-app ppp-mod-pppoa \
-	kmod-rt2800-pci wpad-basic-wolfssl
+	kmod-rt2800-pci wpad-basic-mbedtls
   SUPPORTED_DEVICES += ARV7519PW
 endef
 TARGET_DEVICES += arcadyan_arv7519pw
@@ -106,7 +107,7 @@ define Device/arcadyan_arv7525pw
   DEVICE_ALT0_VARIANT := Typ A
   IMAGE_SIZE := 3776k
   SOC := danube
-  DEVICE_PACKAGES := kmod-rt2800-pci wpad-basic-wolfssl \
+  DEVICE_PACKAGES := kmod-rt2800-pci wpad-basic-mbedtls \
 	kmod-ltq-adsl-danube-mei kmod-ltq-adsl-danube \
 	kmod-ltq-adsl-danube-fw-b kmod-ltq-atm-danube \
 	ltq-adsl-app ppp-mod-pppoa -swconfig
@@ -127,7 +128,7 @@ define Device/arcadyan_arv752dpw
 	kmod-ltq-adsl-danube-fw-b kmod-ltq-atm-danube \
 	ltq-adsl-app ppp-mod-pppoa \
 	kmod-ltq-tapi kmod-ltq-vmmc \
-	kmod-rt2800-pci wpad-basic-wolfssl
+	kmod-rt2800-pci wpad-basic-mbedtls
   SUPPORTED_DEVICES += ARV752DPW
 endef
 TARGET_DEVICES += arcadyan_arv752dpw
@@ -144,7 +145,7 @@ define Device/arcadyan_arv752dpw22
 	kmod-ltq-adsl-danube-fw-b kmod-ltq-atm-danube \
 	ltq-adsl-app ppp-mod-pppoa \
 	kmod-ltq-tapi kmod-ltq-vmmc \
-	kmod-rt2800-pci wpad-basic-wolfssl
+	kmod-rt2800-pci wpad-basic-mbedtls
   SUPPORTED_DEVICES += ARV752DPW22
 endef
 TARGET_DEVICES += arcadyan_arv752dpw22
@@ -160,7 +161,7 @@ define Device/arcadyan_arv8539pw22
 	kmod-ltq-adsl-danube-mei kmod-ltq-adsl-danube \
 	kmod-ltq-adsl-danube-fw-b kmod-ltq-atm-danube \
 	ltq-adsl-app ppp-mod-pppoa \
-	kmod-ath9k kmod-owl-loader wpad-basic-wolfssl
+	kmod-ath9k kmod-owl-loader wpad-basic-mbedtls
   SUPPORTED_DEVICES += ARV8539PW22
 endef
 TARGET_DEVICES += arcadyan_arv8539pw22
@@ -176,7 +177,7 @@ define Device/audiocodes_mp-252
 	kmod-usb-ledtrig-usbport kmod-usb-dwc2 \
 	kmod-rt2800-pci \
 	ltq-adsl-app ppp-mod-pppoa \
-	wpad-basic-wolfssl
+	wpad-basic-mbedtls
   SUPPORTED_DEVICES += ACMP252
 endef
 TARGET_DEVICES += audiocodes_mp-252
@@ -193,7 +194,7 @@ define Device/bt_homehub-v2b
 	kmod-ltq-adsl-danube-mei kmod-ltq-adsl-danube \
 	kmod-ltq-adsl-danube-fw-a kmod-ltq-atm-danube \
 	kmod-ltq-deu-danube ltq-adsl-app ppp-mod-pppoa \
-	kmod-ath9k kmod-owl-loader wpad-basic-wolfssl
+	kmod-ath9k kmod-owl-loader wpad-basic-mbedtls
   SUPPORTED_DEVICES += BTHOMEHUBV2B
   DEFAULT := n
 endef
@@ -217,7 +218,8 @@ define Device/siemens_gigaset-sx76x
 	kmod-ltq-adsl-danube-mei kmod-ltq-adsl-danube \
 	kmod-ltq-adsl-danube-fw-b kmod-ltq-atm-danube \
 	ltq-adsl-app ppp-mod-pppoe \
-	kmod-ath5k wpad-basic-wolfssl
+	kmod-ath5k wpad-basic-mbedtls
   SUPPORTED_DEVICES += GIGASX76X
+  DEFAULT := n
 endef
 TARGET_DEVICES += siemens_gigaset-sx76x
diff --git a/target/linux/lantiq/image/lzma-loader/src/printf.c b/target/linux/lantiq/image/lzma-loader/src/printf.c
index 7bb5a86e187d44..31b5e19ab14f79 100644
--- a/target/linux/lantiq/image/lzma-loader/src/printf.c
+++ b/target/linux/lantiq/image/lzma-loader/src/printf.c
@@ -11,7 +11,7 @@
 
 #include	"printf.h"
 
-extern void board_putc(int ch);
+extern void board_putc(char ch);
 
 /* this is the maximum width for a variable */
 #define		LP_MAX_BUF	256
diff --git a/target/linux/lantiq/image/tp-link.mk b/target/linux/lantiq/image/tp-link.mk
index 756105b94c7f84..751f61589de8cf 100644
--- a/target/linux/lantiq/image/tp-link.mk
+++ b/target/linux/lantiq/image/tp-link.mk
@@ -26,7 +26,7 @@ define Device/tplink_tdw8970
   TPLINK_HWID := 0x89700001
   TPLINK_HWREV := 1
   IMAGE_SIZE := 7680k
-  DEVICE_PACKAGES:= kmod-ath9k wpad-basic-wolfssl kmod-usb-dwc2 kmod-usb-ledtrig-usbport
+  DEVICE_PACKAGES:= kmod-ath9k wpad-basic-mbedtls kmod-usb-dwc2 kmod-usb-ledtrig-usbport
   SUPPORTED_DEVICES += TDW8970
 endef
 TARGET_DEVICES += tplink_tdw8970
@@ -40,7 +40,7 @@ define Device/tplink_tdw8980
   TPLINK_HWID := 0x89800001
   TPLINK_HWREV := 14
   IMAGE_SIZE := 7680k
-  DEVICE_PACKAGES:= kmod-ath9k kmod-owl-loader wpad-basic-wolfssl kmod-usb-dwc2 kmod-usb-ledtrig-usbport
+  DEVICE_PACKAGES:= kmod-ath9k kmod-owl-loader wpad-basic-mbedtls kmod-usb-dwc2 kmod-usb-ledtrig-usbport
   SUPPORTED_DEVICES += TDW8980
 endef
 TARGET_DEVICES += tplink_tdw8980
@@ -54,7 +54,7 @@ define Device/tplink_vr200
   TPLINK_HWID := 0x63e64801
   TPLINK_HWREV := 0x53
   IMAGE_SIZE := 15808k
-  DEVICE_PACKAGES:= kmod-mt76x0e wpad-basic-wolfssl kmod-usb-dwc2 kmod-usb-ledtrig-usbport
+  DEVICE_PACKAGES:= kmod-mt76x0e wpad-basic-mbedtls kmod-usb-dwc2 kmod-usb-ledtrig-usbport
   SUPPORTED_DEVICES += VR200
 endef
 TARGET_DEVICES += tplink_vr200
@@ -68,7 +68,7 @@ define Device/tplink_vr200v
   TPLINK_HWID := 0x73b70801
   TPLINK_HWREV := 0x2f
   IMAGE_SIZE := 15808k
-  DEVICE_PACKAGES:= kmod-mt76x0e wpad-basic-wolfssl kmod-usb-dwc2 kmod-usb-ledtrig-usbport kmod-ltq-tapi kmod-ltq-vmmc
+  DEVICE_PACKAGES:= kmod-mt76x0e wpad-basic-mbedtls kmod-usb-dwc2 kmod-usb-ledtrig-usbport kmod-ltq-tapi kmod-ltq-vmmc
   SUPPORTED_DEVICES += VR200v
 endef
 TARGET_DEVICES += tplink_vr200v
diff --git a/target/linux/lantiq/image/vr9.mk b/target/linux/lantiq/image/vr9.mk
index d17045b6db157a..3c05636f563d0c 100644
--- a/target/linux/lantiq/image/vr9.mk
+++ b/target/linux/lantiq/image/vr9.mk
@@ -12,6 +12,7 @@ define Device/alphanetworks_asl56026
   DEVICE_ALT0_VENDOR := BT Openreach
   DEVICE_ALT0_MODEL := ECI VDSL Modem V-2FUb/I
   IMAGE_SIZE := 7488k
+  DEFAULT := n
 endef
 TARGET_DEVICES += alphanetworks_asl56026
 
@@ -38,6 +39,7 @@ define Device/arcadyan_vg3503j
   DEVICE_MODEL := ECI VDSL Modem V-2FUb/R
   IMAGE_SIZE := 8000k
   SUPPORTED_DEVICES += VG3503J
+  DEFAULT := n
 endef
 TARGET_DEVICES += arcadyan_vg3503j
 
@@ -54,7 +56,7 @@ define Device/arcadyan_vgv7510kw22-brn
   SIGNATURE := BRNDA6431
   MAGIC := 0x12345678
   CRC32_POLY := 0x04c11db7
-  DEVICE_PACKAGES := kmod-rt2800-pci wpad-basic-wolfssl kmod-usb-dwc2 kmod-ltq-tapi kmod-ltq-vmmc
+  DEVICE_PACKAGES := kmod-rt2800-pci wpad-basic-mbedtls kmod-usb-dwc2 kmod-ltq-tapi kmod-ltq-vmmc
   SUPPORTED_DEVICES += VGV7510KW22BRN
 endef
 TARGET_DEVICES += arcadyan_vgv7510kw22-brn
@@ -68,7 +70,7 @@ define Device/arcadyan_vgv7510kw22-nor
   DEVICE_ALT0_MODEL := Box 6431
   DEVICE_ALT0_VARIANT := NOR
   IMAGE_SIZE := 15232k
-  DEVICE_PACKAGES := kmod-rt2800-pci wpad-basic-wolfssl kmod-usb-dwc2 kmod-ltq-tapi kmod-ltq-vmmc
+  DEVICE_PACKAGES := kmod-rt2800-pci wpad-basic-mbedtls kmod-usb-dwc2 kmod-ltq-tapi kmod-ltq-vmmc
   SUPPORTED_DEVICES += VGV7510KW22NOR
 endef
 TARGET_DEVICES += arcadyan_vgv7510kw22-nor
@@ -86,7 +88,7 @@ define Device/arcadyan_vgv7519-brn
   SIGNATURE := 5D00008000
   MAGIC := 0x12345678
   CRC32_POLY := 0x2083b8ed
-  DEVICE_PACKAGES := kmod-rt2800-pci wpad-basic-wolfssl kmod-usb-dwc2 kmod-ltq-tapi kmod-ltq-vmmc
+  DEVICE_PACKAGES := kmod-rt2800-pci wpad-basic-mbedtls kmod-usb-dwc2 kmod-ltq-tapi kmod-ltq-vmmc
   SUPPORTED_DEVICES += VGV7519BRN
 endef
 TARGET_DEVICES += arcadyan_vgv7519-brn
@@ -100,7 +102,7 @@ define Device/arcadyan_vgv7519-nor
   DEVICE_ALT0_MODEL := Experiabox 8
   DEVICE_ALT0_VARIANT := NOR
   IMAGE_SIZE := 15360k
-  DEVICE_PACKAGES := kmod-rt2800-pci wpad-basic-wolfssl kmod-usb-dwc2 kmod-ltq-tapi kmod-ltq-vmmc
+  DEVICE_PACKAGES := kmod-rt2800-pci wpad-basic-mbedtls kmod-usb-dwc2 kmod-ltq-tapi kmod-ltq-vmmc
   SUPPORTED_DEVICES += VGV7519NOR
 endef
 TARGET_DEVICES += arcadyan_vgv7519-nor
@@ -116,7 +118,7 @@ define Device/avm_fritz3370
   IMAGES += eva-kernel.bin eva-filesystem.bin
   IMAGE/eva-kernel.bin := append-kernel
   IMAGE/eva-filesystem.bin := append-ubi
-  DEVICE_PACKAGES := kmod-ath9k wpad-basic-wolfssl kmod-usb-dwc2 fritz-tffs
+  DEVICE_PACKAGES := kmod-ath9k wpad-basic-mbedtls kmod-usb-dwc2 fritz-tffs
 endef
 
 define Device/avm_fritz3370-rev2-hynix
@@ -142,7 +144,7 @@ define Device/avm_fritz3390
   DEVICE_MODEL := FRITZ!Box 3390
   KERNEL_SIZE := 4096k
   IMAGE_SIZE := 49152k
-  DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader wpad-basic-wolfssl \
+  DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader wpad-basic-mbedtls \
 	kmod-usb-dwc2 fritz-tffs
 endef
 TARGET_DEVICES += avm_fritz3390
@@ -152,7 +154,8 @@ define Device/avm_fritz7360sl
   $(Device/AVM)
   DEVICE_MODEL := FRITZ!Box 7360 SL
   IMAGE_SIZE := 15744k
-  DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader wpad-basic-wolfssl kmod-usb-dwc2
+  DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader wpad-basic-mbedtls \
+	kmod-usb-dwc2 fritz-tffs
   SUPPORTED_DEVICES += FRITZ7360SL
 endef
 TARGET_DEVICES += avm_fritz7360sl
@@ -163,7 +166,8 @@ define Device/avm_fritz7360-v2
   DEVICE_MODEL := FRITZ!Box 7360
   DEVICE_VARIANT := v2
   IMAGE_SIZE := 32128k
-  DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader wpad-basic-wolfssl kmod-usb-dwc2
+  DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader wpad-basic-mbedtls \
+	kmod-usb-dwc2 fritz-tffs
 endef
 TARGET_DEVICES += avm_fritz7360-v2
 
@@ -174,7 +178,8 @@ define Device/avm_fritz7362sl
   DEVICE_MODEL := FRITZ!Box 7362 SL
   KERNEL_SIZE := 4096k
   IMAGE_SIZE := 49152k
-  DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader wpad-basic-wolfssl kmod-usb-dwc2 fritz-tffs
+  DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader wpad-basic-mbedtls \
+	kmod-usb-dwc2 fritz-tffs
 endef
 TARGET_DEVICES += avm_fritz7362sl
 
@@ -186,7 +191,8 @@ define Device/avm_fritz7412
   BOARD_NAME := FRITZ7412
   KERNEL_SIZE := 4096k
   IMAGE_SIZE := 49152k
-  DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader wpad-basic-wolfssl fritz-tffs-nand fritz-caldata
+  DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader wpad-basic-mbedtls \
+	fritz-tffs-nand fritz-caldata
 endef
 TARGET_DEVICES += avm_fritz7412
 
@@ -197,7 +203,8 @@ define Device/avm_fritz7430
   DEVICE_MODEL := FRITZ!Box 7430
   KERNEL_SIZE := 4096k
   IMAGE_SIZE := 49152k
-  DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader wpad-basic-wolfssl fritz-tffs-nand fritz-caldata
+  DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader wpad-basic-mbedtls \
+	kmod-usb-dwc2 fritz-tffs-nand fritz-caldata
 endef
 TARGET_DEVICES += avm_fritz7430
 
@@ -209,7 +216,7 @@ define Device/bt_homehub-v5a
   DEVICE_VARIANT := Type A
   BOARD_NAME := BTHOMEHUBV5A
   DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader \
-	kmod-ath10k-ct ath10k-firmware-qca988x-ct wpad-basic-wolfssl kmod-usb-dwc2
+	kmod-ath10k-ct ath10k-firmware-qca988x-ct wpad-basic-mbedtls kmod-usb-dwc2
   SUPPORTED_DEVICES += BTHOMEHUBV5A
 endef
 TARGET_DEVICES += bt_homehub-v5a
@@ -219,7 +226,7 @@ define Device/buffalo_wbmr-300hpd
   DEVICE_VENDOR := Buffalo
   DEVICE_MODEL := WBMR-300HPD
   IMAGE_SIZE := 15616k
-  DEVICE_PACKAGES := kmod-mt7603 wpad-basic-wolfssl kmod-usb-dwc2
+  DEVICE_PACKAGES := kmod-mt7603 wpad-basic-mbedtls kmod-usb-dwc2
   SUPPORTED_DEVICES += WBMR300
 endef
 TARGET_DEVICES += buffalo_wbmr-300hpd
@@ -231,7 +238,7 @@ define Device/lantiq_easy80920-nand
   DEVICE_MODEL := VR9 EASY80920
   DEVICE_VARIANT := NAND
   IMAGE_SIZE := 64512k
-  DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader wpad-basic-wolfssl kmod-usb-dwc2 kmod-usb-ledtrig-usbport
+  DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader wpad-basic-mbedtls kmod-usb-dwc2 kmod-usb-ledtrig-usbport
 endef
 TARGET_DEVICES += lantiq_easy80920-nand
 
@@ -241,7 +248,7 @@ define Device/lantiq_easy80920-nor
   DEVICE_MODEL := VR9 EASY80920
   DEVICE_VARIANT := NOR
   IMAGE_SIZE := 7936k
-  DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader wpad-basic-wolfssl kmod-usb-dwc2 kmod-usb-ledtrig-usbport
+  DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader wpad-basic-mbedtls kmod-usb-dwc2 kmod-usb-ledtrig-usbport
 endef
 TARGET_DEVICES += lantiq_easy80920-nor
 
@@ -268,7 +275,7 @@ define Device/zyxel_p-2812hnu-f1
   DEVICE_MODEL := P-2812HNU
   DEVICE_VARIANT := F1
   BOARD_NAME := P2812HNUF1
-  DEVICE_PACKAGES := kmod-rt2800-pci wpad-basic-wolfssl kmod-usb-dwc2 kmod-usb-ledtrig-usbport
+  DEVICE_PACKAGES := kmod-rt2800-pci wpad-basic-mbedtls kmod-usb-dwc2 kmod-usb-ledtrig-usbport
   KERNEL_SIZE := 3072k
   SUPPORTED_DEVICES += P2812HNUF1
 endef
@@ -281,7 +288,7 @@ define Device/zyxel_p-2812hnu-f3
   DEVICE_MODEL := P-2812HNU
   DEVICE_VARIANT := F3
   BOARD_NAME := P2812HNUF3
-  DEVICE_PACKAGES := kmod-rt2800-pci wpad-basic-wolfssl kmod-usb-dwc2
+  DEVICE_PACKAGES := kmod-rt2800-pci wpad-basic-mbedtls kmod-usb-dwc2
   KERNEL_SIZE := 2048k
   SUPPORTED_DEVICES += P2812HNUF3
   DEFAULT := n
diff --git a/target/linux/lantiq/image/xway_legacy.mk b/target/linux/lantiq/image/xway_legacy.mk
index a0bf7a85ac5f9b..47b52277f618e4 100644
--- a/target/linux/lantiq/image/xway_legacy.mk
+++ b/target/linux/lantiq/image/xway_legacy.mk
@@ -6,7 +6,7 @@ define Device/arcadyan_arv4518pwr01
 	kmod-ltq-adsl-danube-mei kmod-ltq-adsl-danube \
 	kmod-ltq-adsl-danube-fw-a kmod-ltq-atm-danube \
 	ltq-adsl-app ppp-mod-pppoa \
-	kmod-ath5k wpad-basic-wolfssl
+	kmod-ath5k wpad-basic-mbedtls
   SUPPORTED_DEVICES += ARV4518PWR01
   DEFAULT := n
 endef
@@ -20,7 +20,7 @@ define Device/arcadyan_arv4518pwr01a
 	kmod-ltq-adsl-danube-mei kmod-ltq-adsl-danube \
 	kmod-ltq-adsl-danube-fw-a kmod-ltq-atm-danube \
 	ltq-adsl-app ppp-mod-pppoa \
-	kmod-ath5k wpad-basic-wolfssl
+	kmod-ath5k wpad-basic-mbedtls
   SUPPORTED_DEVICES += ARV4518PWR01A
   DEFAULT := n
 endef
@@ -38,7 +38,7 @@ define Device/arcadyan_arv4520pw
 	kmod-ltq-adsl-danube-mei kmod-ltq-adsl-danube \
 	kmod-ltq-adsl-danube-fw-b kmod-ltq-atm-danube \
 	ltq-adsl-app ppp-mod-pppoa \
-	kmod-rt61-pci wpad-basic-wolfssl
+	kmod-rt61-pci wpad-basic-mbedtls
   SUPPORTED_DEVICES += ARV4520PW
   DEFAULT := n
 endef
@@ -51,7 +51,7 @@ define Device/arcadyan_arv4525pw
   DEVICE_ALT0_MODEL := Speedport W502V
   DEVICE_ALT0_VARIANT := Typ A
   IMAGE_SIZE := 3776k
-  DEVICE_PACKAGES := kmod-ath5k wpad-basic-wolfssl \
+  DEVICE_PACKAGES := kmod-ath5k wpad-basic-mbedtls \
 	kmod-ltq-adsl-danube-mei kmod-ltq-adsl-danube \
 	kmod-ltq-adsl-danube-fw-b kmod-ltq-atm-danube \
 	ltq-adsl-app ppp-mod-pppoa -swconfig
@@ -67,7 +67,7 @@ define Device/arcadyan_arv452cqw
   DEVICE_ALT0_MODEL := Easybox 801
   IMAGE_SIZE := 3776k
   DEVICE_PACKAGES := kmod-usb-dwc2 kmod-usb-ledtrig-usbport \
-	kmod-ath5k wpad-basic-wolfssl \
+	kmod-ath5k wpad-basic-mbedtls \
 	kmod-ltq-adsl-danube-mei kmod-ltq-adsl-danube \
 	kmod-ltq-adsl-danube-fw-b kmod-ltq-atm-danube \
 	ltq-adsl-app ppp-mod-pppoa
diff --git a/target/linux/lantiq/patches-5.15/0001-MIPS-lantiq-add-pcie-driver.patch b/target/linux/lantiq/patches-5.15/0001-MIPS-lantiq-add-pcie-driver.patch
new file mode 100644
index 00000000000000..9cd3b08b8e1231
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0001-MIPS-lantiq-add-pcie-driver.patch
@@ -0,0 +1,5505 @@
+From 6f933347d0b4ed02d9534f5fa07f7b99f13eeaa1 Mon Sep 17 00:00:00 2001
+From: John Crispin <blogic@openwrt.org>
+Date: Thu, 7 Aug 2014 18:12:28 +0200
+Subject: [PATCH 01/36] MIPS: lantiq: add pcie driver
+
+Signed-off-by: John Crispin <blogic@openwrt.org>
+---
+ arch/mips/lantiq/Kconfig           |   10 +
+ arch/mips/lantiq/xway/sysctrl.c    |    2 +
+ arch/mips/pci/Makefile             |    2 +
+ arch/mips/pci/fixup-lantiq-pcie.c  |   82 +++
+ arch/mips/pci/fixup-lantiq.c       |    5 +-
+ arch/mips/pci/ifxmips_pci_common.h |   57 ++
+ arch/mips/pci/ifxmips_pcie.c       | 1099 ++++++++++++++++++++++++++++++
+ arch/mips/pci/ifxmips_pcie.h       |  135 ++++
+ arch/mips/pci/ifxmips_pcie_ar10.h  |  290 ++++++++
+ arch/mips/pci/ifxmips_pcie_msi.c   |  392 +++++++++++
+ arch/mips/pci/ifxmips_pcie_phy.c   |  478 +++++++++++++
+ arch/mips/pci/ifxmips_pcie_pm.c    |  176 +++++
+ arch/mips/pci/ifxmips_pcie_pm.h    |   36 +
+ arch/mips/pci/ifxmips_pcie_reg.h   | 1001 +++++++++++++++++++++++++++
+ arch/mips/pci/ifxmips_pcie_vr9.h   |  271 ++++++++
+ arch/mips/pci/pci.c                |   25 +
+ arch/mips/pci/pcie-lantiq.h        | 1305 ++++++++++++++++++++++++++++++++++++
+ drivers/pci/pcie/aer/Kconfig       |    2 +-
+ include/linux/pci.h                |    2 +
+ include/linux/pci_ids.h            |    6 +
+ 20 files changed, 5374 insertions(+), 2 deletions(-)
+ create mode 100644 arch/mips/pci/fixup-lantiq-pcie.c
+ create mode 100644 arch/mips/pci/ifxmips_pci_common.h
+ create mode 100644 arch/mips/pci/ifxmips_pcie.c
+ create mode 100644 arch/mips/pci/ifxmips_pcie.h
+ create mode 100644 arch/mips/pci/ifxmips_pcie_ar10.h
+ create mode 100644 arch/mips/pci/ifxmips_pcie_msi.c
+ create mode 100644 arch/mips/pci/ifxmips_pcie_phy.c
+ create mode 100644 arch/mips/pci/ifxmips_pcie_pm.c
+ create mode 100644 arch/mips/pci/ifxmips_pcie_pm.h
+ create mode 100644 arch/mips/pci/ifxmips_pcie_reg.h
+ create mode 100644 arch/mips/pci/ifxmips_pcie_vr9.h
+ create mode 100644 arch/mips/pci/pcie-lantiq.h
+
+--- a/arch/mips/lantiq/Kconfig
++++ b/arch/mips/lantiq/Kconfig
+@@ -20,6 +20,7 @@ config SOC_XWAY
+ 	bool "XWAY"
+ 	select SOC_TYPE_XWAY
+ 	select HAVE_PCI
++	select ARCH_SUPPORTS_MSI
+ 	select MFD_SYSCON
+ 	select MFD_CORE
+ 
+@@ -52,4 +53,13 @@ config PCI_LANTIQ
+ 	bool "PCI Support"
+ 	depends on SOC_XWAY && PCI
+ 
++config PCIE_LANTIQ
++	bool "PCIE Support"
++	depends on SOC_XWAY && PCI
++
++config PCIE_LANTIQ_MSI
++	bool
++	depends on PCIE_LANTIQ && PCI_MSI
++	default y
++
+ endif
+--- a/arch/mips/pci/Makefile
++++ b/arch/mips/pci/Makefile
+@@ -43,6 +43,8 @@ obj-$(CONFIG_PCI_LANTIQ)	+= pci-lantiq.o
+ obj-$(CONFIG_SOC_MT7620)	+= pci-mt7620.o
+ obj-$(CONFIG_SOC_RT288X)	+= pci-rt2880.o
+ obj-$(CONFIG_SOC_RT3883)	+= pci-rt3883.o
++obj-$(CONFIG_PCIE_LANTIQ)	+= ifxmips_pcie_phy.o ifxmips_pcie.o fixup-lantiq-pcie.o
++obj-$(CONFIG_PCIE_LANTIQ_MSI)	+= pcie-lantiq-msi.o
+ obj-$(CONFIG_TANBAC_TB0219)	+= fixup-tb0219.o
+ obj-$(CONFIG_TANBAC_TB0226)	+= fixup-tb0226.o
+ obj-$(CONFIG_TANBAC_TB0287)	+= fixup-tb0287.o
+--- /dev/null
++++ b/arch/mips/pci/fixup-lantiq-pcie.c
+@@ -0,0 +1,74 @@
++/******************************************************************************
++**
++** FILE NAME    : ifxmips_fixup_pcie.c
++** PROJECT      : IFX UEIP for VRX200
++** MODULES      : PCIe 
++**
++** DATE         : 02 Mar 2009
++** AUTHOR       : Lei Chuanhua
++** DESCRIPTION  : PCIe Root Complex Driver
++** COPYRIGHT    :       Copyright (c) 2009
++**                      Infineon Technologies AG
++**                      Am Campeon 1-12, 85579 Neubiberg, Germany
++**
++**    This program is free software; you can redistribute it and/or modify
++**    it under the terms of the GNU General Public License as published by
++**    the Free Software Foundation; either version 2 of the License, or
++**    (at your option) any later version.
++** HISTORY
++** $Version $Date        $Author         $Comment
++** 0.0.1    17 Mar,2009  Lei Chuanhua    Initial version
++*******************************************************************************/
++/*!
++ \file ifxmips_fixup_pcie.c
++ \ingroup IFX_PCIE  
++ \brief PCIe Fixup functions source file
++*/
++#include <linux/pci.h>
++#include <linux/pci_regs.h>
++#include <linux/pci_ids.h>
++
++#include <lantiq_soc.h>
++
++#include "pcie-lantiq.h"
++
++static void
++ifx_pcie_fixup_resource(struct pci_dev *dev)
++{
++    u32 reg;
++
++    IFX_PCIE_PRINT(PCIE_MSG_FIXUP, "%s dev %s: enter\n", __func__, pci_name(dev));
++
++    printk("%s: fixup host controller %s (%04x:%04x)\n", 
++        __func__, pci_name(dev), dev->vendor, dev->device); 
++
++   /* Setup COMMAND register */
++    reg = PCI_COMMAND_IO | PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER /* | 
++          PCI_COMMAND_INTX_DISABLE */| PCI_COMMAND_SERR;
++    pci_write_config_word(dev, PCI_COMMAND, reg);
++    IFX_PCIE_PRINT(PCIE_MSG_FIXUP, "%s dev %s: exit\n", __func__, pci_name(dev));
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INFINEON, PCI_DEVICE_ID_INFINEON_PCIE, ifx_pcie_fixup_resource);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_LANTIQ, PCI_VENDOR_ID_LANTIQ, ifx_pcie_fixup_resource);
++
++static void
++ifx_pcie_rc_class_early_fixup(struct pci_dev *dev)
++{
++    IFX_PCIE_PRINT(PCIE_MSG_FIXUP, "%s dev %s: enter\n", __func__, pci_name(dev));
++
++    if (dev->devfn == PCI_DEVFN(0, 0) &&
++        (dev->class >> 8) == PCI_CLASS_BRIDGE_HOST) {
++
++        dev->class = (PCI_CLASS_BRIDGE_PCI << 8) | (dev->class & 0xff);
++
++        printk(KERN_INFO "%s: fixed pcie host bridge to pci-pci bridge\n", __func__);
++    }
++    IFX_PCIE_PRINT(PCIE_MSG_FIXUP, "%s dev %s: exit\n", __func__, pci_name(dev));
++    mdelay(10);
++}
++
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INFINEON, PCI_DEVICE_ID_INFINEON_PCIE,
++     ifx_pcie_rc_class_early_fixup);
++
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_LANTIQ, PCI_DEVICE_ID_LANTIQ_PCIE,
++     ifx_pcie_rc_class_early_fixup);
+--- a/arch/mips/pci/fixup-lantiq.c
++++ b/arch/mips/pci/fixup-lantiq.c
+@@ -6,12 +6,19 @@
+ 
+ #include <linux/of_irq.h>
+ #include <linux/of_pci.h>
++#include <linux/pci.h>
++#include "ifxmips_pci_common.h"
+ 
+ int (*ltq_pci_plat_arch_init)(struct pci_dev *dev) = NULL;
+ int (*ltq_pci_plat_dev_init)(struct pci_dev *dev) = NULL;
+ 
+ int pcibios_plat_dev_init(struct pci_dev *dev)
+ {
++#ifdef CONFIG_PCIE_LANTIQ
++	if (pci_find_capability(dev, PCI_CAP_ID_EXP))
++		ifx_pcie_bios_plat_dev_init(dev);
++#endif
++
+ 	if (ltq_pci_plat_arch_init)
+ 		return ltq_pci_plat_arch_init(dev);
+ 
+@@ -23,5 +30,10 @@ int pcibios_plat_dev_init(struct pci_dev
+ 
+ int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+ {
++#ifdef CONFIG_PCIE_LANTIQ
++	if (pci_find_capability((struct pci_dev *)dev, PCI_CAP_ID_EXP))
++		return ifx_pcie_bios_map_irq(dev, slot, pin);
++#endif
++
+ 	return of_irq_parse_and_map_pci(dev, slot, pin);
+ }
+--- /dev/null
++++ b/arch/mips/pci/ifxmips_pci_common.h
+@@ -0,0 +1,53 @@
++/******************************************************************************
++**
++** FILE NAME    : ifxmips_pci_common.h
++** PROJECT      : IFX UEIP
++** MODULES      : PCI subsystem
++**
++** DATE         : 30 June 2009
++** AUTHOR       : Lei Chuanhua
++** DESCRIPTION  : PCIe Root Complex Driver
++** COPYRIGHT    :       Copyright (c) 2009
++**                      Infineon Technologies AG
++**                      Am Campeon 1-12, 85579 Neubiberg, Germany
++**
++**    This program is free software; you can redistribute it and/or modify
++**    it under the terms of the GNU General Public License as published by
++**    the Free Software Foundation; either version 2 of the License, or
++**    (at your option) any later version.
++** HISTORY
++** $Version $Date        $Author         $Comment
++** 0.0.1    30 June,2009  Lei Chuanhua    Initial version
++*******************************************************************************/
++
++#ifndef IFXMIPS_PCI_COMMON_H
++#define IFXMIPS_PCI_COMMON_H
++#include <linux/version.h>
++/*!
++ \defgroup IFX_PCI_COM  IFX PCI/PCIe common parts for OS integration  
++ \brief  PCI/PCIe common parts
++*/
++
++/*!
++ \defgroup IFX_PCI_COM_OS OS APIs
++ \ingroup IFX_PCI_COM
++ \brief PCI/PCIe bus driver OS interface functions
++*/
++/*!
++  \file ifxmips_pci_common.h
++  \ingroup IFX_PCI_COM
++  \brief PCI/PCIe bus driver common OS header file
++*/
++#define IFX_PCI_CONST const
++#ifdef CONFIG_IFX_PCI
++extern int ifx_pci_bios_map_irq(IFX_PCI_CONST struct pci_dev *dev, u8 slot, u8 pin);
++extern int ifx_pci_bios_plat_dev_init(struct pci_dev *dev);
++#endif /* COFNIG_IFX_PCI */
++
++#ifdef CONFIG_PCIE_LANTIQ
++extern int ifx_pcie_bios_map_irq(IFX_PCI_CONST struct pci_dev *dev, u8 slot, u8 pin);
++extern int ifx_pcie_bios_plat_dev_init(struct pci_dev *dev);
++#endif
++
++#endif /* IFXMIPS_PCI_COMMON_H */
++
+--- /dev/null
++++ b/arch/mips/pci/ifxmips_pcie.c
+@@ -0,0 +1,1091 @@
++/*
++ *  This program is free software; you can redistribute it and/or modify it
++ *  under the terms of the GNU General Public License version 2 as published
++ *  by the Free Software Foundation.
++ *
++ *  Copyright (C) 2009 Lei Chuanhua <chuanhua.lei@infineon.com>
++ *  Copyright (C) 2013 John Crispin <blogic@openwrt.org>
++ */
++
++#include <linux/types.h>
++#include <linux/pci.h>
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/delay.h>
++#include <linux/mm.h>
++#include <asm/paccess.h>
++#include <linux/pci.h>
++#include <linux/pci_regs.h>
++#include <linux/module.h>
++
++#include "ifxmips_pcie.h"
++#include "ifxmips_pcie_reg.h"
++
++/* Enable 32bit io due to its mem mapped io nature */
++#define IFX_PCIE_ERROR_INT
++#define IFX_PCIE_IO_32BIT
++
++#define IFX_PCIE_IR                     (INT_NUM_IM4_IRL0 + 25)
++#define IFX_PCIE_INTA                   (INT_NUM_IM4_IRL0 + 8)
++#define IFX_PCIE_INTB                   (INT_NUM_IM4_IRL0 + 9)
++#define IFX_PCIE_INTC                   (INT_NUM_IM4_IRL0 + 10)
++#define IFX_PCIE_INTD                   (INT_NUM_IM4_IRL0 + 11)
++#define MS(_v, _f)  (((_v) & (_f)) >> _f##_S)
++#define SM(_v, _f)  (((_v) << _f##_S) & (_f))
++#define IFX_REG_SET_BIT(_f, _r) \
++	IFX_REG_W32((IFX_REG_R32((_r)) &~ (_f)) | (_f), (_r))
++
++#define IFX_PCIE_LTSSM_ENABLE_TIMEOUT 10
++
++static DEFINE_SPINLOCK(ifx_pcie_lock);
++
++u32 g_pcie_debug_flag = PCIE_MSG_ANY & (~PCIE_MSG_CFG);
++
++static ifx_pcie_irq_t pcie_irqs[IFX_PCIE_CORE_NR] = {
++    {
++        .ir_irq = {
++            .irq  = IFX_PCIE_IR,
++            .name = "ifx_pcie_rc0",
++        },
++
++        .legacy_irq = {
++            {
++                .irq_bit = PCIE_IRN_INTA,
++                .irq     = IFX_PCIE_INTA,
++            },
++            {
++                .irq_bit = PCIE_IRN_INTB,
++                .irq     = IFX_PCIE_INTB,
++            },
++            {
++                .irq_bit = PCIE_IRN_INTC,
++                .irq     = IFX_PCIE_INTC,
++            },
++            {
++                .irq_bit = PCIE_IRN_INTD,
++                .irq     = IFX_PCIE_INTD,
++            },
++        },
++    },
++
++};
++
++void ifx_pcie_debug(const char *fmt, ...)
++{
++	static char buf[256] = {0};      /* XXX */
++	va_list ap;
++
++	va_start(ap, fmt);
++	vsnprintf(buf, sizeof(buf), fmt, ap);
++	va_end(ap);
++
++	printk("%s", buf);
++}
++
++
++static inline int pcie_ltssm_enable(int pcie_port)
++{
++	int i;
++
++	/* Enable LTSSM */
++	IFX_REG_W32(PCIE_RC_CCR_LTSSM_ENABLE, PCIE_RC_CCR(pcie_port));
++
++	/* Wait for the link to come up */
++	for (i = 0; i < IFX_PCIE_LTSSM_ENABLE_TIMEOUT; i++) {
++		if (!(IFX_REG_R32(PCIE_LCTLSTS(pcie_port)) & PCIE_LCTLSTS_RETRAIN_PENDING))
++			return 0;
++		udelay(10);
++	}
++
++	printk("%s link timeout!!!!!\n", __func__);
++	return -1;
++}
++
++static inline void pcie_status_register_clear(int pcie_port)
++{
++	IFX_REG_W32(0, PCIE_RC_DR(pcie_port));
++	IFX_REG_W32(0, PCIE_PCICMDSTS(pcie_port));
++	IFX_REG_W32(0, PCIE_DCTLSTS(pcie_port));
++	IFX_REG_W32(0, PCIE_LCTLSTS(pcie_port));
++	IFX_REG_W32(0, PCIE_SLCTLSTS(pcie_port));
++	IFX_REG_W32(0, PCIE_RSTS(pcie_port));
++	IFX_REG_W32(0, PCIE_UES_R(pcie_port));
++	IFX_REG_W32(0, PCIE_UEMR(pcie_port));
++	IFX_REG_W32(0, PCIE_UESR(pcie_port));
++	IFX_REG_W32(0, PCIE_CESR(pcie_port));
++	IFX_REG_W32(0, PCIE_CEMR(pcie_port));
++	IFX_REG_W32(0, PCIE_RESR(pcie_port));
++	IFX_REG_W32(0, PCIE_PVCCRSR(pcie_port));
++	IFX_REG_W32(0, PCIE_VC0_RSR0(pcie_port));
++	IFX_REG_W32(0, PCIE_TPFCS(pcie_port));
++	IFX_REG_W32(0, PCIE_TNPFCS(pcie_port));
++	IFX_REG_W32(0, PCIE_TCFCS(pcie_port));
++	IFX_REG_W32(0, PCIE_QSR(pcie_port));
++	IFX_REG_W32(0, PCIE_IOBLSECS(pcie_port));
++}
++
++static inline int ifx_pcie_link_up(int pcie_port)
++{
++    return (IFX_REG_R32(PCIE_PHY_SR(pcie_port)) & PCIE_PHY_SR_PHY_LINK_UP) ? 1 : 0;
++}
++
++
++static inline void pcie_mem_io_setup(int pcie_port)
++{
++    u32 reg;
++    /*
++     * BAR[0:1] readonly register 
++     * RC contains only minimal BARs for packets mapped to this device 
++     * Mem/IO filters defines a range of memory occupied by memory mapped IO devices that
++     * reside on the downstream side fo the bridge.
++     */
++    reg = SM((PCIE_MEM_PHY_PORT_TO_END(pcie_port) >> 20), PCIE_MBML_MEM_LIMIT_ADDR)
++        | SM((PCIE_MEM_PHY_PORT_TO_BASE(pcie_port) >> 20), PCIE_MBML_MEM_BASE_ADDR);
++
++    IFX_REG_W32(reg, PCIE_MBML(pcie_port));
++
++
++#ifdef IFX_PCIE_PREFETCH_MEM_64BIT
++    reg = SM((PCIE_MEM_PHY_PORT_TO_END(pcie_port) >> 20), PCIE_PMBL_END_ADDR)
++        | SM((PCIE_MEM_PHY_PORT_TO_BASE(pcie_port) >> 20), PCIE_PMBL_UPPER_12BIT)
++        | PCIE_PMBL_64BIT_ADDR;
++    IFX_REG_W32(reg, PCIE_PMBL(pcie_port));
++
++    /* Must configure upper 32bit */
++    IFX_REG_W32(0, PCIE_PMBU32(pcie_port));
++    IFX_REG_W32(0, PCIE_PMLU32(pcie_port));
++#else
++    /* PCIe_PBML, same as MBML */
++    IFX_REG_W32(IFX_REG_R32(PCIE_MBML(pcie_port)), PCIE_PMBL(pcie_port));
++#endif 
++
++    /* IO Address Range */
++    reg = SM((PCIE_IO_PHY_PORT_TO_END(pcie_port) >> 12), PCIE_IOBLSECS_IO_LIMIT_ADDR)
++        | SM((PCIE_IO_PHY_PORT_TO_BASE(pcie_port) >> 12), PCIE_IOBLSECS_IO_BASE_ADDR);
++#ifdef IFX_PCIE_IO_32BIT    
++    reg |= PCIE_IOBLSECS_32BIT_IO_ADDR;
++#endif /* IFX_PCIE_IO_32BIT */
++    IFX_REG_W32(reg, PCIE_IOBLSECS(pcie_port));
++
++#ifdef IFX_PCIE_IO_32BIT
++    reg = SM((PCIE_IO_PHY_PORT_TO_END(pcie_port) >> 16), PCIE_IO_BANDL_UPPER_16BIT_IO_LIMIT)
++        | SM((PCIE_IO_PHY_PORT_TO_BASE(pcie_port) >> 16), PCIE_IO_BANDL_UPPER_16BIT_IO_BASE);
++    IFX_REG_W32(reg, PCIE_IO_BANDL(pcie_port));
++
++#endif /* IFX_PCIE_IO_32BIT */
++}
++
++static inline void
++pcie_device_setup(int pcie_port)
++{
++    u32 reg;
++
++    /* Device capability register, set up Maximum payload size */
++    reg = IFX_REG_R32(PCIE_DCAP(pcie_port));
++    reg |= PCIE_DCAP_ROLE_BASE_ERR_REPORT;
++    reg |= SM(PCIE_MAX_PAYLOAD_128, PCIE_DCAP_MAX_PAYLOAD_SIZE);
++
++    /* Only available for EP */
++    reg &= ~(PCIE_DCAP_EP_L0S_LATENCY | PCIE_DCAP_EP_L1_LATENCY);
++    IFX_REG_W32(reg, PCIE_DCAP(pcie_port));
++
++    /* Device control and status register */
++    /* Set Maximum Read Request size for the device as a Requestor */
++    reg = IFX_REG_R32(PCIE_DCTLSTS(pcie_port));
++
++    /* 
++     * Request size can be larger than the MPS used, but the completions returned 
++     * for the read will be bounded by the MPS size.
++     * In our system, Max request size depends on AHB burst size. It is 64 bytes.
++     * but we set it as 128 as minimum one.
++     */
++    reg |= SM(PCIE_MAX_PAYLOAD_128, PCIE_DCTLSTS_MAX_READ_SIZE)
++            | SM(PCIE_MAX_PAYLOAD_128, PCIE_DCTLSTS_MAX_PAYLOAD_SIZE);
++
++    /* Enable relaxed ordering, no snoop, and all kinds of errors */
++    reg |= PCIE_DCTLSTS_RELAXED_ORDERING_EN | PCIE_DCTLSTS_ERR_EN | PCIE_DCTLSTS_NO_SNOOP_EN;
++
++    IFX_REG_W32(reg, PCIE_DCTLSTS(pcie_port));
++}
++
++static inline void
++pcie_link_setup(int pcie_port)
++{
++    u32 reg;
++
++    /*
++     * XXX, Link capability register, bit 18 for EP CLKREQ# dynamic clock management for L1, L2/3 CPM 
++     * L0s is reported during link training via TS1 order set by N_FTS
++     */
++    reg = IFX_REG_R32(PCIE_LCAP(pcie_port));
++    reg &= ~PCIE_LCAP_L0S_EIXT_LATENCY;
++    reg |= SM(3, PCIE_LCAP_L0S_EIXT_LATENCY);
++    IFX_REG_W32(reg, PCIE_LCAP(pcie_port));
++
++    /* Link control and status register */
++    reg = IFX_REG_R32(PCIE_LCTLSTS(pcie_port));
++
++    /* Link Enable, ASPM enabled  */
++    reg &= ~PCIE_LCTLSTS_LINK_DISABLE;
++
++#ifdef CONFIG_PCIEASPM
++    /*  
++     * We use the same physical reference clock that the platform provides on the connector 
++     * It paved the way for ASPM to calculate the new exit Latency
++     */
++    reg |= PCIE_LCTLSTS_SLOT_CLK_CFG;
++    reg |= PCIE_LCTLSTS_COM_CLK_CFG;
++    /*
++     * We should disable ASPM by default except that we have dedicated power management support
++     * Enable ASPM will cause the system hangup/instability, performance degration
++     */
++    reg |= PCIE_LCTLSTS_ASPM_ENABLE;
++#else
++    reg &= ~PCIE_LCTLSTS_ASPM_ENABLE;
++#endif /* CONFIG_PCIEASPM */
++
++    /* 
++     * The maximum size of any completion with data packet is bounded by the MPS setting 
++     * in  device control register 
++     */
++
++    /* RCB may cause multiple split transactions, two options available, we use 64 byte RCB */
++    reg &= ~ PCIE_LCTLSTS_RCB128;
++
++    IFX_REG_W32(reg, PCIE_LCTLSTS(pcie_port));
++}
++
++static inline void pcie_error_setup(int pcie_port)
++{
++	u32 reg;
++
++	/* 
++	* Forward ERR_COR, ERR_NONFATAL, ERR_FATAL to the backbone 
++	* Poisoned write TLPs and completions indicating poisoned TLPs will set the PCIe_PCICMDSTS.MDPE 
++	*/
++	reg = IFX_REG_R32(PCIE_INTRBCTRL(pcie_port));
++	reg |= PCIE_INTRBCTRL_SERR_ENABLE | PCIE_INTRBCTRL_PARITY_ERR_RESP_ENABLE;
++
++	IFX_REG_W32(reg, PCIE_INTRBCTRL(pcie_port));
++
++	/* Uncorrectable Error Mask Register, Unmask <enable> all bits in PCIE_UESR */
++	reg = IFX_REG_R32(PCIE_UEMR(pcie_port));
++	reg &= ~PCIE_ALL_UNCORRECTABLE_ERR;
++	IFX_REG_W32(reg, PCIE_UEMR(pcie_port));
++
++	/* Uncorrectable Error Severity Register, ALL errors are FATAL */
++	IFX_REG_W32(PCIE_ALL_UNCORRECTABLE_ERR, PCIE_UESR(pcie_port));
++
++	/* Correctable Error Mask Register, unmask <enable> all bits */
++	reg = IFX_REG_R32(PCIE_CEMR(pcie_port));
++	reg &= ~PCIE_CORRECTABLE_ERR;
++	IFX_REG_W32(reg, PCIE_CEMR(pcie_port));
++
++	/* Advanced Error Capabilities and Control Registr */
++	reg = IFX_REG_R32(PCIE_AECCR(pcie_port));
++	reg |= PCIE_AECCR_ECRC_CHECK_EN | PCIE_AECCR_ECRC_GEN_EN;
++	IFX_REG_W32(reg, PCIE_AECCR(pcie_port));
++
++	/* Root Error Command Register, Report all types of errors */
++	reg = IFX_REG_R32(PCIE_RECR(pcie_port));
++	reg |= PCIE_RECR_ERR_REPORT_EN;
++	IFX_REG_W32(reg, PCIE_RECR(pcie_port));
++
++	/* Clear the Root status register */
++	reg = IFX_REG_R32(PCIE_RESR(pcie_port));
++	IFX_REG_W32(reg, PCIE_RESR(pcie_port));
++}
++
++static inline void pcie_port_logic_setup(int pcie_port)
++{
++	u32 reg;
++
++	/* FTS number, default 12, increase to 63, may increase time from/to L0s to L0  */
++	reg = IFX_REG_R32(PCIE_AFR(pcie_port));
++	reg &= ~(PCIE_AFR_FTS_NUM | PCIE_AFR_COM_FTS_NUM);
++	reg |= SM(PCIE_AFR_FTS_NUM_DEFAULT, PCIE_AFR_FTS_NUM)
++		| SM(PCIE_AFR_FTS_NUM_DEFAULT, PCIE_AFR_COM_FTS_NUM);
++	/* L0s and L1 entry latency */
++	reg &= ~(PCIE_AFR_L0S_ENTRY_LATENCY | PCIE_AFR_L1_ENTRY_LATENCY);
++	reg |= SM(PCIE_AFR_L0S_ENTRY_LATENCY_DEFAULT, PCIE_AFR_L0S_ENTRY_LATENCY)
++		| SM(PCIE_AFR_L1_ENTRY_LATENCY_DEFAULT, PCIE_AFR_L1_ENTRY_LATENCY);
++	IFX_REG_W32(reg, PCIE_AFR(pcie_port));
++
++
++	/* Port Link Control Register */
++	reg = IFX_REG_R32(PCIE_PLCR(pcie_port));
++	reg |= PCIE_PLCR_DLL_LINK_EN;  /* Enable the DLL link */
++	IFX_REG_W32(reg, PCIE_PLCR(pcie_port));
++
++	/* Lane Skew Register */
++	reg = IFX_REG_R32(PCIE_LSR(pcie_port));
++	/* Enable ACK/NACK and FC */
++	reg &= ~(PCIE_LSR_ACKNAK_DISABLE | PCIE_LSR_FC_DISABLE);
++	IFX_REG_W32(reg, PCIE_LSR(pcie_port));
++
++	/* Symbol Timer Register and Filter Mask Register 1 */
++	reg = IFX_REG_R32(PCIE_STRFMR(pcie_port));
++
++	/* Default SKP interval is very accurate already, 5us */
++	/* Enable IO/CFG transaction */
++	reg |= PCIE_STRFMR_RX_CFG_TRANS_ENABLE | PCIE_STRFMR_RX_IO_TRANS_ENABLE;
++	/* Disable FC WDT */
++	reg &= ~PCIE_STRFMR_FC_WDT_DISABLE;
++	IFX_REG_W32(reg, PCIE_STRFMR(pcie_port));
++
++	/* Filter Masker Register 2 */
++	reg = IFX_REG_R32(PCIE_FMR2(pcie_port));
++	reg |= PCIE_FMR2_VENDOR_MSG1_PASSED_TO_TRGT1 | PCIE_FMR2_VENDOR_MSG0_PASSED_TO_TRGT1;
++	IFX_REG_W32(reg, PCIE_FMR2(pcie_port));
++
++	/* VC0 Completion Receive Queue Control Register */
++	reg = IFX_REG_R32(PCIE_VC0_CRQCR(pcie_port));
++	reg &= ~PCIE_VC0_CRQCR_CPL_TLP_QUEUE_MODE;
++	reg |= SM(PCIE_VC0_TLP_QUEUE_MODE_BYPASS, PCIE_VC0_CRQCR_CPL_TLP_QUEUE_MODE);
++	IFX_REG_W32(reg, PCIE_VC0_CRQCR(pcie_port));
++}
++
++static inline void pcie_rc_cfg_reg_setup(int pcie_port)
++{
++	u32 reg;
++
++	/* Disable LTSSM */
++	IFX_REG_W32(0, PCIE_RC_CCR(pcie_port)); /* Disable LTSSM */
++
++	pcie_mem_io_setup(pcie_port);
++
++	/* XXX, MSI stuff should only apply to EP */
++	/* MSI Capability: Only enable 32-bit addresses */
++	reg = IFX_REG_R32(PCIE_MCAPR(pcie_port));
++	reg &= ~PCIE_MCAPR_ADDR64_CAP;
++
++	reg |= PCIE_MCAPR_MSI_ENABLE;
++
++	/* Disable multiple message */
++	reg &= ~(PCIE_MCAPR_MULTI_MSG_CAP | PCIE_MCAPR_MULTI_MSG_ENABLE);
++	IFX_REG_W32(reg, PCIE_MCAPR(pcie_port));
++
++
++	/* Enable PME, Soft reset enabled */
++	reg = IFX_REG_R32(PCIE_PM_CSR(pcie_port));
++	reg |= PCIE_PM_CSR_PME_ENABLE | PCIE_PM_CSR_SW_RST;
++	IFX_REG_W32(reg, PCIE_PM_CSR(pcie_port));
++
++	/* setup the bus */
++	reg = SM(0, PCIE_BNR_PRIMARY_BUS_NUM) | SM(1, PCIE_PNR_SECONDARY_BUS_NUM) | SM(0xFF, PCIE_PNR_SUB_BUS_NUM);
++	IFX_REG_W32(reg, PCIE_BNR(pcie_port));
++
++
++	pcie_device_setup(pcie_port);
++	pcie_link_setup(pcie_port);
++	pcie_error_setup(pcie_port);
++
++	/* Root control and capabilities register */
++	reg = IFX_REG_R32(PCIE_RCTLCAP(pcie_port));
++	reg |= PCIE_RCTLCAP_SERR_ENABLE | PCIE_RCTLCAP_PME_INT_EN;
++	IFX_REG_W32(reg, PCIE_RCTLCAP(pcie_port));
++
++	/* Port VC Capability Register 2 */
++	reg = IFX_REG_R32(PCIE_PVC2(pcie_port));
++	reg &= ~PCIE_PVC2_VC_ARB_WRR;
++	reg |= PCIE_PVC2_VC_ARB_16P_FIXED_WRR;
++	IFX_REG_W32(reg, PCIE_PVC2(pcie_port));
++
++	/* VC0 Resource Capability Register */
++	reg = IFX_REG_R32(PCIE_VC0_RC(pcie_port));
++	reg &= ~PCIE_VC0_RC_REJECT_SNOOP;
++	IFX_REG_W32(reg, PCIE_VC0_RC(pcie_port));
++
++	pcie_port_logic_setup(pcie_port);
++}
++
++static int ifx_pcie_wait_phy_link_up(int pcie_port)
++{
++#define IFX_PCIE_PHY_LINK_UP_TIMEOUT  1000 /* XXX, tunable */
++    int i;
++
++    /* Wait for PHY link is up */
++    for (i = 0; i < IFX_PCIE_PHY_LINK_UP_TIMEOUT; i++) {
++        if (ifx_pcie_link_up(pcie_port)) {
++            break;
++        }
++        udelay(100);
++    }
++    if (i >= IFX_PCIE_PHY_LINK_UP_TIMEOUT) {
++        printk(KERN_ERR "%s timeout\n", __func__);
++        return -1;
++    }
++
++    /* Check data link up or not */
++    if (!(IFX_REG_R32(PCIE_RC_DR(pcie_port)) & PCIE_RC_DR_DLL_UP)) {
++        printk(KERN_ERR "%s DLL link is still down\n", __func__);
++        return -1;
++    }
++
++    /* Check Data link active or not */
++    if (!(IFX_REG_R32(PCIE_LCTLSTS(pcie_port)) & PCIE_LCTLSTS_DLL_ACTIVE)) {
++        printk(KERN_ERR "%s DLL is not active\n", __func__);
++        return -1;
++    }
++    return 0;
++}
++
++static inline int pcie_app_loigc_setup(int pcie_port)
++{
++	/* supress ahb bus errrors */
++	IFX_REG_W32(PCIE_AHB_CTRL_BUS_ERROR_SUPPRESS, PCIE_AHB_CTRL(pcie_port));
++
++	/* Pull PCIe EP out of reset */
++	pcie_device_rst_deassert(pcie_port);
++
++	/* Start LTSSM training between RC and EP */
++	pcie_ltssm_enable(pcie_port);
++
++	/* Check PHY status after enabling LTSSM */
++	if (ifx_pcie_wait_phy_link_up(pcie_port) != 0)
++		return -1;
++
++	return 0;
++}
++
++/*
++ * The numbers below are directly from the PCIe spec table 3-4/5. 
++ */
++static inline void pcie_replay_time_update(int pcie_port)
++{
++	u32 reg;
++	int nlw;
++	int rtl;
++
++	reg = IFX_REG_R32(PCIE_LCTLSTS(pcie_port));
++
++	nlw = MS(reg, PCIE_LCTLSTS_NEGOTIATED_LINK_WIDTH);
++	switch (nlw) {
++	case PCIE_MAX_LENGTH_WIDTH_X1:
++		rtl = 1677;
++		break;
++	case PCIE_MAX_LENGTH_WIDTH_X2:
++		rtl = 867;
++		break;
++	case PCIE_MAX_LENGTH_WIDTH_X4:
++		rtl = 462;
++		break;
++	case PCIE_MAX_LENGTH_WIDTH_X8:
++		rtl = 258;
++		break;
++	default:
++		rtl = 1677;
++		break;
++	}
++	reg = IFX_REG_R32(PCIE_ALTRT(pcie_port));
++	reg &= ~PCIE_ALTRT_REPLAY_TIME_LIMIT;
++	reg |= SM(rtl, PCIE_ALTRT_REPLAY_TIME_LIMIT);
++	IFX_REG_W32(reg, PCIE_ALTRT(pcie_port));
++}
++
++/*
++ * Table 359 Enhanced Configuration Address Mapping1)
++ * 1) This table is defined in Table 7-1, page 341, PCI Express Base Specification v1.1
++ * Memory Address PCI Express Configuration Space
++ * A[(20+n-1):20] Bus Number 1 < n < 8
++ * A[19:15] Device Number
++ * A[14:12] Function Number
++ * A[11:8] Extended Register Number
++ * A[7:2] Register Number
++ * A[1:0] Along with size of the access, used to generate Byte Enables
++ * For VR9, only the address bits [22:0] are mapped to the configuration space:
++ * . Address bits [22:20] select the target bus (1-of-8)1)
++ * . Address bits [19:15] select the target device (1-of-32) on the bus
++ * . Address bits [14:12] select the target function (1-of-8) within the device.
++ * . Address bits [11:2] selects the target dword (1-of-1024) within the selected function.s configuration space
++ * . Address bits [1:0] define the start byte location within the selected dword.
++ */
++static inline u32 pcie_bus_addr(u8 bus_num, u16 devfn, int where)
++{
++	u32 addr;
++	u8  bus;
++
++	if (!bus_num) {
++		/* type 0 */
++		addr = ((PCI_SLOT(devfn) & 0x1F) << 15) | ((PCI_FUNC(devfn) & 0x7) << 12) | ((where & 0xFFF)& ~3);
++	} else {
++		bus = bus_num;
++		/* type 1, only support 8 buses  */
++		addr = ((bus & 0x7) << 20) | ((PCI_SLOT(devfn) & 0x1F) << 15) |
++			((PCI_FUNC(devfn) & 0x7) << 12) | ((where & 0xFFF) & ~3);
++	}
++	return addr;
++}
++
++static int pcie_valid_config(int pcie_port, int bus, int dev)
++{
++	/* RC itself */
++	if ((bus == 0) && (dev == 0)) {
++		return 1;
++	}
++
++	/* No physical link */
++	if (!ifx_pcie_link_up(pcie_port)) {
++		return 0;
++	}
++
++	/* Bus zero only has RC itself
++	* XXX, check if EP will be integrated 
++	*/
++	if ((bus == 0) && (dev != 0)) {
++		return 0;
++	}
++
++	/* Maximum 8 buses supported for VRX */
++	if (bus > 9) {
++		return 0;
++	}
++
++	/* 
++	 * PCIe is PtP link, one bus only supports only one device 
++	 * except bus zero and PCIe switch which is virtual bus device
++	 * The following two conditions really depends on the system design
++	 * and attached the device.
++	 * XXX, how about more new switch
++	*/
++	if ((bus == 1) && (dev != 0)) {
++		return 0;
++	}
++
++	if ((bus >= 3) && (dev != 0)) {
++		return 0;
++	}
++	return 1;
++}
++
++static inline u32 ifx_pcie_cfg_rd(int pcie_port, u32 reg)
++{
++    return IFX_REG_R32((volatile u32 *)(PCIE_CFG_PORT_TO_BASE(pcie_port) + reg));
++}
++
++static inline void ifx_pcie_cfg_wr(int pcie_port, unsigned int reg, u32 val)
++{
++    IFX_REG_W32( val, (volatile u32 *)(PCIE_CFG_PORT_TO_BASE(pcie_port) + reg));
++}
++
++static inline u32 ifx_pcie_rc_cfg_rd(int pcie_port, u32 reg)
++{
++    return IFX_REG_R32((volatile u32 *)(PCIE_RC_PORT_TO_BASE(pcie_port) + reg));
++}
++
++static inline void ifx_pcie_rc_cfg_wr(int pcie_port, unsigned int reg, u32 val)
++{
++	IFX_REG_W32(val, (volatile u32 *)(PCIE_RC_PORT_TO_BASE(pcie_port) + reg));
++}
++
++u32 ifx_pcie_bus_enum_read_hack(int where, u32 value)
++{
++	u32 tvalue = value;
++
++	if (where == PCI_PRIMARY_BUS) {
++		u8 primary, secondary, subordinate;
++
++		primary = tvalue & 0xFF;
++		secondary = (tvalue >> 8) & 0xFF;
++		subordinate = (tvalue >> 16) & 0xFF;
++		primary += pcibios_1st_host_bus_nr();
++		secondary += pcibios_1st_host_bus_nr();
++		subordinate += pcibios_1st_host_bus_nr();
++		tvalue = (tvalue & 0xFF000000) | (u32)primary | (u32)(secondary << 8) | (u32)(subordinate << 16);
++	}
++	return tvalue;
++}
++
++u32 ifx_pcie_bus_enum_write_hack(int where, u32 value)
++{
++    u32 tvalue = value;
++
++    if (where == PCI_PRIMARY_BUS) {
++        u8 primary, secondary, subordinate;
++
++        primary = tvalue & 0xFF;
++        secondary = (tvalue >> 8) & 0xFF;
++        subordinate = (tvalue >> 16) & 0xFF;
++        if (primary > 0 && primary != 0xFF) {
++            primary -= pcibios_1st_host_bus_nr();
++        }
++
++        if (secondary > 0 && secondary != 0xFF) {
++            secondary -= pcibios_1st_host_bus_nr();
++        }
++        if (subordinate > 0 && subordinate != 0xFF) {
++            subordinate -= pcibios_1st_host_bus_nr();
++        }
++        tvalue = (tvalue & 0xFF000000) | (u32)primary | (u32)(secondary << 8) | (u32)(subordinate << 16);
++    }
++    else if (where == PCI_SUBORDINATE_BUS) {
++        u8 subordinate = tvalue & 0xFF;
++
++        subordinate = subordinate > 0 ? subordinate - pcibios_1st_host_bus_nr() : 0;
++        tvalue = subordinate;
++    }
++    return tvalue;
++}
++
++static int ifx_pcie_read_config(struct pci_bus *bus, u32 devfn,
++				int where, int size, u32 *value)
++{
++    u32 data = 0;
++    int bus_number = bus->number;
++    static const u32 mask[8] = {0, 0xff, 0xffff, 0, 0xffffffff, 0, 0, 0};
++    int ret = PCIBIOS_SUCCESSFUL;
++    struct ifx_pci_controller *ctrl = bus->sysdata;
++    int pcie_port = ctrl->port;
++
++    if (unlikely(size != 1 && size != 2 && size != 4)){
++        ret = PCIBIOS_BAD_REGISTER_NUMBER;
++        goto out;
++    }
++
++    /* Make sure the address is aligned to natural boundary */
++    if (unlikely(((size - 1) & where))) {
++        ret = PCIBIOS_BAD_REGISTER_NUMBER;
++        goto out;
++    }
++
++    /* 
++     * If we are second controller, we have to cheat OS so that it assume 
++     * its bus number starts from 0 in host controller
++     */
++    bus_number = ifx_pcie_bus_nr_deduct(bus_number, pcie_port);
++
++    /* 
++     * We need to force the bus number to be zero on the root 
++     * bus. Linux numbers the 2nd root bus to start after all 
++     * busses on root 0. 
++     */ 
++    if (bus->parent == NULL) {
++        bus_number = 0; 
++    }
++
++    /* 
++     * PCIe only has a single device connected to it. It is 
++     * always device ID 0. Don't bother doing reads for other 
++     * device IDs on the first segment. 
++     */ 
++    if ((bus_number == 0) && (PCI_SLOT(devfn) != 0)) {
++        ret = PCIBIOS_FUNC_NOT_SUPPORTED;
++        goto out; 
++    }
++
++    if (pcie_valid_config(pcie_port, bus_number, PCI_SLOT(devfn)) == 0) {
++        *value = 0xffffffff;
++        ret = PCIBIOS_DEVICE_NOT_FOUND;
++        goto out;
++    }
++
++    PCIE_IRQ_LOCK(ifx_pcie_lock);
++    if (bus_number == 0) { /* RC itself */
++        u32 t;
++
++        t = (where & ~3);
++        data = ifx_pcie_rc_cfg_rd(pcie_port, t);
++    } else {
++        u32 addr = pcie_bus_addr(bus_number, devfn, where);
++
++        data = ifx_pcie_cfg_rd(pcie_port, addr);
++    #ifdef CONFIG_IFX_PCIE_HW_SWAP
++            data = le32_to_cpu(data);
++    #endif /* CONFIG_IFX_PCIE_HW_SWAP */
++    }
++    /* To get a correct PCI topology, we have to restore the bus number to OS */
++    data = ifx_pcie_bus_enum_hack(bus, devfn, where, data, pcie_port, 1);
++
++    PCIE_IRQ_UNLOCK(ifx_pcie_lock);
++
++    *value = (data >> (8 * (where & 3))) & mask[size & 7];
++out:
++    return ret;
++}
++
++static u32 ifx_pcie_size_to_value(int where, int size, u32 data, u32 value)
++{
++	u32 shift;
++	u32 tdata = data;
++
++	switch (size) {
++	case 1:
++		shift = (where & 0x3) << 3;
++		tdata &= ~(0xffU << shift);
++		tdata |= ((value & 0xffU) << shift);
++		break;
++	case 2:
++		shift = (where & 3) << 3;
++		tdata &= ~(0xffffU << shift);
++		tdata |= ((value & 0xffffU) << shift);
++		break;
++	case 4:
++		tdata = value;
++		break;
++	}
++	return tdata;
++}
++
++static int ifx_pcie_write_config(struct pci_bus *bus, u32 devfn,
++				int where, int size, u32 value)
++{
++	int bus_number = bus->number;
++	int ret = PCIBIOS_SUCCESSFUL;
++	struct ifx_pci_controller *ctrl = bus->sysdata;
++	int pcie_port = ctrl->port;
++	u32 tvalue = value;
++	u32 data;
++
++	/* Make sure the address is aligned to natural boundary */
++	if (unlikely(((size - 1) & where))) {
++		ret = PCIBIOS_BAD_REGISTER_NUMBER;
++		goto out;
++	}
++	/* 
++	* If we are second controller, we have to cheat OS so that it assume 
++	* its bus number starts from 0 in host controller
++	*/
++	bus_number = ifx_pcie_bus_nr_deduct(bus_number, pcie_port);
++
++	/* 
++	* We need to force the bus number to be zero on the root 
++	* bus. Linux numbers the 2nd root bus to start after all 
++	* busses on root 0. 
++	*/ 
++	if (bus->parent == NULL) {
++		bus_number = 0; 
++	}
++
++	if (pcie_valid_config(pcie_port, bus_number, PCI_SLOT(devfn)) == 0) {
++		ret = PCIBIOS_DEVICE_NOT_FOUND;
++		goto out;
++	}
++
++	/* XXX, some PCIe device may need some delay */
++	PCIE_IRQ_LOCK(ifx_pcie_lock);
++
++	/* 
++	* To configure the correct bus topology using native way, we have to cheat Os so that
++	* it can configure the PCIe hardware correctly.
++	*/
++	tvalue = ifx_pcie_bus_enum_hack(bus, devfn, where, value, pcie_port, 0);
++
++	if (bus_number == 0) { /* RC itself */
++		u32 t;
++
++		t = (where & ~3);
++		data = ifx_pcie_rc_cfg_rd(pcie_port, t);
++
++		data = ifx_pcie_size_to_value(where, size, data, tvalue);
++
++		ifx_pcie_rc_cfg_wr(pcie_port, t, data);
++	} else {
++		u32 addr = pcie_bus_addr(bus_number, devfn, where);
++
++		data = ifx_pcie_cfg_rd(pcie_port, addr);
++#ifdef CONFIG_IFX_PCIE_HW_SWAP
++		data = le32_to_cpu(data);
++#endif
++
++		data = ifx_pcie_size_to_value(where, size, data, tvalue);
++#ifdef CONFIG_IFX_PCIE_HW_SWAP
++		data = cpu_to_le32(data);
++#endif
++		ifx_pcie_cfg_wr(pcie_port, addr, data);
++	}
++	PCIE_IRQ_UNLOCK(ifx_pcie_lock);
++out:
++	return ret;
++}
++
++static struct resource ifx_pcie_io_resource = {
++	.name	= "PCIe0 I/O space",
++	.start	= PCIE_IO_PHY_BASE,
++	.end	= PCIE_IO_PHY_END,
++	.flags	= IORESOURCE_IO,
++};
++
++static struct resource ifx_pcie_mem_resource = {
++	.name	= "PCIe0 Memory space",
++	.start	= PCIE_MEM_PHY_BASE,
++	.end	= PCIE_MEM_PHY_END,
++	.flags	= IORESOURCE_MEM,
++};
++
++static struct pci_ops ifx_pcie_ops = {
++	.read	= ifx_pcie_read_config,
++	.write	= ifx_pcie_write_config,
++};
++
++static struct ifx_pci_controller ifx_pcie_controller[IFX_PCIE_CORE_NR] = {
++    {
++        .pcic = {
++            .pci_ops      = &ifx_pcie_ops,
++            .mem_resource = &ifx_pcie_mem_resource,
++            .io_resource  = &ifx_pcie_io_resource,
++         },
++         .port = IFX_PCIE_PORT0,
++    },
++};
++
++#ifdef IFX_PCIE_ERROR_INT
++
++static irqreturn_t pcie_rc_core_isr(int irq, void *dev_id)
++{
++	struct ifx_pci_controller *ctrl = (struct ifx_pci_controller *)dev_id;
++	int pcie_port = ctrl->port;
++	u32 reg;
++
++	pr_debug("PCIe RC error intr %d\n", irq);
++	reg = IFX_REG_R32(PCIE_IRNCR(pcie_port));
++	reg &= PCIE_RC_CORE_COMBINED_INT;
++	IFX_REG_W32(reg, PCIE_IRNCR(pcie_port));
++
++	return IRQ_HANDLED;
++}
++
++static int
++pcie_rc_core_int_init(int pcie_port)
++{
++	int ret;
++
++	/* Enable core interrupt */
++	IFX_REG_SET_BIT(PCIE_RC_CORE_COMBINED_INT, PCIE_IRNEN(pcie_port));
++
++	/* Clear it first */
++	IFX_REG_SET_BIT(PCIE_RC_CORE_COMBINED_INT, PCIE_IRNCR(pcie_port));
++	ret = request_irq(pcie_irqs[pcie_port].ir_irq.irq, pcie_rc_core_isr, 0,
++		pcie_irqs[pcie_port].ir_irq.name, &ifx_pcie_controller[pcie_port]);
++	if (ret)
++		printk(KERN_ERR "%s request irq %d failed\n", __func__, IFX_PCIE_IR);
++
++	return ret;
++}
++#endif
++
++int ifx_pcie_bios_map_irq(IFX_PCI_CONST struct pci_dev *dev, u8 slot, u8 pin)
++{
++	u32 irq_bit = 0;
++	int irq = 0;
++	struct ifx_pci_controller *ctrl = dev->bus->sysdata;
++	int pcie_port = ctrl->port;
++
++	printk("%s port %d dev %s slot %d pin %d \n", __func__, pcie_port, pci_name(dev), slot, pin);
++
++	if ((pin == PCIE_LEGACY_DISABLE) || (pin > PCIE_LEGACY_INT_MAX)) {
++		printk(KERN_WARNING "WARNING: dev %s: invalid interrupt pin %d\n", pci_name(dev), pin);
++		return -1;
++	}
++
++	/* Pin index so minus one */
++	irq_bit = pcie_irqs[pcie_port].legacy_irq[pin - 1].irq_bit;
++	irq = pcie_irqs[pcie_port].legacy_irq[pin - 1].irq;
++	IFX_REG_SET_BIT(irq_bit, PCIE_IRNEN(pcie_port));
++	IFX_REG_SET_BIT(irq_bit, PCIE_IRNCR(pcie_port));
++	printk("%s dev %s irq %d assigned\n", __func__, pci_name(dev), irq);
++	return irq;
++}
++
++int  ifx_pcie_bios_plat_dev_init(struct pci_dev *dev)
++{
++    u16 config;
++#ifdef IFX_PCIE_ERROR_INT
++    u32 dconfig; 
++    int pos;
++#endif
++
++    /* Enable reporting System errors and parity errors on all devices */ 
++    /* Enable parity checking and error reporting */ 
++    pci_read_config_word(dev, PCI_COMMAND, &config);
++    config |= PCI_COMMAND_PARITY | PCI_COMMAND_SERR /*| PCI_COMMAND_INVALIDATE |
++          PCI_COMMAND_FAST_BACK*/;
++    pci_write_config_word(dev, PCI_COMMAND, config);
++
++    if (dev->subordinate) {
++        /* Set latency timers on sub bridges */
++        pci_write_config_byte(dev, PCI_SEC_LATENCY_TIMER, 0x40); /* XXX, */
++        /* More bridge error detection */
++        pci_read_config_word(dev, PCI_BRIDGE_CONTROL, &config);
++        config |= PCI_BRIDGE_CTL_PARITY | PCI_BRIDGE_CTL_SERR;
++        pci_write_config_word(dev, PCI_BRIDGE_CONTROL, config);
++    }
++#ifdef IFX_PCIE_ERROR_INT
++    /* Enable the PCIe normal error reporting */
++    pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
++    if (pos) {
++
++        /* Disable system error generation in response to error messages */
++        pci_read_config_word(dev, pos + PCI_EXP_RTCTL, &config);
++        config &= ~(PCI_EXP_RTCTL_SECEE | PCI_EXP_RTCTL_SENFEE | PCI_EXP_RTCTL_SEFEE);
++        pci_write_config_word(dev, pos + PCI_EXP_RTCTL, config);
++
++        /* Clear PCIE Capability's Device Status */
++        pci_read_config_word(dev, pos + PCI_EXP_DEVSTA, &config);
++        pci_write_config_word(dev, pos + PCI_EXP_DEVSTA, config);
++
++        /* Update Device Control */ 
++        pci_read_config_word(dev, pos + PCI_EXP_DEVCTL, &config);
++        /* Correctable Error Reporting */
++        config |= PCI_EXP_DEVCTL_CERE;
++        /* Non-Fatal Error Reporting */
++        config |= PCI_EXP_DEVCTL_NFERE;
++        /* Fatal Error Reporting */
++        config |= PCI_EXP_DEVCTL_FERE;
++        /* Unsupported Request */
++        config |= PCI_EXP_DEVCTL_URRE;
++        pci_write_config_word(dev, pos + PCI_EXP_DEVCTL, config);
++    }
++
++    /* Find the Advanced Error Reporting capability */
++    pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR);
++    if (pos) {
++        /* Clear Uncorrectable Error Status */ 
++        pci_read_config_dword(dev, pos + PCI_ERR_UNCOR_STATUS, &dconfig);
++        pci_write_config_dword(dev, pos + PCI_ERR_UNCOR_STATUS, dconfig);
++        /* Enable reporting of all uncorrectable errors */
++        /* Uncorrectable Error Mask - turned on bits disable errors */
++        pci_write_config_dword(dev, pos + PCI_ERR_UNCOR_MASK, 0);
++        /* 
++        * Leave severity at HW default. This only controls if 
++        * errors are reported as uncorrectable or 
++        * correctable, not if the error is reported. 
++        */ 
++        /* PCI_ERR_UNCOR_SEVER - Uncorrectable Error Severity */
++        /* Clear Correctable Error Status */
++        pci_read_config_dword(dev, pos + PCI_ERR_COR_STATUS, &dconfig);
++        pci_write_config_dword(dev, pos + PCI_ERR_COR_STATUS, dconfig);
++        /* Enable reporting of all correctable errors */
++        /* Correctable Error Mask - turned on bits disable errors */
++        pci_write_config_dword(dev, pos + PCI_ERR_COR_MASK, 0);
++        /* Advanced Error Capabilities */ 
++        pci_read_config_dword(dev, pos + PCI_ERR_CAP, &dconfig);
++        /* ECRC Generation Enable */
++        if (dconfig & PCI_ERR_CAP_ECRC_GENC) {
++            dconfig |= PCI_ERR_CAP_ECRC_GENE;
++        }
++        /* ECRC Check Enable */
++        if (dconfig & PCI_ERR_CAP_ECRC_CHKC) {
++            dconfig |= PCI_ERR_CAP_ECRC_CHKE;
++        }
++        pci_write_config_dword(dev, pos + PCI_ERR_CAP, dconfig);
++
++        /* PCI_ERR_HEADER_LOG - Header Log Register (16 bytes) */
++        /* Enable Root Port's interrupt in response to error messages */
++        pci_write_config_dword(dev, pos + PCI_ERR_ROOT_COMMAND,
++              PCI_ERR_ROOT_CMD_COR_EN |
++              PCI_ERR_ROOT_CMD_NONFATAL_EN |
++              PCI_ERR_ROOT_CMD_FATAL_EN); 
++        /* Clear the Root status register */
++        pci_read_config_dword(dev, pos + PCI_ERR_ROOT_STATUS, &dconfig);
++        pci_write_config_dword(dev, pos + PCI_ERR_ROOT_STATUS, dconfig);
++    }
++#endif /* IFX_PCIE_ERROR_INT */
++    /* WAR, only 128 MRRS is supported, force all EPs to support this value */
++    pcie_set_readrq(dev, 128);
++    return 0;
++}
++
++static int
++pcie_rc_initialize(int pcie_port)
++{
++	int i;
++#define IFX_PCIE_PHY_LOOP_CNT  5
++
++	pcie_rcu_endian_setup(pcie_port);
++
++	pcie_ep_gpio_rst_init(pcie_port);
++
++	/* 
++	* XXX, PCIe elastic buffer bug will cause not to be detected. One more 
++	* reset PCIe PHY will solve this issue 
++	*/
++	for (i = 0; i < IFX_PCIE_PHY_LOOP_CNT; i++) {
++		/* Disable PCIe PHY Analog part for sanity check */
++		pcie_phy_pmu_disable(pcie_port);
++
++		pcie_phy_rst_assert(pcie_port);
++		pcie_phy_rst_deassert(pcie_port);
++
++		/* Make sure PHY PLL is stable */
++		udelay(20);
++
++		/* PCIe Core reset enabled, low active, sw programmed */
++		pcie_core_rst_assert(pcie_port);
++
++		/* Put PCIe EP in reset status */
++		pcie_device_rst_assert(pcie_port);
++
++		/* PCI PHY & Core reset disabled, high active, sw programmed */
++		pcie_core_rst_deassert(pcie_port);
++
++		/* Already in a quiet state, program PLL, enable PHY, check ready bit */
++		pcie_phy_clock_mode_setup(pcie_port);
++
++		/* Enable PCIe PHY and Clock */
++		pcie_core_pmu_setup(pcie_port);
++
++		/* Clear status registers */
++		pcie_status_register_clear(pcie_port);
++
++#ifdef CONFIG_PCI_MSI
++		pcie_msi_init(pcie_port);
++#endif /* CONFIG_PCI_MSI */
++		pcie_rc_cfg_reg_setup(pcie_port);
++
++		/* Once link is up, break out */
++		if (pcie_app_loigc_setup(pcie_port) == 0)
++			break;
++	}
++	if (i >= IFX_PCIE_PHY_LOOP_CNT) {
++		printk(KERN_ERR "%s link up failed!!!!!\n", __func__);
++		return -EIO;
++	}
++	/* NB, don't increase ACK/NACK timer timeout value, which will cause a lot of COR errors */
++	pcie_replay_time_update(pcie_port);
++	return 0;
++}
++
++static int __init ifx_pcie_bios_init(void)
++{
++    void __iomem *io_map_base;
++    int pcie_port;
++    int startup_port;
++
++    /* Enable AHB Master/ Slave */
++    pcie_ahb_pmu_setup();
++
++    startup_port = IFX_PCIE_PORT0;
++    
++    for (pcie_port = startup_port; pcie_port < IFX_PCIE_CORE_NR; pcie_port++){
++	if (pcie_rc_initialize(pcie_port) == 0) {
++	    IFX_PCIE_PRINT(PCIE_MSG_INIT, "%s: ifx_pcie_cfg_base 0x%p\n", 
++                 __func__, PCIE_CFG_PORT_TO_BASE(pcie_port));
++            /* Otherwise, warning will pop up */
++            io_map_base = ioremap(PCIE_IO_PHY_PORT_TO_BASE(pcie_port), PCIE_IO_SIZE);
++            if (io_map_base == NULL) {
++                IFX_PCIE_PRINT(PCIE_MSG_ERR, "%s io space ioremap failed\n", __func__);
++                return -ENOMEM;
++            }
++            ifx_pcie_controller[pcie_port].pcic.io_map_base = (unsigned long)io_map_base;
++
++            register_pci_controller(&ifx_pcie_controller[pcie_port].pcic);
++            /* XXX, clear error status */
++
++            IFX_PCIE_PRINT(PCIE_MSG_INIT, "%s: mem_resource 0x%p, io_resource 0x%p\n", 
++                              __func__, &ifx_pcie_controller[pcie_port].pcic.mem_resource, 
++                              &ifx_pcie_controller[pcie_port].pcic.io_resource);
++
++        #ifdef IFX_PCIE_ERROR_INT
++            pcie_rc_core_int_init(pcie_port);
++        #endif /* IFX_PCIE_ERROR_INT */
++        }
++    }
++
++    return 0;
++}
++arch_initcall(ifx_pcie_bios_init);
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Chuanhua.Lei@infineon.com");
++MODULE_DESCRIPTION("Infineon builtin PCIe RC driver");
++
+--- /dev/null
++++ b/arch/mips/pci/ifxmips_pcie.h
+@@ -0,0 +1,131 @@
++/******************************************************************************
++**
++** FILE NAME    : ifxmips_pcie.h
++** PROJECT      : IFX UEIP for VRX200
++** MODULES      : PCIe module
++**
++** DATE         : 02 Mar 2009
++** AUTHOR       : Lei Chuanhua
++** DESCRIPTION  : PCIe Root Complex Driver
++** COPYRIGHT    :       Copyright (c) 2009
++**                      Infineon Technologies AG
++**                      Am Campeon 1-12, 85579 Neubiberg, Germany
++**
++**    This program is free software; you can redistribute it and/or modify
++**    it under the terms of the GNU General Public License as published by
++**    the Free Software Foundation; either version 2 of the License, or
++**    (at your option) any later version.
++** HISTORY
++** $Version $Date        $Author         $Comment
++** 0.0.1    17 Mar,2009  Lei Chuanhua    Initial version
++*******************************************************************************/
++#ifndef IFXMIPS_PCIE_H
++#define IFXMIPS_PCIE_H
++#include <linux/version.h>
++#include <linux/types.h>
++#include <linux/pci.h>
++#include <linux/interrupt.h>
++#include "ifxmips_pci_common.h"
++#include "ifxmips_pcie_reg.h"
++
++/*!
++ \defgroup IFX_PCIE  PCI Express bus driver module   
++ \brief  PCI Express IP module support VRX200 
++*/
++
++/*!
++ \defgroup IFX_PCIE_OS OS APIs
++ \ingroup IFX_PCIE
++ \brief PCIe bus driver OS interface functions
++*/
++
++/*!
++ \file ifxmips_pcie.h
++ \ingroup IFX_PCIE  
++ \brief header file for PCIe module common header file
++*/
++#define PCIE_IRQ_LOCK(lock) do {             \
++    unsigned long flags;                     \
++    spin_lock_irqsave(&(lock), flags);
++#define PCIE_IRQ_UNLOCK(lock)                \
++    spin_unlock_irqrestore(&(lock), flags);  \
++} while (0)
++
++#define PCIE_MSG_MSI        0x00000001
++#define PCIE_MSG_ISR        0x00000002
++#define PCIE_MSG_FIXUP      0x00000004
++#define PCIE_MSG_READ_CFG   0x00000008
++#define PCIE_MSG_WRITE_CFG  0x00000010
++#define PCIE_MSG_CFG        (PCIE_MSG_READ_CFG | PCIE_MSG_WRITE_CFG)
++#define PCIE_MSG_REG        0x00000020
++#define PCIE_MSG_INIT       0x00000040
++#define PCIE_MSG_ERR        0x00000080
++#define PCIE_MSG_PHY        0x00000100
++#define PCIE_MSG_ANY        0x000001ff
++
++#define IFX_PCIE_PORT0      0
++#define IFX_PCIE_PORT1      1
++
++#ifdef CONFIG_IFX_PCIE_2ND_CORE
++#define IFX_PCIE_CORE_NR    2
++#else
++#define IFX_PCIE_CORE_NR    1
++#endif
++
++#define IFX_PCIE_ERROR_INT
++
++//#define IFX_PCIE_DBG
++
++#if defined(IFX_PCIE_DBG)
++#define IFX_PCIE_PRINT(_m, _fmt, args...) do {   \
++        ifx_pcie_debug((_fmt), ##args);          \
++} while (0)
++
++#define INLINE 
++#else
++#define IFX_PCIE_PRINT(_m, _fmt, args...)   \
++    do {} while(0)
++#define INLINE inline
++#endif
++
++struct ifx_pci_controller {
++	struct pci_controller   pcic;
++    
++	/* RC specific, per host bus information */
++	u32   port;  /* Port index, 0 -- 1st core, 1 -- 2nd core */
++};
++
++typedef struct ifx_pcie_ir_irq {
++    const unsigned int irq;
++    const char name[16];
++}ifx_pcie_ir_irq_t;
++
++typedef struct ifx_pcie_legacy_irq{
++    const u32 irq_bit;
++    const int irq;
++}ifx_pcie_legacy_irq_t;
++
++typedef struct ifx_pcie_irq {
++    ifx_pcie_ir_irq_t ir_irq;
++    ifx_pcie_legacy_irq_t legacy_irq[PCIE_LEGACY_INT_MAX];
++}ifx_pcie_irq_t;
++
++extern u32 g_pcie_debug_flag;
++extern void ifx_pcie_debug(const char *fmt, ...);
++extern void pcie_phy_clock_mode_setup(int pcie_port);
++extern void pcie_msi_pic_init(int pcie_port);
++extern u32 ifx_pcie_bus_enum_read_hack(int where, u32 value);
++extern u32 ifx_pcie_bus_enum_write_hack(int where, u32 value);
++
++#define CONFIG_VR9
++
++#ifdef CONFIG_VR9
++#include "ifxmips_pcie_vr9.h"
++#elif defined (CONFIG_AR10)
++#include "ifxmips_pcie_ar10.h"
++#else
++#error "PCIE: platform not defined"
++#endif /* CONFIG_VR9 */
++
++#endif  /* IFXMIPS_PCIE_H */
++
+--- /dev/null
++++ b/arch/mips/pci/ifxmips_pcie_ar10.h
+@@ -0,0 +1,290 @@
++/****************************************************************************
++                              Copyright (c) 2010
++                            Lantiq Deutschland GmbH
++                     Am Campeon 3; 85579 Neubiberg, Germany
++
++  For licensing information, see the file 'LICENSE' in the root folder of
++  this software module.
++
++ *****************************************************************************/
++/*!
++  \file ifxmips_pcie_ar10.h
++  \ingroup IFX_PCIE
++  \brief PCIe RC driver ar10 specific file
++*/
++
++#ifndef IFXMIPS_PCIE_AR10_H
++#define IFXMIPS_PCIE_AR10_H
++#ifndef AUTOCONF_INCLUDED
++#include <linux/config.h>
++#endif /* AUTOCONF_INCLUDED */
++#include <linux/types.h>
++#include <linux/delay.h>
++
++/* Project header file */
++#include <asm/ifx/ifx_types.h>
++#include <asm/ifx/ifx_pmu.h>
++#include <asm/ifx/ifx_gpio.h>
++#include <asm/ifx/ifx_ebu_led.h>
++
++static inline void pcie_ep_gpio_rst_init(int pcie_port)
++{
++    ifx_ebu_led_enable();
++    if (pcie_port == 0) {
++        ifx_ebu_led_set_data(11, 1);        
++    }
++    else {
++        ifx_ebu_led_set_data(12, 1);  
++    }
++}
++
++static inline void pcie_ahb_pmu_setup(void) 
++{
++    /* XXX, moved to CGU to control AHBM */
++}
++
++static inline void pcie_rcu_endian_setup(int pcie_port)
++{
++    u32 reg;
++
++    reg = IFX_REG_R32(IFX_RCU_AHB_ENDIAN);
++    /* Inbound, big endian */
++    reg |= IFX_RCU_BE_AHB4S;
++    if (pcie_port == 0) {
++        reg |= IFX_RCU_BE_PCIE0M;
++
++    #ifdef CONFIG_IFX_PCIE_HW_SWAP
++        /* Outbound, software swap needed */
++        reg |= IFX_RCU_BE_AHB3M;
++        reg &= ~IFX_RCU_BE_PCIE0S;
++    #else
++        /* Outbound little endian  */
++        reg &= ~IFX_RCU_BE_AHB3M;
++        reg &= ~IFX_RCU_BE_PCIE0S;
++    #endif
++    }
++    else {
++        reg |= IFX_RCU_BE_PCIE1M;
++    #ifdef CONFIG_IFX_PCIE1_HW_SWAP
++        /* Outbound, software swap needed */
++        reg |= IFX_RCU_BE_AHB3M;
++        reg &= ~IFX_RCU_BE_PCIE1S;
++    #else
++        /* Outbound little endian  */
++        reg &= ~IFX_RCU_BE_AHB3M;
++        reg &= ~IFX_RCU_BE_PCIE1S;
++    #endif
++    }
++
++    IFX_REG_W32(reg, IFX_RCU_AHB_ENDIAN);
++    IFX_PCIE_PRINT(PCIE_MSG_REG, "%s IFX_RCU_AHB_ENDIAN: 0x%08x\n", __func__, IFX_REG_R32(IFX_RCU_AHB_ENDIAN));
++}
++
++static inline void pcie_phy_pmu_enable(int pcie_port)
++{
++    if (pcie_port == 0) { /* XXX, should use macro*/
++        PCIE0_PHY_PMU_SETUP(IFX_PMU_ENABLE);
++    }
++    else {
++        PCIE1_PHY_PMU_SETUP(IFX_PMU_ENABLE);
++    }
++}
++
++static inline void pcie_phy_pmu_disable(int pcie_port)
++{
++    if (pcie_port == 0) { /* XXX, should use macro*/
++        PCIE0_PHY_PMU_SETUP(IFX_PMU_DISABLE);
++    }
++    else {
++        PCIE1_PHY_PMU_SETUP(IFX_PMU_DISABLE);
++    }
++}
++
++static inline void pcie_pdi_big_endian(int pcie_port)
++{
++    u32 reg;
++
++    reg = IFX_REG_R32(IFX_RCU_AHB_ENDIAN);
++    if (pcie_port == 0) {
++        /* Config AHB->PCIe and PDI endianness */
++        reg |= IFX_RCU_BE_PCIE0_PDI;
++    }
++    else {
++        /* Config AHB->PCIe and PDI endianness */
++        reg |= IFX_RCU_BE_PCIE1_PDI;
++    }
++    IFX_REG_W32(reg, IFX_RCU_AHB_ENDIAN);
++}
++
++static inline void pcie_pdi_pmu_enable(int pcie_port)
++{
++    if (pcie_port == 0) {
++        /* Enable PDI to access PCIe PHY register */
++        PDI0_PMU_SETUP(IFX_PMU_ENABLE);
++    }
++    else {
++        PDI1_PMU_SETUP(IFX_PMU_ENABLE);
++    }
++}
++
++static inline void pcie_core_rst_assert(int pcie_port)
++{
++    u32 reg;
++
++    reg = IFX_REG_R32(IFX_RCU_RST_REQ);
++
++    /* Reset Core, bit 22 */
++    if (pcie_port == 0) {
++        reg |= 0x00400000;
++    }
++    else {
++        reg |= 0x08000000; /* Bit 27 */
++    }
++    IFX_REG_W32(reg, IFX_RCU_RST_REQ);
++}
++
++static inline void pcie_core_rst_deassert(int pcie_port)
++{
++    u32 reg;
++
++    /* Make sure one micro-second delay */
++    udelay(1);
++
++    reg = IFX_REG_R32(IFX_RCU_RST_REQ);
++    if (pcie_port == 0) {
++        reg &= ~0x00400000; /* bit 22 */
++    }
++    else {
++        reg &= ~0x08000000; /* Bit 27 */
++    }
++    IFX_REG_W32(reg, IFX_RCU_RST_REQ);
++}
++
++static inline void pcie_phy_rst_assert(int pcie_port)
++{
++    u32 reg;
++
++    reg = IFX_REG_R32(IFX_RCU_RST_REQ);
++    if (pcie_port == 0) {
++        reg |= 0x00001000; /* Bit 12 */
++    }
++    else {
++        reg |= 0x00002000; /* Bit 13 */
++    }
++    IFX_REG_W32(reg, IFX_RCU_RST_REQ);
++}
++
++static inline void pcie_phy_rst_deassert(int pcie_port)
++{
++    u32 reg;
++
++    /* Make sure one micro-second delay */
++    udelay(1);
++
++    reg = IFX_REG_R32(IFX_RCU_RST_REQ);
++    if (pcie_port == 0) {
++        reg &= ~0x00001000; /* Bit 12 */
++    }
++    else {
++        reg &= ~0x00002000; /* Bit 13 */
++    }
++    IFX_REG_W32(reg, IFX_RCU_RST_REQ);
++}
++
++static inline void pcie_device_rst_assert(int pcie_port)
++{
++    if (pcie_port == 0) {
++        ifx_ebu_led_set_data(11, 0);
++    }
++    else {
++        ifx_ebu_led_set_data(12, 0);
++    }
++}
++
++static inline void pcie_device_rst_deassert(int pcie_port)
++{
++    mdelay(100);
++    if (pcie_port == 0) {
++        ifx_ebu_led_set_data(11, 1);
++    }
++    else {
++        ifx_ebu_led_set_data(12, 1);
++    }
++    ifx_ebu_led_disable();
++}
++
++static inline void pcie_core_pmu_setup(int pcie_port)
++{
++    if (pcie_port == 0) {
++        PCIE0_CTRL_PMU_SETUP(IFX_PMU_ENABLE);
++    }
++    else {
++        PCIE1_CTRL_PMU_SETUP(IFX_PMU_ENABLE); 
++    }
++}
++
++static inline void pcie_msi_init(int pcie_port)
++{
++    pcie_msi_pic_init(pcie_port);
++    if (pcie_port == 0) {
++        MSI0_PMU_SETUP(IFX_PMU_ENABLE);
++    }
++    else {
++        MSI1_PMU_SETUP(IFX_PMU_ENABLE);
++    }
++}
++
++static inline u32
++ifx_pcie_bus_nr_deduct(u32 bus_number, int pcie_port)
++{
++    u32 tbus_number = bus_number;
++
++#ifdef CONFIG_IFX_PCIE_2ND_CORE
++    if (pcie_port == IFX_PCIE_PORT1) { /* Port 1 must check if there are two cores enabled */
++        if (pcibios_host_nr() > 1) {
++            tbus_number -= pcibios_1st_host_bus_nr();
++        }        
++    }
++#endif /* CONFIG_IFX_PCI */
++    return tbus_number;
++}
++
++static inline u32
++ifx_pcie_bus_enum_hack(struct pci_bus *bus, u32 devfn, int where, u32 value, int pcie_port, int read)
++{
++    struct pci_dev *pdev;
++    u32 tvalue = value;
++
++    /* Sanity check */
++    pdev = pci_get_slot(bus, devfn);
++    if (pdev == NULL) {
++        return tvalue;
++    }
++
++    /* Only care about PCI bridge */
++    if (pdev->hdr_type != PCI_HEADER_TYPE_BRIDGE) {
++        return tvalue;
++    }
++
++    if (read) { /* Read hack */
++    #ifdef CONFIG_IFX_PCIE_2ND_CORE
++        if (pcie_port == IFX_PCIE_PORT1) { /* Port 1 must check if there are two cores enabled */
++            if (pcibios_host_nr() > 1) {
++                tvalue = ifx_pcie_bus_enum_read_hack(where, tvalue);
++            }
++        }
++    #endif /* CONFIG_IFX_PCIE_2ND_CORE */
++    }
++    else { /* Write hack */
++    #ifdef CONFIG_IFX_PCIE_2ND_CORE
++        if (pcie_port == IFX_PCIE_PORT1) { /* Port 1 must check if there are two cores enabled */
++            if (pcibios_host_nr() > 1) {
++                tvalue = ifx_pcie_bus_enum_write_hack(where, tvalue);
++            }
++        }
++    #endif
++    }
++    return tvalue;
++}
++
++#endif /* IFXMIPS_PCIE_AR10_H */
+--- /dev/null
++++ b/arch/mips/pci/ifxmips_pcie_msi.c
+@@ -0,0 +1,391 @@
++/******************************************************************************
++**
++** FILE NAME    : ifxmips_pcie_msi.c
++** PROJECT      : IFX UEIP for VRX200
++** MODULES      : PCI MSI sub module
++**
++** DATE         : 02 Mar 2009
++** AUTHOR       : Lei Chuanhua
++** DESCRIPTION  : PCIe MSI Driver
++** COPYRIGHT    :       Copyright (c) 2009
++**                      Infineon Technologies AG
++**                      Am Campeon 1-12, 85579 Neubiberg, Germany
++**
++**    This program is free software; you can redistribute it and/or modify
++**    it under the terms of the GNU General Public License as published by
++**    the Free Software Foundation; either version 2 of the License, or
++**    (at your option) any later version.
++** HISTORY
++** $Date        $Author         $Comment
++** 02 Mar,2009  Lei Chuanhua    Initial version
++*******************************************************************************/
++/*!
++ \defgroup IFX_PCIE_MSI MSI OS APIs
++ \ingroup IFX_PCIE
++ \brief PCIe bus driver OS interface functions
++*/
++
++/*!
++ \file ifxmips_pcie_msi.c
++ \ingroup IFX_PCIE 
++ \brief PCIe MSI OS interface file
++*/
++
++#ifndef AUTOCONF_INCLUDED
++#include <linux/config.h>
++#endif /* AUTOCONF_INCLUDED */
++#include <linux/init.h>
++#include <linux/sched.h>
++#include <linux/slab.h>
++#include <linux/interrupt.h>
++#include <linux/kernel_stat.h>
++#include <linux/pci.h>
++#include <linux/msi.h>
++#include <linux/module.h>
++#include <asm/bootinfo.h>
++#include <asm/irq.h>
++#include <asm/traps.h>
++
++#include <asm/ifx/ifx_types.h>
++#include <asm/ifx/ifx_regs.h>
++#include <asm/ifx/common_routines.h>
++#include <asm/ifx/irq.h>
++
++#include "ifxmips_pcie_reg.h"
++#include "ifxmips_pcie.h"
++
++#define IFX_MSI_IRQ_NUM    16
++
++enum {
++    IFX_PCIE_MSI_IDX0 = 0,
++    IFX_PCIE_MSI_IDX1,
++    IFX_PCIE_MSI_IDX2,
++    IFX_PCIE_MSI_IDX3,
++};
++
++typedef struct ifx_msi_irq_idx {
++    const int irq;
++    const int idx;
++}ifx_msi_irq_idx_t;
++
++struct ifx_msi_pic {
++    volatile u32  pic_table[IFX_MSI_IRQ_NUM];
++    volatile u32  pic_endian;    /* 0x40  */
++};
++typedef struct ifx_msi_pic *ifx_msi_pic_t;
++
++typedef struct ifx_msi_irq {
++    const volatile ifx_msi_pic_t msi_pic_p;
++    const u32 msi_phy_base;
++    const ifx_msi_irq_idx_t msi_irq_idx[IFX_MSI_IRQ_NUM];
++    /*
++     * Each bit in msi_free_irq_bitmask represents a MSI interrupt that is 
++     * in use.
++     */
++    u16 msi_free_irq_bitmask;
++
++    /*
++     * Each bit in msi_multiple_irq_bitmask tells that the device using 
++     * this bit in msi_free_irq_bitmask is also using the next bit. This 
++     * is used so we can disable all of the MSI interrupts when a device 
++     * uses multiple.
++     */
++    u16 msi_multiple_irq_bitmask;
++}ifx_msi_irq_t;
++
++static ifx_msi_irq_t msi_irqs[IFX_PCIE_CORE_NR] = {
++    {
++        .msi_pic_p = (const volatile ifx_msi_pic_t)IFX_MSI_PIC_REG_BASE,
++        .msi_phy_base = PCIE_MSI_PHY_BASE,
++        .msi_irq_idx = {
++            {IFX_PCIE_MSI_IR0, IFX_PCIE_MSI_IDX0}, {IFX_PCIE_MSI_IR1, IFX_PCIE_MSI_IDX1},
++            {IFX_PCIE_MSI_IR2, IFX_PCIE_MSI_IDX2}, {IFX_PCIE_MSI_IR3, IFX_PCIE_MSI_IDX3},
++            {IFX_PCIE_MSI_IR0, IFX_PCIE_MSI_IDX0}, {IFX_PCIE_MSI_IR1, IFX_PCIE_MSI_IDX1},
++            {IFX_PCIE_MSI_IR2, IFX_PCIE_MSI_IDX2}, {IFX_PCIE_MSI_IR3, IFX_PCIE_MSI_IDX3},
++            {IFX_PCIE_MSI_IR0, IFX_PCIE_MSI_IDX0}, {IFX_PCIE_MSI_IR1, IFX_PCIE_MSI_IDX1},
++            {IFX_PCIE_MSI_IR2, IFX_PCIE_MSI_IDX2}, {IFX_PCIE_MSI_IR3, IFX_PCIE_MSI_IDX3},
++            {IFX_PCIE_MSI_IR0, IFX_PCIE_MSI_IDX0}, {IFX_PCIE_MSI_IR1, IFX_PCIE_MSI_IDX1},
++            {IFX_PCIE_MSI_IR2, IFX_PCIE_MSI_IDX2}, {IFX_PCIE_MSI_IR3, IFX_PCIE_MSI_IDX3},
++        },
++        .msi_free_irq_bitmask = 0,
++        .msi_multiple_irq_bitmask= 0,
++    },
++#ifdef CONFIG_IFX_PCIE_2ND_CORE
++    {
++        .msi_pic_p = (const volatile ifx_msi_pic_t)IFX_MSI1_PIC_REG_BASE,
++        .msi_phy_base = PCIE1_MSI_PHY_BASE,
++        .msi_irq_idx = {
++            {IFX_PCIE1_MSI_IR0, IFX_PCIE_MSI_IDX0}, {IFX_PCIE1_MSI_IR1, IFX_PCIE_MSI_IDX1},
++            {IFX_PCIE1_MSI_IR2, IFX_PCIE_MSI_IDX2}, {IFX_PCIE1_MSI_IR3, IFX_PCIE_MSI_IDX3},
++            {IFX_PCIE1_MSI_IR0, IFX_PCIE_MSI_IDX0}, {IFX_PCIE1_MSI_IR1, IFX_PCIE_MSI_IDX1},
++            {IFX_PCIE1_MSI_IR2, IFX_PCIE_MSI_IDX2}, {IFX_PCIE1_MSI_IR3, IFX_PCIE_MSI_IDX3},
++            {IFX_PCIE1_MSI_IR0, IFX_PCIE_MSI_IDX0}, {IFX_PCIE1_MSI_IR1, IFX_PCIE_MSI_IDX1},
++            {IFX_PCIE1_MSI_IR2, IFX_PCIE_MSI_IDX2}, {IFX_PCIE1_MSI_IR3, IFX_PCIE_MSI_IDX3},
++            {IFX_PCIE1_MSI_IR0, IFX_PCIE_MSI_IDX0}, {IFX_PCIE1_MSI_IR1, IFX_PCIE_MSI_IDX1},
++            {IFX_PCIE1_MSI_IR2, IFX_PCIE_MSI_IDX2}, {IFX_PCIE1_MSI_IR3, IFX_PCIE_MSI_IDX3},
++        },
++        .msi_free_irq_bitmask = 0,
++        .msi_multiple_irq_bitmask= 0,
++
++    },
++#endif /* CONFIG_IFX_PCIE_2ND_CORE */
++};
++
++/* 
++ * This lock controls updates to msi_free_irq_bitmask, 
++ * msi_multiple_irq_bitmask and pic register settting
++ */ 
++static DEFINE_SPINLOCK(ifx_pcie_msi_lock);
++
++void pcie_msi_pic_init(int pcie_port)
++{
++    spin_lock(&ifx_pcie_msi_lock);
++    msi_irqs[pcie_port].msi_pic_p->pic_endian = IFX_MSI_PIC_BIG_ENDIAN;
++    spin_unlock(&ifx_pcie_msi_lock);
++}
++
++/** 
++ * \fn int arch_setup_msi_irq(struct pci_dev *pdev, struct msi_desc *desc)
++ * \brief Called when a driver request MSI interrupts instead of the 
++ * legacy INT A-D. This routine will allocate multiple interrupts 
++ * for MSI devices that support them. A device can override this by 
++ * programming the MSI control bits [6:4] before calling 
++ * pci_enable_msi(). 
++ * 
++ * \param[in] pdev   Device requesting MSI interrupts 
++ * \param[in] desc   MSI descriptor 
++ * 
++ * \return   -EINVAL Invalid pcie root port or invalid msi bit
++ * \return    0        OK
++ * \ingroup IFX_PCIE_MSI
++ */
++int 
++arch_setup_msi_irq(struct pci_dev *pdev, struct msi_desc *desc)
++{
++    int  irq, pos;
++    u16  control;
++    int  irq_idx;
++    int  irq_step;
++    int configured_private_bits;
++    int request_private_bits;
++    struct msi_msg msg;
++    u16 search_mask;
++    struct ifx_pci_controller *ctrl = pdev->bus->sysdata;
++    int pcie_port = ctrl->port;
++
++    IFX_PCIE_PRINT(PCIE_MSG_MSI, "%s %s enter\n", __func__, pci_name(pdev));
++
++    /* XXX, skip RC MSI itself */
++    if (pdev->pcie_type == PCI_EXP_TYPE_ROOT_PORT) {
++        IFX_PCIE_PRINT(PCIE_MSG_MSI, "%s RC itself doesn't use MSI interrupt\n", __func__);
++        return -EINVAL;
++    }
++
++    /*
++     * Read the MSI config to figure out how many IRQs this device 
++     * wants.  Most devices only want 1, which will give 
++     * configured_private_bits and request_private_bits equal 0. 
++     */
++    pci_read_config_word(pdev, desc->msi_attrib.pos + PCI_MSI_FLAGS, &control);
++
++    /*
++     * If the number of private bits has been configured then use 
++     * that value instead of the requested number. This gives the 
++     * driver the chance to override the number of interrupts 
++     * before calling pci_enable_msi(). 
++     */
++    configured_private_bits = (control & PCI_MSI_FLAGS_QSIZE) >> 4; 
++    if (configured_private_bits == 0) {
++        /* Nothing is configured, so use the hardware requested size */
++        request_private_bits = (control & PCI_MSI_FLAGS_QMASK) >> 1;
++    }
++    else {
++        /*
++         * Use the number of configured bits, assuming the 
++         * driver wanted to override the hardware request 
++         * value.
++         */
++        request_private_bits = configured_private_bits;
++    }
++
++    /*
++     * The PCI 2.3 spec mandates that there are at most 32
++     * interrupts. If this device asks for more, only give it one.
++     */
++    if (request_private_bits > 5) {
++        request_private_bits = 0;
++    }
++again:
++    /*
++     * The IRQs have to be aligned on a power of two based on the
++     * number being requested.
++     */
++    irq_step = (1 << request_private_bits);
++
++    /* Mask with one bit for each IRQ */
++    search_mask = (1 << irq_step) - 1;
++
++    /*
++     * We're going to search msi_free_irq_bitmask_lock for zero 
++     * bits. This represents an MSI interrupt number that isn't in 
++     * use.
++     */
++    spin_lock(&ifx_pcie_msi_lock);
++    for (pos = 0; pos < IFX_MSI_IRQ_NUM; pos += irq_step) {
++        if ((msi_irqs[pcie_port].msi_free_irq_bitmask & (search_mask << pos)) == 0) {
++            msi_irqs[pcie_port].msi_free_irq_bitmask |= search_mask << pos; 
++            msi_irqs[pcie_port].msi_multiple_irq_bitmask |= (search_mask >> 1) << pos;
++            break; 
++        }
++    }
++    spin_unlock(&ifx_pcie_msi_lock); 
++
++    /* Make sure the search for available interrupts didn't fail */ 
++    if (pos >= IFX_MSI_IRQ_NUM) {
++        if (request_private_bits) {
++            IFX_PCIE_PRINT(PCIE_MSG_MSI, "%s: Unable to find %d free "
++                  "interrupts, trying just one", __func__, 1 << request_private_bits);
++            request_private_bits = 0;
++            goto again;
++        }
++        else {
++            printk(KERN_ERR "%s: Unable to find a free MSI interrupt\n", __func__);
++            return -EINVAL;
++        }
++    } 
++    irq = msi_irqs[pcie_port].msi_irq_idx[pos].irq;
++    irq_idx = msi_irqs[pcie_port].msi_irq_idx[pos].idx;
++
++    IFX_PCIE_PRINT(PCIE_MSG_MSI, "pos %d, irq %d irq_idx %d\n", pos, irq, irq_idx);
++
++    /*
++     * Initialize MSI. This has to match the memory-write endianess from the device 
++     * Address bits [23:12]
++     */
++    spin_lock(&ifx_pcie_msi_lock); 
++    msi_irqs[pcie_port].msi_pic_p->pic_table[pos] = SM(irq_idx, IFX_MSI_PIC_INT_LINE) |
++                    SM((msi_irqs[pcie_port].msi_phy_base >> 12), IFX_MSI_PIC_MSG_ADDR) |
++                    SM((1 << pos), IFX_MSI_PIC_MSG_DATA);
++
++    /* Enable this entry */
++    msi_irqs[pcie_port].msi_pic_p->pic_table[pos] &= ~IFX_MSI_PCI_INT_DISABLE;
++    spin_unlock(&ifx_pcie_msi_lock);
++
++    IFX_PCIE_PRINT(PCIE_MSG_MSI, "pic_table[%d]: 0x%08x\n",
++        pos, msi_irqs[pcie_port].msi_pic_p->pic_table[pos]);
++
++    /* Update the number of IRQs the device has available to it */
++    control &= ~PCI_MSI_FLAGS_QSIZE;
++    control |= (request_private_bits << 4);
++    pci_write_config_word(pdev, desc->msi_attrib.pos + PCI_MSI_FLAGS, control);
++
++    set_irq_msi(irq, desc);
++    msg.address_hi = 0x0;
++    msg.address_lo = msi_irqs[pcie_port].msi_phy_base;
++    msg.data = SM((1 << pos), IFX_MSI_PIC_MSG_DATA);
++    IFX_PCIE_PRINT(PCIE_MSG_MSI, "msi_data: pos %d 0x%08x\n", pos, msg.data);
++
++    write_msi_msg(irq, &msg);
++    IFX_PCIE_PRINT(PCIE_MSG_MSI, "%s exit\n", __func__);
++    return 0;
++}
++
++static int
++pcie_msi_irq_to_port(unsigned int irq, int *port)
++{
++    int ret = 0;
++
++    if (irq == IFX_PCIE_MSI_IR0 || irq == IFX_PCIE_MSI_IR1 ||
++        irq == IFX_PCIE_MSI_IR2 || irq == IFX_PCIE_MSI_IR3) {
++        *port = IFX_PCIE_PORT0;
++    }
++#ifdef CONFIG_IFX_PCIE_2ND_CORE
++    else if (irq == IFX_PCIE1_MSI_IR0 || irq == IFX_PCIE1_MSI_IR1 ||
++        irq == IFX_PCIE1_MSI_IR2 || irq == IFX_PCIE1_MSI_IR3) {
++        *port = IFX_PCIE_PORT1;
++    }
++#endif /* CONFIG_IFX_PCIE_2ND_CORE */
++    else {
++        printk(KERN_ERR "%s: Attempted to teardown illegal " 
++            "MSI interrupt (%d)\n", __func__, irq);
++        ret = -EINVAL;
++    }
++    return ret;
++}
++
++/** 
++ * \fn void arch_teardown_msi_irq(unsigned int irq)
++ * \brief Called when a device no longer needs its MSI interrupts. All 
++ * MSI interrupts for the device are freed. 
++ * 
++ * \param irq   The devices first irq number. There may be multple in sequence.
++ * \return none
++ * \ingroup IFX_PCIE_MSI
++ */
++void 
++arch_teardown_msi_irq(unsigned int irq)
++{
++    int pos;
++    int number_irqs; 
++    u16 bitmask;
++    int pcie_port;
++
++    IFX_PCIE_PRINT(PCIE_MSG_MSI, "%s enter\n", __func__);
++
++    BUG_ON(irq > INT_NUM_IM4_IRL31);
++
++    if (pcie_msi_irq_to_port(irq, &pcie_port) != 0) {
++        return;
++    }
++
++    /* Shift the mask to the correct bit location, not always correct 
++     * Probally, the first match will be chosen.
++     */
++    for (pos = 0; pos < IFX_MSI_IRQ_NUM; pos++) {
++        if ((msi_irqs[pcie_port].msi_irq_idx[pos].irq == irq) 
++            && (msi_irqs[pcie_port].msi_free_irq_bitmask & ( 1 << pos))) {
++            break;
++        }
++    }
++    if (pos >= IFX_MSI_IRQ_NUM) {
++        printk(KERN_ERR "%s: Unable to find a matched MSI interrupt\n", __func__);
++        return;
++    }
++    spin_lock(&ifx_pcie_msi_lock);
++    /* Disable this entry */
++    msi_irqs[pcie_port].msi_pic_p->pic_table[pos] |= IFX_MSI_PCI_INT_DISABLE;
++    msi_irqs[pcie_port].msi_pic_p->pic_table[pos] &= ~(IFX_MSI_PIC_INT_LINE | IFX_MSI_PIC_MSG_ADDR | IFX_MSI_PIC_MSG_DATA);
++    spin_unlock(&ifx_pcie_msi_lock); 
++    /*
++     * Count the number of IRQs we need to free by looking at the
++     * msi_multiple_irq_bitmask. Each bit set means that the next
++     * IRQ is also owned by this device.
++     */ 
++    number_irqs = 0; 
++    while (((pos + number_irqs) < IFX_MSI_IRQ_NUM) && 
++        (msi_irqs[pcie_port].msi_multiple_irq_bitmask & (1 << (pos + number_irqs)))) {
++        number_irqs++;
++    }
++    number_irqs++;
++
++    /* Mask with one bit for each IRQ */
++    bitmask = (1 << number_irqs) - 1;
++
++    bitmask <<= pos;
++    if ((msi_irqs[pcie_port].msi_free_irq_bitmask & bitmask) != bitmask) {
++        printk(KERN_ERR "%s: Attempted to teardown MSI "
++             "interrupt (%d) not in use\n", __func__, irq);
++        return;
++    }
++    /* Checks are done, update the in use bitmask */
++    spin_lock(&ifx_pcie_msi_lock);
++    msi_irqs[pcie_port].msi_free_irq_bitmask &= ~bitmask;
++    msi_irqs[pcie_port].msi_multiple_irq_bitmask &= ~(bitmask >> 1);
++    spin_unlock(&ifx_pcie_msi_lock);
++    IFX_PCIE_PRINT(PCIE_MSG_MSI, "%s exit\n", __func__);
++}
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Chuanhua.Lei@infineon.com");
++MODULE_DESCRIPTION("Infineon PCIe IP builtin MSI PIC driver");
++
+--- /dev/null
++++ b/arch/mips/pci/ifxmips_pcie_phy.c
+@@ -0,0 +1,478 @@
++/******************************************************************************
++**
++** FILE NAME    : ifxmips_pcie_phy.c
++** PROJECT      : IFX UEIP for VRX200
++** MODULES      : PCIe PHY sub module
++**
++** DATE         : 14 May 2009
++** AUTHOR       : Lei Chuanhua
++** DESCRIPTION  : PCIe Root Complex Driver
++** COPYRIGHT    :       Copyright (c) 2009
++**                      Infineon Technologies AG
++**                      Am Campeon 1-12, 85579 Neubiberg, Germany
++**
++**    This program is free software; you can redistribute it and/or modify
++**    it under the terms of the GNU General Public License as published by
++**    the Free Software Foundation; either version 2 of the License, or
++**    (at your option) any later version.
++** HISTORY
++** $Version $Date        $Author         $Comment
++** 0.0.1    14 May,2009  Lei Chuanhua    Initial version
++*******************************************************************************/
++/*!
++ \file ifxmips_pcie_phy.c
++ \ingroup IFX_PCIE  
++ \brief PCIe PHY PLL register programming source file
++*/
++#include <linux/types.h>
++#include <linux/kernel.h>
++#include <asm/paccess.h>
++#include <linux/delay.h>
++
++#include "ifxmips_pcie_reg.h"
++#include "ifxmips_pcie.h"
++
++/* PCIe PDI only supports 16 bit operation */
++
++#define IFX_PCIE_PHY_REG_WRITE16(__addr, __data) \
++    ((*(volatile u16 *) (__addr)) = (__data))
++    
++#define IFX_PCIE_PHY_REG_READ16(__addr)  \
++    (*(volatile u16 *) (__addr))
++
++#define IFX_PCIE_PHY_REG16(__addr)   \
++    (*(volatile u16 *) (__addr))
++
++#define IFX_PCIE_PHY_REG(__reg, __value, __mask) do { \
++    u16 read_data;                                    \
++    u16 write_data;                                   \
++    read_data = IFX_PCIE_PHY_REG_READ16((__reg));      \
++    write_data = (read_data & ((u16)~(__mask))) | (((u16)(__value)) & ((u16)(__mask)));\
++    IFX_PCIE_PHY_REG_WRITE16((__reg), write_data);               \
++} while (0)
++
++#define IFX_PCIE_PLL_TIMEOUT 1000 /* Tunnable */
++
++//#define IFX_PCI_PHY_REG_DUMP
++
++#ifdef IFX_PCI_PHY_REG_DUMP
++static void
++pcie_phy_reg_dump(int pcie_port) 
++{
++    printk("PLL REGFILE\n");
++    printk("PCIE_PHY_PLL_CTRL1    0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_PLL_CTRL1(pcie_port)));
++    printk("PCIE_PHY_PLL_CTRL2    0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_PLL_CTRL2(pcie_port)));
++    printk("PCIE_PHY_PLL_CTRL3    0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_PLL_CTRL3(pcie_port)));
++    printk("PCIE_PHY_PLL_CTRL4    0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_PLL_CTRL4(pcie_port)));
++    printk("PCIE_PHY_PLL_CTRL5    0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_PLL_CTRL5(pcie_port)));
++    printk("PCIE_PHY_PLL_CTRL6    0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_PLL_CTRL6(pcie_port)));
++    printk("PCIE_PHY_PLL_CTRL7    0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_PLL_CTRL7(pcie_port)));
++    printk("PCIE_PHY_PLL_A_CTRL1  0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_PLL_A_CTRL1(pcie_port)));
++    printk("PCIE_PHY_PLL_A_CTRL2  0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_PLL_A_CTRL2(pcie_port)));
++    printk("PCIE_PHY_PLL_A_CTRL3  0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_PLL_A_CTRL3(pcie_port)));
++    printk("PCIE_PHY_PLL_STATUS   0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_PLL_STATUS(pcie_port)));
++
++    printk("TX1 REGFILE\n");
++    printk("PCIE_PHY_TX1_CTRL1    0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_TX1_CTRL1(pcie_port)));
++    printk("PCIE_PHY_TX1_CTRL2    0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_TX1_CTRL2(pcie_port)));
++    printk("PCIE_PHY_TX1_CTRL3    0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_TX1_CTRL3(pcie_port)));
++    printk("PCIE_PHY_TX1_A_CTRL1  0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_TX1_A_CTRL1(pcie_port)));
++    printk("PCIE_PHY_TX1_A_CTRL2  0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_TX1_A_CTRL2(pcie_port)));
++    printk("PCIE_PHY_TX1_MOD1     0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_TX1_MOD1(pcie_port)));
++    printk("PCIE_PHY_TX1_MOD2     0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_TX1_MOD2(pcie_port)));
++    printk("PCIE_PHY_TX1_MOD3     0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_TX1_MOD3(pcie_port)));
++
++    printk("TX2 REGFILE\n");
++    printk("PCIE_PHY_TX2_CTRL1    0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_TX2_CTRL1(pcie_port)));
++    printk("PCIE_PHY_TX2_CTRL2    0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_TX2_CTRL2(pcie_port)));
++    printk("PCIE_PHY_TX2_A_CTRL1  0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_TX2_A_CTRL1(pcie_port)));
++    printk("PCIE_PHY_TX2_A_CTRL2  0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_TX2_A_CTRL2(pcie_port)));
++    printk("PCIE_PHY_TX2_MOD1     0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_TX2_MOD1(pcie_port)));
++    printk("PCIE_PHY_TX2_MOD2     0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_TX2_MOD2(pcie_port)));
++    printk("PCIE_PHY_TX2_MOD3     0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_TX2_MOD3(pcie_port)));
++
++    printk("RX1 REGFILE\n");
++    printk("PCIE_PHY_RX1_CTRL1    0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_RX1_CTRL1(pcie_port)));
++    printk("PCIE_PHY_RX1_CTRL2    0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_RX1_CTRL2(pcie_port)));
++    printk("PCIE_PHY_RX1_CDR      0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_RX1_CDR(pcie_port)));
++    printk("PCIE_PHY_RX1_EI       0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_RX1_EI(pcie_port)));
++    printk("PCIE_PHY_RX1_A_CTRL   0x%04x\n", IFX_PCIE_PHY_REG16(PCIE_PHY_RX1_A_CTRL(pcie_port)));
++}
++#endif /* IFX_PCI_PHY_REG_DUMP */
++
++static void
++pcie_phy_comm_setup(int pcie_port)
++{
++   /* PLL Setting */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_A_CTRL1(pcie_port), 0x120e, 0xFFFF);
++
++    /* increase the bias reference voltage */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_A_CTRL2(pcie_port), 0x39D7, 0xFFFF);
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_A_CTRL3(pcie_port), 0x0900, 0xFFFF);
++
++    /* Endcnt */
++    IFX_PCIE_PHY_REG(PCIE_PHY_RX1_EI(pcie_port), 0x0004, 0xFFFF);
++    IFX_PCIE_PHY_REG(PCIE_PHY_RX1_A_CTRL(pcie_port), 0x6803, 0xFFFF);
++
++    /* force */
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX1_CTRL1(pcie_port), 0x0008, 0x0008);
++
++    /* predrv_ser_en */
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX1_A_CTRL2(pcie_port), 0x0706, 0xFFFF);
++
++    /* ctrl_lim */
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX1_CTRL3(pcie_port), 0x1FFF, 0xFFFF);
++
++    /* ctrl */
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX1_A_CTRL1(pcie_port), 0x0800, 0xFF00);
++
++    /* predrv_ser_en */
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX2_A_CTRL2(pcie_port), 0x4702, 0x7F00);
++
++    /* RTERM*/
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX1_CTRL2(pcie_port), 0x2e00, 0xFFFF);
++
++    /* Improved 100MHz clock output  */
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX2_CTRL2(pcie_port), 0x3096, 0xFFFF);
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX2_A_CTRL2(pcie_port), 0x4707, 0xFFFF);
++
++    /* Reduced CDR BW to avoid glitches */
++    IFX_PCIE_PHY_REG(PCIE_PHY_RX1_CDR(pcie_port), 0x0235, 0xFFFF);
++}
++
++#ifdef CONFIG_IFX_PCIE_PHY_36MHZ_MODE
++static void 
++pcie_phy_36mhz_mode_setup(int pcie_port) 
++{
++    IFX_PCIE_PRINT(PCIE_MSG_PHY, "%s pcie_port %d enter\n", __func__, pcie_port);
++#ifdef IFX_PCI_PHY_REG_DUMP
++    IFX_PCIE_PRINT(PCIE_MSG_PHY, "Initial PHY register dump\n");
++    pcie_phy_reg_dump(pcie_port);
++#endif
++
++    /* en_ext_mmd_div_ratio */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL3(pcie_port), 0x0000, 0x0002);
++
++    /* ext_mmd_div_ratio*/
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL3(pcie_port), 0x0000, 0x0070);
++
++    /* pll_ensdm */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL2(pcie_port), 0x0200, 0x0200);
++
++    /* en_const_sdm */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL2(pcie_port), 0x0100, 0x0100);
++
++    /* mmd */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_A_CTRL3(pcie_port), 0x2000, 0xe000);
++
++    /* lf_mode */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_A_CTRL2(pcie_port), 0x0000, 0x4000);
++
++    /* const_sdm */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL1(pcie_port), 0x38e4, 0xFFFF);
++
++    /* const sdm */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL2(pcie_port), 0x00ee, 0x00FF);
++
++    /* pllmod */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL7(pcie_port), 0x0002, 0xFFFF);
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL6(pcie_port), 0x3a04, 0xFFFF);
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL5(pcie_port), 0xfae3, 0xFFFF);
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL4(pcie_port), 0x1b72, 0xFFFF);
++
++    IFX_PCIE_PRINT(PCIE_MSG_PHY, "%s pcie_port %d exit\n", __func__, pcie_port);
++}
++#endif /* CONFIG_IFX_PCIE_PHY_36MHZ_MODE */
++
++#ifdef CONFIG_IFX_PCIE_PHY_36MHZ_SSC_MODE
++static void 
++pcie_phy_36mhz_ssc_mode_setup(int pcie_port) 
++{
++    IFX_PCIE_PRINT(PCIE_MSG_PHY, "%s pcie_port %d enter\n", __func__, pcie_port);
++#ifdef IFX_PCI_PHY_REG_DUMP
++    IFX_PCIE_PRINT(PCIE_MSG_PHY, "Initial PHY register dump\n");
++    pcie_phy_reg_dump(pcie_port);
++#endif
++
++    /* PLL Setting */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_A_CTRL1(pcie_port), 0x120e, 0xFFFF);
++
++    /* Increase the bias reference voltage */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_A_CTRL2(pcie_port), 0x39D7, 0xFFFF);
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_A_CTRL3(pcie_port), 0x0900, 0xFFFF);
++
++    /* Endcnt */
++    IFX_PCIE_PHY_REG(PCIE_PHY_RX1_EI(pcie_port), 0x0004, 0xFFFF);
++    IFX_PCIE_PHY_REG(PCIE_PHY_RX1_A_CTRL(pcie_port), 0x6803, 0xFFFF);
++
++    /* Force */
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX1_CTRL1(pcie_port), 0x0008, 0x0008);
++
++    /* Predrv_ser_en */
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX1_A_CTRL2(pcie_port), 0x0706, 0xFFFF);
++
++    /* ctrl_lim */
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX1_CTRL3(pcie_port), 0x1FFF, 0xFFFF);
++
++    /* ctrl */
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX1_A_CTRL1(pcie_port), 0x0800, 0xFF00);
++
++    /* predrv_ser_en */
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX2_A_CTRL2(pcie_port), 0x4702, 0x7F00);
++
++    /* RTERM*/
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX1_CTRL2(pcie_port), 0x2e00, 0xFFFF);
++
++    /* en_ext_mmd_div_ratio */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL3(pcie_port), 0x0000, 0x0002);
++
++    /* ext_mmd_div_ratio*/
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL3(pcie_port), 0x0000, 0x0070);
++
++    /* pll_ensdm */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL2(pcie_port), 0x0400, 0x0400);
++
++    /* en_const_sdm */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL2(pcie_port), 0x0200, 0x0200);
++
++    /* mmd */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_A_CTRL3(pcie_port), 0x2000, 0xe000);
++
++    /* lf_mode */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_A_CTRL2(pcie_port), 0x0000, 0x4000);
++
++    /* const_sdm */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL1(pcie_port), 0x38e4, 0xFFFF);
++
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL2(pcie_port), 0x0000, 0x0100);
++    /* const sdm */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL2(pcie_port), 0x00ee, 0x00FF);
++
++    /* pllmod */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL7(pcie_port), 0x0002, 0xFFFF);
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL6(pcie_port), 0x3a04, 0xFFFF);
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL5(pcie_port), 0xfae3, 0xFFFF);
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL4(pcie_port), 0x1c72, 0xFFFF);
++
++    /* improved 100MHz clock output  */
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX2_CTRL2(pcie_port), 0x3096, 0xFFFF);
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX2_A_CTRL2(pcie_port), 0x4707, 0xFFFF);
++
++    /* reduced CDR BW to avoid glitches */
++    IFX_PCIE_PHY_REG(PCIE_PHY_RX1_CDR(pcie_port), 0x0235, 0xFFFF);
++    
++    IFX_PCIE_PRINT(PCIE_MSG_PHY, "%s pcie_port %d exit\n", __func__, pcie_port);
++}
++#endif /* CONFIG_IFX_PCIE_PHY_36MHZ_SSC_MODE */
++
++#ifdef CONFIG_IFX_PCIE_PHY_25MHZ_MODE
++static void 
++pcie_phy_25mhz_mode_setup(int pcie_port) 
++{
++    IFX_PCIE_PRINT(PCIE_MSG_PHY, "%s pcie_port %d enter\n", __func__, pcie_port);
++#ifdef IFX_PCI_PHY_REG_DUMP
++    IFX_PCIE_PRINT(PCIE_MSG_PHY, "Initial PHY register dump\n");
++    pcie_phy_reg_dump(pcie_port);
++#endif
++    /* en_const_sdm */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL2(pcie_port), 0x0100, 0x0100);
++
++    /* pll_ensdm */    
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL2(pcie_port), 0x0000, 0x0200);
++
++    /* en_ext_mmd_div_ratio*/
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL3(pcie_port), 0x0002, 0x0002);
++
++    /* ext_mmd_div_ratio*/
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL3(pcie_port), 0x0040, 0x0070);
++
++    /* mmd */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_A_CTRL3(pcie_port), 0x6000, 0xe000);
++
++    /* lf_mode */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_A_CTRL2(pcie_port), 0x4000, 0x4000);
++
++    IFX_PCIE_PRINT(PCIE_MSG_PHY, "%s pcie_port %d exit\n", __func__, pcie_port);
++}
++#endif /* CONFIG_IFX_PCIE_PHY_25MHZ_MODE */
++
++#ifdef CONFIG_IFX_PCIE_PHY_100MHZ_MODE
++static void 
++pcie_phy_100mhz_mode_setup(int pcie_port) 
++{
++    IFX_PCIE_PRINT(PCIE_MSG_PHY, "%s pcie_port %d enter\n", __func__, pcie_port);
++#ifdef IFX_PCI_PHY_REG_DUMP
++    IFX_PCIE_PRINT(PCIE_MSG_PHY, "Initial PHY register dump\n");
++    pcie_phy_reg_dump(pcie_port);
++#endif 
++    /* en_ext_mmd_div_ratio */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL3(pcie_port), 0x0000, 0x0002);
++
++    /* ext_mmd_div_ratio*/
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL3(pcie_port), 0x0000, 0x0070);
++
++    /* pll_ensdm */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL2(pcie_port), 0x0200, 0x0200);
++
++    /* en_const_sdm */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL2(pcie_port), 0x0100, 0x0100);
++
++    /* mmd */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_A_CTRL3(pcie_port), 0x2000, 0xe000);
++
++    /* lf_mode */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_A_CTRL2(pcie_port), 0x0000, 0x4000);
++
++    /* const_sdm */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL1(pcie_port), 0x38e4, 0xFFFF);
++
++    /* const sdm */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL2(pcie_port), 0x00ee, 0x00FF);
++
++    /* pllmod */
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL7(pcie_port), 0x0002, 0xFFFF);
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL6(pcie_port), 0x3a04, 0xFFFF);
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL5(pcie_port), 0xfae3, 0xFFFF);
++    IFX_PCIE_PHY_REG(PCIE_PHY_PLL_CTRL4(pcie_port), 0x1b72, 0xFFFF);
++
++    IFX_PCIE_PRINT(PCIE_MSG_PHY, "%s pcie_port %d exit\n", __func__, pcie_port);
++}
++#endif /* CONFIG_IFX_PCIE_PHY_100MHZ_MODE */
++
++static int
++pcie_phy_wait_startup_ready(int pcie_port)
++{
++    int i;
++
++    for (i = 0; i < IFX_PCIE_PLL_TIMEOUT; i++) {
++        if ((IFX_PCIE_PHY_REG16(PCIE_PHY_PLL_STATUS(pcie_port)) & 0x0040) != 0) {
++            break;
++        }
++        udelay(10);
++    }
++    if (i >= IFX_PCIE_PLL_TIMEOUT) {
++        printk(KERN_ERR "%s PLL Link timeout\n", __func__);
++        return -1;
++    }
++    return 0;
++}
++
++static void 
++pcie_phy_load_enable(int pcie_port, int slice) 
++{
++    /* Set the load_en of tx/rx slice to '1' */
++    switch (slice) {
++        case 1:
++            IFX_PCIE_PHY_REG(PCIE_PHY_TX1_CTRL1(pcie_port), 0x0010, 0x0010);
++            break;
++        case 2:
++            IFX_PCIE_PHY_REG(PCIE_PHY_TX2_CTRL1(pcie_port), 0x0010, 0x0010);
++            break;
++        case 3:
++            IFX_PCIE_PHY_REG(PCIE_PHY_RX1_CTRL1(pcie_port), 0x0002, 0x0002);
++            break;
++    }
++}
++
++static void 
++pcie_phy_load_disable(int pcie_port, int slice) 
++{ 
++    /* set the load_en of tx/rx slice to '0' */ 
++    switch (slice) {
++        case 1:
++            IFX_PCIE_PHY_REG(PCIE_PHY_TX1_CTRL1(pcie_port), 0x0000, 0x0010);
++            break;
++        case 2:
++            IFX_PCIE_PHY_REG(PCIE_PHY_TX2_CTRL1(pcie_port), 0x0000, 0x0010);
++            break;
++        case 3: 
++            IFX_PCIE_PHY_REG(PCIE_PHY_RX1_CTRL1(pcie_port), 0x0000, 0x0002);
++            break;
++    }
++}
++
++static void 
++pcie_phy_load_war(int pcie_port)
++{
++    int slice;
++
++    for (slice = 1; slice < 4; slice++) {
++        pcie_phy_load_enable(pcie_port, slice);
++        udelay(1);
++        pcie_phy_load_disable(pcie_port, slice);
++    }
++}
++
++static void 
++pcie_phy_tx2_modulation(int pcie_port)
++{
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX2_MOD1(pcie_port), 0x1FFE, 0xFFFF);
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX2_MOD2(pcie_port), 0xFFFE, 0xFFFF);
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX2_MOD3(pcie_port), 0x0601, 0xFFFF);
++    mdelay(1);
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX2_MOD3(pcie_port), 0x0001, 0xFFFF);
++}
++
++static void 
++pcie_phy_tx1_modulation(int pcie_port)
++{
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX1_MOD1(pcie_port), 0x1FFE, 0xFFFF);
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX1_MOD2(pcie_port), 0xFFFE, 0xFFFF);
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX1_MOD3(pcie_port), 0x0601, 0xFFFF);
++    mdelay(1);
++    IFX_PCIE_PHY_REG(PCIE_PHY_TX1_MOD3(pcie_port), 0x0001, 0xFFFF);
++}
++
++static void
++pcie_phy_tx_modulation_war(int pcie_port)
++{
++    int i;
++
++#define PCIE_PHY_MODULATION_NUM 5 
++    for (i = 0; i < PCIE_PHY_MODULATION_NUM; i++) {
++        pcie_phy_tx2_modulation(pcie_port);
++        pcie_phy_tx1_modulation(pcie_port);
++    }
++#undef PCIE_PHY_MODULATION_NUM
++}
++
++void
++pcie_phy_clock_mode_setup(int pcie_port)
++{
++    pcie_pdi_big_endian(pcie_port);
++
++    /* Enable PDI to access PCIe PHY register */
++    pcie_pdi_pmu_enable(pcie_port);
++
++    /* Configure PLL and PHY clock */
++    pcie_phy_comm_setup(pcie_port);
++
++#ifdef CONFIG_IFX_PCIE_PHY_36MHZ_MODE
++    pcie_phy_36mhz_mode_setup(pcie_port);
++#elif defined(CONFIG_IFX_PCIE_PHY_36MHZ_SSC_MODE)
++    pcie_phy_36mhz_ssc_mode_setup(pcie_port);
++#elif defined(CONFIG_IFX_PCIE_PHY_25MHZ_MODE)
++    pcie_phy_25mhz_mode_setup(pcie_port);
++#elif defined (CONFIG_IFX_PCIE_PHY_100MHZ_MODE)
++    pcie_phy_100mhz_mode_setup(pcie_port);
++#else
++    #error "PCIE PHY Clock Mode must be chosen first!!!!"
++#endif /* CONFIG_IFX_PCIE_PHY_36MHZ_MODE */
++
++    /* Enable PCIe PHY and make PLL setting take effect */
++    pcie_phy_pmu_enable(pcie_port);
++
++    /* Check if we are in startup_ready status */
++    pcie_phy_wait_startup_ready(pcie_port);
++
++    pcie_phy_load_war(pcie_port);
++
++    /* Apply TX modulation workarounds */
++    pcie_phy_tx_modulation_war(pcie_port);
++
++#ifdef IFX_PCI_PHY_REG_DUMP
++    IFX_PCIE_PRINT(PCIE_MSG_PHY, "Modified PHY register dump\n");
++    pcie_phy_reg_dump(pcie_port);
++#endif
++}
++
+--- /dev/null
++++ b/arch/mips/pci/ifxmips_pcie_pm.c
+@@ -0,0 +1,176 @@
++/******************************************************************************
++**
++** FILE NAME    : ifxmips_pcie_pm.c
++** PROJECT      : IFX UEIP
++** MODULES      : PCIE Root Complex Driver
++**
++** DATE         : 21 Dec 2009
++** AUTHOR       : Lei Chuanhua
++** DESCRIPTION  : PCIE Root Complex Driver Power Managment
++** COPYRIGHT    :       Copyright (c) 2009
++**                      Lantiq Deutschland GmbH
++**                      Am Campeon 3, 85579 Neubiberg, Germany
++**
++**    This program is free software; you can redistribute it and/or modify
++**    it under the terms of the GNU General Public License as published by
++**    the Free Software Foundation; either version 2 of the License, or
++**    (at your option) any later version.
++**
++** HISTORY
++** $Date        $Author         $Comment
++** 21 Dec,2009   Lei Chuanhua    First UEIP release
++*******************************************************************************/
++/*!
++  \defgroup IFX_PCIE_PM Power Management functions
++  \ingroup IFX_PCIE
++  \brief IFX PCIE Root Complex Driver power management functions
++*/
++
++/*!
++ \file ifxmips_pcie_pm.c
++ \ingroup IFX_PCIE    
++ \brief source file for PCIE Root Complex Driver Power Management
++*/
++
++#ifndef EXPORT_SYMTAB
++#define EXPORT_SYMTAB
++#endif
++#ifndef AUTOCONF_INCLUDED
++#include <linux/config.h>
++#endif /* AUTOCONF_INCLUDED */
++#include <linux/version.h>
++#include <linux/module.h>
++#include <linux/types.h>
++#include <linux/kernel.h>
++#include <asm/system.h>
++
++/* Project header */
++#include <asm/ifx/ifx_types.h>
++#include <asm/ifx/ifx_regs.h>
++#include <asm/ifx/common_routines.h>
++#include <asm/ifx/ifx_pmcu.h>
++#include "ifxmips_pcie_pm.h"
++
++/** 
++ * \fn static IFX_PMCU_RETURN_t ifx_pcie_pmcu_state_change(IFX_PMCU_STATE_t pmcuState)
++ * \brief the callback function to request pmcu state in the power management hardware-dependent module
++ *
++ * \param pmcuState This parameter is a PMCU state.
++ *
++ * \return IFX_PMCU_RETURN_SUCCESS Set Power State successfully
++ * \return IFX_PMCU_RETURN_ERROR   Failed to set power state.
++ * \return IFX_PMCU_RETURN_DENIED  Not allowed to operate power state
++ * \ingroup IFX_PCIE_PM
++ */
++static IFX_PMCU_RETURN_t 
++ifx_pcie_pmcu_state_change(IFX_PMCU_STATE_t pmcuState)
++{
++    switch(pmcuState) 
++    {
++        case IFX_PMCU_STATE_D0:
++            return IFX_PMCU_RETURN_SUCCESS;
++        case IFX_PMCU_STATE_D1: // Not Applicable
++            return IFX_PMCU_RETURN_DENIED;
++        case IFX_PMCU_STATE_D2: // Not Applicable
++            return IFX_PMCU_RETURN_DENIED;
++        case IFX_PMCU_STATE_D3: // Module clock gating and Power gating
++            return IFX_PMCU_RETURN_SUCCESS;
++        default:
++            return IFX_PMCU_RETURN_DENIED;
++    }
++}
++
++/** 
++ * \fn static IFX_PMCU_RETURN_t ifx_pcie_pmcu_state_get(IFX_PMCU_STATE_t *pmcuState)
++ * \brief the callback function to get pmcu state in the power management hardware-dependent module
++
++ * \param pmcuState Pointer to return power state.
++ *
++ * \return IFX_PMCU_RETURN_SUCCESS Set Power State successfully
++ * \return IFX_PMCU_RETURN_ERROR   Failed to set power state.
++ * \return IFX_PMCU_RETURN_DENIED  Not allowed to operate power state
++ * \ingroup IFX_PCIE_PM
++ */
++static IFX_PMCU_RETURN_t 
++ifx_pcie_pmcu_state_get(IFX_PMCU_STATE_t *pmcuState)
++{
++    return IFX_PMCU_RETURN_SUCCESS;
++}
++
++/**
++ * \fn IFX_PMCU_RETURN_t ifx_pcie_pmcu_prechange(IFX_PMCU_MODULE_t pmcuModule, IFX_PMCU_STATE_t newState, IFX_PMCU_STATE_t oldState)
++ * \brief Apply all callbacks registered to be executed before a state change for pmcuModule
++ * 
++ * \param   pmcuModule      Module
++ * \param   newState        New state
++ * \param   oldState        Old state
++ * \return  IFX_PMCU_RETURN_SUCCESS Set Power State successfully
++ * \return  IFX_PMCU_RETURN_ERROR   Failed to set power state.
++ * \ingroup IFX_PCIE_PM
++ */
++static IFX_PMCU_RETURN_t 
++ifx_pcie_pmcu_prechange(IFX_PMCU_MODULE_t pmcuModule, IFX_PMCU_STATE_t newState, IFX_PMCU_STATE_t oldState)
++{
++    return IFX_PMCU_RETURN_SUCCESS;
++}
++
++/**
++ * \fn IFX_PMCU_RETURN_t ifx_pcie_pmcu_postchange(IFX_PMCU_MODULE_t pmcuModule, IFX_PMCU_STATE_t newState, IFX_PMCU_STATE_t oldState)
++ * \brief Apply all callbacks registered to be executed before a state change for pmcuModule
++ * 
++ * \param   pmcuModule      Module
++ * \param   newState        New state
++ * \param   oldState        Old state
++ * \return IFX_PMCU_RETURN_SUCCESS Set Power State successfully
++ * \return IFX_PMCU_RETURN_ERROR   Failed to set power state.
++ * \ingroup IFX_PCIE_PM
++ */
++static IFX_PMCU_RETURN_t 
++ifx_pcie_pmcu_postchange(IFX_PMCU_MODULE_t pmcuModule, IFX_PMCU_STATE_t newState, IFX_PMCU_STATE_t oldState)
++{
++    return IFX_PMCU_RETURN_SUCCESS;
++}
++
++/** 
++ * \fn static void ifx_pcie_pmcu_init(void)
++ * \brief Register with central PMCU module
++ * \return none
++ * \ingroup IFX_PCIE_PM
++ */
++void
++ifx_pcie_pmcu_init(void)
++{
++    IFX_PMCU_REGISTER_t pmcuRegister;
++
++    /* XXX, hook driver context */
++
++    /* State function register */
++    memset(&pmcuRegister, 0, sizeof(IFX_PMCU_REGISTER_t));
++    pmcuRegister.pmcuModule = IFX_PMCU_MODULE_PCIE;
++    pmcuRegister.pmcuModuleNr = 0;
++    pmcuRegister.ifx_pmcu_state_change = ifx_pcie_pmcu_state_change;
++    pmcuRegister.ifx_pmcu_state_get = ifx_pcie_pmcu_state_get;
++    pmcuRegister.pre = ifx_pcie_pmcu_prechange;
++    pmcuRegister.post= ifx_pcie_pmcu_postchange;
++    ifx_pmcu_register(&pmcuRegister); 
++}
++
++/** 
++ * \fn static void ifx_pcie_pmcu_exit(void)
++ * \brief Unregister with central PMCU module
++ *
++ * \return none
++ * \ingroup IFX_PCIE_PM
++ */
++void
++ifx_pcie_pmcu_exit(void)
++{
++    IFX_PMCU_REGISTER_t pmcuUnRegister;
++
++   /* XXX, hook driver context */
++   
++    pmcuUnRegister.pmcuModule = IFX_PMCU_MODULE_PCIE;
++    pmcuUnRegister.pmcuModuleNr = 0;
++    ifx_pmcu_unregister(&pmcuUnRegister);
++}
++
+--- /dev/null
++++ b/arch/mips/pci/ifxmips_pcie_pm.h
+@@ -0,0 +1,36 @@
++/******************************************************************************
++**
++** FILE NAME    : ifxmips_pcie_pm.h
++** PROJECT      : IFX UEIP
++** MODULES      : PCIe Root Complex Driver
++**
++** DATE         : 21 Dec 2009
++** AUTHOR       : Lei Chuanhua
++** DESCRIPTION  : PCIe Root Complex Driver Power Managment
++** COPYRIGHT    :       Copyright (c) 2009
++**                      Lantiq Deutschland GmbH
++**                      Am Campeon 3, 85579 Neubiberg, Germany
++**
++**    This program is free software; you can redistribute it and/or modify
++**    it under the terms of the GNU General Public License as published by
++**    the Free Software Foundation; either version 2 of the License, or
++**    (at your option) any later version.
++**
++** HISTORY
++** $Date        $Author         $Comment
++** 21 Dec,2009   Lei Chuanhua    First UEIP release
++*******************************************************************************/
++/*!
++ \file ifxmips_pcie_pm.h
++ \ingroup IFX_PCIE 
++ \brief header file for PCIe Root Complex Driver Power Management
++*/
++
++#ifndef IFXMIPS_PCIE_PM_H
++#define IFXMIPS_PCIE_PM_H
++
++void ifx_pcie_pmcu_init(void);
++void ifx_pcie_pmcu_exit(void);
++
++#endif /* IFXMIPS_PCIE_PM_H  */
++
+--- /dev/null
++++ b/arch/mips/pci/ifxmips_pcie_reg.h
+@@ -0,0 +1,1001 @@
++/******************************************************************************
++**
++** FILE NAME    : ifxmips_pcie_reg.h
++** PROJECT      : IFX UEIP for VRX200
++** MODULES      : PCIe module
++**
++** DATE         : 02 Mar 2009
++** AUTHOR       : Lei Chuanhua
++** DESCRIPTION  : PCIe Root Complex Driver
++** COPYRIGHT    :       Copyright (c) 2009
++**                      Infineon Technologies AG
++**                      Am Campeon 1-12, 85579 Neubiberg, Germany
++**
++**    This program is free software; you can redistribute it and/or modify
++**    it under the terms of the GNU General Public License as published by
++**    the Free Software Foundation; either version 2 of the License, or
++**    (at your option) any later version.
++** HISTORY
++** $Version $Date        $Author         $Comment
++** 0.0.1    17 Mar,2009  Lei Chuanhua    Initial version
++*******************************************************************************/
++#ifndef IFXMIPS_PCIE_REG_H
++#define IFXMIPS_PCIE_REG_H
++/*!
++ \file ifxmips_pcie_reg.h
++ \ingroup IFX_PCIE  
++ \brief header file for PCIe module register definition
++*/
++/* PCIe Address Mapping Base */
++#define PCIE_CFG_PHY_BASE        0x1D000000UL
++#define PCIE_CFG_BASE           (KSEG1 + PCIE_CFG_PHY_BASE)
++#define PCIE_CFG_SIZE           (8 * 1024 * 1024)
++
++#define PCIE_MEM_PHY_BASE        0x1C000000UL
++#define PCIE_MEM_BASE           (KSEG1 + PCIE_MEM_PHY_BASE)
++#define PCIE_MEM_SIZE           (16 * 1024 * 1024)
++#define PCIE_MEM_PHY_END        (PCIE_MEM_PHY_BASE + PCIE_MEM_SIZE - 1)
++
++#define PCIE_IO_PHY_BASE         0x1D800000UL
++#define PCIE_IO_BASE            (KSEG1 + PCIE_IO_PHY_BASE)
++#define PCIE_IO_SIZE            (1 * 1024 * 1024)
++#define PCIE_IO_PHY_END         (PCIE_IO_PHY_BASE + PCIE_IO_SIZE - 1)
++
++#define PCIE_RC_CFG_BASE        (KSEG1 + 0x1D900000)
++#define PCIE_APP_LOGIC_REG      (KSEG1 + 0x1E100900)
++#define PCIE_MSI_PHY_BASE        0x1F600000UL
++
++#define PCIE_PDI_PHY_BASE        0x1F106800UL
++#define PCIE_PDI_BASE           (KSEG1 + PCIE_PDI_PHY_BASE)
++#define PCIE_PDI_SIZE            0x400
++
++#define PCIE1_CFG_PHY_BASE        0x19000000UL
++#define PCIE1_CFG_BASE           (KSEG1 + PCIE1_CFG_PHY_BASE)
++#define PCIE1_CFG_SIZE           (8 * 1024 * 1024)
++
++#define PCIE1_MEM_PHY_BASE        0x18000000UL
++#define PCIE1_MEM_BASE           (KSEG1 + PCIE1_MEM_PHY_BASE)
++#define PCIE1_MEM_SIZE           (16 * 1024 * 1024)
++#define PCIE1_MEM_PHY_END        (PCIE1_MEM_PHY_BASE + PCIE1_MEM_SIZE - 1)
++
++#define PCIE1_IO_PHY_BASE         0x19800000UL
++#define PCIE1_IO_BASE            (KSEG1 + PCIE1_IO_PHY_BASE)
++#define PCIE1_IO_SIZE            (1 * 1024 * 1024)
++#define PCIE1_IO_PHY_END         (PCIE1_IO_PHY_BASE + PCIE1_IO_SIZE - 1)
++
++#define PCIE1_RC_CFG_BASE        (KSEG1 + 0x19900000)
++#define PCIE1_APP_LOGIC_REG      (KSEG1 + 0x1E100700)
++#define PCIE1_MSI_PHY_BASE        0x1F400000UL
++
++#define PCIE1_PDI_PHY_BASE        0x1F700400UL
++#define PCIE1_PDI_BASE           (KSEG1 + PCIE1_PDI_PHY_BASE)
++#define PCIE1_PDI_SIZE            0x400
++
++#define PCIE_CFG_PORT_TO_BASE(X)     ((X) > 0 ? (PCIE1_CFG_BASE) : (PCIE_CFG_BASE))
++#define PCIE_MEM_PORT_TO_BASE(X)     ((X) > 0 ? (PCIE1_MEM_BASE) : (PCIE_MEM_BASE))
++#define PCIE_IO_PORT_TO_BASE(X)      ((X) > 0 ? (PCIE1_IO_BASE) : (PCIE_IO_BASE))
++#define PCIE_MEM_PHY_PORT_TO_BASE(X) ((X) > 0 ? (PCIE1_MEM_PHY_BASE) : (PCIE_MEM_PHY_BASE))
++#define PCIE_MEM_PHY_PORT_TO_END(X)  ((X) > 0 ? (PCIE1_MEM_PHY_END) : (PCIE_MEM_PHY_END))
++#define PCIE_IO_PHY_PORT_TO_BASE(X)  ((X) > 0 ? (PCIE1_IO_PHY_BASE) : (PCIE_IO_PHY_BASE))
++#define PCIE_IO_PHY_PORT_TO_END(X)   ((X) > 0 ? (PCIE1_IO_PHY_END) : (PCIE_IO_PHY_END))
++#define PCIE_APP_PORT_TO_BASE(X)     ((X) > 0 ? (PCIE1_APP_LOGIC_REG) : (PCIE_APP_LOGIC_REG))
++#define PCIE_RC_PORT_TO_BASE(X)      ((X) > 0 ? (PCIE1_RC_CFG_BASE) : (PCIE_RC_CFG_BASE))
++#define PCIE_PHY_PORT_TO_BASE(X)     ((X) > 0 ? (PCIE1_PDI_BASE) : (PCIE_PDI_BASE))
++
++/* PCIe Application Logic Register */
++/* RC Core Control Register */
++#define PCIE_RC_CCR(X)                      (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x10)
++/* This should be enabled after initializing configuratin registers
++ * Also should check link status retraining bit
++ */
++#define PCIE_RC_CCR_LTSSM_ENABLE             0x00000001    /* Enable LTSSM to continue link establishment */
++
++/* RC Core Debug Register */
++#define PCIE_RC_DR(X)                       (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x14)
++#define PCIE_RC_DR_DLL_UP                    0x00000001  /* Data Link Layer Up */
++#define PCIE_RC_DR_CURRENT_POWER_STATE       0x0000000E  /* Current Power State */
++#define PCIE_RC_DR_CURRENT_POWER_STATE_S     1
++#define PCIE_RC_DR_CURRENT_LTSSM_STATE       0x000001F0  /* Current LTSSM State */
++#define PCIE_RC_DR_CURRENT_LTSSM_STATE_S     4
++
++#define PCIE_RC_DR_PM_DEV_STATE              0x00000E00  /* Power Management D-State */
++#define PCIE_RC_DR_PM_DEV_STATE_S            9
++
++#define PCIE_RC_DR_PM_ENABLED                0x00001000  /* Power Management State from PMU */
++#define PCIE_RC_DR_PME_EVENT_ENABLED         0x00002000  /* Power Management Event Enable State */
++#define PCIE_RC_DR_AUX_POWER_ENABLED         0x00004000  /* Auxiliary Power Enable */
++
++/* Current Power State Definition */
++enum {
++    PCIE_RC_DR_D0 = 0,
++    PCIE_RC_DR_D1,   /* Not supported */
++    PCIE_RC_DR_D2,   /* Not supported */
++    PCIE_RC_DR_D3,
++    PCIE_RC_DR_UN,
++};
++
++/* PHY Link Status Register */
++#define PCIE_PHY_SR(X)                      (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x18)
++#define PCIE_PHY_SR_PHY_LINK_UP              0x00000001   /* PHY Link Up/Down Indicator */
++
++/* Electromechanical Control Register */
++#define PCIE_EM_CR(X)                       (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x1C)
++#define PCIE_EM_CR_CARD_IS_PRESENT           0x00000001  /* Card Presence Detect State */
++#define PCIE_EM_CR_MRL_OPEN                  0x00000002  /* MRL Sensor State */
++#define PCIE_EM_CR_POWER_FAULT_SET           0x00000004  /* Power Fault Detected */
++#define PCIE_EM_CR_MRL_SENSOR_SET            0x00000008  /* MRL Sensor Changed */
++#define PCIE_EM_CR_PRESENT_DETECT_SET        0x00000010  /* Card Presense Detect Changed */
++#define PCIE_EM_CR_CMD_CPL_INT_SET           0x00000020  /* Command Complete Interrupt */
++#define PCIE_EM_CR_SYS_INTERLOCK_SET         0x00000040  /* System Electromechanical IterLock Engaged */
++#define PCIE_EM_CR_ATTENTION_BUTTON_SET      0x00000080  /* Attention Button Pressed */
++
++/* Interrupt Status Register */
++#define PCIE_IR_SR(X)                       (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x20)
++#define PCIE_IR_SR_PME_CAUSE_MSI             0x00000002  /* MSI caused by PME */
++#define PCIE_IR_SR_HP_PME_WAKE_GEN           0x00000004  /* Hotplug PME Wake Generation */
++#define PCIE_IR_SR_HP_MSI                    0x00000008  /* Hotplug MSI */
++#define PCIE_IR_SR_AHB_LU_ERR                0x00000030  /* AHB Bridge Lookup Error Signals */
++#define PCIE_IR_SR_AHB_LU_ERR_S              4
++#define PCIE_IR_SR_INT_MSG_NUM               0x00003E00  /* Interrupt Message Number */
++#define PCIE_IR_SR_INT_MSG_NUM_S             9
++#define PCIE_IR_SR_AER_INT_MSG_NUM           0xF8000000  /* Advanced Error Interrupt Message Number */
++#define PCIE_IR_SR_AER_INT_MSG_NUM_S         27
++
++/* Message Control Register */
++#define PCIE_MSG_CR(X)                      (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x30)
++#define PCIE_MSG_CR_GEN_PME_TURN_OFF_MSG     0x00000001  /* Generate PME Turn Off Message */
++#define PCIE_MSG_CR_GEN_UNLOCK_MSG           0x00000002  /* Generate Unlock Message */
++
++#define PCIE_VDM_DR(X)                      (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x34)
++
++/* Vendor-Defined Message Requester ID Register */
++#define PCIE_VDM_RID(X)                     (PCIE_APP_PORT_TO_BASE (X) + 0x38)
++#define PCIE_VDM_RID_VENROR_MSG_REQ_ID       0x0000FFFF
++#define PCIE_VDM_RID_VDMRID_S                0
++
++/* ASPM Control Register */
++#define PCIE_ASPM_CR(X)                     (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x40)
++#define PCIE_ASPM_CR_HOT_RST                 0x00000001  /* Hot Reset Request to the downstream device */
++#define PCIE_ASPM_CR_REQ_EXIT_L1             0x00000002  /* Request to Exit L1 */
++#define PCIE_ASPM_CR_REQ_ENTER_L1            0x00000004  /* Request to Enter L1 */
++
++/* Vendor Message DW0 Register */
++#define PCIE_VM_MSG_DW0(X)                  (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x50)
++#define PCIE_VM_MSG_DW0_TYPE                 0x0000001F  /* Message type */
++#define PCIE_VM_MSG_DW0_TYPE_S               0
++#define PCIE_VM_MSG_DW0_FORMAT               0x00000060  /* Format */
++#define PCIE_VM_MSG_DW0_FORMAT_S             5
++#define PCIE_VM_MSG_DW0_TC                   0x00007000  /* Traffic Class */
++#define PCIE_VM_MSG_DW0_TC_S                 12
++#define PCIE_VM_MSG_DW0_ATTR                 0x000C0000  /* Atrributes */
++#define PCIE_VM_MSG_DW0_ATTR_S               18
++#define PCIE_VM_MSG_DW0_EP_TLP               0x00100000  /* Poisoned TLP */
++#define PCIE_VM_MSG_DW0_TD                   0x00200000  /* TLP Digest */
++#define PCIE_VM_MSG_DW0_LEN                  0xFFC00000  /* Length */
++#define PCIE_VM_MSG_DW0_LEN_S                22
++
++/* Format Definition */
++enum {
++    PCIE_VM_MSG_FORMAT_00 = 0,  /* 3DW Hdr, no data*/
++    PCIE_VM_MSG_FORMAT_01,      /* 4DW Hdr, no data */
++    PCIE_VM_MSG_FORMAT_10,      /* 3DW Hdr, with data */
++    PCIE_VM_MSG_FORMAT_11,      /* 4DW Hdr, with data */
++};
++
++/* Traffic Class Definition */
++enum {
++    PCIE_VM_MSG_TC0 = 0,
++    PCIE_VM_MSG_TC1,
++    PCIE_VM_MSG_TC2,
++    PCIE_VM_MSG_TC3,
++    PCIE_VM_MSG_TC4,
++    PCIE_VM_MSG_TC5,
++    PCIE_VM_MSG_TC6,
++    PCIE_VM_MSG_TC7,
++};
++
++/* Attributes Definition */
++enum {
++    PCIE_VM_MSG_ATTR_00 = 0,   /* RO and No Snoop cleared */
++    PCIE_VM_MSG_ATTR_01,       /* RO cleared , No Snoop set */
++    PCIE_VM_MSG_ATTR_10,       /* RO set, No Snoop cleared*/
++    PCIE_VM_MSG_ATTR_11,       /* RO and No Snoop set */
++};
++
++/* Payload Size Definition */
++#define PCIE_VM_MSG_LEN_MIN  0
++#define PCIE_VM_MSG_LEN_MAX  1024
++
++/* Vendor Message DW1 Register */
++#define PCIE_VM_MSG_DW1(X)                 (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x54)
++#define PCIE_VM_MSG_DW1_FUNC_NUM            0x00000070  /* Function Number */
++#define PCIE_VM_MSG_DW1_FUNC_NUM_S          8
++#define PCIE_VM_MSG_DW1_CODE                0x00FF0000  /* Message Code */
++#define PCIE_VM_MSG_DW1_CODE_S              16
++#define PCIE_VM_MSG_DW1_TAG                 0xFF000000  /* Tag */
++#define PCIE_VM_MSG_DW1_TAG_S               24
++
++#define PCIE_VM_MSG_DW2(X)                  (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x58)
++#define PCIE_VM_MSG_DW3(X)                  (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x5C)
++
++/* Vendor Message Request Register */
++#define PCIE_VM_MSG_REQR(X)                 (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x60)
++#define PCIE_VM_MSG_REQR_REQ                 0x00000001  /* Vendor Message Request */
++
++
++/* AHB Slave Side Band Control Register */
++#define PCIE_AHB_SSB(X)                     (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x70)
++#define PCIE_AHB_SSB_REQ_BCM                0x00000001 /* Slave Reques BCM filed */
++#define PCIE_AHB_SSB_REQ_EP                 0x00000002 /* Slave Reques EP filed */
++#define PCIE_AHB_SSB_REQ_TD                 0x00000004 /* Slave Reques TD filed */
++#define PCIE_AHB_SSB_REQ_ATTR               0x00000018 /* Slave Reques Attribute number */
++#define PCIE_AHB_SSB_REQ_ATTR_S             3
++#define PCIE_AHB_SSB_REQ_TC                 0x000000E0 /* Slave Request TC Field */
++#define PCIE_AHB_SSB_REQ_TC_S               5
++
++/* AHB Master SideBand Ctrl Register */
++#define PCIE_AHB_MSB(X)                     (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x74)
++#define PCIE_AHB_MSB_RESP_ATTR               0x00000003 /* Master Response Attribute number */
++#define PCIE_AHB_MSB_RESP_ATTR_S             0
++#define PCIE_AHB_MSB_RESP_BAD_EOT            0x00000004 /* Master Response Badeot filed */
++#define PCIE_AHB_MSB_RESP_BCM                0x00000008 /* Master Response BCM filed */
++#define PCIE_AHB_MSB_RESP_EP                 0x00000010 /* Master Response EP filed */
++#define PCIE_AHB_MSB_RESP_TD                 0x00000020 /* Master Response TD filed */
++#define PCIE_AHB_MSB_RESP_FUN_NUM            0x000003C0 /* Master Response Function number */
++#define PCIE_AHB_MSB_RESP_FUN_NUM_S          6
++
++/* AHB Control Register, fixed bus enumeration exception */
++#define PCIE_AHB_CTRL(X)                     (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x78)
++#define PCIE_AHB_CTRL_BUS_ERROR_SUPPRESS     0x00000001 
++
++/* Interrupt Enalbe Register */
++#define PCIE_IRNEN(X)                        (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0xF4)
++#define PCIE_IRNCR(X)                        (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0xF8)
++#define PCIE_IRNICR(X)                       (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0xFC)
++
++/* PCIe interrupt enable/control/capture register definition */
++#define PCIE_IRN_AER_REPORT                 0x00000001  /* AER Interrupt */
++#define PCIE_IRN_AER_MSIX                   0x00000002  /* Advanced Error MSI-X Interrupt */
++#define PCIE_IRN_PME                        0x00000004  /* PME Interrupt */
++#define PCIE_IRN_HOTPLUG                    0x00000008  /* Hotplug Interrupt */
++#define PCIE_IRN_RX_VDM_MSG                 0x00000010  /* Vendor-Defined Message Interrupt */
++#define PCIE_IRN_RX_CORRECTABLE_ERR_MSG     0x00000020  /* Correctable Error Message Interrupt */
++#define PCIE_IRN_RX_NON_FATAL_ERR_MSG       0x00000040  /* Non-fatal Error Message */
++#define PCIE_IRN_RX_FATAL_ERR_MSG           0x00000080  /* Fatal Error Message */
++#define PCIE_IRN_RX_PME_MSG                 0x00000100  /* PME Message Interrupt */
++#define PCIE_IRN_RX_PME_TURNOFF_ACK         0x00000200  /* PME Turnoff Ack Message Interrupt */
++#define PCIE_IRN_AHB_BR_FATAL_ERR           0x00000400  /* AHB Fatal Error Interrupt */
++#define PCIE_IRN_LINK_AUTO_BW_STATUS        0x00000800  /* Link Auto Bandwidth Status Interrupt */
++#define PCIE_IRN_BW_MGT                     0x00001000  /* Bandwidth Managment Interrupt */
++#define PCIE_IRN_INTA                       0x00002000  /* INTA */
++#define PCIE_IRN_INTB                       0x00004000  /* INTB */
++#define PCIE_IRN_INTC                       0x00008000  /* INTC */
++#define PCIE_IRN_INTD                       0x00010000  /* INTD */
++#define PCIE_IRN_WAKEUP                     0x00020000  /* Wake up Interrupt */
++
++#define PCIE_RC_CORE_COMBINED_INT    (PCIE_IRN_AER_REPORT |  PCIE_IRN_AER_MSIX | PCIE_IRN_PME | \
++                                      PCIE_IRN_HOTPLUG | PCIE_IRN_RX_VDM_MSG | PCIE_IRN_RX_CORRECTABLE_ERR_MSG |\
++                                      PCIE_IRN_RX_NON_FATAL_ERR_MSG | PCIE_IRN_RX_FATAL_ERR_MSG | \
++                                      PCIE_IRN_RX_PME_MSG | PCIE_IRN_RX_PME_TURNOFF_ACK | PCIE_IRN_AHB_BR_FATAL_ERR | \
++                                      PCIE_IRN_LINK_AUTO_BW_STATUS | PCIE_IRN_BW_MGT)
++/* PCIe RC Configuration Register */
++#define PCIE_VDID(X)                (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x00)
++
++/* Bit definition from pci_reg.h */
++#define PCIE_PCICMDSTS(X)           (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x04)
++#define PCIE_CCRID(X)               (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x08)
++#define PCIE_CLSLTHTBR(X)           (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x0C) /* EP only */
++/* BAR0, BAR1,Only necessary if the bridges implements a device-specific register set or memory buffer */
++#define PCIE_BAR0(X)                (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x10) /* Not used*/
++#define PCIE_BAR1(X)                (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x14) /* Not used */
++
++#define PCIE_BNR(X)                 (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x18) /* Mandatory */
++/* Bus Number Register bits */
++#define PCIE_BNR_PRIMARY_BUS_NUM             0x000000FF
++#define PCIE_BNR_PRIMARY_BUS_NUM_S           0
++#define PCIE_PNR_SECONDARY_BUS_NUM           0x0000FF00
++#define PCIE_PNR_SECONDARY_BUS_NUM_S         8
++#define PCIE_PNR_SUB_BUS_NUM                 0x00FF0000
++#define PCIE_PNR_SUB_BUS_NUM_S               16
++
++/* IO Base/Limit Register bits */
++#define PCIE_IOBLSECS(X)                       (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x1C)  /* RC only */
++#define PCIE_IOBLSECS_32BIT_IO_ADDR             0x00000001
++#define PCIE_IOBLSECS_IO_BASE_ADDR              0x000000F0
++#define PCIE_IOBLSECS_IO_BASE_ADDR_S            4
++#define PCIE_IOBLSECS_32BIT_IOLIMT              0x00000100
++#define PCIE_IOBLSECS_IO_LIMIT_ADDR             0x0000F000
++#define PCIE_IOBLSECS_IO_LIMIT_ADDR_S           12
++
++/* Non-prefetchable Memory Base/Limit Register bit */
++#define PCIE_MBML(X)                           (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x20)  /* RC only */
++#define PCIE_MBML_MEM_BASE_ADDR                 0x0000FFF0
++#define PCIE_MBML_MEM_BASE_ADDR_S               4
++#define PCIE_MBML_MEM_LIMIT_ADDR                0xFFF00000
++#define PCIE_MBML_MEM_LIMIT_ADDR_S              20
++
++/* Prefetchable Memory Base/Limit Register bit */
++#define PCIE_PMBL(X)                           (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x24)  /* RC only */
++#define PCIE_PMBL_64BIT_ADDR                    0x00000001
++#define PCIE_PMBL_UPPER_12BIT                   0x0000FFF0
++#define PCIE_PMBL_UPPER_12BIT_S                 4
++#define PCIE_PMBL_E64MA                         0x00010000
++#define PCIE_PMBL_END_ADDR                      0xFFF00000
++#define PCIE_PMBL_END_ADDR_S                    20
++#define PCIE_PMBU32(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x28)  /* RC only */
++#define PCIE_PMLU32(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x2C)  /* RC only */
++
++/* I/O Base/Limit Upper 16 bits register */
++#define PCIE_IO_BANDL(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x30)  /* RC only */
++#define PCIE_IO_BANDL_UPPER_16BIT_IO_BASE        0x0000FFFF
++#define PCIE_IO_BANDL_UPPER_16BIT_IO_BASE_S      0
++#define PCIE_IO_BANDL_UPPER_16BIT_IO_LIMIT       0xFFFF0000
++#define PCIE_IO_BANDL_UPPER_16BIT_IO_LIMIT_S     16
++
++#define PCIE_CPR(X)                            (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x34)
++#define PCIE_EBBAR(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x38)
++
++/* Interrupt and Secondary Bridge Control Register */
++#define PCIE_INTRBCTRL(X)                      (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x3C)
++
++#define PCIE_INTRBCTRL_INT_LINE                 0x000000FF
++#define PCIE_INTRBCTRL_INT_LINE_S               0
++#define PCIE_INTRBCTRL_INT_PIN                  0x0000FF00
++#define PCIE_INTRBCTRL_INT_PIN_S                8
++#define PCIE_INTRBCTRL_PARITY_ERR_RESP_ENABLE   0x00010000    /* #PERR */
++#define PCIE_INTRBCTRL_SERR_ENABLE              0x00020000    /* #SERR */
++#define PCIE_INTRBCTRL_ISA_ENABLE               0x00040000    /* ISA enable, IO 64KB only */
++#define PCIE_INTRBCTRL_VGA_ENABLE               0x00080000    /* VGA enable */
++#define PCIE_INTRBCTRL_VGA_16BIT_DECODE         0x00100000    /* VGA 16bit decode */
++#define PCIE_INTRBCTRL_RST_SECONDARY_BUS        0x00400000    /* Secondary bus rest, hot rest, 1ms */
++/* Others are read only */
++enum {
++    PCIE_INTRBCTRL_INT_NON = 0,
++    PCIE_INTRBCTRL_INTA,
++    PCIE_INTRBCTRL_INTB,
++    PCIE_INTRBCTRL_INTC,
++    PCIE_INTRBCTRL_INTD,
++};
++
++#define PCIE_PM_CAPR(X)                  (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x40)
++
++/* Power Management Control and Status Register */
++#define PCIE_PM_CSR(X)                   (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x44)
++
++#define PCIE_PM_CSR_POWER_STATE           0x00000003   /* Power State */
++#define PCIE_PM_CSR_POWER_STATE_S         0
++#define PCIE_PM_CSR_SW_RST                0x00000008   /* Soft Reset Enabled */
++#define PCIE_PM_CSR_PME_ENABLE            0x00000100   /* PME Enable */
++#define PCIE_PM_CSR_PME_STATUS            0x00008000   /* PME status */
++
++/* MSI Capability Register for EP */
++#define PCIE_MCAPR(X)                    (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x50)
++
++#define PCIE_MCAPR_MSI_CAP_ID             0x000000FF  /* MSI Capability ID */
++#define PCIE_MCAPR_MSI_CAP_ID_S           0
++#define PCIE_MCAPR_MSI_NEXT_CAP_PTR       0x0000FF00  /* Next Capability Pointer */
++#define PCIE_MCAPR_MSI_NEXT_CAP_PTR_S     8
++#define PCIE_MCAPR_MSI_ENABLE             0x00010000  /* MSI Enable */
++#define PCIE_MCAPR_MULTI_MSG_CAP          0x000E0000  /* Multiple Message Capable */
++#define PCIE_MCAPR_MULTI_MSG_CAP_S        17
++#define PCIE_MCAPR_MULTI_MSG_ENABLE       0x00700000  /* Multiple Message Enable */
++#define PCIE_MCAPR_MULTI_MSG_ENABLE_S     20
++#define PCIE_MCAPR_ADDR64_CAP             0X00800000  /* 64-bit Address Capable */
++
++/* MSI Message Address Register */
++#define PCIE_MA(X)                       (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x54)
++
++#define PCIE_MA_ADDR_MASK                 0xFFFFFFFC  /* Message Address */
++
++/* MSI Message Upper Address Register */
++#define PCIE_MUA(X)                      (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x58)
++
++/* MSI Message Data Register */
++#define PCIE_MD(X)                       (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x5C)
++
++#define PCIE_MD_DATA                      0x0000FFFF  /* Message Data */
++#define PCIE_MD_DATA_S                    0
++
++/* PCI Express Capability Register */
++#define PCIE_XCAP(X)                     (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x70)
++
++#define PCIE_XCAP_ID                      0x000000FF  /* PCI Express Capability ID */
++#define PCIE_XCAP_ID_S                    0
++#define PCIE_XCAP_NEXT_CAP                0x0000FF00  /* Next Capability Pointer */
++#define PCIE_XCAP_NEXT_CAP_S              8
++#define PCIE_XCAP_VER                     0x000F0000  /* PCI Express Capability Version */
++#define PCIE_XCAP_VER_S                   16
++#define PCIE_XCAP_DEV_PORT_TYPE           0x00F00000  /* Device Port Type */
++#define PCIE_XCAP_DEV_PORT_TYPE_S         20
++#define PCIE_XCAP_SLOT_IMPLEMENTED        0x01000000  /* Slot Implemented */
++#define PCIE_XCAP_MSG_INT_NUM             0x3E000000  /* Interrupt Message Number */
++#define PCIE_XCAP_MSG_INT_NUM_S           25
++
++/* Device Capability Register */
++#define PCIE_DCAP(X)                     (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x74)
++
++#define PCIE_DCAP_MAX_PAYLOAD_SIZE        0x00000007   /* Max Payload size */
++#define PCIE_DCAP_MAX_PAYLOAD_SIZE_S      0
++#define PCIE_DCAP_PHANTOM_FUNC            0x00000018   /* Phanton Function, not supported */
++#define PCIE_DCAP_PHANTOM_FUNC_S          3
++#define PCIE_DCAP_EXT_TAG                 0x00000020   /* Extended Tag Field */
++#define PCIE_DCAP_EP_L0S_LATENCY          0x000001C0   /* EP L0s latency only */
++#define PCIE_DCAP_EP_L0S_LATENCY_S        6
++#define PCIE_DCAP_EP_L1_LATENCY           0x00000E00   /* EP L1 latency only */
++#define PCIE_DCAP_EP_L1_LATENCY_S         9
++#define PCIE_DCAP_ROLE_BASE_ERR_REPORT    0x00008000   /* Role Based ERR */
++
++/* Maximum payload size supported */
++enum {
++    PCIE_MAX_PAYLOAD_128 = 0,
++    PCIE_MAX_PAYLOAD_256,
++    PCIE_MAX_PAYLOAD_512,
++    PCIE_MAX_PAYLOAD_1024,
++    PCIE_MAX_PAYLOAD_2048,
++    PCIE_MAX_PAYLOAD_4096,
++};
++
++/* Device Control and Status Register */
++#define PCIE_DCTLSTS(X)                       (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x78)
++
++#define PCIE_DCTLSTS_CORRECTABLE_ERR_EN        0x00000001   /* COR-ERR */
++#define PCIE_DCTLSTS_NONFATAL_ERR_EN           0x00000002   /* Non-fatal ERR */
++#define PCIE_DCTLSTS_FATAL_ERR_EN              0x00000004   /* Fatal ERR */
++#define PCIE_DCTLSYS_UR_REQ_EN                 0x00000008   /* UR ERR */
++#define PCIE_DCTLSTS_RELAXED_ORDERING_EN       0x00000010   /* Enable relaxing ordering */
++#define PCIE_DCTLSTS_MAX_PAYLOAD_SIZE          0x000000E0   /* Max payload mask */
++#define PCIE_DCTLSTS_MAX_PAYLOAD_SIZE_S        5
++#define PCIE_DCTLSTS_EXT_TAG_EN                0x00000100   /* Extended tag field */
++#define PCIE_DCTLSTS_PHANTOM_FUNC_EN           0x00000200   /* Phantom Function Enable */
++#define PCIE_DCTLSTS_AUX_PM_EN                 0x00000400   /* AUX Power PM Enable */
++#define PCIE_DCTLSTS_NO_SNOOP_EN               0x00000800   /* Enable no snoop, except root port*/
++#define PCIE_DCTLSTS_MAX_READ_SIZE             0x00007000   /* Max Read Request size*/
++#define PCIE_DCTLSTS_MAX_READ_SIZE_S           12
++#define PCIE_DCTLSTS_CORRECTABLE_ERR           0x00010000   /* COR-ERR Detected */
++#define PCIE_DCTLSTS_NONFATAL_ERR              0x00020000   /* Non-Fatal ERR Detected */
++#define PCIE_DCTLSTS_FATAL_ER                  0x00040000   /* Fatal ERR Detected */
++#define PCIE_DCTLSTS_UNSUPPORTED_REQ           0x00080000   /* UR Detected */
++#define PCIE_DCTLSTS_AUX_POWER                 0x00100000   /* Aux Power Detected */
++#define PCIE_DCTLSTS_TRANSACT_PENDING          0x00200000   /* Transaction pending */
++
++#define PCIE_DCTLSTS_ERR_EN      (PCIE_DCTLSTS_CORRECTABLE_ERR_EN | \
++                                  PCIE_DCTLSTS_NONFATAL_ERR_EN | PCIE_DCTLSTS_FATAL_ERR_EN | \
++                                  PCIE_DCTLSYS_UR_REQ_EN)
++
++/* Link Capability Register */
++#define PCIE_LCAP(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x7C)
++#define PCIE_LCAP_MAX_LINK_SPEED               0x0000000F  /* Max link speed, 0x1 by default */
++#define PCIE_LCAP_MAX_LINK_SPEED_S             0
++#define PCIE_LCAP_MAX_LENGTH_WIDTH             0x000003F0  /* Maxium Length Width */
++#define PCIE_LCAP_MAX_LENGTH_WIDTH_S           4
++#define PCIE_LCAP_ASPM_LEVEL                   0x00000C00  /* Active State Link PM Support */
++#define PCIE_LCAP_ASPM_LEVEL_S                 10
++#define PCIE_LCAP_L0S_EIXT_LATENCY             0x00007000  /* L0s Exit Latency */
++#define PCIE_LCAP_L0S_EIXT_LATENCY_S           12
++#define PCIE_LCAP_L1_EXIT_LATENCY              0x00038000  /* L1 Exit Latency */
++#define PCIE_LCAP_L1_EXIT_LATENCY_S            15
++#define PCIE_LCAP_CLK_PM                       0x00040000  /* Clock Power Management */
++#define PCIE_LCAP_SDER                         0x00080000  /* Surprise Down Error Reporting */
++#define PCIE_LCAP_DLL_ACTIVE_REPROT            0x00100000  /* Data Link Layer Active Reporting Capable */
++#define PCIE_LCAP_PORT_NUM                     0xFF0000000  /* Port number */
++#define PCIE_LCAP_PORT_NUM_S                   24
++
++/* Maximum Length width definition */
++#define PCIE_MAX_LENGTH_WIDTH_RES  0x00
++#define PCIE_MAX_LENGTH_WIDTH_X1   0x01  /* Default */
++#define PCIE_MAX_LENGTH_WIDTH_X2   0x02
++#define PCIE_MAX_LENGTH_WIDTH_X4   0x04
++#define PCIE_MAX_LENGTH_WIDTH_X8   0x08
++#define PCIE_MAX_LENGTH_WIDTH_X12  0x0C
++#define PCIE_MAX_LENGTH_WIDTH_X16  0x10
++#define PCIE_MAX_LENGTH_WIDTH_X32  0x20
++
++/* Active State Link PM definition */
++enum {
++    PCIE_ASPM_RES0                = 0,
++    PCIE_ASPM_L0S_ENTRY_SUPPORT,        /* L0s */
++    PCIE_ASPM_RES1,
++    PCIE_ASPM_L0S_L1_ENTRY_SUPPORT,     /* L0s and L1, default */
++};
++
++/* L0s Exit Latency definition */
++enum {
++    PCIE_L0S_EIXT_LATENCY_L64NS    = 0, /* < 64 ns */
++    PCIE_L0S_EIXT_LATENCY_B64A128,      /* > 64 ns < 128 ns */
++    PCIE_L0S_EIXT_LATENCY_B128A256,     /* > 128 ns < 256 ns */
++    PCIE_L0S_EIXT_LATENCY_B256A512,     /* > 256 ns < 512 ns */
++    PCIE_L0S_EIXT_LATENCY_B512TO1U,     /* > 512 ns < 1 us */
++    PCIE_L0S_EIXT_LATENCY_B1A2U,        /* > 1 us < 2 us */
++    PCIE_L0S_EIXT_LATENCY_B2A4U,        /* > 2 us < 4 us */
++    PCIE_L0S_EIXT_LATENCY_M4US,         /* > 4 us  */
++};
++
++/* L1 Exit Latency definition */
++enum {
++    PCIE_L1_EXIT_LATENCY_L1US  = 0,  /* < 1 us */
++    PCIE_L1_EXIT_LATENCY_B1A2,       /* > 1 us < 2 us */
++    PCIE_L1_EXIT_LATENCY_B2A4,       /* > 2 us < 4 us */
++    PCIE_L1_EXIT_LATENCY_B4A8,       /* > 4 us < 8 us */
++    PCIE_L1_EXIT_LATENCY_B8A16,      /* > 8 us < 16 us */
++    PCIE_L1_EXIT_LATENCY_B16A32,     /* > 16 us < 32 us */
++    PCIE_L1_EXIT_LATENCY_B32A64,     /* > 32 us < 64 us */
++    PCIE_L1_EXIT_LATENCY_M64US,      /* > 64 us */
++};
++
++/* Link Control and Status Register */
++#define PCIE_LCTLSTS(X)                     (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x80)
++#define PCIE_LCTLSTS_ASPM_ENABLE            0x00000003  /* Active State Link PM Control */
++#define PCIE_LCTLSTS_ASPM_ENABLE_S          0
++#define PCIE_LCTLSTS_RCB128                 0x00000008  /* Read Completion Boundary 128*/
++#define PCIE_LCTLSTS_LINK_DISABLE           0x00000010  /* Link Disable */
++#define PCIE_LCTLSTS_RETRIAN_LINK           0x00000020  /* Retrain Link */
++#define PCIE_LCTLSTS_COM_CLK_CFG            0x00000040  /* Common Clock Configuration */
++#define PCIE_LCTLSTS_EXT_SYNC               0x00000080  /* Extended Synch */
++#define PCIE_LCTLSTS_CLK_PM_EN              0x00000100  /* Enable Clock Powerm Management */
++#define PCIE_LCTLSTS_LINK_SPEED             0x000F0000  /* Link Speed */
++#define PCIE_LCTLSTS_LINK_SPEED_S           16
++#define PCIE_LCTLSTS_NEGOTIATED_LINK_WIDTH  0x03F00000  /* Negotiated Link Width */
++#define PCIE_LCTLSTS_NEGOTIATED_LINK_WIDTH_S 20
++#define PCIE_LCTLSTS_RETRAIN_PENDING        0x08000000  /* Link training is ongoing */
++#define PCIE_LCTLSTS_SLOT_CLK_CFG           0x10000000  /* Slot Clock Configuration */
++#define PCIE_LCTLSTS_DLL_ACTIVE             0x20000000  /* Data Link Layer Active */
++
++/* Slot Capabilities Register */
++#define PCIE_SLCAP(X)                       (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x84)
++
++/* Slot Capabilities */
++#define PCIE_SLCTLSTS(X)                    (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x88)
++
++/* Root Control and Capability Register */
++#define PCIE_RCTLCAP(X)                     (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x8C)
++#define PCIE_RCTLCAP_SERR_ON_CORRECTABLE_ERR  0x00000001   /* #SERR on COR-ERR */
++#define PCIE_RCTLCAP_SERR_ON_NONFATAL_ERR     0x00000002   /* #SERR on Non-Fatal ERR */
++#define PCIE_RCTLCAP_SERR_ON_FATAL_ERR        0x00000004   /* #SERR on Fatal ERR */
++#define PCIE_RCTLCAP_PME_INT_EN               0x00000008   /* PME Interrupt Enable */
++#define PCIE_RCTLCAP_SERR_ENABLE    (PCIE_RCTLCAP_SERR_ON_CORRECTABLE_ERR | \
++                                     PCIE_RCTLCAP_SERR_ON_NONFATAL_ERR | PCIE_RCTLCAP_SERR_ON_FATAL_ERR)
++/* Root Status Register */
++#define PCIE_RSTS(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x90)
++#define PCIE_RSTS_PME_REQ_ID                   0x0000FFFF   /* PME Request ID */
++#define PCIE_RSTS_PME_REQ_ID_S                 0
++#define PCIE_RSTS_PME_STATUS                   0x00010000   /* PME Status */
++#define PCIE_RSTS_PME_PENDING                  0x00020000   /* PME Pending */
++
++/* PCI Express Enhanced Capability Header */
++#define PCIE_ENHANCED_CAP(X)                (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x100)
++#define PCIE_ENHANCED_CAP_ID                 0x0000FFFF  /* PCI Express Extended Capability ID */
++#define PCIE_ENHANCED_CAP_ID_S               0
++#define PCIE_ENHANCED_CAP_VER                0x000F0000  /* Capability Version */
++#define PCIE_ENHANCED_CAP_VER_S              16
++#define PCIE_ENHANCED_CAP_NEXT_OFFSET        0xFFF00000  /* Next Capability Offset */
++#define PCIE_ENHANCED_CAP_NEXT_OFFSET_S      20
++
++/* Uncorrectable Error Status Register */
++#define PCIE_UES_R(X)                       (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x104)
++#define PCIE_DATA_LINK_PROTOCOL_ERR          0x00000010  /* Data Link Protocol Error Status */
++#define PCIE_SURPRISE_DOWN_ERROR             0x00000020  /* Surprise Down Error Status */
++#define PCIE_POISONED_TLP                    0x00001000  /* Poisoned TLP Status */
++#define PCIE_FC_PROTOCOL_ERR                 0x00002000  /* Flow Control Protocol Error Status */
++#define PCIE_COMPLETION_TIMEOUT              0x00004000  /* Completion Timeout Status */
++#define PCIE_COMPLETOR_ABORT                 0x00008000  /* Completer Abort Error */
++#define PCIE_UNEXPECTED_COMPLETION           0x00010000  /* Unexpected Completion Status */
++#define PCIE_RECEIVER_OVERFLOW               0x00020000  /* Receive Overflow Status */
++#define PCIE_MALFORNED_TLP                   0x00040000  /* Malformed TLP Stauts */
++#define PCIE_ECRC_ERR                        0x00080000  /* ECRC Error Stauts */
++#define PCIE_UR_REQ                          0x00100000  /* Unsupported Request Error Status */
++#define PCIE_ALL_UNCORRECTABLE_ERR    (PCIE_DATA_LINK_PROTOCOL_ERR | PCIE_SURPRISE_DOWN_ERROR | \
++                         PCIE_POISONED_TLP | PCIE_FC_PROTOCOL_ERR | PCIE_COMPLETION_TIMEOUT |   \
++                         PCIE_COMPLETOR_ABORT | PCIE_UNEXPECTED_COMPLETION | PCIE_RECEIVER_OVERFLOW |\
++                         PCIE_MALFORNED_TLP | PCIE_ECRC_ERR | PCIE_UR_REQ)
++
++/* Uncorrectable Error Mask Register, Mask means no report */
++#define PCIE_UEMR(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x108)
++
++/* Uncorrectable Error Severity Register */
++#define PCIE_UESR(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x10C)
++
++/* Correctable Error Status Register */
++#define PCIE_CESR(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x110)
++#define PCIE_RX_ERR                          0x00000001  /* Receive Error Status */
++#define PCIE_BAD_TLP                         0x00000040  /* Bad TLP Status */
++#define PCIE_BAD_DLLP                        0x00000080  /* Bad DLLP Status */
++#define PCIE_REPLAY_NUM_ROLLOVER             0x00000100  /* Replay Number Rollover Status */
++#define PCIE_REPLAY_TIMER_TIMEOUT_ERR        0x00001000  /* Reply Timer Timeout Status */
++#define PCIE_ADVISORY_NONFTAL_ERR            0x00002000  /* Advisory Non-Fatal Error Status */
++#define PCIE_CORRECTABLE_ERR        (PCIE_RX_ERR | PCIE_BAD_TLP | PCIE_BAD_DLLP | PCIE_REPLAY_NUM_ROLLOVER |\
++                                     PCIE_REPLAY_TIMER_TIMEOUT_ERR | PCIE_ADVISORY_NONFTAL_ERR)
++
++/* Correctable Error Mask Register */
++#define PCIE_CEMR(X)                        (volatile u32*)(PCIE_RC_CFG_BASE + 0x114)
++
++/* Advanced Error Capabilities and Control Register */
++#define PCIE_AECCR(X)                       (volatile u32*)(PCIE_RC_CFG_BASE + 0x118)
++#define PCIE_AECCR_FIRST_ERR_PTR            0x0000001F  /* First Error Pointer */
++#define PCIE_AECCR_FIRST_ERR_PTR_S          0
++#define PCIE_AECCR_ECRC_GEN_CAP             0x00000020  /* ECRC Generation Capable */
++#define PCIE_AECCR_ECRC_GEN_EN              0x00000040  /* ECRC Generation Enable */
++#define PCIE_AECCR_ECRC_CHECK_CAP           0x00000080  /* ECRC Check Capable */
++#define PCIE_AECCR_ECRC_CHECK_EN            0x00000100  /* ECRC Check Enable */
++
++/* Header Log Register 1 */
++#define PCIE_HLR1(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x11C)
++
++/* Header Log Register 2 */
++#define PCIE_HLR2(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x120)
++
++/* Header Log Register 3 */
++#define PCIE_HLR3(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x124)
++
++/* Header Log Register 4 */
++#define PCIE_HLR4(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x128)
++
++/* Root Error Command Register */
++#define PCIE_RECR(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x12C)
++#define PCIE_RECR_CORRECTABLE_ERR_REPORT_EN  0x00000001 /* COR-ERR */
++#define PCIE_RECR_NONFATAL_ERR_REPORT_EN     0x00000002 /* Non-Fatal ERR */
++#define PCIE_RECR_FATAL_ERR_REPORT_EN        0x00000004 /* Fatal ERR */
++#define PCIE_RECR_ERR_REPORT_EN  (PCIE_RECR_CORRECTABLE_ERR_REPORT_EN | \
++                PCIE_RECR_NONFATAL_ERR_REPORT_EN | PCIE_RECR_FATAL_ERR_REPORT_EN)
++
++/* Root Error Status Register */
++#define PCIE_RESR(X)                            (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x130)
++#define PCIE_RESR_CORRECTABLE_ERR                0x00000001   /* COR-ERR Receveid */
++#define PCIE_RESR_MULTI_CORRECTABLE_ERR          0x00000002   /* Multiple COR-ERR Received */
++#define PCIE_RESR_FATAL_NOFATAL_ERR              0x00000004   /* ERR Fatal/Non-Fatal Received */
++#define PCIE_RESR_MULTI_FATAL_NOFATAL_ERR        0x00000008   /* Multiple ERR Fatal/Non-Fatal Received */
++#define PCIE_RESR_FIRST_UNCORRECTABLE_FATAL_ERR  0x00000010   /* First UN-COR Fatal */
++#define PCIR_RESR_NON_FATAL_ERR                  0x00000020   /* Non-Fatal Error Message Received */
++#define PCIE_RESR_FATAL_ERR                      0x00000040   /* Fatal Message Received */
++#define PCIE_RESR_AER_INT_MSG_NUM                0xF8000000   /* Advanced Error Interrupt Message Number */
++#define PCIE_RESR_AER_INT_MSG_NUM_S              27
++
++/* Error Source Indentification Register */
++#define PCIE_ESIR(X)                            (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x134)
++#define PCIE_ESIR_CORRECTABLE_ERR_SRC_ID         0x0000FFFF
++#define PCIE_ESIR_CORRECTABLE_ERR_SRC_ID_S       0
++#define PCIE_ESIR_FATAL_NON_FATAL_SRC_ID         0xFFFF0000
++#define PCIE_ESIR_FATAL_NON_FATAL_SRC_ID_S       16
++
++/* VC Enhanced Capability Header */
++#define PCIE_VC_ECH(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x140)
++
++/* Port VC Capability Register */
++#define PCIE_PVC1(X)                            (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x144)
++#define PCIE_PVC1_EXT_VC_CNT                    0x00000007  /* Extended VC Count */
++#define PCIE_PVC1_EXT_VC_CNT_S                  0
++#define PCIE_PVC1_LOW_PRI_EXT_VC_CNT            0x00000070  /* Low Priority Extended VC Count */
++#define PCIE_PVC1_LOW_PRI_EXT_VC_CNT_S          4
++#define PCIE_PVC1_REF_CLK                       0x00000300  /* Reference Clock */
++#define PCIE_PVC1_REF_CLK_S                     8
++#define PCIE_PVC1_PORT_ARB_TAB_ENTRY_SIZE       0x00000C00  /* Port Arbitration Table Entry Size */
++#define PCIE_PVC1_PORT_ARB_TAB_ENTRY_SIZE_S     10
++
++/* Extended Virtual Channel Count Defintion */
++#define PCIE_EXT_VC_CNT_MIN   0
++#define PCIE_EXT_VC_CNT_MAX   7
++
++/* Port Arbitration Table Entry Size Definition */
++enum {
++    PCIE_PORT_ARB_TAB_ENTRY_SIZE_S1BIT = 0,
++    PCIE_PORT_ARB_TAB_ENTRY_SIZE_S2BIT,
++    PCIE_PORT_ARB_TAB_ENTRY_SIZE_S4BIT,
++    PCIE_PORT_ARB_TAB_ENTRY_SIZE_S8BIT,
++};
++
++/* Port VC Capability Register 2 */
++#define PCIE_PVC2(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x148)
++#define PCIE_PVC2_VC_ARB_16P_FIXED_WRR      0x00000001  /* HW Fixed arbitration, 16 phase WRR */
++#define PCIE_PVC2_VC_ARB_32P_WRR            0x00000002  /* 32 phase WRR */
++#define PCIE_PVC2_VC_ARB_64P_WRR            0x00000004  /* 64 phase WRR */
++#define PCIE_PVC2_VC_ARB_128P_WRR           0x00000008  /* 128 phase WRR */
++#define PCIE_PVC2_VC_ARB_WRR                0x0000000F
++#define PCIE_PVC2_VC_ARB_TAB_OFFSET         0xFF000000  /* VC arbitration table offset, not support */
++#define PCIE_PVC2_VC_ARB_TAB_OFFSET_S       24
++
++/* Port VC Control and Status Register */     
++#define PCIE_PVCCRSR(X)                     (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x14C)
++#define PCIE_PVCCRSR_LOAD_VC_ARB_TAB         0x00000001  /* Load VC Arbitration Table */
++#define PCIE_PVCCRSR_VC_ARB_SEL              0x0000000E  /* VC Arbitration Select */
++#define PCIE_PVCCRSR_VC_ARB_SEL_S            1
++#define PCIE_PVCCRSR_VC_ARB_TAB_STATUS       0x00010000  /* Arbitration Status */
++
++/* VC0 Resource Capability Register */
++#define PCIE_VC0_RC(X)                       (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x150)
++#define PCIE_VC0_RC_PORT_ARB_HW_FIXED        0x00000001  /* HW Fixed arbitration */
++#define PCIE_VC0_RC_PORT_ARB_32P_WRR         0x00000002  /* 32 phase WRR */
++#define PCIE_VC0_RC_PORT_ARB_64P_WRR         0x00000004  /* 64 phase WRR */
++#define PCIE_VC0_RC_PORT_ARB_128P_WRR        0x00000008  /* 128 phase WRR */
++#define PCIE_VC0_RC_PORT_ARB_TM_128P_WRR     0x00000010  /* Time-based 128 phase WRR */
++#define PCIE_VC0_RC_PORT_ARB_TM_256P_WRR     0x00000020  /* Time-based 256 phase WRR */
++#define PCIE_VC0_RC_PORT_ARB          (PCIE_VC0_RC_PORT_ARB_HW_FIXED | PCIE_VC0_RC_PORT_ARB_32P_WRR |\
++                        PCIE_VC0_RC_PORT_ARB_64P_WRR | PCIE_VC0_RC_PORT_ARB_128P_WRR | \
++                        PCIE_VC0_RC_PORT_ARB_TM_128P_WRR | PCIE_VC0_RC_PORT_ARB_TM_256P_WRR)
++
++#define PCIE_VC0_RC_REJECT_SNOOP             0x00008000  /* Reject Snoop Transactioin */
++#define PCIE_VC0_RC_MAX_TIMESLOTS            0x007F0000  /* Maximum time Slots */
++#define PCIE_VC0_RC_MAX_TIMESLOTS_S          16
++#define PCIE_VC0_RC_PORT_ARB_TAB_OFFSET      0xFF000000  /* Port Arbitration Table Offset */
++#define PCIE_VC0_RC_PORT_ARB_TAB_OFFSET_S    24
++
++/* VC0 Resource Control Register */
++#define PCIE_VC0_RC0(X)                      (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x154)
++#define PCIE_VC0_RC0_TVM0                    0x00000001  /* TC0 and VC0 */
++#define PCIE_VC0_RC0_TVM1                    0x00000002  /* TC1 and VC1 */
++#define PCIE_VC0_RC0_TVM2                    0x00000004  /* TC2 and VC2 */
++#define PCIE_VC0_RC0_TVM3                    0x00000008  /* TC3 and VC3 */
++#define PCIE_VC0_RC0_TVM4                    0x00000010  /* TC4 and VC4 */
++#define PCIE_VC0_RC0_TVM5                    0x00000020  /* TC5 and VC5 */
++#define PCIE_VC0_RC0_TVM6                    0x00000040  /* TC6 and VC6 */
++#define PCIE_VC0_RC0_TVM7                    0x00000080  /* TC7 and VC7 */
++#define PCIE_VC0_RC0_TC_VC                   0x000000FF  /* TC/VC mask */
++
++#define PCIE_VC0_RC0_LOAD_PORT_ARB_TAB       0x00010000  /* Load Port Arbitration Table */
++#define PCIE_VC0_RC0_PORT_ARB_SEL            0x000E0000  /* Port Arbitration Select */
++#define PCIE_VC0_RC0_PORT_ARB_SEL_S          17
++#define PCIE_VC0_RC0_VC_ID                   0x07000000  /* VC ID */
++#define PCIE_VC0_RC0_VC_ID_S                 24
++#define PCIE_VC0_RC0_VC_EN                   0x80000000  /* VC Enable */
++
++/* VC0 Resource Status Register */
++#define PCIE_VC0_RSR0(X)                     (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x158)
++#define PCIE_VC0_RSR0_PORT_ARB_TAB_STATUS    0x00010000  /* Port Arbitration Table Status,not used */
++#define PCIE_VC0_RSR0_VC_NEG_PENDING         0x00020000  /* VC Negotiation Pending */
++
++/* Ack Latency Timer and Replay Timer Register */
++#define PCIE_ALTRT(X)                         (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x700)
++#define PCIE_ALTRT_ROUND_TRIP_LATENCY_LIMIT   0x0000FFFF  /* Round Trip Latency Time Limit */
++#define PCIE_ALTRT_ROUND_TRIP_LATENCY_LIMIT_S 0
++#define PCIE_ALTRT_REPLAY_TIME_LIMIT          0xFFFF0000  /* Replay Time Limit */
++#define PCIE_ALTRT_REPLAY_TIME_LIMIT_S        16
++
++/* Other Message Register */
++#define PCIE_OMR(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x704)
++
++/* Port Force Link Register */
++#define PCIE_PFLR(X)                         (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x708)
++#define PCIE_PFLR_LINK_NUM                   0x000000FF  /* Link Number */
++#define PCIE_PFLR_LINK_NUM_S                 0
++#define PCIE_PFLR_FORCE_LINK                 0x00008000  /* Force link */
++#define PCIE_PFLR_LINK_STATE                 0x003F0000  /* Link State */
++#define PCIE_PFLR_LINK_STATE_S               16
++#define PCIE_PFLR_LOW_POWER_ENTRY_CNT        0xFF000000  /* Low Power Entrance Count, only for EP */
++#define PCIE_PFLR_LOW_POWER_ENTRY_CNT_S      24
++
++/* Ack Frequency Register */
++#define PCIE_AFR(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x70C)
++#define PCIE_AFR_AF                          0x000000FF  /* Ack Frequency */
++#define PCIE_AFR_AF_S                        0
++#define PCIE_AFR_FTS_NUM                     0x0000FF00  /* The number of Fast Training Sequence from L0S to L0 */
++#define PCIE_AFR_FTS_NUM_S                   8
++#define PCIE_AFR_COM_FTS_NUM                 0x00FF0000  /* N_FTS; when common clock is used*/
++#define PCIE_AFR_COM_FTS_NUM_S               16
++#define PCIE_AFR_L0S_ENTRY_LATENCY           0x07000000  /* L0s Entrance Latency */
++#define PCIE_AFR_L0S_ENTRY_LATENCY_S         24
++#define PCIE_AFR_L1_ENTRY_LATENCY            0x38000000  /* L1 Entrance Latency */
++#define PCIE_AFR_L1_ENTRY_LATENCY_S          27
++#define PCIE_AFR_FTS_NUM_DEFAULT             32
++#define PCIE_AFR_L0S_ENTRY_LATENCY_DEFAULT   7
++#define PCIE_AFR_L1_ENTRY_LATENCY_DEFAULT    5
++
++/* Port Link Control Register */
++#define PCIE_PLCR(X)                         (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x710)
++#define PCIE_PLCR_OTHER_MSG_REQ              0x00000001  /* Other Message Request */
++#define PCIE_PLCR_SCRAMBLE_DISABLE           0x00000002  /* Scramble Disable */  
++#define PCIE_PLCR_LOOPBACK_EN                0x00000004  /* Loopback Enable */
++#define PCIE_PLCR_LTSSM_HOT_RST              0x00000008  /* Force LTSSM to the hot reset */
++#define PCIE_PLCR_DLL_LINK_EN                0x00000020  /* Enable Link initialization */
++#define PCIE_PLCR_FAST_LINK_SIM_EN           0x00000080  /* Sets all internal timers to fast mode for simulation purposes */
++#define PCIE_PLCR_LINK_MODE                  0x003F0000  /* Link Mode Enable Mask */
++#define PCIE_PLCR_LINK_MODE_S                16
++#define PCIE_PLCR_CORRUPTED_CRC_EN           0x02000000  /* Enabled Corrupt CRC */
++
++/* Lane Skew Register */
++#define PCIE_LSR(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x714)
++#define PCIE_LSR_LANE_SKEW_NUM               0x00FFFFFF  /* Insert Lane Skew for Transmit, not applicable */
++#define PCIE_LSR_LANE_SKEW_NUM_S             0
++#define PCIE_LSR_FC_DISABLE                  0x01000000  /* Disable of Flow Control */
++#define PCIE_LSR_ACKNAK_DISABLE              0x02000000  /* Disable of Ack/Nak */
++#define PCIE_LSR_LANE_DESKEW_DISABLE         0x80000000  /* Disable of Lane-to-Lane Skew */
++
++/* Symbol Number Register */
++#define PCIE_SNR(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x718)
++#define PCIE_SNR_TS                          0x0000000F  /* Number of TS Symbol */
++#define PCIE_SNR_TS_S                        0
++#define PCIE_SNR_SKP                         0x00000700  /* Number of SKP Symbol */
++#define PCIE_SNR_SKP_S                       8
++#define PCIE_SNR_REPLAY_TIMER                0x0007C000  /* Timer Modifier for Replay Timer */
++#define PCIE_SNR_REPLAY_TIMER_S              14
++#define PCIE_SNR_ACKNAK_LATENCY_TIMER        0x00F80000  /* Timer Modifier for Ack/Nak Latency Timer */
++#define PCIE_SNR_ACKNAK_LATENCY_TIMER_S      19
++#define PCIE_SNR_FC_TIMER                    0x1F000000  /* Timer Modifier for Flow Control Watchdog Timer */
++#define PCIE_SNR_FC_TIMER_S                  28
++
++/* Symbol Timer Register and Filter Mask Register 1 */
++#define PCIE_STRFMR(X)                      (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x71C)
++#define PCIE_STRFMR_SKP_INTERVAL            0x000007FF  /* SKP lnterval Value */
++#define PCIE_STRFMR_SKP_INTERVAL_S          0
++#define PCIE_STRFMR_FC_WDT_DISABLE          0x00008000  /* Disable of FC Watchdog Timer */
++#define PCIE_STRFMR_TLP_FUNC_MISMATCH_OK    0x00010000  /* Mask Function Mismatch Filtering for Incoming Requests */
++#define PCIE_STRFMR_POISONED_TLP_OK         0x00020000  /* Mask Poisoned TLP Filtering */
++#define PCIE_STRFMR_BAR_MATCH_OK            0x00040000  /* Mask BAR Match Filtering */
++#define PCIE_STRFMR_TYPE1_CFG_REQ_OK        0x00080000  /* Mask Type 1 Configuration Request Filtering */
++#define PCIE_STRFMR_LOCKED_REQ_OK           0x00100000  /* Mask Locked Request Filtering */
++#define PCIE_STRFMR_CPL_TAG_ERR_RULES_OK    0x00200000  /* Mask Tag Error Rules for Received Completions */
++#define PCIE_STRFMR_CPL_REQUESTOR_ID_MISMATCH_OK 0x00400000  /* Mask Requester ID Mismatch Error for Received Completions */
++#define PCIE_STRFMR_CPL_FUNC_MISMATCH_OK         0x00800000  /* Mask Function Mismatch Error for Received Completions */
++#define PCIE_STRFMR_CPL_TC_MISMATCH_OK           0x01000000  /* Mask Traffic Class Mismatch Error for Received Completions */
++#define PCIE_STRFMR_CPL_ATTR_MISMATCH_OK         0x02000000  /* Mask Attribute Mismatch Error for Received Completions */
++#define PCIE_STRFMR_CPL_LENGTH_MISMATCH_OK       0x04000000  /* Mask Length Mismatch Error for Received Completions */
++#define PCIE_STRFMR_TLP_ECRC_ERR_OK              0x08000000  /* Mask ECRC Error Filtering */
++#define PCIE_STRFMR_CPL_TLP_ECRC_OK              0x10000000  /* Mask ECRC Error Filtering for Completions */
++#define PCIE_STRFMR_RX_TLP_MSG_NO_DROP           0x20000000  /* Send Message TLPs */
++#define PCIE_STRFMR_RX_IO_TRANS_ENABLE           0x40000000  /* Mask Filtering of received I/O Requests */
++#define PCIE_STRFMR_RX_CFG_TRANS_ENABLE          0x80000000  /* Mask Filtering of Received Configuration Requests */
++
++#define PCIE_DEF_SKP_INTERVAL    700             /* 1180 ~1538 , 125MHz * 2, 250MHz * 1 */
++
++/* Filter Masker Register 2 */
++#define PCIE_FMR2(X)                             (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x720)
++#define PCIE_FMR2_VENDOR_MSG0_PASSED_TO_TRGT1    0x00000001  /* Mask RADM Filtering and Error Handling Rules */
++#define PCIE_FMR2_VENDOR_MSG1_PASSED_TO_TRGT1    0x00000002  /* Mask RADM Filtering and Error Handling Rules */
++
++/* Debug Register 0 */
++#define PCIE_DBR0(X)                              (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x728)
++
++/* Debug Register 1 */
++#define PCIE_DBR1(X)                              (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x72C)
++
++/* Transmit Posted FC Credit Status Register */
++#define PCIE_TPFCS(X)                             (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x730)
++#define PCIE_TPFCS_TX_P_DATA_FC_CREDITS           0x00000FFF /* Transmit Posted Data FC Credits */
++#define PCIE_TPFCS_TX_P_DATA_FC_CREDITS_S         0
++#define PCIE_TPFCS_TX_P_HDR_FC_CREDITS            0x000FF000 /* Transmit Posted Header FC Credits */
++#define PCIE_TPFCS_TX_P_HDR_FC_CREDITS_S          12
++
++/* Transmit Non-Posted FC Credit Status */
++#define PCIE_TNPFCS(X)                            (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x734)
++#define PCIE_TNPFCS_TX_NP_DATA_FC_CREDITS         0x00000FFF /* Transmit Non-Posted Data FC Credits */
++#define PCIE_TNPFCS_TX_NP_DATA_FC_CREDITS_S       0
++#define PCIE_TNPFCS_TX_NP_HDR_FC_CREDITS          0x000FF000 /* Transmit Non-Posted Header FC Credits */
++#define PCIE_TNPFCS_TX_NP_HDR_FC_CREDITS_S        12
++
++/* Transmit Complete FC Credit Status Register */
++#define PCIE_TCFCS(X)                             (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x738)
++#define PCIE_TCFCS_TX_CPL_DATA_FC_CREDITS         0x00000FFF /* Transmit Completion Data FC Credits */
++#define PCIE_TCFCS_TX_CPL_DATA_FC_CREDITS_S       0
++#define PCIE_TCFCS_TX_CPL_HDR_FC_CREDITS          0x000FF000 /* Transmit Completion Header FC Credits */
++#define PCIE_TCFCS_TX_CPL_HDR_FC_CREDITS_S        12
++
++/* Queue Status Register */
++#define PCIE_QSR(X)                              (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x73C)
++#define PCIE_QSR_WAIT_UPDATE_FC_DLL               0x00000001 /* Received TLP FC Credits Not Returned */
++#define PCIE_QSR_TX_RETRY_BUF_NOT_EMPTY           0x00000002 /* Transmit Retry Buffer Not Empty */
++#define PCIE_QSR_RX_QUEUE_NOT_EMPTY               0x00000004 /* Received Queue Not Empty */
++
++/* VC Transmit Arbitration Register 1 */
++#define PCIE_VCTAR1(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x740)
++#define PCIE_VCTAR1_WRR_WEIGHT_VC0               0x000000FF /* WRR Weight for VC0 */
++#define PCIE_VCTAR1_WRR_WEIGHT_VC1               0x0000FF00 /* WRR Weight for VC1 */
++#define PCIE_VCTAR1_WRR_WEIGHT_VC2               0x00FF0000 /* WRR Weight for VC2 */
++#define PCIE_VCTAR1_WRR_WEIGHT_VC3               0xFF000000 /* WRR Weight for VC3 */
++
++/* VC Transmit Arbitration Register 2 */
++#define PCIE_VCTAR2(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x744)
++#define PCIE_VCTAR2_WRR_WEIGHT_VC4               0x000000FF /* WRR Weight for VC4 */
++#define PCIE_VCTAR2_WRR_WEIGHT_VC5               0x0000FF00 /* WRR Weight for VC5 */
++#define PCIE_VCTAR2_WRR_WEIGHT_VC6               0x00FF0000 /* WRR Weight for VC6 */
++#define PCIE_VCTAR2_WRR_WEIGHT_VC7               0xFF000000 /* WRR Weight for VC7 */
++
++/* VC0 Posted Receive Queue Control Register */
++#define PCIE_VC0_PRQCR(X)                       (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x748)
++#define PCIE_VC0_PRQCR_P_DATA_CREDITS            0x00000FFF /* VC0 Posted Data Credits */
++#define PCIE_VC0_PRQCR_P_DATA_CREDITS_S          0
++#define PCIE_VC0_PRQCR_P_HDR_CREDITS             0x000FF000 /* VC0 Posted Header Credits */
++#define PCIE_VC0_PRQCR_P_HDR_CREDITS_S           12
++#define PCIE_VC0_PRQCR_P_TLP_QUEUE_MODE          0x00E00000 /* VC0 Posted TLP Queue Mode */
++#define PCIE_VC0_PRQCR_P_TLP_QUEUE_MODE_S        20
++#define PCIE_VC0_PRQCR_TLP_RELAX_ORDER           0x40000000 /* TLP Type Ordering for VC0 */    
++#define PCIE_VC0_PRQCR_VC_STRICT_ORDER           0x80000000 /* VC0 Ordering for Receive Queues */
++
++/* VC0 Non-Posted Receive Queue Control */
++#define PCIE_VC0_NPRQCR(X)                      (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x74C)
++#define PCIE_VC0_NPRQCR_NP_DATA_CREDITS          0x00000FFF /* VC0 Non-Posted Data Credits */
++#define PCIE_VC0_NPRQCR_NP_DATA_CREDITS_S        0
++#define PCIE_VC0_NPRQCR_NP_HDR_CREDITS           0x000FF000 /* VC0 Non-Posted Header Credits */
++#define PCIE_VC0_NPRQCR_NP_HDR_CREDITS_S         12
++#define PCIE_VC0_NPRQCR_NP_TLP_QUEUE_MODE        0x00E00000 /* VC0 Non-Posted TLP Queue Mode */
++#define PCIE_VC0_NPRQCR_NP_TLP_QUEUE_MODE_S      20
++
++/* VC0 Completion Receive Queue Control */
++#define PCIE_VC0_CRQCR(X)                       (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x750)
++#define PCIE_VC0_CRQCR_CPL_DATA_CREDITS          0x00000FFF /* VC0 Completion TLP Queue Mode */
++#define PCIE_VC0_CRQCR_CPL_DATA_CREDITS_S        0
++#define PCIE_VC0_CRQCR_CPL_HDR_CREDITS           0x000FF000 /* VC0 Completion Header Credits */
++#define PCIE_VC0_CRQCR_CPL_HDR_CREDITS_S         12
++#define PCIE_VC0_CRQCR_CPL_TLP_QUEUE_MODE        0x00E00000 /* VC0 Completion Data Credits */
++#define PCIE_VC0_CRQCR_CPL_TLP_QUEUE_MODE_S      21
++
++/* Applicable to the above three registers */
++enum {
++    PCIE_VC0_TLP_QUEUE_MODE_STORE_FORWARD = 1,
++    PCIE_VC0_TLP_QUEUE_MODE_CUT_THROUGH   = 2,
++    PCIE_VC0_TLP_QUEUE_MODE_BYPASS        = 4,
++};
++
++/* VC0 Posted Buffer Depth Register */
++#define PCIE_VC0_PBD(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x7A8)
++#define PCIE_VC0_PBD_P_DATA_QUEUE_ENTRIES       0x00003FFF /* VC0 Posted Data Queue Depth */
++#define PCIE_VC0_PBD_P_DATA_QUEUE_ENTRIES_S     0
++#define PCIE_VC0_PBD_P_HDR_QUEUE_ENTRIES        0x03FF0000 /* VC0 Posted Header Queue Depth */
++#define PCIE_VC0_PBD_P_HDR_QUEUE_ENTRIES_S      16
++
++/* VC0 Non-Posted Buffer Depth Register */
++#define PCIE_VC0_NPBD(X)                       (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x7AC)
++#define PCIE_VC0_NPBD_NP_DATA_QUEUE_ENTRIES     0x00003FFF /* VC0 Non-Posted Data Queue Depth */
++#define PCIE_VC0_NPBD_NP_DATA_QUEUE_ENTRIES_S   0
++#define PCIE_VC0_NPBD_NP_HDR_QUEUE_ENTRIES      0x03FF0000 /* VC0 Non-Posted Header Queue Depth */
++#define PCIE_VC0_NPBD_NP_HDR_QUEUE_ENTRIES_S    16
++
++/* VC0 Completion Buffer Depth Register */
++#define PCIE_VC0_CBD(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x7B0)
++#define PCIE_VC0_CBD_CPL_DATA_QUEUE_ENTRIES     0x00003FFF /* C0 Completion Data Queue Depth */
++#define PCIE_VC0_CBD_CPL_DATA_QUEUE_ENTRIES_S   0
++#define PCIE_VC0_CBD_CPL_HDR_QUEUE_ENTRIES      0x03FF0000 /* VC0 Completion Header Queue Depth */
++#define PCIE_VC0_CBD_CPL_HDR_QUEUE_ENTRIES_S    16
++
++/* PHY Status Register, all zeros in VR9 */
++#define PCIE_PHYSR(X)                           (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x810)
++
++/* PHY Control Register, all zeros in VR9 */
++#define PCIE_PHYCR(X)                           (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x814)
++
++/* 
++ * PCIe PDI PHY register definition, suppose all the following 
++ * stuff is confidential. 
++ * XXX, detailed bit definition
++ */
++#define	PCIE_PHY_PLL_CTRL1(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x22 << 1))
++#define	PCIE_PHY_PLL_CTRL2(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x23 << 1))
++#define	PCIE_PHY_PLL_CTRL3(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x24 << 1))
++#define	PCIE_PHY_PLL_CTRL4(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x25 << 1))
++#define	PCIE_PHY_PLL_CTRL5(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x26 << 1))
++#define	PCIE_PHY_PLL_CTRL6(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x27 << 1))
++#define	PCIE_PHY_PLL_CTRL7(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x28 << 1))
++#define	PCIE_PHY_PLL_A_CTRL1(X)     (PCIE_PHY_PORT_TO_BASE(X) + (0x29 << 1))
++#define	PCIE_PHY_PLL_A_CTRL2(X)     (PCIE_PHY_PORT_TO_BASE(X) + (0x2A << 1))
++#define	PCIE_PHY_PLL_A_CTRL3(X)     (PCIE_PHY_PORT_TO_BASE(X) + (0x2B << 1))
++#define	PCIE_PHY_PLL_STATUS(X)      (PCIE_PHY_PORT_TO_BASE(X) + (0x2C << 1))
++ 
++#define PCIE_PHY_TX1_CTRL1(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x30 << 1))
++#define PCIE_PHY_TX1_CTRL2(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x31 << 1))
++#define PCIE_PHY_TX1_CTRL3(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x32 << 1))
++#define PCIE_PHY_TX1_A_CTRL1(X)     (PCIE_PHY_PORT_TO_BASE(X) + (0x33 << 1))
++#define PCIE_PHY_TX1_A_CTRL2(X)     (PCIE_PHY_PORT_TO_BASE(X) + (0x34 << 1))
++#define PCIE_PHY_TX1_MOD1(X)        (PCIE_PHY_PORT_TO_BASE(X) + (0x35 << 1))
++#define PCIE_PHY_TX1_MOD2(X)        (PCIE_PHY_PORT_TO_BASE(X) + (0x36 << 1))
++#define PCIE_PHY_TX1_MOD3(X)        (PCIE_PHY_PORT_TO_BASE(X) + (0x37 << 1))
++
++#define PCIE_PHY_TX2_CTRL1(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x38 << 1))
++#define PCIE_PHY_TX2_CTRL2(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x39 << 1))
++#define PCIE_PHY_TX2_A_CTRL1(X)     (PCIE_PHY_PORT_TO_BASE(X) + (0x3B << 1))
++#define PCIE_PHY_TX2_A_CTRL2(X)     (PCIE_PHY_PORT_TO_BASE(X) + (0x3C << 1))
++#define PCIE_PHY_TX2_MOD1(X)        (PCIE_PHY_PORT_TO_BASE(X) + (0x3D << 1))
++#define PCIE_PHY_TX2_MOD2(X)        (PCIE_PHY_PORT_TO_BASE(X) + (0x3E << 1))
++#define PCIE_PHY_TX2_MOD3(X)        (PCIE_PHY_PORT_TO_BASE(X) + (0x3F << 1))
++
++#define PCIE_PHY_RX1_CTRL1(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x50 << 1))
++#define PCIE_PHY_RX1_CTRL2(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x51 << 1))
++#define PCIE_PHY_RX1_CDR(X)         (PCIE_PHY_PORT_TO_BASE(X) + (0x52 << 1))
++#define PCIE_PHY_RX1_EI(X)          (PCIE_PHY_PORT_TO_BASE(X) + (0x53 << 1))
++#define PCIE_PHY_RX1_A_CTRL(X)      (PCIE_PHY_PORT_TO_BASE(X) + (0x55 << 1))
++
++/* Interrupt related stuff */
++#define PCIE_LEGACY_DISABLE 0
++#define PCIE_LEGACY_INTA  1
++#define PCIE_LEGACY_INTB  2
++#define PCIE_LEGACY_INTC  3
++#define PCIE_LEGACY_INTD  4
++#define PCIE_LEGACY_INT_MAX PCIE_LEGACY_INTD
++
++#endif /* IFXMIPS_PCIE_REG_H */
++
+--- /dev/null
++++ b/arch/mips/pci/ifxmips_pcie_vr9.h
+@@ -0,0 +1,269 @@
++/****************************************************************************
++                              Copyright (c) 2010
++                            Lantiq Deutschland GmbH
++                     Am Campeon 3; 85579 Neubiberg, Germany
++
++  For licensing information, see the file 'LICENSE' in the root folder of
++  this software module.
++
++ *****************************************************************************/
++/*!
++  \file ifxmips_pcie_vr9.h
++  \ingroup IFX_PCIE
++  \brief PCIe RC driver vr9 specific file
++*/
++
++#ifndef IFXMIPS_PCIE_VR9_H
++#define IFXMIPS_PCIE_VR9_H
++
++#include <linux/types.h>
++#include <linux/delay.h>
++
++#include <linux/gpio.h>
++#include <lantiq_soc.h>
++
++#define IFX_PCIE_GPIO_RESET  494
++
++#define IFX_REG_R32    ltq_r32
++#define IFX_REG_W32    ltq_w32
++#define CONFIG_IFX_PCIE_HW_SWAP
++#define IFX_RCU_AHB_ENDIAN                      ((volatile u32*)(IFX_RCU + 0x004C))
++#define IFX_RCU_RST_REQ                         ((volatile u32*)(IFX_RCU + 0x0010))
++#define IFX_RCU_AHB_BE_PCIE_PDI                  0x00000080  /* Configure PCIE PDI module in big endian*/
++
++#define IFX_RCU                                 (KSEG1 | 0x1F203000)
++#define IFX_RCU_AHB_BE_PCIE_M                    0x00000001  /* Configure AHB master port that connects to PCIe RC in big endian */
++#define IFX_RCU_AHB_BE_PCIE_S                    0x00000010  /* Configure AHB slave port that connects to PCIe RC in little endian */
++#define IFX_RCU_AHB_BE_XBAR_M                    0x00000002  /* Configure AHB master port that connects to XBAR in big endian */
++#define CONFIG_IFX_PCIE_PHY_36MHZ_MODE
++
++#define IFX_PMU1_MODULE_PCIE_PHY   (0)
++#define IFX_PMU1_MODULE_PCIE_CTRL  (1)
++#define IFX_PMU1_MODULE_PDI        (4)
++#define IFX_PMU1_MODULE_MSI        (5)
++
++#define IFX_PMU_MODULE_PCIE_L0_CLK (31)
++
++
++#define IFX_GPIO				(KSEG1 | 0x1E100B00)
++#define ALT0			((volatile u32*)(IFX_GPIO + 0x007c))
++#define ALT1			((volatile u32*)(IFX_GPIO + 0x0080))
++#define OD			((volatile u32*)(IFX_GPIO + 0x0084))
++#define DIR			((volatile u32*)(IFX_GPIO + 0x0078))
++#define OUT			((volatile u32*)(IFX_GPIO + 0x0070))
++
++
++static inline void pcie_ep_gpio_rst_init(int pcie_port)
++{
++
++	gpio_request(IFX_PCIE_GPIO_RESET, "pcie-reset");
++	gpio_direction_output(IFX_PCIE_GPIO_RESET, 1);
++	gpio_set_value(IFX_PCIE_GPIO_RESET, 1);
++
++/*    ifx_gpio_pin_reserve(IFX_PCIE_GPIO_RESET, ifx_pcie_gpio_module_id);
++    ifx_gpio_output_set(IFX_PCIE_GPIO_RESET, ifx_pcie_gpio_module_id);
++    ifx_gpio_dir_out_set(IFX_PCIE_GPIO_RESET, ifx_pcie_gpio_module_id);
++    ifx_gpio_altsel0_clear(IFX_PCIE_GPIO_RESET, ifx_pcie_gpio_module_id);
++    ifx_gpio_altsel1_clear(IFX_PCIE_GPIO_RESET, ifx_pcie_gpio_module_id);
++    ifx_gpio_open_drain_set(IFX_PCIE_GPIO_RESET, ifx_pcie_gpio_module_id);*/
++}
++
++static inline void pcie_ahb_pmu_setup(void) 
++{
++	/* Enable AHB bus master/slave */
++	struct clk *clk;
++	clk = clk_get_sys("1d900000.pcie", "ahb");
++	clk_enable(clk);
++
++    //AHBM_PMU_SETUP(IFX_PMU_ENABLE);
++    //AHBS_PMU_SETUP(IFX_PMU_ENABLE);
++}
++
++static inline void pcie_rcu_endian_setup(int pcie_port)
++{
++    u32 reg;
++
++    reg = IFX_REG_R32(IFX_RCU_AHB_ENDIAN);
++#ifdef CONFIG_IFX_PCIE_HW_SWAP
++    reg |= IFX_RCU_AHB_BE_PCIE_M;
++    reg |= IFX_RCU_AHB_BE_PCIE_S;
++    reg &= ~IFX_RCU_AHB_BE_XBAR_M;
++#else 
++    reg |= IFX_RCU_AHB_BE_PCIE_M;
++    reg &= ~IFX_RCU_AHB_BE_PCIE_S;
++    reg &= ~IFX_RCU_AHB_BE_XBAR_M;
++#endif /* CONFIG_IFX_PCIE_HW_SWAP */
++    IFX_REG_W32(reg, IFX_RCU_AHB_ENDIAN);
++    IFX_PCIE_PRINT(PCIE_MSG_REG, "%s IFX_RCU_AHB_ENDIAN: 0x%08x\n", __func__, IFX_REG_R32(IFX_RCU_AHB_ENDIAN));
++}
++
++static inline void pcie_phy_pmu_enable(int pcie_port)
++{
++	struct clk *clk;
++	clk = clk_get_sys("1d900000.pcie", "phy");
++	clk_enable(clk);
++
++	//PCIE_PHY_PMU_SETUP(IFX_PMU_ENABLE);
++}
++
++static inline void pcie_phy_pmu_disable(int pcie_port)
++{
++	struct clk *clk;
++	clk = clk_get_sys("1d900000.pcie", "phy");
++	clk_disable(clk);
++
++//    PCIE_PHY_PMU_SETUP(IFX_PMU_DISABLE);
++}
++
++static inline void pcie_pdi_big_endian(int pcie_port)
++{
++    u32 reg;
++
++    /* SRAM2PDI endianness control. */
++    reg = IFX_REG_R32(IFX_RCU_AHB_ENDIAN);
++    /* Config AHB->PCIe and PDI endianness */
++    reg |= IFX_RCU_AHB_BE_PCIE_PDI;
++    IFX_REG_W32(reg, IFX_RCU_AHB_ENDIAN);
++}
++
++static inline void pcie_pdi_pmu_enable(int pcie_port)
++{
++    /* Enable PDI to access PCIe PHY register */
++	struct clk *clk;
++	clk = clk_get_sys("1d900000.pcie", "pdi");
++	clk_enable(clk);
++    //PDI_PMU_SETUP(IFX_PMU_ENABLE);
++}
++
++static inline void pcie_core_rst_assert(int pcie_port)
++{
++    u32 reg;
++
++    reg = IFX_REG_R32(IFX_RCU_RST_REQ);
++
++    /* Reset PCIe PHY & Core, bit 22, bit 26 may be affected if write it directly  */
++    reg |= 0x00400000;
++    IFX_REG_W32(reg, IFX_RCU_RST_REQ);
++}
++
++static inline void pcie_core_rst_deassert(int pcie_port)
++{
++    u32 reg;
++
++    /* Make sure one micro-second delay */
++    udelay(1);
++
++    /* Reset PCIe PHY & Core, bit 22 */
++    reg = IFX_REG_R32(IFX_RCU_RST_REQ);
++    reg &= ~0x00400000;
++    IFX_REG_W32(reg, IFX_RCU_RST_REQ);
++}
++
++static inline void pcie_phy_rst_assert(int pcie_port)
++{
++    u32 reg;
++
++    reg = IFX_REG_R32(IFX_RCU_RST_REQ);
++    reg |= 0x00001000; /* Bit 12 */
++    IFX_REG_W32(reg, IFX_RCU_RST_REQ);
++}
++
++static inline void pcie_phy_rst_deassert(int pcie_port)
++{
++    u32 reg;
++
++    /* Make sure one micro-second delay */
++    udelay(1);
++
++    reg = IFX_REG_R32(IFX_RCU_RST_REQ);
++    reg &= ~0x00001000; /* Bit 12 */
++    IFX_REG_W32(reg, IFX_RCU_RST_REQ);
++}
++
++static inline void pcie_device_rst_assert(int pcie_port)
++{
++	gpio_set_value(IFX_PCIE_GPIO_RESET, 0);
++//    ifx_gpio_output_clear(IFX_PCIE_GPIO_RESET, ifx_pcie_gpio_module_id);
++}
++
++static inline void pcie_device_rst_deassert(int pcie_port)
++{
++    mdelay(100);
++	gpio_direction_output(IFX_PCIE_GPIO_RESET, 1);
++//    gpio_set_value(IFX_PCIE_GPIO_RESET, 1);
++    //ifx_gpio_output_set(IFX_PCIE_GPIO_RESET, ifx_pcie_gpio_module_id);
++}
++
++static inline void pcie_core_pmu_setup(int pcie_port)
++{
++	struct clk *clk;
++	clk = clk_get_sys("1d900000.pcie", "ctl");
++	clk_enable(clk);
++	clk = clk_get_sys("1d900000.pcie", "bus");
++	clk_enable(clk);
++
++    /* PCIe Core controller enabled */
++//    PCIE_CTRL_PMU_SETUP(IFX_PMU_ENABLE);
++
++    /* Enable PCIe L0 Clock */
++//  PCIE_L0_CLK_PMU_SETUP(IFX_PMU_ENABLE);
++}
++
++static inline void pcie_msi_init(int pcie_port)
++{
++	struct clk *clk;
++	pcie_msi_pic_init(pcie_port);
++	clk = clk_get_sys("ltq_pcie", "msi");
++	clk_enable(clk);
++//    MSI_PMU_SETUP(IFX_PMU_ENABLE);
++}
++
++static inline u32
++ifx_pcie_bus_nr_deduct(u32 bus_number, int pcie_port)
++{
++    u32 tbus_number = bus_number;
++
++#ifdef CONFIG_PCI_LANTIQ
++    if (pcibios_host_nr() > 1) {
++        tbus_number -= pcibios_1st_host_bus_nr();
++    }
++#endif /* CONFIG_PCI_LANTIQ */
++    return tbus_number;
++}
++
++static inline u32
++ifx_pcie_bus_enum_hack(struct pci_bus *bus, u32 devfn, int where, u32 value, int pcie_port, int read)
++{
++    struct pci_dev *pdev;
++    u32 tvalue = value;
++
++    /* Sanity check */
++    pdev = pci_get_slot(bus, devfn);
++    if (pdev == NULL) {
++        return tvalue;
++    }
++
++    /* Only care about PCI bridge */
++    if (pdev->hdr_type != PCI_HEADER_TYPE_BRIDGE) {
++        return tvalue;
++    }
++
++    if (read) { /* Read hack */
++    #ifdef CONFIG_PCI_LANTIQ
++        if (pcibios_host_nr() > 1) {
++            tvalue = ifx_pcie_bus_enum_read_hack(where, tvalue);
++        }
++    #endif /* CONFIG_PCI_LANTIQ */
++    }
++    else { /* Write hack */
++    #ifdef CONFIG_PCI_LANTIQ
++        if (pcibios_host_nr() > 1) {
++            tvalue = ifx_pcie_bus_enum_write_hack(where, tvalue);
++        }
++    #endif
++    }
++    return tvalue;
++}
++
++#endif /* IFXMIPS_PCIE_VR9_H */
++
+--- a/arch/mips/pci/pci-legacy.c
++++ b/arch/mips/pci/pci-legacy.c
+@@ -305,3 +305,30 @@ char *__init pcibios_setup(char *str)
+ 		return pcibios_plat_setup(str);
+ 	return str;
+ }
++
++int pcibios_host_nr(void)
++{
++    int count = 0;
++    struct pci_controller *hose;
++    list_for_each_entry(hose, &controllers, list) {
++        count++;
++    }
++    return count;
++}
++EXPORT_SYMBOL(pcibios_host_nr);
++
++int pcibios_1st_host_bus_nr(void)
++{
++    int bus_nr = 0;
++    struct pci_controller *hose;
++
++    hose = list_first_entry_or_null(&controllers, struct pci_controller, list);
++
++    if (hose != NULL) {
++        if (hose->bus != NULL) {
++            bus_nr = hose->bus->number + 1;
++        }
++    }
++    return bus_nr;
++}
++EXPORT_SYMBOL(pcibios_1st_host_bus_nr);
+--- /dev/null
++++ b/arch/mips/pci/pcie-lantiq.h
+@@ -0,0 +1,1301 @@
++/******************************************************************************
++**
++** FILE NAME    : ifxmips_pcie_reg.h
++** PROJECT      : IFX UEIP for VRX200
++** MODULES      : PCIe module
++**
++** DATE         : 02 Mar 2009
++** AUTHOR       : Lei Chuanhua
++** DESCRIPTION  : PCIe Root Complex Driver
++** COPYRIGHT    :       Copyright (c) 2009
++**                      Infineon Technologies AG
++**                      Am Campeon 1-12, 85579 Neubiberg, Germany
++**
++**    This program is free software; you can redistribute it and/or modify
++**    it under the terms of the GNU General Public License as published by
++**    the Free Software Foundation; either version 2 of the License, or
++**    (at your option) any later version.
++** HISTORY
++** $Version $Date        $Author         $Comment
++** 0.0.1    17 Mar,2009  Lei Chuanhua    Initial version
++*******************************************************************************/
++#ifndef IFXMIPS_PCIE_REG_H
++#define IFXMIPS_PCIE_REG_H
++#include <linux/version.h>
++#include <linux/types.h>
++#include <linux/pci.h>
++#include <linux/interrupt.h>
++/*!
++ \file ifxmips_pcie_reg.h
++ \ingroup IFX_PCIE  
++ \brief header file for PCIe module register definition
++*/
++/* PCIe Address Mapping Base */
++#define PCIE_CFG_PHY_BASE        0x1D000000UL
++#define PCIE_CFG_BASE           (KSEG1 + PCIE_CFG_PHY_BASE)
++#define PCIE_CFG_SIZE           (8 * 1024 * 1024)
++
++#define PCIE_MEM_PHY_BASE        0x1C000000UL
++#define PCIE_MEM_BASE           (KSEG1 + PCIE_MEM_PHY_BASE)
++#define PCIE_MEM_SIZE           (16 * 1024 * 1024)
++#define PCIE_MEM_PHY_END        (PCIE_MEM_PHY_BASE + PCIE_MEM_SIZE - 1)
++
++#define PCIE_IO_PHY_BASE         0x1D800000UL
++#define PCIE_IO_BASE            (KSEG1 + PCIE_IO_PHY_BASE)
++#define PCIE_IO_SIZE            (1 * 1024 * 1024)
++#define PCIE_IO_PHY_END         (PCIE_IO_PHY_BASE + PCIE_IO_SIZE - 1)
++
++#define PCIE_RC_CFG_BASE        (KSEG1 + 0x1D900000)
++#define PCIE_APP_LOGIC_REG      (KSEG1 + 0x1E100900)
++#define PCIE_MSI_PHY_BASE        0x1F600000UL
++
++#define PCIE_PDI_PHY_BASE        0x1F106800UL
++#define PCIE_PDI_BASE           (KSEG1 + PCIE_PDI_PHY_BASE)
++#define PCIE_PDI_SIZE            0x400
++
++#define PCIE1_CFG_PHY_BASE        0x19000000UL
++#define PCIE1_CFG_BASE           (KSEG1 + PCIE1_CFG_PHY_BASE)
++#define PCIE1_CFG_SIZE           (8 * 1024 * 1024)
++
++#define PCIE1_MEM_PHY_BASE        0x18000000UL
++#define PCIE1_MEM_BASE           (KSEG1 + PCIE1_MEM_PHY_BASE)
++#define PCIE1_MEM_SIZE           (16 * 1024 * 1024)
++#define PCIE1_MEM_PHY_END        (PCIE1_MEM_PHY_BASE + PCIE1_MEM_SIZE - 1)
++
++#define PCIE1_IO_PHY_BASE         0x19800000UL
++#define PCIE1_IO_BASE            (KSEG1 + PCIE1_IO_PHY_BASE)
++#define PCIE1_IO_SIZE            (1 * 1024 * 1024)
++#define PCIE1_IO_PHY_END         (PCIE1_IO_PHY_BASE + PCIE1_IO_SIZE - 1)
++
++#define PCIE1_RC_CFG_BASE        (KSEG1 + 0x19900000)
++#define PCIE1_APP_LOGIC_REG      (KSEG1 + 0x1E100700)
++#define PCIE1_MSI_PHY_BASE        0x1F400000UL
++
++#define PCIE1_PDI_PHY_BASE        0x1F700400UL
++#define PCIE1_PDI_BASE           (KSEG1 + PCIE1_PDI_PHY_BASE)
++#define PCIE1_PDI_SIZE            0x400
++
++#define PCIE_CFG_PORT_TO_BASE(X)     ((X) > 0 ? (PCIE1_CFG_BASE) : (PCIE_CFG_BASE))
++#define PCIE_MEM_PORT_TO_BASE(X)     ((X) > 0 ? (PCIE1_MEM_BASE) : (PCIE_MEM_BASE))
++#define PCIE_IO_PORT_TO_BASE(X)      ((X) > 0 ? (PCIE1_IO_BASE) : (PCIE_IO_BASE))
++#define PCIE_MEM_PHY_PORT_TO_BASE(X) ((X) > 0 ? (PCIE1_MEM_PHY_BASE) : (PCIE_MEM_PHY_BASE))
++#define PCIE_MEM_PHY_PORT_TO_END(X)  ((X) > 0 ? (PCIE1_MEM_PHY_END) : (PCIE_MEM_PHY_END))
++#define PCIE_IO_PHY_PORT_TO_BASE(X)  ((X) > 0 ? (PCIE1_IO_PHY_BASE) : (PCIE_IO_PHY_BASE))
++#define PCIE_IO_PHY_PORT_TO_END(X)   ((X) > 0 ? (PCIE1_IO_PHY_END) : (PCIE_IO_PHY_END))
++#define PCIE_APP_PORT_TO_BASE(X)     ((X) > 0 ? (PCIE1_APP_LOGIC_REG) : (PCIE_APP_LOGIC_REG))
++#define PCIE_RC_PORT_TO_BASE(X)      ((X) > 0 ? (PCIE1_RC_CFG_BASE) : (PCIE_RC_CFG_BASE))
++#define PCIE_PHY_PORT_TO_BASE(X)     ((X) > 0 ? (PCIE1_PDI_BASE) : (PCIE_PDI_BASE))
++
++/* PCIe Application Logic Register */
++/* RC Core Control Register */
++#define PCIE_RC_CCR(X)                      (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x10)
++/* This should be enabled after initializing configuratin registers
++ * Also should check link status retraining bit
++ */
++#define PCIE_RC_CCR_LTSSM_ENABLE             0x00000001    /* Enable LTSSM to continue link establishment */
++
++/* RC Core Debug Register */
++#define PCIE_RC_DR(X)                       (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x14)
++#define PCIE_RC_DR_DLL_UP                    0x00000001  /* Data Link Layer Up */
++#define PCIE_RC_DR_CURRENT_POWER_STATE       0x0000000E  /* Current Power State */
++#define PCIE_RC_DR_CURRENT_POWER_STATE_S     1
++#define PCIE_RC_DR_CURRENT_LTSSM_STATE       0x000001F0  /* Current LTSSM State */
++#define PCIE_RC_DR_CURRENT_LTSSM_STATE_S     4
++
++#define PCIE_RC_DR_PM_DEV_STATE              0x00000E00  /* Power Management D-State */
++#define PCIE_RC_DR_PM_DEV_STATE_S            9
++
++#define PCIE_RC_DR_PM_ENABLED                0x00001000  /* Power Management State from PMU */
++#define PCIE_RC_DR_PME_EVENT_ENABLED         0x00002000  /* Power Management Event Enable State */
++#define PCIE_RC_DR_AUX_POWER_ENABLED         0x00004000  /* Auxiliary Power Enable */
++
++/* Current Power State Definition */
++enum {
++    PCIE_RC_DR_D0 = 0,
++    PCIE_RC_DR_D1,   /* Not supported */
++    PCIE_RC_DR_D2,   /* Not supported */
++    PCIE_RC_DR_D3,
++    PCIE_RC_DR_UN,
++};
++
++/* PHY Link Status Register */
++#define PCIE_PHY_SR(X)                      (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x18)
++#define PCIE_PHY_SR_PHY_LINK_UP              0x00000001   /* PHY Link Up/Down Indicator */
++
++/* Electromechanical Control Register */
++#define PCIE_EM_CR(X)                       (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x1C)
++#define PCIE_EM_CR_CARD_IS_PRESENT           0x00000001  /* Card Presence Detect State */
++#define PCIE_EM_CR_MRL_OPEN                  0x00000002  /* MRL Sensor State */
++#define PCIE_EM_CR_POWER_FAULT_SET           0x00000004  /* Power Fault Detected */
++#define PCIE_EM_CR_MRL_SENSOR_SET            0x00000008  /* MRL Sensor Changed */
++#define PCIE_EM_CR_PRESENT_DETECT_SET        0x00000010  /* Card Presense Detect Changed */
++#define PCIE_EM_CR_CMD_CPL_INT_SET           0x00000020  /* Command Complete Interrupt */
++#define PCIE_EM_CR_SYS_INTERLOCK_SET         0x00000040  /* System Electromechanical IterLock Engaged */
++#define PCIE_EM_CR_ATTENTION_BUTTON_SET      0x00000080  /* Attention Button Pressed */
++
++/* Interrupt Status Register */
++#define PCIE_IR_SR(X)                       (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x20)
++#define PCIE_IR_SR_PME_CAUSE_MSI             0x00000002  /* MSI caused by PME */
++#define PCIE_IR_SR_HP_PME_WAKE_GEN           0x00000004  /* Hotplug PME Wake Generation */
++#define PCIE_IR_SR_HP_MSI                    0x00000008  /* Hotplug MSI */
++#define PCIE_IR_SR_AHB_LU_ERR                0x00000030  /* AHB Bridge Lookup Error Signals */
++#define PCIE_IR_SR_AHB_LU_ERR_S              4
++#define PCIE_IR_SR_INT_MSG_NUM               0x00003E00  /* Interrupt Message Number */
++#define PCIE_IR_SR_INT_MSG_NUM_S             9
++#define PCIE_IR_SR_AER_INT_MSG_NUM           0xF8000000  /* Advanced Error Interrupt Message Number */
++#define PCIE_IR_SR_AER_INT_MSG_NUM_S         27
++
++/* Message Control Register */
++#define PCIE_MSG_CR(X)                      (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x30)
++#define PCIE_MSG_CR_GEN_PME_TURN_OFF_MSG     0x00000001  /* Generate PME Turn Off Message */
++#define PCIE_MSG_CR_GEN_UNLOCK_MSG           0x00000002  /* Generate Unlock Message */
++
++#define PCIE_VDM_DR(X)                      (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x34)
++
++/* Vendor-Defined Message Requester ID Register */
++#define PCIE_VDM_RID(X)                     (PCIE_APP_PORT_TO_BASE (X) + 0x38)
++#define PCIE_VDM_RID_VENROR_MSG_REQ_ID       0x0000FFFF
++#define PCIE_VDM_RID_VDMRID_S                0
++
++/* ASPM Control Register */
++#define PCIE_ASPM_CR(X)                     (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x40)
++#define PCIE_ASPM_CR_HOT_RST                 0x00000001  /* Hot Reset Request to the downstream device */
++#define PCIE_ASPM_CR_REQ_EXIT_L1             0x00000002  /* Request to Exit L1 */
++#define PCIE_ASPM_CR_REQ_ENTER_L1            0x00000004  /* Request to Enter L1 */
++
++/* Vendor Message DW0 Register */
++#define PCIE_VM_MSG_DW0(X)                  (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x50)
++#define PCIE_VM_MSG_DW0_TYPE                 0x0000001F  /* Message type */
++#define PCIE_VM_MSG_DW0_TYPE_S               0
++#define PCIE_VM_MSG_DW0_FORMAT               0x00000060  /* Format */
++#define PCIE_VM_MSG_DW0_FORMAT_S             5
++#define PCIE_VM_MSG_DW0_TC                   0x00007000  /* Traffic Class */
++#define PCIE_VM_MSG_DW0_TC_S                 12
++#define PCIE_VM_MSG_DW0_ATTR                 0x000C0000  /* Atrributes */
++#define PCIE_VM_MSG_DW0_ATTR_S               18
++#define PCIE_VM_MSG_DW0_EP_TLP               0x00100000  /* Poisoned TLP */
++#define PCIE_VM_MSG_DW0_TD                   0x00200000  /* TLP Digest */
++#define PCIE_VM_MSG_DW0_LEN                  0xFFC00000  /* Length */
++#define PCIE_VM_MSG_DW0_LEN_S                22
++
++/* Format Definition */
++enum {
++    PCIE_VM_MSG_FORMAT_00 = 0,  /* 3DW Hdr, no data*/
++    PCIE_VM_MSG_FORMAT_01,      /* 4DW Hdr, no data */
++    PCIE_VM_MSG_FORMAT_10,      /* 3DW Hdr, with data */
++    PCIE_VM_MSG_FORMAT_11,      /* 4DW Hdr, with data */
++};
++
++/* Traffic Class Definition */
++enum {
++    PCIE_VM_MSG_TC0 = 0,
++    PCIE_VM_MSG_TC1,
++    PCIE_VM_MSG_TC2,
++    PCIE_VM_MSG_TC3,
++    PCIE_VM_MSG_TC4,
++    PCIE_VM_MSG_TC5,
++    PCIE_VM_MSG_TC6,
++    PCIE_VM_MSG_TC7,
++};
++
++/* Attributes Definition */
++enum {
++    PCIE_VM_MSG_ATTR_00 = 0,   /* RO and No Snoop cleared */
++    PCIE_VM_MSG_ATTR_01,       /* RO cleared , No Snoop set */
++    PCIE_VM_MSG_ATTR_10,       /* RO set, No Snoop cleared*/
++    PCIE_VM_MSG_ATTR_11,       /* RO and No Snoop set */
++};
++
++/* Payload Size Definition */
++#define PCIE_VM_MSG_LEN_MIN  0
++#define PCIE_VM_MSG_LEN_MAX  1024
++
++/* Vendor Message DW1 Register */
++#define PCIE_VM_MSG_DW1(X)                 (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x54)
++#define PCIE_VM_MSG_DW1_FUNC_NUM            0x00000070  /* Function Number */
++#define PCIE_VM_MSG_DW1_FUNC_NUM_S          8
++#define PCIE_VM_MSG_DW1_CODE                0x00FF0000  /* Message Code */
++#define PCIE_VM_MSG_DW1_CODE_S              16
++#define PCIE_VM_MSG_DW1_TAG                 0xFF000000  /* Tag */
++#define PCIE_VM_MSG_DW1_TAG_S               24
++
++#define PCIE_VM_MSG_DW2(X)                  (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x58)
++#define PCIE_VM_MSG_DW3(X)                  (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x5C)
++
++/* Vendor Message Request Register */
++#define PCIE_VM_MSG_REQR(X)                 (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x60)
++#define PCIE_VM_MSG_REQR_REQ                 0x00000001  /* Vendor Message Request */
++
++
++/* AHB Slave Side Band Control Register */
++#define PCIE_AHB_SSB(X)                     (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x70)
++#define PCIE_AHB_SSB_REQ_BCM                0x00000001 /* Slave Reques BCM filed */
++#define PCIE_AHB_SSB_REQ_EP                 0x00000002 /* Slave Reques EP filed */
++#define PCIE_AHB_SSB_REQ_TD                 0x00000004 /* Slave Reques TD filed */
++#define PCIE_AHB_SSB_REQ_ATTR               0x00000018 /* Slave Reques Attribute number */
++#define PCIE_AHB_SSB_REQ_ATTR_S             3
++#define PCIE_AHB_SSB_REQ_TC                 0x000000E0 /* Slave Request TC Field */
++#define PCIE_AHB_SSB_REQ_TC_S               5
++
++/* AHB Master SideBand Ctrl Register */
++#define PCIE_AHB_MSB(X)                     (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x74)
++#define PCIE_AHB_MSB_RESP_ATTR               0x00000003 /* Master Response Attribute number */
++#define PCIE_AHB_MSB_RESP_ATTR_S             0
++#define PCIE_AHB_MSB_RESP_BAD_EOT            0x00000004 /* Master Response Badeot filed */
++#define PCIE_AHB_MSB_RESP_BCM                0x00000008 /* Master Response BCM filed */
++#define PCIE_AHB_MSB_RESP_EP                 0x00000010 /* Master Response EP filed */
++#define PCIE_AHB_MSB_RESP_TD                 0x00000020 /* Master Response TD filed */
++#define PCIE_AHB_MSB_RESP_FUN_NUM            0x000003C0 /* Master Response Function number */
++#define PCIE_AHB_MSB_RESP_FUN_NUM_S          6
++
++/* AHB Control Register, fixed bus enumeration exception */
++#define PCIE_AHB_CTRL(X)                     (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0x78)
++#define PCIE_AHB_CTRL_BUS_ERROR_SUPPRESS     0x00000001 
++
++/* Interrupt Enalbe Register */
++#define PCIE_IRNEN(X)                        (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0xF4)
++#define PCIE_IRNCR(X)                        (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0xF8)
++#define PCIE_IRNICR(X)                       (volatile u32*)(PCIE_APP_PORT_TO_BASE(X) + 0xFC)
++
++/* PCIe interrupt enable/control/capture register definition */
++#define PCIE_IRN_AER_REPORT                 0x00000001  /* AER Interrupt */
++#define PCIE_IRN_AER_MSIX                   0x00000002  /* Advanced Error MSI-X Interrupt */
++#define PCIE_IRN_PME                        0x00000004  /* PME Interrupt */
++#define PCIE_IRN_HOTPLUG                    0x00000008  /* Hotplug Interrupt */
++#define PCIE_IRN_RX_VDM_MSG                 0x00000010  /* Vendor-Defined Message Interrupt */
++#define PCIE_IRN_RX_CORRECTABLE_ERR_MSG     0x00000020  /* Correctable Error Message Interrupt */
++#define PCIE_IRN_RX_NON_FATAL_ERR_MSG       0x00000040  /* Non-fatal Error Message */
++#define PCIE_IRN_RX_FATAL_ERR_MSG           0x00000080  /* Fatal Error Message */
++#define PCIE_IRN_RX_PME_MSG                 0x00000100  /* PME Message Interrupt */
++#define PCIE_IRN_RX_PME_TURNOFF_ACK         0x00000200  /* PME Turnoff Ack Message Interrupt */
++#define PCIE_IRN_AHB_BR_FATAL_ERR           0x00000400  /* AHB Fatal Error Interrupt */
++#define PCIE_IRN_LINK_AUTO_BW_STATUS        0x00000800  /* Link Auto Bandwidth Status Interrupt */
++#define PCIE_IRN_BW_MGT                     0x00001000  /* Bandwidth Managment Interrupt */
++#define PCIE_IRN_INTA                       0x00002000  /* INTA */
++#define PCIE_IRN_INTB                       0x00004000  /* INTB */
++#define PCIE_IRN_INTC                       0x00008000  /* INTC */
++#define PCIE_IRN_INTD                       0x00010000  /* INTD */
++#define PCIE_IRN_WAKEUP                     0x00020000  /* Wake up Interrupt */
++
++#define PCIE_RC_CORE_COMBINED_INT    (PCIE_IRN_AER_REPORT |  PCIE_IRN_AER_MSIX | PCIE_IRN_PME | \
++                                      PCIE_IRN_HOTPLUG | PCIE_IRN_RX_VDM_MSG | PCIE_IRN_RX_CORRECTABLE_ERR_MSG |\
++                                      PCIE_IRN_RX_NON_FATAL_ERR_MSG | PCIE_IRN_RX_FATAL_ERR_MSG | \
++                                      PCIE_IRN_RX_PME_MSG | PCIE_IRN_RX_PME_TURNOFF_ACK | PCIE_IRN_AHB_BR_FATAL_ERR | \
++                                      PCIE_IRN_LINK_AUTO_BW_STATUS | PCIE_IRN_BW_MGT)
++/* PCIe RC Configuration Register */
++#define PCIE_VDID(X)                (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x00)
++
++/* Bit definition from pci_reg.h */
++#define PCIE_PCICMDSTS(X)           (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x04)
++#define PCIE_CCRID(X)               (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x08)
++#define PCIE_CLSLTHTBR(X)           (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x0C) /* EP only */
++/* BAR0, BAR1,Only necessary if the bridges implements a device-specific register set or memory buffer */
++#define PCIE_BAR0(X)                (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x10) /* Not used*/
++#define PCIE_BAR1(X)                (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x14) /* Not used */
++
++#define PCIE_BNR(X)                 (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x18) /* Mandatory */
++/* Bus Number Register bits */
++#define PCIE_BNR_PRIMARY_BUS_NUM             0x000000FF
++#define PCIE_BNR_PRIMARY_BUS_NUM_S           0
++#define PCIE_PNR_SECONDARY_BUS_NUM           0x0000FF00
++#define PCIE_PNR_SECONDARY_BUS_NUM_S         8
++#define PCIE_PNR_SUB_BUS_NUM                 0x00FF0000
++#define PCIE_PNR_SUB_BUS_NUM_S               16
++
++/* IO Base/Limit Register bits */
++#define PCIE_IOBLSECS(X)                       (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x1C)  /* RC only */
++#define PCIE_IOBLSECS_32BIT_IO_ADDR             0x00000001
++#define PCIE_IOBLSECS_IO_BASE_ADDR              0x000000F0
++#define PCIE_IOBLSECS_IO_BASE_ADDR_S            4
++#define PCIE_IOBLSECS_32BIT_IOLIMT              0x00000100
++#define PCIE_IOBLSECS_IO_LIMIT_ADDR             0x0000F000
++#define PCIE_IOBLSECS_IO_LIMIT_ADDR_S           12
++
++/* Non-prefetchable Memory Base/Limit Register bit */
++#define PCIE_MBML(X)                           (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x20)  /* RC only */
++#define PCIE_MBML_MEM_BASE_ADDR                 0x0000FFF0
++#define PCIE_MBML_MEM_BASE_ADDR_S               4
++#define PCIE_MBML_MEM_LIMIT_ADDR                0xFFF00000
++#define PCIE_MBML_MEM_LIMIT_ADDR_S              20
++
++/* Prefetchable Memory Base/Limit Register bit */
++#define PCIE_PMBL(X)                           (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x24)  /* RC only */
++#define PCIE_PMBL_64BIT_ADDR                    0x00000001
++#define PCIE_PMBL_UPPER_12BIT                   0x0000FFF0
++#define PCIE_PMBL_UPPER_12BIT_S                 4
++#define PCIE_PMBL_E64MA                         0x00010000
++#define PCIE_PMBL_END_ADDR                      0xFFF00000
++#define PCIE_PMBL_END_ADDR_S                    20
++#define PCIE_PMBU32(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x28)  /* RC only */
++#define PCIE_PMLU32(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x2C)  /* RC only */
++
++/* I/O Base/Limit Upper 16 bits register */
++#define PCIE_IO_BANDL(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x30)  /* RC only */
++#define PCIE_IO_BANDL_UPPER_16BIT_IO_BASE        0x0000FFFF
++#define PCIE_IO_BANDL_UPPER_16BIT_IO_BASE_S      0
++#define PCIE_IO_BANDL_UPPER_16BIT_IO_LIMIT       0xFFFF0000
++#define PCIE_IO_BANDL_UPPER_16BIT_IO_LIMIT_S     16
++
++#define PCIE_CPR(X)                            (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x34)
++#define PCIE_EBBAR(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x38)
++
++/* Interrupt and Secondary Bridge Control Register */
++#define PCIE_INTRBCTRL(X)                      (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x3C)
++
++#define PCIE_INTRBCTRL_INT_LINE                 0x000000FF
++#define PCIE_INTRBCTRL_INT_LINE_S               0
++#define PCIE_INTRBCTRL_INT_PIN                  0x0000FF00
++#define PCIE_INTRBCTRL_INT_PIN_S                8
++#define PCIE_INTRBCTRL_PARITY_ERR_RESP_ENABLE   0x00010000    /* #PERR */
++#define PCIE_INTRBCTRL_SERR_ENABLE              0x00020000    /* #SERR */
++#define PCIE_INTRBCTRL_ISA_ENABLE               0x00040000    /* ISA enable, IO 64KB only */
++#define PCIE_INTRBCTRL_VGA_ENABLE               0x00080000    /* VGA enable */
++#define PCIE_INTRBCTRL_VGA_16BIT_DECODE         0x00100000    /* VGA 16bit decode */
++#define PCIE_INTRBCTRL_RST_SECONDARY_BUS        0x00400000    /* Secondary bus rest, hot rest, 1ms */
++/* Others are read only */
++enum {
++    PCIE_INTRBCTRL_INT_NON = 0,
++    PCIE_INTRBCTRL_INTA,
++    PCIE_INTRBCTRL_INTB,
++    PCIE_INTRBCTRL_INTC,
++    PCIE_INTRBCTRL_INTD,
++};
++
++#define PCIE_PM_CAPR(X)                  (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x40)
++
++/* Power Management Control and Status Register */
++#define PCIE_PM_CSR(X)                   (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x44)
++
++#define PCIE_PM_CSR_POWER_STATE           0x00000003   /* Power State */
++#define PCIE_PM_CSR_POWER_STATE_S         0
++#define PCIE_PM_CSR_SW_RST                0x00000008   /* Soft Reset Enabled */
++#define PCIE_PM_CSR_PME_ENABLE            0x00000100   /* PME Enable */
++#define PCIE_PM_CSR_PME_STATUS            0x00008000   /* PME status */
++
++/* MSI Capability Register for EP */
++#define PCIE_MCAPR(X)                    (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x50)
++
++#define PCIE_MCAPR_MSI_CAP_ID             0x000000FF  /* MSI Capability ID */
++#define PCIE_MCAPR_MSI_CAP_ID_S           0
++#define PCIE_MCAPR_MSI_NEXT_CAP_PTR       0x0000FF00  /* Next Capability Pointer */
++#define PCIE_MCAPR_MSI_NEXT_CAP_PTR_S     8
++#define PCIE_MCAPR_MSI_ENABLE             0x00010000  /* MSI Enable */
++#define PCIE_MCAPR_MULTI_MSG_CAP          0x000E0000  /* Multiple Message Capable */
++#define PCIE_MCAPR_MULTI_MSG_CAP_S        17
++#define PCIE_MCAPR_MULTI_MSG_ENABLE       0x00700000  /* Multiple Message Enable */
++#define PCIE_MCAPR_MULTI_MSG_ENABLE_S     20
++#define PCIE_MCAPR_ADDR64_CAP             0X00800000  /* 64-bit Address Capable */
++
++/* MSI Message Address Register */
++#define PCIE_MA(X)                       (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x54)
++
++#define PCIE_MA_ADDR_MASK                 0xFFFFFFFC  /* Message Address */
++
++/* MSI Message Upper Address Register */
++#define PCIE_MUA(X)                      (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x58)
++
++/* MSI Message Data Register */
++#define PCIE_MD(X)                       (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x5C)
++
++#define PCIE_MD_DATA                      0x0000FFFF  /* Message Data */
++#define PCIE_MD_DATA_S                    0
++
++/* PCI Express Capability Register */
++#define PCIE_XCAP(X)                     (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x70)
++
++#define PCIE_XCAP_ID                      0x000000FF  /* PCI Express Capability ID */
++#define PCIE_XCAP_ID_S                    0
++#define PCIE_XCAP_NEXT_CAP                0x0000FF00  /* Next Capability Pointer */
++#define PCIE_XCAP_NEXT_CAP_S              8
++#define PCIE_XCAP_VER                     0x000F0000  /* PCI Express Capability Version */
++#define PCIE_XCAP_VER_S                   16
++#define PCIE_XCAP_DEV_PORT_TYPE           0x00F00000  /* Device Port Type */
++#define PCIE_XCAP_DEV_PORT_TYPE_S         20
++#define PCIE_XCAP_SLOT_IMPLEMENTED        0x01000000  /* Slot Implemented */
++#define PCIE_XCAP_MSG_INT_NUM             0x3E000000  /* Interrupt Message Number */
++#define PCIE_XCAP_MSG_INT_NUM_S           25
++
++/* Device Capability Register */
++#define PCIE_DCAP(X)                     (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x74)
++
++#define PCIE_DCAP_MAX_PAYLOAD_SIZE        0x00000007   /* Max Payload size */
++#define PCIE_DCAP_MAX_PAYLOAD_SIZE_S      0
++#define PCIE_DCAP_PHANTOM_FUNC            0x00000018   /* Phanton Function, not supported */
++#define PCIE_DCAP_PHANTOM_FUNC_S          3
++#define PCIE_DCAP_EXT_TAG                 0x00000020   /* Extended Tag Field */
++#define PCIE_DCAP_EP_L0S_LATENCY          0x000001C0   /* EP L0s latency only */
++#define PCIE_DCAP_EP_L0S_LATENCY_S        6
++#define PCIE_DCAP_EP_L1_LATENCY           0x00000E00   /* EP L1 latency only */
++#define PCIE_DCAP_EP_L1_LATENCY_S         9
++#define PCIE_DCAP_ROLE_BASE_ERR_REPORT    0x00008000   /* Role Based ERR */
++
++/* Maximum payload size supported */
++enum {
++    PCIE_MAX_PAYLOAD_128 = 0,
++    PCIE_MAX_PAYLOAD_256,
++    PCIE_MAX_PAYLOAD_512,
++    PCIE_MAX_PAYLOAD_1024,
++    PCIE_MAX_PAYLOAD_2048,
++    PCIE_MAX_PAYLOAD_4096,
++};
++
++/* Device Control and Status Register */
++#define PCIE_DCTLSTS(X)                       (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x78)
++
++#define PCIE_DCTLSTS_CORRECTABLE_ERR_EN        0x00000001   /* COR-ERR */
++#define PCIE_DCTLSTS_NONFATAL_ERR_EN           0x00000002   /* Non-fatal ERR */
++#define PCIE_DCTLSTS_FATAL_ERR_EN              0x00000004   /* Fatal ERR */
++#define PCIE_DCTLSYS_UR_REQ_EN                 0x00000008   /* UR ERR */
++#define PCIE_DCTLSTS_RELAXED_ORDERING_EN       0x00000010   /* Enable relaxing ordering */
++#define PCIE_DCTLSTS_MAX_PAYLOAD_SIZE          0x000000E0   /* Max payload mask */
++#define PCIE_DCTLSTS_MAX_PAYLOAD_SIZE_S        5
++#define PCIE_DCTLSTS_EXT_TAG_EN                0x00000100   /* Extended tag field */
++#define PCIE_DCTLSTS_PHANTOM_FUNC_EN           0x00000200   /* Phantom Function Enable */
++#define PCIE_DCTLSTS_AUX_PM_EN                 0x00000400   /* AUX Power PM Enable */
++#define PCIE_DCTLSTS_NO_SNOOP_EN               0x00000800   /* Enable no snoop, except root port*/
++#define PCIE_DCTLSTS_MAX_READ_SIZE             0x00007000   /* Max Read Request size*/
++#define PCIE_DCTLSTS_MAX_READ_SIZE_S           12
++#define PCIE_DCTLSTS_CORRECTABLE_ERR           0x00010000   /* COR-ERR Detected */
++#define PCIE_DCTLSTS_NONFATAL_ERR              0x00020000   /* Non-Fatal ERR Detected */
++#define PCIE_DCTLSTS_FATAL_ER                  0x00040000   /* Fatal ERR Detected */
++#define PCIE_DCTLSTS_UNSUPPORTED_REQ           0x00080000   /* UR Detected */
++#define PCIE_DCTLSTS_AUX_POWER                 0x00100000   /* Aux Power Detected */
++#define PCIE_DCTLSTS_TRANSACT_PENDING          0x00200000   /* Transaction pending */
++
++#define PCIE_DCTLSTS_ERR_EN      (PCIE_DCTLSTS_CORRECTABLE_ERR_EN | \
++                                  PCIE_DCTLSTS_NONFATAL_ERR_EN | PCIE_DCTLSTS_FATAL_ERR_EN | \
++                                  PCIE_DCTLSYS_UR_REQ_EN)
++
++/* Link Capability Register */
++#define PCIE_LCAP(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x7C)
++#define PCIE_LCAP_MAX_LINK_SPEED               0x0000000F  /* Max link speed, 0x1 by default */
++#define PCIE_LCAP_MAX_LINK_SPEED_S             0
++#define PCIE_LCAP_MAX_LENGTH_WIDTH             0x000003F0  /* Maxium Length Width */
++#define PCIE_LCAP_MAX_LENGTH_WIDTH_S           4
++#define PCIE_LCAP_ASPM_LEVEL                   0x00000C00  /* Active State Link PM Support */
++#define PCIE_LCAP_ASPM_LEVEL_S                 10
++#define PCIE_LCAP_L0S_EIXT_LATENCY             0x00007000  /* L0s Exit Latency */
++#define PCIE_LCAP_L0S_EIXT_LATENCY_S           12
++#define PCIE_LCAP_L1_EXIT_LATENCY              0x00038000  /* L1 Exit Latency */
++#define PCIE_LCAP_L1_EXIT_LATENCY_S            15
++#define PCIE_LCAP_CLK_PM                       0x00040000  /* Clock Power Management */
++#define PCIE_LCAP_SDER                         0x00080000  /* Surprise Down Error Reporting */
++#define PCIE_LCAP_DLL_ACTIVE_REPROT            0x00100000  /* Data Link Layer Active Reporting Capable */
++#define PCIE_LCAP_PORT_NUM                     0xFF0000000  /* Port number */
++#define PCIE_LCAP_PORT_NUM_S                   24
++
++/* Maximum Length width definition */
++#define PCIE_MAX_LENGTH_WIDTH_RES  0x00
++#define PCIE_MAX_LENGTH_WIDTH_X1   0x01  /* Default */
++#define PCIE_MAX_LENGTH_WIDTH_X2   0x02
++#define PCIE_MAX_LENGTH_WIDTH_X4   0x04
++#define PCIE_MAX_LENGTH_WIDTH_X8   0x08
++#define PCIE_MAX_LENGTH_WIDTH_X12  0x0C
++#define PCIE_MAX_LENGTH_WIDTH_X16  0x10
++#define PCIE_MAX_LENGTH_WIDTH_X32  0x20
++
++/* Active State Link PM definition */
++enum {
++    PCIE_ASPM_RES0                = 0,
++    PCIE_ASPM_L0S_ENTRY_SUPPORT,        /* L0s */
++    PCIE_ASPM_RES1,
++    PCIE_ASPM_L0S_L1_ENTRY_SUPPORT,     /* L0s and L1, default */
++};
++
++/* L0s Exit Latency definition */
++enum {
++    PCIE_L0S_EIXT_LATENCY_L64NS    = 0, /* < 64 ns */
++    PCIE_L0S_EIXT_LATENCY_B64A128,      /* > 64 ns < 128 ns */
++    PCIE_L0S_EIXT_LATENCY_B128A256,     /* > 128 ns < 256 ns */
++    PCIE_L0S_EIXT_LATENCY_B256A512,     /* > 256 ns < 512 ns */
++    PCIE_L0S_EIXT_LATENCY_B512TO1U,     /* > 512 ns < 1 us */
++    PCIE_L0S_EIXT_LATENCY_B1A2U,        /* > 1 us < 2 us */
++    PCIE_L0S_EIXT_LATENCY_B2A4U,        /* > 2 us < 4 us */
++    PCIE_L0S_EIXT_LATENCY_M4US,         /* > 4 us  */
++};
++
++/* L1 Exit Latency definition */
++enum {
++    PCIE_L1_EXIT_LATENCY_L1US  = 0,  /* < 1 us */
++    PCIE_L1_EXIT_LATENCY_B1A2,       /* > 1 us < 2 us */
++    PCIE_L1_EXIT_LATENCY_B2A4,       /* > 2 us < 4 us */
++    PCIE_L1_EXIT_LATENCY_B4A8,       /* > 4 us < 8 us */
++    PCIE_L1_EXIT_LATENCY_B8A16,      /* > 8 us < 16 us */
++    PCIE_L1_EXIT_LATENCY_B16A32,     /* > 16 us < 32 us */
++    PCIE_L1_EXIT_LATENCY_B32A64,     /* > 32 us < 64 us */
++    PCIE_L1_EXIT_LATENCY_M64US,      /* > 64 us */
++};
++
++/* Link Control and Status Register */
++#define PCIE_LCTLSTS(X)                     (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x80)
++#define PCIE_LCTLSTS_ASPM_ENABLE            0x00000003  /* Active State Link PM Control */
++#define PCIE_LCTLSTS_ASPM_ENABLE_S          0
++#define PCIE_LCTLSTS_RCB128                 0x00000008  /* Read Completion Boundary 128*/
++#define PCIE_LCTLSTS_LINK_DISABLE           0x00000010  /* Link Disable */
++#define PCIE_LCTLSTS_RETRIAN_LINK           0x00000020  /* Retrain Link */
++#define PCIE_LCTLSTS_COM_CLK_CFG            0x00000040  /* Common Clock Configuration */
++#define PCIE_LCTLSTS_EXT_SYNC               0x00000080  /* Extended Synch */
++#define PCIE_LCTLSTS_CLK_PM_EN              0x00000100  /* Enable Clock Powerm Management */
++#define PCIE_LCTLSTS_LINK_SPEED             0x000F0000  /* Link Speed */
++#define PCIE_LCTLSTS_LINK_SPEED_S           16
++#define PCIE_LCTLSTS_NEGOTIATED_LINK_WIDTH  0x03F00000  /* Negotiated Link Width */
++#define PCIE_LCTLSTS_NEGOTIATED_LINK_WIDTH_S 20
++#define PCIE_LCTLSTS_RETRAIN_PENDING        0x08000000  /* Link training is ongoing */
++#define PCIE_LCTLSTS_SLOT_CLK_CFG           0x10000000  /* Slot Clock Configuration */
++#define PCIE_LCTLSTS_DLL_ACTIVE             0x20000000  /* Data Link Layer Active */
++
++/* Slot Capabilities Register */
++#define PCIE_SLCAP(X)                       (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x84)
++
++/* Slot Capabilities */
++#define PCIE_SLCTLSTS(X)                    (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x88)
++
++/* Root Control and Capability Register */
++#define PCIE_RCTLCAP(X)                     (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x8C)
++#define PCIE_RCTLCAP_SERR_ON_CORRECTABLE_ERR  0x00000001   /* #SERR on COR-ERR */
++#define PCIE_RCTLCAP_SERR_ON_NONFATAL_ERR     0x00000002   /* #SERR on Non-Fatal ERR */
++#define PCIE_RCTLCAP_SERR_ON_FATAL_ERR        0x00000004   /* #SERR on Fatal ERR */
++#define PCIE_RCTLCAP_PME_INT_EN               0x00000008   /* PME Interrupt Enable */
++#define PCIE_RCTLCAP_SERR_ENABLE    (PCIE_RCTLCAP_SERR_ON_CORRECTABLE_ERR | \
++                                     PCIE_RCTLCAP_SERR_ON_NONFATAL_ERR | PCIE_RCTLCAP_SERR_ON_FATAL_ERR)
++/* Root Status Register */
++#define PCIE_RSTS(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x90)
++#define PCIE_RSTS_PME_REQ_ID                   0x0000FFFF   /* PME Request ID */
++#define PCIE_RSTS_PME_REQ_ID_S                 0
++#define PCIE_RSTS_PME_STATUS                   0x00010000   /* PME Status */
++#define PCIE_RSTS_PME_PENDING                  0x00020000   /* PME Pending */
++
++/* PCI Express Enhanced Capability Header */
++#define PCIE_ENHANCED_CAP(X)                (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x100)
++#define PCIE_ENHANCED_CAP_ID                 0x0000FFFF  /* PCI Express Extended Capability ID */
++#define PCIE_ENHANCED_CAP_ID_S               0
++#define PCIE_ENHANCED_CAP_VER                0x000F0000  /* Capability Version */
++#define PCIE_ENHANCED_CAP_VER_S              16
++#define PCIE_ENHANCED_CAP_NEXT_OFFSET        0xFFF00000  /* Next Capability Offset */
++#define PCIE_ENHANCED_CAP_NEXT_OFFSET_S      20
++
++/* Uncorrectable Error Status Register */
++#define PCIE_UES_R(X)                       (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x104)
++#define PCIE_DATA_LINK_PROTOCOL_ERR          0x00000010  /* Data Link Protocol Error Status */
++#define PCIE_SURPRISE_DOWN_ERROR             0x00000020  /* Surprise Down Error Status */
++#define PCIE_POISONED_TLP                    0x00001000  /* Poisoned TLP Status */
++#define PCIE_FC_PROTOCOL_ERR                 0x00002000  /* Flow Control Protocol Error Status */
++#define PCIE_COMPLETION_TIMEOUT              0x00004000  /* Completion Timeout Status */
++#define PCIE_COMPLETOR_ABORT                 0x00008000  /* Completer Abort Error */
++#define PCIE_UNEXPECTED_COMPLETION           0x00010000  /* Unexpected Completion Status */
++#define PCIE_RECEIVER_OVERFLOW               0x00020000  /* Receive Overflow Status */
++#define PCIE_MALFORNED_TLP                   0x00040000  /* Malformed TLP Stauts */
++#define PCIE_ECRC_ERR                        0x00080000  /* ECRC Error Stauts */
++#define PCIE_UR_REQ                          0x00100000  /* Unsupported Request Error Status */
++#define PCIE_ALL_UNCORRECTABLE_ERR    (PCIE_DATA_LINK_PROTOCOL_ERR | PCIE_SURPRISE_DOWN_ERROR | \
++                         PCIE_POISONED_TLP | PCIE_FC_PROTOCOL_ERR | PCIE_COMPLETION_TIMEOUT |   \
++                         PCIE_COMPLETOR_ABORT | PCIE_UNEXPECTED_COMPLETION | PCIE_RECEIVER_OVERFLOW |\
++                         PCIE_MALFORNED_TLP | PCIE_ECRC_ERR | PCIE_UR_REQ)
++
++/* Uncorrectable Error Mask Register, Mask means no report */
++#define PCIE_UEMR(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x108)
++
++/* Uncorrectable Error Severity Register */
++#define PCIE_UESR(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x10C)
++
++/* Correctable Error Status Register */
++#define PCIE_CESR(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x110)
++#define PCIE_RX_ERR                          0x00000001  /* Receive Error Status */
++#define PCIE_BAD_TLP                         0x00000040  /* Bad TLP Status */
++#define PCIE_BAD_DLLP                        0x00000080  /* Bad DLLP Status */
++#define PCIE_REPLAY_NUM_ROLLOVER             0x00000100  /* Replay Number Rollover Status */
++#define PCIE_REPLAY_TIMER_TIMEOUT_ERR        0x00001000  /* Reply Timer Timeout Status */
++#define PCIE_ADVISORY_NONFTAL_ERR            0x00002000  /* Advisory Non-Fatal Error Status */
++#define PCIE_CORRECTABLE_ERR        (PCIE_RX_ERR | PCIE_BAD_TLP | PCIE_BAD_DLLP | PCIE_REPLAY_NUM_ROLLOVER |\
++                                     PCIE_REPLAY_TIMER_TIMEOUT_ERR | PCIE_ADVISORY_NONFTAL_ERR)
++
++/* Correctable Error Mask Register */
++#define PCIE_CEMR(X)                        (volatile u32*)(PCIE_RC_CFG_BASE + 0x114)
++
++/* Advanced Error Capabilities and Control Register */
++#define PCIE_AECCR(X)                       (volatile u32*)(PCIE_RC_CFG_BASE + 0x118)
++#define PCIE_AECCR_FIRST_ERR_PTR            0x0000001F  /* First Error Pointer */
++#define PCIE_AECCR_FIRST_ERR_PTR_S          0
++#define PCIE_AECCR_ECRC_GEN_CAP             0x00000020  /* ECRC Generation Capable */
++#define PCIE_AECCR_ECRC_GEN_EN              0x00000040  /* ECRC Generation Enable */
++#define PCIE_AECCR_ECRC_CHECK_CAP           0x00000080  /* ECRC Check Capable */
++#define PCIE_AECCR_ECRC_CHECK_EN            0x00000100  /* ECRC Check Enable */
++
++/* Header Log Register 1 */
++#define PCIE_HLR1(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x11C)
++
++/* Header Log Register 2 */
++#define PCIE_HLR2(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x120)
++
++/* Header Log Register 3 */
++#define PCIE_HLR3(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x124)
++
++/* Header Log Register 4 */
++#define PCIE_HLR4(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x128)
++
++/* Root Error Command Register */
++#define PCIE_RECR(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x12C)
++#define PCIE_RECR_CORRECTABLE_ERR_REPORT_EN  0x00000001 /* COR-ERR */
++#define PCIE_RECR_NONFATAL_ERR_REPORT_EN     0x00000002 /* Non-Fatal ERR */
++#define PCIE_RECR_FATAL_ERR_REPORT_EN        0x00000004 /* Fatal ERR */
++#define PCIE_RECR_ERR_REPORT_EN  (PCIE_RECR_CORRECTABLE_ERR_REPORT_EN | \
++                PCIE_RECR_NONFATAL_ERR_REPORT_EN | PCIE_RECR_FATAL_ERR_REPORT_EN)
++
++/* Root Error Status Register */
++#define PCIE_RESR(X)                            (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x130)
++#define PCIE_RESR_CORRECTABLE_ERR                0x00000001   /* COR-ERR Receveid */
++#define PCIE_RESR_MULTI_CORRECTABLE_ERR          0x00000002   /* Multiple COR-ERR Received */
++#define PCIE_RESR_FATAL_NOFATAL_ERR              0x00000004   /* ERR Fatal/Non-Fatal Received */
++#define PCIE_RESR_MULTI_FATAL_NOFATAL_ERR        0x00000008   /* Multiple ERR Fatal/Non-Fatal Received */
++#define PCIE_RESR_FIRST_UNCORRECTABLE_FATAL_ERR  0x00000010   /* First UN-COR Fatal */
++#define PCIR_RESR_NON_FATAL_ERR                  0x00000020   /* Non-Fatal Error Message Received */
++#define PCIE_RESR_FATAL_ERR                      0x00000040   /* Fatal Message Received */
++#define PCIE_RESR_AER_INT_MSG_NUM                0xF8000000   /* Advanced Error Interrupt Message Number */
++#define PCIE_RESR_AER_INT_MSG_NUM_S              27
++
++/* Error Source Indentification Register */
++#define PCIE_ESIR(X)                            (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x134)
++#define PCIE_ESIR_CORRECTABLE_ERR_SRC_ID         0x0000FFFF
++#define PCIE_ESIR_CORRECTABLE_ERR_SRC_ID_S       0
++#define PCIE_ESIR_FATAL_NON_FATAL_SRC_ID         0xFFFF0000
++#define PCIE_ESIR_FATAL_NON_FATAL_SRC_ID_S       16
++
++/* VC Enhanced Capability Header */
++#define PCIE_VC_ECH(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x140)
++
++/* Port VC Capability Register */
++#define PCIE_PVC1(X)                            (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x144)
++#define PCIE_PVC1_EXT_VC_CNT                    0x00000007  /* Extended VC Count */
++#define PCIE_PVC1_EXT_VC_CNT_S                  0
++#define PCIE_PVC1_LOW_PRI_EXT_VC_CNT            0x00000070  /* Low Priority Extended VC Count */
++#define PCIE_PVC1_LOW_PRI_EXT_VC_CNT_S          4
++#define PCIE_PVC1_REF_CLK                       0x00000300  /* Reference Clock */
++#define PCIE_PVC1_REF_CLK_S                     8
++#define PCIE_PVC1_PORT_ARB_TAB_ENTRY_SIZE       0x00000C00  /* Port Arbitration Table Entry Size */
++#define PCIE_PVC1_PORT_ARB_TAB_ENTRY_SIZE_S     10
++
++/* Extended Virtual Channel Count Defintion */
++#define PCIE_EXT_VC_CNT_MIN   0
++#define PCIE_EXT_VC_CNT_MAX   7
++
++/* Port Arbitration Table Entry Size Definition */
++enum {
++    PCIE_PORT_ARB_TAB_ENTRY_SIZE_S1BIT = 0,
++    PCIE_PORT_ARB_TAB_ENTRY_SIZE_S2BIT,
++    PCIE_PORT_ARB_TAB_ENTRY_SIZE_S4BIT,
++    PCIE_PORT_ARB_TAB_ENTRY_SIZE_S8BIT,
++};
++
++/* Port VC Capability Register 2 */
++#define PCIE_PVC2(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x148)
++#define PCIE_PVC2_VC_ARB_16P_FIXED_WRR      0x00000001  /* HW Fixed arbitration, 16 phase WRR */
++#define PCIE_PVC2_VC_ARB_32P_WRR            0x00000002  /* 32 phase WRR */
++#define PCIE_PVC2_VC_ARB_64P_WRR            0x00000004  /* 64 phase WRR */
++#define PCIE_PVC2_VC_ARB_128P_WRR           0x00000008  /* 128 phase WRR */
++#define PCIE_PVC2_VC_ARB_WRR                0x0000000F
++#define PCIE_PVC2_VC_ARB_TAB_OFFSET         0xFF000000  /* VC arbitration table offset, not support */
++#define PCIE_PVC2_VC_ARB_TAB_OFFSET_S       24
++
++/* Port VC Control and Status Register */     
++#define PCIE_PVCCRSR(X)                     (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x14C)
++#define PCIE_PVCCRSR_LOAD_VC_ARB_TAB         0x00000001  /* Load VC Arbitration Table */
++#define PCIE_PVCCRSR_VC_ARB_SEL              0x0000000E  /* VC Arbitration Select */
++#define PCIE_PVCCRSR_VC_ARB_SEL_S            1
++#define PCIE_PVCCRSR_VC_ARB_TAB_STATUS       0x00010000  /* Arbitration Status */
++
++/* VC0 Resource Capability Register */
++#define PCIE_VC0_RC(X)                       (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x150)
++#define PCIE_VC0_RC_PORT_ARB_HW_FIXED        0x00000001  /* HW Fixed arbitration */
++#define PCIE_VC0_RC_PORT_ARB_32P_WRR         0x00000002  /* 32 phase WRR */
++#define PCIE_VC0_RC_PORT_ARB_64P_WRR         0x00000004  /* 64 phase WRR */
++#define PCIE_VC0_RC_PORT_ARB_128P_WRR        0x00000008  /* 128 phase WRR */
++#define PCIE_VC0_RC_PORT_ARB_TM_128P_WRR     0x00000010  /* Time-based 128 phase WRR */
++#define PCIE_VC0_RC_PORT_ARB_TM_256P_WRR     0x00000020  /* Time-based 256 phase WRR */
++#define PCIE_VC0_RC_PORT_ARB          (PCIE_VC0_RC_PORT_ARB_HW_FIXED | PCIE_VC0_RC_PORT_ARB_32P_WRR |\
++                        PCIE_VC0_RC_PORT_ARB_64P_WRR | PCIE_VC0_RC_PORT_ARB_128P_WRR | \
++                        PCIE_VC0_RC_PORT_ARB_TM_128P_WRR | PCIE_VC0_RC_PORT_ARB_TM_256P_WRR)
++
++#define PCIE_VC0_RC_REJECT_SNOOP             0x00008000  /* Reject Snoop Transactioin */
++#define PCIE_VC0_RC_MAX_TIMESLOTS            0x007F0000  /* Maximum time Slots */
++#define PCIE_VC0_RC_MAX_TIMESLOTS_S          16
++#define PCIE_VC0_RC_PORT_ARB_TAB_OFFSET      0xFF000000  /* Port Arbitration Table Offset */
++#define PCIE_VC0_RC_PORT_ARB_TAB_OFFSET_S    24
++
++/* VC0 Resource Control Register */
++#define PCIE_VC0_RC0(X)                      (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x154)
++#define PCIE_VC0_RC0_TVM0                    0x00000001  /* TC0 and VC0 */
++#define PCIE_VC0_RC0_TVM1                    0x00000002  /* TC1 and VC1 */
++#define PCIE_VC0_RC0_TVM2                    0x00000004  /* TC2 and VC2 */
++#define PCIE_VC0_RC0_TVM3                    0x00000008  /* TC3 and VC3 */
++#define PCIE_VC0_RC0_TVM4                    0x00000010  /* TC4 and VC4 */
++#define PCIE_VC0_RC0_TVM5                    0x00000020  /* TC5 and VC5 */
++#define PCIE_VC0_RC0_TVM6                    0x00000040  /* TC6 and VC6 */
++#define PCIE_VC0_RC0_TVM7                    0x00000080  /* TC7 and VC7 */
++#define PCIE_VC0_RC0_TC_VC                   0x000000FF  /* TC/VC mask */
++
++#define PCIE_VC0_RC0_LOAD_PORT_ARB_TAB       0x00010000  /* Load Port Arbitration Table */
++#define PCIE_VC0_RC0_PORT_ARB_SEL            0x000E0000  /* Port Arbitration Select */
++#define PCIE_VC0_RC0_PORT_ARB_SEL_S          17
++#define PCIE_VC0_RC0_VC_ID                   0x07000000  /* VC ID */
++#define PCIE_VC0_RC0_VC_ID_S                 24
++#define PCIE_VC0_RC0_VC_EN                   0x80000000  /* VC Enable */
++
++/* VC0 Resource Status Register */
++#define PCIE_VC0_RSR0(X)                     (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x158)
++#define PCIE_VC0_RSR0_PORT_ARB_TAB_STATUS    0x00010000  /* Port Arbitration Table Status,not used */
++#define PCIE_VC0_RSR0_VC_NEG_PENDING         0x00020000  /* VC Negotiation Pending */
++
++/* Ack Latency Timer and Replay Timer Register */
++#define PCIE_ALTRT(X)                         (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x700)
++#define PCIE_ALTRT_ROUND_TRIP_LATENCY_LIMIT   0x0000FFFF  /* Round Trip Latency Time Limit */
++#define PCIE_ALTRT_ROUND_TRIP_LATENCY_LIMIT_S 0
++#define PCIE_ALTRT_REPLAY_TIME_LIMIT          0xFFFF0000  /* Replay Time Limit */
++#define PCIE_ALTRT_REPLAY_TIME_LIMIT_S        16
++
++/* Other Message Register */
++#define PCIE_OMR(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x704)
++
++/* Port Force Link Register */
++#define PCIE_PFLR(X)                         (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x708)
++#define PCIE_PFLR_LINK_NUM                   0x000000FF  /* Link Number */
++#define PCIE_PFLR_LINK_NUM_S                 0
++#define PCIE_PFLR_FORCE_LINK                 0x00008000  /* Force link */
++#define PCIE_PFLR_LINK_STATE                 0x003F0000  /* Link State */
++#define PCIE_PFLR_LINK_STATE_S               16
++#define PCIE_PFLR_LOW_POWER_ENTRY_CNT        0xFF000000  /* Low Power Entrance Count, only for EP */
++#define PCIE_PFLR_LOW_POWER_ENTRY_CNT_S      24
++
++/* Ack Frequency Register */
++#define PCIE_AFR(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x70C)
++#define PCIE_AFR_AF                          0x000000FF  /* Ack Frequency */
++#define PCIE_AFR_AF_S                        0
++#define PCIE_AFR_FTS_NUM                     0x0000FF00  /* The number of Fast Training Sequence from L0S to L0 */
++#define PCIE_AFR_FTS_NUM_S                   8
++#define PCIE_AFR_COM_FTS_NUM                 0x00FF0000  /* N_FTS; when common clock is used*/
++#define PCIE_AFR_COM_FTS_NUM_S               16
++#define PCIE_AFR_L0S_ENTRY_LATENCY           0x07000000  /* L0s Entrance Latency */
++#define PCIE_AFR_L0S_ENTRY_LATENCY_S         24
++#define PCIE_AFR_L1_ENTRY_LATENCY            0x38000000  /* L1 Entrance Latency */
++#define PCIE_AFR_L1_ENTRY_LATENCY_S          27
++#define PCIE_AFR_FTS_NUM_DEFAULT             32
++#define PCIE_AFR_L0S_ENTRY_LATENCY_DEFAULT   7
++#define PCIE_AFR_L1_ENTRY_LATENCY_DEFAULT    5
++
++/* Port Link Control Register */
++#define PCIE_PLCR(X)                         (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x710)
++#define PCIE_PLCR_OTHER_MSG_REQ              0x00000001  /* Other Message Request */
++#define PCIE_PLCR_SCRAMBLE_DISABLE           0x00000002  /* Scramble Disable */  
++#define PCIE_PLCR_LOOPBACK_EN                0x00000004  /* Loopback Enable */
++#define PCIE_PLCR_LTSSM_HOT_RST              0x00000008  /* Force LTSSM to the hot reset */
++#define PCIE_PLCR_DLL_LINK_EN                0x00000020  /* Enable Link initialization */
++#define PCIE_PLCR_FAST_LINK_SIM_EN           0x00000080  /* Sets all internal timers to fast mode for simulation purposes */
++#define PCIE_PLCR_LINK_MODE                  0x003F0000  /* Link Mode Enable Mask */
++#define PCIE_PLCR_LINK_MODE_S                16
++#define PCIE_PLCR_CORRUPTED_CRC_EN           0x02000000  /* Enabled Corrupt CRC */
++
++/* Lane Skew Register */
++#define PCIE_LSR(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x714)
++#define PCIE_LSR_LANE_SKEW_NUM               0x00FFFFFF  /* Insert Lane Skew for Transmit, not applicable */
++#define PCIE_LSR_LANE_SKEW_NUM_S             0
++#define PCIE_LSR_FC_DISABLE                  0x01000000  /* Disable of Flow Control */
++#define PCIE_LSR_ACKNAK_DISABLE              0x02000000  /* Disable of Ack/Nak */
++#define PCIE_LSR_LANE_DESKEW_DISABLE         0x80000000  /* Disable of Lane-to-Lane Skew */
++
++/* Symbol Number Register */
++#define PCIE_SNR(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x718)
++#define PCIE_SNR_TS                          0x0000000F  /* Number of TS Symbol */
++#define PCIE_SNR_TS_S                        0
++#define PCIE_SNR_SKP                         0x00000700  /* Number of SKP Symbol */
++#define PCIE_SNR_SKP_S                       8
++#define PCIE_SNR_REPLAY_TIMER                0x0007C000  /* Timer Modifier for Replay Timer */
++#define PCIE_SNR_REPLAY_TIMER_S              14
++#define PCIE_SNR_ACKNAK_LATENCY_TIMER        0x00F80000  /* Timer Modifier for Ack/Nak Latency Timer */
++#define PCIE_SNR_ACKNAK_LATENCY_TIMER_S      19
++#define PCIE_SNR_FC_TIMER                    0x1F000000  /* Timer Modifier for Flow Control Watchdog Timer */
++#define PCIE_SNR_FC_TIMER_S                  28
++
++/* Symbol Timer Register and Filter Mask Register 1 */
++#define PCIE_STRFMR(X)                      (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x71C)
++#define PCIE_STRFMR_SKP_INTERVAL            0x000007FF  /* SKP lnterval Value */
++#define PCIE_STRFMR_SKP_INTERVAL_S          0
++#define PCIE_STRFMR_FC_WDT_DISABLE          0x00008000  /* Disable of FC Watchdog Timer */
++#define PCIE_STRFMR_TLP_FUNC_MISMATCH_OK    0x00010000  /* Mask Function Mismatch Filtering for Incoming Requests */
++#define PCIE_STRFMR_POISONED_TLP_OK         0x00020000  /* Mask Poisoned TLP Filtering */
++#define PCIE_STRFMR_BAR_MATCH_OK            0x00040000  /* Mask BAR Match Filtering */
++#define PCIE_STRFMR_TYPE1_CFG_REQ_OK        0x00080000  /* Mask Type 1 Configuration Request Filtering */
++#define PCIE_STRFMR_LOCKED_REQ_OK           0x00100000  /* Mask Locked Request Filtering */
++#define PCIE_STRFMR_CPL_TAG_ERR_RULES_OK    0x00200000  /* Mask Tag Error Rules for Received Completions */
++#define PCIE_STRFMR_CPL_REQUESTOR_ID_MISMATCH_OK 0x00400000  /* Mask Requester ID Mismatch Error for Received Completions */
++#define PCIE_STRFMR_CPL_FUNC_MISMATCH_OK         0x00800000  /* Mask Function Mismatch Error for Received Completions */
++#define PCIE_STRFMR_CPL_TC_MISMATCH_OK           0x01000000  /* Mask Traffic Class Mismatch Error for Received Completions */
++#define PCIE_STRFMR_CPL_ATTR_MISMATCH_OK         0x02000000  /* Mask Attribute Mismatch Error for Received Completions */
++#define PCIE_STRFMR_CPL_LENGTH_MISMATCH_OK       0x04000000  /* Mask Length Mismatch Error for Received Completions */
++#define PCIE_STRFMR_TLP_ECRC_ERR_OK              0x08000000  /* Mask ECRC Error Filtering */
++#define PCIE_STRFMR_CPL_TLP_ECRC_OK              0x10000000  /* Mask ECRC Error Filtering for Completions */
++#define PCIE_STRFMR_RX_TLP_MSG_NO_DROP           0x20000000  /* Send Message TLPs */
++#define PCIE_STRFMR_RX_IO_TRANS_ENABLE           0x40000000  /* Mask Filtering of received I/O Requests */
++#define PCIE_STRFMR_RX_CFG_TRANS_ENABLE          0x80000000  /* Mask Filtering of Received Configuration Requests */
++
++#define PCIE_DEF_SKP_INTERVAL    700             /* 1180 ~1538 , 125MHz * 2, 250MHz * 1 */
++
++/* Filter Masker Register 2 */
++#define PCIE_FMR2(X)                             (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x720)
++#define PCIE_FMR2_VENDOR_MSG0_PASSED_TO_TRGT1    0x00000001  /* Mask RADM Filtering and Error Handling Rules */
++#define PCIE_FMR2_VENDOR_MSG1_PASSED_TO_TRGT1    0x00000002  /* Mask RADM Filtering and Error Handling Rules */
++
++/* Debug Register 0 */
++#define PCIE_DBR0(X)                              (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x728)
++
++/* Debug Register 1 */
++#define PCIE_DBR1(X)                              (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x72C)
++
++/* Transmit Posted FC Credit Status Register */
++#define PCIE_TPFCS(X)                             (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x730)
++#define PCIE_TPFCS_TX_P_DATA_FC_CREDITS           0x00000FFF /* Transmit Posted Data FC Credits */
++#define PCIE_TPFCS_TX_P_DATA_FC_CREDITS_S         0
++#define PCIE_TPFCS_TX_P_HDR_FC_CREDITS            0x000FF000 /* Transmit Posted Header FC Credits */
++#define PCIE_TPFCS_TX_P_HDR_FC_CREDITS_S          12
++
++/* Transmit Non-Posted FC Credit Status */
++#define PCIE_TNPFCS(X)                            (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x734)
++#define PCIE_TNPFCS_TX_NP_DATA_FC_CREDITS         0x00000FFF /* Transmit Non-Posted Data FC Credits */
++#define PCIE_TNPFCS_TX_NP_DATA_FC_CREDITS_S       0
++#define PCIE_TNPFCS_TX_NP_HDR_FC_CREDITS          0x000FF000 /* Transmit Non-Posted Header FC Credits */
++#define PCIE_TNPFCS_TX_NP_HDR_FC_CREDITS_S        12
++
++/* Transmit Complete FC Credit Status Register */
++#define PCIE_TCFCS(X)                             (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x738)
++#define PCIE_TCFCS_TX_CPL_DATA_FC_CREDITS         0x00000FFF /* Transmit Completion Data FC Credits */
++#define PCIE_TCFCS_TX_CPL_DATA_FC_CREDITS_S       0
++#define PCIE_TCFCS_TX_CPL_HDR_FC_CREDITS          0x000FF000 /* Transmit Completion Header FC Credits */
++#define PCIE_TCFCS_TX_CPL_HDR_FC_CREDITS_S        12
++
++/* Queue Status Register */
++#define PCIE_QSR(X)                              (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x73C)
++#define PCIE_QSR_WAIT_UPDATE_FC_DLL               0x00000001 /* Received TLP FC Credits Not Returned */
++#define PCIE_QSR_TX_RETRY_BUF_NOT_EMPTY           0x00000002 /* Transmit Retry Buffer Not Empty */
++#define PCIE_QSR_RX_QUEUE_NOT_EMPTY               0x00000004 /* Received Queue Not Empty */
++
++/* VC Transmit Arbitration Register 1 */
++#define PCIE_VCTAR1(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x740)
++#define PCIE_VCTAR1_WRR_WEIGHT_VC0               0x000000FF /* WRR Weight for VC0 */
++#define PCIE_VCTAR1_WRR_WEIGHT_VC1               0x0000FF00 /* WRR Weight for VC1 */
++#define PCIE_VCTAR1_WRR_WEIGHT_VC2               0x00FF0000 /* WRR Weight for VC2 */
++#define PCIE_VCTAR1_WRR_WEIGHT_VC3               0xFF000000 /* WRR Weight for VC3 */
++
++/* VC Transmit Arbitration Register 2 */
++#define PCIE_VCTAR2(X)                          (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x744)
++#define PCIE_VCTAR2_WRR_WEIGHT_VC4               0x000000FF /* WRR Weight for VC4 */
++#define PCIE_VCTAR2_WRR_WEIGHT_VC5               0x0000FF00 /* WRR Weight for VC5 */
++#define PCIE_VCTAR2_WRR_WEIGHT_VC6               0x00FF0000 /* WRR Weight for VC6 */
++#define PCIE_VCTAR2_WRR_WEIGHT_VC7               0xFF000000 /* WRR Weight for VC7 */
++
++/* VC0 Posted Receive Queue Control Register */
++#define PCIE_VC0_PRQCR(X)                       (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x748)
++#define PCIE_VC0_PRQCR_P_DATA_CREDITS            0x00000FFF /* VC0 Posted Data Credits */
++#define PCIE_VC0_PRQCR_P_DATA_CREDITS_S          0
++#define PCIE_VC0_PRQCR_P_HDR_CREDITS             0x000FF000 /* VC0 Posted Header Credits */
++#define PCIE_VC0_PRQCR_P_HDR_CREDITS_S           12
++#define PCIE_VC0_PRQCR_P_TLP_QUEUE_MODE          0x00E00000 /* VC0 Posted TLP Queue Mode */
++#define PCIE_VC0_PRQCR_P_TLP_QUEUE_MODE_S        20
++#define PCIE_VC0_PRQCR_TLP_RELAX_ORDER           0x40000000 /* TLP Type Ordering for VC0 */    
++#define PCIE_VC0_PRQCR_VC_STRICT_ORDER           0x80000000 /* VC0 Ordering for Receive Queues */
++
++/* VC0 Non-Posted Receive Queue Control */
++#define PCIE_VC0_NPRQCR(X)                      (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x74C)
++#define PCIE_VC0_NPRQCR_NP_DATA_CREDITS          0x00000FFF /* VC0 Non-Posted Data Credits */
++#define PCIE_VC0_NPRQCR_NP_DATA_CREDITS_S        0
++#define PCIE_VC0_NPRQCR_NP_HDR_CREDITS           0x000FF000 /* VC0 Non-Posted Header Credits */
++#define PCIE_VC0_NPRQCR_NP_HDR_CREDITS_S         12
++#define PCIE_VC0_NPRQCR_NP_TLP_QUEUE_MODE        0x00E00000 /* VC0 Non-Posted TLP Queue Mode */
++#define PCIE_VC0_NPRQCR_NP_TLP_QUEUE_MODE_S      20
++
++/* VC0 Completion Receive Queue Control */
++#define PCIE_VC0_CRQCR(X)                       (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x750)
++#define PCIE_VC0_CRQCR_CPL_DATA_CREDITS          0x00000FFF /* VC0 Completion TLP Queue Mode */
++#define PCIE_VC0_CRQCR_CPL_DATA_CREDITS_S        0
++#define PCIE_VC0_CRQCR_CPL_HDR_CREDITS           0x000FF000 /* VC0 Completion Header Credits */
++#define PCIE_VC0_CRQCR_CPL_HDR_CREDITS_S         12
++#define PCIE_VC0_CRQCR_CPL_TLP_QUEUE_MODE        0x00E00000 /* VC0 Completion Data Credits */
++#define PCIE_VC0_CRQCR_CPL_TLP_QUEUE_MODE_S      21
++
++/* Applicable to the above three registers */
++enum {
++    PCIE_VC0_TLP_QUEUE_MODE_STORE_FORWARD = 1,
++    PCIE_VC0_TLP_QUEUE_MODE_CUT_THROUGH   = 2,
++    PCIE_VC0_TLP_QUEUE_MODE_BYPASS        = 4,
++};
++
++/* VC0 Posted Buffer Depth Register */
++#define PCIE_VC0_PBD(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x7A8)
++#define PCIE_VC0_PBD_P_DATA_QUEUE_ENTRIES       0x00003FFF /* VC0 Posted Data Queue Depth */
++#define PCIE_VC0_PBD_P_DATA_QUEUE_ENTRIES_S     0
++#define PCIE_VC0_PBD_P_HDR_QUEUE_ENTRIES        0x03FF0000 /* VC0 Posted Header Queue Depth */
++#define PCIE_VC0_PBD_P_HDR_QUEUE_ENTRIES_S      16
++
++/* VC0 Non-Posted Buffer Depth Register */
++#define PCIE_VC0_NPBD(X)                       (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x7AC)
++#define PCIE_VC0_NPBD_NP_DATA_QUEUE_ENTRIES     0x00003FFF /* VC0 Non-Posted Data Queue Depth */
++#define PCIE_VC0_NPBD_NP_DATA_QUEUE_ENTRIES_S   0
++#define PCIE_VC0_NPBD_NP_HDR_QUEUE_ENTRIES      0x03FF0000 /* VC0 Non-Posted Header Queue Depth */
++#define PCIE_VC0_NPBD_NP_HDR_QUEUE_ENTRIES_S    16
++
++/* VC0 Completion Buffer Depth Register */
++#define PCIE_VC0_CBD(X)                        (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x7B0)
++#define PCIE_VC0_CBD_CPL_DATA_QUEUE_ENTRIES     0x00003FFF /* C0 Completion Data Queue Depth */
++#define PCIE_VC0_CBD_CPL_DATA_QUEUE_ENTRIES_S   0
++#define PCIE_VC0_CBD_CPL_HDR_QUEUE_ENTRIES      0x03FF0000 /* VC0 Completion Header Queue Depth */
++#define PCIE_VC0_CBD_CPL_HDR_QUEUE_ENTRIES_S    16
++
++/* PHY Status Register, all zeros in VR9 */
++#define PCIE_PHYSR(X)                           (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x810)
++
++/* PHY Control Register, all zeros in VR9 */
++#define PCIE_PHYCR(X)                           (volatile u32*)(PCIE_RC_PORT_TO_BASE(X) + 0x814)
++
++/* 
++ * PCIe PDI PHY register definition, suppose all the following 
++ * stuff is confidential. 
++ * XXX, detailed bit definition
++ */
++#define	PCIE_PHY_PLL_CTRL1(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x22 << 1))
++#define	PCIE_PHY_PLL_CTRL2(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x23 << 1))
++#define	PCIE_PHY_PLL_CTRL3(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x24 << 1))
++#define	PCIE_PHY_PLL_CTRL4(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x25 << 1))
++#define	PCIE_PHY_PLL_CTRL5(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x26 << 1))
++#define	PCIE_PHY_PLL_CTRL6(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x27 << 1))
++#define	PCIE_PHY_PLL_CTRL7(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x28 << 1))
++#define	PCIE_PHY_PLL_A_CTRL1(X)     (PCIE_PHY_PORT_TO_BASE(X) + (0x29 << 1))
++#define	PCIE_PHY_PLL_A_CTRL2(X)     (PCIE_PHY_PORT_TO_BASE(X) + (0x2A << 1))
++#define	PCIE_PHY_PLL_A_CTRL3(X)     (PCIE_PHY_PORT_TO_BASE(X) + (0x2B << 1))
++#define	PCIE_PHY_PLL_STATUS(X)      (PCIE_PHY_PORT_TO_BASE(X) + (0x2C << 1))
++ 
++#define PCIE_PHY_TX1_CTRL1(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x30 << 1))
++#define PCIE_PHY_TX1_CTRL2(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x31 << 1))
++#define PCIE_PHY_TX1_CTRL3(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x32 << 1))
++#define PCIE_PHY_TX1_A_CTRL1(X)     (PCIE_PHY_PORT_TO_BASE(X) + (0x33 << 1))
++#define PCIE_PHY_TX1_A_CTRL2(X)     (PCIE_PHY_PORT_TO_BASE(X) + (0x34 << 1))
++#define PCIE_PHY_TX1_MOD1(X)        (PCIE_PHY_PORT_TO_BASE(X) + (0x35 << 1))
++#define PCIE_PHY_TX1_MOD2(X)        (PCIE_PHY_PORT_TO_BASE(X) + (0x36 << 1))
++#define PCIE_PHY_TX1_MOD3(X)        (PCIE_PHY_PORT_TO_BASE(X) + (0x37 << 1))
++
++#define PCIE_PHY_TX2_CTRL1(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x38 << 1))
++#define PCIE_PHY_TX2_CTRL2(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x39 << 1))
++#define PCIE_PHY_TX2_A_CTRL1(X)     (PCIE_PHY_PORT_TO_BASE(X) + (0x3B << 1))
++#define PCIE_PHY_TX2_A_CTRL2(X)     (PCIE_PHY_PORT_TO_BASE(X) + (0x3C << 1))
++#define PCIE_PHY_TX2_MOD1(X)        (PCIE_PHY_PORT_TO_BASE(X) + (0x3D << 1))
++#define PCIE_PHY_TX2_MOD2(X)        (PCIE_PHY_PORT_TO_BASE(X) + (0x3E << 1))
++#define PCIE_PHY_TX2_MOD3(X)        (PCIE_PHY_PORT_TO_BASE(X) + (0x3F << 1))
++
++#define PCIE_PHY_RX1_CTRL1(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x50 << 1))
++#define PCIE_PHY_RX1_CTRL2(X)       (PCIE_PHY_PORT_TO_BASE(X) + (0x51 << 1))
++#define PCIE_PHY_RX1_CDR(X)         (PCIE_PHY_PORT_TO_BASE(X) + (0x52 << 1))
++#define PCIE_PHY_RX1_EI(X)          (PCIE_PHY_PORT_TO_BASE(X) + (0x53 << 1))
++#define PCIE_PHY_RX1_A_CTRL(X)      (PCIE_PHY_PORT_TO_BASE(X) + (0x55 << 1))
++
++/* Interrupt related stuff */
++#define PCIE_LEGACY_DISABLE 0
++#define PCIE_LEGACY_INTA  1
++#define PCIE_LEGACY_INTB  2
++#define PCIE_LEGACY_INTC  3
++#define PCIE_LEGACY_INTD  4
++#define PCIE_LEGACY_INT_MAX PCIE_LEGACY_INTD
++
++#define PCIE_IRQ_LOCK(lock) do {             \
++    unsigned long flags;                     \
++    spin_lock_irqsave(&(lock), flags);
++#define PCIE_IRQ_UNLOCK(lock)                \
++    spin_unlock_irqrestore(&(lock), flags);  \
++} while (0)
++
++#define PCIE_MSG_MSI        0x00000001
++#define PCIE_MSG_ISR        0x00000002
++#define PCIE_MSG_FIXUP      0x00000004
++#define PCIE_MSG_READ_CFG   0x00000008
++#define PCIE_MSG_WRITE_CFG  0x00000010
++#define PCIE_MSG_CFG        (PCIE_MSG_READ_CFG | PCIE_MSG_WRITE_CFG)
++#define PCIE_MSG_REG        0x00000020
++#define PCIE_MSG_INIT       0x00000040
++#define PCIE_MSG_ERR        0x00000080
++#define PCIE_MSG_PHY        0x00000100
++#define PCIE_MSG_ANY        0x000001ff
++
++#define IFX_PCIE_PORT0      0
++#define IFX_PCIE_PORT1      1
++
++#ifdef CONFIG_IFX_PCIE_2ND_CORE
++#define IFX_PCIE_CORE_NR    2
++#else
++#define IFX_PCIE_CORE_NR    1
++#endif
++
++//#define IFX_PCIE_ERROR_INT
++
++//#define IFX_PCIE_DBG
++
++#if defined(IFX_PCIE_DBG)
++#define IFX_PCIE_PRINT(_m, _fmt, args...) do {   \
++    if (g_pcie_debug_flag & (_m)) {              \
++        ifx_pcie_debug((_fmt), ##args);          \
++    }                                            \
++} while (0)
++
++#define INLINE 
++#else
++#define IFX_PCIE_PRINT(_m, _fmt, args...)   \
++    do {} while(0)
++#define INLINE inline
++#endif
++
++struct ifx_pci_controller {
++	struct pci_controller   pcic;
++    
++	/* RC specific, per host bus information */
++	u32   port;  /* Port index, 0 -- 1st core, 1 -- 2nd core */
++};
++
++typedef struct ifx_pcie_ir_irq {
++    const unsigned int irq;
++    const char name[16];
++}ifx_pcie_ir_irq_t;
++
++typedef struct ifx_pcie_legacy_irq{
++    const u32 irq_bit;
++    const int irq;
++}ifx_pcie_legacy_irq_t;
++
++typedef struct ifx_pcie_irq {
++    ifx_pcie_ir_irq_t ir_irq;
++    ifx_pcie_legacy_irq_t legacy_irq[PCIE_LEGACY_INT_MAX];
++}ifx_pcie_irq_t;
++
++extern u32 g_pcie_debug_flag;
++extern void ifx_pcie_debug(const char *fmt, ...);
++extern void pcie_phy_clock_mode_setup(int pcie_port);
++extern void pcie_msi_pic_init(int pcie_port);
++extern u32 ifx_pcie_bus_enum_read_hack(int where, u32 value);
++extern u32 ifx_pcie_bus_enum_write_hack(int where, u32 value);
++
++
++#include <linux/types.h>
++#include <linux/delay.h>
++#include <linux/gpio.h>
++#include <linux/clk.h>
++
++#include <lantiq_soc.h>
++
++#define IFX_PCIE_GPIO_RESET  38
++#define IFX_REG_R32	ltq_r32
++#define IFX_REG_W32	ltq_w32
++#define CONFIG_IFX_PCIE_HW_SWAP
++#define IFX_RCU_AHB_ENDIAN                      ((volatile u32*)(IFX_RCU + 0x004C))
++#define IFX_RCU_RST_REQ                         ((volatile u32*)(IFX_RCU + 0x0010))
++#define IFX_RCU_AHB_BE_PCIE_PDI                  0x00000080  /* Configure PCIE PDI module in big endian*/
++
++#define IFX_RCU                                 (KSEG1 | 0x1F203000)
++#define IFX_RCU_AHB_BE_PCIE_M                    0x00000001  /* Configure AHB master port that connects to PCIe RC in big endian */
++#define IFX_RCU_AHB_BE_PCIE_S                    0x00000010  /* Configure AHB slave port that connects to PCIe RC in little endian */
++#define IFX_RCU_AHB_BE_XBAR_M                    0x00000002  /* Configure AHB master port that connects to XBAR in big endian */
++#define CONFIG_IFX_PCIE_PHY_36MHZ_MODE
++
++#define IFX_PMU1_MODULE_PCIE_PHY   (0)
++#define IFX_PMU1_MODULE_PCIE_CTRL  (1)
++#define IFX_PMU1_MODULE_PDI        (4)
++#define IFX_PMU1_MODULE_MSI        (5)
++
++#define IFX_PMU_MODULE_PCIE_L0_CLK (31)
++
++
++static inline void pcie_ep_gpio_rst_init(int pcie_port)
++{
++}
++
++static inline void pcie_ahb_pmu_setup(void)
++{
++	struct clk *clk;
++	clk = clk_get_sys("ltq_pcie", "ahb");
++	clk_enable(clk);
++	//ltq_pmu_enable(PMU_AHBM | PMU_AHBS);
++}
++
++static inline void pcie_rcu_endian_setup(int pcie_port)
++{
++    u32 reg;
++
++    reg = IFX_REG_R32(IFX_RCU_AHB_ENDIAN);
++#ifdef CONFIG_IFX_PCIE_HW_SWAP
++    reg |= IFX_RCU_AHB_BE_PCIE_M;
++    reg |= IFX_RCU_AHB_BE_PCIE_S;
++    reg &= ~IFX_RCU_AHB_BE_XBAR_M;
++#else 
++    reg |= IFX_RCU_AHB_BE_PCIE_M;
++    reg &= ~IFX_RCU_AHB_BE_PCIE_S;
++    reg &= ~IFX_RCU_AHB_BE_XBAR_M;
++#endif /* CONFIG_IFX_PCIE_HW_SWAP */
++    IFX_REG_W32(reg, IFX_RCU_AHB_ENDIAN);
++    IFX_PCIE_PRINT(PCIE_MSG_REG, "%s IFX_RCU_AHB_ENDIAN: 0x%08x\n", __func__, IFX_REG_R32(IFX_RCU_AHB_ENDIAN));
++}
++
++static inline void pcie_phy_pmu_enable(int pcie_port)
++{
++	struct clk *clk;
++	clk = clk_get_sys("ltq_pcie", "phy");
++	clk_enable(clk);
++	//ltq_pmu1_enable(1<<IFX_PMU1_MODULE_PCIE_PHY);
++}
++
++static inline void pcie_phy_pmu_disable(int pcie_port)
++{
++	struct clk *clk;
++	clk = clk_get_sys("ltq_pcie", "phy");
++	clk_disable(clk);
++	//ltq_pmu1_disable(1<<IFX_PMU1_MODULE_PCIE_PHY);
++}
++
++static inline void pcie_pdi_big_endian(int pcie_port)
++{
++    u32 reg;
++
++    /* SRAM2PDI endianness control. */
++    reg = IFX_REG_R32(IFX_RCU_AHB_ENDIAN);
++    /* Config AHB->PCIe and PDI endianness */
++    reg |= IFX_RCU_AHB_BE_PCIE_PDI;
++    IFX_REG_W32(reg, IFX_RCU_AHB_ENDIAN);
++}
++
++static inline void pcie_pdi_pmu_enable(int pcie_port)
++{
++	struct clk *clk;
++	clk = clk_get_sys("ltq_pcie", "pdi");
++	clk_enable(clk);
++	//ltq_pmu1_enable(1<<IFX_PMU1_MODULE_PDI);
++}
++
++static inline void pcie_core_rst_assert(int pcie_port)
++{
++    u32 reg;
++
++    reg = IFX_REG_R32(IFX_RCU_RST_REQ);
++
++    /* Reset PCIe PHY & Core, bit 22, bit 26 may be affected if write it directly  */
++    reg |= 0x00400000;
++    IFX_REG_W32(reg, IFX_RCU_RST_REQ);
++}
++
++static inline void pcie_core_rst_deassert(int pcie_port)
++{
++    u32 reg;
++
++    /* Make sure one micro-second delay */
++    udelay(1);
++
++    /* Reset PCIe PHY & Core, bit 22 */
++    reg = IFX_REG_R32(IFX_RCU_RST_REQ);
++    reg &= ~0x00400000;
++    IFX_REG_W32(reg, IFX_RCU_RST_REQ);
++}
++
++static inline void pcie_phy_rst_assert(int pcie_port)
++{
++    u32 reg;
++
++    reg = IFX_REG_R32(IFX_RCU_RST_REQ);
++    reg |= 0x00001000; /* Bit 12 */
++    IFX_REG_W32(reg, IFX_RCU_RST_REQ);
++}
++
++static inline void pcie_phy_rst_deassert(int pcie_port)
++{
++    u32 reg;
++
++    /* Make sure one micro-second delay */
++    udelay(1);
++
++    reg = IFX_REG_R32(IFX_RCU_RST_REQ);
++    reg &= ~0x00001000; /* Bit 12 */
++    IFX_REG_W32(reg, IFX_RCU_RST_REQ);
++}
++
++static inline void pcie_device_rst_assert(int pcie_port)
++{
++	gpio_set_value(IFX_PCIE_GPIO_RESET, 0);
++  //  ifx_gpio_output_clear(IFX_PCIE_GPIO_RESET, ifx_pcie_gpio_module_id);
++}
++
++static inline void pcie_device_rst_deassert(int pcie_port)
++{
++    mdelay(100);
++	gpio_set_value(IFX_PCIE_GPIO_RESET, 1);
++//    ifx_gpio_output_set(IFX_PCIE_GPIO_RESET, ifx_pcie_gpio_module_id);
++}
++
++static inline void pcie_core_pmu_setup(int pcie_port)
++{
++	struct clk *clk;
++	clk = clk_get_sys("ltq_pcie", "ctl");
++	clk_enable(clk);
++	clk = clk_get_sys("ltq_pcie", "bus");
++	clk_enable(clk);
++
++	//ltq_pmu1_enable(1 << IFX_PMU1_MODULE_PCIE_CTRL);
++	//ltq_pmu_enable(1 << IFX_PMU_MODULE_PCIE_L0_CLK);
++}
++
++static inline void pcie_msi_init(int pcie_port)
++{
++	struct clk *clk;
++    pcie_msi_pic_init(pcie_port);
++	clk = clk_get_sys("ltq_pcie", "msi");
++	clk_enable(clk);
++	//ltq_pmu1_enable(1 << IFX_PMU1_MODULE_MSI);
++}
++
++static inline u32
++ifx_pcie_bus_nr_deduct(u32 bus_number, int pcie_port)
++{
++    u32 tbus_number = bus_number;
++
++#ifdef CONFIG_PCI_LANTIQ
++    if (pcibios_host_nr() > 1) {
++        tbus_number -= pcibios_1st_host_bus_nr();
++    }
++#endif /* CONFIG_PCI_LANTIQ */
++    return tbus_number;
++}
++
++static inline u32
++ifx_pcie_bus_enum_hack(struct pci_bus *bus, u32 devfn, int where, u32 value, int pcie_port, int read)
++{
++    struct pci_dev *pdev;
++    u32 tvalue = value;
++
++    /* Sanity check */
++    pdev = pci_get_slot(bus, devfn);
++    if (pdev == NULL) {
++        return tvalue;
++    }
++
++    /* Only care about PCI bridge */
++    if (pdev->hdr_type != PCI_HEADER_TYPE_BRIDGE) {
++        return tvalue;
++    }
++
++    if (read) { /* Read hack */
++    #ifdef CONFIG_PCI_LANTIQ
++        if (pcibios_host_nr() > 1) {
++            tvalue = ifx_pcie_bus_enum_read_hack(where, tvalue);
++        }
++    #endif /* CONFIG_PCI_LANTIQ */
++    }
++    else { /* Write hack */
++    #ifdef CONFIG_PCI_LANTIQ
++        if (pcibios_host_nr() > 1) {
++            tvalue = ifx_pcie_bus_enum_write_hack(where, tvalue);
++        }
++    #endif
++    }
++    return tvalue;
++}
++
++#endif /* IFXMIPS_PCIE_VR9_H */
++
+--- a/drivers/pci/pcie/Kconfig
++++ b/drivers/pci/pcie/Kconfig
+@@ -51,6 +51,7 @@ config PCIEAER_INJECT
+ config PCIE_ECRC
+ 	bool "PCI Express ECRC settings control"
+ 	depends on PCIEAER
++	default n
+ 	help
+ 	  Used to override firmware/bios settings for PCI Express ECRC
+ 	  (transaction layer end-to-end CRC checking).
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -1482,6 +1482,8 @@ void pci_walk_bus(struct pci_bus *top, i
+ 		  void *userdata);
+ int pci_cfg_space_size(struct pci_dev *dev);
+ unsigned char pci_bus_max_busnr(struct pci_bus *bus);
++int pcibios_host_nr(void);
++int pcibios_1st_host_bus_nr(void);
+ void pci_setup_bridge(struct pci_bus *bus);
+ resource_size_t pcibios_window_alignment(struct pci_bus *bus,
+ 					 unsigned long type);
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -1085,6 +1085,12 @@
+ #define PCI_DEVICE_ID_SGI_IOC3		0x0003
+ #define PCI_DEVICE_ID_SGI_LITHIUM	0x1002
+ 
++#define PCI_VENDOR_ID_INFINEON		0x15D1
++#define PCI_DEVICE_ID_INFINEON_DANUBE	0x000F
++#define PCI_DEVICE_ID_INFINEON_PCIE	0x0011
++#define PCI_VENDOR_ID_LANTIQ		0x1BEF
++#define PCI_DEVICE_ID_LANTIQ_PCIE	0x0011
++
+ #define PCI_VENDOR_ID_WINBOND		0x10ad
+ #define PCI_DEVICE_ID_WINBOND_82C105	0x0105
+ #define PCI_DEVICE_ID_WINBOND_83C553	0x0565
diff --git a/target/linux/lantiq/patches-5.15/0004-MIPS-lantiq-add-atm-hack.patch b/target/linux/lantiq/patches-5.15/0004-MIPS-lantiq-add-atm-hack.patch
new file mode 100644
index 00000000000000..e32e4e2daaeff3
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0004-MIPS-lantiq-add-atm-hack.patch
@@ -0,0 +1,482 @@
+From 9afadf01b1be371ee88491819aa67364684461f9 Mon Sep 17 00:00:00 2001
+From: John Crispin <blogic@openwrt.org>
+Date: Fri, 3 Aug 2012 10:27:25 +0200
+Subject: [PATCH 04/36] MIPS: lantiq: add atm hack
+
+Signed-off-by: John Crispin <blogic@openwrt.org>
+---
+ arch/mips/include/asm/mach-lantiq/lantiq_atm.h |  196 +++++++++++++++++++++++
+ arch/mips/include/asm/mach-lantiq/lantiq_ptm.h |  203 ++++++++++++++++++++++++
+ arch/mips/lantiq/irq.c                         |    2 +
+ arch/mips/mm/cache.c                           |    4 +
+ include/uapi/linux/atm.h                       |    6 +
+ net/atm/common.c                               |    6 +
+ net/atm/proc.c                                 |    2 +-
+ 7 files changed, 416 insertions(+), 1 deletion(-)
+ create mode 100644 arch/mips/include/asm/mach-lantiq/lantiq_atm.h
+ create mode 100644 arch/mips/include/asm/mach-lantiq/lantiq_ptm.h
+
+--- /dev/null
++++ b/arch/mips/include/asm/mach-lantiq/lantiq_atm.h
+@@ -0,0 +1,196 @@
++/******************************************************************************
++**
++** FILE NAME    : ifx_atm.h
++** PROJECT      : UEIP
++** MODULES      : ATM
++**
++** DATE         : 17 Jun 2009
++** AUTHOR       : Xu Liang
++** DESCRIPTION  : Global ATM driver header file
++** COPYRIGHT    :       Copyright (c) 2006
++**                      Infineon Technologies AG
++**                      Am Campeon 1-12, 85579 Neubiberg, Germany
++**
++**    This program is free software; you can redistribute it and/or modify
++**    it under the terms of the GNU General Public License as published by
++**    the Free Software Foundation; either version 2 of the License, or
++**    (at your option) any later version.
++**
++** HISTORY
++** $Date        $Author         $Comment
++** 07 JUL 2009  Xu Liang        Init Version
++*******************************************************************************/
++
++#ifndef IFX_ATM_H
++#define IFX_ATM_H
++
++
++
++/*!
++  \defgroup IFX_ATM UEIP Project - ATM driver module
++  \brief UEIP Project - ATM driver module, support Danube, Amazon-SE, AR9, VR9.
++ */
++
++/*!
++  \defgroup IFX_ATM_IOCTL IOCTL Commands
++  \ingroup IFX_ATM
++  \brief IOCTL Commands used by user application.
++ */
++
++/*!
++  \defgroup IFX_ATM_STRUCT Structures
++  \ingroup IFX_ATM
++  \brief Structures used by user application.
++ */
++
++/*!
++  \file ifx_atm.h
++  \ingroup IFX_ATM
++  \brief ATM driver header file
++ */
++
++
++
++/*
++ * ####################################
++ *              Definition
++ * ####################################
++ */
++
++/*!
++  \addtogroup IFX_ATM_STRUCT
++ */
++/*@{*/
++
++/*
++ *  ATM MIB
++ */
++
++/*!
++  \struct atm_cell_ifEntry_t
++  \brief Structure used for Cell Level MIB Counters.
++
++  User application use this structure to call IOCTL command "PPE_ATM_MIB_CELL".
++ */
++typedef struct {
++	__u32	ifHCInOctets_h;     /*!< byte counter of ingress cells (upper 32 bits, total 64 bits)   */
++	__u32	ifHCInOctets_l;     /*!< byte counter of ingress cells (lower 32 bits, total 64 bits)   */
++	__u32	ifHCOutOctets_h;    /*!< byte counter of egress cells (upper 32 bits, total 64 bits)    */
++	__u32	ifHCOutOctets_l;    /*!< byte counter of egress cells (lower 32 bits, total 64 bits)    */
++	__u32	ifInErrors;         /*!< counter of error ingress cells     */
++	__u32	ifInUnknownProtos;  /*!< counter of unknown ingress cells   */
++	__u32	ifOutErrors;        /*!< counter of error egress cells      */
++} atm_cell_ifEntry_t;
++
++/*!
++  \struct atm_aal5_ifEntry_t
++  \brief Structure used for AAL5 Frame Level MIB Counters.
++
++  User application use this structure to call IOCTL command "PPE_ATM_MIB_AAL5".
++ */
++typedef struct {
++	__u32	ifHCInOctets_h;     /*!< byte counter of ingress packets (upper 32 bits, total 64 bits) */
++	__u32	ifHCInOctets_l;     /*!< byte counter of ingress packets (lower 32 bits, total 64 bits) */
++	__u32	ifHCOutOctets_h;    /*!< byte counter of egress packets (upper 32 bits, total 64 bits)  */
++	__u32	ifHCOutOctets_l;    /*!< byte counter of egress packets (lower 32 bits, total 64 bits)  */
++	__u32	ifInUcastPkts;      /*!< counter of ingress packets         */
++	__u32	ifOutUcastPkts;     /*!< counter of egress packets          */
++	__u32	ifInErrors;         /*!< counter of error ingress packets   */
++	__u32	ifInDiscards;       /*!< counter of dropped ingress packets */
++	__u32	ifOutErros;         /*!< counter of error egress packets    */
++	__u32	ifOutDiscards;      /*!< counter of dropped egress packets  */
++} atm_aal5_ifEntry_t;
++
++/*!
++  \struct atm_aal5_vcc_t
++  \brief Structure used for per PVC AAL5 Frame Level MIB Counters.
++
++  This structure is a part of structure "atm_aal5_vcc_x_t".
++ */
++typedef struct {
++	__u32	aal5VccCrcErrors;       /*!< counter of ingress packets with CRC error  */
++	__u32	aal5VccSarTimeOuts;     /*!< counter of ingress packets with Re-assemble timeout    */  //no timer support yet
++	__u32	aal5VccOverSizedSDUs;   /*!< counter of oversized ingress packets       */
++} atm_aal5_vcc_t;
++
++/*!
++  \struct atm_aal5_vcc_x_t
++  \brief Structure used for per PVC AAL5 Frame Level MIB Counters.
++
++  User application use this structure to call IOCTL command "PPE_ATM_MIB_VCC".
++ */
++typedef struct {
++	int             vpi;        /*!< VPI of the VCC to get MIB counters */
++	int             vci;        /*!< VCI of the VCC to get MIB counters */
++	atm_aal5_vcc_t  mib_vcc;    /*!< structure to get MIB counters      */
++} atm_aal5_vcc_x_t;
++
++/*@}*/
++
++
++
++/*
++ * ####################################
++ *                IOCTL
++ * ####################################
++ */
++
++/*!
++  \addtogroup IFX_ATM_IOCTL
++ */
++/*@{*/
++
++/*
++ *  ioctl Command
++ */
++/*!
++  \brief ATM IOCTL Magic Number
++ */
++#define PPE_ATM_IOC_MAGIC       'o'
++/*!
++  \brief ATM IOCTL Command - Get Cell Level MIB Counters
++
++   This command is obsolete. User can get cell level MIB from DSL API.
++   This command uses structure "atm_cell_ifEntry_t" as parameter for output of MIB counters.
++ */
++#define PPE_ATM_MIB_CELL        _IOW(PPE_ATM_IOC_MAGIC,  0, atm_cell_ifEntry_t)
++/*!
++  \brief ATM IOCTL Command - Get AAL5 Level MIB Counters
++
++   Get AAL5 packet counters.
++   This command uses structure "atm_aal5_ifEntry_t" as parameter for output of MIB counters.
++ */
++#define PPE_ATM_MIB_AAL5        _IOW(PPE_ATM_IOC_MAGIC,  1, atm_aal5_ifEntry_t)
++/*!
++  \brief ATM IOCTL Command - Get Per PVC MIB Counters
++
++   Get AAL5 packet counters for each PVC.
++   This command uses structure "atm_aal5_vcc_x_t" as parameter for input of VPI/VCI information and output of MIB counters.
++ */
++#define PPE_ATM_MIB_VCC         _IOWR(PPE_ATM_IOC_MAGIC, 2, atm_aal5_vcc_x_t)
++/*!
++  \brief Total Number of ATM IOCTL Commands
++ */
++#define PPE_ATM_IOC_MAXNR       3
++
++/*@}*/
++
++
++
++/*
++ * ####################################
++ *                 API
++ * ####################################
++ */
++
++#ifdef __KERNEL__
++struct port_cell_info {
++    unsigned int    port_num;
++    unsigned int    tx_link_rate[2];
++};
++#endif
++
++
++
++#endif  //  IFX_ATM_H
++
+--- /dev/null
++++ b/arch/mips/include/asm/mach-lantiq/lantiq_ptm.h
+@@ -0,0 +1,203 @@
++/******************************************************************************
++**
++** FILE NAME    : ifx_ptm.h
++** PROJECT      : UEIP
++** MODULES      : PTM
++**
++** DATE         : 17 Jun 2009
++** AUTHOR       : Xu Liang
++** DESCRIPTION  : Global PTM driver header file
++** COPYRIGHT    :       Copyright (c) 2006
++**                      Infineon Technologies AG
++**                      Am Campeon 1-12, 85579 Neubiberg, Germany
++**
++**    This program is free software; you can redistribute it and/or modify
++**    it under the terms of the GNU General Public License as published by
++**    the Free Software Foundation; either version 2 of the License, or
++**    (at your option) any later version.
++**
++** HISTORY
++** $Date        $Author         $Comment
++** 07 JUL 2009  Xu Liang        Init Version
++*******************************************************************************/
++
++#ifndef IFX_PTM_H
++#define IFX_PTM_H
++
++
++
++/*!
++  \defgroup IFX_PTM UEIP Project - PTM driver module
++  \brief UEIP Project - PTM driver module, support Danube, Amazon-SE, AR9, VR9.
++ */
++
++/*!
++  \defgroup IFX_PTM_IOCTL IOCTL Commands
++  \ingroup IFX_PTM
++  \brief IOCTL Commands used by user application.
++ */
++
++/*!
++  \defgroup IFX_PTM_STRUCT Structures
++  \ingroup IFX_PTM
++  \brief Structures used by user application.
++ */
++
++/*!
++  \file ifx_ptm.h
++  \ingroup IFX_PTM
++  \brief PTM driver header file
++ */
++
++
++
++/*
++ * ####################################
++ *              Definition
++ * ####################################
++ */
++
++
++
++/*
++ * ####################################
++ *                IOCTL
++ * ####################################
++ */
++
++/*!
++  \addtogroup IFX_PTM_IOCTL
++ */
++/*@{*/
++
++/*
++ *  ioctl Command
++ */
++/*!
++  \brief PTM IOCTL Command - Get codeword MIB counters.
++
++  This command uses structure "PTM_CW_IF_ENTRY_T" to get codeword level MIB counters.
++ */
++#define IFX_PTM_MIB_CW_GET              SIOCDEVPRIVATE + 1
++/*!
++  \brief PTM IOCTL Command - Get packet MIB counters.
++
++  This command uses structure "PTM_FRAME_MIB_T" to get packet level MIB counters.
++ */
++#define IFX_PTM_MIB_FRAME_GET           SIOCDEVPRIVATE + 2
++/*!
++  \brief PTM IOCTL Command - Get firmware configuration (CRC).
++
++  This command uses structure "IFX_PTM_CFG_T" to get firmware configuration (CRC).
++ */
++#define IFX_PTM_CFG_GET                 SIOCDEVPRIVATE + 3
++/*!
++  \brief PTM IOCTL Command - Set firmware configuration (CRC).
++
++  This command uses structure "IFX_PTM_CFG_T" to set firmware configuration (CRC).
++ */
++#define IFX_PTM_CFG_SET                 SIOCDEVPRIVATE + 4
++/*!
++  \brief PTM IOCTL Command - Program priority value to TX queue mapping.
++
++  This command uses structure "IFX_PTM_PRIO_Q_MAP_T" to program priority value to TX queue mapping.
++ */
++#define IFX_PTM_MAP_PKT_PRIO_TO_Q       SIOCDEVPRIVATE + 14
++
++/*@}*/
++
++
++/*!
++  \addtogroup IFX_PTM_STRUCT
++ */
++/*@{*/
++
++/*
++ *  ioctl Data Type
++ */
++
++/*!
++  \typedef PTM_CW_IF_ENTRY_T
++  \brief Wrapping of structure "ptm_cw_ifEntry_t".
++ */
++/*!
++  \struct ptm_cw_ifEntry_t
++  \brief Structure used for CodeWord level MIB counters.
++ */
++typedef struct ptm_cw_ifEntry_t {
++    uint32_t    ifRxNoIdleCodewords;    /*!< output, number of ingress user codeword */
++    uint32_t    ifRxIdleCodewords;      /*!< output, number of ingress idle codeword */
++    uint32_t    ifRxCodingViolation;    /*!< output, number of error ingress codeword */
++    uint32_t    ifTxNoIdleCodewords;    /*!< output, number of egress user codeword */
++    uint32_t    ifTxIdleCodewords;      /*!< output, number of egress idle codeword */
++} PTM_CW_IF_ENTRY_T;
++
++/*!
++  \typedef PTM_FRAME_MIB_T
++  \brief Wrapping of structure "ptm_frame_mib_t".
++ */
++/*!
++  \struct ptm_frame_mib_t
++  \brief Structure used for packet level MIB counters.
++ */
++typedef struct ptm_frame_mib_t {
++    uint32_t    RxCorrect;      /*!< output, number of ingress packet */
++    uint32_t    TC_CrcError;    /*!< output, number of egress packet with CRC error */
++    uint32_t    RxDropped;      /*!< output, number of dropped ingress packet */
++    uint32_t    TxSend;         /*!< output, number of egress packet */
++} PTM_FRAME_MIB_T;
++
++/*!
++  \typedef IFX_PTM_CFG_T
++  \brief Wrapping of structure "ptm_cfg_t".
++ */
++/*!
++  \struct ptm_cfg_t
++  \brief Structure used for ETH/TC CRC configuration.
++ */
++typedef struct ptm_cfg_t {
++    uint32_t    RxEthCrcPresent;    /*!< input/output, ingress packet has ETH CRC */
++    uint32_t    RxEthCrcCheck;      /*!< input/output, check ETH CRC of ingress packet */
++    uint32_t    RxTcCrcCheck;       /*!< input/output, check TC CRC of ingress codeword */
++    uint32_t    RxTcCrcLen;         /*!< input/output, length of TC CRC of ingress codeword */
++    uint32_t    TxEthCrcGen;        /*!< input/output, generate ETH CRC for egress packet */
++    uint32_t    TxTcCrcGen;         /*!< input/output, generate TC CRC for egress codeword */
++    uint32_t    TxTcCrcLen;         /*!< input/output, length of TC CRC of egress codeword */
++} IFX_PTM_CFG_T;
++
++/*!
++  \typedef IFX_PTM_PRIO_Q_MAP_T
++  \brief Wrapping of structure "ppe_prio_q_map".
++ */
++/*!
++  \struct ppe_prio_q_map
++  \brief Structure used for Priority Value to TX Queue mapping.
++ */
++typedef struct ppe_prio_q_map {
++    int             pkt_prio;
++    int             qid;
++    int             vpi;    //  ignored in eth interface
++    int             vci;    //  ignored in eth interface
++} IFX_PTM_PRIO_Q_MAP_T;
++
++/*@}*/
++
++
++
++/*
++ * ####################################
++ *                 API
++ * ####################################
++ */
++
++#ifdef __KERNEL__
++struct port_cell_info {
++    unsigned int    port_num;
++    unsigned int    tx_link_rate[2];
++};
++#endif
++
++
++
++#endif  //  IFX_PTM_H
++
+--- a/arch/mips/lantiq/irq.c
++++ b/arch/mips/lantiq/irq.c
+@@ -13,6 +13,7 @@
+ #include <linux/of_platform.h>
+ #include <linux/of_address.h>
+ #include <linux/of_irq.h>
++#include <linux/module.h>
+ 
+ #include <asm/bootinfo.h>
+ #include <asm/irq_cpu.h>
+@@ -92,6 +93,7 @@ void ltq_disable_irq(struct irq_data *d)
+ 	}
+ 	raw_spin_unlock_irqrestore(&ltq_icu_lock, flags);
+ }
++EXPORT_SYMBOL(ltq_mask_and_ack_irq);
+ 
+ void ltq_mask_and_ack_irq(struct irq_data *d)
+ {
+--- a/arch/mips/mm/cache.c
++++ b/arch/mips/mm/cache.c
+@@ -63,6 +63,10 @@ void (*_dma_cache_wback_inv)(unsigned lo
+ void (*_dma_cache_wback)(unsigned long start, unsigned long size);
+ void (*_dma_cache_inv)(unsigned long start, unsigned long size);
+ 
++EXPORT_SYMBOL(_dma_cache_wback_inv);
++EXPORT_SYMBOL(_dma_cache_wback);
++EXPORT_SYMBOL(_dma_cache_inv);
++
+ #endif /* CONFIG_DMA_NONCOHERENT */
+ 
+ /*
+--- a/include/uapi/linux/atm.h
++++ b/include/uapi/linux/atm.h
+@@ -131,8 +131,14 @@
+ #define ATM_ABR		4
+ #define ATM_ANYCLASS	5		/* compatible with everything */
+ 
++#define ATM_VBR_NRT     ATM_VBR
++#define ATM_VBR_RT      6
++#define ATM_UBR_PLUS    7
++#define ATM_GFR         8
++
+ #define ATM_MAX_PCR	-1		/* maximum available PCR */
+ 
++
+ struct atm_trafprm {
+ 	unsigned char	traffic_class;	/* traffic class (ATM_UBR, ...) */
+ 	int		max_pcr;	/* maximum PCR in cells per second */
+--- a/net/atm/proc.c
++++ b/net/atm/proc.c
+@@ -141,7 +141,7 @@ static void *vcc_seq_next(struct seq_fil
+ static void pvc_info(struct seq_file *seq, struct atm_vcc *vcc)
+ {
+ 	static const char *const class_name[] = {
+-		"off", "UBR", "CBR", "VBR", "ABR"};
++		"off","UBR","CBR","NTR-VBR","ABR","ANY","RT-VBR","UBR+","GFR"};
+ 	static const char *const aal_name[] = {
+ 		"---",	"1",	"2",	"3/4",	/*  0- 3 */
+ 		"???",	"5",	"???",	"???",	/*  4- 7 */
diff --git a/target/linux/lantiq/patches-5.15/0008-MIPS-lantiq-backport-old-timer-code.patch b/target/linux/lantiq/patches-5.15/0008-MIPS-lantiq-backport-old-timer-code.patch
new file mode 100644
index 00000000000000..16b87ed0a5cfc6
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0008-MIPS-lantiq-backport-old-timer-code.patch
@@ -0,0 +1,1041 @@
+From 94800350cb8d2f29dda2206b5e9a3772024ee168 Mon Sep 17 00:00:00 2001
+From: John Crispin <blogic@openwrt.org>
+Date: Thu, 7 Aug 2014 18:30:56 +0200
+Subject: [PATCH 08/36] MIPS: lantiq: backport old timer code
+
+Signed-off-by: John Crispin <blogic@openwrt.org>
+---
+ arch/mips/include/asm/mach-lantiq/lantiq_timer.h |  155 ++++
+ arch/mips/lantiq/xway/Makefile                   |    2 +-
+ arch/mips/lantiq/xway/timer.c                    |  845 ++++++++++++++++++++++
+ 3 files changed, 1001 insertions(+), 1 deletion(-)
+ create mode 100644 arch/mips/include/asm/mach-lantiq/lantiq_timer.h
+ create mode 100644 arch/mips/lantiq/xway/timer.c
+
+--- /dev/null
++++ b/arch/mips/include/asm/mach-lantiq/lantiq_timer.h
+@@ -0,0 +1,155 @@
++#ifndef __DANUBE_GPTU_DEV_H__2005_07_26__10_19__
++#define __DANUBE_GPTU_DEV_H__2005_07_26__10_19__
++
++
++/******************************************************************************
++       Copyright (c) 2002, Infineon Technologies.  All rights reserved.
++
++                               No Warranty
++   Because the program is licensed free of charge, there is no warranty for
++   the program, to the extent permitted by applicable law.  Except when
++   otherwise stated in writing the copyright holders and/or other parties
++   provide the program "as is" without warranty of any kind, either
++   expressed or implied, including, but not limited to, the implied
++   warranties of merchantability and fitness for a particular purpose. The
++   entire risk as to the quality and performance of the program is with
++   you.  should the program prove defective, you assume the cost of all
++   necessary servicing, repair or correction.
++
++   In no event unless required by applicable law or agreed to in writing
++   will any copyright holder, or any other party who may modify and/or
++   redistribute the program as permitted above, be liable to you for
++   damages, including any general, special, incidental or consequential
++   damages arising out of the use or inability to use the program
++   (including but not limited to loss of data or data being rendered
++   inaccurate or losses sustained by you or third parties or a failure of
++   the program to operate with any other programs), even if such holder or
++   other party has been advised of the possibility of such damages.
++******************************************************************************/
++
++
++/*
++ * ####################################
++ *              Definition
++ * ####################################
++ */
++
++/*
++ *  Available Timer/Counter Index
++ */
++#define TIMER(n, X)                     (n * 2 + (X ? 1 : 0))
++#define TIMER_ANY                       0x00
++#define TIMER1A                         TIMER(1, 0)
++#define TIMER1B                         TIMER(1, 1)
++#define TIMER2A                         TIMER(2, 0)
++#define TIMER2B                         TIMER(2, 1)
++#define TIMER3A                         TIMER(3, 0)
++#define TIMER3B                         TIMER(3, 1)
++
++/*
++ *  Flag of Timer/Counter
++ *  These flags specify the way in which timer is configured.
++ */
++/*  Bit size of timer/counter.                      */
++#define TIMER_FLAG_16BIT                0x0000
++#define TIMER_FLAG_32BIT                0x0001
++/*  Switch between timer and counter.               */
++#define TIMER_FLAG_TIMER                0x0000
++#define TIMER_FLAG_COUNTER              0x0002
++/*  Stop or continue when overflowing/underflowing. */
++#define TIMER_FLAG_ONCE                 0x0000
++#define TIMER_FLAG_CYCLIC               0x0004
++/*  Count up or counter down.                       */
++#define TIMER_FLAG_UP                   0x0000
++#define TIMER_FLAG_DOWN                 0x0008
++/*  Count on specific level or edge.                */
++#define TIMER_FLAG_HIGH_LEVEL_SENSITIVE 0x0000
++#define TIMER_FLAG_LOW_LEVEL_SENSITIVE  0x0040
++#define TIMER_FLAG_RISE_EDGE            0x0010
++#define TIMER_FLAG_FALL_EDGE            0x0020
++#define TIMER_FLAG_ANY_EDGE             0x0030
++/*  Signal is syncronous to module clock or not.    */
++#define TIMER_FLAG_UNSYNC               0x0000
++#define TIMER_FLAG_SYNC                 0x0080
++/*  Different interrupt handle type.                */
++#define TIMER_FLAG_NO_HANDLE            0x0000
++#if defined(__KERNEL__)
++    #define TIMER_FLAG_CALLBACK_IN_IRQ  0x0100
++#endif  //  defined(__KERNEL__)
++#define TIMER_FLAG_SIGNAL               0x0300
++/*  Internal clock source or external clock source  */
++#define TIMER_FLAG_INT_SRC              0x0000
++#define TIMER_FLAG_EXT_SRC              0x1000
++
++
++/*
++ *  ioctl Command
++ */
++#define GPTU_REQUEST_TIMER              0x01    /*  General method to setup timer/counter.  */
++#define GPTU_FREE_TIMER                 0x02    /*  Free timer/counter.                     */
++#define GPTU_START_TIMER                0x03    /*  Start or resume timer/counter.          */
++#define GPTU_STOP_TIMER                 0x04    /*  Suspend timer/counter.                  */
++#define GPTU_GET_COUNT_VALUE            0x05    /*  Get current count value.                */
++#define GPTU_CALCULATE_DIVIDER          0x06    /*  Calculate timer divider from given freq.*/
++#define GPTU_SET_TIMER                  0x07    /*  Simplified method to setup timer.       */
++#define GPTU_SET_COUNTER                0x08    /*  Simplified method to setup counter.     */
++
++/*
++ *  Data Type Used to Call ioctl
++ */
++struct gptu_ioctl_param {
++    unsigned int                        timer;  /*  In command GPTU_REQUEST_TIMER, GPTU_SET_TIMER, and  *
++                                                 *  GPTU_SET_COUNTER, this field is ID of expected      *
++                                                 *  timer/counter. If it's zero, a timer/counter would  *
++                                                 *  be dynamically allocated and ID would be stored in  *
++                                                 *  this field.                                         *
++                                                 *  In command GPTU_GET_COUNT_VALUE, this field is      *
++                                                 *  ignored.                                            *
++                                                 *  In other command, this field is ID of timer/counter *
++                                                 *  allocated.                                          */
++    unsigned int                        flag;   /*  In command GPTU_REQUEST_TIMER, GPTU_SET_TIMER, and  *
++                                                 *  GPTU_SET_COUNTER, this field contains flags to      *
++                                                 *  specify how to configure timer/counter.             *
++                                                 *  In command GPTU_START_TIMER, zero indicate start    *
++                                                 *  and non-zero indicate resume timer/counter.         *
++                                                 *  In other command, this field is ignored.            */
++    unsigned long                       value;  /*  In command GPTU_REQUEST_TIMER, this field contains  *
++                                                 *  init/reload value.                                  *
++                                                 *  In command GPTU_SET_TIMER, this field contains      *
++                                                 *  frequency (0.001Hz) of timer.                       *
++                                                 *  In command GPTU_GET_COUNT_VALUE, current count      *
++                                                 *  value would be stored in this field.                *
++                                                 *  In command GPTU_CALCULATE_DIVIDER, this field       *
++                                                 *  contains frequency wanted, and after calculation,   *
++                                                 *  divider would be stored in this field to overwrite  *
++                                                 *  the frequency.                                      *
++                                                 *  In other command, this field is ignored.            */
++    int                                 pid;    /*  In command GPTU_REQUEST_TIMER and GPTU_SET_TIMER,   *
++                                                 *  if signal is required, this field contains process  *
++                                                 *  ID to which signal would be sent.                   *
++                                                 *  In other command, this field is ignored.            */
++    int                                 sig;    /*  In command GPTU_REQUEST_TIMER and GPTU_SET_TIMER,   *
++                                                 *  if signal is required, this field contains signal   *
++                                                 *  number which would be sent.                         *
++                                                 *  In other command, this field is ignored.            */
++};
++
++/*
++ * ####################################
++ *              Data Type
++ * ####################################
++ */
++typedef void (*timer_callback)(unsigned long arg);
++
++extern int lq_request_timer(unsigned int, unsigned int, unsigned long, unsigned long, unsigned long);
++extern int lq_free_timer(unsigned int);
++extern int lq_start_timer(unsigned int, int);
++extern int lq_stop_timer(unsigned int);
++extern int lq_reset_counter_flags(u32 timer, u32 flags);
++extern int lq_get_count_value(unsigned int, unsigned long *);
++extern u32 lq_cal_divider(unsigned long);
++extern int lq_set_timer(unsigned int, unsigned int, int, int, unsigned int, unsigned long, unsigned long);
++extern int lq_set_counter(unsigned int timer, unsigned int flag,
++	u32 reload, unsigned long arg1, unsigned long arg2);
++
++#endif /* __DANUBE_GPTU_DEV_H__2005_07_26__10_19__ */
+--- a/arch/mips/lantiq/xway/Makefile
++++ b/arch/mips/lantiq/xway/Makefile
+@@ -1,4 +1,10 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+-obj-y := prom.o sysctrl.o clk.o dma.o gptu.o dcdc.o
++obj-y := prom.o sysctrl.o clk.o dma.o dcdc.o
++
++ifdef CONFIG_SOC_AMAZON_SE
++obj-y += gptu.o
++else
++obj-y += timer.o
++endif
+ 
+ obj-y += vmmc.o
+--- /dev/null
++++ b/arch/mips/lantiq/xway/timer.c
+@@ -0,0 +1,852 @@
++#ifndef CONFIG_SOC_AMAZON_SE
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/version.h>
++#include <linux/types.h>
++#include <linux/fs.h>
++#include <linux/miscdevice.h>
++#include <linux/init.h>
++#include <linux/uaccess.h>
++#include <linux/unistd.h>
++#include <linux/errno.h>
++#include <linux/interrupt.h>
++#include <linux/sched.h>
++#include <linux/sched/signal.h>
++
++#include <asm/irq.h>
++#include <asm/div64.h>
++#include "../clk.h"
++
++#include <lantiq_soc.h>
++#include <lantiq_irq.h>
++#include <lantiq_timer.h>
++
++#define MAX_NUM_OF_32BIT_TIMER_BLOCKS	6
++
++#ifdef TIMER1A
++#define FIRST_TIMER			TIMER1A
++#else
++#define FIRST_TIMER			2
++#endif
++
++/*
++ *  GPTC divider is set or not.
++ */
++#define GPTU_CLC_RMC_IS_SET		0
++
++/*
++ *  Timer Interrupt (IRQ)
++ */
++/*  Must be adjusted when ICU driver is available */
++#define TIMER_INTERRUPT			(INT_NUM_IM3_IRL0 + 22)
++
++/*
++ *  Bits Operation
++ */
++#define GET_BITS(x, msb, lsb)		\
++	(((x) & ((1 << ((msb) + 1)) - 1)) >> (lsb))
++#define SET_BITS(x, msb, lsb, value)	\
++	(((x) & ~(((1 << ((msb) + 1)) - 1) ^ ((1 << (lsb)) - 1))) | \
++	(((value) & ((1 << (1 + (msb) - (lsb))) - 1)) << (lsb)))
++
++/*
++ *  GPTU Register Mapping
++ */
++#define LQ_GPTU			(KSEG1 + 0x1E100A00)
++#define LQ_GPTU_CLC		((volatile u32 *)(LQ_GPTU + 0x0000))
++#define LQ_GPTU_ID			((volatile u32 *)(LQ_GPTU + 0x0008))
++#define LQ_GPTU_CON(n, X)		((volatile u32 *)(LQ_GPTU + 0x0010 + ((X) * 4) + ((n) - 1) * 0x0020))	/* X must be either A or B */
++#define LQ_GPTU_RUN(n, X)		((volatile u32 *)(LQ_GPTU + 0x0018 + ((X) * 4) + ((n) - 1) * 0x0020))	/* X must be either A or B */
++#define LQ_GPTU_RELOAD(n, X)	((volatile u32 *)(LQ_GPTU + 0x0020 + ((X) * 4) + ((n) - 1) * 0x0020))	/* X must be either A or B */
++#define LQ_GPTU_COUNT(n, X)	((volatile u32 *)(LQ_GPTU + 0x0028 + ((X) * 4) + ((n) - 1) * 0x0020))	/* X must be either A or B */
++#define LQ_GPTU_IRNEN		((volatile u32 *)(LQ_GPTU + 0x00F4))
++#define LQ_GPTU_IRNICR		((volatile u32 *)(LQ_GPTU + 0x00F8))
++#define LQ_GPTU_IRNCR		((volatile u32 *)(LQ_GPTU + 0x00FC))
++
++/*
++ *  Clock Control Register
++ */
++#define GPTU_CLC_SMC			GET_BITS(*LQ_GPTU_CLC, 23, 16)
++#define GPTU_CLC_RMC			GET_BITS(*LQ_GPTU_CLC, 15, 8)
++#define GPTU_CLC_FSOE			(*LQ_GPTU_CLC & (1 << 5))
++#define GPTU_CLC_EDIS			(*LQ_GPTU_CLC & (1 << 3))
++#define GPTU_CLC_SPEN			(*LQ_GPTU_CLC & (1 << 2))
++#define GPTU_CLC_DISS			(*LQ_GPTU_CLC & (1 << 1))
++#define GPTU_CLC_DISR			(*LQ_GPTU_CLC & (1 << 0))
++
++#define GPTU_CLC_SMC_SET(value)		SET_BITS(0, 23, 16, (value))
++#define GPTU_CLC_RMC_SET(value)		SET_BITS(0, 15, 8, (value))
++#define GPTU_CLC_FSOE_SET(value)	((value) ? (1 << 5) : 0)
++#define GPTU_CLC_SBWE_SET(value)	((value) ? (1 << 4) : 0)
++#define GPTU_CLC_EDIS_SET(value)	((value) ? (1 << 3) : 0)
++#define GPTU_CLC_SPEN_SET(value)	((value) ? (1 << 2) : 0)
++#define GPTU_CLC_DISR_SET(value)	((value) ? (1 << 0) : 0)
++
++/*
++ *  ID Register
++ */
++#define GPTU_ID_ID			GET_BITS(*LQ_GPTU_ID, 15, 8)
++#define GPTU_ID_CFG			GET_BITS(*LQ_GPTU_ID, 7, 5)
++#define GPTU_ID_REV			GET_BITS(*LQ_GPTU_ID, 4, 0)
++
++/*
++ *  Control Register of Timer/Counter nX
++ *    n is the index of block (1 based index)
++ *    X is either A or B
++ */
++#define GPTU_CON_SRC_EG(n, X)		(*LQ_GPTU_CON(n, X) & (1 << 10))
++#define GPTU_CON_SRC_EXT(n, X)		(*LQ_GPTU_CON(n, X) & (1 << 9))
++#define GPTU_CON_SYNC(n, X)		(*LQ_GPTU_CON(n, X) & (1 << 8))
++#define GPTU_CON_EDGE(n, X)		GET_BITS(*LQ_GPTU_CON(n, X), 7, 6)
++#define GPTU_CON_INV(n, X)		(*LQ_GPTU_CON(n, X) & (1 << 5))
++#define GPTU_CON_EXT(n, X)		(*LQ_GPTU_CON(n, A) & (1 << 4))	/* Timer/Counter B does not have this bit */
++#define GPTU_CON_STP(n, X)		(*LQ_GPTU_CON(n, X) & (1 << 3))
++#define GPTU_CON_CNT(n, X)		(*LQ_GPTU_CON(n, X) & (1 << 2))
++#define GPTU_CON_DIR(n, X)		(*LQ_GPTU_CON(n, X) & (1 << 1))
++#define GPTU_CON_EN(n, X)		(*LQ_GPTU_CON(n, X) & (1 << 0))
++
++#define GPTU_CON_SRC_EG_SET(value)	((value) ? 0 : (1 << 10))
++#define GPTU_CON_SRC_EXT_SET(value)	((value) ? (1 << 9) : 0)
++#define GPTU_CON_SYNC_SET(value)	((value) ? (1 << 8) : 0)
++#define GPTU_CON_EDGE_SET(value)	SET_BITS(0, 7, 6, (value))
++#define GPTU_CON_INV_SET(value)		((value) ? (1 << 5) : 0)
++#define GPTU_CON_EXT_SET(value)		((value) ? (1 << 4) : 0)
++#define GPTU_CON_STP_SET(value)		((value) ? (1 << 3) : 0)
++#define GPTU_CON_CNT_SET(value)		((value) ? (1 << 2) : 0)
++#define GPTU_CON_DIR_SET(value)		((value) ? (1 << 1) : 0)
++
++#define GPTU_RUN_RL_SET(value)		((value) ? (1 << 2) : 0)
++#define GPTU_RUN_CEN_SET(value)		((value) ? (1 << 1) : 0)
++#define GPTU_RUN_SEN_SET(value)		((value) ? (1 << 0) : 0)
++
++#define GPTU_IRNEN_TC_SET(n, X, value)	((value) ? (1 << (((n) - 1) * 2 + (X))) : 0)
++#define GPTU_IRNCR_TC_SET(n, X, value)	((value) ? (1 << (((n) - 1) * 2 + (X))) : 0)
++
++#define TIMER_FLAG_MASK_SIZE(x)		(x & 0x0001)
++#define TIMER_FLAG_MASK_TYPE(x)		(x & 0x0002)
++#define TIMER_FLAG_MASK_STOP(x)		(x & 0x0004)
++#define TIMER_FLAG_MASK_DIR(x)		(x & 0x0008)
++#define TIMER_FLAG_NONE_EDGE		0x0000
++#define TIMER_FLAG_MASK_EDGE(x)		(x & 0x0030)
++#define TIMER_FLAG_REAL			0x0000
++#define TIMER_FLAG_INVERT		0x0040
++#define TIMER_FLAG_MASK_INVERT(x)	(x & 0x0040)
++#define TIMER_FLAG_MASK_TRIGGER(x)	(x & 0x0070)
++#define TIMER_FLAG_MASK_SYNC(x)		(x & 0x0080)
++#define TIMER_FLAG_CALLBACK_IN_HB	0x0200
++#define TIMER_FLAG_MASK_HANDLE(x)	(x & 0x0300)
++#define TIMER_FLAG_MASK_SRC(x)		(x & 0x1000)
++
++struct timer_dev_timer {
++	unsigned int f_irq_on;
++	unsigned int irq;
++	unsigned int flag;
++	unsigned long arg1;
++	unsigned long arg2;
++};
++
++struct timer_dev {
++	struct mutex gptu_mutex;
++	unsigned int number_of_timers;
++	unsigned int occupation;
++	unsigned int f_gptu_on;
++	struct timer_dev_timer timer[MAX_NUM_OF_32BIT_TIMER_BLOCKS * 2];
++};
++
++
++unsigned int ltq_get_fpi_bus_clock(int fpi) {
++	struct clk *clk = clk_get_fpi();
++	return clk_get_rate(clk);
++}
++
++
++static long gptu_ioctl(struct file *, unsigned int, unsigned long);
++static int gptu_open(struct inode *, struct file *);
++static int gptu_release(struct inode *, struct file *);
++
++static struct file_operations gptu_fops = {
++	.owner = THIS_MODULE,
++	.unlocked_ioctl = gptu_ioctl,
++	.open = gptu_open,
++	.release = gptu_release
++};
++
++static struct miscdevice gptu_miscdev = {
++	.minor = MISC_DYNAMIC_MINOR,
++	.name = "gptu",
++	.fops = &gptu_fops,
++};
++
++static struct timer_dev timer_dev;
++
++static irqreturn_t timer_irq_handler(int irq, void *p)
++{
++	unsigned int timer;
++	unsigned int flag;
++	struct timer_dev_timer *dev_timer = (struct timer_dev_timer *)p;
++
++	timer = irq - TIMER_INTERRUPT;
++	if (timer < timer_dev.number_of_timers
++		&& dev_timer == &timer_dev.timer[timer]) {
++		/*  Clear interrupt.    */
++		ltq_w32(1 << timer, LQ_GPTU_IRNCR);
++
++		/*  Call user hanler or signal. */
++		flag = dev_timer->flag;
++		if (!(timer & 0x01)
++			|| TIMER_FLAG_MASK_SIZE(flag) == TIMER_FLAG_16BIT) {
++			/* 16-bit timer or timer A of 32-bit timer  */
++			switch (TIMER_FLAG_MASK_HANDLE(flag)) {
++			case TIMER_FLAG_CALLBACK_IN_IRQ:
++			case TIMER_FLAG_CALLBACK_IN_HB:
++				if (dev_timer->arg1)
++					(*(timer_callback)dev_timer->arg1)(dev_timer->arg2);
++				break;
++			case TIMER_FLAG_SIGNAL:
++				send_sig((int)dev_timer->arg2, (struct task_struct *)dev_timer->arg1, 0);
++				break;
++			}
++		}
++	}
++	return IRQ_HANDLED;
++}
++
++static inline void lq_enable_gptu(void)
++{
++	struct clk *clk = clk_get_sys("1e100a00.gptu", NULL);
++	clk_enable(clk);
++
++	//ltq_pmu_enable(PMU_GPT);
++
++	/*  Set divider as 1, disable write protection for SPEN, enable module. */
++	*LQ_GPTU_CLC =
++		GPTU_CLC_SMC_SET(0x00) |
++		GPTU_CLC_RMC_SET(0x01) |
++		GPTU_CLC_FSOE_SET(0) |
++		GPTU_CLC_SBWE_SET(1) |
++		GPTU_CLC_EDIS_SET(0) |
++		GPTU_CLC_SPEN_SET(0) |
++		GPTU_CLC_DISR_SET(0);
++}
++
++static inline void lq_disable_gptu(void)
++{
++	struct clk *clk = clk_get_sys("1e100a00.gptu", NULL);
++	ltq_w32(0x00, LQ_GPTU_IRNEN);
++	ltq_w32(0xfff, LQ_GPTU_IRNCR);
++
++	/*  Set divider as 0, enable write protection for SPEN, disable module. */
++	*LQ_GPTU_CLC =
++		GPTU_CLC_SMC_SET(0x00) |
++		GPTU_CLC_RMC_SET(0x00) |
++		GPTU_CLC_FSOE_SET(0) |
++		GPTU_CLC_SBWE_SET(0) |
++		GPTU_CLC_EDIS_SET(0) |
++		GPTU_CLC_SPEN_SET(0) |
++		GPTU_CLC_DISR_SET(1);
++
++	clk_enable(clk);
++}
++
++int lq_request_timer(unsigned int timer, unsigned int flag,
++	unsigned long value, unsigned long arg1, unsigned long arg2)
++{
++	int ret = 0;
++	unsigned int con_reg, irnen_reg;
++	int n, X;
++
++	if (timer >= FIRST_TIMER + timer_dev.number_of_timers)
++		return -EINVAL;
++
++	printk(KERN_INFO "request_timer(%d, 0x%08X, %lu)...",
++		timer, flag, value);
++
++	if (TIMER_FLAG_MASK_SIZE(flag) == TIMER_FLAG_16BIT)
++		value &= 0xFFFF;
++	else
++		timer &= ~0x01;
++
++	mutex_lock(&timer_dev.gptu_mutex);
++
++	/*
++	 *  Allocate timer.
++	 */
++	if (timer < FIRST_TIMER) {
++		unsigned int mask;
++		unsigned int shift;
++		/* This takes care of TIMER1B which is the only choice for Voice TAPI system */
++		unsigned int offset = TIMER2A;
++
++		/*
++		 *  Pick up a free timer.
++		 */
++		if (TIMER_FLAG_MASK_SIZE(flag) == TIMER_FLAG_16BIT) {
++			mask = 1 << offset;
++			shift = 1;
++		} else {
++			mask = 3 << offset;
++			shift = 2;
++		}
++		for (timer = offset;
++		     timer < offset + timer_dev.number_of_timers;
++		     timer += shift, mask <<= shift)
++			if (!(timer_dev.occupation & mask)) {
++				timer_dev.occupation |= mask;
++				break;
++			}
++		if (timer >= offset + timer_dev.number_of_timers) {
++			printk("failed![%d]\n", __LINE__);
++			mutex_unlock(&timer_dev.gptu_mutex);
++			return -EINVAL;
++		} else
++			ret = timer;
++	} else {
++		register unsigned int mask;
++
++		/*
++		 *  Check if the requested timer is free.
++		 */
++		mask = (TIMER_FLAG_MASK_SIZE(flag) == TIMER_FLAG_16BIT ? 1 : 3) << timer;
++		if ((timer_dev.occupation & mask)) {
++			printk("failed![%d] mask %#x, timer_dev.occupation %#x\n",
++				__LINE__, mask, timer_dev.occupation);
++			mutex_unlock(&timer_dev.gptu_mutex);
++			return -EBUSY;
++		} else {
++			timer_dev.occupation |= mask;
++			ret = 0;
++		}
++	}
++
++	/*
++	 *  Prepare control register value.
++	 */
++	switch (TIMER_FLAG_MASK_EDGE(flag)) {
++	default:
++	case TIMER_FLAG_NONE_EDGE:
++		con_reg = GPTU_CON_EDGE_SET(0x00);
++		break;
++	case TIMER_FLAG_RISE_EDGE:
++		con_reg = GPTU_CON_EDGE_SET(0x01);
++		break;
++	case TIMER_FLAG_FALL_EDGE:
++		con_reg = GPTU_CON_EDGE_SET(0x02);
++		break;
++	case TIMER_FLAG_ANY_EDGE:
++		con_reg = GPTU_CON_EDGE_SET(0x03);
++		break;
++	}
++	if (TIMER_FLAG_MASK_TYPE(flag) == TIMER_FLAG_TIMER)
++		con_reg |=
++			TIMER_FLAG_MASK_SRC(flag) ==
++			TIMER_FLAG_EXT_SRC ? GPTU_CON_SRC_EXT_SET(1) :
++			GPTU_CON_SRC_EXT_SET(0);
++	else
++		con_reg |=
++			TIMER_FLAG_MASK_SRC(flag) ==
++			TIMER_FLAG_EXT_SRC ? GPTU_CON_SRC_EG_SET(1) :
++			GPTU_CON_SRC_EG_SET(0);
++	con_reg |=
++		TIMER_FLAG_MASK_SYNC(flag) ==
++		TIMER_FLAG_UNSYNC ? GPTU_CON_SYNC_SET(0) :
++		GPTU_CON_SYNC_SET(1);
++	con_reg |=
++		TIMER_FLAG_MASK_INVERT(flag) ==
++		TIMER_FLAG_REAL ? GPTU_CON_INV_SET(0) : GPTU_CON_INV_SET(1);
++	con_reg |=
++		TIMER_FLAG_MASK_SIZE(flag) ==
++		TIMER_FLAG_16BIT ? GPTU_CON_EXT_SET(0) :
++		GPTU_CON_EXT_SET(1);
++	con_reg |=
++		TIMER_FLAG_MASK_STOP(flag) ==
++		TIMER_FLAG_ONCE ? GPTU_CON_STP_SET(1) : GPTU_CON_STP_SET(0);
++	con_reg |=
++		TIMER_FLAG_MASK_TYPE(flag) ==
++		TIMER_FLAG_TIMER ? GPTU_CON_CNT_SET(0) :
++		GPTU_CON_CNT_SET(1);
++	con_reg |=
++		TIMER_FLAG_MASK_DIR(flag) ==
++		TIMER_FLAG_UP ? GPTU_CON_DIR_SET(1) : GPTU_CON_DIR_SET(0);
++
++	/*
++	 *  Fill up running data.
++	 */
++	timer_dev.timer[timer - FIRST_TIMER].flag = flag;
++	timer_dev.timer[timer - FIRST_TIMER].arg1 = arg1;
++	timer_dev.timer[timer - FIRST_TIMER].arg2 = arg2;
++	if (TIMER_FLAG_MASK_SIZE(flag) != TIMER_FLAG_16BIT)
++		timer_dev.timer[timer - FIRST_TIMER + 1].flag = flag;
++
++	/*
++	 *  Enable GPTU module.
++	 */
++	if (!timer_dev.f_gptu_on) {
++		lq_enable_gptu();
++		timer_dev.f_gptu_on = 1;
++	}
++
++	/*
++	 *  Enable IRQ.
++	 */
++	if (TIMER_FLAG_MASK_HANDLE(flag) != TIMER_FLAG_NO_HANDLE) {
++		if (TIMER_FLAG_MASK_HANDLE(flag) == TIMER_FLAG_SIGNAL)
++			timer_dev.timer[timer - FIRST_TIMER].arg1 =
++				(unsigned long) find_task_by_vpid((int) arg1);
++
++		irnen_reg = 1 << (timer - FIRST_TIMER);
++
++		if (TIMER_FLAG_MASK_HANDLE(flag) == TIMER_FLAG_SIGNAL
++		    || (TIMER_FLAG_MASK_HANDLE(flag) ==
++			TIMER_FLAG_CALLBACK_IN_IRQ
++			&& timer_dev.timer[timer - FIRST_TIMER].arg1)) {
++			enable_irq(timer_dev.timer[timer - FIRST_TIMER].irq);
++			timer_dev.timer[timer - FIRST_TIMER].f_irq_on = 1;
++		}
++	} else
++		irnen_reg = 0;
++
++	/*
++	 *  Write config register, reload value and enable interrupt.
++	 */
++	n = timer >> 1;
++	X = timer & 0x01;
++	*LQ_GPTU_CON(n, X) = con_reg;
++	*LQ_GPTU_RELOAD(n, X) = value;
++	/* printk("reload value = %d\n", (u32)value); */
++	*LQ_GPTU_IRNEN |= irnen_reg;
++
++	mutex_unlock(&timer_dev.gptu_mutex);
++	printk("successful!\n");
++	return ret;
++}
++EXPORT_SYMBOL(lq_request_timer);
++
++int lq_free_timer(unsigned int timer)
++{
++	unsigned int flag;
++	unsigned int mask;
++	int n, X;
++
++	if (!timer_dev.f_gptu_on)
++		return -EINVAL;
++
++	if (timer < FIRST_TIMER || timer >= FIRST_TIMER + timer_dev.number_of_timers)
++		return -EINVAL;
++
++	mutex_lock(&timer_dev.gptu_mutex);
++
++	flag = timer_dev.timer[timer - FIRST_TIMER].flag;
++	if (TIMER_FLAG_MASK_SIZE(flag) != TIMER_FLAG_16BIT)
++		timer &= ~0x01;
++
++	mask = (TIMER_FLAG_MASK_SIZE(flag) == TIMER_FLAG_16BIT ? 1 : 3) << timer;
++	if (((timer_dev.occupation & mask) ^ mask)) {
++		mutex_unlock(&timer_dev.gptu_mutex);
++		return -EINVAL;
++	}
++
++	n = timer >> 1;
++	X = timer & 0x01;
++
++	if (GPTU_CON_EN(n, X))
++		*LQ_GPTU_RUN(n, X) = GPTU_RUN_CEN_SET(1);
++
++	*LQ_GPTU_IRNEN &= ~GPTU_IRNEN_TC_SET(n, X, 1);
++	*LQ_GPTU_IRNCR |= GPTU_IRNCR_TC_SET(n, X, 1);
++
++	if (timer_dev.timer[timer - FIRST_TIMER].f_irq_on) {
++		disable_irq(timer_dev.timer[timer - FIRST_TIMER].irq);
++		timer_dev.timer[timer - FIRST_TIMER].f_irq_on = 0;
++	}
++
++	timer_dev.occupation &= ~mask;
++	if (!timer_dev.occupation && timer_dev.f_gptu_on) {
++		lq_disable_gptu();
++		timer_dev.f_gptu_on = 0;
++	}
++
++	mutex_unlock(&timer_dev.gptu_mutex);
++
++	return 0;
++}
++EXPORT_SYMBOL(lq_free_timer);
++
++int lq_start_timer(unsigned int timer, int is_resume)
++{
++	unsigned int flag;
++	unsigned int mask;
++	int n, X;
++
++	if (!timer_dev.f_gptu_on)
++		return -EINVAL;
++
++	if (timer < FIRST_TIMER || timer >= FIRST_TIMER + timer_dev.number_of_timers)
++		return -EINVAL;
++
++	mutex_lock(&timer_dev.gptu_mutex);
++
++	flag = timer_dev.timer[timer - FIRST_TIMER].flag;
++	if (TIMER_FLAG_MASK_SIZE(flag) != TIMER_FLAG_16BIT)
++		timer &= ~0x01;
++
++	mask = (TIMER_FLAG_MASK_SIZE(flag) ==
++	TIMER_FLAG_16BIT ? 1 : 3) << timer;
++	if (((timer_dev.occupation & mask) ^ mask)) {
++		mutex_unlock(&timer_dev.gptu_mutex);
++		return -EINVAL;
++	}
++
++	n = timer >> 1;
++	X = timer & 0x01;
++
++	*LQ_GPTU_RUN(n, X) = GPTU_RUN_RL_SET(!is_resume) | GPTU_RUN_SEN_SET(1);
++
++
++	mutex_unlock(&timer_dev.gptu_mutex);
++
++	return 0;
++}
++EXPORT_SYMBOL(lq_start_timer);
++
++int lq_stop_timer(unsigned int timer)
++{
++	unsigned int flag;
++	unsigned int mask;
++	int n, X;
++
++	if (!timer_dev.f_gptu_on)
++		return -EINVAL;
++
++	if (timer < FIRST_TIMER
++	    || timer >= FIRST_TIMER + timer_dev.number_of_timers)
++		return -EINVAL;
++
++	mutex_lock(&timer_dev.gptu_mutex);
++
++	flag = timer_dev.timer[timer - FIRST_TIMER].flag;
++	if (TIMER_FLAG_MASK_SIZE(flag) != TIMER_FLAG_16BIT)
++		timer &= ~0x01;
++
++	mask = (TIMER_FLAG_MASK_SIZE(flag) == TIMER_FLAG_16BIT ? 1 : 3) << timer;
++	if (((timer_dev.occupation & mask) ^ mask)) {
++		mutex_unlock(&timer_dev.gptu_mutex);
++		return -EINVAL;
++	}
++
++	n = timer >> 1;
++	X = timer & 0x01;
++
++	*LQ_GPTU_RUN(n, X) = GPTU_RUN_CEN_SET(1);
++
++	mutex_unlock(&timer_dev.gptu_mutex);
++
++	return 0;
++}
++EXPORT_SYMBOL(lq_stop_timer);
++
++int lq_reset_counter_flags(u32 timer, u32 flags)
++{
++	unsigned int oflag;
++	unsigned int mask, con_reg;
++	int n, X;
++
++	if (!timer_dev.f_gptu_on)
++		return -EINVAL;
++
++	if (timer < FIRST_TIMER || timer >= FIRST_TIMER + timer_dev.number_of_timers)
++		return -EINVAL;
++
++	mutex_lock(&timer_dev.gptu_mutex);
++
++	oflag = timer_dev.timer[timer - FIRST_TIMER].flag;
++	if (TIMER_FLAG_MASK_SIZE(oflag) != TIMER_FLAG_16BIT)
++		timer &= ~0x01;
++
++	mask = (TIMER_FLAG_MASK_SIZE(oflag) == TIMER_FLAG_16BIT ? 1 : 3) << timer;
++	if (((timer_dev.occupation & mask) ^ mask)) {
++		mutex_unlock(&timer_dev.gptu_mutex);
++		return -EINVAL;
++	}
++
++	switch (TIMER_FLAG_MASK_EDGE(flags)) {
++	default:
++	case TIMER_FLAG_NONE_EDGE:
++		con_reg = GPTU_CON_EDGE_SET(0x00);
++		break;
++	case TIMER_FLAG_RISE_EDGE:
++		con_reg = GPTU_CON_EDGE_SET(0x01);
++		break;
++	case TIMER_FLAG_FALL_EDGE:
++		con_reg = GPTU_CON_EDGE_SET(0x02);
++		break;
++	case TIMER_FLAG_ANY_EDGE:
++		con_reg = GPTU_CON_EDGE_SET(0x03);
++		break;
++	}
++	if (TIMER_FLAG_MASK_TYPE(flags) == TIMER_FLAG_TIMER)
++		con_reg |= TIMER_FLAG_MASK_SRC(flags) == TIMER_FLAG_EXT_SRC ? GPTU_CON_SRC_EXT_SET(1) : GPTU_CON_SRC_EXT_SET(0);
++	else
++		con_reg |= TIMER_FLAG_MASK_SRC(flags) == TIMER_FLAG_EXT_SRC ? GPTU_CON_SRC_EG_SET(1) : GPTU_CON_SRC_EG_SET(0);
++	con_reg |= TIMER_FLAG_MASK_SYNC(flags) == TIMER_FLAG_UNSYNC ? GPTU_CON_SYNC_SET(0) : GPTU_CON_SYNC_SET(1);
++	con_reg |= TIMER_FLAG_MASK_INVERT(flags) == TIMER_FLAG_REAL ? GPTU_CON_INV_SET(0) : GPTU_CON_INV_SET(1);
++	con_reg |= TIMER_FLAG_MASK_SIZE(flags) == TIMER_FLAG_16BIT ? GPTU_CON_EXT_SET(0) : GPTU_CON_EXT_SET(1);
++	con_reg |= TIMER_FLAG_MASK_STOP(flags) == TIMER_FLAG_ONCE ? GPTU_CON_STP_SET(1) : GPTU_CON_STP_SET(0);
++	con_reg |= TIMER_FLAG_MASK_TYPE(flags) == TIMER_FLAG_TIMER ? GPTU_CON_CNT_SET(0) : GPTU_CON_CNT_SET(1);
++	con_reg |= TIMER_FLAG_MASK_DIR(flags) == TIMER_FLAG_UP ? GPTU_CON_DIR_SET(1) : GPTU_CON_DIR_SET(0);
++
++	timer_dev.timer[timer - FIRST_TIMER].flag = flags;
++	if (TIMER_FLAG_MASK_SIZE(flags) != TIMER_FLAG_16BIT)
++		timer_dev.timer[timer - FIRST_TIMER + 1].flag = flags;
++
++	n = timer >> 1;
++	X = timer & 0x01;
++
++	*LQ_GPTU_CON(n, X) = con_reg;
++	smp_wmb();
++	mutex_unlock(&timer_dev.gptu_mutex);
++	return 0;
++}
++EXPORT_SYMBOL(lq_reset_counter_flags);
++
++int lq_get_count_value(unsigned int timer, unsigned long *value)
++{
++	unsigned int flag;
++	unsigned int mask;
++	int n, X;
++
++	if (!timer_dev.f_gptu_on)
++		return -EINVAL;
++
++	if (timer < FIRST_TIMER
++	    || timer >= FIRST_TIMER + timer_dev.number_of_timers)
++		return -EINVAL;
++
++	mutex_lock(&timer_dev.gptu_mutex);
++
++	flag = timer_dev.timer[timer - FIRST_TIMER].flag;
++	if (TIMER_FLAG_MASK_SIZE(flag) != TIMER_FLAG_16BIT)
++		timer &= ~0x01;
++
++	mask = (TIMER_FLAG_MASK_SIZE(flag) == TIMER_FLAG_16BIT ? 1 : 3) << timer;
++	if (((timer_dev.occupation & mask) ^ mask)) {
++		mutex_unlock(&timer_dev.gptu_mutex);
++		return -EINVAL;
++	}
++
++	n = timer >> 1;
++	X = timer & 0x01;
++
++	*value = *LQ_GPTU_COUNT(n, X);
++
++
++	mutex_unlock(&timer_dev.gptu_mutex);
++
++	return 0;
++}
++EXPORT_SYMBOL(lq_get_count_value);
++
++u32 lq_cal_divider(unsigned long freq)
++{
++	u64 module_freq, fpi = ltq_get_fpi_bus_clock(2);
++	u32 clock_divider = 1;
++	module_freq = fpi * 1000;
++	do_div(module_freq, clock_divider * freq);
++	return module_freq;
++}
++EXPORT_SYMBOL(lq_cal_divider);
++
++int lq_set_timer(unsigned int timer, unsigned int freq, int is_cyclic,
++	int is_ext_src, unsigned int handle_flag, unsigned long arg1,
++	unsigned long arg2)
++{
++	unsigned long divider;
++	unsigned int flag;
++
++	divider = lq_cal_divider(freq);
++	if (divider == 0)
++		return -EINVAL;
++	flag = ((divider & ~0xFFFF) ? TIMER_FLAG_32BIT : TIMER_FLAG_16BIT)
++		| (is_cyclic ? TIMER_FLAG_CYCLIC : TIMER_FLAG_ONCE)
++		| (is_ext_src ? TIMER_FLAG_EXT_SRC : TIMER_FLAG_INT_SRC)
++		| TIMER_FLAG_TIMER | TIMER_FLAG_DOWN
++		| TIMER_FLAG_MASK_HANDLE(handle_flag);
++
++	printk(KERN_INFO "lq_set_timer(%d, %d), divider = %lu\n",
++		timer, freq, divider);
++	return lq_request_timer(timer, flag, divider, arg1, arg2);
++}
++EXPORT_SYMBOL(lq_set_timer);
++
++int lq_set_counter(unsigned int timer, unsigned int flag, u32 reload,
++	unsigned long arg1, unsigned long arg2)
++{
++	printk(KERN_INFO "lq_set_counter(%d, %#x, %d)\n", timer, flag, reload);
++	return lq_request_timer(timer, flag, reload, arg1, arg2);
++}
++EXPORT_SYMBOL(lq_set_counter);
++
++static long gptu_ioctl(struct file *file, unsigned int cmd,
++	unsigned long arg)
++{
++	int ret;
++	struct gptu_ioctl_param param;
++
++	if (!access_ok((void __user *)arg, sizeof(struct gptu_ioctl_param)))
++		return -EFAULT;
++	if (copy_from_user(&param, (void __user *)arg, sizeof(param)))
++		return -EFAULT;
++
++	if ((((cmd == GPTU_REQUEST_TIMER || cmd == GPTU_SET_TIMER
++	       || GPTU_SET_COUNTER) && param.timer < 2)
++	     || cmd == GPTU_GET_COUNT_VALUE || cmd == GPTU_CALCULATE_DIVIDER)
++	    && !access_ok((void __user *)arg,
++			   sizeof(struct gptu_ioctl_param)))
++		return -EFAULT;
++
++	switch (cmd) {
++	case GPTU_REQUEST_TIMER:
++		ret = lq_request_timer(param.timer, param.flag, param.value,
++				     (unsigned long) param.pid,
++				     (unsigned long) param.sig);
++		if (ret > 0) {
++			if (copy_to_user(&((struct gptu_ioctl_param *) arg)->
++					 timer, &ret, sizeof(&ret)))
++				ret = -EFAULT;
++			else
++				ret = 0;
++		}
++		break;
++	case GPTU_FREE_TIMER:
++		ret = lq_free_timer(param.timer);
++		break;
++	case GPTU_START_TIMER:
++		ret = lq_start_timer(param.timer, param.flag);
++		break;
++	case GPTU_STOP_TIMER:
++		ret = lq_stop_timer(param.timer);
++		break;
++	case GPTU_GET_COUNT_VALUE:
++		ret = lq_get_count_value(param.timer, &param.value);
++		if (!ret && copy_to_user(&((struct gptu_ioctl_param *) arg)->
++		    value, &param.value,sizeof(param.value)))
++			ret = -EFAULT;
++		break;
++	case GPTU_CALCULATE_DIVIDER:
++		param.value = lq_cal_divider(param.value);
++		if (param.value == 0)
++			ret = -EINVAL;
++		else if (copy_to_user(&((struct gptu_ioctl_param *) arg)->
++				      value, &param.value,
++				      sizeof(param.value)))
++			ret = -EFAULT;
++		else
++			ret = 0;
++		break;
++	case GPTU_SET_TIMER:
++		ret = lq_set_timer(param.timer, param.value,
++				 TIMER_FLAG_MASK_STOP(param.flag) !=
++				 TIMER_FLAG_ONCE ? 1 : 0,
++				 TIMER_FLAG_MASK_SRC(param.flag) ==
++				 TIMER_FLAG_EXT_SRC ? 1 : 0,
++				 TIMER_FLAG_MASK_HANDLE(param.flag) ==
++				 TIMER_FLAG_SIGNAL ? TIMER_FLAG_SIGNAL :
++				 TIMER_FLAG_NO_HANDLE,
++				 (unsigned long) param.pid,
++				 (unsigned long) param.sig);
++		if (ret > 0) {
++			if (copy_to_user(&((struct gptu_ioctl_param *) arg)->
++					 timer, &ret, sizeof(&ret)))
++				ret = -EFAULT;
++			else
++				ret = 0;
++		}
++		break;
++	case GPTU_SET_COUNTER:
++		lq_set_counter(param.timer, param.flag, param.value, 0, 0);
++		if (ret > 0) {
++			if (copy_to_user(&((struct gptu_ioctl_param *) arg)->
++					 timer, &ret, sizeof(&ret)))
++				ret = -EFAULT;
++			else
++				ret = 0;
++		}
++		break;
++	default:
++		ret = -ENOTTY;
++	}
++
++	return ret;
++}
++
++static int gptu_open(struct inode *inode, struct file *file)
++{
++	return 0;
++}
++
++static int gptu_release(struct inode *inode, struct file *file)
++{
++	return 0;
++}
++
++int __init lq_gptu_init(void)
++{
++	int ret;
++	unsigned int i;
++
++	ltq_w32(0, LQ_GPTU_IRNEN);
++	ltq_w32(0xfff, LQ_GPTU_IRNCR);
++
++	memset(&timer_dev, 0, sizeof(timer_dev));
++	mutex_init(&timer_dev.gptu_mutex);
++
++	lq_enable_gptu();
++	timer_dev.number_of_timers = GPTU_ID_CFG * 2;
++	lq_disable_gptu();
++	if (timer_dev.number_of_timers > MAX_NUM_OF_32BIT_TIMER_BLOCKS * 2)
++		timer_dev.number_of_timers = MAX_NUM_OF_32BIT_TIMER_BLOCKS * 2;
++	printk(KERN_INFO "gptu: totally %d 16-bit timers/counters\n", timer_dev.number_of_timers);
++
++	ret = misc_register(&gptu_miscdev);
++	if (ret) {
++		printk(KERN_ERR "gptu: can't misc_register, get error %d\n", -ret);
++		return ret;
++	} else {
++		printk(KERN_INFO "gptu: misc_register on minor %d\n", gptu_miscdev.minor);
++	}
++
++	for (i = 0; i < timer_dev.number_of_timers; i++) {
++		ret = request_irq(TIMER_INTERRUPT + i, timer_irq_handler, IRQF_TIMER, gptu_miscdev.name, &timer_dev.timer[i]);
++		if (ret) {
++			for (; i >= 0; i--)
++				free_irq(TIMER_INTERRUPT + i, &timer_dev.timer[i]);
++			misc_deregister(&gptu_miscdev);
++			printk(KERN_ERR "gptu: failed in requesting irq (%d), get error %d\n", i, -ret);
++			return ret;
++		} else {
++			timer_dev.timer[i].irq = TIMER_INTERRUPT + i;
++			disable_irq(timer_dev.timer[i].irq);
++			printk(KERN_INFO "gptu: succeeded to request irq %d\n", timer_dev.timer[i].irq);
++		}
++	}
++
++	return 0;
++}
++
++void __exit lq_gptu_exit(void)
++{
++	unsigned int i;
++
++	for (i = 0; i < timer_dev.number_of_timers; i++) {
++		if (timer_dev.timer[i].f_irq_on)
++			disable_irq(timer_dev.timer[i].irq);
++		free_irq(timer_dev.timer[i].irq, &timer_dev.timer[i]);
++	}
++	lq_disable_gptu();
++	misc_deregister(&gptu_miscdev);
++}
++
++module_init(lq_gptu_init);
++module_exit(lq_gptu_exit);
++
++#endif
diff --git a/target/linux/lantiq/patches-5.15/0018-MTD-nand-lots-of-xrx200-fixes.patch b/target/linux/lantiq/patches-5.15/0018-MTD-nand-lots-of-xrx200-fixes.patch
new file mode 100644
index 00000000000000..35f656da6e76bd
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0018-MTD-nand-lots-of-xrx200-fixes.patch
@@ -0,0 +1,121 @@
+From 997a8965db8417266bea3fbdcfa3e5655a1b52fa Mon Sep 17 00:00:00 2001
+From: John Crispin <blogic@openwrt.org>
+Date: Tue, 9 Sep 2014 23:12:15 +0200
+Subject: [PATCH 18/36] MTD: nand: lots of xrx200 fixes
+
+Signed-off-by: John Crispin <blogic@openwrt.org>
+---
+ drivers/mtd/nand/raw/xway_nand.c |   63 ++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 63 insertions(+)
+
+--- a/drivers/mtd/nand/raw/xway_nand.c
++++ b/drivers/mtd/nand/raw/xway_nand.c
+@@ -61,6 +61,24 @@
+ #define NAND_CON_CSMUX		(1 << 1)
+ #define NAND_CON_NANDM		1
+ 
++#define DANUBE_PCI_REG32( addr )    (*(volatile u32 *)(addr))
++#define PCI_CR_PR_OFFSET	    (KSEG1+0x1E105400)
++#define PCI_CR_PC_ARB		    (PCI_CR_PR_OFFSET + 0x0080)
++
++/*
++ * req_mask provides a mechanism to prevent interference between
++ * nand and pci (probably only relevant for the BT Home Hub 2B).
++ * Setting it causes the corresponding pci req pins to be masked
++ * during nand access, and also moves ebu locking from the read/write
++ * functions to the chip select function to ensure that the whole
++ * operation runs with interrupts disabled.
++ * In addition it switches on some extra waiting in xway_cmd_ctrl().
++ * This seems to be necessary if the ebu_cs1 pin has open-drain disabled,
++ * which in turn seems to be necessary for the nor chip to be recognised
++ * reliably, on a board (Home Hub 2B again) which has both nor and nand.
++ */
++static __be32 req_mask = 0;
++
+ struct xway_nand_data {
+ 	struct nand_controller	controller;
+ 	struct nand_chip	chip;
+@@ -92,10 +110,22 @@ static void xway_select_chip(struct nand
+ 	case -1:
+ 		ltq_ebu_w32_mask(NAND_CON_CE, 0, EBU_NAND_CON);
+ 		ltq_ebu_w32_mask(NAND_CON_NANDM, 0, EBU_NAND_CON);
++
++		if (req_mask) {
++			/* Unmask all external PCI request */
++			DANUBE_PCI_REG32(PCI_CR_PC_ARB) &= ~(req_mask << 16);
++		}
++
+ 		spin_unlock_irqrestore(&ebu_lock, data->csflags);
+ 		break;
+ 	case 0:
+ 		spin_lock_irqsave(&ebu_lock, data->csflags);
++
++		if (req_mask) {
++			/* Mask all external PCI request */
++			DANUBE_PCI_REG32(PCI_CR_PC_ARB) |= (req_mask << 16);
++		}
++
+ 		ltq_ebu_w32_mask(0, NAND_CON_NANDM, EBU_NAND_CON);
+ 		ltq_ebu_w32_mask(0, NAND_CON_CE, EBU_NAND_CON);
+ 		break;
+@@ -108,6 +138,11 @@ static void xway_cmd_ctrl(struct nand_ch
+ {
+ 	struct mtd_info *mtd = nand_to_mtd(chip);
+ 
++	if (req_mask) {
++		if (cmd != NAND_CMD_STATUS)
++			ltq_ebu_w32(0, EBU_NAND_WAIT); /* Clear nand ready */
++	}
++
+ 	if (cmd == NAND_CMD_NONE)
+ 		return;
+ 
+@@ -118,6 +153,24 @@ static void xway_cmd_ctrl(struct nand_ch
+ 
+ 	while ((ltq_ebu_r32(EBU_NAND_WAIT) & NAND_WAIT_WR_C) == 0)
+ 		;
++
++	if (req_mask) {
++	       /*
++		* program and erase have their own busy handlers
++		* status and sequential in needs no delay
++		*/
++		switch (cmd) {
++			case NAND_CMD_ERASE1:
++			case NAND_CMD_SEQIN:
++			case NAND_CMD_STATUS:
++			case NAND_CMD_READID:
++			return;
++		}
++
++		/* wait until command is processed */
++		while ((ltq_ebu_r32(EBU_NAND_WAIT) & NAND_WAIT_RD) == 0)
++			;
++	}
+ }
+ 
+ static int xway_dev_ready(struct nand_chip *chip)
+@@ -170,6 +223,7 @@ static int xway_nand_probe(struct platfo
+ 	int err;
+ 	u32 cs;
+ 	u32 cs_flag = 0;
++	const __be32 *req_mask_ptr;
+ 
+ 	/* Allocate memory for the device structure (and zero it) */
+ 	data = devm_kzalloc(&pdev->dev, sizeof(struct xway_nand_data),
+@@ -206,6 +260,15 @@ static int xway_nand_probe(struct platfo
+ 	if (!err && cs == 1)
+ 		cs_flag = NAND_CON_IN_CS1 | NAND_CON_OUT_CS1;
+ 
++	req_mask_ptr = of_get_property(pdev->dev.of_node,
++					"req-mask", NULL);
++
++	/*
++	 * Load the PCI req lines to mask from the device tree. If the
++	 * property is not present, setting req_mask to 0 disables masking.
++	 */
++	req_mask = (req_mask_ptr ? *req_mask_ptr : 0);
++
+ 	/* setup the EBU to run in NAND mode on our base addr */
+ 	ltq_ebu_w32(CPHYSADDR(data->nandaddr)
+ 		    | ADDSEL1_MASK(3) | ADDSEL1_REGEN, EBU_ADDSEL1);
diff --git a/target/linux/lantiq/patches-5.15/0020-MTD-lantiq-handle-NO_XIP-on-cfi0001-flash.patch b/target/linux/lantiq/patches-5.15/0020-MTD-lantiq-handle-NO_XIP-on-cfi0001-flash.patch
new file mode 100644
index 00000000000000..c1fc59487af4b2
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0020-MTD-lantiq-handle-NO_XIP-on-cfi0001-flash.patch
@@ -0,0 +1,25 @@
+From e3b20f04e9f9cae1babe091fdc1d08d7703ae344 Mon Sep 17 00:00:00 2001
+From: John Crispin <blogic@openwrt.org>
+Date: Thu, 7 Aug 2014 18:18:00 +0200
+Subject: [PATCH 20/36] MTD: lantiq: handle NO_XIP on cfi0001 flash
+
+Signed-off-by: John Crispin <blogic@openwrt.org>
+---
+ drivers/mtd/maps/lantiq-flash.c |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/maps/lantiq-flash.c
++++ b/drivers/mtd/maps/lantiq-flash.c
+@@ -129,7 +129,11 @@ ltq_mtd_probe(struct platform_device *pd
+ 	if (!ltq_mtd->map)
+ 		return -ENOMEM;
+ 
+-	ltq_mtd->map->phys = ltq_mtd->res->start;
++	if (of_find_property(pdev->dev.of_node, "lantiq,noxip", NULL))
++		ltq_mtd->map->phys = NO_XIP;
++	else
++		ltq_mtd->map->phys = ltq_mtd->res->start;
++	ltq_mtd->res->start;
+ 	ltq_mtd->map->size = resource_size(ltq_mtd->res);
+ 	ltq_mtd->map->virt = devm_ioremap_resource(&pdev->dev, ltq_mtd->res);
+ 	if (IS_ERR(ltq_mtd->map->virt))
diff --git a/target/linux/lantiq/patches-5.15/0023-NET-PHY-add-led-support-for-intel-xway.patch b/target/linux/lantiq/patches-5.15/0023-NET-PHY-add-led-support-for-intel-xway.patch
new file mode 100644
index 00000000000000..fcc760b911ae22
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0023-NET-PHY-add-led-support-for-intel-xway.patch
@@ -0,0 +1,294 @@
+From 0a63ab263725c427051a8bbaa0732b749627da27 Mon Sep 17 00:00:00 2001
+From: John Crispin <blogic@openwrt.org>
+Date: Thu, 7 Aug 2014 18:15:36 +0200
+Subject: [PATCH 23/36] NET: PHY: adds driver for lantiq PHY11G
+
+Signed-off-by: John Crispin <blogic@openwrt.org>
+---
+ drivers/net/phy/Kconfig  |    5 +
+ drivers/net/phy/Makefile |    1 +
+ drivers/net/phy/lantiq.c |  231 ++++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 237 insertions(+)
+ create mode 100644 drivers/net/phy/lantiq.c
+
+--- a/drivers/net/phy/intel-xway.c
++++ b/drivers/net/phy/intel-xway.c
+@@ -229,6 +229,51 @@ static int xway_gphy_rgmii_init(struct p
+ 			  XWAY_MDIO_MIICTRL_TXSKEW_MASK, val);
+ }
+ 
++#if IS_ENABLED(CONFIG_OF_MDIO)
++static int vr9_gphy_of_reg_init(struct phy_device *phydev)
++{
++	u32 tmp;
++
++	/* store the led values if one was passed by the devicetree */
++	if (!of_property_read_u32(phydev->mdio.dev.of_node, "lantiq,ledch", &tmp))
++		phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LEDCH, tmp);
++
++	if (!of_property_read_u32(phydev->mdio.dev.of_node, "lantiq,ledcl", &tmp))
++		phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LEDCL, tmp);
++
++	if (!of_property_read_u32(phydev->mdio.dev.of_node, "lantiq,led0h", &tmp))
++		phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LED0H, tmp);
++
++	if (!of_property_read_u32(phydev->mdio.dev.of_node, "lantiq,led0l", &tmp))
++		phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LED0L, tmp);
++
++	if (!of_property_read_u32(phydev->mdio.dev.of_node, "lantiq,led1h", &tmp))
++		phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LED1H, tmp);
++
++	if (!of_property_read_u32(phydev->mdio.dev.of_node, "lantiq,led1l", &tmp))
++		phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LED1L, tmp);
++
++	if (!of_property_read_u32(phydev->mdio.dev.of_node, "lantiq,led2h", &tmp))
++		phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LED2H,  tmp);
++
++	if (!of_property_read_u32(phydev->mdio.dev.of_node, "lantiq,led2l", &tmp))
++		phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LED2L, tmp);
++
++	if (!of_property_read_u32(phydev->mdio.dev.of_node, "lantiq,led3h", &tmp))
++		phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LED3H, tmp);
++
++	if (!of_property_read_u32(phydev->mdio.dev.of_node, "lantiq,led3l", &tmp))
++		phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LED3L, tmp);
++
++	return 0;
++}
++#else
++static int vr9_gphy_of_reg_init(struct phy_device *phydev)
++{
++	return 0;
++}
++#endif /* CONFIG_OF_MDIO */
++
+ static int xway_gphy_config_init(struct phy_device *phydev)
+ {
+ 	int err;
+@@ -280,6 +325,7 @@ static int xway_gphy_config_init(struct
+ 	if (err)
+ 		return err;
+ 
++	vr9_gphy_of_reg_init(phydev);
+ 	return 0;
+ }
+ 
+--- /dev/null
++++ b/Documentation/devicetree/bindings/phy/phy-lanitq.txt
+@@ -0,0 +1,216 @@
++Lanitq PHY binding
++============================================
++
++This devicetree binding controls the lantiq ethernet phys led functionality.
++
++Example:
++	mdio@0 {
++		#address-cells = <1>;
++		#size-cells = <0>;
++		compatible = "lantiq,xrx200-mdio";
++			phy5: ethernet-phy@5 {
++			reg = <0x1>;
++			compatible = "lantiq,phy11g", "ethernet-phy-ieee802.3-c22";
++		};
++		phy11: ethernet-phy@11 {
++			reg = <0x11>;
++			compatible = "lantiq,phy22f", "ethernet-phy-ieee802.3-c22";
++			lantiq,led2h = <0x00>;
++			lantiq,led2l = <0x03>;
++		};
++		phy12: ethernet-phy@12 {
++			reg = <0x12>;
++			compatible = "lantiq,phy22f", "ethernet-phy-ieee802.3-c22";
++			lantiq,led1h = <0x00>;
++			lantiq,led1l = <0x03>;
++		};
++		phy13: ethernet-phy@13 {
++			reg = <0x13>;
++			compatible = "lantiq,phy22f", "ethernet-phy-ieee802.3-c22";
++			lantiq,led2h = <0x00>;
++			lantiq,led2l = <0x03>;
++		};
++		phy14: ethernet-phy@14 {
++			reg = <0x14>;
++			compatible = "lantiq,phy22f", "ethernet-phy-ieee802.3-c22";
++			lantiq,led1h = <0x00>;
++			lantiq,led1l = <0x03>;
++		};
++	};
++
++Register Description
++============================================
++
++LEDCH:
++
++Name	Hardware Reset Value
++LEDCH	0x00C5
++
++| 15 |    |    |    |    |    |    |  8 |
++=========================================
++|		RES			|
++=========================================
++
++|  7 |    |    |    |    |    |    |  0 |
++=========================================
++|   FBF   |   SBF   |RES |     NACS     |
++=========================================
++
++Field	Bits	Type	Description
++FBF	7:6	RW	Fast Blink Frequency
++			---
++			0x0 (00b) F02HZ 2 Hz blinking frequency
++			0x1 (01b) F04HZ 4 Hz blinking frequency
++			0x2 (10b) F08HZ 8 Hz blinking frequency
++			0x3 (11b) F16HZ 16 Hz blinking frequency
++
++SBF	5:4	RW	Slow Blink Frequency
++			---
++			0x0 (00b) F02HZ 2 Hz blinking frequency
++			0x1 (01b) F04HZ 4 Hz blinking frequency
++			0x2 (10b) F08HZ 8 Hz blinking frequency
++			0x3 (11b) F16HZ 16 Hz blinking frequency
++
++NACS	2:0	RW	Inverse of Scan Function
++			---
++			0x0 (000b) NONE No Function
++			0x1 (001b) LINK Complex function enabled when link is up
++			0x2 (010b) PDOWN Complex function enabled when device is powered-down
++			0x3 (011b) EEE Complex function enabled when device is in EEE mode
++			0x4 (100b) ANEG Complex function enabled when auto-negotiation is running
++			0x5 (101b) ABIST Complex function enabled when analog self-test is running
++			0x6 (110b) CDIAG Complex function enabled when cable diagnostics are running
++			0x7 (111b) TEST Complex function enabled when test mode is running
++
++LEDCL:
++
++Name	Hardware Reset Value
++LEDCL	0x0067
++
++| 15 |    |    |    |    |    |    |  8 |
++=========================================
++|		RES			|
++=========================================
++
++|  7 |    |    |    |    |    |    |  0 |
++=========================================
++|RES |     SCAN     |RES |    CBLINK    |
++=========================================
++
++Field	Bits	Type	Description
++SCAN	6:4	RW	Complex Scan Configuration
++			---
++			000 B NONE No Function
++			001 B LINK Complex function enabled when link is up
++			010 B PDOWN Complex function enabled when device is powered-down
++			011 B EEE Complex function enabled when device is in EEE mode
++			100 B ANEG Complex function enabled when auto-negotiation is running
++			101 B ABIST Complex function enabled when analog self-test is running
++			110 B CDIAG Complex function enabled when cable diagnostics are running
++			111 B TEST Complex function enabled when test mode is running
++
++CBLINK	2:0	RW	Complex Blinking Configuration
++			---
++			000 B NONE No Function
++			001 B LINK Complex function enabled when link is up
++			010 B PDOWN Complex function enabled when device is powered-down
++			011 B EEE Complex function enabled when device is in EEE mode
++			100 B ANEG Complex function enabled when auto-negotiation is running
++			101 B ABIST Complex function enabled when analog self-test is running
++			110 B CDIAG Complex function enabled when cable diagnostics are running
++			111 B TEST Complex function enabled when test mode is running
++
++LEDxH:
++
++Name	Hardware Reset Value
++LED0H	0x0070
++LED1H	0x0020
++LED2H	0x0040
++LED3H	0x0040
++
++| 15 |    |    |    |    |    |    |  8 |
++=========================================
++|		RES			|
++=========================================
++
++|  7 |    |    |    |    |    |    |  0 |
++=========================================
++|        CON        |       BLINKF      |
++=========================================
++
++Field	Bits	Type	Description
++CON	7:4	RW	Constant On Configuration
++			---
++			0x0 (0000b) NONE LED does not light up constantly
++			0x1 (0001b) LINK10 LED is on when link is 10 Mbit/s
++			0x2 (0010b) LINK100 LED is on when link is 100 Mbit/s
++			0x3 (0011b) LINK10X LED is on when link is 10/100 Mbit/s
++			0x4 (0100b) LINK1000 LED is on when link is 1000 Mbit/s
++			0x5 (0101b) LINK10_0 LED is on when link is 10/1000 Mbit/s
++			0x6 (0110b) LINK100X LED is on when link is 100/1000 Mbit/s
++			0x7 (0111b) LINK10XX LED is on when link is 10/100/1000 Mbit/s
++			0x8 (1000b) PDOWN LED is on when device is powered-down
++			0x9 (1001b) EEE LED is on when device is in EEE mode
++			0xA (1010b) ANEG LED is on when auto-negotiation is running
++			0xB (1011b) ABIST LED is on when analog self-test is running
++			0xC (1100b) CDIAG LED is on when cable diagnostics are running
++
++BLINKF	3:0	RW	Fast Blinking Configuration
++			---
++			0x0 (0000b) NONE No Blinking
++			0x1 (0001b) LINK10 Blink when link is 10 Mbit/s
++			0x2 (0010b) LINK100 Blink when link is 100 Mbit/s
++			0x3 (0011b) LINK10X Blink when link is 10/100 Mbit/s
++			0x4 (0100b) LINK1000 Blink when link is 1000 Mbit/s
++			0x5 (0101b) LINK10_0 Blink when link is 10/1000 Mbit/s
++			0x6 (0110b) LINK100X Blink when link is 100/1000 Mbit/s
++			0x7 (0111b) LINK10XX Blink when link is 10/100/1000 Mbit/s
++			0x8 (1000b) PDOWN Blink when device is powered-down
++			0x9 (1001b) EEE Blink when device is in EEE mode
++			0xA (1010b) ANEG Blink when auto-negotiation is running
++			0xB (1011b) ABIST Blink when analog self-test is running
++			0xC (1100b) CDIAG Blink when cable diagnostics are running
++
++LEDxL:
++
++Name	Hardware Reset Value
++LED0L	0x0003
++LED1L	0x0000
++LED2L	0x0000
++LED3L	0x0020
++
++| 15 |    |    |    |    |    |    |  8 |
++=========================================
++|		RES			|
++=========================================
++
++|  7 |    |    |    |    |    |    |  0 |
++=========================================
++|      BLINKS       |       PULSE       |
++=========================================
++
++Field	Bits	Type	Description
++BLINKS	7:4	RW	Slow Blinkin Configuration
++			---
++			0x0 (0000b) NONE No Blinking
++			0x1 (0001b) LINK10 Blink when link is 10 Mbit/s
++			0x2 (0010b) LINK100 Blink when link is 100 Mbit/s
++			0x3 (0011b) LINK10X Blink when link is 10/100 Mbit/s
++			0x4 (0100b) LINK1000 Blink when link is 1000 Mbit/s
++			0x5 (0101b) LINK10_0 Blink when link is 10/1000 Mbit/s
++			0x6 (0110b) LINK100X Blink when link is 100/1000 Mbit/s
++			0x7 (0111b) LINK10XX Blink when link is 10/100/1000 Mbit/s
++			0x8 (1000b) PDOWN Blink when device is powered-down
++			0x9 (1001b) EEE Blink when device is in EEE mode
++			0xA (1010b) ANEG Blink when auto-negotiation is running
++			0xB (1011b) ABIST Blink when analog self-test is running
++			0xC (1100b) CDIAG Blink when cable diagnostics are runningning
++
++PULSE	3:0	RW	Pulsing Configuration
++			The pulse field is a mask field by which certain events can be combined
++			---
++			0x0 (0000b) NONE No pulsing
++			0x1 (0001b) TXACT Transmit activity
++			0x2 (0010b) RXACT Receive activity
++			0x4 (0100b) COL Collision
++			0x8 (1000b) RES Reserved
diff --git a/target/linux/lantiq/patches-5.15/0028-NET-lantiq-various-etop-fixes.patch b/target/linux/lantiq/patches-5.15/0028-NET-lantiq-various-etop-fixes.patch
new file mode 100644
index 00000000000000..e9f3ee473b494e
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0028-NET-lantiq-various-etop-fixes.patch
@@ -0,0 +1,864 @@
+From 870ed9cae083ff8a60a739ef7e74c5a1800533be Mon Sep 17 00:00:00 2001
+From: John Crispin <blogic@openwrt.org>
+Date: Tue, 9 Sep 2014 22:45:34 +0200
+Subject: [PATCH 28/36] NET: lantiq: various etop fixes
+
+Signed-off-by: John Crispin <blogic@openwrt.org>
+---
+ drivers/net/ethernet/lantiq_etop.c |  555 +++++++++++++++++++++++++-----------
+ 1 file changed, 389 insertions(+), 166 deletions(-)
+
+--- a/drivers/net/ethernet/lantiq_etop.c
++++ b/drivers/net/ethernet/lantiq_etop.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+  *
+- *   Copyright (C) 2011 John Crispin <blogic@openwrt.org>
++ *   Copyright (C) 2011-12 John Crispin <blogic@openwrt.org>
+  */
+ 
+ #include <linux/kernel.h>
+@@ -20,11 +20,16 @@
+ #include <linux/mm.h>
+ #include <linux/platform_device.h>
+ #include <linux/ethtool.h>
++#include <linux/if_vlan.h>
+ #include <linux/init.h>
+ #include <linux/delay.h>
+ #include <linux/io.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/module.h>
++#include <linux/clk.h>
++#include <linux/of_net.h>
++#include <linux/of_irq.h>
++#include <linux/of_platform.h>
+ 
+ #include <asm/checksum.h>
+ 
+@@ -32,7 +37,7 @@
+ #include <xway_dma.h>
+ #include <lantiq_platform.h>
+ 
+-#define LTQ_ETOP_MDIO		0x11804
++#define LTQ_ETOP_MDIO_ACC	0x11804
+ #define MDIO_REQUEST		0x80000000
+ #define MDIO_READ		0x40000000
+ #define MDIO_ADDR_MASK		0x1f
+@@ -41,44 +46,91 @@
+ #define MDIO_REG_OFFSET		0x10
+ #define MDIO_VAL_MASK		0xffff
+ 
+-#define PPE32_CGEN		0x800
+-#define LQ_PPE32_ENET_MAC_CFG	0x1840
++#define LTQ_ETOP_MDIO_CFG       0x11800
++#define MDIO_CFG_MASK           0x6
++
++#define LTQ_ETOP_CFG            0x11808
++#define LTQ_ETOP_IGPLEN         0x11820
++#define LTQ_ETOP_MAC_CFG	0x11840
+ 
+ #define LTQ_ETOP_ENETS0		0x11850
+ #define LTQ_ETOP_MAC_DA0	0x1186C
+ #define LTQ_ETOP_MAC_DA1	0x11870
+-#define LTQ_ETOP_CFG		0x16020
+-#define LTQ_ETOP_IGPLEN		0x16080
++
++#define MAC_CFG_MASK		0xfff
++#define MAC_CFG_CGEN		(1 << 11)
++#define MAC_CFG_DUPLEX		(1 << 2)
++#define MAC_CFG_SPEED		(1 << 1)
++#define MAC_CFG_LINK		(1 << 0)
+ 
+ #define MAX_DMA_CHAN		0x8
+ #define MAX_DMA_CRC_LEN		0x4
+ #define MAX_DMA_DATA_LEN	0x600
+ 
+ #define ETOP_FTCU		BIT(28)
+-#define ETOP_MII_MASK		0xf
+-#define ETOP_MII_NORMAL		0xd
+-#define ETOP_MII_REVERSE	0xe
+ #define ETOP_PLEN_UNDER		0x40
+-#define ETOP_CGEN		0x800
++#define ETOP_CFG_MII0		0x01
+ 
+-/* use 2 static channels for TX/RX */
+-#define LTQ_ETOP_TX_CHANNEL	1
+-#define LTQ_ETOP_RX_CHANNEL	6
+-#define IS_TX(x)		(x == LTQ_ETOP_TX_CHANNEL)
+-#define IS_RX(x)		(x == LTQ_ETOP_RX_CHANNEL)
++#define ETOP_CFG_MASK           0xfff
++#define ETOP_CFG_FEN0		(1 << 8)
++#define ETOP_CFG_SEN0		(1 << 6)
++#define ETOP_CFG_OFF1		(1 << 3)
++#define ETOP_CFG_REMII0		(1 << 1)
++#define ETOP_CFG_OFF0		(1 << 0)
++
++#define LTQ_GBIT_MDIO_CTL	0xCC
++#define LTQ_GBIT_MDIO_DATA	0xd0
++#define LTQ_GBIT_GCTL0		0x68
++#define LTQ_GBIT_PMAC_HD_CTL	0x8c
++#define LTQ_GBIT_P0_CTL		0x4
++#define LTQ_GBIT_PMAC_RX_IPG	0xa8
++#define LTQ_GBIT_RGMII_CTL	0x78
++
++#define PMAC_HD_CTL_AS		(1 << 19)
++#define PMAC_HD_CTL_RXSH	(1 << 22)
++
++/* Switch Enable (0=disable, 1=enable) */
++#define GCTL0_SE		0x80000000
++/* Disable MDIO auto polling (0=disable, 1=enable) */
++#define PX_CTL_DMDIO		0x00400000
++
++/* MDC clock divider, clock = 25MHz/((MDC_CLOCK + 1) * 2) */
++#define MDC_CLOCK_MASK		0xff000000
++#define MDC_CLOCK_OFFSET	24
++
++/* register information for the gbit's MDIO bus */
++#define MDIO_XR9_REQUEST	0x00008000
++#define MDIO_XR9_READ		0x00000800
++#define MDIO_XR9_WRITE		0x00000400
++#define MDIO_XR9_REG_MASK	0x1f
++#define MDIO_XR9_ADDR_MASK	0x1f
++#define MDIO_XR9_RD_MASK	0xffff
++#define MDIO_XR9_REG_OFFSET	0
++#define MDIO_XR9_ADDR_OFFSET	5
++#define MDIO_XR9_WR_OFFSET	16
+ 
++#define LTQ_DMA_ETOP	((of_machine_is_compatible("lantiq,ase")) ? \
++			(INT_NUM_IM3_IRL0) : (INT_NUM_IM2_IRL0))
++
++/* the newer xway socks have a embedded 3/7 port gbit multiplexer */
+ #define ltq_etop_r32(x)		ltq_r32(ltq_etop_membase + (x))
+ #define ltq_etop_w32(x, y)	ltq_w32(x, ltq_etop_membase + (y))
+ #define ltq_etop_w32_mask(x, y, z)	\
+ 		ltq_w32_mask(x, y, ltq_etop_membase + (z))
+ 
+-#define DRV_VERSION	"1.0"
++#define ltq_gbit_r32(x)		ltq_r32(ltq_gbit_membase + (x))
++#define ltq_gbit_w32(x, y)	ltq_w32(x, ltq_gbit_membase + (y))
++#define ltq_gbit_w32_mask(x, y, z)	\
++		ltq_w32_mask(x, y, ltq_gbit_membase + (z))
++
++#define DRV_VERSION	"1.2"
+ 
+ static void __iomem *ltq_etop_membase;
++static void __iomem *ltq_gbit_membase;
+ 
+ struct ltq_etop_chan {
+-	int idx;
+ 	int tx_free;
++	int irq;
+ 	struct net_device *netdev;
+ 	struct napi_struct napi;
+ 	struct ltq_dma_channel dma;
+@@ -88,23 +140,36 @@ struct ltq_etop_chan {
+ struct ltq_etop_priv {
+ 	struct net_device *netdev;
+ 	struct platform_device *pdev;
+-	struct ltq_eth_data *pldata;
+ 	struct resource *res;
+ 
+ 	struct mii_bus *mii_bus;
+ 
+-	struct ltq_etop_chan ch[MAX_DMA_CHAN];
+-	int tx_free[MAX_DMA_CHAN >> 1];
++	struct ltq_etop_chan txch;
++	struct ltq_etop_chan rxch;
+ 
+-	spinlock_t lock;
++	int tx_irq;
++	int rx_irq;
++
++	unsigned char mac[6];
++	phy_interface_t mii_mode;
++ 
++ 	spinlock_t lock;
++
++	struct clk *clk_ppe;
++	struct clk *clk_switch;
++	struct clk *clk_ephy;
++	struct clk *clk_ephycgu;
+ };
+ 
++static int ltq_etop_mdio_wr(struct mii_bus *bus, int phy_addr,
++				int phy_reg, u16 phy_data);
++
+ static int
+ ltq_etop_alloc_skb(struct ltq_etop_chan *ch)
+ {
+ 	struct ltq_etop_priv *priv = netdev_priv(ch->netdev);
+ 
+-	ch->skb[ch->dma.desc] = netdev_alloc_skb(ch->netdev, MAX_DMA_DATA_LEN);
++	ch->skb[ch->dma.desc] = dev_alloc_skb(MAX_DMA_DATA_LEN);
+ 	if (!ch->skb[ch->dma.desc])
+ 		return -ENOMEM;
+ 	ch->dma.desc_base[ch->dma.desc].addr = dma_map_single(&priv->pdev->dev,
+@@ -139,8 +204,11 @@ ltq_etop_hw_receive(struct ltq_etop_chan
+ 	spin_unlock_irqrestore(&priv->lock, flags);
+ 
+ 	skb_put(skb, len);
++	skb->dev = ch->netdev;
+ 	skb->protocol = eth_type_trans(skb, ch->netdev);
+ 	netif_receive_skb(skb);
++	ch->netdev->stats.rx_packets++;
++	ch->netdev->stats.rx_bytes += len;
+ }
+ 
+ static int
+@@ -148,7 +216,9 @@ ltq_etop_poll_rx(struct napi_struct *nap
+ {
+ 	struct ltq_etop_chan *ch = container_of(napi,
+ 				struct ltq_etop_chan, napi);
++	struct ltq_etop_priv *priv = netdev_priv(ch->netdev);
+ 	int work_done = 0;
++	unsigned long flags;
+ 
+ 	while (work_done < budget) {
+ 		struct ltq_dma_desc *desc = &ch->dma.desc_base[ch->dma.desc];
+@@ -160,7 +230,9 @@ ltq_etop_poll_rx(struct napi_struct *nap
+ 	}
+ 	if (work_done < budget) {
+ 		napi_complete_done(&ch->napi, work_done);
++		spin_lock_irqsave(&priv->lock, flags);
+ 		ltq_dma_ack_irq(&ch->dma);
++		spin_unlock_irqrestore(&priv->lock, flags);
+ 	}
+ 	return work_done;
+ }
+@@ -172,12 +244,14 @@ ltq_etop_poll_tx(struct napi_struct *nap
+ 		container_of(napi, struct ltq_etop_chan, napi);
+ 	struct ltq_etop_priv *priv = netdev_priv(ch->netdev);
+ 	struct netdev_queue *txq =
+-		netdev_get_tx_queue(ch->netdev, ch->idx >> 1);
++		netdev_get_tx_queue(ch->netdev, ch->dma.nr >> 1);
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&priv->lock, flags);
+ 	while ((ch->dma.desc_base[ch->tx_free].ctl &
+ 			(LTQ_DMA_OWN | LTQ_DMA_C)) == LTQ_DMA_C) {
++		ch->netdev->stats.tx_packets++;
++		ch->netdev->stats.tx_bytes += ch->skb[ch->tx_free]->len;
+ 		dev_kfree_skb_any(ch->skb[ch->tx_free]);
+ 		ch->skb[ch->tx_free] = NULL;
+ 		memset(&ch->dma.desc_base[ch->tx_free], 0,
+@@ -190,7 +264,9 @@ ltq_etop_poll_tx(struct napi_struct *nap
+ 	if (netif_tx_queue_stopped(txq))
+ 		netif_tx_start_queue(txq);
+ 	napi_complete(&ch->napi);
++	spin_lock_irqsave(&priv->lock, flags);
+ 	ltq_dma_ack_irq(&ch->dma);
++	spin_unlock_irqrestore(&priv->lock, flags);
+ 	return 1;
+ }
+ 
+@@ -198,9 +274,10 @@ static irqreturn_t
+ ltq_etop_dma_irq(int irq, void *_priv)
+ {
+ 	struct ltq_etop_priv *priv = _priv;
+-	int ch = irq - LTQ_DMA_CH0_INT;
+-
+-	napi_schedule(&priv->ch[ch].napi);
++	if (irq == priv->txch.dma.irq)
++		napi_schedule(&priv->txch.napi);
++	else
++		napi_schedule(&priv->rxch.napi);
+ 	return IRQ_HANDLED;
+ }
+ 
+@@ -212,7 +289,7 @@ ltq_etop_free_channel(struct net_device
+ 	ltq_dma_free(&ch->dma);
+ 	if (ch->dma.irq)
+ 		free_irq(ch->dma.irq, priv);
+-	if (IS_RX(ch->idx)) {
++	if (ch == &priv->txch) {
+ 		int desc;
+ 		for (desc = 0; desc < LTQ_DESC_NUM; desc++)
+ 			dev_kfree_skb_any(ch->skb[ch->dma.desc]);
+@@ -223,66 +300,135 @@ static void
+ ltq_etop_hw_exit(struct net_device *dev)
+ {
+ 	struct ltq_etop_priv *priv = netdev_priv(dev);
+-	int i;
+ 
+-	ltq_pmu_disable(PMU_PPE);
+-	for (i = 0; i < MAX_DMA_CHAN; i++)
+-		if (IS_TX(i) || IS_RX(i))
+-			ltq_etop_free_channel(dev, &priv->ch[i]);
++	clk_disable(priv->clk_ppe);
++
++	if (of_machine_is_compatible("lantiq,ar9"))
++		clk_disable(priv->clk_switch);
++
++	if (of_machine_is_compatible("lantiq,ase")) {
++		clk_disable(priv->clk_ephy);
++		clk_disable(priv->clk_ephycgu);
++	}
++
++	ltq_etop_free_channel(dev, &priv->txch);
++	ltq_etop_free_channel(dev, &priv->rxch);
++}
++
++static void
++ltq_etop_gbit_init(struct net_device *dev)
++{
++	struct ltq_etop_priv *priv = netdev_priv(dev);
++
++	clk_enable(priv->clk_switch);
++
++	/* enable gbit port0 on the SoC */
++	ltq_gbit_w32_mask((1 << 17), (1 << 18), LTQ_GBIT_P0_CTL);
++
++	ltq_gbit_w32_mask(0, GCTL0_SE, LTQ_GBIT_GCTL0);
++	/* disable MDIO auto polling mode */
++	ltq_gbit_w32_mask(0, PX_CTL_DMDIO, LTQ_GBIT_P0_CTL);
++	/* set 1522 packet size */
++	ltq_gbit_w32_mask(0x300, 0, LTQ_GBIT_GCTL0);
++	/* disable pmac & dmac headers */
++	ltq_gbit_w32_mask(PMAC_HD_CTL_AS | PMAC_HD_CTL_RXSH, 0,
++		LTQ_GBIT_PMAC_HD_CTL);
++	/* Due to traffic halt when burst length 8,
++		replace default IPG value with 0x3B */
++	ltq_gbit_w32(0x3B, LTQ_GBIT_PMAC_RX_IPG);
++	/* set mdc clock to 2.5 MHz */
++	ltq_gbit_w32_mask(MDC_CLOCK_MASK, 4 << MDC_CLOCK_OFFSET,
++		LTQ_GBIT_RGMII_CTL);
+ }
+ 
+ static int
+ ltq_etop_hw_init(struct net_device *dev)
+ {
+ 	struct ltq_etop_priv *priv = netdev_priv(dev);
+-	int i;
++	phy_interface_t mii_mode = priv->mii_mode;
+ 
+-	ltq_pmu_enable(PMU_PPE);
++	clk_enable(priv->clk_ppe);
+ 
+-	switch (priv->pldata->mii_mode) {
++	if (of_machine_is_compatible("lantiq,ar9")) {
++		ltq_etop_gbit_init(dev);
++		/* force the etops link to the gbit to MII */
++		mii_mode = PHY_INTERFACE_MODE_MII;
++	}
++	ltq_etop_w32_mask(MDIO_CFG_MASK, 0, LTQ_ETOP_MDIO_CFG);
++	ltq_etop_w32_mask(MAC_CFG_MASK, MAC_CFG_CGEN | MAC_CFG_DUPLEX |
++			MAC_CFG_SPEED | MAC_CFG_LINK, LTQ_ETOP_MAC_CFG);
++
++	switch (mii_mode) {
+ 	case PHY_INTERFACE_MODE_RMII:
+-		ltq_etop_w32_mask(ETOP_MII_MASK,
+-			ETOP_MII_REVERSE, LTQ_ETOP_CFG);
++		ltq_etop_w32_mask(ETOP_CFG_MASK, ETOP_CFG_REMII0 | ETOP_CFG_OFF1 |
++			ETOP_CFG_SEN0 | ETOP_CFG_FEN0, LTQ_ETOP_CFG);
+ 		break;
+ 
+ 	case PHY_INTERFACE_MODE_MII:
+-		ltq_etop_w32_mask(ETOP_MII_MASK,
+-			ETOP_MII_NORMAL, LTQ_ETOP_CFG);
++		ltq_etop_w32_mask(ETOP_CFG_MASK, ETOP_CFG_OFF1 |
++			ETOP_CFG_SEN0 | ETOP_CFG_FEN0, LTQ_ETOP_CFG);
+ 		break;
+ 
+ 	default:
++		if (of_machine_is_compatible("lantiq,ase")) {
++			clk_enable(priv->clk_ephy);
++			/* disable external MII */
++			ltq_etop_w32_mask(0, ETOP_CFG_MII0, LTQ_ETOP_CFG);
++			/* enable clock for internal PHY */
++			clk_enable(priv->clk_ephycgu);
++			/* we need to write this magic to the internal phy to
++			   make it work */
++			ltq_etop_mdio_wr(NULL, 0x8, 0x12, 0xC020);
++			pr_info("Selected EPHY mode\n");
++			break;
++		}
+ 		netdev_err(dev, "unknown mii mode %d\n",
+-			priv->pldata->mii_mode);
++			mii_mode);
+ 		return -ENOTSUPP;
+ 	}
+ 
+-	/* enable crc generation */
+-	ltq_etop_w32(PPE32_CGEN, LQ_PPE32_ENET_MAC_CFG);
++	return 0;
++}
++
++static int
++ltq_etop_dma_init(struct net_device *dev)
++{
++	struct ltq_etop_priv *priv = netdev_priv(dev);
++	int tx = priv->tx_irq - LTQ_DMA_ETOP;
++	int rx = priv->rx_irq - LTQ_DMA_ETOP;
++	int err;
+ 
+ 	ltq_dma_init_port(DMA_PORT_ETOP);
+ 
+-	for (i = 0; i < MAX_DMA_CHAN; i++) {
+-		int irq = LTQ_DMA_CH0_INT + i;
+-		struct ltq_etop_chan *ch = &priv->ch[i];
+-
+-		ch->idx = ch->dma.nr = i;
+-		ch->dma.dev = &priv->pdev->dev;
+-
+-		if (IS_TX(i)) {
+-			ltq_dma_alloc_tx(&ch->dma);
+-			request_irq(irq, ltq_etop_dma_irq, 0, "etop_tx", priv);
+-		} else if (IS_RX(i)) {
+-			ltq_dma_alloc_rx(&ch->dma);
+-			for (ch->dma.desc = 0; ch->dma.desc < LTQ_DESC_NUM;
+-					ch->dma.desc++)
+-				if (ltq_etop_alloc_skb(ch))
+-					return -ENOMEM;
+-			ch->dma.desc = 0;
+-			request_irq(irq, ltq_etop_dma_irq, 0, "etop_rx", priv);
++	priv->txch.dma.nr = tx;
++	priv->txch.dma.dev = &priv->pdev->dev;
++	ltq_dma_alloc_tx(&priv->txch.dma);
++	err = request_irq(priv->tx_irq, ltq_etop_dma_irq, 0, "eth_tx", priv);
++	if (err) {
++		netdev_err(dev, "failed to allocate tx irq\n");
++		goto err_out;
++	}
++	priv->txch.dma.irq = priv->tx_irq;
++
++	priv->rxch.dma.nr = rx;
++	priv->rxch.dma.dev = &priv->pdev->dev;
++	ltq_dma_alloc_rx(&priv->rxch.dma);
++	for (priv->rxch.dma.desc = 0; priv->rxch.dma.desc < LTQ_DESC_NUM;
++			priv->rxch.dma.desc++) {
++		if (ltq_etop_alloc_skb(&priv->rxch)) {
++			netdev_err(dev, "failed to allocate skbs\n");
++			err = -ENOMEM;
++			goto err_out;
+ 		}
+-		ch->dma.irq = irq;
+ 	}
+-	return 0;
++	priv->rxch.dma.desc = 0;
++	err = request_irq(priv->rx_irq, ltq_etop_dma_irq, 0, "eth_rx", priv);
++	if (err)
++		netdev_err(dev, "failed to allocate rx irq\n");
++	else
++		priv->rxch.dma.irq = priv->rx_irq;
++err_out:
++	return err;
+ }
+ 
+ static void
+@@ -301,6 +447,39 @@ static const struct ethtool_ops ltq_etop
+ };
+ 
+ static int
++ltq_etop_mdio_wr_xr9(struct mii_bus *bus, int phy_addr,
++		int phy_reg, u16 phy_data)
++{
++	u32 val = MDIO_XR9_REQUEST | MDIO_XR9_WRITE |
++		(phy_data << MDIO_XR9_WR_OFFSET) |
++		((phy_addr & MDIO_XR9_ADDR_MASK) << MDIO_XR9_ADDR_OFFSET) |
++		((phy_reg & MDIO_XR9_REG_MASK) << MDIO_XR9_REG_OFFSET);
++
++	while (ltq_gbit_r32(LTQ_GBIT_MDIO_CTL) & MDIO_XR9_REQUEST)
++		;
++	ltq_gbit_w32(val, LTQ_GBIT_MDIO_CTL);
++	while (ltq_gbit_r32(LTQ_GBIT_MDIO_CTL) & MDIO_XR9_REQUEST)
++		;
++	return 0;
++}
++
++static int
++ltq_etop_mdio_rd_xr9(struct mii_bus *bus, int phy_addr, int phy_reg)
++{
++	u32 val = MDIO_XR9_REQUEST | MDIO_XR9_READ |
++		((phy_addr & MDIO_XR9_ADDR_MASK) << MDIO_XR9_ADDR_OFFSET) |
++		((phy_reg & MDIO_XR9_REG_MASK) << MDIO_XR9_REG_OFFSET);
++
++	while (ltq_gbit_r32(LTQ_GBIT_MDIO_CTL) & MDIO_XR9_REQUEST)
++		;
++	ltq_gbit_w32(val, LTQ_GBIT_MDIO_CTL);
++	while (ltq_gbit_r32(LTQ_GBIT_MDIO_CTL) & MDIO_XR9_REQUEST)
++		;
++	val = ltq_gbit_r32(LTQ_GBIT_MDIO_DATA) & MDIO_XR9_RD_MASK;
++	return val;
++}
++
++static int
+ ltq_etop_mdio_wr(struct mii_bus *bus, int phy_addr, int phy_reg, u16 phy_data)
+ {
+ 	u32 val = MDIO_REQUEST |
+@@ -308,9 +487,9 @@ ltq_etop_mdio_wr(struct mii_bus *bus, in
+ 		((phy_reg & MDIO_REG_MASK) << MDIO_REG_OFFSET) |
+ 		phy_data;
+ 
+-	while (ltq_etop_r32(LTQ_ETOP_MDIO) & MDIO_REQUEST)
++	while (ltq_etop_r32(LTQ_ETOP_MDIO_ACC) & MDIO_REQUEST)
+ 		;
+-	ltq_etop_w32(val, LTQ_ETOP_MDIO);
++	ltq_etop_w32(val, LTQ_ETOP_MDIO_ACC);
+ 	return 0;
+ }
+ 
+@@ -321,12 +500,12 @@ ltq_etop_mdio_rd(struct mii_bus *bus, in
+ 		((phy_addr & MDIO_ADDR_MASK) << MDIO_ADDR_OFFSET) |
+ 		((phy_reg & MDIO_REG_MASK) << MDIO_REG_OFFSET);
+ 
+-	while (ltq_etop_r32(LTQ_ETOP_MDIO) & MDIO_REQUEST)
++	while (ltq_etop_r32(LTQ_ETOP_MDIO_ACC) & MDIO_REQUEST)
+ 		;
+-	ltq_etop_w32(val, LTQ_ETOP_MDIO);
+-	while (ltq_etop_r32(LTQ_ETOP_MDIO) & MDIO_REQUEST)
++	ltq_etop_w32(val, LTQ_ETOP_MDIO_ACC);
++	while (ltq_etop_r32(LTQ_ETOP_MDIO_ACC) & MDIO_REQUEST)
+ 		;
+-	val = ltq_etop_r32(LTQ_ETOP_MDIO) & MDIO_VAL_MASK;
++	val = ltq_etop_r32(LTQ_ETOP_MDIO_ACC) & MDIO_VAL_MASK;
+ 	return val;
+ }
+ 
+@@ -342,7 +521,10 @@ ltq_etop_mdio_probe(struct net_device *d
+ 	struct ltq_etop_priv *priv = netdev_priv(dev);
+ 	struct phy_device *phydev;
+ 
+-	phydev = phy_find_first(priv->mii_bus);
++	if (of_machine_is_compatible("lantiq,ase"))
++		phydev = mdiobus_get_phy(priv->mii_bus, 8);
++	else
++		phydev = mdiobus_get_phy(priv->mii_bus, 0);
+ 
+ 	if (!phydev) {
+ 		netdev_err(dev, "no PHY found\n");
+@@ -350,14 +532,17 @@ ltq_etop_mdio_probe(struct net_device *d
+ 	}
+ 
+ 	phydev = phy_connect(dev, phydev_name(phydev),
+-			     &ltq_etop_mdio_link, priv->pldata->mii_mode);
++			     &ltq_etop_mdio_link, priv->mii_mode);
+ 
+ 	if (IS_ERR(phydev)) {
+ 		netdev_err(dev, "Could not attach to PHY\n");
+ 		return PTR_ERR(phydev);
+ 	}
+ 
+-	phy_set_max_speed(phydev, SPEED_100);
++	if (of_machine_is_compatible("lantiq,ar9"))
++		phy_set_max_speed(phydev, SPEED_1000);
++	else
++		phy_set_max_speed(phydev, SPEED_100);
+ 
+ 	phy_attached_info(phydev);
+ 
+@@ -378,8 +563,13 @@ ltq_etop_mdio_init(struct net_device *de
+ 	}
+ 
+ 	priv->mii_bus->priv = dev;
+-	priv->mii_bus->read = ltq_etop_mdio_rd;
+-	priv->mii_bus->write = ltq_etop_mdio_wr;
++	if (of_machine_is_compatible("lantiq,ar9")) {
++		priv->mii_bus->read = ltq_etop_mdio_rd_xr9;
++		priv->mii_bus->write = ltq_etop_mdio_wr_xr9;
++	} else {
++		priv->mii_bus->read = ltq_etop_mdio_rd;
++		priv->mii_bus->write = ltq_etop_mdio_wr;
++	}
+ 	priv->mii_bus->name = "ltq_mii";
+ 	snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
+ 		priv->pdev->name, priv->pdev->id);
+@@ -416,18 +606,21 @@ static int
+ ltq_etop_open(struct net_device *dev)
+ {
+ 	struct ltq_etop_priv *priv = netdev_priv(dev);
+-	int i;
++	unsigned long flags;
+ 
+-	for (i = 0; i < MAX_DMA_CHAN; i++) {
+-		struct ltq_etop_chan *ch = &priv->ch[i];
++	napi_enable(&priv->txch.napi);
++	napi_enable(&priv->rxch.napi);
++
++	spin_lock_irqsave(&priv->lock, flags);
++	ltq_dma_open(&priv->txch.dma);
++	ltq_dma_enable_irq(&priv->txch.dma);
++	ltq_dma_open(&priv->rxch.dma);
++	ltq_dma_enable_irq(&priv->rxch.dma);
++	spin_unlock_irqrestore(&priv->lock, flags);
++
++	if (dev->phydev)
++		phy_start(dev->phydev);
+ 
+-		if (!IS_TX(i) && (!IS_RX(i)))
+-			continue;
+-		ltq_dma_open(&ch->dma);
+-		ltq_dma_enable_irq(&ch->dma);
+-		napi_enable(&ch->napi);
+-	}
+-	phy_start(dev->phydev);
+ 	netif_tx_start_all_queues(dev);
+ 	return 0;
+ }
+@@ -436,18 +629,19 @@ static int
+ ltq_etop_stop(struct net_device *dev)
+ {
+ 	struct ltq_etop_priv *priv = netdev_priv(dev);
+-	int i;
++	unsigned long flags;
+ 
+ 	netif_tx_stop_all_queues(dev);
+-	phy_stop(dev->phydev);
+-	for (i = 0; i < MAX_DMA_CHAN; i++) {
+-		struct ltq_etop_chan *ch = &priv->ch[i];
+-
+-		if (!IS_RX(i) && !IS_TX(i))
+-			continue;
+-		napi_disable(&ch->napi);
+-		ltq_dma_close(&ch->dma);
+-	}
++	if (dev->phydev)
++		phy_stop(dev->phydev);
++	napi_disable(&priv->txch.napi);
++	napi_disable(&priv->rxch.napi);
++
++	spin_lock_irqsave(&priv->lock, flags);
++	ltq_dma_close(&priv->txch.dma);
++	ltq_dma_close(&priv->rxch.dma);
++	spin_unlock_irqrestore(&priv->lock, flags);
++
+ 	return 0;
+ }
+ 
+@@ -457,15 +651,16 @@ ltq_etop_tx(struct sk_buff *skb, struct
+ 	int queue = skb_get_queue_mapping(skb);
+ 	struct netdev_queue *txq = netdev_get_tx_queue(dev, queue);
+ 	struct ltq_etop_priv *priv = netdev_priv(dev);
+-	struct ltq_etop_chan *ch = &priv->ch[(queue << 1) | 1];
+-	struct ltq_dma_desc *desc = &ch->dma.desc_base[ch->dma.desc];
+-	int len;
++	struct ltq_dma_desc *desc =
++		&priv->txch.dma.desc_base[priv->txch.dma.desc];
+ 	unsigned long flags;
+ 	u32 byte_offset;
++	int len;
+ 
+ 	len = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len;
+ 
+-	if ((desc->ctl & (LTQ_DMA_OWN | LTQ_DMA_C)) || ch->skb[ch->dma.desc]) {
++	if ((desc->ctl & (LTQ_DMA_OWN | LTQ_DMA_C)) ||
++			priv->txch.skb[priv->txch.dma.desc]) {
+ 		netdev_err(dev, "tx ring full\n");
+ 		netif_tx_stop_queue(txq);
+ 		return NETDEV_TX_BUSY;
+@@ -473,7 +668,7 @@ ltq_etop_tx(struct sk_buff *skb, struct
+ 
+ 	/* dma needs to start on a 16 byte aligned address */
+ 	byte_offset = CPHYSADDR(skb->data) % 16;
+-	ch->skb[ch->dma.desc] = skb;
++	priv->txch.skb[priv->txch.dma.desc] = skb;
+ 
+ 	netif_trans_update(dev);
+ 
+@@ -483,11 +678,11 @@ ltq_etop_tx(struct sk_buff *skb, struct
+ 	wmb();
+ 	desc->ctl = LTQ_DMA_OWN | LTQ_DMA_SOP | LTQ_DMA_EOP |
+ 		LTQ_DMA_TX_OFFSET(byte_offset) | (len & LTQ_DMA_SIZE_MASK);
+-	ch->dma.desc++;
+-	ch->dma.desc %= LTQ_DESC_NUM;
++	priv->txch.dma.desc++;
++	priv->txch.dma.desc %= LTQ_DESC_NUM;
+ 	spin_unlock_irqrestore(&priv->lock, flags);
+ 
+-	if (ch->dma.desc_base[ch->dma.desc].ctl & LTQ_DMA_OWN)
++	if (priv->txch.dma.desc_base[priv->txch.dma.desc].ctl & LTQ_DMA_OWN)
+ 		netif_tx_stop_queue(txq);
+ 
+ 	return NETDEV_TX_OK;
+@@ -498,11 +693,14 @@ ltq_etop_change_mtu(struct net_device *d
+ {
+ 	struct ltq_etop_priv *priv = netdev_priv(dev);
+ 	unsigned long flags;
++	int max;
+ 
+ 	dev->mtu = new_mtu;
+ 
++	max = ETH_HLEN + VLAN_HLEN + new_mtu + ETH_FCS_LEN;
++
+ 	spin_lock_irqsave(&priv->lock, flags);
+-	ltq_etop_w32((ETOP_PLEN_UNDER << 16) | new_mtu, LTQ_ETOP_IGPLEN);
++	ltq_etop_w32((ETOP_PLEN_UNDER << 16) | max, LTQ_ETOP_IGPLEN);
+ 	spin_unlock_irqrestore(&priv->lock, flags);
+ 
+ 	return 0;
+@@ -555,6 +753,9 @@ ltq_etop_init(struct net_device *dev)
+ 	if (err)
+ 		goto err_hw;
+ 	ltq_etop_change_mtu(dev, 1500);
++	err = ltq_etop_dma_init(dev);
++	if (err)
++		goto err_hw;
+ 
+ 	memcpy(&mac, &priv->pldata->mac, sizeof(struct sockaddr));
+ 	if (!is_valid_ether_addr(mac.sa_data)) {
+@@ -572,9 +773,10 @@ ltq_etop_init(struct net_device *dev)
+ 		dev->addr_assign_type = NET_ADDR_RANDOM;
+ 
+ 	ltq_etop_set_multicast_list(dev);
+-	err = ltq_etop_mdio_init(dev);
+-	if (err)
+-		goto err_netdev;
++	if (!ltq_etop_mdio_init(dev))
++		dev->ethtool_ops = &ltq_etop_ethtool_ops;
++	else
++		pr_warn("etop: mdio probe failed\n");;
+ 	return 0;
+ 
+ err_netdev:
+@@ -594,6 +796,9 @@ ltq_etop_tx_timeout(struct net_device *d
+ 	err = ltq_etop_hw_init(dev);
+ 	if (err)
+ 		goto err_hw;
++	err = ltq_etop_dma_init(dev);
++	if (err)
++		goto err_hw;
+ 	netif_trans_update(dev);
+ 	netif_wake_queue(dev);
+ 	return;
+@@ -617,14 +822,18 @@ static const struct net_device_ops ltq_e
+ 	.ndo_tx_timeout = ltq_etop_tx_timeout,
+ };
+ 
+-static int __init
+-ltq_etop_probe(struct platform_device *pdev)
++static int ltq_etop_probe(struct platform_device *pdev)
+ {
+ 	struct net_device *dev;
+ 	struct ltq_etop_priv *priv;
+-	struct resource *res;
++	struct resource *res, *gbit_res, irqres[2];
+ 	int err;
+-	int i;
++
++	err = of_irq_to_resource_table(pdev->dev.of_node, irqres, 2);
++	if (err != 2) {
++		dev_err(&pdev->dev, "failed to get etop irqs\n");
++		return -EINVAL;
++	}
+ 
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	if (!res) {
+@@ -650,31 +859,62 @@ ltq_etop_probe(struct platform_device *p
+ 		goto err_out;
+ 	}
+ 
+-	dev = alloc_etherdev_mq(sizeof(struct ltq_etop_priv), 4);
+-	if (!dev) {
+-		err = -ENOMEM;
+-		goto err_out;
++	if (of_machine_is_compatible("lantiq,ar9")) {
++		gbit_res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
++		if (!gbit_res) {
++			dev_err(&pdev->dev, "failed to get gbit resource\n");
++			err = -ENOENT;
++			goto err_out;
++		}
++		ltq_gbit_membase = devm_ioremap(&pdev->dev,
++			gbit_res->start, resource_size(gbit_res));
++		if (!ltq_gbit_membase) {
++			dev_err(&pdev->dev, "failed to remap gigabit switch %d\n",
++				pdev->id);
++			err = -ENOMEM;
++			goto err_out;
++		}
+ 	}
++
++	dev = alloc_etherdev_mq(sizeof(struct ltq_etop_priv), 4);
+ 	strcpy(dev->name, "eth%d");
+ 	dev->netdev_ops = &ltq_eth_netdev_ops;
+-	dev->ethtool_ops = &ltq_etop_ethtool_ops;
+ 	priv = netdev_priv(dev);
+ 	priv->res = res;
+ 	priv->pdev = pdev;
+-	priv->pldata = dev_get_platdata(&pdev->dev);
+ 	priv->netdev = dev;
++	priv->tx_irq = irqres[0].start;
++	priv->rx_irq = irqres[1].start;
++	err = of_get_phy_mode(pdev->dev.of_node, &priv->mii_mode);
++	if (err)
++		pr_err("Can't find phy-mode for port\n");
++
++	of_get_mac_address(pdev->dev.of_node, priv->mac);
++
++	priv->clk_ppe = clk_get(&pdev->dev, NULL);
++	if (IS_ERR(priv->clk_ppe))
++		return PTR_ERR(priv->clk_ppe);
++	if (of_machine_is_compatible("lantiq,ar9")) {
++		priv->clk_switch = clk_get(&pdev->dev, "switch");
++		if (IS_ERR(priv->clk_switch))
++			return PTR_ERR(priv->clk_switch);
++	}
++	if (of_machine_is_compatible("lantiq,ase")) {
++		priv->clk_ephy = clk_get(&pdev->dev, "ephy");
++		if (IS_ERR(priv->clk_ephy))
++			return PTR_ERR(priv->clk_ephy);
++		priv->clk_ephycgu = clk_get(&pdev->dev, "ephycgu");
++		if (IS_ERR(priv->clk_ephycgu))
++			return PTR_ERR(priv->clk_ephycgu);
++	}
++
+ 	spin_lock_init(&priv->lock);
+ 	SET_NETDEV_DEV(dev, &pdev->dev);
+ 
+-	for (i = 0; i < MAX_DMA_CHAN; i++) {
+-		if (IS_TX(i))
+-			netif_napi_add(dev, &priv->ch[i].napi,
+-				ltq_etop_poll_tx, 8);
+-		else if (IS_RX(i))
+-			netif_napi_add(dev, &priv->ch[i].napi,
+-				ltq_etop_poll_rx, 32);
+-		priv->ch[i].netdev = dev;
+-	}
++	netif_napi_add(dev, &priv->txch.napi, ltq_etop_poll_tx, 8);
++	netif_napi_add(dev, &priv->rxch.napi, ltq_etop_poll_rx, 32);
++	priv->txch.netdev = dev;
++	priv->rxch.netdev = dev;
+ 
+ 	err = register_netdev(dev);
+ 	if (err)
+@@ -703,31 +943,22 @@ ltq_etop_remove(struct platform_device *
+ 	return 0;
+ }
+ 
++static const struct of_device_id ltq_etop_match[] = {
++	{ .compatible = "lantiq,etop-xway" },
++	{},
++};
++MODULE_DEVICE_TABLE(of, ltq_etop_match);
++
+ static struct platform_driver ltq_mii_driver = {
++	.probe = ltq_etop_probe,
+ 	.remove = ltq_etop_remove,
+ 	.driver = {
+ 		.name = "ltq_etop",
++		.of_match_table = ltq_etop_match,
+ 	},
+ };
+ 
+-int __init
+-init_ltq_etop(void)
+-{
+-	int ret = platform_driver_probe(&ltq_mii_driver, ltq_etop_probe);
+-
+-	if (ret)
+-		pr_err("ltq_etop: Error registering platform driver!");
+-	return ret;
+-}
+-
+-static void __exit
+-exit_ltq_etop(void)
+-{
+-	platform_driver_unregister(&ltq_mii_driver);
+-}
+-
+-module_init(init_ltq_etop);
+-module_exit(exit_ltq_etop);
++module_platform_driver(ltq_mii_driver);
+ 
+ MODULE_AUTHOR("John Crispin <blogic@openwrt.org>");
+ MODULE_DESCRIPTION("Lantiq SoC ETOP");
diff --git a/target/linux/lantiq/patches-5.15/0031-I2C-MIPS-lantiq-add-FALC-ON-i2c-bus-master.patch b/target/linux/lantiq/patches-5.15/0031-I2C-MIPS-lantiq-add-FALC-ON-i2c-bus-master.patch
new file mode 100644
index 00000000000000..2d3b4e2996b2c4
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0031-I2C-MIPS-lantiq-add-FALC-ON-i2c-bus-master.patch
@@ -0,0 +1,1034 @@
+From f17e50f67fa3c77624edf2ca03fae0d50f0ce39b Mon Sep 17 00:00:00 2001
+From: John Crispin <blogic@openwrt.org>
+Date: Thu, 7 Aug 2014 18:26:42 +0200
+Subject: [PATCH 31/36] I2C: MIPS: lantiq: add FALC-ON i2c bus master
+
+This patch adds the driver needed to make the I2C bus work on FALC-ON SoCs.
+
+Signed-off-by: Thomas Langer <thomas.langer@lantiq.com>
+Signed-off-by: John Crispin <blogic@openwrt.org>
+---
+ drivers/i2c/busses/Kconfig      |   10 +
+ drivers/i2c/busses/Makefile     |    1 +
+ drivers/i2c/busses/i2c-lantiq.c |  747 +++++++++++++++++++++++++++++++++++++++
+ drivers/i2c/busses/i2c-lantiq.h |  234 ++++++++++++
+ 4 files changed, 992 insertions(+)
+ create mode 100644 drivers/i2c/busses/i2c-lantiq.c
+ create mode 100644 drivers/i2c/busses/i2c-lantiq.h
+
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -757,6 +757,16 @@ config I2C_MESON
+ 	  If you say yes to this option, support will be included for the
+ 	  I2C interface on the Amlogic Meson family of SoCs.
+ 
++config I2C_LANTIQ
++	tristate "Lantiq I2C interface"
++	depends on LANTIQ && SOC_FALCON
++	help
++	  If you say yes to this option, support will be included for the
++	  Lantiq I2C core.
++
++	  This driver can also be built as a module. If so, the module
++	  will be called i2c-lantiq.
++
+ config I2C_MPC
+ 	tristate "MPC107/824x/85xx/512x/52xx/83xx/86xx"
+ 	depends on PPC
+--- a/drivers/i2c/busses/Makefile
++++ b/drivers/i2c/busses/Makefile
+@@ -72,6 +72,7 @@ obj-$(CONFIG_I2C_IMX_LPI2C)	+= i2c-imx-l
+ obj-$(CONFIG_I2C_IOP3XX)	+= i2c-iop3xx.o
+ obj-$(CONFIG_I2C_JZ4780)	+= i2c-jz4780.o
+ obj-$(CONFIG_I2C_KEMPLD)	+= i2c-kempld.o
++obj-$(CONFIG_I2C_LANTIQ)	+= i2c-lantiq.o
+ obj-$(CONFIG_I2C_LPC2K)		+= i2c-lpc2k.o
+ obj-$(CONFIG_I2C_MESON)		+= i2c-meson.o
+ obj-$(CONFIG_I2C_MPC)		+= i2c-mpc.o
+--- /dev/null
++++ b/drivers/i2c/busses/i2c-lantiq.c
+@@ -0,0 +1,747 @@
++
++/*
++ * Lantiq I2C bus adapter
++ *
++ * Parts based on i2c-designware.c and other i2c drivers from Linux 2.6.33
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
++ *
++ * Copyright (C) 2012 Thomas Langer <thomas.langer@lantiq.com>
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/delay.h>
++#include <linux/slab.h> /* for kzalloc, kfree */
++#include <linux/i2c.h>
++#include <linux/errno.h>
++#include <linux/completion.h>
++#include <linux/interrupt.h>
++#include <linux/platform_device.h>
++#include <linux/io.h>
++#include <linux/of_irq.h>
++
++#include <lantiq_soc.h>
++#include "i2c-lantiq.h"
++
++/*
++ * CURRENT ISSUES:
++ * - no high speed support
++ * - ten bit mode is not tested (no slave devices)
++ */
++
++/* access macros */
++#define i2c_r32(reg)	\
++	__raw_readl(&(priv->membase)->reg)
++#define i2c_w32(val, reg)	\
++	__raw_writel(val, &(priv->membase)->reg)
++#define i2c_w32_mask(clear, set, reg)	\
++	i2c_w32((i2c_r32(reg) & ~(clear)) | (set), reg)
++
++#define DRV_NAME "i2c-lantiq"
++#define DRV_VERSION "1.00"
++
++#define LTQ_I2C_BUSY_TIMEOUT		20 /* ms */
++
++#ifdef DEBUG
++#define LTQ_I2C_XFER_TIMEOUT		(25*HZ)
++#else
++#define LTQ_I2C_XFER_TIMEOUT		HZ
++#endif
++
++#define LTQ_I2C_IMSC_DEFAULT_MASK	(I2C_IMSC_I2C_P_INT_EN | \
++					 I2C_IMSC_I2C_ERR_INT_EN)
++
++#define LTQ_I2C_ARB_LOST		(1 << 0)
++#define LTQ_I2C_NACK			(1 << 1)
++#define LTQ_I2C_RX_UFL			(1 << 2)
++#define LTQ_I2C_RX_OFL			(1 << 3)
++#define LTQ_I2C_TX_UFL			(1 << 4)
++#define LTQ_I2C_TX_OFL			(1 << 5)
++
++struct ltq_i2c {
++	struct mutex mutex;
++
++
++	/* active clock settings */
++	unsigned int input_clock;	/* clock input for i2c hardware block */
++	unsigned int i2c_clock;		/* approximated bus clock in kHz */
++
++	struct clk *clk_gate;
++	struct clk *clk_input;
++
++
++	/* resources (memory and interrupts) */
++	int irq_lb;				/* last burst irq */
++
++	struct lantiq_reg_i2c __iomem *membase;	/* base of mapped registers */
++
++	struct i2c_adapter adap;
++	struct device *dev;
++
++	struct completion cmd_complete;
++
++
++	/* message transfer data */
++	struct i2c_msg *current_msg;	/* current message */
++	int msgs_num;		/* number of messages to handle */
++	u8 *msg_buf;		/* current buffer */
++	u32 msg_buf_len;	/* remaining length of current buffer */
++	int msg_err;		/* error status of the current transfer */
++
++
++	/* master status codes */
++	enum {
++		STATUS_IDLE,
++		STATUS_ADDR,	/* address phase */
++		STATUS_WRITE,
++		STATUS_READ,
++		STATUS_READ_END,
++		STATUS_STOP
++	} status;
++};
++
++static irqreturn_t ltq_i2c_isr(int irq, void *dev_id);
++
++static inline void enable_burst_irq(struct ltq_i2c *priv)
++{
++	i2c_w32_mask(0, I2C_IMSC_LBREQ_INT_EN | I2C_IMSC_BREQ_INT_EN, imsc);
++}
++static inline void disable_burst_irq(struct ltq_i2c *priv)
++{
++	i2c_w32_mask(I2C_IMSC_LBREQ_INT_EN | I2C_IMSC_BREQ_INT_EN, 0, imsc);
++}
++
++static void prepare_msg_send_addr(struct ltq_i2c *priv)
++{
++	struct i2c_msg *msg = priv->current_msg;
++	int rd = !!(msg->flags & I2C_M_RD);	/* extends to 0 or 1 */
++	u16 addr = msg->addr;
++
++	/* new i2c_msg */
++	priv->msg_buf = msg->buf;
++	priv->msg_buf_len = msg->len;
++	if (rd)
++		priv->status = STATUS_READ;
++	else
++		priv->status = STATUS_WRITE;
++
++	/* send slave address */
++	if (msg->flags & I2C_M_TEN) {
++		i2c_w32(0xf0 | ((addr & 0x300) >> 7) | rd, txd);
++		i2c_w32(addr & 0xff, txd);
++	} else {
++		i2c_w32((addr & 0x7f) << 1 | rd, txd);
++	}
++}
++
++static void ltq_i2c_set_tx_len(struct ltq_i2c *priv)
++{
++	struct i2c_msg *msg = priv->current_msg;
++	int len = (msg->flags & I2C_M_TEN) ? 2 : 1;
++
++	pr_debug("set_tx_len %cX\n", (msg->flags & I2C_M_RD) ? 'R' : 'T');
++
++	priv->status = STATUS_ADDR;
++
++	if (!(msg->flags & I2C_M_RD))
++		len += msg->len;
++	else
++		/* set maximum received packet size (before rx int!) */
++		i2c_w32(msg->len, mrps_ctrl);
++	i2c_w32(len, tps_ctrl);
++	enable_burst_irq(priv);
++}
++
++static int ltq_i2c_hw_set_clock(struct i2c_adapter *adap)
++{
++	struct ltq_i2c *priv = i2c_get_adapdata(adap);
++	unsigned int input_clock = clk_get_rate(priv->clk_input);
++	u32 dec, inc = 1;
++
++	/* clock changed? */
++	if (priv->input_clock == input_clock)
++		return 0;
++
++	/*
++	 * this formula is only an approximation, found by the recommended
++	 * values in the "I2C Architecture Specification 1.7.1"
++	 */
++	dec = input_clock / (priv->i2c_clock * 2);
++	if (dec <= 6)
++		return -ENXIO;
++
++	i2c_w32(0, fdiv_high_cfg);
++	i2c_w32((inc << I2C_FDIV_CFG_INC_OFFSET) |
++		(dec << I2C_FDIV_CFG_DEC_OFFSET),
++		fdiv_cfg);
++
++	dev_info(priv->dev, "setup clocks (in %d kHz, bus %d kHz, dec=%d)\n",
++		input_clock, priv->i2c_clock, dec);
++
++	priv->input_clock = input_clock;
++	return 0;
++}
++
++static int ltq_i2c_hw_init(struct i2c_adapter *adap)
++{
++	int ret = 0;
++	struct ltq_i2c *priv = i2c_get_adapdata(adap);
++
++	/* disable bus */
++	i2c_w32_mask(I2C_RUN_CTRL_RUN_EN, 0, run_ctrl);
++
++#ifndef DEBUG
++	/* set normal operation clock divider */
++	i2c_w32(1 << I2C_CLC_RMC_OFFSET, clc);
++#else
++	/* for debugging a higher divider value! */
++	i2c_w32(0xF0 << I2C_CLC_RMC_OFFSET, clc);
++#endif
++
++	/* setup clock */
++	ret = ltq_i2c_hw_set_clock(adap);
++	if (ret != 0) {
++		dev_warn(priv->dev, "invalid clock settings\n");
++		return ret;
++	}
++
++	/* configure fifo */
++	i2c_w32(I2C_FIFO_CFG_TXFC | /* tx fifo as flow controller */
++		I2C_FIFO_CFG_RXFC | /* rx fifo as flow controller */
++		I2C_FIFO_CFG_TXFA_TXFA2 | /* tx fifo 4-byte aligned */
++		I2C_FIFO_CFG_RXFA_RXFA2 | /* rx fifo 4-byte aligned */
++		I2C_FIFO_CFG_TXBS_TXBS0 | /* tx fifo burst size is 1 word */
++		I2C_FIFO_CFG_RXBS_RXBS0,  /* rx fifo burst size is 1 word */
++		fifo_cfg);
++
++	/* configure address */
++	i2c_w32(I2C_ADDR_CFG_SOPE_EN |	/* generate stop when no more data in
++					   the fifo */
++		I2C_ADDR_CFG_SONA_EN |	/* generate stop when NA received */
++		I2C_ADDR_CFG_MnS_EN |	/* we are master device */
++		0,			/* our slave address (not used!) */
++		addr_cfg);
++
++	/* enable bus */
++	i2c_w32_mask(0, I2C_RUN_CTRL_RUN_EN, run_ctrl);
++
++	return 0;
++}
++
++static int ltq_i2c_wait_bus_not_busy(struct ltq_i2c *priv)
++{
++	unsigned long timeout;
++
++	timeout = jiffies + msecs_to_jiffies(LTQ_I2C_BUSY_TIMEOUT);
++
++	do {
++		u32 stat = i2c_r32(bus_stat);
++
++		if ((stat & I2C_BUS_STAT_BS_MASK) == I2C_BUS_STAT_BS_FREE)
++			return 0;
++
++		cond_resched();
++	} while (!time_after_eq(jiffies, timeout));
++
++	dev_err(priv->dev, "timeout waiting for bus ready\n");
++	return -ETIMEDOUT;
++}
++
++static void ltq_i2c_tx(struct ltq_i2c *priv, int last)
++{
++	if (priv->msg_buf_len && priv->msg_buf) {
++		i2c_w32(*priv->msg_buf, txd);
++
++		if (--priv->msg_buf_len)
++			priv->msg_buf++;
++		else
++			priv->msg_buf = NULL;
++	} else {
++		last = 1;
++	}
++
++	if (last)
++		disable_burst_irq(priv);
++}
++
++static void ltq_i2c_rx(struct ltq_i2c *priv, int last)
++{
++	u32 fifo_stat, timeout;
++	if (priv->msg_buf_len && priv->msg_buf) {
++		timeout = 5000000;
++		do {
++			fifo_stat = i2c_r32(ffs_stat);
++		} while (!fifo_stat && --timeout);
++		if (!timeout) {
++			last = 1;
++			pr_debug("\nrx timeout\n");
++			goto err;
++		}
++		while (fifo_stat) {
++			*priv->msg_buf = i2c_r32(rxd);
++			if (--priv->msg_buf_len) {
++				priv->msg_buf++;
++			} else {
++				priv->msg_buf = NULL;
++				last = 1;
++				break;
++			}
++			/*
++			 * do not read more than burst size, otherwise no "last
++			 * burst" is generated and the transaction is blocked!
++			 */
++			fifo_stat = 0;
++		}
++	} else {
++		last = 1;
++	}
++err:
++	if (last) {
++		disable_burst_irq(priv);
++
++		if (priv->status == STATUS_READ_END) {
++			/* 
++			 * do the STATUS_STOP and complete() here, as sometimes
++			 * the tx_end is already seen before this is finished
++			 */
++			priv->status = STATUS_STOP;
++			complete(&priv->cmd_complete);
++		} else {
++			i2c_w32(I2C_ENDD_CTRL_SETEND, endd_ctrl);
++			priv->status = STATUS_READ_END;
++		}
++	}
++}
++
++static void ltq_i2c_xfer_init(struct ltq_i2c *priv)
++{
++	/* enable interrupts */
++	i2c_w32(LTQ_I2C_IMSC_DEFAULT_MASK, imsc);
++
++	/* trigger transfer of first msg */
++	ltq_i2c_set_tx_len(priv);
++}
++
++static void dump_msgs(struct i2c_msg msgs[], int num, int rx)
++{
++#if defined(DEBUG)
++	int i, j;
++	pr_debug("Messages %d %s\n", num, rx ? "out" : "in");
++	for (i = 0; i < num; i++) {
++		pr_debug("%2d %cX Msg(%d) addr=0x%X: ", i,
++			(msgs[i].flags & I2C_M_RD) ? 'R' : 'T',
++			msgs[i].len, msgs[i].addr);
++		if (!(msgs[i].flags & I2C_M_RD) || rx) {
++			for (j = 0; j < msgs[i].len; j++)
++				pr_debug("%02X ", msgs[i].buf[j]);
++		}
++		pr_debug("\n");
++	}
++#endif
++}
++
++static void ltq_i2c_release_bus(struct ltq_i2c *priv)
++{
++	if ((i2c_r32(bus_stat) & I2C_BUS_STAT_BS_MASK) == I2C_BUS_STAT_BS_BM)
++		i2c_w32(I2C_ENDD_CTRL_SETEND, endd_ctrl);
++}
++
++static int ltq_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
++			   int num)
++{
++	struct ltq_i2c *priv = i2c_get_adapdata(adap);
++	int ret;
++
++	dev_dbg(priv->dev, "xfer %u messages\n", num);
++	dump_msgs(msgs, num, 0);
++
++	mutex_lock(&priv->mutex);
++
++	init_completion(&priv->cmd_complete);
++	priv->current_msg = msgs;
++	priv->msgs_num = num;
++	priv->msg_err = 0;
++	priv->status = STATUS_IDLE;
++
++	/* wait for the bus to become ready */
++	ret = ltq_i2c_wait_bus_not_busy(priv);
++	if (ret)
++		goto done;
++
++	while (priv->msgs_num) {
++		/* start the transfers */
++		ltq_i2c_xfer_init(priv);
++
++		/* wait for transfers to complete */
++		ret = wait_for_completion_interruptible_timeout(
++			&priv->cmd_complete, LTQ_I2C_XFER_TIMEOUT);
++		if (ret == 0) {
++			dev_err(priv->dev, "controller timed out\n");
++			ltq_i2c_hw_init(adap);
++			ret = -ETIMEDOUT;
++			goto done;
++		} else if (ret < 0)
++			goto done;
++
++		if (priv->msg_err) {
++			if (priv->msg_err & LTQ_I2C_NACK)
++				ret = -ENXIO;
++			else
++				ret = -EREMOTEIO;
++			goto done;
++		}
++		if (--priv->msgs_num)
++			priv->current_msg++;
++	}
++	/* no error? */
++	ret = num;
++
++done:
++	ltq_i2c_release_bus(priv);
++
++	mutex_unlock(&priv->mutex);
++
++	if (ret >= 0)
++		dump_msgs(msgs, num, 1);
++
++	pr_debug("XFER ret %d\n", ret);
++	return ret;
++}
++
++static irqreturn_t ltq_i2c_isr_burst(int irq, void *dev_id)
++{
++	struct ltq_i2c *priv = dev_id;
++	struct i2c_msg *msg = priv->current_msg;
++	int last = (irq == priv->irq_lb);
++
++	if (last)
++		pr_debug("LB ");
++	else
++		pr_debug("B ");
++
++	if (msg->flags & I2C_M_RD) {
++		switch (priv->status) {
++		case STATUS_ADDR:
++			pr_debug("X");
++			prepare_msg_send_addr(priv);
++			disable_burst_irq(priv);
++			break;
++		case STATUS_READ:
++		case STATUS_READ_END:
++			pr_debug("R");
++			ltq_i2c_rx(priv, last);
++			break;
++		default:
++			disable_burst_irq(priv);
++			pr_warn("Status R %d\n", priv->status);
++			break;
++		}
++	} else {
++		switch (priv->status) {
++		case STATUS_ADDR:
++			pr_debug("x");
++			prepare_msg_send_addr(priv);
++			break;
++		case STATUS_WRITE:
++			pr_debug("w");
++			ltq_i2c_tx(priv, last);
++			break;
++		default:
++			disable_burst_irq(priv);
++			pr_warn("Status W %d\n", priv->status);
++			break;
++		}
++	}
++
++	i2c_w32(I2C_ICR_BREQ_INT_CLR | I2C_ICR_LBREQ_INT_CLR, icr);
++	return IRQ_HANDLED;
++}
++
++static void ltq_i2c_isr_prot(struct ltq_i2c *priv)
++{
++	u32 i_pro = i2c_r32(p_irqss);
++
++	pr_debug("i2c-p");
++
++	/* not acknowledge */
++	if (i_pro & I2C_P_IRQSS_NACK) {
++		priv->msg_err |= LTQ_I2C_NACK;
++		pr_debug(" nack");
++	}
++
++	/* arbitration lost */
++	if (i_pro & I2C_P_IRQSS_AL) {
++		priv->msg_err |= LTQ_I2C_ARB_LOST;
++		pr_debug(" arb-lost");
++	}
++	/* tx -> rx switch */
++	if (i_pro & I2C_P_IRQSS_RX)
++		pr_debug(" rx");
++
++	/* tx end */
++	if (i_pro & I2C_P_IRQSS_TX_END)
++		pr_debug(" txend");
++	pr_debug("\n");
++
++	if (!priv->msg_err) {
++		/* tx -> rx switch */
++		if (i_pro & I2C_P_IRQSS_RX) {
++			priv->status = STATUS_READ;
++			enable_burst_irq(priv);
++		}
++		if (i_pro & I2C_P_IRQSS_TX_END) {
++			if (priv->status == STATUS_READ)
++				priv->status = STATUS_READ_END;
++			else {
++				disable_burst_irq(priv);
++				priv->status = STATUS_STOP;
++			}
++		}
++	}
++
++	i2c_w32(i_pro, p_irqsc);
++}
++
++static irqreturn_t ltq_i2c_isr(int irq, void *dev_id)
++{
++	u32 i_raw, i_err = 0;
++	struct ltq_i2c *priv = dev_id;
++
++	i_raw = i2c_r32(mis);
++	pr_debug("i_raw 0x%08X\n", i_raw);
++
++	/* error interrupt */
++	if (i_raw & I2C_RIS_I2C_ERR_INT_INTOCC) {
++		i_err = i2c_r32(err_irqss);
++		pr_debug("i_err 0x%08X bus_stat 0x%04X\n",
++			i_err, i2c_r32(bus_stat));
++
++		/* tx fifo overflow (8) */
++		if (i_err & I2C_ERR_IRQSS_TXF_OFL)
++			priv->msg_err |= LTQ_I2C_TX_OFL;
++
++		/* tx fifo underflow (4) */
++		if (i_err & I2C_ERR_IRQSS_TXF_UFL)
++			priv->msg_err |= LTQ_I2C_TX_UFL;
++
++		/* rx fifo overflow (2) */
++		if (i_err & I2C_ERR_IRQSS_RXF_OFL)
++			priv->msg_err |= LTQ_I2C_RX_OFL;
++
++		/* rx fifo underflow (1) */
++		if (i_err & I2C_ERR_IRQSS_RXF_UFL)
++			priv->msg_err |= LTQ_I2C_RX_UFL;
++
++		i2c_w32(i_err, err_irqsc);
++	}
++
++	/* protocol interrupt */
++	if (i_raw & I2C_RIS_I2C_P_INT_INTOCC)
++		ltq_i2c_isr_prot(priv);
++
++	if ((priv->msg_err) || (priv->status == STATUS_STOP))
++		complete(&priv->cmd_complete);
++
++	return IRQ_HANDLED;
++}
++
++static u32 ltq_i2c_functionality(struct i2c_adapter *adap)
++{
++	return	I2C_FUNC_I2C |
++		I2C_FUNC_10BIT_ADDR |
++		I2C_FUNC_SMBUS_EMUL;
++}
++
++static struct i2c_algorithm ltq_i2c_algorithm = {
++	.master_xfer	= ltq_i2c_xfer,
++	.functionality	= ltq_i2c_functionality,
++};
++
++static int ltq_i2c_probe(struct platform_device *pdev)
++{
++	struct device_node *node = pdev->dev.of_node;
++	struct ltq_i2c *priv;
++	struct i2c_adapter *adap;
++	struct resource *mmres, irqres[4];
++	int ret = 0;
++
++	dev_dbg(&pdev->dev, "probing\n");
++
++	mmres = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	ret = of_irq_to_resource_table(node, irqres, 4);
++	if (!mmres || (ret != 4)) {
++		dev_err(&pdev->dev, "no resources\n");
++		return -ENODEV;
++	}
++
++	/* allocate private data */
++	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv) {
++		dev_err(&pdev->dev, "can't allocate private data\n");
++		return -ENOMEM;
++	}
++
++	adap = &priv->adap;
++	i2c_set_adapdata(adap, priv);
++	adap->owner = THIS_MODULE;
++	adap->class = I2C_CLASS_HWMON | I2C_CLASS_SPD;
++	strlcpy(adap->name, DRV_NAME "-adapter", sizeof(adap->name));
++	adap->algo = &ltq_i2c_algorithm;
++	adap->dev.parent = &pdev->dev;
++	adap->dev.of_node = pdev->dev.of_node;
++
++	if (of_property_read_u32(node, "clock-frequency", &priv->i2c_clock)) {
++		dev_warn(&pdev->dev, "No I2C speed selected, using 100kHz\n");
++		priv->i2c_clock = 100000;
++	}
++
++	init_completion(&priv->cmd_complete);
++	mutex_init(&priv->mutex);
++
++	priv->membase = devm_ioremap_resource(&pdev->dev, mmres);
++	if (IS_ERR(priv->membase))
++		return PTR_ERR(priv->membase);
++
++	priv->dev = &pdev->dev;
++	priv->irq_lb = irqres[0].start;
++
++	ret = devm_request_irq(&pdev->dev, irqres[0].start, ltq_i2c_isr_burst,
++		0x0, "i2c lb", priv);
++	if (ret) {
++		dev_err(&pdev->dev, "can't get last burst IRQ %d\n",
++			irqres[0].start);
++		return -ENODEV;
++	}
++
++	ret = devm_request_irq(&pdev->dev, irqres[1].start, ltq_i2c_isr_burst,
++		0x0, "i2c b", priv);
++	if (ret) {
++		dev_err(&pdev->dev, "can't get burst IRQ %d\n",
++			irqres[1].start);
++		return -ENODEV;
++	}
++
++	ret = devm_request_irq(&pdev->dev, irqres[2].start, ltq_i2c_isr,
++		0x0, "i2c err", priv);
++	if (ret) {
++		dev_err(&pdev->dev, "can't get error IRQ %d\n",
++			irqres[2].start);
++		return -ENODEV;
++	}
++
++	ret = devm_request_irq(&pdev->dev, irqres[3].start, ltq_i2c_isr,
++		0x0, "i2c p", priv);
++	if (ret) {
++		dev_err(&pdev->dev, "can't get protocol IRQ %d\n",
++			irqres[3].start);
++		return -ENODEV;
++	}
++
++	dev_dbg(&pdev->dev, "mapped io-space to %p\n", priv->membase);
++	dev_dbg(&pdev->dev, "use IRQs %d, %d, %d, %d\n", irqres[0].start,
++		irqres[1].start, irqres[2].start, irqres[3].start);
++
++	priv->clk_gate = devm_clk_get(&pdev->dev, NULL);
++	if (IS_ERR(priv->clk_gate)) {
++		dev_err(&pdev->dev, "failed to get i2c clk\n");
++		return -ENOENT;
++	}
++
++	/* this is a static clock, which has no refcounting */
++	priv->clk_input = clk_get_fpi();
++	if (IS_ERR(priv->clk_input)) {
++		dev_err(&pdev->dev, "failed to get fpi clk\n");
++		return -ENOENT;
++	}
++
++	clk_activate(priv->clk_gate);
++
++	/* add our adapter to the i2c stack */
++	ret = i2c_add_numbered_adapter(adap);
++	if (ret) {
++		dev_err(&pdev->dev, "can't register I2C adapter\n");
++		goto out;
++	}
++
++	platform_set_drvdata(pdev, priv);
++	i2c_set_adapdata(adap, priv);
++
++	/* print module version information */
++	dev_dbg(&pdev->dev, "module id=%u revision=%u\n",
++		(i2c_r32(id) & I2C_ID_ID_MASK) >> I2C_ID_ID_OFFSET,
++		(i2c_r32(id) & I2C_ID_REV_MASK) >> I2C_ID_REV_OFFSET);
++
++	/* initialize HW */
++	ret = ltq_i2c_hw_init(adap);
++	if (ret) {
++		dev_err(&pdev->dev, "can't configure adapter\n");
++		i2c_del_adapter(adap);
++		platform_set_drvdata(pdev, NULL);
++		goto out;
++	} else {
++		dev_info(&pdev->dev, "version %s\n", DRV_VERSION);
++	}
++
++out:
++	/* if init failed, we need to deactivate the clock gate */
++	if (ret)
++		clk_deactivate(priv->clk_gate);
++
++	return ret;
++}
++
++static int ltq_i2c_remove(struct platform_device *pdev)
++{
++	struct ltq_i2c *priv = platform_get_drvdata(pdev);
++
++	/* disable bus */
++	i2c_w32_mask(I2C_RUN_CTRL_RUN_EN, 0, run_ctrl);
++
++	/* power down the core */
++	clk_deactivate(priv->clk_gate);
++
++	/* remove driver */
++	i2c_del_adapter(&priv->adap);
++	kfree(priv);
++
++	dev_dbg(&pdev->dev, "removed\n");
++	platform_set_drvdata(pdev, NULL);
++
++	return 0;
++}
++static const struct of_device_id ltq_i2c_match[] = {
++	{ .compatible = "lantiq,lantiq-i2c" },
++	{},
++};
++MODULE_DEVICE_TABLE(of, ltq_i2c_match);
++
++static struct platform_driver ltq_i2c_driver = {
++	.probe	= ltq_i2c_probe,
++	.remove	= ltq_i2c_remove,
++	.driver	= {
++		.name	= DRV_NAME,
++		.owner	= THIS_MODULE,
++		.of_match_table = ltq_i2c_match,
++	},
++};
++
++module_platform_driver(ltq_i2c_driver);
++
++MODULE_DESCRIPTION("Lantiq I2C bus adapter");
++MODULE_AUTHOR("Thomas Langer <thomas.langer@lantiq.com>");
++MODULE_ALIAS("platform:" DRV_NAME);
++MODULE_LICENSE("GPL");
++MODULE_VERSION(DRV_VERSION);
+--- /dev/null
++++ b/drivers/i2c/busses/i2c-lantiq.h
+@@ -0,0 +1,234 @@
++#ifndef I2C_LANTIQ_H
++#define I2C_LANTIQ_H
++
++/* I2C register structure */
++struct lantiq_reg_i2c {
++	/* I2C Kernel Clock Control Register */
++	unsigned int clc; /* 0x00000000 */
++	/* Reserved */
++	unsigned int res_0; /* 0x00000004 */
++	/* I2C Identification Register */
++	unsigned int id; /* 0x00000008 */
++	/* Reserved */
++	unsigned int res_1; /* 0x0000000C */
++	/*
++	 * I2C RUN Control Register
++	 * This register enables and disables the I2C peripheral. Before
++	 * enabling, the I2C has to be configured properly. After enabling
++	 * no configuration is possible
++	 */
++	unsigned int run_ctrl; /* 0x00000010 */
++	/*
++	 * I2C End Data Control Register
++	 * This register is used to either turn around the data transmission
++	 * direction or to address another slave without sending a stop
++	 * condition. Also the software can stop the slave-transmitter by
++	 * sending a not-accolade when working as master-receiver or even
++	 * stop data transmission immediately when operating as
++	 * master-transmitter. The writing to the bits of this control
++	 * register is only effective when in MASTER RECEIVES BYTES, MASTER
++	 * TRANSMITS BYTES, MASTER RESTART or SLAVE RECEIVE BYTES state
++	 */
++	unsigned int endd_ctrl; /* 0x00000014 */
++	/*
++	 * I2C Fractional Divider Configuration Register
++	 * These register is used to program the fractional divider of the I2C
++	 * bus. Before the peripheral is switched on by setting the RUN-bit the
++	 * two (fixed) values for the two operating frequencies are programmed
++	 * into these (configuration) registers. The Register FDIV_HIGH_CFG has
++	 * the same layout as I2C_FDIV_CFG.
++	 */
++	unsigned int fdiv_cfg; /* 0x00000018 */
++	/*
++	 * I2C Fractional Divider (highspeed mode) Configuration Register
++	 * These register is used to program the fractional divider of the I2C
++	 * bus. Before the peripheral is switched on by setting the RUN-bit the
++	 * two (fixed) values for the two operating frequencies are programmed
++	 * into these (configuration) registers. The Register FDIV_CFG has the
++	 * same layout as I2C_FDIV_CFG.
++	 */
++	unsigned int fdiv_high_cfg; /* 0x0000001C */
++	/* I2C Address Configuration Register */
++	unsigned int addr_cfg; /* 0x00000020 */
++	/* I2C Bus Status Register
++	 * This register gives a status information of the I2C. This additional
++	 * information can be used by the software to start proper actions.
++	 */
++	unsigned int bus_stat; /* 0x00000024 */
++	/* I2C FIFO Configuration Register */
++	unsigned int fifo_cfg; /* 0x00000028 */
++	/* I2C Maximum Received Packet Size Register */
++	unsigned int mrps_ctrl; /* 0x0000002C */
++	/* I2C Received Packet Size Status Register */
++	unsigned int rps_stat; /* 0x00000030 */
++	/* I2C Transmit Packet Size Register */
++	unsigned int tps_ctrl; /* 0x00000034 */
++	/* I2C Filled FIFO Stages Status Register */
++	unsigned int ffs_stat; /* 0x00000038 */
++	/* Reserved */
++	unsigned int res_2; /* 0x0000003C */
++	/* I2C Timing Configuration Register */
++	unsigned int tim_cfg; /* 0x00000040 */
++	/* Reserved */
++	unsigned int res_3[7]; /* 0x00000044 */
++	/* I2C Error Interrupt Request Source Mask Register */
++	unsigned int err_irqsm; /* 0x00000060 */
++	/* I2C Error Interrupt Request Source Status Register */
++	unsigned int err_irqss; /* 0x00000064 */
++	/* I2C Error Interrupt Request Source Clear Register */
++	unsigned int err_irqsc; /* 0x00000068 */
++	/* Reserved */
++	unsigned int res_4; /* 0x0000006C */
++	/* I2C Protocol Interrupt Request Source Mask Register */
++	unsigned int p_irqsm; /* 0x00000070 */
++	/* I2C Protocol Interrupt Request Source Status Register */
++	unsigned int p_irqss; /* 0x00000074 */
++	/* I2C Protocol Interrupt Request Source Clear Register */
++	unsigned int p_irqsc; /* 0x00000078 */
++	/* Reserved */
++	unsigned int res_5; /* 0x0000007C */
++	/* I2C Raw Interrupt Status Register */
++	unsigned int ris; /* 0x00000080 */
++	/* I2C Interrupt Mask Control Register */
++	unsigned int imsc; /* 0x00000084 */
++	/* I2C Masked Interrupt Status Register */
++	unsigned int mis; /* 0x00000088 */
++	/* I2C Interrupt Clear Register */
++	unsigned int icr; /* 0x0000008C */
++	/* I2C Interrupt Set Register */
++	unsigned int isr; /* 0x00000090 */
++	/* I2C DMA Enable Register */
++	unsigned int dmae; /* 0x00000094 */
++	/* Reserved */
++	unsigned int res_6[8154]; /* 0x00000098 */
++	/* I2C Transmit Data Register */
++	unsigned int txd; /* 0x00008000 */
++	/* Reserved */
++	unsigned int res_7[4095]; /* 0x00008004 */
++	/* I2C Receive Data Register */
++	unsigned int rxd; /* 0x0000C000 */
++	/* Reserved */
++	unsigned int res_8[4095]; /* 0x0000C004 */
++};
++
++/*
++ * Clock Divider for Normal Run Mode
++ * Max 8-bit divider value. IF RMC is 0 the module is disabled. Note: As long
++ * as the new divider value RMC is not valid, the register returns 0x0000 00xx
++ * on reading.
++ */
++#define I2C_CLC_RMC_MASK 0x0000FF00
++/* field offset */
++#define I2C_CLC_RMC_OFFSET 8
++
++/* Fields of "I2C Identification Register" */
++/* Module ID */
++#define I2C_ID_ID_MASK 0x0000FF00
++/* field offset */
++#define I2C_ID_ID_OFFSET 8
++/* Revision */
++#define I2C_ID_REV_MASK 0x000000FF
++/* field offset */
++#define I2C_ID_REV_OFFSET 0
++
++/* Fields of "I2C Interrupt Mask Control Register" */
++/* Enable */
++#define I2C_IMSC_BREQ_INT_EN 0x00000008
++/* Enable */
++#define I2C_IMSC_LBREQ_INT_EN 0x00000004
++
++/* Fields of "I2C Fractional Divider Configuration Register" */
++/* field offset */
++#define I2C_FDIV_CFG_INC_OFFSET 16
++
++/* Fields of "I2C Interrupt Mask Control Register" */
++/* Enable */
++#define I2C_IMSC_I2C_P_INT_EN 0x00000020
++/* Enable */
++#define I2C_IMSC_I2C_ERR_INT_EN 0x00000010
++
++/* Fields of "I2C Error Interrupt Request Source Status Register" */
++/* TXF_OFL */
++#define I2C_ERR_IRQSS_TXF_OFL 0x00000008
++/* TXF_UFL */
++#define I2C_ERR_IRQSS_TXF_UFL 0x00000004
++/* RXF_OFL */
++#define I2C_ERR_IRQSS_RXF_OFL 0x00000002
++/* RXF_UFL */
++#define I2C_ERR_IRQSS_RXF_UFL 0x00000001
++
++/* Fields of "I2C Raw Interrupt Status Register" */
++/* Read: Interrupt occurred. */
++#define I2C_RIS_I2C_ERR_INT_INTOCC 0x00000010
++/* Read: Interrupt occurred. */
++#define I2C_RIS_I2C_P_INT_INTOCC 0x00000020
++
++/* Fields of "I2C FIFO Configuration Register" */
++/* TX FIFO Flow Control */
++#define I2C_FIFO_CFG_TXFC 0x00020000
++/* RX FIFO Flow Control */
++#define I2C_FIFO_CFG_RXFC 0x00010000
++/* Word aligned (character alignment of four characters) */
++#define I2C_FIFO_CFG_TXFA_TXFA2 0x00002000
++/* Word aligned (character alignment of four characters) */
++#define I2C_FIFO_CFG_RXFA_RXFA2 0x00000200
++/* 1 word */
++#define I2C_FIFO_CFG_TXBS_TXBS0 0x00000000
++
++/* Fields of "I2C FIFO Configuration Register" */
++/* 1 word */
++#define I2C_FIFO_CFG_RXBS_RXBS0 0x00000000
++/* Stop on Packet End Enable */
++#define I2C_ADDR_CFG_SOPE_EN 0x00200000
++/* Stop on Not Acknowledge Enable */
++#define I2C_ADDR_CFG_SONA_EN 0x00100000
++/* Enable */
++#define I2C_ADDR_CFG_MnS_EN 0x00080000
++
++/* Fields of "I2C Interrupt Clear Register" */
++/* Clear */
++#define I2C_ICR_BREQ_INT_CLR 0x00000008
++/* Clear */
++#define I2C_ICR_LBREQ_INT_CLR 0x00000004
++
++/* Fields of "I2C Fractional Divider Configuration Register" */
++/* field offset */
++#define I2C_FDIV_CFG_DEC_OFFSET 0
++
++/* Fields of "I2C Bus Status Register" */
++/* Bus Status */
++#define I2C_BUS_STAT_BS_MASK 0x00000003
++/* Read from I2C Bus. */
++#define I2C_BUS_STAT_RNW_READ 0x00000004
++/* I2C Bus is free. */
++#define I2C_BUS_STAT_BS_FREE 0x00000000
++/*
++ * The device is working as master and has claimed the control on the
++ * I2C-bus (busy master).
++ */
++#define I2C_BUS_STAT_BS_BM 0x00000002
++
++/* Fields of "I2C RUN Control Register" */
++/* Enable */
++#define I2C_RUN_CTRL_RUN_EN 0x00000001
++
++/* Fields of "I2C End Data Control Register" */
++/*
++ * Set End of Transmission
++ * Note:Do not write '1' to this bit when bus is free. This will cause an
++ * abort after the first byte when a new transfer is started.
++ */
++#define I2C_ENDD_CTRL_SETEND 0x00000002
++
++/* Fields of "I2C Protocol Interrupt Request Source Status Register" */
++/* NACK */
++#define I2C_P_IRQSS_NACK 0x00000010
++/* AL */
++#define I2C_P_IRQSS_AL 0x00000008
++/* RX */
++#define I2C_P_IRQSS_RX 0x00000040
++/* TX_END */
++#define I2C_P_IRQSS_TX_END 0x00000020
++
++
++#endif /* I2C_LANTIQ_H */
diff --git a/target/linux/lantiq/patches-5.15/0035-owrt-lantiq-wifi-and-ethernet-eeprom-handling.patch b/target/linux/lantiq/patches-5.15/0035-owrt-lantiq-wifi-and-ethernet-eeprom-handling.patch
new file mode 100644
index 00000000000000..be0f0bfccd4699
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0035-owrt-lantiq-wifi-and-ethernet-eeprom-handling.patch
@@ -0,0 +1,218 @@
+From f8c5db89e793a4bc6c1e87bd7b3a5cec16b75bc3 Mon Sep 17 00:00:00 2001
+From: John Crispin <blogic@openwrt.org>
+Date: Wed, 10 Sep 2014 22:42:14 +0200
+Subject: [PATCH 35/36] owrt: lantiq: wifi and ethernet eeprom handling
+
+Signed-off-by: John Crispin <blogic@openwrt.org>
+---
+ .../mips/include/asm/mach-lantiq/xway/lantiq_soc.h |   3 +
+ arch/mips/lantiq/xway/Makefile                     |   3 +
+ arch/mips/lantiq/xway/ath5k_eep.c                  | 136 +++++++++++++++++++++
+ arch/mips/lantiq/xway/eth_mac.c                    |  25 ++++
+ drivers/net/ethernet/lantiq_etop.c                 |   6 +-
+ 5 files changed, 172 insertions(+), 1 deletion(-)
+ create mode 100644 arch/mips/lantiq/xway/ath5k_eep.c
+ create mode 100644 arch/mips/lantiq/xway/eth_mac.c
+
+--- a/arch/mips/include/asm/mach-lantiq/xway/lantiq_soc.h
++++ b/arch/mips/include/asm/mach-lantiq/xway/lantiq_soc.h
+@@ -102,5 +102,8 @@ int xrx200_gphy_boot(struct device *dev,
+ extern void ltq_pmu_enable(unsigned int module);
+ extern void ltq_pmu_disable(unsigned int module);
+ 
++/* allow the ethernet driver to load a flash mapped mac addr */
++const u8* ltq_get_eth_mac(void);
++
+ #endif /* CONFIG_SOC_TYPE_XWAY */
+ #endif /* _LTQ_XWAY_H__ */
+--- a/arch/mips/lantiq/xway/Makefile
++++ b/arch/mips/lantiq/xway/Makefile
+@@ -8,3 +8,6 @@ obj-y += timer.o
+ endif
+ 
+ obj-y += vmmc.o
++
++obj-y += eth_mac.o
++obj-$(CONFIG_PCI) += ath5k_eep.o
+--- /dev/null
++++ b/arch/mips/lantiq/xway/ath5k_eep.c
+@@ -0,0 +1,136 @@
++/*
++ *  Copyright (C) 2011 Luca Olivetti <luca@ventoso.org>
++ *  Copyright (C) 2011 John Crispin <blogic@openwrt.org>
++ *  Copyright (C) 2011 Andrej Vlašić <andrej.vlasic0@gmail.com>
++ *  Copyright (C) 2013 Álvaro Fernández Rojas <noltari@gmail.com>
++ *  Copyright (C) 2013 Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
++ *  Copyright (C) 2015 Vittorio Gambaletta <openwrt@vittgam.net>
++ *
++ *  This program is free software; you can redistribute it and/or modify it
++ *  under the terms of the GNU General Public License version 2 as published
++ *  by the Free Software Foundation.
++ */
++
++#include <linux/init.h>
++#include <linux/platform_device.h>
++#include <linux/etherdevice.h>
++#include <linux/ath5k_platform.h>
++#include <linux/pci.h>
++#include <linux/err.h>
++#include <linux/mtd/mtd.h>
++#include <lantiq_soc.h>
++
++extern int (*ltq_pci_plat_dev_init)(struct pci_dev *dev);
++struct ath5k_platform_data ath5k_pdata;
++static u8 athxk_eeprom_mac[6];
++
++static int ath5k_pci_plat_dev_init(struct pci_dev *dev)
++{
++	dev->dev.platform_data = &ath5k_pdata;
++	return 0;
++}
++
++static int ath5k_eep_load;
++int __init of_ath5k_eeprom_probe(struct platform_device *pdev)
++{
++	struct device_node *np = pdev->dev.of_node, *mtd_np = NULL;
++	int mac_offset;
++	u32 mac_inc = 0;
++	int i;
++	struct mtd_info *the_mtd;
++	size_t flash_readlen;
++	const __be32 *list;
++	const char *part;
++	phandle phandle;
++
++	list = of_get_property(np, "ath,eep-flash", &i);
++	if (!list || (i != (2 * sizeof(*list))))
++		return -ENODEV;
++
++	phandle = be32_to_cpup(list++);
++	if (phandle)
++		mtd_np = of_find_node_by_phandle(phandle);
++
++	if (!mtd_np)
++		return -ENODEV;
++
++	part = of_get_property(mtd_np, "label", NULL);
++	if (!part)
++		part = mtd_np->name;
++
++	the_mtd = get_mtd_device_nm(part);
++	if (IS_ERR(the_mtd))
++		return -ENODEV;
++
++	ath5k_pdata.eeprom_data = kmalloc(ATH5K_PLAT_EEP_MAX_WORDS<<1, GFP_KERNEL);
++
++	i = mtd_read(the_mtd, be32_to_cpup(list), ATH5K_PLAT_EEP_MAX_WORDS << 1,
++		&flash_readlen, (void *) ath5k_pdata.eeprom_data);
++
++	if (!of_property_read_u32(np, "ath,mac-offset", &mac_offset)) {
++		size_t mac_readlen;
++		mtd_read(the_mtd, mac_offset, 6, &mac_readlen,
++			(void *) athxk_eeprom_mac);
++	}
++	put_mtd_device(the_mtd);
++
++	if (((ATH5K_PLAT_EEP_MAX_WORDS<<1) != flash_readlen) || i) {
++		dev_err(&pdev->dev, "failed to load eeprom from mtd\n");
++		return -ENODEV;
++	}
++
++	if (of_find_property(np, "ath,eep-swap", NULL))
++		for (i = 0; i < ATH5K_PLAT_EEP_MAX_WORDS; i++)
++			ath5k_pdata.eeprom_data[i] = swab16(ath5k_pdata.eeprom_data[i]);
++
++	if (!is_valid_ether_addr(athxk_eeprom_mac) && ltq_get_eth_mac())
++		ether_addr_copy(athxk_eeprom_mac, ltq_get_eth_mac());
++
++	if (!is_valid_ether_addr(athxk_eeprom_mac)) {
++		dev_warn(&pdev->dev, "using random mac\n");
++		eth_random_addr(athxk_eeprom_mac);
++	}
++
++	if (!of_property_read_u32(np, "ath,mac-increment", &mac_inc))
++		athxk_eeprom_mac[5] += mac_inc;
++
++	ath5k_pdata.macaddr = athxk_eeprom_mac;
++	ltq_pci_plat_dev_init = ath5k_pci_plat_dev_init;
++
++	dev_info(&pdev->dev, "loaded ath5k eeprom\n");
++
++	return 0;
++}
++
++static struct of_device_id ath5k_eeprom_ids[] = {
++	{ .compatible = "ath5k,eeprom" },
++	{ }
++};
++
++static struct platform_driver ath5k_eeprom_driver = {
++	.driver		= {
++		.name		= "ath5k,eeprom",
++		.owner	= THIS_MODULE,
++		.of_match_table	= of_match_ptr(ath5k_eeprom_ids),
++	},
++};
++
++static int __init of_ath5k_eeprom_init(void)
++{
++	int ret = platform_driver_probe(&ath5k_eeprom_driver, of_ath5k_eeprom_probe);
++
++	if (ret)
++		ath5k_eep_load = 1;
++
++	return ret;
++}
++
++static int __init of_ath5k_eeprom_init_late(void)
++{
++	if (!ath5k_eep_load)
++		return 0;
++
++	return platform_driver_probe(&ath5k_eeprom_driver, of_ath5k_eeprom_probe);
++}
++late_initcall(of_ath5k_eeprom_init_late);
++subsys_initcall(of_ath5k_eeprom_init);
+--- /dev/null
++++ b/arch/mips/lantiq/xway/eth_mac.c
+@@ -0,0 +1,25 @@
++/*
++ *  Copyright (C) 2012 John Crispin <blogic@openwrt.org>
++ *
++ *  This program is free software; you can redistribute it and/or modify it
++ *  under the terms of the GNU General Public License version 2 as published
++ *  by the Free Software Foundation.
++ */
++
++#include <linux/init.h>
++#include <linux/if_ether.h>
++
++static u8 eth_mac[6];
++static int eth_mac_set;
++
++const u8* ltq_get_eth_mac(void)
++{
++	return eth_mac;
++}
++
++static int __init setup_ethaddr(char *str)
++{
++	eth_mac_set = mac_pton(str, eth_mac);
++	return !eth_mac_set;
++}
++early_param("ethaddr", setup_ethaddr);
+--- a/drivers/net/ethernet/lantiq_etop.c
++++ b/drivers/net/ethernet/lantiq_etop.c
+@@ -757,7 +757,11 @@ ltq_etop_init(struct net_device *dev)
+ 	if (err)
+ 		goto err_hw;
+ 
+-	memcpy(&mac, &priv->pldata->mac, sizeof(struct sockaddr));
++	memcpy(&mac.sa_data, ltq_get_eth_mac(), ETH_ALEN);
++
++	if (!is_valid_ether_addr(mac.sa_data))
++		memcpy(&mac.sa_data, priv->mac, ETH_ALEN);
++
+ 	if (!is_valid_ether_addr(mac.sa_data)) {
+ 		pr_warn("etop: invalid MAC, using random\n");
+ 		eth_random_addr(mac.sa_data);
diff --git a/target/linux/lantiq/patches-5.15/0042-arch-mips-increase-io_space_limit.patch b/target/linux/lantiq/patches-5.15/0042-arch-mips-increase-io_space_limit.patch
new file mode 100644
index 00000000000000..c81222af578b79
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0042-arch-mips-increase-io_space_limit.patch
@@ -0,0 +1,24 @@
+From 9807eb80a1b3bad7a4a89aa6566497bb1cadd6ef Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Fri, 3 Jun 2016 13:12:20 +0200
+Subject: [PATCH] arch: mips: increase io_space_limit
+
+this value comes from x86 and breaks some pci devices
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ arch/mips/include/asm/mach-lantiq/spaces.h | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+ create mode 100644 arch/mips/include/asm/mach-lantiq/spaces.h
+
+--- /dev/null
++++ b/arch/mips/include/asm/mach-lantiq/spaces.h
+@@ -0,0 +1,8 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef __ASM_MACH_LANTIQ_SPACES_H_
++#define __ASM_MACH_LANTIQ_SPACES_H_
++
++#define IO_SPACE_LIMIT  0xffffffff
++
++#include <asm/mach-generic/spaces.h>
++#endif
diff --git a/target/linux/lantiq/patches-5.15/0050-USB-DWC2-make-the-lantiq-settings-match-vendor-drive.patch b/target/linux/lantiq/patches-5.15/0050-USB-DWC2-make-the-lantiq-settings-match-vendor-drive.patch
new file mode 100644
index 00000000000000..6615a9edbf896c
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0050-USB-DWC2-make-the-lantiq-settings-match-vendor-drive.patch
@@ -0,0 +1,78 @@
+From de2cad82c4d0872066f83ce59462603852b47f03 Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Fri, 6 Jan 2017 17:55:24 +0100
+Subject: [PATCH 2/2] usb: dwc2:  add support for other Lantiq SoCs
+
+The size of the internal RAM of the DesignWare USB controller changed
+between the different Lantiq SoCs. We have the following sizes:
+
+Amazon + Danube: 8 KByte
+Amazon SE + arx100: 2 KByte
+xrx200 + xrx300: 2.5 KByte
+
+For Danube SoC we do not provide the params and let the driver decide
+to use sane defaults, for the Amazon SE and arx100 we use small fifos
+and for the xrx200 and xrx300 SCs a little bit bigger periodic fifo.
+The auto detection of max_transfer_size and max_packet_count should
+work, so remove it.
+
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+---
+ drivers/usb/dwc2/platform.c | 46 ++++++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 39 insertions(+), 7 deletions(-)
+
+--- a/drivers/usb/dwc2/params.c
++++ b/drivers/usb/dwc2/params.c
+@@ -93,7 +93,14 @@ static void dwc2_set_rk_params(struct dw
+ 	p->power_down = DWC2_POWER_DOWN_PARAM_NONE;
+ }
+ 
+-static void dwc2_set_ltq_params(struct dwc2_hsotg *hsotg)
++static void dwc2_set_ltq_danube_params(struct dwc2_hsotg *hsotg)
++{
++	struct dwc2_core_params *p = &hsotg->params;
++
++	p->otg_cap = DWC2_CAP_PARAM_NO_HNP_SRP_CAPABLE;
++}
++
++static void dwc2_set_ltq_ase_params(struct dwc2_hsotg *hsotg)
+ {
+ 	struct dwc2_core_params *p = &hsotg->params;
+ 
+@@ -101,12 +108,20 @@ static void dwc2_set_ltq_params(struct d
+ 	p->host_rx_fifo_size = 288;
+ 	p->host_nperio_tx_fifo_size = 128;
+ 	p->host_perio_tx_fifo_size = 96;
+-	p->max_transfer_size = 65535;
+-	p->max_packet_count = 511;
+ 	p->ahbcfg = GAHBCFG_HBSTLEN_INCR16 <<
+ 		GAHBCFG_HBSTLEN_SHIFT;
+ }
+ 
++static void dwc2_set_ltq_xrx200_params(struct dwc2_hsotg *hsotg)
++{
++	struct dwc2_core_params *p = &hsotg->params;
++
++	p->otg_cap = DWC2_CAP_PARAM_NO_HNP_SRP_CAPABLE;
++	p->host_rx_fifo_size = 288;
++	p->host_nperio_tx_fifo_size = 128;
++	p->host_perio_tx_fifo_size = 136;
++}
++
+ static void dwc2_set_amlogic_params(struct dwc2_hsotg *hsotg)
+ {
+ 	struct dwc2_core_params *p = &hsotg->params;
+@@ -205,8 +220,11 @@ const struct of_device_id dwc2_of_match_
+ 	{ .compatible = "brcm,bcm2835-usb", .data = dwc2_set_bcm_params },
+ 	{ .compatible = "hisilicon,hi6220-usb", .data = dwc2_set_his_params  },
+ 	{ .compatible = "rockchip,rk3066-usb", .data = dwc2_set_rk_params },
+-	{ .compatible = "lantiq,arx100-usb", .data = dwc2_set_ltq_params },
+-	{ .compatible = "lantiq,xrx200-usb", .data = dwc2_set_ltq_params },
++	{ .compatible = "lantiq,danube-usb", .data = &dwc2_set_ltq_danube_params },
++	{ .compatible = "lantiq,ase-usb", .data = &dwc2_set_ltq_ase_params },
++	{ .compatible = "lantiq,arx100-usb", .data = &dwc2_set_ltq_ase_params },
++	{ .compatible = "lantiq,xrx200-usb", .data = &dwc2_set_ltq_xrx200_params },
++	{ .compatible = "lantiq,xrx300-usb", .data = &dwc2_set_ltq_xrx200_params },
+ 	{ .compatible = "snps,dwc2" },
+ 	{ .compatible = "samsung,s3c6400-hsotg",
+ 	  .data = dwc2_set_s3c6400_params },
diff --git a/target/linux/lantiq/patches-5.15/0051-MIPS-lantiq-improve-USB-initialization.patch b/target/linux/lantiq/patches-5.15/0051-MIPS-lantiq-improve-USB-initialization.patch
new file mode 100644
index 00000000000000..9d62892b566b64
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0051-MIPS-lantiq-improve-USB-initialization.patch
@@ -0,0 +1,49 @@
+From 14909c4e4e836925668e74fc6e0e85ba0283cbf9 Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Fri, 6 Jan 2017 17:40:12 +0100
+Subject: [PATCH 2/2] MIPS: lantiq: improve USB initialization
+
+This adds code to initialize the USB controller and PHY also on Danube,
+Amazon SE and AR10. This code is based on the Vendor driver from
+different UGW versions and compared to the hardware documentation.
+
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+---
+ arch/mips/lantiq/xway/sysctrl.c |  20 +++++++
+ 2 files changed, 110 insertions(+), 30 deletions(-)
+
+
+--- a/arch/mips/lantiq/xway/sysctrl.c
++++ b/arch/mips/lantiq/xway/sysctrl.c
+@@ -248,6 +248,25 @@ static void pmu_disable(struct clk *clk)
+ 		pr_warn("deactivating PMU module failed!");
+ }
+ 
++static void usb_set_clock(void)
++{
++	unsigned int val = ltq_cgu_r32(ifccr);
++
++	if (of_machine_is_compatible("lantiq,ar10") ||
++	    of_machine_is_compatible("lantiq,grx390")) {
++		val &= ~0x03; /* XTAL divided by 3 */
++	} else if (of_machine_is_compatible("lantiq,ar9") ||
++		   of_machine_is_compatible("lantiq,vr9")) {
++		/* TODO: this depends on the XTAL frequency */
++		val |= 0x03; /* XTAL divided by 3 */
++	} else if (of_machine_is_compatible("lantiq,ase")) {
++		val |= 0x20; /* from XTAL */
++	} else if (of_machine_is_compatible("lantiq,danube")) {
++		val |= 0x30; /* 12 MHz, generated from 36 MHz */
++	}
++	ltq_cgu_w32(val, ifccr);
++}
++
+ /* the pci enable helper */
+ static int pci_enable(struct clk *clk)
+ {
+@@ -585,4 +604,5 @@ void __init ltq_soc_init(void)
+ 		clkdev_add_pmu("1e116000.mei", "dfe", 1, 0, PMU_DFE);
+ 		clkdev_add_pmu("1e100400.serial", NULL, 1, 0, PMU_ASC0);
+ 	}
++	usb_set_clock();
+ }
diff --git a/target/linux/lantiq/patches-5.15/0101-find_active_root.patch b/target/linux/lantiq/patches-5.15/0101-find_active_root.patch
new file mode 100644
index 00000000000000..14dc83f1f77fc6
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0101-find_active_root.patch
@@ -0,0 +1,103 @@
+From 2c82524000cca691c89c9fda251b55ef04eabcb6 Mon Sep 17 00:00:00 2001
+From: Mathias Kresin <openwrt@kresin.me>
+Date: Mon, 2 May 2016 18:50:00 +0000
+Subject: [PATCH] find active root
+
+Signed-off-by: Mathias Kresin <openwrt@kresin.me>
+---
+ drivers/mtd/parsers/ofpart_core.c | 49 ++++++++++++++++++++++++++++++-
+ 1 file changed, 48 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/parsers/ofpart_core.c
++++ b/drivers/mtd/parsers/ofpart_core.c
+@@ -38,6 +38,38 @@ static bool node_has_compatible(struct d
+ 	return of_get_property(pp, "compatible", NULL);
+ }
+ 
++static uint8_t * brnboot_get_selected_root_part(struct mtd_info *master,
++						loff_t offset)
++{
++	static uint8_t root_id;
++	int err, len;
++
++	err = mtd_read(master, offset, 0x01, &len, &root_id);
++
++	if (mtd_is_bitflip(err) || !err)
++		return &root_id;
++
++	return NULL;
++}
++
++static void brnboot_set_active_root_part(struct mtd_partition *pparts,
++					 struct device_node **part_nodes,
++					 int nr_parts,
++					 uint8_t *root_id)
++{
++	int i;
++
++	for (i = 0; i < nr_parts; i++) {
++		int part_root_id;
++
++		if (!of_property_read_u32(part_nodes[i], "brnboot,root-id", &part_root_id)
++		    && part_root_id == *root_id) {
++			pparts[i].name = "firmware";
++			break;
++		}
++	}
++}
++
+ static int parse_fixed_partitions(struct mtd_info *master,
+ 				  const struct mtd_partition **pparts,
+ 				  struct mtd_part_parser_data *data)
+@@ -51,6 +83,8 @@ static int parse_fixed_partitions(struct
+ 	struct device_node *pp;
+ 	int nr_parts, i, ret = 0;
+ 	bool dedicated = true;
++	uint8_t *proot_id = NULL;
++	struct device_node **part_nodes;
+ 
+ 	/* Pull of_node from the master device node */
+ 	mtd_node = mtd_get_of_node(master);
+@@ -95,7 +129,9 @@ static int parse_fixed_partitions(struct
+ 		return 0;
+ 
+ 	parts = kcalloc(nr_parts, sizeof(*parts), GFP_KERNEL);
+-	if (!parts)
++	part_nodes = kcalloc(nr_parts, sizeof(*part_nodes), GFP_KERNEL);
++
++	if (!parts || !part_nodes)
+ 		return -ENOMEM;
+ 
+ 	i = 0;
+@@ -147,6 +183,11 @@ static int parse_fixed_partitions(struct
+ 		if (of_property_read_bool(pp, "slc-mode"))
+ 			parts[i].add_flags |= MTD_SLC_ON_MLC_EMULATION;
+ 
++		if (!proot_id && of_device_is_compatible(pp, "brnboot,root-selector"))
++			proot_id = brnboot_get_selected_root_part(master, parts[i].offset);
++
++		part_nodes[i] = pp;
++
+ 		i++;
+ 	}
+ 
+@@ -156,6 +197,11 @@ static int parse_fixed_partitions(struct
+ 	if (quirks && quirks->post_parse)
+ 		quirks->post_parse(master, parts, nr_parts);
+ 
++	if (proot_id)
++		brnboot_set_active_root_part(parts, part_nodes, nr_parts, proot_id);
++
++	kfree(part_nodes);
++
+ 	*pparts = parts;
+ 	return nr_parts;
+ 
+@@ -166,6 +212,7 @@ ofpart_fail:
+ ofpart_none:
+ 	of_node_put(pp);
+ 	kfree(parts);
++	kfree(part_nodes);
+ 	return ret;
+ }
+ 
diff --git a/target/linux/lantiq/patches-5.15/0151-lantiq-ifxmips_pcie-use-of.patch b/target/linux/lantiq/patches-5.15/0151-lantiq-ifxmips_pcie-use-of.patch
new file mode 100644
index 00000000000000..0b99b91bd9156a
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0151-lantiq-ifxmips_pcie-use-of.patch
@@ -0,0 +1,399 @@
+From 1d1885f4a7abd7272f47b835b03d8662fb981d19 Mon Sep 17 00:00:00 2001
+From: Eddi De Pieri <eddi@depieri.net>
+Date: Tue, 14 Oct 2014 11:04:00 +0000
+Subject: [PATCH] MIPS: lantiq: ifxmips_pcie: use of
+
+Signed-off-by: Eddi De Pieri <eddi@depieri.net>
+---
+ arch/mips/pci/Makefile           |   2 +-
+ arch/mips/pci/ifxmips_pcie.c     | 151 +++++++++++++++++++++++++++----
+ arch/mips/pci/ifxmips_pcie_vr9.h | 105 ---------------------
+ 3 files changed, 133 insertions(+), 125 deletions(-)
+
+--- a/arch/mips/pci/Makefile
++++ b/arch/mips/pci/Makefile
+@@ -43,7 +43,7 @@ obj-$(CONFIG_PCI_LANTIQ)	+= pci-lantiq.o
+ obj-$(CONFIG_SOC_MT7620)	+= pci-mt7620.o
+ obj-$(CONFIG_SOC_RT288X)	+= pci-rt2880.o
+ obj-$(CONFIG_SOC_RT3883)	+= pci-rt3883.o
+-obj-$(CONFIG_PCIE_LANTIQ)	+= ifxmips_pcie_phy.o ifxmips_pcie.o fixup-lantiq-pcie.o
++obj-$(CONFIG_PCIE_LANTIQ)	+= ifxmips_pcie.o fixup-lantiq-pcie.o
+ obj-$(CONFIG_PCIE_LANTIQ_MSI)	+= pcie-lantiq-msi.o
+ obj-$(CONFIG_TANBAC_TB0219)	+= fixup-tb0219.o
+ obj-$(CONFIG_TANBAC_TB0226)	+= fixup-tb0226.o
+--- a/arch/mips/pci/ifxmips_pcie.c
++++ b/arch/mips/pci/ifxmips_pcie.c
+@@ -16,8 +16,15 @@
+ #include <asm/paccess.h>
+ #include <linux/pci.h>
+ #include <linux/pci_regs.h>
++#include <linux/phy/phy.h>
++#include <linux/regmap.h>
++#include <linux/reset.h>
++#include <linux/mfd/syscon.h>
+ #include <linux/module.h>
+ 
++#include <linux/of_gpio.h>
++#include <linux/of_platform.h>
++
+ #include "ifxmips_pcie.h"
+ #include "ifxmips_pcie_reg.h"
+ 
+@@ -40,6 +47,10 @@
+ static DEFINE_SPINLOCK(ifx_pcie_lock);
+ 
+ u32 g_pcie_debug_flag = PCIE_MSG_ANY & (~PCIE_MSG_CFG);
++static int pcie_reset_gpio;
++static struct phy *ltq_pcie_phy;
++static struct reset_control *ltq_pcie_reset;
++static struct regmap *ltq_rcu_regmap;
+ 
+ static ifx_pcie_irq_t pcie_irqs[IFX_PCIE_CORE_NR] = {
+     {
+@@ -82,6 +93,22 @@ void ifx_pcie_debug(const char *fmt, ...
+ 	printk("%s", buf);
+ }
+ 
++static inline void pcie_ep_gpio_rst_init(int pcie_port)
++{
++	gpio_direction_output(pcie_reset_gpio, 1);
++	gpio_set_value(pcie_reset_gpio, 1);
++}
++
++static inline void pcie_device_rst_assert(int pcie_port)
++{
++	gpio_set_value(pcie_reset_gpio, 0);
++}
++
++static inline void pcie_device_rst_deassert(int pcie_port)
++{
++	mdelay(100);
++	gpio_direction_output(pcie_reset_gpio, 1);
++}
+ 
+ static inline int pcie_ltssm_enable(int pcie_port)
+ {
+@@ -988,10 +1015,22 @@ int  ifx_pcie_bios_plat_dev_init(struct
+ static int
+ pcie_rc_initialize(int pcie_port)
+ {
+-	int i;
++	int i, ret;
+ #define IFX_PCIE_PHY_LOOP_CNT  5
+ 
+-	pcie_rcu_endian_setup(pcie_port);
++	regmap_update_bits(ltq_rcu_regmap, 0x4c, IFX_RCU_AHB_BE_PCIE_M,
++			   IFX_RCU_AHB_BE_PCIE_M);
++
++#ifdef CONFIG_IFX_PCIE_HW_SWAP
++	regmap_update_bits(ltq_rcu_regmap, 0x4c, IFX_RCU_AHB_BE_PCIE_S,
++			   IFX_RCU_AHB_BE_PCIE_S);
++#else
++	regmap_update_bits(ltq_rcu_regmap, 0x4c, IFX_RCU_AHB_BE_PCIE_S,
++			   0x0);
++#endif
++
++	regmap_update_bits(ltq_rcu_regmap, 0x4c, IFX_RCU_AHB_BE_XBAR_M,
++			   0x0);
+ 
+ 	pcie_ep_gpio_rst_init(pcie_port);
+ 
+@@ -1000,26 +1039,21 @@ pcie_rc_initialize(int pcie_port)
+ 	* reset PCIe PHY will solve this issue 
+ 	*/
+ 	for (i = 0; i < IFX_PCIE_PHY_LOOP_CNT; i++) {
+-		/* Disable PCIe PHY Analog part for sanity check */
+-		pcie_phy_pmu_disable(pcie_port);
+-
+-		pcie_phy_rst_assert(pcie_port);
+-		pcie_phy_rst_deassert(pcie_port);
+-
+-		/* Make sure PHY PLL is stable */
+-		udelay(20);
+-
+-		/* PCIe Core reset enabled, low active, sw programmed */
+-		pcie_core_rst_assert(pcie_port);
++		ret = phy_init(ltq_pcie_phy);
++		if (ret)
++			continue;
+ 
+ 		/* Put PCIe EP in reset status */
+ 		pcie_device_rst_assert(pcie_port);
+ 
+-		/* PCI PHY & Core reset disabled, high active, sw programmed */
+-		pcie_core_rst_deassert(pcie_port);
++		udelay(1);
++		reset_control_deassert(ltq_pcie_reset);
+ 
+-		/* Already in a quiet state, program PLL, enable PHY, check ready bit */
+-		pcie_phy_clock_mode_setup(pcie_port);
++		ret = phy_power_on(ltq_pcie_phy);
++		if (ret) {
++			phy_exit(ltq_pcie_phy);
++			continue;
++		}
+ 
+ 		/* Enable PCIe PHY and Clock */
+ 		pcie_core_pmu_setup(pcie_port);
+@@ -1035,6 +1069,10 @@ pcie_rc_initialize(int pcie_port)
+ 		/* Once link is up, break out */
+ 		if (pcie_app_loigc_setup(pcie_port) == 0)
+ 			break;
++
++		phy_power_off(ltq_pcie_phy);
++		reset_control_assert(ltq_pcie_reset);
++		phy_exit(ltq_pcie_phy);
+ 	}
+ 	if (i >= IFX_PCIE_PHY_LOOP_CNT) {
+ 		printk(KERN_ERR "%s link up failed!!!!!\n", __func__);
+@@ -1045,17 +1083,67 @@ pcie_rc_initialize(int pcie_port)
+ 	return 0;
+ }
+ 
+-static int __init ifx_pcie_bios_init(void)
++static int ifx_pcie_bios_probe(struct platform_device *pdev)
+ {
++    struct device_node *node = pdev->dev.of_node;
+     void __iomem *io_map_base;
+     int pcie_port;
+     int startup_port;
++    struct device_node *np;
++    struct pci_bus *bus;
++
++    /*
++     * In case a PCI device is physical present, the Lantiq PCI driver need
++     * to be loaded prior to the Lantiq PCIe driver. Otherwise none of them
++     * will work.
++     *
++     * In case the lantiq PCI driver is enabled in the device tree, check if
++     * a PCI bus (hopefully the one of the Lantiq PCI driver one) is already
++     * registered.
++     *
++     * It will fail if there is another PCI controller, this controller is
++     * registered before the Lantiq PCIe driver is probe and the lantiq PCI
++     */
++    np = of_find_compatible_node(NULL, NULL, "lantiq,pci-xway");
++
++    if (of_device_is_available(np)) {
++        bus = pci_find_next_bus(bus);
++
++        if (!bus)
++	     return -EPROBE_DEFER;
++    }
+ 
+     /* Enable AHB Master/ Slave */
+     pcie_ahb_pmu_setup();
+ 
+     startup_port = IFX_PCIE_PORT0;
+-    
++
++    ltq_pcie_phy = devm_phy_get(&pdev->dev, "pcie");
++    if (IS_ERR(ltq_pcie_phy)) {
++        dev_err(&pdev->dev, "failed to get the PCIe PHY\n");
++        return PTR_ERR(ltq_pcie_phy);
++    }
++
++    ltq_pcie_reset = devm_reset_control_get_shared(&pdev->dev, NULL);
++    if (IS_ERR(ltq_pcie_reset)) {
++        dev_err(&pdev->dev, "failed to get the PCIe reset line\n");
++        return PTR_ERR(ltq_pcie_reset);
++    }
++
++    ltq_rcu_regmap = syscon_regmap_lookup_by_phandle(node, "lantiq,rcu");
++    if (IS_ERR(ltq_rcu_regmap))
++        return PTR_ERR(ltq_rcu_regmap);
++
++    pcie_reset_gpio = of_get_named_gpio(node, "gpio-reset", 0);
++    if (gpio_is_valid(pcie_reset_gpio)) {
++        int ret = devm_gpio_request(&pdev->dev, pcie_reset_gpio, "pcie-reset");
++        if (ret) {
++            dev_err(&pdev->dev, "failed to request gpio %d\n", pcie_reset_gpio);
++            return ret;
++        }
++        gpio_direction_output(pcie_reset_gpio, 1);
++    }
++
+     for (pcie_port = startup_port; pcie_port < IFX_PCIE_CORE_NR; pcie_port++){
+ 	if (pcie_rc_initialize(pcie_port) == 0) {
+ 	    IFX_PCIE_PRINT(PCIE_MSG_INIT, "%s: ifx_pcie_cfg_base 0x%p\n", 
+@@ -1067,6 +1155,7 @@ static int __init ifx_pcie_bios_init(voi
+                 return -ENOMEM;
+             }
+             ifx_pcie_controller[pcie_port].pcic.io_map_base = (unsigned long)io_map_base;
++            pci_load_of_ranges(&ifx_pcie_controller[pcie_port].pcic, node);
+ 
+             register_pci_controller(&ifx_pcie_controller[pcie_port].pcic);
+             /* XXX, clear error status */
+@@ -1083,6 +1172,30 @@ static int __init ifx_pcie_bios_init(voi
+ 
+     return 0;
+ }
++
++static const struct of_device_id ifxmips_pcie_match[] = {
++        { .compatible = "lantiq,pcie-xrx200" },
++        {},
++};
++MODULE_DEVICE_TABLE(of, ifxmips_pcie_match);
++
++static struct platform_driver ltq_pci_driver = {
++        .probe = ifx_pcie_bios_probe,
++        .driver = {
++                .name = "pcie-xrx200",
++                .owner = THIS_MODULE,
++                .of_match_table = ifxmips_pcie_match,
++        },
++};
++
++int __init ifx_pcie_bios_init(void)
++{
++        int ret = platform_driver_register(&ltq_pci_driver);
++        if (ret)
++                pr_info("pcie-xrx200: Error registering platform driver!");
++        return ret;
++}
++
+ arch_initcall(ifx_pcie_bios_init);
+ 
+ MODULE_LICENSE("GPL");
+--- a/arch/mips/pci/ifxmips_pcie_vr9.h
++++ b/arch/mips/pci/ifxmips_pcie_vr9.h
+@@ -22,8 +22,6 @@
+ #include <linux/gpio.h>
+ #include <lantiq_soc.h>
+ 
+-#define IFX_PCIE_GPIO_RESET  494
+-
+ #define IFX_REG_R32    ltq_r32
+ #define IFX_REG_W32    ltq_w32
+ #define CONFIG_IFX_PCIE_HW_SWAP
+@@ -53,21 +51,6 @@
+ #define OUT			((volatile u32*)(IFX_GPIO + 0x0070))
+ 
+ 
+-static inline void pcie_ep_gpio_rst_init(int pcie_port)
+-{
+-
+-	gpio_request(IFX_PCIE_GPIO_RESET, "pcie-reset");
+-	gpio_direction_output(IFX_PCIE_GPIO_RESET, 1);
+-	gpio_set_value(IFX_PCIE_GPIO_RESET, 1);
+-
+-/*    ifx_gpio_pin_reserve(IFX_PCIE_GPIO_RESET, ifx_pcie_gpio_module_id);
+-    ifx_gpio_output_set(IFX_PCIE_GPIO_RESET, ifx_pcie_gpio_module_id);
+-    ifx_gpio_dir_out_set(IFX_PCIE_GPIO_RESET, ifx_pcie_gpio_module_id);
+-    ifx_gpio_altsel0_clear(IFX_PCIE_GPIO_RESET, ifx_pcie_gpio_module_id);
+-    ifx_gpio_altsel1_clear(IFX_PCIE_GPIO_RESET, ifx_pcie_gpio_module_id);
+-    ifx_gpio_open_drain_set(IFX_PCIE_GPIO_RESET, ifx_pcie_gpio_module_id);*/
+-}
+-
+ static inline void pcie_ahb_pmu_setup(void) 
+ {
+ 	/* Enable AHB bus master/slave */
+@@ -79,24 +62,6 @@ static inline void pcie_ahb_pmu_setup(vo
+     //AHBS_PMU_SETUP(IFX_PMU_ENABLE);
+ }
+ 
+-static inline void pcie_rcu_endian_setup(int pcie_port)
+-{
+-    u32 reg;
+-
+-    reg = IFX_REG_R32(IFX_RCU_AHB_ENDIAN);
+-#ifdef CONFIG_IFX_PCIE_HW_SWAP
+-    reg |= IFX_RCU_AHB_BE_PCIE_M;
+-    reg |= IFX_RCU_AHB_BE_PCIE_S;
+-    reg &= ~IFX_RCU_AHB_BE_XBAR_M;
+-#else 
+-    reg |= IFX_RCU_AHB_BE_PCIE_M;
+-    reg &= ~IFX_RCU_AHB_BE_PCIE_S;
+-    reg &= ~IFX_RCU_AHB_BE_XBAR_M;
+-#endif /* CONFIG_IFX_PCIE_HW_SWAP */
+-    IFX_REG_W32(reg, IFX_RCU_AHB_ENDIAN);
+-    IFX_PCIE_PRINT(PCIE_MSG_REG, "%s IFX_RCU_AHB_ENDIAN: 0x%08x\n", __func__, IFX_REG_R32(IFX_RCU_AHB_ENDIAN));
+-}
+-
+ static inline void pcie_phy_pmu_enable(int pcie_port)
+ {
+ 	struct clk *clk;
+@@ -115,17 +80,6 @@ static inline void pcie_phy_pmu_disable(
+ //    PCIE_PHY_PMU_SETUP(IFX_PMU_DISABLE);
+ }
+ 
+-static inline void pcie_pdi_big_endian(int pcie_port)
+-{
+-    u32 reg;
+-
+-    /* SRAM2PDI endianness control. */
+-    reg = IFX_REG_R32(IFX_RCU_AHB_ENDIAN);
+-    /* Config AHB->PCIe and PDI endianness */
+-    reg |= IFX_RCU_AHB_BE_PCIE_PDI;
+-    IFX_REG_W32(reg, IFX_RCU_AHB_ENDIAN);
+-}
+-
+ static inline void pcie_pdi_pmu_enable(int pcie_port)
+ {
+     /* Enable PDI to access PCIe PHY register */
+@@ -135,65 +89,6 @@ static inline void pcie_pdi_pmu_enable(i
+     //PDI_PMU_SETUP(IFX_PMU_ENABLE);
+ }
+ 
+-static inline void pcie_core_rst_assert(int pcie_port)
+-{
+-    u32 reg;
+-
+-    reg = IFX_REG_R32(IFX_RCU_RST_REQ);
+-
+-    /* Reset PCIe PHY & Core, bit 22, bit 26 may be affected if write it directly  */
+-    reg |= 0x00400000;
+-    IFX_REG_W32(reg, IFX_RCU_RST_REQ);
+-}
+-
+-static inline void pcie_core_rst_deassert(int pcie_port)
+-{
+-    u32 reg;
+-
+-    /* Make sure one micro-second delay */
+-    udelay(1);
+-
+-    /* Reset PCIe PHY & Core, bit 22 */
+-    reg = IFX_REG_R32(IFX_RCU_RST_REQ);
+-    reg &= ~0x00400000;
+-    IFX_REG_W32(reg, IFX_RCU_RST_REQ);
+-}
+-
+-static inline void pcie_phy_rst_assert(int pcie_port)
+-{
+-    u32 reg;
+-
+-    reg = IFX_REG_R32(IFX_RCU_RST_REQ);
+-    reg |= 0x00001000; /* Bit 12 */
+-    IFX_REG_W32(reg, IFX_RCU_RST_REQ);
+-}
+-
+-static inline void pcie_phy_rst_deassert(int pcie_port)
+-{
+-    u32 reg;
+-
+-    /* Make sure one micro-second delay */
+-    udelay(1);
+-
+-    reg = IFX_REG_R32(IFX_RCU_RST_REQ);
+-    reg &= ~0x00001000; /* Bit 12 */
+-    IFX_REG_W32(reg, IFX_RCU_RST_REQ);
+-}
+-
+-static inline void pcie_device_rst_assert(int pcie_port)
+-{
+-	gpio_set_value(IFX_PCIE_GPIO_RESET, 0);
+-//    ifx_gpio_output_clear(IFX_PCIE_GPIO_RESET, ifx_pcie_gpio_module_id);
+-}
+-
+-static inline void pcie_device_rst_deassert(int pcie_port)
+-{
+-    mdelay(100);
+-	gpio_direction_output(IFX_PCIE_GPIO_RESET, 1);
+-//    gpio_set_value(IFX_PCIE_GPIO_RESET, 1);
+-    //ifx_gpio_output_set(IFX_PCIE_GPIO_RESET, ifx_pcie_gpio_module_id);
+-}
+-
+ static inline void pcie_core_pmu_setup(int pcie_port)
+ {
+ 	struct clk *clk;
diff --git a/target/linux/lantiq/patches-5.15/0152-lantiq-VPE.patch b/target/linux/lantiq/patches-5.15/0152-lantiq-VPE.patch
new file mode 100644
index 00000000000000..bf2962a3ffb7e8
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0152-lantiq-VPE.patch
@@ -0,0 +1,195 @@
+From 4d48a3d1ef6f8d036bd926e3c1f70b56fcc679b2 Mon Sep 17 00:00:00 2001
+From: Stefan Koch <stefan.koch10@gmail.com>
+Date: Thu, 20 Oct 2016 21:32:00 +0200
+Subject: [PATCH] lantiq: vpe
+
+Signed-off-by: Stefan Koch <stefan.koch10@gmail.com>
+---
+ arch/mips/Kconfig                  |  6 ++++
+ arch/mips/include/asm/mipsmtregs.h |  5 ++++
+ arch/mips/include/asm/vpe.h        |  9 ++++++
+ arch/mips/kernel/vpe-mt.c          | 47 ++++++++++++++++++++++++++++++
+ arch/mips/kernel/vpe.c             | 35 ++++++++++++++++++++++
+ arch/mips/lantiq/prom.c            |  4 +++
+ 6 files changed, 106 insertions(+)
+
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -2429,6 +2429,12 @@ config MIPS_VPE_LOADER
+ 	  Includes a loader for loading an elf relocatable object
+ 	  onto another VPE and running it.
+ 
++config IFX_VPE_EXT
++	bool "IFX APRP Extensions"
++	depends on MIPS_VPE_LOADER
++	help
++	  IFX included extensions in APRP
++
+ config MIPS_VPE_LOADER_CMP
+ 	bool
+ 	default "y"
+--- a/arch/mips/include/asm/mipsmtregs.h
++++ b/arch/mips/include/asm/mipsmtregs.h
+@@ -32,6 +32,9 @@
+ #define read_c0_vpeconf1()		__read_32bit_c0_register($1, 3)
+ #define write_c0_vpeconf1(val)		__write_32bit_c0_register($1, 3, val)
+ 
++#define read_c0_vpeopt()		__read_32bit_c0_register($1, 7)
++#define write_c0_vpeopt(val)		__write_32bit_c0_register($1, 7, val)
++
+ #define read_c0_tcstatus()		__read_32bit_c0_register($2, 1)
+ #define write_c0_tcstatus(val)		__write_32bit_c0_register($2, 1, val)
+ 
+@@ -378,6 +381,8 @@ do {									\
+ #define write_vpe_c0_vpeconf0(val)	mttc0(1, 2, val)
+ #define read_vpe_c0_vpeconf1()		mftc0(1, 3)
+ #define write_vpe_c0_vpeconf1(val)	mttc0(1, 3, val)
++#define read_vpe_c0_vpeopt()		mftc0(1, 7)
++#define write_vpe_c0_vpeopt(val)	mttc0(1, 7, val)
+ #define read_vpe_c0_count()		mftc0(9, 0)
+ #define write_vpe_c0_count(val)		mttc0(9, 0, val)
+ #define read_vpe_c0_status()		mftc0(12, 0)
+--- a/arch/mips/include/asm/vpe.h
++++ b/arch/mips/include/asm/vpe.h
+@@ -124,4 +124,13 @@ void cleanup_tc(struct tc *tc);
+ 
+ int __init vpe_module_init(void);
+ void __exit vpe_module_exit(void);
++
++/* For the explanation of the APIs please refer the section "MT APRP Kernel
++ * Programming" in AR9 SW Architecture Specification
++ */
++int32_t vpe1_sw_start(void *sw_start_addr, uint32_t tcmask, uint32_t flags);
++int32_t vpe1_sw_stop(uint32_t flags);
++uint32_t vpe1_get_load_addr(uint32_t flags);
++uint32_t vpe1_get_max_mem(uint32_t flags);
++
+ #endif /* _ASM_VPE_H */
+--- a/arch/mips/kernel/vpe-mt.c
++++ b/arch/mips/kernel/vpe-mt.c
+@@ -29,6 +29,7 @@ int vpe_run(struct vpe *v)
+ 	struct vpe_notifications *notifier;
+ 	unsigned int vpeflags;
+ 	struct tc *t;
++	unsigned long physical_memsize = 0L;
+ 
+ 	/* check we are the Master VPE */
+ 	local_irq_save(flags);
+@@ -416,6 +417,8 @@ int __init vpe_module_init(void)
+ 			}
+ 
+ 			v->ntcs = hw_tcs - aprp_cpu_index();
++			write_tc_c0_tcbind((read_tc_c0_tcbind() &
++						~TCBIND_CURVPE) | 1);
+ 
+ 			/* add the tc to the list of this vpe's tc's. */
+ 			list_add(&t->tc, &v->tc);
+@@ -519,3 +522,47 @@ void __exit vpe_module_exit(void)
+ 			release_vpe(v);
+ 	}
+ }
++
++#ifdef CONFIG_IFX_VPE_EXT
++int32_t vpe1_sw_start(void *sw_start_addr, uint32_t tcmask, uint32_t flags)
++{
++	enum vpe_state state;
++	struct vpe *v = get_vpe(tclimit);
++	struct vpe_notifications *not;
++
++	if (tcmask || flags) {
++		pr_warn("Currently tcmask and flags should be 0. Other values are not supported\n");
++		return -1;
++	}
++
++	state = xchg(&v->state, VPE_STATE_INUSE);
++	if (state != VPE_STATE_UNUSED) {
++		vpe_stop(v);
++
++		list_for_each_entry(not, &v->notify, list) {
++			not->stop(tclimit);
++		}
++	}
++
++	v->__start = (unsigned long)sw_start_addr;
++
++	if (!vpe_run(v)) {
++		pr_debug("VPE loader: VPE1 running successfully\n");
++		return 0;
++	}
++	return -1;
++}
++EXPORT_SYMBOL(vpe1_sw_start);
++
++int32_t vpe1_sw_stop(uint32_t flags)
++{
++	struct vpe *v = get_vpe(tclimit);
++
++	if (!vpe_free(v)) {
++		pr_debug("RP Stopped\n");
++		return 0;
++	} else
++		return -1;
++}
++EXPORT_SYMBOL(vpe1_sw_stop);
++#endif
+--- a/arch/mips/kernel/vpe.c
++++ b/arch/mips/kernel/vpe.c
+@@ -49,6 +49,41 @@ struct vpe_control vpecontrol = {
+ 	.tc_list	= LIST_HEAD_INIT(vpecontrol.tc_list)
+ };
+ 
++#ifdef CONFIG_IFX_VPE_EXT
++unsigned int vpe1_load_addr;
++
++static int __init load_address(char *str)
++{
++	get_option(&str, &vpe1_load_addr);
++	return 1;
++}
++__setup("vpe1_load_addr=", load_address);
++
++static unsigned int vpe1_mem;
++static int __init vpe1mem(char *str)
++{
++	vpe1_mem = memparse(str, &str);
++	return 1;
++}
++__setup("vpe1_mem=", vpe1mem);
++
++uint32_t vpe1_get_load_addr(uint32_t flags)
++{
++	return vpe1_load_addr;
++}
++EXPORT_SYMBOL(vpe1_get_load_addr);
++
++uint32_t vpe1_get_max_mem(uint32_t flags)
++{
++	if (!vpe1_mem)
++		return P_SIZE;
++	else
++		return vpe1_mem;
++}
++EXPORT_SYMBOL(vpe1_get_max_mem);
++
++#endif
++
+ /* get the vpe associated with this minor */
+ struct vpe *get_vpe(int minor)
+ {
+--- a/arch/mips/lantiq/prom.c
++++ b/arch/mips/lantiq/prom.c
+@@ -34,10 +34,14 @@ unsigned long physical_memsize = 0L;
+  */
+ static struct ltq_soc_info soc_info;
+ 
++/* for Multithreading (APRP), vpe.c will use it */
++unsigned long cp0_memsize;
++
+ const char *get_system_type(void)
+ {
+ 	return soc_info.sys_type;
+ }
++EXPORT_SYMBOL(ltq_soc_type);
+ 
+ int ltq_soc_type(void)
+ {
diff --git a/target/linux/lantiq/patches-5.15/0154-lantiq-pci-bar11mask-fix.patch b/target/linux/lantiq/patches-5.15/0154-lantiq-pci-bar11mask-fix.patch
new file mode 100644
index 00000000000000..9214f786d7b9cc
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0154-lantiq-pci-bar11mask-fix.patch
@@ -0,0 +1,32 @@
+From 3c92a781de062064e36b867c0ab22f9aba48f3d3 Mon Sep 17 00:00:00 2001
+From: Eddi De Pieri <eddi@depieri.net>
+Date: Tue, 8 Nov 2016 17:38:00 +0100
+Subject: [PATCH] lantiq: pci: bar11mask fix
+
+Signed-off-by: Eddi De Pieri <eddi@depieri.net>
+---
+ arch/mips/pci/pci-lantiq.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/mips/pci/pci-lantiq.c
++++ b/arch/mips/pci/pci-lantiq.c
+@@ -59,6 +59,8 @@
+ #define ltq_pci_cfg_w32(x, y)	ltq_w32((x), ltq_pci_mapped_cfg + (y))
+ #define ltq_pci_cfg_r32(x)	ltq_r32(ltq_pci_mapped_cfg + (x))
+ 
++extern u32 max_low_pfn;
++
+ __iomem void *ltq_pci_mapped_cfg;
+ static __iomem void *ltq_pci_membase;
+ 
+@@ -84,8 +86,8 @@ static inline u32 ltq_calc_bar11mask(voi
+ 	u32 mem, bar11mask;
+ 
+ 	/* BAR11MASK value depends on available memory on system. */
+-	mem = get_num_physpages() * PAGE_SIZE;
+-	bar11mask = (0x0ffffff0 & ~((1 << (fls(mem) - 1)) - 1)) | 8;
++	mem = max_low_pfn << PAGE_SHIFT;
++	bar11mask = ((-roundup_pow_of_two(mem)) & 0x0F000000) | 8;
+ 
+ 	return bar11mask;
+ }
diff --git a/target/linux/lantiq/patches-5.15/0155-lantiq-VPE-nosmp.patch b/target/linux/lantiq/patches-5.15/0155-lantiq-VPE-nosmp.patch
new file mode 100644
index 00000000000000..6562dc8bdab7be
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0155-lantiq-VPE-nosmp.patch
@@ -0,0 +1,24 @@
+From 07ce9e9bc4dcd5ac4728e587901112eef95bbe7b Mon Sep 17 00:00:00 2001
+From: Stefan Koch <stefan.koch10@gmail.com>
+Date: Mon, 13 Mar 2017 23:42:00 +0100
+Subject: [PATCH] lantiq: vpe nosmp
+
+Signed-off-by: Stefan Koch <stefan.koch10@gmail.com>
+---
+ arch/mips/kernel/vpe-mt.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/arch/mips/kernel/vpe-mt.c
++++ b/arch/mips/kernel/vpe-mt.c
+@@ -132,7 +132,10 @@ int vpe_run(struct vpe *v)
+ 	 * kernels need to turn it on, even if that wasn't the pre-dvpe() state.
+ 	 */
+ #ifdef CONFIG_SMP
+-	evpe(vpeflags);
++	if (!setup_max_cpus) /* nosmp is set */
++		evpe(EVPE_ENABLE);
++	else
++		evpe(vpeflags);
+ #else
+ 	evpe(EVPE_ENABLE);
+ #endif
diff --git a/target/linux/lantiq/patches-5.15/0160-owrt-lantiq-multiple-flash.patch b/target/linux/lantiq/patches-5.15/0160-owrt-lantiq-multiple-flash.patch
new file mode 100644
index 00000000000000..a83325c094d97c
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0160-owrt-lantiq-multiple-flash.patch
@@ -0,0 +1,230 @@
+From ebaae1cd68cd79c7eee67c9c5c0fa45809e84525 Mon Sep 17 00:00:00 2001
+From: Maikel Bloemendal <openwrt@maikelenyvonne.nl>
+Date: Fri, 14 Nov 2014 17:06:00 +0000
+Subject: [PATCH] owrt: lantiq: multiple flash
+
+Signed-off-by: Maikel Bloemendal <openwrt@maikelenyvonne.nl>
+---
+ drivers/mtd/maps/lantiq-flash.c | 168 +++++++++++++++++++++-----------
+ 1 file changed, 109 insertions(+), 59 deletions(-)
+
+--- a/drivers/mtd/maps/lantiq-flash.c
++++ b/drivers/mtd/maps/lantiq-flash.c
+@@ -17,6 +17,7 @@
+ #include <linux/mtd/cfi.h>
+ #include <linux/platform_device.h>
+ #include <linux/mtd/physmap.h>
++#include <linux/mtd/concat.h>
+ #include <linux/of.h>
+ 
+ #include <lantiq_soc.h>
+@@ -36,13 +37,16 @@ enum {
+ 	LTQ_NOR_NORMAL
+ };
+ 
++#define MAX_RESOURCES		4
++
+ struct ltq_mtd {
+-	struct resource *res;
+-	struct mtd_info *mtd;
+-	struct map_info *map;
++	struct mtd_info *mtd[MAX_RESOURCES];
++	struct mtd_info	*cmtd;
++	struct map_info map[MAX_RESOURCES];
+ };
+ 
+ static const char ltq_map_name[] = "ltq_nor";
++static const char * const ltq_probe_types[] = { "cmdlinepart", "ofpart", NULL };
+ 
+ static map_word
+ ltq_read16(struct map_info *map, unsigned long adr)
+@@ -106,11 +110,43 @@ ltq_copy_to(struct map_info *map, unsign
+ }
+ 
+ static int
++ltq_mtd_remove(struct platform_device *pdev)
++{
++	struct ltq_mtd *ltq_mtd = platform_get_drvdata(pdev);
++	int i;
++
++	if (ltq_mtd == NULL)
++		return 0;
++
++	if (ltq_mtd->cmtd) {
++		mtd_device_unregister(ltq_mtd->cmtd);
++		if (ltq_mtd->cmtd != ltq_mtd->mtd[0])
++			mtd_concat_destroy(ltq_mtd->cmtd);
++	}
++
++	for (i = 0; i < MAX_RESOURCES; i++) {
++		if (ltq_mtd->mtd[i] != NULL)
++			map_destroy(ltq_mtd->mtd[i]);
++	}
++
++	kfree(ltq_mtd);
++
++	return 0;
++}
++
++static int
+ ltq_mtd_probe(struct platform_device *pdev)
+ {
+ 	struct ltq_mtd *ltq_mtd;
+ 	struct cfi_private *cfi;
+-	int err;
++	int err = 0;
++	int i;
++	int devices_found = 0;
++
++	static const char *rom_probe_types[] = {
++		"cfi_probe", "jedec_probe", NULL
++	};
++	const char **type;
+ 
+ 	ltq_mtd = devm_kzalloc(&pdev->dev, sizeof(struct ltq_mtd), GFP_KERNEL);
+ 	if (!ltq_mtd)
+@@ -118,75 +154,89 @@ ltq_mtd_probe(struct platform_device *pd
+ 
+ 	platform_set_drvdata(pdev, ltq_mtd);
+ 
+-	ltq_mtd->res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	if (!ltq_mtd->res) {
+-		dev_err(&pdev->dev, "failed to get memory resource\n");
+-		return -ENOENT;
++	for (i = 0; i < pdev->num_resources; i++) {
++		printk(KERN_NOTICE "lantiq nor flash device: %.8llx at %.8llx\n",
++		       (unsigned long long)resource_size(&pdev->resource[i]),
++		       (unsigned long long)pdev->resource[i].start);
++	
++		if (!devm_request_mem_region(&pdev->dev,
++			pdev->resource[i].start,
++			resource_size(&pdev->resource[i]),
++			dev_name(&pdev->dev))) {
++			dev_err(&pdev->dev, "Could not reserve memory region\n");
++			return -ENOMEM;
++		}
++
++		ltq_mtd->map[i].name = ltq_map_name;
++		ltq_mtd->map[i].bankwidth = 2;
++		ltq_mtd->map[i].read = ltq_read16;
++		ltq_mtd->map[i].write = ltq_write16;
++		ltq_mtd->map[i].copy_from = ltq_copy_from;
++		ltq_mtd->map[i].copy_to = ltq_copy_to;
++
++		if (of_find_property(pdev->dev.of_node, "lantiq,noxip", NULL))
++			ltq_mtd->map[i].phys = NO_XIP;
++		else
++			ltq_mtd->map[i].phys = pdev->resource[i].start;
++		ltq_mtd->map[i].size = resource_size(&pdev->resource[i]);
++		ltq_mtd->map[i].virt = devm_ioremap(&pdev->dev, pdev->resource[i].start,
++						 ltq_mtd->map[i].size);
++		if (IS_ERR(ltq_mtd->map[i].virt))
++			return PTR_ERR(ltq_mtd->map[i].virt);
++
++		if (ltq_mtd->map[i].virt == NULL) {
++			dev_err(&pdev->dev, "Failed to ioremap flash region\n");
++			err = PTR_ERR(ltq_mtd->map[i].virt);
++			goto err_out;
++		}
++
++		ltq_mtd->map[i].map_priv_1 = LTQ_NOR_PROBING;
++		for (type = rom_probe_types; !ltq_mtd->mtd[i] && *type; type++)
++			ltq_mtd->mtd[i] = do_map_probe(*type, &ltq_mtd->map[i]);
++		ltq_mtd->map[i].map_priv_1 = LTQ_NOR_NORMAL;
++
++		if (!ltq_mtd->mtd[i]) {
++			dev_err(&pdev->dev, "probing failed\n");
++			return -ENXIO;
++		} else {
++			devices_found++;
++		}
++
++		ltq_mtd->mtd[i]->owner = THIS_MODULE;
++		ltq_mtd->mtd[i]->dev.parent = &pdev->dev;
++
++		cfi = ltq_mtd->map[i].fldrv_priv;
++		cfi->addr_unlock1 ^= 1;
++		cfi->addr_unlock2 ^= 1;
+ 	}
+ 
+-	ltq_mtd->map = devm_kzalloc(&pdev->dev, sizeof(struct map_info),
+-				    GFP_KERNEL);
+-	if (!ltq_mtd->map)
+-		return -ENOMEM;
+-
+-	if (of_find_property(pdev->dev.of_node, "lantiq,noxip", NULL))
+-		ltq_mtd->map->phys = NO_XIP;
+-	else
+-		ltq_mtd->map->phys = ltq_mtd->res->start;
+-	ltq_mtd->res->start;
+-	ltq_mtd->map->size = resource_size(ltq_mtd->res);
+-	ltq_mtd->map->virt = devm_ioremap_resource(&pdev->dev, ltq_mtd->res);
+-	if (IS_ERR(ltq_mtd->map->virt))
+-		return PTR_ERR(ltq_mtd->map->virt);
+-
+-	ltq_mtd->map->name = ltq_map_name;
+-	ltq_mtd->map->bankwidth = 2;
+-	ltq_mtd->map->read = ltq_read16;
+-	ltq_mtd->map->write = ltq_write16;
+-	ltq_mtd->map->copy_from = ltq_copy_from;
+-	ltq_mtd->map->copy_to = ltq_copy_to;
+-
+-	ltq_mtd->map->map_priv_1 = LTQ_NOR_PROBING;
+-	ltq_mtd->mtd = do_map_probe("cfi_probe", ltq_mtd->map);
+-	ltq_mtd->map->map_priv_1 = LTQ_NOR_NORMAL;
+-
+-	if (!ltq_mtd->mtd) {
+-		dev_err(&pdev->dev, "probing failed\n");
+-		return -ENXIO;
++	if (devices_found == 1) {
++		ltq_mtd->cmtd = ltq_mtd->mtd[0];
++	} else if (devices_found > 1) {
++		/*
++		 * We detected multiple devices. Concatenate them together.
++		 */
++		ltq_mtd->cmtd = mtd_concat_create(ltq_mtd->mtd, devices_found, dev_name(&pdev->dev));
++		if (ltq_mtd->cmtd == NULL)
++			err = -ENXIO;
+ 	}
+ 
+-	ltq_mtd->mtd->dev.parent = &pdev->dev;
+-	mtd_set_of_node(ltq_mtd->mtd, pdev->dev.of_node);
+-
+-	cfi = ltq_mtd->map->fldrv_priv;
+-	cfi->addr_unlock1 ^= 1;
+-	cfi->addr_unlock2 ^= 1;
++	ltq_mtd->cmtd->dev.parent = &pdev->dev;
++	mtd_set_of_node(ltq_mtd->cmtd, pdev->dev.of_node);
+ 
+-	err = mtd_device_register(ltq_mtd->mtd, NULL, 0);
++	err = mtd_device_register(ltq_mtd->cmtd, NULL, 0);
+ 	if (err) {
+ 		dev_err(&pdev->dev, "failed to add partitions\n");
+-		goto err_destroy;
++		goto err_out;
+ 	}
+ 
+ 	return 0;
+ 
+-err_destroy:
+-	map_destroy(ltq_mtd->mtd);
++err_out:
++	ltq_mtd_remove(pdev);
+ 	return err;
+ }
+ 
+-static int
+-ltq_mtd_remove(struct platform_device *pdev)
+-{
+-	struct ltq_mtd *ltq_mtd = platform_get_drvdata(pdev);
+-
+-	if (ltq_mtd && ltq_mtd->mtd) {
+-		mtd_device_unregister(ltq_mtd->mtd);
+-		map_destroy(ltq_mtd->mtd);
+-	}
+-	return 0;
+-}
+-
+ static const struct of_device_id ltq_mtd_match[] = {
+ 	{ .compatible = "lantiq,nor" },
+ 	{},
diff --git a/target/linux/lantiq/patches-5.15/0300-MTD-cfi-cmdset-0001-disable-buffered-writes.patch b/target/linux/lantiq/patches-5.15/0300-MTD-cfi-cmdset-0001-disable-buffered-writes.patch
new file mode 100644
index 00000000000000..f62d16707844a0
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0300-MTD-cfi-cmdset-0001-disable-buffered-writes.patch
@@ -0,0 +1,21 @@
+From 5e93c85ac3e5626d1aa7e7f9c0a008b2a4224f04 Mon Sep 17 00:00:00 2001
+From: Matti Laakso <malaakso@elisanet.fi>
+Date: Sat, 14 Feb 2015 20:48:00 +0000
+Subject: [PATCH] MTD: cfi_cmdset_0001: disable buffered writes
+
+Signed-off-by: Matti Laakso <malaakso@elisanet.fi>
+---
+ drivers/mtd/chips/cfi_cmdset_0001.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/chips/cfi_cmdset_0001.c
++++ b/drivers/mtd/chips/cfi_cmdset_0001.c
+@@ -39,7 +39,7 @@
+ /* #define CMDSET0001_DISABLE_WRITE_SUSPEND */
+ 
+ // debugging, turns off buffer write mode if set to 1
+-#define FORCE_WORD_WRITE 0
++#define FORCE_WORD_WRITE 1
+ 
+ /* Intel chips */
+ #define I82802AB	0x00ad
diff --git a/target/linux/lantiq/patches-5.15/0301-xrx200-add-gphy-clk-src-device-tree-binding.patch b/target/linux/lantiq/patches-5.15/0301-xrx200-add-gphy-clk-src-device-tree-binding.patch
new file mode 100644
index 00000000000000..6dacba56d5a2eb
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0301-xrx200-add-gphy-clk-src-device-tree-binding.patch
@@ -0,0 +1,40 @@
+From 5502ef9d40ab20b2ac683660d1565a7c4968bcc8 Mon Sep 17 00:00:00 2001
+From: Mathias Kresin <openwrt@kresin.me>
+Date: Mon, 2 May 2016 18:50:00 +0000
+Subject: [PATCH] xrx200: add gphy clk src device tree binding
+
+Signed-off-by: Mathias Kresin <openwrt@kresin.me>
+---
+ arch/mips/lantiq/xway/sysctrl.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/arch/mips/lantiq/xway/sysctrl.c
++++ b/arch/mips/lantiq/xway/sysctrl.c
+@@ -440,6 +440,20 @@ static void clkdev_add_clkout(void)
+ 	}
+ }
+ 
++static void set_phy_clock_source(struct device_node *np_cgu)
++{
++	u32 phy_clk_src, ifcc;
++
++	if (!np_cgu)
++		return;
++
++	if (of_property_read_u32(np_cgu, "lantiq,phy-clk-src", &phy_clk_src))
++		return;
++
++	ifcc = ltq_cgu_r32(ifccr) & ~(0x1c);
++	ltq_cgu_w32(ifcc | (phy_clk_src << 2), ifccr);
++}
++
+ /* bring up all register ranges that we need for basic system control */
+ void __init ltq_soc_init(void)
+ {
+@@ -605,4 +619,6 @@ void __init ltq_soc_init(void)
+ 		clkdev_add_pmu("1e100400.serial", NULL, 1, 0, PMU_ASC0);
+ 	}
+ 	usb_set_clock();
++
++	set_phy_clock_source(np_cgu);
+ }
diff --git a/target/linux/lantiq/patches-5.15/0302-mtd-cfi_cmdset_0001-Disable-write-buffer-functions-i.patch b/target/linux/lantiq/patches-5.15/0302-mtd-cfi_cmdset_0001-Disable-write-buffer-functions-i.patch
new file mode 100644
index 00000000000000..741011039eeb21
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0302-mtd-cfi_cmdset_0001-Disable-write-buffer-functions-i.patch
@@ -0,0 +1,62 @@
+From 118fe2c88b35482711adeee0d8758bddfe958701 Mon Sep 17 00:00:00 2001
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+Date: Sat, 6 May 2023 14:32:00 +0200
+Subject: [PATCH] mtd: cfi_cmdset_0001: Disable write buffer functions if
+ FORCE_WORD_WRITE is 1
+
+Some write buffer functions are not used when FORCE_WORD_WRITE is set to 1.
+So the compile warning messages are output if FORCE_WORD_WRITE is 1. To
+resolve this disable the write buffer functions if FORCE_WORD_WRITE is 1.
+
+This is similar fix to: 557c759036fc3976a5358cef23e65a263853b93f.
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+---
+ drivers/mtd/chips/cfi_cmdset_0001.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/mtd/chips/cfi_cmdset_0001.c
++++ b/drivers/mtd/chips/cfi_cmdset_0001.c
+@@ -61,8 +61,10 @@
+ 
+ static int cfi_intelext_read (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
+ static int cfi_intelext_write_words(struct mtd_info *, loff_t, size_t, size_t *, const u_char *);
++#if !FORCE_WORD_WRITE
+ static int cfi_intelext_write_buffers(struct mtd_info *, loff_t, size_t, size_t *, const u_char *);
+ static int cfi_intelext_writev(struct mtd_info *, const struct kvec *, unsigned long, loff_t, size_t *);
++#endif
+ static int cfi_intelext_erase_varsize(struct mtd_info *, struct erase_info *);
+ static void cfi_intelext_sync (struct mtd_info *);
+ static int cfi_intelext_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len);
+@@ -304,6 +306,7 @@ static void fixup_use_point(struct mtd_i
+ 	}
+ }
+ 
++#if !FORCE_WORD_WRITE
+ static void fixup_use_write_buffers(struct mtd_info *mtd)
+ {
+ 	struct map_info *map = mtd->priv;
+@@ -314,6 +317,7 @@ static void fixup_use_write_buffers(stru
+ 		mtd->_writev = cfi_intelext_writev;
+ 	}
+ }
++#endif /* !FORCE_WORD_WRITE */
+ 
+ /*
+  * Some chips power-up with all sectors locked by default.
+@@ -1703,6 +1707,7 @@ static int cfi_intelext_write_words (str
+ }
+ 
+ 
++#if !FORCE_WORD_WRITE
+ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
+ 				    unsigned long adr, const struct kvec **pvec,
+ 				    unsigned long *pvec_seek, int len)
+@@ -1931,6 +1936,7 @@ static int cfi_intelext_write_buffers (s
+ 
+ 	return cfi_intelext_writev(mtd, &vec, 1, to, retlen);
+ }
++#endif /* !FORCE_WORD_WRITE */
+ 
+ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
+ 				      unsigned long adr, int len, void *thunk)
diff --git a/target/linux/lantiq/patches-5.15/0310-v5.16-MIPS-lantiq-dma-make-the-burst-length-configurable-b.patch b/target/linux/lantiq/patches-5.15/0310-v5.16-MIPS-lantiq-dma-make-the-burst-length-configurable-b.patch
new file mode 100644
index 00000000000000..4f3210a6c39b85
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0310-v5.16-MIPS-lantiq-dma-make-the-burst-length-configurable-b.patch
@@ -0,0 +1,86 @@
+From 49293bbc50cb7d44223eb49e0f7cb38e7dac2361 Mon Sep 17 00:00:00 2001
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+Date: Tue, 14 Sep 2021 23:21:01 +0200
+Subject: [PATCH 4/5] MIPS: lantiq: dma: make the burst length configurable by
+ the drivers
+
+Make the burst length configurable by the drivers.
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ .../include/asm/mach-lantiq/xway/xway_dma.h   |  2 +-
+ arch/mips/lantiq/xway/dma.c                   | 38 ++++++++++++++++---
+ 2 files changed, 34 insertions(+), 6 deletions(-)
+
+--- a/arch/mips/include/asm/mach-lantiq/xway/xway_dma.h
++++ b/arch/mips/include/asm/mach-lantiq/xway/xway_dma.h
+@@ -45,6 +45,6 @@ extern void ltq_dma_close(struct ltq_dma
+ extern void ltq_dma_alloc_tx(struct ltq_dma_channel *ch);
+ extern void ltq_dma_alloc_rx(struct ltq_dma_channel *ch);
+ extern void ltq_dma_free(struct ltq_dma_channel *ch);
+-extern void ltq_dma_init_port(int p);
++extern void ltq_dma_init_port(int p, int tx_burst, int rx_burst);
+ 
+ #endif
+--- a/arch/mips/lantiq/xway/dma.c
++++ b/arch/mips/lantiq/xway/dma.c
+@@ -182,7 +182,7 @@ ltq_dma_free(struct ltq_dma_channel *ch)
+ EXPORT_SYMBOL_GPL(ltq_dma_free);
+ 
+ void
+-ltq_dma_init_port(int p)
++ltq_dma_init_port(int p, int tx_burst, int rx_burst)
+ {
+ 	ltq_dma_w32(p, LTQ_DMA_PS);
+ 	switch (p) {
+@@ -191,16 +191,44 @@ ltq_dma_init_port(int p)
+ 		 * Tell the DMA engine to swap the endianness of data frames and
+ 		 * drop packets if the channel arbitration fails.
+ 		 */
+-		ltq_dma_w32_mask(0, DMA_ETOP_ENDIANNESS | DMA_PDEN,
++		ltq_dma_w32_mask(0, (DMA_ETOP_ENDIANNESS | DMA_PDEN),
+ 			LTQ_DMA_PCTRL);
+ 		break;
+ 
+-	case DMA_PORT_DEU:
+-		ltq_dma_w32((DMA_PCTRL_2W_BURST << DMA_TX_BURST_SHIFT) |
+-			(DMA_PCTRL_2W_BURST << DMA_RX_BURST_SHIFT),
++	default:
++		break;
++	}
++
++	switch (rx_burst) {
++	case 8:
++		ltq_dma_w32_mask(0x0c, (DMA_PCTRL_8W_BURST << DMA_RX_BURST_SHIFT),
+ 			LTQ_DMA_PCTRL);
+ 		break;
++	case 4:
++		ltq_dma_w32_mask(0x0c, (DMA_PCTRL_4W_BURST << DMA_RX_BURST_SHIFT),
++			LTQ_DMA_PCTRL);
++		break;
++	case 2:
++		ltq_dma_w32_mask(0x0c, (DMA_PCTRL_2W_BURST << DMA_RX_BURST_SHIFT),
++			LTQ_DMA_PCTRL);
++		break;
++	default:
++		break;
++	}
+ 
++	switch (tx_burst) {
++	case 8:
++		ltq_dma_w32_mask(0x30, (DMA_PCTRL_8W_BURST << DMA_TX_BURST_SHIFT),
++			LTQ_DMA_PCTRL);
++		break;
++	case 4:
++		ltq_dma_w32_mask(0x30, (DMA_PCTRL_4W_BURST << DMA_TX_BURST_SHIFT),
++			LTQ_DMA_PCTRL);
++		break;
++	case 2:
++		ltq_dma_w32_mask(0x30, (DMA_PCTRL_2W_BURST << DMA_TX_BURST_SHIFT),
++			LTQ_DMA_PCTRL);
++		break;
+ 	default:
+ 		break;
+ 	}
diff --git a/target/linux/lantiq/patches-5.15/0320-v6.1-MIPS-lantiq-enable-all-hardware-interrupts-on-second.patch b/target/linux/lantiq/patches-5.15/0320-v6.1-MIPS-lantiq-enable-all-hardware-interrupts-on-second.patch
new file mode 100644
index 00000000000000..d83a3616b355eb
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0320-v6.1-MIPS-lantiq-enable-all-hardware-interrupts-on-second.patch
@@ -0,0 +1,87 @@
+From 730320fd770d4114a2ecb6fb223dcc8c3cecdc5b Mon Sep 17 00:00:00 2001
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+Date: Wed, 21 Sep 2022 22:59:44 +0200
+Subject: [PATCH] MIPS: lantiq: enable all hardware interrupts on second VPE
+
+This patch is needed to handle interrupts by the second VPE on the Lantiq
+ARX100, xRX200, xRX300 and xRX330 SoCs. Switching some ICU interrupts to
+the second VPE results in a hang. Currently, the vsmp_init_secondary()
+function is responsible for enabling these interrupts. It only enables
+Malta-specific interrupts (SW0, SW1, HW4 and HW5).
+
+The MIPS core has 8 interrupts defined. On Lantiq SoCs, hardware
+interrupts are wired to an ICU instance. Each VPE has an independent
+instance of the ICU. The mapping of the ICU interrupts is shown below:
+SW0(IP0) - IPI call,
+SW1(IP1) - IPI resched,
+HW0(IP2) - ICU 0-31,
+HW1(IP3) - ICU 32-63,
+HW2(IP4) - ICU 64-95,
+HW3(IP5) - ICU 96-127,
+HW4(IP6) - ICU 128-159,
+HW5(IP7) - timer.
+
+This patch enables all interrupt lines on the second VPE.
+
+This problem affects multithreaded SoCs with a custom interrupt controller.
+SOCs with 1004Kc core and newer use the MIPS GIC. At this point, I am aware
+that the Realtek RTL839x and RTL930x SoCs may need a similar fix. In the
+future, this may be replaced with some generic solution.
+
+Tested on Lantiq xRX200.
+
+Suggested-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+---
+ arch/mips/lantiq/prom.c | 26 ++++++++++++++++++++++++--
+ 1 file changed, 24 insertions(+), 2 deletions(-)
+
+--- a/arch/mips/lantiq/prom.c
++++ b/arch/mips/lantiq/prom.c
+@@ -37,6 +37,14 @@ static struct ltq_soc_info soc_info;
+ /* for Multithreading (APRP), vpe.c will use it */
+ unsigned long cp0_memsize;
+ 
++/*
++ * These structs are used to override vsmp_init_secondary()
++ */
++#if defined(CONFIG_MIPS_MT_SMP)
++extern const struct plat_smp_ops vsmp_smp_ops;
++static struct plat_smp_ops lantiq_smp_ops;
++#endif
++
+ const char *get_system_type(void)
+ {
+ 	return soc_info.sys_type;
+@@ -93,6 +101,17 @@ void __init device_tree_init(void)
+ 	unflatten_and_copy_device_tree();
+ }
+ 
++#if defined(CONFIG_MIPS_MT_SMP)
++static void lantiq_init_secondary(void)
++{
++	/*
++	 * MIPS CPU startup function vsmp_init_secondary() will only
++	 * enable some of the interrupts for the second CPU/VPE.
++	 */
++	set_c0_status(ST0_IM);
++}
++#endif
++
+ void __init prom_init(void)
+ {
+ 	/* call the soc specific detetcion code and get it to fill soc_info */
+@@ -104,7 +123,10 @@ void __init prom_init(void)
+ 	prom_init_cmdline();
+ 
+ #if defined(CONFIG_MIPS_MT_SMP)
+-	if (register_vsmp_smp_ops())
+-		panic("failed to register_vsmp_smp_ops()");
++	if (cpu_has_mipsmt) {
++		lantiq_smp_ops = vsmp_smp_ops;
++		lantiq_smp_ops.init_secondary = lantiq_init_secondary;
++		register_smp_ops(&lantiq_smp_ops);
++	}
+ #endif
+ }
diff --git a/target/linux/lantiq/patches-5.15/0400-mtd-rawnand-xway-don-t-yield-while-holding-spinlock.patch b/target/linux/lantiq/patches-5.15/0400-mtd-rawnand-xway-don-t-yield-while-holding-spinlock.patch
new file mode 100644
index 00000000000000..edf06268609226
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0400-mtd-rawnand-xway-don-t-yield-while-holding-spinlock.patch
@@ -0,0 +1,38 @@
+From 416f25a948d11ef15733f2e31658d31b5cc7bef6 Mon Sep 17 00:00:00 2001
+From: Thomas Nixon <tom@tomn.co.uk>
+Date: Sun, 26 Mar 2023 11:08:49 +0100
+Subject: [PATCH] mtd: rawnand: xway: don't yield while holding spinlock
+
+The nand driver normally while waiting for the device to become ready;
+this is normally fine, but xway_nand holds the ebu_lock spinlock, and
+this can cause lockups if other threads which use ebu_lock are
+interleaved. Fix this by waiting instead of polling.
+
+This mainly showed up as crashes in ath9k_pci_owl_loader (see
+https://github.com/openwrt/openwrt/issues/9829 ), but turning on
+spinlock debugging shows this happening in other places too.
+
+This doesn't seem to measurably impact boot time.
+
+Signed-off-by: Thomas Nixon <tom@tomn.co.uk>
+---
+ drivers/mtd/nand/raw/xway_nand.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/raw/xway_nand.c
++++ b/drivers/mtd/nand/raw/xway_nand.c
+@@ -175,7 +175,13 @@ static void xway_cmd_ctrl(struct nand_ch
+ 
+ static int xway_dev_ready(struct nand_chip *chip)
+ {
+-	return ltq_ebu_r32(EBU_NAND_WAIT) & NAND_WAIT_RD;
++	/*
++	 * wait until ready, as otherwise the driver will yield in nand_wait or
++	 * nand_wait_ready, which is a bad idea when we're holding ebu_lock
++	 */
++	while ((ltq_ebu_r32(EBU_NAND_WAIT) & NAND_WAIT_RD) == 0)
++		cpu_relax();
++	return 1;
+ }
+ 
+ static unsigned char xway_read_byte(struct nand_chip *chip)
diff --git a/target/linux/lantiq/patches-5.15/0701-NET-lantiq-etop-of-mido.patch b/target/linux/lantiq/patches-5.15/0701-NET-lantiq-etop-of-mido.patch
new file mode 100644
index 00000000000000..7e49b47e028248
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0701-NET-lantiq-etop-of-mido.patch
@@ -0,0 +1,47 @@
+From 870ed9cae083ff8a60a739ef7e74c5a1800533be Mon Sep 17 00:00:00 2001
+From: Johann Neuhauser <johann@it-neuhauser.de>
+Date: Thu, 17 May 2018 19:12:35 +0200
+Subject: [PATCH] net: lantiq_etop: of mdio
+
+Signed-off-by: Johann Neuhauser <johann@it-neuhauser.de>
+---
+ drivers/net/ethernet/lantiq_etop.c |  555 +++++++++++++++++++++++++-----------
+ 1 file changed, 389 insertions(+), 166 deletions(-)
+
+--- a/drivers/net/ethernet/lantiq_etop.c
++++ b/drivers/net/ethernet/lantiq_etop.c
+@@ -30,6 +30,7 @@
+ #include <linux/of_net.h>
+ #include <linux/of_irq.h>
+ #include <linux/of_platform.h>
++#include <linux/of_mdio.h>
+ 
+ #include <asm/checksum.h>
+ 
+@@ -553,7 +554,8 @@ static int
+ ltq_etop_mdio_init(struct net_device *dev)
+ {
+ 	struct ltq_etop_priv *priv = netdev_priv(dev);
+-	int err;
++	struct device_node *mdio_np = NULL;
++	int err, ret;
+ 
+ 	priv->mii_bus = mdiobus_alloc();
+ 	if (!priv->mii_bus) {
+@@ -573,7 +575,15 @@ ltq_etop_mdio_init(struct net_device *de
+ 	priv->mii_bus->name = "ltq_mii";
+ 	snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
+ 		priv->pdev->name, priv->pdev->id);
+-	if (mdiobus_register(priv->mii_bus)) {
++
++	mdio_np = of_get_child_by_name(priv->pdev->dev.of_node, "mdio-bus");
++
++	if (mdio_np)
++		ret = of_mdiobus_register(priv->mii_bus, mdio_np);
++	else
++		ret = mdiobus_register(priv->mii_bus);
++
++	if (ret) {
+ 		err = -ENXIO;
+ 		goto err_out_free_mdiobus;
+ 	}
diff --git a/target/linux/lantiq/patches-5.15/0702-v5.16-net-lantiq-add-support-for-jumbo-frames.patch b/target/linux/lantiq/patches-5.15/0702-v5.16-net-lantiq-add-support-for-jumbo-frames.patch
new file mode 100644
index 00000000000000..4a4109c7725ad4
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0702-v5.16-net-lantiq-add-support-for-jumbo-frames.patch
@@ -0,0 +1,145 @@
+From 998ac358019e491217e752bc6dcbb3afb2a6fa3e Mon Sep 17 00:00:00 2001
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+Date: Sun, 19 Sep 2021 20:24:28 +0200
+Subject: [PATCH] net: lantiq: add support for jumbo frames
+
+Add support for jumbo frames. Full support for jumbo frames requires
+changes in the DSA switch driver (lantiq_gswip.c).
+
+Tested on BT Hone Hub 5A.
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/lantiq_xrx200.c | 64 +++++++++++++++++++++++++---
+ 1 file changed, 57 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/lantiq_xrx200.c
++++ b/drivers/net/ethernet/lantiq_xrx200.c
+@@ -14,13 +14,15 @@
+ #include <linux/clk.h>
+ #include <linux/delay.h>
+ 
++#include <linux/if_vlan.h>
++
+ #include <linux/of_net.h>
+ #include <linux/of_platform.h>
+ 
+ #include <xway_dma.h>
+ 
+ /* DMA */
+-#define XRX200_DMA_DATA_LEN	0x600
++#define XRX200_DMA_DATA_LEN	(SZ_64K - 1)
+ #define XRX200_DMA_RX		0
+ #define XRX200_DMA_TX		1
+ 
+@@ -106,7 +108,8 @@ static void xrx200_flush_dma(struct xrx2
+ 			break;
+ 
+ 		desc->ctl = LTQ_DMA_OWN | LTQ_DMA_RX_OFFSET(NET_IP_ALIGN) |
+-			    XRX200_DMA_DATA_LEN;
++			    (ch->priv->net_dev->mtu + VLAN_ETH_HLEN +
++			     ETH_FCS_LEN);
+ 		ch->dma.desc++;
+ 		ch->dma.desc %= LTQ_DESC_NUM;
+ 	}
+@@ -154,19 +157,20 @@ static int xrx200_close(struct net_devic
+ 
+ static int xrx200_alloc_skb(struct xrx200_chan *ch)
+ {
++	int len = ch->priv->net_dev->mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
+ 	struct sk_buff *skb = ch->skb[ch->dma.desc];
+ 	dma_addr_t mapping;
+ 	int ret = 0;
+ 
+ 	ch->skb[ch->dma.desc] = netdev_alloc_skb_ip_align(ch->priv->net_dev,
+-							  XRX200_DMA_DATA_LEN);
++							  len);
+ 	if (!ch->skb[ch->dma.desc]) {
+ 		ret = -ENOMEM;
+ 		goto skip;
+ 	}
+ 
+ 	mapping = dma_map_single(ch->priv->dev, ch->skb[ch->dma.desc]->data,
+-				 XRX200_DMA_DATA_LEN, DMA_FROM_DEVICE);
++				 len, DMA_FROM_DEVICE);
+ 	if (unlikely(dma_mapping_error(ch->priv->dev, mapping))) {
+ 		dev_kfree_skb_any(ch->skb[ch->dma.desc]);
+ 		ch->skb[ch->dma.desc] = skb;
+@@ -179,8 +183,7 @@ static int xrx200_alloc_skb(struct xrx20
+ 	wmb();
+ skip:
+ 	ch->dma.desc_base[ch->dma.desc].ctl =
+-		LTQ_DMA_OWN | LTQ_DMA_RX_OFFSET(NET_IP_ALIGN) |
+-		XRX200_DMA_DATA_LEN;
++		LTQ_DMA_OWN | LTQ_DMA_RX_OFFSET(NET_IP_ALIGN) | len;
+ 
+ 	return ret;
+ }
+@@ -340,10 +343,57 @@ err_drop:
+ 	return NETDEV_TX_OK;
+ }
+ 
++static int
++xrx200_change_mtu(struct net_device *net_dev, int new_mtu)
++{
++	struct xrx200_priv *priv = netdev_priv(net_dev);
++	struct xrx200_chan *ch_rx = &priv->chan_rx;
++	int old_mtu = net_dev->mtu;
++	bool running = false;
++	struct sk_buff *skb;
++	int curr_desc;
++	int ret = 0;
++
++	net_dev->mtu = new_mtu;
++
++	if (new_mtu <= old_mtu)
++		return ret;
++
++	running = netif_running(net_dev);
++	if (running) {
++		napi_disable(&ch_rx->napi);
++		ltq_dma_close(&ch_rx->dma);
++	}
++
++	xrx200_poll_rx(&ch_rx->napi, LTQ_DESC_NUM);
++	curr_desc = ch_rx->dma.desc;
++
++	for (ch_rx->dma.desc = 0; ch_rx->dma.desc < LTQ_DESC_NUM;
++	     ch_rx->dma.desc++) {
++		skb = ch_rx->skb[ch_rx->dma.desc];
++		ret = xrx200_alloc_skb(ch_rx);
++		if (ret) {
++			net_dev->mtu = old_mtu;
++			break;
++		}
++		dev_kfree_skb_any(skb);
++	}
++
++	ch_rx->dma.desc = curr_desc;
++	if (running) {
++		napi_enable(&ch_rx->napi);
++		ltq_dma_open(&ch_rx->dma);
++		ltq_dma_enable_irq(&ch_rx->dma);
++	}
++
++	return ret;
++}
++
+ static const struct net_device_ops xrx200_netdev_ops = {
+ 	.ndo_open		= xrx200_open,
+ 	.ndo_stop		= xrx200_close,
+ 	.ndo_start_xmit		= xrx200_start_xmit,
++	.ndo_change_mtu		= xrx200_change_mtu,
+ 	.ndo_set_mac_address	= eth_mac_addr,
+ 	.ndo_validate_addr	= eth_validate_addr,
+ };
+@@ -453,7 +503,7 @@ static int xrx200_probe(struct platform_
+ 	net_dev->netdev_ops = &xrx200_netdev_ops;
+ 	SET_NETDEV_DEV(net_dev, dev);
+ 	net_dev->min_mtu = ETH_ZLEN;
+-	net_dev->max_mtu = XRX200_DMA_DATA_LEN;
++	net_dev->max_mtu = XRX200_DMA_DATA_LEN - VLAN_ETH_HLEN - ETH_FCS_LEN;
+ 
+ 	/* load the memory ranges */
+ 	priv->pmac_reg = devm_platform_get_and_ioremap_resource(pdev, 0, NULL);
diff --git a/target/linux/lantiq/patches-5.15/0703-v5.16-net-lantiq_xrx200-increase-buffer-reservation.patch b/target/linux/lantiq/patches-5.15/0703-v5.16-net-lantiq_xrx200-increase-buffer-reservation.patch
new file mode 100644
index 00000000000000..c197b1a1c957b0
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0703-v5.16-net-lantiq_xrx200-increase-buffer-reservation.patch
@@ -0,0 +1,122 @@
+From 1488fc204568f707fe2a42a913788c00a95af30e Mon Sep 17 00:00:00 2001
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+Date: Fri, 17 Dec 2021 01:07:40 +0100
+Subject: [PATCH] net: lantiq_xrx200: increase buffer reservation
+
+If the user sets a lower mtu on the CPU port than on the switch,
+then DMA inserts a few more bytes into the buffer than expected.
+In the worst case, it may exceed the size of the buffer. The
+experiments showed that the buffer should be a multiple of the
+burst length value. This patch rounds the length of the rx buffer
+upwards and fixes this bug. The reservation of FCS space in the
+buffer has been removed as PMAC strips the FCS.
+
+Fixes: 998ac358019e ("net: lantiq: add support for jumbo frames")
+Reported-by: Thomas Nixon <tom@tomn.co.uk>
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/lantiq_xrx200.c | 34 ++++++++++++++++++++--------
+ 1 file changed, 24 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/lantiq_xrx200.c
++++ b/drivers/net/ethernet/lantiq_xrx200.c
+@@ -70,6 +70,8 @@ struct xrx200_priv {
+ 	struct xrx200_chan chan_tx;
+ 	struct xrx200_chan chan_rx;
+ 
++	u16 rx_buf_size;
++
+ 	struct net_device *net_dev;
+ 	struct device *dev;
+ 
+@@ -96,6 +98,16 @@ static void xrx200_pmac_mask(struct xrx2
+ 	xrx200_pmac_w32(priv, val, offset);
+ }
+ 
++static int xrx200_max_frame_len(int mtu)
++{
++	return VLAN_ETH_HLEN + mtu;
++}
++
++static int xrx200_buffer_size(int mtu)
++{
++	return round_up(xrx200_max_frame_len(mtu), 4 * XRX200_DMA_BURST_LEN);
++}
++
+ /* drop all the packets from the DMA ring */
+ static void xrx200_flush_dma(struct xrx200_chan *ch)
+ {
+@@ -108,8 +120,7 @@ static void xrx200_flush_dma(struct xrx2
+ 			break;
+ 
+ 		desc->ctl = LTQ_DMA_OWN | LTQ_DMA_RX_OFFSET(NET_IP_ALIGN) |
+-			    (ch->priv->net_dev->mtu + VLAN_ETH_HLEN +
+-			     ETH_FCS_LEN);
++			    ch->priv->rx_buf_size;
+ 		ch->dma.desc++;
+ 		ch->dma.desc %= LTQ_DESC_NUM;
+ 	}
+@@ -157,21 +168,21 @@ static int xrx200_close(struct net_devic
+ 
+ static int xrx200_alloc_skb(struct xrx200_chan *ch)
+ {
+-	int len = ch->priv->net_dev->mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
+ 	struct sk_buff *skb = ch->skb[ch->dma.desc];
++	struct xrx200_priv *priv = ch->priv;
+ 	dma_addr_t mapping;
+ 	int ret = 0;
+ 
+-	ch->skb[ch->dma.desc] = netdev_alloc_skb_ip_align(ch->priv->net_dev,
+-							  len);
++	ch->skb[ch->dma.desc] = netdev_alloc_skb_ip_align(priv->net_dev,
++							  priv->rx_buf_size);
+ 	if (!ch->skb[ch->dma.desc]) {
+ 		ret = -ENOMEM;
+ 		goto skip;
+ 	}
+ 
+-	mapping = dma_map_single(ch->priv->dev, ch->skb[ch->dma.desc]->data,
+-				 len, DMA_FROM_DEVICE);
+-	if (unlikely(dma_mapping_error(ch->priv->dev, mapping))) {
++	mapping = dma_map_single(priv->dev, ch->skb[ch->dma.desc]->data,
++				 priv->rx_buf_size, DMA_FROM_DEVICE);
++	if (unlikely(dma_mapping_error(priv->dev, mapping))) {
+ 		dev_kfree_skb_any(ch->skb[ch->dma.desc]);
+ 		ch->skb[ch->dma.desc] = skb;
+ 		ret = -ENOMEM;
+@@ -183,7 +194,7 @@ static int xrx200_alloc_skb(struct xrx20
+ 	wmb();
+ skip:
+ 	ch->dma.desc_base[ch->dma.desc].ctl =
+-		LTQ_DMA_OWN | LTQ_DMA_RX_OFFSET(NET_IP_ALIGN) | len;
++		LTQ_DMA_OWN | LTQ_DMA_RX_OFFSET(NET_IP_ALIGN) | priv->rx_buf_size;
+ 
+ 	return ret;
+ }
+@@ -355,6 +366,7 @@ xrx200_change_mtu(struct net_device *net
+ 	int ret = 0;
+ 
+ 	net_dev->mtu = new_mtu;
++	priv->rx_buf_size = xrx200_buffer_size(new_mtu);
+ 
+ 	if (new_mtu <= old_mtu)
+ 		return ret;
+@@ -374,6 +386,7 @@ xrx200_change_mtu(struct net_device *net
+ 		ret = xrx200_alloc_skb(ch_rx);
+ 		if (ret) {
+ 			net_dev->mtu = old_mtu;
++			priv->rx_buf_size = xrx200_buffer_size(old_mtu);
+ 			break;
+ 		}
+ 		dev_kfree_skb_any(skb);
+@@ -503,7 +516,8 @@ static int xrx200_probe(struct platform_
+ 	net_dev->netdev_ops = &xrx200_netdev_ops;
+ 	SET_NETDEV_DEV(net_dev, dev);
+ 	net_dev->min_mtu = ETH_ZLEN;
+-	net_dev->max_mtu = XRX200_DMA_DATA_LEN - VLAN_ETH_HLEN - ETH_FCS_LEN;
++	net_dev->max_mtu = XRX200_DMA_DATA_LEN - xrx200_max_frame_len(0);
++	priv->rx_buf_size = xrx200_buffer_size(ETH_DATA_LEN);
+ 
+ 	/* load the memory ranges */
+ 	priv->pmac_reg = devm_platform_get_and_ioremap_resource(pdev, 0, NULL);
diff --git a/target/linux/lantiq/patches-5.15/0704-v5.17-net-lantiq_xrx200-add-ingress-SG-DMA-support.patch b/target/linux/lantiq/patches-5.15/0704-v5.17-net-lantiq_xrx200-add-ingress-SG-DMA-support.patch
new file mode 100644
index 00000000000000..f2c36952fca600
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0704-v5.17-net-lantiq_xrx200-add-ingress-SG-DMA-support.patch
@@ -0,0 +1,104 @@
+From c3e6b2c35b34214c58c1e90d65dab5f5393608e7 Mon Sep 17 00:00:00 2001
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+Date: Mon, 3 Jan 2022 20:43:16 +0100
+Subject: [PATCH] net: lantiq_xrx200: add ingress SG DMA support
+
+This patch adds support for scatter gather DMA. DMA in PMAC splits
+the packet into several buffers when the MTU on the CPU port is
+less than the MTU of the switch. The first buffer starts at an
+offset of NET_IP_ALIGN. In subsequent buffers, dma ignores the
+offset. Thanks to this patch, the user can still connect to the
+device in such a situation. For normal configurations, the patch
+has no effect on performance.
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/lantiq_xrx200.c | 47 +++++++++++++++++++++++-----
+ 1 file changed, 40 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/lantiq_xrx200.c
++++ b/drivers/net/ethernet/lantiq_xrx200.c
+@@ -26,6 +26,9 @@
+ #define XRX200_DMA_RX		0
+ #define XRX200_DMA_TX		1
+ 
++#define XRX200_DMA_PACKET_COMPLETE	0
++#define XRX200_DMA_PACKET_IN_PROGRESS	1
++
+ /* cpu port mac */
+ #define PMAC_RX_IPG		0x0024
+ #define PMAC_RX_IPG_MASK	0xf
+@@ -61,6 +64,9 @@ struct xrx200_chan {
+ 	struct ltq_dma_channel dma;
+ 	struct sk_buff *skb[LTQ_DESC_NUM];
+ 
++	struct sk_buff *skb_head;
++	struct sk_buff *skb_tail;
++
+ 	struct xrx200_priv *priv;
+ };
+ 
+@@ -204,7 +210,8 @@ static int xrx200_hw_receive(struct xrx2
+ 	struct xrx200_priv *priv = ch->priv;
+ 	struct ltq_dma_desc *desc = &ch->dma.desc_base[ch->dma.desc];
+ 	struct sk_buff *skb = ch->skb[ch->dma.desc];
+-	int len = (desc->ctl & LTQ_DMA_SIZE_MASK);
++	u32 ctl = desc->ctl;
++	int len = (ctl & LTQ_DMA_SIZE_MASK);
+ 	struct net_device *net_dev = priv->net_dev;
+ 	int ret;
+ 
+@@ -220,12 +227,36 @@ static int xrx200_hw_receive(struct xrx2
+ 	}
+ 
+ 	skb_put(skb, len);
+-	skb->protocol = eth_type_trans(skb, net_dev);
+-	netif_receive_skb(skb);
+-	net_dev->stats.rx_packets++;
+-	net_dev->stats.rx_bytes += len;
+ 
+-	return 0;
++	/* add buffers to skb via skb->frag_list */
++	if (ctl & LTQ_DMA_SOP) {
++		ch->skb_head = skb;
++		ch->skb_tail = skb;
++	} else if (ch->skb_head) {
++		if (ch->skb_head == ch->skb_tail)
++			skb_shinfo(ch->skb_tail)->frag_list = skb;
++		else
++			ch->skb_tail->next = skb;
++		ch->skb_tail = skb;
++		skb_reserve(ch->skb_tail, -NET_IP_ALIGN);
++		ch->skb_head->len += skb->len;
++		ch->skb_head->data_len += skb->len;
++		ch->skb_head->truesize += skb->truesize;
++	}
++
++	if (ctl & LTQ_DMA_EOP) {
++		ch->skb_head->protocol = eth_type_trans(ch->skb_head, net_dev);
++		netif_receive_skb(ch->skb_head);
++		net_dev->stats.rx_packets++;
++		net_dev->stats.rx_bytes += ch->skb_head->len;
++		ch->skb_head = NULL;
++		ch->skb_tail = NULL;
++		ret = XRX200_DMA_PACKET_COMPLETE;
++	} else {
++		ret = XRX200_DMA_PACKET_IN_PROGRESS;
++	}
++
++	return ret;
+ }
+ 
+ static int xrx200_poll_rx(struct napi_struct *napi, int budget)
+@@ -240,7 +271,9 @@ static int xrx200_poll_rx(struct napi_st
+ 
+ 		if ((desc->ctl & (LTQ_DMA_OWN | LTQ_DMA_C)) == LTQ_DMA_C) {
+ 			ret = xrx200_hw_receive(ch);
+-			if (ret)
++			if (ret == XRX200_DMA_PACKET_IN_PROGRESS)
++				continue;
++			if (ret != XRX200_DMA_PACKET_COMPLETE)
+ 				return ret;
+ 			rx++;
+ 		} else {
diff --git a/target/linux/lantiq/patches-5.15/0706-v5.18-net-lantiq-enable-jumbo-frames-on-GSWIP.patch b/target/linux/lantiq/patches-5.15/0706-v5.18-net-lantiq-enable-jumbo-frames-on-GSWIP.patch
new file mode 100644
index 00000000000000..22aa2eea6e0b6c
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0706-v5.18-net-lantiq-enable-jumbo-frames-on-GSWIP.patch
@@ -0,0 +1,127 @@
+From c40bb4fedcd6b8b6a714da5dd466eb88ed2652d1 Mon Sep 17 00:00:00 2001
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+Date: Wed, 9 Mar 2022 00:04:57 +0100
+Subject: net: dsa: lantiq_gswip: enable jumbo frames on GSWIP
+
+This enables non-standard MTUs on a per-port basis, with the overall
+frame size set based on the CPU port.
+
+When the MTU is not changed, this should have no effect.
+
+Long packets crash the switch with MTUs of greater than 2526, so the
+maximum is limited for now. Medium packets are sometimes dropped (e.g.
+TCP over 2477, UDP over 2516-2519, ICMP over 2526), Hence an MTU value
+of 2400 seems safe.
+
+Signed-off-by: Thomas Nixon <tom@tomn.co.uk>
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Link: https://lore.kernel.org/r/20220308230457.1599237-1-olek2@wp.pl
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/lantiq_gswip.c | 53 ++++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 49 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/dsa/lantiq_gswip.c
++++ b/drivers/net/dsa/lantiq_gswip.c
+@@ -213,6 +213,7 @@
+ #define  GSWIP_MAC_CTRL_0_GMII_MII	0x0001
+ #define  GSWIP_MAC_CTRL_0_GMII_RGMII	0x0002
+ #define GSWIP_MAC_CTRL_2p(p)		(0x905 + ((p) * 0xC))
++#define GSWIP_MAC_CTRL_2_LCHKL		BIT(2) /* Frame Length Check Long Enable */
+ #define GSWIP_MAC_CTRL_2_MLEN		BIT(3) /* Maximum Untagged Frame Lnegth */
+ 
+ /* Ethernet Switch Fetch DMA Port Control Register */
+@@ -239,6 +240,15 @@
+ 
+ #define XRX200_GPHY_FW_ALIGN	(16 * 1024)
+ 
++/* Maximum packet size supported by the switch. In theory this should be 10240,
++ * but long packets currently cause lock-ups with an MTU of over 2526. Medium
++ * packets are sometimes dropped (e.g. TCP over 2477, UDP over 2516-2519, ICMP
++ * over 2526), hence an MTU value of 2400 seems safe. This issue only affects
++ * packet reception. This is probably caused by the PPA engine, which is on the
++ * RX part of the device. Packet transmission works properly up to 10240.
++ */
++#define GSWIP_MAX_PACKET_LENGTH	2400
++
+ struct gswip_hw_info {
+ 	int max_ports;
+ 	int cpu_port;
+@@ -846,10 +856,6 @@ static int gswip_setup(struct dsa_switch
+ 	gswip_switch_mask(priv, 0, GSWIP_PCE_PCTRL_0_INGRESS,
+ 			  GSWIP_PCE_PCTRL_0p(cpu_port));
+ 
+-	gswip_switch_mask(priv, 0, GSWIP_MAC_CTRL_2_MLEN,
+-			  GSWIP_MAC_CTRL_2p(cpu_port));
+-	gswip_switch_w(priv, VLAN_ETH_FRAME_LEN + 8 + ETH_FCS_LEN,
+-		       GSWIP_MAC_FLEN);
+ 	gswip_switch_mask(priv, 0, GSWIP_BM_QUEUE_GCTRL_GL_MOD,
+ 			  GSWIP_BM_QUEUE_GCTRL);
+ 
+@@ -866,6 +872,8 @@ static int gswip_setup(struct dsa_switch
+ 		return err;
+ 	}
+ 
++	ds->mtu_enforcement_ingress = true;
++
+ 	gswip_port_enable(ds, cpu_port, NULL);
+ 
+ 	ds->configure_vlan_while_not_filtering = false;
+@@ -1456,6 +1464,39 @@ static void gswip_phylink_set_capab(unsi
+ 	linkmode_and(state->advertising, state->advertising, mask);
+ }
+ 
++static int gswip_port_max_mtu(struct dsa_switch *ds, int port)
++{
++	/* Includes 8 bytes for special header. */
++	return GSWIP_MAX_PACKET_LENGTH - VLAN_ETH_HLEN - ETH_FCS_LEN;
++}
++
++static int gswip_port_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
++{
++	struct gswip_priv *priv = ds->priv;
++	int cpu_port = priv->hw_info->cpu_port;
++
++	/* CPU port always has maximum mtu of user ports, so use it to set
++	 * switch frame size, including 8 byte special header.
++	 */
++	if (port == cpu_port) {
++		new_mtu += 8;
++		gswip_switch_w(priv, VLAN_ETH_HLEN + new_mtu + ETH_FCS_LEN,
++			       GSWIP_MAC_FLEN);
++	}
++
++	/* Enable MLEN for ports with non-standard MTUs, including the special
++	 * header on the CPU port added above.
++	 */
++	if (new_mtu != ETH_DATA_LEN)
++		gswip_switch_mask(priv, 0, GSWIP_MAC_CTRL_2_MLEN,
++				  GSWIP_MAC_CTRL_2p(port));
++	else
++		gswip_switch_mask(priv, GSWIP_MAC_CTRL_2_MLEN, 0,
++				  GSWIP_MAC_CTRL_2p(port));
++
++	return 0;
++}
++
+ static void gswip_xrx200_phylink_validate(struct dsa_switch *ds, int port,
+ 					  unsigned long *supported,
+ 					  struct phylink_link_state *state)
+@@ -1812,6 +1853,8 @@ static const struct dsa_switch_ops gswip
+ 	.port_fdb_add		= gswip_port_fdb_add,
+ 	.port_fdb_del		= gswip_port_fdb_del,
+ 	.port_fdb_dump		= gswip_port_fdb_dump,
++	.port_change_mtu	= gswip_port_change_mtu,
++	.port_max_mtu		= gswip_port_max_mtu,
+ 	.phylink_validate	= gswip_xrx200_phylink_validate,
+ 	.phylink_mac_config	= gswip_phylink_mac_config,
+ 	.phylink_mac_link_down	= gswip_phylink_mac_link_down,
+@@ -1836,6 +1879,8 @@ static const struct dsa_switch_ops gswip
+ 	.port_fdb_add		= gswip_port_fdb_add,
+ 	.port_fdb_del		= gswip_port_fdb_del,
+ 	.port_fdb_dump		= gswip_port_fdb_dump,
++	.port_change_mtu	= gswip_port_change_mtu,
++	.port_max_mtu		= gswip_port_max_mtu,
+ 	.phylink_validate	= gswip_xrx300_phylink_validate,
+ 	.phylink_mac_config	= gswip_phylink_mac_config,
+ 	.phylink_mac_link_down	= gswip_phylink_mac_link_down,
diff --git a/target/linux/lantiq/patches-5.15/0710-v5.16-net-lantiq-configure-the-burst-length-in-ethernet-dr.patch b/target/linux/lantiq/patches-5.15/0710-v5.16-net-lantiq-configure-the-burst-length-in-ethernet-dr.patch
new file mode 100644
index 00000000000000..818fa811e9f2de
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0710-v5.16-net-lantiq-configure-the-burst-length-in-ethernet-dr.patch
@@ -0,0 +1,126 @@
+From 14d4e308e0aa0b78dc7a059716861a4380de3535 Mon Sep 17 00:00:00 2001
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+Date: Tue, 14 Sep 2021 23:21:02 +0200
+Subject: [PATCH 5/5] net: lantiq: configure the burst length in ethernet
+ drivers
+
+Configure the burst length in Ethernet drivers. This improves
+Ethernet performance by 58%. According to the vendor BSP,
+8W burst length is supported by ar9 and newer SoCs.
+
+The NAT benchmark results on xRX200 (Down/Up):
+* 2W: 330 Mb/s
+* 4W: 432 Mb/s    372 Mb/s
+* 8W: 520 Mb/s    389 Mb/s
+
+Tested on xRX200 and xRX330.
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/lantiq_etop.c   | 21 ++++++++++++++++++---
+ drivers/net/ethernet/lantiq_xrx200.c | 21 ++++++++++++++++++---
+ 2 files changed, 36 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/lantiq_etop.c
++++ b/drivers/net/ethernet/lantiq_etop.c
+@@ -148,6 +148,9 @@ struct ltq_etop_priv {
+ 	struct ltq_etop_chan txch;
+ 	struct ltq_etop_chan rxch;
+ 
++	int tx_burst_len;
++	int rx_burst_len;
++
+ 	int tx_irq;
+ 	int rx_irq;
+ 
+@@ -399,7 +402,7 @@ ltq_etop_dma_init(struct net_device *dev
+ 	int rx = priv->rx_irq - LTQ_DMA_ETOP;
+ 	int err;
+ 
+-	ltq_dma_init_port(DMA_PORT_ETOP);
++	ltq_dma_init_port(DMA_PORT_ETOP, priv->tx_burst_len, rx_burst_len);
+ 
+ 	priv->txch.dma.nr = tx;
+ 	priv->txch.dma.dev = &priv->pdev->dev;
+@@ -676,8 +679,8 @@ ltq_etop_tx(struct sk_buff *skb, struct
+ 		return NETDEV_TX_BUSY;
+ 	}
+ 
+-	/* dma needs to start on a 16 byte aligned address */
+-	byte_offset = CPHYSADDR(skb->data) % 16;
++	/* dma needs to start on a burst length value aligned address */
++	byte_offset = CPHYSADDR(skb->data) % (priv->tx_burst_len * 4);
+ 	priv->txch.skb[priv->txch.dma.desc] = skb;
+ 
+ 	netif_trans_update(dev);
+@@ -925,6 +928,18 @@ static int ltq_etop_probe(struct platfor
+ 	spin_lock_init(&priv->lock);
+ 	SET_NETDEV_DEV(dev, &pdev->dev);
+ 
++	err = device_property_read_u32(&pdev->dev, "lantiq,tx-burst-length", &priv->tx_burst_len);
++	if (err < 0) {
++		dev_err(&pdev->dev, "unable to read tx-burst-length property\n");
++		return err;
++	}
++
++	err = device_property_read_u32(&pdev->dev, "lantiq,rx-burst-length", &priv->rx_burst_len);
++	if (err < 0) {
++		dev_err(&pdev->dev, "unable to read rx-burst-length property\n");
++		return err;
++	}
++
+ 	netif_napi_add(dev, &priv->txch.napi, ltq_etop_poll_tx, 8);
+ 	netif_napi_add(dev, &priv->rxch.napi, ltq_etop_poll_rx, 32);
+ 	priv->txch.netdev = dev;
+--- a/drivers/net/ethernet/lantiq_xrx200.c
++++ b/drivers/net/ethernet/lantiq_xrx200.c
+@@ -81,6 +81,9 @@ struct xrx200_priv {
+ 	struct net_device *net_dev;
+ 	struct device *dev;
+ 
++	int tx_burst_len;
++	int rx_burst_len;
++
+ 	__iomem void *pmac_reg;
+ };
+ 
+@@ -363,8 +366,8 @@ static netdev_tx_t xrx200_start_xmit(str
+ 	if (unlikely(dma_mapping_error(priv->dev, mapping)))
+ 		goto err_drop;
+ 
+-	/* dma needs to start on a 16 byte aligned address */
+-	byte_offset = mapping % 16;
++	/* dma needs to start on a burst length value aligned address */
++	byte_offset = mapping % (priv->tx_burst_len * 4);
+ 
+ 	desc->addr = mapping - byte_offset;
+ 	/* Make sure the address is written before we give it to HW */
+@@ -465,7 +468,7 @@ static int xrx200_dma_init(struct xrx200
+ 	int ret = 0;
+ 	int i;
+ 
+-	ltq_dma_init_port(DMA_PORT_ETOP);
++	ltq_dma_init_port(DMA_PORT_ETOP, priv->tx_burst_len, rx_burst_len);
+ 
+ 	ch_rx->dma.nr = XRX200_DMA_RX;
+ 	ch_rx->dma.dev = priv->dev;
+@@ -575,6 +578,18 @@ static int xrx200_probe(struct platform_
+ 	if (err)
+ 		eth_hw_addr_random(net_dev);
+ 
++	err = device_property_read_u32(dev, "lantiq,tx-burst-length", &priv->tx_burst_len);
++	if (err < 0) {
++		dev_err(dev, "unable to read tx-burst-length property\n");
++		return err;
++	}
++
++	err = device_property_read_u32(dev, "lantiq,rx-burst-length", &priv->rx_burst_len);
++	if (err < 0) {
++		dev_err(dev, "unable to read rx-burst-length property\n");
++		return err;
++	}
++
+ 	/* bring up the dma engine and IP core */
+ 	err = xrx200_dma_init(priv);
+ 	if (err)
diff --git a/target/linux/lantiq/patches-5.15/0711-v5.16-net-lantiq_xrx200-Hardcode-the-burst-length-value.patch b/target/linux/lantiq/patches-5.15/0711-v5.16-net-lantiq_xrx200-Hardcode-the-burst-length-value.patch
new file mode 100644
index 00000000000000..e002f81d5a0da1
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0711-v5.16-net-lantiq_xrx200-Hardcode-the-burst-length-value.patch
@@ -0,0 +1,73 @@
+From 7e553c44f09a8f536090904c6db5b8c9dbafa03b Mon Sep 17 00:00:00 2001
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+Date: Tue, 26 Oct 2021 22:59:01 +0200
+Subject: [PATCH] net: lantiq_xrx200: Hardcode the burst length value
+
+All SoCs with this IP core support 8 burst length. Hauke
+suggested to hardcode this value and simplify the driver.
+
+Link: https://lkml.org/lkml/2021/9/14/1533
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/lantiq_xrx200.c | 21 ++++-----------------
+ 1 file changed, 4 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/ethernet/lantiq_xrx200.c
++++ b/drivers/net/ethernet/lantiq_xrx200.c
+@@ -25,6 +25,7 @@
+ #define XRX200_DMA_DATA_LEN	(SZ_64K - 1)
+ #define XRX200_DMA_RX		0
+ #define XRX200_DMA_TX		1
++#define XRX200_DMA_BURST_LEN	8
+ 
+ #define XRX200_DMA_PACKET_COMPLETE	0
+ #define XRX200_DMA_PACKET_IN_PROGRESS	1
+@@ -81,9 +82,6 @@ struct xrx200_priv {
+ 	struct net_device *net_dev;
+ 	struct device *dev;
+ 
+-	int tx_burst_len;
+-	int rx_burst_len;
+-
+ 	__iomem void *pmac_reg;
+ };
+ 
+@@ -367,7 +365,7 @@ static netdev_tx_t xrx200_start_xmit(str
+ 		goto err_drop;
+ 
+ 	/* dma needs to start on a burst length value aligned address */
+-	byte_offset = mapping % (priv->tx_burst_len * 4);
++	byte_offset = mapping % (XRX200_DMA_BURST_LEN * 4);
+ 
+ 	desc->addr = mapping - byte_offset;
+ 	/* Make sure the address is written before we give it to HW */
+@@ -468,7 +466,8 @@ static int xrx200_dma_init(struct xrx200
+ 	int ret = 0;
+ 	int i;
+ 
+-	ltq_dma_init_port(DMA_PORT_ETOP, priv->tx_burst_len, rx_burst_len);
++	ltq_dma_init_port(DMA_PORT_ETOP, XRX200_DMA_BURST_LEN,
++			  XRX200_DMA_BURST_LEN);
+ 
+ 	ch_rx->dma.nr = XRX200_DMA_RX;
+ 	ch_rx->dma.dev = priv->dev;
+@@ -578,18 +577,6 @@ static int xrx200_probe(struct platform_
+ 	if (err)
+ 		eth_hw_addr_random(net_dev);
+ 
+-	err = device_property_read_u32(dev, "lantiq,tx-burst-length", &priv->tx_burst_len);
+-	if (err < 0) {
+-		dev_err(dev, "unable to read tx-burst-length property\n");
+-		return err;
+-	}
+-
+-	err = device_property_read_u32(dev, "lantiq,rx-burst-length", &priv->rx_burst_len);
+-	if (err < 0) {
+-		dev_err(dev, "unable to read rx-burst-length property\n");
+-		return err;
+-	}
+-
+ 	/* bring up the dma engine and IP core */
+ 	err = xrx200_dma_init(priv);
+ 	if (err)
diff --git a/target/linux/lantiq/patches-5.15/0712-v5.16-net-ethernet-lantiq_etop-Fix-compilation-error.patch b/target/linux/lantiq/patches-5.15/0712-v5.16-net-ethernet-lantiq_etop-Fix-compilation-error.patch
new file mode 100644
index 00000000000000..06f4bc2eeed83c
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0712-v5.16-net-ethernet-lantiq_etop-Fix-compilation-error.patch
@@ -0,0 +1,26 @@
+From 68eabc348148ae051631e8dab13c3b1a85c82896 Mon Sep 17 00:00:00 2001
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+Date: Tue, 9 Nov 2021 23:23:54 +0100
+Subject: [PATCH] net: ethernet: lantiq_etop: Fix compilation error
+
+This fixes the error detected when compiling the driver.
+
+Fixes: 14d4e308e0aa ("net: lantiq: configure the burst length in ethernet drivers")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/lantiq_etop.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/lantiq_etop.c
++++ b/drivers/net/ethernet/lantiq_etop.c
+@@ -402,7 +402,7 @@ ltq_etop_dma_init(struct net_device *dev
+ 	int rx = priv->rx_irq - LTQ_DMA_ETOP;
+ 	int err;
+ 
+-	ltq_dma_init_port(DMA_PORT_ETOP, priv->tx_burst_len, rx_burst_len);
++	ltq_dma_init_port(DMA_PORT_ETOP, priv->tx_burst_len, priv->rx_burst_len);
+ 
+ 	priv->txch.dma.nr = tx;
+ 	priv->txch.dma.dev = &priv->pdev->dev;
diff --git a/target/linux/lantiq/patches-5.15/0713-v5.17-MIPS-lantiq-dma-increase-descritor-count.patch b/target/linux/lantiq/patches-5.15/0713-v5.17-MIPS-lantiq-dma-increase-descritor-count.patch
new file mode 100644
index 00000000000000..37ed1d4f31714d
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0713-v5.17-MIPS-lantiq-dma-increase-descritor-count.patch
@@ -0,0 +1,28 @@
+From 5112e9234bbb89f8dd15c983206bd9107b8436d5 Mon Sep 17 00:00:00 2001
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+Date: Tue, 4 Jan 2022 16:11:42 +0100
+Subject: [PATCH 713/715] MIPS: lantiq: dma: increase descritor count
+
+NAT Performance results on BT Home Hub 5A (kernel 5.10.89, mtu 1500):
+
+	Down		Up
+Before	539 Mbps	599 Mbps
+After	545 Mbps	625 Mbps
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ arch/mips/include/asm/mach-lantiq/xway/xway_dma.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/mips/include/asm/mach-lantiq/xway/xway_dma.h
++++ b/arch/mips/include/asm/mach-lantiq/xway/xway_dma.h
+@@ -8,7 +8,7 @@
+ #define LTQ_DMA_H__
+ 
+ #define LTQ_DESC_SIZE		0x08	/* each descriptor is 64bit */
+-#define LTQ_DESC_NUM		0x40	/* 64 descriptors / channel */
++#define LTQ_DESC_NUM		0xC0	/* 192 descriptors / channel */
+ 
+ #define LTQ_DMA_OWN		BIT(31) /* owner bit */
+ #define LTQ_DMA_C		BIT(30) /* complete bit */
diff --git a/target/linux/lantiq/patches-5.15/0714-v5.17-net-lantiq_xrx200-increase-napi-poll-weigth.patch b/target/linux/lantiq/patches-5.15/0714-v5.17-net-lantiq_xrx200-increase-napi-poll-weigth.patch
new file mode 100644
index 00000000000000..10791f9d5366fa
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0714-v5.17-net-lantiq_xrx200-increase-napi-poll-weigth.patch
@@ -0,0 +1,32 @@
+From 768818d772d5d4ddc0c7eb2e62848929270ab7a3 Mon Sep 17 00:00:00 2001
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+Date: Tue, 4 Jan 2022 16:11:43 +0100
+Subject: [PATCH 714/715] net: lantiq_xrx200: increase napi poll weigth
+
+NAT Performance results on BT Home Hub 5A (kernel 5.10.89, mtu 1500):
+
+	Down		Up
+Before	545 Mbps	625 Mbps
+After	577 Mbps	648 Mbps
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/lantiq_xrx200.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/lantiq_xrx200.c
++++ b/drivers/net/ethernet/lantiq_xrx200.c
+@@ -597,8 +597,10 @@ static int xrx200_probe(struct platform_
+ 			 PMAC_HD_CTL);
+ 
+ 	/* setup NAPI */
+-	netif_napi_add(net_dev, &priv->chan_rx.napi, xrx200_poll_rx, 32);
+-	netif_tx_napi_add(net_dev, &priv->chan_tx.napi, xrx200_tx_housekeeping, 32);
++	netif_napi_add(net_dev, &priv->chan_rx.napi, xrx200_poll_rx,
++		       NAPI_POLL_WEIGHT);
++	netif_tx_napi_add(net_dev, &priv->chan_tx.napi, xrx200_tx_housekeeping,
++			  NAPI_POLL_WEIGHT);
+ 
+ 	platform_set_drvdata(pdev, priv);
+ 
diff --git a/target/linux/lantiq/patches-5.15/0715-v5.17-net-lantiq_xrx200-convert-to-build_skb.patch b/target/linux/lantiq/patches-5.15/0715-v5.17-net-lantiq_xrx200-convert-to-build_skb.patch
new file mode 100644
index 00000000000000..6613d0bbd71595
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0715-v5.17-net-lantiq_xrx200-convert-to-build_skb.patch
@@ -0,0 +1,206 @@
+From e015593573b3e3f74bd8a63c05fa92902194a354 Mon Sep 17 00:00:00 2001
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+Date: Tue, 4 Jan 2022 16:11:44 +0100
+Subject: [PATCH 715/715] net: lantiq_xrx200: convert to build_skb
+
+We can increase the efficiency of rx path by using buffers to receive
+packets then build SKBs around them just before passing into the network
+stack. In contrast, preallocating SKBs too early reduces CPU cache
+efficiency.
+
+NAT Performance results on BT Home Hub 5A (kernel 5.10.89, mtu 1500):
+
+	Down		Up
+Before	577 Mbps	648 Mbps
+After	624 Mbps	695 Mbps
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/lantiq_xrx200.c | 56 ++++++++++++++++++----------
+ 1 file changed, 36 insertions(+), 20 deletions(-)
+
+--- a/drivers/net/ethernet/lantiq_xrx200.c
++++ b/drivers/net/ethernet/lantiq_xrx200.c
+@@ -63,7 +63,11 @@ struct xrx200_chan {
+ 
+ 	struct napi_struct napi;
+ 	struct ltq_dma_channel dma;
+-	struct sk_buff *skb[LTQ_DESC_NUM];
++
++	union {
++		struct sk_buff *skb[LTQ_DESC_NUM];
++		void *rx_buff[LTQ_DESC_NUM];
++	};
+ 
+ 	struct sk_buff *skb_head;
+ 	struct sk_buff *skb_tail;
+@@ -78,6 +82,7 @@ struct xrx200_priv {
+ 	struct xrx200_chan chan_rx;
+ 
+ 	u16 rx_buf_size;
++	u16 rx_skb_size;
+ 
+ 	struct net_device *net_dev;
+ 	struct device *dev;
+@@ -115,6 +120,12 @@ static int xrx200_buffer_size(int mtu)
+ 	return round_up(xrx200_max_frame_len(mtu), 4 * XRX200_DMA_BURST_LEN);
+ }
+ 
++static int xrx200_skb_size(u16 buf_size)
++{
++	return SKB_DATA_ALIGN(buf_size + NET_SKB_PAD + NET_IP_ALIGN) +
++		SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
++}
++
+ /* drop all the packets from the DMA ring */
+ static void xrx200_flush_dma(struct xrx200_chan *ch)
+ {
+@@ -173,30 +184,29 @@ static int xrx200_close(struct net_devic
+ 	return 0;
+ }
+ 
+-static int xrx200_alloc_skb(struct xrx200_chan *ch)
++static int xrx200_alloc_buf(struct xrx200_chan *ch, void *(*alloc)(unsigned int size))
+ {
+-	struct sk_buff *skb = ch->skb[ch->dma.desc];
++	void *buf = ch->rx_buff[ch->dma.desc];
+ 	struct xrx200_priv *priv = ch->priv;
+ 	dma_addr_t mapping;
+ 	int ret = 0;
+ 
+-	ch->skb[ch->dma.desc] = netdev_alloc_skb_ip_align(priv->net_dev,
+-							  priv->rx_buf_size);
+-	if (!ch->skb[ch->dma.desc]) {
++	ch->rx_buff[ch->dma.desc] = alloc(priv->rx_skb_size);
++	if (!ch->rx_buff[ch->dma.desc]) {
+ 		ret = -ENOMEM;
+ 		goto skip;
+ 	}
+ 
+-	mapping = dma_map_single(priv->dev, ch->skb[ch->dma.desc]->data,
++	mapping = dma_map_single(priv->dev, ch->rx_buff[ch->dma.desc],
+ 				 priv->rx_buf_size, DMA_FROM_DEVICE);
+ 	if (unlikely(dma_mapping_error(priv->dev, mapping))) {
+-		dev_kfree_skb_any(ch->skb[ch->dma.desc]);
+-		ch->skb[ch->dma.desc] = skb;
++		skb_free_frag(ch->rx_buff[ch->dma.desc]);
++		ch->rx_buff[ch->dma.desc] = buf;
+ 		ret = -ENOMEM;
+ 		goto skip;
+ 	}
+ 
+-	ch->dma.desc_base[ch->dma.desc].addr = mapping;
++	ch->dma.desc_base[ch->dma.desc].addr = mapping + NET_SKB_PAD + NET_IP_ALIGN;
+ 	/* Make sure the address is written before we give it to HW */
+ 	wmb();
+ skip:
+@@ -210,13 +220,14 @@ static int xrx200_hw_receive(struct xrx2
+ {
+ 	struct xrx200_priv *priv = ch->priv;
+ 	struct ltq_dma_desc *desc = &ch->dma.desc_base[ch->dma.desc];
+-	struct sk_buff *skb = ch->skb[ch->dma.desc];
++	void *buf = ch->rx_buff[ch->dma.desc];
+ 	u32 ctl = desc->ctl;
+ 	int len = (ctl & LTQ_DMA_SIZE_MASK);
+ 	struct net_device *net_dev = priv->net_dev;
++	struct sk_buff *skb;
+ 	int ret;
+ 
+-	ret = xrx200_alloc_skb(ch);
++	ret = xrx200_alloc_buf(ch, napi_alloc_frag);
+ 
+ 	ch->dma.desc++;
+ 	ch->dma.desc %= LTQ_DESC_NUM;
+@@ -227,19 +238,21 @@ static int xrx200_hw_receive(struct xrx2
+ 		return ret;
+ 	}
+ 
++	skb = build_skb(buf, priv->rx_skb_size);
++	skb_reserve(skb, NET_SKB_PAD);
+ 	skb_put(skb, len);
+ 
+ 	/* add buffers to skb via skb->frag_list */
+ 	if (ctl & LTQ_DMA_SOP) {
+ 		ch->skb_head = skb;
+ 		ch->skb_tail = skb;
++		skb_reserve(skb, NET_IP_ALIGN);
+ 	} else if (ch->skb_head) {
+ 		if (ch->skb_head == ch->skb_tail)
+ 			skb_shinfo(ch->skb_tail)->frag_list = skb;
+ 		else
+ 			ch->skb_tail->next = skb;
+ 		ch->skb_tail = skb;
+-		skb_reserve(ch->skb_tail, -NET_IP_ALIGN);
+ 		ch->skb_head->len += skb->len;
+ 		ch->skb_head->data_len += skb->len;
+ 		ch->skb_head->truesize += skb->truesize;
+@@ -395,12 +408,13 @@ xrx200_change_mtu(struct net_device *net
+ 	struct xrx200_chan *ch_rx = &priv->chan_rx;
+ 	int old_mtu = net_dev->mtu;
+ 	bool running = false;
+-	struct sk_buff *skb;
++	void *buff;
+ 	int curr_desc;
+ 	int ret = 0;
+ 
+ 	net_dev->mtu = new_mtu;
+ 	priv->rx_buf_size = xrx200_buffer_size(new_mtu);
++	priv->rx_skb_size = xrx200_skb_size(priv->rx_buf_size);
+ 
+ 	if (new_mtu <= old_mtu)
+ 		return ret;
+@@ -416,14 +430,15 @@ xrx200_change_mtu(struct net_device *net
+ 
+ 	for (ch_rx->dma.desc = 0; ch_rx->dma.desc < LTQ_DESC_NUM;
+ 	     ch_rx->dma.desc++) {
+-		skb = ch_rx->skb[ch_rx->dma.desc];
+-		ret = xrx200_alloc_skb(ch_rx);
++		buff = ch_rx->rx_buff[ch_rx->dma.desc];
++		ret = xrx200_alloc_buf(ch_rx, netdev_alloc_frag);
+ 		if (ret) {
+ 			net_dev->mtu = old_mtu;
+ 			priv->rx_buf_size = xrx200_buffer_size(old_mtu);
++			priv->rx_skb_size = xrx200_skb_size(priv->rx_buf_size);
+ 			break;
+ 		}
+-		dev_kfree_skb_any(skb);
++		skb_free_frag(buff);
+ 	}
+ 
+ 	ch_rx->dma.desc = curr_desc;
+@@ -476,7 +491,7 @@ static int xrx200_dma_init(struct xrx200
+ 	ltq_dma_alloc_rx(&ch_rx->dma);
+ 	for (ch_rx->dma.desc = 0; ch_rx->dma.desc < LTQ_DESC_NUM;
+ 	     ch_rx->dma.desc++) {
+-		ret = xrx200_alloc_skb(ch_rx);
++		ret = xrx200_alloc_buf(ch_rx, netdev_alloc_frag);
+ 		if (ret)
+ 			goto rx_free;
+ 	}
+@@ -511,7 +526,7 @@ rx_ring_free:
+ 	/* free the allocated RX ring */
+ 	for (i = 0; i < LTQ_DESC_NUM; i++) {
+ 		if (priv->chan_rx.skb[i])
+-			dev_kfree_skb_any(priv->chan_rx.skb[i]);
++			skb_free_frag(priv->chan_rx.rx_buff[i]);
+ 	}
+ 
+ rx_free:
+@@ -528,7 +543,7 @@ static void xrx200_hw_cleanup(struct xrx
+ 
+ 	/* free the allocated RX ring */
+ 	for (i = 0; i < LTQ_DESC_NUM; i++)
+-		dev_kfree_skb_any(priv->chan_rx.skb[i]);
++		skb_free_frag(priv->chan_rx.rx_buff[i]);
+ }
+ 
+ static int xrx200_probe(struct platform_device *pdev)
+@@ -553,6 +568,7 @@ static int xrx200_probe(struct platform_
+ 	net_dev->min_mtu = ETH_ZLEN;
+ 	net_dev->max_mtu = XRX200_DMA_DATA_LEN - xrx200_max_frame_len(0);
+ 	priv->rx_buf_size = xrx200_buffer_size(ETH_DATA_LEN);
++	priv->rx_skb_size = xrx200_skb_size(priv->rx_buf_size);
+ 
+ 	/* load the memory ranges */
+ 	priv->pmac_reg = devm_platform_get_and_ioremap_resource(pdev, 0, NULL);
diff --git a/target/linux/lantiq/patches-5.15/0716-v5.17-net-lantiq_xrx200-fix-use-after-free-bug.patch b/target/linux/lantiq/patches-5.15/0716-v5.17-net-lantiq_xrx200-fix-use-after-free-bug.patch
new file mode 100644
index 00000000000000..090b7e3111120a
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0716-v5.17-net-lantiq_xrx200-fix-use-after-free-bug.patch
@@ -0,0 +1,30 @@
+From dd830aed23c6e07cd8e2a163742bf3d63c9add08 Mon Sep 17 00:00:00 2001
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+Date: Sat, 5 Mar 2022 12:20:39 +0100
+Subject: net: lantiq_xrx200: fix use after free bug
+
+The skb->len field is read after the packet is sent to the network
+stack. In the meantime, skb can be freed. This patch fixes this bug.
+
+Fixes: c3e6b2c35b34 ("net: lantiq_xrx200: add ingress SG DMA support")
+Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/lantiq_xrx200.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/lantiq_xrx200.c
++++ b/drivers/net/ethernet/lantiq_xrx200.c
+@@ -260,9 +260,9 @@ static int xrx200_hw_receive(struct xrx2
+ 
+ 	if (ctl & LTQ_DMA_EOP) {
+ 		ch->skb_head->protocol = eth_type_trans(ch->skb_head, net_dev);
+-		netif_receive_skb(ch->skb_head);
+ 		net_dev->stats.rx_packets++;
+ 		net_dev->stats.rx_bytes += ch->skb_head->len;
++		netif_receive_skb(ch->skb_head);
+ 		ch->skb_head = NULL;
+ 		ch->skb_tail = NULL;
+ 		ret = XRX200_DMA_PACKET_COMPLETE;
diff --git a/target/linux/lantiq/patches-5.15/0717-v6.0-net-lantiq_xrx200-confirm-skb-is-allocated-before-us.patch b/target/linux/lantiq/patches-5.15/0717-v6.0-net-lantiq_xrx200-confirm-skb-is-allocated-before-us.patch
new file mode 100644
index 00000000000000..9eaec580331504
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0717-v6.0-net-lantiq_xrx200-confirm-skb-is-allocated-before-us.patch
@@ -0,0 +1,33 @@
+From c8b043702dc0894c07721c5b019096cebc8c798f Mon Sep 17 00:00:00 2001
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+Date: Wed, 24 Aug 2022 23:54:06 +0200
+Subject: [PATCH] net: lantiq_xrx200: confirm skb is allocated before using
+
+xrx200_hw_receive() assumes build_skb() always works and goes straight
+to skb_reserve(). However, build_skb() can fail under memory pressure.
+
+Add a check in case build_skb() failed to allocate and return NULL.
+
+Fixes: e015593573b3 ("net: lantiq_xrx200: convert to build_skb")
+Reported-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/lantiq_xrx200.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/ethernet/lantiq_xrx200.c
++++ b/drivers/net/ethernet/lantiq_xrx200.c
+@@ -239,6 +239,12 @@ static int xrx200_hw_receive(struct xrx2
+ 	}
+ 
+ 	skb = build_skb(buf, priv->rx_skb_size);
++	if (!skb) {
++		skb_free_frag(buf);
++		net_dev->stats.rx_dropped++;
++		return -ENOMEM;
++	}
++
+ 	skb_reserve(skb, NET_SKB_PAD);
+ 	skb_put(skb, len);
+ 
diff --git a/target/linux/lantiq/patches-5.15/0718-v6.0-net-lantiq_xrx200-fix-lock-under-memory-pressure.patch b/target/linux/lantiq/patches-5.15/0718-v6.0-net-lantiq_xrx200-fix-lock-under-memory-pressure.patch
new file mode 100644
index 00000000000000..929ae57ace1eb8
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0718-v6.0-net-lantiq_xrx200-fix-lock-under-memory-pressure.patch
@@ -0,0 +1,33 @@
+From c4b6e9341f930e4dd089231c0414758f5f1f9dbd Mon Sep 17 00:00:00 2001
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+Date: Wed, 24 Aug 2022 23:54:07 +0200
+Subject: [PATCH] net: lantiq_xrx200: fix lock under memory pressure
+
+When the xrx200_hw_receive() function returns -ENOMEM, the NAPI poll
+function immediately returns an error.
+This is incorrect for two reasons:
+* the function terminates without enabling interrupts or scheduling NAPI,
+* the error code (-ENOMEM) is returned instead of the number of received
+packets.
+
+After the first memory allocation failure occurs, packet reception is
+locked due to disabled interrupts from DMA..
+
+Fixes: fe1a56420cf2 ("net: lantiq: Add Lantiq / Intel VRX200 Ethernet driver")
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/lantiq_xrx200.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/lantiq_xrx200.c
++++ b/drivers/net/ethernet/lantiq_xrx200.c
+@@ -294,7 +294,7 @@ static int xrx200_poll_rx(struct napi_st
+ 			if (ret == XRX200_DMA_PACKET_IN_PROGRESS)
+ 				continue;
+ 			if (ret != XRX200_DMA_PACKET_COMPLETE)
+-				return ret;
++				break;
+ 			rx++;
+ 		} else {
+ 			break;
diff --git a/target/linux/lantiq/patches-5.15/0719-v6.0-net-lantiq_xrx200-restore-buffer-if-memory-allocatio.patch b/target/linux/lantiq/patches-5.15/0719-v6.0-net-lantiq_xrx200-restore-buffer-if-memory-allocatio.patch
new file mode 100644
index 00000000000000..182da58ed903c6
--- /dev/null
+++ b/target/linux/lantiq/patches-5.15/0719-v6.0-net-lantiq_xrx200-restore-buffer-if-memory-allocatio.patch
@@ -0,0 +1,27 @@
+From c9c3b1775f80fa21f5bff874027d2ccb10f5d90c Mon Sep 17 00:00:00 2001
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+Date: Wed, 24 Aug 2022 23:54:08 +0200
+Subject: [PATCH] net: lantiq_xrx200: restore buffer if memory allocation
+ failed
+
+In a situation where memory allocation fails, an invalid buffer address
+is stored. When this descriptor is used again, the system panics in the
+build_skb() function when accessing memory.
+
+Fixes: 7ea6cd16f159 ("lantiq: net: fix duplicated skb in rx descriptor ring")
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/lantiq_xrx200.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/lantiq_xrx200.c
++++ b/drivers/net/ethernet/lantiq_xrx200.c
+@@ -193,6 +193,7 @@ static int xrx200_alloc_buf(struct xrx20
+ 
+ 	ch->rx_buff[ch->dma.desc] = alloc(priv->rx_skb_size);
+ 	if (!ch->rx_buff[ch->dma.desc]) {
++		ch->rx_buff[ch->dma.desc] = buf;
+ 		ret = -ENOMEM;
+ 		goto skip;
+ 	}
diff --git a/target/linux/lantiq/xrx200/base-files/etc/board.d/01_leds b/target/linux/lantiq/xrx200/base-files/etc/board.d/01_leds
index bac3ed2b53118e..0c80aaa3b8461a 100644
--- a/target/linux/lantiq/xrx200/base-files/etc/board.d/01_leds
+++ b/target/linux/lantiq/xrx200/base-files/etc/board.d/01_leds
@@ -28,7 +28,9 @@ arcadyan,arv7519rw22)
 	ucidef_set_led_netdev "lan" "lan" "green:lan" "eth0.1"
 	;;
 arcadyan,vgv7510kw22-nor|\
-arcadyan,vgv7510kw22-brn|\
+arcadyan,vgv7510kw22-brn)
+	ucidef_set_led_netdev "internet" "internet" "$led_internet" "wan"
+	;;
 zyxel,p-2812hnu-f1|\
 zyxel,p-2812hnu-f3)
 	ucidef_set_led_wlan "wifi" "wifi" "green:wlan" "phy0radio"
diff --git a/target/linux/lantiq/xrx200/base-files/etc/hotplug.d/firmware/12-ath9k-eeprom b/target/linux/lantiq/xrx200/base-files/etc/hotplug.d/firmware/12-ath9k-eeprom
index c6bacb8d3c1629..eefc39b30b463e 100644
--- a/target/linux/lantiq/xrx200/base-files/etc/hotplug.d/firmware/12-ath9k-eeprom
+++ b/target/linux/lantiq/xrx200/base-files/etc/hotplug.d/firmware/12-ath9k-eeprom
@@ -19,8 +19,7 @@ case "$FIRMWARE" in
 			avm,fritz3390)
 				caldata_extract_reverse "urlader" 0x2546 0x440
 				;;
-			avm,fritz7360sl|\
-			avm,fritz7360-v2)
+			avm,fritz7360sl)
 				caldata_extract "urlader" 0x985 0x1000
 				;;
 			avm,fritz7412|\
diff --git a/target/linux/lantiq/xrx200/config-5.15 b/target/linux/lantiq/xrx200/config-5.15
new file mode 100644
index 00000000000000..4dfd55274a3687
--- /dev/null
+++ b/target/linux/lantiq/xrx200/config-5.15
@@ -0,0 +1,93 @@
+CONFIG_AT803X_PHY=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_CPU_HAS_DIEI=y
+CONFIG_CPU_MIPSR2_IRQ_EI=y
+CONFIG_CPU_MIPSR2_IRQ_VI=y
+CONFIG_CPU_RMAP=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_ACOMP2=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_EXTRA_FIRMWARE="lantiq/xrx200_phy11g_a14.bin lantiq/xrx200_phy11g_a22.bin lantiq/xrx200_phy22f_a14.bin lantiq/xrx200_phy22f_a22.bin"
+CONFIG_EXTRA_FIRMWARE_DIR="firmware"
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GRO_CELLS=y
+CONFIG_HWMON=y
+CONFIG_HW_RANDOM=y
+CONFIG_ICPLUS_PHY=y
+CONFIG_IFX_VPE_EXT=y
+CONFIG_INPUT=y
+CONFIG_INPUT_EVDEV=y
+CONFIG_INPUT_POLLDEV=y
+CONFIG_INTEL_XWAY_PHY=y
+# CONFIG_ISDN is not set
+CONFIG_LANTIQ_XRX200=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MIPS_MT=y
+# CONFIG_MIPS_MT_FPAFF is not set
+CONFIG_MIPS_MT_SMP=y
+CONFIG_MIPS_NR_CPU_NR_MAP=2
+CONFIG_MIPS_PERF_SHARED_TC_COUNTERS=y
+CONFIG_MIPS_VPE_APSP_API=y
+CONFIG_MIPS_VPE_APSP_API_MT=y
+CONFIG_MIPS_VPE_LOADER=y
+CONFIG_MIPS_VPE_LOADER_MT=y
+CONFIG_MIPS_VPE_LOADER_TOM=y
+CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_NAND_ECC_SW_HAMMING=y
+CONFIG_MTD_NAND_PLATFORM=y
+CONFIG_MTD_NAND_XWAY=y
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_LIMIT=20
+CONFIG_MTD_UBI_BLOCK=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_LANTIQ_GSWIP=y
+CONFIG_NET_DSA_TAG_GSWIP=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NLS=y
+CONFIG_NR_CPUS=2
+CONFIG_PADATA=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_LANTIQ=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_LANTIQ=y
+CONFIG_PHY_LANTIQ_VRX200_PCIE=y
+CONFIG_POWER_RESET_GPIO=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_POWER_SUPPLY_HWMON=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+CONFIG_SENSORS_LTQ_CPUTEMP=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SMP=y
+CONFIG_SMP_UP=y
+CONFIG_SOC_TYPE_XWAY=y
+CONFIG_SOC_XWAY=y
+CONFIG_SYNC_R4K=y
+CONFIG_SYS_SUPPORTS_SCHED_SMT=y
+CONFIG_SYS_SUPPORTS_SMP=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UBIFS_FS=y
+CONFIG_USB=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_SUPPORT=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/lantiq/xrx200/target.mk b/target/linux/lantiq/xrx200/target.mk
index 8813de8d045278..6e01fc79e4759c 100644
--- a/target/linux/lantiq/xrx200/target.mk
+++ b/target/linux/lantiq/xrx200/target.mk
@@ -1,7 +1,7 @@
 ARCH:=mips
 SUBTARGET:=xrx200
 BOARDNAME:=XRX200
-FEATURES+=atm nand ramdisk
+FEATURES+=atm nand ramdisk source-only
 CPU_TYPE:=24kc
 
 DEFAULT_PACKAGES+=kmod-leds-gpio \
@@ -12,7 +12,7 @@ DEFAULT_PACKAGES+=kmod-leds-gpio \
 	kmod-ltq-atm-vr9 \
 	kmod-ltq-deu-vr9 \
 	kmod-ltq-ptm-vr9 \
-	ltq-vdsl-app \
+	ltq-vdsl-vr9-app \
 	dsl-vrx200-firmware-xdsl-a \
 	dsl-vrx200-firmware-xdsl-b-patch \
 	ppp-mod-pppoa
diff --git a/target/linux/lantiq/xway/config-5.15 b/target/linux/lantiq/xway/config-5.15
new file mode 100644
index 00000000000000..5a6f15dafdc6a5
--- /dev/null
+++ b/target/linux/lantiq/xway/config-5.15
@@ -0,0 +1,84 @@
+CONFIG_ADM6996_PHY=y
+CONFIG_AR8216_PHY=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_AT803X_PHY=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_CPU_HAS_DIEI=y
+CONFIG_CPU_MIPSR2_IRQ_EI=y
+CONFIG_CPU_MIPSR2_IRQ_VI=y
+CONFIG_CPU_RMAP=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_ETHERNET_PACKET_MANGLE=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GPIO_CDEV=y
+CONFIG_HW_RANDOM=y
+CONFIG_INPUT=y
+CONFIG_INPUT_EVDEV=y
+# CONFIG_ISDN is not set
+CONFIG_LANTIQ_ETOP=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MIPS_EBPF_JIT=y
+CONFIG_MIPS_MT=y
+CONFIG_MIPS_MT_FPAFF=y
+CONFIG_MIPS_MT_SMP=y
+CONFIG_MIPS_NR_CPU_NR_MAP=2
+CONFIG_MIPS_PERF_SHARED_TC_COUNTERS=y
+CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_NAND_ECC_SW_HAMMING=y
+CONFIG_MTD_NAND_XWAY=y
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_LIMIT=20
+CONFIG_MTD_UBI_BLOCK=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NLS=y
+CONFIG_NR_CPUS=2
+CONFIG_PADATA=y
+CONFIG_PCI=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_LANTIQ=y
+CONFIG_PSB6970_PHY=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+CONFIG_RTL8306_PHY=y
+CONFIG_RTL8366RB_PHY=y
+CONFIG_RTL8366_SMI=y
+# CONFIG_SCHED_CORE is not set
+CONFIG_SCHED_SMT=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SMP=y
+CONFIG_SMP_UP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOC_TYPE_XWAY=y
+CONFIG_SOC_XWAY=y
+CONFIG_SWCONFIG=y
+CONFIG_SYNC_R4K=y
+CONFIG_SYS_SUPPORTS_SCHED_SMT=y
+CONFIG_SYS_SUPPORTS_SMP=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UBIFS_FS=y
+CONFIG_USB=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_SUPPORT=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/lantiq/xway_legacy/config-5.15 b/target/linux/lantiq/xway_legacy/config-5.15
new file mode 100644
index 00000000000000..c177d2a9351307
--- /dev/null
+++ b/target/linux/lantiq/xway_legacy/config-5.15
@@ -0,0 +1,33 @@
+CONFIG_ADM6996_PHY=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_CPU_HAS_DIEI=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_ACOMP2=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_GENERIC_ALLOCATOR=y
+# CONFIG_GPIO_SYSFS is not set
+CONFIG_INPUT=y
+CONFIG_INPUT_EVDEV=y
+CONFIG_INPUT_POLLDEV=y
+# CONFIG_ISDN is not set
+CONFIG_LANTIQ_ETOP=y
+# CONFIG_LEDS_TRIGGER_TIMER is not set
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_NLS=y
+CONFIG_PCI=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_LANTIQ=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_RTL8306_PHY=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SOC_TYPE_XWAY=y
+CONFIG_SOC_XWAY=y
+CONFIG_SWCONFIG=y
+CONFIG_USB=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_SUPPORT=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
diff --git a/target/linux/layerscape/Makefile b/target/linux/layerscape/Makefile
index 5bdbb5bfcd03ae..23672602529ef8 100644
--- a/target/linux/layerscape/Makefile
+++ b/target/linux/layerscape/Makefile
@@ -6,8 +6,9 @@ include $(TOPDIR)/rules.mk
 
 BOARD:=layerscape
 BOARDNAME:=NXP Layerscape
-KERNEL_PATCHVER:=5.10
-KERNEL_TESTING_PATCHVER:=5.10
+
+KERNEL_PATCHVER:=5.15
+
 FEATURES:=squashfs nand usb pcie gpio fpu ubifs ext4 rootfs-part boot-part
 SUBTARGETS:=armv8_64b armv7
 
diff --git a/target/linux/layerscape/README b/target/linux/layerscape/README
index a8d18464687099..1e3f707b4f18f1 100644
--- a/target/linux/layerscape/README
+++ b/target/linux/layerscape/README
@@ -12,6 +12,7 @@ users can bring up the board without difficulty.
   LS1012ARDB        (QSPI NOR boot)
   LS1012AFRDM       (QSPI NOR boot)
   LS1012AFRWY       (QSPI NOR boot)
+  LS1028ARDB        (QSPI NOR boot    | SD card boot)
   LS1043ARDB        (NOR boot         | SD card boot)
   LS1046ARDB        (QSPI NOR boot    | SD card boot)
   LS1046AFRWY       (QSPI NOR boot    | SD card boot)
@@ -95,6 +96,15 @@ from SD card. (sdcard.img images are gz-iped to save space. Please extract them
   => sf write a0000000 0 $filesize
   => reset
 
+* LS1028ARDB
+  Board has only one bank. Those commands will replace stock bootloader
+  and firmware.
+  => tftp a0000000 <firmware_name>-firmware.bin
+  => sf probe 0:0
+  => sf erase 0 +$filesize
+  => sf write a0000000 0 $filesize
+  => reset
+
 * LS1043ARDB
   Start up from bank0, and program firmware to bank4 with below commands.
   Switch to bank4 to start up OpenWrt.
diff --git a/target/linux/layerscape/armv7/config-5.15 b/target/linux/layerscape/armv7/config-5.15
new file mode 100644
index 00000000000000..b5df343f4eb905
--- /dev/null
+++ b/target/linux/layerscape/armv7/config-5.15
@@ -0,0 +1,676 @@
+CONFIG_AD525X_DPOT=y
+CONFIG_AD525X_DPOT_I2C=y
+# CONFIG_AD525X_DPOT_SPI is not set
+CONFIG_ALIGNMENT_TRAP=y
+CONFIG_APDS9802ALS=y
+CONFIG_AQUANTIA_PHY=y
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+CONFIG_ARCH_MULTIPLATFORM=y
+CONFIG_ARCH_MULTI_V6_V7=y
+CONFIG_ARCH_MULTI_V7=y
+CONFIG_ARCH_MXC=y
+CONFIG_ARCH_NR_GPIO=0
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX=y
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARM=y
+CONFIG_ARM_APPENDED_DTB=y
+CONFIG_ARM_ARCH_TIMER=y
+CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+CONFIG_ARM_ATAG_DTB_COMPAT=y
+CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_FROM_BOOTLOADER=y
+CONFIG_ARM_CPUIDLE=y
+CONFIG_ARM_CPU_SUSPEND=y
+CONFIG_ARM_CRYPTO=y
+CONFIG_ARM_ERRATA_430973=y
+CONFIG_ARM_ERRATA_643719=y
+CONFIG_ARM_ERRATA_720789=y
+CONFIG_ARM_ERRATA_754322=y
+CONFIG_ARM_ERRATA_754327=y
+CONFIG_ARM_ERRATA_764369=y
+CONFIG_ARM_ERRATA_775420=y
+CONFIG_ARM_ERRATA_798181=y
+CONFIG_ARM_GIC=y
+CONFIG_ARM_HAS_SG_CHAIN=y
+CONFIG_ARM_HEAVY_MB=y
+# CONFIG_ARM_HIGHBANK_CPUIDLE is not set
+# CONFIG_ARM_IMX8M_DDRC_DEVFREQ is not set
+# CONFIG_ARM_IMX_BUS_DEVFREQ is not set
+# CONFIG_ARM_IMX_CPUFREQ_DT is not set
+CONFIG_ARM_L1_CACHE_SHIFT=6
+CONFIG_ARM_L1_CACHE_SHIFT_6=y
+CONFIG_ARM_LPAE=y
+CONFIG_ARM_PATCH_IDIV=y
+CONFIG_ARM_PATCH_PHYS_VIRT=y
+CONFIG_ARM_PSCI=y
+CONFIG_ARM_PSCI_FW=y
+# CONFIG_ARM_SMMU is not set
+CONFIG_ARM_THUMB=y
+CONFIG_ARM_THUMBEE=y
+CONFIG_ARM_UNWIND=y
+CONFIG_ARM_VIRT_EXT=y
+CONFIG_ATAGS=y
+CONFIG_AUTOFS4_FS=y
+CONFIG_AUTOFS_FS=y
+CONFIG_AUTO_ZRELADDR=y
+CONFIG_BATTERY_SBS=y
+CONFIG_BCM_NET_PHYLIB=y
+CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK=y
+CONFIG_BLK_DEV_BSG=y
+CONFIG_BLK_DEV_BSG_COMMON=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=262144
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_DEV_SR=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_MQ_VIRTIO=y
+CONFIG_BLK_PM=y
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC_VALUE=0
+CONFIG_BOUNCE=y
+CONFIG_BRCMSTB_GISB_ARB=y
+CONFIG_BROADCOM_PHY=y
+CONFIG_CACHE_L2X0=y
+CONFIG_CDROM=y
+CONFIG_CHECKPOINT_RESTORE=y
+CONFIG_CHR_DEV_SG=y
+CONFIG_CLKSRC_IMX_GPT=y
+CONFIG_CLKSRC_MMIO=y
+# CONFIG_CLK_IMX8MM is not set
+# CONFIG_CLK_IMX8MN is not set
+# CONFIG_CLK_IMX8MP is not set
+# CONFIG_CLK_IMX8MQ is not set
+CONFIG_CLK_QORIQ=y
+# CONFIG_CLK_VEXPRESS_OSC is not set
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CMA=y
+CONFIG_CMA_ALIGNMENT=8
+CONFIG_CMA_AREAS=7
+# CONFIG_CMA_DEBUG is not set
+# CONFIG_CMA_DEBUGFS is not set
+CONFIG_CMA_SIZE_MBYTES=64
+# CONFIG_CMA_SIZE_SEL_MAX is not set
+CONFIG_CMA_SIZE_SEL_MBYTES=y
+# CONFIG_CMA_SIZE_SEL_MIN is not set
+# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
+# CONFIG_CMA_SYSFS is not set
+CONFIG_CMDLINE_PARTITION=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONFIGFS_FS=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CONTIG_ALLOC=y
+CONFIG_COREDUMP=y
+CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+CONFIG_CPU_32v6K=y
+CONFIG_CPU_32v7=y
+CONFIG_CPU_ABRT_EV7=y
+CONFIG_CPU_CACHE_V7=y
+CONFIG_CPU_CACHE_VIPT=y
+CONFIG_CPU_COPY_V6=y
+CONFIG_CPU_CP15=y
+CONFIG_CPU_CP15_MMU=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+# CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+# CONFIG_CPU_FREQ_GOV_POWERSAVE is not set
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+# CONFIG_CPU_FREQ_GOV_USERSPACE is not set
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_HAS_ASID=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_IDLE_MULTIPLE_DRIVERS=y
+CONFIG_CPU_PABRT_V7=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SPECTRE=y
+CONFIG_CPU_THERMAL=y
+CONFIG_CPU_THUMB_CAPABLE=y
+CONFIG_CPU_TLB_V7=y
+CONFIG_CPU_V7=y
+CONFIG_CRASH_CORE=y
+CONFIG_CRC16=y
+# CONFIG_CRC32_SARWATE is not set
+CONFIG_CRC32_SLICEBY8=y
+CONFIG_CROSS_MEMORY_ATTACH=y
+CONFIG_CRYPTO_CRC32=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DEBUG_ALIGN_RODATA=y
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_LL_INCLUDE="mach/debug-macro.S"
+CONFIG_DECOMPRESS_BZIP2=y
+CONFIG_DECOMPRESS_GZIP=y
+CONFIG_DECOMPRESS_LZMA=y
+CONFIG_DECOMPRESS_LZO=y
+CONFIG_DECOMPRESS_XZ=y
+CONFIG_DETECT_HUNG_TASK=y
+# CONFIG_DEVFREQ_GOV_PASSIVE is not set
+# CONFIG_DEVFREQ_GOV_PERFORMANCE is not set
+# CONFIG_DEVFREQ_GOV_POWERSAVE is not set
+# CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND is not set
+# CONFIG_DEVFREQ_GOV_USERSPACE is not set
+# CONFIG_DEVFREQ_THERMAL is not set
+CONFIG_DMADEVICES=y
+CONFIG_DMA_CMA=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_OPS=y
+CONFIG_DMA_REMAP=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DMA_VIRTUAL_CHANNELS=y
+CONFIG_DNOTIFY=y
+CONFIG_DTC=y
+CONFIG_DT_IDLE_STATES=y
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_DW_DMAC=y
+CONFIG_DW_DMAC_CORE=y
+CONFIG_DW_WATCHDOG=y
+CONFIG_EDAC_ATOMIC_SCRUB=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EEPROM_93CX6=y
+CONFIG_EEPROM_AT24=y
+CONFIG_ELF_CORE=y
+# CONFIG_ENABLE_DEFAULT_TRACERS is not set
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_F2FS_FS=y
+CONFIG_FAILOVER=y
+CONFIG_FAT_FS=y
+# CONFIG_FEC is not set
+CONFIG_FHANDLE=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FORCE_MAX_ZONEORDER=12
+CONFIG_FREEZER=y
+# CONFIG_FSL_DPAA2_SWITCH is not set
+CONFIG_FSL_EDMA=y
+CONFIG_FSL_GUTS=y
+CONFIG_FSL_IFC=y
+# CONFIG_FSL_PPFE is not set
+CONFIG_FSL_PQ_MDIO=y
+CONFIG_FSL_RCPM=y
+CONFIG_FSL_XGMAC_MDIO=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FS_POSIX_ACL=y
+CONFIG_FTRACE=y
+# CONFIG_FTRACE_SYSCALLS is not set
+CONFIG_FUSE_FS=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CACHE=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+# CONFIG_FW_LOADER_USER_HELPER_FALLBACK is not set
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ARCH_TOPOLOGY=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_GENERIC_IRQ_MULTI_HANDLER=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_MSI_IRQ=y
+CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GENERIC_VDSO_32=y
+CONFIG_GIANFAR=y
+CONFIG_GLOB=y
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_GPIO_MPC8XXX=y
+CONFIG_GPIO_MXC=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDEN_BRANCH_PREDICTOR=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HAVE_SMP=y
+CONFIG_HID=y
+CONFIG_HID_GENERIC=y
+CONFIG_HIGHMEM=y
+CONFIG_HIGHPTE=y
+# CONFIG_HIST_TRIGGERS is not set
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HVC_DRIVER=y
+CONFIG_HW_CONSOLE=y
+CONFIG_HW_RANDOM=y
+CONFIG_HZ_FIXED=0
+CONFIG_I2C=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_COMPAT=y
+CONFIG_I2C_DEMUX_PINCTRL=y
+CONFIG_I2C_DESIGNWARE_CORE=y
+CONFIG_I2C_DESIGNWARE_PLATFORM=y
+CONFIG_I2C_HELPER_AUTO=y
+CONFIG_I2C_IMX=y
+# CONFIG_I2C_IMX_LPI2C is not set
+CONFIG_I2C_MUX=y
+CONFIG_I2C_MUX_PCA954x=y
+CONFIG_I2C_MUX_PINCTRL=y
+CONFIG_I2C_RK3X=y
+CONFIG_I2C_SLAVE=y
+CONFIG_I2C_SLAVE_EEPROM=y
+# CONFIG_I2C_SLAVE_TESTUNIT is not set
+CONFIG_I2C_XILINX=y
+CONFIG_ICPLUS_PHY=y
+CONFIG_ICS932S401=y
+CONFIG_IMX2_WDT=y
+# CONFIG_IMX7ULP_WDT is not set
+# CONFIG_IMX8MM_THERMAL is not set
+CONFIG_IMX_DMA=y
+# CONFIG_IMX_GPCV2_PM_DOMAINS is not set
+CONFIG_IMX_INTMUX=y
+# CONFIG_IMX_IRQSTEER is not set
+CONFIG_IMX_SDMA=y
+# CONFIG_IMX_WEIM is not set
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_INPUT=y
+# CONFIG_IOMMU_DEBUGFS is not set
+# CONFIG_IOMMU_IO_PGTABLE_ARMV7S is not set
+# CONFIG_IOMMU_IO_PGTABLE_LPAE is not set
+CONFIG_IOMMU_SUPPORT=y
+CONFIG_IPC_NS=y
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+# CONFIG_ISDN is not set
+CONFIG_ISL29003=y
+CONFIG_JBD2=y
+CONFIG_KALLSYMS=y
+CONFIG_KCMP=y
+CONFIG_KERNEL_GZIP=y
+# CONFIG_KERNEL_XZ is not set
+CONFIG_KEXEC=y
+CONFIG_KEXEC_CORE=y
+CONFIG_KMAP_LOCAL=y
+CONFIG_KMAP_LOCAL_NON_LINEAR_PTE_ARRAY=y
+CONFIG_LIBFDT=y
+CONFIG_LOCALVERSION_AUTO=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_LS_EXTIRQ=y
+CONFIG_LS_SCFG_MSI=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MARVELL_PHY=y
+CONFIG_MCPM=y
+CONFIG_MDIO_BITBANG=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+# CONFIG_MDIO_GPIO is not set
+CONFIG_MEMFD_CREATE=y
+CONFIG_MEMORY=y
+CONFIG_MEMORY_ISOLATION=y
+# CONFIG_MFD_HI6421_SPMI is not set
+CONFIG_MFD_SYSCON=y
+# CONFIG_MFD_VEXPRESS_SYSREG is not set
+CONFIG_MICREL_PHY=y
+CONFIG_MIGHT_HAVE_CACHE_L2X0=y
+CONFIG_MIGRATION=y
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_BLOCK_MINORS=16
+# CONFIG_MMC_MXC is not set
+CONFIG_MMC_SDHCI=y
+# CONFIG_MMC_SDHCI_ESDHC_IMX is not set
+CONFIG_MMC_SDHCI_IO_ACCESSORS=y
+CONFIG_MMC_SDHCI_OF_ESDHC=y
+# CONFIG_MMC_SDHCI_PCI is not set
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MSDOS_FS=y
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_GEOMETRY=y
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_CMDLINE_PARTS=y
+# CONFIG_MTD_COMPLEX_MAPPINGS is not set
+CONFIG_MTD_DATAFLASH=y
+# CONFIG_MTD_DATAFLASH_OTP is not set
+# CONFIG_MTD_DATAFLASH_WRITE_VERIFY is not set
+CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_NAND_ECC_SW_HAMMING=y
+CONFIG_MTD_NAND_FSL_IFC=y
+CONFIG_MTD_PHYSMAP=y
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPI_NOR_USE_4K_SECTORS=y
+CONFIG_MTD_SST25L=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_LIMIT=20
+# CONFIG_MTD_UBI_BLOCK is not set
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_MX3_IPU=y
+CONFIG_MX3_IPU_IRQS=4
+CONFIG_MXC_CLK=y
+# CONFIG_MXS_DMA is not set
+CONFIG_NAMESPACES=y
+CONFIG_NATIONAL_PHY=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEON=y
+CONFIG_NET_FAILOVER=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_NS=y
+CONFIG_NET_PTP_CLASSIFY=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NLS=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_UTF8=y
+CONFIG_NO_HZ=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NR_CPUS=16
+CONFIG_NTFS_FS=y
+CONFIG_NVMEM=y
+# CONFIG_NVMEM_IMX_IIM is not set
+# CONFIG_NVMEM_IMX_OCOTP_ELE is not set
+# CONFIG_NVMEM_SNVS_LPGPR is not set
+# CONFIG_NVMEM_SPMI_SDAM is not set
+CONFIG_NVMEM_SYSFS=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_DYNAMIC=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_OLD_SIGACTION=y
+CONFIG_OLD_SIGSUSPEND3=y
+CONFIG_OUTER_CACHE=y
+CONFIG_OUTER_CACHE_SYNC=y
+CONFIG_PACKET_DIAG=y
+CONFIG_PADATA=y
+CONFIG_PAGE_OFFSET=0xC0000000
+# CONFIG_PANIC_ON_OOPS is not set
+CONFIG_PANIC_ON_OOPS_VALUE=0
+CONFIG_PANIC_TIMEOUT=0
+CONFIG_PCI=y
+CONFIG_PCIEAER=y
+CONFIG_PCIEASPM=y
+CONFIG_PCIEASPM_DEFAULT=y
+# CONFIG_PCIEASPM_PERFORMANCE is not set
+# CONFIG_PCIEASPM_POWERSAVE is not set
+# CONFIG_PCIEASPM_POWER_SUPERSAVE is not set
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_DW=y
+CONFIG_PCIE_DW_HOST=y
+CONFIG_PCIE_PME=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PCI_ECAM=y
+CONFIG_PCI_HOST_COMMON=y
+CONFIG_PCI_HOST_GENERIC=y
+# CONFIG_PCI_IMX6 is not set
+CONFIG_PCI_LAYERSCAPE=y
+CONFIG_PCI_MSI=y
+CONFIG_PCI_MSI_IRQ_DOMAIN=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=3
+CONFIG_PHYLIB=y
+CONFIG_PHYS_ADDR_T_64BIT=y
+CONFIG_PID_NS=y
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_IMX8MM is not set
+# CONFIG_PINCTRL_IMX8MN is not set
+# CONFIG_PINCTRL_IMX8MP is not set
+# CONFIG_PINCTRL_IMX8MQ is not set
+# CONFIG_PINCTRL_IMX8ULP is not set
+CONFIG_PL310_ERRATA_588369=y
+CONFIG_PL310_ERRATA_727915=y
+CONFIG_PL310_ERRATA_753970=y
+CONFIG_PL310_ERRATA_769419=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_DEVFREQ=y
+# CONFIG_PM_DEVFREQ_EVENT is not set
+CONFIG_PM_OPP=y
+CONFIG_PM_SLEEP=y
+CONFIG_PM_SLEEP_SMP=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_BRCMKONA=y
+CONFIG_POWER_RESET_BRCMSTB=y
+CONFIG_POWER_RESET_GPIO=y
+CONFIG_POWER_RESET_GPIO_RESTART=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_POWER_RESET_SYSCON_POWEROFF=y
+CONFIG_POWER_RESET_VEXPRESS=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PPS=y
+CONFIG_PRINTK_TIME=y
+CONFIG_PROC_CHILDREN=y
+CONFIG_PROC_PAGE_MONITOR=y
+CONFIG_PSTORE=y
+CONFIG_PSTORE_COMPRESS=y
+CONFIG_PSTORE_COMPRESS_DEFAULT="deflate"
+CONFIG_PSTORE_CONSOLE=y
+CONFIG_PSTORE_DEFLATE_COMPRESS=y
+CONFIG_PSTORE_DEFLATE_COMPRESS_DEFAULT=y
+CONFIG_PSTORE_PMSG=y
+CONFIG_PSTORE_RAM=y
+CONFIG_PTP_1588_CLOCK=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_PTP_1588_CLOCK_QORIQ=y
+CONFIG_QORIQ_CPUFREQ=y
+CONFIG_RAS=y
+CONFIG_RATIONAL=y
+CONFIG_RD_BZIP2=y
+CONFIG_RD_GZIP=y
+CONFIG_RD_LZMA=y
+CONFIG_RD_LZO=y
+CONFIG_RD_XZ=y
+CONFIG_REALTEK_PHY=y
+CONFIG_REED_SOLOMON=y
+CONFIG_REED_SOLOMON_DEC8=y
+CONFIG_REED_SOLOMON_ENC8=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGMAP_SPI=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+CONFIG_RTC_CLASS=y
+# CONFIG_RTC_DRV_CMOS is not set
+CONFIG_RTC_DRV_DS1307=y
+CONFIG_RTC_DRV_DS3232=y
+CONFIG_RTC_DRV_EM3027=y
+CONFIG_RTC_DRV_FSL_FTM_ALARM=y
+# CONFIG_RTC_DRV_IMXDI is not set
+# CONFIG_RTC_DRV_MXC is not set
+# CONFIG_RTC_DRV_MXC_V2 is not set
+CONFIG_RTC_DRV_PCF2127=y
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+CONFIG_SCHED_DEBUG=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+CONFIG_SECCOMP=y
+CONFIG_SECCOMP_FILTER=y
+# CONFIG_SECURITY_DMESG_RESTRICT is not set
+CONFIG_SERIAL_8250_DEPRECATED_OPTIONS=y
+CONFIG_SERIAL_8250_DW=y
+CONFIG_SERIAL_8250_DWLIB=y
+CONFIG_SERIAL_8250_EM=y
+CONFIG_SERIAL_8250_FSL=y
+CONFIG_SERIAL_8250_NR_UARTS=4
+CONFIG_SERIAL_8250_PCI=y
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
+CONFIG_SERIAL_CONEXANT_DIGICOLOR=y
+CONFIG_SERIAL_CONEXANT_DIGICOLOR_CONSOLE=y
+CONFIG_SERIAL_FSL_LPUART=y
+CONFIG_SERIAL_FSL_LPUART_CONSOLE=y
+CONFIG_SERIAL_IMX=y
+CONFIG_SERIAL_IMX_CONSOLE=y
+CONFIG_SERIAL_IMX_EARLYCON=y
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_ST_ASC=y
+CONFIG_SERIAL_ST_ASC_CONSOLE=y
+CONFIG_SERIAL_XILINX_PS_UART=y
+CONFIG_SERIAL_XILINX_PS_UART_CONSOLE=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SG_POOL=y
+CONFIG_SLUB_DEBUG=y
+CONFIG_SMP=y
+CONFIG_SMP_ON_UP=y
+CONFIG_SMSC_PHY=y
+CONFIG_SOCK_DIAG=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOC_BRCMSTB=y
+CONFIG_SOC_BUS=y
+# CONFIG_SOC_IMX50 is not set
+# CONFIG_SOC_IMX51 is not set
+# CONFIG_SOC_IMX53 is not set
+# CONFIG_SOC_IMX6Q is not set
+# CONFIG_SOC_IMX6SL is not set
+# CONFIG_SOC_IMX6SLL is not set
+# CONFIG_SOC_IMX6SX is not set
+# CONFIG_SOC_IMX6UL is not set
+# CONFIG_SOC_IMX7D is not set
+# CONFIG_SOC_IMX7ULP is not set
+# CONFIG_SOC_IMX8M is not set
+CONFIG_SOC_LS1021A=y
+# CONFIG_SOC_VF610 is not set
+CONFIG_SPARSE_IRQ=y
+CONFIG_SPI=y
+CONFIG_SPI_BITBANG=y
+CONFIG_SPI_CADENCE=y
+CONFIG_SPI_DYNAMIC=y
+# CONFIG_SPI_FSL_LPSPI is not set
+# CONFIG_SPI_FSL_QUADSPI is not set
+# CONFIG_SPI_IMX is not set
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SPI_SPIDEV=y
+CONFIG_SPI_XILINX=y
+CONFIG_SPMI=y
+# CONFIG_SPMI_HISI3670 is not set
+# CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU is not set
+CONFIG_SQUASHFS_DECOMP_SINGLE=y
+CONFIG_SQUASHFS_FILE_CACHE=y
+# CONFIG_SQUASHFS_FILE_DIRECT is not set
+CONFIG_SQUASHFS_LZO=y
+CONFIG_SQUASHFS_ZLIB=y
+CONFIG_SRAM=y
+CONFIG_SRAM_EXEC=y
+CONFIG_SRCU=y
+CONFIG_STACKTRACE=y
+CONFIG_STAGING_BOARD=y
+# CONFIG_STRIP_ASM_SYMS is not set
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+CONFIG_SWIOTLB=y
+CONFIG_SWPHY=y
+CONFIG_SWP_EMULATE=y
+CONFIG_SYNC_FILE=y
+CONFIG_SYSFS_SYSCALL=y
+CONFIG_SYS_SUPPORTS_APM_EMULATION=y
+CONFIG_THERMAL=y
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_GOV_STEP_WISE=y
+CONFIG_THERMAL_OF=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UBIFS_FS=y
+# CONFIG_UCLAMP_TASK is not set
+CONFIG_UEVENT_HELPER_PATH=""
+CONFIG_UNCOMPRESS_INCLUDE="debug/uncompress.h"
+CONFIG_UNIX_DIAG=y
+CONFIG_UNWINDER_ARM=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USER_NS=y
+CONFIG_USE_OF=y
+CONFIG_UTS_NS=y
+CONFIG_VEXPRESS_CONFIG=y
+CONFIG_VFAT_FS=y
+CONFIG_VFP=y
+CONFIG_VFPv3=y
+CONFIG_VIRTIO=y
+CONFIG_VIRTIO_BLK=y
+CONFIG_VIRTIO_CONSOLE=y
+CONFIG_VIRTIO_MMIO=y
+CONFIG_VIRTIO_NET=y
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_PCI_LEGACY=y
+CONFIG_VIRTIO_PCI_LIB=y
+CONFIG_VITESSE_PHY=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_CONSOLE_SLEEP=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_WATCHDOG_CORE=y
+# CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set
+CONFIG_XILINX_WATCHDOG=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_XZ_DEC_ARM=y
+CONFIG_XZ_DEC_ARMTHUMB=y
+CONFIG_XZ_DEC_BCJ=y
+CONFIG_XZ_DEC_IA64=y
+CONFIG_XZ_DEC_POWERPC=y
+CONFIG_XZ_DEC_SPARC=y
+CONFIG_XZ_DEC_X86=y
+CONFIG_ZBOOT_ROM_BSS=0
+CONFIG_ZBOOT_ROM_TEXT=0
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/layerscape/armv8_64b/config-5.15 b/target/linux/layerscape/armv8_64b/config-5.15
new file mode 100644
index 00000000000000..69edc7a3f0703a
--- /dev/null
+++ b/target/linux/layerscape/armv8_64b/config-5.15
@@ -0,0 +1,860 @@
+CONFIG_64BIT=y
+CONFIG_AQUANTIA_PHY=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_ARCH_HIBERNATION_HEADER=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_LAYERSCAPE=y
+CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
+CONFIG_ARCH_MMAP_RND_BITS=18
+CONFIG_ARCH_MMAP_RND_BITS_MAX=33
+CONFIG_ARCH_MMAP_RND_BITS_MIN=18
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=11
+CONFIG_ARCH_PROC_KCORE_TEXT=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_STACKWALK=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARCH_WANTS_NO_INSTR=y
+CONFIG_ARM64=y
+CONFIG_ARM64_4K_PAGES=y
+CONFIG_ARM64_CNP=y
+CONFIG_ARM64_CRYPTO=y
+CONFIG_ARM64_EPAN=y
+CONFIG_ARM64_ERRATUM_1165522=y
+CONFIG_ARM64_ERRATUM_1286807=y
+CONFIG_ARM64_ERRATUM_819472=y
+CONFIG_ARM64_ERRATUM_824069=y
+CONFIG_ARM64_ERRATUM_826319=y
+CONFIG_ARM64_ERRATUM_827319=y
+CONFIG_ARM64_ERRATUM_832075=y
+CONFIG_ARM64_ERRATUM_843419=y
+CONFIG_ARM64_HW_AFDBM=y
+CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
+CONFIG_ARM64_PAGE_SHIFT=12
+CONFIG_ARM64_PAN=y
+CONFIG_ARM64_PA_BITS=48
+CONFIG_ARM64_PA_BITS_48=y
+CONFIG_ARM64_PTR_AUTH=y
+CONFIG_ARM64_PTR_AUTH_KERNEL=y
+CONFIG_ARM64_SVE=y
+CONFIG_ARM64_TAGGED_ADDR_ABI=y
+CONFIG_ARM64_VA_BITS=48
+# CONFIG_ARM64_VA_BITS_39 is not set
+CONFIG_ARM64_VA_BITS_48=y
+CONFIG_ARM64_WORKAROUND_CLEAN_CACHE=y
+CONFIG_ARM64_WORKAROUND_REPEAT_TLBI=y
+CONFIG_ARM64_WORKAROUND_SPECULATIVE_AT=y
+CONFIG_ARM_AMBA=y
+CONFIG_ARM_ARCH_TIMER=y
+CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+CONFIG_ARM_ARCH_TIMER_OOL_WORKAROUND=y
+CONFIG_ARM_CPUIDLE=y
+CONFIG_ARM_GIC=y
+CONFIG_ARM_GIC_V2M=y
+CONFIG_ARM_GIC_V3=y
+CONFIG_ARM_GIC_V3_ITS=y
+CONFIG_ARM_GIC_V3_ITS_FSL_MC=y
+CONFIG_ARM_GIC_V3_ITS_PCI=y
+# CONFIG_ARM_PL172_MPMC is not set
+CONFIG_ARM_PSCI_CPUIDLE=y
+CONFIG_ARM_PSCI_FW=y
+CONFIG_ARM_SMMU=y
+# CONFIG_ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT is not set
+# CONFIG_ARM_SMMU_LEGACY_DT_BINDINGS is not set
+CONFIG_ARM_SMMU_V3=y
+# CONFIG_ARM_SMMU_V3_SVA is not set
+CONFIG_ARM_SP805_WATCHDOG=y
+CONFIG_ASM_MODVERSIONS=y
+CONFIG_ASN1=y
+CONFIG_ASYNC_TX_ENABLE_CHANNEL_SWITCH=y
+CONFIG_ATA=y
+CONFIG_AUDIT=y
+CONFIG_AUDITSYSCALL=y
+CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
+CONFIG_AUDIT_GENERIC=y
+CONFIG_AUTOFS4_FS=y
+CONFIG_AUTOFS_FS=y
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+CONFIG_BALLOON_COMPACTION=y
+CONFIG_BATTERY_BQ27XXX=y
+# CONFIG_BATTERY_BQ27XXX_DT_UPDATES_NVM is not set
+CONFIG_BATTERY_BQ27XXX_I2C=y
+CONFIG_BLK_DEV_BSG=y
+CONFIG_BLK_DEV_BSGLIB=y
+CONFIG_BLK_DEV_BSG_COMMON=y
+CONFIG_BLK_DEV_INTEGRITY=y
+CONFIG_BLK_DEV_INTEGRITY_T10=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=262144
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_MQ_VIRTIO=y
+CONFIG_BLK_PM=y
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC_VALUE=0
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_BTRFS_FS=y
+# CONFIG_BTRFS_FS_CHECK_INTEGRITY is not set
+CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_CAVIUM_ERRATUM_22375=y
+CONFIG_CAVIUM_ERRATUM_23144=y
+CONFIG_CAVIUM_ERRATUM_23154=y
+CONFIG_CAVIUM_ERRATUM_27456=y
+CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
+CONFIG_CHECKPOINT_RESTORE=y
+CONFIG_CHROME_PLATFORMS=y
+CONFIG_CLK_LS1028A_PLLDIG=y
+CONFIG_CLK_QORIQ=y
+# CONFIG_CLK_VEXPRESS_OSC is not set
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CLZ_TAB=y
+CONFIG_CMA=y
+CONFIG_CMA_ALIGNMENT=8
+CONFIG_CMA_AREAS=7
+# CONFIG_CMA_DEBUG is not set
+# CONFIG_CMA_DEBUGFS is not set
+CONFIG_CMA_SIZE_MBYTES=16
+# CONFIG_CMA_SIZE_SEL_MAX is not set
+CONFIG_CMA_SIZE_SEL_MBYTES=y
+# CONFIG_CMA_SIZE_SEL_MIN is not set
+# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
+# CONFIG_CMA_SYSFS is not set
+CONFIG_COMMON_CLK=y
+CONFIG_COMMON_CLK_CS2000_CP=y
+CONFIG_COMMON_CLK_FSL_FLEXSPI=y
+# CONFIG_COMMON_CLK_FSL_SAI is not set
+CONFIG_COMMON_CLK_XGENE=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONFIGFS_FS=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CONTIG_ALLOC=y
+CONFIG_COREDUMP=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+CONFIG_CPU_FREQ=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_THERMAL=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_IDLE_MULTIPLE_DRIVERS=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_THERMAL=y
+CONFIG_CRASH_CORE=y
+CONFIG_CRC16=y
+# CONFIG_CRC32_SARWATE is not set
+CONFIG_CRC32_SLICEBY8=y
+CONFIG_CRC7=y
+CONFIG_CRC_ITU_T=y
+CONFIG_CRC_T10DIF=y
+CONFIG_CROSS_MEMORY_ATTACH=y
+# CONFIG_CROS_EC is not set
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_CE=y
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
+CONFIG_CRYPTO_AUTHENC=y
+CONFIG_CRYPTO_BLAKE2B=y
+CONFIG_CRYPTO_CRC32=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_CRCT10DIF=y
+CONFIG_CRYPTO_CRCT10DIF_ARM64_CE=y
+CONFIG_CRYPTO_CRYPTD=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_DES=y
+CONFIG_CRYPTO_DEV_FSL_CAAM=y
+CONFIG_CRYPTO_DEV_FSL_CAAM_AHASH_API=y
+CONFIG_CRYPTO_DEV_FSL_CAAM_AHASH_API_DESC=y
+CONFIG_CRYPTO_DEV_FSL_CAAM_COMMON=y
+CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API=y
+CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API_DESC=y
+CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API_QI=y
+# CONFIG_CRYPTO_DEV_FSL_CAAM_DEBUG is not set
+# CONFIG_CRYPTO_DEV_FSL_CAAM_INTC is not set
+CONFIG_CRYPTO_DEV_FSL_CAAM_JR=y
+CONFIG_CRYPTO_DEV_FSL_CAAM_PKC_API=y
+CONFIG_CRYPTO_DEV_FSL_CAAM_RINGSIZE=9
+CONFIG_CRYPTO_DEV_FSL_CAAM_RNG_API=y
+CONFIG_CRYPTO_DEV_FSL_DPAA2_CAAM=y
+CONFIG_CRYPTO_ECB=y
+CONFIG_CRYPTO_ENGINE=y
+CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_HW=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_DES=y
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_RSA=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA256_ARM64=y
+CONFIG_CRYPTO_SHA2_ARM64_CE=y
+CONFIG_CRYPTO_SIMD=y
+CONFIG_CRYPTO_XTS=y
+CONFIG_CRYPTO_XXHASH=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_DECOMPRESS_BZIP2=y
+CONFIG_DECOMPRESS_GZIP=y
+CONFIG_DECOMPRESS_LZMA=y
+CONFIG_DECOMPRESS_LZO=y
+CONFIG_DECOMPRESS_XZ=y
+CONFIG_DETECT_HUNG_TASK=y
+CONFIG_DIMLIB=y
+CONFIG_DMADEVICES=y
+CONFIG_DMATEST=y
+CONFIG_DMA_CMA=y
+CONFIG_DMA_DIRECT_REMAP=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_ENGINE_RAID=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_OPS=y
+CONFIG_DMA_REMAP=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DMA_VIRTUAL_CHANNELS=y
+CONFIG_DNOTIFY=y
+CONFIG_DPAA2_CONSOLE=y
+CONFIG_DPAA_ERRATUM_A050385=y
+CONFIG_DTC=y
+CONFIG_DT_IDLE_STATES=y
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EEPROM_AT24=y
+CONFIG_ELF_CORE=y
+# CONFIG_EMBEDDED is not set
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_EXTCON=y
+CONFIG_EXTCON_USB_GPIO=y
+CONFIG_F2FS_FS=y
+CONFIG_FAILOVER=y
+CONFIG_FANOTIFY=y
+CONFIG_FAT_FS=y
+CONFIG_FB=y
+CONFIG_FB_ARMCLCD=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+CONFIG_FB_CMDLINE=y
+CONFIG_FB_DEFERRED_IO=y
+CONFIG_FB_MODE_HELPERS=y
+CONFIG_FB_SYS_COPYAREA=y
+CONFIG_FB_SYS_FILLRECT=y
+CONFIG_FB_SYS_FOPS=y
+CONFIG_FB_SYS_IMAGEBLIT=y
+CONFIG_FHANDLE=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FONT_8x16=y
+CONFIG_FONT_8x8=y
+CONFIG_FONT_SUPPORT=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y
+# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
+CONFIG_FRAME_POINTER=y
+CONFIG_FREEZER=y
+# CONFIG_FSL_BMAN_TEST is not set
+CONFIG_FSL_DPAA=y
+CONFIG_FSL_DPAA2_ETH=y
+CONFIG_FSL_DPAA2_PTP_CLOCK=y
+# CONFIG_FSL_DPAA2_QDMA is not set
+# CONFIG_FSL_DPAA2_SWITCH is not set
+# CONFIG_FSL_DPAA_CHECKING is not set
+CONFIG_FSL_DPAA_ETH=y
+CONFIG_FSL_EDMA=y
+CONFIG_FSL_ENETC=y
+CONFIG_FSL_ENETC_IERB=y
+CONFIG_FSL_ENETC_MDIO=y
+CONFIG_FSL_ENETC_PTP_CLOCK=y
+CONFIG_FSL_ENETC_VF=y
+CONFIG_FSL_ERRATUM_A008585=y
+CONFIG_FSL_FMAN=y
+CONFIG_FSL_GUTS=y
+CONFIG_FSL_IFC=y
+CONFIG_FSL_MC_BUS=y
+CONFIG_FSL_MC_DPIO=y
+CONFIG_FSL_MC_UAPI_SUPPORT=y
+# CONFIG_FSL_PPFE is not set
+# CONFIG_FSL_PPFE_UTIL_DISABLED is not set
+# CONFIG_FSL_QMAN_TEST is not set
+CONFIG_FSL_RCPM=y
+CONFIG_FSL_XGMAC_MDIO=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FS_POSIX_ACL=y
+CONFIG_FUSE_FS=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CACHE=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+# CONFIG_FW_LOADER_USER_HELPER_FALLBACK is not set
+CONFIG_GARP=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ARCH_NUMA=y
+CONFIG_GENERIC_ARCH_TOPOLOGY=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_CSUM=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_MSI_IRQ=y
+CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+# CONFIG_GIANFAR is not set
+CONFIG_GLOB=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_GPIO_MPC8XXX=y
+CONFIG_GPIO_PCA953X=y
+CONFIG_GPIO_PCA953X_IRQ=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HIBERNATE_CALLBACKS=y
+CONFIG_HIBERNATION=y
+CONFIG_HIBERNATION_SNAPSHOT_DEV=y
+CONFIG_HID=y
+CONFIG_HID_A4TECH=y
+CONFIG_HID_APPLE=y
+CONFIG_HID_BELKIN=y
+CONFIG_HID_CHERRY=y
+CONFIG_HID_CYPRESS=y
+CONFIG_HID_EZKEY=y
+CONFIG_HID_GENERIC=y
+CONFIG_HID_KENSINGTON=y
+CONFIG_HID_MICROSOFT=y
+CONFIG_HID_MONTEREY=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HUGETLBFS=y
+CONFIG_HUGETLB_PAGE=y
+CONFIG_HVC_DRIVER=y
+CONFIG_HVC_IRQ=y
+CONFIG_HVC_XEN=y
+CONFIG_HVC_XEN_FRONTEND=y
+CONFIG_HW_CONSOLE=y
+CONFIG_HW_RANDOM=y
+CONFIG_I2C=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_COMPAT=y
+CONFIG_I2C_DESIGNWARE_CORE=y
+CONFIG_I2C_DESIGNWARE_PLATFORM=y
+CONFIG_I2C_HELPER_AUTO=y
+CONFIG_I2C_IMX=y
+CONFIG_I2C_MUX=y
+CONFIG_I2C_MUX_PCA954x=y
+CONFIG_I2C_RK3X=y
+CONFIG_I2C_SLAVE=y
+# CONFIG_I2C_SLAVE_TESTUNIT is not set
+CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
+CONFIG_IMX2_WDT=y
+CONFIG_INET_DIAG=y
+# CONFIG_INET_DIAG_DESTROY is not set
+# CONFIG_INET_RAW_DIAG is not set
+CONFIG_INET_TCP_DIAG=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_INPUT=y
+CONFIG_INPUT_EVDEV=y
+CONFIG_INPUT_FF_MEMLESS=y
+CONFIG_INPUT_KEYBOARD=y
+CONFIG_INPUT_MOUSE=y
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_MOUSEDEV_PSAUX=y
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+CONFIG_INPUT_XEN_KBDDEV_FRONTEND=y
+CONFIG_INTERVAL_TREE=y
+CONFIG_IOMMU_API=y
+# CONFIG_IOMMU_DEBUGFS is not set
+CONFIG_IOMMU_DEFAULT_PASSTHROUGH=y
+CONFIG_IOMMU_DMA=y
+CONFIG_IOMMU_IOVA=y
+CONFIG_IOMMU_IO_PGTABLE=y
+# CONFIG_IOMMU_IO_PGTABLE_ARMV7S is not set
+CONFIG_IOMMU_IO_PGTABLE_LPAE=y
+# CONFIG_IOMMU_IO_PGTABLE_LPAE_SELFTEST is not set
+CONFIG_IOMMU_SUPPORT=y
+CONFIG_IPC_NS=y
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_BYPASS_MANAGER=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MSI_IOMMU=y
+CONFIG_IRQ_WORK=y
+# CONFIG_ISDN is not set
+CONFIG_JBD2=y
+CONFIG_JUMP_LABEL=y
+CONFIG_KALLSYMS=y
+CONFIG_KALLSYMS_ALL=y
+CONFIG_KCMP=y
+CONFIG_KEXEC=y
+CONFIG_KEXEC_CORE=y
+CONFIG_KEYBOARD_ATKBD=y
+CONFIG_KEYBOARD_GPIO=y
+CONFIG_KSM=y
+CONFIG_LIBCRC32C=y
+CONFIG_LIBFDT=y
+CONFIG_LOCALVERSION_AUTO=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_LOGO=y
+CONFIG_LOGO_LINUX_CLUT224=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_LS_EXTIRQ=y
+CONFIG_LS_SCFG_MSI=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MDIO_BITBANG=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_BUS_MUX=y
+CONFIG_MDIO_BUS_MUX_MMIOREG=y
+CONFIG_MDIO_BUS_MUX_MULTIPLEXER=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+# CONFIG_MDIO_GPIO is not set
+CONFIG_MEMFD_CREATE=y
+CONFIG_MEMORY=y
+CONFIG_MEMORY_BALLOON=y
+CONFIG_MEMORY_ISOLATION=y
+CONFIG_MEMTEST=y
+# CONFIG_MFD_HI6421_SPMI is not set
+CONFIG_MFD_SYSCON=y
+# CONFIG_MFD_VEXPRESS_SYSREG is not set
+CONFIG_MICREL_PHY=y
+CONFIG_MICROSEMI_PHY=y
+CONFIG_MIGRATION=y
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_IO_ACCESSORS=y
+CONFIG_MMC_SDHCI_OF_ESDHC=y
+# CONFIG_MMC_SDHCI_PCI is not set
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMU_NOTIFIER=y
+CONFIG_MODULES_USE_ELF_RELA=y
+CONFIG_MODULE_FORCE_LOAD=y
+CONFIG_MODVERSIONS=y
+# CONFIG_MOUSE_BCM5974 is not set
+# CONFIG_MOUSE_CYAPA is not set
+CONFIG_MOUSE_PS2=y
+CONFIG_MOUSE_PS2_ALPS=y
+CONFIG_MOUSE_PS2_BYD=y
+CONFIG_MOUSE_PS2_CYPRESS=y
+# CONFIG_MOUSE_PS2_ELANTECH is not set
+CONFIG_MOUSE_PS2_FOCALTECH=y
+CONFIG_MOUSE_PS2_LOGIPS2PP=y
+CONFIG_MOUSE_PS2_SMBUS=y
+CONFIG_MOUSE_PS2_SYNAPTICS=y
+CONFIG_MOUSE_PS2_SYNAPTICS_SMBUS=y
+# CONFIG_MOUSE_PS2_TOUCHKIT is not set
+CONFIG_MOUSE_PS2_TRACKPOINT=y
+# CONFIG_MOUSE_SERIAL is not set
+# CONFIG_MOUSE_VSXXXAA is not set
+CONFIG_MPILIB=y
+CONFIG_MRP=y
+CONFIG_MSCC_OCELOT_SWITCH_LIB=y
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+# CONFIG_MTD_CFI_GEOMETRY is not set
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_CMDLINE_PARTS=y
+# CONFIG_MTD_COMPLEX_MAPPINGS is not set
+CONFIG_MTD_DATAFLASH=y
+# CONFIG_MTD_DATAFLASH_OTP is not set
+# CONFIG_MTD_DATAFLASH_WRITE_VERIFY is not set
+CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_NAND_ECC_SW_HAMMING=y
+CONFIG_MTD_NAND_FSL_IFC=y
+CONFIG_MTD_PHYSMAP=y
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPI_NOR_USE_4K_SECTORS=y
+CONFIG_MTD_SPLIT_FIRMWARE=y
+CONFIG_MTD_SPLIT_FIT_FW=y
+CONFIG_MTD_SST25L=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_LIMIT=20
+# CONFIG_MTD_UBI_BLOCK is not set
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_MULTIPLEXER=y
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_MUX_MMIO=y
+CONFIG_MV_XOR_V2=y
+CONFIG_NAMESPACES=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y
+CONFIG_NEED_SG_DMA_LENGTH=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_MSCC_FELIX=y
+CONFIG_NET_DSA_TAG_OCELOT=y
+CONFIG_NET_DSA_TAG_OCELOT_8021Q=y
+CONFIG_NET_FAILOVER=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_NS=y
+CONFIG_NET_PTP_CLASSIFY=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NLS=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_NODES_SHIFT=2
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NR_CPUS=64
+CONFIG_NUMA=y
+CONFIG_NUMA_BALANCING=y
+CONFIG_NUMA_BALANCING_DEFAULT_ENABLED=y
+CONFIG_NVMEM=y
+# CONFIG_NVMEM_LAYERSCAPE_SFP is not set
+# CONFIG_NVMEM_SPMI_SDAM is not set
+CONFIG_NVMEM_SYSFS=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IOMMU=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_OF_NUMA=y
+CONFIG_PACKET_DIAG=y
+CONFIG_PADATA=y
+CONFIG_PAGE_POOL=y
+CONFIG_PAGE_REPORTING=y
+# CONFIG_PANIC_ON_OOPS is not set
+CONFIG_PANIC_ON_OOPS_VALUE=0
+CONFIG_PANIC_TIMEOUT=0
+CONFIG_PARAVIRT=y
+# CONFIG_PARTITION_ADVANCED is not set
+CONFIG_PARTITION_PERCPU=y
+CONFIG_PCI=y
+CONFIG_PCIEAER=y
+CONFIG_PCIEASPM=y
+CONFIG_PCIEASPM_DEFAULT=y
+# CONFIG_PCIEASPM_PERFORMANCE is not set
+# CONFIG_PCIEASPM_POWERSAVE is not set
+# CONFIG_PCIEASPM_POWER_SUPERSAVE is not set
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_DW=y
+CONFIG_PCIE_DW_HOST=y
+CONFIG_PCIE_LAYERSCAPE_GEN4=y
+CONFIG_PCIE_MOBIVEIL=y
+CONFIG_PCIE_MOBIVEIL_HOST=y
+CONFIG_PCIE_PME=y
+CONFIG_PCI_ATS=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PCI_ECAM=y
+CONFIG_PCI_HISI=y
+CONFIG_PCI_HOST_COMMON=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCI_IOV=y
+CONFIG_PCI_LAYERSCAPE=y
+CONFIG_PCI_MSI=y
+CONFIG_PCI_MSI_IRQ_DOMAIN=y
+CONFIG_PCS_LYNX=y
+CONFIG_PGTABLE_LEVELS=4
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PHYS_ADDR_T_64BIT=y
+CONFIG_PHY_XGENE=y
+CONFIG_PID_IN_CONTEXTIDR=y
+CONFIG_PID_NS=y
+CONFIG_PL330_DMA=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_OPP=y
+CONFIG_PM_SLEEP=y
+CONFIG_PM_SLEEP_SMP=y
+CONFIG_PM_STD_PARTITION=""
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_POWER_RESET_VEXPRESS=y
+CONFIG_POWER_RESET_XGENE=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PPS=y
+CONFIG_PREEMPT=y
+CONFIG_PREEMPTION=y
+CONFIG_PREEMPT_COUNT=y
+# CONFIG_PREEMPT_NONE is not set
+CONFIG_PREEMPT_RCU=y
+CONFIG_PRINTK_TIME=y
+CONFIG_PRINT_QUOTA_WARNING=y
+CONFIG_PROC_CHILDREN=y
+CONFIG_PROFILING=y
+CONFIG_PTP_1588_CLOCK=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_PTP_1588_CLOCK_QORIQ=y
+CONFIG_QCOM_HIDMA=y
+CONFIG_QCOM_HIDMA_MGMT=y
+CONFIG_QCOM_QDF2400_ERRATUM_0065=y
+# CONFIG_QFMT_V2 is not set
+CONFIG_QORIQ_CPUFREQ=y
+CONFIG_QORIQ_THERMAL=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_QUOTA=y
+CONFIG_QUOTACTL=y
+CONFIG_RAID6_PQ=y
+CONFIG_RAS=y
+CONFIG_RATIONAL=y
+CONFIG_RD_BZIP2=y
+CONFIG_RD_GZIP=y
+CONFIG_RD_LZMA=y
+CONFIG_RD_LZO=y
+CONFIG_RD_XZ=y
+CONFIG_REALTEK_PHY=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGMAP_SPI=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RODATA_FULL_DEFAULT_ENABLED=y
+CONFIG_RPS=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_DS1307=y
+CONFIG_RTC_DRV_DS3232=y
+CONFIG_RTC_DRV_FSL_FTM_ALARM=y
+CONFIG_RTC_DRV_PCF2127=y
+CONFIG_RTC_DRV_PL031=y
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+CONFIG_SCHED_INFO=y
+CONFIG_SCHED_MC=y
+CONFIG_SCHED_THERMAL_PRESSURE=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+# CONFIG_SCSI_PROC_FS is not set
+# CONFIG_SCSI_SAS_ATA is not set
+CONFIG_SCSI_SAS_ATTRS=y
+CONFIG_SCSI_SAS_HOST_SMP=y
+CONFIG_SCSI_SAS_LIBSAS=y
+CONFIG_SECCOMP=y
+CONFIG_SECCOMP_FILTER=y
+CONFIG_SECRETMEM=y
+CONFIG_SERIAL_8250_DEPRECATED_OPTIONS=y
+CONFIG_SERIAL_8250_DW=y
+CONFIG_SERIAL_8250_DWLIB=y
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_FSL=y
+CONFIG_SERIAL_8250_NR_UARTS=4
+CONFIG_SERIAL_8250_PCI=y
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_FSL_LPUART=y
+CONFIG_SERIAL_FSL_LPUART_CONSOLE=y
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_SC16IS7XX=y
+CONFIG_SERIAL_SC16IS7XX_CORE=y
+# CONFIG_SERIAL_SC16IS7XX_I2C is not set
+CONFIG_SERIAL_SC16IS7XX_SPI=y
+CONFIG_SERIAL_XILINX_PS_UART=y
+CONFIG_SERIAL_XILINX_PS_UART_CONSOLE=y
+CONFIG_SERIO=y
+CONFIG_SERIO_AMBAKMI=y
+CONFIG_SERIO_LIBPS2=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SG_POOL=y
+CONFIG_SLAB=y
+# CONFIG_SLUB is not set
+CONFIG_SMP=y
+CONFIG_SOCK_DIAG=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOC_BUS=y
+CONFIG_SPARSEMEM=y
+CONFIG_SPARSEMEM_EXTREME=y
+CONFIG_SPARSEMEM_VMEMMAP=y
+CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SPI=y
+CONFIG_SPI_FSL_DSPI=y
+CONFIG_SPI_FSL_QUADSPI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SPI_NXP_FLEXSPI=y
+CONFIG_SPI_PL022=y
+CONFIG_SPMI=y
+# CONFIG_SPMI_HISI3670 is not set
+# CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU is not set
+CONFIG_SQUASHFS_DECOMP_SINGLE=y
+CONFIG_SQUASHFS_FILE_CACHE=y
+# CONFIG_SQUASHFS_FILE_DIRECT is not set
+# CONFIG_SQUASHFS_XZ is not set
+CONFIG_SQUASHFS_ZLIB=y
+CONFIG_SRAM=y
+CONFIG_SRCU=y
+# CONFIG_STRIP_ASM_SYMS is not set
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+CONFIG_SWIOTLB=y
+CONFIG_SWIOTLB_XEN=y
+CONFIG_SWPHY=y
+CONFIG_SYNC_FILE=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYSFS_SYSCALL=y
+CONFIG_SYS_HYPERVISOR=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_TASK_XACCT=y
+CONFIG_THERMAL=y
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_EMULATION=y
+CONFIG_THERMAL_GOV_STEP_WISE=y
+CONFIG_THERMAL_OF=y
+CONFIG_THREAD_INFO_IN_TASK=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y
+CONFIG_TRANSPARENT_HUGEPAGE=y
+CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y
+# CONFIG_TRANSPARENT_HUGEPAGE_MADVISE is not set
+CONFIG_TRANS_TABLE=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+# CONFIG_UACCE is not set
+CONFIG_UBIFS_FS=y
+# CONFIG_UCLAMP_TASK is not set
+CONFIG_UIO=y
+CONFIG_UIO_AEC=y
+CONFIG_UIO_CIF=y
+CONFIG_UIO_DMEM_GENIRQ=y
+CONFIG_UIO_MF624=y
+CONFIG_UIO_NETX=y
+CONFIG_UIO_PCI_GENERIC=y
+CONFIG_UIO_PDRV_GENIRQ=y
+# CONFIG_UIO_PRUSS is not set
+CONFIG_UIO_SERCOS3=y
+CONFIG_UNINLINE_SPIN_UNLOCK=y
+CONFIG_UNIX_DIAG=y
+CONFIG_UNMAP_KERNEL_AT_EL0=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USER_NS=y
+CONFIG_USE_PERCPU_NUMA_NODE_ID=y
+CONFIG_UTS_NS=y
+CONFIG_VEXPRESS_CONFIG=y
+CONFIG_VFAT_FS=y
+CONFIG_VFIO=y
+CONFIG_VFIO_FSL_MC=y
+CONFIG_VFIO_IOMMU_TYPE1=y
+# CONFIG_VFIO_MDEV is not set
+# CONFIG_VFIO_NOIOMMU is not set
+CONFIG_VFIO_PCI=y
+CONFIG_VFIO_PCI_CORE=y
+CONFIG_VFIO_PCI_INTX=y
+CONFIG_VFIO_PCI_MMAP=y
+# CONFIG_VFIO_PLATFORM is not set
+CONFIG_VFIO_VIRQFD=y
+CONFIG_VGA_ARB=y
+CONFIG_VGA_ARB_MAX_GPUS=16
+CONFIG_VIDEOMODE_HELPERS=y
+CONFIG_VIRTIO=y
+CONFIG_VIRTIO_BALLOON=y
+CONFIG_VIRTIO_BLK=y
+CONFIG_VIRTIO_CONSOLE=y
+CONFIG_VIRTIO_MMIO=y
+CONFIG_VIRTIO_NET=y
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_PCI_LEGACY=y
+CONFIG_VIRTIO_PCI_LIB=y
+CONFIG_VITESSE_PHY=y
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_VLAN_8021Q_MVRP=y
+CONFIG_VMAP_STACK=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_CONSOLE_SLEEP=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_WATCHDOG_CORE=y
+# CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set
+CONFIG_XARRAY_MULTI=y
+CONFIG_XEN=y
+CONFIG_XENFS=y
+CONFIG_XEN_AUTO_XLATE=y
+CONFIG_XEN_BACKEND=y
+CONFIG_XEN_BALLOON=y
+# CONFIG_XEN_BLKDEV_BACKEND is not set
+CONFIG_XEN_BLKDEV_FRONTEND=y
+CONFIG_XEN_COMPAT_XENFS=y
+CONFIG_XEN_DEV_EVTCHN=y
+CONFIG_XEN_DOM0=y
+CONFIG_XEN_FBDEV_FRONTEND=y
+CONFIG_XEN_GNTDEV=y
+CONFIG_XEN_GRANT_DEV_ALLOC=y
+# CONFIG_XEN_NETDEV_BACKEND is not set
+CONFIG_XEN_NETDEV_FRONTEND=y
+CONFIG_XEN_PRIVCMD=y
+# CONFIG_XEN_PVCALLS_BACKEND is not set
+# CONFIG_XEN_SCSI_FRONTEND is not set
+CONFIG_XEN_SYS_HYPERVISOR=y
+# CONFIG_XEN_WDT is not set
+CONFIG_XEN_XENBUS_FRONTEND=y
+CONFIG_XFS_FS=y
+CONFIG_XFS_POSIX_ACL=y
+CONFIG_XFS_RT=y
+CONFIG_XOR_BLOCKS=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_XZ_DEC_ARM=y
+CONFIG_XZ_DEC_ARMTHUMB=y
+CONFIG_XZ_DEC_BCJ=y
+CONFIG_XZ_DEC_IA64=y
+CONFIG_XZ_DEC_POWERPC=y
+CONFIG_XZ_DEC_SPARC=y
+CONFIG_XZ_DEC_X86=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZONE_DMA32=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/layerscape/base-files/etc/board.d/02_network b/target/linux/layerscape/base-files/etc/board.d/02_network
index b46f0b06215cb7..172172c12c6760 100644
--- a/target/linux/layerscape/base-files/etc/board.d/02_network
+++ b/target/linux/layerscape/base-files/etc/board.d/02_network
@@ -5,6 +5,10 @@
 board_config_update
 
 case "$(board_name)" in
+	fsl,ls1028a-rdb|\
+	fsl,ls1028a-rdb-sdboot)
+		ucidef_set_interfaces_lan_wan "swp0 swp1 swp2 swp3" "eth0"
+		;;
 	traverse,ls1043v)
 		ucidef_set_interface_lan "eth0 eth1 eth2 eth3"
 		ucidef_set_interface_wan "eth4"
diff --git a/target/linux/layerscape/base-files/lib/preinit/79_move_config b/target/linux/layerscape/base-files/lib/preinit/79_move_config
index 901a289b66f6fb..5519e059d9d75b 100644
--- a/target/linux/layerscape/base-files/lib/preinit/79_move_config
+++ b/target/linux/layerscape/base-files/lib/preinit/79_move_config
@@ -10,6 +10,7 @@ move_config() {
 	fsl,ls1012a-frwy-sdboot | \
 	fsl,ls1021a-iot-sdboot | \
 	fsl,ls1021a-twr-sdboot | \
+	fsl,ls1028a-rdb-sdboot | \
 	fsl,ls1043a-rdb-sdboot | \
 	fsl,ls1046a-frwy-sdboot | \
 	fsl,ls1046a-rdb-sdboot | \
diff --git a/target/linux/layerscape/base-files/lib/upgrade/platform.sh b/target/linux/layerscape/base-files/lib/upgrade/platform.sh
index 857be5a744b3c3..e88dfdf145c9d4 100644
--- a/target/linux/layerscape/base-files/lib/upgrade/platform.sh
+++ b/target/linux/layerscape/base-files/lib/upgrade/platform.sh
@@ -71,6 +71,7 @@ platform_copy_config() {
 	fsl,ls1012a-frwy-sdboot | \
 	fsl,ls1021a-iot-sdboot | \
 	fsl,ls1021a-twr-sdboot | \
+	fsl,ls1028a-rdb-sdboot | \
 	fsl,ls1043a-rdb-sdboot | \
 	fsl,ls1046a-frwy-sdboot | \
 	fsl,ls1046a-rdb-sdboot | \
@@ -95,6 +96,8 @@ platform_check_image() {
 	fsl,ls1021a-iot-sdboot | \
 	fsl,ls1021a-twr | \
 	fsl,ls1021a-twr-sdboot | \
+	fsl,ls1028a-rdb | \
+	fsl,ls1028a-rdb-sdboot | \
 	fsl,ls1043a-rdb | \
 	fsl,ls1043a-rdb-sdboot | \
 	fsl,ls1046a-frwy | \
@@ -130,6 +133,7 @@ platform_do_upgrade() {
 	fsl,ls1012a-frdm | \
 	fsl,ls1012a-rdb | \
 	fsl,ls1021a-twr | \
+	fsl,ls1028a-rdb | \
 	fsl,ls1043a-rdb | \
 	fsl,ls1046a-frwy | \
 	fsl,ls1046a-rdb | \
@@ -142,6 +146,7 @@ platform_do_upgrade() {
 	fsl,ls1012a-frwy-sdboot | \
 	fsl,ls1021a-iot-sdboot | \
 	fsl,ls1021a-twr-sdboot | \
+	fsl,ls1028a-rdb-sdboot | \
 	fsl,ls1043a-rdb-sdboot | \
 	fsl,ls1046a-frwy-sdboot | \
 	fsl,ls1046a-rdb-sdboot | \
diff --git a/target/linux/layerscape/image/armv8_64b.mk b/target/linux/layerscape/image/armv8_64b.mk
index 72b6c58f838be1..f5a6a055fb20a5 100644
--- a/target/linux/layerscape/image/armv8_64b.mk
+++ b/target/linux/layerscape/image/armv8_64b.mk
@@ -8,11 +8,7 @@ define Device/Default
   FILESYSTEMS := squashfs
   KERNEL := kernel-bin | gzip | uImage gzip
   KERNEL_INITRAMFS = kernel-bin | gzip | fit gzip $$(DTS_DIR)/$$(DEVICE_DTS).dtb
-ifdef CONFIG_LINUX_5_4
-  KERNEL_LOADADDR := 0x80080000
-else
   KERNEL_LOADADDR := 0x80000000
-endif
   DEVICE_DTS = freescale/$(subst _,-,$(1))
   IMAGE_SIZE := 64m
   IMAGE/sysupgrade.bin = \
@@ -33,7 +29,7 @@ define Device/fsl_ls1012a-frdm
   DEVICE_MODEL := FRDM-LS1012A
   DEVICE_PACKAGES += \
     layerscape-ppfe \
-    tfa-ls1012a-frdm \
+    trusted-firmware-a-ls1012a-frdm \
     kmod-ppfe
   BLOCKSIZE := 256KiB
   IMAGE/firmware.bin := \
@@ -50,7 +46,6 @@ define Device/fsl_ls1012a-frdm
     append-rootfs | pad-rootfs | \
     check-size $(LS_SYSUPGRADE_IMAGE_SIZE) | append-metadata
   KERNEL := kernel-bin | gzip | fit gzip $$(DTS_DIR)/$$(DEVICE_DTS).dtb
-  KERNEL_INITRAMFS := kernel-bin | fit none $$(DTS_DIR)/$$(DEVICE_DTS).dtb
 endef
 TARGET_DEVICES += fsl_ls1012a-frdm
 
@@ -60,7 +55,7 @@ define Device/fsl_ls1012a-rdb
   DEVICE_MODEL := LS1012A-RDB
   DEVICE_PACKAGES += \
     layerscape-ppfe \
-    tfa-ls1012a-rdb \
+    trusted-firmware-a-ls1012a-rdb \
     kmod-hwmon-ina2xx \
     kmod-iio-fxas21002c-i2c \
     kmod-iio-fxos8700-i2c \
@@ -84,7 +79,7 @@ define Device/fsl_ls1012a-frwy-sdboot
   DEVICE_MODEL := FRWY-LS1012A
   DEVICE_PACKAGES += \
     layerscape-ppfe \
-    tfa-ls1012a-frwy-sdboot \
+    trusted-firmware-a-ls1012a-frwy-sdboot \
     kmod-ppfe
   DEVICE_DTS := freescale/fsl-ls1012a-frwy
   IMAGES += firmware.bin
@@ -103,6 +98,53 @@ define Device/fsl_ls1012a-frwy-sdboot
 endef
 TARGET_DEVICES += fsl_ls1012a-frwy-sdboot
 
+define Device/fsl_ls1028a-rdb
+  DEVICE_VENDOR := NXP
+  DEVICE_MODEL := LS1028A-RDB
+  DEVICE_VARIANT := Default
+  DEVICE_DTS := freescale/fsl-ls1028a-rdb
+  KERNEL = kernel-bin | gzip | fit gzip $$(DTS_DIR)/$$(DEVICE_DTS).dtb
+  DEVICE_PACKAGES += \
+    trusted-firmware-a-ls1028a-rdb \
+    kmod-hwmon-ina2xx \
+    kmod-hwmon-lm90 \
+    kmod-rtc-pcf2127
+  IMAGE/firmware.bin := \
+    ls-clean | \
+    ls-append $(1)-bl2.pbl | pad-to 1M | \
+    ls-append $(1)-fip.bin | pad-to 5M | \
+    ls-append $(1)-uboot-env.bin | pad-to 16M | \
+    append-kernel | \
+    append-rootfs | pad-rootfs | check-size
+  IMAGE/sysupgrade.bin := \
+    append-kernel | \
+    append-rootfs | pad-rootfs | \
+    check-size $(LS_SYSUPGRADE_IMAGE_SIZE) | append-metadata
+endef
+TARGET_DEVICES += fsl_ls1028a-rdb
+
+define Device/fsl_ls1028a-rdb-sdboot
+  $(Device/fsl-sdboot)
+  DEVICE_VENDOR := NXP
+  DEVICE_MODEL := LS1028A-RDB
+  DEVICE_VARIANT := SD Card Boot
+  DEVICE_DTS := freescale/fsl-ls1028a-rdb
+  DEVICE_PACKAGES += \
+    trusted-firmware-a-ls1028a-rdb-sdboot \
+    kmod-hwmon-ina2xx \
+    kmod-hwmon-lm90 \
+    kmod-rtc-pcf2127
+  IMAGE/sdcard.img.gz := \
+    ls-clean | \
+    ls-append-sdhead $(1) | pad-to 4K | \
+    ls-append $(1)-bl2.pbl | pad-to 1M | \
+    ls-append $(1)-fip.bin | pad-to 5M | \
+    ls-append $(1)-uboot-env.bin | pad-to 16M | \
+    ls-append-kernel | pad-to $(LS_SD_ROOTFSPART_OFFSET)M | \
+    append-rootfs | pad-to $(LS_SD_IMAGE_SIZE)M | gzip
+endef
+TARGET_DEVICES += fsl_ls1028a-rdb-sdboot
+
 define Device/fsl_ls1043a-rdb
   $(Device/fix-sysupgrade)
   DEVICE_VENDOR := NXP
@@ -110,16 +152,12 @@ define Device/fsl_ls1043a-rdb
   DEVICE_VARIANT := Default
   DEVICE_PACKAGES += \
     layerscape-fman \
-    tfa-ls1043a-rdb \
+    trusted-firmware-a-ls1043a-rdb \
     fmc fmc-eth-config \
     kmod-ahci-qoriq \
     kmod-hwmon-ina2xx \
     kmod-hwmon-lm90
-ifdef CONFIG_LINUX_5_4
-  DEVICE_DTS := freescale/fsl-ls1043a-rdb-sdk
-else
   DEVICE_DTS := freescale/fsl-ls1043a-rdb
-endif
   IMAGE/firmware.bin := \
     ls-clean | \
     ls-append $(1)-bl2.pbl | pad-to 1M | \
@@ -140,16 +178,12 @@ define Device/fsl_ls1043a-rdb-sdboot
   DEVICE_VARIANT := SD Card Boot
   DEVICE_PACKAGES += \
     layerscape-fman \
-    tfa-ls1043a-rdb-sdboot \
+    trusted-firmware-a-ls1043a-rdb-sdboot \
     fmc fmc-eth-config \
     kmod-ahci-qoriq \
     kmod-hwmon-ina2xx \
     kmod-hwmon-lm90
-ifdef CONFIG_LINUX_5_4
-  DEVICE_DTS := freescale/fsl-ls1043a-rdb-sdk
-else
   DEVICE_DTS := freescale/fsl-ls1043a-rdb
-endif
   IMAGE/sdcard.img.gz := \
     ls-clean | \
     ls-append-sdhead $(1) | pad-to 4K | \
@@ -168,12 +202,8 @@ define Device/fsl_ls1046a-frwy
   DEVICE_VARIANT := Default
   DEVICE_PACKAGES += \
     layerscape-fman \
-    tfa-ls1046a-frwy
-ifdef CONFIG_LINUX_5_4
-  DEVICE_DTS := freescale/fsl-ls1046a-frwy-sdk
-else
+    trusted-firmware-a-ls1046a-frwy
   DEVICE_DTS := freescale/fsl-ls1046a-frwy
-endif
   IMAGE/firmware.bin := \
     ls-clean | \
     ls-append $(1)-bl2.pbl | pad-to 1M | \
@@ -193,12 +223,8 @@ define Device/fsl_ls1046a-frwy-sdboot
   DEVICE_VARIANT := SD Card Boot
   DEVICE_PACKAGES += \
     layerscape-fman \
-    tfa-ls1046a-frwy-sdboot
-ifdef CONFIG_LINUX_5_4
-  DEVICE_DTS := freescale/fsl-ls1046a-frwy-sdk
-else
+    trusted-firmware-a-ls1046a-frwy-sdboot
   DEVICE_DTS := freescale/fsl-ls1046a-frwy
-endif
   IMAGE/sdcard.img.gz := \
     ls-clean | \
     ls-append-sdhead $(1) | pad-to 4K | \
@@ -218,16 +244,12 @@ define Device/fsl_ls1046a-rdb
   DEVICE_VARIANT := Default
   DEVICE_PACKAGES += \
     layerscape-fman \
-    tfa-ls1046a-rdb \
+    trusted-firmware-a-ls1046a-rdb \
     fmc fmc-eth-config \
     kmod-ahci-qoriq \
     kmod-hwmon-ina2xx \
     kmod-hwmon-lm90
-ifdef CONFIG_LINUX_5_4
-  DEVICE_DTS := freescale/fsl-ls1046a-rdb-sdk
-else
   DEVICE_DTS := freescale/fsl-ls1046a-rdb
-endif
   IMAGE/firmware.bin := \
     ls-clean | \
     ls-append $(1)-bl2.pbl | pad-to 1M | \
@@ -248,16 +270,12 @@ define Device/fsl_ls1046a-rdb-sdboot
   DEVICE_VARIANT := SD Card Boot
   DEVICE_PACKAGES += \
     layerscape-fman \
-    tfa-ls1046a-rdb-sdboot \
+    trusted-firmware-a-ls1046a-rdb-sdboot \
     fmc fmc-eth-config \
     kmod-ahci-qoriq \
     kmod-hwmon-ina2xx \
     kmod-hwmon-lm90
-ifdef CONFIG_LINUX_5_4
-  DEVICE_DTS := freescale/fsl-ls1046a-rdb-sdk
-else
   DEVICE_DTS := freescale/fsl-ls1046a-rdb
-endif
   IMAGE/sdcard.img.gz := \
     ls-clean | \
     ls-append-sdhead $(1) | pad-to 4K | \
@@ -278,7 +296,7 @@ define Device/fsl_ls1088a-rdb
   DEVICE_PACKAGES += \
     layerscape-mc \
     layerscape-dpl \
-    tfa-ls1088a-rdb \
+    trusted-firmware-a-ls1088a-rdb \
     restool \
     kmod-ahci-qoriq \
     kmod-hwmon-ina2xx \
@@ -306,7 +324,7 @@ define Device/fsl_ls1088a-rdb-sdboot
   DEVICE_PACKAGES += \
     layerscape-mc \
     layerscape-dpl \
-    tfa-ls1088a-rdb-sdboot \
+    trusted-firmware-a-ls1088a-rdb-sdboot \
     restool \
     kmod-ahci-qoriq \
     kmod-hwmon-ina2xx \
@@ -333,7 +351,7 @@ define Device/fsl_ls2088a-rdb
   DEVICE_PACKAGES += \
     layerscape-mc \
     layerscape-dpl \
-    tfa-ls2088a-rdb \
+    trusted-firmware-a-ls2088a-rdb \
     restool \
     kmod-ahci-qoriq
   IMAGE/firmware.bin := \
@@ -358,7 +376,7 @@ define Device/fsl_lx2160a-rdb
     layerscape-mc \
     layerscape-dpl \
     layerscape-ddr-phy \
-    tfa-lx2160a-rdb \
+    trusted-firmware-a-lx2160a-rdb \
     restool
   IMAGE/firmware.bin := \
     ls-clean | \
@@ -384,7 +402,7 @@ define Device/fsl_lx2160a-rdb-sdboot
     layerscape-mc \
     layerscape-dpl \
     layerscape-ddr-phy \
-    tfa-lx2160a-rdb-sdboot \
+    trusted-firmware-a-lx2160a-rdb-sdboot \
     restool
   DEVICE_DTS := freescale/fsl-lx2160a-rdb
   IMAGE/sdcard.img.gz := \
diff --git a/target/linux/layerscape/modules.mk b/target/linux/layerscape/modules.mk
index 11e75ee7499a38..9aa11e08fb51ae 100644
--- a/target/linux/layerscape/modules.mk
+++ b/target/linux/layerscape/modules.mk
@@ -22,7 +22,7 @@ define KernelPackage/ppfe
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=Freescale PPFE Driver support
   DEPENDS:=@TARGET_layerscape
-  KCONFIG:=CONFIG_FSL_PPFE=y \
+  KCONFIG:=CONFIG_FSL_PPFE \
   	CONFIG_FSL_PPFE_UTIL_DISABLED=y
   FILES:=$(LINUX_DIR)/drivers/staging/fsl_ppfe/pfe.ko
   AUTOLOAD:=$(call AutoLoad,35,pfe)
diff --git a/target/linux/layerscape/patches-5.15/300-add-DTS-for-Traverse-LS1043-Boards.patch b/target/linux/layerscape/patches-5.15/300-add-DTS-for-Traverse-LS1043-Boards.patch
new file mode 100644
index 00000000000000..110afedefd51c0
--- /dev/null
+++ b/target/linux/layerscape/patches-5.15/300-add-DTS-for-Traverse-LS1043-Boards.patch
@@ -0,0 +1,26 @@
+From 5b35aae22b4ca2400e49561c9267aa01346f91d4 Mon Sep 17 00:00:00 2001
+From: Mathew McBride <matt@traverse.com.au>
+Date: Tue, 17 Apr 2018 10:01:03 +1000
+Subject: [PATCH] add DTS for Traverse LS1043 Boards
+
+Signed-off-by: Mathew McBride <matt@traverse.com.au>
+[rebase]
+Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
+---
+ arch/arm64/boot/dts/freescale/Makefile             |  3 +++
+ arch/arm64/boot/dts/freescale/traverse-ls1043s.dts | 29 ++++++++++++++++++++++
+ arch/arm64/boot/dts/freescale/traverse-ls1043v.dts | 29 ++++++++++++++++++++++
+ 3 files changed, 61 insertions(+)
+
+--- a/arch/arm64/boot/dts/freescale/Makefile
++++ b/arch/arm64/boot/dts/freescale/Makefile
+@@ -31,6 +31,9 @@ dtb-$(CONFIG_ARCH_LAYERSCAPE) += fsl-lx2
+ dtb-$(CONFIG_ARCH_LAYERSCAPE) += fsl-lx2160a-rdb.dtb
+ dtb-$(CONFIG_ARCH_LAYERSCAPE) += fsl-lx2162a-qds.dtb
+ 
++dtb-$(CONFIG_ARCH_LAYERSCAPE) += traverse-ls1043v.dtb
++dtb-$(CONFIG_ARCH_LAYERSCAPE) += traverse-ls1043s.dtb
++
+ dtb-$(CONFIG_ARCH_MXC) += imx8mm-beacon-kit.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mm-evk.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mm-ddr4-evk.dtb
diff --git a/target/linux/layerscape/patches-5.15/301-arm-dts-ls1021a-Add-LS1021A-IOT-board-support.patch b/target/linux/layerscape/patches-5.15/301-arm-dts-ls1021a-Add-LS1021A-IOT-board-support.patch
new file mode 100644
index 00000000000000..fa8ded735ccf7b
--- /dev/null
+++ b/target/linux/layerscape/patches-5.15/301-arm-dts-ls1021a-Add-LS1021A-IOT-board-support.patch
@@ -0,0 +1,291 @@
+From 55e00e402d6143aeb153761f8144d9fee5f1f009 Mon Sep 17 00:00:00 2001
+From: Biwen Li <biwen.li@nxp.com>
+Date: Fri, 26 Oct 2018 16:00:37 +0800
+Subject: [PATCH] arm: dts: ls1021a: Add LS1021A-IOT board support
+
+Signed-off-by: Biwen Li <biwen.li@nxp.com>
+[rebase]
+Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
+---
+ arch/arm/boot/dts/Makefile        |   3 +-
+ arch/arm/boot/dts/ls1021a-iot.dts | 262 ++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 264 insertions(+), 1 deletion(-)
+ create mode 100644 arch/arm/boot/dts/ls1021a-iot.dts
+
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -713,7 +713,8 @@ dtb-$(CONFIG_SOC_LS1021A) += \
+ 	ls1021a-moxa-uc-8410a.dtb \
+ 	ls1021a-qds.dtb \
+ 	ls1021a-tsn.dtb \
+-	ls1021a-twr.dtb
++	ls1021a-twr.dtb \
++	ls1021a-iot.dtb
+ dtb-$(CONFIG_SOC_VF610) += \
+ 	vf500-colibri-eval-v3.dtb \
+ 	vf610-bk4.dtb \
+--- /dev/null
++++ b/arch/arm/boot/dts/ls1021a-iot.dts
+@@ -0,0 +1,262 @@
++/*
++ * Copyright 2013-2016 Freescale Semiconductor, Inc.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ */
++
++/dts-v1/;
++#include "ls1021a.dtsi"
++
++/ {
++	model = "LS1021A IOT Board";
++
++	sys_mclk: clock-mclk {
++		compatible = "fixed-clock";
++		#clock-cells = <0>;
++		clock-frequency = <24576000>;
++	};
++
++	regulators {
++		compatible = "simple-bus";
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		reg_3p3v: regulator@0 {
++			compatible = "regulator-fixed";
++			reg = <0>;
++			regulator-name = "3P3V";
++			regulator-min-microvolt = <3300000>;
++			regulator-max-microvolt = <3300000>;
++			regulator-always-on;
++		};
++
++		reg_2p5v: regulator@1 {
++			compatible = "regulator-fixed";
++			reg = <1>;
++			regulator-name = "2P5V";
++			regulator-min-microvolt = <2500000>;
++			regulator-max-microvolt = <2500000>;
++			regulator-always-on;
++		};
++	};
++
++	sound {
++		compatible = "simple-audio-card";
++		simple-audio-card,format = "i2s";
++		simple-audio-card,widgets =
++			"Microphone", "Microphone Jack",
++			"Headphone", "Headphone Jack",
++			"Speaker", "Speaker Ext",
++			"Line", "Line In Jack";
++		simple-audio-card,routing =
++			"MIC_IN", "Microphone Jack",
++			"Microphone Jack", "Mic Bias",
++			"LINE_IN", "Line In Jack",
++			"Headphone Jack", "HP_OUT",
++			"Speaker Ext", "LINE_OUT";
++
++		simple-audio-card,cpu {
++			sound-dai = <&sai2>;
++			frame-master;
++			bitclock-master;
++		};
++
++		simple-audio-card,codec {
++			sound-dai = <&codec>;
++			frame-master;
++			bitclock-master;
++		};
++	};
++
++	firmware {
++		optee {
++			compatible = "linaro,optee-tz";
++			method = "smc";
++			};
++		};
++};
++
++&enet0 {
++	tbi-handle = <&tbi1>;
++	phy-handle = <&phy1>;
++	phy-connection-type = "sgmii";
++	status = "okay";
++};
++
++&enet1 {
++	tbi-handle = <&tbi1>;
++	phy-handle = <&phy3>;
++	phy-connection-type = "sgmii";
++	status = "okay";
++};
++
++&enet2 {
++	fixed-link = <0 1 1000 0 0>;
++	phy-connection-type = "rgmii-id";
++	status = "okay";
++};
++
++&can0{
++	status = "disabled";
++};
++
++&can1{
++	status = "disabled";
++};
++
++&can2{
++	status = "disabled";
++};
++
++&can3{
++	status = "okay";
++};
++
++&esdhc{
++	status = "okay";
++};
++
++&i2c0 {
++	status = "okay";
++
++	max1239@35 {
++		compatible = "maxim,max1239";
++		reg = <0x35>;
++		#io-channel-cells = <1>;
++	};
++
++	codec: sgtl5000@2a {
++               #sound-dai-cells=<0x0>;
++		compatible = "fsl,sgtl5000";
++		reg = <0x2a>;
++		VDDA-supply = <&reg_3p3v>;
++		VDDIO-supply = <&reg_2p5v>;
++		clocks = <&sys_mclk 1>;
++	};
++
++	pca9555: pca9555@23 {
++		compatible = "nxp,pca9555";
++		/*pinctrl-names = "default";*/
++		/*interrupt-parent = <&gpio2>;
++		interrupts = <19 0x2>;*/
++		gpio-controller;
++		#gpio-cells = <2>;
++		interrupt-controller;
++		#interrupt-cells = <2>;
++		reg = <0x23>;
++	};
++
++	ina220@44 {
++		compatible = "ti,ina220";
++		reg = <0x44>;
++		shunt-resistor = <1000>;
++	};
++
++	ina220@45 {
++		compatible = "ti,ina220";
++		reg = <0x45>;
++		shunt-resistor = <1000>;
++	};
++
++	lm75b@48 {
++                compatible = "nxp,lm75a";
++                reg = <0x48>;
++        };
++
++	adt7461a@4c {
++		compatible = "adt7461a";
++		reg = <0x4c>;
++	};
++
++	hdmi: sii9022a@39 {
++		compatible = "fsl,sii902x";
++		reg = <0x39>;
++		interrupts = <GIC_SPI 163 IRQ_TYPE_EDGE_RISING>;
++	};
++};
++
++&i2c1 {
++	status = "disabled";
++};
++
++&ifc {
++	status = "disabled";
++};
++
++&lpuart0 {
++	status = "okay";
++};
++
++&mdio0 {
++	phy0: ethernet-phy@0 {
++		reg = <0x0>;
++	};
++	phy1: ethernet-phy@1 {
++		reg = <0x1>;
++	};
++	phy2: ethernet-phy@2 {
++		reg = <0x2>;
++	};
++	phy3: ethernet-phy@3 {
++		reg = <0x3>;
++	};
++	tbi1: tbi-phy@1f {
++		reg = <0x1f>;
++		device_type = "tbi-phy";
++	};
++};
++
++&qspi {
++	num-cs = <2>;
++	status = "okay";
++
++	qflash0: s25fl128s@0 {
++		compatible = "spansion,s25fl129p1";
++		#address-cells = <1>;
++		#size-cells = <1>;
++		spi-max-frequency = <20000000>;
++		reg = <0>;
++	};
++};
++
++&sai2 {
++	status = "okay";
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&uart1 {
++	status = "okay";
++};
++
++&dcu {
++	display = <&display>;
++	status = "okay";
++
++	display: display@0 {
++		bits-per-pixel = <24>;
++
++		display-timings {
++			native-mode = <&timing0>;
++
++			timing0: mode0 {
++				clock-frequency = <25000000>;
++				hactive = <640>;
++				vactive = <480>;
++				hback-porch = <80>;
++				hfront-porch = <80>;
++				vback-porch = <16>;
++				vfront-porch = <16>;
++				hsync-len = <12>;
++				vsync-len = <2>;
++				hsync-active = <1>;
++				vsync-active = <1>;
++			};
++		};
++	};
++};
diff --git a/target/linux/layerscape/patches-5.15/302-arm64-dts-ls1012a-update-with-ppfe-support.patch b/target/linux/layerscape/patches-5.15/302-arm64-dts-ls1012a-update-with-ppfe-support.patch
new file mode 100644
index 00000000000000..27f4330bf1f587
--- /dev/null
+++ b/target/linux/layerscape/patches-5.15/302-arm64-dts-ls1012a-update-with-ppfe-support.patch
@@ -0,0 +1,288 @@
+From 1bb35ff4ce33e65601c8d9c736be52e4aabd6252 Mon Sep 17 00:00:00 2001
+From: Calvin Johnson <calvin.johnson@nxp.com>
+Date: Sat, 16 Sep 2017 14:20:23 +0530
+Subject: [PATCH] arm64: dts: freescale: ls1012a: update with ppfe support
+
+Update ls1012a dtsi and platform dts files with support for ppfe.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+Signed-off-by: Anjaneyulu Jagarlmudi <anji.jagarlmudi@nxp.com>
+---
+ .../boot/dts/freescale/fsl-ls1012a-frdm.dts   | 43 +++++++++++++++++
+ .../boot/dts/freescale/fsl-ls1012a-frwy.dts   | 43 +++++++++++++++++
+ .../boot/dts/freescale/fsl-ls1012a-qds.dts    | 43 +++++++++++++++++
+ .../boot/dts/freescale/fsl-ls1012a-rdb.dts    | 47 +++++++++++++++++++
+ .../arm64/boot/dts/freescale/fsl-ls1012a.dtsi | 29 ++++++++++++
+ 5 files changed, 205 insertions(+)
+
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1012a-frdm.dts
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1012a-frdm.dts
+@@ -14,6 +14,11 @@
+ 	model = "LS1012A Freedom Board";
+ 	compatible = "fsl,ls1012a-frdm", "fsl,ls1012a";
+ 
++	aliases {
++		ethernet0 = &pfe_mac0;
++		ethernet1 = &pfe_mac1;
++	};
++
+ 	sys_mclk: clock-mclk {
+ 		compatible = "fixed-clock";
+ 		#clock-cells = <0>;
+@@ -95,6 +100,44 @@
+ 	};
+ };
+ 
++&pfe {
++	status = "okay";
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	pfe_mac0: ethernet@0 {
++		compatible = "fsl,pfe-gemac-port";
++		#address-cells = <1>;
++		#size-cells = <0>;
++		reg = <0x0>;	/* GEM_ID */
++		fsl,gemac-bus-id = <0x0>;	/* BUS_ID */
++		fsl,gemac-phy-id = <0x2>;	/* PHY_ID */
++		fsl,mdio-mux-val = <0x0>;
++		phy-mode = "sgmii";
++		fsl,pfe-phy-if-flags = <0x0>;
++
++		mdio@0 {
++			reg = <0x1>; /* enabled/disabled */
++		};
++	};
++
++	pfe_mac1: ethernet@1 {
++		compatible = "fsl,pfe-gemac-port";
++		#address-cells = <1>;
++		#size-cells = <0>;
++		reg = <0x1>;	/* GEM_ID */
++		fsl,gemac-bus-id = <0x1>;	/* BUS_ID */
++		fsl,gemac-phy-id = <0x1>;	/* PHY_ID */
++		fsl,mdio-mux-val = <0x0>;
++		phy-mode = "sgmii";
++		fsl,pfe-phy-if-flags = <0x0>;
++
++		mdio@0 {
++			reg = <0x0>; /* enabled/disabled */
++		};
++	};
++};
++
+ &qspi {
+ 	status = "okay";
+ 
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1012a-frwy.dts
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1012a-frwy.dts
+@@ -14,6 +14,11 @@
+ / {
+ 	model = "LS1012A FRWY Board";
+ 	compatible = "fsl,ls1012a-frwy", "fsl,ls1012a";
++
++	aliases {
++		ethernet0 = &pfe_mac0;
++		ethernet1 = &pfe_mac1;
++	};
+ };
+ 
+ &duart0 {
+@@ -28,6 +33,44 @@
+ 	status = "okay";
+ };
+ 
++&pfe {
++	status = "okay";
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	pfe_mac0: ethernet@0 {
++		compatible = "fsl,pfe-gemac-port";
++		#address-cells = <1>;
++		#size-cells = <0>;
++		reg = <0x0>;	/* GEM_ID */
++		fsl,gemac-bus-id = <0x0>;	/* BUS_ID */
++		fsl,gemac-phy-id = <0x2>;	/* PHY_ID */
++		fsl,mdio-mux-val = <0x0>;
++		phy-mode = "sgmii";
++		fsl,pfe-phy-if-flags = <0x0>;
++
++		mdio@0 {
++			reg = <0x1>; /* enabled/disabled */
++		};
++	};
++
++	pfe_mac1: ethernet@1 {
++		compatible = "fsl,pfe-gemac-port";
++		#address-cells = <1>;
++		#size-cells = <0>;
++		reg = <0x1>;	/* GEM_ID */
++		fsl,gemac-bus-id = <0x1>;	/* BUS_ID */
++		fsl,gemac-phy-id = <0x1>;	/* PHY_ID */
++		fsl,mdio-mux-val = <0x0>;
++		phy-mode = "sgmii";
++		fsl,pfe-phy-if-flags = <0x0>;
++
++		mdio@0 {
++			reg = <0x0>; /* enabled/disabled */
++		};
++	};
++};
++
+ &qspi {
+ 	status = "okay";
+ 
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1012a-qds.dts
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1012a-qds.dts
+@@ -18,6 +18,11 @@
+ 		mmc1 = &esdhc1;
+ 	};
+ 
++	aliases {
++		ethernet0 = &pfe_mac0;
++		ethernet1 = &pfe_mac1;
++	};
++
+ 	sys_mclk: clock-mclk {
+ 		compatible = "fixed-clock";
+ 		#clock-cells = <0>;
+@@ -132,6 +137,44 @@
+ 		};
+ 	};
+ };
++
++&pfe {
++	status = "okay";
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	pfe_mac0: ethernet@0 {
++		compatible = "fsl,pfe-gemac-port";
++		#address-cells = <1>;
++		#size-cells = <0>;
++		reg = <0x0>;	/* GEM_ID */
++		fsl,gemac-bus-id = <0x0>;	/* BUS_ID */
++		fsl,gemac-phy-id = <0x1>;	/* PHY_ID */
++		fsl,mdio-mux-val = <0x2>;
++		phy-mode = "sgmii-2500";
++		fsl,pfe-phy-if-flags = <0x0>;
++
++		mdio@0 {
++			reg = <0x1>; /* enabled/disabled */
++		};
++	};
++
++	pfe_mac1: ethernet@1 {
++		compatible = "fsl,pfe-gemac-port";
++		#address-cells = <1>;
++		#size-cells = <0>;
++		reg = <0x1>;	/* GEM_ID */
++		fsl,gemac-bus-id = <0x1>;	/* BUS_ID */
++		fsl,gemac-phy-id = <0x2>;	/* PHY_ID */
++		fsl,mdio-mux-val = <0x3>;
++		phy-mode = "sgmii-2500";
++		fsl,pfe-phy-if-flags = <0x0>;
++
++		mdio@0 {
++			reg = <0x0>; /* enabled/disabled */
++		};
++	};
++};
+ 
+ &qspi {
+ 	status = "okay";
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1012a-rdb.dts
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1012a-rdb.dts
+@@ -16,6 +16,8 @@
+ 
+ 	aliases {
+ 		serial0 = &duart0;
++		ethernet0 = &pfe_mac0;
++		ethernet1 = &pfe_mac1;
+ 		mmc0 = &esdhc0;
+ 		mmc1 = &esdhc1;
+ 	};
+@@ -86,6 +88,44 @@
+ 	};
+ };
+ 
++&pfe {
++	status = "okay";
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	pfe_mac0: ethernet@0 {
++		compatible = "fsl,pfe-gemac-port";
++		#address-cells = <1>;
++		#size-cells = <0>;
++		reg = <0x0>;	/* GEM_ID */
++		fsl,gemac-bus-id = <0x0>;	/* BUS_ID */
++		fsl,gemac-phy-id = <0x2>;	/* PHY_ID */
++		fsl,mdio-mux-val = <0x0>;
++		phy-mode = "sgmii";
++		fsl,pfe-phy-if-flags = <0x0>;
++
++		mdio@0 {
++			reg = <0x1>; /* enabled/disabled */
++		};
++	};
++
++	pfe_mac1: ethernet@1 {
++		compatible = "fsl,pfe-gemac-port";
++		#address-cells = <1>;
++		#size-cells = <0>;
++		reg = <0x1>;	/* GEM_ID */
++		fsl,gemac-bus-id = < 0x1 >;	/* BUS_ID */
++		fsl,gemac-phy-id = < 0x1 >;	/* PHY_ID */
++		fsl,mdio-mux-val = <0x0>;
++		phy-mode = "rgmii-txid";
++		fsl,pfe-phy-if-flags = <0x0>;
++
++		mdio@0 {
++			reg = <0x0>; /* enabled/disabled */
++		};
++	};
++};
++
+ &qspi {
+ 	status = "okay";
+ 
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi
+@@ -560,6 +560,35 @@
+ 		};
+ 	};
+ 
++	reserved-memory {
++		#address-cells = <2>;
++		#size-cells = <2>;
++		ranges;
++
++		pfe_reserved: packetbuffer@83400000 {
++			reg = <0 0x83400000 0 0xc00000>;
++		};
++	};
++
++	pfe: pfe@04000000 {
++		compatible = "fsl,pfe";
++		reg =   <0x0 0x04000000 0x0 0xc00000>,	/* AXI 16M */
++			<0x0 0x83400000 0x0 0xc00000>;  /* PFE DDR 12M */
++		reg-names = "pfe", "pfe-ddr";
++		fsl,pfe-num-interfaces = <0x2>;
++		interrupts = <0 172 0x4>,    /* HIF interrupt */
++			     <0 173 0x4>,    /*HIF_NOCPY interrupt */
++			     <0 174 0x4>;    /* WoL interrupt */
++		interrupt-names = "pfe_hif", "pfe_hif_nocpy", "pfe_wol";
++		memory-region = <&pfe_reserved>;
++		fsl,pfe-scfg = <&scfg 0>;
++		fsl,rcpm-wakeup = <&rcpm 0xf0000020>;
++		clocks = <&clockgen 4 0>;
++		clock-names = "pfe";
++
++		status = "okay";
++	};
++
+ 	firmware {
+ 		optee {
+ 			compatible = "linaro,optee-tz";
diff --git a/target/linux/layerscape/patches-5.15/303-arm64-dts-ls1012a-frdm-workaround-by-updating-qspi-f.patch b/target/linux/layerscape/patches-5.15/303-arm64-dts-ls1012a-frdm-workaround-by-updating-qspi-f.patch
new file mode 100644
index 00000000000000..5d19cb92dc0d53
--- /dev/null
+++ b/target/linux/layerscape/patches-5.15/303-arm64-dts-ls1012a-frdm-workaround-by-updating-qspi-f.patch
@@ -0,0 +1,41 @@
+From 9c5c18dbf8e1845d349ef7020f8af5bc9b56ed1f Mon Sep 17 00:00:00 2001
+From: Pawel Dembicki <paweldembicki@gmail.com>
+Date: Fri, 28 Sep 2022 17:14:32 +0200
+Subject: [PATCH] arm64: dts: ls1012a-frdm/qds: workaround by updating qspi flash to
+ single mode
+
+Update rx and tx bus-width to 1 to use single mode to workaround ubifs
+issue found with double mode. (The same method as RDB board)
+
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+---
+ arch/arm64/boot/dts/freescale/fsl-ls1012a-frdm.dts | 4 ++--
+ arch/arm64/boot/dts/freescale/fsl-ls1012a-qds.dts  | 4 ++--
+ 2 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1012a-frdm.dts
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1012a-frdm.dts
+@@ -148,8 +148,8 @@
+ 		spi-max-frequency = <50000000>;
+ 		m25p,fast-read;
+ 		reg = <0>;
+-		spi-rx-bus-width = <2>;
+-		spi-tx-bus-width = <2>;
++		spi-rx-bus-width = <1>;
++		spi-tx-bus-width = <1>;
+ 	};
+ };
+ 
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1012a-qds.dts
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1012a-qds.dts
+@@ -186,8 +186,8 @@
+ 		spi-max-frequency = <50000000>;
+ 		m25p,fast-read;
+ 		reg = <0>;
+-		spi-rx-bus-width = <2>;
+-		spi-tx-bus-width = <2>;
++		spi-rx-bus-width = <1>;
++		spi-tx-bus-width = <1>;
+ 	};
+ };
+ 
diff --git a/target/linux/layerscape/patches-5.15/304-arm64-dts-ls1012a-rdb-workaround-by-updating-qspi-fl.patch b/target/linux/layerscape/patches-5.15/304-arm64-dts-ls1012a-rdb-workaround-by-updating-qspi-fl.patch
new file mode 100644
index 00000000000000..53cfd193b78672
--- /dev/null
+++ b/target/linux/layerscape/patches-5.15/304-arm64-dts-ls1012a-rdb-workaround-by-updating-qspi-fl.patch
@@ -0,0 +1,29 @@
+From 9c5c18dbf8e1845d349ef7020f8af5bc9b56ed1f Mon Sep 17 00:00:00 2001
+From: Kuldeep Singh <kuldeep.singh@nxp.com>
+Date: Tue, 7 Jan 2020 17:14:32 +0530
+Subject: [PATCH] arm64: dts: ls1012a-rdb: workaround by updating qspi flash to
+ single mode
+
+Update rx and tx bus-width to 1 to use single mode to workaround ubifs
+issue found with double mode.
+
+[ Leo: Local workaround ]
+
+Signed-off-by: Kuldeep Singh <kuldeep.singh@nxp.com>
+---
+ arch/arm64/boot/dts/freescale/fsl-ls1012a-rdb.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1012a-rdb.dts
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1012a-rdb.dts
+@@ -136,8 +136,8 @@
+ 		spi-max-frequency = <50000000>;
+ 		m25p,fast-read;
+ 		reg = <0>;
+-		spi-rx-bus-width = <2>;
+-		spi-tx-bus-width = <2>;
++		spi-rx-bus-width = <1>;
++		spi-tx-bus-width = <1>;
+ 	};
+ };
+ 
diff --git a/target/linux/layerscape/patches-5.15/305-arm64-dts-ls1046a-rdb-Update-qspi-spi-rx-bus-width-t.patch b/target/linux/layerscape/patches-5.15/305-arm64-dts-ls1046a-rdb-Update-qspi-spi-rx-bus-width-t.patch
new file mode 100644
index 00000000000000..9bc4e2b520afb7
--- /dev/null
+++ b/target/linux/layerscape/patches-5.15/305-arm64-dts-ls1046a-rdb-Update-qspi-spi-rx-bus-width-t.patch
@@ -0,0 +1,34 @@
+From 38093ebbf25eb60a1aa863f46118a68a0300c56e Mon Sep 17 00:00:00 2001
+From: Kuldeep Singh <kuldeep.singh@nxp.com>
+Date: Fri, 3 Jan 2020 14:49:07 +0530
+Subject: [PATCH] arm64: dts: ls1046a-rdb: Update qspi spi-rx-bus-width to 1
+
+Update rx width from quad mode to single mode as a workaround.
+
+[Leo: Local workaround ]
+
+Signed-off-by: Kuldeep Singh <kuldeep.singh@nxp.com>
+---
+ arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts
+@@ -104,7 +104,7 @@
+ 		#address-cells = <1>;
+ 		#size-cells = <1>;
+ 		spi-max-frequency = <50000000>;
+-		spi-rx-bus-width = <4>;
++		spi-rx-bus-width = <1>;
+ 		spi-tx-bus-width = <1>;
+ 		reg = <0>;
+ 	};
+@@ -114,7 +114,7 @@
+ 		#address-cells = <1>;
+ 		#size-cells = <1>;
+ 		spi-max-frequency = <50000000>;
+-		spi-rx-bus-width = <4>;
++		spi-rx-bus-width = <1>;
+ 		spi-tx-bus-width = <1>;
+ 		reg = <1>;
+ 	};
diff --git a/target/linux/layerscape/patches-5.15/400-LF-20-3-mtd-spi-nor-Use-1-bit-mode-of-spansion-s25fs.patch b/target/linux/layerscape/patches-5.15/400-LF-20-3-mtd-spi-nor-Use-1-bit-mode-of-spansion-s25fs.patch
new file mode 100644
index 00000000000000..8ba7971e8a83a8
--- /dev/null
+++ b/target/linux/layerscape/patches-5.15/400-LF-20-3-mtd-spi-nor-Use-1-bit-mode-of-spansion-s25fs.patch
@@ -0,0 +1,26 @@
+From 2b84e88d36de482da0370290ad4af09a71993f08 Mon Sep 17 00:00:00 2001
+From: Han Xu <han.xu@nxp.com>
+Date: Tue, 14 Apr 2020 11:58:44 -0500
+Subject: [PATCH] LF-20-3 mtd: spi-nor: Use 1 bit mode of spansion(s25fs512s)
+ flash
+
+This is a workaround patch which uses only single bit mode of s25fs512s
+flash
+
+Signed-off-by: Han Xu <han.xu@nxp.com>
+Signed-off-by: Kuldeep Singh <kuldeep.singh@nxp.com>
+---
+ drivers/mtd/spi-nor/spansion.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/spi-nor/spansion.c
++++ b/drivers/mtd/spi-nor/spansion.c
+@@ -232,7 +232,7 @@ static const struct flash_info spansion_
+ 			      SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ |
+ 			      USE_CLSR) },
+ 	{ "s25fs512s",  INFO6(0x010220, 0x4d0081, 256 * 1024, 256,
+-			      SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ | USE_CLSR)
++			      SPI_NOR_4B_OPCODES | USE_CLSR)
+ 	  .fixups = &s25fs_s_fixups, },
+ 	{ "s25sl12800", INFO(0x012018, 0x0300, 256 * 1024,  64, 0) },
+ 	{ "s25sl12801", INFO(0x012018, 0x0301,  64 * 1024, 256, 0) },
diff --git a/target/linux/layerscape/patches-5.15/701-staging-add-fsl_ppfe-driver.patch b/target/linux/layerscape/patches-5.15/701-staging-add-fsl_ppfe-driver.patch
new file mode 100644
index 00000000000000..6130bf0030ff3f
--- /dev/null
+++ b/target/linux/layerscape/patches-5.15/701-staging-add-fsl_ppfe-driver.patch
@@ -0,0 +1,11803 @@
+From 15eff6c8760a76619654464103314bba9fdda0af Mon Sep 17 00:00:00 2001
+From: Pawel Dembicki <paweldembicki@gmail.com>
+Date: Sat, 19 Oct 2022 07:05:49 +0200
+Subject: [PATCH] staging: add fsl_ppfe driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This is squash of all commits with ppfe driver taken from NXP 5.15 tree:
+https://github.com/nxp-qoriq/linux/commits/lf-5.15.y/drivers/staging/fsl_ppfe
+
+List of original commits:
+
+net: fsl_ppfe: dts binding for ppfe
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+Signed-off-by: Anjaneyulu Jagarlmudi <anji.jagarlmudi@nxp.com>
+
+staging: fsl_ppfe/eth: header files for pfe driver
+
+This patch has all pfe header files.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+Signed-off-by: Anjaneyulu Jagarlmudi <anji.jagarlmudi@nxp.com>
+
+staging: fsl_ppfe/eth: introduce pfe driver
+
+	This patch introduces Linux support for NXP's LS1012A Packet
+Forwarding Engine (pfe_eth). LS1012A uses hardware packet forwarding
+engine to provide high performance Ethernet interfaces. The device
+includes two Ethernet ports.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+Signed-off-by: Anjaneyulu Jagarlmudi <anji.jagarlmudi@nxp.com>
+
+staging: fsl_ppfe/eth: fix RGMII tx delay issue
+
+Recently logic to enable RGMII tx delay was changed by
+below patch.
+
+https://patchwork.kernel.org/patch/9447581/
+
+Based on the patch, appropriate change is made in PFE driver.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+Signed-off-by: Anjaneyulu Jagarlmudi <anji.jagarlmudi@nxp.com>
+
+staging: fsl_ppfe/eth: remove unused functions
+
+Remove unused functions hif_xmit_pkt & hif_lib_xmit_pkt.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: fix read/write/ack idx issue
+
+While fixing checkpatch errors some of the index increments
+were commented out. They are enabled.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: Make phy_ethtool_ksettings_get return void
+
+Make return value void since function never return meaningful value
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: add function to update tmu credits
+
+__hif_lib_update_credit function is used to update the tmu credits.
+If tx_qos is set, tmu credit is updated based on the number of packets
+transmitted by tmu.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+Signed-off-by: Anjaneyulu Jagarlmudi <anji.jagarlmudi@nxp.com>
+
+staging: fsl_ppfe/eth: Avoid packet drop at TMU queues
+
+Added flow control between TMU queues and PFE Linux driver,
+based on TMU credits availability.
+Added tx_qos module parameter to control this behavior.
+Use queue-0 as default queue to transmit packets.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+Signed-off-by: Akhila Kavi <akhila.kavi@nxp.com>
+Signed-off-by: Anjaneyulu Jagarlmudi <anji.jagarlmudi@nxp.com>
+
+staging: fsl_ppfe/eth: Enable PFE in clause 45 mode
+
+when we opearate in clause 45 mode, we need to call
+the function get_phy_device() with its 3rd argument as
+"true" and then the resultant phy device needs to be
+register with phy layer via phy_device_register()
+
+Signed-off-by: Bhaskar Upadhaya <Bhaskar.Upadhaya@nxp.com>
+
+staging: fsl_ppfe/eth: Disable autonegotiation for 2.5G SGMII
+
+PCS initialization sequence for 2.5G SGMII interface governs
+auto negotiation to be in disabled mode
+
+Signed-off-by: Bhaskar Upadhaya <Bhaskar.Upadhaya@nxp.com>
+
+staging: fsl_ppfe/eth: calculate PFE_PKT_SIZE with SKB_DATA_ALIGN
+
+pfe packet size was calculated without considering skb data alignment
+and this resulted in jumbo frames crashing kernel when the
+cacheline size increased from 64 to 128 bytes with
+commit 97303480753e ("arm64: Increase the max granular size").
+
+Modify pfe packet size caclulation to include skb data alignment of
+sizeof(struct skb_shared_info).
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: support for userspace networking
+
+This patch adds the userspace mode support to fsl_ppfe network driver.
+In the new mode, basic hardware initialization is performed in kernel, while
+the datapath and HIF handling is the responsibility of the userspace.
+
+The new command line parameter is added to initialize the ppfe module
+in userspace mode. By default the module remains in kernelspace networking
+mode.
+To enable userspace mode, use "insmod pfe.ko us=1"
+
+Signed-off-by: Akhil Goyal <akhil.goyal@nxp.com>
+Signed-off-by: Gagandeep Singh <g.singh@nxp.com>
+
+staging: fsl_ppfe/eth: unregister netdev after pfe_phy_exit
+
+rmmod pfe.ko throws below warning:
+
+kernfs: can not remove 'phydev', no directory
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 2230 at fs/kernfs/dir.c:1481
+kernfs_remove_by_name_ns+0x90/0xa0
+
+This is caused when the unregistered netdev structure is accessed to
+disconnect phy.
+
+Resolve the issue by unregistering netdev after disconnecting phy.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: HW parse results for DPDK
+
+HW Parse results are included in the packet headroom.
+Length and Offset calculation now accommodates parse info size.
+
+Signed-off-by: Archana Madhavan <archana.madhavan@nxp.com>
+
+staging: fsl_ppfe/eth: reorganize pfe_netdev_ops
+
+Reorganize members of struct pfe_netdev_ops to match with the order
+of members in struct net_device_ops defined in include/linux/netdevice.h
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: use mask for rx max frame len
+
+Define and use PFE_RCR_MAX_FL_MASK to properly set Rx max frame
+length of MAC Receive Control Register.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: define pfe ndo_change_mtu function
+
+Define ndo_change_mtu function for pfe. This sets the max Rx frame
+length to the new mtu.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: remove jumbo frame enable from gemac init
+
+MAC Receive Control Register was configured to allow jumbo frames.
+This is removed as jumbo frames can be supported anytime by changing
+mtu which will in turn modify MAX_FL field of MAC RCR.
+Jumbo frames caused pfe to hang on LS1012A rev 1.0 Silicon due to
+erratum A-010897.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: disable CRC removal
+
+Disable CRC removal from the packet, so that packets are forwarded
+as is to Linux.
+CRC configuration in MAC will be reflected in the packet received
+to Linux.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: handle ls1012a errata_a010897
+
+On LS1012A rev 1.0, Jumbo frames are not supported as it causes
+the PFE controller to hang. A reset of the entire chip is required
+to resume normal operation.
+
+To handle this errata, frames with length > 1900 are truncated for
+rev 1.0 of LS1012A.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: replace magic numbers
+
+Replace magic numbers and some cosmetic changes.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: resolve indentation warning
+
+Resolve the following indentation warning:
+
+drivers/staging/fsl_ppfe/pfe_ls1012a_platform.c:
+In function ‘pfe_get_gemac_if_proprties’:
+drivers/staging/fsl_ppfe/pfe_ls1012a_platform.c:96:2:
+warning: this ‘else’ clause does not guard...
+[-Wmisleading-indentation]
+  else
+  ^~~~
+drivers/staging/fsl_ppfe/pfe_ls1012a_platform.c:98:3:
+note: ...this statement, but the latter is misleadingly indented as
+if it were guarded by the ‘else’
+   pdata->ls1012a_eth_pdata[port].mdio_muxval = phy_id;
+   ^~~~~
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: add fixed-link support
+
+In cases where MAC is not connected to a normal MDIO-managed PHY
+device, and instead to a switch, it is configured as a "fixed-link".
+Code to handle this scenario is added here.
+
+phy_node in the dtb is checked to identify a fixed-link.
+On identification of a fixed-link, it is registered and connected.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe: add support for a char dev for link status
+
+Read and IOCTL support is added. Application would need to open,
+read/ioctl the /dev/pfe_us_cdev device.
+select is pending as it requires a wait_queue.
+
+Signed-off-by: Shreyansh Jain <shreyansh.jain@nxp.com>
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe: enable hif event from userspace
+
+HIF interrupts are enabled using ioctl from user space,
+and epoll wait from user space wakes up when there is an HIF
+interrupt.
+
+Signed-off-by: Akhil Goyal <akhil.goyal@nxp.com>
+
+staging: fsl_ppfe: performance tuning for user space
+
+interrupt coalescing of 100 usec is added.
+
+Signed-off-by: Akhil Goyal <akhil.goyal@nxp.com>
+Signed-off-by: Sachin Saxena <sachin.saxena@nxp.com>
+
+staging: fsl_ppfe/eth: Update to use SPDX identifiers
+
+Replace license text with corresponding SPDX identifiers and update the
+format of existing SPDX identifiers to follow the new guideline
+Documentation/process/license-rules.rst.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: misc clean up
+
+- remove redundant hwfeature init
+- remove unused vars from ls1012a_eth_platform_data
+- To handle ls1012a errata_a010897, PPFE driver requires GUTS driver
+to be compiled in. Select FSL_GUTS when PPFE driver is compiled.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: reorganize platform phy parameters
+
+- Use "phy-handle" and of_* functions to get phy node and fixed-link
+parameters
+
+- Reorganize phy parameters and initialize them only if phy-handle
+or fixed-link is defined in the dtb.
+
+- correct typo pfe_get_gemac_if_proprties to pfe_get_gemac_if_properties
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: support single interface initialization
+
+- arrange members of struct mii_bus in sequence matching phy.h
+- if mdio node is defined, use of_mdiobus_register to register
+  child nodes (phy devices) available on the mdio bus.
+- remove of_phy_register_fixed_link from pfe_phy_init as it is being
+  handled in pfe_get_gemac_if_properties
+- remove mdio enabled check
+- skip phy init, if no PHY or fixed-link
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+net: fsl_ppfe: update dts properties for phy
+
+Use commonly used phy-handle property and mdio subnode to handle
+phy properties.
+
+Deprecate bindings fsl,gemac-phy-id & fsl,pfe-phy-if-flags.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: remove unused code
+
+- remove gemac-bus-id related code that is unused.
+- remove unused prototype gemac_set_mdc_div.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: separate mdio init from mac init
+
+- separate mdio initialization from mac initialization
+- Define pfe_mdio_priv_s structure to hold mii_bus structure and other
+  related data.
+- Modify functions to work with the separted mdio init model.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: adapt to link mode based phydev changes
+
+Setting link mode bits have changed with the integration of
+commit (3c1bcc8 net: ethernet: Convert phydev advertize and
+supported from u32 to link mode). Adapt to the new method of
+setting and clearing the link mode bits.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: use generic soc_device infra instead of fsl_guts_get_svr()
+
+Commit ("soc: fsl: guts: make fsl_guts_get_svr() static") has
+made fsl_guts_get_svr() static and hence use generic soc_device
+infrastructure to check SoC revision.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: use memremap() to map RAM area used by PFE
+
+RAM area used by PFE should be mapped using memremap() instead of
+directly traslating physical addr to virtual. This will ensure proper
+checks are done before the area is used.
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+
+staging: fsl_ppfe/eth: remove 'fallback' argument from dev->ndo_select_queue()
+
+To be consistent with upstream API change.
+
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+
+staging: fsl_ppfe/eth: prefix header search paths with $(srctree)/
+
+Currently, the rules for configuring search paths in Kbuild have
+changed: https://lkml.org/lkml/2019/5/13/37
+
+This will lead the below error:
+
+fatal error: pfe/pfe.h: No such file or directory
+
+Fix it by adding $(srctree)/ prefix to the search paths.
+
+Signed-off-by: Ting Liu <ting.liu@nxp.com>
+
+staging: fsl_ppfe/eth: add pfe support to Kconfig and Makefile
+
+Signed-off-by: Calvin Johnson <calvin.johnson@nxp.com>
+[ Aisheng: fix minor conflict due to removed VBOXSF_FS ]
+Signed-off-by: Dong Aisheng <aisheng.dong@nxp.com>
+
+staging: fsl_ppfe/eth: Disable termination of CRC fwd.
+
+LS1012A MAC PCS block has an erratum that is seen with specific PHY AR803x.
+The issue is triggered by the (spec-compliant) operation of the AR803x PHY
+on the LS1012A-FRWY board.Due to this, good FCS packet is reported as error
+packet by MAC, so for these error packets FCS should be validated and
+discard only real error packets in PFE Rx packet path.
+
+Signed-off-by: Nagesh Koneti <koneti.nagesh@nxp.com>
+Signed-off-by: Nagesh Koneti <“koneti.nagesh@nxp.com”>
+
+net: ppfe: Cope with of_get_phy_mode() API change
+
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+
+staging: fsl_ppfe/eth: Enhance error checking in platform probe
+
+Fix the kernel crash when MAC addr is not passed in dtb.
+
+Signed-off-by: Anji Jagarlmudi <anji.jagarlmudi@nxp.com>
+
+staging: fsl_ppfe/eth: reject unsupported coalescing params
+
+Set ethtool_ops->supported_coalesce_params to let
+the core reject unsupported coalescing parameters.
+
+Signed-off-by: Anji Jagarlmudi <anji.jagarlmudi@nxp.com>
+
+staging: fsl_ppfe/eth:check "reg" property before pfe_get_gemac_if_properties()
+
+It has been observed that the function pfe_get_gemac_if_properties() is
+been called blindly for the next two child nodes. There might be some
+cases where it may go wrong and that lead to missing interfaces.
+with these changes it is ensured thats not the case.
+
+Signed-off-by: Chaitanya Sakinam <chaitanya.sakinam@nxp.com>
+Signed-off-by: Anji J <anji.jagarlmudi@nxp.com>
+
+staging: fsl_ppfe/eth: "struct firmware" dereference is reduced in many functions
+
+firmware structure's data variable is the actual elf data. It has been
+dereferenced in multiple functions and this has been reduced.
+
+Signed-off-by: Chaitanya Sakinam <chaitanya.sakinam@nxp.com>
+Signed-off-by: Anji J <anji.jagarlmudi@nxp.com>
+
+staging: fsl_ppfe/eth: LF-27 load pfe binaries from FDT
+
+FDT prepared in uboot now has pfe firmware part of it.
+These changes will read the firmware by default from it and tries to load
+the elf into the PFE PEs. This help build the pfe driver pasrt of kernel.
+
+Signed-off-by: Chaitanya Sakinam <chaitanya.sakinam@nxp.com>
+Signed-off-by: Anji J <anji.jagarlmudi@nxp.com>
+
+staging: fsl_ppfe/eth: proper handling for RGMII delay mode
+
+The correct setting for the RGMII ports on LS1012ARDB is to
+enable delay on both Tx and Rx. So the phy mode to be matched
+is PHY_INTERFACE_MODE_RGMII_ID.
+
+Signed-off-by: Chaitanya Sakinam <chaitanya.sakinam@nxp.com>
+Signed-off-by: Anji Jagarlmudi <anji.jagarlmudi@nxp.com>
+
+LF-1762-2 staging: fsl_ppfe: replace '---help---' in Kconfig files with 'help'
+
+Update Kconfig to cope with upstream change
+commit 84af7a6194e4 ("checkpatch: kconfig: prefer 'help' over
+'---help---'").
+
+Signed-off-by: Dong Aisheng <aisheng.dong@nxp.com>
+
+staging: fsl_ppfe/eth: Nesting level does not match indentation
+
+corrected nesting level
+LF-1661 and Coverity CID: 8879316
+
+Signed-off-by: Chaitanya Sakinam <chaitanya.sakinam@nxp.com>
+
+staging: fsl_ppfe/eth: Initialized scalar variable
+
+Proper initialization of scalar variable
+LF-1657 and Coverity CID: 3335133
+
+Signed-off-by: Chaitanya Sakinam <chaitanya.sakinam@nxp.com>
+
+staging: fsl_ppfe/eth: misspelt variable name
+
+variable name corrected
+LF-1656 and Coverity CID: 3335119
+
+Signed-off-by: Chaitanya Sakinam <chaitanya.sakinam@nxp.com>
+
+staging: fsl_ppfe/eth: Avoiding out-of-bound writes
+
+avoid out-of-bound writes with proper error handling
+LF-1654, LF-1652 and Coverity CID: 3335106, 3335090
+
+Signed-off-by: Chaitanya Sakinam <chaitanya.sakinam@nxp.com>
+
+staging: fsl_ppfe/eth: Initializing scalar variable
+
+proper initialization of scalar variable.
+LF-1653 and Coverity CID: 3335101
+
+Signed-off-by: Chaitanya Sakinam <chaitanya.sakinam@nxp.com>
+
+staging: fsl_ppfe/eth: checking return value
+
+proper checks added and handled for return value.
+LF-1644 and Coverity CID: 241888
+
+Signed-off-by: Chaitanya Sakinam <chaitanya.sakinam@nxp.com>
+
+staging: fsl_ppfe/eth: Avoid out-of-bound access
+
+proper handling to avoid out-of-bound access
+LF-1642, LF-1641 and Coverity CID: 240910, 240891
+
+Signed-off-by: Chaitanya Sakinam <chaitanya.sakinam@nxp.com>
+
+staging: fsl_ppfe/eth: Avoiding out-of-bound writes
+
+avoid out-of-bound writes with proper error handling
+LF-1654, LF-1652 and Coverity CID: 3335106, 3335090
+
+Signed-off-by: Chaitanya Sakinam <chaitanya.sakinam@nxp.com>
+
+staging: fsl_ppfe/eth: return value init in error case
+
+proper err return in error case.
+LF-1806 and Coverity CID: 10468592
+
+Signed-off-by: Chaitanya Sakinam <chaitanya.sakinam@nxp.com>
+
+staging: fsl_ppfe/eth: Avoid recursion in header inclusion
+
+Avoiding header inclusions that are not necessary and also that are
+causing header inclusion recursion.
+
+LF-2102 and Coverity CID: 240838
+
+Signed-off-by: Chaitanya Sakinam <chaitanya.sakinam@nxp.com>
+
+staging: fsl_ppfe/eth: Avoiding return value overwrite
+
+avoid return value overwrite at the end of function.
+LF-2136, LF-2137 and Coverity CID: 8879341, 8879364
+
+Signed-off-by: Chaitanya Sakinam <chaitanya.sakinam@nxp.com>
+
+staging: fsl_ppfe/eth: LF-27 enabling PFE firmware load from FDT
+
+The macro, "LOAD_PFEFIRMWARE_FROM_FILESYSTEM" is been disabled to load
+the firmware from FDT by default. Enabling the macro will load the
+firmware from filesystem.
+
+Also, the Makefile is now tuned to build pfe as per the config option
+
+Signed-off-by: Chaitanya Sakinam <chaitanya.sakinam@nxp.com>
+
+staging: fsl_ppfe/eth: Ethtool stats correction for IEEE_rx_drop counter
+
+Due to carrier extended bug the phy counter IEEE_rx_drop counter is
+incremented some times and phy reports the packet has crc error.
+Because of this PFE revalidates all the packets that are marked crc
+error by phy. Now, the counter phy reports is till bogus and this
+patch decrements the counter by pfe revalidated (and are crc ok)
+counter amount.
+
+Signed-off-by: Chaitanya Sakinam <chaitanya.sakinam@nxp.com>
+
+staging: fsl_ppfe/eth: PFE firmware load enhancements
+
+PFE driver enhancements to load the PE firmware from filesystem
+when the firmware is not found in FDT.
+
+Signed-off-by: Chaitanya Sakinam <chaitanya.sakinam@nxp.com>
+
+staging: fsl_ppfe: deal with upstream API change of of_get_mac_address()
+
+Uptream commit 83216e398 changed the of_get_mac_address() API, update
+the user accordingly.
+
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+
+staging: fsl_ppfe: update coalesce setting uAPI usage
+
+API changed since:
+f3ccfda19319 ("ethtool: extend coalesce setting uAPI with CQE mode")
+
+Signed-off-by: Dong Aisheng <aisheng.dong@nxp.com>
+
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+---
+ .../devicetree/bindings/net/fsl_ppfe/pfe.txt  |  199 ++
+ MAINTAINERS                                   |    8 +
+ drivers/staging/Kconfig                       |    2 +
+ drivers/staging/Makefile                      |    1 +
+ drivers/staging/fsl_ppfe/Kconfig              |   21 +
+ drivers/staging/fsl_ppfe/Makefile             |   20 +
+ drivers/staging/fsl_ppfe/TODO                 |    2 +
+ drivers/staging/fsl_ppfe/include/pfe/cbus.h   |   78 +
+ .../staging/fsl_ppfe/include/pfe/cbus/bmu.h   |   55 +
+ .../fsl_ppfe/include/pfe/cbus/class_csr.h     |  289 ++
+ .../fsl_ppfe/include/pfe/cbus/emac_mtip.h     |  242 ++
+ .../staging/fsl_ppfe/include/pfe/cbus/gpi.h   |   86 +
+ .../staging/fsl_ppfe/include/pfe/cbus/hif.h   |  100 +
+ .../fsl_ppfe/include/pfe/cbus/hif_nocpy.h     |   50 +
+ .../fsl_ppfe/include/pfe/cbus/tmu_csr.h       |  168 ++
+ .../fsl_ppfe/include/pfe/cbus/util_csr.h      |   61 +
+ drivers/staging/fsl_ppfe/include/pfe/pfe.h    |  372 +++
+ drivers/staging/fsl_ppfe/pfe_cdev.c           |  258 ++
+ drivers/staging/fsl_ppfe/pfe_cdev.h           |   41 +
+ drivers/staging/fsl_ppfe/pfe_ctrl.c           |  226 ++
+ drivers/staging/fsl_ppfe/pfe_ctrl.h           |  100 +
+ drivers/staging/fsl_ppfe/pfe_debugfs.c        |   99 +
+ drivers/staging/fsl_ppfe/pfe_debugfs.h        |   13 +
+ drivers/staging/fsl_ppfe/pfe_eth.c            | 2591 +++++++++++++++++
+ drivers/staging/fsl_ppfe/pfe_eth.h            |  175 ++
+ drivers/staging/fsl_ppfe/pfe_firmware.c       |  398 +++
+ drivers/staging/fsl_ppfe/pfe_firmware.h       |   21 +
+ drivers/staging/fsl_ppfe/pfe_hal.c            | 1517 ++++++++++
+ drivers/staging/fsl_ppfe/pfe_hif.c            | 1064 +++++++
+ drivers/staging/fsl_ppfe/pfe_hif.h            |  199 ++
+ drivers/staging/fsl_ppfe/pfe_hif_lib.c        |  628 ++++
+ drivers/staging/fsl_ppfe/pfe_hif_lib.h        |  229 ++
+ drivers/staging/fsl_ppfe/pfe_hw.c             |  164 ++
+ drivers/staging/fsl_ppfe/pfe_hw.h             |   15 +
+ .../staging/fsl_ppfe/pfe_ls1012a_platform.c   |  383 +++
+ drivers/staging/fsl_ppfe/pfe_mod.c            |  158 +
+ drivers/staging/fsl_ppfe/pfe_mod.h            |  103 +
+ drivers/staging/fsl_ppfe/pfe_perfmon.h        |   26 +
+ drivers/staging/fsl_ppfe/pfe_sysfs.c          |  840 ++++++
+ drivers/staging/fsl_ppfe/pfe_sysfs.h          |   17 +
+ 40 files changed, 11019 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/net/fsl_ppfe/pfe.txt
+ create mode 100644 drivers/staging/fsl_ppfe/Kconfig
+ create mode 100644 drivers/staging/fsl_ppfe/Makefile
+ create mode 100644 drivers/staging/fsl_ppfe/TODO
+ create mode 100644 drivers/staging/fsl_ppfe/include/pfe/cbus.h
+ create mode 100644 drivers/staging/fsl_ppfe/include/pfe/cbus/bmu.h
+ create mode 100644 drivers/staging/fsl_ppfe/include/pfe/cbus/class_csr.h
+ create mode 100644 drivers/staging/fsl_ppfe/include/pfe/cbus/emac_mtip.h
+ create mode 100644 drivers/staging/fsl_ppfe/include/pfe/cbus/gpi.h
+ create mode 100644 drivers/staging/fsl_ppfe/include/pfe/cbus/hif.h
+ create mode 100644 drivers/staging/fsl_ppfe/include/pfe/cbus/hif_nocpy.h
+ create mode 100644 drivers/staging/fsl_ppfe/include/pfe/cbus/tmu_csr.h
+ create mode 100644 drivers/staging/fsl_ppfe/include/pfe/cbus/util_csr.h
+ create mode 100644 drivers/staging/fsl_ppfe/include/pfe/pfe.h
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_cdev.c
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_cdev.h
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_ctrl.c
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_ctrl.h
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_debugfs.c
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_debugfs.h
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_eth.c
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_eth.h
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_firmware.c
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_firmware.h
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_hal.c
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_hif.c
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_hif.h
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_hif_lib.c
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_hif_lib.h
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_hw.c
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_hw.h
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_ls1012a_platform.c
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_mod.c
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_mod.h
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_perfmon.h
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_sysfs.c
+ create mode 100644 drivers/staging/fsl_ppfe/pfe_sysfs.h
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/net/fsl_ppfe/pfe.txt
+@@ -0,0 +1,199 @@
++=============================================================================
++NXP Programmable Packet Forwarding Engine Device Bindings
++
++CONTENTS
++  - PFE Node
++  - Ethernet Node
++
++=============================================================================
++PFE Node
++
++DESCRIPTION
++
++PFE Node has all the properties associated with Packet Forwarding Engine block.
++
++PROPERTIES
++
++- compatible
++		Usage: required
++		Value type: <stringlist>
++		Definition: Must include "fsl,pfe"
++
++- reg
++		Usage: required
++		Value type: <prop-encoded-array>
++		Definition: A standard property.
++		Specifies the offset of the following registers:
++		- PFE configuration registers
++		- DDR memory used by PFE
++
++- fsl,pfe-num-interfaces
++		Usage: required
++		Value type: <u32>
++		Definition: Must be present. Value can be either one or two.
++
++- interrupts
++		Usage: required
++		Value type: <prop-encoded-array>
++		Definition: Three interrupts are specified in this property.
++		- HIF interrupt
++		- HIF NO COPY interrupt
++		- Wake On LAN interrupt
++
++- interrupt-names
++		Usage: required
++		Value type: <stringlist>
++		Definition: Following strings are defined for the 3 interrupts.
++		"pfe_hif" - HIF interrupt
++		"pfe_hif_nocpy" - HIF NO COPY interrupt
++		"pfe_wol" - Wake On LAN interrupt
++
++- memory-region
++		Usage: required
++		Value type: <phandle>
++		Definition: phandle to a node describing reserved memory used by pfe.
++		Refer:- Documentation/devicetree/bindings/reserved-memory/reserved-memory.txt
++
++- fsl,pfe-scfg
++		Usage: required
++		Value type: <phandle>
++		Definition: phandle for scfg.
++
++- fsl,rcpm-wakeup
++		Usage: required
++		Value type: <phandle>
++		Definition: phandle for rcpm.
++
++- clocks
++		Usage: required
++		Value type: <phandle>
++		Definition: phandle for clockgen.
++
++- clock-names
++		Usage: required
++		Value type: <string>
++		Definition: phandle for clock name.
++
++EXAMPLE
++
++pfe: pfe@04000000 {
++	compatible = "fsl,pfe";
++	reg =   <0x0 0x04000000 0x0 0xc00000>,	/* AXI 16M */
++		<0x0 0x83400000 0x0 0xc00000>;  /* PFE DDR 12M */
++	reg-names = "pfe", "pfe-ddr";
++	fsl,pfe-num-interfaces = <0x2>;
++	interrupts = <0 172 0x4>,    /* HIF interrupt */
++		     <0 173 0x4>,    /*HIF_NOCPY interrupt */
++		     <0 174 0x4>;    /* WoL interrupt */
++	interrupt-names = "pfe_hif", "pfe_hif_nocpy", "pfe_wol";
++	memory-region = <&pfe_reserved>;
++	fsl,pfe-scfg = <&scfg 0>;
++	fsl,rcpm-wakeup = <&rcpm 0xf0000020>;
++	clocks = <&clockgen 4 0>;
++	clock-names = "pfe";
++
++	status = "okay";
++	pfe_mac0: ethernet@0 {
++	};
++
++	pfe_mac1: ethernet@1 {
++	};
++};
++
++=============================================================================
++Ethernet Node
++
++DESCRIPTION
++
++Ethernet Node has all the properties associated with PFE used by platforms to
++connect to PHY:
++
++PROPERTIES
++
++- compatible
++		Usage: required
++		Value type: <stringlist>
++		Definition: Must include "fsl,pfe-gemac-port"
++
++- reg
++		Usage: required
++		Value type: <prop-encoded-array>
++		Definition: A standard property.
++		Specifies the gemacid of the interface.
++
++- fsl,gemac-bus-id
++		Usage: required
++		Value type: <u32>
++		Definition: Must be present. Value should be the id of the bus
++		connected to gemac.
++
++- fsl,gemac-phy-id (deprecated binding)
++               Usage: required
++               Value type: <u32>
++               Definition: This binding shouldn't be used with new platforms.
++	       Must be present. Value should be the id of the phy
++               connected to gemac.
++
++- fsl,mdio-mux-val
++		Usage: required
++		Value type: <u32>
++		Definition: Must be present. Value can be either 0 or 2 or 3.
++		This value is used to configure the mux to enable mdio.
++
++- phy-mode
++		Usage: required
++		Value type: <string>
++		Definition: Must include "sgmii"
++
++- fsl,pfe-phy-if-flags (deprecated binding)
++               Usage: required
++               Value type: <u32>
++               Definition: This binding shouldn't be used with new platforms.
++               Must be present. Value should be 0 by default.
++               If there is not phy connected, this need to be 1.
++
++- phy-handle
++		Usage: optional
++		Value type: <phandle>
++		Definition: phandle to the PHY device connected to this device.
++
++- mdio : A required subnode which specifies the mdio bus in the PFE and used as
++a container for phy nodes according to ../phy.txt.
++
++EXAMPLE
++
++ethernet@0 {
++	compatible = "fsl,pfe-gemac-port";
++	#address-cells = <1>;
++	#size-cells = <0>;
++	reg = <0x0>;	/* GEM_ID */
++	fsl,gemac-bus-id = <0x0>;	/* BUS_ID */
++	fsl,mdio-mux-val = <0x0>;
++	phy-mode = "sgmii";
++	phy-handle = <&sgmii_phy1>;
++};
++
++
++ethernet@1 {
++	compatible = "fsl,pfe-gemac-port";
++	#address-cells = <1>;
++	#size-cells = <0>;
++	reg = <0x1>;	/* GEM_ID */
++	fsl,gemac-bus-id = <0x1>;	/* BUS_ID */
++	fsl,mdio-mux-val = <0x0>;
++	phy-mode = "sgmii";
++	phy-handle = <&sgmii_phy2>;
++};
++
++mdio@0 {
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	sgmii_phy1: ethernet-phy@2 {
++		reg = <0x2>;
++	};
++
++	sgmii_phy2: ethernet-phy@1 {
++		reg = <0x1>;
++	};
++};
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -7526,6 +7526,14 @@ F:	drivers/ptp/ptp_qoriq.c
+ F:	drivers/ptp/ptp_qoriq_debugfs.c
+ F:	include/linux/fsl/ptp_qoriq.h
+ 
++FREESCALE QORIQ PPFE ETHERNET DRIVER
++M:	Anji Jagarlmudi <anji.jagarlmudi@nxp.com>
++M:	Calvin Johnson <calvin.johnson@nxp.com>
++L:	netdev@vger.kernel.org
++S:	Maintained
++F:	drivers/staging/fsl_ppfe
++F:	Documentation/devicetree/bindings/net/fsl_ppfe/pfe.txt
++
+ FREESCALE QUAD SPI DRIVER
+ M:	Han Xu <han.xu@nxp.com>
+ L:	linux-spi@vger.kernel.org
+--- a/drivers/staging/Kconfig
++++ b/drivers/staging/Kconfig
+@@ -102,4 +102,6 @@ source "drivers/staging/qlge/Kconfig"
+ 
+ source "drivers/staging/wfx/Kconfig"
+ 
++source "drivers/staging/fsl_ppfe/Kconfig"
++
+ endif # STAGING
+--- a/drivers/staging/Makefile
++++ b/drivers/staging/Makefile
+@@ -41,3 +41,4 @@ obj-$(CONFIG_XIL_AXIS_FIFO)	+= axis-fifo
+ obj-$(CONFIG_FIELDBUS_DEV)     += fieldbus/
+ obj-$(CONFIG_QLGE)		+= qlge/
+ obj-$(CONFIG_WFX)		+= wfx/
++obj-$(CONFIG_FSL_PPFE)		+= fsl_ppfe/
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/Kconfig
+@@ -0,0 +1,21 @@
++#
++# Freescale Programmable Packet Forwarding Engine driver
++#
++config FSL_PPFE
++	tristate "Freescale PPFE Driver"
++	select FSL_GUTS
++	default n
++	help
++	Freescale LS1012A SoC has a Programmable Packet Forwarding Engine.
++	It provides two high performance ethernet interfaces.
++	This driver initializes, programs and controls the PPFE.
++	Use this driver to enable network connectivity on LS1012A platforms.
++
++if FSL_PPFE
++
++config FSL_PPFE_UTIL_DISABLED
++	bool "Disable PPFE UTIL Processor Engine"
++	help
++	UTIL PE has to be enabled only if required.
++
++endif # FSL_PPFE
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/Makefile
+@@ -0,0 +1,20 @@
++#
++# Makefile for Freesecale PPFE driver
++#
++
++ccflags-y +=  -I $(srctree)/$(src)/include  -I $(srctree)/$(src)
++
++obj-$(CONFIG_FSL_PPFE) += pfe.o
++
++pfe-y += pfe_mod.o \
++	pfe_hw.o \
++	pfe_firmware.o \
++	pfe_ctrl.o \
++	pfe_hif.o \
++	pfe_hif_lib.o\
++	pfe_eth.o \
++	pfe_sysfs.o \
++	pfe_debugfs.o \
++	pfe_ls1012a_platform.o \
++	pfe_hal.o \
++	pfe_cdev.o
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/TODO
+@@ -0,0 +1,2 @@
++TODO:
++	- provide pfe pe monitoring support
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/include/pfe/cbus.h
+@@ -0,0 +1,78 @@
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#ifndef _CBUS_H_
++#define _CBUS_H_
++
++#define EMAC1_BASE_ADDR	(CBUS_BASE_ADDR + 0x200000)
++#define EGPI1_BASE_ADDR	(CBUS_BASE_ADDR + 0x210000)
++#define EMAC2_BASE_ADDR	(CBUS_BASE_ADDR + 0x220000)
++#define EGPI2_BASE_ADDR	(CBUS_BASE_ADDR + 0x230000)
++#define BMU1_BASE_ADDR	(CBUS_BASE_ADDR + 0x240000)
++#define BMU2_BASE_ADDR	(CBUS_BASE_ADDR + 0x250000)
++#define ARB_BASE_ADDR	(CBUS_BASE_ADDR + 0x260000)
++#define DDR_CONFIG_BASE_ADDR	(CBUS_BASE_ADDR + 0x270000)
++#define HIF_BASE_ADDR	(CBUS_BASE_ADDR + 0x280000)
++#define HGPI_BASE_ADDR	(CBUS_BASE_ADDR + 0x290000)
++#define LMEM_BASE_ADDR	(CBUS_BASE_ADDR + 0x300000)
++#define LMEM_SIZE	0x10000
++#define LMEM_END	(LMEM_BASE_ADDR + LMEM_SIZE)
++#define TMU_CSR_BASE_ADDR	(CBUS_BASE_ADDR + 0x310000)
++#define CLASS_CSR_BASE_ADDR	(CBUS_BASE_ADDR + 0x320000)
++#define HIF_NOCPY_BASE_ADDR	(CBUS_BASE_ADDR + 0x350000)
++#define UTIL_CSR_BASE_ADDR	(CBUS_BASE_ADDR + 0x360000)
++#define CBUS_GPT_BASE_ADDR	(CBUS_BASE_ADDR + 0x370000)
++
++/*
++ * defgroup XXX_MEM_ACCESS_ADDR PE memory access through CSR
++ * XXX_MEM_ACCESS_ADDR register bit definitions.
++ */
++#define PE_MEM_ACCESS_WRITE	BIT(31)	/* Internal Memory Write. */
++#define PE_MEM_ACCESS_IMEM	BIT(15)
++#define PE_MEM_ACCESS_DMEM	BIT(16)
++
++/* Byte Enables of the Internal memory access. These are interpred in BE */
++#define PE_MEM_ACCESS_BYTE_ENABLE(offset, size)	\
++	({ typeof(size) size_ = (size);		\
++	(((BIT(size_) - 1) << (4 - (offset) - (size_))) & 0xf) << 24; })
++
++#include "cbus/emac_mtip.h"
++#include "cbus/gpi.h"
++#include "cbus/bmu.h"
++#include "cbus/hif.h"
++#include "cbus/tmu_csr.h"
++#include "cbus/class_csr.h"
++#include "cbus/hif_nocpy.h"
++#include "cbus/util_csr.h"
++
++/* PFE cores states */
++#define CORE_DISABLE	0x00000000
++#define CORE_ENABLE	0x00000001
++#define CORE_SW_RESET	0x00000002
++
++/* LMEM defines */
++#define LMEM_HDR_SIZE	0x0010
++#define LMEM_BUF_SIZE_LN2	0x7
++#define LMEM_BUF_SIZE	BIT(LMEM_BUF_SIZE_LN2)
++
++/* DDR defines */
++#define DDR_HDR_SIZE	0x0100
++#define DDR_BUF_SIZE_LN2	0xb
++#define DDR_BUF_SIZE	BIT(DDR_BUF_SIZE_LN2)
++
++#endif /* _CBUS_H_ */
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/include/pfe/cbus/bmu.h
+@@ -0,0 +1,55 @@
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#ifndef _BMU_H_
++#define _BMU_H_
++
++#define BMU_VERSION	0x000
++#define BMU_CTRL	0x004
++#define BMU_UCAST_CONFIG	0x008
++#define BMU_UCAST_BASE_ADDR	0x00c
++#define BMU_BUF_SIZE	0x010
++#define BMU_BUF_CNT	0x014
++#define BMU_THRES	0x018
++#define BMU_INT_SRC	0x020
++#define BMU_INT_ENABLE	0x024
++#define BMU_ALLOC_CTRL	0x030
++#define BMU_FREE_CTRL	0x034
++#define BMU_FREE_ERR_ADDR	0x038
++#define BMU_CURR_BUF_CNT	0x03c
++#define BMU_MCAST_CNT	0x040
++#define BMU_MCAST_ALLOC_CTRL	0x044
++#define BMU_REM_BUF_CNT	0x048
++#define BMU_LOW_WATERMARK	0x050
++#define BMU_HIGH_WATERMARK	0x054
++#define BMU_INT_MEM_ACCESS	0x100
++
++struct BMU_CFG {
++	unsigned long baseaddr;
++	u32 count;
++	u32 size;
++	u32 low_watermark;
++	u32 high_watermark;
++};
++
++#define BMU1_BUF_SIZE	LMEM_BUF_SIZE_LN2
++#define BMU2_BUF_SIZE	DDR_BUF_SIZE_LN2
++
++#define BMU2_MCAST_ALLOC_CTRL	(BMU2_BASE_ADDR + BMU_MCAST_ALLOC_CTRL)
++
++#endif /* _BMU_H_ */
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/include/pfe/cbus/class_csr.h
+@@ -0,0 +1,289 @@
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#ifndef _CLASS_CSR_H_
++#define _CLASS_CSR_H_
++
++/* @file class_csr.h.
++ * class_csr - block containing all the classifier control and status register.
++ * Mapped on CBUS and accessible from all PE's and ARM.
++ */
++#define CLASS_VERSION	(CLASS_CSR_BASE_ADDR + 0x000)
++#define CLASS_TX_CTRL	(CLASS_CSR_BASE_ADDR + 0x004)
++#define CLASS_INQ_PKTPTR	(CLASS_CSR_BASE_ADDR + 0x010)
++
++/* (ddr_hdr_size[24:16], lmem_hdr_size[5:0]) */
++#define CLASS_HDR_SIZE	(CLASS_CSR_BASE_ADDR + 0x014)
++
++/* LMEM header size for the Classifier block.\ Data in the LMEM
++ * is written from this offset.
++ */
++#define CLASS_HDR_SIZE_LMEM(off)	((off) & 0x3f)
++
++/* DDR header size for the Classifier block.\ Data in the DDR
++ * is written from this offset.
++ */
++#define CLASS_HDR_SIZE_DDR(off)	(((off) & 0x1ff) << 16)
++
++#define CLASS_PE0_QB_DM_ADDR0	(CLASS_CSR_BASE_ADDR + 0x020)
++
++/* DMEM address of first [15:0] and second [31:16] buffers on QB side. */
++#define CLASS_PE0_QB_DM_ADDR1	(CLASS_CSR_BASE_ADDR + 0x024)
++
++/* DMEM address of third [15:0] and fourth [31:16] buffers on QB side. */
++#define CLASS_PE0_RO_DM_ADDR0	(CLASS_CSR_BASE_ADDR + 0x060)
++
++/* DMEM address of first [15:0] and second [31:16] buffers on RO side. */
++#define CLASS_PE0_RO_DM_ADDR1	(CLASS_CSR_BASE_ADDR + 0x064)
++
++/* DMEM address of third [15:0] and fourth [31:16] buffers on RO side. */
++
++/* @name Class PE memory access. Allows external PE's and HOST to
++ * read/write PMEM/DMEM memory ranges for each classifier PE.
++ */
++/* {sr_pe_mem_cmd[31], csr_pe_mem_wren[27:24], csr_pe_mem_addr[23:0]},
++ * See \ref XXX_MEM_ACCESS_ADDR for details.
++ */
++#define CLASS_MEM_ACCESS_ADDR	(CLASS_CSR_BASE_ADDR + 0x100)
++
++/* Internal Memory Access Write Data [31:0] */
++#define CLASS_MEM_ACCESS_WDATA	(CLASS_CSR_BASE_ADDR + 0x104)
++
++/* Internal Memory Access Read Data [31:0] */
++#define CLASS_MEM_ACCESS_RDATA	(CLASS_CSR_BASE_ADDR + 0x108)
++#define CLASS_TM_INQ_ADDR	(CLASS_CSR_BASE_ADDR + 0x114)
++#define CLASS_PE_STATUS	(CLASS_CSR_BASE_ADDR + 0x118)
++
++#define CLASS_PHY1_RX_PKTS	(CLASS_CSR_BASE_ADDR + 0x11c)
++#define CLASS_PHY1_TX_PKTS	(CLASS_CSR_BASE_ADDR + 0x120)
++#define CLASS_PHY1_LP_FAIL_PKTS	(CLASS_CSR_BASE_ADDR + 0x124)
++#define CLASS_PHY1_INTF_FAIL_PKTS	(CLASS_CSR_BASE_ADDR + 0x128)
++#define CLASS_PHY1_INTF_MATCH_PKTS	(CLASS_CSR_BASE_ADDR + 0x12c)
++#define CLASS_PHY1_L3_FAIL_PKTS	(CLASS_CSR_BASE_ADDR + 0x130)
++#define CLASS_PHY1_V4_PKTS	(CLASS_CSR_BASE_ADDR + 0x134)
++#define CLASS_PHY1_V6_PKTS	(CLASS_CSR_BASE_ADDR + 0x138)
++#define CLASS_PHY1_CHKSUM_ERR_PKTS	(CLASS_CSR_BASE_ADDR + 0x13c)
++#define CLASS_PHY1_TTL_ERR_PKTS	(CLASS_CSR_BASE_ADDR + 0x140)
++#define CLASS_PHY2_RX_PKTS	(CLASS_CSR_BASE_ADDR + 0x144)
++#define CLASS_PHY2_TX_PKTS	(CLASS_CSR_BASE_ADDR + 0x148)
++#define CLASS_PHY2_LP_FAIL_PKTS	(CLASS_CSR_BASE_ADDR + 0x14c)
++#define CLASS_PHY2_INTF_FAIL_PKTS	(CLASS_CSR_BASE_ADDR + 0x150)
++#define CLASS_PHY2_INTF_MATCH_PKTS	(CLASS_CSR_BASE_ADDR + 0x154)
++#define CLASS_PHY2_L3_FAIL_PKTS	(CLASS_CSR_BASE_ADDR + 0x158)
++#define CLASS_PHY2_V4_PKTS	(CLASS_CSR_BASE_ADDR + 0x15c)
++#define CLASS_PHY2_V6_PKTS	(CLASS_CSR_BASE_ADDR + 0x160)
++#define CLASS_PHY2_CHKSUM_ERR_PKTS	(CLASS_CSR_BASE_ADDR + 0x164)
++#define CLASS_PHY2_TTL_ERR_PKTS	(CLASS_CSR_BASE_ADDR + 0x168)
++#define CLASS_PHY3_RX_PKTS	(CLASS_CSR_BASE_ADDR + 0x16c)
++#define CLASS_PHY3_TX_PKTS	(CLASS_CSR_BASE_ADDR + 0x170)
++#define CLASS_PHY3_LP_FAIL_PKTS	(CLASS_CSR_BASE_ADDR + 0x174)
++#define CLASS_PHY3_INTF_FAIL_PKTS	(CLASS_CSR_BASE_ADDR + 0x178)
++#define CLASS_PHY3_INTF_MATCH_PKTS	(CLASS_CSR_BASE_ADDR + 0x17c)
++#define CLASS_PHY3_L3_FAIL_PKTS	(CLASS_CSR_BASE_ADDR + 0x180)
++#define CLASS_PHY3_V4_PKTS	(CLASS_CSR_BASE_ADDR + 0x184)
++#define CLASS_PHY3_V6_PKTS	(CLASS_CSR_BASE_ADDR + 0x188)
++#define CLASS_PHY3_CHKSUM_ERR_PKTS	(CLASS_CSR_BASE_ADDR + 0x18c)
++#define CLASS_PHY3_TTL_ERR_PKTS	(CLASS_CSR_BASE_ADDR + 0x190)
++#define CLASS_PHY1_ICMP_PKTS	(CLASS_CSR_BASE_ADDR + 0x194)
++#define CLASS_PHY1_IGMP_PKTS	(CLASS_CSR_BASE_ADDR + 0x198)
++#define CLASS_PHY1_TCP_PKTS	(CLASS_CSR_BASE_ADDR + 0x19c)
++#define CLASS_PHY1_UDP_PKTS	(CLASS_CSR_BASE_ADDR + 0x1a0)
++#define CLASS_PHY2_ICMP_PKTS	(CLASS_CSR_BASE_ADDR + 0x1a4)
++#define CLASS_PHY2_IGMP_PKTS	(CLASS_CSR_BASE_ADDR + 0x1a8)
++#define CLASS_PHY2_TCP_PKTS	(CLASS_CSR_BASE_ADDR + 0x1ac)
++#define CLASS_PHY2_UDP_PKTS	(CLASS_CSR_BASE_ADDR + 0x1b0)
++#define CLASS_PHY3_ICMP_PKTS	(CLASS_CSR_BASE_ADDR + 0x1b4)
++#define CLASS_PHY3_IGMP_PKTS	(CLASS_CSR_BASE_ADDR + 0x1b8)
++#define CLASS_PHY3_TCP_PKTS	(CLASS_CSR_BASE_ADDR + 0x1bc)
++#define CLASS_PHY3_UDP_PKTS	(CLASS_CSR_BASE_ADDR + 0x1c0)
++#define CLASS_PHY4_ICMP_PKTS	(CLASS_CSR_BASE_ADDR + 0x1c4)
++#define CLASS_PHY4_IGMP_PKTS	(CLASS_CSR_BASE_ADDR + 0x1c8)
++#define CLASS_PHY4_TCP_PKTS	(CLASS_CSR_BASE_ADDR + 0x1cc)
++#define CLASS_PHY4_UDP_PKTS	(CLASS_CSR_BASE_ADDR + 0x1d0)
++#define CLASS_PHY4_RX_PKTS	(CLASS_CSR_BASE_ADDR + 0x1d4)
++#define CLASS_PHY4_TX_PKTS	(CLASS_CSR_BASE_ADDR + 0x1d8)
++#define CLASS_PHY4_LP_FAIL_PKTS	(CLASS_CSR_BASE_ADDR + 0x1dc)
++#define CLASS_PHY4_INTF_FAIL_PKTS	(CLASS_CSR_BASE_ADDR + 0x1e0)
++#define CLASS_PHY4_INTF_MATCH_PKTS	(CLASS_CSR_BASE_ADDR + 0x1e4)
++#define CLASS_PHY4_L3_FAIL_PKTS	(CLASS_CSR_BASE_ADDR + 0x1e8)
++#define CLASS_PHY4_V4_PKTS	(CLASS_CSR_BASE_ADDR + 0x1ec)
++#define CLASS_PHY4_V6_PKTS	(CLASS_CSR_BASE_ADDR + 0x1f0)
++#define CLASS_PHY4_CHKSUM_ERR_PKTS	(CLASS_CSR_BASE_ADDR + 0x1f4)
++#define CLASS_PHY4_TTL_ERR_PKTS	(CLASS_CSR_BASE_ADDR + 0x1f8)
++
++#define CLASS_PE_SYS_CLK_RATIO	(CLASS_CSR_BASE_ADDR + 0x200)
++#define CLASS_AFULL_THRES	(CLASS_CSR_BASE_ADDR + 0x204)
++#define CLASS_GAP_BETWEEN_READS	(CLASS_CSR_BASE_ADDR + 0x208)
++#define CLASS_MAX_BUF_CNT	(CLASS_CSR_BASE_ADDR + 0x20c)
++#define CLASS_TSQ_FIFO_THRES	(CLASS_CSR_BASE_ADDR + 0x210)
++#define CLASS_TSQ_MAX_CNT	(CLASS_CSR_BASE_ADDR + 0x214)
++#define CLASS_IRAM_DATA_0	(CLASS_CSR_BASE_ADDR + 0x218)
++#define CLASS_IRAM_DATA_1	(CLASS_CSR_BASE_ADDR + 0x21c)
++#define CLASS_IRAM_DATA_2	(CLASS_CSR_BASE_ADDR + 0x220)
++#define CLASS_IRAM_DATA_3	(CLASS_CSR_BASE_ADDR + 0x224)
++
++#define CLASS_BUS_ACCESS_ADDR	(CLASS_CSR_BASE_ADDR + 0x228)
++
++#define CLASS_BUS_ACCESS_WDATA	(CLASS_CSR_BASE_ADDR + 0x22c)
++#define CLASS_BUS_ACCESS_RDATA	(CLASS_CSR_BASE_ADDR + 0x230)
++
++/* (route_entry_size[9:0], route_hash_size[23:16]
++ * (this is actually ln2(size)))
++ */
++#define CLASS_ROUTE_HASH_ENTRY_SIZE	(CLASS_CSR_BASE_ADDR + 0x234)
++
++#define CLASS_ROUTE_ENTRY_SIZE(size)	 ((size) & 0x1ff)
++#define CLASS_ROUTE_HASH_SIZE(hash_bits) (((hash_bits) & 0xff) << 16)
++
++#define CLASS_ROUTE_TABLE_BASE	(CLASS_CSR_BASE_ADDR + 0x238)
++
++#define CLASS_ROUTE_MULTI	(CLASS_CSR_BASE_ADDR + 0x23c)
++#define CLASS_SMEM_OFFSET	(CLASS_CSR_BASE_ADDR + 0x240)
++#define CLASS_LMEM_BUF_SIZE	(CLASS_CSR_BASE_ADDR + 0x244)
++#define CLASS_VLAN_ID	(CLASS_CSR_BASE_ADDR + 0x248)
++#define CLASS_BMU1_BUF_FREE	(CLASS_CSR_BASE_ADDR + 0x24c)
++#define CLASS_USE_TMU_INQ	(CLASS_CSR_BASE_ADDR + 0x250)
++#define CLASS_VLAN_ID1	(CLASS_CSR_BASE_ADDR + 0x254)
++
++#define CLASS_BUS_ACCESS_BASE	(CLASS_CSR_BASE_ADDR + 0x258)
++#define CLASS_BUS_ACCESS_BASE_MASK	(0xFF000000)
++/* bit 31:24 of PE peripheral address are stored in CLASS_BUS_ACCESS_BASE */
++
++#define CLASS_HIF_PARSE	(CLASS_CSR_BASE_ADDR + 0x25c)
++
++#define CLASS_HOST_PE0_GP	(CLASS_CSR_BASE_ADDR + 0x260)
++#define CLASS_PE0_GP	(CLASS_CSR_BASE_ADDR + 0x264)
++#define CLASS_HOST_PE1_GP	(CLASS_CSR_BASE_ADDR + 0x268)
++#define CLASS_PE1_GP	(CLASS_CSR_BASE_ADDR + 0x26c)
++#define CLASS_HOST_PE2_GP	(CLASS_CSR_BASE_ADDR + 0x270)
++#define CLASS_PE2_GP	(CLASS_CSR_BASE_ADDR + 0x274)
++#define CLASS_HOST_PE3_GP	(CLASS_CSR_BASE_ADDR + 0x278)
++#define CLASS_PE3_GP	(CLASS_CSR_BASE_ADDR + 0x27c)
++#define CLASS_HOST_PE4_GP	(CLASS_CSR_BASE_ADDR + 0x280)
++#define CLASS_PE4_GP	(CLASS_CSR_BASE_ADDR + 0x284)
++#define CLASS_HOST_PE5_GP	(CLASS_CSR_BASE_ADDR + 0x288)
++#define CLASS_PE5_GP	(CLASS_CSR_BASE_ADDR + 0x28c)
++
++#define CLASS_PE_INT_SRC	(CLASS_CSR_BASE_ADDR + 0x290)
++#define CLASS_PE_INT_ENABLE	(CLASS_CSR_BASE_ADDR + 0x294)
++
++#define CLASS_TPID0_TPID1	(CLASS_CSR_BASE_ADDR + 0x298)
++#define CLASS_TPID2	(CLASS_CSR_BASE_ADDR + 0x29c)
++
++#define CLASS_L4_CHKSUM_ADDR	(CLASS_CSR_BASE_ADDR + 0x2a0)
++
++#define CLASS_PE0_DEBUG	(CLASS_CSR_BASE_ADDR + 0x2a4)
++#define CLASS_PE1_DEBUG	(CLASS_CSR_BASE_ADDR + 0x2a8)
++#define CLASS_PE2_DEBUG	(CLASS_CSR_BASE_ADDR + 0x2ac)
++#define CLASS_PE3_DEBUG	(CLASS_CSR_BASE_ADDR + 0x2b0)
++#define CLASS_PE4_DEBUG	(CLASS_CSR_BASE_ADDR + 0x2b4)
++#define CLASS_PE5_DEBUG	(CLASS_CSR_BASE_ADDR + 0x2b8)
++
++#define CLASS_STATE	(CLASS_CSR_BASE_ADDR + 0x2bc)
++
++/* CLASS defines */
++#define CLASS_PBUF_SIZE	0x100	/* Fixed by hardware */
++#define CLASS_PBUF_HEADER_OFFSET	0x80	/* Can be configured */
++
++/* Can be configured */
++#define CLASS_PBUF0_BASE_ADDR	0x000
++/* Can be configured */
++#define CLASS_PBUF1_BASE_ADDR	(CLASS_PBUF0_BASE_ADDR + CLASS_PBUF_SIZE)
++/* Can be configured */
++#define CLASS_PBUF2_BASE_ADDR	(CLASS_PBUF1_BASE_ADDR + CLASS_PBUF_SIZE)
++/* Can be configured */
++#define CLASS_PBUF3_BASE_ADDR	(CLASS_PBUF2_BASE_ADDR + CLASS_PBUF_SIZE)
++
++#define CLASS_PBUF0_HEADER_BASE_ADDR	(CLASS_PBUF0_BASE_ADDR + \
++						CLASS_PBUF_HEADER_OFFSET)
++#define CLASS_PBUF1_HEADER_BASE_ADDR	(CLASS_PBUF1_BASE_ADDR + \
++						CLASS_PBUF_HEADER_OFFSET)
++#define CLASS_PBUF2_HEADER_BASE_ADDR	(CLASS_PBUF2_BASE_ADDR + \
++						CLASS_PBUF_HEADER_OFFSET)
++#define CLASS_PBUF3_HEADER_BASE_ADDR	(CLASS_PBUF3_BASE_ADDR + \
++						CLASS_PBUF_HEADER_OFFSET)
++
++#define CLASS_PE0_RO_DM_ADDR0_VAL	((CLASS_PBUF1_BASE_ADDR << 16) | \
++						CLASS_PBUF0_BASE_ADDR)
++#define CLASS_PE0_RO_DM_ADDR1_VAL	((CLASS_PBUF3_BASE_ADDR << 16) | \
++						CLASS_PBUF2_BASE_ADDR)
++
++#define CLASS_PE0_QB_DM_ADDR0_VAL	((CLASS_PBUF1_HEADER_BASE_ADDR << 16) |\
++						CLASS_PBUF0_HEADER_BASE_ADDR)
++#define CLASS_PE0_QB_DM_ADDR1_VAL	((CLASS_PBUF3_HEADER_BASE_ADDR << 16) |\
++						CLASS_PBUF2_HEADER_BASE_ADDR)
++
++#define CLASS_ROUTE_SIZE	128
++#define CLASS_MAX_ROUTE_SIZE	256
++#define CLASS_ROUTE_HASH_BITS	20
++#define CLASS_ROUTE_HASH_MASK	(BIT(CLASS_ROUTE_HASH_BITS) - 1)
++
++/* Can be configured */
++#define	CLASS_ROUTE0_BASE_ADDR	0x400
++/* Can be configured */
++#define CLASS_ROUTE1_BASE_ADDR	(CLASS_ROUTE0_BASE_ADDR + CLASS_ROUTE_SIZE)
++/* Can be configured */
++#define CLASS_ROUTE2_BASE_ADDR	(CLASS_ROUTE1_BASE_ADDR + CLASS_ROUTE_SIZE)
++/* Can be configured */
++#define CLASS_ROUTE3_BASE_ADDR	(CLASS_ROUTE2_BASE_ADDR + CLASS_ROUTE_SIZE)
++
++#define CLASS_SA_SIZE	128
++#define CLASS_IPSEC_SA0_BASE_ADDR	0x600
++/* not used */
++#define CLASS_IPSEC_SA1_BASE_ADDR  (CLASS_IPSEC_SA0_BASE_ADDR + CLASS_SA_SIZE)
++/* not used */
++#define CLASS_IPSEC_SA2_BASE_ADDR  (CLASS_IPSEC_SA1_BASE_ADDR + CLASS_SA_SIZE)
++/* not used */
++#define CLASS_IPSEC_SA3_BASE_ADDR  (CLASS_IPSEC_SA2_BASE_ADDR + CLASS_SA_SIZE)
++
++/* generic purpose free dmem buffer, last portion of 2K dmem pbuf */
++#define CLASS_GP_DMEM_BUF_SIZE	(2048 - (CLASS_PBUF_SIZE * 4) - \
++				(CLASS_ROUTE_SIZE * 4) - (CLASS_SA_SIZE))
++#define CLASS_GP_DMEM_BUF	((void *)(CLASS_IPSEC_SA0_BASE_ADDR + \
++					CLASS_SA_SIZE))
++
++#define TWO_LEVEL_ROUTE		BIT(0)
++#define PHYNO_IN_HASH		BIT(1)
++#define HW_ROUTE_FETCH		BIT(3)
++#define HW_BRIDGE_FETCH		BIT(5)
++#define IP_ALIGNED		BIT(6)
++#define ARC_HIT_CHECK_EN	BIT(7)
++#define CLASS_TOE		BIT(11)
++#define HASH_NORMAL		(0 << 12)
++#define HASH_CRC_PORT		BIT(12)
++#define HASH_CRC_IP		(2 << 12)
++#define HASH_CRC_PORT_IP	(3 << 12)
++#define QB2BUS_LE		BIT(15)
++
++#define TCP_CHKSUM_DROP		BIT(0)
++#define UDP_CHKSUM_DROP		BIT(1)
++#define IPV4_CHKSUM_DROP	BIT(9)
++
++/*CLASS_HIF_PARSE bits*/
++#define HIF_PKT_CLASS_EN	BIT(0)
++#define HIF_PKT_OFFSET(ofst)	(((ofst) & 0xF) << 1)
++
++struct class_cfg {
++	u32 toe_mode;
++	unsigned long route_table_baseaddr;
++	u32 route_table_hash_bits;
++	u32 pe_sys_clk_ratio;
++	u32 resume;
++};
++
++#endif /* _CLASS_CSR_H_ */
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/include/pfe/cbus/emac_mtip.h
+@@ -0,0 +1,242 @@
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#ifndef _EMAC_H_
++#define _EMAC_H_
++
++#include <linux/ethtool.h>
++
++#define EMAC_IEVENT_REG		0x004
++#define EMAC_IMASK_REG		0x008
++#define EMAC_R_DES_ACTIVE_REG	0x010
++#define EMAC_X_DES_ACTIVE_REG	0x014
++#define EMAC_ECNTRL_REG		0x024
++#define EMAC_MII_DATA_REG	0x040
++#define EMAC_MII_CTRL_REG	0x044
++#define EMAC_MIB_CTRL_STS_REG	0x064
++#define EMAC_RCNTRL_REG		0x084
++#define EMAC_TCNTRL_REG		0x0C4
++#define EMAC_PHY_ADDR_LOW	0x0E4
++#define EMAC_PHY_ADDR_HIGH	0x0E8
++#define EMAC_GAUR		0x120
++#define EMAC_GALR		0x124
++#define EMAC_TFWR_STR_FWD	0x144
++#define EMAC_RX_SECTION_FULL	0x190
++#define EMAC_RX_SECTION_EMPTY	0x194
++#define EMAC_TX_SECTION_EMPTY	0x1A0
++#define EMAC_TRUNC_FL		0x1B0
++
++#define RMON_T_DROP	0x200 /* Count of frames not cntd correctly */
++#define RMON_T_PACKETS	0x204 /* RMON TX packet count */
++#define RMON_T_BC_PKT	0x208 /* RMON TX broadcast pkts */
++#define RMON_T_MC_PKT	0x20c /* RMON TX multicast pkts */
++#define RMON_T_CRC_ALIGN	0x210 /* RMON TX pkts with CRC align err */
++#define RMON_T_UNDERSIZE	0x214 /* RMON TX pkts < 64 bytes, good CRC */
++#define RMON_T_OVERSIZE	0x218 /* RMON TX pkts > MAX_FL bytes good CRC */
++#define RMON_T_FRAG	0x21c /* RMON TX pkts < 64 bytes, bad CRC */
++#define RMON_T_JAB	0x220 /* RMON TX pkts > MAX_FL bytes, bad CRC */
++#define RMON_T_COL	0x224 /* RMON TX collision count */
++#define RMON_T_P64	0x228 /* RMON TX 64 byte pkts */
++#define RMON_T_P65TO127	0x22c /* RMON TX 65 to 127 byte pkts */
++#define RMON_T_P128TO255	0x230 /* RMON TX 128 to 255 byte pkts */
++#define RMON_T_P256TO511	0x234 /* RMON TX 256 to 511 byte pkts */
++#define RMON_T_P512TO1023	0x238 /* RMON TX 512 to 1023 byte pkts */
++#define RMON_T_P1024TO2047	0x23c /* RMON TX 1024 to 2047 byte pkts */
++#define RMON_T_P_GTE2048	0x240 /* RMON TX pkts > 2048 bytes */
++#define RMON_T_OCTETS	0x244 /* RMON TX octets */
++#define IEEE_T_DROP	0x248 /* Count of frames not counted crtly */
++#define IEEE_T_FRAME_OK	0x24c /* Frames tx'd OK */
++#define IEEE_T_1COL	0x250 /* Frames tx'd with single collision */
++#define IEEE_T_MCOL	0x254 /* Frames tx'd with multiple collision */
++#define IEEE_T_DEF	0x258 /* Frames tx'd after deferral delay */
++#define IEEE_T_LCOL	0x25c /* Frames tx'd with late collision */
++#define IEEE_T_EXCOL	0x260 /* Frames tx'd with excesv collisions */
++#define IEEE_T_MACERR	0x264 /* Frames tx'd with TX FIFO underrun */
++#define IEEE_T_CSERR	0x268 /* Frames tx'd with carrier sense err */
++#define IEEE_T_SQE	0x26c /* Frames tx'd with SQE err */
++#define IEEE_T_FDXFC	0x270 /* Flow control pause frames tx'd */
++#define IEEE_T_OCTETS_OK	0x274 /* Octet count for frames tx'd w/o err */
++#define RMON_R_PACKETS	0x284 /* RMON RX packet count */
++#define RMON_R_BC_PKT	0x288 /* RMON RX broadcast pkts */
++#define RMON_R_MC_PKT	0x28c /* RMON RX multicast pkts */
++#define RMON_R_CRC_ALIGN	0x290 /* RMON RX pkts with CRC alignment err */
++#define RMON_R_UNDERSIZE	0x294 /* RMON RX pkts < 64 bytes, good CRC */
++#define RMON_R_OVERSIZE	0x298 /* RMON RX pkts > MAX_FL bytes good CRC */
++#define RMON_R_FRAG	0x29c /* RMON RX pkts < 64 bytes, bad CRC */
++#define RMON_R_JAB	0x2a0 /* RMON RX pkts > MAX_FL bytes, bad CRC */
++#define RMON_R_RESVD_O	0x2a4 /* Reserved */
++#define RMON_R_P64	0x2a8 /* RMON RX 64 byte pkts */
++#define RMON_R_P65TO127	0x2ac /* RMON RX 65 to 127 byte pkts */
++#define RMON_R_P128TO255	0x2b0 /* RMON RX 128 to 255 byte pkts */
++#define RMON_R_P256TO511	0x2b4 /* RMON RX 256 to 511 byte pkts */
++#define RMON_R_P512TO1023	0x2b8 /* RMON RX 512 to 1023 byte pkts */
++#define RMON_R_P1024TO2047	0x2bc /* RMON RX 1024 to 2047 byte pkts */
++#define RMON_R_P_GTE2048	0x2c0 /* RMON RX pkts > 2048 bytes */
++#define RMON_R_OCTETS	0x2c4 /* RMON RX octets */
++#define IEEE_R_DROP	0x2c8 /* Count frames not counted correctly */
++#define IEEE_R_FRAME_OK	0x2cc /* Frames rx'd OK */
++#define IEEE_R_CRC	0x2d0 /* Frames rx'd with CRC err */
++#define IEEE_R_ALIGN	0x2d4 /* Frames rx'd with alignment err */
++#define IEEE_R_MACERR	0x2d8 /* Receive FIFO overflow count */
++#define IEEE_R_FDXFC	0x2dc /* Flow control pause frames rx'd */
++#define IEEE_R_OCTETS_OK	0x2e0 /* Octet cnt for frames rx'd w/o err */
++
++#define EMAC_SMAC_0_0	0x500 /*Supplemental MAC Address 0 (RW).*/
++#define EMAC_SMAC_0_1	0x504 /*Supplemental MAC Address 0 (RW).*/
++
++/* GEMAC definitions and settings */
++
++#define EMAC_PORT_0	0
++#define EMAC_PORT_1	1
++
++/* GEMAC Bit definitions */
++#define EMAC_IEVENT_HBERR		 0x80000000
++#define EMAC_IEVENT_BABR		 0x40000000
++#define EMAC_IEVENT_BABT		 0x20000000
++#define EMAC_IEVENT_GRA			 0x10000000
++#define EMAC_IEVENT_TXF			 0x08000000
++#define EMAC_IEVENT_TXB			 0x04000000
++#define EMAC_IEVENT_RXF			 0x02000000
++#define EMAC_IEVENT_RXB			 0x01000000
++#define EMAC_IEVENT_MII			 0x00800000
++#define EMAC_IEVENT_EBERR		 0x00400000
++#define EMAC_IEVENT_LC			 0x00200000
++#define EMAC_IEVENT_RL			 0x00100000
++#define EMAC_IEVENT_UN			 0x00080000
++
++#define EMAC_IMASK_HBERR                 0x80000000
++#define EMAC_IMASK_BABR                  0x40000000
++#define EMAC_IMASKT_BABT                 0x20000000
++#define EMAC_IMASK_GRA                   0x10000000
++#define EMAC_IMASKT_TXF                  0x08000000
++#define EMAC_IMASK_TXB                   0x04000000
++#define EMAC_IMASKT_RXF                  0x02000000
++#define EMAC_IMASK_RXB                   0x01000000
++#define EMAC_IMASK_MII                   0x00800000
++#define EMAC_IMASK_EBERR                 0x00400000
++#define EMAC_IMASK_LC                    0x00200000
++#define EMAC_IMASKT_RL                   0x00100000
++#define EMAC_IMASK_UN                    0x00080000
++
++#define EMAC_RCNTRL_MAX_FL_SHIFT         16
++#define EMAC_RCNTRL_LOOP                 0x00000001
++#define EMAC_RCNTRL_DRT                  0x00000002
++#define EMAC_RCNTRL_MII_MODE             0x00000004
++#define EMAC_RCNTRL_PROM                 0x00000008
++#define EMAC_RCNTRL_BC_REJ               0x00000010
++#define EMAC_RCNTRL_FCE                  0x00000020
++#define EMAC_RCNTRL_RGMII                0x00000040
++#define EMAC_RCNTRL_SGMII                0x00000080
++#define EMAC_RCNTRL_RMII                 0x00000100
++#define EMAC_RCNTRL_RMII_10T             0x00000200
++#define EMAC_RCNTRL_CRC_FWD		 0x00004000
++
++#define EMAC_TCNTRL_GTS                  0x00000001
++#define EMAC_TCNTRL_HBC                  0x00000002
++#define EMAC_TCNTRL_FDEN                 0x00000004
++#define EMAC_TCNTRL_TFC_PAUSE            0x00000008
++#define EMAC_TCNTRL_RFC_PAUSE            0x00000010
++
++#define EMAC_ECNTRL_RESET                0x00000001      /* reset the EMAC */
++#define EMAC_ECNTRL_ETHER_EN             0x00000002      /* enable the EMAC */
++#define EMAC_ECNTRL_MAGIC_ENA		 0x00000004
++#define EMAC_ECNTRL_SLEEP		 0x00000008
++#define EMAC_ECNTRL_SPEED                0x00000020
++#define EMAC_ECNTRL_DBSWAP               0x00000100
++
++#define EMAC_X_WMRK_STRFWD               0x00000100
++
++#define EMAC_X_DES_ACTIVE_TDAR           0x01000000
++#define EMAC_R_DES_ACTIVE_RDAR           0x01000000
++
++#define EMAC_RX_SECTION_EMPTY_V		0x00010006
++/*
++ * The possible operating speeds of the MAC, currently supporting 10, 100 and
++ * 1000Mb modes.
++ */
++enum mac_speed {SPEED_10M, SPEED_100M, SPEED_1000M, SPEED_1000M_PCS};
++
++/* MII-related definitios */
++#define EMAC_MII_DATA_ST         0x40000000      /* Start of frame delimiter */
++#define EMAC_MII_DATA_OP_RD      0x20000000      /* Perform a read operation */
++#define EMAC_MII_DATA_OP_CL45_RD 0x30000000      /* Perform a read operation */
++#define EMAC_MII_DATA_OP_WR      0x10000000      /* Perform a write operation */
++#define EMAC_MII_DATA_OP_CL45_WR 0x10000000      /* Perform a write operation */
++#define EMAC_MII_DATA_PA_MSK     0x0f800000      /* PHY Address field mask */
++#define EMAC_MII_DATA_RA_MSK     0x007c0000      /* PHY Register field mask */
++#define EMAC_MII_DATA_TA         0x00020000      /* Turnaround */
++#define EMAC_MII_DATA_DATAMSK    0x0000ffff      /* PHY data field */
++
++#define EMAC_MII_DATA_RA_SHIFT   18      /* MII Register address bits */
++#define EMAC_MII_DATA_RA_MASK	 0x1F      /* MII Register address mask */
++#define EMAC_MII_DATA_PA_SHIFT   23      /* MII PHY address bits */
++#define EMAC_MII_DATA_PA_MASK    0x1F      /* MII PHY address mask */
++
++#define EMAC_MII_DATA_RA(v) (((v) & EMAC_MII_DATA_RA_MASK) << \
++				EMAC_MII_DATA_RA_SHIFT)
++#define EMAC_MII_DATA_PA(v) (((v) & EMAC_MII_DATA_RA_MASK) << \
++				EMAC_MII_DATA_PA_SHIFT)
++#define EMAC_MII_DATA(v)    ((v) & 0xffff)
++
++#define EMAC_MII_SPEED_SHIFT	1
++#define EMAC_HOLDTIME_SHIFT	8
++#define EMAC_HOLDTIME_MASK	0x7
++#define EMAC_HOLDTIME(v)	(((v) & EMAC_HOLDTIME_MASK) << \
++					EMAC_HOLDTIME_SHIFT)
++
++/*
++ * The Address organisation for the MAC device.  All addresses are split into
++ * two 32-bit register fields.  The first one (bottom) is the lower 32-bits of
++ * the address and the other field are the high order bits - this may be 16-bits
++ * in the case of MAC addresses, or 32-bits for the hash address.
++ * In terms of memory storage, the first item (bottom) is assumed to be at a
++ * lower address location than 'top'. i.e. top should be at address location of
++ * 'bottom' + 4 bytes.
++ */
++struct pfe_mac_addr {
++	u32 bottom;     /* Lower 32-bits of address. */
++	u32 top;        /* Upper 32-bits of address. */
++};
++
++/*
++ * The following is the organisation of the address filters section of the MAC
++ * registers.  The Cadence MAC contains four possible specific address match
++ * addresses, if an incoming frame corresponds to any one of these four
++ * addresses then the frame will be copied to memory.
++ * It is not necessary for all four of the address match registers to be
++ * programmed, this is application dependent.
++ */
++struct spec_addr {
++	struct pfe_mac_addr one;        /* Specific address register 1. */
++	struct pfe_mac_addr two;        /* Specific address register 2. */
++	struct pfe_mac_addr three;      /* Specific address register 3. */
++	struct pfe_mac_addr four;       /* Specific address register 4. */
++};
++
++struct gemac_cfg {
++	u32 mode;
++	u32 speed;
++	u32 duplex;
++};
++
++/* EMAC Hash size */
++#define EMAC_HASH_REG_BITS       64
++
++#define EMAC_SPEC_ADDR_MAX	4
++
++#endif /* _EMAC_H_ */
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/include/pfe/cbus/gpi.h
+@@ -0,0 +1,86 @@
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#ifndef _GPI_H_
++#define _GPI_H_
++
++#define GPI_VERSION	0x00
++#define GPI_CTRL	0x04
++#define GPI_RX_CONFIG	0x08
++#define GPI_HDR_SIZE	0x0c
++#define GPI_BUF_SIZE	0x10
++#define GPI_LMEM_ALLOC_ADDR	0x14
++#define GPI_LMEM_FREE_ADDR	0x18
++#define GPI_DDR_ALLOC_ADDR	0x1c
++#define GPI_DDR_FREE_ADDR	0x20
++#define GPI_CLASS_ADDR	0x24
++#define GPI_DRX_FIFO	0x28
++#define GPI_TRX_FIFO	0x2c
++#define GPI_INQ_PKTPTR	0x30
++#define GPI_DDR_DATA_OFFSET	0x34
++#define GPI_LMEM_DATA_OFFSET	0x38
++#define GPI_TMLF_TX	0x4c
++#define GPI_DTX_ASEQ	0x50
++#define GPI_FIFO_STATUS	0x54
++#define GPI_FIFO_DEBUG	0x58
++#define GPI_TX_PAUSE_TIME	0x5c
++#define GPI_LMEM_SEC_BUF_DATA_OFFSET	0x60
++#define GPI_DDR_SEC_BUF_DATA_OFFSET	0x64
++#define GPI_TOE_CHKSUM_EN	0x68
++#define GPI_OVERRUN_DROPCNT	0x6c
++#define GPI_CSR_MTIP_PAUSE_REG		0x74
++#define GPI_CSR_MTIP_PAUSE_QUANTUM	0x78
++#define GPI_CSR_RX_CNT			0x7c
++#define GPI_CSR_TX_CNT			0x80
++#define GPI_CSR_DEBUG1			0x84
++#define GPI_CSR_DEBUG2			0x88
++
++struct gpi_cfg {
++	u32 lmem_rtry_cnt;
++	u32 tmlf_txthres;
++	u32 aseq_len;
++	u32 mtip_pause_reg;
++};
++
++/* GPI commons defines */
++#define GPI_LMEM_BUF_EN	0x1
++#define GPI_DDR_BUF_EN	0x1
++
++/* EGPI 1 defines */
++#define EGPI1_LMEM_RTRY_CNT	0x40
++#define EGPI1_TMLF_TXTHRES	0xBC
++#define EGPI1_ASEQ_LEN	0x50
++
++/* EGPI 2 defines */
++#define EGPI2_LMEM_RTRY_CNT	0x40
++#define EGPI2_TMLF_TXTHRES	0xBC
++#define EGPI2_ASEQ_LEN	0x40
++
++/* EGPI 3 defines */
++#define EGPI3_LMEM_RTRY_CNT	0x40
++#define EGPI3_TMLF_TXTHRES	0xBC
++#define EGPI3_ASEQ_LEN	0x40
++
++/* HGPI defines */
++#define HGPI_LMEM_RTRY_CNT	0x40
++#define HGPI_TMLF_TXTHRES	0xBC
++#define HGPI_ASEQ_LEN	0x40
++
++#define EGPI_PAUSE_TIME		0x000007D0
++#define EGPI_PAUSE_ENABLE	0x40000000
++#endif /* _GPI_H_ */
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/include/pfe/cbus/hif.h
+@@ -0,0 +1,100 @@
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#ifndef _HIF_H_
++#define _HIF_H_
++
++/* @file hif.h.
++ * hif - PFE hif block control and status register.
++ * Mapped on CBUS and accessible from all PE's and ARM.
++ */
++#define HIF_VERSION	(HIF_BASE_ADDR + 0x00)
++#define HIF_TX_CTRL	(HIF_BASE_ADDR + 0x04)
++#define HIF_TX_CURR_BD_ADDR	(HIF_BASE_ADDR + 0x08)
++#define HIF_TX_ALLOC	(HIF_BASE_ADDR + 0x0c)
++#define HIF_TX_BDP_ADDR	(HIF_BASE_ADDR + 0x10)
++#define HIF_TX_STATUS	(HIF_BASE_ADDR + 0x14)
++#define HIF_RX_CTRL	(HIF_BASE_ADDR + 0x20)
++#define HIF_RX_BDP_ADDR	(HIF_BASE_ADDR + 0x24)
++#define HIF_RX_STATUS	(HIF_BASE_ADDR + 0x30)
++#define HIF_INT_SRC	(HIF_BASE_ADDR + 0x34)
++#define HIF_INT_ENABLE	(HIF_BASE_ADDR + 0x38)
++#define HIF_POLL_CTRL	(HIF_BASE_ADDR + 0x3c)
++#define HIF_RX_CURR_BD_ADDR	(HIF_BASE_ADDR + 0x40)
++#define HIF_RX_ALLOC	(HIF_BASE_ADDR + 0x44)
++#define HIF_TX_DMA_STATUS	(HIF_BASE_ADDR + 0x48)
++#define HIF_RX_DMA_STATUS	(HIF_BASE_ADDR + 0x4c)
++#define HIF_INT_COAL	(HIF_BASE_ADDR + 0x50)
++
++/* HIF_INT_SRC/ HIF_INT_ENABLE control bits */
++#define HIF_INT		BIT(0)
++#define HIF_RXBD_INT	BIT(1)
++#define HIF_RXPKT_INT	BIT(2)
++#define HIF_TXBD_INT	BIT(3)
++#define HIF_TXPKT_INT	BIT(4)
++
++/* HIF_TX_CTRL bits */
++#define HIF_CTRL_DMA_EN			BIT(0)
++#define HIF_CTRL_BDP_POLL_CTRL_EN	BIT(1)
++#define HIF_CTRL_BDP_CH_START_WSTB	BIT(2)
++
++/* HIF_RX_STATUS bits */
++#define BDP_CSR_RX_DMA_ACTV     BIT(16)
++
++/* HIF_INT_ENABLE bits */
++#define HIF_INT_EN		BIT(0)
++#define HIF_RXBD_INT_EN		BIT(1)
++#define HIF_RXPKT_INT_EN	BIT(2)
++#define HIF_TXBD_INT_EN		BIT(3)
++#define HIF_TXPKT_INT_EN	BIT(4)
++
++/* HIF_POLL_CTRL bits*/
++#define HIF_RX_POLL_CTRL_CYCLE	0x0400
++#define HIF_TX_POLL_CTRL_CYCLE	0x0400
++
++/* HIF_INT_COAL bits*/
++#define HIF_INT_COAL_ENABLE	BIT(31)
++
++/* Buffer descriptor control bits */
++#define BD_CTRL_BUFLEN_MASK	0x3fff
++#define BD_BUF_LEN(x)	((x) & BD_CTRL_BUFLEN_MASK)
++#define BD_CTRL_CBD_INT_EN	BIT(16)
++#define BD_CTRL_PKT_INT_EN	BIT(17)
++#define BD_CTRL_LIFM		BIT(18)
++#define BD_CTRL_LAST_BD		BIT(19)
++#define BD_CTRL_DIR		BIT(20)
++#define BD_CTRL_LMEM_CPY	BIT(21) /* Valid only for HIF_NOCPY */
++#define BD_CTRL_PKT_XFER	BIT(24)
++#define BD_CTRL_DESC_EN		BIT(31)
++#define BD_CTRL_PARSE_DISABLE	BIT(25)
++#define BD_CTRL_BRFETCH_DISABLE	BIT(26)
++#define BD_CTRL_RTFETCH_DISABLE	BIT(27)
++
++/* Buffer descriptor status bits*/
++#define BD_STATUS_CONN_ID(x)	((x) & 0xffff)
++#define BD_STATUS_DIR_PROC_ID	BIT(16)
++#define BD_STATUS_CONN_ID_EN	BIT(17)
++#define BD_STATUS_PE2PROC_ID(x)	(((x) & 7) << 18)
++#define BD_STATUS_LE_DATA	BIT(21)
++#define BD_STATUS_CHKSUM_EN	BIT(22)
++
++/* HIF Buffer descriptor status bits */
++#define DIR_PROC_ID	BIT(16)
++#define PROC_ID(id)	((id) << 18)
++
++#endif /* _HIF_H_ */
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/include/pfe/cbus/hif_nocpy.h
+@@ -0,0 +1,50 @@
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#ifndef _HIF_NOCPY_H_
++#define _HIF_NOCPY_H_
++
++#define HIF_NOCPY_VERSION	(HIF_NOCPY_BASE_ADDR + 0x00)
++#define HIF_NOCPY_TX_CTRL	(HIF_NOCPY_BASE_ADDR + 0x04)
++#define HIF_NOCPY_TX_CURR_BD_ADDR	(HIF_NOCPY_BASE_ADDR + 0x08)
++#define HIF_NOCPY_TX_ALLOC	(HIF_NOCPY_BASE_ADDR + 0x0c)
++#define HIF_NOCPY_TX_BDP_ADDR	(HIF_NOCPY_BASE_ADDR + 0x10)
++#define HIF_NOCPY_TX_STATUS	(HIF_NOCPY_BASE_ADDR + 0x14)
++#define HIF_NOCPY_RX_CTRL	(HIF_NOCPY_BASE_ADDR + 0x20)
++#define HIF_NOCPY_RX_BDP_ADDR	(HIF_NOCPY_BASE_ADDR + 0x24)
++#define HIF_NOCPY_RX_STATUS	(HIF_NOCPY_BASE_ADDR + 0x30)
++#define HIF_NOCPY_INT_SRC	(HIF_NOCPY_BASE_ADDR + 0x34)
++#define HIF_NOCPY_INT_ENABLE	(HIF_NOCPY_BASE_ADDR + 0x38)
++#define HIF_NOCPY_POLL_CTRL	(HIF_NOCPY_BASE_ADDR + 0x3c)
++#define HIF_NOCPY_RX_CURR_BD_ADDR	(HIF_NOCPY_BASE_ADDR + 0x40)
++#define HIF_NOCPY_RX_ALLOC	(HIF_NOCPY_BASE_ADDR + 0x44)
++#define HIF_NOCPY_TX_DMA_STATUS	(HIF_NOCPY_BASE_ADDR + 0x48)
++#define HIF_NOCPY_RX_DMA_STATUS	(HIF_NOCPY_BASE_ADDR + 0x4c)
++#define HIF_NOCPY_RX_INQ0_PKTPTR	(HIF_NOCPY_BASE_ADDR + 0x50)
++#define HIF_NOCPY_RX_INQ1_PKTPTR	(HIF_NOCPY_BASE_ADDR + 0x54)
++#define HIF_NOCPY_TX_PORT_NO	(HIF_NOCPY_BASE_ADDR + 0x60)
++#define HIF_NOCPY_LMEM_ALLOC_ADDR	(HIF_NOCPY_BASE_ADDR + 0x64)
++#define HIF_NOCPY_CLASS_ADDR	(HIF_NOCPY_BASE_ADDR + 0x68)
++#define HIF_NOCPY_TMU_PORT0_ADDR	(HIF_NOCPY_BASE_ADDR + 0x70)
++#define HIF_NOCPY_TMU_PORT1_ADDR	(HIF_NOCPY_BASE_ADDR + 0x74)
++#define HIF_NOCPY_TMU_PORT2_ADDR	(HIF_NOCPY_BASE_ADDR + 0x7c)
++#define HIF_NOCPY_TMU_PORT3_ADDR	(HIF_NOCPY_BASE_ADDR + 0x80)
++#define HIF_NOCPY_TMU_PORT4_ADDR	(HIF_NOCPY_BASE_ADDR + 0x84)
++#define HIF_NOCPY_INT_COAL	(HIF_NOCPY_BASE_ADDR + 0x90)
++
++#endif /* _HIF_NOCPY_H_ */
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/include/pfe/cbus/tmu_csr.h
+@@ -0,0 +1,168 @@
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#ifndef _TMU_CSR_H_
++#define _TMU_CSR_H_
++
++#define TMU_VERSION	(TMU_CSR_BASE_ADDR + 0x000)
++#define TMU_INQ_WATERMARK	(TMU_CSR_BASE_ADDR + 0x004)
++#define TMU_PHY_INQ_PKTPTR	(TMU_CSR_BASE_ADDR + 0x008)
++#define TMU_PHY_INQ_PKTINFO	(TMU_CSR_BASE_ADDR + 0x00c)
++#define TMU_PHY_INQ_FIFO_CNT	(TMU_CSR_BASE_ADDR + 0x010)
++#define TMU_SYS_GENERIC_CONTROL	(TMU_CSR_BASE_ADDR + 0x014)
++#define TMU_SYS_GENERIC_STATUS	(TMU_CSR_BASE_ADDR + 0x018)
++#define TMU_SYS_GEN_CON0	(TMU_CSR_BASE_ADDR + 0x01c)
++#define TMU_SYS_GEN_CON1	(TMU_CSR_BASE_ADDR + 0x020)
++#define TMU_SYS_GEN_CON2	(TMU_CSR_BASE_ADDR + 0x024)
++#define TMU_SYS_GEN_CON3	(TMU_CSR_BASE_ADDR + 0x028)
++#define TMU_SYS_GEN_CON4	(TMU_CSR_BASE_ADDR + 0x02c)
++#define TMU_TEQ_DISABLE_DROPCHK	(TMU_CSR_BASE_ADDR + 0x030)
++#define TMU_TEQ_CTRL	(TMU_CSR_BASE_ADDR + 0x034)
++#define TMU_TEQ_QCFG	(TMU_CSR_BASE_ADDR + 0x038)
++#define TMU_TEQ_DROP_STAT	(TMU_CSR_BASE_ADDR + 0x03c)
++#define TMU_TEQ_QAVG	(TMU_CSR_BASE_ADDR + 0x040)
++#define TMU_TEQ_WREG_PROB	(TMU_CSR_BASE_ADDR + 0x044)
++#define TMU_TEQ_TRANS_STAT	(TMU_CSR_BASE_ADDR + 0x048)
++#define TMU_TEQ_HW_PROB_CFG0	(TMU_CSR_BASE_ADDR + 0x04c)
++#define TMU_TEQ_HW_PROB_CFG1	(TMU_CSR_BASE_ADDR + 0x050)
++#define TMU_TEQ_HW_PROB_CFG2	(TMU_CSR_BASE_ADDR + 0x054)
++#define TMU_TEQ_HW_PROB_CFG3	(TMU_CSR_BASE_ADDR + 0x058)
++#define TMU_TEQ_HW_PROB_CFG4	(TMU_CSR_BASE_ADDR + 0x05c)
++#define TMU_TEQ_HW_PROB_CFG5	(TMU_CSR_BASE_ADDR + 0x060)
++#define TMU_TEQ_HW_PROB_CFG6	(TMU_CSR_BASE_ADDR + 0x064)
++#define TMU_TEQ_HW_PROB_CFG7	(TMU_CSR_BASE_ADDR + 0x068)
++#define TMU_TEQ_HW_PROB_CFG8	(TMU_CSR_BASE_ADDR + 0x06c)
++#define TMU_TEQ_HW_PROB_CFG9	(TMU_CSR_BASE_ADDR + 0x070)
++#define TMU_TEQ_HW_PROB_CFG10	(TMU_CSR_BASE_ADDR + 0x074)
++#define TMU_TEQ_HW_PROB_CFG11	(TMU_CSR_BASE_ADDR + 0x078)
++#define TMU_TEQ_HW_PROB_CFG12	(TMU_CSR_BASE_ADDR + 0x07c)
++#define TMU_TEQ_HW_PROB_CFG13	(TMU_CSR_BASE_ADDR + 0x080)
++#define TMU_TEQ_HW_PROB_CFG14	(TMU_CSR_BASE_ADDR + 0x084)
++#define TMU_TEQ_HW_PROB_CFG15	(TMU_CSR_BASE_ADDR + 0x088)
++#define TMU_TEQ_HW_PROB_CFG16	(TMU_CSR_BASE_ADDR + 0x08c)
++#define TMU_TEQ_HW_PROB_CFG17	(TMU_CSR_BASE_ADDR + 0x090)
++#define TMU_TEQ_HW_PROB_CFG18	(TMU_CSR_BASE_ADDR + 0x094)
++#define TMU_TEQ_HW_PROB_CFG19	(TMU_CSR_BASE_ADDR + 0x098)
++#define TMU_TEQ_HW_PROB_CFG20	(TMU_CSR_BASE_ADDR + 0x09c)
++#define TMU_TEQ_HW_PROB_CFG21	(TMU_CSR_BASE_ADDR + 0x0a0)
++#define TMU_TEQ_HW_PROB_CFG22	(TMU_CSR_BASE_ADDR + 0x0a4)
++#define TMU_TEQ_HW_PROB_CFG23	(TMU_CSR_BASE_ADDR + 0x0a8)
++#define TMU_TEQ_HW_PROB_CFG24	(TMU_CSR_BASE_ADDR + 0x0ac)
++#define TMU_TEQ_HW_PROB_CFG25	(TMU_CSR_BASE_ADDR + 0x0b0)
++#define TMU_TDQ_IIFG_CFG	(TMU_CSR_BASE_ADDR + 0x0b4)
++/* [9:0] Scheduler Enable for each of the scheduler in the TDQ.
++ * This is a global Enable for all schedulers in PHY0
++ */
++#define TMU_TDQ0_SCH_CTRL	(TMU_CSR_BASE_ADDR + 0x0b8)
++
++#define TMU_LLM_CTRL	(TMU_CSR_BASE_ADDR + 0x0bc)
++#define TMU_LLM_BASE_ADDR	(TMU_CSR_BASE_ADDR + 0x0c0)
++#define TMU_LLM_QUE_LEN	(TMU_CSR_BASE_ADDR + 0x0c4)
++#define TMU_LLM_QUE_HEADPTR	(TMU_CSR_BASE_ADDR + 0x0c8)
++#define TMU_LLM_QUE_TAILPTR	(TMU_CSR_BASE_ADDR + 0x0cc)
++#define TMU_LLM_QUE_DROPCNT	(TMU_CSR_BASE_ADDR + 0x0d0)
++#define TMU_INT_EN	(TMU_CSR_BASE_ADDR + 0x0d4)
++#define TMU_INT_SRC	(TMU_CSR_BASE_ADDR + 0x0d8)
++#define TMU_INQ_STAT	(TMU_CSR_BASE_ADDR + 0x0dc)
++#define TMU_CTRL	(TMU_CSR_BASE_ADDR + 0x0e0)
++
++/* [31] Mem Access Command. 0 = Internal Memory Read, 1 = Internal memory
++ * Write [27:24] Byte Enables of the Internal memory access [23:0] Address of
++ * the internal memory. This address is used to access both the PM and DM of
++ * all the PE's
++ */
++#define TMU_MEM_ACCESS_ADDR	(TMU_CSR_BASE_ADDR + 0x0e4)
++
++/* Internal Memory Access Write Data */
++#define TMU_MEM_ACCESS_WDATA	(TMU_CSR_BASE_ADDR + 0x0e8)
++/* Internal Memory Access Read Data. The commands are blocked
++ * at the mem_access only
++ */
++#define TMU_MEM_ACCESS_RDATA	(TMU_CSR_BASE_ADDR + 0x0ec)
++
++/* [31:0] PHY0 in queue address (must be initialized with one of the
++ * xxx_INQ_PKTPTR cbus addresses)
++ */
++#define TMU_PHY0_INQ_ADDR	(TMU_CSR_BASE_ADDR + 0x0f0)
++/* [31:0] PHY1 in queue address (must be initialized with one of the
++ * xxx_INQ_PKTPTR cbus addresses)
++ */
++#define TMU_PHY1_INQ_ADDR	(TMU_CSR_BASE_ADDR + 0x0f4)
++/* [31:0] PHY2 in queue address (must be initialized with one of the
++ * xxx_INQ_PKTPTR cbus addresses)
++ */
++#define TMU_PHY2_INQ_ADDR	(TMU_CSR_BASE_ADDR + 0x0f8)
++/* [31:0] PHY3 in queue address (must be initialized with one of the
++ * xxx_INQ_PKTPTR cbus addresses)
++ */
++#define TMU_PHY3_INQ_ADDR	(TMU_CSR_BASE_ADDR + 0x0fc)
++#define TMU_BMU_INQ_ADDR	(TMU_CSR_BASE_ADDR + 0x100)
++#define TMU_TX_CTRL	(TMU_CSR_BASE_ADDR + 0x104)
++
++#define TMU_BUS_ACCESS_WDATA	(TMU_CSR_BASE_ADDR + 0x108)
++#define TMU_BUS_ACCESS	(TMU_CSR_BASE_ADDR + 0x10c)
++#define TMU_BUS_ACCESS_RDATA	(TMU_CSR_BASE_ADDR + 0x110)
++
++#define TMU_PE_SYS_CLK_RATIO	(TMU_CSR_BASE_ADDR + 0x114)
++#define TMU_PE_STATUS	(TMU_CSR_BASE_ADDR + 0x118)
++#define TMU_TEQ_MAX_THRESHOLD	(TMU_CSR_BASE_ADDR + 0x11c)
++/* [31:0] PHY4 in queue address (must be initialized with one of the
++ * xxx_INQ_PKTPTR cbus addresses)
++ */
++#define TMU_PHY4_INQ_ADDR	(TMU_CSR_BASE_ADDR + 0x134)
++/* [9:0] Scheduler Enable for each of the scheduler in the TDQ.
++ * This is a global Enable for all schedulers in PHY1
++ */
++#define TMU_TDQ1_SCH_CTRL	(TMU_CSR_BASE_ADDR + 0x138)
++/* [9:0] Scheduler Enable for each of the scheduler in the TDQ.
++ * This is a global Enable for all schedulers in PHY2
++ */
++#define TMU_TDQ2_SCH_CTRL	(TMU_CSR_BASE_ADDR + 0x13c)
++/* [9:0] Scheduler Enable for each of the scheduler in the TDQ.
++ * This is a global Enable for all schedulers in PHY3
++ */
++#define TMU_TDQ3_SCH_CTRL	(TMU_CSR_BASE_ADDR + 0x140)
++#define TMU_BMU_BUF_SIZE	(TMU_CSR_BASE_ADDR + 0x144)
++/* [31:0] PHY5 in queue address (must be initialized with one of the
++ * xxx_INQ_PKTPTR cbus addresses)
++ */
++#define TMU_PHY5_INQ_ADDR	(TMU_CSR_BASE_ADDR + 0x148)
++
++#define SW_RESET		BIT(0)	/* Global software reset */
++#define INQ_RESET		BIT(2)
++#define TEQ_RESET		BIT(3)
++#define TDQ_RESET		BIT(4)
++#define PE_RESET		BIT(5)
++#define MEM_INIT		BIT(6)
++#define MEM_INIT_DONE		BIT(7)
++#define LLM_INIT		BIT(8)
++#define LLM_INIT_DONE		BIT(9)
++#define ECC_MEM_INIT_DONE	BIT(10)
++
++struct tmu_cfg {
++	u32 pe_sys_clk_ratio;
++	unsigned long llm_base_addr;
++	u32 llm_queue_len;
++};
++
++/* Not HW related for pfe_ctrl / pfe common defines */
++#define DEFAULT_MAX_QDEPTH	80
++#define DEFAULT_Q0_QDEPTH	511 /*We keep one large queue for host tx qos */
++#define DEFAULT_TMU3_QDEPTH	127
++
++#endif /* _TMU_CSR_H_ */
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/include/pfe/cbus/util_csr.h
+@@ -0,0 +1,61 @@
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#ifndef _UTIL_CSR_H_
++#define _UTIL_CSR_H_
++
++#define UTIL_VERSION	(UTIL_CSR_BASE_ADDR + 0x000)
++#define UTIL_TX_CTRL	(UTIL_CSR_BASE_ADDR + 0x004)
++#define UTIL_INQ_PKTPTR	(UTIL_CSR_BASE_ADDR + 0x010)
++
++#define UTIL_HDR_SIZE	(UTIL_CSR_BASE_ADDR + 0x014)
++
++#define UTIL_PE0_QB_DM_ADDR0	(UTIL_CSR_BASE_ADDR + 0x020)
++#define UTIL_PE0_QB_DM_ADDR1	(UTIL_CSR_BASE_ADDR + 0x024)
++#define UTIL_PE0_RO_DM_ADDR0	(UTIL_CSR_BASE_ADDR + 0x060)
++#define UTIL_PE0_RO_DM_ADDR1	(UTIL_CSR_BASE_ADDR + 0x064)
++
++#define UTIL_MEM_ACCESS_ADDR	(UTIL_CSR_BASE_ADDR + 0x100)
++#define UTIL_MEM_ACCESS_WDATA	(UTIL_CSR_BASE_ADDR + 0x104)
++#define UTIL_MEM_ACCESS_RDATA	(UTIL_CSR_BASE_ADDR + 0x108)
++
++#define UTIL_TM_INQ_ADDR	(UTIL_CSR_BASE_ADDR + 0x114)
++#define UTIL_PE_STATUS	(UTIL_CSR_BASE_ADDR + 0x118)
++
++#define UTIL_PE_SYS_CLK_RATIO	(UTIL_CSR_BASE_ADDR + 0x200)
++#define UTIL_AFULL_THRES	(UTIL_CSR_BASE_ADDR + 0x204)
++#define UTIL_GAP_BETWEEN_READS	(UTIL_CSR_BASE_ADDR + 0x208)
++#define UTIL_MAX_BUF_CNT	(UTIL_CSR_BASE_ADDR + 0x20c)
++#define UTIL_TSQ_FIFO_THRES	(UTIL_CSR_BASE_ADDR + 0x210)
++#define UTIL_TSQ_MAX_CNT	(UTIL_CSR_BASE_ADDR + 0x214)
++#define UTIL_IRAM_DATA_0	(UTIL_CSR_BASE_ADDR + 0x218)
++#define UTIL_IRAM_DATA_1	(UTIL_CSR_BASE_ADDR + 0x21c)
++#define UTIL_IRAM_DATA_2	(UTIL_CSR_BASE_ADDR + 0x220)
++#define UTIL_IRAM_DATA_3	(UTIL_CSR_BASE_ADDR + 0x224)
++
++#define UTIL_BUS_ACCESS_ADDR	(UTIL_CSR_BASE_ADDR + 0x228)
++#define UTIL_BUS_ACCESS_WDATA	(UTIL_CSR_BASE_ADDR + 0x22c)
++#define UTIL_BUS_ACCESS_RDATA	(UTIL_CSR_BASE_ADDR + 0x230)
++
++#define UTIL_INQ_AFULL_THRES	(UTIL_CSR_BASE_ADDR + 0x234)
++
++struct util_cfg {
++	u32 pe_sys_clk_ratio;
++};
++
++#endif /* _UTIL_CSR_H_ */
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/include/pfe/pfe.h
+@@ -0,0 +1,372 @@
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#ifndef _PFE_H_
++#define _PFE_H_
++
++#include "cbus.h"
++
++#define CLASS_DMEM_BASE_ADDR(i)	(0x00000000 | ((i) << 20))
++/*
++ * Only valid for mem access register interface
++ */
++#define CLASS_IMEM_BASE_ADDR(i)	(0x00000000 | ((i) << 20))
++#define CLASS_DMEM_SIZE	0x00002000
++#define CLASS_IMEM_SIZE	0x00008000
++
++#define TMU_DMEM_BASE_ADDR(i)	(0x00000000 + ((i) << 20))
++/*
++ * Only valid for mem access register interface
++ */
++#define TMU_IMEM_BASE_ADDR(i)	(0x00000000 + ((i) << 20))
++#define TMU_DMEM_SIZE	0x00000800
++#define TMU_IMEM_SIZE	0x00002000
++
++#define UTIL_DMEM_BASE_ADDR	0x00000000
++#define UTIL_DMEM_SIZE	0x00002000
++
++#define PE_LMEM_BASE_ADDR	0xc3010000
++#define PE_LMEM_SIZE	0x8000
++#define PE_LMEM_END	(PE_LMEM_BASE_ADDR + PE_LMEM_SIZE)
++
++#define DMEM_BASE_ADDR	0x00000000
++#define DMEM_SIZE	0x2000	/* TMU has less... */
++#define DMEM_END	(DMEM_BASE_ADDR + DMEM_SIZE)
++
++#define PMEM_BASE_ADDR	0x00010000
++#define PMEM_SIZE	0x8000	/* TMU has less... */
++#define PMEM_END	(PMEM_BASE_ADDR + PMEM_SIZE)
++
++/* These check memory ranges from PE point of view/memory map */
++#define IS_DMEM(addr, len)				\
++	({ typeof(addr) addr_ = (addr);			\
++	((unsigned long)(addr_) >= DMEM_BASE_ADDR) &&	\
++	(((unsigned long)(addr_) + (len)) <= DMEM_END); })
++
++#define IS_PMEM(addr, len)				\
++	({ typeof(addr) addr_ = (addr);			\
++	((unsigned long)(addr_) >= PMEM_BASE_ADDR) &&	\
++	(((unsigned long)(addr_) + (len)) <= PMEM_END); })
++
++#define IS_PE_LMEM(addr, len)				\
++	({ typeof(addr) addr_ = (addr);			\
++	((unsigned long)(addr_) >=			\
++	PE_LMEM_BASE_ADDR) &&				\
++	(((unsigned long)(addr_) +			\
++	(len)) <= PE_LMEM_END); })
++
++#define IS_PFE_LMEM(addr, len)				\
++	({ typeof(addr) addr_ = (addr);			\
++	((unsigned long)(addr_) >=			\
++	CBUS_VIRT_TO_PFE(LMEM_BASE_ADDR)) &&		\
++	(((unsigned long)(addr_) + (len)) <=		\
++	CBUS_VIRT_TO_PFE(LMEM_END)); })
++
++#define __IS_PHYS_DDR(addr, len)			\
++	({ typeof(addr) addr_ = (addr);			\
++	((unsigned long)(addr_) >=			\
++	DDR_PHYS_BASE_ADDR) &&				\
++	(((unsigned long)(addr_) + (len)) <=		\
++	DDR_PHYS_END); })
++
++#define IS_PHYS_DDR(addr, len)	__IS_PHYS_DDR(DDR_PFE_TO_PHYS(addr), len)
++
++/*
++ * If using a run-time virtual address for the cbus base address use this code
++ */
++extern void *cbus_base_addr;
++extern void *ddr_base_addr;
++extern unsigned long ddr_phys_base_addr;
++extern unsigned int ddr_size;
++
++#define CBUS_BASE_ADDR	cbus_base_addr
++#define DDR_PHYS_BASE_ADDR	ddr_phys_base_addr
++#define DDR_BASE_ADDR	ddr_base_addr
++#define DDR_SIZE	ddr_size
++
++#define DDR_PHYS_END	(DDR_PHYS_BASE_ADDR + DDR_SIZE)
++
++#define LS1012A_PFE_RESET_WA	/*
++				 * PFE doesn't have global reset and re-init
++				 * should takecare few things to make PFE
++				 * functional after reset
++				 */
++#define PFE_CBUS_PHYS_BASE_ADDR	0xc0000000	/* CBUS physical base address
++						 * as seen by PE's.
++						 */
++/* CBUS physical base address as seen by PE's. */
++#define PFE_CBUS_PHYS_BASE_ADDR_FROM_PFE	0xc0000000
++
++#define DDR_PHYS_TO_PFE(p)	(((unsigned long int)(p)) & 0x7FFFFFFF)
++#define DDR_PFE_TO_PHYS(p)	(((unsigned long int)(p)) | 0x80000000)
++#define CBUS_PHYS_TO_PFE(p)	(((p) - PFE_CBUS_PHYS_BASE_ADDR) + \
++				PFE_CBUS_PHYS_BASE_ADDR_FROM_PFE)
++/* Translates to PFE address map */
++
++#define DDR_PHYS_TO_VIRT(p)	(((p) - DDR_PHYS_BASE_ADDR) + DDR_BASE_ADDR)
++#define DDR_VIRT_TO_PHYS(v)	(((v) - DDR_BASE_ADDR) + DDR_PHYS_BASE_ADDR)
++#define DDR_VIRT_TO_PFE(p)	(DDR_PHYS_TO_PFE(DDR_VIRT_TO_PHYS(p)))
++
++#define CBUS_VIRT_TO_PFE(v)	(((v) - CBUS_BASE_ADDR) + \
++				PFE_CBUS_PHYS_BASE_ADDR)
++#define CBUS_PFE_TO_VIRT(p)	(((unsigned long int)(p) - \
++				PFE_CBUS_PHYS_BASE_ADDR) + CBUS_BASE_ADDR)
++
++/* The below part of the code is used in QOS control driver from host */
++#define TMU_APB_BASE_ADDR       0xc1000000      /* TMU base address seen by
++						 * pe's
++						 */
++
++enum {
++	CLASS0_ID = 0,
++	CLASS1_ID,
++	CLASS2_ID,
++	CLASS3_ID,
++	CLASS4_ID,
++	CLASS5_ID,
++	TMU0_ID,
++	TMU1_ID,
++	TMU2_ID,
++	TMU3_ID,
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++	UTIL_ID,
++#endif
++	MAX_PE
++};
++
++#define CLASS_MASK	(BIT(CLASS0_ID) | BIT(CLASS1_ID) |\
++			BIT(CLASS2_ID) | BIT(CLASS3_ID) |\
++			BIT(CLASS4_ID) | BIT(CLASS5_ID))
++#define CLASS_MAX_ID	CLASS5_ID
++
++#define TMU_MASK	(BIT(TMU0_ID) | BIT(TMU1_ID) |\
++			BIT(TMU3_ID))
++
++#define TMU_MAX_ID	TMU3_ID
++
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++#define UTIL_MASK	BIT(UTIL_ID)
++#endif
++
++struct pe_status {
++	u32	cpu_state;
++	u32	activity_counter;
++	u32	rx;
++	union {
++	u32	tx;
++	u32	tmu_qstatus;
++	};
++	u32	drop;
++#if defined(CFG_PE_DEBUG)
++	u32	debug_indicator;
++	u32	debug[16];
++#endif
++} __aligned(16);
++
++struct pe_sync_mailbox {
++	u32 stop;
++	u32 stopped;
++};
++
++/* Drop counter definitions */
++
++#define	CLASS_NUM_DROP_COUNTERS	13
++#define	UTIL_NUM_DROP_COUNTERS	8
++
++/* PE information.
++ * Structure containing PE's specific information. It is used to create
++ * generic C functions common to all PE's.
++ * Before using the library functions this structure needs to be initialized
++ * with the different registers virtual addresses
++ * (according to the ARM MMU mmaping). The default initialization supports a
++ * virtual == physical mapping.
++ */
++struct pe_info {
++	u32 dmem_base_addr;	/* PE's dmem base address */
++	u32 pmem_base_addr;	/* PE's pmem base address */
++	u32 pmem_size;	/* PE's pmem size */
++
++	void *mem_access_wdata;	/* PE's _MEM_ACCESS_WDATA register
++				 * address
++				 */
++	void *mem_access_addr;	/* PE's _MEM_ACCESS_ADDR register
++				 * address
++				 */
++	void *mem_access_rdata;	/* PE's _MEM_ACCESS_RDATA register
++				 * address
++				 */
++};
++
++void pe_lmem_read(u32 *dst, u32 len, u32 offset);
++void pe_lmem_write(u32 *src, u32 len, u32 offset);
++
++void pe_dmem_memcpy_to32(int id, u32 dst, const void *src, unsigned int len);
++void pe_pmem_memcpy_to32(int id, u32 dst, const void *src, unsigned int len);
++
++u32 pe_pmem_read(int id, u32 addr, u8 size);
++
++void pe_dmem_write(int id, u32 val, u32 addr, u8 size);
++u32 pe_dmem_read(int id, u32 addr, u8 size);
++void class_pe_lmem_memcpy_to32(u32 dst, const void *src, unsigned int len);
++void class_pe_lmem_memset(u32 dst, int val, unsigned int len);
++void class_bus_write(u32 val, u32 addr, u8 size);
++u32 class_bus_read(u32 addr, u8 size);
++
++#define class_bus_readl(addr)	class_bus_read(addr, 4)
++#define class_bus_readw(addr)	class_bus_read(addr, 2)
++#define class_bus_readb(addr)	class_bus_read(addr, 1)
++
++#define class_bus_writel(val, addr)	class_bus_write(val, addr, 4)
++#define class_bus_writew(val, addr)	class_bus_write(val, addr, 2)
++#define class_bus_writeb(val, addr)	class_bus_write(val, addr, 1)
++
++#define pe_dmem_readl(id, addr)	pe_dmem_read(id, addr, 4)
++#define pe_dmem_readw(id, addr)	pe_dmem_read(id, addr, 2)
++#define pe_dmem_readb(id, addr)	pe_dmem_read(id, addr, 1)
++
++#define pe_dmem_writel(id, val, addr)	pe_dmem_write(id, val, addr, 4)
++#define pe_dmem_writew(id, val, addr)	pe_dmem_write(id, val, addr, 2)
++#define pe_dmem_writeb(id, val, addr)	pe_dmem_write(id, val, addr, 1)
++
++/*int pe_load_elf_section(int id, const void *data, elf32_shdr *shdr); */
++int pe_load_elf_section(int id, const void *data, struct elf32_shdr *shdr,
++			struct device *dev);
++
++void pfe_lib_init(void *cbus_base, void *ddr_base, unsigned long ddr_phys_base,
++		  unsigned int ddr_size);
++void bmu_init(void *base, struct BMU_CFG *cfg);
++void bmu_reset(void *base);
++void bmu_enable(void *base);
++void bmu_disable(void *base);
++void bmu_set_config(void *base, struct BMU_CFG *cfg);
++
++/*
++ * An enumerated type for loopback values.  This can be one of three values, no
++ * loopback -normal operation, local loopback with internal loopback module of
++ * MAC or PHY loopback which is through the external PHY.
++ */
++#ifndef __MAC_LOOP_ENUM__
++#define __MAC_LOOP_ENUM__
++enum mac_loop {LB_NONE, LB_EXT, LB_LOCAL};
++#endif
++
++void gemac_init(void *base, void *config);
++void gemac_disable_rx_checksum_offload(void *base);
++void gemac_enable_rx_checksum_offload(void *base);
++void gemac_set_speed(void *base, enum mac_speed gem_speed);
++void gemac_set_duplex(void *base, int duplex);
++void gemac_set_mode(void *base, int mode);
++void gemac_enable(void *base);
++void gemac_tx_disable(void *base);
++void gemac_tx_enable(void *base);
++void gemac_disable(void *base);
++void gemac_reset(void *base);
++void gemac_set_address(void *base, struct spec_addr *addr);
++struct spec_addr gemac_get_address(void *base);
++void gemac_set_loop(void *base, enum mac_loop gem_loop);
++void gemac_set_laddr1(void *base, struct pfe_mac_addr *address);
++void gemac_set_laddr2(void *base, struct pfe_mac_addr *address);
++void gemac_set_laddr3(void *base, struct pfe_mac_addr *address);
++void gemac_set_laddr4(void *base, struct pfe_mac_addr *address);
++void gemac_set_laddrN(void *base, struct pfe_mac_addr *address,
++		      unsigned int entry_index);
++void gemac_clear_laddr1(void *base);
++void gemac_clear_laddr2(void *base);
++void gemac_clear_laddr3(void *base);
++void gemac_clear_laddr4(void *base);
++void gemac_clear_laddrN(void *base, unsigned int entry_index);
++struct pfe_mac_addr gemac_get_hash(void *base);
++void gemac_set_hash(void *base, struct pfe_mac_addr *hash);
++struct pfe_mac_addr gem_get_laddr1(void *base);
++struct pfe_mac_addr gem_get_laddr2(void *base);
++struct pfe_mac_addr gem_get_laddr3(void *base);
++struct pfe_mac_addr gem_get_laddr4(void *base);
++struct pfe_mac_addr gem_get_laddrN(void *base, unsigned int entry_index);
++void gemac_set_config(void *base, struct gemac_cfg *cfg);
++void gemac_allow_broadcast(void *base);
++void gemac_no_broadcast(void *base);
++void gemac_enable_1536_rx(void *base);
++void gemac_disable_1536_rx(void *base);
++void gemac_set_rx_max_fl(void *base, int mtu);
++void gemac_enable_rx_jmb(void *base);
++void gemac_disable_rx_jmb(void *base);
++void gemac_enable_stacked_vlan(void *base);
++void gemac_disable_stacked_vlan(void *base);
++void gemac_enable_pause_rx(void *base);
++void gemac_disable_pause_rx(void *base);
++void gemac_enable_copy_all(void *base);
++void gemac_disable_copy_all(void *base);
++void gemac_set_bus_width(void *base, int width);
++void gemac_set_wol(void *base, u32 wol_conf);
++
++void gpi_init(void *base, struct gpi_cfg *cfg);
++void gpi_reset(void *base);
++void gpi_enable(void *base);
++void gpi_disable(void *base);
++void gpi_set_config(void *base, struct gpi_cfg *cfg);
++
++void class_init(struct class_cfg *cfg);
++void class_reset(void);
++void class_enable(void);
++void class_disable(void);
++void class_set_config(struct class_cfg *cfg);
++
++void tmu_reset(void);
++void tmu_init(struct tmu_cfg *cfg);
++void tmu_enable(u32 pe_mask);
++void tmu_disable(u32 pe_mask);
++u32  tmu_qstatus(u32 if_id);
++u32  tmu_pkts_processed(u32 if_id);
++
++void util_init(struct util_cfg *cfg);
++void util_reset(void);
++void util_enable(void);
++void util_disable(void);
++
++void hif_init(void);
++void hif_tx_enable(void);
++void hif_tx_disable(void);
++void hif_rx_enable(void);
++void hif_rx_disable(void);
++
++/* Get Chip Revision level
++ *
++ */
++static inline unsigned int CHIP_REVISION(void)
++{
++	/*For LS1012A return always 1 */
++	return 1;
++}
++
++/* Start HIF rx DMA
++ *
++ */
++static inline void hif_rx_dma_start(void)
++{
++	writel(HIF_CTRL_DMA_EN | HIF_CTRL_BDP_CH_START_WSTB, HIF_RX_CTRL);
++}
++
++/* Start HIF tx DMA
++ *
++ */
++static inline void hif_tx_dma_start(void)
++{
++	writel(HIF_CTRL_DMA_EN | HIF_CTRL_BDP_CH_START_WSTB, HIF_TX_CTRL);
++}
++
++#endif /* _PFE_H_ */
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_cdev.c
+@@ -0,0 +1,258 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Copyright 2018 NXP
++ */
++
++/* @pfe_cdev.c.
++ *  Dummy device representing the PFE US in userspace.
++ *  - used for interacting with the kernel layer for link status
++ */
++
++#include <linux/eventfd.h>
++#include <linux/irqreturn.h>
++#include <linux/io.h>
++#include <asm/irq.h>
++
++#include "pfe_cdev.h"
++#include "pfe_mod.h"
++
++static int pfe_majno;
++static struct class *pfe_char_class;
++static struct device *pfe_char_dev;
++struct eventfd_ctx *g_trigger;
++
++struct pfe_shared_info link_states[PFE_CDEV_ETH_COUNT];
++
++static int pfe_cdev_open(struct inode *inp, struct file *fp)
++{
++	pr_debug("PFE CDEV device opened.\n");
++	return 0;
++}
++
++static ssize_t pfe_cdev_read(struct file *fp, char *buf,
++			     size_t len, loff_t *off)
++{
++	int ret = 0;
++
++	pr_info("PFE CDEV attempt copying (%zu) size of user.\n",
++		sizeof(link_states));
++
++	pr_debug("Dump link_state on screen before copy_to_user\n");
++	for (; ret < PFE_CDEV_ETH_COUNT; ret++) {
++		pr_debug("%u  %u", link_states[ret].phy_id,
++			 link_states[ret].state);
++		pr_debug("\n");
++	}
++
++	/* Copy to user the value in buffer sized len */
++	ret = copy_to_user(buf, &link_states, sizeof(link_states));
++	if (ret != 0) {
++		pr_err("Failed to send (%d)bytes of (%zu) requested.\n",
++		       ret, len);
++		return -EFAULT;
++	}
++
++	/* offset set back to 0 as there is contextual reading offset */
++	*off = 0;
++	pr_debug("Read of (%zu) bytes performed.\n", sizeof(link_states));
++
++	return sizeof(link_states);
++}
++
++/**
++ * This function is for getting some commands from user through non-IOCTL
++ * channel. It can used to configure the device.
++ * TODO: To be filled in future, if require duplex communication with user
++ * space.
++ */
++static ssize_t pfe_cdev_write(struct file *fp, const char *buf,
++			      size_t len, loff_t *off)
++{
++	pr_info("PFE CDEV Write operation not supported!\n");
++
++	return -EFAULT;
++}
++
++static int pfe_cdev_release(struct inode *inp, struct file *fp)
++{
++	if (g_trigger) {
++		free_irq(pfe->hif_irq, g_trigger);
++		eventfd_ctx_put(g_trigger);
++		g_trigger = NULL;
++	}
++
++	pr_info("PFE_CDEV: Device successfully closed\n");
++	return 0;
++}
++
++/*
++ * hif_us_isr-
++ * This ISR routine processes Rx/Tx done interrupts from the HIF hardware block
++ */
++static irqreturn_t hif_us_isr(int irq, void *arg)
++{
++	struct eventfd_ctx *trigger = (struct eventfd_ctx *)arg;
++	int int_status;
++	int int_enable_mask;
++
++	/*Read hif interrupt source register */
++	int_status = readl_relaxed(HIF_INT_SRC);
++	int_enable_mask = readl_relaxed(HIF_INT_ENABLE);
++
++	if ((int_status & HIF_INT) == 0)
++		return IRQ_NONE;
++
++	if (int_status & HIF_RXPKT_INT) {
++		int_enable_mask &= ~(HIF_RXPKT_INT);
++		/* Disable interrupts, they will be enabled after
++		 * they are serviced
++		 */
++		writel_relaxed(int_enable_mask, HIF_INT_ENABLE);
++
++		eventfd_signal(trigger, 1);
++	}
++
++	return IRQ_HANDLED;
++}
++
++#define PFE_INTR_COAL_USECS	100
++static long pfe_cdev_ioctl(struct file *fp, unsigned int cmd,
++			   unsigned long arg)
++{
++	int ret = -EFAULT;
++	int __user *argp = (int __user *)arg;
++
++	pr_debug("PFE CDEV IOCTL Called with cmd=(%u)\n", cmd);
++
++	switch (cmd) {
++	case PFE_CDEV_ETH0_STATE_GET:
++		/* Return an unsigned int (link state) for ETH0 */
++		*argp = link_states[0].state;
++		pr_debug("Returning state=%d for ETH0\n", *argp);
++		ret = 0;
++		break;
++	case PFE_CDEV_ETH1_STATE_GET:
++		/* Return an unsigned int (link state) for ETH0 */
++		*argp = link_states[1].state;
++		pr_debug("Returning state=%d for ETH1\n", *argp);
++		ret = 0;
++		break;
++	case PFE_CDEV_HIF_INTR_EN:
++		/* Return success/failure */
++		g_trigger = eventfd_ctx_fdget(*argp);
++		if (IS_ERR(g_trigger))
++			return PTR_ERR(g_trigger);
++		ret = request_irq(pfe->hif_irq, hif_us_isr, 0, "pfe_hif",
++				  g_trigger);
++		if (ret) {
++			pr_err("%s: failed to get the hif IRQ = %d\n",
++			       __func__, pfe->hif_irq);
++			eventfd_ctx_put(g_trigger);
++			g_trigger = NULL;
++		}
++		writel((PFE_INTR_COAL_USECS * (pfe->ctrl.sys_clk / 1000)) |
++			HIF_INT_COAL_ENABLE, HIF_INT_COAL);
++
++		pr_debug("request_irq for hif interrupt: %d\n", pfe->hif_irq);
++		ret = 0;
++		break;
++	default:
++		pr_info("Unsupport cmd (%d) for PFE CDEV.\n", cmd);
++		break;
++	};
++
++	return ret;
++}
++
++static unsigned int pfe_cdev_poll(struct file *fp,
++				  struct poll_table_struct *wait)
++{
++	pr_info("PFE CDEV poll method not supported\n");
++	return 0;
++}
++
++static const struct file_operations pfe_cdev_fops = {
++	.open = pfe_cdev_open,
++	.read = pfe_cdev_read,
++	.write = pfe_cdev_write,
++	.release = pfe_cdev_release,
++	.unlocked_ioctl = pfe_cdev_ioctl,
++	.poll = pfe_cdev_poll,
++};
++
++int pfe_cdev_init(void)
++{
++	int ret;
++
++	pr_debug("PFE CDEV initialization begin\n");
++
++	/* Register the major number for the device */
++	pfe_majno = register_chrdev(0, PFE_CDEV_NAME, &pfe_cdev_fops);
++	if (pfe_majno < 0) {
++		pr_err("Unable to register PFE CDEV. PFE CDEV not available\n");
++		ret = pfe_majno;
++		goto cleanup;
++	}
++
++	pr_debug("PFE CDEV assigned major number: %d\n", pfe_majno);
++
++	/* Register the class for the device */
++	pfe_char_class = class_create(THIS_MODULE, PFE_CLASS_NAME);
++	if (IS_ERR(pfe_char_class)) {
++		pr_err(
++		"Failed to init class for PFE CDEV. PFE CDEV not available.\n");
++		ret = PTR_ERR(pfe_char_class);
++		goto cleanup;
++	}
++
++	pr_debug("PFE CDEV Class created successfully.\n");
++
++	/* Create the device without any parent and without any callback data */
++	    pfe_char_dev = device_create(pfe_char_class, NULL,
++					 MKDEV(pfe_majno, 0), NULL,
++					 PFE_CDEV_NAME);
++	if (IS_ERR(pfe_char_dev)) {
++		pr_err("Unable to PFE CDEV device. PFE CDEV not available.\n");
++		ret = PTR_ERR(pfe_char_dev);
++		goto cleanup;
++	}
++
++	/* Information structure being shared with the userspace */
++	memset(link_states, 0, sizeof(struct pfe_shared_info) *
++			PFE_CDEV_ETH_COUNT);
++
++	pr_info("PFE CDEV created: %s\n", PFE_CDEV_NAME);
++
++	ret = 0;
++	return ret;
++
++cleanup:
++	if (!IS_ERR(pfe_char_class))
++		class_destroy(pfe_char_class);
++
++	if (pfe_majno > 0)
++		unregister_chrdev(pfe_majno, PFE_CDEV_NAME);
++
++	return ret;
++}
++
++void pfe_cdev_exit(void)
++{
++	if (!IS_ERR(pfe_char_dev))
++		device_destroy(pfe_char_class, MKDEV(pfe_majno, 0));
++
++	if (!IS_ERR(pfe_char_class)) {
++		class_unregister(pfe_char_class);
++		class_destroy(pfe_char_class);
++	}
++
++	if (pfe_majno > 0)
++		unregister_chrdev(pfe_majno, PFE_CDEV_NAME);
++
++	/* reset the variables */
++	pfe_majno = 0;
++	pfe_char_class = NULL;
++	pfe_char_dev = NULL;
++
++	pr_info("PFE CDEV Removed.\n");
++}
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_cdev.h
+@@ -0,0 +1,41 @@
++/* SPDX-License-Identifier: GPL-2.0+ */
++/*
++ * Copyright 2018 NXP
++ */
++
++#ifndef _PFE_CDEV_H_
++#define _PFE_CDEV_H_
++
++#include <linux/init.h>
++#include <linux/device.h>
++#include <linux/err.h>
++#include <linux/kernel.h>
++#include <linux/fs.h>
++#include <linux/uaccess.h>
++#include <linux/poll.h>
++
++#define  PFE_CDEV_NAME "pfe_us_cdev"
++#define  PFE_CLASS_NAME  "ppfe_us"
++
++/* Extracted from ls1012a_pfe_platform_data, there are 3 interfaces which are
++ * supported by PFE driver. Should be updated if number of eth devices are
++ * changed.
++ */
++#define PFE_CDEV_ETH_COUNT 3
++
++struct pfe_shared_info {
++	uint32_t phy_id; /* Link phy ID */
++	uint8_t state;  /* Has either 0 or 1 */
++};
++
++extern struct pfe_shared_info link_states[PFE_CDEV_ETH_COUNT];
++
++/* IOCTL Commands */
++#define PFE_CDEV_ETH0_STATE_GET		_IOR('R', 0, int)
++#define PFE_CDEV_ETH1_STATE_GET		_IOR('R', 1, int)
++#define PFE_CDEV_HIF_INTR_EN		_IOWR('R', 2, int)
++
++int pfe_cdev_init(void);
++void pfe_cdev_exit(void);
++
++#endif /* _PFE_CDEV_H_ */
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_ctrl.c
+@@ -0,0 +1,226 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ */
++
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/module.h>
++#include <linux/list.h>
++#include <linux/kthread.h>
++
++#include "pfe_mod.h"
++#include "pfe_ctrl.h"
++
++#define TIMEOUT_MS	1000
++
++int relax(unsigned long end)
++{
++	if (time_after(jiffies, end)) {
++		if (time_after(jiffies, end + (TIMEOUT_MS * HZ) / 1000))
++			return -1;
++
++		if (need_resched())
++			schedule();
++	}
++
++	return 0;
++}
++
++void pfe_ctrl_suspend(struct pfe_ctrl *ctrl)
++{
++	int id;
++
++	mutex_lock(&ctrl->mutex);
++
++	for (id = CLASS0_ID; id <= CLASS_MAX_ID; id++)
++		pe_dmem_write(id, cpu_to_be32(0x1), CLASS_DM_RESUME, 4);
++
++	for (id = TMU0_ID; id <= TMU_MAX_ID; id++) {
++		if (id == TMU2_ID)
++			continue;
++		pe_dmem_write(id, cpu_to_be32(0x1), TMU_DM_RESUME, 4);
++	}
++
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++	pe_dmem_write(UTIL_ID, cpu_to_be32(0x1), UTIL_DM_RESUME, 4);
++#endif
++	mutex_unlock(&ctrl->mutex);
++}
++
++void pfe_ctrl_resume(struct pfe_ctrl *ctrl)
++{
++	int pe_mask = CLASS_MASK | TMU_MASK;
++
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++	pe_mask |= UTIL_MASK;
++#endif
++	mutex_lock(&ctrl->mutex);
++	pe_start(&pfe->ctrl, pe_mask);
++	mutex_unlock(&ctrl->mutex);
++}
++
++/* PE sync stop.
++ * Stops packet processing for a list of PE's (specified using a bitmask).
++ * The caller must hold ctrl->mutex.
++ *
++ * @param ctrl		Control context
++ * @param pe_mask	Mask of PE id's to stop
++ *
++ */
++int pe_sync_stop(struct pfe_ctrl *ctrl, int pe_mask)
++{
++	struct pe_sync_mailbox *mbox;
++	int pe_stopped = 0;
++	unsigned long end = jiffies + 2;
++	int i;
++
++	pe_mask &= 0x2FF;  /*Exclude Util + TMU2 */
++
++	for (i = 0; i < MAX_PE; i++)
++		if (pe_mask & (1 << i)) {
++			mbox = (void *)ctrl->sync_mailbox_baseaddr[i];
++
++			pe_dmem_write(i, cpu_to_be32(0x1), (unsigned
++					long)&mbox->stop, 4);
++		}
++
++	while (pe_stopped != pe_mask) {
++		for (i = 0; i < MAX_PE; i++)
++			if ((pe_mask & (1 << i)) && !(pe_stopped & (1 << i))) {
++				mbox = (void *)ctrl->sync_mailbox_baseaddr[i];
++
++				if (pe_dmem_read(i, (unsigned
++					long)&mbox->stopped, 4) &
++					cpu_to_be32(0x1))
++					pe_stopped |= (1 << i);
++			}
++
++		if (relax(end) < 0)
++			goto err;
++	}
++
++	return 0;
++
++err:
++	pr_err("%s: timeout, %x %x\n", __func__, pe_mask, pe_stopped);
++
++	for (i = 0; i < MAX_PE; i++)
++		if (pe_mask & (1 << i)) {
++			mbox = (void *)ctrl->sync_mailbox_baseaddr[i];
++
++			pe_dmem_write(i, cpu_to_be32(0x0), (unsigned
++					long)&mbox->stop, 4);
++	}
++
++	return -EIO;
++}
++
++/* PE start.
++ * Starts packet processing for a list of PE's (specified using a bitmask).
++ * The caller must hold ctrl->mutex.
++ *
++ * @param ctrl		Control context
++ * @param pe_mask	Mask of PE id's to start
++ *
++ */
++void pe_start(struct pfe_ctrl *ctrl, int pe_mask)
++{
++	struct pe_sync_mailbox *mbox;
++	int i;
++
++	for (i = 0; i < MAX_PE; i++)
++		if (pe_mask & (1 << i)) {
++			mbox = (void *)ctrl->sync_mailbox_baseaddr[i];
++
++			pe_dmem_write(i, cpu_to_be32(0x0), (unsigned
++					long)&mbox->stop, 4);
++		}
++}
++
++/* This function will ensure all PEs are put in to idle state */
++int pe_reset_all(struct pfe_ctrl *ctrl)
++{
++	struct pe_sync_mailbox *mbox;
++	int pe_stopped = 0;
++	unsigned long end = jiffies + 2;
++	int i;
++	int pe_mask  = CLASS_MASK | TMU_MASK;
++
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++	pe_mask |= UTIL_MASK;
++#endif
++
++	for (i = 0; i < MAX_PE; i++)
++		if (pe_mask & (1 << i)) {
++			mbox = (void *)ctrl->sync_mailbox_baseaddr[i];
++
++			pe_dmem_write(i, cpu_to_be32(0x2), (unsigned
++					long)&mbox->stop, 4);
++		}
++
++	while (pe_stopped != pe_mask) {
++		for (i = 0; i < MAX_PE; i++)
++			if ((pe_mask & (1 << i)) && !(pe_stopped & (1 << i))) {
++				mbox = (void *)ctrl->sync_mailbox_baseaddr[i];
++
++				if (pe_dmem_read(i, (unsigned long)
++							&mbox->stopped, 4) &
++						cpu_to_be32(0x1))
++					pe_stopped |= (1 << i);
++			}
++
++		if (relax(end) < 0)
++			goto err;
++	}
++
++	return 0;
++
++err:
++	pr_err("%s: timeout, %x %x\n", __func__, pe_mask, pe_stopped);
++	return -EIO;
++}
++
++int pfe_ctrl_init(struct pfe *pfe)
++{
++	struct pfe_ctrl *ctrl = &pfe->ctrl;
++	int id;
++
++	pr_info("%s\n", __func__);
++
++	mutex_init(&ctrl->mutex);
++	spin_lock_init(&ctrl->lock);
++
++	for (id = CLASS0_ID; id <= CLASS_MAX_ID; id++) {
++		ctrl->sync_mailbox_baseaddr[id] = CLASS_DM_SYNC_MBOX;
++		ctrl->msg_mailbox_baseaddr[id] = CLASS_DM_MSG_MBOX;
++	}
++
++	for (id = TMU0_ID; id <= TMU_MAX_ID; id++) {
++		if (id == TMU2_ID)
++			continue;
++		ctrl->sync_mailbox_baseaddr[id] = TMU_DM_SYNC_MBOX;
++		ctrl->msg_mailbox_baseaddr[id] = TMU_DM_MSG_MBOX;
++	}
++
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++	ctrl->sync_mailbox_baseaddr[UTIL_ID] = UTIL_DM_SYNC_MBOX;
++	ctrl->msg_mailbox_baseaddr[UTIL_ID] = UTIL_DM_MSG_MBOX;
++#endif
++
++	ctrl->hash_array_baseaddr = pfe->ddr_baseaddr + ROUTE_TABLE_BASEADDR;
++	ctrl->hash_array_phys_baseaddr = pfe->ddr_phys_baseaddr +
++						ROUTE_TABLE_BASEADDR;
++
++	ctrl->dev = pfe->dev;
++
++	pr_info("%s finished\n", __func__);
++
++	return 0;
++}
++
++void pfe_ctrl_exit(struct pfe *pfe)
++{
++	pr_info("%s\n", __func__);
++}
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_ctrl.h
+@@ -0,0 +1,100 @@
++/* SPDX-License-Identifier: GPL-2.0+ */
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ */
++
++#ifndef _PFE_CTRL_H_
++#define _PFE_CTRL_H_
++
++#include <linux/dmapool.h>
++
++#include "pfe/pfe.h"
++
++#define DMA_BUF_SIZE_128	0x80	/* enough for 1 conntracks */
++#define DMA_BUF_SIZE_256	0x100
++/* enough for 2 conntracks, 1 bridge entry or 1 multicast entry */
++#define DMA_BUF_SIZE_512	0x200
++/* 512bytes dma allocated buffers used by rtp relay feature */
++#define DMA_BUF_MIN_ALIGNMENT	8
++#define DMA_BUF_BOUNDARY	(4 * 1024)
++/* bursts can not cross 4k boundary */
++
++#define CMD_TX_ENABLE	0x0501
++#define CMD_TX_DISABLE	0x0502
++
++#define CMD_RX_LRO		0x0011
++#define CMD_PKTCAP_ENABLE       0x0d01
++#define CMD_QM_EXPT_RATE	0x020c
++
++#define CLASS_DM_SH_STATIC		(0x800)
++#define CLASS_DM_CPU_TICKS		(CLASS_DM_SH_STATIC)
++#define CLASS_DM_SYNC_MBOX		(0x808)
++#define CLASS_DM_MSG_MBOX		(0x810)
++#define CLASS_DM_DROP_CNTR		(0x820)
++#define CLASS_DM_RESUME			(0x854)
++#define CLASS_DM_PESTATUS		(0x860)
++#define CLASS_DM_CRC_VALIDATED		(0x14b0)
++
++#define TMU_DM_SH_STATIC		(0x80)
++#define TMU_DM_CPU_TICKS		(TMU_DM_SH_STATIC)
++#define TMU_DM_SYNC_MBOX		(0x88)
++#define TMU_DM_MSG_MBOX			(0x90)
++#define TMU_DM_RESUME			(0xA0)
++#define TMU_DM_PESTATUS			(0xB0)
++#define TMU_DM_CONTEXT			(0x300)
++#define TMU_DM_TX_TRANS			(0x480)
++
++#define UTIL_DM_SH_STATIC		(0x0)
++#define UTIL_DM_CPU_TICKS		(UTIL_DM_SH_STATIC)
++#define UTIL_DM_SYNC_MBOX		(0x8)
++#define UTIL_DM_MSG_MBOX		(0x10)
++#define UTIL_DM_DROP_CNTR		(0x20)
++#define UTIL_DM_RESUME			(0x40)
++#define UTIL_DM_PESTATUS		(0x50)
++
++struct pfe_ctrl {
++	struct mutex mutex; /* to serialize pfe control access */
++	spinlock_t lock;
++
++	void *dma_pool;
++	void *dma_pool_512;
++	void *dma_pool_128;
++
++	struct device *dev;
++
++	void *hash_array_baseaddr;		/*
++						 * Virtual base address of
++						 * the conntrack hash array
++						 */
++	unsigned long hash_array_phys_baseaddr; /*
++						 * Physical base address of
++						 * the conntrack hash array
++						 */
++
++	int (*event_cb)(u16, u16, u16*);
++
++	unsigned long sync_mailbox_baseaddr[MAX_PE]; /*
++						      * Sync mailbox PFE
++						      * internal address,
++						      * initialized
++						      * when parsing elf images
++						      */
++	unsigned long msg_mailbox_baseaddr[MAX_PE]; /*
++						     * Msg mailbox PFE internal
++						     * address, initialized
++						     * when parsing elf images
++						     */
++	unsigned int sys_clk;			/* AXI clock value, in KHz */
++};
++
++int pfe_ctrl_init(struct pfe *pfe);
++void pfe_ctrl_exit(struct pfe *pfe);
++int pe_sync_stop(struct pfe_ctrl *ctrl, int pe_mask);
++void pe_start(struct pfe_ctrl *ctrl, int pe_mask);
++int pe_reset_all(struct pfe_ctrl *ctrl);
++void pfe_ctrl_suspend(struct pfe_ctrl *ctrl);
++void pfe_ctrl_resume(struct pfe_ctrl *ctrl);
++int relax(unsigned long end);
++
++#endif /* _PFE_CTRL_H_ */
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_debugfs.c
+@@ -0,0 +1,99 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ */
++
++#include <linux/module.h>
++#include <linux/debugfs.h>
++#include <linux/platform_device.h>
++
++#include "pfe_mod.h"
++
++static int dmem_show(struct seq_file *s, void *unused)
++{
++	u32 dmem_addr, val;
++	int id = (long int)s->private;
++	int i;
++
++	for (dmem_addr = 0; dmem_addr < CLASS_DMEM_SIZE; dmem_addr += 8 * 4) {
++		seq_printf(s, "%04x:", dmem_addr);
++
++		for (i = 0; i < 8; i++) {
++			val = pe_dmem_read(id, dmem_addr + i * 4, 4);
++			seq_printf(s, " %02x %02x %02x %02x", val & 0xff,
++				   (val >> 8) & 0xff, (val >> 16) & 0xff,
++				   (val >> 24) & 0xff);
++		}
++
++		seq_puts(s, "\n");
++	}
++
++	return 0;
++}
++
++static int dmem_open(struct inode *inode, struct file *file)
++{
++	return single_open(file, dmem_show, inode->i_private);
++}
++
++static const struct file_operations dmem_fops = {
++	.open		= dmem_open,
++	.read		= seq_read,
++	.llseek		= seq_lseek,
++	.release	= single_release,
++};
++
++int pfe_debugfs_init(struct pfe *pfe)
++{
++	struct dentry *d;
++
++	pr_info("%s\n", __func__);
++
++	pfe->dentry = debugfs_create_dir("pfe", NULL);
++	if (IS_ERR_OR_NULL(pfe->dentry))
++		goto err_dir;
++
++	d = debugfs_create_file("pe0_dmem", 0444, pfe->dentry, (void *)0,
++				&dmem_fops);
++	if (IS_ERR_OR_NULL(d))
++		goto err_pe;
++
++	d = debugfs_create_file("pe1_dmem", 0444, pfe->dentry, (void *)1,
++				&dmem_fops);
++	if (IS_ERR_OR_NULL(d))
++		goto err_pe;
++
++	d = debugfs_create_file("pe2_dmem", 0444, pfe->dentry, (void *)2,
++				&dmem_fops);
++	if (IS_ERR_OR_NULL(d))
++		goto err_pe;
++
++	d = debugfs_create_file("pe3_dmem", 0444, pfe->dentry, (void *)3,
++				&dmem_fops);
++	if (IS_ERR_OR_NULL(d))
++		goto err_pe;
++
++	d = debugfs_create_file("pe4_dmem", 0444, pfe->dentry, (void *)4,
++				&dmem_fops);
++	if (IS_ERR_OR_NULL(d))
++		goto err_pe;
++
++	d = debugfs_create_file("pe5_dmem", 0444, pfe->dentry, (void *)5,
++				&dmem_fops);
++	if (IS_ERR_OR_NULL(d))
++		goto err_pe;
++
++	return 0;
++
++err_pe:
++	debugfs_remove_recursive(pfe->dentry);
++
++err_dir:
++	return -1;
++}
++
++void pfe_debugfs_exit(struct pfe *pfe)
++{
++	debugfs_remove_recursive(pfe->dentry);
++}
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_debugfs.h
+@@ -0,0 +1,13 @@
++/* SPDX-License-Identifier: GPL-2.0+ */
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ */
++
++#ifndef _PFE_DEBUGFS_H_
++#define _PFE_DEBUGFS_H_
++
++int pfe_debugfs_init(struct pfe *pfe);
++void pfe_debugfs_exit(struct pfe *pfe);
++
++#endif /* _PFE_DEBUGFS_H_ */
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_eth.c
+@@ -0,0 +1,2591 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ */
++
++/* @pfe_eth.c.
++ *  Ethernet driver for to handle exception path for PFE.
++ *  - uses HIF functions to send/receive packets.
++ *  - uses ctrl function to start/stop interfaces.
++ *  - uses direct register accesses to control phy operation.
++ */
++#include <linux/version.h>
++#include <linux/kernel.h>
++#include <linux/interrupt.h>
++#include <linux/dma-mapping.h>
++#include <linux/dmapool.h>
++#include <linux/netdevice.h>
++#include <linux/etherdevice.h>
++#include <linux/ethtool.h>
++#include <linux/mii.h>
++#include <linux/phy.h>
++#include <linux/timer.h>
++#include <linux/hrtimer.h>
++#include <linux/platform_device.h>
++
++#include <net/ip.h>
++#include <net/sock.h>
++
++#include <linux/of.h>
++#include <linux/of_mdio.h>
++
++#include <linux/io.h>
++#include <asm/irq.h>
++#include <linux/delay.h>
++#include <linux/regmap.h>
++#include <linux/i2c.h>
++#include <linux/sys_soc.h>
++
++#if defined(CONFIG_NF_CONNTRACK_MARK)
++#include <net/netfilter/nf_conntrack.h>
++#endif
++
++#include "pfe_mod.h"
++#include "pfe_eth.h"
++#include "pfe_cdev.h"
++
++#define LS1012A_REV_1_0		0x87040010
++
++bool pfe_use_old_dts_phy;
++bool pfe_errata_a010897;
++
++static void *cbus_emac_base[3];
++static void *cbus_gpi_base[3];
++
++/* Forward Declaration */
++static void pfe_eth_exit_one(struct pfe_eth_priv_s *priv);
++static void pfe_eth_flush_tx(struct pfe_eth_priv_s *priv);
++static void pfe_eth_flush_txQ(struct pfe_eth_priv_s *priv, int tx_q_num, int
++				from_tx, int n_desc);
++
++/* MDIO registers */
++#define MDIO_SGMII_CR			0x00
++#define MDIO_SGMII_SR			0x01
++#define MDIO_SGMII_DEV_ABIL_SGMII	0x04
++#define MDIO_SGMII_LINK_TMR_L		0x12
++#define MDIO_SGMII_LINK_TMR_H		0x13
++#define MDIO_SGMII_IF_MODE		0x14
++
++/* SGMII Control defines */
++#define SGMII_CR_RST			0x8000
++#define SGMII_CR_AN_EN			0x1000
++#define SGMII_CR_RESTART_AN		0x0200
++#define SGMII_CR_FD			0x0100
++#define SGMII_CR_SPEED_SEL1_1G		0x0040
++#define SGMII_CR_DEF_VAL		(SGMII_CR_AN_EN | SGMII_CR_FD | \
++					 SGMII_CR_SPEED_SEL1_1G)
++
++/* SGMII IF Mode */
++#define SGMII_DUPLEX_HALF		0x10
++#define SGMII_SPEED_10MBPS		0x00
++#define SGMII_SPEED_100MBPS		0x04
++#define SGMII_SPEED_1GBPS		0x08
++#define SGMII_USE_SGMII_AN		0x02
++#define SGMII_EN			0x01
++
++/* SGMII Device Ability for SGMII */
++#define SGMII_DEV_ABIL_ACK		0x4000
++#define SGMII_DEV_ABIL_EEE_CLK_STP_EN	0x0100
++#define SGMII_DEV_ABIL_SGMII		0x0001
++
++unsigned int gemac_regs[] = {
++	0x0004, /* Interrupt event */
++	0x0008, /* Interrupt mask */
++	0x0024, /* Ethernet control */
++	0x0064, /* MIB Control/Status */
++	0x0084, /* Receive control/status */
++	0x00C4, /* Transmit control */
++	0x00E4, /* Physical address low */
++	0x00E8, /* Physical address high */
++	0x0144, /* Transmit FIFO Watermark and Store and Forward Control*/
++	0x0190, /* Receive FIFO Section Full Threshold */
++	0x01A0, /* Transmit FIFO Section Empty Threshold */
++	0x01B0, /* Frame Truncation Length */
++};
++
++const struct soc_device_attribute ls1012a_rev1_soc_attr[] = {
++	{ .family = "QorIQ LS1012A",
++	  .soc_id = "svr:0x87040010",
++	  .revision = "1.0",
++	  .data = NULL },
++	{ },
++};
++
++/********************************************************************/
++/*                   SYSFS INTERFACE				    */
++/********************************************************************/
++
++#ifdef PFE_ETH_NAPI_STATS
++/*
++ * pfe_eth_show_napi_stats
++ */
++static ssize_t pfe_eth_show_napi_stats(struct device *dev,
++				       struct device_attribute *attr,
++				       char *buf)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(to_net_dev(dev));
++	ssize_t len = 0;
++
++	len += sprintf(buf + len, "sched:  %u\n",
++			priv->napi_counters[NAPI_SCHED_COUNT]);
++	len += sprintf(buf + len, "poll:   %u\n",
++			priv->napi_counters[NAPI_POLL_COUNT]);
++	len += sprintf(buf + len, "packet: %u\n",
++			priv->napi_counters[NAPI_PACKET_COUNT]);
++	len += sprintf(buf + len, "budget: %u\n",
++			priv->napi_counters[NAPI_FULL_BUDGET_COUNT]);
++	len += sprintf(buf + len, "desc:   %u\n",
++			priv->napi_counters[NAPI_DESC_COUNT]);
++
++	return len;
++}
++
++/*
++ * pfe_eth_set_napi_stats
++ */
++static ssize_t pfe_eth_set_napi_stats(struct device *dev,
++				      struct device_attribute *attr,
++				      const char *buf, size_t count)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(to_net_dev(dev));
++
++	memset(priv->napi_counters, 0, sizeof(priv->napi_counters));
++
++	return count;
++}
++#endif
++#ifdef PFE_ETH_TX_STATS
++/* pfe_eth_show_tx_stats
++ *
++ */
++static ssize_t pfe_eth_show_tx_stats(struct device *dev,
++				     struct device_attribute *attr,
++				     char *buf)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(to_net_dev(dev));
++	ssize_t len = 0;
++	int i;
++
++	len += sprintf(buf + len, "TX queues stats:\n");
++
++	for (i = 0; i < emac_txq_cnt; i++) {
++		struct netdev_queue *tx_queue = netdev_get_tx_queue(priv->ndev,
++									i);
++
++		len += sprintf(buf + len, "\n");
++		__netif_tx_lock_bh(tx_queue);
++
++		hif_tx_lock(&pfe->hif);
++		len += sprintf(buf + len,
++				"Queue %2d :  credits               = %10d\n"
++				, i, hif_lib_tx_credit_avail(pfe, priv->id, i));
++		len += sprintf(buf + len,
++				 "            tx packets            = %10d\n"
++				,  pfe->tmu_credit.tx_packets[priv->id][i]);
++		hif_tx_unlock(&pfe->hif);
++
++		/* Don't output additionnal stats if queue never used */
++		if (!pfe->tmu_credit.tx_packets[priv->id][i])
++			goto skip;
++
++		len += sprintf(buf + len,
++				 "            clean_fail            = %10d\n"
++				, priv->clean_fail[i]);
++		len += sprintf(buf + len,
++				 "            stop_queue            = %10d\n"
++				, priv->stop_queue_total[i]);
++		len += sprintf(buf + len,
++				 "            stop_queue_hif        = %10d\n"
++				, priv->stop_queue_hif[i]);
++		len += sprintf(buf + len,
++				"            stop_queue_hif_client = %10d\n"
++				, priv->stop_queue_hif_client[i]);
++		len += sprintf(buf + len,
++				 "            stop_queue_credit     = %10d\n"
++				, priv->stop_queue_credit[i]);
++skip:
++		__netif_tx_unlock_bh(tx_queue);
++	}
++	return len;
++}
++
++/* pfe_eth_set_tx_stats
++ *
++ */
++static ssize_t pfe_eth_set_tx_stats(struct device *dev,
++				    struct device_attribute *attr,
++				    const char *buf, size_t count)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(to_net_dev(dev));
++	int i;
++
++	for (i = 0; i < emac_txq_cnt; i++) {
++		struct netdev_queue *tx_queue = netdev_get_tx_queue(priv->ndev,
++									i);
++
++		__netif_tx_lock_bh(tx_queue);
++		priv->clean_fail[i] = 0;
++		priv->stop_queue_total[i] = 0;
++		priv->stop_queue_hif[i] = 0;
++		priv->stop_queue_hif_client[i] = 0;
++		priv->stop_queue_credit[i] = 0;
++		__netif_tx_unlock_bh(tx_queue);
++	}
++
++	return count;
++}
++#endif
++/* pfe_eth_show_txavail
++ *
++ */
++static ssize_t pfe_eth_show_txavail(struct device *dev,
++				    struct device_attribute *attr,
++				    char *buf)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(to_net_dev(dev));
++	ssize_t len = 0;
++	int i;
++
++	for (i = 0; i < emac_txq_cnt; i++) {
++		struct netdev_queue *tx_queue = netdev_get_tx_queue(priv->ndev,
++									i);
++
++		__netif_tx_lock_bh(tx_queue);
++
++		len += sprintf(buf + len, "%d",
++				hif_lib_tx_avail(&priv->client, i));
++
++		__netif_tx_unlock_bh(tx_queue);
++
++		if (i == (emac_txq_cnt - 1))
++			len += sprintf(buf + len, "\n");
++		else
++			len += sprintf(buf + len, " ");
++	}
++
++	return len;
++}
++
++/* pfe_eth_show_default_priority
++ *
++ */
++static ssize_t pfe_eth_show_default_priority(struct device *dev,
++					     struct device_attribute *attr,
++						char *buf)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(to_net_dev(dev));
++	unsigned long flags;
++	int rc;
++
++	spin_lock_irqsave(&priv->lock, flags);
++	rc = sprintf(buf, "%d\n", priv->default_priority);
++	spin_unlock_irqrestore(&priv->lock, flags);
++
++	return rc;
++}
++
++/* pfe_eth_set_default_priority
++ *
++ */
++
++static ssize_t pfe_eth_set_default_priority(struct device *dev,
++					    struct device_attribute *attr,
++					    const char *buf, size_t count)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(to_net_dev(dev));
++	unsigned long flags;
++
++	spin_lock_irqsave(&priv->lock, flags);
++	priv->default_priority = kstrtoul(buf, 0, 0);
++	spin_unlock_irqrestore(&priv->lock, flags);
++
++	return count;
++}
++
++static DEVICE_ATTR(txavail, 0444, pfe_eth_show_txavail, NULL);
++static DEVICE_ATTR(default_priority, 0644, pfe_eth_show_default_priority,
++			pfe_eth_set_default_priority);
++
++#ifdef PFE_ETH_NAPI_STATS
++static DEVICE_ATTR(napi_stats, 0644, pfe_eth_show_napi_stats,
++			pfe_eth_set_napi_stats);
++#endif
++
++#ifdef PFE_ETH_TX_STATS
++static DEVICE_ATTR(tx_stats, 0644, pfe_eth_show_tx_stats,
++			pfe_eth_set_tx_stats);
++#endif
++
++/*
++ * pfe_eth_sysfs_init
++ *
++ */
++static int pfe_eth_sysfs_init(struct net_device *ndev)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++	int err;
++
++	/* Initialize the default values */
++
++	/*
++	 * By default, packets without conntrack will use this default low
++	 * priority queue
++	 */
++	priv->default_priority = 0;
++
++	/* Create our sysfs files */
++	err = device_create_file(&ndev->dev, &dev_attr_default_priority);
++	if (err) {
++		netdev_err(ndev,
++			   "failed to create default_priority sysfs files\n");
++		goto err_priority;
++	}
++
++	err = device_create_file(&ndev->dev, &dev_attr_txavail);
++	if (err) {
++		netdev_err(ndev,
++			   "failed to create default_priority sysfs files\n");
++		goto err_txavail;
++	}
++
++#ifdef PFE_ETH_NAPI_STATS
++	err = device_create_file(&ndev->dev, &dev_attr_napi_stats);
++	if (err) {
++		netdev_err(ndev, "failed to create napi stats sysfs files\n");
++		goto err_napi;
++	}
++#endif
++
++#ifdef PFE_ETH_TX_STATS
++	err = device_create_file(&ndev->dev, &dev_attr_tx_stats);
++	if (err) {
++		netdev_err(ndev, "failed to create tx stats sysfs files\n");
++		goto err_tx;
++	}
++#endif
++
++	return 0;
++
++#ifdef PFE_ETH_TX_STATS
++err_tx:
++#endif
++#ifdef PFE_ETH_NAPI_STATS
++	device_remove_file(&ndev->dev, &dev_attr_napi_stats);
++
++err_napi:
++#endif
++	device_remove_file(&ndev->dev, &dev_attr_txavail);
++
++err_txavail:
++	device_remove_file(&ndev->dev, &dev_attr_default_priority);
++
++err_priority:
++	return -1;
++}
++
++/* pfe_eth_sysfs_exit
++ *
++ */
++void pfe_eth_sysfs_exit(struct net_device *ndev)
++{
++#ifdef PFE_ETH_TX_STATS
++	device_remove_file(&ndev->dev, &dev_attr_tx_stats);
++#endif
++
++#ifdef PFE_ETH_NAPI_STATS
++	device_remove_file(&ndev->dev, &dev_attr_napi_stats);
++#endif
++	device_remove_file(&ndev->dev, &dev_attr_txavail);
++	device_remove_file(&ndev->dev, &dev_attr_default_priority);
++}
++
++/*************************************************************************/
++/*		ETHTOOL INTERCAE					 */
++/*************************************************************************/
++
++/*MTIP GEMAC */
++static const struct fec_stat {
++	char name[ETH_GSTRING_LEN];
++	u16 offset;
++} fec_stats[] = {
++	/* RMON TX */
++	{ "tx_dropped", RMON_T_DROP },
++	{ "tx_packets", RMON_T_PACKETS },
++	{ "tx_broadcast", RMON_T_BC_PKT },
++	{ "tx_multicast", RMON_T_MC_PKT },
++	{ "tx_crc_errors", RMON_T_CRC_ALIGN },
++	{ "tx_undersize", RMON_T_UNDERSIZE },
++	{ "tx_oversize", RMON_T_OVERSIZE },
++	{ "tx_fragment", RMON_T_FRAG },
++	{ "tx_jabber", RMON_T_JAB },
++	{ "tx_collision", RMON_T_COL },
++	{ "tx_64byte", RMON_T_P64 },
++	{ "tx_65to127byte", RMON_T_P65TO127 },
++	{ "tx_128to255byte", RMON_T_P128TO255 },
++	{ "tx_256to511byte", RMON_T_P256TO511 },
++	{ "tx_512to1023byte", RMON_T_P512TO1023 },
++	{ "tx_1024to2047byte", RMON_T_P1024TO2047 },
++	{ "tx_GTE2048byte", RMON_T_P_GTE2048 },
++	{ "tx_octets", RMON_T_OCTETS },
++
++	/* IEEE TX */
++	{ "IEEE_tx_drop", IEEE_T_DROP },
++	{ "IEEE_tx_frame_ok", IEEE_T_FRAME_OK },
++	{ "IEEE_tx_1col", IEEE_T_1COL },
++	{ "IEEE_tx_mcol", IEEE_T_MCOL },
++	{ "IEEE_tx_def", IEEE_T_DEF },
++	{ "IEEE_tx_lcol", IEEE_T_LCOL },
++	{ "IEEE_tx_excol", IEEE_T_EXCOL },
++	{ "IEEE_tx_macerr", IEEE_T_MACERR },
++	{ "IEEE_tx_cserr", IEEE_T_CSERR },
++	{ "IEEE_tx_sqe", IEEE_T_SQE },
++	{ "IEEE_tx_fdxfc", IEEE_T_FDXFC },
++	{ "IEEE_tx_octets_ok", IEEE_T_OCTETS_OK },
++
++	/* RMON RX */
++	{ "rx_packets", RMON_R_PACKETS },
++	{ "rx_broadcast", RMON_R_BC_PKT },
++	{ "rx_multicast", RMON_R_MC_PKT },
++	{ "rx_crc_errors", RMON_R_CRC_ALIGN },
++	{ "rx_undersize", RMON_R_UNDERSIZE },
++	{ "rx_oversize", RMON_R_OVERSIZE },
++	{ "rx_fragment", RMON_R_FRAG },
++	{ "rx_jabber", RMON_R_JAB },
++	{ "rx_64byte", RMON_R_P64 },
++	{ "rx_65to127byte", RMON_R_P65TO127 },
++	{ "rx_128to255byte", RMON_R_P128TO255 },
++	{ "rx_256to511byte", RMON_R_P256TO511 },
++	{ "rx_512to1023byte", RMON_R_P512TO1023 },
++	{ "rx_1024to2047byte", RMON_R_P1024TO2047 },
++	{ "rx_GTE2048byte", RMON_R_P_GTE2048 },
++	{ "rx_octets", RMON_R_OCTETS },
++
++	/* IEEE RX */
++	{ "IEEE_rx_drop", IEEE_R_DROP },
++	{ "IEEE_rx_frame_ok", IEEE_R_FRAME_OK },
++	{ "IEEE_rx_crc", IEEE_R_CRC },
++	{ "IEEE_rx_align", IEEE_R_ALIGN },
++	{ "IEEE_rx_macerr", IEEE_R_MACERR },
++	{ "IEEE_rx_fdxfc", IEEE_R_FDXFC },
++	{ "IEEE_rx_octets_ok", IEEE_R_OCTETS_OK },
++};
++
++static void pfe_eth_fill_stats(struct net_device *ndev, struct ethtool_stats
++				*stats, u64 *data)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++	int i;
++	u64 pfe_crc_validated = 0;
++	int id;
++
++	for (id = CLASS0_ID; id <= CLASS_MAX_ID; id++) {
++		pfe_crc_validated += be32_to_cpu(pe_dmem_read(id,
++			CLASS_DM_CRC_VALIDATED + (priv->id * 4), 4));
++	}
++
++	for (i = 0; i < ARRAY_SIZE(fec_stats); i++) {
++		data[i] = readl(priv->EMAC_baseaddr + fec_stats[i].offset);
++
++		if (fec_stats[i].offset == IEEE_R_DROP)
++			data[i] -= pfe_crc_validated;
++	}
++}
++
++static void pfe_eth_gstrings(struct net_device *netdev,
++			     u32 stringset, u8 *data)
++{
++	int i;
++
++	switch (stringset) {
++	case ETH_SS_STATS:
++		for (i = 0; i < ARRAY_SIZE(fec_stats); i++)
++			memcpy(data + i * ETH_GSTRING_LEN,
++			       fec_stats[i].name, ETH_GSTRING_LEN);
++		break;
++	}
++}
++
++static int pfe_eth_stats_count(struct net_device *ndev, int sset)
++{
++	switch (sset) {
++	case ETH_SS_STATS:
++		return ARRAY_SIZE(fec_stats);
++	default:
++		return -EOPNOTSUPP;
++	}
++}
++
++/*
++ * pfe_eth_gemac_reglen - Return the length of the register structure.
++ *
++ */
++static int pfe_eth_gemac_reglen(struct net_device *ndev)
++{
++	pr_info("%s()\n", __func__);
++	return (sizeof(gemac_regs) / sizeof(u32));
++}
++
++/*
++ * pfe_eth_gemac_get_regs - Return the gemac register structure.
++ *
++ */
++static void  pfe_eth_gemac_get_regs(struct net_device *ndev, struct ethtool_regs
++					*regs, void *regbuf)
++{
++	int i;
++
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++	u32 *buf = (u32 *)regbuf;
++
++	pr_info("%s()\n", __func__);
++	for (i = 0; i < sizeof(gemac_regs) / sizeof(u32); i++)
++		buf[i] = readl(priv->EMAC_baseaddr + gemac_regs[i]);
++}
++
++/*
++ * pfe_eth_set_wol - Set the magic packet option, in WoL register.
++ *
++ */
++static int pfe_eth_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++
++	if (wol->wolopts & ~WAKE_MAGIC)
++		return -EOPNOTSUPP;
++
++	/* for MTIP we store wol->wolopts */
++	priv->wol = wol->wolopts;
++
++	device_set_wakeup_enable(&ndev->dev, wol->wolopts & WAKE_MAGIC);
++
++	return 0;
++}
++
++/*
++ *
++ * pfe_eth_get_wol - Get the WoL options.
++ *
++ */
++static void pfe_eth_get_wol(struct net_device *ndev, struct ethtool_wolinfo
++				*wol)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++
++	wol->supported = WAKE_MAGIC;
++	wol->wolopts = 0;
++
++	if (priv->wol & WAKE_MAGIC)
++		wol->wolopts = WAKE_MAGIC;
++
++	memset(&wol->sopass, 0, sizeof(wol->sopass));
++}
++
++/*
++ * pfe_eth_get_drvinfo -  Fills in the drvinfo structure with some basic info
++ *
++ */
++static void pfe_eth_get_drvinfo(struct net_device *ndev, struct ethtool_drvinfo
++				*drvinfo)
++{
++	strlcpy(drvinfo->driver, DRV_NAME, sizeof(drvinfo->driver));
++	strlcpy(drvinfo->version, DRV_VERSION, sizeof(drvinfo->version));
++	strlcpy(drvinfo->fw_version, "N/A", sizeof(drvinfo->fw_version));
++	strlcpy(drvinfo->bus_info, "N/A", sizeof(drvinfo->bus_info));
++}
++
++/*
++ * pfe_eth_set_settings - Used to send commands to PHY.
++ *
++ */
++static int pfe_eth_set_settings(struct net_device *ndev,
++				const struct ethtool_link_ksettings *cmd)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++	struct phy_device *phydev = priv->phydev;
++
++	if (!phydev)
++		return -ENODEV;
++
++	return phy_ethtool_ksettings_set(phydev, cmd);
++}
++
++/*
++ * pfe_eth_getsettings - Return the current settings in the ethtool_cmd
++ * structure.
++ *
++ */
++static int pfe_eth_get_settings(struct net_device *ndev,
++				struct ethtool_link_ksettings *cmd)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++	struct phy_device *phydev = priv->phydev;
++
++	if (!phydev)
++		return -ENODEV;
++
++	phy_ethtool_ksettings_get(phydev, cmd);
++
++	return 0;
++}
++
++/*
++ * pfe_eth_get_msglevel - Gets the debug message mask.
++ *
++ */
++static uint32_t pfe_eth_get_msglevel(struct net_device *ndev)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++
++	return priv->msg_enable;
++}
++
++/*
++ * pfe_eth_set_msglevel - Sets the debug message mask.
++ *
++ */
++static void pfe_eth_set_msglevel(struct net_device *ndev, uint32_t data)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++
++	priv->msg_enable = data;
++}
++
++#define HIF_RX_COAL_MAX_CLKS		(~(1 << 31))
++#define HIF_RX_COAL_CLKS_PER_USEC	(pfe->ctrl.sys_clk / 1000)
++#define HIF_RX_COAL_MAX_USECS		(HIF_RX_COAL_MAX_CLKS	/ \
++						HIF_RX_COAL_CLKS_PER_USEC)
++
++/*
++ * pfe_eth_set_coalesce - Sets rx interrupt coalescing timer.
++ *
++ */
++static int pfe_eth_set_coalesce(struct net_device *ndev,
++				struct ethtool_coalesce *ec,
++				struct kernel_ethtool_coalesce *kernel_coal,
++				struct netlink_ext_ack *extack)
++{
++	if (ec->rx_coalesce_usecs > HIF_RX_COAL_MAX_USECS)
++		return -EINVAL;
++
++	if (!ec->rx_coalesce_usecs) {
++		writel(0, HIF_INT_COAL);
++		return 0;
++	}
++
++	writel((ec->rx_coalesce_usecs * HIF_RX_COAL_CLKS_PER_USEC) |
++			HIF_INT_COAL_ENABLE, HIF_INT_COAL);
++
++	return 0;
++}
++
++/*
++ * pfe_eth_get_coalesce - Gets rx interrupt coalescing timer value.
++ *
++ */
++static int pfe_eth_get_coalesce(struct net_device *ndev,
++				struct ethtool_coalesce *ec,
++				struct kernel_ethtool_coalesce *kernel_coal,
++				struct netlink_ext_ack *extack)
++{
++	int reg_val = readl(HIF_INT_COAL);
++
++	if (reg_val & HIF_INT_COAL_ENABLE)
++		ec->rx_coalesce_usecs = (reg_val & HIF_RX_COAL_MAX_CLKS) /
++						HIF_RX_COAL_CLKS_PER_USEC;
++	else
++		ec->rx_coalesce_usecs = 0;
++
++	return 0;
++}
++
++/*
++ * pfe_eth_set_pauseparam - Sets pause parameters
++ *
++ */
++static int pfe_eth_set_pauseparam(struct net_device *ndev,
++				  struct ethtool_pauseparam *epause)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++
++	if (epause->tx_pause != epause->rx_pause) {
++		netdev_info(ndev,
++			    "hardware only support enable/disable both tx and rx\n");
++		return -EINVAL;
++	}
++
++	priv->pause_flag = 0;
++	priv->pause_flag |= epause->rx_pause ? PFE_PAUSE_FLAG_ENABLE : 0;
++	priv->pause_flag |= epause->autoneg ? PFE_PAUSE_FLAG_AUTONEG : 0;
++
++	if (epause->rx_pause || epause->autoneg) {
++		gemac_enable_pause_rx(priv->EMAC_baseaddr);
++		writel((readl(priv->GPI_baseaddr + GPI_TX_PAUSE_TIME) |
++					EGPI_PAUSE_ENABLE),
++				priv->GPI_baseaddr + GPI_TX_PAUSE_TIME);
++		if (priv->phydev) {
++			linkmode_set_bit(ETHTOOL_LINK_MODE_Pause_BIT,
++					 priv->phydev->supported);
++			linkmode_set_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT,
++					 priv->phydev->supported);
++			linkmode_set_bit(ETHTOOL_LINK_MODE_Pause_BIT,
++					 priv->phydev->advertising);
++			linkmode_set_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT,
++					 priv->phydev->advertising);
++		}
++	} else {
++		gemac_disable_pause_rx(priv->EMAC_baseaddr);
++		writel((readl(priv->GPI_baseaddr + GPI_TX_PAUSE_TIME) &
++					~EGPI_PAUSE_ENABLE),
++				priv->GPI_baseaddr + GPI_TX_PAUSE_TIME);
++		if (priv->phydev) {
++			linkmode_clear_bit(ETHTOOL_LINK_MODE_Pause_BIT,
++					   priv->phydev->supported);
++			linkmode_clear_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT,
++					   priv->phydev->supported);
++			linkmode_clear_bit(ETHTOOL_LINK_MODE_Pause_BIT,
++					   priv->phydev->advertising);
++			linkmode_clear_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT,
++					   priv->phydev->advertising);
++		}
++	}
++
++	return 0;
++}
++
++/*
++ * pfe_eth_get_pauseparam - Gets pause parameters
++ *
++ */
++static void pfe_eth_get_pauseparam(struct net_device *ndev,
++				   struct ethtool_pauseparam *epause)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++
++	epause->autoneg = (priv->pause_flag & PFE_PAUSE_FLAG_AUTONEG) != 0;
++	epause->tx_pause = (priv->pause_flag & PFE_PAUSE_FLAG_ENABLE) != 0;
++	epause->rx_pause = epause->tx_pause;
++}
++
++/*
++ * pfe_eth_get_hash
++ */
++#define PFE_HASH_BITS	6		/* #bits in hash */
++#define CRC32_POLY	0xEDB88320
++
++static int pfe_eth_get_hash(u8 *addr)
++{
++	unsigned int i, bit, data, crc, hash;
++
++	/* calculate crc32 value of mac address */
++	crc = 0xffffffff;
++
++	for (i = 0; i < 6; i++) {
++		data = addr[i];
++		for (bit = 0; bit < 8; bit++, data >>= 1) {
++			crc = (crc >> 1) ^
++				(((crc ^ data) & 1) ? CRC32_POLY : 0);
++		}
++	}
++
++	/*
++	 * only upper 6 bits (PFE_HASH_BITS) are used
++	 * which point to specific bit in the hash registers
++	 */
++	hash = (crc >> (32 - PFE_HASH_BITS)) & 0x3f;
++
++	return hash;
++}
++
++const struct ethtool_ops pfe_ethtool_ops = {
++	.supported_coalesce_params = ETHTOOL_COALESCE_RX_USECS,
++	.get_drvinfo = pfe_eth_get_drvinfo,
++	.get_regs_len = pfe_eth_gemac_reglen,
++	.get_regs = pfe_eth_gemac_get_regs,
++	.get_link = ethtool_op_get_link,
++	.get_wol  = pfe_eth_get_wol,
++	.set_wol  = pfe_eth_set_wol,
++	.set_pauseparam = pfe_eth_set_pauseparam,
++	.get_pauseparam = pfe_eth_get_pauseparam,
++	.get_strings = pfe_eth_gstrings,
++	.get_sset_count = pfe_eth_stats_count,
++	.get_ethtool_stats = pfe_eth_fill_stats,
++	.get_msglevel = pfe_eth_get_msglevel,
++	.set_msglevel = pfe_eth_set_msglevel,
++	.set_coalesce = pfe_eth_set_coalesce,
++	.get_coalesce = pfe_eth_get_coalesce,
++	.get_link_ksettings = pfe_eth_get_settings,
++	.set_link_ksettings = pfe_eth_set_settings,
++};
++
++/* pfe_eth_mdio_reset
++ */
++int pfe_eth_mdio_reset(struct mii_bus *bus)
++{
++	struct pfe_mdio_priv_s *priv = (struct pfe_mdio_priv_s *)bus->priv;
++	u32 phy_speed;
++
++
++	mutex_lock(&bus->mdio_lock);
++
++	/*
++	 * Set MII speed to 2.5 MHz (= clk_get_rate() / 2 * phy_speed)
++	 *
++	 * The formula for FEC MDC is 'ref_freq / (MII_SPEED x 2)' while
++	 * for ENET-MAC is 'ref_freq / ((MII_SPEED + 1) x 2)'.
++	 */
++	phy_speed = (DIV_ROUND_UP((pfe->ctrl.sys_clk * 1000), 4000000)
++		     << EMAC_MII_SPEED_SHIFT);
++	phy_speed |= EMAC_HOLDTIME(0x5);
++	__raw_writel(phy_speed, priv->mdio_base + EMAC_MII_CTRL_REG);
++
++	mutex_unlock(&bus->mdio_lock);
++
++	return 0;
++}
++
++/* pfe_eth_mdio_timeout
++ *
++ */
++static int pfe_eth_mdio_timeout(struct pfe_mdio_priv_s *priv, int timeout)
++{
++	while (!(__raw_readl(priv->mdio_base + EMAC_IEVENT_REG) &
++			EMAC_IEVENT_MII)) {
++		if (timeout-- <= 0)
++			return -1;
++		usleep_range(10, 20);
++	}
++	__raw_writel(EMAC_IEVENT_MII, priv->mdio_base + EMAC_IEVENT_REG);
++	return 0;
++}
++
++static int pfe_eth_mdio_mux(u8 muxval)
++{
++	struct i2c_adapter *a;
++	struct i2c_msg msg;
++	unsigned char buf[2];
++	int ret;
++
++	a = i2c_get_adapter(0);
++	if (!a)
++		return -ENODEV;
++
++	/* set bit 1 (the second bit) of chip at 0x09, register 0x13 */
++	buf[0] = 0x54; /* reg number */
++	buf[1] = (muxval << 6) | 0x3; /* data */
++	msg.addr = 0x66;
++	msg.buf = buf;
++	msg.len = 2;
++	msg.flags = 0;
++	ret = i2c_transfer(a, &msg, 1);
++	i2c_put_adapter(a);
++	if (ret != 1)
++		return -ENODEV;
++	return 0;
++}
++
++static int pfe_eth_mdio_write_addr(struct mii_bus *bus, int mii_id,
++				   int dev_addr, int regnum)
++{
++	struct pfe_mdio_priv_s *priv = (struct pfe_mdio_priv_s *)bus->priv;
++
++	__raw_writel(EMAC_MII_DATA_PA(mii_id) |
++		     EMAC_MII_DATA_RA(dev_addr) |
++		     EMAC_MII_DATA_TA | EMAC_MII_DATA(regnum),
++		     priv->mdio_base + EMAC_MII_DATA_REG);
++
++	if (pfe_eth_mdio_timeout(priv, EMAC_MDIO_TIMEOUT)) {
++		dev_err(&bus->dev, "phy MDIO address write timeout\n");
++		return -1;
++	}
++
++	return 0;
++}
++
++static int pfe_eth_mdio_write(struct mii_bus *bus, int mii_id, int regnum,
++			      u16 value)
++{
++	struct pfe_mdio_priv_s *priv = (struct pfe_mdio_priv_s *)bus->priv;
++
++	/*To access external PHYs on QDS board mux needs to be configured*/
++	if ((mii_id) && (pfe->mdio_muxval[mii_id]))
++		pfe_eth_mdio_mux(pfe->mdio_muxval[mii_id]);
++
++	if (regnum & MII_ADDR_C45) {
++		pfe_eth_mdio_write_addr(bus, mii_id, (regnum >> 16) & 0x1f,
++					regnum & 0xffff);
++		__raw_writel(EMAC_MII_DATA_OP_CL45_WR |
++			     EMAC_MII_DATA_PA(mii_id) |
++			     EMAC_MII_DATA_RA((regnum >> 16) & 0x1f) |
++			     EMAC_MII_DATA_TA | EMAC_MII_DATA(value),
++			     priv->mdio_base + EMAC_MII_DATA_REG);
++	} else {
++		/* start a write op */
++		__raw_writel(EMAC_MII_DATA_ST | EMAC_MII_DATA_OP_WR |
++			     EMAC_MII_DATA_PA(mii_id) |
++			     EMAC_MII_DATA_RA(regnum) |
++			     EMAC_MII_DATA_TA | EMAC_MII_DATA(value),
++			     priv->mdio_base + EMAC_MII_DATA_REG);
++	}
++
++	if (pfe_eth_mdio_timeout(priv, EMAC_MDIO_TIMEOUT)) {
++		dev_err(&bus->dev, "%s: phy MDIO write timeout\n", __func__);
++		return -1;
++	}
++	return 0;
++}
++
++static int pfe_eth_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
++{
++	struct pfe_mdio_priv_s *priv = (struct pfe_mdio_priv_s *)bus->priv;
++	u16 value = 0;
++
++	/*To access external PHYs on QDS board mux needs to be configured*/
++	if ((mii_id) && (pfe->mdio_muxval[mii_id]))
++		pfe_eth_mdio_mux(pfe->mdio_muxval[mii_id]);
++
++	if (regnum & MII_ADDR_C45) {
++		pfe_eth_mdio_write_addr(bus, mii_id, (regnum >> 16) & 0x1f,
++					regnum & 0xffff);
++		__raw_writel(EMAC_MII_DATA_OP_CL45_RD |
++			     EMAC_MII_DATA_PA(mii_id) |
++			     EMAC_MII_DATA_RA((regnum >> 16) & 0x1f) |
++			     EMAC_MII_DATA_TA,
++			     priv->mdio_base + EMAC_MII_DATA_REG);
++	} else {
++		/* start a read op */
++		__raw_writel(EMAC_MII_DATA_ST | EMAC_MII_DATA_OP_RD |
++			     EMAC_MII_DATA_PA(mii_id) |
++			     EMAC_MII_DATA_RA(regnum) |
++			     EMAC_MII_DATA_TA, priv->mdio_base +
++			     EMAC_MII_DATA_REG);
++	}
++
++	if (pfe_eth_mdio_timeout(priv, EMAC_MDIO_TIMEOUT)) {
++		dev_err(&bus->dev, "%s: phy MDIO read timeout\n", __func__);
++		return -1;
++	}
++
++	value = EMAC_MII_DATA(__raw_readl(priv->mdio_base +
++						EMAC_MII_DATA_REG));
++	return value;
++}
++
++static int pfe_eth_mdio_init(struct pfe *pfe,
++			     struct ls1012a_pfe_platform_data *pfe_info,
++			     int ii)
++{
++	struct pfe_mdio_priv_s *priv = NULL;
++	struct ls1012a_mdio_platform_data *mdio_info;
++	struct mii_bus *bus;
++	struct device_node *mdio_node;
++	int rc = 0;
++
++	mdio_info = (struct ls1012a_mdio_platform_data *)
++					pfe_info->ls1012a_mdio_pdata;
++	mdio_info->id = ii;
++
++	bus = mdiobus_alloc_size(sizeof(struct pfe_mdio_priv_s));
++	if (!bus) {
++		pr_err("mdiobus_alloc() failed\n");
++		rc = -ENOMEM;
++		goto err_mdioalloc;
++	}
++
++	bus->name = "ls1012a MDIO Bus";
++	snprintf(bus->id, MII_BUS_ID_SIZE, "ls1012a-%x", mdio_info->id);
++
++	bus->read = &pfe_eth_mdio_read;
++	bus->write = &pfe_eth_mdio_write;
++	bus->reset = &pfe_eth_mdio_reset;
++	bus->parent = pfe->dev;
++	bus->phy_mask = mdio_info->phy_mask;
++	bus->irq[0] = mdio_info->irq[0];
++	priv = bus->priv;
++	priv->mdio_base = cbus_emac_base[ii];
++
++	priv->mdc_div = mdio_info->mdc_div;
++	if (!priv->mdc_div)
++		priv->mdc_div = 64;
++
++	dev_info(bus->parent, "%s: mdc_div: %d, phy_mask: %x\n",
++		 __func__, priv->mdc_div, bus->phy_mask);
++	mdio_node = of_get_child_by_name(pfe->dev->of_node, "mdio");
++	if ((mdio_info->id == 0) && mdio_node) {
++		rc = of_mdiobus_register(bus, mdio_node);
++		of_node_put(mdio_node);
++	} else {
++		rc = mdiobus_register(bus);
++	}
++
++	if (rc) {
++		dev_err(bus->parent, "mdiobus_register(%s) failed\n",
++			bus->name);
++		goto err_mdioregister;
++	}
++
++	priv->mii_bus = bus;
++	pfe->mdio.mdio_priv[ii] = priv;
++
++	pfe_eth_mdio_reset(bus);
++
++	return 0;
++
++err_mdioregister:
++	mdiobus_free(bus);
++err_mdioalloc:
++	return rc;
++}
++
++/* pfe_eth_mdio_exit
++ */
++static void pfe_eth_mdio_exit(struct pfe *pfe,
++			      int ii)
++{
++	struct pfe_mdio_priv_s *mdio_priv = pfe->mdio.mdio_priv[ii];
++	struct mii_bus *bus = mdio_priv->mii_bus;
++
++	if (!bus)
++		return;
++	mdiobus_unregister(bus);
++	mdiobus_free(bus);
++}
++
++/* pfe_get_phydev_speed
++ */
++static int pfe_get_phydev_speed(struct phy_device *phydev)
++{
++	switch (phydev->speed) {
++	case 10:
++			return SPEED_10M;
++	case 100:
++			return SPEED_100M;
++	case 1000:
++	default:
++			return SPEED_1000M;
++	}
++}
++
++/* pfe_set_rgmii_speed
++ */
++#define RGMIIPCR	0x434
++/* RGMIIPCR bit definitions*/
++#define SCFG_RGMIIPCR_EN_AUTO           (0x00000008)
++#define SCFG_RGMIIPCR_SETSP_1000M       (0x00000004)
++#define SCFG_RGMIIPCR_SETSP_100M        (0x00000000)
++#define SCFG_RGMIIPCR_SETSP_10M         (0x00000002)
++#define SCFG_RGMIIPCR_SETFD             (0x00000001)
++
++#define MDIOSELCR	0x484
++#define MDIOSEL_SERDES	0x0
++#define MDIOSEL_EXTPHY  0x80000000
++
++static void pfe_set_rgmii_speed(struct phy_device *phydev)
++{
++	u32 rgmii_pcr;
++
++	regmap_read(pfe->scfg, RGMIIPCR, &rgmii_pcr);
++	rgmii_pcr  &= ~(SCFG_RGMIIPCR_SETSP_1000M | SCFG_RGMIIPCR_SETSP_10M);
++
++	switch (phydev->speed) {
++	case 10:
++			rgmii_pcr |= SCFG_RGMIIPCR_SETSP_10M;
++			break;
++	case 1000:
++			rgmii_pcr |= SCFG_RGMIIPCR_SETSP_1000M;
++			break;
++	case 100:
++	default:
++			/* Default is 100M */
++			break;
++	}
++	regmap_write(pfe->scfg, RGMIIPCR, rgmii_pcr);
++}
++
++/* pfe_get_phydev_duplex
++ */
++static int pfe_get_phydev_duplex(struct phy_device *phydev)
++{
++	/*return (phydev->duplex == DUPLEX_HALF) ? DUP_HALF:DUP_FULL ; */
++	return DUPLEX_FULL;
++}
++
++/* pfe_eth_adjust_link
++ */
++static void pfe_eth_adjust_link(struct net_device *ndev)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++	unsigned long flags;
++	struct phy_device *phydev = priv->phydev;
++	int new_state = 0;
++
++	netif_info(priv, drv, ndev, "%s\n", __func__);
++
++	spin_lock_irqsave(&priv->lock, flags);
++
++	if (phydev->link) {
++		/*
++		 * Now we make sure that we can be in full duplex mode.
++		 * If not, we operate in half-duplex mode.
++		 */
++		if (phydev->duplex != priv->oldduplex) {
++			new_state = 1;
++			gemac_set_duplex(priv->EMAC_baseaddr,
++					 pfe_get_phydev_duplex(phydev));
++			priv->oldduplex = phydev->duplex;
++		}
++
++		if (phydev->speed != priv->oldspeed) {
++			new_state = 1;
++			gemac_set_speed(priv->EMAC_baseaddr,
++					pfe_get_phydev_speed(phydev));
++			if (priv->einfo->mii_config ==
++					PHY_INTERFACE_MODE_RGMII_ID)
++				pfe_set_rgmii_speed(phydev);
++			priv->oldspeed = phydev->speed;
++		}
++
++		if (!priv->oldlink) {
++			new_state = 1;
++			priv->oldlink = 1;
++		}
++
++	} else if (priv->oldlink) {
++		new_state = 1;
++		priv->oldlink = 0;
++		priv->oldspeed = 0;
++		priv->oldduplex = -1;
++	}
++
++	if (new_state && netif_msg_link(priv))
++		phy_print_status(phydev);
++
++	spin_unlock_irqrestore(&priv->lock, flags);
++
++	/* Now, dump the details to the cdev.
++	 * XXX: Locking would be required? (uniprocess arch)
++	 *      Or, maybe move it in spinlock above
++	 */
++	if (us && priv->einfo->gem_id < PFE_CDEV_ETH_COUNT) {
++		pr_debug("Changing link state from (%u) to (%u) for ID=(%u)\n",
++			 link_states[priv->einfo->gem_id].state,
++			 phydev->link,
++			 priv->einfo->gem_id);
++		link_states[priv->einfo->gem_id].phy_id = priv->einfo->gem_id;
++		link_states[priv->einfo->gem_id].state = phydev->link;
++	}
++}
++
++/* pfe_phy_exit
++ */
++static void pfe_phy_exit(struct net_device *ndev)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++
++	netif_info(priv, drv, ndev, "%s\n", __func__);
++
++	phy_disconnect(priv->phydev);
++	priv->phydev = NULL;
++}
++
++/* pfe_eth_stop
++ */
++static void pfe_eth_stop(struct net_device *ndev, int wake)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++
++	netif_info(priv, drv, ndev, "%s\n", __func__);
++
++	if (wake) {
++		gemac_tx_disable(priv->EMAC_baseaddr);
++	} else {
++		gemac_disable(priv->EMAC_baseaddr);
++		gpi_disable(priv->GPI_baseaddr);
++
++		if (priv->phydev)
++			phy_stop(priv->phydev);
++	}
++}
++
++/* pfe_eth_start
++ */
++static int pfe_eth_start(struct pfe_eth_priv_s *priv)
++{
++	netif_info(priv, drv, priv->ndev, "%s\n", __func__);
++
++	if (priv->phydev)
++		phy_start(priv->phydev);
++
++	gpi_enable(priv->GPI_baseaddr);
++	gemac_enable(priv->EMAC_baseaddr);
++
++	return 0;
++}
++
++/*
++ * Configure on chip serdes through mdio
++ */
++static void ls1012a_configure_serdes(struct net_device *ndev)
++{
++	struct pfe_eth_priv_s *eth_priv = netdev_priv(ndev);
++	struct pfe_mdio_priv_s *mdio_priv = pfe->mdio.mdio_priv[eth_priv->id];
++	int sgmii_2500 = 0;
++	struct mii_bus *bus = mdio_priv->mii_bus;
++	u16 value = 0;
++
++	if (eth_priv->einfo->mii_config == PHY_INTERFACE_MODE_2500SGMII)
++		sgmii_2500 = 1;
++
++	netif_info(eth_priv, drv, ndev, "%s\n", __func__);
++	/* PCS configuration done with corresponding GEMAC */
++
++	pfe_eth_mdio_read(bus, 0, MDIO_SGMII_CR);
++	pfe_eth_mdio_read(bus, 0, MDIO_SGMII_SR);
++
++	pfe_eth_mdio_write(bus, 0, MDIO_SGMII_CR, SGMII_CR_RST);
++
++	if (sgmii_2500) {
++		pfe_eth_mdio_write(bus, 0, MDIO_SGMII_IF_MODE, SGMII_SPEED_1GBPS
++							       | SGMII_EN);
++		pfe_eth_mdio_write(bus, 0, MDIO_SGMII_DEV_ABIL_SGMII,
++				   SGMII_DEV_ABIL_ACK | SGMII_DEV_ABIL_SGMII);
++		pfe_eth_mdio_write(bus, 0, MDIO_SGMII_LINK_TMR_L, 0xa120);
++		pfe_eth_mdio_write(bus, 0, MDIO_SGMII_LINK_TMR_H, 0x7);
++		/* Autonegotiation need to be disabled for 2.5G SGMII mode*/
++		value = SGMII_CR_FD | SGMII_CR_SPEED_SEL1_1G;
++		pfe_eth_mdio_write(bus, 0, MDIO_SGMII_CR, value);
++	} else {
++		pfe_eth_mdio_write(bus, 0, MDIO_SGMII_IF_MODE,
++				   SGMII_SPEED_1GBPS
++				   | SGMII_USE_SGMII_AN
++				   | SGMII_EN);
++		pfe_eth_mdio_write(bus, 0, MDIO_SGMII_DEV_ABIL_SGMII,
++				   SGMII_DEV_ABIL_EEE_CLK_STP_EN
++				   | 0xa0
++				   | SGMII_DEV_ABIL_SGMII);
++		pfe_eth_mdio_write(bus, 0, MDIO_SGMII_LINK_TMR_L, 0x400);
++		pfe_eth_mdio_write(bus, 0, MDIO_SGMII_LINK_TMR_H, 0x0);
++		value = SGMII_CR_AN_EN | SGMII_CR_FD | SGMII_CR_SPEED_SEL1_1G;
++		pfe_eth_mdio_write(bus, 0, MDIO_SGMII_CR, value);
++	}
++}
++
++/*
++ * pfe_phy_init
++ *
++ */
++static int pfe_phy_init(struct net_device *ndev)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++	struct phy_device *phydev;
++	char phy_id[MII_BUS_ID_SIZE + 3];
++	char bus_id[MII_BUS_ID_SIZE];
++	phy_interface_t interface;
++
++	priv->oldlink = 0;
++	priv->oldspeed = 0;
++	priv->oldduplex = -1;
++
++	snprintf(bus_id, MII_BUS_ID_SIZE, "ls1012a-%d", 0);
++	snprintf(phy_id, MII_BUS_ID_SIZE + 3, PHY_ID_FMT, bus_id,
++		 priv->einfo->phy_id);
++	netif_info(priv, drv, ndev, "%s: %s\n", __func__, phy_id);
++	interface = priv->einfo->mii_config;
++	if ((interface == PHY_INTERFACE_MODE_SGMII) ||
++	    (interface == PHY_INTERFACE_MODE_2500SGMII)) {
++		/*Configure SGMII PCS */
++		if (pfe->scfg) {
++			/* Config MDIO from serdes */
++			regmap_write(pfe->scfg, MDIOSELCR, MDIOSEL_SERDES);
++		}
++		ls1012a_configure_serdes(ndev);
++	}
++
++	if (pfe->scfg) {
++		/*Config MDIO from PAD */
++		regmap_write(pfe->scfg, MDIOSELCR, MDIOSEL_EXTPHY);
++	}
++
++	priv->oldlink = 0;
++	priv->oldspeed = 0;
++	priv->oldduplex = -1;
++	pr_info("%s interface %x\n", __func__, interface);
++
++	if (priv->phy_node) {
++		phydev = of_phy_connect(ndev, priv->phy_node,
++					pfe_eth_adjust_link, 0,
++					priv->einfo->mii_config);
++		if (!(phydev)) {
++			netdev_err(ndev, "Unable to connect to phy\n");
++			return -ENODEV;
++		}
++
++	} else {
++		phydev = phy_connect(ndev, phy_id,
++				     &pfe_eth_adjust_link, interface);
++		if (IS_ERR(phydev)) {
++			netdev_err(ndev, "Unable to connect to phy\n");
++			return PTR_ERR(phydev);
++		}
++	}
++
++	priv->phydev = phydev;
++	phydev->irq = PHY_POLL;
++
++	return 0;
++}
++
++/* pfe_gemac_init
++ */
++static int pfe_gemac_init(struct pfe_eth_priv_s *priv)
++{
++	struct gemac_cfg cfg;
++
++	netif_info(priv, ifup, priv->ndev, "%s\n", __func__);
++
++	cfg.mode = 0;
++	cfg.speed = SPEED_1000M;
++	cfg.duplex = DUPLEX_FULL;
++
++	gemac_set_config(priv->EMAC_baseaddr, &cfg);
++	gemac_allow_broadcast(priv->EMAC_baseaddr);
++	gemac_enable_1536_rx(priv->EMAC_baseaddr);
++	gemac_enable_stacked_vlan(priv->EMAC_baseaddr);
++	gemac_enable_pause_rx(priv->EMAC_baseaddr);
++	gemac_set_bus_width(priv->EMAC_baseaddr, 64);
++
++	/*GEM will perform checksum verifications*/
++	if (priv->ndev->features & NETIF_F_RXCSUM)
++		gemac_enable_rx_checksum_offload(priv->EMAC_baseaddr);
++	else
++		gemac_disable_rx_checksum_offload(priv->EMAC_baseaddr);
++
++	return 0;
++}
++
++/* pfe_eth_event_handler
++ */
++static int pfe_eth_event_handler(void *data, int event, int qno)
++{
++	struct pfe_eth_priv_s *priv = data;
++
++	switch (event) {
++	case EVENT_RX_PKT_IND:
++
++		if (qno == 0) {
++			if (napi_schedule_prep(&priv->high_napi)) {
++				netif_info(priv, intr, priv->ndev,
++					   "%s: schedule high prio poll\n"
++					   , __func__);
++
++#ifdef PFE_ETH_NAPI_STATS
++				priv->napi_counters[NAPI_SCHED_COUNT]++;
++#endif
++
++				__napi_schedule(&priv->high_napi);
++			}
++		} else if (qno == 1) {
++			if (napi_schedule_prep(&priv->low_napi)) {
++				netif_info(priv, intr, priv->ndev,
++					   "%s: schedule low prio poll\n"
++					   , __func__);
++
++#ifdef PFE_ETH_NAPI_STATS
++				priv->napi_counters[NAPI_SCHED_COUNT]++;
++#endif
++				__napi_schedule(&priv->low_napi);
++			}
++		} else if (qno == 2) {
++			if (napi_schedule_prep(&priv->lro_napi)) {
++				netif_info(priv, intr, priv->ndev,
++					   "%s: schedule lro prio poll\n"
++					   , __func__);
++
++#ifdef PFE_ETH_NAPI_STATS
++				priv->napi_counters[NAPI_SCHED_COUNT]++;
++#endif
++				__napi_schedule(&priv->lro_napi);
++			}
++		}
++
++		break;
++
++	case EVENT_TXDONE_IND:
++		pfe_eth_flush_tx(priv);
++		hif_lib_event_handler_start(&priv->client, EVENT_TXDONE_IND, 0);
++		break;
++	case EVENT_HIGH_RX_WM:
++	default:
++		break;
++	}
++
++	return 0;
++}
++
++static int pfe_eth_change_mtu(struct net_device *ndev, int new_mtu)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++
++	ndev->mtu = new_mtu;
++	new_mtu += ETH_HLEN + ETH_FCS_LEN;
++	gemac_set_rx_max_fl(priv->EMAC_baseaddr, new_mtu);
++
++	return 0;
++}
++
++/* pfe_eth_open
++ */
++static int pfe_eth_open(struct net_device *ndev)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++	struct hif_client_s *client;
++	int rc;
++
++	netif_info(priv, ifup, ndev, "%s\n", __func__);
++
++	/* Register client driver with HIF */
++	client = &priv->client;
++	memset(client, 0, sizeof(*client));
++	client->id = PFE_CL_GEM0 + priv->id;
++	client->tx_qn = emac_txq_cnt;
++	client->rx_qn = EMAC_RXQ_CNT;
++	client->priv = priv;
++	client->pfe = priv->pfe;
++	client->event_handler = pfe_eth_event_handler;
++
++	client->tx_qsize = EMAC_TXQ_DEPTH;
++	client->rx_qsize = EMAC_RXQ_DEPTH;
++
++	rc = hif_lib_client_register(client);
++	if (rc) {
++		netdev_err(ndev, "%s: hif_lib_client_register(%d) failed\n",
++			   __func__, client->id);
++		goto err0;
++	}
++
++	netif_info(priv, drv, ndev, "%s: registered client: %p\n", __func__,
++		   client);
++
++	pfe_gemac_init(priv);
++
++	if (!is_valid_ether_addr(ndev->dev_addr)) {
++		netdev_err(ndev, "%s: invalid MAC address\n", __func__);
++		rc = -EADDRNOTAVAIL;
++		goto err1;
++	}
++
++	gemac_set_laddrN(priv->EMAC_baseaddr,
++			 (struct pfe_mac_addr *)ndev->dev_addr, 1);
++
++	napi_enable(&priv->high_napi);
++	napi_enable(&priv->low_napi);
++	napi_enable(&priv->lro_napi);
++
++	rc = pfe_eth_start(priv);
++
++	netif_tx_wake_all_queues(ndev);
++
++	return rc;
++
++err1:
++	hif_lib_client_unregister(&priv->client);
++
++err0:
++	return rc;
++}
++
++/*
++ *  pfe_eth_shutdown
++ */
++int pfe_eth_shutdown(struct net_device *ndev, int wake)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++	int i, qstatus, id;
++	unsigned long next_poll = jiffies + 1, end = jiffies +
++				(TX_POLL_TIMEOUT_MS * HZ) / 1000;
++	int tx_pkts, prv_tx_pkts;
++
++	netif_info(priv, ifdown, ndev, "%s\n", __func__);
++
++	for (i = 0; i < emac_txq_cnt; i++)
++		hrtimer_cancel(&priv->fast_tx_timeout[i].timer);
++
++	netif_tx_stop_all_queues(ndev);
++
++	do {
++		tx_pkts = 0;
++		pfe_eth_flush_tx(priv);
++
++		for (i = 0; i < emac_txq_cnt; i++)
++			tx_pkts += hif_lib_tx_pending(&priv->client, i);
++
++		if (tx_pkts) {
++			/*Don't wait forever, break if we cross max timeout */
++			if (time_after(jiffies, end)) {
++				pr_err(
++					"(%s)Tx is not complete after %dmsec\n",
++					ndev->name, TX_POLL_TIMEOUT_MS);
++				break;
++			}
++
++			pr_info("%s : (%s) Waiting for tx packets to free. Pending tx pkts = %d.\n"
++				, __func__, ndev->name, tx_pkts);
++			if (need_resched())
++				schedule();
++		}
++
++	} while (tx_pkts);
++
++	end = jiffies + (TX_POLL_TIMEOUT_MS * HZ) / 1000;
++
++	prv_tx_pkts = tmu_pkts_processed(priv->id);
++	/*
++	 * Wait till TMU transmits all pending packets
++	 * poll tmu_qstatus and pkts processed by TMU for every 10ms
++	 * Consider TMU is busy, If we see TMU qeueu pending or any packets
++	 * processed by TMU
++	 */
++	while (1) {
++		if (time_after(jiffies, next_poll)) {
++			tx_pkts = tmu_pkts_processed(priv->id);
++			qstatus = tmu_qstatus(priv->id) & 0x7ffff;
++
++			if (!qstatus && (tx_pkts == prv_tx_pkts))
++				break;
++			/* Don't wait forever, break if we cross max
++			 * timeout(TX_POLL_TIMEOUT_MS)
++			 */
++			if (time_after(jiffies, end)) {
++				pr_err("TMU%d is busy after %dmsec\n",
++				       priv->id, TX_POLL_TIMEOUT_MS);
++				break;
++			}
++			prv_tx_pkts = tx_pkts;
++			next_poll++;
++		}
++		if (need_resched())
++			schedule();
++	}
++	/* Wait for some more time to complete transmitting packet if any */
++	next_poll = jiffies + 1;
++	while (1) {
++		if (time_after(jiffies, next_poll))
++			break;
++		if (need_resched())
++			schedule();
++	}
++
++	pfe_eth_stop(ndev, wake);
++
++	napi_disable(&priv->lro_napi);
++	napi_disable(&priv->low_napi);
++	napi_disable(&priv->high_napi);
++
++	for (id = CLASS0_ID; id <= CLASS_MAX_ID; id++) {
++		pe_dmem_write(id, 0, CLASS_DM_CRC_VALIDATED
++			      + (priv->id * 4), 4);
++	}
++
++	hif_lib_client_unregister(&priv->client);
++
++	return 0;
++}
++
++/* pfe_eth_close
++ *
++ */
++static int pfe_eth_close(struct net_device *ndev)
++{
++	pfe_eth_shutdown(ndev, 0);
++
++	return 0;
++}
++
++/* pfe_eth_suspend
++ *
++ * return value : 1 if netdevice is configured to wakeup system
++ *                0 otherwise
++ */
++int pfe_eth_suspend(struct net_device *ndev)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++	int retval = 0;
++
++	if (priv->wol) {
++		gemac_set_wol(priv->EMAC_baseaddr, priv->wol);
++		retval = 1;
++	}
++	pfe_eth_shutdown(ndev, priv->wol);
++
++	return retval;
++}
++
++/* pfe_eth_resume
++ *
++ */
++int pfe_eth_resume(struct net_device *ndev)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++
++	if (priv->wol)
++		gemac_set_wol(priv->EMAC_baseaddr, 0);
++	gemac_tx_enable(priv->EMAC_baseaddr);
++
++	return pfe_eth_open(ndev);
++}
++
++/* pfe_eth_get_queuenum
++ */
++static int pfe_eth_get_queuenum(struct pfe_eth_priv_s *priv, struct sk_buff
++					*skb)
++{
++	int queuenum = 0;
++	unsigned long flags;
++
++	/* Get the Fast Path queue number */
++	/*
++	 * Use conntrack mark (if conntrack exists), then packet mark (if any),
++	 * then fallback to default
++	 */
++#if defined(CONFIG_IP_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_MARK)
++	if (skb->_nfct) {
++		enum ip_conntrack_info cinfo;
++		struct nf_conn *ct;
++
++		ct = nf_ct_get(skb, &cinfo);
++
++		if (ct) {
++			u32 connmark;
++
++			connmark = ct->mark;
++
++			if ((connmark & 0x80000000) && priv->id != 0)
++				connmark >>= 16;
++
++			queuenum = connmark & EMAC_QUEUENUM_MASK;
++		}
++	} else  {/* continued after #endif ... */
++#endif
++		if (skb->mark) {
++			queuenum = skb->mark & EMAC_QUEUENUM_MASK;
++		} else {
++			spin_lock_irqsave(&priv->lock, flags);
++			queuenum = priv->default_priority & EMAC_QUEUENUM_MASK;
++			spin_unlock_irqrestore(&priv->lock, flags);
++		}
++#if defined(CONFIG_IP_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_MARK)
++	}
++#endif
++	return queuenum;
++}
++
++/* pfe_eth_might_stop_tx
++ *
++ */
++static int pfe_eth_might_stop_tx(struct pfe_eth_priv_s *priv, int queuenum,
++				 struct netdev_queue *tx_queue,
++				 unsigned int n_desc,
++				 unsigned int n_segs)
++{
++	ktime_t kt;
++	int tried = 0;
++
++try_again:
++	if (unlikely((__hif_tx_avail(&pfe->hif) < n_desc) ||
++	(hif_lib_tx_avail(&priv->client, queuenum) < n_desc) ||
++	(hif_lib_tx_credit_avail(pfe, priv->id, queuenum) < n_segs))) {
++		if (!tried) {
++			__hif_lib_update_credit(&priv->client, queuenum);
++			tried = 1;
++			goto try_again;
++		}
++#ifdef PFE_ETH_TX_STATS
++		if (__hif_tx_avail(&pfe->hif) < n_desc) {
++			priv->stop_queue_hif[queuenum]++;
++		} else if (hif_lib_tx_avail(&priv->client, queuenum) < n_desc) {
++			priv->stop_queue_hif_client[queuenum]++;
++		} else if (hif_lib_tx_credit_avail(pfe, priv->id, queuenum) <
++			n_segs) {
++			priv->stop_queue_credit[queuenum]++;
++		}
++		priv->stop_queue_total[queuenum]++;
++#endif
++		netif_tx_stop_queue(tx_queue);
++
++		kt = ktime_set(0, LS1012A_TX_FAST_RECOVERY_TIMEOUT_MS *
++				NSEC_PER_MSEC);
++		hrtimer_start(&priv->fast_tx_timeout[queuenum].timer, kt,
++			      HRTIMER_MODE_REL);
++		return -1;
++	} else {
++		return 0;
++	}
++}
++
++#define SA_MAX_OP 2
++/* pfe_hif_send_packet
++ *
++ * At this level if TX fails we drop the packet
++ */
++static void pfe_hif_send_packet(struct sk_buff *skb, struct  pfe_eth_priv_s
++					*priv, int queuenum)
++{
++	struct skb_shared_info *sh = skb_shinfo(skb);
++	unsigned int nr_frags;
++	u32 ctrl = 0;
++
++	netif_info(priv, tx_queued, priv->ndev, "%s\n", __func__);
++
++	if (skb_is_gso(skb)) {
++		priv->stats.tx_dropped++;
++		return;
++	}
++
++	if (skb->ip_summed == CHECKSUM_PARTIAL)
++		ctrl = HIF_CTRL_TX_CHECKSUM;
++
++	nr_frags = sh->nr_frags;
++
++	if (nr_frags) {
++		skb_frag_t *f;
++		int i;
++
++		__hif_lib_xmit_pkt(&priv->client, queuenum, skb->data,
++				   skb_headlen(skb), ctrl, HIF_FIRST_BUFFER,
++				   skb);
++
++		for (i = 0; i < nr_frags - 1; i++) {
++			f = &sh->frags[i];
++			__hif_lib_xmit_pkt(&priv->client, queuenum,
++					   skb_frag_address(f),
++					   skb_frag_size(f),
++					   0x0, 0x0, skb);
++		}
++
++		f = &sh->frags[i];
++
++		__hif_lib_xmit_pkt(&priv->client, queuenum,
++				   skb_frag_address(f), skb_frag_size(f),
++				   0x0, HIF_LAST_BUFFER | HIF_DATA_VALID,
++				   skb);
++
++		netif_info(priv, tx_queued, priv->ndev,
++			   "%s: pkt sent successfully skb:%p nr_frags:%d len:%d\n",
++			   __func__, skb, nr_frags, skb->len);
++	} else {
++		__hif_lib_xmit_pkt(&priv->client, queuenum, skb->data,
++				   skb->len, ctrl, HIF_FIRST_BUFFER |
++				   HIF_LAST_BUFFER | HIF_DATA_VALID,
++				   skb);
++		netif_info(priv, tx_queued, priv->ndev,
++			   "%s: pkt sent successfully skb:%p len:%d\n",
++			   __func__, skb, skb->len);
++	}
++	hif_tx_dma_start();
++	priv->stats.tx_packets++;
++	priv->stats.tx_bytes += skb->len;
++	hif_lib_tx_credit_use(pfe, priv->id, queuenum, 1);
++}
++
++/* pfe_eth_flush_txQ
++ */
++static void pfe_eth_flush_txQ(struct pfe_eth_priv_s *priv, int tx_q_num, int
++				from_tx, int n_desc)
++{
++	struct sk_buff *skb;
++	struct netdev_queue *tx_queue = netdev_get_tx_queue(priv->ndev,
++								tx_q_num);
++	unsigned int flags;
++
++	netif_info(priv, tx_done, priv->ndev, "%s\n", __func__);
++
++	if (!from_tx)
++		__netif_tx_lock_bh(tx_queue);
++
++	/* Clean HIF and client queue */
++	while ((skb = hif_lib_tx_get_next_complete(&priv->client,
++						   tx_q_num, &flags,
++						   HIF_TX_DESC_NT))) {
++		if (flags & HIF_DATA_VALID)
++			dev_kfree_skb_any(skb);
++	}
++	if (!from_tx)
++		__netif_tx_unlock_bh(tx_queue);
++}
++
++/* pfe_eth_flush_tx
++ */
++static void pfe_eth_flush_tx(struct pfe_eth_priv_s *priv)
++{
++	int ii;
++
++	netif_info(priv, tx_done, priv->ndev, "%s\n", __func__);
++
++	for (ii = 0; ii < emac_txq_cnt; ii++) {
++		pfe_eth_flush_txQ(priv, ii, 0, 0);
++		__hif_lib_update_credit(&priv->client, ii);
++	}
++}
++
++void pfe_tx_get_req_desc(struct sk_buff *skb, unsigned int *n_desc, unsigned int
++				*n_segs)
++{
++	struct skb_shared_info *sh = skb_shinfo(skb);
++
++	/* Scattered data */
++	if (sh->nr_frags) {
++		*n_desc = sh->nr_frags + 1;
++		*n_segs = 1;
++	/* Regular case */
++	} else {
++		*n_desc = 1;
++		*n_segs = 1;
++	}
++}
++
++/* pfe_eth_send_packet
++ */
++static int pfe_eth_send_packet(struct sk_buff *skb, struct net_device *ndev)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++	int tx_q_num = skb_get_queue_mapping(skb);
++	int n_desc, n_segs;
++	struct netdev_queue *tx_queue = netdev_get_tx_queue(priv->ndev,
++								tx_q_num);
++
++	netif_info(priv, tx_queued, ndev, "%s\n", __func__);
++
++	if ((!skb_is_gso(skb)) && (skb_headroom(skb) < (PFE_PKT_HEADER_SZ +
++			sizeof(unsigned long)))) {
++		netif_warn(priv, tx_err, priv->ndev, "%s: copying skb\n",
++			   __func__);
++
++		if (pskb_expand_head(skb, (PFE_PKT_HEADER_SZ + sizeof(unsigned
++					long)), 0, GFP_ATOMIC)) {
++			/* No need to re-transmit, no way to recover*/
++			kfree_skb(skb);
++			priv->stats.tx_dropped++;
++			return NETDEV_TX_OK;
++		}
++	}
++
++	pfe_tx_get_req_desc(skb, &n_desc, &n_segs);
++
++	hif_tx_lock(&pfe->hif);
++	if (unlikely(pfe_eth_might_stop_tx(priv, tx_q_num, tx_queue, n_desc,
++					   n_segs))) {
++#ifdef PFE_ETH_TX_STATS
++		if (priv->was_stopped[tx_q_num]) {
++			priv->clean_fail[tx_q_num]++;
++			priv->was_stopped[tx_q_num] = 0;
++		}
++#endif
++		hif_tx_unlock(&pfe->hif);
++		return NETDEV_TX_BUSY;
++	}
++
++	pfe_hif_send_packet(skb, priv, tx_q_num);
++
++	hif_tx_unlock(&pfe->hif);
++
++	tx_queue->trans_start = jiffies;
++
++#ifdef PFE_ETH_TX_STATS
++	priv->was_stopped[tx_q_num] = 0;
++#endif
++
++	return NETDEV_TX_OK;
++}
++
++/* pfe_eth_select_queue
++ *
++ */
++static u16 pfe_eth_select_queue(struct net_device *ndev, struct sk_buff *skb,
++				struct net_device *sb_dev)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++
++	return pfe_eth_get_queuenum(priv, skb);
++}
++
++/* pfe_eth_get_stats
++ */
++static struct net_device_stats *pfe_eth_get_stats(struct net_device *ndev)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++
++	netif_info(priv, drv, ndev, "%s\n", __func__);
++
++	return &priv->stats;
++}
++
++/* pfe_eth_set_mac_address
++ */
++static int pfe_eth_set_mac_address(struct net_device *ndev, void *addr)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++	struct sockaddr *sa = addr;
++
++	netif_info(priv, drv, ndev, "%s\n", __func__);
++
++	if (!is_valid_ether_addr(sa->sa_data))
++		return -EADDRNOTAVAIL;
++
++	memcpy(ndev->dev_addr, sa->sa_data, ETH_ALEN);
++
++	gemac_set_laddrN(priv->EMAC_baseaddr,
++			 (struct pfe_mac_addr *)ndev->dev_addr, 1);
++
++	return 0;
++}
++
++/* pfe_eth_enet_addr_byte_mac
++ */
++int pfe_eth_enet_addr_byte_mac(u8 *enet_byte_addr,
++			       struct pfe_mac_addr *enet_addr)
++{
++	if (!enet_byte_addr || !enet_addr) {
++		return -1;
++
++	} else {
++		enet_addr->bottom = enet_byte_addr[0] |
++			(enet_byte_addr[1] << 8) |
++			(enet_byte_addr[2] << 16) |
++			(enet_byte_addr[3] << 24);
++		enet_addr->top = enet_byte_addr[4] |
++			(enet_byte_addr[5] << 8);
++		return 0;
++	}
++}
++
++/* pfe_eth_set_multi
++ */
++static void pfe_eth_set_multi(struct net_device *ndev)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++	struct pfe_mac_addr    hash_addr; /* hash register structure */
++	/* specific mac address	register structure */
++	struct pfe_mac_addr    spec_addr;
++	int		result; /* index into hash register to set.. */
++	int		uc_count = 0;
++	struct netdev_hw_addr *ha;
++
++	if (ndev->flags & IFF_PROMISC) {
++		netif_info(priv, drv, ndev, "entering promiscuous mode\n");
++
++		priv->promisc = 1;
++		gemac_enable_copy_all(priv->EMAC_baseaddr);
++	} else {
++		priv->promisc = 0;
++		gemac_disable_copy_all(priv->EMAC_baseaddr);
++	}
++
++	/* Enable broadcast frame reception if required. */
++	if (ndev->flags & IFF_BROADCAST) {
++		gemac_allow_broadcast(priv->EMAC_baseaddr);
++	} else {
++		netif_info(priv, drv, ndev,
++			   "disabling broadcast frame reception\n");
++
++		gemac_no_broadcast(priv->EMAC_baseaddr);
++	}
++
++	if (ndev->flags & IFF_ALLMULTI) {
++		/* Set the hash to rx all multicast frames */
++		hash_addr.bottom = 0xFFFFFFFF;
++		hash_addr.top = 0xFFFFFFFF;
++		gemac_set_hash(priv->EMAC_baseaddr, &hash_addr);
++		netdev_for_each_uc_addr(ha, ndev) {
++			if (uc_count >= MAX_UC_SPEC_ADDR_REG)
++				break;
++			pfe_eth_enet_addr_byte_mac(ha->addr, &spec_addr);
++			gemac_set_laddrN(priv->EMAC_baseaddr, &spec_addr,
++					 uc_count + 2);
++			uc_count++;
++		}
++	} else if ((netdev_mc_count(ndev) > 0)  || (netdev_uc_count(ndev))) {
++		u8 *addr;
++
++		hash_addr.bottom = 0;
++		hash_addr.top = 0;
++
++		netdev_for_each_mc_addr(ha, ndev) {
++			addr = ha->addr;
++
++			netif_info(priv, drv, ndev,
++				   "adding multicast address %X:%X:%X:%X:%X:%X to gem filter\n",
++				addr[0], addr[1], addr[2],
++				addr[3], addr[4], addr[5]);
++
++			result = pfe_eth_get_hash(addr);
++
++			if (result < EMAC_HASH_REG_BITS) {
++				if (result < 32)
++					hash_addr.bottom |= (1 << result);
++				else
++					hash_addr.top |= (1 << (result - 32));
++			} else {
++				break;
++			}
++		}
++
++		uc_count = -1;
++		netdev_for_each_uc_addr(ha, ndev) {
++			addr = ha->addr;
++
++			if (++uc_count < MAX_UC_SPEC_ADDR_REG)   {
++				netdev_info(ndev,
++					    "adding unicast address %02x:%02x:%02x:%02x:%02x:%02x to gem filter\n",
++					    addr[0], addr[1], addr[2],
++					    addr[3], addr[4], addr[5]);
++				pfe_eth_enet_addr_byte_mac(addr, &spec_addr);
++				gemac_set_laddrN(priv->EMAC_baseaddr,
++						 &spec_addr, uc_count + 2);
++			} else {
++				netif_info(priv, drv, ndev,
++					   "adding unicast address %02x:%02x:%02x:%02x:%02x:%02x to gem hash\n",
++					   addr[0], addr[1], addr[2],
++					   addr[3], addr[4], addr[5]);
++
++				result = pfe_eth_get_hash(addr);
++				if (result >= EMAC_HASH_REG_BITS) {
++					break;
++
++				} else {
++					if (result < 32)
++						hash_addr.bottom |= (1 <<
++								result);
++					else
++						hash_addr.top |= (1 <<
++								(result - 32));
++				}
++			}
++		}
++
++		gemac_set_hash(priv->EMAC_baseaddr, &hash_addr);
++	}
++
++	if (!(netdev_uc_count(ndev) >= MAX_UC_SPEC_ADDR_REG)) {
++		/*
++		 *  Check if there are any specific address HW registers that
++		 * need to be flushed
++		 */
++		for (uc_count = netdev_uc_count(ndev); uc_count <
++			MAX_UC_SPEC_ADDR_REG; uc_count++)
++			gemac_clear_laddrN(priv->EMAC_baseaddr, uc_count + 2);
++	}
++
++	if (ndev->flags & IFF_LOOPBACK)
++		gemac_set_loop(priv->EMAC_baseaddr, LB_LOCAL);
++}
++
++/* pfe_eth_set_features
++ */
++static int pfe_eth_set_features(struct net_device *ndev, netdev_features_t
++					features)
++{
++	struct pfe_eth_priv_s *priv = netdev_priv(ndev);
++	int rc = 0;
++
++	if (features & NETIF_F_RXCSUM)
++		gemac_enable_rx_checksum_offload(priv->EMAC_baseaddr);
++	else
++		gemac_disable_rx_checksum_offload(priv->EMAC_baseaddr);
++	return rc;
++}
++
++/* pfe_eth_fast_tx_timeout
++ */
++static enum hrtimer_restart pfe_eth_fast_tx_timeout(struct hrtimer *timer)
++{
++	struct pfe_eth_fast_timer *fast_tx_timeout = container_of(timer, struct
++							pfe_eth_fast_timer,
++							timer);
++	struct pfe_eth_priv_s *priv =  container_of(fast_tx_timeout->base,
++							struct pfe_eth_priv_s,
++							fast_tx_timeout);
++	struct netdev_queue *tx_queue = netdev_get_tx_queue(priv->ndev,
++						fast_tx_timeout->queuenum);
++
++	if (netif_tx_queue_stopped(tx_queue)) {
++#ifdef PFE_ETH_TX_STATS
++		priv->was_stopped[fast_tx_timeout->queuenum] = 1;
++#endif
++		netif_tx_wake_queue(tx_queue);
++	}
++
++	return HRTIMER_NORESTART;
++}
++
++/* pfe_eth_fast_tx_timeout_init
++ */
++static void pfe_eth_fast_tx_timeout_init(struct pfe_eth_priv_s *priv)
++{
++	int i;
++
++	for (i = 0; i < emac_txq_cnt; i++) {
++		priv->fast_tx_timeout[i].queuenum = i;
++		hrtimer_init(&priv->fast_tx_timeout[i].timer, CLOCK_MONOTONIC,
++			     HRTIMER_MODE_REL);
++		priv->fast_tx_timeout[i].timer.function =
++				pfe_eth_fast_tx_timeout;
++		priv->fast_tx_timeout[i].base = priv->fast_tx_timeout;
++	}
++}
++
++static struct sk_buff *pfe_eth_rx_skb(struct net_device *ndev,
++				      struct	pfe_eth_priv_s *priv,
++				      unsigned int qno)
++{
++	void *buf_addr;
++	unsigned int rx_ctrl;
++	unsigned int desc_ctrl = 0;
++	struct hif_ipsec_hdr *ipsec_hdr = NULL;
++	struct sk_buff *skb;
++	struct sk_buff *skb_frag, *skb_frag_last = NULL;
++	int length = 0, offset;
++
++	skb = priv->skb_inflight[qno];
++
++	if (skb) {
++		skb_frag_last = skb_shinfo(skb)->frag_list;
++		if (skb_frag_last) {
++			while (skb_frag_last->next)
++				skb_frag_last = skb_frag_last->next;
++		}
++	}
++
++	while (!(desc_ctrl & CL_DESC_LAST)) {
++		buf_addr = hif_lib_receive_pkt(&priv->client, qno, &length,
++					       &offset, &rx_ctrl, &desc_ctrl,
++					       (void **)&ipsec_hdr);
++		if (!buf_addr)
++			goto incomplete;
++
++#ifdef PFE_ETH_NAPI_STATS
++		priv->napi_counters[NAPI_DESC_COUNT]++;
++#endif
++
++		/* First frag */
++		if (desc_ctrl & CL_DESC_FIRST) {
++			skb = build_skb(buf_addr, 0);
++			if (unlikely(!skb))
++				goto pkt_drop;
++
++			skb_reserve(skb, offset);
++			skb_put(skb, length);
++			skb->dev = ndev;
++
++			if ((ndev->features & NETIF_F_RXCSUM) && (rx_ctrl &
++					HIF_CTRL_RX_CHECKSUMMED))
++				skb->ip_summed = CHECKSUM_UNNECESSARY;
++			else
++				skb_checksum_none_assert(skb);
++
++		} else {
++			/* Next frags */
++			if (unlikely(!skb)) {
++				pr_err("%s: NULL skb_inflight\n",
++				       __func__);
++				goto pkt_drop;
++			}
++
++			skb_frag = build_skb(buf_addr, 0);
++
++			if (unlikely(!skb_frag)) {
++				kfree(buf_addr);
++				goto pkt_drop;
++			}
++
++			skb_reserve(skb_frag, offset);
++			skb_put(skb_frag, length);
++
++			skb_frag->dev = ndev;
++
++			if (skb_shinfo(skb)->frag_list)
++				skb_frag_last->next = skb_frag;
++			else
++				skb_shinfo(skb)->frag_list = skb_frag;
++
++			skb->truesize += skb_frag->truesize;
++			skb->data_len += length;
++			skb->len += length;
++			skb_frag_last = skb_frag;
++		}
++	}
++
++	priv->skb_inflight[qno] = NULL;
++	return skb;
++
++incomplete:
++	priv->skb_inflight[qno] = skb;
++	return NULL;
++
++pkt_drop:
++	priv->skb_inflight[qno] = NULL;
++
++	if (skb)
++		kfree_skb(skb);
++	else
++		kfree(buf_addr);
++
++	priv->stats.rx_errors++;
++
++	return NULL;
++}
++
++/* pfe_eth_poll
++ */
++static int pfe_eth_poll(struct pfe_eth_priv_s *priv, struct napi_struct *napi,
++			unsigned int qno, int budget)
++{
++	struct net_device *ndev = priv->ndev;
++	struct sk_buff *skb;
++	int work_done = 0;
++	unsigned int len;
++
++	netif_info(priv, intr, priv->ndev, "%s\n", __func__);
++
++#ifdef PFE_ETH_NAPI_STATS
++	priv->napi_counters[NAPI_POLL_COUNT]++;
++#endif
++
++	do {
++		skb = pfe_eth_rx_skb(ndev, priv, qno);
++
++		if (!skb)
++			break;
++
++		len = skb->len;
++
++		/* Packet will be processed */
++		skb->protocol = eth_type_trans(skb, ndev);
++
++		netif_receive_skb(skb);
++
++		priv->stats.rx_packets++;
++		priv->stats.rx_bytes += len;
++
++		work_done++;
++
++#ifdef PFE_ETH_NAPI_STATS
++		priv->napi_counters[NAPI_PACKET_COUNT]++;
++#endif
++
++	} while (work_done < budget);
++
++	/*
++	 * If no Rx receive nor cleanup work was done, exit polling mode.
++	 * No more netif_running(dev) check is required here , as this is
++	 * checked in net/core/dev.c (2.6.33.5 kernel specific).
++	 */
++	if (work_done < budget) {
++		napi_complete(napi);
++
++		hif_lib_event_handler_start(&priv->client, EVENT_RX_PKT_IND,
++					    qno);
++	}
++#ifdef PFE_ETH_NAPI_STATS
++	else
++		priv->napi_counters[NAPI_FULL_BUDGET_COUNT]++;
++#endif
++
++	return work_done;
++}
++
++/*
++ * pfe_eth_lro_poll
++ */
++static int pfe_eth_lro_poll(struct napi_struct *napi, int budget)
++{
++	struct pfe_eth_priv_s *priv = container_of(napi, struct pfe_eth_priv_s,
++							lro_napi);
++
++	netif_info(priv, intr, priv->ndev, "%s\n", __func__);
++
++	return pfe_eth_poll(priv, napi, 2, budget);
++}
++
++/* pfe_eth_low_poll
++ */
++static int pfe_eth_low_poll(struct napi_struct *napi, int budget)
++{
++	struct pfe_eth_priv_s *priv = container_of(napi, struct pfe_eth_priv_s,
++							low_napi);
++
++	netif_info(priv, intr, priv->ndev, "%s\n", __func__);
++
++	return pfe_eth_poll(priv, napi, 1, budget);
++}
++
++/* pfe_eth_high_poll
++ */
++static int pfe_eth_high_poll(struct napi_struct *napi, int budget)
++{
++	struct pfe_eth_priv_s *priv = container_of(napi, struct pfe_eth_priv_s,
++							high_napi);
++
++	netif_info(priv, intr, priv->ndev, "%s\n", __func__);
++
++	return pfe_eth_poll(priv, napi, 0, budget);
++}
++
++static const struct net_device_ops pfe_netdev_ops = {
++	.ndo_open = pfe_eth_open,
++	.ndo_stop = pfe_eth_close,
++	.ndo_start_xmit = pfe_eth_send_packet,
++	.ndo_select_queue = pfe_eth_select_queue,
++	.ndo_set_rx_mode = pfe_eth_set_multi,
++	.ndo_set_mac_address = pfe_eth_set_mac_address,
++	.ndo_validate_addr = eth_validate_addr,
++	.ndo_change_mtu = pfe_eth_change_mtu,
++	.ndo_get_stats = pfe_eth_get_stats,
++	.ndo_set_features = pfe_eth_set_features,
++};
++
++/* pfe_eth_init_one
++ */
++static int pfe_eth_init_one(struct pfe *pfe,
++			    struct ls1012a_pfe_platform_data *pfe_info,
++			    int id)
++{
++	struct net_device *ndev = NULL;
++	struct pfe_eth_priv_s *priv = NULL;
++	struct ls1012a_eth_platform_data *einfo;
++	int err;
++
++	einfo = (struct ls1012a_eth_platform_data *)
++				pfe_info->ls1012a_eth_pdata;
++
++	/* einfo never be NULL, but no harm in having this check */
++	if (!einfo) {
++		pr_err(
++			"%s: pfe missing additional gemacs platform data\n"
++			, __func__);
++		err = -ENODEV;
++		goto err0;
++	}
++
++	if (us)
++		emac_txq_cnt = EMAC_TXQ_CNT;
++	/* Create an ethernet device instance */
++	ndev = alloc_etherdev_mq(sizeof(*priv), emac_txq_cnt);
++
++	if (!ndev) {
++		pr_err("%s: gemac %d device allocation failed\n",
++		       __func__, einfo[id].gem_id);
++		err = -ENOMEM;
++		goto err0;
++	}
++
++	priv = netdev_priv(ndev);
++	priv->ndev = ndev;
++	priv->id = einfo[id].gem_id;
++	priv->pfe = pfe;
++	priv->phy_node = einfo[id].phy_node;
++
++	SET_NETDEV_DEV(priv->ndev, priv->pfe->dev);
++
++	pfe->eth.eth_priv[id] = priv;
++
++	/* Set the info in the priv to the current info */
++	priv->einfo = &einfo[id];
++	priv->EMAC_baseaddr = cbus_emac_base[id];
++	priv->GPI_baseaddr = cbus_gpi_base[id];
++
++	spin_lock_init(&priv->lock);
++
++	pfe_eth_fast_tx_timeout_init(priv);
++
++	/* Copy the station address into the dev structure, */
++	memcpy(ndev->dev_addr, einfo[id].mac_addr, ETH_ALEN);
++
++	if (us)
++		goto phy_init;
++
++	ndev->mtu = 1500;
++
++	/* Set MTU limits */
++	ndev->min_mtu = ETH_MIN_MTU;
++
++/*
++ * Jumbo frames are not supported on LS1012A rev-1.0.
++ * So max mtu should be restricted to supported frame length.
++ */
++	if (pfe_errata_a010897)
++		ndev->max_mtu = JUMBO_FRAME_SIZE_V1 - ETH_HLEN - ETH_FCS_LEN;
++	else
++		ndev->max_mtu = JUMBO_FRAME_SIZE_V2 - ETH_HLEN - ETH_FCS_LEN;
++
++	/*Enable after checksum offload is validated */
++	ndev->hw_features = NETIF_F_RXCSUM | NETIF_F_IP_CSUM |
++		NETIF_F_IPV6_CSUM | NETIF_F_SG;
++
++	/* enabled by default */
++	ndev->features = ndev->hw_features;
++
++	priv->usr_features = ndev->features;
++
++	ndev->netdev_ops = &pfe_netdev_ops;
++
++	ndev->ethtool_ops = &pfe_ethtool_ops;
++
++	/* Enable basic messages by default */
++	priv->msg_enable = NETIF_MSG_IFUP | NETIF_MSG_IFDOWN | NETIF_MSG_LINK |
++				NETIF_MSG_PROBE;
++
++	netif_napi_add(ndev, &priv->low_napi, pfe_eth_low_poll,
++		       HIF_RX_POLL_WEIGHT - 16);
++	netif_napi_add(ndev, &priv->high_napi, pfe_eth_high_poll,
++		       HIF_RX_POLL_WEIGHT - 16);
++	netif_napi_add(ndev, &priv->lro_napi, pfe_eth_lro_poll,
++		       HIF_RX_POLL_WEIGHT - 16);
++
++	err = register_netdev(ndev);
++	if (err) {
++		netdev_err(ndev, "register_netdev() failed\n");
++		goto err1;
++	}
++
++	if ((!(pfe_use_old_dts_phy) && !(priv->phy_node)) ||
++	    ((pfe_use_old_dts_phy) &&
++	      (priv->einfo->phy_flags & GEMAC_NO_PHY))) {
++		pr_info("%s: No PHY or fixed-link\n", __func__);
++		goto skip_phy_init;
++	}
++
++phy_init:
++	device_init_wakeup(&ndev->dev, WAKE_MAGIC);
++
++	err = pfe_phy_init(ndev);
++	if (err) {
++		netdev_err(ndev, "%s: pfe_phy_init() failed\n",
++			   __func__);
++		goto err2;
++	}
++
++	if (us) {
++		if (priv->phydev)
++			phy_start(priv->phydev);
++		return 0;
++	}
++
++	netif_carrier_on(ndev);
++
++skip_phy_init:
++	/* Create all the sysfs files */
++	if (pfe_eth_sysfs_init(ndev))
++		goto err3;
++
++	netif_info(priv, probe, ndev, "%s: created interface, baseaddr: %p\n",
++		   __func__, priv->EMAC_baseaddr);
++
++	return 0;
++
++err3:
++	pfe_phy_exit(priv->ndev);
++err2:
++	if (us)
++		goto err1;
++	unregister_netdev(ndev);
++err1:
++	free_netdev(priv->ndev);
++err0:
++	return err;
++}
++
++/* pfe_eth_init
++ */
++int pfe_eth_init(struct pfe *pfe)
++{
++	int ii = 0;
++	int err;
++	struct ls1012a_pfe_platform_data *pfe_info;
++
++	pr_info("%s\n", __func__);
++
++	cbus_emac_base[0] = EMAC1_BASE_ADDR;
++	cbus_emac_base[1] = EMAC2_BASE_ADDR;
++
++	cbus_gpi_base[0] = EGPI1_BASE_ADDR;
++	cbus_gpi_base[1] = EGPI2_BASE_ADDR;
++
++	pfe_info = (struct ls1012a_pfe_platform_data *)
++					pfe->dev->platform_data;
++	if (!pfe_info) {
++		pr_err("%s: pfe missing additional platform data\n", __func__);
++		err = -ENODEV;
++		goto err_pdata;
++	}
++
++	for (ii = 0; ii < NUM_GEMAC_SUPPORT; ii++) {
++		err = pfe_eth_mdio_init(pfe, pfe_info, ii);
++		if (err) {
++			pr_err("%s: pfe_eth_mdio_init() failed\n", __func__);
++			goto err_mdio_init;
++		}
++	}
++
++	if (soc_device_match(ls1012a_rev1_soc_attr))
++		pfe_errata_a010897 = true;
++	else
++		pfe_errata_a010897 = false;
++
++	for (ii = 0; ii < NUM_GEMAC_SUPPORT; ii++) {
++		err = pfe_eth_init_one(pfe, pfe_info, ii);
++		if (err)
++			goto err_eth_init;
++	}
++
++	return 0;
++
++err_eth_init:
++	while (ii--) {
++		pfe_eth_exit_one(pfe->eth.eth_priv[ii]);
++		pfe_eth_mdio_exit(pfe, ii);
++	}
++
++err_mdio_init:
++err_pdata:
++	return err;
++}
++
++/* pfe_eth_exit_one
++ */
++static void pfe_eth_exit_one(struct pfe_eth_priv_s *priv)
++{
++	netif_info(priv, probe, priv->ndev, "%s\n", __func__);
++
++	if (!us)
++		pfe_eth_sysfs_exit(priv->ndev);
++
++	if ((!(pfe_use_old_dts_phy) && !(priv->phy_node)) ||
++	    ((pfe_use_old_dts_phy) &&
++	      (priv->einfo->phy_flags & GEMAC_NO_PHY))) {
++		pr_info("%s: No PHY or fixed-link\n", __func__);
++		goto skip_phy_exit;
++	}
++
++	pfe_phy_exit(priv->ndev);
++
++skip_phy_exit:
++	if (!us)
++		unregister_netdev(priv->ndev);
++
++	free_netdev(priv->ndev);
++}
++
++/* pfe_eth_exit
++ */
++void pfe_eth_exit(struct pfe *pfe)
++{
++	int ii;
++
++	pr_info("%s\n", __func__);
++
++	for (ii = NUM_GEMAC_SUPPORT - 1; ii >= 0; ii--)
++		pfe_eth_exit_one(pfe->eth.eth_priv[ii]);
++
++	for (ii = NUM_GEMAC_SUPPORT - 1; ii >= 0; ii--)
++		pfe_eth_mdio_exit(pfe, ii);
++}
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_eth.h
+@@ -0,0 +1,175 @@
++/* SPDX-License-Identifier: GPL-2.0+ */
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ */
++
++#ifndef _PFE_ETH_H_
++#define _PFE_ETH_H_
++#include <linux/kernel.h>
++#include <linux/netdevice.h>
++#include <linux/etherdevice.h>
++#include <linux/ethtool.h>
++#include <linux/mii.h>
++#include <linux/phy.h>
++#include <linux/clk.h>
++#include <linux/interrupt.h>
++#include <linux/time.h>
++
++#define PFE_ETH_NAPI_STATS
++#define PFE_ETH_TX_STATS
++
++#define PFE_ETH_FRAGS_MAX (65536 / HIF_RX_PKT_MIN_SIZE)
++#define LRO_LEN_COUNT_MAX	32
++#define LRO_NB_COUNT_MAX	32
++
++#define PFE_PAUSE_FLAG_ENABLE		1
++#define PFE_PAUSE_FLAG_AUTONEG		2
++
++/* GEMAC configured by SW */
++/* GEMAC configured by phy lines (not for MII/GMII) */
++
++#define GEMAC_SW_FULL_DUPLEX    BIT(9)
++#define GEMAC_SW_SPEED_10M      (0 << 12)
++#define GEMAC_SW_SPEED_100M     BIT(12)
++#define GEMAC_SW_SPEED_1G       (2 << 12)
++
++#define GEMAC_NO_PHY            BIT(0)
++
++struct ls1012a_eth_platform_data {
++	/* board specific information */
++	phy_interface_t mii_config;
++	u32 phy_flags;
++	u32 gem_id;
++	u32 phy_id;
++	u32 mdio_muxval;
++	u8 mac_addr[ETH_ALEN];
++	struct device_node	*phy_node;
++};
++
++struct ls1012a_mdio_platform_data {
++	int id;
++	int irq[32];
++	u32 phy_mask;
++	int mdc_div;
++};
++
++struct ls1012a_pfe_platform_data {
++	struct ls1012a_eth_platform_data ls1012a_eth_pdata[3];
++	struct ls1012a_mdio_platform_data ls1012a_mdio_pdata[3];
++};
++
++#define NUM_GEMAC_SUPPORT	2
++#define DRV_NAME		"pfe-eth"
++#define DRV_VERSION		"1.0"
++
++#define LS1012A_TX_FAST_RECOVERY_TIMEOUT_MS	3
++#define TX_POLL_TIMEOUT_MS	1000
++
++#define EMAC_TXQ_CNT	16
++#define EMAC_TXQ_DEPTH	(HIF_TX_DESC_NT)
++
++#define JUMBO_FRAME_SIZE_V1	1900
++#define JUMBO_FRAME_SIZE_V2	10258
++/*
++ * Client Tx queue threshold, for txQ flush condition.
++ * It must be smaller than the queue size (in case we ever change it in the
++ * future).
++ */
++#define HIF_CL_TX_FLUSH_MARK	32
++
++/*
++ * Max number of TX resources (HIF descriptors or skbs) that will be released
++ * in a single go during batch recycling.
++ * Should be lower than the flush mark so the SW can provide the HW with a
++ * continuous stream of packets instead of bursts.
++ */
++#define TX_FREE_MAX_COUNT 16
++#define EMAC_RXQ_CNT	3
++#define EMAC_RXQ_DEPTH	HIF_RX_DESC_NT
++/* make sure clients can receive a full burst of packets */
++#define EMAC_RMON_TXBYTES_POS	0x00
++#define EMAC_RMON_RXBYTES_POS	0x14
++
++#define EMAC_QUEUENUM_MASK      (emac_txq_cnt - 1)
++#define EMAC_MDIO_TIMEOUT	1000
++#define MAX_UC_SPEC_ADDR_REG 31
++
++struct pfe_eth_fast_timer {
++	int queuenum;
++	struct hrtimer timer;
++	void *base;
++};
++
++struct  pfe_eth_priv_s {
++	struct pfe		*pfe;
++	struct hif_client_s	client;
++	struct napi_struct	lro_napi;
++	struct napi_struct	low_napi;
++	struct napi_struct	high_napi;
++	int			low_tmu_q;
++	int			high_tmu_q;
++	struct net_device_stats stats;
++	struct net_device	*ndev;
++	int			id;
++	int			promisc;
++	unsigned int		msg_enable;
++	unsigned int		usr_features;
++
++	spinlock_t		lock; /* protect member variables */
++	unsigned int		event_status;
++	int			irq;
++	void			*EMAC_baseaddr;
++	void			*GPI_baseaddr;
++	/* PHY stuff */
++	struct phy_device	*phydev;
++	int			oldspeed;
++	int			oldduplex;
++	int			oldlink;
++	struct device_node	*phy_node;
++	struct clk		*gemtx_clk;
++	int			wol;
++	int			pause_flag;
++
++	int			default_priority;
++	struct pfe_eth_fast_timer fast_tx_timeout[EMAC_TXQ_CNT];
++
++	struct ls1012a_eth_platform_data *einfo;
++	struct sk_buff *skb_inflight[EMAC_RXQ_CNT + 6];
++
++#ifdef PFE_ETH_TX_STATS
++	unsigned int stop_queue_total[EMAC_TXQ_CNT];
++	unsigned int stop_queue_hif[EMAC_TXQ_CNT];
++	unsigned int stop_queue_hif_client[EMAC_TXQ_CNT];
++	unsigned int stop_queue_credit[EMAC_TXQ_CNT];
++	unsigned int clean_fail[EMAC_TXQ_CNT];
++	unsigned int was_stopped[EMAC_TXQ_CNT];
++#endif
++
++#ifdef PFE_ETH_NAPI_STATS
++	unsigned int napi_counters[NAPI_MAX_COUNT];
++#endif
++	unsigned int frags_inflight[EMAC_RXQ_CNT + 6];
++};
++
++struct pfe_eth {
++	struct pfe_eth_priv_s *eth_priv[3];
++};
++
++struct pfe_mdio_priv_s {
++	void __iomem *mdio_base;
++	int			mdc_div;
++	struct mii_bus		*mii_bus;
++};
++
++struct pfe_mdio {
++	struct pfe_mdio_priv_s *mdio_priv[3];
++};
++
++int pfe_eth_init(struct pfe *pfe);
++void pfe_eth_exit(struct pfe *pfe);
++int pfe_eth_suspend(struct net_device *dev);
++int pfe_eth_resume(struct net_device *dev);
++int pfe_eth_mdio_reset(struct mii_bus *bus);
++
++#endif /* _PFE_ETH_H_ */
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_firmware.c
+@@ -0,0 +1,398 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ */
++
++/*
++ * @file
++ * Contains all the functions to handle parsing and loading of PE firmware
++ * files.
++ */
++#include <linux/firmware.h>
++
++#include "pfe_mod.h"
++#include "pfe_firmware.h"
++#include "pfe/pfe.h"
++#include <linux/of_platform.h>
++#include <linux/of_address.h>
++
++static struct elf32_shdr *get_elf_section_header(const u8 *fw,
++						 const char *section)
++{
++	struct elf32_hdr *elf_hdr = (struct elf32_hdr *)fw;
++	struct elf32_shdr *shdr;
++	struct elf32_shdr *shdr_shstr;
++	Elf32_Off e_shoff = be32_to_cpu(elf_hdr->e_shoff);
++	Elf32_Half e_shentsize = be16_to_cpu(elf_hdr->e_shentsize);
++	Elf32_Half e_shnum = be16_to_cpu(elf_hdr->e_shnum);
++	Elf32_Half e_shstrndx = be16_to_cpu(elf_hdr->e_shstrndx);
++	Elf32_Off shstr_offset;
++	Elf32_Word sh_name;
++	const char *name;
++	int i;
++
++	/* Section header strings */
++	shdr_shstr = (struct elf32_shdr *)((u8 *)elf_hdr + e_shoff + e_shstrndx
++					* e_shentsize);
++	shstr_offset = be32_to_cpu(shdr_shstr->sh_offset);
++
++	for (i = 0; i < e_shnum; i++) {
++		shdr = (struct elf32_shdr *)((u8 *)elf_hdr + e_shoff
++					     + i * e_shentsize);
++
++		sh_name = be32_to_cpu(shdr->sh_name);
++
++		name = (const char *)((u8 *)elf_hdr + shstr_offset + sh_name);
++
++		if (!strcmp(name, section))
++			return shdr;
++	}
++
++	pr_err("%s: didn't find section %s\n", __func__, section);
++
++	return NULL;
++}
++
++#if defined(CFG_DIAGS)
++static int pfe_get_diags_info(const u8 *fw, struct pfe_diags_info
++				*diags_info)
++{
++	struct elf32_shdr *shdr;
++	unsigned long offset, size;
++
++	shdr = get_elf_section_header(fw, ".pfe_diags_str");
++	if (shdr) {
++		offset = be32_to_cpu(shdr->sh_offset);
++		size = be32_to_cpu(shdr->sh_size);
++		diags_info->diags_str_base = be32_to_cpu(shdr->sh_addr);
++		diags_info->diags_str_size = size;
++		diags_info->diags_str_array = kmalloc(size, GFP_KERNEL);
++		memcpy(diags_info->diags_str_array, fw + offset, size);
++
++		return 0;
++	} else {
++		return -1;
++	}
++}
++#endif
++
++static void pfe_check_version_info(const u8 *fw)
++{
++	/*static char *version = NULL;*/
++	const u8 *elf_data = fw;
++	static char *version;
++
++	struct elf32_shdr *shdr = get_elf_section_header(fw, ".version");
++
++	if (shdr) {
++		if (!version) {
++			/*
++			 * this is the first fw we load, use its version
++			 * string as reference (whatever it is)
++			 */
++			version = (char *)(elf_data +
++					be32_to_cpu(shdr->sh_offset));
++
++			pr_info("PFE binary version: %s\n", version);
++		} else {
++			/*
++			 * already have loaded at least one firmware, check
++			 * sequence can start now
++			 */
++			if (strcmp(version, (char *)(elf_data +
++				be32_to_cpu(shdr->sh_offset)))) {
++				pr_info(
++				"WARNING: PFE firmware binaries from incompatible version\n");
++			}
++		}
++	} else {
++		/*
++		 * version cannot be verified, a potential issue that should
++		 * be reported
++		 */
++		pr_info(
++			 "WARNING: PFE firmware binaries from incompatible version\n");
++	}
++}
++
++/* PFE elf firmware loader.
++ * Loads an elf firmware image into a list of PE's (specified using a bitmask)
++ *
++ * @param pe_mask	Mask of PE id's to load firmware to
++ * @param fw		Pointer to the firmware image
++ *
++ * @return		0 on success, a negative value on error
++ *
++ */
++int pfe_load_elf(int pe_mask, const u8 *fw, struct pfe *pfe)
++{
++	struct elf32_hdr *elf_hdr = (struct elf32_hdr *)fw;
++	Elf32_Half sections = be16_to_cpu(elf_hdr->e_shnum);
++	struct elf32_shdr *shdr = (struct elf32_shdr *)(fw +
++					be32_to_cpu(elf_hdr->e_shoff));
++	int id, section;
++	int rc;
++
++	pr_info("%s\n", __func__);
++
++	/* Some sanity checks */
++	if (strncmp(&elf_hdr->e_ident[EI_MAG0], ELFMAG, SELFMAG)) {
++		pr_err("%s: incorrect elf magic number\n", __func__);
++		return -EINVAL;
++	}
++
++	if (elf_hdr->e_ident[EI_CLASS] != ELFCLASS32) {
++		pr_err("%s: incorrect elf class(%x)\n", __func__,
++		       elf_hdr->e_ident[EI_CLASS]);
++		return -EINVAL;
++	}
++
++	if (elf_hdr->e_ident[EI_DATA] != ELFDATA2MSB) {
++		pr_err("%s: incorrect elf data(%x)\n", __func__,
++		       elf_hdr->e_ident[EI_DATA]);
++		return -EINVAL;
++	}
++
++	if (be16_to_cpu(elf_hdr->e_type) != ET_EXEC) {
++		pr_err("%s: incorrect elf file type(%x)\n", __func__,
++		       be16_to_cpu(elf_hdr->e_type));
++		return -EINVAL;
++	}
++
++	for (section = 0; section < sections; section++, shdr++) {
++		if (!(be32_to_cpu(shdr->sh_flags) & (SHF_WRITE | SHF_ALLOC |
++			SHF_EXECINSTR)))
++			continue;
++
++		for (id = 0; id < MAX_PE; id++)
++			if (pe_mask & (1 << id)) {
++				rc = pe_load_elf_section(id, elf_hdr, shdr,
++							 pfe->dev);
++				if (rc < 0)
++					goto err;
++			}
++	}
++
++	pfe_check_version_info(fw);
++
++	return 0;
++
++err:
++	return rc;
++}
++
++int get_firmware_in_fdt(const u8 **pe_fw, const char *name)
++{
++	struct device_node *np;
++	const unsigned int *len;
++	const void *data;
++
++	if (!strcmp(name, CLASS_FIRMWARE_FILENAME)) {
++		/* The firmware should be inside the device tree. */
++		np = of_find_compatible_node(NULL, NULL,
++					     "fsl,pfe-class-firmware");
++		if (!np) {
++			pr_info("Failed to find the node\n");
++			return -ENOENT;
++		}
++
++		data = of_get_property(np, "fsl,class-firmware", NULL);
++		if (data) {
++			len = of_get_property(np, "length", NULL);
++			pr_info("CLASS fw of length %d bytes loaded from FDT.\n",
++				be32_to_cpu(*len));
++		} else {
++			pr_info("fsl,class-firmware not found!!!!\n");
++			return -ENOENT;
++		}
++		of_node_put(np);
++		*pe_fw = data;
++	} else if (!strcmp(name, TMU_FIRMWARE_FILENAME)) {
++		np = of_find_compatible_node(NULL, NULL,
++					     "fsl,pfe-tmu-firmware");
++		if (!np) {
++			pr_info("Failed to find the node\n");
++			return -ENOENT;
++		}
++
++		data = of_get_property(np, "fsl,tmu-firmware", NULL);
++		if (data) {
++			len = of_get_property(np, "length", NULL);
++			pr_info("TMU fw of length %d bytes loaded from FDT.\n",
++				be32_to_cpu(*len));
++		} else {
++			pr_info("fsl,tmu-firmware not found!!!!\n");
++			return -ENOENT;
++		}
++		of_node_put(np);
++		*pe_fw = data;
++	} else if (!strcmp(name, UTIL_FIRMWARE_FILENAME)) {
++		np = of_find_compatible_node(NULL, NULL,
++					     "fsl,pfe-util-firmware");
++		if (!np) {
++			pr_info("Failed to find the node\n");
++			return -ENOENT;
++		}
++
++		data = of_get_property(np, "fsl,util-firmware", NULL);
++		if (data) {
++			len = of_get_property(np, "length", NULL);
++			pr_info("UTIL fw of length %d bytes loaded from FDT.\n",
++				be32_to_cpu(*len));
++		} else {
++			pr_info("fsl,util-firmware not found!!!!\n");
++			return -ENOENT;
++		}
++		of_node_put(np);
++		*pe_fw = data;
++	} else {
++		pr_err("firmware:%s not known\n", name);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/* PFE firmware initialization.
++ * Loads different firmware files from filesystem.
++ * Initializes PE IMEM/DMEM and UTIL-PE DDR
++ * Initializes control path symbol addresses (by looking them up in the elf
++ * firmware files
++ * Takes PE's out of reset
++ *
++ * @return	0 on success, a negative value on error
++ *
++ */
++int pfe_firmware_init(struct pfe *pfe)
++{
++	const struct firmware *class_fw, *tmu_fw;
++	const u8 *class_elf_fw, *tmu_elf_fw;
++	int rc = 0, fs_load = 0;
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++	const struct firmware *util_fw;
++	const u8 *util_elf_fw;
++
++#endif
++
++	pr_info("%s\n", __func__);
++
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++	if (get_firmware_in_fdt(&class_elf_fw, CLASS_FIRMWARE_FILENAME) ||
++	    get_firmware_in_fdt(&tmu_elf_fw, TMU_FIRMWARE_FILENAME) ||
++	    get_firmware_in_fdt(&util_elf_fw, UTIL_FIRMWARE_FILENAME))
++#else
++	if (get_firmware_in_fdt(&class_elf_fw, CLASS_FIRMWARE_FILENAME) ||
++	    get_firmware_in_fdt(&tmu_elf_fw, TMU_FIRMWARE_FILENAME))
++#endif
++	{
++		pr_info("%s:PFE firmware not found in FDT.\n", __func__);
++		pr_info("%s:Trying to load firmware from filesystem...!\n", __func__);
++
++		/* look for firmware in filesystem...!*/
++		fs_load = 1;
++		if (request_firmware(&class_fw, CLASS_FIRMWARE_FILENAME, pfe->dev)) {
++			pr_err("%s: request firmware %s failed\n", __func__,
++			       CLASS_FIRMWARE_FILENAME);
++			rc = -ETIMEDOUT;
++			goto err0;
++		}
++		class_elf_fw = class_fw->data;
++
++		if (request_firmware(&tmu_fw, TMU_FIRMWARE_FILENAME, pfe->dev)) {
++			pr_err("%s: request firmware %s failed\n", __func__,
++			       TMU_FIRMWARE_FILENAME);
++			rc = -ETIMEDOUT;
++			goto err1;
++		}
++		tmu_elf_fw = tmu_fw->data;
++
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++		if (request_firmware(&util_fw, UTIL_FIRMWARE_FILENAME, pfe->dev)) {
++			pr_err("%s: request firmware %s failed\n", __func__,
++			       UTIL_FIRMWARE_FILENAME);
++			rc = -ETIMEDOUT;
++			goto err2;
++		}
++		util_elf_fw = util_fw->data;
++#endif
++	}
++
++	rc = pfe_load_elf(CLASS_MASK, class_elf_fw, pfe);
++	if (rc < 0) {
++		pr_err("%s: class firmware load failed\n", __func__);
++		goto err3;
++	}
++
++#if defined(CFG_DIAGS)
++	rc = pfe_get_diags_info(class_elf_fw, &pfe->diags.class_diags_info);
++	if (rc < 0) {
++		pr_warn(
++			"PFE diags won't be available for class PEs\n");
++		rc = 0;
++	}
++#endif
++
++	rc = pfe_load_elf(TMU_MASK, tmu_elf_fw, pfe);
++	if (rc < 0) {
++		pr_err("%s: tmu firmware load failed\n", __func__);
++		goto err3;
++	}
++
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++	rc = pfe_load_elf(UTIL_MASK, util_elf_fw, pfe);
++	if (rc < 0) {
++		pr_err("%s: util firmware load failed\n", __func__);
++		goto err3;
++	}
++
++#if defined(CFG_DIAGS)
++	rc = pfe_get_diags_info(util_elf_fw, &pfe->diags.util_diags_info);
++	if (rc < 0) {
++		pr_warn(
++			"PFE diags won't be available for util PE\n");
++		rc = 0;
++	}
++#endif
++
++	util_enable();
++#endif
++
++	tmu_enable(0xf);
++	class_enable();
++
++err3:
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++	if (fs_load)
++		release_firmware(util_fw);
++err2:
++#endif
++	if (fs_load)
++		release_firmware(tmu_fw);
++
++err1:
++	if (fs_load)
++		release_firmware(class_fw);
++
++err0:
++	return rc;
++}
++
++/* PFE firmware cleanup
++ * Puts PE's in reset
++ *
++ *
++ */
++void pfe_firmware_exit(struct pfe *pfe)
++{
++	pr_info("%s\n", __func__);
++
++	if (pe_reset_all(&pfe->ctrl) != 0)
++		pr_err("Error: Failed to stop PEs, PFE reload may not work correctly\n");
++
++	class_disable();
++	tmu_disable(0xf);
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++	util_disable();
++#endif
++}
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_firmware.h
+@@ -0,0 +1,21 @@
++/* SPDX-License-Identifier: GPL-2.0+ */
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ */
++
++#ifndef _PFE_FIRMWARE_H_
++#define _PFE_FIRMWARE_H_
++
++#define CLASS_FIRMWARE_FILENAME		"ppfe_class_ls1012a.elf"
++#define TMU_FIRMWARE_FILENAME		"ppfe_tmu_ls1012a.elf"
++#define UTIL_FIRMWARE_FILENAME		"ppfe_util_ls1012a.elf"
++
++#define PFE_FW_CHECK_PASS		0
++#define PFE_FW_CHECK_FAIL		1
++#define NUM_PFE_FW				3
++
++int pfe_firmware_init(struct pfe *pfe);
++void pfe_firmware_exit(struct pfe *pfe);
++
++#endif /* _PFE_FIRMWARE_H_ */
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_hal.c
+@@ -0,0 +1,1516 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ */
++
++#include "pfe_mod.h"
++#include "pfe/pfe.h"
++
++/* A-010897: Jumbo frame is not supported */
++extern bool pfe_errata_a010897;
++
++#define PFE_RCR_MAX_FL_MASK	0xC000FFFF
++
++void *cbus_base_addr;
++void *ddr_base_addr;
++unsigned long ddr_phys_base_addr;
++unsigned int ddr_size;
++
++static struct pe_info pe[MAX_PE];
++
++/* Initializes the PFE library.
++ * Must be called before using any of the library functions.
++ *
++ * @param[in] cbus_base		CBUS virtual base address (as mapped in
++ * the host CPU address space)
++ * @param[in] ddr_base		PFE DDR range virtual base address (as
++ * mapped in the host CPU address space)
++ * @param[in] ddr_phys_base	PFE DDR range physical base address (as
++ * mapped in platform)
++ * @param[in] size		PFE DDR range size (as defined by the host
++ * software)
++ */
++void pfe_lib_init(void *cbus_base, void *ddr_base, unsigned long ddr_phys_base,
++		  unsigned int size)
++{
++	cbus_base_addr = cbus_base;
++	ddr_base_addr = ddr_base;
++	ddr_phys_base_addr = ddr_phys_base;
++	ddr_size = size;
++
++	pe[CLASS0_ID].dmem_base_addr = CLASS_DMEM_BASE_ADDR(0);
++	pe[CLASS0_ID].pmem_base_addr = CLASS_IMEM_BASE_ADDR(0);
++	pe[CLASS0_ID].pmem_size = CLASS_IMEM_SIZE;
++	pe[CLASS0_ID].mem_access_wdata = CLASS_MEM_ACCESS_WDATA;
++	pe[CLASS0_ID].mem_access_addr = CLASS_MEM_ACCESS_ADDR;
++	pe[CLASS0_ID].mem_access_rdata = CLASS_MEM_ACCESS_RDATA;
++
++	pe[CLASS1_ID].dmem_base_addr = CLASS_DMEM_BASE_ADDR(1);
++	pe[CLASS1_ID].pmem_base_addr = CLASS_IMEM_BASE_ADDR(1);
++	pe[CLASS1_ID].pmem_size = CLASS_IMEM_SIZE;
++	pe[CLASS1_ID].mem_access_wdata = CLASS_MEM_ACCESS_WDATA;
++	pe[CLASS1_ID].mem_access_addr = CLASS_MEM_ACCESS_ADDR;
++	pe[CLASS1_ID].mem_access_rdata = CLASS_MEM_ACCESS_RDATA;
++
++	pe[CLASS2_ID].dmem_base_addr = CLASS_DMEM_BASE_ADDR(2);
++	pe[CLASS2_ID].pmem_base_addr = CLASS_IMEM_BASE_ADDR(2);
++	pe[CLASS2_ID].pmem_size = CLASS_IMEM_SIZE;
++	pe[CLASS2_ID].mem_access_wdata = CLASS_MEM_ACCESS_WDATA;
++	pe[CLASS2_ID].mem_access_addr = CLASS_MEM_ACCESS_ADDR;
++	pe[CLASS2_ID].mem_access_rdata = CLASS_MEM_ACCESS_RDATA;
++
++	pe[CLASS3_ID].dmem_base_addr = CLASS_DMEM_BASE_ADDR(3);
++	pe[CLASS3_ID].pmem_base_addr = CLASS_IMEM_BASE_ADDR(3);
++	pe[CLASS3_ID].pmem_size = CLASS_IMEM_SIZE;
++	pe[CLASS3_ID].mem_access_wdata = CLASS_MEM_ACCESS_WDATA;
++	pe[CLASS3_ID].mem_access_addr = CLASS_MEM_ACCESS_ADDR;
++	pe[CLASS3_ID].mem_access_rdata = CLASS_MEM_ACCESS_RDATA;
++
++	pe[CLASS4_ID].dmem_base_addr = CLASS_DMEM_BASE_ADDR(4);
++	pe[CLASS4_ID].pmem_base_addr = CLASS_IMEM_BASE_ADDR(4);
++	pe[CLASS4_ID].pmem_size = CLASS_IMEM_SIZE;
++	pe[CLASS4_ID].mem_access_wdata = CLASS_MEM_ACCESS_WDATA;
++	pe[CLASS4_ID].mem_access_addr = CLASS_MEM_ACCESS_ADDR;
++	pe[CLASS4_ID].mem_access_rdata = CLASS_MEM_ACCESS_RDATA;
++
++	pe[CLASS5_ID].dmem_base_addr = CLASS_DMEM_BASE_ADDR(5);
++	pe[CLASS5_ID].pmem_base_addr = CLASS_IMEM_BASE_ADDR(5);
++	pe[CLASS5_ID].pmem_size = CLASS_IMEM_SIZE;
++	pe[CLASS5_ID].mem_access_wdata = CLASS_MEM_ACCESS_WDATA;
++	pe[CLASS5_ID].mem_access_addr = CLASS_MEM_ACCESS_ADDR;
++	pe[CLASS5_ID].mem_access_rdata = CLASS_MEM_ACCESS_RDATA;
++
++	pe[TMU0_ID].dmem_base_addr = TMU_DMEM_BASE_ADDR(0);
++	pe[TMU0_ID].pmem_base_addr = TMU_IMEM_BASE_ADDR(0);
++	pe[TMU0_ID].pmem_size = TMU_IMEM_SIZE;
++	pe[TMU0_ID].mem_access_wdata = TMU_MEM_ACCESS_WDATA;
++	pe[TMU0_ID].mem_access_addr = TMU_MEM_ACCESS_ADDR;
++	pe[TMU0_ID].mem_access_rdata = TMU_MEM_ACCESS_RDATA;
++
++	pe[TMU1_ID].dmem_base_addr = TMU_DMEM_BASE_ADDR(1);
++	pe[TMU1_ID].pmem_base_addr = TMU_IMEM_BASE_ADDR(1);
++	pe[TMU1_ID].pmem_size = TMU_IMEM_SIZE;
++	pe[TMU1_ID].mem_access_wdata = TMU_MEM_ACCESS_WDATA;
++	pe[TMU1_ID].mem_access_addr = TMU_MEM_ACCESS_ADDR;
++	pe[TMU1_ID].mem_access_rdata = TMU_MEM_ACCESS_RDATA;
++
++	pe[TMU3_ID].dmem_base_addr = TMU_DMEM_BASE_ADDR(3);
++	pe[TMU3_ID].pmem_base_addr = TMU_IMEM_BASE_ADDR(3);
++	pe[TMU3_ID].pmem_size = TMU_IMEM_SIZE;
++	pe[TMU3_ID].mem_access_wdata = TMU_MEM_ACCESS_WDATA;
++	pe[TMU3_ID].mem_access_addr = TMU_MEM_ACCESS_ADDR;
++	pe[TMU3_ID].mem_access_rdata = TMU_MEM_ACCESS_RDATA;
++
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++	pe[UTIL_ID].dmem_base_addr = UTIL_DMEM_BASE_ADDR;
++	pe[UTIL_ID].mem_access_wdata = UTIL_MEM_ACCESS_WDATA;
++	pe[UTIL_ID].mem_access_addr = UTIL_MEM_ACCESS_ADDR;
++	pe[UTIL_ID].mem_access_rdata = UTIL_MEM_ACCESS_RDATA;
++#endif
++}
++
++/* Writes a buffer to PE internal memory from the host
++ * through indirect access registers.
++ *
++ * @param[in] id		PE identification (CLASS0_ID, ..., TMU0_ID,
++ * ..., UTIL_ID)
++ * @param[in] src		Buffer source address
++ * @param[in] mem_access_addr	DMEM destination address (must be 32bit
++ * aligned)
++ * @param[in] len		Number of bytes to copy
++ */
++void pe_mem_memcpy_to32(int id, u32 mem_access_addr, const void *src, unsigned
++int len)
++{
++	u32 offset = 0, val, addr;
++	unsigned int len32 = len >> 2;
++	int i;
++
++	addr = mem_access_addr | PE_MEM_ACCESS_WRITE |
++		PE_MEM_ACCESS_BYTE_ENABLE(0, 4);
++
++	for (i = 0; i < len32; i++, offset += 4, src += 4) {
++		val = *(u32 *)src;
++		writel(cpu_to_be32(val), pe[id].mem_access_wdata);
++		writel(addr + offset, pe[id].mem_access_addr);
++	}
++
++	len = (len & 0x3);
++	if (len) {
++		val = 0;
++
++		addr = (mem_access_addr | PE_MEM_ACCESS_WRITE |
++			PE_MEM_ACCESS_BYTE_ENABLE(0, len)) + offset;
++
++		for (i = 0; i < len; i++, src++)
++			val |= (*(u8 *)src) << (8 * i);
++
++		writel(cpu_to_be32(val), pe[id].mem_access_wdata);
++		writel(addr, pe[id].mem_access_addr);
++	}
++}
++
++/* Writes a buffer to PE internal data memory (DMEM) from the host
++ * through indirect access registers.
++ * @param[in] id		PE identification (CLASS0_ID, ..., TMU0_ID,
++ * ..., UTIL_ID)
++ * @param[in] src		Buffer source address
++ * @param[in] dst		DMEM destination address (must be 32bit
++ * aligned)
++ * @param[in] len		Number of bytes to copy
++ */
++void pe_dmem_memcpy_to32(int id, u32 dst, const void *src, unsigned int len)
++{
++	pe_mem_memcpy_to32(id, pe[id].dmem_base_addr | dst |
++				PE_MEM_ACCESS_DMEM, src, len);
++}
++
++/* Writes a buffer to PE internal program memory (PMEM) from the host
++ * through indirect access registers.
++ * @param[in] id		PE identification (CLASS0_ID, ..., TMU0_ID,
++ * ..., TMU3_ID)
++ * @param[in] src		Buffer source address
++ * @param[in] dst		PMEM destination address (must be 32bit
++ * aligned)
++ * @param[in] len		Number of bytes to copy
++ */
++void pe_pmem_memcpy_to32(int id, u32 dst, const void *src, unsigned int len)
++{
++	pe_mem_memcpy_to32(id, pe[id].pmem_base_addr | (dst & (pe[id].pmem_size
++				- 1)) | PE_MEM_ACCESS_IMEM, src, len);
++}
++
++/* Reads PE internal program memory (IMEM) from the host
++ * through indirect access registers.
++ * @param[in] id		PE identification (CLASS0_ID, ..., TMU0_ID,
++ * ..., TMU3_ID)
++ * @param[in] addr		PMEM read address (must be aligned on size)
++ * @param[in] size		Number of bytes to read (maximum 4, must not
++ * cross 32bit boundaries)
++ * @return			the data read (in PE endianness, i.e BE).
++ */
++u32 pe_pmem_read(int id, u32 addr, u8 size)
++{
++	u32 offset = addr & 0x3;
++	u32 mask = 0xffffffff >> ((4 - size) << 3);
++	u32 val;
++
++	addr = pe[id].pmem_base_addr | ((addr & ~0x3) & (pe[id].pmem_size - 1))
++		| PE_MEM_ACCESS_IMEM | PE_MEM_ACCESS_BYTE_ENABLE(offset, size);
++
++	writel(addr, pe[id].mem_access_addr);
++	val = be32_to_cpu(readl(pe[id].mem_access_rdata));
++
++	return (val >> (offset << 3)) & mask;
++}
++
++/* Writes PE internal data memory (DMEM) from the host
++ * through indirect access registers.
++ * @param[in] id		PE identification (CLASS0_ID, ..., TMU0_ID,
++ * ..., UTIL_ID)
++ * @param[in] addr		DMEM write address (must be aligned on size)
++ * @param[in] val		Value to write (in PE endianness, i.e BE)
++ * @param[in] size		Number of bytes to write (maximum 4, must not
++ * cross 32bit boundaries)
++ */
++void pe_dmem_write(int id, u32 val, u32 addr, u8 size)
++{
++	u32 offset = addr & 0x3;
++
++	addr = pe[id].dmem_base_addr | (addr & ~0x3) | PE_MEM_ACCESS_WRITE |
++		PE_MEM_ACCESS_DMEM | PE_MEM_ACCESS_BYTE_ENABLE(offset, size);
++
++	/* Indirect access interface is byte swapping data being written */
++	writel(cpu_to_be32(val << (offset << 3)), pe[id].mem_access_wdata);
++	writel(addr, pe[id].mem_access_addr);
++}
++
++/* Reads PE internal data memory (DMEM) from the host
++ * through indirect access registers.
++ * @param[in] id		PE identification (CLASS0_ID, ..., TMU0_ID,
++ * ..., UTIL_ID)
++ * @param[in] addr		DMEM read address (must be aligned on size)
++ * @param[in] size		Number of bytes to read (maximum 4, must not
++ * cross 32bit boundaries)
++ * @return			the data read (in PE endianness, i.e BE).
++ */
++u32 pe_dmem_read(int id, u32 addr, u8 size)
++{
++	u32 offset = addr & 0x3;
++	u32 mask = 0xffffffff >> ((4 - size) << 3);
++	u32 val;
++
++	addr = pe[id].dmem_base_addr | (addr & ~0x3) | PE_MEM_ACCESS_DMEM |
++			PE_MEM_ACCESS_BYTE_ENABLE(offset, size);
++
++	writel(addr, pe[id].mem_access_addr);
++
++	/* Indirect access interface is byte swapping data being read */
++	val = be32_to_cpu(readl(pe[id].mem_access_rdata));
++
++	return (val >> (offset << 3)) & mask;
++}
++
++/* This function is used to write to CLASS internal bus peripherals (ccu,
++ * pe-lem) from the host
++ * through indirect access registers.
++ * @param[in]	val	value to write
++ * @param[in]	addr	Address to write to (must be aligned on size)
++ * @param[in]	size	Number of bytes to write (1, 2 or 4)
++ *
++ */
++void class_bus_write(u32 val, u32 addr, u8 size)
++{
++	u32 offset = addr & 0x3;
++
++	writel((addr & CLASS_BUS_ACCESS_BASE_MASK), CLASS_BUS_ACCESS_BASE);
++
++	addr = (addr & ~CLASS_BUS_ACCESS_BASE_MASK) | PE_MEM_ACCESS_WRITE |
++			(size << 24);
++
++	writel(cpu_to_be32(val << (offset << 3)), CLASS_BUS_ACCESS_WDATA);
++	writel(addr, CLASS_BUS_ACCESS_ADDR);
++}
++
++/* Reads from CLASS internal bus peripherals (ccu, pe-lem) from the host
++ * through indirect access registers.
++ * @param[in] addr	Address to read from (must be aligned on size)
++ * @param[in] size	Number of bytes to read (1, 2 or 4)
++ * @return		the read data
++ *
++ */
++u32 class_bus_read(u32 addr, u8 size)
++{
++	u32 offset = addr & 0x3;
++	u32 mask = 0xffffffff >> ((4 - size) << 3);
++	u32 val;
++
++	writel((addr & CLASS_BUS_ACCESS_BASE_MASK), CLASS_BUS_ACCESS_BASE);
++
++	addr = (addr & ~CLASS_BUS_ACCESS_BASE_MASK) | (size << 24);
++
++	writel(addr, CLASS_BUS_ACCESS_ADDR);
++	val = be32_to_cpu(readl(CLASS_BUS_ACCESS_RDATA));
++
++	return (val >> (offset << 3)) & mask;
++}
++
++/* Writes data to the cluster memory (PE_LMEM)
++ * @param[in] dst	PE LMEM destination address (must be 32bit aligned)
++ * @param[in] src	Buffer source address
++ * @param[in] len	Number of bytes to copy
++ */
++void class_pe_lmem_memcpy_to32(u32 dst, const void *src, unsigned int len)
++{
++	u32 len32 = len >> 2;
++	int i;
++
++	for (i = 0; i < len32; i++, src += 4, dst += 4)
++		class_bus_write(*(u32 *)src, dst, 4);
++
++	if (len & 0x2) {
++		class_bus_write(*(u16 *)src, dst, 2);
++		src += 2;
++		dst += 2;
++	}
++
++	if (len & 0x1) {
++		class_bus_write(*(u8 *)src, dst, 1);
++		src++;
++		dst++;
++	}
++}
++
++/* Writes value to the cluster memory (PE_LMEM)
++ * @param[in] dst	PE LMEM destination address (must be 32bit aligned)
++ * @param[in] val	Value to write
++ * @param[in] len	Number of bytes to write
++ */
++void class_pe_lmem_memset(u32 dst, int val, unsigned int len)
++{
++	u32 len32 = len >> 2;
++	int i;
++
++	val = val | (val << 8) | (val << 16) | (val << 24);
++
++	for (i = 0; i < len32; i++, dst += 4)
++		class_bus_write(val, dst, 4);
++
++	if (len & 0x2) {
++		class_bus_write(val, dst, 2);
++		dst += 2;
++	}
++
++	if (len & 0x1) {
++		class_bus_write(val, dst, 1);
++		dst++;
++	}
++}
++
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++
++/* Writes UTIL program memory (DDR) from the host.
++ *
++ * @param[in] addr	Address to write (virtual, must be aligned on size)
++ * @param[in] val		Value to write (in PE endianness, i.e BE)
++ * @param[in] size		Number of bytes to write (2 or 4)
++ */
++static void util_pmem_write(u32 val, void *addr, u8 size)
++{
++	void *addr64 = (void *)((unsigned long)addr & ~0x7);
++	unsigned long off = 8 - ((unsigned long)addr & 0x7) - size;
++
++	/*
++	 * IMEM should  be loaded as a 64bit swapped value in a 64bit aligned
++	 * location
++	 */
++	if (size == 4)
++		writel(be32_to_cpu(val), addr64 + off);
++	else
++		writew(be16_to_cpu((u16)val), addr64 + off);
++}
++
++/* Writes a buffer to UTIL program memory (DDR) from the host.
++ *
++ * @param[in] dst	Address to write (virtual, must be at least 16bit
++ * aligned)
++ * @param[in] src	Buffer to write (in PE endianness, i.e BE, must have
++ * same alignment as dst)
++ * @param[in] len	Number of bytes to write (must be at least 16bit
++ * aligned)
++ */
++static void util_pmem_memcpy(void *dst, const void *src, unsigned int len)
++{
++	unsigned int len32;
++	int i;
++
++	if ((unsigned long)src & 0x2) {
++		util_pmem_write(*(u16 *)src, dst, 2);
++		src += 2;
++		dst += 2;
++		len -= 2;
++	}
++
++	len32 = len >> 2;
++
++	for (i = 0; i < len32; i++, dst += 4, src += 4)
++		util_pmem_write(*(u32 *)src, dst, 4);
++
++	if (len & 0x2)
++		util_pmem_write(*(u16 *)src, dst, len & 0x2);
++}
++#endif
++
++/* Loads an elf section into pmem
++ * Code needs to be at least 16bit aligned and only PROGBITS sections are
++ * supported
++ *
++ * @param[in] id	PE identification (CLASS0_ID, ..., TMU0_ID, ...,
++ * TMU3_ID)
++ * @param[in] data	pointer to the elf firmware
++ * @param[in] shdr	pointer to the elf section header
++ *
++ */
++static int pe_load_pmem_section(int id, const void *data,
++				struct elf32_shdr *shdr)
++{
++	u32 offset = be32_to_cpu(shdr->sh_offset);
++	u32 addr = be32_to_cpu(shdr->sh_addr);
++	u32 size = be32_to_cpu(shdr->sh_size);
++	u32 type = be32_to_cpu(shdr->sh_type);
++
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++	if (id == UTIL_ID) {
++		pr_err("%s: unsupported pmem section for UTIL\n",
++		       __func__);
++		return -EINVAL;
++	}
++#endif
++
++	if (((unsigned long)(data + offset) & 0x3) != (addr & 0x3)) {
++		pr_err(
++			"%s: load address(%x) and elf file address(%lx) don't have the same alignment\n"
++			, __func__, addr, (unsigned long)data + offset);
++
++		return -EINVAL;
++	}
++
++	if (addr & 0x1) {
++		pr_err("%s: load address(%x) is not 16bit aligned\n",
++		       __func__, addr);
++		return -EINVAL;
++	}
++
++	if (size & 0x1) {
++		pr_err("%s: load size(%x) is not 16bit aligned\n",
++		       __func__, size);
++		return -EINVAL;
++	}
++
++	switch (type) {
++	case SHT_PROGBITS:
++		pe_pmem_memcpy_to32(id, addr, data + offset, size);
++
++		break;
++
++	default:
++		pr_err("%s: unsupported section type(%x)\n", __func__,
++		       type);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/* Loads an elf section into dmem
++ * Data needs to be at least 32bit aligned, NOBITS sections are correctly
++ * initialized to 0
++ *
++ * @param[in] id		PE identification (CLASS0_ID, ..., TMU0_ID,
++ * ..., UTIL_ID)
++ * @param[in] data		pointer to the elf firmware
++ * @param[in] shdr		pointer to the elf section header
++ *
++ */
++static int pe_load_dmem_section(int id, const void *data,
++				struct elf32_shdr *shdr)
++{
++	u32 offset = be32_to_cpu(shdr->sh_offset);
++	u32 addr = be32_to_cpu(shdr->sh_addr);
++	u32 size = be32_to_cpu(shdr->sh_size);
++	u32 type = be32_to_cpu(shdr->sh_type);
++	u32 size32 = size >> 2;
++	int i;
++
++	if (((unsigned long)(data + offset) & 0x3) != (addr & 0x3)) {
++		pr_err(
++			"%s: load address(%x) and elf file address(%lx) don't have the same alignment\n",
++			__func__, addr, (unsigned long)data + offset);
++
++		return -EINVAL;
++	}
++
++	if (addr & 0x3) {
++		pr_err("%s: load address(%x) is not 32bit aligned\n",
++		       __func__, addr);
++		return -EINVAL;
++	}
++
++	switch (type) {
++	case SHT_PROGBITS:
++		pe_dmem_memcpy_to32(id, addr, data + offset, size);
++		break;
++
++	case SHT_NOBITS:
++		for (i = 0; i < size32; i++, addr += 4)
++			pe_dmem_write(id, 0, addr, 4);
++
++		if (size & 0x3)
++			pe_dmem_write(id, 0, addr, size & 0x3);
++
++		break;
++
++	default:
++		pr_err("%s: unsupported section type(%x)\n", __func__,
++		       type);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/* Loads an elf section into DDR
++ * Data needs to be at least 32bit aligned, NOBITS sections are correctly
++ * initialized to 0
++ *
++ * @param[in] id		PE identification (CLASS0_ID, ..., TMU0_ID,
++ * ..., UTIL_ID)
++ * @param[in] data		pointer to the elf firmware
++ * @param[in] shdr		pointer to the elf section header
++ *
++ */
++static int pe_load_ddr_section(int id, const void *data,
++			       struct elf32_shdr *shdr,
++			       struct device *dev) {
++	u32 offset = be32_to_cpu(shdr->sh_offset);
++	u32 addr = be32_to_cpu(shdr->sh_addr);
++	u32 size = be32_to_cpu(shdr->sh_size);
++	u32 type = be32_to_cpu(shdr->sh_type);
++	u32 flags = be32_to_cpu(shdr->sh_flags);
++
++	switch (type) {
++	case SHT_PROGBITS:
++		if (flags & SHF_EXECINSTR) {
++			if (id <= CLASS_MAX_ID) {
++				/* DO the loading only once in DDR */
++				if (id == CLASS0_ID) {
++					pr_err(
++						"%s: load address(%x) and elf file address(%lx) rcvd\n",
++						__func__, addr,
++						(unsigned long)data + offset);
++					if (((unsigned long)(data + offset)
++						& 0x3) != (addr & 0x3)) {
++						pr_err(
++							"%s: load address(%x) and elf file address(%lx) don't have the same alignment\n"
++							, __func__, addr,
++						(unsigned long)data + offset);
++
++						return -EINVAL;
++					}
++
++					if (addr & 0x1) {
++						pr_err(
++							"%s: load address(%x) is not 16bit aligned\n"
++							, __func__, addr);
++						return -EINVAL;
++					}
++
++					if (size & 0x1) {
++						pr_err(
++							"%s: load length(%x) is not 16bit aligned\n"
++							, __func__, size);
++						return -EINVAL;
++					}
++					memcpy(DDR_PHYS_TO_VIRT(
++						DDR_PFE_TO_PHYS(addr)),
++						data + offset, size);
++				}
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++			} else if (id == UTIL_ID) {
++				if (((unsigned long)(data + offset) & 0x3)
++					!= (addr & 0x3)) {
++					pr_err(
++						"%s: load address(%x) and elf file address(%lx) don't have the same alignment\n"
++						, __func__, addr,
++						(unsigned long)data + offset);
++
++					return -EINVAL;
++				}
++
++				if (addr & 0x1) {
++					pr_err(
++						"%s: load address(%x) is not 16bit aligned\n"
++						, __func__, addr);
++					return -EINVAL;
++				}
++
++				if (size & 0x1) {
++					pr_err(
++						"%s: load length(%x) is not 16bit aligned\n"
++						, __func__, size);
++					return -EINVAL;
++				}
++
++				util_pmem_memcpy(DDR_PHYS_TO_VIRT(
++							DDR_PFE_TO_PHYS(addr)),
++							data + offset, size);
++#endif
++			} else {
++				pr_err(
++					"%s: unsupported ddr section type(%x) for PE(%d)\n"
++						, __func__, type, id);
++				return -EINVAL;
++			}
++
++		} else {
++			memcpy(DDR_PHYS_TO_VIRT(DDR_PFE_TO_PHYS(addr)), data
++				+ offset, size);
++		}
++
++		break;
++
++	case SHT_NOBITS:
++		memset(DDR_PHYS_TO_VIRT(DDR_PFE_TO_PHYS(addr)), 0, size);
++
++		break;
++
++	default:
++		pr_err("%s: unsupported section type(%x)\n", __func__,
++		       type);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/* Loads an elf section into pe lmem
++ * Data needs to be at least 32bit aligned, NOBITS sections are correctly
++ * initialized to 0
++ *
++ * @param[in] id		PE identification (CLASS0_ID,..., CLASS5_ID)
++ * @param[in] data		pointer to the elf firmware
++ * @param[in] shdr		pointer to the elf section header
++ *
++ */
++static int pe_load_pe_lmem_section(int id, const void *data,
++				   struct elf32_shdr *shdr)
++{
++	u32 offset = be32_to_cpu(shdr->sh_offset);
++	u32 addr = be32_to_cpu(shdr->sh_addr);
++	u32 size = be32_to_cpu(shdr->sh_size);
++	u32 type = be32_to_cpu(shdr->sh_type);
++
++	if (id > CLASS_MAX_ID) {
++		pr_err(
++			"%s: unsupported pe-lmem section type(%x) for PE(%d)\n",
++			 __func__, type, id);
++		return -EINVAL;
++	}
++
++	if (((unsigned long)(data + offset) & 0x3) != (addr & 0x3)) {
++		pr_err(
++			"%s: load address(%x) and elf file address(%lx) don't have the same alignment\n",
++			__func__, addr, (unsigned long)data + offset);
++
++		return -EINVAL;
++	}
++
++	if (addr & 0x3) {
++		pr_err("%s: load address(%x) is not 32bit aligned\n",
++		       __func__, addr);
++		return -EINVAL;
++	}
++
++	switch (type) {
++	case SHT_PROGBITS:
++		class_pe_lmem_memcpy_to32(addr, data + offset, size);
++		break;
++
++	case SHT_NOBITS:
++		class_pe_lmem_memset(addr, 0, size);
++		break;
++
++	default:
++		pr_err("%s: unsupported section type(%x)\n", __func__,
++		       type);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/* Loads an elf section into a PE
++ * For now only supports loading a section to dmem (all PE's), pmem (class and
++ * tmu PE's),
++ * DDDR (util PE code)
++ *
++ * @param[in] id		PE identification (CLASS0_ID, ..., TMU0_ID,
++ * ..., UTIL_ID)
++ * @param[in] data		pointer to the elf firmware
++ * @param[in] shdr		pointer to the elf section header
++ *
++ */
++int pe_load_elf_section(int id, const void *data, struct elf32_shdr *shdr,
++			struct device *dev) {
++	u32 addr = be32_to_cpu(shdr->sh_addr);
++	u32 size = be32_to_cpu(shdr->sh_size);
++
++	if (IS_DMEM(addr, size))
++		return pe_load_dmem_section(id, data, shdr);
++	else if (IS_PMEM(addr, size))
++		return pe_load_pmem_section(id, data, shdr);
++	else if (IS_PFE_LMEM(addr, size))
++		return 0;
++	else if (IS_PHYS_DDR(addr, size))
++		return pe_load_ddr_section(id, data, shdr, dev);
++	else if (IS_PE_LMEM(addr, size))
++		return pe_load_pe_lmem_section(id, data, shdr);
++
++	pr_err("%s: unsupported memory range(%x)\n", __func__,
++	       addr);
++	return 0;
++}
++
++/**************************** BMU ***************************/
++
++/* Initializes a BMU block.
++ * @param[in] base	BMU block base address
++ * @param[in] cfg	BMU configuration
++ */
++void bmu_init(void *base, struct BMU_CFG *cfg)
++{
++	bmu_disable(base);
++
++	bmu_set_config(base, cfg);
++
++	bmu_reset(base);
++}
++
++/* Resets a BMU block.
++ * @param[in] base	BMU block base address
++ */
++void bmu_reset(void *base)
++{
++	writel(CORE_SW_RESET, base + BMU_CTRL);
++
++	/* Wait for self clear */
++	while (readl(base + BMU_CTRL) & CORE_SW_RESET)
++		;
++}
++
++/* Enabled a BMU block.
++ * @param[in] base	BMU block base address
++ */
++void bmu_enable(void *base)
++{
++	writel(CORE_ENABLE, base + BMU_CTRL);
++}
++
++/* Disables a BMU block.
++ * @param[in] base	BMU block base address
++ */
++void bmu_disable(void *base)
++{
++	writel(CORE_DISABLE, base + BMU_CTRL);
++}
++
++/* Sets the configuration of a BMU block.
++ * @param[in] base	BMU block base address
++ * @param[in] cfg	BMU configuration
++ */
++void bmu_set_config(void *base, struct BMU_CFG *cfg)
++{
++	writel(cfg->baseaddr, base + BMU_UCAST_BASE_ADDR);
++	writel(cfg->count & 0xffff, base + BMU_UCAST_CONFIG);
++	writel(cfg->size & 0xffff, base + BMU_BUF_SIZE);
++
++	/* Interrupts are never used */
++	writel(cfg->low_watermark, base + BMU_LOW_WATERMARK);
++	writel(cfg->high_watermark, base + BMU_HIGH_WATERMARK);
++	writel(0x0, base + BMU_INT_ENABLE);
++}
++
++/**************************** MTIP GEMAC ***************************/
++
++/* Enable Rx Checksum Engine. With this enabled, Frame with bad IP,
++ *   TCP or UDP checksums are discarded
++ *
++ * @param[in] base	GEMAC base address.
++ */
++void gemac_enable_rx_checksum_offload(void *base)
++{
++	/*Do not find configuration to do this */
++}
++
++/* Disable Rx Checksum Engine.
++ *
++ * @param[in] base	GEMAC base address.
++ */
++void gemac_disable_rx_checksum_offload(void *base)
++{
++	/*Do not find configuration to do this */
++}
++
++/* GEMAC set speed.
++ * @param[in] base	GEMAC base address
++ * @param[in] speed	GEMAC speed (10, 100 or 1000 Mbps)
++ */
++void gemac_set_speed(void *base, enum mac_speed gem_speed)
++{
++	u32 ecr = readl(base + EMAC_ECNTRL_REG) & ~EMAC_ECNTRL_SPEED;
++	u32 rcr = readl(base + EMAC_RCNTRL_REG) & ~EMAC_RCNTRL_RMII_10T;
++
++	switch (gem_speed) {
++	case SPEED_10M:
++			rcr |= EMAC_RCNTRL_RMII_10T;
++			break;
++
++	case SPEED_1000M:
++			ecr |= EMAC_ECNTRL_SPEED;
++			break;
++
++	case SPEED_100M:
++	default:
++			/*It is in 100M mode */
++			break;
++	}
++	writel(ecr, (base + EMAC_ECNTRL_REG));
++	writel(rcr, (base + EMAC_RCNTRL_REG));
++}
++
++/* GEMAC set duplex.
++ * @param[in] base	GEMAC base address
++ * @param[in] duplex	GEMAC duplex mode (Full, Half)
++ */
++void gemac_set_duplex(void *base, int duplex)
++{
++	if (duplex == DUPLEX_HALF) {
++		writel(readl(base + EMAC_TCNTRL_REG) & ~EMAC_TCNTRL_FDEN, base
++			+ EMAC_TCNTRL_REG);
++		writel(readl(base + EMAC_RCNTRL_REG) | EMAC_RCNTRL_DRT, (base
++			+ EMAC_RCNTRL_REG));
++	} else{
++		writel(readl(base + EMAC_TCNTRL_REG) | EMAC_TCNTRL_FDEN, base
++			+ EMAC_TCNTRL_REG);
++		writel(readl(base + EMAC_RCNTRL_REG) & ~EMAC_RCNTRL_DRT, (base
++			+ EMAC_RCNTRL_REG));
++	}
++}
++
++/* GEMAC set mode.
++ * @param[in] base	GEMAC base address
++ * @param[in] mode	GEMAC operation mode (MII, RMII, RGMII, SGMII)
++ */
++void gemac_set_mode(void *base, int mode)
++{
++	u32 val = readl(base + EMAC_RCNTRL_REG);
++
++	/*Remove loopbank*/
++	val &= ~EMAC_RCNTRL_LOOP;
++
++	/* Enable flow control and MII mode.PFE firmware always expects
++       CRC should be forwarded by MAC to validate CRC in software.*/
++	val |= (EMAC_RCNTRL_FCE | EMAC_RCNTRL_MII_MODE);
++
++	writel(val, base + EMAC_RCNTRL_REG);
++}
++
++/* GEMAC enable function.
++ * @param[in] base	GEMAC base address
++ */
++void gemac_enable(void *base)
++{
++	writel(readl(base + EMAC_ECNTRL_REG) | EMAC_ECNTRL_ETHER_EN, base +
++		EMAC_ECNTRL_REG);
++}
++
++/* GEMAC disable function.
++ * @param[in] base	GEMAC base address
++ */
++void gemac_disable(void *base)
++{
++	writel(readl(base + EMAC_ECNTRL_REG) & ~EMAC_ECNTRL_ETHER_EN, base +
++		EMAC_ECNTRL_REG);
++}
++
++/* GEMAC TX disable function.
++ * @param[in] base	GEMAC base address
++ */
++void gemac_tx_disable(void *base)
++{
++	writel(readl(base + EMAC_TCNTRL_REG) | EMAC_TCNTRL_GTS, base +
++		EMAC_TCNTRL_REG);
++}
++
++void gemac_tx_enable(void *base)
++{
++	writel(readl(base + EMAC_TCNTRL_REG) & ~EMAC_TCNTRL_GTS, base +
++			EMAC_TCNTRL_REG);
++}
++
++/* Sets the hash register of the MAC.
++ * This register is used for matching unicast and multicast frames.
++ *
++ * @param[in] base	GEMAC base address.
++ * @param[in] hash	64-bit hash to be configured.
++ */
++void gemac_set_hash(void *base, struct pfe_mac_addr *hash)
++{
++	writel(hash->bottom,  base + EMAC_GALR);
++	writel(hash->top, base + EMAC_GAUR);
++}
++
++void gemac_set_laddrN(void *base, struct pfe_mac_addr *address,
++		      unsigned int entry_index)
++{
++	if ((entry_index < 1) || (entry_index > EMAC_SPEC_ADDR_MAX))
++		return;
++
++	entry_index = entry_index - 1;
++	if (entry_index < 1) {
++		writel(htonl(address->bottom),  base + EMAC_PHY_ADDR_LOW);
++		writel((htonl(address->top) | 0x8808), base +
++			EMAC_PHY_ADDR_HIGH);
++	} else {
++		writel(htonl(address->bottom),  base + ((entry_index - 1) * 8)
++			+ EMAC_SMAC_0_0);
++		writel((htonl(address->top) | 0x8808), base + ((entry_index -
++			1) * 8) + EMAC_SMAC_0_1);
++	}
++}
++
++void gemac_clear_laddrN(void *base, unsigned int entry_index)
++{
++	if ((entry_index < 1) || (entry_index > EMAC_SPEC_ADDR_MAX))
++		return;
++
++	entry_index = entry_index - 1;
++	if (entry_index < 1) {
++		writel(0, base + EMAC_PHY_ADDR_LOW);
++		writel(0, base + EMAC_PHY_ADDR_HIGH);
++	} else {
++		writel(0,  base + ((entry_index - 1) * 8) + EMAC_SMAC_0_0);
++		writel(0, base + ((entry_index - 1) * 8) + EMAC_SMAC_0_1);
++	}
++}
++
++/* Set the loopback mode of the MAC.  This can be either no loopback for
++ * normal operation, local loopback through MAC internal loopback module or PHY
++ *   loopback for external loopback through a PHY.  This asserts the external
++ * loop pin.
++ *
++ * @param[in] base	GEMAC base address.
++ * @param[in] gem_loop	Loopback mode to be enabled. LB_LOCAL - MAC
++ * Loopback,
++ *			LB_EXT - PHY Loopback.
++ */
++void gemac_set_loop(void *base, enum mac_loop gem_loop)
++{
++	pr_info("%s()\n", __func__);
++	writel(readl(base + EMAC_RCNTRL_REG) | EMAC_RCNTRL_LOOP, (base +
++		EMAC_RCNTRL_REG));
++}
++
++/* GEMAC allow frames
++ * @param[in] base	GEMAC base address
++ */
++void gemac_enable_copy_all(void *base)
++{
++	writel(readl(base + EMAC_RCNTRL_REG) | EMAC_RCNTRL_PROM, (base +
++		EMAC_RCNTRL_REG));
++}
++
++/* GEMAC do not allow frames
++ * @param[in] base	GEMAC base address
++ */
++void gemac_disable_copy_all(void *base)
++{
++	writel(readl(base + EMAC_RCNTRL_REG) & ~EMAC_RCNTRL_PROM, (base +
++		EMAC_RCNTRL_REG));
++}
++
++/* GEMAC allow broadcast function.
++ * @param[in] base	GEMAC base address
++ */
++void gemac_allow_broadcast(void *base)
++{
++	writel(readl(base + EMAC_RCNTRL_REG) & ~EMAC_RCNTRL_BC_REJ, base +
++		EMAC_RCNTRL_REG);
++}
++
++/* GEMAC no broadcast function.
++ * @param[in] base	GEMAC base address
++ */
++void gemac_no_broadcast(void *base)
++{
++	writel(readl(base + EMAC_RCNTRL_REG) | EMAC_RCNTRL_BC_REJ, base +
++		EMAC_RCNTRL_REG);
++}
++
++/* GEMAC enable 1536 rx function.
++ * @param[in]	base	GEMAC base address
++ */
++void gemac_enable_1536_rx(void *base)
++{
++	/* Set 1536 as Maximum frame length */
++	writel((readl(base + EMAC_RCNTRL_REG) & PFE_RCR_MAX_FL_MASK)
++		| (1536 << 16), base +	EMAC_RCNTRL_REG);
++}
++
++/* GEMAC set rx Max frame length.
++ * @param[in]	base	GEMAC base address
++ * @param[in]	mtu	new mtu
++ */
++void gemac_set_rx_max_fl(void *base, int mtu)
++{
++	/* Set mtu as Maximum frame length */
++	writel((readl(base + EMAC_RCNTRL_REG) & PFE_RCR_MAX_FL_MASK)
++		| (mtu << 16), base + EMAC_RCNTRL_REG);
++}
++
++/* GEMAC enable stacked vlan function.
++ * @param[in]	base	GEMAC base address
++ */
++void gemac_enable_stacked_vlan(void *base)
++{
++	/* MTIP doesn't support stacked vlan */
++}
++
++/* GEMAC enable pause rx function.
++ * @param[in] base	GEMAC base address
++ */
++void gemac_enable_pause_rx(void *base)
++{
++	writel(readl(base + EMAC_RCNTRL_REG) | EMAC_RCNTRL_FCE,
++	       base + EMAC_RCNTRL_REG);
++}
++
++/* GEMAC disable pause rx function.
++ * @param[in] base	GEMAC base address
++ */
++void gemac_disable_pause_rx(void *base)
++{
++	writel(readl(base + EMAC_RCNTRL_REG) & ~EMAC_RCNTRL_FCE,
++	       base + EMAC_RCNTRL_REG);
++}
++
++/* GEMAC enable pause tx function.
++ * @param[in] base GEMAC base address
++ */
++void gemac_enable_pause_tx(void *base)
++{
++	writel(EMAC_RX_SECTION_EMPTY_V, base + EMAC_RX_SECTION_EMPTY);
++}
++
++/* GEMAC disable pause tx function.
++ * @param[in] base GEMAC base address
++ */
++void gemac_disable_pause_tx(void *base)
++{
++	writel(0x0, base + EMAC_RX_SECTION_EMPTY);
++}
++
++/* GEMAC wol configuration
++ * @param[in] base	GEMAC base address
++ * @param[in] wol_conf	WoL register configuration
++ */
++void gemac_set_wol(void *base, u32 wol_conf)
++{
++	u32  val = readl(base + EMAC_ECNTRL_REG);
++
++	if (wol_conf)
++		val |= (EMAC_ECNTRL_MAGIC_ENA | EMAC_ECNTRL_SLEEP);
++	else
++		val &= ~(EMAC_ECNTRL_MAGIC_ENA | EMAC_ECNTRL_SLEEP);
++	writel(val, base + EMAC_ECNTRL_REG);
++}
++
++/* Sets Gemac bus width to 64bit
++ * @param[in] base       GEMAC base address
++ * @param[in] width     gemac bus width to be set possible values are 32/64/128
++ */
++void gemac_set_bus_width(void *base, int width)
++{
++}
++
++/* Sets Gemac configuration.
++ * @param[in] base	GEMAC base address
++ * @param[in] cfg	GEMAC configuration
++ */
++void gemac_set_config(void *base, struct gemac_cfg *cfg)
++{
++	/*GEMAC config taken from VLSI */
++	writel(0x00000004, base + EMAC_TFWR_STR_FWD);
++	writel(0x00000005, base + EMAC_RX_SECTION_FULL);
++
++	if (pfe_errata_a010897)
++		writel(0x0000076c, base + EMAC_TRUNC_FL);
++	else
++		writel(0x00003fff, base + EMAC_TRUNC_FL);
++
++	writel(0x00000030, base + EMAC_TX_SECTION_EMPTY);
++	writel(0x00000000, base + EMAC_MIB_CTRL_STS_REG);
++
++	gemac_set_mode(base, cfg->mode);
++
++	gemac_set_speed(base, cfg->speed);
++
++	gemac_set_duplex(base, cfg->duplex);
++}
++
++/**************************** GPI ***************************/
++
++/* Initializes a GPI block.
++ * @param[in] base	GPI base address
++ * @param[in] cfg	GPI configuration
++ */
++void gpi_init(void *base, struct gpi_cfg *cfg)
++{
++	gpi_reset(base);
++
++	gpi_disable(base);
++
++	gpi_set_config(base, cfg);
++}
++
++/* Resets a GPI block.
++ * @param[in] base	GPI base address
++ */
++void gpi_reset(void *base)
++{
++	writel(CORE_SW_RESET, base + GPI_CTRL);
++}
++
++/* Enables a GPI block.
++ * @param[in] base	GPI base address
++ */
++void gpi_enable(void *base)
++{
++	writel(CORE_ENABLE, base + GPI_CTRL);
++}
++
++/* Disables a GPI block.
++ * @param[in] base	GPI base address
++ */
++void gpi_disable(void *base)
++{
++	writel(CORE_DISABLE, base + GPI_CTRL);
++}
++
++/* Sets the configuration of a GPI block.
++ * @param[in] base	GPI base address
++ * @param[in] cfg	GPI configuration
++ */
++void gpi_set_config(void *base, struct gpi_cfg *cfg)
++{
++	writel(CBUS_VIRT_TO_PFE(BMU1_BASE_ADDR + BMU_ALLOC_CTRL),	base
++		+ GPI_LMEM_ALLOC_ADDR);
++	writel(CBUS_VIRT_TO_PFE(BMU1_BASE_ADDR + BMU_FREE_CTRL),	base
++		+ GPI_LMEM_FREE_ADDR);
++	writel(CBUS_VIRT_TO_PFE(BMU2_BASE_ADDR + BMU_ALLOC_CTRL),	base
++		+ GPI_DDR_ALLOC_ADDR);
++	writel(CBUS_VIRT_TO_PFE(BMU2_BASE_ADDR + BMU_FREE_CTRL),	base
++		+ GPI_DDR_FREE_ADDR);
++	writel(CBUS_VIRT_TO_PFE(CLASS_INQ_PKTPTR), base + GPI_CLASS_ADDR);
++	writel(DDR_HDR_SIZE, base + GPI_DDR_DATA_OFFSET);
++	writel(LMEM_HDR_SIZE, base + GPI_LMEM_DATA_OFFSET);
++	writel(0, base + GPI_LMEM_SEC_BUF_DATA_OFFSET);
++	writel(0, base + GPI_DDR_SEC_BUF_DATA_OFFSET);
++	writel((DDR_HDR_SIZE << 16) |	LMEM_HDR_SIZE,	base + GPI_HDR_SIZE);
++	writel((DDR_BUF_SIZE << 16) |	LMEM_BUF_SIZE,	base + GPI_BUF_SIZE);
++
++	writel(((cfg->lmem_rtry_cnt << 16) | (GPI_DDR_BUF_EN << 1) |
++		GPI_LMEM_BUF_EN), base + GPI_RX_CONFIG);
++	writel(cfg->tmlf_txthres, base + GPI_TMLF_TX);
++	writel(cfg->aseq_len,	base + GPI_DTX_ASEQ);
++	writel(1, base + GPI_TOE_CHKSUM_EN);
++
++	if (cfg->mtip_pause_reg) {
++		writel(cfg->mtip_pause_reg, base + GPI_CSR_MTIP_PAUSE_REG);
++		writel(EGPI_PAUSE_TIME, base + GPI_TX_PAUSE_TIME);
++	}
++}
++
++/**************************** CLASSIFIER ***************************/
++
++/* Initializes CLASSIFIER block.
++ * @param[in] cfg	CLASSIFIER configuration
++ */
++void class_init(struct class_cfg *cfg)
++{
++	class_reset();
++
++	class_disable();
++
++	class_set_config(cfg);
++}
++
++/* Resets CLASSIFIER block.
++ *
++ */
++void class_reset(void)
++{
++	writel(CORE_SW_RESET, CLASS_TX_CTRL);
++}
++
++/* Enables all CLASS-PE's cores.
++ *
++ */
++void class_enable(void)
++{
++	writel(CORE_ENABLE, CLASS_TX_CTRL);
++}
++
++/* Disables all CLASS-PE's cores.
++ *
++ */
++void class_disable(void)
++{
++	writel(CORE_DISABLE, CLASS_TX_CTRL);
++}
++
++/*
++ * Sets the configuration of the CLASSIFIER block.
++ * @param[in] cfg	CLASSIFIER configuration
++ */
++void class_set_config(struct class_cfg *cfg)
++{
++	u32 val;
++
++	/* Initialize route table */
++	if (!cfg->resume)
++		memset(DDR_PHYS_TO_VIRT(cfg->route_table_baseaddr), 0, (1 <<
++		cfg->route_table_hash_bits) * CLASS_ROUTE_SIZE);
++
++#if !defined(LS1012A_PFE_RESET_WA)
++	writel(cfg->pe_sys_clk_ratio,	CLASS_PE_SYS_CLK_RATIO);
++#endif
++
++	writel((DDR_HDR_SIZE << 16) | LMEM_HDR_SIZE,	CLASS_HDR_SIZE);
++	writel(LMEM_BUF_SIZE,				CLASS_LMEM_BUF_SIZE);
++	writel(CLASS_ROUTE_ENTRY_SIZE(CLASS_ROUTE_SIZE) |
++		CLASS_ROUTE_HASH_SIZE(cfg->route_table_hash_bits),
++		CLASS_ROUTE_HASH_ENTRY_SIZE);
++	writel(HIF_PKT_CLASS_EN | HIF_PKT_OFFSET(sizeof(struct hif_hdr)),
++	       CLASS_HIF_PARSE);
++
++	val = HASH_CRC_PORT_IP | QB2BUS_LE;
++
++#if defined(CONFIG_IP_ALIGNED)
++	val |= IP_ALIGNED;
++#endif
++
++	/*
++	 *  Class PE packet steering will only work if TOE mode, bridge fetch or
++	 * route fetch are enabled (see class/qb_fet.v). Route fetch would
++	 * trigger additional memory copies (likely from DDR because of hash
++	 * table size, which cannot be reduced because PE software still
++	 * relies on hash value computed in HW), so when not in TOE mode we
++	 * simply enable HW bridge fetch even though we don't use it.
++	 */
++	if (cfg->toe_mode)
++		val |= CLASS_TOE;
++	else
++		val |= HW_BRIDGE_FETCH;
++
++	writel(val, CLASS_ROUTE_MULTI);
++
++	writel(DDR_PHYS_TO_PFE(cfg->route_table_baseaddr),
++	       CLASS_ROUTE_TABLE_BASE);
++	writel(CLASS_PE0_RO_DM_ADDR0_VAL,		CLASS_PE0_RO_DM_ADDR0);
++	writel(CLASS_PE0_RO_DM_ADDR1_VAL,		CLASS_PE0_RO_DM_ADDR1);
++	writel(CLASS_PE0_QB_DM_ADDR0_VAL,		CLASS_PE0_QB_DM_ADDR0);
++	writel(CLASS_PE0_QB_DM_ADDR1_VAL,		CLASS_PE0_QB_DM_ADDR1);
++	writel(CBUS_VIRT_TO_PFE(TMU_PHY_INQ_PKTPTR),	CLASS_TM_INQ_ADDR);
++
++	writel(23, CLASS_AFULL_THRES);
++	writel(23, CLASS_TSQ_FIFO_THRES);
++
++	writel(24, CLASS_MAX_BUF_CNT);
++	writel(24, CLASS_TSQ_MAX_CNT);
++}
++
++/**************************** TMU ***************************/
++
++void tmu_reset(void)
++{
++	writel(SW_RESET, TMU_CTRL);
++}
++
++/* Initializes TMU block.
++ * @param[in] cfg	TMU configuration
++ */
++void tmu_init(struct tmu_cfg *cfg)
++{
++	int q, phyno;
++
++	tmu_disable(0xF);
++	mdelay(10);
++
++#if !defined(LS1012A_PFE_RESET_WA)
++	/* keep in soft reset */
++	writel(SW_RESET, TMU_CTRL);
++#endif
++	writel(0x3, TMU_SYS_GENERIC_CONTROL);
++	writel(750, TMU_INQ_WATERMARK);
++	writel(CBUS_VIRT_TO_PFE(EGPI1_BASE_ADDR +
++		GPI_INQ_PKTPTR),	TMU_PHY0_INQ_ADDR);
++	writel(CBUS_VIRT_TO_PFE(EGPI2_BASE_ADDR +
++		GPI_INQ_PKTPTR),	TMU_PHY1_INQ_ADDR);
++	writel(CBUS_VIRT_TO_PFE(HGPI_BASE_ADDR +
++		GPI_INQ_PKTPTR),	TMU_PHY3_INQ_ADDR);
++	writel(CBUS_VIRT_TO_PFE(HIF_NOCPY_RX_INQ0_PKTPTR), TMU_PHY4_INQ_ADDR);
++	writel(CBUS_VIRT_TO_PFE(UTIL_INQ_PKTPTR), TMU_PHY5_INQ_ADDR);
++	writel(CBUS_VIRT_TO_PFE(BMU2_BASE_ADDR + BMU_FREE_CTRL),
++	       TMU_BMU_INQ_ADDR);
++
++	writel(0x3FF,	TMU_TDQ0_SCH_CTRL);	/*
++						 * enabling all 10
++						 * schedulers [9:0] of each TDQ
++						 */
++	writel(0x3FF,	TMU_TDQ1_SCH_CTRL);
++	writel(0x3FF,	TMU_TDQ3_SCH_CTRL);
++
++#if !defined(LS1012A_PFE_RESET_WA)
++	writel(cfg->pe_sys_clk_ratio,	TMU_PE_SYS_CLK_RATIO);
++#endif
++
++#if !defined(LS1012A_PFE_RESET_WA)
++	writel(DDR_PHYS_TO_PFE(cfg->llm_base_addr),	TMU_LLM_BASE_ADDR);
++	/* Extra packet pointers will be stored from this address onwards */
++
++	writel(cfg->llm_queue_len,	TMU_LLM_QUE_LEN);
++	writel(5,			TMU_TDQ_IIFG_CFG);
++	writel(DDR_BUF_SIZE,		TMU_BMU_BUF_SIZE);
++
++	writel(0x0,			TMU_CTRL);
++
++	/* MEM init */
++	pr_info("%s: mem init\n", __func__);
++	writel(MEM_INIT,	TMU_CTRL);
++
++	while (!(readl(TMU_CTRL) & MEM_INIT_DONE))
++		;
++
++	/* LLM init */
++	pr_info("%s: lmem init\n", __func__);
++	writel(LLM_INIT,	TMU_CTRL);
++
++	while (!(readl(TMU_CTRL) & LLM_INIT_DONE))
++		;
++#endif
++	/* set up each queue for tail drop */
++	for (phyno = 0; phyno < 4; phyno++) {
++		if (phyno == 2)
++			continue;
++		for (q = 0; q < 16; q++) {
++			u32 qdepth;
++
++			writel((phyno << 8) | q, TMU_TEQ_CTRL);
++			writel(1 << 22, TMU_TEQ_QCFG); /*Enable tail drop */
++
++			if (phyno == 3)
++				qdepth = DEFAULT_TMU3_QDEPTH;
++			else
++				qdepth = (q == 0) ? DEFAULT_Q0_QDEPTH :
++						DEFAULT_MAX_QDEPTH;
++
++			/* LOG: 68855 */
++			/*
++			 * The following is a workaround for the reordered
++			 * packet and BMU2 buffer leakage issue.
++			 */
++			if (CHIP_REVISION() == 0)
++				qdepth = 31;
++
++			writel(qdepth << 18, TMU_TEQ_HW_PROB_CFG2);
++			writel(qdepth >> 14, TMU_TEQ_HW_PROB_CFG3);
++		}
++	}
++
++#ifdef CFG_LRO
++	/* Set TMU-3 queue 5 (LRO) in no-drop mode */
++	writel((3 << 8) | TMU_QUEUE_LRO, TMU_TEQ_CTRL);
++	writel(0, TMU_TEQ_QCFG);
++#endif
++
++	writel(0x05, TMU_TEQ_DISABLE_DROPCHK);
++
++	writel(0x0, TMU_CTRL);
++}
++
++/* Enables TMU-PE cores.
++ * @param[in] pe_mask	TMU PE mask
++ */
++void tmu_enable(u32 pe_mask)
++{
++	writel(readl(TMU_TX_CTRL) | (pe_mask & 0xF), TMU_TX_CTRL);
++}
++
++/* Disables TMU cores.
++ * @param[in] pe_mask	TMU PE mask
++ */
++void tmu_disable(u32 pe_mask)
++{
++	writel(readl(TMU_TX_CTRL) & ~(pe_mask & 0xF), TMU_TX_CTRL);
++}
++
++/* This will return the tmu queue status
++ * @param[in] if_id	gem interface id or TMU index
++ * @return		returns the bit mask of busy queues, zero means all
++ * queues are empty
++ */
++u32 tmu_qstatus(u32 if_id)
++{
++	return cpu_to_be32(pe_dmem_read(TMU0_ID + if_id, TMU_DM_PESTATUS +
++		offsetof(struct pe_status, tmu_qstatus), 4));
++}
++
++u32 tmu_pkts_processed(u32 if_id)
++{
++	return cpu_to_be32(pe_dmem_read(TMU0_ID + if_id, TMU_DM_PESTATUS +
++		offsetof(struct pe_status, rx), 4));
++}
++
++/**************************** UTIL ***************************/
++
++/* Resets UTIL block.
++ */
++void util_reset(void)
++{
++	writel(CORE_SW_RESET, UTIL_TX_CTRL);
++}
++
++/* Initializes UTIL block.
++ * @param[in] cfg	UTIL configuration
++ */
++void util_init(struct util_cfg *cfg)
++{
++	writel(cfg->pe_sys_clk_ratio,   UTIL_PE_SYS_CLK_RATIO);
++}
++
++/* Enables UTIL-PE core.
++ *
++ */
++void util_enable(void)
++{
++	writel(CORE_ENABLE, UTIL_TX_CTRL);
++}
++
++/* Disables UTIL-PE core.
++ *
++ */
++void util_disable(void)
++{
++	writel(CORE_DISABLE, UTIL_TX_CTRL);
++}
++
++/**************************** HIF ***************************/
++/* Initializes HIF copy block.
++ *
++ */
++void hif_init(void)
++{
++	/*Initialize HIF registers*/
++	writel((HIF_RX_POLL_CTRL_CYCLE << 16) | HIF_TX_POLL_CTRL_CYCLE,
++	       HIF_POLL_CTRL);
++}
++
++/* Enable hif tx DMA and interrupt
++ *
++ */
++void hif_tx_enable(void)
++{
++	writel(HIF_CTRL_DMA_EN, HIF_TX_CTRL);
++	writel((readl(HIF_INT_ENABLE) | HIF_INT_EN | HIF_TXPKT_INT_EN),
++	       HIF_INT_ENABLE);
++}
++
++/* Disable hif tx DMA and interrupt
++ *
++ */
++void hif_tx_disable(void)
++{
++	u32	hif_int;
++
++	writel(0, HIF_TX_CTRL);
++
++	hif_int = readl(HIF_INT_ENABLE);
++	hif_int &= HIF_TXPKT_INT_EN;
++	writel(hif_int, HIF_INT_ENABLE);
++}
++
++/* Enable hif rx DMA and interrupt
++ *
++ */
++void hif_rx_enable(void)
++{
++	hif_rx_dma_start();
++	writel((readl(HIF_INT_ENABLE) | HIF_INT_EN | HIF_RXPKT_INT_EN),
++	       HIF_INT_ENABLE);
++}
++
++/* Disable hif rx DMA and interrupt
++ *
++ */
++void hif_rx_disable(void)
++{
++	u32	hif_int;
++
++	writel(0, HIF_RX_CTRL);
++
++	hif_int = readl(HIF_INT_ENABLE);
++	hif_int &= HIF_RXPKT_INT_EN;
++	writel(hif_int, HIF_INT_ENABLE);
++}
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_hif.c
+@@ -0,0 +1,1064 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ */
++
++#include <linux/kernel.h>
++#include <linux/interrupt.h>
++#include <linux/dma-mapping.h>
++#include <linux/dmapool.h>
++#include <linux/sched.h>
++#include <linux/module.h>
++#include <linux/list.h>
++#include <linux/kthread.h>
++#include <linux/slab.h>
++
++#include <linux/io.h>
++#include <asm/irq.h>
++
++#include "pfe_mod.h"
++
++#define HIF_INT_MASK	(HIF_INT | HIF_RXPKT_INT | HIF_TXPKT_INT)
++
++unsigned char napi_first_batch;
++
++static void pfe_tx_do_cleanup(unsigned long data);
++
++static int pfe_hif_alloc_descr(struct pfe_hif *hif)
++{
++	void *addr;
++	dma_addr_t dma_addr;
++	int err = 0;
++
++	pr_info("%s\n", __func__);
++	addr = dma_alloc_coherent(pfe->dev,
++				  HIF_RX_DESC_NT * sizeof(struct hif_desc) +
++				  HIF_TX_DESC_NT * sizeof(struct hif_desc),
++				  &dma_addr, GFP_KERNEL);
++
++	if (!addr) {
++		pr_err("%s: Could not allocate buffer descriptors!\n"
++			, __func__);
++		err = -ENOMEM;
++		goto err0;
++	}
++
++	hif->descr_baseaddr_p = dma_addr;
++	hif->descr_baseaddr_v = addr;
++	hif->rx_ring_size = HIF_RX_DESC_NT;
++	hif->tx_ring_size = HIF_TX_DESC_NT;
++
++	return 0;
++
++err0:
++	return err;
++}
++
++#if defined(LS1012A_PFE_RESET_WA)
++static void pfe_hif_disable_rx_desc(struct pfe_hif *hif)
++{
++	int ii;
++	struct hif_desc	*desc = hif->rx_base;
++
++	/*Mark all descriptors as LAST_BD */
++	for (ii = 0; ii < hif->rx_ring_size; ii++) {
++		desc->ctrl |= BD_CTRL_LAST_BD;
++		desc++;
++	}
++}
++
++struct class_rx_hdr_t {
++	u32     next_ptr;       /* ptr to the start of the first DDR buffer */
++	u16     length;         /* total packet length */
++	u16     phyno;          /* input physical port number */
++	u32     status;         /* gemac status bits */
++	u32     status2;            /* reserved for software usage */
++};
++
++/* STATUS_BAD_FRAME_ERR is set for all errors (including checksums if enabled)
++ * except overflow
++ */
++#define STATUS_BAD_FRAME_ERR            BIT(16)
++#define STATUS_LENGTH_ERR               BIT(17)
++#define STATUS_CRC_ERR                  BIT(18)
++#define STATUS_TOO_SHORT_ERR            BIT(19)
++#define STATUS_TOO_LONG_ERR             BIT(20)
++#define STATUS_CODE_ERR                 BIT(21)
++#define STATUS_MC_HASH_MATCH            BIT(22)
++#define STATUS_CUMULATIVE_ARC_HIT       BIT(23)
++#define STATUS_UNICAST_HASH_MATCH       BIT(24)
++#define STATUS_IP_CHECKSUM_CORRECT      BIT(25)
++#define STATUS_TCP_CHECKSUM_CORRECT     BIT(26)
++#define STATUS_UDP_CHECKSUM_CORRECT     BIT(27)
++#define STATUS_OVERFLOW_ERR             BIT(28) /* GPI error */
++#define MIN_PKT_SIZE			64
++
++static inline void copy_to_lmem(u32 *dst, u32 *src, int len)
++{
++	int i;
++
++	for (i = 0; i < len; i += sizeof(u32))	{
++		*dst = htonl(*src);
++		dst++; src++;
++	}
++}
++
++static void send_dummy_pkt_to_hif(void)
++{
++	void *lmem_ptr, *ddr_ptr, *lmem_virt_addr;
++	u32 physaddr;
++	struct class_rx_hdr_t local_hdr;
++	static u32 dummy_pkt[] =  {
++		0x33221100, 0x2b785544, 0xd73093cb, 0x01000608,
++		0x04060008, 0x2b780200, 0xd73093cb, 0x0a01a8c0,
++		0x33221100, 0xa8c05544, 0x00000301, 0x00000000,
++		0x00000000, 0x00000000, 0x00000000, 0xbe86c51f };
++
++	ddr_ptr = (void *)((uintptr_t)readl(BMU2_BASE_ADDR + BMU_ALLOC_CTRL));
++	if (!ddr_ptr)
++		return;
++
++	lmem_ptr = (void *)((uintptr_t)readl(BMU1_BASE_ADDR + BMU_ALLOC_CTRL));
++	if (!lmem_ptr)
++		return;
++
++	pr_info("Sending a dummy pkt to HIF %p %p\n", ddr_ptr, lmem_ptr);
++	physaddr = (u32)DDR_VIRT_TO_PFE(ddr_ptr);
++
++	lmem_virt_addr = (void *)CBUS_PFE_TO_VIRT((unsigned long int)lmem_ptr);
++
++	local_hdr.phyno = htons(0); /* RX_PHY_0 */
++	local_hdr.length = htons(MIN_PKT_SIZE);
++
++	local_hdr.next_ptr = htonl((u32)physaddr);
++	/*Mark checksum is correct */
++	local_hdr.status = htonl((STATUS_IP_CHECKSUM_CORRECT |
++				STATUS_UDP_CHECKSUM_CORRECT |
++				STATUS_TCP_CHECKSUM_CORRECT |
++				STATUS_UNICAST_HASH_MATCH |
++				STATUS_CUMULATIVE_ARC_HIT));
++	local_hdr.status2 = 0;
++
++	copy_to_lmem((u32 *)lmem_virt_addr, (u32 *)&local_hdr,
++		     sizeof(local_hdr));
++
++	copy_to_lmem((u32 *)(lmem_virt_addr + LMEM_HDR_SIZE), (u32 *)dummy_pkt,
++		     0x40);
++
++	writel((unsigned long int)lmem_ptr, CLASS_INQ_PKTPTR);
++}
++
++void pfe_hif_rx_idle(struct pfe_hif *hif)
++{
++	int hif_stop_loop = 10;
++	u32 rx_status;
++
++	pfe_hif_disable_rx_desc(hif);
++	pr_info("Bringing hif to idle state...");
++	writel(0, HIF_INT_ENABLE);
++	/*If HIF Rx BDP is busy send a dummy packet */
++	do {
++		rx_status = readl(HIF_RX_STATUS);
++		if (rx_status & BDP_CSR_RX_DMA_ACTV)
++			send_dummy_pkt_to_hif();
++
++		usleep_range(100, 150);
++	} while (--hif_stop_loop);
++
++	if (readl(HIF_RX_STATUS) & BDP_CSR_RX_DMA_ACTV)
++		pr_info("Failed\n");
++	else
++		pr_info("Done\n");
++}
++#endif
++
++static void pfe_hif_free_descr(struct pfe_hif *hif)
++{
++	pr_info("%s\n", __func__);
++
++	dma_free_coherent(pfe->dev,
++			  hif->rx_ring_size * sizeof(struct hif_desc) +
++			  hif->tx_ring_size * sizeof(struct hif_desc),
++			  hif->descr_baseaddr_v, hif->descr_baseaddr_p);
++}
++
++void pfe_hif_desc_dump(struct pfe_hif *hif)
++{
++	struct hif_desc	*desc;
++	u64 desc_p;
++	int ii = 0;
++
++	pr_info("%s\n", __func__);
++
++	desc = hif->rx_base;
++	desc_p = ((void *)desc - hif->descr_baseaddr_v +
++			hif->descr_baseaddr_p);
++
++	pr_info("HIF Rx desc base %p physical %llx\n", desc, desc_p);
++	for (ii = 0; ii < hif->rx_ring_size; ii++) {
++		pr_info("status: %08x, ctrl: %08x, data: %08x, next: %x\n",
++			readl(&desc->status), readl(&desc->ctrl),
++			readl(&desc->data), readl(&desc->next));
++			desc++;
++	}
++
++	desc = hif->tx_base;
++	desc_p = ((void *)desc - hif->descr_baseaddr_v +
++			hif->descr_baseaddr_p);
++
++	pr_info("HIF Tx desc base %p physical %llx\n", desc, desc_p);
++	for (ii = 0; ii < hif->tx_ring_size; ii++) {
++		pr_info("status: %08x, ctrl: %08x, data: %08x, next: %x\n",
++			readl(&desc->status), readl(&desc->ctrl),
++			readl(&desc->data), readl(&desc->next));
++		desc++;
++	}
++}
++
++/* pfe_hif_release_buffers */
++static void pfe_hif_release_buffers(struct pfe_hif *hif)
++{
++	struct hif_desc	*desc;
++	int i = 0;
++
++	hif->rx_base = hif->descr_baseaddr_v;
++
++	pr_info("%s\n", __func__);
++
++	/*Free Rx buffers */
++	desc = hif->rx_base;
++	for (i = 0; i < hif->rx_ring_size; i++) {
++		if (readl(&desc->data)) {
++			if ((i < hif->shm->rx_buf_pool_cnt) &&
++			    (!hif->shm->rx_buf_pool[i])) {
++				/*
++				 * dma_unmap_single(hif->dev, desc->data,
++				 * hif->rx_buf_len[i], DMA_FROM_DEVICE);
++				 */
++				dma_unmap_single(hif->dev,
++						 DDR_PFE_TO_PHYS(
++						 readl(&desc->data)),
++						 hif->rx_buf_len[i],
++						 DMA_FROM_DEVICE);
++				hif->shm->rx_buf_pool[i] = hif->rx_buf_addr[i];
++			} else {
++				pr_err("%s: buffer pool already full\n"
++					, __func__);
++			}
++		}
++
++		writel(0, &desc->data);
++		writel(0, &desc->status);
++		writel(0, &desc->ctrl);
++		desc++;
++	}
++}
++
++/*
++ * pfe_hif_init_buffers
++ * This function initializes the HIF Rx/Tx ring descriptors and
++ * initialize Rx queue with buffers.
++ */
++static int pfe_hif_init_buffers(struct pfe_hif *hif)
++{
++	struct hif_desc	*desc, *first_desc_p;
++	u32 data;
++	int i = 0;
++
++	pr_info("%s\n", __func__);
++
++	/* Check enough Rx buffers available in the shared memory */
++	if (hif->shm->rx_buf_pool_cnt < hif->rx_ring_size)
++		return -ENOMEM;
++
++	hif->rx_base = hif->descr_baseaddr_v;
++	memset(hif->rx_base, 0, hif->rx_ring_size * sizeof(struct hif_desc));
++
++	/*Initialize Rx descriptors */
++	desc = hif->rx_base;
++	first_desc_p = (struct hif_desc *)hif->descr_baseaddr_p;
++
++	for (i = 0; i < hif->rx_ring_size; i++) {
++		/* Initialize Rx buffers from the shared memory */
++
++		data = (u32)dma_map_single(hif->dev, hif->shm->rx_buf_pool[i],
++				pfe_pkt_size, DMA_FROM_DEVICE);
++		hif->rx_buf_addr[i] = hif->shm->rx_buf_pool[i];
++		hif->rx_buf_len[i] = pfe_pkt_size;
++		hif->shm->rx_buf_pool[i] = NULL;
++
++		if (likely(dma_mapping_error(hif->dev, data) == 0)) {
++			writel(DDR_PHYS_TO_PFE(data), &desc->data);
++		} else {
++			pr_err("%s : low on mem\n",  __func__);
++
++			goto err;
++		}
++
++		writel(0, &desc->status);
++
++		/*
++		 * Ensure everything else is written to DDR before
++		 * writing bd->ctrl
++		 */
++		wmb();
++
++		writel((BD_CTRL_PKT_INT_EN | BD_CTRL_LIFM
++			| BD_CTRL_DIR | BD_CTRL_DESC_EN
++			| BD_BUF_LEN(pfe_pkt_size)), &desc->ctrl);
++
++		/* Chain descriptors */
++		writel((u32)DDR_PHYS_TO_PFE(first_desc_p + i + 1), &desc->next);
++		desc++;
++	}
++
++	/* Overwrite last descriptor to chain it to first one*/
++	desc--;
++	writel((u32)DDR_PHYS_TO_PFE(first_desc_p), &desc->next);
++
++	hif->rxtoclean_index = 0;
++
++	/*Initialize Rx buffer descriptor ring base address */
++	writel(DDR_PHYS_TO_PFE(hif->descr_baseaddr_p), HIF_RX_BDP_ADDR);
++
++	hif->tx_base = hif->rx_base + hif->rx_ring_size;
++	first_desc_p = (struct hif_desc *)hif->descr_baseaddr_p +
++				hif->rx_ring_size;
++	memset(hif->tx_base, 0, hif->tx_ring_size * sizeof(struct hif_desc));
++
++	/*Initialize tx descriptors */
++	desc = hif->tx_base;
++
++	for (i = 0; i < hif->tx_ring_size; i++) {
++		/* Chain descriptors */
++		writel((u32)DDR_PHYS_TO_PFE(first_desc_p + i + 1), &desc->next);
++		writel(0, &desc->ctrl);
++		desc++;
++	}
++
++	/* Overwrite last descriptor to chain it to first one */
++	desc--;
++	writel((u32)DDR_PHYS_TO_PFE(first_desc_p), &desc->next);
++	hif->txavail = hif->tx_ring_size;
++	hif->txtosend = 0;
++	hif->txtoclean = 0;
++	hif->txtoflush = 0;
++
++	/*Initialize Tx buffer descriptor ring base address */
++	writel((u32)DDR_PHYS_TO_PFE(first_desc_p), HIF_TX_BDP_ADDR);
++
++	return 0;
++
++err:
++	pfe_hif_release_buffers(hif);
++	return -ENOMEM;
++}
++
++/*
++ * pfe_hif_client_register
++ *
++ * This function used to register a client driver with the HIF driver.
++ *
++ * Return value:
++ * 0 - on Successful registration
++ */
++static int pfe_hif_client_register(struct pfe_hif *hif, u32 client_id,
++				   struct hif_client_shm *client_shm)
++{
++	struct hif_client *client = &hif->client[client_id];
++	u32 i, cnt;
++	struct rx_queue_desc *rx_qbase;
++	struct tx_queue_desc *tx_qbase;
++	struct hif_rx_queue *rx_queue;
++	struct hif_tx_queue *tx_queue;
++	int err = 0;
++
++	pr_info("%s\n", __func__);
++
++	spin_lock_bh(&hif->tx_lock);
++
++	if (test_bit(client_id, &hif->shm->g_client_status[0])) {
++		pr_err("%s: client %d already registered\n",
++		       __func__, client_id);
++		err = -1;
++		goto unlock;
++	}
++
++	memset(client, 0, sizeof(struct hif_client));
++
++	/* Initialize client Rx queues baseaddr, size */
++
++	cnt = CLIENT_CTRL_RX_Q_CNT(client_shm->ctrl);
++	/* Check if client is requesting for more queues than supported */
++	if (cnt > HIF_CLIENT_QUEUES_MAX)
++		cnt = HIF_CLIENT_QUEUES_MAX;
++
++	client->rx_qn = cnt;
++	rx_qbase = (struct rx_queue_desc *)client_shm->rx_qbase;
++	for (i = 0; i < cnt; i++) {
++		rx_queue = &client->rx_q[i];
++		rx_queue->base = rx_qbase + i * client_shm->rx_qsize;
++		rx_queue->size = client_shm->rx_qsize;
++		rx_queue->write_idx = 0;
++	}
++
++	/* Initialize client Tx queues baseaddr, size */
++	cnt = CLIENT_CTRL_TX_Q_CNT(client_shm->ctrl);
++
++	/* Check if client is requesting for more queues than supported */
++	if (cnt > HIF_CLIENT_QUEUES_MAX)
++		cnt = HIF_CLIENT_QUEUES_MAX;
++
++	client->tx_qn = cnt;
++	tx_qbase = (struct tx_queue_desc *)client_shm->tx_qbase;
++	for (i = 0; i < cnt; i++) {
++		tx_queue = &client->tx_q[i];
++		tx_queue->base = tx_qbase + i * client_shm->tx_qsize;
++		tx_queue->size = client_shm->tx_qsize;
++		tx_queue->ack_idx = 0;
++	}
++
++	set_bit(client_id, &hif->shm->g_client_status[0]);
++
++unlock:
++	spin_unlock_bh(&hif->tx_lock);
++
++	return err;
++}
++
++/*
++ * pfe_hif_client_unregister
++ *
++ * This function used to unregister a client  from the HIF driver.
++ *
++ */
++static void pfe_hif_client_unregister(struct pfe_hif *hif, u32 client_id)
++{
++	pr_info("%s\n", __func__);
++
++	/*
++	 * Mark client as no longer available (which prevents further packet
++	 * receive for this client)
++	 */
++	spin_lock_bh(&hif->tx_lock);
++
++	if (!test_bit(client_id, &hif->shm->g_client_status[0])) {
++		pr_err("%s: client %d not registered\n", __func__,
++		       client_id);
++
++		spin_unlock_bh(&hif->tx_lock);
++		return;
++	}
++
++	clear_bit(client_id, &hif->shm->g_client_status[0]);
++
++	spin_unlock_bh(&hif->tx_lock);
++}
++
++/*
++ * client_put_rxpacket-
++ * This functions puts the Rx pkt  in the given client Rx queue.
++ * It actually swap the Rx pkt in the client Rx descriptor buffer
++ * and returns the free buffer from it.
++ *
++ * If the function returns NULL means client Rx queue is full and
++ * packet couldn't send to client queue.
++ */
++static void *client_put_rxpacket(struct hif_rx_queue *queue, void *pkt, u32 len,
++				 u32 flags, u32 client_ctrl, u32 *rem_len)
++{
++	void *free_pkt = NULL;
++	struct rx_queue_desc *desc = queue->base + queue->write_idx;
++
++	if (readl(&desc->ctrl) & CL_DESC_OWN) {
++		if (page_mode) {
++			int rem_page_size = PAGE_SIZE -
++					PRESENT_OFST_IN_PAGE(pkt);
++			int cur_pkt_size = ROUND_MIN_RX_SIZE(len +
++					pfe_pkt_headroom);
++			*rem_len = (rem_page_size - cur_pkt_size);
++			if (*rem_len) {
++				free_pkt = pkt + cur_pkt_size;
++				get_page(virt_to_page(free_pkt));
++			} else {
++				free_pkt = (void
++				*)__get_free_page(GFP_ATOMIC | GFP_DMA_PFE);
++				*rem_len = pfe_pkt_size;
++			}
++		} else {
++			free_pkt = kmalloc(PFE_BUF_SIZE, GFP_ATOMIC |
++					GFP_DMA_PFE);
++			*rem_len = PFE_BUF_SIZE - pfe_pkt_headroom;
++		}
++
++		if (free_pkt) {
++			desc->data = pkt;
++			desc->client_ctrl = client_ctrl;
++			/*
++			 * Ensure everything else is written to DDR before
++			 * writing bd->ctrl
++			 */
++			smp_wmb();
++			writel(CL_DESC_BUF_LEN(len) | flags, &desc->ctrl);
++			queue->write_idx = (queue->write_idx + 1)
++					    & (queue->size - 1);
++
++			free_pkt += pfe_pkt_headroom;
++		}
++	}
++
++	return free_pkt;
++}
++
++/*
++ * pfe_hif_rx_process-
++ * This function does pfe hif rx queue processing.
++ * Dequeue packet from Rx queue and send it to corresponding client queue
++ */
++static int pfe_hif_rx_process(struct pfe_hif *hif, int budget)
++{
++	struct hif_desc	*desc;
++	struct hif_hdr *pkt_hdr;
++	struct __hif_hdr hif_hdr;
++	void *free_buf;
++	int rtc, len, rx_processed = 0;
++	struct __hif_desc local_desc;
++	int flags;
++	unsigned int desc_p;
++	unsigned int buf_size = 0;
++
++	spin_lock_bh(&hif->lock);
++
++	rtc = hif->rxtoclean_index;
++
++	while (rx_processed < budget) {
++		desc = hif->rx_base + rtc;
++
++		__memcpy12(&local_desc, desc);
++
++		/* ACK pending Rx interrupt */
++		if (local_desc.ctrl & BD_CTRL_DESC_EN) {
++			writel(HIF_INT | HIF_RXPKT_INT, HIF_INT_SRC);
++
++			if (rx_processed == 0) {
++				if (napi_first_batch == 1) {
++					desc_p = hif->descr_baseaddr_p +
++					((unsigned long int)(desc) -
++					(unsigned long
++					int)hif->descr_baseaddr_v);
++					napi_first_batch = 0;
++				}
++			}
++
++			__memcpy12(&local_desc, desc);
++
++			if (local_desc.ctrl & BD_CTRL_DESC_EN)
++				break;
++		}
++
++		napi_first_batch = 0;
++
++#ifdef HIF_NAPI_STATS
++		hif->napi_counters[NAPI_DESC_COUNT]++;
++#endif
++		len = BD_BUF_LEN(local_desc.ctrl);
++		/*
++		 * dma_unmap_single(hif->dev, DDR_PFE_TO_PHYS(local_desc.data),
++		 * hif->rx_buf_len[rtc], DMA_FROM_DEVICE);
++		 */
++		dma_unmap_single(hif->dev, DDR_PFE_TO_PHYS(local_desc.data),
++				 hif->rx_buf_len[rtc], DMA_FROM_DEVICE);
++
++		pkt_hdr = (struct hif_hdr *)hif->rx_buf_addr[rtc];
++
++		/* Track last HIF header received */
++		if (!hif->started) {
++			hif->started = 1;
++
++			__memcpy8(&hif_hdr, pkt_hdr);
++
++			hif->qno = hif_hdr.hdr.q_num;
++			hif->client_id = hif_hdr.hdr.client_id;
++			hif->client_ctrl = (hif_hdr.hdr.client_ctrl1 << 16) |
++						hif_hdr.hdr.client_ctrl;
++			flags = CL_DESC_FIRST;
++
++		} else {
++			flags = 0;
++		}
++
++		if (local_desc.ctrl & BD_CTRL_LIFM)
++			flags |= CL_DESC_LAST;
++
++		/* Check for valid client id and still registered */
++		if ((hif->client_id >= HIF_CLIENTS_MAX) ||
++		    !(test_bit(hif->client_id,
++			&hif->shm->g_client_status[0]))) {
++			printk_ratelimited("%s: packet with invalid client id %d q_num %d\n",
++					   __func__,
++					   hif->client_id,
++					   hif->qno);
++
++			free_buf = pkt_hdr;
++
++			goto pkt_drop;
++		}
++
++		/* Check to valid queue number */
++		if (hif->client[hif->client_id].rx_qn <= hif->qno) {
++			pr_info("%s: packet with invalid queue: %d\n"
++				, __func__, hif->qno);
++			hif->qno = 0;
++		}
++
++		free_buf =
++		client_put_rxpacket(&hif->client[hif->client_id].rx_q[hif->qno],
++				    (void *)pkt_hdr, len, flags,
++			hif->client_ctrl, &buf_size);
++
++		hif_lib_indicate_client(hif->client_id, EVENT_RX_PKT_IND,
++					hif->qno);
++
++		if (unlikely(!free_buf)) {
++#ifdef HIF_NAPI_STATS
++			hif->napi_counters[NAPI_CLIENT_FULL_COUNT]++;
++#endif
++			/*
++			 * If we want to keep in polling mode to retry later,
++			 * we need to tell napi that we consumed
++			 * the full budget or we will hit a livelock scenario.
++			 * The core code keeps this napi instance
++			 * at the head of the list and none of the other
++			 * instances get to run
++			 */
++			rx_processed = budget;
++
++			if (flags & CL_DESC_FIRST)
++				hif->started = 0;
++
++			break;
++		}
++
++pkt_drop:
++		/*Fill free buffer in the descriptor */
++		hif->rx_buf_addr[rtc] = free_buf;
++		hif->rx_buf_len[rtc] = min(pfe_pkt_size, buf_size);
++		writel((DDR_PHYS_TO_PFE
++			((u32)dma_map_single(hif->dev,
++			free_buf, hif->rx_buf_len[rtc], DMA_FROM_DEVICE))),
++			&desc->data);
++		/*
++		 * Ensure everything else is written to DDR before
++		 * writing bd->ctrl
++		 */
++		wmb();
++		writel((BD_CTRL_PKT_INT_EN | BD_CTRL_LIFM | BD_CTRL_DIR |
++			BD_CTRL_DESC_EN | BD_BUF_LEN(hif->rx_buf_len[rtc])),
++			&desc->ctrl);
++
++		rtc = (rtc + 1) & (hif->rx_ring_size - 1);
++
++		if (local_desc.ctrl & BD_CTRL_LIFM) {
++			if (!(hif->client_ctrl & HIF_CTRL_RX_CONTINUED)) {
++				rx_processed++;
++
++#ifdef HIF_NAPI_STATS
++				hif->napi_counters[NAPI_PACKET_COUNT]++;
++#endif
++			}
++			hif->started = 0;
++		}
++	}
++
++	hif->rxtoclean_index = rtc;
++	spin_unlock_bh(&hif->lock);
++
++	/* we made some progress, re-start rx dma in case it stopped */
++	hif_rx_dma_start();
++
++	return rx_processed;
++}
++
++/*
++ * client_ack_txpacket-
++ * This function ack the Tx packet in the give client Tx queue by resetting
++ * ownership bit in the descriptor.
++ */
++static int client_ack_txpacket(struct pfe_hif *hif, unsigned int client_id,
++			       unsigned int q_no)
++{
++	struct hif_tx_queue *queue = &hif->client[client_id].tx_q[q_no];
++	struct tx_queue_desc *desc = queue->base + queue->ack_idx;
++
++	if (readl(&desc->ctrl) & CL_DESC_OWN) {
++		writel((readl(&desc->ctrl) & ~CL_DESC_OWN), &desc->ctrl);
++		queue->ack_idx = (queue->ack_idx + 1) & (queue->size - 1);
++
++		return 0;
++
++	} else {
++		/*This should not happen */
++		pr_err("%s: %d %d %d %d %d %p %d\n", __func__,
++		       hif->txtosend, hif->txtoclean, hif->txavail,
++			client_id, q_no, queue, queue->ack_idx);
++		WARN(1, "%s: doesn't own this descriptor", __func__);
++		return 1;
++	}
++}
++
++void __hif_tx_done_process(struct pfe_hif *hif, int count)
++{
++	struct hif_desc *desc;
++	struct hif_desc_sw *desc_sw;
++	int ttc, tx_avl;
++	int pkts_done[HIF_CLIENTS_MAX] = {0, 0};
++
++	ttc = hif->txtoclean;
++	tx_avl = hif->txavail;
++
++	while ((tx_avl < hif->tx_ring_size) && count--) {
++		desc = hif->tx_base + ttc;
++
++		if (readl(&desc->ctrl) & BD_CTRL_DESC_EN)
++			break;
++
++		desc_sw = &hif->tx_sw_queue[ttc];
++
++		if (desc_sw->data) {
++			/*
++			 * dmap_unmap_single(hif->dev, desc_sw->data,
++			 * desc_sw->len, DMA_TO_DEVICE);
++			 */
++			dma_unmap_single(hif->dev, desc_sw->data,
++					 desc_sw->len, DMA_TO_DEVICE);
++		}
++
++		if (desc_sw->client_id >= HIF_CLIENTS_MAX) {
++			pr_err("Invalid cl id %d\n", desc_sw->client_id);
++			break;
++		}
++
++		pkts_done[desc_sw->client_id]++;
++
++		client_ack_txpacket(hif, desc_sw->client_id, desc_sw->q_no);
++
++		ttc = (ttc + 1) & (hif->tx_ring_size - 1);
++		tx_avl++;
++	}
++
++	if (pkts_done[0])
++		hif_lib_indicate_client(0, EVENT_TXDONE_IND, 0);
++	if (pkts_done[1])
++		hif_lib_indicate_client(1, EVENT_TXDONE_IND, 0);
++
++	hif->txtoclean = ttc;
++	hif->txavail = tx_avl;
++
++	if (!count) {
++		tasklet_schedule(&hif->tx_cleanup_tasklet);
++	} else {
++		/*Enable Tx done interrupt */
++		writel(readl_relaxed(HIF_INT_ENABLE) | HIF_TXPKT_INT,
++		       HIF_INT_ENABLE);
++	}
++}
++
++static void pfe_tx_do_cleanup(unsigned long data)
++{
++	struct pfe_hif *hif = (struct pfe_hif *)data;
++
++	writel(HIF_INT | HIF_TXPKT_INT, HIF_INT_SRC);
++
++	hif_tx_done_process(hif, 64);
++}
++
++/*
++ * __hif_xmit_pkt -
++ * This function puts one packet in the HIF Tx queue
++ */
++void __hif_xmit_pkt(struct pfe_hif *hif, unsigned int client_id, unsigned int
++			q_no, void *data, u32 len, unsigned int flags)
++{
++	struct hif_desc	*desc;
++	struct hif_desc_sw *desc_sw;
++
++	desc = hif->tx_base + hif->txtosend;
++	desc_sw = &hif->tx_sw_queue[hif->txtosend];
++
++	desc_sw->len = len;
++	desc_sw->client_id = client_id;
++	desc_sw->q_no = q_no;
++	desc_sw->flags = flags;
++
++	if (flags & HIF_DONT_DMA_MAP) {
++		desc_sw->data = 0;
++		writel((u32)DDR_PHYS_TO_PFE(data), &desc->data);
++	} else {
++		desc_sw->data = dma_map_single(hif->dev, data, len,
++						DMA_TO_DEVICE);
++		writel((u32)DDR_PHYS_TO_PFE(desc_sw->data), &desc->data);
++	}
++
++	hif->txtosend = (hif->txtosend + 1) & (hif->tx_ring_size - 1);
++	hif->txavail--;
++
++	if ((!((flags & HIF_DATA_VALID) && (flags &
++				HIF_LAST_BUFFER))))
++		goto skip_tx;
++
++	/*
++	 * Ensure everything else is written to DDR before
++	 * writing bd->ctrl
++	 */
++	wmb();
++
++	do {
++		desc_sw = &hif->tx_sw_queue[hif->txtoflush];
++		desc = hif->tx_base + hif->txtoflush;
++
++		if (desc_sw->flags & HIF_LAST_BUFFER) {
++			writel((BD_CTRL_LIFM |
++			       BD_CTRL_BRFETCH_DISABLE | BD_CTRL_RTFETCH_DISABLE
++			       | BD_CTRL_PARSE_DISABLE | BD_CTRL_DESC_EN |
++				BD_CTRL_PKT_INT_EN | BD_BUF_LEN(desc_sw->len)),
++				&desc->ctrl);
++		} else {
++			writel((BD_CTRL_DESC_EN |
++				BD_BUF_LEN(desc_sw->len)), &desc->ctrl);
++		}
++		hif->txtoflush = (hif->txtoflush + 1) & (hif->tx_ring_size - 1);
++	}
++	while (hif->txtoflush != hif->txtosend)
++		;
++
++skip_tx:
++	return;
++}
++
++static irqreturn_t wol_isr(int irq, void *dev_id)
++{
++	pr_info("WoL\n");
++	gemac_set_wol(EMAC1_BASE_ADDR, 0);
++	gemac_set_wol(EMAC2_BASE_ADDR, 0);
++	return IRQ_HANDLED;
++}
++
++/*
++ * hif_isr-
++ * This ISR routine processes Rx/Tx done interrupts from the HIF hardware block
++ */
++static irqreturn_t hif_isr(int irq, void *dev_id)
++{
++	struct pfe_hif *hif = (struct pfe_hif *)dev_id;
++	int int_status;
++	int int_enable_mask;
++
++	/*Read hif interrupt source register */
++	int_status = readl_relaxed(HIF_INT_SRC);
++	int_enable_mask = readl_relaxed(HIF_INT_ENABLE);
++
++	if ((int_status & HIF_INT) == 0)
++		return IRQ_NONE;
++
++	int_status &= ~(HIF_INT);
++
++	if (int_status & HIF_RXPKT_INT) {
++		int_status &= ~(HIF_RXPKT_INT);
++		int_enable_mask &= ~(HIF_RXPKT_INT);
++
++		napi_first_batch = 1;
++
++		if (napi_schedule_prep(&hif->napi)) {
++#ifdef HIF_NAPI_STATS
++			hif->napi_counters[NAPI_SCHED_COUNT]++;
++#endif
++			__napi_schedule(&hif->napi);
++		}
++	}
++
++	if (int_status & HIF_TXPKT_INT) {
++		int_status &= ~(HIF_TXPKT_INT);
++		int_enable_mask &= ~(HIF_TXPKT_INT);
++		/*Schedule tx cleanup tassklet */
++		tasklet_schedule(&hif->tx_cleanup_tasklet);
++	}
++
++	/*Disable interrupts, they will be enabled after they are serviced */
++	writel_relaxed(int_enable_mask, HIF_INT_ENABLE);
++
++	if (int_status) {
++		pr_info("%s : Invalid interrupt : %d\n", __func__,
++			int_status);
++		writel(int_status, HIF_INT_SRC);
++	}
++
++	return IRQ_HANDLED;
++}
++
++void hif_process_client_req(struct pfe_hif *hif, int req, int data1, int data2)
++{
++	unsigned int client_id = data1;
++
++	if (client_id >= HIF_CLIENTS_MAX) {
++		pr_err("%s: client id %d out of bounds\n", __func__,
++		       client_id);
++		return;
++	}
++
++	switch (req) {
++	case REQUEST_CL_REGISTER:
++			/* Request for register a client */
++			pr_info("%s: register client_id %d\n",
++				__func__, client_id);
++			pfe_hif_client_register(hif, client_id, (struct
++				hif_client_shm *)&hif->shm->client[client_id]);
++			break;
++
++	case REQUEST_CL_UNREGISTER:
++			pr_info("%s: unregister client_id %d\n",
++				__func__, client_id);
++
++			/* Request for unregister a client */
++			pfe_hif_client_unregister(hif, client_id);
++
++			break;
++
++	default:
++			pr_err("%s: unsupported request %d\n",
++			       __func__, req);
++			break;
++	}
++
++	/*
++	 * Process client Tx queues
++	 * Currently we don't have checking for tx pending
++	 */
++}
++
++/*
++ * pfe_hif_rx_poll
++ *  This function is NAPI poll function to process HIF Rx queue.
++ */
++static int pfe_hif_rx_poll(struct napi_struct *napi, int budget)
++{
++	struct pfe_hif *hif = container_of(napi, struct pfe_hif, napi);
++	int work_done;
++
++#ifdef HIF_NAPI_STATS
++	hif->napi_counters[NAPI_POLL_COUNT]++;
++#endif
++
++	work_done = pfe_hif_rx_process(hif, budget);
++
++	if (work_done < budget) {
++		napi_complete(napi);
++		writel(readl_relaxed(HIF_INT_ENABLE) | HIF_RXPKT_INT,
++		       HIF_INT_ENABLE);
++	}
++#ifdef HIF_NAPI_STATS
++	else
++		hif->napi_counters[NAPI_FULL_BUDGET_COUNT]++;
++#endif
++
++	return work_done;
++}
++
++/*
++ * pfe_hif_init
++ * This function initializes the baseaddresses and irq, etc.
++ */
++int pfe_hif_init(struct pfe *pfe)
++{
++	struct pfe_hif *hif = &pfe->hif;
++	int err;
++
++	pr_info("%s\n", __func__);
++
++	hif->dev = pfe->dev;
++	hif->irq = pfe->hif_irq;
++
++	err = pfe_hif_alloc_descr(hif);
++	if (err)
++		goto err0;
++
++	if (pfe_hif_init_buffers(hif)) {
++		pr_err("%s: Could not initialize buffer descriptors\n"
++			, __func__);
++		err = -ENOMEM;
++		goto err1;
++	}
++
++	/* Initialize NAPI for Rx processing */
++	init_dummy_netdev(&hif->dummy_dev);
++	netif_napi_add(&hif->dummy_dev, &hif->napi, pfe_hif_rx_poll,
++		       HIF_RX_POLL_WEIGHT);
++	napi_enable(&hif->napi);
++
++	spin_lock_init(&hif->tx_lock);
++	spin_lock_init(&hif->lock);
++
++	hif_init();
++	hif_rx_enable();
++	hif_tx_enable();
++
++	/* Disable tx done interrupt */
++	writel(HIF_INT_MASK, HIF_INT_ENABLE);
++
++	gpi_enable(HGPI_BASE_ADDR);
++
++	err = request_irq(hif->irq, hif_isr, 0, "pfe_hif", hif);
++	if (err) {
++		pr_err("%s: failed to get the hif IRQ = %d\n",
++		       __func__, hif->irq);
++		goto err1;
++	}
++
++	err = request_irq(pfe->wol_irq, wol_isr, 0, "pfe_wol", pfe);
++	if (err) {
++		pr_err("%s: failed to get the wol IRQ = %d\n",
++		       __func__, pfe->wol_irq);
++		goto err1;
++	}
++
++	tasklet_init(&hif->tx_cleanup_tasklet,
++		     (void(*)(unsigned long))pfe_tx_do_cleanup,
++		     (unsigned long)hif);
++
++	return 0;
++err1:
++	pfe_hif_free_descr(hif);
++err0:
++	return err;
++}
++
++/* pfe_hif_exit- */
++void pfe_hif_exit(struct pfe *pfe)
++{
++	struct pfe_hif *hif = &pfe->hif;
++
++	pr_info("%s\n", __func__);
++
++	tasklet_kill(&hif->tx_cleanup_tasklet);
++
++	spin_lock_bh(&hif->lock);
++	hif->shm->g_client_status[0] = 0;
++	/* Make sure all clients are disabled*/
++	hif->shm->g_client_status[1] = 0;
++
++	spin_unlock_bh(&hif->lock);
++
++	/*Disable Rx/Tx */
++	gpi_disable(HGPI_BASE_ADDR);
++	hif_rx_disable();
++	hif_tx_disable();
++
++	napi_disable(&hif->napi);
++	netif_napi_del(&hif->napi);
++
++	free_irq(pfe->wol_irq, pfe);
++	free_irq(hif->irq, hif);
++
++	pfe_hif_release_buffers(hif);
++	pfe_hif_free_descr(hif);
++}
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_hif.h
+@@ -0,0 +1,199 @@
++/* SPDX-License-Identifier: GPL-2.0+ */
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ */
++
++#ifndef _PFE_HIF_H_
++#define _PFE_HIF_H_
++
++#include <linux/netdevice.h>
++
++#define HIF_NAPI_STATS
++
++#define HIF_CLIENT_QUEUES_MAX	16
++#define HIF_RX_POLL_WEIGHT	64
++
++#define HIF_RX_PKT_MIN_SIZE 0x800 /* 2KB */
++#define HIF_RX_PKT_MIN_SIZE_MASK ~(HIF_RX_PKT_MIN_SIZE - 1)
++#define ROUND_MIN_RX_SIZE(_sz) (((_sz) + (HIF_RX_PKT_MIN_SIZE - 1)) \
++					& HIF_RX_PKT_MIN_SIZE_MASK)
++#define PRESENT_OFST_IN_PAGE(_buf) (((unsigned long int)(_buf) & (PAGE_SIZE \
++					- 1)) & HIF_RX_PKT_MIN_SIZE_MASK)
++
++enum {
++	NAPI_SCHED_COUNT = 0,
++	NAPI_POLL_COUNT,
++	NAPI_PACKET_COUNT,
++	NAPI_DESC_COUNT,
++	NAPI_FULL_BUDGET_COUNT,
++	NAPI_CLIENT_FULL_COUNT,
++	NAPI_MAX_COUNT
++};
++
++/*
++ * HIF_TX_DESC_NT value should be always greter than 4,
++ * Otherwise HIF_TX_POLL_MARK will become zero.
++ */
++#define HIF_RX_DESC_NT		256
++#define HIF_TX_DESC_NT		2048
++
++#define HIF_FIRST_BUFFER	BIT(0)
++#define HIF_LAST_BUFFER		BIT(1)
++#define HIF_DONT_DMA_MAP	BIT(2)
++#define HIF_DATA_VALID		BIT(3)
++#define HIF_TSO			BIT(4)
++
++enum {
++	PFE_CL_GEM0 = 0,
++	PFE_CL_GEM1,
++	HIF_CLIENTS_MAX
++};
++
++/*structure to store client queue info */
++struct hif_rx_queue {
++	struct rx_queue_desc *base;
++	u32	size;
++	u32	write_idx;
++};
++
++struct hif_tx_queue {
++	struct tx_queue_desc *base;
++	u32	size;
++	u32	ack_idx;
++};
++
++/*Structure to store the client info */
++struct hif_client {
++	int	rx_qn;
++	struct hif_rx_queue	rx_q[HIF_CLIENT_QUEUES_MAX];
++	int	tx_qn;
++	struct hif_tx_queue	tx_q[HIF_CLIENT_QUEUES_MAX];
++};
++
++/*HIF hardware buffer descriptor */
++struct hif_desc {
++	u32 ctrl;
++	u32 status;
++	u32 data;
++	u32 next;
++};
++
++struct __hif_desc {
++	u32 ctrl;
++	u32 status;
++	u32 data;
++};
++
++struct hif_desc_sw {
++	dma_addr_t data;
++	u16 len;
++	u8 client_id;
++	u8 q_no;
++	u16 flags;
++};
++
++struct hif_hdr {
++	u8 client_id;
++	u8 q_num;
++	u16 client_ctrl;
++	u16 client_ctrl1;
++};
++
++struct __hif_hdr {
++	union {
++		struct hif_hdr hdr;
++		u32 word[2];
++	};
++};
++
++struct hif_ipsec_hdr {
++	u16	sa_handle[2];
++} __packed;
++
++/*  HIF_CTRL_TX... defines */
++#define HIF_CTRL_TX_CHECKSUM		BIT(2)
++
++/*  HIF_CTRL_RX... defines */
++#define HIF_CTRL_RX_OFFSET_OFST         (24)
++#define HIF_CTRL_RX_CHECKSUMMED		BIT(2)
++#define HIF_CTRL_RX_CONTINUED		BIT(1)
++
++struct pfe_hif {
++	/* To store registered clients in hif layer */
++	struct hif_client client[HIF_CLIENTS_MAX];
++	struct hif_shm *shm;
++	int	irq;
++
++	void	*descr_baseaddr_v;
++	unsigned long	descr_baseaddr_p;
++
++	struct hif_desc *rx_base;
++	u32	rx_ring_size;
++	u32	rxtoclean_index;
++	void	*rx_buf_addr[HIF_RX_DESC_NT];
++	int	rx_buf_len[HIF_RX_DESC_NT];
++	unsigned int qno;
++	unsigned int client_id;
++	unsigned int client_ctrl;
++	unsigned int started;
++
++	struct hif_desc *tx_base;
++	u32	tx_ring_size;
++	u32	txtosend;
++	u32	txtoclean;
++	u32	txavail;
++	u32	txtoflush;
++	struct hif_desc_sw tx_sw_queue[HIF_TX_DESC_NT];
++
++/* tx_lock synchronizes hif packet tx as well as pfe_hif structure access */
++	spinlock_t tx_lock;
++/* lock synchronizes hif rx queue processing */
++	spinlock_t lock;
++	struct net_device	dummy_dev;
++	struct napi_struct	napi;
++	struct device *dev;
++
++#ifdef HIF_NAPI_STATS
++	unsigned int napi_counters[NAPI_MAX_COUNT];
++#endif
++	struct tasklet_struct	tx_cleanup_tasklet;
++};
++
++void __hif_xmit_pkt(struct pfe_hif *hif, unsigned int client_id, unsigned int
++			q_no, void *data, u32 len, unsigned int flags);
++int hif_xmit_pkt(struct pfe_hif *hif, unsigned int client_id, unsigned int q_no,
++		 void *data, unsigned int len);
++void __hif_tx_done_process(struct pfe_hif *hif, int count);
++void hif_process_client_req(struct pfe_hif *hif, int req, int data1, int
++				data2);
++int pfe_hif_init(struct pfe *pfe);
++void pfe_hif_exit(struct pfe *pfe);
++void pfe_hif_rx_idle(struct pfe_hif *hif);
++static inline void hif_tx_done_process(struct pfe_hif *hif, int count)
++{
++	spin_lock_bh(&hif->tx_lock);
++	__hif_tx_done_process(hif, count);
++	spin_unlock_bh(&hif->tx_lock);
++}
++
++static inline void hif_tx_lock(struct pfe_hif *hif)
++{
++	spin_lock_bh(&hif->tx_lock);
++}
++
++static inline void hif_tx_unlock(struct pfe_hif *hif)
++{
++	spin_unlock_bh(&hif->tx_lock);
++}
++
++static inline int __hif_tx_avail(struct pfe_hif *hif)
++{
++	return hif->txavail;
++}
++
++#define __memcpy8(dst, src)		memcpy(dst, src, 8)
++#define __memcpy12(dst, src)		memcpy(dst, src, 12)
++#define __memcpy(dst, src, len)		memcpy(dst, src, len)
++
++#endif /* _PFE_HIF_H_ */
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_hif_lib.c
+@@ -0,0 +1,628 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ */
++
++#include <linux/version.h>
++#include <linux/kernel.h>
++#include <linux/slab.h>
++#include <linux/interrupt.h>
++#include <linux/workqueue.h>
++#include <linux/dma-mapping.h>
++#include <linux/dmapool.h>
++#include <linux/sched.h>
++#include <linux/skbuff.h>
++#include <linux/moduleparam.h>
++#include <linux/cpu.h>
++
++#include "pfe_mod.h"
++#include "pfe_hif.h"
++#include "pfe_hif_lib.h"
++
++unsigned int lro_mode;
++unsigned int page_mode;
++unsigned int tx_qos = 1;
++module_param(tx_qos, uint, 0444);
++MODULE_PARM_DESC(tx_qos, "0: disable ,\n"
++			 "1: enable (default), guarantee no packet drop at TMU level\n");
++unsigned int pfe_pkt_size;
++unsigned int pfe_pkt_headroom;
++unsigned int emac_txq_cnt;
++
++/*
++ * @pfe_hal_lib.c.
++ * Common functions used by HIF client drivers
++ */
++
++/*HIF shared memory Global variable */
++struct hif_shm ghif_shm;
++
++/* Cleanup the HIF shared memory, release HIF rx_buffer_pool.
++ * This function should be called after pfe_hif_exit
++ *
++ * @param[in] hif_shm		Shared memory address location in DDR
++ */
++static void pfe_hif_shm_clean(struct hif_shm *hif_shm)
++{
++	int i;
++	void *pkt;
++
++	for (i = 0; i < hif_shm->rx_buf_pool_cnt; i++) {
++		pkt = hif_shm->rx_buf_pool[i];
++		if (pkt) {
++			hif_shm->rx_buf_pool[i] = NULL;
++			pkt -= pfe_pkt_headroom;
++
++			if (page_mode)
++				put_page(virt_to_page(pkt));
++			else
++				kfree(pkt);
++		}
++	}
++}
++
++/* Initialize shared memory used between HIF driver and clients,
++ * allocate rx_buffer_pool required for HIF Rx descriptors.
++ * This function should be called before initializing HIF driver.
++ *
++ * @param[in] hif_shm		Shared memory address location in DDR
++ * @rerurn			0 - on succes, <0 on fail to initialize
++ */
++static int pfe_hif_shm_init(struct hif_shm *hif_shm)
++{
++	int i;
++	void *pkt;
++
++	memset(hif_shm, 0, sizeof(struct hif_shm));
++	hif_shm->rx_buf_pool_cnt = HIF_RX_DESC_NT;
++
++	for (i = 0; i < hif_shm->rx_buf_pool_cnt; i++) {
++		if (page_mode) {
++			pkt = (void *)__get_free_page(GFP_KERNEL |
++				GFP_DMA_PFE);
++		} else {
++			pkt = kmalloc(PFE_BUF_SIZE, GFP_KERNEL | GFP_DMA_PFE);
++		}
++
++		if (pkt)
++			hif_shm->rx_buf_pool[i] = pkt + pfe_pkt_headroom;
++		else
++			goto err0;
++	}
++
++	return 0;
++
++err0:
++	pr_err("%s Low memory\n", __func__);
++	pfe_hif_shm_clean(hif_shm);
++	return -ENOMEM;
++}
++
++/*This function sends indication to HIF driver
++ *
++ * @param[in] hif	hif context
++ */
++static void hif_lib_indicate_hif(struct pfe_hif *hif, int req, int data1, int
++					data2)
++{
++	hif_process_client_req(hif, req, data1, data2);
++}
++
++void hif_lib_indicate_client(int client_id, int event_type, int qno)
++{
++	struct hif_client_s *client = pfe->hif_client[client_id];
++
++	if (!client || (event_type >= HIF_EVENT_MAX) || (qno >=
++		HIF_CLIENT_QUEUES_MAX))
++		return;
++
++	if (!test_and_set_bit(qno, &client->queue_mask[event_type]))
++		client->event_handler(client->priv, event_type, qno);
++}
++
++/*This function releases Rx queue descriptors memory and pre-filled buffers
++ *
++ * @param[in] client	hif_client context
++ */
++static void hif_lib_client_release_rx_buffers(struct hif_client_s *client)
++{
++	struct rx_queue_desc *desc;
++	int qno, ii;
++	void *buf;
++
++	for (qno = 0; qno < client->rx_qn; qno++) {
++		desc = client->rx_q[qno].base;
++
++		for (ii = 0; ii < client->rx_q[qno].size; ii++) {
++			buf = (void *)desc->data;
++			if (buf) {
++				buf -= pfe_pkt_headroom;
++
++				if (page_mode)
++					free_page((unsigned long)buf);
++				else
++					kfree(buf);
++
++				desc->ctrl = 0;
++			}
++
++			desc++;
++		}
++	}
++
++	kfree(client->rx_qbase);
++}
++
++/*This function allocates memory for the rxq descriptors and pre-fill rx queues
++ * with buffers.
++ * @param[in] client	client context
++ * @param[in] q_size	size of the rxQ, all queues are of same size
++ */
++static int hif_lib_client_init_rx_buffers(struct hif_client_s *client, int
++						q_size)
++{
++	struct rx_queue_desc *desc;
++	struct hif_client_rx_queue *queue;
++	int ii, qno;
++
++	/*Allocate memory for the client queues */
++	client->rx_qbase = kzalloc(client->rx_qn * q_size * sizeof(struct
++				rx_queue_desc), GFP_KERNEL);
++	if (!client->rx_qbase)
++		goto err;
++
++	for (qno = 0; qno < client->rx_qn; qno++) {
++		queue = &client->rx_q[qno];
++
++		queue->base = client->rx_qbase + qno * q_size * sizeof(struct
++				rx_queue_desc);
++		queue->size = q_size;
++		queue->read_idx = 0;
++		queue->write_idx = 0;
++
++		pr_debug("rx queue: %d, base: %p, size: %d\n", qno,
++			 queue->base, queue->size);
++	}
++
++	for (qno = 0; qno < client->rx_qn; qno++) {
++		queue = &client->rx_q[qno];
++		desc = queue->base;
++
++		for (ii = 0; ii < queue->size; ii++) {
++			desc->ctrl = CL_DESC_BUF_LEN(pfe_pkt_size) |
++					CL_DESC_OWN;
++			desc++;
++		}
++	}
++
++	return 0;
++
++err:
++	return 1;
++}
++
++
++static void hif_lib_client_cleanup_tx_queue(struct hif_client_tx_queue *queue)
++{
++	pr_debug("%s\n", __func__);
++
++	/*
++	 * Check if there are any pending packets. Client must flush the tx
++	 * queues before unregistering, by calling by calling
++	 * hif_lib_tx_get_next_complete()
++	 *
++	 * Hif no longer calls since we are no longer registered
++	 */
++	if (queue->tx_pending)
++		pr_err("%s: pending transmit packets\n", __func__);
++}
++
++static void hif_lib_client_release_tx_buffers(struct hif_client_s *client)
++{
++	int qno;
++
++	pr_debug("%s\n", __func__);
++
++	for (qno = 0; qno < client->tx_qn; qno++)
++		hif_lib_client_cleanup_tx_queue(&client->tx_q[qno]);
++
++	kfree(client->tx_qbase);
++}
++
++static int hif_lib_client_init_tx_buffers(struct hif_client_s *client, int
++						q_size)
++{
++	struct hif_client_tx_queue *queue;
++	int qno;
++
++	client->tx_qbase = kzalloc(client->tx_qn * q_size * sizeof(struct
++					tx_queue_desc), GFP_KERNEL);
++	if (!client->tx_qbase)
++		return 1;
++
++	for (qno = 0; qno < client->tx_qn; qno++) {
++		queue = &client->tx_q[qno];
++
++		queue->base = client->tx_qbase + qno * q_size * sizeof(struct
++				tx_queue_desc);
++		queue->size = q_size;
++		queue->read_idx = 0;
++		queue->write_idx = 0;
++		queue->tx_pending = 0;
++		queue->nocpy_flag = 0;
++		queue->prev_tmu_tx_pkts = 0;
++		queue->done_tmu_tx_pkts = 0;
++
++		pr_debug("tx queue: %d, base: %p, size: %d\n", qno,
++			 queue->base, queue->size);
++	}
++
++	return 0;
++}
++
++static int hif_lib_event_dummy(void *priv, int event_type, int qno)
++{
++	return 0;
++}
++
++int hif_lib_client_register(struct hif_client_s *client)
++{
++	struct hif_shm *hif_shm;
++	struct hif_client_shm *client_shm;
++	int err, i;
++	/* int loop_cnt = 0; */
++
++	pr_debug("%s\n", __func__);
++
++	/*Allocate memory before spin_lock*/
++	if (hif_lib_client_init_rx_buffers(client, client->rx_qsize)) {
++		err = -ENOMEM;
++		goto err_rx;
++	}
++
++	if (hif_lib_client_init_tx_buffers(client, client->tx_qsize)) {
++		err = -ENOMEM;
++		goto err_tx;
++	}
++
++	spin_lock_bh(&pfe->hif.lock);
++	if (!(client->pfe) || (client->id >= HIF_CLIENTS_MAX) ||
++	    (pfe->hif_client[client->id])) {
++		err = -EINVAL;
++		goto err;
++	}
++
++	hif_shm = client->pfe->hif.shm;
++
++	if (!client->event_handler)
++		client->event_handler = hif_lib_event_dummy;
++
++	/*Initialize client specific shared memory */
++	client_shm = (struct hif_client_shm *)&hif_shm->client[client->id];
++	client_shm->rx_qbase = (unsigned long int)client->rx_qbase;
++	client_shm->rx_qsize = client->rx_qsize;
++	client_shm->tx_qbase = (unsigned long int)client->tx_qbase;
++	client_shm->tx_qsize = client->tx_qsize;
++	client_shm->ctrl = (client->tx_qn << CLIENT_CTRL_TX_Q_CNT_OFST) |
++				(client->rx_qn << CLIENT_CTRL_RX_Q_CNT_OFST);
++	/* spin_lock_init(&client->rx_lock); */
++
++	for (i = 0; i < HIF_EVENT_MAX; i++) {
++		client->queue_mask[i] = 0;  /*
++					     * By default all events are
++					     * unmasked
++					     */
++	}
++
++	/*Indicate to HIF driver*/
++	hif_lib_indicate_hif(&pfe->hif, REQUEST_CL_REGISTER, client->id, 0);
++
++	pr_debug("%s: client: %p, client_id: %d, tx_qsize: %d, rx_qsize: %d\n",
++		 __func__, client, client->id, client->tx_qsize,
++		 client->rx_qsize);
++
++	client->cpu_id = -1;
++
++	pfe->hif_client[client->id] = client;
++	spin_unlock_bh(&pfe->hif.lock);
++
++	return 0;
++
++err:
++	spin_unlock_bh(&pfe->hif.lock);
++	hif_lib_client_release_tx_buffers(client);
++
++err_tx:
++	hif_lib_client_release_rx_buffers(client);
++
++err_rx:
++	return err;
++}
++
++int hif_lib_client_unregister(struct hif_client_s *client)
++{
++	struct pfe *pfe = client->pfe;
++	u32 client_id = client->id;
++
++	pr_info(
++		"%s : client: %p, client_id: %d, txQ_depth: %d, rxQ_depth: %d\n"
++		, __func__, client, client->id, client->tx_qsize,
++		client->rx_qsize);
++
++	spin_lock_bh(&pfe->hif.lock);
++	hif_lib_indicate_hif(&pfe->hif, REQUEST_CL_UNREGISTER, client->id, 0);
++
++	hif_lib_client_release_tx_buffers(client);
++	hif_lib_client_release_rx_buffers(client);
++	pfe->hif_client[client_id] = NULL;
++	spin_unlock_bh(&pfe->hif.lock);
++
++	return 0;
++}
++
++int hif_lib_event_handler_start(struct hif_client_s *client, int event,
++				int qno)
++{
++	struct hif_client_rx_queue *queue = &client->rx_q[qno];
++	struct rx_queue_desc *desc = queue->base + queue->read_idx;
++
++	if ((event >= HIF_EVENT_MAX) || (qno >= HIF_CLIENT_QUEUES_MAX)) {
++		pr_debug("%s: Unsupported event : %d  queue number : %d\n",
++			 __func__, event, qno);
++		return -1;
++	}
++
++	test_and_clear_bit(qno, &client->queue_mask[event]);
++
++	switch (event) {
++	case EVENT_RX_PKT_IND:
++		if (!(desc->ctrl & CL_DESC_OWN))
++			hif_lib_indicate_client(client->id,
++						EVENT_RX_PKT_IND, qno);
++		break;
++
++	case EVENT_HIGH_RX_WM:
++	case EVENT_TXDONE_IND:
++	default:
++		break;
++	}
++
++	return 0;
++}
++
++/*
++ * This function gets one packet from the specified client queue
++ * It also refill the rx buffer
++ */
++void *hif_lib_receive_pkt(struct hif_client_s *client, int qno, int *len, int
++				*ofst, unsigned int *rx_ctrl,
++				unsigned int *desc_ctrl, void **priv_data)
++{
++	struct hif_client_rx_queue *queue = &client->rx_q[qno];
++	struct rx_queue_desc *desc;
++	void *pkt = NULL;
++
++	/*
++	 * Following lock is to protect rx queue access from,
++	 * hif_lib_event_handler_start.
++	 * In general below lock is not required, because hif_lib_xmit_pkt and
++	 * hif_lib_event_handler_start are called from napi poll and which is
++	 * not re-entrant. But if some client use in different way this lock is
++	 * required.
++	 */
++	/*spin_lock_irqsave(&client->rx_lock, flags); */
++	desc = queue->base + queue->read_idx;
++	if (!(desc->ctrl & CL_DESC_OWN)) {
++		pkt = desc->data - pfe_pkt_headroom;
++
++		*rx_ctrl = desc->client_ctrl;
++		*desc_ctrl = desc->ctrl;
++
++		if (desc->ctrl & CL_DESC_FIRST) {
++			u16 size = *rx_ctrl >> HIF_CTRL_RX_OFFSET_OFST;
++
++			if (size) {
++				size += PFE_PARSE_INFO_SIZE;
++				*len = CL_DESC_BUF_LEN(desc->ctrl) -
++						PFE_PKT_HEADER_SZ - size;
++				*ofst = pfe_pkt_headroom + PFE_PKT_HEADER_SZ
++								+ size;
++				*priv_data = desc->data + PFE_PKT_HEADER_SZ;
++			} else {
++				*len = CL_DESC_BUF_LEN(desc->ctrl) -
++				       PFE_PKT_HEADER_SZ - PFE_PARSE_INFO_SIZE;
++				*ofst = pfe_pkt_headroom
++					+ PFE_PKT_HEADER_SZ
++					+ PFE_PARSE_INFO_SIZE;
++				*priv_data = NULL;
++			}
++
++		} else {
++			*len = CL_DESC_BUF_LEN(desc->ctrl);
++			*ofst = pfe_pkt_headroom;
++		}
++
++		/*
++		 * Needed so we don't free a buffer/page
++		 * twice on module_exit
++		 */
++		desc->data = NULL;
++
++		/*
++		 * Ensure everything else is written to DDR before
++		 * writing bd->ctrl
++		 */
++		smp_wmb();
++
++		desc->ctrl = CL_DESC_BUF_LEN(pfe_pkt_size) | CL_DESC_OWN;
++		queue->read_idx = (queue->read_idx + 1) & (queue->size - 1);
++	}
++
++	/*spin_unlock_irqrestore(&client->rx_lock, flags); */
++	return pkt;
++}
++
++static inline void hif_hdr_write(struct hif_hdr *pkt_hdr, unsigned int
++					client_id, unsigned int qno,
++					u32 client_ctrl)
++{
++	/* Optimize the write since the destinaton may be non-cacheable */
++	if (!((unsigned long)pkt_hdr & 0x3)) {
++		((u32 *)pkt_hdr)[0] = (client_ctrl << 16) | (qno << 8) |
++					client_id;
++	} else {
++		((u16 *)pkt_hdr)[0] = (qno << 8) | (client_id & 0xFF);
++		((u16 *)pkt_hdr)[1] = (client_ctrl & 0xFFFF);
++	}
++}
++
++/*This function puts the given packet in the specific client queue */
++void __hif_lib_xmit_pkt(struct hif_client_s *client, unsigned int qno, void
++				*data, unsigned int len, u32 client_ctrl,
++				unsigned int flags, void *client_data)
++{
++	struct hif_client_tx_queue *queue = &client->tx_q[qno];
++	struct tx_queue_desc *desc = queue->base + queue->write_idx;
++
++	/* First buffer */
++	if (flags & HIF_FIRST_BUFFER) {
++		data -= sizeof(struct hif_hdr);
++		len += sizeof(struct hif_hdr);
++
++		hif_hdr_write(data, client->id, qno, client_ctrl);
++	}
++
++	desc->data = client_data;
++	desc->ctrl = CL_DESC_OWN | CL_DESC_FLAGS(flags);
++
++	__hif_xmit_pkt(&pfe->hif, client->id, qno, data, len, flags);
++
++	queue->write_idx = (queue->write_idx + 1) & (queue->size - 1);
++	queue->tx_pending++;
++	queue->jiffies_last_packet = jiffies;
++}
++
++void *hif_lib_tx_get_next_complete(struct hif_client_s *client, int qno,
++				   unsigned int *flags, int count)
++{
++	struct hif_client_tx_queue *queue = &client->tx_q[qno];
++	struct tx_queue_desc *desc = queue->base + queue->read_idx;
++
++	pr_debug("%s: qno : %d rd_indx: %d pending:%d\n", __func__, qno,
++		 queue->read_idx, queue->tx_pending);
++
++	if (!queue->tx_pending)
++		return NULL;
++
++	if (queue->nocpy_flag && !queue->done_tmu_tx_pkts) {
++		u32 tmu_tx_pkts = be32_to_cpu(pe_dmem_read(TMU0_ID +
++			client->id, TMU_DM_TX_TRANS, 4));
++
++		if (queue->prev_tmu_tx_pkts > tmu_tx_pkts)
++			queue->done_tmu_tx_pkts = UINT_MAX -
++				queue->prev_tmu_tx_pkts + tmu_tx_pkts;
++		else
++			queue->done_tmu_tx_pkts = tmu_tx_pkts -
++						queue->prev_tmu_tx_pkts;
++
++		queue->prev_tmu_tx_pkts  = tmu_tx_pkts;
++
++		if (!queue->done_tmu_tx_pkts)
++			return NULL;
++	}
++
++	if (desc->ctrl & CL_DESC_OWN)
++		return NULL;
++
++	queue->read_idx = (queue->read_idx + 1) & (queue->size - 1);
++	queue->tx_pending--;
++
++	*flags = CL_DESC_GET_FLAGS(desc->ctrl);
++
++	if (queue->done_tmu_tx_pkts && (*flags & HIF_LAST_BUFFER))
++		queue->done_tmu_tx_pkts--;
++
++	return desc->data;
++}
++
++static void hif_lib_tmu_credit_init(struct pfe *pfe)
++{
++	int i, q;
++
++	for (i = 0; i < NUM_GEMAC_SUPPORT; i++)
++		for (q = 0; q < emac_txq_cnt; q++) {
++			pfe->tmu_credit.tx_credit_max[i][q] = (q == 0) ?
++					DEFAULT_Q0_QDEPTH : DEFAULT_MAX_QDEPTH;
++			pfe->tmu_credit.tx_credit[i][q] =
++					pfe->tmu_credit.tx_credit_max[i][q];
++		}
++}
++
++/* __hif_lib_update_credit
++ *
++ * @param[in] client	hif client context
++ * @param[in] queue	queue number in match with TMU
++ */
++void __hif_lib_update_credit(struct hif_client_s *client, unsigned int queue)
++{
++	unsigned int tmu_tx_packets, tmp;
++
++	if (tx_qos) {
++		tmu_tx_packets = be32_to_cpu(pe_dmem_read(TMU0_ID +
++			client->id, (TMU_DM_TX_TRANS + (queue * 4)), 4));
++
++		/* tx_packets counter overflowed */
++		if (tmu_tx_packets >
++		    pfe->tmu_credit.tx_packets[client->id][queue]) {
++			tmp = UINT_MAX - tmu_tx_packets +
++			pfe->tmu_credit.tx_packets[client->id][queue];
++
++			pfe->tmu_credit.tx_credit[client->id][queue] =
++			pfe->tmu_credit.tx_credit_max[client->id][queue] - tmp;
++		} else {
++		/* TMU tx <= pfe_eth tx, normal case or both OF since
++		 * last time
++		 */
++			pfe->tmu_credit.tx_credit[client->id][queue] =
++			pfe->tmu_credit.tx_credit_max[client->id][queue] -
++			(pfe->tmu_credit.tx_packets[client->id][queue] -
++			tmu_tx_packets);
++		}
++	}
++}
++
++int pfe_hif_lib_init(struct pfe *pfe)
++{
++	int rc;
++
++	pr_info("%s\n", __func__);
++
++	if (lro_mode) {
++		page_mode = 1;
++		pfe_pkt_size = min(PAGE_SIZE, MAX_PFE_PKT_SIZE);
++		pfe_pkt_headroom = 0;
++	} else {
++		page_mode = 0;
++		pfe_pkt_size = PFE_PKT_SIZE;
++		pfe_pkt_headroom = PFE_PKT_HEADROOM;
++	}
++
++	if (tx_qos)
++		emac_txq_cnt = EMAC_TXQ_CNT / 2;
++	else
++		emac_txq_cnt = EMAC_TXQ_CNT;
++
++	hif_lib_tmu_credit_init(pfe);
++	pfe->hif.shm = &ghif_shm;
++	rc = pfe_hif_shm_init(pfe->hif.shm);
++
++	return rc;
++}
++
++void pfe_hif_lib_exit(struct pfe *pfe)
++{
++	pr_info("%s\n", __func__);
++
++	pfe_hif_shm_clean(pfe->hif.shm);
++}
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_hif_lib.h
+@@ -0,0 +1,229 @@
++/* SPDX-License-Identifier: GPL-2.0+ */
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ */
++
++#ifndef _PFE_HIF_LIB_H_
++#define _PFE_HIF_LIB_H_
++
++#include "pfe_hif.h"
++
++#define HIF_CL_REQ_TIMEOUT	10
++#define GFP_DMA_PFE 0
++#define PFE_PARSE_INFO_SIZE	16
++
++enum {
++	REQUEST_CL_REGISTER = 0,
++	REQUEST_CL_UNREGISTER,
++	HIF_REQUEST_MAX
++};
++
++enum {
++	/* Event to indicate that client rx queue is reached water mark level */
++	EVENT_HIGH_RX_WM = 0,
++	/* Event to indicate that, packet received for client */
++	EVENT_RX_PKT_IND,
++	/* Event to indicate that, packet tx done for client */
++	EVENT_TXDONE_IND,
++	HIF_EVENT_MAX
++};
++
++/*structure to store client queue info */
++
++/*structure to store client queue info */
++struct hif_client_rx_queue {
++	struct rx_queue_desc *base;
++	u32	size;
++	u32	read_idx;
++	u32	write_idx;
++};
++
++struct hif_client_tx_queue {
++	struct tx_queue_desc *base;
++	u32	size;
++	u32	read_idx;
++	u32	write_idx;
++	u32	tx_pending;
++	unsigned long jiffies_last_packet;
++	u32	nocpy_flag;
++	u32	prev_tmu_tx_pkts;
++	u32	done_tmu_tx_pkts;
++};
++
++struct hif_client_s {
++	int	id;
++	int	tx_qn;
++	int	rx_qn;
++	void	*rx_qbase;
++	void	*tx_qbase;
++	int	tx_qsize;
++	int	rx_qsize;
++	int	cpu_id;
++	struct hif_client_tx_queue tx_q[HIF_CLIENT_QUEUES_MAX];
++	struct hif_client_rx_queue rx_q[HIF_CLIENT_QUEUES_MAX];
++	int (*event_handler)(void *priv, int event, int data);
++	unsigned long queue_mask[HIF_EVENT_MAX];
++	struct pfe *pfe;
++	void *priv;
++};
++
++/*
++ * Client specific shared memory
++ * It contains number of Rx/Tx queues, base addresses and queue sizes
++ */
++struct hif_client_shm {
++	u32 ctrl; /*0-7: number of Rx queues, 8-15: number of tx queues */
++	unsigned long rx_qbase; /*Rx queue base address */
++	u32 rx_qsize; /*each Rx queue size, all Rx queues are of same size */
++	unsigned long tx_qbase; /* Tx queue base address */
++	u32 tx_qsize; /*each Tx queue size, all Tx queues are of same size */
++};
++
++/*Client shared memory ctrl bit description */
++#define CLIENT_CTRL_RX_Q_CNT_OFST	0
++#define CLIENT_CTRL_TX_Q_CNT_OFST	8
++#define CLIENT_CTRL_RX_Q_CNT(ctrl)	(((ctrl) >> CLIENT_CTRL_RX_Q_CNT_OFST) \
++						& 0xFF)
++#define CLIENT_CTRL_TX_Q_CNT(ctrl)	(((ctrl) >> CLIENT_CTRL_TX_Q_CNT_OFST) \
++						& 0xFF)
++
++/*
++ * Shared memory used to communicate between HIF driver and host/client drivers
++ * Before starting the hif driver rx_buf_pool ans rx_buf_pool_cnt should be
++ * initialized with host buffers and buffers count in the pool.
++ * rx_buf_pool_cnt should be >= HIF_RX_DESC_NT.
++ *
++ */
++struct hif_shm {
++	u32 rx_buf_pool_cnt; /*Number of rx buffers available*/
++	/*Rx buffers required to initialize HIF rx descriptors */
++	void *rx_buf_pool[HIF_RX_DESC_NT];
++	unsigned long g_client_status[2]; /*Global client status bit mask */
++	/* Client specific shared memory */
++	struct hif_client_shm client[HIF_CLIENTS_MAX];
++};
++
++#define CL_DESC_OWN	BIT(31)
++/* This sets owner ship to HIF driver */
++#define CL_DESC_LAST	BIT(30)
++/* This indicates last packet for multi buffers handling */
++#define CL_DESC_FIRST	BIT(29)
++/* This indicates first packet for multi buffers handling */
++
++#define CL_DESC_BUF_LEN(x)		((x) & 0xFFFF)
++#define CL_DESC_FLAGS(x)		(((x) & 0xF) << 16)
++#define CL_DESC_GET_FLAGS(x)		(((x) >> 16) & 0xF)
++
++struct rx_queue_desc {
++	void *data;
++	u32	ctrl; /*0-15bit len, 16-20bit flags, 31bit owner*/
++	u32	client_ctrl;
++};
++
++struct tx_queue_desc {
++	void *data;
++	u32	ctrl; /*0-15bit len, 16-20bit flags, 31bit owner*/
++};
++
++/* HIF Rx is not working properly for 2-byte aligned buffers and
++ * ip_header should be 4byte aligned for better iperformance.
++ * "ip_header = 64 + 6(hif_header) + 14 (MAC Header)" will be 4byte aligned.
++ */
++#define PFE_PKT_HEADER_SZ	sizeof(struct hif_hdr)
++/* must be big enough for headroom, pkt size and skb shared info */
++#define PFE_BUF_SIZE		2048
++#define PFE_PKT_HEADROOM	128
++
++#define SKB_SHARED_INFO_SIZE   SKB_DATA_ALIGN(sizeof(struct skb_shared_info))
++#define PFE_PKT_SIZE		(PFE_BUF_SIZE - PFE_PKT_HEADROOM \
++				 - SKB_SHARED_INFO_SIZE)
++#define MAX_L2_HDR_SIZE		14	/* Not correct for VLAN/PPPoE */
++#define MAX_L3_HDR_SIZE		20	/* Not correct for IPv6 */
++#define MAX_L4_HDR_SIZE		60	/* TCP with maximum options */
++#define MAX_HDR_SIZE		(MAX_L2_HDR_SIZE + MAX_L3_HDR_SIZE \
++				 + MAX_L4_HDR_SIZE)
++/* Used in page mode to clamp packet size to the maximum supported by the hif
++ *hw interface (<16KiB)
++ */
++#define MAX_PFE_PKT_SIZE	16380UL
++
++extern unsigned int pfe_pkt_size;
++extern unsigned int pfe_pkt_headroom;
++extern unsigned int page_mode;
++extern unsigned int lro_mode;
++extern unsigned int tx_qos;
++extern unsigned int emac_txq_cnt;
++
++int pfe_hif_lib_init(struct pfe *pfe);
++void pfe_hif_lib_exit(struct pfe *pfe);
++int hif_lib_client_register(struct hif_client_s *client);
++int hif_lib_client_unregister(struct  hif_client_s *client);
++void __hif_lib_xmit_pkt(struct hif_client_s *client, unsigned int qno, void
++				*data, unsigned int len, u32 client_ctrl,
++				unsigned int flags, void *client_data);
++int hif_lib_xmit_pkt(struct hif_client_s *client, unsigned int qno, void *data,
++		     unsigned int len, u32 client_ctrl, void *client_data);
++void hif_lib_indicate_client(int cl_id, int event, int data);
++int hif_lib_event_handler_start(struct hif_client_s *client, int event, int
++					data);
++int hif_lib_tmu_queue_start(struct hif_client_s *client, int qno);
++int hif_lib_tmu_queue_stop(struct hif_client_s *client, int qno);
++void *hif_lib_tx_get_next_complete(struct hif_client_s *client, int qno,
++				   unsigned int *flags, int count);
++void *hif_lib_receive_pkt(struct hif_client_s *client, int qno, int *len, int
++				*ofst, unsigned int *rx_ctrl,
++				unsigned int *desc_ctrl, void **priv_data);
++void __hif_lib_update_credit(struct hif_client_s *client, unsigned int queue);
++void hif_lib_set_rx_cpu_affinity(struct hif_client_s *client, int cpu_id);
++void hif_lib_set_tx_queue_nocpy(struct hif_client_s *client, int qno, int
++					enable);
++static inline int hif_lib_tx_avail(struct hif_client_s *client, unsigned int
++					qno)
++{
++	struct hif_client_tx_queue *queue = &client->tx_q[qno];
++
++	return (queue->size - queue->tx_pending);
++}
++
++static inline int hif_lib_get_tx_wr_index(struct hif_client_s *client, unsigned
++						int qno)
++{
++	struct hif_client_tx_queue *queue = &client->tx_q[qno];
++
++	return queue->write_idx;
++}
++
++static inline int hif_lib_tx_pending(struct hif_client_s *client, unsigned int
++					qno)
++{
++	struct hif_client_tx_queue *queue = &client->tx_q[qno];
++
++	return queue->tx_pending;
++}
++
++#define hif_lib_tx_credit_avail(pfe, id, qno) \
++				((pfe)->tmu_credit.tx_credit[id][qno])
++
++#define hif_lib_tx_credit_max(pfe, id, qno) \
++				((pfe)->tmu_credit.tx_credit_max[id][qno])
++
++/*
++ * Test comment
++ */
++#define hif_lib_tx_credit_use(pfe, id, qno, credit)			\
++	({ typeof(pfe) pfe_ = pfe;					\
++		typeof(id) id_ = id;					\
++		typeof(qno) qno_ = qno;					\
++		typeof(credit) credit_ = credit;			\
++		do {							\
++			if (tx_qos) {					\
++				(pfe_)->tmu_credit.tx_credit[id_][qno_]\
++					 -= credit_;			\
++				(pfe_)->tmu_credit.tx_packets[id_][qno_]\
++					+= credit_;			\
++			}						\
++		} while (0);						\
++	})
++
++#endif /* _PFE_HIF_LIB_H_ */
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_hw.c
+@@ -0,0 +1,164 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ */
++
++#include "pfe_mod.h"
++#include "pfe_hw.h"
++
++/* Functions to handle most of pfe hw register initialization */
++int pfe_hw_init(struct pfe *pfe, int resume)
++{
++	struct class_cfg class_cfg = {
++		.pe_sys_clk_ratio = PE_SYS_CLK_RATIO,
++		.route_table_baseaddr = pfe->ddr_phys_baseaddr +
++					ROUTE_TABLE_BASEADDR,
++		.route_table_hash_bits = ROUTE_TABLE_HASH_BITS,
++	};
++
++	struct tmu_cfg tmu_cfg = {
++		.pe_sys_clk_ratio = PE_SYS_CLK_RATIO,
++		.llm_base_addr = pfe->ddr_phys_baseaddr + TMU_LLM_BASEADDR,
++		.llm_queue_len = TMU_LLM_QUEUE_LEN,
++	};
++
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++	struct util_cfg util_cfg = {
++		.pe_sys_clk_ratio = PE_SYS_CLK_RATIO,
++	};
++#endif
++
++	struct BMU_CFG bmu1_cfg = {
++		.baseaddr = CBUS_VIRT_TO_PFE(LMEM_BASE_ADDR +
++						BMU1_LMEM_BASEADDR),
++		.count = BMU1_BUF_COUNT,
++		.size = BMU1_BUF_SIZE,
++		.low_watermark = 10,
++		.high_watermark = 15,
++	};
++
++	struct BMU_CFG bmu2_cfg = {
++		.baseaddr = DDR_PHYS_TO_PFE(pfe->ddr_phys_baseaddr +
++						BMU2_DDR_BASEADDR),
++		.count = BMU2_BUF_COUNT,
++		.size = BMU2_BUF_SIZE,
++		.low_watermark = 250,
++		.high_watermark = 253,
++	};
++
++	struct gpi_cfg egpi1_cfg = {
++		.lmem_rtry_cnt = EGPI1_LMEM_RTRY_CNT,
++		.tmlf_txthres = EGPI1_TMLF_TXTHRES,
++		.aseq_len = EGPI1_ASEQ_LEN,
++		.mtip_pause_reg = CBUS_VIRT_TO_PFE(EMAC1_BASE_ADDR +
++						EMAC_TCNTRL_REG),
++	};
++
++	struct gpi_cfg egpi2_cfg = {
++		.lmem_rtry_cnt = EGPI2_LMEM_RTRY_CNT,
++		.tmlf_txthres = EGPI2_TMLF_TXTHRES,
++		.aseq_len = EGPI2_ASEQ_LEN,
++		.mtip_pause_reg = CBUS_VIRT_TO_PFE(EMAC2_BASE_ADDR +
++						EMAC_TCNTRL_REG),
++	};
++
++	struct gpi_cfg hgpi_cfg = {
++		.lmem_rtry_cnt = HGPI_LMEM_RTRY_CNT,
++		.tmlf_txthres = HGPI_TMLF_TXTHRES,
++		.aseq_len = HGPI_ASEQ_LEN,
++		.mtip_pause_reg = 0,
++	};
++
++	pr_info("%s\n", __func__);
++
++#if !defined(LS1012A_PFE_RESET_WA)
++	/* LS1012A needs this to make PE work correctly */
++	writel(0x3,     CLASS_PE_SYS_CLK_RATIO);
++	writel(0x3,     TMU_PE_SYS_CLK_RATIO);
++	writel(0x3,     UTIL_PE_SYS_CLK_RATIO);
++	usleep_range(10, 20);
++#endif
++
++	pr_info("CLASS version: %x\n", readl(CLASS_VERSION));
++	pr_info("TMU version: %x\n", readl(TMU_VERSION));
++
++	pr_info("BMU1 version: %x\n", readl(BMU1_BASE_ADDR +
++		BMU_VERSION));
++	pr_info("BMU2 version: %x\n", readl(BMU2_BASE_ADDR +
++		BMU_VERSION));
++
++	pr_info("EGPI1 version: %x\n", readl(EGPI1_BASE_ADDR +
++		GPI_VERSION));
++	pr_info("EGPI2 version: %x\n", readl(EGPI2_BASE_ADDR +
++		GPI_VERSION));
++	pr_info("HGPI version: %x\n", readl(HGPI_BASE_ADDR +
++		GPI_VERSION));
++
++	pr_info("HIF version: %x\n", readl(HIF_VERSION));
++	pr_info("HIF NOPCY version: %x\n", readl(HIF_NOCPY_VERSION));
++
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++	pr_info("UTIL version: %x\n", readl(UTIL_VERSION));
++#endif
++	while (!(readl(TMU_CTRL) & ECC_MEM_INIT_DONE))
++		;
++
++	hif_rx_disable();
++	hif_tx_disable();
++
++	bmu_init(BMU1_BASE_ADDR, &bmu1_cfg);
++
++	pr_info("bmu_init(1) done\n");
++
++	bmu_init(BMU2_BASE_ADDR, &bmu2_cfg);
++
++	pr_info("bmu_init(2) done\n");
++
++	class_cfg.resume = resume ? 1 : 0;
++
++	class_init(&class_cfg);
++
++	pr_info("class_init() done\n");
++
++	tmu_init(&tmu_cfg);
++
++	pr_info("tmu_init() done\n");
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++	util_init(&util_cfg);
++
++	pr_info("util_init() done\n");
++#endif
++	gpi_init(EGPI1_BASE_ADDR, &egpi1_cfg);
++
++	pr_info("gpi_init(1) done\n");
++
++	gpi_init(EGPI2_BASE_ADDR, &egpi2_cfg);
++
++	pr_info("gpi_init(2) done\n");
++
++	gpi_init(HGPI_BASE_ADDR, &hgpi_cfg);
++
++	pr_info("gpi_init(hif) done\n");
++
++	bmu_enable(BMU1_BASE_ADDR);
++
++	pr_info("bmu_enable(1) done\n");
++
++	bmu_enable(BMU2_BASE_ADDR);
++
++	pr_info("bmu_enable(2) done\n");
++
++	return 0;
++}
++
++void pfe_hw_exit(struct pfe *pfe)
++{
++	pr_info("%s\n", __func__);
++
++	bmu_disable(BMU1_BASE_ADDR);
++	bmu_reset(BMU1_BASE_ADDR);
++
++	bmu_disable(BMU2_BASE_ADDR);
++	bmu_reset(BMU2_BASE_ADDR);
++}
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_hw.h
+@@ -0,0 +1,15 @@
++/* SPDX-License-Identifier: GPL-2.0+ */
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ */
++
++#ifndef _PFE_HW_H_
++#define _PFE_HW_H_
++
++#define PE_SYS_CLK_RATIO	1	/* SYS/AXI = 250MHz, HFE = 500MHz */
++
++int pfe_hw_init(struct pfe *pfe, int resume);
++void pfe_hw_exit(struct pfe *pfe);
++
++#endif /* _PFE_HW_H_ */
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_ls1012a_platform.c
+@@ -0,0 +1,383 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ */
++
++#include <linux/module.h>
++#include <linux/device.h>
++#include <linux/of.h>
++#include <linux/of_net.h>
++#include <linux/of_address.h>
++#include <linux/of_mdio.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++#include <linux/clk.h>
++#include <linux/mfd/syscon.h>
++#include <linux/regmap.h>
++
++#include "pfe_mod.h"
++
++extern bool pfe_use_old_dts_phy;
++struct ls1012a_pfe_platform_data pfe_platform_data;
++
++static int pfe_get_gemac_if_properties(struct device_node *gem,
++				       int port,
++				       struct ls1012a_pfe_platform_data	*pdata)
++{
++	struct device_node *phy_node = NULL;
++	int size;
++	int phy_id = 0;
++	const u32 *addr;
++	int err;
++
++	addr = of_get_property(gem, "reg", &size);
++	if (addr)
++		port = be32_to_cpup(addr);
++	else
++		goto err;
++
++	pdata->ls1012a_eth_pdata[port].gem_id = port;
++
++	err = of_get_mac_address(gem, pdata->ls1012a_eth_pdata[port].mac_addr);
++
++	phy_node = of_parse_phandle(gem, "phy-handle", 0);
++	pdata->ls1012a_eth_pdata[port].phy_node = phy_node;
++	if (phy_node) {
++		pfe_use_old_dts_phy = false;
++		goto process_phynode;
++	} else if (of_phy_is_fixed_link(gem)) {
++		pfe_use_old_dts_phy = false;
++		if (of_phy_register_fixed_link(gem) < 0) {
++			pr_err("broken fixed-link specification\n");
++			goto err;
++		}
++		phy_node = of_node_get(gem);
++		pdata->ls1012a_eth_pdata[port].phy_node = phy_node;
++	} else if (of_get_property(gem, "fsl,pfe-phy-if-flags", &size)) {
++		pfe_use_old_dts_phy = true;
++		/* Use old dts properties for phy handling */
++		addr = of_get_property(gem, "fsl,pfe-phy-if-flags", &size);
++		pdata->ls1012a_eth_pdata[port].phy_flags = be32_to_cpup(addr);
++
++		addr = of_get_property(gem, "fsl,gemac-phy-id", &size);
++		if (!addr) {
++			pr_err("%s:%d Invalid gemac-phy-id....\n", __func__,
++			       __LINE__);
++		} else {
++			phy_id = be32_to_cpup(addr);
++			pdata->ls1012a_eth_pdata[port].phy_id = phy_id;
++			pdata->ls1012a_mdio_pdata[0].phy_mask &= ~(1 << phy_id);
++		}
++
++		/* If PHY is enabled, read mdio properties */
++		if (pdata->ls1012a_eth_pdata[port].phy_flags & GEMAC_NO_PHY)
++			goto done;
++
++	} else {
++		pr_info("%s: No PHY or fixed-link\n", __func__);
++		return 0;
++	}
++
++process_phynode:
++	err = of_get_phy_mode(gem, &pdata->ls1012a_eth_pdata[port].mii_config);
++	if (err)
++		pr_err("%s:%d Incorrect Phy mode....\n", __func__,
++		       __LINE__);
++
++	addr = of_get_property(gem, "fsl,mdio-mux-val", &size);
++	if (!addr) {
++		pr_err("%s: Invalid mdio-mux-val....\n", __func__);
++	} else {
++		phy_id = be32_to_cpup(addr);
++		pdata->ls1012a_eth_pdata[port].mdio_muxval = phy_id;
++	}
++
++	if (pdata->ls1012a_eth_pdata[port].phy_id < 32)
++		pfe->mdio_muxval[pdata->ls1012a_eth_pdata[port].phy_id] =
++			 pdata->ls1012a_eth_pdata[port].mdio_muxval;
++
++
++	pdata->ls1012a_mdio_pdata[port].irq[0] = PHY_POLL;
++
++done:
++	return 0;
++
++err:
++	return -1;
++}
++
++/*
++ *
++ * pfe_platform_probe -
++ *
++ *
++ */
++static int pfe_platform_probe(struct platform_device *pdev)
++{
++	struct resource res;
++	int ii = 0, rc, interface_count = 0, size = 0;
++	const u32 *prop;
++	struct device_node *np, *gem = NULL;
++	struct clk *pfe_clk;
++
++	np = pdev->dev.of_node;
++
++	if (!np) {
++		pr_err("Invalid device node\n");
++		return -EINVAL;
++	}
++
++	pfe = kzalloc(sizeof(*pfe), GFP_KERNEL);
++	if (!pfe) {
++		rc = -ENOMEM;
++		goto err_alloc;
++	}
++
++	platform_set_drvdata(pdev, pfe);
++
++	if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32))) {
++		rc = -ENOMEM;
++		pr_err("unable to configure DMA mask.\n");
++		goto err_ddr;
++	}
++
++	if (of_address_to_resource(np, 1, &res)) {
++		rc = -ENOMEM;
++		pr_err("failed to get ddr resource\n");
++		goto err_ddr;
++	}
++
++	pfe->ddr_phys_baseaddr = res.start;
++	pfe->ddr_size = resource_size(&res);
++
++	pfe->ddr_baseaddr = memremap(res.start, resource_size(&res),
++				     MEMREMAP_WB);
++	if (!pfe->ddr_baseaddr) {
++		pr_err("memremap() ddr failed\n");
++		rc = -ENOMEM;
++		goto err_ddr;
++	}
++
++	pfe->scfg =
++		syscon_regmap_lookup_by_phandle(pdev->dev.of_node,
++						"fsl,pfe-scfg");
++	if (IS_ERR(pfe->scfg)) {
++		dev_err(&pdev->dev, "No syscfg phandle specified\n");
++		return PTR_ERR(pfe->scfg);
++	}
++
++	pfe->cbus_baseaddr = of_iomap(np, 0);
++	if (!pfe->cbus_baseaddr) {
++		rc = -ENOMEM;
++		pr_err("failed to get axi resource\n");
++		goto err_axi;
++	}
++
++	pfe->hif_irq = platform_get_irq(pdev, 0);
++	if (pfe->hif_irq < 0) {
++		pr_err("platform_get_irq for hif failed\n");
++		rc = pfe->hif_irq;
++		goto err_hif_irq;
++	}
++
++	pfe->wol_irq = platform_get_irq(pdev, 2);
++	if (pfe->wol_irq < 0) {
++		pr_err("platform_get_irq for WoL failed\n");
++		rc = pfe->wol_irq;
++		goto err_hif_irq;
++	}
++
++	/* Read interface count */
++	prop = of_get_property(np, "fsl,pfe-num-interfaces", &size);
++	if (!prop) {
++		pr_err("Failed to read number of interfaces\n");
++		rc = -ENXIO;
++		goto err_prop;
++	}
++
++	interface_count = be32_to_cpup(prop);
++	if (interface_count <= 0) {
++		pr_err("No ethernet interface count : %d\n",
++		       interface_count);
++		rc = -ENXIO;
++		goto err_prop;
++	}
++
++	pfe_platform_data.ls1012a_mdio_pdata[0].phy_mask = 0xffffffff;
++
++	while ((gem = of_get_next_child(np, gem))) {
++		if (of_find_property(gem, "reg", &size)) {
++			pfe_get_gemac_if_properties(gem, ii,
++						&pfe_platform_data);
++			ii++;
++		}
++	}
++
++	if (interface_count != ii)
++		pr_info("missing some of gemac interface properties.\n");
++
++	pfe->dev = &pdev->dev;
++
++	pfe->dev->platform_data = &pfe_platform_data;
++
++	/* declare WoL capabilities */
++	device_init_wakeup(&pdev->dev, true);
++
++	/* find the clocks */
++	pfe_clk = devm_clk_get(pfe->dev, "pfe");
++	if (IS_ERR(pfe_clk))
++		return PTR_ERR(pfe_clk);
++
++	/* PFE clock is (platform clock / 2) */
++	/* save sys_clk value as KHz */
++	pfe->ctrl.sys_clk = clk_get_rate(pfe_clk) / (2 * 1000);
++
++	rc = pfe_probe(pfe);
++	if (rc < 0)
++		goto err_probe;
++
++	return 0;
++
++err_probe:
++err_prop:
++err_hif_irq:
++	iounmap(pfe->cbus_baseaddr);
++
++err_axi:
++	memunmap(pfe->ddr_baseaddr);
++
++err_ddr:
++	platform_set_drvdata(pdev, NULL);
++
++	kfree(pfe);
++
++err_alloc:
++	return rc;
++}
++
++/*
++ * pfe_platform_remove -
++ */
++static int pfe_platform_remove(struct platform_device *pdev)
++{
++	struct pfe *pfe = platform_get_drvdata(pdev);
++	int rc;
++
++	pr_info("%s\n", __func__);
++
++	rc = pfe_remove(pfe);
++
++	iounmap(pfe->cbus_baseaddr);
++
++	memunmap(pfe->ddr_baseaddr);
++
++	platform_set_drvdata(pdev, NULL);
++
++	kfree(pfe);
++
++	return rc;
++}
++
++#ifdef CONFIG_PM
++#ifdef CONFIG_PM_SLEEP
++int pfe_platform_suspend(struct device *dev)
++{
++	struct pfe *pfe = platform_get_drvdata(to_platform_device(dev));
++	struct net_device *netdev;
++	int i;
++
++	pfe->wake = 0;
++
++	for (i = 0; i < (NUM_GEMAC_SUPPORT); i++) {
++		netdev = pfe->eth.eth_priv[i]->ndev;
++
++		netif_device_detach(netdev);
++
++		if (netif_running(netdev))
++			if (pfe_eth_suspend(netdev))
++				pfe->wake = 1;
++	}
++
++	/* Shutdown PFE only if we're not waking up the system */
++	if (!pfe->wake) {
++#if defined(LS1012A_PFE_RESET_WA)
++		pfe_hif_rx_idle(&pfe->hif);
++#endif
++		pfe_ctrl_suspend(&pfe->ctrl);
++		pfe_firmware_exit(pfe);
++
++		pfe_hif_exit(pfe);
++		pfe_hif_lib_exit(pfe);
++
++		pfe_hw_exit(pfe);
++	}
++
++	return 0;
++}
++
++static int pfe_platform_resume(struct device *dev)
++{
++	struct pfe *pfe = platform_get_drvdata(to_platform_device(dev));
++	struct net_device *netdev;
++	int i;
++
++	if (!pfe->wake) {
++		pfe_hw_init(pfe, 1);
++		pfe_hif_lib_init(pfe);
++		pfe_hif_init(pfe);
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++		util_enable();
++#endif
++		tmu_enable(0xf);
++		class_enable();
++		pfe_ctrl_resume(&pfe->ctrl);
++	}
++
++	for (i = 0; i < (NUM_GEMAC_SUPPORT); i++) {
++		netdev = pfe->eth.eth_priv[i]->ndev;
++
++		if (pfe->mdio.mdio_priv[i]->mii_bus)
++			pfe_eth_mdio_reset(pfe->mdio.mdio_priv[i]->mii_bus);
++
++		if (netif_running(netdev))
++			pfe_eth_resume(netdev);
++
++		netif_device_attach(netdev);
++	}
++	return 0;
++}
++#else
++#define pfe_platform_suspend NULL
++#define pfe_platform_resume NULL
++#endif
++
++static const struct dev_pm_ops pfe_platform_pm_ops = {
++	SET_SYSTEM_SLEEP_PM_OPS(pfe_platform_suspend, pfe_platform_resume)
++};
++#endif
++
++static const struct of_device_id pfe_match[] = {
++	{
++		.compatible = "fsl,pfe",
++	},
++	{},
++};
++MODULE_DEVICE_TABLE(of, pfe_match);
++
++static struct platform_driver pfe_platform_driver = {
++	.probe = pfe_platform_probe,
++	.remove = pfe_platform_remove,
++	.driver = {
++		.name = "pfe",
++		.of_match_table = pfe_match,
++#ifdef CONFIG_PM
++		.pm = &pfe_platform_pm_ops,
++#endif
++	},
++};
++
++module_platform_driver(pfe_platform_driver);
++MODULE_LICENSE("GPL");
++MODULE_DESCRIPTION("PFE Ethernet driver");
++MODULE_AUTHOR("NXP DNCPE");
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_mod.c
+@@ -0,0 +1,158 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ */
++
++#include <linux/dma-mapping.h>
++#include "pfe_mod.h"
++#include "pfe_cdev.h"
++
++unsigned int us;
++module_param(us, uint, 0444);
++MODULE_PARM_DESC(us, "0: module enabled for kernel networking (DEFAULT)\n"
++			"1: module enabled for userspace networking\n");
++struct pfe *pfe;
++
++/*
++ * pfe_probe -
++ */
++int pfe_probe(struct pfe *pfe)
++{
++	int rc;
++
++	if (pfe->ddr_size < DDR_MAX_SIZE) {
++		pr_err("%s: required DDR memory (%x) above platform ddr memory (%x)\n",
++		       __func__, (unsigned int)DDR_MAX_SIZE, pfe->ddr_size);
++		rc = -ENOMEM;
++		goto err_hw;
++	}
++
++	if (((int)(pfe->ddr_phys_baseaddr + BMU2_DDR_BASEADDR) &
++			(8 * SZ_1M - 1)) != 0) {
++		pr_err("%s: BMU2 base address (0x%x) must be aligned on 8MB boundary\n",
++		       __func__, (int)pfe->ddr_phys_baseaddr +
++			BMU2_DDR_BASEADDR);
++		rc = -ENOMEM;
++		goto err_hw;
++	}
++
++	pr_info("cbus_baseaddr: %lx, ddr_baseaddr: %lx, ddr_phys_baseaddr: %lx, ddr_size: %x\n",
++		(unsigned long)pfe->cbus_baseaddr,
++		(unsigned long)pfe->ddr_baseaddr,
++		pfe->ddr_phys_baseaddr, pfe->ddr_size);
++
++	pfe_lib_init(pfe->cbus_baseaddr, pfe->ddr_baseaddr,
++		     pfe->ddr_phys_baseaddr, pfe->ddr_size);
++
++	rc = pfe_hw_init(pfe, 0);
++	if (rc < 0)
++		goto err_hw;
++
++	if (us)
++		goto firmware_init;
++
++	rc = pfe_hif_lib_init(pfe);
++	if (rc < 0)
++		goto err_hif_lib;
++
++	rc = pfe_hif_init(pfe);
++	if (rc < 0)
++		goto err_hif;
++
++firmware_init:
++	rc = pfe_firmware_init(pfe);
++	if (rc < 0)
++		goto err_firmware;
++
++	rc = pfe_ctrl_init(pfe);
++	if (rc < 0)
++		goto err_ctrl;
++
++	rc = pfe_eth_init(pfe);
++	if (rc < 0)
++		goto err_eth;
++
++	rc = pfe_sysfs_init(pfe);
++	if (rc < 0)
++		goto err_sysfs;
++
++	rc = pfe_debugfs_init(pfe);
++	if (rc < 0)
++		goto err_debugfs;
++
++	if (us) {
++		/* Creating a character device */
++		rc = pfe_cdev_init();
++		if (rc < 0)
++			goto err_cdev;
++	}
++
++	return 0;
++
++err_cdev:
++	pfe_debugfs_exit(pfe);
++
++err_debugfs:
++	pfe_sysfs_exit(pfe);
++
++err_sysfs:
++	pfe_eth_exit(pfe);
++
++err_eth:
++	pfe_ctrl_exit(pfe);
++
++err_ctrl:
++	pfe_firmware_exit(pfe);
++
++err_firmware:
++	if (us)
++		goto err_hif_lib;
++
++	pfe_hif_exit(pfe);
++
++err_hif:
++	pfe_hif_lib_exit(pfe);
++
++err_hif_lib:
++	pfe_hw_exit(pfe);
++
++err_hw:
++	return rc;
++}
++
++/*
++ * pfe_remove -
++ */
++int pfe_remove(struct pfe *pfe)
++{
++	pr_info("%s\n", __func__);
++
++	if (us)
++		pfe_cdev_exit();
++
++	pfe_debugfs_exit(pfe);
++
++	pfe_sysfs_exit(pfe);
++
++	pfe_eth_exit(pfe);
++
++	pfe_ctrl_exit(pfe);
++
++#if defined(LS1012A_PFE_RESET_WA)
++	pfe_hif_rx_idle(&pfe->hif);
++#endif
++	pfe_firmware_exit(pfe);
++
++	if (us)
++		goto hw_exit;
++
++	pfe_hif_exit(pfe);
++
++	pfe_hif_lib_exit(pfe);
++
++hw_exit:
++	pfe_hw_exit(pfe);
++
++	return 0;
++}
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_mod.h
+@@ -0,0 +1,103 @@
++/* SPDX-License-Identifier: GPL-2.0+ */
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ */
++
++#ifndef _PFE_MOD_H_
++#define _PFE_MOD_H_
++
++#include <linux/device.h>
++#include <linux/elf.h>
++
++extern unsigned int us;
++
++struct pfe;
++
++#include "pfe_hw.h"
++#include "pfe_firmware.h"
++#include "pfe_ctrl.h"
++#include "pfe_hif.h"
++#include "pfe_hif_lib.h"
++#include "pfe_eth.h"
++#include "pfe_sysfs.h"
++#include "pfe_perfmon.h"
++#include "pfe_debugfs.h"
++
++#define PHYID_MAX_VAL 32
++
++struct pfe_tmu_credit {
++	/* Number of allowed TX packet in-flight, matches TMU queue size */
++	unsigned int tx_credit[NUM_GEMAC_SUPPORT][EMAC_TXQ_CNT];
++	unsigned int tx_credit_max[NUM_GEMAC_SUPPORT][EMAC_TXQ_CNT];
++	unsigned int tx_packets[NUM_GEMAC_SUPPORT][EMAC_TXQ_CNT];
++};
++
++struct pfe {
++	struct regmap	*scfg;
++	unsigned long ddr_phys_baseaddr;
++	void *ddr_baseaddr;
++	unsigned int ddr_size;
++	void *cbus_baseaddr;
++	void *apb_baseaddr;
++	unsigned long iram_phys_baseaddr;
++	void *iram_baseaddr;
++	unsigned long ipsec_phys_baseaddr;
++	void *ipsec_baseaddr;
++	int hif_irq;
++	int wol_irq;
++	int hif_client_irq;
++	struct device *dev;
++	struct dentry *dentry;
++	struct pfe_ctrl ctrl;
++	struct pfe_hif hif;
++	struct pfe_eth eth;
++	struct pfe_mdio mdio;
++	struct hif_client_s *hif_client[HIF_CLIENTS_MAX];
++#if defined(CFG_DIAGS)
++	struct pfe_diags diags;
++#endif
++	struct pfe_tmu_credit tmu_credit;
++	struct pfe_cpumon cpumon;
++	struct pfe_memmon memmon;
++	int wake;
++	int mdio_muxval[PHYID_MAX_VAL];
++	struct clk *hfe_clock;
++};
++
++extern struct pfe *pfe;
++
++int pfe_probe(struct pfe *pfe);
++int pfe_remove(struct pfe *pfe);
++
++/* DDR Mapping in reserved memory*/
++#define ROUTE_TABLE_BASEADDR	0
++#define ROUTE_TABLE_HASH_BITS	15	/* 32K entries */
++#define ROUTE_TABLE_SIZE	((1 << ROUTE_TABLE_HASH_BITS) \
++				  * CLASS_ROUTE_SIZE)
++#define BMU2_DDR_BASEADDR	(ROUTE_TABLE_BASEADDR + ROUTE_TABLE_SIZE)
++#define BMU2_BUF_COUNT		(4096 - 256)
++/* This is to get a total DDR size of 12MiB */
++#define BMU2_DDR_SIZE		(DDR_BUF_SIZE * BMU2_BUF_COUNT)
++#define UTIL_CODE_BASEADDR	(BMU2_DDR_BASEADDR + BMU2_DDR_SIZE)
++#define UTIL_CODE_SIZE		(128 * SZ_1K)
++#define UTIL_DDR_DATA_BASEADDR	(UTIL_CODE_BASEADDR + UTIL_CODE_SIZE)
++#define UTIL_DDR_DATA_SIZE	(64 * SZ_1K)
++#define CLASS_DDR_DATA_BASEADDR	(UTIL_DDR_DATA_BASEADDR + UTIL_DDR_DATA_SIZE)
++#define CLASS_DDR_DATA_SIZE	(32 * SZ_1K)
++#define TMU_DDR_DATA_BASEADDR	(CLASS_DDR_DATA_BASEADDR + CLASS_DDR_DATA_SIZE)
++#define TMU_DDR_DATA_SIZE	(32 * SZ_1K)
++#define TMU_LLM_BASEADDR	(TMU_DDR_DATA_BASEADDR + TMU_DDR_DATA_SIZE)
++#define TMU_LLM_QUEUE_LEN	(8 * 512)
++/* Must be power of two and at least 16 * 8 = 128 bytes */
++#define TMU_LLM_SIZE		(4 * 16 * TMU_LLM_QUEUE_LEN)
++/* (4 TMU's x 16 queues x queue_len) */
++
++#define DDR_MAX_SIZE		(TMU_LLM_BASEADDR + TMU_LLM_SIZE)
++
++/* LMEM Mapping */
++#define BMU1_LMEM_BASEADDR	0
++#define BMU1_BUF_COUNT		256
++#define BMU1_LMEM_SIZE		(LMEM_BUF_SIZE * BMU1_BUF_COUNT)
++
++#endif /* _PFE_MOD_H */
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_perfmon.h
+@@ -0,0 +1,26 @@
++/* SPDX-License-Identifier: GPL-2.0+ */
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ */
++
++#ifndef _PFE_PERFMON_H_
++#define _PFE_PERFMON_H_
++
++#include "pfe/pfe.h"
++
++#define	CT_CPUMON_INTERVAL	(1 * TIMER_TICKS_PER_SEC)
++
++struct pfe_cpumon {
++	u32 cpu_usage_pct[MAX_PE];
++	u32 class_usage_pct;
++};
++
++struct pfe_memmon {
++	u32 kernel_memory_allocated;
++};
++
++int pfe_perfmon_init(struct pfe *pfe);
++void pfe_perfmon_exit(struct pfe *pfe);
++
++#endif /* _PFE_PERFMON_H_ */
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_sysfs.c
+@@ -0,0 +1,840 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++
++#include "pfe_mod.h"
++
++#define PE_EXCEPTION_DUMP_ADDRESS 0x1fa8
++#define NUM_QUEUES		16
++
++static char register_name[20][5] = {
++	"EPC", "ECAS", "EID", "ED",
++	"r0", "r1", "r2", "r3",
++	"r4", "r5", "r6", "r7",
++	"r8", "r9", "r10", "r11",
++	"r12", "r13", "r14", "r15",
++};
++
++static char exception_name[14][20] = {
++	"Reset",
++	"HardwareFailure",
++	"NMI",
++	"InstBreakpoint",
++	"DataBreakpoint",
++	"Unsupported",
++	"PrivilegeViolation",
++	"InstBusError",
++	"DataBusError",
++	"AlignmentError",
++	"ArithmeticError",
++	"SystemCall",
++	"MemoryManagement",
++	"Interrupt",
++};
++
++static unsigned long class_do_clear;
++static unsigned long tmu_do_clear;
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++static unsigned long util_do_clear;
++#endif
++
++static ssize_t display_pe_status(char *buf, int id, u32 dmem_addr, unsigned long
++					do_clear)
++{
++	ssize_t len = 0;
++	u32 val;
++	char statebuf[5];
++	struct pfe_cpumon *cpumon = &pfe->cpumon;
++	u32 debug_indicator;
++	u32 debug[20];
++
++	if (id < CLASS0_ID || id >= MAX_PE)
++		return len;
++
++	*(u32 *)statebuf = pe_dmem_read(id, dmem_addr, 4);
++	dmem_addr += 4;
++
++	statebuf[4] = '\0';
++	len += sprintf(buf + len, "state=%4s ", statebuf);
++
++	val = pe_dmem_read(id, dmem_addr, 4);
++	dmem_addr += 4;
++	len += sprintf(buf + len, "ctr=%08x ", cpu_to_be32(val));
++
++	val = pe_dmem_read(id, dmem_addr, 4);
++	if (do_clear && val)
++		pe_dmem_write(id, 0, dmem_addr, 4);
++	dmem_addr += 4;
++	len += sprintf(buf + len, "rx=%u ", cpu_to_be32(val));
++
++	val = pe_dmem_read(id, dmem_addr, 4);
++	if (do_clear && val)
++		pe_dmem_write(id, 0, dmem_addr, 4);
++	dmem_addr += 4;
++	if (id >= TMU0_ID && id <= TMU_MAX_ID)
++		len += sprintf(buf + len, "qstatus=%x", cpu_to_be32(val));
++	else
++		len += sprintf(buf + len, "tx=%u", cpu_to_be32(val));
++
++	val = pe_dmem_read(id, dmem_addr, 4);
++	if (do_clear && val)
++		pe_dmem_write(id, 0, dmem_addr, 4);
++	dmem_addr += 4;
++	if (val)
++		len += sprintf(buf + len, " drop=%u", cpu_to_be32(val));
++
++	len += sprintf(buf + len, " load=%d%%", cpumon->cpu_usage_pct[id]);
++
++	len += sprintf(buf + len, "\n");
++
++	debug_indicator = pe_dmem_read(id, dmem_addr, 4);
++	dmem_addr += 4;
++	if (!strncmp((char *)&debug_indicator, "DBUG", 4)) {
++		int j, last = 0;
++
++		for (j = 0; j < 16; j++) {
++			debug[j] = pe_dmem_read(id, dmem_addr, 4);
++			if (debug[j]) {
++				if (do_clear)
++					pe_dmem_write(id, 0, dmem_addr, 4);
++				last = j + 1;
++			}
++			dmem_addr += 4;
++		}
++		for (j = 0; j < last; j++) {
++			len += sprintf(buf + len, "%08x%s",
++			cpu_to_be32(debug[j]),
++			(j & 0x7) == 0x7 || j == last - 1 ? "\n" : " ");
++		}
++	}
++
++	if (!strncmp(statebuf, "DEAD", 4)) {
++		u32 i, dump = PE_EXCEPTION_DUMP_ADDRESS;
++
++		len += sprintf(buf + len, "Exception details:\n");
++		for (i = 0; i < 20; i++) {
++			debug[i] = pe_dmem_read(id, dump, 4);
++			dump += 4;
++			if (i == 2)
++				len += sprintf(buf + len, "%4s = %08x (=%s) ",
++				register_name[i], cpu_to_be32(debug[i]),
++				exception_name[min((u32)
++				cpu_to_be32(debug[i]), (u32)13)]);
++			else
++				len += sprintf(buf + len, "%4s = %08x%s",
++				register_name[i], cpu_to_be32(debug[i]),
++				(i & 0x3) == 0x3 || i == 19 ? "\n" : " ");
++		}
++	}
++
++	return len;
++}
++
++static ssize_t class_phy_stats(char *buf, int phy)
++{
++	ssize_t len = 0;
++	int off1 = phy * 0x28;
++	int off2 = phy * 0x10;
++
++	if (phy == 3)
++		off1 = CLASS_PHY4_RX_PKTS - CLASS_PHY1_RX_PKTS;
++
++	len += sprintf(buf + len, "phy: %d\n", phy);
++	len += sprintf(buf + len,
++			"  rx:   %10u, tx:   %10u, intf:  %10u, ipv4:    %10u, ipv6: %10u\n",
++			readl(CLASS_PHY1_RX_PKTS + off1),
++			readl(CLASS_PHY1_TX_PKTS + off1),
++			readl(CLASS_PHY1_INTF_MATCH_PKTS + off1),
++			readl(CLASS_PHY1_V4_PKTS + off1),
++			readl(CLASS_PHY1_V6_PKTS + off1));
++
++	len += sprintf(buf + len,
++			"  icmp: %10u, igmp: %10u, tcp:   %10u, udp:     %10u\n",
++			readl(CLASS_PHY1_ICMP_PKTS + off2),
++			readl(CLASS_PHY1_IGMP_PKTS + off2),
++			readl(CLASS_PHY1_TCP_PKTS + off2),
++			readl(CLASS_PHY1_UDP_PKTS + off2));
++
++	len += sprintf(buf + len, "  err\n");
++	len += sprintf(buf + len,
++			"  lp:   %10u, intf: %10u, l3:    %10u, chcksum: %10u, ttl:  %10u\n",
++			readl(CLASS_PHY1_LP_FAIL_PKTS + off1),
++			readl(CLASS_PHY1_INTF_FAIL_PKTS + off1),
++			readl(CLASS_PHY1_L3_FAIL_PKTS + off1),
++			readl(CLASS_PHY1_CHKSUM_ERR_PKTS + off1),
++			readl(CLASS_PHY1_TTL_ERR_PKTS + off1));
++
++	return len;
++}
++
++/* qm_read_drop_stat
++ * This function is used to read the drop statistics from the TMU
++ * hw drop counter.  Since the hw counter is always cleared afer
++ * reading, this function maintains the previous drop count, and
++ * adds the new value to it.  That value can be retrieved by
++ * passing a pointer to it with the total_drops arg.
++ *
++ * @param tmu		TMU number (0 - 3)
++ * @param queue		queue number (0 - 15)
++ * @param total_drops	pointer to location to store total drops (or NULL)
++ * @param do_reset	if TRUE, clear total drops after updating
++ */
++u32 qm_read_drop_stat(u32 tmu, u32 queue, u32 *total_drops, int do_reset)
++{
++	static u32 qtotal[TMU_MAX_ID + 1][NUM_QUEUES];
++	u32 val;
++
++	writel((tmu << 8) | queue, TMU_TEQ_CTRL);
++	writel((tmu << 8) | queue, TMU_LLM_CTRL);
++	val = readl(TMU_TEQ_DROP_STAT);
++	qtotal[tmu][queue] += val;
++	if (total_drops)
++		*total_drops = qtotal[tmu][queue];
++	if (do_reset)
++		qtotal[tmu][queue] = 0;
++	return val;
++}
++
++static ssize_t tmu_queue_stats(char *buf, int tmu, int queue)
++{
++	ssize_t len = 0;
++	u32 drops;
++
++	len += sprintf(buf + len, "%d-%02d, ", tmu, queue);
++
++	drops = qm_read_drop_stat(tmu, queue, NULL, 0);
++
++	/* Select queue */
++	writel((tmu << 8) | queue, TMU_TEQ_CTRL);
++	writel((tmu << 8) | queue, TMU_LLM_CTRL);
++
++	len += sprintf(buf + len,
++			"(teq) drop: %10u, tx: %10u (llm) head: %08x, tail: %08x, drop: %10u\n",
++		drops, readl(TMU_TEQ_TRANS_STAT),
++		readl(TMU_LLM_QUE_HEADPTR), readl(TMU_LLM_QUE_TAILPTR),
++		readl(TMU_LLM_QUE_DROPCNT));
++
++	return len;
++}
++
++static ssize_t tmu_queues(char *buf, int tmu)
++{
++	ssize_t len = 0;
++	int queue;
++
++	for (queue = 0; queue < 16; queue++)
++		len += tmu_queue_stats(buf + len, tmu, queue);
++
++	return len;
++}
++
++static ssize_t block_version(char *buf, void *addr)
++{
++	ssize_t len = 0;
++	u32 val;
++
++	val = readl(addr);
++	len += sprintf(buf + len, "revision: %x, version: %x, id: %x\n",
++		(val >> 24) & 0xff, (val >> 16) & 0xff, val & 0xffff);
++
++	return len;
++}
++
++static ssize_t bmu(char *buf, int id, void *base)
++{
++	ssize_t len = 0;
++
++	len += sprintf(buf + len, "%s: %d\n  ", __func__, id);
++
++	len += block_version(buf + len, base + BMU_VERSION);
++
++	len += sprintf(buf + len, "  buf size:  %x\n", (1 << readl(base +
++			BMU_BUF_SIZE)));
++	len += sprintf(buf + len, "  buf count: %x\n", readl(base +
++			BMU_BUF_CNT));
++	len += sprintf(buf + len, "  buf rem:   %x\n", readl(base +
++			BMU_REM_BUF_CNT));
++	len += sprintf(buf + len, "  buf curr:  %x\n", readl(base +
++			BMU_CURR_BUF_CNT));
++	len += sprintf(buf + len, "  free err:  %x\n", readl(base +
++			BMU_FREE_ERR_ADDR));
++
++	return len;
++}
++
++static ssize_t gpi(char *buf, int id, void *base)
++{
++	ssize_t len = 0;
++	u32 val;
++
++	len += sprintf(buf + len, "%s%d:\n  ", __func__, id);
++	len += block_version(buf + len, base + GPI_VERSION);
++
++	len += sprintf(buf + len, "  tx under stick: %x\n", readl(base +
++			GPI_FIFO_STATUS));
++	val = readl(base + GPI_FIFO_DEBUG);
++	len += sprintf(buf + len, "  tx pkts:        %x\n", (val >> 23) &
++			0x3f);
++	len += sprintf(buf + len, "  rx pkts:        %x\n", (val >> 18) &
++			0x3f);
++	len += sprintf(buf + len, "  tx bytes:       %x\n", (val >> 9) &
++			0x1ff);
++	len += sprintf(buf + len, "  rx bytes:       %x\n", (val >> 0) &
++			0x1ff);
++	len += sprintf(buf + len, "  overrun:        %x\n", readl(base +
++			GPI_OVERRUN_DROPCNT));
++
++	return len;
++}
++
++static ssize_t pfe_set_class(struct device *dev, struct device_attribute *attr,
++			     const char *buf, size_t count)
++{
++	class_do_clear = kstrtoul(buf, 0, 0);
++	return count;
++}
++
++static ssize_t pfe_show_class(struct device *dev, struct device_attribute *attr,
++			      char *buf)
++{
++	ssize_t len = 0;
++	int id;
++	u32 val;
++	struct pfe_cpumon *cpumon = &pfe->cpumon;
++
++	len += block_version(buf + len, CLASS_VERSION);
++
++	for (id = CLASS0_ID; id <= CLASS_MAX_ID; id++) {
++		len += sprintf(buf + len, "%d: ", id - CLASS0_ID);
++
++		val = readl(CLASS_PE0_DEBUG + id * 4);
++		len += sprintf(buf + len, "pc=1%04x ", val & 0xffff);
++
++		len += display_pe_status(buf + len, id, CLASS_DM_PESTATUS,
++						class_do_clear);
++	}
++	len += sprintf(buf + len, "aggregate load=%d%%\n\n",
++			cpumon->class_usage_pct);
++
++	len += sprintf(buf + len, "pe status:   0x%x\n",
++			readl(CLASS_PE_STATUS));
++	len += sprintf(buf + len, "max buf cnt: 0x%x   afull thres: 0x%x\n",
++			readl(CLASS_MAX_BUF_CNT), readl(CLASS_AFULL_THRES));
++	len += sprintf(buf + len, "tsq max cnt: 0x%x   tsq fifo thres: 0x%x\n",
++			readl(CLASS_TSQ_MAX_CNT), readl(CLASS_TSQ_FIFO_THRES));
++	len += sprintf(buf + len, "state:       0x%x\n", readl(CLASS_STATE));
++
++	len += class_phy_stats(buf + len, 0);
++	len += class_phy_stats(buf + len, 1);
++	len += class_phy_stats(buf + len, 2);
++	len += class_phy_stats(buf + len, 3);
++
++	return len;
++}
++
++static ssize_t pfe_set_tmu(struct device *dev, struct device_attribute *attr,
++			   const char *buf, size_t count)
++{
++	tmu_do_clear = kstrtoul(buf, 0, 0);
++	return count;
++}
++
++static ssize_t pfe_show_tmu(struct device *dev, struct device_attribute *attr,
++			    char *buf)
++{
++	ssize_t len = 0;
++	int id;
++	u32 val;
++
++	len += block_version(buf + len, TMU_VERSION);
++
++	for (id = TMU0_ID; id <= TMU_MAX_ID; id++) {
++		if (id == TMU2_ID)
++			continue;
++		len += sprintf(buf + len, "%d: ", id - TMU0_ID);
++
++		len += display_pe_status(buf + len, id, TMU_DM_PESTATUS,
++						tmu_do_clear);
++	}
++
++	len += sprintf(buf + len, "pe status:    %x\n", readl(TMU_PE_STATUS));
++	len += sprintf(buf + len, "inq fifo cnt: %x\n",
++			readl(TMU_PHY_INQ_FIFO_CNT));
++	val = readl(TMU_INQ_STAT);
++	len += sprintf(buf + len, "inq wr ptr:     %x\n", val & 0x3ff);
++	len += sprintf(buf + len, "inq rd ptr:     %x\n", val >> 10);
++
++	return len;
++}
++
++static unsigned long drops_do_clear;
++static u32 class_drop_counter[CLASS_NUM_DROP_COUNTERS];
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++static u32 util_drop_counter[UTIL_NUM_DROP_COUNTERS];
++#endif
++
++char *class_drop_description[CLASS_NUM_DROP_COUNTERS] = {
++	"ICC",
++	"Host Pkt Error",
++	"Rx Error",
++	"IPsec Outbound",
++	"IPsec Inbound",
++	"EXPT IPsec Error",
++	"Reassembly",
++	"Fragmenter",
++	"NAT-T",
++	"Socket",
++	"Multicast",
++	"NAT-PT",
++	"Tx Disabled",
++};
++
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++char *util_drop_description[UTIL_NUM_DROP_COUNTERS] = {
++	"IPsec Outbound",
++	"IPsec Inbound",
++	"IPsec Rate Limiter",
++	"Fragmenter",
++	"Socket",
++	"Tx Disabled",
++	"Rx Error",
++};
++#endif
++
++static ssize_t pfe_set_drops(struct device *dev, struct device_attribute *attr,
++			     const char *buf, size_t count)
++{
++	drops_do_clear = kstrtoul(buf, 0, 0);
++	return count;
++}
++
++static u32 tmu_drops[4][16];
++static ssize_t pfe_show_drops(struct device *dev, struct device_attribute *attr,
++			      char *buf)
++{
++	ssize_t len = 0;
++	int id, dropnum;
++	int tmu, queue;
++	u32 val;
++	u32 dmem_addr;
++	int num_class_drops = 0, num_tmu_drops = 0, num_util_drops = 0;
++	struct pfe_ctrl *ctrl = &pfe->ctrl;
++
++	memset(class_drop_counter, 0, sizeof(class_drop_counter));
++	for (id = CLASS0_ID; id <= CLASS_MAX_ID; id++) {
++		if (drops_do_clear)
++			pe_sync_stop(ctrl, (1 << id));
++		for (dropnum = 0; dropnum < CLASS_NUM_DROP_COUNTERS;
++			dropnum++) {
++			dmem_addr = CLASS_DM_DROP_CNTR;
++			val = be32_to_cpu(pe_dmem_read(id, dmem_addr, 4));
++			class_drop_counter[dropnum] += val;
++			num_class_drops += val;
++			if (drops_do_clear)
++				pe_dmem_write(id, 0, dmem_addr, 4);
++		}
++		if (drops_do_clear)
++			pe_start(ctrl, (1 << id));
++	}
++
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++	if (drops_do_clear)
++		pe_sync_stop(ctrl, (1 << UTIL_ID));
++	for (dropnum = 0; dropnum < UTIL_NUM_DROP_COUNTERS; dropnum++) {
++		dmem_addr = UTIL_DM_DROP_CNTR;
++		val = be32_to_cpu(pe_dmem_read(UTIL_ID, dmem_addr, 4));
++		util_drop_counter[dropnum] = val;
++		num_util_drops += val;
++		if (drops_do_clear)
++			pe_dmem_write(UTIL_ID, 0, dmem_addr, 4);
++	}
++	if (drops_do_clear)
++		pe_start(ctrl, (1 << UTIL_ID));
++#endif
++	for (tmu = 0; tmu < 4; tmu++) {
++		for (queue = 0; queue < 16; queue++) {
++			qm_read_drop_stat(tmu, queue, &tmu_drops[tmu][queue],
++					  drops_do_clear);
++			num_tmu_drops += tmu_drops[tmu][queue];
++		}
++	}
++
++	if (num_class_drops == 0 && num_util_drops == 0 && num_tmu_drops == 0)
++		len += sprintf(buf + len, "No PE drops\n\n");
++
++	if (num_class_drops > 0) {
++		len += sprintf(buf + len, "Class PE drops --\n");
++		for (dropnum = 0; dropnum < CLASS_NUM_DROP_COUNTERS;
++			dropnum++) {
++			if (class_drop_counter[dropnum] > 0)
++				len += sprintf(buf + len, "  %s: %d\n",
++					class_drop_description[dropnum],
++					class_drop_counter[dropnum]);
++		}
++		len += sprintf(buf + len, "\n");
++	}
++
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++	if (num_util_drops > 0) {
++		len += sprintf(buf + len, "Util PE drops --\n");
++		for (dropnum = 0; dropnum < UTIL_NUM_DROP_COUNTERS; dropnum++) {
++			if (util_drop_counter[dropnum] > 0)
++				len += sprintf(buf + len, "  %s: %d\n",
++					util_drop_description[dropnum],
++					util_drop_counter[dropnum]);
++		}
++		len += sprintf(buf + len, "\n");
++	}
++#endif
++	if (num_tmu_drops > 0) {
++		len += sprintf(buf + len, "TMU drops --\n");
++		for (tmu = 0; tmu < 4; tmu++) {
++			for (queue = 0; queue < 16; queue++) {
++				if (tmu_drops[tmu][queue] > 0)
++					len += sprintf(buf + len,
++						"  TMU%d-Q%d: %d\n"
++					, tmu, queue, tmu_drops[tmu][queue]);
++			}
++		}
++		len += sprintf(buf + len, "\n");
++	}
++
++	return len;
++}
++
++static ssize_t pfe_show_tmu0_queues(struct device *dev, struct device_attribute
++					*attr, char *buf)
++{
++	return tmu_queues(buf, 0);
++}
++
++static ssize_t pfe_show_tmu1_queues(struct device *dev, struct device_attribute
++					*attr, char *buf)
++{
++	return tmu_queues(buf, 1);
++}
++
++static ssize_t pfe_show_tmu2_queues(struct device *dev, struct device_attribute
++					*attr, char *buf)
++{
++	return tmu_queues(buf, 2);
++}
++
++static ssize_t pfe_show_tmu3_queues(struct device *dev, struct device_attribute
++					*attr, char *buf)
++{
++	return tmu_queues(buf, 3);
++}
++
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++static ssize_t pfe_set_util(struct device *dev, struct device_attribute *attr,
++			    const char *buf, size_t count)
++{
++	util_do_clear = kstrtoul(buf, 0, 0);
++	return count;
++}
++
++static ssize_t pfe_show_util(struct device *dev, struct device_attribute *attr,
++			     char *buf)
++{
++	ssize_t len = 0;
++	struct pfe_ctrl *ctrl = &pfe->ctrl;
++
++	len += block_version(buf + len, UTIL_VERSION);
++
++	pe_sync_stop(ctrl, (1 << UTIL_ID));
++	len += display_pe_status(buf + len, UTIL_ID, UTIL_DM_PESTATUS,
++					util_do_clear);
++	pe_start(ctrl, (1 << UTIL_ID));
++
++	len += sprintf(buf + len, "pe status:   %x\n", readl(UTIL_PE_STATUS));
++	len += sprintf(buf + len, "max buf cnt: %x\n",
++			readl(UTIL_MAX_BUF_CNT));
++	len += sprintf(buf + len, "tsq max cnt: %x\n",
++			readl(UTIL_TSQ_MAX_CNT));
++
++	return len;
++}
++#endif
++
++static ssize_t pfe_show_bmu(struct device *dev, struct device_attribute *attr,
++			    char *buf)
++{
++	ssize_t len = 0;
++
++	len += bmu(buf + len, 1, BMU1_BASE_ADDR);
++	len += bmu(buf + len, 2, BMU2_BASE_ADDR);
++
++	return len;
++}
++
++static ssize_t pfe_show_hif(struct device *dev, struct device_attribute *attr,
++			    char *buf)
++{
++	ssize_t len = 0;
++
++	len += sprintf(buf + len, "hif:\n  ");
++	len += block_version(buf + len, HIF_VERSION);
++
++	len += sprintf(buf + len, "  tx curr bd:    %x\n",
++			readl(HIF_TX_CURR_BD_ADDR));
++	len += sprintf(buf + len, "  tx status:     %x\n",
++			readl(HIF_TX_STATUS));
++	len += sprintf(buf + len, "  tx dma status: %x\n",
++			readl(HIF_TX_DMA_STATUS));
++
++	len += sprintf(buf + len, "  rx curr bd:    %x\n",
++			readl(HIF_RX_CURR_BD_ADDR));
++	len += sprintf(buf + len, "  rx status:     %x\n",
++			readl(HIF_RX_STATUS));
++	len += sprintf(buf + len, "  rx dma status: %x\n",
++			readl(HIF_RX_DMA_STATUS));
++
++	len += sprintf(buf + len, "hif nocopy:\n  ");
++	len += block_version(buf + len, HIF_NOCPY_VERSION);
++
++	len += sprintf(buf + len, "  tx curr bd:    %x\n",
++			readl(HIF_NOCPY_TX_CURR_BD_ADDR));
++	len += sprintf(buf + len, "  tx status:     %x\n",
++			readl(HIF_NOCPY_TX_STATUS));
++	len += sprintf(buf + len, "  tx dma status: %x\n",
++			readl(HIF_NOCPY_TX_DMA_STATUS));
++
++	len += sprintf(buf + len, "  rx curr bd:    %x\n",
++			readl(HIF_NOCPY_RX_CURR_BD_ADDR));
++	len += sprintf(buf + len, "  rx status:     %x\n",
++			readl(HIF_NOCPY_RX_STATUS));
++	len += sprintf(buf + len, "  rx dma status: %x\n",
++			readl(HIF_NOCPY_RX_DMA_STATUS));
++
++	return len;
++}
++
++static ssize_t pfe_show_gpi(struct device *dev, struct device_attribute *attr,
++			    char *buf)
++{
++	ssize_t len = 0;
++
++	len += gpi(buf + len, 0, EGPI1_BASE_ADDR);
++	len += gpi(buf + len, 1, EGPI2_BASE_ADDR);
++	len += gpi(buf + len, 3, HGPI_BASE_ADDR);
++
++	return len;
++}
++
++static ssize_t pfe_show_pfemem(struct device *dev, struct device_attribute
++				*attr, char *buf)
++{
++	ssize_t len = 0;
++	struct pfe_memmon *memmon = &pfe->memmon;
++
++	len += sprintf(buf + len, "Kernel Memory: %d Bytes (%d KB)\n",
++		memmon->kernel_memory_allocated,
++		(memmon->kernel_memory_allocated + 1023) / 1024);
++
++	return len;
++}
++
++static ssize_t pfe_show_crc_revalidated(struct device *dev,
++					struct device_attribute *attr,
++					char *buf)
++{
++	u64 crc_validated = 0;
++	ssize_t len = 0;
++	int id, phyid;
++
++	len += sprintf(buf + len, "FCS re-validated by PFE:\n");
++
++	for (phyid = 0; phyid < 2; phyid++) {
++		crc_validated = 0;
++		for (id = CLASS0_ID; id <= CLASS_MAX_ID; id++) {
++			crc_validated += be32_to_cpu(pe_dmem_read(id,
++				CLASS_DM_CRC_VALIDATED + (phyid * 4), 4));
++		}
++		len += sprintf(buf + len, "MAC %d:\n    count:%10llu\n",
++			       phyid, crc_validated);
++	}
++
++	return len;
++}
++
++#ifdef HIF_NAPI_STATS
++static ssize_t pfe_show_hif_napi_stats(struct device *dev,
++				       struct device_attribute *attr,
++				       char *buf)
++{
++	struct platform_device *pdev = to_platform_device(dev);
++	struct pfe *pfe = platform_get_drvdata(pdev);
++	ssize_t len = 0;
++
++	len += sprintf(buf + len, "sched:  %u\n",
++			pfe->hif.napi_counters[NAPI_SCHED_COUNT]);
++	len += sprintf(buf + len, "poll:   %u\n",
++			pfe->hif.napi_counters[NAPI_POLL_COUNT]);
++	len += sprintf(buf + len, "packet: %u\n",
++			pfe->hif.napi_counters[NAPI_PACKET_COUNT]);
++	len += sprintf(buf + len, "budget: %u\n",
++			pfe->hif.napi_counters[NAPI_FULL_BUDGET_COUNT]);
++	len += sprintf(buf + len, "desc:   %u\n",
++			pfe->hif.napi_counters[NAPI_DESC_COUNT]);
++	len += sprintf(buf + len, "full:   %u\n",
++			pfe->hif.napi_counters[NAPI_CLIENT_FULL_COUNT]);
++
++	return len;
++}
++
++static ssize_t pfe_set_hif_napi_stats(struct device *dev,
++				      struct device_attribute *attr,
++					const char *buf, size_t count)
++{
++	struct platform_device *pdev = to_platform_device(dev);
++	struct pfe *pfe = platform_get_drvdata(pdev);
++
++	memset(pfe->hif.napi_counters, 0, sizeof(pfe->hif.napi_counters));
++
++	return count;
++}
++
++static DEVICE_ATTR(hif_napi_stats, 0644, pfe_show_hif_napi_stats,
++			pfe_set_hif_napi_stats);
++#endif
++
++static DEVICE_ATTR(class, 0644, pfe_show_class, pfe_set_class);
++static DEVICE_ATTR(tmu, 0644, pfe_show_tmu, pfe_set_tmu);
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++static DEVICE_ATTR(util, 0644, pfe_show_util, pfe_set_util);
++#endif
++static DEVICE_ATTR(bmu, 0444, pfe_show_bmu, NULL);
++static DEVICE_ATTR(hif, 0444, pfe_show_hif, NULL);
++static DEVICE_ATTR(gpi, 0444, pfe_show_gpi, NULL);
++static DEVICE_ATTR(drops, 0644, pfe_show_drops, pfe_set_drops);
++static DEVICE_ATTR(tmu0_queues, 0444, pfe_show_tmu0_queues, NULL);
++static DEVICE_ATTR(tmu1_queues, 0444, pfe_show_tmu1_queues, NULL);
++static DEVICE_ATTR(tmu2_queues, 0444, pfe_show_tmu2_queues, NULL);
++static DEVICE_ATTR(tmu3_queues, 0444, pfe_show_tmu3_queues, NULL);
++static DEVICE_ATTR(pfemem, 0444, pfe_show_pfemem, NULL);
++static DEVICE_ATTR(fcs_revalidated, 0444, pfe_show_crc_revalidated, NULL);
++
++int pfe_sysfs_init(struct pfe *pfe)
++{
++	if (device_create_file(pfe->dev, &dev_attr_class))
++		goto err_class;
++
++	if (device_create_file(pfe->dev, &dev_attr_tmu))
++		goto err_tmu;
++
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++	if (device_create_file(pfe->dev, &dev_attr_util))
++		goto err_util;
++#endif
++
++	if (device_create_file(pfe->dev, &dev_attr_bmu))
++		goto err_bmu;
++
++	if (device_create_file(pfe->dev, &dev_attr_hif))
++		goto err_hif;
++
++	if (device_create_file(pfe->dev, &dev_attr_gpi))
++		goto err_gpi;
++
++	if (device_create_file(pfe->dev, &dev_attr_drops))
++		goto err_drops;
++
++	if (device_create_file(pfe->dev, &dev_attr_tmu0_queues))
++		goto err_tmu0_queues;
++
++	if (device_create_file(pfe->dev, &dev_attr_tmu1_queues))
++		goto err_tmu1_queues;
++
++	if (device_create_file(pfe->dev, &dev_attr_tmu2_queues))
++		goto err_tmu2_queues;
++
++	if (device_create_file(pfe->dev, &dev_attr_tmu3_queues))
++		goto err_tmu3_queues;
++
++	if (device_create_file(pfe->dev, &dev_attr_pfemem))
++		goto err_pfemem;
++
++	if (device_create_file(pfe->dev, &dev_attr_fcs_revalidated))
++		goto err_crc_revalidated;
++
++#ifdef HIF_NAPI_STATS
++	if (device_create_file(pfe->dev, &dev_attr_hif_napi_stats))
++		goto err_hif_napi_stats;
++#endif
++
++	return 0;
++
++#ifdef HIF_NAPI_STATS
++err_hif_napi_stats:
++	device_remove_file(pfe->dev, &dev_attr_fcs_revalidated);
++#endif
++
++err_crc_revalidated:
++	device_remove_file(pfe->dev, &dev_attr_pfemem);
++
++err_pfemem:
++	device_remove_file(pfe->dev, &dev_attr_tmu3_queues);
++
++err_tmu3_queues:
++	device_remove_file(pfe->dev, &dev_attr_tmu2_queues);
++
++err_tmu2_queues:
++	device_remove_file(pfe->dev, &dev_attr_tmu1_queues);
++
++err_tmu1_queues:
++	device_remove_file(pfe->dev, &dev_attr_tmu0_queues);
++
++err_tmu0_queues:
++	device_remove_file(pfe->dev, &dev_attr_drops);
++
++err_drops:
++	device_remove_file(pfe->dev, &dev_attr_gpi);
++
++err_gpi:
++	device_remove_file(pfe->dev, &dev_attr_hif);
++
++err_hif:
++	device_remove_file(pfe->dev, &dev_attr_bmu);
++
++err_bmu:
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++	device_remove_file(pfe->dev, &dev_attr_util);
++
++err_util:
++#endif
++	device_remove_file(pfe->dev, &dev_attr_tmu);
++
++err_tmu:
++	device_remove_file(pfe->dev, &dev_attr_class);
++
++err_class:
++	return -1;
++}
++
++void pfe_sysfs_exit(struct pfe *pfe)
++{
++#ifdef HIF_NAPI_STATS
++	device_remove_file(pfe->dev, &dev_attr_hif_napi_stats);
++#endif
++	device_remove_file(pfe->dev, &dev_attr_fcs_revalidated);
++	device_remove_file(pfe->dev, &dev_attr_pfemem);
++	device_remove_file(pfe->dev, &dev_attr_tmu3_queues);
++	device_remove_file(pfe->dev, &dev_attr_tmu2_queues);
++	device_remove_file(pfe->dev, &dev_attr_tmu1_queues);
++	device_remove_file(pfe->dev, &dev_attr_tmu0_queues);
++	device_remove_file(pfe->dev, &dev_attr_drops);
++	device_remove_file(pfe->dev, &dev_attr_gpi);
++	device_remove_file(pfe->dev, &dev_attr_hif);
++	device_remove_file(pfe->dev, &dev_attr_bmu);
++#if !defined(CONFIG_FSL_PPFE_UTIL_DISABLED)
++	device_remove_file(pfe->dev, &dev_attr_util);
++#endif
++	device_remove_file(pfe->dev, &dev_attr_tmu);
++	device_remove_file(pfe->dev, &dev_attr_class);
++}
+--- /dev/null
++++ b/drivers/staging/fsl_ppfe/pfe_sysfs.h
+@@ -0,0 +1,17 @@
++/* SPDX-License-Identifier: GPL-2.0+ */
++/*
++ * Copyright 2015-2016 Freescale Semiconductor, Inc.
++ * Copyright 2017 NXP
++ */
++
++#ifndef _PFE_SYSFS_H_
++#define _PFE_SYSFS_H_
++
++#include <linux/proc_fs.h>
++
++u32 qm_read_drop_stat(u32 tmu, u32 queue, u32 *total_drops, int do_reset);
++
++int pfe_sysfs_init(struct pfe *pfe);
++void pfe_sysfs_exit(struct pfe *pfe);
++
++#endif /* _PFE_SYSFS_H_ */
diff --git a/target/linux/layerscape/patches-5.15/702-phy-Add-2.5G-SGMII-interface-mode.patch b/target/linux/layerscape/patches-5.15/702-phy-Add-2.5G-SGMII-interface-mode.patch
new file mode 100644
index 00000000000000..30fc56e618503c
--- /dev/null
+++ b/target/linux/layerscape/patches-5.15/702-phy-Add-2.5G-SGMII-interface-mode.patch
@@ -0,0 +1,53 @@
+From c918c472546afa83a619ae3cb1a9d7d346c6e288 Mon Sep 17 00:00:00 2001
+From: Bhaskar Upadhaya <Bhaskar.Upadhaya@nxp.com>
+Date: Wed, 29 Nov 2017 15:27:57 +0530
+Subject: [PATCH 154/173] phy: Add 2.5G SGMII interface mode
+
+Add 2.5G SGMII interface mode(PHY_INTERFACE_MODE_2500SGMII)
+in existing phy_interface list
+
+Signed-off-by: Bhaskar Upadhaya <Bhaskar.Upadhaya@nxp.com>
+---
+ include/linux/phy.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -393,6 +393,7 @@ void phylink_get_linkmodes(unsigned long
+ 		caps |= MAC_1000FD;
+ 		break;
+ 
++	case PHY_INTERFACE_MODE_2500SGMII:
+ 	case PHY_INTERFACE_MODE_2500BASEX:
+ 		caps |= MAC_2500FD;
+ 		break;
+@@ -646,6 +647,10 @@ static int phylink_parse_mode(struct phy
+ 			phylink_set(pl->supported, 2500baseX_Full);
+ 			break;
+ 
++		case PHY_INTERFACE_MODE_2500SGMII:
++			phylink_set(pl->supported, 2500baseT_Full);
++			break;
++
+ 		case PHY_INTERFACE_MODE_5GBASER:
+ 			phylink_set(pl->supported, 5000baseT_Full);
+ 			break;
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -153,6 +153,7 @@ typedef enum {
+ 	PHY_INTERFACE_MODE_USXGMII,
+ 	/* 10GBASE-KR - with Clause 73 AN */
+ 	PHY_INTERFACE_MODE_10GKR,
++	PHY_INTERFACE_MODE_2500SGMII,
+ 	PHY_INTERFACE_MODE_MAX,
+ } phy_interface_t;
+ 
+@@ -268,6 +269,8 @@ static inline const char *phy_modes(phy_
+ 		return "10gbase-kr";
+ 	case PHY_INTERFACE_MODE_100BASEX:
+ 		return "100base-x";
++	case PHY_INTERFACE_MODE_2500SGMII:
++		return "sgmii-2500";
+ 	default:
+ 		return "unknown";
+ 	}
diff --git a/target/linux/malta/Makefile b/target/linux/malta/Makefile
index 7259cff4e98e2a..bff63a1dd4bd2c 100644
--- a/target/linux/malta/Makefile
+++ b/target/linux/malta/Makefile
@@ -10,11 +10,11 @@ SUBTARGETS:=le be le64 be64
 INITRAMFS_EXTRA_FILES:=
 FEATURES:=cpiogz ext4 ramdisk squashfs targz
 
-KERNEL_PATCHVER:=5.10
-KERNEL_TESTING_PATCHVER:=5.15
+KERNEL_PATCHVER:=5.15
+KERNEL_TESTING_PATCHVER:=6.1
 
 include $(INCLUDE_DIR)/target.mk
 
-DEFAULT_PACKAGES += wpad-basic-wolfssl kmod-mac80211-hwsim kmod-pcnet32 mkf2fs e2fsprogs
+DEFAULT_PACKAGES += wpad-basic-mbedtls kmod-mac80211-hwsim kmod-pcnet32 mkf2fs e2fsprogs
 
 $(eval $(call BuildTarget))
diff --git a/target/linux/malta/be/config-default b/target/linux/malta/be/config-default
index 5586be6b7c463f..0e7faa0877daf6 100644
--- a/target/linux/malta/be/config-default
+++ b/target/linux/malta/be/config-default
@@ -1,4 +1,3 @@
 CONFIG_CPU_BIG_ENDIAN=y
-# CONFIG_CPU_LITTLE_ENDIAN is not set
 CONFIG_CPU_MIPS32_R2=y
 CONFIG_HIGHMEM=y
diff --git a/target/linux/malta/be64/config-default b/target/linux/malta/be64/config-default
index ef044bb8ca07bb..a7e88feda04dbf 100644
--- a/target/linux/malta/be64/config-default
+++ b/target/linux/malta/be64/config-default
@@ -2,7 +2,6 @@
 CONFIG_64BIT=y
 CONFIG_ARCH_MMAP_RND_BITS=12
 CONFIG_CPU_BIG_ENDIAN=y
-# CONFIG_CPU_LITTLE_ENDIAN is not set
 CONFIG_CPU_MIPS64_R2=y
 # CONFIG_MIPS32_N32 is not set
 # CONFIG_MIPS32_O32 is not set
diff --git a/target/linux/malta/config-6.1 b/target/linux/malta/config-6.1
new file mode 100644
index 00000000000000..9411879835b394
--- /dev/null
+++ b/target/linux/malta/config-6.1
@@ -0,0 +1,267 @@
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_FORCE_MAX_ORDER=11
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+CONFIG_ARCH_MIGHT_HAVE_PC_SERIO=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_ATA=y
+CONFIG_ATA_PIIX=y
+CONFIG_BLK_DEV_BSG=y
+CONFIG_BLK_DEV_BSGLIB=y
+CONFIG_BLK_DEV_BSG_COMMON=y
+# CONFIG_BLK_DEV_INITRD is not set
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BOARD_SCACHE=y
+CONFIG_BOOT_ELF32=y
+CONFIG_BUILTIN_DTB=y
+CONFIG_CEVT_R4K=y
+CONFIG_CLKBLD_I8253=y
+CONFIG_CLKEVT_I8253=y
+CONFIG_CLKSRC_I8253=y
+CONFIG_CLKSRC_MIPS_GIC=y
+CONFIG_CLOCKSOURCE_WATCHDOG=y
+CONFIG_CLOCKSOURCE_WATCHDOG_MAX_SKEW_US=100
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_PREFETCH=y
+# CONFIG_CPU_HAS_SMARTMIPS is not set
+CONFIG_CPU_HAS_SYNC=y
+# CONFIG_CPU_MICROMIPS is not set
+# CONFIG_CPU_MIPS32 is not set
+# CONFIG_CPU_MIPS32_3_5_FEATURES is not set
+# CONFIG_CPU_MIPS32_R1 is not set
+# CONFIG_CPU_MIPS32_R2 is not set
+# CONFIG_CPU_MIPS32_R5 is not set
+# CONFIG_CPU_MIPS32_R5_FEATURES is not set
+# CONFIG_CPU_MIPS32_R6 is not set
+# CONFIG_CPU_MIPS64_R1 is not set
+# CONFIG_CPU_MIPS64_R2 is not set
+# CONFIG_CPU_MIPS64_R6 is not set
+# CONFIG_CPU_MIPSR1 is not set
+# CONFIG_CPU_MIPSR2 is not set
+# CONFIG_CPU_MIPSR2_IRQ_EI is not set
+# CONFIG_CPU_MIPSR2_IRQ_VI is not set
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+# CONFIG_CPU_NEVADA is not set
+CONFIG_CPU_R4K_CACHE_TLB=y
+# CONFIG_CPU_RM7000 is not set
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_BLAKE2S=y
+CONFIG_CRYPTO_CRC32=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CSRC_R4K=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_DNOTIFY=y
+CONFIG_DTC=y
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_EXT4_FS=y
+CONFIG_F2FS_FS=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FS_POSIX_ACL=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_ISA_DMA=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GLOB=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDWARE_WATCHPOINTS=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HW_CONSOLE=y
+CONFIG_I8253=y
+CONFIG_I8253_LOCK=y
+CONFIG_I8259=y
+CONFIG_INPUT=y
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_MOUSEDEV_PSAUX=y
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+CONFIG_ISA_DMA_API=y
+CONFIG_JBD2=y
+CONFIG_JFFS2_FS_POSIX_ACL=y
+CONFIG_JFFS2_FS_SECURITY=y
+CONFIG_KALLSYMS=y
+CONFIG_KERNEL_GZIP=y
+# CONFIG_KERNEL_XZ is not set
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_MD=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+CONFIG_MIPS_BONITO64=y
+CONFIG_MIPS_CLOCK_VSYSCALL=y
+CONFIG_MIPS_CM=y
+CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER=y
+CONFIG_MIPS_CPC=y
+CONFIG_MIPS_CPU_SCACHE=y
+CONFIG_MIPS_EBPF_JIT=y
+CONFIG_MIPS_EXTERNAL_TIMER=y
+CONFIG_MIPS_GIC=y
+CONFIG_MIPS_L1_CACHE_SHIFT=6
+CONFIG_MIPS_L1_CACHE_SHIFT_6=y
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+CONFIG_MIPS_MALTA=y
+CONFIG_MIPS_MSC=y
+CONFIG_MIPS_MT=y
+CONFIG_MIPS_MT_FPAFF=y
+CONFIG_MIPS_MT_SMP=y
+CONFIG_MIPS_NO_APPENDED_DTB=y
+CONFIG_MIPS_NR_CPU_NR_MAP=2
+CONFIG_MIPS_PERF_SHARED_TC_COUNTERS=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+CONFIG_MTD_CFI_STAA=y
+# CONFIG_MTD_COMPLEX_MAPPINGS is not set
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NLS=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+CONFIG_NO_HZ=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NR_CPUS=2
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_PADATA=y
+# CONFIG_PARTITION_ADVANCED is not set
+CONFIG_PATA_LEGACY=y
+CONFIG_PATA_TIMINGS=y
+CONFIG_PCI=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DRIVERS_LEGACY=y
+CONFIG_PCI_GT64XXX_PCI0=y
+CONFIG_PCSPKR_PLATFORM=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_PIIX4_POWEROFF=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_PRINT_QUOTA_WARNING=y
+CONFIG_PROC_PAGE_MONITOR=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QFMT_V2=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_QUOTA=y
+CONFIG_QUOTACTL=y
+CONFIG_QUOTA_TREE=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RELAY=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_MC146818_LIB=y
+CONFIG_SATA_HOST=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+CONFIG_SECCOMP=y
+CONFIG_SECCOMP_FILTER=y
+CONFIG_SERIAL_8250_NR_UARTS=4
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
+CONFIG_SERIO=y
+CONFIG_SERIO_SERPORT=y
+CONFIG_SG_POOL=y
+CONFIG_SMP=y
+CONFIG_SMP_UP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SRCU=y
+CONFIG_SWAP_IO_SPACE=y
+CONFIG_SYNC_R4K=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYSFS_DEPRECATED=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_SYS_HAS_CPU_MIPS32_R1=y
+CONFIG_SYS_HAS_CPU_MIPS32_R2=y
+CONFIG_SYS_HAS_CPU_MIPS32_R3_5=y
+CONFIG_SYS_HAS_CPU_MIPS32_R5=y
+CONFIG_SYS_HAS_CPU_MIPS32_R6=y
+CONFIG_SYS_HAS_CPU_MIPS64_R1=y
+CONFIG_SYS_HAS_CPU_MIPS64_R2=y
+CONFIG_SYS_HAS_CPU_MIPS64_R6=y
+CONFIG_SYS_HAS_CPU_NEVADA=y
+CONFIG_SYS_HAS_CPU_RM7000=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_64BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+CONFIG_SYS_SUPPORTS_HIGHMEM=y
+CONFIG_SYS_SUPPORTS_LITTLE_ENDIAN=y
+CONFIG_SYS_SUPPORTS_MICROMIPS=y
+CONFIG_SYS_SUPPORTS_MIPS16=y
+CONFIG_SYS_SUPPORTS_MIPS_CMP=y
+CONFIG_SYS_SUPPORTS_MIPS_CPS=y
+CONFIG_SYS_SUPPORTS_MULTITHREADING=y
+CONFIG_SYS_SUPPORTS_RELOCATABLE=y
+CONFIG_SYS_SUPPORTS_SCHED_SMT=y
+CONFIG_SYS_SUPPORTS_SMARTMIPS=y
+CONFIG_SYS_SUPPORTS_SMP=y
+CONFIG_SYS_SUPPORTS_VPE_LOADER=y
+CONFIG_SYS_SUPPORTS_ZBOOT=y
+CONFIG_TARGET_ISA_REV=1
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_OF=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_VXFS_FS=y
+CONFIG_WAR_ICACHE_REFILLS=y
+CONFIG_XPS=y
+CONFIG_ZBOOT_LOAD_ADDRESS=0x0
diff --git a/target/linux/mediatek/base-files/lib/preinit/05_set_preinit_iface b/target/linux/mediatek/base-files/lib/preinit/05_set_preinit_iface
index 3ac856d1c45b6c..5e7fc81ad8263d 100644
--- a/target/linux/mediatek/base-files/lib/preinit/05_set_preinit_iface
+++ b/target/linux/mediatek/base-files/lib/preinit/05_set_preinit_iface
@@ -1,11 +1,15 @@
 set_preinit_iface() {
-	ip link set eth0 up
-
 	case $(board_name) in
+	glinet,gl-mt3000)
+		ip link set eth1 up
+		ifname=eth1
+		;;
 	ubnt,unifi-6-lr)
+		ip link set eth0 up
 		ifname=eth0
 		;;
 	*)
+		ip link set eth0 up
 		ifname=lan1
 		;;
 	esac
diff --git a/target/linux/mediatek/dts/mt7622-elecom-wrc-x3200gst3.dts b/target/linux/mediatek/dts/mt7622-elecom-wrc-x3200gst3.dts
index fdbcbc18bce8c9..c7e11c80b05990 100644
--- a/target/linux/mediatek/dts/mt7622-elecom-wrc-x3200gst3.dts
+++ b/target/linux/mediatek/dts/mt7622-elecom-wrc-x3200gst3.dts
@@ -258,7 +258,6 @@
 
 				port@6 {
 					reg = <6>;
-					label = "cpu";
 					ethernet = <&gmac0>;
 					phy-mode = "2500base-x";
 
diff --git a/target/linux/mediatek/dts/mt7622-linksys-e8450.dtsi b/target/linux/mediatek/dts/mt7622-linksys-e8450.dtsi
index 1fe839575ed058..abac02a72d022e 100644
--- a/target/linux/mediatek/dts/mt7622-linksys-e8450.dtsi
+++ b/target/linux/mediatek/dts/mt7622-linksys-e8450.dtsi
@@ -181,7 +181,6 @@
 
 				port@6 {
 					reg = <6>;
-					label = "cpu";
 					ethernet = <&gmac0>;
 					phy-mode = "2500base-x";
 
diff --git a/target/linux/mediatek/dts/mt7622-netgear-wax206.dts b/target/linux/mediatek/dts/mt7622-netgear-wax206.dts
new file mode 100644
index 00000000000000..9e877b85f16d44
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7622-netgear-wax206.dts
@@ -0,0 +1,558 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/* Copyright (c) 2022, Marcel Ziswiler <marcel@ziswiler.com> */
+
+/dts-v1/;
+#include "mt7622.dtsi"
+#include "mt6380.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Netgear WAX206";
+	compatible = "netgear,wax206", "mediatek,mt7622";
+
+	aliases {
+		ethernet0 = &gmac0;
+		led-boot = &led_power_r;
+		led-failsafe = &led_power_r;
+		led-running = &led_power_g;
+		led-upgrade = &led_power_g;
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs = "earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n8 swiotlb=512";
+	};
+
+	cpus {
+		cpu@0 {
+			proc-supply = <&mt6380_vcpu_reg>;
+			sram-supply = <&mt6380_vm_reg>;
+		};
+
+		cpu@1 {
+			proc-supply = <&mt6380_vcpu_reg>;
+			sram-supply = <&mt6380_vm_reg>;
+		};
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			gpios = <&pio 102 GPIO_ACTIVE_LOW>;
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		led_power_r: power_red {
+			default-state = "on";
+			gpios = <&pio 3 GPIO_ACTIVE_LOW>;
+			label = "power:red";
+		};
+
+		led_power_g: power_green {
+			default-state = "off";
+			gpios = <&pio 4 GPIO_ACTIVE_LOW>;
+			label = "power:green";
+		};
+
+		inet_green {
+			default-state = "off";
+			gpios = <&pio 20 GPIO_ACTIVE_HIGH>;
+			label = "inet:green";
+		};
+
+		inet_blue {
+			default-state = "off";
+			gpios = <&pio 17 GPIO_ACTIVE_LOW>;
+			label = "inet:blue";
+		};
+
+		wifin_green {
+			default-state = "off";
+			gpios = <&pio 85 GPIO_ACTIVE_LOW>;
+			label = "wifin:green";
+		};
+
+		wifin_blue {
+			default-state = "off";
+			gpios = <&pio 86 GPIO_ACTIVE_LOW>;
+			label = "wifin:blue";
+		};
+
+		wifia_green {
+			default-state = "off";
+			gpios = <&pio 2 GPIO_ACTIVE_HIGH>;
+			label = "wifia:green";
+		};
+
+		wifia_blue {
+			default-state = "off";
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+			label = "wifia:blue";
+		};
+	};
+
+	memory {
+		reg = <0 0x40000000 0 0x40000000>;
+	};
+};
+
+&bch {
+	status = "okay";
+};
+
+&btif {
+	status = "okay";
+};
+
+&cir {
+	pinctrl-names = "default";
+	pinctrl-0 = <&irrx_pins>;
+	status = "okay";
+};
+
+&eth {
+	pinctrl-names = "default";
+	pinctrl-0 = <&eth_pins>;
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		nvmem-cells = <&macaddr_factory_7fff4>;
+		nvmem-cell-names = "mac-address";
+		phy-mode = "2500base-x";
+		reg = <0>;
+
+		fixed-link {
+			full-duplex;
+			pause;
+			speed = <2500>;
+		};
+	};
+
+	mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		switch@0 {
+			compatible = "mediatek,mt7531";
+			#interrupt-cells = <1>;
+			interrupt-controller;
+			interrupt-parent = <&pio>;
+			interrupts = <53 IRQ_TYPE_LEVEL_HIGH>;
+			reg = <0>;
+			reset-gpios = <&pio 54 GPIO_ACTIVE_HIGH>;
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@1 {
+					label = "lan1";
+					reg = <1>;
+				};
+
+				port@2 {
+					label = "lan2";
+					reg = <2>;
+				};
+
+				port@3 {
+					label = "lan3";
+					reg = <3>;
+				};
+
+				port@4 {
+					label = "lan4";
+					reg = <4>;
+				};
+
+				wan: port@5 {
+					label = "wan";
+					nvmem-cells = <&macaddr_factory_7fffa>;
+					nvmem-cell-names = "mac-address";
+					phy-handle = <&rtl8221b_phy>;
+					phy-mode = "2500base-x";
+					reg = <5>;
+				};
+
+				port@6 {
+					ethernet = <&gmac0>;
+					phy-mode = "2500base-x";
+					reg = <6>;
+
+					fixed-link {
+						full-duplex;
+						pause;
+						speed = <2500>;
+					};
+				};
+			};
+		};
+
+		rtl8221b_phy: ethernet-phy@7 {
+			compatible = "ethernet-phy-ieee802.3-c45";
+			reg = <7>;
+			reset-gpios = <&pio 101 GPIO_ACTIVE_LOW>;
+			interrupts = <52 IRQ_TYPE_LEVEL_HIGH>;
+			reset-assert-us = <100000>;
+			reset-deassert-us = <100000>;
+		};
+	};
+};
+
+&pcie0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie0_pins>;
+	status = "okay";
+};
+
+&pcie1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie1_pins>;
+	status = "okay";
+};
+
+&pio {
+	eth_pins: eth-pins {
+		mux {
+			function = "eth";
+			groups = "mdc_mdio", "rgmii_via_gmac2";
+		};
+	};
+
+	irrx_pins: irrx-pins {
+		mux {
+			function = "ir";
+			groups =  "ir_1_rx";
+		};
+	};
+
+	irtx_pins: irtx-pins {
+		mux {
+			function = "ir";
+			groups =  "ir_1_tx";
+		};
+	};
+
+	pcie0_pins: pcie0-pins {
+		mux {
+			function = "pcie";
+			groups = "pcie0_pad_perst",
+				 "pcie0_1_waken",
+				 "pcie0_1_clkreq";
+		};
+	};
+
+	pcie1_pins: pcie1-pins {
+		mux {
+			function = "pcie";
+			groups = "pcie1_pad_perst",
+				 "pcie1_0_waken",
+				 "pcie1_0_clkreq";
+		};
+	};
+
+	pmic_bus_pins: pmic-bus-pins {
+		mux {
+			function = "pmic";
+			groups = "pmic_bus";
+		};
+	};
+
+	pwm7_pins: pwm1-2-pins {
+		mux {
+			function = "pwm";
+			groups = "pwm_ch7_2";
+		};
+	};
+
+	wled_pins: wled-pins {
+		mux {
+			function = "led";
+			groups = "wled";
+		};
+	};
+
+	/* Serial NAND is shared pin with SPI-NOR */
+	serial_nand_pins: serial-nand-pins {
+		mux {
+			function = "flash";
+			groups = "snfi";
+		};
+	};
+
+	spic0_pins: spic0-pins {
+		mux {
+			function = "spi";
+			groups = "spic0_0";
+		};
+	};
+
+	spic1_pins: spic1-pins {
+		mux {
+			function = "spi";
+			groups = "spic1_0";
+		};
+	};
+
+	uart0_pins: uart0-pins {
+		mux {
+			function = "uart";
+			groups = "uart0_0_tx_rx";
+		};
+	};
+
+	uart2_pins: uart2-pins {
+		mux {
+			function = "uart";
+			groups = "uart2_1_tx_rx";
+		};
+	};
+
+	watchdog_pins: watchdog-pins {
+		mux {
+			function = "watchdog";
+			groups = "watchdog";
+		};
+	};
+};
+
+&pwm {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pwm7_pins>;
+	status = "okay";
+};
+
+&pwrap {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pmic_bus_pins>;
+	status = "okay";
+};
+
+&rtc {
+	status = "disabled";
+};
+
+&sata {
+	status = "disabled";
+};
+
+&sata_phy {
+	status = "disabled";
+};
+
+&slot0 {
+	wmac1: mt7915@0,0 {
+		reg = <0x0000 0 0 0 0>;
+		ieee80211-freq-limit = <5000000 6000000>;
+	};
+};
+
+&snfi {
+	pinctrl-names = "default";
+	pinctrl-0 = <&serial_nand_pins>;
+	status = "okay";
+
+	snand: flash@0 {
+		compatible = "spi-nand";
+		mediatek,bmt-table-size = <0x1000>;
+		mediatek,bmt-v2;
+		nand-ecc-engine = <&snfi>;
+		reg = <0>;
+		spi-rx-bus-width = <4>;
+		spi-tx-bus-width = <4>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "Preloader";
+				reg = <0x00000 0x0080000>;
+				read-only;
+			};
+
+			partition@80000 {
+				label = "ATF";
+				reg = <0x80000 0x0040000>;
+				read-only;
+			};
+
+			partition@c0000 {
+				label = "Bootloader";
+				reg = <0xc0000 0x0080000>;
+				read-only;
+			};
+
+			partition@140000 {
+				label = "Config";
+				reg = <0x140000 0x0080000>;
+			};
+
+			factory: partition@1c0000 {
+				compatible = "nvmem-cells";
+				label = "Factory";
+				reg = <0x1c0000 0x0100000>;
+				#address-cells = <1>;
+				#size-cells = <1>;
+				read-only;
+
+				macaddr_factory_7fff4: macaddr@7fff4 {
+					reg = <0x7fff4 0x6>;
+				};
+
+				macaddr_factory_7fffa: macaddr@7fffa {
+					reg = <0x7fffa 0x6>;
+				};
+			};
+
+			partition@2c0000 {
+				label = "firmware";
+				reg = <0x2c0000 0x2600000>;
+
+				compatible = "fixed-partitions";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				partition@0 {
+					label = "kernel";
+					reg = <0x0 0x600000>;
+				};
+
+				partition@600000 {
+					label = "ubi";
+					reg = <0x600000 0x2000000>;
+				};
+			};
+
+			partition@28c0000 {
+				label = "firmware_backup";
+				reg = <0x28c0000 0x2600000>;
+				read-only;
+			};
+
+			partition@4ec0000 {
+				label = "CFG";
+				reg = <0x4ec0000 0x800000>;
+				read-only;
+			};
+
+			partition@56c0000 {
+				label = "RAE";
+				reg = <0x56c0000 0x400000>;
+				read-only;
+			};
+
+			partition@5ac0000 {
+				label = "POT";
+				reg = <0x5ac0000 0x100000>;
+				read-only;
+			};
+
+			partition@5bc0000 {
+				label = "Language";
+				reg = <0x5bc0000 0x400000>;
+				read-only;
+			};
+
+			partition@5fc0000 {
+				label = "Traffic";
+				reg = <0x5fc0000 0x200000>;
+				read-only;
+			};
+
+			partition@61c0000 {
+				label = "Cert";
+				reg = <0x61c0000 0x100000>;
+				read-only;
+			};
+
+			partition@62c0000 {
+				label = "NTGRcryptK";
+				reg = <0x62c0000 0x100000>;
+				read-only;
+			};
+
+			partition@63c0000 {
+				label = "NTGRcryptD";
+				reg = <0x63c0000 0x500000>;
+				read-only;
+			};
+
+			partition@68c0000 {
+				label = "LOG";
+				reg = <0x68c0000 0x100000>;
+				read-only;
+			};
+
+			partition@69c0000 {
+				label = "User_data";
+				reg = <0x69c0000 0x640000>;
+				read-only;
+			};
+
+		};
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spic0_pins>;
+	status = "okay";
+};
+
+&spi1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spic1_pins>;
+	status = "okay";
+};
+
+&ssusb {
+	status = "disabled";
+};
+
+&u3phy {
+	status = "disabled";
+};
+
+&uart0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart0_pins>;
+	status = "okay";
+};
+
+&uart2 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart2_pins>;
+	status = "okay";
+};
+
+&watchdog {
+	pinctrl-names = "default";
+	pinctrl-0 = <&watchdog_pins>;
+	status = "okay";
+};
+
+&wmac {
+	mediatek,mtd-eeprom = <&factory 0x0000>;
+	status = "okay";
+};
+
+&wmac1 {
+	mediatek,mtd-eeprom = <&factory 0x05000>;
+};
diff --git a/target/linux/mediatek/dts/mt7622-reyee-ax3200-e5.dts b/target/linux/mediatek/dts/mt7622-reyee-ax3200-e5.dts
new file mode 100644
index 00000000000000..d86ea52fcf0d45
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7622-reyee-ax3200-e5.dts
@@ -0,0 +1,96 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+
+#include "mt7622-ruijie-rg-ew3200.dtsi"
+
+/ {
+	model = "reyee AX3200 E5";
+	compatible = "reyee,ax3200-e5", "mediatek,mt7622";
+};
+
+&nor_flash {
+	status = "okay";
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_nor_pins>;
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <50000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "Preloader";
+				reg = <0x0 0x20000>;
+				read-only;
+			};
+
+			partition@20000 {
+				label = "ATF";
+				reg = <0x20000 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot";
+				reg = <0x30000 0x80000>;
+				read-only;
+			};
+
+			partition@80000 {
+				label = "u-boot-env";
+				reg = <0x80000 0x90000>;
+			};
+
+			factory: partition@90000 {
+				label = "Factory";
+				reg = <0x90000 0xd0000>;
+				read-only;
+			};
+
+			partition@d0000 {
+				label = "product_info";
+				reg = <0xd0000 0xe0000>;
+				read-only;
+			};
+
+			partition@e0000 {
+				label = "kdump";
+				reg = <0xe0000 0xf0000>;
+				read-only;
+			};
+
+			partition@f0000 {
+				compatible = "denx,fit";
+				label = "firmware";
+				reg = <0xf0000 0x1000000>;
+			};
+		};
+	};
+};
+
+&wmac {
+	status = "okay";
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&epa_elna_pins>;
+	mediatek,mtd-eeprom = <&factory 0x0>;
+};
+
+&slot0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x5000>;
+		ieee80211-freq-limit = <5000000 6000000>;
+		mediatek,disable-radar-background;
+	};
+};
diff --git a/target/linux/mediatek/dts/mt7622-ruijie-rg-ew3200.dtsi b/target/linux/mediatek/dts/mt7622-ruijie-rg-ew3200.dtsi
new file mode 100644
index 00000000000000..a240f9bfcec111
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7622-ruijie-rg-ew3200.dtsi
@@ -0,0 +1,240 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+
+#include "mt7622.dtsi"
+#include "mt6380.dtsi"
+
+/ {
+	aliases {
+		ethernet0 = &gmac0;
+		label-mac-device = &gmac0;
+		led-boot = &led_system;
+		led-failsafe = &led_system;
+		led-running = &led_system;
+		led-upgrade = &led_system;
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n1";
+		bootargs = "console=ttyS0,115200n1 swiotlb=512";
+	};
+
+	cpus {
+		cpu@0 {
+			proc-supply = <&mt6380_vcpu_reg>;
+			sram-supply = <&mt6380_vm_reg>;
+		};
+
+		cpu@1 {
+			proc-supply = <&mt6380_vcpu_reg>;
+			sram-supply = <&mt6380_vm_reg>;
+		};
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 102 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		mesh_green {
+			label = "green:mesh";
+			gpios = <&pio 79 GPIO_ACTIVE_LOW>;
+		};
+
+		mesh_red {
+			label = "red:mesh";
+			gpios = <&pio 82 GPIO_ACTIVE_LOW>;
+		};
+
+		led_system: system_blue {
+			label = "blue:system";
+			gpios = <&pio 81 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+	};
+
+	memory {
+		reg = <0 0x40000000 0 0x40000000>;
+	};
+};
+
+&eth {
+	status = "okay";
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&eth_pins>;
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-connection-type = "2500base-x";
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		switch@0 {
+			compatible = "mediatek,mt7531";
+			reg = <0>;
+			reset-gpios = <&pio 54 GPIO_ACTIVE_HIGH>;
+			interrupt-controller;
+			#interrupt-cells = <2>;
+			interrupt-parent = <&pio>;
+			interrupts = <53 IRQ_TYPE_LEVEL_HIGH>;
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					label = "lan1";
+				};
+
+				port@1 {
+					reg = <1>;
+					label = "lan2";
+				};
+
+				port@2 {
+					reg = <2>;
+					label = "lan3";
+				};
+
+				port@3 {
+					reg = <3>;
+					label = "lan4";
+				};
+
+				wan: port@4 {
+					reg = <4>;
+					label = "wan";
+				};
+
+				port@6 {
+					reg = <6>;
+					ethernet = <&gmac0>;
+					phy-mode = "2500base-x";
+
+					fixed-link {
+						speed = <2500>;
+						full-duplex;
+						pause;
+					};
+				};
+			};
+		};
+	};
+};
+
+&pcie0 {
+	status = "okay";
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie0_pins>;
+};
+
+&pio {
+	epa_elna_pins: epa-elna-pins {
+		mux {
+			function = "antsel";
+			groups = "antsel0", "antsel1", "antsel2", "antsel3",
+				"antsel4", "antsel5", "antsel6", "antsel7",
+				"antsel8", "antsel9", "antsel12", "antsel13",
+				"antsel14", "antsel15", "antsel16", "antsel17";
+		};
+	};
+
+	eth_pins: eth-pins {
+		mux {
+			function = "eth";
+			groups = "mdc_mdio", "rgmii_via_gmac2";
+		};
+	};
+
+	pcie0_pins: pcie0-pins {
+		mux {
+			function = "pcie";
+			groups = "pcie0_pad_perst",
+				 "pcie0_0_waken",
+				 "pcie0_0_clkreq";
+		};
+	};
+
+	pmic_bus_pins: pmic-bus-pins {
+		mux {
+			function = "pmic";
+			groups = "pmic_bus";
+		};
+	};
+
+	spi_nor_pins: spi-nor-pins {
+		mux {
+			function = "flash";
+			groups = "spi_nor";
+		};
+	};
+
+	uart0_pins: uart0-pins {
+		mux {
+			function = "uart";
+			groups = "uart0_0_tx_rx";
+		};
+	};
+
+	watchdog_pins: watchdog-pins {
+		mux {
+			function = "watchdog";
+			groups = "watchdog";
+		};
+	};
+};
+
+&pwrap {
+	status = "okay";
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&pmic_bus_pins>;
+};
+
+&rtc {
+	status = "disabled";
+};
+
+&uart0 {
+	status = "okay";
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart0_pins>;
+};
+
+&watchdog {
+	status = "okay";
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&watchdog_pins>;
+};
diff --git a/target/linux/mediatek/dts/mt7622-ruijie-rg-ew3200gx-pro.dts b/target/linux/mediatek/dts/mt7622-ruijie-rg-ew3200gx-pro.dts
index fba9a1b8f77993..857f94ae94b276 100644
--- a/target/linux/mediatek/dts/mt7622-ruijie-rg-ew3200gx-pro.dts
+++ b/target/linux/mediatek/dts/mt7622-ruijie-rg-ew3200gx-pro.dts
@@ -1,239 +1,11 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 
 /dts-v1/;
-#include <dt-bindings/input/input.h>
-#include <dt-bindings/gpio/gpio.h>
-
-#include "mt7622.dtsi"
-#include "mt6380.dtsi"
+#include "mt7622-ruijie-rg-ew3200.dtsi"
 
 / {
 	model = "Ruijie RG-EW3200GX PRO";
 	compatible = "ruijie,rg-ew3200gx-pro", "mediatek,mt7622";
-
-	aliases {
-		ethernet0 = &gmac0;
-		label-mac-device = &gmac0;
-		led-boot = &led_system;
-		led-failsafe = &led_system;
-		led-running = &led_system;
-		led-upgrade = &led_system;
-		serial0 = &uart0;
-	};
-
-	chosen {
-		stdout-path = "serial0:115200n1";
-		bootargs = "console=ttyS0,115200n1 swiotlb=512";
-	};
-
-	cpus {
-		cpu@0 {
-			proc-supply = <&mt6380_vcpu_reg>;
-			sram-supply = <&mt6380_vm_reg>;
-		};
-
-		cpu@1 {
-			proc-supply = <&mt6380_vcpu_reg>;
-			sram-supply = <&mt6380_vm_reg>;
-		};
-	};
-
-	gpio-keys {
-		compatible = "gpio-keys";
-
-		reset {
-			label = "reset";
-			linux,code = <KEY_RESTART>;
-			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
-		};
-
-		wps {
-			label = "wps";
-			linux,code = <KEY_WPS_BUTTON>;
-			gpios = <&pio 102 GPIO_ACTIVE_LOW>;
-		};
-	};
-
-	gpio-leds {
-		compatible = "gpio-leds";
-
-		mesh_green {
-			label = "green:mesh";
-			gpios = <&pio 79 GPIO_ACTIVE_LOW>;
-		};
-
-		mesh_red {
-			label = "red:mesh";
-			gpios = <&pio 82 GPIO_ACTIVE_LOW>;
-		};
-
-		led_system: system_blue {
-			label = "blue:system";
-			gpios = <&pio 81 GPIO_ACTIVE_LOW>;
-			default-state = "on";
-		};
-	};
-
-	memory {
-		reg = <0 0x40000000 0 0x40000000>;
-	};
-};
-
-&eth {
-	status = "okay";
-
-	pinctrl-names = "default";
-	pinctrl-0 = <&eth_pins>;
-
-	gmac0: mac@0 {
-		compatible = "mediatek,eth-mac";
-		reg = <0>;
-		phy-connection-type = "2500base-x";
-		fixed-link {
-			speed = <2500>;
-			full-duplex;
-			pause;
-		};
-	};
-
-	mdio: mdio-bus {
-		#address-cells = <1>;
-		#size-cells = <0>;
-
-		switch@0 {
-			compatible = "mediatek,mt7531";
-			reg = <0>;
-			reset-gpios = <&pio 54 GPIO_ACTIVE_HIGH>;
-			
-			interrupt-controller;
-			#interrupt-cells = <2>;
-			interrupt-parent = <&pio>;
-			interrupts = <53 IRQ_TYPE_LEVEL_HIGH>;
-
-			ports {
-				#address-cells = <1>;
-				#size-cells = <0>;
-
-				port@0 {
-					reg = <0>;
-					label = "lan1";
-				};
-
-				port@1 {
-					reg = <1>;
-					label = "lan2";
-				};
-
-				port@2 {
-					reg = <2>;
-					label = "lan3";
-				};
-
-				port@3 {
-					reg = <3>;
-					label = "lan4";
-				};
-
-				wan: port@4 {
-					reg = <4>;
-					label = "wan";
-				};
-
-				port@6 {
-					reg = <6>;
-					label = "cpu";
-					ethernet = <&gmac0>;
-					phy-mode = "2500base-x";
-
-					fixed-link {
-						speed = <2500>;
-						full-duplex;
-						pause;
-					};
-				};
-			};
-		};
-	};
-};
-
-&pcie0 {
-	status = "okay";
-
-	pinctrl-names = "default";
-	pinctrl-0 = <&pcie0_pins>;
-};
-
-&slot0 {
-	wifi@0,0 {
-		compatible = "mediatek,mt76";
-		reg = <0x0000 0 0 0 0>;
-		mediatek,mtd-eeprom = <&factory 0x5000>;
-		ieee80211-freq-limit = <5000000 6000000>;
-		mediatek,disable-radar-background;
-	};
-};
-
-&pio {
-	epa_elna_pins: epa-elna-pins {
-		mux {
-			function = "antsel";
-			groups = "antsel0", "antsel1", "antsel2", "antsel3",
-				"antsel4", "antsel5", "antsel6", "antsel7",
-				"antsel8", "antsel9", "antsel12", "antsel13",
-				"antsel14", "antsel15", "antsel16", "antsel17";
-		};
-	};
-
-	eth_pins: eth-pins {
-		mux {
-			function = "eth";
-			groups = "mdc_mdio", "rgmii_via_gmac2";
-		};
-	};
-
-	pcie0_pins: pcie0-pins {
-		mux {
-			function = "pcie";
-			groups = "pcie0_pad_perst",
-				 "pcie0_0_waken",
-				 "pcie0_0_clkreq";
-		};
-	};
-
-	pmic_bus_pins: pmic-bus-pins {
-		mux {
-			function = "pmic";
-			groups = "pmic_bus";
-		};
-	};
-
-	spi_nor_pins: spi-nor-pins {
-		mux {
-			function = "flash";
-			groups = "spi_nor";
-		};
-	};
-
-	uart0_pins: uart0-pins {
-		mux {
-			function = "uart";
-			groups = "uart0_0_tx_rx";
-		};
-	};
-
-	watchdog_pins: watchdog-pins {
-		mux {
-			function = "watchdog";
-			groups = "watchdog";
-		};
-	};
-};
-
-&pwrap {
-	status = "okay";
-
-	pinctrl-names = "default";
-	pinctrl-0 = <&pmic_bus_pins>;
 };
 
 &nor_flash {
@@ -302,24 +74,6 @@
 	};
 };
 
-&rtc {
-	status = "disabled";
-};
-
-&uart0 {
-	status = "okay";
-
-	pinctrl-names = "default";
-	pinctrl-0 = <&uart0_pins>;
-};
-
-&watchdog {
-	status = "okay";
-
-	pinctrl-names = "default";
-	pinctrl-0 = <&watchdog_pins>;
-};
-
 &wmac {
 	status = "okay";
 
@@ -327,3 +81,13 @@
 	pinctrl-0 = <&epa_elna_pins>;
 	mediatek,mtd-eeprom = <&factory 0x0>;
 };
+
+&slot0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x5000>;
+		ieee80211-freq-limit = <5000000 6000000>;
+		mediatek,disable-radar-background;
+	};
+};
diff --git a/target/linux/mediatek/dts/mt7622-xiaomi-redmi-router-ax6s.dts b/target/linux/mediatek/dts/mt7622-xiaomi-redmi-router-ax6s.dts
index 73ee41bb2dccf5..ecc25fd328ca04 100644
--- a/target/linux/mediatek/dts/mt7622-xiaomi-redmi-router-ax6s.dts
+++ b/target/linux/mediatek/dts/mt7622-xiaomi-redmi-router-ax6s.dts
@@ -196,7 +196,6 @@
 
 				port@6 {
 					reg = <6>;
-					label = "cpu";
 					ethernet = <&gmac0>;
 					phy-mode = "2500base-x";
 
@@ -295,7 +294,6 @@
 			 */
 			partition@2c0000 {
 				label = "kernel";
-				compatible = "denx,fit";
 				reg = <0x2c0000 0x400000>;
 			};
 
diff --git a/target/linux/mediatek/dts/mt7623a-unielec-u7623-02.dtsi b/target/linux/mediatek/dts/mt7623a-unielec-u7623-02.dtsi
index 50c7f3e88e1284..a4e443a0fb6f9d 100644
--- a/target/linux/mediatek/dts/mt7623a-unielec-u7623-02.dtsi
+++ b/target/linux/mediatek/dts/mt7623a-unielec-u7623-02.dtsi
@@ -178,7 +178,6 @@
 
 		cpu_port0: port@6 {
 			reg = <6>;
-			label = "cpu";
 			ethernet = <&gmac0>;
 			phy-mode = "trgmii";
 
diff --git a/target/linux/mediatek/dts/mt7629-iptime-a6004mx.dts b/target/linux/mediatek/dts/mt7629-iptime-a6004mx.dts
index b40ac528482c8e..dc1868a0669e0d 100644
--- a/target/linux/mediatek/dts/mt7629-iptime-a6004mx.dts
+++ b/target/linux/mediatek/dts/mt7629-iptime-a6004mx.dts
@@ -161,7 +161,6 @@
 
 				port@6 {
 					reg = <6>;
-					label = "cpu";
 					ethernet = <&gmac0>;
 					phy-mode = "2500base-x";
 
diff --git a/target/linux/mediatek/dts/mt7981b-cudy-wr3000-v1.dts b/target/linux/mediatek/dts/mt7981b-cudy-wr3000-v1.dts
new file mode 100644
index 00000000000000..7c8a94d97c8e76
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-cudy-wr3000-v1.dts
@@ -0,0 +1,282 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+
+/dts-v1/;
+
+#include "mt7981.dtsi"
+
+/ {
+	model = "Cudy WR3000 v1";
+	compatible = "cudy,wr3000-v1", "mediatek,mt7981";
+
+	aliases {
+		ethernet0 = &gmac0;
+		label-mac-device = &lan1;
+		led-boot = &led_status;
+		led-failsafe = &led_status;
+		led-running = &led_status;
+		led-upgrade = &led_status;
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 0 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status: led@0 {
+			label = "blue:status";
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+
+		led@1 {
+			label = "blue:internet";
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led@2 {
+			label = "blue:wan";
+			gpios = <&pio 5 GPIO_ACTIVE_LOW>;
+		};
+
+		led@3 {
+			label = "blue:lan";
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		led@4 {
+			label = "blue:wifi2";
+			gpios = <&pio 6 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led@5 {
+			label = "blue:wifi5";
+			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&eth {
+	pinctrl-names = "default";
+	pinctrl-0 = <&mdio_pins>;
+
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_bdinfo_de00>;
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		status = "disabled";
+	};
+};
+
+&mdio_bus {
+	switch: switch@0 {
+		compatible = "mediatek,mt7531";
+		reg = <31>;
+		reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "disabled";
+};
+
+&spi2 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi2_flash_pins>;
+	status = "okay";
+
+	flash@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+
+		spi-max-frequency = <25000000>;
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@00000 {
+				label = "BL2";
+				reg = <0x00000 0x40000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "u-boot-env";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@50000 {
+				label = "Factory";
+				reg = <0x50000 0x10000>;
+				read-only;
+			};
+
+			bdinfo: partition@60000 {
+				label = "bdinfo";
+				reg = <0x60000 0x10000>;
+				read-only;
+			};
+
+			partition@70000 {
+				label = "FIP";
+				reg = <0x70000 0x80000>;
+				read-only;
+			};
+
+			partition@f0000 {
+				compatible = "denx,fit";
+				label = "firmware";
+				reg = <0xf0000 0xf10000>;
+			};
+		};
+	};
+};
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+	};
+
+	spi2_flash_pins: spi2-pins {
+		mux {
+			function = "spi";
+			groups = "spi2", "spi2_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
+			drive-strength = <8>;
+			bias-pull-up = <103>;
+		};
+
+		conf-pd {
+			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
+			drive-strength = <8>;
+			bias-pull-down = <103>;
+		};
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "wan";
+
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_bdinfo_de00>;
+			mac-address-increment = <1>;
+		};
+
+		lan1: port@1 {
+			reg = <1>;
+			label = "lan1";
+
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_bdinfo_de00>;
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan2";
+
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_bdinfo_de00>;
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan3";
+
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_bdinfo_de00>;
+		};
+
+		port@6 {
+			reg = <6>;
+			label = "cpu";
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&wifi {
+	status = "okay";
+	mediatek,mtd-eeprom = <&factory 0x0>;
+};
+
+&bdinfo {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_bdinfo_de00: macaddr@de00 {
+		reg = <0xde00 0x6>;
+	};
+};
diff --git a/target/linux/mediatek/dts/mt7981b-glinet-gl-mt3000.dts b/target/linux/mediatek/dts/mt7981b-glinet-gl-mt3000.dts
new file mode 100644
index 00000000000000..d916ee49ef6ffe
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-glinet-gl-mt3000.dts
@@ -0,0 +1,240 @@
+/dts-v1/;
+
+#include "mt7981.dtsi"
+
+/ {
+	model = "GL.iNet GL-MT3000";
+	compatible = "glinet,gl-mt3000", "mediatek,mt7981";
+
+	aliases {
+		led-boot = &led_lightblue;
+		led-failsafe = &led_lightblue;
+		led-running = &led_white;
+		led-upgrade = &led_lightblue;
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		mode {
+			label = "mode";
+			linux,input-type = <EV_SW>;
+			linux,code = <BTN_0>;
+			gpios = <&pio 0 GPIO_ACTIVE_HIGH>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_lightblue: led@0 {
+			label = "blue:run";
+			gpios = <&pio 31 GPIO_ACTIVE_LOW>;
+		};
+
+		led_white: led@1 {
+			label = "white:system";
+			gpios = <&pio 30 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	fan_5v: regulator-fan-5v {
+		compatible = "regulator-fixed";
+		regulator-name = "fan";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		gpio = <&pio 28 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+		regulator-boot-on;
+	};
+
+	usb_vbus: regulator-usb-vbus {
+		compatible = "regulator-fixed";
+		regulator-name = "usb_vbus";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		gpio = <&pio 12 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+		regulator-boot-on;
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&eth {
+	pinctrl-names = "default";
+	pinctrl-0 = <&mdio_pins>;
+
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+		phy-handle = <&phy0>;
+		nvmem-cells = <&macaddr>;
+		nvmem-cell-names = "mac-address";
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "gmii";
+		phy-handle = <&int_gbe_phy>;
+		nvmem-cells = <&macaddr>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <1>;
+	};
+};
+
+&mdio_bus {
+	reset-gpios = <&pio 14 GPIO_ACTIVE_LOW>;
+	reset-delay-us = <600>;
+	reset-post-delay-us = <20000>;
+
+	phy0: ethernet-phy@5 {
+		reg = <5>;
+		compatible = "ethernet-phy-ieee802.3-c45";
+		phy-mode = "2500base-x";
+	};
+};
+
+&pwm {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pwm_pins>;
+
+	status = "okay";
+};
+
+&fan {
+	pwms = <&pwm 0 40000 0>;
+	fan-supply = <&fan_5v>;
+	interrupt-parent = <&pio>;
+	interrupts = <29 IRQ_TYPE_EDGE_RISING>;
+	status = "okay";
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	spi_nand: flash@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "spi-nand";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+
+		spi-cal-enable;
+		spi-cal-mode = "read-data";
+		spi-cal-datalen = <7>;
+		spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4E 0x41 0x4E 0x44>;
+		spi-cal-addrlen = <5>;
+		spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
+
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
+		mediatek,nmbm;
+		mediatek,bmt-max-ratio = <1>;
+		mediatek,bmt-max-reserved-blocks = <64>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "BL2";
+				reg = <0x00000 0x0100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x0100000 0x0080000>;
+			};
+
+			factory: partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x0200000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr: macaddr@a {
+					reg = <0xa 0x6>;
+				};
+			};
+
+			partition@380000 {
+				label = "FIP";
+				reg = <0x380000 0x0200000>;
+				read-only;
+			};
+
+			partition@580000 {
+				label = "log";
+				reg = <0x580000 0x0040000>;
+			};
+
+			partition@5c0000 {
+				label = "ubi";
+				reg = <0x5c0000 0xf640000>;
+				compatible = "linux,ubi";
+			};
+		};
+	};
+};
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+	};
+
+	pwm_pins: pwm0-pins {
+		mux {
+			function = "pwm";
+			groups = "pwm0_1";
+		};
+	};
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&xhci {
+	vbus-supply = <&usb_vbus>;
+
+	status = "okay";
+};
+
+&wifi {
+	mediatek,mtd-eeprom = <&factory 0x0>;
+
+	status = "okay";
+};
diff --git a/target/linux/mediatek/dts/mt7981b-qihoo-360t7.dts b/target/linux/mediatek/dts/mt7981b-qihoo-360t7.dts
new file mode 100644
index 00000000000000..87076d255cfdac
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-qihoo-360t7.dts
@@ -0,0 +1,229 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+#include "mt7981.dtsi"
+
+/ {
+	model = "Qihoo 360T7";
+	compatible = "qihoo,360t7", "mediatek,mt7981";
+
+	aliases {
+		serial0 = &uart0;
+		led-boot = &led_status_red;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_green;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	memory {
+		reg = <0 0x40000000 0 0x10000000>;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_red: red {
+			label = "red:status";
+			gpios = <&pio 3 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_green: green {
+			label = "green:status";
+			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+};
+
+&mdio_bus {
+	switch: switch@0 {
+		compatible = "mediatek,mt7531";
+		reg = <31>;
+		reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	spi_nand@0 {
+		compatible = "spi-nand";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+
+		spi-max-frequency = <52000000>;
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "bl2";
+				reg = <0x0000000 0x0100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x0100000 0x0080000>;
+			};
+
+			factory: partition@180000 {
+				label = "Factory";
+				reg = <0x0180000 0x0200000>;
+				read-only;
+			};
+
+			partition@380000 {
+				label = "fip";
+				reg = <0x0380000 0x0200000>;
+				read-only;
+			};
+
+			partition@580000 {
+				label = "ubi";
+				reg = <0x0580000 0x6c00000>;
+			};
+
+			partition@7180000 {
+				label = "config";
+				reg = <0x7180000 0x0100000>;
+				read-only;
+			};
+
+			partition@7280000 {
+				label = "factory";
+				reg = <0x7280000 0x0080000>;
+				read-only;
+			};
+
+			partition@7300000 {
+				label = "log";
+				reg = <0x7300000 0x0700000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "lan3";
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan2";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan1";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "wan";
+		};
+
+		port@6 {
+			reg = <6>;
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <8>;
+			mediatek,pull-up-adv = <0>; /* bias-disable */
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <8>;
+			mediatek,pull-up-adv = <0>; /* bias-disable */
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi {
+	status = "okay";
+
+	mediatek,mtd-eeprom = <&factory 0x0>;
+};
diff --git a/target/linux/mediatek/dts/mt7986a-asus-tuf-ax4200.dts b/target/linux/mediatek/dts/mt7986a-asus-tuf-ax4200.dts
new file mode 100644
index 00000000000000..239be9645f38ff
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986a-asus-tuf-ax4200.dts
@@ -0,0 +1,364 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+
+/dts-v1/;
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+
+#include "mt7986a.dtsi"
+
+/ {
+	model = "ASUS TUF-AX4200";
+	compatible = "asus,tuf-ax4200", "mediatek,mt7986a";
+
+	aliases {
+		serial0 = &uart0;
+		led-boot = &led_system;
+		led-failsafe = &led_system;
+		led-running = &led_system;
+		led-upgrade = &led_system;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs-override = "ubi.mtd=UBI_DEV";
+	};
+
+	memory {
+		reg = <0 0x40000000 0 0x20000000>;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		mesh {
+			label = "wps";
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		wlan24 {
+			label = "white:wlan24";
+			gpios = <&pio 1 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wlan5 {
+			label = "white:wlan5";
+			gpios = <&pio 2 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		led_system: system {
+			label = "white:system";
+			gpios = <&pio 11 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan-red {
+			label = "red:wan";
+			gpios = <&pio 12 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-3.3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_5v: regulator-5v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-5V";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+};
+
+&crypto {
+	status = "okay";
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		/* LAN */
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	gmac1: mac@1 {
+		/* WAN */
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "2500base-x";
+		phy-handle = <&phy6>;
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+};
+
+&mdio {
+	phy6: phy@6 {
+		compatible = "ethernet-phy-ieee802.3-c45";
+		reg = <6>;
+
+		reset-gpios = <&pio 6 GPIO_ACTIVE_LOW>;
+		reset-assert-us = <10000>;
+		reset-deassert-us = <10000>;
+
+		/* LED0: CONN (WAN white) */
+		mxl,led-config = <0x03f0 0x0 0x0 0x0>;
+	};
+
+	switch: switch@0 {
+		compatible = "mediatek,mt7531";
+		reg = <31>;
+
+		reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
+		reset-assert-us = <10000>;
+		reset-deassert-us = <10000>;
+	};
+};
+
+&pio {
+	spi_flash_pins: spi-flash-pins-33-to-38 {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+		conf-pu {
+			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
+			drive-strength = <8>;
+			mediatek,pull-up-adv = <0>; /* bias-disable */
+		};
+		conf-pd {
+			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
+			drive-strength = <8>;
+			mediatek,pull-down-adv = <0>; /* bias-disable */
+		};
+	};
+
+	wf_2g_5g_pins: wf_2g_5g-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_2g", "wf_5g";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			       "WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+
+	wf_dbdc_pins: wf-dbdc-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_dbdc";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+				"WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+				"WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+				"WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+				"WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+				"WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+				"WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	status = "okay";
+
+	spi_nand_flash: flash@0 {
+		compatible = "spi-nand";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+
+		spi-max-frequency = <20000000>;
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
+
+		partitions: partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "bootloader";
+				reg = <0x0 0x400000>;
+				read-only;
+			};
+
+			partition@400000 {
+				label = "UBI_DEV";
+				reg = <0x400000 0xfc00000>;
+			};
+		};
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@1 {
+			reg = <1>;
+			label = "lan1";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan2";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan3";
+		};
+
+		port@4 {
+			reg = <4>;
+			label = "lan4";
+		};
+
+		port@6 {
+			reg = <6>;
+			label = "cpu";
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+
+	mdio {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		phy@1 {
+			reg = <1>;
+
+			mediatek,led-config = <
+				0x21 0x8009 /* BASIC_CTRL */
+				0x22 0x0c00 /* ON_DURATION */
+				0x23 0x1400 /* BLINK_DURATION */
+				0x24 0x8000 /* LED0_ON_CTRL */
+				0x25 0x0000 /* LED0_BLINK_CTRL */
+				0x26 0xc007 /* LED1_ON_CTRL */
+				0x27 0x003f /* LED1_BLINK_CTRL */
+			>;
+		};
+
+		phy@2 {
+			reg = <2>;
+
+			mediatek,led-config = <
+				0x21 0x8009 /* BASIC_CTRL */
+				0x22 0x0c00 /* ON_DURATION */
+				0x23 0x1400 /* BLINK_DURATION */
+				0x24 0x8000 /* LED0_ON_CTRL */
+				0x25 0x0000 /* LED0_BLINK_CTRL */
+				0x26 0xc007 /* LED1_ON_CTRL */
+				0x27 0x003f /* LED1_BLINK_CTRL */
+			>;
+		};
+
+		phy@3 {
+			reg = <3>;
+
+			mediatek,led-config = <
+				0x21 0x8009 /* BASIC_CTRL */
+				0x22 0x0c00 /* ON_DURATION */
+				0x23 0x1400 /* BLINK_DURATION */
+				0x24 0x8000 /* LED0_ON_CTRL */
+				0x25 0x0000 /* LED0_BLINK_CTRL */
+				0x26 0xc007 /* LED1_ON_CTRL */
+				0x27 0x003f /* LED1_BLINK_CTRL */
+			>;
+		};
+
+		phy@4 {
+			reg = <4>;
+
+			mediatek,led-config = <
+				0x21 0x8009 /* BASIC_CTRL */
+				0x22 0x0c00 /* ON_DURATION */
+				0x23 0x1400 /* BLINK_DURATION */
+				0x24 0x8000 /* LED0_ON_CTRL */
+				0x25 0x0000 /* LED0_BLINK_CTRL */
+				0x26 0xc007 /* LED1_ON_CTRL */
+				0x27 0x003f /* LED1_BLINK_CTRL */
+			>;
+		};
+	};
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi {
+	status = "okay";
+	pinctrl-names = "default", "dbdc";
+	pinctrl-0 = <&wf_2g_5g_pins>;
+	pinctrl-1 = <&wf_dbdc_pins>;
+};
+
+&trng {
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&ssusb {
+	vusb33-supply = <&reg_3p3v>;
+	vbus-supply = <&reg_5v>;
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
\ No newline at end of file
diff --git a/target/linux/mediatek/dts/mt7986a-tplink-tl-xdr-common.dtsi b/target/linux/mediatek/dts/mt7986a-tplink-tl-xdr-common.dtsi
new file mode 100644
index 00000000000000..94edfd121e42cf
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986a-tplink-tl-xdr-common.dtsi
@@ -0,0 +1,270 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+#include "mt7986a.dtsi"
+
+/ {
+	aliases {
+		serial0 = &uart0;
+		label-mac-device = &gmac0;
+		led-boot = &led_status_green;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_red;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	memory {
+		reg = <0 0x40000000 0 0x20000000>;
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-3.3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_5v: regulator-5v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-5V";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+
+		turbo {
+			label = "turbo";
+			linux,code = <BTN_1>;
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_red: status_red {
+			label = "red:status";
+			gpios = <&pio 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_green: status_green {
+			label = "green:status";
+			gpios = <&pio 8 GPIO_ACTIVE_HIGH>;
+		};
+
+		turbo {
+			label = "green:turbo";
+			gpios = <&pio 12 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&crypto {
+	status = "okay";
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		nvmem-cells = <&macaddr_config_1c>;
+		nvmem-cell-names = "mac-address";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-handle = <&phy7>;
+		phy-mode = "2500base-x";
+
+		nvmem-cells = <&macaddr_config_1c>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <1>;
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+};
+
+&mdio {
+	phy5: ethernet-phy@5 {
+		compatible = "ethernet-phy-ieee802.3-c45";
+		reg = <5>;
+		reset-assert-us = <100000>;
+		reset-deassert-us = <100000>;
+		reset-gpios = <&pio 13 GPIO_ACTIVE_LOW>;
+		realtek,aldps-enable;
+	};
+
+	phy7: ethernet-phy@7 {
+		compatible = "ethernet-phy-ieee802.3-c45";
+		reg = <7>;
+		reset-assert-us = <100000>;
+		reset-deassert-us = <100000>;
+		reset-gpios = <&pio 17 GPIO_ACTIVE_LOW>;
+		realtek,aldps-enable;
+	};
+
+	switch: switch@31 {
+		compatible = "mediatek,mt7531";
+		reg = <31>;
+		reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <66 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	status = "okay";
+
+	flash@0 {
+		compatible = "spi-nand";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+
+		spi-max-frequency = <20000000>;
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "bl2";
+				reg = <0x000000 0x0100000>;
+				read-only;
+			};
+
+			config: partition@100000 {
+				label = "config";
+				reg = <0x100000 0x0060000>;
+				read-only;
+			};
+
+			factory: partition@160000 {
+				label = "factory";
+				reg = <0x160000 0x0060000>;
+				read-only;
+			};
+
+			partition@1c0000 {
+				label = "reserved";
+				reg = <0x1c0000 0x01c0000>;
+				read-only;
+			};
+
+			partition@380000 {
+				label = "fip";
+				reg = <0x380000 0x0200000>;
+				read-only;
+			};
+
+			partition@580000 {
+				label = "ubi";
+				reg = <0x580000 0x7800000>;
+			};
+		};
+	};
+};
+
+&pio {
+	spi_flash_pins: spi-flash-pins-33-to-38 {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+		conf-pu {
+			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
+			drive-strength = <8>;
+			mediatek,pull-up-adv = <0>; /* bias-disable */
+		};
+		conf-pd {
+			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
+			drive-strength = <8>;
+			mediatek,pull-down-adv = <0>; /* bias-disable */
+		};
+	};
+};
+
+&ssusb {
+	vusb33-supply = <&reg_3p3v>;
+	vbus-supply = <&reg_5v>;
+	status = "okay";
+};
+
+&trng {
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi {
+	mediatek,mtd-eeprom = <&factory 0x0>;
+	nvmem-cells = <&macaddr_config_1c>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <2>;
+	status = "okay";
+};
+
+&config {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_config_1c: macaddr@1c {
+		reg = <0x1c 0x6>;
+	};
+};
diff --git a/target/linux/mediatek/dts/mt7986a-tplink-tl-xdr4288.dts b/target/linux/mediatek/dts/mt7986a-tplink-tl-xdr4288.dts
new file mode 100644
index 00000000000000..591d16195e233a
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986a-tplink-tl-xdr4288.dts
@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+#include "mt7986a-tplink-tl-xdr-common.dtsi"
+
+/ {
+	model = "TP-Link TL-XDR4288";
+	compatible = "tplink,tl-xdr4288", "mediatek,mt7986a";
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "lan1";
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan2";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan3";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan4";
+		};
+
+		port@5 {
+			reg = <5>;
+			label = "lan5";
+			phy-handle = <&phy5>;
+			phy-mode = "2500base-x";
+		};
+
+		port@6 {
+			reg = <6>;
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&pio {
+	wf_dbdc_pins: wf-dbdc-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_dbdc";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			       "WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+};
+
+&wifi {
+	pinctrl-names = "dbdc";
+	pinctrl-0 = <&wf_dbdc_pins>;
+};
diff --git a/target/linux/mediatek/dts/mt7986a-tplink-tl-xdr6086.dts b/target/linux/mediatek/dts/mt7986a-tplink-tl-xdr6086.dts
new file mode 100644
index 00000000000000..68a159a8e7c173
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986a-tplink-tl-xdr6086.dts
@@ -0,0 +1,64 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+#include "mt7986a-tplink-tl-xdr-common.dtsi"
+
+/ {
+	model = "TP-Link TL-XDR6086";
+	compatible = "tplink,tl-xdr6086", "mediatek,mt7986a";
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "lan1";
+		};
+
+		port@5 {
+			reg = <5>;
+			label = "lan2";
+			phy-handle = <&phy5>;
+			phy-mode = "2500base-x";
+		};
+
+		port@6 {
+			reg = <6>;
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&pio {
+	wf_2g_5g_pins: wf_2g_5g-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_2g", "wf_5g";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			       "WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+};
+
+&wifi {
+	pinctrl-names = "default";
+	pinctrl-0 = <&wf_2g_5g_pins>;
+};
diff --git a/target/linux/mediatek/dts/mt7986a-tplink-tl-xdr6088.dts b/target/linux/mediatek/dts/mt7986a-tplink-tl-xdr6088.dts
new file mode 100644
index 00000000000000..751909a6aa2f22
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986a-tplink-tl-xdr6088.dts
@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+#include "mt7986a-tplink-tl-xdr-common.dtsi"
+
+/ {
+	model = "TP-Link TL-XDR6088";
+	compatible = "tplink,tl-xdr6088", "mediatek,mt7986a";
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "lan1";
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan2";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan3";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan4";
+		};
+
+		port@5 {
+			reg = <5>;
+			label = "lan5";
+			phy-handle = <&phy5>;
+			phy-mode = "2500base-x";
+		};
+
+		port@6 {
+			reg = <6>;
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&pio {
+	wf_2g_5g_pins: wf_2g_5g-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_2g", "wf_5g";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			       "WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+};
+
+&wifi {
+	pinctrl-names = "default";
+	pinctrl-0 = <&wf_2g_5g_pins>;
+};
diff --git a/target/linux/mediatek/dts/mt7986a-xiaomi-redmi-router-ax6000-stock.dts b/target/linux/mediatek/dts/mt7986a-xiaomi-redmi-router-ax6000-stock.dts
new file mode 100644
index 00000000000000..114076dffcdfb8
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986a-xiaomi-redmi-router-ax6000-stock.dts
@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+
+/dts-v1/;
+#include "mt7986a-xiaomi-redmi-router-ax6000.dtsi"
+
+/ {
+	model = "Xiaomi Redmi Router AX6000 (stock layout)";
+	compatible = "xiaomi,redmi-router-ax6000-stock", "mediatek,mt7986a";
+};
+
+&spi_nand_flash {
+	mediatek,nmbm;
+	mediatek,bmt-max-ratio = <1>;
+	mediatek,bmt-max-reserved-blocks = <64>;
+};
+
+&partitions {
+	partition@580000 {
+		label = "crash";
+		reg = <0x580000 0x40000>;
+		read-only;
+	};
+
+	partition@5c0000 {
+		label = "crash_log";
+		reg = <0x5c0000 0x40000>;
+		read-only;
+	};
+
+	partition@600000 {
+		label = "ubi_kernel";
+		reg = <0x600000 0x1e00000>;
+	};
+
+	partition@2400000 {
+		label = "ubi";
+		reg = <0x2400000 0x5000000>;
+	};
+};
diff --git a/target/linux/mediatek/dts/mt7986a-xiaomi-redmi-router-ax6000-ubootmod.dts b/target/linux/mediatek/dts/mt7986a-xiaomi-redmi-router-ax6000-ubootmod.dts
new file mode 100644
index 00000000000000..152bbd20f8cb69
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986a-xiaomi-redmi-router-ax6000-ubootmod.dts
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+
+/dts-v1/;
+#include "mt7986a-xiaomi-redmi-router-ax6000.dtsi"
+
+/ {
+	model = "Xiaomi Redmi Router AX6000 (OpenWrt U-Boot layout)";
+	compatible = "xiaomi,redmi-router-ax6000-ubootmod", "mediatek,mt7986a";
+};
+
+&partitions {
+	partition@580000 {
+		label = "ubi";
+		reg = <0x580000 0x7a80000>;
+	};
+};
diff --git a/target/linux/mediatek/dts/mt7986a-xiaomi-redmi-router-ax6000.dtsi b/target/linux/mediatek/dts/mt7986a-xiaomi-redmi-router-ax6000.dtsi
new file mode 100644
index 00000000000000..13f37cd7630b8d
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986a-xiaomi-redmi-router-ax6000.dtsi
@@ -0,0 +1,275 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+
+/dts-v1/;
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+
+#include "mt7986a.dtsi"
+
+/ {
+	aliases {
+		serial0 = &uart0;
+		led-boot = &led_status_rgb;
+		led-failsafe = &led_status_rgb;
+		led-running = &led_status_rgb;
+		led-upgrade = &led_status_rgb;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	memory {
+		reg = <0 0x40000000 0 0x20000000>;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		mesh {
+			label = "mesh";
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_9>;
+			linux,input-type = <EV_SW>;
+		};
+	};
+};
+
+&crypto {
+	status = "okay";
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		nvmem-cells = <&macaddr_factory_4>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <(-1)>;
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+};
+
+&mdio {
+	switch: switch@0 {
+		compatible = "mediatek,mt7531";
+		reg = <31>;
+		reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <66 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&pio {
+	spi_flash_pins: spi-flash-pins-33-to-38 {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+		conf-pu {
+			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
+			drive-strength = <8>;
+			mediatek,pull-up-adv = <0>; /* bias-disable */
+		};
+		conf-pd {
+			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
+			drive-strength = <8>;
+			mediatek,pull-down-adv = <0>; /* bias-disable */
+		};
+	};
+
+	spi_led_pins: spic-pins-29-to-32 {
+		mux {
+			function = "spi";
+			groups = "spi1_2";
+		};
+	};
+
+	wf_2g_5g_pins: wf_2g_5g-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_2g", "wf_5g";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			       "WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	status = "okay";
+
+	spi_nand_flash: flash@0 {
+		compatible = "spi-nand";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+
+		spi-max-frequency = <20000000>;
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
+
+		partitions: partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "BL2";
+				reg = <0x0 0x100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "Nvram";
+				reg = <0x100000 0x40000>;
+			};
+
+			partition@140000 {
+				label = "Bdata";
+				reg = <0x140000 0x40000>;
+			};
+
+			factory: partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x200000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_factory_4: macaddr@4 {
+					reg = <0x4 0x6>;
+				};
+			};
+
+			partition@380000 {
+				label = "FIP";
+				reg = <0x380000 0x200000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&spi1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_led_pins>;
+	status = "okay";
+
+	ws2812b@0 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		compatible = "worldsemi,ws2812b";
+		reg = <0>;
+		spi-max-frequency = <3000000>;
+
+		led_status_rgb: led@0 {
+			reg = <0>;
+			label = "rgb:status";
+			color-index = <LED_COLOR_ID_RED LED_COLOR_ID_GREEN LED_COLOR_ID_BLUE>;
+		};
+
+		led_network_rgb: led@1 {
+			reg = <1>;
+			label = "rgb:network";
+			color-index = <LED_COLOR_ID_RED LED_COLOR_ID_GREEN LED_COLOR_ID_BLUE>;
+		};
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@1 {
+			reg = <1>;
+			label = "lan4";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan3";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan2";
+		};
+
+		port@4 {
+			reg = <4>;
+			label = "wan";
+		};
+
+		port@6 {
+			reg = <6>;
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&trng {
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&wf_2g_5g_pins>;
+
+	mediatek,mtd-eeprom = <&factory 0x0>;
+};
+
+&uart0 {
+	status = "okay";
+};
diff --git a/target/linux/mediatek/dts/mt7986a-zyxel-ex5601-t0-stock.dts b/target/linux/mediatek/dts/mt7986a-zyxel-ex5601-t0-stock.dts
new file mode 100644
index 00000000000000..bc9f6688b39361
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986a-zyxel-ex5601-t0-stock.dts
@@ -0,0 +1,568 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2021 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/dts-v1/;
+#include "mt7986a.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Zyxel EX5601-T0";
+	compatible = "zyxel,ex5601-t0", "mediatek,mt7986a-rfb-snand";
+
+	aliases {
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	memory {
+		reg = <0 0x40000000 0 0x40000000>;
+	};
+
+	reg_1p8v: regulator-1p8v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-1.8V";
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-3.3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_5v: regulator-5v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-5V";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+		poll-interval = <20>;
+
+		reset-button {
+			label = "reset";
+			gpios = <&pio 21 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wlan-button {
+			label = "wlan";
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WLAN>;
+		};
+		wps-button {
+			label = "wps";
+			gpios = <&pio 56 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	zyleds {
+		compatible = "gpio-leds";
+
+		led_green_wifi24g {
+			label = "zyled-green-wifi24g";
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+			default-state = "off";
+		};
+
+		led_green_wifi5g {
+			label = "zyled-green-wifi5g";
+			gpios = <&pio 2 GPIO_ACTIVE_LOW>;
+			default-state = "off";
+		};
+
+		led_green_inet {
+			label = "zyled-green-inet";
+			gpios = <&pio 14 GPIO_ACTIVE_LOW>;
+			default-state = "off";
+		};
+
+		led_red_inet {
+			label = "zyled-red-inet";
+			gpios = <&pio 15 GPIO_ACTIVE_LOW>;
+			default-state = "off";
+		};
+
+		led_green_pwr {
+			label = "zyled-green-pwr";
+			gpios = <&pio 13 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "timer"; /* Default blinking */
+			led-pattern = <125 125>; /* Fast blink is 4 HZ */
+		};
+
+		led_red_pwr {
+			label = "zyled-red-pwr";
+			gpios = <&pio 12 GPIO_ACTIVE_LOW>;
+			default-state = "off";
+		};
+
+		led_green_fxs {
+			label = "zyled-green-fxs";
+			gpios = <&pio 16 GPIO_ACTIVE_HIGH>;
+			default-state = "off";
+		};
+
+		led_amber_fxs {
+			label = "zyled-amber-fxs";
+			gpios = <&pio 17 GPIO_ACTIVE_HIGH>;
+			default-state = "off";
+		};
+
+		led_amber_wps24g {
+			label = "zyled-amber-wps24g";
+			gpios = <&pio 18 GPIO_ACTIVE_HIGH>;
+			default-state = "off";
+		};
+
+		led_amber_wps5g {
+			label = "zyled-amber-wps5g";
+			gpios = <&pio 19 GPIO_ACTIVE_HIGH>;
+			default-state = "off";
+		};
+
+		led_green_lan {
+			label = "zyled-green-lan";
+			gpios = <&pio 20 GPIO_ACTIVE_HIGH>;
+			default-state = "off";
+		};
+
+		led_green_sfp {
+			label = "zyled-green-sfp";
+			gpios = <&pio 24 GPIO_ACTIVE_HIGH>;
+			default-state = "off";
+		};
+
+	};
+
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		nvmem-cells = <&macaddr_factory_002a>;
+		nvmem-cell-names = "mac-address";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "2500base-x";
+		phy = <&phy6>;
+
+		nvmem-cells = <&macaddr_factory_0024>;
+		nvmem-cell-names = "mac-address";
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reset-gpios = <&pio 6 GPIO_ACTIVE_LOW>;
+		reset-delay-us = <1500000>;
+		reset-post-delay-us = <1000000>;
+
+		phy5: phy@5 {
+			compatible = "ethernet-phy-ieee802.3-c45";
+			reg = <5>;
+		};
+
+		phy6: phy@6 {
+			compatible = "ethernet-phy-ieee802.3-c45";
+			reg = <6>;
+		};
+
+		switch@0 {
+			compatible = "mediatek,mt7531";
+			reg = <31>;
+			reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@1 {
+					reg = <1>;
+					label = "lan1";
+				};
+
+				port@2 {
+					reg = <2>;
+					label = "lan2";
+				};
+
+				port@3 {
+					reg = <3>;
+					label = "lan3";
+				};
+
+				port@5 {
+					reg = <5>;
+					label = "lan4";
+					phy-mode = "2500base-x";
+					phy = <&phy5>;
+				};
+
+				port@6 {
+					reg = <6>;
+					ethernet = <&gmac0>;
+					phy-mode = "2500base-x";
+
+					fixed-link {
+						speed = <2500>;
+						full-duplex;
+						pause;
+					};
+				};
+			};
+		};
+	};
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi {
+	status = "okay";
+	pinctrl-names = "default", "dbdc";
+	pinctrl-0 = <&wf_2g_5g_pins>;
+	pinctrl-1 = <&wf_dbdc_pins>;
+	mediatek,mtd-eeprom = <&factory 0x0>;
+	nvmem-cells = <&macaddr_factory_0004>;
+	nvmem-cell-names = "mac-address";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&mmc0 {
+	pinctrl-names = "default", "state_uhs";
+	pinctrl-0 = <&mmc0_pins_default>;
+	pinctrl-1 = <&mmc0_pins_uhs>;
+	bus-width = <8>;
+	max-frequency = <200000000>;
+	cap-mmc-highspeed;
+	mmc-hs200-1_8v;
+	mmc-hs400-1_8v;
+	hs400-ds-delay = <0x14014>;
+	vmmc-supply = <&reg_3p3v>;
+	vqmmc-supply = <&reg_1p8v>;
+	non-removable;
+	no-sd;
+	no-sdio;
+	status = "disabled";
+};
+
+&pcie {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie_pins>;
+	status = "okay";
+};
+
+&pcie_phy {
+	status = "okay";
+};
+
+&pio {
+	mmc0_pins_default: mmc0-pins {
+		mux {
+			function = "emmc";
+			groups = "emmc_51";
+		};
+		conf-cmd-dat {
+			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
+			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
+			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
+			input-enable;
+			drive-strength = <4>;
+			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
+		};
+		conf-clk {
+			pins = "EMMC_CK";
+			drive-strength = <6>;
+			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
+		};
+		conf-ds {
+			pins = "EMMC_DSL";
+			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
+		};
+		conf-rst {
+			pins = "EMMC_RSTB";
+			drive-strength = <4>;
+			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
+		};
+	};
+
+	mmc0_pins_uhs: mmc0-uhs-pins {
+		mux {
+			function = "emmc";
+			groups = "emmc_51";
+		};
+		conf-cmd-dat {
+			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
+			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
+			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
+			input-enable;
+			drive-strength = <4>;
+			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
+		};
+		conf-clk {
+			pins = "EMMC_CK";
+			drive-strength = <6>;
+			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
+		};
+		conf-ds {
+			pins = "EMMC_DSL";
+			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
+		};
+		conf-rst {
+			pins = "EMMC_RSTB";
+			drive-strength = <4>;
+			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
+		};
+	};
+
+	pcie_pins: pcie-pins {
+		mux {
+			function = "pcie";
+			groups = "pcie_clk", "pcie_wake", "pcie_pereset";
+		};
+	};
+
+	spic_pins_g2: spic-pins-29-to-32 {
+		mux {
+			function = "spi";
+			groups = "spi1_2";
+		};
+	};
+
+	spi_flash_pins: spi-flash-pins-33-to-38 {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+		conf-pu {
+			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
+			drive-strength = <8>;
+			mediatek,pull-up-adv = <0>;	/* bias-disable */
+		};
+		conf-pd {
+			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
+			drive-strength = <8>;
+			mediatek,pull-down-adv = <0>;	/* bias-disable */
+		};
+	};
+
+	uart1_pins: uart1-pins {
+		mux {
+			function = "uart";
+			groups = "uart1";
+		};
+	};
+
+	uart2_pins: uart2-pins {
+		mux {
+			function = "uart";
+			groups = "uart2";
+		};
+	};
+
+	wf_2g_5g_pins: wf_2g_5g-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_2g", "wf_5g";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			       "WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+
+	wf_dbdc_pins: wf_dbdc-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_dbdc";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			       "WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	cs-gpios = <0>, <0>;
+	#address-cells = <1>;
+	#size-cells = <0>;
+	status = "okay";
+
+	spi_nand: spi_nand@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "spi-nand";
+		reg = <1>;
+		spi-max-frequency = <10000000>;
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "BL2";
+				reg = <0x00000 0x0100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x0100000 0x0080000>;
+			};
+
+			factory: partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x0200000>;
+				read-only;
+			};
+
+			partition@380000 {
+				label = "FIP";
+				reg = <0x380000 0x01C0000>;
+				read-only;
+			};
+
+			partition@540000 {
+				label = "zloader";
+				reg = <0x540000 0x0040000>;
+				read-only;
+			};
+
+			partition@580000 {
+				label = "ubi";
+				reg = <0x580000 0x4000000>;
+			};
+
+			partition@4580000 {
+				label = "ubi2";
+				reg = <0x4580000 0x4000000>;
+				read-only;
+			};
+
+			partition@8580000 {
+				label = "zyubi";
+				reg = <0x8580000 0x15A80000>;
+			};
+		};
+	};
+};
+
+&spi1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spic_pins_g2>;
+	status = "okay";
+
+	proslic_spi: proslic_spi@0 {
+		compatible = "silabs,proslic_spi";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+		spi-cpha = <1>;
+		spi-cpol = <1>;
+		channel_count = <1>;
+		debug_level = <4>;       /* 1 = TRC, 2 = DBG, 4 = ERR */
+		reset_gpio = <&pio 7 GPIO_ACTIVE_HIGH>;
+		ig,enable-spi = <1>;     /* 1: Enable, 0: Disable */
+	};
+};
+
+&ssusb {
+	vusb33-supply = <&reg_3p3v>;
+	vbus-supply = <&reg_5v>;
+	status = "okay";
+};
+
+&trng {
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&uart1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart1_pins>;
+	status = "okay";
+};
+
+&uart2 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart2_pins>;
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_0004: macaddr@0004 {
+		reg = <0x0004 0x6>;
+	};
+
+	macaddr_factory_0024: macaddr@0024 {
+		reg = <0x0024 0x6>;
+	};
+
+	macaddr_factory_002a: macaddr@002a {
+		reg = <0x002a 0x6>;
+	};
+};
diff --git a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7981.dtsi b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7981.dtsi
new file mode 100644
index 00000000000000..3629a6f6dda70c
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7981.dtsi
@@ -0,0 +1,775 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (c) 2020 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ * Author: Jianhui Zhao <zhaojh329@gmail.com>
+ */
+
+#include <dt-bindings/interrupt-controller/irq.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/phy/phy.h>
+#include <dt-bindings/clock/mediatek,mt7981-clk.h>
+#include <dt-bindings/reset/mt7986-resets.h>
+#include <dt-bindings/pinctrl/mt65xx.h>
+#include <dt-bindings/input/linux-event-codes.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/mux/mux.h>
+
+/ {
+	compatible = "mediatek,mt7981";
+	interrupt-parent = <&gic>;
+	#address-cells = <2>;
+	#size-cells = <2>;
+
+	cpus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		cpu@0 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a53";
+			enable-method = "psci";
+			reg = <0x0>;
+		};
+
+		cpu@1 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a53";
+			enable-method = "psci";
+			reg = <0x1>;
+		};
+	};
+
+	pwm: pwm@10048000 {
+		compatible = "mediatek,mt7981-pwm";
+		reg = <0 0x10048000 0 0x1000>;
+		#pwm-cells = <2>;
+		clocks = <&infracfg CLK_INFRA_PWM_STA>,
+			 <&infracfg CLK_INFRA_PWM_HCK>,
+			 <&infracfg CLK_INFRA_PWM1_CK>,
+			 <&infracfg CLK_INFRA_PWM2_CK>,
+			 <&infracfg CLK_INFRA_PWM3_CK>;
+		clock-names = "top", "main", "pwm1", "pwm2", "pwm3";
+	};
+
+	fan: pwm-fan {
+		compatible = "pwm-fan";
+		/* cooling level (0, 1, 2, 3) : (0% duty, 50% duty, 75% duty, 100% duty) */
+		cooling-levels = <0 128 192 255>;
+		#cooling-cells = <2>;
+		status = "disabled";
+	};
+
+	thermal-zones {
+		cpu_thermal: cpu-thermal {
+			polling-delay-passive = <1000>;
+			polling-delay = <1000>;
+			thermal-sensors = <&thermal 0>;
+			trips {
+				cpu_trip_crit: crit {
+					temperature = <125000>;
+					hysteresis = <2000>;
+					type = "critical";
+				};
+
+				cpu_trip_hot: hot {
+					temperature = <120000>;
+					hysteresis = <2000>;
+					type = "hot";
+				};
+
+				cpu_trip_active_high: active-high {
+					temperature = <115000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+
+				cpu_trip_active_med: active-med {
+					temperature = <85000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+
+				cpu_trip_active_low: active-low {
+					temperature = <60000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+			};
+
+			cooling-maps {
+				cpu-active-high {
+					/* active: set fan to cooling level 3 */
+					cooling-device = <&fan 3 3>;
+					trip = <&cpu_trip_active_high>;
+				};
+
+				cpu-active-med {
+					/* active: set fan to cooling level 2 */
+					cooling-device = <&fan 2 2>;
+					trip = <&cpu_trip_active_med>;
+				};
+
+				cpu-active-low {
+					/* passive: set fan to cooling level 1 */
+					cooling-device = <&fan 1 1>;
+					trip = <&cpu_trip_active_low>;
+				};
+			};
+		};
+	};
+
+	thermal: thermal@1100c800 {
+		#thermal-sensor-cells = <1>;
+		compatible = "mediatek,mt7981-thermal", "mediatek,mt7986-thermal";
+		reg = <0 0x1100c800 0 0x800>;
+		interrupts = <GIC_SPI 138 IRQ_TYPE_LEVEL_HIGH>;
+		clocks = <&infracfg CLK_INFRA_THERM_CK>,
+			 <&infracfg CLK_INFRA_ADC_26M_CK>;
+		clock-names = "therm", "auxadc";
+		mediatek,auxadc = <&auxadc>;
+		mediatek,apmixedsys = <&apmixedsys>;
+		nvmem-cells = <&thermal_calibration>;
+		nvmem-cell-names = "calibration-data";
+	};
+
+	auxadc: adc@1100d000 {
+		compatible = "mediatek,mt7981-auxadc",
+			     "mediatek,mt7986-auxadc",
+			     "mediatek,mt7622-auxadc";
+		reg = <0 0x1100d000 0 0x1000>;
+		clocks = <&infracfg CLK_INFRA_ADC_26M_CK>,
+			 <&infracfg CLK_INFRA_ADC_FRC_CK>;
+		clock-names = "main", "32k";
+		#io-channel-cells = <1>;
+	};
+
+	wdma: wdma@15104800 {
+		compatible = "mediatek,wed-wdma";
+		reg = <0 0x15104800 0 0x400>,
+		      <0 0x15104c00 0 0x400>;
+	};
+
+	ap2woccif: ap2woccif@151a5000 {
+		compatible = "mediatek,ap2woccif";
+		reg = <0 0x151a5000 0 0x1000>,
+		      <0 0x151ad000 0 0x1000>;
+		interrupt-parent = <&gic>;
+		interrupts = <GIC_SPI 211 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 212 IRQ_TYPE_LEVEL_HIGH>;
+	};
+
+	reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+
+		/* 64 KiB reserved for ramoops/pstore */
+		ramoops@42ff0000 {
+			compatible = "ramoops";
+			reg = <0 0x42ff0000 0 0x10000>;
+			record-size = <0x1000>;
+		};
+
+		/* 192 KiB reserved for ARM Trusted Firmware (BL31) */
+		secmon_reserved: secmon@43000000 {
+			reg = <0 0x43000000 0 0x30000>;
+			no-map;
+		};
+
+		wmcpu_emi: wmcpu-reserved@47c80000 {
+			reg = <0 0x47c80000 0 0x100000>;
+			no-map;
+		};
+
+		wo_emi0: wo-emi@47d80000 {
+			reg = <0 0x47d80000 0 0x40000>;
+			no-map;
+		};
+
+		wo_data: wo-data@47dc0000 {
+			reg = <0 0x47dc0000 0 0x240000>;
+			no-map;
+		};
+
+		wo_ilm0: wo-ilm@151e0000 {
+			reg = <0 0x151e0000 0 0x8000>;
+			no-map;
+		};
+
+		wo_dlm0: wo-dlm@151e8000 {
+			reg = <0 0x151e8000 0 0x2000>;
+			no-map;
+		};
+
+		wo_boot: wo-boot@15194000 {
+			reg = <0 0x15194000 0 0x1000>;
+			no-map;
+		};
+	};
+
+	psci {
+		compatible  = "arm,psci-0.2";
+		method      = "smc";
+	};
+
+	trng {
+		compatible = "mediatek,mt7981-rng";
+	};
+
+	clk40m: oscillator@0 {
+		compatible = "fixed-clock";
+		#clock-cells = <0>;
+		clock-frequency = <40000000>;
+		clock-output-names = "clkxtal";
+	};
+
+	infracfg: infracfg@10001000 {
+		compatible = "mediatek,mt7981-infracfg", "syscon";
+		reg = <0 0x10001000 0 0x1000>;
+		#clock-cells = <1>;
+	};
+
+	topckgen: topckgen@1001B000 {
+		compatible = "mediatek,mt7981-topckgen", "syscon";
+		reg = <0 0x1001B000 0 0x1000>;
+		#clock-cells = <1>;
+	};
+
+	apmixedsys: apmixedsys@1001E000 {
+		compatible = "mediatek,mt7981-apmixedsys", "mediatek,mt7986-apmixedsys", "syscon";
+		reg = <0 0x1001E000 0 0x1000>;
+		#clock-cells = <1>;
+	};
+
+	timer {
+		compatible = "arm,armv8-timer";
+		interrupt-parent = <&gic>;
+		clock-frequency = <13000000>;
+		interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>;
+
+	};
+
+	watchdog: watchdog@1001c000 {
+		compatible = "mediatek,mt7986-wdt",
+			     "mediatek,mt6589-wdt";
+		reg = <0 0x1001c000 0 0x1000>;
+		interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH>;
+		#reset-cells = <1>;
+		status = "disabled";
+	};
+
+	gic: interrupt-controller@c000000 {
+		compatible = "arm,gic-v3";
+		#interrupt-cells = <3>;
+		interrupt-parent = <&gic>;
+		interrupt-controller;
+		reg = <0 0x0c000000 0 0x40000>,  /* GICD */
+		      <0 0x0c080000 0 0x200000>; /* GICR */
+
+		interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_HIGH>;
+	};
+
+	uart0: serial@11002000 {
+		compatible = "mediatek,mt6577-uart";
+		reg = <0 0x11002000 0 0x400>;
+		interrupts = <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>;
+		clocks = <&infracfg CLK_INFRA_UART0_SEL>,
+			<&infracfg CLK_INFRA_UART0_CK>;
+		clock-names = "baud", "bus";
+		assigned-clocks = <&topckgen CLK_TOP_UART_SEL>,
+				  <&infracfg CLK_INFRA_UART0_SEL>;
+		assigned-clock-parents = <&topckgen CLK_TOP_CB_CKSQ_40M>,
+					 <&topckgen CLK_TOP_UART_SEL>;
+		pinctrl-0 = <&uart0_pins>;
+		pinctrl-names = "default";
+		status = "disabled";
+	};
+
+	uart1: serial@11003000 {
+		compatible = "mediatek,mt6577-uart";
+		reg = <0 0x11003000 0 0x400>;
+		interrupts = <GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>;
+		clocks = <&infracfg CLK_INFRA_UART1_SEL>,
+			<&infracfg CLK_INFRA_UART1_CK>;
+		clock-names = "baud", "bus";
+		assigned-clocks = <&topckgen CLK_TOP_UART_SEL>,
+				  <&infracfg CLK_INFRA_UART1_SEL>;
+		assigned-clock-parents = <&topckgen CLK_TOP_CB_CKSQ_40M>,
+					 <&topckgen CLK_TOP_UART_SEL>;
+		status = "disabled";
+	};
+
+	uart2: serial@11004000 {
+		compatible = "mediatek,mt6577-uart";
+		reg = <0 0x11004000 0 0x400>;
+		interrupts = <GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>;
+		clocks = <&infracfg CLK_INFRA_UART2_SEL>,
+			<&infracfg CLK_INFRA_UART2_CK>;
+		clock-names = "baud", "bus";
+		assigned-clocks = <&topckgen CLK_TOP_UART_SEL>,
+				  <&infracfg CLK_INFRA_UART2_SEL>;
+		assigned-clock-parents = <&topckgen CLK_TOP_CB_CKSQ_40M>,
+					 <&topckgen CLK_TOP_UART_SEL>;
+		status = "disabled";
+	};
+
+	i2c0: i2c@11007000 {
+		compatible = "mediatek,mt7981-i2c";
+		reg = <0 0x11007000 0 0x1000>,
+		      <0 0x10217080 0 0x80>;
+		interrupts = <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>;
+		clock-div = <1>;
+		clocks = <&infracfg CLK_INFRA_I2C0_CK>,
+			 <&infracfg CLK_INFRA_AP_DMA_CK>,
+			 <&infracfg CLK_INFRA_I2C_MCK_CK>,
+			 <&infracfg CLK_INFRA_I2C_PCK_CK>;
+		clock-names = "main", "dma", "arb", "pmic";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		status = "disabled";
+	};
+
+	pcie: pcie@11280000 {
+		compatible = "mediatek,mt7981-pcie",
+			     "mediatek,mt7986-pcie";
+		device_type = "pci";
+		reg = <0 0x11280000 0 0x4000>;
+		reg-names = "pcie-mac";
+		#address-cells = <3>;
+		#size-cells = <2>;
+		interrupts = <GIC_SPI 168 IRQ_TYPE_LEVEL_HIGH>;
+		bus-range = <0x00 0xff>;
+		ranges = <0x82000000 0 0x20000000
+			  0x0 0x20000000 0 0x10000000>;
+		status = "disabled";
+
+		clocks = <&infracfg CLK_INFRA_IPCIE_CK>,
+			 <&infracfg CLK_INFRA_IPCIE_PIPE_CK>,
+			 <&infracfg CLK_INFRA_IPCIER_CK>,
+			 <&infracfg CLK_INFRA_IPCIEB_CK>;
+
+		phys = <&u3port0 PHY_TYPE_PCIE>;
+		phy-names = "pcie-phy";
+
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0 0 0 7>;
+		interrupt-map = <0 0 0 1 &pcie_intc 0>,
+				<0 0 0 2 &pcie_intc 1>,
+				<0 0 0 3 &pcie_intc 2>,
+				<0 0 0 4 &pcie_intc 3>;
+		pcie_intc: interrupt-controller {
+			interrupt-controller;
+			#address-cells = <0>;
+			#interrupt-cells = <1>;
+		};
+	};
+
+	crypto: crypto@10320000 {
+		compatible = "inside-secure,safexcel-eip97";
+		reg = <0 0x10320000 0 0x40000>;
+		interrupts = <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 119 IRQ_TYPE_LEVEL_HIGH>;
+		interrupt-names = "ring0", "ring1", "ring2", "ring3";
+		clocks = <&topckgen CLK_TOP_EIP97B>;
+		clock-names = "top_eip97_ck";
+		assigned-clocks = <&topckgen CLK_TOP_EIP97B_SEL>;
+		assigned-clock-parents = <&topckgen CLK_TOP_CB_NET1_D5>;
+	};
+
+	pio: pinctrl@11d00000 {
+		compatible = "mediatek,mt7981-pinctrl";
+		reg = <0 0x11d00000 0 0x1000>,
+		      <0 0x11c00000 0 0x1000>,
+		      <0 0x11c10000 0 0x1000>,
+		      <0 0x11d20000 0 0x1000>,
+		      <0 0x11e00000 0 0x1000>,
+		      <0 0x11e20000 0 0x1000>,
+		      <0 0x11f00000 0 0x1000>,
+		      <0 0x11f10000 0 0x1000>,
+		      <0 0x1000b000 0 0x1000>;
+		reg-names = "gpio", "iocfg_rt", "iocfg_rm",
+			    "iocfg_rb", "iocfg_lb", "iocfg_bl",
+			    "iocfg_tm", "iocfg_tl", "eint";
+		gpio-controller;
+		#gpio-cells = <2>;
+		gpio-ranges = <&pio 0 0 56>;
+		interrupt-controller;
+		interrupts = <GIC_SPI 225 IRQ_TYPE_LEVEL_HIGH>;
+		interrupt-parent = <&gic>;
+		#interrupt-cells = <2>;
+
+		mdio_pins: mdc-mdio-pins {
+			mux {
+				function = "eth";
+				groups = "smi_mdc_mdio";
+			};
+		};
+
+		uart0_pins: uart0-pins {
+			mux {
+				function = "uart";
+				groups = "uart0";
+			};
+		};
+
+		wifi_dbdc_pins: wifi-dbdc-pins {
+			mux {
+				function = "eth";
+				groups = "wf0_mode1";
+			};
+			conf {
+				pins = "WF_HB1", "WF_HB2", "WF_HB3", "WF_HB4",
+				       "WF_HB0", "WF_HB0_B", "WF_HB5", "WF_HB6",
+				       "WF_HB7", "WF_HB8", "WF_HB9", "WF_HB10",
+				       "WF_TOP_CLK", "WF_TOP_DATA", "WF_XO_REQ",
+				       "WF_CBA_RESETB", "WF_DIG_RESETB";
+				drive-strength = <4>;
+			};
+		};
+	};
+
+	ethsys: syscon@15000000 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "mediatek,mt7981-ethsys",
+			     "mediatek,mt7986-ethsys",
+			     "syscon";
+		reg = <0 0x15000000 0 0x1000>;
+		#clock-cells = <1>;
+		#reset-cells = <1>;
+	};
+
+	wed: wed@15010000 {
+		compatible = "mediatek,mt7981-wed",
+			     "mediatek,mt7986-wed",
+			     "syscon";
+		reg = <0 0x15010000 0 0x1000>;
+		interrupt-parent = <&gic>;
+		interrupts = <GIC_SPI 205 IRQ_TYPE_LEVEL_HIGH>;
+		memory-region = <&wo_emi0>, <&wo_ilm0>, <&wo_dlm0>,
+				<&wo_data>, <&wo_boot>;
+		memory-region-names = "wo-emi", "wo-ilm", "wo-dlm",
+				      "wo-data", "wo-boot";
+		mediatek,wo-ccif = <&wo_ccif0>;
+	};
+
+	eth: ethernet@15100000 {
+		compatible = "mediatek,mt7981-eth";
+		reg = <0 0x15100000 0 0x80000>;
+		interrupts = <GIC_SPI 196 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 197 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 198 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 199 IRQ_TYPE_LEVEL_HIGH>;
+		clocks = <&ethsys CLK_ETH_FE_EN>,
+			<&ethsys CLK_ETH_GP2_EN>,
+			<&ethsys CLK_ETH_GP1_EN>,
+			<&ethsys CLK_ETH_WOCPU0_EN>,
+			<&sgmiisys0 CLK_SGM0_TX_EN>,
+			<&sgmiisys0 CLK_SGM0_RX_EN>,
+			<&sgmiisys0 CLK_SGM0_CK0_EN>,
+			<&sgmiisys0 CLK_SGM0_CDR_CK0_EN>,
+			<&sgmiisys1 CLK_SGM1_TX_EN>,
+			<&sgmiisys1 CLK_SGM1_RX_EN>,
+			<&sgmiisys1 CLK_SGM1_CK1_EN>,
+			<&sgmiisys1 CLK_SGM1_CDR_CK1_EN>,
+			<&topckgen CLK_TOP_SGM_REG>,
+			<&topckgen CLK_TOP_NETSYS_SEL>,
+			<&topckgen CLK_TOP_NETSYS_500M_SEL>;
+		clock-names = "fe", "gp2", "gp1", "wocpu0",
+					"sgmii_tx250m", "sgmii_rx250m",
+					"sgmii_cdr_ref", "sgmii_cdr_fb",
+					"sgmii2_tx250m", "sgmii2_rx250m",
+					"sgmii2_cdr_ref", "sgmii2_cdr_fb",
+					"sgmii_ck", "netsys0", "netsys1";
+		assigned-clocks = <&topckgen CLK_TOP_NETSYS_2X_SEL>,
+				  <&topckgen CLK_TOP_SGM_325M_SEL>;
+		assigned-clock-parents = <&topckgen CLK_TOP_CB_NET2_800M>,
+					 <&topckgen CLK_TOP_CB_SGM_325M>;
+		mediatek,ethsys = <&ethsys>;
+		mediatek,sgmiisys = <&sgmiisys0>, <&sgmiisys1>;
+		mediatek,infracfg = <&topmisc>;
+		mediatek,wed = <&wed>;
+		#reset-cells = <1>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+		status = "disabled";
+
+		mdio_bus: mdio-bus {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			int_gbe_phy: ethernet-phy@0 {
+				reg = <0>;
+				compatible = "ethernet-phy-ieee802.3-c22";
+				phy-mode = "gmii";
+				phy-is-integrated;
+				nvmem-cells = <&phy_calibration>;
+				nvmem-cell-names = "phy-cal-data";
+			};
+		};
+	};
+
+	wo_ccif0: syscon@151a5000 {
+		compatible = "mediatek,mt7986-wo-ccif", "syscon";
+		reg = <0 0x151a5000 0 0x1000>;
+		interrupt-parent = <&gic>;
+		interrupts = <GIC_SPI 211 IRQ_TYPE_LEVEL_HIGH>;
+	};
+
+	sgmiisys0: syscon@10060000 {
+		compatible = "mediatek,mt7981-sgmiisys_0", "mediatek,mt7986-sgmiisys_0", "syscon";
+		reg = <0 0x10060000 0 0x1000>;
+		mediatek,pnswap;
+		#clock-cells = <1>;
+	};
+
+	sgmiisys1: syscon@10070000 {
+		compatible = "mediatek,mt7981-sgmiisys_1", "mediatek,mt7986-sgmiisys_1", "syscon";
+		reg = <0 0x10070000 0 0x1000>;
+		#clock-cells = <1>;
+	};
+
+	topmisc: topmisc@11d10000 {
+		compatible = "mediatek,mt7981-topmisc", "syscon";
+		reg = <0 0x11d10000 0 0x10000>;
+		#clock-cells = <1>;
+	};
+
+	snand: snfi@11005000 {
+		compatible = "mediatek,mt7986-snand";
+		reg = <0 0x11005000 0 0x1000>, <0 0x11006000 0 0x1000>;
+		reg-names = "nfi", "ecc";
+		interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
+		clocks = <&infracfg CLK_INFRA_SPINFI1_CK>,
+			 <&infracfg CLK_INFRA_NFI1_CK>,
+			 <&infracfg CLK_INFRA_NFI_HCK_CK>;
+		clock-names = "pad_clk", "nfi_clk", "nfi_hclk";
+		assigned-clocks = <&topckgen CLK_TOP_SPINFI_SEL>,
+				  <&topckgen CLK_TOP_NFI1X_SEL>;
+		assigned-clock-parents = <&topckgen CLK_TOP_CB_M_D8>,
+					 <&topckgen CLK_TOP_CB_M_D8>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+		status = "disabled";
+	};
+
+	mmc0: mmc@11230000 {
+		compatible = "mediatek,mt7986-mmc",
+					"mediatek,mt7981-mmc";
+		reg = <0 0x11230000 0 0x1000>, <0 0x11c20000 0 0x1000>;
+		interrupts = <GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>;
+		clocks = <&infracfg CLK_INFRA_MSDC_CK>,
+			 <&infracfg CLK_INFRA_MSDC_HCK_CK>,
+			 <&infracfg CLK_INFRA_MSDC_66M_CK>,
+			 <&infracfg CLK_INFRA_MSDC_133M_CK>;
+		assigned-clocks = <&topckgen CLK_TOP_EMMC_208M_SEL>,
+				  <&topckgen CLK_TOP_EMMC_400M_SEL>;
+		assigned-clock-parents = <&topckgen CLK_TOP_CB_M_D2>,
+					 <&topckgen CLK_TOP_CB_NET2_D2>;
+		clock-names = "source", "hclk", "axi_cg", "ahb_cg";
+		status = "disabled";
+	};
+
+	wed_pcie: wed_pcie@10003000 {
+		compatible = "mediatek,wed_pcie";
+		reg = <0 0x10003000 0 0x10>;
+	};
+
+	spi0: spi@1100a000 {
+		compatible = "mediatek,mt7986-spi-ipm", "mediatek,spi-ipm";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0 0x1100a000 0 0x100>;
+		interrupts = <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>;
+		clocks = <&topckgen CLK_TOP_CB_M_D2>,
+			 <&topckgen CLK_TOP_SPI_SEL>,
+			 <&infracfg CLK_INFRA_SPI0_CK>,
+			 <&infracfg CLK_INFRA_SPI0_HCK_CK>;
+
+		clock-names = "parent-clk", "sel-clk", "spi-clk", "hclk";
+		status = "disabled";
+	};
+
+	spi1: spi@1100b000 {
+		compatible = "mediatek,mt7986-spi-ipm", "mediatek,spi-ipm";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0 0x1100b000 0 0x100>;
+		interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
+		clocks = <&topckgen CLK_TOP_CB_M_D2>,
+			 <&topckgen CLK_TOP_SPIM_MST_SEL>,
+			 <&infracfg CLK_INFRA_SPI1_CK>,
+			 <&infracfg CLK_INFRA_SPI1_HCK_CK>;
+		clock-names = "parent-clk", "sel-clk", "spi-clk", "hclk";
+		status = "disabled";
+	};
+
+	spi2: spi@11009000 {
+		compatible = "mediatek,mt7986-spi-ipm", "mediatek,spi-ipm";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0 0x11009000 0 0x100>;
+		interrupts = <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>;
+		clocks = <&topckgen CLK_TOP_CB_M_D2>,
+			 <&topckgen CLK_TOP_SPI_SEL>,
+			 <&infracfg CLK_INFRA_SPI2_CK>,
+			 <&infracfg CLK_INFRA_SPI2_HCK_CK>;
+		clock-names = "parent-clk", "sel-clk", "spi-clk", "hclk";
+		status = "disabled";
+	};
+
+	consys: consys@10000000 {
+		compatible = "mediatek,mt7981-consys";
+		reg = <0 0x10000000 0 0x8600000>;
+		memory-region = <&wmcpu_emi>;
+	};
+
+	xhci: usb@11200000 {
+		compatible = "mediatek,mt7986-xhci",
+			     "mediatek,mtk-xhci";
+		reg = <0 0x11200000 0 0x2e00>,
+		      <0 0x11203e00 0 0x0100>;
+		reg-names = "mac", "ippc";
+		interrupts = <GIC_SPI 173 IRQ_TYPE_LEVEL_HIGH>;
+		clocks = <&infracfg CLK_INFRA_IUSB_SYS_CK>,
+			 <&infracfg CLK_INFRA_IUSB_CK>,
+			 <&infracfg CLK_INFRA_IUSB_133_CK>,
+			 <&infracfg CLK_INFRA_IUSB_66M_CK>,
+			 <&topckgen CLK_TOP_U2U3_XHCI_SEL>;
+		clock-names = "sys_ck",
+			      "ref_ck",
+			      "mcu_ck",
+			      "dma_ck",
+			      "xhci_ck";
+		phys = <&u2port0 PHY_TYPE_USB2>,
+		       <&u3port0 PHY_TYPE_USB3>;
+		vusb33-supply = <&reg_3p3v>;
+		status = "disabled";
+	};
+
+	usb_phy: usb-phy@11e10000 {
+		compatible = "mediatek,mt7981",
+			     "mediatek,generic-tphy-v2";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges = <0 0 0x11e10000 0x1700>;
+		status = "disabled";
+
+		u2port0: usb-phy@0 {
+			reg = <0x0 0x700>;
+			clocks = <&topckgen CLK_TOP_USB_FRMCNT_SEL>;
+			clock-names = "ref";
+			#phy-cells = <1>;
+		};
+
+		u3port0: usb-phy@700 {
+			reg = <0x700 0x900>;
+			clocks = <&topckgen CLK_TOP_USB3_PHY_SEL>;
+			clock-names = "ref";
+			#phy-cells = <1>;
+			mediatek,syscon-type = <&topmisc 0x218 0>;
+			status = "okay";
+		};
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-3.3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	efuse: efuse@11f20000 {
+		compatible = "mediatek,mt7981-efuse",
+			     "mediatek,efuse";
+		reg = <0 0x11f20000 0 0x1000>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+		status = "okay";
+
+		thermal_calibration: thermal-calib@274 {
+			reg = <0x274 0xc>;
+		};
+
+		phy_calibration: phy-calib@8dc {
+			reg = <0x8dc 0x10>;
+		};
+
+		comb_rx_imp_p0: usb3-rx-imp@8c8 {
+			reg = <0x8c8 1>;
+			bits = <0 5>;
+		};
+
+		comb_tx_imp_p0: usb3-tx-imp@8c8 {
+			reg = <0x8c8 2>;
+			bits = <5 5>;
+		};
+
+		comb_intr_p0: usb3-intr@8c9 {
+			reg = <0x8c9 1>;
+			bits = <2 6>;
+		};
+	};
+
+	afe: audio-controller@11210000 {
+		compatible = "mediatek,mt79xx-audio";
+		reg = <0 0x11210000 0 0x9000>;
+		interrupts = <GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>;
+		clocks = <&infracfg CLK_INFRA_AUD_BUS_CK>,
+			 <&infracfg CLK_INFRA_AUD_26M_CK>,
+			 <&infracfg CLK_INFRA_AUD_L_CK>,
+			 <&infracfg CLK_INFRA_AUD_AUD_CK>,
+			 <&infracfg CLK_INFRA_AUD_EG2_CK>,
+			 <&topckgen CLK_TOP_AUD_SEL>;
+		clock-names = "aud_bus_ck",
+			      "aud_26m_ck",
+			      "aud_l_ck",
+			      "aud_aud_ck",
+			      "aud_eg2_ck",
+			      "aud_sel";
+		assigned-clocks = <&topckgen CLK_TOP_AUD_SEL>,
+				  <&topckgen CLK_TOP_A1SYS_SEL>,
+				  <&topckgen CLK_TOP_AUD_L_SEL>,
+				  <&topckgen CLK_TOP_A_TUNER_SEL>;
+		assigned-clock-parents = <&topckgen CLK_TOP_CB_APLL2_196M>,
+					 <&topckgen CLK_TOP_APLL2_D4>,
+					 <&topckgen CLK_TOP_CB_APLL2_196M>,
+					 <&topckgen CLK_TOP_APLL2_D4>;
+		status = "disabled";
+	};
+
+	ice: ice_debug {
+		compatible = "mediatek,mt7981-ice_debug",
+			   "mediatek,mt2701-ice_debug";
+		clocks = <&infracfg CLK_INFRA_DBG_CK>;
+		clock-names = "ice_dbg";
+	};
+
+	wifi: wifi@18000000 {
+		compatible = "mediatek,mt7981-wmac";
+		resets = <&watchdog MT7986_TOPRGU_CONSYS_SW_RST>;
+		reset-names = "consys";
+		pinctrl-0 = <&wifi_dbdc_pins>;
+		pinctrl-names = "dbdc";
+		clocks = <&topckgen CLK_TOP_NETSYS_MCU_SEL>,
+			 <&topckgen CLK_TOP_AP2CNN_HOST_SEL>;
+		clock-names = "mcu", "ap2conn";
+		reg = <0 0x18000000 0 0x1000000>,
+		      <0 0x10003000 0 0x1000>,
+		      <0 0x11d10000 0 0x1000>;
+		interrupts = <GIC_SPI 213 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 214 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 215 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 216 IRQ_TYPE_LEVEL_HIGH>;
+		memory-region = <&wmcpu_emi>;
+		status = "disabled";
+	};
+};
diff --git a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3-emmc.dtso b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3-emmc.dtso
new file mode 100644
index 00000000000000..779dc6782bb198
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3-emmc.dtso
@@ -0,0 +1,29 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2021 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "bananapi,bpi-r3", "mediatek,mt7986a";
+
+	fragment@0 {
+		target-path = "/soc/mmc@11230000";
+		__overlay__ {
+			bus-width = <8>;
+			max-frequency = <200000000>;
+			cap-mmc-highspeed;
+			mmc-hs200-1_8v;
+			mmc-hs400-1_8v;
+			hs400-ds-delay = <0x14014>;
+			non-removable;
+			no-sd;
+			no-sdio;
+			status = "okay";
+		};
+	};
+};
+
diff --git a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3-nand.dtso b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3-nand.dtso
new file mode 100644
index 00000000000000..15ee8c568f3c3f
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3-nand.dtso
@@ -0,0 +1,55 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR MIT) */
+/*
+ * Authors: Daniel Golle <daniel@makrotopia.org>
+ *          Frank Wunderlich <frank-w@public-files.de>
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "bananapi,bpi-r3", "mediatek,mt7986a";
+
+	fragment@0 {
+		target-path = "/soc/spi@1100a000";
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			spi_nand: spi_nand@0 {
+				compatible = "spi-nand";
+				reg = <0>;
+				spi-max-frequency = <10000000>;
+				spi-tx-buswidth = <4>;
+				spi-rx-buswidth = <4>;
+
+				partitions {
+					compatible = "fixed-partitions";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					partition@0 {
+						label = "bl2";
+						reg = <0x0 0x80000>;
+						read-only;
+					};
+
+					partition@80000 {
+						label = "reserved";
+						reg = <0x80000 0x300000>;
+					};
+
+					partition@380000 {
+						label = "fip";
+						reg = <0x380000 0x200000>;
+						read-only;
+					};
+
+					partition@580000 {
+						label = "ubi";
+						reg = <0x580000 0x7a80000>;
+					};
+				};
+			};
+		};
+	};
+};
diff --git a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3-nor.dtso b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3-nor.dtso
new file mode 100644
index 00000000000000..e48881be4ed60c
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3-nor.dtso
@@ -0,0 +1,63 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR MIT) */
+/*
+ * Authors: Daniel Golle <daniel@makrotopia.org>
+ *          Frank Wunderlich <frank-w@public-files.de>
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "bananapi,bpi-r3", "mediatek,mt7986a";
+
+	fragment@0 {
+		target-path = "/soc/spi@1100a000";
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			flash@0 {
+				compatible = "jedec,spi-nor";
+				reg = <0>;
+				spi-max-frequency = <10000000>;
+
+				partitions {
+					compatible = "fixed-partitions";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					partition@0 {
+						label = "bl2";
+						reg = <0x0 0x40000>;
+						read-only;
+					};
+
+					partition@40000 {
+						label = "u-boot-env";
+						reg = <0x40000 0x40000>;
+					};
+
+					partition@80000 {
+						label = "reserved2";
+						reg = <0x80000 0x80000>;
+					};
+
+					partition@100000 {
+						label = "fip";
+						reg = <0x100000 0x80000>;
+						read-only;
+					};
+
+					partition@180000 {
+						label = "recovery";
+						reg = <0x180000 0xa80000>;
+					};
+
+					partition@c00000 {
+						label = "fit";
+						reg = <0xc00000 0x1400000>;
+					};
+				};
+			};
+		};
+	};
+};
diff --git a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3-sd.dtso b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3-sd.dtso
new file mode 100644
index 00000000000000..f623bce075ce6e
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3-sd.dtso
@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2021 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "bananapi,bpi-r3", "mediatek,mt7986a";
+
+	fragment@0 {
+		target-path = "/soc/mmc@11230000";
+		__overlay__ {
+			bus-width = <4>;
+			max-frequency = <52000000>;
+			cap-sd-highspeed;
+			status = "okay";
+		};
+	};
+};
+
diff --git a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts
new file mode 100644
index 00000000000000..af4a4309bda4b9
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts
@@ -0,0 +1,499 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2021 MediaTek Inc.
+ * Authors: Sam.Shih <sam.shih@mediatek.com>
+ *          Frank Wunderlich <frank-w@public-files.de>
+ *          Daniel Golle <daniel@makrotopia.org>
+ */
+
+/dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/pinctrl/mt65xx.h>
+
+#include "mt7986a.dtsi"
+
+/ {
+	model = "Bananapi BPI-R3";
+	chassis-type = "embedded";
+	compatible = "bananapi,bpi-r3", "mediatek,mt7986a";
+
+	aliases {
+		serial0 = &uart0;
+		ethernet0 = &gmac0;
+		ethernet1 = &gmac1;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	dcin: regulator-12vd {
+		compatible = "regulator-fixed";
+		regulator-name = "12vd";
+		regulator-min-microvolt = <12000000>;
+		regulator-max-microvolt = <12000000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	fan: pwm-fan {
+		compatible = "pwm-fan";
+		#cooling-cells = <2>;
+		/* cooling level (0, 1, 2) - pwm inverted */
+		cooling-levels = <255 96 0>;
+		pwms = <&pwm 0 10000 0>;
+		status = "okay";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset-key {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		wps-key {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	/* i2c of the left SFP cage (wan) */
+	i2c_sfp1: i2c-gpio-0 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&pio 16 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&pio 17 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	/* i2c of the right SFP cage (lan) */
+	i2c_sfp2: i2c-gpio-1 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&pio 18 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&pio 19 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		green_led: led-0 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_POWER;
+			gpios = <&pio 69 GPIO_ACTIVE_HIGH>;
+			default-state = "on";
+		};
+
+		blue_led: led-1 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&pio 86 GPIO_ACTIVE_HIGH>;
+			default-state = "off";
+		};
+	};
+
+	reg_1p8v: regulator-1p8v {
+		compatible = "regulator-fixed";
+		regulator-name = "1.8vd";
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		regulator-boot-on;
+		regulator-always-on;
+		vin-supply = <&dcin>;
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "3.3vd";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+		vin-supply = <&dcin>;
+	};
+
+	/* left SFP cage (wan) */
+	sfp1: sfp-1 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c_sfp1>;
+		los-gpios = <&pio 46 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpios = <&pio 49 GPIO_ACTIVE_LOW>;
+		tx-disable-gpios = <&pio 20 GPIO_ACTIVE_HIGH>;
+		tx-fault-gpios = <&pio 7 GPIO_ACTIVE_HIGH>;
+	};
+
+	/* right SFP cage (lan) */
+	sfp2: sfp-2 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c_sfp2>;
+		los-gpios = <&pio 31 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpios = <&pio 47 GPIO_ACTIVE_LOW>;
+		tx-disable-gpios = <&pio 15 GPIO_ACTIVE_HIGH>;
+		tx-fault-gpios = <&pio 48 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&cpu_thermal {
+	cooling-maps {
+		cpu-active-high {
+			/* active: set fan to cooling level 2 */
+			cooling-device = <&fan 2 2>;
+			trip = <&cpu_trip_active_high>;
+		};
+
+		cpu-active-low {
+			/* active: set fan to cooling level 1 */
+			cooling-device = <&fan 1 1>;
+			trip = <&cpu_trip_active_low>;
+		};
+
+		cpu-passive {
+			/* passive: set fan to cooling level 0 */
+			cooling-device = <&fan 0 0>;
+			trip = <&cpu_trip_passive>;
+		};
+	};
+};
+
+&crypto {
+	status = "okay";
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "2500base-x";
+		sfp = <&sfp1>;
+		managed = "in-band-status";
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+};
+
+&mdio {
+	switch: switch@31 {
+		compatible = "mediatek,mt7531";
+		reg = <31>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <66 IRQ_TYPE_LEVEL_HIGH>;
+		reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&mmc0 {
+	pinctrl-names = "default", "state_uhs";
+	pinctrl-0 = <&mmc0_pins_default>;
+	pinctrl-1 = <&mmc0_pins_uhs>;
+	vmmc-supply = <&reg_3p3v>;
+	vqmmc-supply = <&reg_1p8v>;
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c_pins>;
+	status = "okay";
+};
+
+&pcie {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie_pins>;
+	status = "okay";
+};
+
+&pcie_phy {
+	status = "okay";
+};
+
+&pio {
+	i2c_pins: i2c-pins {
+		mux {
+			function = "i2c";
+			groups = "i2c";
+		};
+	};
+
+	mmc0_pins_default: mmc0-pins {
+		mux {
+			function = "emmc";
+			groups = "emmc_51";
+		};
+		conf-cmd-dat {
+			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
+			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
+			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
+			input-enable;
+			drive-strength = <4>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_01>; /* pull-up 10K */
+		};
+		conf-clk {
+			pins = "EMMC_CK";
+			drive-strength = <6>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_10>; /* pull-down 50K */
+		};
+		conf-ds {
+			pins = "EMMC_DSL";
+			bias-pull-down = <MTK_PUPD_SET_R1R0_10>; /* pull-down 50K */
+		};
+		conf-rst {
+			pins = "EMMC_RSTB";
+			drive-strength = <4>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_01>; /* pull-up 10K */
+		};
+	};
+
+	mmc0_pins_uhs: mmc0-uhs-pins {
+		mux {
+			function = "emmc";
+			groups = "emmc_51";
+		};
+		conf-cmd-dat {
+			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
+			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
+			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
+			input-enable;
+			drive-strength = <4>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_01>; /* pull-up 10K */
+		};
+		conf-clk {
+			pins = "EMMC_CK";
+			drive-strength = <6>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_10>; /* pull-down 50K */
+		};
+		conf-ds {
+			pins = "EMMC_DSL";
+			bias-pull-down = <MTK_PUPD_SET_R1R0_10>; /* pull-down 50K */
+		};
+		conf-rst {
+			pins = "EMMC_RSTB";
+			drive-strength = <4>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_01>; /* pull-up 10K */
+		};
+	};
+
+	pcie_pins: pcie-pins {
+		mux {
+			function = "pcie";
+			groups = "pcie_clk", "pcie_pereset";
+		};
+	};
+
+	pwm_pins: pwm-pins {
+		mux {
+			function = "pwm";
+			groups = "pwm0", "pwm1_0";
+		};
+	};
+
+	spi_flash_pins: spi-flash-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+	};
+
+	spic_pins: spic-pins {
+		mux {
+			function = "spi";
+			groups = "spi1_0";
+		};
+	};
+
+	uart1_pins: uart1-pins {
+		mux {
+			function = "uart";
+			groups = "uart1_rx_tx";
+		};
+	};
+
+	uart2_pins: uart2-pins {
+		mux {
+			function = "uart";
+			groups = "uart2_0_rx_tx";
+		};
+	};
+
+	wf_2g_5g_pins: wf-2g-5g-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_2g", "wf_5g";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			       "WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+
+	wf_dbdc_pins: wf-dbdc-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_dbdc";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			       "WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+
+	wf_led_pins: wf-led-pins {
+		mux {
+			function = "led";
+			groups = "wifi_led";
+		};
+	};
+};
+
+&pwm {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pwm_pins>;
+	status = "okay";
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	status = "okay";
+};
+
+&spi1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spic_pins>;
+	status = "okay";
+};
+
+&ssusb {
+	status = "okay";
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "wan";
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan0";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan1";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan2";
+		};
+
+		port@4 {
+			reg = <4>;
+			label = "lan3";
+		};
+
+		port5: port@5 {
+			reg = <5>;
+			label = "lan4";
+			phy-mode = "2500base-x";
+			sfp = <&sfp2>;
+			managed = "in-band-status";
+		};
+
+		port@6 {
+			reg = <6>;
+			label = "cpu";
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&trng {
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&uart1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart1_pins>;
+	status = "okay";
+};
+
+&uart2 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart2_pins>;
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi {
+	status = "okay";
+	pinctrl-names = "default", "dbdc";
+	pinctrl-0 = <&wf_2g_5g_pins>, <&wf_led_pins>;
+	pinctrl-1 = <&wf_dbdc_pins>, <&wf_led_pins>;
+
+	led {
+		led-active-low;
+	};
+};
+
diff --git a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-rfb-spim-nand.dts b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-rfb-spim-nand.dts
index 72b8923b41dae7..83a37150cf07ed 100644
--- a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-rfb-spim-nand.dts
+++ b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-rfb-spim-nand.dts
@@ -1,51 +1,52 @@
 /* SPDX-License-Identifier: (GPL-2.0-only OR MIT) */
 
-/dts-v1/;
-/plugin/;
+#include "mt7986a-rfb.dtsi"
 
 / {
-        compatible = "mediatek,mt7986a-spim-snand-rfb";
+	compatible = "mediatek,mt7986a-rfb-snand";
+};
+
+&spi0 {
+	status = "okay";
 
-        fragment@0 {
-		target-path = "/soc/spi@1100a000";
-                __overlay__ {
-			status = "okay";
-			spi_nand: spi_nand@0 {
-				#address-cells = <1>;
-				#size-cells = <1>;
-				compatible = "spi-nand";
-				reg = <1>;
-				spi-max-frequency = <10000000>;
-				spi-tx-buswidth = <4>;
-				spi-rx-buswidth = <4>;
+	spi_nand: spi_nand@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "spi-nand";
+		reg = <1>;
+		spi-max-frequency = <10000000>;
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
 
-				partitions {
-					compatible = "fixed-partitions";
-					#address-cells = <1>;
-					#size-cells = <1>;
-					partition@0 {
-						label = "BL2";
-						reg = <0x00000 0x0100000>;
-						read-only;
-					};
-					partition@100000 {
-						label = "u-boot-env";
-						reg = <0x0100000 0x0080000>;
-					};
-					factory: partition@180000 {
-						label = "Factory";
-						reg = <0x180000 0x0200000>;
-					};
-					partition@380000 {
-						label = "FIP";
-						reg = <0x380000 0x0200000>;
-					};
-					partition@580000 {
-						label = "ubi";
-						reg = <0x580000 0x4000000>;
-					};
-				};
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			partition@0 {
+				label = "BL2";
+				reg = <0x00000 0x0100000>;
+				read-only;
+			};
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x0100000 0x0080000>;
+			};
+			factory: partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x0200000>;
+			};
+			partition@380000 {
+				label = "FIP";
+				reg = <0x380000 0x0200000>;
+			};
+			partition@580000 {
+				label = "ubi";
+				reg = <0x580000 0x4000000>;
 			};
 		};
-        };
+	};
+};
+
+&wifi {
+	mediatek,mtd-eeprom = <&factory 0>;
 };
diff --git a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-rfb-spim-nor.dts b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-rfb-spim-nor.dts
index b847e484556d9b..868365a99429a7 100644
--- a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-rfb-spim-nor.dts
+++ b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-rfb-spim-nor.dts
@@ -1,50 +1,51 @@
 /* SPDX-License-Identifier: (GPL-2.0-only OR MIT) */
 
-/dts-v1/;
-/plugin/;
+#include "mt7986a-rfb.dtsi"
 
 / {
-        compatible = "mediatek,mt7986a-snor-rfb";
+	compatible = "mediatek,mt7986a-rfb-snor";
+};
+
+&spi0 {
+	status = "okay";
 
-        fragment@0 {
-		target-path = "/soc/spi@1100a000";
-		__overlay__ {
-			status = "okay";
-			spi_nor: spi_nor@0 {
-				#address-cells = <1>;
-				#size-cells = <1>;
-				compatible = "jedec,spi-nor";
-				reg = <0>;
-				spi-max-frequency = <52000000>;
-				spi-tx-buswidth = <4>;
-				spi-rx-buswidth = <4>;
-				partitions {
-					compatible = "fixed-partitions";
-					#address-cells = <1>;
-					#size-cells = <1>;
+	spi_nor: spi_nor@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
 
-					partition@00000 {
-						label = "BL2";
-						reg = <0x00000 0x0040000>;
-					};
-					partition@40000 {
-						label = "u-boot-env";
-						reg = <0x40000 0x0010000>;
-					};
-					factory: partition@50000 {
-						label = "Factory";
-						reg = <0x50000 0x00B0000>;
-					};
-					partition@100000 {
-						label = "FIP";
-						reg = <0x100000 0x0080000>;
-					};
-					partition@180000 {
-						label = "firmware";
-						reg = <0x180000 0xE00000>;
-					};
-				};
+			partition@00000 {
+				label = "BL2";
+				reg = <0x00000 0x0040000>;
+			};
+			partition@40000 {
+				label = "u-boot-env";
+				reg = <0x40000 0x0010000>;
+			};
+			factory: partition@50000 {
+				label = "Factory";
+				reg = <0x50000 0x00B0000>;
+			};
+			partition@100000 {
+				label = "FIP";
+				reg = <0x100000 0x0080000>;
+			};
+			partition@180000 {
+				label = "firmware";
+				reg = <0x180000 0xE00000>;
 			};
 		};
-        };
+	};
+};
+
+&wifi {
+	mediatek,mtd-eeprom = <&factory 0>;
 };
diff --git a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dtsi b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dtsi
new file mode 100644
index 00000000000000..1ab56e37f741cd
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dtsi
@@ -0,0 +1,389 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2021 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/dts-v1/;
+#include "mt7986a.dtsi"
+
+/ {
+	model = "MediaTek MT7986a RFB";
+	compatible = "mediatek,mt7986a-rfb";
+
+	aliases {
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	memory {
+		reg = <0 0x40000000 0 0x40000000>;
+	};
+
+	reg_1p8v: regulator-1p8v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-1.8V";
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-3.3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_5v: regulator-5v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-5V";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "2500base-x";
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+};
+
+&wifi {
+	status = "okay";
+	pinctrl-names = "default", "dbdc";
+	pinctrl-0 = <&wf_2g_5g_pins>;
+	pinctrl-1 = <&wf_dbdc_pins>;
+};
+
+&mdio {
+	phy5: phy@5 {
+		compatible = "ethernet-phy-id67c9.de0a";
+		reg = <5>;
+
+		reset-gpios = <&pio 6 1>;
+		reset-deassert-us = <20000>;
+	};
+
+	phy6: phy@6 {
+		compatible = "ethernet-phy-id67c9.de0a";
+		reg = <6>;
+	};
+
+	switch: switch@0 {
+		compatible = "mediatek,mt7531";
+		reg = <31>;
+		reset-gpios = <&pio 5 0>;
+	};
+};
+
+&crypto {
+	status = "okay";
+};
+
+&mmc0 {
+	pinctrl-names = "default", "state_uhs";
+	pinctrl-0 = <&mmc0_pins_default>;
+	pinctrl-1 = <&mmc0_pins_uhs>;
+	bus-width = <8>;
+	max-frequency = <200000000>;
+	cap-mmc-highspeed;
+	mmc-hs200-1_8v;
+	mmc-hs400-1_8v;
+	hs400-ds-delay = <0x14014>;
+	vmmc-supply = <&reg_3p3v>;
+	vqmmc-supply = <&reg_1p8v>;
+	non-removable;
+	no-sd;
+	no-sdio;
+	status = "okay";
+};
+
+&pcie {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie_pins>;
+	status = "okay";
+};
+
+&pcie_phy {
+	status = "okay";
+};
+
+&pio {
+	mmc0_pins_default: mmc0-pins {
+		mux {
+			function = "emmc";
+			groups = "emmc_51";
+		};
+		conf-cmd-dat {
+			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
+			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
+			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
+			input-enable;
+			drive-strength = <4>;
+			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
+		};
+		conf-clk {
+			pins = "EMMC_CK";
+			drive-strength = <6>;
+			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
+		};
+		conf-ds {
+			pins = "EMMC_DSL";
+			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
+		};
+		conf-rst {
+			pins = "EMMC_RSTB";
+			drive-strength = <4>;
+			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
+		};
+	};
+
+	mmc0_pins_uhs: mmc0-uhs-pins {
+		mux {
+			function = "emmc";
+			groups = "emmc_51";
+		};
+		conf-cmd-dat {
+			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
+			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
+			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
+			input-enable;
+			drive-strength = <4>;
+			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
+		};
+		conf-clk {
+			pins = "EMMC_CK";
+			drive-strength = <6>;
+			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
+		};
+		conf-ds {
+			pins = "EMMC_DSL";
+			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
+		};
+		conf-rst {
+			pins = "EMMC_RSTB";
+			drive-strength = <4>;
+			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
+		};
+	};
+
+	pcie_pins: pcie-pins {
+		mux {
+			function = "pcie";
+			groups = "pcie_clk", "pcie_wake", "pcie_pereset";
+		};
+	};
+
+	spic_pins_g2: spic-pins-29-to-32 {
+		mux {
+			function = "spi";
+			groups = "spi1_2";
+		};
+	};
+
+	spi_flash_pins: spi-flash-pins-33-to-38 {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+		conf-pu {
+			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
+			drive-strength = <8>;
+			mediatek,pull-up-adv = <0>;	/* bias-disable */
+		};
+		conf-pd {
+			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
+			drive-strength = <8>;
+			mediatek,pull-down-adv = <0>;	/* bias-disable */
+		};
+	};
+
+	uart1_pins: uart1-pins {
+		mux {
+			function = "uart";
+			groups = "uart1";
+		};
+	};
+
+	uart2_pins: uart2-pins {
+		mux {
+			function = "uart";
+			groups = "uart2";
+		};
+	};
+
+	wf_2g_5g_pins: wf_2g_5g-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_2g", "wf_5g";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			       "WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+
+	wf_dbdc_pins: wf_dbdc-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_dbdc";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			       "WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	cs-gpios = <0>, <0>;
+	#address-cells = <1>;
+	#size-cells = <0>;
+	status = "disabled";
+};
+
+&spi1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spic_pins_g2>;
+	status = "okay";
+
+	proslic_spi: proslic_spi@0 {
+		compatible = "silabs,proslic_spi";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+		spi-cpha = <1>;
+		spi-cpol = <1>;
+		channel_count = <1>;
+		debug_level = <4>;       /* 1 = TRC, 2 = DBG, 4 = ERR */
+		reset_gpio = <&pio 7 0>;
+		ig,enable-spi = <1>;     /* 1: Enable, 0: Disable */
+	};
+};
+
+&gmac1 {
+	phy-mode = "2500base-x";
+	phy-connection-type = "2500base-x";
+	phy-handle = <&phy6>;
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "lan1";
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan2";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan3";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan4";
+		};
+
+		port@4 {
+			reg = <4>;
+			label = "wan";
+		};
+
+		port@5 {
+			reg = <5>;
+			label = "lan6";
+
+			phy-mode = "2500base-x";
+			phy-handle = <&phy5>;
+		};
+
+		port@6 {
+			reg = <6>;
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&ssusb {
+	vusb33-supply = <&reg_3p3v>;
+	vbus-supply = <&reg_5v>;
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&uart1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart1_pins>;
+	status = "okay";
+};
+
+&uart2 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart2_pins>;
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
diff --git a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
index 17adda15544ff1..68539ea788dfcc 100644
--- a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+++ b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
@@ -4,18 +4,19 @@
  * Author: Sam.Shih <sam.shih@mediatek.com>
  */
 
-#include <dt-bindings/clock/mt7986-clk.h>
 #include <dt-bindings/interrupt-controller/irq.h>
 #include <dt-bindings/interrupt-controller/arm-gic.h>
-#include <dt-bindings/phy/phy.h>
+#include <dt-bindings/clock/mt7986-clk.h>
 #include <dt-bindings/reset/mt7986-resets.h>
+#include <dt-bindings/phy/phy.h>
 
 / {
+	compatible = "mediatek,mt7986a";
 	interrupt-parent = <&gic>;
 	#address-cells = <2>;
 	#size-cells = <2>;
 
-	clk40m: oscillator@0 {
+	clk40m: oscillator-40m {
 		compatible = "fixed-clock";
 		clock-frequency = <40000000>;
 		#clock-cells = <0>;
@@ -59,22 +60,14 @@
 	};
 
 	psci {
-		compatible  = "arm,psci-0.2";
-		method      = "smc";
+		compatible = "arm,psci-0.2";
+		method = "smc";
 	};
 
 	reserved-memory {
 		#address-cells = <2>;
 		#size-cells = <2>;
 		ranges;
-
-		/* 64 KiB reserved for ramoops/pstore */
-		ramoops@42ff0000 {
-			compatible = "ramoops";
-			reg = <0 0x42ff0000 0 0x10000>;
-			record-size = <0x1000>;
-		};
-
 		/* 192 KiB reserved for ARM Trusted Firmware (BL31) */
 		secmon_reserved: secmon@43000000 {
 			reg = <0 0x43000000 0 0x30000>;
@@ -85,6 +78,47 @@
 			no-map;
 			reg = <0 0x4fc00000 0 0x00100000>;
 		};
+
+		wo_emi0: wo-emi@4fd00000 {
+			reg = <0 0x4fd00000 0 0x40000>;
+			no-map;
+		};
+
+		wo_emi1: wo-emi@4fd40000 {
+			reg = <0 0x4fd40000 0 0x40000>;
+			no-map;
+		};
+
+		wo_ilm0: wo-ilm@151e0000 {
+			reg = <0 0x151e0000 0 0x8000>;
+			no-map;
+		};
+
+		wo_ilm1: wo-ilm@151f0000 {
+			reg = <0 0x151f0000 0 0x8000>;
+			no-map;
+		};
+
+		wo_data: wo-data@4fd80000 {
+			reg = <0 0x4fd80000 0 0x240000>;
+			no-map;
+		};
+
+		wo_dlm0: wo-dlm@151e8000 {
+			reg = <0 0x151e8000 0 0x2000>;
+			no-map;
+		};
+
+		wo_dlm1: wo-dlm@151f8000 {
+			reg = <0 0x151f8000 0 0x2000>;
+			no-map;
+		};
+
+		wo_boot: wo-boot@15194000 {
+			reg = <0 0x15194000 0 0x1000>;
+			no-map;
+		};
+
 	};
 
 	timer {
@@ -121,6 +155,12 @@
 			#clock-cells = <1>;
 		};
 
+		wed_pcie: wed-pcie@10003000 {
+			compatible = "mediatek,mt7986-wed-pcie",
+				     "syscon";
+			reg = <0 0x10003000 0 0x10>;
+		};
+
 		topckgen: topckgen@1001b000 {
 			compatible = "mediatek,mt7986-topckgen", "syscon";
 			reg = <0 0x1001B000 0 0x1000>;
@@ -128,11 +168,17 @@
 		};
 
 		watchdog: watchdog@1001c000 {
-			compatible = "mediatek,mt7986-wdt",
-				     "mediatek,mt6589-wdt";
+			compatible = "mediatek,mt7986-wdt";
 			reg = <0 0x1001c000 0 0x1000>;
 			interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH>;
 			#reset-cells = <1>;
+			status = "disabled";
+		};
+
+		apmixedsys: apmixedsys@1001e000 {
+			compatible = "mediatek,mt7986-apmixedsys";
+			reg = <0 0x1001E000 0 0x1000>;
+			#clock-cells = <1>;
 		};
 
 		pio: pinctrl@1001f000 {
@@ -156,12 +202,6 @@
 			#interrupt-cells = <2>;
 		};
 
-		apmixedsys: apmixedsys@1001e000 {
-			compatible = "mediatek,mt7986-apmixedsys";
-			reg = <0 0x1001E000 0 0x1000>;
-			#clock-cells = <1>;
-		};
-
 		sgmiisys0: syscon@10060000 {
 			compatible = "mediatek,mt7986-sgmiisys_0",
 				     "syscon";
@@ -176,12 +216,13 @@
 			#clock-cells = <1>;
 		};
 
-		trng: trng@1020f000 {
-			compatible = "mediatek,mt7986-rng";
+		trng: rng@1020f000 {
+			compatible = "mediatek,mt7986-rng",
+				     "mediatek,mt7623-rng";
 			reg = <0 0x1020f000 0 0x100>;
 			clocks = <&infracfg CLK_INFRA_TRNG_CK>;
 			clock-names = "rng";
-			status = "okay";
+			status = "disabled";
 		};
 
 		crypto: crypto@10320000 {
@@ -196,7 +237,21 @@
 			clock-names = "infra_eip97_ck";
 			assigned-clocks = <&topckgen CLK_TOP_EIP_B_SEL>;
 			assigned-clock-parents = <&apmixedsys CLK_APMIXED_NET2PLL>;
-			status = "okay";
+			status = "disabled";
+		};
+
+		pwm: pwm@10048000 {
+			compatible = "mediatek,mt7986-pwm";
+			reg = <0 0x10048000 0 0x1000>;
+			#clock-cells = <1>;
+			#pwm-cells = <2>;
+			interrupts = <GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&topckgen CLK_TOP_PWM_SEL>,
+				 <&infracfg CLK_INFRA_PWM_STA>,
+				 <&infracfg CLK_INFRA_PWM1_CK>,
+				 <&infracfg CLK_INFRA_PWM2_CK>;
+			clock-names = "top", "main", "pwm1", "pwm2";
+			status = "disabled";
 		};
 
 		uart0: serial@11002000 {
@@ -240,8 +295,24 @@
 			status = "disabled";
 		};
 
+		i2c0: i2c@11008000 {
+			compatible = "mediatek,mt7986-i2c";
+			reg = <0 0x11008000 0 0x90>,
+			      <0 0x10217080 0 0x80>;
+			interrupts = <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>;
+			clock-div = <5>;
+			clocks = <&infracfg CLK_INFRA_I2C0_CK>,
+				 <&infracfg CLK_INFRA_AP_DMA_CK>;
+			clock-names = "main", "dma";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
 		spi0: spi@1100a000 {
 			compatible = "mediatek,mt7986-spi-ipm", "mediatek,spi-ipm";
+			#address-cells = <1>;
+			#size-cells = <0>;
 			reg = <0 0x1100a000 0 0x100>;
 			interrupts = <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&topckgen CLK_TOP_MPLL_D2>,
@@ -254,6 +325,8 @@
 
 		spi1: spi@1100b000 {
 			compatible = "mediatek,mt7986-spi-ipm", "mediatek,spi-ipm";
+			#address-cells = <1>;
+			#size-cells = <0>;
 			reg = <0 0x1100b000 0 0x100>;
 			interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&topckgen CLK_TOP_MPLL_D2>,
@@ -264,6 +337,15 @@
 			status = "disabled";
 		};
 
+		auxadc: adc@1100d000 {
+			compatible = "mediatek,mt7986-auxadc";
+			reg = <0 0x1100d000 0 0x1000>;
+			clocks = <&infracfg CLK_INFRA_ADC_26M_CK>;
+			clock-names = "main";
+			#io-channel-cells = <1>;
+			status = "disabled";
+		};
+
 		ssusb: usb@11200000 {
 			compatible = "mediatek,mt7986-xhci",
 				     "mediatek,mtk-xhci";
@@ -272,15 +354,15 @@
 			reg-names = "mac", "ippc";
 			interrupts = <GIC_SPI 173 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&infracfg CLK_INFRA_IUSB_SYS_CK>,
-				 <&topckgen CLK_TOP_U2U3_XHCI_SEL>,
 				 <&infracfg CLK_INFRA_IUSB_CK>,
 				 <&infracfg CLK_INFRA_IUSB_133_CK>,
-				 <&infracfg CLK_INFRA_IUSB_66M_CK>;
+				 <&infracfg CLK_INFRA_IUSB_66M_CK>,
+				 <&topckgen CLK_TOP_U2U3_XHCI_SEL>;
 			clock-names = "sys_ck",
-				      "xhci_ck",
 				      "ref_ck",
 				      "mcu_ck",
-				      "dma_ck";
+				      "dma_ck",
+				      "xhci_ck";
 			phys = <&u2port0 PHY_TYPE_USB2>,
 			       <&u3port0 PHY_TYPE_USB3>,
 			       <&u2port1 PHY_TYPE_USB2>;
@@ -292,18 +374,31 @@
 			reg = <0 0x11230000 0 0x1000>,
 			      <0 0x11c20000 0 0x1000>;
 			interrupts = <GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&infracfg CLK_INFRA_MSDC_CK>,
+			clocks = <&topckgen CLK_TOP_EMMC_416M_SEL>,
 				 <&infracfg CLK_INFRA_MSDC_HCK_CK>,
-				 <&infracfg CLK_INFRA_MSDC_66M_CK>,
-				 <&infracfg CLK_INFRA_MSDC_133M_CK>;
-			clock-names = "source", "hclk", "axi_cg", "ahb_cg";
-			assigned-clocks = <&topckgen CLK_TOP_EMMC_416M_SEL>,
-					  <&topckgen CLK_TOP_EMMC_250M_SEL>;
-			assigned-clock-parents = <&apmixedsys CLK_APMIXED_MPLL>,
-						 <&topckgen CLK_TOP_NET1PLL_D5_D2>;
+				 <&infracfg CLK_INFRA_MSDC_CK>,
+				 <&infracfg CLK_INFRA_MSDC_133M_CK>,
+				 <&infracfg CLK_INFRA_MSDC_66M_CK>;
+			clock-names = "source", "hclk", "source_cg", "bus_clk",
+				      "sys_cg";
 			status = "disabled";
 		};
 
+		thermal: thermal@1100c800 {
+			#thermal-sensor-cells = <1>;
+			compatible = "mediatek,mt7986-thermal";
+			reg = <0 0x1100c800 0 0x800>;
+			interrupts = <GIC_SPI 138 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_THERM_CK>,
+				 <&infracfg CLK_INFRA_ADC_26M_CK>,
+				 <&infracfg CLK_INFRA_ADC_FRC_CK>;
+			clock-names = "therm", "auxadc", "adc_32k";
+			mediatek,auxadc = <&auxadc>;
+			mediatek,apmixedsys = <&apmixedsys>;
+			nvmem-cells = <&thermal_calibration>;
+			nvmem-cell-names = "calibration-data";
+		};
+
 		pcie: pcie@11280000 {
 			compatible = "mediatek,mt7986-pcie",
 				     "mediatek,mt8192-pcie";
@@ -316,11 +411,11 @@
 			bus-range = <0x00 0xff>;
 			ranges = <0x82000000 0x00 0x20000000 0x00
 				  0x20000000 0x00 0x10000000>;
-			clocks = <&infracfg CLK_INFRA_PCIE_SEL>,
+			clocks = <&infracfg CLK_INFRA_IPCIE_PIPE_CK>,
 				 <&infracfg CLK_INFRA_IPCIE_CK>,
-				 <&infracfg CLK_INFRA_IPCIE_PIPE_CK>,
 				 <&infracfg CLK_INFRA_IPCIER_CK>,
 				 <&infracfg CLK_INFRA_IPCIEB_CK>;
+			clock-names = "pl_250m", "tl_26m", "peri_26m", "top_133m";
 			status = "disabled";
 
 			phys = <&pcie_port PHY_TYPE_PCIE>;
@@ -355,31 +450,42 @@
 			};
 		};
 
+		efuse: efuse@11d00000 {
+			compatible = "mediatek,mt7986-efuse", "mediatek,efuse";
+			reg = <0 0x11d00000 0 0x1000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			thermal_calibration: calib@274 {
+				reg = <0x274 0xc>;
+			};
+		};
+
 		usb_phy: t-phy@11e10000 {
 			compatible = "mediatek,mt7986-tphy",
 				     "mediatek,generic-tphy-v2";
-			#address-cells = <2>;
-			#size-cells = <2>;
-			ranges;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			ranges = <0 0 0x11e10000 0x1700>;
 			status = "disabled";
 
-			u2port0: usb-phy@11e10000 {
-				reg = <0 0x11e10000 0 0x700>;
+			u2port0: usb-phy@0 {
+				reg = <0x0 0x700>;
 				clocks = <&topckgen CLK_TOP_DA_U2_REFSEL>,
 					 <&topckgen CLK_TOP_DA_U2_CK_1P_SEL>;
 				clock-names = "ref", "da_ref";
 				#phy-cells = <1>;
 			};
 
-			u3port0: usb-phy@11e10700 {
-				reg = <0 0x11e10700 0 0x900>;
+			u3port0: usb-phy@700 {
+				reg = <0x700 0x900>;
 				clocks = <&topckgen CLK_TOP_USB3_PHY_SEL>;
 				clock-names = "ref";
 				#phy-cells = <1>;
 			};
 
-			u2port1: usb-phy@11e11000 {
-				reg = <0 0x11e11000 0 0x700>;
+			u2port1: usb-phy@1000 {
+				reg = <0x1000 0x700>;
 				clocks = <&topckgen CLK_TOP_DA_U2_REFSEL>,
 					 <&topckgen CLK_TOP_DA_U2_CK_1P_SEL>;
 				clock-names = "ref", "da_ref";
@@ -390,13 +496,53 @@
 		ethsys: syscon@15000000 {
 			 #address-cells = <1>;
 			 #size-cells = <1>;
-			 compatible = "mediatek,mt7986-ethsys_ck",
+			 compatible = "mediatek,mt7986-ethsys",
 				      "syscon";
 			 reg = <0 0x15000000 0 0x1000>;
 			 #clock-cells = <1>;
 			 #reset-cells = <1>;
 		};
 
+		wed0: wed@15010000 {
+			compatible = "mediatek,mt7986-wed",
+				     "syscon";
+			reg = <0 0x15010000 0 0x1000>;
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_SPI 205 IRQ_TYPE_LEVEL_HIGH>;
+			memory-region = <&wo_emi0>, <&wo_ilm0>, <&wo_dlm0>,
+					<&wo_data>, <&wo_boot>;
+			memory-region-names = "wo-emi", "wo-ilm", "wo-dlm",
+					      "wo-data", "wo-boot";
+			mediatek,wo-ccif = <&wo_ccif0>;
+		};
+
+		wed1: wed@15011000 {
+			compatible = "mediatek,mt7986-wed",
+				     "syscon";
+			reg = <0 0x15011000 0 0x1000>;
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_SPI 206 IRQ_TYPE_LEVEL_HIGH>;
+			memory-region = <&wo_emi1>, <&wo_ilm1>, <&wo_dlm1>,
+					<&wo_data>, <&wo_boot>;
+			memory-region-names = "wo-emi", "wo-ilm", "wo-dlm",
+					      "wo-data", "wo-boot";
+			mediatek,wo-ccif = <&wo_ccif1>;
+		};
+
+		wo_ccif0: syscon@151a5000 {
+			compatible = "mediatek,mt7986-wo-ccif", "syscon";
+			reg = <0 0x151a5000 0 0x1000>;
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_SPI 211 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		wo_ccif1: syscon@151ad000 {
+			compatible = "mediatek,mt7986-wo-ccif", "syscon";
+			reg = <0 0x151ad000 0 0x1000>;
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_SPI 212 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
 		eth: ethernet@15100000 {
 			compatible = "mediatek,mt7986-eth";
 			reg = <0 0x15100000 0 0x80000>;
@@ -431,35 +577,57 @@
 						 <&apmixedsys CLK_APMIXED_SGMPLL>;
 			mediatek,ethsys = <&ethsys>;
 			mediatek,sgmiisys = <&sgmiisys0>, <&sgmiisys1>;
+			mediatek,wed-pcie = <&wed_pcie>;
+			mediatek,wed = <&wed0>, <&wed1>;
 			#reset-cells = <1>;
 			#address-cells = <1>;
 			#size-cells = <0>;
 			status = "disabled";
 		};
 
-		consys: consys@10000000 {
-			compatible = "mediatek,mt7986-consys";
-			reg = <0 0x10000000 0 0x8600000>;
-			memory-region = <&wmcpu_emi>;
-		};
-
-		wmac: wmac@18000000 {
-			compatible = "mediatek,mt7986-wmac", "mediatek,wbsys";
-			resets = <&watchdog MT7986_TOPRGU_CONSYS_RST>;
+		wifi: wifi@18000000 {
+			compatible = "mediatek,mt7986-wmac";
+			resets = <&watchdog MT7986_TOPRGU_CONSYS_SW_RST>;
 			reset-names = "consys";
+			clocks = <&topckgen CLK_TOP_CONN_MCUSYS_SEL>,
+				 <&topckgen CLK_TOP_AP2CNN_HOST_SEL>;
+			clock-names = "mcu", "ap2conn";
 			reg = <0 0x18000000 0 0x1000000>,
 			      <0 0x10003000 0 0x1000>,
 			      <0 0x11d10000 0 0x1000>;
 			interrupts = <GIC_SPI 213 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 214 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 215 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 217 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&topckgen CLK_TOP_CONN_MCUSYS_SEL>,
-				 <&topckgen CLK_TOP_AP2CNN_HOST_SEL>;
-			clock-names = "mcu", "ap2conn";
+				     <GIC_SPI 216 IRQ_TYPE_LEVEL_HIGH>;
 			memory-region = <&wmcpu_emi>;
-			status = "disabled";
 		};
 	};
 
+	thermal-zones {
+		cpu_thermal: cpu-thermal {
+			polling-delay-passive = <1000>;
+			polling-delay = <1000>;
+			thermal-sensors = <&thermal 0>;
+
+			trips {
+				cpu_trip_active_high: active-high {
+					temperature = <115000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+
+				cpu_trip_active_low: active-low {
+					temperature = <85000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+
+				cpu_trip_passive: passive {
+					temperature = <40000>;
+					hysteresis = <2000>;
+					type = "passive";
+				};
+			};
+		};
+	};
 };
diff --git a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts
index 52b6c152feb366..83d51916717fb9 100644
--- a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts
+++ b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts
@@ -56,7 +56,7 @@
 	status = "okay";
 };
 
-&wmac {
+&wifi {
 	status = "okay";
 	pinctrl-names = "default", "dbdc";
 	pinctrl-0 = <&wf_2g_5g_pins>;
@@ -139,7 +139,6 @@
 
 				port@6 {
 					reg = <6>;
-					label = "cpu";
 					ethernet = <&gmac0>;
 					phy-mode = "2500base-x";
 
diff --git a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986b.dtsi b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986b.dtsi
index 23923b9f8944b5..db5189664c29ba 100644
--- a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986b.dtsi
+++ b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7986b.dtsi
@@ -5,6 +5,9 @@
  */
 
 #include "mt7986a.dtsi"
+/ {
+	compatible = "mediatek,mt7986b";
+};
 
 &pio {
 	compatible = "mediatek,mt7986b-pinctrl";
diff --git a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7988a-dsa-10g-spim-nand.dts b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7988a-dsa-10g-spim-nand.dts
new file mode 100644
index 00000000000000..98dbf8d6913ff1
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7988a-dsa-10g-spim-nand.dts
@@ -0,0 +1,200 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2022 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/dts-v1/;
+#include "mt7988a-rfb-spim-nand.dtsi"
+#include <dt-bindings/pinctrl/mt65xx.h>
+
+/ {
+	model = "MediaTek MT7988A DSA 10G SPIM-NAND RFB";
+	compatible = "mediatek,mt7988a-dsa-10g-spim-snand",
+		     "mediatek,mt7988a-rfb-snand",
+		     "mediatek,mt7988";
+
+	chosen {
+		bootargs = "console=ttyS0,115200n1 loglevel=8  \
+			    earlycon=uart8250,mmio32,0x11000000 \
+			    pci=pcie_bus_perf";
+	};
+
+	memory {
+		reg = <0 0x40000000 0 0x40000000>;
+	};
+};
+
+&eth {
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "internal";
+
+		fixed-link {
+			speed = <10000>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "internal";
+		phy-connection-type = "internal";
+		phy = <&phy15>;
+	};
+
+	gmac2: mac@2 {
+		compatible = "mediatek,eth-mac";
+		reg = <2>;
+		phy-mode = "10gbase-kr";
+		phy-connection-type = "10gbase-kr";
+		phy = <&phy8>;
+	};
+
+	mdio0: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		/* external Aquantia AQR113C */
+		phy0: ethernet-phy@0 {
+			reg = <0>;
+			compatible = "ethernet-phy-ieee802.3-c45";
+			reset-gpios = <&pio 72 1>;
+			reset-assert-us = <100000>;
+			reset-deassert-us = <221000>;
+		};
+
+		/* external Aquantia AQR113C */
+		phy8: ethernet-phy@8 {
+			reg = <8>;
+			compatible = "ethernet-phy-ieee802.3-c45";
+			reset-gpios = <&pio 71 1>;
+			reset-assert-us = <100000>;
+			reset-deassert-us = <221000>;
+		};
+
+		/* external Maxlinear GPY211C */
+		phy5: ethernet-phy@5 {
+			reg = <5>;
+			compatible = "ethernet-phy-ieee802.3-c45";
+			phy-mode = "2500base-x";
+		};
+
+		/* external Maxlinear GPY211C */
+		phy13: ethernet-phy@13 {
+			reg = <13>;
+			compatible = "ethernet-phy-ieee802.3-c45";
+			phy-mode = "2500base-x";
+		};
+
+		/* internal 2.5G PHY */
+		phy15: ethernet-phy@15 {
+			reg = <15>;
+			pinctrl-names = "i2p5gbe-led";
+			pinctrl-0 = <&i2p5gbe_led0_pins>;
+			compatible = "ethernet-phy-ieee802.3-c45";
+			phy-mode = "internal";
+		};
+	};
+};
+
+&switch {
+	status = "okay";
+
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "lan0";
+			phy-mode = "internal";
+			phy-handle = <&gsw_phy0>;
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan1";
+			phy-mode = "internal";
+			phy-handle = <&gsw_phy1>;
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan2";
+			phy-mode = "internal";
+			phy-handle = <&gsw_phy2>;
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan3";
+			phy-mode = "internal";
+			phy-handle = <&gsw_phy3>;
+		};
+
+		port@6 {
+			reg = <6>;
+			ethernet = <&gmac0>;
+			phy-mode = "internal";
+
+			fixed-link {
+				speed = <10000>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+
+	mdio {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		gsw_phy0: ethernet-phy@0 {
+			compatible = "ethernet-phy-id03a2.9481";
+			reg = <0>;
+			phy-mode = "internal";
+			pinctrl-names = "gbe-led";
+			pinctrl-0 = <&gbe0_led0_pins>;
+			nvmem-cells = <&phy_calibration_p0>;
+			nvmem-cell-names = "phy-cal-data";
+		};
+
+		gsw_phy1: ethernet-phy@1 {
+			compatible = "ethernet-phy-id03a2.9481";
+			reg = <1>;
+			phy-mode = "internal";
+			pinctrl-names = "gbe-led";
+			pinctrl-0 = <&gbe1_led0_pins>;
+			nvmem-cells = <&phy_calibration_p1>;
+			nvmem-cell-names = "phy-cal-data";
+		};
+
+		gsw_phy2: ethernet-phy@2 {
+			compatible = "ethernet-phy-id03a2.9481";
+			reg = <2>;
+			phy-mode = "internal";
+			pinctrl-names = "gbe-led";
+			pinctrl-0 = <&gbe2_led0_pins>;
+			nvmem-cells = <&phy_calibration_p2>;
+			nvmem-cell-names = "phy-cal-data";
+		};
+
+		gsw_phy3: ethernet-phy@3 {
+			compatible = "ethernet-phy-id03a2.9481";
+			reg = <3>;
+			phy-mode = "internal";
+			pinctrl-names = "gbe-led";
+			pinctrl-0 = <&gbe3_led0_pins>;
+			nvmem-cells = <&phy_calibration_p3>;
+			nvmem-cell-names = "phy-cal-data";
+		};
+	};
+};
diff --git a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7988a-rfb-spim-nand.dtsi b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7988a-rfb-spim-nand.dtsi
new file mode 100644
index 00000000000000..e4c05712509ee4
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7988a-rfb-spim-nand.dtsi
@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2022 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/dts-v1/;
+#include "mt7988a-rfb.dtsi"
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	spi_nand: spi_nand@0 {
+		compatible = "spi-nand";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
+	};
+
+};
+
+&spi_nand {
+	mediatek,nmbm;
+	mediatek,bmt-max-ratio = <1>;
+	mediatek,bmt-max-reserved-blocks = <64>;
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "BL2";
+			reg = <0x00000 0x0100000>;
+			read-only;
+		};
+
+		partition@100000 {
+			label = "u-boot-env";
+			reg = <0x0100000 0x0080000>;
+		};
+
+		factory: partition@180000 {
+			label = "Factory";
+			reg = <0x180000 0x0400000>;
+		};
+
+		partition@580000 {
+			label = "FIP";
+			reg = <0x580000 0x0200000>;
+		};
+
+		partition@780000 {
+			label = "ubi";
+			reg = <0x780000 0x7080000>;
+		};
+	};
+};
diff --git a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7988a-rfb.dtsi b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7988a-rfb.dtsi
new file mode 100644
index 00000000000000..423b3860c6c64e
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7988a-rfb.dtsi
@@ -0,0 +1,175 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2022 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/dts-v1/;
+#include "mt7988a.dtsi"
+#include <dt-bindings/regulator/richtek,rt5190a-regulator.h>
+
+&cpu0 {
+	proc-supply = <&rt5190_buck3>;
+};
+
+&cpu1 {
+	proc-supply = <&rt5190_buck3>;
+};
+
+&cpu2 {
+	proc-supply = <&rt5190_buck3>;
+};
+
+&cpu3 {
+	proc-supply = <&rt5190_buck3>;
+};
+
+&cci {
+	proc-supply = <&rt5190_buck3>;
+};
+
+&eth {
+	status = "okay";
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	status = "okay";
+
+	rt5190a_64: rt5190a@64 {
+		compatible = "richtek,rt5190a";
+		reg = <0x64>;
+		/*interrupts-extended = <&gpio26 0 IRQ_TYPE_LEVEL_LOW>;*/
+		vin2-supply = <&rt5190_buck1>;
+		vin3-supply = <&rt5190_buck1>;
+		vin4-supply = <&rt5190_buck1>;
+
+		regulators {
+			rt5190_buck1: buck1 {
+				regulator-name = "rt5190a-buck1";
+				regulator-min-microvolt = <5090000>;
+				regulator-max-microvolt = <5090000>;
+				regulator-allowed-modes =
+				<RT5190A_OPMODE_AUTO RT5190A_OPMODE_FPWM>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			buck2 {
+				regulator-name = "vcore";
+				regulator-min-microvolt = <600000>;
+				regulator-max-microvolt = <1400000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			rt5190_buck3: buck3 {
+				regulator-name = "vproc";
+				regulator-min-microvolt = <600000>;
+				regulator-max-microvolt = <1400000>;
+				regulator-boot-on;
+			};
+			buck4 {
+				regulator-name = "rt5190a-buck4";
+				regulator-min-microvolt = <850000>;
+				regulator-max-microvolt = <850000>;
+				regulator-allowed-modes =
+				<RT5190A_OPMODE_AUTO RT5190A_OPMODE_FPWM>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			ldo {
+				regulator-name = "rt5190a-ldo";
+				regulator-min-microvolt = <1200000>;
+				regulator-max-microvolt = <1200000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+		};
+	};
+};
+
+&pcie0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie0_pins>;
+	status = "okay";
+};
+
+&pcie1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie1_pins>;
+	status = "okay";
+};
+
+&pcie2 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie2_pins>;
+	status = "disabled";
+};
+
+&pcie3 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie3_pins>;
+	status = "okay";
+};
+
+&ssusb0 {
+	status = "okay";
+};
+
+&ssusb1 {
+	status = "okay";
+};
+
+&tphy {
+	status = "okay";
+};
+
+&pio {
+	pcie0_pins: pcie0-pins {
+		mux {
+			function = "pcie";
+			groups = "pcie_2l_0_pereset", "pcie_clk_req_n0_0",
+				 "pcie_wake_n0_0";
+		};
+	};
+
+	pcie1_pins: pcie1-pins {
+		mux {
+			function = "pcie";
+			groups = "pcie_2l_1_pereset", "pcie_clk_req_n1",
+				 "pcie_wake_n1_0";
+		};
+	};
+
+	pcie2_pins: pcie2-pins {
+		mux {
+			function = "pcie";
+			groups = "pcie_1l_0_pereset", "pcie_clk_req_n2_0",
+				 "pcie_wake_n2_0";
+		};
+	};
+
+	pcie3_pins: pcie3-pins {
+		mux {
+			function = "pcie";
+			groups = "pcie_1l_1_pereset", "pcie_clk_req_n3",
+				 "pcie_wake_n3_0";
+		};
+	};
+};
+
+&spi0 {
+	status = "disabled";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&xphy {
+	status = "okay";
+};
diff --git a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7988a.dtsi b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7988a.dtsi
new file mode 100644
index 00000000000000..13ad39500d1b93
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7988a.dtsi
@@ -0,0 +1,853 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2023 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+#include <dt-bindings/interrupt-controller/irq.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/phy/phy.h>
+#include <dt-bindings/reset/ti-syscon.h>
+#include <dt-bindings/clock/mediatek,mt7988-clk.h>
+#include <dt-bindings/pinctrl/mt65xx.h>
+#include <dt-bindings/thermal/thermal.h>
+
+/ {
+	compatible = "mediatek,mt7988";
+	interrupt-parent = <&gic>;
+	#address-cells = <2>;
+	#size-cells = <2>;
+
+	clk40m: oscillator@0 {
+		compatible = "fixed-clock";
+		clock-frequency = <40000000>;
+		#clock-cells = <0>;
+		clock-output-names = "clkxtal";
+	};
+
+	cpus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		cpu0: cpu@0 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a73";
+			enable-method = "psci";
+			reg = <0x0>;
+			clocks = <&mcusys CLK_MCU_ARM_DIV_SEL>,
+				 <&topckgen CLK_TOP_XTAL>;
+			clock-names = "cpu", "intermediate";
+			operating-points-v2 = <&cluster0_opp>;
+			mediatek,cci = <&cci>;
+		};
+
+		cpu1: cpu@1 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a73";
+			enable-method = "psci";
+			reg = <0x1>;
+			clocks = <&mcusys CLK_MCU_ARM_DIV_SEL>,
+				 <&topckgen CLK_TOP_XTAL>;
+			clock-names = "cpu", "intermediate";
+			operating-points-v2 = <&cluster0_opp>;
+			mediatek,cci = <&cci>;
+		};
+
+		cpu2: cpu@2 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a73";
+			enable-method = "psci";
+			reg = <0x2>;
+			clocks = <&mcusys CLK_MCU_ARM_DIV_SEL>,
+				 <&topckgen CLK_TOP_XTAL>;
+			clock-names = "cpu", "intermediate";
+			operating-points-v2 = <&cluster0_opp>;
+			mediatek,cci = <&cci>;
+		};
+
+		cpu3: cpu@3 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a73";
+			enable-method = "psci";
+			reg = <0x3>;
+			clocks = <&mcusys CLK_MCU_ARM_DIV_SEL>,
+				 <&topckgen CLK_TOP_XTAL>;
+			clock-names = "cpu", "intermediate";
+			operating-points-v2 = <&cluster0_opp>;
+			mediatek,cci = <&cci>;
+		};
+
+		cluster0_opp: opp_table0 {
+			compatible = "operating-points-v2";
+			opp-shared;
+			opp00 {
+				opp-hz = /bits/ 64 <800000000>;
+				opp-microvolt = <850000>;
+			};
+			opp01 {
+				opp-hz = /bits/ 64 <1100000000>;
+				opp-microvolt = <850000>;
+			};
+			opp02 {
+				opp-hz = /bits/ 64 <1500000000>;
+				opp-microvolt = <850000>;
+			};
+			opp03 {
+				opp-hz = /bits/ 64 <1800000000>;
+				opp-microvolt = <900000>;
+			};
+		};
+	};
+
+	cci: cci {
+		compatible = "mediatek,mt7988-cci",
+			     "mediatek,mt8183-cci";
+		clocks = <&mcusys CLK_MCU_BUS_DIV_SEL>,
+			 <&topckgen CLK_TOP_XTAL>;
+		clock-names = "cci", "intermediate";
+		operating-points-v2 = <&cci_opp>;
+	};
+
+	cci_opp: opp_table_cci {
+		compatible = "operating-points-v2";
+		opp-shared;
+		opp00 {
+			opp-hz = /bits/ 64 <480000000>;
+			opp-microvolt = <850000>;
+		};
+		opp01 {
+			opp-hz = /bits/ 64 <660000000>;
+			opp-microvolt = <850000>;
+		};
+		opp02 {
+			opp-hz = /bits/ 64 <900000000>;
+			opp-microvolt = <850000>;
+		};
+		opp03 {
+			opp-hz = /bits/ 64 <1080000000>;
+			opp-microvolt = <900000>;
+		};
+	};
+
+	pmu {
+		compatible = "arm,cortex-a73-pmu";
+		interrupt-parent = <&gic>;
+		interrupt = <GIC_PPI 7 IRQ_TYPE_LEVEL_LOW>;
+	};
+
+	psci {
+		compatible  = "arm,psci-0.2";
+		method      = "smc";
+	};
+
+	reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+
+		/* 192 KiB reserved for ARM Trusted Firmware (BL31) */
+		secmon_reserved: secmon@43000000 {
+			reg = <0 0x43000000 0 0x30000>;
+			no-map;
+		};
+	};
+
+	timer {
+		compatible = "arm,armv8-timer";
+		interrupt-parent = <&gic>;
+		interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>;
+	};
+
+	soc {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		compatible = "simple-bus";
+		ranges;
+
+		gic: interrupt-controller@c000000 {
+			compatible = "arm,gic-v3";
+			#interrupt-cells = <3>;
+			interrupt-parent = <&gic>;
+			interrupt-controller;
+			reg = <0 0x0c000000 0 0x40000>,  /* GICD */
+			      <0 0x0c080000 0 0x200000>, /* GICR */
+			      <0 0x0c400000 0 0x2000>,   /* GICC */
+			      <0 0x0c410000 0 0x1000>,   /* GICH */
+			      <0 0x0c420000 0 0x2000>;   /* GICV */
+
+			interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		phyfw: phy-firmware@f000000 {
+			compatible = "mediatek,2p5gphy-fw";
+			reg = <0 0x0f000000 0 0x8000>,
+			      <0 0x0f100000 0 0x20000>,
+			      <0 0x0f0f0000 0 0x200>;
+		};
+
+		infracfg: infracfg@10001000 {
+			compatible = "mediatek,mt7988-infracfg", "syscon";
+			reg = <0 0x10001000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		topckgen: topckgen@1001b000 {
+			compatible = "mediatek,mt7988-topckgen", "syscon";
+			reg = <0 0x1001b000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		watchdog: watchdog@1001c000 {
+			compatible = "mediatek,mt7988-wdt",
+				     "mediatek,mt6589-wdt",
+				     "syscon";
+			reg = <0 0x1001c000 0 0x1000>;
+			interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH>;
+			#reset-cells = <1>;
+		};
+
+		apmixedsys: apmixedsys@1001e000 {
+			compatible = "mediatek,mt7988-apmixedsys";
+			reg = <0 0x1001e000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		pio: pinctrl@1001f000 {
+			compatible = "mediatek,mt7988-pinctrl";
+			reg = <0 0x1001f000 0 0x1000>,
+			<0 0x11c10000 0 0x1000>,
+			<0 0x11d00000 0 0x1000>,
+			<0 0x11d20000 0 0x1000>,
+			<0 0x11e00000 0 0x1000>,
+			<0 0x11f00000 0 0x1000>,
+			<0 0x1000b000 0 0x1000>;
+			reg-names = "gpio_base", "iocfg_tr_base",
+				    "iocfg_br_base", "iocfg_rb_base",
+				    "iocfg_lb_base", "iocfg_tl_base", "eint";
+			gpio-controller;
+			#gpio-cells = <2>;
+			gpio-ranges = <&pio 0 0 83>;
+			interrupt-controller;
+			interrupts = <GIC_SPI 225 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-parent = <&gic>;
+			#interrupt-cells = <2>;
+
+			mdio0_pins: mdio0-pins {
+				mux {
+					function = "eth";
+					groups = "mdc_mdio0";
+				};
+
+				conf {
+					groups = "mdc_mdio0";
+					drive-strength = <MTK_DRIVE_8mA>;
+				};
+			};
+
+			i2c0_pins: i2c0-pins-g0 {
+				mux {
+					function = "i2c";
+					groups = "i2c0_1";
+				};
+			};
+
+			i2c1_pins: i2c1-pins-g0 {
+				mux {
+					function = "i2c";
+					groups = "i2c1_0";
+				};
+			};
+
+			i2c2_pins: i2c2-pins-g0 {
+				mux {
+					function = "i2c";
+					groups = "i2c2_1";
+				};
+			};
+
+			gbe0_led0_pins: gbe0-pins {
+				mux {
+					function = "led";
+					groups = "gbe0_led0";
+				};
+			};
+
+			gbe1_led0_pins: gbe1-pins {
+				mux {
+					function = "led";
+					groups = "gbe1_led0";
+				};
+			};
+
+			gbe2_led0_pins: gbe2-pins {
+				mux {
+					function = "led";
+					groups = "gbe2_led0";
+				};
+			};
+
+			gbe3_led0_pins: gbe3-pins {
+				mux {
+					function = "led";
+					groups = "gbe3_led0";
+				};
+			};
+
+			i2p5gbe_led0_pins: 2p5gbe-pins {
+				mux {
+					function = "led";
+					groups = "2p5gbe_led0";
+				};
+			};
+		};
+
+		boottrap: boottrap@1001f6f0 {
+			compatible = "mediatek,boottrap";
+			reg = <0 0x1001f6f0 0 0x4>;
+		};
+
+		sgmiisys0: syscon@10060000 {
+			compatible = "mediatek,mt7988-sgmiisys",
+				     "mediatek,mt7988-sgmiisys_0",
+				     "syscon";
+			reg = <0 0x10060000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		sgmiisys1: syscon@10070000 {
+			compatible = "mediatek,mt7988-sgmiisys",
+				     "mediatek,mt7988-sgmiisys_1",
+				     "syscon";
+			reg = <0 0x10070000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		usxgmiisys0: usxgmiisys@10080000 {
+			compatible = "mediatek,mt7988-usxgmiisys",
+				     "mediatek,mt7988-usxgmiisys_0",
+				     "syscon";
+			reg = <0 0x10080000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		usxgmiisys1: usxgmiisys@10081000 {
+			compatible = "mediatek,mt7988-usxgmiisys",
+				     "mediatek,mt7988-usxgmiisys_1",
+				     "syscon";
+			reg = <0 0x10081000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		xfi_pextp0: xfi_pextp@11f20000 {
+			compatible = "mediatek,mt7988-xfi_pextp",
+				     "mediatek,mt7988-xfi_pextp_0",
+				     "syscon";
+			reg = <0 0x11f20000 0 0x10000>;
+			#clock-cells = <1>;
+		};
+
+		xfi_pextp1: xfi_pextp@11f30000 {
+			compatible = "mediatek,mt7988-xfi_pextp",
+				     "mediatek,mt7988-xfi_pextp_1",
+				     "syscon";
+			reg = <0 0x11f30000 0 0x10000>;
+			#clock-cells = <1>;
+		};
+
+		xfi_pll: xfi_pll@11f40000 {
+			compatible = "mediatek,mt7988-xfi_pll", "syscon";
+			reg = <0 0x11f40000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		mcusys: mcusys@100e0000 {
+			compatible = "mediatek,mt7988-mcusys", "syscon";
+			reg = <0 0x100e0000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		uart0: serial@11000000 {
+			compatible = "mediatek,mt7986-uart",
+				     "mediatek,mt6577-uart";
+			reg = <0 0x11000000 0 0x100>;
+			interrupts = <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>;
+			/*
+			 * 8250-mtk driver don't control "baud" clock since commit
+			 * e32a83c70cf9 (kernel v5.7), but both "baud" and "bus" clocks
+			 * still need to be passed to the driver to prevent probe fail
+			 */
+			clocks = <&topckgen CLK_TOP_UART_SEL>,
+				 <&infracfg CLK_INFRA_52M_UART0_CK>;
+			clock-names = "baud", "bus";
+			assigned-clocks = <&topckgen CLK_TOP_UART_SEL>,
+					  <&infracfg CLK_INFRA_MUX_UART0_SEL>;
+			assigned-clock-parents = <&topckgen CLK_TOP_XTAL>,
+						 <&topckgen CLK_TOP_UART_SEL>;
+			status = "disabled";
+		};
+
+		i2c0: i2c@11003000 {
+			compatible = "mediatek,mt7988-i2c",
+				     "mediatek,mt7981-i2c";
+			reg = <0 0x11003000 0 0x1000>,
+			      <0 0x10217080 0 0x80>;
+			interrupts = <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>;
+			clock-div = <1>;
+			clocks = <&infracfg CLK_INFRA_I2C_BCK>,
+				 <&infracfg CLK_INFRA_66M_AP_DMA_BCK>;
+			clock-names = "main", "dma";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		i2c1: i2c@11004000 {
+			compatible = "mediatek,mt7988-i2c",
+				     "mediatek,mt7981-i2c";
+			reg = <0 0x11004000 0 0x1000>,
+			      <0 0x10217100 0 0x80>;
+			interrupts = <GIC_SPI 144 IRQ_TYPE_LEVEL_HIGH>;
+			clock-div = <1>;
+			clocks = <&infracfg CLK_INFRA_I2C_BCK>,
+				 <&infracfg CLK_INFRA_66M_AP_DMA_BCK>;
+			clock-names = "main", "dma";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		i2c2: i2c@11005000 {
+			compatible = "mediatek,mt7988-i2c",
+				"mediatek,mt7981-i2c";
+			reg = <0 0x11005000 0 0x1000>,
+			      <0 0x10217180 0 0x80>;
+			interrupts = <GIC_SPI 145 IRQ_TYPE_LEVEL_HIGH>;
+			clock-div = <1>;
+			clocks = <&infracfg CLK_INFRA_I2C_BCK>,
+				 <&infracfg CLK_INFRA_66M_AP_DMA_BCK>;
+			clock-names = "main", "dma";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		spi0: spi@11007000 {
+			compatible = "mediatek,ipm-spi-quad", "mediatek,spi-ipm";
+			reg = <0 0x11007000 0 0x100>;
+			interrupts = <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&topckgen CLK_TOP_MPLL_D2>,
+				 <&topckgen CLK_TOP_SPI_SEL>,
+				 <&infracfg CLK_INFRA_104M_SPI0>,
+				 <&infracfg CLK_INFRA_66M_SPI0_HCK>;
+			clock-names = "parent-clk", "sel-clk", "spi-clk",
+				      "spi-hclk";
+
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "disabled";
+		};
+
+		pcie2: pcie@11280000 {
+			compatible = "mediatek,mt7988-pcie",
+				     "mediatek,mt7986-pcie",
+				     "mediatek,mt8192-pcie";
+			device_type = "pci";
+			#address-cells = <3>;
+			#size-cells = <2>;
+			reg = <0 0x11280000 0 0x2000>;
+			reg-names = "pcie-mac";
+			linux,pci-domain = <3>;
+			interrupts = <GIC_SPI 170 IRQ_TYPE_LEVEL_HIGH>;
+			bus-range = <0x00 0xff>;
+			ranges = <0x81000000 0x00 0x20000000 0x00
+				  0x20000000 0x00 0x00200000>,
+				 <0x82000000 0x00 0x20200000 0x00
+				  0x20200000 0x00 0x07e00000>;
+			clocks = <&infracfg CLK_INFRA_PCIE_PIPE_P2>,
+				 <&infracfg CLK_INFRA_PCIE_GFMUX_TL_P2>,
+				 <&infracfg CLK_INFRA_PCIE_PERI_26M_CK_P2>,
+				 <&infracfg CLK_INFRA_133M_PCIE_CK_P2>;
+			clock-names = "pl_250m", "tl_26m", "peri_26m",
+				      "top_133m";
+			status = "disabled";
+
+			phys = <&xphyu3port0 PHY_TYPE_PCIE>;
+			phy-names = "pcie-phy";
+
+			#interrupt-cells = <1>;
+			interrupt-map-mask = <0 0 0 0x7>;
+			interrupt-map = <0 0 0 1 &pcie_intc2 0>,
+					<0 0 0 2 &pcie_intc2 1>,
+					<0 0 0 3 &pcie_intc2 2>,
+					<0 0 0 4 &pcie_intc2 3>;
+			pcie_intc2: interrupt-controller {
+				#address-cells = <0>;
+				#interrupt-cells = <1>;
+				interrupt-controller;
+			};
+		};
+
+		pcie3: pcie@11290000 {
+			compatible = "mediatek,mt7988-pcie",
+				     "mediatek,mt7986-pcie",
+				     "mediatek,mt8192-pcie";
+			device_type = "pci";
+			#address-cells = <3>;
+			#size-cells = <2>;
+			reg = <0 0x11290000 0 0x2000>;
+			reg-names = "pcie-mac";
+			linux,pci-domain = <2>;
+			interrupts = <GIC_SPI 171 IRQ_TYPE_LEVEL_HIGH>;
+			bus-range = <0x00 0xff>;
+			ranges = <0x81000000 0x00 0x28000000 0x00
+				  0x28000000 0x00 0x00200000>,
+				 <0x82000000 0x00 0x28200000 0x00
+				  0x28200000 0x00 0x07e00000>;
+			clocks = <&infracfg CLK_INFRA_PCIE_PIPE_P3>,
+				 <&infracfg CLK_INFRA_PCIE_GFMUX_TL_P3>,
+				 <&infracfg CLK_INFRA_PCIE_PERI_26M_CK_P3>,
+				 <&infracfg CLK_INFRA_133M_PCIE_CK_P3>;
+			clock-names = "pl_250m", "tl_26m", "peri_26m",
+				      "top_133m";
+			status = "disabled";
+
+			#interrupt-cells = <1>;
+			interrupt-map-mask = <0 0 0 0x7>;
+			interrupt-map = <0 0 0 1 &pcie_intc3 0>,
+					<0 0 0 2 &pcie_intc3 1>,
+					<0 0 0 3 &pcie_intc3 2>,
+					<0 0 0 4 &pcie_intc3 3>;
+			pcie_intc3: interrupt-controller {
+				#address-cells = <0>;
+				#interrupt-cells = <1>;
+				interrupt-controller;
+			};
+		};
+
+		pcie0: pcie@11300000 {
+			compatible = "mediatek,mt7988-pcie",
+				     "mediatek,mt7986-pcie",
+				     "mediatek,mt8192-pcie";
+			device_type = "pci";
+			#address-cells = <3>;
+			#size-cells = <2>;
+			reg = <0 0x11300000 0 0x2000>;
+			reg-names = "pcie-mac";
+			linux,pci-domain = <0>;
+			interrupts = <GIC_SPI 168 IRQ_TYPE_LEVEL_HIGH>;
+			bus-range = <0x00 0xff>;
+			ranges = <0x81000000 0x00 0x30000000 0x00
+				  0x30000000 0x00 0x00200000>,
+				 <0x82000000 0x00 0x30200000 0x00
+				  0x30200000 0x00 0x07e00000>;
+			clocks = <&infracfg CLK_INFRA_PCIE_PIPE_P0>,
+				 <&infracfg CLK_INFRA_PCIE_GFMUX_TL_P0>,
+				 <&infracfg CLK_INFRA_PCIE_PERI_26M_CK_P0>,
+				 <&infracfg CLK_INFRA_133M_PCIE_CK_P0>;
+			clock-names = "pl_250m", "tl_26m", "peri_26m",
+				      "top_133m";
+			status = "disabled";
+
+			#interrupt-cells = <1>;
+			interrupt-map-mask = <0 0 0 0x7>;
+			interrupt-map = <0 0 0 1 &pcie_intc0 0>,
+					<0 0 0 2 &pcie_intc0 1>,
+					<0 0 0 3 &pcie_intc0 2>,
+					<0 0 0 4 &pcie_intc0 3>;
+			pcie_intc0: interrupt-controller {
+				#address-cells = <0>;
+				#interrupt-cells = <1>;
+				interrupt-controller;
+			};
+		};
+
+		pcie1: pcie@11310000 {
+			compatible = "mediatek,mt7988-pcie",
+				     "mediatek,mt7986-pcie",
+				     "mediatek,mt8192-pcie";
+			device_type = "pci";
+			#address-cells = <3>;
+			#size-cells = <2>;
+			reg = <0 0x11310000 0 0x2000>;
+			reg-names = "pcie-mac";
+			linux,pci-domain = <1>;
+			interrupts = <GIC_SPI 169 IRQ_TYPE_LEVEL_HIGH>;
+			bus-range = <0x00 0xff>;
+			ranges = <0x81000000 0x00 0x38000000 0x00
+				  0x38000000 0x00 0x00200000>,
+				 <0x82000000 0x00 0x38200000 0x00
+				  0x38200000 0x00 0x07e00000>;
+			clocks = <&infracfg CLK_INFRA_PCIE_PIPE_P1>,
+				 <&infracfg CLK_INFRA_PCIE_GFMUX_TL_P1>,
+				 <&infracfg CLK_INFRA_PCIE_PERI_26M_CK_P1>,
+				 <&infracfg CLK_INFRA_133M_PCIE_CK_P1>;
+			clock-names = "pl_250m", "tl_26m", "peri_26m",
+				      "top_133m";
+			status = "disabled";
+
+			#interrupt-cells = <1>;
+			interrupt-map-mask = <0 0 0 0x7>;
+			interrupt-map = <0 0 0 1 &pcie_intc1 0>,
+					<0 0 0 2 &pcie_intc1 1>,
+					<0 0 0 3 &pcie_intc1 2>,
+					<0 0 0 4 &pcie_intc1 3>;
+			pcie_intc1: interrupt-controller {
+				#address-cells = <0>;
+				#interrupt-cells = <1>;
+				interrupt-controller;
+			};
+		};
+
+		ssusb0: usb@11190000 {
+			compatible = "mediatek,mt7988-xhci",
+				     "mediatek,mtk-xhci";
+			reg = <0 0x11190000 0 0x2e00>,
+			      <0 0x11193e00 0 0x0100>;
+			reg-names = "mac", "ippc";
+			interrupts = <GIC_SPI 173 IRQ_TYPE_LEVEL_HIGH>;
+			phys = <&xphyu2port0 PHY_TYPE_USB2>,
+			       <&xphyu3port0 PHY_TYPE_USB3>;
+			clocks = <&infracfg CLK_INFRA_USB_SYS>,
+				 <&infracfg CLK_INFRA_USB_XHCI>,
+				 <&infracfg CLK_INFRA_USB_REF>,
+				 <&infracfg CLK_INFRA_66M_USB_HCK>,
+				 <&infracfg CLK_INFRA_133M_USB_HCK>;
+			clock-names = "sys_ck",
+				      "xhci_ck",
+				      "ref_ck",
+				      "mcu_ck",
+				      "dma_ck";
+			#address-cells = <2>;
+			#size-cells = <2>;
+			mediatek,p0_speed_fixup;
+			status = "disabled";
+		};
+
+		ssusb1: usb@11200000 {
+			compatible = "mediatek,mt7988-xhci",
+				     "mediatek,mtk-xhci";
+			reg = <0 0x11200000 0 0x2e00>,
+			      <0 0x11203e00 0 0x0100>;
+			reg-names = "mac", "ippc";
+			interrupts = <GIC_SPI 172 IRQ_TYPE_LEVEL_HIGH>;
+			phys = <&tphyu2port0 PHY_TYPE_USB2>,
+			       <&tphyu3port0 PHY_TYPE_USB3>;
+			clocks = <&infracfg CLK_INFRA_USB_SYS_CK_P1>,
+				 <&infracfg CLK_INFRA_USB_XHCI_CK_P1>,
+				 <&infracfg CLK_INFRA_USB_CK_P1>,
+				 <&infracfg CLK_INFRA_66M_USB_HCK_CK_P1>,
+				 <&infracfg CLK_INFRA_133M_USB_HCK_CK_P1>;
+			clock-names = "sys_ck",
+				      "xhci_ck",
+				      "ref_ck",
+				      "mcu_ck",
+				      "dma_ck";
+			#address-cells = <2>;
+			#size-cells = <2>;
+			status = "disabled";
+		};
+
+		tphy: tphy@11c50000 {
+			compatible = "mediatek,mt7988",
+				     "mediatek,generic-tphy-v2";
+			#address-cells = <2>;
+			#size-cells = <2>;
+			ranges;
+			status = "disabled";
+			tphyu2port0: usb-phy@11c50000 {
+				reg = <0 0x11c50000 0 0x700>;
+				clocks = <&infracfg CLK_INFRA_USB_UTMI_CK_P1>;
+				clock-names = "ref";
+				#phy-cells = <1>;
+			};
+			tphyu3port0: usb-phy@11c50700 {
+				reg = <0 0x11c50700 0 0x900>;
+				clocks = <&infracfg CLK_INFRA_USB_PIPE_CK_P1>;
+				clock-names = "ref";
+				#phy-cells = <1>;
+				mediatek,usb3-pll-ssc-delta;
+				mediatek,usb3-pll-ssc-delta1;
+			};
+		};
+
+		topmisc: topmisc@11d10000 {
+			compatible = "mediatek,mt7988-topmisc", "syscon",
+				     "mediatek,mt7988-power-controller";
+			reg = <0 0x11d10000 0 0x10000>;
+			#clock-cells = <1>;
+			#power-domain-cells = <1>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+		};
+
+		xphy: xphy@11e10000 {
+			compatible = "mediatek,mt7988",
+				     "mediatek,xsphy";
+			#address-cells = <2>;
+			#size-cells = <2>;
+			ranges;
+			status = "disabled";
+
+			xphyu2port0: usb-phy@11e10000 {
+				reg = <0 0x11e10000 0 0x400>;
+				clocks = <&infracfg CLK_INFRA_USB_UTMI>;
+				clock-names = "ref";
+				#phy-cells = <1>;
+			};
+
+			xphyu3port0: usb-phy@11e13000 {
+				reg = <0 0x11e13400 0 0x500>;
+				clocks = <&infracfg CLK_INFRA_USB_PIPE>;
+				clock-names = "ref";
+				#phy-cells = <1>;
+				mediatek,syscon-type = <&topmisc 0x218 0>;
+			};
+		};
+
+		efuse: efuse@11f50000 {
+			compatible = "mediatek,efuse";
+			reg = <0 0x11f50000 0 0x1000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			lvts_calibration: calib@918 {
+				reg = <0x918 0x28>;
+			};
+			phy_calibration_p0: calib@940 {
+				reg = <0x940 0x10>;
+			};
+			phy_calibration_p1: calib@954 {
+				reg = <0x954 0x10>;
+			};
+			phy_calibration_p2: calib@968 {
+				reg = <0x968 0x10>;
+			};
+			phy_calibration_p3: calib@97c {
+				reg = <0x97c 0x10>;
+			};
+			cpufreq_calibration: calib@278 {
+				reg = <0x278 0x1>;
+			};
+		};
+
+		ethsys: syscon@15000000 {
+			#address-cells = <1>;
+			#size-cells = <1>;
+			compatible = "mediatek,mt7988-ethsys", "syscon";
+			reg = <0 0x15000000 0 0x1000>;
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+		};
+
+		switch: switch@15020000 {
+			#address-cells = <1>;
+			#size-cells = <1>;
+			compatible = "mediatek,mt7988-switch";
+			reg = <0 0x15020000 0 0x8000>;
+			interrupt-controller;
+			#interrupt-cells = <1>;
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_SPI 209 IRQ_TYPE_LEVEL_HIGH>;
+			resets = <&ethrst 0>;
+		};
+
+		ethwarp: syscon@15031000 {
+			compatible = "mediatek,mt7988-ethwarp", "syscon", "simple-mfd";
+			reg = <0 0x15031000 0 0x1000>;
+			#clock-cells = <1>;
+
+			ethrst: reset-controller {
+				compatible = "ti,syscon-reset";
+				#reset-cells = <1>;
+				ti,reset-bits = <
+					0x8 9 0x8 9 0 0 (ASSERT_SET | DEASSERT_CLEAR | STATUS_NONE)
+				>;
+			};
+		};
+
+		eth: ethernet@15100000 {
+			compatible = "mediatek,mt7988-eth";
+			reg = <0 0x15100000 0 0x80000>,
+			      <0 0x15400000 0 0x380000>;
+			interrupts = <GIC_SPI 196 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 197 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 198 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 199 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&ethsys CLK_ETHDMA_XGP1_EN>,
+				 <&ethsys CLK_ETHDMA_XGP2_EN>,
+				 <&ethsys CLK_ETHDMA_XGP3_EN>,
+				 <&ethsys CLK_ETHDMA_FE_EN>,
+				 <&ethsys CLK_ETHDMA_GP2_EN>,
+				 <&ethsys CLK_ETHDMA_GP1_EN>,
+				 <&ethsys CLK_ETHDMA_GP3_EN>,
+				 <&ethsys CLK_ETHDMA_ESW_EN>,
+				 <&ethsys CLK_ETHDMA_CRYPT0_EN>,
+				 <&sgmiisys0 CLK_SGM0_TX_EN>,
+				 <&sgmiisys0 CLK_SGM0_RX_EN>,
+				 <&sgmiisys1 CLK_SGM1_TX_EN>,
+				 <&sgmiisys1 CLK_SGM1_RX_EN>,
+				 <&ethwarp CLK_ETHWARP_WOCPU2_EN>,
+				 <&ethwarp CLK_ETHWARP_WOCPU1_EN>,
+				 <&ethwarp CLK_ETHWARP_WOCPU0_EN>,
+				 <&topckgen CLK_TOP_USXGMII_SBUS_0_SEL>,
+				 <&topckgen CLK_TOP_USXGMII_SBUS_1_SEL>,
+				 <&topckgen CLK_TOP_SGM_0_SEL>,
+				 <&topckgen CLK_TOP_SGM_1_SEL>,
+				 <&topckgen CLK_TOP_XFI_PHY_0_XTAL_SEL>,
+				 <&topckgen CLK_TOP_XFI_PHY_1_XTAL_SEL>,
+				 <&topckgen CLK_TOP_ETH_GMII_SEL>,
+				 <&topckgen CLK_TOP_ETH_REFCK_50M_SEL>,
+				 <&topckgen CLK_TOP_ETH_SYS_200M_SEL>,
+				 <&topckgen CLK_TOP_ETH_SYS_SEL>,
+				 <&topckgen CLK_TOP_ETH_XGMII_SEL>,
+				 <&topckgen CLK_TOP_ETH_MII_SEL>,
+				 <&topckgen CLK_TOP_NETSYS_SEL>,
+				 <&topckgen CLK_TOP_NETSYS_500M_SEL>,
+				 <&topckgen CLK_TOP_NETSYS_PAO_2X_SEL>,
+				 <&topckgen CLK_TOP_NETSYS_SYNC_250M_SEL>,
+				 <&topckgen CLK_TOP_NETSYS_PPEFB_250M_SEL>,
+				 <&topckgen CLK_TOP_NETSYS_WARP_SEL>;
+			clock-names = "xgp1", "xgp2", "xgp3", "fe", "gp2", "gp1",
+				      "gp3", "esw", "crypto", "sgmii_tx250m",
+				      "sgmii_rx250m", "sgmii2_tx250m", "sgmii2_rx250m",
+				      "ethwarp_wocpu2", "ethwarp_wocpu1",
+				      "ethwarp_wocpu0", "top_usxgmii0_sel",
+				      "top_usxgmii1_sel", "top_sgm0_sel",
+				      "top_sgm1_sel", "top_xfi_phy0_xtal_sel",
+				      "top_xfi_phy1_xtal_sel", "top_eth_gmii_sel",
+				      "top_eth_refck_50m_sel", "top_eth_sys_200m_sel",
+				      "top_eth_sys_sel", "top_eth_xgmii_sel",
+				      "top_eth_mii_sel", "top_netsys_sel",
+				      "top_netsys_500m_sel", "top_netsys_pao_2x_sel",
+				      "top_netsys_sync_250m_sel",
+				      "top_netsys_ppefb_250m_sel",
+				      "top_netsys_warp_sel";
+			assigned-clocks = <&topckgen CLK_TOP_NETSYS_2X_SEL>,
+					  <&topckgen CLK_TOP_NETSYS_GSW_SEL>,
+					  <&topckgen CLK_TOP_USXGMII_SBUS_0_SEL>,
+					  <&topckgen CLK_TOP_USXGMII_SBUS_1_SEL>,
+					  <&topckgen CLK_TOP_SGM_0_SEL>,
+					  <&topckgen CLK_TOP_SGM_1_SEL>;
+			assigned-clock-parents = <&apmixedsys CLK_APMIXED_NET2PLL>,
+						 <&topckgen CLK_TOP_NET1PLL_D4>,
+						 <&topckgen CLK_TOP_NET1PLL_D8_D4>,
+						 <&topckgen CLK_TOP_NET1PLL_D8_D4>,
+						 <&apmixedsys CLK_APMIXED_SGMPLL>,
+						 <&apmixedsys CLK_APMIXED_SGMPLL>;
+			mediatek,ethsys = <&ethsys>;
+			mediatek,sgmiisys = <&sgmiisys0>, <&sgmiisys1>;
+			mediatek,usxgmiisys = <&usxgmiisys0>, <&usxgmiisys1>;
+			mediatek,xfi_pextp = <&xfi_pextp0>, <&xfi_pextp1>;
+			mediatek,xfi_pll = <&xfi_pll>;
+			mediatek,infracfg = <&topmisc>;
+			mediatek,toprgu = <&watchdog>;
+			#reset-cells = <1>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+	};
+};
diff --git a/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7981-apmixed.c b/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7981-apmixed.c
new file mode 100644
index 00000000000000..1647021de88d8d
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7981-apmixed.c
@@ -0,0 +1,102 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2021 MediaTek Inc.
+ * Author: Sam Shih <sam.shih@mediatek.com>
+ * Author: Wenzhen Yu <wenzhen.yu@mediatek.com>
+ * Author: Jianhui Zhao <zhaojh329@gmail.com>
+ * Author: Daniel Golle <daniel@makrotopia.org>
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/of_device.h>
+#include <linux/platform_device.h>
+#include "clk-mtk.h"
+#include "clk-gate.h"
+#include "clk-mux.h"
+
+#include <dt-bindings/clock/mediatek,mt7981-clk.h>
+#include <linux/clk.h>
+
+#define MT7981_PLL_FMAX (2500UL * MHZ)
+#define CON0_MT7981_RST_BAR BIT(27)
+
+#define PLL_xtal(_id, _name, _reg, _pwr_reg, _en_mask, _flags, _pcwbits,       \
+		 _pd_reg, _pd_shift, _tuner_reg, _pcw_reg, _pcw_shift,         \
+		 _div_table, _parent_name)                                     \
+	{                                                                      \
+		.id = _id, .name = _name, .reg = _reg, .pwr_reg = _pwr_reg,    \
+		.en_mask = _en_mask, .flags = _flags,                          \
+		.rst_bar_mask = CON0_MT7981_RST_BAR, .fmax = MT7981_PLL_FMAX,  \
+		.pcwbits = _pcwbits, .pd_reg = _pd_reg, .pd_shift = _pd_shift, \
+		.tuner_reg = _tuner_reg, .pcw_reg = _pcw_reg,                  \
+		.pcw_shift = _pcw_shift, .div_table = _div_table,              \
+		.parent_name = _parent_name,                                   \
+	}
+
+#define PLL(_id, _name, _reg, _pwr_reg, _en_mask, _flags, _pcwbits, _pd_reg,   \
+	    _pd_shift, _tuner_reg, _pcw_reg, _pcw_shift)                       \
+	PLL_xtal(_id, _name, _reg, _pwr_reg, _en_mask, _flags, _pcwbits,       \
+		 _pd_reg, _pd_shift, _tuner_reg, _pcw_reg, _pcw_shift, NULL,   \
+		 "clkxtal")
+
+static const struct mtk_pll_data plls[] = {
+	PLL(CLK_APMIXED_ARMPLL, "armpll", 0x0200, 0x020C, 0x00000001, PLL_AO,
+	    32, 0x0200, 4, 0, 0x0204, 0),
+	PLL(CLK_APMIXED_NET2PLL, "net2pll", 0x0210, 0x021C, 0x00000001, 0, 32,
+	    0x0210, 4, 0, 0x0214, 0),
+	PLL(CLK_APMIXED_MMPLL, "mmpll", 0x0220, 0x022C, 0x00000001, 0, 32,
+	    0x0220, 4, 0, 0x0224, 0),
+	PLL(CLK_APMIXED_SGMPLL, "sgmpll", 0x0230, 0x023C, 0x00000001, 0, 32,
+	    0x0230, 4, 0, 0x0234, 0),
+	PLL(CLK_APMIXED_WEDMCUPLL, "wedmcupll", 0x0240, 0x024C, 0x00000001, 0, 32,
+	    0x0240, 4, 0, 0x0244, 0),
+	PLL(CLK_APMIXED_NET1PLL, "net1pll", 0x0250, 0x025C, 0x00000001, 0, 32,
+	    0x0250, 4, 0, 0x0254, 0),
+	PLL(CLK_APMIXED_MPLL, "mpll", 0x0260, 0x0270, 0x00000001, 0, 32,
+	    0x0260, 4, 0, 0x0264, 0),
+	PLL(CLK_APMIXED_APLL2, "apll2", 0x0278, 0x0288, 0x00000001, 0, 32,
+	    0x0278, 4, 0, 0x027C, 0),
+};
+
+static const struct of_device_id of_match_clk_mt7981_apmixed[] = {
+	{ .compatible = "mediatek,mt7981-apmixedsys", },
+	{}
+};
+
+static int clk_mt7981_apmixed_probe(struct platform_device *pdev)
+{
+	struct clk_onecell_data *clk_data;
+	struct device_node *node = pdev->dev.of_node;
+	int r;
+
+	clk_data = mtk_alloc_clk_data(ARRAY_SIZE(plls));
+	if (!clk_data)
+		return -ENOMEM;
+
+	mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data);
+
+	clk_prepare_enable(clk_data->clks[CLK_APMIXED_ARMPLL]);
+
+	r = of_clk_add_provider(node, of_clk_src_onecell_get, clk_data);
+	if (r) {
+		pr_err("%s(): could not register clock provider: %d\n",
+		       __func__, r);
+		goto free_apmixed_data;
+	}
+	return r;
+
+free_apmixed_data:
+	mtk_free_clk_data(clk_data);
+	return r;
+}
+
+static struct platform_driver clk_mt7981_apmixed_drv = {
+	.probe = clk_mt7981_apmixed_probe,
+	.driver = {
+		.name = "clk-mt7981-apmixed",
+		.of_match_table = of_match_clk_mt7981_apmixed,
+	},
+};
+builtin_platform_driver(clk_mt7981_apmixed_drv);
diff --git a/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7981-eth.c b/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7981-eth.c
new file mode 100644
index 00000000000000..4aba657aa6f637
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7981-eth.c
@@ -0,0 +1,139 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2021 MediaTek Inc.
+ * Author: Sam Shih <sam.shih@mediatek.com>
+ * Author: Wenzhen Yu <wenzhen.yu@mediatek.com>
+ * Author: Jianhui Zhao <zhaojh329@gmail.com>
+ * Author: Daniel Golle <daniel@makrotopia.org>
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/of_device.h>
+#include <linux/platform_device.h>
+
+#include "clk-mtk.h"
+#include "clk-gate.h"
+
+#include <dt-bindings/clock/mediatek,mt7981-clk.h>
+
+static const struct mtk_gate_regs sgmii0_cg_regs = {
+	.set_ofs = 0xE4,
+	.clr_ofs = 0xE4,
+	.sta_ofs = 0xE4,
+};
+
+#define GATE_SGMII0(_id, _name, _parent, _shift) {	\
+		.id = _id,				\
+		.name = _name,				\
+		.parent_name = _parent,			\
+		.regs = &sgmii0_cg_regs,			\
+		.shift = _shift,			\
+		.ops = &mtk_clk_gate_ops_no_setclr_inv,	\
+	}
+
+static const struct mtk_gate sgmii0_clks[] __initconst = {
+	GATE_SGMII0(CLK_SGM0_TX_EN, "sgm0_tx_en", "usb_tx250m", 2),
+	GATE_SGMII0(CLK_SGM0_RX_EN, "sgm0_rx_en", "usb_eq_rx250m", 3),
+	GATE_SGMII0(CLK_SGM0_CK0_EN, "sgm0_ck0_en", "usb_ln0", 4),
+	GATE_SGMII0(CLK_SGM0_CDR_CK0_EN, "sgm0_cdr_ck0_en", "usb_cdr", 5),
+};
+
+static const struct mtk_gate_regs sgmii1_cg_regs = {
+	.set_ofs = 0xE4,
+	.clr_ofs = 0xE4,
+	.sta_ofs = 0xE4,
+};
+
+#define GATE_SGMII1(_id, _name, _parent, _shift) {	\
+		.id = _id,				\
+		.name = _name,				\
+		.parent_name = _parent,			\
+		.regs = &sgmii1_cg_regs,			\
+		.shift = _shift,			\
+		.ops = &mtk_clk_gate_ops_no_setclr_inv,	\
+	}
+
+static const struct mtk_gate sgmii1_clks[] __initconst = {
+	GATE_SGMII1(CLK_SGM1_TX_EN, "sgm1_tx_en", "usb_tx250m", 2),
+	GATE_SGMII1(CLK_SGM1_RX_EN, "sgm1_rx_en", "usb_eq_rx250m", 3),
+	GATE_SGMII1(CLK_SGM1_CK1_EN, "sgm1_ck1_en", "usb_ln0", 4),
+	GATE_SGMII1(CLK_SGM1_CDR_CK1_EN, "sgm1_cdr_ck1_en", "usb_cdr", 5),
+};
+
+static const struct mtk_gate_regs eth_cg_regs = {
+	.set_ofs = 0x30,
+	.clr_ofs = 0x30,
+	.sta_ofs = 0x30,
+};
+
+#define GATE_ETH(_id, _name, _parent, _shift) {	\
+		.id = _id,				\
+		.name = _name,				\
+		.parent_name = _parent,			\
+		.regs = &eth_cg_regs,			\
+		.shift = _shift,			\
+		.ops = &mtk_clk_gate_ops_no_setclr_inv,	\
+	}
+
+static const struct mtk_gate eth_clks[] __initconst = {
+	GATE_ETH(CLK_ETH_FE_EN, "eth_fe_en", "netsys_2x", 6),
+	GATE_ETH(CLK_ETH_GP2_EN, "eth_gp2_en", "sgm_325m", 7),
+	GATE_ETH(CLK_ETH_GP1_EN, "eth_gp1_en", "sgm_325m", 8),
+	GATE_ETH(CLK_ETH_WOCPU0_EN, "eth_wocpu0_en", "netsys_wed_mcu", 15),
+};
+
+static void __init mtk_sgmiisys_0_init(struct device_node *node)
+{
+	struct clk_onecell_data *clk_data;
+	int r;
+
+	clk_data = mtk_alloc_clk_data(ARRAY_SIZE(sgmii0_clks));
+
+	mtk_clk_register_gates(node, sgmii0_clks, ARRAY_SIZE(sgmii0_clks),
+			       clk_data);
+
+	r = of_clk_add_provider(node, of_clk_src_onecell_get, clk_data);
+	if (r)
+		pr_err("%s(): could not register clock provider: %d\n",
+		       __func__, r);
+}
+CLK_OF_DECLARE(mtk_sgmiisys_0, "mediatek,mt7981-sgmiisys_0",
+	       mtk_sgmiisys_0_init);
+
+static void __init mtk_sgmiisys_1_init(struct device_node *node)
+{
+	struct clk_onecell_data *clk_data;
+	int r;
+
+	clk_data = mtk_alloc_clk_data(ARRAY_SIZE(sgmii1_clks));
+
+	mtk_clk_register_gates(node, sgmii1_clks, ARRAY_SIZE(sgmii1_clks),
+			       clk_data);
+
+	r = of_clk_add_provider(node, of_clk_src_onecell_get, clk_data);
+
+	if (r)
+		pr_err("%s(): could not register clock provider: %d\n",
+		       __func__, r);
+}
+CLK_OF_DECLARE(mtk_sgmiisys_1, "mediatek,mt7981-sgmiisys_1",
+	       mtk_sgmiisys_1_init);
+
+static void __init mtk_ethsys_init(struct device_node *node)
+{
+	struct clk_onecell_data *clk_data;
+	int r;
+
+	clk_data = mtk_alloc_clk_data(ARRAY_SIZE(eth_clks));
+
+	mtk_clk_register_gates(node, eth_clks, ARRAY_SIZE(eth_clks), clk_data);
+
+	r = of_clk_add_provider(node, of_clk_src_onecell_get, clk_data);
+
+	if (r)
+		pr_err("%s(): could not register clock provider: %d\n",
+		       __func__, r);
+}
+CLK_OF_DECLARE(mtk_ethsys, "mediatek,mt7981-ethsys", mtk_ethsys_init);
diff --git a/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7981-infracfg.c b/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7981-infracfg.c
new file mode 100644
index 00000000000000..8416829e3580c5
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7981-infracfg.c
@@ -0,0 +1,235 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2021 MediaTek Inc.
+ * Author: Sam Shih <sam.shih@mediatek.com>
+ * Author: Wenzhen Yu <wenzhen.yu@mediatek.com>
+ * Author: Jianhui Zhao <zhaojh329@gmail.com>
+ * Author: Daniel Golle <daniel@makrotopia.org>
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/of_device.h>
+#include <linux/platform_device.h>
+#include "clk-mtk.h"
+#include "clk-gate.h"
+#include "clk-mux.h"
+
+#include <dt-bindings/clock/mediatek,mt7981-clk.h>
+#include <linux/clk.h>
+
+static DEFINE_SPINLOCK(mt7981_clk_lock);
+
+static const struct mtk_fixed_factor infra_divs[] = {
+	FACTOR(CLK_INFRA_66M_MCK, "infra_66m_mck", "sysaxi_sel", 1, 2),
+};
+
+static const char *const infra_uart_parent[] __initconst = { "csw_f26m_sel",
+								"uart_sel" };
+
+static const char *const infra_spi0_parents[] __initconst = { "i2c_sel",
+							      "spi_sel" };
+
+static const char *const infra_spi1_parents[] __initconst = { "i2c_sel",
+							      "spim_mst_sel" };
+
+static const char *const infra_pwm1_parents[] __initconst = { "pwm_sel" };
+
+static const char *const infra_pwm_bsel_parents[] __initconst = {
+	"cb_rtc_32p7k", "csw_f26m_sel", "infra_66m_mck", "pwm_sel"
+};
+
+static const char *const infra_pcie_parents[] __initconst = {
+	"cb_rtc_32p7k", "csw_f26m_sel", "cb_cksq_40m", "pextp_tl_ck_sel"
+};
+
+static const struct mtk_mux infra_muxes[] = {
+	/* MODULE_CLK_SEL_0 */
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_UART0_SEL, "infra_uart0_sel",
+			     infra_uart_parent, 0x0018, 0x0010, 0x0014, 0, 1,
+			     -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_UART1_SEL, "infra_uart1_sel",
+			     infra_uart_parent, 0x0018, 0x0010, 0x0014, 1, 1,
+			     -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_UART2_SEL, "infra_uart2_sel",
+			     infra_uart_parent, 0x0018, 0x0010, 0x0014, 2, 1,
+			     -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_SPI0_SEL, "infra_spi0_sel",
+			     infra_spi0_parents, 0x0018, 0x0010, 0x0014, 4, 1,
+			     -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_SPI1_SEL, "infra_spi1_sel",
+			     infra_spi1_parents, 0x0018, 0x0010, 0x0014, 5, 1,
+			     -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_SPI2_SEL, "infra_spi2_sel",
+			     infra_spi0_parents, 0x0018, 0x0010, 0x0014, 6, 1,
+			     -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_PWM1_SEL, "infra_pwm1_sel",
+			     infra_pwm1_parents, 0x0018, 0x0010, 0x0014, 9, 1,
+			     -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_PWM2_SEL, "infra_pwm2_sel",
+			     infra_pwm1_parents, 0x0018, 0x0010, 0x0014, 11, 1,
+			     -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_PWM3_SEL, "infra_pwm3_sel",
+			     infra_pwm1_parents, 0x0018, 0x0010, 0x0014, 15, 1,
+			     -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_PWM_BSEL, "infra_pwm_bsel",
+			     infra_pwm_bsel_parents, 0x0018, 0x0010, 0x0014, 13,
+			     2, -1, -1, -1),
+	/* MODULE_CLK_SEL_1 */
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_PCIE_SEL, "infra_pcie_sel",
+			     infra_pcie_parents, 0x0028, 0x0020, 0x0024, 0, 2,
+			     -1, -1, -1),
+};
+
+static const struct mtk_gate_regs infra0_cg_regs = {
+	.set_ofs = 0x40,
+	.clr_ofs = 0x44,
+	.sta_ofs = 0x48,
+};
+
+static const struct mtk_gate_regs infra1_cg_regs = {
+	.set_ofs = 0x50,
+	.clr_ofs = 0x54,
+	.sta_ofs = 0x58,
+};
+
+static const struct mtk_gate_regs infra2_cg_regs = {
+	.set_ofs = 0x60,
+	.clr_ofs = 0x64,
+	.sta_ofs = 0x68,
+};
+
+#define GATE_INFRA0(_id, _name, _parent, _shift)                               \
+	{                                                                      \
+		.id = _id, .name = _name, .parent_name = _parent,              \
+		.regs = &infra0_cg_regs, .shift = _shift,                      \
+		.ops = &mtk_clk_gate_ops_setclr,                               \
+	}
+
+#define GATE_INFRA1(_id, _name, _parent, _shift)                               \
+	{                                                                      \
+		.id = _id, .name = _name, .parent_name = _parent,              \
+		.regs = &infra1_cg_regs, .shift = _shift,                      \
+		.ops = &mtk_clk_gate_ops_setclr,                               \
+	}
+
+#define GATE_INFRA2(_id, _name, _parent, _shift)                               \
+	{                                                                      \
+		.id = _id, .name = _name, .parent_name = _parent,              \
+		.regs = &infra2_cg_regs, .shift = _shift,                      \
+		.ops = &mtk_clk_gate_ops_setclr,                               \
+	}
+
+static const struct mtk_gate infra_clks[] = {
+	/* INFRA0 */
+	GATE_INFRA0(CLK_INFRA_GPT_STA, "infra_gpt_sta", "infra_66m_mck", 0),
+	GATE_INFRA0(CLK_INFRA_PWM_HCK, "infra_pwm_hck", "infra_66m_mck", 1),
+	GATE_INFRA0(CLK_INFRA_PWM_STA, "infra_pwm_sta", "infra_pwm_bsel", 2),
+	GATE_INFRA0(CLK_INFRA_PWM1_CK, "infra_pwm1", "infra_pwm1_sel", 3),
+	GATE_INFRA0(CLK_INFRA_PWM2_CK, "infra_pwm2", "infra_pwm2_sel", 4),
+	GATE_INFRA0(CLK_INFRA_CQ_DMA_CK, "infra_cq_dma", "sysaxi", 6),
+
+	GATE_INFRA0(CLK_INFRA_AUD_BUS_CK, "infra_aud_bus", "sysaxi", 8),
+	GATE_INFRA0(CLK_INFRA_AUD_26M_CK, "infra_aud_26m", "csw_f26m_sel", 9),
+	GATE_INFRA0(CLK_INFRA_AUD_L_CK, "infra_aud_l", "aud_l", 10),
+	GATE_INFRA0(CLK_INFRA_AUD_AUD_CK, "infra_aud_aud", "a1sys", 11),
+	GATE_INFRA0(CLK_INFRA_AUD_EG2_CK, "infra_aud_eg2", "a_tuner", 13),
+	GATE_INFRA0(CLK_INFRA_DRAMC_26M_CK, "infra_dramc_26m", "csw_f26m_sel",
+		    14),
+	GATE_INFRA0(CLK_INFRA_DBG_CK, "infra_dbg", "infra_66m_mck", 15),
+	GATE_INFRA0(CLK_INFRA_AP_DMA_CK, "infra_ap_dma", "infra_66m_mck", 16),
+	GATE_INFRA0(CLK_INFRA_SEJ_CK, "infra_sej", "infra_66m_mck", 24),
+	GATE_INFRA0(CLK_INFRA_SEJ_13M_CK, "infra_sej_13m", "csw_f26m_sel", 25),
+	GATE_INFRA0(CLK_INFRA_PWM3_CK, "infra_pwm3", "infra_pwm3_sel", 27),
+	/* INFRA1 */
+	GATE_INFRA1(CLK_INFRA_THERM_CK, "infra_therm", "csw_f26m_sel", 0),
+	GATE_INFRA1(CLK_INFRA_I2C0_CK, "infra_i2c0", "i2c_bck", 1),
+	GATE_INFRA1(CLK_INFRA_UART0_CK, "infra_uart0", "infra_uart0_sel", 2),
+	GATE_INFRA1(CLK_INFRA_UART1_CK, "infra_uart1", "infra_uart1_sel", 3),
+	GATE_INFRA1(CLK_INFRA_UART2_CK, "infra_uart2", "infra_uart2_sel", 4),
+	GATE_INFRA1(CLK_INFRA_SPI2_CK, "infra_spi2", "infra_spi2_sel", 6),
+	GATE_INFRA1(CLK_INFRA_SPI2_HCK_CK, "infra_spi2_hck", "infra_66m_mck", 7),
+	GATE_INFRA1(CLK_INFRA_NFI1_CK, "infra_nfi1", "nfi1x", 8),
+	GATE_INFRA1(CLK_INFRA_SPINFI1_CK, "infra_spinfi1", "spinfi_bck", 9),
+	GATE_INFRA1(CLK_INFRA_NFI_HCK_CK, "infra_nfi_hck", "infra_66m_mck", 10),
+	GATE_INFRA1(CLK_INFRA_SPI0_CK, "infra_spi0", "infra_spi0_sel", 11),
+	GATE_INFRA1(CLK_INFRA_SPI1_CK, "infra_spi1", "infra_spi1_sel", 12),
+	GATE_INFRA1(CLK_INFRA_SPI0_HCK_CK, "infra_spi0_hck", "infra_66m_mck",
+		    13),
+	GATE_INFRA1(CLK_INFRA_SPI1_HCK_CK, "infra_spi1_hck", "infra_66m_mck",
+		    14),
+	GATE_INFRA1(CLK_INFRA_FRTC_CK, "infra_frtc", "cb_rtc_32k", 15),
+	GATE_INFRA1(CLK_INFRA_MSDC_CK, "infra_msdc", "emmc_400m", 16),
+	GATE_INFRA1(CLK_INFRA_MSDC_HCK_CK, "infra_msdc_hck", "emmc_208m", 17),
+	GATE_INFRA1(CLK_INFRA_MSDC_133M_CK, "infra_msdc_133m", "sysaxi", 18),
+	GATE_INFRA1(CLK_INFRA_MSDC_66M_CK, "infra_msdc_66m", "sysaxi", 19),
+	GATE_INFRA1(CLK_INFRA_ADC_26M_CK, "infra_adc_26m", "infra_adc_frc", 20),
+	GATE_INFRA1(CLK_INFRA_ADC_FRC_CK, "infra_adc_frc", "csw_f26m", 21),
+	GATE_INFRA1(CLK_INFRA_FBIST2FPC_CK, "infra_fbist2fpc", "nfi1x", 23),
+	GATE_INFRA1(CLK_INFRA_I2C_MCK_CK, "infra_i2c_mck", "sysaxi", 25),
+	GATE_INFRA1(CLK_INFRA_I2C_PCK_CK, "infra_i2c_pck", "infra_66m_mck", 26),
+	/* INFRA2 */
+	GATE_INFRA2(CLK_INFRA_IUSB_133_CK, "infra_iusb_133", "sysaxi", 0),
+	GATE_INFRA2(CLK_INFRA_IUSB_66M_CK, "infra_iusb_66m", "sysaxi", 1),
+	GATE_INFRA2(CLK_INFRA_IUSB_SYS_CK, "infra_iusb_sys", "u2u3_sys", 2),
+	GATE_INFRA2(CLK_INFRA_IUSB_CK, "infra_iusb", "u2u3_ref", 3),
+	GATE_INFRA2(CLK_INFRA_IPCIE_CK, "infra_ipcie", "pextp_tl", 12),
+	GATE_INFRA2(CLK_INFRA_IPCIE_PIPE_CK, "infra_ipcie_pipe", "cb_cksq_40m",
+		    13),
+	GATE_INFRA2(CLK_INFRA_IPCIER_CK, "infra_ipcier", "csw_f26m", 14),
+	GATE_INFRA2(CLK_INFRA_IPCIEB_CK, "infra_ipcieb", "sysaxi", 15),
+};
+
+static int clk_mt7981_infracfg_probe(struct platform_device *pdev)
+{
+	struct clk_onecell_data *clk_data;
+	struct device_node *node = pdev->dev.of_node;
+	int r;
+	void __iomem *base;
+	int nr = ARRAY_SIZE(infra_divs) + ARRAY_SIZE(infra_muxes) +
+		 ARRAY_SIZE(infra_clks);
+
+	base = of_iomap(node, 0);
+	if (!base) {
+		pr_err("%s(): ioremap failed\n", __func__);
+		return -ENOMEM;
+	}
+
+	clk_data = mtk_alloc_clk_data(nr);
+
+	if (!clk_data)
+		return -ENOMEM;
+
+	mtk_clk_register_factors(infra_divs, ARRAY_SIZE(infra_divs), clk_data);
+	mtk_clk_register_muxes(infra_muxes, ARRAY_SIZE(infra_muxes), node,
+			       &mt7981_clk_lock, clk_data);
+	mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks),
+			       clk_data);
+
+	r = of_clk_add_provider(node, of_clk_src_onecell_get, clk_data);
+	if (r) {
+		pr_err("%s(): could not register clock provider: %d\n",
+		       __func__, r);
+		goto free_infracfg_data;
+	}
+	return r;
+
+free_infracfg_data:
+	mtk_free_clk_data(clk_data);
+	return r;
+}
+
+static const struct of_device_id of_match_clk_mt7981_infracfg[] = {
+	{ .compatible = "mediatek,mt7981-infracfg", },
+	{}
+};
+
+static struct platform_driver clk_mt7981_infracfg_drv = {
+	.probe = clk_mt7981_infracfg_probe,
+	.driver = {
+		.name = "clk-mt7981-infracfg",
+		.of_match_table = of_match_clk_mt7981_infracfg,
+	},
+};
+builtin_platform_driver(clk_mt7981_infracfg_drv);
diff --git a/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7981-topckgen.c b/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7981-topckgen.c
new file mode 100644
index 00000000000000..ce6dc18672665a
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7981-topckgen.c
@@ -0,0 +1,450 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2021 MediaTek Inc.
+ * Author: Sam Shih <sam.shih@mediatek.com>
+ * Author: Wenzhen Yu <wenzhen.yu@mediatek.com>
+ * Author: Jianhui Zhao <zhaojh329@gmail.com>
+ */
+
+
+#include <linux/clk-provider.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/of_device.h>
+#include <linux/platform_device.h>
+#include "clk-mtk.h"
+#include "clk-gate.h"
+#include "clk-mux.h"
+
+#include <dt-bindings/clock/mediatek,mt7981-clk.h>
+#include <linux/clk.h>
+
+static DEFINE_SPINLOCK(mt7981_clk_lock);
+
+static const struct mtk_fixed_factor top_divs[] = {
+	FACTOR(CLK_TOP_CB_CKSQ_40M, "cb_cksq_40m", "clkxtal", 1, 1),
+	FACTOR(CLK_TOP_CB_M_416M, "cb_m_416m", "mpll", 1, 1),
+	FACTOR(CLK_TOP_CB_M_D2, "cb_m_d2", "mpll", 1, 2),
+	FACTOR(CLK_TOP_CB_M_D3, "cb_m_d3", "mpll", 1, 3),
+	FACTOR(CLK_TOP_M_D3_D2, "m_d3_d2", "mpll", 1, 2),
+	FACTOR(CLK_TOP_CB_M_D4, "cb_m_d4", "mpll", 1, 4),
+	FACTOR(CLK_TOP_CB_M_D8, "cb_m_d8", "mpll", 1, 8),
+	FACTOR(CLK_TOP_M_D8_D2, "m_d8_d2", "mpll", 1, 16),
+	FACTOR(CLK_TOP_CB_MM_720M, "cb_mm_720m", "mmpll", 1, 1),
+	FACTOR(CLK_TOP_CB_MM_D2, "cb_mm_d2", "mmpll", 1, 2),
+	FACTOR(CLK_TOP_CB_MM_D3, "cb_mm_d3", "mmpll", 1, 3),
+	FACTOR(CLK_TOP_CB_MM_D3_D5, "cb_mm_d3_d5", "mmpll", 1, 15),
+	FACTOR(CLK_TOP_CB_MM_D4, "cb_mm_d4", "mmpll", 1, 4),
+	FACTOR(CLK_TOP_CB_MM_D6, "cb_mm_d6", "mmpll", 1, 6),
+	FACTOR(CLK_TOP_MM_D6_D2, "mm_d6_d2", "mmpll", 1, 12),
+	FACTOR(CLK_TOP_CB_MM_D8, "cb_mm_d8", "mmpll", 1, 8),
+	FACTOR(CLK_TOP_CB_APLL2_196M, "cb_apll2_196m", "apll2", 1, 1),
+	FACTOR(CLK_TOP_APLL2_D2, "apll2_d2", "apll2", 1, 2),
+	FACTOR(CLK_TOP_APLL2_D4, "apll2_d4", "apll2", 1, 4),
+	FACTOR(CLK_TOP_NET1_2500M, "net1_2500m", "net1pll", 1, 1),
+	FACTOR(CLK_TOP_CB_NET1_D4, "cb_net1_d4", "net1pll", 1, 4),
+	FACTOR(CLK_TOP_CB_NET1_D5, "cb_net1_d5", "net1pll", 1, 5),
+	FACTOR(CLK_TOP_NET1_D5_D2, "net1_d5_d2", "net1pll", 1, 10),
+	FACTOR(CLK_TOP_NET1_D5_D4, "net1_d5_d4", "net1pll", 1, 20),
+	FACTOR(CLK_TOP_CB_NET1_D8, "cb_net1_d8", "net1pll", 1, 8),
+	FACTOR(CLK_TOP_NET1_D8_D2, "net1_d8_d2", "net1pll", 1, 16),
+	FACTOR(CLK_TOP_NET1_D8_D4, "net1_d8_d4", "net1pll", 1, 32),
+	FACTOR(CLK_TOP_CB_NET2_800M, "cb_net2_800m", "net2pll", 1, 1),
+	FACTOR(CLK_TOP_CB_NET2_D2, "cb_net2_d2", "net2pll", 1, 2),
+	FACTOR(CLK_TOP_CB_NET2_D4, "cb_net2_d4", "net2pll", 1, 4),
+	FACTOR(CLK_TOP_NET2_D4_D2, "net2_d4_d2", "net2pll", 1, 8),
+	FACTOR(CLK_TOP_NET2_D4_D4, "net2_d4_d4", "net2pll", 1, 16),
+	FACTOR(CLK_TOP_CB_NET2_D6, "cb_net2_d6", "net2pll", 1, 6),
+	FACTOR(CLK_TOP_CB_WEDMCU_208M, "cb_wedmcu_208m", "wedmcupll", 1, 1),
+	FACTOR(CLK_TOP_CB_SGM_325M, "cb_sgm_325m", "sgmpll", 1, 1),
+	FACTOR(CLK_TOP_CKSQ_40M_D2, "cksq_40m_d2", "cb_cksq_40m", 1, 2),
+	FACTOR(CLK_TOP_CB_RTC_32K, "cb_rtc_32k", "cb_cksq_40m", 1, 1250),
+	FACTOR(CLK_TOP_CB_RTC_32P7K, "cb_rtc_32p7k", "cb_cksq_40m", 1, 1220),
+	FACTOR(CLK_TOP_USB_TX250M, "usb_tx250m", "cb_cksq_40m", 1, 1),
+	FACTOR(CLK_TOP_FAUD, "faud", "aud_sel", 1, 1),
+	FACTOR(CLK_TOP_NFI1X, "nfi1x", "nfi1x_sel", 1, 1),
+	FACTOR(CLK_TOP_USB_EQ_RX250M, "usb_eq_rx250m", "cb_cksq_40m", 1, 1),
+	FACTOR(CLK_TOP_USB_CDR_CK, "usb_cdr", "cb_cksq_40m", 1, 1),
+	FACTOR(CLK_TOP_USB_LN0_CK, "usb_ln0", "cb_cksq_40m", 1, 1),
+	FACTOR(CLK_TOP_SPINFI_BCK, "spinfi_bck", "spinfi_sel", 1, 1),
+	FACTOR(CLK_TOP_SPI, "spi", "spi_sel", 1, 1),
+	FACTOR(CLK_TOP_SPIM_MST, "spim_mst", "spim_mst_sel", 1, 1),
+	FACTOR(CLK_TOP_UART_BCK, "uart_bck", "uart_sel", 1, 1),
+	FACTOR(CLK_TOP_PWM_BCK, "pwm_bck", "pwm_sel", 1, 1),
+	FACTOR(CLK_TOP_I2C_BCK, "i2c_bck", "i2c_sel", 1, 1),
+	FACTOR(CLK_TOP_PEXTP_TL, "pextp_tl", "pextp_tl_ck_sel", 1, 1),
+	FACTOR(CLK_TOP_EMMC_208M, "emmc_208m", "emmc_208m_sel", 1, 1),
+	FACTOR(CLK_TOP_EMMC_400M, "emmc_400m", "emmc_400m_sel", 1, 1),
+	FACTOR(CLK_TOP_DRAMC_REF, "dramc_ref", "dramc_sel", 1, 1),
+	FACTOR(CLK_TOP_DRAMC_MD32, "dramc_md32", "dramc_md32_sel", 1, 1),
+	FACTOR(CLK_TOP_SYSAXI, "sysaxi", "sysaxi_sel", 1, 1),
+	FACTOR(CLK_TOP_SYSAPB, "sysapb", "sysapb_sel", 1, 1),
+	FACTOR(CLK_TOP_ARM_DB_MAIN, "arm_db_main", "arm_db_main_sel", 1, 1),
+	FACTOR(CLK_TOP_AP2CNN_HOST, "ap2cnn_host", "ap2cnn_host_sel", 1, 1),
+	FACTOR(CLK_TOP_NETSYS, "netsys", "netsys_sel", 1, 1),
+	FACTOR(CLK_TOP_NETSYS_500M, "netsys_500m", "netsys_500m_sel", 1, 1),
+	FACTOR(CLK_TOP_NETSYS_WED_MCU, "netsys_wed_mcu", "netsys_mcu_sel", 1, 1),
+	FACTOR(CLK_TOP_NETSYS_2X, "netsys_2x", "netsys_2x_sel", 1, 1),
+	FACTOR(CLK_TOP_SGM_325M, "sgm_325m", "sgm_325m_sel", 1, 1),
+	FACTOR(CLK_TOP_SGM_REG, "sgm_reg", "sgm_reg_sel", 1, 1),
+	FACTOR(CLK_TOP_F26M, "csw_f26m", "csw_f26m_sel", 1, 1),
+	FACTOR(CLK_TOP_EIP97B, "eip97b", "eip97b_sel", 1, 1),
+	FACTOR(CLK_TOP_USB3_PHY, "usb3_phy", "usb3_phy_sel", 1, 1),
+	FACTOR(CLK_TOP_AUD, "aud", "faud", 1, 1),
+	FACTOR(CLK_TOP_A1SYS, "a1sys", "a1sys_sel", 1, 1),
+	FACTOR(CLK_TOP_AUD_L, "aud_l", "aud_l_sel", 1, 1),
+	FACTOR(CLK_TOP_A_TUNER, "a_tuner", "a_tuner_sel", 1, 1),
+	FACTOR(CLK_TOP_U2U3_REF, "u2u3_ref", "u2u3_sel", 1, 1),
+	FACTOR(CLK_TOP_U2U3_SYS, "u2u3_sys", "u2u3_sys_sel", 1, 1),
+	FACTOR(CLK_TOP_U2U3_XHCI, "u2u3_xhci", "u2u3_xhci_sel", 1, 1),
+	FACTOR(CLK_TOP_USB_FRMCNT, "usb_frmcnt", "usb_frmcnt_sel", 1, 1),
+};
+
+static const char * const nfi1x_parents[] __initconst = {
+	"cb_cksq_40m",
+	"cb_mm_d4",
+	"net1_d8_d2",
+	"cb_net2_d6",
+	"cb_m_d4",
+	"cb_mm_d8",
+	"net1_d8_d4",
+	"cb_m_d8"
+};
+
+static const char * const spinfi_parents[] __initconst = {
+	"cksq_40m_d2",
+	"cb_cksq_40m",
+	"net1_d5_d4",
+	"cb_m_d4",
+	"cb_mm_d8",
+	"net1_d8_d4",
+	"mm_d6_d2",
+	"cb_m_d8"
+};
+
+static const char * const spi_parents[] __initconst = {
+	"cb_cksq_40m",
+	"cb_m_d2",
+	"cb_mm_d4",
+	"net1_d8_d2",
+	"cb_net2_d6",
+	"net1_d5_d4",
+	"cb_m_d4",
+	"net1_d8_d4"
+};
+
+static const char * const uart_parents[] __initconst = {
+	"cb_cksq_40m",
+	"cb_m_d8",
+	"m_d8_d2"
+};
+
+static const char * const pwm_parents[] __initconst = {
+	"cb_cksq_40m",
+	"net1_d8_d2",
+	"net1_d5_d4",
+	"cb_m_d4",
+	"m_d8_d2",
+	"cb_rtc_32k"
+};
+
+static const char * const i2c_parents[] __initconst = {
+	"cb_cksq_40m",
+	"net1_d5_d4",
+	"cb_m_d4",
+	"net1_d8_d4"
+};
+
+static const char * const pextp_tl_ck_parents[] __initconst = {
+	"cb_cksq_40m",
+	"net1_d5_d4",
+	"cb_m_d4",
+	"cb_rtc_32k"
+};
+
+static const char * const emmc_208m_parents[] __initconst = {
+	"cb_cksq_40m",
+	"cb_m_d2",
+	"cb_net2_d4",
+	"cb_apll2_196m",
+	"cb_mm_d4",
+	"net1_d8_d2",
+	"cb_mm_d6"
+};
+
+static const char * const emmc_400m_parents[] __initconst = {
+	"cb_cksq_40m",
+	"cb_net2_d2",
+	"cb_mm_d2",
+	"cb_net2_d2"
+};
+
+static const char * const csw_f26m_parents[] __initconst = {
+	"cksq_40m_d2",
+	"m_d8_d2"
+};
+
+static const char * const dramc_md32_parents[] __initconst = {
+	"cb_cksq_40m",
+	"cb_m_d2",
+	"cb_wedmcu_208m"
+};
+
+static const char * const sysaxi_parents[] __initconst = {
+	"cb_cksq_40m",
+	"net1_d8_d2"
+};
+
+static const char * const sysapb_parents[] __initconst = {
+	"cb_cksq_40m",
+	"m_d3_d2"
+};
+
+static const char * const arm_db_main_parents[] __initconst = {
+	"cb_cksq_40m",
+	"cb_net2_d6"
+};
+
+static const char * const ap2cnn_host_parents[] __initconst = {
+	"cb_cksq_40m",
+	"net1_d8_d4"
+};
+
+static const char * const netsys_parents[] __initconst = {
+	"cb_cksq_40m",
+	"cb_mm_d2"
+};
+
+static const char * const netsys_500m_parents[] __initconst = {
+	"cb_cksq_40m",
+	"cb_net1_d5"
+};
+
+static const char * const netsys_mcu_parents[] __initconst = {
+	"cb_cksq_40m",
+	"cb_mm_720m",
+	"cb_net1_d4",
+	"cb_net1_d5",
+	"cb_m_416m"
+};
+
+static const char * const netsys_2x_parents[] __initconst = {
+	"cb_cksq_40m",
+	"cb_net2_800m",
+	"cb_mm_720m"
+};
+
+static const char * const sgm_325m_parents[] __initconst = {
+	"cb_cksq_40m",
+	"cb_sgm_325m"
+};
+
+static const char * const sgm_reg_parents[] __initconst = {
+	"cb_cksq_40m",
+	"cb_net2_d4"
+};
+
+static const char * const eip97b_parents[] __initconst = {
+	"cb_cksq_40m",
+	"cb_net1_d5",
+	"cb_m_416m",
+	"cb_mm_d2",
+	"net1_d5_d2"
+};
+
+static const char * const aud_parents[] __initconst = {
+	"cb_cksq_40m",
+	"cb_apll2_196m"
+};
+
+static const char * const a1sys_parents[] __initconst = {
+	"cb_cksq_40m",
+	"apll2_d4"
+};
+
+static const char * const aud_l_parents[] __initconst = {
+	"cb_cksq_40m",
+	"cb_apll2_196m",
+	"m_d8_d2"
+};
+
+static const char * const a_tuner_parents[] __initconst = {
+	"cb_cksq_40m",
+	"apll2_d4",
+	"m_d8_d2"
+};
+
+static const char * const u2u3_parents[] __initconst = {
+	"cb_cksq_40m",
+	"m_d8_d2"
+};
+
+static const char * const u2u3_sys_parents[] __initconst = {
+	"cb_cksq_40m",
+	"net1_d5_d4"
+};
+
+static const char * const usb_frmcnt_parents[] __initconst = {
+	"cb_cksq_40m",
+	"cb_mm_d3_d5"
+};
+
+static const struct mtk_mux top_muxes[] = {
+	/* CLK_CFG_0 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_NFI1X_SEL, "nfi1x_sel", nfi1x_parents,
+			     0x000, 0x004, 0x008, 0, 3, 7, 0x1C0, 0),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_SPINFI_SEL, "spinfi_sel", spinfi_parents,
+			     0x000, 0x004, 0x008, 8, 3, 15, 0x1C0, 1),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_SPI_SEL, "spi_sel", spi_parents,
+			     0x000, 0x004, 0x008, 16, 3, 23, 0x1C0, 2),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_SPIM_MST_SEL, "spim_mst_sel", spi_parents,
+			     0x000, 0x004, 0x008, 24, 3, 31, 0x1C0, 3),
+	/* CLK_CFG_1 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_UART_SEL, "uart_sel", uart_parents,
+			     0x010, 0x014, 0x018, 0, 2, 7, 0x1C0, 4),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_PWM_SEL, "pwm_sel", pwm_parents,
+			     0x010, 0x014, 0x018, 8, 3, 15, 0x1C0, 5),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_I2C_SEL, "i2c_sel", i2c_parents,
+			     0x010, 0x014, 0x018, 16, 2, 23, 0x1C0, 6),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_PEXTP_TL_SEL, "pextp_tl_ck_sel",
+			     pextp_tl_ck_parents, 0x010, 0x014, 0x018, 24, 2, 31,
+			     0x1C0, 7),
+	/* CLK_CFG_2 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_EMMC_208M_SEL, "emmc_208m_sel",
+			     emmc_208m_parents, 0x020, 0x024, 0x028, 0, 3, 7,
+			     0x1C0, 8),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_EMMC_400M_SEL, "emmc_400m_sel",
+			     emmc_400m_parents, 0x020, 0x024, 0x028, 8, 2, 15,
+			     0x1C0, 9),
+	MUX_GATE_CLR_SET_UPD_FLAGS(CLK_TOP_F26M_SEL, "csw_f26m_sel",
+				   csw_f26m_parents, 0x020, 0x024, 0x028, 16, 1, 23,
+				   0x1C0, 10,
+				   CLK_IS_CRITICAL | CLK_SET_RATE_PARENT),
+	MUX_GATE_CLR_SET_UPD_FLAGS(CLK_TOP_DRAMC_SEL, "dramc_sel",
+				   csw_f26m_parents, 0x020, 0x024, 0x028, 24, 1,
+				   31, 0x1C0, 11,
+				   CLK_IS_CRITICAL | CLK_SET_RATE_PARENT),
+	/* CLK_CFG_3 */
+	MUX_GATE_CLR_SET_UPD_FLAGS(CLK_TOP_DRAMC_MD32_SEL, "dramc_md32_sel",
+				   dramc_md32_parents, 0x030, 0x034, 0x038, 0, 2,
+				   7, 0x1C0, 12,
+				   CLK_IS_CRITICAL | CLK_SET_RATE_PARENT),
+	MUX_GATE_CLR_SET_UPD_FLAGS(CLK_TOP_SYSAXI_SEL, "sysaxi_sel",
+				   sysaxi_parents, 0x030, 0x034, 0x038, 8, 1, 15,
+				   0x1C0, 13,
+				   CLK_IS_CRITICAL | CLK_SET_RATE_PARENT),
+	MUX_GATE_CLR_SET_UPD_FLAGS(CLK_TOP_SYSAPB_SEL, "sysapb_sel",
+				   sysapb_parents, 0x030, 0x034, 0x038, 16, 1,
+				   23, 0x1C0, 14,
+				   CLK_IS_CRITICAL | CLK_SET_RATE_PARENT),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_ARM_DB_MAIN_SEL, "arm_db_main_sel",
+			     arm_db_main_parents, 0x030, 0x034, 0x038, 24, 1, 31,
+			     0x1C0, 15),
+	/* CLK_CFG_4 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_AP2CNN_HOST_SEL, "ap2cnn_host_sel",
+			     ap2cnn_host_parents, 0x040, 0x044, 0x048, 0, 1, 7,
+			     0x1C0, 16),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_NETSYS_SEL, "netsys_sel", netsys_parents,
+			     0x040, 0x044, 0x048, 8, 1, 15, 0x1C0, 17),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_NETSYS_500M_SEL, "netsys_500m_sel",
+			     netsys_500m_parents, 0x040, 0x044, 0x048, 16, 1, 23,
+			     0x1C0, 18),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_NETSYS_MCU_SEL, "netsys_mcu_sel",
+			     netsys_mcu_parents, 0x040, 0x044, 0x048, 24, 3, 31,
+			     0x1C0, 19),
+	/* CLK_CFG_5 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_NETSYS_2X_SEL, "netsys_2x_sel",
+			     netsys_2x_parents, 0x050, 0x054, 0x058, 0, 2, 7,
+			     0x1C0, 20),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_SGM_325M_SEL, "sgm_325m_sel",
+			     sgm_325m_parents, 0x050, 0x054, 0x058, 8, 1, 15,
+			     0x1C0, 21),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_SGM_REG_SEL, "sgm_reg_sel", sgm_reg_parents,
+			     0x050, 0x054, 0x058, 16, 1, 23, 0x1C0, 22),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_EIP97B_SEL, "eip97b_sel", eip97b_parents,
+			     0x050, 0x054, 0x058, 24, 3, 31, 0x1C0, 23),
+	/* CLK_CFG_6 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_USB3_PHY_SEL, "usb3_phy_sel",
+			     csw_f26m_parents, 0x060, 0x064, 0x068, 0, 1,
+			     7, 0x1C0, 24),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_AUD_SEL, "aud_sel", aud_parents, 0x060,
+			     0x064, 0x068, 8, 1, 15, 0x1C0, 25),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_A1SYS_SEL, "a1sys_sel", a1sys_parents,
+			     0x060, 0x064, 0x068, 16, 1, 23, 0x1C0, 26),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_AUD_L_SEL, "aud_l_sel", aud_l_parents,
+			     0x060, 0x064, 0x068, 24, 2, 31, 0x1C0, 27),
+	/* CLK_CFG_7 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_A_TUNER_SEL, "a_tuner_sel",
+			     a_tuner_parents, 0x070, 0x074, 0x078, 0, 2, 7,
+			     0x1C0, 28),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_U2U3_SEL, "u2u3_sel", u2u3_parents, 0x070,
+			     0x074, 0x078, 8, 1, 15, 0x1C0, 29),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_U2U3_SYS_SEL, "u2u3_sys_sel",
+			     u2u3_sys_parents, 0x070, 0x074, 0x078, 16, 1, 23,
+			     0x1C0, 30),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_U2U3_XHCI_SEL, "u2u3_xhci_sel",
+			     u2u3_sys_parents, 0x070, 0x074, 0x078, 24, 1, 31,
+			     0x1C4, 0),
+	/* CLK_CFG_8 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_USB_FRMCNT_SEL, "usb_frmcnt_sel",
+			     usb_frmcnt_parents, 0x080, 0x084, 0x088, 0, 1, 7,
+			     0x1C4, 1),
+};
+
+static struct mtk_composite top_aud_divs[] = {
+	DIV_GATE(CLK_TOP_AUD_I2S_M, "aud_i2s_m", "aud",
+		0x0420, 0, 0x0420, 8, 8),
+};
+
+static int clk_mt7981_topckgen_probe(struct platform_device *pdev)
+{
+	struct clk_onecell_data *clk_data;
+	struct device_node *node = pdev->dev.of_node;
+	int r;
+	void __iomem *base;
+	int nr = ARRAY_SIZE(top_divs) + ARRAY_SIZE(top_muxes) +
+		 ARRAY_SIZE(top_aud_divs);
+
+	base = of_iomap(node, 0);
+	if (!base) {
+		pr_err("%s(): ioremap failed\n", __func__);
+		return -ENOMEM;
+	}
+
+	clk_data = mtk_alloc_clk_data(nr);
+	if (!clk_data)
+		return -ENOMEM;
+
+	mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), clk_data);
+	mtk_clk_register_muxes(top_muxes, ARRAY_SIZE(top_muxes), node,
+			       &mt7981_clk_lock, clk_data);
+	mtk_clk_register_composites(top_aud_divs, ARRAY_SIZE(top_aud_divs), base,
+                        &mt7981_clk_lock, clk_data);
+
+	r = of_clk_add_provider(node, of_clk_src_onecell_get, clk_data);
+
+	if (r) {
+		pr_err("%s(): could not register clock provider: %d\n",
+		       __func__, r);
+		goto free_topckgen_data;
+	}
+	return r;
+
+free_topckgen_data:
+	mtk_free_clk_data(clk_data);
+	return r;
+}
+
+static const struct of_device_id of_match_clk_mt7981_topckgen[] = {
+	{ .compatible = "mediatek,mt7981-topckgen", },
+	{}
+};
+
+static struct platform_driver clk_mt7981_topckgen_drv = {
+	.probe = clk_mt7981_topckgen_probe,
+	.driver = {
+		.name = "clk-mt7981-topckgen",
+		.of_match_table = of_match_clk_mt7981_topckgen,
+	},
+};
+builtin_platform_driver(clk_mt7981_topckgen_drv);
diff --git a/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7986-eth.c b/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7986-eth.c
index 495d023ccad7c6..ed2e7b20098770 100644
--- a/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7986-eth.c
+++ b/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7986-eth.c
@@ -129,4 +129,4 @@ static void __init mtk_ethsys_init(struct device_node *node)
 		pr_err("%s(): could not register clock provider: %d\n",
 		       __func__, r);
 }
-CLK_OF_DECLARE(mtk_ethsys, "mediatek,mt7986-ethsys_ck", mtk_ethsys_init);
+CLK_OF_DECLARE(mtk_ethsys, "mediatek,mt7986-ethsys", mtk_ethsys_init);
diff --git a/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7986-infracfg.c b/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7986-infracfg.c
index 3be168c34fc0a8..82279dfcf57137 100644
--- a/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7986-infracfg.c
+++ b/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7986-infracfg.c
@@ -153,7 +153,7 @@ static const struct mtk_gate infra_clks[] = {
 		    18),
 	GATE_INFRA1(CLK_INFRA_MSDC_66M_CK, "infra_msdc_66m", "infra_sysaxi_d2",
 		    19),
-	GATE_INFRA1(CLK_INFRA_ADC_26M_CK, "infra_adc_26m", "csw_f26m_sel", 20),
+	GATE_INFRA1(CLK_INFRA_ADC_26M_CK, "infra_adc_26m", "infra_adc_frc", 20),
 	GATE_INFRA1(CLK_INFRA_ADC_FRC_CK, "infra_adc_frc", "csw_f26m_sel", 21),
 	GATE_INFRA1(CLK_INFRA_FBIST2FPC_CK, "infra_fbist2fpc", "nfi1x_sel", 23),
 	/* INFRA2 */
diff --git a/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7988-apmixed.c b/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7988-apmixed.c
new file mode 100644
index 00000000000000..587b70767eb21e
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7988-apmixed.c
@@ -0,0 +1,113 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2023 MediaTek Inc.
+ * Author: Sam Shih <sam.shih@mediatek.com>
+ * Author: Xiufeng Li <Xiufeng.Li@mediatek.com>
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/of_device.h>
+#include <linux/platform_device.h>
+#include "clk-mtk.h"
+#include "clk-gate.h"
+#include "clk-mux.h"
+#include <dt-bindings/clock/mediatek,mt7988-clk.h>
+
+#define MT7988_PLL_FMAX (2500UL * MHZ)
+#define MT7988_PCW_CHG_SHIFT 2
+
+#define PLL_xtal(_id, _name, _reg, _pwr_reg, _en_mask, _flags, _rst_bar_mask, \
+		 _pcwbits, _pd_reg, _pd_shift, _tuner_reg, _tuner_en_reg,     \
+		 _tuner_en_bit, _pcw_reg, _pcw_shift, _pcw_chg_reg,           \
+		 _div_table)                                                  \
+	{                                                                     \
+		.id = _id, .name = _name, .reg = _reg, .pwr_reg = _pwr_reg,   \
+		.en_mask = _en_mask, .flags = _flags,                         \
+		.rst_bar_mask = BIT(_rst_bar_mask), .fmax = MT7988_PLL_FMAX,  \
+		.pcwbits = _pcwbits, .pd_reg = _pd_reg,                       \
+		.pd_shift = _pd_shift, .tuner_reg = _tuner_reg,               \
+		.tuner_en_reg = _tuner_en_reg, .tuner_en_bit = _tuner_en_bit, \
+		.pcw_reg = _pcw_reg, .pcw_shift = _pcw_shift,                 \
+		.pcw_chg_reg = _pcw_chg_reg,                                  \
+		.pcw_chg_shift = MT7988_PCW_CHG_SHIFT,                        \
+		.div_table = _div_table, .parent_name = "clkxtal",            \
+	}
+
+#define PLL(_id, _name, _reg, _pwr_reg, _en_mask, _flags, _rst_bar_mask,      \
+	    _pcwbits, _pd_reg, _pd_shift, _tuner_reg, _tuner_en_reg,          \
+	    _tuner_en_bit, _pcw_reg, _pcw_shift, _pcw_chg_reg)                \
+	PLL_xtal(_id, _name, _reg, _pwr_reg, _en_mask, _flags, _rst_bar_mask, \
+		 _pcwbits, _pd_reg, _pd_shift, _tuner_reg, _tuner_en_reg,     \
+		 _tuner_en_bit, _pcw_reg, _pcw_shift, _pcw_chg_reg, NULL)
+
+static const struct mtk_pll_data plls[] = {
+	PLL(CLK_APMIXED_NETSYSPLL, "netsyspll", 0x0104, 0x0110, 0x00000001, 0,
+	    0, 32, 0x0104, 4, 0, 0, 0, 0x0108, 0, 0x0104),
+	PLL(CLK_APMIXED_MPLL, "mpll", 0x0114, 0x0120, 0xff000001, HAVE_RST_BAR,
+	    23, 32, 0x0114, 4, 0, 0, 0, 0x0118, 0, 0x0114),
+	PLL(CLK_APMIXED_MMPLL, "mmpll", 0x0124, 0x0130, 0xff000001,
+	    HAVE_RST_BAR, 23, 32, 0x0124, 4, 0, 0, 0, 0x0128, 0, 0x0124),
+	PLL(CLK_APMIXED_APLL2, "apll2", 0x0134, 0x0140, 0x00000001, 0, 0, 32,
+	    0x0134, 4, 0x0704, 0x0700, 1, 0x0138, 0, 0x0134),
+	PLL(CLK_APMIXED_NET1PLL, "net1pll", 0x0144, 0x0150, 0xff000001,
+	    HAVE_RST_BAR, 23, 32, 0x0144, 4, 0, 0, 0, 0x0148, 0, 0x0144),
+	PLL(CLK_APMIXED_NET2PLL, "net2pll", 0x0154, 0x0160, 0xff000001,
+	    (HAVE_RST_BAR | PLL_AO), 23, 32, 0x0154, 4, 0, 0, 0, 0x0158, 0,
+	    0x0154),
+	PLL(CLK_APMIXED_WEDMCUPLL, "wedmcupll", 0x0164, 0x0170, 0x00000001, 0,
+	    0, 32, 0x0164, 4, 0, 0, 0, 0x0168, 0, 0x0164),
+	PLL(CLK_APMIXED_SGMPLL, "sgmpll", 0x0174, 0x0180, 0x00000001, 0, 0, 32,
+	    0x0174, 4, 0, 0, 0, 0x0178, 0, 0x0174),
+	PLL(CLK_APMIXED_ARM_B, "arm_b", 0x0204, 0x0210, 0xff000001,
+	    (HAVE_RST_BAR | PLL_AO), 23, 32, 0x0204, 4, 0, 0, 0, 0x0208, 0,
+	    0x0204),
+	PLL(CLK_APMIXED_CCIPLL2_B, "ccipll2_b", 0x0214, 0x0220, 0xff000001,
+	    HAVE_RST_BAR, 23, 32, 0x0214, 4, 0, 0, 0, 0x0218, 0, 0x0214),
+	PLL(CLK_APMIXED_USXGMIIPLL, "usxgmiipll", 0x0304, 0x0310, 0xff000001,
+	    HAVE_RST_BAR, 23, 32, 0x0304, 4, 0, 0, 0, 0x0308, 0, 0x0304),
+	PLL(CLK_APMIXED_MSDCPLL, "msdcpll", 0x0314, 0x0320, 0x00000001, 0, 0,
+	    32, 0x0314, 4, 0, 0, 0, 0x0318, 0, 0x0314),
+};
+
+static const struct of_device_id of_match_clk_mt7988_apmixed[] = {
+	{
+		.compatible = "mediatek,mt7988-apmixedsys",
+	},
+	{}
+};
+
+static int clk_mt7988_apmixed_probe(struct platform_device *pdev)
+{
+	struct clk_onecell_data *clk_data;
+	struct device_node *node = pdev->dev.of_node;
+	int r;
+
+	clk_data = mtk_alloc_clk_data(ARRAY_SIZE(plls));
+	if (!clk_data)
+		return -ENOMEM;
+
+	mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data);
+
+	r = of_clk_add_provider(node, of_clk_src_onecell_get, clk_data);
+	if (r) {
+		pr_err("%s(): could not register clock provider: %d\n",
+		       __func__, r);
+		goto free_apmixed_data;
+	}
+	return r;
+
+free_apmixed_data:
+	mtk_free_clk_data(clk_data);
+	return r;
+}
+
+static struct platform_driver clk_mt7988_apmixed_drv = {
+	.probe = clk_mt7988_apmixed_probe,
+	.driver = {
+		.name = "clk-mt7988-apmixed",
+		.of_match_table = of_match_clk_mt7988_apmixed,
+	},
+};
+builtin_platform_driver(clk_mt7988_apmixed_drv);
diff --git a/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7988-eth.c b/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7988-eth.c
new file mode 100644
index 00000000000000..341d0f73fd3080
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7988-eth.c
@@ -0,0 +1,299 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2023 MediaTek Inc.
+ * Author: Sam Shih <sam.shih@mediatek.com>
+ * Author: Xiufeng Li <Xiufeng.Li@mediatek.com>
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/of_device.h>
+#include <linux/platform_device.h>
+#include "clk-mtk.h"
+#include "clk-gate.h"
+#include <dt-bindings/clock/mediatek,mt7988-clk.h>
+
+static const struct mtk_gate_regs ethdma_cg_regs = {
+	.set_ofs = 0x30,
+	.clr_ofs = 0x30,
+	.sta_ofs = 0x30,
+};
+
+#define GATE_ETHDMA(_id, _name, _parent, _shift)                              \
+	{                                                                     \
+		.id = _id, .name = _name, .parent_name = _parent,             \
+		.regs = &ethdma_cg_regs, .shift = _shift,                     \
+		.ops = &mtk_clk_gate_ops_no_setclr_inv,                       \
+	}
+
+static const struct mtk_gate ethdma_clks[] = {
+	GATE_ETHDMA(CLK_ETHDMA_XGP1_EN, "ethdma_xgp1_en", "top_xtal", 0),
+	GATE_ETHDMA(CLK_ETHDMA_XGP2_EN, "ethdma_xgp2_en", "top_xtal", 1),
+	GATE_ETHDMA(CLK_ETHDMA_XGP3_EN, "ethdma_xgp3_en", "top_xtal", 2),
+	GATE_ETHDMA(CLK_ETHDMA_FE_EN, "ethdma_fe_en", "netsys_2x_sel", 6),
+	GATE_ETHDMA(CLK_ETHDMA_GP2_EN, "ethdma_gp2_en", "top_xtal", 7),
+	GATE_ETHDMA(CLK_ETHDMA_GP1_EN, "ethdma_gp1_en", "top_xtal", 8),
+	GATE_ETHDMA(CLK_ETHDMA_GP3_EN, "ethdma_gp3_en", "top_xtal", 10),
+	GATE_ETHDMA(CLK_ETHDMA_ESW_EN, "ethdma_esw_en", "netsys_gsw_sel", 16),
+	GATE_ETHDMA(CLK_ETHDMA_CRYPT0_EN, "ethdma_crypt0_en", "eip197_sel",
+		    29),
+};
+
+static int clk_mt7988_ethsys_probe(struct platform_device *pdev)
+{
+	struct clk_onecell_data *clk_data;
+	struct device_node *node = pdev->dev.of_node;
+	int r;
+	void __iomem *base;
+
+	base = of_iomap(node, 0);
+	if (!base) {
+		pr_err("%s(): ioremap failed\n", __func__);
+		return -ENOMEM;
+	}
+
+	clk_data = mtk_alloc_clk_data(ARRAY_SIZE(ethdma_clks));
+
+	if (!clk_data)
+		return -ENOMEM;
+
+	mtk_clk_register_gates(node, ethdma_clks, ARRAY_SIZE(ethdma_clks),
+			       clk_data);
+
+	r = of_clk_add_provider(node, of_clk_src_onecell_get, clk_data);
+	if (r) {
+		pr_err("%s(): could not register clock provider: %d\n",
+		       __func__, r);
+		goto free_data;
+	}
+	return r;
+
+free_data:
+	mtk_free_clk_data(clk_data);
+	return r;
+}
+
+static const struct mtk_gate_regs sgmii0_cg_regs = {
+	.set_ofs = 0xe4,
+	.clr_ofs = 0xe4,
+	.sta_ofs = 0xe4,
+};
+
+#define GATE_SGMII0(_id, _name, _parent, _shift)                              \
+	{                                                                     \
+		.id = _id, .name = _name, .parent_name = _parent,             \
+		.regs = &sgmii0_cg_regs, .shift = _shift,                     \
+		.ops = &mtk_clk_gate_ops_no_setclr_inv,                       \
+	}
+
+static const struct mtk_gate sgmii0_clks[] = {
+	GATE_SGMII0(CLK_SGM0_TX_EN, "sgm0_tx_en", "top_xtal", 2),
+	GATE_SGMII0(CLK_SGM0_RX_EN, "sgm0_rx_en", "top_xtal", 3),
+};
+
+static int clk_mt7988_sgmii0_probe(struct platform_device *pdev)
+{
+	struct clk_onecell_data *clk_data;
+	struct device_node *node = pdev->dev.of_node;
+	int r;
+	void __iomem *base;
+
+	base = of_iomap(node, 0);
+	if (!base) {
+		pr_err("%s(): ioremap failed\n", __func__);
+		return -ENOMEM;
+	}
+
+	clk_data = mtk_alloc_clk_data(ARRAY_SIZE(sgmii0_clks));
+
+	if (!clk_data)
+		return -ENOMEM;
+
+	mtk_clk_register_gates(node, sgmii0_clks, ARRAY_SIZE(sgmii0_clks),
+			       clk_data);
+
+	r = of_clk_add_provider(node, of_clk_src_onecell_get, clk_data);
+	if (r) {
+		pr_err("%s(): could not register clock provider: %d\n",
+		       __func__, r);
+		goto free_data;
+	}
+	return r;
+
+free_data:
+	mtk_free_clk_data(clk_data);
+	return r;
+}
+
+static const struct mtk_gate_regs sgmii1_cg_regs = {
+	.set_ofs = 0xe4,
+	.clr_ofs = 0xe4,
+	.sta_ofs = 0xe4,
+};
+
+#define GATE_SGMII1(_id, _name, _parent, _shift)                              \
+	{                                                                     \
+		.id = _id, .name = _name, .parent_name = _parent,             \
+		.regs = &sgmii1_cg_regs, .shift = _shift,                     \
+		.ops = &mtk_clk_gate_ops_no_setclr_inv,                       \
+	}
+
+static const struct mtk_gate sgmii1_clks[] = {
+	GATE_SGMII1(CLK_SGM1_TX_EN, "sgm1_tx_en", "top_xtal", 2),
+	GATE_SGMII1(CLK_SGM1_RX_EN, "sgm1_rx_en", "top_xtal", 3),
+};
+
+static int clk_mt7988_sgmii1_probe(struct platform_device *pdev)
+{
+	struct clk_onecell_data *clk_data;
+	struct device_node *node = pdev->dev.of_node;
+	int r;
+	void __iomem *base;
+
+	base = of_iomap(node, 0);
+	if (!base) {
+		pr_err("%s(): ioremap failed\n", __func__);
+		return -ENOMEM;
+	}
+
+	clk_data = mtk_alloc_clk_data(ARRAY_SIZE(sgmii1_clks));
+
+	if (!clk_data)
+		return -ENOMEM;
+
+	mtk_clk_register_gates(node, sgmii1_clks, ARRAY_SIZE(sgmii1_clks),
+			       clk_data);
+
+	r = of_clk_add_provider(node, of_clk_src_onecell_get, clk_data);
+	if (r) {
+		pr_err("%s(): could not register clock provider: %d\n",
+		       __func__, r);
+		goto free_data;
+	}
+	return r;
+
+free_data:
+	mtk_free_clk_data(clk_data);
+	return r;
+}
+
+static const struct mtk_gate_regs ethwarp_cg_regs = {
+	.set_ofs = 0x14,
+	.clr_ofs = 0x14,
+	.sta_ofs = 0x14,
+};
+
+#define GATE_ETHWARP(_id, _name, _parent, _shift)                             \
+	{                                                                     \
+		.id = _id, .name = _name, .parent_name = _parent,             \
+		.regs = &ethwarp_cg_regs, .shift = _shift,                    \
+		.ops = &mtk_clk_gate_ops_no_setclr_inv,                       \
+	}
+
+static const struct mtk_gate ethwarp_clks[] = {
+	GATE_ETHWARP(CLK_ETHWARP_WOCPU2_EN, "ethwarp_wocpu2_en",
+		     "netsys_mcu_sel", 13),
+	GATE_ETHWARP(CLK_ETHWARP_WOCPU1_EN, "ethwarp_wocpu1_en",
+		     "netsys_mcu_sel", 14),
+	GATE_ETHWARP(CLK_ETHWARP_WOCPU0_EN, "ethwarp_wocpu0_en",
+		     "netsys_mcu_sel", 15),
+};
+
+static int clk_mt7988_ethwarp_probe(struct platform_device *pdev)
+{
+	struct clk_onecell_data *clk_data;
+	struct device_node *node = pdev->dev.of_node;
+	int r;
+	void __iomem *base;
+
+	base = of_iomap(node, 0);
+	if (!base) {
+		pr_err("%s(): ioremap failed\n", __func__);
+		return -ENOMEM;
+	}
+
+	clk_data = mtk_alloc_clk_data(ARRAY_SIZE(ethwarp_clks));
+
+	if (!clk_data)
+		return -ENOMEM;
+
+	mtk_clk_register_gates(node, ethwarp_clks, ARRAY_SIZE(ethwarp_clks),
+			       clk_data);
+
+	r = of_clk_add_provider(node, of_clk_src_onecell_get, clk_data);
+	if (r) {
+		pr_err("%s(): could not register clock provider: %d\n",
+		       __func__, r);
+		goto free_data;
+	}
+	return r;
+
+free_data:
+	mtk_free_clk_data(clk_data);
+	return r;
+}
+
+static const struct of_device_id of_match_clk_mt7988_ethsys[] = {
+	{
+		.compatible = "mediatek,mt7988-ethsys",
+	},
+	{}
+};
+
+static struct platform_driver clk_mt7988_ethsys_drv = {
+	.probe = clk_mt7988_ethsys_probe,
+	.driver = {
+		.name = "clk-mt7988-ethsys",
+		.of_match_table = of_match_clk_mt7988_ethsys,
+	},
+};
+builtin_platform_driver(clk_mt7988_ethsys_drv);
+
+static const struct of_device_id of_match_clk_mt7988_sgmii0[] = {
+	{
+		.compatible = "mediatek,mt7988-sgmiisys_0",
+	},
+	{}
+};
+
+static struct platform_driver clk_mt7988_sgmii0_drv = {
+	.probe = clk_mt7988_sgmii0_probe,
+	.driver = {
+		.name = "clk-mt7988-sgmiisys_0",
+		.of_match_table = of_match_clk_mt7988_sgmii0,
+	},
+};
+builtin_platform_driver(clk_mt7988_sgmii0_drv);
+
+static const struct of_device_id of_match_clk_mt7988_sgmii1[] = {
+	{
+		.compatible = "mediatek,mt7988-sgmiisys_1",
+	},
+	{}
+};
+
+static struct platform_driver clk_mt7988_sgmii1_drv = {
+	.probe = clk_mt7988_sgmii1_probe,
+	.driver = {
+		.name = "clk-mt7988-sgmiisys_1",
+		.of_match_table = of_match_clk_mt7988_sgmii1,
+	},
+};
+builtin_platform_driver(clk_mt7988_sgmii1_drv);
+
+static const struct of_device_id of_match_clk_mt7988_ethwarp[] = {
+	{
+		.compatible = "mediatek,mt7988-ethwarp",
+	},
+	{}
+};
+
+static struct platform_driver clk_mt7988_ethwarp_drv = {
+	.probe = clk_mt7988_ethwarp_probe,
+	.driver = {
+		.name = "clk-mt7988-ethwarp",
+		.of_match_table = of_match_clk_mt7988_ethwarp,
+	},
+};
+builtin_platform_driver(clk_mt7988_ethwarp_drv);
\ No newline at end of file
diff --git a/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7988-infracfg.c b/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7988-infracfg.c
new file mode 100644
index 00000000000000..77e25383b6e3c1
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7988-infracfg.c
@@ -0,0 +1,399 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2023 MediaTek Inc.
+ * Author: Sam Shih <sam.shih@mediatek.com>
+ * Author: Xiufeng Li <Xiufeng.Li@mediatek.com>
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/of_device.h>
+#include <linux/platform_device.h>
+#include "clk-mtk.h"
+#include "clk-gate.h"
+#include "clk-mux.h"
+#include <dt-bindings/clock/mediatek,mt7988-clk.h>
+
+static DEFINE_SPINLOCK(mt7988_clk_lock);
+
+static const char *const infra_mux_uart0_parents[] __initconst = {
+	"csw_infra_f26m_sel", "uart_sel"
+};
+
+static const char *const infra_mux_uart1_parents[] __initconst = {
+	"csw_infra_f26m_sel", "uart_sel"
+};
+
+static const char *const infra_mux_uart2_parents[] __initconst = {
+	"csw_infra_f26m_sel", "uart_sel"
+};
+
+static const char *const infra_mux_spi0_parents[] __initconst = { "i2c_sel",
+								  "spi_sel" };
+
+static const char *const infra_mux_spi1_parents[] __initconst = {
+	"i2c_sel", "spim_mst_sel"
+};
+
+static const char *const infra_pwm_bck_parents[] __initconst = {
+	"top_rtc_32p7k", "csw_infra_f26m_sel", "sysaxi_sel", "pwm_sel"
+};
+
+static const char *const infra_pcie_gfmux_tl_ck_o_p0_parents[] __initconst = {
+	"top_rtc_32p7k", "csw_infra_f26m_sel", "csw_infra_f26m_sel",
+	"pextp_tl_sel"
+};
+
+static const char *const infra_pcie_gfmux_tl_ck_o_p1_parents[] __initconst = {
+	"top_rtc_32p7k", "csw_infra_f26m_sel", "csw_infra_f26m_sel",
+	"pextp_tl_p1_sel"
+};
+
+static const char *const infra_pcie_gfmux_tl_ck_o_p2_parents[] __initconst = {
+	"top_rtc_32p7k", "csw_infra_f26m_sel", "csw_infra_f26m_sel",
+	"pextp_tl_p2_sel"
+};
+
+static const char *const infra_pcie_gfmux_tl_ck_o_p3_parents[] __initconst = {
+	"top_rtc_32p7k", "csw_infra_f26m_sel", "csw_infra_f26m_sel",
+	"pextp_tl_p3_sel"
+};
+
+static const struct mtk_mux infra_muxes[] = {
+	/* MODULE_CLK_SEL_0 */
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_MUX_UART0_SEL, "infra_mux_uart0_sel",
+			     infra_mux_uart0_parents, 0x0018, 0x0010, 0x0014,
+			     0, 1, -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_MUX_UART1_SEL, "infra_mux_uart1_sel",
+			     infra_mux_uart1_parents, 0x0018, 0x0010, 0x0014,
+			     1, 1, -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_MUX_UART2_SEL, "infra_mux_uart2_sel",
+			     infra_mux_uart2_parents, 0x0018, 0x0010, 0x0014,
+			     2, 1, -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_MUX_SPI0_SEL, "infra_mux_spi0_sel",
+			     infra_mux_spi0_parents, 0x0018, 0x0010, 0x0014, 4,
+			     1, -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_MUX_SPI1_SEL, "infra_mux_spi1_sel",
+			     infra_mux_spi1_parents, 0x0018, 0x0010, 0x0014, 5,
+			     1, -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_MUX_SPI2_SEL, "infra_mux_spi2_sel",
+			     infra_mux_spi0_parents, 0x0018, 0x0010, 0x0014, 6,
+			     1, -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_PWM_SEL, "infra_pwm_sel",
+			     infra_pwm_bck_parents, 0x0018, 0x0010, 0x0014, 14,
+			     2, -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_PWM_CK1_SEL, "infra_pwm_ck1_sel",
+			     infra_pwm_bck_parents, 0x0018, 0x0010, 0x0014, 16,
+			     2, -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_PWM_CK2_SEL, "infra_pwm_ck2_sel",
+			     infra_pwm_bck_parents, 0x0018, 0x0010, 0x0014, 18,
+			     2, -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_PWM_CK3_SEL, "infra_pwm_ck3_sel",
+			     infra_pwm_bck_parents, 0x0018, 0x0010, 0x0014, 20,
+			     2, -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_PWM_CK4_SEL, "infra_pwm_ck4_sel",
+			     infra_pwm_bck_parents, 0x0018, 0x0010, 0x0014, 22,
+			     2, -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_PWM_CK5_SEL, "infra_pwm_ck5_sel",
+			     infra_pwm_bck_parents, 0x0018, 0x0010, 0x0014, 24,
+			     2, -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_PWM_CK6_SEL, "infra_pwm_ck6_sel",
+			     infra_pwm_bck_parents, 0x0018, 0x0010, 0x0014, 26,
+			     2, -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_PWM_CK7_SEL, "infra_pwm_ck7_sel",
+			     infra_pwm_bck_parents, 0x0018, 0x0010, 0x0014, 28,
+			     2, -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_PWM_CK8_SEL, "infra_pwm_ck8_sel",
+			     infra_pwm_bck_parents, 0x0018, 0x0010, 0x0014, 30,
+			     2, -1, -1, -1),
+	/* MODULE_CLK_SEL_1 */
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_PCIE_GFMUX_TL_O_P0_SEL,
+			     "infra_pcie_gfmux_tl_o_p0_sel",
+			     infra_pcie_gfmux_tl_ck_o_p0_parents, 0x0028,
+			     0x0020, 0x0024, 0, 2, -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_PCIE_GFMUX_TL_O_P1_SEL,
+			     "infra_pcie_gfmux_tl_o_p1_sel",
+			     infra_pcie_gfmux_tl_ck_o_p1_parents, 0x0028,
+			     0x0020, 0x0024, 2, 2, -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_PCIE_GFMUX_TL_O_P2_SEL,
+			     "infra_pcie_gfmux_tl_o_p2_sel",
+			     infra_pcie_gfmux_tl_ck_o_p2_parents, 0x0028,
+			     0x0020, 0x0024, 4, 2, -1, -1, -1),
+	MUX_GATE_CLR_SET_UPD(CLK_INFRA_PCIE_GFMUX_TL_O_P3_SEL,
+			     "infra_pcie_gfmux_tl_o_p3_sel",
+			     infra_pcie_gfmux_tl_ck_o_p3_parents, 0x0028,
+			     0x0020, 0x0024, 6, 2, -1, -1, -1),
+};
+
+static const struct mtk_gate_regs infra0_cg_regs = {
+	.set_ofs = 0x10,
+	.clr_ofs = 0x14,
+	.sta_ofs = 0x18,
+};
+
+static const struct mtk_gate_regs infra1_cg_regs = {
+	.set_ofs = 0x40,
+	.clr_ofs = 0x44,
+	.sta_ofs = 0x48,
+};
+
+static const struct mtk_gate_regs infra2_cg_regs = {
+	.set_ofs = 0x50,
+	.clr_ofs = 0x54,
+	.sta_ofs = 0x58,
+};
+
+static const struct mtk_gate_regs infra3_cg_regs = {
+	.set_ofs = 0x60,
+	.clr_ofs = 0x64,
+	.sta_ofs = 0x68,
+};
+
+#define GATE_INFRA0_FLAGS(_id, _name, _parent, _shift, _flags)                \
+	{                                                                     \
+		.id = _id, .name = _name, .parent_name = _parent,             \
+		.regs = &infra0_cg_regs, .shift = _shift,                     \
+		.ops = &mtk_clk_gate_ops_setclr, .flags = _flags,             \
+	}
+
+#define GATE_INFRA1_FLAGS(_id, _name, _parent, _shift, _flags)                \
+	{                                                                     \
+		.id = _id, .name = _name, .parent_name = _parent,             \
+		.regs = &infra1_cg_regs, .shift = _shift,                     \
+		.ops = &mtk_clk_gate_ops_setclr, .flags = _flags,             \
+	}
+
+#define GATE_INFRA2_FLAGS(_id, _name, _parent, _shift, _flags)                \
+	{                                                                     \
+		.id = _id, .name = _name, .parent_name = _parent,             \
+		.regs = &infra2_cg_regs, .shift = _shift,                     \
+		.ops = &mtk_clk_gate_ops_setclr, .flags = _flags,             \
+	}
+
+#define GATE_INFRA3_FLAGS(_id, _name, _parent, _shift, _flags)                \
+	{                                                                     \
+		.id = _id, .name = _name, .parent_name = _parent,             \
+		.regs = &infra3_cg_regs, .shift = _shift,                     \
+		.ops = &mtk_clk_gate_ops_setclr, .flags = _flags,             \
+	}
+
+#define GATE_INFRA0(_id, _name, _parent, _shift)                              \
+	GATE_INFRA0_FLAGS(_id, _name, _parent, _shift, 0)
+
+#define GATE_INFRA1(_id, _name, _parent, _shift)                              \
+	GATE_INFRA1_FLAGS(_id, _name, _parent, _shift, 0)
+
+#define GATE_INFRA2(_id, _name, _parent, _shift)                              \
+	GATE_INFRA2_FLAGS(_id, _name, _parent, _shift, 0)
+
+#define GATE_INFRA3(_id, _name, _parent, _shift)                              \
+	GATE_INFRA3_FLAGS(_id, _name, _parent, _shift, 0)
+
+static const struct mtk_gate infra_clks[] = {
+	/* INFRA0 */
+	GATE_INFRA0(CLK_INFRA_PCIE_PERI_26M_CK_P0,
+		    "infra_pcie_peri_ck_26m_ck_p0", "csw_infra_f26m_sel", 7),
+	GATE_INFRA0(CLK_INFRA_PCIE_PERI_26M_CK_P1,
+		    "infra_pcie_peri_ck_26m_ck_p1", "csw_infra_f26m_sel", 8),
+	GATE_INFRA0(CLK_INFRA_PCIE_PERI_26M_CK_P2,
+		    "infra_pcie_peri_ck_26m_ck_p2", "csw_infra_f26m_sel", 9),
+	GATE_INFRA0(CLK_INFRA_PCIE_PERI_26M_CK_P3,
+		    "infra_pcie_peri_ck_26m_ck_p3", "csw_infra_f26m_sel", 10),
+	/* INFRA1 */
+	GATE_INFRA1(CLK_INFRA_66M_GPT_BCK, "infra_hf_66m_gpt_bck",
+		    "sysaxi_sel", 0),
+	GATE_INFRA1(CLK_INFRA_66M_PWM_HCK, "infra_hf_66m_pwm_hck",
+		    "sysaxi_sel", 1),
+	GATE_INFRA1(CLK_INFRA_66M_PWM_BCK, "infra_hf_66m_pwm_bck",
+		    "infra_pwm_sel", 2),
+	GATE_INFRA1(CLK_INFRA_66M_PWM_CK1, "infra_hf_66m_pwm_ck1",
+		    "infra_pwm_ck1_sel", 3),
+	GATE_INFRA1(CLK_INFRA_66M_PWM_CK2, "infra_hf_66m_pwm_ck2",
+		    "infra_pwm_ck2_sel", 4),
+	GATE_INFRA1(CLK_INFRA_66M_PWM_CK3, "infra_hf_66m_pwm_ck3",
+		    "infra_pwm_ck3_sel", 5),
+	GATE_INFRA1(CLK_INFRA_66M_PWM_CK4, "infra_hf_66m_pwm_ck4",
+		    "infra_pwm_ck4_sel", 6),
+	GATE_INFRA1(CLK_INFRA_66M_PWM_CK5, "infra_hf_66m_pwm_ck5",
+		    "infra_pwm_ck5_sel", 7),
+	GATE_INFRA1(CLK_INFRA_66M_PWM_CK6, "infra_hf_66m_pwm_ck6",
+		    "infra_pwm_ck6_sel", 8),
+	GATE_INFRA1(CLK_INFRA_66M_PWM_CK7, "infra_hf_66m_pwm_ck7",
+		    "infra_pwm_ck7_sel", 9),
+	GATE_INFRA1(CLK_INFRA_66M_PWM_CK8, "infra_hf_66m_pwm_ck8",
+		    "infra_pwm_ck8_sel", 10),
+	GATE_INFRA1(CLK_INFRA_133M_CQDMA_BCK, "infra_hf_133m_cqdma_bck",
+		    "sysaxi_sel", 12),
+	GATE_INFRA1(CLK_INFRA_66M_AUD_SLV_BCK, "infra_66m_aud_slv_bck",
+		    "sysaxi_sel", 13),
+	GATE_INFRA1(CLK_INFRA_AUD_26M, "infra_f_faud_26m",
+		    "csw_infra_f26m_sel", 14),
+	GATE_INFRA1(CLK_INFRA_AUD_L, "infra_f_faud_l", "aud_l_sel", 15),
+	GATE_INFRA1(CLK_INFRA_AUD_AUD, "infra_f_aud_aud", "a1sys_sel", 16),
+	GATE_INFRA1(CLK_INFRA_AUD_EG2, "infra_f_faud_eg2", "a_tuner_sel", 18),
+	GATE_INFRA1_FLAGS(CLK_INFRA_DRAMC_F26M, "infra_dramc_f26m",
+			  "csw_infra_f26m_sel", 19, CLK_IS_CRITICAL),
+	// JTAG
+	GATE_INFRA1_FLAGS(CLK_INFRA_133M_DBG_ACKM, "infra_hf_133m_dbg_ackm",
+			  "sysaxi_sel", 20, CLK_IS_CRITICAL),
+	GATE_INFRA1(CLK_INFRA_66M_AP_DMA_BCK, "infra_66m_ap_dma_bck",
+		    "sysaxi_sel", 21),
+	GATE_INFRA1(CLK_INFRA_66M_SEJ_BCK, "infra_hf_66m_sej_bck",
+		    "sysaxi_sel", 29),
+	GATE_INFRA1(CLK_INFRA_PRE_CK_SEJ_F13M, "infra_pre_ck_sej_f13m",
+		    "csw_infra_f26m_sel", 30),
+	/* INFRA2 */
+	GATE_INFRA2(CLK_INFRA_26M_THERM_SYSTEM, "infra_hf_26m_therm_system",
+		    "csw_infra_f26m_sel", 0),
+	GATE_INFRA2(CLK_INFRA_I2C_BCK, "infra_i2c_bck", "i2c_sel", 1),
+	GATE_INFRA2(CLK_INFRA_52M_UART0_CK, "infra_f_52m_uart0",
+		    "infra_mux_uart0_sel", 3),
+	GATE_INFRA2(CLK_INFRA_52M_UART1_CK, "infra_f_52m_uart1",
+		    "infra_mux_uart1_sel", 4),
+	GATE_INFRA2(CLK_INFRA_52M_UART2_CK, "infra_f_52m_uart2",
+		    "infra_mux_uart2_sel", 5),
+	GATE_INFRA2(CLK_INFRA_NFI, "infra_f_fnfi", "nfi1x_sel", 9),
+	GATE_INFRA2(CLK_INFRA_SPINFI, "infra_f_fspinfi", "spinfi_sel", 10),
+	GATE_INFRA2_FLAGS(CLK_INFRA_66M_NFI_HCK, "infra_hf_66m_nfi_hck",
+			  "sysaxi_sel", 11, CLK_IS_CRITICAL),
+	GATE_INFRA2_FLAGS(CLK_INFRA_104M_SPI0, "infra_hf_104m_spi0",
+			  "infra_mux_spi0_sel", 12, CLK_IS_CRITICAL),
+	GATE_INFRA2(CLK_INFRA_104M_SPI1, "infra_hf_104m_spi1",
+		    "infra_mux_spi1_sel", 13),
+	GATE_INFRA2(CLK_INFRA_104M_SPI2_BCK, "infra_hf_104m_spi2_bck",
+		    "infra_mux_spi2_sel", 14),
+	GATE_INFRA2_FLAGS(CLK_INFRA_66M_SPI0_HCK, "infra_hf_66m_spi0_hck",
+			  "sysaxi_sel", 15, CLK_IS_CRITICAL),
+	GATE_INFRA2(CLK_INFRA_66M_SPI1_HCK, "infra_hf_66m_spi1_hck",
+		    "sysaxi_sel", 16),
+	GATE_INFRA2(CLK_INFRA_66M_SPI2_HCK, "infra_hf_66m_spi2_hck",
+		    "sysaxi_sel", 17),
+	GATE_INFRA2(CLK_INFRA_66M_FLASHIF_AXI, "infra_hf_66m_flashif_axi",
+		    "sysaxi_sel", 18),
+	GATE_INFRA2(CLK_INFRA_RTC, "infra_f_frtc", "top_rtc_32k", 19),
+	GATE_INFRA2(CLK_INFRA_26M_ADC_BCK, "infra_f_26m_adc_bck",
+		    "csw_infra_f26m_sel", 20),
+	GATE_INFRA2(CLK_INFRA_RC_ADC, "infra_f_frc_adc", "infra_f_26m_adc_bck",
+		    21),
+	GATE_INFRA2(CLK_INFRA_MSDC400, "infra_f_fmsdc400", "emmc_400m_sel",
+		    22),
+	GATE_INFRA2(CLK_INFRA_MSDC2_HCK, "infra_f_fmsdc2_hck", "emmc_250m_sel",
+		    23),
+	GATE_INFRA2(CLK_INFRA_133M_MSDC_0_HCK, "infra_hf_133m_msdc_0_hck",
+		    "sysaxi_sel", 24),
+	GATE_INFRA2(CLK_INFRA_66M_MSDC_0_HCK, "infra_66m_msdc_0_hck",
+		    "sysaxi_sel", 25),
+	GATE_INFRA2(CLK_INFRA_133M_CPUM_BCK, "infra_hf_133m_cpum_bck",
+		    "sysaxi_sel", 26),
+	GATE_INFRA2(CLK_INFRA_BIST2FPC, "infra_hf_fbist2fpc", "nfi1x_sel", 27),
+	GATE_INFRA2(CLK_INFRA_I2C_X16W_MCK_CK_P1,
+		    "infra_hf_i2c_x16w_mck_ck_p1", "sysaxi_sel", 29),
+	GATE_INFRA2(CLK_INFRA_I2C_X16W_PCK_CK_P1,
+		    "infra_hf_i2c_x16w_pck_ck_p1", "sysaxi_sel", 31),
+	/* INFRA3 */
+	GATE_INFRA3(CLK_INFRA_133M_USB_HCK, "infra_133m_usb_hck", "sysaxi_sel",
+		    0),
+	GATE_INFRA3(CLK_INFRA_133M_USB_HCK_CK_P1, "infra_133m_usb_hck_ck_p1",
+		    "sysaxi_sel", 1),
+	GATE_INFRA3(CLK_INFRA_66M_USB_HCK, "infra_66m_usb_hck", "sysaxi_sel",
+		    2),
+	GATE_INFRA3(CLK_INFRA_66M_USB_HCK_CK_P1, "infra_66m_usb_hck_ck_p1",
+		    "sysaxi_sel", 3),
+	GATE_INFRA3(CLK_INFRA_USB_SYS, "infra_usb_sys", "usb_sys_sel", 4),
+	GATE_INFRA3(CLK_INFRA_USB_SYS_CK_P1, "infra_usb_sys_ck_p1",
+		    "usb_sys_p1_sel", 5),
+	GATE_INFRA3(CLK_INFRA_USB_REF, "infra_usb_ref", "top_xtal", 6),
+	GATE_INFRA3(CLK_INFRA_USB_CK_P1, "infra_usb_ck_p1", "top_xtal", 7),
+	GATE_INFRA3_FLAGS(CLK_INFRA_USB_FRMCNT, "infra_usb_frmcnt",
+			  "usb_frmcnt_sel", 8, CLK_IS_CRITICAL),
+	GATE_INFRA3_FLAGS(CLK_INFRA_USB_FRMCNT_CK_P1, "infra_usb_frmcnt_ck_p1",
+			  "usb_frmcnt_p1_sel", 9, CLK_IS_CRITICAL),
+	GATE_INFRA3(CLK_INFRA_USB_PIPE, "infra_usb_pipe", "sspxtp_sel", 10),
+	GATE_INFRA3(CLK_INFRA_USB_PIPE_CK_P1, "infra_usb_pipe_ck_p1",
+		    "usb_phy_sel", 11),
+	GATE_INFRA3(CLK_INFRA_USB_UTMI, "infra_usb_utmi", "top_xtal", 12),
+	GATE_INFRA3(CLK_INFRA_USB_UTMI_CK_P1, "infra_usb_utmi_ck_p1",
+		    "top_xtal", 13),
+	GATE_INFRA3(CLK_INFRA_USB_XHCI, "infra_usb_xhci", "usb_xhci_sel", 14),
+	GATE_INFRA3(CLK_INFRA_USB_XHCI_CK_P1, "infra_usb_xhci_ck_p1",
+		    "usb_xhci_p1_sel", 15),
+	GATE_INFRA3(CLK_INFRA_PCIE_GFMUX_TL_P0, "infra_pcie_gfmux_tl_ck_p0",
+		    "infra_pcie_gfmux_tl_o_p0_sel", 20),
+	GATE_INFRA3(CLK_INFRA_PCIE_GFMUX_TL_P1, "infra_pcie_gfmux_tl_ck_p1",
+		    "infra_pcie_gfmux_tl_o_p1_sel", 21),
+	GATE_INFRA3(CLK_INFRA_PCIE_GFMUX_TL_P2, "infra_pcie_gfmux_tl_ck_p2",
+		    "infra_pcie_gfmux_tl_o_p2_sel", 22),
+	GATE_INFRA3(CLK_INFRA_PCIE_GFMUX_TL_P3, "infra_pcie_gfmux_tl_ck_p3",
+		    "infra_pcie_gfmux_tl_o_p3_sel", 23),
+	GATE_INFRA3(CLK_INFRA_PCIE_PIPE_P0, "infra_pcie_pipe_ck_p0",
+		    "top_xtal", 24),
+	GATE_INFRA3(CLK_INFRA_PCIE_PIPE_P1, "infra_pcie_pipe_ck_p1",
+		    "top_xtal", 25),
+	GATE_INFRA3(CLK_INFRA_PCIE_PIPE_P2, "infra_pcie_pipe_ck_p2",
+		    "top_xtal", 26),
+	GATE_INFRA3(CLK_INFRA_PCIE_PIPE_P3, "infra_pcie_pipe_ck_p3",
+		    "top_xtal", 27),
+	GATE_INFRA3(CLK_INFRA_133M_PCIE_CK_P0, "infra_133m_pcie_ck_p0",
+		    "sysaxi_sel", 28),
+	GATE_INFRA3(CLK_INFRA_133M_PCIE_CK_P1, "infra_133m_pcie_ck_p1",
+		    "sysaxi_sel", 29),
+	GATE_INFRA3(CLK_INFRA_133M_PCIE_CK_P2, "infra_133m_pcie_ck_p2",
+		    "sysaxi_sel", 30),
+	GATE_INFRA3(CLK_INFRA_133M_PCIE_CK_P3, "infra_133m_pcie_ck_p3",
+		    "sysaxi_sel", 31),
+};
+
+static int clk_mt7988_infracfg_probe(struct platform_device *pdev)
+{
+	struct clk_onecell_data *clk_data;
+	struct device_node *node = pdev->dev.of_node;
+	int r;
+	void __iomem *base;
+	int nr = ARRAY_SIZE(infra_muxes) + ARRAY_SIZE(infra_clks);
+
+	base = of_iomap(node, 0);
+	if (!base) {
+		pr_err("%s(): ioremap failed\n", __func__);
+		return -ENOMEM;
+	}
+
+	clk_data = mtk_alloc_clk_data(nr);
+
+	if (!clk_data)
+		return -ENOMEM;
+
+	mtk_clk_register_muxes(infra_muxes, ARRAY_SIZE(infra_muxes), node,
+			       &mt7988_clk_lock, clk_data);
+
+	mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks),
+			       clk_data);
+
+	r = of_clk_add_provider(node, of_clk_src_onecell_get, clk_data);
+	if (r) {
+		pr_err("%s(): could not register clock provider: %d\n",
+		       __func__, r);
+		goto free_infracfg_data;
+	}
+	return r;
+
+free_infracfg_data:
+	mtk_free_clk_data(clk_data);
+	return r;
+}
+
+static const struct of_device_id of_match_clk_mt7988_infracfg[] = {
+	{
+		.compatible = "mediatek,mt7988-infracfg",
+	},
+	{}
+};
+
+static struct platform_driver clk_mt7988_infracfg_drv = {
+	.probe = clk_mt7988_infracfg_probe,
+	.driver = {
+		.name = "clk-mt7988-infracfg",
+		.of_match_table = of_match_clk_mt7988_infracfg,
+	},
+};
+builtin_platform_driver(clk_mt7988_infracfg_drv);
diff --git a/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7988-topckgen.c b/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7988-topckgen.c
new file mode 100644
index 00000000000000..917302b6df682a
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/drivers/clk/mediatek/clk-mt7988-topckgen.c
@@ -0,0 +1,522 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2023 MediaTek Inc.
+ * Author: Sam Shih <sam.shih@mediatek.com>
+ * Author: Xiufeng Li <Xiufeng.Li@mediatek.com>
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/of_device.h>
+#include <linux/platform_device.h>
+#include "clk-mtk.h"
+#include "clk-gate.h"
+#include "clk-mux.h"
+#include <dt-bindings/clock/mediatek,mt7988-clk.h>
+
+static DEFINE_SPINLOCK(mt7988_clk_lock);
+
+static const struct mtk_fixed_clk top_fixed_clks[] = {
+	FIXED_CLK(CLK_TOP_XTAL, "top_xtal", "clkxtal", 40000000),
+};
+
+static const struct mtk_fixed_factor top_divs[] = {
+	FACTOR(CLK_TOP_XTAL_D2, "top_xtal_d2", "top_xtal", 1, 2),
+	FACTOR(CLK_TOP_RTC_32K, "top_rtc_32k", "top_xtal", 1, 1250),
+	FACTOR(CLK_TOP_RTC_32P7K, "top_rtc_32p7k", "top_xtal", 1, 1220),
+	FACTOR(CLK_TOP_MPLL_D2, "mpll_d2", "mpll", 1, 2),
+	FACTOR(CLK_TOP_MPLL_D3_D2, "mpll_d3_d2", "mpll", 1, 2),
+	FACTOR(CLK_TOP_MPLL_D4, "mpll_d4", "mpll", 1, 4),
+	FACTOR(CLK_TOP_MPLL_D8, "mpll_d8", "mpll", 1, 8),
+	FACTOR(CLK_TOP_MPLL_D8_D2, "mpll_d8_d2", "mpll", 1, 16),
+	FACTOR(CLK_TOP_MMPLL_D2, "mmpll_d2", "mmpll", 1, 2),
+	FACTOR(CLK_TOP_MMPLL_D3_D5, "mmpll_d3_d5", "mmpll", 1, 15),
+	FACTOR(CLK_TOP_MMPLL_D4, "mmpll_d4", "mmpll", 1, 4),
+	FACTOR(CLK_TOP_MMPLL_D6_D2, "mmpll_d6_d2", "mmpll", 1, 12),
+	FACTOR(CLK_TOP_MMPLL_D8, "mmpll_d8", "mmpll", 1, 8),
+	FACTOR(CLK_TOP_APLL2_D4, "apll2_d4", "apll2", 1, 4),
+	FACTOR(CLK_TOP_NET1PLL_D4, "net1pll_d4", "net1pll", 1, 4),
+	FACTOR(CLK_TOP_NET1PLL_D5, "net1pll_d5", "net1pll", 1, 5),
+	FACTOR(CLK_TOP_NET1PLL_D5_D2, "net1pll_d5_d2", "net1pll", 1, 10),
+	FACTOR(CLK_TOP_NET1PLL_D5_D4, "net1pll_d5_d4", "net1pll", 1, 20),
+	FACTOR(CLK_TOP_NET1PLL_D8, "net1pll_d8", "net1pll", 1, 8),
+	FACTOR(CLK_TOP_NET1PLL_D8_D2, "net1pll_d8_d2", "net1pll", 1, 16),
+	FACTOR(CLK_TOP_NET1PLL_D8_D4, "net1pll_d8_d4", "net1pll", 1, 32),
+	FACTOR(CLK_TOP_NET1PLL_D8_D8, "net1pll_d8_d8", "net1pll", 1, 64),
+	FACTOR(CLK_TOP_NET1PLL_D8_D16, "net1pll_d8_d16", "net1pll", 1, 128),
+	FACTOR(CLK_TOP_NET2PLL_D2, "net2pll_d2", "net2pll", 1, 2),
+	FACTOR(CLK_TOP_NET2PLL_D4, "net2pll_d4", "net2pll", 1, 4),
+	FACTOR(CLK_TOP_NET2PLL_D4_D4, "net2pll_d4_d4", "net2pll", 1, 16),
+	FACTOR(CLK_TOP_NET2PLL_D4_D8, "net2pll_d4_d8", "net2pll", 1, 32),
+	FACTOR(CLK_TOP_NET2PLL_D6, "net2pll_d6", "net2pll", 1, 6),
+	FACTOR(CLK_TOP_NET2PLL_D8, "net2pll_d8", "net2pll", 1, 8),
+};
+
+static const char *const netsys_parents[] = { "top_xtal", "net2pll_d2",
+					      "mmpll_d2" };
+
+static const char *const netsys_500m_parents[] = { "top_xtal", "net1pll_d5",
+						   "net1pll_d5_d2" };
+
+static const char *const netsys_2x_parents[] = { "top_xtal", "net2pll",
+						 "mmpll" };
+
+static const char *const netsys_gsw_parents[] = { "top_xtal", "net1pll_d4",
+						  "net1pll_d5" };
+
+static const char *const eth_gmii_parents[] = { "top_xtal", "net1pll_d5_d4" };
+
+static const char *const netsys_mcu_parents[] = { "top_xtal",	"net2pll",
+						  "mmpll",	"net1pll_d4",
+						  "net1pll_d5", "mpll" };
+
+static const char *const eip197_parents[] = { "top_xtal",   "netsyspll",
+					      "net2pll",    "mmpll",
+					      "net1pll_d4", "net1pll_d5" };
+
+static const char *const axi_infra_parents[] = { "top_xtal", "net1pll_d8_d2" };
+
+static const char *const uart_parents[] = { "top_xtal", "mpll_d8",
+					    "mpll_d8_d2" };
+
+static const char *const emmc_250m_parents[] = { "top_xtal", "net1pll_d5_d2",
+						 "mmpll_d4" };
+
+static const char *const emmc_400m_parents[] = { "top_xtal", "msdcpll",
+						 "mmpll_d2", "mpll_d2",
+						 "mmpll_d4", "net1pll_d8_d2" };
+
+static const char *const spi_parents[] = { "top_xtal",	 "mpll_d2",
+					   "mmpll_d4",	 "net1pll_d8_d2",
+					   "net2pll_d6", "net1pll_d5_d4",
+					   "mpll_d4",	 "net1pll_d8_d4" };
+
+static const char *const nfi1x_parents[] = { "top_xtal",      "mmpll_d4",
+					     "net1pll_d8_d2", "net2pll_d6",
+					     "mpll_d4",	      "mmpll_d8",
+					     "net1pll_d8_d4", "mpll_d8" };
+
+static const char *const spinfi_parents[] = { "top_xtal_d2",   "top_xtal",
+					      "net1pll_d5_d4", "mpll_d4",
+					      "mmpll_d8",      "net1pll_d8_d4",
+					      "mmpll_d6_d2",   "mpll_d8" };
+
+static const char *const pwm_parents[] = { "top_xtal",	    "net1pll_d8_d2",
+					   "net1pll_d5_d4", "mpll_d4",
+					   "mpll_d8_d2",    "top_rtc_32k" };
+
+static const char *const i2c_parents[] = { "top_xtal", "net1pll_d5_d4",
+					   "mpll_d4", "net1pll_d8_d4" };
+
+static const char *const pcie_mbist_250m_parents[] = { "top_xtal",
+						       "net1pll_d5_d2" };
+
+static const char *const pextp_tl_ck_parents[] = { "top_xtal", "net2pll_d6",
+						   "mmpll_d8", "mpll_d8_d2",
+						   "top_rtc_32k" };
+
+static const char *const usb_frmcnt_parents[] = { "top_xtal", "mmpll_d3_d5" };
+
+static const char *const aud_parents[] = { "top_xtal", "apll2" };
+
+static const char *const a1sys_parents[] = { "top_xtal", "apll2_d4" };
+
+static const char *const aud_l_parents[] = { "top_xtal", "apll2",
+					     "mpll_d8_d2" };
+
+static const char *const sspxtp_parents[] = { "top_xtal_d2", "mpll_d8_d2" };
+
+static const char *const usxgmii_sbus_0_parents[] = { "top_xtal",
+						      "net1pll_d8_d4" };
+
+static const char *const sgm_0_parents[] = { "top_xtal", "sgmpll" };
+
+static const char *const sysapb_parents[] = { "top_xtal", "mpll_d3_d2" };
+
+static const char *const eth_refck_50m_parents[] = { "top_xtal",
+						     "net2pll_d4_d4" };
+
+static const char *const eth_sys_200m_parents[] = { "top_xtal", "net2pll_d4" };
+
+static const char *const eth_xgmii_parents[] = { "top_xtal_d2",
+						 "net1pll_d8_d8",
+						 "net1pll_d8_d16" };
+
+static const char *const bus_tops_parents[] = { "top_xtal", "net1pll_d5",
+						"net2pll_d2" };
+
+static const char *const npu_tops_parents[] = { "top_xtal", "net2pll" };
+
+static const char *const dramc_md32_parents[] = { "top_xtal", "mpll_d2",
+						  "wedmcupll" };
+
+static const char *const da_xtp_glb_p0_parents[] = { "top_xtal",
+						     "net2pll_d8" };
+
+static const char *const mcusys_backup_625m_parents[] = { "top_xtal",
+							  "net1pll_d4" };
+
+static const char *const macsec_parents[] = { "top_xtal", "sgmpll",
+					      "net1pll_d8" };
+
+static const char *const netsys_tops_400m_parents[] = { "top_xtal",
+							"net2pll_d2" };
+
+static const char *const eth_mii_parents[] = { "top_xtal_d2",
+					       "net2pll_d4_d8" };
+
+static const struct mtk_mux top_muxes[] = {
+	/* CLK_CFG_0 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_NETSYS_SEL, "netsys_sel", netsys_parents,
+			     0x000, 0x004, 0x008, 0, 2, 7, 0x1c0, 0),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_NETSYS_500M_SEL, "netsys_500m_sel",
+			     netsys_500m_parents, 0x000, 0x004, 0x008, 8, 2,
+			     15, 0x1C0, 1),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_NETSYS_2X_SEL, "netsys_2x_sel",
+			     netsys_2x_parents, 0x000, 0x004, 0x008, 16, 2, 23,
+			     0x1C0, 2),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_NETSYS_GSW_SEL, "netsys_gsw_sel",
+			     netsys_gsw_parents, 0x000, 0x004, 0x008, 24, 2,
+			     31, 0x1C0, 3),
+	/* CLK_CFG_1 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_ETH_GMII_SEL, "eth_gmii_sel",
+			     eth_gmii_parents, 0x010, 0x014, 0x018, 0, 1, 7,
+			     0x1C0, 4),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_NETSYS_MCU_SEL, "netsys_mcu_sel",
+			     netsys_mcu_parents, 0x010, 0x014, 0x018, 8, 3, 15,
+			     0x1C0, 5),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_NETSYS_PAO_2X_SEL, "netsys_pao_2x_sel",
+			     netsys_mcu_parents, 0x010, 0x014, 0x018, 16, 3,
+			     23, 0x1C0, 6),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_EIP197_SEL, "eip197_sel", eip197_parents,
+			     0x010, 0x014, 0x018, 24, 3, 31, 0x1c0, 7),
+	/* CLK_CFG_2 */
+	MUX_GATE_CLR_SET_UPD_FLAGS(CLK_TOP_AXI_INFRA_SEL, "axi_infra_sel",
+				   axi_infra_parents, 0x020, 0x024, 0x028, 0,
+				   1, 7, 0x1C0, 8, CLK_IS_CRITICAL),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_UART_SEL, "uart_sel", uart_parents, 0x020,
+			     0x024, 0x028, 8, 2, 15, 0x1c0, 9),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_EMMC_250M_SEL, "emmc_250m_sel",
+			     emmc_250m_parents, 0x020, 0x024, 0x028, 16, 2, 23,
+			     0x1C0, 10),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_EMMC_400M_SEL, "emmc_400m_sel",
+			     emmc_400m_parents, 0x020, 0x024, 0x028, 24, 3, 31,
+			     0x1C0, 11),
+	/* CLK_CFG_3 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_SPI_SEL, "spi_sel", spi_parents, 0x030,
+			     0x034, 0x038, 0, 3, 7, 0x1c0, 12),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_SPIM_MST_SEL, "spim_mst_sel", spi_parents,
+			     0x030, 0x034, 0x038, 8, 3, 15, 0x1c0, 13),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_NFI1X_SEL, "nfi1x_sel", nfi1x_parents,
+			     0x030, 0x034, 0x038, 16, 3, 23, 0x1c0, 14),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_SPINFI_SEL, "spinfi_sel", spinfi_parents,
+			     0x030, 0x034, 0x038, 24, 3, 31, 0x1c0, 15),
+	/* CLK_CFG_4 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_PWM_SEL, "pwm_sel", pwm_parents, 0x040,
+			     0x044, 0x048, 0, 3, 7, 0x1c0, 16),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_I2C_SEL, "i2c_sel", i2c_parents, 0x040,
+			     0x044, 0x048, 8, 2, 15, 0x1c0, 17),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_PCIE_MBIST_250M_SEL,
+			     "pcie_mbist_250m_sel", pcie_mbist_250m_parents,
+			     0x040, 0x044, 0x048, 16, 1, 23, 0x1C0, 18),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_PEXTP_TL_SEL, "pextp_tl_sel",
+			     pextp_tl_ck_parents, 0x040, 0x044, 0x048, 24, 3,
+			     31, 0x1C0, 19),
+	/* CLK_CFG_5 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_PEXTP_TL_P1_SEL, "pextp_tl_p1_sel",
+			     pextp_tl_ck_parents, 0x050, 0x054, 0x058, 0, 3, 7,
+			     0x1C0, 20),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_PEXTP_TL_P2_SEL, "pextp_tl_p2_sel",
+			     pextp_tl_ck_parents, 0x050, 0x054, 0x058, 8, 3,
+			     15, 0x1C0, 21),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_PEXTP_TL_P3_SEL, "pextp_tl_p3_sel",
+			     pextp_tl_ck_parents, 0x050, 0x054, 0x058, 16, 3,
+			     23, 0x1C0, 22),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_USB_SYS_SEL, "usb_sys_sel",
+			     eth_gmii_parents, 0x050, 0x054, 0x058, 24, 1, 31,
+			     0x1C0, 23),
+	/* CLK_CFG_6 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_USB_SYS_P1_SEL, "usb_sys_p1_sel",
+			     eth_gmii_parents, 0x060, 0x064, 0x068, 0, 1, 7,
+			     0x1C0, 24),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_USB_XHCI_SEL, "usb_xhci_sel",
+			     eth_gmii_parents, 0x060, 0x064, 0x068, 8, 1, 15,
+			     0x1C0, 25),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_USB_XHCI_P1_SEL, "usb_xhci_p1_sel",
+			     eth_gmii_parents, 0x060, 0x064, 0x068, 16, 1, 23,
+			     0x1C0, 26),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_USB_FRMCNT_SEL, "usb_frmcnt_sel",
+			     usb_frmcnt_parents, 0x060, 0x064, 0x068, 24, 1,
+			     31, 0x1C0, 27),
+	/* CLK_CFG_7 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_USB_FRMCNT_P1_SEL, "usb_frmcnt_p1_sel",
+			     usb_frmcnt_parents, 0x070, 0x074, 0x078, 0, 1, 7,
+			     0x1C0, 28),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_AUD_SEL, "aud_sel", aud_parents, 0x070,
+			     0x074, 0x078, 8, 1, 15, 0x1c0, 29),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_A1SYS_SEL, "a1sys_sel", a1sys_parents,
+			     0x070, 0x074, 0x078, 16, 1, 23, 0x1c0, 30),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_AUD_L_SEL, "aud_l_sel", aud_l_parents,
+			     0x070, 0x074, 0x078, 24, 2, 31, 0x1c4, 0),
+	/* CLK_CFG_8 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_A_TUNER_SEL, "a_tuner_sel", a1sys_parents,
+			     0x080, 0x084, 0x088, 0, 1, 7, 0x1c4, 1),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_SSPXTP_SEL, "sspxtp_sel", sspxtp_parents,
+			     0x080, 0x084, 0x088, 8, 1, 15, 0x1c4, 2),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_USB_PHY_SEL, "usb_phy_sel",
+			     sspxtp_parents, 0x080, 0x084, 0x088, 16, 1, 23,
+			     0x1c4, 3),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_USXGMII_SBUS_0_SEL, "usxgmii_sbus_0_sel",
+			     usxgmii_sbus_0_parents, 0x080, 0x084, 0x088, 24,
+			     1, 31, 0x1C4, 4),
+	/* CLK_CFG_9 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_USXGMII_SBUS_1_SEL, "usxgmii_sbus_1_sel",
+			     usxgmii_sbus_0_parents, 0x090, 0x094, 0x098, 0, 1,
+			     7, 0x1C4, 5),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_SGM_0_SEL, "sgm_0_sel", sgm_0_parents,
+			     0x090, 0x094, 0x098, 8, 1, 15, 0x1c4, 6),
+	MUX_GATE_CLR_SET_UPD_FLAGS(CLK_TOP_SGM_SBUS_0_SEL, "sgm_sbus_0_sel",
+				   usxgmii_sbus_0_parents, 0x090, 0x094, 0x098,
+				   16, 1, 23, 0x1C4, 7, CLK_IS_CRITICAL),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_SGM_1_SEL, "sgm_1_sel", sgm_0_parents,
+			     0x090, 0x094, 0x098, 24, 1, 31, 0x1c4, 8),
+	/* CLK_CFG_10 */
+	MUX_GATE_CLR_SET_UPD_FLAGS(CLK_TOP_SGM_SBUS_1_SEL, "sgm_sbus_1_sel",
+				   usxgmii_sbus_0_parents, 0x0a0, 0x0a4, 0x0a8,
+				   0, 1, 7, 0x1C4, 9, CLK_IS_CRITICAL),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_XFI_PHY_0_XTAL_SEL, "xfi_phy_0_xtal_sel",
+			     sspxtp_parents, 0x0a0, 0x0a4, 0x0a8, 8, 1, 15,
+			     0x1C4, 10),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_XFI_PHY_1_XTAL_SEL, "xfi_phy_1_xtal_sel",
+			     sspxtp_parents, 0x0a0, 0x0a4, 0x0a8, 16, 1, 23,
+			     0x1C4, 11),
+	/* CLK_CFG_11 */
+	MUX_GATE_CLR_SET_UPD_FLAGS(CLK_TOP_SYSAXI_SEL, "sysaxi_sel",
+				   axi_infra_parents, 0x0a0, 0x0a4, 0x0a8, 24,
+				   1, 31, 0x1C4, 12, CLK_IS_CRITICAL),
+	MUX_GATE_CLR_SET_UPD_FLAGS(CLK_TOP_SYSAPB_SEL, "sysapb_sel",
+				   sysapb_parents, 0x0b0, 0x0b4, 0x0b8, 0, 1,
+				   7, 0x1c4, 13, CLK_IS_CRITICAL),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_ETH_REFCK_50M_SEL, "eth_refck_50m_sel",
+			     eth_refck_50m_parents, 0x0b0, 0x0b4, 0x0b8, 8, 1,
+			     15, 0x1C4, 14),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_ETH_SYS_200M_SEL, "eth_sys_200m_sel",
+			     eth_sys_200m_parents, 0x0b0, 0x0b4, 0x0b8, 16, 1,
+			     23, 0x1C4, 15),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_ETH_SYS_SEL, "eth_sys_sel",
+			     pcie_mbist_250m_parents, 0x0b0, 0x0b4, 0x0b8, 24,
+			     1, 31, 0x1C4, 16),
+	/* CLK_CFG_12 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_ETH_XGMII_SEL, "eth_xgmii_sel",
+			     eth_xgmii_parents, 0x0c0, 0x0c4, 0x0c8, 0, 2, 7,
+			     0x1C4, 17),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_BUS_TOPS_SEL, "bus_tops_sel",
+			     bus_tops_parents, 0x0c0, 0x0c4, 0x0c8, 8, 2, 15,
+			     0x1C4, 18),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_NPU_TOPS_SEL, "npu_tops_sel",
+			     npu_tops_parents, 0x0c0, 0x0c4, 0x0c8, 16, 1, 23,
+			     0x1C4, 19),
+	MUX_GATE_CLR_SET_UPD_FLAGS(CLK_TOP_DRAMC_SEL, "dramc_sel",
+				   sspxtp_parents, 0x0c0, 0x0c4, 0x0c8, 24, 1,
+				   31, 0x1C4, 20, CLK_IS_CRITICAL),
+	/* CLK_CFG_13 */
+	MUX_GATE_CLR_SET_UPD_FLAGS(CLK_TOP_DRAMC_MD32_SEL, "dramc_md32_sel",
+				   dramc_md32_parents, 0x0d0, 0x0d4, 0x0d8, 0,
+				   2, 7, 0x1C4, 21, CLK_IS_CRITICAL),
+	MUX_GATE_CLR_SET_UPD_FLAGS(
+		CLK_TOP_INFRA_F26M_SEL, "csw_infra_f26m_sel", sspxtp_parents,
+		0x0d0, 0x0d4, 0x0d8, 8, 1, 15, 0x1C4, 22, CLK_IS_CRITICAL),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_PEXTP_P0_SEL, "pextp_p0_sel",
+			     sspxtp_parents, 0x0d0, 0x0d4, 0x0d8, 16, 1, 23,
+			     0x1C4, 23),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_PEXTP_P1_SEL, "pextp_p1_sel",
+			     sspxtp_parents, 0x0d0, 0x0d4, 0x0d8, 24, 1, 31,
+			     0x1C4, 24),
+	/* CLK_CFG_14 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_PEXTP_P2_SEL, "pextp_p2_sel",
+			     sspxtp_parents, 0x0e0, 0x0e4, 0x0e8, 0, 1, 7,
+			     0x1C4, 25),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_PEXTP_P3_SEL, "pextp_p3_sel",
+			     sspxtp_parents, 0x0e0, 0x0e4, 0x0e8, 8, 1, 15,
+			     0x1C4, 26),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_DA_XTP_GLB_P0_SEL, "da_xtp_glb_p0_sel",
+			     da_xtp_glb_p0_parents, 0x0e0, 0x0e4, 0x0e8, 16, 1,
+			     23, 0x1C4, 27),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_DA_XTP_GLB_P1_SEL, "da_xtp_glb_p1_sel",
+			     da_xtp_glb_p0_parents, 0x0e0, 0x0e4, 0x0e8, 24, 1,
+			     31, 0x1C4, 28),
+	/* CLK_CFG_15 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_DA_XTP_GLB_P2_SEL, "da_xtp_glb_p2_sel",
+			     da_xtp_glb_p0_parents, 0x0f0, 0x0f4, 0x0f8, 0, 1,
+			     7, 0x1C4, 29),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_DA_XTP_GLB_P3_SEL, "da_xtp_glb_p3_sel",
+			     da_xtp_glb_p0_parents, 0x0f0, 0x0f4, 0x0f8, 8, 1,
+			     15, 0x1C4, 30),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_CKM_SEL, "ckm_sel", sspxtp_parents, 0x0F0,
+			     0x0f4, 0x0f8, 16, 1, 23, 0x1c8, 0),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_DA_SEL, "da_sel", sspxtp_parents, 0x0f0,
+			     0x0f4, 0x0f8, 24, 1, 31, 0x1C8, 1),
+	/* CLK_CFG_16 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_PEXTP_SEL, "pextp_sel", sspxtp_parents,
+			     0x0100, 0x104, 0x108, 0, 1, 7, 0x1c8, 2),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_TOPS_P2_26M_SEL, "tops_p2_26m_sel",
+			     sspxtp_parents, 0x0100, 0x104, 0x108, 8, 1, 15,
+			     0x1C8, 3),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_MCUSYS_BACKUP_625M_SEL,
+			     "mcusys_backup_625m_sel",
+			     mcusys_backup_625m_parents, 0x0100, 0x104, 0x108,
+			     16, 1, 23, 0x1C8, 4),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_NETSYS_SYNC_250M_SEL,
+			     "netsys_sync_250m_sel", pcie_mbist_250m_parents,
+			     0x0100, 0x104, 0x108, 24, 1, 31, 0x1c8, 5),
+	/* CLK_CFG_17 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_MACSEC_SEL, "macsec_sel", macsec_parents,
+			     0x0110, 0x114, 0x118, 0, 2, 7, 0x1c8, 6),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_NETSYS_TOPS_400M_SEL,
+			     "netsys_tops_400m_sel", netsys_tops_400m_parents,
+			     0x0110, 0x114, 0x118, 8, 1, 15, 0x1c8, 7),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_NETSYS_PPEFB_250M_SEL,
+			     "netsys_ppefb_250m_sel", pcie_mbist_250m_parents,
+			     0x0110, 0x114, 0x118, 16, 1, 23, 0x1c8, 8),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_NETSYS_WARP_SEL, "netsys_warp_sel",
+			     netsys_parents, 0x0110, 0x114, 0x118, 24, 2, 31,
+			     0x1C8, 9),
+	/* CLK_CFG_18 */
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_ETH_MII_SEL, "eth_mii_sel",
+			     eth_mii_parents, 0x0120, 0x124, 0x128, 0, 1, 7,
+			     0x1c8, 10),
+	MUX_GATE_CLR_SET_UPD(CLK_TOP_NPU_SEL, "ck_npu_sel", netsys_2x_parents,
+			     0x0120, 0x124, 0x128, 8, 2, 15, 0x1c8, 11),
+};
+
+static const struct mtk_composite top_aud_divs[] = {
+	DIV_GATE(CLK_TOP_AUD_I2S_M, "aud_i2s_m", "aud_sel", 0x0420, 0, 0x0420,
+		 8, 8),
+};
+
+static int clk_mt7988_topckgen_probe(struct platform_device *pdev)
+{
+	struct clk_onecell_data *clk_data;
+	struct device_node *node = pdev->dev.of_node;
+	int r;
+	void __iomem *base;
+	int nr = ARRAY_SIZE(top_fixed_clks) + ARRAY_SIZE(top_divs) +
+		 ARRAY_SIZE(top_muxes) + ARRAY_SIZE(top_aud_divs);
+
+	base = of_iomap(node, 0);
+	if (!base) {
+		pr_err("%s(): ioremap failed\n", __func__);
+		return -ENOMEM;
+	}
+
+	clk_data = mtk_alloc_clk_data(nr);
+	if (!clk_data)
+		return -ENOMEM;
+
+	mtk_clk_register_fixed_clks(top_fixed_clks, ARRAY_SIZE(top_fixed_clks),
+				    clk_data);
+
+	mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), clk_data);
+
+	mtk_clk_register_muxes(top_muxes, ARRAY_SIZE(top_muxes), node,
+			       &mt7988_clk_lock, clk_data);
+
+	mtk_clk_register_composites(top_aud_divs, ARRAY_SIZE(top_aud_divs),
+				    base, &mt7988_clk_lock, clk_data);
+
+	r = of_clk_add_provider(node, of_clk_src_onecell_get, clk_data);
+
+	if (r) {
+		pr_err("%s(): could not register clock provider: %d\n",
+		       __func__, r);
+		goto free_topckgen_data;
+	}
+	return r;
+
+free_topckgen_data:
+	mtk_free_clk_data(clk_data);
+	return r;
+}
+
+static const char *const mcu_bus_div_parents[] = { "top_xtal", "ccipll2_b",
+						   "net1pll_d4" };
+
+static const char *const mcu_arm_div_parents[] = { "top_xtal", "arm_b",
+						   "net1pll_d4" };
+
+static struct mtk_composite mcu_muxes[] = {
+	/* bus_pll_divider_cfg */
+	MUX_GATE_FLAGS(CLK_MCU_BUS_DIV_SEL, "mcu_bus_div_sel",
+		       mcu_bus_div_parents, 0x7C0, 9, 2, -1, CLK_IS_CRITICAL),
+	/* mp2_pll_divider_cfg */
+	MUX_GATE_FLAGS(CLK_MCU_ARM_DIV_SEL, "mcu_arm_div_sel",
+		       mcu_arm_div_parents, 0x7A8, 9, 2, -1, CLK_IS_CRITICAL),
+};
+
+static int clk_mt7988_mcusys_probe(struct platform_device *pdev)
+{
+	struct clk_onecell_data *clk_data;
+	struct device_node *node = pdev->dev.of_node;
+	int r;
+	void __iomem *base;
+	int nr = ARRAY_SIZE(mcu_muxes);
+
+	base = of_iomap(node, 0);
+	if (!base) {
+		pr_err("%s(): ioremap failed\n", __func__);
+		return -ENOMEM;
+	}
+
+	clk_data = mtk_alloc_clk_data(nr);
+	if (!clk_data)
+		return -ENOMEM;
+
+	mtk_clk_register_composites(mcu_muxes, ARRAY_SIZE(mcu_muxes), base,
+				    &mt7988_clk_lock, clk_data);
+
+	r = of_clk_add_provider(node, of_clk_src_onecell_get, clk_data);
+
+	if (r) {
+		pr_err("%s(): could not register clock provider: %d\n",
+		       __func__, r);
+		goto free_mcusys_data;
+	}
+	return r;
+
+free_mcusys_data:
+	mtk_free_clk_data(clk_data);
+	return r;
+}
+
+static const struct of_device_id of_match_clk_mt7988_topckgen[] = {
+	{
+		.compatible = "mediatek,mt7988-topckgen",
+	},
+	{}
+};
+
+static struct platform_driver clk_mt7988_topckgen_drv = {
+	.probe = clk_mt7988_topckgen_probe,
+	.driver = {
+		.name = "clk-mt7988-topckgen",
+		.of_match_table = of_match_clk_mt7988_topckgen,
+	},
+};
+builtin_platform_driver(clk_mt7988_topckgen_drv);
+
+static const struct of_device_id of_match_clk_mt7988_mcusys[] = {
+	{
+		.compatible = "mediatek,mt7988-mcusys",
+	},
+	{}
+};
+
+static struct platform_driver clk_mt7988_mcusys_drv = {
+	.probe = clk_mt7988_mcusys_probe,
+	.driver = {
+		.name = "clk-mt7988-mcusys",
+		.of_match_table = of_match_clk_mt7988_mcusys,
+	},
+};
+builtin_platform_driver(clk_mt7988_mcusys_drv);
\ No newline at end of file
diff --git a/target/linux/mediatek/files-5.15/drivers/net/phy/mediatek-2p5ge.c b/target/linux/mediatek/files-5.15/drivers/net/phy/mediatek-2p5ge.c
new file mode 100644
index 00000000000000..c12e6b8eb6f8f6
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/drivers/net/phy/mediatek-2p5ge.c
@@ -0,0 +1,262 @@
+// SPDX-License-Identifier: GPL-2.0+
+#include <linux/bitfield.h>
+#include <linux/firmware.h>
+#include <linux/module.h>
+#include <linux/nvmem-consumer.h>
+#include <linux/of_address.h>
+#include <linux/of_platform.h>
+#include <linux/pinctrl/consumer.h>
+#include <linux/phy.h>
+
+#define MEDAITEK_2P5GE_PHY_DMB_FW "mediatek/mediatek-2p5ge-phy-dmb.bin"
+#define MEDIATEK_2P5GE_PHY_PMB_FW "mediatek/mediatek-2p5ge-phy-pmb.bin"
+
+#define MD32_EN_CFG			0x18
+#define   MD32_EN			BIT(0)
+
+#define BASE100T_STATUS_EXTEND		0x10
+#define BASE1000T_STATUS_EXTEND		0x11
+#define EXTEND_CTRL_AND_STATUS		0x16
+
+#define PHY_AUX_CTRL_STATUS		0x1d
+#define   PHY_AUX_DPX_MASK		GENMASK(5, 5)
+#define   PHY_AUX_SPEED_MASK		GENMASK(4, 2)
+
+/* Registers on MDIO_MMD_VEND1 */
+#define MTK_PHY_LINK_STATUS_MISC	0xa2
+#define   MTK_PHY_FDX_ENABLE		BIT(5)
+
+/* Registers on MDIO_MMD_VEND2 */
+#define MTK_PHY_LED0_ON_CTRL		0x24
+#define   MTK_PHY_LED0_ON_LINK1000	BIT(0)
+#define   MTK_PHY_LED0_ON_LINK100	BIT(1)
+#define   MTK_PHY_LED0_ON_LINK10	BIT(2)
+#define   MTK_PHY_LED0_ON_LINK2500	BIT(7)
+#define   MTK_PHY_LED0_POLARITY		BIT(14)
+
+#define MTK_PHY_LED1_ON_CTRL		0x26
+#define   MTK_PHY_LED1_ON_FDX		BIT(4)
+#define   MTK_PHY_LED1_ON_HDX		BIT(5)
+#define   MTK_PHY_LED1_POLARITY		BIT(14)
+
+enum {
+	PHY_AUX_SPD_10 = 0,
+	PHY_AUX_SPD_100,
+	PHY_AUX_SPD_1000,
+	PHY_AUX_SPD_2500,
+};
+
+static int mt798x_2p5ge_phy_config_init(struct phy_device *phydev)
+{
+	int ret;
+	int i;
+	const struct firmware *fw;
+	struct device *dev = &phydev->mdio.dev;
+	struct device_node *np;
+	void __iomem *dmb_addr;
+	void __iomem *pmb_addr;
+	void __iomem *mcucsr_base;
+	u16 reg;
+	struct pinctrl *pinctrl;
+
+	np = of_find_compatible_node(NULL, NULL, "mediatek,2p5gphy-fw");
+	if (!np)
+		return -ENOENT;
+
+	dmb_addr = of_iomap(np, 0);
+	if (!dmb_addr)
+		return -ENOMEM;
+	pmb_addr = of_iomap(np, 1);
+	if (!pmb_addr)
+		return -ENOMEM;
+	mcucsr_base = of_iomap(np, 2);
+	if (!mcucsr_base)
+		return -ENOMEM;
+
+	ret = request_firmware(&fw, MEDAITEK_2P5GE_PHY_DMB_FW, dev);
+	if (ret) {
+		dev_err(dev, "failed to load firmware: %s, ret: %d\n",
+			MEDAITEK_2P5GE_PHY_DMB_FW, ret);
+		return ret;
+	}
+	for (i = 0; i < fw->size - 1; i += 4)
+		writel(*((uint32_t *)(fw->data + i)), dmb_addr + i);
+	release_firmware(fw);
+
+	ret = request_firmware(&fw, MEDIATEK_2P5GE_PHY_PMB_FW, dev);
+	if (ret) {
+		dev_err(dev, "failed to load firmware: %s, ret: %d\n",
+			MEDIATEK_2P5GE_PHY_PMB_FW, ret);
+		return ret;
+	}
+	for (i = 0; i < fw->size - 1; i += 4)
+		writel(*((uint32_t *)(fw->data + i)), pmb_addr + i);
+	release_firmware(fw);
+
+	reg = readw(mcucsr_base + MD32_EN_CFG);
+	writew(reg | MD32_EN, mcucsr_base + MD32_EN_CFG);
+	dev_dbg(dev, "Firmware loading/trigger ok.\n");
+
+	/* Setup LED */
+	phy_clear_bits_mmd(phydev, MDIO_MMD_VEND2, MTK_PHY_LED0_ON_CTRL,
+			   MTK_PHY_LED0_POLARITY);
+
+	phy_set_bits_mmd(phydev, MDIO_MMD_VEND2, MTK_PHY_LED0_ON_CTRL,
+			 MTK_PHY_LED0_ON_LINK10 |
+			 MTK_PHY_LED0_ON_LINK100 |
+			 MTK_PHY_LED0_ON_LINK1000 |
+			 MTK_PHY_LED0_ON_LINK2500);
+
+	phy_set_bits_mmd(phydev, MDIO_MMD_VEND2, MTK_PHY_LED1_ON_CTRL,
+			 MTK_PHY_LED1_ON_FDX | MTK_PHY_LED1_ON_HDX);
+
+	pinctrl = devm_pinctrl_get_select(&phydev->mdio.dev, "i2p5gbe-led");
+	if (IS_ERR(pinctrl)) {
+		dev_err(&phydev->mdio.dev, "Fail to set LED pins!\n");
+		return PTR_ERR(pinctrl);
+	}
+
+	return 0;
+}
+
+static int mt798x_2p5ge_phy_config_aneg(struct phy_device *phydev)
+{
+	bool changed = false;
+	u32 adv;
+	int ret;
+
+	if (phydev->autoneg == AUTONEG_DISABLE) {
+		/* Configure half duplex with genphy_setup_forced,
+		 * because genphy_c45_pma_setup_forced does not support.
+		 */
+		return phydev->duplex != DUPLEX_FULL
+			? genphy_setup_forced(phydev)
+			: genphy_c45_pma_setup_forced(phydev);
+	}
+
+	ret = genphy_c45_an_config_aneg(phydev);
+	if (ret < 0)
+		return ret;
+	if (ret > 0)
+		changed = true;
+
+	adv = linkmode_adv_to_mii_ctrl1000_t(phydev->advertising);
+	ret = phy_modify_changed(phydev, MII_CTRL1000,
+				 ADVERTISE_1000FULL | ADVERTISE_1000HALF,
+				 adv);
+	if (ret < 0)
+		return ret;
+	if (ret > 0)
+		changed = true;
+
+	return genphy_c45_check_and_restart_aneg(phydev, changed);
+}
+
+static int mt798x_2p5ge_phy_get_features(struct phy_device *phydev)
+{
+	int ret;
+
+	ret = genphy_read_abilities(phydev);
+	if (ret)
+		return ret;
+
+	/* We don't support HDX at MAC layer on mt798x.
+	 * So mask phy's HDX capabilities, too.
+	 */
+	linkmode_set_bit(ETHTOOL_LINK_MODE_10baseT_Full_BIT,
+			 phydev->supported);
+	linkmode_set_bit(ETHTOOL_LINK_MODE_100baseT_Full_BIT,
+			 phydev->supported);
+	linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseT_Full_BIT,
+			 phydev->supported);
+	linkmode_set_bit(ETHTOOL_LINK_MODE_2500baseT_Full_BIT,
+			 phydev->supported);
+	linkmode_set_bit(ETHTOOL_LINK_MODE_Autoneg_BIT, phydev->supported);
+
+	return 0;
+}
+
+static int mt798x_2p5ge_phy_read_status(struct phy_device *phydev)
+{
+	int ret;
+
+	ret = genphy_update_link(phydev);
+	if (ret)
+		return ret;
+
+	phydev->speed = SPEED_UNKNOWN;
+	phydev->duplex = DUPLEX_UNKNOWN;
+	phydev->pause = 0;
+	phydev->asym_pause = 0;
+
+	if (!phydev->link)
+		return 0;
+
+	if (phydev->autoneg == AUTONEG_ENABLE && phydev->autoneg_complete) {
+		ret = genphy_c45_read_lpa(phydev);
+		if (ret < 0)
+			return ret;
+
+		/* Read the link partner's 1G advertisement */
+		ret = phy_read(phydev, MII_STAT1000);
+		if (ret < 0)
+			return ret;
+		mii_stat1000_mod_linkmode_lpa_t(phydev->lp_advertising, ret);
+	} else if (phydev->autoneg == AUTONEG_DISABLE) {
+		linkmode_zero(phydev->lp_advertising);
+	}
+
+	ret = phy_read(phydev, PHY_AUX_CTRL_STATUS);
+	if (ret < 0)
+		return ret;
+
+	switch (FIELD_GET(PHY_AUX_SPEED_MASK, ret)) {
+	case PHY_AUX_SPD_10:
+		phydev->speed = SPEED_10;
+		break;
+	case PHY_AUX_SPD_100:
+		phydev->speed = SPEED_100;
+		break;
+	case PHY_AUX_SPD_1000:
+		phydev->speed = SPEED_1000;
+		break;
+	case PHY_AUX_SPD_2500:
+		phydev->speed = SPEED_2500;
+		phydev->duplex = DUPLEX_FULL; /* 2.5G must be FDX */
+		break;
+	}
+
+	ret = phy_read_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_LINK_STATUS_MISC);
+	if (ret < 0)
+		return ret;
+
+	phydev->duplex = (ret & MTK_PHY_FDX_ENABLE) ? DUPLEX_FULL : DUPLEX_HALF;
+
+	return 0;
+}
+
+static struct phy_driver mtk_gephy_driver[] = {
+	{
+		PHY_ID_MATCH_EXACT(0x00339c11),
+		.name		= "MediaTek MT798x 2.5GbE PHY",
+		.config_init	= mt798x_2p5ge_phy_config_init,
+		.config_aneg    = mt798x_2p5ge_phy_config_aneg,
+		.get_features	= mt798x_2p5ge_phy_get_features,
+		.read_status	= mt798x_2p5ge_phy_read_status,
+	},
+};
+
+module_phy_driver(mtk_gephy_driver);
+
+static struct mdio_device_id __maybe_unused mtk_2p5ge_phy_tbl[] = {
+	{ PHY_ID_MATCH_VENDOR(0x00339c00) },
+	{ }
+};
+
+MODULE_DESCRIPTION("MediaTek 2.5Gb Ethernet PHY driver");
+MODULE_AUTHOR("SkyLake Huang <SkyLake.Huang@mediatek.com>");
+MODULE_LICENSE("GPL");
+
+MODULE_DEVICE_TABLE(mdio, mtk_2p5ge_phy_tbl);
+MODULE_FIRMWARE(MEDAITEK_2P5GE_PHY_DMB_FW);
+MODULE_FIRMWARE(MEDIATEK_2P5GE_PHY_PMB_FW);
diff --git a/target/linux/mediatek/files-5.15/drivers/net/phy/mediatek-ge-soc.c b/target/linux/mediatek/files-5.15/drivers/net/phy/mediatek-ge-soc.c
new file mode 100644
index 00000000000000..e48502ac3fdd16
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/drivers/net/phy/mediatek-ge-soc.c
@@ -0,0 +1,1263 @@
+// SPDX-License-Identifier: GPL-2.0+
+#include <linux/bitfield.h>
+#include <linux/module.h>
+#include <linux/nvmem-consumer.h>
+#include <linux/of_address.h>
+#include <linux/of_platform.h>
+#include <linux/pinctrl/consumer.h>
+#include <linux/phy.h>
+
+#define MTK_GPHY_ID_MT7981			0x03a29461
+#define MTK_GPHY_ID_MT7988			0x03a29481
+
+#define MTK_EXT_PAGE_ACCESS			0x1f
+#define MTK_PHY_PAGE_STANDARD			0x0000
+#define MTK_PHY_PAGE_EXTENDED_3			0x0003
+
+#define MTK_PHY_LPI_REG_14			0x14
+#define MTK_PHY_LPI_WAKE_TIMER_1000_MASK	GENMASK(8, 0)
+
+#define MTK_PHY_LPI_REG_1c			0x1c
+#define MTK_PHY_SMI_DET_ON_THRESH_MASK		GENMASK(13, 8)
+
+#define MTK_PHY_PAGE_EXTENDED_2A30		0x2a30
+#define MTK_PHY_PAGE_EXTENDED_52B5		0x52b5
+
+#define ANALOG_INTERNAL_OPERATION_MAX_US	20
+#define TXRESERVE_MIN				0
+#define TXRESERVE_MAX				7
+
+#define MTK_PHY_ANARG_RG			0x10
+#define   MTK_PHY_TCLKOFFSET_MASK		GENMASK(12, 8)
+
+/* Registers on MDIO_MMD_VEND1 */
+#define MTK_PHY_TXVLD_DA_RG			0x12
+#define   MTK_PHY_DA_TX_I2MPB_A_GBE_MASK	GENMASK(15, 10)
+#define   MTK_PHY_DA_TX_I2MPB_A_TBT_MASK	GENMASK(5, 0)
+
+#define MTK_PHY_TX_I2MPB_TEST_MODE_A2		0x16
+#define   MTK_PHY_DA_TX_I2MPB_A_HBT_MASK	GENMASK(15, 10)
+#define   MTK_PHY_DA_TX_I2MPB_A_TST_MASK	GENMASK(5, 0)
+
+#define MTK_PHY_TX_I2MPB_TEST_MODE_B1		0x17
+#define   MTK_PHY_DA_TX_I2MPB_B_GBE_MASK	GENMASK(13, 8)
+#define   MTK_PHY_DA_TX_I2MPB_B_TBT_MASK	GENMASK(5, 0)
+
+#define MTK_PHY_TX_I2MPB_TEST_MODE_B2		0x18
+#define   MTK_PHY_DA_TX_I2MPB_B_HBT_MASK	GENMASK(13, 8)
+#define   MTK_PHY_DA_TX_I2MPB_B_TST_MASK	GENMASK(5, 0)
+
+#define MTK_PHY_TX_I2MPB_TEST_MODE_C1		0x19
+#define   MTK_PHY_DA_TX_I2MPB_C_GBE_MASK	GENMASK(13, 8)
+#define   MTK_PHY_DA_TX_I2MPB_C_TBT_MASK	GENMASK(5, 0)
+
+#define MTK_PHY_TX_I2MPB_TEST_MODE_C2		0x20
+#define   MTK_PHY_DA_TX_I2MPB_C_HBT_MASK	GENMASK(13, 8)
+#define   MTK_PHY_DA_TX_I2MPB_C_TST_MASK	GENMASK(5, 0)
+
+#define MTK_PHY_TX_I2MPB_TEST_MODE_D1		0x21
+#define   MTK_PHY_DA_TX_I2MPB_D_GBE_MASK	GENMASK(13, 8)
+#define   MTK_PHY_DA_TX_I2MPB_D_TBT_MASK	GENMASK(5, 0)
+
+#define MTK_PHY_TX_I2MPB_TEST_MODE_D2		0x22
+#define   MTK_PHY_DA_TX_I2MPB_D_HBT_MASK	GENMASK(13, 8)
+#define   MTK_PHY_DA_TX_I2MPB_D_TST_MASK	GENMASK(5, 0)
+
+#define MTK_PHY_RXADC_CTRL_RG7			0xc6
+#define   MTK_PHY_DA_AD_BUF_BIAS_LP_MASK	GENMASK(9, 8)
+
+#define MTK_PHY_RXADC_CTRL_RG9			0xc8
+#define   MTK_PHY_DA_RX_PSBN_TBT_MASK		GENMASK(14, 12)
+#define   MTK_PHY_DA_RX_PSBN_HBT_MASK		GENMASK(10, 8)
+#define   MTK_PHY_DA_RX_PSBN_GBE_MASK		GENMASK(6, 4)
+#define   MTK_PHY_DA_RX_PSBN_LP_MASK		GENMASK(2, 0)
+
+#define MTK_PHY_LDO_OUTPUT_V			0xd7
+
+#define MTK_PHY_RG_ANA_CAL_RG0			0xdb
+#define   MTK_PHY_RG_CAL_CKINV			BIT(12)
+#define   MTK_PHY_RG_ANA_CALEN			BIT(8)
+#define   MTK_PHY_RG_ZCALEN_A			BIT(0)
+
+#define MTK_PHY_RG_ANA_CAL_RG1			0xdc
+#define   MTK_PHY_RG_ZCALEN_B			BIT(12)
+#define   MTK_PHY_RG_ZCALEN_C			BIT(8)
+#define   MTK_PHY_RG_ZCALEN_D			BIT(4)
+#define   MTK_PHY_RG_TXVOS_CALEN		BIT(0)
+
+#define MTK_PHY_RG_ANA_CAL_RG5			0xe0
+#define   MTK_PHY_RG_REXT_TRIM_MASK		GENMASK(13, 8)
+
+#define MTK_PHY_RG_TX_FILTER			0xfe
+
+#define MTK_PHY_RG_LPI_PCS_DSP_CTRL_REG120	0x120
+#define   MTK_PHY_LPI_SIG_EN_LO_THRESH1000_MASK	GENMASK(12, 8)
+#define   MTK_PHY_LPI_SIG_EN_HI_THRESH1000_MASK	GENMASK(4, 0)
+
+#define MTK_PHY_RG_LPI_PCS_DSP_CTRL_REG122	0x122
+#define   MTK_PHY_LPI_NORM_MSE_HI_THRESH1000_MASK	GENMASK(7, 0)
+
+#define MTK_PHY_RG_TESTMUX_ADC_CTRL		0x144
+#define   MTK_PHY_RG_TXEN_DIG_MASK		GENMASK(5, 5)
+
+#define MTK_PHY_RG_CR_TX_AMP_OFFSET_A_B		0x172
+#define   MTK_PHY_CR_TX_AMP_OFFSET_A_MASK	GENMASK(13, 8)
+#define   MTK_PHY_CR_TX_AMP_OFFSET_B_MASK	GENMASK(6, 0)
+
+#define MTK_PHY_RG_CR_TX_AMP_OFFSET_C_D		0x173
+#define   MTK_PHY_CR_TX_AMP_OFFSET_C_MASK	GENMASK(13, 8)
+#define   MTK_PHY_CR_TX_AMP_OFFSET_D_MASK	GENMASK(6, 0)
+
+#define MTK_PHY_RG_AD_CAL_COMP			0x17a
+#define   MTK_PHY_AD_CAL_COMP_OUT_SHIFT		(8)
+
+#define MTK_PHY_RG_AD_CAL_CLK			0x17b
+#define   MTK_PHY_DA_CAL_CLK			BIT(0)
+
+#define MTK_PHY_RG_AD_CALIN			0x17c
+#define   MTK_PHY_DA_CALIN_FLAG			BIT(0)
+
+#define MTK_PHY_RG_DASN_DAC_IN0_A		0x17d
+#define   MTK_PHY_DASN_DAC_IN0_A_MASK		GENMASK(9, 0)
+
+#define MTK_PHY_RG_DASN_DAC_IN0_B		0x17e
+#define   MTK_PHY_DASN_DAC_IN0_B_MASK		GENMASK(9, 0)
+
+#define MTK_PHY_RG_DASN_DAC_IN0_C		0x17f
+#define   MTK_PHY_DASN_DAC_IN0_C_MASK		GENMASK(9, 0)
+
+#define MTK_PHY_RG_DASN_DAC_IN0_D		0x180
+#define   MTK_PHY_DASN_DAC_IN0_D_MASK		GENMASK(9, 0)
+
+#define MTK_PHY_RG_DASN_DAC_IN1_A		0x181
+#define   MTK_PHY_DASN_DAC_IN1_A_MASK		GENMASK(9, 0)
+
+#define MTK_PHY_RG_DASN_DAC_IN1_B		0x182
+#define   MTK_PHY_DASN_DAC_IN1_B_MASK		GENMASK(9, 0)
+
+#define MTK_PHY_RG_DASN_DAC_IN1_C		0x183
+#define   MTK_PHY_DASN_DAC_IN1_C_MASK		GENMASK(9, 0)
+
+#define MTK_PHY_RG_DASN_DAC_IN1_D		0x184
+#define   MTK_PHY_DASN_DAC_IN1_D_MASK		GENMASK(9, 0)
+
+#define MTK_PHY_RG_DEV1E_REG19b			0x19b
+#define   MTK_PHY_BYPASS_DSP_LPI_READY		BIT(8)
+
+#define MTK_PHY_RG_LP_IIR2_K1_L			0x22a
+#define MTK_PHY_RG_LP_IIR2_K1_U			0x22b
+#define MTK_PHY_RG_LP_IIR2_K2_L			0x22c
+#define MTK_PHY_RG_LP_IIR2_K2_U			0x22d
+#define MTK_PHY_RG_LP_IIR2_K3_L			0x22e
+#define MTK_PHY_RG_LP_IIR2_K3_U			0x22f
+#define MTK_PHY_RG_LP_IIR2_K4_L			0x230
+#define MTK_PHY_RG_LP_IIR2_K4_U			0x231
+#define MTK_PHY_RG_LP_IIR2_K5_L			0x232
+#define MTK_PHY_RG_LP_IIR2_K5_U			0x233
+
+#define MTK_PHY_RG_DEV1E_REG234			0x234
+#define   MTK_PHY_TR_OPEN_LOOP_EN_MASK		GENMASK(0, 0)
+#define   MTK_PHY_LPF_X_AVERAGE_MASK		GENMASK(7, 4)
+#define   MTK_PHY_TR_LP_IIR_EEE_EN		BIT(12)
+
+#define MTK_PHY_RG_LPF_CNT_VAL			0x235
+
+#define MTK_PHY_RG_DEV1E_REG238			0x238
+#define   MTK_PHY_LPI_SLV_SEND_TX_TIMER_MASK	GENMASK(8, 0)
+#define   MTK_PHY_LPI_SLV_SEND_TX_EN		BIT(12)
+
+#define MTK_PHY_RG_DEV1E_REG239			0x239
+#define   MTK_PHY_LPI_SEND_LOC_TIMER_MASK	GENMASK(8, 0)
+#define   MTK_PHY_LPI_TXPCS_LOC_RCV		BIT(12)
+
+#define MTK_PHY_RG_DEV1E_REG27C			0x27c
+#define   MTK_PHY_VGASTATE_FFE_THR_ST1_MASK	GENMASK(12, 8)
+#define MTK_PHY_RG_DEV1E_REG27D			0x27d
+#define   MTK_PHY_VGASTATE_FFE_THR_ST2_MASK	GENMASK(4, 0)
+
+#define MTK_PHY_RG_DEV1E_REG2C7			0x2c7
+#define   MTK_PHY_MAX_GAIN_MASK			GENMASK(4, 0)
+#define   MTK_PHY_MIN_GAIN_MASK			GENMASK(12, 8)
+
+#define MTK_PHY_RG_DEV1E_REG2D1			0x2d1
+#define   MTK_PHY_VCO_SLICER_THRESH_BITS_HIGH_EEE_MASK	GENMASK(7, 0)
+#define   MTK_PHY_LPI_SKIP_SD_SLV_TR		BIT(8)
+#define   MTK_PHY_LPI_TR_READY			BIT(9)
+#define   MTK_PHY_LPI_VCO_EEE_STG0_EN		BIT(10)
+
+#define MTK_PHY_RG_DEV1E_REG323			0x323
+#define   MTK_PHY_EEE_WAKE_MAS_INT_DC		BIT(0)
+#define   MTK_PHY_EEE_WAKE_SLV_INT_DC		BIT(4)
+
+#define MTK_PHY_RG_DEV1E_REG324			0x324
+#define   MTK_PHY_SMI_DETCNT_MAX_MASK		GENMASK(5, 0)
+#define   MTK_PHY_SMI_DET_MAX_EN		BIT(8)
+
+#define MTK_PHY_RG_DEV1E_REG326			0x326
+#define   MTK_PHY_LPI_MODE_SD_ON		BIT(0)
+#define   MTK_PHY_RESET_RANDUPD_CNT		BIT(1)
+#define   MTK_PHY_TREC_UPDATE_ENAB_CLR		BIT(2)
+#define   MTK_PHY_LPI_QUIT_WAIT_DFE_SIG_DET_OFF	BIT(4)
+#define   MTK_PHY_TR_READY_SKIP_AFE_WAKEUP	BIT(5)
+
+#define MTK_PHY_LDO_PUMP_EN_PAIRAB		0x502
+#define MTK_PHY_LDO_PUMP_EN_PAIRCD		0x503
+
+#define MTK_PHY_DA_TX_R50_PAIR_A		0x53d
+#define MTK_PHY_DA_TX_R50_PAIR_B		0x53e
+#define MTK_PHY_DA_TX_R50_PAIR_C		0x53f
+#define MTK_PHY_DA_TX_R50_PAIR_D		0x540
+
+/* Registers on MDIO_MMD_VEND2 */
+#define MTK_PHY_LED0_ON_CTRL			0x24
+#define   MTK_PHY_LED0_ON_MASK			GENMASK(6, 0)
+#define   MTK_PHY_LED0_ON_LINK1000		BIT(0)
+#define   MTK_PHY_LED0_ON_LINK100		BIT(1)
+#define   MTK_PHY_LED0_ON_LINK10		BIT(2)
+#define   MTK_PHY_LED0_ON_LINKDOWN		BIT(3)
+#define   MTK_PHY_LED0_ON_FDX			BIT(4) /* Full duplex */
+#define   MTK_PHY_LED0_ON_HDX			BIT(5) /* Half duplex */
+#define   MTK_PHY_LED0_FORCE_ON			BIT(6)
+#define   MTK_PHY_LED0_POLARITY			BIT(14)
+#define   MTK_PHY_LED0_ENABLE			BIT(15)
+
+#define MTK_PHY_LED0_BLINK_CTRL			0x25
+#define   MTK_PHY_LED0_1000TX			BIT(0)
+#define   MTK_PHY_LED0_1000RX			BIT(1)
+#define   MTK_PHY_LED0_100TX			BIT(2)
+#define   MTK_PHY_LED0_100RX			BIT(3)
+#define   MTK_PHY_LED0_10TX			BIT(4)
+#define   MTK_PHY_LED0_10RX			BIT(5)
+#define   MTK_PHY_LED0_COLLISION		BIT(6)
+#define   MTK_PHY_LED0_RX_CRC_ERR		BIT(7)
+#define   MTK_PHY_LED0_RX_IDLE_ERR		BIT(8)
+#define   MTK_PHY_LED0_FORCE_BLINK		BIT(9)
+
+#define MTK_PHY_LED1_ON_CTRL			0x26
+#define   MTK_PHY_LED1_ON_MASK			GENMASK(6, 0)
+#define   MTK_PHY_LED1_ON_LINK1000		BIT(0)
+#define   MTK_PHY_LED1_ON_LINK100		BIT(1)
+#define   MTK_PHY_LED1_ON_LINK10		BIT(2)
+#define   MTK_PHY_LED1_ON_LINKDOWN		BIT(3)
+#define   MTK_PHY_LED1_ON_FDX			BIT(4) /* Full duplex */
+#define   MTK_PHY_LED1_ON_HDX			BIT(5) /* Half duplex */
+#define   MTK_PHY_LED1_FORCE_ON			BIT(6)
+#define   MTK_PHY_LED1_POLARITY			BIT(14)
+#define   MTK_PHY_LED1_ENABLE			BIT(15)
+
+#define MTK_PHY_LED1_BLINK_CTRL			0x27
+#define   MTK_PHY_LED1_1000TX			BIT(0)
+#define   MTK_PHY_LED1_1000RX			BIT(1)
+#define   MTK_PHY_LED1_100TX			BIT(2)
+#define   MTK_PHY_LED1_100RX			BIT(3)
+#define   MTK_PHY_LED1_10TX			BIT(4)
+#define   MTK_PHY_LED1_10RX			BIT(5)
+#define   MTK_PHY_LED1_COLLISION		BIT(6)
+#define   MTK_PHY_LED1_RX_CRC_ERR		BIT(7)
+#define   MTK_PHY_LED1_RX_IDLE_ERR		BIT(8)
+#define   MTK_PHY_LED1_FORCE_BLINK		BIT(9)
+
+#define MTK_PHY_RG_BG_RASEL			0x115
+#define   MTK_PHY_RG_BG_RASEL_MASK		GENMASK(2, 0)
+
+/* These macro privides efuse parsing for internal phy. */
+#define EFS_DA_TX_I2MPB_A(x)			(((x) >> 0) & GENMASK(5, 0))
+#define EFS_DA_TX_I2MPB_B(x)			(((x) >> 6) & GENMASK(5, 0))
+#define EFS_DA_TX_I2MPB_C(x)			(((x) >> 12) & GENMASK(5, 0))
+#define EFS_DA_TX_I2MPB_D(x)			(((x) >> 18) & GENMASK(5, 0))
+#define EFS_DA_TX_AMP_OFFSET_A(x)		(((x) >> 24) & GENMASK(5, 0))
+
+#define EFS_DA_TX_AMP_OFFSET_B(x)		(((x) >> 0) & GENMASK(5, 0))
+#define EFS_DA_TX_AMP_OFFSET_C(x)		(((x) >> 6) & GENMASK(5, 0))
+#define EFS_DA_TX_AMP_OFFSET_D(x)		(((x) >> 12) & GENMASK(5, 0))
+#define EFS_DA_TX_R50_A(x)			(((x) >> 18) & GENMASK(5, 0))
+#define EFS_DA_TX_R50_B(x)			(((x) >> 24) & GENMASK(5, 0))
+
+#define EFS_DA_TX_R50_C(x)			(((x) >> 0) & GENMASK(5, 0))
+#define EFS_DA_TX_R50_D(x)			(((x) >> 6) & GENMASK(5, 0))
+
+#define EFS_RG_BG_RASEL(x)			(((x) >> 4) & GENMASK(2, 0))
+#define EFS_RG_REXT_TRIM(x)			(((x) >> 7) & GENMASK(5, 0))
+
+enum {
+	NO_PAIR,
+	PAIR_A,
+	PAIR_B,
+	PAIR_C,
+	PAIR_D,
+};
+
+enum {
+	GPHY_PORT0,
+	GPHY_PORT1,
+	GPHY_PORT2,
+	GPHY_PORT3,
+};
+
+enum calibration_mode {
+	EFUSE_K,
+	SW_K
+};
+
+enum CAL_ITEM {
+	REXT,
+	TX_OFFSET,
+	TX_AMP,
+	TX_R50,
+	TX_VCM
+};
+
+enum CAL_MODE {
+	EFUSE_M,
+	SW_M
+};
+
+struct mtk_socphy_shared_priv {
+	u32			boottrap;
+};
+
+static int mtk_socphy_read_page(struct phy_device *phydev)
+{
+	return __phy_read(phydev, MTK_EXT_PAGE_ACCESS);
+}
+
+static int mtk_socphy_write_page(struct phy_device *phydev, int page)
+{
+	return __phy_write(phydev, MTK_EXT_PAGE_ACCESS, page);
+}
+
+/* One calibration cycle consists of:
+ * 1.Set DA_CALIN_FLAG high to start calibration. Keep it high
+ *   until AD_CAL_COMP is ready to output calibration result.
+ * 2.Wait until DA_CAL_CLK is available.
+ * 3.Fetch AD_CAL_COMP_OUT.
+ */
+static int cal_cycle(struct phy_device *phydev, int devad,
+		     u32 regnum, u16 mask, u16 cal_val)
+{
+	int reg_val;
+	int ret;
+
+	phy_modify_mmd(phydev, devad, regnum,
+		       mask, cal_val);
+	phy_set_bits_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_AD_CALIN,
+			 MTK_PHY_DA_CALIN_FLAG);
+
+	ret = phy_read_mmd_poll_timeout(phydev, MDIO_MMD_VEND1,
+					MTK_PHY_RG_AD_CAL_CLK, reg_val,
+					reg_val & MTK_PHY_DA_CAL_CLK, 500,
+					ANALOG_INTERNAL_OPERATION_MAX_US, false);
+	if (ret) {
+		phydev_err(phydev, "Calibration cycle timeout\n");
+		return ret;
+	}
+
+	phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_AD_CALIN,
+			   MTK_PHY_DA_CALIN_FLAG);
+	ret = phy_read_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_AD_CAL_COMP) >>
+			   MTK_PHY_AD_CAL_COMP_OUT_SHIFT;
+	phydev_dbg(phydev, "cal_val: 0x%x, ret: %d\n", cal_val, ret);
+
+	return ret;
+}
+
+static int rext_fill_result(struct phy_device *phydev, u16 *buf)
+{
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_ANA_CAL_RG5,
+		       MTK_PHY_RG_REXT_TRIM_MASK, buf[0] << 8);
+	phy_modify_mmd(phydev, MDIO_MMD_VEND2, MTK_PHY_RG_BG_RASEL,
+		       MTK_PHY_RG_BG_RASEL_MASK, buf[1]);
+
+	return 0;
+}
+
+static int rext_cal_efuse(struct phy_device *phydev, u32 *buf)
+{
+	u16 rext_cal_val[2];
+
+	rext_cal_val[0] = EFS_RG_REXT_TRIM(buf[3]);
+	rext_cal_val[1] = EFS_RG_BG_RASEL(buf[3]);
+	rext_fill_result(phydev, rext_cal_val);
+
+	return 0;
+}
+
+static int tx_offset_fill_result(struct phy_device *phydev, u16 *buf)
+{
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_CR_TX_AMP_OFFSET_A_B,
+		       MTK_PHY_CR_TX_AMP_OFFSET_A_MASK, buf[0] << 8);
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_CR_TX_AMP_OFFSET_A_B,
+		       MTK_PHY_CR_TX_AMP_OFFSET_B_MASK, buf[1]);
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_CR_TX_AMP_OFFSET_C_D,
+		       MTK_PHY_CR_TX_AMP_OFFSET_C_MASK, buf[2] << 8);
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_CR_TX_AMP_OFFSET_C_D,
+		       MTK_PHY_CR_TX_AMP_OFFSET_D_MASK, buf[3]);
+
+	return 0;
+}
+
+static int tx_offset_cal_efuse(struct phy_device *phydev, u32 *buf)
+{
+	u16 tx_offset_cal_val[4];
+
+	tx_offset_cal_val[0] = EFS_DA_TX_AMP_OFFSET_A(buf[0]);
+	tx_offset_cal_val[1] = EFS_DA_TX_AMP_OFFSET_B(buf[1]);
+	tx_offset_cal_val[2] = EFS_DA_TX_AMP_OFFSET_C(buf[1]);
+	tx_offset_cal_val[3] = EFS_DA_TX_AMP_OFFSET_D(buf[1]);
+
+	tx_offset_fill_result(phydev, tx_offset_cal_val);
+
+	return 0;
+}
+
+static int tx_amp_fill_result(struct phy_device *phydev, u16 *buf)
+{
+	int i;
+	int bias[16] = {};
+	const int vals_9461[16] = { 7, 1, 4, 7,
+				    7, 1, 4, 7,
+				    7, 1, 4, 7,
+				    7, 1, 4, 7 };
+	const int vals_9481[16] = { 10, 6, 6, 10,
+				    10, 6, 6, 10,
+				    10, 6, 6, 10,
+				    10, 6, 6, 10 };
+	switch (phydev->drv->phy_id) {
+	case MTK_GPHY_ID_MT7981:
+		/* We add some calibration to efuse values
+		 * due to board level influence.
+		 * GBE: +7, TBT: +1, HBT: +4, TST: +7
+		 */
+		memcpy(bias, (const void *)vals_9461, sizeof(bias));
+		break;
+	case MTK_GPHY_ID_MT7988:
+		memcpy(bias, (const void *)vals_9481, sizeof(bias));
+		break;
+	}
+
+	/* Prevent overflow */
+	for (i = 0; i < 12; i++) {
+		if (buf[i >> 2] + bias[i] > 63) {
+			buf[i >> 2] = 63;
+			bias[i] = 0;
+		}
+	}
+
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_TXVLD_DA_RG,
+		       MTK_PHY_DA_TX_I2MPB_A_GBE_MASK, (buf[0] + bias[0]) << 10);
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_TXVLD_DA_RG,
+		       MTK_PHY_DA_TX_I2MPB_A_TBT_MASK, buf[0] + bias[1]);
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_TX_I2MPB_TEST_MODE_A2,
+		       MTK_PHY_DA_TX_I2MPB_A_HBT_MASK, (buf[0] + bias[2]) << 10);
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_TX_I2MPB_TEST_MODE_A2,
+		       MTK_PHY_DA_TX_I2MPB_A_TST_MASK, buf[0] + bias[3]);
+
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_TX_I2MPB_TEST_MODE_B1,
+		       MTK_PHY_DA_TX_I2MPB_B_GBE_MASK, (buf[1] + bias[4]) << 8);
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_TX_I2MPB_TEST_MODE_B1,
+		       MTK_PHY_DA_TX_I2MPB_B_TBT_MASK, buf[1] + bias[5]);
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_TX_I2MPB_TEST_MODE_B2,
+		       MTK_PHY_DA_TX_I2MPB_B_HBT_MASK, (buf[1] + bias[6]) << 8);
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_TX_I2MPB_TEST_MODE_B2,
+		       MTK_PHY_DA_TX_I2MPB_B_TST_MASK, buf[1] + bias[7]);
+
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_TX_I2MPB_TEST_MODE_C1,
+		       MTK_PHY_DA_TX_I2MPB_C_GBE_MASK, (buf[2] + bias[8]) << 8);
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_TX_I2MPB_TEST_MODE_C1,
+		       MTK_PHY_DA_TX_I2MPB_C_TBT_MASK, buf[2] + bias[9]);
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_TX_I2MPB_TEST_MODE_C2,
+		       MTK_PHY_DA_TX_I2MPB_C_HBT_MASK, (buf[2] + bias[10]) << 8);
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_TX_I2MPB_TEST_MODE_C2,
+		       MTK_PHY_DA_TX_I2MPB_C_TST_MASK, buf[2] + bias[11]);
+
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_TX_I2MPB_TEST_MODE_D1,
+		       MTK_PHY_DA_TX_I2MPB_D_GBE_MASK, (buf[3] + bias[12]) << 8);
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_TX_I2MPB_TEST_MODE_D1,
+		       MTK_PHY_DA_TX_I2MPB_D_TBT_MASK, buf[3] + bias[13]);
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_TX_I2MPB_TEST_MODE_D2,
+		       MTK_PHY_DA_TX_I2MPB_D_HBT_MASK, (buf[3] + bias[14]) << 8);
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_TX_I2MPB_TEST_MODE_D2,
+		       MTK_PHY_DA_TX_I2MPB_D_TST_MASK, buf[3] + bias[15]);
+
+	return 0;
+}
+
+static int tx_amp_cal_efuse(struct phy_device *phydev, u32 *buf)
+{
+	u16 tx_amp_cal_val[4];
+
+	tx_amp_cal_val[0] = EFS_DA_TX_I2MPB_A(buf[0]);
+	tx_amp_cal_val[1] = EFS_DA_TX_I2MPB_B(buf[0]);
+	tx_amp_cal_val[2] = EFS_DA_TX_I2MPB_C(buf[0]);
+	tx_amp_cal_val[3] = EFS_DA_TX_I2MPB_D(buf[0]);
+	tx_amp_fill_result(phydev, tx_amp_cal_val);
+
+	return 0;
+}
+
+static int tx_r50_fill_result(struct phy_device *phydev, u16 tx_r50_cal_val,
+			      u8 txg_calen_x)
+{
+	int bias = 0;
+	u16 reg, val;
+
+	if (phydev->drv->phy_id == MTK_GPHY_ID_MT7988)
+		bias = -2;
+
+	val = clamp_val(bias + tx_r50_cal_val, 0, 63);
+
+	switch (txg_calen_x) {
+	case PAIR_A:
+		reg = MTK_PHY_DA_TX_R50_PAIR_A;
+		break;
+	case PAIR_B:
+		reg = MTK_PHY_DA_TX_R50_PAIR_B;
+		break;
+	case PAIR_C:
+		reg = MTK_PHY_DA_TX_R50_PAIR_C;
+		break;
+	case PAIR_D:
+		reg = MTK_PHY_DA_TX_R50_PAIR_D;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	phy_write_mmd(phydev, MDIO_MMD_VEND1, reg, val | val << 8);
+
+	return 0;
+}
+
+static int tx_r50_cal_efuse(struct phy_device *phydev, u32 *buf,
+			    u8 txg_calen_x)
+{
+	u16 tx_r50_cal_val;
+
+	switch (txg_calen_x) {
+	case PAIR_A:
+		tx_r50_cal_val = EFS_DA_TX_R50_A(buf[1]);
+		break;
+	case PAIR_B:
+		tx_r50_cal_val = EFS_DA_TX_R50_B(buf[1]);
+		break;
+	case PAIR_C:
+		tx_r50_cal_val = EFS_DA_TX_R50_C(buf[2]);
+		break;
+	case PAIR_D:
+		tx_r50_cal_val = EFS_DA_TX_R50_D(buf[2]);
+		break;
+	default:
+		return -EINVAL;
+	}
+	tx_r50_fill_result(phydev, tx_r50_cal_val, txg_calen_x);
+
+	return 0;
+}
+
+static int tx_vcm_cal_sw(struct phy_device *phydev, u8 rg_txreserve_x)
+{
+	u8 lower_idx, upper_idx, txreserve_val;
+	u8 lower_ret, upper_ret;
+	int ret;
+
+	phy_set_bits_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_ANA_CAL_RG0,
+			 MTK_PHY_RG_ANA_CALEN);
+	phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_ANA_CAL_RG0,
+			   MTK_PHY_RG_CAL_CKINV);
+	phy_set_bits_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_ANA_CAL_RG1,
+			 MTK_PHY_RG_TXVOS_CALEN);
+
+	switch (rg_txreserve_x) {
+	case PAIR_A:
+		phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1,
+				   MTK_PHY_RG_DASN_DAC_IN0_A,
+				   MTK_PHY_DASN_DAC_IN0_A_MASK);
+		phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1,
+				   MTK_PHY_RG_DASN_DAC_IN1_A,
+				   MTK_PHY_DASN_DAC_IN1_A_MASK);
+		phy_set_bits_mmd(phydev, MDIO_MMD_VEND1,
+				 MTK_PHY_RG_ANA_CAL_RG0,
+				 MTK_PHY_RG_ZCALEN_A);
+		break;
+	case PAIR_B:
+		phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1,
+				   MTK_PHY_RG_DASN_DAC_IN0_B,
+				   MTK_PHY_DASN_DAC_IN0_B_MASK);
+		phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1,
+				   MTK_PHY_RG_DASN_DAC_IN1_B,
+				   MTK_PHY_DASN_DAC_IN1_B_MASK);
+		phy_set_bits_mmd(phydev, MDIO_MMD_VEND1,
+				 MTK_PHY_RG_ANA_CAL_RG1,
+				 MTK_PHY_RG_ZCALEN_B);
+		break;
+	case PAIR_C:
+		phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1,
+				   MTK_PHY_RG_DASN_DAC_IN0_C,
+				   MTK_PHY_DASN_DAC_IN0_C_MASK);
+		phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1,
+				   MTK_PHY_RG_DASN_DAC_IN1_C,
+				   MTK_PHY_DASN_DAC_IN1_C_MASK);
+		phy_set_bits_mmd(phydev, MDIO_MMD_VEND1,
+				 MTK_PHY_RG_ANA_CAL_RG1,
+				 MTK_PHY_RG_ZCALEN_C);
+		break;
+	case PAIR_D:
+		phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1,
+				   MTK_PHY_RG_DASN_DAC_IN0_D,
+				   MTK_PHY_DASN_DAC_IN0_D_MASK);
+		phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1,
+				   MTK_PHY_RG_DASN_DAC_IN1_D,
+				   MTK_PHY_DASN_DAC_IN1_D_MASK);
+		phy_set_bits_mmd(phydev, MDIO_MMD_VEND1,
+				 MTK_PHY_RG_ANA_CAL_RG1,
+				 MTK_PHY_RG_ZCALEN_D);
+		break;
+	default:
+		ret = -EINVAL;
+		goto restore;
+	}
+
+	lower_idx = TXRESERVE_MIN;
+	upper_idx = TXRESERVE_MAX;
+
+	phydev_dbg(phydev, "Start TX-VCM SW cal.\n");
+	while ((upper_idx - lower_idx) > 1) {
+		txreserve_val = DIV_ROUND_CLOSEST(lower_idx + upper_idx, 2);
+		ret = cal_cycle(phydev, MDIO_MMD_VEND1, MTK_PHY_RXADC_CTRL_RG9,
+				MTK_PHY_DA_RX_PSBN_TBT_MASK |
+				MTK_PHY_DA_RX_PSBN_HBT_MASK |
+				MTK_PHY_DA_RX_PSBN_GBE_MASK |
+				MTK_PHY_DA_RX_PSBN_LP_MASK,
+				txreserve_val << 12 | txreserve_val << 8 |
+				txreserve_val << 4 | txreserve_val);
+		if (ret == 1) {
+			upper_idx = txreserve_val;
+			upper_ret = ret;
+		} else if (ret == 0) {
+			lower_idx = txreserve_val;
+			lower_ret = ret;
+		} else {
+			goto restore;
+		}
+	}
+
+	if (lower_idx == TXRESERVE_MIN) {
+		lower_ret = cal_cycle(phydev, MDIO_MMD_VEND1,
+				      MTK_PHY_RXADC_CTRL_RG9,
+				      MTK_PHY_DA_RX_PSBN_TBT_MASK |
+				      MTK_PHY_DA_RX_PSBN_HBT_MASK |
+				      MTK_PHY_DA_RX_PSBN_GBE_MASK |
+				      MTK_PHY_DA_RX_PSBN_LP_MASK,
+				      lower_idx << 12 | lower_idx << 8 |
+				      lower_idx << 4 | lower_idx);
+		ret = lower_ret;
+	} else if (upper_idx == TXRESERVE_MAX) {
+		upper_ret = cal_cycle(phydev, MDIO_MMD_VEND1,
+				      MTK_PHY_RXADC_CTRL_RG9,
+				      MTK_PHY_DA_RX_PSBN_TBT_MASK |
+				      MTK_PHY_DA_RX_PSBN_HBT_MASK |
+				      MTK_PHY_DA_RX_PSBN_GBE_MASK |
+				      MTK_PHY_DA_RX_PSBN_LP_MASK,
+				      upper_idx << 12 | upper_idx << 8 |
+				      upper_idx << 4 | upper_idx);
+		ret = upper_ret;
+	}
+	if (ret < 0)
+		goto restore;
+
+	/* We calibrate TX-VCM in different logic. Check upper index and then
+	 * lower index. If this calibration is valid, apply lower index's result.
+	 */
+	ret = upper_ret - lower_ret;
+	if (ret == 1) {
+		ret = 0;
+		/* Make sure we use upper_idx in our calibration system */
+		cal_cycle(phydev, MDIO_MMD_VEND1, MTK_PHY_RXADC_CTRL_RG9,
+			  MTK_PHY_DA_RX_PSBN_TBT_MASK |
+			  MTK_PHY_DA_RX_PSBN_HBT_MASK |
+			  MTK_PHY_DA_RX_PSBN_GBE_MASK |
+			  MTK_PHY_DA_RX_PSBN_LP_MASK,
+			  upper_idx << 12 | upper_idx << 8 |
+			  upper_idx << 4 | upper_idx);
+		phydev_dbg(phydev, "TX-VCM SW cal result: 0x%x\n", upper_idx);
+	} else if (lower_idx == TXRESERVE_MIN && upper_ret == 1 &&
+		   lower_ret == 1) {
+		ret = 0;
+		cal_cycle(phydev, MDIO_MMD_VEND1, MTK_PHY_RXADC_CTRL_RG9,
+			  MTK_PHY_DA_RX_PSBN_TBT_MASK |
+			  MTK_PHY_DA_RX_PSBN_HBT_MASK |
+			  MTK_PHY_DA_RX_PSBN_GBE_MASK |
+			  MTK_PHY_DA_RX_PSBN_LP_MASK,
+			  lower_idx << 12 | lower_idx << 8 |
+			  lower_idx << 4 | lower_idx);
+		phydev_warn(phydev, "TX-VCM SW cal result at low margin 0x%x\n",
+			    lower_idx);
+	} else if (upper_idx == TXRESERVE_MAX && upper_ret == 0 &&
+		   lower_ret == 0) {
+		ret = 0;
+		phydev_warn(phydev, "TX-VCM SW cal result at high margin 0x%x\n",
+			    upper_idx);
+	} else {
+		ret = -EINVAL;
+	}
+
+restore:
+	phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_ANA_CAL_RG0,
+			   MTK_PHY_RG_ANA_CALEN);
+	phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_ANA_CAL_RG1,
+			   MTK_PHY_RG_TXVOS_CALEN);
+	phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_ANA_CAL_RG0,
+			   MTK_PHY_RG_ZCALEN_A);
+	phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_ANA_CAL_RG1,
+			   MTK_PHY_RG_ZCALEN_B | MTK_PHY_RG_ZCALEN_C |
+			   MTK_PHY_RG_ZCALEN_D);
+
+	return ret;
+}
+
+static void mt798x_phy_common_finetune(struct phy_device *phydev)
+{
+	phy_select_page(phydev, MTK_PHY_PAGE_EXTENDED_52B5);
+	/* EnabRandUpdTrig = 1 */
+	__phy_write(phydev, 0x11, 0x2f00);
+	__phy_write(phydev, 0x12, 0xe);
+	__phy_write(phydev, 0x10, 0x8fb0);
+
+	/* NormMseLoThresh = 85 */
+	__phy_write(phydev, 0x11, 0x55a0);
+	__phy_write(phydev, 0x12, 0x0);
+	__phy_write(phydev, 0x10, 0x83aa);
+
+	/* TrFreeze = 0 */
+	__phy_write(phydev, 0x11, 0x0);
+	__phy_write(phydev, 0x12, 0x0);
+	__phy_write(phydev, 0x10, 0x9686);
+
+	/* SSTrKp1000Slv = 5 */
+	__phy_write(phydev, 0x11, 0xbaef);
+	__phy_write(phydev, 0x12, 0x2e);
+	__phy_write(phydev, 0x10, 0x968c);
+
+	/* MrvlTrFix100Kp = 3, MrvlTrFix100Kf = 2,
+	 * MrvlTrFix1000Kp = 3, MrvlTrFix1000Kf = 2
+	 */
+	__phy_write(phydev, 0x11, 0xd10a);
+	__phy_write(phydev, 0x12, 0x34);
+	__phy_write(phydev, 0x10, 0x8f82);
+
+	/* VcoSlicerThreshBitsHigh */
+	__phy_write(phydev, 0x11, 0x5555);
+	__phy_write(phydev, 0x12, 0x55);
+	__phy_write(phydev, 0x10, 0x8ec0);
+	phy_restore_page(phydev, MTK_PHY_PAGE_STANDARD, 0);
+
+	/* TR_OPEN_LOOP_EN = 1, lpf_x_average = 9*/
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_DEV1E_REG234,
+		       MTK_PHY_TR_OPEN_LOOP_EN_MASK | MTK_PHY_LPF_X_AVERAGE_MASK,
+		       BIT(0) | FIELD_PREP(MTK_PHY_LPF_X_AVERAGE_MASK, 0x9));
+
+	/* rg_tr_lpf_cnt_val = 512 */
+	phy_write_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_LPF_CNT_VAL, 0x200);
+
+	/* IIR2 related */
+	phy_write_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_LP_IIR2_K1_L, 0x82);
+	phy_write_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_LP_IIR2_K1_U, 0x0);
+	phy_write_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_LP_IIR2_K2_L, 0x103);
+	phy_write_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_LP_IIR2_K2_U, 0x0);
+	phy_write_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_LP_IIR2_K3_L, 0x82);
+	phy_write_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_LP_IIR2_K3_U, 0x0);
+	phy_write_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_LP_IIR2_K4_L, 0xd177);
+	phy_write_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_LP_IIR2_K4_U, 0x3);
+	phy_write_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_LP_IIR2_K5_L, 0x2c82);
+	phy_write_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_LP_IIR2_K5_U, 0xe);
+
+	/* FFE peaking */
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_DEV1E_REG27C,
+		       MTK_PHY_VGASTATE_FFE_THR_ST1_MASK, 0x1b << 8);
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_DEV1E_REG27D,
+		       MTK_PHY_VGASTATE_FFE_THR_ST2_MASK, 0x1e);
+
+	/* Disable LDO pump */
+	phy_write_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_LDO_PUMP_EN_PAIRAB, 0x0);
+	phy_write_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_LDO_PUMP_EN_PAIRCD, 0x0);
+	/* Adjust LDO output voltage */
+	phy_write_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_LDO_OUTPUT_V, 0x2222);
+}
+
+static void mt7981_phy_finetune(struct phy_device *phydev)
+{
+	u16 val[8] = { 0x01ce, 0x01c1,
+		       0x020f, 0x0202,
+		       0x03d0, 0x03c0,
+		       0x0013, 0x0005 };
+	int i, k;
+
+	/* 100M eye finetune:
+	 * Keep middle level of TX MLT3 shapper as default.
+	 * Only change TX MLT3 overshoot level here.
+	 */
+	for (k = 0, i = 1; i < 12; i++) {
+		if (i % 3 == 0)
+			continue;
+		phy_write_mmd(phydev, MDIO_MMD_VEND1, i, val[k++]);
+	}
+
+	phy_select_page(phydev, MTK_PHY_PAGE_EXTENDED_52B5);
+	/* SlvDSPreadyTime = 24, MasDSPreadyTime = 24 */
+	__phy_write(phydev, 0x11, 0xc71);
+	__phy_write(phydev, 0x12, 0xc);
+	__phy_write(phydev, 0x10, 0x8fae);
+
+	/* ResetSyncOffset = 6 */
+	__phy_write(phydev, 0x11, 0x600);
+	__phy_write(phydev, 0x12, 0x0);
+	__phy_write(phydev, 0x10, 0x8fc0);
+
+	/* VgaDecRate = 1 */
+	__phy_write(phydev, 0x11, 0x4c2a);
+	__phy_write(phydev, 0x12, 0x3e);
+	__phy_write(phydev, 0x10, 0x8fa4);
+
+	/* FfeUpdGainForce = 4 */
+	__phy_write(phydev, 0x11, 0x240);
+	__phy_write(phydev, 0x12, 0x0);
+	__phy_write(phydev, 0x10, 0x9680);
+
+	phy_restore_page(phydev, MTK_PHY_PAGE_STANDARD, 0);
+}
+
+static void mt7988_phy_finetune(struct phy_device *phydev)
+{
+	u16 val[12] = { 0x0187, 0x01cd, 0x01c8, 0x0182,
+			0x020d, 0x0206, 0x0384, 0x03d0,
+			0x03c6, 0x030a, 0x0011, 0x0005 };
+	int i;
+
+	/* Set default MLT3 shaper first */
+	for (i = 0; i < 12; i++)
+		phy_write_mmd(phydev, MDIO_MMD_VEND1, i, val[i]);
+
+	/* TCT finetune */
+	phy_write_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_TX_FILTER, 0x5);
+
+	/* Disable TX power saving */
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RXADC_CTRL_RG7,
+		       MTK_PHY_DA_AD_BUF_BIAS_LP_MASK, 0x3 << 8);
+
+	phy_select_page(phydev, MTK_PHY_PAGE_EXTENDED_52B5);
+
+	/* SlvDSPreadyTime = 24, MasDSPreadyTime = 12 */
+	__phy_write(phydev, 0x11, 0x671);
+	__phy_write(phydev, 0x12, 0xc);
+	__phy_write(phydev, 0x10, 0x8fae);
+
+	/* ResetSyncOffset = 5 */
+	__phy_write(phydev, 0x11, 0x500);
+	__phy_write(phydev, 0x12, 0x0);
+	__phy_write(phydev, 0x10, 0x8fc0);
+
+	/* VgaDecRate is 1 at default on mt7988 */
+
+	phy_restore_page(phydev, MTK_PHY_PAGE_STANDARD, 0);
+
+	phy_select_page(phydev, MTK_PHY_PAGE_EXTENDED_2A30);
+	/* TxClkOffset = 2 */
+	__phy_modify(phydev, MTK_PHY_ANARG_RG, MTK_PHY_TCLKOFFSET_MASK,
+		     FIELD_PREP(MTK_PHY_TCLKOFFSET_MASK, 0x2));
+	phy_restore_page(phydev, MTK_PHY_PAGE_STANDARD, 0);
+}
+
+static void mt798x_phy_eee(struct phy_device *phydev)
+{
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1,
+		       MTK_PHY_RG_LPI_PCS_DSP_CTRL_REG120,
+		       MTK_PHY_LPI_SIG_EN_LO_THRESH1000_MASK |
+		       MTK_PHY_LPI_SIG_EN_HI_THRESH1000_MASK,
+		       FIELD_PREP(MTK_PHY_LPI_SIG_EN_LO_THRESH1000_MASK, 0x0) |
+		       FIELD_PREP(MTK_PHY_LPI_SIG_EN_HI_THRESH1000_MASK, 0x14));
+
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1,
+		       MTK_PHY_RG_LPI_PCS_DSP_CTRL_REG122,
+		       MTK_PHY_LPI_NORM_MSE_HI_THRESH1000_MASK,
+		       FIELD_PREP(MTK_PHY_LPI_NORM_MSE_HI_THRESH1000_MASK,
+				  0xff));
+
+	phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1,
+			   MTK_PHY_RG_TESTMUX_ADC_CTRL,
+			   MTK_PHY_RG_TXEN_DIG_MASK);
+
+	phy_set_bits_mmd(phydev, MDIO_MMD_VEND1,
+			 MTK_PHY_RG_DEV1E_REG19b, MTK_PHY_BYPASS_DSP_LPI_READY);
+
+	phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1,
+			   MTK_PHY_RG_DEV1E_REG234, MTK_PHY_TR_LP_IIR_EEE_EN);
+
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_DEV1E_REG238,
+		       MTK_PHY_LPI_SLV_SEND_TX_TIMER_MASK |
+		       MTK_PHY_LPI_SLV_SEND_TX_EN,
+		       FIELD_PREP(MTK_PHY_LPI_SLV_SEND_TX_TIMER_MASK, 0x120));
+
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_DEV1E_REG239,
+		       MTK_PHY_LPI_SEND_LOC_TIMER_MASK |
+		       MTK_PHY_LPI_TXPCS_LOC_RCV,
+		       FIELD_PREP(MTK_PHY_LPI_SEND_LOC_TIMER_MASK, 0x117));
+
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_DEV1E_REG2C7,
+		       MTK_PHY_MAX_GAIN_MASK | MTK_PHY_MIN_GAIN_MASK,
+		       FIELD_PREP(MTK_PHY_MAX_GAIN_MASK, 0x8) |
+		       FIELD_PREP(MTK_PHY_MIN_GAIN_MASK, 0x13));
+
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_DEV1E_REG2D1,
+		       MTK_PHY_VCO_SLICER_THRESH_BITS_HIGH_EEE_MASK,
+		       FIELD_PREP(MTK_PHY_VCO_SLICER_THRESH_BITS_HIGH_EEE_MASK,
+				  0x33) |
+		       MTK_PHY_LPI_SKIP_SD_SLV_TR | MTK_PHY_LPI_TR_READY |
+		       MTK_PHY_LPI_VCO_EEE_STG0_EN);
+
+	phy_set_bits_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_DEV1E_REG323,
+			 MTK_PHY_EEE_WAKE_MAS_INT_DC |
+			 MTK_PHY_EEE_WAKE_SLV_INT_DC);
+
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_DEV1E_REG324,
+		       MTK_PHY_SMI_DETCNT_MAX_MASK,
+		       FIELD_PREP(MTK_PHY_SMI_DETCNT_MAX_MASK, 0x3f) |
+		       MTK_PHY_SMI_DET_MAX_EN);
+
+	phy_set_bits_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_DEV1E_REG326,
+			 MTK_PHY_LPI_MODE_SD_ON | MTK_PHY_RESET_RANDUPD_CNT |
+			 MTK_PHY_TREC_UPDATE_ENAB_CLR |
+			 MTK_PHY_LPI_QUIT_WAIT_DFE_SIG_DET_OFF |
+			 MTK_PHY_TR_READY_SKIP_AFE_WAKEUP);
+
+	phy_select_page(phydev, MTK_PHY_PAGE_EXTENDED_52B5);
+	/* Regsigdet_sel_1000 = 0 */
+	__phy_write(phydev, 0x11, 0xb);
+	__phy_write(phydev, 0x12, 0x0);
+	__phy_write(phydev, 0x10, 0x9690);
+
+	/* REG_EEE_st2TrKf1000 = 3 */
+	__phy_write(phydev, 0x11, 0x114f);
+	__phy_write(phydev, 0x12, 0x2);
+	__phy_write(phydev, 0x10, 0x969a);
+
+	/* RegEEE_slv_wake_tr_timer_tar = 6, RegEEE_slv_remtx_timer_tar = 20 */
+	__phy_write(phydev, 0x11, 0x3028);
+	__phy_write(phydev, 0x12, 0x0);
+	__phy_write(phydev, 0x10, 0x969e);
+
+	/* RegEEE_slv_wake_int_timer_tar = 8 */
+	__phy_write(phydev, 0x11, 0x5010);
+	__phy_write(phydev, 0x12, 0x0);
+	__phy_write(phydev, 0x10, 0x96a0);
+
+	/* RegEEE_trfreeze_timer2 = 586 */
+	__phy_write(phydev, 0x11, 0x24a);
+	__phy_write(phydev, 0x12, 0x0);
+	__phy_write(phydev, 0x10, 0x96a8);
+
+	/* RegEEE100Stg1_tar = 16 */
+	__phy_write(phydev, 0x11, 0x3210);
+	__phy_write(phydev, 0x12, 0x0);
+	__phy_write(phydev, 0x10, 0x96b8);
+
+	/* REGEEE_wake_slv_tr_wait_dfesigdet_en = 1 */
+	__phy_write(phydev, 0x11, 0x1463);
+	__phy_write(phydev, 0x12, 0x0);
+	__phy_write(phydev, 0x10, 0x96ca);
+
+	/* DfeTailEnableVgaThresh1000 = 27 */
+	__phy_write(phydev, 0x11, 0x36);
+	__phy_write(phydev, 0x12, 0x0);
+	__phy_write(phydev, 0x10, 0x8f80);
+	phy_restore_page(phydev, MTK_PHY_PAGE_STANDARD, 0);
+
+	phy_select_page(phydev, MTK_PHY_PAGE_EXTENDED_3);
+	__phy_modify(phydev, MTK_PHY_LPI_REG_14, MTK_PHY_LPI_WAKE_TIMER_1000_MASK,
+		     FIELD_PREP(MTK_PHY_LPI_WAKE_TIMER_1000_MASK, 0x19c));
+
+	__phy_modify(phydev, MTK_PHY_LPI_REG_1c, MTK_PHY_SMI_DET_ON_THRESH_MASK,
+		     FIELD_PREP(MTK_PHY_SMI_DET_ON_THRESH_MASK, 0xc));
+	phy_restore_page(phydev, MTK_PHY_PAGE_STANDARD, 0);
+
+	phy_modify_mmd(phydev, MDIO_MMD_VEND1,
+		       MTK_PHY_RG_LPI_PCS_DSP_CTRL_REG122,
+		       MTK_PHY_LPI_NORM_MSE_HI_THRESH1000_MASK,
+		       FIELD_PREP(MTK_PHY_LPI_NORM_MSE_HI_THRESH1000_MASK, 0xff));
+}
+
+static int cal_sw(struct phy_device *phydev, enum CAL_ITEM cal_item,
+		  u8 start_pair, u8 end_pair)
+{
+	u8 pair_n;
+	int ret;
+
+	for (pair_n = start_pair; pair_n <= end_pair; pair_n++) {
+		/* TX_OFFSET & TX_AMP have no SW calibration. */
+		switch (cal_item) {
+		case TX_VCM:
+			ret = tx_vcm_cal_sw(phydev, pair_n);
+			break;
+		default:
+			return -EINVAL;
+		}
+		if (ret)
+			return ret;
+	}
+	return 0;
+}
+
+static int cal_efuse(struct phy_device *phydev, enum CAL_ITEM cal_item,
+		     u8 start_pair, u8 end_pair, u32 *buf)
+{
+	u8 pair_n;
+	int ret;
+
+	for (pair_n = start_pair; pair_n <= end_pair; pair_n++) {
+		/* TX_VCM has no efuse calibration. */
+		switch (cal_item) {
+		case REXT:
+			ret = rext_cal_efuse(phydev, buf);
+			break;
+		case TX_OFFSET:
+			ret = tx_offset_cal_efuse(phydev, buf);
+			break;
+		case TX_AMP:
+			ret = tx_amp_cal_efuse(phydev, buf);
+			break;
+		case TX_R50:
+			ret = tx_r50_cal_efuse(phydev, buf, pair_n);
+			break;
+		default:
+			return -EINVAL;
+		}
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+static int start_cal(struct phy_device *phydev, enum CAL_ITEM cal_item,
+		     enum CAL_MODE cal_mode, u8 start_pair,
+		     u8 end_pair, u32 *buf)
+{
+	int ret;
+
+	switch (cal_mode) {
+	case EFUSE_M:
+		ret = cal_efuse(phydev, cal_item, start_pair,
+				end_pair, buf);
+		break;
+	case SW_M:
+		ret = cal_sw(phydev, cal_item, start_pair, end_pair);
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	if (ret) {
+		phydev_err(phydev, "cal %d failed\n", cal_item);
+		return -EIO;
+	}
+
+	return 0;
+}
+
+static int mt798x_phy_calibration(struct phy_device *phydev)
+{
+	int ret = 0;
+	u32 *buf;
+	size_t len;
+	struct nvmem_cell *cell;
+
+	cell = nvmem_cell_get(&phydev->mdio.dev, "phy-cal-data");
+	if (IS_ERR(cell)) {
+		if (PTR_ERR(cell) == -EPROBE_DEFER)
+			return PTR_ERR(cell);
+		return 0;
+	}
+
+	buf = (u32 *)nvmem_cell_read(cell, &len);
+	if (IS_ERR(buf))
+		return PTR_ERR(buf);
+	nvmem_cell_put(cell);
+
+	if (!buf[0] || !buf[1] || !buf[2] || !buf[3] || len < 4 * sizeof(u32)) {
+		phydev_err(phydev, "invalid efuse data\n");
+		ret = -EINVAL;
+		goto out;
+	}
+
+	ret = start_cal(phydev, REXT, EFUSE_M, NO_PAIR, NO_PAIR, buf);
+	if (ret)
+		goto out;
+	ret = start_cal(phydev, TX_OFFSET, EFUSE_M, NO_PAIR, NO_PAIR, buf);
+	if (ret)
+		goto out;
+	ret = start_cal(phydev, TX_AMP, EFUSE_M, NO_PAIR, NO_PAIR, buf);
+	if (ret)
+		goto out;
+	ret = start_cal(phydev, TX_R50, EFUSE_M, PAIR_A, PAIR_D, buf);
+	if (ret)
+		goto out;
+	ret = start_cal(phydev, TX_VCM, SW_M, PAIR_A, PAIR_A, buf);
+	if (ret)
+		goto out;
+
+out:
+	kfree(buf);
+	return ret;
+}
+
+static int mt798x_phy_config_init(struct phy_device *phydev)
+{
+	switch (phydev->drv->phy_id) {
+	case MTK_GPHY_ID_MT7981:
+		mt7981_phy_finetune(phydev);
+		break;
+	case MTK_GPHY_ID_MT7988:
+		mt7988_phy_finetune(phydev);
+		break;
+	}
+
+	mt798x_phy_common_finetune(phydev);
+	mt798x_phy_eee(phydev);
+
+	return mt798x_phy_calibration(phydev);
+}
+
+static int mt7988_phy_setup_led(struct phy_device *phydev)
+{
+	struct mtk_socphy_shared_priv *priv = phydev->shared->priv;
+	int port = phydev->mdio.addr;
+	u32 reg = priv->boottrap;
+	struct pinctrl *pinctrl;
+
+	phy_write_mmd(phydev, MDIO_MMD_VEND2, MTK_PHY_LED0_ON_CTRL,
+		      MTK_PHY_LED0_ENABLE | MTK_PHY_LED0_POLARITY |
+		      MTK_PHY_LED0_ON_LINK10 |
+		      MTK_PHY_LED0_ON_LINK100 |
+		      MTK_PHY_LED0_ON_LINK1000);
+	phy_write_mmd(phydev, MDIO_MMD_VEND2, MTK_PHY_LED1_ON_CTRL,
+		      MTK_PHY_LED1_ENABLE | MTK_PHY_LED1_POLARITY |
+		      MTK_PHY_LED1_ON_LINK10 |
+		      MTK_PHY_LED1_ON_LINK100 |
+		      MTK_PHY_LED1_ON_LINK1000);
+
+	if ((port == GPHY_PORT0 && reg & BIT(8)) ||
+	    (port == GPHY_PORT1 && reg & BIT(9)) ||
+	    (port == GPHY_PORT2 && reg & BIT(10)) ||
+	    (port == GPHY_PORT3 && reg & BIT(11))) {
+		phy_clear_bits_mmd(phydev, MDIO_MMD_VEND2, MTK_PHY_LED0_ON_CTRL,
+				   MTK_PHY_LED0_POLARITY);
+		phy_clear_bits_mmd(phydev, MDIO_MMD_VEND2, MTK_PHY_LED1_ON_CTRL,
+				   MTK_PHY_LED1_POLARITY);
+	}
+
+	phy_write_mmd(phydev, MDIO_MMD_VEND2, MTK_PHY_LED0_BLINK_CTRL,
+		      MTK_PHY_LED0_1000TX | MTK_PHY_LED0_1000RX |
+		      MTK_PHY_LED0_100TX  | MTK_PHY_LED0_100RX  |
+		      MTK_PHY_LED0_10TX   | MTK_PHY_LED0_10RX);
+	phy_write_mmd(phydev, MDIO_MMD_VEND2, MTK_PHY_LED1_BLINK_CTRL,
+		      MTK_PHY_LED1_1000TX | MTK_PHY_LED1_1000RX |
+		      MTK_PHY_LED1_100TX  | MTK_PHY_LED1_100RX  |
+		      MTK_PHY_LED1_10TX   | MTK_PHY_LED1_10RX);
+
+	pinctrl = devm_pinctrl_get_select(&phydev->mdio.dev, "gbe-led");
+	if (IS_ERR(pinctrl)) {
+		dev_err(&phydev->mdio.bus->dev, "Failed to setup LED pins\n");
+		return PTR_ERR(pinctrl);
+	}
+
+	return 0;
+}
+
+static int mt7988_phy_probe_shared(struct phy_device *phydev)
+{
+	struct mtk_socphy_shared_priv *priv = phydev->shared->priv;
+	void __iomem *boottrap;
+	struct device_node *np;
+	u32 reg;
+
+	np = of_find_compatible_node(NULL, NULL, "mediatek,boottrap");
+	if (!np)
+		return -ENOENT;
+
+	boottrap = of_iomap(np, 0);
+	if (!boottrap)
+		return -ENOMEM;
+
+	reg = readl(boottrap);
+	iounmap(boottrap);
+
+	priv->boottrap = reg;
+
+	return 0;
+}
+
+static int mt7981_phy_probe(struct phy_device *phydev)
+{
+	return mt798x_phy_calibration(phydev);
+}
+
+static int mt7988_phy_probe(struct phy_device *phydev)
+{
+	int err;
+
+	err = devm_phy_package_join(&phydev->mdio.dev, phydev, 0,
+				    sizeof(struct mtk_socphy_shared_priv));
+	if (err)
+		return err;
+
+	if (phy_package_probe_once(phydev)) {
+		err = mt7988_phy_probe_shared(phydev);
+		if (err)
+			return err;
+	}
+
+	mt7988_phy_setup_led(phydev);
+
+	return mt798x_phy_calibration(phydev);
+}
+
+static struct phy_driver mtk_socphy_driver[] = {
+	{
+		PHY_ID_MATCH_EXACT(MTK_GPHY_ID_MT7981),
+		.name		= "MediaTek MT7981 PHY",
+		.config_init	= mt798x_phy_config_init,
+		.config_intr	= genphy_no_config_intr,
+		.handle_interrupt = genphy_handle_interrupt_no_ack,
+		.probe		= mt7981_phy_probe,
+		.suspend	= genphy_suspend,
+		.resume		= genphy_resume,
+		.read_page	= mtk_socphy_read_page,
+		.write_page	= mtk_socphy_write_page,
+	},
+	{
+		PHY_ID_MATCH_EXACT(MTK_GPHY_ID_MT7988),
+		.name		= "MediaTek MT7988 PHY",
+		.config_init	= mt798x_phy_config_init,
+		.config_intr	= genphy_no_config_intr,
+		.handle_interrupt = genphy_handle_interrupt_no_ack,
+		.probe		= mt7988_phy_probe,
+		.suspend	= genphy_suspend,
+		.resume		= genphy_resume,
+		.read_page	= mtk_socphy_read_page,
+		.write_page	= mtk_socphy_write_page,
+	},
+};
+
+module_phy_driver(mtk_socphy_driver);
+
+static struct mdio_device_id __maybe_unused mtk_socphy_tbl[] = {
+	{ PHY_ID_MATCH_EXACT(MTK_GPHY_ID_MT7981) },
+	{ PHY_ID_MATCH_EXACT(MTK_GPHY_ID_MT7988) },
+	{ }
+};
+
+MODULE_DESCRIPTION("MediaTek SoC Gigabit Ethernet PHY driver");
+MODULE_AUTHOR("Daniel Golle <daniel@makrotopia.org>");
+MODULE_AUTHOR("SkyLake Huang <SkyLake.Huang@mediatek.com>");
+MODULE_LICENSE("GPL");
+
+MODULE_DEVICE_TABLE(mdio, mtk_socphy_tbl);
diff --git a/target/linux/mediatek/files-5.15/drivers/pinctrl/mediatek/pinctrl-mt7981.c b/target/linux/mediatek/files-5.15/drivers/pinctrl/mediatek/pinctrl-mt7981.c
new file mode 100644
index 00000000000000..18abc57800111a
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/drivers/pinctrl/mediatek/pinctrl-mt7981.c
@@ -0,0 +1,1048 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * The MT7981 driver based on Linux generic pinctrl binding.
+ *
+ * Copyright (C) 2020 MediaTek Inc.
+ * Author: Sam Shih <sam.shih@mediatek.com>
+ */
+
+#include "pinctrl-moore.h"
+
+#define MT7981_PIN(_number, _name)				\
+	MTK_PIN(_number, _name, 0, _number, DRV_GRP4)
+
+#define PIN_FIELD_BASE(_s_pin, _e_pin, _i_base, _s_addr, _x_addrs, _s_bit, _x_bits)	\
+	PIN_FIELD_CALC(_s_pin, _e_pin, _i_base, _s_addr, _x_addrs, _s_bit,	\
+		       _x_bits, 32, 0)
+
+#define PINS_FIELD_BASE(_s_pin, _e_pin, _i_base, _s_addr, _x_addrs, _s_bit, _x_bits)	\
+	PIN_FIELD_CALC(_s_pin, _e_pin, _i_base, _s_addr, _x_addrs, _s_bit,	\
+		      _x_bits, 32, 1)
+
+static const struct mtk_pin_field_calc mt7981_pin_mode_range[] = {
+	PIN_FIELD(0, 56, 0x300, 0x10, 0, 4),
+};
+
+static const struct mtk_pin_field_calc mt7981_pin_dir_range[] = {
+	PIN_FIELD(0, 56, 0x0, 0x10, 0, 1),
+};
+
+static const struct mtk_pin_field_calc mt7981_pin_di_range[] = {
+	PIN_FIELD(0, 56, 0x200, 0x10, 0, 1),
+};
+
+static const struct mtk_pin_field_calc mt7981_pin_do_range[] = {
+	PIN_FIELD(0, 56, 0x100, 0x10, 0, 1),
+};
+
+static const struct mtk_pin_field_calc mt7981_pin_ies_range[] = {
+	PIN_FIELD_BASE(0, 0, 1, 0x10, 0x10, 1, 1),
+	PIN_FIELD_BASE(1, 1, 1, 0x10, 0x10, 0, 1),
+	PIN_FIELD_BASE(2, 2, 5, 0x20, 0x10, 6, 1),
+	PIN_FIELD_BASE(3, 3, 4, 0x20, 0x10, 6, 1),
+	PIN_FIELD_BASE(4, 4, 4, 0x20, 0x10, 2, 1),
+	PIN_FIELD_BASE(5, 5, 4, 0x20, 0x10, 1, 1),
+	PIN_FIELD_BASE(6, 6, 4, 0x20, 0x10, 3, 1),
+	PIN_FIELD_BASE(7, 7, 4, 0x20, 0x10, 0, 1),
+	PIN_FIELD_BASE(8, 8, 4, 0x20, 0x10, 4, 1),
+
+	PIN_FIELD_BASE(9, 9, 5, 0x20, 0x10, 9, 1),
+	PIN_FIELD_BASE(10, 10, 5, 0x20, 0x10, 8, 1),
+	PIN_FIELD_BASE(11, 11, 5, 0x40, 0x10, 10, 1),
+	PIN_FIELD_BASE(12, 12, 5, 0x20, 0x10, 7, 1),
+	PIN_FIELD_BASE(13, 13, 5, 0x20, 0x10, 11, 1),
+
+	PIN_FIELD_BASE(14, 14, 4, 0x20, 0x10, 8, 1),
+
+	PIN_FIELD_BASE(15, 15, 2, 0x20, 0x10, 0, 1),
+	PIN_FIELD_BASE(16, 16, 2, 0x20, 0x10, 1, 1),
+	PIN_FIELD_BASE(17, 17, 2, 0x20, 0x10, 5, 1),
+	PIN_FIELD_BASE(18, 18, 2, 0x20, 0x10, 4, 1),
+	PIN_FIELD_BASE(19, 19, 2, 0x20, 0x10, 2, 1),
+	PIN_FIELD_BASE(20, 20, 2, 0x20, 0x10, 3, 1),
+	PIN_FIELD_BASE(21, 21, 2, 0x20, 0x10, 6, 1),
+	PIN_FIELD_BASE(22, 22, 2, 0x20, 0x10, 7, 1),
+	PIN_FIELD_BASE(23, 23, 2, 0x20, 0x10, 10, 1),
+	PIN_FIELD_BASE(24, 24, 2, 0x20, 0x10, 9, 1),
+	PIN_FIELD_BASE(25, 25, 2, 0x20, 0x10, 8, 1),
+
+	PIN_FIELD_BASE(26, 26, 5, 0x20, 0x10, 0, 1),
+	PIN_FIELD_BASE(27, 27, 5, 0x20, 0x10, 4, 1),
+	PIN_FIELD_BASE(28, 28, 5, 0x20, 0x10, 3, 1),
+	PIN_FIELD_BASE(29, 29, 5, 0x20, 0x10, 1, 1),
+	PIN_FIELD_BASE(30, 30, 5, 0x20, 0x10, 2, 1),
+	PIN_FIELD_BASE(31, 31, 5, 0x20, 0x10, 5, 1),
+
+	PIN_FIELD_BASE(32, 32, 1, 0x10, 0x10, 2, 1),
+	PIN_FIELD_BASE(33, 33, 1, 0x10, 0x10, 3, 1),
+
+	PIN_FIELD_BASE(34, 34, 4, 0x20, 0x10, 5, 1),
+	PIN_FIELD_BASE(35, 35, 4, 0x20, 0x10, 7, 1),
+
+	PIN_FIELD_BASE(36, 36, 3, 0x10, 0x10, 2, 1),
+	PIN_FIELD_BASE(37, 37, 3, 0x10, 0x10, 3, 1),
+	PIN_FIELD_BASE(38, 38, 3, 0x10, 0x10, 0, 1),
+	PIN_FIELD_BASE(39, 39, 3, 0x10, 0x10, 1, 1),
+
+	PIN_FIELD_BASE(40, 40, 7, 0x30, 0x10, 1, 1),
+	PIN_FIELD_BASE(41, 41, 7, 0x30, 0x10, 0, 1),
+	PIN_FIELD_BASE(42, 42, 7, 0x30, 0x10, 9, 1),
+	PIN_FIELD_BASE(43, 43, 7, 0x30, 0x10, 7, 1),
+	PIN_FIELD_BASE(44, 44, 7, 0x30, 0x10, 8, 1),
+	PIN_FIELD_BASE(45, 45, 7, 0x30, 0x10, 3, 1),
+	PIN_FIELD_BASE(46, 46, 7, 0x30, 0x10, 4, 1),
+	PIN_FIELD_BASE(47, 47, 7, 0x30, 0x10, 5, 1),
+	PIN_FIELD_BASE(48, 48, 7, 0x30, 0x10, 6, 1),
+	PIN_FIELD_BASE(49, 49, 7, 0x30, 0x10, 2, 1),
+
+	PIN_FIELD_BASE(50, 50, 6, 0x10, 0x10, 0, 1),
+	PIN_FIELD_BASE(51, 51, 6, 0x10, 0x10, 2, 1),
+	PIN_FIELD_BASE(52, 52, 6, 0x10, 0x10, 3, 1),
+	PIN_FIELD_BASE(53, 53, 6, 0x10, 0x10, 4, 1),
+	PIN_FIELD_BASE(54, 54, 6, 0x10, 0x10, 5, 1),
+	PIN_FIELD_BASE(55, 55, 6, 0x10, 0x10, 6, 1),
+	PIN_FIELD_BASE(56, 56, 6, 0x10, 0x10, 1, 1),
+};
+
+static const struct mtk_pin_field_calc mt7981_pin_smt_range[] = {
+	PIN_FIELD_BASE(0, 0, 1, 0x60, 0x10, 1, 1),
+	PIN_FIELD_BASE(1, 1, 1, 0x60, 0x10, 0, 1),
+	PIN_FIELD_BASE(2, 2, 5, 0x90, 0x10, 6, 1),
+	PIN_FIELD_BASE(3, 3, 4, 0x80, 0x10, 6, 1),
+	PIN_FIELD_BASE(4, 4, 4, 0x80, 0x10, 2, 1),
+	PIN_FIELD_BASE(5, 5, 4, 0x80, 0x10, 1, 1),
+	PIN_FIELD_BASE(6, 6, 4, 0x80, 0x10, 3, 1),
+	PIN_FIELD_BASE(7, 7, 4, 0x80, 0x10, 0, 1),
+	PIN_FIELD_BASE(8, 8, 4, 0x80, 0x10, 4, 1),
+
+	PIN_FIELD_BASE(9, 9, 5, 0x90, 0x10, 9, 1),
+	PIN_FIELD_BASE(10, 10, 5, 0x90, 0x10, 8, 1),
+	PIN_FIELD_BASE(11, 11, 5, 0x90, 0x10, 10, 1),
+	PIN_FIELD_BASE(12, 12, 5, 0x90, 0x10, 7, 1),
+	PIN_FIELD_BASE(13, 13, 5, 0x90, 0x10, 11, 1),
+
+	PIN_FIELD_BASE(14, 14, 4, 0x80, 0x10, 8, 1),
+
+	PIN_FIELD_BASE(15, 15, 2, 0x90, 0x10, 0, 1),
+	PIN_FIELD_BASE(16, 16, 2, 0x90, 0x10, 1, 1),
+	PIN_FIELD_BASE(17, 17, 2, 0x90, 0x10, 5, 1),
+	PIN_FIELD_BASE(18, 18, 2, 0x90, 0x10, 4, 1),
+	PIN_FIELD_BASE(19, 19, 2, 0x90, 0x10, 2, 1),
+	PIN_FIELD_BASE(20, 20, 2, 0x90, 0x10, 3, 1),
+	PIN_FIELD_BASE(21, 21, 2, 0x90, 0x10, 6, 1),
+	PIN_FIELD_BASE(22, 22, 2, 0x90, 0x10, 7, 1),
+	PIN_FIELD_BASE(23, 23, 2, 0x90, 0x10, 10, 1),
+	PIN_FIELD_BASE(24, 24, 2, 0x90, 0x10, 9, 1),
+	PIN_FIELD_BASE(25, 25, 2, 0x90, 0x10, 8, 1),
+
+	PIN_FIELD_BASE(26, 26, 5, 0x90, 0x10, 0, 1),
+	PIN_FIELD_BASE(27, 27, 5, 0x90, 0x10, 4, 1),
+	PIN_FIELD_BASE(28, 28, 5, 0x90, 0x10, 3, 1),
+	PIN_FIELD_BASE(29, 29, 5, 0x90, 0x10, 1, 1),
+	PIN_FIELD_BASE(30, 30, 5, 0x90, 0x10, 2, 1),
+	PIN_FIELD_BASE(31, 31, 5, 0x90, 0x10, 5, 1),
+
+	PIN_FIELD_BASE(32, 32, 1, 0x60, 0x10, 2, 1),
+	PIN_FIELD_BASE(33, 33, 1, 0x60, 0x10, 3, 1),
+
+	PIN_FIELD_BASE(34, 34, 4, 0x80, 0x10, 5, 1),
+	PIN_FIELD_BASE(35, 35, 4, 0x80, 0x10, 7, 1),
+
+	PIN_FIELD_BASE(36, 36, 3, 0x60, 0x10, 2, 1),
+	PIN_FIELD_BASE(37, 37, 3, 0x60, 0x10, 3, 1),
+	PIN_FIELD_BASE(38, 38, 3, 0x60, 0x10, 0, 1),
+	PIN_FIELD_BASE(39, 39, 3, 0x60, 0x10, 1, 1),
+
+	PIN_FIELD_BASE(40, 40, 7, 0x70, 0x10, 1, 1),
+	PIN_FIELD_BASE(41, 41, 7, 0x70, 0x10, 0, 1),
+	PIN_FIELD_BASE(42, 42, 7, 0x70, 0x10, 9, 1),
+	PIN_FIELD_BASE(43, 43, 7, 0x70, 0x10, 7, 1),
+	PIN_FIELD_BASE(44, 44, 7, 0x30, 0x10, 8, 1),
+	PIN_FIELD_BASE(45, 45, 7, 0x70, 0x10, 3, 1),
+	PIN_FIELD_BASE(46, 46, 7, 0x70, 0x10, 4, 1),
+	PIN_FIELD_BASE(47, 47, 7, 0x70, 0x10, 5, 1),
+	PIN_FIELD_BASE(48, 48, 7, 0x70, 0x10, 6, 1),
+	PIN_FIELD_BASE(49, 49, 7, 0x70, 0x10, 2, 1),
+
+	PIN_FIELD_BASE(50, 50, 6, 0x50, 0x10, 0, 1),
+	PIN_FIELD_BASE(51, 51, 6, 0x50, 0x10, 2, 1),
+	PIN_FIELD_BASE(52, 52, 6, 0x50, 0x10, 3, 1),
+	PIN_FIELD_BASE(53, 53, 6, 0x50, 0x10, 4, 1),
+	PIN_FIELD_BASE(54, 54, 6, 0x50, 0x10, 5, 1),
+	PIN_FIELD_BASE(55, 55, 6, 0x50, 0x10, 6, 1),
+	PIN_FIELD_BASE(56, 56, 6, 0x50, 0x10, 1, 1),
+};
+
+static const struct mtk_pin_field_calc mt7981_pin_pu_range[] = {
+	PIN_FIELD_BASE(40, 40, 7, 0x50, 0x10, 1, 1),
+	PIN_FIELD_BASE(41, 41, 7, 0x50, 0x10, 0, 1),
+	PIN_FIELD_BASE(42, 42, 7, 0x50, 0x10, 9, 1),
+	PIN_FIELD_BASE(43, 43, 7, 0x50, 0x10, 7, 1),
+	PIN_FIELD_BASE(44, 44, 7, 0x50, 0x10, 8, 1),
+	PIN_FIELD_BASE(45, 45, 7, 0x50, 0x10, 3, 1),
+	PIN_FIELD_BASE(46, 46, 7, 0x50, 0x10, 4, 1),
+	PIN_FIELD_BASE(47, 47, 7, 0x50, 0x10, 5, 1),
+	PIN_FIELD_BASE(48, 48, 7, 0x50, 0x10, 6, 1),
+	PIN_FIELD_BASE(49, 49, 7, 0x50, 0x10, 2, 1),
+
+	PIN_FIELD_BASE(50, 50, 6, 0x30, 0x10, 0, 1),
+	PIN_FIELD_BASE(51, 51, 6, 0x30, 0x10, 2, 1),
+	PIN_FIELD_BASE(52, 52, 6, 0x30, 0x10, 3, 1),
+	PIN_FIELD_BASE(53, 53, 6, 0x30, 0x10, 4, 1),
+	PIN_FIELD_BASE(54, 54, 6, 0x30, 0x10, 5, 1),
+	PIN_FIELD_BASE(55, 55, 6, 0x30, 0x10, 6, 1),
+	PIN_FIELD_BASE(56, 56, 6, 0x30, 0x10, 1, 1),
+};
+
+static const struct mtk_pin_field_calc mt7981_pin_pd_range[] = {
+	PIN_FIELD_BASE(40, 40, 7, 0x40, 0x10, 1, 1),
+	PIN_FIELD_BASE(41, 41, 7, 0x40, 0x10, 0, 1),
+	PIN_FIELD_BASE(42, 42, 7, 0x40, 0x10, 9, 1),
+	PIN_FIELD_BASE(43, 43, 7, 0x40, 0x10, 7, 1),
+	PIN_FIELD_BASE(44, 44, 7, 0x40, 0x10, 8, 1),
+	PIN_FIELD_BASE(45, 45, 7, 0x40, 0x10, 3, 1),
+	PIN_FIELD_BASE(46, 46, 7, 0x40, 0x10, 4, 1),
+	PIN_FIELD_BASE(47, 47, 7, 0x40, 0x10, 5, 1),
+	PIN_FIELD_BASE(48, 48, 7, 0x40, 0x10, 6, 1),
+	PIN_FIELD_BASE(49, 49, 7, 0x40, 0x10, 2, 1),
+
+	PIN_FIELD_BASE(50, 50, 6, 0x20, 0x10, 0, 1),
+	PIN_FIELD_BASE(51, 51, 6, 0x20, 0x10, 2, 1),
+	PIN_FIELD_BASE(52, 52, 6, 0x20, 0x10, 3, 1),
+	PIN_FIELD_BASE(53, 53, 6, 0x20, 0x10, 4, 1),
+	PIN_FIELD_BASE(54, 54, 6, 0x20, 0x10, 5, 1),
+	PIN_FIELD_BASE(55, 55, 6, 0x20, 0x10, 6, 1),
+	PIN_FIELD_BASE(56, 56, 6, 0x20, 0x10, 1, 1),
+};
+
+static const struct mtk_pin_field_calc mt7981_pin_drv_range[] = {
+	PIN_FIELD_BASE(0, 0, 1, 0x00, 0x10, 3, 3),
+	PIN_FIELD_BASE(1, 1, 1, 0x00, 0x10, 0, 3),
+
+	PIN_FIELD_BASE(2, 2, 5, 0x00, 0x10, 18, 3),
+
+	PIN_FIELD_BASE(3, 3, 4, 0x00, 0x10, 18, 1),
+	PIN_FIELD_BASE(4, 4, 4, 0x00, 0x10, 6, 1),
+	PIN_FIELD_BASE(5, 5, 4, 0x00, 0x10, 3, 3),
+	PIN_FIELD_BASE(6, 6, 4, 0x00, 0x10, 9, 3),
+	PIN_FIELD_BASE(7, 7, 4, 0x00, 0x10, 0, 3),
+	PIN_FIELD_BASE(8, 8, 4, 0x00, 0x10, 12, 3),
+
+	PIN_FIELD_BASE(9, 9, 5, 0x00, 0x10, 27, 3),
+	PIN_FIELD_BASE(10, 10, 5, 0x00, 0x10, 24, 3),
+	PIN_FIELD_BASE(11, 11, 5, 0x00, 0x10, 0, 3),
+	PIN_FIELD_BASE(12, 12, 5, 0x00, 0x10, 21, 3),
+	PIN_FIELD_BASE(13, 13, 5, 0x00, 0x10, 3, 3),
+
+	PIN_FIELD_BASE(14, 14, 4, 0x00, 0x10, 27, 3),
+
+	PIN_FIELD_BASE(15, 15, 2, 0x00, 0x10, 0, 3),
+	PIN_FIELD_BASE(16, 16, 2, 0x00, 0x10, 3, 3),
+	PIN_FIELD_BASE(17, 17, 2, 0x00, 0x10, 15, 3),
+	PIN_FIELD_BASE(18, 18, 2, 0x00, 0x10, 12, 3),
+	PIN_FIELD_BASE(19, 19, 2, 0x00, 0x10, 6, 3),
+	PIN_FIELD_BASE(20, 20, 2, 0x00, 0x10, 9, 3),
+	PIN_FIELD_BASE(21, 21, 2, 0x00, 0x10, 18, 3),
+	PIN_FIELD_BASE(22, 22, 2, 0x00, 0x10, 21, 3),
+	PIN_FIELD_BASE(23, 23, 2, 0x00, 0x10, 0, 3),
+	PIN_FIELD_BASE(24, 24, 2, 0x00, 0x10, 27, 3),
+	PIN_FIELD_BASE(25, 25, 2, 0x00, 0x10, 24, 3),
+
+	PIN_FIELD_BASE(26, 26, 5, 0x00, 0x10, 0, 3),
+	PIN_FIELD_BASE(27, 27, 5, 0x00, 0x10, 12, 3),
+	PIN_FIELD_BASE(28, 28, 5, 0x00, 0x10, 9, 3),
+	PIN_FIELD_BASE(29, 29, 5, 0x00, 0x10, 3, 3),
+	PIN_FIELD_BASE(30, 30, 5, 0x00, 0x10, 6, 3),
+	PIN_FIELD_BASE(31, 31, 5, 0x00, 0x10, 15, 3),
+
+	PIN_FIELD_BASE(32, 32, 1, 0x00, 0x10, 9, 3),
+	PIN_FIELD_BASE(33, 33, 1, 0x00, 0x10, 12, 3),
+
+	PIN_FIELD_BASE(34, 34, 4, 0x00, 0x10, 15, 3),
+	PIN_FIELD_BASE(35, 35, 4, 0x00, 0x10, 21, 3),
+
+	PIN_FIELD_BASE(36, 36, 3, 0x00, 0x10, 6, 3),
+	PIN_FIELD_BASE(37, 37, 3, 0x00, 0x10, 9, 3),
+	PIN_FIELD_BASE(38, 38, 3, 0x00, 0x10, 0, 3),
+	PIN_FIELD_BASE(39, 39, 3, 0x00, 0x10, 3, 3),
+
+	PIN_FIELD_BASE(40, 40, 7, 0x00, 0x10, 3, 3),
+	PIN_FIELD_BASE(41, 41, 7, 0x00, 0x10, 0, 3),
+	PIN_FIELD_BASE(42, 42, 7, 0x00, 0x10, 27, 3),
+	PIN_FIELD_BASE(43, 43, 7, 0x00, 0x10, 21, 3),
+	PIN_FIELD_BASE(44, 44, 7, 0x00, 0x10, 24, 3),
+	PIN_FIELD_BASE(45, 45, 7, 0x00, 0x10, 9, 3),
+	PIN_FIELD_BASE(46, 46, 7, 0x00, 0x10, 12, 3),
+	PIN_FIELD_BASE(47, 47, 7, 0x00, 0x10, 15, 3),
+	PIN_FIELD_BASE(48, 48, 7, 0x00, 0x10, 18, 3),
+	PIN_FIELD_BASE(49, 49, 7, 0x00, 0x10, 6, 3),
+
+	PIN_FIELD_BASE(50, 50, 6, 0x00, 0x10, 0, 3),
+	PIN_FIELD_BASE(51, 51, 6, 0x00, 0x10, 6, 3),
+	PIN_FIELD_BASE(52, 52, 6, 0x00, 0x10, 9, 3),
+	PIN_FIELD_BASE(53, 53, 6, 0x00, 0x10, 12, 3),
+	PIN_FIELD_BASE(54, 54, 6, 0x00, 0x10, 15, 3),
+	PIN_FIELD_BASE(55, 55, 6, 0x00, 0x10, 18, 3),
+	PIN_FIELD_BASE(56, 56, 6, 0x00, 0x10, 3, 3),
+};
+
+static const struct mtk_pin_field_calc mt7981_pin_pupd_range[] = {
+	PIN_FIELD_BASE(0, 0, 1, 0x20, 0x10, 1, 1),
+	PIN_FIELD_BASE(1, 1, 1, 0x20, 0x10, 0, 1),
+	PIN_FIELD_BASE(2, 2, 5, 0x30, 0x10, 6, 1),
+	PIN_FIELD_BASE(3, 3, 4, 0x30, 0x10, 6, 1),
+	PIN_FIELD_BASE(4, 4, 4, 0x30, 0x10, 2, 1),
+	PIN_FIELD_BASE(5, 5, 4, 0x30, 0x10, 1, 1),
+	PIN_FIELD_BASE(6, 6, 4, 0x30, 0x10, 3, 1),
+	PIN_FIELD_BASE(7, 7, 4, 0x30, 0x10, 0, 1),
+	PIN_FIELD_BASE(8, 8, 4, 0x30, 0x10, 4, 1),
+
+	PIN_FIELD_BASE(9, 9, 5, 0x30, 0x10, 9, 1),
+	PIN_FIELD_BASE(10, 10, 5, 0x30, 0x10, 8, 1),
+	PIN_FIELD_BASE(11, 11, 5, 0x30, 0x10, 10, 1),
+	PIN_FIELD_BASE(12, 12, 5, 0x30, 0x10, 7, 1),
+	PIN_FIELD_BASE(13, 13, 5, 0x30, 0x10, 11, 1),
+
+	PIN_FIELD_BASE(14, 14, 4, 0x30, 0x10, 8, 1),
+
+	PIN_FIELD_BASE(15, 15, 2, 0x30, 0x10, 0, 1),
+	PIN_FIELD_BASE(16, 16, 2, 0x30, 0x10, 1, 1),
+	PIN_FIELD_BASE(17, 17, 2, 0x30, 0x10, 5, 1),
+	PIN_FIELD_BASE(18, 18, 2, 0x30, 0x10, 4, 1),
+	PIN_FIELD_BASE(19, 19, 2, 0x30, 0x10, 2, 1),
+	PIN_FIELD_BASE(20, 20, 2, 0x90, 0x10, 3, 1),
+	PIN_FIELD_BASE(21, 21, 2, 0x30, 0x10, 6, 1),
+	PIN_FIELD_BASE(22, 22, 2, 0x30, 0x10, 7, 1),
+	PIN_FIELD_BASE(23, 23, 2, 0x30, 0x10, 10, 1),
+	PIN_FIELD_BASE(24, 24, 2, 0x30, 0x10, 9, 1),
+	PIN_FIELD_BASE(25, 25, 2, 0x30, 0x10, 8, 1),
+
+	PIN_FIELD_BASE(26, 26, 5, 0x30, 0x10, 0, 1),
+	PIN_FIELD_BASE(27, 27, 5, 0x30, 0x10, 4, 1),
+	PIN_FIELD_BASE(28, 28, 5, 0x30, 0x10, 3, 1),
+	PIN_FIELD_BASE(29, 29, 5, 0x30, 0x10, 1, 1),
+	PIN_FIELD_BASE(30, 30, 5, 0x30, 0x10, 2, 1),
+	PIN_FIELD_BASE(31, 31, 5, 0x30, 0x10, 5, 1),
+
+	PIN_FIELD_BASE(32, 32, 1, 0x20, 0x10, 2, 1),
+	PIN_FIELD_BASE(33, 33, 1, 0x20, 0x10, 3, 1),
+
+	PIN_FIELD_BASE(34, 34, 4, 0x30, 0x10, 5, 1),
+	PIN_FIELD_BASE(35, 35, 4, 0x30, 0x10, 7, 1),
+
+	PIN_FIELD_BASE(36, 36, 3, 0x20, 0x10, 2, 1),
+	PIN_FIELD_BASE(37, 37, 3, 0x20, 0x10, 3, 1),
+	PIN_FIELD_BASE(38, 38, 3, 0x20, 0x10, 0, 1),
+	PIN_FIELD_BASE(39, 39, 3, 0x20, 0x10, 1, 1),
+};
+
+static const struct mtk_pin_field_calc mt7981_pin_r0_range[] = {
+	PIN_FIELD_BASE(0, 0, 1, 0x30, 0x10, 1, 1),
+	PIN_FIELD_BASE(1, 1, 1, 0x30, 0x10, 0, 1),
+	PIN_FIELD_BASE(2, 2, 5, 0x40, 0x10, 6, 1),
+	PIN_FIELD_BASE(3, 3, 4, 0x40, 0x10, 6, 1),
+	PIN_FIELD_BASE(4, 4, 4, 0x40, 0x10, 2, 1),
+	PIN_FIELD_BASE(5, 5, 4, 0x40, 0x10, 1, 1),
+	PIN_FIELD_BASE(6, 6, 4, 0x40, 0x10, 3, 1),
+	PIN_FIELD_BASE(7, 7, 4, 0x40, 0x10, 0, 1),
+	PIN_FIELD_BASE(8, 8, 4, 0x40, 0x10, 4, 1),
+
+	PIN_FIELD_BASE(9, 9, 5, 0x40, 0x10, 9, 1),
+	PIN_FIELD_BASE(10, 10, 5, 0x40, 0x10, 8, 1),
+	PIN_FIELD_BASE(11, 11, 5, 0x40, 0x10, 10, 1),
+	PIN_FIELD_BASE(12, 12, 5, 0x40, 0x10, 7, 1),
+	PIN_FIELD_BASE(13, 13, 5, 0x40, 0x10, 11, 1),
+
+	PIN_FIELD_BASE(14, 14, 4, 0x40, 0x10, 8, 1),
+
+	PIN_FIELD_BASE(15, 15, 2, 0x40, 0x10, 0, 1),
+	PIN_FIELD_BASE(16, 16, 2, 0x40, 0x10, 1, 1),
+	PIN_FIELD_BASE(17, 17, 2, 0x40, 0x10, 5, 1),
+	PIN_FIELD_BASE(18, 18, 2, 0x40, 0x10, 4, 1),
+	PIN_FIELD_BASE(19, 19, 2, 0x40, 0x10, 2, 1),
+	PIN_FIELD_BASE(20, 20, 2, 0x40, 0x10, 3, 1),
+	PIN_FIELD_BASE(21, 21, 2, 0x40, 0x10, 6, 1),
+	PIN_FIELD_BASE(22, 22, 2, 0x40, 0x10, 7, 1),
+	PIN_FIELD_BASE(23, 23, 2, 0x40, 0x10, 10, 1),
+	PIN_FIELD_BASE(24, 24, 2, 0x40, 0x10, 9, 1),
+	PIN_FIELD_BASE(25, 25, 2, 0x40, 0x10, 8, 1),
+
+	PIN_FIELD_BASE(26, 26, 5, 0x40, 0x10, 0, 1),
+	PIN_FIELD_BASE(27, 27, 5, 0x40, 0x10, 4, 1),
+	PIN_FIELD_BASE(28, 28, 5, 0x40, 0x10, 3, 1),
+	PIN_FIELD_BASE(29, 29, 5, 0x40, 0x10, 1, 1),
+	PIN_FIELD_BASE(30, 30, 5, 0x40, 0x10, 2, 1),
+	PIN_FIELD_BASE(31, 31, 5, 0x40, 0x10, 5, 1),
+
+	PIN_FIELD_BASE(32, 32, 1, 0x30, 0x10, 2, 1),
+	PIN_FIELD_BASE(33, 33, 1, 0x30, 0x10, 3, 1),
+
+	PIN_FIELD_BASE(34, 34, 4, 0x40, 0x10, 5, 1),
+	PIN_FIELD_BASE(35, 35, 4, 0x40, 0x10, 7, 1),
+
+	PIN_FIELD_BASE(36, 36, 3, 0x30, 0x10, 2, 1),
+	PIN_FIELD_BASE(37, 37, 3, 0x30, 0x10, 3, 1),
+	PIN_FIELD_BASE(38, 38, 3, 0x30, 0x10, 0, 1),
+	PIN_FIELD_BASE(39, 39, 3, 0x30, 0x10, 1, 1),
+};
+
+static const struct mtk_pin_field_calc mt7981_pin_r1_range[] = {
+	PIN_FIELD_BASE(0, 0, 1, 0x40, 0x10, 1, 1),
+	PIN_FIELD_BASE(1, 1, 1, 0x40, 0x10, 0, 1),
+	PIN_FIELD_BASE(2, 2, 5, 0x50, 0x10, 6, 1),
+	PIN_FIELD_BASE(3, 3, 4, 0x50, 0x10, 6, 1),
+	PIN_FIELD_BASE(4, 4, 4, 0x50, 0x10, 2, 1),
+	PIN_FIELD_BASE(5, 5, 4, 0x50, 0x10, 1, 1),
+	PIN_FIELD_BASE(6, 6, 4, 0x50, 0x10, 3, 1),
+	PIN_FIELD_BASE(7, 7, 4, 0x50, 0x10, 0, 1),
+	PIN_FIELD_BASE(8, 8, 4, 0x50, 0x10, 4, 1),
+
+	PIN_FIELD_BASE(9, 9, 5, 0x50, 0x10, 9, 1),
+	PIN_FIELD_BASE(10, 10, 5, 0x50, 0x10, 8, 1),
+	PIN_FIELD_BASE(11, 11, 5, 0x50, 0x10, 10, 1),
+	PIN_FIELD_BASE(12, 12, 5, 0x50, 0x10, 7, 1),
+	PIN_FIELD_BASE(13, 13, 5, 0x50, 0x10, 11, 1),
+
+	PIN_FIELD_BASE(14, 14, 4, 0x50, 0x10, 8, 1),
+
+	PIN_FIELD_BASE(15, 15, 2, 0x50, 0x10, 0, 1),
+	PIN_FIELD_BASE(16, 16, 2, 0x50, 0x10, 1, 1),
+	PIN_FIELD_BASE(17, 17, 2, 0x50, 0x10, 5, 1),
+	PIN_FIELD_BASE(18, 18, 2, 0x50, 0x10, 4, 1),
+	PIN_FIELD_BASE(19, 19, 2, 0x50, 0x10, 2, 1),
+	PIN_FIELD_BASE(20, 20, 2, 0x50, 0x10, 3, 1),
+	PIN_FIELD_BASE(21, 21, 2, 0x50, 0x10, 6, 1),
+	PIN_FIELD_BASE(22, 22, 2, 0x50, 0x10, 7, 1),
+	PIN_FIELD_BASE(23, 23, 2, 0x50, 0x10, 10, 1),
+	PIN_FIELD_BASE(24, 24, 2, 0x50, 0x10, 9, 1),
+	PIN_FIELD_BASE(25, 25, 2, 0x50, 0x10, 8, 1),
+
+	PIN_FIELD_BASE(26, 26, 5, 0x50, 0x10, 0, 1),
+	PIN_FIELD_BASE(27, 27, 5, 0x50, 0x10, 4, 1),
+	PIN_FIELD_BASE(28, 28, 5, 0x50, 0x10, 3, 1),
+	PIN_FIELD_BASE(29, 29, 5, 0x50, 0x10, 1, 1),
+	PIN_FIELD_BASE(30, 30, 5, 0x50, 0x10, 2, 1),
+	PIN_FIELD_BASE(31, 31, 5, 0x50, 0x10, 5, 1),
+
+	PIN_FIELD_BASE(32, 32, 1, 0x40, 0x10, 2, 1),
+	PIN_FIELD_BASE(33, 33, 1, 0x40, 0x10, 3, 1),
+
+	PIN_FIELD_BASE(34, 34, 4, 0x50, 0x10, 5, 1),
+	PIN_FIELD_BASE(35, 35, 4, 0x50, 0x10, 7, 1),
+
+	PIN_FIELD_BASE(36, 36, 3, 0x40, 0x10, 2, 1),
+	PIN_FIELD_BASE(37, 37, 3, 0x40, 0x10, 3, 1),
+	PIN_FIELD_BASE(38, 38, 3, 0x40, 0x10, 0, 1),
+	PIN_FIELD_BASE(39, 39, 3, 0x40, 0x10, 1, 1),
+};
+
+static const unsigned int mt7981_pull_type[] = {
+	MTK_PULL_PUPD_R1R0_TYPE,/*0*/ MTK_PULL_PUPD_R1R0_TYPE,/*1*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*2*/ MTK_PULL_PUPD_R1R0_TYPE,/*3*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*4*/ MTK_PULL_PUPD_R1R0_TYPE,/*5*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*6*/ MTK_PULL_PUPD_R1R0_TYPE,/*7*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*8*/ MTK_PULL_PUPD_R1R0_TYPE,/*9*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*10*/ MTK_PULL_PUPD_R1R0_TYPE,/*11*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*12*/ MTK_PULL_PUPD_R1R0_TYPE,/*13*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*14*/ MTK_PULL_PUPD_R1R0_TYPE,/*15*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*16*/ MTK_PULL_PUPD_R1R0_TYPE,/*17*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*18*/ MTK_PULL_PUPD_R1R0_TYPE,/*19*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*20*/ MTK_PULL_PUPD_R1R0_TYPE,/*21*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*22*/ MTK_PULL_PUPD_R1R0_TYPE,/*23*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*24*/ MTK_PULL_PUPD_R1R0_TYPE,/*25*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*26*/ MTK_PULL_PUPD_R1R0_TYPE,/*27*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*28*/ MTK_PULL_PUPD_R1R0_TYPE,/*29*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*30*/ MTK_PULL_PUPD_R1R0_TYPE,/*31*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*32*/ MTK_PULL_PUPD_R1R0_TYPE,/*33*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*34*/ MTK_PULL_PUPD_R1R0_TYPE,/*35*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*36*/ MTK_PULL_PUPD_R1R0_TYPE,/*37*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*38*/ MTK_PULL_PUPD_R1R0_TYPE,/*39*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*40*/ MTK_PULL_PUPD_R1R0_TYPE,/*41*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*42*/ MTK_PULL_PUPD_R1R0_TYPE,/*43*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*44*/ MTK_PULL_PUPD_R1R0_TYPE,/*45*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*46*/ MTK_PULL_PUPD_R1R0_TYPE,/*47*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*48*/ MTK_PULL_PUPD_R1R0_TYPE,/*49*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*50*/ MTK_PULL_PUPD_R1R0_TYPE,/*51*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*52*/ MTK_PULL_PUPD_R1R0_TYPE,/*53*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*54*/ MTK_PULL_PUPD_R1R0_TYPE,/*55*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*56*/ MTK_PULL_PUPD_R1R0_TYPE,/*57*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*58*/ MTK_PULL_PUPD_R1R0_TYPE,/*59*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*60*/ MTK_PULL_PUPD_R1R0_TYPE,/*61*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*62*/ MTK_PULL_PUPD_R1R0_TYPE,/*63*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*64*/ MTK_PULL_PUPD_R1R0_TYPE,/*65*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*66*/ MTK_PULL_PUPD_R1R0_TYPE,/*67*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*68*/ MTK_PULL_PU_PD_TYPE,/*69*/
+	MTK_PULL_PU_PD_TYPE,/*70*/ MTK_PULL_PU_PD_TYPE,/*71*/
+	MTK_PULL_PU_PD_TYPE,/*72*/ MTK_PULL_PU_PD_TYPE,/*73*/
+	MTK_PULL_PU_PD_TYPE,/*74*/ MTK_PULL_PU_PD_TYPE,/*75*/
+	MTK_PULL_PU_PD_TYPE,/*76*/ MTK_PULL_PU_PD_TYPE,/*77*/
+	MTK_PULL_PU_PD_TYPE,/*78*/ MTK_PULL_PU_PD_TYPE,/*79*/
+	MTK_PULL_PU_PD_TYPE,/*80*/ MTK_PULL_PU_PD_TYPE,/*81*/
+	MTK_PULL_PU_PD_TYPE,/*82*/ MTK_PULL_PU_PD_TYPE,/*83*/
+	MTK_PULL_PU_PD_TYPE,/*84*/ MTK_PULL_PU_PD_TYPE,/*85*/
+	MTK_PULL_PU_PD_TYPE,/*86*/ MTK_PULL_PU_PD_TYPE,/*87*/
+	MTK_PULL_PU_PD_TYPE,/*88*/ MTK_PULL_PU_PD_TYPE,/*89*/
+	MTK_PULL_PU_PD_TYPE,/*90*/ MTK_PULL_PU_PD_TYPE,/*91*/
+	MTK_PULL_PU_PD_TYPE,/*92*/ MTK_PULL_PU_PD_TYPE,/*93*/
+	MTK_PULL_PU_PD_TYPE,/*94*/ MTK_PULL_PU_PD_TYPE,/*95*/
+	MTK_PULL_PU_PD_TYPE,/*96*/ MTK_PULL_PU_PD_TYPE,/*97*/
+	MTK_PULL_PU_PD_TYPE,/*98*/ MTK_PULL_PU_PD_TYPE,/*99*/
+	MTK_PULL_PU_PD_TYPE,/*100*/
+};
+
+static const struct mtk_pin_reg_calc mt7981_reg_cals[] = {
+	[PINCTRL_PIN_REG_MODE] = MTK_RANGE(mt7981_pin_mode_range),
+	[PINCTRL_PIN_REG_DIR] = MTK_RANGE(mt7981_pin_dir_range),
+	[PINCTRL_PIN_REG_DI] = MTK_RANGE(mt7981_pin_di_range),
+	[PINCTRL_PIN_REG_DO] = MTK_RANGE(mt7981_pin_do_range),
+	[PINCTRL_PIN_REG_SMT] = MTK_RANGE(mt7981_pin_smt_range),
+	[PINCTRL_PIN_REG_IES] = MTK_RANGE(mt7981_pin_ies_range),
+	[PINCTRL_PIN_REG_PU] = MTK_RANGE(mt7981_pin_pu_range),
+	[PINCTRL_PIN_REG_PD] = MTK_RANGE(mt7981_pin_pd_range),
+	[PINCTRL_PIN_REG_DRV] = MTK_RANGE(mt7981_pin_drv_range),
+	[PINCTRL_PIN_REG_PUPD] = MTK_RANGE(mt7981_pin_pupd_range),
+	[PINCTRL_PIN_REG_R0] = MTK_RANGE(mt7981_pin_r0_range),
+	[PINCTRL_PIN_REG_R1] = MTK_RANGE(mt7981_pin_r1_range),
+};
+
+static const struct mtk_pin_desc mt7981_pins[] = {
+	MT7981_PIN(0, "GPIO_WPS"),
+	MT7981_PIN(1, "GPIO_RESET"),
+	MT7981_PIN(2, "SYS_WATCHDOG"),
+	MT7981_PIN(3, "PCIE_PERESET_N"),
+	MT7981_PIN(4, "JTAG_JTDO"),
+	MT7981_PIN(5, "JTAG_JTDI"),
+	MT7981_PIN(6, "JTAG_JTMS"),
+	MT7981_PIN(7, "JTAG_JTCLK"),
+	MT7981_PIN(8, "JTAG_JTRST_N"),
+	MT7981_PIN(9, "WO_JTAG_JTDO"),
+	MT7981_PIN(10, "WO_JTAG_JTDI"),
+	MT7981_PIN(11, "WO_JTAG_JTMS"),
+	MT7981_PIN(12, "WO_JTAG_JTCLK"),
+	MT7981_PIN(13, "WO_JTAG_JTRST_N"),
+	MT7981_PIN(14, "USB_VBUS"),
+	MT7981_PIN(15, "PWM0"),
+	MT7981_PIN(16, "SPI0_CLK"),
+	MT7981_PIN(17, "SPI0_MOSI"),
+	MT7981_PIN(18, "SPI0_MISO"),
+	MT7981_PIN(19, "SPI0_CS"),
+	MT7981_PIN(20, "SPI0_HOLD"),
+	MT7981_PIN(21, "SPI0_WP"),
+	MT7981_PIN(22, "SPI1_CLK"),
+	MT7981_PIN(23, "SPI1_MOSI"),
+	MT7981_PIN(24, "SPI1_MISO"),
+	MT7981_PIN(25, "SPI1_CS"),
+	MT7981_PIN(26, "SPI2_CLK"),
+	MT7981_PIN(27, "SPI2_MOSI"),
+	MT7981_PIN(28, "SPI2_MISO"),
+	MT7981_PIN(29, "SPI2_CS"),
+	MT7981_PIN(30, "SPI2_HOLD"),
+	MT7981_PIN(31, "SPI2_WP"),
+	MT7981_PIN(32, "UART0_RXD"),
+	MT7981_PIN(33, "UART0_TXD"),
+	MT7981_PIN(34, "PCIE_CLK_REQ"),
+	MT7981_PIN(35, "PCIE_WAKE_N"),
+	MT7981_PIN(36, "SMI_MDC"),
+	MT7981_PIN(37, "SMI_MDIO"),
+	MT7981_PIN(38, "GBE_INT"),
+	MT7981_PIN(39, "GBE_RESET"),
+	MT7981_PIN(40, "WF_DIG_RESETB"),
+	MT7981_PIN(41, "WF_CBA_RESETB"),
+	MT7981_PIN(42, "WF_XO_REQ"),
+	MT7981_PIN(43, "WF_TOP_CLK"),
+	MT7981_PIN(44, "WF_TOP_DATA"),
+	MT7981_PIN(45, "WF_HB1"),
+	MT7981_PIN(46, "WF_HB2"),
+	MT7981_PIN(47, "WF_HB3"),
+	MT7981_PIN(48, "WF_HB4"),
+	MT7981_PIN(49, "WF_HB0"),
+	MT7981_PIN(50, "WF_HB0_B"),
+	MT7981_PIN(51, "WF_HB5"),
+	MT7981_PIN(52, "WF_HB6"),
+	MT7981_PIN(53, "WF_HB7"),
+	MT7981_PIN(54, "WF_HB8"),
+	MT7981_PIN(55, "WF_HB9"),
+	MT7981_PIN(56, "WF_HB10"),
+};
+
+/* List all groups consisting of these pins dedicated to the enablement of
+ * certain hardware block and the corresponding mode for all of the pins.
+ * The hardware probably has multiple combinations of these pinouts.
+ */
+
+/* WA_AICE */
+static int mt7981_wa_aice1_pins[] = { 0, 1, };
+static int mt7981_wa_aice1_funcs[] = { 2, 2, };
+
+static int mt7981_wa_aice2_pins[] = { 0, 1, };
+static int mt7981_wa_aice2_funcs[] = { 3, 3, };
+
+static int mt7981_wa_aice3_pins[] = { 28, 29, };
+static int mt7981_wa_aice3_funcs[] = { 3, 3, };
+
+static int mt7981_wm_aice1_pins[] = { 9, 10, };
+static int mt7981_wm_aice1_funcs[] = { 2, 2, };
+
+static int mt7981_wm_aice2_pins[] = { 30, 31, };
+static int mt7981_wm_aice2_funcs[] = { 5, 5, };
+
+/* WM_UART */
+static int mt7981_wm_uart_0_pins[] = { 0, 1, };
+static int mt7981_wm_uart_0_funcs[] = { 5, 5, };
+
+static int mt7981_wm_uart_1_pins[] = { 20, 21, };
+static int mt7981_wm_uart_1_funcs[] = { 4, 4, };
+
+static int mt7981_wm_uart_2_pins[] = { 30, 31, };
+static int mt7981_wm_uart_2_funcs[] = { 3, 3, };
+
+/* DFD */
+static int mt7981_dfd_pins[] = { 0, 1, 4, 5, };
+static int mt7981_dfd_funcs[] = { 5, 5, 6, 6, };
+
+/* SYS_WATCHDOG */
+static int mt7981_watchdog_pins[] = { 2, };
+static int mt7981_watchdog_funcs[] = { 1, };
+
+static int mt7981_watchdog1_pins[] = { 13, };
+static int mt7981_watchdog1_funcs[] = { 5, };
+
+/* PCIE_PERESET_N */
+static int mt7981_pcie_pereset_pins[] = { 3, };
+static int mt7981_pcie_pereset_funcs[] = { 1, };
+
+/* JTAG */
+static int mt7981_jtag_pins[] = { 4, 5, 6, 7, 8, };
+static int mt7981_jtag_funcs[] = { 1, 1, 1, 1, 1, };
+
+/* WM_JTAG */
+static int mt7981_wm_jtag_0_pins[] = { 4, 5, 6, 7, 8, };
+static int mt7981_wm_jtag_0_funcs[] = { 2, 2, 2, 2, 2, };
+
+static int mt7981_wm_jtag_1_pins[] = { 20, 21, 22, 23, 24, };
+static int mt7981_wm_jtag_1_funcs[] = { 5, 5, 5, 5, 5, };
+
+/* WO0_JTAG */
+static int mt7981_wo0_jtag_0_pins[] = { 9, 10, 11, 12, 13, };
+static int mt7981_wo0_jtag_0_funcs[] = { 1, 1, 1, 1, 1, };
+
+static int mt7981_wo0_jtag_1_pins[] = { 25, 26, 27, 28, 29, };
+static int mt7981_wo0_jtag_1_funcs[] = { 5, 5, 5, 5, 5, };
+
+/* UART2 */
+static int mt7981_uart2_0_pins[] = { 4, 5, 6, 7, };
+static int mt7981_uart2_0_funcs[] = { 3, 3, 3, 3, };
+
+/* GBE_LED0 */
+static int mt7981_gbe_led0_pins[] = { 8, };
+static int mt7981_gbe_led0_funcs[] = { 3, };
+
+/* PTA_EXT */
+static int mt7981_pta_ext_0_pins[] = { 4, 5, 6, };
+static int mt7981_pta_ext_0_funcs[] = { 4, 4, 4, };
+
+static int mt7981_pta_ext_1_pins[] = { 22, 23, 24, };
+static int mt7981_pta_ext_1_funcs[] = { 4, 4, 4, };
+
+/* PWM2 */
+static int mt7981_pwm2_pins[] = { 7, };
+static int mt7981_pwm2_funcs[] = { 4, };
+
+/* NET_WO0_UART_TXD */
+static int mt7981_net_wo0_uart_txd_0_pins[] = { 8, };
+static int mt7981_net_wo0_uart_txd_0_funcs[] = { 4, };
+
+static int mt7981_net_wo0_uart_txd_1_pins[] = { 14, };
+static int mt7981_net_wo0_uart_txd_1_funcs[] = { 3, };
+
+static int mt7981_net_wo0_uart_txd_2_pins[] = { 15, };
+static int mt7981_net_wo0_uart_txd_2_funcs[] = { 4, };
+
+/* SPI1 */
+static int mt7981_spi1_0_pins[] = { 4, 5, 6, 7, };
+static int mt7981_spi1_0_funcs[] = { 5, 5, 5, 5, };
+
+/* I2C */
+static int mt7981_i2c0_0_pins[] = { 6, 7, };
+static int mt7981_i2c0_0_funcs[] = { 6, 6, };
+
+static int mt7981_i2c0_1_pins[] = { 30, 31, };
+static int mt7981_i2c0_1_funcs[] = { 4, 4, };
+
+static int mt7981_i2c0_2_pins[] = { 36, 37, };
+static int mt7981_i2c0_2_funcs[] = { 2, 2, };
+
+static int mt7981_u2_phy_i2c_pins[] = { 30, 31, };
+static int mt7981_u2_phy_i2c_funcs[] = { 6, 6, };
+
+static int mt7981_u3_phy_i2c_pins[] = { 32, 33, };
+static int mt7981_u3_phy_i2c_funcs[] = { 3, 3, };
+
+static int mt7981_sgmii1_phy_i2c_pins[] = { 32, 33, };
+static int mt7981_sgmii1_phy_i2c_funcs[] = { 2, 2, };
+
+static int mt7981_sgmii0_phy_i2c_pins[] = { 32, 33, };
+static int mt7981_sgmii0_phy_i2c_funcs[] = { 5, 5, };
+
+/* DFD_NTRST */
+static int mt7981_dfd_ntrst_pins[] = { 8, };
+static int mt7981_dfd_ntrst_funcs[] = { 6, };
+
+/* PWM0 */
+static int mt7981_pwm0_0_pins[] = { 13, };
+static int mt7981_pwm0_0_funcs[] = { 2, };
+
+static int mt7981_pwm0_1_pins[] = { 15, };
+static int mt7981_pwm0_1_funcs[] = { 1, };
+
+/* PWM1 */
+static int mt7981_pwm1_0_pins[] = { 14, };
+static int mt7981_pwm1_0_funcs[] = { 2, };
+
+static int mt7981_pwm1_1_pins[] = { 15, };
+static int mt7981_pwm1_1_funcs[] = { 3, };
+
+/* GBE_LED1 */
+static int mt7981_gbe_led1_pins[] = { 13, };
+static int mt7981_gbe_led1_funcs[] = { 3, };
+
+/* PCM */
+static int mt7981_pcm_pins[] = { 9, 10, 11, 12, 13, 25 };
+static int mt7981_pcm_funcs[] = { 4, 4, 4, 4, 4, 4, };
+
+/* UDI */
+static int mt7981_udi_pins[] = { 9, 10, 11, 12, 13, };
+static int mt7981_udi_funcs[] = { 6, 6, 6, 6, 6, };
+
+/* DRV_VBUS */
+static int mt7981_drv_vbus_pins[] = { 14, };
+static int mt7981_drv_vbus_funcs[] = { 1, };
+
+/* EMMC */
+static int mt7981_emmc_45_pins[] = { 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, };
+static int mt7981_emmc_45_funcs[] = { 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, };
+
+/* SNFI */
+static int mt7981_snfi_pins[] = { 16, 17, 18, 19, 20, 21, };
+static int mt7981_snfi_funcs[] = { 3, 3, 3, 3, 3, 3, };
+
+/* SPI0 */
+static int mt7981_spi0_pins[] = { 16, 17, 18, 19, };
+static int mt7981_spi0_funcs[] = { 1, 1, 1, 1, };
+
+/* SPI0 */
+static int mt7981_spi0_wp_hold_pins[] = { 20, 21, };
+static int mt7981_spi0_wp_hold_funcs[] = { 1, 1, };
+
+/* SPI1 */
+static int mt7981_spi1_1_pins[] = { 22, 23, 24, 25, };
+static int mt7981_spi1_1_funcs[] = { 1, 1, 1, 1, };
+
+/* SPI2 */
+static int mt7981_spi2_pins[] = { 26, 27, 28, 29, };
+static int mt7981_spi2_funcs[] = { 1, 1, 1, 1, };
+
+/* SPI2 */
+static int mt7981_spi2_wp_hold_pins[] = { 30, 31, };
+static int mt7981_spi2_wp_hold_funcs[] = { 1, 1, };
+
+/* UART1 */
+static int mt7981_uart1_0_pins[] = { 16, 17, 18, 19, };
+static int mt7981_uart1_0_funcs[] = { 4, 4, 4, 4, };
+
+static int mt7981_uart1_1_pins[] = { 26, 27, 28, 29, };
+static int mt7981_uart1_1_funcs[] = { 2, 2, 2, 2, };
+
+/* UART2 */
+static int mt7981_uart2_1_pins[] = { 22, 23, 24, 25, };
+static int mt7981_uart2_1_funcs[] = { 3, 3, 3, 3, };
+
+/* UART0 */
+static int mt7981_uart0_pins[] = { 32, 33, };
+static int mt7981_uart0_funcs[] = { 1, 1, };
+
+/* PCIE_CLK_REQ */
+static int mt7981_pcie_clk_pins[] = { 34, };
+static int mt7981_pcie_clk_funcs[] = { 2, };
+
+/* PCIE_WAKE_N */
+static int mt7981_pcie_wake_pins[] = { 35, };
+static int mt7981_pcie_wake_funcs[] = { 2, };
+
+/* MDC_MDIO */
+static int mt7981_smi_mdc_mdio_pins[] = { 36, 37, };
+static int mt7981_smi_mdc_mdio_funcs[] = { 1, 1, };
+
+static int mt7981_gbe_ext_mdc_mdio_pins[] = { 36, 37, };
+static int mt7981_gbe_ext_mdc_mdio_funcs[] = { 3, 3, };
+
+/* WF0_MODE1 */
+static int mt7981_wf0_mode1_pins[] = { 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56 };
+static int mt7981_wf0_mode1_funcs[] = { 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 };
+
+/* WF0_MODE3 */
+static int mt7981_wf0_mode3_pins[] = { 45, 46, 47, 48, 49, 51 };
+static int mt7981_wf0_mode3_funcs[] = { 2, 2, 2, 2, 2, 2 };
+
+/* WF2G_LED */
+static int mt7981_wf2g_led0_pins[] = { 30, };
+static int mt7981_wf2g_led0_funcs[] = { 2, };
+
+static int mt7981_wf2g_led1_pins[] = { 34, };
+static int mt7981_wf2g_led1_funcs[] = { 1, };
+
+/* WF5G_LED */
+static int mt7981_wf5g_led0_pins[] = { 31, };
+static int mt7981_wf5g_led0_funcs[] = { 2, };
+
+static int mt7981_wf5g_led1_pins[] = { 35, };
+static int mt7981_wf5g_led1_funcs[] = { 1, };
+
+/* MT7531_INT */
+static int mt7981_mt7531_int_pins[] = { 38, };
+static int mt7981_mt7531_int_funcs[] = { 1, };
+
+/* ANT_SEL */
+static int mt7981_ant_sel_pins[] = { 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 34, 35 };
+static int mt7981_ant_sel_funcs[] = { 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6 };
+
+static const struct group_desc mt7981_groups[] = {
+	/* @GPIO(0,1): WA_AICE(2) */
+	PINCTRL_PIN_GROUP("wa_aice1", mt7981_wa_aice1),
+	/* @GPIO(0,1): WA_AICE(3) */
+	PINCTRL_PIN_GROUP("wa_aice2", mt7981_wa_aice2),
+	/* @GPIO(0,1): WM_UART(5) */
+	PINCTRL_PIN_GROUP("wm_uart_0", mt7981_wm_uart_0),
+	/* @GPIO(0,1,4,5): DFD(6) */
+	PINCTRL_PIN_GROUP("dfd", mt7981_dfd),
+	/* @GPIO(2): SYS_WATCHDOG(1) */
+	PINCTRL_PIN_GROUP("watchdog", mt7981_watchdog),
+	/* @GPIO(3): PCIE_PERESET_N(1) */
+	PINCTRL_PIN_GROUP("pcie_pereset", mt7981_pcie_pereset),
+	/* @GPIO(4,8) JTAG(1) */
+	PINCTRL_PIN_GROUP("jtag", mt7981_jtag),
+	/* @GPIO(4,8) WM_JTAG(2) */
+	PINCTRL_PIN_GROUP("wm_jtag_0", mt7981_wm_jtag_0),
+	/* @GPIO(9,13) WO0_JTAG(1) */
+	PINCTRL_PIN_GROUP("wo0_jtag_0", mt7981_wo0_jtag_0),
+	/* @GPIO(4,7) WM_JTAG(3) */
+	PINCTRL_PIN_GROUP("uart2_0", mt7981_uart2_0),
+	/* @GPIO(8) GBE_LED0(3) */
+	PINCTRL_PIN_GROUP("gbe_led0", mt7981_gbe_led0),
+	/* @GPIO(4,6) PTA_EXT(4) */
+	PINCTRL_PIN_GROUP("pta_ext_0", mt7981_pta_ext_0),
+	/* @GPIO(7) PWM2(4) */
+	PINCTRL_PIN_GROUP("pwm2", mt7981_pwm2),
+	/* @GPIO(8) NET_WO0_UART_TXD(4) */
+	PINCTRL_PIN_GROUP("net_wo0_uart_txd_0", mt7981_net_wo0_uart_txd_0),
+	/* @GPIO(4,7) SPI1(5) */
+	PINCTRL_PIN_GROUP("spi1_0", mt7981_spi1_0),
+	/* @GPIO(6,7) I2C(5) */
+	PINCTRL_PIN_GROUP("i2c0_0", mt7981_i2c0_0),
+	/* @GPIO(0,1,4,5): DFD_NTRST(6) */
+	PINCTRL_PIN_GROUP("dfd_ntrst", mt7981_dfd_ntrst),
+	/* @GPIO(9,10): WM_AICE(2) */
+	PINCTRL_PIN_GROUP("wm_aice1", mt7981_wm_aice1),
+	/* @GPIO(13): PWM0(2) */
+	PINCTRL_PIN_GROUP("pwm0_0", mt7981_pwm0_0),
+	/* @GPIO(15): PWM0(1) */
+	PINCTRL_PIN_GROUP("pwm0_1", mt7981_pwm0_1),
+	/* @GPIO(14): PWM1(2) */
+	PINCTRL_PIN_GROUP("pwm1_0", mt7981_pwm1_0),
+	/* @GPIO(15): PWM1(3) */
+	PINCTRL_PIN_GROUP("pwm1_1", mt7981_pwm1_1),
+	/* @GPIO(14) NET_WO0_UART_TXD(3) */
+	PINCTRL_PIN_GROUP("net_wo0_uart_txd_1", mt7981_net_wo0_uart_txd_1),
+	/* @GPIO(15) NET_WO0_UART_TXD(4) */
+	PINCTRL_PIN_GROUP("net_wo0_uart_txd_2", mt7981_net_wo0_uart_txd_2),
+	/* @GPIO(13) GBE_LED0(3) */
+	PINCTRL_PIN_GROUP("gbe_led1", mt7981_gbe_led1),
+	/* @GPIO(9,13) PCM(4) */
+	PINCTRL_PIN_GROUP("pcm", mt7981_pcm),
+	/* @GPIO(13): SYS_WATCHDOG1(5) */
+	PINCTRL_PIN_GROUP("watchdog1", mt7981_watchdog1),
+	/* @GPIO(9,13) UDI(4) */
+	PINCTRL_PIN_GROUP("udi", mt7981_udi),
+	/* @GPIO(14) DRV_VBUS(1) */
+	PINCTRL_PIN_GROUP("drv_vbus", mt7981_drv_vbus),
+	/* @GPIO(15,25): EMMC(2) */
+	PINCTRL_PIN_GROUP("emmc_45", mt7981_emmc_45),
+	/* @GPIO(16,21): SNFI(3) */
+	PINCTRL_PIN_GROUP("snfi", mt7981_snfi),
+	/* @GPIO(16,19): SPI0(1) */
+	PINCTRL_PIN_GROUP("spi0", mt7981_spi0),
+	/* @GPIO(20,21): SPI0(1) */
+	PINCTRL_PIN_GROUP("spi0_wp_hold", mt7981_spi0_wp_hold),
+	/* @GPIO(22,25) SPI1(1) */
+	PINCTRL_PIN_GROUP("spi1_1", mt7981_spi1_1),
+	/* @GPIO(26,29): SPI2(1) */
+	PINCTRL_PIN_GROUP("spi2", mt7981_spi2),
+	/* @GPIO(30,31): SPI0(1) */
+	PINCTRL_PIN_GROUP("spi2_wp_hold", mt7981_spi2_wp_hold),
+	/* @GPIO(16,19): UART1(4) */
+	PINCTRL_PIN_GROUP("uart1_0", mt7981_uart1_0),
+	/* @GPIO(26,29): UART1(2) */
+	PINCTRL_PIN_GROUP("uart1_1", mt7981_uart1_1),
+	/* @GPIO(22,25): UART1(3) */
+	PINCTRL_PIN_GROUP("uart2_1", mt7981_uart2_1),
+	/* @GPIO(22,24) PTA_EXT(4) */
+	PINCTRL_PIN_GROUP("pta_ext_1", mt7981_pta_ext_1),
+	/* @GPIO(20,21): WM_UART(4) */
+	PINCTRL_PIN_GROUP("wm_aurt_1", mt7981_wm_uart_1),
+	/* @GPIO(30,31): WM_UART(3) */
+	PINCTRL_PIN_GROUP("wm_aurt_2", mt7981_wm_uart_2),
+	/* @GPIO(20,24) WM_JTAG(5) */
+	PINCTRL_PIN_GROUP("wm_jtag_1", mt7981_wm_jtag_1),
+	/* @GPIO(25,29) WO0_JTAG(5) */
+	PINCTRL_PIN_GROUP("wo0_jtag_1", mt7981_wo0_jtag_1),
+	/* @GPIO(28,29): WA_AICE(3) */
+	PINCTRL_PIN_GROUP("wa_aice3", mt7981_wa_aice3),
+	/* @GPIO(30,31): WM_AICE(5) */
+	PINCTRL_PIN_GROUP("wm_aice2", mt7981_wm_aice2),
+	/* @GPIO(30,31): I2C(4) */
+	PINCTRL_PIN_GROUP("i2c0_1", mt7981_i2c0_1),
+	/* @GPIO(30,31): I2C(6) */
+	PINCTRL_PIN_GROUP("u2_phy_i2c", mt7981_u2_phy_i2c),
+	/* @GPIO(32,33): I2C(1) */
+	PINCTRL_PIN_GROUP("uart0", mt7981_uart0),
+	/* @GPIO(32,33): I2C(2) */
+	PINCTRL_PIN_GROUP("sgmii1_phy_i2c", mt7981_sgmii1_phy_i2c),
+	/* @GPIO(32,33): I2C(3) */
+	PINCTRL_PIN_GROUP("u3_phy_i2c", mt7981_u3_phy_i2c),
+	/* @GPIO(32,33): I2C(5) */
+	PINCTRL_PIN_GROUP("sgmii0_phy_i2c", mt7981_sgmii0_phy_i2c),
+	/* @GPIO(34): PCIE_CLK_REQ(2) */
+	PINCTRL_PIN_GROUP("pcie_clk", mt7981_pcie_clk),
+	/* @GPIO(35): PCIE_WAKE_N(2) */
+	PINCTRL_PIN_GROUP("pcie_wake", mt7981_pcie_wake),
+	/* @GPIO(36,37): I2C(2) */
+	PINCTRL_PIN_GROUP("i2c0_2", mt7981_i2c0_2),
+	/* @GPIO(36,37): MDC_MDIO(1) */
+	PINCTRL_PIN_GROUP("smi_mdc_mdio", mt7981_smi_mdc_mdio),
+	/* @GPIO(36,37): MDC_MDIO(3) */
+	PINCTRL_PIN_GROUP("gbe_ext_mdc_mdio", mt7981_gbe_ext_mdc_mdio),
+	/* @GPIO(69,85): WF0_MODE1(1) */
+	PINCTRL_PIN_GROUP("wf0_mode1", mt7981_wf0_mode1),
+	/* @GPIO(74,80): WF0_MODE3(3) */
+	PINCTRL_PIN_GROUP("wf0_mode3", mt7981_wf0_mode3),
+	/* @GPIO(30): WF2G_LED(2) */
+	PINCTRL_PIN_GROUP("wf2g_led0", mt7981_wf2g_led0),
+	/* @GPIO(34): WF2G_LED(1) */
+	PINCTRL_PIN_GROUP("wf2g_led1", mt7981_wf2g_led1),
+	/* @GPIO(31): WF5G_LED(2) */
+	PINCTRL_PIN_GROUP("wf5g_led0", mt7981_wf5g_led0),
+	/* @GPIO(35): WF5G_LED(1) */
+	PINCTRL_PIN_GROUP("wf5g_led1", mt7981_wf5g_led1),
+	/* @GPIO(38): MT7531_INT(1) */
+	PINCTRL_PIN_GROUP("mt7531_int", mt7981_mt7531_int),
+	/* @GPIO(14,15,26,17,18,19,20,21,22,23,24,25,34,35): ANT_SEL(1) */
+	PINCTRL_PIN_GROUP("ant_sel", mt7981_ant_sel),
+};
+
+/* Joint those groups owning the same capability in user point of view which
+ * allows that people tend to use through the device tree.
+ */
+static const char *mt7981_wa_aice_groups[] = { "wa_aice1", "wa_aice2", "wm_aice1_1",
+	"wa_aice3", "wm_aice1_2", };
+static const char *mt7981_uart_groups[] = { "wm_uart_0", "uart2_0",
+	"net_wo0_uart_txd_0", "net_wo0_uart_txd_1", "net_wo0_uart_txd_2",
+	"uart1_0", "uart1_1", "uart2_1", "wm_aurt_1", "wm_aurt_2", "uart0", };
+static const char *mt7981_dfd_groups[] = { "dfd", "dfd_ntrst", };
+static const char *mt7981_wdt_groups[] = { "watchdog", "watchdog1", };
+static const char *mt7981_pcie_groups[] = { "pcie_pereset", "pcie_clk", "pcie_wake", };
+static const char *mt7981_jtag_groups[] = { "jtag", "wm_jtag_0", "wo0_jtag_0",
+	"wo0_jtag_1", "wm_jtag_1", };
+static const char *mt7981_led_groups[] = { "gbe_led0", "gbe_led1", "wf2g_led0",
+	"wf2g_led1", "wf5g_led0", "wf5g_led1", };
+static const char *mt7981_pta_groups[] = { "pta_ext_0", "pta_ext_1", };
+static const char *mt7981_pwm_groups[] = { "pwm2", "pwm0_0", "pwm0_1",
+	"pwm1_0", "pwm1_1", };
+static const char *mt7981_spi_groups[] = { "spi1_0", "spi0", "spi0_wp_hold", "spi1_1", "spi2",
+	"spi2_wp_hold", };
+static const char *mt7981_i2c_groups[] = { "i2c0_0", "i2c0_1", "u2_phy_i2c",
+	"sgmii1_phy_i2c", "u3_phy_i2c", "sgmii0_phy_i2c", "i2c0_2", };
+static const char *mt7981_pcm_groups[] = { "pcm", };
+static const char *mt7981_udi_groups[] = { "udi", };
+static const char *mt7981_usb_groups[] = { "drv_vbus", };
+static const char *mt7981_flash_groups[] = { "emmc_45", "snfi", };
+static const char *mt7981_ethernet_groups[] = { "smi_mdc_mdio", "gbe_ext_mdc_mdio",
+	"wf0_mode1", "wf0_mode3", "mt7531_int", };
+static const char *mt7981_ant_groups[] = { "ant_sel", };
+
+static const struct function_desc mt7981_functions[] = {
+	{"wa_aice",	mt7981_wa_aice_groups, ARRAY_SIZE(mt7981_wa_aice_groups)},
+	{"dfd",	mt7981_dfd_groups, ARRAY_SIZE(mt7981_dfd_groups)},
+	{"jtag", mt7981_jtag_groups, ARRAY_SIZE(mt7981_jtag_groups)},
+	{"pta", mt7981_pta_groups, ARRAY_SIZE(mt7981_pta_groups)},
+	{"pcm", mt7981_pcm_groups, ARRAY_SIZE(mt7981_pcm_groups)},
+	{"udi", mt7981_udi_groups, ARRAY_SIZE(mt7981_udi_groups)},
+	{"usb", mt7981_usb_groups, ARRAY_SIZE(mt7981_usb_groups)},
+	{"ant", mt7981_ant_groups, ARRAY_SIZE(mt7981_ant_groups)},
+	{"eth",	mt7981_ethernet_groups, ARRAY_SIZE(mt7981_ethernet_groups)},
+	{"i2c", mt7981_i2c_groups, ARRAY_SIZE(mt7981_i2c_groups)},
+	{"led",	mt7981_led_groups, ARRAY_SIZE(mt7981_led_groups)},
+	{"pwm",	mt7981_pwm_groups, ARRAY_SIZE(mt7981_pwm_groups)},
+	{"spi",	mt7981_spi_groups, ARRAY_SIZE(mt7981_spi_groups)},
+	{"uart", mt7981_uart_groups, ARRAY_SIZE(mt7981_uart_groups)},
+	{"watchdog", mt7981_wdt_groups, ARRAY_SIZE(mt7981_wdt_groups)},
+	{"flash", mt7981_flash_groups, ARRAY_SIZE(mt7981_flash_groups)},
+	{"pcie", mt7981_pcie_groups, ARRAY_SIZE(mt7981_pcie_groups)},
+};
+
+static const struct mtk_eint_hw mt7981_eint_hw = {
+	.port_mask = 7,
+	.ports     = 7,
+	.ap_num    = ARRAY_SIZE(mt7981_pins),
+	.db_cnt    = 16,
+};
+
+static const char * const mt7981_pinctrl_register_base_names[] = {
+	"gpio", "iocfg_rt", "iocfg_rm", "iocfg_rb",
+	"iocfg_lb", "iocfg_bl", "iocfg_tm", "iocfg_tl",
+};
+
+static struct mtk_pin_soc mt7981_data = {
+	.reg_cal = mt7981_reg_cals,
+	.pins = mt7981_pins,
+	.npins = ARRAY_SIZE(mt7981_pins),
+	.grps = mt7981_groups,
+	.ngrps = ARRAY_SIZE(mt7981_groups),
+	.funcs = mt7981_functions,
+	.nfuncs = ARRAY_SIZE(mt7981_functions),
+	.eint_hw = &mt7981_eint_hw,
+	.gpio_m = 0,
+	.ies_present = false,
+	.base_names = mt7981_pinctrl_register_base_names,
+	.nbase_names = ARRAY_SIZE(mt7981_pinctrl_register_base_names),
+	.pull_type = mt7981_pull_type,
+	.bias_set_combo = mtk_pinconf_bias_set_combo,
+	.bias_get_combo = mtk_pinconf_bias_get_combo,
+	.drive_set = mtk_pinconf_drive_set_rev1,
+	.drive_get = mtk_pinconf_drive_get_rev1,
+	.adv_pull_get = mtk_pinconf_adv_pull_get,
+	.adv_pull_set = mtk_pinconf_adv_pull_set,
+};
+
+static const struct of_device_id mt7981_pinctrl_of_match[] = {
+	{ .compatible = "mediatek,mt7981-pinctrl", },
+	{}
+};
+
+static int mt7981_pinctrl_probe(struct platform_device *pdev)
+{
+	return mtk_moore_pinctrl_probe(pdev, &mt7981_data);
+}
+
+static struct platform_driver mt7981_pinctrl_driver = {
+	.driver = {
+		.name = "mt7981-pinctrl",
+		.of_match_table = mt7981_pinctrl_of_match,
+	},
+	.probe = mt7981_pinctrl_probe,
+};
+
+static int __init mt7981_pinctrl_init(void)
+{
+	return platform_driver_register(&mt7981_pinctrl_driver);
+}
+arch_initcall(mt7981_pinctrl_init);
diff --git a/target/linux/mediatek/files-5.15/drivers/pinctrl/mediatek/pinctrl-mt7986.c b/target/linux/mediatek/files-5.15/drivers/pinctrl/mediatek/pinctrl-mt7986.c
index 05a34e721eb36c..aa0ccd67f4f4ea 100644
--- a/target/linux/mediatek/files-5.15/drivers/pinctrl/mediatek/pinctrl-mt7986.c
+++ b/target/linux/mediatek/files-5.15/drivers/pinctrl/mediatek/pinctrl-mt7986.c
@@ -316,10 +316,10 @@ static const struct mtk_pin_field_calc mt7986_pin_pupd_range[] = {
 	PIN_FIELD_BASE(38, 38, IOCFG_LT_BASE, 0x30, 0x10, 9, 1),
 	PIN_FIELD_BASE(39, 40, IOCFG_RB_BASE, 0x60, 0x10, 18, 1),
 	PIN_FIELD_BASE(41, 41, IOCFG_RB_BASE, 0x60, 0x10, 12, 1),
-	PIN_FIELD_BASE(42, 43, IOCFG_RB_BASE, 0x60, 0x10, 22, 1),
-	PIN_FIELD_BASE(44, 45, IOCFG_RB_BASE, 0x60, 0x10, 20, 1),
-	PIN_FIELD_BASE(46, 47, IOCFG_RB_BASE, 0x60, 0x10, 26, 1),
-	PIN_FIELD_BASE(48, 49, IOCFG_RB_BASE, 0x60, 0x10, 24, 1),
+	PIN_FIELD_BASE(42, 43, IOCFG_RB_BASE, 0x60, 0x10, 23, 1),
+	PIN_FIELD_BASE(44, 45, IOCFG_RB_BASE, 0x60, 0x10, 21, 1),
+	PIN_FIELD_BASE(46, 47, IOCFG_RB_BASE, 0x60, 0x10, 27, 1),
+	PIN_FIELD_BASE(48, 49, IOCFG_RB_BASE, 0x60, 0x10, 25, 1),
 	PIN_FIELD_BASE(50, 57, IOCFG_RT_BASE, 0x40, 0x10, 2, 1),
 	PIN_FIELD_BASE(58, 58, IOCFG_RT_BASE, 0x40, 0x10, 1, 1),
 	PIN_FIELD_BASE(59, 59, IOCFG_RT_BASE, 0x40, 0x10, 0, 1),
@@ -354,10 +354,10 @@ static const struct mtk_pin_field_calc mt7986_pin_r0_range[] = {
 	PIN_FIELD_BASE(38, 38, IOCFG_LT_BASE, 0x40, 0x10, 9, 1),
 	PIN_FIELD_BASE(39, 40, IOCFG_RB_BASE, 0x70, 0x10, 18, 1),
 	PIN_FIELD_BASE(41, 41, IOCFG_RB_BASE, 0x70, 0x10, 12, 1),
-	PIN_FIELD_BASE(42, 43, IOCFG_RB_BASE, 0x70, 0x10, 22, 1),
-	PIN_FIELD_BASE(44, 45, IOCFG_RB_BASE, 0x70, 0x10, 20, 1),
-	PIN_FIELD_BASE(46, 47, IOCFG_RB_BASE, 0x70, 0x10, 26, 1),
-	PIN_FIELD_BASE(48, 49, IOCFG_RB_BASE, 0x70, 0x10, 24, 1),
+	PIN_FIELD_BASE(42, 43, IOCFG_RB_BASE, 0x70, 0x10, 23, 1),
+	PIN_FIELD_BASE(44, 45, IOCFG_RB_BASE, 0x70, 0x10, 21, 1),
+	PIN_FIELD_BASE(46, 47, IOCFG_RB_BASE, 0x70, 0x10, 27, 1),
+	PIN_FIELD_BASE(48, 49, IOCFG_RB_BASE, 0x70, 0x10, 25, 1),
 	PIN_FIELD_BASE(50, 57, IOCFG_RT_BASE, 0x50, 0x10, 2, 1),
 	PIN_FIELD_BASE(58, 58, IOCFG_RT_BASE, 0x50, 0x10, 1, 1),
 	PIN_FIELD_BASE(59, 59, IOCFG_RT_BASE, 0x50, 0x10, 0, 1),
@@ -392,10 +392,10 @@ static const struct mtk_pin_field_calc mt7986_pin_r1_range[] = {
 	PIN_FIELD_BASE(38, 38, IOCFG_LT_BASE, 0x50, 0x10, 9, 1),
 	PIN_FIELD_BASE(39, 40, IOCFG_RB_BASE, 0x80, 0x10, 18, 1),
 	PIN_FIELD_BASE(41, 41, IOCFG_RB_BASE, 0x80, 0x10, 12, 1),
-	PIN_FIELD_BASE(42, 43, IOCFG_RB_BASE, 0x80, 0x10, 22, 1),
-	PIN_FIELD_BASE(44, 45, IOCFG_RB_BASE, 0x80, 0x10, 20, 1),
-	PIN_FIELD_BASE(46, 47, IOCFG_RB_BASE, 0x80, 0x10, 26, 1),
-	PIN_FIELD_BASE(48, 49, IOCFG_RB_BASE, 0x80, 0x10, 24, 1),
+	PIN_FIELD_BASE(42, 43, IOCFG_RB_BASE, 0x80, 0x10, 23, 1),
+	PIN_FIELD_BASE(44, 45, IOCFG_RB_BASE, 0x80, 0x10, 21, 1),
+	PIN_FIELD_BASE(46, 47, IOCFG_RB_BASE, 0x80, 0x10, 27, 1),
+	PIN_FIELD_BASE(48, 49, IOCFG_RB_BASE, 0x80, 0x10, 25, 1),
 	PIN_FIELD_BASE(50, 57, IOCFG_RT_BASE, 0x60, 0x10, 2, 1),
 	PIN_FIELD_BASE(58, 58, IOCFG_RT_BASE, 0x60, 0x10, 1, 1),
 	PIN_FIELD_BASE(59, 59, IOCFG_RT_BASE, 0x60, 0x10, 0, 1),
@@ -407,6 +407,60 @@ static const struct mtk_pin_field_calc mt7986_pin_r1_range[] = {
 	PIN_FIELD_BASE(66, 68, IOCFG_LB_BASE, 0x60, 0x10, 2, 1),
 };
 
+static const unsigned int mt7986_pull_type[] = {
+	MTK_PULL_PUPD_R1R0_TYPE,/*0*/ MTK_PULL_PUPD_R1R0_TYPE,/*1*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*2*/ MTK_PULL_PUPD_R1R0_TYPE,/*3*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*4*/ MTK_PULL_PUPD_R1R0_TYPE,/*5*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*6*/ MTK_PULL_PUPD_R1R0_TYPE,/*7*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*8*/ MTK_PULL_PUPD_R1R0_TYPE,/*9*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*10*/ MTK_PULL_PUPD_R1R0_TYPE,/*11*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*12*/ MTK_PULL_PUPD_R1R0_TYPE,/*13*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*14*/ MTK_PULL_PUPD_R1R0_TYPE,/*15*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*16*/ MTK_PULL_PUPD_R1R0_TYPE,/*17*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*18*/ MTK_PULL_PUPD_R1R0_TYPE,/*19*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*20*/ MTK_PULL_PUPD_R1R0_TYPE,/*21*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*22*/ MTK_PULL_PUPD_R1R0_TYPE,/*23*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*24*/ MTK_PULL_PUPD_R1R0_TYPE,/*25*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*26*/ MTK_PULL_PUPD_R1R0_TYPE,/*27*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*28*/ MTK_PULL_PUPD_R1R0_TYPE,/*29*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*30*/ MTK_PULL_PUPD_R1R0_TYPE,/*31*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*32*/ MTK_PULL_PUPD_R1R0_TYPE,/*33*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*34*/ MTK_PULL_PUPD_R1R0_TYPE,/*35*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*36*/ MTK_PULL_PUPD_R1R0_TYPE,/*37*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*38*/ MTK_PULL_PUPD_R1R0_TYPE,/*39*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*40*/ MTK_PULL_PUPD_R1R0_TYPE,/*41*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*42*/ MTK_PULL_PUPD_R1R0_TYPE,/*43*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*44*/ MTK_PULL_PUPD_R1R0_TYPE,/*45*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*46*/ MTK_PULL_PUPD_R1R0_TYPE,/*47*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*48*/ MTK_PULL_PUPD_R1R0_TYPE,/*49*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*50*/ MTK_PULL_PUPD_R1R0_TYPE,/*51*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*52*/ MTK_PULL_PUPD_R1R0_TYPE,/*53*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*54*/ MTK_PULL_PUPD_R1R0_TYPE,/*55*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*56*/ MTK_PULL_PUPD_R1R0_TYPE,/*57*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*58*/ MTK_PULL_PUPD_R1R0_TYPE,/*59*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*60*/ MTK_PULL_PUPD_R1R0_TYPE,/*61*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*62*/ MTK_PULL_PUPD_R1R0_TYPE,/*63*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*64*/ MTK_PULL_PUPD_R1R0_TYPE,/*65*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*66*/ MTK_PULL_PUPD_R1R0_TYPE,/*67*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*68*/ MTK_PULL_PU_PD_TYPE,/*69*/
+	MTK_PULL_PU_PD_TYPE,/*70*/ MTK_PULL_PU_PD_TYPE,/*71*/
+	MTK_PULL_PU_PD_TYPE,/*72*/ MTK_PULL_PU_PD_TYPE,/*73*/
+	MTK_PULL_PU_PD_TYPE,/*74*/ MTK_PULL_PU_PD_TYPE,/*75*/
+	MTK_PULL_PU_PD_TYPE,/*76*/ MTK_PULL_PU_PD_TYPE,/*77*/
+	MTK_PULL_PU_PD_TYPE,/*78*/ MTK_PULL_PU_PD_TYPE,/*79*/
+	MTK_PULL_PU_PD_TYPE,/*80*/ MTK_PULL_PU_PD_TYPE,/*81*/
+	MTK_PULL_PU_PD_TYPE,/*82*/ MTK_PULL_PU_PD_TYPE,/*83*/
+	MTK_PULL_PU_PD_TYPE,/*84*/ MTK_PULL_PU_PD_TYPE,/*85*/
+	MTK_PULL_PU_PD_TYPE,/*86*/ MTK_PULL_PU_PD_TYPE,/*87*/
+	MTK_PULL_PU_PD_TYPE,/*88*/ MTK_PULL_PU_PD_TYPE,/*89*/
+	MTK_PULL_PU_PD_TYPE,/*90*/ MTK_PULL_PU_PD_TYPE,/*91*/
+	MTK_PULL_PU_PD_TYPE,/*92*/ MTK_PULL_PU_PD_TYPE,/*93*/
+	MTK_PULL_PU_PD_TYPE,/*94*/ MTK_PULL_PU_PD_TYPE,/*95*/
+	MTK_PULL_PU_PD_TYPE,/*96*/ MTK_PULL_PU_PD_TYPE,/*97*/
+	MTK_PULL_PU_PD_TYPE,/*98*/ MTK_PULL_PU_PD_TYPE,/*99*/
+	MTK_PULL_PU_PD_TYPE,/*100*/
+};
+
 static const struct mtk_pin_reg_calc mt7986_reg_cals[] = {
 	[PINCTRL_PIN_REG_MODE] = MTK_RANGE(mt7986_pin_mode_range),
 	[PINCTRL_PIN_REG_DIR] = MTK_RANGE(mt7986_pin_dir_range),
@@ -675,11 +729,17 @@ static int mt7986_uart1_1_funcs[] = { 4, 4, 4, 4, };
 static int mt7986_spi1_2_pins[] = { 29, 30, 31, 32, };
 static int mt7986_spi1_2_funcs[] = { 1, 1, 1, 1, };
 
-static int mt7986_uart1_2_pins[] = { 29, 30, 31, 32, };
-static int mt7986_uart1_2_funcs[] = { 3, 3, 3, 3, };
+static int mt7986_uart1_2_rx_tx_pins[] = { 29, 30, };
+static int mt7986_uart1_2_rx_tx_funcs[] = { 3, 3, };
+
+static int mt7986_uart1_2_cts_rts_pins[] = { 31, 32, };
+static int mt7986_uart1_2_cts_rts_funcs[] = { 3, 3, };
+
+static int mt7986_uart2_0_rx_tx_pins[] = { 29, 30, };
+static int mt7986_uart2_0_rx_tx_funcs[] = { 4, 4, };
 
-static int mt7986_uart2_0_pins[] = { 29, 30, 31, 32, };
-static int mt7986_uart2_0_funcs[] = { 4, 4, 4, 4, };
+static int mt7986_uart2_0_cts_rts_pins[] = { 31, 32, };
+static int mt7986_uart2_0_cts_rts_funcs[] = { 4, 4, };
 
 static int mt7986_spi0_pins[] = { 33, 34, 35, 36, };
 static int mt7986_spi0_funcs[] = { 1, 1, 1, 1, };
@@ -708,6 +768,12 @@ static int mt7986_pcie_reset_funcs[] = { 1, };
 static int mt7986_uart1_pins[] = { 42, 43, 44, 45, };
 static int mt7986_uart1_funcs[] = { 1, 1, 1, 1, };
 
+static int mt7986_uart1_rx_tx_pins[] = { 42, 43, };
+static int mt7986_uart1_rx_tx_funcs[] = { 1, 1, };
+
+static int mt7986_uart1_cts_rts_pins[] = { 44, 45, };
+static int mt7986_uart1_cts_rts_funcs[] = { 1, 1, };
+
 static int mt7986_uart2_pins[] = { 46, 47, 48, 49, };
 static int mt7986_uart2_funcs[] = { 1, 1, 1, 1, };
 
@@ -744,14 +810,13 @@ static int mt7986_pcie_clk_funcs[] = { 1, };
 static int mt7986_pcie_wake_pins[] = { 10, };
 static int mt7986_pcie_wake_funcs[] = { 1, };
 
-static int mt7986_jtag_pins[] = { 11, 12, 13, 14, 15};
-static int mt7986_jtag_funcs[] = { 1, 1, 1, 1, 1};
-
 static const struct group_desc mt7986_groups[] = {
 	PINCTRL_PIN_GROUP("watchdog", mt7986_watchdog),
 	PINCTRL_PIN_GROUP("wifi_led", mt7986_wifi_led),
 	PINCTRL_PIN_GROUP("i2c", mt7986_i2c),
 	PINCTRL_PIN_GROUP("uart1_0", mt7986_uart1_0),
+	PINCTRL_PIN_GROUP("uart1_rx_tx", mt7986_uart1_rx_tx),
+	PINCTRL_PIN_GROUP("uart1_cts_rts", mt7986_uart1_cts_rts),
 	PINCTRL_PIN_GROUP("pcie_clk", mt7986_pcie_clk),
 	PINCTRL_PIN_GROUP("pcie_wake", mt7986_pcie_wake),
 	PINCTRL_PIN_GROUP("spi1_0", mt7986_spi1_0),
@@ -763,8 +828,10 @@ static const struct group_desc mt7986_groups[] = {
 	PINCTRL_PIN_GROUP("spi1_1", mt7986_spi1_1),
 	PINCTRL_PIN_GROUP("uart1_1", mt7986_uart1_1),
 	PINCTRL_PIN_GROUP("spi1_2", mt7986_spi1_2),
-	PINCTRL_PIN_GROUP("uart1_2", mt7986_uart1_2),
-	PINCTRL_PIN_GROUP("uart2_0", mt7986_uart2_0),
+	PINCTRL_PIN_GROUP("uart1_2_rx_tx", mt7986_uart1_2_rx_tx),
+	PINCTRL_PIN_GROUP("uart1_2_cts_rts", mt7986_uart1_2_cts_rts),
+	PINCTRL_PIN_GROUP("uart2_0_rx_tx", mt7986_uart2_0_rx_tx),
+	PINCTRL_PIN_GROUP("uart2_0_cts_rts", mt7986_uart2_0_cts_rts),
 	PINCTRL_PIN_GROUP("spi0", mt7986_spi0),
 	PINCTRL_PIN_GROUP("spi0_wp_hold", mt7986_spi0_wp_hold),
 	PINCTRL_PIN_GROUP("uart2_1", mt7986_uart2_1),
@@ -783,7 +850,6 @@ static const struct group_desc mt7986_groups[] = {
 	PINCTRL_PIN_GROUP("wf_2g", mt7986_wf_2g),
 	PINCTRL_PIN_GROUP("wf_5g", mt7986_wf_5g),
 	PINCTRL_PIN_GROUP("wf_dbdc", mt7986_wf_dbdc),
-	PINCTRL_PIN_GROUP("jtag", mt7986_jtag),
 };
 
 /* Joint those groups owning the same capability in user point of view which
@@ -804,12 +870,13 @@ static const char *mt7986_pwm_groups[] = { "pwm0", "pwm1_0", "pwm1_1", };
 static const char *mt7986_spi_groups[] = {
 	"spi0", "spi0_wp_hold", "spi1_0", "spi1_1", "spi1_2", "spi1_3", };
 static const char *mt7986_uart_groups[] = {
-	"uart1_0", "uart1_1", "uart1_2", "uart1_3_rx_tx", "uart1_3_cts_rts",
+	"uart1_0", "uart1_1", "uart1_rx_tx", "uart1_cts_rts",
+	"uart1_2_rx_tx", "uart1_2_cts_rts",
+	"uart1_3_rx_tx", "uart1_3_cts_rts", "uart2_0_rx_tx", "uart2_0_cts_rts",
 	"uart2_0", "uart2_1", "uart0", "uart1", "uart2",
 };
 static const char *mt7986_wdt_groups[] = { "watchdog", };
 static const char *mt7986_wf_groups[] = { "wf_2g", "wf_5g", "wf_dbdc", };
-static const char *mt7986_jtag_groups[] = { "jtag", };
 
 static const struct function_desc mt7986_functions[] = {
 	{"audio", mt7986_audio_groups, ARRAY_SIZE(mt7986_audio_groups)},
@@ -824,7 +891,6 @@ static const struct function_desc mt7986_functions[] = {
 	{"uart", mt7986_uart_groups, ARRAY_SIZE(mt7986_uart_groups)},
 	{"watchdog", mt7986_wdt_groups, ARRAY_SIZE(mt7986_wdt_groups)},
 	{"wifi", mt7986_wf_groups, ARRAY_SIZE(mt7986_wf_groups)},
-	{"jtag", mt7986_jtag_groups, ARRAY_SIZE(mt7986_jtag_groups)},
 };
 
 static const struct mtk_eint_hw mt7986a_eint_hw = {
@@ -832,6 +898,7 @@ static const struct mtk_eint_hw mt7986a_eint_hw = {
 	.ports = 7,
 	.ap_num = ARRAY_SIZE(mt7986a_pins),
 	.db_cnt = 16,
+	.db_time = debounce_time_mt6765,
 };
 
 static const struct mtk_eint_hw mt7986b_eint_hw = {
@@ -839,6 +906,7 @@ static const struct mtk_eint_hw mt7986b_eint_hw = {
 	.ports = 7,
 	.ap_num = ARRAY_SIZE(mt7986b_pins),
 	.db_cnt = 16,
+	.db_time = debounce_time_mt6765,
 };
 
 static struct mtk_pin_soc mt7986a_data = {
@@ -854,6 +922,7 @@ static struct mtk_pin_soc mt7986a_data = {
 	.ies_present = false,
 	.base_names = mt7986_pinctrl_register_base_names,
 	.nbase_names = ARRAY_SIZE(mt7986_pinctrl_register_base_names),
+	.pull_type = mt7986_pull_type,
 	.bias_set_combo = mtk_pinconf_bias_set_combo,
 	.bias_get_combo = mtk_pinconf_bias_get_combo,
 	.drive_set = mtk_pinconf_drive_set_rev1,
@@ -875,6 +944,7 @@ static struct mtk_pin_soc mt7986b_data = {
 	.ies_present = false,
 	.base_names = mt7986_pinctrl_register_base_names,
 	.nbase_names = ARRAY_SIZE(mt7986_pinctrl_register_base_names),
+	.pull_type = mt7986_pull_type,
 	.bias_set_combo = mtk_pinconf_bias_set_combo,
 	.bias_get_combo = mtk_pinconf_bias_get_combo,
 	.drive_set = mtk_pinconf_drive_set_rev1,
diff --git a/target/linux/mediatek/files-5.15/drivers/pinctrl/mediatek/pinctrl-mt7988.c b/target/linux/mediatek/files-5.15/drivers/pinctrl/mediatek/pinctrl-mt7988.c
new file mode 100644
index 00000000000000..80a7e19f7a2d0d
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/drivers/pinctrl/mediatek/pinctrl-mt7988.c
@@ -0,0 +1,1281 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * The MT7988 driver based on Linux generic pinctrl binding.
+ *
+ * Copyright (C) 2020 MediaTek Inc.
+ * Author: Sam Shih <sam.shih@mediatek.com>
+ */
+
+#include "pinctrl-moore.h"
+
+enum MT7988_PINCTRL_REG_PAGE {
+	GPIO_BASE,
+	IOCFG_TR_BASE,
+	IOCFG_BR_BASE,
+	IOCFG_RB_BASE,
+	IOCFG_LB_BASE,
+	IOCFG_TL_BASE,
+};
+
+#define MT7988_PIN(_number, _name) MTK_PIN(_number, _name, 0, _number, DRV_GRP4)
+
+#define PIN_FIELD_BASE(_s_pin, _e_pin, _i_base, _s_addr, _x_addrs, _s_bit,     \
+		       _x_bits)                                                \
+	PIN_FIELD_CALC(_s_pin, _e_pin, _i_base, _s_addr, _x_addrs, _s_bit,     \
+		       _x_bits, 32, 0)
+
+#define PINS_FIELD_BASE(_s_pin, _e_pin, _i_base, _s_addr, _x_addrs, _s_bit,    \
+			_x_bits)                                               \
+	PIN_FIELD_CALC(_s_pin, _e_pin, _i_base, _s_addr, _x_addrs, _s_bit,     \
+		       _x_bits, 32, 1)
+
+static const struct mtk_pin_field_calc mt7988_pin_mode_range[] = {
+	PIN_FIELD(0, 83, 0x300, 0x10, 0, 4),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_dir_range[] = {
+	PIN_FIELD(0, 83, 0x0, 0x10, 0, 1),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_di_range[] = {
+	PIN_FIELD(0, 83, 0x200, 0x10, 0, 1),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_do_range[] = {
+	PIN_FIELD(0, 83, 0x100, 0x10, 0, 1),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_ies_range[] = {
+	PIN_FIELD_BASE(0, 1, 5, 0x30, 0x10, 13, 1),
+	PIN_FIELD_BASE(2, 3, 5, 0x30, 0x10, 11, 1),
+	PIN_FIELD_BASE(4, 4, 5, 0x30, 0x10, 0, 1),
+	PIN_FIELD_BASE(5, 6, 5, 0x30, 0x10, 9, 1),
+	PIN_FIELD_BASE(7, 7, 4, 0x30, 0x10, 8, 1),
+	PIN_FIELD_BASE(8, 8, 4, 0x30, 0x10, 6, 1),
+	PIN_FIELD_BASE(9, 9, 4, 0x30, 0x10, 5, 1),
+	PIN_FIELD_BASE(10, 10, 4, 0x30, 0x10, 3, 1),
+	PIN_FIELD_BASE(11, 11, 1, 0x40, 0x10, 0, 1),
+	PIN_FIELD_BASE(12, 12, 1, 0x40, 0x10, 21, 1),
+	PIN_FIELD_BASE(13, 14, 1, 0x40, 0x10, 1, 1),
+	PIN_FIELD_BASE(15, 16, 5, 0x30, 0x10, 7, 1),
+	PIN_FIELD_BASE(17, 18, 5, 0x30, 0x10, 3, 1),
+	PIN_FIELD_BASE(19, 19, 4, 0x30, 0x10, 7, 1),
+	PIN_FIELD_BASE(20, 20, 4, 0x30, 0x10, 4, 1),
+	PIN_FIELD_BASE(21, 21, 3, 0x50, 0x10, 17, 1),
+	PIN_FIELD_BASE(22, 22, 3, 0x50, 0x10, 23, 1),
+	PIN_FIELD_BASE(23, 23, 3, 0x50, 0x10, 20, 1),
+	PIN_FIELD_BASE(24, 24, 3, 0x50, 0x10, 19, 1),
+	PIN_FIELD_BASE(25, 26, 3, 0x50, 0x10, 21, 1),
+	PIN_FIELD_BASE(27, 27, 3, 0x50, 0x10, 18, 1),
+	PIN_FIELD_BASE(28, 30, 3, 0x50, 0x10, 25, 1),
+	PIN_FIELD_BASE(31, 31, 3, 0x50, 0x10, 24, 1),
+	PIN_FIELD_BASE(32, 32, 3, 0x50, 0x10, 28, 1),
+	PIN_FIELD_BASE(33, 33, 3, 0x60, 0x10, 0, 1),
+	PIN_FIELD_BASE(34, 34, 3, 0x50, 0x10, 31, 1),
+	PIN_FIELD_BASE(35, 36, 3, 0x50, 0x10, 29, 1),
+	PIN_FIELD_BASE(37, 37, 3, 0x60, 0x10, 1, 1),
+	PIN_FIELD_BASE(38, 38, 3, 0x50, 0x10, 11, 1),
+	PIN_FIELD_BASE(39, 39, 3, 0x50, 0x10, 10, 1),
+	PIN_FIELD_BASE(40, 41, 3, 0x50, 0x10, 0, 1),
+	PIN_FIELD_BASE(42, 42, 3, 0x50, 0x10, 9, 1),
+	PIN_FIELD_BASE(43, 43, 3, 0x50, 0x10, 8, 1),
+	PIN_FIELD_BASE(44, 44, 3, 0x50, 0x10, 7, 1),
+	PIN_FIELD_BASE(45, 45, 3, 0x50, 0x10, 6, 1),
+	PIN_FIELD_BASE(46, 46, 3, 0x50, 0x10, 5, 1),
+	PIN_FIELD_BASE(47, 47, 3, 0x50, 0x10, 4, 1),
+	PIN_FIELD_BASE(48, 48, 3, 0x50, 0x10, 3, 1),
+	PIN_FIELD_BASE(49, 49, 3, 0x50, 0x10, 2, 1),
+	PIN_FIELD_BASE(50, 50, 3, 0x50, 0x10, 15, 1),
+	PIN_FIELD_BASE(51, 53, 3, 0x50, 0x10, 12, 1),
+	PIN_FIELD_BASE(54, 54, 3, 0x50, 0x10, 16, 1),
+	PIN_FIELD_BASE(55, 56, 1, 0x40, 0x10, 14, 1),
+	PIN_FIELD_BASE(57, 57, 1, 0x40, 0x10, 13, 1),
+	PIN_FIELD_BASE(58, 60, 1, 0x40, 0x10, 4, 1),
+	PIN_FIELD_BASE(61, 61, 1, 0x40, 0x10, 3, 1),
+	PIN_FIELD_BASE(62, 62, 1, 0x40, 0x10, 7, 1),
+	PIN_FIELD_BASE(63, 63, 1, 0x40, 0x10, 20, 1),
+	PIN_FIELD_BASE(64, 68, 1, 0x40, 0x10, 8, 1),
+	PIN_FIELD_BASE(69, 70, 5, 0x30, 0x10, 1, 1),
+	PIN_FIELD_BASE(71, 72, 5, 0x30, 0x10, 5, 1),
+	PIN_FIELD_BASE(73, 73, 4, 0x30, 0x10, 10, 1),
+	PIN_FIELD_BASE(74, 74, 4, 0x30, 0x10, 1, 1),
+	PIN_FIELD_BASE(75, 75, 4, 0x30, 0x10, 11, 1),
+	PIN_FIELD_BASE(76, 76, 4, 0x30, 0x10, 9, 1),
+	PIN_FIELD_BASE(77, 77, 4, 0x30, 0x10, 2, 1),
+	PIN_FIELD_BASE(78, 78, 4, 0x30, 0x10, 0, 1),
+	PIN_FIELD_BASE(79, 79, 4, 0x30, 0x10, 12, 1),
+	PIN_FIELD_BASE(80, 81, 1, 0x40, 0x10, 18, 1),
+	PIN_FIELD_BASE(82, 83, 1, 0x40, 0x10, 16, 1),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_smt_range[] = {
+	PIN_FIELD_BASE(0, 1, 5, 0xc0, 0x10, 13, 1),
+	PIN_FIELD_BASE(2, 3, 5, 0xc0, 0x10, 11, 1),
+	PIN_FIELD_BASE(4, 4, 5, 0xc0, 0x10, 0, 1),
+	PIN_FIELD_BASE(5, 6, 5, 0xc0, 0x10, 9, 1),
+	PIN_FIELD_BASE(7, 7, 4, 0xb0, 0x10, 8, 1),
+	PIN_FIELD_BASE(8, 8, 4, 0xb0, 0x10, 6, 1),
+	PIN_FIELD_BASE(9, 9, 4, 0xb0, 0x10, 5, 1),
+	PIN_FIELD_BASE(10, 10, 4, 0xb0, 0x10, 3, 1),
+	PIN_FIELD_BASE(11, 11, 1, 0xe0, 0x10, 0, 1),
+	PIN_FIELD_BASE(12, 12, 1, 0xe0, 0x10, 21, 1),
+	PIN_FIELD_BASE(13, 14, 1, 0xe0, 0x10, 1, 1),
+	PIN_FIELD_BASE(15, 16, 5, 0xc0, 0x10, 7, 1),
+	PIN_FIELD_BASE(17, 18, 5, 0xc0, 0x10, 3, 1),
+	PIN_FIELD_BASE(19, 19, 4, 0xb0, 0x10, 7, 1),
+	PIN_FIELD_BASE(20, 20, 4, 0xb0, 0x10, 4, 1),
+	PIN_FIELD_BASE(21, 21, 3, 0x140, 0x10, 17, 1),
+	PIN_FIELD_BASE(22, 22, 3, 0x140, 0x10, 23, 1),
+	PIN_FIELD_BASE(23, 23, 3, 0x140, 0x10, 20, 1),
+	PIN_FIELD_BASE(24, 24, 3, 0x140, 0x10, 19, 1),
+	PIN_FIELD_BASE(25, 26, 3, 0x140, 0x10, 21, 1),
+	PIN_FIELD_BASE(27, 27, 3, 0x140, 0x10, 18, 1),
+	PIN_FIELD_BASE(28, 30, 3, 0x140, 0x10, 25, 1),
+	PIN_FIELD_BASE(31, 31, 3, 0x140, 0x10, 24, 1),
+	PIN_FIELD_BASE(32, 32, 3, 0x140, 0x10, 28, 1),
+	PIN_FIELD_BASE(33, 33, 3, 0x150, 0x10, 0, 1),
+	PIN_FIELD_BASE(34, 34, 3, 0x140, 0x10, 31, 1),
+	PIN_FIELD_BASE(35, 36, 3, 0x140, 0x10, 29, 1),
+	PIN_FIELD_BASE(37, 37, 3, 0x150, 0x10, 1, 1),
+	PIN_FIELD_BASE(38, 38, 3, 0x140, 0x10, 11, 1),
+	PIN_FIELD_BASE(39, 39, 3, 0x140, 0x10, 10, 1),
+	PIN_FIELD_BASE(40, 41, 3, 0x140, 0x10, 0, 1),
+	PIN_FIELD_BASE(42, 42, 3, 0x140, 0x10, 9, 1),
+	PIN_FIELD_BASE(43, 43, 3, 0x140, 0x10, 8, 1),
+	PIN_FIELD_BASE(44, 44, 3, 0x140, 0x10, 7, 1),
+	PIN_FIELD_BASE(45, 45, 3, 0x140, 0x10, 6, 1),
+	PIN_FIELD_BASE(46, 46, 3, 0x140, 0x10, 5, 1),
+	PIN_FIELD_BASE(47, 47, 3, 0x140, 0x10, 4, 1),
+	PIN_FIELD_BASE(48, 48, 3, 0x140, 0x10, 3, 1),
+	PIN_FIELD_BASE(49, 49, 3, 0x140, 0x10, 2, 1),
+	PIN_FIELD_BASE(50, 50, 3, 0x140, 0x10, 15, 1),
+	PIN_FIELD_BASE(51, 53, 3, 0x140, 0x10, 12, 1),
+	PIN_FIELD_BASE(54, 54, 3, 0x140, 0x10, 16, 1),
+	PIN_FIELD_BASE(55, 56, 1, 0xe0, 0x10, 14, 1),
+	PIN_FIELD_BASE(57, 57, 1, 0xe0, 0x10, 13, 1),
+	PIN_FIELD_BASE(58, 60, 1, 0xe0, 0x10, 4, 1),
+	PIN_FIELD_BASE(61, 61, 1, 0xe0, 0x10, 3, 1),
+	PIN_FIELD_BASE(62, 62, 1, 0xe0, 0x10, 7, 1),
+	PIN_FIELD_BASE(63, 63, 1, 0xe0, 0x10, 20, 1),
+	PIN_FIELD_BASE(64, 68, 1, 0xe0, 0x10, 8, 1),
+	PIN_FIELD_BASE(69, 70, 5, 0xc0, 0x10, 1, 1),
+	PIN_FIELD_BASE(71, 72, 5, 0xc0, 0x10, 5, 1),
+	PIN_FIELD_BASE(73, 73, 4, 0xb0, 0x10, 10, 1),
+	PIN_FIELD_BASE(74, 74, 4, 0xb0, 0x10, 1, 1),
+	PIN_FIELD_BASE(75, 75, 4, 0xb0, 0x10, 11, 1),
+	PIN_FIELD_BASE(76, 76, 4, 0xb0, 0x10, 9, 1),
+	PIN_FIELD_BASE(77, 77, 4, 0xb0, 0x10, 2, 1),
+	PIN_FIELD_BASE(78, 78, 4, 0xb0, 0x10, 0, 1),
+	PIN_FIELD_BASE(79, 79, 4, 0xb0, 0x10, 12, 1),
+	PIN_FIELD_BASE(80, 81, 1, 0xe0, 0x10, 18, 1),
+	PIN_FIELD_BASE(82, 83, 1, 0xe0, 0x10, 16, 1),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_pu_range[] = {
+	PIN_FIELD_BASE(7, 7, 4, 0x60, 0x10, 5, 1),
+	PIN_FIELD_BASE(8, 8, 4, 0x60, 0x10, 4, 1),
+	PIN_FIELD_BASE(9, 9, 4, 0x60, 0x10, 3, 1),
+	PIN_FIELD_BASE(10, 10, 4, 0x60, 0x10, 2, 1),
+	PIN_FIELD_BASE(13, 14, 1, 0x70, 0x10, 0, 1),
+	PIN_FIELD_BASE(63, 63, 1, 0x70, 0x10, 2, 1),
+	PIN_FIELD_BASE(75, 75, 4, 0x60, 0x10, 7, 1),
+	PIN_FIELD_BASE(76, 76, 4, 0x60, 0x10, 6, 1),
+	PIN_FIELD_BASE(77, 77, 4, 0x60, 0x10, 1, 1),
+	PIN_FIELD_BASE(78, 78, 4, 0x60, 0x10, 0, 1),
+	PIN_FIELD_BASE(79, 79, 4, 0x60, 0x10, 8, 1),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_pd_range[] = {
+	PIN_FIELD_BASE(7, 7, 4, 0x40, 0x10, 5, 1),
+	PIN_FIELD_BASE(8, 8, 4, 0x40, 0x10, 4, 1),
+	PIN_FIELD_BASE(9, 9, 4, 0x40, 0x10, 3, 1),
+	PIN_FIELD_BASE(10, 10, 4, 0x40, 0x10, 2, 1),
+	PIN_FIELD_BASE(13, 14, 1, 0x50, 0x10, 0, 1),
+	PIN_FIELD_BASE(15, 16, 5, 0x40, 0x10, 4, 1),
+	PIN_FIELD_BASE(17, 18, 5, 0x40, 0x10, 0, 1),
+	PIN_FIELD_BASE(63, 63, 1, 0x50, 0x10, 2, 1),
+	PIN_FIELD_BASE(71, 72, 5, 0x40, 0x10, 2, 1),
+	PIN_FIELD_BASE(75, 75, 4, 0x40, 0x10, 7, 1),
+	PIN_FIELD_BASE(76, 76, 4, 0x40, 0x10, 6, 1),
+	PIN_FIELD_BASE(77, 77, 4, 0x40, 0x10, 1, 1),
+	PIN_FIELD_BASE(78, 78, 4, 0x40, 0x10, 0, 1),
+	PIN_FIELD_BASE(79, 79, 4, 0x40, 0x10, 8, 1),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_drv_range[] = {
+	PIN_FIELD_BASE(0, 1, 5, 0x00, 0x10, 21, 3),
+	PIN_FIELD_BASE(2, 3, 5, 0x00, 0x10, 15, 3),
+	PIN_FIELD_BASE(4, 4, 5, 0x00, 0x10, 0, 3),
+	PIN_FIELD_BASE(5, 6, 5, 0x00, 0x10, 9, 3),
+	PIN_FIELD_BASE(7, 7, 4, 0x00, 0x10, 24, 3),
+	PIN_FIELD_BASE(8, 8, 4, 0x00, 0x10, 28, 3),
+	PIN_FIELD_BASE(9, 9, 4, 0x00, 0x10, 15, 3),
+	PIN_FIELD_BASE(10, 10, 4, 0x00, 0x10, 9, 3),
+	PIN_FIELD_BASE(11, 11, 1, 0x00, 0x10, 0, 3),
+	PIN_FIELD_BASE(12, 12, 1, 0x20, 0x10, 3, 3),
+	PIN_FIELD_BASE(13, 14, 1, 0x00, 0x10, 3, 3),
+	PIN_FIELD_BASE(19, 19, 4, 0x00, 0x10, 21, 3),
+	PIN_FIELD_BASE(20, 20, 4, 0x00, 0x10, 12, 3),
+	PIN_FIELD_BASE(21, 21, 3, 0x10, 0x10, 21, 3),
+	PIN_FIELD_BASE(22, 22, 3, 0x20, 0x10, 9, 3),
+	PIN_FIELD_BASE(23, 23, 3, 0x20, 0x10, 0, 3),
+	PIN_FIELD_BASE(24, 24, 3, 0x10, 0x10, 27, 3),
+	PIN_FIELD_BASE(25, 26, 3, 0x20, 0x10, 3, 3),
+	PIN_FIELD_BASE(27, 27, 3, 0x10, 0x10, 24, 3),
+	PIN_FIELD_BASE(28, 30, 3, 0x20, 0x10, 15, 3),
+	PIN_FIELD_BASE(31, 31, 3, 0x20, 0x10, 12, 3),
+	PIN_FIELD_BASE(32, 32, 3, 0x20, 0x10, 24, 3),
+	PIN_FIELD_BASE(33, 33, 3, 0x30, 0x10, 6, 3),
+	PIN_FIELD_BASE(34, 34, 3, 0x30, 0x10, 3, 3),
+	PIN_FIELD_BASE(35, 35, 3, 0x20, 0x10, 27, 3),
+	PIN_FIELD_BASE(36, 36, 3, 0x30, 0x10, 0, 3),
+	PIN_FIELD_BASE(37, 37, 3, 0x30, 0x10, 9, 3),
+	PIN_FIELD_BASE(38, 38, 3, 0x10, 0x10, 3, 3),
+	PIN_FIELD_BASE(39, 39, 3, 0x10, 0x10, 0, 3),
+	PIN_FIELD_BASE(40, 41, 3, 0x00, 0x10, 0, 3),
+	PIN_FIELD_BASE(42, 42, 3, 0x00, 0x10, 27, 3),
+	PIN_FIELD_BASE(43, 43, 3, 0x00, 0x10, 24, 3),
+	PIN_FIELD_BASE(44, 44, 3, 0x00, 0x10, 21, 3),
+	PIN_FIELD_BASE(45, 45, 3, 0x00, 0x10, 18, 3),
+	PIN_FIELD_BASE(46, 46, 3, 0x00, 0x10, 15, 3),
+	PIN_FIELD_BASE(47, 47, 3, 0x00, 0x10, 12, 3),
+	PIN_FIELD_BASE(48, 48, 3, 0x00, 0x10, 9, 3),
+	PIN_FIELD_BASE(49, 49, 3, 0x00, 0x10, 6, 3),
+	PIN_FIELD_BASE(50, 50, 3, 0x10, 0x10, 15, 3),
+	PIN_FIELD_BASE(51, 53, 3, 0x10, 0x10, 6, 3),
+	PIN_FIELD_BASE(54, 54, 3, 0x10, 0x10, 18, 3),
+	PIN_FIELD_BASE(55, 56, 1, 0x10, 0x10, 12, 3),
+	PIN_FIELD_BASE(57, 57, 1, 0x10, 0x10, 9, 3),
+	PIN_FIELD_BASE(58, 60, 1, 0x00, 0x10, 12, 3),
+	PIN_FIELD_BASE(61, 61, 1, 0x00, 0x10, 9, 3),
+	PIN_FIELD_BASE(62, 62, 1, 0x00, 0x10, 21, 3),
+	PIN_FIELD_BASE(63, 63, 1, 0x20, 0x10, 0, 3),
+	PIN_FIELD_BASE(64, 65, 1, 0x00, 0x10, 24, 3),
+	PIN_FIELD_BASE(66, 68, 1, 0x10, 0x10, 0, 3),
+	PIN_FIELD_BASE(69, 70, 5, 0x00, 0x10, 3, 3),
+	PIN_FIELD_BASE(73, 73, 4, 0x10, 0x10, 0, 3),
+	PIN_FIELD_BASE(74, 74, 4, 0x00, 0x10, 3, 3),
+	PIN_FIELD_BASE(75, 75, 4, 0x10, 0x10, 3, 3),
+	PIN_FIELD_BASE(76, 76, 4, 0x00, 0x10, 27, 3),
+	PIN_FIELD_BASE(77, 77, 4, 0x00, 0x10, 6, 3),
+	PIN_FIELD_BASE(78, 78, 4, 0x00, 0x10, 0, 3),
+	PIN_FIELD_BASE(79, 79, 4, 0x10, 0x10, 6, 3),
+	PIN_FIELD_BASE(80, 81, 1, 0x10, 0x10, 24, 3),
+	PIN_FIELD_BASE(82, 83, 1, 0x10, 0x10, 18, 3),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_pupd_range[] = {
+	PIN_FIELD_BASE(0, 1, 5, 0x50, 0x10, 7, 1),
+	PIN_FIELD_BASE(2, 3, 5, 0x50, 0x10, 5, 1),
+	PIN_FIELD_BASE(4, 4, 5, 0x50, 0x10, 0, 1),
+	PIN_FIELD_BASE(5, 6, 5, 0x50, 0x10, 3, 1),
+	PIN_FIELD_BASE(11, 11, 1, 0x60, 0x10, 0, 1),
+	PIN_FIELD_BASE(12, 12, 1, 0x60, 0x10, 18, 1),
+	PIN_FIELD_BASE(19, 19, 4, 0x50, 0x10, 2, 1),
+	PIN_FIELD_BASE(20, 20, 4, 0x50, 0x10, 1, 1),
+	PIN_FIELD_BASE(21, 21, 3, 0x70, 0x10, 17, 1),
+	PIN_FIELD_BASE(22, 22, 3, 0x70, 0x10, 23, 1),
+	PIN_FIELD_BASE(23, 23, 3, 0x70, 0x10, 20, 1),
+	PIN_FIELD_BASE(24, 24, 3, 0x70, 0x10, 19, 1),
+	PIN_FIELD_BASE(25, 26, 3, 0x70, 0x10, 21, 1),
+	PIN_FIELD_BASE(27, 27, 3, 0x70, 0x10, 18, 1),
+	PIN_FIELD_BASE(28, 30, 3, 0x70, 0x10, 25, 1),
+	PIN_FIELD_BASE(31, 31, 3, 0x70, 0x10, 24, 1),
+	PIN_FIELD_BASE(32, 32, 3, 0x70, 0x10, 28, 1),
+	PIN_FIELD_BASE(33, 33, 3, 0x80, 0x10, 0, 1),
+	PIN_FIELD_BASE(34, 34, 3, 0x70, 0x10, 31, 1),
+	PIN_FIELD_BASE(35, 36, 3, 0x70, 0x10, 29, 1),
+	PIN_FIELD_BASE(37, 37, 3, 0x80, 0x10, 1, 1),
+	PIN_FIELD_BASE(38, 38, 3, 0x70, 0x10, 11, 1),
+	PIN_FIELD_BASE(39, 39, 3, 0x70, 0x10, 10, 1),
+	PIN_FIELD_BASE(40, 41, 3, 0x70, 0x10, 0, 1),
+	PIN_FIELD_BASE(42, 42, 3, 0x70, 0x10, 9, 1),
+	PIN_FIELD_BASE(43, 43, 3, 0x70, 0x10, 8, 1),
+	PIN_FIELD_BASE(44, 44, 3, 0x70, 0x10, 7, 1),
+	PIN_FIELD_BASE(45, 45, 3, 0x70, 0x10, 6, 1),
+	PIN_FIELD_BASE(46, 46, 3, 0x70, 0x10, 5, 1),
+	PIN_FIELD_BASE(47, 47, 3, 0x70, 0x10, 4, 1),
+	PIN_FIELD_BASE(48, 48, 3, 0x70, 0x10, 3, 1),
+	PIN_FIELD_BASE(49, 49, 3, 0x70, 0x10, 2, 1),
+	PIN_FIELD_BASE(50, 50, 3, 0x70, 0x10, 15, 1),
+	PIN_FIELD_BASE(51, 53, 3, 0x70, 0x10, 12, 1),
+	PIN_FIELD_BASE(54, 54, 3, 0x70, 0x10, 16, 1),
+	PIN_FIELD_BASE(55, 56, 1, 0x60, 0x10, 12, 1),
+	PIN_FIELD_BASE(57, 57, 1, 0x60, 0x10, 11, 1),
+	PIN_FIELD_BASE(58, 60, 1, 0x60, 0x10, 2, 1),
+	PIN_FIELD_BASE(61, 61, 1, 0x60, 0x10, 1, 1),
+	PIN_FIELD_BASE(62, 62, 1, 0x60, 0x10, 5, 1),
+	PIN_FIELD_BASE(64, 68, 1, 0x60, 0x10, 6, 1),
+	PIN_FIELD_BASE(69, 70, 5, 0x50, 0x10, 1, 1),
+	PIN_FIELD_BASE(73, 73, 4, 0x50, 0x10, 3, 1),
+	PIN_FIELD_BASE(74, 74, 4, 0x50, 0x10, 0, 1),
+	PIN_FIELD_BASE(80, 81, 1, 0x60, 0x10, 16, 1),
+	PIN_FIELD_BASE(82, 83, 1, 0x60, 0x10, 14, 1),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_r0_range[] = {
+	PIN_FIELD_BASE(0, 1, 5, 0x60, 0x10, 7, 1),
+	PIN_FIELD_BASE(2, 3, 5, 0x60, 0x10, 5, 1),
+	PIN_FIELD_BASE(4, 4, 5, 0x60, 0x10, 0, 1),
+	PIN_FIELD_BASE(5, 6, 5, 0x60, 0x10, 3, 1),
+	PIN_FIELD_BASE(11, 11, 1, 0x80, 0x10, 0, 1),
+	PIN_FIELD_BASE(12, 12, 1, 0x80, 0x10, 18, 1),
+	PIN_FIELD_BASE(19, 19, 4, 0x70, 0x10, 2, 1),
+	PIN_FIELD_BASE(20, 20, 4, 0x70, 0x10, 1, 1),
+	PIN_FIELD_BASE(21, 21, 3, 0x90, 0x10, 17, 1),
+	PIN_FIELD_BASE(22, 22, 3, 0x90, 0x10, 23, 1),
+	PIN_FIELD_BASE(23, 23, 3, 0x90, 0x10, 20, 1),
+	PIN_FIELD_BASE(24, 24, 3, 0x90, 0x10, 19, 1),
+	PIN_FIELD_BASE(25, 26, 3, 0x90, 0x10, 21, 1),
+	PIN_FIELD_BASE(27, 27, 3, 0x90, 0x10, 18, 1),
+	PIN_FIELD_BASE(28, 30, 3, 0x90, 0x10, 25, 1),
+	PIN_FIELD_BASE(31, 31, 3, 0x90, 0x10, 24, 1),
+	PIN_FIELD_BASE(32, 32, 3, 0x90, 0x10, 28, 1),
+	PIN_FIELD_BASE(33, 33, 3, 0xa0, 0x10, 0, 1),
+	PIN_FIELD_BASE(34, 34, 3, 0x90, 0x10, 31, 1),
+	PIN_FIELD_BASE(35, 36, 3, 0x90, 0x10, 29, 1),
+	PIN_FIELD_BASE(37, 37, 3, 0xa0, 0x10, 1, 1),
+	PIN_FIELD_BASE(38, 38, 3, 0x90, 0x10, 11, 1),
+	PIN_FIELD_BASE(39, 39, 3, 0x90, 0x10, 10, 1),
+	PIN_FIELD_BASE(40, 41, 3, 0x90, 0x10, 0, 1),
+	PIN_FIELD_BASE(42, 42, 3, 0x90, 0x10, 9, 1),
+	PIN_FIELD_BASE(43, 43, 3, 0x90, 0x10, 8, 1),
+	PIN_FIELD_BASE(44, 44, 3, 0x90, 0x10, 7, 1),
+	PIN_FIELD_BASE(45, 45, 3, 0x90, 0x10, 6, 1),
+	PIN_FIELD_BASE(46, 46, 3, 0x90, 0x10, 5, 1),
+	PIN_FIELD_BASE(47, 47, 3, 0x90, 0x10, 4, 1),
+	PIN_FIELD_BASE(48, 48, 3, 0x90, 0x10, 3, 1),
+	PIN_FIELD_BASE(49, 49, 3, 0x90, 0x10, 2, 1),
+	PIN_FIELD_BASE(50, 50, 3, 0x90, 0x10, 15, 1),
+	PIN_FIELD_BASE(51, 53, 3, 0x90, 0x10, 12, 1),
+	PIN_FIELD_BASE(54, 54, 3, 0x90, 0x10, 16, 1),
+	PIN_FIELD_BASE(55, 56, 1, 0x80, 0x10, 12, 1),
+	PIN_FIELD_BASE(57, 57, 1, 0x80, 0x10, 11, 1),
+	PIN_FIELD_BASE(58, 60, 1, 0x80, 0x10, 2, 1),
+	PIN_FIELD_BASE(61, 61, 1, 0x80, 0x10, 1, 1),
+	PIN_FIELD_BASE(62, 62, 1, 0x80, 0x10, 5, 1),
+	PIN_FIELD_BASE(64, 68, 1, 0x80, 0x10, 6, 1),
+	PIN_FIELD_BASE(69, 70, 5, 0x60, 0x10, 1, 1),
+	PIN_FIELD_BASE(73, 73, 4, 0x70, 0x10, 3, 1),
+	PIN_FIELD_BASE(74, 74, 4, 0x70, 0x10, 0, 1),
+	PIN_FIELD_BASE(80, 81, 1, 0x80, 0x10, 16, 1),
+	PIN_FIELD_BASE(82, 83, 1, 0x80, 0x10, 14, 1),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_r1_range[] = {
+	PIN_FIELD_BASE(0, 1, 5, 0x70, 0x10, 7, 1),
+	PIN_FIELD_BASE(2, 3, 5, 0x70, 0x10, 5, 1),
+	PIN_FIELD_BASE(4, 4, 5, 0x70, 0x10, 0, 1),
+	PIN_FIELD_BASE(5, 6, 5, 0x70, 0x10, 3, 1),
+	PIN_FIELD_BASE(11, 11, 1, 0x90, 0x10, 0, 1),
+	PIN_FIELD_BASE(12, 12, 1, 0x90, 0x10, 18, 1),
+	PIN_FIELD_BASE(19, 19, 4, 0x80, 0x10, 2, 1),
+	PIN_FIELD_BASE(20, 20, 4, 0x80, 0x10, 1, 1),
+	PIN_FIELD_BASE(21, 21, 3, 0xb0, 0x10, 17, 1),
+	PIN_FIELD_BASE(22, 22, 3, 0xb0, 0x10, 23, 1),
+	PIN_FIELD_BASE(23, 23, 3, 0xb0, 0x10, 20, 1),
+	PIN_FIELD_BASE(24, 24, 3, 0xb0, 0x10, 19, 1),
+	PIN_FIELD_BASE(25, 26, 3, 0xb0, 0x10, 21, 1),
+	PIN_FIELD_BASE(27, 27, 3, 0xb0, 0x10, 18, 1),
+	PIN_FIELD_BASE(28, 30, 3, 0xb0, 0x10, 25, 1),
+	PIN_FIELD_BASE(31, 31, 3, 0xb0, 0x10, 24, 1),
+	PIN_FIELD_BASE(32, 32, 3, 0xb0, 0x10, 28, 1),
+	PIN_FIELD_BASE(33, 33, 3, 0xc0, 0x10, 0, 1),
+	PIN_FIELD_BASE(34, 34, 3, 0xb0, 0x10, 31, 1),
+	PIN_FIELD_BASE(35, 36, 3, 0xb0, 0x10, 29, 1),
+	PIN_FIELD_BASE(37, 37, 3, 0xc0, 0x10, 1, 1),
+	PIN_FIELD_BASE(38, 38, 3, 0xb0, 0x10, 11, 1),
+	PIN_FIELD_BASE(39, 39, 3, 0xb0, 0x10, 10, 1),
+	PIN_FIELD_BASE(40, 41, 3, 0xb0, 0x10, 0, 1),
+	PIN_FIELD_BASE(42, 42, 3, 0xb0, 0x10, 9, 1),
+	PIN_FIELD_BASE(43, 43, 3, 0xb0, 0x10, 8, 1),
+	PIN_FIELD_BASE(44, 44, 3, 0xb0, 0x10, 7, 1),
+	PIN_FIELD_BASE(45, 45, 3, 0xb0, 0x10, 6, 1),
+	PIN_FIELD_BASE(46, 46, 3, 0xb0, 0x10, 5, 1),
+	PIN_FIELD_BASE(47, 47, 3, 0xb0, 0x10, 4, 1),
+	PIN_FIELD_BASE(48, 48, 3, 0xb0, 0x10, 3, 1),
+	PIN_FIELD_BASE(49, 49, 3, 0xb0, 0x10, 2, 1),
+	PIN_FIELD_BASE(50, 50, 3, 0xb0, 0x10, 15, 1),
+	PIN_FIELD_BASE(51, 53, 3, 0xb0, 0x10, 12, 1),
+	PIN_FIELD_BASE(54, 54, 3, 0xb0, 0x10, 16, 1),
+	PIN_FIELD_BASE(55, 56, 1, 0x90, 0x10, 12, 1),
+	PIN_FIELD_BASE(57, 57, 1, 0x90, 0x10, 11, 1),
+	PIN_FIELD_BASE(58, 60, 1, 0x90, 0x10, 2, 1),
+	PIN_FIELD_BASE(61, 61, 1, 0x90, 0x10, 1, 1),
+	PIN_FIELD_BASE(62, 62, 1, 0x90, 0x10, 5, 1),
+	PIN_FIELD_BASE(64, 68, 1, 0x90, 0x10, 6, 1),
+	PIN_FIELD_BASE(69, 70, 5, 0x70, 0x10, 1, 1),
+	PIN_FIELD_BASE(73, 73, 4, 0x80, 0x10, 3, 1),
+	PIN_FIELD_BASE(74, 74, 4, 0x80, 0x10, 0, 1),
+	PIN_FIELD_BASE(80, 81, 1, 0x90, 0x10, 16, 1),
+	PIN_FIELD_BASE(82, 83, 1, 0x90, 0x10, 14, 1),
+};
+
+static const struct mtk_pin_reg_calc mt7988_reg_cals[] = {
+	[PINCTRL_PIN_REG_MODE] = MTK_RANGE(mt7988_pin_mode_range),
+	[PINCTRL_PIN_REG_DIR] = MTK_RANGE(mt7988_pin_dir_range),
+	[PINCTRL_PIN_REG_DI] = MTK_RANGE(mt7988_pin_di_range),
+	[PINCTRL_PIN_REG_DO] = MTK_RANGE(mt7988_pin_do_range),
+	[PINCTRL_PIN_REG_SMT] = MTK_RANGE(mt7988_pin_smt_range),
+	[PINCTRL_PIN_REG_IES] = MTK_RANGE(mt7988_pin_ies_range),
+	[PINCTRL_PIN_REG_PU] = MTK_RANGE(mt7988_pin_pu_range),
+	[PINCTRL_PIN_REG_PD] = MTK_RANGE(mt7988_pin_pd_range),
+	[PINCTRL_PIN_REG_DRV] = MTK_RANGE(mt7988_pin_drv_range),
+	[PINCTRL_PIN_REG_PUPD] = MTK_RANGE(mt7988_pin_pupd_range),
+	[PINCTRL_PIN_REG_R0] = MTK_RANGE(mt7988_pin_r0_range),
+	[PINCTRL_PIN_REG_R1] = MTK_RANGE(mt7988_pin_r1_range),
+};
+
+static const struct mtk_pin_desc mt7988_pins[] = {
+	MT7988_PIN(0, "UART2_RXD"),
+	MT7988_PIN(1, "UART2_TXD"),
+	MT7988_PIN(2, "UART2_CTS"),
+	MT7988_PIN(3, "UART2_RTS"),
+	MT7988_PIN(4, "GPIO_A"),
+	MT7988_PIN(5, "SMI_0_MDC"),
+	MT7988_PIN(6, "SMI_0_MDIO"),
+	MT7988_PIN(7, "PCIE30_2L_0_WAKE_N"),
+	MT7988_PIN(8, "PCIE30_2L_0_CLKREQ_N"),
+	MT7988_PIN(9, "PCIE30_1L_1_WAKE_N"),
+	MT7988_PIN(10, "PCIE30_1L_1_CLKREQ_N"),
+	MT7988_PIN(11, "GPIO_P"),
+	MT7988_PIN(12, "WATCHDOG"),
+	MT7988_PIN(13, "GPIO_RESET"),
+	MT7988_PIN(14, "GPIO_WPS"),
+	MT7988_PIN(15, "PMIC_I2C_SCL"),
+	MT7988_PIN(16, "PMIC_I2C_SDA"),
+	MT7988_PIN(17, "I2C_1_SCL"),
+	MT7988_PIN(18, "I2C_1_SDA"),
+	MT7988_PIN(19, "PCIE30_2L_0_PRESET_N"),
+	MT7988_PIN(20, "PCIE30_1L_1_PRESET_N"),
+	MT7988_PIN(21, "PWMD1"),
+	MT7988_PIN(22, "SPI0_WP"),
+	MT7988_PIN(23, "SPI0_HOLD"),
+	MT7988_PIN(24, "SPI0_CSB"),
+	MT7988_PIN(25, "SPI0_MISO"),
+	MT7988_PIN(26, "SPI0_MOSI"),
+	MT7988_PIN(27, "SPI0_CLK"),
+	MT7988_PIN(28, "SPI1_CSB"),
+	MT7988_PIN(29, "SPI1_MISO"),
+	MT7988_PIN(30, "SPI1_MOSI"),
+	MT7988_PIN(31, "SPI1_CLK"),
+	MT7988_PIN(32, "SPI2_CLK"),
+	MT7988_PIN(33, "SPI2_MOSI"),
+	MT7988_PIN(34, "SPI2_MISO"),
+	MT7988_PIN(35, "SPI2_CSB"),
+	MT7988_PIN(36, "SPI2_HOLD"),
+	MT7988_PIN(37, "SPI2_WP"),
+	MT7988_PIN(38, "EMMC_RSTB"),
+	MT7988_PIN(39, "EMMC_DSL"),
+	MT7988_PIN(40, "EMMC_CK"),
+	MT7988_PIN(41, "EMMC_CMD"),
+	MT7988_PIN(42, "EMMC_DATA_7"),
+	MT7988_PIN(43, "EMMC_DATA_6"),
+	MT7988_PIN(44, "EMMC_DATA_5"),
+	MT7988_PIN(45, "EMMC_DATA_4"),
+	MT7988_PIN(46, "EMMC_DATA_3"),
+	MT7988_PIN(47, "EMMC_DATA_2"),
+	MT7988_PIN(48, "EMMC_DATA_1"),
+	MT7988_PIN(49, "EMMC_DATA_0"),
+	MT7988_PIN(50, "PCM_FS_I2S_LRCK"),
+	MT7988_PIN(51, "PCM_CLK_I2S_BCLK"),
+	MT7988_PIN(52, "PCM_DRX_I2S_DIN"),
+	MT7988_PIN(53, "PCM_DTX_I2S_DOUT"),
+	MT7988_PIN(54, "PCM_MCK_I2S_MCLK"),
+	MT7988_PIN(55, "UART0_RXD"),
+	MT7988_PIN(56, "UART0_TXD"),
+	MT7988_PIN(57, "PWMD0"),
+	MT7988_PIN(58, "JTAG_JTDI"),
+	MT7988_PIN(59, "JTAG_JTDO"),
+	MT7988_PIN(60, "JTAG_JTMS"),
+	MT7988_PIN(61, "JTAG_JTCLK"),
+	MT7988_PIN(62, "JTAG_JTRST_N"),
+	MT7988_PIN(63, "USB_DRV_VBUS_P1"),
+	MT7988_PIN(64, "LED_A"),
+	MT7988_PIN(65, "LED_B"),
+	MT7988_PIN(66, "LED_C"),
+	MT7988_PIN(67, "LED_D"),
+	MT7988_PIN(68, "LED_E"),
+	MT7988_PIN(69, "GPIO_B"),
+	MT7988_PIN(70, "GPIO_C"),
+	MT7988_PIN(71, "I2C_2_SCL"),
+	MT7988_PIN(72, "I2C_2_SDA"),
+	MT7988_PIN(73, "PCIE30_2L_1_PRESET_N"),
+	MT7988_PIN(74, "PCIE30_1L_0_PRESET_N"),
+	MT7988_PIN(75, "PCIE30_2L_1_WAKE_N"),
+	MT7988_PIN(76, "PCIE30_2L_1_CLKREQ_N"),
+	MT7988_PIN(77, "PCIE30_1L_0_WAKE_N"),
+	MT7988_PIN(78, "PCIE30_1L_0_CLKREQ_N"),
+	MT7988_PIN(79, "USB_DRV_VBUS_P0"),
+	MT7988_PIN(80, "UART1_RXD"),
+	MT7988_PIN(81, "UART1_TXD"),
+	MT7988_PIN(82, "UART1_CTS"),
+	MT7988_PIN(83, "UART1_RTS"),
+};
+
+/* jtag */
+static int mt7988_tops_jtag0_0_pins[] = { 0, 1, 2, 3, 4 };
+static int mt7988_tops_jtag0_0_funcs[] = { 2, 2, 2, 2, 2 };
+
+static int mt7988_wo0_jtag_pins[] = { 50, 51, 52, 53, 54 };
+static int mt7988_wo0_jtag_funcs[] = { 3, 3, 3, 3, 3 };
+
+static int mt7988_wo1_jtag_pins[] = { 50, 51, 52, 53, 54 };
+static int mt7988_wo1_jtag_funcs[] = { 4, 4, 4, 4, 4 };
+
+static int mt7988_wo2_jtag_pins[] = { 50, 51, 52, 53, 54 };
+static int mt7988_wo2_jtag_funcs[] = { 5, 5, 5, 5, 5 };
+
+static int mt7988_jtag_pins[] = { 58, 59, 60, 61, 62 };
+static int mt7988_jtag_funcs[] = { 1, 1, 1, 1, 1 };
+
+static int mt7988_tops_jtag0_1_pins[] = { 58, 59, 60, 61, 62 };
+static int mt7988_tops_jtag0_1_funcs[] = { 4, 4, 4, 4, 4 };
+
+/* int_usxgmii */
+static int mt7988_int_usxgmii_pins[] = { 2, 3 };
+static int mt7988_int_usxgmii_funcs[] = { 3, 3 };
+
+/* pwm */
+static int mt7988_pwm0_pins[] = { 57 };
+static int mt7988_pwm0_funcs[] = { 1 };
+
+static int mt7988_pwm1_pins[] = { 21 };
+static int mt7988_pwm1_funcs[] = { 1 };
+
+static int mt7988_pwm2_pins[] = { 80 };
+static int mt7988_pwm2_funcs[] = { 2 };
+
+static int mt7988_pwm3_pins[] = { 81 };
+static int mt7988_pwm3_funcs[] = { 2 };
+
+static int mt7988_pwm4_pins[] = { 82 };
+static int mt7988_pwm4_funcs[] = { 2 };
+
+static int mt7988_pwm5_pins[] = { 83 };
+static int mt7988_pwm5_funcs[] = { 2 };
+
+static int mt7988_pwm6_pins[] = { 69 };
+static int mt7988_pwm6_funcs[] = { 3 };
+
+static int mt7988_pwm7_pins[] = { 70 };
+static int mt7988_pwm7_funcs[] = { 3 };
+
+/* dfd */
+static int mt7988_dfd_pins[] = { 0, 1, 2, 3, 4 };
+static int mt7988_dfd_funcs[] = { 4, 4, 4, 4, 4 };
+
+/* i2c */
+static int mt7988_xfi_phy0_i2c0_pins[] = { 0, 1 };
+static int mt7988_xfi_phy0_i2c0_funcs[] = { 5, 5 };
+
+static int mt7988_xfi_phy1_i2c0_pins[] = { 0, 1 };
+static int mt7988_xfi_phy1_i2c0_funcs[] = { 6, 6 };
+
+static int mt7988_xfi_phy_pll_i2c0_pins[] = { 3, 4 };
+static int mt7988_xfi_phy_pll_i2c0_funcs[] = { 5, 5 };
+
+static int mt7988_xfi_phy_pll_i2c1_pins[] = { 3, 4 };
+static int mt7988_xfi_phy_pll_i2c1_funcs[] = { 6, 6 };
+
+static int mt7988_i2c0_0_pins[] = { 5, 6 };
+static int mt7988_i2c0_0_funcs[] = { 2, 2 };
+
+static int mt7988_i2c1_sfp_pins[] = { 5, 6 };
+static int mt7988_i2c1_sfp_funcs[] = { 4, 4 };
+
+static int mt7988_xfi_pextp_phy0_i2c_pins[] = { 5, 6 };
+static int mt7988_xfi_pextp_phy0_i2c_funcs[] = { 5, 5 };
+
+static int mt7988_xfi_pextp_phy1_i2c_pins[] = { 5, 6 };
+static int mt7988_xfi_pextp_phy1_i2c_funcs[] = { 6, 6 };
+
+static int mt7988_i2c0_1_pins[] = { 15, 16 };
+static int mt7988_i2c0_1_funcs[] = { 1, 1 };
+
+static int mt7988_u30_phy_i2c0_pins[] = { 15, 16 };
+static int mt7988_u30_phy_i2c0_funcs[] = { 2, 2 };
+
+static int mt7988_u32_phy_i2c0_pins[] = { 15, 16 };
+static int mt7988_u32_phy_i2c0_funcs[] = { 3, 3 };
+
+static int mt7988_xfi_phy0_i2c1_pins[] = { 15, 16 };
+static int mt7988_xfi_phy0_i2c1_funcs[] = { 5, 5 };
+
+static int mt7988_xfi_phy1_i2c1_pins[] = { 15, 16 };
+static int mt7988_xfi_phy1_i2c1_funcs[] = { 6, 6 };
+
+static int mt7988_xfi_phy_pll_i2c2_pins[] = { 15, 16 };
+static int mt7988_xfi_phy_pll_i2c2_funcs[] = { 7, 7 };
+
+static int mt7988_i2c1_0_pins[] = { 17, 18 };
+static int mt7988_i2c1_0_funcs[] = { 1, 1 };
+
+static int mt7988_u30_phy_i2c1_pins[] = { 17, 18 };
+static int mt7988_u30_phy_i2c1_funcs[] = { 2, 2 };
+
+static int mt7988_u32_phy_i2c1_pins[] = { 17, 18 };
+static int mt7988_u32_phy_i2c1_funcs[] = { 3, 3 };
+
+static int mt7988_xfi_phy_pll_i2c3_pins[] = { 17, 18 };
+static int mt7988_xfi_phy_pll_i2c3_funcs[] = { 4, 4 };
+
+static int mt7988_sgmii0_i2c_pins[] = { 17, 18 };
+static int mt7988_sgmii0_i2c_funcs[] = { 5, 5 };
+
+static int mt7988_sgmii1_i2c_pins[] = { 17, 18 };
+static int mt7988_sgmii1_i2c_funcs[] = { 6, 6 };
+
+static int mt7988_i2c1_2_pins[] = { 69, 70 };
+static int mt7988_i2c1_2_funcs[] = { 2, 2 };
+
+static int mt7988_i2c2_0_pins[] = { 69, 70 };
+static int mt7988_i2c2_0_funcs[] = { 4, 4 };
+
+static int mt7988_i2c2_1_pins[] = { 71, 72 };
+static int mt7988_i2c2_1_funcs[] = { 1, 1 };
+
+/* eth */
+static int mt7988_mdc_mdio0_pins[] = { 5, 6 };
+static int mt7988_mdc_mdio0_funcs[] = { 1, 1 };
+
+static int mt7988_2p5g_ext_mdio_pins[] = { 28, 29 };
+static int mt7988_2p5g_ext_mdio_funcs[] = { 6, 6 };
+
+static int mt7988_gbe_ext_mdio_pins[] = { 30, 31 };
+static int mt7988_gbe_ext_mdio_funcs[] = { 6, 6 };
+
+static int mt7988_mdc_mdio1_pins[] = { 69, 70 };
+static int mt7988_mdc_mdio1_funcs[] = { 1, 1 };
+
+/* pcie */
+static int mt7988_pcie_wake_n0_0_pins[] = { 7 };
+static int mt7988_pcie_wake_n0_0_funcs[] = { 1 };
+
+static int mt7988_pcie_clk_req_n0_0_pins[] = { 8 };
+static int mt7988_pcie_clk_req_n0_0_funcs[] = { 1 };
+
+static int mt7988_pcie_wake_n3_0_pins[] = { 9 };
+static int mt7988_pcie_wake_n3_0_funcs[] = { 1 };
+
+static int mt7988_pcie_clk_req_n3_pins[] = { 10 };
+static int mt7988_pcie_clk_req_n3_funcs[] = { 1 };
+
+static int mt7988_pcie_clk_req_n0_1_pins[] = { 10 };
+static int mt7988_pcie_clk_req_n0_1_funcs[] = { 2 };
+
+static int mt7988_pcie_p0_phy_i2c_pins[] = { 7, 8 };
+static int mt7988_pcie_p0_phy_i2c_funcs[] = { 3, 3 };
+
+static int mt7988_pcie_p1_phy_i2c_pins[] = { 7, 8 };
+static int mt7988_pcie_p1_phy_i2c_funcs[] = { 4, 4 };
+
+static int mt7988_pcie_p3_phy_i2c_pins[] = { 9, 10 };
+static int mt7988_pcie_p3_phy_i2c_funcs[] = { 4, 4 };
+
+static int mt7988_pcie_p2_phy_i2c_pins[] = { 7, 8 };
+static int mt7988_pcie_p2_phy_i2c_funcs[] = { 5, 5 };
+
+static int mt7988_ckm_phy_i2c_pins[] = { 9, 10 };
+static int mt7988_ckm_phy_i2c_funcs[] = { 5, 5 };
+
+static int mt7988_pcie_wake_n0_1_pins[] = { 13 };
+static int mt7988_pcie_wake_n0_1_funcs[] = { 2 };
+
+static int mt7988_pcie_wake_n3_1_pins[] = { 14 };
+static int mt7988_pcie_wake_n3_1_funcs[] = { 2 };
+
+static int mt7988_pcie_2l_0_pereset_pins[] = { 19 };
+static int mt7988_pcie_2l_0_pereset_funcs[] = { 1 };
+
+static int mt7988_pcie_1l_1_pereset_pins[] = { 20 };
+static int mt7988_pcie_1l_1_pereset_funcs[] = { 1 };
+
+static int mt7988_pcie_clk_req_n2_1_pins[] = { 63 };
+static int mt7988_pcie_clk_req_n2_1_funcs[] = { 2 };
+
+static int mt7988_pcie_2l_1_pereset_pins[] = { 73 };
+static int mt7988_pcie_2l_1_pereset_funcs[] = { 1 };
+
+static int mt7988_pcie_1l_0_pereset_pins[] = { 74 };
+static int mt7988_pcie_1l_0_pereset_funcs[] = { 1 };
+
+static int mt7988_pcie_wake_n1_0_pins[] = { 75 };
+static int mt7988_pcie_wake_n1_0_funcs[] = { 1 };
+
+static int mt7988_pcie_clk_req_n1_pins[] = { 76 };
+static int mt7988_pcie_clk_req_n1_funcs[] = { 1 };
+
+static int mt7988_pcie_wake_n2_0_pins[] = { 77 };
+static int mt7988_pcie_wake_n2_0_funcs[] = { 1 };
+
+static int mt7988_pcie_clk_req_n2_0_pins[] = { 78 };
+static int mt7988_pcie_clk_req_n2_0_funcs[] = { 1 };
+
+static int mt7988_pcie_wake_n2_1_pins[] = { 79 };
+static int mt7988_pcie_wake_n2_1_funcs[] = { 2 };
+
+/* pmic */
+static int mt7988_pmic_pins[] = { 11 };
+static int mt7988_pmic_funcs[] = { 1 };
+
+/* watchdog */
+static int mt7988_watchdog_pins[] = { 12 };
+static int mt7988_watchdog_funcs[] = { 1 };
+
+/* spi */
+static int mt7988_spi0_wp_hold_pins[] = { 22, 23 };
+static int mt7988_spi0_wp_hold_funcs[] = { 1, 1 };
+
+static int mt7988_spi0_pins[] = { 24, 25, 26, 27 };
+static int mt7988_spi0_funcs[] = { 1, 1, 1, 1 };
+
+static int mt7988_spi1_pins[] = { 28, 29, 30, 31 };
+static int mt7988_spi1_funcs[] = { 1, 1, 1, 1 };
+
+static int mt7988_spi2_pins[] = { 32, 33, 34, 35 };
+static int mt7988_spi2_funcs[] = { 1, 1, 1, 1 };
+
+static int mt7988_spi2_wp_hold_pins[] = { 36, 37 };
+static int mt7988_spi2_wp_hold_funcs[] = { 1, 1 };
+
+/* flash */
+static int mt7988_snfi_pins[] = { 22, 23, 24, 25, 26, 27 };
+static int mt7988_snfi_funcs[] = { 2, 2, 2, 2, 2, 2 };
+
+static int mt7988_emmc_45_pins[] = {
+	21, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37
+};
+static int mt7988_emmc_45_funcs[] = { 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5 };
+
+static int mt7988_sdcard_pins[] = { 32, 33, 34, 35, 36, 37 };
+static int mt7988_sdcard_funcs[] = { 5, 5, 5, 5, 5, 5 };
+
+static int mt7988_emmc_51_pins[] = { 38, 39, 40, 41, 42, 43,
+				     44, 45, 46, 47, 48, 49 };
+static int mt7988_emmc_51_funcs[] = { 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 };
+
+/* uart */
+static int mt7988_uart2_pins[] = { 0, 1, 2, 3 };
+static int mt7988_uart2_funcs[] = { 1, 1, 1, 1 };
+
+static int mt7988_tops_uart0_0_pins[] = { 22, 23 };
+static int mt7988_tops_uart0_0_funcs[] = { 3, 3 };
+
+static int mt7988_uart2_0_pins[] = { 28, 29, 30, 31 };
+static int mt7988_uart2_0_funcs[] = { 2, 2, 2, 2 };
+
+static int mt7988_uart1_0_pins[] = { 32, 33, 34, 35 };
+static int mt7988_uart1_0_funcs[] = { 2, 2, 2, 2 };
+
+static int mt7988_uart2_1_pins[] = { 32, 33, 34, 35 };
+static int mt7988_uart2_1_funcs[] = { 3, 3, 3, 3 };
+
+static int mt7988_net_wo0_uart_txd_0_pins[] = { 28 };
+static int mt7988_net_wo0_uart_txd_0_funcs[] = { 3 };
+
+static int mt7988_net_wo1_uart_txd_0_pins[] = { 29 };
+static int mt7988_net_wo1_uart_txd_0_funcs[] = { 3 };
+
+static int mt7988_net_wo2_uart_txd_0_pins[] = { 30 };
+static int mt7988_net_wo2_uart_txd_0_funcs[] = { 3 };
+
+static int mt7988_tops_uart1_0_pins[] = { 28, 29 };
+static int mt7988_tops_uart1_0_funcs[] = { 4, 4 };
+
+static int mt7988_tops_uart0_1_pins[] = { 30, 31 };
+static int mt7988_tops_uart0_1_funcs[] = { 4, 4 };
+
+static int mt7988_tops_uart1_1_pins[] = { 36, 37 };
+static int mt7988_tops_uart1_1_funcs[] = { 3, 3 };
+
+static int mt7988_uart0_pins[] = { 55, 56 };
+static int mt7988_uart0_funcs[] = { 1, 1 };
+
+static int mt7988_tops_uart0_2_pins[] = { 55, 56 };
+static int mt7988_tops_uart0_2_funcs[] = { 2, 2 };
+
+static int mt7988_uart2_2_pins[] = { 50, 51, 52, 53 };
+static int mt7988_uart2_2_funcs[] = { 2, 2, 2, 2 };
+
+static int mt7988_uart1_1_pins[] = { 58, 59, 60, 61 };
+static int mt7988_uart1_1_funcs[] = { 2, 2, 2, 2 };
+
+static int mt7988_uart2_3_pins[] = { 58, 59, 60, 61 };
+static int mt7988_uart2_3_funcs[] = { 3, 3, 3, 3 };
+
+static int mt7988_uart1_2_pins[] = { 80, 81, 82, 83 };
+static int mt7988_uart1_2_funcs[] = { 1, 1, 1, 1 };
+
+static int mt7988_tops_uart1_2_pins[] = { 80, 81 };
+static int mt7988_tops_uart1_2_funcs[] = {
+	4,
+	4,
+};
+
+static int mt7988_net_wo0_uart_txd_1_pins[] = { 80 };
+static int mt7988_net_wo0_uart_txd_1_funcs[] = { 3 };
+
+static int mt7988_net_wo1_uart_txd_1_pins[] = { 81 };
+static int mt7988_net_wo1_uart_txd_1_funcs[] = { 3 };
+
+static int mt7988_net_wo2_uart_txd_1_pins[] = { 82 };
+static int mt7988_net_wo2_uart_txd_1_funcs[] = { 3 };
+
+/* udi */
+static int mt7988_udi_pins[] = { 32, 33, 34, 35, 36 };
+static int mt7988_udi_funcs[] = { 4, 4, 4, 4, 4 };
+
+/* i2s */
+static int mt7988_i2s_pins[] = { 50, 51, 52, 53, 54 };
+static int mt7988_i2s_funcs[] = { 1, 1, 1, 1, 1 };
+
+/* pcm */
+static int mt7988_pcm_pins[] = { 50, 51, 52, 53 };
+static int mt7988_pcm_funcs[] = { 1, 1, 1, 1 };
+
+/* led */
+static int mt7988_gbe0_led1_pins[] = { 58 };
+static int mt7988_gbe0_led1_funcs[] = { 6 };
+static int mt7988_gbe1_led1_pins[] = { 59 };
+static int mt7988_gbe1_led1_funcs[] = { 6 };
+static int mt7988_gbe2_led1_pins[] = { 60 };
+static int mt7988_gbe2_led1_funcs[] = { 6 };
+static int mt7988_gbe3_led1_pins[] = { 61 };
+static int mt7988_gbe3_led1_funcs[] = { 6 };
+
+static int mt7988_2p5gbe_led1_pins[] = { 62 };
+static int mt7988_2p5gbe_led1_funcs[] = { 6 };
+
+static int mt7988_gbe0_led0_pins[] = { 64 };
+static int mt7988_gbe0_led0_funcs[] = { 1 };
+static int mt7988_gbe1_led0_pins[] = { 65 };
+static int mt7988_gbe1_led0_funcs[] = { 1 };
+static int mt7988_gbe2_led0_pins[] = { 66 };
+static int mt7988_gbe2_led0_funcs[] = { 1 };
+static int mt7988_gbe3_led0_pins[] = { 67 };
+static int mt7988_gbe3_led0_funcs[] = { 1 };
+
+static int mt7988_2p5gbe_led0_pins[] = { 68 };
+static int mt7988_2p5gbe_led0_funcs[] = { 1 };
+
+/* usb */
+static int mt7988_drv_vbus_p1_pins[] = { 63 };
+static int mt7988_drv_vbus_p1_funcs[] = { 1 };
+
+static int mt7988_drv_vbus_pins[] = { 79 };
+static int mt7988_drv_vbus_funcs[] = { 1 };
+
+static const struct group_desc mt7988_groups[] = {
+	/*  @GPIO(0,1,2,3): uart2 */
+	PINCTRL_PIN_GROUP("uart2", mt7988_uart2),
+	/*  @GPIO(0,1,2,3,4): tops_jtag0_0 */
+	PINCTRL_PIN_GROUP("tops_jtag0_0", mt7988_tops_jtag0_0),
+	/*  @GPIO(2,3): int_usxgmii */
+	PINCTRL_PIN_GROUP("int_usxgmii", mt7988_int_usxgmii),
+	/*  @GPIO(0,1,2,3,4): dfd */
+	PINCTRL_PIN_GROUP("dfd", mt7988_dfd),
+	/*  @GPIO(0,1): xfi_phy0_i2c0 */
+	PINCTRL_PIN_GROUP("xfi_phy0_i2c0", mt7988_xfi_phy0_i2c0),
+	/*  @GPIO(0,1): xfi_phy1_i2c0 */
+	PINCTRL_PIN_GROUP("xfi_phy1_i2c0", mt7988_xfi_phy1_i2c0),
+	/*  @GPIO(3,4): xfi_phy_pll_i2c0 */
+	PINCTRL_PIN_GROUP("xfi_phy_pll_i2c0", mt7988_xfi_phy_pll_i2c0),
+	/*  @GPIO(3,4): xfi_phy_pll_i2c1 */
+	PINCTRL_PIN_GROUP("xfi_phy_pll_i2c1", mt7988_xfi_phy_pll_i2c1),
+	/*  @GPIO(5,6) i2c0_0 */
+	PINCTRL_PIN_GROUP("i2c0_0", mt7988_i2c0_0),
+	/*  @GPIO(5,6) i2c1_sfp */
+	PINCTRL_PIN_GROUP("i2c1_sfp", mt7988_i2c1_sfp),
+	/*  @GPIO(5,6) xfi_pextp_phy0_i2c */
+	PINCTRL_PIN_GROUP("xfi_pextp_phy0_i2c", mt7988_xfi_pextp_phy0_i2c),
+	/*  @GPIO(5,6) xfi_pextp_phy1_i2c */
+	PINCTRL_PIN_GROUP("xfi_pextp_phy1_i2c", mt7988_xfi_pextp_phy1_i2c),
+	/*  @GPIO(5,6) mdc_mdio0 */
+	PINCTRL_PIN_GROUP("mdc_mdio0", mt7988_mdc_mdio0),
+	/*  @GPIO(7): pcie_wake_n0_0 */
+	PINCTRL_PIN_GROUP("pcie_wake_n0_0", mt7988_pcie_wake_n0_0),
+	/*  @GPIO(8): pcie_clk_req_n0_0 */
+	PINCTRL_PIN_GROUP("pcie_clk_req_n0_0", mt7988_pcie_clk_req_n0_0),
+	/*  @GPIO(9): pcie_wake_n3_0 */
+	PINCTRL_PIN_GROUP("pcie_wake_n3_0", mt7988_pcie_wake_n3_0),
+	/*  @GPIO(10): pcie_clk_req_n3 */
+	PINCTRL_PIN_GROUP("pcie_clk_req_n3", mt7988_pcie_clk_req_n3),
+	/*  @GPIO(10): pcie_clk_req_n0_1 */
+	PINCTRL_PIN_GROUP("pcie_clk_req_n0_1", mt7988_pcie_clk_req_n0_1),
+	/*  @GPIO(7,8) pcie_p0_phy_i2c */
+	PINCTRL_PIN_GROUP("pcie_p0_phy_i2c", mt7988_pcie_p0_phy_i2c),
+	/*  @GPIO(7,8) pcie_p1_phy_i2c */
+	PINCTRL_PIN_GROUP("pcie_p1_phy_i2c", mt7988_pcie_p1_phy_i2c),
+	/*  @GPIO(7,8) pcie_p2_phy_i2c */
+	PINCTRL_PIN_GROUP("pcie_p2_phy_i2c", mt7988_pcie_p2_phy_i2c),
+	/*  @GPIO(9,10) pcie_p3_phy_i2c */
+	PINCTRL_PIN_GROUP("pcie_p3_phy_i2c", mt7988_pcie_p3_phy_i2c),
+	/*  @GPIO(9,10) ckm_phy_i2c */
+	PINCTRL_PIN_GROUP("ckm_phy_i2c", mt7988_ckm_phy_i2c),
+	/*  @GPIO(11): pmic */
+	PINCTRL_PIN_GROUP("pcie_pmic", mt7988_pmic),
+	/*  @GPIO(12): watchdog */
+	PINCTRL_PIN_GROUP("watchdog", mt7988_watchdog),
+	/*  @GPIO(13): pcie_wake_n0_1 */
+	PINCTRL_PIN_GROUP("pcie_wake_n0_1", mt7988_pcie_wake_n0_1),
+	/*  @GPIO(14): pcie_wake_n3_1 */
+	PINCTRL_PIN_GROUP("pcie_wake_n3_1", mt7988_pcie_wake_n3_1),
+	/*  @GPIO(15,16) i2c0_1 */
+	PINCTRL_PIN_GROUP("i2c0_1", mt7988_i2c0_1),
+	/*  @GPIO(15,16) u30_phy_i2c0 */
+	PINCTRL_PIN_GROUP("u30_phy_i2c0", mt7988_u30_phy_i2c0),
+	/*  @GPIO(15,16) u32_phy_i2c0 */
+	PINCTRL_PIN_GROUP("u32_phy_i2c0", mt7988_u32_phy_i2c0),
+	/*  @GPIO(15,16) xfi_phy0_i2c1 */
+	PINCTRL_PIN_GROUP("xfi_phy0_i2c1", mt7988_xfi_phy0_i2c1),
+	/*  @GPIO(15,16) xfi_phy1_i2c1 */
+	PINCTRL_PIN_GROUP("xfi_phy1_i2c1", mt7988_xfi_phy1_i2c1),
+	/*  @GPIO(15,16) xfi_phy_pll_i2c2 */
+	PINCTRL_PIN_GROUP("xfi_phy_pll_i2c2", mt7988_xfi_phy_pll_i2c2),
+	/*  @GPIO(17,18) i2c1_0 */
+	PINCTRL_PIN_GROUP("i2c1_0", mt7988_i2c1_0),
+	/*  @GPIO(17,18) u30_phy_i2c1 */
+	PINCTRL_PIN_GROUP("u30_phy_i2c1", mt7988_u30_phy_i2c1),
+	/*  @GPIO(17,18) u32_phy_i2c1 */
+	PINCTRL_PIN_GROUP("u32_phy_i2c1", mt7988_u32_phy_i2c1),
+	/*  @GPIO(17,18) xfi_phy_pll_i2c3 */
+	PINCTRL_PIN_GROUP("xfi_phy_pll_i2c3", mt7988_xfi_phy_pll_i2c3),
+	/*  @GPIO(17,18) sgmii0_i2c */
+	PINCTRL_PIN_GROUP("sgmii0_i2c", mt7988_sgmii0_i2c),
+	/*  @GPIO(17,18) sgmii1_i2c */
+	PINCTRL_PIN_GROUP("sgmii1_i2c", mt7988_sgmii1_i2c),
+	/*  @GPIO(19): pcie_2l_0_pereset */
+	PINCTRL_PIN_GROUP("pcie_2l_0_pereset", mt7988_pcie_2l_0_pereset),
+	/*  @GPIO(20): pcie_1l_1_pereset */
+	PINCTRL_PIN_GROUP("pcie_1l_1_pereset", mt7988_pcie_1l_1_pereset),
+	/*  @GPIO(21): pwm1 */
+	PINCTRL_PIN_GROUP("pwm1", mt7988_pwm1),
+	/*  @GPIO(22,23) spi0_wp_hold */
+	PINCTRL_PIN_GROUP("spi0_wp_hold", mt7988_spi0_wp_hold),
+	/*  @GPIO(24,25,26,27) spi0 */
+	PINCTRL_PIN_GROUP("spi0", mt7988_spi0),
+	/*  @GPIO(28,29,30,31) spi1 */
+	PINCTRL_PIN_GROUP("spi1", mt7988_spi1),
+	/*  @GPIO(32,33,34,35) spi2 */
+	PINCTRL_PIN_GROUP("spi2", mt7988_spi2),
+	/*  @GPIO(36,37) spi2_wp_hold */
+	PINCTRL_PIN_GROUP("spi2_wp_hold", mt7988_spi2_wp_hold),
+	/*  @GPIO(22,23,24,25,26,27) snfi */
+	PINCTRL_PIN_GROUP("snfi", mt7988_snfi),
+	/*  @GPIO(22,23) tops_uart0_0 */
+	PINCTRL_PIN_GROUP("tops_uart0_0", mt7988_tops_uart0_0),
+	/*  @GPIO(28,29,30,31) uart2_0 */
+	PINCTRL_PIN_GROUP("uart2_0", mt7988_uart2_0),
+	/*  @GPIO(32,33,34,35) uart1_0 */
+	PINCTRL_PIN_GROUP("uart1_0", mt7988_uart1_0),
+	/*  @GPIO(32,33,34,35) uart2_1 */
+	PINCTRL_PIN_GROUP("uart2_1", mt7988_uart2_1),
+	/*  @GPIO(28) net_wo0_uart_txd_0 */
+	PINCTRL_PIN_GROUP("net_wo0_uart_txd_0", mt7988_net_wo0_uart_txd_0),
+	/*  @GPIO(29) net_wo1_uart_txd_0 */
+	PINCTRL_PIN_GROUP("net_wo1_uart_txd_0", mt7988_net_wo1_uart_txd_0),
+	/*  @GPIO(30) net_wo2_uart_txd_0 */
+	PINCTRL_PIN_GROUP("net_wo2_uart_txd_0", mt7988_net_wo2_uart_txd_0),
+	/*  @GPIO(28,29) tops_uart1_0 */
+	PINCTRL_PIN_GROUP("tops_uart0_0", mt7988_tops_uart1_0),
+	/*  @GPIO(30,31) tops_uart0_1 */
+	PINCTRL_PIN_GROUP("tops_uart0_1", mt7988_tops_uart0_1),
+	/*  @GPIO(36,37) tops_uart1_1 */
+	PINCTRL_PIN_GROUP("tops_uart1_1", mt7988_tops_uart1_1),
+	/*  @GPIO(32,33,34,35,36) udi */
+	PINCTRL_PIN_GROUP("udi", mt7988_udi),
+	/*  @GPIO(21,28,29,30,31,32,33,34,35,36,37) emmc_45 */
+	PINCTRL_PIN_GROUP("emmc_45", mt7988_emmc_45),
+	/*  @GPIO(32,33,34,35,36,37) sdcard */
+	PINCTRL_PIN_GROUP("sdcard", mt7988_sdcard),
+	/*  @GPIO(38,39,40,41,42,43,44,45,46,47,48,49) emmc_51 */
+	PINCTRL_PIN_GROUP("emmc_51", mt7988_emmc_51),
+	/*  @GPIO(28,29) 2p5g_ext_mdio */
+	PINCTRL_PIN_GROUP("2p5g_ext_mdio", mt7988_2p5g_ext_mdio),
+	/*  @GPIO(30,31) gbe_ext_mdio */
+	PINCTRL_PIN_GROUP("gbe_ext_mdio", mt7988_gbe_ext_mdio),
+	/*  @GPIO(50,51,52,53,54) i2s */
+	PINCTRL_PIN_GROUP("i2s", mt7988_i2s),
+	/*  @GPIO(50,51,52,53) pcm */
+	PINCTRL_PIN_GROUP("pcm", mt7988_pcm),
+	/*  @GPIO(55,56) uart0 */
+	PINCTRL_PIN_GROUP("uart0", mt7988_uart0),
+	/*  @GPIO(55,56) tops_uart0_2 */
+	PINCTRL_PIN_GROUP("tops_uart0_2", mt7988_tops_uart0_2),
+	/*  @GPIO(50,51,52,53) uart2_2 */
+	PINCTRL_PIN_GROUP("uart2_2", mt7988_uart2_2),
+	/*  @GPIO(50,51,52,53,54) wo0_jtag */
+	PINCTRL_PIN_GROUP("wo0_jtag", mt7988_wo0_jtag),
+	/*  @GPIO(50,51,52,53,54) wo1-wo1_jtag */
+	PINCTRL_PIN_GROUP("wo1_jtag", mt7988_wo1_jtag),
+	/*  @GPIO(50,51,52,53,54) wo2_jtag */
+	PINCTRL_PIN_GROUP("wo2_jtag", mt7988_wo2_jtag),
+	/*  @GPIO(57) pwm0 */
+	PINCTRL_PIN_GROUP("pwm0", mt7988_pwm0),
+	/*  @GPIO(58,59,60,61,62) jtag */
+	PINCTRL_PIN_GROUP("jtag", mt7988_jtag),
+	/*  @GPIO(58,59,60,61,62) tops_jtag0_1 */
+	PINCTRL_PIN_GROUP("tops_jtag0_1", mt7988_tops_jtag0_1),
+	/*  @GPIO(58,59,60,61) uart2_3 */
+	PINCTRL_PIN_GROUP("uart2_3", mt7988_uart2_3),
+	/*  @GPIO(58,59,60,61) uart1_1 */
+	PINCTRL_PIN_GROUP("uart1_1", mt7988_uart1_1),
+	/*  @GPIO(58,59,60,61) gbe_led1 */
+	PINCTRL_PIN_GROUP("gbe0_led1", mt7988_gbe0_led1),
+	PINCTRL_PIN_GROUP("gbe1_led1", mt7988_gbe1_led1),
+	PINCTRL_PIN_GROUP("gbe2_led1", mt7988_gbe2_led1),
+	PINCTRL_PIN_GROUP("gbe3_led1", mt7988_gbe3_led1),
+	/*  @GPIO(62) 2p5gbe_led1 */
+	PINCTRL_PIN_GROUP("2p5gbe_led1", mt7988_2p5gbe_led1),
+	/*  @GPIO(64,65,66,67) gbe_led0 */
+	PINCTRL_PIN_GROUP("gbe0_led0", mt7988_gbe0_led0),
+	PINCTRL_PIN_GROUP("gbe1_led0", mt7988_gbe1_led0),
+	PINCTRL_PIN_GROUP("gbe2_led0", mt7988_gbe2_led0),
+	PINCTRL_PIN_GROUP("gbe3_led0", mt7988_gbe3_led0),
+	/*  @GPIO(68) 2p5gbe_led0 */
+	PINCTRL_PIN_GROUP("2p5gbe_led0", mt7988_2p5gbe_led0),
+	/*  @GPIO(63) drv_vbus_p1 */
+	PINCTRL_PIN_GROUP("drv_vbus_p1", mt7988_drv_vbus_p1),
+	/*  @GPIO(63) pcie_clk_req_n2_1 */
+	PINCTRL_PIN_GROUP("pcie_clk_req_n2_1", mt7988_pcie_clk_req_n2_1),
+	/*  @GPIO(69, 70) mdc_mdio1 */
+	PINCTRL_PIN_GROUP("mdc_mdio1", mt7988_mdc_mdio1),
+	/*  @GPIO(69, 70) i2c1_2 */
+	PINCTRL_PIN_GROUP("i2c1_2", mt7988_i2c1_2),
+	/*  @GPIO(69) pwm6 */
+	PINCTRL_PIN_GROUP("pwm6", mt7988_pwm6),
+	/*  @GPIO(70) pwm7 */
+	PINCTRL_PIN_GROUP("pwm7", mt7988_pwm7),
+	/*  @GPIO(69,70) i2c2_0 */
+	PINCTRL_PIN_GROUP("i2c2_0", mt7988_i2c2_0),
+	/*  @GPIO(71,72) i2c2_1 */
+	PINCTRL_PIN_GROUP("i2c2_1", mt7988_i2c2_1),
+	/*  @GPIO(73) pcie_2l_1_pereset */
+	PINCTRL_PIN_GROUP("pcie_2l_1_pereset", mt7988_pcie_2l_1_pereset),
+	/*  @GPIO(74) pcie_1l_0_pereset */
+	PINCTRL_PIN_GROUP("pcie_1l_0_pereset", mt7988_pcie_1l_0_pereset),
+	/*  @GPIO(75) pcie_wake_n1_0 */
+	PINCTRL_PIN_GROUP("pcie_wake_n1_0", mt7988_pcie_wake_n1_0),
+	/*  @GPIO(76) pcie_clk_req_n1 */
+	PINCTRL_PIN_GROUP("pcie_clk_req_n1", mt7988_pcie_clk_req_n1),
+	/*  @GPIO(77) pcie_wake_n2_0 */
+	PINCTRL_PIN_GROUP("pcie_wake_n2_0", mt7988_pcie_wake_n2_0),
+	/*  @GPIO(78) pcie_clk_req_n2_0 */
+	PINCTRL_PIN_GROUP("pcie_clk_req_n2_0", mt7988_pcie_clk_req_n2_0),
+	/*  @GPIO(79) drv_vbus */
+	PINCTRL_PIN_GROUP("drv_vbus", mt7988_drv_vbus),
+	/*  @GPIO(79) pcie_wake_n2_1 */
+	PINCTRL_PIN_GROUP("pcie_wake_n2_1", mt7988_pcie_wake_n2_1),
+	/*  @GPIO(80,81,82,83) uart1_2 */
+	PINCTRL_PIN_GROUP("uart1_2", mt7988_uart1_2),
+	/*  @GPIO(80) pwm2 */
+	PINCTRL_PIN_GROUP("pwm2", mt7988_pwm2),
+	/*  @GPIO(81) pwm3 */
+	PINCTRL_PIN_GROUP("pwm3", mt7988_pwm3),
+	/*  @GPIO(82) pwm4 */
+	PINCTRL_PIN_GROUP("pwm4", mt7988_pwm4),
+	/*  @GPIO(83) pwm5 */
+	PINCTRL_PIN_GROUP("pwm5", mt7988_pwm5),
+	/*  @GPIO(80) net_wo0_uart_txd_0 */
+	PINCTRL_PIN_GROUP("net_wo0_uart_txd_0", mt7988_net_wo0_uart_txd_0),
+	/*  @GPIO(81) net_wo1_uart_txd_0 */
+	PINCTRL_PIN_GROUP("net_wo1_uart_txd_0", mt7988_net_wo1_uart_txd_0),
+	/*  @GPIO(82) net_wo2_uart_txd_0 */
+	PINCTRL_PIN_GROUP("net_wo2_uart_txd_0", mt7988_net_wo2_uart_txd_0),
+	/*  @GPIO(80,81) tops_uart1_2 */
+	PINCTRL_PIN_GROUP("tops_uart1_2", mt7988_tops_uart1_2),
+	/*  @GPIO(80) net_wo0_uart_txd_1 */
+	PINCTRL_PIN_GROUP("net_wo0_uart_txd_1", mt7988_net_wo0_uart_txd_1),
+	/*  @GPIO(81) net_wo1_uart_txd_1 */
+	PINCTRL_PIN_GROUP("net_wo1_uart_txd_1", mt7988_net_wo1_uart_txd_1),
+	/*  @GPIO(82) net_wo2_uart_txd_1 */
+	PINCTRL_PIN_GROUP("net_wo2_uart_txd_1", mt7988_net_wo2_uart_txd_1),
+};
+
+/* Joint those groups owning the same capability in user point of view which
+ * allows that people tend to use through the device tree.
+ */
+static const char *mt7988_jtag_groups[] = {
+	"tops_jtag0_0", "wo0_jtag", "wo1_jtag",
+	"wo2_jtag",	"jtag",	    "tops_jtag0_1",
+};
+static const char *mt7988_int_usxgmii_groups[] = {
+	"int_usxgmii",
+};
+static const char *mt7988_pwm_groups[] = {
+	"pwm0", "pwm1", "pwm2", "pwm3", "pwm4",	"pwm5",	"pwm6", "pwm7"
+};
+static const char *mt7988_dfd_groups[] = {
+	"dfd",
+};
+static const char *mt7988_i2c_groups[] = {
+	"xfi_phy0_i2c0",
+	"xfi_phy1_i2c0",
+	"xfi_phy_pll_i2c0",
+	"xfi_phy_pll_i2c1",
+	"i2c0_0",
+	"i2c1_sfp",
+	"xfi_pextp_phy0_i2c",
+	"xfi_pextp_phy1_i2c",
+	"i2c0_1",
+	"u30_phy_i2c0",
+	"u32_phy_i2c0",
+	"xfi_phy0_i2c1",
+	"xfi_phy1_i2c1",
+	"xfi_phy_pll_i2c2",
+	"i2c1_0",
+	"u30_phy_i2c1",
+	"u32_phy_i2c1",
+	"xfi_phy_pll_i2c3",
+	"sgmii0_i2c",
+	"sgmii1_i2c",
+	"i2c1_2",
+	"i2c2_0",
+	"i2c2_1",
+};
+static const char *mt7988_ethernet_groups[] = {
+	"mdc_mdio0",
+	"2p5g_ext_mdio",
+	"gbe_ext_mdio",
+	"mdc_mdio1",
+};
+static const char *mt7988_pcie_groups[] = {
+	"pcie_wake_n0_0",    "pcie_clk_req_n0_0", "pcie_wake_n3_0",
+	"pcie_clk_req_n3",   "pcie_p0_phy_i2c",	  "pcie_p1_phy_i2c",
+	"pcie_p3_phy_i2c",   "pcie_p2_phy_i2c",	  "ckm_phy_i2c",
+	"pcie_wake_n0_1",    "pcie_wake_n3_1",	  "pcie_2l_0_pereset",
+	"pcie_1l_1_pereset", "pcie_clk_req_n2_1", "pcie_2l_1_pereset",
+	"pcie_1l_0_pereset", "pcie_wake_n1_0",	  "pcie_clk_req_n1",
+	"pcie_wake_n2_0",    "pcie_clk_req_n2_0", "pcie_wake_n2_1",
+	"pcie_clk_req_n0_1"
+};
+static const char *mt7988_pmic_groups[] = {
+	"pmic",
+};
+static const char *mt7988_wdt_groups[] = {
+	"watchdog",
+};
+static const char *mt7988_spi_groups[] = {
+	"spi0", "spi0_wp_hold", "spi1", "spi2", "spi2_wp_hold",
+};
+static const char *mt7988_flash_groups[] = { "emmc_45", "sdcard", "snfi",
+						    "emmc_51" };
+static const char *mt7988_uart_groups[] = {
+	"uart2",
+	"tops_uart0_0",
+	"uart2_0",
+	"uart1_0",
+	"uart2_1",
+	"net_wo0_uart_txd_0",
+	"net_wo1_uart_txd_0",
+	"net_wo2_uart_txd_0",
+	"tops_uart1_0",
+	"ops_uart0_1",
+	"ops_uart1_1",
+	"uart0",
+	"tops_uart0_2",
+	"uart1_1",
+	"uart2_3",
+	"uart1_2",
+	"tops_uart1_2",
+	"net_wo0_uart_txd_1",
+	"net_wo1_uart_txd_1",
+	"net_wo2_uart_txd_1",
+};
+static const char *mt7988_udi_groups[] = {
+	"udi",
+};
+static const char *mt7988_audio_groups[] = {
+	"i2s", "pcm",
+};
+static const char *mt7988_led_groups[] = {
+	"gbe0_led1", "gbe1_led1", "gbe2_led1", "gbe3_led1", "2p5gbe_led1",
+	"gbe0_led0", "gbe1_led0", "gbe2_led0", "gbe3_led0", "2p5gbe_led0",
+	"wf5g_led0",   "wf5g_led1",
+};
+static const char *mt7988_usb_groups[] = {
+	"drv_vbus",
+	"drv_vbus_p1",
+};
+
+static const struct function_desc mt7988_functions[] = {
+	{ "audio", mt7988_audio_groups, ARRAY_SIZE(mt7988_audio_groups) },
+	{ "jtag", mt7988_jtag_groups, ARRAY_SIZE(mt7988_jtag_groups) },
+	{ "int_usxgmii", mt7988_int_usxgmii_groups,
+	  ARRAY_SIZE(mt7988_int_usxgmii_groups) },
+	{ "pwm", mt7988_pwm_groups, ARRAY_SIZE(mt7988_pwm_groups) },
+	{ "dfd", mt7988_dfd_groups, ARRAY_SIZE(mt7988_dfd_groups) },
+	{ "i2c", mt7988_i2c_groups, ARRAY_SIZE(mt7988_i2c_groups) },
+	{ "eth", mt7988_ethernet_groups, ARRAY_SIZE(mt7988_ethernet_groups) },
+	{ "pcie", mt7988_pcie_groups, ARRAY_SIZE(mt7988_pcie_groups) },
+	{ "pmic", mt7988_pmic_groups, ARRAY_SIZE(mt7988_pmic_groups) },
+	{ "watchdog", mt7988_wdt_groups, ARRAY_SIZE(mt7988_wdt_groups) },
+	{ "spi", mt7988_spi_groups, ARRAY_SIZE(mt7988_spi_groups) },
+	{ "flash", mt7988_flash_groups, ARRAY_SIZE(mt7988_flash_groups) },
+	{ "uart", mt7988_uart_groups, ARRAY_SIZE(mt7988_uart_groups) },
+	{ "udi", mt7988_udi_groups, ARRAY_SIZE(mt7988_udi_groups) },
+	{ "usb", mt7988_usb_groups, ARRAY_SIZE(mt7988_usb_groups) },
+	{ "led", mt7988_led_groups, ARRAY_SIZE(mt7988_led_groups) },
+};
+
+static const struct mtk_eint_hw mt7988_eint_hw = {
+	.port_mask = 7,
+	.ports = 7,
+	.ap_num = ARRAY_SIZE(mt7988_pins),
+	.db_cnt = 16,
+};
+
+static const char *mt7988_pinctrl_register_base_names[] = {
+	"gpio_base",	 "iocfg_tr_base", "iocfg_br_base",
+	"iocfg_rb_base", "iocfg_lb_base", "iocfg_tl_base",
+};
+
+static struct mtk_pin_soc mt7988_data = {
+	.reg_cal = mt7988_reg_cals,
+	.pins = mt7988_pins,
+	.npins = ARRAY_SIZE(mt7988_pins),
+	.grps = mt7988_groups,
+	.ngrps = ARRAY_SIZE(mt7988_groups),
+	.funcs = mt7988_functions,
+	.nfuncs = ARRAY_SIZE(mt7988_functions),
+	.eint_hw = &mt7988_eint_hw,
+	.gpio_m = 0,
+	.ies_present = false,
+	.base_names = mt7988_pinctrl_register_base_names,
+	.nbase_names = ARRAY_SIZE(mt7988_pinctrl_register_base_names),
+	.bias_disable_set = mtk_pinconf_bias_disable_set,
+	.bias_disable_get = mtk_pinconf_bias_disable_get,
+	.bias_set = mtk_pinconf_bias_set,
+	.bias_get = mtk_pinconf_bias_get,
+	.drive_set = mtk_pinconf_drive_set_rev1,
+	.drive_get = mtk_pinconf_drive_get_rev1,
+	.adv_pull_get = mtk_pinconf_adv_pull_get,
+	.adv_pull_set = mtk_pinconf_adv_pull_set,
+};
+
+static const struct of_device_id mt7988_pinctrl_of_match[] = {
+	{
+		.compatible = "mediatek,mt7988-pinctrl",
+	},
+	{}
+};
+
+static int mt7988_pinctrl_probe(struct platform_device *pdev)
+{
+	return mtk_moore_pinctrl_probe(pdev, &mt7988_data);
+}
+
+static struct platform_driver mt7988_pinctrl_driver = {
+	.driver = {
+		.name = "mt7988-pinctrl",
+		.of_match_table = mt7988_pinctrl_of_match,
+	},
+	.probe = mt7988_pinctrl_probe,
+};
+
+static int __init mt7988_pinctrl_init(void)
+{
+	return platform_driver_register(&mt7988_pinctrl_driver);
+}
+arch_initcall(mt7988_pinctrl_init);
diff --git a/target/linux/mediatek/files-5.15/include/dt-bindings/clock/mediatek,mt7981-clk.h b/target/linux/mediatek/files-5.15/include/dt-bindings/clock/mediatek,mt7981-clk.h
new file mode 100644
index 00000000000000..192f8cefb589f4
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/include/dt-bindings/clock/mediatek,mt7981-clk.h
@@ -0,0 +1,215 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
+/*
+ * Copyright (c) 2021 MediaTek Inc.
+ * Author: Wenzhen.Yu <wenzhen.yu@mediatek.com>
+ * Author: Jianhui Zhao <zhaojh329@gmail.com>
+ * Author: Daniel Golle <daniel@makrotopia.org>
+ */
+
+#ifndef _DT_BINDINGS_CLK_MT7981_H
+#define _DT_BINDINGS_CLK_MT7981_H
+
+/* TOPCKGEN */
+#define CLK_TOP_CB_CKSQ_40M		0
+#define CLK_TOP_CB_M_416M		1
+#define CLK_TOP_CB_M_D2			2
+#define CLK_TOP_CB_M_D3			3
+#define CLK_TOP_M_D3_D2			4
+#define CLK_TOP_CB_M_D4			5
+#define CLK_TOP_CB_M_D8			6
+#define CLK_TOP_M_D8_D2			7
+#define CLK_TOP_CB_MM_720M		8
+#define CLK_TOP_CB_MM_D2		9
+#define CLK_TOP_CB_MM_D3		10
+#define CLK_TOP_CB_MM_D3_D5		11
+#define CLK_TOP_CB_MM_D4		12
+#define CLK_TOP_CB_MM_D6		13
+#define CLK_TOP_MM_D6_D2		14
+#define CLK_TOP_CB_MM_D8		15
+#define CLK_TOP_CB_APLL2_196M		16
+#define CLK_TOP_APLL2_D2		17
+#define CLK_TOP_APLL2_D4		18
+#define CLK_TOP_NET1_2500M		19
+#define CLK_TOP_CB_NET1_D4		20
+#define CLK_TOP_CB_NET1_D5		21
+#define CLK_TOP_NET1_D5_D2		22
+#define CLK_TOP_NET1_D5_D4		23
+#define CLK_TOP_CB_NET1_D8		24
+#define CLK_TOP_NET1_D8_D2		25
+#define CLK_TOP_NET1_D8_D4		26
+#define CLK_TOP_CB_NET2_800M		27
+#define CLK_TOP_CB_NET2_D2		28
+#define CLK_TOP_CB_NET2_D4		29
+#define CLK_TOP_NET2_D4_D2		30
+#define CLK_TOP_NET2_D4_D4		31
+#define CLK_TOP_CB_NET2_D6		32
+#define CLK_TOP_CB_WEDMCU_208M		33
+#define CLK_TOP_CB_SGM_325M		34
+#define CLK_TOP_CKSQ_40M_D2		35
+#define CLK_TOP_CB_RTC_32K		36
+#define CLK_TOP_CB_RTC_32P7K		37
+#define CLK_TOP_USB_TX250M		38
+#define CLK_TOP_FAUD			39
+#define CLK_TOP_NFI1X			40
+#define CLK_TOP_USB_EQ_RX250M		41
+#define CLK_TOP_USB_CDR_CK		42
+#define CLK_TOP_USB_LN0_CK		43
+#define CLK_TOP_SPINFI_BCK		44
+#define CLK_TOP_SPI			45
+#define CLK_TOP_SPIM_MST		46
+#define CLK_TOP_UART_BCK		47
+#define CLK_TOP_PWM_BCK			48
+#define CLK_TOP_I2C_BCK			49
+#define CLK_TOP_PEXTP_TL		50
+#define CLK_TOP_EMMC_208M		51
+#define CLK_TOP_EMMC_400M		52
+#define CLK_TOP_DRAMC_REF		53
+#define CLK_TOP_DRAMC_MD32		54
+#define CLK_TOP_SYSAXI			55
+#define CLK_TOP_SYSAPB			56
+#define CLK_TOP_ARM_DB_MAIN		57
+#define CLK_TOP_AP2CNN_HOST		58
+#define CLK_TOP_NETSYS			59
+#define CLK_TOP_NETSYS_500M		60
+#define CLK_TOP_NETSYS_WED_MCU		61
+#define CLK_TOP_NETSYS_2X		62
+#define CLK_TOP_SGM_325M		63
+#define CLK_TOP_SGM_REG			64
+#define CLK_TOP_F26M			65
+#define CLK_TOP_EIP97B			66
+#define CLK_TOP_USB3_PHY		67
+#define CLK_TOP_AUD			68
+#define CLK_TOP_A1SYS			69
+#define CLK_TOP_AUD_L			70
+#define CLK_TOP_A_TUNER			71
+#define CLK_TOP_U2U3_REF		72
+#define CLK_TOP_U2U3_SYS		73
+#define CLK_TOP_U2U3_XHCI		74
+#define CLK_TOP_USB_FRMCNT		75
+#define CLK_TOP_NFI1X_SEL		76
+#define CLK_TOP_SPINFI_SEL		77
+#define CLK_TOP_SPI_SEL			78
+#define CLK_TOP_SPIM_MST_SEL		79
+#define CLK_TOP_UART_SEL		80
+#define CLK_TOP_PWM_SEL			81
+#define CLK_TOP_I2C_SEL			82
+#define CLK_TOP_PEXTP_TL_SEL		83
+#define CLK_TOP_EMMC_208M_SEL		84
+#define CLK_TOP_EMMC_400M_SEL		85
+#define CLK_TOP_F26M_SEL		86
+#define CLK_TOP_DRAMC_SEL		87
+#define CLK_TOP_DRAMC_MD32_SEL		88
+#define CLK_TOP_SYSAXI_SEL		89
+#define CLK_TOP_SYSAPB_SEL		90
+#define CLK_TOP_ARM_DB_MAIN_SEL		91
+#define CLK_TOP_AP2CNN_HOST_SEL		92
+#define CLK_TOP_NETSYS_SEL		93
+#define CLK_TOP_NETSYS_500M_SEL		94
+#define CLK_TOP_NETSYS_MCU_SEL		95
+#define CLK_TOP_NETSYS_2X_SEL		96
+#define CLK_TOP_SGM_325M_SEL		97
+#define CLK_TOP_SGM_REG_SEL		98
+#define CLK_TOP_EIP97B_SEL		99
+#define CLK_TOP_USB3_PHY_SEL		100
+#define CLK_TOP_AUD_SEL			101
+#define CLK_TOP_A1SYS_SEL		102
+#define CLK_TOP_AUD_L_SEL		103
+#define CLK_TOP_A_TUNER_SEL		104
+#define CLK_TOP_U2U3_SEL		105
+#define CLK_TOP_U2U3_SYS_SEL		106
+#define CLK_TOP_U2U3_XHCI_SEL		107
+#define CLK_TOP_USB_FRMCNT_SEL		108
+#define CLK_TOP_AUD_I2S_M		109
+
+/* INFRACFG */
+#define CLK_INFRA_66M_MCK		0
+#define CLK_INFRA_UART0_SEL		1
+#define CLK_INFRA_UART1_SEL		2
+#define CLK_INFRA_UART2_SEL		3
+#define CLK_INFRA_SPI0_SEL		4
+#define CLK_INFRA_SPI1_SEL		5
+#define CLK_INFRA_SPI2_SEL		6
+#define CLK_INFRA_PWM1_SEL		7
+#define CLK_INFRA_PWM2_SEL		8
+#define CLK_INFRA_PWM3_SEL		9
+#define CLK_INFRA_PWM_BSEL		10
+#define CLK_INFRA_PCIE_SEL		11
+#define CLK_INFRA_GPT_STA		12
+#define CLK_INFRA_PWM_HCK		13
+#define CLK_INFRA_PWM_STA		14
+#define CLK_INFRA_PWM1_CK		15
+#define CLK_INFRA_PWM2_CK		16
+#define CLK_INFRA_PWM3_CK		17
+#define CLK_INFRA_CQ_DMA_CK		18
+#define CLK_INFRA_AUD_BUS_CK		19
+#define CLK_INFRA_AUD_26M_CK		20
+#define CLK_INFRA_AUD_L_CK		21
+#define CLK_INFRA_AUD_AUD_CK		22
+#define CLK_INFRA_AUD_EG2_CK		23
+#define CLK_INFRA_DRAMC_26M_CK		24
+#define CLK_INFRA_DBG_CK		25
+#define CLK_INFRA_AP_DMA_CK		26
+#define CLK_INFRA_SEJ_CK		27
+#define CLK_INFRA_SEJ_13M_CK		28
+#define CLK_INFRA_THERM_CK		29
+#define CLK_INFRA_I2C0_CK		30
+#define CLK_INFRA_UART0_CK		31
+#define CLK_INFRA_UART1_CK		32
+#define CLK_INFRA_UART2_CK		33
+#define CLK_INFRA_SPI2_CK		34
+#define CLK_INFRA_SPI2_HCK_CK		35
+#define CLK_INFRA_NFI1_CK		36
+#define CLK_INFRA_SPINFI1_CK		37
+#define CLK_INFRA_NFI_HCK_CK		38
+#define CLK_INFRA_SPI0_CK		39
+#define CLK_INFRA_SPI1_CK		40
+#define CLK_INFRA_SPI0_HCK_CK		41
+#define CLK_INFRA_SPI1_HCK_CK		42
+#define CLK_INFRA_FRTC_CK		43
+#define CLK_INFRA_MSDC_CK		44
+#define CLK_INFRA_MSDC_HCK_CK		45
+#define CLK_INFRA_MSDC_133M_CK		46
+#define CLK_INFRA_MSDC_66M_CK		47
+#define CLK_INFRA_ADC_26M_CK		48
+#define CLK_INFRA_ADC_FRC_CK		49
+#define CLK_INFRA_FBIST2FPC_CK		50
+#define CLK_INFRA_I2C_MCK_CK		51
+#define CLK_INFRA_I2C_PCK_CK		52
+#define CLK_INFRA_IUSB_133_CK		53
+#define CLK_INFRA_IUSB_66M_CK		54
+#define CLK_INFRA_IUSB_SYS_CK		55
+#define CLK_INFRA_IUSB_CK		56
+#define CLK_INFRA_IPCIE_CK		57
+#define CLK_INFRA_IPCIE_PIPE_CK		58
+#define CLK_INFRA_IPCIER_CK		59
+#define CLK_INFRA_IPCIEB_CK		60
+
+/* APMIXEDSYS */
+#define CLK_APMIXED_ARMPLL		0
+#define CLK_APMIXED_NET2PLL		1
+#define CLK_APMIXED_MMPLL		2
+#define CLK_APMIXED_SGMPLL		3
+#define CLK_APMIXED_WEDMCUPLL		4
+#define CLK_APMIXED_NET1PLL		5
+#define CLK_APMIXED_MPLL		6
+#define CLK_APMIXED_APLL2		7
+
+/* SGMIISYS_0 */
+#define CLK_SGM0_TX_EN			0
+#define CLK_SGM0_RX_EN			1
+#define CLK_SGM0_CK0_EN			2
+#define CLK_SGM0_CDR_CK0_EN		3
+
+/* SGMIISYS_1 */
+#define CLK_SGM1_TX_EN			0
+#define CLK_SGM1_RX_EN			1
+#define CLK_SGM1_CK1_EN			2
+#define CLK_SGM1_CDR_CK1_EN		3
+
+/* ETHSYS */
+#define CLK_ETH_FE_EN			0
+#define CLK_ETH_GP2_EN			1
+#define CLK_ETH_GP1_EN			2
+#define CLK_ETH_WOCPU0_EN		3
+
+#endif /* _DT_BINDINGS_CLK_MT7981_H */
diff --git a/target/linux/mediatek/files-5.15/include/dt-bindings/clock/mediatek,mt7988-clk.h b/target/linux/mediatek/files-5.15/include/dt-bindings/clock/mediatek,mt7988-clk.h
new file mode 100644
index 00000000000000..77cfea4a8eaf6a
--- /dev/null
+++ b/target/linux/mediatek/files-5.15/include/dt-bindings/clock/mediatek,mt7988-clk.h
@@ -0,0 +1,276 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
+/*
+ * Copyright (c) 2023 MediaTek Inc.
+ * Author: Sam Shih <sam.shih@mediatek.com>
+ * Author: Xiufeng Li <Xiufeng.Li@mediatek.com>
+ */
+
+#ifndef _DT_BINDINGS_CLK_MT7988_H
+#define _DT_BINDINGS_CLK_MT7988_H
+
+/* APMIXEDSYS */
+
+#define CLK_APMIXED_NETSYSPLL  0
+#define CLK_APMIXED_MPLL       1
+#define CLK_APMIXED_MMPLL      2
+#define CLK_APMIXED_APLL2      3
+#define CLK_APMIXED_NET1PLL    4
+#define CLK_APMIXED_NET2PLL    5
+#define CLK_APMIXED_WEDMCUPLL  6
+#define CLK_APMIXED_SGMPLL     7
+#define CLK_APMIXED_ARM_B      8
+#define CLK_APMIXED_CCIPLL2_B  9
+#define CLK_APMIXED_USXGMIIPLL 10
+#define CLK_APMIXED_MSDCPLL    11
+
+/* TOPCKGEN */
+
+#define CLK_TOP_XTAL		       0
+#define CLK_TOP_XTAL_D2		       1
+#define CLK_TOP_RTC_32K		       2
+#define CLK_TOP_RTC_32P7K	       3
+#define CLK_TOP_MPLL_D2		       4
+#define CLK_TOP_MPLL_D3_D2	       5
+#define CLK_TOP_MPLL_D4		       6
+#define CLK_TOP_MPLL_D8		       7
+#define CLK_TOP_MPLL_D8_D2	       8
+#define CLK_TOP_MMPLL_D2	       9
+#define CLK_TOP_MMPLL_D3_D5	       10
+#define CLK_TOP_MMPLL_D4	       11
+#define CLK_TOP_MMPLL_D6_D2	       12
+#define CLK_TOP_MMPLL_D8	       13
+#define CLK_TOP_APLL2_D4	       14
+#define CLK_TOP_NET1PLL_D4	       15
+#define CLK_TOP_NET1PLL_D5	       16
+#define CLK_TOP_NET1PLL_D5_D2	       17
+#define CLK_TOP_NET1PLL_D5_D4	       18
+#define CLK_TOP_NET1PLL_D8	       19
+#define CLK_TOP_NET1PLL_D8_D2	       20
+#define CLK_TOP_NET1PLL_D8_D4	       21
+#define CLK_TOP_NET1PLL_D8_D8	       22
+#define CLK_TOP_NET1PLL_D8_D16	       23
+#define CLK_TOP_NET2PLL_D2	       24
+#define CLK_TOP_NET2PLL_D4	       25
+#define CLK_TOP_NET2PLL_D4_D4	       26
+#define CLK_TOP_NET2PLL_D4_D8	       27
+#define CLK_TOP_NET2PLL_D6	       28
+#define CLK_TOP_NET2PLL_D8	       29
+#define CLK_TOP_NETSYS_SEL	       30
+#define CLK_TOP_NETSYS_500M_SEL	       31
+#define CLK_TOP_NETSYS_2X_SEL	       32
+#define CLK_TOP_NETSYS_GSW_SEL	       33
+#define CLK_TOP_ETH_GMII_SEL	       34
+#define CLK_TOP_NETSYS_MCU_SEL	       35
+#define CLK_TOP_NETSYS_PAO_2X_SEL      36
+#define CLK_TOP_EIP197_SEL	       37
+#define CLK_TOP_AXI_INFRA_SEL	       38
+#define CLK_TOP_UART_SEL	       39
+#define CLK_TOP_EMMC_250M_SEL	       40
+#define CLK_TOP_EMMC_400M_SEL	       41
+#define CLK_TOP_SPI_SEL		       42
+#define CLK_TOP_SPIM_MST_SEL	       43
+#define CLK_TOP_NFI1X_SEL	       44
+#define CLK_TOP_SPINFI_SEL	       45
+#define CLK_TOP_PWM_SEL		       46
+#define CLK_TOP_I2C_SEL		       47
+#define CLK_TOP_PCIE_MBIST_250M_SEL    48
+#define CLK_TOP_PEXTP_TL_SEL	       49
+#define CLK_TOP_PEXTP_TL_P1_SEL	       50
+#define CLK_TOP_PEXTP_TL_P2_SEL	       51
+#define CLK_TOP_PEXTP_TL_P3_SEL	       52
+#define CLK_TOP_USB_SYS_SEL	       53
+#define CLK_TOP_USB_SYS_P1_SEL	       54
+#define CLK_TOP_USB_XHCI_SEL	       55
+#define CLK_TOP_USB_XHCI_P1_SEL	       56
+#define CLK_TOP_USB_FRMCNT_SEL	       57
+#define CLK_TOP_USB_FRMCNT_P1_SEL      58
+#define CLK_TOP_AUD_SEL		       59
+#define CLK_TOP_A1SYS_SEL	       60
+#define CLK_TOP_AUD_L_SEL	       61
+#define CLK_TOP_A_TUNER_SEL	       62
+#define CLK_TOP_SSPXTP_SEL	       63
+#define CLK_TOP_USB_PHY_SEL	       64
+#define CLK_TOP_USXGMII_SBUS_0_SEL     65
+#define CLK_TOP_USXGMII_SBUS_1_SEL     66
+#define CLK_TOP_SGM_0_SEL	       67
+#define CLK_TOP_SGM_SBUS_0_SEL	       68
+#define CLK_TOP_SGM_1_SEL	       69
+#define CLK_TOP_SGM_SBUS_1_SEL	       70
+#define CLK_TOP_XFI_PHY_0_XTAL_SEL     71
+#define CLK_TOP_XFI_PHY_1_XTAL_SEL     72
+#define CLK_TOP_SYSAXI_SEL	       73
+#define CLK_TOP_SYSAPB_SEL	       74
+#define CLK_TOP_ETH_REFCK_50M_SEL      75
+#define CLK_TOP_ETH_SYS_200M_SEL       76
+#define CLK_TOP_ETH_SYS_SEL	       77
+#define CLK_TOP_ETH_XGMII_SEL	       78
+#define CLK_TOP_BUS_TOPS_SEL	       79
+#define CLK_TOP_NPU_TOPS_SEL	       80
+#define CLK_TOP_DRAMC_SEL	       81
+#define CLK_TOP_DRAMC_MD32_SEL	       82
+#define CLK_TOP_INFRA_F26M_SEL	       83
+#define CLK_TOP_PEXTP_P0_SEL	       84
+#define CLK_TOP_PEXTP_P1_SEL	       85
+#define CLK_TOP_PEXTP_P2_SEL	       86
+#define CLK_TOP_PEXTP_P3_SEL	       87
+#define CLK_TOP_DA_XTP_GLB_P0_SEL      88
+#define CLK_TOP_DA_XTP_GLB_P1_SEL      89
+#define CLK_TOP_DA_XTP_GLB_P2_SEL      90
+#define CLK_TOP_DA_XTP_GLB_P3_SEL      91
+#define CLK_TOP_CKM_SEL		       92
+#define CLK_TOP_DA_SEL		       93
+#define CLK_TOP_PEXTP_SEL	       94
+#define CLK_TOP_TOPS_P2_26M_SEL	       95
+#define CLK_TOP_MCUSYS_BACKUP_625M_SEL 96
+#define CLK_TOP_NETSYS_SYNC_250M_SEL   97
+#define CLK_TOP_MACSEC_SEL	       98
+#define CLK_TOP_NETSYS_TOPS_400M_SEL   99
+#define CLK_TOP_NETSYS_PPEFB_250M_SEL  100
+#define CLK_TOP_NETSYS_WARP_SEL	       101
+#define CLK_TOP_ETH_MII_SEL	       102
+#define CLK_TOP_NPU_SEL		       103
+#define CLK_TOP_AUD_I2S_M	       104
+
+/* MCUSYS */
+
+#define CLK_MCU_BUS_DIV_SEL 0
+#define CLK_MCU_ARM_DIV_SEL 1
+
+/* INFRACFG_AO */
+
+#define CLK_INFRA_MUX_UART0_SEL		 0
+#define CLK_INFRA_MUX_UART1_SEL		 1
+#define CLK_INFRA_MUX_UART2_SEL		 2
+#define CLK_INFRA_MUX_SPI0_SEL		 3
+#define CLK_INFRA_MUX_SPI1_SEL		 4
+#define CLK_INFRA_MUX_SPI2_SEL		 5
+#define CLK_INFRA_PWM_SEL		 6
+#define CLK_INFRA_PWM_CK1_SEL		 7
+#define CLK_INFRA_PWM_CK2_SEL		 8
+#define CLK_INFRA_PWM_CK3_SEL		 9
+#define CLK_INFRA_PWM_CK4_SEL		 10
+#define CLK_INFRA_PWM_CK5_SEL		 11
+#define CLK_INFRA_PWM_CK6_SEL		 12
+#define CLK_INFRA_PWM_CK7_SEL		 13
+#define CLK_INFRA_PWM_CK8_SEL		 14
+#define CLK_INFRA_PCIE_GFMUX_TL_O_P0_SEL 15
+#define CLK_INFRA_PCIE_GFMUX_TL_O_P1_SEL 16
+#define CLK_INFRA_PCIE_GFMUX_TL_O_P2_SEL 17
+#define CLK_INFRA_PCIE_GFMUX_TL_O_P3_SEL 18
+
+/* INFRACFG */
+
+#define CLK_INFRA_PCIE_PERI_26M_CK_P0 19
+#define CLK_INFRA_PCIE_PERI_26M_CK_P1 20
+#define CLK_INFRA_PCIE_PERI_26M_CK_P2 21
+#define CLK_INFRA_PCIE_PERI_26M_CK_P3 22
+#define CLK_INFRA_66M_GPT_BCK	      23
+#define CLK_INFRA_66M_PWM_HCK	      24
+#define CLK_INFRA_66M_PWM_BCK	      25
+#define CLK_INFRA_66M_PWM_CK1	      26
+#define CLK_INFRA_66M_PWM_CK2	      27
+#define CLK_INFRA_66M_PWM_CK3	      28
+#define CLK_INFRA_66M_PWM_CK4	      29
+#define CLK_INFRA_66M_PWM_CK5	      30
+#define CLK_INFRA_66M_PWM_CK6	      31
+#define CLK_INFRA_66M_PWM_CK7	      32
+#define CLK_INFRA_66M_PWM_CK8	      33
+#define CLK_INFRA_133M_CQDMA_BCK      34
+#define CLK_INFRA_66M_AUD_SLV_BCK     35
+#define CLK_INFRA_AUD_26M	      36
+#define CLK_INFRA_AUD_L		      37
+#define CLK_INFRA_AUD_AUD	      38
+#define CLK_INFRA_AUD_EG2	      39
+#define CLK_INFRA_DRAMC_F26M	      40
+#define CLK_INFRA_133M_DBG_ACKM	      41
+#define CLK_INFRA_66M_AP_DMA_BCK      42
+#define CLK_INFRA_66M_SEJ_BCK	      43
+#define CLK_INFRA_PRE_CK_SEJ_F13M     44
+#define CLK_INFRA_26M_THERM_SYSTEM    45
+#define CLK_INFRA_I2C_BCK	      46
+#define CLK_INFRA_52M_UART0_CK	      47
+#define CLK_INFRA_52M_UART1_CK	      48
+#define CLK_INFRA_52M_UART2_CK	      49
+#define CLK_INFRA_NFI		      50
+#define CLK_INFRA_SPINFI	      51
+#define CLK_INFRA_66M_NFI_HCK	      52
+#define CLK_INFRA_104M_SPI0	      53
+#define CLK_INFRA_104M_SPI1	      54
+#define CLK_INFRA_104M_SPI2_BCK	      55
+#define CLK_INFRA_66M_SPI0_HCK	      56
+#define CLK_INFRA_66M_SPI1_HCK	      57
+#define CLK_INFRA_66M_SPI2_HCK	      58
+#define CLK_INFRA_66M_FLASHIF_AXI     59
+#define CLK_INFRA_RTC		      60
+#define CLK_INFRA_26M_ADC_BCK	      61
+#define CLK_INFRA_RC_ADC	      62
+#define CLK_INFRA_MSDC400	      63
+#define CLK_INFRA_MSDC2_HCK	      64
+#define CLK_INFRA_133M_MSDC_0_HCK     65
+#define CLK_INFRA_66M_MSDC_0_HCK      66
+#define CLK_INFRA_133M_CPUM_BCK	      67
+#define CLK_INFRA_BIST2FPC	      68
+#define CLK_INFRA_I2C_X16W_MCK_CK_P1  69
+#define CLK_INFRA_I2C_X16W_PCK_CK_P1  70
+#define CLK_INFRA_133M_USB_HCK	      71
+#define CLK_INFRA_133M_USB_HCK_CK_P1  72
+#define CLK_INFRA_66M_USB_HCK	      73
+#define CLK_INFRA_66M_USB_HCK_CK_P1   74
+#define CLK_INFRA_USB_SYS	      75
+#define CLK_INFRA_USB_SYS_CK_P1	      76
+#define CLK_INFRA_USB_REF	      77
+#define CLK_INFRA_USB_CK_P1	      78
+#define CLK_INFRA_USB_FRMCNT	      79
+#define CLK_INFRA_USB_FRMCNT_CK_P1    80
+#define CLK_INFRA_USB_PIPE	      81
+#define CLK_INFRA_USB_PIPE_CK_P1      82
+#define CLK_INFRA_USB_UTMI	      83
+#define CLK_INFRA_USB_UTMI_CK_P1      84
+#define CLK_INFRA_USB_XHCI	      85
+#define CLK_INFRA_USB_XHCI_CK_P1      86
+#define CLK_INFRA_PCIE_GFMUX_TL_P0    87
+#define CLK_INFRA_PCIE_GFMUX_TL_P1    88
+#define CLK_INFRA_PCIE_GFMUX_TL_P2    89
+#define CLK_INFRA_PCIE_GFMUX_TL_P3    90
+#define CLK_INFRA_PCIE_PIPE_P0	      91
+#define CLK_INFRA_PCIE_PIPE_P1	      92
+#define CLK_INFRA_PCIE_PIPE_P2	      93
+#define CLK_INFRA_PCIE_PIPE_P3	      94
+#define CLK_INFRA_133M_PCIE_CK_P0     95
+#define CLK_INFRA_133M_PCIE_CK_P1     96
+#define CLK_INFRA_133M_PCIE_CK_P2     97
+#define CLK_INFRA_133M_PCIE_CK_P3     98
+
+/* ETHDMA */
+
+#define CLK_ETHDMA_XGP1_EN   0
+#define CLK_ETHDMA_XGP2_EN   1
+#define CLK_ETHDMA_XGP3_EN   2
+#define CLK_ETHDMA_FE_EN     3
+#define CLK_ETHDMA_GP2_EN    4
+#define CLK_ETHDMA_GP1_EN    5
+#define CLK_ETHDMA_GP3_EN    6
+#define CLK_ETHDMA_ESW_EN    7
+#define CLK_ETHDMA_CRYPT0_EN 8
+#define CLK_ETHDMA_NR_CLK    9
+
+/* SGMIISYS_0 */
+
+#define CLK_SGM0_TX_EN	  0
+#define CLK_SGM0_RX_EN	  1
+#define CLK_SGMII0_NR_CLK 2
+
+/* SGMIISYS_1 */
+
+#define CLK_SGM1_TX_EN	  0
+#define CLK_SGM1_RX_EN	  1
+#define CLK_SGMII1_NR_CLK 2
+
+/* ETHWARP */
+
+#define CLK_ETHWARP_WOCPU2_EN 0
+#define CLK_ETHWARP_WOCPU1_EN 1
+#define CLK_ETHWARP_WOCPU0_EN 2
+#define CLK_ETHWARP_NR_CLK    3
+
+#endif /* _DT_BINDINGS_CLK_MT7988_H */
diff --git a/target/linux/mediatek/files-5.15/include/dt-bindings/reset/mt7986-resets.h b/target/linux/mediatek/files-5.15/include/dt-bindings/reset/mt7986-resets.h
index 1bdfe34a7a3492..af3d16c81192f7 100644
--- a/target/linux/mediatek/files-5.15/include/dt-bindings/reset/mt7986-resets.h
+++ b/target/linux/mediatek/files-5.15/include/dt-bindings/reset/mt7986-resets.h
@@ -1,10 +1,55 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/* Copyright (c) 2021 MediaTek Inc. */
+/* SPDX-License-Identifier: (GPL-2.0+ OR BSD-3-Clause) */
+/*
+ * Copyright (c) 2022 MediaTek Inc.
+ * Author: Sam Shih <sam.shih@mediatek.com>
+ */
 
-#ifndef _DT_BINDINGS_RESET_MT7986
-#define _DT_BINDINGS_RESET_MT7986
+#ifndef _DT_BINDINGS_RESET_CONTROLLER_MT7986
+#define _DT_BINDINGS_RESET_CONTROLLER_MT7986
 
-#define MT7986_TOPRGU_CONSYS_RST	23
-#define MT7986_TOPRGU_SW_RST_NUM	32
+/* INFRACFG resets */
+#define MT7986_INFRACFG_PEXTP_MAC_SW_RST	6
+#define MT7986_INFRACFG_SSUSB_SW_RST		7
+#define MT7986_INFRACFG_EIP97_SW_RST		8
+#define MT7986_INFRACFG_AUDIO_SW_RST		13
+#define MT7986_INFRACFG_CQ_DMA_SW_RST		14
 
-#endif  /* _DT_BINDINGS_RESET_MT7986 */
+#define MT7986_INFRACFG_TRNG_SW_RST		17
+#define MT7986_INFRACFG_AP_DMA_SW_RST		32
+#define MT7986_INFRACFG_I2C_SW_RST		33
+#define MT7986_INFRACFG_NFI_SW_RST		34
+#define MT7986_INFRACFG_SPI0_SW_RST		35
+#define MT7986_INFRACFG_SPI1_SW_RST		36
+#define MT7986_INFRACFG_UART0_SW_RST		37
+#define MT7986_INFRACFG_UART1_SW_RST		38
+#define MT7986_INFRACFG_UART2_SW_RST		39
+#define MT7986_INFRACFG_AUXADC_SW_RST		43
+
+#define MT7986_INFRACFG_APXGPT_SW_RST		66
+#define MT7986_INFRACFG_PWM_SW_RST		68
+
+#define MT7986_INFRACFG_SW_RST_NUM		69
+
+/* TOPRGU resets */
+#define MT7986_TOPRGU_APMIXEDSYS_SW_RST		0
+#define MT7986_TOPRGU_SGMII0_SW_RST		1
+#define MT7986_TOPRGU_SGMII1_SW_RST		2
+#define MT7986_TOPRGU_INFRA_SW_RST		3
+#define MT7986_TOPRGU_U2PHY_SW_RST		5
+#define MT7986_TOPRGU_PCIE_SW_RST		6
+#define MT7986_TOPRGU_SSUSB_SW_RST		7
+#define MT7986_TOPRGU_ETHDMA_SW_RST		20
+#define MT7986_TOPRGU_CONSYS_SW_RST		23
+
+#define MT7986_TOPRGU_SW_RST_NUM		24
+
+/* ETHSYS Subsystem resets */
+#define MT7986_ETHSYS_FE_SW_RST			6
+#define MT7986_ETHSYS_PMTR_SW_RST		8
+#define MT7986_ETHSYS_GMAC_SW_RST		23
+#define MT7986_ETHSYS_PPE0_SW_RST		30
+#define MT7986_ETHSYS_PPE1_SW_RST		31
+
+#define MT7986_ETHSYS_SW_RST_NUM		32
+
+#endif  /* _DT_BINDINGS_RESET_CONTROLLER_MT7986 */
diff --git a/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds b/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds
new file mode 100644
index 00000000000000..1cb00ce26db3dc
--- /dev/null
+++ b/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds
@@ -0,0 +1,20 @@
+. /lib/functions/leds.sh
+. /lib/functions/uci-defaults.sh
+
+board=$(board_name)
+
+board_config_update
+
+case $board in
+cudy,wr3000-v1)
+	ucidef_set_led_netdev "wan" "wan" "blue:wan" "wan"
+	;;
+xiaomi,redmi-router-ax6000-stock|\
+xiaomi,redmi-router-ax6000-ubootmod)
+	ucidef_set_led_netdev "wan" "wan" "rgb:network" "wan"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/mediatek/filogic/base-files/etc/board.d/02_network b/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
index f7dc7a01e061c7..a327a46108acd9 100644
--- a/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
+++ b/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
@@ -8,13 +8,40 @@ mediatek_setup_interfaces()
 	local board="$1"
 
 	case $board in
-	mediatek,mt7986a-rfb|\
-	mediatek,mt7986b-rfb)
-		ucidef_set_interfaces_lan_wan "lan0 lan1 lan2 lan3" eth1
+	asus,tuf-ax4200)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" eth1
 		;;
 	bananapi,bpi-r3)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4 sfp2" "eth1 wan"
-		ucidef_set_interface_macaddr "wan" "$(macaddr_add $(cat /sys/class/net/eth0/address) 1)"
+		;;
+	cudy,wr3000-v1)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" "wan"
+		;;
+	glinet,gl-mt3000)
+		ucidef_set_interfaces_lan_wan eth1 eth0
+		;;
+	mediatek,mt7986a-rfb)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4 lan6" "eth1 wan"
+		;;
+	mediatek,mt7986b-rfb)
+		ucidef_set_interfaces_lan_wan "lan0 lan1 lan2 lan3" eth1
+		;;
+	mediatek,mt7988a-dsa-10g-spim-snand)
+		ucidef_set_interfaces_lan_wan "lan0 lan1 lan2 lan3" "eth1 eth2"
+		;;
+	qihoo,360t7)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" wan
+		;;
+	tplink,tl-xdr4288|\
+	tplink,tl-xdr6088)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4 lan5" eth1
+		;;
+	tplink,tl-xdr6086)
+		ucidef_set_interfaces_lan_wan "lan1 lan2" eth1
+		;;
+	xiaomi,redmi-router-ax6000-stock|\
+	xiaomi,redmi-router-ax6000-ubootmod)
+		ucidef_set_interfaces_lan_wan "lan2 lan3 lan4" wan
 		;;
 	*)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" wan
@@ -22,9 +49,44 @@ mediatek_setup_interfaces()
 	esac
 }
 
+mediatek_setup_macs()
+{
+	local board="$1"
+	local lan_mac=""
+	local wan_mac=""
+	local label_mac=""
+
+	case $board in
+	asus,tuf-ax4200)
+		CI_UBIPART="UBI_DEV"
+		addr=$(mtd_get_mac_binary_ubi "Factory" 0x4)
+		wan_mac="${addr}"
+		lan_mac="${addr}"
+		;;
+	bananapi,bpi-r3)
+		wan_mac=$(macaddr_add $(cat /sys/class/net/eth0/address) 1)
+		;;
+	qihoo,360t7)
+		lan_mac=$(mtd_get_mac_ascii factory lanMac)
+		wan_mac=$(macaddr_add "$lan_mac" 1)
+		label_mac=$wan_mac
+		;;
+	xiaomi,redmi-router-ax6000-stock|\
+	xiaomi,redmi-router-ax6000-ubootmod)
+		wan_mac=$(mtd_get_mac_ascii Bdata ethaddr_wan)
+		label_mac=$wan_mac
+		;;
+	esac
+
+	[ -n "$lan_mac" ] && ucidef_set_interface_macaddr "lan" $lan_mac
+	[ -n "$wan_mac" ] && ucidef_set_interface_macaddr "wan" $wan_mac
+	[ -n "$label_mac" ] && ucidef_set_label_macaddr $label_mac
+}
+
 board_config_update
 board=$(board_name)
 mediatek_setup_interfaces $board
+mediatek_setup_macs $board
 board_config_flush
 
 exit 0
diff --git a/target/linux/mediatek/filogic/base-files/etc/board.d/05_compat-version b/target/linux/mediatek/filogic/base-files/etc/board.d/05_compat-version
new file mode 100644
index 00000000000000..e0e1a8ecc73e3d
--- /dev/null
+++ b/target/linux/mediatek/filogic/base-files/etc/board.d/05_compat-version
@@ -0,0 +1,15 @@
+
+. /lib/functions.sh
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+	bananapi,bpi-r3)
+		ucidef_set_compat_version "1.1"
+		;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/mediatek/filogic/base-files/etc/hotplug.d/firmware/11-mt76-caldata b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/firmware/11-mt76-caldata
new file mode 100644
index 00000000000000..0fe4c6998870cf
--- /dev/null
+++ b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/firmware/11-mt76-caldata
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+[ -e /lib/firmware/$FIRMWARE ] && exit 0
+
+. /lib/functions/caldata.sh
+
+board=$(board_name)
+
+case "$FIRMWARE" in
+"mediatek/mt7986_eeprom_mt7976_dbdc.bin")
+	case "$board" in
+	asus,tuf-ax4200)
+		CI_UBIPART="UBI_DEV"
+		caldata_extract_ubi "Factory" 0x0 0x1000
+		;;
+	esac
+	;;
+*)
+	exit 1
+	;;
+esac
diff --git a/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
new file mode 100644
index 00000000000000..a3db00f5e8ffd0
--- /dev/null
+++ b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
@@ -0,0 +1,49 @@
+[ "$ACTION" == "add" ] || exit 0
+
+PHYNBR=${DEVPATH##*/phy}
+
+[ -n $PHYNBR ] || exit 0
+
+. /lib/functions.sh
+. /lib/functions/system.sh
+
+board=$(board_name)
+
+case "$board" in
+	asus,tuf-ax4200)
+		CI_UBIPART="UBI_DEV"
+		addr=$(mtd_get_mac_binary_ubi "Factory" 0x4)
+		# Originally, phy0 is phy1 mac with LA bit set. However, this would conflict
+		# addresses on multiple VIFs with the other radio. Set LA bit and increment
+		# mac-address instead.
+		[ "$PHYNBR" = "0" ] && macaddr_setbit_la $(macaddr_add $addr 1) > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && echo "$addr" > /sys${DEVPATH}/macaddress
+		;;
+	bananapi,bpi-r3)
+		addr=$(macaddr_add $(cat /sys/class/net/eth0/address) 2)
+		[ "$PHYNBR" = "0" ] && macaddr_unsetbit $addr 6 > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && macaddr_setbit $addr 6 > /sys${DEVPATH}/macaddress
+		;;
+	cudy,wr3000-v1)
+		addr=$(mtd_get_mac_binary bdinfo 0xde00)
+		# Originally, phy0 is phy1 mac with LA bit set. However, this would conflict
+		# addresses on multiple VIFs with the other radio. Set LA bit and increment
+		# mac-address instead.
+		[ "$PHYNBR" = "0" ] && echo "$addr" > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && macaddr_setbit_la $(macaddr_add $addr 1) > /sys${DEVPATH}/macaddress
+		;;
+	qihoo,360t7)
+		addr=$(mtd_get_mac_ascii factory lanMac)
+		[ "$PHYNBR" = "0" ] && macaddr_add $addr 2 > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && macaddr_add $addr 3 > /sys${DEVPATH}/macaddress
+		;;
+	tplink,tl-xdr4288|\
+	tplink,tl-xdr6086|\
+	tplink,tl-xdr6088)
+		[ "$PHYNBR" = "0" ] && get_mac_label > /sys${DEVPATH}/macaddress
+		;;
+	zyxel,ex5601-t0)
+		addr=$(mtd_get_mac_binary "Factory" 0x4)
+		[ "$PHYNBR" = "1" ] && macaddr_add $addr 1 > /sys${DEVPATH}/macaddress
+		;;
+esac
diff --git a/target/linux/mediatek/filogic/base-files/etc/uci-defaults/05_fix-compat-version b/target/linux/mediatek/filogic/base-files/etc/uci-defaults/05_fix-compat-version
new file mode 100644
index 00000000000000..4486f2f090c55a
--- /dev/null
+++ b/target/linux/mediatek/filogic/base-files/etc/uci-defaults/05_fix-compat-version
@@ -0,0 +1,10 @@
+. /lib/functions.sh
+
+case "$(board_name)" in
+	bananapi,bpi-r3)
+	uci set system.@system[0].compat_version="1.1"
+	uci commit system
+	;;
+esac
+
+exit 0
diff --git a/target/linux/mediatek/filogic/base-files/lib/preinit/10_fix_eth_mac.sh b/target/linux/mediatek/filogic/base-files/lib/preinit/10_fix_eth_mac.sh
new file mode 100644
index 00000000000000..ec078741c986ef
--- /dev/null
+++ b/target/linux/mediatek/filogic/base-files/lib/preinit/10_fix_eth_mac.sh
@@ -0,0 +1,14 @@
+. /lib/functions/system.sh
+
+preinit_set_mac_address() {
+	case $(board_name) in
+	asus,tuf-ax4200)
+		CI_UBIPART="UBI_DEV"
+		addr=$(mtd_get_mac_binary_ubi "Factory" 0x4)
+		ip link set dev eth0 address "$addr"
+		ip link set dev eth1 address "$addr"
+		;;
+	esac
+}
+
+boot_hook_add preinit_main preinit_set_mac_address
diff --git a/target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh b/target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh
index 811e5133f2e469..5b624bc5517146 100755
--- a/target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh
+++ b/target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh
@@ -1,13 +1,56 @@
 REQUIRE_IMAGE_METADATA=1
 
+redmi_ax6000_initial_setup()
+{
+	# initialize UBI and setup uboot-env if it's running on initramfs
+	[ "$(rootfs_type)" = "tmpfs" ] || return 0
+
+	local mtdnum="$( find_mtd_index ubi )"
+	if [ ! "$mtdnum" ]; then
+		echo "unable to find mtd partition ubi"
+		return 1
+	fi
+
+	local kern_mtdnum="$( find_mtd_index ubi_kernel )"
+	if [ ! "$kern_mtdnum" ]; then
+		echo "unable to find mtd partition ubi_kernel"
+		return 1
+	fi
+
+	ubidetach -m "$mtdnum"
+	ubiformat /dev/mtd$mtdnum -y
+
+	ubidetach -m "$kern_mtdnum"
+	ubiformat /dev/mtd$kern_mtdnum -y
+
+	if ! fw_printenv -n flag_try_sys2_failed &>/dev/null; then
+		echo "failed to access u-boot-env. skip env setup."
+		return 0
+	fi
+
+	fw_setenv boot_wait on
+	fw_setenv uart_en 1
+	fw_setenv flag_boot_rootfs 0
+	fw_setenv flag_last_success 1
+	fw_setenv flag_boot_success 1
+	fw_setenv flag_try_sys1_failed 8
+	fw_setenv flag_try_sys2_failed 8
+	fw_setenv mtdparts "nmbm0:1024k(bl2),256k(Nvram),256k(Bdata),2048k(factory),2048k(fip),256k(crash),256k(crash_log),30720k(ubi),30720k(ubi1),51200k(overlay)"
+}
+
 platform_do_upgrade() {
 	local board=$(board_name)
-	local file_type=$(identify $1)
 
 	case "$board" in
+	asus,tuf-ax4200)
+		CI_UBIPART="UBI_DEV"
+		CI_KERNPART="linux"
+		nand_do_upgrade "$1"
+		;;
 	bananapi,bpi-r3)
-		export_bootdevice
-		export_partdevice rootdev 0
+		local rootdev="$(cmdline_get_var root)"
+		rootdev="${rootdev##*/}"
+		rootdev="${rootdev%p[0-9]*}"
 		case "$rootdev" in
 		mmc*)
 			CI_ROOTDEV="$rootdev"
@@ -24,6 +67,22 @@ platform_do_upgrade() {
 			;;
 		esac
 		;;
+	cudy,wr3000-v1)
+		default_do_upgrade "$1"
+		;;
+	qihoo,360t7|\
+	tplink,tl-xdr4288|\
+	tplink,tl-xdr6086|\
+	tplink,tl-xdr6088|\
+	xiaomi,redmi-router-ax6000-ubootmod)
+		CI_KERNPART="fit"
+		nand_do_upgrade "$1"
+		;;
+	xiaomi,redmi-router-ax6000-stock)
+		CI_KERN_UBIPART=ubi_kernel
+		CI_ROOT_UBIPART=ubi
+		nand_do_upgrade "$1"
+		;;
 	*)
 		nand_do_upgrade "$1"
 		;;
@@ -48,7 +107,7 @@ platform_check_image() {
 		;;
 	*)
 		nand_do_platform_check "$board" "$1"
-		return 0
+		return $?
 		;;
 	esac
 
@@ -58,13 +117,21 @@ platform_check_image() {
 platform_copy_config() {
 	case "$(board_name)" in
 	bananapi,bpi-r3)
-		export_bootdevice
-		export_partdevice rootdev 0
-		case "$rootdev" in
-		mmc*)
+		case "$(cmdline_get_var root)" in
+		/dev/mmc*)
 			emmc_copy_config
 			;;
 		esac
 		;;
 	esac
 }
+
+platform_pre_upgrade() {
+	local board=$(board_name)
+
+	case "$board" in
+	xiaomi,redmi-router-ax6000-stock)
+		redmi_ax6000_initial_setup
+		;;
+	esac
+}
diff --git a/target/linux/mediatek/filogic/config-5.15 b/target/linux/mediatek/filogic/config-5.15
index 0c026e0e012d61..4cae8c50ac7427 100644
--- a/target/linux/mediatek/filogic/config-5.15
+++ b/target/linux/mediatek/filogic/config-5.15
@@ -16,15 +16,12 @@ CONFIG_ARCH_SUSPEND_POSSIBLE=y
 CONFIG_ARCH_WANTS_NO_INSTR=y
 CONFIG_ARM64=y
 CONFIG_ARM64_4K_PAGES=y
-# CONFIG_ARM64_CNP is not set
 CONFIG_ARM64_CRYPTO=y
 CONFIG_ARM64_ERRATUM_843419=y
 CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
-CONFIG_ARM64_MODULE_PLTS=y
 CONFIG_ARM64_PAGE_SHIFT=12
 CONFIG_ARM64_PA_BITS=48
 CONFIG_ARM64_PA_BITS_48=y
-# CONFIG_ARM64_SW_TTBR0_PAN is not set
 CONFIG_ARM64_TAGGED_ADDR_ABI=y
 CONFIG_ARM64_VA_BITS=39
 CONFIG_ARM64_VA_BITS_39=y
@@ -47,18 +44,22 @@ CONFIG_BLK_MQ_PCI=y
 CONFIG_BLK_PM=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_CC_HAVE_SHADOW_CALL_STACK=y
 CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLONE_BACKWARDS=y
-# CONFIG_CMDLINE_OVERRIDE is not set
+CONFIG_CMDLINE_OVERRIDE=y
 CONFIG_COMMON_CLK=y
 CONFIG_COMMON_CLK_MEDIATEK=y
 # CONFIG_COMMON_CLK_MT2712 is not set
 # CONFIG_COMMON_CLK_MT6779 is not set
 # CONFIG_COMMON_CLK_MT6797 is not set
 # CONFIG_COMMON_CLK_MT7622 is not set
+CONFIG_COMMON_CLK_MT7981=y
+CONFIG_COMMON_CLK_MT7981_ETHSYS=y
 CONFIG_COMMON_CLK_MT7986=y
 CONFIG_COMMON_CLK_MT7986_ETHSYS=y
+CONFIG_COMMON_CLK_MT7988=y
 # CONFIG_COMMON_CLK_MT8173 is not set
 # CONFIG_COMMON_CLK_MT8183 is not set
 # CONFIG_COMMON_CLK_MT8516 is not set
@@ -78,6 +79,7 @@ CONFIG_CPU_FREQ_GOV_POWERSAVE=y
 CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
 CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_LITTLE_ENDIAN=y
 CONFIG_CPU_RMAP=y
 CONFIG_CPU_THERMAL=y
 CONFIG_CRC16=y
@@ -85,7 +87,6 @@ CONFIG_CRYPTO_AES_ARM64=y
 CONFIG_CRYPTO_AES_ARM64_CE=y
 CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
 CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
-CONFIG_CRYPTO_BLAKE2S=y
 CONFIG_CRYPTO_CMAC=y
 CONFIG_CRYPTO_CRC32=y
 CONFIG_CRYPTO_CRC32C=y
@@ -125,7 +126,6 @@ CONFIG_DMA_OF=y
 CONFIG_DMA_REMAP=y
 CONFIG_DMA_VIRTUAL_CHANNELS=y
 CONFIG_DTC=y
-CONFIG_DYNAMIC_DEBUG=y
 CONFIG_EDAC_SUPPORT=y
 CONFIG_EINT_MTK=y
 CONFIG_EXT4_FS=y
@@ -168,7 +168,6 @@ CONFIG_GENERIC_STRNCPY_FROM_USER=y
 CONFIG_GENERIC_STRNLEN_USER=y
 CONFIG_GENERIC_TIME_VSYSCALL=y
 CONFIG_GLOB=y
-CONFIG_GPIOLIB=y
 CONFIG_GPIO_CDEV=y
 CONFIG_GRO_CELLS=y
 CONFIG_HANDLE_DOMAIN_IRQ=y
@@ -176,6 +175,7 @@ CONFIG_HARDIRQS_SW_RESEND=y
 CONFIG_HAS_DMA=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HWMON=y
 CONFIG_HW_RANDOM=y
 CONFIG_HW_RANDOM_MTK=y
 CONFIG_I2C=y
@@ -183,12 +183,8 @@ CONFIG_I2C_BOARDINFO=y
 CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_MT65XX=y
 CONFIG_ICPLUS_PHY=y
-CONFIG_IIO=y
-CONFIG_IKCONFIG=y
-CONFIG_IKCONFIG_PROC=y
 CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
 CONFIG_INITRAMFS_SOURCE=""
-CONFIG_IO_URING=y
 CONFIG_IRQCHIP=y
 CONFIG_IRQ_DOMAIN=y
 CONFIG_IRQ_DOMAIN_HIERARCHY=y
@@ -197,18 +193,19 @@ CONFIG_IRQ_TIME_ACCOUNTING=y
 CONFIG_IRQ_WORK=y
 CONFIG_JBD2=y
 CONFIG_JUMP_LABEL=y
-# CONFIG_LEDS_UBNT_LEDBAR is not set
 CONFIG_LIBFDT=y
 CONFIG_LOCK_DEBUGGING_SUPPORT=y
 CONFIG_LOCK_SPIN_ON_OWNER=y
 CONFIG_LZO_COMPRESS=y
 CONFIG_LZO_DECOMPRESS=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_MAXLINEAR_GPHY=y
 CONFIG_MDIO_BUS=y
 CONFIG_MDIO_DEVICE=y
 CONFIG_MDIO_DEVRES=y
+CONFIG_MEDIATEK_2P5G_PHY=y
 CONFIG_MEDIATEK_GE_PHY=y
-CONFIG_MEDIATEK_MT6577_AUXADC=y
+CONFIG_MEDIATEK_GE_SOC_PHY=y
 CONFIG_MEDIATEK_WATCHDOG=y
 CONFIG_MEMFD_CREATE=y
 CONFIG_MESSAGE_LOGLEVEL_DEFAULT=7
@@ -235,10 +232,10 @@ CONFIG_MTD_SPLIT_FIT_FW=y
 CONFIG_MTD_UBI=y
 CONFIG_MTD_UBI_BEB_LIMIT=20
 CONFIG_MTD_UBI_BLOCK=y
+CONFIG_MTD_UBI_FASTMAP=y
 CONFIG_MTD_UBI_WL_THRESHOLD=4096
 # CONFIG_MTK_CMDQ is not set
 # CONFIG_MTK_CQDMA is not set
-CONFIG_MTK_EFUSE=y
 CONFIG_MTK_HSDMA=y
 CONFIG_MTK_INFRACFG=y
 CONFIG_MTK_PMIC_WRAP=y
@@ -253,9 +250,12 @@ CONFIG_NEED_SG_DMA_LENGTH=y
 CONFIG_NET_DEVLINK=y
 CONFIG_NET_DSA=y
 CONFIG_NET_DSA_MT7530=y
+CONFIG_NET_DSA_MT7530_MDIO=y
+CONFIG_NET_DSA_MT7530_MMIO=y
 CONFIG_NET_DSA_TAG_MTK=y
 CONFIG_NET_FLOW_LIMIT=y
 CONFIG_NET_MEDIATEK_SOC=y
+CONFIG_NET_MEDIATEK_SOC_USXGMII=y
 CONFIG_NET_MEDIATEK_SOC_WED=y
 CONFIG_NET_SELFTESTS=y
 CONFIG_NET_SWITCHDEV=y
@@ -265,6 +265,7 @@ CONFIG_NO_HZ_COMMON=y
 CONFIG_NO_HZ_IDLE=y
 CONFIG_NR_CPUS=4
 CONFIG_NVMEM=y
+CONFIG_NVMEM_MTK_EFUSE=y
 CONFIG_NVMEM_SYSFS=y
 CONFIG_OF=y
 CONFIG_OF_ADDRESS=y
@@ -278,6 +279,8 @@ CONFIG_OF_MDIO=y
 CONFIG_OF_OVERLAY=y
 CONFIG_OF_RESOLVE=y
 CONFIG_PADATA=y
+CONFIG_PAGE_POOL=y
+CONFIG_PAGE_POOL_STATS=y
 CONFIG_PARTITION_PERCPU=y
 CONFIG_PCI=y
 CONFIG_PCIEAER=y
@@ -295,6 +298,7 @@ CONFIG_PCI_DOMAINS=y
 CONFIG_PCI_DOMAINS_GENERIC=y
 CONFIG_PCI_MSI=y
 CONFIG_PCI_MSI_IRQ_DOMAIN=y
+CONFIG_PCS_MTK_LYNXI=y
 CONFIG_PERF_EVENTS=y
 CONFIG_PGTABLE_LEVELS=3
 CONFIG_PHYLIB=y
@@ -308,7 +312,9 @@ CONFIG_PINCTRL=y
 # CONFIG_PINCTRL_MT6765 is not set
 # CONFIG_PINCTRL_MT6797 is not set
 # CONFIG_PINCTRL_MT7622 is not set
+CONFIG_PINCTRL_MT7981=y
 CONFIG_PINCTRL_MT7986=y
+CONFIG_PINCTRL_MT7988=y
 # CONFIG_PINCTRL_MT8173 is not set
 # CONFIG_PINCTRL_MT8183 is not set
 CONFIG_PINCTRL_MT8516=y
@@ -347,11 +353,14 @@ CONFIG_REED_SOLOMON=y
 CONFIG_REED_SOLOMON_DEC8=y
 CONFIG_REED_SOLOMON_ENC8=y
 CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
 CONFIG_REGMAP_MMIO=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
 CONFIG_REGULATOR_MT6380=y
+CONFIG_REGULATOR_RT5190A=y
 CONFIG_RESET_CONTROLLER=y
+CONFIG_RESET_TI_SYSCON=y
 CONFIG_RFS_ACCEL=y
 CONFIG_RODATA_FULL_DEFAULT_ENABLED=y
 CONFIG_RPS=y
@@ -389,35 +398,30 @@ CONFIG_SPI_MT65XX=y
 CONFIG_SPI_MTK_NOR=y
 CONFIG_SPI_MTK_SNFI=y
 CONFIG_SRCU=y
-CONFIG_SWCONFIG=y
 CONFIG_SWIOTLB=y
 CONFIG_SWPHY=y
 CONFIG_SYSCTL_EXCEPTION_TRACE=y
 CONFIG_THERMAL=y
 CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
 CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
-CONFIG_THERMAL_EMULATION=y
 CONFIG_THERMAL_GOV_BANG_BANG=y
 CONFIG_THERMAL_GOV_FAIR_SHARE=y
 CONFIG_THERMAL_GOV_STEP_WISE=y
 CONFIG_THERMAL_GOV_USER_SPACE=y
+CONFIG_THERMAL_HWMON=y
 CONFIG_THERMAL_OF=y
 CONFIG_THERMAL_WRITABLE_TRIPS=y
 CONFIG_THREAD_INFO_IN_TASK=y
 CONFIG_TICK_CPU_ACCOUNTING=y
 CONFIG_TIMER_OF=y
 CONFIG_TIMER_PROBE=y
+CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y
 CONFIG_TREE_RCU=y
 CONFIG_TREE_SRCU=y
 CONFIG_UBIFS_FS=y
 # CONFIG_UCLAMP_TASK is not set
 # CONFIG_UNMAP_KERNEL_AT_EL0 is not set
-CONFIG_USB=y
-CONFIG_USB_COMMON=y
 CONFIG_USB_SUPPORT=y
-CONFIG_USB_XHCI_HCD=y
-CONFIG_USB_XHCI_MTK=y
-# CONFIG_USB_XHCI_PLATFORM is not set
 CONFIG_VMAP_STACK=y
 CONFIG_WATCHDOG_CORE=y
 CONFIG_WATCHDOG_PRETIMEOUT_DEFAULT_GOV_PANIC=y
diff --git a/target/linux/mediatek/filogic/target.mk b/target/linux/mediatek/filogic/target.mk
index 0c5bf4844e6e6d..dd4c4c1448347c 100644
--- a/target/linux/mediatek/filogic/target.mk
+++ b/target/linux/mediatek/filogic/target.mk
@@ -1,8 +1,8 @@
 ARCH:=aarch64
 SUBTARGET:=filogic
-BOARDNAME:=Filogic 830 (MT7986)
+BOARDNAME:=Filogic 8x0 (MT798x)
 CPU_TYPE:=cortex-a53
-DEFAULT_PACKAGES += kmod-crypto-hw-safexcel kmod-mt7915e kmod-mt7986-firmware wpad-basic-wolfssl uboot-envtools
+DEFAULT_PACKAGES += kmod-crypto-hw-safexcel kmod-mt7915e wpad-basic-mbedtls uboot-envtools
 KERNELNAME:=Image dtbs
 
 define Target/Description
diff --git a/target/linux/mediatek/image/Makefile b/target/linux/mediatek/image/Makefile
index 4c17e5845a226f..97164428e05c9e 100644
--- a/target/linux/mediatek/image/Makefile
+++ b/target/linux/mediatek/image/Makefile
@@ -6,6 +6,11 @@
 include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/image.mk
 
+loadaddr-$(CONFIG_TARGET_mediatek_mt7622) := 0x44000000
+loadaddr-$(CONFIG_TARGET_mediatek_mt7623) := 0x80008000
+loadaddr-$(CONFIG_TARGET_mediatek_mt7629) := 0x40008000
+loadaddr-$(CONFIG_TARGET_mediatek_filogic) := 0x48000000
+
 # default all platform image(fit) build
 define Device/Default
   PROFILES = Default $$(DEVICE_NAME)
@@ -14,6 +19,7 @@ define Device/Default
 	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
   KERNEL_INITRAMFS = kernel-bin | lzma | \
 	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd
+  KERNEL_LOADADDR = $(loadaddr-y)
   FILESYSTEMS := squashfs
   DEVICE_DTS_DIR := $(DTS_DIR)
   IMAGES := sysupgrade.bin
diff --git a/target/linux/mediatek/image/filogic.mk b/target/linux/mediatek/image/filogic.mk
index cd74da745073e4..6323a05de2a625 100644
--- a/target/linux/mediatek/image/filogic.mk
+++ b/target/linux/mediatek/image/filogic.mk
@@ -1,18 +1,24 @@
 DTS_DIR := $(DTS_DIR)/mediatek
 
-KERNEL_LOADADDR := 0x44000000
-
 define Image/Prepare
 	# For UBI we want only one extra block
 	rm -f $(KDIR)/ubi_mark
 	echo -ne '\xde\xad\xc0\xde' > $(KDIR)/ubi_mark
 endef
 
-define Build/bl2
+define Build/mt7981-bl2
+	cat $(STAGING_DIR_IMAGE)/mt7981-$1-bl2.img >> $@
+endef
+
+define Build/mt7981-bl31-uboot
+	cat $(STAGING_DIR_IMAGE)/mt7981_$1-u-boot.fip >> $@
+endef
+
+define Build/mt7986-bl2
 	cat $(STAGING_DIR_IMAGE)/mt7986-$1-bl2.img >> $@
 endef
 
-define Build/bl31-uboot
+define Build/mt7986-bl31-uboot
 	cat $(STAGING_DIR_IMAGE)/mt7986_$1-u-boot.fip >> $@
 endef
 
@@ -38,60 +44,145 @@ define Build/mt7986-gpt
 	rm $@.tmp
 endef
 
+metadata_gl_json = \
+	'{ $(if $(IMAGE_METADATA),$(IMAGE_METADATA)$(comma)) \
+		"metadata_version": "1.1", \
+		"compat_version": "$(call json_quote,$(compat_version))", \
+		$(if $(DEVICE_COMPAT_MESSAGE),"compat_message": "$(call json_quote,$(DEVICE_COMPAT_MESSAGE))"$(comma)) \
+		$(if $(filter-out 1.0,$(compat_version)),"new_supported_devices": \
+			[$(call metadata_devices,$(SUPPORTED_DEVICES))]$(comma) \
+			"supported_devices": ["$(call json_quote,$(legacy_supported_message))"]$(comma)) \
+		$(if $(filter 1.0,$(compat_version)),"supported_devices":[$(call metadata_devices,$(SUPPORTED_DEVICES))]$(comma)) \
+		"version": { \
+			"release": "$(call json_quote,$(VERSION_NUMBER))", \
+			"date": "$(shell TZ='Asia/Chongqing' date '+%Y%m%d%H%M%S')", \
+			"dist": "$(call json_quote,$(VERSION_DIST))", \
+			"version": "$(call json_quote,$(VERSION_NUMBER))", \
+			"revision": "$(call json_quote,$(REVISION))", \
+			"target": "$(call json_quote,$(TARGETID))", \
+			"board": "$(call json_quote,$(if $(BOARD_NAME),$(BOARD_NAME),$(DEVICE_NAME)))" \
+		} \
+	}'
+
+define Build/append-gl-metadata
+	$(if $(SUPPORTED_DEVICES),-echo $(call metadata_gl_json,$(SUPPORTED_DEVICES)) | fwtool -I - $@)
+	sha256sum "$@" | cut -d" " -f1 > "$@.sha256sum"
+	[ ! -s "$(BUILD_KEY)" -o ! -s "$(BUILD_KEY).ucert" -o ! -s "$@" ] || { \
+		cp "$(BUILD_KEY).ucert" "$@.ucert" ;\
+		usign -S -m "$@" -s "$(BUILD_KEY)" -x "$@.sig" ;\
+		ucert -A -c "$@.ucert" -x "$@.sig" ;\
+		fwtool -S "$@.ucert" "$@" ;\
+	}
+endef
+
+define Device/asus_tuf-ax4200
+  DEVICE_VENDOR := ASUS
+  DEVICE_MODEL := TUF-AX4200
+  DEVICE_DTS := mt7986a-asus-tuf-ax4200
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTS_LOADADDR := 0x47000000
+  DEVICE_PACKAGES := kmod-usb3 kmod-mt7986-firmware mt7986-wo-firmware
+  IMAGES := sysupgrade.bin
+  KERNEL := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += asus_tuf-ax4200
+
 define Device/bananapi_bpi-r3
   DEVICE_VENDOR := Bananapi
   DEVICE_MODEL := BPi-R3
   DEVICE_DTS := mt7986a-bananapi-bpi-r3
   DEVICE_DTS_CONFIG := config-mt7986a-bananapi-bpi-r3
-  DEVICE_DTS_OVERLAY:= mt7986a-bananapi-bpi-r3-nor mt7986a-bananapi-bpi-r3-emmc-nor mt7986a-bananapi-bpi-r3-emmc-snand mt7986a-bananapi-bpi-r3-snand
-  DEVICE_DTS_DIR := ../dts
-  DEVICE_PACKAGES := kmod-usb3 kmod-i2c-gpio kmod-sfp e2fsprogs f2fsck mkf2fs
+  DEVICE_DTS_OVERLAY:= mt7986a-bananapi-bpi-r3-emmc mt7986a-bananapi-bpi-r3-nand mt7986a-bananapi-bpi-r3-nor mt7986a-bananapi-bpi-r3-sd
+  DEVICE_DTS_DIR := $(DTS_DIR)/
+  DEVICE_PACKAGES := kmod-hwmon-pwmfan kmod-i2c-gpio kmod-mt7986-firmware kmod-sfp kmod-usb3 e2fsprogs f2fsck mkf2fs mt7986-wo-firmware
   IMAGES := sysupgrade.itb
+  KERNEL_LOADADDR := 0x44000000
   KERNEL_INITRAMFS_SUFFIX := -recovery.itb
   ARTIFACTS := \
 	       emmc-preloader.bin emmc-bl31-uboot.fip \
 	       nor-preloader.bin nor-bl31-uboot.fip \
 	       sdcard.img.gz \
 	       snand-preloader.bin snand-bl31-uboot.fip
-  ARTIFACT/emmc-preloader.bin	:= bl2 emmc-ddr4
-  ARTIFACT/emmc-bl31-uboot.fip	:= bl31-uboot bananapi_bpi-r3-emmc
-  ARTIFACT/nor-preloader.bin	:= bl2 nor-ddr4
-  ARTIFACT/nor-bl31-uboot.fip	:= bl31-uboot bananapi_bpi-r3-nor
-  ARTIFACT/snand-preloader.bin	:= bl2 spim-nand-ddr4
-  ARTIFACT/snand-bl31-uboot.fip	:= bl31-uboot bananapi_bpi-r3-snand
+  ARTIFACT/emmc-preloader.bin	:= mt7986-bl2 emmc-ddr4
+  ARTIFACT/emmc-bl31-uboot.fip	:= mt7986-bl31-uboot bananapi_bpi-r3-emmc
+  ARTIFACT/nor-preloader.bin	:= mt7986-bl2 nor-ddr4
+  ARTIFACT/nor-bl31-uboot.fip	:= mt7986-bl31-uboot bananapi_bpi-r3-nor
+  ARTIFACT/snand-preloader.bin	:= mt7986-bl2 spim-nand-ddr4
+  ARTIFACT/snand-bl31-uboot.fip	:= mt7986-bl31-uboot bananapi_bpi-r3-snand
   ARTIFACT/sdcard.img.gz	:= mt7986-gpt sdmmc |\
-				   pad-to 17k | bl2 sdmmc-ddr4 |\
-				   pad-to 6656k | bl31-uboot bananapi_bpi-r3-sdmmc |\
+				   pad-to 17k | mt7986-bl2 sdmmc-ddr4 |\
+				   pad-to 6656k | mt7986-bl31-uboot bananapi_bpi-r3-sdmmc |\
 				$(if $(CONFIG_TARGET_ROOTFS_INITRAMFS),\
 				   pad-to 12M | append-image-stage initramfs-recovery.itb | check-size 44m |\
 				) \
-				   pad-to 44M | bl2 spim-nand-ddr4 |\
-				   pad-to 45M | bl31-uboot bananapi_bpi-r3-snand |\
-				   pad-to 49M | bl2 nor-ddr4 |\
-				   pad-to 50M | bl31-uboot bananapi_bpi-r3-nor |\
-				   pad-to 51M | bl2 emmc-ddr4 |\
-				   pad-to 52M | bl31-uboot bananapi_bpi-r3-emmc |\
+				   pad-to 44M | mt7986-bl2 spim-nand-ddr4 |\
+				   pad-to 45M | mt7986-bl31-uboot bananapi_bpi-r3-snand |\
+				   pad-to 49M | mt7986-bl2 nor-ddr4 |\
+				   pad-to 50M | mt7986-bl31-uboot bananapi_bpi-r3-nor |\
+				   pad-to 51M | mt7986-bl2 emmc-ddr4 |\
+				   pad-to 52M | mt7986-bl31-uboot bananapi_bpi-r3-emmc |\
 				   pad-to 56M | mt7986-gpt emmc |\
 				$(if $(CONFIG_TARGET_ROOTFS_SQUASHFS),\
-				   pad-to 64M | append-image squashfs-sysupgrade.itb | check-size | gzip \
-				)
+				   pad-to 64M | append-image squashfs-sysupgrade.itb | check-size |\
+				) \
+				  gzip
   IMAGE_SIZE := $$(shell expr 64 + $$(CONFIG_TARGET_ROOTFS_PARTSIZE))m
   KERNEL			:= kernel-bin | gzip
   KERNEL_INITRAMFS := kernel-bin | lzma | \
 	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
   IMAGE/sysupgrade.itb := append-kernel | fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | pad-rootfs | append-metadata
-  DTC_FLAGS += -@ --space 32768
+  DEVICE_DTC_FLAGS := --pad 4096
+  DEVICE_COMPAT_VERSION := 1.1
+  DEVICE_COMPAT_MESSAGE := Device tree overlay mechanism needs bootloader update
 endef
 TARGET_DEVICES += bananapi_bpi-r3
 
-define Device/mediatek_mt7986a-rfb
+define Device/cudy_wr3000-v1
+  DEVICE_VENDOR := Cudy
+  DEVICE_MODEL := WR3000
+  DEVICE_VARIANT := v1
+  DEVICE_DTS := mt7981b-cudy-wr3000-v1
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTS_LOADADDR := 0x47000000
+  IMAGES := sysupgrade.bin
+  IMAGE_SIZE := 15424k
+  SUPPORTED_DEVICES += R31
+  KERNEL := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.bin := append-kernel | pad-to 128k | append-rootfs | pad-rootfs | check-size | append-metadata
+  DEVICE_PACKAGES := kmod-mt7981-firmware
+endef
+TARGET_DEVICES += cudy_wr3000-v1
+
+define Device/glinet_gl-mt3000
+  DEVICE_VENDOR := GL.iNet
+  DEVICE_MODEL := GL-MT3000
+  DEVICE_DTS := mt7981b-glinet-gl-mt3000
+  DEVICE_DTS_DIR := ../dts
+  SUPPORTED_DEVICES += glinet,mt3000-snand
+  DEVICE_PACKAGES := kmod-mt7981-firmware mt7981-wo-firmware kmod-hwmon-pwmfan kmod-usb3
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 246272k
+  KERNEL_IN_UBI := 1
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-gl-metadata
+endef
+TARGET_DEVICES += glinet_gl-mt3000
+
+define Device/mediatek_mt7986a-rfb-nand
   DEVICE_VENDOR := MediaTek
-  DEVICE_MODEL := MTK7986 rfba AP
-  DEVICE_DTS := mt7986a-rfb
+  DEVICE_MODEL := MT7986 rfba AP (NAND)
+  DEVICE_DTS := mt7986a-rfb-spim-nand
   DEVICE_DTS_DIR := $(DTS_DIR)/
-  KERNEL_LOADADDR := 0x48000000
-  DEVICE_DTS_OVERLAY := mt7986a-rfb-spim-nand mt7986a-rfb-spim-nor
-  SUPPORTED_DEVICES := mediatek,mt7986a-rfb
+  DEVICE_PACKAGES := kmod-mt7986-firmware mt7986-wo-firmware
+  SUPPORTED_DEVICES := mediatek,mt7986a-rfb-snand
   UBINIZE_OPTS := -E 5
   BLOCKSIZE := 128k
   PAGESIZE := 2048
@@ -101,19 +192,18 @@ define Device/mediatek_mt7986a-rfb
   IMAGE/factory.bin := append-ubi | check-size $$$$(IMAGE_SIZE)
   IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   KERNEL = kernel-bin | lzma | \
-	fit lzma $$(KDIR)/$$(firstword $$(DEVICE_DTS)).dtb
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
   KERNEL_INITRAMFS = kernel-bin | lzma | \
-	fit lzma $$(KDIR)/$$(firstword $$(DEVICE_DTS)).dtb with-initrd
-  DTC_FLAGS += -@ --space 32768
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd
 endef
-TARGET_DEVICES += mediatek_mt7986a-rfb
+TARGET_DEVICES += mediatek_mt7986a-rfb-nand
 
 define Device/mediatek_mt7986b-rfb
   DEVICE_VENDOR := MediaTek
   DEVICE_MODEL := MTK7986 rfbb AP
   DEVICE_DTS := mt7986b-rfb
   DEVICE_DTS_DIR := $(DTS_DIR)/
-  KERNEL_LOADADDR := 0x48000000
+  DEVICE_PACKAGES := kmod-mt7986-firmware mt7986-wo-firmware
   SUPPORTED_DEVICES := mediatek,mt7986b-rfb
   UBINIZE_OPTS := -E 5
   BLOCKSIZE := 128k
@@ -125,3 +215,156 @@ define Device/mediatek_mt7986b-rfb
   IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
 endef
 TARGET_DEVICES += mediatek_mt7986b-rfb
+
+define Device/mediatek_mt7988a-rfb-nand
+  DEVICE_VENDOR := MediaTek
+  DEVICE_MODEL := MT7988a nand rfb
+  DEVICE_DTS := mt7988a-dsa-10g-spim-nand
+  DEVICE_DTS_DIR := $(DTS_DIR)/
+  KERNEL_LOADADDR := 0x48000000
+  SUPPORTED_DEVICES := mediatek,mt7988a-rfb
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 65536k
+  KERNEL_IN_UBI := 1
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-ubi | check-size $$$$(IMAGE_SIZE)
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += mediatek_mt7988a-rfb-nand
+
+define Device/qihoo_360t7
+  DEVICE_VENDOR := Qihoo
+  DEVICE_MODEL := 360T7
+  DEVICE_DTS := mt7981b-qihoo-360t7
+  DEVICE_DTS_DIR := ../dts
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  IMAGES := sysupgrade.itb
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | \
+        fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | append-metadata
+  DEVICE_PACKAGES := kmod-mt7981-firmware mt7981-wo-firmware
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7981-bl2 spim-nand-ddr3
+  ARTIFACT/bl31-uboot.fip := mt7981-bl31-uboot qihoo_360t7
+endef
+TARGET_DEVICES += qihoo_360t7
+
+define Device/tplink_tl-xdr-common
+  DEVICE_VENDOR := TP-Link
+  DEVICE_DTS_DIR := ../dts
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  IMAGES := sysupgrade.itb
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | \
+        fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | append-metadata
+  DEVICE_PACKAGES := kmod-usb3 kmod-mt7986-firmware mt7986-wo-firmware
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7986-bl2 spim-nand-ddr3
+endef
+
+define Device/tplink_tl-xdr4288
+  DEVICE_MODEL := TL-XDR4288
+  DEVICE_DTS := mt7986a-tplink-tl-xdr4288
+  ARTIFACT/bl31-uboot.fip := mt7986-bl31-uboot tplink_tl-xdr4288
+  $(call Device/tplink_tl-xdr-common)
+endef
+TARGET_DEVICES += tplink_tl-xdr4288
+
+define Device/tplink_tl-xdr6086
+  DEVICE_MODEL := TL-XDR6086
+  DEVICE_DTS := mt7986a-tplink-tl-xdr6086
+  ARTIFACT/bl31-uboot.fip := mt7986-bl31-uboot tplink_tl-xdr6086
+  $(call Device/tplink_tl-xdr-common)
+endef
+TARGET_DEVICES += tplink_tl-xdr6086
+
+define Device/tplink_tl-xdr6088
+  DEVICE_MODEL := TL-XDR6088
+  DEVICE_DTS := mt7986a-tplink-tl-xdr6088
+  ARTIFACT/bl31-uboot.fip := mt7986-bl31-uboot tplink_tl-xdr6088
+  $(call Device/tplink_tl-xdr-common)
+endef
+TARGET_DEVICES += tplink_tl-xdr6088
+
+define Device/xiaomi_redmi-router-ax6000-stock
+  DEVICE_VENDOR := Xiaomi
+  DEVICE_MODEL := Redmi Router AX6000 (stock layout)
+  DEVICE_DTS := mt7986a-xiaomi-redmi-router-ax6000-stock
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-leds-ws2812b kmod-mt7986-firmware mt7986-wo-firmware
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+  ARTIFACTS := initramfs-factory.ubi
+  ARTIFACT/initramfs-factory.ubi := append-image-stage initramfs-kernel.bin | ubinize-kernel
+endif
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += xiaomi_redmi-router-ax6000-stock
+
+define Device/xiaomi_redmi-router-ax6000-ubootmod
+  DEVICE_VENDOR := Xiaomi
+  DEVICE_MODEL := Redmi Router AX6000 (OpenWrt U-Boot layout)
+  DEVICE_DTS := mt7986a-xiaomi-redmi-router-ax6000-ubootmod
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-leds-ws2812b kmod-mt7986-firmware mt7986-wo-firmware
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  IMAGES := sysupgrade.itb
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | \
+        fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | append-metadata
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7986-bl2 spim-nand-ddr4
+  ARTIFACT/bl31-uboot.fip := mt7986-bl31-uboot xiaomi_redmi-router-ax6000
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+  ARTIFACTS += initramfs-factory.ubi
+  ARTIFACT/initramfs-factory.ubi := append-image-stage initramfs-recovery.itb | ubinize-kernel
+endif
+endef
+TARGET_DEVICES += xiaomi_redmi-router-ax6000-ubootmod
+
+define Device/zyxel_ex5601-t0-stock
+  DEVICE_VENDOR := Zyxel
+  DEVICE_MODEL := EX5601-T0  (stock layout)
+  DEVICE_DTS := mt7986a-zyxel-ex5601-t0-stock
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7986-firmware mt7986-wo-firmware
+  SUPPORTED_DEVICES := mediatek,mt7986a-rfb-snand
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 256k
+  PAGESIZE := 4096
+  IMAGE_SIZE := 65536k
+  KERNEL_IN_UBI := 1
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-ubi | check-size $$$$(IMAGE_SIZE)
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  KERNEL = kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS = kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd
+endef
+TARGET_DEVICES += zyxel_ex5601-t0-stock
diff --git a/target/linux/mediatek/image/mt7622.mk b/target/linux/mediatek/image/mt7622.mk
index f9cd18fd418b27..040ef957db9a8d 100644
--- a/target/linux/mediatek/image/mt7622.mk
+++ b/target/linux/mediatek/image/mt7622.mk
@@ -1,11 +1,5 @@
 DTS_DIR := $(DTS_DIR)/mediatek
 
-ifdef CONFIG_LINUX_5_4
-  KERNEL_LOADADDR := 0x44080000
-else
-  KERNEL_LOADADDR := 0x44000000
-endif
-
 define Image/Prepare
 	# For UBI we want only one extra block
 	rm -f $(KDIR)/ubi_mark
@@ -76,6 +70,7 @@ define Device/bananapi_bpi-r64
   DEVICE_DTS := mt7622-bananapi-bpi-r64
   DEVICE_DTS_OVERLAY := mt7622-bananapi-bpi-r64-pcie1 mt7622-bananapi-bpi-r64-sata
   DEVICE_PACKAGES := kmod-ata-ahci-mtk kmod-btmtkuart kmod-usb3 e2fsprogs mkf2fs f2fsck
+  DEVICE_DTC_FLAGS := --pad 4096
   ARTIFACTS := emmc-preloader.bin emmc-bl31-uboot.fip sdcard.img.gz snand-preloader.bin snand-bl31-uboot.fip
   IMAGES := sysupgrade.itb
   KERNEL_INITRAMFS_SUFFIX := -recovery.itb
@@ -94,13 +89,16 @@ define Device/bananapi_bpi-r64
 				   pad-to 40960k | bl31-uboot bananapi_bpi-r64-emmc |\
 				   pad-to 43008k | bl2 snand-2ddr |\
 				   pad-to 43520k | bl31-uboot bananapi_bpi-r64-snand |\
-				$(if $(CONFIG_TARGET_ROOTFS_SQUASHFS),\
-				   pad-to 46080k | append-image squashfs-sysupgrade.itb | check-size | gzip \
-				)
+				$(if $(CONFIG_TARGET_ROOTFS_SQUASHFS), \
+				   pad-to 46080k | append-image squashfs-sysupgrade.itb | check-size |\
+				) \
+				  gzip
   IMAGE_SIZE := $$(shell expr 45 + $$(CONFIG_TARGET_ROOTFS_PARTSIZE))m
   KERNEL			:= kernel-bin | gzip
   KERNEL_INITRAMFS		:= kernel-bin | lzma | fit lzma $$(DTS_DIR)/$$(DEVICE_DTS).dtb with-initrd | pad-to 128k
   IMAGE/sysupgrade.itb		:= append-kernel | fit gzip $$(DTS_DIR)/$$(DEVICE_DTS).dtb external-static-with-rootfs | append-metadata
+  DEVICE_COMPAT_VERSION := 1.1
+  DEVICE_COMPAT_MESSAGE := Device tree overlay mechanism needs bootloader update
 endef
 TARGET_DEVICES += bananapi_bpi-r64
 
@@ -129,7 +127,7 @@ define Device/buffalo_wsr-2533dhp2
   IMAGE/sysupgrade.bin := append-kernel | \
 	buffalo-kernel-trx 0x32504844 $(KDIR)/tmp/$$(DEVICE_NAME).null | \
 	sysupgrade-tar kernel=$$$$@ | append-metadata
-  DEVICE_PACKAGES := swconfig
+  DEVICE_PACKAGES := kmod-mt7615-firmware swconfig
 endef
 TARGET_DEVICES += buffalo_wsr-2533dhp2
 
@@ -138,7 +136,7 @@ define Device/elecom_wrc-2533gent
   DEVICE_MODEL := WRC-2533GENT
   DEVICE_DTS := mt7622-elecom-wrc-2533gent
   DEVICE_DTS_DIR := ../dts
-  DEVICE_PACKAGES := kmod-btmtkuart kmod-usb3 swconfig
+  DEVICE_PACKAGES := kmod-btmtkuart kmod-mt7615-firmware kmod-usb3 swconfig
 endef
 TARGET_DEVICES += elecom_wrc-2533gent
 
@@ -158,7 +156,7 @@ define Device/elecom_wrc-x3200gst3
 	elecom-wrc-gs-factory WRC-X3200GST3 0.00 -N | \
 	append-string MT7622_ELECOM_WRC-X3200GST3
   IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
-  DEVICE_PACKAGES := kmod-mt7915e
+  DEVICE_PACKAGES := kmod-mt7915-firmware
 endef
 TARGET_DEVICES += elecom_wrc-x3200gst3
 
@@ -169,7 +167,7 @@ define Device/linksys_e8450
   DEVICE_ALT0_MODEL := RT3200
   DEVICE_DTS := mt7622-linksys-e8450
   DEVICE_DTS_DIR := ../dts
-  DEVICE_PACKAGES := kmod-mt7915e kmod-usb3
+  DEVICE_PACKAGES := kmod-mt7915-firmware kmod-usb3
 endef
 TARGET_DEVICES += linksys_e8450
 
@@ -182,7 +180,7 @@ define Device/linksys_e8450-ubi
   DEVICE_ALT0_VARIANT := UBI
   DEVICE_DTS := mt7622-linksys-e8450-ubi
   DEVICE_DTS_DIR := ../dts
-  DEVICE_PACKAGES := kmod-mt7915e kmod-usb3
+  DEVICE_PACKAGES := kmod-mt7915-firmware kmod-usb3
   UBINIZE_OPTS := -E 5
   BLOCKSIZE := 128k
   PAGESIZE := 2048
@@ -228,21 +226,57 @@ define Device/mediatek_mt7622-rfb1-ubi
 endef
 TARGET_DEVICES += mediatek_mt7622-rfb1-ubi
 
+define Device/netgear_wax206
+  $(Device/dsa-migration)
+  DEVICE_VENDOR := NETGEAR
+  DEVICE_MODEL := WAX206
+  DEVICE_DTS := mt7622-netgear-wax206
+  DEVICE_DTS_DIR := ../dts
+  NETGEAR_ENC_MODEL := WAX206
+  NETGEAR_ENC_REGION := US
+  DEVICE_PACKAGES := kmod-mt7915-firmware
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_SIZE := 6144k
+  IMAGE_SIZE := 32768k
+  KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb | \
+	append-squashfs4-fakeroot
+# recovery can also be used with stock firmware web-ui, hence the padding...
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 128k
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  IMAGES += factory.img
+  IMAGE/factory.img := append-kernel | pad-to $$(KERNEL_SIZE) | \
+	append-ubi | check-size | netgear-encrypted-factory
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += netgear_wax206
+
 define Device/ruijie_rg-ew3200gx-pro
   DEVICE_VENDOR := Ruijie
   DEVICE_MODEL := RG-EW3200GX PRO
   DEVICE_DTS := mt7622-ruijie-rg-ew3200gx-pro
   DEVICE_DTS_DIR := ../dts
-  DEVICE_PACKAGES := kmod-mt7915e
+  DEVICE_PACKAGES := kmod-mt7915-firmware
 endef
 TARGET_DEVICES += ruijie_rg-ew3200gx-pro
 
+define Device/reyee_ax3200-e5
+  DEVICE_VENDOR := reyee
+  DEVICE_MODEL := AX3200 E5
+  DEVICE_DTS := mt7622-reyee-ax3200-e5
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915-firmware
+endef
+TARGET_DEVICES += reyee_ax3200-e5
+
 define Device/totolink_a8000ru
   DEVICE_VENDOR := TOTOLINK
   DEVICE_MODEL := A8000RU
   DEVICE_DTS := mt7622-totolink-a8000ru
   DEVICE_DTS_DIR := ../dts
-  DEVICE_PACKAGES := swconfig
+  DEVICE_PACKAGES := kmod-mt7615-firmware swconfig
   IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
 endef
 TARGET_DEVICES += totolink_a8000ru
@@ -254,7 +288,7 @@ define Device/ubnt_unifi-6-lr-v1
   DEVICE_DTS_CONFIG := config@1
   DEVICE_DTS := mt7622-ubnt-unifi-6-lr-v1
   DEVICE_DTS_DIR := ../dts
-  DEVICE_PACKAGES := kmod-mt7915e kmod-leds-ubnt-ledbar
+  DEVICE_PACKAGES := kmod-mt7915-firmware kmod-leds-ubnt-ledbar
   SUPPORTED_DEVICES += ubnt,unifi-6-lr
 endef
 TARGET_DEVICES += ubnt_unifi-6-lr-v1
@@ -265,7 +299,7 @@ define Device/ubnt_unifi-6-lr-v1-ubootmod
   DEVICE_VARIANT := v1 U-Boot mod
   DEVICE_DTS := mt7622-ubnt-unifi-6-lr-v1-ubootmod
   DEVICE_DTS_DIR := ../dts
-  DEVICE_PACKAGES := kmod-mt7915e kmod-leds-ubnt-ledbar
+  DEVICE_PACKAGES := kmod-mt7915-firmware kmod-leds-ubnt-ledbar
   KERNEL := kernel-bin | lzma
   KERNEL_INITRAMFS_SUFFIX := -recovery.itb
   KERNEL_INITRAMFS := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
@@ -285,7 +319,7 @@ define Device/ubnt_unifi-6-lr-v2
   DEVICE_DTS_CONFIG := config@1
   DEVICE_DTS := mt7622-ubnt-unifi-6-lr-v2
   DEVICE_DTS_DIR := ../dts
-  DEVICE_PACKAGES := kmod-mt7915e
+  DEVICE_PACKAGES := kmod-mt7915-firmware
 endef
 TARGET_DEVICES += ubnt_unifi-6-lr-v2
 
@@ -295,7 +329,7 @@ define Device/ubnt_unifi-6-lr-v2-ubootmod
   DEVICE_VARIANT := v2 U-Boot mod
   DEVICE_DTS := mt7622-ubnt-unifi-6-lr-v2-ubootmod
   DEVICE_DTS_DIR := ../dts
-  DEVICE_PACKAGES := kmod-mt7915e
+  DEVICE_PACKAGES := kmod-mt7915-firmware
   KERNEL := kernel-bin | lzma
   KERNEL_INITRAMFS_SUFFIX := -recovery.itb
   KERNEL_INITRAMFS := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
@@ -315,7 +349,7 @@ define Device/xiaomi_redmi-router-ax6s
   DEVICE_DTS := mt7622-xiaomi-redmi-router-ax6s
   DEVICE_DTS_DIR := ../dts
   BOARD_NAME := xiaomi,redmi-router-ax6s
-  DEVICE_PACKAGES := kmod-mt7915e
+  DEVICE_PACKAGES := kmod-mt7915-firmware
   UBINIZE_OPTS := -E 5
   IMAGES += factory.bin
   BLOCKSIZE := 128k
diff --git a/target/linux/mediatek/image/mt7623.mk b/target/linux/mediatek/image/mt7623.mk
index 4ef0aabe4da9e4..5828c4d763d937 100644
--- a/target/linux/mediatek/image/mt7623.mk
+++ b/target/linux/mediatek/image/mt7623.mk
@@ -1,4 +1,3 @@
-KERNEL_LOADADDR := 0x80008000
 DEVICE_VARS += UBOOT_TARGET UBOOT_OFFSET UBOOT_IMAGE
 
 # The bootrom of MT7623 expects legacy MediaTek headers present in
@@ -97,6 +96,7 @@ define Device/bananapi_bpi-r2
   KERNEL := kernel-bin | gzip
   KERNEL_INITRAMFS_SUFFIX := -recovery.itb
   KERNEL_INITRAMFS := kernel-bin | gzip | fit gzip $$(DTS_DIR)/$$(DEVICE_DTS).dtb with-initrd
+  IMAGE_SIZE := $$(shell expr 48 + $$(CONFIG_TARGET_ROOTFS_PARTSIZE))m
   IMAGE/sysupgrade.itb := append-kernel | fit gzip $$(DTS_DIR)/$$(DEVICE_DTS).dtb external-static-with-rootfs | append-metadata
   ARTIFACT/preloader.bin := mt7623-mbr emmc |\
 			    pad-to 2k | append-preloader $$(UBOOT_TARGET)
@@ -105,8 +105,12 @@ define Device/bananapi_bpi-r2
 			    pad-to 2k | append-preloader $$(UBOOT_TARGET) |\
 			    pad-to $$(UBOOT_OFFSET) | append-bootloader $$(UBOOT_TARGET) |\
 			    pad-to 4092k | mt7623-mbr emmc |\
-			    pad-to 4M | append-image-stage initramfs-recovery.itb |\
-			    pad-to 48M | append-image squashfs-sysupgrade.itb |\
+			    $(if $(CONFIG_TARGET_ROOTFS_INITRAMFS),\
+			    pad-to 4M | append-image-stage initramfs-recovery.itb | check-size 48m |\
+			    ) \
+			    $(if $(CONFIG_TARGET_ROOTFS_SQUASHFS),\
+			    pad-to 48M | append-image squashfs-sysupgrade.itb | check-size |\
+			    ) \
 			    gzip
   ARTIFACTS := u-boot.bin preloader.bin sdcard.img.gz
   SUPPORTED_DEVICES := bananapi,bpi-r2
@@ -126,6 +130,7 @@ define Device/unielec_u7623-02
   UBOOT_TARGET := mt7623a_unielec_u7623
   UBOOT_IMAGE := u-boot-mtk.bin
   UBOOT_PATH := $(STAGING_DIR_IMAGE)/$$(UBOOT_TARGET)-$$(UBOOT_IMAGE)
+  IMAGE_SIZE := $$(shell expr 48 + $$(CONFIG_TARGET_ROOTFS_PARTSIZE))m
   IMAGES := sysupgrade.itb
   KERNEL := kernel-bin | gzip
   KERNEL_INITRAMFS_SUFFIX := -recovery.itb
@@ -136,8 +141,12 @@ define Device/unielec_u7623-02
 # but OpenWrt expects 'SDMM' magic for sysupgrade.
   ARTIFACT/emmc.img.gz := mt7623-mbr sdmmc |\
 			    pad-to $$(UBOOT_OFFSET) | append-bootloader $$(UBOOT_TARGET) |\
-			    pad-to 4M | append-image-stage initramfs-recovery.itb |\
-			    pad-to 48M | append-image squashfs-sysupgrade.itb |\
+			    $(if $(CONFIG_TARGET_ROOTFS_INITRAMFS),\
+			    pad-to 4M | append-image-stage initramfs-recovery.itb | check-size 48m |\
+			    ) \
+			    $(if $(CONFIG_TARGET_ROOTFS_SQUASHFS),\
+			    pad-to 48M | append-image squashfs-sysupgrade.itb | check-size |\
+			    ) \
 			    gzip | append-metadata
   ARTIFACT/scatter.txt := scatterfile emmc.img.gz
   ARTIFACTS := u-boot.bin scatter.txt emmc.img.gz
diff --git a/target/linux/mediatek/image/mt7629.mk b/target/linux/mediatek/image/mt7629.mk
index 891b65c4e7c5bc..3f5b2e257940ff 100644
--- a/target/linux/mediatek/image/mt7629.mk
+++ b/target/linux/mediatek/image/mt7629.mk
@@ -1,5 +1,3 @@
-KERNEL_LOADADDR := 0x40008000
-
 define Device/mediatek_mt7629-rfb
   DEVICE_VENDOR := MediaTek
   DEVICE_MODEL := MT7629 rfb AP
diff --git a/target/linux/mediatek/modules.mk b/target/linux/mediatek/modules.mk
index 0eb2866cf06044..84801237259017 100644
--- a/target/linux/mediatek/modules.mk
+++ b/target/linux/mediatek/modules.mk
@@ -27,30 +27,13 @@ endef
 
 $(eval $(call KernelPackage,btmtkuart))
 
-define KernelPackage/sdhci-mtk
-  SUBMENU:=Other modules
-  TITLE:=Mediatek SDHCI driver
-  DEPENDS:=@TARGET_mediatek_mt7622 +kmod-sdhci
-  KCONFIG:=CONFIG_MMC_MTK 
-  FILES:= \
-	$(LINUX_DIR)/drivers/mmc/host/mtk-sd.ko
-  AUTOLOAD:=$(call AutoProbe,mtk-sd,1)
-endef
-
-$(eval $(call KernelPackage,sdhci-mtk))
-
-define KernelPackage/leds-ubnt-ledbar
-  SUBMENU:=LED modules
-  TITLE:=Ubiquiti UniFi 6 LR LED support
-  KCONFIG:=CONFIG_LEDS_UBNT_LEDBAR
+define KernelPackage/iio-mt6577-auxadc
+  TITLE:=Mediatek AUXADC driver
+  DEPENDS:=@(TARGET_mediatek_mt7622||TARGET_mediatek_filogic)
+  KCONFIG:=CONFIG_MEDIATEK_MT6577_AUXADC
   FILES:= \
-	$(LINUX_DIR)/drivers/leds/leds-ubnt-ledbar.ko
-  AUTOLOAD:=$(call AutoProbe,leds-ubnt-ledbar,1)
-  DEPENDS:=@TARGET_mediatek_mt7622 +kmod-i2c-core
-endef
-
-define KernelPackage/leds-ubnt-ledbar/description
-  LED support for Ubiquiti UniFi 6 LR
+	$(LINUX_DIR)/drivers/iio/adc/mt6577_auxadc.ko
+  AUTOLOAD:=$(call AutoProbe,mt6577_auxadc)
+  $(call AddDepends/iio)
 endef
-
-$(eval $(call KernelPackage,leds-ubnt-ledbar))
+$(eval $(call KernelPackage,iio-mt6577-auxadc))
diff --git a/target/linux/mediatek/mt7622/base-files/etc/board.d/01_leds b/target/linux/mediatek/mt7622/base-files/etc/board.d/01_leds
index 5c32918d35cd76..7cb54186fd1e42 100644
--- a/target/linux/mediatek/mt7622/base-files/etc/board.d/01_leds
+++ b/target/linux/mediatek/mt7622/base-files/etc/board.d/01_leds
@@ -7,7 +7,8 @@ board_config_update
 
 case $board in
 linksys,e8450|\
-linksys,e8450-ubi)
+linksys,e8450-ubi|\
+netgear,wax206)
 	ucidef_set_led_netdev "wan" "WAN" "inet:blue" "wan"
 	;;
 xiaomi,redmi-router-ax6s)
diff --git a/target/linux/mediatek/mt7622/base-files/etc/board.d/02_network b/target/linux/mediatek/mt7622/base-files/etc/board.d/02_network
index 29f4b875f8b2fe..38db921f5c58e9 100644
--- a/target/linux/mediatek/mt7622/base-files/etc/board.d/02_network
+++ b/target/linux/mediatek/mt7622/base-files/etc/board.d/02_network
@@ -14,6 +14,8 @@ mediatek_setup_interfaces()
 	linksys,e8450-ubi|\
 	mediatek,mt7622-rfb1|\
 	mediatek,mt7622-rfb1-ubi|\
+	netgear,wax206|\
+	reyee,ax3200-e5|\
 	ruijie,rg-ew3200gx-pro)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" wan
 		;;
@@ -21,8 +23,7 @@ mediatek_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"0:lan" "1:lan" "2:lan" "3:lan" "4:wan" "6@eth0"
 		;;
-	ubnt,unifi-6-lr|\
-	ubnt,unifi-6-lr-ubootmod)
+	ubnt,unifi-6-lr*)
 		ucidef_set_interface_lan "eth0"
 		;;
 	xiaomi,redmi-router-ax6s)
@@ -35,6 +36,17 @@ mediatek_setup_interfaces()
 	esac
 }
 
+DEV_PATH_WMAC=platform/18000000.wmac
+DEV_PATH_PCIE0=1a143000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0
+DEV_PATH_PCIE1=1a145000.pcie/pci0001:00/0001:00:01.0/0001:01:00.0
+
+mediatek_setup_wlan()
+{
+	dt_is_enabled wmac@18000000 && ucidef_add_wlan $DEV_PATH_WMAC
+	dt_is_enabled pcie@1a143000 && ucidef_add_wlan $DEV_PATH_PCIE0
+	dt_is_enabled pcie@1a145000 && ucidef_add_wlan $DEV_PATH_PCIE1
+}
+
 mediatek_setup_macs()
 {
 	local board="$1"
@@ -43,6 +55,7 @@ mediatek_setup_macs()
 	local label_mac=""
 
 	case $board in
+	reyee,ax3200-e5|\
 	ruijie,rg-ew3200gx-pro)
 		lan_mac=$(macaddr_add $(get_mac_label) 1)
 		;;
@@ -61,6 +74,7 @@ board_config_update
 board=$(board_name)
 mediatek_setup_interfaces $board
 mediatek_setup_macs $board
+mediatek_setup_wlan $board
 board_config_flush
 
 exit 0
diff --git a/target/linux/mediatek/mt7622/base-files/etc/board.d/05_compat-version b/target/linux/mediatek/mt7622/base-files/etc/board.d/05_compat-version
new file mode 100644
index 00000000000000..c8fb2c08f69915
--- /dev/null
+++ b/target/linux/mediatek/mt7622/base-files/etc/board.d/05_compat-version
@@ -0,0 +1,15 @@
+
+. /lib/functions.sh
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+	bananapi,bpi-r64)
+		ucidef_set_compat_version "1.1"
+		;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/mediatek/mt7622/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac b/target/linux/mediatek/mt7622/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
index d573465745e190..f8639e9f409147 100644
--- a/target/linux/mediatek/mt7622/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
+++ b/target/linux/mediatek/mt7622/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
@@ -10,6 +10,10 @@ PHYNBR=${DEVPATH##*/phy}
 board=$(board_name)
 
 case "$board" in
+	bananapi,bpi-r64)
+		[ "$PHYNBR" = "0" ] && macaddr_add $(cat /sys/class/net/eth0/address) 2 > /sys${DEVPATH}/macaddress
+		;;
+	reyee,ax3200-e5|\
 	ruijie,rg-ew3200gx-pro)
 		[ "$PHYNBR" = "0" ] && macaddr_add $(get_mac_label) 3 > /sys${DEVPATH}/macaddress
 		[ "$PHYNBR" = "1" ] && macaddr_add $(get_mac_label) 2 > /sys${DEVPATH}/macaddress
diff --git a/target/linux/mediatek/mt7622/base-files/etc/uci-defaults/05_fix-compat-version b/target/linux/mediatek/mt7622/base-files/etc/uci-defaults/05_fix-compat-version
new file mode 100644
index 00000000000000..c77e1cb8bd1927
--- /dev/null
+++ b/target/linux/mediatek/mt7622/base-files/etc/uci-defaults/05_fix-compat-version
@@ -0,0 +1,10 @@
+. /lib/functions.sh
+
+case "$(board_name)" in
+	bananapi,bpi-r64)
+	uci set system.@system[0].compat_version="1.1"
+	uci commit system
+	;;
+esac
+
+exit 0
diff --git a/target/linux/mediatek/mt7622/base-files/lib/upgrade/platform.sh b/target/linux/mediatek/mt7622/base-files/lib/upgrade/platform.sh
index 1036793145df4a..b37b7b1c6e5772 100755
--- a/target/linux/mediatek/mt7622/base-files/lib/upgrade/platform.sh
+++ b/target/linux/mediatek/mt7622/base-files/lib/upgrade/platform.sh
@@ -6,8 +6,9 @@ platform_do_upgrade() {
 
 	case "$board" in
 	bananapi,bpi-r64)
-		export_bootdevice
-		export_partdevice rootdev 0
+		local rootdev="$(cmdline_get_var root)"
+		rootdev="${rootdev##*/}"
+		rootdev="${rootdev%p[0-9]*}"
 		case "$rootdev" in
 		mmc*)
 			CI_ROOTDEV="$rootdev"
@@ -34,6 +35,7 @@ platform_do_upgrade() {
 		;;
 	elecom,wrc-x3200gst3|\
 	mediatek,mt7622-rfb1-ubi|\
+	netgear,wax206|\
 	totolink,a8000ru|\
 	xiaomi,redmi-router-ax6s)
 		nand_do_upgrade "$1"
@@ -70,9 +72,11 @@ platform_check_image() {
 		;;
 	elecom,wrc-x3200gst3|\
 	mediatek,mt7622-rfb1-ubi|\
+	netgear,wax206|\
 	totolink,a8000ru|\
 	xiaomi,redmi-router-ax6s)
 		nand_do_platform_check "$board" "$1"
+		return $?
 		;;
 	*)
 		[ "$magic" != "d00dfeed" ] && {
diff --git a/target/linux/mediatek/mt7622/config-5.15 b/target/linux/mediatek/mt7622/config-5.15
index 8717e799ed800d..30a5ff948fac83 100644
--- a/target/linux/mediatek/mt7622/config-5.15
+++ b/target/linux/mediatek/mt7622/config-5.15
@@ -22,11 +22,9 @@ CONFIG_ARM64_CRYPTO=y
 CONFIG_ARM64_ERRATUM_843419=y
 CONFIG_ARM64_ERRATUM_845719=y
 CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
-CONFIG_ARM64_MODULE_PLTS=y
 CONFIG_ARM64_PAGE_SHIFT=12
 CONFIG_ARM64_PA_BITS=48
 CONFIG_ARM64_PA_BITS_48=y
-# CONFIG_ARM64_SW_TTBR0_PAN is not set
 CONFIG_ARM64_TAGGED_ADDR_ABI=y
 CONFIG_ARM64_VA_BITS=39
 CONFIG_ARM64_VA_BITS_39=y
@@ -71,9 +69,11 @@ CONFIG_COMMON_CLK_MT7622=y
 CONFIG_COMMON_CLK_MT7622_AUDSYS=y
 CONFIG_COMMON_CLK_MT7622_ETHSYS=y
 CONFIG_COMMON_CLK_MT7622_HIFSYS=y
+# CONFIG_COMMON_CLK_MT7981 is not set
 # CONFIG_COMMON_CLK_MT7986 is not set
+# CONFIG_COMMON_CLK_MT7988 is not set
 # CONFIG_COMMON_CLK_MT8173 is not set
-CONFIG_COMMON_CLK_MT8183=y
+# CONFIG_COMMON_CLK_MT8183 is not set
 # CONFIG_COMMON_CLK_MT8183_AUDIOSYS is not set
 # CONFIG_COMMON_CLK_MT8183_CAMSYS is not set
 # CONFIG_COMMON_CLK_MT8183_IMGSYS is not set
@@ -85,19 +85,15 @@ CONFIG_COMMON_CLK_MT8183=y
 # CONFIG_COMMON_CLK_MT8183_MMSYS is not set
 # CONFIG_COMMON_CLK_MT8183_VDECSYS is not set
 # CONFIG_COMMON_CLK_MT8183_VENCSYS is not set
-CONFIG_COMMON_CLK_MT8516=y
+# CONFIG_COMMON_CLK_MT8516 is not set
 # CONFIG_COMMON_CLK_MT8516_AUDSYS is not set
-CONFIG_COMPAT=y
 CONFIG_COMPAT_32BIT_TIME=y
-CONFIG_COMPAT_BINFMT_ELF=y
-CONFIG_COMPAT_NETLINK_MESSAGES=y
-CONFIG_COMPAT_OLD_SIGACTION=y
 CONFIG_CONFIGFS_FS=y
 CONFIG_CONSOLE_LOGLEVEL_DEFAULT=15
 # CONFIG_CPUFREQ_DT is not set
 CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
 # CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
-CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_GOV_ATTR_SET=y
 CONFIG_CPU_FREQ_GOV_COMMON=y
 CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
@@ -107,6 +103,7 @@ CONFIG_CPU_FREQ_GOV_POWERSAVE=y
 CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
 CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_LITTLE_ENDIAN=y
 CONFIG_CPU_RMAP=y
 CONFIG_CPU_THERMAL=y
 CONFIG_CRC16=y
@@ -146,7 +143,6 @@ CONFIG_DCACHE_WORD_ACCESS=y
 CONFIG_DEBUG_MISC=y
 CONFIG_DIMLIB=y
 CONFIG_DMADEVICES=y
-CONFIG_DMATEST=y
 CONFIG_DMA_DIRECT_REMAP=y
 CONFIG_DMA_ENGINE=y
 CONFIG_DMA_ENGINE_RAID=y
@@ -154,7 +150,6 @@ CONFIG_DMA_OF=y
 CONFIG_DMA_REMAP=y
 CONFIG_DMA_VIRTUAL_CHANNELS=y
 CONFIG_DTC=y
-CONFIG_DYNAMIC_DEBUG=y
 CONFIG_EDAC_SUPPORT=y
 CONFIG_EINT_MTK=y
 CONFIG_EXT4_FS=y
@@ -211,12 +206,8 @@ CONFIG_I2C_BOARDINFO=y
 CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_MT65XX=y
 CONFIG_ICPLUS_PHY=y
-CONFIG_IIO=y
-CONFIG_IKCONFIG=y
-CONFIG_IKCONFIG_PROC=y
 CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
 CONFIG_INITRAMFS_SOURCE=""
-CONFIG_IO_URING=y
 CONFIG_IRQCHIP=y
 CONFIG_IRQ_DOMAIN=y
 CONFIG_IRQ_DOMAIN_HIERARCHY=y
@@ -234,8 +225,9 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_MDIO_BUS=y
 CONFIG_MDIO_DEVICE=y
 CONFIG_MDIO_DEVRES=y
+# CONFIG_MEDIATEK_2P5G_PHY is not set
 CONFIG_MEDIATEK_GE_PHY=y
-CONFIG_MEDIATEK_MT6577_AUXADC=y
+# CONFIG_MEDIATEK_GE_SOC_PHY is not set
 CONFIG_MEDIATEK_WATCHDOG=y
 CONFIG_MEMFD_CREATE=y
 CONFIG_MESSAGE_LOGLEVEL_DEFAULT=7
@@ -262,11 +254,11 @@ CONFIG_MTD_SPLIT_FIRMWARE=y
 CONFIG_MTD_SPLIT_FIT_FW=y
 CONFIG_MTD_UBI=y
 CONFIG_MTD_UBI_BEB_LIMIT=20
+CONFIG_MTD_UBI_FASTMAP=y
 CONFIG_MTD_UBI_BLOCK=y
 CONFIG_MTD_UBI_WL_THRESHOLD=4096
 # CONFIG_MTK_CMDQ is not set
 # CONFIG_MTK_CQDMA is not set
-CONFIG_MTK_EFUSE=y
 CONFIG_MTK_HSDMA=y
 CONFIG_MTK_INFRACFG=y
 CONFIG_MTK_PMIC_WRAP=y
@@ -281,9 +273,12 @@ CONFIG_NEED_SG_DMA_LENGTH=y
 CONFIG_NET_DEVLINK=y
 CONFIG_NET_DSA=y
 CONFIG_NET_DSA_MT7530=y
+CONFIG_NET_DSA_MT7530_MDIO=y
+# CONFIG_NET_DSA_MT7530_MMIO is not set
 CONFIG_NET_DSA_TAG_MTK=y
 CONFIG_NET_FLOW_LIMIT=y
 CONFIG_NET_MEDIATEK_SOC=y
+# CONFIG_NET_MEDIATEK_SOC_USXGMII is not set
 CONFIG_NET_MEDIATEK_SOC_WED=y
 CONFIG_NET_SELFTESTS=y
 CONFIG_NET_SWITCHDEV=y
@@ -293,6 +288,7 @@ CONFIG_NO_HZ_COMMON=y
 CONFIG_NO_HZ_IDLE=y
 CONFIG_NR_CPUS=2
 CONFIG_NVMEM=y
+CONFIG_NVMEM_MTK_EFUSE=y
 CONFIG_NVMEM_SYSFS=y
 CONFIG_OF=y
 CONFIG_OF_ADDRESS=y
@@ -336,7 +332,9 @@ CONFIG_PINCTRL=y
 # CONFIG_PINCTRL_MT6765 is not set
 # CONFIG_PINCTRL_MT6797 is not set
 CONFIG_PINCTRL_MT7622=y
+# CONFIG_PINCTRL_MT7981 is not set
 # CONFIG_PINCTRL_MT7986 is not set
+# CONFIG_PINCTRL_MT7988 is not set
 # CONFIG_PINCTRL_MT8173 is not set
 # CONFIG_PINCTRL_MT8183 is not set
 CONFIG_PINCTRL_MT8516=y
@@ -379,6 +377,7 @@ CONFIG_REGMAP_MMIO=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
 CONFIG_REGULATOR_MT6380=y
+# CONFIG_REGULATOR_RT5190A is not set
 CONFIG_RESET_CONTROLLER=y
 CONFIG_RFS_ACCEL=y
 CONFIG_RODATA_FULL_DEFAULT_ENABLED=y
@@ -441,12 +440,7 @@ CONFIG_TREE_SRCU=y
 CONFIG_UBIFS_FS=y
 # CONFIG_UCLAMP_TASK is not set
 # CONFIG_UNMAP_KERNEL_AT_EL0 is not set
-CONFIG_USB=y
-CONFIG_USB_COMMON=y
 CONFIG_USB_SUPPORT=y
-CONFIG_USB_XHCI_HCD=y
-CONFIG_USB_XHCI_MTK=y
-# CONFIG_USB_XHCI_PLATFORM is not set
 CONFIG_VMAP_STACK=y
 CONFIG_WATCHDOG_CORE=y
 CONFIG_WATCHDOG_PRETIMEOUT_DEFAULT_GOV_PANIC=y
diff --git a/target/linux/mediatek/mt7622/target.mk b/target/linux/mediatek/mt7622/target.mk
index 92c3f47370ee12..7742672a513b2e 100644
--- a/target/linux/mediatek/mt7622/target.mk
+++ b/target/linux/mediatek/mt7622/target.mk
@@ -2,7 +2,7 @@ ARCH:=aarch64
 SUBTARGET:=mt7622
 BOARDNAME:=MT7622
 CPU_TYPE:=cortex-a53
-DEFAULT_PACKAGES += kmod-mt7615e kmod-mt7615-firmware wpad-basic-wolfssl uboot-envtools
+DEFAULT_PACKAGES += kmod-mt7622-firmware wpad-basic-mbedtls uboot-envtools
 KERNELNAME:=Image dtbs
 
 define Target/Description
diff --git a/target/linux/mediatek/mt7623/config-5.15 b/target/linux/mediatek/mt7623/config-5.15
index d28b051c853c38..039a904f197000 100644
--- a/target/linux/mediatek/mt7623/config-5.15
+++ b/target/linux/mediatek/mt7623/config-5.15
@@ -21,6 +21,7 @@ CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
 # CONFIG_ARM_ATAG_DTB_COMPAT is not set
 CONFIG_ARM_CPU_SUSPEND=y
 # CONFIG_ARM_CPU_TOPOLOGY is not set
+CONFIG_ARM_CRYPTO=y
 CONFIG_ARM_DMA_IOMMU_ALIGNMENT=8
 CONFIG_ARM_DMA_USE_IOMMU=y
 CONFIG_ARM_GIC=y
@@ -53,8 +54,8 @@ CONFIG_CLKSRC_MMIO=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CMDLINE="earlyprintk console=ttyS0,115200 rootfstype=squashfs,jffs2"
 CONFIG_CMDLINE_FROM_BOOTLOADER=y
-CONFIG_CMDLINE_PARTITION=y
 # CONFIG_CMDLINE_OVERRIDE is not set
+CONFIG_CMDLINE_PARTITION=y
 CONFIG_COMMON_CLK=y
 CONFIG_COMMON_CLK_MEDIATEK=y
 CONFIG_COMMON_CLK_MT2701=y
@@ -68,7 +69,9 @@ CONFIG_COMMON_CLK_MT2701_MMSYS=y
 CONFIG_COMMON_CLK_MT2701_VDECSYS=y
 # CONFIG_COMMON_CLK_MT7622 is not set
 # CONFIG_COMMON_CLK_MT7629 is not set
+# CONFIG_COMMON_CLK_MT7981 is not set
 # CONFIG_COMMON_CLK_MT7986 is not set
+# CONFIG_COMMON_CLK_MT7988 is not set
 # CONFIG_COMMON_CLK_MT8135 is not set
 # CONFIG_COMMON_CLK_MT8173 is not set
 CONFIG_COMMON_CLK_MT8516=y
@@ -108,7 +111,6 @@ CONFIG_CRC16=y
 # CONFIG_CRC32_SARWATE is not set
 CONFIG_CRC32_SLICEBY8=y
 CONFIG_CROSS_MEMORY_ATTACH=y
-CONFIG_CRYPTO_BLAKE2S=y
 CONFIG_CRYPTO_CRC32=y
 CONFIG_CRYPTO_CRC32C=y
 CONFIG_CRYPTO_DEFLATE=y
@@ -275,15 +277,12 @@ CONFIG_INPUT_KEYBOARD=y
 CONFIG_INPUT_TOUCHSCREEN=y
 CONFIG_IOMMU_API=y
 # CONFIG_IOMMU_DEBUGFS is not set
-# CONFIG_IOMMU_DEFAULT_DMA_LAZY is not set
 CONFIG_IOMMU_DEFAULT_DMA_STRICT=y
-# CONFIG_IOMMU_DEFAULT_PASSTHROUGH is not set
 CONFIG_IOMMU_IO_PGTABLE=y
 CONFIG_IOMMU_IO_PGTABLE_ARMV7S=y
 # CONFIG_IOMMU_IO_PGTABLE_ARMV7S_SELFTEST is not set
 # CONFIG_IOMMU_IO_PGTABLE_LPAE is not set
 CONFIG_IOMMU_SUPPORT=y
-CONFIG_IO_URING=y
 CONFIG_IRQCHIP=y
 CONFIG_IRQ_DOMAIN=y
 CONFIG_IRQ_DOMAIN_HIERARCHY=y
@@ -353,7 +352,6 @@ CONFIG_MTD_UBI_WL_THRESHOLD=4096
 CONFIG_MTK_CMDQ=y
 CONFIG_MTK_CMDQ_MBOX=y
 CONFIG_MTK_CQDMA=y
-CONFIG_MTK_EFUSE=y
 # CONFIG_MTK_HSDMA is not set
 CONFIG_MTK_INFRACFG=y
 CONFIG_MTK_IOMMU=y
@@ -374,6 +372,8 @@ CONFIG_NEON=y
 CONFIG_NET_DEVLINK=y
 CONFIG_NET_DSA=y
 CONFIG_NET_DSA_MT7530=y
+CONFIG_NET_DSA_MT7530_MDIO=y
+# CONFIG_NET_DSA_MT7530_MMIO is not set
 CONFIG_NET_DSA_TAG_MTK=y
 CONFIG_NET_FLOW_LIMIT=y
 CONFIG_NET_MEDIATEK_SOC=y
@@ -389,6 +389,7 @@ CONFIG_NO_HZ_COMMON=y
 CONFIG_NO_HZ_IDLE=y
 CONFIG_NR_CPUS=4
 CONFIG_NVMEM=y
+CONFIG_NVMEM_MTK_EFUSE=y
 # CONFIG_NVMEM_SPMI_SDAM is not set
 CONFIG_NVMEM_SYSFS=y
 CONFIG_OF=y
@@ -407,7 +408,8 @@ CONFIG_OLD_SIGACTION=y
 CONFIG_OLD_SIGSUSPEND3=y
 CONFIG_PADATA=y
 CONFIG_PAGE_OFFSET=0xC0000000
-CONFIG_PAHOLE_HAS_SPLIT_BTF=y
+CONFIG_PAGE_POOL=y
+CONFIG_PAGE_POOL_STATS=y
 CONFIG_PCI=y
 CONFIG_PCIEAER=y
 CONFIG_PCIEPORTBUS=y
@@ -417,6 +419,7 @@ CONFIG_PCI_DOMAINS=y
 CONFIG_PCI_DOMAINS_GENERIC=y
 CONFIG_PCI_MSI=y
 CONFIG_PCI_MSI_IRQ_DOMAIN=y
+CONFIG_PCS_MTK_LYNXI=y
 CONFIG_PERF_USE_VMALLOC=y
 CONFIG_PGTABLE_LEVELS=2
 CONFIG_PHYLIB=y
@@ -430,7 +433,6 @@ CONFIG_PINCTRL=y
 CONFIG_PINCTRL_MT2701=y
 CONFIG_PINCTRL_MT6397=y
 CONFIG_PINCTRL_MT7623=y
-# CONFIG_PINCTRL_MT7986 is not set
 CONFIG_PINCTRL_MTK=y
 CONFIG_PINCTRL_MTK_MOORE=y
 CONFIG_PINCTRL_MTK_V2=y
@@ -470,6 +472,7 @@ CONFIG_REGULATOR_MT6323=y
 # CONFIG_REGULATOR_MT6358 is not set
 # CONFIG_REGULATOR_MT6380 is not set
 # CONFIG_REGULATOR_MT6397 is not set
+# CONFIG_REGULATOR_RT5190A is not set
 # CONFIG_REGULATOR_QCOM_LABIBB is not set
 # CONFIG_REGULATOR_QCOM_SPMI is not set
 # CONFIG_REGULATOR_QCOM_USB_VBUS is not set
@@ -507,7 +510,6 @@ CONFIG_SRCU=y
 # CONFIG_STRIP_ASM_SYMS is not set
 CONFIG_SUSPEND=y
 CONFIG_SUSPEND_FREEZER=y
-CONFIG_SWCONFIG=y
 CONFIG_SWPHY=y
 CONFIG_SWP_EMULATE=y
 CONFIG_SYNC_FILE=y
@@ -552,9 +554,6 @@ CONFIG_USB_ROLE_SWITCH=y
 CONFIG_USB_SUPPORT=y
 CONFIG_USB_U_ETHER=y
 CONFIG_USB_U_SERIAL=y
-CONFIG_USB_XHCI_HCD=y
-CONFIG_USB_XHCI_MTK=y
-CONFIG_USB_XHCI_PLATFORM=y
 CONFIG_USE_OF=y
 CONFIG_VFP=y
 CONFIG_VFPv3=y
diff --git a/target/linux/mediatek/mt7629/config-5.15 b/target/linux/mediatek/mt7629/config-5.15
index 39596717ae26db..08089dde2a3211 100644
--- a/target/linux/mediatek/mt7629/config-5.15
+++ b/target/linux/mediatek/mt7629/config-5.15
@@ -1,4 +1,3 @@
-CONFIG_AF_UNIX_OOB=y
 CONFIG_ALIGNMENT_TRAP=y
 CONFIG_ARCH_32BIT_OFF_T=y
 CONFIG_ARCH_HIBERNATION_POSSIBLE=y
@@ -17,6 +16,7 @@ CONFIG_ARCH_SUSPEND_POSSIBLE=y
 CONFIG_ARM=y
 CONFIG_ARM_ARCH_TIMER=y
 CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+CONFIG_ARM_CRYPTO=y
 CONFIG_ARM_GIC=y
 CONFIG_ARM_HAS_SG_CHAIN=y
 CONFIG_ARM_HEAVY_MB=y
@@ -29,7 +29,6 @@ CONFIG_ARM_UNWIND=y
 CONFIG_ARM_VIRT_EXT=y
 CONFIG_ATAGS=y
 CONFIG_AUTO_ZRELADDR=y
-CONFIG_BINARY_PRINTF=y
 CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_BLK_MQ_PCI=y
@@ -52,7 +51,9 @@ CONFIG_COMMON_CLK_MEDIATEK=y
 CONFIG_COMMON_CLK_MT7629=y
 CONFIG_COMMON_CLK_MT7629_ETHSYS=y
 CONFIG_COMMON_CLK_MT7629_HIFSYS=y
+# CONFIG_COMMON_CLK_MT7981 is not set
 # CONFIG_COMMON_CLK_MT7986 is not set
+# CONFIG_COMMON_CLK_MT7988 is not set
 # CONFIG_COMMON_CLK_MT8135 is not set
 # CONFIG_COMMON_CLK_MT8173 is not set
 CONFIG_COMMON_CLK_MT8516=y
@@ -77,7 +78,6 @@ CONFIG_CPU_THUMB_CAPABLE=y
 CONFIG_CPU_TLB_V7=y
 CONFIG_CPU_V7=y
 CONFIG_CRC16=y
-CONFIG_CRYPTO_BLAKE2S_ARM=y
 CONFIG_CRYPTO_DEFLATE=y
 CONFIG_CRYPTO_HASH_INFO=y
 CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
@@ -129,8 +129,8 @@ CONFIG_GENERIC_STRNLEN_USER=y
 CONFIG_GENERIC_TIME_VSYSCALL=y
 CONFIG_GENERIC_VDSO_32=y
 CONFIG_GPIO_CDEV=y
+CONFIG_GRO_CELLS=y
 CONFIG_HANDLE_DOMAIN_IRQ=y
-# CONFIG_HARDENED_USERCOPY is not set
 CONFIG_HARDEN_BRANCH_PREDICTOR=y
 CONFIG_HARDIRQS_SW_RESEND=y
 CONFIG_HAS_DMA=y
@@ -142,7 +142,6 @@ CONFIG_HW_RANDOM=y
 CONFIG_HW_RANDOM_MTK=y
 CONFIG_HZ_FIXED=0
 CONFIG_INITRAMFS_SOURCE=""
-CONFIG_IO_URING=y
 CONFIG_IRQCHIP=y
 CONFIG_IRQ_DOMAIN=y
 CONFIG_IRQ_DOMAIN_HIERARCHY=y
@@ -153,7 +152,6 @@ CONFIG_IRQ_WORK=y
 CONFIG_LIBFDT=y
 CONFIG_LOCK_DEBUGGING_SUPPORT=y
 CONFIG_LOCK_SPIN_ON_OWNER=y
-CONFIG_LTO_NONE=y
 CONFIG_LZO_COMPRESS=y
 CONFIG_LZO_DECOMPRESS=y
 # CONFIG_MACH_MT2701 is not set
@@ -166,6 +164,7 @@ CONFIG_MACH_MT7629=y
 CONFIG_MDIO_BUS=y
 CONFIG_MDIO_DEVICE=y
 CONFIG_MDIO_DEVRES=y
+CONFIG_MEDIATEK_GE_PHY=y
 CONFIG_MEDIATEK_WATCHDOG=y
 CONFIG_MEMFD_CREATE=y
 CONFIG_MFD_SYSCON=y
@@ -187,7 +186,6 @@ CONFIG_MTD_UBI_BEB_LIMIT=20
 CONFIG_MTD_UBI_BLOCK=y
 CONFIG_MTD_UBI_WL_THRESHOLD=4096
 # CONFIG_MTK_CMDQ is not set
-# CONFIG_MTK_EFUSE is not set
 CONFIG_MTK_INFRACFG=y
 # CONFIG_MTK_PMIC_WRAP is not set
 CONFIG_MTK_SCPSYS=y
@@ -199,12 +197,13 @@ CONFIG_NETFILTER=y
 CONFIG_NET_DEVLINK=y
 CONFIG_NET_DSA=y
 CONFIG_NET_DSA_MT7530=y
+CONFIG_NET_DSA_MT7530_MDIO=y
+# CONFIG_NET_DSA_MT7530_MMIO is not set
 CONFIG_NET_DSA_TAG_MTK=y
 CONFIG_NET_FLOW_LIMIT=y
 CONFIG_NET_MEDIATEK_SOC=y
 CONFIG_NET_MEDIATEK_SOC_WED=y
 CONFIG_NET_SELFTESTS=y
-CONFIG_NET_SOCK_MSG=y
 CONFIG_NET_SWITCHDEV=y
 CONFIG_NET_VENDOR_MEDIATEK=y
 CONFIG_NLS=y
@@ -212,6 +211,7 @@ CONFIG_NO_HZ_COMMON=y
 CONFIG_NO_HZ_IDLE=y
 CONFIG_NR_CPUS=2
 CONFIG_NVMEM=y
+# CONFIG_NVMEM_MTK_EFUSE is not set
 CONFIG_NVMEM_SYSFS=y
 CONFIG_OF=y
 CONFIG_OF_ADDRESS=y
@@ -227,6 +227,8 @@ CONFIG_OUTER_CACHE=y
 CONFIG_OUTER_CACHE_SYNC=y
 CONFIG_PADATA=y
 CONFIG_PAGE_OFFSET=0xC0000000
+CONFIG_PAGE_POOL=y
+CONFIG_PAGE_POOL_STATS=y
 CONFIG_PCI=y
 CONFIG_PCIEAER=y
 CONFIG_PCIEPORTBUS=y
@@ -236,6 +238,7 @@ CONFIG_PCI_DOMAINS=y
 CONFIG_PCI_DOMAINS_GENERIC=y
 CONFIG_PCI_MSI=y
 CONFIG_PCI_MSI_IRQ_DOMAIN=y
+CONFIG_PCS_MTK_LYNXI=y
 CONFIG_PERF_USE_VMALLOC=y
 CONFIG_PGTABLE_LEVELS=2
 CONFIG_PHYLIB=y
@@ -245,7 +248,6 @@ CONFIG_PHY_MTK_TPHY=y
 # CONFIG_PHY_MTK_XSPHY is not set
 CONFIG_PINCTRL=y
 CONFIG_PINCTRL_MT7629=y
-# CONFIG_PINCTRL_MT7986 is not set
 CONFIG_PINCTRL_MTK_MOORE=y
 CONFIG_PINCTRL_MTK_V2=y
 CONFIG_PM=y
diff --git a/target/linux/mediatek/patches-5.15/104-mt7622-add-snor-irq.patch b/target/linux/mediatek/patches-5.15/104-mt7622-add-snor-irq.patch
index fa2cd96f971cc1..79b051147a34ab 100644
--- a/target/linux/mediatek/patches-5.15/104-mt7622-add-snor-irq.patch
+++ b/target/linux/mediatek/patches-5.15/104-mt7622-add-snor-irq.patch
@@ -1,6 +1,6 @@
 --- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
 +++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
-@@ -558,6 +558,7 @@
+@@ -559,6 +559,7 @@
  		compatible = "mediatek,mt7622-nor",
  			     "mediatek,mt8173-nor";
  		reg = <0 0x11014000 0 0xe0>;
diff --git a/target/linux/mediatek/patches-5.15/120-08-v5.18-mtd-spinand-Delay-a-little-bit-the-dirmap-creation.patch b/target/linux/mediatek/patches-5.15/120-08-v5.18-mtd-spinand-Delay-a-little-bit-the-dirmap-creation.patch
index 0f69b30e947204..87c7b7cd297ac3 100644
--- a/target/linux/mediatek/patches-5.15/120-08-v5.18-mtd-spinand-Delay-a-little-bit-the-dirmap-creation.patch
+++ b/target/linux/mediatek/patches-5.15/120-08-v5.18-mtd-spinand-Delay-a-little-bit-the-dirmap-creation.patch
@@ -18,7 +18,7 @@ Link: https://lore.kernel.org/linux-mtd/20220127091808.1043392-8-miquel.raynal@b
 
 --- a/drivers/mtd/nand/spi/core.c
 +++ b/drivers/mtd/nand/spi/core.c
-@@ -1211,14 +1211,6 @@ static int spinand_init(struct spinand_d
+@@ -1221,14 +1221,6 @@ static int spinand_init(struct spinand_d
  	if (ret)
  		goto err_free_bufs;
  
@@ -33,7 +33,7 @@ Link: https://lore.kernel.org/linux-mtd/20220127091808.1043392-8-miquel.raynal@b
  	ret = nanddev_init(nand, &spinand_ops, THIS_MODULE);
  	if (ret)
  		goto err_manuf_cleanup;
-@@ -1253,6 +1245,14 @@ static int spinand_init(struct spinand_d
+@@ -1263,6 +1255,14 @@ static int spinand_init(struct spinand_d
  	mtd->ecc_strength = nanddev_get_ecc_conf(nand)->strength;
  	mtd->ecc_step_size = nanddev_get_ecc_conf(nand)->step_size;
  
diff --git a/target/linux/mediatek/patches-5.15/120-09-v5.18-mtd-spinand-Create-direct-mapping-descriptors-for-EC.patch b/target/linux/mediatek/patches-5.15/120-09-v5.18-mtd-spinand-Create-direct-mapping-descriptors-for-EC.patch
index 1188872bd78731..35912cd2cd6b81 100644
--- a/target/linux/mediatek/patches-5.15/120-09-v5.18-mtd-spinand-Create-direct-mapping-descriptors-for-EC.patch
+++ b/target/linux/mediatek/patches-5.15/120-09-v5.18-mtd-spinand-Create-direct-mapping-descriptors-for-EC.patch
@@ -53,7 +53,7 @@ Link: https://lore.kernel.org/linux-mtd/20220127091808.1043392-9-miquel.raynal@b
  
  	while (nbytes) {
  		ret = spi_mem_dirmap_write(wdesc, column, nbytes, buf);
-@@ -865,6 +871,31 @@ static int spinand_create_dirmap(struct
+@@ -875,6 +881,31 @@ static int spinand_create_dirmap(struct
  
  	spinand->dirmaps[plane].rdesc = desc;
  
diff --git a/target/linux/mediatek/patches-5.15/120-12-v5.19-spi-add-driver-for-MTK-SPI-NAND-Flash-Interface.patch b/target/linux/mediatek/patches-5.15/120-12-v5.19-spi-add-driver-for-MTK-SPI-NAND-Flash-Interface.patch
index b77b4ad4c473a3..ed209050123b7e 100644
--- a/target/linux/mediatek/patches-5.15/120-12-v5.19-spi-add-driver-for-MTK-SPI-NAND-Flash-Interface.patch
+++ b/target/linux/mediatek/patches-5.15/120-12-v5.19-spi-add-driver-for-MTK-SPI-NAND-Flash-Interface.patch
@@ -35,7 +35,7 @@ Changes since v5:
 
 --- a/drivers/spi/Kconfig
 +++ b/drivers/spi/Kconfig
-@@ -530,6 +530,16 @@ config SPI_MTK_NOR
+@@ -529,6 +529,16 @@ config SPI_MTK_NOR
  	  SPI interface as well as several SPI NOR specific instructions
  	  via SPI MEM interface.
  
diff --git a/target/linux/mediatek/patches-5.15/120-14-v5.19-arm64-dts-mediatek-add-mtk-snfi-for-mt7622.patch b/target/linux/mediatek/patches-5.15/120-14-v5.19-arm64-dts-mediatek-add-mtk-snfi-for-mt7622.patch
index d5285676fec6db..15d267137230e3 100644
--- a/target/linux/mediatek/patches-5.15/120-14-v5.19-arm64-dts-mediatek-add-mtk-snfi-for-mt7622.patch
+++ b/target/linux/mediatek/patches-5.15/120-14-v5.19-arm64-dts-mediatek-add-mtk-snfi-for-mt7622.patch
@@ -14,7 +14,7 @@ Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
 
 --- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
 +++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
-@@ -552,6 +552,18 @@
+@@ -553,6 +553,18 @@
  		status = "disabled";
  	};
  
diff --git a/target/linux/mediatek/patches-5.15/121-hack-spi-nand-1b-bbm.patch b/target/linux/mediatek/patches-5.15/121-hack-spi-nand-1b-bbm.patch
index 770a7ff9bd9a0d..ff5521c44eafd5 100644
--- a/target/linux/mediatek/patches-5.15/121-hack-spi-nand-1b-bbm.patch
+++ b/target/linux/mediatek/patches-5.15/121-hack-spi-nand-1b-bbm.patch
@@ -1,6 +1,6 @@
 --- a/drivers/mtd/nand/spi/core.c
 +++ b/drivers/mtd/nand/spi/core.c
-@@ -714,7 +714,7 @@ static int spinand_mtd_write(struct mtd_
+@@ -724,7 +724,7 @@ static int spinand_mtd_write(struct mtd_
  static bool spinand_isbad(struct nand_device *nand, const struct nand_pos *pos)
  {
  	struct spinand_device *spinand = nand_to_spinand(nand);
@@ -9,7 +9,7 @@
  	struct nand_page_io_req req = {
  		.pos = *pos,
  		.ooblen = sizeof(marker),
-@@ -725,7 +725,7 @@ static bool spinand_isbad(struct nand_de
+@@ -735,7 +735,7 @@ static bool spinand_isbad(struct nand_de
  
  	spinand_select_target(spinand, pos->target);
  	spinand_read_page(spinand, &req);
diff --git a/target/linux/mediatek/patches-5.15/191-v5.19-arm64-dts-mt7622-specify-the-L2-cache-topology.patch b/target/linux/mediatek/patches-5.15/191-v5.19-arm64-dts-mt7622-specify-the-L2-cache-topology.patch
new file mode 100644
index 00000000000000..8851fefbb3a617
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/191-v5.19-arm64-dts-mt7622-specify-the-L2-cache-topology.patch
@@ -0,0 +1,132 @@
+From patchwork Thu Apr 28 22:57:55 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Rui Salvaterra <rsalvaterra@gmail.com>
+X-Patchwork-Id: 12831311
+Return-Path: 
+ <linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from bombadil.infradead.org (bombadil.infradead.org
+ [198.137.202.133])
+	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
+	(No client certificate requested)
+	by smtp.lore.kernel.org (Postfix) with ESMTPS id 49367C433EF
+	for <linux-arm-kernel@archiver.kernel.org>;
+ Thu, 28 Apr 2022 22:59:15 +0000 (UTC)
+DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
+	d=lists.infradead.org; s=bombadil.20210309; h=Sender:
+	Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post:
+	List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc
+	:To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:
+	Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:
+	List-Owner; bh=SerBW8MOw68wFFCbuq25LJzAcmqCfKMO2cFJxwFvZ+M=; b=nN4CYEO6VOGVbq
+	GSvQPGoya0L2IzQ/ZfknzQ853lY97zEPJk14ndK+TGQ+8ySjBSTu0xKgxlBoJj5G+DGubgRP1eZRJ
+	bktFqX2tohnrRavlceRxgVA3YFGBhjXE7AC0YzGC7auH2S6nSPUrH7cTVuaeIacIoV1AXPazc2hRU
+	u8RaJl1XHQwuhdZOsFBH99M5an3Zsmq0tsoIOYwB+gQaI307ZkqscxzcXFiCYCHlDvZlhHlW/WbdG
+	J+3iUnfq1KJWI2kE7TkPXMYaJzbEgG+LDrgYr3deADArCfCmnzbf0U29EZd6cR5D19GMVqGFDvsTX
+	H69W8qxVzJ+mR2HQd3GQ==;
+Received: from localhost ([::1] helo=bombadil.infradead.org)
+	by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux))
+	id 1nkD5T-008uVi-54; Thu, 28 Apr 2022 22:58:15 +0000
+Received: from mail-ed1-x533.google.com ([2a00:1450:4864:20::533])
+ by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux))
+ id 1nkD5P-008uUW-Px; Thu, 28 Apr 2022 22:58:13 +0000
+Received: by mail-ed1-x533.google.com with SMTP id p18so7146795edr.7;
+ Thu, 28 Apr 2022 15:58:08 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112;
+ h=from:to:cc:subject:date:message-id:mime-version
+ :content-transfer-encoding;
+ bh=R5/7OCxhqk5o9giaTDUQztGpi5IgQbeepSeYSbhWdII=;
+ b=BZQqEcfqgYTQ01yTJ3p6tPu0vaoYxHxTZYXAPCQDyng2F9JErAwf+wBYyeCYL3jbyn
+ fu7P7HVw2JjagdSunf6J7t0o3nqtfHGPh/ZLJHzYdg1s5shotJ5wMbZpAHCMdC4+K+BV
+ uL4JNuQnZmCRBiUFM+rtrpfaTepwEclOBBGoL9iE+tm/pWzx/WIR5WB9W8CutqsrDxF5
+ 8r5IwxNz3GLYfDgZMejyxQ0BjUIeQeCMTqhf73P19V3Bgg4MUbJ2q163D/OWSpHCbJdH
+ OfKEAdrVw4U7Rx0/SOnvPBxeiyCVH2uAkdPiFk+O3ZvsaiODty7uqGGjbN4chYEWRdp+
+ 7WBQ==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+ d=1e100.net; s=20210112;
+ h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version
+ :content-transfer-encoding;
+ bh=R5/7OCxhqk5o9giaTDUQztGpi5IgQbeepSeYSbhWdII=;
+ b=mvuzYrIKVAnpUgnlEa+S84XOruFt2VxxK25dib+Az/UPt4CzDO0h1u3SckfcmsFT4h
+ lUKka66CkdkHCJWC5JqKwSD0lbgtu2KWEsvtCWVDS+S6XKuAu99o2kvNyHC+/xW07dKL
+ zB7WAkyG53lrX0KH7fZ46uzHoRKWATW/idDhXBA49B+vaPqHKroSOn5JBKsu/hDwsQdf
+ zWA5tmOJweFjVZYe0ChD8OUDYOv+6RYlGqVvsQ5quMKJDBoC7KC8YMqvHc3K6DbQbnvZ
+ vJyXlcHgHSpadLRgg6wIY+ZyJyZsGqVyRD1TmcByRxSrUTGc3VSQeXUcUPv+3JFk9Esu
+ PqoA==
+X-Gm-Message-State: AOAM530veLoWc1JsDUuaRxe8Wi4N5UaD7cH5c9nhGlW7j5aj9gwvCDya
+ /uqAd6FaNeLuB5hEWmAEXXugS+7njg==
+X-Google-Smtp-Source: 
+ ABdhPJyLbUuBj/1YYm+3qmglf7zy9b/YbbcMub3/HL40okdVxkr6/TVxIZulAoEV9PjbfrGkO2N3Bw==
+X-Received: by 2002:a05:6402:2920:b0:425:d7c7:41f with SMTP id
+ ee32-20020a056402292000b00425d7c7041fmr29248373edb.370.1651186687432;
+ Thu, 28 Apr 2022 15:58:07 -0700 (PDT)
+Received: from crystalwell.adg.lan (a109-49-0-175.cpe.netcabo.pt.
+ [109.49.0.175]) by smtp.gmail.com with ESMTPSA id
+ a25-20020a056402169900b0042617ba63c8sm2219102edv.82.2022.04.28.15.58.06
+ (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+ Thu, 28 Apr 2022 15:58:06 -0700 (PDT)
+From: Rui Salvaterra <rsalvaterra@gmail.com>
+To: linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org,
+ linux-kernel@vger.kernel.org
+Cc: matthias.bgg@gmail.com, ryder.lee@mediatek.com, daniel@makrotopia.org,
+ Rui Salvaterra <rsalvaterra@gmail.com>
+Subject: [PATCH] arm64: dts: mt7622: specify the L2 cache topology
+Date: Thu, 28 Apr 2022 23:57:55 +0100
+Message-Id: <20220428225755.785153-1-rsalvaterra@gmail.com>
+X-Mailer: git-send-email 2.36.0
+MIME-Version: 1.0
+X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 
+X-CRM114-CacheID: sfid-20220428_155811_895571_B63D2806 
+X-CRM114-Status: GOOD (  10.27  )
+X-BeenThere: linux-arm-kernel@lists.infradead.org
+X-Mailman-Version: 2.1.34
+Precedence: list
+List-Id: <linux-arm-kernel.lists.infradead.org>
+List-Unsubscribe: 
+ <http://lists.infradead.org/mailman/options/linux-arm-kernel>,
+ <mailto:linux-arm-kernel-request@lists.infradead.org?subject=unsubscribe>
+List-Archive: <http://lists.infradead.org/pipermail/linux-arm-kernel/>
+List-Post: <mailto:linux-arm-kernel@lists.infradead.org>
+List-Help: <mailto:linux-arm-kernel-request@lists.infradead.org?subject=help>
+List-Subscribe: 
+ <http://lists.infradead.org/mailman/listinfo/linux-arm-kernel>,
+ <mailto:linux-arm-kernel-request@lists.infradead.org?subject=subscribe>
+Sender: "linux-arm-kernel" <linux-arm-kernel-bounces@lists.infradead.org>
+Errors-To: 
+ linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org
+
+On an MT7622 system, the kernel complains of not being able to detect the cache
+hierarchy of CPU 0. Specify the shared L2 cache node in the device tree, in
+order to fix this.
+
+Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
+---
+ arch/arm64/boot/dts/mediatek/mt7622.dtsi | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+@@ -80,6 +80,7 @@
+ 			enable-method = "psci";
+ 			clock-frequency = <1300000000>;
+ 			cci-control-port = <&cci_control2>;
++			next-level-cache = <&L2>;
+ 		};
+ 
+ 		cpu1: cpu@1 {
+@@ -94,6 +95,12 @@
+ 			enable-method = "psci";
+ 			clock-frequency = <1300000000>;
+ 			cci-control-port = <&cci_control2>;
++			next-level-cache = <&L2>;
++		};
++
++		L2: l2-cache {
++			compatible = "cache";
++			cache-level = <2>;
+ 		};
+ 	};
+ 
diff --git a/target/linux/mediatek/patches-5.15/192-v5.19-arm64-dts-mt7622-specify-the-number-of-DMA-requests.patch b/target/linux/mediatek/patches-5.15/192-v5.19-arm64-dts-mt7622-specify-the-number-of-DMA-requests.patch
new file mode 100644
index 00000000000000..4fef9aea22d93a
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/192-v5.19-arm64-dts-mt7622-specify-the-number-of-DMA-requests.patch
@@ -0,0 +1,122 @@
+From patchwork Fri Apr 29 08:42:25 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Rui Salvaterra <rsalvaterra@gmail.com>
+X-Patchwork-Id: 12831649
+Return-Path: 
+ <linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from bombadil.infradead.org (bombadil.infradead.org
+ [198.137.202.133])
+	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
+	(No client certificate requested)
+	by smtp.lore.kernel.org (Postfix) with ESMTPS id 386E2C433FE
+	for <linux-arm-kernel@archiver.kernel.org>;
+ Fri, 29 Apr 2022 08:43:49 +0000 (UTC)
+DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
+	d=lists.infradead.org; s=bombadil.20210309; h=Sender:
+	Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post:
+	List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc
+	:To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:
+	Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:
+	List-Owner; bh=8o7lZT3r9rAaTm8HKh4V0xpz9VW91LuZAYfrXGv0Xic=; b=bS+249v3+UY+qs
+	bxuupjLqBetRQqMAaPjTn6GKQJtca75PMdLf3okoQban7PNqWO9WOgCJWgY2eyzOSjxHBPr1dsGzy
+	6c3CZBbMy8pXl/zf80YRmikPFXehOzAvOpZjco4QUCCqXNsJM9FKzAqYIaZDSlLOTmADDepsh481G
+	k/h/g39ztzn09LVqwF2Bh0DopIbHiq/BepTeU8jFt5GTj3EGPTdCU7Vq7mf2pP6P6oPk6vswKVYaQ
+	opq96BDGIEpeKViuMWt07vdJX2meQBHhY/Rte/aAO5pdLpusY2OPvEKv0/49swpAEsNYIYFcgtCtm
+	vaKUqN85QlQznqd/NaHw==;
+Received: from localhost ([::1] helo=bombadil.infradead.org)
+	by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux))
+	id 1nkMD3-00AFVb-Co; Fri, 29 Apr 2022 08:42:42 +0000
+Received: from mail-ed1-x534.google.com ([2a00:1450:4864:20::534])
+ by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux))
+ id 1nkMCy-00AFSn-Rp; Fri, 29 Apr 2022 08:42:38 +0000
+Received: by mail-ed1-x534.google.com with SMTP id be20so8231068edb.12;
+ Fri, 29 Apr 2022 01:42:33 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112;
+ h=from:to:cc:subject:date:message-id:mime-version
+ :content-transfer-encoding;
+ bh=XJkVawFXvwQH7kz0CHPfmxuFkQ6+ipcLhCSvCaul0jQ=;
+ b=HSFxl4yM5hEns1ZYq8D5pL88/nYNfulhELpJyhaF8XIrymlck2o40/lATRsLIEWMyb
+ 8MiL8d5eAOEMSb7rUrqWodLDPZld7ZzCvoVt6XQeVmJLkAw0teNdQXvlCZgu/3Q6MwUw
+ Wx+QkzqUjCODOLk224RVZGvnKY9YRu/WmZEnWqBjzQIF90DLNXyni+yS7XbUn8CnPbdM
+ M3s/Ty7YsgPGsibKem1EI6yma15sXRNi1Vz1o0ArcPpsB/6x/ym8sCQemxSvrmer5ps9
+ wrBnmlH558mrlj7rSHK9l5SmsGlkJiXB3DTLSrnynxHTY9gX9lSBsQxxjiqu1sEMvDVY
+ toUA==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+ d=1e100.net; s=20210112;
+ h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version
+ :content-transfer-encoding;
+ bh=XJkVawFXvwQH7kz0CHPfmxuFkQ6+ipcLhCSvCaul0jQ=;
+ b=LtdsZ9M/Im1hyxdJYYHttN4wtxcqRThm/H/oV8driFRB4KuwxO2iP2OqycVsS1sN2y
+ quWFM6L8v0KaUZRUR85rRRr8JX9P84kqTu4szOEuSIQQ/aUDUbJxVi7rICLPZ890DqTY
+ APplzuMhuNr6unYQO5Lxrj5IHHtrsmKP8ttR7VVWPNHpJseXc1kQ+HDLgylQLHVsb/5U
+ 8KpUG0LvxhvqsNU6HbTwLD/Q/88ELP5MfoWHUocYXKPrBJ8K6rCHsmjH6z6tFLfXgce7
+ 619waAHXFhCBCflRbAC+D9VemoNe5wJlu9mzyQ4Xavbo8NZgDobVFWOTEQ1iRdua/oRT
+ tbxw==
+X-Gm-Message-State: AOAM532GrwQ/whp0buK64HysYJy6aLBD/xGE/8Dr7NSW150Jds7jTjor
+ eVhdzOGjuWywij/s3mwA9XfPjST+Cg==
+X-Google-Smtp-Source: 
+ ABdhPJxU9goI5zXE0GQP90hO7TH0IDw++6UHpkGFSUH/chvzvE0L/pQF0XqDkdwzbbTmxsOBUMGcZg==
+X-Received: by 2002:a05:6402:84c:b0:423:e5a2:3655 with SMTP id
+ b12-20020a056402084c00b00423e5a23655mr40374113edz.28.1651221752304;
+ Fri, 29 Apr 2022 01:42:32 -0700 (PDT)
+Received: from crystalwell.adg.lan (a109-49-0-175.cpe.netcabo.pt.
+ [109.49.0.175]) by smtp.gmail.com with ESMTPSA id
+ el10-20020a170907284a00b006f3ef214e32sm429064ejc.152.2022.04.29.01.42.31
+ (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+ Fri, 29 Apr 2022 01:42:31 -0700 (PDT)
+From: Rui Salvaterra <rsalvaterra@gmail.com>
+To: linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org,
+ linux-kernel@vger.kernel.org
+Cc: matthias.bgg@gmail.com, ryder.lee@mediatek.com, daniel@makrotopia.org,
+ Rui Salvaterra <rsalvaterra@gmail.com>
+Subject: [PATCH] arm64: dts: mt7622: specify the number of DMA requests
+Date: Fri, 29 Apr 2022 09:42:25 +0100
+Message-Id: <20220429084225.298213-1-rsalvaterra@gmail.com>
+X-Mailer: git-send-email 2.36.0
+MIME-Version: 1.0
+X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 
+X-CRM114-CacheID: sfid-20220429_014236_944696_097D1E73 
+X-CRM114-Status: UNSURE (   8.85  )
+X-CRM114-Notice: Please train this message.
+X-BeenThere: linux-arm-kernel@lists.infradead.org
+X-Mailman-Version: 2.1.34
+Precedence: list
+List-Id: <linux-arm-kernel.lists.infradead.org>
+List-Unsubscribe: 
+ <http://lists.infradead.org/mailman/options/linux-arm-kernel>,
+ <mailto:linux-arm-kernel-request@lists.infradead.org?subject=unsubscribe>
+List-Archive: <http://lists.infradead.org/pipermail/linux-arm-kernel/>
+List-Post: <mailto:linux-arm-kernel@lists.infradead.org>
+List-Help: <mailto:linux-arm-kernel-request@lists.infradead.org?subject=help>
+List-Subscribe: 
+ <http://lists.infradead.org/mailman/listinfo/linux-arm-kernel>,
+ <mailto:linux-arm-kernel-request@lists.infradead.org?subject=subscribe>
+Sender: "linux-arm-kernel" <linux-arm-kernel-bounces@lists.infradead.org>
+Errors-To: 
+ linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org
+
+The MT7622 device tree never bothered to specify the number of virtual DMA
+channels for the HSDMA controller, always falling back to the default value of
+3. Make this value explicit, in order to avoid the following dmesg notification:
+
+mtk_hsdma 1b007000.dma-controller: Using 3 as missing dma-requests property
+
+Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
+---
+ arch/arm64/boot/dts/mediatek/mt7622.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+@@ -942,6 +942,7 @@
+ 		clock-names = "hsdma";
+ 		power-domains = <&scpsys MT7622_POWER_DOMAIN_ETHSYS>;
+ 		#dma-cells = <1>;
++		dma-requests = <3>;
+ 	};
+ 
+ 	pcie_mirror: pcie-mirror@10000400 {
diff --git a/target/linux/mediatek/patches-5.15/193-dts-mt7623-thermal_zone_fix.patch b/target/linux/mediatek/patches-5.15/193-dts-mt7623-thermal_zone_fix.patch
new file mode 100644
index 00000000000000..1cfb53d6208918
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/193-dts-mt7623-thermal_zone_fix.patch
@@ -0,0 +1,48 @@
+From 824d56e753a588fcfd650db1822e34a02a48bb77 Mon Sep 17 00:00:00 2001
+From: Bruno Umuarama <anonimou_eu@hotmail.com>
+Date: Thu, 13 Oct 2022 21:18:21 +0000
+Subject: [PATCH] mediatek: mt7623: fix thermal zone
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Raising the temperatures for passive and active trips. @VA1DER
+proposed at issue 9396 to remove passive trip. This commit relates to
+his suggestion.
+
+Without this patch. the CPU will be throttled all the way down to 98MHz
+if the temperature rises even a degree above the trip point, and it was
+further discovered that if the internal temperature of the device is
+above the first trip point temperature when it boots then it will start
+in a throttled state and even
+$ echo disabled > /sys/class/thermal/thermal_zone0/mode
+will have no effect.
+
+The patch increases the passive trip point and active cooling map. The
+throttling temperature will then be at 77°C and 82°C, which is still a
+low enough temperature for ARM devices to not be in the real danger
+zone, and gives some operational headroom.
+
+Signed-off-by: Bruno Umuarama <anonimou_eu@hotmail.com>
+---
+ arch/arm/boot/dts/mt7623.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/mt7623.dtsi
++++ b/arch/arm/boot/dts/mt7623.dtsi
+@@ -160,13 +160,13 @@
+ 
+ 				trips {
+ 					cpu_passive: cpu-passive {
+-						temperature = <57000>;
++						temperature = <77000>;
+ 						hysteresis = <2000>;
+ 						type = "passive";
+ 					};
+ 
+ 					cpu_active: cpu-active {
+-						temperature = <67000>;
++						temperature = <82000>;
+ 						hysteresis = <2000>;
+ 						type = "active";
+ 					};
diff --git a/target/linux/mediatek/patches-5.15/194-dts-mt7968a-add-ramoops.patch b/target/linux/mediatek/patches-5.15/194-dts-mt7968a-add-ramoops.patch
new file mode 100644
index 00000000000000..161c1e75168cff
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/194-dts-mt7968a-add-ramoops.patch
@@ -0,0 +1,17 @@
+--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+@@ -68,6 +68,14 @@
+ 		#address-cells = <2>;
+ 		#size-cells = <2>;
+ 		ranges;
++
++		/* 64 KiB reserved for ramoops/pstore */
++		ramoops@42ff0000 {
++			compatible = "ramoops";
++			reg = <0 0x42ff0000 0 0x10000>;
++			record-size = <0x1000>;
++		};
++
+ 		/* 192 KiB reserved for ARM Trusted Firmware (BL31) */
+ 		secmon_reserved: secmon@43000000 {
+ 			reg = <0 0x43000000 0 0x30000>;
diff --git a/target/linux/mediatek/patches-5.15/195-dts-mt7986a-bpi-r3-leds-port-names-and-wifi-eeprom.patch b/target/linux/mediatek/patches-5.15/195-dts-mt7986a-bpi-r3-leds-port-names-and-wifi-eeprom.patch
new file mode 100644
index 00000000000000..7126da788beaba
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/195-dts-mt7986a-bpi-r3-leds-port-names-and-wifi-eeprom.patch
@@ -0,0 +1,196 @@
+--- a/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts
+@@ -23,6 +23,10 @@
+ 		serial0 = &uart0;
+ 		ethernet0 = &gmac0;
+ 		ethernet1 = &gmac1;
++		led-boot = &green_led;
++		led-failsafe = &green_led;
++		led-running = &green_led;
++		led-upgrade = &blue_led;
+ 	};
+ 
+ 	chosen {
+@@ -417,27 +421,27 @@
+ 
+ 		port@1 {
+ 			reg = <1>;
+-			label = "lan0";
++			label = "lan1";
+ 		};
+ 
+ 		port@2 {
+ 			reg = <2>;
+-			label = "lan1";
++			label = "lan2";
+ 		};
+ 
+ 		port@3 {
+ 			reg = <3>;
+-			label = "lan2";
++			label = "lan3";
+ 		};
+ 
+ 		port@4 {
+ 			reg = <4>;
+-			label = "lan3";
++			label = "lan4";
+ 		};
+ 
+ 		port5: port@5 {
+ 			reg = <5>;
+-			label = "lan4";
++			label = "sfp2";
+ 			phy-mode = "2500base-x";
+ 			sfp = <&sfp2>;
+ 			managed = "in-band-status";
+@@ -488,9 +492,137 @@
+ 
+ &wifi {
+ 	status = "okay";
+-	pinctrl-names = "default", "dbdc";
++	pinctrl-names = "default";
+ 	pinctrl-0 = <&wf_2g_5g_pins>, <&wf_led_pins>;
+-	pinctrl-1 = <&wf_dbdc_pins>, <&wf_led_pins>;
++
++	mediatek,eeprom-data = <0x86790900 0x000c4326 0x60000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x01000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000800 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x24649090 0x00280000 0x05100000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00021e00 0x021e0002 0x1e00021e 0x00022800 0x02280002 0x28000228 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00008080 0x8080fdf7
++				0x0903150d 0x80808080 0x80808080 0x05050d0d 0x1313c6c6 0xc3c3c200 0x00c200c2 0x00008182
++				0x8585c2c2 0x82828282 0x858500c2 0xc2000081 0x82858587 0x87c2c200 0x81818285 0x858787c2
++				0xc2000081 0x82858587 0x87c2c200 0x00818285 0x858787c2 0xc2000081 0x82858587 0x87c4c4c2
++				0xc100c300 0xc3c3c100 0x818383c3 0xc3c3c100 0x81838300 0xc2c2c2c0 0x81828484 0x000000c3
++				0xc3c3c100 0x81838386 0x86c3c3c3 0xc1008183 0x838686c2 0xc2c2c081 0x82848486 0x86c3c3c3
++				0xc1008183 0x838686c3 0xc3c3c100 0x81838386 0x86c3c3c3 0xc1008183 0x83868622 0x28002228
++				0x00222800 0x22280000 0xdddddddd 0xdddddddd 0xddbbbbbb 0xccccccdd 0xdddddddd 0xdddddddd
++				0xeeeeeecc 0xccccdddd 0xdddddddd 0x004a5662 0x0000004a 0x56620000 0x004a5662 0x0000004a
++				0x56620000 0x88888888 0x33333326 0x26262626 0x26262600 0x33333326 0x26262626 0x26262600
++				0x33333326 0x26262626 0x26262600 0x33333326 0x26262626 0x26262600 0x00000000 0xf0f0cc00
++				0x00000000 0x0000aaaa 0xaabbbbbb 0xcccccccc 0xccccbbbb 0xbbbbbbbb 0xbbbbbbaa 0xaaaabbbb
++				0xbbaaaaaa 0x999999aa 0xaaaabbbb 0xbbcccccc 0x00000000 0x0000aaaa 0xaa000000 0xbbbbbbbb
++				0xbbbbaaaa 0xaa999999 0xaaaaaaaa 0xaaaaaaaa 0xaaaaaaaa 0xaaaaaaaa 0xaaaabbbb 0xbbbbbbbb
++				0x00000000 0x00000000 0x00000000 0x99999999 0x9999aaaa 0xaaaaaaaa 0x999999aa 0xaaaaaaaa
++				0xaaaaaaaa 0xaaaaaaaa 0xaaaabbbb 0xbbbbbbbb 0x00000000 0x0000eeee 0xeeffffff 0xcccccccc
++				0xccccdddd 0xddbbbbbb 0xccccccbb 0xbbbbbbbb 0xbbbbbbbb 0xbbbbbbbb 0xbbbbcccc 0xccdddddd
++				0x00516200 0x686e0051 0x6200686e 0x00516200 0x686e0051 0x6200686e 0x00516200 0x686e0051
++				0x6200686e 0x00516200 0x686e0051 0x6200686e 0x00516200 0x686e0051 0x6200686e 0x00516200
++				0x686e0051 0x6200686e 0x00516200 0x686e0051 0x6200686e 0x00516200 0x686e0051 0x6200686e
++				0x00516200 0x686e0051 0x6200686e 0x00516200 0x686e0051 0x6200686e 0x00516200 0x686e0051
++				0x6200686e 0x00516200 0x686e0051 0x6200686e 0x00516200 0x686e0051 0x6200686e 0x00516200
++				0x686e0051 0x6200686e 0x00516200 0x686e0051 0x6200686e 0x00516200 0x686e0051 0x6200686e
++				0x88888888 0x88888888 0x88888888 0x88888888 0x88888888 0x88888888 0x88888888 0x88888888
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000001 0x06000100 0x01050002 0x00ff0300
++				0xf900fe03 0x00000000 0x00000000 0x0000009b 0x6e370000 0x00000000 0x00fc0009 0x0a00fe00
++				0x060700fe 0x00070800 0x05000b0a 0x00000000 0x00000000 0x000000e2 0x96460000 0x00000000
++				0x000400f7 0xf8000300 0xfcfe0003 0x00fbfc00 0xee00e3f2 0x00000000 0x00000000 0x00000011
++				0xbb550000 0x00000000 0x000600f6 0xfc000300 0xfbfe0004 0x00fafe00 0xf600ecf2 0x00000000
++				0x00000000 0x0000001f 0xbf580000 0x00000000 0x000600f5 0xf6000400 0xf8f90004 0x00f7f800
++				0xf700f0f4 0x00000000 0x00000000 0x00000024 0xbe570000 0x00000000 0x000800f8 0xfe000600
++				0xf8fd0007 0x00f9fe00 0xf500f0f4 0x00000000 0x00000000 0x0000002d 0xd6610000 0x00000000
++				0x000400f7 0xfc000500 0xf7fc0005 0x00f7fc00 0xf900f5f8 0x00000000 0x00000000 0x00000026
++				0xd96e0000 0x00000000 0x000400f7 0xf9000600 0xf5f70005 0x00f5f800 0xf900f4f7 0x00000000
++				0x00000000 0x0000001b 0xce690000 0x00000000 0x000300f8 0xf8000600 0xf6f60004 0x00f6f700
++				0xf900f4f7 0x00000000 0x00000000 0x00000018 0xd8720000 0x00000000 0x00000000 0x02404002
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0xc1c2c1c2 0x41c341c3 0x3fc13fc1 0x40c13fc2 0x3fc240c1 0x41c040c0 0x3fc23fc2 0x40c13fc2
++				0x3fc140c0 0x41c040c0 0x3fc33fc3 0x40c23fc2 0x3fc240c1 0x41c040c0 0x3fc23fc2 0x40c23fc2
++				0x3fc140c1 0x41c040c0 0x00000000 0x00000000 0x41c741c7 0xc1c7c1c7 0x00000000 0x00000000
++				0x3fc03fc0 0x3fc03fc0 0x3fc03fc0 0x3fc03fc0 0x3fc03fc0 0x3fc03fc0 0x3fc03fc0 0x3fc03fc0
++				0x3fc03fc0 0x3fc03fc0 0x3fc03fc0 0x3fc03fc0 0x3fc03fc0 0x3fc03fc0 0x3fc03fc0 0x3fc03fc0
++				0x00a0ce00 0x00000000 0xb6840000 0x00000000 0x00000000 0x00000000 0x18181818 0x18181818
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x004b5763 0x0000004b 0x57630000 0x004b5763 0x0000004b 0x57630000 0x88888888 0x08474759
++				0x69780849 0x49596d7a 0x0849495a 0x6d790848 0x48596c78 0x08484858 0x6a780848 0x48586a78
++				0x08484858 0x6c78084a 0x4a5b6d79 0x08474759 0x697a0848 0x48596b79 0x08484859 0x6c7a0848
++				0x48586c79 0x08484857 0x68770848 0x48576877 0x08484857 0x6a77084a 0x4a5a6a77 0x08464659
++				0x69790848 0x48586b79 0x08484858 0x6c7a0848 0x48596c79 0x08484857 0x68770848 0x48576877
++				0x08494958 0x6d7a084b 0x4b5c6c77 0x0847475a 0x6a7b0849 0x495a6e7c 0x0849495a 0x6e7c0849
++				0x495b6e7c 0x08494959 0x6a7a0849 0x49596a7a 0x084a4a5a 0x6f7d084b 0x4b5c6e7b 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x85848484
++				0xc3c4c4c5 0xc4c3c33f 0xc3c3c2c2 0xc2c2c03f 0xc3c3c3c4 0xc4c4c33f 0xc2c2c2c2 0xc1c3c1c1
++				0xc0c08282 0x83848686 0x88880000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00001111 0x00000000
++				0x8080f703 0x10808080 0x80050d13 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x000000a4 0xce000000 0x0000b684 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
++				0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000>;
+ 
+ 	led {
+ 		led-active-low;
+--- a/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3-nor.dtso
++++ b/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3-nor.dtso
+@@ -55,6 +55,7 @@
+ 					partition@c00000 {
+ 						label = "fit";
+ 						reg = <0xc00000 0x1400000>;
++						compatible = "denx,fit";
+ 					};
+ 				};
+ 			};
diff --git a/target/linux/mediatek/patches-5.15/200-phy-phy-mtk-tphy-Add-hifsys-support.patch b/target/linux/mediatek/patches-5.15/200-phy-phy-mtk-tphy-Add-hifsys-support.patch
index 860728f02dc748..cfb0556d1efd9c 100644
--- a/target/linux/mediatek/patches-5.15/200-phy-phy-mtk-tphy-Add-hifsys-support.patch
+++ b/target/linux/mediatek/patches-5.15/200-phy-phy-mtk-tphy-Add-hifsys-support.patch
@@ -47,7 +47,7 @@ Subject: [PATCH] phy: phy-mtk-tphy: Add hifsys-support
  	tmp = readl(u3_banks->phya + U3P_U3_PHYA_DA_REG0);
  	tmp &= ~(P3A_RG_XTAL_EXT_PE1H | P3A_RG_XTAL_EXT_PE2H);
  	tmp |= P3A_RG_XTAL_EXT_PE1H_VAL(0x2) | P3A_RG_XTAL_EXT_PE2H_VAL(0x2);
-@@ -1436,6 +1446,16 @@ static int mtk_tphy_probe(struct platfor
+@@ -1437,6 +1447,16 @@ static int mtk_tphy_probe(struct platfor
  					 &tphy->src_coef);
  	}
  
diff --git a/target/linux/mediatek/patches-5.15/210-v6.1-pinctrl-mediatek-add-support-for-MT7986-SoC.patch b/target/linux/mediatek/patches-5.15/210-v6.1-pinctrl-mediatek-add-support-for-MT7986-SoC.patch
new file mode 100644
index 00000000000000..0761e1da18080c
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/210-v6.1-pinctrl-mediatek-add-support-for-MT7986-SoC.patch
@@ -0,0 +1,26 @@
+--- a/drivers/pinctrl/mediatek/Kconfig
++++ b/drivers/pinctrl/mediatek/Kconfig
+@@ -120,6 +120,13 @@ config PINCTRL_MT7622
+ 	default ARM64 && ARCH_MEDIATEK
+ 	select PINCTRL_MTK_MOORE
+ 
++config PINCTRL_MT7986
++	bool "Mediatek MT7986 pin control"
++	depends on OF
++	depends on ARM64 || COMPILE_TEST
++	default ARM64 && ARCH_MEDIATEK
++	select PINCTRL_MTK_MOORE
++
+ config PINCTRL_MT8167
+ 	bool "Mediatek MT8167 pin control"
+ 	depends on OF
+--- a/drivers/pinctrl/mediatek/Makefile
++++ b/drivers/pinctrl/mediatek/Makefile
+@@ -17,6 +17,7 @@ obj-$(CONFIG_PINCTRL_MT6797)	+= pinctrl-
+ obj-$(CONFIG_PINCTRL_MT7622)	+= pinctrl-mt7622.o
+ obj-$(CONFIG_PINCTRL_MT7623)	+= pinctrl-mt7623.o
+ obj-$(CONFIG_PINCTRL_MT7629)	+= pinctrl-mt7629.o
++obj-$(CONFIG_PINCTRL_MT7986)	+= pinctrl-mt7986.o
+ obj-$(CONFIG_PINCTRL_MT8167)	+= pinctrl-mt8167.o
+ obj-$(CONFIG_PINCTRL_MT8173)	+= pinctrl-mt8173.o
+ obj-$(CONFIG_PINCTRL_MT8183)	+= pinctrl-mt8183.o
diff --git a/target/linux/mediatek/patches-5.15/211-v5.16-clk-mediatek-Add-API-for-clock-resource-recycle.patch b/target/linux/mediatek/patches-5.15/211-v5.16-clk-mediatek-Add-API-for-clock-resource-recycle.patch
new file mode 100644
index 00000000000000..15de8aa3d49ca6
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/211-v5.16-clk-mediatek-Add-API-for-clock-resource-recycle.patch
@@ -0,0 +1,28 @@
+--- a/drivers/clk/mediatek/clk-mtk.c
++++ b/drivers/clk/mediatek/clk-mtk.c
+@@ -43,6 +43,15 @@ err_out:
+ 	return NULL;
+ }
+ 
++void mtk_free_clk_data(struct clk_onecell_data *clk_data)
++{
++	if (!clk_data)
++		return;
++
++	kfree(clk_data->clks);
++	kfree(clk_data);
++}
++
+ void mtk_clk_register_fixed_clks(const struct mtk_fixed_clk *clks,
+ 		int num, struct clk_onecell_data *clk_data)
+ {
+--- a/drivers/clk/mediatek/clk-mtk.h
++++ b/drivers/clk/mediatek/clk-mtk.h
+@@ -202,6 +202,7 @@ void mtk_clk_register_dividers(const str
+ 				struct clk_onecell_data *clk_data);
+ 
+ struct clk_onecell_data *mtk_alloc_clk_data(unsigned int clk_num);
++void mtk_free_clk_data(struct clk_onecell_data *clk_data);
+ 
+ #define HAVE_RST_BAR	BIT(0)
+ #define PLL_AO		BIT(1)
diff --git a/target/linux/mediatek/patches-5.15/212-v5.17-clk-mediatek-add-mt7986-clock-support.patch b/target/linux/mediatek/patches-5.15/212-v5.17-clk-mediatek-add-mt7986-clock-support.patch
new file mode 100644
index 00000000000000..8e2365a498e8b8
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/212-v5.17-clk-mediatek-add-mt7986-clock-support.patch
@@ -0,0 +1,39 @@
+--- a/drivers/clk/mediatek/Kconfig
++++ b/drivers/clk/mediatek/Kconfig
+@@ -344,6 +344,23 @@ config COMMON_CLK_MT7629_HIFSYS
+ 	  This driver supports MediaTek MT7629 HIFSYS clocks providing
+ 	  to PCI-E and USB.
+ 
++config COMMON_CLK_MT7986
++	bool "Clock driver for MediaTek MT7986"
++	depends on ARCH_MEDIATEK || COMPILE_TEST
++	select COMMON_CLK_MEDIATEK
++	default ARCH_MEDIATEK
++	help
++	  This driver supports MediaTek MT7986 basic clocks and clocks
++	  required for various periperals found on MediaTek.
++
++config COMMON_CLK_MT7986_ETHSYS
++	bool "Clock driver for MediaTek MT7986 ETHSYS"
++	depends on COMMON_CLK_MT7986
++	default COMMON_CLK_MT7986
++	help
++	  This driver add support for clocks for Ethernet and SGMII
++	  required on MediaTek MT7986 SoC.
++
+ config COMMON_CLK_MT8135
+ 	bool "Clock driver for MediaTek MT8135"
+ 	depends on (ARCH_MEDIATEK && ARM) || COMPILE_TEST
+--- a/drivers/clk/mediatek/Makefile
++++ b/drivers/clk/mediatek/Makefile
+@@ -46,6 +46,10 @@ obj-$(CONFIG_COMMON_CLK_MT7622_AUDSYS) +
+ obj-$(CONFIG_COMMON_CLK_MT7629) += clk-mt7629.o
+ obj-$(CONFIG_COMMON_CLK_MT7629_ETHSYS) += clk-mt7629-eth.o
+ obj-$(CONFIG_COMMON_CLK_MT7629_HIFSYS) += clk-mt7629-hif.o
++obj-$(CONFIG_COMMON_CLK_MT7986) += clk-mt7986-apmixed.o
++obj-$(CONFIG_COMMON_CLK_MT7986) += clk-mt7986-topckgen.o
++obj-$(CONFIG_COMMON_CLK_MT7986) += clk-mt7986-infracfg.o
++obj-$(CONFIG_COMMON_CLK_MT7986_ETHSYS) += clk-mt7986-eth.o
+ obj-$(CONFIG_COMMON_CLK_MT8135) += clk-mt8135.o
+ obj-$(CONFIG_COMMON_CLK_MT8167) += clk-mt8167.o
+ obj-$(CONFIG_COMMON_CLK_MT8167_AUDSYS) += clk-mt8167-aud.o
diff --git a/target/linux/mediatek/patches-5.15/213-spi-mediatek-add-mt7986-spi-support.patch b/target/linux/mediatek/patches-5.15/213-spi-mediatek-add-mt7986-spi-support.patch
index f10d57a785364b..04da1765f37873 100644
--- a/target/linux/mediatek/patches-5.15/213-spi-mediatek-add-mt7986-spi-support.patch
+++ b/target/linux/mediatek/patches-5.15/213-spi-mediatek-add-mt7986-spi-support.patch
@@ -816,7 +816,7 @@ Signed-off-by: Sam Shih <sam.shih@mediatek.com>
  err_put_master:
  	spi_master_put(master);
  
-@@ -917,8 +1296,10 @@ static int mtk_spi_remove(struct platfor
+@@ -920,8 +1299,10 @@ static int mtk_spi_remove(struct platfor
  
  	mtk_spi_reset(mdata);
  
@@ -826,9 +826,9 @@ Signed-off-by: Sam Shih <sam.shih@mediatek.com>
 +		clk_unprepare(mdata->spi_hclk);
 +	}
  
- 	return 0;
- }
-@@ -934,8 +1315,10 @@ static int mtk_spi_suspend(struct device
+ 	pm_runtime_put_noidle(&pdev->dev);
+ 	pm_runtime_disable(&pdev->dev);
+@@ -940,8 +1321,10 @@ static int mtk_spi_suspend(struct device
  	if (ret)
  		return ret;
  
@@ -840,7 +840,7 @@ Signed-off-by: Sam Shih <sam.shih@mediatek.com>
  
  	return ret;
  }
-@@ -952,11 +1335,20 @@ static int mtk_spi_resume(struct device
+@@ -958,11 +1341,20 @@ static int mtk_spi_resume(struct device
  			dev_err(dev, "failed to enable spi_clk (%d)\n", ret);
  			return ret;
  		}
@@ -862,7 +862,7 @@ Signed-off-by: Sam Shih <sam.shih@mediatek.com>
  
  	return ret;
  }
-@@ -968,10 +1360,13 @@ static int mtk_spi_runtime_suspend(struc
+@@ -974,10 +1366,13 @@ static int mtk_spi_runtime_suspend(struc
  	struct spi_master *master = dev_get_drvdata(dev);
  	struct mtk_spi *mdata = spi_master_get_devdata(master);
  
@@ -878,7 +878,7 @@ Signed-off-by: Sam Shih <sam.shih@mediatek.com>
  
  	return 0;
  }
-@@ -982,13 +1377,31 @@ static int mtk_spi_runtime_resume(struct
+@@ -988,13 +1383,31 @@ static int mtk_spi_runtime_resume(struct
  	struct mtk_spi *mdata = spi_master_get_devdata(master);
  	int ret;
  
diff --git a/target/linux/mediatek/patches-5.15/214-v6.3-clk-mediatek-add-mt7981-clock-support.patch b/target/linux/mediatek/patches-5.15/214-v6.3-clk-mediatek-add-mt7981-clock-support.patch
new file mode 100644
index 00000000000000..631eb04092dfc0
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/214-v6.3-clk-mediatek-add-mt7981-clock-support.patch
@@ -0,0 +1,39 @@
+--- a/drivers/clk/mediatek/Kconfig
++++ b/drivers/clk/mediatek/Kconfig
+@@ -344,6 +344,23 @@ config COMMON_CLK_MT7629_HIFSYS
+ 	  This driver supports MediaTek MT7629 HIFSYS clocks providing
+ 	  to PCI-E and USB.
+ 
++config COMMON_CLK_MT7981
++	bool "Clock driver for MediaTek MT7981"
++	depends on ARCH_MEDIATEK || COMPILE_TEST
++	select COMMON_CLK_MEDIATEK
++	default ARCH_MEDIATEK
++	help
++	  This driver supports MediaTek MT7981 basic clocks and clocks
++	  required for various periperals found on MediaTek.
++
++config COMMON_CLK_MT7981_ETHSYS
++	bool "Clock driver for MediaTek MT7981 ETHSYS"
++	depends on COMMON_CLK_MT7981
++	default COMMON_CLK_MT7981
++	help
++	  This driver add support for clocks for Ethernet and SGMII
++	  required on MediaTek MT7981 SoC.
++
+ config COMMON_CLK_MT7986
+ 	bool "Clock driver for MediaTek MT7986"
+ 	depends on ARCH_MEDIATEK || COMPILE_TEST
+--- a/drivers/clk/mediatek/Makefile
++++ b/drivers/clk/mediatek/Makefile
+@@ -46,6 +46,10 @@ obj-$(CONFIG_COMMON_CLK_MT7622_AUDSYS) +
+ obj-$(CONFIG_COMMON_CLK_MT7629) += clk-mt7629.o
+ obj-$(CONFIG_COMMON_CLK_MT7629_ETHSYS) += clk-mt7629-eth.o
+ obj-$(CONFIG_COMMON_CLK_MT7629_HIFSYS) += clk-mt7629-hif.o
++obj-$(CONFIG_COMMON_CLK_MT7981) += clk-mt7981-apmixed.o
++obj-$(CONFIG_COMMON_CLK_MT7981) += clk-mt7981-topckgen.o
++obj-$(CONFIG_COMMON_CLK_MT7981) += clk-mt7981-infracfg.o
++obj-$(CONFIG_COMMON_CLK_MT7981_ETHSYS) += clk-mt7981-eth.o
+ obj-$(CONFIG_COMMON_CLK_MT7986) += clk-mt7986-apmixed.o
+ obj-$(CONFIG_COMMON_CLK_MT7986) += clk-mt7986-topckgen.o
+ obj-$(CONFIG_COMMON_CLK_MT7986) += clk-mt7986-infracfg.o
diff --git a/target/linux/mediatek/patches-5.15/215-v6.3-pinctrl-mediatek-add-support-for-MT7981-SoC.patch b/target/linux/mediatek/patches-5.15/215-v6.3-pinctrl-mediatek-add-support-for-MT7981-SoC.patch
new file mode 100644
index 00000000000000..ae99685df4c70f
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/215-v6.3-pinctrl-mediatek-add-support-for-MT7981-SoC.patch
@@ -0,0 +1,26 @@
+--- a/drivers/pinctrl/mediatek/Kconfig
++++ b/drivers/pinctrl/mediatek/Kconfig
+@@ -120,6 +120,13 @@ config PINCTRL_MT7622
+ 	default ARM64 && ARCH_MEDIATEK
+ 	select PINCTRL_MTK_MOORE
+ 
++config PINCTRL_MT7981
++	bool "Mediatek MT7981 pin control"
++	depends on OF
++	depends on ARM64 || COMPILE_TEST
++	default ARM64 && ARCH_MEDIATEK
++	select PINCTRL_MTK_MOORE
++
+ config PINCTRL_MT7986
+ 	bool "Mediatek MT7986 pin control"
+ 	depends on OF
+--- a/drivers/pinctrl/mediatek/Makefile
++++ b/drivers/pinctrl/mediatek/Makefile
+@@ -17,6 +17,7 @@ obj-$(CONFIG_PINCTRL_MT6797)	+= pinctrl-
+ obj-$(CONFIG_PINCTRL_MT7622)	+= pinctrl-mt7622.o
+ obj-$(CONFIG_PINCTRL_MT7623)	+= pinctrl-mt7623.o
+ obj-$(CONFIG_PINCTRL_MT7629)	+= pinctrl-mt7629.o
++obj-$(CONFIG_PINCTRL_MT7986)	+= pinctrl-mt7981.o
+ obj-$(CONFIG_PINCTRL_MT7986)	+= pinctrl-mt7986.o
+ obj-$(CONFIG_PINCTRL_MT8167)	+= pinctrl-mt8167.o
+ obj-$(CONFIG_PINCTRL_MT8173)	+= pinctrl-mt8173.o
diff --git a/target/linux/mediatek/patches-5.15/240-pinctrl-mediatek-add-support-for-MT7988-SoC.patch b/target/linux/mediatek/patches-5.15/240-pinctrl-mediatek-add-support-for-MT7988-SoC.patch
new file mode 100644
index 00000000000000..cbee45bc1f89d2
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/240-pinctrl-mediatek-add-support-for-MT7988-SoC.patch
@@ -0,0 +1,26 @@
+--- a/drivers/pinctrl/mediatek/Kconfig
++++ b/drivers/pinctrl/mediatek/Kconfig
+@@ -134,6 +134,13 @@ config PINCTRL_MT7986
+ 	default ARM64 && ARCH_MEDIATEK
+ 	select PINCTRL_MTK_MOORE
+ 
++config PINCTRL_MT7988
++	bool "Mediatek MT7988 pin control"
++	depends on OF
++	depends on ARM64 || COMPILE_TEST
++	default ARCH_MEDIATEK
++	select PINCTRL_MTK_MOORE
++
+ config PINCTRL_MT8167
+ 	bool "Mediatek MT8167 pin control"
+ 	depends on OF
+--- a/drivers/pinctrl/mediatek/Makefile
++++ b/drivers/pinctrl/mediatek/Makefile
+@@ -19,6 +19,7 @@ obj-$(CONFIG_PINCTRL_MT7623)	+= pinctrl-
+ obj-$(CONFIG_PINCTRL_MT7629)	+= pinctrl-mt7629.o
+ obj-$(CONFIG_PINCTRL_MT7986)	+= pinctrl-mt7981.o
+ obj-$(CONFIG_PINCTRL_MT7986)	+= pinctrl-mt7986.o
++obj-$(CONFIG_PINCTRL_MT7988)	+= pinctrl-mt7988.o
+ obj-$(CONFIG_PINCTRL_MT8167)	+= pinctrl-mt8167.o
+ obj-$(CONFIG_PINCTRL_MT8173)	+= pinctrl-mt8173.o
+ obj-$(CONFIG_PINCTRL_MT8183)	+= pinctrl-mt8183.o
diff --git a/target/linux/mediatek/patches-5.15/241-clk-mediatek-Add-pcw-chg-shift-control.patch b/target/linux/mediatek/patches-5.15/241-clk-mediatek-Add-pcw-chg-shift-control.patch
new file mode 100644
index 00000000000000..23a5b7c911a5da
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/241-clk-mediatek-Add-pcw-chg-shift-control.patch
@@ -0,0 +1,24 @@
+--- a/drivers/clk/mediatek/clk-mtk.h
++++ b/drivers/clk/mediatek/clk-mtk.h
+@@ -233,6 +233,7 @@ struct mtk_pll_data {
+ 	u32 pcw_reg;
+ 	int pcw_shift;
+ 	u32 pcw_chg_reg;
++	int pcw_chg_shift;
+ 	const struct mtk_pll_div_table *div_table;
+ 	const char *parent_name;
+ 	u32 en_reg;
+--- a/drivers/clk/mediatek/clk-pll.c
++++ b/drivers/clk/mediatek/clk-pll.c
+@@ -137,7 +137,10 @@ static void mtk_pll_set_rate_regs(struct
+ 			pll->data->pcw_shift);
+ 	val |= pcw << pll->data->pcw_shift;
+ 	writel(val, pll->pcw_addr);
+-	chg = readl(pll->pcw_chg_addr) | PCW_CHG_MASK;
++	if (pll->data->pcw_chg_shift)
++		chg = readl(pll->pcw_chg_addr) | BIT(pll->data->pcw_chg_shift);
++	else
++		chg = readl(pll->pcw_chg_addr) | PCW_CHG_MASK;
+ 	writel(chg, pll->pcw_chg_addr);
+ 	if (pll->tuner_addr)
+ 		writel(val + 1, pll->tuner_addr);
diff --git a/target/linux/mediatek/patches-5.15/242-clk-mediatek-add-mt7988-clock-support.patch b/target/linux/mediatek/patches-5.15/242-clk-mediatek-add-mt7988-clock-support.patch
new file mode 100644
index 00000000000000..bf9146352a6154
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/242-clk-mediatek-add-mt7988-clock-support.patch
@@ -0,0 +1,31 @@
+--- a/drivers/clk/mediatek/Kconfig
++++ b/drivers/clk/mediatek/Kconfig
+@@ -378,6 +378,15 @@ config COMMON_CLK_MT7986_ETHSYS
+ 	  This driver add support for clocks for Ethernet and SGMII
+ 	  required on MediaTek MT7986 SoC.
+ 
++config COMMON_CLK_MT7988
++	bool "Clock driver for MediaTek MT7988"
++	depends on ARCH_MEDIATEK || COMPILE_TEST
++	select COMMON_CLK_MEDIATEK
++	default ARCH_MEDIATEK
++	help
++	  This driver supports MediaTek MT7988 basic clocks and clocks
++	  required for various periperals found on MediaTek.
++
+ config COMMON_CLK_MT8135
+ 	bool "Clock driver for MediaTek MT8135"
+ 	depends on (ARCH_MEDIATEK && ARM) || COMPILE_TEST
+--- a/drivers/clk/mediatek/Makefile
++++ b/drivers/clk/mediatek/Makefile
+@@ -54,6 +54,10 @@ obj-$(CONFIG_COMMON_CLK_MT7986) += clk-m
+ obj-$(CONFIG_COMMON_CLK_MT7986) += clk-mt7986-topckgen.o
+ obj-$(CONFIG_COMMON_CLK_MT7986) += clk-mt7986-infracfg.o
+ obj-$(CONFIG_COMMON_CLK_MT7986_ETHSYS) += clk-mt7986-eth.o
++obj-$(CONFIG_COMMON_CLK_MT7988) += clk-mt7988-apmixed.o
++obj-$(CONFIG_COMMON_CLK_MT7988) += clk-mt7988-topckgen.o
++obj-$(CONFIG_COMMON_CLK_MT7988) += clk-mt7988-infracfg.o
++obj-$(CONFIG_COMMON_CLK_MT7988) += clk-mt7988-eth.o
+ obj-$(CONFIG_COMMON_CLK_MT8135) += clk-mt8135.o
+ obj-$(CONFIG_COMMON_CLK_MT8167) += clk-mt8167.o
+ obj-$(CONFIG_COMMON_CLK_MT8167_AUDSYS) += clk-mt8167-aud.o
diff --git a/target/linux/mediatek/patches-5.15/330-snand-mtk-bmt-support.patch b/target/linux/mediatek/patches-5.15/330-snand-mtk-bmt-support.patch
index cd1745dd7a223f..6814e5f5e983e0 100644
--- a/target/linux/mediatek/patches-5.15/330-snand-mtk-bmt-support.patch
+++ b/target/linux/mediatek/patches-5.15/330-snand-mtk-bmt-support.patch
@@ -8,7 +8,7 @@
  
  static int spinand_read_reg_op(struct spinand_device *spinand, u8 reg, u8 *val)
  {
-@@ -1333,6 +1334,7 @@ static int spinand_probe(struct spi_mem
+@@ -1343,6 +1344,7 @@ static int spinand_probe(struct spi_mem
  	if (ret)
  		return ret;
  
@@ -16,7 +16,7 @@
  	ret = mtd_device_register(mtd, NULL, 0);
  	if (ret)
  		goto err_spinand_cleanup;
-@@ -1340,6 +1342,7 @@ static int spinand_probe(struct spi_mem
+@@ -1350,6 +1352,7 @@ static int spinand_probe(struct spi_mem
  	return 0;
  
  err_spinand_cleanup:
@@ -24,7 +24,7 @@
  	spinand_cleanup(spinand);
  
  	return ret;
-@@ -1358,6 +1361,7 @@ static int spinand_remove(struct spi_mem
+@@ -1368,6 +1371,7 @@ static int spinand_remove(struct spi_mem
  	if (ret)
  		return ret;
  
diff --git a/target/linux/mediatek/patches-5.15/340-mtd-spinand-Add-support-for-the-Fidelix-FM35X1GA.patch b/target/linux/mediatek/patches-5.15/340-mtd-spinand-Add-support-for-the-Fidelix-FM35X1GA.patch
index 823630b3c42339..6baa32879bf7c4 100644
--- a/target/linux/mediatek/patches-5.15/340-mtd-spinand-Add-support-for-the-Fidelix-FM35X1GA.patch
+++ b/target/linux/mediatek/patches-5.15/340-mtd-spinand-Add-support-for-the-Fidelix-FM35X1GA.patch
@@ -23,7 +23,7 @@ Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
  obj-$(CONFIG_MTD_SPI_NAND) += spinand.o
 --- a/drivers/mtd/nand/spi/core.c
 +++ b/drivers/mtd/nand/spi/core.c
-@@ -929,6 +929,7 @@ static const struct nand_ops spinand_ops
+@@ -939,6 +939,7 @@ static const struct nand_ops spinand_ops
  
  static const struct spinand_manufacturer *spinand_manufacturers[] = {
  	&esmt_c8_spinand_manufacturer,
diff --git a/target/linux/mediatek/patches-5.15/350-01-cpufreq-mediatek-Cleanup-variables-and-error-handlin.patch b/target/linux/mediatek/patches-5.15/350-01-cpufreq-mediatek-Cleanup-variables-and-error-handlin.patch
new file mode 100644
index 00000000000000..8fad64a5702aa0
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/350-01-cpufreq-mediatek-Cleanup-variables-and-error-handlin.patch
@@ -0,0 +1,166 @@
+From 7a768326fdba542144833b9198a6d0edab52fad2 Mon Sep 17 00:00:00 2001
+From: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Date: Fri, 8 Apr 2022 12:58:56 +0800
+Subject: [PATCH 01/21] cpufreq: mediatek: Cleanup variables and error handling
+ in mtk_cpu_dvfs_info_init()
+
+- Remove several unnecessary varaibles in mtk_cpu_dvfs_info_init().
+- Unify error message format and use dev_err_probe() if possible.
+
+Signed-off-by: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Signed-off-by: Rex-BC Chen <rex-bc.chen@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 89 ++++++++++++------------------
+ 1 file changed, 34 insertions(+), 55 deletions(-)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -302,96 +302,75 @@ static int mtk_cpufreq_set_target(struct
+ static int mtk_cpu_dvfs_info_init(struct mtk_cpu_dvfs_info *info, int cpu)
+ {
+ 	struct device *cpu_dev;
+-	struct regulator *proc_reg = ERR_PTR(-ENODEV);
+-	struct regulator *sram_reg = ERR_PTR(-ENODEV);
+-	struct clk *cpu_clk = ERR_PTR(-ENODEV);
+-	struct clk *inter_clk = ERR_PTR(-ENODEV);
+ 	struct dev_pm_opp *opp;
+ 	unsigned long rate;
+ 	int ret;
+ 
+ 	cpu_dev = get_cpu_device(cpu);
+ 	if (!cpu_dev) {
+-		pr_err("failed to get cpu%d device\n", cpu);
++		dev_err(cpu_dev, "failed to get cpu%d device\n", cpu);
+ 		return -ENODEV;
+ 	}
++	info->cpu_dev = cpu_dev;
+ 
+-	cpu_clk = clk_get(cpu_dev, "cpu");
+-	if (IS_ERR(cpu_clk)) {
+-		if (PTR_ERR(cpu_clk) == -EPROBE_DEFER)
+-			pr_warn("cpu clk for cpu%d not ready, retry.\n", cpu);
+-		else
+-			pr_err("failed to get cpu clk for cpu%d\n", cpu);
+-
+-		ret = PTR_ERR(cpu_clk);
+-		return ret;
+-	}
+-
+-	inter_clk = clk_get(cpu_dev, "intermediate");
+-	if (IS_ERR(inter_clk)) {
+-		if (PTR_ERR(inter_clk) == -EPROBE_DEFER)
+-			pr_warn("intermediate clk for cpu%d not ready, retry.\n",
+-				cpu);
+-		else
+-			pr_err("failed to get intermediate clk for cpu%d\n",
+-			       cpu);
++	info->cpu_clk = clk_get(cpu_dev, "cpu");
++	if (IS_ERR(info->cpu_clk)) {
++		ret = PTR_ERR(info->cpu_clk);
++		return dev_err_probe(cpu_dev, ret,
++				     "cpu%d: failed to get cpu clk\n", cpu);
++	}
+ 
+-		ret = PTR_ERR(inter_clk);
++	info->inter_clk = clk_get(cpu_dev, "intermediate");
++	if (IS_ERR(info->inter_clk)) {
++		ret = PTR_ERR(info->inter_clk);
++		dev_err_probe(cpu_dev, ret,
++			      "cpu%d: failed to get intermediate clk\n", cpu);
+ 		goto out_free_resources;
+ 	}
+ 
+-	proc_reg = regulator_get_optional(cpu_dev, "proc");
+-	if (IS_ERR(proc_reg)) {
+-		if (PTR_ERR(proc_reg) == -EPROBE_DEFER)
+-			pr_warn("proc regulator for cpu%d not ready, retry.\n",
+-				cpu);
+-		else
+-			pr_err("failed to get proc regulator for cpu%d\n",
+-			       cpu);
+-
+-		ret = PTR_ERR(proc_reg);
++	info->proc_reg = regulator_get_optional(cpu_dev, "proc");
++	if (IS_ERR(info->proc_reg)) {
++		ret = PTR_ERR(info->proc_reg);
++		dev_err_probe(cpu_dev, ret,
++			      "cpu%d: failed to get proc regulator\n", cpu);
+ 		goto out_free_resources;
+ 	}
+ 
+ 	/* Both presence and absence of sram regulator are valid cases. */
+-	sram_reg = regulator_get_exclusive(cpu_dev, "sram");
++	info->sram_reg = regulator_get_exclusive(cpu_dev, "sram");
++	if (IS_ERR(info->sram_reg))
++		info->sram_reg = NULL;
+ 
+ 	/* Get OPP-sharing information from "operating-points-v2" bindings */
+ 	ret = dev_pm_opp_of_get_sharing_cpus(cpu_dev, &info->cpus);
+ 	if (ret) {
+-		pr_err("failed to get OPP-sharing information for cpu%d\n",
+-		       cpu);
++		dev_err(cpu_dev,
++			"cpu%d: failed to get OPP-sharing information\n", cpu);
+ 		goto out_free_resources;
+ 	}
+ 
+ 	ret = dev_pm_opp_of_cpumask_add_table(&info->cpus);
+ 	if (ret) {
+-		pr_warn("no OPP table for cpu%d\n", cpu);
++		dev_warn(cpu_dev, "cpu%d: no OPP table\n", cpu);
+ 		goto out_free_resources;
+ 	}
+ 
+ 	/* Search a safe voltage for intermediate frequency. */
+-	rate = clk_get_rate(inter_clk);
++	rate = clk_get_rate(info->inter_clk);
+ 	opp = dev_pm_opp_find_freq_ceil(cpu_dev, &rate);
+ 	if (IS_ERR(opp)) {
+-		pr_err("failed to get intermediate opp for cpu%d\n", cpu);
++		dev_err(cpu_dev, "cpu%d: failed to get intermediate opp\n", cpu);
+ 		ret = PTR_ERR(opp);
+ 		goto out_free_opp_table;
+ 	}
+ 	info->intermediate_voltage = dev_pm_opp_get_voltage(opp);
+ 	dev_pm_opp_put(opp);
+ 
+-	info->cpu_dev = cpu_dev;
+-	info->proc_reg = proc_reg;
+-	info->sram_reg = IS_ERR(sram_reg) ? NULL : sram_reg;
+-	info->cpu_clk = cpu_clk;
+-	info->inter_clk = inter_clk;
+-
+ 	/*
+ 	 * If SRAM regulator is present, software "voltage tracking" is needed
+ 	 * for this CPU power domain.
+ 	 */
+-	info->need_voltage_tracking = !IS_ERR(sram_reg);
++	info->need_voltage_tracking = (info->sram_reg != NULL);
+ 
+ 	return 0;
+ 
+@@ -399,14 +378,14 @@ out_free_opp_table:
+ 	dev_pm_opp_of_cpumask_remove_table(&info->cpus);
+ 
+ out_free_resources:
+-	if (!IS_ERR(proc_reg))
+-		regulator_put(proc_reg);
+-	if (!IS_ERR(sram_reg))
+-		regulator_put(sram_reg);
+-	if (!IS_ERR(cpu_clk))
+-		clk_put(cpu_clk);
+-	if (!IS_ERR(inter_clk))
+-		clk_put(inter_clk);
++	if (!IS_ERR(info->proc_reg))
++		regulator_put(info->proc_reg);
++	if (!IS_ERR(info->sram_reg))
++		regulator_put(info->sram_reg);
++	if (!IS_ERR(info->cpu_clk))
++		clk_put(info->cpu_clk);
++	if (!IS_ERR(info->inter_clk))
++		clk_put(info->inter_clk);
+ 
+ 	return ret;
+ }
diff --git a/target/linux/mediatek/patches-5.15/350-02-cpufreq-mediatek-Remove-unused-headers.patch b/target/linux/mediatek/patches-5.15/350-02-cpufreq-mediatek-Remove-unused-headers.patch
new file mode 100644
index 00000000000000..eebeeb09028518
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/350-02-cpufreq-mediatek-Remove-unused-headers.patch
@@ -0,0 +1,25 @@
+From 756104b856d4bc3121420af3ced342f5fc2b2123 Mon Sep 17 00:00:00 2001
+From: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Date: Fri, 8 Apr 2022 12:58:57 +0800
+Subject: [PATCH 02/21] cpufreq: mediatek: Remove unused headers
+
+Remove unused headers.
+
+Signed-off-by: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -13,8 +13,6 @@
+ #include <linux/platform_device.h>
+ #include <linux/pm_opp.h>
+ #include <linux/regulator/consumer.h>
+-#include <linux/slab.h>
+-#include <linux/thermal.h>
+ 
+ #define MIN_VOLT_SHIFT		(100000)
+ #define MAX_VOLT_SHIFT		(200000)
diff --git a/target/linux/mediatek/patches-5.15/350-03-cpufreq-mediatek-Enable-clocks-and-regulators.patch b/target/linux/mediatek/patches-5.15/350-03-cpufreq-mediatek-Enable-clocks-and-regulators.patch
new file mode 100644
index 00000000000000..c97d5fc3d91d82
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/350-03-cpufreq-mediatek-Enable-clocks-and-regulators.patch
@@ -0,0 +1,117 @@
+From 342d5545e9f40496db9ae0d31c2427dd5f369a43 Mon Sep 17 00:00:00 2001
+From: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Date: Fri, 8 Apr 2022 12:58:58 +0800
+Subject: [PATCH 03/21] cpufreq: mediatek: Enable clocks and regulators
+
+We need to enable regulators so that the max and min requested values will
+be recorded.
+The intermediate clock is not always enabled by CCF in different projects,
+so we should enable it in the cpufreq driver.
+
+Signed-off-by: Andrew-sh.Cheng <andrew-sh.cheng@mediatek.com>
+Signed-off-by: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Signed-off-by: Rex-BC Chen <rex-bc.chen@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 50 +++++++++++++++++++++++++++---
+ 1 file changed, 45 insertions(+), 5 deletions(-)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -334,10 +334,23 @@ static int mtk_cpu_dvfs_info_init(struct
+ 		goto out_free_resources;
+ 	}
+ 
++	ret = regulator_enable(info->proc_reg);
++	if (ret) {
++		dev_warn(cpu_dev, "cpu%d: failed to enable vproc\n", cpu);
++		goto out_free_resources;
++	}
++
+ 	/* Both presence and absence of sram regulator are valid cases. */
+ 	info->sram_reg = regulator_get_exclusive(cpu_dev, "sram");
+ 	if (IS_ERR(info->sram_reg))
+ 		info->sram_reg = NULL;
++	else {
++		ret = regulator_enable(info->sram_reg);
++		if (ret) {
++			dev_warn(cpu_dev, "cpu%d: failed to enable vsram\n", cpu);
++			goto out_free_resources;
++		}
++	}
+ 
+ 	/* Get OPP-sharing information from "operating-points-v2" bindings */
+ 	ret = dev_pm_opp_of_get_sharing_cpus(cpu_dev, &info->cpus);
+@@ -353,13 +366,21 @@ static int mtk_cpu_dvfs_info_init(struct
+ 		goto out_free_resources;
+ 	}
+ 
++	ret = clk_prepare_enable(info->cpu_clk);
++	if (ret)
++		goto out_free_opp_table;
++
++	ret = clk_prepare_enable(info->inter_clk);
++	if (ret)
++		goto out_disable_mux_clock;
++
+ 	/* Search a safe voltage for intermediate frequency. */
+ 	rate = clk_get_rate(info->inter_clk);
+ 	opp = dev_pm_opp_find_freq_ceil(cpu_dev, &rate);
+ 	if (IS_ERR(opp)) {
+ 		dev_err(cpu_dev, "cpu%d: failed to get intermediate opp\n", cpu);
+ 		ret = PTR_ERR(opp);
+-		goto out_free_opp_table;
++		goto out_disable_inter_clock;
+ 	}
+ 	info->intermediate_voltage = dev_pm_opp_get_voltage(opp);
+ 	dev_pm_opp_put(opp);
+@@ -372,10 +393,21 @@ static int mtk_cpu_dvfs_info_init(struct
+ 
+ 	return 0;
+ 
++out_disable_inter_clock:
++	clk_disable_unprepare(info->inter_clk);
++
++out_disable_mux_clock:
++	clk_disable_unprepare(info->cpu_clk);
++
+ out_free_opp_table:
+ 	dev_pm_opp_of_cpumask_remove_table(&info->cpus);
+ 
+ out_free_resources:
++	if (regulator_is_enabled(info->proc_reg))
++		regulator_disable(info->proc_reg);
++	if (info->sram_reg && regulator_is_enabled(info->sram_reg))
++		regulator_disable(info->sram_reg);
++
+ 	if (!IS_ERR(info->proc_reg))
+ 		regulator_put(info->proc_reg);
+ 	if (!IS_ERR(info->sram_reg))
+@@ -390,14 +422,22 @@ out_free_resources:
+ 
+ static void mtk_cpu_dvfs_info_release(struct mtk_cpu_dvfs_info *info)
+ {
+-	if (!IS_ERR(info->proc_reg))
++	if (!IS_ERR(info->proc_reg)) {
++		regulator_disable(info->proc_reg);
+ 		regulator_put(info->proc_reg);
+-	if (!IS_ERR(info->sram_reg))
++	}
++	if (!IS_ERR(info->sram_reg)) {
++		regulator_disable(info->sram_reg);
+ 		regulator_put(info->sram_reg);
+-	if (!IS_ERR(info->cpu_clk))
++	}
++	if (!IS_ERR(info->cpu_clk)) {
++		clk_disable_unprepare(info->cpu_clk);
+ 		clk_put(info->cpu_clk);
+-	if (!IS_ERR(info->inter_clk))
++	}
++	if (!IS_ERR(info->inter_clk)) {
++		clk_disable_unprepare(info->inter_clk);
+ 		clk_put(info->inter_clk);
++	}
+ 
+ 	dev_pm_opp_of_cpumask_remove_table(&info->cpus);
+ }
diff --git a/target/linux/mediatek/patches-5.15/350-04-cpufreq-mediatek-Use-device-print-to-show-logs.patch b/target/linux/mediatek/patches-5.15/350-04-cpufreq-mediatek-Use-device-print-to-show-logs.patch
new file mode 100644
index 00000000000000..18e1da728a877a
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/350-04-cpufreq-mediatek-Use-device-print-to-show-logs.patch
@@ -0,0 +1,161 @@
+From a02e2b359141035d2d6999940bc1b9f83ec88587 Mon Sep 17 00:00:00 2001
+From: Rex-BC Chen <rex-bc.chen@mediatek.com>
+Date: Fri, 22 Apr 2022 15:52:27 +0800
+Subject: [PATCH 04/21] cpufreq: mediatek: Use device print to show logs
+
+- Replace pr_* with dev_* to show logs.
+- Remove usage of __func__.
+
+Signed-off-by: Rex-BC Chen <rex-bc.chen@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 54 ++++++++++++++++--------------
+ 1 file changed, 28 insertions(+), 26 deletions(-)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -67,7 +67,8 @@ static int mtk_cpufreq_voltage_tracking(
+ 
+ 	old_vproc = regulator_get_voltage(proc_reg);
+ 	if (old_vproc < 0) {
+-		pr_err("%s: invalid Vproc value: %d\n", __func__, old_vproc);
++		dev_err(info->cpu_dev,
++			"invalid Vproc value: %d\n", old_vproc);
+ 		return old_vproc;
+ 	}
+ 	/* Vsram should not exceed the maximum allowed voltage of SoC. */
+@@ -83,14 +84,14 @@ static int mtk_cpufreq_voltage_tracking(
+ 		do {
+ 			old_vsram = regulator_get_voltage(sram_reg);
+ 			if (old_vsram < 0) {
+-				pr_err("%s: invalid Vsram value: %d\n",
+-				       __func__, old_vsram);
++				dev_err(info->cpu_dev,
++					"invalid Vsram value: %d\n", old_vsram);
+ 				return old_vsram;
+ 			}
+ 			old_vproc = regulator_get_voltage(proc_reg);
+ 			if (old_vproc < 0) {
+-				pr_err("%s: invalid Vproc value: %d\n",
+-				       __func__, old_vproc);
++				dev_err(info->cpu_dev,
++					"invalid Vproc value: %d\n", old_vproc);
+ 				return old_vproc;
+ 			}
+ 
+@@ -138,14 +139,14 @@ static int mtk_cpufreq_voltage_tracking(
+ 		do {
+ 			old_vproc = regulator_get_voltage(proc_reg);
+ 			if (old_vproc < 0) {
+-				pr_err("%s: invalid Vproc value: %d\n",
+-				       __func__, old_vproc);
++				dev_err(info->cpu_dev,
++					"invalid Vproc value: %d\n", old_vproc);
+ 				return old_vproc;
+ 			}
+ 			old_vsram = regulator_get_voltage(sram_reg);
+ 			if (old_vsram < 0) {
+-				pr_err("%s: invalid Vsram value: %d\n",
+-				       __func__, old_vsram);
++				dev_err(info->cpu_dev,
++					"invalid Vsram value: %d\n", old_vsram);
+ 				return old_vsram;
+ 			}
+ 
+@@ -216,7 +217,7 @@ static int mtk_cpufreq_set_target(struct
+ 	old_freq_hz = clk_get_rate(cpu_clk);
+ 	old_vproc = regulator_get_voltage(info->proc_reg);
+ 	if (old_vproc < 0) {
+-		pr_err("%s: invalid Vproc value: %d\n", __func__, old_vproc);
++		dev_err(cpu_dev, "invalid Vproc value: %d\n", old_vproc);
+ 		return old_vproc;
+ 	}
+ 
+@@ -224,8 +225,8 @@ static int mtk_cpufreq_set_target(struct
+ 
+ 	opp = dev_pm_opp_find_freq_ceil(cpu_dev, &freq_hz);
+ 	if (IS_ERR(opp)) {
+-		pr_err("cpu%d: failed to find OPP for %ld\n",
+-		       policy->cpu, freq_hz);
++		dev_err(cpu_dev, "cpu%d: failed to find OPP for %ld\n",
++			policy->cpu, freq_hz);
+ 		return PTR_ERR(opp);
+ 	}
+ 	vproc = dev_pm_opp_get_voltage(opp);
+@@ -239,8 +240,8 @@ static int mtk_cpufreq_set_target(struct
+ 	if (old_vproc < target_vproc) {
+ 		ret = mtk_cpufreq_set_voltage(info, target_vproc);
+ 		if (ret) {
+-			pr_err("cpu%d: failed to scale up voltage!\n",
+-			       policy->cpu);
++			dev_err(cpu_dev,
++				"cpu%d: failed to scale up voltage!\n", policy->cpu);
+ 			mtk_cpufreq_set_voltage(info, old_vproc);
+ 			return ret;
+ 		}
+@@ -249,8 +250,8 @@ static int mtk_cpufreq_set_target(struct
+ 	/* Reparent the CPU clock to intermediate clock. */
+ 	ret = clk_set_parent(cpu_clk, info->inter_clk);
+ 	if (ret) {
+-		pr_err("cpu%d: failed to re-parent cpu clock!\n",
+-		       policy->cpu);
++		dev_err(cpu_dev,
++			"cpu%d: failed to re-parent cpu clock!\n", policy->cpu);
+ 		mtk_cpufreq_set_voltage(info, old_vproc);
+ 		WARN_ON(1);
+ 		return ret;
+@@ -259,8 +260,8 @@ static int mtk_cpufreq_set_target(struct
+ 	/* Set the original PLL to target rate. */
+ 	ret = clk_set_rate(armpll, freq_hz);
+ 	if (ret) {
+-		pr_err("cpu%d: failed to scale cpu clock rate!\n",
+-		       policy->cpu);
++		dev_err(cpu_dev,
++			"cpu%d: failed to scale cpu clock rate!\n", policy->cpu);
+ 		clk_set_parent(cpu_clk, armpll);
+ 		mtk_cpufreq_set_voltage(info, old_vproc);
+ 		return ret;
+@@ -269,8 +270,8 @@ static int mtk_cpufreq_set_target(struct
+ 	/* Set parent of CPU clock back to the original PLL. */
+ 	ret = clk_set_parent(cpu_clk, armpll);
+ 	if (ret) {
+-		pr_err("cpu%d: failed to re-parent cpu clock!\n",
+-		       policy->cpu);
++		dev_err(cpu_dev,
++			"cpu%d: failed to re-parent cpu clock!\n", policy->cpu);
+ 		mtk_cpufreq_set_voltage(info, inter_vproc);
+ 		WARN_ON(1);
+ 		return ret;
+@@ -283,8 +284,8 @@ static int mtk_cpufreq_set_target(struct
+ 	if (vproc < inter_vproc || vproc < old_vproc) {
+ 		ret = mtk_cpufreq_set_voltage(info, vproc);
+ 		if (ret) {
+-			pr_err("cpu%d: failed to scale down voltage!\n",
+-			       policy->cpu);
++			dev_err(cpu_dev,
++				"cpu%d: failed to scale down voltage!\n", policy->cpu);
+ 			clk_set_parent(cpu_clk, info->inter_clk);
+ 			clk_set_rate(armpll, old_freq_hz);
+ 			clk_set_parent(cpu_clk, armpll);
+@@ -450,15 +451,16 @@ static int mtk_cpufreq_init(struct cpufr
+ 
+ 	info = mtk_cpu_dvfs_info_lookup(policy->cpu);
+ 	if (!info) {
+-		pr_err("dvfs info for cpu%d is not initialized.\n",
+-		       policy->cpu);
++		dev_err(info->cpu_dev,
++			"dvfs info for cpu%d is not initialized.\n", policy->cpu);
+ 		return -EINVAL;
+ 	}
+ 
+ 	ret = dev_pm_opp_init_cpufreq_table(info->cpu_dev, &freq_table);
+ 	if (ret) {
+-		pr_err("failed to init cpufreq table for cpu%d: %d\n",
+-		       policy->cpu, ret);
++		dev_err(info->cpu_dev,
++			"failed to init cpufreq table for cpu%d: %d\n",
++			policy->cpu, ret);
+ 		return ret;
+ 	}
+ 
diff --git a/target/linux/mediatek/patches-5.15/350-05-cpufreq-mediatek-Replace-old_-with-pre_.patch b/target/linux/mediatek/patches-5.15/350-05-cpufreq-mediatek-Replace-old_-with-pre_.patch
new file mode 100644
index 00000000000000..8506f4e47769f9
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/350-05-cpufreq-mediatek-Replace-old_-with-pre_.patch
@@ -0,0 +1,201 @@
+From 35832d9f9c5c1da01420d962dc56e7e61d104829 Mon Sep 17 00:00:00 2001
+From: Rex-BC Chen <rex-bc.chen@mediatek.com>
+Date: Fri, 22 Apr 2022 15:52:28 +0800
+Subject: [PATCH 05/21] cpufreq: mediatek: Replace old_* with pre_*
+
+To make driver more readable, replace old_* with pre_*.
+
+Signed-off-by: Rex-BC Chen <rex-bc.chen@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 84 +++++++++++++++---------------
+ 1 file changed, 42 insertions(+), 42 deletions(-)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -63,18 +63,18 @@ static int mtk_cpufreq_voltage_tracking(
+ {
+ 	struct regulator *proc_reg = info->proc_reg;
+ 	struct regulator *sram_reg = info->sram_reg;
+-	int old_vproc, old_vsram, new_vsram, vsram, vproc, ret;
++	int pre_vproc, pre_vsram, new_vsram, vsram, vproc, ret;
+ 
+-	old_vproc = regulator_get_voltage(proc_reg);
+-	if (old_vproc < 0) {
++	pre_vproc = regulator_get_voltage(proc_reg);
++	if (pre_vproc < 0) {
+ 		dev_err(info->cpu_dev,
+-			"invalid Vproc value: %d\n", old_vproc);
+-		return old_vproc;
++			"invalid Vproc value: %d\n", pre_vproc);
++		return pre_vproc;
+ 	}
+ 	/* Vsram should not exceed the maximum allowed voltage of SoC. */
+ 	new_vsram = min(new_vproc + MIN_VOLT_SHIFT, MAX_VOLT_LIMIT);
+ 
+-	if (old_vproc < new_vproc) {
++	if (pre_vproc < new_vproc) {
+ 		/*
+ 		 * When scaling up voltages, Vsram and Vproc scale up step
+ 		 * by step. At each step, set Vsram to (Vproc + 200mV) first,
+@@ -82,20 +82,20 @@ static int mtk_cpufreq_voltage_tracking(
+ 		 * Keep doing it until Vsram and Vproc hit target voltages.
+ 		 */
+ 		do {
+-			old_vsram = regulator_get_voltage(sram_reg);
+-			if (old_vsram < 0) {
++			pre_vsram = regulator_get_voltage(sram_reg);
++			if (pre_vsram < 0) {
+ 				dev_err(info->cpu_dev,
+-					"invalid Vsram value: %d\n", old_vsram);
+-				return old_vsram;
++					"invalid Vsram value: %d\n", pre_vsram);
++				return pre_vsram;
+ 			}
+-			old_vproc = regulator_get_voltage(proc_reg);
+-			if (old_vproc < 0) {
++			pre_vproc = regulator_get_voltage(proc_reg);
++			if (pre_vproc < 0) {
+ 				dev_err(info->cpu_dev,
+-					"invalid Vproc value: %d\n", old_vproc);
+-				return old_vproc;
++					"invalid Vproc value: %d\n", pre_vproc);
++				return pre_vproc;
+ 			}
+ 
+-			vsram = min(new_vsram, old_vproc + MAX_VOLT_SHIFT);
++			vsram = min(new_vsram, pre_vproc + MAX_VOLT_SHIFT);
+ 
+ 			if (vsram + VOLT_TOL >= MAX_VOLT_LIMIT) {
+ 				vsram = MAX_VOLT_LIMIT;
+@@ -124,12 +124,12 @@ static int mtk_cpufreq_voltage_tracking(
+ 			ret = regulator_set_voltage(proc_reg, vproc,
+ 						    vproc + VOLT_TOL);
+ 			if (ret) {
+-				regulator_set_voltage(sram_reg, old_vsram,
+-						      old_vsram);
++				regulator_set_voltage(sram_reg, pre_vsram,
++						      pre_vsram);
+ 				return ret;
+ 			}
+ 		} while (vproc < new_vproc || vsram < new_vsram);
+-	} else if (old_vproc > new_vproc) {
++	} else if (pre_vproc > new_vproc) {
+ 		/*
+ 		 * When scaling down voltages, Vsram and Vproc scale down step
+ 		 * by step. At each step, set Vproc to (Vsram - 200mV) first,
+@@ -137,20 +137,20 @@ static int mtk_cpufreq_voltage_tracking(
+ 		 * Keep doing it until Vsram and Vproc hit target voltages.
+ 		 */
+ 		do {
+-			old_vproc = regulator_get_voltage(proc_reg);
+-			if (old_vproc < 0) {
++			pre_vproc = regulator_get_voltage(proc_reg);
++			if (pre_vproc < 0) {
+ 				dev_err(info->cpu_dev,
+-					"invalid Vproc value: %d\n", old_vproc);
+-				return old_vproc;
++					"invalid Vproc value: %d\n", pre_vproc);
++				return pre_vproc;
+ 			}
+-			old_vsram = regulator_get_voltage(sram_reg);
+-			if (old_vsram < 0) {
++			pre_vsram = regulator_get_voltage(sram_reg);
++			if (pre_vsram < 0) {
+ 				dev_err(info->cpu_dev,
+-					"invalid Vsram value: %d\n", old_vsram);
+-				return old_vsram;
++					"invalid Vsram value: %d\n", pre_vsram);
++				return pre_vsram;
+ 			}
+ 
+-			vproc = max(new_vproc, old_vsram - MAX_VOLT_SHIFT);
++			vproc = max(new_vproc, pre_vsram - MAX_VOLT_SHIFT);
+ 			ret = regulator_set_voltage(proc_reg, vproc,
+ 						    vproc + VOLT_TOL);
+ 			if (ret)
+@@ -180,8 +180,8 @@ static int mtk_cpufreq_voltage_tracking(
+ 			}
+ 
+ 			if (ret) {
+-				regulator_set_voltage(proc_reg, old_vproc,
+-						      old_vproc);
++				regulator_set_voltage(proc_reg, pre_vproc,
++						      pre_vproc);
+ 				return ret;
+ 			}
+ 		} while (vproc > new_vproc + VOLT_TOL ||
+@@ -209,16 +209,16 @@ static int mtk_cpufreq_set_target(struct
+ 	struct mtk_cpu_dvfs_info *info = policy->driver_data;
+ 	struct device *cpu_dev = info->cpu_dev;
+ 	struct dev_pm_opp *opp;
+-	long freq_hz, old_freq_hz;
+-	int vproc, old_vproc, inter_vproc, target_vproc, ret;
++	long freq_hz, pre_freq_hz;
++	int vproc, pre_vproc, inter_vproc, target_vproc, ret;
+ 
+ 	inter_vproc = info->intermediate_voltage;
+ 
+-	old_freq_hz = clk_get_rate(cpu_clk);
+-	old_vproc = regulator_get_voltage(info->proc_reg);
+-	if (old_vproc < 0) {
+-		dev_err(cpu_dev, "invalid Vproc value: %d\n", old_vproc);
+-		return old_vproc;
++	pre_freq_hz = clk_get_rate(cpu_clk);
++	pre_vproc = regulator_get_voltage(info->proc_reg);
++	if (pre_vproc < 0) {
++		dev_err(cpu_dev, "invalid Vproc value: %d\n", pre_vproc);
++		return pre_vproc;
+ 	}
+ 
+ 	freq_hz = freq_table[index].frequency * 1000;
+@@ -237,12 +237,12 @@ static int mtk_cpufreq_set_target(struct
+ 	 * current voltage, scale up voltage first.
+ 	 */
+ 	target_vproc = (inter_vproc > vproc) ? inter_vproc : vproc;
+-	if (old_vproc < target_vproc) {
++	if (pre_vproc < target_vproc) {
+ 		ret = mtk_cpufreq_set_voltage(info, target_vproc);
+ 		if (ret) {
+ 			dev_err(cpu_dev,
+ 				"cpu%d: failed to scale up voltage!\n", policy->cpu);
+-			mtk_cpufreq_set_voltage(info, old_vproc);
++			mtk_cpufreq_set_voltage(info, pre_vproc);
+ 			return ret;
+ 		}
+ 	}
+@@ -252,7 +252,7 @@ static int mtk_cpufreq_set_target(struct
+ 	if (ret) {
+ 		dev_err(cpu_dev,
+ 			"cpu%d: failed to re-parent cpu clock!\n", policy->cpu);
+-		mtk_cpufreq_set_voltage(info, old_vproc);
++		mtk_cpufreq_set_voltage(info, pre_vproc);
+ 		WARN_ON(1);
+ 		return ret;
+ 	}
+@@ -263,7 +263,7 @@ static int mtk_cpufreq_set_target(struct
+ 		dev_err(cpu_dev,
+ 			"cpu%d: failed to scale cpu clock rate!\n", policy->cpu);
+ 		clk_set_parent(cpu_clk, armpll);
+-		mtk_cpufreq_set_voltage(info, old_vproc);
++		mtk_cpufreq_set_voltage(info, pre_vproc);
+ 		return ret;
+ 	}
+ 
+@@ -281,13 +281,13 @@ static int mtk_cpufreq_set_target(struct
+ 	 * If the new voltage is lower than the intermediate voltage or the
+ 	 * original voltage, scale down to the new voltage.
+ 	 */
+-	if (vproc < inter_vproc || vproc < old_vproc) {
++	if (vproc < inter_vproc || vproc < pre_vproc) {
+ 		ret = mtk_cpufreq_set_voltage(info, vproc);
+ 		if (ret) {
+ 			dev_err(cpu_dev,
+ 				"cpu%d: failed to scale down voltage!\n", policy->cpu);
+ 			clk_set_parent(cpu_clk, info->inter_clk);
+-			clk_set_rate(armpll, old_freq_hz);
++			clk_set_rate(armpll, pre_freq_hz);
+ 			clk_set_parent(cpu_clk, armpll);
+ 			return ret;
+ 		}
diff --git a/target/linux/mediatek/patches-5.15/350-06-cpufreq-mediatek-Record-previous-target-vproc-value.patch b/target/linux/mediatek/patches-5.15/350-06-cpufreq-mediatek-Record-previous-target-vproc-value.patch
new file mode 100644
index 00000000000000..94e6617d267aad
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/350-06-cpufreq-mediatek-Record-previous-target-vproc-value.patch
@@ -0,0 +1,64 @@
+From 34737eb8d0daa0d4183f10286a2f55d8788066bc Mon Sep 17 00:00:00 2001
+From: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Date: Fri, 22 Apr 2022 15:52:29 +0800
+Subject: [PATCH 06/21] cpufreq: mediatek: Record previous target vproc value
+
+We found the buck voltage may not be exactly the same with what we set
+because CPU may share the same buck with other module.
+Therefore, we need to record the previous desired value instead of reading
+it from regulators.
+
+Signed-off-by: Andrew-sh.Cheng <andrew-sh.cheng@mediatek.com>
+Signed-off-by: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Signed-off-by: Rex-BC Chen <rex-bc.chen@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -40,6 +40,7 @@ struct mtk_cpu_dvfs_info {
+ 	struct list_head list_head;
+ 	int intermediate_voltage;
+ 	bool need_voltage_tracking;
++	int pre_vproc;
+ };
+ 
+ static struct platform_device *cpufreq_pdev;
+@@ -193,11 +194,17 @@ static int mtk_cpufreq_voltage_tracking(
+ 
+ static int mtk_cpufreq_set_voltage(struct mtk_cpu_dvfs_info *info, int vproc)
+ {
++	int ret;
++
+ 	if (info->need_voltage_tracking)
+-		return mtk_cpufreq_voltage_tracking(info, vproc);
++		ret = mtk_cpufreq_voltage_tracking(info, vproc);
+ 	else
+-		return regulator_set_voltage(info->proc_reg, vproc,
+-					     vproc + VOLT_TOL);
++		ret = regulator_set_voltage(info->proc_reg, vproc,
++					    MAX_VOLT_LIMIT);
++	if (!ret)
++		info->pre_vproc = vproc;
++
++	return ret;
+ }
+ 
+ static int mtk_cpufreq_set_target(struct cpufreq_policy *policy,
+@@ -215,7 +222,12 @@ static int mtk_cpufreq_set_target(struct
+ 	inter_vproc = info->intermediate_voltage;
+ 
+ 	pre_freq_hz = clk_get_rate(cpu_clk);
+-	pre_vproc = regulator_get_voltage(info->proc_reg);
++
++	if (unlikely(info->pre_vproc <= 0))
++		pre_vproc = regulator_get_voltage(info->proc_reg);
++	else
++		pre_vproc = info->pre_vproc;
++
+ 	if (pre_vproc < 0) {
+ 		dev_err(cpu_dev, "invalid Vproc value: %d\n", pre_vproc);
+ 		return pre_vproc;
diff --git a/target/linux/mediatek/patches-5.15/350-07-cpufreq-mediatek-Make-sram-regulator-optional.patch b/target/linux/mediatek/patches-5.15/350-07-cpufreq-mediatek-Make-sram-regulator-optional.patch
new file mode 100644
index 00000000000000..4b74873b158fe6
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/350-07-cpufreq-mediatek-Make-sram-regulator-optional.patch
@@ -0,0 +1,30 @@
+From f6114c2bc563a8050e9dc874ad87e1448865f031 Mon Sep 17 00:00:00 2001
+From: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Date: Fri, 22 Apr 2022 15:52:33 +0800
+Subject: [PATCH 07/21] cpufreq: mediatek: Make sram regulator optional
+
+For some MediaTek SoCs, like MT8186, it's possible that the sram regulator
+is shared between CPU and CCI.
+We hope regulator framework can return error for error handling rather
+than a dummy handler from regulator_get api.
+Therefore, we choose to use regulator_get_optional.
+
+Signed-off-by: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Signed-off-by: Rex-BC Chen <rex-bc.chen@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -354,7 +354,7 @@ static int mtk_cpu_dvfs_info_init(struct
+ 	}
+ 
+ 	/* Both presence and absence of sram regulator are valid cases. */
+-	info->sram_reg = regulator_get_exclusive(cpu_dev, "sram");
++	info->sram_reg = regulator_get_optional(cpu_dev, "sram");
+ 	if (IS_ERR(info->sram_reg))
+ 		info->sram_reg = NULL;
+ 	else {
diff --git a/target/linux/mediatek/patches-5.15/350-08-cpufreq-mediatek-Fix-NULL-pointer-dereference-in-med.patch b/target/linux/mediatek/patches-5.15/350-08-cpufreq-mediatek-Fix-NULL-pointer-dereference-in-med.patch
new file mode 100644
index 00000000000000..f2f572a753faec
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/350-08-cpufreq-mediatek-Fix-NULL-pointer-dereference-in-med.patch
@@ -0,0 +1,32 @@
+From fa7030d8ad4638acfd9e0fac84a20716d031dc95 Mon Sep 17 00:00:00 2001
+From: Wan Jiabing <wanjiabing@vivo.com>
+Date: Tue, 26 Apr 2022 19:17:14 +0800
+Subject: [PATCH 08/21] cpufreq: mediatek: Fix NULL pointer dereference in
+ mediatek-cpufreq
+
+Fix following coccicheck error:
+drivers/cpufreq/mediatek-cpufreq.c:464:16-23: ERROR: info is NULL but dereferenced.
+
+Use pr_err instead of dev_err to avoid dereferring a NULL pointer.
+
+Fixes: f52b16ba9fe4 ("cpufreq: mediatek: Use device print to show logs")
+Signed-off-by: Wan Jiabing <wanjiabing@vivo.com>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -463,8 +463,8 @@ static int mtk_cpufreq_init(struct cpufr
+ 
+ 	info = mtk_cpu_dvfs_info_lookup(policy->cpu);
+ 	if (!info) {
+-		dev_err(info->cpu_dev,
+-			"dvfs info for cpu%d is not initialized.\n", policy->cpu);
++		pr_err("dvfs info for cpu%d is not initialized.\n",
++			policy->cpu);
+ 		return -EINVAL;
+ 	}
+ 
diff --git a/target/linux/mediatek/patches-5.15/350-09-cpufreq-mediatek-Move-voltage-limits-to-platform-dat.patch b/target/linux/mediatek/patches-5.15/350-09-cpufreq-mediatek-Move-voltage-limits-to-platform-dat.patch
new file mode 100644
index 00000000000000..23b319648dc937
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/350-09-cpufreq-mediatek-Move-voltage-limits-to-platform-dat.patch
@@ -0,0 +1,227 @@
+From be2354b064e6bafbbad599ae2e10569ba4f7d5a6 Mon Sep 17 00:00:00 2001
+From: Rex-BC Chen <rex-bc.chen@mediatek.com>
+Date: Thu, 5 May 2022 19:52:19 +0800
+Subject: [PATCH 09/21] cpufreq: mediatek: Move voltage limits to platform data
+
+Voltages and shifts are defined as macros originally.
+There are different requirements of these values for each MediaTek SoCs.
+Therefore, we add the platform data and move these values into it.
+
+Signed-off-by: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Signed-off-by: Rex-BC Chen <rex-bc.chen@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 84 +++++++++++++++++++++---------
+ 1 file changed, 58 insertions(+), 26 deletions(-)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -10,15 +10,21 @@
+ #include <linux/cpumask.h>
+ #include <linux/module.h>
+ #include <linux/of.h>
++#include <linux/of_platform.h>
+ #include <linux/platform_device.h>
+ #include <linux/pm_opp.h>
+ #include <linux/regulator/consumer.h>
+ 
+-#define MIN_VOLT_SHIFT		(100000)
+-#define MAX_VOLT_SHIFT		(200000)
+-#define MAX_VOLT_LIMIT		(1150000)
+ #define VOLT_TOL		(10000)
+ 
++struct mtk_cpufreq_platform_data {
++	int min_volt_shift;
++	int max_volt_shift;
++	int proc_max_volt;
++	int sram_min_volt;
++	int sram_max_volt;
++};
++
+ /*
+  * The struct mtk_cpu_dvfs_info holds necessary information for doing CPU DVFS
+  * on each CPU power/clock domain of Mediatek SoCs. Each CPU cluster in
+@@ -41,6 +47,7 @@ struct mtk_cpu_dvfs_info {
+ 	int intermediate_voltage;
+ 	bool need_voltage_tracking;
+ 	int pre_vproc;
++	const struct mtk_cpufreq_platform_data *soc_data;
+ };
+ 
+ static struct platform_device *cpufreq_pdev;
+@@ -62,6 +69,7 @@ static struct mtk_cpu_dvfs_info *mtk_cpu
+ static int mtk_cpufreq_voltage_tracking(struct mtk_cpu_dvfs_info *info,
+ 					int new_vproc)
+ {
++	const struct mtk_cpufreq_platform_data *soc_data = info->soc_data;
+ 	struct regulator *proc_reg = info->proc_reg;
+ 	struct regulator *sram_reg = info->sram_reg;
+ 	int pre_vproc, pre_vsram, new_vsram, vsram, vproc, ret;
+@@ -73,7 +81,8 @@ static int mtk_cpufreq_voltage_tracking(
+ 		return pre_vproc;
+ 	}
+ 	/* Vsram should not exceed the maximum allowed voltage of SoC. */
+-	new_vsram = min(new_vproc + MIN_VOLT_SHIFT, MAX_VOLT_LIMIT);
++	new_vsram = min(new_vproc + soc_data->min_volt_shift,
++			soc_data->sram_max_volt);
+ 
+ 	if (pre_vproc < new_vproc) {
+ 		/*
+@@ -96,10 +105,11 @@ static int mtk_cpufreq_voltage_tracking(
+ 				return pre_vproc;
+ 			}
+ 
+-			vsram = min(new_vsram, pre_vproc + MAX_VOLT_SHIFT);
++			vsram = min(new_vsram,
++				    pre_vproc + soc_data->min_volt_shift);
+ 
+-			if (vsram + VOLT_TOL >= MAX_VOLT_LIMIT) {
+-				vsram = MAX_VOLT_LIMIT;
++			if (vsram + VOLT_TOL >= soc_data->sram_max_volt) {
++				vsram = soc_data->sram_max_volt;
+ 
+ 				/*
+ 				 * If the target Vsram hits the maximum voltage,
+@@ -117,7 +127,7 @@ static int mtk_cpufreq_voltage_tracking(
+ 				ret = regulator_set_voltage(sram_reg, vsram,
+ 							    vsram + VOLT_TOL);
+ 
+-				vproc = vsram - MIN_VOLT_SHIFT;
++				vproc = vsram - soc_data->min_volt_shift;
+ 			}
+ 			if (ret)
+ 				return ret;
+@@ -151,7 +161,8 @@ static int mtk_cpufreq_voltage_tracking(
+ 				return pre_vsram;
+ 			}
+ 
+-			vproc = max(new_vproc, pre_vsram - MAX_VOLT_SHIFT);
++			vproc = max(new_vproc,
++				    pre_vsram - soc_data->max_volt_shift);
+ 			ret = regulator_set_voltage(proc_reg, vproc,
+ 						    vproc + VOLT_TOL);
+ 			if (ret)
+@@ -160,10 +171,11 @@ static int mtk_cpufreq_voltage_tracking(
+ 			if (vproc == new_vproc)
+ 				vsram = new_vsram;
+ 			else
+-				vsram = max(new_vsram, vproc + MIN_VOLT_SHIFT);
++				vsram = max(new_vsram,
++					    vproc + soc_data->min_volt_shift);
+ 
+-			if (vsram + VOLT_TOL >= MAX_VOLT_LIMIT) {
+-				vsram = MAX_VOLT_LIMIT;
++			if (vsram + VOLT_TOL >= soc_data->sram_max_volt) {
++				vsram = soc_data->sram_max_volt;
+ 
+ 				/*
+ 				 * If the target Vsram hits the maximum voltage,
+@@ -194,13 +206,14 @@ static int mtk_cpufreq_voltage_tracking(
+ 
+ static int mtk_cpufreq_set_voltage(struct mtk_cpu_dvfs_info *info, int vproc)
+ {
++	const struct mtk_cpufreq_platform_data *soc_data = info->soc_data;
+ 	int ret;
+ 
+ 	if (info->need_voltage_tracking)
+ 		ret = mtk_cpufreq_voltage_tracking(info, vproc);
+ 	else
+ 		ret = regulator_set_voltage(info->proc_reg, vproc,
+-					    MAX_VOLT_LIMIT);
++					    soc_data->proc_max_volt);
+ 	if (!ret)
+ 		info->pre_vproc = vproc;
+ 
+@@ -509,9 +522,17 @@ static struct cpufreq_driver mtk_cpufreq
+ 
+ static int mtk_cpufreq_probe(struct platform_device *pdev)
+ {
++	const struct mtk_cpufreq_platform_data *data;
+ 	struct mtk_cpu_dvfs_info *info, *tmp;
+ 	int cpu, ret;
+ 
++	data = dev_get_platdata(&pdev->dev);
++	if (!data) {
++		dev_err(&pdev->dev,
++			"failed to get mtk cpufreq platform data\n");
++		return -ENODEV;
++	}
++
+ 	for_each_possible_cpu(cpu) {
+ 		info = mtk_cpu_dvfs_info_lookup(cpu);
+ 		if (info)
+@@ -523,6 +544,7 @@ static int mtk_cpufreq_probe(struct plat
+ 			goto release_dvfs_info_list;
+ 		}
+ 
++		info->soc_data = data;
+ 		ret = mtk_cpu_dvfs_info_init(info, cpu);
+ 		if (ret) {
+ 			dev_err(&pdev->dev,
+@@ -558,20 +580,27 @@ static struct platform_driver mtk_cpufre
+ 	.probe		= mtk_cpufreq_probe,
+ };
+ 
++static const struct mtk_cpufreq_platform_data mt2701_platform_data = {
++	.min_volt_shift = 100000,
++	.max_volt_shift = 200000,
++	.proc_max_volt = 1150000,
++	.sram_min_volt = 0,
++	.sram_max_volt = 1150000,
++};
++
+ /* List of machines supported by this driver */
+ static const struct of_device_id mtk_cpufreq_machines[] __initconst = {
+-	{ .compatible = "mediatek,mt2701", },
+-	{ .compatible = "mediatek,mt2712", },
+-	{ .compatible = "mediatek,mt7622", },
+-	{ .compatible = "mediatek,mt7623", },
+-	{ .compatible = "mediatek,mt8167", },
+-	{ .compatible = "mediatek,mt817x", },
+-	{ .compatible = "mediatek,mt8173", },
+-	{ .compatible = "mediatek,mt8176", },
+-	{ .compatible = "mediatek,mt8183", },
+-	{ .compatible = "mediatek,mt8365", },
+-	{ .compatible = "mediatek,mt8516", },
+-
++	{ .compatible = "mediatek,mt2701", .data = &mt2701_platform_data },
++	{ .compatible = "mediatek,mt2712", .data = &mt2701_platform_data },
++	{ .compatible = "mediatek,mt7622", .data = &mt2701_platform_data },
++	{ .compatible = "mediatek,mt7623", .data = &mt2701_platform_data },
++	{ .compatible = "mediatek,mt8167", .data = &mt2701_platform_data },
++	{ .compatible = "mediatek,mt817x", .data = &mt2701_platform_data },
++	{ .compatible = "mediatek,mt8173", .data = &mt2701_platform_data },
++	{ .compatible = "mediatek,mt8176", .data = &mt2701_platform_data },
++	{ .compatible = "mediatek,mt8183", .data = &mt2701_platform_data },
++	{ .compatible = "mediatek,mt8365", .data = &mt2701_platform_data },
++	{ .compatible = "mediatek,mt8516", .data = &mt2701_platform_data },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(of, mtk_cpufreq_machines);
+@@ -580,6 +609,7 @@ static int __init mtk_cpufreq_driver_ini
+ {
+ 	struct device_node *np;
+ 	const struct of_device_id *match;
++	const struct mtk_cpufreq_platform_data *data;
+ 	int err;
+ 
+ 	np = of_find_node_by_path("/");
+@@ -592,6 +622,7 @@ static int __init mtk_cpufreq_driver_ini
+ 		pr_debug("Machine is not compatible with mtk-cpufreq\n");
+ 		return -ENODEV;
+ 	}
++	data = match->data;
+ 
+ 	err = platform_driver_register(&mtk_cpufreq_platdrv);
+ 	if (err)
+@@ -603,7 +634,8 @@ static int __init mtk_cpufreq_driver_ini
+ 	 * and the device registration codes are put here to handle defer
+ 	 * probing.
+ 	 */
+-	cpufreq_pdev = platform_device_register_simple("mtk-cpufreq", -1, NULL, 0);
++	cpufreq_pdev = platform_device_register_data(NULL, "mtk-cpufreq", -1,
++						     data, sizeof(*data));
+ 	if (IS_ERR(cpufreq_pdev)) {
+ 		pr_err("failed to register mtk-cpufreq platform device\n");
+ 		platform_driver_unregister(&mtk_cpufreq_platdrv);
diff --git a/target/linux/mediatek/patches-5.15/350-10-cpufreq-mediatek-Refine-mtk_cpufreq_voltage_tracking.patch b/target/linux/mediatek/patches-5.15/350-10-cpufreq-mediatek-Refine-mtk_cpufreq_voltage_tracking.patch
new file mode 100644
index 00000000000000..0ba9471ffa7128
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/350-10-cpufreq-mediatek-Refine-mtk_cpufreq_voltage_tracking.patch
@@ -0,0 +1,255 @@
+From 944b041c91f1e1cd762c39c1222f078550149486 Mon Sep 17 00:00:00 2001
+From: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Date: Thu, 5 May 2022 19:52:20 +0800
+Subject: [PATCH 10/21] cpufreq: mediatek: Refine
+ mtk_cpufreq_voltage_tracking()
+
+Because the difference of sram and proc should in a range of min_volt_shift
+and max_volt_shift. We need to adjust the sram and proc step by step.
+
+We replace VOLT_TOL (voltage tolerance) with the platform data and update the
+logic to determine the voltage boundary and invoking regulator_set_voltage.
+
+- Use 'sram_min_volt' and 'sram_max_volt' to determine the voltage boundary
+  of sram regulator.
+- Use (sram_min_volt - min_volt_shift) and 'proc_max_volt' to determine the
+  voltage boundary of vproc regulator.
+
+Moreover, to prevent infinite loop when tracking voltage, we calculate the
+maximum value for each platform data.
+We assume min voltage is 0 and tracking target voltage using
+min_volt_shift for each iteration.
+The retry_max is 3 times of expeted iteration count.
+
+Signed-off-by: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Signed-off-by: Rex-BC Chen <rex-bc.chen@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 147 ++++++++++-------------------
+ 1 file changed, 51 insertions(+), 96 deletions(-)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -8,6 +8,7 @@
+ #include <linux/cpu.h>
+ #include <linux/cpufreq.h>
+ #include <linux/cpumask.h>
++#include <linux/minmax.h>
+ #include <linux/module.h>
+ #include <linux/of.h>
+ #include <linux/of_platform.h>
+@@ -15,8 +16,6 @@
+ #include <linux/pm_opp.h>
+ #include <linux/regulator/consumer.h>
+ 
+-#define VOLT_TOL		(10000)
+-
+ struct mtk_cpufreq_platform_data {
+ 	int min_volt_shift;
+ 	int max_volt_shift;
+@@ -48,6 +47,7 @@ struct mtk_cpu_dvfs_info {
+ 	bool need_voltage_tracking;
+ 	int pre_vproc;
+ 	const struct mtk_cpufreq_platform_data *soc_data;
++	int vtrack_max;
+ };
+ 
+ static struct platform_device *cpufreq_pdev;
+@@ -73,6 +73,7 @@ static int mtk_cpufreq_voltage_tracking(
+ 	struct regulator *proc_reg = info->proc_reg;
+ 	struct regulator *sram_reg = info->sram_reg;
+ 	int pre_vproc, pre_vsram, new_vsram, vsram, vproc, ret;
++	int retry = info->vtrack_max;
+ 
+ 	pre_vproc = regulator_get_voltage(proc_reg);
+ 	if (pre_vproc < 0) {
+@@ -80,91 +81,44 @@ static int mtk_cpufreq_voltage_tracking(
+ 			"invalid Vproc value: %d\n", pre_vproc);
+ 		return pre_vproc;
+ 	}
+-	/* Vsram should not exceed the maximum allowed voltage of SoC. */
+-	new_vsram = min(new_vproc + soc_data->min_volt_shift,
+-			soc_data->sram_max_volt);
+-
+-	if (pre_vproc < new_vproc) {
+-		/*
+-		 * When scaling up voltages, Vsram and Vproc scale up step
+-		 * by step. At each step, set Vsram to (Vproc + 200mV) first,
+-		 * then set Vproc to (Vsram - 100mV).
+-		 * Keep doing it until Vsram and Vproc hit target voltages.
+-		 */
+-		do {
+-			pre_vsram = regulator_get_voltage(sram_reg);
+-			if (pre_vsram < 0) {
+-				dev_err(info->cpu_dev,
+-					"invalid Vsram value: %d\n", pre_vsram);
+-				return pre_vsram;
+-			}
+-			pre_vproc = regulator_get_voltage(proc_reg);
+-			if (pre_vproc < 0) {
+-				dev_err(info->cpu_dev,
+-					"invalid Vproc value: %d\n", pre_vproc);
+-				return pre_vproc;
+-			}
+ 
+-			vsram = min(new_vsram,
+-				    pre_vproc + soc_data->min_volt_shift);
++	pre_vsram = regulator_get_voltage(sram_reg);
++	if (pre_vsram < 0) {
++		dev_err(info->cpu_dev, "invalid Vsram value: %d\n", pre_vsram);
++		return pre_vsram;
++	}
+ 
+-			if (vsram + VOLT_TOL >= soc_data->sram_max_volt) {
+-				vsram = soc_data->sram_max_volt;
++	new_vsram = clamp(new_vproc + soc_data->min_volt_shift,
++			  soc_data->sram_min_volt, soc_data->sram_max_volt);
++
++	do {
++		if (pre_vproc <= new_vproc) {
++			vsram = clamp(pre_vproc + soc_data->max_volt_shift,
++				      soc_data->sram_min_volt, new_vsram);
++			ret = regulator_set_voltage(sram_reg, vsram,
++						    soc_data->sram_max_volt);
+ 
+-				/*
+-				 * If the target Vsram hits the maximum voltage,
+-				 * try to set the exact voltage value first.
+-				 */
+-				ret = regulator_set_voltage(sram_reg, vsram,
+-							    vsram);
+-				if (ret)
+-					ret = regulator_set_voltage(sram_reg,
+-							vsram - VOLT_TOL,
+-							vsram);
++			if (ret)
++				return ret;
+ 
++			if (vsram == soc_data->sram_max_volt ||
++			    new_vsram == soc_data->sram_min_volt)
+ 				vproc = new_vproc;
+-			} else {
+-				ret = regulator_set_voltage(sram_reg, vsram,
+-							    vsram + VOLT_TOL);
+-
++			else
+ 				vproc = vsram - soc_data->min_volt_shift;
+-			}
+-			if (ret)
+-				return ret;
+ 
+ 			ret = regulator_set_voltage(proc_reg, vproc,
+-						    vproc + VOLT_TOL);
++						    soc_data->proc_max_volt);
+ 			if (ret) {
+ 				regulator_set_voltage(sram_reg, pre_vsram,
+-						      pre_vsram);
++						      soc_data->sram_max_volt);
+ 				return ret;
+ 			}
+-		} while (vproc < new_vproc || vsram < new_vsram);
+-	} else if (pre_vproc > new_vproc) {
+-		/*
+-		 * When scaling down voltages, Vsram and Vproc scale down step
+-		 * by step. At each step, set Vproc to (Vsram - 200mV) first,
+-		 * then set Vproc to (Vproc + 100mV).
+-		 * Keep doing it until Vsram and Vproc hit target voltages.
+-		 */
+-		do {
+-			pre_vproc = regulator_get_voltage(proc_reg);
+-			if (pre_vproc < 0) {
+-				dev_err(info->cpu_dev,
+-					"invalid Vproc value: %d\n", pre_vproc);
+-				return pre_vproc;
+-			}
+-			pre_vsram = regulator_get_voltage(sram_reg);
+-			if (pre_vsram < 0) {
+-				dev_err(info->cpu_dev,
+-					"invalid Vsram value: %d\n", pre_vsram);
+-				return pre_vsram;
+-			}
+-
++		} else if (pre_vproc > new_vproc) {
+ 			vproc = max(new_vproc,
+ 				    pre_vsram - soc_data->max_volt_shift);
+ 			ret = regulator_set_voltage(proc_reg, vproc,
+-						    vproc + VOLT_TOL);
++						    soc_data->proc_max_volt);
+ 			if (ret)
+ 				return ret;
+ 
+@@ -174,32 +128,24 @@ static int mtk_cpufreq_voltage_tracking(
+ 				vsram = max(new_vsram,
+ 					    vproc + soc_data->min_volt_shift);
+ 
+-			if (vsram + VOLT_TOL >= soc_data->sram_max_volt) {
+-				vsram = soc_data->sram_max_volt;
+-
+-				/*
+-				 * If the target Vsram hits the maximum voltage,
+-				 * try to set the exact voltage value first.
+-				 */
+-				ret = regulator_set_voltage(sram_reg, vsram,
+-							    vsram);
+-				if (ret)
+-					ret = regulator_set_voltage(sram_reg,
+-							vsram - VOLT_TOL,
+-							vsram);
+-			} else {
+-				ret = regulator_set_voltage(sram_reg, vsram,
+-							    vsram + VOLT_TOL);
+-			}
+-
++			ret = regulator_set_voltage(sram_reg, vsram,
++						    soc_data->sram_max_volt);
+ 			if (ret) {
+ 				regulator_set_voltage(proc_reg, pre_vproc,
+-						      pre_vproc);
++						      soc_data->proc_max_volt);
+ 				return ret;
+ 			}
+-		} while (vproc > new_vproc + VOLT_TOL ||
+-			 vsram > new_vsram + VOLT_TOL);
+-	}
++		}
++
++		pre_vproc = vproc;
++		pre_vsram = vsram;
++
++		if (--retry < 0) {
++			dev_err(info->cpu_dev,
++				"over loop count, failed to set voltage\n");
++			return -EINVAL;
++		}
++	} while (vproc != new_vproc || vsram != new_vsram);
+ 
+ 	return 0;
+ }
+@@ -261,8 +207,8 @@ static int mtk_cpufreq_set_target(struct
+ 	 * If the new voltage or the intermediate voltage is higher than the
+ 	 * current voltage, scale up voltage first.
+ 	 */
+-	target_vproc = (inter_vproc > vproc) ? inter_vproc : vproc;
+-	if (pre_vproc < target_vproc) {
++	target_vproc = max(inter_vproc, vproc);
++	if (pre_vproc <= target_vproc) {
+ 		ret = mtk_cpufreq_set_voltage(info, target_vproc);
+ 		if (ret) {
+ 			dev_err(cpu_dev,
+@@ -417,6 +363,15 @@ static int mtk_cpu_dvfs_info_init(struct
+ 	 */
+ 	info->need_voltage_tracking = (info->sram_reg != NULL);
+ 
++	/*
++	 * We assume min voltage is 0 and tracking target voltage using
++	 * min_volt_shift for each iteration.
++	 * The vtrack_max is 3 times of expeted iteration count.
++	 */
++	info->vtrack_max = 3 * DIV_ROUND_UP(max(info->soc_data->sram_max_volt,
++						info->soc_data->proc_max_volt),
++					    info->soc_data->min_volt_shift);
++
+ 	return 0;
+ 
+ out_disable_inter_clock:
diff --git a/target/linux/mediatek/patches-5.15/350-11-cpufreq-mediatek-Add-opp-notification-support.patch b/target/linux/mediatek/patches-5.15/350-11-cpufreq-mediatek-Add-opp-notification-support.patch
new file mode 100644
index 00000000000000..2cb99b907a6e2f
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/350-11-cpufreq-mediatek-Add-opp-notification-support.patch
@@ -0,0 +1,184 @@
+From 01be227eff7e5fc01f7c8de8f6daddd5fb17ddd1 Mon Sep 17 00:00:00 2001
+From: Rex-BC Chen <rex-bc.chen@mediatek.com>
+Date: Thu, 5 May 2022 19:52:21 +0800
+Subject: [PATCH 11/21] cpufreq: mediatek: Add opp notification support
+
+From this opp notifier, cpufreq should listen to opp notification and do
+proper actions when receiving events of disable and voltage adjustment.
+
+One of the user for this opp notifier is MediaTek SVS.
+The MediaTek Smart Voltage Scaling (SVS) is a hardware which calculates
+suitable SVS bank voltages to OPP voltage table.
+
+Signed-off-by: Andrew-sh.Cheng <andrew-sh.cheng@mediatek.com>
+Signed-off-by: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Signed-off-by: Rex-BC Chen <rex-bc.chen@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+[ Viresh: Renamed opp_freq as current_freq and moved its initialization ]
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 90 +++++++++++++++++++++++++++---
+ 1 file changed, 82 insertions(+), 8 deletions(-)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -46,6 +46,11 @@ struct mtk_cpu_dvfs_info {
+ 	int intermediate_voltage;
+ 	bool need_voltage_tracking;
+ 	int pre_vproc;
++	/* Avoid race condition for regulators between notify and policy */
++	struct mutex reg_lock;
++	struct notifier_block opp_nb;
++	unsigned int opp_cpu;
++	unsigned long current_freq;
+ 	const struct mtk_cpufreq_platform_data *soc_data;
+ 	int vtrack_max;
+ };
+@@ -182,6 +187,8 @@ static int mtk_cpufreq_set_target(struct
+ 
+ 	pre_freq_hz = clk_get_rate(cpu_clk);
+ 
++	mutex_lock(&info->reg_lock);
++
+ 	if (unlikely(info->pre_vproc <= 0))
+ 		pre_vproc = regulator_get_voltage(info->proc_reg);
+ 	else
+@@ -214,7 +221,7 @@ static int mtk_cpufreq_set_target(struct
+ 			dev_err(cpu_dev,
+ 				"cpu%d: failed to scale up voltage!\n", policy->cpu);
+ 			mtk_cpufreq_set_voltage(info, pre_vproc);
+-			return ret;
++			goto out;
+ 		}
+ 	}
+ 
+@@ -224,8 +231,7 @@ static int mtk_cpufreq_set_target(struct
+ 		dev_err(cpu_dev,
+ 			"cpu%d: failed to re-parent cpu clock!\n", policy->cpu);
+ 		mtk_cpufreq_set_voltage(info, pre_vproc);
+-		WARN_ON(1);
+-		return ret;
++		goto out;
+ 	}
+ 
+ 	/* Set the original PLL to target rate. */
+@@ -235,7 +241,7 @@ static int mtk_cpufreq_set_target(struct
+ 			"cpu%d: failed to scale cpu clock rate!\n", policy->cpu);
+ 		clk_set_parent(cpu_clk, armpll);
+ 		mtk_cpufreq_set_voltage(info, pre_vproc);
+-		return ret;
++		goto out;
+ 	}
+ 
+ 	/* Set parent of CPU clock back to the original PLL. */
+@@ -244,8 +250,7 @@ static int mtk_cpufreq_set_target(struct
+ 		dev_err(cpu_dev,
+ 			"cpu%d: failed to re-parent cpu clock!\n", policy->cpu);
+ 		mtk_cpufreq_set_voltage(info, inter_vproc);
+-		WARN_ON(1);
+-		return ret;
++		goto out;
+ 	}
+ 
+ 	/*
+@@ -260,15 +265,72 @@ static int mtk_cpufreq_set_target(struct
+ 			clk_set_parent(cpu_clk, info->inter_clk);
+ 			clk_set_rate(armpll, pre_freq_hz);
+ 			clk_set_parent(cpu_clk, armpll);
+-			return ret;
++			goto out;
+ 		}
+ 	}
+ 
+-	return 0;
++	info->current_freq = freq_hz;
++
++out:
++	mutex_unlock(&info->reg_lock);
++
++	return ret;
+ }
+ 
+ #define DYNAMIC_POWER "dynamic-power-coefficient"
+ 
++static int mtk_cpufreq_opp_notifier(struct notifier_block *nb,
++				    unsigned long event, void *data)
++{
++	struct dev_pm_opp *opp = data;
++	struct dev_pm_opp *new_opp;
++	struct mtk_cpu_dvfs_info *info;
++	unsigned long freq, volt;
++	struct cpufreq_policy *policy;
++	int ret = 0;
++
++	info = container_of(nb, struct mtk_cpu_dvfs_info, opp_nb);
++
++	if (event == OPP_EVENT_ADJUST_VOLTAGE) {
++		freq = dev_pm_opp_get_freq(opp);
++
++		mutex_lock(&info->reg_lock);
++		if (info->current_freq == freq) {
++			volt = dev_pm_opp_get_voltage(opp);
++			ret = mtk_cpufreq_set_voltage(info, volt);
++			if (ret)
++				dev_err(info->cpu_dev,
++					"failed to scale voltage: %d\n", ret);
++		}
++		mutex_unlock(&info->reg_lock);
++	} else if (event == OPP_EVENT_DISABLE) {
++		freq = dev_pm_opp_get_freq(opp);
++
++		/* case of current opp item is disabled */
++		if (info->current_freq == freq) {
++			freq = 1;
++			new_opp = dev_pm_opp_find_freq_ceil(info->cpu_dev,
++							    &freq);
++			if (IS_ERR(new_opp)) {
++				dev_err(info->cpu_dev,
++					"all opp items are disabled\n");
++				ret = PTR_ERR(new_opp);
++				return notifier_from_errno(ret);
++			}
++
++			dev_pm_opp_put(new_opp);
++			policy = cpufreq_cpu_get(info->opp_cpu);
++			if (policy) {
++				cpufreq_driver_target(policy, freq / 1000,
++						      CPUFREQ_RELATION_L);
++				cpufreq_cpu_put(policy);
++			}
++		}
++	}
++
++	return notifier_from_errno(ret);
++}
++
+ static int mtk_cpu_dvfs_info_init(struct mtk_cpu_dvfs_info *info, int cpu)
+ {
+ 	struct device *cpu_dev;
+@@ -357,6 +419,17 @@ static int mtk_cpu_dvfs_info_init(struct
+ 	info->intermediate_voltage = dev_pm_opp_get_voltage(opp);
+ 	dev_pm_opp_put(opp);
+ 
++	mutex_init(&info->reg_lock);
++	info->current_freq = clk_get_rate(info->cpu_clk);
++
++	info->opp_cpu = cpu;
++	info->opp_nb.notifier_call = mtk_cpufreq_opp_notifier;
++	ret = dev_pm_opp_register_notifier(cpu_dev, &info->opp_nb);
++	if (ret) {
++		dev_err(cpu_dev, "cpu%d: failed to register opp notifier\n", cpu);
++		goto out_disable_inter_clock;
++	}
++
+ 	/*
+ 	 * If SRAM regulator is present, software "voltage tracking" is needed
+ 	 * for this CPU power domain.
+@@ -421,6 +494,7 @@ static void mtk_cpu_dvfs_info_release(st
+ 	}
+ 
+ 	dev_pm_opp_of_cpumask_remove_table(&info->cpus);
++	dev_pm_opp_unregister_notifier(info->cpu_dev, &info->opp_nb);
+ }
+ 
+ static int mtk_cpufreq_init(struct cpufreq_policy *policy)
diff --git a/target/linux/mediatek/patches-5.15/350-12-cpufreq-mediatek-Fix-potential-deadlock-problem-in-m.patch b/target/linux/mediatek/patches-5.15/350-12-cpufreq-mediatek-Fix-potential-deadlock-problem-in-m.patch
new file mode 100644
index 00000000000000..76bd795c004afb
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/350-12-cpufreq-mediatek-Fix-potential-deadlock-problem-in-m.patch
@@ -0,0 +1,43 @@
+From 6a1bd7cf4ed7a1948f564aaf16d34b7352c0029b Mon Sep 17 00:00:00 2001
+From: Wan Jiabing <wanjiabing@vivo.com>
+Date: Tue, 10 May 2022 17:05:31 +0800
+Subject: [PATCH 12/21] cpufreq: mediatek: Fix potential deadlock problem in
+ mtk_cpufreq_set_target
+
+Fix following coccichek error:
+./drivers/cpufreq/mediatek-cpufreq.c:199:2-8: preceding lock on line
+./drivers/cpufreq/mediatek-cpufreq.c:208:2-8: preceding lock on line
+
+mutex_lock is acquired but not released before return.
+Use 'goto out' to help releasing the mutex_lock.
+
+Fixes: c210063b40ac ("cpufreq: mediatek: Add opp notification support")
+Signed-off-by: Wan Jiabing <wanjiabing@vivo.com>
+Reviewed-by: Rex-BC Chen <rex-bc.chen@mediatek.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -196,7 +196,8 @@ static int mtk_cpufreq_set_target(struct
+ 
+ 	if (pre_vproc < 0) {
+ 		dev_err(cpu_dev, "invalid Vproc value: %d\n", pre_vproc);
+-		return pre_vproc;
++		ret = pre_vproc;
++		goto out;
+ 	}
+ 
+ 	freq_hz = freq_table[index].frequency * 1000;
+@@ -205,7 +206,8 @@ static int mtk_cpufreq_set_target(struct
+ 	if (IS_ERR(opp)) {
+ 		dev_err(cpu_dev, "cpu%d: failed to find OPP for %ld\n",
+ 			policy->cpu, freq_hz);
+-		return PTR_ERR(opp);
++		ret = PTR_ERR(opp);
++		goto out;
+ 	}
+ 	vproc = dev_pm_opp_get_voltage(opp);
+ 	dev_pm_opp_put(opp);
diff --git a/target/linux/mediatek/patches-5.15/350-13-cpufreq-mediatek-Link-CCI-device-to-CPU.patch b/target/linux/mediatek/patches-5.15/350-13-cpufreq-mediatek-Link-CCI-device-to-CPU.patch
new file mode 100644
index 00000000000000..eeaa466c326d07
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/350-13-cpufreq-mediatek-Link-CCI-device-to-CPU.patch
@@ -0,0 +1,188 @@
+From 15aaf74fb734a3e69b10d00b97b322711b81e222 Mon Sep 17 00:00:00 2001
+From: Rex-BC Chen <rex-bc.chen@mediatek.com>
+Date: Thu, 5 May 2022 19:52:22 +0800
+Subject: [PATCH 13/21] cpufreq: mediatek: Link CCI device to CPU
+
+In some MediaTek SoCs, like MT8183, CPU and CCI share the same power
+supplies. Cpufreq needs to check if CCI devfreq exists and wait until
+CCI devfreq ready before scaling frequency.
+
+Before CCI devfreq is ready, we record the voltage when booting to
+kernel and use the max(cpu target voltage, booting voltage) to
+prevent cpufreq adjust to the lower voltage which will cause the CCI
+crash because of high frequency and low voltage.
+
+- Add is_ccifreq_ready() to link CCI device to CPI, and CPU will start
+  DVFS when CCI is ready.
+- Add platform data for MT8183.
+
+Signed-off-by: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Signed-off-by: Rex-BC Chen <rex-bc.chen@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 82 +++++++++++++++++++++++++++++-
+ 1 file changed, 81 insertions(+), 1 deletion(-)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -22,6 +22,7 @@ struct mtk_cpufreq_platform_data {
+ 	int proc_max_volt;
+ 	int sram_min_volt;
+ 	int sram_max_volt;
++	bool ccifreq_supported;
+ };
+ 
+ /*
+@@ -38,6 +39,7 @@ struct mtk_cpufreq_platform_data {
+ struct mtk_cpu_dvfs_info {
+ 	struct cpumask cpus;
+ 	struct device *cpu_dev;
++	struct device *cci_dev;
+ 	struct regulator *proc_reg;
+ 	struct regulator *sram_reg;
+ 	struct clk *cpu_clk;
+@@ -45,6 +47,7 @@ struct mtk_cpu_dvfs_info {
+ 	struct list_head list_head;
+ 	int intermediate_voltage;
+ 	bool need_voltage_tracking;
++	int vproc_on_boot;
+ 	int pre_vproc;
+ 	/* Avoid race condition for regulators between notify and policy */
+ 	struct mutex reg_lock;
+@@ -53,6 +56,7 @@ struct mtk_cpu_dvfs_info {
+ 	unsigned long current_freq;
+ 	const struct mtk_cpufreq_platform_data *soc_data;
+ 	int vtrack_max;
++	bool ccifreq_bound;
+ };
+ 
+ static struct platform_device *cpufreq_pdev;
+@@ -171,6 +175,28 @@ static int mtk_cpufreq_set_voltage(struc
+ 	return ret;
+ }
+ 
++static bool is_ccifreq_ready(struct mtk_cpu_dvfs_info *info)
++{
++	struct device_link *sup_link;
++
++	if (info->ccifreq_bound)
++		return true;
++
++	sup_link = device_link_add(info->cpu_dev, info->cci_dev,
++				   DL_FLAG_AUTOREMOVE_CONSUMER);
++	if (!sup_link) {
++		dev_err(info->cpu_dev, "cpu%d: sup_link is NULL\n", info->opp_cpu);
++		return false;
++	}
++
++	if (sup_link->supplier->links.status != DL_DEV_DRIVER_BOUND)
++		return false;
++
++	info->ccifreq_bound = true;
++
++	return true;
++}
++
+ static int mtk_cpufreq_set_target(struct cpufreq_policy *policy,
+ 				  unsigned int index)
+ {
+@@ -213,6 +239,14 @@ static int mtk_cpufreq_set_target(struct
+ 	dev_pm_opp_put(opp);
+ 
+ 	/*
++	 * If MediaTek cci is supported but is not ready, we will use the value
++	 * of max(target cpu voltage, booting voltage) to prevent high freqeuncy
++	 * low voltage crash.
++	 */
++	if (info->soc_data->ccifreq_supported && !is_ccifreq_ready(info))
++		vproc = max(vproc, info->vproc_on_boot);
++
++	/*
+ 	 * If the new voltage or the intermediate voltage is higher than the
+ 	 * current voltage, scale up voltage first.
+ 	 */
+@@ -333,6 +367,23 @@ static int mtk_cpufreq_opp_notifier(stru
+ 	return notifier_from_errno(ret);
+ }
+ 
++static struct device *of_get_cci(struct device *cpu_dev)
++{
++	struct device_node *np;
++	struct platform_device *pdev;
++
++	np = of_parse_phandle(cpu_dev->of_node, "mediatek,cci", 0);
++	if (IS_ERR_OR_NULL(np))
++		return NULL;
++
++	pdev = of_find_device_by_node(np);
++	of_node_put(np);
++	if (IS_ERR_OR_NULL(pdev))
++		return NULL;
++
++	return &pdev->dev;
++}
++
+ static int mtk_cpu_dvfs_info_init(struct mtk_cpu_dvfs_info *info, int cpu)
+ {
+ 	struct device *cpu_dev;
+@@ -347,6 +398,16 @@ static int mtk_cpu_dvfs_info_init(struct
+ 	}
+ 	info->cpu_dev = cpu_dev;
+ 
++	info->ccifreq_bound = false;
++	if (info->soc_data->ccifreq_supported) {
++		info->cci_dev = of_get_cci(info->cpu_dev);
++		if (IS_ERR_OR_NULL(info->cci_dev)) {
++			ret = PTR_ERR(info->cci_dev);
++			dev_err(cpu_dev, "cpu%d: failed to get cci device\n", cpu);
++			return -ENODEV;
++		}
++	}
++
+ 	info->cpu_clk = clk_get(cpu_dev, "cpu");
+ 	if (IS_ERR(info->cpu_clk)) {
+ 		ret = PTR_ERR(info->cpu_clk);
+@@ -410,6 +471,15 @@ static int mtk_cpu_dvfs_info_init(struct
+ 	if (ret)
+ 		goto out_disable_mux_clock;
+ 
++	if (info->soc_data->ccifreq_supported) {
++		info->vproc_on_boot = regulator_get_voltage(info->proc_reg);
++		if (info->vproc_on_boot < 0) {
++			dev_err(info->cpu_dev,
++				"invalid Vproc value: %d\n", info->vproc_on_boot);
++			goto out_disable_inter_clock;
++		}
++	}
++
+ 	/* Search a safe voltage for intermediate frequency. */
+ 	rate = clk_get_rate(info->inter_clk);
+ 	opp = dev_pm_opp_find_freq_ceil(cpu_dev, &rate);
+@@ -617,6 +687,16 @@ static const struct mtk_cpufreq_platform
+ 	.proc_max_volt = 1150000,
+ 	.sram_min_volt = 0,
+ 	.sram_max_volt = 1150000,
++	.ccifreq_supported = false,
++};
++
++static const struct mtk_cpufreq_platform_data mt8183_platform_data = {
++	.min_volt_shift = 100000,
++	.max_volt_shift = 200000,
++	.proc_max_volt = 1150000,
++	.sram_min_volt = 0,
++	.sram_max_volt = 1150000,
++	.ccifreq_supported = true,
+ };
+ 
+ /* List of machines supported by this driver */
+@@ -629,7 +709,7 @@ static const struct of_device_id mtk_cpu
+ 	{ .compatible = "mediatek,mt817x", .data = &mt2701_platform_data },
+ 	{ .compatible = "mediatek,mt8173", .data = &mt2701_platform_data },
+ 	{ .compatible = "mediatek,mt8176", .data = &mt2701_platform_data },
+-	{ .compatible = "mediatek,mt8183", .data = &mt2701_platform_data },
++	{ .compatible = "mediatek,mt8183", .data = &mt8183_platform_data },
+ 	{ .compatible = "mediatek,mt8365", .data = &mt2701_platform_data },
+ 	{ .compatible = "mediatek,mt8516", .data = &mt2701_platform_data },
+ 	{ }
diff --git a/target/linux/mediatek/patches-5.15/350-14-cpufreq-mediatek-Add-support-for-MT8186.patch b/target/linux/mediatek/patches-5.15/350-14-cpufreq-mediatek-Add-support-for-MT8186.patch
new file mode 100644
index 00000000000000..31000cfbe058fa
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/350-14-cpufreq-mediatek-Add-support-for-MT8186.patch
@@ -0,0 +1,42 @@
+From b6be0baa6615afc65c3963adab674e36af1d4d5f Mon Sep 17 00:00:00 2001
+From: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Date: Thu, 5 May 2022 19:52:23 +0800
+Subject: [PATCH 14/21] cpufreq: mediatek: Add support for MT8186
+
+The platform data of MT8186 is different from previous MediaTek SoCs,
+so we add a new compatible and platform data for it.
+
+Signed-off-by: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Signed-off-by: Rex-BC Chen <rex-bc.chen@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -699,6 +699,15 @@ static const struct mtk_cpufreq_platform
+ 	.ccifreq_supported = true,
+ };
+ 
++static const struct mtk_cpufreq_platform_data mt8186_platform_data = {
++	.min_volt_shift = 100000,
++	.max_volt_shift = 250000,
++	.proc_max_volt = 1118750,
++	.sram_min_volt = 850000,
++	.sram_max_volt = 1118750,
++	.ccifreq_supported = true,
++};
++
+ /* List of machines supported by this driver */
+ static const struct of_device_id mtk_cpufreq_machines[] __initconst = {
+ 	{ .compatible = "mediatek,mt2701", .data = &mt2701_platform_data },
+@@ -710,6 +719,7 @@ static const struct of_device_id mtk_cpu
+ 	{ .compatible = "mediatek,mt8173", .data = &mt2701_platform_data },
+ 	{ .compatible = "mediatek,mt8176", .data = &mt2701_platform_data },
+ 	{ .compatible = "mediatek,mt8183", .data = &mt8183_platform_data },
++	{ .compatible = "mediatek,mt8186", .data = &mt8186_platform_data },
+ 	{ .compatible = "mediatek,mt8365", .data = &mt2701_platform_data },
+ 	{ .compatible = "mediatek,mt8516", .data = &mt2701_platform_data },
+ 	{ }
diff --git a/target/linux/mediatek/patches-5.15/350-15-cpufreq-mediatek-Handle-sram-regulator-probe-deferra.patch b/target/linux/mediatek/patches-5.15/350-15-cpufreq-mediatek-Handle-sram-regulator-probe-deferra.patch
new file mode 100644
index 00000000000000..c0137894c93413
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/350-15-cpufreq-mediatek-Handle-sram-regulator-probe-deferra.patch
@@ -0,0 +1,35 @@
+From 75d19b24aa3203d6c78e4c431c2cc07157ce12fe Mon Sep 17 00:00:00 2001
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Date: Wed, 13 Jul 2022 13:15:36 +0200
+Subject: [PATCH 15/21] cpufreq: mediatek: Handle sram regulator probe deferral
+
+If the regulator_get_optional() call for the SRAM regulator returns
+a probe deferral, we must bail out and retry probing later: failing
+to do this will produce unstabilities on platforms requiring the
+handling for this regulator.
+
+Fixes: ffa7bdf7f344 ("cpufreq: mediatek: Make sram regulator optional")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -439,9 +439,13 @@ static int mtk_cpu_dvfs_info_init(struct
+ 
+ 	/* Both presence and absence of sram regulator are valid cases. */
+ 	info->sram_reg = regulator_get_optional(cpu_dev, "sram");
+-	if (IS_ERR(info->sram_reg))
++	if (IS_ERR(info->sram_reg)) {
++		ret = PTR_ERR(info->sram_reg);
++		if (ret == -EPROBE_DEFER)
++			goto out_free_resources;
++
+ 		info->sram_reg = NULL;
+-	else {
++	} else {
+ 		ret = regulator_enable(info->sram_reg);
+ 		if (ret) {
+ 			dev_warn(cpu_dev, "cpu%d: failed to enable vsram\n", cpu);
diff --git a/target/linux/mediatek/patches-5.15/350-16-cpufreq-mediatek-fix-error-return-code-in-mtk_cpu_dv.patch b/target/linux/mediatek/patches-5.15/350-16-cpufreq-mediatek-fix-error-return-code-in-mtk_cpu_dv.patch
new file mode 100644
index 00000000000000..45c4477ff1ab1f
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/350-16-cpufreq-mediatek-fix-error-return-code-in-mtk_cpu_dv.patch
@@ -0,0 +1,29 @@
+From dd1174c21dacacd6c0129c1dabc5decad35c02c2 Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Tue, 17 May 2022 21:34:50 +0800
+Subject: [PATCH 16/21] cpufreq: mediatek: fix error return code in
+ mtk_cpu_dvfs_info_init()
+
+If regulator_get_voltage() fails, it should return the error code in
+mtk_cpu_dvfs_info_init().
+
+Fixes: 0daa47325bae ("cpufreq: mediatek: Link CCI device to CPU")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Rex-BC Chen <rex-bc.chen@mediatek.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -478,6 +478,7 @@ static int mtk_cpu_dvfs_info_init(struct
+ 	if (info->soc_data->ccifreq_supported) {
+ 		info->vproc_on_boot = regulator_get_voltage(info->proc_reg);
+ 		if (info->vproc_on_boot < 0) {
++			ret = info->vproc_on_boot;
+ 			dev_err(info->cpu_dev,
+ 				"invalid Vproc value: %d\n", info->vproc_on_boot);
+ 			goto out_disable_inter_clock;
diff --git a/target/linux/mediatek/patches-5.15/350-17-cpufreq-mediatek-fix-passing-zero-to-PTR_ERR.patch b/target/linux/mediatek/patches-5.15/350-17-cpufreq-mediatek-fix-passing-zero-to-PTR_ERR.patch
new file mode 100644
index 00000000000000..557d02b822b3a9
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/350-17-cpufreq-mediatek-fix-passing-zero-to-PTR_ERR.patch
@@ -0,0 +1,47 @@
+From 230a74d459244411db91bfd678f17fcf7aedfcd0 Mon Sep 17 00:00:00 2001
+From: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Date: Fri, 24 Mar 2023 18:11:27 +0800
+Subject: [PATCH 17/21] cpufreq: mediatek: fix passing zero to 'PTR_ERR'
+
+In order to prevent passing zero to 'PTR_ERR' in
+mtk_cpu_dvfs_info_init(), we fix the return value of of_get_cci() using
+error pointer by explicitly casting error number.
+
+Signed-off-by: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Fixes: 0daa47325bae ("cpufreq: mediatek: Link CCI device to CPU")
+Reported-by: Dan Carpenter <error27@gmail.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -373,13 +373,13 @@ static struct device *of_get_cci(struct
+ 	struct platform_device *pdev;
+ 
+ 	np = of_parse_phandle(cpu_dev->of_node, "mediatek,cci", 0);
+-	if (IS_ERR_OR_NULL(np))
+-		return NULL;
++	if (!np)
++		return ERR_PTR(-ENODEV);
+ 
+ 	pdev = of_find_device_by_node(np);
+ 	of_node_put(np);
+-	if (IS_ERR_OR_NULL(pdev))
+-		return NULL;
++	if (!pdev)
++		return ERR_PTR(-ENODEV);
+ 
+ 	return &pdev->dev;
+ }
+@@ -401,7 +401,7 @@ static int mtk_cpu_dvfs_info_init(struct
+ 	info->ccifreq_bound = false;
+ 	if (info->soc_data->ccifreq_supported) {
+ 		info->cci_dev = of_get_cci(info->cpu_dev);
+-		if (IS_ERR_OR_NULL(info->cci_dev)) {
++		if (IS_ERR(info->cci_dev)) {
+ 			ret = PTR_ERR(info->cci_dev);
+ 			dev_err(cpu_dev, "cpu%d: failed to get cci device\n", cpu);
+ 			return -ENODEV;
diff --git a/target/linux/mediatek/patches-5.15/350-18-cpufreq-mediatek-fix-KP-caused-by-handler-usage-afte.patch b/target/linux/mediatek/patches-5.15/350-18-cpufreq-mediatek-fix-KP-caused-by-handler-usage-afte.patch
new file mode 100644
index 00000000000000..61531d38ad2910
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/350-18-cpufreq-mediatek-fix-KP-caused-by-handler-usage-afte.patch
@@ -0,0 +1,149 @@
+From fced531b7c7e18192e7982637c8e8f20c29aad64 Mon Sep 17 00:00:00 2001
+From: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Date: Fri, 24 Mar 2023 18:11:28 +0800
+Subject: [PATCH 18/21] cpufreq: mediatek: fix KP caused by handler usage after
+ regulator_put/clk_put
+
+Any kind of failure in mtk_cpu_dvfs_info_init() will lead to calling
+regulator_put() or clk_put() and the KP will occur since the regulator/clk
+handlers are used after released in mtk_cpu_dvfs_info_release().
+
+To prevent the usage after regulator_put()/clk_put(), the regulator/clk
+handlers are addressed in a way of "Free the Last Thing Style".
+
+Signed-off-by: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Fixes: 4b9ceb757bbb ("cpufreq: mediatek: Enable clocks and regulators")
+Suggested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Suggested-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 62 +++++++++++++++---------------
+ 1 file changed, 30 insertions(+), 32 deletions(-)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -420,7 +420,7 @@ static int mtk_cpu_dvfs_info_init(struct
+ 		ret = PTR_ERR(info->inter_clk);
+ 		dev_err_probe(cpu_dev, ret,
+ 			      "cpu%d: failed to get intermediate clk\n", cpu);
+-		goto out_free_resources;
++		goto out_free_mux_clock;
+ 	}
+ 
+ 	info->proc_reg = regulator_get_optional(cpu_dev, "proc");
+@@ -428,13 +428,13 @@ static int mtk_cpu_dvfs_info_init(struct
+ 		ret = PTR_ERR(info->proc_reg);
+ 		dev_err_probe(cpu_dev, ret,
+ 			      "cpu%d: failed to get proc regulator\n", cpu);
+-		goto out_free_resources;
++		goto out_free_inter_clock;
+ 	}
+ 
+ 	ret = regulator_enable(info->proc_reg);
+ 	if (ret) {
+ 		dev_warn(cpu_dev, "cpu%d: failed to enable vproc\n", cpu);
+-		goto out_free_resources;
++		goto out_free_proc_reg;
+ 	}
+ 
+ 	/* Both presence and absence of sram regulator are valid cases. */
+@@ -442,14 +442,14 @@ static int mtk_cpu_dvfs_info_init(struct
+ 	if (IS_ERR(info->sram_reg)) {
+ 		ret = PTR_ERR(info->sram_reg);
+ 		if (ret == -EPROBE_DEFER)
+-			goto out_free_resources;
++			goto out_disable_proc_reg;
+ 
+ 		info->sram_reg = NULL;
+ 	} else {
+ 		ret = regulator_enable(info->sram_reg);
+ 		if (ret) {
+ 			dev_warn(cpu_dev, "cpu%d: failed to enable vsram\n", cpu);
+-			goto out_free_resources;
++			goto out_free_sram_reg;
+ 		}
+ 	}
+ 
+@@ -458,13 +458,13 @@ static int mtk_cpu_dvfs_info_init(struct
+ 	if (ret) {
+ 		dev_err(cpu_dev,
+ 			"cpu%d: failed to get OPP-sharing information\n", cpu);
+-		goto out_free_resources;
++		goto out_disable_sram_reg;
+ 	}
+ 
+ 	ret = dev_pm_opp_of_cpumask_add_table(&info->cpus);
+ 	if (ret) {
+ 		dev_warn(cpu_dev, "cpu%d: no OPP table\n", cpu);
+-		goto out_free_resources;
++		goto out_disable_sram_reg;
+ 	}
+ 
+ 	ret = clk_prepare_enable(info->cpu_clk);
+@@ -533,43 +533,41 @@ out_disable_mux_clock:
+ out_free_opp_table:
+ 	dev_pm_opp_of_cpumask_remove_table(&info->cpus);
+ 
+-out_free_resources:
+-	if (regulator_is_enabled(info->proc_reg))
+-		regulator_disable(info->proc_reg);
+-	if (info->sram_reg && regulator_is_enabled(info->sram_reg))
++out_disable_sram_reg:
++	if (info->sram_reg)
+ 		regulator_disable(info->sram_reg);
+ 
+-	if (!IS_ERR(info->proc_reg))
+-		regulator_put(info->proc_reg);
+-	if (!IS_ERR(info->sram_reg))
++out_free_sram_reg:
++	if (info->sram_reg)
+ 		regulator_put(info->sram_reg);
+-	if (!IS_ERR(info->cpu_clk))
+-		clk_put(info->cpu_clk);
+-	if (!IS_ERR(info->inter_clk))
+-		clk_put(info->inter_clk);
++
++out_disable_proc_reg:
++	regulator_disable(info->proc_reg);
++
++out_free_proc_reg:
++	regulator_put(info->proc_reg);
++
++out_free_inter_clock:
++	clk_put(info->inter_clk);
++
++out_free_mux_clock:
++	clk_put(info->cpu_clk);
+ 
+ 	return ret;
+ }
+ 
+ static void mtk_cpu_dvfs_info_release(struct mtk_cpu_dvfs_info *info)
+ {
+-	if (!IS_ERR(info->proc_reg)) {
+-		regulator_disable(info->proc_reg);
+-		regulator_put(info->proc_reg);
+-	}
+-	if (!IS_ERR(info->sram_reg)) {
++	regulator_disable(info->proc_reg);
++	regulator_put(info->proc_reg);
++	if (info->sram_reg) {
+ 		regulator_disable(info->sram_reg);
+ 		regulator_put(info->sram_reg);
+ 	}
+-	if (!IS_ERR(info->cpu_clk)) {
+-		clk_disable_unprepare(info->cpu_clk);
+-		clk_put(info->cpu_clk);
+-	}
+-	if (!IS_ERR(info->inter_clk)) {
+-		clk_disable_unprepare(info->inter_clk);
+-		clk_put(info->inter_clk);
+-	}
+-
++	clk_disable_unprepare(info->cpu_clk);
++	clk_put(info->cpu_clk);
++	clk_disable_unprepare(info->inter_clk);
++	clk_put(info->inter_clk);
+ 	dev_pm_opp_of_cpumask_remove_table(&info->cpus);
+ 	dev_pm_opp_unregister_notifier(info->cpu_dev, &info->opp_nb);
+ }
diff --git a/target/linux/mediatek/patches-5.15/350-19-cpufreq-mediatek-raise-proc-sram-max-voltage-for-MT8.patch b/target/linux/mediatek/patches-5.15/350-19-cpufreq-mediatek-raise-proc-sram-max-voltage-for-MT8.patch
new file mode 100644
index 00000000000000..2b7d229f1c5d47
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/350-19-cpufreq-mediatek-raise-proc-sram-max-voltage-for-MT8.patch
@@ -0,0 +1,55 @@
+From 24bc42a2d44cb821818717a5c607270921ec5d20 Mon Sep 17 00:00:00 2001
+From: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Date: Fri, 24 Mar 2023 18:11:29 +0800
+Subject: [PATCH 19/21] cpufreq: mediatek: raise proc/sram max voltage for
+ MT8516
+
+Since the upper boundary of proc/sram voltage of MT8516 is 1300 mV,
+which is greater than the value of MT2701 1150 mV, we fix it by adding
+the corresponding platform data and specify proc/sram_max_volt to
+support MT8516.
+
+Signed-off-by: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Fixes: ead858bd128d ("cpufreq: mediatek: Move voltage limits to platform data")
+Fixes: 6a17b3876bc8 ("cpufreq: mediatek: Refine mtk_cpufreq_voltage_tracking()")
+Reported-by: Nick Hainke <vincent@systemli.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -711,20 +711,29 @@ static const struct mtk_cpufreq_platform
+ 	.ccifreq_supported = true,
+ };
+ 
++static const struct mtk_cpufreq_platform_data mt8516_platform_data = {
++	.min_volt_shift = 100000,
++	.max_volt_shift = 200000,
++	.proc_max_volt = 1310000,
++	.sram_min_volt = 0,
++	.sram_max_volt = 1310000,
++	.ccifreq_supported = false,
++};
++
+ /* List of machines supported by this driver */
+ static const struct of_device_id mtk_cpufreq_machines[] __initconst = {
+ 	{ .compatible = "mediatek,mt2701", .data = &mt2701_platform_data },
+ 	{ .compatible = "mediatek,mt2712", .data = &mt2701_platform_data },
+ 	{ .compatible = "mediatek,mt7622", .data = &mt2701_platform_data },
+ 	{ .compatible = "mediatek,mt7623", .data = &mt2701_platform_data },
+-	{ .compatible = "mediatek,mt8167", .data = &mt2701_platform_data },
++	{ .compatible = "mediatek,mt8167", .data = &mt8516_platform_data },
+ 	{ .compatible = "mediatek,mt817x", .data = &mt2701_platform_data },
+ 	{ .compatible = "mediatek,mt8173", .data = &mt2701_platform_data },
+ 	{ .compatible = "mediatek,mt8176", .data = &mt2701_platform_data },
+ 	{ .compatible = "mediatek,mt8183", .data = &mt8183_platform_data },
+ 	{ .compatible = "mediatek,mt8186", .data = &mt8186_platform_data },
+ 	{ .compatible = "mediatek,mt8365", .data = &mt2701_platform_data },
+-	{ .compatible = "mediatek,mt8516", .data = &mt2701_platform_data },
++	{ .compatible = "mediatek,mt8516", .data = &mt8516_platform_data },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(of, mtk_cpufreq_machines);
diff --git a/target/linux/mediatek/patches-5.15/350-20-cpufreq-mediatek-Raise-proc-and-sram-max-voltage-for.patch b/target/linux/mediatek/patches-5.15/350-20-cpufreq-mediatek-Raise-proc-and-sram-max-voltage-for.patch
new file mode 100644
index 00000000000000..2de8eb6394ca2d
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/350-20-cpufreq-mediatek-Raise-proc-and-sram-max-voltage-for.patch
@@ -0,0 +1,58 @@
+From fe6ef09358dc0cfead9d383a8676fbe7a40fcef7 Mon Sep 17 00:00:00 2001
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Date: Fri, 24 Mar 2023 18:11:30 +0800
+Subject: [PATCH 20/21] cpufreq: mediatek: Raise proc and sram max voltage for
+ MT7622/7623
+
+During the addition of SRAM voltage tracking for CCI scaling, this
+driver got some voltage limits set for the vtrack algorithm: these
+were moved to platform data first, then enforced in a later commit
+6a17b3876bc8 ("cpufreq: mediatek: Refine mtk_cpufreq_voltage_tracking()")
+using these as max values for the regulator_set_voltage() calls.
+
+In this case, the vsram/vproc constraints for MT7622 and MT7623
+were supposed to be the same as MT2701 (and a number of other SoCs),
+but that turned out to be a mistake because the aforementioned two
+SoCs' maximum voltage for both VPROC and VPROC_SRAM is 1.36V.
+
+Fix that by adding new platform data for MT7622/7623 declaring the
+right {proc,sram}_max_volt parameter.
+
+Fixes: ead858bd128d ("cpufreq: mediatek: Move voltage limits to platform data")
+Fixes: 6a17b3876bc8 ("cpufreq: mediatek: Refine mtk_cpufreq_voltage_tracking()")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -693,6 +693,15 @@ static const struct mtk_cpufreq_platform
+ 	.ccifreq_supported = false,
+ };
+ 
++static const struct mtk_cpufreq_platform_data mt7622_platform_data = {
++	.min_volt_shift = 100000,
++	.max_volt_shift = 200000,
++	.proc_max_volt = 1360000,
++	.sram_min_volt = 0,
++	.sram_max_volt = 1360000,
++	.ccifreq_supported = false,
++};
++
+ static const struct mtk_cpufreq_platform_data mt8183_platform_data = {
+ 	.min_volt_shift = 100000,
+ 	.max_volt_shift = 200000,
+@@ -724,8 +733,8 @@ static const struct mtk_cpufreq_platform
+ static const struct of_device_id mtk_cpufreq_machines[] __initconst = {
+ 	{ .compatible = "mediatek,mt2701", .data = &mt2701_platform_data },
+ 	{ .compatible = "mediatek,mt2712", .data = &mt2701_platform_data },
+-	{ .compatible = "mediatek,mt7622", .data = &mt2701_platform_data },
+-	{ .compatible = "mediatek,mt7623", .data = &mt2701_platform_data },
++	{ .compatible = "mediatek,mt7622", .data = &mt7622_platform_data },
++	{ .compatible = "mediatek,mt7623", .data = &mt7622_platform_data },
+ 	{ .compatible = "mediatek,mt8167", .data = &mt8516_platform_data },
+ 	{ .compatible = "mediatek,mt817x", .data = &mt2701_platform_data },
+ 	{ .compatible = "mediatek,mt8173", .data = &mt2701_platform_data },
diff --git a/target/linux/mediatek/patches-5.15/350-21-cpufreq-mediatek-Add-support-for-MT7988.patch b/target/linux/mediatek/patches-5.15/350-21-cpufreq-mediatek-Add-support-for-MT7988.patch
new file mode 100644
index 00000000000000..6acd3d607fbb3b
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/350-21-cpufreq-mediatek-Add-support-for-MT7988.patch
@@ -0,0 +1,41 @@
+From 4983a1517e7ddbc6f53fc07607e4ebeb51412843 Mon Sep 17 00:00:00 2001
+From: Sam Shih <sam.shih@mediatek.com>
+Date: Tue, 28 Feb 2023 19:59:22 +0800
+Subject: [PATCH 21/21] cpufreq: mediatek: Add support for MT7988
+
+This add cpufreq support for mediatek MT7988 SoC.
+
+The platform data of MT7988 is different from previous MediaTek SoCs,
+so we add a new compatible and platform data for it.
+
+Signed-off-by: Sam Shih <sam.shih@mediatek.com>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -702,6 +702,15 @@ static const struct mtk_cpufreq_platform
+ 	.ccifreq_supported = false,
+ };
+ 
++static const struct mtk_cpufreq_platform_data mt7988_platform_data = {
++	.min_volt_shift = 100000,
++	.max_volt_shift = 200000,
++	.proc_max_volt = 900000,
++	.sram_min_volt = 0,
++	.sram_max_volt = 1150000,
++	.ccifreq_supported = true,
++};
++
+ static const struct mtk_cpufreq_platform_data mt8183_platform_data = {
+ 	.min_volt_shift = 100000,
+ 	.max_volt_shift = 200000,
+@@ -735,6 +744,7 @@ static const struct of_device_id mtk_cpu
+ 	{ .compatible = "mediatek,mt2712", .data = &mt2701_platform_data },
+ 	{ .compatible = "mediatek,mt7622", .data = &mt7622_platform_data },
+ 	{ .compatible = "mediatek,mt7623", .data = &mt7622_platform_data },
++	{ .compatible = "mediatek,mt7988", .data = &mt7988_platform_data },
+ 	{ .compatible = "mediatek,mt8167", .data = &mt8516_platform_data },
+ 	{ .compatible = "mediatek,mt817x", .data = &mt2701_platform_data },
+ 	{ .compatible = "mediatek,mt8173", .data = &mt2701_platform_data },
diff --git a/target/linux/mediatek/patches-5.15/351-cpufreq-mediatek-correct-voltages-for-MT7622-and-MT7.patch b/target/linux/mediatek/patches-5.15/351-cpufreq-mediatek-correct-voltages-for-MT7622-and-MT7.patch
new file mode 100644
index 00000000000000..6ab05b897c3e39
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/351-cpufreq-mediatek-correct-voltages-for-MT7622-and-MT7.patch
@@ -0,0 +1,53 @@
+From e7697814c142c99f470c3458d49e41b25a575f23 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Fri, 26 May 2023 10:31:40 +0100
+Subject: [PATCH] cpufreq: mediatek: correct voltages for MT7622 and MT7623
+
+The MT6380 regulator typically used together with MT7622 does not
+support the current maximum processor and SRAM voltage in the cpufreq
+driver (1360000uV).
+For MT7622 limit processor and SRAM supply voltages to 1350000uV to
+avoid having the tracking algorithm request unsupported voltages from
+the regulator.
+
+On MT7623 there is no separate SRAM supply and the maximum voltage used
+is 1300000uV. Create dedicated platform data for MT7623 to cover that
+case as well.
+
+Fixes: 0883426fd07e3 ("cpufreq: mediatek: Raise proc and sram max voltage for MT7622/7623")
+Suggested-by: Jia-wei Chang <Jia-wei.Chang@mediatek.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -696,9 +696,16 @@ static const struct mtk_cpufreq_platform
+ static const struct mtk_cpufreq_platform_data mt7622_platform_data = {
+ 	.min_volt_shift = 100000,
+ 	.max_volt_shift = 200000,
+-	.proc_max_volt = 1360000,
++	.proc_max_volt = 1350000,
+ 	.sram_min_volt = 0,
+-	.sram_max_volt = 1360000,
++	.sram_max_volt = 1350000,
++	.ccifreq_supported = false,
++};
++
++static const struct mtk_cpufreq_platform_data mt7623_platform_data = {
++	.min_volt_shift = 100000,
++	.max_volt_shift = 200000,
++	.proc_max_volt = 1300000,
+ 	.ccifreq_supported = false,
+ };
+ 
+@@ -743,7 +750,7 @@ static const struct of_device_id mtk_cpu
+ 	{ .compatible = "mediatek,mt2701", .data = &mt2701_platform_data },
+ 	{ .compatible = "mediatek,mt2712", .data = &mt2701_platform_data },
+ 	{ .compatible = "mediatek,mt7622", .data = &mt7622_platform_data },
+-	{ .compatible = "mediatek,mt7623", .data = &mt7622_platform_data },
++	{ .compatible = "mediatek,mt7623", .data = &mt7623_platform_data },
+ 	{ .compatible = "mediatek,mt7988", .data = &mt7988_platform_data },
+ 	{ .compatible = "mediatek,mt8167", .data = &mt8516_platform_data },
+ 	{ .compatible = "mediatek,mt817x", .data = &mt2701_platform_data },
diff --git a/target/linux/mediatek/patches-5.15/410-bt-mtk-serial-fix.patch b/target/linux/mediatek/patches-5.15/410-bt-mtk-serial-fix.patch
index a5836a826847b5..3f4597c65d68f8 100644
--- a/target/linux/mediatek/patches-5.15/410-bt-mtk-serial-fix.patch
+++ b/target/linux/mediatek/patches-5.15/410-bt-mtk-serial-fix.patch
@@ -10,7 +10,7 @@
  #define UART_BUG_TXEN	BIT(1)	/* UART has buggy TX IIR status */
 --- a/drivers/tty/serial/8250/8250_port.c
 +++ b/drivers/tty/serial/8250/8250_port.c
-@@ -288,7 +288,7 @@ static const struct serial8250_config ua
+@@ -289,7 +289,7 @@ static const struct serial8250_config ua
  		.tx_loadsz	= 16,
  		.fcr		= UART_FCR_ENABLE_FIFO |
  				  UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT,
@@ -19,7 +19,7 @@
  	},
  	[PORT_NPCM] = {
  		.name		= "Nuvoton 16550",
-@@ -2745,6 +2745,11 @@ serial8250_do_set_termios(struct uart_po
+@@ -2766,6 +2766,11 @@ serial8250_do_set_termios(struct uart_po
  	unsigned long flags;
  	unsigned int baud, quot, frac = 0;
  
diff --git a/target/linux/mediatek/patches-5.15/431-drivers-spi-mt65xx-Move-chip_config-to-driver-s-priv.patch b/target/linux/mediatek/patches-5.15/431-drivers-spi-mt65xx-Move-chip_config-to-driver-s-priv.patch
new file mode 100644
index 00000000000000..a57ee253938433
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/431-drivers-spi-mt65xx-Move-chip_config-to-driver-s-priv.patch
@@ -0,0 +1,130 @@
+From bfd3acc428085742d754a6d328d1a93ebf9451df Mon Sep 17 00:00:00 2001
+From: "SkyLake.Huang" <skylake.huang@mediatek.com>
+Date: Thu, 23 Jun 2022 18:29:51 +0800
+Subject: [PATCH 1/6] drivers: spi-mt65xx: Move chip_config to driver's private
+ data
+
+Signed-off-by: SkyLake.Huang <skylake.huang@mediatek.com>
+---
+ drivers/spi/spi-mt65xx.c                 | 29 +++++++++---------------
+ include/linux/platform_data/spi-mt65xx.h | 17 --------------
+ 2 files changed, 11 insertions(+), 35 deletions(-)
+ delete mode 100644 include/linux/platform_data/spi-mt65xx.h
+
+--- a/drivers/spi/spi-mt65xx.c
++++ b/drivers/spi/spi-mt65xx.c
+@@ -14,7 +14,6 @@
+ #include <linux/of.h>
+ #include <linux/gpio/consumer.h>
+ #include <linux/platform_device.h>
+-#include <linux/platform_data/spi-mt65xx.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/spi/spi.h>
+ #include <linux/spi/spi-mem.h>
+@@ -142,6 +141,8 @@ struct mtk_spi {
+ 	struct device *dev;
+ 	dma_addr_t tx_dma;
+ 	dma_addr_t rx_dma;
++	u32 sample_sel;
++	u32 get_tick_dly;
+ };
+ 
+ static const struct mtk_spi_compatible mtk_common_compat;
+@@ -187,15 +188,6 @@ static const struct mtk_spi_compatible m
+ 	.no_need_unprepare = true,
+ };
+ 
+-/*
+- * A piece of default chip info unless the platform
+- * supplies it.
+- */
+-static const struct mtk_chip_config mtk_default_chip_info = {
+-	.sample_sel = 0,
+-	.tick_delay = 0,
+-};
+-
+ static const struct of_device_id mtk_spi_of_match[] = {
+ 	{ .compatible = "mediatek,spi-ipm",
+ 		.data = (void *)&mtk_ipm_compat,
+@@ -323,7 +315,6 @@ static int mtk_spi_hw_init(struct spi_ma
+ {
+ 	u16 cpha, cpol;
+ 	u32 reg_val;
+-	struct mtk_chip_config *chip_config = spi->controller_data;
+ 	struct mtk_spi *mdata = spi_master_get_devdata(master);
+ 
+ 	cpha = spi->mode & SPI_CPHA ? 1 : 0;
+@@ -373,7 +364,7 @@ static int mtk_spi_hw_init(struct spi_ma
+ 		else
+ 			reg_val &= ~SPI_CMD_CS_POL;
+ 
+-		if (chip_config->sample_sel)
++		if (mdata->sample_sel)
+ 			reg_val |= SPI_CMD_SAMPLE_SEL;
+ 		else
+ 			reg_val &= ~SPI_CMD_SAMPLE_SEL;
+@@ -400,20 +391,20 @@ static int mtk_spi_hw_init(struct spi_ma
+ 		if (mdata->dev_comp->ipm_design) {
+ 			reg_val = readl(mdata->base + SPI_CMD_REG);
+ 			reg_val &= ~SPI_CMD_IPM_GET_TICKDLY_MASK;
+-			reg_val |= ((chip_config->tick_delay & 0x7)
++			reg_val |= ((mdata->get_tick_dly & 0x7)
+ 				    << SPI_CMD_IPM_GET_TICKDLY_OFFSET);
+ 			writel(reg_val, mdata->base + SPI_CMD_REG);
+ 		} else {
+ 			reg_val = readl(mdata->base + SPI_CFG1_REG);
+ 			reg_val &= ~SPI_CFG1_GET_TICK_DLY_MASK;
+-			reg_val |= ((chip_config->tick_delay & 0x7)
++			reg_val |= ((mdata->get_tick_dly & 0x7)
+ 				    << SPI_CFG1_GET_TICK_DLY_OFFSET);
+ 			writel(reg_val, mdata->base + SPI_CFG1_REG);
+ 		}
+ 	} else {
+ 		reg_val = readl(mdata->base + SPI_CFG1_REG);
+ 		reg_val &= ~SPI_CFG1_GET_TICK_DLY_MASK_V1;
+-		reg_val |= ((chip_config->tick_delay & 0x3)
++		reg_val |= ((mdata->get_tick_dly & 0x3)
+ 			    << SPI_CFG1_GET_TICK_DLY_OFFSET_V1);
+ 		writel(reg_val, mdata->base + SPI_CFG1_REG);
+ 	}
+@@ -700,9 +691,6 @@ static int mtk_spi_setup(struct spi_devi
+ {
+ 	struct mtk_spi *mdata = spi_master_get_devdata(spi->master);
+ 
+-	if (!spi->controller_data)
+-		spi->controller_data = (void *)&mtk_default_chip_info;
+-
+ 	if (mdata->dev_comp->need_pad_sel && spi->cs_gpiod)
+ 		/* CS de-asserted, gpiolib will handle inversion */
+ 		gpiod_direction_output(spi->cs_gpiod, 0);
+@@ -1115,6 +1103,10 @@ static int mtk_spi_probe(struct platform
+ 	mdata = spi_master_get_devdata(master);
+ 	mdata->dev_comp = of_id->data;
+ 
++	/* Set device configs to default first. Calibrate it later. */
++	mdata->sample_sel = 0;
++	mdata->get_tick_dly = 2;
++
+ 	if (mdata->dev_comp->enhance_timing)
+ 		master->mode_bits |= SPI_CS_HIGH;
+ 
+--- a/include/linux/platform_data/spi-mt65xx.h
++++ /dev/null
+@@ -1,17 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0-only */
+-/*
+- *  MTK SPI bus driver definitions
+- *
+- * Copyright (c) 2015 MediaTek Inc.
+- * Author: Leilk Liu <leilk.liu@mediatek.com>
+- */
+-
+-#ifndef ____LINUX_PLATFORM_DATA_SPI_MTK_H
+-#define ____LINUX_PLATFORM_DATA_SPI_MTK_H
+-
+-/* Board specific platform_data */
+-struct mtk_chip_config {
+-	u32 sample_sel;
+-	u32 tick_delay;
+-};
+-#endif
diff --git a/target/linux/mediatek/patches-5.15/432-drivers-spi-Add-support-for-dynamic-calibration.patch b/target/linux/mediatek/patches-5.15/432-drivers-spi-Add-support-for-dynamic-calibration.patch
new file mode 100644
index 00000000000000..4c980e9438d1ee
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/432-drivers-spi-Add-support-for-dynamic-calibration.patch
@@ -0,0 +1,236 @@
+From 2ade0172154e50c8a2bfd8634c6eff943cffea29 Mon Sep 17 00:00:00 2001
+From: "SkyLake.Huang" <skylake.huang@mediatek.com>
+Date: Thu, 23 Jun 2022 18:35:52 +0800
+Subject: [PATCH 2/6] drivers: spi: Add support for dynamic calibration
+
+Signed-off-by: SkyLake.Huang <skylake.huang@mediatek.com>
+---
+ drivers/spi/spi.c       | 137 ++++++++++++++++++++++++++++++++++++++++
+ include/linux/spi/spi.h |  42 ++++++++++++
+ 2 files changed, 179 insertions(+)
+
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -1234,6 +1234,70 @@ static int spi_transfer_wait(struct spi_
+ 	return 0;
+ }
+ 
++int spi_do_calibration(struct spi_controller *ctlr, struct spi_device *spi,
++	int (*cal_read)(void *priv, u32 *addr, int addrlen, u8 *buf, int readlen), void *drv_priv)
++{
++	int datalen = ctlr->cal_rule->datalen;
++	int addrlen = ctlr->cal_rule->addrlen;
++	u8 *buf;
++	int ret;
++	int i;
++	struct list_head *cal_head, *listptr;
++	struct spi_cal_target *target;
++
++	/* Calculate calibration result */
++	int hit_val, total_hit, origin;
++	bool hit;
++
++	/* Make sure we can start calibration */
++	if(!ctlr->cal_target || !ctlr->cal_rule || !ctlr->append_caldata)
++		return 0;
++
++	buf = kzalloc(datalen * sizeof(u8), GFP_KERNEL);
++	if(!buf)
++		return -ENOMEM;
++
++	ret = ctlr->append_caldata(ctlr);
++	if (ret)
++		goto cal_end;
++
++	cal_head = ctlr->cal_target;
++	list_for_each(listptr, cal_head) {
++		target = list_entry(listptr, struct spi_cal_target, list);
++
++		hit = false;
++		hit_val = 0;
++		total_hit = 0;
++		origin = *target->cal_item;
++
++		for(i=target->cal_min; i<=target->cal_max; i+=target->step) {
++			*target->cal_item = i;
++			ret = (*cal_read)(drv_priv, ctlr->cal_rule->addr, addrlen, buf, datalen);
++			if(ret)
++				break;
++			dev_dbg(&spi->dev, "controller cal item value: 0x%x\n", i);
++			if(memcmp(ctlr->cal_rule->match_data, buf, datalen * sizeof(u8)) == 0) {
++				hit = true;
++				hit_val += i;
++				total_hit++;
++				dev_dbg(&spi->dev, "golden data matches data read!\n");
++			}
++		}
++		if(hit) {
++			*target->cal_item = DIV_ROUND_CLOSEST(hit_val, total_hit);
++			dev_info(&spi->dev, "calibration result: 0x%x", *target->cal_item);
++		} else {
++			*target->cal_item = origin;
++			dev_warn(&spi->dev, "calibration failed, fallback to default: 0x%x", origin);
++		}
++	}
++
++cal_end:
++	kfree(buf);
++	return ret? ret: 0;
++}
++EXPORT_SYMBOL_GPL(spi_do_calibration);
++
+ static void _spi_transfer_delay_ns(u32 ns)
+ {
+ 	if (!ns)
+@@ -2021,6 +2085,75 @@ void spi_flush_queue(struct spi_controll
+ /*-------------------------------------------------------------------------*/
+ 
+ #if defined(CONFIG_OF)
++static inline void alloc_cal_data(struct list_head **cal_target,
++	struct spi_cal_rule **cal_rule, bool enable)
++{
++	if(enable) {
++		*cal_target = kmalloc(sizeof(struct list_head), GFP_KERNEL);
++		INIT_LIST_HEAD(*cal_target);
++		*cal_rule = kmalloc(sizeof(struct spi_cal_rule), GFP_KERNEL);
++	} else {
++		kfree(*cal_target);
++		kfree(*cal_rule);
++	}
++}
++
++static int of_spi_parse_cal_dt(struct spi_controller *ctlr, struct spi_device *spi,
++			   struct device_node *nc)
++{
++	u32 value;
++	int rc;
++	const char *cal_mode;
++
++	rc = of_property_read_bool(nc, "spi-cal-enable");
++	if (rc)
++		alloc_cal_data(&ctlr->cal_target, &ctlr->cal_rule, true);
++	else
++		return 0;
++
++	rc = of_property_read_string(nc, "spi-cal-mode", &cal_mode);
++	if(!rc) {
++		if(strcmp("read-data", cal_mode) == 0){
++			ctlr->cal_rule->mode = SPI_CAL_READ_DATA;
++		} else if(strcmp("read-pp", cal_mode) == 0) {
++			ctlr->cal_rule->mode = SPI_CAL_READ_PP;
++			return 0;
++		} else if(strcmp("read-sfdp", cal_mode) == 0){
++			ctlr->cal_rule->mode = SPI_CAL_READ_SFDP;
++			return 0;
++		}
++	} else
++		goto err;
++
++	ctlr->cal_rule->datalen = 0;
++	rc = of_property_read_u32(nc, "spi-cal-datalen", &value);
++	if(!rc && value > 0) {
++		ctlr->cal_rule->datalen = value;
++
++		ctlr->cal_rule->match_data = kzalloc(value * sizeof(u8), GFP_KERNEL);
++		rc = of_property_read_u8_array(nc, "spi-cal-data",
++				ctlr->cal_rule->match_data, value);
++		if(rc)
++			kfree(ctlr->cal_rule->match_data);
++	}
++
++	rc = of_property_read_u32(nc, "spi-cal-addrlen", &value);
++	if(!rc && value > 0) {
++		ctlr->cal_rule->addrlen = value;
++
++		ctlr->cal_rule->addr = kzalloc(value * sizeof(u32), GFP_KERNEL);
++		rc = of_property_read_u32_array(nc, "spi-cal-addr",
++				ctlr->cal_rule->addr, value);
++		if(rc)
++			kfree(ctlr->cal_rule->addr);
++	}
++	return 0;
++
++err:
++	alloc_cal_data(&ctlr->cal_target, &ctlr->cal_rule, false);
++	return 0;
++}
++
+ static int of_spi_parse_dt(struct spi_controller *ctlr, struct spi_device *spi,
+ 			   struct device_node *nc)
+ {
+@@ -2139,6 +2272,10 @@ of_register_spi_device(struct spi_contro
+ 	if (rc)
+ 		goto err_out;
+ 
++	rc = of_spi_parse_cal_dt(ctlr, spi, nc);
++	if (rc)
++		goto err_out;
++
+ 	/* Store a pointer to the node in the device structure */
+ 	of_node_get(nc);
+ 	spi->dev.of_node = nc;
+--- a/include/linux/spi/spi.h
++++ b/include/linux/spi/spi.h
+@@ -290,6 +290,40 @@ struct spi_driver {
+ 	struct device_driver	driver;
+ };
+ 
++enum {
++	SPI_CAL_READ_DATA = 0,
++	SPI_CAL_READ_PP = 1, /* only for SPI-NAND */
++	SPI_CAL_READ_SFDP = 2, /* only for SPI-NOR */
++};
++
++struct nand_addr {
++	unsigned int lun;
++	unsigned int plane;
++	unsigned int eraseblock;
++	unsigned int page;
++	unsigned int dataoffs;
++};
++
++/**
++ * Read calibration rule from device dts node.
++ * Once calibration result matches the rule, we regard is as success.
++ */
++struct spi_cal_rule {
++	int datalen;
++	u8 *match_data;
++	int addrlen;
++	u32 *addr;
++	int mode;
++};
++
++struct spi_cal_target {
++	u32 *cal_item;
++	int cal_min; /* min of cal_item */
++	int cal_max; /* max of cal_item */
++	int step; /* Increase/decrease cal_item */
++	struct list_head list;
++};
++
+ static inline struct spi_driver *to_spi_driver(struct device_driver *drv)
+ {
+ 	return drv ? container_of(drv, struct spi_driver, driver) : NULL;
+@@ -665,6 +699,11 @@ struct spi_controller {
+ 	void			*dummy_rx;
+ 	void			*dummy_tx;
+ 
++	/* For calibration */
++	int (*append_caldata)(struct spi_controller *ctlr);
++	struct list_head *cal_target;
++	struct spi_cal_rule *cal_rule;
++
+ 	int (*fw_translate_cs)(struct spi_controller *ctlr, unsigned cs);
+ 
+ 	/*
+@@ -1477,6 +1516,9 @@ spi_register_board_info(struct spi_board
+ 	{ return 0; }
+ #endif
+ 
++extern int spi_do_calibration(struct spi_controller *ctlr,
++	struct spi_device *spi, int (*cal_read)(void *, u32 *, int, u8 *, int), void *drv_priv);
++
+ /* If you're hotplugging an adapter with devices (parport, usb, etc)
+  * use spi_new_device() to describe each device.  You can also call
+  * spi_unregister_device() to start making that device vanish, but
diff --git a/target/linux/mediatek/patches-5.15/433-drivers-spi-mem-Add-spi-calibration-hook.patch b/target/linux/mediatek/patches-5.15/433-drivers-spi-mem-Add-spi-calibration-hook.patch
new file mode 100644
index 00000000000000..aaacab01312972
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/433-drivers-spi-mem-Add-spi-calibration-hook.patch
@@ -0,0 +1,41 @@
+From 06640a5da2973318c06e516da16a5b579622e7c5 Mon Sep 17 00:00:00 2001
+From: "SkyLake.Huang" <skylake.huang@mediatek.com>
+Date: Thu, 23 Jun 2022 18:37:55 +0800
+Subject: [PATCH 3/6] drivers: spi-mem: Add spi calibration hook
+
+Signed-off-by: SkyLake.Huang <skylake.huang@mediatek.com>
+---
+ drivers/spi/spi-mem.c       | 8 ++++++++
+ include/linux/spi/spi-mem.h | 4 ++++
+ 2 files changed, 12 insertions(+)
+
+--- a/drivers/spi/spi-mem.c
++++ b/drivers/spi/spi-mem.c
+@@ -410,6 +410,14 @@ int spi_mem_exec_op(struct spi_mem *mem,
+ }
+ EXPORT_SYMBOL_GPL(spi_mem_exec_op);
+ 
++int spi_mem_do_calibration(struct spi_mem *mem,
++	int (*cal_read)(void *priv, u32 *addr, int addrlen, u8 *buf, int readlen),
++	void *priv)
++{
++	return spi_do_calibration(mem->spi->controller, mem->spi, cal_read, priv);
++}
++EXPORT_SYMBOL_GPL(spi_mem_do_calibration);
++
+ /**
+  * spi_mem_get_name() - Return the SPI mem device name to be used by the
+  *			upper layer if necessary
+--- a/include/linux/spi/spi-mem.h
++++ b/include/linux/spi/spi-mem.h
+@@ -366,6 +366,10 @@ bool spi_mem_supports_op(struct spi_mem
+ int spi_mem_exec_op(struct spi_mem *mem,
+ 		    const struct spi_mem_op *op);
+ 
++int spi_mem_do_calibration(struct spi_mem *mem,
++			int (*cal_read)(void *, u32 *, int, u8 *, int),
++			void *priv);
++
+ const char *spi_mem_get_name(struct spi_mem *mem);
+ 
+ struct spi_mem_dirmap_desc *
diff --git a/target/linux/mediatek/patches-5.15/434-drivers-spi-mt65xx-Add-controller-s-calibration-para.patch b/target/linux/mediatek/patches-5.15/434-drivers-spi-mt65xx-Add-controller-s-calibration-para.patch
new file mode 100644
index 00000000000000..a64d6229819bac
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/434-drivers-spi-mt65xx-Add-controller-s-calibration-para.patch
@@ -0,0 +1,43 @@
+From d278c7a0bf730318a7ccf8d0a8b434c813e23fd0 Mon Sep 17 00:00:00 2001
+From: "SkyLake.Huang" <skylake.huang@mediatek.com>
+Date: Thu, 23 Jun 2022 18:39:03 +0800
+Subject: [PATCH 4/6] drivers: spi-mt65xx: Add controller's calibration
+ paramter
+
+Signed-off-by: SkyLake.Huang <skylake.huang@mediatek.com>
+---
+ drivers/spi/spi-mt65xx.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/spi/spi-mt65xx.c
++++ b/drivers/spi/spi-mt65xx.c
+@@ -800,6 +800,21 @@ static irqreturn_t mtk_spi_interrupt(int
+ 	return IRQ_HANDLED;
+ }
+ 
++static int mtk_spi_append_caldata(struct spi_controller *ctlr)
++{
++	struct spi_cal_target *cal_target = kmalloc(sizeof(*cal_target), GFP_KERNEL);
++	struct mtk_spi *mdata = spi_master_get_devdata(ctlr);
++
++	cal_target->cal_item = &mdata->get_tick_dly;
++	cal_target->cal_min = 0;
++	cal_target->cal_max = 7;
++	cal_target->step = 1;
++
++	list_add(&cal_target->list, ctlr->cal_target);
++
++	return 0;
++}
++
+ static int mtk_spi_mem_adjust_op_size(struct spi_mem *mem,
+ 				      struct spi_mem_op *op)
+ {
+@@ -1092,6 +1107,7 @@ static int mtk_spi_probe(struct platform
+ 	master->setup = mtk_spi_setup;
+ 	master->set_cs_timing = mtk_spi_set_hw_cs_timing;
+ 	master->use_gpio_descriptors = true;
++	master->append_caldata = mtk_spi_append_caldata;
+ 
+ 	of_id = of_match_node(mtk_spi_of_match, pdev->dev.of_node);
+ 	if (!of_id) {
diff --git a/target/linux/mediatek/patches-5.15/435-drivers-mtd-spinand-Add-calibration-support-for-spin.patch b/target/linux/mediatek/patches-5.15/435-drivers-mtd-spinand-Add-calibration-support-for-spin.patch
new file mode 100644
index 00000000000000..e2684eebb74992
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/435-drivers-mtd-spinand-Add-calibration-support-for-spin.patch
@@ -0,0 +1,81 @@
+From 7670ec4a14891a1a182b98a9c403ffbf6b49e4b1 Mon Sep 17 00:00:00 2001
+From: "SkyLake.Huang" <skylake.huang@mediatek.com>
+Date: Thu, 23 Jun 2022 18:39:56 +0800
+Subject: [PATCH 5/6] drivers: mtd: spinand: Add calibration support for
+ spinand
+
+Signed-off-by: SkyLake.Huang <skylake.huang@mediatek.com>
+---
+ drivers/mtd/nand/spi/core.c | 54 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 54 insertions(+)
+
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -977,6 +977,56 @@ static int spinand_manufacturer_match(st
+ 	return -ENOTSUPP;
+ }
+ 
++int spinand_cal_read(void *priv, u32 *addr, int addrlen, u8 *buf, int readlen) {
++	struct spinand_device *spinand = (struct spinand_device *)priv;
++	struct device *dev = &spinand->spimem->spi->dev;
++	struct spi_mem_op op = SPINAND_PAGE_READ_FROM_CACHE_OP(false, 0, 1, buf, readlen);
++	struct nand_pos pos;
++	struct nand_page_io_req req;
++	u8 status;
++	int ret;
++
++	if(addrlen != sizeof(struct nand_addr)/sizeof(unsigned int)) {
++		dev_err(dev, "Must provide correct addr(length) for spinand calibration\n");
++		return -EINVAL;
++	}
++
++	ret = spinand_reset_op(spinand);
++	if (ret)
++		return ret;
++
++	/* We should store our golden data in first target because
++	 * we can't switch target at this moment.
++	 */
++	pos = (struct nand_pos){
++		.target = 0,
++		.lun = *addr,
++		.plane = *(addr+1),
++		.eraseblock = *(addr+2),
++		.page = *(addr+3),
++	};
++
++	req = (struct nand_page_io_req){
++		.pos = pos,
++		.dataoffs = *(addr+4),
++		.datalen = readlen,
++		.databuf.in = buf,
++		.mode = MTD_OPS_AUTO_OOB,
++	};
++
++	ret = spinand_load_page_op(spinand, &req);
++	if (ret)
++		return ret;
++
++	ret = spinand_wait(spinand, &status);
++	if (ret < 0)
++		return ret;
++
++	ret = spi_mem_exec_op(spinand->spimem, &op);
++
++	return 0;
++}
++
+ static int spinand_id_detect(struct spinand_device *spinand)
+ {
+ 	u8 *id = spinand->id.data;
+@@ -1227,6 +1277,10 @@ static int spinand_init(struct spinand_d
+ 	if (!spinand->scratchbuf)
+ 		return -ENOMEM;
+ 
++	ret = spi_mem_do_calibration(spinand->spimem, spinand_cal_read, spinand);
++	if (ret)
++		dev_err(dev, "Failed to calibrate SPI-NAND (err = %d)\n", ret);
++
+ 	ret = spinand_detect(spinand);
+ 	if (ret)
+ 		goto err_free_bufs;
diff --git a/target/linux/mediatek/patches-5.15/436-drivers-mtd-spi-nor-Add-calibration-support-for-spi-.patch b/target/linux/mediatek/patches-5.15/436-drivers-mtd-spi-nor-Add-calibration-support-for-spi-.patch
new file mode 100644
index 00000000000000..25a7cd38614d26
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/436-drivers-mtd-spi-nor-Add-calibration-support-for-spi-.patch
@@ -0,0 +1,57 @@
+From f3fe3b15eca7908eaac57f9b8387a5dbc45ec5b2 Mon Sep 17 00:00:00 2001
+From: "SkyLake.Huang" <skylake.huang@mediatek.com>
+Date: Thu, 23 Jun 2022 18:40:59 +0800
+Subject: [PATCH 6/6] drivers: mtd: spi-nor: Add calibration support for
+ spi-nor
+
+Signed-off-by: SkyLake.Huang <skylake.huang@mediatek.com>
+---
+ drivers/mtd/nand/spi/core.c |  5 ++++-
+ drivers/mtd/spi-nor/core.c  | 15 +++++++++++++++
+ 2 files changed, 19 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -1018,7 +1018,10 @@ int spinand_cal_read(void *priv, u32 *ad
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = spinand_wait(spinand, &status);
++	ret = spinand_wait(spinand,
++			   SPINAND_READ_INITIAL_DELAY_US,
++			   SPINAND_READ_POLL_DELAY_US,
++			   &status);
+ 	if (ret < 0)
+ 		return ret;
+ 
+--- a/drivers/mtd/spi-nor/core.c
++++ b/drivers/mtd/spi-nor/core.c
+@@ -3060,6 +3060,18 @@ static void spi_nor_debugfs_init(struct
+ 					 info->id_len, info->id);
+ }
+ 
++static int spi_nor_cal_read(void *priv, u32 *addr, int addrlen, u8 *buf, int readlen)
++{
++	struct spi_nor *nor = (struct spi_nor *)priv;
++
++	nor->reg_proto = SNOR_PROTO_1_1_1;
++	nor->read_proto = SNOR_PROTO_1_1_1;
++	nor->read_opcode = SPINOR_OP_READ;
++	nor->read_dummy = 0;
++
++	return nor->controller_ops->read(nor, *addr, readlen, buf);
++}
++
+ static const struct flash_info *spi_nor_get_flash_info(struct spi_nor *nor,
+ 						       const char *name)
+ {
+@@ -3133,6 +3145,9 @@ int spi_nor_scan(struct spi_nor *nor, co
+ 	if (!nor->bouncebuf)
+ 		return -ENOMEM;
+ 
++	if(nor->spimem)
++		spi_mem_do_calibration(nor->spimem, spi_nor_cal_read, nor);
++
+ 	info = spi_nor_get_flash_info(nor, name);
+ 	if (IS_ERR(info))
+ 		return PTR_ERR(info);
diff --git a/target/linux/mediatek/patches-5.15/500-gsw-rtl8367s-mt7622-support.patch b/target/linux/mediatek/patches-5.15/500-gsw-rtl8367s-mt7622-support.patch
index 262df9d2cfabc1..b8964f4e765756 100644
--- a/target/linux/mediatek/patches-5.15/500-gsw-rtl8367s-mt7622-support.patch
+++ b/target/linux/mediatek/patches-5.15/500-gsw-rtl8367s-mt7622-support.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/phy/Kconfig
 +++ b/drivers/net/phy/Kconfig
-@@ -366,6 +366,12 @@ config ROCKCHIP_PHY
+@@ -367,6 +367,12 @@ config ROCKCHIP_PHY
  	help
  	  Currently supports the integrated Ethernet PHY.
  
diff --git a/target/linux/mediatek/patches-5.15/600-v5.16-arm64-dts-mediatek-Split-PCIe-node-for-MT2712-and-MT.patch b/target/linux/mediatek/patches-5.15/600-v5.16-arm64-dts-mediatek-Split-PCIe-node-for-MT2712-and-MT.patch
new file mode 100644
index 00000000000000..6a84ff47db1808
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/600-v5.16-arm64-dts-mediatek-Split-PCIe-node-for-MT2712-and-MT.patch
@@ -0,0 +1,332 @@
+From: Chuanjia Liu <chuanjia.liu@mediatek.com>
+Date: Mon, 23 Aug 2021 11:27:59 +0800
+Subject: [PATCH] arm64: dts: mediatek: Split PCIe node for MT2712 and MT7622
+
+There are two independent PCIe controllers in MT2712 and MT7622
+platform. Each of them should contain an independent MSI domain.
+
+In old dts architecture, MSI domain will be inherited from the root
+bridge, and all of the devices will share the same MSI domain.
+Hence that, the PCIe devices will not work properly if the irq number
+which required is more than 32.
+
+Split the PCIe node for MT2712 and MT7622 platform to comply with
+the hardware design and fix MSI issue.
+
+Signed-off-by: Chuanjia Liu <chuanjia.liu@mediatek.com>
+Acked-by: Ryder Lee <ryder.lee@mediatek.com>
+Link: https://lore.kernel.org/r/20210823032800.1660-6-chuanjia.liu@mediatek.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+---
+
+--- a/arch/arm64/boot/dts/mediatek/mt2712e.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt2712e.dtsi
+@@ -915,64 +915,67 @@
+ 		};
+ 	};
+ 
+-	pcie: pcie@11700000 {
++	pcie1: pcie@112ff000 {
+ 		compatible = "mediatek,mt2712-pcie";
+ 		device_type = "pci";
+-		reg = <0 0x11700000 0 0x1000>,
+-		      <0 0x112ff000 0 0x1000>;
+-		reg-names = "port0", "port1";
++		reg = <0 0x112ff000 0 0x1000>;
++		reg-names = "port1";
++		linux,pci-domain = <1>;
+ 		#address-cells = <3>;
+ 		#size-cells = <2>;
+-		interrupts = <GIC_SPI 115 IRQ_TYPE_LEVEL_HIGH>,
+-			     <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>;
+-		clocks = <&topckgen CLK_TOP_PE2_MAC_P0_SEL>,
+-			 <&topckgen CLK_TOP_PE2_MAC_P1_SEL>,
+-			 <&pericfg CLK_PERI_PCIE0>,
++		interrupts = <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-names = "pcie_irq";
++		clocks = <&topckgen CLK_TOP_PE2_MAC_P1_SEL>,
+ 			 <&pericfg CLK_PERI_PCIE1>;
+-		clock-names = "sys_ck0", "sys_ck1", "ahb_ck0", "ahb_ck1";
+-		phys = <&u3port0 PHY_TYPE_PCIE>, <&u3port1 PHY_TYPE_PCIE>;
+-		phy-names = "pcie-phy0", "pcie-phy1";
++		clock-names = "sys_ck1", "ahb_ck1";
++		phys = <&u3port1 PHY_TYPE_PCIE>;
++		phy-names = "pcie-phy1";
+ 		bus-range = <0x00 0xff>;
+-		ranges = <0x82000000 0 0x20000000  0x0 0x20000000  0 0x10000000>;
++		ranges = <0x82000000 0 0x11400000  0x0 0x11400000  0 0x300000>;
++		status = "disabled";
+ 
+-		pcie0: pcie@0,0 {
+-			device_type = "pci";
+-			status = "disabled";
+-			reg = <0x0000 0 0 0 0>;
+-			#address-cells = <3>;
+-			#size-cells = <2>;
++		#interrupt-cells = <1>;
++		interrupt-map-mask = <0 0 0 7>;
++		interrupt-map = <0 0 0 1 &pcie_intc1 0>,
++				<0 0 0 2 &pcie_intc1 1>,
++				<0 0 0 3 &pcie_intc1 2>,
++				<0 0 0 4 &pcie_intc1 3>;
++		pcie_intc1: interrupt-controller {
++			interrupt-controller;
++			#address-cells = <0>;
+ 			#interrupt-cells = <1>;
+-			ranges;
+-			interrupt-map-mask = <0 0 0 7>;
+-			interrupt-map = <0 0 0 1 &pcie_intc0 0>,
+-					<0 0 0 2 &pcie_intc0 1>,
+-					<0 0 0 3 &pcie_intc0 2>,
+-					<0 0 0 4 &pcie_intc0 3>;
+-			pcie_intc0: interrupt-controller {
+-				interrupt-controller;
+-				#address-cells = <0>;
+-				#interrupt-cells = <1>;
+-			};
+ 		};
++	};
++
++	pcie0: pcie@11700000 {
++		compatible = "mediatek,mt2712-pcie";
++		device_type = "pci";
++		reg = <0 0x11700000 0 0x1000>;
++		reg-names = "port0";
++		linux,pci-domain = <0>;
++		#address-cells = <3>;
++		#size-cells = <2>;
++		interrupts = <GIC_SPI 115 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-names = "pcie_irq";
++		clocks = <&topckgen CLK_TOP_PE2_MAC_P0_SEL>,
++			 <&pericfg CLK_PERI_PCIE0>;
++		clock-names = "sys_ck0", "ahb_ck0";
++		phys = <&u3port0 PHY_TYPE_PCIE>;
++		phy-names = "pcie-phy0";
++		bus-range = <0x00 0xff>;
++		ranges = <0x82000000 0 0x20000000 0x0 0x20000000 0 0x10000000>;
++		status = "disabled";
+ 
+-		pcie1: pcie@1,0 {
+-			device_type = "pci";
+-			status = "disabled";
+-			reg = <0x0800 0 0 0 0>;
+-			#address-cells = <3>;
+-			#size-cells = <2>;
++		#interrupt-cells = <1>;
++		interrupt-map-mask = <0 0 0 7>;
++		interrupt-map = <0 0 0 1 &pcie_intc0 0>,
++				<0 0 0 2 &pcie_intc0 1>,
++				<0 0 0 3 &pcie_intc0 2>,
++				<0 0 0 4 &pcie_intc0 3>;
++		pcie_intc0: interrupt-controller {
++			interrupt-controller;
++			#address-cells = <0>;
+ 			#interrupt-cells = <1>;
+-			ranges;
+-			interrupt-map-mask = <0 0 0 7>;
+-			interrupt-map = <0 0 0 1 &pcie_intc1 0>,
+-					<0 0 0 2 &pcie_intc1 1>,
+-					<0 0 0 3 &pcie_intc1 2>,
+-					<0 0 0 4 &pcie_intc1 3>;
+-			pcie_intc1: interrupt-controller {
+-				interrupt-controller;
+-				#address-cells = <0>;
+-				#interrupt-cells = <1>;
+-			};
+ 		};
+ 	};
+ 
+--- a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
+@@ -302,18 +302,16 @@
+ 	};
+ };
+ 
+-&pcie {
++&pcie0 {
+ 	pinctrl-names = "default";
+-	pinctrl-0 = <&pcie0_pins>, <&pcie1_pins>;
++	pinctrl-0 = <&pcie0_pins>;
+ 	status = "okay";
++};
+ 
+-	pcie@0,0 {
+-		status = "okay";
+-	};
+-
+-	pcie@1,0 {
+-		status = "okay";
+-	};
++&pcie1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pcie1_pins>;
++	status = "okay";
+ };
+ 
+ &pio {
+--- a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
+@@ -232,18 +232,16 @@
+ 	};
+ };
+ 
+-&pcie {
++&pcie0 {
+ 	pinctrl-names = "default";
+-	pinctrl-0 = <&pcie0_pins>, <&pcie1_pins>;
++	pinctrl-0 = <&pcie0_pins>;
+ 	status = "okay";
++};
+ 
+-	pcie@0,0 {
+-		status = "okay";
+-	};
+-
+-	pcie@1,0 {
+-		status = "okay";
+-	};
++&pcie1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pcie1_pins>;
++	status = "okay";
+ };
+ 
+ &pio {
+--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+@@ -809,75 +809,83 @@
+ 		#reset-cells = <1>;
+ 	};
+ 
+-	pcie: pcie@1a140000 {
++	pciecfg: pciecfg@1a140000 {
++		compatible = "mediatek,generic-pciecfg", "syscon";
++		reg = <0 0x1a140000 0 0x1000>;
++	};
++
++	pcie0: pcie@1a143000 {
+ 		compatible = "mediatek,mt7622-pcie";
+ 		device_type = "pci";
+-		reg = <0 0x1a140000 0 0x1000>,
+-		      <0 0x1a143000 0 0x1000>,
+-		      <0 0x1a145000 0 0x1000>;
+-		reg-names = "subsys", "port0", "port1";
++		reg = <0 0x1a143000 0 0x1000>;
++		reg-names = "port0";
++		linux,pci-domain = <0>;
+ 		#address-cells = <3>;
+ 		#size-cells = <2>;
+-		interrupts = <GIC_SPI 228 IRQ_TYPE_LEVEL_LOW>,
+-			     <GIC_SPI 229 IRQ_TYPE_LEVEL_LOW>;
++		interrupts = <GIC_SPI 228 IRQ_TYPE_LEVEL_LOW>;
++		interrupt-names = "pcie_irq";
+ 		clocks = <&pciesys CLK_PCIE_P0_MAC_EN>,
+-			 <&pciesys CLK_PCIE_P1_MAC_EN>,
+-			 <&pciesys CLK_PCIE_P0_AHB_EN>,
+ 			 <&pciesys CLK_PCIE_P0_AHB_EN>,
+ 			 <&pciesys CLK_PCIE_P0_AUX_EN>,
+-			 <&pciesys CLK_PCIE_P1_AUX_EN>,
+ 			 <&pciesys CLK_PCIE_P0_AXI_EN>,
+-			 <&pciesys CLK_PCIE_P1_AXI_EN>,
+ 			 <&pciesys CLK_PCIE_P0_OBFF_EN>,
+-			 <&pciesys CLK_PCIE_P1_OBFF_EN>,
+-			 <&pciesys CLK_PCIE_P0_PIPE_EN>,
+-			 <&pciesys CLK_PCIE_P1_PIPE_EN>;
+-		clock-names = "sys_ck0", "sys_ck1", "ahb_ck0", "ahb_ck1",
+-			      "aux_ck0", "aux_ck1", "axi_ck0", "axi_ck1",
+-			      "obff_ck0", "obff_ck1", "pipe_ck0", "pipe_ck1";
++			 <&pciesys CLK_PCIE_P0_PIPE_EN>;
++		clock-names = "sys_ck0", "ahb_ck0", "aux_ck0",
++			      "axi_ck0", "obff_ck0", "pipe_ck0";
++
+ 		power-domains = <&scpsys MT7622_POWER_DOMAIN_HIF0>;
+ 		bus-range = <0x00 0xff>;
+-		ranges = <0x82000000 0 0x20000000 0x0 0x20000000 0 0x10000000>;
++		ranges = <0x82000000 0 0x20000000 0x0 0x20000000 0 0x8000000>;
+ 		status = "disabled";
+ 
+-		pcie0: pcie@0,0 {
+-			reg = <0x0000 0 0 0 0>;
+-			#address-cells = <3>;
+-			#size-cells = <2>;
++		#interrupt-cells = <1>;
++		interrupt-map-mask = <0 0 0 7>;
++		interrupt-map = <0 0 0 1 &pcie_intc0 0>,
++				<0 0 0 2 &pcie_intc0 1>,
++				<0 0 0 3 &pcie_intc0 2>,
++				<0 0 0 4 &pcie_intc0 3>;
++		pcie_intc0: interrupt-controller {
++			interrupt-controller;
++			#address-cells = <0>;
+ 			#interrupt-cells = <1>;
+-			ranges;
+-			status = "disabled";
+-
+-			interrupt-map-mask = <0 0 0 7>;
+-			interrupt-map = <0 0 0 1 &pcie_intc0 0>,
+-					<0 0 0 2 &pcie_intc0 1>,
+-					<0 0 0 3 &pcie_intc0 2>,
+-					<0 0 0 4 &pcie_intc0 3>;
+-			pcie_intc0: interrupt-controller {
+-				interrupt-controller;
+-				#address-cells = <0>;
+-				#interrupt-cells = <1>;
+-			};
+ 		};
++	};
+ 
+-		pcie1: pcie@1,0 {
+-			reg = <0x0800 0 0 0 0>;
+-			#address-cells = <3>;
+-			#size-cells = <2>;
+-			#interrupt-cells = <1>;
+-			ranges;
+-			status = "disabled";
++	pcie1: pcie@1a145000 {
++		compatible = "mediatek,mt7622-pcie";
++		device_type = "pci";
++		reg = <0 0x1a145000 0 0x1000>;
++		reg-names = "port1";
++		linux,pci-domain = <1>;
++		#address-cells = <3>;
++		#size-cells = <2>;
++		interrupts = <GIC_SPI 229 IRQ_TYPE_LEVEL_LOW>;
++		interrupt-names = "pcie_irq";
++		clocks = <&pciesys CLK_PCIE_P1_MAC_EN>,
++			 /* designer has connect RC1 with p0_ahb clock */
++			 <&pciesys CLK_PCIE_P0_AHB_EN>,
++			 <&pciesys CLK_PCIE_P1_AUX_EN>,
++			 <&pciesys CLK_PCIE_P1_AXI_EN>,
++			 <&pciesys CLK_PCIE_P1_OBFF_EN>,
++			 <&pciesys CLK_PCIE_P1_PIPE_EN>;
++		clock-names = "sys_ck1", "ahb_ck1", "aux_ck1",
++			      "axi_ck1", "obff_ck1", "pipe_ck1";
++
++		power-domains = <&scpsys MT7622_POWER_DOMAIN_HIF0>;
++		bus-range = <0x00 0xff>;
++		ranges = <0x82000000 0 0x28000000 0x0 0x28000000 0 0x8000000>;
++		status = "disabled";
+ 
+-			interrupt-map-mask = <0 0 0 7>;
+-			interrupt-map = <0 0 0 1 &pcie_intc1 0>,
+-					<0 0 0 2 &pcie_intc1 1>,
+-					<0 0 0 3 &pcie_intc1 2>,
+-					<0 0 0 4 &pcie_intc1 3>;
+-			pcie_intc1: interrupt-controller {
+-				interrupt-controller;
+-				#address-cells = <0>;
+-				#interrupt-cells = <1>;
+-			};
++		#interrupt-cells = <1>;
++		interrupt-map-mask = <0 0 0 7>;
++		interrupt-map = <0 0 0 1 &pcie_intc1 0>,
++				<0 0 0 2 &pcie_intc1 1>,
++				<0 0 0 3 &pcie_intc1 2>,
++				<0 0 0 4 &pcie_intc1 3>;
++		pcie_intc1: interrupt-controller {
++			interrupt-controller;
++			#address-cells = <0>;
++			#interrupt-cells = <1>;
+ 		};
+ 	};
+ 
diff --git a/target/linux/mediatek/patches-5.15/602-arm64-dts-mediatek-add-mt7622-pcie-slot-node.patch b/target/linux/mediatek/patches-5.15/602-arm64-dts-mediatek-add-mt7622-pcie-slot-node.patch
index 0ecceecebef760..bf479ab53b2cc6 100644
--- a/target/linux/mediatek/patches-5.15/602-arm64-dts-mediatek-add-mt7622-pcie-slot-node.patch
+++ b/target/linux/mediatek/patches-5.15/602-arm64-dts-mediatek-add-mt7622-pcie-slot-node.patch
@@ -1,6 +1,6 @@
 --- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
 +++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
-@@ -848,6 +848,12 @@
+@@ -849,6 +849,12 @@
  			#address-cells = <0>;
  			#interrupt-cells = <1>;
  		};
@@ -13,7 +13,7 @@
  	};
  
  	pcie1: pcie@1a145000 {
-@@ -886,6 +892,12 @@
+@@ -887,6 +893,12 @@
  			#address-cells = <0>;
  			#interrupt-cells = <1>;
  		};
diff --git a/target/linux/mediatek/patches-5.15/603-v5.16-ARM-dts-mediatek-Update-mt7629-PCIe-node.patch b/target/linux/mediatek/patches-5.15/603-v5.16-ARM-dts-mediatek-Update-mt7629-PCIe-node.patch
new file mode 100644
index 00000000000000..252ef080f59fc0
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/603-v5.16-ARM-dts-mediatek-Update-mt7629-PCIe-node.patch
@@ -0,0 +1,203 @@
+From patchwork Thu May 28 06:16:48 2020
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Chuanjia Liu <chuanjia.liu@mediatek.com>
+X-Patchwork-Id: 11574797
+Return-Path: 
+ <SRS0=ftSA=7K=lists.infradead.org=linux-mediatek-bounces+patchwork-linux-mediatek=patchwork.kernel.org@kernel.org>
+Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org
+ [172.30.200.123])
+	by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 30A5E1392
+	for <patchwork-linux-mediatek@patchwork.kernel.org>;
+ Thu, 28 May 2020 06:29:05 +0000 (UTC)
+Received: from bombadil.infradead.org (bombadil.infradead.org
+ [198.137.202.133])
+	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
+	(No client certificate requested)
+	by mail.kernel.org (Postfix) with ESMTPS id 08B6320721
+	for <patchwork-linux-mediatek@patchwork.kernel.org>;
+ Thu, 28 May 2020 06:29:05 +0000 (UTC)
+Authentication-Results: mail.kernel.org;
+	dkim=pass (2048-bit key) header.d=lists.infradead.org
+ header.i=@lists.infradead.org header.b="auhxDafY";
+	dkim=fail reason="signature verification failed" (1024-bit key)
+ header.d=mediatek.com header.i=@mediatek.com header.b="Kj09Arxb"
+DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 08B6320721
+Authentication-Results: mail.kernel.org;
+ dmarc=fail (p=none dis=none) header.from=mediatek.com
+Authentication-Results: mail.kernel.org;
+ spf=none
+ smtp.mailfrom=linux-mediatek-bounces+patchwork-linux-mediatek=patchwork.kernel.org@lists.infradead.org
+DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
+	d=lists.infradead.org; s=bombadil.20170209; h=Sender:
+	Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post:
+	List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To:
+	Message-ID:Date:Subject:To:From:Reply-To:Content-ID:Content-Description:
+	Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:
+	List-Owner; bh=+QPxF1vlOH7StIZYuXJa3V40x8QVDxCLF9AFXHblB9M=; b=auhxDafYBeaUZO
+	aYp2KVO8Aie0v4tYtRwBon7hF+x55JwD78SAxQR2RsSvrlOo9cMYYby+ToUWflVUWQ60FapAl+w+l
+	nkEjIOrLBErHwxNOcsD8T5kjyCBMqlz4OMAQYUDNJ3fSugRlGhOtxkjCGd9ebB8N2Rvu6/U8P1A9n
+	P15mEQoc+RLonR1+9mBgwTEXErjsraxkimTD4Txsp4IvMs3UdsMkP+r3OT5S/p+Uj6O9ES0h7xIon
+	aL79KaVqRLHrfZxnrVwuGiecAiTp8qLy9clHuJU32NA6ZcXH1OnWipKApgp8Ck7ys80WPKaMrat9B
+	XuskJ63w13DZAbCVvuGQ==;
+Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org)
+	by bombadil.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux))
+	id 1jeC2J-00014n-M9; Thu, 28 May 2020 06:29:03 +0000
+Received: from mailgw02.mediatek.com ([216.200.240.185])
+ by bombadil.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux))
+ id 1jeC2H-00013t-Li; Thu, 28 May 2020 06:29:03 +0000
+X-UUID: a4877c1586e64afeb2d6172e10605d2b-20200527
+DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
+ d=mediatek.com;
+ s=dk;
+ h=Content-Transfer-Encoding:Content-Type:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:CC:To:From;
+ bh=CIwcBFK1x0LbOjDt1BG6/knHFxDHRiqj8ov/jWEZDBY=;
+ b=Kj09ArxbnLVTc9bpaVPT3jQrIVjhL87sSYyVF9dFypS976k78Ce9gZd0f4K3zAZbYZHYoQtuyOQ9TOeufQfgD+Cr+j5VR7pTdO2E1iXHFs/eQAz5gAjvjlK01z1JiunrLnn9dvIr6c1gEkjQHny0VpuZ1duxx79jwYusg/Nw6Wc=;
+X-UUID: a4877c1586e64afeb2d6172e10605d2b-20200527
+Received: from mtkcas66.mediatek.inc [(172.29.193.44)] by
+ mailgw02.mediatek.com
+ (envelope-from <chuanjia.liu@mediatek.com>)
+ (musrelay.mediatek.com ESMTP with TLS)
+ with ESMTP id 899663677; Wed, 27 May 2020 22:29:21 -0800
+Received: from MTKMBS07N2.mediatek.inc (172.21.101.141) by
+ MTKMBS62DR.mediatek.inc (172.29.94.18) with Microsoft SMTP Server (TLS) id
+ 15.0.1497.2; Wed, 27 May 2020 23:18:50 -0700
+Received: from mtkcas07.mediatek.inc (172.21.101.84) by
+ mtkmbs07n2.mediatek.inc (172.21.101.141) with Microsoft SMTP Server (TLS) id
+ 15.0.1497.2; Thu, 28 May 2020 14:18:54 +0800
+Received: from localhost.localdomain (10.17.3.153) by mtkcas07.mediatek.inc
+ (172.21.101.73) with Microsoft SMTP Server id 15.0.1497.2 via Frontend
+ Transport; Thu, 28 May 2020 14:18:52 +0800
+From: <chuanjia.liu@mediatek.com>
+To: <robh+dt@kernel.org>, <ryder.lee@mediatek.com>, <matthias.bgg@gmail.com>
+Subject: [PATCH v2 4/4] ARM: dts: mediatek: Update mt7629 PCIe node
+Date: Thu, 28 May 2020 14:16:48 +0800
+Message-ID: <20200528061648.32078-5-chuanjia.liu@mediatek.com>
+X-Mailer: git-send-email 2.18.0
+In-Reply-To: <20200528061648.32078-1-chuanjia.liu@mediatek.com>
+References: <20200528061648.32078-1-chuanjia.liu@mediatek.com>
+MIME-Version: 1.0
+X-MTK: N
+X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 
+X-CRM114-CacheID: sfid-20200527_232901_719172_E5A99C62 
+X-CRM114-Status: GOOD (  11.61  )
+X-Spam-Score: -0.2 (/)
+X-Spam-Report: SpamAssassin version 3.4.4 on bombadil.infradead.org summary:
+ Content analysis details:   (-0.2 points)
+ pts rule name              description
+ ---- ----------------------
+ --------------------------------------------------
+ -0.0 SPF_PASS               SPF: sender matches SPF record
+ 0.0 SPF_HELO_NONE          SPF: HELO does not publish an SPF Record
+ 0.0 MIME_BASE64_TEXT       RAW: Message text disguised using base64
+ encoding
+ -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
+ author's domain
+ 0.1 DKIM_SIGNED            Message has a DKIM or DK signature,
+ not necessarily
+ valid
+ -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
+ -0.1 DKIM_VALID_EF          Message has a valid DKIM or DK signature from
+ envelope-from domain
+ 0.0 UNPARSEABLE_RELAY      Informational: message has unparseable relay
+ lines
+X-BeenThere: linux-mediatek@lists.infradead.org
+X-Mailman-Version: 2.1.29
+Precedence: list
+List-Id: <linux-mediatek.lists.infradead.org>
+List-Unsubscribe: <http://lists.infradead.org/mailman/options/linux-mediatek>,
+ <mailto:linux-mediatek-request@lists.infradead.org?subject=unsubscribe>
+List-Archive: <http://lists.infradead.org/pipermail/linux-mediatek/>
+List-Post: <mailto:linux-mediatek@lists.infradead.org>
+List-Help: <mailto:linux-mediatek-request@lists.infradead.org?subject=help>
+List-Subscribe: <http://lists.infradead.org/mailman/listinfo/linux-mediatek>,
+ <mailto:linux-mediatek-request@lists.infradead.org?subject=subscribe>
+Cc: devicetree@vger.kernel.org, lorenzo.pieralisi@arm.com,
+ srv_heupstream@mediatek.com, "chuanjia.liu" <Chuanjia.Liu@mediatek.com>,
+ linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org,
+ jianjun.wang@mediatek.com, linux-mediatek@lists.infradead.org,
+ yong.wu@mediatek.com, bhelgaas@google.com,
+ linux-arm-kernel@lists.infradead.org, amurray@thegoodpenguin.co.uk
+Sender: "Linux-mediatek" <linux-mediatek-bounces@lists.infradead.org>
+Errors-To: 
+ linux-mediatek-bounces+patchwork-linux-mediatek=patchwork.kernel.org@lists.infradead.org
+
+From: "chuanjia.liu" <Chuanjia.Liu@mediatek.com>
+
+Remove unused property and add pciecfg node.
+
+Signed-off-by: chuanjia.liu <Chuanjia.Liu@mediatek.com>
+---
+ arch/arm/boot/dts/mt7629-rfb.dts |  3 ++-
+ arch/arm/boot/dts/mt7629.dtsi    | 23 +++++++++++++----------
+ 2 files changed, 15 insertions(+), 11 deletions(-)
+
+--- a/arch/arm/boot/dts/mt7629-rfb.dts
++++ b/arch/arm/boot/dts/mt7629-rfb.dts
+@@ -149,9 +149,10 @@
+ 	};
+ };
+ 
+-&pcie {
++&pcie1 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&pcie_pins>;
++	status = "okay";
+ };
+ 
+ &pciephy1 {
+--- a/arch/arm/boot/dts/mt7629.dtsi
++++ b/arch/arm/boot/dts/mt7629.dtsi
+@@ -382,16 +382,21 @@
+ 			#reset-cells = <1>;
+ 		};
+ 
+-		pcie: pcie@1a140000 {
++		pciecfg: pciecfg@1a140000 {
++			compatible = "mediatek,mt7629-pciecfg", "syscon";
++			reg = <0x1a140000 0x1000>;
++		};
++
++		pcie1: pcie@1a145000 {
+ 			compatible = "mediatek,mt7629-pcie";
+ 			device_type = "pci";
+-			reg = <0x1a140000 0x1000>,
+-			      <0x1a145000 0x1000>;
+-			reg-names = "subsys","port1";
++			reg = <0x1a145000 0x1000>;
++			reg-names = "port1";
++			mediatek,pcie-cfg = <&pciecfg>;
+ 			#address-cells = <3>;
+ 			#size-cells = <2>;
+-			interrupts = <GIC_SPI 176 IRQ_TYPE_LEVEL_LOW>,
+-				     <GIC_SPI 229 IRQ_TYPE_LEVEL_LOW>;
++			interrupts = <GIC_SPI 229 IRQ_TYPE_LEVEL_LOW>;
++			interrupt-names = "pcie_irq";
+ 			clocks = <&pciesys CLK_PCIE_P1_MAC_EN>,
+ 				 <&pciesys CLK_PCIE_P0_AHB_EN>,
+ 				 <&pciesys CLK_PCIE_P1_AUX_EN>,
+@@ -412,21 +417,19 @@
+ 			power-domains = <&scpsys MT7622_POWER_DOMAIN_HIF0>;
+ 			bus-range = <0x00 0xff>;
+ 			ranges = <0x82000000 0 0x20000000 0x20000000 0 0x10000000>;
++			status = "disabled";
+ 
+-			pcie1: pcie@1,0 {
+-				device_type = "pci";
++			slot1: pcie@1,0 {
+ 				reg = <0x0800 0 0 0 0>;
+ 				#address-cells = <3>;
+ 				#size-cells = <2>;
+ 				#interrupt-cells = <1>;
+ 				ranges;
+-				num-lanes = <1>;
+ 				interrupt-map-mask = <0 0 0 7>;
+ 				interrupt-map = <0 0 0 1 &pcie_intc1 0>,
+ 						<0 0 0 2 &pcie_intc1 1>,
+ 						<0 0 0 3 &pcie_intc1 2>,
+ 						<0 0 0 4 &pcie_intc1 3>;
+-
+ 				pcie_intc1: interrupt-controller {
+ 					interrupt-controller;
+ 					#address-cells = <0>;
diff --git a/target/linux/mediatek/patches-5.15/703-v5.17-net-ethernet-mtk_eth_soc-implement-Clause-45-MDIO-ac.patch b/target/linux/mediatek/patches-5.15/703-v5.17-net-ethernet-mtk_eth_soc-implement-Clause-45-MDIO-ac.patch
index 7544787701633d..84718d300b5df7 100644
--- a/target/linux/mediatek/patches-5.15/703-v5.17-net-ethernet-mtk_eth_soc-implement-Clause-45-MDIO-ac.patch
+++ b/target/linux/mediatek/patches-5.15/703-v5.17-net-ethernet-mtk_eth_soc-implement-Clause-45-MDIO-ac.patch
@@ -20,7 +20,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -196,13 +196,35 @@ static int _mtk_mdio_write(struct mtk_et
+@@ -323,13 +323,35 @@ static int _mtk_mdio_write(struct mtk_et
  	if (ret < 0)
  		return ret;
  
@@ -63,7 +63,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	ret = mtk_mdio_busy_wait(eth);
  	if (ret < 0)
-@@ -219,12 +241,33 @@ static int _mtk_mdio_read(struct mtk_eth
+@@ -346,12 +368,33 @@ static int _mtk_mdio_read(struct mtk_eth
  	if (ret < 0)
  		return ret;
  
@@ -103,7 +103,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	ret = mtk_mdio_busy_wait(eth);
  	if (ret < 0)
-@@ -621,6 +664,7 @@ static int mtk_mdio_init(struct mtk_eth
+@@ -1013,6 +1056,7 @@ static int mtk_mdio_init(struct mtk_eth
  	eth->mii_bus->name = "mdio";
  	eth->mii_bus->read = mtk_mdio_read;
  	eth->mii_bus->write = mtk_mdio_write;
@@ -113,7 +113,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -327,9 +327,12 @@
+@@ -382,9 +382,12 @@
  #define PHY_IAC_ADDR_MASK	GENMASK(24, 20)
  #define PHY_IAC_ADDR(x)		FIELD_PREP(PHY_IAC_ADDR_MASK, (x))
  #define PHY_IAC_CMD_MASK	GENMASK(19, 18)
diff --git a/target/linux/mediatek/patches-5.15/710-pci-pcie-mediatek-add-support-for-coherent-DMA.patch b/target/linux/mediatek/patches-5.15/710-pci-pcie-mediatek-add-support-for-coherent-DMA.patch
index 4c4db9f0498a8e..de64eda8277d5c 100644
--- a/target/linux/mediatek/patches-5.15/710-pci-pcie-mediatek-add-support-for-coherent-DMA.patch
+++ b/target/linux/mediatek/patches-5.15/710-pci-pcie-mediatek-add-support-for-coherent-DMA.patch
@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
 +++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
-@@ -836,6 +836,9 @@
+@@ -837,6 +837,9 @@
  		bus-range = <0x00 0xff>;
  		ranges = <0x82000000 0 0x20000000 0x0 0x20000000 0 0x8000000>;
  		status = "disabled";
@@ -20,7 +20,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  		#interrupt-cells = <1>;
  		interrupt-map-mask = <0 0 0 7>;
-@@ -880,6 +883,9 @@
+@@ -881,6 +884,9 @@
  		bus-range = <0x00 0xff>;
  		ranges = <0x82000000 0 0x28000000 0x0 0x28000000 0 0x8000000>;
  		status = "disabled";
diff --git a/target/linux/mediatek/patches-5.15/730-net-phy-add-driver-for-MediaTek-SoC-built-in-GE-PHYs.patch b/target/linux/mediatek/patches-5.15/730-net-phy-add-driver-for-MediaTek-SoC-built-in-GE-PHYs.patch
new file mode 100644
index 00000000000000..6af9e843357a0e
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/730-net-phy-add-driver-for-MediaTek-SoC-built-in-GE-PHYs.patch
@@ -0,0 +1,82 @@
+From 60ed9eb9605656c19ca402b7bd3f47552e901601 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 13 Feb 2023 02:33:14 +0000
+Subject: [PATCH] net: phy: add driver for MediaTek SoC built-in GE PHYs
+
+Some of MediaTek's Filogic SoCs come with built-in gigabit Ethernet
+PHYs which require calibration data from the SoC's efuse.
+Despite the similar design the driver doesn't share any code with the
+existing mediatek-ge.c, so add support for these PHYs by introducing a
+new driver for only MediaTek's ARM64 SoCs.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ MAINTAINERS                       |    9 +
+ drivers/net/phy/Kconfig           |   12 +
+ drivers/net/phy/Makefile          |    1 +
+ drivers/net/phy/mediatek-ge-soc.c | 1263 +++++++++++++++++++++++++++++
+ drivers/net/phy/mediatek-ge.c     |    3 +-
+ 5 files changed, 1287 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/net/phy/mediatek-ge-soc.c
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -11797,6 +11797,15 @@ S:	Maintained
+ F:	drivers/net/pcs/pcs-mtk-lynxi.c
+ F:	include/linux/pcs/pcs-mtk-lynxi.h
+ 
++MEDIATEK ETHERNET PHY DRIVERS
++M:	Daniel Golle <daniel@makrotopia.org>
++M:	Qingfang Deng <dqfext@gmail.com>
++M:	SkyLake Huang <SkyLake.Huang@mediatek.com>
++L:	netdev@vger.kernel.org
++S:	Maintained
++F:	drivers/net/phy/mediatek-ge-soc.c
++F:	drivers/net/phy/mediatek-ge.c
++
+ MEDIATEK I2C CONTROLLER DRIVER
+ M:	Qii Wang <qii.wang@mediatek.com>
+ L:	linux-i2c@vger.kernel.org
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -293,6 +293,18 @@ config MEDIATEK_GE_PHY
+ 	help
+ 	  Supports the MediaTek Gigabit Ethernet PHYs.
+ 
++config MEDIATEK_GE_SOC_PHY
++	tristate "MediaTek SoC Ethernet PHYs"
++	depends on (ARM64 && ARCH_MEDIATEK) || COMPILE_TEST
++	select NVMEM_MTK_EFUSE
++	help
++	  Supports MediaTek SoC built-in Gigabit Ethernet PHYs.
++
++	  Include support for built-in Ethernet PHYs which are present in
++	  the MT7981 and MT7988 SoCs. These PHYs need calibration data
++	  present in the SoCs efuse and will dynamically calibrate VCM
++	  (common-mode voltage) during startup.
++
+ config MICREL_PHY
+ 	tristate "Micrel PHYs"
+ 	help
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -81,6 +81,7 @@ obj-$(CONFIG_MARVELL_PHY)	+= marvell.o
+ obj-$(CONFIG_MARVELL_88X2222_PHY)	+= marvell-88x2222.o
+ obj-$(CONFIG_MAXLINEAR_GPHY)	+= mxl-gpy.o
+ obj-$(CONFIG_MEDIATEK_GE_PHY)	+= mediatek-ge.o
++obj-$(CONFIG_MEDIATEK_GE_SOC_PHY)	+= mediatek-ge-soc.o
+ obj-$(CONFIG_MESON_GXL_PHY)	+= meson-gxl.o
+ obj-$(CONFIG_MICREL_KS8995MA)	+= spi_ks8995.o
+ obj-$(CONFIG_MICREL_PHY)	+= micrel.o
+--- a/drivers/net/phy/mediatek-ge.c
++++ b/drivers/net/phy/mediatek-ge.c
+@@ -136,7 +136,8 @@ static struct phy_driver mtk_gephy_drive
+ module_phy_driver(mtk_gephy_driver);
+ 
+ static struct mdio_device_id __maybe_unused mtk_gephy_tbl[] = {
+-	{ PHY_ID_MATCH_VENDOR(0x03a29400) },
++	{ PHY_ID_MATCH_EXACT(0x03a29441) },
++	{ PHY_ID_MATCH_EXACT(0x03a29412) },
+ 	{ }
+ };
+ 
diff --git a/target/linux/mediatek/patches-5.15/731-net-phy-hack-mxl-gpy-disable-sgmii-an.patch b/target/linux/mediatek/patches-5.15/731-net-phy-hack-mxl-gpy-disable-sgmii-an.patch
new file mode 100644
index 00000000000000..2e39ca3c26aad2
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/731-net-phy-hack-mxl-gpy-disable-sgmii-an.patch
@@ -0,0 +1,166 @@
+--- a/drivers/net/phy/mxl-gpy.c
++++ b/drivers/net/phy/mxl-gpy.c
+@@ -126,6 +126,12 @@ static int gpy_config_init(struct phy_de
+ 	if (ret < 0)
+ 		return ret;
+ 
++	/* Disable SGMII auto-negotiation */
++	ret = phy_modify_mmd(phydev, MDIO_MMD_VEND1, VSPEC1_SGMII_CTRL,
++			     VSPEC1_SGMII_CTRL_ANEN, 0);
++	if (ret < 0)
++		return ret;
++
+ 	return gpy_led_write(phydev);
+ }
+ 
+@@ -151,65 +157,6 @@ static int gpy_probe(struct phy_device *
+ 	return 0;
+ }
+ 
+-static bool gpy_sgmii_need_reaneg(struct phy_device *phydev)
+-{
+-	int fw_ver, fw_type, fw_minor;
+-	size_t i;
+-
+-	fw_ver = phy_read(phydev, PHY_FWV);
+-	if (fw_ver < 0)
+-		return true;
+-
+-	fw_type = FIELD_GET(PHY_FWV_TYPE_MASK, fw_ver);
+-	fw_minor = FIELD_GET(PHY_FWV_MINOR_MASK, fw_ver);
+-
+-	for (i = 0; i < ARRAY_SIZE(ver_need_sgmii_reaneg); i++) {
+-		if (fw_type != ver_need_sgmii_reaneg[i].type)
+-			continue;
+-		if (fw_minor < ver_need_sgmii_reaneg[i].minor)
+-			return true;
+-		break;
+-	}
+-
+-	return false;
+-}
+-
+-static bool gpy_2500basex_chk(struct phy_device *phydev)
+-{
+-	int ret;
+-
+-	ret = phy_read(phydev, PHY_MIISTAT);
+-	if (ret < 0) {
+-		phydev_err(phydev, "Error: MDIO register access failed: %d\n",
+-			   ret);
+-		return false;
+-	}
+-
+-	if (!(ret & PHY_MIISTAT_LS) ||
+-	    FIELD_GET(PHY_MIISTAT_SPD_MASK, ret) != PHY_MIISTAT_SPD_2500)
+-		return false;
+-
+-	phydev->speed = SPEED_2500;
+-	phydev->interface = PHY_INTERFACE_MODE_2500BASEX;
+-	phy_modify_mmd(phydev, MDIO_MMD_VEND1, VSPEC1_SGMII_CTRL,
+-		       VSPEC1_SGMII_CTRL_ANEN, 0);
+-	return true;
+-}
+-
+-static bool gpy_sgmii_aneg_en(struct phy_device *phydev)
+-{
+-	int ret;
+-
+-	ret = phy_read_mmd(phydev, MDIO_MMD_VEND1, VSPEC1_SGMII_CTRL);
+-	if (ret < 0) {
+-		phydev_err(phydev, "Error: MMD register access failed: %d\n",
+-			   ret);
+-		return true;
+-	}
+-
+-	return (ret & VSPEC1_SGMII_CTRL_ANEN) ? true : false;
+-}
+-
+ static int gpy_config_aneg(struct phy_device *phydev)
+ {
+ 	bool changed = false;
+@@ -248,53 +195,11 @@ static int gpy_config_aneg(struct phy_de
+ 	    phydev->interface == PHY_INTERFACE_MODE_INTERNAL)
+ 		return 0;
+ 
+-	/* No need to trigger re-ANEG if link speed is 2.5G or SGMII ANEG is
+-	 * disabled.
+-	 */
+-	if (!gpy_sgmii_need_reaneg(phydev) || gpy_2500basex_chk(phydev) ||
+-	    !gpy_sgmii_aneg_en(phydev))
+-		return 0;
+-
+-	/* There is a design constraint in GPY2xx device where SGMII AN is
+-	 * only triggered when there is change of speed. If, PHY link
+-	 * partner`s speed is still same even after PHY TPI is down and up
+-	 * again, SGMII AN is not triggered and hence no new in-band message
+-	 * from GPY to MAC side SGMII.
+-	 * This could cause an issue during power up, when PHY is up prior to
+-	 * MAC. At this condition, once MAC side SGMII is up, MAC side SGMII
+-	 * wouldn`t receive new in-band message from GPY with correct link
+-	 * status, speed and duplex info.
+-	 *
+-	 * 1) If PHY is already up and TPI link status is still down (such as
+-	 *    hard reboot), TPI link status is polled for 4 seconds before
+-	 *    retriggerring SGMII AN.
+-	 * 2) If PHY is already up and TPI link status is also up (such as soft
+-	 *    reboot), polling of TPI link status is not needed and SGMII AN is
+-	 *    immediately retriggered.
+-	 * 3) Other conditions such as PHY is down, speed change etc, skip
+-	 *    retriggering SGMII AN. Note: in case of speed change, GPY FW will
+-	 *    initiate SGMII AN.
+-	 */
+-
+-	if (phydev->state != PHY_UP)
+-		return 0;
+-
+-	ret = phy_read_poll_timeout(phydev, MII_BMSR, ret, ret & BMSR_LSTATUS,
+-				    20000, 4000000, false);
+-	if (ret == -ETIMEDOUT)
+-		return 0;
+-	else if (ret < 0)
+-		return ret;
+-
+-	/* Trigger SGMII AN. */
+-	return phy_modify_mmd(phydev, MDIO_MMD_VEND1, VSPEC1_SGMII_CTRL,
+-			      VSPEC1_SGMII_CTRL_ANRS, VSPEC1_SGMII_CTRL_ANRS);
++	return 0;
+ }
+ 
+ static void gpy_update_interface(struct phy_device *phydev)
+ {
+-	int ret;
+-
+ 	/* Interface mode is fixed for USXGMII and integrated PHY */
+ 	if (phydev->interface == PHY_INTERFACE_MODE_USXGMII ||
+ 	    phydev->interface == PHY_INTERFACE_MODE_INTERNAL)
+@@ -306,29 +211,11 @@ static void gpy_update_interface(struct
+ 	switch (phydev->speed) {
+ 	case SPEED_2500:
+ 		phydev->interface = PHY_INTERFACE_MODE_2500BASEX;
+-		ret = phy_modify_mmd(phydev, MDIO_MMD_VEND1, VSPEC1_SGMII_CTRL,
+-				     VSPEC1_SGMII_CTRL_ANEN, 0);
+-		if (ret < 0)
+-			phydev_err(phydev,
+-				   "Error: Disable of SGMII ANEG failed: %d\n",
+-				   ret);
+ 		break;
+ 	case SPEED_1000:
+ 	case SPEED_100:
+ 	case SPEED_10:
+ 		phydev->interface = PHY_INTERFACE_MODE_SGMII;
+-		if (gpy_sgmii_aneg_en(phydev))
+-			break;
+-		/* Enable and restart SGMII ANEG for 10/100/1000Mbps link speed
+-		 * if ANEG is disabled (in 2500-BaseX mode).
+-		 */
+-		ret = phy_modify_mmd(phydev, MDIO_MMD_VEND1, VSPEC1_SGMII_CTRL,
+-				     VSPEC1_SGMII_ANEN_ANRS,
+-				     VSPEC1_SGMII_ANEN_ANRS);
+-		if (ret < 0)
+-			phydev_err(phydev,
+-				   "Error: Enable of SGMII ANEG failed: %d\n",
+-				   ret);
+ 		break;
+ 	}
+ }
diff --git a/target/linux/mediatek/patches-5.15/732-net-phy-add-driver-for-MediaTek-2.5G-PHY.patch b/target/linux/mediatek/patches-5.15/732-net-phy-add-driver-for-MediaTek-2.5G-PHY.patch
new file mode 100644
index 00000000000000..7151eb35cc0908
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/732-net-phy-add-driver-for-MediaTek-2.5G-PHY.patch
@@ -0,0 +1,39 @@
+From 128dc09b0af36772062142ce9e85b19c84ac789a Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Tue, 28 Feb 2023 17:53:37 +0000
+Subject: [PATCH] net: phy: add driver for MediaTek 2.5G PHY
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/Kconfig          |   7 ++
+ drivers/net/phy/Makefile         |   1 +
+ drivers/net/phy/mediatek-2p5ge.c | 220 +++++++++++++++++++++++++++++++
+ 3 files changed, 226 insertions(+)
+ create mode 100644 drivers/net/phy/mediatek-2p5ge.c
+
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -305,6 +305,13 @@ config MEDIATEK_GE_SOC_PHY
+ 	  present in the SoCs efuse and will dynamically calibrate VCM
+ 	  (common-mode voltage) during startup.
+ 
++config MEDIATEK_2P5G_PHY
++	tristate "MediaTek 2.5G Ethernet PHY"
++	depends on (ARCH_MEDIATEK && ARM64) || COMPILE_TEST
++	default NET_MEDIATEK_SOC
++	help
++	  Supports the MediaTek 2.5G Ethernet PHY.
++
+ config MICREL_PHY
+ 	tristate "Micrel PHYs"
+ 	help
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -80,6 +80,7 @@ obj-$(CONFIG_MARVELL_10G_PHY)	+= marvell
+ obj-$(CONFIG_MARVELL_PHY)	+= marvell.o
+ obj-$(CONFIG_MARVELL_88X2222_PHY)	+= marvell-88x2222.o
+ obj-$(CONFIG_MAXLINEAR_GPHY)	+= mxl-gpy.o
++obj-$(CONFIG_MEDIATEK_2P5G_PHY)	+= mediatek-2p5ge.o
+ obj-$(CONFIG_MEDIATEK_GE_PHY)	+= mediatek-ge.o
+ obj-$(CONFIG_MEDIATEK_GE_SOC_PHY)	+= mediatek-ge-soc.o
+ obj-$(CONFIG_MESON_GXL_PHY)	+= meson-gxl.o
diff --git a/target/linux/mediatek/patches-5.15/801-phy-phy-mtk-tphy-Add-PCIe-2-lane-efuse-support.patch b/target/linux/mediatek/patches-5.15/801-phy-phy-mtk-tphy-Add-PCIe-2-lane-efuse-support.patch
new file mode 100644
index 00000000000000..691a7c0398e46b
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/801-phy-phy-mtk-tphy-Add-PCIe-2-lane-efuse-support.patch
@@ -0,0 +1,225 @@
+From 41ffe32e7ec23f592e21c508b5108899ad393059 Mon Sep 17 00:00:00 2001
+From: Zhanyong Wang <zhanyong.wang@mediatek.com>
+Date: Tue, 25 Jan 2022 16:50:47 +0800
+Subject: [PATCH 4/5] phy: phy-mtk-tphy: Add PCIe 2 lane efuse support
+
+Add PCIe 2 lane efuse support in tphy driver.
+
+Signed-off-by: Jie Yang <jieyy.yang@mediatek.com>
+Signed-off-by: Zhanyong Wang <zhanyong.wang@mediatek.com>
+---
+ drivers/phy/mediatek/phy-mtk-tphy.c | 140 ++++++++++++++++++++++++++++
+ 1 file changed, 140 insertions(+)
+
+--- a/drivers/phy/mediatek/phy-mtk-tphy.c
++++ b/drivers/phy/mediatek/phy-mtk-tphy.c
+@@ -44,6 +44,15 @@
+ #define SSUSB_SIFSLV_V2_U3PHYD		0x200
+ #define SSUSB_SIFSLV_V2_U3PHYA		0x400
+ 
++/* version V4 sub-banks offset base address */
++/* pcie phy banks */
++#define SSUSB_SIFSLV_V4_SPLLC		0x000
++#define SSUSB_SIFSLV_V4_CHIP		0x100
++#define SSUSB_SIFSLV_V4_U3PHYD		0x900
++#define SSUSB_SIFSLV_V4_U3PHYA		0xb00
++
++#define SSUSB_LN1_OFFSET		0x10000
++
+ #define U3P_MISC_REG1		0x04
+ #define MR1_EFUSE_AUTO_LOAD_DIS		BIT(6)
+ 
+@@ -320,6 +329,7 @@ enum mtk_phy_version {
+ 	MTK_PHY_V1 = 1,
+ 	MTK_PHY_V2,
+ 	MTK_PHY_V3,
++	MTK_PHY_V4,
+ };
+ 
+ struct mtk_phy_pdata {
+@@ -369,6 +379,9 @@ struct mtk_phy_instance {
+ 	u32 efuse_intr;
+ 	u32 efuse_tx_imp;
+ 	u32 efuse_rx_imp;
++	u32 efuse_intr_ln1;
++	u32 efuse_tx_imp_ln1;
++	u32 efuse_rx_imp_ln1;
+ 	int eye_src;
+ 	int eye_vrt;
+ 	int eye_term;
+@@ -946,6 +959,36 @@ static void phy_v2_banks_init(struct mtk
+ 	}
+ }
+ 
++static void phy_v4_banks_init(struct mtk_tphy *tphy,
++			      struct mtk_phy_instance *instance)
++{
++	struct u2phy_banks *u2_banks = &instance->u2_banks;
++	struct u3phy_banks *u3_banks = &instance->u3_banks;
++
++	switch (instance->type) {
++	case PHY_TYPE_USB2:
++		u2_banks->misc = instance->port_base + SSUSB_SIFSLV_V2_MISC;
++		u2_banks->fmreg = instance->port_base + SSUSB_SIFSLV_V2_U2FREQ;
++		u2_banks->com = instance->port_base + SSUSB_SIFSLV_V2_U2PHY_COM;
++		break;
++	case PHY_TYPE_USB3:
++		u3_banks->spllc = instance->port_base + SSUSB_SIFSLV_V2_SPLLC;
++		u3_banks->chip = instance->port_base + SSUSB_SIFSLV_V2_CHIP;
++		u3_banks->phyd = instance->port_base + SSUSB_SIFSLV_V2_U3PHYD;
++		u3_banks->phya = instance->port_base + SSUSB_SIFSLV_V2_U3PHYA;
++		break;
++	case PHY_TYPE_PCIE:
++		u3_banks->spllc = instance->port_base + SSUSB_SIFSLV_V4_SPLLC;
++		u3_banks->chip = instance->port_base + SSUSB_SIFSLV_V4_CHIP;
++		u3_banks->phyd = instance->port_base + SSUSB_SIFSLV_V4_U3PHYD;
++		u3_banks->phya = instance->port_base + SSUSB_SIFSLV_V4_U3PHYA;
++		break;
++	default:
++		dev_err(tphy->dev, "incompatible PHY type\n");
++		return;
++	}
++}
++
+ static void phy_parse_property(struct mtk_tphy *tphy,
+ 				struct mtk_phy_instance *instance)
+ {
+@@ -1144,6 +1187,40 @@ static int phy_efuse_get(struct mtk_tphy
+ 
+ 		dev_dbg(dev, "u3 efuse - intr %x, rx_imp %x, tx_imp %x\n",
+ 			instance->efuse_intr, instance->efuse_rx_imp,instance->efuse_tx_imp);
++
++		if (tphy->pdata->version != MTK_PHY_V4)
++			break;
++
++		ret = nvmem_cell_read_variable_le_u32(dev, "intr_ln1", &instance->efuse_intr_ln1);
++		if (ret) {
++			dev_err(dev, "fail to get u3 lane1 intr efuse, %d\n", ret);
++			break;
++		}
++
++		ret = nvmem_cell_read_variable_le_u32(dev, "rx_imp_ln1", &instance->efuse_rx_imp_ln1);
++		if (ret) {
++			dev_err(dev, "fail to get u3 lane1 rx_imp efuse, %d\n", ret);
++			break;
++		}
++
++		ret = nvmem_cell_read_variable_le_u32(dev, "tx_imp_ln1", &instance->efuse_tx_imp_ln1);
++		if (ret) {
++			dev_err(dev, "fail to get u3 lane1 tx_imp efuse, %d\n", ret);
++			break;
++		}
++
++		/* no efuse, ignore it */
++		if (!instance->efuse_intr_ln1 &&
++		    !instance->efuse_rx_imp_ln1 &&
++		    !instance->efuse_tx_imp_ln1) {
++			dev_warn(dev, "no u3 lane1 efuse, but dts enable it\n");
++			instance->efuse_sw_en = 0;
++			break;
++		}
++
++		dev_info(dev, "u3 lane1 efuse - intr %x, rx_imp %x, tx_imp %x\n",
++			 instance->efuse_intr_ln1, instance->efuse_rx_imp_ln1,
++			 instance->efuse_tx_imp_ln1);
+ 		break;
+ 	default:
+ 		dev_err(dev, "no sw efuse for type %d\n", instance->type);
+@@ -1175,6 +1252,31 @@ static void phy_efuse_set(struct mtk_phy
+ 		writel(tmp, u2_banks->com + U3P_USBPHYACR1);
+ 		break;
+ 	case PHY_TYPE_USB3:
++		tmp = readl(u3_banks->phyd + U3P_U3_PHYD_RSV);
++		tmp |= P3D_RG_EFUSE_AUTO_LOAD_DIS;
++		writel(tmp, u3_banks->phyd + U3P_U3_PHYD_RSV);
++
++		tmp = readl(u3_banks->phyd + U3P_U3_PHYD_IMPCAL0);
++		tmp &= ~P3D_RG_TX_IMPEL;
++		tmp |= P3D_RG_TX_IMPEL_VAL(instance->efuse_tx_imp);
++		tmp |= P3D_RG_FORCE_TX_IMPEL;
++		writel(tmp, u3_banks->phyd + U3P_U3_PHYD_IMPCAL0);
++
++		tmp = readl(u3_banks->phyd + U3P_U3_PHYD_IMPCAL1);
++		tmp &= ~P3D_RG_RX_IMPEL;
++		tmp |= P3D_RG_RX_IMPEL_VAL(instance->efuse_rx_imp);
++		tmp |= P3D_RG_FORCE_RX_IMPEL;
++		writel(tmp, u3_banks->phyd + U3P_U3_PHYD_IMPCAL1);
++
++		tmp = readl(u3_banks->phya + U3P_U3_PHYA_REG0);
++		tmp &= ~P3A_RG_IEXT_INTR;
++		tmp |= P3A_RG_IEXT_INTR_VAL(instance->efuse_intr);
++		writel(tmp, u3_banks->phya + U3P_U3_PHYA_REG0);
++		pr_err("%s set efuse, tx_imp %x, rx_imp %x intr %x\n",
++			__func__, instance->efuse_tx_imp,
++			instance->efuse_rx_imp, instance->efuse_intr);
++
++		break;
+ 	case PHY_TYPE_PCIE:
+ 		tmp = readl(u3_banks->phyd + U3P_U3_PHYD_RSV);
+ 		tmp |= P3D_RG_EFUSE_AUTO_LOAD_DIS;
+@@ -1196,6 +1298,34 @@ static void phy_efuse_set(struct mtk_phy
+ 		tmp &= ~P3A_RG_IEXT_INTR;
+ 		tmp |= P3A_RG_IEXT_INTR_VAL(instance->efuse_intr);
+ 		writel(tmp, u3_banks->phya + U3P_U3_PHYA_REG0);
++		if (!instance->efuse_intr_ln1 &&
++		    !instance->efuse_rx_imp_ln1 &&
++		    !instance->efuse_tx_imp_ln1)
++			break;
++
++		tmp = readl(u3_banks->phyd + SSUSB_LN1_OFFSET + U3P_U3_PHYD_RSV);
++		tmp |= P3D_RG_EFUSE_AUTO_LOAD_DIS;
++		writel(tmp, u3_banks->phyd + SSUSB_LN1_OFFSET + U3P_U3_PHYD_RSV);
++
++		tmp = readl(u3_banks->phyd + SSUSB_LN1_OFFSET + U3P_U3_PHYD_IMPCAL0);
++		tmp &= ~P3D_RG_TX_IMPEL;
++		tmp |= P3D_RG_TX_IMPEL_VAL(instance->efuse_tx_imp_ln1);
++		tmp |= P3D_RG_FORCE_TX_IMPEL;
++		writel(tmp, u3_banks->phyd + SSUSB_LN1_OFFSET + U3P_U3_PHYD_IMPCAL0);
++
++		tmp = readl(u3_banks->phyd + SSUSB_LN1_OFFSET + U3P_U3_PHYD_IMPCAL1);
++		tmp &= ~P3D_RG_RX_IMPEL;
++		tmp |= P3D_RG_RX_IMPEL_VAL(instance->efuse_rx_imp_ln1);
++		tmp |= P3D_RG_FORCE_RX_IMPEL;
++		writel(tmp, u3_banks->phyd + SSUSB_LN1_OFFSET + U3P_U3_PHYD_IMPCAL1);
++
++		tmp = readl(u3_banks->phya + SSUSB_LN1_OFFSET + U3P_U3_PHYA_REG0);
++		tmp &= ~P3A_RG_IEXT_INTR;
++		tmp |= P3A_RG_IEXT_INTR_VAL(instance->efuse_intr_ln1);
++		writel(tmp, u3_banks->phya + SSUSB_LN1_OFFSET + U3P_U3_PHYA_REG0);
++		dev_info(dev, "%s set LN1 efuse, tx_imp %x, rx_imp %x intr %x\n",
++			 __func__, instance->efuse_tx_imp_ln1,
++			 instance->efuse_rx_imp_ln1, instance->efuse_intr_ln1);
+ 		break;
+ 	default:
+ 		dev_warn(dev, "no sw efuse for type %d\n", instance->type);
+@@ -1335,6 +1465,9 @@ static struct phy *mtk_phy_xlate(struct
+ 	case MTK_PHY_V3:
+ 		phy_v2_banks_init(tphy, instance);
+ 		break;
++	case MTK_PHY_V4:
++		phy_v4_banks_init(tphy, instance);
++		break;
+ 	default:
+ 		dev_err(dev, "phy version is not supported\n");
+ 		return ERR_PTR(-EINVAL);
+@@ -1375,6 +1508,12 @@ static const struct mtk_phy_pdata tphy_v
+ 	.version = MTK_PHY_V3,
+ };
+ 
++static const struct mtk_phy_pdata tphy_v4_pdata = {
++	.avoid_rx_sen_degradation = false,
++	.sw_efuse_supported = true,
++	.version = MTK_PHY_V4,
++};
++
+ static const struct mtk_phy_pdata mt8173_pdata = {
+ 	.avoid_rx_sen_degradation = true,
+ 	.version = MTK_PHY_V1,
+@@ -1394,6 +1533,7 @@ static const struct of_device_id mtk_tph
+ 	{ .compatible = "mediatek,generic-tphy-v1", .data = &tphy_v1_pdata },
+ 	{ .compatible = "mediatek,generic-tphy-v2", .data = &tphy_v2_pdata },
+ 	{ .compatible = "mediatek,generic-tphy-v3", .data = &tphy_v3_pdata },
++	{ .compatible = "mediatek,generic-tphy-v4", .data = &tphy_v4_pdata },
+ 	{ },
+ };
+ MODULE_DEVICE_TABLE(of, mtk_tphy_id_table);
diff --git a/target/linux/mediatek/patches-5.15/802-phy-phy-mtk-tphy-add-auto-load-valid-check-mechanism.patch b/target/linux/mediatek/patches-5.15/802-phy-phy-mtk-tphy-add-auto-load-valid-check-mechanism.patch
new file mode 100644
index 00000000000000..3b8285bf479ab0
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/802-phy-phy-mtk-tphy-add-auto-load-valid-check-mechanism.patch
@@ -0,0 +1,149 @@
+From 1d5819e90f2ef6dead11809744372a9863227a92 Mon Sep 17 00:00:00 2001
+From: Zhanyong Wang <zhanyong.wang@mediatek.com>
+Date: Tue, 25 Jan 2022 19:03:34 +0800
+Subject: [PATCH 5/5] phy: phy-mtk-tphy: add auto-load-valid check mechanism
+ support
+
+add auto-load-valid check mechanism support
+
+Signed-off-by: Zhanyong Wang <zhanyong.wang@mediatek.com>
+---
+ drivers/phy/mediatek/phy-mtk-tphy.c | 67 +++++++++++++++++++++++++++--
+ 1 file changed, 64 insertions(+), 3 deletions(-)
+
+--- a/drivers/phy/mediatek/phy-mtk-tphy.c
++++ b/drivers/phy/mediatek/phy-mtk-tphy.c
+@@ -376,9 +376,13 @@ struct mtk_phy_instance {
+ 	u32 type_sw_reg;
+ 	u32 type_sw_index;
+ 	u32 efuse_sw_en;
++	bool efuse_alv_en;
++	u32 efuse_autoloadvalid;
+ 	u32 efuse_intr;
+ 	u32 efuse_tx_imp;
+ 	u32 efuse_rx_imp;
++	bool efuse_alv_ln1_en;
++	u32 efuse_ln1_autoloadvalid;
+ 	u32 efuse_intr_ln1;
+ 	u32 efuse_tx_imp_ln1;
+ 	u32 efuse_rx_imp_ln1;
+@@ -1126,6 +1130,7 @@ static int phy_efuse_get(struct mtk_tphy
+ {
+ 	struct device *dev = &instance->phy->dev;
+ 	int ret = 0;
++	bool alv = false;
+ 
+ 	/* tphy v1 doesn't support sw efuse, skip it */
+ 	if (!tphy->pdata->sw_efuse_supported) {
+@@ -1140,6 +1145,20 @@ static int phy_efuse_get(struct mtk_tphy
+ 
+ 	switch (instance->type) {
+ 	case PHY_TYPE_USB2:
++		alv = of_property_read_bool(dev->of_node, "auto_load_valid");
++		if (alv) {
++			instance->efuse_alv_en = alv;
++			ret = nvmem_cell_read_variable_le_u32(dev, "auto_load_valid",
++							&instance->efuse_autoloadvalid);
++			if (ret) {
++				dev_err(dev, "fail to get u2 alv efuse, %d\n", ret);
++				break;
++			}
++			dev_info(dev,
++				"u2 auto load valid efuse: ENABLE with value: %u\n",
++				instance->efuse_autoloadvalid);
++		}
++
+ 		ret = nvmem_cell_read_variable_le_u32(dev, "intr", &instance->efuse_intr);
+ 		if (ret) {
+ 			dev_err(dev, "fail to get u2 intr efuse, %d\n", ret);
+@@ -1158,6 +1177,20 @@ static int phy_efuse_get(struct mtk_tphy
+ 
+ 	case PHY_TYPE_USB3:
+ 	case PHY_TYPE_PCIE:
++		alv = of_property_read_bool(dev->of_node, "auto_load_valid");
++		if (alv) {
++			instance->efuse_alv_en = alv;
++			ret = nvmem_cell_read_variable_le_u32(dev, "auto_load_valid",
++							&instance->efuse_autoloadvalid);
++			if (ret) {
++				dev_err(dev, "fail to get u3(pcei) alv efuse, %d\n", ret);
++				break;
++			}
++			dev_info(dev,
++				"u3 auto load valid efuse: ENABLE with value: %u\n",
++				instance->efuse_autoloadvalid);
++		}
++
+ 		ret = nvmem_cell_read_variable_le_u32(dev, "intr", &instance->efuse_intr);
+ 		if (ret) {
+ 			dev_err(dev, "fail to get u3 intr efuse, %d\n", ret);
+@@ -1191,6 +1224,20 @@ static int phy_efuse_get(struct mtk_tphy
+ 		if (tphy->pdata->version != MTK_PHY_V4)
+ 			break;
+ 
++		alv = of_property_read_bool(dev->of_node, "auto_load_valid_ln1");
++		if (alv) {
++			instance->efuse_alv_ln1_en = alv;
++			ret = nvmem_cell_read_variable_le_u32(dev, "auto_load_valid_ln1",
++							&instance->efuse_ln1_autoloadvalid);
++			if (ret) {
++				dev_err(dev, "fail to get pcie auto_load_valid efuse, %d\n", ret);
++				break;
++			}
++			dev_info(dev,
++				"pcie auto load valid efuse: ENABLE with value: %u\n",
++				instance->efuse_ln1_autoloadvalid);
++		}
++
+ 		ret = nvmem_cell_read_variable_le_u32(dev, "intr_ln1", &instance->efuse_intr_ln1);
+ 		if (ret) {
+ 			dev_err(dev, "fail to get u3 lane1 intr efuse, %d\n", ret);
+@@ -1242,6 +1289,10 @@ static void phy_efuse_set(struct mtk_phy
+ 
+ 	switch (instance->type) {
+ 	case PHY_TYPE_USB2:
++		if (instance->efuse_alv_en &&
++		    instance->efuse_autoloadvalid == 1)
++			break;
++
+ 		tmp = readl(u2_banks->misc + U3P_MISC_REG1);
+ 		tmp |= MR1_EFUSE_AUTO_LOAD_DIS;
+ 		writel(tmp, u2_banks->misc + U3P_MISC_REG1);
+@@ -1252,6 +1303,10 @@ static void phy_efuse_set(struct mtk_phy
+ 		writel(tmp, u2_banks->com + U3P_USBPHYACR1);
+ 		break;
+ 	case PHY_TYPE_USB3:
++		if (instance->efuse_alv_en &&
++		    instance->efuse_autoloadvalid == 1)
++			break;
++
+ 		tmp = readl(u3_banks->phyd + U3P_U3_PHYD_RSV);
+ 		tmp |= P3D_RG_EFUSE_AUTO_LOAD_DIS;
+ 		writel(tmp, u3_banks->phyd + U3P_U3_PHYD_RSV);
+@@ -1278,6 +1333,10 @@ static void phy_efuse_set(struct mtk_phy
+ 
+ 		break;
+ 	case PHY_TYPE_PCIE:
++		if (instance->efuse_alv_en &&
++		    instance->efuse_autoloadvalid == 1)
++			break;
++
+ 		tmp = readl(u3_banks->phyd + U3P_U3_PHYD_RSV);
+ 		tmp |= P3D_RG_EFUSE_AUTO_LOAD_DIS;
+ 		writel(tmp, u3_banks->phyd + U3P_U3_PHYD_RSV);
+@@ -1298,9 +1357,12 @@ static void phy_efuse_set(struct mtk_phy
+ 		tmp &= ~P3A_RG_IEXT_INTR;
+ 		tmp |= P3A_RG_IEXT_INTR_VAL(instance->efuse_intr);
+ 		writel(tmp, u3_banks->phya + U3P_U3_PHYA_REG0);
+-		if (!instance->efuse_intr_ln1 &&
+-		    !instance->efuse_rx_imp_ln1 &&
+-		    !instance->efuse_tx_imp_ln1)
++
++		if ((!instance->efuse_intr_ln1 &&
++		     !instance->efuse_rx_imp_ln1 &&
++		     !instance->efuse_tx_imp_ln1) ||
++		    (instance->efuse_alv_ln1_en &&
++		     instance->efuse_ln1_autoloadvalid == 1))
+ 			break;
+ 
+ 		tmp = readl(u3_banks->phyd + SSUSB_LN1_OFFSET + U3P_U3_PHYD_RSV);
diff --git a/target/linux/mediatek/patches-5.15/804-pwm-add-mt7986-support.patch b/target/linux/mediatek/patches-5.15/804-pwm-add-mt7986-support.patch
new file mode 100644
index 00000000000000..7a10dac051c020
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/804-pwm-add-mt7986-support.patch
@@ -0,0 +1,23 @@
+--- a/drivers/pwm/pwm-mediatek.c
++++ b/drivers/pwm/pwm-mediatek.c
+@@ -302,6 +302,12 @@ static const struct pwm_mediatek_of_data
+ 	.has_ck_26m_sel = true,
+ };
+ 
++static const struct pwm_mediatek_of_data mt7986_pwm_data = {
++	.num_pwms = 2,
++	.pwm45_fixup = false,
++	.has_ck_26m_sel = true,
++};
++
+ static const struct pwm_mediatek_of_data mt8516_pwm_data = {
+ 	.num_pwms = 5,
+ 	.pwm45_fixup = false,
+@@ -314,6 +320,7 @@ static const struct of_device_id pwm_med
+ 	{ .compatible = "mediatek,mt7623-pwm", .data = &mt7623_pwm_data },
+ 	{ .compatible = "mediatek,mt7628-pwm", .data = &mt7628_pwm_data },
+ 	{ .compatible = "mediatek,mt7629-pwm", .data = &mt7629_pwm_data },
++	{ .compatible = "mediatek,mt7986-pwm", .data = &mt7986_pwm_data },
+ 	{ .compatible = "mediatek,mt8183-pwm", .data = &mt8183_pwm_data },
+ 	{ .compatible = "mediatek,mt8516-pwm", .data = &mt8516_pwm_data },
+ 	{ },
diff --git a/target/linux/mediatek/patches-5.15/805-v6.2-thermal-drivers-mtk-use-function-pointer-for-raw_to_.patch b/target/linux/mediatek/patches-5.15/805-v6.2-thermal-drivers-mtk-use-function-pointer-for-raw_to_.patch
new file mode 100644
index 00000000000000..b142b22eb8d3cf
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/805-v6.2-thermal-drivers-mtk-use-function-pointer-for-raw_to_.patch
@@ -0,0 +1,56 @@
+From 69c17529e8418da3eec703dde31e1b01e5b0f7e8 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Wed, 18 Jan 2023 02:48:41 +0000
+Subject: [PATCH 1/2] thermal/drivers/mtk: use function pointer for
+ raw_to_mcelsius
+
+Instead of having if-else logic selecting either raw_to_mcelsius_v1 or
+raw_to_mcelsius_v2 in mtk_thermal_bank_temperature introduce a function
+pointer raw_to_mcelsius to struct mtk_thermal which is initialized in the
+probe function.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/thermal/mtk_thermal.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+--- a/drivers/thermal/mtk_thermal.c
++++ b/drivers/thermal/mtk_thermal.c
+@@ -292,6 +292,8 @@ struct mtk_thermal {
+ 
+ 	const struct mtk_thermal_data *conf;
+ 	struct mtk_thermal_bank banks[MAX_NUM_ZONES];
++
++	int (*raw_to_mcelsius)(struct mtk_thermal *mt, int sensno, s32 raw);
+ };
+ 
+ /* MT8183 thermal sensor data */
+@@ -656,13 +658,9 @@ static int mtk_thermal_bank_temperature(
+ 	for (i = 0; i < conf->bank_data[bank->id].num_sensors; i++) {
+ 		raw = readl(mt->thermal_base + conf->msr[i]);
+ 
+-		if (mt->conf->version == MTK_THERMAL_V1) {
+-			temp = raw_to_mcelsius_v1(
+-				mt, conf->bank_data[bank->id].sensors[i], raw);
+-		} else {
+-			temp = raw_to_mcelsius_v2(
+-				mt, conf->bank_data[bank->id].sensors[i], raw);
+-		}
++		temp = mt->raw_to_mcelsius(
++			mt, conf->bank_data[bank->id].sensors[i], raw);
++
+ 
+ 		/*
+ 		 * The first read of a sensor often contains very high bogus
+@@ -1085,6 +1083,11 @@ static int mtk_thermal_probe(struct plat
+ 		mtk_thermal_release_periodic_ts(mt, auxadc_base);
+ 	}
+ 
++	if (mt->conf->version == MTK_THERMAL_V1)
++		mt->raw_to_mcelsius = raw_to_mcelsius_v1;
++	else
++		mt->raw_to_mcelsius = raw_to_mcelsius_v2;
++
+ 	for (ctrl_id = 0; ctrl_id < mt->conf->num_controller ; ctrl_id++)
+ 		for (i = 0; i < mt->conf->num_banks; i++)
+ 			mtk_thermal_init_bank(mt, i, apmixed_phys_base,
diff --git a/target/linux/mediatek/patches-5.15/806-v6.2-thermal-mediatek-add-support-for-MT7986-and-MT7981.patch b/target/linux/mediatek/patches-5.15/806-v6.2-thermal-mediatek-add-support-for-MT7986-and-MT7981.patch
new file mode 100644
index 00000000000000..3ac2e7fc28cb14
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/806-v6.2-thermal-mediatek-add-support-for-MT7986-and-MT7981.patch
@@ -0,0 +1,240 @@
+From aa957c759b1182aee00cc35178667f849f941b42 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Wed, 30 Nov 2022 13:19:39 +0000
+Subject: [PATCH 2/2] thermal: mediatek: add support for MT7986 and MT7981
+
+Add support for V3 generation thermal found in MT7986 and MT7981 SoCs.
+Brings code to assign values from efuse as well as new function to
+convert raw temperature to millidegree celsius, as found in MediaTek's
+SDK sources (but cleaned up and de-duplicated)
+
+[1]: https://git01.mediatek.com/plugins/gitiles/openwrt/feeds/mtk-openwrt-feeds/+/baf36c7eef477aae1f8f2653b6c29e2caf48475b
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/thermal/mtk_thermal.c | 137 ++++++++++++++++++++++++++++++++--
+ 1 file changed, 132 insertions(+), 5 deletions(-)
+
+--- a/drivers/thermal/mtk_thermal.c
++++ b/drivers/thermal/mtk_thermal.c
+@@ -150,6 +150,20 @@
+ #define CALIB_BUF1_VALID_V2(x)		(((x) >> 4) & 0x1)
+ #define CALIB_BUF1_O_SLOPE_SIGN_V2(x)	(((x) >> 3) & 0x1)
+ 
++/*
++ * Layout of the fuses providing the calibration data
++ * These macros can be used for MT7981 and MT7986.
++ */
++#define CALIB_BUF0_ADC_GE_V3(x)		(((x) >> 0) & 0x3ff)
++#define CALIB_BUF0_DEGC_CALI_V3(x)	(((x) >> 20) & 0x3f)
++#define CALIB_BUF0_O_SLOPE_V3(x)	(((x) >> 26) & 0x3f)
++#define CALIB_BUF1_VTS_TS1_V3(x)	(((x) >> 0) & 0x1ff)
++#define CALIB_BUF1_VTS_TS2_V3(x)	(((x) >> 21) & 0x1ff)
++#define CALIB_BUF1_VTS_TSABB_V3(x)	(((x) >> 9) & 0x1ff)
++#define CALIB_BUF1_VALID_V3(x)		(((x) >> 18) & 0x1)
++#define CALIB_BUF1_O_SLOPE_SIGN_V3(x)	(((x) >> 19) & 0x1)
++#define CALIB_BUF1_ID_V3(x)		(((x) >> 20) & 0x1)
++
+ enum {
+ 	VTS1,
+ 	VTS2,
+@@ -163,6 +177,7 @@ enum {
+ enum mtk_thermal_version {
+ 	MTK_THERMAL_V1 = 1,
+ 	MTK_THERMAL_V2,
++	MTK_THERMAL_V3,
+ };
+ 
+ /* MT2701 thermal sensors */
+@@ -245,6 +260,27 @@ enum mtk_thermal_version {
+ /* The calibration coefficient of sensor  */
+ #define MT8183_CALIBRATION	153
+ 
++/* AUXADC channel 11 is used for the temperature sensors */
++#define MT7986_TEMP_AUXADC_CHANNEL	11
++
++/* The total number of temperature sensors in the MT7986 */
++#define MT7986_NUM_SENSORS		1
++
++/* The number of banks in the MT7986 */
++#define MT7986_NUM_ZONES		1
++
++/* The number of sensing points per bank */
++#define MT7986_NUM_SENSORS_PER_ZONE	1
++
++/* MT7986 thermal sensors */
++#define MT7986_TS1			0
++
++/* The number of controller in the MT7986 */
++#define MT7986_NUM_CONTROLLER		1
++
++/* The calibration coefficient of sensor  */
++#define MT7986_CALIBRATION		165
++
+ struct mtk_thermal;
+ 
+ struct thermal_bank_cfg {
+@@ -388,6 +424,14 @@ static const int mt7622_mux_values[MT762
+ static const int mt7622_vts_index[MT7622_NUM_SENSORS] = { VTS1 };
+ static const int mt7622_tc_offset[MT7622_NUM_CONTROLLER] = { 0x0, };
+ 
++/* MT7986 thermal sensor data */
++static const int mt7986_bank_data[MT7986_NUM_SENSORS] = { MT7986_TS1, };
++static const int mt7986_msr[MT7986_NUM_SENSORS_PER_ZONE] = { TEMP_MSR0, };
++static const int mt7986_adcpnp[MT7986_NUM_SENSORS_PER_ZONE] = { TEMP_ADCPNP0, };
++static const int mt7986_mux_values[MT7986_NUM_SENSORS] = { 0, };
++static const int mt7986_vts_index[MT7986_NUM_SENSORS] = { VTS1 };
++static const int mt7986_tc_offset[MT7986_NUM_CONTROLLER] = { 0x0, };
++
+ /*
+  * The MT8173 thermal controller has four banks. Each bank can read up to
+  * four temperature sensors simultaneously. The MT8173 has a total of 5
+@@ -551,6 +595,30 @@ static const struct mtk_thermal_data mt8
+ 	.version = MTK_THERMAL_V1,
+ };
+ 
++/*
++ * MT7986 uses AUXADC Channel 11 for raw data access.
++ */
++static const struct mtk_thermal_data mt7986_thermal_data = {
++	.auxadc_channel = MT7986_TEMP_AUXADC_CHANNEL,
++	.num_banks = MT7986_NUM_ZONES,
++	.num_sensors = MT7986_NUM_SENSORS,
++	.vts_index = mt7986_vts_index,
++	.cali_val = MT7986_CALIBRATION,
++	.num_controller = MT7986_NUM_CONTROLLER,
++	.controller_offset = mt7986_tc_offset,
++	.need_switch_bank = true,
++	.bank_data = {
++		{
++			.num_sensors = 1,
++			.sensors = mt7986_bank_data,
++		},
++	},
++	.msr = mt7986_msr,
++	.adcpnp = mt7986_adcpnp,
++	.sensor_mux_values = mt7986_mux_values,
++	.version = MTK_THERMAL_V3,
++};
++
+ /**
+  * raw_to_mcelsius - convert a raw ADC value to mcelsius
+  * @mt:	The thermal controller
+@@ -605,6 +673,22 @@ static int raw_to_mcelsius_v2(struct mtk
+ 	return (format_2 - tmp) * 100;
+ }
+ 
++static int raw_to_mcelsius_v3(struct mtk_thermal *mt, int sensno, s32 raw)
++{
++	s32 tmp;
++
++	if (raw == 0)
++		return 0;
++
++	raw &= 0xfff;
++	tmp = 100000 * 15 / 16 * 10000;
++	tmp /= 4096 - 512 + mt->adc_ge;
++	tmp /= 1490;
++	tmp *= raw - mt->vts[sensno] - 2900;
++
++	return mt->degc_cali * 500 - tmp;
++}
++
+ /**
+  * mtk_thermal_get_bank - get bank
+  * @bank:	The bank
+@@ -885,6 +969,25 @@ static int mtk_thermal_extract_efuse_v2(
+ 	return 0;
+ }
+ 
++static int mtk_thermal_extract_efuse_v3(struct mtk_thermal *mt, u32 *buf)
++{
++	if (!CALIB_BUF1_VALID_V3(buf[1]))
++		return -EINVAL;
++
++	mt->adc_ge = CALIB_BUF0_ADC_GE_V3(buf[0]);
++	mt->degc_cali = CALIB_BUF0_DEGC_CALI_V3(buf[0]);
++	mt->o_slope = CALIB_BUF0_O_SLOPE_V3(buf[0]);
++	mt->vts[VTS1] = CALIB_BUF1_VTS_TS1_V3(buf[1]);
++	mt->vts[VTS2] = CALIB_BUF1_VTS_TS2_V3(buf[1]);
++	mt->vts[VTSABB] = CALIB_BUF1_VTS_TSABB_V3(buf[1]);
++	mt->o_slope_sign = CALIB_BUF1_O_SLOPE_SIGN_V3(buf[1]);
++
++	if (CALIB_BUF1_ID_V3(buf[1]) == 0)
++		mt->o_slope = 0;
++
++	return 0;
++}
++
+ static int mtk_thermal_get_calibration_data(struct device *dev,
+ 					    struct mtk_thermal *mt)
+ {
+@@ -895,6 +998,7 @@ static int mtk_thermal_get_calibration_d
+ 
+ 	/* Start with default values */
+ 	mt->adc_ge = 512;
++	mt->adc_oe = 512;
+ 	for (i = 0; i < mt->conf->num_sensors; i++)
+ 		mt->vts[i] = 260;
+ 	mt->degc_cali = 40;
+@@ -920,10 +1024,20 @@ static int mtk_thermal_get_calibration_d
+ 		goto out;
+ 	}
+ 
+-	if (mt->conf->version == MTK_THERMAL_V1)
++	switch (mt->conf->version) {
++	case MTK_THERMAL_V1:
+ 		ret = mtk_thermal_extract_efuse_v1(mt, buf);
+-	else
++		break;
++	case MTK_THERMAL_V2:
+ 		ret = mtk_thermal_extract_efuse_v2(mt, buf);
++		break;
++	case MTK_THERMAL_V3:
++		ret = mtk_thermal_extract_efuse_v3(mt, buf);
++		break;
++	default:
++		ret = -EINVAL;
++		break;
++	}
+ 
+ 	if (ret) {
+ 		dev_info(dev, "Device not calibrated, using default calibration values\n");
+@@ -954,6 +1068,10 @@ static const struct of_device_id mtk_the
+ 		.data = (void *)&mt7622_thermal_data,
+ 	},
+ 	{
++		.compatible = "mediatek,mt7986-thermal",
++		.data = (void *)&mt7986_thermal_data,
++	},
++	{
+ 		.compatible = "mediatek,mt8183-thermal",
+ 		.data = (void *)&mt8183_thermal_data,
+ 	}, {
+@@ -1078,15 +1196,24 @@ static int mtk_thermal_probe(struct plat
+ 		goto err_disable_clk_auxadc;
+ 	}
+ 
+-	if (mt->conf->version == MTK_THERMAL_V2) {
++	if (mt->conf->version != MTK_THERMAL_V1) {
+ 		mtk_thermal_turn_on_buffer(apmixed_base);
+ 		mtk_thermal_release_periodic_ts(mt, auxadc_base);
+ 	}
+ 
+-	if (mt->conf->version == MTK_THERMAL_V1)
++	switch (mt->conf->version) {
++	case MTK_THERMAL_V1:
+ 		mt->raw_to_mcelsius = raw_to_mcelsius_v1;
+-	else
++		break;
++	case MTK_THERMAL_V2:
+ 		mt->raw_to_mcelsius = raw_to_mcelsius_v2;
++		break;
++	case MTK_THERMAL_V3:
++		mt->raw_to_mcelsius = raw_to_mcelsius_v3;
++		break;
++	default:
++		break;
++	}
+ 
+ 	for (ctrl_id = 0; ctrl_id < mt->conf->num_controller ; ctrl_id++)
+ 		for (i = 0; i < mt->conf->num_banks; i++)
diff --git a/target/linux/mediatek/patches-5.15/811-pwm-mediatek-Add-support-for-MT7981.patch b/target/linux/mediatek/patches-5.15/811-pwm-mediatek-Add-support-for-MT7981.patch
new file mode 100644
index 00000000000000..8f27462cbdc355
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/811-pwm-mediatek-Add-support-for-MT7981.patch
@@ -0,0 +1,122 @@
+From 73d20ebc21c562fbe79d02fa0fa38e095e716fa9 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Wed, 19 Apr 2023 20:25:51 +0100
+Subject: [PATCH] pwm: mediatek: Add support for MT7981
+
+The PWM unit on MT7981 uses different register offsets than previous
+MediaTek PWM units. Add support for these new offsets and add support
+for PWM on MT7981 which has 3 PWM channels, one of them is typically
+used for a temperature controlled fan.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/pwm/pwm-mediatek.c | 41 ++++++++++++++++++++++++++++++--------
+ 1 file changed, 33 insertions(+), 8 deletions(-)
+
+--- a/drivers/pwm/pwm-mediatek.c
++++ b/drivers/pwm/pwm-mediatek.c
+@@ -38,6 +38,7 @@ struct pwm_mediatek_of_data {
+ 	unsigned int num_pwms;
+ 	bool pwm45_fixup;
+ 	bool has_ck_26m_sel;
++	const unsigned int *reg_offset;
+ };
+ 
+ /**
+@@ -59,10 +60,14 @@ struct pwm_mediatek_chip {
+ 	const struct pwm_mediatek_of_data *soc;
+ };
+ 
+-static const unsigned int pwm_mediatek_reg_offset[] = {
++static const unsigned int mtk_pwm_reg_offset_v1[] = {
+ 	0x0010, 0x0050, 0x0090, 0x00d0, 0x0110, 0x0150, 0x0190, 0x0220
+ };
+ 
++static const unsigned int mtk_pwm_reg_offset_v2[] = {
++	0x0080, 0x00c0, 0x0100, 0x0140, 0x0180, 0x01c0, 0x0200, 0x0240
++};
++
+ static inline struct pwm_mediatek_chip *
+ to_pwm_mediatek_chip(struct pwm_chip *chip)
+ {
+@@ -111,7 +116,7 @@ static inline void pwm_mediatek_writel(s
+ 				       unsigned int num, unsigned int offset,
+ 				       u32 value)
+ {
+-	writel(value, chip->regs + pwm_mediatek_reg_offset[num] + offset);
++	writel(value, chip->regs + chip->soc->reg_offset[num] + offset);
+ }
+ 
+ static int pwm_mediatek_config(struct pwm_chip *chip, struct pwm_device *pwm,
+@@ -270,48 +275,63 @@ static const struct pwm_mediatek_of_data
+ 	.num_pwms = 8,
+ 	.pwm45_fixup = false,
+ 	.has_ck_26m_sel = false,
++	.reg_offset = mtk_pwm_reg_offset_v1,
+ };
+ 
+ static const struct pwm_mediatek_of_data mt7622_pwm_data = {
+ 	.num_pwms = 6,
+ 	.pwm45_fixup = false,
+ 	.has_ck_26m_sel = true,
++	.reg_offset = mtk_pwm_reg_offset_v1,
+ };
+ 
+ static const struct pwm_mediatek_of_data mt7623_pwm_data = {
+ 	.num_pwms = 5,
+ 	.pwm45_fixup = true,
+ 	.has_ck_26m_sel = false,
++	.reg_offset = mtk_pwm_reg_offset_v1,
+ };
+ 
+ static const struct pwm_mediatek_of_data mt7628_pwm_data = {
+ 	.num_pwms = 4,
+ 	.pwm45_fixup = true,
+ 	.has_ck_26m_sel = false,
++	.reg_offset = mtk_pwm_reg_offset_v1,
+ };
+ 
+ static const struct pwm_mediatek_of_data mt7629_pwm_data = {
+ 	.num_pwms = 1,
+ 	.pwm45_fixup = false,
+ 	.has_ck_26m_sel = false,
++	.reg_offset = mtk_pwm_reg_offset_v1,
+ };
+ 
+ static const struct pwm_mediatek_of_data mt8183_pwm_data = {
+ 	.num_pwms = 4,
+ 	.pwm45_fixup = false,
+ 	.has_ck_26m_sel = true,
++	.reg_offset = mtk_pwm_reg_offset_v1,
++};
++
++static const struct pwm_mediatek_of_data mt7981_pwm_data = {
++	.num_pwms = 3,
++	.pwm45_fixup = false,
++	.has_ck_26m_sel = true,
++	.reg_offset = mtk_pwm_reg_offset_v2,
+ };
+ 
+ static const struct pwm_mediatek_of_data mt7986_pwm_data = {
+ 	.num_pwms = 2,
+ 	.pwm45_fixup = false,
+ 	.has_ck_26m_sel = true,
++	.reg_offset = mtk_pwm_reg_offset_v1,
+ };
+ 
+ static const struct pwm_mediatek_of_data mt8516_pwm_data = {
+ 	.num_pwms = 5,
+ 	.pwm45_fixup = false,
+ 	.has_ck_26m_sel = true,
++	.reg_offset = mtk_pwm_reg_offset_v1,
+ };
+ 
+ static const struct of_device_id pwm_mediatek_of_match[] = {
+@@ -320,6 +340,7 @@ static const struct of_device_id pwm_med
+ 	{ .compatible = "mediatek,mt7623-pwm", .data = &mt7623_pwm_data },
+ 	{ .compatible = "mediatek,mt7628-pwm", .data = &mt7628_pwm_data },
+ 	{ .compatible = "mediatek,mt7629-pwm", .data = &mt7629_pwm_data },
++	{ .compatible = "mediatek,mt7981-pwm", .data = &mt7981_pwm_data },
+ 	{ .compatible = "mediatek,mt7986-pwm", .data = &mt7986_pwm_data },
+ 	{ .compatible = "mediatek,mt8183-pwm", .data = &mt8183_pwm_data },
+ 	{ .compatible = "mediatek,mt8516-pwm", .data = &mt8516_pwm_data },
diff --git a/target/linux/mediatek/patches-5.15/820-v5.16-dt-bindings-pinctrl-mt8195-add-rsel-define.patch b/target/linux/mediatek/patches-5.15/820-v5.16-dt-bindings-pinctrl-mt8195-add-rsel-define.patch
new file mode 100644
index 00000000000000..f2be737146e19c
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/820-v5.16-dt-bindings-pinctrl-mt8195-add-rsel-define.patch
@@ -0,0 +1,33 @@
+From 26564c44357e19d03c124550bbd0b5851e6638c2 Mon Sep 17 00:00:00 2001
+From: Zhiyong Tao <zhiyong.tao@mediatek.com>
+Date: Fri, 24 Sep 2021 16:06:28 +0800
+Subject: [PATCH] dt-bindings: pinctrl: mt8195: add rsel define
+
+This patch adds rsel define for mt8195.
+
+Signed-off-by: Zhiyong Tao <zhiyong.tao@mediatek.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20210924080632.28410-2-zhiyong.tao@mediatek.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+---
+ include/dt-bindings/pinctrl/mt65xx.h | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/include/dt-bindings/pinctrl/mt65xx.h
++++ b/include/dt-bindings/pinctrl/mt65xx.h
+@@ -16,6 +16,15 @@
+ #define MTK_PUPD_SET_R1R0_10 102
+ #define MTK_PUPD_SET_R1R0_11 103
+ 
++#define MTK_PULL_SET_RSEL_000  200
++#define MTK_PULL_SET_RSEL_001  201
++#define MTK_PULL_SET_RSEL_010  202
++#define MTK_PULL_SET_RSEL_011  203
++#define MTK_PULL_SET_RSEL_100  204
++#define MTK_PULL_SET_RSEL_101  205
++#define MTK_PULL_SET_RSEL_110  206
++#define MTK_PULL_SET_RSEL_111  207
++
+ #define MTK_DRIVE_2mA  2
+ #define MTK_DRIVE_4mA  4
+ #define MTK_DRIVE_6mA  6
diff --git a/target/linux/mediatek/patches-5.15/821-v5.16-pinctrl-mediatek-moore-check-if-pin_desc-is-valid-be.patch b/target/linux/mediatek/patches-5.15/821-v5.16-pinctrl-mediatek-moore-check-if-pin_desc-is-valid-be.patch
new file mode 100644
index 00000000000000..aa9f879e3aa746
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/821-v5.16-pinctrl-mediatek-moore-check-if-pin_desc-is-valid-be.patch
@@ -0,0 +1,93 @@
+From d8b94c9ff96c2024a527086d850eb0b314337ff9 Mon Sep 17 00:00:00 2001
+From: Sam Shih <sam.shih@mediatek.com>
+Date: Tue, 14 Sep 2021 16:51:32 +0800
+Subject: [PATCH] pinctrl: mediatek: moore: check if pin_desc is valid before
+ use
+
+Certain SoC are missing the middle part gpios in consecutive pins,
+it's better to check if mtk_pin_desc is a valid pin for the extensibility
+
+Signed-off-by: Sam Shih <sam.shih@mediatek.com>
+Acked-by: Sean Wang <sean.wang@mediatek.com>
+Link: https://lore.kernel.org/r/20210914085137.31761-5-sam.shih@mediatek.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-moore.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/pinctrl/mediatek/pinctrl-moore.c
++++ b/drivers/pinctrl/mediatek/pinctrl-moore.c
+@@ -60,6 +60,8 @@ static int mtk_pinmux_set_mux(struct pin
+ 		int pin = grp->pins[i];
+ 
+ 		desc = (const struct mtk_pin_desc *)&hw->soc->pins[pin];
++		if (!desc->name)
++			return -ENOTSUPP;
+ 
+ 		mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_MODE,
+ 				 pin_modes[i]);
+@@ -76,6 +78,8 @@ static int mtk_pinmux_gpio_request_enabl
+ 	const struct mtk_pin_desc *desc;
+ 
+ 	desc = (const struct mtk_pin_desc *)&hw->soc->pins[pin];
++	if (!desc->name)
++		return -ENOTSUPP;
+ 
+ 	return mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_MODE,
+ 				hw->soc->gpio_m);
+@@ -89,6 +93,8 @@ static int mtk_pinmux_gpio_set_direction
+ 	const struct mtk_pin_desc *desc;
+ 
+ 	desc = (const struct mtk_pin_desc *)&hw->soc->pins[pin];
++	if (!desc->name)
++		return -ENOTSUPP;
+ 
+ 	/* hardware would take 0 as input direction */
+ 	return mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_DIR, !input);
+@@ -103,6 +109,8 @@ static int mtk_pinconf_get(struct pinctr
+ 	const struct mtk_pin_desc *desc;
+ 
+ 	desc = (const struct mtk_pin_desc *)&hw->soc->pins[pin];
++	if (!desc->name)
++		return -ENOTSUPP;
+ 
+ 	switch (param) {
+ 	case PIN_CONFIG_BIAS_DISABLE:
+@@ -218,6 +226,8 @@ static int mtk_pinconf_set(struct pinctr
+ 	int cfg, err = 0;
+ 
+ 	desc = (const struct mtk_pin_desc *)&hw->soc->pins[pin];
++	if (!desc->name)
++		return -ENOTSUPP;
+ 
+ 	for (cfg = 0; cfg < num_configs; cfg++) {
+ 		param = pinconf_to_config_param(configs[cfg]);
+@@ -435,6 +445,8 @@ static int mtk_gpio_get(struct gpio_chip
+ 	int value, err;
+ 
+ 	desc = (const struct mtk_pin_desc *)&hw->soc->pins[gpio];
++	if (!desc->name)
++		return -ENOTSUPP;
+ 
+ 	err = mtk_hw_get_value(hw, desc, PINCTRL_PIN_REG_DI, &value);
+ 	if (err)
+@@ -449,6 +461,10 @@ static void mtk_gpio_set(struct gpio_chi
+ 	const struct mtk_pin_desc *desc;
+ 
+ 	desc = (const struct mtk_pin_desc *)&hw->soc->pins[gpio];
++	if (!desc->name) {
++		dev_err(hw->dev, "Failed to set gpio %d\n", gpio);
++		return;
++	}
+ 
+ 	mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_DO, !!value);
+ }
+@@ -490,6 +506,8 @@ static int mtk_gpio_set_config(struct gp
+ 	u32 debounce;
+ 
+ 	desc = (const struct mtk_pin_desc *)&hw->soc->pins[offset];
++	if (!desc->name)
++		return -ENOTSUPP;
+ 
+ 	if (!hw->eint ||
+ 	    pinconf_to_config_param(config) != PIN_CONFIG_INPUT_DEBOUNCE ||
diff --git a/target/linux/mediatek/patches-5.15/822-v5.16-pinctrl-mediatek-support-rsel-feature.patch b/target/linux/mediatek/patches-5.15/822-v5.16-pinctrl-mediatek-support-rsel-feature.patch
new file mode 100644
index 00000000000000..0f5c0495feffdb
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/822-v5.16-pinctrl-mediatek-support-rsel-feature.patch
@@ -0,0 +1,457 @@
+From fb34a9ae383ae26326d4889fd2513e49f1019b88 Mon Sep 17 00:00:00 2001
+From: Zhiyong Tao <zhiyong.tao@mediatek.com>
+Date: Fri, 24 Sep 2021 16:06:31 +0800
+Subject: [PATCH] pinctrl: mediatek: support rsel feature
+
+This patch supports rsel(resistance selection) feature for I2C pins.
+It provides more resistance selection solution in different ICs.
+It provides rsel define and si unit solution by identifying
+"mediatek,rsel_resistance_in_si_unit" property in pio dtsi node.
+
+Signed-off-by: Zhiyong Tao <zhiyong.tao@mediatek.com>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20210924080632.28410-5-zhiyong.tao@mediatek.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+---
+ .../pinctrl/mediatek/pinctrl-mtk-common-v2.c  | 231 +++++++++++++++---
+ .../pinctrl/mediatek/pinctrl-mtk-common-v2.h  |  46 ++++
+ drivers/pinctrl/mediatek/pinctrl-paris.c      |  60 +++--
+ 3 files changed, 289 insertions(+), 48 deletions(-)
+
+--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
+@@ -665,6 +665,181 @@ out:
+ 	return err;
+ }
+ 
++static int mtk_hw_pin_rsel_lookup(struct mtk_pinctrl *hw,
++				  const struct mtk_pin_desc *desc,
++				  u32 pullup, u32 arg, u32 *rsel_val)
++{
++	const struct mtk_pin_rsel *rsel;
++	int check;
++	bool found = false;
++
++	rsel = hw->soc->pin_rsel;
++
++	for (check = 0; check <= hw->soc->npin_rsel - 1; check++) {
++		if (desc->number >= rsel[check].s_pin &&
++		    desc->number <= rsel[check].e_pin) {
++			if (pullup) {
++				if (rsel[check].up_rsel == arg) {
++					found = true;
++					*rsel_val = rsel[check].rsel_index;
++					break;
++				}
++			} else {
++				if (rsel[check].down_rsel == arg) {
++					found = true;
++					*rsel_val = rsel[check].rsel_index;
++					break;
++				}
++			}
++		}
++	}
++
++	if (!found) {
++		dev_err(hw->dev, "Not support rsel value %d Ohm for pin = %d (%s)\n",
++			arg, desc->number, desc->name);
++		return -ENOTSUPP;
++	}
++
++	return 0;
++}
++
++static int mtk_pinconf_bias_set_rsel(struct mtk_pinctrl *hw,
++				     const struct mtk_pin_desc *desc,
++				     u32 pullup, u32 arg)
++{
++	int err, rsel_val;
++
++	if (hw->rsel_si_unit) {
++		/* find pin rsel_index from pin_rsel array*/
++		err = mtk_hw_pin_rsel_lookup(hw, desc, pullup, arg, &rsel_val);
++		if (err)
++			goto out;
++	} else {
++		if (arg < MTK_PULL_SET_RSEL_000 ||
++		    arg > MTK_PULL_SET_RSEL_111) {
++			err = -EINVAL;
++			goto out;
++		}
++
++		rsel_val = arg - MTK_PULL_SET_RSEL_000;
++	}
++
++	err = mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_RSEL, rsel_val);
++	if (err)
++		goto out;
++
++	err = mtk_pinconf_bias_set_pu_pd(hw, desc, pullup, MTK_ENABLE);
++
++out:
++	return err;
++}
++
++int mtk_pinconf_bias_set_combo(struct mtk_pinctrl *hw,
++			       const struct mtk_pin_desc *desc,
++			       u32 pullup, u32 arg)
++{
++	int err = -ENOTSUPP;
++	u32 try_all_type;
++
++	if (hw->soc->pull_type)
++		try_all_type = hw->soc->pull_type[desc->number];
++	else
++		try_all_type = MTK_PULL_TYPE_MASK;
++
++	if (try_all_type & MTK_PULL_RSEL_TYPE) {
++		err = mtk_pinconf_bias_set_rsel(hw, desc, pullup, arg);
++		if (!err)
++			return err;
++	}
++
++	if (try_all_type & MTK_PULL_PU_PD_TYPE) {
++		err = mtk_pinconf_bias_set_pu_pd(hw, desc, pullup, arg);
++		if (!err)
++			return err;
++	}
++
++	if (try_all_type & MTK_PULL_PULLSEL_TYPE) {
++		err = mtk_pinconf_bias_set_pullsel_pullen(hw, desc,
++							  pullup, arg);
++		if (!err)
++			return err;
++	}
++
++	if (try_all_type & MTK_PULL_PUPD_R1R0_TYPE)
++		err = mtk_pinconf_bias_set_pupd_r1_r0(hw, desc, pullup, arg);
++
++	if (err)
++		dev_err(hw->dev, "Invalid pull argument\n");
++
++	return err;
++}
++EXPORT_SYMBOL_GPL(mtk_pinconf_bias_set_combo);
++
++static int mtk_rsel_get_si_unit(struct mtk_pinctrl *hw,
++				const struct mtk_pin_desc *desc,
++				u32 pullup, u32 rsel_val, u32 *si_unit)
++{
++	const struct mtk_pin_rsel *rsel;
++	int check;
++
++	rsel = hw->soc->pin_rsel;
++
++	for (check = 0; check <= hw->soc->npin_rsel - 1; check++) {
++		if (desc->number >= rsel[check].s_pin &&
++		    desc->number <= rsel[check].e_pin) {
++			if (rsel_val == rsel[check].rsel_index) {
++				if (pullup)
++					*si_unit = rsel[check].up_rsel;
++				else
++					*si_unit = rsel[check].down_rsel;
++				break;
++			}
++		}
++	}
++
++	return 0;
++}
++
++static int mtk_pinconf_bias_get_rsel(struct mtk_pinctrl *hw,
++				     const struct mtk_pin_desc *desc,
++				     u32 *pullup, u32 *enable)
++{
++	int pu, pd, rsel, err;
++
++	err = mtk_hw_get_value(hw, desc, PINCTRL_PIN_REG_RSEL, &rsel);
++	if (err)
++		goto out;
++
++	err = mtk_hw_get_value(hw, desc, PINCTRL_PIN_REG_PU, &pu);
++	if (err)
++		goto out;
++
++	err = mtk_hw_get_value(hw, desc, PINCTRL_PIN_REG_PD, &pd);
++
++	if (pu == 0 && pd == 0) {
++		*pullup = 0;
++		*enable = MTK_DISABLE;
++	} else if (pu == 1 && pd == 0) {
++		*pullup = 1;
++		if (hw->rsel_si_unit)
++			mtk_rsel_get_si_unit(hw, desc, *pullup, rsel, enable);
++		else
++			*enable = rsel + MTK_PULL_SET_RSEL_000;
++	} else if (pu == 0 && pd == 1) {
++		*pullup = 0;
++		if (hw->rsel_si_unit)
++			mtk_rsel_get_si_unit(hw, desc, *pullup, rsel, enable);
++		else
++			*enable = rsel + MTK_PULL_SET_RSEL_000;
++	} else {
++		err = -EINVAL;
++		goto out;
++	}
++
++out:
++	return err;
++}
++
+ static int mtk_pinconf_bias_get_pu_pd(struct mtk_pinctrl *hw,
+ 				const struct mtk_pin_desc *desc,
+ 				u32 *pullup, u32 *enable)
+@@ -746,44 +921,40 @@ out:
+ 	return err;
+ }
+ 
+-int mtk_pinconf_bias_set_combo(struct mtk_pinctrl *hw,
+-				const struct mtk_pin_desc *desc,
+-				u32 pullup, u32 arg)
+-{
+-	int err;
+-
+-	err = mtk_pinconf_bias_set_pu_pd(hw, desc, pullup, arg);
+-	if (!err)
+-		goto out;
+-
+-	err = mtk_pinconf_bias_set_pullsel_pullen(hw, desc, pullup, arg);
+-	if (!err)
+-		goto out;
+-
+-	err = mtk_pinconf_bias_set_pupd_r1_r0(hw, desc, pullup, arg);
+-
+-out:
+-	return err;
+-}
+-EXPORT_SYMBOL_GPL(mtk_pinconf_bias_set_combo);
+-
+ int mtk_pinconf_bias_get_combo(struct mtk_pinctrl *hw,
+ 			      const struct mtk_pin_desc *desc,
+ 			      u32 *pullup, u32 *enable)
+ {
+-	int err;
++	int err = -ENOTSUPP;
++	u32 try_all_type;
+ 
+-	err = mtk_pinconf_bias_get_pu_pd(hw, desc, pullup, enable);
+-	if (!err)
+-		goto out;
++	if (hw->soc->pull_type)
++		try_all_type = hw->soc->pull_type[desc->number];
++	else
++		try_all_type = MTK_PULL_TYPE_MASK;
+ 
+-	err = mtk_pinconf_bias_get_pullsel_pullen(hw, desc, pullup, enable);
+-	if (!err)
+-		goto out;
++	if (try_all_type & MTK_PULL_RSEL_TYPE) {
++		err = mtk_pinconf_bias_get_rsel(hw, desc, pullup, enable);
++		if (!err)
++			return err;
++	}
++
++	if (try_all_type & MTK_PULL_PU_PD_TYPE) {
++		err = mtk_pinconf_bias_get_pu_pd(hw, desc, pullup, enable);
++		if (!err)
++			return err;
++	}
++
++	if (try_all_type & MTK_PULL_PULLSEL_TYPE) {
++		err = mtk_pinconf_bias_get_pullsel_pullen(hw, desc,
++							  pullup, enable);
++		if (!err)
++			return err;
++	}
+ 
+-	err = mtk_pinconf_bias_get_pupd_r1_r0(hw, desc, pullup, enable);
++	if (try_all_type & MTK_PULL_PUPD_R1R0_TYPE)
++		err = mtk_pinconf_bias_get_pupd_r1_r0(hw, desc, pullup, enable);
+ 
+-out:
+ 	return err;
+ }
+ EXPORT_SYMBOL_GPL(mtk_pinconf_bias_get_combo);
+--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.h
++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.h
+@@ -17,6 +17,22 @@
+ #define MTK_ENABLE     1
+ #define MTK_PULLDOWN   0
+ #define MTK_PULLUP     1
++#define MTK_PULL_PU_PD_TYPE		BIT(0)
++#define MTK_PULL_PULLSEL_TYPE		BIT(1)
++#define MTK_PULL_PUPD_R1R0_TYPE		BIT(2)
++/* MTK_PULL_RSEL_TYPE can select resistance and can be
++ * turned on/off itself. But it can't be selected pull up/down
++ */
++#define MTK_PULL_RSEL_TYPE		BIT(3)
++/* MTK_PULL_PU_PD_RSEL_TYPE is a type which is controlled by
++ * MTK_PULL_PU_PD_TYPE and MTK_PULL_RSEL_TYPE.
++ */
++#define MTK_PULL_PU_PD_RSEL_TYPE	(MTK_PULL_PU_PD_TYPE \
++					| MTK_PULL_RSEL_TYPE)
++#define MTK_PULL_TYPE_MASK	(MTK_PULL_PU_PD_TYPE |\
++				 MTK_PULL_PULLSEL_TYPE |\
++				 MTK_PULL_PUPD_R1R0_TYPE |\
++				 MTK_PULL_RSEL_TYPE)
+ 
+ #define EINT_NA	U16_MAX
+ #define NO_EINT_SUPPORT	EINT_NA
+@@ -42,6 +58,14 @@
+ 	PIN_FIELD_CALC(_s_pin, _e_pin, 0, _s_addr, _x_addrs, _s_bit,	\
+ 		       _x_bits, 32, 1)
+ 
++#define PIN_RSEL(_s_pin, _e_pin, _rsel_index, _up_resl, _down_rsel) {	\
++		.s_pin = _s_pin,					\
++		.e_pin = _e_pin,					\
++		.rsel_index = _rsel_index,				\
++		.up_rsel = _up_resl,					\
++		.down_rsel = _down_rsel,				\
++	}
++
+ /* List these attributes which could be modified for the pin */
+ enum {
+ 	PINCTRL_PIN_REG_MODE,
+@@ -67,6 +91,7 @@ enum {
+ 	PINCTRL_PIN_REG_DRV_E0,
+ 	PINCTRL_PIN_REG_DRV_E1,
+ 	PINCTRL_PIN_REG_DRV_ADV,
++	PINCTRL_PIN_REG_RSEL,
+ 	PINCTRL_PIN_REG_MAX,
+ };
+ 
+@@ -129,6 +154,22 @@ struct mtk_pin_field_calc {
+ 	u8  fixed;
+ };
+ 
++/**
++ * struct mtk_pin_rsel - the structure that provides bias resistance selection.
++ * @s_pin:		the start pin within the rsel range
++ * @e_pin:		the end pin within the rsel range
++ * @rsel_index:	the rsel bias resistance index
++ * @up_rsel:	the pullup rsel bias resistance value
++ * @down_rsel:	the pulldown rsel bias resistance value
++ */
++struct mtk_pin_rsel {
++	u16 s_pin;
++	u16 e_pin;
++	u16 rsel_index;
++	u32 up_rsel;
++	u32 down_rsel;
++};
++
+ /* struct mtk_pin_reg_calc - the structure that holds all ranges used to
+  *			     determine which register the pin would make use of
+  *			     for certain pin attribute.
+@@ -206,6 +247,9 @@ struct mtk_pin_soc {
+ 	bool				ies_present;
+ 	const char * const		*base_names;
+ 	unsigned int			nbase_names;
++	const unsigned int		*pull_type;
++	const struct mtk_pin_rsel	*pin_rsel;
++	unsigned int			npin_rsel;
+ 
+ 	/* Specific pinconfig operations */
+ 	int (*bias_disable_set)(struct mtk_pinctrl *hw,
+@@ -254,6 +298,8 @@ struct mtk_pinctrl {
+ 	const char          **grp_names;
+ 	/* lock pin's register resource to avoid multiple threads issue*/
+ 	spinlock_t lock;
++	/* identify rsel setting by si unit or rsel define in dts node */
++	bool rsel_si_unit;
+ };
+ 
+ void mtk_rmw(struct mtk_pinctrl *pctl, u8 i, u32 reg, u32 mask, u32 set);
+--- a/drivers/pinctrl/mediatek/pinctrl-paris.c
++++ b/drivers/pinctrl/mediatek/pinctrl-paris.c
+@@ -574,8 +574,9 @@ static int mtk_hw_get_value_wrap(struct
+ ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw,
+ 	unsigned int gpio, char *buf, unsigned int buf_len)
+ {
+-	int pinmux, pullup = 0, pullen = 0, len = 0, r1 = -1, r0 = -1;
++	int pinmux, pullup = 0, pullen = 0, len = 0, r1 = -1, r0 = -1, rsel = -1;
+ 	const struct mtk_pin_desc *desc;
++	u32 try_all_type;
+ 
+ 	if (gpio >= hw->soc->npins)
+ 		return -EINVAL;
+@@ -589,24 +590,39 @@ ssize_t mtk_pctrl_show_one_pin(struct mt
+ 		pinmux -= hw->soc->nfuncs;
+ 
+ 	mtk_pinconf_bias_get_combo(hw, desc, &pullup, &pullen);
+-	if (pullen == MTK_PUPD_SET_R1R0_00) {
+-		pullen = 0;
+-		r1 = 0;
+-		r0 = 0;
+-	} else if (pullen == MTK_PUPD_SET_R1R0_01) {
+-		pullen = 1;
+-		r1 = 0;
+-		r0 = 1;
+-	} else if (pullen == MTK_PUPD_SET_R1R0_10) {
+-		pullen = 1;
+-		r1 = 1;
+-		r0 = 0;
+-	} else if (pullen == MTK_PUPD_SET_R1R0_11) {
++
++	if (hw->soc->pull_type)
++		try_all_type = hw->soc->pull_type[desc->number];
++
++	if (hw->rsel_si_unit && (try_all_type & MTK_PULL_RSEL_TYPE)) {
++		rsel = pullen;
+ 		pullen = 1;
+-		r1 = 1;
+-		r0 = 1;
+-	} else if (pullen != MTK_DISABLE && pullen != MTK_ENABLE) {
+-		pullen = 0;
++	} else {
++		/* Case for: R1R0 */
++		if (pullen == MTK_PUPD_SET_R1R0_00) {
++			pullen = 0;
++			r1 = 0;
++			r0 = 0;
++		} else if (pullen == MTK_PUPD_SET_R1R0_01) {
++			pullen = 1;
++			r1 = 0;
++			r0 = 1;
++		} else if (pullen == MTK_PUPD_SET_R1R0_10) {
++			pullen = 1;
++			r1 = 1;
++			r0 = 0;
++		} else if (pullen == MTK_PUPD_SET_R1R0_11) {
++			pullen = 1;
++			r1 = 1;
++			r0 = 1;
++		}
++
++		/* Case for: RSEL */
++		if (pullen >= MTK_PULL_SET_RSEL_000 &&
++		    pullen <= MTK_PULL_SET_RSEL_111) {
++			rsel = pullen - MTK_PULL_SET_RSEL_000;
++			pullen = 1;
++		}
+ 	}
+ 	len += scnprintf(buf + len, buf_len - len,
+ 			"%03d: %1d%1d%1d%1d%02d%1d%1d%1d%1d",
+@@ -624,6 +640,8 @@ ssize_t mtk_pctrl_show_one_pin(struct mt
+ 	if (r1 != -1) {
+ 		len += scnprintf(buf + len, buf_len - len, " (%1d %1d)\n",
+ 			r1, r0);
++	} else if (rsel != -1) {
++		len += scnprintf(buf + len, buf_len - len, " (%1d)\n", rsel);
+ 	} else {
+ 		len += scnprintf(buf + len, buf_len - len, "\n");
+ 	}
+@@ -966,6 +984,12 @@ int mtk_paris_pinctrl_probe(struct platf
+ 
+ 	hw->nbase = hw->soc->nbase_names;
+ 
++	if (of_find_property(hw->dev->of_node,
++			     "mediatek,rsel_resistance_in_si_unit", NULL))
++		hw->rsel_si_unit = true;
++	else
++		hw->rsel_si_unit = false;
++
+ 	spin_lock_init(&hw->lock);
+ 
+ 	err = mtk_pctrl_build_state(pdev);
diff --git a/target/linux/mediatek/patches-5.15/823-v5.17-pinctrl-mediatek-add-a-check-for-error-in-mtk_pincon.patch b/target/linux/mediatek/patches-5.15/823-v5.17-pinctrl-mediatek-add-a-check-for-error-in-mtk_pincon.patch
new file mode 100644
index 00000000000000..6752b4093b4175
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/823-v5.17-pinctrl-mediatek-add-a-check-for-error-in-mtk_pincon.patch
@@ -0,0 +1,31 @@
+From 9f9d17c228c89e38ed612500126daf626270be9a Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 27 Nov 2021 17:08:36 +0300
+Subject: [PATCH] pinctrl: mediatek: add a check for error in
+ mtk_pinconf_bias_get_rsel()
+
+All the other mtk_hw_get_value() calls have a check for "if (err)" so
+we can add one here as well.  This silences a Smatch warning:
+
+    drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c:819 mtk_pinconf_bias_get_rsel()
+    error: uninitialized symbol 'pd'.
+
+Fixes: fb34a9ae383a ("pinctrl: mediatek: support rsel feature")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20211127140836.GB24002@kili
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
+@@ -815,6 +815,8 @@ static int mtk_pinconf_bias_get_rsel(str
+ 		goto out;
+ 
+ 	err = mtk_hw_get_value(hw, desc, PINCTRL_PIN_REG_PD, &pd);
++	if (err)
++		goto out;
+ 
+ 	if (pu == 0 && pd == 0) {
+ 		*pullup = 0;
diff --git a/target/linux/mediatek/patches-5.15/824-v6.1-pinctrl-mediatek-Fix-EINT-pins-input-debounce-time-c.patch b/target/linux/mediatek/patches-5.15/824-v6.1-pinctrl-mediatek-Fix-EINT-pins-input-debounce-time-c.patch
new file mode 100644
index 00000000000000..47a29fbdba442a
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/824-v6.1-pinctrl-mediatek-Fix-EINT-pins-input-debounce-time-c.patch
@@ -0,0 +1,297 @@
+From e1ff91f9d2303cd4e706cc908bfca21cd17b9927 Mon Sep 17 00:00:00 2001
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Date: Fri, 11 Nov 2022 10:41:06 +0100
+Subject: [PATCH] pinctrl: mediatek: Fix EINT pins input debounce time
+ configuration
+
+The External Interrupt Controller (EINTC) on all of the supported
+MediaTek SoCs does support input debouncing, but not all of them
+index the debounce time values (DBNC_SETTING registers) the same way.
+
+Before this change, in some cases, as an example, requesting a debounce
+time of 16 milliseconds would mistakenly set the relative DBNC_SETTING
+register to 0x2, resulting in a way shorter debounce time of 500uS.
+
+To fix the aforementioned issue, define three different debounce_time
+arrays, reflecting the correct register index for each value and for
+each register index variant, and make sure that each SoC pinctrl
+driver uses the right one.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20221111094106.18486-1-angelogioacchino.delregno@collabora.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+---
+ drivers/pinctrl/mediatek/mtk-eint.c       | 31 +++++++++++++++++++----
+ drivers/pinctrl/mediatek/mtk-eint.h       |  6 +++++
+ drivers/pinctrl/mediatek/pinctrl-mt2701.c |  1 +
+ drivers/pinctrl/mediatek/pinctrl-mt2712.c |  1 +
+ drivers/pinctrl/mediatek/pinctrl-mt6765.c |  1 +
+ drivers/pinctrl/mediatek/pinctrl-mt6779.c |  1 +
+ drivers/pinctrl/mediatek/pinctrl-mt7622.c |  1 +
+ drivers/pinctrl/mediatek/pinctrl-mt7623.c |  1 +
+ drivers/pinctrl/mediatek/pinctrl-mt7629.c |  1 +
+ drivers/pinctrl/mediatek/pinctrl-mt8127.c |  1 +
+ drivers/pinctrl/mediatek/pinctrl-mt8135.c |  1 +
+ drivers/pinctrl/mediatek/pinctrl-mt8167.c |  1 +
+ drivers/pinctrl/mediatek/pinctrl-mt8173.c |  1 +
+ drivers/pinctrl/mediatek/pinctrl-mt8183.c |  1 +
+ drivers/pinctrl/mediatek/pinctrl-mt8192.c |  1 +
+ drivers/pinctrl/mediatek/pinctrl-mt8195.c |  1 +
+ drivers/pinctrl/mediatek/pinctrl-mt8365.c |  1 +
+ drivers/pinctrl/mediatek/pinctrl-mt8516.c |  1 +
+ 22 files changed, 53 insertions(+), 5 deletions(-)
+
+--- a/drivers/pinctrl/mediatek/mtk-eint.c
++++ b/drivers/pinctrl/mediatek/mtk-eint.c
+@@ -24,6 +24,7 @@
+ #define MTK_EINT_EDGE_SENSITIVE           0
+ #define MTK_EINT_LEVEL_SENSITIVE          1
+ #define MTK_EINT_DBNC_SET_DBNC_BITS	  4
++#define MTK_EINT_DBNC_MAX		  16
+ #define MTK_EINT_DBNC_RST_BIT		  (0x1 << 1)
+ #define MTK_EINT_DBNC_SET_EN		  (0x1 << 0)
+ 
+@@ -48,6 +49,18 @@ static const struct mtk_eint_regs mtk_ge
+ 	.dbnc_clr  = 0x700,
+ };
+ 
++const unsigned int debounce_time_mt2701[] = {
++	500, 1000, 16000, 32000, 64000, 128000, 256000, 0
++};
++
++const unsigned int debounce_time_mt6765[] = {
++	125, 250, 500, 1000, 16000, 32000, 64000, 128000, 256000, 512000, 0
++};
++
++const unsigned int debounce_time_mt6795[] = {
++	500, 1000, 16000, 32000, 64000, 128000, 256000, 512000, 0
++};
++
+ static void __iomem *mtk_eint_get_offset(struct mtk_eint *eint,
+ 					 unsigned int eint_num,
+ 					 unsigned int offset)
+@@ -407,10 +420,11 @@ int mtk_eint_set_debounce(struct mtk_ein
+ 	int virq, eint_offset;
+ 	unsigned int set_offset, bit, clr_bit, clr_offset, rst, i, unmask,
+ 		     dbnc;
+-	static const unsigned int debounce_time[] = {500, 1000, 16000, 32000,
+-						     64000, 128000, 256000};
+ 	struct irq_data *d;
+ 
++	if (!eint->hw->db_time)
++		return -EOPNOTSUPP;
++
+ 	virq = irq_find_mapping(eint->domain, eint_num);
+ 	eint_offset = (eint_num % 4) * 8;
+ 	d = irq_get_irq_data(virq);
+@@ -421,9 +435,9 @@ int mtk_eint_set_debounce(struct mtk_ein
+ 	if (!mtk_eint_can_en_debounce(eint, eint_num))
+ 		return -EINVAL;
+ 
+-	dbnc = ARRAY_SIZE(debounce_time);
+-	for (i = 0; i < ARRAY_SIZE(debounce_time); i++) {
+-		if (debounce <= debounce_time[i]) {
++	dbnc = eint->num_db_time;
++	for (i = 0; i < eint->num_db_time; i++) {
++		if (debounce <= eint->hw->db_time[i]) {
+ 			dbnc = i;
+ 			break;
+ 		}
+@@ -497,6 +511,13 @@ int mtk_eint_do_init(struct mtk_eint *ei
+ 	if (!eint->domain)
+ 		return -ENOMEM;
+ 
++	if (eint->hw->db_time) {
++		for (i = 0; i < MTK_EINT_DBNC_MAX; i++)
++			if (eint->hw->db_time[i] == 0)
++				break;
++		eint->num_db_time = i;
++	}
++
+ 	mtk_eint_hw_init(eint);
+ 	for (i = 0; i < eint->hw->ap_num; i++) {
+ 		int virq = irq_create_mapping(eint->domain, i);
+--- a/drivers/pinctrl/mediatek/mtk-eint.h
++++ b/drivers/pinctrl/mediatek/mtk-eint.h
+@@ -37,8 +37,13 @@ struct mtk_eint_hw {
+ 	u8		ports;
+ 	unsigned int	ap_num;
+ 	unsigned int	db_cnt;
++	const unsigned int *db_time;
+ };
+ 
++extern const unsigned int debounce_time_mt2701[];
++extern const unsigned int debounce_time_mt6765[];
++extern const unsigned int debounce_time_mt6795[];
++
+ struct mtk_eint;
+ 
+ struct mtk_eint_xt {
+@@ -62,6 +67,7 @@ struct mtk_eint {
+ 	/* Used to fit into various EINT device */
+ 	const struct mtk_eint_hw *hw;
+ 	const struct mtk_eint_regs *regs;
++	u16 num_db_time;
+ 
+ 	/* Used to fit into various pinctrl device */
+ 	void *pctl;
+--- a/drivers/pinctrl/mediatek/pinctrl-mt2701.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt2701.c
+@@ -531,6 +531,7 @@ static const struct mtk_pinctrl_devdata
+ 		.ports     = 6,
+ 		.ap_num    = 169,
+ 		.db_cnt    = 16,
++		.db_time   = debounce_time_mt2701,
+ 	},
+ };
+ 
+--- a/drivers/pinctrl/mediatek/pinctrl-mt2712.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt2712.c
+@@ -584,6 +584,7 @@ static const struct mtk_pinctrl_devdata
+ 		.ports     = 8,
+ 		.ap_num    = 229,
+ 		.db_cnt    = 40,
++		.db_time   = debounce_time_mt2701,
+ 	},
+ };
+ 
+--- a/drivers/pinctrl/mediatek/pinctrl-mt6765.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt6765.c
+@@ -1062,6 +1062,7 @@ static const struct mtk_eint_hw mt6765_e
+ 	.ports     = 6,
+ 	.ap_num    = 160,
+ 	.db_cnt    = 13,
++	.db_time   = debounce_time_mt6765,
+ };
+ 
+ static const struct mtk_pin_soc mt6765_data = {
+--- a/drivers/pinctrl/mediatek/pinctrl-mt6779.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt6779.c
+@@ -737,6 +737,7 @@ static const struct mtk_eint_hw mt6779_e
+ 	.ports     = 6,
+ 	.ap_num    = 195,
+ 	.db_cnt    = 13,
++	.db_time   = debounce_time_mt2701,
+ };
+ 
+ static const struct mtk_pin_soc mt6779_data = {
+--- a/drivers/pinctrl/mediatek/pinctrl-mt7622.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt7622.c
+@@ -846,6 +846,7 @@ static const struct mtk_eint_hw mt7622_e
+ 	.ports     = 7,
+ 	.ap_num    = ARRAY_SIZE(mt7622_pins),
+ 	.db_cnt    = 20,
++	.db_time   = debounce_time_mt6765,
+ };
+ 
+ static const struct mtk_pin_soc mt7622_data = {
+--- a/drivers/pinctrl/mediatek/pinctrl-mt7623.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt7623.c
+@@ -1369,6 +1369,7 @@ static const struct mtk_eint_hw mt7623_e
+ 	.ports     = 6,
+ 	.ap_num    = 169,
+ 	.db_cnt    = 20,
++	.db_time   = debounce_time_mt2701,
+ };
+ 
+ static struct mtk_pin_soc mt7623_data = {
+--- a/drivers/pinctrl/mediatek/pinctrl-mt7629.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt7629.c
+@@ -402,6 +402,7 @@ static const struct mtk_eint_hw mt7629_e
+ 	.ports     = 7,
+ 	.ap_num    = ARRAY_SIZE(mt7629_pins),
+ 	.db_cnt    = 16,
++	.db_time   = debounce_time_mt2701,
+ };
+ 
+ static struct mtk_pin_soc mt7629_data = {
+--- a/drivers/pinctrl/mediatek/pinctrl-mt8127.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt8127.c
+@@ -300,6 +300,7 @@ static const struct mtk_pinctrl_devdata
+ 		.ports     = 6,
+ 		.ap_num    = 143,
+ 		.db_cnt    = 16,
++		.db_time = debounce_time_mt2701,
+ 	},
+ };
+ 
+--- a/drivers/pinctrl/mediatek/pinctrl-mt8135.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt8135.c
+@@ -313,6 +313,7 @@ static const struct mtk_pinctrl_devdata
+ 		.ports     = 6,
+ 		.ap_num    = 192,
+ 		.db_cnt    = 16,
++		.db_time = debounce_time_mt2701,
+ 	},
+ };
+ 
+--- a/drivers/pinctrl/mediatek/pinctrl-mt8167.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt8167.c
+@@ -332,6 +332,7 @@ static const struct mtk_pinctrl_devdata
+ 		.ports     = 6,
+ 		.ap_num    = 169,
+ 		.db_cnt    = 64,
++		.db_time = debounce_time_mt6795,
+ 	},
+ };
+ 
+--- a/drivers/pinctrl/mediatek/pinctrl-mt8173.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt8173.c
+@@ -340,6 +340,7 @@ static const struct mtk_pinctrl_devdata
+ 		.ports     = 6,
+ 		.ap_num    = 224,
+ 		.db_cnt    = 16,
++		.db_time   = debounce_time_mt2701,
+ 	},
+ };
+ 
+--- a/drivers/pinctrl/mediatek/pinctrl-mt8183.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt8183.c
+@@ -545,6 +545,7 @@ static const struct mtk_eint_hw mt8183_e
+ 	.ports     = 6,
+ 	.ap_num    = 212,
+ 	.db_cnt    = 13,
++	.db_time   = debounce_time_mt6765,
+ };
+ 
+ static const struct mtk_pin_soc mt8183_data = {
+--- a/drivers/pinctrl/mediatek/pinctrl-mt8192.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt8192.c
+@@ -1339,6 +1339,7 @@ static const struct mtk_eint_hw mt8192_e
+ 	.ports     = 7,
+ 	.ap_num    = 224,
+ 	.db_cnt    = 32,
++	.db_time   = debounce_time_mt6765,
+ };
+ 
+ static const struct mtk_pin_reg_calc mt8192_reg_cals[PINCTRL_PIN_REG_MAX] = {
+--- a/drivers/pinctrl/mediatek/pinctrl-mt8195.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt8195.c
+@@ -805,6 +805,7 @@ static const struct mtk_eint_hw mt8195_e
+ 	.ports     = 7,
+ 	.ap_num    = 225,
+ 	.db_cnt    = 32,
++	.db_time   = debounce_time_mt6765,
+ };
+ 
+ static const struct mtk_pin_soc mt8195_data = {
+--- a/drivers/pinctrl/mediatek/pinctrl-mt8365.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt8365.c
+@@ -466,6 +466,7 @@ static const struct mtk_pinctrl_devdata
+ 		.ports     = 5,
+ 		.ap_num = 160,
+ 		.db_cnt = 160,
++		.db_time   = debounce_time_mt6765,
+ 	},
+ };
+ 
+--- a/drivers/pinctrl/mediatek/pinctrl-mt8516.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt8516.c
+@@ -332,6 +332,7 @@ static const struct mtk_pinctrl_devdata
+ 		.ports     = 6,
+ 		.ap_num    = 169,
+ 		.db_cnt    = 64,
++		.db_time   = debounce_time_mt6795,
+ 	},
+ };
+ 
diff --git a/target/linux/mediatek/patches-5.15/825-v6.1-pinctrl-mediatek-Export-debounce-time-tables.patch b/target/linux/mediatek/patches-5.15/825-v6.1-pinctrl-mediatek-Export-debounce-time-tables.patch
new file mode 100644
index 00000000000000..92f4e842e8acc6
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/825-v6.1-pinctrl-mediatek-Export-debounce-time-tables.patch
@@ -0,0 +1,37 @@
+From 2e35b25dd8e666b8619355fc3defb1b246a5dc02 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Tue, 15 Nov 2022 09:11:07 +0100
+Subject: [PATCH] pinctrl: mediatek: Export debounce time tables
+
+The kernel test robot complains that in certain combinations
+when building the Mediatek drivers as modules we lack some
+debounce table symbols, so export them.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Fixes: e1ff91f9d230 ("pinctrl: mediatek: Fix EINT pins input debounce time configuration")
+Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+---
+ drivers/pinctrl/mediatek/mtk-eint.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/pinctrl/mediatek/mtk-eint.c
++++ b/drivers/pinctrl/mediatek/mtk-eint.c
+@@ -52,14 +52,17 @@ static const struct mtk_eint_regs mtk_ge
+ const unsigned int debounce_time_mt2701[] = {
+ 	500, 1000, 16000, 32000, 64000, 128000, 256000, 0
+ };
++EXPORT_SYMBOL_GPL(debounce_time_mt2701);
+ 
+ const unsigned int debounce_time_mt6765[] = {
+ 	125, 250, 500, 1000, 16000, 32000, 64000, 128000, 256000, 512000, 0
+ };
++EXPORT_SYMBOL_GPL(debounce_time_mt6765);
+ 
+ const unsigned int debounce_time_mt6795[] = {
+ 	500, 1000, 16000, 32000, 64000, 128000, 256000, 512000, 0
+ };
++EXPORT_SYMBOL_GPL(debounce_time_mt6795);
+ 
+ static void __iomem *mtk_eint_get_offset(struct mtk_eint *eint,
+ 					 unsigned int eint_num,
diff --git a/target/linux/mediatek/patches-5.15/826-v6.2-pinctrl-mediatek-extend-pinctrl-moore-to-support-new.patch b/target/linux/mediatek/patches-5.15/826-v6.2-pinctrl-mediatek-extend-pinctrl-moore-to-support-new.patch
new file mode 100644
index 00000000000000..f130fdbc566909
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/826-v6.2-pinctrl-mediatek-extend-pinctrl-moore-to-support-new.patch
@@ -0,0 +1,129 @@
+From fae82621ac33e2a4a96220c56e90d1ec6237d394 Mon Sep 17 00:00:00 2001
+From: Sam Shih <sam.shih@mediatek.com>
+Date: Sun, 6 Nov 2022 09:01:12 +0100
+Subject: [PATCH] pinctrl: mediatek: extend pinctrl-moore to support new bias
+ functions
+
+Commit fb34a9ae383a ("pinctrl: mediatek: support rsel feature")
+introduced SoC specify 'pull_type' attribute to mtk_pinconf_bias_set_combo
+and mtk_pinconf_bias_get_combo, and make the functions able to support
+almost all Mediatek SoCs that use pinctrl-mtk-common-v2.c.
+
+This patch enables pinctrl_moore to support these functions.
+
+Signed-off-by: Sam Shih <sam.shih@mediatek.com>
+Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20221106080114.7426-6-linux@fw-web.de
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-moore.c | 49 ++++++++++++++++++++----
+ 1 file changed, 42 insertions(+), 7 deletions(-)
+
+--- a/drivers/pinctrl/mediatek/pinctrl-moore.c
++++ b/drivers/pinctrl/mediatek/pinctrl-moore.c
+@@ -8,6 +8,7 @@
+  *
+  */
+ 
++#include <dt-bindings/pinctrl/mt65xx.h>
+ #include <linux/gpio/driver.h>
+ #include "pinctrl-moore.h"
+ 
+@@ -105,7 +106,7 @@ static int mtk_pinconf_get(struct pinctr
+ {
+ 	struct mtk_pinctrl *hw = pinctrl_dev_get_drvdata(pctldev);
+ 	u32 param = pinconf_to_config_param(*config);
+-	int val, val2, err, reg, ret = 1;
++	int val, val2, err, pullup, reg, ret = 1;
+ 	const struct mtk_pin_desc *desc;
+ 
+ 	desc = (const struct mtk_pin_desc *)&hw->soc->pins[pin];
+@@ -114,7 +115,13 @@ static int mtk_pinconf_get(struct pinctr
+ 
+ 	switch (param) {
+ 	case PIN_CONFIG_BIAS_DISABLE:
+-		if (hw->soc->bias_disable_get) {
++		if (hw->soc->bias_get_combo) {
++			err = hw->soc->bias_get_combo(hw, desc, &pullup, &ret);
++			if (err)
++				return err;
++			if (ret != MTK_PUPD_SET_R1R0_00 && ret != MTK_DISABLE)
++				return -EINVAL;
++		} else if (hw->soc->bias_disable_get) {
+ 			err = hw->soc->bias_disable_get(hw, desc, &ret);
+ 			if (err)
+ 				return err;
+@@ -123,7 +130,15 @@ static int mtk_pinconf_get(struct pinctr
+ 		}
+ 		break;
+ 	case PIN_CONFIG_BIAS_PULL_UP:
+-		if (hw->soc->bias_get) {
++		if (hw->soc->bias_get_combo) {
++			err = hw->soc->bias_get_combo(hw, desc, &pullup, &ret);
++			if (err)
++				return err;
++			if (ret == MTK_PUPD_SET_R1R0_00 || ret == MTK_DISABLE)
++				return -EINVAL;
++			if (!pullup)
++				return -EINVAL;
++		} else if (hw->soc->bias_get) {
+ 			err = hw->soc->bias_get(hw, desc, 1, &ret);
+ 			if (err)
+ 				return err;
+@@ -132,7 +147,15 @@ static int mtk_pinconf_get(struct pinctr
+ 		}
+ 		break;
+ 	case PIN_CONFIG_BIAS_PULL_DOWN:
+-		if (hw->soc->bias_get) {
++		if (hw->soc->bias_get_combo) {
++			err = hw->soc->bias_get_combo(hw, desc, &pullup, &ret);
++			if (err)
++				return err;
++			if (ret == MTK_PUPD_SET_R1R0_00 || ret == MTK_DISABLE)
++				return -EINVAL;
++			if (pullup)
++				return -EINVAL;
++		} else if (hw->soc->bias_get) {
+ 			err = hw->soc->bias_get(hw, desc, 0, &ret);
+ 			if (err)
+ 				return err;
+@@ -235,7 +258,11 @@ static int mtk_pinconf_set(struct pinctr
+ 
+ 		switch (param) {
+ 		case PIN_CONFIG_BIAS_DISABLE:
+-			if (hw->soc->bias_disable_set) {
++			if (hw->soc->bias_set_combo) {
++				err = hw->soc->bias_set_combo(hw, desc, 0, MTK_DISABLE);
++				if (err)
++					return err;
++			} else if (hw->soc->bias_disable_set) {
+ 				err = hw->soc->bias_disable_set(hw, desc);
+ 				if (err)
+ 					return err;
+@@ -244,7 +271,11 @@ static int mtk_pinconf_set(struct pinctr
+ 			}
+ 			break;
+ 		case PIN_CONFIG_BIAS_PULL_UP:
+-			if (hw->soc->bias_set) {
++			if (hw->soc->bias_set_combo) {
++				err = hw->soc->bias_set_combo(hw, desc, 1, arg);
++				if (err)
++					return err;
++			} else if (hw->soc->bias_set) {
+ 				err = hw->soc->bias_set(hw, desc, 1);
+ 				if (err)
+ 					return err;
+@@ -253,7 +284,11 @@ static int mtk_pinconf_set(struct pinctr
+ 			}
+ 			break;
+ 		case PIN_CONFIG_BIAS_PULL_DOWN:
+-			if (hw->soc->bias_set) {
++			if (hw->soc->bias_set_combo) {
++				err = hw->soc->bias_set_combo(hw, desc, 0, arg);
++				if (err)
++					return err;
++			} else if (hw->soc->bias_set) {
+ 				err = hw->soc->bias_set(hw, desc, 0);
+ 				if (err)
+ 					return err;
diff --git a/target/linux/mediatek/patches-5.15/830-v5.18-regulator-Add-bindings-for-Richtek-RT5190A-PMIC.patch b/target/linux/mediatek/patches-5.15/830-v5.18-regulator-Add-bindings-for-Richtek-RT5190A-PMIC.patch
new file mode 100644
index 00000000000000..30891d34872b5f
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/830-v5.18-regulator-Add-bindings-for-Richtek-RT5190A-PMIC.patch
@@ -0,0 +1,180 @@
+From b77e70f6b8f2cc62fba847f3008a430a09ef275d Mon Sep 17 00:00:00 2001
+From: ChiYuan Huang <cy_huang@richtek.com>
+Date: Wed, 9 Mar 2022 16:01:42 +0800
+Subject: [PATCH 1/2] regulator: Add bindings for Richtek RT5190A PMIC
+
+Add bindings for Richtek RT5190A PMIC.
+
+Signed-off-by: ChiYuan Huang <cy_huang@richtek.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Link: https://lore.kernel.org/r/1646812903-32496-2-git-send-email-u0084500@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+---
+ .../regulator/richtek,rt5190a-regulator.yaml  | 141 ++++++++++++++++++
+ .../regulator/richtek,rt5190a-regulator.h     |  15 ++
+ 2 files changed, 156 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/regulator/richtek,rt5190a-regulator.yaml
+ create mode 100644 include/dt-bindings/regulator/richtek,rt5190a-regulator.h
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/regulator/richtek,rt5190a-regulator.yaml
+@@ -0,0 +1,141 @@
++# SPDX-License-Identifier: GPL-2.0-only OR BSD-2-Clause
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/regulator/richtek,rt5190a-regulator.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Richtek RT5190A PMIC Regulator
++
++maintainers:
++  - ChiYuan Huang <cy_huang@richtek.com>
++
++description: |
++  The RT5190A integrates 1 channel buck controller, 3 channels high efficiency
++  synchronous buck converters, 1 LDO, I2C control interface and peripherial
++  logical control.
++
++  It also supports mute AC OFF depop sound and quick setting storage while
++  input power is removed.
++
++properties:
++  compatible:
++    enum:
++      - richtek,rt5190a
++
++  reg:
++    maxItems: 1
++
++  interrupts:
++    maxItems: 1
++
++  vin2-supply:
++    description: phandle to buck2 input voltage.
++
++  vin3-supply:
++    description: phandle to buck3 input voltage.
++
++  vin4-supply:
++    description: phandle to buck4 input voltage.
++
++  vinldo-supply:
++    description: phandle to ldo input voltage
++
++  richtek,mute-enable:
++    description: |
++      The mute function uses 'mutein', 'muteout', and 'vdet' pins as the control
++      signal. When enabled, The normal behavior is to bypass the 'mutein' signal
++      'muteout'. But if the power source removal is detected from 'vdet',
++      whatever the 'mutein' signal is, it will pull down the 'muteout' to force
++      speakers mute. this function is commonly used to prevent the speaker pop
++      noise during AC power turned off in the modern TV system design.
++    type: boolean
++
++  regulators:
++    type: object
++
++    patternProperties:
++      "^buck[1-4]$|^ldo$":
++        type: object
++        $ref: regulator.yaml#
++        description: |
++          regulator description for buck1 and buck4.
++
++        properties:
++          regulator-allowed-modes:
++            description: |
++             buck operating mode, only buck1/4 support mode operating.
++              0: auto mode
++              1: force pwm mode
++            items:
++              enum: [0, 1]
++
++          richtek,latchup-enable:
++            type: boolean
++            description: |
++              If specified, undervolt protection mode changes from the default
++              hiccup to latchup.
++
++        unevaluatedProperties: false
++
++    additionalProperties: false
++
++required:
++  - compatible
++  - reg
++  - regulators
++
++additionalProperties: false
++
++examples:
++  - |
++    #include <dt-bindings/interrupt-controller/irq.h>
++    #include <dt-bindings/regulator/richtek,rt5190a-regulator.h>
++
++    i2c {
++      #address-cells = <1>;
++      #size-cells = <0>;
++
++      pmic@64 {
++        compatible = "richtek,rt5190a";
++        reg = <0x64>;
++        interrupts-extended = <&gpio26 0 IRQ_TYPE_LEVEL_LOW>;
++        vin2-supply = <&rt5190_buck1>;
++        vin3-supply = <&rt5190_buck1>;
++        vin4-supply = <&rt5190_buck1>;
++
++        regulators {
++          rt5190_buck1: buck1 {
++            regulator-name = "rt5190a-buck1";
++            regulator-min-microvolt = <5090000>;
++            regulator-max-microvolt = <5090000>;
++            regulator-allowed-modes = <RT5190A_OPMODE_AUTO RT5190A_OPMODE_FPWM>;
++            regulator-boot-on;
++          };
++          buck2 {
++            regulator-name = "rt5190a-buck2";
++            regulator-min-microvolt = <600000>;
++            regulator-max-microvolt = <1400000>;
++            regulator-boot-on;
++          };
++          buck3 {
++            regulator-name = "rt5190a-buck3";
++            regulator-min-microvolt = <600000>;
++            regulator-max-microvolt = <1400000>;
++            regulator-boot-on;
++          };
++          buck4 {
++            regulator-name = "rt5190a-buck4";
++            regulator-min-microvolt = <850000>;
++            regulator-max-microvolt = <850000>;
++            regulator-allowed-modes = <RT5190A_OPMODE_AUTO RT5190A_OPMODE_FPWM>;
++            regulator-boot-on;
++          };
++          ldo {
++            regulator-name = "rt5190a-ldo";
++            regulator-min-microvolt = <1200000>;
++            regulator-max-microvolt = <1200000>;
++            regulator-boot-on;
++          };
++        };
++      };
++    };
+--- /dev/null
++++ b/include/dt-bindings/regulator/richtek,rt5190a-regulator.h
+@@ -0,0 +1,15 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++
++#ifndef __DT_BINDINGS_RICHTEK_RT5190A_REGULATOR_H__
++#define __DT_BINDINGS_RICHTEK_RT5190A_REGULATOR_H__
++
++/*
++ * BUCK/LDO mode constants which may be used in devicetree properties
++ * (eg. regulator-allowed-modes).
++ * See the manufacturer's datasheet for more information on these modes.
++ */
++
++#define RT5190A_OPMODE_AUTO	0
++#define RT5190A_OPMODE_FPWM	1
++
++#endif
diff --git a/target/linux/mediatek/patches-5.15/831-v5.18-regulator-rt5190a-Add-support-for-Richtek-RT5190A-PM.patch b/target/linux/mediatek/patches-5.15/831-v5.18-regulator-rt5190a-Add-support-for-Richtek-RT5190A-PM.patch
new file mode 100644
index 00000000000000..0e0f099e5058df
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/831-v5.18-regulator-rt5190a-Add-support-for-Richtek-RT5190A-PM.patch
@@ -0,0 +1,562 @@
+From 760423dfad53877b468490758fe7ea968ded9402 Mon Sep 17 00:00:00 2001
+From: ChiYuan Huang <cy_huang@richtek.com>
+Date: Wed, 9 Mar 2022 16:01:43 +0800
+Subject: [PATCH 2/2] regulator: rt5190a: Add support for Richtek RT5190A PMIC
+
+Add support for Richtek RT5190A PMIC.
+
+Signed-off-by: ChiYuan Huang <cy_huang@richtek.com>
+Link: https://lore.kernel.org/r/1646812903-32496-3-git-send-email-u0084500@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+---
+ drivers/regulator/Kconfig             |  10 +
+ drivers/regulator/Makefile            |   1 +
+ drivers/regulator/rt5190a-regulator.c | 513 ++++++++++++++++++++++++++
+ 3 files changed, 524 insertions(+)
+ create mode 100644 drivers/regulator/rt5190a-regulator.c
+
+--- a/drivers/regulator/Kconfig
++++ b/drivers/regulator/Kconfig
+@@ -1037,6 +1037,16 @@ config REGULATOR_RT5033
+ 	  RT5033 PMIC. The device supports multiple regulators like
+ 	  current source, LDO and Buck.
+ 
++config REGULATOR_RT5190A
++	tristate "Richtek RT5190A PMIC"
++	depends on I2C
++	select REGMAP_I2C
++	help
++	  This adds support for voltage regulator in Richtek RT5190A PMIC.
++	  It integratas 1 channel buck controller, 3 channels high efficiency
++	  buck converters, 1 LDO, mute AC OFF depop function, with the general
++	  I2C control interface.
++
+ config REGULATOR_RT6160
+ 	tristate "Richtek RT6160 BuckBoost voltage regulator"
+ 	depends on I2C
+--- a/drivers/regulator/Makefile
++++ b/drivers/regulator/Makefile
+@@ -125,6 +125,7 @@ obj-$(CONFIG_REGULATOR_ROHM)	+= rohm-reg
+ obj-$(CONFIG_REGULATOR_RT4801)	+= rt4801-regulator.o
+ obj-$(CONFIG_REGULATOR_RT4831)	+= rt4831-regulator.o
+ obj-$(CONFIG_REGULATOR_RT5033)	+= rt5033-regulator.o
++obj-$(CONFIG_REGULATOR_RT5190A) += rt5190a-regulator.o
+ obj-$(CONFIG_REGULATOR_RT6160)	+= rt6160-regulator.o
+ obj-$(CONFIG_REGULATOR_RT6245)	+= rt6245-regulator.o
+ obj-$(CONFIG_REGULATOR_RTMV20)	+= rtmv20-regulator.o
+--- /dev/null
++++ b/drivers/regulator/rt5190a-regulator.c
+@@ -0,0 +1,513 @@
++// SPDX-License-Identifier: GPL-2.0+
++
++#include <dt-bindings/regulator/richtek,rt5190a-regulator.h>
++#include <linux/bits.h>
++#include <linux/i2c.h>
++#include <linux/interrupt.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/property.h>
++#include <linux/regmap.h>
++#include <linux/regulator/driver.h>
++#include <linux/regulator/machine.h>
++#include <linux/regulator/of_regulator.h>
++
++#define RT5190A_REG_MANUFACTURE		0x00
++#define RT5190A_REG_BUCK2VSEL		0x04
++#define RT5190A_REG_BUCK3VSEL		0x05
++#define RT5190A_REG_DCDCCNTL		0x06
++#define RT5190A_REG_ENABLE		0x07
++#define RT5190A_REG_DISCHARGE		0x09
++#define RT5190A_REG_PROTMODE		0x0A
++#define RT5190A_REG_MUTECNTL		0x0B
++#define RT5190A_REG_PGSTAT		0x0F
++#define RT5190A_REG_OVINT		0x10
++#define RT5190A_REG_HOTDIEMASK		0x17
++
++#define RT5190A_VSEL_MASK		GENMASK(6, 0)
++#define RT5190A_RID_BITMASK(rid)	BIT(rid + 1)
++#define RT5190A_BUCK1_DISCHG_MASK	GENMASK(1, 0)
++#define RT5190A_BUCK1_DISCHG_ONVAL	0x01
++#define RT5190A_OVERVOLT_MASK		GENMASK(7, 0)
++#define RT5190A_UNDERVOLT_MASK		GENMASK(15, 8)
++#define RT5190A_CH234OT_MASK		BIT(29)
++#define RT5190A_CHIPOT_MASK		BIT(28)
++
++#define RT5190A_BUCK23_MINUV		600000
++#define RT5190A_BUCK23_MAXUV		1400000
++#define RT5190A_BUCK23_STEPUV		10000
++#define RT5190A_BUCK23_STEPNUM		((1400000 - 600000) / 10000 + 1)
++
++enum {
++	RT5190A_IDX_BUCK1 = 0,
++	RT5190A_IDX_BUCK2,
++	RT5190A_IDX_BUCK3,
++	RT5190A_IDX_BUCK4,
++	RT5190A_IDX_LDO,
++	RT5190A_MAX_IDX
++};
++
++struct rt5190a_priv {
++	struct device *dev;
++	struct regmap *regmap;
++	struct regulator_desc rdesc[RT5190A_MAX_IDX];
++	struct regulator_dev *rdev[RT5190A_MAX_IDX];
++};
++
++static int rt5190a_get_error_flags(struct regulator_dev *rdev,
++				   unsigned int *flags)
++{
++	struct regmap *regmap = rdev_get_regmap(rdev);
++	int rid = rdev_get_id(rdev);
++	unsigned int pgood_stat;
++	int ret;
++
++	ret = regmap_read(regmap, RT5190A_REG_PGSTAT, &pgood_stat);
++	if (ret)
++		return ret;
++
++	if (!(pgood_stat & RT5190A_RID_BITMASK(rid)))
++		*flags = REGULATOR_ERROR_FAIL;
++	else
++		*flags = 0;
++
++	return 0;
++}
++
++static int rt5190a_fixed_buck_set_mode(struct regulator_dev *rdev,
++				       unsigned int mode)
++{
++	struct regmap *regmap = rdev_get_regmap(rdev);
++	int rid = rdev_get_id(rdev);
++	unsigned int mask = RT5190A_RID_BITMASK(rid), val;
++
++	switch (mode) {
++	case REGULATOR_MODE_FAST:
++		val = mask;
++		break;
++	case REGULATOR_MODE_NORMAL:
++		val = 0;
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	return regmap_update_bits(regmap, RT5190A_REG_DCDCCNTL, mask, val);
++}
++
++static unsigned int rt5190a_fixed_buck_get_mode(struct regulator_dev *rdev)
++{
++	struct regmap *regmap = rdev_get_regmap(rdev);
++	int rid = rdev_get_id(rdev);
++	unsigned int val;
++	int ret;
++
++	ret = regmap_read(regmap, RT5190A_REG_DCDCCNTL, &val);
++	if (ret) {
++		dev_err(&rdev->dev, "Failed to get mode [%d]\n", ret);
++		return ret;
++	}
++
++	if (val & RT5190A_RID_BITMASK(rid))
++		return REGULATOR_MODE_FAST;
++
++	return REGULATOR_MODE_NORMAL;
++}
++
++static const struct regulator_ops rt5190a_ranged_buck_ops = {
++	.enable	= regulator_enable_regmap,
++	.disable = regulator_disable_regmap,
++	.is_enabled = regulator_is_enabled_regmap,
++	.set_voltage_sel = regulator_set_voltage_sel_regmap,
++	.get_voltage_sel = regulator_get_voltage_sel_regmap,
++	.list_voltage = regulator_list_voltage_linear,
++	.set_active_discharge = regulator_set_active_discharge_regmap,
++	.get_error_flags = rt5190a_get_error_flags,
++};
++
++static const struct regulator_ops rt5190a_fixed_buck_ops = {
++	.enable	= regulator_enable_regmap,
++	.disable = regulator_disable_regmap,
++	.is_enabled = regulator_is_enabled_regmap,
++	.set_active_discharge = regulator_set_active_discharge_regmap,
++	.set_mode = rt5190a_fixed_buck_set_mode,
++	.get_mode = rt5190a_fixed_buck_get_mode,
++	.get_error_flags = rt5190a_get_error_flags,
++};
++
++static const struct regulator_ops rt5190a_fixed_ldo_ops = {
++	.enable	= regulator_enable_regmap,
++	.disable = regulator_disable_regmap,
++	.is_enabled = regulator_is_enabled_regmap,
++	.set_active_discharge = regulator_set_active_discharge_regmap,
++	.get_error_flags = rt5190a_get_error_flags,
++};
++
++static irqreturn_t rt5190a_irq_handler(int irq, void *data)
++{
++	struct rt5190a_priv *priv = data;
++	__le32 raws;
++	unsigned int events, fields;
++	static const struct {
++		unsigned int bitmask;
++		unsigned int report;
++	} event_tbl[] = {
++		{ RT5190A_OVERVOLT_MASK, REGULATOR_ERROR_REGULATION_OUT },
++		{ RT5190A_UNDERVOLT_MASK, REGULATOR_ERROR_UNDER_VOLTAGE }
++	};
++	int i, j, ret;
++
++	ret = regmap_raw_read(priv->regmap, RT5190A_REG_OVINT, &raws,
++			      sizeof(raws));
++	if (ret) {
++		dev_err(priv->dev, "Failed to read events\n");
++		return IRQ_NONE;
++	}
++
++	events = le32_to_cpu(raws);
++
++	ret = regmap_raw_write(priv->regmap, RT5190A_REG_OVINT, &raws,
++			       sizeof(raws));
++	if (ret)
++		dev_err(priv->dev, "Failed to write-clear events\n");
++
++	/* Handle OV,UV events */
++	for (i = 0; i < ARRAY_SIZE(event_tbl); i++) {
++		fields = events & event_tbl[i].bitmask;
++		fields >>= ffs(event_tbl[i].bitmask) - 1;
++
++		for (j = 0; j < RT5190A_MAX_IDX; j++) {
++			if (!(fields & RT5190A_RID_BITMASK(j)))
++				continue;
++
++			regulator_notifier_call_chain(priv->rdev[j],
++						      event_tbl[i].report,
++						      NULL);
++		}
++	}
++
++	/* Handle CH234 OT event */
++	if (events & RT5190A_CH234OT_MASK) {
++		for (j = RT5190A_IDX_BUCK2; j < RT5190A_IDX_LDO; j++) {
++			regulator_notifier_call_chain(priv->rdev[j],
++						      REGULATOR_ERROR_OVER_TEMP,
++						      NULL);
++		}
++	}
++
++	/* Warning if CHIP OT occur */
++	if (events & RT5190A_CHIPOT_MASK)
++		dev_warn(priv->dev, "CHIP overheat\n");
++
++	return IRQ_HANDLED;
++}
++
++static unsigned int rt5190a_of_map_mode(unsigned int mode)
++{
++	switch (mode) {
++	case RT5190A_OPMODE_AUTO:
++		return REGULATOR_MODE_NORMAL;
++	case RT5190A_OPMODE_FPWM:
++		return REGULATOR_MODE_FAST;
++	default:
++		return REGULATOR_MODE_INVALID;
++	}
++}
++
++static int rt5190a_of_parse_cb(struct rt5190a_priv *priv, int rid,
++			       struct of_regulator_match *match)
++{
++	struct regulator_desc *desc = priv->rdesc + rid;
++	struct regulator_init_data *init_data = match->init_data;
++	struct device_node *np = match->of_node;
++	bool latchup_enable;
++	unsigned int mask = RT5190A_RID_BITMASK(rid), val;
++
++	switch (rid) {
++	case RT5190A_IDX_BUCK1:
++	case RT5190A_IDX_BUCK4:
++	case RT5190A_IDX_LDO:
++		init_data->constraints.apply_uV = 0;
++
++		if (init_data->constraints.min_uV ==
++				init_data->constraints.max_uV)
++			desc->fixed_uV = init_data->constraints.min_uV;
++		else {
++			dev_err(priv->dev,
++				"Variable voltage for fixed regulator\n");
++			return -EINVAL;
++		}
++		break;
++	default:
++		break;
++	}
++
++	latchup_enable = of_property_read_bool(np, "richtek,latchup-enable");
++
++	/* latchup: 0, default hiccup: 1 */
++	val = !latchup_enable ? mask : 0;
++
++	return regmap_update_bits(priv->regmap, RT5190A_REG_PROTMODE, mask, val);
++}
++
++static void rt5190a_fillin_regulator_desc(struct regulator_desc *desc, int rid)
++{
++	static const char * const regu_name[] = { "buck1", "buck2",
++						  "buck3", "buck4",
++						  "ldo" };
++	static const char * const supply[] = { NULL, "vin2", "vin3", "vin4",
++					       "vinldo" };
++
++	desc->name = regu_name[rid];
++	desc->supply_name = supply[rid];
++	desc->owner = THIS_MODULE;
++	desc->type = REGULATOR_VOLTAGE;
++	desc->id = rid;
++	desc->enable_reg = RT5190A_REG_ENABLE;
++	desc->enable_mask = RT5190A_RID_BITMASK(rid);
++	desc->active_discharge_reg = RT5190A_REG_DISCHARGE;
++	desc->active_discharge_mask = RT5190A_RID_BITMASK(rid);
++	desc->active_discharge_on = RT5190A_RID_BITMASK(rid);
++
++	switch (rid) {
++	case RT5190A_IDX_BUCK1:
++		desc->active_discharge_mask = RT5190A_BUCK1_DISCHG_MASK;
++		desc->active_discharge_on = RT5190A_BUCK1_DISCHG_ONVAL;
++		desc->n_voltages = 1;
++		desc->ops = &rt5190a_fixed_buck_ops;
++		desc->of_map_mode = rt5190a_of_map_mode;
++		break;
++	case RT5190A_IDX_BUCK2:
++		desc->vsel_reg = RT5190A_REG_BUCK2VSEL;
++		desc->vsel_mask = RT5190A_VSEL_MASK;
++		desc->min_uV = RT5190A_BUCK23_MINUV;
++		desc->uV_step = RT5190A_BUCK23_STEPUV;
++		desc->n_voltages = RT5190A_BUCK23_STEPNUM;
++		desc->ops = &rt5190a_ranged_buck_ops;
++		break;
++	case RT5190A_IDX_BUCK3:
++		desc->vsel_reg = RT5190A_REG_BUCK3VSEL;
++		desc->vsel_mask = RT5190A_VSEL_MASK;
++		desc->min_uV = RT5190A_BUCK23_MINUV;
++		desc->uV_step = RT5190A_BUCK23_STEPUV;
++		desc->n_voltages = RT5190A_BUCK23_STEPNUM;
++		desc->ops = &rt5190a_ranged_buck_ops;
++		break;
++	case RT5190A_IDX_BUCK4:
++		desc->n_voltages = 1;
++		desc->ops = &rt5190a_fixed_buck_ops;
++		desc->of_map_mode = rt5190a_of_map_mode;
++		break;
++	case RT5190A_IDX_LDO:
++		desc->n_voltages = 1;
++		desc->ops = &rt5190a_fixed_ldo_ops;
++		break;
++	}
++}
++
++static struct of_regulator_match rt5190a_regulator_match[] = {
++	{ .name = "buck1", },
++	{ .name = "buck2", },
++	{ .name = "buck3", },
++	{ .name = "buck4", },
++	{ .name = "ldo", }
++};
++
++static int rt5190a_parse_regulator_dt_data(struct rt5190a_priv *priv)
++{
++	struct device_node *regulator_np;
++	struct regulator_desc *reg_desc;
++	struct of_regulator_match *match;
++	int i, ret;
++
++	for (i = 0; i < RT5190A_MAX_IDX; i++) {
++		reg_desc = priv->rdesc + i;
++		match = rt5190a_regulator_match + i;
++
++		rt5190a_fillin_regulator_desc(reg_desc, i);
++
++		match->desc = reg_desc;
++	}
++
++	regulator_np = of_get_child_by_name(priv->dev->of_node, "regulators");
++	if (!regulator_np) {
++		dev_err(priv->dev, "Could not find 'regulators' node\n");
++		return -ENODEV;
++	}
++
++	ret = of_regulator_match(priv->dev, regulator_np,
++				 rt5190a_regulator_match,
++				 ARRAY_SIZE(rt5190a_regulator_match));
++
++	of_node_put(regulator_np);
++
++	if (ret < 0) {
++		dev_err(priv->dev,
++			"Error parsing regulator init data: %d\n", ret);
++		return ret;
++	}
++
++	for (i = 0; i < RT5190A_MAX_IDX; i++) {
++		match = rt5190a_regulator_match + i;
++
++		ret = rt5190a_of_parse_cb(priv, i, match);
++		if (ret) {
++			dev_err(priv->dev, "Failed in [%d] of_parse_cb\n", i);
++			return ret;
++		}
++	}
++
++	return 0;
++}
++
++static const struct reg_sequence rt5190a_init_patch[] = {
++	{ 0x09, 0x3d, },
++	{ 0x0a, 0x3e, },
++	{ 0x0b, 0x01, },
++	{ 0x10, 0xff, },
++	{ 0x11, 0xff, },
++	{ 0x12, 0xff, },
++	{ 0x13, 0xff, },
++	{ 0x14, 0, },
++	{ 0x15, 0, },
++	{ 0x16, 0x3e, },
++	{ 0x17, 0, }
++};
++
++static int rt5190a_device_initialize(struct rt5190a_priv *priv)
++{
++	bool mute_enable;
++	int ret;
++
++	ret = regmap_register_patch(priv->regmap, rt5190a_init_patch,
++				    ARRAY_SIZE(rt5190a_init_patch));
++	if (ret) {
++		dev_err(priv->dev, "Failed to do register patch\n");
++		return ret;
++	}
++
++	mute_enable = device_property_read_bool(priv->dev,
++						"richtek,mute-enable");
++
++	if (mute_enable) {
++		ret = regmap_write(priv->regmap, RT5190A_REG_MUTECNTL, 0x00);
++		if (ret) {
++			dev_err(priv->dev, "Failed to enable mute function\n");
++			return ret;
++		}
++	}
++
++	return 0;
++}
++
++static int rt5190a_device_check(struct rt5190a_priv *priv)
++{
++	u16 devid;
++	int ret;
++
++	ret = regmap_raw_read(priv->regmap, RT5190A_REG_MANUFACTURE, &devid,
++			      sizeof(devid));
++	if (ret)
++		return ret;
++
++	if (devid) {
++		dev_err(priv->dev, "Incorrect device id 0x%04x\n", devid);
++		return -ENODEV;
++	}
++
++	return 0;
++}
++
++static const struct regmap_config rt5190a_regmap_config = {
++	.reg_bits = 8,
++	.val_bits = 8,
++	.max_register = RT5190A_REG_HOTDIEMASK,
++};
++
++static int rt5190a_probe(struct i2c_client *i2c)
++{
++	struct rt5190a_priv *priv;
++	struct regulator_config cfg = {};
++	int i, ret;
++
++	priv = devm_kzalloc(&i2c->dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	priv->dev = &i2c->dev;
++
++	priv->regmap = devm_regmap_init_i2c(i2c, &rt5190a_regmap_config);
++	if (IS_ERR(priv->regmap)) {
++		dev_err(&i2c->dev, "Failed to allocate regmap\n");
++		return PTR_ERR(priv->regmap);
++	}
++
++	ret = rt5190a_device_check(priv);
++	if (ret) {
++		dev_err(&i2c->dev, "Failed to check device %d\n", ret);
++		return ret;
++	}
++
++	ret = rt5190a_device_initialize(priv);
++	if (ret) {
++		dev_err(&i2c->dev, "Failed to initialize the device\n");
++		return ret;
++	}
++
++	ret = rt5190a_parse_regulator_dt_data(priv);
++	if (ret) {
++		dev_err(&i2c->dev, "Failed to parse regulator dt\n");
++		return ret;
++	}
++
++	cfg.dev = &i2c->dev;
++	cfg.regmap = priv->regmap;
++
++	for (i = 0; i < RT5190A_MAX_IDX; i++) {
++		struct regulator_desc *desc = priv->rdesc + i;
++		struct of_regulator_match *match = rt5190a_regulator_match + i;
++
++		cfg.init_data = match->init_data;
++		cfg.of_node = match->of_node;
++
++		priv->rdev[i] = devm_regulator_register(&i2c->dev, desc, &cfg);
++		if (IS_ERR(priv->rdev[i])) {
++			dev_err(&i2c->dev, "Failed to register regulator %s\n",
++				desc->name);
++			return PTR_ERR(priv->rdev[i]);
++		}
++	}
++
++	if (i2c->irq) {
++		ret = devm_request_threaded_irq(&i2c->dev, i2c->irq, NULL,
++						rt5190a_irq_handler,
++						IRQF_ONESHOT,
++						dev_name(&i2c->dev), priv);
++		if (ret) {
++			dev_err(&i2c->dev, "Failed to register interrupt\n");
++			return ret;
++		}
++	}
++
++	return 0;
++}
++
++static const struct of_device_id __maybe_unused rt5190a_device_table[] = {
++	{ .compatible = "richtek,rt5190a", },
++	{}
++};
++MODULE_DEVICE_TABLE(of, rt5190a_device_table);
++
++static struct i2c_driver rt5190a_driver = {
++	.driver = {
++		.name = "rt5190a",
++		.of_match_table = rt5190a_device_table,
++	},
++	.probe_new = rt5190a_probe,
++};
++module_i2c_driver(rt5190a_driver);
++
++MODULE_AUTHOR("ChiYuan Huang <cy_huang@richtek.com>");
++MODULE_DESCRIPTION("Richtek RT5190A Regulator Driver");
++MODULE_LICENSE("GPL v2");
diff --git a/target/linux/mediatek/patches-5.15/840-v5.16-i2c-mediatek-Reset-the-handshake-signal-between-i2c-.patch b/target/linux/mediatek/patches-5.15/840-v5.16-i2c-mediatek-Reset-the-handshake-signal-between-i2c-.patch
new file mode 100644
index 00000000000000..8b0119640984c9
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/840-v5.16-i2c-mediatek-Reset-the-handshake-signal-between-i2c-.patch
@@ -0,0 +1,74 @@
+From 95e4dfbf33dc0a0843ba20db811f7ea271235e1e Mon Sep 17 00:00:00 2001
+From: Kewei Xu <kewei.xu@mediatek.com>
+Date: Sun, 10 Oct 2021 15:05:12 +0800
+Subject: [PATCH 01/16] i2c: mediatek: Reset the handshake signal between i2c
+ and dma
+
+Due to changes in the hardware design of the handshaking signal
+between i2c and dma, it is necessary to reset the handshaking
+signal before each transfer to ensure that the multi-msgs can
+be transferred correctly.
+
+Signed-off-by: Kewei Xu <kewei.xu@mediatek.com>
+Reviewed-by: Qii Wang <qii.wang@mediatek.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -15,6 +15,7 @@
+ #include <linux/init.h>
+ #include <linux/interrupt.h>
+ #include <linux/io.h>
++#include <linux/iopoll.h>
+ #include <linux/kernel.h>
+ #include <linux/mm.h>
+ #include <linux/module.h>
+@@ -49,6 +50,8 @@
+ #define I2C_RD_TRANAC_VALUE		0x0001
+ #define I2C_SCL_MIS_COMP_VALUE		0x0000
+ #define I2C_CHN_CLR_FLAG		0x0000
++#define I2C_RELIABILITY		0x0010
++#define I2C_DMAACK_ENABLE		0x0008
+ 
+ #define I2C_DMA_CON_TX			0x0000
+ #define I2C_DMA_CON_RX			0x0001
+@@ -851,6 +854,7 @@ static int mtk_i2c_do_transfer(struct mt
+ 	u16 restart_flag = 0;
+ 	u16 dma_sync = 0;
+ 	u32 reg_4g_mode;
++	u32 reg_dma_reset;
+ 	u8 *dma_rd_buf = NULL;
+ 	u8 *dma_wr_buf = NULL;
+ 	dma_addr_t rpaddr = 0;
+@@ -864,6 +868,28 @@ static int mtk_i2c_do_transfer(struct mt
+ 
+ 	reinit_completion(&i2c->msg_complete);
+ 
++	if (i2c->dev_comp->apdma_sync &&
++	    i2c->op != I2C_MASTER_WRRD && num > 1) {
++		mtk_i2c_writew(i2c, 0x00, OFFSET_DEBUGCTRL);
++		writel(I2C_DMA_HANDSHAKE_RST | I2C_DMA_WARM_RST,
++		       i2c->pdmabase + OFFSET_RST);
++
++		ret = readw_poll_timeout(i2c->pdmabase + OFFSET_RST,
++					 reg_dma_reset,
++					 !(reg_dma_reset & I2C_DMA_WARM_RST),
++					 0, 100);
++		if (ret) {
++			dev_err(i2c->dev, "DMA warm reset timeout\n");
++			return -ETIMEDOUT;
++		}
++
++		writel(I2C_DMA_CLR_FLAG, i2c->pdmabase + OFFSET_RST);
++		mtk_i2c_writew(i2c, I2C_HANDSHAKE_RST, OFFSET_SOFTRESET);
++		mtk_i2c_writew(i2c, I2C_CHN_CLR_FLAG, OFFSET_SOFTRESET);
++		mtk_i2c_writew(i2c, I2C_RELIABILITY | I2C_DMAACK_ENABLE,
++			       OFFSET_DEBUGCTRL);
++	}
++
+ 	control_reg = mtk_i2c_readw(i2c, OFFSET_CONTROL) &
+ 			~(I2C_CONTROL_DIR_CHANGE | I2C_CONTROL_RS);
+ 	if ((i2c->speed_hz > I2C_MAX_FAST_MODE_PLUS_FREQ) || (left_num >= 1))
diff --git a/target/linux/mediatek/patches-5.15/841-v5.16-i2c-mediatek-Dump-i2c-dma-register-when-a-timeout-oc.patch b/target/linux/mediatek/patches-5.15/841-v5.16-i2c-mediatek-Dump-i2c-dma-register-when-a-timeout-oc.patch
new file mode 100644
index 00000000000000..a2d2521c772f87
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/841-v5.16-i2c-mediatek-Dump-i2c-dma-register-when-a-timeout-oc.patch
@@ -0,0 +1,102 @@
+From 5b8e29e566e086ef9b5b9ea0d054370a295e1d05 Mon Sep 17 00:00:00 2001
+From: Kewei Xu <kewei.xu@mediatek.com>
+Date: Sun, 10 Oct 2021 15:05:13 +0800
+Subject: [PATCH 02/16] i2c: mediatek: Dump i2c/dma register when a timeout
+ occurs
+
+When a timeout error occurs in i2c transter, it is usually related
+to the i2c/dma IP hardware configuration. Therefore, the purpose of
+this patch is to dump the key register values of i2c/dma when a
+timeout occurs in i2c for debugging.
+
+Signed-off-by: Kewei Xu <kewei.xu@mediatek.com>
+Reviewed-by: Qii Wang <qii.wang@mediatek.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 54 +++++++++++++++++++++++++++++++++
+ 1 file changed, 54 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -130,6 +130,7 @@ enum I2C_REGS_OFFSET {
+ 	OFFSET_HS,
+ 	OFFSET_SOFTRESET,
+ 	OFFSET_DCM_EN,
++	OFFSET_MULTI_DMA,
+ 	OFFSET_PATH_DIR,
+ 	OFFSET_DEBUGSTAT,
+ 	OFFSET_DEBUGCTRL,
+@@ -197,6 +198,7 @@ static const u16 mt_i2c_regs_v2[] = {
+ 	[OFFSET_TRANSFER_LEN_AUX] = 0x44,
+ 	[OFFSET_CLOCK_DIV] = 0x48,
+ 	[OFFSET_SOFTRESET] = 0x50,
++	[OFFSET_MULTI_DMA] = 0x8c,
+ 	[OFFSET_SCL_MIS_COMP_POINT] = 0x90,
+ 	[OFFSET_DEBUGSTAT] = 0xe4,
+ 	[OFFSET_DEBUGCTRL] = 0xe8,
+@@ -845,6 +847,57 @@ static int mtk_i2c_set_speed(struct mtk_
+ 	return 0;
+ }
+ 
++static void i2c_dump_register(struct mtk_i2c *i2c)
++{
++	dev_dbg(i2c->dev, "SLAVE_ADDR: 0x%x, INTR_MASK: 0x%x\n",
++		mtk_i2c_readw(i2c, OFFSET_SLAVE_ADDR),
++		mtk_i2c_readw(i2c, OFFSET_INTR_MASK));
++	dev_dbg(i2c->dev, "INTR_STAT: 0x%x, CONTROL: 0x%x\n",
++		mtk_i2c_readw(i2c, OFFSET_INTR_STAT),
++		mtk_i2c_readw(i2c, OFFSET_CONTROL));
++	dev_dbg(i2c->dev, "TRANSFER_LEN: 0x%x, TRANSAC_LEN: 0x%x\n",
++		mtk_i2c_readw(i2c, OFFSET_TRANSFER_LEN),
++		mtk_i2c_readw(i2c, OFFSET_TRANSAC_LEN));
++	dev_dbg(i2c->dev, "DELAY_LEN: 0x%x, HTIMING: 0x%x\n",
++		mtk_i2c_readw(i2c, OFFSET_DELAY_LEN),
++		mtk_i2c_readw(i2c, OFFSET_TIMING));
++	dev_dbg(i2c->dev, "START: 0x%x, EXT_CONF: 0x%x\n",
++		mtk_i2c_readw(i2c, OFFSET_START),
++		mtk_i2c_readw(i2c, OFFSET_EXT_CONF));
++	dev_dbg(i2c->dev, "HS: 0x%x, IO_CONFIG: 0x%x\n",
++		mtk_i2c_readw(i2c, OFFSET_HS),
++		mtk_i2c_readw(i2c, OFFSET_IO_CONFIG));
++	dev_dbg(i2c->dev, "DCM_EN: 0x%x, TRANSFER_LEN_AUX: 0x%x\n",
++		mtk_i2c_readw(i2c, OFFSET_DCM_EN),
++		mtk_i2c_readw(i2c, OFFSET_TRANSFER_LEN_AUX));
++	dev_dbg(i2c->dev, "CLOCK_DIV: 0x%x, FIFO_STAT: 0x%x\n",
++		mtk_i2c_readw(i2c, OFFSET_CLOCK_DIV),
++		mtk_i2c_readw(i2c, OFFSET_FIFO_STAT));
++	dev_dbg(i2c->dev, "DEBUGCTRL : 0x%x, DEBUGSTAT: 0x%x\n",
++		mtk_i2c_readw(i2c, OFFSET_DEBUGCTRL),
++		mtk_i2c_readw(i2c, OFFSET_DEBUGSTAT));
++	if (i2c->dev_comp->regs == mt_i2c_regs_v2) {
++		dev_dbg(i2c->dev, "LTIMING: 0x%x, MULTI_DMA: 0x%x\n",
++			mtk_i2c_readw(i2c, OFFSET_LTIMING),
++			mtk_i2c_readw(i2c, OFFSET_MULTI_DMA));
++	}
++	dev_dbg(i2c->dev, "\nDMA_INT_FLAG: 0x%x, DMA_INT_EN: 0x%x\n",
++		readl(i2c->pdmabase + OFFSET_INT_FLAG),
++		readl(i2c->pdmabase + OFFSET_INT_EN));
++	dev_dbg(i2c->dev, "DMA_EN: 0x%x, DMA_CON: 0x%x\n",
++		readl(i2c->pdmabase + OFFSET_EN),
++		readl(i2c->pdmabase + OFFSET_CON));
++	dev_dbg(i2c->dev, "DMA_TX_MEM_ADDR: 0x%x, DMA_RX_MEM_ADDR: 0x%x\n",
++		readl(i2c->pdmabase + OFFSET_TX_MEM_ADDR),
++		readl(i2c->pdmabase + OFFSET_RX_MEM_ADDR));
++	dev_dbg(i2c->dev, "DMA_TX_LEN: 0x%x, DMA_RX_LEN: 0x%x\n",
++		readl(i2c->pdmabase + OFFSET_TX_LEN),
++		readl(i2c->pdmabase + OFFSET_RX_LEN));
++	dev_dbg(i2c->dev, "DMA_TX_4G_MODE: 0x%x, DMA_RX_4G_MODE: 0x%x",
++		readl(i2c->pdmabase + OFFSET_TX_4G_MODE),
++		readl(i2c->pdmabase + OFFSET_RX_4G_MODE));
++}
++
+ static int mtk_i2c_do_transfer(struct mtk_i2c *i2c, struct i2c_msg *msgs,
+ 			       int num, int left_num)
+ {
+@@ -1075,6 +1128,7 @@ static int mtk_i2c_do_transfer(struct mt
+ 
+ 	if (ret == 0) {
+ 		dev_dbg(i2c->dev, "addr: %x, transfer timeout\n", msgs->addr);
++		i2c_dump_register(i2c);
+ 		mtk_i2c_init_hw(i2c);
+ 		return -ETIMEDOUT;
+ 	}
diff --git a/target/linux/mediatek/patches-5.15/842-v5.18-i2c-mediatek-Add-i2c-compatible-for-Mediatek-MT8186.patch b/target/linux/mediatek/patches-5.15/842-v5.18-i2c-mediatek-Add-i2c-compatible-for-Mediatek-MT8186.patch
new file mode 100644
index 00000000000000..184fe94ff80bde
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/842-v5.18-i2c-mediatek-Add-i2c-compatible-for-Mediatek-MT8186.patch
@@ -0,0 +1,45 @@
+From 83630e3c6147bf7bb18a18f3d5a99462464f450b Mon Sep 17 00:00:00 2001
+From: Kewei Xu <kewei.xu@mediatek.com>
+Date: Tue, 25 Jan 2022 19:04:13 +0800
+Subject: [PATCH 03/16] i2c: mediatek: Add i2c compatible for Mediatek MT8186
+
+Add i2c compatible for MT8186. Compare to MT8192 i2c controller,
+MT8186 doesn't need handshake signal witch apdma.
+
+Signed-off-by: Kewei Xu <kewei.xu@mediatek.com>
+Reviewed-by: Qii Wang <qii.wang@mediatek.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -397,6 +397,19 @@ static const struct mtk_i2c_compatible m
+ 	.max_dma_support = 33,
+ };
+ 
++static const struct mtk_i2c_compatible mt8186_compat = {
++	.regs = mt_i2c_regs_v2,
++	.pmic_i2c = 0,
++	.dcm = 0,
++	.auto_restart = 1,
++	.aux_len_reg = 1,
++	.timing_adjust = 1,
++	.dma_sync = 0,
++	.ltiming_adjust = 1,
++	.apdma_sync = 0,
++	.max_dma_support = 36,
++};
++
+ static const struct mtk_i2c_compatible mt8192_compat = {
+ 	.quirks = &mt8183_i2c_quirks,
+ 	.regs = mt_i2c_regs_v2,
+@@ -418,6 +431,7 @@ static const struct of_device_id mtk_i2c
+ 	{ .compatible = "mediatek,mt7622-i2c", .data = &mt7622_compat },
+ 	{ .compatible = "mediatek,mt8173-i2c", .data = &mt8173_compat },
+ 	{ .compatible = "mediatek,mt8183-i2c", .data = &mt8183_compat },
++	{ .compatible = "mediatek,mt8186-i2c", .data = &mt8186_compat },
+ 	{ .compatible = "mediatek,mt8192-i2c", .data = &mt8192_compat },
+ 	{}
+ };
diff --git a/target/linux/mediatek/patches-5.15/843-v5.18-i2c-mediatek-modify-bus-speed-calculation-formula.patch b/target/linux/mediatek/patches-5.15/843-v5.18-i2c-mediatek-modify-bus-speed-calculation-formula.patch
new file mode 100644
index 00000000000000..0ace4a6701c5d5
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/843-v5.18-i2c-mediatek-modify-bus-speed-calculation-formula.patch
@@ -0,0 +1,132 @@
+From f606aab3f1a49d723d66e14e545f6ca45005bda6 Mon Sep 17 00:00:00 2001
+From: Kewei Xu <kewei.xu@mediatek.com>
+Date: Thu, 17 Feb 2022 20:22:43 +0800
+Subject: [PATCH 04/16] i2c: mediatek: modify bus speed calculation formula
+
+When clock-div is 0 or greater than 1, the bus speed
+calculated by the old speed calculation formula will be
+larger than the target speed. So we update the formula.
+
+Signed-off-by: Kewei Xu <kewei.xu@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Qii Wang <qii.wang@mediatek.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 51 ++++++++++++++++++++++++++-------
+ 1 file changed, 41 insertions(+), 10 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -67,11 +67,12 @@
+ 
+ #define MAX_SAMPLE_CNT_DIV		8
+ #define MAX_STEP_CNT_DIV		64
+-#define MAX_CLOCK_DIV			256
++#define MAX_CLOCK_DIV_8BITS		256
++#define MAX_CLOCK_DIV_5BITS		32
+ #define MAX_HS_STEP_CNT_DIV		8
+-#define I2C_STANDARD_MODE_BUFFER	(1000 / 2)
+-#define I2C_FAST_MODE_BUFFER		(300 / 2)
+-#define I2C_FAST_MODE_PLUS_BUFFER	(20 / 2)
++#define I2C_STANDARD_MODE_BUFFER	(1000 / 3)
++#define I2C_FAST_MODE_BUFFER		(300 / 3)
++#define I2C_FAST_MODE_PLUS_BUFFER	(20 / 3)
+ 
+ #define I2C_CONTROL_RS                  (0x1 << 1)
+ #define I2C_CONTROL_DMA_EN              (0x1 << 2)
+@@ -604,6 +605,31 @@ static int mtk_i2c_max_step_cnt(unsigned
+ 		return MAX_STEP_CNT_DIV;
+ }
+ 
++static int mtk_i2c_get_clk_div_restri(struct mtk_i2c *i2c,
++				      unsigned int sample_cnt)
++{
++	int clk_div_restri = 0;
++
++	if (i2c->dev_comp->ltiming_adjust == 0)
++		return 0;
++
++	if (sample_cnt == 1) {
++		if (i2c->ac_timing.inter_clk_div == 0)
++			clk_div_restri = 0;
++		else
++			clk_div_restri = 1;
++	} else {
++		if (i2c->ac_timing.inter_clk_div == 0)
++			clk_div_restri = -1;
++		else if (i2c->ac_timing.inter_clk_div == 1)
++			clk_div_restri = 0;
++		else
++			clk_div_restri = 1;
++	}
++
++	return clk_div_restri;
++}
++
+ /*
+  * Check and Calculate i2c ac-timing
+  *
+@@ -732,6 +758,7 @@ static int mtk_i2c_calculate_speed(struc
+ 	unsigned int best_mul;
+ 	unsigned int cnt_mul;
+ 	int ret = -EINVAL;
++	int clk_div_restri = 0;
+ 
+ 	if (target_speed > I2C_MAX_HIGH_SPEED_MODE_FREQ)
+ 		target_speed = I2C_MAX_HIGH_SPEED_MODE_FREQ;
+@@ -749,7 +776,8 @@ static int mtk_i2c_calculate_speed(struc
+ 	 * optimizing for sample_cnt * step_cnt being minimal
+ 	 */
+ 	for (sample_cnt = 1; sample_cnt <= MAX_SAMPLE_CNT_DIV; sample_cnt++) {
+-		step_cnt = DIV_ROUND_UP(opt_div, sample_cnt);
++		clk_div_restri = mtk_i2c_get_clk_div_restri(i2c, sample_cnt);
++		step_cnt = DIV_ROUND_UP(opt_div + clk_div_restri, sample_cnt);
+ 		cnt_mul = step_cnt * sample_cnt;
+ 		if (step_cnt > max_step_cnt)
+ 			continue;
+@@ -763,7 +791,7 @@ static int mtk_i2c_calculate_speed(struc
+ 			best_mul = cnt_mul;
+ 			base_sample_cnt = sample_cnt;
+ 			base_step_cnt = step_cnt;
+-			if (best_mul == opt_div)
++			if (best_mul == (opt_div + clk_div_restri))
+ 				break;
+ 		}
+ 	}
+@@ -774,7 +802,8 @@ static int mtk_i2c_calculate_speed(struc
+ 	sample_cnt = base_sample_cnt;
+ 	step_cnt = base_step_cnt;
+ 
+-	if ((clk_src / (2 * sample_cnt * step_cnt)) > target_speed) {
++	if ((clk_src / (2 * (sample_cnt * step_cnt - clk_div_restri))) >
++		target_speed) {
+ 		/* In this case, hardware can't support such
+ 		 * low i2c_bus_freq
+ 		 */
+@@ -803,13 +832,16 @@ static int mtk_i2c_set_speed(struct mtk_
+ 	target_speed = i2c->speed_hz;
+ 	parent_clk /= i2c->clk_src_div;
+ 
+-	if (i2c->dev_comp->timing_adjust)
+-		max_clk_div = MAX_CLOCK_DIV;
++	if (i2c->dev_comp->timing_adjust && i2c->dev_comp->ltiming_adjust)
++		max_clk_div = MAX_CLOCK_DIV_5BITS;
++	else if (i2c->dev_comp->timing_adjust)
++		max_clk_div = MAX_CLOCK_DIV_8BITS;
+ 	else
+ 		max_clk_div = 1;
+ 
+ 	for (clk_div = 1; clk_div <= max_clk_div; clk_div++) {
+ 		clk_src = parent_clk / clk_div;
++		i2c->ac_timing.inter_clk_div = clk_div - 1;
+ 
+ 		if (target_speed > I2C_MAX_FAST_MODE_PLUS_FREQ) {
+ 			/* Set master code speed register */
+@@ -856,7 +888,6 @@ static int mtk_i2c_set_speed(struct mtk_
+ 		break;
+ 	}
+ 
+-	i2c->ac_timing.inter_clk_div = clk_div - 1;
+ 
+ 	return 0;
+ }
diff --git a/target/linux/mediatek/patches-5.15/844-v5.18-i2c-mediatek-remove-redundant-null-check.patch b/target/linux/mediatek/patches-5.15/844-v5.18-i2c-mediatek-remove-redundant-null-check.patch
new file mode 100644
index 00000000000000..8f3c965a8d4e32
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/844-v5.18-i2c-mediatek-remove-redundant-null-check.patch
@@ -0,0 +1,41 @@
+From eb4a2ae019815946f574cd9f8209e12bdcd8fd34 Mon Sep 17 00:00:00 2001
+From: Xu Wang <vulab@iscas.ac.cn>
+Date: Wed, 30 Sep 2020 08:42:33 +0000
+Subject: [PATCH 05/16] i2c: mediatek: remove redundant null check
+
+Because clk_disable_unprepare already checked NULL clock parameter,
+so the additional checks are unnecessary, just remove it
+
+Signed-off-by: Xu Wang <vulab@iscas.ac.cn>
+Reviewed-by: Qii Wang <qii.wang@mediatek.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -476,8 +476,7 @@ static int mtk_i2c_clock_enable(struct m
+ 	return 0;
+ 
+ err_arb:
+-	if (i2c->have_pmic)
+-		clk_disable_unprepare(i2c->clk_pmic);
++	clk_disable_unprepare(i2c->clk_pmic);
+ err_pmic:
+ 	clk_disable_unprepare(i2c->clk_main);
+ err_main:
+@@ -488,11 +487,9 @@ err_main:
+ 
+ static void mtk_i2c_clock_disable(struct mtk_i2c *i2c)
+ {
+-	if (i2c->clk_arb)
+-		clk_disable_unprepare(i2c->clk_arb);
++	clk_disable_unprepare(i2c->clk_arb);
+ 
+-	if (i2c->have_pmic)
+-		clk_disable_unprepare(i2c->clk_pmic);
++	clk_disable_unprepare(i2c->clk_pmic);
+ 
+ 	clk_disable_unprepare(i2c->clk_main);
+ 	clk_disable_unprepare(i2c->clk_dma);
diff --git a/target/linux/mediatek/patches-5.15/845-v5.18-i2c-mt65xx-Simplify-with-clk-bulk.patch b/target/linux/mediatek/patches-5.15/845-v5.18-i2c-mt65xx-Simplify-with-clk-bulk.patch
new file mode 100644
index 00000000000000..71d083f31a9565
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/845-v5.18-i2c-mt65xx-Simplify-with-clk-bulk.patch
@@ -0,0 +1,234 @@
+From cc6faa5e0772296d815fd298c231277d47308a6a Mon Sep 17 00:00:00 2001
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Date: Thu, 3 Mar 2022 10:15:47 +0100
+Subject: [PATCH 06/16] i2c: mt65xx: Simplify with clk-bulk
+
+Since depending on the SoC or specific bus functionality some clocks
+may be optional, we cannot get the benefit of using devm_clk_bulk_get()
+but, by migrating to clk-bulk, we are able to remove the custom functions
+mtk_i2c_clock_enable() and mtk_i2c_clock_disable(), increasing common
+APIs usage, hence (lightly) decreasing kernel footprint.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Qii Wang <qii.wang@mediatek.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 124 +++++++++++++-------------------
+ 1 file changed, 51 insertions(+), 73 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -86,6 +86,27 @@
+ 
+ #define I2C_DRV_NAME		"i2c-mt65xx"
+ 
++/**
++ * enum i2c_mt65xx_clks - Clocks enumeration for MT65XX I2C
++ *
++ * @I2C_MT65XX_CLK_MAIN: main clock for i2c bus
++ * @I2C_MT65XX_CLK_DMA:  DMA clock for i2c via DMA
++ * @I2C_MT65XX_CLK_PMIC: PMIC clock for i2c from PMIC
++ * @I2C_MT65XX_CLK_ARB:  Arbitrator clock for i2c
++ * @I2C_MT65XX_CLK_MAX:  Number of supported clocks
++ */
++enum i2c_mt65xx_clks {
++	I2C_MT65XX_CLK_MAIN = 0,
++	I2C_MT65XX_CLK_DMA,
++	I2C_MT65XX_CLK_PMIC,
++	I2C_MT65XX_CLK_ARB,
++	I2C_MT65XX_CLK_MAX
++};
++
++static const char * const i2c_mt65xx_clk_ids[I2C_MT65XX_CLK_MAX] = {
++	"main", "dma", "pmic", "arb"
++};
++
+ enum DMA_REGS_OFFSET {
+ 	OFFSET_INT_FLAG = 0x0,
+ 	OFFSET_INT_EN = 0x04,
+@@ -244,10 +265,7 @@ struct mtk_i2c {
+ 	/* set in i2c probe */
+ 	void __iomem *base;		/* i2c base addr */
+ 	void __iomem *pdmabase;		/* dma base address*/
+-	struct clk *clk_main;		/* main clock for i2c bus */
+-	struct clk *clk_dma;		/* DMA clock for i2c via DMA */
+-	struct clk *clk_pmic;		/* PMIC clock for i2c from PMIC */
+-	struct clk *clk_arb;		/* Arbitrator clock for i2c */
++	struct clk_bulk_data clocks[I2C_MT65XX_CLK_MAX]; /* clocks for i2c */
+ 	bool have_pmic;			/* can use i2c pins from PMIC */
+ 	bool use_push_pull;		/* IO config push-pull mode */
+ 
+@@ -449,52 +467,6 @@ static void mtk_i2c_writew(struct mtk_i2
+ 	writew(val, i2c->base + i2c->dev_comp->regs[reg]);
+ }
+ 
+-static int mtk_i2c_clock_enable(struct mtk_i2c *i2c)
+-{
+-	int ret;
+-
+-	ret = clk_prepare_enable(i2c->clk_dma);
+-	if (ret)
+-		return ret;
+-
+-	ret = clk_prepare_enable(i2c->clk_main);
+-	if (ret)
+-		goto err_main;
+-
+-	if (i2c->have_pmic) {
+-		ret = clk_prepare_enable(i2c->clk_pmic);
+-		if (ret)
+-			goto err_pmic;
+-	}
+-
+-	if (i2c->clk_arb) {
+-		ret = clk_prepare_enable(i2c->clk_arb);
+-		if (ret)
+-			goto err_arb;
+-	}
+-
+-	return 0;
+-
+-err_arb:
+-	clk_disable_unprepare(i2c->clk_pmic);
+-err_pmic:
+-	clk_disable_unprepare(i2c->clk_main);
+-err_main:
+-	clk_disable_unprepare(i2c->clk_dma);
+-
+-	return ret;
+-}
+-
+-static void mtk_i2c_clock_disable(struct mtk_i2c *i2c)
+-{
+-	clk_disable_unprepare(i2c->clk_arb);
+-
+-	clk_disable_unprepare(i2c->clk_pmic);
+-
+-	clk_disable_unprepare(i2c->clk_main);
+-	clk_disable_unprepare(i2c->clk_dma);
+-}
+-
+ static void mtk_i2c_init_hw(struct mtk_i2c *i2c)
+ {
+ 	u16 control_reg;
+@@ -1191,7 +1163,7 @@ static int mtk_i2c_transfer(struct i2c_a
+ 	int left_num = num;
+ 	struct mtk_i2c *i2c = i2c_get_adapdata(adap);
+ 
+-	ret = mtk_i2c_clock_enable(i2c);
++	ret = clk_bulk_prepare_enable(I2C_MT65XX_CLK_MAX, i2c->clocks);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -1245,7 +1217,7 @@ static int mtk_i2c_transfer(struct i2c_a
+ 	ret = num;
+ 
+ err_exit:
+-	mtk_i2c_clock_disable(i2c);
++	clk_bulk_disable_unprepare(I2C_MT65XX_CLK_MAX, i2c->clocks);
+ 	return ret;
+ }
+ 
+@@ -1323,9 +1295,8 @@ static int mtk_i2c_probe(struct platform
+ {
+ 	int ret = 0;
+ 	struct mtk_i2c *i2c;
+-	struct clk *clk;
+ 	struct resource *res;
+-	int irq;
++	int i, irq, speed_clk;
+ 
+ 	i2c = devm_kzalloc(&pdev->dev, sizeof(*i2c), GFP_KERNEL);
+ 	if (!i2c)
+@@ -1371,35 +1342,42 @@ static int mtk_i2c_probe(struct platform
+ 	if (i2c->have_pmic && !i2c->dev_comp->pmic_i2c)
+ 		return -EINVAL;
+ 
+-	i2c->clk_main = devm_clk_get(&pdev->dev, "main");
+-	if (IS_ERR(i2c->clk_main)) {
++	/* Fill in clk-bulk IDs */
++	for (i = 0; i < I2C_MT65XX_CLK_MAX; i++)
++		i2c->clocks[i].id = i2c_mt65xx_clk_ids[i];
++
++	/* Get clocks one by one, some may be optional */
++	i2c->clocks[I2C_MT65XX_CLK_MAIN].clk = devm_clk_get(&pdev->dev, "main");
++	if (IS_ERR(i2c->clocks[I2C_MT65XX_CLK_MAIN].clk)) {
+ 		dev_err(&pdev->dev, "cannot get main clock\n");
+-		return PTR_ERR(i2c->clk_main);
++		return PTR_ERR(i2c->clocks[I2C_MT65XX_CLK_MAIN].clk);
+ 	}
+ 
+-	i2c->clk_dma = devm_clk_get(&pdev->dev, "dma");
+-	if (IS_ERR(i2c->clk_dma)) {
++	i2c->clocks[I2C_MT65XX_CLK_DMA].clk = devm_clk_get(&pdev->dev, "dma");
++	if (IS_ERR(i2c->clocks[I2C_MT65XX_CLK_DMA].clk)) {
+ 		dev_err(&pdev->dev, "cannot get dma clock\n");
+-		return PTR_ERR(i2c->clk_dma);
++		return PTR_ERR(i2c->clocks[I2C_MT65XX_CLK_DMA].clk);
+ 	}
+ 
+-	i2c->clk_arb = devm_clk_get(&pdev->dev, "arb");
+-	if (IS_ERR(i2c->clk_arb))
+-		i2c->clk_arb = NULL;
++	i2c->clocks[I2C_MT65XX_CLK_ARB].clk = devm_clk_get_optional(&pdev->dev, "arb");
++	if (IS_ERR(i2c->clocks[I2C_MT65XX_CLK_ARB].clk))
++		return PTR_ERR(i2c->clocks[I2C_MT65XX_CLK_ARB].clk);
+ 
+-	clk = i2c->clk_main;
+ 	if (i2c->have_pmic) {
+-		i2c->clk_pmic = devm_clk_get(&pdev->dev, "pmic");
+-		if (IS_ERR(i2c->clk_pmic)) {
++		i2c->clocks[I2C_MT65XX_CLK_PMIC].clk = devm_clk_get(&pdev->dev, "pmic");
++		if (IS_ERR(i2c->clocks[I2C_MT65XX_CLK_PMIC].clk)) {
+ 			dev_err(&pdev->dev, "cannot get pmic clock\n");
+-			return PTR_ERR(i2c->clk_pmic);
++			return PTR_ERR(i2c->clocks[I2C_MT65XX_CLK_PMIC].clk);
+ 		}
+-		clk = i2c->clk_pmic;
++		speed_clk = I2C_MT65XX_CLK_PMIC;
++	} else {
++		i2c->clocks[I2C_MT65XX_CLK_PMIC].clk = NULL;
++		speed_clk = I2C_MT65XX_CLK_MAIN;
+ 	}
+ 
+ 	strlcpy(i2c->adap.name, I2C_DRV_NAME, sizeof(i2c->adap.name));
+ 
+-	ret = mtk_i2c_set_speed(i2c, clk_get_rate(clk));
++	ret = mtk_i2c_set_speed(i2c, clk_get_rate(i2c->clocks[speed_clk].clk));
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "Failed to set the speed.\n");
+ 		return -EINVAL;
+@@ -1414,13 +1392,13 @@ static int mtk_i2c_probe(struct platform
+ 		}
+ 	}
+ 
+-	ret = mtk_i2c_clock_enable(i2c);
++	ret = clk_bulk_prepare_enable(I2C_MT65XX_CLK_MAX, i2c->clocks);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "clock enable failed!\n");
+ 		return ret;
+ 	}
+ 	mtk_i2c_init_hw(i2c);
+-	mtk_i2c_clock_disable(i2c);
++	clk_bulk_disable_unprepare(I2C_MT65XX_CLK_MAX, i2c->clocks);
+ 
+ 	ret = devm_request_irq(&pdev->dev, irq, mtk_i2c_irq,
+ 			       IRQF_NO_SUSPEND | IRQF_TRIGGER_NONE,
+@@ -1465,7 +1443,7 @@ static int mtk_i2c_resume_noirq(struct d
+ 	int ret;
+ 	struct mtk_i2c *i2c = dev_get_drvdata(dev);
+ 
+-	ret = mtk_i2c_clock_enable(i2c);
++	ret = clk_bulk_prepare_enable(I2C_MT65XX_CLK_MAX, i2c->clocks);
+ 	if (ret) {
+ 		dev_err(dev, "clock enable failed!\n");
+ 		return ret;
+@@ -1473,7 +1451,7 @@ static int mtk_i2c_resume_noirq(struct d
+ 
+ 	mtk_i2c_init_hw(i2c);
+ 
+-	mtk_i2c_clock_disable(i2c);
++	clk_bulk_disable_unprepare(I2C_MT65XX_CLK_MAX, i2c->clocks);
+ 
+ 	i2c_mark_adapter_resumed(&i2c->adap);
+ 
diff --git a/target/linux/mediatek/patches-5.15/846-v5.18-i2c-mediatek-Add-i2c-compatible-for-Mediatek-MT8168.patch b/target/linux/mediatek/patches-5.15/846-v5.18-i2c-mediatek-Add-i2c-compatible-for-Mediatek-MT8168.patch
new file mode 100644
index 00000000000000..fe5be94fca446e
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/846-v5.18-i2c-mediatek-Add-i2c-compatible-for-Mediatek-MT8168.patch
@@ -0,0 +1,46 @@
+From de054c03f90b3ea22bc346fbf78ac716df192b2d Mon Sep 17 00:00:00 2001
+From: Kewei Xu <kewei.xu@mediatek.com>
+Date: Mon, 7 Mar 2022 11:36:49 +0800
+Subject: [PATCH 07/16] i2c: mediatek: Add i2c compatible for Mediatek MT8168
+
+Add i2c compatible for MT8168. Compare to MT2712 i2c controller,
+MT8168 need to synchronize signal with dma.
+
+Signed-off-by: Kewei Xu <kewei.xu@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Qii Wang <qii.wang@mediatek.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -389,6 +389,19 @@ static const struct mtk_i2c_compatible m
+ 	.max_dma_support = 32,
+ };
+ 
++static const struct mtk_i2c_compatible mt8168_compat = {
++	.regs = mt_i2c_regs_v1,
++	.pmic_i2c = 0,
++	.dcm = 1,
++	.auto_restart = 1,
++	.aux_len_reg = 1,
++	.timing_adjust = 1,
++	.dma_sync = 1,
++	.ltiming_adjust = 0,
++	.apdma_sync = 0,
++	.max_dma_support = 33,
++};
++
+ static const struct mtk_i2c_compatible mt8173_compat = {
+ 	.regs = mt_i2c_regs_v1,
+ 	.pmic_i2c = 0,
+@@ -448,6 +461,7 @@ static const struct of_device_id mtk_i2c
+ 	{ .compatible = "mediatek,mt6577-i2c", .data = &mt6577_compat },
+ 	{ .compatible = "mediatek,mt6589-i2c", .data = &mt6589_compat },
+ 	{ .compatible = "mediatek,mt7622-i2c", .data = &mt7622_compat },
++	{ .compatible = "mediatek,mt8168-i2c", .data = &mt8168_compat },
+ 	{ .compatible = "mediatek,mt8173-i2c", .data = &mt8173_compat },
+ 	{ .compatible = "mediatek,mt8183-i2c", .data = &mt8183_compat },
+ 	{ .compatible = "mediatek,mt8186-i2c", .data = &mt8186_compat },
diff --git a/target/linux/mediatek/patches-5.15/847-v5.19-i2c-mediatek-Optimize-master_xfer-and-avoid-circular.patch b/target/linux/mediatek/patches-5.15/847-v5.19-i2c-mediatek-Optimize-master_xfer-and-avoid-circular.patch
new file mode 100644
index 00000000000000..5c4ce40765c058
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/847-v5.19-i2c-mediatek-Optimize-master_xfer-and-avoid-circular.patch
@@ -0,0 +1,101 @@
+From 2831f9a53ec3a16012d2d23590e3ebad6084b763 Mon Sep 17 00:00:00 2001
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Date: Mon, 11 Apr 2022 15:21:07 +0200
+Subject: [PATCH 08/16] i2c: mediatek: Optimize master_xfer() and avoid
+ circular locking
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Especially (but not only) during probe, it may happen that multiple
+devices are communicating via i2c (or multiple i2c busses) and
+sometimes while others are probing asynchronously.
+For example, a Cr50 TPM may be filling entropy (or userspace may be
+reading random data) while the rt5682 (i2c) codec driver reads/sets
+some registers, like while getting/setting a clock's rate, which
+happens both during probe and during system operation.
+
+In this driver, the mtk_i2c_transfer() function (which is the i2c
+.master_xfer() callback) was granularly managing the clocks by
+performing a clk_bulk_prepare_enable() to start them and its inverse.
+This is not only creating possible circular locking dependencies in
+the some cases (like former explanation), but it's also suboptimal,
+as clk_core prepare/unprepare operations are using mutex locking,
+which creates a bit of unwanted overhead (for example, i2c trackpads
+will call master_xfer() every few milliseconds!).
+
+With this commit, we avoid both the circular locking and additional
+overhead by changing how we handle the clocks in this driver:
+- Prepare the clocks during probe (and PM resume)
+- Enable/disable clocks in mtk_i2c_transfer()
+- Unprepare the clocks only for driver removal (and PM suspend)
+
+For the sake of providing a full explanation: during probe, the
+clocks are not only prepared but also enabled, as this is needed
+for some hardware initialization but, after that, we are disabling
+but not unpreparing them, leaving an expected state for the
+aforementioned clock handling strategy.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Tested-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: Qii Wang <qii.wang@mediatek.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -1177,7 +1177,7 @@ static int mtk_i2c_transfer(struct i2c_a
+ 	int left_num = num;
+ 	struct mtk_i2c *i2c = i2c_get_adapdata(adap);
+ 
+-	ret = clk_bulk_prepare_enable(I2C_MT65XX_CLK_MAX, i2c->clocks);
++	ret = clk_bulk_enable(I2C_MT65XX_CLK_MAX, i2c->clocks);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -1231,7 +1231,7 @@ static int mtk_i2c_transfer(struct i2c_a
+ 	ret = num;
+ 
+ err_exit:
+-	clk_bulk_disable_unprepare(I2C_MT65XX_CLK_MAX, i2c->clocks);
++	clk_bulk_disable(I2C_MT65XX_CLK_MAX, i2c->clocks);
+ 	return ret;
+ }
+ 
+@@ -1412,7 +1412,7 @@ static int mtk_i2c_probe(struct platform
+ 		return ret;
+ 	}
+ 	mtk_i2c_init_hw(i2c);
+-	clk_bulk_disable_unprepare(I2C_MT65XX_CLK_MAX, i2c->clocks);
++	clk_bulk_disable(I2C_MT65XX_CLK_MAX, i2c->clocks);
+ 
+ 	ret = devm_request_irq(&pdev->dev, irq, mtk_i2c_irq,
+ 			       IRQF_NO_SUSPEND | IRQF_TRIGGER_NONE,
+@@ -1439,6 +1439,8 @@ static int mtk_i2c_remove(struct platfor
+ 
+ 	i2c_del_adapter(&i2c->adap);
+ 
++	clk_bulk_unprepare(I2C_MT65XX_CLK_MAX, i2c->clocks);
++
+ 	return 0;
+ }
+ 
+@@ -1448,6 +1450,7 @@ static int mtk_i2c_suspend_noirq(struct
+ 	struct mtk_i2c *i2c = dev_get_drvdata(dev);
+ 
+ 	i2c_mark_adapter_suspended(&i2c->adap);
++	clk_bulk_unprepare(I2C_MT65XX_CLK_MAX, i2c->clocks);
+ 
+ 	return 0;
+ }
+@@ -1465,7 +1468,7 @@ static int mtk_i2c_resume_noirq(struct d
+ 
+ 	mtk_i2c_init_hw(i2c);
+ 
+-	clk_bulk_disable_unprepare(I2C_MT65XX_CLK_MAX, i2c->clocks);
++	clk_bulk_disable(I2C_MT65XX_CLK_MAX, i2c->clocks);
+ 
+ 	i2c_mark_adapter_resumed(&i2c->adap);
+ 
diff --git a/target/linux/mediatek/patches-5.15/848-v5.19-i2c-mediatek-Fix-an-error-handling-path-in-mtk_i2c_p.patch b/target/linux/mediatek/patches-5.15/848-v5.19-i2c-mediatek-Fix-an-error-handling-path-in-mtk_i2c_p.patch
new file mode 100644
index 00000000000000..354f12e2146495
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/848-v5.19-i2c-mediatek-Fix-an-error-handling-path-in-mtk_i2c_p.patch
@@ -0,0 +1,48 @@
+From 6f3a5814c7aaea4176e0ac8b1ec6dc0a65aa2808 Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Sun, 22 May 2022 14:22:07 +0200
+Subject: [PATCH 09/16] i2c: mediatek: Fix an error handling path in
+ mtk_i2c_probe()
+
+The clsk are prepared, enabled, then disabled. So if an error occurs after
+the disable step, they are still prepared.
+
+Add an error handling path to unprepare the clks in such a case, as already
+done in the .remove function.
+
+Fixes: 8b4fc246c3ff ("i2c: mediatek: Optimize master_xfer() and avoid circular locking")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Qii Wang <qii.wang@mediatek.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -1420,17 +1420,22 @@ static int mtk_i2c_probe(struct platform
+ 	if (ret < 0) {
+ 		dev_err(&pdev->dev,
+ 			"Request I2C IRQ %d fail\n", irq);
+-		return ret;
++		goto err_bulk_unprepare;
+ 	}
+ 
+ 	i2c_set_adapdata(&i2c->adap, i2c);
+ 	ret = i2c_add_adapter(&i2c->adap);
+ 	if (ret)
+-		return ret;
++		goto err_bulk_unprepare;
+ 
+ 	platform_set_drvdata(pdev, i2c);
+ 
+ 	return 0;
++
++err_bulk_unprepare:
++	clk_bulk_unprepare(I2C_MT65XX_CLK_MAX, i2c->clocks);
++
++	return ret;
+ }
+ 
+ static int mtk_i2c_remove(struct platform_device *pdev)
diff --git a/target/linux/mediatek/patches-5.15/849-v6.0-i2c-mediatek-add-i2c-compatible-for-MT8188.patch b/target/linux/mediatek/patches-5.15/849-v6.0-i2c-mediatek-add-i2c-compatible-for-MT8188.patch
new file mode 100644
index 00000000000000..744aa96ed0c49b
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/849-v6.0-i2c-mediatek-add-i2c-compatible-for-MT8188.patch
@@ -0,0 +1,82 @@
+From 94c7f8af2c0a399c8aa66f2522b60c5784b5be6c Mon Sep 17 00:00:00 2001
+From: Kewei Xu <kewei.xu@mediatek.com>
+Date: Sat, 6 Aug 2022 18:02:49 +0800
+Subject: [PATCH 10/16] i2c: mediatek: add i2c compatible for MT8188
+
+Add i2c compatible for MT8188 and added mt_i2c_regs_v3[], since
+MT8188 i2c OFFSET_SLAVE_ADDR register changed from 0x04 to 0x94.
+
+Signed-off-by: Kewei Xu <kewei.xu@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Qii Wang <qii.wang@mediatek.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 43 +++++++++++++++++++++++++++++++++
+ 1 file changed, 43 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -229,6 +229,35 @@ static const u16 mt_i2c_regs_v2[] = {
+ 	[OFFSET_DCM_EN] = 0xf88,
+ };
+ 
++static const u16 mt_i2c_regs_v3[] = {
++	[OFFSET_DATA_PORT] = 0x0,
++	[OFFSET_INTR_MASK] = 0x8,
++	[OFFSET_INTR_STAT] = 0xc,
++	[OFFSET_CONTROL] = 0x10,
++	[OFFSET_TRANSFER_LEN] = 0x14,
++	[OFFSET_TRANSAC_LEN] = 0x18,
++	[OFFSET_DELAY_LEN] = 0x1c,
++	[OFFSET_TIMING] = 0x20,
++	[OFFSET_START] = 0x24,
++	[OFFSET_EXT_CONF] = 0x28,
++	[OFFSET_LTIMING] = 0x2c,
++	[OFFSET_HS] = 0x30,
++	[OFFSET_IO_CONFIG] = 0x34,
++	[OFFSET_FIFO_ADDR_CLR] = 0x38,
++	[OFFSET_SDA_TIMING] = 0x3c,
++	[OFFSET_TRANSFER_LEN_AUX] = 0x44,
++	[OFFSET_CLOCK_DIV] = 0x48,
++	[OFFSET_SOFTRESET] = 0x50,
++	[OFFSET_MULTI_DMA] = 0x8c,
++	[OFFSET_SCL_MIS_COMP_POINT] = 0x90,
++	[OFFSET_SLAVE_ADDR] = 0x94,
++	[OFFSET_DEBUGSTAT] = 0xe4,
++	[OFFSET_DEBUGCTRL] = 0xe8,
++	[OFFSET_FIFO_STAT] = 0xf4,
++	[OFFSET_FIFO_THRESH] = 0xf8,
++	[OFFSET_DCM_EN] = 0xf88,
++};
++
+ struct mtk_i2c_compatible {
+ 	const struct i2c_adapter_quirks *quirks;
+ 	const u16 *regs;
+@@ -442,6 +471,19 @@ static const struct mtk_i2c_compatible m
+ 	.max_dma_support = 36,
+ };
+ 
++static const struct mtk_i2c_compatible mt8188_compat = {
++	.regs = mt_i2c_regs_v3,
++	.pmic_i2c = 0,
++	.dcm = 0,
++	.auto_restart = 1,
++	.aux_len_reg = 1,
++	.timing_adjust = 1,
++	.dma_sync = 0,
++	.ltiming_adjust = 1,
++	.apdma_sync = 1,
++	.max_dma_support = 36,
++};
++
+ static const struct mtk_i2c_compatible mt8192_compat = {
+ 	.quirks = &mt8183_i2c_quirks,
+ 	.regs = mt_i2c_regs_v2,
+@@ -465,6 +507,7 @@ static const struct of_device_id mtk_i2c
+ 	{ .compatible = "mediatek,mt8173-i2c", .data = &mt8173_compat },
+ 	{ .compatible = "mediatek,mt8183-i2c", .data = &mt8183_compat },
+ 	{ .compatible = "mediatek,mt8186-i2c", .data = &mt8186_compat },
++	{ .compatible = "mediatek,mt8188-i2c", .data = &mt8188_compat },
+ 	{ .compatible = "mediatek,mt8192-i2c", .data = &mt8192_compat },
+ 	{}
+ };
diff --git a/target/linux/mediatek/patches-5.15/850-v6.0-i2c-move-drivers-from-strlcpy-to-strscpy.patch b/target/linux/mediatek/patches-5.15/850-v6.0-i2c-move-drivers-from-strlcpy-to-strscpy.patch
new file mode 100644
index 00000000000000..1520a6cbe6d191
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/850-v6.0-i2c-move-drivers-from-strlcpy-to-strscpy.patch
@@ -0,0 +1,579 @@
+From 2f4ca256a98cc19787b7c861109dd1150a21b0bf Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Thu, 11 Aug 2022 09:10:30 +0200
+Subject: [PATCH 11/16] i2c: move drivers from strlcpy to strscpy
+
+Follow the advice of the below link and prefer 'strscpy'. Conversion is
+easy because no driver used the return value and has been done with a
+simple sed invocation.
+
+Link: https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+---
+ drivers/i2c/busses/i2c-altera.c         | 2 +-
+ drivers/i2c/busses/i2c-aspeed.c         | 2 +-
+ drivers/i2c/busses/i2c-au1550.c         | 2 +-
+ drivers/i2c/busses/i2c-axxia.c          | 2 +-
+ drivers/i2c/busses/i2c-bcm-kona.c       | 2 +-
+ drivers/i2c/busses/i2c-cbus-gpio.c      | 2 +-
+ drivers/i2c/busses/i2c-cht-wc.c         | 2 +-
+ drivers/i2c/busses/i2c-cros-ec-tunnel.c | 2 +-
+ drivers/i2c/busses/i2c-davinci.c        | 2 +-
+ drivers/i2c/busses/i2c-digicolor.c      | 2 +-
+ drivers/i2c/busses/i2c-eg20t.c          | 2 +-
+ drivers/i2c/busses/i2c-emev2.c          | 2 +-
+ drivers/i2c/busses/i2c-exynos5.c        | 2 +-
+ drivers/i2c/busses/i2c-gpio.c           | 2 +-
+ drivers/i2c/busses/i2c-highlander.c     | 2 +-
+ drivers/i2c/busses/i2c-hix5hd2.c        | 2 +-
+ drivers/i2c/busses/i2c-i801.c           | 4 ++--
+ drivers/i2c/busses/i2c-ibm_iic.c        | 2 +-
+ drivers/i2c/busses/i2c-icy.c            | 2 +-
+ drivers/i2c/busses/i2c-imx-lpi2c.c      | 2 +-
+ drivers/i2c/busses/i2c-lpc2k.c          | 2 +-
+ drivers/i2c/busses/i2c-meson.c          | 2 +-
+ drivers/i2c/busses/i2c-mt65xx.c         | 2 +-
+ drivers/i2c/busses/i2c-mt7621.c         | 2 +-
+ drivers/i2c/busses/i2c-mv64xxx.c        | 2 +-
+ drivers/i2c/busses/i2c-mxs.c            | 2 +-
+ drivers/i2c/busses/i2c-nvidia-gpu.c     | 2 +-
+ drivers/i2c/busses/i2c-omap.c           | 2 +-
+ drivers/i2c/busses/i2c-opal.c           | 4 ++--
+ drivers/i2c/busses/i2c-parport.c        | 2 +-
+ drivers/i2c/busses/i2c-pxa.c            | 2 +-
+ drivers/i2c/busses/i2c-qcom-geni.c      | 2 +-
+ drivers/i2c/busses/i2c-qup.c            | 2 +-
+ drivers/i2c/busses/i2c-rcar.c           | 2 +-
+ drivers/i2c/busses/i2c-riic.c           | 2 +-
+ drivers/i2c/busses/i2c-rk3x.c           | 2 +-
+ drivers/i2c/busses/i2c-s3c2410.c        | 2 +-
+ drivers/i2c/busses/i2c-sh_mobile.c      | 2 +-
+ drivers/i2c/busses/i2c-simtec.c         | 2 +-
+ drivers/i2c/busses/i2c-taos-evm.c       | 2 +-
+ drivers/i2c/busses/i2c-tegra-bpmp.c     | 2 +-
+ drivers/i2c/busses/i2c-tegra.c          | 2 +-
+ drivers/i2c/busses/i2c-uniphier-f.c     | 2 +-
+ drivers/i2c/busses/i2c-uniphier.c       | 2 +-
+ drivers/i2c/busses/i2c-versatile.c      | 2 +-
+ drivers/i2c/busses/i2c-wmt.c            | 2 +-
+ 46 files changed, 48 insertions(+), 48 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-altera.c
++++ b/drivers/i2c/busses/i2c-altera.c
+@@ -447,7 +447,7 @@ static int altr_i2c_probe(struct platfor
+ 	mutex_unlock(&idev->isr_mutex);
+ 
+ 	i2c_set_adapdata(&idev->adapter, idev);
+-	strlcpy(idev->adapter.name, pdev->name, sizeof(idev->adapter.name));
++	strscpy(idev->adapter.name, pdev->name, sizeof(idev->adapter.name));
+ 	idev->adapter.owner = THIS_MODULE;
+ 	idev->adapter.algo = &altr_i2c_algo;
+ 	idev->adapter.dev.parent = &pdev->dev;
+--- a/drivers/i2c/busses/i2c-aspeed.c
++++ b/drivers/i2c/busses/i2c-aspeed.c
+@@ -1024,7 +1024,7 @@ static int aspeed_i2c_probe_bus(struct p
+ 	bus->adap.algo = &aspeed_i2c_algo;
+ 	bus->adap.dev.parent = &pdev->dev;
+ 	bus->adap.dev.of_node = pdev->dev.of_node;
+-	strlcpy(bus->adap.name, pdev->name, sizeof(bus->adap.name));
++	strscpy(bus->adap.name, pdev->name, sizeof(bus->adap.name));
+ 	i2c_set_adapdata(&bus->adap, bus);
+ 
+ 	bus->dev = &pdev->dev;
+--- a/drivers/i2c/busses/i2c-au1550.c
++++ b/drivers/i2c/busses/i2c-au1550.c
+@@ -321,7 +321,7 @@ i2c_au1550_probe(struct platform_device
+ 	priv->adap.algo = &au1550_algo;
+ 	priv->adap.algo_data = priv;
+ 	priv->adap.dev.parent = &pdev->dev;
+-	strlcpy(priv->adap.name, "Au1xxx PSC I2C", sizeof(priv->adap.name));
++	strscpy(priv->adap.name, "Au1xxx PSC I2C", sizeof(priv->adap.name));
+ 
+ 	/* Now, set up the PSC for SMBus PIO mode. */
+ 	i2c_au1550_setup(priv);
+--- a/drivers/i2c/busses/i2c-axxia.c
++++ b/drivers/i2c/busses/i2c-axxia.c
+@@ -783,7 +783,7 @@ static int axxia_i2c_probe(struct platfo
+ 	}
+ 
+ 	i2c_set_adapdata(&idev->adapter, idev);
+-	strlcpy(idev->adapter.name, pdev->name, sizeof(idev->adapter.name));
++	strscpy(idev->adapter.name, pdev->name, sizeof(idev->adapter.name));
+ 	idev->adapter.owner = THIS_MODULE;
+ 	idev->adapter.algo = &axxia_i2c_algo;
+ 	idev->adapter.bus_recovery_info = &axxia_i2c_recovery_info;
+--- a/drivers/i2c/busses/i2c-bcm-kona.c
++++ b/drivers/i2c/busses/i2c-bcm-kona.c
+@@ -849,7 +849,7 @@ static int bcm_kona_i2c_probe(struct pla
+ 	adap = &dev->adapter;
+ 	i2c_set_adapdata(adap, dev);
+ 	adap->owner = THIS_MODULE;
+-	strlcpy(adap->name, "Broadcom I2C adapter", sizeof(adap->name));
++	strscpy(adap->name, "Broadcom I2C adapter", sizeof(adap->name));
+ 	adap->algo = &bcm_algo;
+ 	adap->dev.parent = &pdev->dev;
+ 	adap->dev.of_node = pdev->dev.of_node;
+--- a/drivers/i2c/busses/i2c-cbus-gpio.c
++++ b/drivers/i2c/busses/i2c-cbus-gpio.c
+@@ -245,7 +245,7 @@ static int cbus_i2c_probe(struct platfor
+ 	adapter->nr		= pdev->id;
+ 	adapter->timeout	= HZ;
+ 	adapter->algo		= &cbus_i2c_algo;
+-	strlcpy(adapter->name, "CBUS I2C adapter", sizeof(adapter->name));
++	strscpy(adapter->name, "CBUS I2C adapter", sizeof(adapter->name));
+ 
+ 	spin_lock_init(&chost->lock);
+ 	chost->dev = &pdev->dev;
+--- a/drivers/i2c/busses/i2c-cht-wc.c
++++ b/drivers/i2c/busses/i2c-cht-wc.c
+@@ -334,7 +334,7 @@ static int cht_wc_i2c_adap_i2c_probe(str
+ 	adap->adapter.class = I2C_CLASS_HWMON;
+ 	adap->adapter.algo = &cht_wc_i2c_adap_algo;
+ 	adap->adapter.lock_ops = &cht_wc_i2c_adap_lock_ops;
+-	strlcpy(adap->adapter.name, "PMIC I2C Adapter",
++	strscpy(adap->adapter.name, "PMIC I2C Adapter",
+ 		sizeof(adap->adapter.name));
+ 	adap->adapter.dev.parent = &pdev->dev;
+ 
+--- a/drivers/i2c/busses/i2c-cros-ec-tunnel.c
++++ b/drivers/i2c/busses/i2c-cros-ec-tunnel.c
+@@ -267,7 +267,7 @@ static int ec_i2c_probe(struct platform_
+ 	bus->dev = dev;
+ 
+ 	bus->adap.owner = THIS_MODULE;
+-	strlcpy(bus->adap.name, "cros-ec-i2c-tunnel", sizeof(bus->adap.name));
++	strscpy(bus->adap.name, "cros-ec-i2c-tunnel", sizeof(bus->adap.name));
+ 	bus->adap.algo = &ec_i2c_algorithm;
+ 	bus->adap.algo_data = bus;
+ 	bus->adap.dev.parent = &pdev->dev;
+--- a/drivers/i2c/busses/i2c-davinci.c
++++ b/drivers/i2c/busses/i2c-davinci.c
+@@ -847,7 +847,7 @@ static int davinci_i2c_probe(struct plat
+ 	i2c_set_adapdata(adap, dev);
+ 	adap->owner = THIS_MODULE;
+ 	adap->class = I2C_CLASS_DEPRECATED;
+-	strlcpy(adap->name, "DaVinci I2C adapter", sizeof(adap->name));
++	strscpy(adap->name, "DaVinci I2C adapter", sizeof(adap->name));
+ 	adap->algo = &i2c_davinci_algo;
+ 	adap->dev.parent = &pdev->dev;
+ 	adap->timeout = DAVINCI_I2C_TIMEOUT;
+--- a/drivers/i2c/busses/i2c-digicolor.c
++++ b/drivers/i2c/busses/i2c-digicolor.c
+@@ -322,7 +322,7 @@ static int dc_i2c_probe(struct platform_
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	strlcpy(i2c->adap.name, "Conexant Digicolor I2C adapter",
++	strscpy(i2c->adap.name, "Conexant Digicolor I2C adapter",
+ 		sizeof(i2c->adap.name));
+ 	i2c->adap.owner = THIS_MODULE;
+ 	i2c->adap.algo = &dc_i2c_algorithm;
+--- a/drivers/i2c/busses/i2c-eg20t.c
++++ b/drivers/i2c/busses/i2c-eg20t.c
+@@ -773,7 +773,7 @@ static int pch_i2c_probe(struct pci_dev
+ 
+ 		pch_adap->owner = THIS_MODULE;
+ 		pch_adap->class = I2C_CLASS_HWMON;
+-		strlcpy(pch_adap->name, KBUILD_MODNAME, sizeof(pch_adap->name));
++		strscpy(pch_adap->name, KBUILD_MODNAME, sizeof(pch_adap->name));
+ 		pch_adap->algo = &pch_algorithm;
+ 		pch_adap->algo_data = &adap_info->pch_data[i];
+ 
+--- a/drivers/i2c/busses/i2c-emev2.c
++++ b/drivers/i2c/busses/i2c-emev2.c
+@@ -371,7 +371,7 @@ static int em_i2c_probe(struct platform_
+ 	if (IS_ERR(priv->base))
+ 		return PTR_ERR(priv->base);
+ 
+-	strlcpy(priv->adap.name, "EMEV2 I2C", sizeof(priv->adap.name));
++	strscpy(priv->adap.name, "EMEV2 I2C", sizeof(priv->adap.name));
+ 
+ 	priv->sclk = devm_clk_get(&pdev->dev, "sclk");
+ 	if (IS_ERR(priv->sclk))
+--- a/drivers/i2c/busses/i2c-exynos5.c
++++ b/drivers/i2c/busses/i2c-exynos5.c
+@@ -751,7 +751,7 @@ static int exynos5_i2c_probe(struct plat
+ 	if (of_property_read_u32(np, "clock-frequency", &i2c->op_clock))
+ 		i2c->op_clock = I2C_MAX_STANDARD_MODE_FREQ;
+ 
+-	strlcpy(i2c->adap.name, "exynos5-i2c", sizeof(i2c->adap.name));
++	strscpy(i2c->adap.name, "exynos5-i2c", sizeof(i2c->adap.name));
+ 	i2c->adap.owner   = THIS_MODULE;
+ 	i2c->adap.algo    = &exynos5_i2c_algorithm;
+ 	i2c->adap.retries = 3;
+--- a/drivers/i2c/busses/i2c-gpio.c
++++ b/drivers/i2c/busses/i2c-gpio.c
+@@ -436,7 +436,7 @@ static int i2c_gpio_probe(struct platfor
+ 
+ 	adap->owner = THIS_MODULE;
+ 	if (np)
+-		strlcpy(adap->name, dev_name(dev), sizeof(adap->name));
++		strscpy(adap->name, dev_name(dev), sizeof(adap->name));
+ 	else
+ 		snprintf(adap->name, sizeof(adap->name), "i2c-gpio%d", pdev->id);
+ 
+--- a/drivers/i2c/busses/i2c-highlander.c
++++ b/drivers/i2c/busses/i2c-highlander.c
+@@ -402,7 +402,7 @@ static int highlander_i2c_probe(struct p
+ 	i2c_set_adapdata(adap, dev);
+ 	adap->owner = THIS_MODULE;
+ 	adap->class = I2C_CLASS_HWMON;
+-	strlcpy(adap->name, "HL FPGA I2C adapter", sizeof(adap->name));
++	strscpy(adap->name, "HL FPGA I2C adapter", sizeof(adap->name));
+ 	adap->algo = &highlander_i2c_algo;
+ 	adap->dev.parent = &pdev->dev;
+ 	adap->nr = pdev->id;
+--- a/drivers/i2c/busses/i2c-hix5hd2.c
++++ b/drivers/i2c/busses/i2c-hix5hd2.c
+@@ -423,7 +423,7 @@ static int hix5hd2_i2c_probe(struct plat
+ 	}
+ 	clk_prepare_enable(priv->clk);
+ 
+-	strlcpy(priv->adap.name, "hix5hd2-i2c", sizeof(priv->adap.name));
++	strscpy(priv->adap.name, "hix5hd2-i2c", sizeof(priv->adap.name));
+ 	priv->dev = &pdev->dev;
+ 	priv->adap.owner = THIS_MODULE;
+ 	priv->adap.algo = &hix5hd2_i2c_algorithm;
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -1111,7 +1111,7 @@ static void dmi_check_onboard_device(u8
+ 
+ 		memset(&info, 0, sizeof(struct i2c_board_info));
+ 		info.addr = dmi_devices[i].i2c_addr;
+-		strlcpy(info.type, dmi_devices[i].i2c_type, I2C_NAME_SIZE);
++		strscpy(info.type, dmi_devices[i].i2c_type, I2C_NAME_SIZE);
+ 		i2c_new_client_device(adap, &info);
+ 		break;
+ 	}
+@@ -1267,7 +1267,7 @@ static void register_dell_lis3lv02d_i2c_
+ 
+ 	memset(&info, 0, sizeof(struct i2c_board_info));
+ 	info.addr = dell_lis3lv02d_devices[i].i2c_addr;
+-	strlcpy(info.type, "lis3lv02d", I2C_NAME_SIZE);
++	strscpy(info.type, "lis3lv02d", I2C_NAME_SIZE);
+ 	i2c_new_client_device(&priv->adapter, &info);
+ }
+ 
+--- a/drivers/i2c/busses/i2c-ibm_iic.c
++++ b/drivers/i2c/busses/i2c-ibm_iic.c
+@@ -738,7 +738,7 @@ static int iic_probe(struct platform_dev
+ 	adap = &dev->adap;
+ 	adap->dev.parent = &ofdev->dev;
+ 	adap->dev.of_node = of_node_get(np);
+-	strlcpy(adap->name, "IBM IIC", sizeof(adap->name));
++	strscpy(adap->name, "IBM IIC", sizeof(adap->name));
+ 	i2c_set_adapdata(adap, dev);
+ 	adap->class = I2C_CLASS_HWMON | I2C_CLASS_SPD;
+ 	adap->algo = &iic_algo;
+--- a/drivers/i2c/busses/i2c-icy.c
++++ b/drivers/i2c/busses/i2c-icy.c
+@@ -141,7 +141,7 @@ static int icy_probe(struct zorro_dev *z
+ 	i2c->adapter.owner = THIS_MODULE;
+ 	/* i2c->adapter.algo assigned by i2c_pcf_add_bus() */
+ 	i2c->adapter.algo_data = algo_data;
+-	strlcpy(i2c->adapter.name, "ICY I2C Zorro adapter",
++	strscpy(i2c->adapter.name, "ICY I2C Zorro adapter",
+ 		sizeof(i2c->adapter.name));
+ 
+ 	if (!devm_request_mem_region(&z->dev,
+--- a/drivers/i2c/busses/i2c-imx-lpi2c.c
++++ b/drivers/i2c/busses/i2c-imx-lpi2c.c
+@@ -564,7 +564,7 @@ static int lpi2c_imx_probe(struct platfo
+ 	lpi2c_imx->adapter.algo		= &lpi2c_imx_algo;
+ 	lpi2c_imx->adapter.dev.parent	= &pdev->dev;
+ 	lpi2c_imx->adapter.dev.of_node	= pdev->dev.of_node;
+-	strlcpy(lpi2c_imx->adapter.name, pdev->name,
++	strscpy(lpi2c_imx->adapter.name, pdev->name,
+ 		sizeof(lpi2c_imx->adapter.name));
+ 
+ 	lpi2c_imx->clk = devm_clk_get(&pdev->dev, NULL);
+--- a/drivers/i2c/busses/i2c-lpc2k.c
++++ b/drivers/i2c/busses/i2c-lpc2k.c
+@@ -417,7 +417,7 @@ static int i2c_lpc2k_probe(struct platfo
+ 
+ 	i2c_set_adapdata(&i2c->adap, i2c);
+ 	i2c->adap.owner = THIS_MODULE;
+-	strlcpy(i2c->adap.name, "LPC2K I2C adapter", sizeof(i2c->adap.name));
++	strscpy(i2c->adap.name, "LPC2K I2C adapter", sizeof(i2c->adap.name));
+ 	i2c->adap.algo = &i2c_lpc2k_algorithm;
+ 	i2c->adap.dev.parent = &pdev->dev;
+ 	i2c->adap.dev.of_node = pdev->dev.of_node;
+--- a/drivers/i2c/busses/i2c-meson.c
++++ b/drivers/i2c/busses/i2c-meson.c
+@@ -451,7 +451,7 @@ static int meson_i2c_probe(struct platfo
+ 		return ret;
+ 	}
+ 
+-	strlcpy(i2c->adap.name, "Meson I2C adapter",
++	strscpy(i2c->adap.name, "Meson I2C adapter",
+ 		sizeof(i2c->adap.name));
+ 	i2c->adap.owner = THIS_MODULE;
+ 	i2c->adap.algo = &meson_i2c_algorithm;
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -1432,7 +1432,7 @@ static int mtk_i2c_probe(struct platform
+ 		speed_clk = I2C_MT65XX_CLK_MAIN;
+ 	}
+ 
+-	strlcpy(i2c->adap.name, I2C_DRV_NAME, sizeof(i2c->adap.name));
++	strscpy(i2c->adap.name, I2C_DRV_NAME, sizeof(i2c->adap.name));
+ 
+ 	ret = mtk_i2c_set_speed(i2c, clk_get_rate(i2c->clocks[speed_clk].clk));
+ 	if (ret) {
+--- a/drivers/i2c/busses/i2c-mt7621.c
++++ b/drivers/i2c/busses/i2c-mt7621.c
+@@ -315,7 +315,7 @@ static int mtk_i2c_probe(struct platform
+ 	adap->dev.parent = &pdev->dev;
+ 	i2c_set_adapdata(adap, i2c);
+ 	adap->dev.of_node = pdev->dev.of_node;
+-	strlcpy(adap->name, dev_name(&pdev->dev), sizeof(adap->name));
++	strscpy(adap->name, dev_name(&pdev->dev), sizeof(adap->name));
+ 
+ 	platform_set_drvdata(pdev, i2c);
+ 
+--- a/drivers/i2c/busses/i2c-mv64xxx.c
++++ b/drivers/i2c/busses/i2c-mv64xxx.c
+@@ -1000,7 +1000,7 @@ mv64xxx_i2c_probe(struct platform_device
+ 	if (IS_ERR(drv_data->reg_base))
+ 		return PTR_ERR(drv_data->reg_base);
+ 
+-	strlcpy(drv_data->adapter.name, MV64XXX_I2C_CTLR_NAME " adapter",
++	strscpy(drv_data->adapter.name, MV64XXX_I2C_CTLR_NAME " adapter",
+ 		sizeof(drv_data->adapter.name));
+ 
+ 	init_waitqueue_head(&drv_data->waitq);
+--- a/drivers/i2c/busses/i2c-mxs.c
++++ b/drivers/i2c/busses/i2c-mxs.c
+@@ -838,7 +838,7 @@ static int mxs_i2c_probe(struct platform
+ 		return err;
+ 
+ 	adap = &i2c->adapter;
+-	strlcpy(adap->name, "MXS I2C adapter", sizeof(adap->name));
++	strscpy(adap->name, "MXS I2C adapter", sizeof(adap->name));
+ 	adap->owner = THIS_MODULE;
+ 	adap->algo = &mxs_i2c_algo;
+ 	adap->quirks = &mxs_i2c_quirks;
+--- a/drivers/i2c/busses/i2c-nvidia-gpu.c
++++ b/drivers/i2c/busses/i2c-nvidia-gpu.c
+@@ -319,7 +319,7 @@ static int gpu_i2c_probe(struct pci_dev
+ 
+ 	i2c_set_adapdata(&i2cd->adapter, i2cd);
+ 	i2cd->adapter.owner = THIS_MODULE;
+-	strlcpy(i2cd->adapter.name, "NVIDIA GPU I2C adapter",
++	strscpy(i2cd->adapter.name, "NVIDIA GPU I2C adapter",
+ 		sizeof(i2cd->adapter.name));
+ 	i2cd->adapter.algo = &gpu_i2c_algorithm;
+ 	i2cd->adapter.quirks = &gpu_i2c_quirks;
+--- a/drivers/i2c/busses/i2c-omap.c
++++ b/drivers/i2c/busses/i2c-omap.c
+@@ -1488,7 +1488,7 @@ omap_i2c_probe(struct platform_device *p
+ 	i2c_set_adapdata(adap, omap);
+ 	adap->owner = THIS_MODULE;
+ 	adap->class = I2C_CLASS_DEPRECATED;
+-	strlcpy(adap->name, "OMAP I2C adapter", sizeof(adap->name));
++	strscpy(adap->name, "OMAP I2C adapter", sizeof(adap->name));
+ 	adap->algo = &omap_i2c_algo;
+ 	adap->quirks = &omap_i2c_quirks;
+ 	adap->dev.parent = &pdev->dev;
+--- a/drivers/i2c/busses/i2c-opal.c
++++ b/drivers/i2c/busses/i2c-opal.c
+@@ -220,9 +220,9 @@ static int i2c_opal_probe(struct platfor
+ 	adapter->dev.of_node = of_node_get(pdev->dev.of_node);
+ 	pname = of_get_property(pdev->dev.of_node, "ibm,port-name", NULL);
+ 	if (pname)
+-		strlcpy(adapter->name, pname, sizeof(adapter->name));
++		strscpy(adapter->name, pname, sizeof(adapter->name));
+ 	else
+-		strlcpy(adapter->name, "opal", sizeof(adapter->name));
++		strscpy(adapter->name, "opal", sizeof(adapter->name));
+ 
+ 	platform_set_drvdata(pdev, adapter);
+ 	rc = i2c_add_adapter(adapter);
+--- a/drivers/i2c/busses/i2c-parport.c
++++ b/drivers/i2c/busses/i2c-parport.c
+@@ -308,7 +308,7 @@ static void i2c_parport_attach(struct pa
+ 	/* Fill the rest of the structure */
+ 	adapter->adapter.owner = THIS_MODULE;
+ 	adapter->adapter.class = I2C_CLASS_HWMON;
+-	strlcpy(adapter->adapter.name, "Parallel port adapter",
++	strscpy(adapter->adapter.name, "Parallel port adapter",
+ 		sizeof(adapter->adapter.name));
+ 	adapter->algo_data = parport_algo_data;
+ 	/* Slow down if we can't sense SCL */
+--- a/drivers/i2c/busses/i2c-pxa.c
++++ b/drivers/i2c/busses/i2c-pxa.c
+@@ -1403,7 +1403,7 @@ static int i2c_pxa_probe(struct platform
+ 	spin_lock_init(&i2c->lock);
+ 	init_waitqueue_head(&i2c->wait);
+ 
+-	strlcpy(i2c->adap.name, "pxa_i2c-i2c", sizeof(i2c->adap.name));
++	strscpy(i2c->adap.name, "pxa_i2c-i2c", sizeof(i2c->adap.name));
+ 
+ 	i2c->clk = devm_clk_get(&dev->dev, NULL);
+ 	if (IS_ERR(i2c->clk)) {
+--- a/drivers/i2c/busses/i2c-qcom-geni.c
++++ b/drivers/i2c/busses/i2c-qcom-geni.c
+@@ -577,7 +577,7 @@ static int geni_i2c_probe(struct platfor
+ 	i2c_set_adapdata(&gi2c->adap, gi2c);
+ 	gi2c->adap.dev.parent = dev;
+ 	gi2c->adap.dev.of_node = dev->of_node;
+-	strlcpy(gi2c->adap.name, "Geni-I2C", sizeof(gi2c->adap.name));
++	strscpy(gi2c->adap.name, "Geni-I2C", sizeof(gi2c->adap.name));
+ 
+ 	ret = geni_icc_get(&gi2c->se, "qup-memory");
+ 	if (ret)
+--- a/drivers/i2c/busses/i2c-qup.c
++++ b/drivers/i2c/busses/i2c-qup.c
+@@ -1878,7 +1878,7 @@ nodma:
+ 	qup->adap.dev.of_node = pdev->dev.of_node;
+ 	qup->is_last = true;
+ 
+-	strlcpy(qup->adap.name, "QUP I2C adapter", sizeof(qup->adap.name));
++	strscpy(qup->adap.name, "QUP I2C adapter", sizeof(qup->adap.name));
+ 
+ 	pm_runtime_set_autosuspend_delay(qup->dev, MSEC_PER_SEC);
+ 	pm_runtime_use_autosuspend(qup->dev);
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -1059,7 +1059,7 @@ static int rcar_i2c_probe(struct platfor
+ 	adap->bus_recovery_info = &rcar_i2c_bri;
+ 	adap->quirks = &rcar_i2c_quirks;
+ 	i2c_set_adapdata(adap, priv);
+-	strlcpy(adap->name, pdev->name, sizeof(adap->name));
++	strscpy(adap->name, pdev->name, sizeof(adap->name));
+ 
+ 	/* Init DMA */
+ 	sg_init_table(&priv->sg, 1);
+--- a/drivers/i2c/busses/i2c-riic.c
++++ b/drivers/i2c/busses/i2c-riic.c
+@@ -447,7 +447,7 @@ static int riic_i2c_probe(struct platfor
+ 
+ 	adap = &riic->adapter;
+ 	i2c_set_adapdata(adap, riic);
+-	strlcpy(adap->name, "Renesas RIIC adapter", sizeof(adap->name));
++	strscpy(adap->name, "Renesas RIIC adapter", sizeof(adap->name));
+ 	adap->owner = THIS_MODULE;
+ 	adap->algo = &riic_algo;
+ 	adap->dev.parent = &pdev->dev;
+--- a/drivers/i2c/busses/i2c-rk3x.c
++++ b/drivers/i2c/busses/i2c-rk3x.c
+@@ -1240,7 +1240,7 @@ static int rk3x_i2c_probe(struct platfor
+ 	/* use common interface to get I2C timing properties */
+ 	i2c_parse_fw_timings(&pdev->dev, &i2c->t, true);
+ 
+-	strlcpy(i2c->adap.name, "rk3x-i2c", sizeof(i2c->adap.name));
++	strscpy(i2c->adap.name, "rk3x-i2c", sizeof(i2c->adap.name));
+ 	i2c->adap.owner = THIS_MODULE;
+ 	i2c->adap.algo = &rk3x_i2c_algorithm;
+ 	i2c->adap.retries = 3;
+--- a/drivers/i2c/busses/i2c-s3c2410.c
++++ b/drivers/i2c/busses/i2c-s3c2410.c
+@@ -1076,7 +1076,7 @@ static int s3c24xx_i2c_probe(struct plat
+ 	else
+ 		s3c24xx_i2c_parse_dt(pdev->dev.of_node, i2c);
+ 
+-	strlcpy(i2c->adap.name, "s3c2410-i2c", sizeof(i2c->adap.name));
++	strscpy(i2c->adap.name, "s3c2410-i2c", sizeof(i2c->adap.name));
+ 	i2c->adap.owner = THIS_MODULE;
+ 	i2c->adap.algo = &s3c24xx_i2c_algorithm;
+ 	i2c->adap.retries = 2;
+--- a/drivers/i2c/busses/i2c-sh_mobile.c
++++ b/drivers/i2c/busses/i2c-sh_mobile.c
+@@ -930,7 +930,7 @@ static int sh_mobile_i2c_probe(struct pl
+ 	adap->nr = dev->id;
+ 	adap->dev.of_node = dev->dev.of_node;
+ 
+-	strlcpy(adap->name, dev->name, sizeof(adap->name));
++	strscpy(adap->name, dev->name, sizeof(adap->name));
+ 
+ 	spin_lock_init(&pd->lock);
+ 	init_waitqueue_head(&pd->wait);
+--- a/drivers/i2c/busses/i2c-simtec.c
++++ b/drivers/i2c/busses/i2c-simtec.c
+@@ -99,7 +99,7 @@ static int simtec_i2c_probe(struct platf
+ 	pd->adap.algo_data = &pd->bit;
+ 	pd->adap.dev.parent = &dev->dev;
+ 
+-	strlcpy(pd->adap.name, "Simtec I2C", sizeof(pd->adap.name));
++	strscpy(pd->adap.name, "Simtec I2C", sizeof(pd->adap.name));
+ 
+ 	pd->bit.data = pd;
+ 	pd->bit.setsda = simtec_i2c_setsda;
+--- a/drivers/i2c/busses/i2c-taos-evm.c
++++ b/drivers/i2c/busses/i2c-taos-evm.c
+@@ -239,7 +239,7 @@ static int taos_connect(struct serio *se
+ 		dev_err(&serio->dev, "TAOS EVM identification failed\n");
+ 		goto exit_close;
+ 	}
+-	strlcpy(adapter->name, name, sizeof(adapter->name));
++	strscpy(adapter->name, name, sizeof(adapter->name));
+ 
+ 	/* Turn echo off for better performance */
+ 	taos->state = TAOS_STATE_EOFF;
+--- a/drivers/i2c/busses/i2c-tegra-bpmp.c
++++ b/drivers/i2c/busses/i2c-tegra-bpmp.c
+@@ -305,7 +305,7 @@ static int tegra_bpmp_i2c_probe(struct p
+ 
+ 	i2c_set_adapdata(&i2c->adapter, i2c);
+ 	i2c->adapter.owner = THIS_MODULE;
+-	strlcpy(i2c->adapter.name, "Tegra BPMP I2C adapter",
++	strscpy(i2c->adapter.name, "Tegra BPMP I2C adapter",
+ 		sizeof(i2c->adapter.name));
+ 	i2c->adapter.algo = &tegra_bpmp_i2c_algo;
+ 	i2c->adapter.dev.parent = &pdev->dev;
+--- a/drivers/i2c/busses/i2c-tegra.c
++++ b/drivers/i2c/busses/i2c-tegra.c
+@@ -1799,7 +1799,7 @@ static int tegra_i2c_probe(struct platfo
+ 	if (i2c_dev->hw->supports_bus_clear)
+ 		i2c_dev->adapter.bus_recovery_info = &tegra_i2c_recovery_info;
+ 
+-	strlcpy(i2c_dev->adapter.name, dev_name(i2c_dev->dev),
++	strscpy(i2c_dev->adapter.name, dev_name(i2c_dev->dev),
+ 		sizeof(i2c_dev->adapter.name));
+ 
+ 	err = i2c_add_numbered_adapter(&i2c_dev->adapter);
+--- a/drivers/i2c/busses/i2c-uniphier-f.c
++++ b/drivers/i2c/busses/i2c-uniphier-f.c
+@@ -564,7 +564,7 @@ static int uniphier_fi2c_probe(struct pl
+ 	priv->adap.algo = &uniphier_fi2c_algo;
+ 	priv->adap.dev.parent = dev;
+ 	priv->adap.dev.of_node = dev->of_node;
+-	strlcpy(priv->adap.name, "UniPhier FI2C", sizeof(priv->adap.name));
++	strscpy(priv->adap.name, "UniPhier FI2C", sizeof(priv->adap.name));
+ 	priv->adap.bus_recovery_info = &uniphier_fi2c_bus_recovery_info;
+ 	i2c_set_adapdata(&priv->adap, priv);
+ 	platform_set_drvdata(pdev, priv);
+--- a/drivers/i2c/busses/i2c-uniphier.c
++++ b/drivers/i2c/busses/i2c-uniphier.c
+@@ -358,7 +358,7 @@ static int uniphier_i2c_probe(struct pla
+ 	priv->adap.algo = &uniphier_i2c_algo;
+ 	priv->adap.dev.parent = dev;
+ 	priv->adap.dev.of_node = dev->of_node;
+-	strlcpy(priv->adap.name, "UniPhier I2C", sizeof(priv->adap.name));
++	strscpy(priv->adap.name, "UniPhier I2C", sizeof(priv->adap.name));
+ 	priv->adap.bus_recovery_info = &uniphier_i2c_bus_recovery_info;
+ 	i2c_set_adapdata(&priv->adap, priv);
+ 	platform_set_drvdata(pdev, priv);
+--- a/drivers/i2c/busses/i2c-versatile.c
++++ b/drivers/i2c/busses/i2c-versatile.c
+@@ -79,7 +79,7 @@ static int i2c_versatile_probe(struct pl
+ 	writel(SCL | SDA, i2c->base + I2C_CONTROLS);
+ 
+ 	i2c->adap.owner = THIS_MODULE;
+-	strlcpy(i2c->adap.name, "Versatile I2C adapter", sizeof(i2c->adap.name));
++	strscpy(i2c->adap.name, "Versatile I2C adapter", sizeof(i2c->adap.name));
+ 	i2c->adap.algo_data = &i2c->algo;
+ 	i2c->adap.dev.parent = &dev->dev;
+ 	i2c->adap.dev.of_node = dev->dev.of_node;
+--- a/drivers/i2c/busses/i2c-wmt.c
++++ b/drivers/i2c/busses/i2c-wmt.c
+@@ -413,7 +413,7 @@ static int wmt_i2c_probe(struct platform
+ 
+ 	adap = &i2c_dev->adapter;
+ 	i2c_set_adapdata(adap, i2c_dev);
+-	strlcpy(adap->name, "WMT I2C adapter", sizeof(adap->name));
++	strscpy(adap->name, "WMT I2C adapter", sizeof(adap->name));
+ 	adap->owner = THIS_MODULE;
+ 	adap->algo = &wmt_i2c_algo;
+ 	adap->dev.parent = &pdev->dev;
diff --git a/target/linux/mediatek/patches-5.15/851-v6.2-i2c-mediatek-add-mt7986-support.patch b/target/linux/mediatek/patches-5.15/851-v6.2-i2c-mediatek-add-mt7986-support.patch
new file mode 100644
index 00000000000000..4c398c59f93551
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/851-v6.2-i2c-mediatek-add-mt7986-support.patch
@@ -0,0 +1,44 @@
+From 11f9a0f4e51887ad7b4a2898a368fcd0c2984e89 Mon Sep 17 00:00:00 2001
+From: Frank Wunderlich <frank-w@public-files.de>
+Date: Sun, 9 Oct 2022 12:16:31 +0200
+Subject: [PATCH 12/16] i2c: mediatek: add mt7986 support
+
+Add i2c support for MT7986 SoC.
+
+Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -431,6 +431,19 @@ static const struct mtk_i2c_compatible m
+ 	.max_dma_support = 33,
+ };
+ 
++static const struct mtk_i2c_compatible mt7986_compat = {
++	.quirks = &mt7622_i2c_quirks,
++	.regs = mt_i2c_regs_v1,
++	.pmic_i2c = 0,
++	.dcm = 1,
++	.auto_restart = 1,
++	.aux_len_reg = 1,
++	.timing_adjust = 0,
++	.dma_sync = 1,
++	.ltiming_adjust = 0,
++	.max_dma_support = 32,
++};
++
+ static const struct mtk_i2c_compatible mt8173_compat = {
+ 	.regs = mt_i2c_regs_v1,
+ 	.pmic_i2c = 0,
+@@ -503,6 +516,7 @@ static const struct of_device_id mtk_i2c
+ 	{ .compatible = "mediatek,mt6577-i2c", .data = &mt6577_compat },
+ 	{ .compatible = "mediatek,mt6589-i2c", .data = &mt6589_compat },
+ 	{ .compatible = "mediatek,mt7622-i2c", .data = &mt7622_compat },
++	{ .compatible = "mediatek,mt7986-i2c", .data = &mt7986_compat },
+ 	{ .compatible = "mediatek,mt8168-i2c", .data = &mt8168_compat },
+ 	{ .compatible = "mediatek,mt8173-i2c", .data = &mt8173_compat },
+ 	{ .compatible = "mediatek,mt8183-i2c", .data = &mt8183_compat },
diff --git a/target/linux/mediatek/patches-5.15/852-v6.3-i2c-mt65xx-Use-devm_platform_get_and_ioremap_resourc.patch b/target/linux/mediatek/patches-5.15/852-v6.3-i2c-mt65xx-Use-devm_platform_get_and_ioremap_resourc.patch
new file mode 100644
index 00000000000000..18c66cdac52910
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/852-v6.3-i2c-mt65xx-Use-devm_platform_get_and_ioremap_resourc.patch
@@ -0,0 +1,42 @@
+From 98204ccafd45a8a6109ff2d60e2c179b95d92578 Mon Sep 17 00:00:00 2001
+From: ye xingchen <ye.xingchen@zte.com.cn>
+Date: Thu, 19 Jan 2023 17:19:58 +0800
+Subject: [PATCH 13/16] i2c: mt65xx: Use
+ devm_platform_get_and_ioremap_resource()
+
+Convert platform_get_resource(), devm_ioremap_resource() to a single
+call to devm_platform_get_and_ioremap_resource(), as this is exactly
+what this function does.
+
+Signed-off-by: ye xingchen <ye.xingchen@zte.com.cn>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -1366,20 +1366,17 @@ static int mtk_i2c_probe(struct platform
+ {
+ 	int ret = 0;
+ 	struct mtk_i2c *i2c;
+-	struct resource *res;
+ 	int i, irq, speed_clk;
+ 
+ 	i2c = devm_kzalloc(&pdev->dev, sizeof(*i2c), GFP_KERNEL);
+ 	if (!i2c)
+ 		return -ENOMEM;
+ 
+-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	i2c->base = devm_ioremap_resource(&pdev->dev, res);
++	i2c->base = devm_platform_get_and_ioremap_resource(pdev, 0, NULL);
+ 	if (IS_ERR(i2c->base))
+ 		return PTR_ERR(i2c->base);
+ 
+-	res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+-	i2c->pdmabase = devm_ioremap_resource(&pdev->dev, res);
++	i2c->pdmabase = devm_platform_get_and_ioremap_resource(pdev, 1, NULL);
+ 	if (IS_ERR(i2c->pdmabase))
+ 		return PTR_ERR(i2c->pdmabase);
+ 
diff --git a/target/linux/mediatek/patches-5.15/853-v6.3-i2c-mt65xx-drop-of_match_ptr-for-ID-table.patch b/target/linux/mediatek/patches-5.15/853-v6.3-i2c-mt65xx-drop-of_match_ptr-for-ID-table.patch
new file mode 100644
index 00000000000000..d000d535226f42
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/853-v6.3-i2c-mt65xx-drop-of_match_ptr-for-ID-table.patch
@@ -0,0 +1,33 @@
+From 8106fa2e0ae6082833fe1df97829c46c0183eaea Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Sat, 11 Mar 2023 12:16:54 +0100
+Subject: [PATCH 14/16] i2c: mt65xx: drop of_match_ptr for ID table
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The driver can match only via the DT table so the table should be always
+used and the of_match_ptr does not have any sense (this also allows ACPI
+matching via PRP0001, even though it might not be relevant here).
+
+  drivers/i2c/busses/i2c-mt65xx.c:514:34: error: ‘mtk_i2c_of_match’ defined but not used [-Werror=unused-const-variable=]
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Guenter Roeck <groeck@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -1546,7 +1546,7 @@ static struct platform_driver mtk_i2c_dr
+ 	.driver = {
+ 		.name = I2C_DRV_NAME,
+ 		.pm = &mtk_i2c_pm,
+-		.of_match_table = of_match_ptr(mtk_i2c_of_match),
++		.of_match_table = mtk_i2c_of_match,
+ 	},
+ };
+ 
diff --git a/target/linux/mediatek/patches-5.15/854-v6.4-i2c-mediatek-add-support-for-MT7981-SoC.patch b/target/linux/mediatek/patches-5.15/854-v6.4-i2c-mediatek-add-support-for-MT7981-SoC.patch
new file mode 100644
index 00000000000000..e0973741e29d68
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/854-v6.4-i2c-mediatek-add-support-for-MT7981-SoC.patch
@@ -0,0 +1,47 @@
+From f69f3d662ba3bf999c36d9ac1e684540c4487bc3 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 10 Apr 2023 17:19:38 +0100
+Subject: [PATCH 15/16] i2c: mediatek: add support for MT7981 SoC
+
+Add support for the I2C units found in the MediaTek MT7981 and MT7988
+SoCs. Just like other recent MediaTek I2C units that also uses v3
+register offsets (which differ from v2 only by OFFSET_SLAVE_ADDR being
+0x94 instead of 0x4).
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -431,6 +431,18 @@ static const struct mtk_i2c_compatible m
+ 	.max_dma_support = 33,
+ };
+ 
++static const struct mtk_i2c_compatible mt7981_compat = {
++	.regs = mt_i2c_regs_v3,
++	.pmic_i2c = 0,
++	.dcm = 0,
++	.auto_restart = 1,
++	.aux_len_reg = 1,
++	.timing_adjust = 1,
++	.dma_sync = 1,
++	.ltiming_adjust = 1,
++	.max_dma_support = 33
++};
++
+ static const struct mtk_i2c_compatible mt7986_compat = {
+ 	.quirks = &mt7622_i2c_quirks,
+ 	.regs = mt_i2c_regs_v1,
+@@ -516,6 +528,7 @@ static const struct of_device_id mtk_i2c
+ 	{ .compatible = "mediatek,mt6577-i2c", .data = &mt6577_compat },
+ 	{ .compatible = "mediatek,mt6589-i2c", .data = &mt6589_compat },
+ 	{ .compatible = "mediatek,mt7622-i2c", .data = &mt7622_compat },
++	{ .compatible = "mediatek,mt7981-i2c", .data = &mt7981_compat },
+ 	{ .compatible = "mediatek,mt7986-i2c", .data = &mt7986_compat },
+ 	{ .compatible = "mediatek,mt8168-i2c", .data = &mt8168_compat },
+ 	{ .compatible = "mediatek,mt8173-i2c", .data = &mt8173_compat },
diff --git a/target/linux/mediatek/patches-5.15/900-dts-mt7622-bpi-r64-aliases-for-dtoverlay.patch b/target/linux/mediatek/patches-5.15/900-dts-mt7622-bpi-r64-aliases-for-dtoverlay.patch
index b15d04f8bb0945..f779c1e0473ab2 100644
--- a/target/linux/mediatek/patches-5.15/900-dts-mt7622-bpi-r64-aliases-for-dtoverlay.patch
+++ b/target/linux/mediatek/patches-5.15/900-dts-mt7622-bpi-r64-aliases-for-dtoverlay.patch
@@ -10,7 +10,7 @@
  		gpios = <90 GPIO_ACTIVE_HIGH>;
  		output-high;
 --- /dev/null
-+++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64-sata.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64-sata.dtso
 @@ -0,0 +1,31 @@
 +/* SPDX-License-Identifier: (GPL-2.0-only OR MIT) */
 +
@@ -44,7 +44,7 @@
 +	};
 +};
 --- /dev/null
-+++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64-pcie1.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64-pcie1.dtso
 @@ -0,0 +1,17 @@
 +/* SPDX-License-Identifier: (GPL-2.0-only OR MIT) */
 +
diff --git a/target/linux/mediatek/patches-5.15/901-arm-add-cmdline-override.patch b/target/linux/mediatek/patches-5.15/901-arm-add-cmdline-override.patch
index a11219d353e63f..6016128bd4a200 100644
--- a/target/linux/mediatek/patches-5.15/901-arm-add-cmdline-override.patch
+++ b/target/linux/mediatek/patches-5.15/901-arm-add-cmdline-override.patch
@@ -1,6 +1,6 @@
 --- a/arch/arm/Kconfig
 +++ b/arch/arm/Kconfig
-@@ -1794,6 +1794,14 @@ config ARM_ATAG_DTB_COMPAT_CMDLINE_MANGL
+@@ -1729,6 +1729,14 @@ config ARM_ATAG_DTB_COMPAT_CMDLINE_EXTEN
  
  endchoice
  
@@ -17,7 +17,7 @@
  	default ""
 --- a/drivers/of/fdt.c
 +++ b/drivers/of/fdt.c
-@@ -1059,6 +1059,17 @@ int __init early_init_dt_scan_chosen(uns
+@@ -1162,6 +1162,17 @@ int __init early_init_dt_scan_chosen(uns
  	if (p != NULL && l > 0)
  		strlcat(data, p, min_t(int, strlen(data) + (int)l, COMMAND_LINE_SIZE));
  
@@ -35,3 +35,20 @@
  	/*
  	 * CONFIG_CMDLINE is meant to be a default in case nothing else
  	 * managed to set the command line, unless CONFIG_CMDLINE_FORCE
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -1942,6 +1942,14 @@ config CMDLINE_FORCE
+ 
+ endchoice
+ 
++config CMDLINE_OVERRIDE
++	bool "Use alternative cmdline from device tree"
++	help
++	  Some bootloaders may have uneditable bootargs. While CMDLINE_FORCE can
++	  be used, this is not a good option for kernels that are shared across
++	  devices. This setting enables using "chosen/cmdline-override" as the
++	  cmdline if it exists in the device tree.
++
+ config EFI_STUB
+ 	bool
+ 
diff --git a/target/linux/mediatek/patches-5.15/920-v5.16-watchdog-mtk-add-disable_wdt_extrst-support.patch b/target/linux/mediatek/patches-5.15/920-v5.16-watchdog-mtk-add-disable_wdt_extrst-support.patch
new file mode 100644
index 00000000000000..d9379721fb8a58
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/920-v5.16-watchdog-mtk-add-disable_wdt_extrst-support.patch
@@ -0,0 +1,50 @@
+From 59b0f51335644ee603260faaa4298c0115fb7187 Mon Sep 17 00:00:00 2001
+From: Fengquan Chen <Fengquan.Chen@mediatek.com>
+Date: Tue, 14 Sep 2021 20:34:54 +0800
+Subject: [PATCH] watchdog: mtk: add disable_wdt_extrst support
+
+In some cases, we may need watchdog just to trigger an
+internal soc reset without sending any output signal.
+
+Provide a disable_wdt_extrst parameter for configuration.
+We can disable or enable it just by configuring dts.
+
+Signed-off-by: Fengquan Chen <fengquan.chen@mediatek.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20210914123454.32603-3-Fengquan.Chen@mediatek.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+---
+ drivers/watchdog/mtk_wdt.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/watchdog/mtk_wdt.c
++++ b/drivers/watchdog/mtk_wdt.c
+@@ -65,6 +65,7 @@ struct mtk_wdt_dev {
+ 	void __iomem *wdt_base;
+ 	spinlock_t lock; /* protects WDT_SWSYSRST reg */
+ 	struct reset_controller_dev rcdev;
++	bool disable_wdt_extrst;
+ };
+ 
+ struct mtk_wdt_data {
+@@ -256,6 +257,8 @@ static int mtk_wdt_start(struct watchdog
+ 		reg |= (WDT_MODE_IRQ_EN | WDT_MODE_DUAL_EN);
+ 	else
+ 		reg &= ~(WDT_MODE_IRQ_EN | WDT_MODE_DUAL_EN);
++	if (mtk_wdt->disable_wdt_extrst)
++		reg &= ~WDT_MODE_EXRST_EN;
+ 	reg |= (WDT_MODE_EN | WDT_MODE_KEY);
+ 	iowrite32(reg, wdt_base + WDT_MODE);
+ 
+@@ -381,6 +384,10 @@ static int mtk_wdt_probe(struct platform
+ 		if (err)
+ 			return err;
+ 	}
++
++	mtk_wdt->disable_wdt_extrst =
++		of_property_read_bool(dev->of_node, "mediatek,disable-extrst");
++
+ 	return 0;
+ }
+ 
diff --git a/target/linux/mediatek/patches-5.15/921-v5.19-watchdog-mtk_wdt-mt7986-Add-toprgu-reset-controller.patch b/target/linux/mediatek/patches-5.15/921-v5.19-watchdog-mtk_wdt-mt7986-Add-toprgu-reset-controller.patch
new file mode 100644
index 00000000000000..96fb215f76c04e
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/921-v5.19-watchdog-mtk_wdt-mt7986-Add-toprgu-reset-controller.patch
@@ -0,0 +1,49 @@
+From 711a5b25bac95dcd1111521ed71693330e74a926 Mon Sep 17 00:00:00 2001
+From: Sam Shih <sam.shih@mediatek.com>
+Date: Wed, 5 Jan 2022 18:04:56 +0800
+Subject: [PATCH] watchdog: mtk_wdt: mt7986: Add toprgu reset controller
+ support
+
+Besides watchdog, the mt7986 toprgu module also provides software reset
+functionality for various peripheral subsystems
+(eg, ethernet, pcie, and connectivity)
+
+Signed-off-by: Sam Shih <sam.shih@mediatek.com>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20220105100456.7126-3-sam.shih@mediatek.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+---
+ drivers/watchdog/mtk_wdt.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/watchdog/mtk_wdt.c
++++ b/drivers/watchdog/mtk_wdt.c
+@@ -10,6 +10,7 @@
+  */
+ 
+ #include <dt-bindings/reset-controller/mt2712-resets.h>
++#include <dt-bindings/reset/mt7986-resets.h>
+ #include <dt-bindings/reset-controller/mt8183-resets.h>
+ #include <dt-bindings/reset-controller/mt8192-resets.h>
+ #include <dt-bindings/reset/mt8195-resets.h>
+@@ -76,6 +77,10 @@ static const struct mtk_wdt_data mt2712_
+ 	.toprgu_sw_rst_num = MT2712_TOPRGU_SW_RST_NUM,
+ };
+ 
++static const struct mtk_wdt_data mt7986_data = {
++	.toprgu_sw_rst_num = MT7986_TOPRGU_SW_RST_NUM,
++};
++
+ static const struct mtk_wdt_data mt8183_data = {
+ 	.toprgu_sw_rst_num = MT8183_TOPRGU_SW_RST_NUM,
+ };
+@@ -418,6 +423,7 @@ static int mtk_wdt_resume(struct device
+ static const struct of_device_id mtk_wdt_dt_ids[] = {
+ 	{ .compatible = "mediatek,mt2712-wdt", .data = &mt2712_data },
+ 	{ .compatible = "mediatek,mt6589-wdt" },
++	{ .compatible = "mediatek,mt7986-wdt", .data = &mt7986_data },
+ 	{ .compatible = "mediatek,mt8183-wdt", .data = &mt8183_data },
+ 	{ .compatible = "mediatek,mt8192-wdt", .data = &mt8192_data },
+ 	{ .compatible = "mediatek,mt8195-wdt", .data = &mt8195_data },
diff --git a/target/linux/mediatek/patches-5.15/922-v6.1-PCI-mediatek-gen3-change-driver-name-to-mtk-pcie-gen.patch b/target/linux/mediatek/patches-5.15/922-v6.1-PCI-mediatek-gen3-change-driver-name-to-mtk-pcie-gen.patch
new file mode 100644
index 00000000000000..44aed2207d564c
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/922-v6.1-PCI-mediatek-gen3-change-driver-name-to-mtk-pcie-gen.patch
@@ -0,0 +1,20 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 4 May 2022 12:03:42 +0200
+Subject: [PATCH] PCI: mediatek-gen3: change driver name to mtk-pcie-gen3
+
+This allows it to coexist with the other mtk pcie driver in the same kernel
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/pci/controller/pcie-mediatek-gen3.c
++++ b/drivers/pci/controller/pcie-mediatek-gen3.c
+@@ -1025,7 +1025,7 @@ static struct platform_driver mtk_pcie_d
+ 	.probe = mtk_pcie_probe,
+ 	.remove = mtk_pcie_remove,
+ 	.driver = {
+-		.name = "mtk-pcie",
++		.name = "mtk-pcie-gen3",
+ 		.of_match_table = mtk_pcie_of_match,
+ 		.pm = &mtk_pcie_pm_ops,
+ 	},
diff --git a/target/linux/mediatek/patches-5.15/930-spi-mt65xx-enable-sel-clk.patch b/target/linux/mediatek/patches-5.15/930-spi-mt65xx-enable-sel-clk.patch
new file mode 100644
index 00000000000000..ebb6c060b54c65
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/930-spi-mt65xx-enable-sel-clk.patch
@@ -0,0 +1,29 @@
+--- a/drivers/spi/spi-mt65xx.c
++++ b/drivers/spi/spi-mt65xx.c
+@@ -1231,10 +1231,16 @@ static int mtk_spi_probe(struct platform
+ 		goto err_disable_spi_hclk;
+ 	}
+ 
++	ret = clk_prepare_enable(mdata->sel_clk);
++	if (ret < 0) {
++		dev_err(&pdev->dev, "failed to enable sel_clk (%d)\n", ret);
++		goto err_disable_spi_clk;
++	}
++
+ 	ret = clk_set_parent(mdata->sel_clk, mdata->parent_clk);
+ 	if (ret < 0) {
+ 		dev_err(&pdev->dev, "failed to clk_set_parent (%d)\n", ret);
+-		goto err_disable_spi_clk;
++		goto err_disable_spi_sel_clk;
+ 	}
+ 
+ 	mdata->spi_clk_hz = clk_get_rate(mdata->spi_clk);
+@@ -1285,6 +1291,8 @@ static int mtk_spi_probe(struct platform
+ 
+ err_disable_runtime_pm:
+ 	pm_runtime_disable(&pdev->dev);
++err_disable_spi_sel_clk:
++	clk_disable_unprepare(mdata->sel_clk);
+ err_disable_spi_clk:
+ 	clk_disable_unprepare(mdata->spi_clk);
+ err_disable_spi_hclk:
diff --git a/target/linux/mediatek/patches-5.15/940-net-ethernet-mtk_wed-rename-mtk_wed_get_memory_regio.patch b/target/linux/mediatek/patches-5.15/940-net-ethernet-mtk_wed-rename-mtk_wed_get_memory_regio.patch
new file mode 100644
index 00000000000000..2fe565f3b25f6e
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/940-net-ethernet-mtk_wed-rename-mtk_wed_get_memory_regio.patch
@@ -0,0 +1,44 @@
+From 3cf212c4ce6cd72c09bc47f35f539ba0afd4d106 Mon Sep 17 00:00:00 2001
+Message-Id: <3cf212c4ce6cd72c09bc47f35f539ba0afd4d106.1678716918.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sun, 12 Mar 2023 16:40:31 +0100
+Subject: [PATCH net-next 1/2] net: ethernet: mtk_wed: rename
+ mtk_wed_get_memory_region in mtk_wed_get_reserved_memory_region
+
+This is a preliminary patch to move wed ilm/dlm and cpuboot properties in
+dedicated dts nodes.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_wed_mcu.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
+@@ -215,8 +215,8 @@ int mtk_wed_mcu_msg_update(struct mtk_we
+ }
+ 
+ static int
+-mtk_wed_get_memory_region(struct mtk_wed_wo *wo,
+-			  struct mtk_wed_wo_memory_region *region)
++mtk_wed_get_reserved_memory_region(struct mtk_wed_wo *wo,
++				   struct mtk_wed_wo_memory_region *region)
+ {
+ 	struct reserved_mem *rmem;
+ 	struct device_node *np;
+@@ -311,13 +311,13 @@ mtk_wed_mcu_load_firmware(struct mtk_wed
+ 
+ 	/* load firmware region metadata */
+ 	for (i = 0; i < ARRAY_SIZE(mem_region); i++) {
+-		ret = mtk_wed_get_memory_region(wo, &mem_region[i]);
++		ret = mtk_wed_get_reserved_memory_region(wo, &mem_region[i]);
+ 		if (ret)
+ 			return ret;
+ 	}
+ 
+ 	wo->boot.name = "wo-boot";
+-	ret = mtk_wed_get_memory_region(wo, &wo->boot);
++	ret = mtk_wed_get_reserved_memory_region(wo, &wo->boot);
+ 	if (ret)
+ 		return ret;
+ 
diff --git a/target/linux/mediatek/patches-5.15/941-arm64-dts-mt7986-move-cpuboot-in-a-dedicated-node.patch b/target/linux/mediatek/patches-5.15/941-arm64-dts-mt7986-move-cpuboot-in-a-dedicated-node.patch
new file mode 100644
index 00000000000000..0a58ae953b4fe5
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/941-arm64-dts-mt7986-move-cpuboot-in-a-dedicated-node.patch
@@ -0,0 +1,66 @@
+From 247e566e3459481f1fa98733534bfed767e18b42 Mon Sep 17 00:00:00 2001
+Message-Id: <247e566e3459481f1fa98733534bfed767e18b42.1678620342.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 11 Mar 2023 16:32:41 +0100
+Subject: [PATCH net-next] arm64: dts: mt7986: move cpuboot in a dedicated node
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+@@ -121,12 +121,6 @@
+ 			reg = <0 0x151f8000 0 0x2000>;
+ 			no-map;
+ 		};
+-
+-		wo_boot: wo-boot@15194000 {
+-			reg = <0 0x15194000 0 0x1000>;
+-			no-map;
+-		};
+-
+ 	};
+ 
+ 	timer {
+@@ -518,10 +512,11 @@
+ 			interrupt-parent = <&gic>;
+ 			interrupts = <GIC_SPI 205 IRQ_TYPE_LEVEL_HIGH>;
+ 			memory-region = <&wo_emi0>, <&wo_ilm0>, <&wo_dlm0>,
+-					<&wo_data>, <&wo_boot>;
++					<&wo_data>;
+ 			memory-region-names = "wo-emi", "wo-ilm", "wo-dlm",
+-					      "wo-data", "wo-boot";
++					      "wo-data";
+ 			mediatek,wo-ccif = <&wo_ccif0>;
++			mediatek,wo-cpuboot = <&wo_cpuboot>;
+ 		};
+ 
+ 		wed1: wed@15011000 {
+@@ -531,10 +526,11 @@
+ 			interrupt-parent = <&gic>;
+ 			interrupts = <GIC_SPI 206 IRQ_TYPE_LEVEL_HIGH>;
+ 			memory-region = <&wo_emi1>, <&wo_ilm1>, <&wo_dlm1>,
+-					<&wo_data>, <&wo_boot>;
++					<&wo_data>;
+ 			memory-region-names = "wo-emi", "wo-ilm", "wo-dlm",
+-					      "wo-data", "wo-boot";
++					      "wo-data";
+ 			mediatek,wo-ccif = <&wo_ccif1>;
++			mediatek,wo-cpuboot = <&wo_cpuboot>;
+ 		};
+ 
+ 		wo_ccif0: syscon@151a5000 {
+@@ -551,6 +547,11 @@
+ 			interrupts = <GIC_SPI 212 IRQ_TYPE_LEVEL_HIGH>;
+ 		};
+ 
++		wo_cpuboot: syscon@15194000 {
++			compatible = "mediatek,mt7986-wo-cpuboot", "syscon";
++			reg = <0 0x15194000 0 0x1000>;
++		};
++
+ 		eth: ethernet@15100000 {
+ 			compatible = "mediatek,mt7986-eth";
+ 			reg = <0 0x15100000 0 0x80000>;
diff --git a/target/linux/mediatek/patches-5.15/942-net-ethernet-mtk_wed-move-cpuboot-in-a-dedicated-dts.patch b/target/linux/mediatek/patches-5.15/942-net-ethernet-mtk_wed-move-cpuboot-in-a-dedicated-dts.patch
new file mode 100644
index 00000000000000..9de4ffa433eedb
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/942-net-ethernet-mtk_wed-move-cpuboot-in-a-dedicated-dts.patch
@@ -0,0 +1,89 @@
+From f292d1bf83ec160bef2532b58aa08f5b71041923 Mon Sep 17 00:00:00 2001
+Message-Id: <f292d1bf83ec160bef2532b58aa08f5b71041923.1678716918.git.lorenzo@kernel.org>
+In-Reply-To: <3cf212c4ce6cd72c09bc47f35f539ba0afd4d106.1678716918.git.lorenzo@kernel.org>
+References: <3cf212c4ce6cd72c09bc47f35f539ba0afd4d106.1678716918.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 11 Mar 2023 18:13:04 +0100
+Subject: [PATCH net-next 2/2] net: ethernet: mtk_wed: move cpuboot in a
+ dedicated dts node
+
+Since the cpuboot memory region is not part of the RAM SoC, move cpuboot
+in a deidicated syscon node.
+This patch helps to keep backward-compatibility with older version of
+uboot codebase where we have a limit of 8 reserved-memory dts child
+nodes.
+Keep backward-compatibility with older dts version where cpuboot was
+defined as reserved-memory child node.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_wed_mcu.c | 34 +++++++++++++++++----
+ drivers/net/ethernet/mediatek/mtk_wed_wo.h  |  3 +-
+ 2 files changed, 30 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
+@@ -18,12 +18,23 @@
+ 
+ static u32 wo_r32(struct mtk_wed_wo *wo, u32 reg)
+ {
+-	return readl(wo->boot.addr + reg);
++	u32 val;
++
++	if (!wo->boot_regmap)
++		return readl(wo->boot.addr + reg);
++
++	if (regmap_read(wo->boot_regmap, reg, &val))
++		val = ~0;
++
++	return val;
+ }
+ 
+ static void wo_w32(struct mtk_wed_wo *wo, u32 reg, u32 val)
+ {
+-	writel(val, wo->boot.addr + reg);
++	if (wo->boot_regmap)
++		regmap_write(wo->boot_regmap, reg, val);
++	else
++		writel(val, wo->boot.addr + reg);
+ }
+ 
+ static struct sk_buff *
+@@ -316,10 +327,21 @@ mtk_wed_mcu_load_firmware(struct mtk_wed
+ 			return ret;
+ 	}
+ 
+-	wo->boot.name = "wo-boot";
+-	ret = mtk_wed_get_reserved_memory_region(wo, &wo->boot);
+-	if (ret)
+-		return ret;
++	wo->boot_regmap = syscon_regmap_lookup_by_phandle(wo->hw->node,
++							  "mediatek,wo-cpuboot");
++	if (IS_ERR(wo->boot_regmap)) {
++		if (wo->boot_regmap != ERR_PTR(-ENODEV))
++			return PTR_ERR(wo->boot_regmap);
++
++		/* For backward compatibility, we need to check if cpu_boot
++		 * is defined through reserved memory property.
++		 */
++		wo->boot_regmap = NULL;
++		wo->boot.name = "wo-boot";
++		ret = mtk_wed_get_reserved_memory_region(wo, &wo->boot);
++		if (ret)
++			return ret;
++	}
+ 
+ 	/* set dummy cr */
+ 	wed_w32(wo->hw->wed_dev, MTK_WED_SCR0 + 4 * MTK_WED_DUMMY_CR_FWDL,
+--- a/drivers/net/ethernet/mediatek/mtk_wed_wo.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.h
+@@ -228,7 +228,8 @@ struct mtk_wed_wo_queue {
+ 
+ struct mtk_wed_wo {
+ 	struct mtk_wed_hw *hw;
+-	struct mtk_wed_wo_memory_region boot;
++	struct mtk_wed_wo_memory_region boot; /* backward compatibility */
++	struct regmap *boot_regmap;
+ 
+ 	struct mtk_wed_wo_queue q_tx;
+ 	struct mtk_wed_wo_queue q_rx;
diff --git a/target/linux/mediatek/patches-5.15/943-net-ethernet-mtk_wed-move-ilm-a-dedicated-dts-node.patch b/target/linux/mediatek/patches-5.15/943-net-ethernet-mtk_wed-move-ilm-a-dedicated-dts-node.patch
new file mode 100644
index 00000000000000..7b6c5d1e277c9d
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/943-net-ethernet-mtk_wed-move-ilm-a-dedicated-dts-node.patch
@@ -0,0 +1,91 @@
+From f3565e6c2276411275e707a5442d3f69cc111273 Mon Sep 17 00:00:00 2001
+Message-Id: <f3565e6c2276411275e707a5442d3f69cc111273.1678718888.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sun, 12 Mar 2023 18:51:47 +0100
+Subject: [PATCH net-next 1/3] net: ethernet: mtk_wed: move ilm a dedicated dts
+ node
+
+Since the ilm memory region is not part of the RAM SoC, move ilm in a
+deidicated syscon node.
+This patch helps to keep backward-compatibility with older version of
+uboot codebase where we have a limit of 8 reserved-memory dts child
+nodes.
+Keep backward-compatibility with older dts version where ilm was defined
+as reserved-memory child node.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_wed_mcu.c | 55 ++++++++++++++++++---
+ 1 file changed, 49 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
+@@ -300,6 +300,52 @@ next:
+ }
+ 
+ static int
++mtk_wed_mcu_load_memory_regions(struct mtk_wed_wo *wo,
++				struct mtk_wed_wo_memory_region *region)
++{
++	struct device_node *np;
++	int ret;
++
++	/* firmware EMI memory region */
++	ret = mtk_wed_get_reserved_memory_region(wo,
++			&region[MTK_WED_WO_REGION_EMI]);
++	if (ret)
++		return ret;
++
++	/* firmware DATA memory region */
++	ret = mtk_wed_get_reserved_memory_region(wo,
++			&region[MTK_WED_WO_REGION_DATA]);
++	if (ret)
++		return ret;
++
++	np = of_parse_phandle(wo->hw->node, "mediatek,wo-ilm", 0);
++	if (np) {
++		struct mtk_wed_wo_memory_region *ilm_region;
++		struct resource res;
++
++		ret = of_address_to_resource(np, 0, &res);
++		of_node_put(np);
++
++		if (ret < 0)
++			return ret;
++
++		ilm_region = &region[MTK_WED_WO_REGION_ILM];
++		ilm_region->phy_addr = res.start;
++		ilm_region->size = resource_size(&res);
++		ilm_region->addr = devm_ioremap(wo->hw->dev, res.start,
++						resource_size(&res));
++
++		return IS_ERR(ilm_region->addr) ? PTR_ERR(ilm_region->addr) : 0;
++	}
++
++	/* For backward compatibility, we need to check if ILM
++	 * node is defined through reserved memory property.
++	 */
++	return mtk_wed_get_reserved_memory_region(wo,
++			&region[MTK_WED_WO_REGION_ILM]);
++}
++
++static int
+ mtk_wed_mcu_load_firmware(struct mtk_wed_wo *wo)
+ {
+ 	static struct mtk_wed_wo_memory_region mem_region[] = {
+@@ -320,12 +366,9 @@ mtk_wed_mcu_load_firmware(struct mtk_wed
+ 	u32 val, boot_cr;
+ 	int ret, i;
+ 
+-	/* load firmware region metadata */
+-	for (i = 0; i < ARRAY_SIZE(mem_region); i++) {
+-		ret = mtk_wed_get_reserved_memory_region(wo, &mem_region[i]);
+-		if (ret)
+-			return ret;
+-	}
++	ret = mtk_wed_mcu_load_memory_regions(wo, mem_region);
++	if (ret)
++		return ret;
+ 
+ 	wo->boot_regmap = syscon_regmap_lookup_by_phandle(wo->hw->node,
+ 							  "mediatek,wo-cpuboot");
diff --git a/target/linux/mediatek/patches-5.15/944-net-ethernet-mtk_wed-move-dlm-a-dedicated-dts-node.patch b/target/linux/mediatek/patches-5.15/944-net-ethernet-mtk_wed-move-dlm-a-dedicated-dts-node.patch
new file mode 100644
index 00000000000000..a455005504cead
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/944-net-ethernet-mtk_wed-move-dlm-a-dedicated-dts-node.patch
@@ -0,0 +1,57 @@
+From b74ba226be2c45091b93bd49192bdd6d2178729e Mon Sep 17 00:00:00 2001
+Message-Id: <b74ba226be2c45091b93bd49192bdd6d2178729e.1678718888.git.lorenzo@kernel.org>
+In-Reply-To: <f3565e6c2276411275e707a5442d3f69cc111273.1678718888.git.lorenzo@kernel.org>
+References: <f3565e6c2276411275e707a5442d3f69cc111273.1678718888.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Mon, 13 Mar 2023 15:45:16 +0100
+Subject: [PATCH net-next 3/3] net: ethernet: mtk_wed: move dlm a dedicated dts
+ node
+
+Since the dlm memory region is not part of the RAM SoC, move dlm in a
+deidicated syscon node.
+This patch helps to keep backward-compatibility with older version of
+uboot codebase where we have a limit of 8 reserved-memory dts child
+nodes.
+Keep backward-compatibility with older dts version where dlm was defined
+as reserved-memory child node.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_wed.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -813,6 +813,24 @@ mtk_wed_rro_alloc(struct mtk_wed_device
+ 	struct device_node *np;
+ 	int index;
+ 
++	np = of_parse_phandle(dev->hw->node, "mediatek,wo-dlm", 0);
++	if (np) {
++		struct resource res;
++		int ret;
++
++		ret = of_address_to_resource(np, 0, &res);
++		of_node_put(np);
++
++		if (ret < 0)
++			return ret;
++
++		dev->rro.miod_phys = res.start;
++		goto out;
++	}
++
++	/* For backward compatibility, we need to check if DLM
++	 * node is defined through reserved memory property.
++	 */
+ 	index = of_property_match_string(dev->hw->node, "memory-region-names",
+ 					 "wo-dlm");
+ 	if (index < 0)
+@@ -829,6 +847,7 @@ mtk_wed_rro_alloc(struct mtk_wed_device
+ 		return -ENODEV;
+ 
+ 	dev->rro.miod_phys = rmem->base;
++out:
+ 	dev->rro.fdbk_phys = MTK_WED_MIOD_COUNT + dev->rro.miod_phys;
+ 
+ 	return mtk_wed_rro_ring_alloc(dev, &dev->rro.ring,
diff --git a/target/linux/mediatek/patches-5.15/945-arm64-dts-mt7986-move-ilm-in-a-dedicated-node.patch b/target/linux/mediatek/patches-5.15/945-arm64-dts-mt7986-move-ilm-in-a-dedicated-node.patch
new file mode 100644
index 00000000000000..36fe9278372a95
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/945-arm64-dts-mt7986-move-ilm-in-a-dedicated-node.patch
@@ -0,0 +1,83 @@
+From 01561065af5bf1d2a4244896d897e3a1eafbcd46 Mon Sep 17 00:00:00 2001
+Message-Id: <01561065af5bf1d2a4244896d897e3a1eafbcd46.1678717704.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Mon, 13 Mar 2023 15:10:56 +0100
+Subject: [PATCH net-next] arm64: dts: mt7986: move ilm in a dedicated node
+
+Since the ilm memory region is not part of the RAM SoC, move ilm in a
+deidicated syscon node.
+This patch helps to keep backward-compatibility with older version of
+uboot codebase where we have a limit of 8 reserved-memory dts child
+nodes.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 34 +++++++++++------------
+ 1 file changed, 16 insertions(+), 18 deletions(-)
+
+--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+@@ -97,16 +97,6 @@
+ 			no-map;
+ 		};
+ 
+-		wo_ilm0: wo-ilm@151e0000 {
+-			reg = <0 0x151e0000 0 0x8000>;
+-			no-map;
+-		};
+-
+-		wo_ilm1: wo-ilm@151f0000 {
+-			reg = <0 0x151f0000 0 0x8000>;
+-			no-map;
+-		};
+-
+ 		wo_data: wo-data@4fd80000 {
+ 			reg = <0 0x4fd80000 0 0x240000>;
+ 			no-map;
+@@ -511,11 +501,10 @@
+ 			reg = <0 0x15010000 0 0x1000>;
+ 			interrupt-parent = <&gic>;
+ 			interrupts = <GIC_SPI 205 IRQ_TYPE_LEVEL_HIGH>;
+-			memory-region = <&wo_emi0>, <&wo_ilm0>, <&wo_dlm0>,
+-					<&wo_data>;
+-			memory-region-names = "wo-emi", "wo-ilm", "wo-dlm",
+-					      "wo-data";
++			memory-region = <&wo_emi0>, <&wo_dlm0>, <&wo_data>;
++			memory-region-names = "wo-emi", "wo-dlm", "wo-data";
+ 			mediatek,wo-ccif = <&wo_ccif0>;
++			mediatek,wo-ilm = <&wo_ilm0>;
+ 			mediatek,wo-cpuboot = <&wo_cpuboot>;
+ 		};
+ 
+@@ -525,11 +514,10 @@
+ 			reg = <0 0x15011000 0 0x1000>;
+ 			interrupt-parent = <&gic>;
+ 			interrupts = <GIC_SPI 206 IRQ_TYPE_LEVEL_HIGH>;
+-			memory-region = <&wo_emi1>, <&wo_ilm1>, <&wo_dlm1>,
+-					<&wo_data>;
+-			memory-region-names = "wo-emi", "wo-ilm", "wo-dlm",
+-					      "wo-data";
++			memory-region = <&wo_emi1>, <&wo_dlm1>, <&wo_data>;
++			memory-region-names = "wo-emi", "wo-dlm", "wo-data";
+ 			mediatek,wo-ccif = <&wo_ccif1>;
++			mediatek,wo-ilm = <&wo_ilm1>;
+ 			mediatek,wo-cpuboot = <&wo_cpuboot>;
+ 		};
+ 
+@@ -547,6 +535,16 @@
+ 			interrupts = <GIC_SPI 212 IRQ_TYPE_LEVEL_HIGH>;
+ 		};
+ 
++		wo_ilm0: syscon@151e0000 {
++			compatible = "mediatek,mt7986-wo-ilm", "syscon";
++			reg = <0 0x151e0000 0 0x8000>;
++		};
++
++		wo_ilm1: syscon@151f0000 {
++			compatible = "mediatek,mt7986-wo-ilm", "syscon";
++			reg = <0 0x151f0000 0 0x8000>;
++		};
++
+ 		wo_cpuboot: syscon@15194000 {
+ 			compatible = "mediatek,mt7986-wo-cpuboot", "syscon";
+ 			reg = <0 0x15194000 0 0x1000>;
diff --git a/target/linux/mediatek/patches-5.15/946-arm64-dts-mt7986-move-dlm-in-a-dedicated-node.patch b/target/linux/mediatek/patches-5.15/946-arm64-dts-mt7986-move-dlm-in-a-dedicated-node.patch
new file mode 100644
index 00000000000000..55f17286c600eb
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/946-arm64-dts-mt7986-move-dlm-in-a-dedicated-node.patch
@@ -0,0 +1,81 @@
+From 9f76be683a8ec498563c294bc1cc279468058302 Mon Sep 17 00:00:00 2001
+Message-Id: <9f76be683a8ec498563c294bc1cc279468058302.1678719283.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Mon, 13 Mar 2023 15:53:30 +0100
+Subject: [PATCH net-next] arm64: dts: mt7986: move dlm in a dedicated node
+
+Since the dlm memory region is not part of the RAM SoC, move dlm in a
+deidicated syscon node.
+This patch helps to keep backward-compatibility with older version of
+uboot codebase where we have a limit of 8 reserved-memory dts child
+nodes.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 30 ++++++++++++-----------
+ 1 file changed, 16 insertions(+), 14 deletions(-)
+
+--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+@@ -101,16 +101,6 @@
+ 			reg = <0 0x4fd80000 0 0x240000>;
+ 			no-map;
+ 		};
+-
+-		wo_dlm0: wo-dlm@151e8000 {
+-			reg = <0 0x151e8000 0 0x2000>;
+-			no-map;
+-		};
+-
+-		wo_dlm1: wo-dlm@151f8000 {
+-			reg = <0 0x151f8000 0 0x2000>;
+-			no-map;
+-		};
+ 	};
+ 
+ 	timer {
+@@ -501,10 +491,11 @@
+ 			reg = <0 0x15010000 0 0x1000>;
+ 			interrupt-parent = <&gic>;
+ 			interrupts = <GIC_SPI 205 IRQ_TYPE_LEVEL_HIGH>;
+-			memory-region = <&wo_emi0>, <&wo_dlm0>, <&wo_data>;
+-			memory-region-names = "wo-emi", "wo-dlm", "wo-data";
++			memory-region = <&wo_emi0>, <&wo_data>;
++			memory-region-names = "wo-emi", "wo-data";
+ 			mediatek,wo-ccif = <&wo_ccif0>;
+ 			mediatek,wo-ilm = <&wo_ilm0>;
++			mediatek,wo-dlm = <&wo_dlm0>;
+ 			mediatek,wo-cpuboot = <&wo_cpuboot>;
+ 		};
+ 
+@@ -514,10 +505,11 @@
+ 			reg = <0 0x15011000 0 0x1000>;
+ 			interrupt-parent = <&gic>;
+ 			interrupts = <GIC_SPI 206 IRQ_TYPE_LEVEL_HIGH>;
+-			memory-region = <&wo_emi1>, <&wo_dlm1>, <&wo_data>;
+-			memory-region-names = "wo-emi", "wo-dlm", "wo-data";
++			memory-region = <&wo_emi1>, <&wo_data>;
++			memory-region-names = "wo-emi", "wo-data";
+ 			mediatek,wo-ccif = <&wo_ccif1>;
+ 			mediatek,wo-ilm = <&wo_ilm1>;
++			mediatek,wo-dlm = <&wo_dlm1>;
+ 			mediatek,wo-cpuboot = <&wo_cpuboot>;
+ 		};
+ 
+@@ -545,6 +537,16 @@
+ 			reg = <0 0x151f0000 0 0x8000>;
+ 		};
+ 
++		wo_dlm0: syscon@151e8000 {
++			compatible = "mediatek,mt7986-wo-dlm", "syscon";
++			reg = <0 0x151e8000 0 0x2000>;
++		};
++
++		wo_dlm1: syscon@151f8000 {
++			compatible = "mediatek,mt7986-wo-dlm", "syscon";
++			reg = <0 0x151f8000 0 0x2000>;
++		};
++
+ 		wo_cpuboot: syscon@15194000 {
+ 			compatible = "mediatek,mt7986-wo-cpuboot", "syscon";
+ 			reg = <0 0x15194000 0 0x1000>;
diff --git a/target/linux/mpc85xx/Makefile b/target/linux/mpc85xx/Makefile
index 398e5788820541..7e84be8624154b 100644
--- a/target/linux/mpc85xx/Makefile
+++ b/target/linux/mpc85xx/Makefile
@@ -7,11 +7,11 @@ include $(TOPDIR)/rules.mk
 ARCH:=powerpc
 BOARD:=mpc85xx
 BOARDNAME:=Freescale MPC85xx
-CPU_TYPE:=8540
+CPU_TYPE:=8548
 FEATURES:=squashfs ramdisk nand
 SUBTARGETS:=p1010 p1020 p2020
 
-KERNEL_PATCHVER:=5.10
+KERNEL_PATCHVER:=5.15
 
 KERNELNAME:=zImage
 
@@ -19,7 +19,7 @@ include $(INCLUDE_DIR)/target.mk
 
 DEFAULT_PACKAGES += \
 	kmod-input-core kmod-input-gpio-keys kmod-button-hotplug \
-	kmod-leds-gpio swconfig kmod-ath9k wpad-basic-wolfssl kmod-usb2 \
+	kmod-leds-gpio swconfig kmod-ath9k wpad-basic-mbedtls kmod-usb2 \
 	uboot-envtools
 
 $(eval $(call BuildTarget))
diff --git a/target/linux/mpc85xx/base-files/etc/board.d/01_leds b/target/linux/mpc85xx/base-files/etc/board.d/01_leds
index 391c909e4cd54c..d9b4d2d79d32b9 100644
--- a/target/linux/mpc85xx/base-files/etc/board.d/01_leds
+++ b/target/linux/mpc85xx/base-files/etc/board.d/01_leds
@@ -8,6 +8,7 @@ boardname="${board##*,}"
 board_config_update
 
 case $board in
+enterasys,ws-ap3715i|\
 extreme-networks,ws-ap3825i)
 	ucidef_set_led_netdev "lan1" "LAN1" "green:lan1" "eth1"
 	ucidef_set_led_netdev "lan2" "LAN2" "green:lan2" "eth0"
diff --git a/target/linux/mpc85xx/base-files/etc/board.d/02_network b/target/linux/mpc85xx/base-files/etc/board.d/02_network
index 03153b73d0b00d..41859362b52ed7 100644
--- a/target/linux/mpc85xx/base-files/etc/board.d/02_network
+++ b/target/linux/mpc85xx/base-files/etc/board.d/02_network
@@ -9,7 +9,11 @@ board_config_update
 board=$(board_name)
 
 case "$board" in
-aerohive,hiveap-330)
+aerohive,br200-wp)
+	ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" "wan"
+	;;
+aerohive,hiveap-330|\
+enterasys,ws-ap3715i)
 	ucidef_set_interfaces_lan_wan "eth1" "eth0"
 	;;
 ocedo,panda)
@@ -18,10 +22,12 @@ ocedo,panda)
 		"0:lan" "1:lan" "2:lan" "3:lan" "4:lan" "5:lan" "6:lan" "7:lan" "8u@eth0"
 	;;
 tplink,tl-wdr4900-v1)
-	ucidef_add_switch "switch0" \
-		"0@eth0" "2:lan:1" "3:lan:2" "4:lan:3" "5:lan:4" "1:wan"
+	ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" "wan"
 	ucidef_set_interface_macaddr "wan" "$(macaddr_add $(mtd_get_mac_binary u-boot 0x4fc00) 1)"
 	;;
+watchguard,firebox-t10)
+	ucidef_set_interfaces_lan_wan "eth1 eth2" "eth0"
+	;;
 *)
 	ucidef_set_interfaces_lan_wan "eth0" "eth1"
 	;;
diff --git a/target/linux/mpc85xx/base-files/etc/board.d/05_compat-version b/target/linux/mpc85xx/base-files/etc/board.d/05_compat-version
new file mode 100644
index 00000000000000..bcc03e95021663
--- /dev/null
+++ b/target/linux/mpc85xx/base-files/etc/board.d/05_compat-version
@@ -0,0 +1,15 @@
+
+. /lib/functions.sh
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+	tplink,tl-wdr4900-v1)
+		ucidef_set_compat_version "1.1"
+		;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/mpc85xx/base-files/etc/hotplug.d/ieee80211/10-fix-wifi-mac b/target/linux/mpc85xx/base-files/etc/hotplug.d/ieee80211/10-fix-wifi-mac
index 8050c7bea279eb..20ad8eb44f4735 100644
--- a/target/linux/mpc85xx/base-files/etc/hotplug.d/ieee80211/10-fix-wifi-mac
+++ b/target/linux/mpc85xx/base-files/etc/hotplug.d/ieee80211/10-fix-wifi-mac
@@ -12,6 +12,10 @@ PHYNBR=${DEVPATH##*/phy}
 board=$(board_name)
 
 case "$board" in
+enterasys,ws-ap3715i)
+	[ "$PHYNBR" -eq 0 ] && mtd_get_mac_ascii cfg2 RADIOADDR1 > /sys${DEVPATH}/macaddress
+	[ "$PHYNBR" -eq 1 ] && mtd_get_mac_ascii cfg2 RADIOADDR0 > /sys${DEVPATH}/macaddress
+	;;
 enterasys,ws-ap3710i|\
 extreme-networks,ws-ap3825i)
 	mtd_get_mac_ascii cfg2 RADIOADDR${PHYNBR} > /sys${DEVPATH}/macaddress
diff --git a/target/linux/mpc85xx/base-files/lib/preinit/10_fix_eth_mac.sh b/target/linux/mpc85xx/base-files/lib/preinit/10_fix_eth_mac.sh
index d94eba688c8ed7..ddb9bef1416ae4 100644
--- a/target/linux/mpc85xx/base-files/lib/preinit/10_fix_eth_mac.sh
+++ b/target/linux/mpc85xx/base-files/lib/preinit/10_fix_eth_mac.sh
@@ -1,11 +1,18 @@
 . /lib/functions.sh
+. /lib/functions/system.sh
 
 preinit_set_mac_address() {
 	case $(board_name) in
+	enterasys,ws-ap3715i|\
 	extreme-networks,ws-ap3825i)
 		ip link set dev eth0 address $(mtd_get_mac_ascii cfg1 ethaddr)
 		ip link set dev eth1 address $(mtd_get_mac_ascii cfg1 eth1addr)
 		;;
+	watchguard,firebox-t10)
+		ip link set dev eth0 address "$(mtd_get_mac_text "device_id" 0x1830)"
+		ip link set dev eth1 address "$(mtd_get_mac_text "device_id" 0x1844)"
+		ip link set dev eth2 address "$(mtd_get_mac_text "device_id" 0x1858)"
+		;;
 	esac
 }
 
diff --git a/target/linux/mpc85xx/base-files/lib/upgrade/platform.sh b/target/linux/mpc85xx/base-files/lib/upgrade/platform.sh
index 064eeb35bc9502..226b40a90623e8 100755
--- a/target/linux/mpc85xx/base-files/lib/upgrade/platform.sh
+++ b/target/linux/mpc85xx/base-files/lib/upgrade/platform.sh
@@ -14,7 +14,8 @@ platform_do_upgrade() {
 
 	case "$board" in
 	ocedo,panda|\
-	sophos,red-15w-rev1)
+	sophos,red-15w-rev1|\
+	watchguard,firebox-t10)
 		nand_do_upgrade "$1"
 		;;
 	*)
diff --git a/target/linux/mpc85xx/config-5.15 b/target/linux/mpc85xx/config-5.15
new file mode 100644
index 00000000000000..6f7db117d4ce89
--- /dev/null
+++ b/target/linux/mpc85xx/config-5.15
@@ -0,0 +1,269 @@
+# CONFIG_40x is not set
+# CONFIG_44x is not set
+# CONFIG_ADVANCED_OPTIONS is not set
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+CONFIG_ARCH_MIGHT_HAVE_PC_SERIO=y
+CONFIG_ARCH_MMAP_RND_BITS=11
+CONFIG_ARCH_MMAP_RND_BITS_MAX=17
+CONFIG_ARCH_MMAP_RND_BITS_MIN=11
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=17
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=11
+CONFIG_ARCH_STACKWALK=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARCH_WEAK_RELEASE_ACQUIRE=y
+CONFIG_ASN1=y
+CONFIG_AUDIT_ARCH=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BOOKE=y
+CONFIG_BOOKE_WDT=y
+# CONFIG_BR200_WP is not set
+# CONFIG_BSC9131_RDB is not set
+# CONFIG_BSC9132_QDS is not set
+# CONFIG_C293_PCIE is not set
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CLZ_TAB=y
+CONFIG_CMDLINE="console=ttyS0,115200"
+CONFIG_CMDLINE_FROM_BOOTLOADER=y
+# CONFIG_CMDLINE_OVERRIDE is not set
+# CONFIG_COMMON_CLK is not set
+CONFIG_COMPAT_32BIT_TIME=y
+# CONFIG_CORENET_GENERIC is not set
+# CONFIG_CPM2 is not set
+CONFIG_CPU_BIG_ENDIAN=y
+# CONFIG_CRYPTO_AES_PPC_SPE is not set
+CONFIG_CRYPTO_AUTHENC=y
+CONFIG_CRYPTO_HW=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=1
+# CONFIG_CRYPTO_MD5_PPC is not set
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_RSA=y
+# CONFIG_CRYPTO_SHA1_PPC is not set
+# CONFIG_CRYPTO_SHA1_PPC_SPE is not set
+# CONFIG_CRYPTO_SHA256_PPC_SPE is not set
+CONFIG_DATA_SHIFT=12
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DNOTIFY=y
+CONFIG_DTC=y
+CONFIG_E500=y
+CONFIG_E500_CPU=y
+CONFIG_EARLY_PRINTK=y
+CONFIG_EDAC=y
+CONFIG_EDAC_ATOMIC_SCRUB=y
+# CONFIG_EDAC_DEBUG is not set
+CONFIG_EDAC_LEGACY_SYSFS=y
+CONFIG_EDAC_MPC85XX=y
+CONFIG_EDAC_SUPPORT=y
+# CONFIG_FIREBOX_T10 is not set
+CONFIG_FIXED_PHY=y
+CONFIG_FSL_BOOKE=y
+# CONFIG_FSL_DPAA2_SWITCH is not set
+CONFIG_FSL_EMB_PERFMON=y
+# CONFIG_FSL_FMAN is not set
+CONFIG_FSL_LBC=y
+CONFIG_FSL_PCI=y
+CONFIG_FSL_PQ_MDIO=y
+CONFIG_FSL_SOC=y
+CONFIG_FSL_SOC_BOOKE=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_ISA_DMA=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GEN_RTC=y
+# CONFIG_GE_IMP3A is not set
+CONFIG_GIANFAR=y
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_MPC8XXX=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+# CONFIG_HIVEAP_330 is not set
+CONFIG_HW_RANDOM=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_I2C=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_MPC=y
+CONFIG_ILLEGAL_POINTER_VALUE=0
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+CONFIG_ISA_DMA_API=y
+CONFIG_KERNEL_START=0xc0000000
+# CONFIG_KSI8560 is not set
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOWMEM_CAM_NUM=3
+CONFIG_LOWMEM_SIZE=0x30000000
+CONFIG_LXT_PHY=y
+# CONFIG_MATH_EMULATION is not set
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MIGRATION=y
+CONFIG_MMU_GATHER_PAGE_SIZE=y
+CONFIG_MODULES_USE_ELF_RELA=y
+# CONFIG_MPC8536_DS is not set
+# CONFIG_MPC8540_ADS is not set
+# CONFIG_MPC8560_ADS is not set
+# CONFIG_MPC85xx_CDS is not set
+# CONFIG_MPC85xx_DS is not set
+# CONFIG_MPC85xx_MDS is not set
+# CONFIG_MPC85xx_RDB is not set
+CONFIG_MPIC=y
+# CONFIG_MPIC_MSGR is not set
+CONFIG_MPIC_TIMER=y
+CONFIG_MPILIB=y
+# CONFIG_MTD_CFI is not set
+CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_NAND_ECC_SW_HAMMING=y
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_SPI_NOR=y
+# CONFIG_MVME2500 is not set
+CONFIG_NEED_PER_CPU_KM=y
+CONFIG_NEED_SG_DMA_LENGTH=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NLS=y
+CONFIG_NR_CPUS=1
+CONFIG_NR_IRQS=512
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_DMA_DEFAULT_COHERENT=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_OLD_SIGACTION=y
+CONFIG_OLD_SIGSUSPEND=y
+# CONFIG_P1010_RDB is not set
+# CONFIG_P1022_DS is not set
+# CONFIG_P1022_RDK is not set
+# CONFIG_P1023_RDB is not set
+CONFIG_PAGE_OFFSET=0xc0000000
+# CONFIG_PANDA is not set
+CONFIG_PCI=y
+CONFIG_PCIEAER=y
+CONFIG_PCIEASPM=y
+CONFIG_PCIEASPM_DEFAULT=y
+# CONFIG_PCIEASPM_PERFORMANCE is not set
+# CONFIG_PCIEASPM_POWERSAVE is not set
+# CONFIG_PCIEASPM_POWER_SUPERSAVE is not set
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYSICAL_ALIGN=0x04000000
+CONFIG_PHYSICAL_START=0x00000000
+# CONFIG_PHYS_64BIT is not set
+# CONFIG_PMU_SYSFS is not set
+# CONFIG_PPA8548 is not set
+CONFIG_PPC=y
+CONFIG_PPC32=y
+# CONFIG_PPC64 is not set
+CONFIG_PPC_85xx=y
+# CONFIG_PPC_8xx is not set
+CONFIG_PPC_ADV_DEBUG_DACS=2
+CONFIG_PPC_ADV_DEBUG_DVCS=0
+CONFIG_PPC_ADV_DEBUG_IACS=2
+CONFIG_PPC_ADV_DEBUG_REGS=y
+CONFIG_PPC_BARRIER_NOSPEC=y
+CONFIG_PPC_BOOK3E_MMU=y
+# CONFIG_PPC_BOOK3S_32 is not set
+CONFIG_PPC_DOORBELL=y
+# CONFIG_PPC_E500MC is not set
+# CONFIG_PPC_EARLY_DEBUG is not set
+CONFIG_PPC_FSL_BOOK3E=y
+CONFIG_PPC_INDIRECT_PCI=y
+CONFIG_PPC_MMU_NOHASH=y
+CONFIG_PPC_PAGE_SHIFT=12
+# CONFIG_PPC_QEMU_E500 is not set
+CONFIG_PPC_SMP_MUXED_IPI=y
+CONFIG_PPC_UDBG_16550=y
+CONFIG_PPC_WERROR=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QE_GPIO=y
+CONFIG_QUICC_ENGINE=y
+CONFIG_RAS=y
+# CONFIG_RED_15W_REV1 is not set
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_GENERIC=y
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RTC_MC146818_LIB=y
+# CONFIG_SCOM_DEBUGFS is not set
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_FSL=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_OF_PLATFORM=y
+# CONFIG_SERIAL_QE is not set
+# CONFIG_SOCRATES is not set
+CONFIG_SPARSE_IRQ=y
+CONFIG_SPE=y
+CONFIG_SPE_POSSIBLE=y
+CONFIG_SPI=y
+CONFIG_SPI_FSL_ESPI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRCU=y
+# CONFIG_STRIP_ASM_SYMS is not set
+# CONFIG_STX_GP3 is not set
+CONFIG_SWPHY=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_TARGET_CPU="8540"
+CONFIG_TARGET_CPU_BOOL=y
+CONFIG_TASK_SIZE=0xc0000000
+CONFIG_THREAD_INFO_IN_TASK=y
+CONFIG_THREAD_SHIFT=13
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TINY_SRCU=y
+# CONFIG_TL_WDR4900_V1 is not set
+# CONFIG_TOOLCHAIN_DEFAULT_CPU is not set
+# CONFIG_TQM8540 is not set
+# CONFIG_TQM8541 is not set
+# CONFIG_TQM8548 is not set
+# CONFIG_TQM8555 is not set
+# CONFIG_TQM8560 is not set
+# CONFIG_TWR_P102x is not set
+CONFIG_UCC=y
+CONFIG_UCC_FAST=y
+CONFIG_UCC_GETH=y
+# CONFIG_UGETH_TX_ON_DEMAND is not set
+CONFIG_USB_SUPPORT=y
+CONFIG_VDSO32=y
+# CONFIG_VIRT_CPU_ACCOUNTING_NATIVE is not set
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_WATCHDOG_CORE=y
+# CONFIG_WS_AP3710I is not set
+# CONFIG_WS_AP3715I is not set
+# CONFIG_WS_AP3825I is not set
+# CONFIG_XES_MPC85xx is not set
+CONFIG_XZ_DEC_BCJ=y
+CONFIG_XZ_DEC_POWERPC=y
diff --git a/target/linux/mpc85xx/files/arch/powerpc/boot/dts/br200-wp.dts b/target/linux/mpc85xx/files/arch/powerpc/boot/dts/br200-wp.dts
new file mode 100644
index 00000000000000..a4bc10ff3882da
--- /dev/null
+++ b/target/linux/mpc85xx/files/arch/powerpc/boot/dts/br200-wp.dts
@@ -0,0 +1,373 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Aerohive BR200-WP Device Tree Source
+ *
+ * Based on: Aerohive HiveAP-330 Device Tree Source
+ *
+ * Copyright (C) 2017 Chris Blake <chrisrblake93@gmail.com>
+ * Copyright (C) 2023 Pawel Dembicki <paweldembicki@gmail.com>
+ */
+
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+
+/include/ "fsl/p1020si-pre.dtsi"
+
+/ {
+	model = "Aerohive BR200-WP";
+	compatible = "aerohive,br200-wp";
+
+	chosen {
+		bootargs = "console=ttyS0,9600";
+		bootargs-override = "console=ttyS0,9600 noinitrd";
+	};
+
+	aliases {
+		led-boot = &led_attention;
+		led-failsafe = &led_attention;
+		led-running = &led_status;
+		led-upgrade = &led_status;
+		label-mac-device = &enet0;
+	};
+
+	memory {
+		device_type = "memory";
+	};
+
+	cpus {
+		/delete-property/ PowerPC,P1020@1; /* P1011 have one core only */
+	};
+
+	board_lbc: lbc: localbus@ffe05000 {
+		reg = <0 0xffe05000 0 0x1000>;
+		ranges = <0x0 0x0 0x0 0xec000000 0x4000000>;
+
+		nor@0,0 {
+			#address-cells = <1>;
+			#size-cells = <1>;
+			compatible = "cfi-flash";
+			reg = <0x0 0x0 0x4000000>;
+			bank-width = <2>;
+			device-width = <1>;
+
+			partitions {
+				compatible = "fixed-partitions";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				partition@0 {
+					reg = <0x0 0x40000>;
+					label = "dtb";
+				};
+
+				partition@40000 {
+					reg = <0x40000 0x40000>;
+					label = "initramfs";
+				};
+
+				partition@80000 {
+					reg = <0x80000 0x27c0000>;
+					label = "rootfs";
+				};
+
+				partition@2840000 {
+					reg = <0x2840000 0x800000>;
+					label = "kernel";
+				};
+
+				partition@3040000 {
+					reg = <0x3040000 0xec0000>;
+					label = "stock-jffs2";
+					read-only;
+				};
+
+				partition@3f00000 {
+					reg = <0x3f00000 0x20000>;
+					label = "hw-info";
+					read-only;
+
+					compatible = "nvmem-cells";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_hwinfo_0: macaddr@0 {
+						reg = <0x0 0x6>;
+					};
+				};
+
+				partition@3f20000 {
+					reg = <0x3f20000 0x20000>;
+					label = "boot-info";
+					read-only;
+				};
+
+				partition@3f40000 {
+					reg = <0x3f40000 0x20000>;
+					label = "boot-info-backup";
+					read-only;
+				};
+
+				partition@3f60000 {
+					reg = <0x3f60000 0x20000>;
+					label = "u-boot-env";
+				};
+
+				partition@3f80000 {
+					reg = <0x3f80000 0x80000>;
+					label = "u-boot";
+					read-only;
+				};
+
+				firmware@0 {
+					reg = <0x0 0x3040000>;
+					label = "firmware";
+				};
+			};
+		};
+	};
+
+	board_soc: soc: soc@ffe00000 {
+		ranges = <0x0 0x0 0xffe00000 0x100000>;
+
+		mdio@24000 {
+
+			phy_port1: phy@0 {
+				reg = <0>;
+			};
+
+			phy_port2: phy@1 {
+				reg = <1>;
+			};
+
+			phy_port3: phy@2 {
+				reg = <2>;
+			};
+
+			phy_port4: phy@3 {
+				reg = <3>;
+			};
+
+			phy_port5: phy@4 {
+				reg = <4>;
+			};
+
+			switch@10 {
+				compatible = "qca,qca8327";
+				#address-cells = <1>;
+				#size-cells = <0>;
+				reg = <0x10>;
+				reset-gpios = <&gpio0 6 GPIO_ACTIVE_LOW>;
+
+				ports {
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					port@1 {
+						reg = <1>;
+						label = "lan1";
+						phy-handle = <&phy_port1>;
+						nvmem-cells = <&macaddr_hwinfo_0>;
+						nvmem-cell-names = "mac-address";
+						mac-address-increment = <2>;
+					};
+
+					port@2 {
+						reg = <2>;
+						label = "lan2";
+						phy-handle = <&phy_port2>;
+						nvmem-cells = <&macaddr_hwinfo_0>;
+						nvmem-cell-names = "mac-address";
+						mac-address-increment = <3>;
+					};
+
+					port@3 {
+						reg = <3>;
+						label = "lan3";
+						phy-handle = <&phy_port3>;
+						nvmem-cells = <&macaddr_hwinfo_0>;
+						nvmem-cell-names = "mac-address";
+						mac-address-increment = <4>;
+					};
+
+					port@4 {
+						reg = <4>;
+						label = "lan4";
+						phy-handle = <&phy_port4>;
+						nvmem-cells = <&macaddr_hwinfo_0>;
+						nvmem-cell-names = "mac-address";
+						mac-address-increment = <5>;
+					};
+
+					port@5 {
+						reg = <5>;
+						label = "wan";
+						phy-handle = <&phy_port5>;
+						nvmem-cells = <&macaddr_hwinfo_0>;
+						nvmem-cell-names = "mac-address";
+					};
+
+					port@6 {
+						reg = <6>;
+						ethernet = <&enet0>;
+						phy-mode = "rgmii-id";
+
+						fixed-link {
+							speed = <1000>;
+							full-duplex;
+						};
+					};
+				};
+			};
+		};
+
+		mdio@25000 {
+			status = "disabled";
+		};
+
+		mdio@26000 {
+			status = "disabled";
+		};
+
+		enet0: ethernet@b0000 {
+			status = "okay";
+			phy-connection-type = "rgmii-id";
+			nvmem-cells = <&macaddr_hwinfo_0>;
+			nvmem-cell-names = "mac-address";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+
+		enet1: ethernet@b1000 {
+			status = "disabled";
+		};
+
+		enet2: ethernet@b2000 {
+			status = "disabled";
+		};
+
+		gpio0: gpio-controller@fc00 {
+		};
+
+		usb@22000 {
+			phy_type = "ulpi";
+			dr_mode = "host";
+		};
+
+		usb@23000 {
+			status = "disabled";
+		};
+	};
+
+	pci0: pcie@ffe09000 {
+		status = "disabled";
+	};
+
+	pci1: pcie@ffe0a000 {
+		reg = <0x0 0xffe0a000 0x0 0x1000>;
+		ranges = <0x2000000 0x0 0xc0000000 0x0 0xc0000000 0x0 0x20000000
+				  0x1000000 0x0 0x00000000 0x0 0xffc20000 0x0 0x10000>;
+
+		reset-gpios = <&gpio0 15 GPIO_ACTIVE_LOW>;
+
+		pcie@0 {
+			ranges = <0x2000000 0x0 0xc0000000
+				  0x2000000 0x0 0xc0000000
+				  0x0 0x20000000
+
+				  0x1000000 0x0 0x0
+				  0x1000000 0x0 0x0
+				  0x0 0x100000>;
+
+			ath9k: wifi@0,0 {
+				reg = <0x0000 0 0 0 0>;
+				#gpio-cells = <2>;
+				gpio-controller;
+				nvmem-cells = <&macaddr_hwinfo_0>;
+				nvmem-cell-names = "mac-address";
+				mac-address-increment = <16>;
+			};
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_attention: led-0 {
+			gpios = <&gpio0 11 GPIO_ACTIVE_LOW>;
+			label = "amber:status";
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_STATUS;
+		};
+
+		led_status: led-1 {
+			gpios = <&gpio0 12 GPIO_ACTIVE_LOW>;
+			label = "white:status";
+			color = <LED_COLOR_ID_WHITE>;
+			function = LED_FUNCTION_STATUS;
+		};
+	};
+
+	buttons {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "Reset button";
+			gpios = <&gpio0 8 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+};
+
+/include/ "fsl/p1020si-post.dtsi"
+
+/ {
+	chosen {
+		linux,stdout-path = "/soc@ffe00000/serial@4500";
+	};
+
+	cpus {
+		PowerPC,P1020@0 {
+			i-cache-sets = <0x80>;
+			i-cache-size = <0x8000>;
+			i-cache-block-size = <0x20>;
+			d-cache-sets = <0x80>;
+			d-cache-size = <0x8000>;
+			d-cache-block-size = <0x20>;
+			clock-frequency = <0x2756cd00>;
+			bus-frequency = <0x13ab6680>;
+			timebase-frequency = <0x2756cd0>;
+		};
+	};
+
+	memory {
+		reg = <0x00 0x00 0x00 0x10000000>;
+	};
+
+	localbus@ffe05000 {
+		bus-frequency = <0x13ab668>;
+	};
+
+	soc@ffe00000 {
+		bus-frequency = <0x13ab6680>;
+
+		serial@4500 {
+			clock-frequency = <0x13ab6680>;
+		};
+
+		serial@4600 {
+			clock-frequency = <0x13ab6680>;
+		};
+	};
+
+	pcie@ffe09000 {
+		clock-frequency = <0x1fca055>;
+	};
+
+	pcie@ffe0a000 {
+		clock-frequency = <0x1fca055>;
+	};
+};
diff --git a/target/linux/mpc85xx/files/arch/powerpc/boot/dts/firebox-t10.dts b/target/linux/mpc85xx/files/arch/powerpc/boot/dts/firebox-t10.dts
new file mode 100644
index 00000000000000..607706a2d434c2
--- /dev/null
+++ b/target/linux/mpc85xx/files/arch/powerpc/boot/dts/firebox-t10.dts
@@ -0,0 +1,268 @@
+// SPDX-License-Identifier: GPL-2.0-or-later or MIT
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+
+/include/ "fsl/p1010si-pre.dtsi"
+
+/ {
+	model = "Watchguard Firebox T10";
+	compatible = "watchguard,firebox-t10";
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+		bootargs-override = "console=ttyS0,115200";
+	};
+
+	aliases {
+		spi0 = &spi0;
+		led-boot = &led_mode;
+		led-failsafe = &led_failover;
+		led-running = &led_mode;
+		led-upgrade = &led_attention;
+	};
+
+	memory {
+		device_type = "memory";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_attention: attention_orange {
+			gpios = <&gpio0 2 GPIO_ACTIVE_LOW>;
+			label = "orange:attention";
+		};
+
+		status_red {
+			gpios = <&gpio0 3 GPIO_ACTIVE_LOW>;
+			label = "red:status";
+		};
+
+		led_mode: mode_green {
+			gpios = <&gpio0 4 GPIO_ACTIVE_LOW>;
+			label = "green:mode";
+		};
+
+		led_failover: failover_green {
+			gpios = <&gpio0 5 GPIO_ACTIVE_LOW>;
+			label = "green:failover";
+		};
+	};
+
+	buttons {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "Reset button";
+			gpios = <&gpio0 10 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+
+	soc: soc@ffe00000 {
+		ranges = <0x0 0x0 0xffe00000 0x100000>;
+
+		i2c@3000 {
+			rtc@30 {
+				compatible = "sii,s35390a";
+				reg = <0x30>;
+			};
+		};
+
+		spi0: spi@7000 {
+			flash@0 {
+				compatible = "jedec,spi-nor";
+				reg = <0>;
+				spi-max-frequency = <25000000>;
+
+				partitions {
+					compatible = "fixed-partitions";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					uboot: partition@0 {
+						reg = <0x0 0x90000>;
+						label = "u-boot";
+						read-only;
+					};
+
+					partition@90000 {
+						reg = <0x90000 0x10000>;
+						label = "u-boot-env";
+					};
+
+					partition@a0000 {
+						reg = <0xa0000 0x20000>;
+						label = "cfgxxx";
+						read-only;
+					};
+
+					partition@c0000 {
+						reg = <0xc0000 0x40000>;
+						label = "device_id";
+						read-only;
+					};
+				};
+			};
+		};
+
+		gpio0: gpio-controller@fc00 {
+		};
+
+		usb@22000 {
+			phy_type = "utmi";
+			dr_mode = "host";
+		};
+
+		mdio@24000 {
+			phy1: ethernet-phy@1 {
+				reg = <0x1>;
+			};
+
+			phy2: ethernet-phy@2 {
+				reg = <0x2>;
+			};
+
+			phy3: ethernet-phy@3 {
+				reg = <0x3>;
+			};
+		};
+
+		mdio@25000 {
+			tbi_phy1: tbi-phy@11 {
+				reg = <0x11>;
+				device_type = "tbi-phy";
+			};
+		};
+
+		mdio@26000 {
+			tbi_phy2: tbi-phy@11 {
+				reg = <0x11>;
+				device_type = "tbi-phy";
+			};
+		};
+
+		enet0: ethernet@b0000 {
+			phy-handle = <&phy1>;
+			phy-connection-type = "rgmii-id";
+		};
+
+		enet1: ethernet@b1000 {
+			tbi-handle = <&tbi_phy1>;
+			phy-handle = <&phy2>;
+			phy-connection-type = "sgmii";
+		};
+
+		enet2: ethernet@b2000 {
+			tbi-handle = <&tbi_phy2>;
+			phy-handle = <&phy3>;
+			phy-connection-type = "sgmii";
+		};
+
+		sdhc@2e000 {
+			status = "disabled";
+		};
+
+		serial1: serial@4600 {
+			status = "disabled";
+		};
+
+		can0: can@1c000 {
+			status = "disabled";
+		};
+
+		can1: can@1d000 {
+			status = "disabled";
+		};
+	};
+
+	pci0: pcie@ffe09000 {
+		status = "disabled";
+	};
+
+	pci1: pcie@ffe0a000 {
+		status = "disabled";
+	};
+
+	ifc: ifc@ffe1e000 {
+		reg = <0x0 0xffe1e000 0 0x2000>;
+
+		/* NOR, NAND Flashes and CPLD on board */
+		ranges = <0x0 0x0 0x0 0xee000000 0x02000000
+			0x1 0x0 0x0 0xff800000 0x00010000
+			0x3 0x0 0x0 0xffb00000 0x00000020>;
+
+		nand@1,0 {
+			compatible = "fsl,ifc-nand";
+			reg = <0x1 0x0 0x10000>;
+
+			partitions {
+				compatible = "fixed-partitions";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				/*
+				 * Original partition layout:
+				 * 0x000000000000-0x000000020000 : "NAND (RW) WG DTB Image"
+				 * 0x000000020000-0x000000520000 : "NAND (RW) WG SYSA Kernel"
+				 * 0x000000520000-0x000007f00000 : "NAND (RW) WG SYSA_CODE"
+				 * 0x000007f00000-0x000008400000 : "NAND (RW) WG SYSB Kernel"
+				 * 0x000008400000-0x000009c00000 : "NAND (RW) WG SYSB_CODE"
+				 * 0x000009c00000-0x00000a100000 : "NAND (RW) WG SYSA2 Kernel"
+				 * 0x00000a100000-0x000011ae0000 : "NAND (RW) WG SYSA_CODE2"
+				 * 0x000011ae0000-0x000020000000 : "NAND (RW) WG SYSA_DATA"
+				 */
+
+				partition@0 {
+					reg = <0x0 0x20000>;
+					label = "wg-dtb";
+					read-only;
+				};
+
+				partition@20000 {
+					reg = <0x20000 0x500000>;
+					label = "kernel";
+				};
+
+				partition@520000 {
+					reg = <0x520000 0x79e0000>;
+					label = "wg-sysa-rootfs";
+					read-only;
+				};
+
+				partition@7f00000 {
+					reg = <0x7f00000 0x500000>;
+					label = "wg-sysb-kernel";
+					read-only;
+				};
+
+				partition@8400000 {
+					reg = <0x8400000 0x1800000>;
+					label = "wg-sysb-rootfs";
+					read-only;
+				};
+
+				partition@9c00000 {
+					reg = <0x9c00000 0x500000>;
+					label = "wg-sysa2-kernel";
+					read-only;
+				};
+
+				partition@a100000 {
+					reg = <0xa100000 0x79e0000>;
+					label = "wg-sysa2-rootfs";
+					read-only;
+				};
+
+				partition@11ae0000 {
+					reg = <0x11ae0000 0xe520000>;
+					label = "ubi";
+				};
+			};
+		};
+	};
+};
+
+/include/ "fsl/p1010si-post.dtsi"
diff --git a/target/linux/mpc85xx/files/arch/powerpc/boot/dts/hiveap-330.dts b/target/linux/mpc85xx/files/arch/powerpc/boot/dts/hiveap-330.dts
index d6a8da84ef66d1..a807403a07a43f 100644
--- a/target/linux/mpc85xx/files/arch/powerpc/boot/dts/hiveap-330.dts
+++ b/target/linux/mpc85xx/files/arch/powerpc/boot/dts/hiveap-330.dts
@@ -207,12 +207,12 @@
 
 		mdio@24000 {
 			phy0: ethernet-phy@0 {
-				interrupts = <3 1 0 0>;
+				/* interrupts = <3 1 0 0>; */
 				reg = <0x1>;
 			};
 
 			phy1: ethernet-phy@1 {
-				interrupts = <2 1 0 0>;
+				/* interrupts = <2 1 0 0>; */
 				reg = <0x2>;
 			};
 		};
diff --git a/target/linux/mpc85xx/files/arch/powerpc/boot/dts/tl-wdr4900-v1.dts b/target/linux/mpc85xx/files/arch/powerpc/boot/dts/tl-wdr4900-v1.dts
index 12281808aa5b60..c54cb53f9452ea 100644
--- a/target/linux/mpc85xx/files/arch/powerpc/boot/dts/tl-wdr4900-v1.dts
+++ b/target/linux/mpc85xx/files/arch/powerpc/boot/dts/tl-wdr4900-v1.dts
@@ -102,20 +102,78 @@
 		};
 
 		mdio@24000 {
-			phy0: ethernet-phy@0 {
-				reg = <0x0>;
-				qca,ar8327-initvals = <
-					0x00004 0x07600000 /* PAD0_MODE */
-					0x00008 0x00000000 /* PAD5_MODE */
-					0x0000c 0x01000000 /* PAD6_MODE */
-					0x00010 0x40000000 /* POWER_ON_STRAP */
-					0x00050 0xcf35cf35 /* LED_CTRL0 */
-					0x00054 0xcf35cf35 /* LED_CTRL1 */
-					0x00058 0xcf35cf35 /* LED_CTRL2 */
-					0x0005c 0x03ffff00 /* LED_CTRL3 */
-					0x0007c 0x0000007e /* PORT0_STATUS */
-					0x00094 0x00000200 /* PORT6_STATUS */
-				>;
+
+			phy_port1: phy@0 {
+				reg = <0>;
+			};
+
+			phy_port2: phy@1 {
+				reg = <1>;
+			};
+
+			phy_port3: phy@2 {
+				reg = <2>;
+			};
+
+			phy_port4: phy@3 {
+				reg = <3>;
+			};
+
+			phy_port5: phy@4 {
+				reg = <4>;
+			};
+
+			switch@0 {
+				compatible = "qca,qca8327";
+				#address-cells = <1>;
+				#size-cells = <0>;
+				reg = <0x10>;
+
+				ports {
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					port@0 {
+						reg = <0>;
+						ethernet = <&enet0>;
+						phy-mode = "rgmii-id";
+
+						fixed-link {
+							speed = <1000>;
+							full-duplex;
+						};
+					};
+
+					port@1 {
+						reg = <1>;
+						label = "wan";
+						phy-handle = <&phy_port1>;
+					};
+
+					port@2 {
+						reg = <2>;
+						label = "lan1";
+						phy-handle = <&phy_port2>;
+					};
+
+					port@3 {
+						reg = <3>;
+						label = "lan2";
+						phy-handle = <&phy_port3>;
+					};
+
+					port@4 {
+						reg = <4>;
+						label = "lan3";
+						phy-handle = <&phy_port4>;
+					};
+
+					port@5 {
+						reg = <5>;
+						label = "lan4";
+						phy-handle = <&phy_port5>;
+					};
+				};
 			};
 		};
 
@@ -128,10 +186,14 @@
 		};
 
 		enet0: ethernet@b0000 {
-			phy-handle = <&phy0>;
 			phy-connection-type = "rgmii-id";
 			nvmem-cells = <&macaddr_uboot_4fc00>;
 			nvmem-cell-names = "mac-address";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
 		};
 
 		enet1: ethernet@b1000 {
diff --git a/target/linux/mpc85xx/files/arch/powerpc/boot/dts/ws-ap3715i.dts b/target/linux/mpc85xx/files/arch/powerpc/boot/dts/ws-ap3715i.dts
new file mode 100644
index 00000000000000..d13952acae8565
--- /dev/null
+++ b/target/linux/mpc85xx/files/arch/powerpc/boot/dts/ws-ap3715i.dts
@@ -0,0 +1,293 @@
+// SPDX-License-Identifier: GPL-2.0-or-later or MIT
+
+#include <dt-bindings/gpio/gpio.h>
+
+/include/ "fsl/p1010si-pre.dtsi"
+
+/ {
+	model = "Enterasys WS-AP3715i";
+	compatible = "enterasys,ws-ap3715i";
+
+	aliases {
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_red;
+		label-mac-device = &enet0;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	memory {
+		device_type = "memory";
+		reg = <0x0 0x0 0x0 0x10000000>;
+	};
+	
+	leds {
+		compatible = "gpio-leds";
+
+		wifi1 {
+			gpios = <&spi_gpio 3 GPIO_ACTIVE_HIGH>;
+			label = "green:radio1";
+			linux,default-trigger = "phy1tpt";
+		};
+
+		wifi2 {
+			gpios = <&spi_gpio 2 GPIO_ACTIVE_HIGH>;
+			label = "green:radio2";
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led_power_green: power_green {
+			gpios = <&spi_gpio 0 GPIO_ACTIVE_HIGH>;
+			label = "green:power";
+		};
+
+		led_power_red: power_red {
+			gpios = <&spi_gpio 1 GPIO_ACTIVE_HIGH>;
+			label = "red:power";
+		};
+
+		lan1_red {
+			gpios = <&spi_gpio 6 GPIO_ACTIVE_HIGH>;
+			label = "red:lan1";
+		};
+
+		lan1_green {
+			gpios = <&spi_gpio 4 GPIO_ACTIVE_HIGH>;
+			label = "green:lan1";
+		};
+
+		lan2_red {
+			gpios = <&spi_gpio 7 GPIO_ACTIVE_HIGH>;
+			label = "red:lan2";
+		};
+
+		lan2_green {
+			gpios = <&spi_gpio 5 GPIO_ACTIVE_HIGH>;
+			label = "green:lan2";
+		};
+	};
+
+	soc: soc@ffe00000 {
+		ranges = <0x0 0x0 0xffe00000 0x100000>;
+
+		gpio0: gpio-controller@fc00 {
+		};
+
+		usb@22000 {
+			status = "disabled";
+		};
+
+		mdio@24000 {
+			phy0: ethernet-phy@0 {
+				reg = <0x1>;
+			};
+
+			phy2: ethernet-phy@2 {
+				reg = <0x2>;
+			};
+		};
+
+		mdio@25000 {
+			tbi_phy: tbi-phy@11 {
+				reg = <0x11>;
+			};
+		};
+
+		mdio@26000 {
+			status = "disabled";
+		};
+
+		enet0: ethernet@b0000 {
+			phy-handle = <&phy0>;
+			phy-connection-type = "rgmii-id";
+
+			label = "lan1";
+		};
+
+		enet1: ethernet@b1000 {
+			phy-handle = <&phy2>;
+			phy-connection-type = "sgmii";
+
+			tbi-handle = <&tbi_phy>;
+
+			label = "lan2";
+		};
+
+		enet2: ethernet@b2000 {
+			status = "disabled";
+		};
+
+		sdhc@2e000 {
+			status = "disabled";
+		};
+	};
+
+	ifc: ifc@ffe1e000 {
+	};
+
+	pci0: pcie@ffe09000 {
+		reg = <0 0xffe09000 0 0x1000>;
+		ranges = <0x2000000 0x0 0xa0000000 0 0xa0000000 0x0 0x20000000
+			  0x1000000 0x0 0x00000000 0 0xffc10000 0x0 0x10000>;
+		pcie@0 {
+			ranges = <0x2000000 0x0 0xa0000000
+				  0x2000000 0x0 0xa0000000
+				  0x0 0x20000000
+
+				  0x1000000 0x0 0x0
+				  0x1000000 0x0 0x0
+				  0x0 0x100000>;
+
+			wifi@0,0,0 {
+				compatible = "pci168c,0033";
+				reg = <0x0 0 0 0 0>;
+				ieee80211-freq-limit = <2400000 2500000>;
+			};
+		};
+	};
+
+	pci1: pcie@ffe0a000 {
+		reg = <0 0xffe0a000 0 0x1000>;
+		ranges = <0x2000000 0x0 0x80000000 0 0x80000000 0x0 0x20000000
+			  0x1000000 0x0 0x00000000 0 0xffc00000 0x0 0x10000>;
+		pcie@0 {
+			ranges = <0x2000000 0x0 0x80000000
+				  0x2000000 0x0 0x80000000
+				  0x0 0x20000000
+
+				  0x1000000 0x0 0x0
+				  0x1000000 0x0 0x0
+				  0x0 0x100000>;
+			
+			wifi@0,0,0 {
+				compatible = "pci168c,0033";
+				reg = <0x0 0 0 0 0>;
+				ieee80211-freq-limit = <5000000 6000000>;
+			};
+		};
+	};
+};
+
+&soc {
+	led_spi {
+		compatible = "spi-gpio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		sck-gpios = <&gpio0 10 GPIO_ACTIVE_HIGH>;
+		mosi-gpios = <&gpio0 11 GPIO_ACTIVE_HIGH>;
+		num-chipselects = <0>;
+
+		spi_gpio: led_gpio@0 {
+			compatible = "fairchild,74hc595";
+			reg = <0>;
+			gpio-controller;
+			#gpio-cells = <2>;
+			registers-number = <1>;
+			spi-max-frequency = <100000>;
+		};
+	};
+
+	spi0: spi@7000 {
+		flash@0 {
+			compatible = "jedec,spi-nor";
+			reg = <0>;
+			spi-max-frequency = <25000000>;
+
+			partitions {
+				compatible = "fixed-partitions";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				partition@0 {
+					reg = <0x0 0xa0000>;
+					label = "boot-bak";
+					read-only;
+				};
+
+				partition@a0000 {
+					reg = <0xa0000 0xa0000>;
+					label = "boot-pri";
+					read-only;
+				};
+
+				partition@120000 {
+					reg = <0x120000 0x10000>;
+					label = "cfg1";
+					read-only;
+				};
+
+				partition@130000 {
+					reg = <0x130000 0x10000>;
+					label = "cfg2";
+					read-only;
+				};
+
+				partition@140000 {
+					compatible = "denx,uimage";
+					reg = <0x140000 0x1d80000>;
+					label = "firmware";
+				};
+
+				partition@1ec0000 {
+					reg = <0x1ec0000 0x100000>;
+					label = "nvram";
+					read-only;
+				};
+			};
+		};
+	};
+};
+
+/include/ "fsl/p1010si-post.dtsi"
+
+/ {
+	cpus {
+		PowerPC,P1010@0 {
+			bus-frequency = <399999996>;
+			timebase-frequency = <50000000>;
+			clock-frequency = <799999992>;
+			d-cache-block-size = <0x20>;
+			d-cache-size = <0x8000>;
+			d-cache-sets = <0x80>;
+			i-cache-block-size = <0x20>;
+			i-cache-size = <0x8000>;
+			i-cache-sets = <0x80>;
+		};
+	};
+
+	soc@ffe00000 {
+		bus-frequency = <399999996>;
+
+		serial@4600 {
+			clock-frequency = <399999996>;
+			status = "disabled";
+		};
+
+		serial@4500 {
+			clock-frequency = <399999996>;
+		};
+
+		pic@40000 {
+			clock-frequency = <399999996>;
+		};
+	};
+};
+
+/*
+ * For the OpenWrt 22.03 release, since Linux 5.10.138 now uses
+ * aliases to determine PCI domain numbers, drop aliases so as not to
+ * change the sysfs path of our wireless netdevs.
+ */
+
+/ {
+	aliases {
+		/delete-property/ pci0;
+		/delete-property/ pci1;
+	};
+};
+
diff --git a/target/linux/mpc85xx/files/arch/powerpc/boot/dts/ws-ap3825i.dts b/target/linux/mpc85xx/files/arch/powerpc/boot/dts/ws-ap3825i.dts
index c4bce497cc47bd..a347900e5dfe3e 100644
--- a/target/linux/mpc85xx/files/arch/powerpc/boot/dts/ws-ap3825i.dts
+++ b/target/linux/mpc85xx/files/arch/powerpc/boot/dts/ws-ap3825i.dts
@@ -20,6 +20,7 @@
 
 	chosen {
 		bootargs-override = "console=ttyS0,115200";
+		linux,stdout-path = &serial0;
 	};
 
 	memory {
@@ -144,7 +145,7 @@
 
 		mdio@24000 {
 			phy0: ethernet-phy@0 {
-				interrupts = <3 1 0 0>;
+				/* interrupts = <3 1 0 0>; */
 				reg = <0x5>;
 				reset-gpios = <&gpio0 6 GPIO_ACTIVE_LOW>;
 				reset-assert-us = <10000>;
@@ -152,7 +153,7 @@
 			};
 
 			phy2: ethernet-phy@2 {
-				interrupts = <1 1 0 0>;
+				/* interrupts = <1 1 0 0>; */
 				reg = <0x6>;
 				reset-gpios = <&gpio0 7 GPIO_ACTIVE_LOW>;
 				reset-assert-us = <10000>;
@@ -198,6 +199,13 @@
 		ranges = <0x2000000 0x0 0xa0000000 0 0xa0000000 0x0 0x20000000
 			  0x1000000 0x0 0x00000000 0 0xffc10000 0x0 0x10000>;
 		reg = <0 0xffe09000 0 0x1000>;
+
+		/* Filled by U-Boot */
+		bus-range = <0x00 0x01>;
+		dma-ranges = <0x2000000 0x00 0xfff00000 0x00 0xffe00000
+			      0x00 0x100000 0x42000000 0x00 0x00 0x00
+			      0x00 0x00 0x10000000>;
+
 		pcie@0 {
 			ranges = <0x2000000 0x0 0xa0000000
 				  0x2000000 0x0 0xa0000000
@@ -213,6 +221,13 @@
 		reg = <0 0xffe0a000 0 0x1000>;
 		ranges = <0x2000000 0x0 0x80000000 0 0x80000000 0x0 0x20000000
 			  0x1000000 0x0 0x00000000 0 0xffc00000 0x0 0x10000>;
+
+		/* Filled by U-Boot */
+		bus-range = <0x00 0x01>;
+		dma-ranges = <0x2000000 0x00 0xfff00000 0x00
+			      0xffe00000 0x00 0x100000 0x42000000
+			      0x00 0x00 0x00 0x00 0x00 0x10000000>;
+
 		pcie@0 {
 			ranges = <0x2000000 0x0 0x80000000
 				  0x2000000 0x0 0x80000000
@@ -252,6 +267,77 @@
 
 /include/ "fsl/p1020si-post.dtsi"
 
+/ {
+	cpus {
+		PowerPC,P1020@0 {
+			bus-frequency = <399999996>;
+			timebase-frequency = <50000000>;
+			clock-frequency = <799999992>;
+			d-cache-block-size = <0x20>;
+			d-cache-size = <0x8000>;
+			d-cache-sets = <0x80>;
+			i-cache-block-size = <0x20>;
+			i-cache-size = <0x8000>;
+			i-cache-sets = <0x80>;
+			cpu-release-addr = <0x0 0x0ffff280>;
+			status = "okay";
+			enable-method = "spin-table";
+		};
+
+		PowerPC,P1020@1 {
+			bus-frequency = <399999996>;
+			timebase-frequency = <50000000>;
+			clock-frequency = <799999992>;
+			d-cache-block-size = <0x20>;
+			d-cache-size = <0x8000>;
+			d-cache-sets = <0x80>;
+			i-cache-block-size = <0x20>;
+			i-cache-size = <0x8000>;
+			i-cache-sets = <0x80>;
+			cpu-release-addr = <0x0 0x0ffff2a0>;
+			status = "disabled";
+			enable-method = "spin-table";
+		};
+	};
+
+	memory {
+		/* Reserve upper MB for second-core-bootpage */
+		reg = <0x0 0x0 0x0 0xff00000>;
+	};
+
+	soc@ffe00000 {
+		bus-frequency = <399999996>;
+
+		serial@4600 {
+			clock-frequency = <399999996>;
+		};
+
+		serial@4500 {
+			clock-frequency = <399999996>;
+		};
+
+		pic@40000 {
+			clock-frequency = <399999996>;
+		};
+	};
+
+	localbus@ffe05000 {
+		bus-frequency = <24999999>;
+	};
+};
+
+&enet0 {
+	rx-stash-idx = <0x00>;
+	rx-stash-len = <0x60>;
+	bd-stash;
+};
+
+&enet2 {
+	rx-stash-idx = <0x00>;
+	rx-stash-len = <0x60>;
+	bd-stash;
+};
+
 /*
  * For the OpenWrt 22.03 release, since Linux 5.10.138 now uses
  * aliases to determine PCI domain numbers, drop aliases so as not to
diff --git a/target/linux/mpc85xx/files/arch/powerpc/platforms/85xx/br200-wp.c b/target/linux/mpc85xx/files/arch/powerpc/platforms/85xx/br200-wp.c
new file mode 100644
index 00000000000000..23fd11a5c69255
--- /dev/null
+++ b/target/linux/mpc85xx/files/arch/powerpc/platforms/85xx/br200-wp.c
@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Aerohive BR200-WP Board Setup
+ * Copyright (C) 2023 Pawel Dembicki <paweldembicki@gmail.com>
+ *
+ * Based on:
+ *   hiveap-330.c:
+ *      Aerohive HiveAP-330 Board Setup
+ *      Copyright (C) 2017 Chris Blake <chrisrblake93@gmail.com>
+ */
+
+#include <linux/stddef.h>
+#include <linux/kernel.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/of_platform.h>
+
+#include <asm/time.h>
+#include <asm/machdep.h>
+#include <asm/pci-bridge.h>
+#include <mm/mmu_decl.h>
+#include <asm/prom.h>
+#include <asm/udbg.h>
+#include <asm/mpic.h>
+
+#include <sysdev/fsl_soc.h>
+#include <sysdev/fsl_pci.h>
+#include "smp.h"
+
+#include "mpc85xx.h"
+
+void __init br200_wp_pic_init(void)
+{
+	struct mpic *mpic;
+
+	mpic = mpic_alloc(NULL, 0,
+	  MPIC_BIG_ENDIAN |
+	  MPIC_SINGLE_DEST_CPU,
+	  0, 256, " OpenPIC  ");
+
+	BUG_ON(mpic == NULL);
+	mpic_init(mpic);
+}
+
+/*
+ * Setup the architecture
+ */
+static void __init br200_wp_setup_arch(void)
+{
+	if (ppc_md.progress)
+		ppc_md.progress("br200_wp_setup_arch()", 0);
+
+	fsl_pci_assign_primary();
+
+	pr_info("br200-wp board from Aerohive\n");
+}
+
+machine_arch_initcall(br200_wp, mpc85xx_common_publish_devices);
+
+/*
+ * Called very early, device-tree isn't unflattened
+ */
+static int __init br200_wp_probe(void)
+{
+	if (of_machine_is_compatible("aerohive,br200-wp"))
+		return 1;
+	return 0;
+}
+
+define_machine(br200_wp) {
+	.name			= "P1020 RDB",
+	.probe			= br200_wp_probe,
+	.setup_arch		= br200_wp_setup_arch,
+	.init_IRQ		= br200_wp_pic_init,
+#ifdef CONFIG_PCI
+	.pcibios_fixup_bus	= fsl_pcibios_fixup_bus,
+	.pcibios_fixup_phb      = fsl_pcibios_fixup_phb,
+#endif
+	.get_irq		= mpic_get_irq,
+	.calibrate_decr		= generic_calibrate_decr,
+	.progress		= udbg_progress,
+};
diff --git a/target/linux/mpc85xx/files/arch/powerpc/platforms/85xx/firebox_t10.c b/target/linux/mpc85xx/files/arch/powerpc/platforms/85xx/firebox_t10.c
new file mode 100644
index 00000000000000..422bde69032292
--- /dev/null
+++ b/target/linux/mpc85xx/files/arch/powerpc/platforms/85xx/firebox_t10.c
@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+/*
+ * Watchguard Firebox T10 Board Setup
+ *
+ * Copyright (C) 2023 David Bauer <mail@david-bauer.net>
+ *
+ * Based on:
+ *   p1010rdb.c:
+ *      P1010 RDB Board Setup
+ *      Copyright 2011 Freescale Semiconductor Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#include <linux/stddef.h>
+#include <linux/kernel.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/of_platform.h>
+
+#include <asm/time.h>
+#include <asm/machdep.h>
+#include <asm/pci-bridge.h>
+#include <mm/mmu_decl.h>
+#include <asm/prom.h>
+#include <asm/udbg.h>
+#include <asm/mpic.h>
+
+#include <sysdev/fsl_soc.h>
+#include <sysdev/fsl_pci.h>
+
+#include "mpc85xx.h"
+
+void __init firebox_t10_pic_init(void)
+{
+	struct mpic *mpic;
+
+	mpic = mpic_alloc(NULL, 0,
+	  MPIC_BIG_ENDIAN | MPIC_SINGLE_DEST_CPU,
+	  0, 256, " OpenPIC  ");
+
+	BUG_ON(mpic == NULL);
+	mpic_init(mpic);
+}
+
+/*
+ * Setup the architecture
+ */
+static void __init firebox_t10_setup_arch(void)
+{
+	if (ppc_md.progress)
+		ppc_md.progress("firebox_t10_setup_arch()", 0);
+
+	fsl_pci_assign_primary();
+
+	pr_info("Firebox T10 from Watchguard\n");
+}
+
+machine_arch_initcall(firebox_t10, mpc85xx_common_publish_devices);
+
+/*
+ * Called very early, device-tree isn't unflattened
+ */
+static int __init firebox_t10_probe(void)
+{
+	if (of_machine_is_compatible("watchguard,firebox-t10"))
+		return 1;
+	return 0;
+}
+
+define_machine(firebox_t10) {
+	.name			= "P1010 RDB",
+	.probe			= firebox_t10_probe,
+	.setup_arch		= firebox_t10_setup_arch,
+	.init_IRQ		= firebox_t10_pic_init,
+#ifdef CONFIG_PCI
+	.pcibios_fixup_bus	= fsl_pcibios_fixup_bus,
+	.pcibios_fixup_phb      = fsl_pcibios_fixup_phb,
+#endif
+	.get_irq		= mpic_get_irq,
+	.calibrate_decr		= generic_calibrate_decr,
+	.progress		= udbg_progress,
+};
diff --git a/target/linux/mpc85xx/files/arch/powerpc/platforms/85xx/ws-ap3715i.c b/target/linux/mpc85xx/files/arch/powerpc/platforms/85xx/ws-ap3715i.c
new file mode 100644
index 00000000000000..aa2a366b3db4b2
--- /dev/null
+++ b/target/linux/mpc85xx/files/arch/powerpc/platforms/85xx/ws-ap3715i.c
@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+/*
+ * Enterasys WS-AP3715i Board Setup
+ *
+ * Copyright (C) 2023 David Bauer <mail@david-bauer.net>
+ *
+ * Based on:
+ *   p1010rdb.c:
+ *      P1010 RDB Board Setup
+ *      Copyright 2011 Freescale Semiconductor Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#include <linux/stddef.h>
+#include <linux/kernel.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/of_platform.h>
+
+#include <asm/time.h>
+#include <asm/machdep.h>
+#include <asm/pci-bridge.h>
+#include <mm/mmu_decl.h>
+#include <asm/prom.h>
+#include <asm/udbg.h>
+#include <asm/mpic.h>
+
+#include <sysdev/fsl_soc.h>
+#include <sysdev/fsl_pci.h>
+
+#include "mpc85xx.h"
+
+void __init wsap3715i_pic_init(void)
+{
+	struct mpic *mpic;
+
+	mpic = mpic_alloc(NULL, 0,
+	  MPIC_BIG_ENDIAN | MPIC_SINGLE_DEST_CPU,
+	  0, 256, " OpenPIC  ");
+
+	BUG_ON(mpic == NULL);
+	mpic_init(mpic);
+}
+
+/*
+ * Setup the architecture
+ */
+static void __init wsap3715i_setup_arch(void)
+{
+	if (ppc_md.progress)
+		ppc_md.progress("wsap3715i_setup_arch()", 0);
+
+	fsl_pci_assign_primary();
+
+	pr_info("WS-AP3715i from Enterasys\n");
+}
+
+machine_arch_initcall(wsap3715i, mpc85xx_common_publish_devices);
+
+/*
+ * Called very early, device-tree isn't unflattened
+ */
+static int __init wsap3715i_probe(void)
+{
+	if (of_machine_is_compatible("enterasys,ws-ap3715i"))
+		return 1;
+	return 0;
+}
+
+define_machine(wsap3715i) {
+	.name			= "P1010 RDB",
+	.probe			= wsap3715i_probe,
+	.setup_arch		= wsap3715i_setup_arch,
+	.init_IRQ		= wsap3715i_pic_init,
+#ifdef CONFIG_PCI
+	.pcibios_fixup_bus	= fsl_pcibios_fixup_bus,
+	.pcibios_fixup_phb      = fsl_pcibios_fixup_phb,
+#endif
+	.get_irq		= mpic_get_irq,
+	.calibrate_decr		= generic_calibrate_decr,
+	.progress		= udbg_progress,
+};
diff --git a/target/linux/mpc85xx/image/p1010.mk b/target/linux/mpc85xx/image/p1010.mk
index 86ab53e355a295..c0de19f6c6fd45 100644
--- a/target/linux/mpc85xx/image/p1010.mk
+++ b/target/linux/mpc85xx/image/p1010.mk
@@ -1,29 +1,88 @@
 DEVICE_VARS += TPLINK_HWID TPLINK_HWREV TPLINK_FLASHLAYOUT TPLINK_HEADER_VERSION
 
+define Build/spi-loader-okli-compile
+	rm -rf $@.spi-loader-okli
+	$(CP) spi-loader $@.spi-loader-okli
+	$(MAKE) -C $@.spi-loader-okli \
+		CROSS_COMPILE="$(TARGET_CROSS)" CONFIG="$(DEVICE_NAME)"
+	cp "$@.spi-loader-okli/out/uImage" "$@"
+	rm -rf $@.spi-loader-okli
+endef
+
+define Build/spi-loader-okli
+	cat $(KDIR)/loader-$(1) "$@" > "$@.new"
+	mv "$@.new" "$@"
+endef
+
+define Device/aerohive_br200-wp
+  DEVICE_VENDOR := Aerohive
+  DEVICE_MODEL := BR200-WP
+  BLOCKSIZE := 128k
+  KERNEL_NAME := simpleImage.br200-wp
+  KERNEL := kernel-bin | uImage none
+  KERNEL_INITRAMFS := kernel-bin | uImage none
+  KERNEL_ENTRY := 0x1000000
+  KERNEL_LOADADDR := 0x1000000
+  KERNEL_SIZE := 8m
+  IMAGES := fdt.bin sysupgrade.bin
+  IMAGE/fdt.bin := append-dtb
+  IMAGE/sysupgrade.bin := append-dtb | pad-to 256k | check-size 256k | \
+	append-uImage-fakehdr ramdisk | pad-to 256k | check-size 512k | \
+	append-rootfs | pad-rootfs $$(BLOCKSIZE) | pad-to 41216k | check-size 41216k | \
+	append-kernel | append-metadata
+  IMAGE_SIZE = 63m
+endef
+TARGET_DEVICES += aerohive_br200-wp
+
+define Device/enterasys_ws-ap3715i
+  DEVICE_VENDOR := Enterasys
+  DEVICE_MODEL := WS-AP3715i
+  BLOCKSIZE := 64k
+  KERNEL_NAME := simpleImage.ws-ap3715i
+  KERNEL_ENTRY := 0x1000000
+  KERNEL_LOADADDR := 0x1000000
+  KERNEL = kernel-bin | lzma | uImage lzma
+  IMAGES := sysupgrade.bin
+  IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | append-metadata
+endef
+TARGET_DEVICES += enterasys_ws-ap3715i
+
 define Device/tplink_tl-wdr4900-v1
   DEVICE_VENDOR := TP-Link
   DEVICE_MODEL := TL-WDR4900
   DEVICE_VARIANT := v1
+  DEVICE_COMPAT_VERSION := 1.1
+  DEVICE_COMPAT_MESSAGE := Config cannot be migrated from swconfig to DSA
   TPLINK_HEADER_VERSION := 1
   TPLINK_HWID := 0x49000001
   TPLINK_HWREV := 1
   TPLINK_FLASHLAYOUT := 16Mppc
-  KERNEL_SIZE := 2684k
   KERNEL_NAME := simpleImage.tl-wdr4900-v1
   KERNEL_INITRAMFS :=
-  KERNEL := kernel-bin | uImage none
+  KERNEL := kernel-bin | uImage none -M 0x4f4b4c49 | spi-loader-okli $(1)
   KERNEL_ENTRY := 0x1000000
   KERNEL_LOADADDR := 0x1000000
   SUPPORTED_DEVICES += tl-wdr4900-v1
+  COMPILE := loader-$(1)
+  COMPILE/loader-$(1) := spi-loader-okli-compile
   ARTIFACTS := fdt.bin
   ARTIFACT/fdt.bin := append-dtb
   IMAGES := factory.bin sysupgrade.bin
   IMAGE/sysupgrade.bin := tplink-v1-image sysupgrade | append-metadata
   IMAGE/factory.bin := tplink-v1-image factory
-  DEFAULT := n
 endef
 TARGET_DEVICES += tplink_tl-wdr4900-v1
 
+define Device/watchguard_firebox-t10
+  DEVICE_VENDOR := Watchguard
+  DEVICE_MODEL := Firebox T10
+  DEVICE_PACKAGES := kmod-rtc-s35390a kmod-eeprom-at24
+  KERNEL = kernel-bin | gzip | fit gzip $(KDIR)/image-$$(DEVICE_DTS).dtb
+  IMAGES := sysupgrade.bin
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += watchguard_firebox-t10
+
 define Device/sophos_red-15w-rev1
   DEVICE_VENDOR := Sophos
   DEVICE_MODEL := RED 15w
diff --git a/target/linux/mpc85xx/image/p1020.mk b/target/linux/mpc85xx/image/p1020.mk
index 6fdbfd664a8fe4..d3d7f93ddda4b4 100644
--- a/target/linux/mpc85xx/image/p1020.mk
+++ b/target/linux/mpc85xx/image/p1020.mk
@@ -73,8 +73,10 @@ define Device/extreme-networks_ws-ap3825i
   DEVICE_MODEL := WS-AP3825i
   DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
   BLOCKSIZE := 128k
-  DTB_SIZE := 20480
-  KERNEL = kernel-bin | lzma | pad-dtb | fit lzma $(KDIR)/image-$$(DEVICE_DTS).dtb
+  KERNEL_NAME := simpleImage.ws-ap3825i
+  KERNEL_ENTRY := 0x1000000
+  KERNEL_LOADADDR := 0x1000000
+  KERNEL = kernel-bin | fit none $(KDIR)/image-$$(DEVICE_DTS).dtb
   IMAGES := sysupgrade.bin
   IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | append-metadata
 endef
diff --git a/target/linux/mpc85xx/image/spi-loader/.gitignore b/target/linux/mpc85xx/image/spi-loader/.gitignore
new file mode 100644
index 00000000000000..e2e7327cde6685
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/.gitignore
@@ -0,0 +1 @@
+/out
diff --git a/target/linux/mpc85xx/image/spi-loader/Makefile b/target/linux/mpc85xx/image/spi-loader/Makefile
new file mode 100644
index 00000000000000..45af2c3b538e84
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/Makefile
@@ -0,0 +1,60 @@
+# SPDX-License-Identifier: BSD-2-Clause
+#
+# Copyright (C) 2022 Matthias Schiffer <mschiffer@universe-factory.net>
+
+CONFIG     ?= $(error No configuration set)
+
+include config/$(CONFIG).mk
+
+MKIMAGE    := mkimage
+KARCH      := powerpc
+CC         := $(CROSS_COMPILE)gcc
+LD         := $(CROSS_COMPILE)ld
+OBJCOPY    := $(CROSS_COMPILE)objcopy
+
+PROGRAM_NAME := MPC85xx SPI loader
+
+BIN_FLAGS  := -O binary --pad-to=$(PAD_TO)
+
+CFLAGS     += -std=gnu17 -Os -Wall -Wstrict-prototypes \
+		-fomit-frame-pointer -ffreestanding \
+		-ffunction-sections -fno-pic \
+		-Iinclude -include ../config/$(CONFIG).h \
+		-DCONFIG_PROGRAM_NAME='"$(PROGRAM_NAME)"' \
+		-DCONFIG_IMAGE_OFFSET=$(IMAGE_OFFSET)
+ASFLAGS    := $(CFLAGS)
+
+LDS        := loader.lds
+LDFLAGS    := -static --gc-sections -T $(LDS) -Ttext $(TEXT_START)
+
+OBJECTS    := head.o loader.o string.o stdio.o  drivers/serial/ns16550.o \
+		drivers/spi/fsl_espi.o drivers/spi/spi-nor.o
+
+OUTDIR     := out
+
+all: $(OUTDIR)/uImage
+
+-include $(OBJECTS:%.o=$(OUTDIR)/%.d)
+
+$(OUTDIR)/%.o: %.c Makefile config/$(CONFIG).mk
+	@mkdir -p $(dir $@)
+	$(CC) $(CFLAGS) -c -o $@ -MD -MP $<
+
+$(OUTDIR)/%.o: %.S Makefile config/$(CONFIG).mk
+	@mkdir -p $(dir $@)
+	$(CC) $(ASFLAGS) -c -o $@ -MD -MP $<
+
+$(OUTDIR)/loader.elf: $(OBJECTS:%=$(OUTDIR)/%) $(LDS)
+	$(LD) $(LDFLAGS) -o $@ $(OBJECTS:%=$(OUTDIR)/%)
+
+$(OUTDIR)/loader.bin: $(OUTDIR)/loader.elf
+	$(OBJCOPY) $(BIN_FLAGS) $< $@
+
+$(OUTDIR)/uImage: $(OUTDIR)/loader.bin
+	$(MKIMAGE) -A $(KARCH) -O linux -T kernel -C none \
+		-a $(TEXT_START) -e $(TEXT_START) -n '$(PROGRAM_NAME)' -d $< $@
+
+clean:
+	rm -rf $(OUTDIR)
+
+.PHONY: all clean
diff --git a/target/linux/mpc85xx/image/spi-loader/config/tplink_tl-wdr4900-v1.h b/target/linux/mpc85xx/image/spi-loader/config/tplink_tl-wdr4900-v1.h
new file mode 100644
index 00000000000000..c3aca32b95f6d3
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/config/tplink_tl-wdr4900-v1.h
@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#define CONFIG_FREQ_SYSTEMBUS 399999996
+#define CONFIG_SPI_MAX_HZ 25000000
+
+#define CONFIG_SERIAL_NS16550_REG_BASE 0xffe04500
+#define CONFIG_SERIAL_NS16550_REG_SHIFT 0
+
+#define CONFIG_SPI_FSL_ESPI_REG_BASE 0xffe07000
diff --git a/target/linux/mpc85xx/image/spi-loader/config/tplink_tl-wdr4900-v1.mk b/target/linux/mpc85xx/image/spi-loader/config/tplink_tl-wdr4900-v1.mk
new file mode 100644
index 00000000000000..ca8793f2be3443
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/config/tplink_tl-wdr4900-v1.mk
@@ -0,0 +1,13 @@
+TEXT_START   := 0x800000
+
+# It seems that the TP-Link TL-WDR4900 U-Boot does not flush the cache before
+# jumping into the uImage. Padding the image to 32k seems make the boot work
+# reliably.
+#
+# We leave 0x40 for the uImage header, which allows us to append the kernel
+# uImage after the loader and read with an added offset 0x8000 from the
+# SPI flash.
+PAD_TO       := 0x807fc0
+
+# Kernel begins at 0x60200 in flash, loader adds 0x8000
+IMAGE_OFFSET := 0x68200
diff --git a/target/linux/mpc85xx/image/spi-loader/drivers/serial/ns16550.c b/target/linux/mpc85xx/image/spi-loader/drivers/serial/ns16550.c
new file mode 100644
index 00000000000000..d4549176b1e29b
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/drivers/serial/ns16550.c
@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * 16550 serial console support.
+ *
+ * Original copied from <file:arch/ppc/boot/common/ns16550.c>
+ * (which had no copyright)
+ * Modifications: 2006 (c) MontaVista Software, Inc.
+ *
+ * Modified by: Mark A. Greer <mgreer@mvista.com>
+ *
+ * Adapted by:
+ *
+ * Copyright (c) 2022 Matthias Schiffer <mschiffer@universe-factory.net>
+ */
+
+#include <io.h>
+#include <serial.h>
+
+#define UART_DLL	0	/* Out: Divisor Latch Low */
+#define UART_DLM	1	/* Out: Divisor Latch High */
+#define UART_FCR	2	/* Out: FIFO Control Register */
+#define UART_LCR	3	/* Out: Line Control Register */
+#define UART_MCR	4	/* Out: Modem Control Register */
+#define UART_LSR	5	/* In:  Line Status Register */
+#define UART_LSR_THRE	0x20	/* Transmit-hold-register empty */
+#define UART_LSR_DR	0x01	/* Receiver data ready */
+#define UART_MSR	6	/* In:  Modem Status Register */
+#define UART_SCR	7	/* I/O: Scratch Register */
+
+static uint8_t *const reg_base = (uint8_t *)CONFIG_SERIAL_NS16550_REG_BASE;
+static const int reg_shift = CONFIG_SERIAL_NS16550_REG_SHIFT;
+
+void serial_console_putchar(char c)
+{
+	while ((in_8(reg_base + (UART_LSR << reg_shift)) & UART_LSR_THRE) == 0);
+	out_8(reg_base, c);
+}
+
+int serial_console_getc(void)
+{
+	while ((in_8(reg_base + (UART_LSR << reg_shift)) & UART_LSR_DR) == 0);
+	return in_8(reg_base);
+}
+
+int serial_console_tstc(void)
+{
+	return ((in_8(reg_base + (UART_LSR << reg_shift)) & UART_LSR_DR) != 0);
+}
+
+void serial_console_init(void)
+{
+	out_8(reg_base + (UART_FCR << reg_shift), 0x06);
+}
diff --git a/target/linux/mpc85xx/image/spi-loader/drivers/spi/fsl_espi.c b/target/linux/mpc85xx/image/spi-loader/drivers/spi/fsl_espi.c
new file mode 100644
index 00000000000000..7e9d8ed11f240b
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/drivers/spi/fsl_espi.c
@@ -0,0 +1,232 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * eSPI controller driver.
+ *
+ * Copyright (c) 2022 Matthias Schiffer <mschiffer@universe-factory.net>
+ *
+ * Based on U-Boot code:
+ *
+ * Copyright 2010-2011 Freescale Semiconductor, Inc.
+ * Copyright 2020 NXP
+ * Author: Mingkai Hu (Mingkai.hu@freescale.com)
+ *	   Chuanhua Han (chuanhua.han@nxp.com)
+ */
+
+#include <io.h>
+#include <stdio.h>
+#include <spi.h>
+
+/* eSPI Registers */
+typedef struct ccsr_espi {
+	uint32_t mode;       /* eSPI mode */
+	uint32_t event;      /* eSPI event */
+	uint32_t mask;       /* eSPI mask */
+	uint32_t com;        /* eSPI command */
+	uint32_t tx;         /* eSPI transmit FIFO access */
+	uint32_t rx;         /* eSPI receive FIFO access */
+	uint8_t  res1[8];    /* reserved */
+	uint32_t csmode[4];  /* 0x2c: sSPI CS0/1/2/3 mode */
+	uint8_t  res2[4048]; /* fill up to 0x1000 */
+} ccsr_espi_t;
+
+struct fsl_spi {
+	ccsr_espi_t	*espi;
+	uint32_t	cs;
+	uint32_t	div16;
+	uint32_t	pm;
+	uint32_t	mode;
+};
+
+#define ESPI_MAX_CS_NUM		4
+#define ESPI_FIFO_WIDTH_BIT	32
+
+#define ESPI_EV_RNE		BIT(9)
+#define ESPI_EV_TNF		BIT(8)
+#define ESPI_EV_DON		BIT(14)
+#define ESPI_EV_TXE		BIT(15)
+#define ESPI_EV_RFCNT_SHIFT	24
+#define ESPI_EV_RFCNT_MASK	(0x3f << ESPI_EV_RFCNT_SHIFT)
+
+#define ESPI_MODE_EN		BIT(31)	/* Enable interface */
+#define ESPI_MODE_TXTHR(x)	((x) << 8)	/* Tx FIFO threshold */
+#define ESPI_MODE_RXTHR(x)	((x) << 0)	/* Rx FIFO threshold */
+
+#define ESPI_COM_CS(x)		((x) << 30)
+#define ESPI_COM_TRANLEN(x)	((x) << 0)
+
+#define ESPI_CSMODE_CI_INACTIVEHIGH	BIT(31)
+#define ESPI_CSMODE_CP_BEGIN_EDGCLK	BIT(30)
+#define ESPI_CSMODE_REV_MSB_FIRST	BIT(29)
+#define ESPI_CSMODE_DIV16		BIT(28)
+#define ESPI_CSMODE_PM(x)		((x) << 24)
+#define ESPI_CSMODE_POL_ASSERTED_LOW	BIT(20)
+#define ESPI_CSMODE_LEN(x)		((x) << 16)
+#define ESPI_CSMODE_CSBEF(x)		((x) << 12)
+#define ESPI_CSMODE_CSAFT(x)		((x) << 8)
+#define ESPI_CSMODE_CSCG(x)		((x) << 3)
+
+#define ESPI_CSMODE_INIT_VAL (ESPI_CSMODE_POL_ASSERTED_LOW | \
+		ESPI_CSMODE_CSBEF(0) | ESPI_CSMODE_CSAFT(0) | \
+		ESPI_CSMODE_CSCG(1))
+
+#define ESPI_MAX_DATA_TRANSFER_LEN 0x10000
+
+static int espi_xfer(struct fsl_spi *fsl, const struct spi_transfer *msg, int n)
+{
+	ccsr_espi_t *espi = fsl->espi;
+	size_t len = spi_message_len(msg, n);
+
+	if (len > ESPI_MAX_DATA_TRANSFER_LEN)
+		return -1;
+
+	/* clear the RXCNT and TXCNT */
+	out_be32(&espi->mode, in_be32(&espi->mode) & (~ESPI_MODE_EN));
+	out_be32(&espi->mode, in_be32(&espi->mode) | ESPI_MODE_EN);
+	out_be32(&espi->com, ESPI_COM_CS(fsl->cs) | ESPI_COM_TRANLEN(len - 1));
+
+	int last_msg = n - 1;
+	int tx_msg = -1, rx_msg = -1;
+	size_t tx_len = 0, rx_len = 0, tx_pos = 0, rx_pos = 0;
+
+	while (true) {
+		if (tx_pos == tx_len && tx_msg < last_msg) {
+			tx_msg++;
+			tx_pos = 0;
+			tx_len = msg[tx_msg].len;
+		}
+		if (rx_pos == rx_len && rx_msg < last_msg) {
+			rx_msg++;
+			rx_pos = 0;
+			rx_len = msg[rx_msg].len;
+		}
+		if (rx_pos == rx_len)
+			break;
+
+		const uint8_t *tx_buf = msg[tx_msg].tx_buf;
+		uint8_t *rx_buf = msg[rx_msg].rx_buf;
+
+		uint32_t event = in_be32(&espi->event);
+
+		/* TX */
+		if ((event & ESPI_EV_TNF) && tx_len > 0) {
+			uint8_t v = 0;
+			if (tx_buf)
+				v = tx_buf[tx_pos];
+			out_8((uint8_t *)&espi->tx, v);
+			tx_pos++;
+		}
+
+		/* RX */
+		if (event & ESPI_EV_RNE) {
+			uint8_t v = in_8((uint8_t *)&espi->rx);
+			if (rx_buf)
+				rx_buf[rx_pos] = v;
+			rx_pos++;
+		}
+	}
+
+	return 0;
+}
+
+static void espi_claim_bus(struct fsl_spi *fsl)
+{
+	ccsr_espi_t *espi = fsl->espi;
+	uint32_t csmode;
+	int i;
+
+	/* Enable eSPI interface */
+	out_be32(&espi->mode, ESPI_MODE_RXTHR(3)
+			| ESPI_MODE_TXTHR(4) | ESPI_MODE_EN);
+
+	out_be32(&espi->mask, 0x00000000); /* Mask  all eSPI interrupts */
+
+	/* Init CS mode interface */
+	for (i = 0; i < ESPI_MAX_CS_NUM; i++)
+		out_be32(&espi->csmode[i], ESPI_CSMODE_INIT_VAL);
+
+	csmode = ESPI_CSMODE_INIT_VAL;
+
+	/* Set eSPI BRG clock source */
+	csmode |= ESPI_CSMODE_PM(fsl->pm) | fsl->div16;
+
+	/* Set eSPI mode */
+	if (fsl->mode & SPI_CPHA)
+		csmode |= ESPI_CSMODE_CP_BEGIN_EDGCLK;
+	if (fsl->mode & SPI_CPOL)
+		csmode |= ESPI_CSMODE_CI_INACTIVEHIGH;
+
+	/* Character bit order: msb first */
+	csmode |= ESPI_CSMODE_REV_MSB_FIRST;
+
+	/* Character length in bits, between 0x3~0xf, i.e. 4bits~16bits */
+	csmode |= ESPI_CSMODE_LEN(7);
+
+	out_be32(&espi->csmode[fsl->cs], csmode);
+}
+
+static void espi_release_bus(struct fsl_spi *fsl)
+{
+	/* Disable the SPI hardware */
+	out_be32(&fsl->espi->mode,
+		in_be32(&fsl->espi->mode) & (~ESPI_MODE_EN));
+}
+
+static void espi_setup_spi(struct fsl_spi *fsl, unsigned int max_hz)
+{
+	unsigned long spibrg;
+	uint32_t pm;
+
+	spibrg = CONFIG_FREQ_SYSTEMBUS / 2;
+	fsl->div16 = 0;
+	if ((spibrg / max_hz) > 32) {
+		fsl->div16 = ESPI_CSMODE_DIV16;
+		pm = spibrg / (max_hz * 16 * 2);
+		if (pm > 16) {
+			/* max_hz too low */
+			pm = 16;
+		}
+	} else {
+		pm = spibrg / (max_hz * 2);
+	}
+	if (pm)
+		pm--;
+	fsl->pm = pm;
+}
+
+static struct fsl_spi spi;
+
+int spi_init(unsigned int cs, unsigned int max_hz, unsigned int mode)
+{
+	if (cs >= ESPI_MAX_CS_NUM)
+		return -1;
+
+	spi.espi = (ccsr_espi_t *)CONFIG_SPI_FSL_ESPI_REG_BASE;
+	spi.cs = cs;
+	spi.mode = mode;
+
+	espi_setup_spi(&spi, max_hz);
+
+	return 0;
+}
+
+int spi_claim_bus(void)
+{
+	espi_claim_bus(&spi);
+
+	return 0;
+}
+
+void spi_release_bus(void)
+{
+	espi_release_bus(&spi);
+}
+
+int spi_xfer(const struct spi_transfer *msg, int n)
+{
+	return espi_xfer(&spi, msg, n);
+}
+
+size_t spi_max_xfer(void)
+{
+	return ESPI_MAX_DATA_TRANSFER_LEN;
+}
diff --git a/target/linux/mpc85xx/image/spi-loader/drivers/spi/spi-nor.c b/target/linux/mpc85xx/image/spi-loader/drivers/spi/spi-nor.c
new file mode 100644
index 00000000000000..403434823efa21
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/drivers/spi/spi-nor.c
@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * Copyright (c) 2022 Matthias Schiffer <mschiffer@universe-factory.net>
+ */
+
+#include <spi.h>
+#include <spi-nor.h>
+#include <stdio.h>
+
+#define CMD_READ 0x03
+#define CMD_READ_ID 0x9F
+
+int spi_nor_read_id(void)
+{
+	int ret;
+
+	const uint8_t tx_buf[1] = {CMD_READ_ID};
+	uint8_t rx_buf[3] = {};
+	struct spi_transfer t[2] = {{
+		.tx_buf = tx_buf,
+		.rx_buf = NULL,
+		.len = sizeof(tx_buf),
+	}, {
+		.tx_buf = NULL,
+		.rx_buf = rx_buf,
+		.len = sizeof(rx_buf),
+	}};
+
+	ret = spi_xfer(t, ARRAY_SIZE(t));
+	if (ret) {
+		puts("SPI transfer failed\n");
+		return ret;
+	}
+
+	puts("Flash JECED ID: ");
+	put_array(rx_buf, sizeof(rx_buf));
+
+	return 0;
+}
+
+int spi_nor_read_data(void *dest, size_t pos, size_t len)
+{
+	int ret;
+
+	while (len > 0) {
+		uint8_t cmd[4] = {CMD_READ, pos >> 16, pos >> 8, pos};
+		size_t block_len = min(len, spi_max_xfer() - sizeof(cmd));
+
+		struct spi_transfer t[2] = {{
+			.tx_buf = cmd,
+			.rx_buf = NULL,
+			.len = sizeof(cmd),
+		}, {
+			.tx_buf = NULL,
+			.rx_buf = dest,
+			.len = block_len,
+		}};
+
+		ret = spi_xfer(t, ARRAY_SIZE(t));
+		if (ret) {
+			puts("SPI transfer failed\n");
+			return ret;
+		}
+
+		pos += block_len;
+		dest += block_len;
+		len -= block_len;
+	}
+
+	return 0;
+}
+
diff --git a/target/linux/mpc85xx/image/spi-loader/head.S b/target/linux/mpc85xx/image/spi-loader/head.S
new file mode 100644
index 00000000000000..032e9141260dca
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/head.S
@@ -0,0 +1,36 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2022 Matthias Schiffer <mschiffer@universe-factory.net>
+ *
+ * Based on Linux arch/powerpc/boot/crt0.S, which is:
+ *
+ * Copyright (C) Paul Mackerras 1997.
+ */
+
+#include <ppc_asm.h>
+
+	.text
+	.global _start
+_start:
+	/* Do a cache flush for our text, in case the loader didn't */
+	lis	r3,_text_start@ha
+	addi	r3,r3,_text_start@l
+	li	r4,_text_len
+	bl	flush_cache
+
+	/* Clear the BSS */
+	lis	r3,_bss_start@ha
+	addi	r3,r3,_bss_start@l
+	li	r4,0
+	li	r5,_bss_len
+	bl	memset
+
+	/* Set up stack */
+	lis	r1,_stack_top@ha
+	addi	r1,r1,_stack_top@l
+	/* Establish a stack frame */
+	li	r0,0
+	stwu	r0,-16(r1)
+
+	/* Call start */
+	b	start
diff --git a/target/linux/mpc85xx/image/spi-loader/include/image.h b/target/linux/mpc85xx/image/spi-loader/include/image.h
new file mode 100644
index 00000000000000..0377c2959eb155
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/include/image.h
@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Derived from U-Boot include/image.h:
+ *
+ * (C) Copyright 2008 Semihalf
+ *
+ * (C) Copyright 2000-2005
+ * Wolfgang Denk, DENX Software Engineering, wd@denx.de.
+ ********************************************************************
+ * NOTE: This header file defines an interface to U-Boot. Including
+ * this (unmodified) header file in another file is considered normal
+ * use of U-Boot, and does *not* fall under the heading of "derived
+ * work".
+ ********************************************************************
+ */
+
+#pragma once
+
+#include <types.h>
+
+/*
+ * Compression Types
+ *
+ * The following are exposed to uImage header.
+ * New IDs *MUST* be appended at the end of the list and *NEVER*
+ * inserted for backward compatibility.
+ */
+enum {
+	IH_COMP_NONE		= 0,	/*  No	 Compression Used	*/
+	IH_COMP_GZIP,			/* gzip	 Compression Used	*/
+	IH_COMP_BZIP2,			/* bzip2 Compression Used	*/
+	IH_COMP_LZMA,			/* lzma  Compression Used	*/
+	IH_COMP_LZO,			/* lzo   Compression Used	*/
+	IH_COMP_LZ4,			/* lz4   Compression Used	*/
+	IH_COMP_ZSTD,			/* zstd   Compression Used	*/
+
+	IH_COMP_COUNT,
+};
+
+#define IH_MAGIC	0x27051956	/* Image Magic Number		*/
+#define IH_MAGIC_OKLI	0x4f4b4c49	/* 'OKLI' Magic Number */
+#define IH_NMLEN		32	/* Image Name Length		*/
+
+/*
+ * Legacy format image header,
+ * all data in network byte order (aka natural aka bigendian).
+ */
+typedef struct image_header {
+	uint32_t	ih_magic;	/* Image Header Magic Number	*/
+	uint32_t	ih_hcrc;	/* Image Header CRC Checksum	*/
+	uint32_t	ih_time;	/* Image Creation Timestamp	*/
+	uint32_t	ih_size;	/* Image Data Size		*/
+	uint32_t	ih_load;	/* Data	 Load  Address		*/
+	uint32_t	ih_ep;		/* Entry Point Address		*/
+	uint32_t	ih_dcrc;	/* Image Data CRC Checksum	*/
+	uint8_t		ih_os;		/* Operating System		*/
+	uint8_t		ih_arch;	/* CPU architecture		*/
+	uint8_t		ih_type;	/* Image Type			*/
+	uint8_t		ih_comp;	/* Compression Type		*/
+	uint8_t		ih_name[IH_NMLEN];	/* Image Name		*/
+} image_header_t;
diff --git a/target/linux/mpc85xx/image/spi-loader/include/init.h b/target/linux/mpc85xx/image/spi-loader/include/init.h
new file mode 100644
index 00000000000000..f3a15f5d43cafe
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/include/init.h
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * Copyright (c) 2022 Matthias Schiffer <mschiffer@universe-factory.net>
+ */
+
+#pragma once
+
+void start(void);
diff --git a/target/linux/mpc85xx/image/spi-loader/include/io.h b/target/linux/mpc85xx/image/spi-loader/include/io.h
new file mode 100644
index 00000000000000..d6eed5eee06b72
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/include/io.h
@@ -0,0 +1,101 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#pragma once
+
+#include <stdint.h>
+
+/*
+ * Low-level I/O routines.
+ *
+ * Copied from <file:arch/powerpc/include/asm/io.h> (which has no copyright)
+ */
+static inline uint8_t in_8(const volatile uint8_t *addr)
+{
+	int ret;
+
+	__asm__ __volatile__("lbz%U1%X1 %0,%1; twi 0,%0,0; isync"
+			     : "=r" (ret) : "m" (*addr));
+	return ret;
+}
+
+static inline void out_8(volatile uint8_t *addr, uint8_t val)
+{
+	__asm__ __volatile__("stb%U0%X0 %1,%0; sync"
+			     : "=m" (*addr) : "r" (val));
+}
+
+static inline uint16_t in_le16(const volatile uint16_t *addr)
+{
+	uint32_t ret;
+
+	__asm__ __volatile__("lhbrx %0,0,%1; twi 0,%0,0; isync"
+			     : "=r" (ret) : "r" (addr), "m" (*addr));
+
+	return ret;
+}
+
+static inline uint16_t in_be16(const volatile uint16_t *addr)
+{
+	uint32_t ret;
+
+	__asm__ __volatile__("lhz%U1%X1 %0,%1; twi 0,%0,0; isync"
+			     : "=r" (ret) : "m" (*addr));
+	return ret;
+}
+
+static inline void out_le16(volatile uint16_t *addr, uint16_t val)
+{
+	__asm__ __volatile__("sthbrx %1,0,%2; sync" : "=m" (*addr)
+			     : "r" (val), "r" (addr));
+}
+
+static inline void out_be16(volatile uint16_t *addr, uint16_t val)
+{
+	__asm__ __volatile__("sth%U0%X0 %1,%0; sync"
+			     : "=m" (*addr) : "r" (val));
+}
+
+static inline uint32_t in_le32(const volatile uint32_t *addr)
+{
+	uint32_t ret;
+
+	__asm__ __volatile__("lwbrx %0,0,%1; twi 0,%0,0; isync"
+			     : "=r" (ret) : "r" (addr), "m" (*addr));
+	return ret;
+}
+
+static inline uint32_t in_be32(const volatile uint32_t *addr)
+{
+	uint32_t ret;
+
+	__asm__ __volatile__("lwz%U1%X1 %0,%1; twi 0,%0,0; isync"
+			     : "=r" (ret) : "m" (*addr));
+	return ret;
+}
+
+static inline void out_le32(volatile uint32_t *addr, uint32_t val)
+{
+	__asm__ __volatile__("stwbrx %1,0,%2; sync" : "=m" (*addr)
+			     : "r" (val), "r" (addr));
+}
+
+static inline void out_be32(volatile uint32_t *addr, uint32_t val)
+{
+	__asm__ __volatile__("stw%U0%X0 %1,%0; sync"
+			     : "=m" (*addr) : "r" (val));
+}
+
+static inline void sync(void)
+{
+	asm volatile("sync" : : : "memory");
+}
+
+static inline void eieio(void)
+{
+	asm volatile("eieio" : : : "memory");
+}
+
+static inline void barrier(void)
+{
+	asm volatile("" : : : "memory");
+}
diff --git a/target/linux/mpc85xx/image/spi-loader/include/ppc_asm.h b/target/linux/mpc85xx/image/spi-loader/include/ppc_asm.h
new file mode 100644
index 00000000000000..5dae34eb70e7e2
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/include/ppc_asm.h
@@ -0,0 +1,55 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#pragma once
+/*
+ *
+ * Definitions used by various bits of low-level assembly code on PowerPC.
+ *
+ * Copyright (C) 1995-1999 Gary Thomas, Paul Mackerras, Cort Dougan.
+ */
+
+/* Condition Register Bit Fields */
+
+#define	cr0	0
+#define	cr1	1
+#define	cr2	2
+#define	cr3	3
+#define	cr4	4
+#define	cr5	5
+#define	cr6	6
+#define	cr7	7
+
+/* General Purpose Registers (GPRs) */
+
+#define	r0	0
+#define	r1	1
+#define	r2	2
+#define	r3	3
+#define	r4	4
+#define	r5	5
+#define	r6	6
+#define	r7	7
+#define	r8	8
+#define	r9	9
+#define	r10	10
+#define	r11	11
+#define	r12	12
+#define	r13	13
+#define	r14	14
+#define	r15	15
+#define	r16	16
+#define	r17	17
+#define	r18	18
+#define	r19	19
+#define	r20	20
+#define	r21	21
+#define	r22	22
+#define	r23	23
+#define	r24	24
+#define	r25	25
+#define	r26	26
+#define	r27	27
+#define	r28	28
+#define	r29	29
+#define	r30	30
+#define	r31	31
diff --git a/target/linux/mpc85xx/image/spi-loader/include/serial.h b/target/linux/mpc85xx/image/spi-loader/include/serial.h
new file mode 100644
index 00000000000000..1d80ede3357d36
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/include/serial.h
@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: BSD-2-Clause
+
+#pragma once
+
+int serial_console_getchar(void);
+int serial_console_tstc(void);
+void serial_console_putchar(char c);
+void serial_console_init(void);
+
diff --git a/target/linux/mpc85xx/image/spi-loader/include/spi-nor.h b/target/linux/mpc85xx/image/spi-loader/include/spi-nor.h
new file mode 100644
index 00000000000000..efbf38660137b5
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/include/spi-nor.h
@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * Copyright (c) 2022 Matthias Schiffer <mschiffer@universe-factory.net>
+ */
+
+#pragma once
+
+#include <types.h>
+
+int spi_nor_read_id(void);
+int spi_nor_read_data(void *dest, size_t pos, size_t len);
diff --git a/target/linux/mpc85xx/image/spi-loader/include/spi.h b/target/linux/mpc85xx/image/spi-loader/include/spi.h
new file mode 100644
index 00000000000000..98e799ccaf9bf5
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/include/spi.h
@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Common SPI Interface: Controller-specific definitions
+ *
+ * Copyright (c) 2022 Matthias Schiffer <mschiffer@universe-factory.net>
+ *
+ * Based on U-boot's spi.h:
+ *
+ * (C) Copyright 2001
+ * Gerald Van Baren, Custom IDEAS, vanbaren@cideas.com.
+ */
+
+#pragma once
+
+#include <types.h>
+
+/* SPI mode flags */
+#define SPI_CPHA	BIT(0)	/* clock phase (1 = SPI_CLOCK_PHASE_SECOND) */
+#define SPI_CPOL	BIT(1)	/* clock polarity (1 = SPI_POLARITY_HIGH) */
+#define SPI_MODE_0	(0|0)			/* (original MicroWire) */
+#define SPI_MODE_1	(0|SPI_CPHA)
+#define SPI_MODE_2	(SPI_CPOL|0)
+#define SPI_MODE_3	(SPI_CPOL|SPI_CPHA)
+
+struct spi_transfer {
+	const void *tx_buf;
+	void *rx_buf;
+	size_t len;
+};
+
+static inline size_t spi_message_len(const struct spi_transfer *msg, int n) {
+	size_t total = 0;
+	for (int i = 0; i < n; i++) {
+		total += msg[i].len;
+	}
+	return total;
+}
+
+int spi_init(unsigned int cs, unsigned int max_hz, unsigned int mode);
+int spi_claim_bus(void);
+void spi_release_bus(void);
+int spi_xfer(const struct spi_transfer *msg, int n);
+size_t spi_max_xfer(void);
diff --git a/target/linux/mpc85xx/image/spi-loader/include/stdio.h b/target/linux/mpc85xx/image/spi-loader/include/stdio.h
new file mode 100644
index 00000000000000..60494300b23916
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/include/stdio.h
@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * Copyright (c) 2022 Matthias Schiffer <mschiffer@universe-factory.net>
+ */
+
+#pragma once
+
+#include <serial.h>
+#include <types.h>
+
+static inline int getchar(void)
+{
+	return serial_console_getchar();
+}
+
+static inline int tstc(void)
+{
+	return serial_console_tstc();
+}
+
+static inline int putchar(char c)
+{
+	if (c == '\n')
+		serial_console_putchar('\r');
+	serial_console_putchar(c);
+	return 0;
+}
+
+int puts(const char *s);
+
+/* Utility functions */
+void put_u4(uint8_t v);
+void put_u8(uint8_t v);
+void put_u16(uint16_t v);
+void put_u32(uint32_t v);
+void put_ptr(const void *p);
+void put_array(const void *p, size_t l);
+
+#define put_with_label(label, put, value) do { \
+		puts(label); \
+		put(value); \
+		puts("\n"); \
+	} while (0)
diff --git a/target/linux/mpc85xx/image/spi-loader/include/string.h b/target/linux/mpc85xx/image/spi-loader/include/string.h
new file mode 100644
index 00000000000000..f9e6fed38d8248
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/include/string.h
@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#pragma once
+
+#include <stddef.h>
+
+extern char *strcpy(char *dest, const char *src);
+extern char *strncpy(char *dest, const char *src, size_t n);
+extern char *strcat(char *dest, const char *src);
+extern char *strchr(const char *s, int c);
+extern char *strrchr(const char *s, int c);
+extern int strcmp(const char *s1, const char *s2);
+extern int strncmp(const char *s1, const char *s2, size_t n);
+extern size_t strlen(const char *s);
+extern size_t strnlen(const char *s, size_t count);
+
+extern void *memset(void *s, int c, size_t n);
+extern void *memmove(void *dest, const void *src, unsigned long n);
+extern void *memcpy(void *dest, const void *src, unsigned long n);
+extern void *memchr(const void *s, int c, size_t n);
+extern int memcmp(const void *s1, const void *s2, size_t n);
+
+extern void flush_cache(void *, unsigned long);
diff --git a/target/linux/mpc85xx/image/spi-loader/include/types.h b/target/linux/mpc85xx/image/spi-loader/include/types.h
new file mode 100644
index 00000000000000..b80f9e625cf588
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/include/types.h
@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Code originates from Linux kernel arch/powerpc/boot
+ * (types.h, swab.h, of.h)
+ */
+
+#pragma once
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+
+#define BIT(nr)	(1UL << (nr))
+
+#define min(x,y) ({ \
+	typeof(x) _x = (x);	\
+	typeof(y) _y = (y);	\
+	(void) (&_x == &_y);	\
+	_x < _y ? _x : _y; })
+
+#define max(x,y) ({ \
+	typeof(x) _x = (x);	\
+	typeof(y) _y = (y);	\
+	(void) (&_x == &_y);	\
+	_x > _y ? _x : _y; })
+
+#define min_t(type, a, b) min(((type) a), ((type) b))
+#define max_t(type, a, b) max(((type) a), ((type) b))
+
+static inline uint16_t swab16(uint16_t x)
+{
+	return  ((x & (uint16_t)0x00ffU) << 8) |
+		((x & (uint16_t)0xff00U) >> 8);
+}
+
+static inline uint32_t swab32(uint32_t x)
+{
+	return  ((x & (uint32_t)0x000000ffUL) << 24) |
+		((x & (uint32_t)0x0000ff00UL) <<  8) |
+		((x & (uint32_t)0x00ff0000UL) >>  8) |
+		((x & (uint32_t)0xff000000UL) >> 24);
+}
+
+static inline uint64_t swab64(uint64_t x)
+{
+	return  (uint64_t)((x & (uint64_t)0x00000000000000ffULL) << 56) |
+		(uint64_t)((x & (uint64_t)0x000000000000ff00ULL) << 40) |
+		(uint64_t)((x & (uint64_t)0x0000000000ff0000ULL) << 24) |
+		(uint64_t)((x & (uint64_t)0x00000000ff000000ULL) <<  8) |
+		(uint64_t)((x & (uint64_t)0x000000ff00000000ULL) >>  8) |
+		(uint64_t)((x & (uint64_t)0x0000ff0000000000ULL) >> 24) |
+		(uint64_t)((x & (uint64_t)0x00ff000000000000ULL) >> 40) |
+		(uint64_t)((x & (uint64_t)0xff00000000000000ULL) >> 56);
+}
+
+#ifdef __LITTLE_ENDIAN__
+#define cpu_to_be16(x) swab16(x)
+#define be16_to_cpu(x) swab16(x)
+#define cpu_to_be32(x) swab32(x)
+#define be32_to_cpu(x) swab32(x)
+#define cpu_to_be64(x) swab64(x)
+#define be64_to_cpu(x) swab64(x)
+#else
+#define cpu_to_be16(x) (x)
+#define be16_to_cpu(x) (x)
+#define cpu_to_be32(x) (x)
+#define be32_to_cpu(x) (x)
+#define cpu_to_be64(x) (x)
+#define be64_to_cpu(x) (x)
+#endif
diff --git a/target/linux/mpc85xx/image/spi-loader/loader.c b/target/linux/mpc85xx/image/spi-loader/loader.c
new file mode 100644
index 00000000000000..145a723033e36c
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/loader.c
@@ -0,0 +1,107 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * Copyright (c) 2022 Matthias Schiffer <mschiffer@universe-factory.net>
+ */
+
+#include <image.h>
+#include <init.h>
+#include <spi.h>
+#include <spi-nor.h>
+#include <stdio.h>
+#include <string.h>
+
+static bool check_image_header(const image_header_t *header)
+{
+	if (header->ih_magic != cpu_to_be32(IH_MAGIC_OKLI)) {
+		puts("Invalid image magic\n");
+		return false;
+	}
+
+	if (header->ih_comp != cpu_to_be32(IH_COMP_NONE)) {
+		puts("Unsupported compressed image\n");
+		return false;
+	}
+
+	return true;
+}
+
+static uint32_t do_load(void)
+{
+	image_header_t header;
+	uint32_t ih_size, ih_load, ih_ep;
+
+	if (spi_nor_read_id())
+		return UINT32_MAX;
+
+	puts("Reading image header...\n");
+	if (spi_nor_read_data(&header, CONFIG_IMAGE_OFFSET, sizeof(header)))
+		return UINT32_MAX;
+
+	if (!check_image_header(&header))
+		return UINT32_MAX;
+
+	header.ih_name[sizeof(header.ih_name) - 1] = 0;
+	ih_size = be32_to_cpu(header.ih_size);
+	ih_load = be32_to_cpu(header.ih_load);
+	ih_ep = be32_to_cpu(header.ih_ep);
+
+	put_with_label("Image Name:   ", puts, (const char *)header.ih_name);
+	put_with_label("Data Size:    ", put_u32, ih_size);
+	put_with_label("Load Address: ", put_u32, ih_load);
+	put_with_label("Entry Point:  ", put_u32, ih_ep);
+
+	puts("Reading image data...\n");
+	void *loadaddr = (void *)ih_load;
+	if (spi_nor_read_data(loadaddr, CONFIG_IMAGE_OFFSET + sizeof(header),
+			      ih_size))
+		return false;
+
+	flush_cache(loadaddr, ih_size);
+
+	return ih_ep;
+}
+
+static void enter_image(uint32_t addr)
+{
+	typedef void (*entry_t)(void);
+	entry_t entry = (entry_t)addr;
+
+	puts("Starting image...\n");
+	entry();
+}
+
+static void load(void)
+{
+	uint32_t addr;
+	int ret;
+
+	ret = spi_init(0, CONFIG_SPI_MAX_HZ, SPI_MODE_0);
+	if (ret) {
+		puts("Failed to initialize SPI controller\n");
+		return;
+	}
+
+	ret = spi_claim_bus();
+	if (ret) {
+		puts("Failed to enable SPI controller\n");
+		return;
+	}
+
+	addr = do_load();
+
+	spi_release_bus();
+
+	if (addr != UINT32_MAX)
+		enter_image(addr);
+}
+
+void start(void)
+{
+	serial_console_init();
+	puts("=== " CONFIG_PROGRAM_NAME " ===\n");
+
+	load();
+
+	puts("Halting execution.\n");
+	while (true) {}
+}
diff --git a/target/linux/mpc85xx/image/spi-loader/loader.lds b/target/linux/mpc85xx/image/spi-loader/loader.lds
new file mode 100644
index 00000000000000..3af24a162e54cd
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/loader.lds
@@ -0,0 +1,31 @@
+OUTPUT_ARCH(powerpc:common)
+ENTRY(_start)
+EXTERN(_start)
+SECTIONS {
+	.text :
+	{
+		_text_start = .;
+		*(.text*)
+		_text_len = ABSOLUTE(. - _text_start);
+	}
+	.data :
+	{
+		_data_start = .;
+		*(.rodata*)
+		*(.data*)
+		*(.sdata*)
+		_data_len = ABSOLUTE(. - _data_start);
+	}
+	. = ALIGN(4096);
+	.bss :
+	{
+		_bss_start = .;
+		. += 4K;
+		_stack_top = .;
+		*(.bss*)
+		*(.sbss*)
+		_bss_len = ABSOLUTE(. - _bss_start);
+	}
+	. = ALIGN(4096);
+	_end = .;
+}
diff --git a/target/linux/mpc85xx/image/spi-loader/stdio.c b/target/linux/mpc85xx/image/spi-loader/stdio.c
new file mode 100644
index 00000000000000..3aa55d06132a6e
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/stdio.c
@@ -0,0 +1,59 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * Copyright (c) 2022 Matthias Schiffer <mschiffer@universe-factory.net>
+ */
+
+#include <stdio.h>
+
+int puts(const char *s)
+{
+	while (*s)
+		putchar(*s++);
+	return 0;
+}
+
+void put_u4(uint8_t v)
+{
+	v &= 0xf;
+	switch (v) {
+	case 0x0 ... 0x9:
+		putchar('0' + v);
+		break;
+	case 0xa ... 0xf:
+		putchar('a' + (v - 0xa));
+	}
+}
+
+void put_u8(uint8_t v)
+{
+	put_u4(v >> 4);
+	put_u4(v);
+}
+
+void put_u16(uint16_t v)
+{
+	put_u8(v >> 8);
+	put_u8(v);
+}
+
+void put_u32(uint32_t v)
+{
+	put_u16(v >> 16);
+	put_u16(v);
+}
+
+void put_ptr(const void *p)
+{
+	put_u32((uint32_t)p);
+}
+
+void put_array(const void *p, size_t l)
+{
+	const uint8_t *c = p;
+	size_t i;
+	for (i = 0; i < l; i++) {
+		put_u8(c[i]);
+		putchar(' ');
+	}
+	putchar('\n');
+}
diff --git a/target/linux/mpc85xx/image/spi-loader/string.S b/target/linux/mpc85xx/image/spi-loader/string.S
new file mode 100644
index 00000000000000..11d05a80e21bff
--- /dev/null
+++ b/target/linux/mpc85xx/image/spi-loader/string.S
@@ -0,0 +1,265 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) Paul Mackerras 1997.
+ *
+ * NOTE: this code runs in 32 bit mode and is packaged as ELF32.
+ */
+
+#include <ppc_asm.h>
+
+	.text
+	.globl	strcpy
+strcpy:
+	addi	r5,r3,-1
+	addi	r4,r4,-1
+1:	lbzu	r0,1(r4)
+	cmpwi	0,r0,0
+	stbu	r0,1(r5)
+	bne	1b
+	blr
+
+	.globl	strncpy
+strncpy:
+	cmpwi	0,r5,0
+	beqlr
+	mtctr	r5
+	addi	r6,r3,-1
+	addi	r4,r4,-1
+1:	lbzu	r0,1(r4)
+	cmpwi	0,r0,0
+	stbu	r0,1(r6)
+	bdnzf	2,1b		/* dec ctr, branch if ctr != 0 && !cr0.eq */
+	blr
+
+	.globl	strcat
+strcat:
+	addi	r5,r3,-1
+	addi	r4,r4,-1
+1:	lbzu	r0,1(r5)
+	cmpwi	0,r0,0
+	bne	1b
+	addi	r5,r5,-1
+1:	lbzu	r0,1(r4)
+	cmpwi	0,r0,0
+	stbu	r0,1(r5)
+	bne	1b
+	blr
+
+	.globl	strchr
+strchr:
+	addi	r3,r3,-1
+1:	lbzu	r0,1(r3)
+	cmpw	0,r0,r4
+	beqlr
+	cmpwi	0,r0,0
+	bne	1b
+	li	r3,0
+	blr
+
+	.globl	strcmp
+strcmp:
+	addi	r5,r3,-1
+	addi	r4,r4,-1
+1:	lbzu	r3,1(r5)
+	cmpwi	1,r3,0
+	lbzu	r0,1(r4)
+	subf.	r3,r0,r3
+	beqlr	1
+	beq	1b
+	blr
+
+	.globl	strncmp
+strncmp:
+	mtctr	r5
+	addi	r5,r3,-1
+	addi	r4,r4,-1
+1:	lbzu	r3,1(r5)
+	cmpwi	1,r3,0
+	lbzu	r0,1(r4)
+	subf.	r3,r0,r3
+	beqlr	1
+	bdnzt	eq,1b
+	blr
+
+	.globl	strlen
+strlen:
+	addi	r4,r3,-1
+1:	lbzu	r0,1(r4)
+	cmpwi	0,r0,0
+	bne	1b
+	subf	r3,r3,r4
+	blr
+
+	.globl	memset
+memset:
+	rlwimi	r4,r4,8,16,23
+	rlwimi	r4,r4,16,0,15
+	addi	r6,r3,-4
+	cmplwi	0,r5,4
+	blt	7f
+	stwu	r4,4(r6)
+	beqlr
+	andi.	r0,r6,3
+	add	r5,r0,r5
+	subf	r6,r0,r6
+	rlwinm	r0,r5,32-2,2,31
+	mtctr	r0
+	bdz	6f
+1:	stwu	r4,4(r6)
+	bdnz	1b
+6:	andi.	r5,r5,3
+7:	cmpwi	0,r5,0
+	beqlr
+	mtctr	r5
+	addi	r6,r6,3
+8:	stbu	r4,1(r6)
+	bdnz	8b
+	blr
+
+	.globl	memmove
+memmove:
+	cmplw	0,r3,r4
+	bgt	backwards_memcpy
+	/* fall through */
+
+	.globl	memcpy
+memcpy:
+	rlwinm.	r7,r5,32-3,3,31		/* r7 = r5 >> 3 */
+	addi	r6,r3,-4
+	addi	r4,r4,-4
+	beq	3f			/* if less than 8 bytes to do */
+	andi.	r0,r6,3			/* get dest word aligned */
+	mtctr	r7
+	bne	5f
+	andi.	r0,r4,3			/* check src word aligned too */
+	bne	3f
+1:	lwz	r7,4(r4)
+	lwzu	r8,8(r4)
+	stw	r7,4(r6)
+	stwu	r8,8(r6)
+	bdnz	1b
+	andi.	r5,r5,7
+2:	cmplwi	0,r5,4
+	blt	3f
+	lwzu	r0,4(r4)
+	addi	r5,r5,-4
+	stwu	r0,4(r6)
+3:	cmpwi	0,r5,0
+	beqlr
+	mtctr	r5
+	addi	r4,r4,3
+	addi	r6,r6,3
+4:	lbzu	r0,1(r4)
+	stbu	r0,1(r6)
+	bdnz	4b
+	blr
+5:	subfic	r0,r0,4
+	cmpw	cr1,r0,r5
+	add	r7,r0,r4
+	andi.	r7,r7,3			/* will source be word-aligned too? */
+	ble	cr1,3b
+	bne	3b			/* do byte-by-byte if not */
+	mtctr	r0
+6:	lbz	r7,4(r4)
+	addi	r4,r4,1
+	stb	r7,4(r6)
+	addi	r6,r6,1
+	bdnz	6b
+	subf	r5,r0,r5
+	rlwinm.	r7,r5,32-3,3,31
+	beq	2b
+	mtctr	r7
+	b	1b
+
+	.globl	backwards_memcpy
+backwards_memcpy:
+	rlwinm.	r7,r5,32-3,3,31		/* r7 = r5 >> 3 */
+	add	r6,r3,r5
+	add	r4,r4,r5
+	beq	3f
+	andi.	r0,r6,3
+	mtctr	r7
+	bne	5f
+	andi.	r0,r4,3
+	bne	3f
+1:	lwz	r7,-4(r4)
+	lwzu	r8,-8(r4)
+	stw	r7,-4(r6)
+	stwu	r8,-8(r6)
+	bdnz	1b
+	andi.	r5,r5,7
+2:	cmplwi	0,r5,4
+	blt	3f
+	lwzu	r0,-4(r4)
+	subi	r5,r5,4
+	stwu	r0,-4(r6)
+3:	cmpwi	0,r5,0
+	beqlr
+	mtctr	r5
+4:	lbzu	r0,-1(r4)
+	stbu	r0,-1(r6)
+	bdnz	4b
+	blr
+5:	cmpw	cr1,r0,r5
+	subf	r7,r0,r4
+	andi.	r7,r7,3
+	ble	cr1,3b
+	bne	3b
+	mtctr	r0
+6:	lbzu	r7,-1(r4)
+	stbu	r7,-1(r6)
+	bdnz	6b
+	subf	r5,r0,r5
+	rlwinm.	r7,r5,32-3,3,31
+	beq	2b
+	mtctr	r7
+	b	1b
+
+	.globl	memchr
+memchr:
+	cmpwi	0,r5,0
+	blelr
+	mtctr	r5
+	addi	r3,r3,-1
+1:	lbzu	r0,1(r3)
+	cmpw	r0,r4
+	beqlr
+	bdnz	1b
+	li	r3,0
+	blr
+
+	.globl	memcmp
+memcmp:
+	cmpwi	0,r5,0
+	ble	2f
+	mtctr	r5
+	addi	r6,r3,-1
+	addi	r4,r4,-1
+1:	lbzu	r3,1(r6)
+	lbzu	r0,1(r4)
+	subf.	r3,r0,r3
+	bdnzt	2,1b
+	blr
+2:	li	r3,0
+	blr
+
+
+/*
+ * Flush the dcache and invalidate the icache for a range of addresses.
+ *
+ * flush_cache(addr, len)
+ */
+	.global	flush_cache
+flush_cache:
+	addi	4,4,0x1f	/* len = (len + 0x1f) / 0x20 */
+	rlwinm.	4,4,27,5,31
+	mtctr	4
+	beqlr
+1:	dcbf	0,3
+	icbi	0,3
+	addi	3,3,0x20
+	bdnz	1b
+	sync
+	isync
+	blr
+
diff --git a/target/linux/mpc85xx/p1010/config-default b/target/linux/mpc85xx/p1010/config-default
index 8a065f7944161c..f00fb4d5fdfcb8 100644
--- a/target/linux/mpc85xx/p1010/config-default
+++ b/target/linux/mpc85xx/p1010/config-default
@@ -1,12 +1,31 @@
+CONFIG_AT803X_PHY=y
+CONFIG_BR200_WP=y
+CONFIG_CMDLINE_OVERRIDE=y
+CONFIG_FIREBOX_T10=y
 # CONFIG_FSL_CORENET_CF is not set
+CONFIG_GPIO_74X164=y
+CONFIG_MTD_CFI=y
 CONFIG_MTD_NAND_FSL_IFC=y
+CONFIG_MTD_PHYSMAP=y
 CONFIG_MTD_SPLIT_FIRMWARE=y
 CONFIG_MTD_SPLIT_TPLINK_FW=y
+CONFIG_MTD_SPLIT_UIMAGE_FW=y
 CONFIG_MTD_UBI=y
 CONFIG_MTD_UBI_BEB_LIMIT=20
 CONFIG_MTD_UBI_BLOCK=y
 CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_QCA8K=y
+CONFIG_NET_DSA_QCA8K_LEDS_SUPPORT=y
+CONFIG_NET_DSA_TAG_QCA=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_PHYLINK=y
 CONFIG_REALTEK_PHY=y
 CONFIG_RED_15W_REV1=y
+CONFIG_REGMAP=y
+CONFIG_REGULATOR=y
+CONFIG_SPI_GPIO=y
 CONFIG_TL_WDR4900_V1=y
 CONFIG_UBIFS_FS=y
+CONFIG_WS_AP3715I=y
diff --git a/target/linux/mpc85xx/p1010/target.mk b/target/linux/mpc85xx/p1010/target.mk
index 019536ff1ab394..6b54390863762d 100644
--- a/target/linux/mpc85xx/p1010/target.mk
+++ b/target/linux/mpc85xx/p1010/target.mk
@@ -1,5 +1,5 @@
 BOARDNAME:=P1010
-KERNELNAME:=simpleImage.tl-wdr4900-v1
+KERNEL_IMAGES:=simpleImage.br200-wp simpleImage.tl-wdr4900-v1 simpleImage.ws-ap3715i
 
 define Target/Description
 	Build firmware images for P1010 based boards.
diff --git a/target/linux/mpc85xx/p1020/config-default b/target/linux/mpc85xx/p1020/config-default
index 6f2a9d2c3b44e4..573ff362f956a5 100644
--- a/target/linux/mpc85xx/p1020/config-default
+++ b/target/linux/mpc85xx/p1020/config-default
@@ -42,6 +42,7 @@ CONFIG_RPS=y
 CONFIG_RWSEM_SPIN_ON_OWNER=y
 CONFIG_SMP=y
 CONFIG_SPI_GPIO=y
+CONFIG_SWCONFIG=y
 CONFIG_SWCONFIG_B53=y
 # CONFIG_SWCONFIG_B53_MMAP_DRIVER is not set
 CONFIG_SWCONFIG_B53_PHY_DRIVER=y
diff --git a/target/linux/mpc85xx/p1020/target.mk b/target/linux/mpc85xx/p1020/target.mk
index 000fc6464444ae..8770edb9a9146f 100644
--- a/target/linux/mpc85xx/p1020/target.mk
+++ b/target/linux/mpc85xx/p1020/target.mk
@@ -1,4 +1,5 @@
 BOARDNAME:=P1020
+KERNEL_IMAGES:=simpleImage.ws-ap3825i
 
 define Target/Description
 	Build firmware images for Freescale P1020 based boards.
diff --git a/target/linux/mpc85xx/p2020/config-default b/target/linux/mpc85xx/p2020/config-default
index e4ed758d95b9ac..6d0ecc5b9ee131 100644
--- a/target/linux/mpc85xx/p2020/config-default
+++ b/target/linux/mpc85xx/p2020/config-default
@@ -1,29 +1,44 @@
-CONFIG_ARCH_HAS_TICK_BROADCAST=y
+CONFIG_BLK_DEV_NVME=y
 CONFIG_CPU_RMAP=y
+CONFIG_DEFAULT_UIMAGE=y
+CONFIG_FSL_ULI1575=y
 CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
 CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_GENERIC_MSI_IRQ=y
+CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
 CONFIG_GENERIC_TBSYNC=y
-CONFIG_HAVE_RCU_TABLE_FREE=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
 CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_MAX63XX_WATCHDOG=y
+CONFIG_MDIO_DEVRES=y
 CONFIG_MPC85xx_RDB=y
 CONFIG_MTD_CFI=y
-CONFIG_MTD_NAND_BCH=y
-CONFIG_MTD_NAND_ECC_BCH=y
 CONFIG_MTD_NAND_FSL_ELBC=y
 CONFIG_MTD_PHYSMAP=y
 CONFIG_MTD_SPLIT_FIRMWARE=y
 CONFIG_MTD_SPLIT_FIT_FW=y
 CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_NEED_DMA_MAP_STATE=y
 CONFIG_NET_FLOW_LIMIT=y
 CONFIG_NR_CPUS=2
+CONFIG_NVME_CORE=y
+# CONFIG_NVME_MULTIPATH is not set
 CONFIG_PADATA=y
 CONFIG_PCI_MSI=y
+CONFIG_PCI_MSI_ARCH_FALLBACKS=y
+CONFIG_PCI_MSI_IRQ_DOMAIN=y
+CONFIG_PPC_I8259=y
 CONFIG_PPC_MSI_BITMAP=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
 CONFIG_RFS_ACCEL=y
 CONFIG_RPS=y
 CONFIG_RTC_DRV_DS1307=y
 CONFIG_RWSEM_SPIN_ON_OWNER=y
 CONFIG_SMP=y
+CONFIG_SWIOTLB=y
+CONFIG_TARGET_CPU="8540"
+CONFIG_TARGET_CPU_BOOL=y
 CONFIG_TREE_RCU=y
 CONFIG_TREE_SRCU=y
 CONFIG_XPS=y
diff --git a/target/linux/mpc85xx/patches-5.15/001-powerpc-85xx-add-gpio-keys-to-of-match-table.patch b/target/linux/mpc85xx/patches-5.15/001-powerpc-85xx-add-gpio-keys-to-of-match-table.patch
new file mode 100644
index 00000000000000..5e5ab10daf1d02
--- /dev/null
+++ b/target/linux/mpc85xx/patches-5.15/001-powerpc-85xx-add-gpio-keys-to-of-match-table.patch
@@ -0,0 +1,10 @@
+--- a/arch/powerpc/platforms/85xx/common.c
++++ b/arch/powerpc/platforms/85xx/common.c
+@@ -30,6 +30,7 @@ static const struct of_device_id mpc85xx
+ 	{ .compatible = "fsl,mpc8548-guts", },
+ 	/* Probably unnecessary? */
+ 	{ .compatible = "gpio-leds", },
++	{ .compatible = "gpio-keys", },
+ 	/* For all PCI controllers */
+ 	{ .compatible = "fsl,mpc8540-pci", },
+ 	{ .compatible = "fsl,mpc8548-pcie", },
diff --git a/target/linux/mpc85xx/patches-5.15/100-powerpc-85xx-tl-wdr4900-v1-support.patch b/target/linux/mpc85xx/patches-5.15/100-powerpc-85xx-tl-wdr4900-v1-support.patch
new file mode 100644
index 00000000000000..0ecbec3ca413c2
--- /dev/null
+++ b/target/linux/mpc85xx/patches-5.15/100-powerpc-85xx-tl-wdr4900-v1-support.patch
@@ -0,0 +1,83 @@
+From 1d9f596e572917772b87a2a37e1680902964782f Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Wed, 20 Feb 2013 08:40:33 +0100
+Subject: [PATCH] powerpc: 85xx: add support for the TP-Link TL-WDR4900 v1
+ board
+
+This patch adds support for the TP-Link TL-WDR4900 v1
+concurrent dual-band wireless router. The devices uses
+the Freescale P1014 SoC.
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+---
+ arch/powerpc/boot/Makefile           |  3 ++-
+ arch/powerpc/boot/wrapper            |  5 +++++
+ arch/powerpc/platforms/85xx/Kconfig  | 12 ++++++++++++
+ arch/powerpc/platforms/85xx/Makefile |  1 +
+ 4 files changed, 20 insertions(+), 1 deletion(-)
+
+--- a/arch/powerpc/boot/Makefile
++++ b/arch/powerpc/boot/Makefile
+@@ -163,6 +163,7 @@ src-plat-$(CONFIG_PPC_PSERIES) += pserie
+ src-plat-$(CONFIG_PPC_POWERNV) += pseries-head.S
+ src-plat-$(CONFIG_PPC_IBM_CELL_BLADE) += pseries-head.S
+ src-plat-$(CONFIG_MVME7100) += motload-head.S mvme7100.c
++src-plat-$(CONFIG_TL_WDR4900_V1) += simpleboot.c fixed-head.S
+ 
+ src-plat-$(CONFIG_PPC_MICROWATT) += fixed-head.S microwatt.c
+ 
+@@ -343,7 +344,7 @@ image-$(CONFIG_TQM8548)			+= cuImage.tqm
+ image-$(CONFIG_TQM8555)			+= cuImage.tqm8555
+ image-$(CONFIG_TQM8560)			+= cuImage.tqm8560
+ image-$(CONFIG_KSI8560)			+= cuImage.ksi8560
+-
++image-$(CONFIG_TL_WDR4900_V1)		+= simpleImage.tl-wdr4900-v1
+ # Board ports in arch/powerpc/platform/86xx/Kconfig
+ image-$(CONFIG_MVME7100)                += dtbImage.mvme7100
+ 
+--- a/arch/powerpc/boot/wrapper
++++ b/arch/powerpc/boot/wrapper
+@@ -339,6 +339,11 @@ adder875-redboot)
+     platformo="$object/fixed-head.o $object/redboot-8xx.o"
+     binary=y
+     ;;
++simpleboot-tl-wdr4900-v1)
++    platformo="$object/fixed-head.o $object/simpleboot.o"
++    link_address='0x1000000'
++    binary=y
++    ;;
+ simpleboot-*)
+     platformo="$object/fixed-head.o $object/simpleboot.o"
+     binary=y
+--- a/arch/powerpc/platforms/85xx/Kconfig
++++ b/arch/powerpc/platforms/85xx/Kconfig
+@@ -170,6 +170,18 @@ config STX_GP3
+ 	select CPM2
+ 	select DEFAULT_UIMAGE
+ 
++config TL_WDR4900_V1
++    bool "TP-Link TL-WDR4900 v1"
++    select DEFAULT_UIMAGE
++    select ARCH_REQUIRE_GPIOLIB
++    select GPIO_MPC8XXX
++    select SWIOTLB
++    help
++      This option enables support for the TP-Link TL-WDR4900 v1 board.
++
++      This board is a Concurrent Dual-Band wireless router with a
++      Freescale P1014 SoC.
++
+ config TQM8540
+ 	bool "TQ Components TQM8540"
+ 	help
+--- a/arch/powerpc/platforms/85xx/Makefile
++++ b/arch/powerpc/platforms/85xx/Makefile
+@@ -27,6 +27,7 @@ obj-$(CONFIG_TWR_P102x)   += twr_p102x.o
+ obj-$(CONFIG_CORENET_GENERIC)   += corenet_generic.o
+ obj-$(CONFIG_FB_FSL_DIU)	+= t1042rdb_diu.o
+ obj-$(CONFIG_STX_GP3)	  += stx_gp3.o
++obj-$(CONFIG_TL_WDR4900_V1) += tl_wdr4900_v1.o
+ obj-$(CONFIG_TQM85xx)	  += tqm85xx.o
+ obj-$(CONFIG_PPA8548)     += ppa8548.o
+ obj-$(CONFIG_SOCRATES)    += socrates.o socrates_fpga_pic.o
diff --git a/target/linux/mpc85xx/patches-5.15/101-powerpc-85xx-hiveap-330-support.patch b/target/linux/mpc85xx/patches-5.15/101-powerpc-85xx-hiveap-330-support.patch
new file mode 100644
index 00000000000000..da95cd27162109
--- /dev/null
+++ b/target/linux/mpc85xx/patches-5.15/101-powerpc-85xx-hiveap-330-support.patch
@@ -0,0 +1,30 @@
+--- a/arch/powerpc/platforms/85xx/Kconfig
++++ b/arch/powerpc/platforms/85xx/Kconfig
+@@ -49,6 +49,17 @@ config BSC9132_QDS
+ 	  and dual StarCore SC3850 DSP cores.
+ 	  Manufacturer : Freescale Semiconductor, Inc
+ 
++config HIVEAP_330
++    bool "Aerohive HiveAP-330"
++    select DEFAULT_UIMAGE
++    select ARCH_REQUIRE_GPIOLIB
++    select GPIO_MPC8XXX
++    help
++      This option enables support for the Aerohive HiveAP-330 board.
++
++      This board is a Concurrent Dual-Band wireless access point with a
++      Freescale P1020 SoC.
++
+ config MPC8540_ADS
+ 	bool "Freescale MPC8540 ADS"
+ 	select DEFAULT_UIMAGE
+--- a/arch/powerpc/platforms/85xx/Makefile
++++ b/arch/powerpc/platforms/85xx/Makefile
+@@ -12,6 +12,7 @@ obj-y += common.o
+ obj-$(CONFIG_BSC9131_RDB) += bsc913x_rdb.o
+ obj-$(CONFIG_BSC9132_QDS) += bsc913x_qds.o
+ obj-$(CONFIG_C293_PCIE)   += c293pcie.o
++obj-$(CONFIG_HIVEAP_330) += hiveap-330.o
+ obj-$(CONFIG_MPC8540_ADS) += mpc85xx_ads.o
+ obj-$(CONFIG_MPC8560_ADS) += mpc85xx_ads.o
+ obj-$(CONFIG_MPC85xx_CDS) += mpc85xx_cds.o
diff --git a/target/linux/mpc85xx/patches-5.15/102-powerpc-add-cmdline-override.patch b/target/linux/mpc85xx/patches-5.15/102-powerpc-add-cmdline-override.patch
new file mode 100644
index 00000000000000..0d26dc85015296
--- /dev/null
+++ b/target/linux/mpc85xx/patches-5.15/102-powerpc-add-cmdline-override.patch
@@ -0,0 +1,37 @@
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -915,6 +915,14 @@ config CMDLINE_FORCE
+ 
+ endchoice
+ 
++config CMDLINE_OVERRIDE
++    bool "Use alternative cmdline from device tree"
++    help
++      Some bootloaders may have uneditable bootargs. While CMDLINE_FORCE can
++      be used, this is not a good option for kernels that are shared across
++      devices. This setting enables using "chosen/cmdline-override" as the
++      cmdline if it exists in the device tree.
++
+ config EXTRA_TARGETS
+ 	string "Additional default image types"
+ 	help
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -1162,6 +1162,17 @@ int __init early_init_dt_scan_chosen(uns
+ 	if (p != NULL && l > 0)
+ 		strlcat(data, p, min_t(int, strlen(data) + (int)l, COMMAND_LINE_SIZE));
+ 
++    /* CONFIG_CMDLINE_OVERRIDE is used to fallback to a different
++     * device tree option of chosen/bootargs-override. This is
++     * helpful on boards where u-boot sets bootargs, and is unable
++     * to be modified.
++     */
++#ifdef CONFIG_CMDLINE_OVERRIDE
++	p = of_get_flat_dt_prop(node, "bootargs-override", &l);
++	if (p != NULL && l > 0)
++		strlcpy(data, p, min((int)l, COMMAND_LINE_SIZE));
++#endif
++
+ 	/*
+ 	 * CONFIG_CMDLINE is meant to be a default in case nothing else
+ 	 * managed to set the command line, unless CONFIG_CMDLINE_FORCE
diff --git a/target/linux/mpc85xx/patches-5.15/103-powerpc-85xx-red-15w-rev1.patch b/target/linux/mpc85xx/patches-5.15/103-powerpc-85xx-red-15w-rev1.patch
new file mode 100644
index 00000000000000..66044878eb6126
--- /dev/null
+++ b/target/linux/mpc85xx/patches-5.15/103-powerpc-85xx-red-15w-rev1.patch
@@ -0,0 +1,29 @@
+--- a/arch/powerpc/platforms/85xx/Kconfig
++++ b/arch/powerpc/platforms/85xx/Kconfig
+@@ -173,6 +173,16 @@ config XES_MPC85xx
+ 	  Manufacturer: Extreme Engineering Solutions, Inc.
+ 	  URL: <https://www.xes-inc.com/>
+ 
++config RED_15W_REV1
++	bool "Sophos RED 15w Rev.1"
++	select DEFAULT_UIMAGE
++	select ARCH_REQUIRE_GPIOLIB
++	select GPIO_MPC8XXX
++	help
++	  This option enables support for the Sophos RED 15w Rev.1 board.
++
++	  This board is a wireless VPN router with a Freescale P1010 SoC.
++
+ config STX_GP3
+ 	bool "Silicon Turnkey Express GP3"
+ 	help
+--- a/arch/powerpc/platforms/85xx/Makefile
++++ b/arch/powerpc/platforms/85xx/Makefile
+@@ -27,6 +27,7 @@ obj-$(CONFIG_P1023_RDB)   += p1023_rdb.o
+ obj-$(CONFIG_TWR_P102x)   += twr_p102x.o
+ obj-$(CONFIG_CORENET_GENERIC)   += corenet_generic.o
+ obj-$(CONFIG_FB_FSL_DIU)	+= t1042rdb_diu.o
++obj-$(CONFIG_RED_15W_REV1)	+= red15w_rev1.o
+ obj-$(CONFIG_STX_GP3)	  += stx_gp3.o
+ obj-$(CONFIG_TL_WDR4900_V1) += tl_wdr4900_v1.o
+ obj-$(CONFIG_TQM85xx)	  += tqm85xx.o
diff --git a/target/linux/mpc85xx/patches-5.15/104-powerpc-mpc85xx-change-P2020RDB-dts-file-for-OpenWRT.patch b/target/linux/mpc85xx/patches-5.15/104-powerpc-mpc85xx-change-P2020RDB-dts-file-for-OpenWRT.patch
new file mode 100644
index 00000000000000..94ed26c3df0f17
--- /dev/null
+++ b/target/linux/mpc85xx/patches-5.15/104-powerpc-mpc85xx-change-P2020RDB-dts-file-for-OpenWRT.patch
@@ -0,0 +1,170 @@
+From 93514afd769c305182beeed1f9c4c46235879ef8 Mon Sep 17 00:00:00 2001
+From: Pawel Dembicki <paweldembicki@gmail.com>
+Date: Sun, 30 Dec 2018 23:24:41 +0100
+Subject: [PATCH] powerpc: mpc85xx: change P2020RDB dts file for OpenWRT
+
+This patch apply chages for OpenWRT in P2020RDB
+dts file.
+
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+---
+ arch/powerpc/boot/dts/fsl/p2020rdb.dts | 98 +++++++++++++++++---------
+ 1 file changed, 63 insertions(+), 35 deletions(-)
+
+--- a/arch/powerpc/boot/dts/fsl/p2020rdb.dts
++++ b/arch/powerpc/boot/dts/fsl/p2020rdb.dts
+@@ -5,10 +5,15 @@
+  * Copyright 2009-2012 Freescale Semiconductor Inc.
+  */
+ 
++/dts-v1/;
++
+ /include/ "p2020si-pre.dtsi"
+ 
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/input/input.h>
++
+ / {
+-	model = "fsl,P2020RDB";
++	model = "Freescale P2020RDB";
+ 	compatible = "fsl,P2020RDB";
+ 
+ 	aliases {
+@@ -34,48 +39,38 @@
+ 			  0x2 0x0 0x0 0xffb00000 0x00020000>;
+ 
+ 		nor@0,0 {
+-			#address-cells = <1>;
+-			#size-cells = <1>;
+ 			compatible = "cfi-flash";
+ 			reg = <0x0 0x0 0x1000000>;
+ 			bank-width = <2>;
+ 			device-width = <1>;
+ 
+-			partition@0 {
+-				/* This location must not be altered  */
+-				/* 256KB for Vitesse 7385 Switch firmware */
+-				reg = <0x0 0x00040000>;
+-				label = "NOR (RO) Vitesse-7385 Firmware";
+-				read-only;
+-			};
+-
+-			partition@40000 {
+-				/* 256KB for DTB Image */
+-				reg = <0x00040000 0x00040000>;
+-				label = "NOR (RO) DTB Image";
+-				read-only;
+-			};
++			partitions {
++				compatible = "fixed-partitions";
++				#address-cells = <1>;
++				#size-cells = <1>;
+ 
+-			partition@80000 {
+-				/* 3.5 MB for Linux Kernel Image */
+-				reg = <0x00080000 0x00380000>;
+-				label = "NOR (RO) Linux Kernel Image";
+-				read-only;
+-			};
++				partition@0 {
++					/* This location must not be altered  */
++					/* 256KB for Vitesse 7385 Switch firmware */
++					reg = <0x0 0x00040000>;
++					label = "NOR (RO) Vitesse-7385 Firmware";
++					read-only;
++				};
+ 
+-			partition@400000 {
+-				/* 11MB for JFFS2 based Root file System */
+-				reg = <0x00400000 0x00b00000>;
+-				label = "NOR (RW) JFFS2 Root File System";
+-			};
++				partition@40000 {
++					compatible = "denx,fit";
++					reg = <0x00040000 0x00ec0000>;
++					label = "firmware";
++				};
+ 
+-			partition@f00000 {
+-				/* This location must not be altered  */
+-				/* 512KB for u-boot Bootloader Image */
+-				/* 512KB for u-boot Environment Variables */
+-				reg = <0x00f00000 0x00100000>;
+-				label = "NOR (RO) U-Boot Image";
+-				read-only;
++				partition@f00000 {
++					/* This location must not be altered  */
++					/* 512KB for u-boot Bootloader Image */
++					/* 512KB for u-boot Environment Variables */
++					reg = <0x00f00000 0x00100000>;
++					label = "u-boot";
++					read-only;
++				};
+ 			};
+ 		};
+ 
+@@ -85,6 +80,7 @@
+ 			compatible = "fsl,p2020-fcm-nand",
+ 				     "fsl,elbc-fcm-nand";
+ 			reg = <0x1 0x0 0x40000>;
++			nand-ecc-mode = "none";
+ 
+ 			partition@0 {
+ 				/* This location must not be altered  */
+@@ -140,13 +136,43 @@
+ 	soc: soc@ffe00000 {
+ 		ranges = <0x0 0x0 0xffe00000 0x100000>;
+ 
++		gpio0: gpio-controller@fc00 {
++		};
++
+ 		i2c@3000 {
++			temperature-sensor@4c {
++				compatible = "adi,adt7461";
++				reg = <0x4c>;
++			};
++
++			eeprom@50 {
++				compatible = "atmel,24c256";
++				reg = <0x50>;
++			};
++
+ 			rtc@68 {
+ 				compatible = "dallas,ds1339";
+ 				reg = <0x68>;
+ 			};
+ 		};
+ 
++		i2c@3100 {
++			pmic@11 {
++				compatible = "zl2006";
++				reg = <0x11>;
++			};
++
++			gpio@18 {
++				compatible = "nxp,pca9557";
++				reg = <0x18>;
++			};
++
++			eeprom@52 {
++				compatible = "atmel,24c01";
++				reg = <0x52>;
++			};
++		};
++
+ 		spi@7000 {
+ 			flash@0 {
+ 				#address-cells = <1>;
+@@ -200,10 +226,12 @@
+ 			phy0: ethernet-phy@0 {
+ 				interrupts = <3 1 0 0>;
+ 				reg = <0x0>;
++				reset-gpios = <&gpio0 14 GPIO_ACTIVE_LOW>;
+ 			};
+ 			phy1: ethernet-phy@1 {
+ 				interrupts = <3 1 0 0>;
+ 				reg = <0x1>;
++				reset-gpios = <&gpio0 6 GPIO_ACTIVE_LOW>;
+ 			};
+ 			tbi-phy@2 {
+ 				device_type = "tbi-phy";
diff --git a/target/linux/mpc85xx/patches-5.15/105-powerpc-85xx-panda-support.patch b/target/linux/mpc85xx/patches-5.15/105-powerpc-85xx-panda-support.patch
new file mode 100644
index 00000000000000..4913c614a80325
--- /dev/null
+++ b/target/linux/mpc85xx/patches-5.15/105-powerpc-85xx-panda-support.patch
@@ -0,0 +1,30 @@
+--- a/arch/powerpc/platforms/85xx/Kconfig
++++ b/arch/powerpc/platforms/85xx/Kconfig
+@@ -60,6 +60,17 @@ config HIVEAP_330
+       This board is a Concurrent Dual-Band wireless access point with a
+       Freescale P1020 SoC.
+ 
++config PANDA
++	bool "OCEDO PANDA"
++	select DEFAULT_UIMAGE
++	select ARCH_REQUIRE_GPIOLIB
++	select GPIO_MPC8XXX
++	help
++	  This option enables support for the OCEDO PANDA board.
++
++	  This board is a Concurrent Dual-Band wireless access point with a
++	  Freescale P1020 SoC.
++
+ config MPC8540_ADS
+ 	bool "Freescale MPC8540 ADS"
+ 	select DEFAULT_UIMAGE
+--- a/arch/powerpc/platforms/85xx/Makefile
++++ b/arch/powerpc/platforms/85xx/Makefile
+@@ -24,6 +24,7 @@ obj-$(CONFIG_P1010_RDB)   += p1010rdb.o
+ obj-$(CONFIG_P1022_DS)    += p1022_ds.o
+ obj-$(CONFIG_P1022_RDK)   += p1022_rdk.o
+ obj-$(CONFIG_P1023_RDB)   += p1023_rdb.o
++obj-$(CONFIG_PANDA)       += panda.o
+ obj-$(CONFIG_TWR_P102x)   += twr_p102x.o
+ obj-$(CONFIG_CORENET_GENERIC)   += corenet_generic.o
+ obj-$(CONFIG_FB_FSL_DIU)	+= t1042rdb_diu.o
diff --git a/target/linux/mpc85xx/patches-5.15/106-powerpc-85xx-ws-ap3710i-support.patch b/target/linux/mpc85xx/patches-5.15/106-powerpc-85xx-ws-ap3710i-support.patch
new file mode 100644
index 00000000000000..124376ffd9972e
--- /dev/null
+++ b/target/linux/mpc85xx/patches-5.15/106-powerpc-85xx-ws-ap3710i-support.patch
@@ -0,0 +1,30 @@
+--- a/arch/powerpc/platforms/85xx/Kconfig
++++ b/arch/powerpc/platforms/85xx/Kconfig
+@@ -71,6 +71,17 @@ config PANDA
+ 	  This board is a Concurrent Dual-Band wireless access point with a
+ 	  Freescale P1020 SoC.
+ 
++config WS_AP3710I
++	bool "Enterasys WS-AP3710i"
++	select DEFAULT_UIMAGE
++	select ARCH_REQUIRE_GPIOLIB
++	select GPIO_MPC8XXX
++	help
++	  This option enables support for the Enterasys WS-AP3710i board.
++
++	  This board is a Concurrent Dual-Band wireless access point with a
++	  Freescale P1020 SoC.
++
+ config MPC8540_ADS
+ 	bool "Freescale MPC8540 ADS"
+ 	select DEFAULT_UIMAGE
+--- a/arch/powerpc/platforms/85xx/Makefile
++++ b/arch/powerpc/platforms/85xx/Makefile
+@@ -26,6 +26,7 @@ obj-$(CONFIG_P1022_RDK)   += p1022_rdk.o
+ obj-$(CONFIG_P1023_RDB)   += p1023_rdb.o
+ obj-$(CONFIG_PANDA)       += panda.o
+ obj-$(CONFIG_TWR_P102x)   += twr_p102x.o
++obj-$(CONFIG_WS_AP3710I)  += ws-ap3710i.o
+ obj-$(CONFIG_CORENET_GENERIC)   += corenet_generic.o
+ obj-$(CONFIG_FB_FSL_DIU)	+= t1042rdb_diu.o
+ obj-$(CONFIG_RED_15W_REV1)	+= red15w_rev1.o
diff --git a/target/linux/mpc85xx/patches-5.15/107-powerpc-85xx-add-ws-ap3825i-support.patch b/target/linux/mpc85xx/patches-5.15/107-powerpc-85xx-add-ws-ap3825i-support.patch
new file mode 100644
index 00000000000000..bd731a23445026
--- /dev/null
+++ b/target/linux/mpc85xx/patches-5.15/107-powerpc-85xx-add-ws-ap3825i-support.patch
@@ -0,0 +1,65 @@
+From 2fa1a7983ef30f3c7486f9b07c001bee87d1f6d6 Mon Sep 17 00:00:00 2001
+From: Martin Kennedy <hurricos@gmail.com>
+Date: Sat, 1 Jan 2022 11:01:37 -0500
+Subject: [PATCH] PowerPC 85xx: Add WS-AP3825i support
+
+This patch adds support for building Linux for the Extreme Networks
+WS-AP3825i AP.
+
+--- a/arch/powerpc/platforms/85xx/Kconfig
++++ b/arch/powerpc/platforms/85xx/Kconfig
+@@ -82,6 +82,16 @@ config WS_AP3710I
+ 	  This board is a Concurrent Dual-Band wireless access point with a
+ 	  Freescale P1020 SoC.
+ 
++config WS_AP3825I
++	bool "Extreme Networks WS-AP3825i"
++	select DEFAULT_UIMAGE
++	select ARCH_REQUIRE_GPIOLIB
++	select GPIO_MPC8XXX
++	help
++	  This option enables support for the Extreme Networks WS-AP3825i board.
++	  This board is a Concurrent Dual-Band wireless access point with a
++	  Freescale P1020 SoC.
++
+ config MPC8540_ADS
+ 	bool "Freescale MPC8540 ADS"
+ 	select DEFAULT_UIMAGE
+--- a/arch/powerpc/platforms/85xx/Makefile
++++ b/arch/powerpc/platforms/85xx/Makefile
+@@ -27,6 +27,7 @@ obj-$(CONFIG_P1023_RDB)   += p1023_rdb.o
+ obj-$(CONFIG_PANDA)       += panda.o
+ obj-$(CONFIG_TWR_P102x)   += twr_p102x.o
+ obj-$(CONFIG_WS_AP3710I)  += ws-ap3710i.o
++obj-$(CONFIG_WS_AP3825I)  += ws-ap3825i.o
+ obj-$(CONFIG_CORENET_GENERIC)   += corenet_generic.o
+ obj-$(CONFIG_FB_FSL_DIU)	+= t1042rdb_diu.o
+ obj-$(CONFIG_RED_15W_REV1)	+= red15w_rev1.o
+--- a/arch/powerpc/boot/Makefile
++++ b/arch/powerpc/boot/Makefile
+@@ -164,6 +164,7 @@ src-plat-$(CONFIG_PPC_POWERNV) += pserie
+ src-plat-$(CONFIG_PPC_IBM_CELL_BLADE) += pseries-head.S
+ src-plat-$(CONFIG_MVME7100) += motload-head.S mvme7100.c
+ src-plat-$(CONFIG_TL_WDR4900_V1) += simpleboot.c fixed-head.S
++src-plat-$(CONFIG_WS_AP3825I) += simpleboot.c fixed-head.S
+ 
+ src-plat-$(CONFIG_PPC_MICROWATT) += fixed-head.S microwatt.c
+ 
+@@ -345,6 +346,7 @@ image-$(CONFIG_TQM8555)			+= cuImage.tqm
+ image-$(CONFIG_TQM8560)			+= cuImage.tqm8560
+ image-$(CONFIG_KSI8560)			+= cuImage.ksi8560
+ image-$(CONFIG_TL_WDR4900_V1)		+= simpleImage.tl-wdr4900-v1
++image-$(CONFIG_WS_AP3825I)		+= simpleImage.ws-ap3825i
+ # Board ports in arch/powerpc/platform/86xx/Kconfig
+ image-$(CONFIG_MVME7100)                += dtbImage.mvme7100
+ 
+--- a/arch/powerpc/boot/wrapper
++++ b/arch/powerpc/boot/wrapper
+@@ -339,6 +339,7 @@ adder875-redboot)
+     platformo="$object/fixed-head.o $object/redboot-8xx.o"
+     binary=y
+     ;;
++simpleboot-ws-ap3825i|\
+ simpleboot-tl-wdr4900-v1)
+     platformo="$object/fixed-head.o $object/simpleboot.o"
+     link_address='0x1000000'
diff --git a/target/linux/mpc85xx/patches-5.15/108-powerpc-85xx-firebox-t10-support.patch.patch b/target/linux/mpc85xx/patches-5.15/108-powerpc-85xx-firebox-t10-support.patch.patch
new file mode 100644
index 00000000000000..b074113eaa5a9f
--- /dev/null
+++ b/target/linux/mpc85xx/patches-5.15/108-powerpc-85xx-firebox-t10-support.patch.patch
@@ -0,0 +1,29 @@
+--- a/arch/powerpc/platforms/85xx/Kconfig
++++ b/arch/powerpc/platforms/85xx/Kconfig
+@@ -92,6 +92,16 @@ config WS_AP3825I
+ 	  This board is a Concurrent Dual-Band wireless access point with a
+ 	  Freescale P1020 SoC.
+ 
++config FIREBOX_T10
++	bool "Watchguard Firebox T10"
++	select DEFAULT_UIMAGE
++	select ARCH_REQUIRE_GPIOLIB
++	select GPIO_MPC8XXX
++	help
++	  This option enables support for the Watchguard Firebox T10 board.
++	  This board is a VPN Gateway-Router with a
++	  Freescale P1010 SoC.
++
+ config MPC8540_ADS
+ 	bool "Freescale MPC8540 ADS"
+ 	select DEFAULT_UIMAGE
+--- a/arch/powerpc/platforms/85xx/Makefile
++++ b/arch/powerpc/platforms/85xx/Makefile
+@@ -28,6 +28,7 @@ obj-$(CONFIG_PANDA)       += panda.o
+ obj-$(CONFIG_TWR_P102x)   += twr_p102x.o
+ obj-$(CONFIG_WS_AP3710I)  += ws-ap3710i.o
+ obj-$(CONFIG_WS_AP3825I)  += ws-ap3825i.o
++obj-$(CONFIG_FIREBOX_T10) += firebox_t10.o
+ obj-$(CONFIG_CORENET_GENERIC)   += corenet_generic.o
+ obj-$(CONFIG_FB_FSL_DIU)	+= t1042rdb_diu.o
+ obj-$(CONFIG_RED_15W_REV1)	+= red15w_rev1.o
diff --git a/target/linux/mpc85xx/patches-5.15/109-powerpc-85xx-add-ws-ap3715i-support.patch b/target/linux/mpc85xx/patches-5.15/109-powerpc-85xx-add-ws-ap3715i-support.patch
new file mode 100644
index 00000000000000..692cef0417db82
--- /dev/null
+++ b/target/linux/mpc85xx/patches-5.15/109-powerpc-85xx-add-ws-ap3715i-support.patch
@@ -0,0 +1,50 @@
+--- a/arch/powerpc/platforms/85xx/Kconfig
++++ b/arch/powerpc/platforms/85xx/Kconfig
+@@ -82,6 +82,17 @@ config WS_AP3710I
+ 	  This board is a Concurrent Dual-Band wireless access point with a
+ 	  Freescale P1020 SoC.
+ 
++config WS_AP3715I
++	bool "Enterasys WS-AP3715i"
++	select DEFAULT_UIMAGE
++	select ARCH_REQUIRE_GPIOLIB
++	select GPIO_MPC8XXX
++	help
++	  This option enables support for the Enterasys WS-AP3715i board.
++
++	  This board is a Concurrent Dual-Band wireless access point with a
++	  Freescale P1010 SoC.
++
+ config WS_AP3825I
+ 	bool "Extreme Networks WS-AP3825i"
+ 	select DEFAULT_UIMAGE
+--- a/arch/powerpc/platforms/85xx/Makefile
++++ b/arch/powerpc/platforms/85xx/Makefile
+@@ -27,6 +27,7 @@ obj-$(CONFIG_P1023_RDB)   += p1023_rdb.o
+ obj-$(CONFIG_PANDA)       += panda.o
+ obj-$(CONFIG_TWR_P102x)   += twr_p102x.o
+ obj-$(CONFIG_WS_AP3710I)  += ws-ap3710i.o
++obj-$(CONFIG_WS_AP3715I)  += ws-ap3715i.o
+ obj-$(CONFIG_WS_AP3825I)  += ws-ap3825i.o
+ obj-$(CONFIG_FIREBOX_T10) += firebox_t10.o
+ obj-$(CONFIG_CORENET_GENERIC)   += corenet_generic.o
+--- a/arch/powerpc/boot/Makefile
++++ b/arch/powerpc/boot/Makefile
+@@ -346,6 +346,7 @@ image-$(CONFIG_TQM8555)			+= cuImage.tqm
+ image-$(CONFIG_TQM8560)			+= cuImage.tqm8560
+ image-$(CONFIG_KSI8560)			+= cuImage.ksi8560
+ image-$(CONFIG_TL_WDR4900_V1)		+= simpleImage.tl-wdr4900-v1
++image-$(CONFIG_WS_AP3715I)		+= simpleImage.ws-ap3715i
+ image-$(CONFIG_WS_AP3825I)		+= simpleImage.ws-ap3825i
+ # Board ports in arch/powerpc/platform/86xx/Kconfig
+ image-$(CONFIG_MVME7100)                += dtbImage.mvme7100
+--- a/arch/powerpc/boot/wrapper
++++ b/arch/powerpc/boot/wrapper
+@@ -339,6 +339,7 @@ adder875-redboot)
+     platformo="$object/fixed-head.o $object/redboot-8xx.o"
+     binary=y
+     ;;
++simpleboot-ws-ap3715i|\
+ simpleboot-ws-ap3825i|\
+ simpleboot-tl-wdr4900-v1)
+     platformo="$object/fixed-head.o $object/simpleboot.o"
diff --git a/target/linux/mpc85xx/patches-5.15/110-powerpc-85xx-br200-wp-support.patch b/target/linux/mpc85xx/patches-5.15/110-powerpc-85xx-br200-wp-support.patch
new file mode 100644
index 00000000000000..eb70a4c4c47890
--- /dev/null
+++ b/target/linux/mpc85xx/patches-5.15/110-powerpc-85xx-br200-wp-support.patch
@@ -0,0 +1,57 @@
+--- a/arch/powerpc/platforms/85xx/Kconfig
++++ b/arch/powerpc/platforms/85xx/Kconfig
+@@ -49,6 +49,16 @@ config BSC9132_QDS
+ 	  and dual StarCore SC3850 DSP cores.
+ 	  Manufacturer : Freescale Semiconductor, Inc
+ 
++config BR200_WP
++    bool "Aerohive BR200-WP"
++    select DEFAULT_UIMAGE
++    select ARCH_REQUIRE_GPIOLIB
++    select GPIO_MPC8XXX
++    help
++      This option enables support for the Aerohive BR200-WP board.
++
++      This board is a wireless router with a Freescale P1011 SoC.
++
+ config HIVEAP_330
+     bool "Aerohive HiveAP-330"
+     select DEFAULT_UIMAGE
+--- a/arch/powerpc/platforms/85xx/Makefile
++++ b/arch/powerpc/platforms/85xx/Makefile
+@@ -12,6 +12,7 @@ obj-y += common.o
+ obj-$(CONFIG_BSC9131_RDB) += bsc913x_rdb.o
+ obj-$(CONFIG_BSC9132_QDS) += bsc913x_qds.o
+ obj-$(CONFIG_C293_PCIE)   += c293pcie.o
++obj-$(CONFIG_BR200_WP) += br200-wp.o
+ obj-$(CONFIG_HIVEAP_330) += hiveap-330.o
+ obj-$(CONFIG_MPC8540_ADS) += mpc85xx_ads.o
+ obj-$(CONFIG_MPC8560_ADS) += mpc85xx_ads.o
+--- a/arch/powerpc/boot/Makefile
++++ b/arch/powerpc/boot/Makefile
+@@ -163,6 +163,7 @@ src-plat-$(CONFIG_PPC_PSERIES) += pserie
+ src-plat-$(CONFIG_PPC_POWERNV) += pseries-head.S
+ src-plat-$(CONFIG_PPC_IBM_CELL_BLADE) += pseries-head.S
+ src-plat-$(CONFIG_MVME7100) += motload-head.S mvme7100.c
++src-plat-$(CONFIG_BR200_WP) += simpleboot.c fixed-head.S
+ src-plat-$(CONFIG_TL_WDR4900_V1) += simpleboot.c fixed-head.S
+ src-plat-$(CONFIG_WS_AP3825I) += simpleboot.c fixed-head.S
+ 
+@@ -345,6 +346,7 @@ image-$(CONFIG_TQM8548)			+= cuImage.tqm
+ image-$(CONFIG_TQM8555)			+= cuImage.tqm8555
+ image-$(CONFIG_TQM8560)			+= cuImage.tqm8560
+ image-$(CONFIG_KSI8560)			+= cuImage.ksi8560
++image-$(CONFIG_BR200_WP)		+= simpleImage.br200-wp
+ image-$(CONFIG_TL_WDR4900_V1)		+= simpleImage.tl-wdr4900-v1
+ image-$(CONFIG_WS_AP3715I)		+= simpleImage.ws-ap3715i
+ image-$(CONFIG_WS_AP3825I)		+= simpleImage.ws-ap3825i
+--- a/arch/powerpc/boot/wrapper
++++ b/arch/powerpc/boot/wrapper
+@@ -339,6 +339,7 @@ adder875-redboot)
+     platformo="$object/fixed-head.o $object/redboot-8xx.o"
+     binary=y
+     ;;
++simpleboot-br200-wp|\
+ simpleboot-ws-ap3715i|\
+ simpleboot-ws-ap3825i|\
+ simpleboot-tl-wdr4900-v1)
diff --git a/target/linux/mpc85xx/patches-5.15/900-powerpc-bootwrapper-disable-uImage-generation.patch b/target/linux/mpc85xx/patches-5.15/900-powerpc-bootwrapper-disable-uImage-generation.patch
new file mode 100644
index 00000000000000..1af5aefe0bdda1
--- /dev/null
+++ b/target/linux/mpc85xx/patches-5.15/900-powerpc-bootwrapper-disable-uImage-generation.patch
@@ -0,0 +1,42 @@
+From d43ab14605510d9d2bd257a8cd70f24ada4621b0 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sat, 29 Feb 2020 14:27:04 +0100
+Subject: [PATCH] powerpc: bootwrapper: disable uImage generation
+
+Due to CONFIG_KERNEL_XZ symbol, the bootwrapper code tries to
+instruct the mkimage to use the xz compression, which isn't
+supported. This disables the uImage generation, as OpenWrt
+generates individual uImages for each board using it's own
+toolchain.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ arch/powerpc/boot/Makefile | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+--- a/arch/powerpc/boot/Makefile
++++ b/arch/powerpc/boot/Makefile
+@@ -274,7 +274,6 @@ image-$(CONFIG_PPC_CHRP)		+= zImage.chrp
+ image-$(CONFIG_PPC_EFIKA)		+= zImage.chrp
+ image-$(CONFIG_PPC_PMAC)		+= zImage.pmac
+ image-$(CONFIG_PPC_HOLLY)		+= dtbImage.holly
+-image-$(CONFIG_DEFAULT_UIMAGE)		+= uImage
+ image-$(CONFIG_EPAPR_BOOT)		+= zImage.epapr
+ 
+ #
+@@ -409,15 +408,6 @@ $(obj)/dtbImage.%: vmlinux $(wrapperbits
+ $(obj)/vmlinux.strip: vmlinux
+ 	$(STRIP) -s -R .comment $< -o $@
+ 
+-$(obj)/uImage: vmlinux $(wrapperbits) FORCE
+-	$(call if_changed,wrap,uboot)
+-
+-$(obj)/uImage.initrd.%: vmlinux $(obj)/dts/%.dtb $(wrapperbits) FORCE
+-	$(call if_changed,wrap,uboot-$*,,$(obj)/dts/$*.dtb,$(obj)/ramdisk.image.gz)
+-
+-$(obj)/uImage.%: vmlinux $(obj)/dts/%.dtb $(wrapperbits) FORCE
+-	$(call if_changed,wrap,uboot-$*,,$(obj)/dts/$*.dtb)
+-
+ $(obj)/cuImage.initrd.%: vmlinux $(obj)/dts/%.dtb $(wrapperbits) FORCE
+ 	$(call if_changed,wrap,cuboot-$*,,$(obj)/dts/$*.dtb,$(obj)/ramdisk.image.gz)
+ 
diff --git a/target/linux/mvebu/Makefile b/target/linux/mvebu/Makefile
index 6a1e0f63f70510..2971f3fcaf504a 100644
--- a/target/linux/mvebu/Makefile
+++ b/target/linux/mvebu/Makefile
@@ -9,8 +9,7 @@ BOARDNAME:=Marvell EBU Armada
 FEATURES:=fpu usb pci pcie gpio nand squashfs ramdisk boot-part rootfs-part legacy-sdcard targz
 SUBTARGETS:=cortexa9 cortexa53 cortexa72
 
-KERNEL_PATCHVER:=5.10
-KERNEL_TESTING_PATCHVER:=5.15
+KERNEL_PATCHVER:=5.15
 
 include $(INCLUDE_DIR)/target.mk
 
diff --git a/target/linux/mvebu/cortexa53/base-files/lib/upgrade/uDPU.sh b/target/linux/mvebu/cortexa53/base-files/lib/upgrade/uDPU.sh
index 0bb1dd12cc8d32..b01ad607ee251f 100644
--- a/target/linux/mvebu/cortexa53/base-files/lib/upgrade/uDPU.sh
+++ b/target/linux/mvebu/cortexa53/base-files/lib/upgrade/uDPU.sh
@@ -18,10 +18,10 @@ udpu_check_emmc() {
 }
 
 udpu_part_prep() {
-	 if [ "$(grep $1 /proc/mounts)" ]; then
-		mounted_part="$(grep $1 /proc/mounts | awk '{print $2}' | head -1)"
-		umount $mounted_part
-		[ "$(grep -wo $mounted_part /proc/mounts)" ] && umount -l $mounted_part
+	 if grep -q "$1" /proc/mounts; then
+		mounted_part="$(grep -m 1 $1 /proc/mounts | awk '{print $2}')"
+		umount "$mounted_part"
+		grep -woq "$mounted_part" /proc/mounts && umount -l "$mounted_part"
 	fi
 }
 
@@ -42,8 +42,11 @@ udpu_do_part_check() {
 		# Format the /misc part right away as we will need it for the firmware
 		printf "Formating /misc partition, this make take a while..\n"
 		udpu_part_prep ${emmc_dev}p4
-		mkfs.f2fs -q -l misc ${emmc_dev}p4
-		[ $? -eq 0 ] && printf "/misc partition formated successfully\n" || printf "/misc partition formatting failed\n"
+		if mkfs.f2fs -q -l misc ${emmc_dev}p4; then
+			printf "/misc partition formated successfully\n"
+		else
+			printf "/misc partition formatting failed\n"
+		fi
 
 		udpu_do_initial_setup
 	else
@@ -52,21 +55,19 @@ udpu_do_part_check() {
 }
 
 udpu_do_misc_prep() {
-	if [ ! "$(grep -wo /misc /proc/mounts)" ]; then
+	if ! grep -woq /misc /proc/mounts; then
 		mkdir -p /misc
-		mount ${emmc_dev}p4 /misc
 
 		# If the mount fails, try to reformat partition
 		# Leaving possiblity for multiple iterations
-		if [ $? -ne 0 ]; then
+		if ! mount ${emmc_dev}p4 /misc; then
 			printf "Error while mounting /misc, trying to reformat..\n"
 
 			format_count=0
 			while [ "$format_count" -lt "1" ]; do
 				udpu_part_prep ${emmc_dev}p4
 				mkfs.f2fs -q -l misc ${emmc_dev}p4
-				mount ${emmc_dev}p4 /misc
-				if [ $? -ne 0 ]; then
+				if ! mount ${emmc_dev}p4 /misc; then
 					umount -l /misc
 					printf "Failed while mounting /misc\n"
 					format_count=$((format_count +1))
@@ -82,28 +83,27 @@ udpu_do_misc_prep() {
 udpu_do_initial_setup() {
 	# Prepare /recovery parition
 	udpu_part_prep ${emmc_dev}p2
-	mkfs.ext4 -q ${emmc_dev}p2 | echo y &> /dev/null
+	mkfs.ext4 -qF ${emmc_dev}p2 2>&1 /dev/null
 
 	# Prepare /boot partition
 	udpu_part_prep ${emmc_dev}p1
-	mkfs.ext4 -q ${emmc_dev}p1 | echo y &> /dev/null
+	mkfs.ext4 -qF ${emmc_dev}p1 2>&1 /dev/null
 
 	# Prepare /root partition
 	printf "Formating /root partition, this may take a while..\n"
 	udpu_part_prep ${emmc_dev}p3
-	mkfs.f2fs -q -l rootfs ${emmc_dev}p3
-	[ $? -eq 0 ] && printf "/root partition reformated\n"
+	mkfs.f2fs -q -l rootfs ${emmc_dev}p3 && printf "/root partition reformated\n"
 }
 
 udpu_do_regular_upgrade() {
 	# Clean /boot partition - mfks.ext4 is not available in chroot
-	[ "$(grep -wo /boot /proc/mounts)" ] && umount /boot
+	grep -woq /boot /proc/mounts && umount /boot
 	mkdir -p /tmp/boot
 	mount ${emmc_dev}p1 /tmp/boot
 	rm -rf /tmp/boot/*
 
 	# Clean /root partition - mkfs.f2fs is not available in chroot
-	[ "$(grep -wo /dev/root /proc/mounts)" ] && umount /
+	grep -woq /dev/root /proc/mounts && umount /
 	mkdir -p /tmp/rootpart
 	mount ${emmc_dev}p3 /tmp/rootpart
 	rm -rf /tmp/rootpart/*
@@ -122,13 +122,19 @@ platform_do_upgrade_uDPU() {
 	udpu_do_regular_upgrade
 
 	printf "Updating /boot partition\n"
-	tar xzf /misc/firmware/boot.tgz -C /tmp/boot
-	[ $? -eq 0 ] && printf "/boot partition updated successfully\n" || printf "/boot partition update failed\n"
+	if tar xzf /misc/firmware/boot.tgz -C /tmp/boot; then
+		printf "/boot partition updated successfully\n"
+	else
+		printf "/boot partition update failed\n"
+	fi
 	sync
 
 	printf "Updating /root partition\n"
-	tar xzf /misc/firmware/rootfs.tgz -C /tmp/rootpart
-	[ $? -eq 0 ] && printf "/root partition updated successfully\n" || printf "/root partition update failed\n"
+	if tar xzf /misc/firmware/rootfs.tgz -C /tmp/rootpart; then
+		printf "/root partition updated successfully\n"
+	else
+		printf "/root partition update failed\n"
+	fi
 	sync
 
 	# Saving configuration files over sysupgrade
@@ -137,9 +143,9 @@ platform_do_upgrade_uDPU() {
 	# Remove tmp mounts
 	tmp_parts=$(grep "${emmc_dev}" /proc/mounts | awk '{print $2}')
 	for part in ${tmp_parts}; do
-		umount $part
+		umount "$part"
 		# Force umount is necessary
-		[ "$(grep "${part}" /proc/mounts)" ] && umount -l $part
+		grep -q "${part}" /proc/mounts && umount -l "$part"
 	done
 
 	# Sysupgrade complains about /tmp and /dev, so we can detach them here
diff --git a/target/linux/mvebu/cortexa53/config-5.15 b/target/linux/mvebu/cortexa53/config-5.15
index 3c195291d1eefd..27d410f68b915f 100644
--- a/target/linux/mvebu/cortexa53/config-5.15
+++ b/target/linux/mvebu/cortexa53/config-5.15
@@ -36,6 +36,7 @@ CONFIG_ARM_GIC_V3_ITS_PCI=y
 CONFIG_ARM_PSCI_FW=y
 CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
 CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
+CONFIG_CPU_LITTLE_ENDIAN=y
 CONFIG_DMA_DIRECT_REMAP=y
 CONFIG_FRAME_POINTER=y
 CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
diff --git a/target/linux/mvebu/cortexa72/config-5.15 b/target/linux/mvebu/cortexa72/config-5.15
index 7e07c28ba641f3..cb27e0285faae5 100644
--- a/target/linux/mvebu/cortexa72/config-5.15
+++ b/target/linux/mvebu/cortexa72/config-5.15
@@ -12,6 +12,7 @@ CONFIG_ARCH_WANTS_NO_INSTR=y
 CONFIG_ARM64=y
 CONFIG_ARM64_4K_PAGES=y
 CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
+CONFIG_ARM64_ERRATUM_1742098=y
 CONFIG_ARM64_PAGE_SHIFT=12
 CONFIG_ARM64_PA_BITS=48
 CONFIG_ARM64_PA_BITS_48=y
@@ -36,6 +37,7 @@ CONFIG_ARM_GIC_V3_ITS_PCI=y
 CONFIG_ARM_PSCI_FW=y
 CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
 CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
+CONFIG_CPU_LITTLE_ENDIAN=y
 CONFIG_DMA_DIRECT_REMAP=y
 CONFIG_FRAME_POINTER=y
 CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
diff --git a/target/linux/mvebu/cortexa9/base-files/etc/board.d/02_network b/target/linux/mvebu/cortexa9/base-files/etc/board.d/02_network
index c613a3cd603ec8..9db29d52df5a6a 100644
--- a/target/linux/mvebu/cortexa9/base-files/etc/board.d/02_network
+++ b/target/linux/mvebu/cortexa9/base-files/etc/board.d/02_network
@@ -18,6 +18,9 @@ mvebu_setup_interfaces()
 	cznic,turris-omnia)
 		ucidef_set_interfaces_lan_wan "lan0 lan1 lan2 lan3 lan4" "eth2"
 		;;
+	fortinet,fg-50e)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4 lan5" "eth1 eth2"
+		;;
 	iptime,nas1dual)
 		ucidef_set_interface_lan "eth0 eth1" "dhcp"
 		;;
@@ -61,6 +64,7 @@ mvebu_setup_macs()
 	local label_mac=""
 
 	case "$board" in
+	buffalo,ls220de|\
 	buffalo,ls421de)
 		lan_mac=$(mtd_get_mac_ascii u-boot-env eth1addr)
 		;;
diff --git a/target/linux/mvebu/cortexa9/base-files/lib/upgrade/fortinet.sh b/target/linux/mvebu/cortexa9/base-files/lib/upgrade/fortinet.sh
new file mode 100644
index 00000000000000..a2742aa3743669
--- /dev/null
+++ b/target/linux/mvebu/cortexa9/base-files/lib/upgrade/fortinet.sh
@@ -0,0 +1,54 @@
+. /lib/functions.sh
+
+fortinet_fwinfo_blocks() {
+	local fwinfo_mtd="$(find_mtd_part firmware-info)"
+	local offset="$1"
+	local len="$2"
+	local blks
+
+	if [ -z "$fwinfo_mtd" ]; then
+		echo "WARN: MTD device \"firmware-info\" not found"
+		return 1
+	fi
+
+	blks=$((len / 0x200))
+	[ $((len % 0x200)) -gt 0 ] && blks=$((blks + 1))
+	blks=$(printf "%04x" $blks)
+	printf "fwinfo: offset-> 0x%x, blocks-> 0x%s (len: 0x%08x)\n" \
+		$offset $blks $len
+
+	printf "\x${blks:2:2}\x${blks:0:2}" | \
+		dd bs=2 count=1 seek=$((offset / 2)) conv=notrunc of=${fwinfo_mtd}
+}
+
+fortinet_do_upgrade() {
+	local board_dir="$(tar tf "$1" | grep -m 1 '^sysupgrade-.*/$')"
+	local kern_mtd="$(find_mtd_part kernel)"
+	local root_mtd="$(find_mtd_part rootfs)"
+	local kern_len root_len
+
+	board_dir="${board_dir%/}"
+
+	if [ -z "$kern_mtd" ] || [ -z "$root_mtd" ]; then
+		echo "ERROR: MTD device \"kernel\" or \"rootfs\" not found"
+		umount -a
+		reboot -f
+	fi
+
+	kern_len=$( (tar xOf "$1" "$board_dir/kernel" | wc -c) 2> /dev/null)
+	root_len=$( (tar xOf "$1" "$board_dir/root" | wc -c) 2> /dev/null)
+
+	if [ -z "$kern_len" ] || [ -z "$root_len" ]; then
+		echo "ERROR: failed to get length of new kernel or rootfs"
+		umount -a
+		reboot -f
+	fi
+
+	fortinet_fwinfo_blocks "0x184" "$kern_len"
+	fortinet_fwinfo_blocks "0x18c" "$root_len"
+
+	tar xOf "$1" "$board_dir/kernel" | \
+		mtd write - "kernel"
+	tar xOf "$1" "$board_dir/root" | \
+		mtd ${UPGRADE_BACKUP:+-j "${UPGRADE_BACKUP}"} write - "rootfs"
+}
diff --git a/target/linux/mvebu/cortexa9/base-files/lib/upgrade/linksys.sh b/target/linux/mvebu/cortexa9/base-files/lib/upgrade/linksys.sh
index 826bf8c9b50f0e..d4222a3f31b3f3 100644
--- a/target/linux/mvebu/cortexa9/base-files/lib/upgrade/linksys.sh
+++ b/target/linux/mvebu/cortexa9/base-files/lib/upgrade/linksys.sh
@@ -8,7 +8,7 @@ linksys_get_target_firmware() {
 
 	cur_boot_part=$(/usr/sbin/fw_printenv -n boot_part)
 	if [ -z "${cur_boot_part}" ] ; then
-		mtd_ubi0=$(cat /sys/devices/virtual/ubi/ubi0/mtd_num)
+		mtd_ubi0=$(cat /sys/class/ubi/ubi0/mtd_num)
 		case $(grep -E ^mtd${mtd_ubi0}: /proc/mtd | cut -d '"' -f 2) in
 		kernel1|rootfs1)
 			cur_boot_part=1
@@ -68,7 +68,12 @@ platform_do_upgrade_linksys() {
 			CI_UBIPART="rootfs2"
 		fi
 
-		nand_upgrade_tar "$1"
+		if nand_upgrade_tar "$1" ; then
+			nand_do_upgrade_success
+		else
+			nand_do_upgrade_failed
+		fi
+
 	}
 	[ "$magic_long" = "27051956" -o "$magic_long" = "0000a0e1" ] && {
 		get_image "$1" | mtd write - $part_label
diff --git a/target/linux/mvebu/cortexa9/base-files/lib/upgrade/platform.sh b/target/linux/mvebu/cortexa9/base-files/lib/upgrade/platform.sh
index 18b978d43705ce..fbbb68e05eb93d 100755
--- a/target/linux/mvebu/cortexa9/base-files/lib/upgrade/platform.sh
+++ b/target/linux/mvebu/cortexa9/base-files/lib/upgrade/platform.sh
@@ -25,6 +25,13 @@ platform_check_image() {
 
 platform_do_upgrade() {
 	case "$(board_name)" in
+	buffalo,ls220de)
+		# Kernel UBI volume name must be "boot"
+		CI_KERNPART=boot
+		CI_KERN_UBIPART=ubi_kernel
+		CI_ROOT_UBIPART=ubi
+		nand_do_upgrade "$1"
+		;;
 	buffalo,ls421de)
 		nand_do_upgrade "$1"
 		;;
@@ -45,6 +52,9 @@ platform_do_upgrade() {
 	solidrun,clearfog-pro-a1)
 		legacy_sdcard_do_upgrade "$1"
 		;;
+	fortinet,fg-50e)
+		fortinet_do_upgrade "$1"
+		;;
 	linksys,wrt1200ac|\
 	linksys,wrt1900ac-v1|\
 	linksys,wrt1900ac-v2|\
diff --git a/target/linux/mvebu/cortexa9/config-5.15 b/target/linux/mvebu/cortexa9/config-5.15
index b737c44d42980c..88a2f14c0264e0 100644
--- a/target/linux/mvebu/cortexa9/config-5.15
+++ b/target/linux/mvebu/cortexa9/config-5.15
@@ -1,2 +1,3 @@
+CONFIG_LED_TRIGGER_PHY=y
 CONFIG_PHY_MVEBU_A38X_COMPHY=y
 CONFIG_RTC_DRV_MV=y
diff --git a/target/linux/mvebu/files/arch/arm/boot/dts/armada-370-buffalo-ls220de.dts b/target/linux/mvebu/files/arch/arm/boot/dts/armada-370-buffalo-ls220de.dts
new file mode 100644
index 00000000000000..3de9ac5473e573
--- /dev/null
+++ b/target/linux/mvebu/files/arch/arm/boot/dts/armada-370-buffalo-ls220de.dts
@@ -0,0 +1,380 @@
+// SPDX-License-Identifier: (GPL-2.0-or-later OR MIT)
+/*
+ * Device Tree file for Buffalo LinkStation LS220DE
+ *
+ * Copyright (C) 2023 Daniel González Cabanelas <dgcbueu@gmail.com>
+ */
+
+/dts-v1/;
+
+#include "armada-370.dtsi"
+#include "mvebu-linkstation-fan.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/thermal/thermal.h>
+
+/ {
+	model = "Buffalo LinkStation LS220DE";
+	compatible = "buffalo,ls220de", "marvell,armada370", "marvell,armada-370-xp";
+
+	aliases {
+		led-boot = &led_boot;
+		led-failsafe = &led_failsafe;
+		led-running = &led_power;
+		led-upgrade = &led_upgrade;
+	};
+
+	chosen {
+		bootargs = "earlycon";
+		stdout-path = "serial0:115200n8";
+		append-rootblock = "nullparameter="; /* override the bootloader args */
+	};
+
+	memory {
+		device_type = "memory";
+		reg = <0x00000000 0x10000000>; /* 256 MB */
+	};
+
+	soc {
+		ranges = <MBUS_ID(0xf0, 0x01) 0 0xd0000000 0x100000
+			  MBUS_ID(0x01, 0xe0) 0 0xfff00000 0x100000
+			  MBUS_ID(0x09, 0x01) 0 0xf1100000 0x10000>;
+	};
+
+	system_fan: gpio_fan {
+		gpios = <&gpio0 13 GPIO_ACTIVE_HIGH
+			 &gpio0 14 GPIO_ACTIVE_HIGH>;
+		alarm-gpios = <&gpio0 10 GPIO_ACTIVE_HIGH>;
+
+		#cooling-cells = <2>;
+	};
+
+	thermal-zones {
+		hdd-thermal {
+			polling-delay = <20000>;
+			polling-delay-passive = <2000>;
+
+			thermal-sensors = <&hdd0_temp>; /* only one drivetemp sensor is supported */
+
+			trips {
+				hdd_alert1: trip1 {
+					temperature = <34000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+				hdd_alert2: trip2 {
+					temperature = <40000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+				hdd_alert3: trip3 {
+					temperature = <45000>;
+					hysteresis = <2000>;
+					type = "passive";
+				};
+				hdd_hot {
+					temperature = <50000>;
+					hysteresis = <2000>;
+					type = "hot";
+				};
+				hdd_crit {
+					temperature = <60000>;
+					hysteresis = <2000>;
+					type = "critical";
+				};
+			};
+
+			cooling-maps {
+				map1 {
+					trip = <&hdd_alert1>;
+					cooling-device = <&system_fan THERMAL_NO_LIMIT 1>;
+				};
+				map2 {
+					trip = <&hdd_alert2>;
+					cooling-device = <&system_fan 2 2>;
+				};
+				map3 {
+					trip = <&hdd_alert3>;
+					cooling-device = <&system_fan 3 THERMAL_NO_LIMIT>;
+				};
+			};
+		};
+	};
+
+	gpio_keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&pmx_buttons>;
+		pinctrl-names = "default";
+
+		power {
+			label = "Power Switch";
+			linux,code = <KEY_POWER>;
+			linux,input-type = <EV_SW>;
+			gpios = <&gpio0 15 GPIO_ACTIVE_LOW>;
+		};
+
+		function {
+			label = "Function Button";
+			linux,code = <KEY_CONFIG>;
+			gpios = <&gpio0 16 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio_leds {
+		compatible = "gpio-leds";
+		pinctrl-names = "default";
+		pinctrl-0 = <&pmx_leds1 &pmx_leds2>;
+
+		indicator_red {
+			function = LED_FUNCTION_INDICATOR;
+			color = <LED_COLOR_ID_RED>;
+			gpios = <&gpio0 7 GPIO_ACTIVE_HIGH>;
+			panic-indicator;
+		};
+
+		led_power: power_white {
+			label = "white:power";
+			function = LED_FUNCTION_POWER;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&gpio1 22 GPIO_ACTIVE_HIGH>;
+			default-state = "on";
+		};
+
+		led_failsafe: power_red {
+			label = "red:power";
+			function = LED_FUNCTION_POWER;
+			color = <LED_COLOR_ID_RED>;
+			gpios = <&gpio1 23 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_upgrade: power_orange {
+			label = "amber:power";
+			function = LED_FUNCTION_POWER;
+			color = <LED_COLOR_ID_AMBER>;
+			gpios = <&gpio1 25 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_boot: indicator_white {
+			label = "white:indicator";
+			function = LED_FUNCTION_INDICATOR;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&gpio1 27 GPIO_ACTIVE_HIGH>;
+		};
+
+		hdd1_red {
+			function = LED_FUNCTION_DISK;
+			color = <LED_COLOR_ID_RED>;
+			gpios = <&gpio1 29 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "ata1";
+			function-enumerator = <1>;
+		};
+
+		hdd2_red {
+			function = LED_FUNCTION_DISK;
+			color = <LED_COLOR_ID_RED>;
+			gpios = <&gpio1 30 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "ata2";
+			function-enumerator = <2>;
+		};
+	};
+
+	regulators {
+		compatible = "simple-bus";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		pinctrl-0 = <&pmx_power_hdd1 &pmx_power_hdd2>;
+		pinctrl-names = "default";
+
+		sata1_power: regulator@1 {
+			compatible = "regulator-fixed";
+			reg = <1>;
+			regulator-name = "HDD1";
+			regulator-min-microvolt = <12000000>;
+			regulator-max-microvolt = <12000000>;
+			startup-delay-us = <2000000>;
+			enable-active-high;
+			regulator-always-on;
+			regulator-boot-on;
+			gpio = <&gpio0 8 GPIO_ACTIVE_HIGH>;
+		};
+
+		sata2_power: regulator@2 {
+			compatible = "regulator-fixed";
+			reg = <2>;
+			regulator-name = "HDD2";
+			regulator-min-microvolt = <12000000>;
+			regulator-max-microvolt = <12000000>;
+			startup-delay-us = <4000000>;
+			enable-active-high;
+			regulator-always-on;
+			regulator-boot-on;
+			gpio = <&gpio0 2 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&coherencyfab {
+	broken-idle;
+};
+
+&eth1 {
+	pinctrl-0 = <&ge1_rgmii_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+	phy-handle = <&ethphy0>;
+	phy-connection-type = "rgmii-id";
+};
+
+&mdio {
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+
+	ethphy0: ethernet-phy@0 { /* Marvell 88E1318 */
+		reg = <0>;
+		marvell,reg-init = <0x3 0x10 0xf000 0x091A>, /* LED function */
+				   <0x3 0x11 0x0000 0x4401>, /* LED polarity */
+				   <0x3 0x12 0x0000 0x4905>; /* LED timer */
+		#thermal-sensor-cells = <0>;
+	};
+};
+
+&nand_controller {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		label = "pxa3xx_nand-0";
+		nand-rb = <0>;
+		marvell,nand-keep-config;
+		nand-on-flash-bbt;
+		nand-ecc-strength = <4>;
+		nand-ecc-step-size = <512>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "ubi_kernel";
+				reg = <0x00000000 0x02000000>; /* 32 MiB */
+			};
+
+			partition@2000000 {
+				label = "ubi";
+				reg = <0x02000000 0x1df00000>; /* 479 MiB */
+			};
+		};
+	};
+};
+
+&sata {
+	nr-ports = <2>;
+	status = "okay";
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	hdd0_temp: sata-port@0 {
+		reg = <0>;
+		#thermal-sensor-cells = <0>;
+	};
+
+	hdd1_temp: sata-port@1 {
+		reg = <1>;
+		#thermal-sensor-cells = <0>;
+	};
+};
+
+&spi0 {
+	status = "okay";
+	pinctrl-0 = <&spi0_pins2>;
+	pinctrl-names = "default";
+
+	spi-flash@0 {
+		compatible = "mxicy,mx25l8005", "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <50000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				reg = <0x00000 0xf0000>; /* 960 KiB*/
+				label = "u-boot";
+				read-only;
+			};
+			partition@f0000 {
+				reg = <0xf0000 0x10000>; /* 64 KiB */
+				label = "u-boot-env";
+			};
+		};
+	};
+};
+
+&pmsu {
+	pinctrl-0 = <&pmx_power_cpu>;
+	pinctrl-names = "default";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usb0 {
+	status = "okay";
+};
+
+&pinctrl {
+	pmx_power_hdd2: pmx-power-hdd2 {
+		marvell,pins = "mpp2";
+		marvell,function = "gpio";
+	};
+
+	pmx_power_cpu: pmx-power-cpu {
+		marvell,pins = "mpp4";
+		marvell,function = "vdd";
+	};
+
+	pmx_power_hdd1: pmx-power-hdd1 {
+		marvell,pins = "mpp8";
+		marvell,function = "gpio";
+	};
+
+	pmx_fan_lock: pmx-fan-lock {
+		marvell,pins = "mpp10";
+		marvell,function = "gpio";
+	};
+
+	pmx_hdd_present: pmx-hdd-present {
+		marvell,pins = "mpp11", "mpp12";
+		marvell,function = "gpio";
+	};
+
+	pmx_fan_high: pmx-fan-high {
+		marvell,pins = "mpp13";
+		marvell,function = "gpio";
+	};
+
+	pmx_fan_low: pmx-fan-low {
+		marvell,pins = "mpp14";
+		marvell,function = "gpio";
+	};
+
+	pmx_buttons: pmx-buttons {
+		marvell,pins = "mpp15", "mpp16";
+		marvell,function = "gpio";
+	};
+
+	pmx_leds1: pmx-leds {
+		marvell,pins = "mpp7", "mpp54", "mpp59", "mpp61";
+		marvell,function = "gpo";
+	};
+
+	pmx_leds2: pmx-leds {
+		marvell,pins = "mpp55", "mpp57", "mpp62";
+		marvell,function = "gpio";
+	};
+};
diff --git a/target/linux/mvebu/files/arch/arm/boot/dts/armada-385-fortinet-fg-50e.dts b/target/linux/mvebu/files/arch/arm/boot/dts/armada-385-fortinet-fg-50e.dts
new file mode 100644
index 00000000000000..61d2da1755ceef
--- /dev/null
+++ b/target/linux/mvebu/files/arch/arm/boot/dts/armada-385-fortinet-fg-50e.dts
@@ -0,0 +1,503 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+#include "armada-385.dtsi"
+
+/ {
+	model = "Fortinet FortiGate 50E";
+	compatible = "fortinet,fg-50e", "marvell,armada385", "marvell,armada380";
+
+	aliases {
+		led-boot = &led_status_green;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_green;
+		label-mac-device = &eth0;
+	};
+
+	chosen {
+		stdout-path = "serial0:9600n8";
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x00000000 0x80000000>; /* 2GB */
+	};
+
+	soc {
+		ranges = <MBUS_ID(0xf0, 0x01) 0 0xf1000000 0x100000
+			  MBUS_ID(0x01, 0x1d) 0 0xfff00000 0x100000
+			  MBUS_ID(0x09, 0x19) 0 0xf1100000 0x10000
+			  MBUS_ID(0x09, 0x15) 0 0xf1110000 0x10000
+			  MBUS_ID(0x0c, 0x04) 0 0xf1200000 0x100000>;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+		pinctrl-names = "default";
+		pinctrl-0 = <&pmx_gpio_keys_pins>;
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio1 22 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+		pinctrl-names = "default";
+		pinctrl-0 = <&pmx_gpio_leds_pins>;
+
+		led-0 {
+			label = "red:alarm";
+			gpios = <&gpio0 30 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_ALARM;
+		};
+
+		led-1 {
+			label = "red:ha";
+			gpios = <&gpio1 0 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_RED>;
+		};
+
+		led_status_green: led-2 {
+			label = "green:sta";
+			gpios = <&gpio1 1 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+		};
+
+		led-3 {
+			label = "green:ha";
+			gpios = <&gpio1 3 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+		};
+
+		led-4 {
+			label = "amber:alarm";
+			gpios = <&gpio1 13 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_ALARM;
+		};
+
+		led_status_red: led-5 {
+			label = "red:sta";
+			gpios = <&gpio1 15 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+		};
+
+		led-6 {
+			label = "green:speed_wan1";
+			gpios = <&gpio2 0 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_GREEN>;
+			linux,default-trigger = "f1072004.mdio-mii:00:1Gbps";
+		};
+
+		led-7 {
+			label = "green:speed_wan2";
+			gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_GREEN>;
+			linux,default-trigger = "f1072004.mdio-mii:01:1Gbps";
+		};
+
+		led-8 {
+			label = "amber:speed_lan5";
+			gpios = <&gpio2 2 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_AMBER>;
+			linux,default-trigger = "mv88e6xxx-1:00:100Mbps";
+		};
+
+		led-9 {
+			label = "green:speed_lan5";
+			gpios = <&gpio2 3 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_GREEN>;
+			linux,default-trigger = "mv88e6xxx-1:00:1Gbps";
+		};
+
+		led-10 {
+			label = "green:speed_lan4";
+			gpios = <&gpio2 4 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			linux,default-trigger = "mv88e6xxx-1:01:1Gbps";
+		};
+
+		led-11 {
+			label = "amber:speed_lan4";
+			gpios = <&gpio2 5 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_AMBER>;
+			linux,default-trigger = "mv88e6xxx-1:01:100Mbps";
+		};
+
+		led-12 {
+			label = "amber:speed_lan3";
+			gpios = <&gpio2 6 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_AMBER>;
+			linux,default-trigger = "mv88e6xxx-1:02:100Mbps";
+		};
+
+		led-13 {
+			label = "green:speed_lan3";
+			gpios = <&gpio2 7 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			linux,default-trigger = "mv88e6xxx-1:02:1Gbps";
+		};
+
+		led-14 {
+			label = "green:speed_lan1";
+			gpios = <&gpio2 12 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			linux,default-trigger = "mv88e6xxx-1:04:1Gbps";
+		};
+
+		led-15 {
+			label = "amber:speed_lan1";
+			gpios = <&gpio2 13 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_AMBER>;
+			linux,default-trigger = "mv88e6xxx-1:04:100Mbps";
+		};
+
+		led-16 {
+			label = "green:speed_lan2";
+			gpios = <&gpio2 14 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			linux,default-trigger = "mv88e6xxx-1:03:1Gbps";
+		};
+
+		led-17 {
+			label = "amber:speed_lan2";
+			gpios = <&gpio2 15 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_AMBER>;
+			linux,default-trigger = "mv88e6xxx-1:03:100Mbps";
+		};
+	};
+
+	reg_usb_vbus: regulator-usb-vbus {
+		compatible = "fixed-regulator";
+		regulator-name = "usb-vbus";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		gpio = <&gpio1 21 GPIO_ACTIVE_LOW>;
+		regulator-always-on;
+	};
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	status = "okay";
+
+	gpio2: gpio@24 {
+		compatible = "nxp,pca9555";
+		reg = <0x24>;
+		gpio-controller;
+		#gpio-cells = <0x2>;
+	};
+
+	hwmon@28 {
+		compatible = "nuvoton,nct7802";
+		reg = <0x28>;
+	};
+};
+
+&uart0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart0_pins>;
+	status = "okay";
+};
+
+&pinctrl {
+	pmx_phy_switch_pins: phy-switch-pins {
+		marvell,pins = "mpp19", "mpp20", "mpp23", "mpp34", "mpp41";
+		marvell,function = "gpio";
+	};
+
+	pmx_gpio_leds_pins: gpio-leds-pins {
+		marvell,pins = "mpp30", "mpp32", "mpp33", "mpp35",
+			       "mpp45", "mpp47";
+		marvell,function = "gpio";
+	};
+
+	pmx_usb_pins: usb-pins {
+		marvell,pins = "mpp53";
+		marvell,function = "gpio";
+	};
+
+	pmx_gpio_keys_pins: gpio-keys-pins {
+		marvell,pins = "mpp54";
+		marvell,function = "gpio";
+	};
+};
+
+&bm {
+	status = "okay";
+};
+
+&bm_bppi {
+	status = "okay";
+};
+
+&eth0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&ge0_rgmii_pins>;
+	status = "okay";
+
+	phy-connection-type = "rgmii-id";
+	buffer-manager = <&bm>;
+	bm,pool-long = <0>;
+	bm,pool-short = <1>;
+	nvmem-cells = <&macaddr_bdinfo_d880>;
+	nvmem-cell-names = "mac-address";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&eth1 {
+	status = "okay";
+
+	phy-handle = <&ethphy0>;
+	phy-connection-type = "sgmii";
+	buffer-manager = <&bm>;
+	bm,pool-long = <2>;
+	nvmem-cells = <&macaddr_bdinfo_d880>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <1>;
+};
+
+&eth2 {
+	status = "okay";
+
+	phy-handle = <&ethphy1>;
+	phy-connection-type = "sgmii";
+	buffer-manager = <&bm>;
+	bm,pool-long = <3>;
+	nvmem-cells = <&macaddr_bdinfo_d880>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <2>;
+};
+
+&mdio {
+	pinctrl-names = "default";
+	pinctrl-0 = <&mdio_pins>, <&pmx_phy_switch_pins>;
+
+	/* Marvell 88E1512 */
+	ethphy0: ethernet-phy@0 {
+		compatible = "ethernet-phy-id0141,0dd1",
+			     "ethernet-phy-ieee802.3-c22";
+		reg = <0>;
+		interrupt-parent = <&gpio0>;
+		interrupts = <20 IRQ_TYPE_LEVEL_LOW>;
+		reset-gpios = <&gpio0 23 GPIO_ACTIVE_LOW>;
+		/*
+		 * LINK/ACT   (Green): LED[0], Active Low
+		 * SPEED 100M (Amber): LED[1], Active High
+		 */
+		marvell,reg-init = <3 16 0 0x71>,
+				   <3 17 0 0x4>;
+	};
+
+	/* Marvell 88E1512 */
+	ethphy1: ethernet-phy@1 {
+		compatible = "ethernet-phy-id0141,0dd1",
+			     "ethernet-phy-ieee802.3-c22";
+		reg = <1>;
+		interrupt-parent = <&gpio1>;
+		interrupts = <9 IRQ_TYPE_LEVEL_LOW>;
+		reset-gpios = <&gpio1 2 GPIO_ACTIVE_LOW>;
+		/*
+		 * LINK/ACT   (Green): LED[0], Active Low
+		 * SPEED 100M (Amber): LED[1], Active High
+		 */
+		marvell,reg-init = <3 16 0 0x71>,
+				   <3 17 0 0x4>;
+	};
+
+	/* Marvell 88E6176 */
+	switch@2 {
+		compatible = "marvell,mv88e6085";
+		reg = <0x2>;
+		reset-gpios = <&gpio0 19 GPIO_ACTIVE_LOW>;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				label = "lan5";
+				nvmem-cells = <&macaddr_bdinfo_d880>;
+				nvmem-cell-names = "mac-address";
+				mac-address-increment = <7>;
+			};
+
+			port@1 {
+				reg = <1>;
+				label = "lan4";
+				nvmem-cells = <&macaddr_bdinfo_d880>;
+				nvmem-cell-names = "mac-address";
+				mac-address-increment = <6>;
+			};
+
+			port@2 {
+				reg = <2>;
+				label = "lan3";
+				nvmem-cells = <&macaddr_bdinfo_d880>;
+				nvmem-cell-names = "mac-address";
+				mac-address-increment = <5>;
+			};
+
+			port@3 {
+				reg = <3>;
+				label = "lan2";
+				nvmem-cells = <&macaddr_bdinfo_d880>;
+				nvmem-cell-names = "mac-address";
+				mac-address-increment = <4>;
+			};
+
+			port@4 {
+				reg = <4>;
+				label = "lan1";
+				nvmem-cells = <&macaddr_bdinfo_d880>;
+				nvmem-cell-names = "mac-address";
+				mac-address-increment = <3>;
+			};
+
+			port@6 {
+				reg = <6>;
+				ethernet = <&eth0>;
+				phy-connection-type = "rgmii-id";
+
+				fixed-link {
+					speed = <1000>;
+					full-duplex;
+				};
+			};
+		};
+	};
+};
+
+&usb3_0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pmx_usb_pins>;
+	status = "okay";
+
+	vbus-supply = <&reg_usb_vbus>;
+};
+
+&spi1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi1_pins>;
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <50000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				reg = <0x0 0x1c0000>;
+				label = "u-boot";
+				read-only;
+			};
+
+			partition@1c0000 {
+				reg = <0x1c0000 0x10000>;
+				label = "firmware-info";
+
+				/*
+				 *  0x10 - 0x2f : image name (image1)
+				 *  0x30 - 0x4f : image name (image2)
+				 * 0x170 (1byte): active image (0x0/0x1)
+				 * 0x184 - 0x185: kernel block count (image1)
+				 * 0x18c - 0x18d: rootfs block count (image1)
+				 * 0x194 - 0x195: kernel block count (image2)
+				 * 0x19c - 0x19d: rootfs block count (image2)
+				 * 0x1be (1byte): bit7 -> active flag (image1)?
+				 * 0x1ce (1byte): bit7 -> active flag (image2)?
+				 *
+				 * Note: block size --> 0x200 (512 bytes)
+				 */
+			};
+
+			partition@1d0000 {
+				reg = <0x1d0000 0x10000>;
+				label = "dtb";
+				read-only;
+			};
+
+			partition@1e0000 {
+				reg = <0x1e0000 0x10000>;
+				label = "u-boot-env";
+				read-only;
+			};
+
+			partition@1f0000 {
+				reg = <0x1f0000 0x10000>;
+				label = "board-info";
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_bdinfo_d880: macaddr@d880 {
+					reg = <0xd880 0x6>;
+				};
+			};
+
+			partition@200000 {
+				reg = <0x200000 0x600000>;
+				label = "kernel";
+			};
+
+			partition@800000 {
+				reg = <0x800000 0x1800000>;
+				label = "rootfs";
+			};
+
+			partition@2000000 {
+				reg = <0x2000000 0x600000>;
+				label = "kn2";
+				read-only;
+			};
+
+			partition@2600000 {
+				reg = <0x2600000 0x1800000>;
+				label = "rfs2";
+				read-only;
+			};
+
+			partition@3e00000 {
+				reg = <0x3e00000 0x1200000>;
+				label = "part1";
+				read-only;
+			};
+
+			partition@5000000 {
+				reg = <0x5000000 0x1200000>;
+				label = "part2";
+				read-only;
+			};
+
+			partition@6200000 {
+				reg = <0x6200000 0x1e00000>;
+				label = "config";
+				read-only;
+			};
+		};
+	};
+};
diff --git a/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts b/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts
index 669b67e5a962ce..1a6594e3cdab0b 100644
--- a/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts
+++ b/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts
@@ -184,7 +184,6 @@
 
 			switch0port0: port@0 {
 				reg = <0>;
-				label = "cpu";
 				ethernet = <&eth0>;
 			};
 
diff --git a/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/armada-3720-gl-mv1000.dts b/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/armada-3720-gl-mv1000.dts
index acf15e8ca96d44..8d163059a007e1 100644
--- a/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/armada-3720-gl-mv1000.dts
+++ b/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/armada-3720-gl-mv1000.dts
@@ -96,7 +96,7 @@
 
 			partition@f0000 {
 				label = "u-boot-env";
-				reg = <0Xf0000 0x8000>;
+				reg = <0xf0000 0x8000>;
 				read-only;
 			};
 
@@ -105,6 +105,24 @@
 				reg = <0xf8000 0x8000>;
 				read-only;
 			};
+
+			partition@100000 {
+				label = "gl-firmware-dtb";
+				reg = <0x100000 0x10000>;
+				read-only;
+			};
+
+			partition@110000 {
+				label = "gl-firmware";
+				reg = <0x110000 0xef0000>;
+				read-only;
+			};
+
+			partition@ef0000 {
+				label = "gl-firmware-jffs2";
+				reg = <0xef0000 0x110000>;
+				read-only;
+			};
 		};
 	};
 };
@@ -157,7 +175,6 @@
 
 			port@0 {
 				reg = <0>;
-				label = "cpu";
 				ethernet = <&eth0>;
 			};
 
diff --git a/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/armada-7040-mochabin.dts b/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/armada-7040-mochabin.dts
index c198061af74104..26804a48755529 100644
--- a/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/armada-7040-mochabin.dts
+++ b/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/armada-7040-mochabin.dts
@@ -339,7 +339,6 @@
 
 			port@5 {
 				reg = <5>;
-				label = "cpu";
 				ethernet = <&cp0_eth1>;
 				phy-mode = "2500base-x";
 				managed = "in-band-status";
@@ -445,4 +444,5 @@
 	phys = <&cp0_comphy5 2>;
 	phy-names = "cp0-pcie2-x1-phy";
 	reset-gpio = <&cp0_gpio1 9 GPIO_ACTIVE_LOW>;
+	ranges = <0x82000000 0x0 0xc0000000 0x0 0xc0000000 0x0 0x8000000>;
 };
diff --git a/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/cn9131-puzzle-m901.dts b/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/cn9131-puzzle-m901.dts
index 80d876b4ad6740..0ad25fafbb8b2d 100644
--- a/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/cn9131-puzzle-m901.dts
+++ b/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/cn9131-puzzle-m901.dts
@@ -6,6 +6,7 @@
  */
 
 #include "cn9130.dtsi"
+#include "puzzle-thermal.dtsi"
 
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
@@ -109,26 +110,18 @@
 			chassis_fan_group0: fan-group@0 {
 				#cooling-cells = <2>;
 				reg = <0x00>;
-				cooling-levels = <64 102 170 230 250>;
+				cooling-levels = <80 102 170 230 255>;
 			};
 		};
 	};
 };
 
-&ap_thermal_cpu1 {
-	trips {
-		cpu_active: cpu-active {
-			temperature = <44000>;
-			hysteresis = <2000>;
-			type = "active";
-		};
-	};
-	cooling-maps {
-		fan-map {
-			trip = <&cpu_active>;
-			cooling-device = <&chassis_fan_group0 64 THERMAL_NO_LIMIT>;
-		};
-	};
+&ap_thermal_ic {
+	PUZZLE_FAN_THERMAL(ic, &chassis_fan_group0);
+};
+
+&cp0_thermal_ic {
+	PUZZLE_FAN_THERMAL(cp0, &chassis_fan_group0);
 };
 
 /* on-board eMMC - U9 */
@@ -396,6 +389,10 @@
 	};
 };
 
+&cp1_thermal_ic {
+	PUZZLE_FAN_THERMAL(cp1, &chassis_fan_group0);
+};
+
 &cp1_usb3_1 {
 	status = "okay";
 	phys = <&cp1_comphy3 1>;
diff --git a/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/cn9132-puzzle-m902.dts b/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/cn9132-puzzle-m902.dts
index fd99eb2d1303ca..398e53a5f9a4f4 100644
--- a/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/cn9132-puzzle-m902.dts
+++ b/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/cn9132-puzzle-m902.dts
@@ -6,6 +6,7 @@
  */
 
 #include "cn9130.dtsi"
+#include "puzzle-thermal.dtsi"
 
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
@@ -154,28 +155,21 @@
 			chassis_fan_group0: fan-group@0 {
 				#cooling-cells = <2>;
 				reg = <0x00>;
-				cooling-levels = <64 102 170 230 250>;
+				cooling-levels = <80 102 170 230 255>;
 			};
 		};
 	};
 };
 
-&ap_thermal_cpu1 {
-	trips {
-		cpu_active: cpu-active {
-			temperature = <44000>;
-			hysteresis = <2000>;
-			type = "active";
-		};
-	};
-	cooling-maps {
-		fan-map {
-			trip = <&cpu_active>;
-			cooling-device = <&chassis_fan_group0 64 THERMAL_NO_LIMIT>;
-		};
-	};
+&ap_thermal_ic {
+	PUZZLE_FAN_THERMAL(ic, &chassis_fan_group0);
+};
+
+&cp0_thermal_ic {
+	PUZZLE_FAN_THERMAL(cp0, &chassis_fan_group0);
 };
 
+
 /* on-board eMMC - U9 */
 &ap_sdhci0 {
 	pinctrl-names = "default";
@@ -447,6 +441,10 @@
 	};
 };
 
+&cp1_thermal_ic {
+	PUZZLE_FAN_THERMAL(cp1, &chassis_fan_group0);
+};
+
 /*
  * Instantiate the second connected CP115
  */
@@ -562,3 +560,7 @@
 		};
 	};
 };
+
+&cp2_thermal_ic {
+	PUZZLE_FAN_THERMAL(cp2, &chassis_fan_group0);
+};
diff --git a/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/puzzle-thermal.dtsi b/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/puzzle-thermal.dtsi
new file mode 100644
index 00000000000000..94677532f2dc1f
--- /dev/null
+++ b/target/linux/mvebu/files/arch/arm64/boot/dts/marvell/puzzle-thermal.dtsi
@@ -0,0 +1,41 @@
+#define PUZZLE_FAN_THERMAL(_cname, _fan)					\
+	trips {									\
+		_cname##_active_high: cpu-active-high {				\
+			temperature = <80000>;					\
+			hysteresis = <2000>;					\
+			type = "active";					\
+		};								\
+		_cname##_active_med: cpu-active-med {				\
+			temperature = <72000>;					\
+			hysteresis = <2000>;					\
+			type = "active";					\
+		};								\
+		_cname##_active_low: cpu-active-low {				\
+			temperature = <65000>;					\
+			hysteresis = <2000>;					\
+			type = "active";					\
+		};								\
+		_cname##_active_idle: cpu-active-idle {				\
+			temperature = <60000>;					\
+			hysteresis = <2000>;					\
+			type = "active";					\
+		};								\
+	};									\
+	cooling-maps {								\
+		cpu-active-high {						\
+			trip = <&_cname##_active_high>;				\
+			cooling-device = <_fan 3 THERMAL_NO_LIMIT>;		\
+		};								\
+		cpu-active-med {						\
+			trip = <&_cname##_active_med>;				\
+			cooling-device = <_fan 2 THERMAL_NO_LIMIT>;		\
+		};								\
+		cpu-active-low {						\
+			trip = <&_cname##_active_low>;				\
+			cooling-device = <_fan 1 THERMAL_NO_LIMIT>;		\
+		};								\
+		cpu-active-idle {						\
+			trip = <&_cname##_active_idle>;				\
+			cooling-device = <_fan 0 THERMAL_NO_LIMIT>;		\
+		};								\
+	}
diff --git a/target/linux/mvebu/image/Makefile b/target/linux/mvebu/image/Makefile
index b0498d34c9320c..9d6f207b3f2fde 100644
--- a/target/linux/mvebu/image/Makefile
+++ b/target/linux/mvebu/image/Makefile
@@ -53,6 +53,16 @@ define Build/buffalo-kernel-jffs2
 	rm -rf $(KDIR)/kernel_jffs2 $@.fakerd
 endef
 
+define Build/buffalo-kernel-ubifs
+	rm -rf $@-ubidir
+	mkdir -p $@-ubidir
+	mv $@ $@-ubidir/uImage.buffalo
+	touch $@
+	$(call Build/append-uImage-fakehdr, ramdisk)
+	mv $@ $@-ubidir/initrd.buffalo
+	$(STAGING_DIR_HOST)/bin/mkfs.ubifs $(KERNEL_UBIFS_OPTS) -r $@-ubidir $@
+endef
+
 # Some info about Ctera firmware:
 # 1. It's simple tar file (GNU standard), but it must have ".firm" suffix.
 # 2. It contains two images: kernel and romdisk. Both are required.
@@ -126,17 +136,6 @@ define Build/sdcard-img-ext4
 		83 $(CONFIG_TARGET_ROOTFS_PARTSIZE) $(IMAGE_ROOTFS)
 endef
 
-define Build/omnia-medkit-initramfs
-	$(TAR) -c -T /dev/null -f $@
-	rm -rf $(dir $(IMAGE_KERNEL))boot
-	mkdir -p $(dir $(IMAGE_KERNEL))boot/boot/
-	cp $(KDIR)/zImage-initramfs $(dir $(IMAGE_KERNEL))boot/boot/zImage
-	cp $(KDIR)/image-$(DEVICE_DTS).dtb $(dir $(IMAGE_KERNEL))boot/boot/dtb
-	$(TAR) -rp --numeric-owner --owner=0 --group=0 --sort=name \
-		$(if $(SOURCE_DATE_EPOCH),--mtime="@$(SOURCE_DATE_EPOCH)") \
-		--file=$@ -C $(dir $(IMAGE_KERNEL))boot/ .
-endef
-
 define Build/uDPU-firmware
 	(rm -fR $@-fw; mkdir -p $@-fw)
 	$(CP) $(BIN_DIR)/$(DEVICE_IMG_PREFIX)-initramfs.itb $@-fw/recovery.itb
diff --git a/target/linux/mvebu/image/cortexa9.mk b/target/linux/mvebu/image/cortexa9.mk
index d9738903fb0413..ba6213a89ef7f5 100644
--- a/target/linux/mvebu/image/cortexa9.mk
+++ b/target/linux/mvebu/image/cortexa9.mk
@@ -3,6 +3,19 @@
 # Copyright (C) 2012-2016 OpenWrt.org
 # Copyright (C) 2016 LEDE-project.org
 
+define Build/fortigate-header
+  ( \
+    dd if=/dev/zero bs=384 count=1 2>/dev/null; \
+    datalen=$$(wc -c $@ | cut -d' ' -f1); \
+    datalen=$$(printf "%08x" $$datalen); \
+    datalen="$${datalen:6:2}$${datalen:4:2}$${datalen:2:2}$${datalen:0:2}"; \
+    printf $$(echo "00020000$${datalen}ffff0000ffff0000" | sed 's/../\\x&/g'); \
+    dd if=/dev/zero bs=112 count=1 2>/dev/null; \
+    cat $@; \
+  ) > $@.new
+  mv $@.new $@
+endef
+
 define Device/dsa-migration
   DEVICE_COMPAT_VERSION := 1.1
   DEVICE_COMPAT_MESSAGE := Config cannot be migrated from swconfig to DSA
@@ -14,6 +27,21 @@ define Device/kernel-size-migration
 	Upgrade via sysupgrade mechanism is not possible, so new installation via factory style image is required.
 endef
 
+define Device/buffalo_ls220de
+  $(Device/NAND-128K)
+  DEVICE_VENDOR := Buffalo
+  DEVICE_MODEL := LinkStation LS220DE
+  KERNEL_UBIFS_OPTS = -m $$(PAGESIZE) -e 124KiB -c 172 -x none
+  KERNEL := kernel-bin | append-dtb | uImage none | buffalo-kernel-ubifs
+  KERNEL_INITRAMFS := kernel-bin | append-dtb | uImage none
+  DEVICE_DTS := armada-370-buffalo-ls220de
+  DEVICE_PACKAGES :=  \
+    kmod-hwmon-gpiofan kmod-hwmon-drivetemp kmod-linkstation-poweroff \
+    kmod-md-mod kmod-md-raid0 kmod-md-raid1 kmod-md-raid10 kmod-fs-xfs \
+    mdadm mkf2fs e2fsprogs partx-utils
+endef
+TARGET_DEVICES += buffalo_ls220de
+
 define Device/buffalo_ls421de
   $(Device/NAND-128K)
   DEVICE_VENDOR := Buffalo
@@ -58,17 +86,30 @@ define Device/cznic_turris-omnia
   KERNEL_INITRAMFS := kernel-bin | gzip | fit gzip $$(KDIR)/image-$$(DEVICE_DTS).dtb
   DEVICE_PACKAGES :=  \
     mkf2fs e2fsprogs kmod-fs-vfat kmod-nls-cp437 kmod-nls-iso8859-1 \
-    wpad-basic-wolfssl kmod-ath9k kmod-ath10k-ct ath10k-firmware-qca988x-ct \
+    wpad-basic-mbedtls kmod-ath9k kmod-ath10k-ct ath10k-firmware-qca988x-ct \
     partx-utils kmod-i2c-mux-pca954x kmod-leds-turris-omnia
-  IMAGES := $$(DEVICE_IMG_PREFIX)-sysupgrade.img.gz omnia-medkit-$$(DEVICE_IMG_PREFIX)-initramfs.tar.gz
-  IMAGE/$$(DEVICE_IMG_PREFIX)-sysupgrade.img.gz := boot-scr | boot-img | sdcard-img | gzip | append-metadata
-  IMAGE/omnia-medkit-$$(DEVICE_IMG_PREFIX)-initramfs.tar.gz := omnia-medkit-initramfs | gzip
-  DEVICE_IMG_NAME = $$(2)
+  IMAGES := sysupgrade.img.gz
+  IMAGE/sysupgrade.img.gz := boot-scr | boot-img | sdcard-img | gzip | append-metadata
   SUPPORTED_DEVICES += armada-385-turris-omnia
   BOOT_SCRIPT := turris-omnia
 endef
 TARGET_DEVICES += cznic_turris-omnia
 
+define Device/fortinet_fg-50e
+  DEVICE_VENDOR := Fortinet
+  DEVICE_MODEL := FortiGate 50E
+  SOC := armada-385
+  KERNEL := kernel-bin | append-dtb
+  KERNEL_INITRAMFS := kernel-bin | append-dtb | fortigate-header | \
+    gzip-filename FGT50E
+  KERNEL_SIZE := 6144k
+  DEVICE_DTS := armada-385-fortinet-fg-50e
+  IMAGE/sysupgrade.bin := append-rootfs | pad-rootfs | \
+    sysupgrade-tar rootfs=$$$$@ | append-metadata
+  DEVICE_PACKAGES := kmod-hwmon-nct7802
+endef
+TARGET_DEVICES += fortinet_fg-50e
+
 define Device/globalscale_mirabox
   $(Device/NAND-512K)
   DEVICE_VENDOR := Globalscale
@@ -101,7 +142,7 @@ define Device/kobol_helios4
   IMAGES := sdcard.img.gz
   IMAGE/sdcard.img.gz := boot-scr | boot-img-ext4 | sdcard-img-ext4 | gzip | append-metadata
   SOC := armada-388
-  UBOOT := helios4-u-boot-spl.kwb
+  UBOOT := helios4-u-boot-with-spl.kwb
   BOOT_SCRIPT := clearfog
 endef
 TARGET_DEVICES += kobol_helios4
@@ -109,7 +150,7 @@ TARGET_DEVICES += kobol_helios4
 define Device/linksys
   $(Device/NAND-128K)
   DEVICE_VENDOR := Linksys
-  DEVICE_PACKAGES := kmod-mwlwifi wpad-basic-wolfssl
+  DEVICE_PACKAGES := kmod-mwlwifi wpad-basic-mbedtls
   IMAGES += factory.img
   IMAGE/factory.img := append-kernel | pad-to $$$$(KERNEL_SIZE) | \
 	append-ubi | pad-to $$$$(PAGESIZE)
@@ -278,7 +319,7 @@ define Device/solidrun_clearfog-base-a1
   IMAGES := sdcard.img.gz
   IMAGE/sdcard.img.gz := boot-scr | boot-img-ext4 | sdcard-img-ext4 | gzip | append-metadata
   DEVICE_DTS := armada-388-clearfog-base armada-388-clearfog-pro
-  UBOOT := clearfog-u-boot-spl.kwb
+  UBOOT := clearfog-u-boot-with-spl.kwb
   BOOT_SCRIPT := clearfog
   SUPPORTED_DEVICES += armada-388-clearfog-base
   DEVICE_COMPAT_VERSION := 1.1
@@ -296,7 +337,7 @@ define Device/solidrun_clearfog-pro-a1
   IMAGES := sdcard.img.gz
   IMAGE/sdcard.img.gz := boot-scr | boot-img-ext4 | sdcard-img-ext4 | gzip | append-metadata
   DEVICE_DTS := armada-388-clearfog-pro armada-388-clearfog-base
-  UBOOT := clearfog-u-boot-spl.kwb
+  UBOOT := clearfog-u-boot-with-spl.kwb
   BOOT_SCRIPT := clearfog
   SUPPORTED_DEVICES += armada-388-clearfog armada-388-clearfog-pro
 endef
diff --git a/target/linux/mvebu/patches-5.15/100-ARM-dts-turris-omnia-configure-LED-0-pin-function-to.patch b/target/linux/mvebu/patches-5.15/100-ARM-dts-turris-omnia-configure-LED-0-pin-function-to.patch
index 27937375568184..67beb0654162a0 100644
--- a/target/linux/mvebu/patches-5.15/100-ARM-dts-turris-omnia-configure-LED-0-pin-function-to.patch
+++ b/target/linux/mvebu/patches-5.15/100-ARM-dts-turris-omnia-configure-LED-0-pin-function-to.patch
@@ -26,7 +26,7 @@ Signed-off-by: Marek Behún <kabel@kernel.org>
 
 --- a/arch/arm/boot/dts/armada-385-turris-omnia.dts
 +++ b/arch/arm/boot/dts/armada-385-turris-omnia.dts
-@@ -390,7 +390,8 @@
+@@ -396,7 +396,8 @@
  	phy1: ethernet-phy@1 {
  		compatible = "ethernet-phy-ieee802.3-c22";
  		reg = <1>;
diff --git a/target/linux/mvebu/patches-5.15/101-ARM-dts-turris-omnia-enable-LED-controller-node.patch b/target/linux/mvebu/patches-5.15/101-ARM-dts-turris-omnia-enable-LED-controller-node.patch
index 5b8ce56f5d6c8f..ecfb43553f517c 100644
--- a/target/linux/mvebu/patches-5.15/101-ARM-dts-turris-omnia-enable-LED-controller-node.patch
+++ b/target/linux/mvebu/patches-5.15/101-ARM-dts-turris-omnia-enable-LED-controller-node.patch
@@ -20,7 +20,7 @@ Signed-off-by: Marek Behún <kabel@kernel.org>
 
 --- a/arch/arm/boot/dts/armada-385-turris-omnia.dts
 +++ b/arch/arm/boot/dts/armada-385-turris-omnia.dts
-@@ -188,15 +188,13 @@
+@@ -194,15 +194,13 @@
  				reg = <0x2b>;
  				#address-cells = <1>;
  				#size-cells = <0>;
@@ -38,7 +38,7 @@ Signed-off-by: Marek Behún <kabel@kernel.org>
  				 * - there are 3 LEDs connected via MCU to PCIe
  				 *   ports. One of these ports supports mSATA.
  				 *   There is no mSATA nor PCIe function.
-@@ -207,7 +205,6 @@
+@@ -213,7 +211,6 @@
  				 *   B. Again there is no such function defined.
  				 *   For now we use LED_FUNCTION_INDICATOR
  				 */
diff --git a/target/linux/mvebu/patches-5.15/105-power-reset-linkstation-poweroff-add-ls220de.patch b/target/linux/mvebu/patches-5.15/105-power-reset-linkstation-poweroff-add-ls220de.patch
new file mode 100644
index 00000000000000..32238612344b57
--- /dev/null
+++ b/target/linux/mvebu/patches-5.15/105-power-reset-linkstation-poweroff-add-ls220de.patch
@@ -0,0 +1,15 @@
+--- a/drivers/power/reset/linkstation-poweroff.c
++++ b/drivers/power/reset/linkstation-poweroff.c
+@@ -142,6 +142,12 @@ static void linkstation_poweroff(void)
+ }
+ 
+ static const struct of_device_id ls_poweroff_of_match[] = {
++	{ .compatible = "buffalo,ls220d",
++	  .data = &linkstation_power_off_cfg,
++	},
++	{ .compatible = "buffalo,ls220de",
++	  .data = &linkstation_power_off_cfg,
++	},
+ 	{ .compatible = "buffalo,ls421d",
+ 	  .data = &linkstation_power_off_cfg,
+ 	},
diff --git a/target/linux/mvebu/patches-5.15/300-mvebu-Mangle-bootloader-s-kernel-arguments.patch b/target/linux/mvebu/patches-5.15/300-mvebu-Mangle-bootloader-s-kernel-arguments.patch
index 90d8b05cfca5b5..9069de16146981 100644
--- a/target/linux/mvebu/patches-5.15/300-mvebu-Mangle-bootloader-s-kernel-arguments.patch
+++ b/target/linux/mvebu/patches-5.15/300-mvebu-Mangle-bootloader-s-kernel-arguments.patch
@@ -57,16 +57,58 @@ Signed-off-by: Michael Gray <michael.gray@lantisproject.com>
  #else
  #define do_extend_cmdline 0
  #endif
-@@ -69,6 +71,72 @@ static uint32_t get_cell_size(const void
+@@ -20,6 +22,7 @@ static int node_offset(void *fdt, const
+ 	return offset;
+ }
+ 
++#ifndef CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
+ static int setprop(void *fdt, const char *node_path, const char *property,
+ 		   void *val_array, int size)
+ {
+@@ -28,6 +31,7 @@ static int setprop(void *fdt, const char
+ 		return offset;
+ 	return fdt_setprop(fdt, offset, property, val_array, size);
+ }
++#endif
+ 
+ static int setprop_string(void *fdt, const char *node_path,
+ 			  const char *property, const char *string)
+@@ -38,6 +42,7 @@ static int setprop_string(void *fdt, con
+ 	return fdt_setprop_string(fdt, offset, property, string);
+ }
+ 
++#ifndef CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
+ static int setprop_cell(void *fdt, const char *node_path,
+ 			const char *property, uint32_t val)
+ {
+@@ -46,6 +51,7 @@ static int setprop_cell(void *fdt, const
+ 		return offset;
+ 	return fdt_setprop_cell(fdt, offset, property, val);
+ }
++#endif
+ 
+ static const void *getprop(const void *fdt, const char *node_path,
+ 			   const char *property, int *len)
+@@ -58,6 +64,7 @@ static const void *getprop(const void *f
+ 	return fdt_getprop(fdt, offset, property, len);
+ }
+ 
++#ifndef CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
+ static uint32_t get_cell_size(const void *fdt)
+ {
+ 	int len;
+@@ -69,6 +76,74 @@ static uint32_t get_cell_size(const void
  	return cell_size;
  }
  
++#endif
++
 +#if defined(CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE)
 +
 +static char *append_rootblock(char *dest, const char *str, int len, void *fdt)
 +{
-+	char *ptr, *end;
-+	char *root="root=";
++	const char *ptr, *end;
++	const char *root="root=";
 +	int i, l;
 +	const char *rootblock;
 +
@@ -130,7 +172,7 @@ Signed-off-by: Michael Gray <michael.gray@lantisproject.com>
  static void merge_fdt_bootargs(void *fdt, const char *fdt_cmdline)
  {
  	char cmdline[COMMAND_LINE_SIZE];
-@@ -88,12 +156,21 @@ static void merge_fdt_bootargs(void *fdt
+@@ -88,18 +163,28 @@ static void merge_fdt_bootargs(void *fdt
  
  	/* and append the ATAG_CMDLINE */
  	if (fdt_cmdline) {
@@ -152,7 +194,36 @@ Signed-off-by: Michael Gray <michael.gray@lantisproject.com>
  	}
  	*ptr = '\0';
  
-@@ -168,7 +245,9 @@ int atags_to_fdt(void *atag_list, void *
+ 	setprop_string(fdt, "/chosen", "bootargs", cmdline);
+ }
+ 
++#ifndef CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
+ static void hex_str(char *out, uint32_t value)
+ {
+ 	uint32_t digit;
+@@ -117,6 +202,7 @@ static void hex_str(char *out, uint32_t
+ 	}
+ 	*out = '\0';
+ }
++#endif
+ 
+ /*
+  * Convert and fold provided ATAGs into the provided FDT.
+@@ -131,9 +217,11 @@ int atags_to_fdt(void *atag_list, void *
+ 	struct tag *atag = atag_list;
+ 	/* In the case of 64 bits memory size, need to reserve 2 cells for
+ 	 * address and size for each bank */
++#ifndef CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
+ 	__be32 mem_reg_property[2 * 2 * NR_BANKS];
+-	int memcount = 0;
+-	int ret, memsize;
++	int memsize, memcount = 0;
++#endif
++	int ret;
+ 
+ 	/* make sure we've got an aligned pointer */
+ 	if ((u32)atag_list & 0x3)
+@@ -168,7 +256,9 @@ int atags_to_fdt(void *atag_list, void *
  			else
  				setprop_string(fdt, "/chosen", "bootargs",
  					       atag->u.cmdline.cmdline);
@@ -163,7 +234,7 @@ Signed-off-by: Michael Gray <michael.gray@lantisproject.com>
  			if (memcount >= sizeof(mem_reg_property)/4)
  				continue;
  			if (!atag->u.mem.size)
-@@ -212,6 +291,10 @@ int atags_to_fdt(void *atag_list, void *
+@@ -212,6 +302,10 @@ int atags_to_fdt(void *atag_list, void *
  		setprop(fdt, "/memory", "reg", mem_reg_property,
  			4 * memcount * memsize);
  	}
diff --git a/target/linux/mvebu/patches-5.15/700-mvneta-tx-queue-workaround.patch b/target/linux/mvebu/patches-5.15/700-mvneta-tx-queue-workaround.patch
index 826f95d1c2ceef..32e8ef4b7d8727 100644
--- a/target/linux/mvebu/patches-5.15/700-mvneta-tx-queue-workaround.patch
+++ b/target/linux/mvebu/patches-5.15/700-mvneta-tx-queue-workaround.patch
@@ -9,7 +9,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 ---
 --- a/drivers/net/ethernet/marvell/mvneta.c
 +++ b/drivers/net/ethernet/marvell/mvneta.c
-@@ -4943,6 +4943,16 @@ static int mvneta_setup_tc(struct net_de
+@@ -5006,6 +5006,16 @@ static int mvneta_setup_tc(struct net_de
  	}
  }
  
@@ -26,7 +26,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static const struct net_device_ops mvneta_netdev_ops = {
  	.ndo_open            = mvneta_open,
  	.ndo_stop            = mvneta_stop,
-@@ -4953,6 +4963,9 @@ static const struct net_device_ops mvnet
+@@ -5016,6 +5026,9 @@ static const struct net_device_ops mvnet
  	.ndo_fix_features    = mvneta_fix_features,
  	.ndo_get_stats64     = mvneta_get_stats64,
  	.ndo_eth_ioctl        = mvneta_ioctl,
diff --git a/target/linux/mvebu/patches-5.15/702-net-next-ethernet-marvell-mvnetaMQPrioOffload.patch b/target/linux/mvebu/patches-5.15/702-net-next-ethernet-marvell-mvnetaMQPrioOffload.patch
index c3a6d9f4d06b45..019b9528c360e5 100644
--- a/target/linux/mvebu/patches-5.15/702-net-next-ethernet-marvell-mvnetaMQPrioOffload.patch
+++ b/target/linux/mvebu/patches-5.15/702-net-next-ethernet-marvell-mvnetaMQPrioOffload.patch
@@ -26,7 +26,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  #include <linux/bpf_trace.h>
  
  /* Registers */
-@@ -4903,14 +4904,14 @@ static void mvneta_setup_rx_prio_map(str
+@@ -4966,14 +4967,14 @@ static void mvneta_setup_rx_prio_map(str
  }
  
  static int mvneta_setup_mqprio(struct net_device *dev,
@@ -44,7 +44,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	if (num_tc > rxq_number)
  		return -EINVAL;
-@@ -4921,13 +4922,15 @@ static int mvneta_setup_mqprio(struct ne
+@@ -4984,13 +4985,15 @@ static int mvneta_setup_mqprio(struct ne
  		return 0;
  	}
  
diff --git a/target/linux/mvebu/patches-5.15/703-net-next-ethernet-marvell-mvnetaMQPrioFlag.patch b/target/linux/mvebu/patches-5.15/703-net-next-ethernet-marvell-mvnetaMQPrioFlag.patch
index 8ef585be9a1224..c878a288439216 100644
--- a/target/linux/mvebu/patches-5.15/703-net-next-ethernet-marvell-mvnetaMQPrioFlag.patch
+++ b/target/linux/mvebu/patches-5.15/703-net-next-ethernet-marvell-mvnetaMQPrioFlag.patch
@@ -17,7 +17,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/drivers/net/ethernet/marvell/mvneta.c
 +++ b/drivers/net/ethernet/marvell/mvneta.c
-@@ -4910,7 +4910,9 @@ static int mvneta_setup_mqprio(struct ne
+@@ -4973,7 +4973,9 @@ static int mvneta_setup_mqprio(struct ne
  	u8 num_tc;
  	int i;
  
diff --git a/target/linux/mvebu/patches-5.15/704-net-next-ethernet-marvell-mvnetaMQPrioQueue.patch b/target/linux/mvebu/patches-5.15/704-net-next-ethernet-marvell-mvnetaMQPrioQueue.patch
index 196b986541e976..546a8486ef0588 100644
--- a/target/linux/mvebu/patches-5.15/704-net-next-ethernet-marvell-mvnetaMQPrioQueue.patch
+++ b/target/linux/mvebu/patches-5.15/704-net-next-ethernet-marvell-mvnetaMQPrioQueue.patch
@@ -22,7 +22,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/drivers/net/ethernet/marvell/mvneta.c
 +++ b/drivers/net/ethernet/marvell/mvneta.c
-@@ -493,7 +493,6 @@ struct mvneta_port {
+@@ -498,7 +498,6 @@ struct mvneta_port {
  	u8 mcast_count[256];
  	u16 tx_ring_size;
  	u16 rx_ring_size;
@@ -30,7 +30,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	phy_interface_t phy_interface;
  	struct device_node *dn;
-@@ -4892,13 +4891,12 @@ static void mvneta_clear_rx_prio_map(str
+@@ -4955,13 +4954,12 @@ static void mvneta_clear_rx_prio_map(str
  	mvreg_write(pp, MVNETA_VLAN_PRIO_TO_RXQ, 0);
  }
  
@@ -48,7 +48,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	mvreg_write(pp, MVNETA_VLAN_PRIO_TO_RXQ, val);
  }
-@@ -4907,8 +4905,8 @@ static int mvneta_setup_mqprio(struct ne
+@@ -4970,8 +4968,8 @@ static int mvneta_setup_mqprio(struct ne
  			       struct tc_mqprio_qopt_offload *mqprio)
  {
  	struct mvneta_port *pp = netdev_priv(dev);
@@ -58,7 +58,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	if (mqprio->qopt.hw != TC_MQPRIO_HW_OFFLOAD_TCS)
  		return 0;
-@@ -4918,21 +4916,28 @@ static int mvneta_setup_mqprio(struct ne
+@@ -4981,21 +4979,28 @@ static int mvneta_setup_mqprio(struct ne
  	if (num_tc > rxq_number)
  		return -EINVAL;
  
diff --git a/target/linux/mvebu/patches-5.15/705-net-next-ethernet-marvell-mvnetaMQPrioTCOffload.patch b/target/linux/mvebu/patches-5.15/705-net-next-ethernet-marvell-mvnetaMQPrioTCOffload.patch
index d640da4d4490e4..1d4a055a71938e 100644
--- a/target/linux/mvebu/patches-5.15/705-net-next-ethernet-marvell-mvnetaMQPrioTCOffload.patch
+++ b/target/linux/mvebu/patches-5.15/705-net-next-ethernet-marvell-mvnetaMQPrioTCOffload.patch
@@ -62,7 +62,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  #define MVNETA_LPI_CTRL_0                        0x2cc0
  #define MVNETA_LPI_CTRL_1                        0x2cc4
  #define      MVNETA_LPI_REQUEST_ENABLE           BIT(0)
-@@ -4901,11 +4928,74 @@ static void mvneta_map_vlan_prio_to_rxq(
+@@ -4964,11 +4991,74 @@ static void mvneta_map_vlan_prio_to_rxq(
  	mvreg_write(pp, MVNETA_VLAN_PRIO_TO_RXQ, val);
  }
  
@@ -138,7 +138,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	u8 num_tc;
  
  	if (mqprio->qopt.hw != TC_MQPRIO_HW_OFFLOAD_TCS)
-@@ -4919,6 +5009,7 @@ static int mvneta_setup_mqprio(struct ne
+@@ -4982,6 +5072,7 @@ static int mvneta_setup_mqprio(struct ne
  	mvneta_clear_rx_prio_map(pp);
  
  	if (!num_tc) {
@@ -146,7 +146,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		netdev_reset_tc(dev);
  		return 0;
  	}
-@@ -4939,6 +5030,33 @@ static int mvneta_setup_mqprio(struct ne
+@@ -5002,6 +5093,33 @@ static int mvneta_setup_mqprio(struct ne
  		}
  	}
  
diff --git a/target/linux/mvebu/patches-5.15/710-v6.2-phy-marvell-phy-mvebu-a3700-comphy-Reset-COMPHY-regi.patch b/target/linux/mvebu/patches-5.15/710-v6.2-phy-marvell-phy-mvebu-a3700-comphy-Reset-COMPHY-regi.patch
new file mode 100644
index 00000000000000..a852dc1fc11f78
--- /dev/null
+++ b/target/linux/mvebu/patches-5.15/710-v6.2-phy-marvell-phy-mvebu-a3700-comphy-Reset-COMPHY-regi.patch
@@ -0,0 +1,50 @@
+From b01d622d76134e9401970ffd3fbbb9a7051f976a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
+Date: Tue, 20 Sep 2022 14:11:54 +0200
+Subject: [PATCH] phy: marvell: phy-mvebu-a3700-comphy: Reset COMPHY registers
+ before USB 3.0 power on
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Turris MOX board with older ARM Trusted Firmware version v1.5 is not able
+to detect any USB 3.0 device connected to USB-A port on Mox-A module after
+commit 0a6fc70d76bd ("phy: marvell: phy-mvebu-a3700-comphy: Remove broken
+reset support"). On the other hand USB 2.0 devices connected to the same
+USB-A port are working fine.
+
+It looks as if the older firmware configures COMPHY registers for USB 3.0
+somehow incompatibly for kernel driver. Experiments show that resetting
+COMPHY registers via setting SFT_RST auto-clearing bit in COMPHY_SFT_RESET
+register fixes this issue.
+
+Reset the COMPHY in mvebu_a3700_comphy_usb3_power_on() function as a first
+step after selecting COMPHY lane and USB 3.0 function. With this change
+Turris MOX board can successfully detect USB 3.0 devices again.
+
+Before the above mentioned commit this reset was implemented in PHY reset
+method, so this is the reason why there was no issue with older firmware
+version then.
+
+Fixes: 0a6fc70d76bd ("phy: marvell: phy-mvebu-a3700-comphy: Remove broken reset support")
+Reported-by: Marek Behún <kabel@kernel.org>
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Link: https://lore.kernel.org/r/20220920121154.30115-1-pali@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+---
+ drivers/phy/marvell/phy-mvebu-a3700-comphy.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/phy/marvell/phy-mvebu-a3700-comphy.c
++++ b/drivers/phy/marvell/phy-mvebu-a3700-comphy.c
+@@ -826,6 +826,9 @@ mvebu_a3700_comphy_usb3_power_on(struct
+ 	if (ret)
+ 		return ret;
+ 
++	/* COMPHY register reset (cleared automatically) */
++	comphy_lane_reg_set(lane, COMPHY_SFT_RESET, SFT_RST, SFT_RST);
++
+ 	/*
+ 	 * 0. Set PHY OTG Control(0x5d034), bit 4, Power up OTG module The
+ 	 * register belong to UTMI module, so it is set in UTMI phy driver.
diff --git a/target/linux/mvebu/patches-5.15/902-drivers-mfd-Add-a-driver-for-IEI-WT61P803-PUZZLE-MCU.patch b/target/linux/mvebu/patches-5.15/902-drivers-mfd-Add-a-driver-for-IEI-WT61P803-PUZZLE-MCU.patch
index 84d995b902a46e..0e546b426edd0d 100644
--- a/target/linux/mvebu/patches-5.15/902-drivers-mfd-Add-a-driver-for-IEI-WT61P803-PUZZLE-MCU.patch
+++ b/target/linux/mvebu/patches-5.15/902-drivers-mfd-Add-a-driver-for-IEI-WT61P803-PUZZLE-MCU.patch
@@ -26,7 +26,7 @@ Cc: Robert Marko <robert.marko@sartura.hr>
 
 --- a/drivers/mfd/Kconfig
 +++ b/drivers/mfd/Kconfig
-@@ -2187,6 +2187,15 @@ config SGI_MFD_IOC3
+@@ -2189,6 +2189,15 @@ config SGI_MFD_IOC3
  	  If you have an SGI Origin, Octane, or a PCI IOC3 card,
  	  then say Y. Otherwise say N.
  
diff --git a/target/linux/mvebu/patches-5.15/903-drivers-hwmon-Add-the-IEI-WT61P803-PUZZLE-HWMON-driv.patch b/target/linux/mvebu/patches-5.15/903-drivers-hwmon-Add-the-IEI-WT61P803-PUZZLE-HWMON-driv.patch
index c22314e41c5be6..023495373b86ed 100644
--- a/target/linux/mvebu/patches-5.15/903-drivers-hwmon-Add-the-IEI-WT61P803-PUZZLE-HWMON-driv.patch
+++ b/target/linux/mvebu/patches-5.15/903-drivers-hwmon-Add-the-IEI-WT61P803-PUZZLE-HWMON-driv.patch
@@ -53,7 +53,7 @@ Cc: Robert Marko <robert.marko@sartura.hr>
  obj-$(CONFIG_SENSORS_IBMPOWERNV)+= ibmpowernv.o
 --- /dev/null
 +++ b/drivers/hwmon/iei-wt61p803-puzzle-hwmon.c
-@@ -0,0 +1,413 @@
+@@ -0,0 +1,445 @@
 +// SPDX-License-Identifier: GPL-2.0-only
 +/* IEI WT61P803 PUZZLE MCU HWMON Driver
 + *
@@ -84,13 +84,17 @@ Cc: Robert Marko <robert.marko@sartura.hr>
 + * @name:		Thermal cooling device name
 + * @pwm_channel:	Controlled PWM channel (0 or 1)
 + * @cooling_levels:	Thermal cooling device cooling levels (DT)
++ * @cur_level:		Current cooling level
++ * @num_levels:	Number of cooling levels
 + */
 +struct iei_wt61p803_puzzle_thermal_cooling_device {
 +	struct iei_wt61p803_puzzle_hwmon *mcu_hwmon;
 +	struct thermal_cooling_device *tcdev;
 +	char name[THERMAL_NAME_LENGTH];
 +	int pwm_channel;
-+	u8 *cooling_levels;
++	u32 *cooling_levels;
++	int cur_level;
++	u8 num_levels;
 +};
 +
 +/**
@@ -326,8 +330,12 @@ Cc: Robert Marko <robert.marko@sartura.hr>
 +static int iei_wt61p803_puzzle_get_max_state(struct thermal_cooling_device *tcdev,
 +					     unsigned long *state)
 +{
-+	*state = IEI_WT61P803_PUZZLE_HWMON_MAX_PWM_VAL;
++	struct iei_wt61p803_puzzle_thermal_cooling_device *cdev = tcdev->devdata;
++
++	if (!cdev)
++		return -EINVAL;
 +
++	*state = cdev->num_levels - 1;
 +	return 0;
 +}
 +
@@ -335,14 +343,14 @@ Cc: Robert Marko <robert.marko@sartura.hr>
 +					     unsigned long *state)
 +{
 +	struct iei_wt61p803_puzzle_thermal_cooling_device *cdev = tcdev->devdata;
-+	struct iei_wt61p803_puzzle_hwmon *mcu_hwmon = cdev->mcu_hwmon;
-+	long value;
-+	int ret;
 +
-+	ret = iei_wt61p803_puzzle_read_pwm_channel(mcu_hwmon, cdev->pwm_channel, &value);
-+	if (ret)
-+		return ret;
-+	*state = value;
++	if (!cdev)
++		return -EINVAL;
++
++	if (cdev->cur_level < 0)
++		return -EAGAIN;
++
++	*state = cdev->cur_level;
 +	return 0;
 +}
 +
@@ -350,9 +358,21 @@ Cc: Robert Marko <robert.marko@sartura.hr>
 +					     unsigned long state)
 +{
 +	struct iei_wt61p803_puzzle_thermal_cooling_device *cdev = tcdev->devdata;
-+	struct iei_wt61p803_puzzle_hwmon *mcu_hwmon = cdev->mcu_hwmon;
++	u8 pwm_level;
++
++	if (!cdev)
++		return -EINVAL;
 +
-+	return iei_wt61p803_puzzle_write_pwm_channel(mcu_hwmon, cdev->pwm_channel, state);
++	if (state >= cdev->num_levels)
++		return -EINVAL;
++
++	if (state == cdev->cur_level)
++		return 0;
++
++	cdev->cur_level = state;
++	pwm_level = cdev->cooling_levels[state];
++
++	return iei_wt61p803_puzzle_write_pwm_channel(cdev->mcu_hwmon, cdev->pwm_channel, pwm_level);
 +}
 +
 +static const struct thermal_cooling_device_ops iei_wt61p803_puzzle_cooling_ops = {
@@ -369,7 +389,7 @@ Cc: Robert Marko <robert.marko@sartura.hr>
 +	struct iei_wt61p803_puzzle_thermal_cooling_device *cdev;
 +	u32 pwm_channel;
 +	u8 num_levels;
-+	int ret;
++	int i, ret;
 +
 +	ret = fwnode_property_read_u32(child, "reg", &pwm_channel);
 +	if (ret)
@@ -377,7 +397,7 @@ Cc: Robert Marko <robert.marko@sartura.hr>
 +
 +	mcu_hwmon->thermal_cooling_dev_present[pwm_channel] = true;
 +
-+	num_levels = fwnode_property_count_u8(child, "cooling-levels");
++	num_levels = fwnode_property_count_u32(child, "cooling-levels");
 +	if (!num_levels)
 +		return -EINVAL;
 +
@@ -385,28 +405,40 @@ Cc: Robert Marko <robert.marko@sartura.hr>
 +	if (!cdev)
 +		return -ENOMEM;
 +
-+	cdev->cooling_levels = devm_kmalloc_array(dev, num_levels, sizeof(u8), GFP_KERNEL);
++	cdev->cooling_levels = devm_kmalloc_array(dev, num_levels, sizeof(u32), GFP_KERNEL);
 +	if (!cdev->cooling_levels)
 +		return -ENOMEM;
 +
-+	ret = fwnode_property_read_u8_array(child, "cooling-levels",
-+					    cdev->cooling_levels,
-+					    num_levels);
++	ret = fwnode_property_read_u32_array(child, "cooling-levels",
++					     cdev->cooling_levels,
++					     num_levels);
 +	if (ret) {
 +		dev_err(dev, "Couldn't read property 'cooling-levels'\n");
 +		return ret;
 +	}
 +
-+	snprintf(cdev->name, THERMAL_NAME_LENGTH, "wt61p803_puzzle_%d", pwm_channel);
-+	cdev->tcdev = devm_thermal_of_cooling_device_register(dev, NULL, cdev->name, cdev,
-+							      &iei_wt61p803_puzzle_cooling_ops);
-+	if (IS_ERR(cdev->tcdev))
-+		return PTR_ERR(cdev->tcdev);
++	for (i = 0; i < num_levels; i++) {
++		if (cdev->cooling_levels[i] >
++		    IEI_WT61P803_PUZZLE_HWMON_MAX_PWM_VAL) {
++			dev_err(dev, "iei_wt61p803_fan state[%d]:%d > %d\n", i,
++				cdev->cooling_levels[i],
++				IEI_WT61P803_PUZZLE_HWMON_MAX_PWM_VAL);
++			return -EINVAL;
++		}
++	}
 +
 +	cdev->mcu_hwmon = mcu_hwmon;
 +	cdev->pwm_channel = pwm_channel;
++	cdev->num_levels = num_levels;
++	cdev->cur_level = -1;
 +	mcu_hwmon->cdev[pwm_channel] = cdev;
 +
++	snprintf(cdev->name, THERMAL_NAME_LENGTH, "wt61p803_puzzle_%d", pwm_channel);
++	cdev->tcdev = devm_thermal_of_cooling_device_register(dev, to_of_node(child), cdev->name,
++							      cdev, &iei_wt61p803_puzzle_cooling_ops);
++	if (IS_ERR(cdev->tcdev))
++		return PTR_ERR(cdev->tcdev);
++
 +	return 0;
 +}
 +
diff --git a/target/linux/mvebu/patches-5.15/907-MAINTAINERS-Add-an-entry-for-the-IEI-WT61P803-PUZZLE.patch b/target/linux/mvebu/patches-5.15/907-MAINTAINERS-Add-an-entry-for-the-IEI-WT61P803-PUZZLE.patch
index f2f4748e00144f..b8accf180bb005 100644
--- a/target/linux/mvebu/patches-5.15/907-MAINTAINERS-Add-an-entry-for-the-IEI-WT61P803-PUZZLE.patch
+++ b/target/linux/mvebu/patches-5.15/907-MAINTAINERS-Add-an-entry-for-the-IEI-WT61P803-PUZZLE.patch
@@ -16,7 +16,7 @@ Cc: Robert Marko <robert.marko@sartura.hr>
 
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -9066,6 +9066,22 @@ F:	include/net/nl802154.h
+@@ -9063,6 +9063,22 @@ F:	include/net/nl802154.h
  F:	net/ieee802154/
  F:	net/mac802154/
  
diff --git a/target/linux/mvebu/patches-5.15/911-drivers-leds-wt61p803-puzzle-mcu-retry.patch b/target/linux/mvebu/patches-5.15/911-drivers-leds-wt61p803-puzzle-mcu-retry.patch
new file mode 100644
index 00000000000000..2f0b1788ff68f2
--- /dev/null
+++ b/target/linux/mvebu/patches-5.15/911-drivers-leds-wt61p803-puzzle-mcu-retry.patch
@@ -0,0 +1,63 @@
+--- a/drivers/mfd/iei-wt61p803-puzzle.c
++++ b/drivers/mfd/iei-wt61p803-puzzle.c
+@@ -241,6 +241,7 @@ int iei_wt61p803_puzzle_write_command(st
+ {
+ 	struct device *dev = &mcu->serdev->dev;
+ 	int ret;
++	int retries;
+ 
+ 	if (size <= 1 || size > IEI_WT61P803_PUZZLE_MAX_COMMAND_LENGTH)
+ 		return -EINVAL;
+@@ -252,24 +253,36 @@ int iei_wt61p803_puzzle_write_command(st
+ 	print_hex_dump_debug("puzzle-mcu tx: ", DUMP_PREFIX_NONE,
+ 			     16, 1, cmd, size, false);
+ 
++	retries = 3;
+ 	/* Initialize reply struct */
+-	reinit_completion(&mcu->reply->received);
+-	mcu->reply->size = 0;
+-	usleep_range(2000, 10000);
+-	serdev_device_write_flush(mcu->serdev);
+-	ret = serdev_device_write_buf(mcu->serdev, cmd, size);
+-	if (ret < 0)
+-		goto exit;
+-
+-	serdev_device_wait_until_sent(mcu->serdev, IEI_WT61P803_PUZZLE_GENERAL_TIMEOUT);
+-	ret = wait_for_completion_timeout(&mcu->reply->received,
+-					  IEI_WT61P803_PUZZLE_GENERAL_TIMEOUT);
+-	if (ret == 0) {
+-		dev_err(dev, "Command reply receive timeout\n");
+-		ret = -ETIMEDOUT;
+-		goto exit;
++	while (retries) {
++		reinit_completion(&mcu->reply->received);
++		mcu->reply->size = 0;
++		usleep_range(2000, 10000);
++		serdev_device_write_flush(mcu->serdev);
++		ret = serdev_device_write_buf(mcu->serdev, cmd, size);
++		if (ret < 0)
++			goto exit;
++
++		serdev_device_wait_until_sent(mcu->serdev, IEI_WT61P803_PUZZLE_GENERAL_TIMEOUT);
++		ret = wait_for_completion_timeout(&mcu->reply->received,
++						  IEI_WT61P803_PUZZLE_GENERAL_TIMEOUT);
++		retries--;
++		if (ret == 0) {
++			if (retries == 0) {
++				dev_err(dev, "Command reply receive timeout\n");
++				ret = -ETIMEDOUT;
++				goto exit;
++			}
++		}
++		else {
++			if (mcu->reply->data[0] == IEI_WT61P803_PUZZLE_CMD_HEADER_START &&
++				mcu->reply->data[1] == IEI_WT61P803_PUZZLE_CMD_RESPONSE_OK &&
++				mcu->reply->data[2] == IEI_WT61P803_PUZZLE_CHECKSUM_RESPONSE_OK) {
++				break;
++			}
++		}
+ 	}
+-
+ 	*reply_size = mcu->reply->size;
+ 	/* Copy the received data, as it will not be available after a new frame is received */
+ 	memcpy(reply_data, mcu->reply->data, mcu->reply->size);
diff --git a/target/linux/mxs/Makefile b/target/linux/mxs/Makefile
index 7b6c6ee3f1540e..6ae4814e95aead 100644
--- a/target/linux/mxs/Makefile
+++ b/target/linux/mxs/Makefile
@@ -9,9 +9,9 @@ BOARD:=mxs
 BOARDNAME:=Freescale i.MX23/i.MX28
 FEATURES:=ext4 rtc usb gpio
 CPU_TYPE:=arm926ej-s
+SUBTARGETS:=generic
 
-KERNEL_PATCHVER:=5.10
-KERNEL_TESTING_PATCHVER:=5.15
+KERNEL_PATCHVER:=5.15
 
 KERNELNAME:=zImage dtbs
 
diff --git a/target/linux/mxs/config-5.15 b/target/linux/mxs/config-5.15
index 4d3f1d42cf300f..67b2cfa373e870 100644
--- a/target/linux/mxs/config-5.15
+++ b/target/linux/mxs/config-5.15
@@ -21,6 +21,7 @@ CONFIG_ARM_APPENDED_DTB=y
 CONFIG_ARM_ATAG_DTB_COMPAT=y
 CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_FROM_BOOTLOADER=y
 CONFIG_ARM_CPU_SUSPEND=y
+CONFIG_ARM_CRYPTO=y
 CONFIG_ARM_HAS_SG_CHAIN=y
 CONFIG_ARM_L1_CACHE_SHIFT=5
 CONFIG_ARM_PATCH_PHYS_VIRT=y
@@ -56,7 +57,6 @@ CONFIG_CPU_TLB_V4WBI=y
 CONFIG_CPU_USE_DOMAINS=y
 CONFIG_CRC16=y
 CONFIG_CROSS_MEMORY_ATTACH=y
-CONFIG_CRYPTO_BLAKE2S=y
 CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_CRC32C=y
 CONFIG_CRYPTO_DEV_MXS_DCP=y
diff --git a/target/linux/mxs/generic/target.mk b/target/linux/mxs/generic/target.mk
new file mode 100644
index 00000000000000..f5cb1fb19b943f
--- /dev/null
+++ b/target/linux/mxs/generic/target.mk
@@ -0,0 +1 @@
+BOARDNAME:=Generic
diff --git a/target/linux/mxs/image/Config.in b/target/linux/mxs/image/Config.in
index 250553e3566562..a04700a440b72d 100644
--- a/target/linux/mxs/image/Config.in
+++ b/target/linux/mxs/image/Config.in
@@ -1,6 +1,6 @@
 config TARGET_BOOTFS_PARTSIZE
 	int "Boot (SD Card) filesystem partition size (in MB)"
-	depends on TARGET_mxs_olinuxino-maxi || TARGET_mxs_olinuxino-micro
+	depends on TARGET_mxs_generic_olinuxino-maxi || TARGET_mxs_generic_olinuxino-micro
 	default 8
 	help
 	    On the Olimex OLinuXino boards, mainline U-Boot loads the
diff --git a/target/linux/mxs/profiles/02-olinuxino-maxi.mk b/target/linux/mxs/profiles/02-olinuxino-maxi.mk
index 662c9f2254a93d..dd333629b8d66b 100644
--- a/target/linux/mxs/profiles/02-olinuxino-maxi.mk
+++ b/target/linux/mxs/profiles/02-olinuxino-maxi.mk
@@ -5,8 +5,8 @@
 define Profile/olinuxino-maxi
   NAME:=Olimex OLinuXino Maxi/Mini boards
   PACKAGES += imx-bootlets uboot-mxs-mx23_olinuxino \
-	  kmod-usb-net-smsc95xx kmod-gpio-mcp23s08 \
-	  kmod-leds-gpio kmod-sound-core
+	  kmod-usb-net-smsc95xx kmod-pinctrl-mcp23s08-i2c \
+	  kmod-pinctrl-mcp23s08-spi kmod-leds-gpio kmod-sound-core
 endef
 
 define Profile/olinuxino-maxi/Description
diff --git a/target/linux/mxs/profiles/03-olinuxino-micro.mk b/target/linux/mxs/profiles/03-olinuxino-micro.mk
index 31a767188ce091..8413ebbdca0250 100644
--- a/target/linux/mxs/profiles/03-olinuxino-micro.mk
+++ b/target/linux/mxs/profiles/03-olinuxino-micro.mk
@@ -5,7 +5,8 @@
 define Profile/olinuxino-micro
   NAME:=Olimex OLinuXino Micro/Nano boards
   PACKAGES += imx-bootlets uboot-mxs-mx23_olinuxino \
-	  kmod-gpio-mcp23s08 kmod-leds-gpio
+	  kmod-pinctrl-mcp23s08-spi kmod-pinctrl-mcp23s08-i2c \
+	  kmod-leds-gpio
 endef
 
 define Profile/olinuxino-micro/Description
diff --git a/target/linux/octeon/Makefile b/target/linux/octeon/Makefile
index beb3e5436ad1b5..4b5c4c07c103a3 100644
--- a/target/linux/octeon/Makefile
+++ b/target/linux/octeon/Makefile
@@ -10,8 +10,7 @@ BOARDNAME:=Cavium Networks Octeon
 FEATURES:=squashfs ramdisk pci usb
 CPU_TYPE:=octeonplus
 
-KERNEL_PATCHVER:=5.10
-KERNEL_TESTING_PATCHVER:=5.15
+KERNEL_PATCHVER:=5.15
 
 define Target/Description
 	Build firmware images for Cavium Networks Octeon-based boards.
diff --git a/target/linux/octeon/config-5.15 b/target/linux/octeon/config-5.15
index f1258586366e50..5882c7dd757325 100644
--- a/target/linux/octeon/config-5.15
+++ b/target/linux/octeon/config-5.15
@@ -34,7 +34,6 @@ CONFIG_CPU_HAS_DIEI=y
 CONFIG_CPU_HAS_PREFETCH=y
 CONFIG_CPU_HAS_RIXI=y
 CONFIG_CPU_HAS_SYNC=y
-# CONFIG_CPU_LITTLE_ENDIAN is not set
 CONFIG_CPU_MIPS64=y
 CONFIG_CPU_MIPSR2=y
 CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
@@ -71,7 +70,6 @@ CONFIG_EXT4_FS=y
 CONFIG_F2FS_FS=y
 CONFIG_FAT_FS=y
 CONFIG_FIXED_PHY=y
-CONFIG_FRAME_WARN=2048
 CONFIG_FS_IOMAP=y
 CONFIG_FS_MBCACHE=y
 CONFIG_FWNODE_MDIO=y
diff --git a/target/linux/octeon/generic/target.mk b/target/linux/octeon/generic/target.mk
new file mode 100644
index 00000000000000..f5cb1fb19b943f
--- /dev/null
+++ b/target/linux/octeon/generic/target.mk
@@ -0,0 +1 @@
+BOARDNAME:=Generic
diff --git a/target/linux/octeon/patches-5.15/100-mips_image_cmdline_hack.patch b/target/linux/octeon/patches-5.15/100-mips_image_cmdline_hack.patch
new file mode 100644
index 00000000000000..15e233aceb2c12
--- /dev/null
+++ b/target/linux/octeon/patches-5.15/100-mips_image_cmdline_hack.patch
@@ -0,0 +1,38 @@
+From: John Crispin <john@phrozen.org>
+Subject: hack: kernel: add generic image_cmdline hack to MIPS targets
+
+lede-commit: d59f5b3a987a48508257a0ddbaeadc7909f9f976
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ arch/mips/Kconfig       | 4 ++++
+ arch/mips/kernel/head.S | 6 ++++++
+ 2 files changed, 10 insertions(+)
+
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -1180,6 +1180,10 @@ config MIPS_MSC
+ config SYNC_R4K
+ 	bool
+ 
++config IMAGE_CMDLINE_HACK
++	bool "OpenWrt specific image command line hack"
++	default n
++
+ config NO_IOPORT_MAP
+ 	def_bool n
+ 
+--- a/arch/mips/kernel/head.S
++++ b/arch/mips/kernel/head.S
+@@ -79,6 +79,12 @@ FEXPORT(__kernel_entry)
+ 	j	kernel_entry
+ #endif /* CONFIG_BOOT_RAW */
+ 
++#ifdef CONFIG_IMAGE_CMDLINE_HACK
++	.ascii	"CMDLINE:"
++EXPORT(__image_cmdline)
++	.fill	0x400
++#endif /* CONFIG_IMAGE_CMDLINE_HACK */
++
+ 	__REF
+ 
+ NESTED(kernel_entry, 16, sp)			# kernel entry point
diff --git a/target/linux/octeon/profiles/000-Generic.mk b/target/linux/octeon/profiles/000-Generic.mk
index 6d5aa4e2bd4677..b7261cd355d0fb 100644
--- a/target/linux/octeon/profiles/000-Generic.mk
+++ b/target/linux/octeon/profiles/000-Generic.mk
@@ -2,13 +2,12 @@
 #
 # Copyright (C) 2013 OpenWrt.org
 
-define Profile/Default
-  NAME:=Default Profile
-  PRIORITY:=1
+define Profile/Generic
+  NAME:=Octeon SoC
 endef
 
-define Profile/Default/Description
+define Profile/Generic/Description
    Base packages for Octeon boards.
 endef
 
-$(eval $(call Profile,Default))
+$(eval $(call Profile,Generic))
diff --git a/target/linux/octeontx/Makefile b/target/linux/octeontx/Makefile
index eb90529740e40e..57250a5e01cab6 100644
--- a/target/linux/octeontx/Makefile
+++ b/target/linux/octeontx/Makefile
@@ -7,9 +7,10 @@ include $(TOPDIR)/rules.mk
 ARCH:=aarch64
 BOARD:=octeontx
 BOARDNAME:=Octeon-TX
-FEATURES:=targz pcie gpio rtc usb fpu
+FEATURES:=squashfs ramdisk targz pcie gpio rtc usb fpu
+SUBTARGETS:=generic
 
-KERNEL_PATCHVER:=5.10
+KERNEL_PATCHVER:=5.15
 
 define Target/Description
 	Build images for Octeon-TX CN80XX/CN81XX based boards
@@ -19,4 +20,9 @@ include $(INCLUDE_DIR)/target.mk
 
 KERNELNAME:=Image
 
+DEFAULT_PACKAGES += uboot-envtools mkf2fs e2fsprogs blkid \
+		    kmod-hwmon-gsc kmod-leds-gpio kmod-pps-gpio \
+		    kmod-gpio-button-hotplug kmod-input-evdev kmod-rtc-ds1672 \
+		    kmod-can kmod-can-mcp251x
+
 $(eval $(call BuildTarget))
diff --git a/target/linux/octeontx/config-5.15 b/target/linux/octeontx/config-5.15
new file mode 100644
index 00000000000000..9ca15896432546
--- /dev/null
+++ b/target/linux/octeontx/config-5.15
@@ -0,0 +1,424 @@
+CONFIG_64BIT=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_ARCH_HIBERNATION_HEADER=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
+CONFIG_ARCH_MMAP_RND_BITS=18
+CONFIG_ARCH_MMAP_RND_BITS_MAX=33
+CONFIG_ARCH_MMAP_RND_BITS_MIN=18
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=11
+CONFIG_ARCH_PROC_KCORE_TEXT=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_STACKWALK=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARCH_THUNDER=y
+CONFIG_ARCH_WANTS_NO_INSTR=y
+CONFIG_ARM64=y
+CONFIG_ARM64_4K_PAGES=y
+CONFIG_ARM64_CNP=y
+CONFIG_ARM64_CRYPTO=y
+CONFIG_ARM64_EPAN=y
+CONFIG_ARM64_ERRATUM_819472=y
+CONFIG_ARM64_ERRATUM_824069=y
+CONFIG_ARM64_ERRATUM_826319=y
+CONFIG_ARM64_ERRATUM_827319=y
+CONFIG_ARM64_ERRATUM_843419=y
+CONFIG_ARM64_HW_AFDBM=y
+CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
+CONFIG_ARM64_PAGE_SHIFT=12
+CONFIG_ARM64_PAN=y
+CONFIG_ARM64_PA_BITS=48
+CONFIG_ARM64_PA_BITS_48=y
+CONFIG_ARM64_PTR_AUTH=y
+CONFIG_ARM64_PTR_AUTH_KERNEL=y
+CONFIG_ARM64_SVE=y
+CONFIG_ARM64_TAGGED_ADDR_ABI=y
+CONFIG_ARM64_VA_BITS=48
+# CONFIG_ARM64_VA_BITS_39 is not set
+CONFIG_ARM64_VA_BITS_48=y
+CONFIG_ARM64_WORKAROUND_CLEAN_CACHE=y
+CONFIG_ARM_AMBA=y
+CONFIG_ARM_ARCH_TIMER=y
+CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+CONFIG_ARM_CPUIDLE=y
+CONFIG_ARM_GIC=y
+CONFIG_ARM_GIC_V2M=y
+CONFIG_ARM_GIC_V3=y
+CONFIG_ARM_GIC_V3_ITS=y
+CONFIG_ARM_GIC_V3_ITS_PCI=y
+# CONFIG_ARM_MHU_V2 is not set
+CONFIG_ARM_PSCI_FW=y
+CONFIG_ARM_SBSA_WATCHDOG=y
+CONFIG_ATA=y
+# CONFIG_ATA_SFF is not set
+CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
+CONFIG_BALLOON_COMPACTION=y
+CONFIG_BLK_DEV_BSG=y
+CONFIG_BLK_DEV_BSGLIB=y
+CONFIG_BLK_DEV_BSG_COMMON=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_MQ_VIRTIO=y
+CONFIG_BLK_PM=y
+CONFIG_CAVIUM_ERRATUM_22375=y
+CONFIG_CAVIUM_ERRATUM_23144=y
+CONFIG_CAVIUM_ERRATUM_23154=y
+CONFIG_CAVIUM_ERRATUM_27456=y
+CONFIG_CAVIUM_ERRATUM_30115=y
+CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CMA=y
+CONFIG_CMA_ALIGNMENT=8
+CONFIG_CMA_AREAS=7
+# CONFIG_CMA_DEBUG is not set
+# CONFIG_CMA_DEBUGFS is not set
+CONFIG_CMA_SIZE_MBYTES=16
+# CONFIG_CMA_SIZE_SEL_MAX is not set
+CONFIG_CMA_SIZE_SEL_MBYTES=y
+# CONFIG_CMA_SIZE_SEL_MIN is not set
+# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
+# CONFIG_CMA_SYSFS is not set
+CONFIG_COMMON_CLK=y
+CONFIG_COMMON_CLK_CS2000_CP=y
+# CONFIG_COMPAT_32BIT_TIME is not set
+CONFIG_CONFIGFS_FS=y
+CONFIG_CONTIG_ALLOC=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_IDLE_MULTIPLE_DRIVERS=y
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_RMAP=y
+CONFIG_CRASH_CORE=y
+CONFIG_CRASH_DUMP=y
+CONFIG_CRC16=y
+CONFIG_CRC7=y
+CONFIG_CRC_ITU_T=y
+CONFIG_CRC_T10DIF=y
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_CE=y
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
+CONFIG_CRYPTO_ANSI_CPRNG=y
+CONFIG_CRYPTO_CRC32=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_CRCT10DIF=y
+CONFIG_CRYPTO_CRCT10DIF_ARM64_CE=y
+CONFIG_CRYPTO_CRYPTD=y
+CONFIG_CRYPTO_DRBG=y
+CONFIG_CRYPTO_DRBG_HMAC=y
+CONFIG_CRYPTO_DRBG_MENU=y
+CONFIG_CRYPTO_ECHAINIV=y
+CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_JITTERENTROPY=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_RNG_DEFAULT=y
+CONFIG_CRYPTO_SHA1=y
+CONFIG_CRYPTO_SHA1_ARM64_CE=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA256_ARM64=y
+CONFIG_CRYPTO_SHA2_ARM64_CE=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_SIMD=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DMADEVICES=y
+CONFIG_DMA_CMA=y
+CONFIG_DMA_DIRECT_REMAP=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_PERNUMA_CMA=y
+CONFIG_DMA_REMAP=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DTC=y
+CONFIG_DT_IDLE_STATES=y
+CONFIG_EDAC=y
+# CONFIG_EDAC_DEBUG is not set
+# CONFIG_EDAC_DMC520 is not set
+CONFIG_EDAC_LEGACY_SYSFS=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EDAC_THUNDERX=y
+# CONFIG_EDAC_XGENE is not set
+CONFIG_EEPROM_AT24=y
+CONFIG_EXT4_FS=y
+CONFIG_F2FS_FS=y
+CONFIG_FAT_FS=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FRAME_POINTER=y
+CONFIG_FREEZER=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CACHE=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ARCH_NUMA=y
+CONFIG_GENERIC_ARCH_TOPOLOGY=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_CSUM=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_MSI_IRQ=y
+CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GLOB=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_PCA953X=y
+CONFIG_GPIO_PCA953X_IRQ=y
+CONFIG_GPIO_THUNDERX=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HIBERNATE_CALLBACKS=y
+CONFIG_HIBERNATION=y
+CONFIG_HIBERNATION_SNAPSHOT_DEV=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HUGETLBFS=y
+CONFIG_HUGETLB_PAGE=y
+CONFIG_HWSPINLOCK=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_CAVIUM=y
+CONFIG_HW_RANDOM_OPTEE=y
+CONFIG_I2C=y
+CONFIG_I2C_ALGOBIT=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_MUX=y
+CONFIG_I2C_SMBUS=y
+CONFIG_I2C_THUNDERX=y
+CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FASTEOI_HIERARCHY_HANDLERS=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_TIME_ACCOUNTING=y
+CONFIG_IRQ_WORK=y
+# CONFIG_ISDN is not set
+CONFIG_JUMP_LABEL=y
+CONFIG_KEXEC=y
+CONFIG_KEXEC_CORE=y
+CONFIG_KSM=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MAILBOX=y
+# CONFIG_MAILBOX_TEST is not set
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_CAVIUM=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MDIO_THUNDER=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MEMORY_BALLOON=y
+CONFIG_MEMORY_ISOLATION=y
+CONFIG_MEMTEST=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_CAVIUM_THUNDERX=y
+CONFIG_MODULES_USE_ELF_RELA=y
+CONFIG_MSDOS_FS=y
+# CONFIG_MTD is not set
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y
+CONFIG_NEED_SG_DMA_LENGTH=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NLS=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_NODES_SHIFT=2
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NR_CPUS=64
+CONFIG_NUMA=y
+CONFIG_NUMA_BALANCING=y
+CONFIG_NUMA_BALANCING_DEFAULT_ENABLED=y
+CONFIG_NVMEM=y
+CONFIG_NVMEM_SYSFS=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_OF_NUMA=y
+CONFIG_OPTEE=y
+CONFIG_OPTEE_SHM_NUM_PRIV_PAGES=1
+CONFIG_PADATA=y
+CONFIG_PAGE_REPORTING=y
+CONFIG_PARAVIRT=y
+CONFIG_PARTITION_PERCPU=y
+CONFIG_PCI=y
+CONFIG_PCIEAER=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_PME=y
+CONFIG_PCI_ATS=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PCI_ECAM=y
+CONFIG_PCI_HOST_COMMON=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCI_HOST_THUNDER_ECAM=y
+CONFIG_PCI_HOST_THUNDER_PEM=y
+CONFIG_PCI_IOV=y
+CONFIG_PCI_MSI=y
+CONFIG_PCI_MSI_IRQ_DOMAIN=y
+CONFIG_PGTABLE_LEVELS=4
+CONFIG_PHYLIB=y
+CONFIG_PHYS_ADDR_T_64BIT=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_SLEEP=y
+CONFIG_PM_SLEEP_SMP=y
+CONFIG_PM_STD_PARTITION=""
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_POWER_RESET_XGENE=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PROC_VMCORE=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RAS=y
+CONFIG_RATIONAL=y
+# CONFIG_RAVE_SP_CORE is not set
+CONFIG_REBOOT_MODE=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RODATA_FULL_DEFAULT_ENABLED=y
+CONFIG_RPS=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_DS1672=y
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+CONFIG_SATA_AHCI=y
+CONFIG_SATA_AHCI_PLATFORM=y
+CONFIG_SATA_HOST=y
+CONFIG_SCHED_INFO=y
+CONFIG_SCHED_MC=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+# CONFIG_SCSI_LOWLEVEL is not set
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_SCSI_SAS_ATA=y
+CONFIG_SCSI_SAS_ATTRS=y
+CONFIG_SCSI_SAS_HOST_SMP=y
+CONFIG_SCSI_SAS_LIBSAS=y
+CONFIG_SECCOMP=y
+CONFIG_SECCOMP_FILTER=y
+CONFIG_SERIAL_8250_DW=y
+CONFIG_SERIAL_8250_DWLIB=y
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_FSL=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_DEV_BUS=y
+CONFIG_SERIAL_DEV_CTRL_TTYPORT=y
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_XILINX_PS_UART=y
+CONFIG_SERIAL_XILINX_PS_UART_CONSOLE=y
+CONFIG_SG_POOL=y
+CONFIG_SMP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SPARSEMEM=y
+CONFIG_SPARSEMEM_EXTREME=y
+CONFIG_SPARSEMEM_VMEMMAP=y
+CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SPI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_THUNDERX=y
+CONFIG_SRAM=y
+CONFIG_SRCU=y
+CONFIG_SWIOTLB=y
+CONFIG_SWPHY=y
+CONFIG_SYNC_FILE=y
+CONFIG_SYSCON_REBOOT_MODE=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_TASK_XACCT=y
+CONFIG_TEE=y
+CONFIG_THREAD_INFO_IN_TASK=y
+CONFIG_THUNDER_NIC_BGX=y
+CONFIG_THUNDER_NIC_PF=y
+CONFIG_THUNDER_NIC_RGX=y
+CONFIG_THUNDER_NIC_VF=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y
+CONFIG_TRANSPARENT_HUGEPAGE=y
+CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y
+# CONFIG_TRANSPARENT_HUGEPAGE_MADVISE is not set
+CONFIG_TRANS_TABLE=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UNMAP_KERNEL_AT_EL0=y
+CONFIG_USB=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_PCI=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_SUPPORT=y
+# CONFIG_USB_UHCI_HCD is not set
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_PCI=y
+CONFIG_USB_XHCI_PLATFORM=y
+CONFIG_USE_PERCPU_NUMA_NODE_ID=y
+CONFIG_VIRTIO=y
+CONFIG_VIRTIO_BALLOON=y
+# CONFIG_VIRTIO_BLK is not set
+CONFIG_VIRTIO_MMIO=y
+# CONFIG_VIRTIO_NET is not set
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_PCI_LEGACY=y
+CONFIG_VIRTIO_PCI_LIB=y
+CONFIG_VMAP_STACK=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_XARRAY_MULTI=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_ZONE_DMA32=y
diff --git a/target/linux/octeontx/generic/target.mk b/target/linux/octeontx/generic/target.mk
new file mode 100644
index 00000000000000..f5cb1fb19b943f
--- /dev/null
+++ b/target/linux/octeontx/generic/target.mk
@@ -0,0 +1 @@
+BOARDNAME:=Generic
diff --git a/target/linux/octeontx/patches-5.15/0004-PCI-add-quirk-for-Gateworks-PLX-PEX860x-switch-with-.patch b/target/linux/octeontx/patches-5.15/0004-PCI-add-quirk-for-Gateworks-PLX-PEX860x-switch-with-.patch
new file mode 100644
index 00000000000000..5b0db92d9e49f0
--- /dev/null
+++ b/target/linux/octeontx/patches-5.15/0004-PCI-add-quirk-for-Gateworks-PLX-PEX860x-switch-with-.patch
@@ -0,0 +1,59 @@
+From d0ff7a1bcfe886cab1a237895b08ac51ecfe10e7 Mon Sep 17 00:00:00 2001
+From: Tim Harvey <tharvey@gateworks.com>
+Date: Wed, 10 Apr 2019 08:00:47 -0700
+Subject: [PATCH 04/12] PCI: add quirk for Gateworks PLX PEX860x switch with
+ GPIO PERST#
+
+Gateworks boards use PLX PEX860x switches where downstream ports
+have their PERST# driven from the PEX GPIO.
+
+Signed-off-by: Tim Harvey <tharvey@gateworks.com>
+---
+ drivers/pci/quirks.c | 32 ++++++++++++++++++++++++++++++++
+ 1 file changed, 32 insertions(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -25,6 +25,7 @@
+ #include <linux/ktime.h>
+ #include <linux/mm.h>
+ #include <linux/nvme.h>
++#include <linux/of.h>
+ #include <linux/platform_data/x86/apple.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/suspend.h>
+@@ -5854,3 +5855,34 @@ static void nvidia_ion_ahci_fixup(struct
+ 	pdev->dev_flags |= PCI_DEV_FLAGS_HAS_MSI_MASKING;
+ }
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0ab8, nvidia_ion_ahci_fixup);
++
++#ifdef CONFIG_PCI_HOST_THUNDER_PEM
++/*
++ * fixup for PLX PEX8909 bridge to configure GPIO1-7 as output High
++ * as they are used for slots1-7 PERST#
++ */
++static void newport_pciesw_early_fixup(struct pci_dev *dev)
++{
++	u32 dw;
++
++	if (!of_machine_is_compatible("gw,newport"))
++		return;
++
++	if (dev->devfn != 0)
++		return;
++
++	dev_info(&dev->dev, "de-asserting PERST#\n");
++	pci_read_config_dword(dev, 0x62c, &dw);
++	dw |= 0xaaa8; /* GPIO1-7 outputs */
++	pci_write_config_dword(dev, 0x62c, dw);
++
++	pci_read_config_dword(dev, 0x644, &dw);
++	dw |= 0xfe;   /* GPIO1-7 output high */
++	pci_write_config_dword(dev, 0x644, dw);
++
++	msleep(100);
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_PLX, 0x8609, newport_pciesw_early_fixup);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_PLX, 0x8606, newport_pciesw_early_fixup);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_PLX, 0x8604, newport_pciesw_early_fixup);
++#endif /* CONFIG_PCI_HOST_THUNDER_PEM */
diff --git a/target/linux/omap/Makefile b/target/linux/omap/Makefile
index 51f19862d67208..f995b5eae4dc25 100644
--- a/target/linux/omap/Makefile
+++ b/target/linux/omap/Makefile
@@ -7,12 +7,12 @@ include $(TOPDIR)/rules.mk
 ARCH:=arm
 BOARD:=omap
 BOARDNAME:=TI OMAP3/4/AM33xx
-FEATURES:=usb usbgadget ext4 targz fpu audio display nand rootfs-part squashfs
+FEATURES:=usb usbgadget ext4 targz fpu audio display nand rootfs-part squashfs source-only
 CPU_TYPE:=cortex-a8
 CPU_SUBTYPE:=vfpv3
+SUBTARGETS:=generic
 
-KERNEL_PATCHVER:=5.10
-KERNEL_TESTING_PATCHVER:=5.15
+KERNEL_PATCHVER:=5.15
 
 KERNELNAME:=zImage dtbs
 
diff --git a/target/linux/omap/config-5.15 b/target/linux/omap/config-5.15
index c35a20acdad458..888345c75a85d2 100644
--- a/target/linux/omap/config-5.15
+++ b/target/linux/omap/config-5.15
@@ -25,7 +25,9 @@ CONFIG_ARM=y
 CONFIG_ARM_APPENDED_DTB=y
 CONFIG_ARM_ATAG_DTB_COMPAT=y
 CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_FROM_BOOTLOADER=y
+CONFIG_ARM_CPUIDLE=y
 CONFIG_ARM_CPU_SUSPEND=y
+CONFIG_ARM_CRYPTO=y
 CONFIG_ARM_ERRATA_430973=y
 CONFIG_ARM_ERRATA_720789=y
 CONFIG_ARM_ERRATA_754322=y
@@ -81,6 +83,7 @@ CONFIG_CMA_SIZE_SEL_MBYTES=y
 # CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
 # CONFIG_CMA_SYSFS is not set
 CONFIG_CMDLINE="root=/dev/mmcblk0p2 rootwait console=ttyO2,115200"
+CONFIG_CMDLINE_FROM_BOOTLOADER=y
 CONFIG_COMMON_CLK=y
 # CONFIG_COMMON_CLK_PALMAS is not set
 # CONFIG_COMMON_CLK_TI_ADPLL is not set
@@ -113,6 +116,7 @@ CONFIG_CPU_HAS_ASID=y
 CONFIG_CPU_IDLE=y
 CONFIG_CPU_IDLE_GOV_LADDER=y
 CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_IDLE_MULTIPLE_DRIVERS=y
 CONFIG_CPU_PABRT_V7=y
 CONFIG_CPU_PM=y
 CONFIG_CPU_RMAP=y
@@ -127,11 +131,15 @@ CONFIG_CRC7=y
 CONFIG_CRC_CCITT=y
 CONFIG_CRC_ITU_T=y
 CONFIG_CRC_T10DIF=y
-CONFIG_CRYPTO_BLAKE2S=y
+CONFIG_CRYPTO_AES_ARM=y
+CONFIG_CRYPTO_AES_ARM_BS=y
+CONFIG_CRYPTO_ARCH_HAVE_LIB_CHACHA=y
 CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CHACHA20_NEON=y
 CONFIG_CRYPTO_CRC32=y
 CONFIG_CRYPTO_CRC32C=y
 CONFIG_CRYPTO_CRCT10DIF=y
+CONFIG_CRYPTO_CRYPTD=y
 CONFIG_CRYPTO_DEFLATE=y
 CONFIG_CRYPTO_DES=y
 CONFIG_CRYPTO_DEV_OMAP=y
@@ -143,6 +151,7 @@ CONFIG_CRYPTO_DRBG_HMAC=y
 CONFIG_CRYPTO_DRBG_MENU=y
 CONFIG_CRYPTO_ECB=y
 CONFIG_CRYPTO_ENGINE=y
+CONFIG_CRYPTO_GHASH_ARM_CE=y
 CONFIG_CRYPTO_HASH_INFO=y
 CONFIG_CRYPTO_HMAC=y
 CONFIG_CRYPTO_HW=y
@@ -157,8 +166,13 @@ CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_RNG_DEFAULT=y
 CONFIG_CRYPTO_SEQIV=y
 CONFIG_CRYPTO_SHA1=y
+CONFIG_CRYPTO_SHA1_ARM=y
+CONFIG_CRYPTO_SHA1_ARM_NEON=y
 CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA256_ARM=y
 CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_SHA512_ARM=y
+CONFIG_CRYPTO_SIMD=y
 CONFIG_CRYPTO_ZSTD=y
 CONFIG_DCACHE_WORD_ACCESS=y
 CONFIG_DDR=y
@@ -195,6 +209,7 @@ CONFIG_DRM_SIMPLE_BRIDGE=y
 CONFIG_DRM_TI_TFP410=y
 CONFIG_DRM_TI_TPD12S015=y
 CONFIG_DTC=y
+CONFIG_DT_IDLE_STATES=y
 CONFIG_EDAC_ATOMIC_SCRUB=y
 CONFIG_EDAC_SUPPORT=y
 CONFIG_EEPROM_93CX6=y
@@ -277,8 +292,6 @@ CONFIG_I2C_ALGOBIT=y
 CONFIG_I2C_BOARDINFO=y
 CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_OMAP=y
-CONFIG_IKCONFIG=y
-CONFIG_IKCONFIG_PROC=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_IP_PNP=y
 CONFIG_IP_PNP_BOOTP=y
@@ -319,9 +332,11 @@ CONFIG_LZO_COMPRESS=y
 CONFIG_LZO_DECOMPRESS=y
 CONFIG_MACH_OMAP_GENERIC=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_MDIO_BITBANG=y
 CONFIG_MDIO_BUS=y
 CONFIG_MDIO_DEVICE=y
 CONFIG_MDIO_DEVRES=y
+# CONFIG_MDIO_GPIO is not set
 CONFIG_MEMFD_CREATE=y
 CONFIG_MEMORY=y
 CONFIG_MEMORY_ISOLATION=y
diff --git a/target/linux/omap/generic/target.mk b/target/linux/omap/generic/target.mk
new file mode 100644
index 00000000000000..f5cb1fb19b943f
--- /dev/null
+++ b/target/linux/omap/generic/target.mk
@@ -0,0 +1 @@
+BOARDNAME:=Generic
diff --git a/target/linux/omap/profiles/00-default.mk b/target/linux/omap/profiles/00-default.mk
index 73338d8652ee90..172fbc26b3d1eb 100644
--- a/target/linux/omap/profiles/00-default.mk
+++ b/target/linux/omap/profiles/00-default.mk
@@ -8,7 +8,7 @@ define Profile/Default
 	kmod-usb-net-asix kmod-usb-net-asix-ax88179 kmod-usb-net-hso \
 	kmod-usb-net-kaweth kmod-usb-net-pegasus kmod-usb-net-mcs7830 \
 	kmod-usb-net-smsc95xx kmod-usb-net-dm9601-ether \
-	wpad-basic-wolfssl
+	wpad-basic-mbedtls
   PRIORITY := 1
 endef
 
diff --git a/target/linux/oxnas/Makefile b/target/linux/oxnas/Makefile
index 9dfdb5c86e640d..2884a66cc76373 100644
--- a/target/linux/oxnas/Makefile
+++ b/target/linux/oxnas/Makefile
@@ -7,8 +7,7 @@ SUBTARGETS:=ox810se ox820
 FEATURES:=gpio ramdisk rtc squashfs
 DEVICE_TYPE:=nas
 
-KERNEL_PATCHVER:=5.10
-KERNEL_TESTING_PATCHVER:=5.15
+KERNEL_PATCHVER:=5.15
 
 include $(INCLUDE_DIR)/target.mk
 
diff --git a/target/linux/oxnas/config-5.15 b/target/linux/oxnas/config-5.15
index aff528e34fb3dd..9540a76774f5df 100644
--- a/target/linux/oxnas/config-5.15
+++ b/target/linux/oxnas/config-5.15
@@ -15,13 +15,13 @@ CONFIG_ARCH_OXNAS=y
 CONFIG_ARCH_SELECT_MEMORY_MODEL=y
 CONFIG_ARCH_SPARSEMEM_ENABLE=y
 CONFIG_ARCH_SUSPEND_POSSIBLE=y
-CONFIG_ARCH_WANT_LIBATA_LEDS=y
 CONFIG_ARM=y
 CONFIG_ARM_APPENDED_DTB=y
 CONFIG_ARM_ATAG_DTB_COMPAT=y
 # CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_FROM_BOOTLOADER is not set
 CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE=y
 CONFIG_ARM_CPU_SUSPEND=y
+CONFIG_ARM_CRYPTO=y
 CONFIG_ARM_HAS_SG_CHAIN=y
 CONFIG_ARM_L1_CACHE_SHIFT=5
 CONFIG_ARM_PATCH_PHYS_VIRT=y
@@ -77,6 +77,7 @@ CONFIG_CRC16=y
 CONFIG_CRC32_SLICEBY8=y
 CONFIG_CROSS_MEMORY_ATTACH=y
 CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LZ4=y
 CONFIG_CRYPTO_RNG2=y
 CONFIG_DEBUG_ALIGN_RODATA=y
 CONFIG_DEBUG_BUGVERBOSE=y
@@ -165,6 +166,7 @@ CONFIG_LEDS_TRIGGER_ONESHOT=y
 CONFIG_LIBFDT=y
 CONFIG_LOCALVERSION_AUTO=y
 CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LZ4_COMPRESS=y
 CONFIG_LZ4_DECOMPRESS=y
 CONFIG_LZO_DECOMPRESS=y
 # CONFIG_MACH_OX810SE is not set
@@ -242,6 +244,7 @@ CONFIG_SERIAL_OF_PLATFORM=y
 CONFIG_SERIO=y
 CONFIG_SERIO_LIBPS2=y
 CONFIG_SERIO_SERPORT=y
+CONFIG_SGL_ALLOC=y
 CONFIG_SLUB_DEBUG=y
 CONFIG_SOCK_DIAG=y
 CONFIG_SPARSE_IRQ=y
diff --git a/target/linux/oxnas/files/arch/arm/boot/dts/ox820-shuttle-kd20.dts b/target/linux/oxnas/files/arch/arm/boot/dts/ox820-shuttle-kd20.dts
index 0bcd2fcf0005fe..2cff439c25964f 100644
--- a/target/linux/oxnas/files/arch/arm/boot/dts/ox820-shuttle-kd20.dts
+++ b/target/linux/oxnas/files/arch/arm/boot/dts/ox820-shuttle-kd20.dts
@@ -31,7 +31,7 @@
 		led-upgrade = &led_warn;
 	};
 
-	thermal_zones {
+	thermal-zones {
 		chassis-thermal {
 			/* Poll every 20 seconds */
 			polling-delay = <20000>;
@@ -153,6 +153,7 @@
 		gpios = <&gpio0 2 GPIO_ACTIVE_HIGH>;
 		gpio-fan,speed-map = <0    0
 				      3000 1>;
+		#cooling-cells = <2>;
 	};
 
 	gpio-poweroff {
diff --git a/target/linux/oxnas/files/drivers/ata/sata_oxnas.c b/target/linux/oxnas/files/drivers/ata/sata_oxnas.c
index a5d7b3de72331a..bd39ce7b1b874b 100644
--- a/target/linux/oxnas/files/drivers/ata/sata_oxnas.c
+++ b/target/linux/oxnas/files/drivers/ata/sata_oxnas.c
@@ -2039,7 +2039,7 @@ static int sata_oxnas_softreset(struct ata_link *link, unsigned int *class,
 
 	/* if link is occupied, -ENODEV too is an error */
 	if (rc && (rc != -ENODEV || sata_scr_valid(link))) {
-		ata_link_printk(link, KERN_ERR, "SRST failed (errno=%d)\n", rc);
+		ata_link_err(link, "SRST failed (errno=%d)\n", rc);
 		return rc;
 	}
 
@@ -2232,9 +2232,6 @@ static struct scsi_host_template sata_oxnas_sht = {
 	.can_queue = SATA_OXNAS_QUEUE_DEPTH,
 	.sg_tablesize = SATA_OXNAS_MAX_PRD,
 	.dma_boundary = ATA_DMA_BOUNDARY,
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 13, 0)
-	.unchecked_isa_dma  = 0,
-#endif
 };
 
 
diff --git a/target/linux/oxnas/image/ox820.mk b/target/linux/oxnas/image/ox820.mk
index 8dea842503578e..deb49b14c44fbd 100644
--- a/target/linux/oxnas/image/ox820.mk
+++ b/target/linux/oxnas/image/ox820.mk
@@ -50,7 +50,7 @@ define Device/cloudengines_pogoplugpro
   DEVICE_MODEL := PogoPlug Pro (with mPCIe)
   SUPPORTED_DEVICES += pogoplug-pro
   DEVICE_PACKAGES := kmod-usb2-oxnas kmod-usb-ledtrig-usbport \
-	kmod-ata-oxnas-sata kmod-rt2800-pci wpad-basic-wolfssl
+	kmod-ata-oxnas-sata kmod-rt2800-pci wpad-basic-mbedtls
 endef
 TARGET_DEVICES += cloudengines_pogoplugpro
 
diff --git a/target/linux/oxnas/patches-5.15/100-oxnas-clk-plla-pllb.patch b/target/linux/oxnas/patches-5.15/100-oxnas-clk-plla-pllb.patch
index 6c795c1d25f202..f609f1b12abce6 100644
--- a/target/linux/oxnas/patches-5.15/100-oxnas-clk-plla-pllb.patch
+++ b/target/linux/oxnas/patches-5.15/100-oxnas-clk-plla-pllb.patch
@@ -179,7 +179,7 @@
  static inline struct clk_oxnas_gate *to_clk_oxnas_gate(struct clk_hw *hw)
  {
  	return container_of(hw, struct clk_oxnas_gate, hw);
-@@ -249,3 +401,42 @@ static struct platform_driver oxnas_stdc
+@@ -251,3 +403,42 @@ static struct platform_driver oxnas_stdc
  	},
  };
  builtin_platform_driver(oxnas_stdclk_driver);
diff --git a/target/linux/oxnas/patches-5.15/996-generic-Mangle-bootloader-s-kernel-arguments.patch b/target/linux/oxnas/patches-5.15/996-generic-Mangle-bootloader-s-kernel-arguments.patch
index 8cf935ad1277e4..c64c193e7ee2dd 100644
--- a/target/linux/oxnas/patches-5.15/996-generic-Mangle-bootloader-s-kernel-arguments.patch
+++ b/target/linux/oxnas/patches-5.15/996-generic-Mangle-bootloader-s-kernel-arguments.patch
@@ -51,16 +51,58 @@ Signed-off-by: Adrian Panella <ianchi74@outlook.com>
  #else
  #define do_extend_cmdline 0
  #endif
-@@ -69,6 +71,59 @@ static uint32_t get_cell_size(const void
+@@ -20,6 +22,7 @@ static int node_offset(void *fdt, const
+ 	return offset;
+ }
+ 
++#ifndef CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
+ static int setprop(void *fdt, const char *node_path, const char *property,
+ 		   void *val_array, int size)
+ {
+@@ -28,6 +31,7 @@ static int setprop(void *fdt, const char
+ 		return offset;
+ 	return fdt_setprop(fdt, offset, property, val_array, size);
+ }
++#endif
+ 
+ static int setprop_string(void *fdt, const char *node_path,
+ 			  const char *property, const char *string)
+@@ -38,6 +42,7 @@ static int setprop_string(void *fdt, con
+ 	return fdt_setprop_string(fdt, offset, property, string);
+ }
+ 
++#ifndef CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
+ static int setprop_cell(void *fdt, const char *node_path,
+ 			const char *property, uint32_t val)
+ {
+@@ -46,6 +51,7 @@ static int setprop_cell(void *fdt, const
+ 		return offset;
+ 	return fdt_setprop_cell(fdt, offset, property, val);
+ }
++#endif
+ 
+ static const void *getprop(const void *fdt, const char *node_path,
+ 			   const char *property, int *len)
+@@ -58,6 +64,7 @@ static const void *getprop(const void *f
+ 	return fdt_getprop(fdt, offset, property, len);
+ }
+ 
++#ifndef CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
+ static uint32_t get_cell_size(const void *fdt)
+ {
+ 	int len;
+@@ -69,6 +76,61 @@ static uint32_t get_cell_size(const void
  	return cell_size;
  }
  
++#endif
++
 +#if defined(CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE)
 +
 +static char *append_rootblock(char *dest, const char *str, int len, void *fdt)
 +{
-+	char *ptr, *end;
-+	char *root="root=";
++	const char *ptr, *end;
++	const char *root="root=";
 +	int i, l;
 +	const char *rootblock;
 +
@@ -111,7 +153,7 @@ Signed-off-by: Adrian Panella <ianchi74@outlook.com>
  static void merge_fdt_bootargs(void *fdt, const char *fdt_cmdline)
  {
  	char cmdline[COMMAND_LINE_SIZE];
-@@ -88,12 +143,21 @@ static void merge_fdt_bootargs(void *fdt
+@@ -88,18 +150,28 @@ static void merge_fdt_bootargs(void *fdt
  
  	/* and append the ATAG_CMDLINE */
  	if (fdt_cmdline) {
@@ -133,7 +175,36 @@ Signed-off-by: Adrian Panella <ianchi74@outlook.com>
  	}
  	*ptr = '\0';
  
-@@ -168,7 +232,9 @@ int atags_to_fdt(void *atag_list, void *
+ 	setprop_string(fdt, "/chosen", "bootargs", cmdline);
+ }
+ 
++#ifndef CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
+ static void hex_str(char *out, uint32_t value)
+ {
+ 	uint32_t digit;
+@@ -117,6 +189,7 @@ static void hex_str(char *out, uint32_t
+ 	}
+ 	*out = '\0';
+ }
++#endif
+ 
+ /*
+  * Convert and fold provided ATAGs into the provided FDT.
+@@ -131,9 +204,11 @@ int atags_to_fdt(void *atag_list, void *
+ 	struct tag *atag = atag_list;
+ 	/* In the case of 64 bits memory size, need to reserve 2 cells for
+ 	 * address and size for each bank */
++#ifndef CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_MANGLE
+ 	__be32 mem_reg_property[2 * 2 * NR_BANKS];
+-	int memcount = 0;
+-	int ret, memsize;
++	int memsize, memcount = 0;
++#endif
++	int ret;
+ 
+ 	/* make sure we've got an aligned pointer */
+ 	if ((u32)atag_list & 0x3)
+@@ -168,7 +243,9 @@ int atags_to_fdt(void *atag_list, void *
  			else
  				setprop_string(fdt, "/chosen", "bootargs",
  					       atag->u.cmdline.cmdline);
@@ -144,7 +215,7 @@ Signed-off-by: Adrian Panella <ianchi74@outlook.com>
  			if (memcount >= sizeof(mem_reg_property)/4)
  				continue;
  			if (!atag->u.mem.size)
-@@ -212,6 +278,10 @@ int atags_to_fdt(void *atag_list, void *
+@@ -212,6 +289,10 @@ int atags_to_fdt(void *atag_list, void *
  		setprop(fdt, "/memory", "reg", mem_reg_property,
  			4 * memcount * memsize);
  	}
diff --git a/target/linux/oxnas/patches-5.15/999-libata-hacks.patch b/target/linux/oxnas/patches-5.15/999-libata-hacks.patch
index 73700f5c617027..f44f6b55ffe77c 100644
--- a/target/linux/oxnas/patches-5.15/999-libata-hacks.patch
+++ b/target/linux/oxnas/patches-5.15/999-libata-hacks.patch
@@ -15,7 +15,7 @@
  	/* initialize internal qc */
  	qc = __ata_qc_from_tag(ap, ATA_TAG_INTERNAL);
  
-@@ -4583,6 +4591,9 @@ struct ata_queued_cmd *ata_qc_new_init(s
+@@ -4587,6 +4595,9 @@ struct ata_queued_cmd *ata_qc_new_init(s
  	if (unlikely(ap->pflags & ATA_PFLAG_FROZEN))
  		return NULL;
  
@@ -25,7 +25,7 @@
  	/* libsas case */
  	if (ap->flags & ATA_FLAG_SAS_HOST) {
  		tag = ata_sas_allocate_tag(ap);
-@@ -4628,6 +4639,8 @@ void ata_qc_free(struct ata_queued_cmd *
+@@ -4632,6 +4643,8 @@ void ata_qc_free(struct ata_queued_cmd *
  		qc->tag = ATA_TAG_POISON;
  		if (ap->flags & ATA_FLAG_SAS_HOST)
  			ata_sas_free_tag(tag, ap);
@@ -36,7 +36,7 @@
  
 --- a/include/linux/libata.h
 +++ b/include/linux/libata.h
-@@ -917,6 +917,8 @@ struct ata_port_operations {
+@@ -923,6 +923,8 @@ struct ata_port_operations {
  	enum ata_completion_errors (*qc_prep)(struct ata_queued_cmd *qc);
  	unsigned int (*qc_issue)(struct ata_queued_cmd *qc);
  	bool (*qc_fill_rtf)(struct ata_queued_cmd *qc);
@@ -45,7 +45,7 @@
  
  	/*
  	 * Configuration and exception handling
-@@ -1007,6 +1009,9 @@ struct ata_port_operations {
+@@ -1013,6 +1015,9 @@ struct ata_port_operations {
  	void (*phy_reset)(struct ata_port *ap);
  	void (*eng_timeout)(struct ata_port *ap);
  
diff --git a/target/linux/pistachio/Makefile b/target/linux/pistachio/Makefile
index 8bafaa0b21765f..6ccf63142eca61 100644
--- a/target/linux/pistachio/Makefile
+++ b/target/linux/pistachio/Makefile
@@ -10,8 +10,9 @@ BOARDNAME:=MIPS pistachio
 FEATURES:=fpu usb usbgadget squashfs targz nand
 CPU_TYPE:=24kc
 CPU_SUBTYPE:=24kf
+SUBTARGETS:=generic
 
-KERNEL_PATCHVER:=5.10
+KERNEL_PATCHVER:=5.15
 
 include $(INCLUDE_DIR)/target.mk
 
diff --git a/target/linux/pistachio/config-5.15 b/target/linux/pistachio/config-5.15
new file mode 100644
index 00000000000000..c16a0c45516975
--- /dev/null
+++ b/target/linux/pistachio/config-5.15
@@ -0,0 +1,333 @@
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_SD=y
+# CONFIG_BOARD_INGENIC is not set
+CONFIG_BOARD_SCACHE=y
+CONFIG_BUILTIN_DTB=y
+CONFIG_CEVT_R4K=y
+CONFIG_CLKSRC_MIPS_GIC=y
+CONFIG_CLKSRC_PISTACHIO=y
+CONFIG_CLOCKSOURCE_WATCHDOG=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMMON_CLK_PISTACHIO=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONNECTOR=y
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_DIEI=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_RIXI=y
+# CONFIG_CPU_HAS_SMARTMIPS is not set
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_LITTLE_ENDIAN=y
+# CONFIG_CPU_MICROMIPS is not set
+CONFIG_CPU_MIPS32=y
+# CONFIG_CPU_MIPS32_R1 is not set
+CONFIG_CPU_MIPS32_R2=y
+# CONFIG_CPU_MIPS32_R6 is not set
+# CONFIG_CPU_MIPS64_R1 is not set
+# CONFIG_CPU_MIPS64_R2 is not set
+# CONFIG_CPU_MIPS64_R6 is not set
+CONFIG_CPU_MIPSR2=y
+CONFIG_CPU_MIPSR2_IRQ_EI=y
+CONFIG_CPU_MIPSR2_IRQ_VI=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CPU_SUPPORTS_MSA=y
+CONFIG_CRC16=y
+CONFIG_CRC_CCITT=y
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_MD5=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_SHA1=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_CSRC_R4K=y
+CONFIG_DMADEVICES=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_VIRTUAL_CHANNELS=y
+CONFIG_DTC=y
+CONFIG_DWMAC_GENERIC=y
+CONFIG_EXT4_FS=y
+# CONFIG_FIT_IMAGE_FDT_BOSTON is not set
+# CONFIG_FIT_IMAGE_FDT_JAGUAR2 is not set
+# CONFIG_FIT_IMAGE_FDT_LUTON is not set
+CONFIG_FIT_IMAGE_FDT_MARDUK=y
+# CONFIG_FIT_IMAGE_FDT_NI169445 is not set
+# CONFIG_FIT_IMAGE_FDT_OCELOT is not set
+# CONFIG_FIT_IMAGE_FDT_SERVAL is not set
+# CONFIG_FIT_IMAGE_FDT_XILFPGA is not set
+CONFIG_FIXED_PHY=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FS_POSIX_ACL=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDWARE_WATCHPOINTS=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_I2C=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_IMG=y
+CONFIG_IMGPDC_WDT=y
+CONFIG_IMG_MDC_DMA=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+CONFIG_JBD2=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PWM=y
+# CONFIG_LEGACY_BOARD_OCELOT is not set
+# CONFIG_LEGACY_BOARD_SEAD3 is not set
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOG_BUF_SHIFT=18
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MICREL_PHY=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+CONFIG_MIPS_AUTO_PFN_OFFSET=y
+CONFIG_MIPS_CLOCK_VSYSCALL=y
+CONFIG_MIPS_CM=y
+CONFIG_MIPS_CMDLINE_DTB_EXTEND=y
+# CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER is not set
+CONFIG_MIPS_CPC=y
+CONFIG_MIPS_CPS=y
+# CONFIG_MIPS_CPS_CPUIDLE is not set
+# CONFIG_MIPS_CPS_NS16550_BOOL is not set
+CONFIG_MIPS_CPS_PM=y
+CONFIG_MIPS_CPU_SCACHE=y
+CONFIG_MIPS_EBPF_JIT=y
+CONFIG_MIPS_GENERIC=y
+CONFIG_MIPS_GENERIC_KERNEL=y
+CONFIG_MIPS_GIC=y
+CONFIG_MIPS_L1_CACHE_SHIFT=7
+CONFIG_MIPS_L1_CACHE_SHIFT_7=y
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+CONFIG_MIPS_MT=y
+CONFIG_MIPS_MT_FPAFF=y
+CONFIG_MIPS_MT_SMP=y
+CONFIG_MIPS_NO_APPENDED_DTB=y
+CONFIG_MIPS_NR_CPU_NR_MAP=4
+CONFIG_MIPS_PERF_SHARED_TC_COUNTERS=y
+CONFIG_MIPS_SPRAM=y
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_DW=y
+# CONFIG_MMC_DW_BLUEFIELD is not set
+# CONFIG_MMC_DW_EXYNOS is not set
+# CONFIG_MMC_DW_HI3798CV200 is not set
+# CONFIG_MMC_DW_K3 is not set
+CONFIG_MMC_DW_PLTFM=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+CONFIG_MTD_CMDLINE_PARTS=y
+CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_SPI_NAND=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPI_NOR_USE_4K_SECTORS=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_LIMIT=20
+CONFIG_MTD_UBI_BLOCK=y
+CONFIG_MTD_UBI_FASTMAP=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_PTP_CLASSIFY=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NLS=y
+CONFIG_NO_EXCEPT_FILL=y
+CONFIG_NR_CPUS=4
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_PADATA=y
+CONFIG_PAGE_POOL=y
+CONFIG_PCI_DRIVERS_GENERIC=y
+CONFIG_PCS_XPCS=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PHY_PISTACHIO_USB=y
+CONFIG_PINCTRL=y
+CONFIG_PINCTRL_PISTACHIO=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PPS=y
+CONFIG_PRINTK_TIME=y
+CONFIG_PROC_EVENTS=y
+CONFIG_PTP_1588_CLOCK=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_PWM=y
+CONFIG_PWM_IMG=y
+CONFIG_PWM_SYSFS=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGMAP_SPI=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_GPIO=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RESET_PISTACHIO=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+CONFIG_SCHEDSTATS=y
+CONFIG_SCHED_INFO=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+CONFIG_SCSI_SPI_ATTRS=y
+CONFIG_SERIAL_8250_DW=y
+CONFIG_SERIAL_8250_DWLIB=y
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_SC16IS7XX=y
+CONFIG_SERIAL_SC16IS7XX_CORE=y
+# CONFIG_SERIAL_SC16IS7XX_I2C is not set
+CONFIG_SERIAL_SC16IS7XX_SPI=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SG_POOL=y
+CONFIG_SMP=y
+CONFIG_SMP_UP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SPI=y
+CONFIG_SPI_IMG_SPFI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRAM=y
+CONFIG_SRCU=y
+CONFIG_STMMAC_ETH=y
+CONFIG_STMMAC_PLATFORM=y
+CONFIG_SWAP_IO_SPACE=y
+CONFIG_SWPHY=y
+CONFIG_SYNC_R4K=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYS_HAS_CPU_MIPS32_R1=y
+CONFIG_SYS_HAS_CPU_MIPS32_R2=y
+CONFIG_SYS_HAS_CPU_MIPS32_R6=y
+CONFIG_SYS_HAS_CPU_MIPS64_R1=y
+CONFIG_SYS_HAS_CPU_MIPS64_R2=y
+CONFIG_SYS_HAS_CPU_MIPS64_R6=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_64BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+CONFIG_SYS_SUPPORTS_HIGHMEM=y
+CONFIG_SYS_SUPPORTS_HOTPLUG_CPU=y
+CONFIG_SYS_SUPPORTS_LITTLE_ENDIAN=y
+CONFIG_SYS_SUPPORTS_MICROMIPS=y
+CONFIG_SYS_SUPPORTS_MIPS16=y
+CONFIG_SYS_SUPPORTS_MIPS_CPS=y
+CONFIG_SYS_SUPPORTS_MULTITHREADING=y
+CONFIG_SYS_SUPPORTS_RELOCATABLE=y
+CONFIG_SYS_SUPPORTS_SCHED_SMT=y
+CONFIG_SYS_SUPPORTS_SMARTMIPS=y
+CONFIG_SYS_SUPPORTS_SMP=y
+CONFIG_SYS_SUPPORTS_ZBOOT=y
+CONFIG_TARGET_ISA_REV=2
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UBIFS_FS=y
+CONFIG_UHI_BOOT=y
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_DWC2=y
+CONFIG_USB_DWC2_DUAL_ROLE=y
+CONFIG_USB_EHCI_HCD=y
+# CONFIG_USB_EHCI_HCD_PLATFORM is not set
+CONFIG_USB_GADGET=y
+CONFIG_USB_ROLE_SWITCH=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_OF=y
+# CONFIG_VIRT_BOARD_RANCHU is not set
+CONFIG_WATCHDOG_CORE=y
+CONFIG_WEAK_ORDERING=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSMALLOC=y
+# CONFIG_ZSMALLOC_STAT is not set
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/pistachio/generic/target.mk b/target/linux/pistachio/generic/target.mk
new file mode 100644
index 00000000000000..f5cb1fb19b943f
--- /dev/null
+++ b/target/linux/pistachio/generic/target.mk
@@ -0,0 +1 @@
+BOARDNAME:=Generic
diff --git a/target/linux/pistachio/image/Makefile b/target/linux/pistachio/image/Makefile
index 2e15005ac230c4..64898b46e04168 100644
--- a/target/linux/pistachio/image/Makefile
+++ b/target/linux/pistachio/image/Makefile
@@ -5,7 +5,7 @@
 include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/image.mk
 
-KERNEL_LOADADDR := 0x80400000
+KERNEL_LOADADDR := 0x80100000
 
 define Device/Default
   PROFILES := Default
diff --git a/target/linux/pistachio/patches-5.15/101-dmaengine-img-mdc-Handle-early-status-read.patch b/target/linux/pistachio/patches-5.15/101-dmaengine-img-mdc-Handle-early-status-read.patch
new file mode 100644
index 00000000000000..031a4e3e5eedd6
--- /dev/null
+++ b/target/linux/pistachio/patches-5.15/101-dmaengine-img-mdc-Handle-early-status-read.patch
@@ -0,0 +1,68 @@
+From a2dd154377c9aa6ddda00d39b8c7c334e4fa16ff Mon Sep 17 00:00:00 2001
+From: Damien Horsley <damien.horsley@imgtec.com>
+Date: Tue, 22 Mar 2016 12:46:09 +0000
+Subject: dmaengine: img-mdc: Handle early status read
+
+It is possible that mdc_tx_status may be called before the first
+node has been read from memory.
+
+In this case, the residue value stored in the register is undefined.
+Return the transfer size instead.
+
+Signed-off-by: Damien Horsley <damien.horsley@imgtec.com>
+---
+ drivers/dma/img-mdc-dma.c | 40 ++++++++++++++++++++++++----------------
+ 1 file changed, 24 insertions(+), 16 deletions(-)
+
+--- a/drivers/dma/img-mdc-dma.c
++++ b/drivers/dma/img-mdc-dma.c
+@@ -618,25 +618,33 @@ static enum dma_status mdc_tx_status(str
+ 			(MDC_CMDS_PROCESSED_CMDS_DONE_MASK + 1);
+ 
+ 		/*
+-		 * If the command loaded event hasn't been processed yet, then
+-		 * the difference above includes an extra command.
++		 * If the first node has not yet been read from memory,
++		 * the residue register value is undefined
+ 		 */
+-		if (!mdesc->cmd_loaded)
+-			cmds--;
+-		else
+-			cmds += mdesc->list_cmds_done;
+-
+-		bytes = mdesc->list_xfer_size;
+-		ldesc = mdesc->list;
+-		for (i = 0; i < cmds; i++) {
+-			bytes -= ldesc->xfer_size + 1;
+-			ldesc = ldesc->next_desc;
+-		}
+-		if (ldesc) {
+-			if (residue != MDC_TRANSFER_SIZE_MASK)
+-				bytes -= ldesc->xfer_size - residue;
++		if (!mdesc->cmd_loaded && !cmds) {
++			bytes = mdesc->list_xfer_size;
++		} else {
++			/*
++			 * If the command loaded event hasn't been processed yet, then
++			 * the difference above includes an extra command.
++			 */
++			if (!mdesc->cmd_loaded)
++				cmds--;
+ 			else
++				cmds += mdesc->list_cmds_done;
++
++			bytes = mdesc->list_xfer_size;
++			ldesc = mdesc->list;
++			for (i = 0; i < cmds; i++) {
+ 				bytes -= ldesc->xfer_size + 1;
++				ldesc = ldesc->next_desc;
++			}
++			if (ldesc) {
++				if (residue != MDC_TRANSFER_SIZE_MASK)
++					bytes -= ldesc->xfer_size - residue;
++				else
++					bytes -= ldesc->xfer_size + 1;
++			}
+ 		}
+ 	}
+ 	spin_unlock_irqrestore(&mchan->vc.lock, flags);
diff --git a/target/linux/pistachio/patches-5.15/102-spi-img-spfi-Implement-dual-and-quad-mode.patch b/target/linux/pistachio/patches-5.15/102-spi-img-spfi-Implement-dual-and-quad-mode.patch
new file mode 100644
index 00000000000000..83f21a5c0a5dee
--- /dev/null
+++ b/target/linux/pistachio/patches-5.15/102-spi-img-spfi-Implement-dual-and-quad-mode.patch
@@ -0,0 +1,198 @@
+From cd2a6af51553d38072cd31699b58d16ca6176ef5 Mon Sep 17 00:00:00 2001
+From: Ionela Voinescu <ionela.voinescu@imgtec.com>
+Date: Thu, 2 Feb 2017 16:46:14 +0000
+Subject: spi: img-spfi: Implement dual and quad mode
+
+For dual and quad modes to work the SPFI controller needs
+to have information about command/address/dummy bytes in the
+transaction register. This information is not relevant for
+single mode, and therefore it can have any value in the
+allowed range. Therefore, for any read or write transfers of less
+than 8 bytes (cmd = 1 byte, addr up to 7 bytes), SPFI will be
+configured, but not enabled (unless it is the last transfer in
+the queue). The transfer will be enabled by the subsequent tranfer.
+A pending transfer is determined by the content of the transaction
+register: if command part is set and tsize is not.
+
+This way we ensure that for dual and quad transactions
+the command request size will apear in the command/address part
+of the transaction register, while the data size will be in
+tsize, all data being sent/received in the same transaction (as
+set up in the transaction register).
+
+Signed-off-by: Ionela Voinescu <ionela.voinescu@imgtec.com>
+Signed-off-by: Ezequiel Garcia <ezequiel.garcia@imgtec.com>
+---
+ drivers/spi/spi-img-spfi.c | 96 ++++++++++++++++++++++++++++++++++++++++------
+ 1 file changed, 85 insertions(+), 11 deletions(-)
+
+--- a/drivers/spi/spi-img-spfi.c
++++ b/drivers/spi/spi-img-spfi.c
+@@ -36,7 +36,8 @@
+ #define SPFI_CONTROL_SOFT_RESET			BIT(11)
+ #define SPFI_CONTROL_SEND_DMA			BIT(10)
+ #define SPFI_CONTROL_GET_DMA			BIT(9)
+-#define SPFI_CONTROL_SE			BIT(8)
++#define SPFI_CONTROL_SE				BIT(8)
++#define SPFI_CONTROL_TX_RX			BIT(1)
+ #define SPFI_CONTROL_TMODE_SHIFT		5
+ #define SPFI_CONTROL_TMODE_MASK			0x7
+ #define SPFI_CONTROL_TMODE_SINGLE		0
+@@ -47,6 +48,10 @@
+ #define SPFI_TRANSACTION			0x18
+ #define SPFI_TRANSACTION_TSIZE_SHIFT		16
+ #define SPFI_TRANSACTION_TSIZE_MASK		0xffff
++#define SPFI_TRANSACTION_CMD_SHIFT		13
++#define SPFI_TRANSACTION_CMD_MASK		0x7
++#define SPFI_TRANSACTION_ADDR_SHIFT		10
++#define SPFI_TRANSACTION_ADDR_MASK		0x7
+ 
+ #define SPFI_PORT_STATE				0x1c
+ #define SPFI_PORT_STATE_DEV_SEL_SHIFT		20
+@@ -83,6 +88,7 @@
+  */
+ #define SPFI_32BIT_FIFO_SIZE			64
+ #define SPFI_8BIT_FIFO_SIZE			16
++#define SPFI_DATA_REQUEST_MAX_SIZE		8
+ 
+ struct img_spfi {
+ 	struct device *dev;
+@@ -99,6 +105,8 @@ struct img_spfi {
+ 	struct dma_chan *tx_ch;
+ 	bool tx_dma_busy;
+ 	bool rx_dma_busy;
++
++	bool complete;
+ };
+ 
+ static inline u32 spfi_readl(struct img_spfi *spfi, u32 reg)
+@@ -115,9 +123,11 @@ static inline void spfi_start(struct img
+ {
+ 	u32 val;
+ 
+-	val = spfi_readl(spfi, SPFI_CONTROL);
+-	val |= SPFI_CONTROL_SPFI_EN;
+-	spfi_writel(spfi, val, SPFI_CONTROL);
++	if (spfi->complete) {
++		val = spfi_readl(spfi, SPFI_CONTROL);
++		val |= SPFI_CONTROL_SPFI_EN;
++		spfi_writel(spfi, val, SPFI_CONTROL);
++	}
+ }
+ 
+ static inline void spfi_reset(struct img_spfi *spfi)
+@@ -130,12 +140,21 @@ static int spfi_wait_all_done(struct img
+ {
+ 	unsigned long timeout = jiffies + msecs_to_jiffies(50);
+ 
++	if (!(spfi->complete))
++		return 0;
++
+ 	while (time_before(jiffies, timeout)) {
+ 		u32 status = spfi_readl(spfi, SPFI_INTERRUPT_STATUS);
+ 
+ 		if (status & SPFI_INTERRUPT_ALLDONETRIG) {
+ 			spfi_writel(spfi, SPFI_INTERRUPT_ALLDONETRIG,
+ 				    SPFI_INTERRUPT_CLEAR);
++			/*
++			 * Disable SPFI for it not to interfere with
++			 * pending transactions
++			 */
++			spfi_writel(spfi, spfi_readl(spfi, SPFI_CONTROL)
++			& ~SPFI_CONTROL_SPFI_EN, SPFI_CONTROL);
+ 			return 0;
+ 		}
+ 		cpu_relax();
+@@ -441,9 +460,32 @@ static void img_spfi_config(struct spi_m
+ 			    struct spi_transfer *xfer)
+ {
+ 	struct img_spfi *spfi = spi_master_get_devdata(spi->master);
+-	u32 val, div;
++	u32 val, div, transact;
++	bool is_pending;
+ 
+ 	/*
++	 * For read or write transfers of less than 8 bytes (cmd = 1 byte,
++	 * addr up to 7 bytes), SPFI will be configured, but not enabled
++	 * (unless it is the last transfer in the queue).The transfer will
++	 * be enabled by the subsequent transfer.
++	 * A pending transfer is determined by the content of the
++	 * transaction register: if command part is set and tsize
++	 * is not
++	 */
++	transact = spfi_readl(spfi, SPFI_TRANSACTION);
++	is_pending = ((transact >> SPFI_TRANSACTION_CMD_SHIFT) &
++			SPFI_TRANSACTION_CMD_MASK) &&
++			(!((transact >> SPFI_TRANSACTION_TSIZE_SHIFT) &
++			SPFI_TRANSACTION_TSIZE_MASK));
++
++	/* If there are no pending transactions it's OK to soft reset */
++	if (!is_pending) {
++		/* Start the transaction from a known (reset) state */
++		spfi_reset(spfi);
++	}
++
++	/*
++	 * Before anything else, set up parameters.
+ 	 * output = spfi_clk * (BITCLK / 512), where BITCLK must be a
+ 	 * power of 2 up to 128
+ 	 */
+@@ -456,20 +498,52 @@ static void img_spfi_config(struct spi_m
+ 	val |= div << SPFI_DEVICE_PARAMETER_BITCLK_SHIFT;
+ 	spfi_writel(spfi, val, SPFI_DEVICE_PARAMETER(spi->chip_select));
+ 
+-	spfi_writel(spfi, xfer->len << SPFI_TRANSACTION_TSIZE_SHIFT,
+-		    SPFI_TRANSACTION);
++	if (!list_is_last(&xfer->transfer_list, &master->cur_msg->transfers) &&
++		/*
++		 * For duplex mode (both the tx and rx buffers are !NULL) the
++		 * CMD, ADDR, and DUMMY byte parts of the transaction register
++		 * should always be 0 and therefore the pending transfer
++		 * technique cannot be used.
++		 */
++		(xfer->tx_buf) && (!xfer->rx_buf) &&
++		(xfer->len <= SPFI_DATA_REQUEST_MAX_SIZE) && !is_pending) {
++		transact = (1 & SPFI_TRANSACTION_CMD_MASK) <<
++			SPFI_TRANSACTION_CMD_SHIFT;
++		transact |= ((xfer->len - 1) & SPFI_TRANSACTION_ADDR_MASK) <<
++			SPFI_TRANSACTION_ADDR_SHIFT;
++		spfi->complete = false;
++	} else {
++		spfi->complete = true;
++		if (is_pending) {
++			/* Keep setup from pending transfer */
++			transact |= ((xfer->len & SPFI_TRANSACTION_TSIZE_MASK) <<
++				SPFI_TRANSACTION_TSIZE_SHIFT);
++		} else {
++			transact = ((xfer->len & SPFI_TRANSACTION_TSIZE_MASK) <<
++				SPFI_TRANSACTION_TSIZE_SHIFT);
++		}
++	}
++	spfi_writel(spfi, transact, SPFI_TRANSACTION);
+ 
+ 	val = spfi_readl(spfi, SPFI_CONTROL);
+ 	val &= ~(SPFI_CONTROL_SEND_DMA | SPFI_CONTROL_GET_DMA);
+-	if (xfer->tx_buf)
++	/*
++	 * We set up send DMA for pending transfers also, as
++	 * those are always send transfers
++	 */
++	if ((xfer->tx_buf) || is_pending)
+ 		val |= SPFI_CONTROL_SEND_DMA;
+-	if (xfer->rx_buf)
++	if (xfer->tx_buf)
++		val |= SPFI_CONTROL_TX_RX;
++	if (xfer->rx_buf) {
+ 		val |= SPFI_CONTROL_GET_DMA;
++		val &= ~SPFI_CONTROL_TX_RX;
++	}
+ 	val &= ~(SPFI_CONTROL_TMODE_MASK << SPFI_CONTROL_TMODE_SHIFT);
+-	if (xfer->tx_nbits == SPI_NBITS_DUAL &&
++	if (xfer->tx_nbits == SPI_NBITS_DUAL ||
+ 	    xfer->rx_nbits == SPI_NBITS_DUAL)
+ 		val |= SPFI_CONTROL_TMODE_DUAL << SPFI_CONTROL_TMODE_SHIFT;
+-	else if (xfer->tx_nbits == SPI_NBITS_QUAD &&
++	else if (xfer->tx_nbits == SPI_NBITS_QUAD ||
+ 		 xfer->rx_nbits == SPI_NBITS_QUAD)
+ 		val |= SPFI_CONTROL_TMODE_QUAD << SPFI_CONTROL_TMODE_SHIFT;
+ 	val |= SPFI_CONTROL_SE;
diff --git a/target/linux/pistachio/patches-5.15/104-spi-img-spfi-use-device-0-configuration-for-all-devi.patch b/target/linux/pistachio/patches-5.15/104-spi-img-spfi-use-device-0-configuration-for-all-devi.patch
new file mode 100644
index 00000000000000..2995b7dd88c569
--- /dev/null
+++ b/target/linux/pistachio/patches-5.15/104-spi-img-spfi-use-device-0-configuration-for-all-devi.patch
@@ -0,0 +1,64 @@
+From 905ee06a9966113fe51d6bad1819759cb30fd0bd Mon Sep 17 00:00:00 2001
+From: Ionela Voinescu <ionela.voinescu@imgtec.com>
+Date: Tue, 9 Feb 2016 10:18:31 +0000
+Subject: spi: img-spfi: use device 0 configuration for all devices
+
+Given that we control the chip select line externally
+we can use only one parameter register (device 0 parameter
+register) and one set of configuration bits (port configuration
+bits for device 0) for all devices (all chip select lines).
+
+Signed-off-by: Ionela Voinescu <ionela.voinescu@imgtec.com>
+---
+ drivers/spi/spi-img-spfi.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+--- a/drivers/spi/spi-img-spfi.c
++++ b/drivers/spi/spi-img-spfi.c
+@@ -429,18 +429,23 @@ static int img_spfi_prepare(struct spi_m
+ 	struct img_spfi *spfi = spi_master_get_devdata(master);
+ 	u32 val;
+ 
++	/*
++	 * The chip select line is controlled externally so
++	 * we can use the CS0 configuration for all devices
++	 */
+ 	val = spfi_readl(spfi, SPFI_PORT_STATE);
++
++	/* 0 for device selection */
+ 	val &= ~(SPFI_PORT_STATE_DEV_SEL_MASK <<
+ 		 SPFI_PORT_STATE_DEV_SEL_SHIFT);
+-	val |= msg->spi->chip_select << SPFI_PORT_STATE_DEV_SEL_SHIFT;
+ 	if (msg->spi->mode & SPI_CPHA)
+-		val |= SPFI_PORT_STATE_CK_PHASE(msg->spi->chip_select);
++		val |= SPFI_PORT_STATE_CK_PHASE(0);
+ 	else
+-		val &= ~SPFI_PORT_STATE_CK_PHASE(msg->spi->chip_select);
++		val &= ~SPFI_PORT_STATE_CK_PHASE(0);
+ 	if (msg->spi->mode & SPI_CPOL)
+-		val |= SPFI_PORT_STATE_CK_POL(msg->spi->chip_select);
++		val |= SPFI_PORT_STATE_CK_POL(0);
+ 	else
+-		val &= ~SPFI_PORT_STATE_CK_POL(msg->spi->chip_select);
++		val &= ~SPFI_PORT_STATE_CK_POL(0);
+ 	spfi_writel(spfi, val, SPFI_PORT_STATE);
+ 
+ 	return 0;
+@@ -492,11 +497,15 @@ static void img_spfi_config(struct spi_m
+ 	div = DIV_ROUND_UP(clk_get_rate(spfi->spfi_clk), xfer->speed_hz);
+ 	div = clamp(512 / (1 << get_count_order(div)), 1, 128);
+ 
+-	val = spfi_readl(spfi, SPFI_DEVICE_PARAMETER(spi->chip_select));
++	/*
++	 * The chip select line is controlled externally so
++	 * we can use the CS0 parameters for all devices
++	 */
++	val = spfi_readl(spfi, SPFI_DEVICE_PARAMETER(0));
+ 	val &= ~(SPFI_DEVICE_PARAMETER_BITCLK_MASK <<
+ 		 SPFI_DEVICE_PARAMETER_BITCLK_SHIFT);
+ 	val |= div << SPFI_DEVICE_PARAMETER_BITCLK_SHIFT;
+-	spfi_writel(spfi, val, SPFI_DEVICE_PARAMETER(spi->chip_select));
++	spfi_writel(spfi, val, SPFI_DEVICE_PARAMETER(0));
+ 
+ 	if (!list_is_last(&xfer->transfer_list, &master->cur_msg->transfers) &&
+ 		/*
diff --git a/target/linux/pistachio/patches-5.15/105-spi-img-spfi-RX-maximum-burst-size-for-DMA-is-8.patch b/target/linux/pistachio/patches-5.15/105-spi-img-spfi-RX-maximum-burst-size-for-DMA-is-8.patch
new file mode 100644
index 00000000000000..54185038162116
--- /dev/null
+++ b/target/linux/pistachio/patches-5.15/105-spi-img-spfi-RX-maximum-burst-size-for-DMA-is-8.patch
@@ -0,0 +1,59 @@
+From 56466f505f58f44b69feb7eaed3b506842800456 Mon Sep 17 00:00:00 2001
+From: Ionela Voinescu <ionela.voinescu@imgtec.com>
+Date: Tue, 1 Mar 2016 17:49:45 +0000
+Subject: spi: img-spfi: RX maximum burst size for DMA is 8
+
+The depth of the FIFOs is 16 bytes. The DMA request line is tied
+to the half full/empty (depending on the use of the TX or RX FIFO)
+threshold. For the TX FIFO, if you set a burst size of 8 (equal to
+half the depth) the first burst goes into FIFO without any issues,
+but due the latency involved (the time the data leaves  the DMA
+engine to the time it arrives at the FIFO), the DMA might trigger
+another burst of 8. But given that there is no space for 2 additonal
+bursts of 8, this would result in a failure. Therefore, we have to
+keep the burst size for TX to 4 to accomodate for an extra burst.
+
+For the read (RX) scenario, the DMA request line goes high when
+there is at least 8 entries in the FIFO (half full), and we can
+program the burst size to be 8 because the risk of accidental burst
+does not exist. The DMA engine will not trigger another read until
+the read data for all the burst it has sent out has been received.
+
+While here, move the burst size setting outside of the if/else branches
+as they have the same value for both 8 and 32 bit data widths.
+
+Signed-off-by: Ionela Voinescu <ionela.voinescu@imgtec.com>
+---
+ drivers/spi/spi-img-spfi.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/spi/spi-img-spfi.c
++++ b/drivers/spi/spi-img-spfi.c
+@@ -338,12 +338,11 @@ static int img_spfi_start_dma(struct spi
+ 		if (xfer->len % 4 == 0) {
+ 			rxconf.src_addr = spfi->phys + SPFI_RX_32BIT_VALID_DATA;
+ 			rxconf.src_addr_width = 4;
+-			rxconf.src_maxburst = 4;
+ 		} else {
+ 			rxconf.src_addr = spfi->phys + SPFI_RX_8BIT_VALID_DATA;
+ 			rxconf.src_addr_width = 1;
+-			rxconf.src_maxburst = 4;
+ 		}
++		rxconf.src_maxburst = 8;
+ 		dmaengine_slave_config(spfi->rx_ch, &rxconf);
+ 
+ 		rxdesc = dmaengine_prep_slave_sg(spfi->rx_ch, xfer->rx_sg.sgl,
+@@ -362,12 +361,11 @@ static int img_spfi_start_dma(struct spi
+ 		if (xfer->len % 4 == 0) {
+ 			txconf.dst_addr = spfi->phys + SPFI_TX_32BIT_VALID_DATA;
+ 			txconf.dst_addr_width = 4;
+-			txconf.dst_maxburst = 4;
+ 		} else {
+ 			txconf.dst_addr = spfi->phys + SPFI_TX_8BIT_VALID_DATA;
+ 			txconf.dst_addr_width = 1;
+-			txconf.dst_maxburst = 4;
+ 		}
++		txconf.dst_maxburst = 4;
+ 		dmaengine_slave_config(spfi->tx_ch, &txconf);
+ 
+ 		txdesc = dmaengine_prep_slave_sg(spfi->tx_ch, xfer->tx_sg.sgl,
diff --git a/target/linux/pistachio/patches-5.15/106-spi-img-spfi-finish-every-transfer-cleanly.patch b/target/linux/pistachio/patches-5.15/106-spi-img-spfi-finish-every-transfer-cleanly.patch
new file mode 100644
index 00000000000000..ea1f9f28cc7361
--- /dev/null
+++ b/target/linux/pistachio/patches-5.15/106-spi-img-spfi-finish-every-transfer-cleanly.patch
@@ -0,0 +1,120 @@
+From 5fcca3fd4b621d7b5bdeca18d36dfc6ca6cfe383 Mon Sep 17 00:00:00 2001
+From: Ionela Voinescu <ionela.voinescu@imgtec.com>
+Date: Wed, 10 Aug 2016 11:42:26 +0100
+Subject: spi: img-spfi: finish every transfer cleanly
+
+Before this change, the interrupt status bit that signaled
+the end of a tranfers was cleared in the wait_all_done
+function. That functionality triggered issues for DMA
+duplex transactions where the wait function was called
+twice, in both the TX and RX callbacks.
+
+In order to fix the issue, clear all interrupt data bits
+at the end of a PIO transfer or at the end of both TX and RX
+duplex transfers, if the transfer is not a pending tranfer
+(command waiting for data). After that, the status register
+is checked for new incoming data or new data requests to be
+signaled. If SPFI finished cleanly, no new interrupt data
+bits should be set.
+
+Signed-off-by: Ionela Voinescu <ionela.voinescu@imgtec.com>
+---
+ drivers/spi/spi-img-spfi.c | 49 +++++++++++++++++++++++++++++++++-------------
+ 1 file changed, 35 insertions(+), 14 deletions(-)
+
+--- a/drivers/spi/spi-img-spfi.c
++++ b/drivers/spi/spi-img-spfi.c
+@@ -79,6 +79,14 @@
+ #define SPFI_INTERRUPT_SDE			BIT(1)
+ #define SPFI_INTERRUPT_SDTRIG			BIT(0)
+ 
++#define SPFI_INTERRUPT_DATA_BITS		(SPFI_INTERRUPT_SDHF |\
++						SPFI_INTERRUPT_SDFUL |\
++						SPFI_INTERRUPT_GDEX32BIT |\
++						SPFI_INTERRUPT_GDHF |\
++						SPFI_INTERRUPT_GDFUL |\
++						SPFI_INTERRUPT_ALLDONETRIG |\
++						SPFI_INTERRUPT_GDEX8BIT)
++
+ /*
+  * There are four parallel FIFOs of 16 bytes each.  The word buffer
+  * (*_32BIT_VALID_DATA) accesses all four FIFOs at once, resulting in an
+@@ -136,6 +144,23 @@ static inline void spfi_reset(struct img
+ 	spfi_writel(spfi, 0, SPFI_CONTROL);
+ }
+ 
++static inline void spfi_finish(struct img_spfi *spfi)
++{
++	if (!(spfi->complete))
++		return;
++
++	/* Clear data bits as all transfers(TX and RX) have finished */
++	spfi_writel(spfi, SPFI_INTERRUPT_DATA_BITS, SPFI_INTERRUPT_CLEAR);
++	if (spfi_readl(spfi, SPFI_INTERRUPT_STATUS) & SPFI_INTERRUPT_DATA_BITS) {
++		dev_err(spfi->dev, "SPFI did not finish transfer cleanly.\n");
++		spfi_reset(spfi);
++	}
++	/* Disable SPFI for it not to interfere with pending transactions */
++	spfi_writel(spfi,
++		    spfi_readl(spfi, SPFI_CONTROL) & ~SPFI_CONTROL_SPFI_EN,
++		    SPFI_CONTROL);
++}
++
+ static int spfi_wait_all_done(struct img_spfi *spfi)
+ {
+ 	unsigned long timeout = jiffies + msecs_to_jiffies(50);
+@@ -144,19 +169,9 @@ static int spfi_wait_all_done(struct img
+ 		return 0;
+ 
+ 	while (time_before(jiffies, timeout)) {
+-		u32 status = spfi_readl(spfi, SPFI_INTERRUPT_STATUS);
+-
+-		if (status & SPFI_INTERRUPT_ALLDONETRIG) {
+-			spfi_writel(spfi, SPFI_INTERRUPT_ALLDONETRIG,
+-				    SPFI_INTERRUPT_CLEAR);
+-			/*
+-			 * Disable SPFI for it not to interfere with
+-			 * pending transactions
+-			 */
+-			spfi_writel(spfi, spfi_readl(spfi, SPFI_CONTROL)
+-			& ~SPFI_CONTROL_SPFI_EN, SPFI_CONTROL);
++		if (spfi_readl(spfi, SPFI_INTERRUPT_STATUS) &
++		    SPFI_INTERRUPT_ALLDONETRIG)
+ 			return 0;
+-		}
+ 		cpu_relax();
+ 	}
+ 
+@@ -288,6 +303,8 @@ static int img_spfi_start_pio(struct spi
+ 	}
+ 
+ 	ret = spfi_wait_all_done(spfi);
++	spfi_finish(spfi);
++
+ 	if (ret < 0)
+ 		return ret;
+ 
+@@ -303,8 +320,10 @@ static void img_spfi_dma_rx_cb(void *dat
+ 
+ 	spin_lock_irqsave(&spfi->lock, flags);
+ 	spfi->rx_dma_busy = false;
+-	if (!spfi->tx_dma_busy)
++	if (!spfi->tx_dma_busy) {
++		spfi_finish(spfi);
+ 		spi_finalize_current_transfer(spfi->master);
++	}
+ 	spin_unlock_irqrestore(&spfi->lock, flags);
+ }
+ 
+@@ -317,8 +336,10 @@ static void img_spfi_dma_tx_cb(void *dat
+ 
+ 	spin_lock_irqsave(&spfi->lock, flags);
+ 	spfi->tx_dma_busy = false;
+-	if (!spfi->rx_dma_busy)
++	if (!spfi->rx_dma_busy) {
++		spfi_finish(spfi);
+ 		spi_finalize_current_transfer(spfi->master);
++	}
+ 	spin_unlock_irqrestore(&spfi->lock, flags);
+ }
+ 
diff --git a/target/linux/pistachio/patches-5.15/108-clk-pistachio-Fix-wrong-SDHost-card-speed.patch b/target/linux/pistachio/patches-5.15/108-clk-pistachio-Fix-wrong-SDHost-card-speed.patch
new file mode 100644
index 00000000000000..6fddbe269afc6a
--- /dev/null
+++ b/target/linux/pistachio/patches-5.15/108-clk-pistachio-Fix-wrong-SDHost-card-speed.patch
@@ -0,0 +1,49 @@
+From 3642843a06025ec333d7e92580cf52cb8db2a652 Mon Sep 17 00:00:00 2001
+From: Govindraj Raja <Govindraj.Raja@imgtec.com>
+Date: Fri, 8 Jan 2016 16:36:07 +0000
+Subject: clk: pistachio: Fix wrong SDHost card speed
+
+The SDHost currently clocks the card 4x slower than it
+should do, because there is fixed divide by 4 in the
+sdhost wrapper that is not present in the clock tree.
+To model this add a fixed divide by 4 clock node in
+the SDHost clock path.
+
+This will ensure the right clock frequency is selected when
+the mmc driver tries to configure frequency on card insert.
+
+Signed-off-by: Govindraj Raja <Govindraj.Raja@imgtec.com>
+---
+ drivers/clk/pistachio/clk-pistachio.c     | 3 ++-
+ include/dt-bindings/clock/pistachio-clk.h | 1 +
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/pistachio/clk-pistachio.c
++++ b/drivers/clk/pistachio/clk-pistachio.c
+@@ -41,7 +41,7 @@ static struct pistachio_gate pistachio_g
+ 	GATE(CLK_AUX_ADC_INTERNAL, "aux_adc_internal", "sys_internal_div",
+ 	     0x104, 22),
+ 	GATE(CLK_AUX_ADC, "aux_adc", "aux_adc_div", 0x104, 23),
+-	GATE(CLK_SD_HOST, "sd_host", "sd_host_div", 0x104, 24),
++	GATE(CLK_SD_HOST, "sd_host", "sd_host_div4", 0x104, 24),
+ 	GATE(CLK_BT, "bt", "bt_div", 0x104, 25),
+ 	GATE(CLK_BT_DIV4, "bt_div4", "bt_div4_div", 0x104, 26),
+ 	GATE(CLK_BT_DIV8, "bt_div8", "bt_div8_div", 0x104, 27),
+@@ -51,6 +51,7 @@ static struct pistachio_gate pistachio_g
+ static struct pistachio_fixed_factor pistachio_ffs[] __initdata = {
+ 	FIXED_FACTOR(CLK_WIFI_DIV4, "wifi_div4", "wifi_pll", 4),
+ 	FIXED_FACTOR(CLK_WIFI_DIV8, "wifi_div8", "wifi_pll", 8),
++	FIXED_FACTOR(CLK_SDHOST_DIV4, "sd_host_div4", "sd_host_div", 4),
+ };
+ 
+ static struct pistachio_div pistachio_divs[] __initdata = {
+--- a/include/dt-bindings/clock/pistachio-clk.h
++++ b/include/dt-bindings/clock/pistachio-clk.h
+@@ -18,6 +18,7 @@
+ /* Fixed-factor clocks */
+ #define CLK_WIFI_DIV4			16
+ #define CLK_WIFI_DIV8			17
++#define CLK_SDHOST_DIV4			18
+ 
+ /* Gate clocks */
+ #define CLK_MIPS			32
diff --git a/target/linux/pistachio/patches-5.15/109-MIPS-DTS-img-marduk-switch-mmc-to-1-bit-mode.patch b/target/linux/pistachio/patches-5.15/109-MIPS-DTS-img-marduk-switch-mmc-to-1-bit-mode.patch
new file mode 100644
index 00000000000000..faba23c5f1bf46
--- /dev/null
+++ b/target/linux/pistachio/patches-5.15/109-MIPS-DTS-img-marduk-switch-mmc-to-1-bit-mode.patch
@@ -0,0 +1,47 @@
+From 981c1d416af45eff207227aec106381ac23aac99 Mon Sep 17 00:00:00 2001
+From: Ian Pozella <Ian.Pozella@imgtec.com>
+Date: Mon, 20 Feb 2017 10:00:52 +0000
+Subject: MIPS: DTS: img: marduk: switch mmc to 1 bit mode
+
+The mmc block in Pistachio allows 1 to 8 data bits to be used.
+Marduk uses 4 bits allowing the upper 4 bits to be allocated
+to the Mikrobus ports. However these bits are still connected
+internally meaning the mmc block recieves signals on all data lines
+and seems the internal HW CRC checks get corrupted by this erroneous
+data.
+
+We cannot control what data is sent on these lines because they go
+to external ports. 1 bit mode does not exhibit the issue hence the
+safe default is to use this. If a user knows that in their use case
+they will not use the upper bits then they can set to 4 bit mode in
+order to improve performance.
+
+Also make sure that the upper 4 bits don't get allocated to the mmc
+driver (the default is to assign all 8 pins) so they can be allocated
+to other drivers. Allocating all 4 despite setting 1 bit mode as this
+matches what is there in hardware.
+
+Signed-off-by: Ian Pozella <Ian.Pozella@imgtec.com>
+---
+ arch/mips/boot/dts/img/pistachio_marduk.dts | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/mips/boot/dts/img/pistachio_marduk.dts
++++ b/arch/mips/boot/dts/img/pistachio_marduk.dts
+@@ -118,7 +118,7 @@
+ 
+ &sdhost {
+ 	status = "okay";
+-	bus-width = <4>;
++	bus-width = <1>;
+ 	disable-wp;
+ };
+ 
+@@ -128,6 +128,7 @@
+ 
+ &pin_sdhost_data {
+ 	drive-strength = <2>;
++	pins = "mfio17", "mfio18", "mfio19", "mfio20";
+ };
+ 
+ &pwm {
diff --git a/target/linux/pistachio/patches-5.15/401-mtd-nor-support-mtd-name-from-device-tree.patch b/target/linux/pistachio/patches-5.15/401-mtd-nor-support-mtd-name-from-device-tree.patch
new file mode 100644
index 00000000000000..163bafdb2e5b34
--- /dev/null
+++ b/target/linux/pistachio/patches-5.15/401-mtd-nor-support-mtd-name-from-device-tree.patch
@@ -0,0 +1,54 @@
+From f32bc2aa01edcba2f2ed5db151cf183eac9ef919 Mon Sep 17 00:00:00 2001
+From: Abhimanyu Vishwakarma <Abhimanyu.Vishwakarma@imgtec.com>
+Date: Sat, 25 Feb 2017 16:42:50 +0000
+Subject: mtd: nor: support mtd name from device tree
+
+Signed-off-by: Abhimanyu Vishwakarma <Abhimanyu.Vishwakarma@imgtec.com>
+---
+ drivers/mtd/spi-nor/spi-nor.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/spi-nor/core.c
++++ b/drivers/mtd/spi-nor/core.c
+@@ -3107,6 +3107,7 @@ int spi_nor_scan(struct spi_nor *nor, co
+ 	struct device *dev = nor->dev;
+ 	struct mtd_info *mtd = &nor->mtd;
+ 	struct device_node *np = spi_nor_get_flash_node(nor);
++	const char __maybe_unused *of_mtd_name = NULL;
+ 	int ret;
+ 	int i;
+ 
+@@ -3161,7 +3162,12 @@ int spi_nor_scan(struct spi_nor *nor, co
+ 	if (ret)
+ 		return ret;
+ 
+-	if (!mtd->name)
++#ifdef CONFIG_MTD_OF_PARTS
++	of_property_read_string(np, "linux,mtd-name", &of_mtd_name);
++#endif
++	if (of_mtd_name)
++		mtd->name = of_mtd_name;
++	else if (!mtd->name)
+ 		mtd->name = dev_name(dev);
+ 	mtd->priv = nor;
+ 	mtd->type = MTD_NORFLASH;
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -847,6 +847,17 @@ out_error:
+  */
+ static void mtd_set_dev_defaults(struct mtd_info *mtd)
+ {
++#ifdef CONFIG_MTD_OF_PARTS
++	const char __maybe_unused *of_mtd_name = NULL;
++	struct device_node *np;
++
++	np = mtd_get_of_node(mtd);
++	if (np && !mtd->name) {
++		of_property_read_string(np, "linux,mtd-name", &of_mtd_name);
++		if (of_mtd_name)
++			mtd->name = of_mtd_name;
++	} else
++#endif
+ 	if (mtd->dev.parent) {
+ 		if (!mtd->owner && mtd->dev.parent->driver)
+ 			mtd->owner = mtd->dev.parent->driver->owner;
diff --git a/target/linux/pistachio/patches-5.15/901-MIPS-DTS-img-marduk-Add-SPI-NAND-flash.patch b/target/linux/pistachio/patches-5.15/901-MIPS-DTS-img-marduk-Add-SPI-NAND-flash.patch
new file mode 100644
index 00000000000000..4b28f4683333c7
--- /dev/null
+++ b/target/linux/pistachio/patches-5.15/901-MIPS-DTS-img-marduk-Add-SPI-NAND-flash.patch
@@ -0,0 +1,30 @@
+From 0023c706f7e0f0f02bd48a63a2f3c04c839532ae Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Sat, 15 Aug 2020 16:04:53 +0200
+Subject: [PATCH 901/904] MIPS: DTS: img: marduk: Add SPI NAND flash
+
+Add Gigadevice GD5F4GQ4UCYIGT SPI NAND flash to the device tree.
+
+The NAND flash chip is connected with quad SPI, but reading currently
+fails in quad SPI mode.
+
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+---
+ arch/mips/boot/dts/img/pistachio_marduk.dts | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/arch/mips/boot/dts/img/pistachio_marduk.dts
++++ b/arch/mips/boot/dts/img/pistachio_marduk.dts
+@@ -89,6 +89,12 @@
+ 		reg = <0>;
+ 		spi-max-frequency = <50000000>;
+ 	};
++
++	flash@1 {
++		compatible = "spi-nand";
++		reg = <1>;
++		spi-max-frequency = <50000000>;
++	};
+ };
+ 
+ &uart0 {
diff --git a/target/linux/pistachio/patches-5.15/902-MIPS-DTS-img-marduk-Add-Cascoda-CA8210-6LoWPAN.patch b/target/linux/pistachio/patches-5.15/902-MIPS-DTS-img-marduk-Add-Cascoda-CA8210-6LoWPAN.patch
new file mode 100644
index 00000000000000..d4c4ccac53d50e
--- /dev/null
+++ b/target/linux/pistachio/patches-5.15/902-MIPS-DTS-img-marduk-Add-Cascoda-CA8210-6LoWPAN.patch
@@ -0,0 +1,43 @@
+From b7700154d75e8d7c9a2022f09c2d5430137606fa Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Sat, 15 Aug 2020 16:05:25 +0200
+Subject: [PATCH 902/904] MIPS: DTS: img: marduk: Add Cascoda CA8210 6LoWPAN
+
+Add Cascoda CA8210 6LoWPAN controller to device tree.
+
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+---
+ arch/mips/boot/dts/img/pistachio_marduk.dts | 22 +++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+--- a/arch/mips/boot/dts/img/pistachio_marduk.dts
++++ b/arch/mips/boot/dts/img/pistachio_marduk.dts
+@@ -76,6 +76,28 @@
+ 	VDD-supply = <&internal_dac_supply>;
+ };
+ 
++&spfi0 {
++	status = "okay";
++	pinctrl-0 = <&spim0_pins>, <&spim0_cs0_alt_pin>, <&spim0_cs2_alt_pin>, <&spim0_cs3_alt_pin>, <&spim0_cs4_alt_pin>;
++	pinctrl-names = "default";
++
++	cs-gpios = <&gpio1 14 GPIO_ACTIVE_HIGH>, <&gpio0 2 GPIO_ACTIVE_HIGH>,
++			<&gpio1 12 GPIO_ACTIVE_HIGH>, <&gpio1 13 GPIO_ACTIVE_HIGH>;
++
++	ca8210: ca8210@0 {
++		status = "okay";
++		compatible = "cascoda,ca8210";
++		reg = <0>;
++		spi-max-frequency = <4000000>;
++		spi-cpol;
++		reset-gpio = <&gpio0 12 GPIO_ACTIVE_HIGH>;
++		irq-gpio = <&gpio2 12 GPIO_ACTIVE_HIGH>;
++		extclock-enable;
++		extclock-freq = <16000000>;
++		extclock-gpio = <2>;
++	};
++};
++
+ &spfi1 {
+ 	status = "okay";
+ 
diff --git a/target/linux/pistachio/patches-5.15/903-MIPS-DTS-img-marduk-Add-NXP-SC16IS752IPW.patch b/target/linux/pistachio/patches-5.15/903-MIPS-DTS-img-marduk-Add-NXP-SC16IS752IPW.patch
new file mode 100644
index 00000000000000..b1070c3d309eac
--- /dev/null
+++ b/target/linux/pistachio/patches-5.15/903-MIPS-DTS-img-marduk-Add-NXP-SC16IS752IPW.patch
@@ -0,0 +1,81 @@
+From ad4eba0c36ce8af6ab9ea1bc163e4c1ac7c271c3 Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Sat, 15 Aug 2020 16:09:02 +0200
+Subject: [PATCH 903/904] MIPS: DTS: img: marduk: Add NXP SC16IS752IPW
+
+Add NXP SC16IS752IPW SPI-UART controller to device tree.
+
+This controller drives 2 UARTs and 7 LEDs on the board.
+
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+---
+ arch/mips/boot/dts/img/pistachio_marduk.dts | 51 +++++++++++++++++++++
+ 1 file changed, 51 insertions(+)
+
+--- a/arch/mips/boot/dts/img/pistachio_marduk.dts
++++ b/arch/mips/boot/dts/img/pistachio_marduk.dts
+@@ -46,6 +46,46 @@
+ 		regulator-max-microvolt = <1800000>;
+ 	};
+ 
++	/* EXT clock from ca8210 is fed to sc16is752 */
++	ca8210_ext_clk: ca8210-ext-clk {
++		compatible = "fixed-clock";
++		#clock-cells = <0>;
++		clock-frequency = <16000000>;
++		clock-output-names = "ca8210_ext_clock";
++	};
++
++	gpioleds {
++		compatible = "gpio-leds";
++		user1 {
++			label = "marduk:red:user1";
++			gpios = <&sc16is752 0 GPIO_ACTIVE_LOW>;
++		};
++		user2 {
++			label = "marduk:red:user2";
++			gpios = <&sc16is752 1 GPIO_ACTIVE_LOW>;
++		};
++		user3 {
++			label = "marduk:red:user3";
++			gpios = <&sc16is752 2 GPIO_ACTIVE_LOW>;
++		};
++		user4 {
++			label = "marduk:red:user4";
++			gpios = <&sc16is752 3 GPIO_ACTIVE_LOW>;
++		};
++		user5 {
++			label = "marduk:red:user5";
++			gpios = <&sc16is752 4 GPIO_ACTIVE_LOW>;
++		};
++		user6 {
++			label = "marduk:red:user6";
++			gpios = <&sc16is752 5 GPIO_ACTIVE_LOW>;
++		};
++		user7 {
++			label = "marduk:red:user7";
++			gpios = <&sc16is752 6 GPIO_ACTIVE_LOW>;
++		};
++	};
++
+ 	led-controller {
+ 		compatible = "pwm-leds";
+ 
+@@ -96,6 +136,17 @@
+ 		extclock-freq = <16000000>;
+ 		extclock-gpio = <2>;
+ 	};
++
++	sc16is752: sc16is752@1 {
++		compatible = "nxp,sc16is752";
++		reg = <1>;
++		clocks = <&ca8210_ext_clk>;
++		spi-max-frequency = <4000000>;
++		interrupt-parent = <&gpio0>;
++		interrupts = <11 IRQ_TYPE_EDGE_FALLING>;
++		gpio-controller;
++		#gpio-cells = <2>;
++	};
+ };
+ 
+ &spfi1 {
diff --git a/target/linux/pistachio/patches-5.15/904-MIPS-DTS-img-marduk-Add-partition-name.patch b/target/linux/pistachio/patches-5.15/904-MIPS-DTS-img-marduk-Add-partition-name.patch
new file mode 100644
index 00000000000000..490027a7021f0b
--- /dev/null
+++ b/target/linux/pistachio/patches-5.15/904-MIPS-DTS-img-marduk-Add-partition-name.patch
@@ -0,0 +1,27 @@
+From ff0e950b605047bf50d470023e0fb2fc2003a0f0 Mon Sep 17 00:00:00 2001
+From: Ian Pozella <Ian.Pozella@imgtec.com>
+Date: Mon, 20 Feb 2017 10:38:07 +0000
+Subject: [PATCH 904/904] MIPS: DTS: img: marduk: Add partition name
+
+Signed-off-by: Ian Pozella <Ian.Pozella@imgtec.com>
+---
+ arch/mips/boot/dts/img/pistachio_marduk.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/mips/boot/dts/img/pistachio_marduk.dts
++++ b/arch/mips/boot/dts/img/pistachio_marduk.dts
+@@ -161,12 +161,14 @@
+ 		compatible = "spansion,s25fl016k", "jedec,spi-nor";
+ 		reg = <0>;
+ 		spi-max-frequency = <50000000>;
++		linux,mtd-name = "spi-nor";
+ 	};
+ 
+ 	flash@1 {
+ 		compatible = "spi-nand";
+ 		reg = <1>;
+ 		spi-max-frequency = <50000000>;
++		linux,mtd-name = "spi-nand";
+ 	};
+ };
+ 
diff --git a/target/linux/pistachio/patches-5.15/905-MIPS-DTS-img-marduk-Add-led-aliases.patch b/target/linux/pistachio/patches-5.15/905-MIPS-DTS-img-marduk-Add-led-aliases.patch
new file mode 100644
index 00000000000000..8c03ddeea277d3
--- /dev/null
+++ b/target/linux/pistachio/patches-5.15/905-MIPS-DTS-img-marduk-Add-led-aliases.patch
@@ -0,0 +1,27 @@
+--- a/arch/mips/boot/dts/img/pistachio_marduk.dts
++++ b/arch/mips/boot/dts/img/pistachio_marduk.dts
+@@ -19,6 +19,11 @@
+ 		ethernet0 = &enet;
+ 		spi0 = &spfi0;
+ 		spi1 = &spfi1;
++
++		led-boot = &led_heartbeat;
++		led-failsafe = &led_heartbeat;
++		led-running = &led_heartbeat;
++		led-upgrade = &led_heartbeat;
+ 	};
+ 
+ 	chosen {
+@@ -89,11 +94,10 @@
+ 	led-controller {
+ 		compatible = "pwm-leds";
+ 
+-		led-1 {
++		led_heartbeat: heartbeat {
+ 			label = "marduk:red:heartbeat";
+ 			pwms = <&pwm 3 300000>;
+ 			max-brightness = <255>;
+-			linux,default-trigger = "heartbeat";
+ 		};
+ 	};
+ 
diff --git a/target/linux/qoriq/Makefile b/target/linux/qoriq/Makefile
index d6a84634e2d478..5e8e417d3f477e 100644
--- a/target/linux/qoriq/Makefile
+++ b/target/linux/qoriq/Makefile
@@ -8,11 +8,10 @@ ARCH:=powerpc64
 BOARD:=qoriq
 BOARDNAME:=NXP QorIQ (PowerPC)
 CPU_TYPE:=e5500
-FEATURES:=boot-part ext4 fpu legacy-sdcard powerpc64 ramdisk root-part rtc source-only
+FEATURES:=boot-part ext4 fpu legacy-sdcard powerpc64 ramdisk rootfs-part rtc source-only
 SUBTARGETS:=generic
 
-KERNEL_PATCHVER:=5.10
-KERNEL_TESTING_PATCHVER:=5.15
+KERNEL_PATCHVER:=5.15
 
 KERNELNAME:=zImage
 
diff --git a/target/linux/qoriq/config-5.15 b/target/linux/qoriq/config-5.15
index e607501dbc0b98..8ebee2bb14f8bb 100644
--- a/target/linux/qoriq/config-5.15
+++ b/target/linux/qoriq/config-5.15
@@ -93,7 +93,6 @@ CONFIG_DMA_OPS_BYPASS=y
 CONFIG_DPAA_ERRATUM_A050385=y
 CONFIG_DTC=y
 CONFIG_DUMMY_CONSOLE=y
-CONFIG_DYNAMIC_DEBUG=y
 CONFIG_E500=y
 # CONFIG_E5500_CPU is not set
 CONFIG_E6500_CPU=y
@@ -183,9 +182,7 @@ CONFIG_INITRAMFS_SOURCE=""
 CONFIG_INPUT=y
 CONFIG_IOMMU_API=y
 # CONFIG_IOMMU_DEBUGFS is not set
-# CONFIG_IOMMU_DEFAULT_DMA_LAZY is not set
 CONFIG_IOMMU_DEFAULT_DMA_STRICT=y
-# CONFIG_IOMMU_DEFAULT_PASSTHROUGH is not set
 CONFIG_IOMMU_HELPER=y
 CONFIG_IOMMU_SUPPORT=y
 CONFIG_IRQCHIP=y
@@ -203,7 +200,6 @@ CONFIG_KERNEL_GZIP=y
 CONFIG_KERNEL_START=0xc000000000000000
 CONFIG_KPROBES=y
 CONFIG_KRETPROBES=y
-# CONFIG_LD_HEAD_STUB_CATCH is not set
 CONFIG_LIBFDT=y
 CONFIG_LOCK_DEBUGGING_SUPPORT=y
 CONFIG_LOCK_SPIN_ON_OWNER=y
diff --git a/target/linux/qoriq/files/arch/powerpc/boot/dts/fsl/watchguard-firebox-m300.dts b/target/linux/qoriq/files/arch/powerpc/boot/dts/fsl/watchguard-firebox-m300.dts
index 15dc5f445e3ac0..c611263099d542 100644
--- a/target/linux/qoriq/files/arch/powerpc/boot/dts/fsl/watchguard-firebox-m300.dts
+++ b/target/linux/qoriq/files/arch/powerpc/boot/dts/fsl/watchguard-firebox-m300.dts
@@ -269,7 +269,6 @@
 				status = "disabled";
 
 				reg = "<5>";
-				label = "cpu";
 				ethernet = <&enet2>;
 				phy-mode = "rgmii-id";
 
@@ -281,7 +280,6 @@
 
 			port@6 {
 				reg = <6>;
-				label = "cpu";
 				ethernet = <&enet3>;
 				phy-mode = "rgmii-id";
 
diff --git a/target/linux/qualcommax/Makefile b/target/linux/qualcommax/Makefile
new file mode 100644
index 00000000000000..a9d4c06b77aea1
--- /dev/null
+++ b/target/linux/qualcommax/Makefile
@@ -0,0 +1,21 @@
+include $(TOPDIR)/rules.mk
+
+ARCH:=aarch64
+BOARD:=qualcommax
+BOARDNAME:=Qualcomm Atheros 802.11ax WiSoC-s
+FEATURES:=squashfs ramdisk fpu nand rtc emmc
+KERNELNAME:=Image dtbs
+CPU_TYPE:=cortex-a53
+SUBTARGETS:=ipq807x
+
+KERNEL_PATCHVER:=6.1
+
+include $(INCLUDE_DIR)/target.mk
+DEFAULT_PACKAGES += \
+	kmod-usb3 kmod-usb-dwc3 kmod-usb-dwc3-qcom \
+	kmod-leds-gpio kmod-gpio-button-hotplug \
+	kmod-qca-nss-dp kmod-ath11k-ahb \
+	wpad-basic-mbedtls uboot-envtools \
+	e2fsprogs kmod-fs-ext4 losetup
+
+$(eval $(call BuildTarget))
diff --git a/target/linux/qualcommax/config-6.1 b/target/linux/qualcommax/config-6.1
new file mode 100644
index 00000000000000..2fa4aa30bbfcb1
--- /dev/null
+++ b/target/linux/qualcommax/config-6.1
@@ -0,0 +1,560 @@
+CONFIG_64BIT=y
+# CONFIG_APQ_GCC_8084 is not set
+# CONFIG_APQ_MMCC_8084 is not set
+CONFIG_ARCH_BINFMT_ELF_EXTRA_PHDRS=y
+CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_ARCH_FORCE_MAX_ORDER=11
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
+CONFIG_ARCH_MMAP_RND_BITS=18
+CONFIG_ARCH_MMAP_RND_BITS_MAX=24
+CONFIG_ARCH_MMAP_RND_BITS_MIN=18
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=11
+CONFIG_ARCH_NR_GPIO=0
+CONFIG_ARCH_PROC_KCORE_TEXT=y
+CONFIG_ARCH_QCOM=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_STACKWALK=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARCH_WANTS_NO_INSTR=y
+CONFIG_ARCH_WANTS_THP_SWAP=y
+CONFIG_ARM64=y
+CONFIG_ARM64_4K_PAGES=y
+CONFIG_ARM64_ERRATUM_1165522=y
+CONFIG_ARM64_ERRATUM_1286807=y
+CONFIG_ARM64_ERRATUM_2051678=y
+CONFIG_ARM64_ERRATUM_2054223=y
+CONFIG_ARM64_ERRATUM_2067961=y
+CONFIG_ARM64_ERRATUM_2077057=y
+CONFIG_ARM64_ERRATUM_2658417=y
+CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
+CONFIG_ARM64_PAGE_SHIFT=12
+CONFIG_ARM64_PA_BITS=48
+CONFIG_ARM64_PA_BITS_48=y
+CONFIG_ARM64_PTR_AUTH=y
+CONFIG_ARM64_PTR_AUTH_KERNEL=y
+CONFIG_ARM64_SME=y
+CONFIG_ARM64_SVE=y
+CONFIG_ARM64_TAGGED_ADDR_ABI=y
+CONFIG_ARM64_VA_BITS=39
+CONFIG_ARM64_VA_BITS_39=y
+CONFIG_ARM64_WORKAROUND_REPEAT_TLBI=y
+CONFIG_ARM64_WORKAROUND_SPECULATIVE_AT=y
+CONFIG_ARM64_WORKAROUND_TSB_FLUSH_FAILURE=y
+CONFIG_ARM_AMBA=y
+CONFIG_ARM_ARCH_TIMER=y
+CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+CONFIG_ARM_GIC=y
+CONFIG_ARM_GIC_V2M=y
+CONFIG_ARM_GIC_V3=y
+CONFIG_ARM_GIC_V3_ITS=y
+CONFIG_ARM_GIC_V3_ITS_PCI=y
+# CONFIG_ARM_MHU_V2 is not set
+CONFIG_ARM_PSCI_CPUIDLE=y
+CONFIG_ARM_PSCI_CPUIDLE_DOMAIN=y
+CONFIG_ARM_PSCI_FW=y
+# CONFIG_ARM_QCOM_CPUFREQ_HW is not set
+CONFIG_ARM_QCOM_CPUFREQ_NVMEM=y
+CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_MQ_VIRTIO=y
+CONFIG_BLK_PM=y
+CONFIG_CAVIUM_TX2_ERRATUM_219=y
+CONFIG_CC_HAVE_SHADOW_CALL_STACK=y
+CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
+CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
+CONFIG_CC_NO_ARRAY_BOUNDS=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMMON_CLK_QCOM=y
+CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
+# CONFIG_COMPAT_32BIT_TIME is not set
+CONFIG_CONTEXT_TRACKING=y
+CONFIG_CONTEXT_TRACKING_IDLE=y
+CONFIG_COREDUMP=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+CONFIG_CPU_FREQ=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+# CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set
+# CONFIG_CPU_FREQ_GOV_ONDEMAND is not set
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+# CONFIG_CPU_FREQ_GOV_POWERSAVE is not set
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+# CONFIG_CPU_FREQ_GOV_USERSPACE is not set
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_THERMAL=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_IDLE_MULTIPLE_DRIVERS=y
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_THERMAL=y
+CONFIG_CRC16=y
+CONFIG_CRC8=y
+CONFIG_CRYPTO_AUTHENC=y
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_DEV_QCE=y
+CONFIG_CRYPTO_DEV_QCE_AEAD=y
+# CONFIG_CRYPTO_DEV_QCE_ENABLE_AEAD is not set
+CONFIG_CRYPTO_DEV_QCE_ENABLE_ALL=y
+# CONFIG_CRYPTO_DEV_QCE_ENABLE_SHA is not set
+# CONFIG_CRYPTO_DEV_QCE_ENABLE_SKCIPHER is not set
+CONFIG_CRYPTO_DEV_QCE_SHA=y
+CONFIG_CRYPTO_DEV_QCE_SKCIPHER=y
+CONFIG_CRYPTO_DEV_QCE_SW_MAX_LEN=512
+CONFIG_CRYPTO_DEV_QCOM_RNG=y
+CONFIG_CRYPTO_ECB=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_HW=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_DES=y
+CONFIG_CRYPTO_LIB_SHA1=y
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_LIB_UTILS=y
+CONFIG_CRYPTO_LZO=y
+# CONFIG_CRYPTO_POLYVAL_ARM64_CE is not set
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_SHA1=y
+CONFIG_CRYPTO_SHA256=y
+# CONFIG_CRYPTO_SM4_ARM64_CE_BLK is not set
+# CONFIG_CRYPTO_SM4_ARM64_NEON_BLK is not set
+CONFIG_CRYPTO_XTS=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DEV_COREDUMP=y
+CONFIG_DMADEVICES=y
+CONFIG_DMA_DIRECT_REMAP=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_VIRTUAL_CHANNELS=y
+CONFIG_DTC=y
+CONFIG_DT_IDLE_GENPD=y
+CONFIG_DT_IDLE_STATES=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EXCLUSIVE_SYSTEM_RAM=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FRAME_POINTER=y
+CONFIG_FUJITSU_ERRATUM_010001=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_FW_LOADER_SYSFS=y
+CONFIG_GCC11_NO_ARRAY_BOUNDS=y
+CONFIG_GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_REGS=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ARCH_TOPOLOGY=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_CSUM=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IOREMAP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_MSI_IRQ=y
+CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GLOB=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HWSPINLOCK=y
+CONFIG_HWSPINLOCK_QCOM=y
+CONFIG_I2C=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_HELPER_AUTO=y
+# CONFIG_I2C_QCOM_CCI is not set
+CONFIG_I2C_QUP=y
+CONFIG_IIO=y
+CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IPQ_APSS_6018=y
+CONFIG_IPQ_APSS_PLL=y
+# CONFIG_IPQ_GCC_4019 is not set
+# CONFIG_IPQ_GCC_6018 is not set
+# CONFIG_IPQ_GCC_806X is not set
+CONFIG_IPQ_GCC_8074=y
+# CONFIG_IPQ_LCC_806X is not set
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FASTEOI_HIERARCHY_HANDLERS=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+# CONFIG_KPSS_XCC is not set
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MAILBOX=y
+# CONFIG_MAILBOX_TEST is not set
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MDIO_IPQ4019=y
+# CONFIG_MDM_GCC_9615 is not set
+# CONFIG_MDM_LCC_9615 is not set
+CONFIG_MEMFD_CREATE=y
+# CONFIG_MFD_HI6421_SPMI is not set
+# CONFIG_MFD_QCOM_RPM is not set
+CONFIG_MFD_SPMI_PMIC=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_CQHCI=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_IO_ACCESSORS=y
+CONFIG_MMC_SDHCI_MSM=y
+# CONFIG_MMC_SDHCI_PCI is not set
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MODULES_USE_ELF_RELA=y
+# CONFIG_MSM_GCC_8660 is not set
+# CONFIG_MSM_GCC_8909 is not set
+# CONFIG_MSM_GCC_8916 is not set
+# CONFIG_MSM_GCC_8939 is not set
+# CONFIG_MSM_GCC_8960 is not set
+# CONFIG_MSM_GCC_8974 is not set
+# CONFIG_MSM_GCC_8976 is not set
+# CONFIG_MSM_GCC_8994 is not set
+# CONFIG_MSM_GCC_8996 is not set
+# CONFIG_MSM_GCC_8998 is not set
+# CONFIG_MSM_GPUCC_8998 is not set
+# CONFIG_MSM_LCC_8960 is not set
+# CONFIG_MSM_MMCC_8960 is not set
+# CONFIG_MSM_MMCC_8974 is not set
+# CONFIG_MSM_MMCC_8996 is not set
+# CONFIG_MSM_MMCC_8998 is not set
+CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_NAND_ECC_SW_HAMMING=y
+CONFIG_MTD_NAND_QCOM=y
+CONFIG_MTD_QCOMSMEM_PARTS=y
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_LIMIT=20
+CONFIG_MTD_UBI_BLOCK=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_SG_DMA_LENGTH=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NLS=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NR_CPUS=4
+CONFIG_NVIDIA_CARMEL_CNP_ERRATUM=y
+CONFIG_NVMEM=y
+CONFIG_NVMEM_QCOM_QFPROM=y
+# CONFIG_NVMEM_SPMI_SDAM is not set
+CONFIG_NVMEM_SYSFS=y
+CONFIG_NVMEM_U_BOOT_ENV=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_PADATA=y
+CONFIG_PAGE_POOL=y
+CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
+CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
+CONFIG_PARTITION_PERCPU=y
+CONFIG_PCI=y
+CONFIG_PCIEAER=y
+CONFIG_PCIEASPM=y
+CONFIG_PCIEASPM_DEFAULT=y
+# CONFIG_PCIEASPM_PERFORMANCE is not set
+# CONFIG_PCIEASPM_POWERSAVE is not set
+# CONFIG_PCIEASPM_POWER_SUPERSAVE is not set
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_DW=y
+CONFIG_PCIE_DW_HOST=y
+CONFIG_PCIE_PME=y
+CONFIG_PCIE_QCOM=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PCI_MSI=y
+CONFIG_PCI_MSI_IRQ_DOMAIN=y
+CONFIG_PGTABLE_LEVELS=3
+CONFIG_PHYLIB=y
+CONFIG_PHYS_ADDR_T_64BIT=y
+# CONFIG_PHY_QCOM_APQ8064_SATA is not set
+# CONFIG_PHY_QCOM_EDP is not set
+# CONFIG_PHY_QCOM_IPQ4019_USB is not set
+# CONFIG_PHY_QCOM_IPQ806X_SATA is not set
+# CONFIG_PHY_QCOM_IPQ806X_USB is not set
+# CONFIG_PHY_QCOM_PCIE2 is not set
+CONFIG_PHY_QCOM_QMP=y
+CONFIG_PHY_QCOM_QUSB2=y
+# CONFIG_PHY_QCOM_USB_HS_28NM is not set
+# CONFIG_PHY_QCOM_USB_SNPS_FEMTO_V2 is not set
+# CONFIG_PHY_QCOM_USB_SS is not set
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_IPQ6018 is not set
+CONFIG_PINCTRL_IPQ8074=y
+CONFIG_PINCTRL_MSM=y
+# CONFIG_PINCTRL_MSM8916 is not set
+# CONFIG_PINCTRL_MSM8976 is not set
+# CONFIG_PINCTRL_MSM8994 is not set
+# CONFIG_PINCTRL_MSM8996 is not set
+# CONFIG_PINCTRL_MSM8998 is not set
+# CONFIG_PINCTRL_QCM2290 is not set
+CONFIG_PINCTRL_QCOM_SPMI_PMIC=y
+# CONFIG_PINCTRL_QCOM_SSBI_PMIC is not set
+# CONFIG_PINCTRL_QCS404 is not set
+# CONFIG_PINCTRL_SC7180 is not set
+# CONFIG_PINCTRL_SC8280XP is not set
+# CONFIG_PINCTRL_SDM660 is not set
+# CONFIG_PINCTRL_SDM845 is not set
+# CONFIG_PINCTRL_SM6350 is not set
+# CONFIG_PINCTRL_SM6375 is not set
+# CONFIG_PINCTRL_SM8150 is not set
+# CONFIG_PINCTRL_SM8250 is not set
+# CONFIG_PINCTRL_SM8450 is not set
+CONFIG_PM=y
+# CONFIG_PM8916_WATCHDOG is not set
+CONFIG_PM_CLK=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_PM_OPP=y
+CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y
+CONFIG_POWER_RESET=y
+# CONFIG_POWER_RESET_MSM is not set
+# CONFIG_POWER_RESET_QCOM_PON is not set
+CONFIG_POWER_SUPPLY=y
+CONFIG_PREEMPT_NONE_BUILD=y
+CONFIG_PRINTK_TIME=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+# CONFIG_QCM_DISPCC_2290 is not set
+# CONFIG_QCM_GCC_2290 is not set
+# CONFIG_QCOM_A53PLL is not set
+# CONFIG_QCOM_AOSS_QMP is not set
+CONFIG_QCOM_APCS_IPC=y
+CONFIG_QCOM_APM=y
+# CONFIG_QCOM_APR is not set
+CONFIG_QCOM_BAM_DMA=y
+# CONFIG_QCOM_CLK_APCC_MSM8996 is not set
+# CONFIG_QCOM_CLK_APCS_MSM8916 is not set
+# CONFIG_QCOM_CLK_APCS_SDX55 is not set
+# CONFIG_QCOM_COINCELL is not set
+# CONFIG_QCOM_COMMAND_DB is not set
+# CONFIG_QCOM_CPR is not set
+# CONFIG_QCOM_EBI2 is not set
+# CONFIG_QCOM_FASTRPC is not set
+CONFIG_QCOM_GDSC=y
+# CONFIG_QCOM_GENI_SE is not set
+# CONFIG_QCOM_GSBI is not set
+# CONFIG_QCOM_HFPLL is not set
+# CONFIG_QCOM_ICC_BWMON is not set
+# CONFIG_QCOM_IPCC is not set
+# CONFIG_QCOM_LLCC is not set
+CONFIG_QCOM_MDT_LOADER=y
+# CONFIG_QCOM_MPM is not set
+# CONFIG_QCOM_OCMEM is not set
+# CONFIG_QCOM_PDC is not set
+CONFIG_QCOM_PIL_INFO=y
+# CONFIG_QCOM_Q6V5_ADSP is not set
+CONFIG_QCOM_Q6V5_COMMON=y
+# CONFIG_QCOM_Q6V5_MSS is not set
+# CONFIG_QCOM_Q6V5_PAS is not set
+CONFIG_QCOM_Q6V5_WCSS=y
+# CONFIG_QCOM_RMTFS_MEM is not set
+# CONFIG_QCOM_RPMH is not set
+CONFIG_QCOM_RPROC_COMMON=y
+CONFIG_QCOM_SCM=y
+# CONFIG_QCOM_SCM_DOWNLOAD_MODE_DEFAULT is not set
+# CONFIG_QCOM_SMD_RPM is not set
+CONFIG_QCOM_SMEM=y
+CONFIG_QCOM_SMEM_STATE=y
+CONFIG_QCOM_SMP2P=y
+# CONFIG_QCOM_SMSM is not set
+CONFIG_QCOM_SOCINFO=y
+# CONFIG_QCOM_SPM is not set
+CONFIG_QCOM_SPMI_ADC5=y
+# CONFIG_QCOM_SPMI_RRADC is not set
+# CONFIG_QCOM_STATS is not set
+# CONFIG_QCOM_SYSMON is not set
+CONFIG_QCOM_TSENS=y
+CONFIG_QCOM_VADC_COMMON=y
+# CONFIG_QCOM_WCNSS_CTRL is not set
+# CONFIG_QCOM_WCNSS_PIL is not set
+CONFIG_QCOM_WDT=y
+# CONFIG_QCS_GCC_404 is not set
+# CONFIG_QCS_Q6SSTOP_404 is not set
+# CONFIG_QCS_TURING_404 is not set
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RANDSTRUCT_NONE=y
+CONFIG_RAS=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGMAP_SPMI=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_CPR3=y
+# CONFIG_REGULATOR_CPR3_NPU is not set
+CONFIG_REGULATOR_CPR4_APSS=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+# CONFIG_REGULATOR_QCOM_LABIBB is not set
+CONFIG_REGULATOR_QCOM_SPMI=y
+# CONFIG_REGULATOR_QCOM_USB_VBUS is not set
+# CONFIG_REGULATOR_VQMMC_IPQ4019 is not set
+CONFIG_RELOCATABLE=y
+CONFIG_REMOTEPROC=y
+CONFIG_REMOTEPROC_CDEV=y
+CONFIG_RESET_CONTROLLER=y
+# CONFIG_RESET_QCOM_AOSS is not set
+# CONFIG_RESET_QCOM_PDC is not set
+CONFIG_RFS_ACCEL=y
+CONFIG_RODATA_FULL_DEFAULT_ENABLED=y
+CONFIG_RPMSG=y
+CONFIG_RPMSG_CHAR=y
+# CONFIG_RPMSG_CTRL is not set
+# CONFIG_RPMSG_NS is not set
+CONFIG_RPMSG_QCOM_GLINK=y
+CONFIG_RPMSG_QCOM_GLINK_RPM=y
+CONFIG_RPMSG_QCOM_GLINK_SMEM=y
+CONFIG_RPMSG_QCOM_SMD=y
+# CONFIG_RPMSG_TTY is not set
+CONFIG_RPS=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_PM8XXX=y
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+# CONFIG_SCHED_CORE is not set
+CONFIG_SCHED_MC=y
+CONFIG_SCHED_SMT=y
+CONFIG_SCHED_THERMAL_PRESSURE=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+# CONFIG_SCSI_LOWLEVEL is not set
+# CONFIG_SCSI_PROC_FS is not set
+# CONFIG_SC_CAMCC_7280 is not set
+# CONFIG_SC_DISPCC_7180 is not set
+# CONFIG_SC_GCC_7180 is not set
+# CONFIG_SC_GCC_8280XP is not set
+# CONFIG_SC_GPUCC_7180 is not set
+# CONFIG_SC_LPASSCC_7280 is not set
+# CONFIG_SC_LPASS_CORECC_7180 is not set
+# CONFIG_SC_LPASS_CORECC_7280 is not set
+# CONFIG_SC_MSS_7180 is not set
+# CONFIG_SC_VIDEOCC_7180 is not set
+# CONFIG_SDM_CAMCC_845 is not set
+# CONFIG_SDM_DISPCC_845 is not set
+# CONFIG_SDM_GCC_660 is not set
+# CONFIG_SDM_GCC_845 is not set
+# CONFIG_SDM_GPUCC_845 is not set
+# CONFIG_SDM_LPASSCC_845 is not set
+# CONFIG_SDM_VIDEOCC_845 is not set
+# CONFIG_SDX_GCC_65 is not set
+CONFIG_SERIAL_8250_FSL=y
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_MSM=y
+CONFIG_SERIAL_MSM_CONSOLE=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SG_POOL=y
+CONFIG_SMP=y
+# CONFIG_SM_CAMCC_8450 is not set
+# CONFIG_SM_GCC_8150 is not set
+# CONFIG_SM_GCC_8250 is not set
+# CONFIG_SM_GCC_8450 is not set
+# CONFIG_SM_GPUCC_6350 is not set
+# CONFIG_SM_GPUCC_8150 is not set
+# CONFIG_SM_GPUCC_8250 is not set
+# CONFIG_SM_GPUCC_8350 is not set
+# CONFIG_SM_VIDEOCC_8150 is not set
+# CONFIG_SM_VIDEOCC_8250 is not set
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOC_BUS=y
+CONFIG_SOFTIRQ_ON_OWN_STACK=y
+CONFIG_SPARSEMEM=y
+CONFIG_SPARSEMEM_EXTREME=y
+CONFIG_SPARSEMEM_VMEMMAP=y
+CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SPI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SPI_QUP=y
+CONFIG_SPMI=y
+# CONFIG_SPMI_HISI3670 is not set
+CONFIG_SPMI_MSM_PMIC_ARB=y
+# CONFIG_SPMI_PMIC_CLKDIV is not set
+CONFIG_SRCU=y
+CONFIG_SWIOTLB=y
+CONFIG_SWPHY=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_THERMAL=y
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_GOV_STEP_WISE=y
+CONFIG_THERMAL_OF=y
+CONFIG_THREAD_INFO_IN_TASK=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UBIFS_FS=y
+CONFIG_UBIFS_FS_ADVANCED_COMPR=y
+# CONFIG_UCLAMP_TASK is not set
+CONFIG_UNMAP_KERNEL_AT_EL0=y
+CONFIG_USB=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_SUPPORT=y
+CONFIG_VIRTIO=y
+CONFIG_VIRTIO_ANCHOR=y
+# CONFIG_VIRTIO_BLK is not set
+# CONFIG_VIRTIO_NET is not set
+CONFIG_VMAP_STACK=y
+CONFIG_WANT_DEV_COREDUMP=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_WATCHDOG_SYSFS=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZONE_DMA32=y
+CONFIG_ZSTD_COMMON=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8070-cax1800.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8070-cax1800.dts
new file mode 100644
index 00000000000000..2c9cbd5b3cd3ca
--- /dev/null
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8070-cax1800.dts
@@ -0,0 +1,322 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/* Copyright (c) 2021, Dirk Buchwalder <buchwalder@posteo.de> */
+
+/dts-v1/;
+
+#include "ipq8074-512m.dtsi"
+#include "ipq8074-ac-cpu.dtsi"
+#include "ipq8074-ess.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Edimax CAX1800";
+	compatible = "edimax,cax1800", "qcom,ipq8074";
+
+	aliases {
+		serial0 = &blsp1_uart5;
+		led-boot = &led_system_red;
+		led-failsafe = &led_system_red;
+		led-running = &led_system_green;
+		led-upgrade = &led_system_red;
+		/* Aliases as required by u-boot to patch MAC addresses */
+		ethernet0 = &dp5;
+		label-mac-device = &dp5;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs-append = " root=/dev/ubiblock0_1";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 32 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_system_red: system-red {
+			label = "red:system";
+			gpios = <&tlmm 25 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_system_green: system-green {
+			label = "green:system";
+			gpios = <&tlmm 26 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_system_blue: system-blue {
+			label = "blue:system";
+			gpios = <&tlmm 27 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&tlmm {
+	mdio_pins: mdio-pins {
+		mdc {
+			pins = "gpio68";
+			function = "mdc";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		mdio {
+			pins = "gpio69";
+			function = "mdio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+};
+
+&blsp1_uart5 {
+	status = "okay";
+};
+
+&prng {
+	status = "okay";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&qpic_nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		nand-ecc-strength = <4>;
+		nand-ecc-step-size = <512>;
+		nand-bus-width = <8>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "rootfs";
+				reg = <0x0000000 0x3400000>;
+			};
+		};
+	};
+};
+
+&blsp1_spi1 {
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+	cs-select = <0>;
+	status = "ok";
+
+	m25p80@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+		compatible = "jedec,spi-nor";
+		spi-max-frequency = <50000000>;
+		use-default-sizes;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "0:sbl1";
+				reg = <0x0 0x50000>;
+				read-only;
+			};
+
+			partition@50000 {
+				label = "0:mibib";
+				reg = <0x50000 0x10000>;
+				read-only;
+			};
+
+			partition@60000 {
+				label = "0:bootconfig";
+				reg = <0x60000 0x20000>;
+				read-only;
+			};
+
+			partition@80000 {
+				label = "0:bootconfig1";
+				reg = <0x80000 0x20000>;
+				read-only;
+			};
+
+			partition@a0000 {
+				label = "0:qsee";
+				reg = <0xa0000 0x180000>;
+				read-only;
+			};
+
+			partition@220000 {
+				label = "0:qsee_1";
+				reg = <0x220000 0x180000>;
+				read-only;
+			};
+
+			partition@3a0000 {
+				label = "0:devcfg";
+				reg = <0x3a0000 0x10000>;
+				read-only;
+			};
+
+			partition@3b0000 {
+				label = "0:devcfg_1";
+				reg = <0x3b0000 0x10000>;
+				read-only;
+			};
+
+			partition@3c0000 {
+				label = "0:apdp";
+				reg = <0x3c0000 0x10000>;
+				read-only;
+			};
+
+			partition@3d0000 {
+				label = "0:apdp_1";
+				reg = <0x3d0000 0x10000>;
+				read-only;
+			};
+
+			partition@3e0000 {
+				label = "0:rpm";
+				reg = <0x3e0000 0x40000>;
+				read-only;
+			};
+
+			partition@420000 {
+				label = "0:rpm_1";
+				reg = <0x420000 0x40000>;
+				read-only;
+			};
+
+			partition@460000 {
+				label = "0:cdt";
+				reg = <0x460000 0x10000>;
+				read-only;
+			};
+
+			partition@470000 {
+				label = "0:cdt_1";
+				reg = <0x470000 0x10000>;
+				read-only;
+			};
+
+			partition@480000 {
+				label = "0:appsblenv";
+				reg = <0x480000 0x10000>;
+			};
+
+			partition@490000 {
+				label = "0:appsbl";
+				reg = <0x490000 0xa0000>;
+				read-only;
+			};
+
+			partition@530000 {
+				label = "0:appsbl_1";
+				reg = <0x530000 0xa0000>;
+				read-only;
+			};
+
+			partition@5d0000 {
+				label = "0:art";
+				reg = <0x5d0000 0x40000>;
+				read-only;
+			};
+
+			partition@610000 {
+				label = "0:ethphyfw";
+				reg = <0x610000 0x80000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&mdio {
+	status = "okay";
+
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+
+	reset-gpios = <&tlmm 37 GPIO_ACTIVE_LOW>;
+
+	qca8075: ethernet-phy@4 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <4>;
+	};
+};
+
+&switch {
+	status = "okay";
+
+	switch_cpu_bmp = <0x1>;  /* cpu port bitmap */
+	switch_lan_bmp = <0x1e>; /* lan port bitmap */
+	switch_wan_bmp = <0x20>; /* wan port bitmap */
+	switch_mac_mode = <0x0>; /* mac mode for uniphy instance0*/
+	switch_mac_mode1 = <0xff>; /* mac mode for uniphy instance1*/
+	switch_mac_mode2 = <0xff>; /* mac mode for uniphy instance2*/
+	bm_tick_mode = <0>; /* bm tick mode */
+	tm_tick_mode = <0>; /* tm tick mode */
+
+	qcom,port_phyinfo {
+		port@0 {
+			port_id = <1>;
+			phy_address = <0>;
+		};
+		port@1 {
+			port_id = <2>;
+			phy_address = <1>;
+		};
+		port@2 {
+			port_id = <3>;
+			phy_address = <2>;
+		};
+		port@3 {
+			port_id = <4>;
+			phy_address = <3>;
+		};
+		port@4 {
+			port_id = <5>;
+			phy_address = <4>;
+		};
+	};
+};
+
+&edma {
+	status = "okay";
+};
+
+&dp5 {
+	status = "okay";
+	phy-handle = <&qca8075>;
+	label = "lan";
+};
+
+&wifi {
+	status = "okay";
+
+	qcom,ath11k-calibration-variant = "Edimax-CAX1800";
+	qcom,ath11k-fw-memory-mode = <1>;
+};
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dts
new file mode 100644
index 00000000000000..f3e82e22511875
--- /dev/null
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dts
@@ -0,0 +1,73 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/* Copyright (c) 2021, Robert Marko <robimarko@gmail.com> */
+
+/dts-v1/;
+
+#include "ipq8071-ax3600.dtsi"
+
+/ {
+	model = "Xiaomi AX3600";
+	compatible = "xiaomi,ax3600", "qcom,ipq8074";
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_system_blue: system-blue {
+			label = "blue:system";
+			gpios = <&tlmm 42 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_system_yellow: system-yellow {
+			label = "yellow:system";
+			gpios = <&tlmm 43 GPIO_ACTIVE_HIGH>;
+		};
+
+		network-yellow {
+			label = "yellow:network";
+			gpios = <&tlmm 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		network-blue {
+			label = "blue:network";
+			gpios = <&tlmm 21 GPIO_ACTIVE_HIGH>;
+		};
+
+		aiot {
+			label = "blue:aiot";
+			gpios = <&tlmm 51 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy0tpt";
+		};
+	};
+};
+
+&pcie_qmp0 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+
+	perst-gpio = <&tlmm 52 GPIO_ACTIVE_HIGH>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi0: wifi@1,0 {
+			status = "okay";
+
+			compatible = "qcom,ath10k";
+			reg = <0x00010000 0 0 0 0>;
+
+			qcom,ath10k-calibration-variant = "Xiaomi-AX3600";
+			nvmem-cell-names = "calibration";
+			nvmem-cells = <&caldata_qca9889>;
+		};
+	};
+};
+
+&wifi {
+	qcom,ath11k-calibration-variant = "Xiaomi-AX3600";
+};
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dtsi b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dtsi
new file mode 100644
index 00000000000000..c18cef52f39d8b
--- /dev/null
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dtsi
@@ -0,0 +1,311 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/* Copyright (c) 2021, Robert Marko <robimarko@gmail.com> */
+
+#include "ipq8074-512m.dtsi"
+#include "ipq8074-ac-cpu.dtsi"
+#include "ipq8074-ess.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	aliases {
+		serial0 = &blsp1_uart5;
+		led-boot = &led_system_yellow;
+		led-failsafe = &led_system_yellow;
+		led-running = &led_system_blue;
+		led-upgrade = &led_system_yellow;
+		label-mac-device = &dp2;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs-append = " root=/dev/ubiblock0_0";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 34 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+};
+
+&tlmm {
+	mdio_pins: mdio-pins {
+		mdc {
+			pins = "gpio68";
+			function = "mdc";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		mdio {
+			pins = "gpio69";
+			function = "mdio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+};
+
+&blsp1_uart5 {
+	status = "okay";
+};
+
+&prng {
+	status = "okay";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&qpic_nand {
+	status = "okay";
+
+	/*
+	 * Bootloader will find the NAND DT node by the compatible and
+	 * then "fixup" it by adding the partitions from the SMEM table
+	 * using the legacy bindings thus making it impossible for us
+	 * to change the partition table or utilize NVMEM for calibration.
+	 * So add a dummy partitions node that bootloader will populate
+	 * and set it as disabled so the kernel ignores it instead of
+	 * printing warnings due to the broken way bootloader adds the
+	 * partitions.
+	 */
+	partitions {
+		status = "disabled";
+	};
+
+	nand@0 {
+		reg = <0>;
+		nand-ecc-strength = <4>;
+		nand-ecc-step-size = <512>;
+		nand-bus-width = <8>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "0:sbl1";
+				reg = <0x0 0x100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "0:mibib";
+				reg = <0x100000 0x100000>;
+				read-only;
+			};
+
+			partition@200000 {
+				label = "0:qsee";
+				reg = <0x200000 0x300000>;
+				read-only;
+			};
+
+			partition@500000 {
+				label = "0:devcfg";
+				reg = <0x500000 0x80000>;
+				read-only;
+			};
+
+			partition@580000 {
+				label = "0:rpm";
+				reg = <0x580000 0x80000>;
+				read-only;
+			};
+
+			partition@600000 {
+				label = "0:cdt";
+				reg = <0x600000 0x80000>;
+				read-only;
+			};
+
+			partition@680000 {
+				label = "0:appsblenv";
+				reg = <0x680000 0x80000>;
+			};
+
+			partition@700000 {
+				label = "0:appsbl";
+				reg = <0x700000 0x100000>;
+				read-only;
+			};
+
+			partition@800000 {
+				label = "0:art";
+				reg = <0x800000 0x80000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_dp2: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+
+				macaddr_dp3: macaddr@c {
+					reg = <0xc 0x6>;
+				};
+
+				macaddr_dp4: macaddr@12 {
+					reg = <0x12 0x6>;
+				};
+
+				macaddr_dp5: macaddr@18 {
+					reg = <0x18 0x6>;
+				};
+
+				caldata_qca9889: caldata@4d000 {
+					reg = <0x33000 0x844>;
+				};
+			};
+
+			partition@880000 {
+				label = "bdata";
+				reg = <0x880000 0x80000>;
+			};
+
+			partition@900000 {
+				/* This is crash + crash_syslog parts combined */
+				label = "pstore";
+				reg = <0x900000 0x100000>;
+			};
+
+			/* Make the first rootfs a dedicated ubi partition for kernel */
+			partition@a00000 {
+				label = "ubi_kernel";
+				reg = <0xa00000 0x23c0000>;
+			};
+
+			/* Place the real rootfs in the original second rootfs and
+			 * expand it to the end of the nand
+			 */
+			rootfs: partition@2dc0000 {
+				label = "rootfs";
+				reg = <0x2dc0000 0xd240000>;
+			};
+		};
+	};
+};
+
+&mdio {
+	status = "okay";
+
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	reset-gpios = <&tlmm 37 GPIO_ACTIVE_LOW>;
+
+	qca8075_1: ethernet-phy@1 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <1>;
+	};
+
+	qca8075_2: ethernet-phy@2 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <2>;
+	};
+
+	qca8075_3: ethernet-phy@3 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <3>;
+	};
+
+	qca8075_4: ethernet-phy@4 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <4>;
+	};
+};
+
+&switch {
+	status = "okay";
+
+	switch_cpu_bmp = <0x1>;  /* cpu port bitmap */
+	switch_lan_bmp = <0x1e>; /* lan port bitmap */
+	switch_wan_bmp = <0x20>; /* wan port bitmap */
+	switch_mac_mode = <0x0>; /* mac mode for uniphy instance0*/
+	switch_mac_mode1 = <0xff>; /* mac mode for uniphy instance1*/
+	switch_mac_mode2 = <0xff>; /* mac mode for uniphy instance2*/
+	bm_tick_mode = <0>; /* bm tick mode */
+	tm_tick_mode = <0>; /* tm tick mode */
+
+	qcom,port_phyinfo {
+		port@0 {
+			port_id = <1>;
+			phy_address = <0>;
+		};
+		port@1 {
+			port_id = <2>;
+			phy_address = <1>;
+		};
+		port@2 {
+			port_id = <3>;
+			phy_address = <2>;
+		};
+		port@3 {
+			port_id = <4>;
+			phy_address = <3>;
+		};
+		port@4 {
+			port_id = <5>;
+			phy_address = <4>;
+		};
+	};
+};
+
+&edma {
+	status = "okay";
+};
+
+&dp2 {
+	status = "okay";
+	phy-handle = <&qca8075_1>;
+	label = "wan";
+	nvmem-cells = <&macaddr_dp2>;
+	nvmem-cell-names = "mac-address";
+};
+
+&dp3 {
+	status = "okay";
+	phy-handle = <&qca8075_2>;
+	label = "lan1";
+	nvmem-cells = <&macaddr_dp3>;
+	nvmem-cell-names = "mac-address";
+};
+
+&dp4 {
+	status = "okay";
+	phy-handle = <&qca8075_3>;
+	label = "lan2";
+	nvmem-cells = <&macaddr_dp4>;
+	nvmem-cell-names = "mac-address";
+};
+
+&dp5 {
+	status = "okay";
+	phy-handle = <&qca8075_4>;
+	label = "lan3";
+	nvmem-cells = <&macaddr_dp5>;
+	nvmem-cell-names = "mac-address";
+};
+
+&wifi {
+	status = "okay";
+
+	qcom,ath11k-fw-memory-mode = <1>;
+};
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-ax6.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-ax6.dts
new file mode 100644
index 00000000000000..6611a8fe27a2b3
--- /dev/null
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-ax6.dts
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/* Copyright (c) 2021, Zhijun You <hujy652@gmail.com> */
+
+/dts-v1/;
+
+#include "ipq8071-ax3600.dtsi"
+
+/ {
+	model = "Redmi AX6";
+	compatible = "redmi,ax6", "qcom,ipq8074";
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_system_blue: system-blue {
+			label = "blue:system";
+			gpios = <&tlmm 21 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_system_yellow: system-yellow {
+			label = "yellow:system";
+			gpios = <&tlmm 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		network-blue {
+			label = "blue:network";
+			gpios = <&tlmm 42 GPIO_ACTIVE_HIGH>;
+		};
+
+		network-yellow {
+			label = "yellow:network";
+			gpios = <&tlmm 43 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+/* AX6 can both have NAND of 256MiB or 128MiB.
+ * To be on the safe side, assume 128MiB of NAND.
+ */
+&rootfs {
+	reg = <0x2dc0000 0x5220000>;
+};
+
+&wifi {
+	qcom,ath11k-calibration-variant = "Redmi-AX6";
+};
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-eap102.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-eap102.dts
new file mode 100644
index 00000000000000..357b6368d9dc55
--- /dev/null
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-eap102.dts
@@ -0,0 +1,389 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/* Copyright (c) 2022, Matthew Hagan <mnhagan88@gmail.com> */
+
+/dts-v1/;
+
+#include "ipq8074.dtsi"
+#include "ipq8074-ac-cpu.dtsi"
+#include "ipq8074-ess.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Edgecore EAP102";
+	compatible = "edgecore,eap102", "qcom,ipq8074";
+
+	aliases {
+		serial0 = &blsp1_uart5;
+		serial1 = &blsp1_uart3;
+		led-boot = &led_system_green;
+		led-failsafe = &led_system_green;
+		led-running = &led_system_green;
+		led-upgrade = &led_system_green;
+		/* Aliases as required by u-boot to patch MAC addresses */
+		ethernet0 = &dp5;
+		ethernet1 = &dp6;
+		label-mac-device = &dp5;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs-append = " root=/dev/ubiblock0_1";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 66 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_wanpoe {
+			label = "green:wanpoe";
+			gpios = <&tlmm 46 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_wlan2g {
+			label = "green:wlan2g";
+			gpio = <&tlmm 47 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy1radio";
+		};
+
+		led_wlan5g {
+			label = "green:wlan5g";
+			gpio = <&tlmm 48 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy0radio";
+		};
+
+		led_system_green: led_system {
+			label = "green:power";
+			gpios = <&tlmm 50 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&tlmm {
+	mdio_pins: mdio-pins {
+		mdc {
+			pins = "gpio68";
+			function = "mdc";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		mdio {
+			pins = "gpio69";
+			function = "mdio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+
+	button_pins: button_pins {
+		reset_button {
+			pins = "gpio66";
+			function = "gpio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+};
+
+&blsp1_spi1 {
+	status = "okay";
+
+	flash@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+		compatible = "jedec,spi-nor";
+		spi-max-frequency = <50000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "0:sbl1";
+				reg = <0x0 0x50000>;
+				read-only;
+			};
+
+			partition@50000 {
+				label = "0:mibib";
+				reg = <0x50000 0x10000>;
+				read-only;
+			};
+
+			partition@60000 {
+				label = "0:bootconfig";
+				reg = <0x60000 0x20000>;
+				read-only;
+			};
+
+			partition@80000 {
+				label = "0:bootconfig1";
+				reg = <0x80000 0x20000>;
+				read-only;
+			};
+
+			partition@a0000 {
+				label = "0:qsee";
+				reg = <0xa0000 0x180000>;
+				read-only;
+			};
+
+			partition@220000 {
+				label = "0:qsee_1";
+				reg = <0x220000 0x180000>;
+				read-only;
+			};
+
+			partition@3a0000 {
+				label = "0:devcfg";
+				reg = <0x3a0000 0x10000>;
+				read-only;
+			};
+
+			partition@3b0000 {
+				label = "0:devcfg_1";
+				reg = <0x3b0000 0x10000>;
+				read-only;
+			};
+
+			partition@3c0000 {
+				label = "0:apdp";
+				reg = <0x3c0000 0x10000>;
+				read-only;
+			};
+
+			partition@3d0000 {
+				label = "0:apdp_1";
+				reg = <0x3d0000 0x10000>;
+				read-only;
+			};
+
+			partition@3e0000 {
+				label = "0:rpm";
+				reg = <0x3e0000 0x40000>;
+				read-only;
+			};
+
+			partition@420000 {
+				label = "0:rpm_1";
+				reg = <0x420000 0x40000>;
+				read-only;
+			};
+
+			partition@460000 {
+				label = "0:cdt";
+				reg = <0x460000 0x10000>;
+				read-only;
+			};
+
+			partition@470000 {
+				label = "0:cdt_1";
+				reg = <0x470000 0x10000>;
+				read-only;
+			};
+
+			partition@480000 {
+				label = "0:appsblenv";
+				reg = <0x480000 0x10000>;
+			};
+
+			partition@490000 {
+				label = "0:appsbl";
+				reg = <0x490000 0xc0000>;
+				read-only;
+			};
+
+			partition@550000 {
+				label = "0:appsbl_1";
+				reg = <0x530000 0xc0000>;
+				read-only;
+			};
+
+			partition@610000 {
+				label = "0:art";
+				reg = <0x610000 0x40000>;
+				read-only;
+			};
+
+			partition@650000 {
+				label = "0:ethphyfw";
+				reg = <0x650000 0x80000>;
+				read-only;
+			};
+
+			partition@6d0000 {
+				label = "0:product_info";
+				reg = <0x6d0000 0x80000>;
+				read-only;
+			};
+
+			partition@750000 {
+				label = "priv_data1";
+				reg = <0x750000 0x10000>;
+				read-only;
+			};
+
+			partition@760000 {
+				label = "priv_data2";
+				reg = <0x760000 0x10000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&blsp1_uart3 {
+	status = "okay";
+};
+
+&blsp1_uart5 {
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&prng {
+	status = "okay";
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&qusb_phy_0 {
+	status = "okay";
+};
+
+&ssphy_0 {
+	status = "okay";
+};
+
+&usb_0 {
+	status = "okay";
+};
+
+&qpic_nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		nand-ecc-strength = <8>;
+		nand-ecc-step-size = <512>;
+		nand-bus-width = <8>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "rootfs1";
+				reg = <0x0000000 0x3400000>;
+			};
+
+			partition@3400000 {
+				label = "0:wififw";
+				reg = <0x3400000 0x800000>;
+				read-only;
+			};
+
+			partition@3c00000 {
+				label = "rootfs2";
+				reg = <0x3c00000 0x3400000>;
+			};
+
+			partition@7000000 {
+				label = "0:wififw_1";
+				reg = <0x7000000 0x800000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&mdio {
+	status = "okay";
+
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+
+	qca8081_24: ethernet-phy@24 {
+		compatible = "ethernet-phy-id004d.d101";
+		reg = <24>;
+		reset-gpios = <&tlmm 33 GPIO_ACTIVE_LOW>;
+	};
+
+	qca8081_28: ethernet-phy@28 {
+		compatible = "ethernet-phy-id004d.d101";
+		reg = <28>;
+		reset-gpios = <&tlmm 44 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&switch {
+	status = "okay";
+
+	switch_cpu_bmp = <0x1>;  /* cpu port bitmap */
+	switch_lan_bmp = <0x3e>; /* lan port bitmap */
+	switch_wan_bmp = <0x40>; /* wan port bitmap */
+	switch_mac_mode = <0xff>; /* mac mode for uniphy instance0*/
+	switch_mac_mode1 = <0xf>; /* mac mode for uniphy instance1*/
+	switch_mac_mode2 = <0xf>; /* mac mode for uniphy instance2*/
+	bm_tick_mode = <0>; /* bm tick mode */
+	tm_tick_mode = <0>; /* tm tick mode */
+
+	qcom,port_phyinfo {
+		port@4 {
+			port_id = <5>;
+			phy_address = <24>;
+			port_mac_sel = "QGMAC_PORT";
+		};
+		port@5 {
+			port_id = <6>;
+			phy_address = <28>;
+			port_mac_sel = "QGMAC_PORT";
+		};
+	};
+};
+
+&edma {
+	status = "okay";
+};
+
+&dp5 {
+	status = "okay";
+	phy-handle = <&qca8081_28>;
+	label = "wan";
+};
+
+&dp6 {
+	status = "okay";
+	phy-handle = <&qca8081_24>;
+	label = "lan";
+};
+
+&wifi {
+	status = "okay";
+
+	qcom,ath11k-calibration-variant = "Edgecore-EAP102";
+};
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-301w.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-301w.dts
new file mode 100644
index 00000000000000..5521a480b8a35e
--- /dev/null
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-301w.dts
@@ -0,0 +1,410 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/* Copyright (c) 2021, Dirk Buchwalder <buchwalder@posteo.de> */
+
+/dts-v1/;
+
+#include "ipq8074.dtsi"
+#include "ipq8074-hk-cpu.dtsi"
+#include "ipq8074-ess.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	model = "QNAP 301w";
+	compatible = "qnap,301w", "qcom,ipq8074";
+
+	aliases {
+		serial0 = &blsp1_uart5;
+		/*
+		 * Aliases as required by u-boot
+		 * to patch MAC addresses
+		 */
+		led-boot = &led_system_red;
+		led-failsafe = &led_system_red;
+		led-running = &led_pwr_green;
+		led-upgrade = &led_system_red;
+		ethernet0 = &dp1;
+		ethernet1 = &dp2;
+		ethernet2 = &dp3;
+		ethernet3 = &dp4;
+		ethernet4 = &dp5;
+		ethernet5 = &dp6_syn;
+		label-mac-device = &dp1;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wps-button {
+			label = "wps";
+			gpios = <&tlmm 57 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+
+		reset-button {
+			label = "reset";
+			gpios = <&tlmm 67 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&leds_pins>;
+		pinctrl-names = "default";
+
+		led_system_green: led-system-green {
+			label = "green:system";
+			gpios = <&tlmm 1 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_GREEN>;
+		};
+
+		led_system_red: led-system-red {
+			label = "red:system";
+			gpios = <&tlmm 3 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_RED>;
+		};
+
+		led_pwr_green: led-pwr-green {
+			label = "green:pwr";
+			gpios = <&tlmm 4 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_GREEN>;
+		};
+
+		led-wifi-green {
+			label = "green:wifi";
+			gpios = <&tlmm 42 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_GREEN>;
+		};
+
+		led-lan4-green {
+			label = "green:lan4";
+			gpios = <&tlmm 6 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_GREEN>;
+		};
+
+		led-lan4-amber {
+			label = "amber:lan4";
+			gpios = <&tlmm 7 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_AMBER>;
+		};
+
+		led-lan3-green {
+			label = "green:lan3";
+			gpios = <&tlmm 8 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_GREEN>;
+		};
+
+		led-lan3-amber {
+			label = "amber:lan3";
+			gpios = <&tlmm 11 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_AMBER>;
+		};
+
+		led-lan2-green {
+			label = "green:lan2";
+			gpios = <&tlmm 12 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_GREEN>;
+		};
+
+		led-lan2-amber {
+			label = "amber:lan2";
+			gpios = <&tlmm 13 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_AMBER>;
+		};
+
+		led-lan1-green {
+			label = "green:lan1";
+			gpios = <&tlmm 14 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_GREEN>;
+		};
+
+		led-lan1-amber {
+			label = "amber:lan1";
+			gpios = <&tlmm 15 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_AMBER>;
+		};
+
+		led-10g-1-green {
+			label = "green:10g_1";
+			gpios = <&tlmm 54 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_GREEN>;
+		};
+
+		led-10g-1-amber {
+			label = "amber:10g_1";
+			gpios = <&tlmm 56 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_AMBER>;
+		};
+
+		led-10g-2-green {
+			label = "green:10g_2";
+			gpios = <&tlmm 51 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_GREEN>;
+		};
+
+		led-10g-2-amber {
+			label = "amber:10g_2";
+			gpios = <&tlmm 52 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_AMBER>;
+		};
+	};
+};
+
+&tlmm {
+
+	mdio_pins: mdio-state {
+		mdc-pins {
+			pins = "gpio68";
+			function = "mdc";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		mdio-pins {
+			pins = "gpio69";
+			function = "mdio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+
+	button_pins: button-state {
+		wps-pins {
+			pins = "gpio57";
+			function = "gpio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		rst-pins {
+			pins = "gpio67";
+			function = "gpio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+
+	leds_pins: leds-state {
+		pins = "gpio1", "gpio3", "gpio4", "gpio6", "gpio7", "gpio8",
+		       "gpio11", "gpio12", "gpio13", "gpio14", "gpio15", "gpio42",
+		       "gpio51", "gpio52", "gpio54", "gpio56";
+		function = "gpio";
+		drive-strength = <8>;
+		bias-pull-down;
+	};
+};
+
+&blsp1_uart5 {
+	status = "okay";
+};
+
+&prng {
+	status = "okay";
+};
+
+&ssphy_0 {
+	status = "okay";
+};
+
+&qusb_phy_0 {
+	status = "okay";
+};
+
+&ssphy_1 {
+	status = "okay";
+};
+
+&qusb_phy_1 {
+	status = "okay";
+};
+
+&usb_0 {
+	status = "okay";
+};
+
+&usb_1 {
+	status = "okay";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&blsp1_spi1 { /* BLSP1 QUP1 */
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+	cs-gpios = <0>;
+	status = "okay";
+
+	flash@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+		compatible = "jedec,spi-nor";
+		spi-max-frequency = <50000000>;
+
+		partitions {
+			compatible = "qcom,smem-part";
+		};
+	};
+};
+
+&mdio {
+	status = "okay";
+
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	reset-gpios = <&tlmm 37 GPIO_ACTIVE_LOW>;
+
+	aqr113c_0: ethernet-phy@0 {
+		compatible ="ethernet-phy-ieee802.3-c45";
+		reg = <0>;
+		reset-gpios = <&tlmm 59 GPIO_ACTIVE_LOW>;
+	};
+
+	aqr113c_8: ethernet-phy@8 {
+		compatible ="ethernet-phy-ieee802.3-c45";
+		reg = <8>;
+		reset-gpios = <&tlmm 44 GPIO_ACTIVE_LOW>;
+	};
+
+	qca8075_16: ethernet-phy@16 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <16>;
+	};
+
+	qca8075_17: ethernet-phy@17 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <17>;
+	};
+
+	qca8075_18: ethernet-phy@18 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <18>;
+	};
+
+	qca8075_19: ethernet-phy@19 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <19>;
+	};
+};
+
+&sdhc_1 {
+	status = "okay";
+
+	/* According to the stock dts from the QNAP gpl drop
+	 * the emmc has a problem with the hs400 > hs200 speed switch.
+	 * Therefore remove the mmc-hs400-1_8v property
+	*/
+	/delete-property/ mmc-hs400-1_8v;
+	mmc-hs200-1_8v;
+	mmc-ddr-1_8v;
+	vqmmc-supply = <&l11>;
+};
+
+&switch {
+	status = "okay";
+
+	switch_cpu_bmp = <0x1>;  /* cpu port bitmap */
+	switch_lan_bmp = <0x3e>; /* lan port bitmap */
+	switch_wan_bmp = <0xc0>; /* wan port bitmap */
+	switch_mac_mode = <0xb>; /* mac mode for uniphy instance0*/
+	switch_mac_mode1 = <0xd>; /* mac mode for uniphy instance1*/
+	switch_mac_mode2 = <0xd>; /* mac mode for uniphy instance2*/
+	bm_tick_mode = <0>; /* bm tick mode */
+	tm_tick_mode = <0>; /* tm tick mode */
+
+	qcom,port_phyinfo {
+		port@0 {
+			port_id = <1>;
+			phy_address = <16>;
+		};
+		port@1 {
+			port_id = <2>;
+			phy_address = <17>;
+		};
+		port@2 {
+			port_id = <3>;
+			phy_address = <18>;
+		};
+		port@3 {
+			port_id = <4>;
+			phy_address = <19>;
+		};
+		port@4 {
+			port_id = <5>;
+			phy_address = <8>;
+			compatible = "ethernet-phy-ieee802.3-c45";
+			ethernet-phy-ieee802.3-c45;
+		};
+		port@5 {
+			port_id = <6>;
+			phy_address = <0>;
+			compatible = "ethernet-phy-ieee802.3-c45";
+			ethernet-phy-ieee802.3-c45;
+		};
+	};
+};
+
+&edma {
+	status = "okay";
+};
+
+&dp1 {
+	status = "okay";
+	phy-handle = <&qca8075_16>;
+	label = "lan4";
+};
+
+&dp2 {
+	status = "okay";
+	phy-handle = <&qca8075_17>;
+	label = "lan3";
+};
+
+&dp3 {
+	status = "okay";
+	phy-handle = <&qca8075_18>;
+	label = "lan2";
+};
+
+&dp4 {
+	status = "okay";
+	phy-handle = <&qca8075_19>;
+	label = "lan1";
+};
+
+&dp5 {
+	status = "okay";
+	qcom,mactype = <1>;
+	phy-handle = <&aqr113c_8>;
+	label = "10g-1";
+};
+
+&dp6_syn {
+	status = "okay";
+	phy-handle = <&aqr113c_0>;
+	label = "10g-2";
+};
+
+&wifi {
+	status = "okay";
+
+	qcom,ath11k-calibration-variant = "QNAP-301w";
+};
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-ax9000.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-ax9000.dts
new file mode 100644
index 00000000000000..801aa056045f44
--- /dev/null
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-ax9000.dts
@@ -0,0 +1,522 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/* Copyright (c) 2021, Robert Marko <robimarko@gmail.com> */
+
+/dts-v1/;
+
+#include "ipq8074.dtsi"
+#include "ipq8074-hk-cpu.dtsi"
+#include "ipq8074-ess.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	model = "Xiaomi AX9000";
+	compatible = "xiaomi,ax9000", "qcom,ipq8074";
+
+	aliases {
+		serial0 = &blsp1_uart5;
+		led-boot = &led_system_yellow;
+		led-failsafe = &led_system_yellow;
+		led-running = &led_system_blue;
+		led-upgrade = &led_system_yellow;
+		label-mac-device = &dp5;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs-append = " root=/dev/ubiblock0_0";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 47 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps"; /* Labeled Mesh on the device */
+			gpios = <&tlmm 46 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_system_blue: system-blue {
+			label = "blue:system";
+			gpios = <&tlmm 48 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_BLUE>;
+		};
+
+		led_system_yellow: system-yellow {
+			label = "yellow:system";
+			gpios = <&tlmm 52 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_YELLOW>;
+		};
+
+		network-yellow {
+			label = "yellow:network";
+			gpios = <&tlmm 50 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_YELLOW>;
+		};
+
+		network-blue {
+			label = "blue:network";
+			gpios = <&tlmm 51 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_BLUE>;
+		};
+
+		top-red {
+			label = "red:top";
+			gpios = <&tlmm 63 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_RED>;
+			default-state = "keep";
+		};
+
+		top-green {
+			label = "green:top";
+			gpios = <&tlmm 64 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_GREEN>;
+			default-state = "keep";
+		};
+
+		top-blue {
+			label = "blue:top";
+			gpios = <&tlmm 66 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_BLUE>;
+			default-state = "keep";
+		};
+	};
+};
+
+&tlmm {
+	mdio_pins: mdio-pins {
+		mdc {
+			pins = "gpio68";
+			function = "mdc";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		mdio {
+			pins = "gpio69";
+			function = "mdio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+
+	i2c_pins: i2c-pins {
+		pins = "gpio0", "gpio2";
+		function = "blsp5_i2c";
+		drive-strength = <8>;
+		bias-disable;
+	};
+};
+
+&blsp1_uart5 {
+	status = "okay";
+};
+
+&blsp1_i2c6 {
+	status = "okay";
+
+	pinctrl-0 = <&i2c_pins>;
+	pinctrl-names = "default";
+};
+
+&prng {
+	status = "okay";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&qpic_nand {
+	status = "okay";
+
+	/*
+	 * Bootloader will find the NAND DT node by the compatible and
+	 * then "fixup" it by adding the partitions from the SMEM table
+	 * using the legacy bindings thus making it impossible for us
+	 * to change the partition table or utilize NVMEM for calibration.
+	 * So add a dummy partitions node that bootloader will populate
+	 * and set it as disabled so the kernel ignores it instead of
+	 * printing warnings due to the broken way bootloader adds the
+	 * partitions.
+	 */
+	partitions {
+		status = "disabled";
+	};
+
+	nand@0 {
+		reg = <0>;
+		nand-ecc-strength = <4>;
+		nand-ecc-step-size = <512>;
+		nand-bus-width = <8>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "0:sbl1";
+				reg = <0x0 0x100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "0:mibib";
+				reg = <0x100000 0x100000>;
+				read-only;
+			};
+
+			partition@200000 {
+				label = "0:bootconfig";
+				reg = <0x200000 0x80000>;
+				read-only;
+			};
+
+			partition@280000 {
+				label = "0:bootconfig1";
+				reg = <0x280000 0x80000>;
+				read-only;
+			};
+
+			partition@300000 {
+				label = "0:qsee";
+				reg = <0x300000 0x300000>;
+				read-only;
+			};
+
+			partition@600000 {
+				label = "0:qsee_1";
+				reg = <0x600000 0x300000>;
+				read-only;
+			};
+
+			partition@900000 {
+				label = "0:devcfg";
+				reg = <0x900000 0x80000>;
+				read-only;
+			};
+
+			partition@980000 {
+				label = "0:devcfg_1";
+				reg = <0x980000 0x80000>;
+				read-only;
+			};
+
+			partition@a00000 {
+				label = "0:apdp";
+				reg = <0xa00000 0x80000>;
+				read-only;
+			};
+
+			partition@a80000 {
+				label = "0:apdp_1";
+				reg = <0xa80000 0x80000>;
+				read-only;
+			};
+
+			partition@b00000 {
+				label = "0:rpm";
+				reg = <0xb00000 0x80000>;
+				read-only;
+			};
+
+			partition@b80000 {
+				label = "0:rpm_1";
+				reg = <0xb80000 0x80000>;
+				read-only;
+			};
+
+			partition@c00000 {
+				label = "0:cdt";
+				reg = <0xc00000 0x80000>;
+				read-only;
+			};
+
+			partition@c80000 {
+				label = "0:cdt_1";
+				reg = <0xc80000 0x80000>;
+				read-only;
+			};
+
+			partition@d00000 {
+				label = "0:appsblenv";
+				reg = <0xd00000 0x80000>;
+			};
+
+			partition@d80000 {
+				label = "0:appsbl";
+				reg = <0xd80000 0x100000>;
+				read-only;
+			};
+
+			partition@e80000 {
+				label = "0:appsbl_1";
+				reg = <0xe80000 0x100000>;
+				read-only;
+			};
+
+			partition@f80000 {
+				label = "0:art";
+				reg = <0xf80000 0x80000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_dp1: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_dp2: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+
+				macaddr_dp3: macaddr@c {
+					reg = <0xc 0x6>;
+				};
+
+				macaddr_dp4: macaddr@12 {
+					reg = <0x12 0x6>;
+				};
+
+				macaddr_dp5: macaddr@18 {
+					reg = <0x18 0x6>;
+				};
+
+				caldata_qca9889: caldata@4d000 {
+					reg = <0x4d000 0x844>;
+				};
+			};
+
+			partition@1000000 {
+				label = "bdata";
+				reg = <0x1000000 0x80000>;
+			};
+
+			partition@1080000 {
+				/* This is crash + crash_syslog parts combined */
+				label = "pstore";
+				reg = <0x1080000 0x100000>;
+			};
+
+			partition@1180000 {
+				label = "ubi_kernel";
+				reg = <0x1180000 0x3800000>;
+			};
+
+			partition@4980000 {
+				label = "rootfs";
+				reg = <0x4980000 0xb680000>;
+			};
+		};
+	};
+};
+
+&qusb_phy_0 {
+	status = "okay";
+};
+
+&ssphy_0 {
+	status = "okay";
+};
+
+&usb_0 {
+	status = "okay";
+};
+
+&mdio {
+	status = "okay";
+
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	reset-gpios = <&tlmm 37 GPIO_ACTIVE_LOW>;
+
+	qca8075_0: ethernet-phy@0 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <0>;
+	};
+
+	qca8075_1: ethernet-phy@1 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <1>;
+	};
+
+	qca8075_2: ethernet-phy@2 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <2>;
+	};
+
+	qca8075_3: ethernet-phy@3 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <3>;
+	};
+
+	qca8081: ethernet-phy@24 {
+		compatible = "ethernet-phy-id004d.d101";
+		reg = <24>;
+		reset-gpios = <&tlmm 44 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&switch {
+	status = "okay";
+
+	switch_cpu_bmp = <0x1>;  /* cpu port bitmap */
+	switch_lan_bmp = <0x1e>; /* lan port bitmap */
+	switch_wan_bmp = <0x20>; /* wan port bitmap */
+	switch_mac_mode = <0xb>; /* mac mode for uniphy instance0*/
+	switch_mac_mode1 = <0xc>; /* mac mode for uniphy instance1*/
+	switch_mac_mode2 = <0xff>; /* mac mode for uniphy instance2*/
+	bm_tick_mode = <0>; /* bm tick mode */
+	tm_tick_mode = <0>; /* tm tick mode */
+
+	qcom,port_phyinfo {
+		port@0 {
+			port_id = <1>;
+			phy_address = <0>;
+		};
+		port@1 {
+			port_id = <2>;
+			phy_address = <1>;
+		};
+		port@2 {
+			port_id = <3>;
+			phy_address = <2>;
+		};
+		port@3 {
+			port_id = <4>;
+			phy_address = <3>;
+		};
+		port@4 {
+			port_id = <5>;
+			phy_address = <24>;
+			port_mac_sel = "QGMAC_PORT";
+		};
+	};
+};
+
+&edma {
+	status = "okay";
+};
+
+&dp1 {
+	status = "okay";
+	phy-handle = <&qca8075_0>;
+	label = "lan4";
+	nvmem-cells = <&macaddr_dp1>;
+	nvmem-cell-names = "mac-address";
+};
+
+&dp2 {
+	status = "okay";
+	phy-handle = <&qca8075_1>;
+	label = "lan3";
+	nvmem-cells = <&macaddr_dp2>;
+	nvmem-cell-names = "mac-address";
+};
+
+&dp3 {
+	status = "okay";
+	phy-handle = <&qca8075_2>;
+	label = "lan2";
+	nvmem-cells = <&macaddr_dp3>;
+	nvmem-cell-names = "mac-address";
+};
+
+&dp4 {
+	status = "okay";
+	phy-handle = <&qca8075_3>;
+	label = "lan1";
+	nvmem-cells = <&macaddr_dp4>;
+	nvmem-cell-names = "mac-address";
+};
+
+&dp5 {
+	status = "okay";
+	phy-handle = <&qca8081>;
+	label = "wan";
+	nvmem-cells = <&macaddr_dp5>;
+	nvmem-cell-names = "mac-address";
+};
+
+&pcie_qmp0 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+
+	perst-gpio = <&tlmm 58 GPIO_ACTIVE_LOW>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			status = "okay";
+
+			/* ath11k has no DT compatible for PCI cards */
+			compatible = "pci17cb,1104";
+			reg = <0x00010000 0 0 0 0>;
+
+			qcom,ath11k-calibration-variant = "Xiaomi-AX9000";
+		};
+	};
+};
+
+&pcie_qmp1 {
+	status = "okay";
+};
+
+&pcie1 {
+	status = "okay";
+
+	perst-gpio = <&tlmm 62 GPIO_ACTIVE_HIGH>;
+
+	bridge@1,0 {
+		reg = <0x00010000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			status = "okay";
+
+			compatible = "qcom,ath10k";
+			reg = <0x00010000 0 0 0 0>;
+
+			qcom,ath10k-calibration-variant = "Xiaomi-AX9000";
+			nvmem-cell-names = "calibration";
+			nvmem-cells = <&caldata_qca9889>;
+		};
+	};
+};
+
+&wifi {
+	status = "okay";
+
+	qcom,ath11k-calibration-variant = "Xiaomi-AX9000";
+};
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts
new file mode 100644
index 00000000000000..5468e9e1fb83f5
--- /dev/null
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts
@@ -0,0 +1,243 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/* Copyright (c) 2022, Robert Marko <robimarko@gmail.com> */
+
+/dts-v1/;
+
+#include "ipq8074.dtsi"
+#include "ipq8074-hk-cpu.dtsi"
+#include "ipq8074-ess.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	model = "Dynalink DL-WRX36";
+	compatible = "dynalink,dl-wrx36", "qcom,ipq8074";
+
+	aliases {
+		led-boot = &led_system_red;
+		led-failsafe = &led_system_red;
+		led-running = &led_system_blue;
+		led-upgrade = &led_system_red;
+		serial0 = &blsp1_uart5;
+		/* Aliases as required by u-boot to patch MAC addresses */
+		ethernet0 = &dp6_syn;
+		ethernet1 = &dp4;
+		ethernet2 = &dp3;
+		ethernet3 = &dp2;
+		ethernet4 = &dp1;
+		label-mac-device = &dp6_syn;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs-append = " root=/dev/ubiblock0_1";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 34 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&tlmm 63 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_system_blue: system-blue {
+			label = "blue:system";
+			gpios = <&tlmm 26 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_BLUE>;
+		};
+
+		led_system_red: system-red {
+			label = "red:system";
+			gpios = <&tlmm 25 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_RED>;
+		};
+	};
+};
+
+&tlmm {
+	mdio_pins: mdio-pins {
+		mdc {
+			pins = "gpio68";
+			function = "mdc";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		mdio {
+			pins = "gpio69";
+			function = "mdio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+};
+
+&blsp1_uart5 {
+	status = "okay";
+};
+
+&prng {
+	status = "okay";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&qpic_nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		nand-ecc-strength = <8>;
+		nand-ecc-step-size = <512>;
+		nand-bus-width = <8>;
+
+		partitions {
+			compatible = "qcom,smem-part";
+		};
+	};
+};
+
+&qusb_phy_0 {
+	status = "okay";
+};
+
+&ssphy_0 {
+	status = "okay";
+};
+
+&usb_0 {
+	status = "okay";
+};
+
+&mdio {
+	status = "okay";
+
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	reset-gpios = <&tlmm 37 GPIO_ACTIVE_LOW>;
+
+	qca8075_0: ethernet-phy@0 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <0>;
+	};
+
+	qca8075_1: ethernet-phy@1 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <1>;
+	};
+
+	qca8075_2: ethernet-phy@2 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <2>;
+	};
+
+	qca8075_3: ethernet-phy@3 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <3>;
+	};
+
+	qca8081: ethernet-phy@28 {
+		compatible = "ethernet-phy-id004d.d101";
+		reg = <28>;
+		reset-gpios = <&tlmm 44 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&switch {
+	status = "okay";
+
+	switch_cpu_bmp = <0x1>;  /* cpu port bitmap */
+	switch_lan_bmp = <0x3e>; /* lan port bitmap */
+	switch_wan_bmp = <0x40>; /* wan port bitmap */
+	switch_mac_mode = <0xb>; /* mac mode for uniphy instance0*/
+	switch_mac_mode1 = <0xff>; /* mac mode for uniphy instance1*/
+	switch_mac_mode2 = <0xc>; /* mac mode for uniphy instance2*/
+	bm_tick_mode = <0>; /* bm tick mode */
+	tm_tick_mode = <0>; /* tm tick mode */
+
+	qcom,port_phyinfo {
+		port@0 {
+			port_id = <1>;
+			phy_address = <0>;
+		};
+		port@1 {
+			port_id = <2>;
+			phy_address = <1>;
+		};
+		port@2 {
+			port_id = <3>;
+			phy_address = <2>;
+		};
+		port@3 {
+			port_id = <4>;
+			phy_address = <3>;
+		};
+		port@5 {
+			port_id = <6>;
+			phy_address = <28>;
+			port_mac_sel = "QGMAC_PORT";
+		};
+	};
+};
+
+&edma {
+	status = "okay";
+};
+
+&dp1 {
+	status = "okay";
+	phy-handle = <&qca8075_0>;
+	label = "lan4";
+};
+
+&dp2 {
+	status = "okay";
+	phy-handle = <&qca8075_1>;
+	label = "lan3";
+};
+
+&dp3 {
+	status = "okay";
+	phy-handle = <&qca8075_2>;
+	label = "lan2";
+};
+
+&dp4 {
+	status = "okay";
+	phy-handle = <&qca8075_3>;
+	label = "lan1";
+};
+
+&dp6_syn {
+	status = "okay";
+	phy-handle = <&qca8081>;
+	label = "wan";
+};
+
+&wifi {
+	status = "okay";
+	qcom,ath11k-calibration-variant = "Dynalink-DL-WRX36";
+};
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-haze.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-haze.dts
new file mode 100644
index 00000000000000..8a5200b4ebf50e
--- /dev/null
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-haze.dts
@@ -0,0 +1,308 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+
+#include "ipq8074.dtsi"
+#include "ipq8074-hk-cpu.dtsi"
+#include "ipq8074-ess.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	model = "prpl Foundation Haze";
+	compatible = "prpl,haze", "qcom,ipq8074";
+
+	aliases {
+		serial0 = &blsp1_uart5;
+		/* Aliases are required by U-Boot to patch MAC addresses */
+		ethernet0 = &dp6_syn;
+		ethernet1 = &dp4;
+		ethernet2 = &dp3;
+		ethernet3 = &dp2;
+		label-mac-device = &dp6_syn;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		wps-button {
+			label = "wps";
+			gpios = <&tlmm 42 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+
+		reset-button {
+			label = "reset";
+			gpios = <&tlmm 44 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+};
+
+&tlmm {
+	mdio_pins: mdio-state {
+		mdc-pins {
+			pins = "gpio68";
+			function = "mdc";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		mdio-pins {
+			pins = "gpio69";
+			function = "mdio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+
+	button_pins: button-state {
+		wps-pins {
+			pins = "gpio42";
+			function = "gpio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		rst-pins {
+			pins = "gpio44";
+			function = "gpio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+};
+
+&blsp1_uart5 {
+	status = "okay";
+};
+
+&prng {
+	status = "okay";
+};
+
+&ssphy_0 {
+	status = "okay";
+};
+
+&qusb_phy_0 {
+	status = "okay";
+};
+
+&ssphy_1 {
+	status = "okay";
+};
+
+&qusb_phy_1 {
+	status = "okay";
+};
+
+&usb_0 {
+	status = "okay";
+};
+
+&usb_1 {
+	status = "okay";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&blsp1_spi1 { /* BLSP1 QUP1 */
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+	cs-gpios = <0>;
+	status = "okay";
+
+	flash@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+		compatible = "jedec,spi-nor";
+		spi-max-frequency = <50000000>;
+
+		partitions {
+			compatible = "qcom,smem-part";
+		};
+	};
+};
+
+&mdio {
+	status = "okay";
+
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	reset-gpios = <&tlmm 22 GPIO_ACTIVE_LOW>;
+
+	qca8075_1: ethernet-phy@0 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <0>;
+	};
+
+	qca8075_2: ethernet-phy@1 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <1>;
+	};
+
+	qca8075_3: ethernet-phy@2 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <2>;
+	};
+
+	qca8075_4: ethernet-phy@3 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <3>;
+	};
+
+	aqr113c: ethernet-phy@5 {
+		compatible ="ethernet-phy-ieee802.3-c45";
+		reg = <8>;
+		reset-gpios = <&tlmm 43 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&sdhc_1 {
+	status = "okay";
+
+	vqmmc-supply = <&l11>;
+};
+
+&switch {
+	status = "okay";
+
+	switch_cpu_bmp = <0x1>;  /* cpu port bitmap */
+	switch_lan_bmp = <0x1e>; /* lan port bitmap */
+	switch_wan_bmp = <0x60>; /* wan port bitmap */
+	switch_mac_mode = <0x0>; /* mac mode for uniphy instance0*/
+	switch_mac_mode1 = <0xe>; /* mac mode for uniphy instance1*/
+	switch_mac_mode2 = <0xd>; /* mac mode for uniphy instance2*/
+	bm_tick_mode = <0>; /* bm tick mode */
+	tm_tick_mode = <0>; /* tm tick mode */
+
+	qcom,port_phyinfo {
+		port@0 {
+			port_id = <1>;
+			phy_address = <0>;
+		};
+		port@1 {
+			port_id = <2>;
+			phy_address = <1>;
+		};
+		port@2 {
+			port_id = <3>;
+			phy_address = <2>;
+		};
+		port@3 {
+			port_id = <4>;
+			phy_address = <3>;
+		};
+		port@4 {
+			port_id = <6>;
+			phy_address = <8>;
+			compatible = "ethernet-phy-ieee802.3-c45";
+			ethernet-phy-ieee802.3-c45;
+		};
+	};
+};
+
+&edma {
+	status = "okay";
+};
+
+/* Dummy LAN port */
+&dp1 {
+	status = "disabled";
+	phy-handle = <&qca8075_1>;
+	label = "lan4";
+};
+
+&dp2 {
+	status = "okay";
+	phy-handle = <&qca8075_2>;
+	label = "lan3";
+};
+
+&dp3 {
+	status = "okay";
+	phy-handle = <&qca8075_3>;
+	label = "lan2";
+};
+
+&dp4 {
+	status = "okay";
+	phy-handle = <&qca8075_4>;
+	label = "lan1";
+};
+
+&dp6_syn {
+	status = "okay";
+	qcom,mactype = <1>;
+	phy-handle = <&aqr113c>;
+	label = "wan";
+};
+
+&pcie_qmp0 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+
+	perst-gpio = <&tlmm 58 GPIO_ACTIVE_LOW>;
+
+	bridge@0,0 {
+		reg = <0x00020000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+	};
+};
+
+&pcie_qmp1 {
+	status = "okay";
+};
+
+&pcie1 {
+	status = "okay";
+
+	perst-gpio = <&tlmm 61 GPIO_ACTIVE_LOW>;
+
+	bridge@1,0 {
+		reg = <0x00010000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			status = "okay";
+
+			/* ath11k has no DT compatible for PCI cards */
+			compatible = "pci17cb,1104";
+			reg = <0x00010000 0 0 0 0>;
+
+			qcom,ath11k-calibration-variant = "prpl-Haze";
+		};
+	};
+};
+
+&wifi {
+	status = "okay";
+
+	qcom,ath11k-calibration-variant = "prpl-Haze";
+};
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-wax218.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-wax218.dts
new file mode 100644
index 00000000000000..5bfcdcc8ca3ad1
--- /dev/null
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-wax218.dts
@@ -0,0 +1,191 @@
+/dts-v1/;
+
+#include "ipq8074.dtsi"
+#include "ipq8074-hk-cpu.dtsi"
+#include "ipq8074-ess.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	model = "Netgear WAX218";
+	compatible = "netgear,wax218", "qcom,ipq8074";
+
+	aliases {
+		serial0 = &blsp1_uart5;
+		led-boot = &led_power_amber;
+		led-failsafe = &led_power_amber;
+		led-running = &led_power_amber;
+		led-upgrade = &led_power_amber;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		/*
+		 * Netgear's U-Boot adds "ubi.mtd=rootfs root=mtd:ubi_rootfs"
+		 * That fails to create a UBI block device, so add it here.
+		*/
+		bootargs-append = " ubi.block=0,rootfs root=/dev/ubiblock0_1";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 52 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	led_spi {
+		compatible = "spi-gpio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		sck-gpios = <&tlmm 18 GPIO_ACTIVE_HIGH>;
+		mosi-gpios = <&tlmm 19 GPIO_ACTIVE_HIGH>;
+
+		led_gpio: led_gpio@0 {
+			compatible = "fairchild,74hc595";
+			reg = <0>;
+			gpio-controller;
+			#gpio-cells = <2>;
+			registers-number = <1>;
+			enable-gpios = <&tlmm 20 GPIO_ACTIVE_HIGH>;
+			spi-max-frequency = <1000000>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power_amber: led_power {
+			label = "amber:power";
+			gpios = <&led_gpio 1 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_lan {
+			label = "blue:lan";
+			gpios = <&led_gpio 2 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_wlan_2g {
+			label = "blue:wlan2g";
+			gpios = <&led_gpio 3 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_wlan_5g {
+			label = "blue:wlan5g";
+			gpios = <&led_gpio 4 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&edma {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+
+	switch_cpu_bmp = <0x1>;
+	switch_lan_bmp = <0x3e>;
+	switch_wan_bmp = <0x40>;
+	switch_mac_mode = <0x00>;
+	switch_mac_mode1 = <0xff>;
+	switch_mac_mode2 = <0x0f>;
+	bm_tick_mode = <0>;
+	tm_tick_mode = <0>;
+
+	qcom,port_phyinfo {
+		port@5 {
+			port_id = <6>;
+			phy_address = <28>;
+			port_mac_sel = "QGMAC_PORT";
+		};
+	};
+};
+
+&tlmm {
+	mdio_pins: mdio-pins {
+		mdc {
+			pins = "gpio68";
+			function = "mdc";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		mdio {
+			pins = "gpio69";
+			function = "mdio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+};
+
+&mdio {
+	status = "okay";
+
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	reset-gpios = <&tlmm 44 GPIO_ACTIVE_LOW>;
+
+	qca8081_28: ethernet-phy@28 {
+		reg = <28>;
+	};
+};
+
+&dp6_syn {
+	status = "okay";
+	phy-handle = <&qca8081_28>;
+	label = "lan";
+	nvmem-cells = <&macaddr_ubootenv_ethaddr>;
+	nvmem-cell-names = "mac-address";
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&qpic_nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		nand-ecc-strength = <4>;
+		nand-ecc-step-size = <512>;
+		nand-bus-width = <8>;
+
+		partitions {
+			compatible = "qcom,smem-part";
+
+			partition-0-appsblenv {
+				compatible = "fixed-partitions";
+				label = "0:appsblenv";
+				read-only;
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				partition@0 {
+					compatible = "u-boot,env";
+					label = "env-data";
+					reg = <0x0 0x40000>;
+
+					macaddr_ubootenv_ethaddr: ethaddr {};
+				};
+			};
+		};
+	};
+};
+
+&blsp1_uart5 {
+	status = "okay";
+};
+
+&wifi {
+	status = "okay";
+
+	qcom,ath11k-calibration-variant = "Netgear-WAX218";
+};
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-wpq873.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-wpq873.dts
new file mode 100644
index 00000000000000..9779070725b40e
--- /dev/null
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-wpq873.dts
@@ -0,0 +1,487 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/* Copyright 2023 Nokia */
+
+/dts-v1/;
+
+#include "ipq8074.dtsi"
+#include "ipq8074-hk-cpu.dtsi"
+#include "ipq8074-ess.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	model = "Compex WPQ873";
+	compatible = "compex,wpq873", "qcom,ipq8074";
+
+	aliases {
+		serial0 = &blsp1_uart5;
+		led-boot = &led_power_blue;
+		led-failsafe = &led_power_red;
+		led-running = &led_system_green;
+		led-upgrade = &led_system_blue;
+		/* Aliases as required by u-boot to patch MAC addresses */
+		ethernet0 = &dp6;
+		ethernet1 = &dp2;
+		ethernet2 = &dp3;
+		ethernet3 = &dp4;
+		label-mac-device = &dp6;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs-append = " root=/dev/ubiblock0_1";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 21 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power_red: power-red {
+			label = "red:power";
+			gpios = <&tlmm 42 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_RED>;
+		};
+
+		led_power_blue: power-blue {
+			label = "blue:power";
+			gpios = <&tlmm 43 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_BLUE>;
+		};
+
+		led_system_red: system-red {
+			label = "red:system";
+			gpios = <&tlmm 28 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_RED>;
+		};
+
+		led_system_green: system-green {
+			label = "green:system";
+			gpios = <&tlmm 18 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_GREEN>;
+		};
+
+		led_system_blue: system-blue {
+			label = "blue:system";
+			gpios = <&tlmm 19 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_BLUE>;
+		};
+	};
+};
+
+&tlmm {
+	mdio_pins: mdio-pins {
+		mdc {
+			pins = "gpio68";
+			function = "mdc";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		mdio {
+			pins = "gpio69";
+			function = "mdio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+
+	i2c_pins: i2c-pins {
+		pins = "gpio0", "gpio2";
+		function = "blsp5_i2c";
+		drive-strength = <8>;
+		bias-disable;
+	};
+};
+
+&blsp1_uart5 {
+	status = "okay";
+};
+
+&blsp1_i2c6 {
+	status = "okay";
+
+	pinctrl-0 = <&i2c_pins>;
+	pinctrl-names = "default";
+};
+
+&prng {
+	status = "okay";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&blsp1_spi1 {
+	status = "okay";
+};
+
+&tlmm {
+	mdio_pins: mdio-pins {
+		mdc {
+			pins = "gpio68";
+			function = "mdc";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		mdio {
+			pins = "gpio69";
+			function = "mdio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+
+	button_pins: button_pins {
+		reset_button {
+			pins = "gpio66";
+			function = "gpio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+};
+
+&blsp1_spi1 {
+	status = "okay";
+
+	flash@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+		compatible = "jedec,spi-nor";
+		spi-max-frequency = <50000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "0:sbl1";
+				reg = <0x0 0x50000>;
+				read-only;
+			};
+
+			partition@50000 {
+				label = "0:mibib";
+				reg = <0x50000 0x10000>;
+				read-only;
+			};
+
+			partition@60000 {
+				label = "0:bootconfig";
+				reg = <0x60000 0x20000>;
+				read-only;
+			};
+
+			partition@80000 {
+				label = "0:bootconfig1";
+				reg = <0x80000 0x20000>;
+				read-only;
+			};
+
+			partition@a0000 {
+				label = "0:qsee";
+				reg = <0xa0000 0x180000>;
+				read-only;
+			};
+
+			partition@220000 {
+				label = "0:qsee_1";
+				reg = <0x220000 0x180000>;
+				read-only;
+			};
+
+			partition@3a0000 {
+				label = "0:devcfg";
+				reg = <0x3a0000 0x10000>;
+				read-only;
+			};
+
+			partition@3b0000 {
+				label = "0:devcfg_1";
+				reg = <0x3b0000 0x10000>;
+				read-only;
+			};
+
+			partition@3c0000 {
+				label = "0:apdp";
+				reg = <0x3c0000 0x10000>;
+				read-only;
+			};
+
+			partition@3d0000 {
+				label = "0:apdp_1";
+				reg = <0x3d0000 0x10000>;
+				read-only;
+			};
+
+			partition@3e0000 {
+				label = "0:rpm";
+				reg = <0x3e0000 0x40000>;
+				read-only;
+			};
+
+			partition@420000 {
+				label = "0:rpm_1";
+				reg = <0x420000 0x40000>;
+				read-only;
+			};
+
+			partition@460000 {
+				label = "0:cdt";
+				reg = <0x460000 0x10000>;
+				read-only;
+			};
+
+			partition@470000 {
+				label = "0:cdt_1";
+				reg = <0x470000 0x10000>;
+				read-only;
+			};
+
+			partition@480000 {
+				label = "0:appsblenv";
+				reg = <0x480000 0x10000>;
+			};
+
+			partition@490000 {
+				label = "0:appsbl";
+				reg = <0x490000 0xa0000>;
+				read-only;
+			};
+
+			partition@550000 {
+				label = "0:appsbl_1";
+				reg = <0x530000 0xa0000>;
+				read-only;
+			};
+
+			partition@610000 {
+				label = "0:art";
+				reg = <0x5d0000 0x40000>;
+				read-only;
+			};
+
+			partition@650000 {
+				label = "0:ethphyfw";
+				reg = <0x610000 0x80000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&qpic_nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		nand-ecc-strength = <8>;
+		nand-ecc-step-size = <512>;
+		nand-bus-width = <8>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "rootfs";
+				reg = <0x0000000 0x3400000>;
+			};
+
+			partition@3400000 {
+				label = "0:wififw";
+				reg = <0x3400000 0x800000>;
+				read-only;
+			};
+
+			partition@3c00000 {
+				label = "rootfs_1";
+				reg = <0x3c00000 0x3400000>;
+			};
+
+			partition@7000000 {
+				label = "0:wififw_1";
+				reg = <0x7000000 0x800000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&qusb_phy_0 {
+	status = "okay";
+};
+
+&qusb_phy_1 {
+	status = "okay";
+};
+
+&ssphy_0 {
+	status = "okay";
+};
+
+&ssphy_1 {
+	status = "okay";
+};
+
+&usb_0 {
+	status = "okay";
+};
+
+&usb_1 {
+	status = "okay";
+};
+
+
+&mdio {
+	status = "okay";
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	reset-gpios = <&tlmm 37 GPIO_ACTIVE_LOW>;
+
+	qca8075_1: ethernet-phy@1 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <1>;
+	};
+
+	qca8075_2: ethernet-phy@2 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <2>;
+	};
+
+	qca8075_3: ethernet-phy@3 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <3>;
+	};
+
+	qca8081: ethernet-phy@28 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <28>;
+		reset-gpios = <&tlmm 44 GPIO_ACTIVE_LOW>;
+	};
+
+};
+
+&switch {
+	status = "okay";
+
+	switch_cpu_bmp = <0x1>;  /* cpu port bitmap */
+	switch_lan_bmp = <0x3e>; /* lan port bitmap */
+	switch_wan_bmp = <0x40>; /* wan port bitmap */
+	switch_mac_mode = <0x0>; /* mac mode for uniphy instance0*/
+	switch_mac_mode1 = <0x0f>; /* mac mode for uniphy instance1*/
+	switch_mac_mode2 = <0x0f>; /* mac mode for uniphy instance2*/
+	bm_tick_mode = <0>; /* bm tick mode */
+	tm_tick_mode = <0>; /* tm tick mode */
+
+	qcom,port_phyinfo {
+		port@2 {
+			port_id = <2>;
+			phy_address = <1>;
+		};
+		port@3 {
+			port_id = <3>;
+			phy_address = <2>;
+		};
+		port@4 {
+			port_id = <4>;
+			phy_address = <3>;
+		};
+		port@5 {
+			port_id = <6>;
+			phy_address = <28>;
+			port_mac_sel = "QGMAC_PORT";
+		};
+	};
+};
+
+&edma {
+	status = "okay";
+};
+
+&dp2 {
+        status = "okay";
+        phy-handle = <&qca8075_1>;
+        label = "lan1";
+};
+
+&dp3 {
+        status = "okay";
+        phy-handle = <&qca8075_2>;
+        label = "lan2";
+};
+
+&dp4 {
+        status = "okay";
+        phy-handle = <&qca8075_3>;
+        label = "lan3";
+};
+
+&dp6 {
+        status = "okay";
+        phy-handle = <&qca8081>;
+        label = "wan";
+};
+
+&pcie_qmp0 {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+
+	perst-gpio = <&tlmm 58 GPIO_ACTIVE_LOW>;
+
+	bridge@0,0 {
+		reg = <0x00020000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+	};
+};
+
+&pcie_qmp1 {
+	status = "okay";
+};
+
+&pcie1 {
+	status = "okay";
+
+	perst-gpio = <&tlmm 62 GPIO_ACTIVE_HIGH>;
+
+	bridge@1,0 {
+		reg = <0x00010000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+	};
+};
+
+&wifi {
+	status = "okay";
+
+	qcom,ath11k-calibration-variant = "Compex-WPQ873";
+};
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-512m.dtsi b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-512m.dtsi
new file mode 100644
index 00000000000000..dace4008b38bdf
--- /dev/null
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-512m.dtsi
@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include "ipq8074.dtsi"
+
+&tzapp_region {
+	reg = <0x0 0x4a400000 0x0 0x100000>;
+};
+
+&q6_region {
+	reg = <0x0 0x4b000000 0x0 0x3700000>;
+};
+
+&q6_etr_region {
+	reg = <0x0 0x4e700000 0x0 0x100000>;
+};
+
+&m3_dump_region {
+	reg = <0x0 0x4e800000 0x0 0x100000>;
+};
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-ac-cpu.dtsi b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-ac-cpu.dtsi
new file mode 100644
index 00000000000000..057d592031106d
--- /dev/null
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-ac-cpu.dtsi
@@ -0,0 +1,123 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <dt-bindings/thermal/thermal.h>
+#include "ipq8074-cpr-regulator.dtsi"
+
+&CPU0 {
+	cpu-supply = <&apc_vreg>;
+	voltage-tolerance = <1>;
+};
+
+&CPU1 {
+	cpu-supply = <&apc_vreg>;
+	voltage-tolerance = <1>;
+};
+
+&CPU2 {
+	cpu-supply = <&apc_vreg>;
+	voltage-tolerance = <1>;
+};
+
+&CPU3 {
+	cpu-supply = <&apc_vreg>;
+	voltage-tolerance = <1>;
+};
+&cpu0_thermal {
+	trips {
+		cpu0_passive: cpu-passive {
+			temperature = <95000>;
+			hysteresis = <2000>;
+			type = "passive";
+		};
+	};
+
+	cooling-maps {
+		map0 {
+			trip = <&cpu0_passive>;
+			cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+		};
+	};
+};
+
+&cpu1_thermal {
+	trips {
+		cpu1_passive: cpu-passive {
+			temperature = <95000>;
+			hysteresis = <2000>;
+			type = "passive";
+		};
+	};
+
+	cooling-maps {
+		map0 {
+			trip = <&cpu1_passive>;
+			cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+		};
+	};
+};
+
+&cpu2_thermal {
+	trips {
+		cpu2_passive: cpu-passive {
+			temperature = <95000>;
+			hysteresis = <2000>;
+			type = "passive";
+		};
+	};
+
+	cooling-maps {
+		map0 {
+			trip = <&cpu2_passive>;
+			cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+		};
+	};
+};
+
+&cpu3_thermal {
+	trips {
+		cpu3_passive: cpu-passive {
+			temperature = <95000>;
+			hysteresis = <2000>;
+			type = "passive";
+		};
+	};
+
+	cooling-maps {
+		map0 {
+			trip = <&cpu3_passive>;
+			cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+		};
+	};
+};
+
+&cluster_thermal {
+	trips {
+		cluster_passive: cluster-passive {
+			temperature = <95000>;
+			hysteresis = <2000>;
+			type = "passive";
+		};
+	};
+
+	cooling-maps {
+		map0 {
+			trip = <&cluster_passive>;
+			cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+		};
+	};
+};
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-cpr-regulator.dtsi b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-cpr-regulator.dtsi
new file mode 100644
index 00000000000000..e351a2e759a54d
--- /dev/null
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-cpr-regulator.dtsi
@@ -0,0 +1,228 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include "pmp8074.dtsi"
+
+&soc {
+	apc_apm: apm@b111000 {
+		compatible = "qcom,ipq807x-apm";
+		reg = <0xb111000 0x1000>;
+		reg-names = "pm-apcc-glb";
+		qcom,apm-post-halt-delay = <0x2>;
+		qcom,apm-halt-clk-delay = <0x11>;
+		qcom,apm-resume-clk-delay = <0x10>;
+		qcom,apm-sel-switch-delay = <0x01>;
+	};
+
+	apc_cpr: cpr4-ctrl@b018000 {
+		compatible = "qcom,cpr4-ipq807x-apss-regulator";
+		reg = <0xb018000 0x4000>, <0xa4000 0x1000>, <0x0193d008 0x4>;
+		reg-names = "cpr_ctrl", "fuse_base", "cpr_tcsr_reg";
+		interrupts = <GIC_SPI 15 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "cpr";
+		qcom,cpr-ctrl-name = "apc";
+		qcom,cpr-sensor-time = <1000>;
+		qcom,cpr-loop-time = <5000000>;
+		qcom,cpr-idle-cycles = <15>;
+		qcom,cpr-step-quot-init-min = <12>;
+		qcom,cpr-step-quot-init-max = <14>;
+		qcom,cpr-count-mode = <0>;		/* All-at-once */
+		qcom,cpr-count-repeat = <14>;
+		qcom,cpr-down-error-step-limit = <1>;
+		qcom,cpr-up-error-step-limit = <1>;
+		qcom,apm-ctrl = <&apc_apm>;
+		qcom,apm-threshold-voltage = <848000>;
+		vdd-supply = <&s3>;
+		qcom,voltage-step = <8000>;
+
+		thread@0 {
+			qcom,cpr-thread-id = <0>;
+			qcom,cpr-consecutive-up = <0>;
+			qcom,cpr-consecutive-down = <0>;
+			qcom,cpr-up-threshold = <4>;
+			qcom,cpr-down-threshold = <1>;
+
+			apc_vreg: regulator {
+				regulator-name = "apc_corner";
+				regulator-min-microvolt = <1>;
+				regulator-max-microvolt = <6>;
+				qcom,cpr-part-types = <2>;
+				qcom,cpr-parts-voltage = <1048000>;
+				qcom,cpr-parts-voltage-v2 = <992000>;
+				qcom,cpr-fuse-corners = <4>;
+				qcom,cpr-fuse-combos = <8>;
+				qcom,cpr-corners = <6>;
+				qcom,cpr-speed-bins = <1>;
+				qcom,cpr-speed-bin-corners = <6>;
+				qcom,cpr-corner-fmax-map = <1 3 5 6>;
+				qcom,allow-voltage-interpolation;
+				qcom,allow-quotient-interpolation;
+				qcom,cpr-scaled-open-loop-voltage-as-ceiling;
+				qcom,cpr-voltage-ceiling =
+					<840000 904000 944000
+					 984000 992000 1064000>;
+				qcom,cpr-voltage-floor =
+					<592000 648000 712000
+					 744000 784000 848000>;
+				qcom,corner-frequencies =
+					<1017600000 1382400000 1651200000
+					1843200000 1920000000 2208000000>;
+
+				/* TT/FF parts i.e. turbo L1 OL voltage < 1048 mV */
+				qcom,cpr-open-loop-voltage-fuse-adjustment-0 =
+					/* Speed bin 0; CPR rev 0..7 */
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0 12000>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>;
+
+				/* SS parts i.e turbo L1 OL voltage >= 1048 mV */
+				qcom,cpr-open-loop-voltage-fuse-adjustment-1 =
+					/* Speed bin 0; CPR rev 0..7 */
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					< 20000  26000      0 20000>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>;
+
+				/* v2 - FF parts i.e. turbo L1 OL voltage < 992 mV */
+				qcom,cpr-open-loop-voltage-fuse-adjustment-v2-0 =
+                                        /* Speed bin 0; CPR rev 0..7 */
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>;
+
+				/* v2 - SS/TT parts i.e turbo L1 OL voltage >= 992 mV */
+				qcom,cpr-open-loop-voltage-fuse-adjustment-v2-1 =
+					/* Speed bin 0; CPR rev 0..7 */
+					<     0      0      0     0>,
+					<     0   7000  36000  4000>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>;
+
+				/* v2 - FF parts i.e. turbo L1 OL voltage < 992 mV */
+				qcom,cpr-closed-loop-voltage-adjustment-v2-0 =
+					/* Speed bin 0; CPR rev 0..7 */
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>;
+
+				/* v2 - SS/TT parts i.e turbo L1 OL voltage >= 992 mV */
+				qcom,cpr-closed-loop-voltage-adjustment-v2-1 =
+					/* Speed bin 0; CPR rev 0..7 */
+					<     0      0      0     0>,
+					<     0      0      19000 0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>,
+					<     0      0      0     0>;
+
+				qcom,cpr-ro-scaling-factor =
+					< 3970 4150 0    2280 2520 2470 2250 2280
+					  2390 2330 2530 2500  850 2900 2510 2170 >,
+					< 3970 4150 0    2280 2520 2470 2250 2280
+					  2390 2330 2530 2500  850 2900 2510 2170 >,
+					< 3970 4150 0    2280 2520 2470 2250 2280
+					  2390 2330 2530 2500  850 2900 2510 2170 >,
+					< 3970 4150 0    2280 2520 2470 2250 2280
+					  2390 2330 2530 2500  850 2900 2510 2170 >;
+
+				qcom,cpr-floor-to-ceiling-max-range =
+					< 40000 40000 40000 40000 40000 40000>,
+					< 40000 40000 40000 40000 40000 40000>,
+					< 40000 40000 40000 40000 40000 40000>,
+					< 40000 40000 40000 40000 40000 40000>,
+					< 40000 40000 40000 40000 40000 40000>,
+					< 40000 40000 40000 40000 40000 40000>,
+					< 40000 40000 40000 40000 40000 40000>,
+					< 40000 40000 40000 40000 40000 40000>;
+				regulator-always-on;
+			};
+		};
+	};
+
+	npu_cpr: npu-cpr {
+		compatible = "qcom,cpr3-ipq807x-npu-regulator";
+		reg = <0xa4000 0x1000>, <0x0193d008 0x4>;
+		reg-names = "fuse_base", "cpr_tcsr_reg";
+		qcom,cpr-ctrl-name = "npu";
+		vdd-supply = <&s4>;
+		qcom,voltage-step = <8000>;
+		thread@0 {
+			qcom,cpr-thread-id = <0>;
+			qcom,cpr-consecutive-up = <0>;
+			qcom,cpr-consecutive-down = <2>;
+			qcom,cpr-up-threshold = <2>;
+			qcom,cpr-down-threshold = <1>;
+
+			npu_vreg: regulator {
+				regulator-name = "npu_corner";
+				regulator-min-microvolt = <1>;
+				regulator-max-microvolt = <3>;
+				qcom,cpr-part-types = <2>;
+				qcom,cpr-parts-voltage = <968000>;
+				qcom,cpr-parts-voltage-v2 = <832001>;
+				qcom,cpr-cold-temp-threshold-v2 = <30>;
+				qcom,cpr-fuse-corners = <2>;
+				qcom,cpr-fuse-combos = <1>;
+				qcom,cpr-corners = <2>;
+				qcom,cpr-speed-bins = <1>;
+				qcom,cpr-speed-bin-corners = <2>;
+				qcom,allow-voltage-interpolation;
+				qcom,cpr-corner-fmax-map = <1 2>;
+				qcom,cpr-voltage-ceiling =
+					<912000 992000>;
+				qcom,cpr-voltage-floor =
+					<752000 792000>;
+				qcom,corner-frequencies =
+					<1497600000 1689600000>;
+
+				/* TT/FF parts i.e. turbo OL voltage < 968 mV */
+				qcom,cpr-open-loop-voltage-fuse-adjustment-0 =
+					< 40000   40000>;
+
+				/* SS parts i.e turbo OL voltage >= 968 mV */
+				qcom,cpr-open-loop-voltage-fuse-adjustment-1 =
+					< 24000   24000>;
+
+				/* FF parts i.e. turbo OL voltage <= 832 mV */
+				qcom,cpr-open-loop-voltage-fuse-adjustment-v2-0=
+					<40000   40000>;
+
+				 /* TT/SS parts i.e turbo OL voltage > 832 mV */
+				qcom,cpr-open-loop-voltage-fuse-adjustment-v2-1=
+					<40000   40000>;
+
+				/* FF parts i.e. turbo OL voltage <= 832 mV */
+				qcom,cpr-cold-temp-voltage-adjustment-v2-0 =
+					<0   0>;
+
+				/* TT/SS parts i.e turbo OL voltage > 832 mV */
+				qcom,cpr-cold-temp-voltage-adjustment-v2-1 =
+					<35000   27000>;
+			};
+		};
+	};
+};
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-ess.dtsi b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-ess.dtsi
new file mode 100644
index 00000000000000..129266c50d1d38
--- /dev/null
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-ess.dtsi
@@ -0,0 +1,531 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+&clocks {
+	bias_pll_cc_clk {
+		compatible = "fixed-clock";
+		clock-frequency = <300000000>;
+		#clock-cells = <0>;
+	};
+
+	bias_pll_nss_noc_clk {
+		compatible = "fixed-clock";
+		clock-frequency = <416500000>;
+		#clock-cells = <0>;
+	};
+};
+
+&soc {
+	switch: ess-switch@3a000000 {
+		compatible = "qcom,ess-switch-ipq807x";
+		reg = <0x3a000000 0x1000000>;
+		switch_access_mode = "local bus";
+		switch_cpu_bmp = <0x1>;  /* cpu port bitmap */
+		switch_inner_bmp = <0x80>; /*inner port bitmap*/
+		clocks = <&gcc GCC_CMN_12GPLL_AHB_CLK>,
+			 <&gcc GCC_CMN_12GPLL_SYS_CLK>,
+			 <&gcc GCC_UNIPHY0_AHB_CLK>,
+			 <&gcc GCC_UNIPHY0_SYS_CLK>,
+			 <&gcc GCC_UNIPHY1_AHB_CLK>,
+			 <&gcc GCC_UNIPHY1_SYS_CLK>,
+			 <&gcc GCC_UNIPHY2_AHB_CLK>,
+			 <&gcc GCC_UNIPHY2_SYS_CLK>,
+			 <&gcc GCC_PORT1_MAC_CLK>,
+			 <&gcc GCC_PORT2_MAC_CLK>,
+			 <&gcc GCC_PORT3_MAC_CLK>,
+			 <&gcc GCC_PORT4_MAC_CLK>,
+			 <&gcc GCC_PORT5_MAC_CLK>,
+			 <&gcc GCC_PORT6_MAC_CLK>,
+			 <&gcc GCC_NSS_PPE_CLK>,
+			 <&gcc GCC_NSS_PPE_CFG_CLK>,
+			 <&gcc GCC_NSSNOC_PPE_CLK>,
+			 <&gcc GCC_NSSNOC_PPE_CFG_CLK>,
+			 <&gcc GCC_NSS_EDMA_CLK>,
+			 <&gcc GCC_NSS_EDMA_CFG_CLK>,
+			 <&gcc GCC_NSS_PPE_IPE_CLK>,
+			 <&gcc GCC_NSS_PPE_BTQ_CLK>,
+			 <&gcc GCC_MDIO_AHB_CLK>,
+			 <&gcc GCC_NSS_NOC_CLK>,
+			 <&gcc GCC_NSSNOC_SNOC_CLK>,
+			 <&gcc GCC_MEM_NOC_NSS_AXI_CLK>,
+			 <&gcc GCC_NSS_CRYPTO_CLK>,
+			 <&gcc GCC_NSS_IMEM_CLK>,
+			 <&gcc GCC_NSS_PTP_REF_CLK>,
+			 <&gcc GCC_NSS_PORT1_RX_CLK>,
+			 <&gcc GCC_NSS_PORT1_TX_CLK>,
+			 <&gcc GCC_NSS_PORT2_RX_CLK>,
+			 <&gcc GCC_NSS_PORT2_TX_CLK>,
+			 <&gcc GCC_NSS_PORT3_RX_CLK>,
+			 <&gcc GCC_NSS_PORT3_TX_CLK>,
+			 <&gcc GCC_NSS_PORT4_RX_CLK>,
+			 <&gcc GCC_NSS_PORT4_TX_CLK>,
+			 <&gcc GCC_NSS_PORT5_RX_CLK>,
+			 <&gcc GCC_NSS_PORT5_TX_CLK>,
+			 <&gcc GCC_NSS_PORT6_RX_CLK>,
+			 <&gcc GCC_NSS_PORT6_TX_CLK>,
+			 <&gcc GCC_UNIPHY0_PORT1_RX_CLK>,
+			 <&gcc GCC_UNIPHY0_PORT1_TX_CLK>,
+			 <&gcc GCC_UNIPHY0_PORT2_RX_CLK>,
+			 <&gcc GCC_UNIPHY0_PORT2_TX_CLK>,
+			 <&gcc GCC_UNIPHY0_PORT3_RX_CLK>,
+			 <&gcc GCC_UNIPHY0_PORT3_TX_CLK>,
+			 <&gcc GCC_UNIPHY0_PORT4_RX_CLK>,
+			 <&gcc GCC_UNIPHY0_PORT4_TX_CLK>,
+			 <&gcc GCC_UNIPHY0_PORT5_RX_CLK>,
+			 <&gcc GCC_UNIPHY0_PORT5_TX_CLK>,
+			 <&gcc GCC_UNIPHY1_PORT5_RX_CLK>,
+			 <&gcc GCC_UNIPHY1_PORT5_TX_CLK>,
+			 <&gcc GCC_UNIPHY2_PORT6_RX_CLK>,
+			 <&gcc GCC_UNIPHY2_PORT6_TX_CLK>,
+			 <&gcc NSS_PORT5_RX_CLK_SRC>,
+			 <&gcc NSS_PORT5_TX_CLK_SRC>;
+		clock-names = "cmn_ahb_clk", "cmn_sys_clk",
+			      "uniphy0_ahb_clk", "uniphy0_sys_clk",
+			      "uniphy1_ahb_clk", "uniphy1_sys_clk",
+			      "uniphy2_ahb_clk", "uniphy2_sys_clk",
+			      "port1_mac_clk", "port2_mac_clk",
+			      "port3_mac_clk", "port4_mac_clk",
+			      "port5_mac_clk", "port6_mac_clk",
+			      "nss_ppe_clk", "nss_ppe_cfg_clk",
+			      "nssnoc_ppe_clk", "nssnoc_ppe_cfg_clk",
+			      "nss_edma_clk", "nss_edma_cfg_clk",
+			      "nss_ppe_ipe_clk", "nss_ppe_btq_clk",
+			      "gcc_mdio_ahb_clk", "gcc_nss_noc_clk",
+			      "gcc_nssnoc_snoc_clk",
+			      "gcc_mem_noc_nss_axi_clk",
+			      "gcc_nss_crypto_clk",
+			      "gcc_nss_imem_clk",
+			      "gcc_nss_ptp_ref_clk",
+			      "nss_port1_rx_clk", "nss_port1_tx_clk",
+			      "nss_port2_rx_clk", "nss_port2_tx_clk",
+			      "nss_port3_rx_clk", "nss_port3_tx_clk",
+			      "nss_port4_rx_clk", "nss_port4_tx_clk",
+			      "nss_port5_rx_clk", "nss_port5_tx_clk",
+			      "nss_port6_rx_clk", "nss_port6_tx_clk",
+			      "uniphy0_port1_rx_clk",
+			      "uniphy0_port1_tx_clk",
+			      "uniphy0_port2_rx_clk",
+			      "uniphy0_port2_tx_clk",
+			      "uniphy0_port3_rx_clk",
+			      "uniphy0_port3_tx_clk",
+			      "uniphy0_port4_rx_clk",
+			      "uniphy0_port4_tx_clk",
+			      "uniphy0_port5_rx_clk",
+			      "uniphy0_port5_tx_clk",
+			      "uniphy1_port5_rx_clk",
+			      "uniphy1_port5_tx_clk",
+			      "uniphy2_port6_rx_clk",
+			      "uniphy2_port6_tx_clk",
+			      "nss_port5_rx_clk_src",
+			      "nss_port5_tx_clk_src";
+		resets = <&gcc GCC_PPE_FULL_RESET>,
+			 <&gcc GCC_UNIPHY0_SOFT_RESET>,
+			 <&gcc GCC_UNIPHY0_XPCS_RESET>,
+			 <&gcc GCC_UNIPHY1_SOFT_RESET>,
+			 <&gcc GCC_UNIPHY1_XPCS_RESET>,
+			 <&gcc GCC_UNIPHY2_SOFT_RESET>,
+			 <&gcc GCC_UNIPHY2_XPCS_RESET>,
+			 <&gcc GCC_NSSPORT1_RESET>,
+			 <&gcc GCC_NSSPORT2_RESET>,
+			 <&gcc GCC_NSSPORT3_RESET>,
+			 <&gcc GCC_NSSPORT4_RESET>,
+			 <&gcc GCC_NSSPORT5_RESET>,
+			 <&gcc GCC_NSSPORT6_RESET>;
+		reset-names = "ppe_rst", "uniphy0_soft_rst",
+			      "uniphy0_xpcs_rst", "uniphy1_soft_rst",
+			      "uniphy1_xpcs_rst", "uniphy2_soft_rst",
+			      "uniphy2_xpcs_rst", "nss_port1_rst",
+			      "nss_port2_rst", "nss_port3_rst",
+			      "nss_port4_rst", "nss_port5_rst",
+			      "nss_port6_rst";
+		mdio-bus = <&mdio>;
+		status = "disabled";
+
+		port_scheduler_resource {
+			port@0 {
+				port_id = <0>;
+				ucast_queue = <0 143>;
+				mcast_queue = <256 271>;
+				l0sp = <0 35>;
+				l0cdrr = <0 47>;
+				l0edrr = <0 47>;
+				l1cdrr = <0 7>;
+				l1edrr = <0 7>;
+			};
+			port@1 {
+				port_id = <1>;
+				ucast_queue = <144 159>;
+				mcast_queue = <272 275>;
+				l0sp = <36 39>;
+				l0cdrr = <48 63>;
+				l0edrr = <48 63>;
+				l1cdrr = <8 11>;
+				l1edrr = <8 11>;
+			};
+			port@2 {
+				port_id = <2>;
+				ucast_queue = <160 175>;
+				mcast_queue = <276 279>;
+				l0sp = <40 43>;
+				l0cdrr = <64 79>;
+				l0edrr = <64 79>;
+				l1cdrr = <12 15>;
+				l1edrr = <12 15>;
+			};
+			port@3 {
+				port_id = <3>;
+				ucast_queue = <176 191>;
+				mcast_queue = <280 283>;
+				l0sp = <44 47>;
+				l0cdrr = <80 95>;
+				l0edrr = <80 95>;
+				l1cdrr = <16 19>;
+				l1edrr = <16 19>;
+			};
+			port@4 {
+				port_id = <4>;
+				ucast_queue = <192 207>;
+				mcast_queue = <284 287>;
+				l0sp = <48 51>;
+				l0cdrr = <96 111>;
+				l0edrr = <96 111>;
+				l1cdrr = <20 23>;
+				l1edrr = <20 23>;
+			};
+			port@5 {
+				port_id = <5>;
+				ucast_queue = <208 223>;
+				mcast_queue = <288 291>;
+				l0sp = <52 55>;
+				l0cdrr = <112 127>;
+				l0edrr = <112 127>;
+				l1cdrr = <24 27>;
+				l1edrr = <24 27>;
+			};
+			port@6 {
+				port_id = <6>;
+				ucast_queue = <224 239>;
+				mcast_queue = <292 295>;
+				l0sp = <56 59>;
+				l0cdrr = <128 143>;
+				l0edrr = <128 143>;
+				l1cdrr = <28 31>;
+				l1edrr = <28 31>;
+			};
+			port@7 {
+				port_id = <7>;
+				ucast_queue = <240 255>;
+				mcast_queue = <296 299>;
+				l0sp = <60 63>;
+				l0cdrr = <144 159>;
+				l0edrr = <144 159>;
+				l1cdrr = <32 35>;
+				l1edrr = <32 35>;
+			};
+		};
+		port_scheduler_config {
+			port@0 {
+				port_id = <0>;
+				l1scheduler {
+					group@0 {
+						sp = <0 1>; /*L0 SPs*/
+						/*cpri cdrr epri edrr*/
+						cfg = <0 0 0 0>;
+					};
+				};
+				l0scheduler {
+					group@0 {
+						/*unicast queues*/
+						ucast_queue = <0 4 8>;
+						/*multicast queues*/
+						mcast_queue = <256 260>;
+						/*sp cpri cdrr epri edrr*/
+						cfg = <0 0 0 0 0>;
+					};
+					group@1 {
+						ucast_queue = <1 5 9>;
+						mcast_queue = <257 261>;
+						cfg = <0 1 1 1 1>;
+					};
+					group@2 {
+						ucast_queue = <2 6 10>;
+						mcast_queue = <258 262>;
+						cfg = <0 2 2 2 2>;
+					};
+					group@3 {
+						ucast_queue = <3 7 11>;
+						mcast_queue = <259 263>;
+						cfg = <0 3 3 3 3>;
+					};
+				};
+			};
+			port@1 {
+				port_id = <1>;
+				l1scheduler {
+					group@0 {
+						sp = <36>;
+						cfg = <0 8 0 8>;
+					};
+					group@1 {
+						sp = <37>;
+						cfg = <1 9 1 9>;
+					};
+				};
+				l0scheduler {
+					group@0 {
+						ucast_queue = <144>;
+						ucast_loop_pri = <16>;
+						mcast_queue = <272>;
+						mcast_loop_pri = <4>;
+						cfg = <36 0 48 0 48>;
+					};
+				};
+			};
+			port@2 {
+				port_id = <2>;
+				l1scheduler {
+					group@0 {
+						sp = <40>;
+						cfg = <0 12 0 12>;
+					};
+					group@1 {
+						sp = <41>;
+						cfg = <1 13 1 13>;
+					};
+				};
+				l0scheduler {
+					group@0 {
+						ucast_queue = <160>;
+						ucast_loop_pri = <16>;
+						mcast_queue = <276>;
+						mcast_loop_pri = <4>;
+						cfg = <40 0 64 0 64>;
+					};
+				};
+			};
+			port@3 {
+				port_id = <3>;
+				l1scheduler {
+					group@0 {
+						sp = <44>;
+						cfg = <0 16 0 16>;
+					};
+					group@1 {
+						sp = <45>;
+						cfg = <1 17 1 17>;
+					};
+				};
+				l0scheduler {
+					group@0 {
+						ucast_queue = <176>;
+						ucast_loop_pri = <16>;
+						mcast_queue = <280>;
+						mcast_loop_pri = <4>;
+						cfg = <44 0 80 0 80>;
+					};
+				};
+			};
+			port@4 {
+				port_id = <4>;
+				l1scheduler {
+					group@0 {
+						sp = <48>;
+						cfg = <0 20 0 20>;
+					};
+					group@1 {
+						sp = <49>;
+						cfg = <1 21 1 21>;
+					};
+				};
+				l0scheduler {
+					group@0 {
+						ucast_queue = <192>;
+						ucast_loop_pri = <16>;
+						mcast_queue = <284>;
+						mcast_loop_pri = <4>;
+						cfg = <48 0 96 0 96>;
+					};
+				};
+			};
+			port@5 {
+				port_id = <5>;
+				l1scheduler {
+					group@0 {
+						sp = <52>;
+						cfg = <0 24 0 24>;
+					};
+					group@1 {
+						sp = <53>;
+						cfg = <1 25 1 25>;
+					};
+				};
+				l0scheduler {
+					group@0 {
+						ucast_queue = <208>;
+						ucast_loop_pri = <16>;
+						mcast_queue = <288>;
+						mcast_loop_pri = <4>;
+						cfg = <52 0 112 0 112>;
+					};
+				};
+			};
+			port@6 {
+				port_id = <6>;
+				l1scheduler {
+					group@0 {
+						sp = <56>;
+						cfg = <0 28 0 28>;
+					};
+					group@1 {
+						sp = <57>;
+						cfg = <1 29 1 29>;
+					};
+				};
+				l0scheduler {
+					group@0 {
+						ucast_queue = <224>;
+						ucast_loop_pri = <16>;
+						mcast_queue = <292>;
+						mcast_loop_pri = <4>;
+						cfg = <56 0 128 0 128>;
+					};
+				};
+			};
+			port@7 {
+				port_id = <7>;
+				l1scheduler {
+					group@0 {
+						sp = <60>;
+						cfg = <0 32 0 32>;
+					};
+					group@1 {
+						sp = <61>;
+						cfg = <1 33 1 33>;
+					};
+				};
+				l0scheduler {
+					group@0 {
+						ucast_queue = <240>;
+						ucast_loop_pri = <16>;
+						mcast_queue = <296>;
+						cfg = <60 0 144 0 144>;
+					};
+				};
+			};
+		};
+	};
+
+	ess-uniphy@7a00000 {
+		compatible = "qcom,ess-uniphy";
+		reg = <0x7a00000 0x30000>;
+		uniphy_access_mode = "local bus";
+	};
+
+	edma: edma@3ab00000 {
+		compatible = "qcom,edma";
+		reg = <0x3ab00000 0x76900>;
+		reg-names = "edma-reg-base";
+		qcom,txdesc-ring-start = <23>;
+		qcom,txdesc-rings = <1>;
+		qcom,txcmpl-ring-start = <7>;
+		qcom,txcmpl-rings = <1>;
+		qcom,rxfill-ring-start = <7>;
+		qcom,rxfill-rings = <1>;
+		qcom,rxdesc-ring-start = <15>;
+		qcom,rxdesc-rings = <1>;
+		interrupts = <GIC_SPI 345 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 361 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 344 IRQ_TYPE_LEVEL_HIGH>;
+		resets = <&gcc GCC_EDMA_HW_RESET>;
+		reset-names = "edma_rst";
+		status = "disabled";
+	};
+
+	dp1: dp1 {
+		device_type = "network";
+		compatible = "qcom,nss-dp";
+		qcom,id = <1>;
+		reg = <0x3a001000 0x200>;
+		qcom,mactype = <0>;
+		local-mac-address = [000000000000];
+		phy-mode = "sgmii";
+		status = "disabled";
+	};
+
+	dp2: dp2 {
+		device_type = "network";
+		compatible = "qcom,nss-dp";
+		qcom,id = <2>;
+		reg = <0x3a001200 0x200>;
+		qcom,mactype = <0>;
+		local-mac-address = [000000000000];
+		phy-mode = "sgmii";
+		status = "disabled";
+	};
+
+	dp3: dp3 {
+		device_type = "network";
+		compatible = "qcom,nss-dp";
+		qcom,id = <3>;
+		reg = <0x3a001400 0x200>;
+		qcom,mactype = <0>;
+		local-mac-address = [000000000000];
+		phy-mode = "sgmii";
+		status = "disabled";
+	};
+
+	dp4: dp4 {
+		device_type = "network";
+		compatible = "qcom,nss-dp";
+		qcom,id = <4>;
+		reg = <0x3a001600 0x200>;
+		qcom,mactype = <0>;
+		local-mac-address = [000000000000];
+		phy-mode = "sgmii";
+		status = "disabled";
+	};
+
+	dp5: dp5 {
+		device_type = "network";
+		compatible = "qcom,nss-dp";
+		qcom,id = <5>;
+		reg = <0x3a001800 0x200>;
+		qcom,mactype = <0>;
+		local-mac-address = [000000000000];
+		phy-mode = "sgmii";
+		status = "disabled";
+	};
+
+	dp6: dp6 {
+		device_type = "network";
+		compatible = "qcom,nss-dp";
+		qcom,id = <6>;
+		reg = <0x3a001a00 0x200>;
+		qcom,mactype = <0>;
+		local-mac-address = [000000000000];
+		phy-mode = "sgmii";
+		status = "disabled";
+	};
+
+	dp5_syn: dp5-syn {
+		device_type = "network";
+		compatible = "qcom,nss-dp";
+		qcom,id = <5>;
+		reg = <0x3a003000 0x3fff>;
+		qcom,mactype = <1>;
+		local-mac-address = [000000000000];
+		phy-mode = "sgmii";
+		status = "disabled";
+	};
+
+	dp6_syn: dp6-syn {
+		device_type = "network";
+		compatible = "qcom,nss-dp";
+		qcom,id = <6>;
+		reg = <0x3a007000 0x3fff>;
+		qcom,mactype = <1>;
+		local-mac-address = [000000000000];
+		phy-mode = "sgmii";
+		status = "disabled";
+	};
+};
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-hk-cpu.dtsi b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-hk-cpu.dtsi
new file mode 100644
index 00000000000000..37af7bbc1f78c2
--- /dev/null
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-hk-cpu.dtsi
@@ -0,0 +1,188 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <dt-bindings/thermal/thermal.h>
+#include "ipq8074-cpr-regulator.dtsi"
+
+&CPU0 {
+	cpu-supply = <&apc_vreg>;
+	voltage-tolerance = <1>;
+};
+
+&CPU1 {
+	cpu-supply = <&apc_vreg>;
+	voltage-tolerance = <1>;
+};
+
+&CPU2 {
+	cpu-supply = <&apc_vreg>;
+	voltage-tolerance = <1>;
+};
+
+&CPU3 {
+	cpu-supply = <&apc_vreg>;
+	voltage-tolerance = <1>;
+};
+&cpu0_thermal {
+	trips {
+		cpu0_passive_low: cpu-passive-low {
+			temperature = <95000>;
+			hysteresis = <2000>;
+			type = "passive";
+		};
+
+		cpu0_passive_high: cpu-passive-high {
+			temperature = <100000>;
+			hysteresis = <2000>;
+			type = "passive";
+		};
+	};
+
+	cooling-maps {
+		map0 {
+			trip = <&cpu0_passive_low>;
+			cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+		};
+		map1 {
+			trip = <&cpu0_passive_high>;
+			cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+		};
+	};
+};
+
+&cpu1_thermal {
+	trips {
+		cpu1_passive_low: cpu-passive-low {
+			temperature = <95000>;
+			hysteresis = <2000>;
+			type = "passive";
+		};
+
+		cpu1_passive_high: cpu-passive-high {
+			temperature = <100000>;
+			hysteresis = <2000>;
+			type = "passive";
+		};
+	};
+
+	cooling-maps {
+		map0 {
+			trip = <&cpu1_passive_low>;
+			cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+		};
+		map1 {
+			trip = <&cpu1_passive_high>;
+			cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+		};
+	};
+};
+
+&cpu2_thermal {
+	trips {
+		cpu2_passive_low: cpu-passive-low {
+			temperature = <95000>;
+			hysteresis = <2000>;
+			type = "passive";
+		};
+
+		cpu2_passive_high: cpu-passive-high {
+			temperature = <100000>;
+			hysteresis = <2000>;
+			type = "passive";
+		};
+	};
+
+	cooling-maps {
+		map0 {
+			trip = <&cpu2_passive_low>;
+			cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+		};
+		map1 {
+			trip = <&cpu2_passive_high>;
+			cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+		};
+	};
+};
+
+&cpu3_thermal {
+	trips {
+		cpu3_passive_low: cpu-passive-low {
+			temperature = <95000>;
+			hysteresis = <2000>;
+			type = "passive";
+		};
+
+		cpu3_passive_high: cpu-passive-high {
+			temperature = <100000>;
+			hysteresis = <2000>;
+			type = "passive";
+		};
+	};
+
+	cooling-maps {
+		map0 {
+			trip = <&cpu3_passive_low>;
+			cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+		};
+		map1 {
+			trip = <&cpu3_passive_high>;
+			cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+		};
+	};
+};
+
+&cluster_thermal {
+	trips {
+		cluster_passive_low: cluster-passive {
+			temperature = <95000>;
+			hysteresis = <2000>;
+			type = "passive";
+		};
+
+		cluster_passive_high: cluster-passive-high {
+			temperature = <100000>;
+			hysteresis = <2000>;
+			type = "passive";
+		};
+	};
+
+	cooling-maps {
+		map0 {
+			trip = <&cluster_passive_low>;
+			cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+		};
+		map1 {
+			trip = <&cluster_passive_high>;
+			cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>,
+					 <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+		};
+	};
+};
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-nbg7815.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-nbg7815.dts
new file mode 100644
index 00000000000000..d113b233ecf970
--- /dev/null
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-nbg7815.dts
@@ -0,0 +1,445 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/*
+ * Copyright (c) 2022, Karol Przybylski <itor@o2.pl>
+ * Copyright (c) 2023, Andre Valentin <avalentin@marcant.net>
+ */
+
+/dts-v1/;
+
+#include "ipq8074.dtsi"
+#include "ipq8074-hk-cpu.dtsi"
+#include "ipq8074-ess.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/input/input.h>
+
+
+/ {
+	model = "Zyxel NBG7815";
+	compatible = "zyxel,nbg7815", "qcom,ipq8074";
+
+	aliases {
+		serial0 = &blsp1_uart5;
+		serial1 = &blsp1_uart3;
+		/* Alias as required by u-boot to patch MAC addresses */
+		ethernet0 = &dp1;
+		label-mac-device = &dp1;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&tlmm 54 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&tlmm {
+	mdio_pins: mdio-pins {
+		mdc {
+			pins = "gpio68";
+			function = "mdc";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		mdio {
+			pins = "gpio69";
+			function = "mdio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+};
+
+
+&blsp1_uart3 {
+	status = "okay";
+};
+
+&blsp1_uart5 {
+	status = "okay";
+};
+
+&prng {
+	status = "okay";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+
+&blsp1_spi1 {
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+	cs-gpios = <0>;
+	status = "okay";
+
+	/*
+	 * Bootloader will find the NAND DT node by the compatible and
+	 * then "fixup" it by adding the partitions from the SMEM table
+	 * using the legacy bindings thus making it impossible for us
+	 * to change the partition table or utilize NVMEM for calibration.
+	 * So add a dummy partitions node that bootloader will populate
+	 * and set it as disabled so the kernel ignores it instead of
+	 * printing warnings due to the broken way bootloader adds the
+	 * partitions.
+	 */
+	partitions {
+		status = "disabled";
+	};
+
+
+	flash@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+		compatible = "jedec,spi-nor";
+		spi-max-frequency = <50000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "0:sbl1";
+				reg = <0x0 0x50000>;
+				read-only;
+			};
+
+			partition@50000 {
+				label = "0:mibib";
+				reg = <0x50000 0x10000>;
+				read-only;
+			};
+
+			partition@60000 {
+				label = "0:bootconfig";
+				reg = <0x60000 0x20000>;
+				read-only;
+			};
+
+			partition@80000 {
+				label = "0:bootconfig1";
+				reg = <0x80000 0x20000>;
+				read-only;
+			};
+
+			partition@a0000 {
+				label = "0:qsee";
+				reg = <0xa0000 0x180000>;
+				read-only;
+			};
+
+			partition@220000 {
+				label = "0:qsee_1";
+				reg = <0x220000 0x180000>;
+				read-only;
+			};
+
+			partition@3a0000 {
+				label = "0:devcfg";
+				reg = <0x3a0000 0x10000>;
+				read-only;
+			};
+
+			partition@3b0000 {
+				label = "0:devcfg_1";
+				reg = <0x3b0000 0x10000>;
+				read-only;
+			};
+
+			partition@3c0000 {
+				label = "0:apdp";
+				reg = <0x3c0000 0x10000>;
+				read-only;
+			};
+
+			partition@3d0000 {
+				label = "0:apdp_1";
+				reg = <0x3d0000 0x10000>;
+				read-only;
+			};
+
+			partition@3e0000 {
+				label = "0:rpm";
+				reg = <0x3e0000 0x40000>;
+				read-only;
+			};
+
+			partition@420000 {
+				label = "0:rpm_1";
+				reg = <0x420000 0x40000>;
+				read-only;
+			};
+
+			partition@460000 {
+				label = "0:cdt";
+				reg = <0x460000 0x10000>;
+				read-only;
+			};
+
+			partition@470000 {
+				label = "0:cdt_1";
+				reg = <0x470000 0x10000>;
+				read-only;
+			};
+
+			partition@480000 {
+				label = "0:appsbl";
+				reg = <0x480000 0xc0000>;
+				read-only;
+			};
+
+			partition@540000 {
+				label = "0:appsbl_1";
+				reg = <0x540000 0xc0000>;
+				read-only;
+			};
+
+			partition@600000 {
+				compatible = "u-boot,env";
+				label = "0:appsblenv";
+				reg = <0x600000 0x10000>;
+
+				macaddr_lan: ethaddr {
+					#nvmem-cell-cells = <1>;
+				};
+			};
+
+			partition@610000 {
+				label = "0:art";
+				reg = <0x610000 0x40000>;
+				read-only;
+			};
+
+			partition@650000 {
+				label = "0:ethphyfw";
+				reg = <0x650000 0x80000>;
+				read-only;
+			};
+
+			partition@6d0000 {
+				label = "0:crt";
+				reg = <0x6d0000 0x10000>;
+				read-only;
+			};
+
+			partition@6e0000 {
+				label = "dual_flag";
+				reg = <0x6e0000 0x10000>;
+			};
+
+			partition@6f0000 {
+				label = "reserved";
+				reg = <0x6f0000 0x110000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&mdio {
+	status = "okay";
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	reset-gpios = <&tlmm 37 GPIO_ACTIVE_LOW>;
+
+	qca8075_1: ethernet-phy@0 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <0>;
+	};
+
+	qca8075_2: ethernet-phy@1 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <1>;
+	};
+
+	qca8075_3: ethernet-phy@2 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <2>;
+	};
+
+	qca8075_4: ethernet-phy@3 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <3>;
+	};
+
+	qca8081: ethernet-phy@4{
+		compatible = "ethernet-phy-id004d.d101";
+		reg = <28>;
+		reset-gpios = <&tlmm 31 GPIO_ACTIVE_LOW>;
+	};
+
+	aqr113c: ethernet-phy@5 {
+		compatible = "ethernet-phy-ieee802.3-c45";
+		reg = <8>;
+		reset-gpios = <&tlmm 63 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&switch {
+	status = "okay";
+
+	switch_cpu_bmp = <0x1>;
+	switch_lan_bmp = <0x3e>;
+	switch_wan_bmp = <0x40>;
+	switch_mac_mode = <0x0>;
+	switch_mac_mode1 = <0xf>;
+	switch_mac_mode2 = <0xd>;
+	bm_tick_mode = <0>;
+	tm_tick_mode = <0>;
+
+	qcom,port_phyinfo {
+		port@0 {
+			port_id = <1>;
+			phy_address = <0>;
+		};
+
+		port@1 {
+			port_id = <2>;
+			phy_address = <1>;
+		};
+
+		port@2 {
+			port_id = <3>;
+			phy_address = <2>;
+		};
+
+		port@3 {
+			port_id = <4>;
+			phy_address = <3>;
+		};
+
+		port@4 {
+			port_id = <5>;
+			phy_address = <28>;
+			port_mac_sel = "QGMAC_PORT";
+		};
+
+		port@5 {
+			port_id = <6>;
+			ethernet-phy-ieee802.3-c45;
+			phy_address = <8>;
+		};
+	};
+};
+
+&edma {
+	status = "okay";
+};
+
+&dp1 {
+	status = "okay";
+	phy-handle = <&qca8075_1>;
+	label = "lan1";
+	nvmem-cells = <&macaddr_lan 0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&dp2 {
+	status = "okay";
+	phy-handle = <&qca8075_2>;
+	label = "lan2";
+	nvmem-cells = <&macaddr_lan 0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&dp3 {
+	status = "okay";
+	phy-handle = <&qca8075_3>;
+	label = "lan3";
+	nvmem-cells = <&macaddr_lan 0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&dp4 {
+	status = "okay";
+	phy-handle = <&qca8075_4>;
+	label = "lan4";
+	nvmem-cells = <&macaddr_lan 0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&dp5 {
+	status = "okay";
+	phy-handle = <&qca8081>;
+	label = "wan";
+	nvmem-cells = <&macaddr_lan 1>;
+	nvmem-cell-names = "mac-address";
+};
+
+&dp6_syn {
+	status = "okay";
+	phy-handle = <&aqr113c>;
+	label = "10g";
+	nvmem-cells = <&macaddr_lan 0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&blsp1_i2c2 {
+	pinctrl-0 = <&i2c_0_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+
+	tmp103@70 {
+		compatible = "ti,tmp103";
+		reg = <0x70>;
+	};
+};
+
+&sdhc_1 {
+	status = "okay";
+	/* unstable, problem with the hs400 > h200 speed switch */
+	/delete-property/ mmc-hs400-1_8v;
+	mmc-hs200-1_8v;
+	mmc-ddr-1_8v;
+	vqmmc-supply = <&l11>;
+};
+
+&ssphy_0 {
+	status = "okay";
+};
+
+&qusb_phy_0 {
+	status = "okay";
+};
+
+&ssphy_1 {
+	status = "okay";
+};
+
+&qusb_phy_1 {
+	status = "okay";
+};
+
+&usb_0 {
+	status = "okay";
+};
+
+&usb_1 {
+	status = "okay";
+};
+
+&wifi {
+	status = "okay";
+
+	qcom,ath11k-calibration-variant = "Zyxel-NBG7815";
+};
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-wxr-5950ax12.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-wxr-5950ax12.dts
new file mode 100644
index 00000000000000..32386dc93e0718
--- /dev/null
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-wxr-5950ax12.dts
@@ -0,0 +1,376 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+
+#include "ipq8074.dtsi"
+#include "ipq8074-hk-cpu.dtsi"
+#include "ipq8074-ess.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Buffalo WXR-5950AX12";
+	compatible = "buffalo,wxr-5950ax12", "qcom,ipq8074";
+
+	aliases {
+		serial0 = &blsp1_uart5;
+		led-boot = &led_power_white;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_white;
+		led-upgrade = &led_power_white;
+		label-mac-device = &dp5_syn;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs-append = " ubi.mtd=user_property root=/dev/ubiblock1_0";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			label = "white:router";
+			gpios = <&tlmm 21 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_WHITE>;
+		};
+
+		led-1 {
+			label = "red:router";
+			gpios = <&tlmm 22 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_RED>;
+		};
+
+		led_power_red: led-2 {
+			label = "red:power";
+			gpios = <&tlmm 31 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_POWER;
+		};
+
+		led_power_white: led-3 {
+			label = "white:power";
+			gpios = <&tlmm 34 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_WHITE>;
+			function = LED_FUNCTION_POWER;
+		};
+
+		led-4 {
+			label = "white:internet";
+			gpios = <&tlmm 43 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_WHITE>;
+		};
+
+		led-5 {
+			label = "red:internet";
+			gpios = <&tlmm 44 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_RED>;
+		};
+
+		led-6 {
+			label = "red:wireless";
+			gpios = <&tlmm 55 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WLAN;
+		};
+
+		led-7 {
+			label = "white:wireless";
+			gpios = <&tlmm 56 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_WHITE>;
+			function = LED_FUNCTION_WLAN;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		/*
+		 * mode: 3x position switch
+		 *
+		 * - ROUTER
+		 * - AP
+		 * - WB (Wireless Bridge)
+		 */
+		ap {
+			label = "mode-ap";
+			gpios = <&tlmm 29 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+		};
+
+		bridge {
+			label = "mode-wb";
+			gpios = <&tlmm 30 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_1>;
+		};
+
+		/*
+		 * op: 2x position switch
+		 *
+		 * - AUTO
+		 * - MANUAL (select Router/AP/WB manually)
+		 */
+		manual {
+			label = "op-manual";
+			gpios = <&tlmm 52 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_2>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&tlmm 51 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	reg_usb_vbus: regulator-5v-vbus {
+		compatible = "regulator-fixed";
+		regulator-name = "vbus";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		gpio = <&tlmm 64 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+		regulator-always-on;
+	};
+};
+
+&tlmm {
+	mdio_pins: mdio-pins {
+		mdc {
+			pins = "gpio68";
+			function = "mdc";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		mdio {
+			pins = "gpio69";
+			function = "mdio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+};
+
+&blsp1_uart5 {
+	status = "okay";
+};
+
+&prng {
+	status = "okay";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&qpic_nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		nand-ecc-strength = <4>;
+		nand-ecc-step-size = <512>;
+		nand-bus-width = <8>;
+
+		partitions {
+			compatible = "qcom,smem-part";
+
+			partition-0-appsblenv {
+				compatible = "fixed-partitions";
+				label = "0:appsblenv";
+				read-only;
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				partition@0 {
+					compatible = "u-boot,env";
+					label = "env-data";
+					reg = <0x0 0x40000>;
+
+					macaddr_appsblenv_ethaddr: ethaddr {
+					};
+				};
+			};
+		};
+	};
+};
+
+&mdio {
+	status = "okay";
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	/*
+	 * RESET pins of phy chips
+	 *
+	 * WXR-5950AX12 has 2x RESET pins for QCA8075 and AQR113C.
+	 * The pin of QCA8075 is for the chip and not phys in the chip, the
+	 * pin of AQR113C is for 2x chips. So both pins are not appropriate
+	 * to declare them as reset-gpios in phy nodes.
+	 * Multiple entries in reset-gpios of mdio may not be supported, but
+	 * leave the following as-is to show that the those reset pin exists.
+	 */
+	reset-gpios = <&tlmm 37 GPIO_ACTIVE_LOW>, /* QCA8075 RESET */
+		      <&tlmm 63 GPIO_ACTIVE_LOW>; /* AQR113C RESET (2x) */
+
+	aqr113c_1: ethernet-phy@0 {
+		compatible = "ethernet-phy-ieee802.3-c45";
+		reg = <0x0>;
+	};
+
+	aqr113c_2: ethernet-phy@8 {
+		compatible = "ethernet-phy-ieee802.3-c45";
+		reg = <0x8>;
+	};
+
+	qca8075_1: ethernet-phy@18 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <0x18>;
+	};
+
+	qca8075_2: ethernet-phy@19 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <0x19>;
+	};
+
+	qca8075_3: ethernet-phy@1a {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <0x1a>;
+	};
+
+	qca8075_4: ethernet-phy@1b {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <0x1b>;
+	};
+
+	qca8075_5: ethernet-phy@1c {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <0x1c>;
+	};
+};
+
+&switch {
+	status = "okay";
+
+	switch_cpu_bmp = <0x1>;
+	switch_lan_bmp = <0x3e>;
+	switch_wan_bmp = <0x40>;
+	switch_mac_mode = <0xb>;
+	switch_mac_mode1 = <0xd>;
+	switch_mac_mode2 = <0xd>;
+	bm_tick_mode = <0>;
+	tm_tick_mode = <0>;
+
+	qcom,port_phyinfo {
+		port@0 {
+			port_id = <1>;
+			phy_address = <0x18>;
+		};
+
+		port@1 {
+			port_id = <2>;
+			phy_address = <0x19>;
+		};
+
+		port@2 {
+			port_id = <3>;
+			phy_address = <0x1a>;
+		};
+
+		port@3 {
+			port_id = <4>;
+			phy_address = <0x1b>;
+		};
+
+		port@4 {
+			port_id = <5>;
+			ethernet-phy-ieee802.3-c45;
+			phy_address = <0x0>;
+		};
+
+		port@5 {
+			port_id = <6>;
+			ethernet-phy-ieee802.3-c45;
+			phy_address = <0x8>;
+		};
+	};
+};
+
+&edma {
+	status = "okay";
+};
+
+&dp2 {
+	status = "okay";
+	phy-handle = <&qca8075_2>;
+	label = "lan4";
+	nvmem-cells = <&macaddr_appsblenv_ethaddr>;
+	nvmem-cell-names = "mac-address";
+};
+
+&dp3 {
+	status = "okay";
+	phy-handle = <&qca8075_3>;
+	label = "lan3";
+	nvmem-cells = <&macaddr_appsblenv_ethaddr>;
+	nvmem-cell-names = "mac-address";
+};
+
+&dp4 {
+	status = "okay";
+	phy-handle = <&qca8075_4>;
+	label = "lan2";
+	nvmem-cells = <&macaddr_appsblenv_ethaddr>;
+	nvmem-cell-names = "mac-address";
+};
+
+&dp5_syn {
+	status = "okay";
+	phy-handle = <&aqr113c_1>;
+	label = "wan";
+	nvmem-cells = <&macaddr_appsblenv_ethaddr>;
+	nvmem-cell-names = "mac-address";
+};
+
+&dp6_syn {
+	status = "okay";
+	phy-handle = <&aqr113c_2>;
+	label = "lan1";
+	nvmem-cells = <&macaddr_appsblenv_ethaddr>;
+	nvmem-cell-names = "mac-address";
+};
+
+&ssphy_0 {
+	status = "okay";
+};
+
+&qusb_phy_0 {
+	status = "okay";
+};
+
+&usb_0 {
+	status = "okay";
+
+	vbus-supply = <&reg_usb_vbus>;
+};
+
+&wifi {
+	status = "okay";
+
+	qcom,ath11k-calibration-variant = "Buffalo-WXR-5950AX12";
+};
diff --git a/target/linux/qualcommax/image/Makefile b/target/linux/qualcommax/image/Makefile
new file mode 100644
index 00000000000000..f59ad0c15fdb1c
--- /dev/null
+++ b/target/linux/qualcommax/image/Makefile
@@ -0,0 +1,17 @@
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/image.mk
+
+define Device/Default
+	PROFILES := Default
+	KERNEL_LOADADDR := 0x41000000
+	DEVICE_DTS = $$(SOC)-$(lastword $(subst _, ,$(1)))
+	DEVICE_DTS_CONFIG := config@1
+	DEVICE_DTS_DIR := $(DTS_DIR)/qcom
+	IMAGES := sysupgrade.bin
+	IMAGE/sysupgrade.bin = sysupgrade-tar | append-metadata
+	IMAGE/sysupgrade.bin/squashfs :=
+endef
+
+include $(SUBTARGET).mk
+
+$(eval $(call BuildImage))
diff --git a/target/linux/qualcommax/image/ipq807x.mk b/target/linux/qualcommax/image/ipq807x.mk
new file mode 100644
index 00000000000000..54f8caf5d7a2a2
--- /dev/null
+++ b/target/linux/qualcommax/image/ipq807x.mk
@@ -0,0 +1,189 @@
+define Device/FitImage
+	KERNEL_SUFFIX := -uImage.itb
+	KERNEL = kernel-bin | libdeflate-gzip | fit gzip $$(KDIR)/image-$$(DEVICE_DTS).dtb
+	KERNEL_NAME := Image
+endef
+
+define Device/FitImageLzma
+	KERNEL_SUFFIX := -uImage.itb
+	KERNEL = kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(DEVICE_DTS).dtb
+	KERNEL_NAME := Image
+endef
+
+define Device/EmmcImage
+	IMAGES += factory.bin sysupgrade.bin
+	IMAGE/factory.bin := append-rootfs | pad-rootfs | pad-to 64k
+	IMAGE/sysupgrade.bin/squashfs := append-rootfs | pad-to 64k | sysupgrade-tar rootfs=$$$$@ | append-metadata
+endef
+
+define Device/UbiFit
+	KERNEL_IN_UBI := 1
+	IMAGES := factory.ubi sysupgrade.bin
+	IMAGE/factory.ubi := append-ubi
+	IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+
+define Device/buffalo_wxr-5950ax12
+	$(call Device/FitImage)
+	DEVICE_VENDOR := Buffalo
+	DEVICE_MODEL := WXR-5950AX12
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@hk01
+	SOC := ipq8074
+	IMAGES := sysupgrade.bin
+	IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+	DEVICE_PACKAGES := ipq-wifi-buffalo_wxr-5950ax12
+endef
+TARGET_DEVICES += buffalo_wxr-5950ax12
+
+define Device/compex_wpq873
+       $(call Device/FitImage)
+       $(call Device/UbiFit)
+       DEVICE_VENDOR := Compex
+       DEVICE_MODEL := WPQ873
+       BLOCKSIZE := 128k
+       PAGESIZE := 2048
+       DEVICE_DTS_CONFIG := config@hk09.wpq873
+       SOC := ipq8072
+       DEVICE_PACKAGES := ipq-wifi-compex_wpq873
+       IMAGE/factory.ubi := append-ubi | qsdk-ipq-factory-nand
+endef
+TARGET_DEVICES += compex_wpq873
+
+define Device/dynalink_dl-wrx36
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Dynalink
+	DEVICE_MODEL := DL-WRX36
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@rt5010w-d350-rev0
+	SOC := ipq8072
+	DEVICE_PACKAGES := ipq-wifi-dynalink_dl-wrx36
+endef
+TARGET_DEVICES += dynalink_dl-wrx36
+
+define Device/edgecore_eap102
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Edgecore
+	DEVICE_MODEL := EAP102
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@ac02
+	SOC := ipq8071
+	DEVICE_PACKAGES := ipq-wifi-edgecore_eap102
+	IMAGE/factory.ubi := append-ubi | qsdk-ipq-factory-nand
+endef
+TARGET_DEVICES += edgecore_eap102
+
+define Device/edimax_cax1800
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Edimax
+	DEVICE_MODEL := CAX1800
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@ac03
+	SOC := ipq8070
+	DEVICE_PACKAGES := ipq-wifi-edimax_cax1800
+endef
+TARGET_DEVICES += edimax_cax1800
+
+define Device/netgear_wax218
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	ARTIFACTS := web-ui-factory.fit
+	DEVICE_VENDOR := Netgear
+	DEVICE_MODEL := WAX218
+	DEVICE_DTS_CONFIG := config@hk07
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	SOC := ipq8072
+	ARTIFACT/web-ui-factory.fit := append-image initramfs-uImage.itb | \
+		ubinize-kernel | qsdk-ipq-factory-nand
+	DEVICE_PACKAGES := kmod-spi-gpio kmod-spi-bitbang kmod-gpio-nxp-74hc164 \
+		ipq-wifi-netgear_wax218
+endef
+TARGET_DEVICES += netgear_wax218
+
+define Device/prpl_haze
+	$(call Device/FitImage)
+	$(call Device/EmmcImage)
+	DEVICE_VENDOR := prpl Foundation
+	DEVICE_MODEL := Haze
+	DEVICE_DTS_CONFIG := config@hk09
+	SOC := ipq8072
+	DEVICE_PACKAGES += ath11k-firmware-qcn9074 ipq-wifi-prpl_haze kmod-ath11k-pci
+endef
+TARGET_DEVICES += prpl_haze
+
+define Device/qnap_301w
+	$(call Device/FitImage)
+	$(call Device/EmmcImage)
+	DEVICE_VENDOR := QNAP
+	DEVICE_MODEL := 301w
+	DEVICE_DTS_CONFIG := config@hk01
+	KERNEL_SIZE := 16384k
+	SOC := ipq8072
+	DEVICE_PACKAGES += ipq-wifi-qnap_301w
+endef
+TARGET_DEVICES += qnap_301w
+
+define Device/redmi_ax6
+	$(call Device/xiaomi_ax3600)
+	DEVICE_VENDOR := Redmi
+	DEVICE_MODEL := AX6
+	DEVICE_PACKAGES := ipq-wifi-redmi_ax6
+endef
+TARGET_DEVICES += redmi_ax6
+
+define Device/xiaomi_ax3600
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Xiaomi
+	DEVICE_MODEL := AX3600
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@ac04
+	SOC := ipq8071
+	KERNEL_SIZE := 36608k
+	DEVICE_PACKAGES := ipq-wifi-xiaomi_ax3600 kmod-ath10k-ct-smallbuffers ath10k-firmware-qca9887-ct
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+	ARTIFACTS := initramfs-factory.ubi
+	ARTIFACT/initramfs-factory.ubi := append-image-stage initramfs-uImage.itb | ubinize-kernel
+endif
+endef
+TARGET_DEVICES += xiaomi_ax3600
+
+define Device/xiaomi_ax9000
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Xiaomi
+	DEVICE_MODEL := AX9000
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@hk14
+	SOC := ipq8072
+	KERNEL_SIZE := 57344k
+	DEVICE_PACKAGES := ipq-wifi-xiaomi_ax9000 kmod-ath11k-pci ath11k-firmware-qcn9074 \
+	kmod-ath10k-ct ath10k-firmware-qca9887-ct
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+	ARTIFACTS := initramfs-factory.ubi
+	ARTIFACT/initramfs-factory.ubi := append-image-stage initramfs-uImage.itb | ubinize-kernel
+endif
+endef
+TARGET_DEVICES += xiaomi_ax9000
+
+define Device/zyxel_nbg7815
+	$(call Device/FitImage)
+	$(call Device/EmmcImage)
+	DEVICE_VENDOR := ZYXEL
+	DEVICE_MODEL := NBG7815
+	DEVICE_DTS_CONFIG := config@nbg7815
+	SOC := ipq8074
+	DEVICE_PACKAGES += ipq-wifi-zyxel_nbg7815 kmod-ath11k-pci kmod-hwmon-tmp103 \
+		kmod-bluetooth
+endef
+TARGET_DEVICES += zyxel_nbg7815
diff --git a/target/linux/qualcommax/ipq807x/base-files/etc/board.d/01_leds b/target/linux/qualcommax/ipq807x/base-files/etc/board.d/01_leds
new file mode 100644
index 00000000000000..a89b4c15643d8c
--- /dev/null
+++ b/target/linux/qualcommax/ipq807x/base-files/etc/board.d/01_leds
@@ -0,0 +1,33 @@
+
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+board=$(board_name)
+
+case "$board" in
+edgecore,eap102)
+	ucidef_set_led_netdev "wan" "WAN" "green:wanpoe" "wan"
+	;;
+netgear,wax218)
+	ucidef_set_led_netdev "lan" "LAN" "blue:lan" "lan"
+	ucidef_set_led_wlan "wlan5g" "WIFI 5GHz" "blue:wlan5g" "phy0radio"
+	ucidef_set_led_wlan "wlan2g" "WIFI 2.4GHz" "blue:wlan2g" "phy1radio"
+	;;
+redmi,ax6|\
+xiaomi,ax3600)
+	ucidef_set_led_netdev "wan" "WAN" "blue:network" "wan"
+	;;
+qnap,301w)
+	ucidef_set_led_netdev "lan1" "LAN1" "green:lan1" "lan1"
+	ucidef_set_led_netdev "lan2" "LAN2" "green:lan2" "lan2"
+	ucidef_set_led_netdev "lan3" "LAN3" "green:lan3" "lan3"
+	ucidef_set_led_netdev "lan4" "LAN4" "green:lan4" "lan4"
+	ucidef_set_led_netdev "10G_1" "10G_1" "green:10g_1" "10g-1"
+	ucidef_set_led_netdev "10G_2" "10G_2" "green:10g_2" "10g-2"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/qualcommax/ipq807x/base-files/etc/board.d/02_network b/target/linux/qualcommax/ipq807x/base-files/etc/board.d/02_network
new file mode 100644
index 00000000000000..8175a99f97ee17
--- /dev/null
+++ b/target/linux/qualcommax/ipq807x/base-files/etc/board.d/02_network
@@ -0,0 +1,53 @@
+#
+# Copyright (c) 2015 The Linux Foundation. All rights reserved.
+# Copyright (c) 2011-2015 OpenWrt.org
+#
+
+. /lib/functions/uci-defaults.sh
+. /lib/functions/system.sh
+
+ipq807x_setup_interfaces()
+{
+	local board="$1"
+
+	case "$board" in
+	buffalo,wxr-5950ax12|\
+	dynalink,dl-wrx36|\
+	xiaomi,ax9000)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" "wan"
+		;;
+	edgecore,eap102)
+		ucidef_set_interfaces_lan_wan "lan" "wan"
+		;;
+	edimax,cax1800)
+		ucidef_set_interfaces_lan_wan "lan"
+		;;
+	netgear,wax218)
+		ucidef_set_interface_lan "lan" "dhcp"
+		;;
+	prpl,haze)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" "wan"
+		;;
+	qnap,301w)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4 10g-2" "10g-1"
+		;;
+	compex,wpq873|\
+	redmi,ax6|\
+	xiaomi,ax3600)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" "wan"
+		;;
+	zyxel,nbg7815)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4 10g" "wan"
+		;;
+	*)
+		echo "Unsupported hardware. Network interfaces not initialized"
+		;;
+	esac
+}
+
+board_config_update
+board=$(board_name)
+ipq807x_setup_interfaces $board
+board_config_flush
+
+exit 0
diff --git a/target/linux/qualcommax/ipq807x/base-files/etc/hotplug.d/firmware/11-ath11k-caldata b/target/linux/qualcommax/ipq807x/base-files/etc/hotplug.d/firmware/11-ath11k-caldata
new file mode 100644
index 00000000000000..f9315573ec4191
--- /dev/null
+++ b/target/linux/qualcommax/ipq807x/base-files/etc/hotplug.d/firmware/11-ath11k-caldata
@@ -0,0 +1,44 @@
+#!/bin/sh
+
+[ -e /lib/firmware/$FIRMWARE ] && exit 0
+
+. /lib/functions/caldata.sh
+
+board=$(board_name)
+
+case "$FIRMWARE" in
+"ath11k/IPQ8074/hw2.0/cal-ahb-c000000.wifi.bin")
+	case "$board" in
+	buffalo,wxr-5950ax12|\
+	compex,wpq873|\
+	edgecore,eap102|\
+	edimax,cax1800|\
+	dynalink,dl-wrx36|\
+	netgear,wax218|\
+	qnap,301w|\
+	redmi,ax6|\
+	xiaomi,ax3600|\
+	xiaomi,ax9000|\
+	zyxel,nbg7815)
+		caldata_extract "0:art" 0x1000 0x20000
+		;;
+	prpl,haze)
+                caldata_extract_mmc "0:ART" 0x1000 0x20000
+		;;
+	esac
+	;;
+"ath11k/QCN9074/hw1.0/cal-pci-0000:01:00.0.bin"|\
+"ath11k/QCN9074/hw1.0/cal-pci-0001:01:00.0.bin")
+	case "$board" in
+	prpl,haze)
+                caldata_extract_mmc "0:ART" 0x26800 0x20000
+		;;
+	xiaomi,ax9000)
+		caldata_extract "0:art" 0x26800 0x20000
+		;;
+	esac
+	;;
+*)
+	exit 1
+	;;
+esac
diff --git a/target/linux/qualcommax/ipq807x/base-files/etc/init.d/bootcount b/target/linux/qualcommax/ipq807x/base-files/etc/init.d/bootcount
new file mode 100644
index 00000000000000..6917446a9bb5df
--- /dev/null
+++ b/target/linux/qualcommax/ipq807x/base-files/etc/init.d/bootcount
@@ -0,0 +1,13 @@
+#!/bin/sh /etc/rc.common
+
+START=99
+
+boot() {
+	case $(board_name) in
+	edgecore,eap102)
+		fw_setenv upgrade_available 0
+		# Unset changed flag after sysupgrade complete
+		fw_setenv changed
+	;;
+	esac
+}
diff --git a/target/linux/qualcommax/ipq807x/base-files/lib/upgrade/buffalo.sh b/target/linux/qualcommax/ipq807x/base-files/lib/upgrade/buffalo.sh
new file mode 100644
index 00000000000000..d0ed258890f921
--- /dev/null
+++ b/target/linux/qualcommax/ipq807x/base-files/lib/upgrade/buffalo.sh
@@ -0,0 +1,55 @@
+. /lib/functions.sh
+
+# Prepare UBI devices for OpenWrt installation
+# - rootfs (mtd22)
+#   - remove "ubi_rootfs" volume (rootfs on stock)
+#   - remove "fw_hash" volume (firmware hash)
+# - user_property (mtd24)
+#   - remove "user_property_ubi" volume (user configuration)
+#   - remove "extra_property" volume (gzipped syslog)
+buffalo_upgrade_prepare() {
+	local ubi_rootdev ubi_propdev
+
+	if ! ubi_rootdev="$(nand_attach_ubi rootfs)" || \
+	   ! ubi_propdev="$(nand_attach_ubi user_property)"; then
+		echo "failed to attach UBI volume \"rootfs\" or \"user_property\", rebooting..."
+		reboot -f
+	fi
+
+	ubirmvol /dev/$ubi_rootdev -N ubi_rootfs &> /dev/null || true
+	ubirmvol /dev/$ubi_rootdev -N fw_hash &> /dev/null || true
+
+	ubirmvol /dev/$ubi_propdev -N user_property_ubi &> /dev/null || true
+	ubirmvol /dev/$ubi_propdev -N extra_property &> /dev/null || true
+}
+
+# Re-create small dummy ubi_rootfs volume and update
+# fw_hash volume to pass the checking by U-Boot
+# - rootfs (mtd22)
+#   - re-create "ubi_rootfs" volume
+#   - re-create and update "fw_hash" volume
+# - rootfs_recover (mtd23)
+#   - update "fw_hash" volume
+buffalo_upgrade_optvol() {
+	local ubi_rootdev ubi_rcvrdev
+	local hashvol_root hashvol_rcvr
+
+	if ! ubi_rootdev="$(nand_attach_ubi rootfs)" || \
+	   ! ubi_rcvrdev="$(nand_attach_ubi rootfs_recover)"; then
+		echo "failed to attach UBI volume \"rootfs\" or \"rootfs_recover\", rebooting..."
+		reboot -f
+	fi
+
+	ubimkvol /dev/$ubi_rootdev -N ubi_rootfs -S 1
+	ubimkvol /dev/$ubi_rootdev -N fw_hash -S 1 -t static
+
+	if ! hashvol_root="$(nand_find_volume $ubi_rootdev fw_hash)" || \
+	   ! hashvol_rcvr="$(nand_find_volume $ubi_rcvrdev fw_hash)"; then
+		echo "\"fw_hash\" volume in \"rootfs\" or \"rootfs_recover\" not found, rebooting..."
+		reboot -f
+	fi
+
+	echo -n "00000000000000000000000000000000" > /tmp/dummyhash.txt
+	ubiupdatevol /dev/$hashvol_root /tmp/dummyhash.txt
+	ubiupdatevol /dev/$hashvol_rcvr /tmp/dummyhash.txt
+}
diff --git a/target/linux/qualcommax/ipq807x/base-files/lib/upgrade/mmc.sh b/target/linux/qualcommax/ipq807x/base-files/lib/upgrade/mmc.sh
new file mode 100644
index 00000000000000..dac9ddd5686544
--- /dev/null
+++ b/target/linux/qualcommax/ipq807x/base-files/lib/upgrade/mmc.sh
@@ -0,0 +1,83 @@
+#
+# Copyright (C) 2016 lede-project.org
+#
+
+# this can be used as a generic mmc upgrade script
+# just add a device entry in platform.sh, 
+# define "kernelname" and "rootfsname" and call mmc_do_upgrade
+# after the kernel and rootfs flash a loopdev (as overlay) is 
+# setup on top of the rootfs partition
+# for the proper function a padded rootfs image is needed, basically 
+# append "pad-to 64k" to the image definition
+# this is based on the ipq806x zyxel.sh mmc upgrade
+
+. /lib/functions.sh
+
+mmc_do_upgrade() {
+	local tar_file="$1"
+	local rootfs=
+	local kernel=
+
+			[ -z "$kernel" ] && kernel=$(find_mmc_part ${kernelname})
+			[ -z "$rootfs" ] && rootfs=$(find_mmc_part ${rootfsname})
+
+			[ -z "$kernel" ] && echo "Upgrade failed: kernel partition not found! Rebooting..." && reboot -f
+			[ -z "$rootfs" ] && echo "Upgrade failed: rootfs partition not found! Rebooting..." && reboot -f
+
+	mmc_do_flash $tar_file $kernel $rootfs
+
+	return 0
+}
+
+mmc_do_flash() {
+	local tar_file=$1
+	local kernel=$2
+	local rootfs=$3
+	
+	# keep sure its unbound
+	losetup --detach-all || {
+		echo Failed to detach all loop devices. Skip this try.
+		reboot -f
+	}
+
+	# use the first found directory in the tar archive
+	local board_dir=$(tar tf $tar_file | grep -m 1 '^sysupgrade-.*/$')
+	board_dir=${board_dir%/}
+
+	echo "flashing kernel to $kernel"
+	tar xf $tar_file ${board_dir}/kernel -O >$kernel
+
+	echo "flashing rootfs to ${rootfs}"
+	tar xf $tar_file ${board_dir}/root -O >"${rootfs}"
+
+	# a padded rootfs is needed for overlay fs creation
+	local offset=$(tar xf $tar_file ${board_dir}/root -O | wc -c)
+	[ $offset -lt 65536 ] && {
+		echo Wrong size for rootfs: $offset
+		sleep 10
+		reboot -f
+	}
+
+	# Mount loop for rootfs_data
+	local loopdev="$(losetup -f)"
+	losetup -o $offset $loopdev $rootfs || {
+		echo "Failed to mount looped rootfs_data."
+		sleep 10
+		reboot -f
+	}
+
+	echo "Format new rootfs_data at position ${offset}."
+	mkfs.ext4 -F -L rootfs_data $loopdev
+	mkdir /tmp/new_root
+	mount -t ext4 $loopdev /tmp/new_root && {
+		echo "Saving config to rootfs_data at position ${offset}."
+		cp -v "$UPGRADE_BACKUP" "/tmp/new_root/$BACKUP_FILE"
+		umount /tmp/new_root
+	}
+
+	# Cleanup
+	losetup -d $loopdev >/dev/null 2>&1
+	sync
+	umount -a
+	reboot -f
+}
diff --git a/target/linux/qualcommax/ipq807x/base-files/lib/upgrade/platform.sh b/target/linux/qualcommax/ipq807x/base-files/lib/upgrade/platform.sh
new file mode 100644
index 00000000000000..458eb16b795c60
--- /dev/null
+++ b/target/linux/qualcommax/ipq807x/base-files/lib/upgrade/platform.sh
@@ -0,0 +1,117 @@
+PART_NAME=firmware
+REQUIRE_IMAGE_METADATA=1
+
+RAMFS_COPY_BIN='fw_printenv fw_setenv head'
+RAMFS_COPY_DATA='/etc/fw_env.config /var/lock/fw_printenv.lock'
+
+xiaomi_initramfs_prepare() {
+	# Wipe UBI if running initramfs
+	[ "$(rootfs_type)" = "tmpfs" ] || return 0
+
+	local rootfs_mtdnum="$( find_mtd_index rootfs )"
+	if [ ! "$rootfs_mtdnum" ]; then
+		echo "unable to find mtd partition rootfs"
+		return 1
+	fi
+
+	local kern_mtdnum="$( find_mtd_index ubi_kernel )"
+	if [ ! "$kern_mtdnum" ]; then
+		echo "unable to find mtd partition ubi_kernel"
+		return 1
+	fi
+
+	ubidetach -m "$rootfs_mtdnum"
+	ubiformat /dev/mtd$rootfs_mtdnum -y
+
+	ubidetach -m "$kern_mtdnum"
+	ubiformat /dev/mtd$kern_mtdnum -y
+}
+
+platform_check_image() {
+	return 0;
+}
+
+platform_pre_upgrade() {
+	case "$(board_name)" in
+	redmi,ax6|\
+	xiaomi,ax3600|\
+	xiaomi,ax9000)
+		xiaomi_initramfs_prepare
+		;;
+	esac
+}
+
+platform_do_upgrade() {
+	case "$(board_name)" in
+	buffalo,wxr-5950ax12)
+		CI_KERN_UBIPART="rootfs"
+		CI_ROOT_UBIPART="user_property"
+		buffalo_upgrade_prepare
+		nand_do_flash_file "$1" || nand_do_upgrade_failed
+		nand_do_restore_config || nand_do_upgrade_failed
+		buffalo_upgrade_optvol
+		;;
+	dynalink,dl-wrx36)
+		nand_do_upgrade "$1"
+		;;
+	edgecore,eap102)
+		active="$(fw_printenv -n active)"
+		if [ "$active" -eq "1" ]; then
+			CI_UBIPART="rootfs2"
+		else
+			CI_UBIPART="rootfs1"
+		fi
+		# force altbootcmd which handles partition change in u-boot
+		fw_setenv bootcount 3
+		fw_setenv upgrade_available 1
+		nand_do_upgrade "$1"
+		;;
+	compex,wpq873|\
+	edimax,cax1800|\
+	netgear,wax218)
+		nand_do_upgrade "$1"
+		;;
+	prpl,haze|\
+	qnap,301w)
+		kernelname="0:HLOS"
+		rootfsname="rootfs"
+		mmc_do_upgrade "$1"
+		;;
+	zyxel,nbg7815)
+		local config_mtdnum="$(find_mtd_index 0:bootconfig)"
+		[ -z "$config_mtdnum" ] && reboot
+		part_num="$(hexdump -e '1/1 "%01x|"' -n 1 -s 168 -C /dev/mtd$config_mtdnum | cut -f 1 -d "|" | head -n1)"
+		if [ "$part_num" -eq "0" ]; then
+			kernelname="0:HLOS"
+			rootfsname="rootfs"
+			mmc_do_upgrade "$1"
+		else
+			kernelname="0:HLOS_1"
+			rootfsname="rootfs_1"
+			mmc_do_upgrade "$1"
+		fi
+		;;
+	redmi,ax6|\
+	xiaomi,ax3600|\
+	xiaomi,ax9000)
+		# Make sure that UART is enabled
+		fw_setenv boot_wait on
+		fw_setenv uart_en 1
+
+		# Enforce single partition.
+		fw_setenv flag_boot_rootfs 0
+		fw_setenv flag_last_success 0
+		fw_setenv flag_boot_success 1
+		fw_setenv flag_try_sys1_failed 8
+		fw_setenv flag_try_sys2_failed 8
+
+		# Kernel and rootfs are placed in 2 different UBI
+		CI_KERN_UBIPART="ubi_kernel"
+		CI_ROOT_UBIPART="rootfs"
+		nand_do_upgrade "$1"
+		;;
+	*)
+		default_do_upgrade "$1"
+		;;
+	esac
+}
diff --git a/target/linux/qualcommax/ipq807x/target.mk b/target/linux/qualcommax/ipq807x/target.mk
new file mode 100644
index 00000000000000..22a9b78d592df4
--- /dev/null
+++ b/target/linux/qualcommax/ipq807x/target.mk
@@ -0,0 +1,7 @@
+SUBTARGET:=ipq807x
+BOARDNAME:=Qualcomm Atheros IPQ807x
+DEFAULT_PACKAGES += kmod-phy-aquantia ath11k-firmware-ipq8074
+
+define Target/Description
+	Build firmware images for Qualcomm Atheros IPQ807x based boards.
+endef
diff --git a/target/linux/qualcommax/patches-6.1/0001-v6.2-arm64-dts-qcom-ipq8074-add-A53-PLL-node.patch b/target/linux/qualcommax/patches-6.1/0001-v6.2-arm64-dts-qcom-ipq8074-add-A53-PLL-node.patch
new file mode 100644
index 00000000000000..dd57eae360b234
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0001-v6.2-arm64-dts-qcom-ipq8074-add-A53-PLL-node.patch
@@ -0,0 +1,32 @@
+From 6463c10bfdbd684ec7ecfd408ea541283215a088 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 19 Aug 2022 00:06:28 +0200
+Subject: [PATCH] arm64: dts: qcom: ipq8074: add A53 PLL node
+
+Add the required node for A53 PLL which will be used to provide the CPU
+clock via APCS for APSS scaling.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220818220628.339366-9-robimarko@gmail.com
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -675,6 +675,14 @@
+ 			#mbox-cells = <1>;
+ 		};
+ 
++		a53pll: clock@b116000 {
++			compatible = "qcom,ipq8074-a53pll";
++			reg = <0x0b116000 0x40>;
++			#clock-cells = <0>;
++			clocks = <&xo>;
++			clock-names = "xo";
++		};
++
+ 		timer@b120000 {
+ 			#address-cells = <1>;
+ 			#size-cells = <1>;
diff --git a/target/linux/qualcommax/patches-6.1/0002-v6.2-thermal-drivers-tsens-Add-support-for-combined-inter.patch b/target/linux/qualcommax/patches-6.1/0002-v6.2-thermal-drivers-tsens-Add-support-for-combined-inter.patch
new file mode 100644
index 00000000000000..032072599968f1
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0002-v6.2-thermal-drivers-tsens-Add-support-for-combined-inter.patch
@@ -0,0 +1,134 @@
+From e593e834fe8ba9bf314d8215ac05d8787f81efda Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 19 Aug 2022 00:02:42 +0200
+Subject: [PATCH] thermal/drivers/tsens: Add support for combined interrupt
+
+Despite using tsens v2.3 IP, IPQ8074 and IPQ6018 only have one IRQ for
+signaling both up/low and critical trips.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220818220245.338396-2-robimarko@gmail.com
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+---
+ drivers/thermal/qcom/tsens-8960.c |  1 +
+ drivers/thermal/qcom/tsens-v0_1.c |  1 +
+ drivers/thermal/qcom/tsens-v1.c   |  1 +
+ drivers/thermal/qcom/tsens-v2.c   |  1 +
+ drivers/thermal/qcom/tsens.c      | 38 ++++++++++++++++++++++++++-----
+ drivers/thermal/qcom/tsens.h      |  2 ++
+ 6 files changed, 38 insertions(+), 6 deletions(-)
+
+--- a/drivers/thermal/qcom/tsens-8960.c
++++ b/drivers/thermal/qcom/tsens-8960.c
+@@ -269,6 +269,7 @@ static const struct tsens_ops ops_8960 =
+ static struct tsens_features tsens_8960_feat = {
+ 	.ver_major	= VER_0,
+ 	.crit_int	= 0,
++	.combo_int	= 0,
+ 	.adc		= 1,
+ 	.srot_split	= 0,
+ 	.max_sensors	= 11,
+--- a/drivers/thermal/qcom/tsens-v0_1.c
++++ b/drivers/thermal/qcom/tsens-v0_1.c
+@@ -549,6 +549,7 @@ static int __init init_8939(struct tsens
+ static struct tsens_features tsens_v0_1_feat = {
+ 	.ver_major	= VER_0_1,
+ 	.crit_int	= 0,
++	.combo_int	= 0,
+ 	.adc		= 1,
+ 	.srot_split	= 1,
+ 	.max_sensors	= 11,
+--- a/drivers/thermal/qcom/tsens-v1.c
++++ b/drivers/thermal/qcom/tsens-v1.c
+@@ -273,6 +273,7 @@ static int calibrate_8976(struct tsens_p
+ static struct tsens_features tsens_v1_feat = {
+ 	.ver_major	= VER_1_X,
+ 	.crit_int	= 0,
++	.combo_int	= 0,
+ 	.adc		= 1,
+ 	.srot_split	= 1,
+ 	.max_sensors	= 11,
+--- a/drivers/thermal/qcom/tsens-v2.c
++++ b/drivers/thermal/qcom/tsens-v2.c
+@@ -31,6 +31,7 @@
+ static struct tsens_features tsens_v2_feat = {
+ 	.ver_major	= VER_2_X,
+ 	.crit_int	= 1,
++	.combo_int	= 0,
+ 	.adc		= 0,
+ 	.srot_split	= 1,
+ 	.max_sensors	= 16,
+--- a/drivers/thermal/qcom/tsens.c
++++ b/drivers/thermal/qcom/tsens.c
+@@ -532,6 +532,27 @@ static irqreturn_t tsens_irq_thread(int
+ 	return IRQ_HANDLED;
+ }
+ 
++/**
++ * tsens_combined_irq_thread() - Threaded interrupt handler for combined interrupts
++ * @irq: irq number
++ * @data: tsens controller private data
++ *
++ * Handle the combined interrupt as if it were 2 separate interrupts, so call the
++ * critical handler first and then the up/low one.
++ *
++ * Return: IRQ_HANDLED
++ */
++static irqreturn_t tsens_combined_irq_thread(int irq, void *data)
++{
++	irqreturn_t ret;
++
++	ret = tsens_critical_irq_thread(irq, data);
++	if (ret != IRQ_HANDLED)
++		return ret;
++
++	return tsens_irq_thread(irq, data);
++}
++
+ static int tsens_set_trips(struct thermal_zone_device *tz, int low, int high)
+ {
+ 	struct tsens_sensor *s = tz->devdata;
+@@ -1074,13 +1095,18 @@ static int tsens_register(struct tsens_p
+ 				   tsens_mC_to_hw(priv->sensor, 0));
+ 	}
+ 
+-	ret = tsens_register_irq(priv, "uplow", tsens_irq_thread);
+-	if (ret < 0)
+-		return ret;
++	if (priv->feat->combo_int) {
++		ret = tsens_register_irq(priv, "combined",
++					 tsens_combined_irq_thread);
++	} else {
++		ret = tsens_register_irq(priv, "uplow", tsens_irq_thread);
++		if (ret < 0)
++			return ret;
+ 
+-	if (priv->feat->crit_int)
+-		ret = tsens_register_irq(priv, "critical",
+-					 tsens_critical_irq_thread);
++		if (priv->feat->crit_int)
++			ret = tsens_register_irq(priv, "critical",
++						 tsens_critical_irq_thread);
++	}
+ 
+ 	return ret;
+ }
+--- a/drivers/thermal/qcom/tsens.h
++++ b/drivers/thermal/qcom/tsens.h
+@@ -493,6 +493,7 @@ enum regfield_ids {
+  * struct tsens_features - Features supported by the IP
+  * @ver_major: Major number of IP version
+  * @crit_int: does the IP support critical interrupts?
++ * @combo_int: does the IP use one IRQ for up, low and critical thresholds?
+  * @adc:      do the sensors only output adc code (instead of temperature)?
+  * @srot_split: does the IP neatly splits the register space into SROT and TM,
+  *              with SROT only being available to secure boot firmware?
+@@ -502,6 +503,7 @@ enum regfield_ids {
+ struct tsens_features {
+ 	unsigned int ver_major;
+ 	unsigned int crit_int:1;
++	unsigned int combo_int:1;
+ 	unsigned int adc:1;
+ 	unsigned int srot_split:1;
+ 	unsigned int has_watchdog:1;
diff --git a/target/linux/qualcommax/patches-6.1/0003-v6.2-thermal-drivers-tsens-Allow-configuring-min-and-max-.patch b/target/linux/qualcommax/patches-6.1/0003-v6.2-thermal-drivers-tsens-Allow-configuring-min-and-max-.patch
new file mode 100644
index 00000000000000..363061813a8d96
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0003-v6.2-thermal-drivers-tsens-Allow-configuring-min-and-max-.patch
@@ -0,0 +1,101 @@
+From 7805365fee582056b32c69cf35aafbb94b14a8ca Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 19 Aug 2022 00:02:43 +0200
+Subject: [PATCH] thermal/drivers/tsens: Allow configuring min and max trips
+
+IPQ8074 and IPQ6018 dont support negative trip temperatures and support
+up to 204 degrees C as the max trip temperature.
+
+So, instead of always setting the -40 as min and 120 degrees C as max
+allow it to be configured as part of the features.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220818220245.338396-3-robimarko@gmail.com
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+---
+ drivers/thermal/qcom/tsens-8960.c | 2 ++
+ drivers/thermal/qcom/tsens-v0_1.c | 2 ++
+ drivers/thermal/qcom/tsens-v1.c   | 2 ++
+ drivers/thermal/qcom/tsens-v2.c   | 2 ++
+ drivers/thermal/qcom/tsens.c      | 4 ++--
+ drivers/thermal/qcom/tsens.h      | 4 ++++
+ 6 files changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/thermal/qcom/tsens-8960.c
++++ b/drivers/thermal/qcom/tsens-8960.c
+@@ -273,6 +273,8 @@ static struct tsens_features tsens_8960_
+ 	.adc		= 1,
+ 	.srot_split	= 0,
+ 	.max_sensors	= 11,
++	.trip_min_temp	= -40000,
++	.trip_max_temp	= 120000,
+ };
+ 
+ struct tsens_plat_data data_8960 = {
+--- a/drivers/thermal/qcom/tsens-v0_1.c
++++ b/drivers/thermal/qcom/tsens-v0_1.c
+@@ -553,6 +553,8 @@ static struct tsens_features tsens_v0_1_
+ 	.adc		= 1,
+ 	.srot_split	= 1,
+ 	.max_sensors	= 11,
++	.trip_min_temp	= -40000,
++	.trip_max_temp	= 120000,
+ };
+ 
+ static const struct reg_field tsens_v0_1_regfields[MAX_REGFIELDS] = {
+--- a/drivers/thermal/qcom/tsens-v1.c
++++ b/drivers/thermal/qcom/tsens-v1.c
+@@ -277,6 +277,8 @@ static struct tsens_features tsens_v1_fe
+ 	.adc		= 1,
+ 	.srot_split	= 1,
+ 	.max_sensors	= 11,
++	.trip_min_temp	= -40000,
++	.trip_max_temp	= 120000,
+ };
+ 
+ static const struct reg_field tsens_v1_regfields[MAX_REGFIELDS] = {
+--- a/drivers/thermal/qcom/tsens-v2.c
++++ b/drivers/thermal/qcom/tsens-v2.c
+@@ -35,6 +35,8 @@ static struct tsens_features tsens_v2_fe
+ 	.adc		= 0,
+ 	.srot_split	= 1,
+ 	.max_sensors	= 16,
++	.trip_min_temp	= -40000,
++	.trip_max_temp	= 120000,
+ };
+ 
+ static const struct reg_field tsens_v2_regfields[MAX_REGFIELDS] = {
+--- a/drivers/thermal/qcom/tsens.c
++++ b/drivers/thermal/qcom/tsens.c
+@@ -573,8 +573,8 @@ static int tsens_set_trips(struct therma
+ 	dev_dbg(dev, "[%u] %s: proposed thresholds: (%d:%d)\n",
+ 		hw_id, __func__, low, high);
+ 
+-	cl_high = clamp_val(high, -40000, 120000);
+-	cl_low  = clamp_val(low, -40000, 120000);
++	cl_high = clamp_val(high, priv->feat->trip_min_temp, priv->feat->trip_max_temp);
++	cl_low  = clamp_val(low, priv->feat->trip_min_temp, priv->feat->trip_max_temp);
+ 
+ 	high_val = tsens_mC_to_hw(s, cl_high);
+ 	low_val  = tsens_mC_to_hw(s, cl_low);
+--- a/drivers/thermal/qcom/tsens.h
++++ b/drivers/thermal/qcom/tsens.h
+@@ -499,6 +499,8 @@ enum regfield_ids {
+  *              with SROT only being available to secure boot firmware?
+  * @has_watchdog: does this IP support watchdog functionality?
+  * @max_sensors: maximum sensors supported by this version of the IP
++ * @trip_min_temp: minimum trip temperature supported by this version of the IP
++ * @trip_max_temp: maximum trip temperature supported by this version of the IP
+  */
+ struct tsens_features {
+ 	unsigned int ver_major;
+@@ -508,6 +510,8 @@ struct tsens_features {
+ 	unsigned int srot_split:1;
+ 	unsigned int has_watchdog:1;
+ 	unsigned int max_sensors;
++	int trip_min_temp;
++	int trip_max_temp;
+ };
+ 
+ /**
diff --git a/target/linux/qualcommax/patches-6.1/0004-v6.2-thermal-drivers-tsens-Add-IPQ8074-support.patch b/target/linux/qualcommax/patches-6.1/0004-v6.2-thermal-drivers-tsens-Add-IPQ8074-support.patch
new file mode 100644
index 00000000000000..eaea6939591dfd
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0004-v6.2-thermal-drivers-tsens-Add-IPQ8074-support.patch
@@ -0,0 +1,74 @@
+From 0164d794cbc58488a7321272e95958d10cf103a4 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 19 Aug 2022 00:02:44 +0200
+Subject: [PATCH] thermal/drivers/tsens: Add IPQ8074 support
+
+Qualcomm IPQ8074 uses tsens v2.3 IP, however unlike other tsens v2 IP
+it only has one IRQ, that is used for up/low as well as critical.
+It also does not support negative trip temperatures.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220818220245.338396-4-robimarko@gmail.com
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+---
+ drivers/thermal/qcom/tsens-v2.c | 17 +++++++++++++++++
+ drivers/thermal/qcom/tsens.c    |  3 +++
+ drivers/thermal/qcom/tsens.h    |  2 +-
+ 3 files changed, 21 insertions(+), 1 deletion(-)
+
+--- a/drivers/thermal/qcom/tsens-v2.c
++++ b/drivers/thermal/qcom/tsens-v2.c
+@@ -39,6 +39,17 @@ static struct tsens_features tsens_v2_fe
+ 	.trip_max_temp	= 120000,
+ };
+ 
++static struct tsens_features ipq8074_feat = {
++	.ver_major	= VER_2_X,
++	.crit_int	= 1,
++	.combo_int	= 1,
++	.adc		= 0,
++	.srot_split	= 1,
++	.max_sensors	= 16,
++	.trip_min_temp	= 0,
++	.trip_max_temp	= 204000,
++};
++
+ static const struct reg_field tsens_v2_regfields[MAX_REGFIELDS] = {
+ 	/* ----- SROT ------ */
+ 	/* VERSION */
+@@ -104,6 +115,12 @@ struct tsens_plat_data data_tsens_v2 = {
+ 	.fields	= tsens_v2_regfields,
+ };
+ 
++struct tsens_plat_data data_ipq8074 = {
++	.ops		= &ops_generic_v2,
++	.feat		= &ipq8074_feat,
++	.fields	= tsens_v2_regfields,
++};
++
+ /* Kept around for backward compatibility with old msm8996.dtsi */
+ struct tsens_plat_data data_8996 = {
+ 	.num_sensors	= 13,
+--- a/drivers/thermal/qcom/tsens.c
++++ b/drivers/thermal/qcom/tsens.c
+@@ -981,6 +981,9 @@ static const struct of_device_id tsens_t
+ 		.compatible = "qcom,ipq8064-tsens",
+ 		.data = &data_8960,
+ 	}, {
++		.compatible = "qcom,ipq8074-tsens",
++		.data = &data_ipq8074,
++	}, {
+ 		.compatible = "qcom,mdm9607-tsens",
+ 		.data = &data_9607,
+ 	}, {
+--- a/drivers/thermal/qcom/tsens.h
++++ b/drivers/thermal/qcom/tsens.h
+@@ -597,6 +597,6 @@ extern struct tsens_plat_data data_8916,
+ extern struct tsens_plat_data data_tsens_v1, data_8976, data_8956;
+ 
+ /* TSENS v2 targets */
+-extern struct tsens_plat_data data_8996, data_tsens_v2;
++extern struct tsens_plat_data data_8996, data_ipq8074, data_tsens_v2;
+ 
+ #endif /* __QCOM_TSENS_H__ */
diff --git a/target/linux/qualcommax/patches-6.1/0005-v6.2-arm64-dts-qcom-ipq8074-add-thermal-nodes.patch b/target/linux/qualcommax/patches-6.1/0005-v6.2-arm64-dts-qcom-ipq8074-add-thermal-nodes.patch
new file mode 100644
index 00000000000000..bad75e4597ae7b
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0005-v6.2-arm64-dts-qcom-ipq8074-add-thermal-nodes.patch
@@ -0,0 +1,130 @@
+From c3cc0c2a17f552be2426200e47a9e2c62cf449ce Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 19 Aug 2022 00:02:45 +0200
+Subject: [PATCH] arm64: dts: qcom: ipq8074: add thermal nodes
+
+IPQ8074 has a tsens v2.3.0 peripheral which monitors
+temperatures around the various subsystems on the
+die.
+
+So lets add the tsens and thermal zone nodes, passive
+CPU cooling will come in later patches after CPU frequency
+scaling is supported.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220818220245.338396-5-robimarko@gmail.com
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 96 +++++++++++++++++++++++++++
+ 1 file changed, 96 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -274,6 +274,16 @@
+ 			status = "disabled";
+ 		};
+ 
++		tsens: thermal-sensor@4a9000 {
++			compatible = "qcom,ipq8074-tsens";
++			reg = <0x4a9000 0x1000>, /* TM */
++			      <0x4a8000 0x1000>; /* SROT */
++			interrupts = <GIC_SPI 184 IRQ_TYPE_LEVEL_HIGH>;
++			interrupt-names = "combined";
++			#qcom,sensors = <16>;
++			#thermal-sensor-cells = <1>;
++		};
++
+ 		cryptobam: dma-controller@704000 {
+ 			compatible = "qcom,bam-v1.7.0";
+ 			reg = <0x00704000 0x20000>;
+@@ -874,4 +884,90 @@
+ 			     <GIC_PPI 4 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
+ 			     <GIC_PPI 1 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>;
+ 	};
++
++	thermal-zones {
++		nss-top-thermal {
++			polling-delay-passive = <250>;
++			polling-delay = <1000>;
++
++			thermal-sensors = <&tsens 4>;
++		};
++
++		nss0-thermal {
++			polling-delay-passive = <250>;
++			polling-delay = <1000>;
++
++			thermal-sensors = <&tsens 5>;
++		};
++
++		nss1-thermal {
++			polling-delay-passive = <250>;
++			polling-delay = <1000>;
++
++			thermal-sensors = <&tsens 6>;
++		};
++
++		wcss-phya0-thermal {
++			polling-delay-passive = <250>;
++			polling-delay = <1000>;
++
++			thermal-sensors = <&tsens 7>;
++		};
++
++		wcss-phya1-thermal {
++			polling-delay-passive = <250>;
++			polling-delay = <1000>;
++
++			thermal-sensors = <&tsens 8>;
++		};
++
++		cpu0_thermal: cpu0-thermal {
++			polling-delay-passive = <250>;
++			polling-delay = <1000>;
++
++			thermal-sensors = <&tsens 9>;
++		};
++
++		cpu1_thermal: cpu1-thermal {
++			polling-delay-passive = <250>;
++			polling-delay = <1000>;
++
++			thermal-sensors = <&tsens 10>;
++		};
++
++		cpu2_thermal: cpu2-thermal {
++			polling-delay-passive = <250>;
++			polling-delay = <1000>;
++
++			thermal-sensors = <&tsens 11>;
++		};
++
++		cpu3_thermal: cpu3-thermal {
++			polling-delay-passive = <250>;
++			polling-delay = <1000>;
++
++			thermal-sensors = <&tsens 12>;
++		};
++
++		cluster_thermal: cluster-thermal {
++			polling-delay-passive = <250>;
++			polling-delay = <1000>;
++
++			thermal-sensors = <&tsens 13>;
++		};
++
++		wcss-phyb0-thermal {
++			polling-delay-passive = <250>;
++			polling-delay = <1000>;
++
++			thermal-sensors = <&tsens 14>;
++		};
++
++		wcss-phyb1-thermal {
++			polling-delay-passive = <250>;
++			polling-delay = <1000>;
++
++			thermal-sensors = <&tsens 15>;
++		};
++	};
+ };
diff --git a/target/linux/qualcommax/patches-6.1/0006-v6.2-arm64-dts-qcom-ipq8074-add-clocks-to-APCS.patch b/target/linux/qualcommax/patches-6.1/0006-v6.2-arm64-dts-qcom-ipq8074-add-clocks-to-APCS.patch
new file mode 100644
index 00000000000000..e229851649caca
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0006-v6.2-arm64-dts-qcom-ipq8074-add-clocks-to-APCS.patch
@@ -0,0 +1,29 @@
+From 0df592a0a1a3fff9133977192677aa915afc174f Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 19 Aug 2022 00:08:49 +0200
+Subject: [PATCH] arm64: dts: qcom: ipq8074: add clocks to APCS
+
+APCS now has support for providing the APSS clocks as the child device
+for IPQ8074.
+
+So, add the A53 PLL and XO clocks in order to use APCS as the CPU
+clocksource for APSS scaling.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220818220849.339732-4-robimarko@gmail.com
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -680,6 +680,8 @@
+ 		apcs_glb: mailbox@b111000 {
+ 			compatible = "qcom,ipq8074-apcs-apps-global";
+ 			reg = <0x0b111000 0x1000>;
++			clocks = <&a53pll>, <&xo>;
++			clock-names = "pll", "xo";
+ 
+ 			#clock-cells = <1>;
+ 			#mbox-cells = <1>;
diff --git a/target/linux/qualcommax/patches-6.1/0007-v6.2-clk-qcom-ipq8074-convert-to-parent-data.patch b/target/linux/qualcommax/patches-6.1/0007-v6.2-clk-qcom-ipq8074-convert-to-parent-data.patch
new file mode 100644
index 00000000000000..9162ea538d3805
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0007-v6.2-clk-qcom-ipq8074-convert-to-parent-data.patch
@@ -0,0 +1,3601 @@
+From e6c5115d6845f25eda7e162dcd783a2044215867 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Sun, 30 Oct 2022 18:57:01 +0100
+Subject: [PATCH] clk: qcom: ipq8074: convert to parent data
+
+Convert the IPQ8074 GCC driver to use parent data instead of global
+name matching.
+
+Utilize ARRAY_SIZE for num_parents instead of hardcoding the value.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221030175703.1103224-1-robimarko@gmail.com
+---
+ drivers/clk/qcom/gcc-ipq8074.c | 1781 +++++++++++++++-----------------
+ 1 file changed, 813 insertions(+), 968 deletions(-)
+
+--- a/drivers/clk/qcom/gcc-ipq8074.c
++++ b/drivers/clk/qcom/gcc-ipq8074.c
+@@ -49,349 +49,6 @@ enum {
+ 	P_UNIPHY2_TX,
+ };
+ 
+-static const char * const gcc_xo_gpll0_gpll0_out_main_div2[] = {
+-	"xo",
+-	"gpll0",
+-	"gpll0_out_main_div2",
+-};
+-
+-static const struct parent_map gcc_xo_gpll0_gpll0_out_main_div2_map[] = {
+-	{ P_XO, 0 },
+-	{ P_GPLL0, 1 },
+-	{ P_GPLL0_DIV2, 4 },
+-};
+-
+-static const struct parent_map gcc_xo_gpll0_map[] = {
+-	{ P_XO, 0 },
+-	{ P_GPLL0, 1 },
+-};
+-
+-static const char * const gcc_xo_gpll0_gpll2_gpll0_out_main_div2[] = {
+-	"xo",
+-	"gpll0",
+-	"gpll2",
+-	"gpll0_out_main_div2",
+-};
+-
+-static const struct parent_map gcc_xo_gpll0_gpll2_gpll0_out_main_div2_map[] = {
+-	{ P_XO, 0 },
+-	{ P_GPLL0, 1 },
+-	{ P_GPLL2, 2 },
+-	{ P_GPLL0_DIV2, 4 },
+-};
+-
+-static const char * const gcc_xo_gpll0_sleep_clk[] = {
+-	"xo",
+-	"gpll0",
+-	"sleep_clk",
+-};
+-
+-static const struct parent_map gcc_xo_gpll0_sleep_clk_map[] = {
+-	{ P_XO, 0 },
+-	{ P_GPLL0, 2 },
+-	{ P_SLEEP_CLK, 6 },
+-};
+-
+-static const char * const gcc_xo_gpll6_gpll0_gpll0_out_main_div2[] = {
+-	"xo",
+-	"gpll6",
+-	"gpll0",
+-	"gpll0_out_main_div2",
+-};
+-
+-static const struct parent_map gcc_xo_gpll6_gpll0_gpll0_out_main_div2_map[] = {
+-	{ P_XO, 0 },
+-	{ P_GPLL6, 1 },
+-	{ P_GPLL0, 3 },
+-	{ P_GPLL0_DIV2, 4 },
+-};
+-
+-static const char * const gcc_xo_gpll0_out_main_div2_gpll0[] = {
+-	"xo",
+-	"gpll0_out_main_div2",
+-	"gpll0",
+-};
+-
+-static const struct parent_map gcc_xo_gpll0_out_main_div2_gpll0_map[] = {
+-	{ P_XO, 0 },
+-	{ P_GPLL0_DIV2, 2 },
+-	{ P_GPLL0, 1 },
+-};
+-
+-static const char * const gcc_usb3phy_0_cc_pipe_clk_xo[] = {
+-	"usb3phy_0_cc_pipe_clk",
+-	"xo",
+-};
+-
+-static const struct parent_map gcc_usb3phy_0_cc_pipe_clk_xo_map[] = {
+-	{ P_USB3PHY_0_PIPE, 0 },
+-	{ P_XO, 2 },
+-};
+-
+-static const char * const gcc_usb3phy_1_cc_pipe_clk_xo[] = {
+-	"usb3phy_1_cc_pipe_clk",
+-	"xo",
+-};
+-
+-static const struct parent_map gcc_usb3phy_1_cc_pipe_clk_xo_map[] = {
+-	{ P_USB3PHY_1_PIPE, 0 },
+-	{ P_XO, 2 },
+-};
+-
+-static const char * const gcc_pcie20_phy0_pipe_clk_xo[] = {
+-	"pcie20_phy0_pipe_clk",
+-	"xo",
+-};
+-
+-static const struct parent_map gcc_pcie20_phy0_pipe_clk_xo_map[] = {
+-	{ P_PCIE20_PHY0_PIPE, 0 },
+-	{ P_XO, 2 },
+-};
+-
+-static const char * const gcc_pcie20_phy1_pipe_clk_xo[] = {
+-	"pcie20_phy1_pipe_clk",
+-	"xo",
+-};
+-
+-static const struct parent_map gcc_pcie20_phy1_pipe_clk_xo_map[] = {
+-	{ P_PCIE20_PHY1_PIPE, 0 },
+-	{ P_XO, 2 },
+-};
+-
+-static const char * const gcc_xo_gpll0_gpll6_gpll0_div2[] = {
+-	"xo",
+-	"gpll0",
+-	"gpll6",
+-	"gpll0_out_main_div2",
+-};
+-
+-static const struct parent_map gcc_xo_gpll0_gpll6_gpll0_div2_map[] = {
+-	{ P_XO, 0 },
+-	{ P_GPLL0, 1 },
+-	{ P_GPLL6, 2 },
+-	{ P_GPLL0_DIV2, 4 },
+-};
+-
+-static const char * const gcc_xo_gpll0_gpll6_gpll0_out_main_div2[] = {
+-	"xo",
+-	"gpll0",
+-	"gpll6",
+-	"gpll0_out_main_div2",
+-};
+-
+-static const struct parent_map gcc_xo_gpll0_gpll6_gpll0_out_main_div2_map[] = {
+-	{ P_XO, 0 },
+-	{ P_GPLL0, 1 },
+-	{ P_GPLL6, 2 },
+-	{ P_GPLL0_DIV2, 3 },
+-};
+-
+-static const char * const gcc_xo_bias_pll_nss_noc_clk_gpll0_gpll2[] = {
+-	"xo",
+-	"bias_pll_nss_noc_clk",
+-	"gpll0",
+-	"gpll2",
+-};
+-
+-static const struct parent_map gcc_xo_bias_pll_nss_noc_clk_gpll0_gpll2_map[] = {
+-	{ P_XO, 0 },
+-	{ P_BIAS_PLL_NSS_NOC, 1 },
+-	{ P_GPLL0, 2 },
+-	{ P_GPLL2, 3 },
+-};
+-
+-static const char * const gcc_xo_nss_crypto_pll_gpll0[] = {
+-	"xo",
+-	"nss_crypto_pll",
+-	"gpll0",
+-};
+-
+-static const struct parent_map gcc_xo_nss_crypto_pll_gpll0_map[] = {
+-	{ P_XO, 0 },
+-	{ P_NSS_CRYPTO_PLL, 1 },
+-	{ P_GPLL0, 2 },
+-};
+-
+-static const char * const gcc_xo_ubi32_pll_gpll0_gpll2_gpll4_gpll6[] = {
+-	"xo",
+-	"ubi32_pll",
+-	"gpll0",
+-	"gpll2",
+-	"gpll4",
+-	"gpll6",
+-};
+-
+-static const struct parent_map gcc_xo_ubi32_gpll0_gpll2_gpll4_gpll6_map[] = {
+-	{ P_XO, 0 },
+-	{ P_UBI32_PLL, 1 },
+-	{ P_GPLL0, 2 },
+-	{ P_GPLL2, 3 },
+-	{ P_GPLL4, 4 },
+-	{ P_GPLL6, 5 },
+-};
+-
+-static const char * const gcc_xo_gpll0_out_main_div2[] = {
+-	"xo",
+-	"gpll0_out_main_div2",
+-};
+-
+-static const struct parent_map gcc_xo_gpll0_out_main_div2_map[] = {
+-	{ P_XO, 0 },
+-	{ P_GPLL0_DIV2, 1 },
+-};
+-
+-static const char * const gcc_xo_bias_gpll0_gpll4_nss_ubi32[] = {
+-	"xo",
+-	"bias_pll_cc_clk",
+-	"gpll0",
+-	"gpll4",
+-	"nss_crypto_pll",
+-	"ubi32_pll",
+-};
+-
+-static const struct parent_map gcc_xo_bias_gpll0_gpll4_nss_ubi32_map[] = {
+-	{ P_XO, 0 },
+-	{ P_BIAS_PLL, 1 },
+-	{ P_GPLL0, 2 },
+-	{ P_GPLL4, 3 },
+-	{ P_NSS_CRYPTO_PLL, 4 },
+-	{ P_UBI32_PLL, 5 },
+-};
+-
+-static const char * const gcc_xo_gpll0_gpll4[] = {
+-	"xo",
+-	"gpll0",
+-	"gpll4",
+-};
+-
+-static const struct parent_map gcc_xo_gpll0_gpll4_map[] = {
+-	{ P_XO, 0 },
+-	{ P_GPLL0, 1 },
+-	{ P_GPLL4, 2 },
+-};
+-
+-static const char * const gcc_xo_uniphy0_rx_tx_ubi32_bias[] = {
+-	"xo",
+-	"uniphy0_gcc_rx_clk",
+-	"uniphy0_gcc_tx_clk",
+-	"ubi32_pll",
+-	"bias_pll_cc_clk",
+-};
+-
+-static const struct parent_map gcc_xo_uniphy0_rx_tx_ubi32_bias_map[] = {
+-	{ P_XO, 0 },
+-	{ P_UNIPHY0_RX, 1 },
+-	{ P_UNIPHY0_TX, 2 },
+-	{ P_UBI32_PLL, 5 },
+-	{ P_BIAS_PLL, 6 },
+-};
+-
+-static const char * const gcc_xo_uniphy0_tx_rx_ubi32_bias[] = {
+-	"xo",
+-	"uniphy0_gcc_tx_clk",
+-	"uniphy0_gcc_rx_clk",
+-	"ubi32_pll",
+-	"bias_pll_cc_clk",
+-};
+-
+-static const struct parent_map gcc_xo_uniphy0_tx_rx_ubi32_bias_map[] = {
+-	{ P_XO, 0 },
+-	{ P_UNIPHY0_TX, 1 },
+-	{ P_UNIPHY0_RX, 2 },
+-	{ P_UBI32_PLL, 5 },
+-	{ P_BIAS_PLL, 6 },
+-};
+-
+-static const char * const gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias[] = {
+-	"xo",
+-	"uniphy0_gcc_rx_clk",
+-	"uniphy0_gcc_tx_clk",
+-	"uniphy1_gcc_rx_clk",
+-	"uniphy1_gcc_tx_clk",
+-	"ubi32_pll",
+-	"bias_pll_cc_clk",
+-};
+-
+-static const struct parent_map
+-gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias_map[] = {
+-	{ P_XO, 0 },
+-	{ P_UNIPHY0_RX, 1 },
+-	{ P_UNIPHY0_TX, 2 },
+-	{ P_UNIPHY1_RX, 3 },
+-	{ P_UNIPHY1_TX, 4 },
+-	{ P_UBI32_PLL, 5 },
+-	{ P_BIAS_PLL, 6 },
+-};
+-
+-static const char * const gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias[] = {
+-	"xo",
+-	"uniphy0_gcc_tx_clk",
+-	"uniphy0_gcc_rx_clk",
+-	"uniphy1_gcc_tx_clk",
+-	"uniphy1_gcc_rx_clk",
+-	"ubi32_pll",
+-	"bias_pll_cc_clk",
+-};
+-
+-static const struct parent_map
+-gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias_map[] = {
+-	{ P_XO, 0 },
+-	{ P_UNIPHY0_TX, 1 },
+-	{ P_UNIPHY0_RX, 2 },
+-	{ P_UNIPHY1_TX, 3 },
+-	{ P_UNIPHY1_RX, 4 },
+-	{ P_UBI32_PLL, 5 },
+-	{ P_BIAS_PLL, 6 },
+-};
+-
+-static const char * const gcc_xo_uniphy2_rx_tx_ubi32_bias[] = {
+-	"xo",
+-	"uniphy2_gcc_rx_clk",
+-	"uniphy2_gcc_tx_clk",
+-	"ubi32_pll",
+-	"bias_pll_cc_clk",
+-};
+-
+-static const struct parent_map gcc_xo_uniphy2_rx_tx_ubi32_bias_map[] = {
+-	{ P_XO, 0 },
+-	{ P_UNIPHY2_RX, 1 },
+-	{ P_UNIPHY2_TX, 2 },
+-	{ P_UBI32_PLL, 5 },
+-	{ P_BIAS_PLL, 6 },
+-};
+-
+-static const char * const gcc_xo_uniphy2_tx_rx_ubi32_bias[] = {
+-	"xo",
+-	"uniphy2_gcc_tx_clk",
+-	"uniphy2_gcc_rx_clk",
+-	"ubi32_pll",
+-	"bias_pll_cc_clk",
+-};
+-
+-static const struct parent_map gcc_xo_uniphy2_tx_rx_ubi32_bias_map[] = {
+-	{ P_XO, 0 },
+-	{ P_UNIPHY2_TX, 1 },
+-	{ P_UNIPHY2_RX, 2 },
+-	{ P_UBI32_PLL, 5 },
+-	{ P_BIAS_PLL, 6 },
+-};
+-
+-static const char * const gcc_xo_gpll0_gpll6_gpll0_sleep_clk[] = {
+-	"xo",
+-	"gpll0",
+-	"gpll6",
+-	"gpll0_out_main_div2",
+-	"sleep_clk",
+-};
+-
+-static const struct parent_map gcc_xo_gpll0_gpll6_gpll0_sleep_clk_map[] = {
+-	{ P_XO, 0 },
+-	{ P_GPLL0, 1 },
+-	{ P_GPLL6, 2 },
+-	{ P_GPLL0_DIV2, 4 },
+-	{ P_SLEEP_CLK, 6 },
+-};
+-
+ static struct clk_alpha_pll gpll0_main = {
+ 	.offset = 0x21000,
+ 	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+@@ -400,8 +57,9 @@ static struct clk_alpha_pll gpll0_main =
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gpll0_main",
+-			.parent_names = (const char *[]){
+-				"xo"
++			.parent_data = &(const struct clk_parent_data){
++				.fw_name = "xo",
++				.name = "xo",
+ 			},
+ 			.num_parents = 1,
+ 			.ops = &clk_alpha_pll_ops,
+@@ -414,9 +72,8 @@ static struct clk_fixed_factor gpll0_out
+ 	.div = 2,
+ 	.hw.init = &(struct clk_init_data){
+ 		.name = "gpll0_out_main_div2",
+-		.parent_names = (const char *[]){
+-			"gpll0_main"
+-		},
++		.parent_hws = (const struct clk_hw *[]){
++				&gpll0_main.clkr.hw },
+ 		.num_parents = 1,
+ 		.ops = &clk_fixed_factor_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+@@ -429,9 +86,8 @@ static struct clk_alpha_pll_postdiv gpll
+ 	.width = 4,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll0",
+-		.parent_names = (const char *[]){
+-			"gpll0_main"
+-		},
++		.parent_hws = (const struct clk_hw *[]){
++				&gpll0_main.clkr.hw },
+ 		.num_parents = 1,
+ 		.ops = &clk_alpha_pll_postdiv_ro_ops,
+ 	},
+@@ -445,8 +101,9 @@ static struct clk_alpha_pll gpll2_main =
+ 		.enable_mask = BIT(2),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gpll2_main",
+-			.parent_names = (const char *[]){
+-				"xo"
++			.parent_data = &(const struct clk_parent_data){
++				.fw_name = "xo",
++				.name = "xo",
+ 			},
+ 			.num_parents = 1,
+ 			.ops = &clk_alpha_pll_ops,
+@@ -461,9 +118,8 @@ static struct clk_alpha_pll_postdiv gpll
+ 	.width = 4,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll2",
+-		.parent_names = (const char *[]){
+-			"gpll2_main"
+-		},
++		.parent_hws = (const struct clk_hw *[]){
++				&gpll2_main.clkr.hw },
+ 		.num_parents = 1,
+ 		.ops = &clk_alpha_pll_postdiv_ro_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+@@ -478,8 +134,9 @@ static struct clk_alpha_pll gpll4_main =
+ 		.enable_mask = BIT(5),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gpll4_main",
+-			.parent_names = (const char *[]){
+-				"xo"
++			.parent_data = &(const struct clk_parent_data){
++				.fw_name = "xo",
++				.name = "xo",
+ 			},
+ 			.num_parents = 1,
+ 			.ops = &clk_alpha_pll_ops,
+@@ -494,9 +151,8 @@ static struct clk_alpha_pll_postdiv gpll
+ 	.width = 4,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll4",
+-		.parent_names = (const char *[]){
+-			"gpll4_main"
+-		},
++		.parent_hws = (const struct clk_hw *[]){
++				&gpll4_main.clkr.hw },
+ 		.num_parents = 1,
+ 		.ops = &clk_alpha_pll_postdiv_ro_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+@@ -512,8 +168,9 @@ static struct clk_alpha_pll gpll6_main =
+ 		.enable_mask = BIT(7),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gpll6_main",
+-			.parent_names = (const char *[]){
+-				"xo"
++			.parent_data = &(const struct clk_parent_data){
++				.fw_name = "xo",
++				.name = "xo",
+ 			},
+ 			.num_parents = 1,
+ 			.ops = &clk_alpha_pll_ops,
+@@ -528,9 +185,8 @@ static struct clk_alpha_pll_postdiv gpll
+ 	.width = 2,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll6",
+-		.parent_names = (const char *[]){
+-			"gpll6_main"
+-		},
++		.parent_hws = (const struct clk_hw *[]){
++				&gpll6_main.clkr.hw },
+ 		.num_parents = 1,
+ 		.ops = &clk_alpha_pll_postdiv_ro_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+@@ -542,9 +198,8 @@ static struct clk_fixed_factor gpll6_out
+ 	.div = 2,
+ 	.hw.init = &(struct clk_init_data){
+ 		.name = "gpll6_out_main_div2",
+-		.parent_names = (const char *[]){
+-			"gpll6_main"
+-		},
++		.parent_hws = (const struct clk_hw *[]){
++				&gpll6_main.clkr.hw },
+ 		.num_parents = 1,
+ 		.ops = &clk_fixed_factor_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+@@ -560,8 +215,9 @@ static struct clk_alpha_pll ubi32_pll_ma
+ 		.enable_mask = BIT(6),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "ubi32_pll_main",
+-			.parent_names = (const char *[]){
+-				"xo"
++			.parent_data = &(const struct clk_parent_data){
++				.fw_name = "xo",
++				.name = "xo",
+ 			},
+ 			.num_parents = 1,
+ 			.ops = &clk_alpha_pll_huayra_ops,
+@@ -575,9 +231,8 @@ static struct clk_alpha_pll_postdiv ubi3
+ 	.width = 2,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "ubi32_pll",
+-		.parent_names = (const char *[]){
+-			"ubi32_pll_main"
+-		},
++		.parent_hws = (const struct clk_hw *[]){
++				&ubi32_pll_main.clkr.hw },
+ 		.num_parents = 1,
+ 		.ops = &clk_alpha_pll_postdiv_ro_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+@@ -592,8 +247,9 @@ static struct clk_alpha_pll nss_crypto_p
+ 		.enable_mask = BIT(4),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "nss_crypto_pll_main",
+-			.parent_names = (const char *[]){
+-				"xo"
++			.parent_data = &(const struct clk_parent_data){
++				.fw_name = "xo",
++				.name = "xo",
+ 			},
+ 			.num_parents = 1,
+ 			.ops = &clk_alpha_pll_ops,
+@@ -607,9 +263,8 @@ static struct clk_alpha_pll_postdiv nss_
+ 	.width = 4,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "nss_crypto_pll",
+-		.parent_names = (const char *[]){
+-			"nss_crypto_pll_main"
+-		},
++		.parent_hws = (const struct clk_hw *[]){
++				&nss_crypto_pll_main.clkr.hw },
+ 		.num_parents = 1,
+ 		.ops = &clk_alpha_pll_postdiv_ro_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+@@ -623,6 +278,18 @@ static const struct freq_tbl ftbl_pcnoc_
+ 	{ }
+ };
+ 
++static const struct clk_parent_data gcc_xo_gpll0_gpll0_out_main_div2[] = {
++	{ .fw_name = "xo", .name = "xo" },
++	{ .hw = &gpll0.clkr.hw},
++	{ .hw = &gpll0_out_main_div2.hw},
++};
++
++static const struct parent_map gcc_xo_gpll0_gpll0_out_main_div2_map[] = {
++	{ P_XO, 0 },
++	{ P_GPLL0, 1 },
++	{ P_GPLL0_DIV2, 4 },
++};
++
+ static struct clk_rcg2 pcnoc_bfdcd_clk_src = {
+ 	.cmd_rcgr = 0x27000,
+ 	.freq_tbl = ftbl_pcnoc_bfdcd_clk_src,
+@@ -630,8 +297,8 @@ static struct clk_rcg2 pcnoc_bfdcd_clk_s
+ 	.parent_map = gcc_xo_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "pcnoc_bfdcd_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll0_out_main_div2,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 		.flags = CLK_IS_CRITICAL,
+ 	},
+@@ -642,9 +309,8 @@ static struct clk_fixed_factor pcnoc_clk
+ 	.div = 1,
+ 	.hw.init = &(struct clk_init_data){
+ 		.name = "pcnoc_clk_src",
+-		.parent_names = (const char *[]){
+-			"pcnoc_bfdcd_clk_src"
+-		},
++		.parent_hws = (const struct clk_hw *[]){
++				&pcnoc_bfdcd_clk_src.clkr.hw },
+ 		.num_parents = 1,
+ 		.ops = &clk_fixed_factor_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+@@ -658,8 +324,9 @@ static struct clk_branch gcc_sleep_clk_s
+ 		.enable_mask = BIT(1),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_sleep_clk_src",
+-			.parent_names = (const char *[]){
+-				"sleep_clk"
++			.parent_data = &(const struct clk_parent_data){
++				.fw_name = "sleep_clk",
++				.name = "sleep_clk",
+ 			},
+ 			.num_parents = 1,
+ 			.ops = &clk_branch2_ops,
+@@ -682,8 +349,8 @@ static struct clk_rcg2 blsp1_qup1_i2c_ap
+ 	.parent_map = gcc_xo_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "blsp1_qup1_i2c_apps_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll0_out_main_div2,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -708,8 +375,8 @@ static struct clk_rcg2 blsp1_qup1_spi_ap
+ 	.parent_map = gcc_xo_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "blsp1_qup1_spi_apps_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll0_out_main_div2,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -721,8 +388,8 @@ static struct clk_rcg2 blsp1_qup2_i2c_ap
+ 	.parent_map = gcc_xo_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "blsp1_qup2_i2c_apps_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll0_out_main_div2,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -735,8 +402,8 @@ static struct clk_rcg2 blsp1_qup2_spi_ap
+ 	.parent_map = gcc_xo_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "blsp1_qup2_spi_apps_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll0_out_main_div2,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -748,8 +415,8 @@ static struct clk_rcg2 blsp1_qup3_i2c_ap
+ 	.parent_map = gcc_xo_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "blsp1_qup3_i2c_apps_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll0_out_main_div2,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -762,8 +429,8 @@ static struct clk_rcg2 blsp1_qup3_spi_ap
+ 	.parent_map = gcc_xo_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "blsp1_qup3_spi_apps_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll0_out_main_div2,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -775,8 +442,8 @@ static struct clk_rcg2 blsp1_qup4_i2c_ap
+ 	.parent_map = gcc_xo_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "blsp1_qup4_i2c_apps_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll0_out_main_div2,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -789,8 +456,8 @@ static struct clk_rcg2 blsp1_qup4_spi_ap
+ 	.parent_map = gcc_xo_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "blsp1_qup4_spi_apps_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll0_out_main_div2,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -802,8 +469,8 @@ static struct clk_rcg2 blsp1_qup5_i2c_ap
+ 	.parent_map = gcc_xo_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "blsp1_qup5_i2c_apps_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll0_out_main_div2,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -816,8 +483,8 @@ static struct clk_rcg2 blsp1_qup5_spi_ap
+ 	.parent_map = gcc_xo_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "blsp1_qup5_spi_apps_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll0_out_main_div2,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -829,8 +496,8 @@ static struct clk_rcg2 blsp1_qup6_i2c_ap
+ 	.parent_map = gcc_xo_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "blsp1_qup6_i2c_apps_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll0_out_main_div2,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -843,8 +510,8 @@ static struct clk_rcg2 blsp1_qup6_spi_ap
+ 	.parent_map = gcc_xo_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "blsp1_qup6_spi_apps_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll0_out_main_div2,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -877,8 +544,8 @@ static struct clk_rcg2 blsp1_uart1_apps_
+ 	.parent_map = gcc_xo_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "blsp1_uart1_apps_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll0_out_main_div2,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -891,8 +558,8 @@ static struct clk_rcg2 blsp1_uart2_apps_
+ 	.parent_map = gcc_xo_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "blsp1_uart2_apps_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll0_out_main_div2,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -905,8 +572,8 @@ static struct clk_rcg2 blsp1_uart3_apps_
+ 	.parent_map = gcc_xo_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "blsp1_uart3_apps_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll0_out_main_div2,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -919,8 +586,8 @@ static struct clk_rcg2 blsp1_uart4_apps_
+ 	.parent_map = gcc_xo_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "blsp1_uart4_apps_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll0_out_main_div2,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -933,8 +600,8 @@ static struct clk_rcg2 blsp1_uart5_apps_
+ 	.parent_map = gcc_xo_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "blsp1_uart5_apps_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll0_out_main_div2,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -947,8 +614,8 @@ static struct clk_rcg2 blsp1_uart6_apps_
+ 	.parent_map = gcc_xo_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "blsp1_uart6_apps_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll0_out_main_div2,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -958,6 +625,11 @@ static const struct clk_parent_data gcc_
+ 	{ .hw = &gpll0.clkr.hw },
+ };
+ 
++static const struct parent_map gcc_xo_gpll0_map[] = {
++	{ P_XO, 0 },
++	{ P_GPLL0, 1 },
++};
++
+ static const struct freq_tbl ftbl_pcie_axi_clk_src[] = {
+ 	F(19200000, P_XO, 1, 0, 0),
+ 	F(200000000, P_GPLL0, 4, 0, 0),
+@@ -972,7 +644,7 @@ static struct clk_rcg2 pcie0_axi_clk_src
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "pcie0_axi_clk_src",
+ 		.parent_data = gcc_xo_gpll0,
+-		.num_parents = 2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -981,6 +653,18 @@ static const struct freq_tbl ftbl_pcie_a
+ 	F(19200000, P_XO, 1, 0, 0),
+ };
+ 
++static const struct clk_parent_data gcc_xo_gpll0_sleep_clk[] = {
++	{ .fw_name = "xo", .name = "xo" },
++	{ .hw = &gpll0.clkr.hw },
++	{ .fw_name = "sleep_clk", .name = "sleep_clk" },
++};
++
++static const struct parent_map gcc_xo_gpll0_sleep_clk_map[] = {
++	{ P_XO, 0 },
++	{ P_GPLL0, 2 },
++	{ P_SLEEP_CLK, 6 },
++};
++
+ static struct clk_rcg2 pcie0_aux_clk_src = {
+ 	.cmd_rcgr = 0x75024,
+ 	.freq_tbl = ftbl_pcie_aux_clk_src,
+@@ -989,12 +673,22 @@ static struct clk_rcg2 pcie0_aux_clk_src
+ 	.parent_map = gcc_xo_gpll0_sleep_clk_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "pcie0_aux_clk_src",
+-		.parent_names = gcc_xo_gpll0_sleep_clk,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_sleep_clk,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_sleep_clk),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+ 
++static const struct clk_parent_data gcc_pcie20_phy0_pipe_clk_xo[] = {
++	{ .name = "pcie20_phy0_pipe_clk" },
++	{ .fw_name = "xo", .name = "xo" },
++};
++
++static const struct parent_map gcc_pcie20_phy0_pipe_clk_xo_map[] = {
++	{ P_PCIE20_PHY0_PIPE, 0 },
++	{ P_XO, 2 },
++};
++
+ static struct clk_regmap_mux pcie0_pipe_clk_src = {
+ 	.reg = 0x7501c,
+ 	.shift = 8,
+@@ -1003,8 +697,8 @@ static struct clk_regmap_mux pcie0_pipe_
+ 	.clkr = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "pcie0_pipe_clk_src",
+-			.parent_names = gcc_pcie20_phy0_pipe_clk_xo,
+-			.num_parents = 2,
++			.parent_data = gcc_pcie20_phy0_pipe_clk_xo,
++			.num_parents = ARRAY_SIZE(gcc_pcie20_phy0_pipe_clk_xo),
+ 			.ops = &clk_regmap_mux_closest_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 		},
+@@ -1019,7 +713,7 @@ static struct clk_rcg2 pcie1_axi_clk_src
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "pcie1_axi_clk_src",
+ 		.parent_data = gcc_xo_gpll0,
+-		.num_parents = 2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1032,12 +726,22 @@ static struct clk_rcg2 pcie1_aux_clk_src
+ 	.parent_map = gcc_xo_gpll0_sleep_clk_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "pcie1_aux_clk_src",
+-		.parent_names = gcc_xo_gpll0_sleep_clk,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_sleep_clk,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_sleep_clk),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+ 
++static const struct clk_parent_data gcc_pcie20_phy1_pipe_clk_xo[] = {
++	{ .name = "pcie20_phy1_pipe_clk" },
++	{ .fw_name = "xo", .name = "xo" },
++};
++
++static const struct parent_map gcc_pcie20_phy1_pipe_clk_xo_map[] = {
++	{ P_PCIE20_PHY1_PIPE, 0 },
++	{ P_XO, 2 },
++};
++
+ static struct clk_regmap_mux pcie1_pipe_clk_src = {
+ 	.reg = 0x7601c,
+ 	.shift = 8,
+@@ -1046,8 +750,8 @@ static struct clk_regmap_mux pcie1_pipe_
+ 	.clkr = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "pcie1_pipe_clk_src",
+-			.parent_names = gcc_pcie20_phy1_pipe_clk_xo,
+-			.num_parents = 2,
++			.parent_data = gcc_pcie20_phy1_pipe_clk_xo,
++			.num_parents = ARRAY_SIZE(gcc_pcie20_phy1_pipe_clk_xo),
+ 			.ops = &clk_regmap_mux_closest_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 		},
+@@ -1066,6 +770,20 @@ static const struct freq_tbl ftbl_sdcc_a
+ 	{ }
+ };
+ 
++static const struct clk_parent_data gcc_xo_gpll0_gpll2_gpll0_out_main_div2[] = {
++	{ .fw_name = "xo", .name = "xo" },
++	{ .hw = &gpll0.clkr.hw },
++	{ .hw = &gpll2.clkr.hw },
++	{ .hw = &gpll0_out_main_div2.hw },
++};
++
++static const struct parent_map gcc_xo_gpll0_gpll2_gpll0_out_main_div2_map[] = {
++	{ P_XO, 0 },
++	{ P_GPLL0, 1 },
++	{ P_GPLL2, 2 },
++	{ P_GPLL0_DIV2, 4 },
++};
++
+ static struct clk_rcg2 sdcc1_apps_clk_src = {
+ 	.cmd_rcgr = 0x42004,
+ 	.freq_tbl = ftbl_sdcc_apps_clk_src,
+@@ -1074,8 +792,8 @@ static struct clk_rcg2 sdcc1_apps_clk_sr
+ 	.parent_map = gcc_xo_gpll0_gpll2_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "sdcc1_apps_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll2_gpll0_out_main_div2,
+-		.num_parents = 4,
++		.parent_data = gcc_xo_gpll0_gpll2_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll2_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_floor_ops,
+ 	},
+ };
+@@ -1086,6 +804,20 @@ static const struct freq_tbl ftbl_sdcc_i
+ 	F(308570000, P_GPLL6, 3.5, 0, 0),
+ };
+ 
++static const struct clk_parent_data gcc_xo_gpll0_gpll6_gpll0_div2[] = {
++	{ .fw_name = "xo", .name = "xo" },
++	{ .hw = &gpll0.clkr.hw },
++	{ .hw = &gpll6.clkr.hw },
++	{ .hw = &gpll0_out_main_div2.hw },
++};
++
++static const struct parent_map gcc_xo_gpll0_gpll6_gpll0_div2_map[] = {
++	{ P_XO, 0 },
++	{ P_GPLL0, 1 },
++	{ P_GPLL6, 2 },
++	{ P_GPLL0_DIV2, 4 },
++};
++
+ static struct clk_rcg2 sdcc1_ice_core_clk_src = {
+ 	.cmd_rcgr = 0x5d000,
+ 	.freq_tbl = ftbl_sdcc_ice_core_clk_src,
+@@ -1094,8 +826,8 @@ static struct clk_rcg2 sdcc1_ice_core_cl
+ 	.parent_map = gcc_xo_gpll0_gpll6_gpll0_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "sdcc1_ice_core_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll6_gpll0_div2,
+-		.num_parents = 4,
++		.parent_data = gcc_xo_gpll0_gpll6_gpll0_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll6_gpll0_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1108,8 +840,8 @@ static struct clk_rcg2 sdcc2_apps_clk_sr
+ 	.parent_map = gcc_xo_gpll0_gpll2_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "sdcc2_apps_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll2_gpll0_out_main_div2,
+-		.num_parents = 4,
++		.parent_data = gcc_xo_gpll0_gpll2_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll2_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_floor_ops,
+ 	},
+ };
+@@ -1121,6 +853,18 @@ static const struct freq_tbl ftbl_usb_ma
+ 	{ }
+ };
+ 
++static const struct clk_parent_data gcc_xo_gpll0_out_main_div2_gpll0[] = {
++	{ .fw_name = "xo", .name = "xo" },
++	{ .hw = &gpll0_out_main_div2.hw },
++	{ .hw = &gpll0.clkr.hw },
++};
++
++static const struct parent_map gcc_xo_gpll0_out_main_div2_gpll0_map[] = {
++	{ P_XO, 0 },
++	{ P_GPLL0_DIV2, 2 },
++	{ P_GPLL0, 1 },
++};
++
+ static struct clk_rcg2 usb0_master_clk_src = {
+ 	.cmd_rcgr = 0x3e00c,
+ 	.freq_tbl = ftbl_usb_master_clk_src,
+@@ -1129,8 +873,8 @@ static struct clk_rcg2 usb0_master_clk_s
+ 	.parent_map = gcc_xo_gpll0_out_main_div2_gpll0_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "usb0_master_clk_src",
+-		.parent_names = gcc_xo_gpll0_out_main_div2_gpll0,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_out_main_div2_gpll0,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_out_main_div2_gpll0),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1148,8 +892,8 @@ static struct clk_rcg2 usb0_aux_clk_src
+ 	.parent_map = gcc_xo_gpll0_sleep_clk_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "usb0_aux_clk_src",
+-		.parent_names = gcc_xo_gpll0_sleep_clk,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_sleep_clk,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_sleep_clk),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1161,6 +905,20 @@ static const struct freq_tbl ftbl_usb_mo
+ 	{ }
+ };
+ 
++static const struct clk_parent_data gcc_xo_gpll6_gpll0_gpll0_out_main_div2[] = {
++	{ .fw_name = "xo", .name = "xo" },
++	{ .hw = &gpll6.clkr.hw },
++	{ .hw = &gpll0.clkr.hw },
++	{ .hw = &gpll0_out_main_div2.hw },
++};
++
++static const struct parent_map gcc_xo_gpll6_gpll0_gpll0_out_main_div2_map[] = {
++	{ P_XO, 0 },
++	{ P_GPLL6, 1 },
++	{ P_GPLL0, 3 },
++	{ P_GPLL0_DIV2, 4 },
++};
++
+ static struct clk_rcg2 usb0_mock_utmi_clk_src = {
+ 	.cmd_rcgr = 0x3e020,
+ 	.freq_tbl = ftbl_usb_mock_utmi_clk_src,
+@@ -1169,12 +927,22 @@ static struct clk_rcg2 usb0_mock_utmi_cl
+ 	.parent_map = gcc_xo_gpll6_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "usb0_mock_utmi_clk_src",
+-		.parent_names = gcc_xo_gpll6_gpll0_gpll0_out_main_div2,
+-		.num_parents = 4,
++		.parent_data = gcc_xo_gpll6_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll6_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+ 
++static const struct clk_parent_data gcc_usb3phy_0_cc_pipe_clk_xo[] = {
++	{ .name = "usb3phy_0_cc_pipe_clk" },
++	{ .fw_name = "xo", .name = "xo" },
++};
++
++static const struct parent_map gcc_usb3phy_0_cc_pipe_clk_xo_map[] = {
++	{ P_USB3PHY_0_PIPE, 0 },
++	{ P_XO, 2 },
++};
++
+ static struct clk_regmap_mux usb0_pipe_clk_src = {
+ 	.reg = 0x3e048,
+ 	.shift = 8,
+@@ -1183,8 +951,8 @@ static struct clk_regmap_mux usb0_pipe_c
+ 	.clkr = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "usb0_pipe_clk_src",
+-			.parent_names = gcc_usb3phy_0_cc_pipe_clk_xo,
+-			.num_parents = 2,
++			.parent_data = gcc_usb3phy_0_cc_pipe_clk_xo,
++			.num_parents = ARRAY_SIZE(gcc_usb3phy_0_cc_pipe_clk_xo),
+ 			.ops = &clk_regmap_mux_closest_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 		},
+@@ -1199,8 +967,8 @@ static struct clk_rcg2 usb1_master_clk_s
+ 	.parent_map = gcc_xo_gpll0_out_main_div2_gpll0_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "usb1_master_clk_src",
+-		.parent_names = gcc_xo_gpll0_out_main_div2_gpll0,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_out_main_div2_gpll0,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_out_main_div2_gpll0),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1213,8 +981,8 @@ static struct clk_rcg2 usb1_aux_clk_src
+ 	.parent_map = gcc_xo_gpll0_sleep_clk_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "usb1_aux_clk_src",
+-		.parent_names = gcc_xo_gpll0_sleep_clk,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_sleep_clk,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_sleep_clk),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1227,12 +995,22 @@ static struct clk_rcg2 usb1_mock_utmi_cl
+ 	.parent_map = gcc_xo_gpll6_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "usb1_mock_utmi_clk_src",
+-		.parent_names = gcc_xo_gpll6_gpll0_gpll0_out_main_div2,
+-		.num_parents = 4,
++		.parent_data = gcc_xo_gpll6_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll6_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+ 
++static const struct clk_parent_data gcc_usb3phy_1_cc_pipe_clk_xo[] = {
++	{ .name = "usb3phy_1_cc_pipe_clk" },
++	{ .fw_name = "xo", .name = "xo" },
++};
++
++static const struct parent_map gcc_usb3phy_1_cc_pipe_clk_xo_map[] = {
++	{ P_USB3PHY_1_PIPE, 0 },
++	{ P_XO, 2 },
++};
++
+ static struct clk_regmap_mux usb1_pipe_clk_src = {
+ 	.reg = 0x3f048,
+ 	.shift = 8,
+@@ -1241,8 +1019,8 @@ static struct clk_regmap_mux usb1_pipe_c
+ 	.clkr = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "usb1_pipe_clk_src",
+-			.parent_names = gcc_usb3phy_1_cc_pipe_clk_xo,
+-			.num_parents = 2,
++			.parent_data = gcc_usb3phy_1_cc_pipe_clk_xo,
++			.num_parents = ARRAY_SIZE(gcc_usb3phy_1_cc_pipe_clk_xo),
+ 			.ops = &clk_regmap_mux_closest_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 		},
+@@ -1256,8 +1034,9 @@ static struct clk_branch gcc_xo_clk_src
+ 		.enable_mask = BIT(1),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_xo_clk_src",
+-			.parent_names = (const char *[]){
+-				"xo"
++			.parent_data = &(const struct clk_parent_data){
++				.fw_name = "xo",
++				.name = "xo",
+ 			},
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL,
+@@ -1271,9 +1050,8 @@ static struct clk_fixed_factor gcc_xo_di
+ 	.div = 4,
+ 	.hw.init = &(struct clk_init_data){
+ 		.name = "gcc_xo_div4_clk_src",
+-		.parent_names = (const char *[]){
+-			"gcc_xo_clk_src"
+-		},
++		.parent_hws = (const struct clk_hw *[]){
++				&gcc_xo_clk_src.clkr.hw },
+ 		.num_parents = 1,
+ 		.ops = &clk_fixed_factor_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+@@ -1291,6 +1069,20 @@ static const struct freq_tbl ftbl_system
+ 	{ }
+ };
+ 
++static const struct clk_parent_data gcc_xo_gpll0_gpll6_gpll0_out_main_div2[] = {
++	{ .fw_name = "xo", .name = "xo" },
++	{ .hw = &gpll0.clkr.hw },
++	{ .hw = &gpll6.clkr.hw },
++	{ .hw = &gpll0_out_main_div2.hw },
++};
++
++static const struct parent_map gcc_xo_gpll0_gpll6_gpll0_out_main_div2_map[] = {
++	{ P_XO, 0 },
++	{ P_GPLL0, 1 },
++	{ P_GPLL6, 2 },
++	{ P_GPLL0_DIV2, 3 },
++};
++
+ static struct clk_rcg2 system_noc_bfdcd_clk_src = {
+ 	.cmd_rcgr = 0x26004,
+ 	.freq_tbl = ftbl_system_noc_bfdcd_clk_src,
+@@ -1298,8 +1090,8 @@ static struct clk_rcg2 system_noc_bfdcd_
+ 	.parent_map = gcc_xo_gpll0_gpll6_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "system_noc_bfdcd_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll6_gpll0_out_main_div2,
+-		.num_parents = 4,
++		.parent_data = gcc_xo_gpll0_gpll6_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll6_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 		.flags = CLK_IS_CRITICAL,
+ 	},
+@@ -1310,9 +1102,8 @@ static struct clk_fixed_factor system_no
+ 	.div = 1,
+ 	.hw.init = &(struct clk_init_data){
+ 		.name = "system_noc_clk_src",
+-		.parent_names = (const char *[]){
+-			"system_noc_bfdcd_clk_src"
+-		},
++		.parent_hws = (const struct clk_hw *[]){
++				&system_noc_bfdcd_clk_src.clkr.hw },
+ 		.num_parents = 1,
+ 		.ops = &clk_fixed_factor_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+@@ -1333,7 +1124,7 @@ static struct clk_rcg2 nss_ce_clk_src =
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "nss_ce_clk_src",
+ 		.parent_data = gcc_xo_gpll0,
+-		.num_parents = 2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1344,6 +1135,20 @@ static const struct freq_tbl ftbl_nss_no
+ 	{ }
+ };
+ 
++static const struct clk_parent_data gcc_xo_bias_pll_nss_noc_clk_gpll0_gpll2[] = {
++	{ .fw_name = "xo", .name = "xo" },
++	{ .name = "bias_pll_nss_noc_clk" },
++	{ .hw = &gpll0.clkr.hw },
++	{ .hw = &gpll2.clkr.hw },
++};
++
++static const struct parent_map gcc_xo_bias_pll_nss_noc_clk_gpll0_gpll2_map[] = {
++	{ P_XO, 0 },
++	{ P_BIAS_PLL_NSS_NOC, 1 },
++	{ P_GPLL0, 2 },
++	{ P_GPLL2, 3 },
++};
++
+ static struct clk_rcg2 nss_noc_bfdcd_clk_src = {
+ 	.cmd_rcgr = 0x68088,
+ 	.freq_tbl = ftbl_nss_noc_bfdcd_clk_src,
+@@ -1351,8 +1156,8 @@ static struct clk_rcg2 nss_noc_bfdcd_clk
+ 	.parent_map = gcc_xo_bias_pll_nss_noc_clk_gpll0_gpll2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "nss_noc_bfdcd_clk_src",
+-		.parent_names = gcc_xo_bias_pll_nss_noc_clk_gpll0_gpll2,
+-		.num_parents = 4,
++		.parent_data = gcc_xo_bias_pll_nss_noc_clk_gpll0_gpll2,
++		.num_parents = ARRAY_SIZE(gcc_xo_bias_pll_nss_noc_clk_gpll0_gpll2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1362,9 +1167,8 @@ static struct clk_fixed_factor nss_noc_c
+ 	.div = 1,
+ 	.hw.init = &(struct clk_init_data){
+ 		.name = "nss_noc_clk_src",
+-		.parent_names = (const char *[]){
+-			"nss_noc_bfdcd_clk_src"
+-		},
++		.parent_hws = (const struct clk_hw *[]){
++				&nss_noc_bfdcd_clk_src.clkr.hw },
+ 		.num_parents = 1,
+ 		.ops = &clk_fixed_factor_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+@@ -1377,6 +1181,18 @@ static const struct freq_tbl ftbl_nss_cr
+ 	{ }
+ };
+ 
++static const struct clk_parent_data gcc_xo_nss_crypto_pll_gpll0[] = {
++	{ .fw_name = "xo", .name = "xo" },
++	{ .hw = &nss_crypto_pll.clkr.hw },
++	{ .hw = &gpll0.clkr.hw },
++};
++
++static const struct parent_map gcc_xo_nss_crypto_pll_gpll0_map[] = {
++	{ P_XO, 0 },
++	{ P_NSS_CRYPTO_PLL, 1 },
++	{ P_GPLL0, 2 },
++};
++
+ static struct clk_rcg2 nss_crypto_clk_src = {
+ 	.cmd_rcgr = 0x68144,
+ 	.freq_tbl = ftbl_nss_crypto_clk_src,
+@@ -1385,8 +1201,8 @@ static struct clk_rcg2 nss_crypto_clk_sr
+ 	.parent_map = gcc_xo_nss_crypto_pll_gpll0_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "nss_crypto_clk_src",
+-		.parent_names = gcc_xo_nss_crypto_pll_gpll0,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_nss_crypto_pll_gpll0,
++		.num_parents = ARRAY_SIZE(gcc_xo_nss_crypto_pll_gpll0),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1400,6 +1216,24 @@ static const struct freq_tbl ftbl_nss_ub
+ 	{ }
+ };
+ 
++static const struct clk_parent_data gcc_xo_ubi32_pll_gpll0_gpll2_gpll4_gpll6[] = {
++	{ .fw_name = "xo", .name = "xo" },
++	{ .hw = &ubi32_pll.clkr.hw },
++	{ .hw = &gpll0.clkr.hw },
++	{ .hw = &gpll2.clkr.hw },
++	{ .hw = &gpll4.clkr.hw },
++	{ .hw = &gpll6.clkr.hw },
++};
++
++static const struct parent_map gcc_xo_ubi32_gpll0_gpll2_gpll4_gpll6_map[] = {
++	{ P_XO, 0 },
++	{ P_UBI32_PLL, 1 },
++	{ P_GPLL0, 2 },
++	{ P_GPLL2, 3 },
++	{ P_GPLL4, 4 },
++	{ P_GPLL6, 5 },
++};
++
+ static struct clk_rcg2 nss_ubi0_clk_src = {
+ 	.cmd_rcgr = 0x68104,
+ 	.freq_tbl = ftbl_nss_ubi_clk_src,
+@@ -1407,8 +1241,8 @@ static struct clk_rcg2 nss_ubi0_clk_src
+ 	.parent_map = gcc_xo_ubi32_gpll0_gpll2_gpll4_gpll6_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "nss_ubi0_clk_src",
+-		.parent_names = gcc_xo_ubi32_pll_gpll0_gpll2_gpll4_gpll6,
+-		.num_parents = 6,
++		.parent_data = gcc_xo_ubi32_pll_gpll0_gpll2_gpll4_gpll6,
++		.num_parents = ARRAY_SIZE(gcc_xo_ubi32_pll_gpll0_gpll2_gpll4_gpll6),
+ 		.ops = &clk_rcg2_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+ 	},
+@@ -1421,9 +1255,8 @@ static struct clk_regmap_div nss_ubi0_di
+ 	.clkr = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "nss_ubi0_div_clk_src",
+-			.parent_names = (const char *[]){
+-				"nss_ubi0_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ubi0_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.ops = &clk_regmap_div_ro_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1438,8 +1271,8 @@ static struct clk_rcg2 nss_ubi1_clk_src
+ 	.parent_map = gcc_xo_ubi32_gpll0_gpll2_gpll4_gpll6_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "nss_ubi1_clk_src",
+-		.parent_names = gcc_xo_ubi32_pll_gpll0_gpll2_gpll4_gpll6,
+-		.num_parents = 6,
++		.parent_data = gcc_xo_ubi32_pll_gpll0_gpll2_gpll4_gpll6,
++		.num_parents = ARRAY_SIZE(gcc_xo_ubi32_pll_gpll0_gpll2_gpll4_gpll6),
+ 		.ops = &clk_rcg2_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+ 	},
+@@ -1452,9 +1285,8 @@ static struct clk_regmap_div nss_ubi1_di
+ 	.clkr = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "nss_ubi1_div_clk_src",
+-			.parent_names = (const char *[]){
+-				"nss_ubi1_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ubi1_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.ops = &clk_regmap_div_ro_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1468,6 +1300,16 @@ static const struct freq_tbl ftbl_ubi_mp
+ 	{ }
+ };
+ 
++static const struct clk_parent_data gcc_xo_gpll0_out_main_div2[] = {
++	{ .fw_name = "xo", .name = "xo" },
++	{ .hw = &gpll0_out_main_div2.hw },
++};
++
++static const struct parent_map gcc_xo_gpll0_out_main_div2_map[] = {
++	{ P_XO, 0 },
++	{ P_GPLL0_DIV2, 1 },
++};
++
+ static struct clk_rcg2 ubi_mpt_clk_src = {
+ 	.cmd_rcgr = 0x68090,
+ 	.freq_tbl = ftbl_ubi_mpt_clk_src,
+@@ -1475,8 +1317,8 @@ static struct clk_rcg2 ubi_mpt_clk_src =
+ 	.parent_map = gcc_xo_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "ubi_mpt_clk_src",
+-		.parent_names = gcc_xo_gpll0_out_main_div2,
+-		.num_parents = 2,
++		.parent_data = gcc_xo_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1487,6 +1329,18 @@ static const struct freq_tbl ftbl_nss_im
+ 	{ }
+ };
+ 
++static const struct clk_parent_data gcc_xo_gpll0_gpll4[] = {
++	{ .fw_name = "xo", .name = "xo" },
++	{ .hw = &gpll0.clkr.hw },
++	{ .hw = &gpll4.clkr.hw },
++};
++
++static const struct parent_map gcc_xo_gpll0_gpll4_map[] = {
++	{ P_XO, 0 },
++	{ P_GPLL0, 1 },
++	{ P_GPLL4, 2 },
++};
++
+ static struct clk_rcg2 nss_imem_clk_src = {
+ 	.cmd_rcgr = 0x68158,
+ 	.freq_tbl = ftbl_nss_imem_clk_src,
+@@ -1494,8 +1348,8 @@ static struct clk_rcg2 nss_imem_clk_src
+ 	.parent_map = gcc_xo_gpll0_gpll4_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "nss_imem_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll4,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_gpll4,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll4),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1506,6 +1360,24 @@ static const struct freq_tbl ftbl_nss_pp
+ 	{ }
+ };
+ 
++static const struct clk_parent_data gcc_xo_bias_gpll0_gpll4_nss_ubi32[] = {
++	{ .fw_name = "xo", .name = "xo" },
++	{ .name = "bias_pll_cc_clk" },
++	{ .hw = &gpll0.clkr.hw },
++	{ .hw = &gpll4.clkr.hw },
++	{ .hw = &nss_crypto_pll.clkr.hw },
++	{ .hw = &ubi32_pll.clkr.hw },
++};
++
++static const struct parent_map gcc_xo_bias_gpll0_gpll4_nss_ubi32_map[] = {
++	{ P_XO, 0 },
++	{ P_BIAS_PLL, 1 },
++	{ P_GPLL0, 2 },
++	{ P_GPLL4, 3 },
++	{ P_NSS_CRYPTO_PLL, 4 },
++	{ P_UBI32_PLL, 5 },
++};
++
+ static struct clk_rcg2 nss_ppe_clk_src = {
+ 	.cmd_rcgr = 0x68080,
+ 	.freq_tbl = ftbl_nss_ppe_clk_src,
+@@ -1513,8 +1385,8 @@ static struct clk_rcg2 nss_ppe_clk_src =
+ 	.parent_map = gcc_xo_bias_gpll0_gpll4_nss_ubi32_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "nss_ppe_clk_src",
+-		.parent_names = gcc_xo_bias_gpll0_gpll4_nss_ubi32,
+-		.num_parents = 6,
++		.parent_data = gcc_xo_bias_gpll0_gpll4_nss_ubi32,
++		.num_parents = ARRAY_SIZE(gcc_xo_bias_gpll0_gpll4_nss_ubi32),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1524,9 +1396,8 @@ static struct clk_fixed_factor nss_ppe_c
+ 	.div = 4,
+ 	.hw.init = &(struct clk_init_data){
+ 		.name = "nss_ppe_cdiv_clk_src",
+-		.parent_names = (const char *[]){
+-			"nss_ppe_clk_src"
+-		},
++		.parent_hws = (const struct clk_hw *[]){
++				&nss_ppe_clk_src.clkr.hw },
+ 		.num_parents = 1,
+ 		.ops = &clk_fixed_factor_ops,
+ 		.flags = CLK_SET_RATE_PARENT,
+@@ -1540,6 +1411,22 @@ static const struct freq_tbl ftbl_nss_po
+ 	{ }
+ };
+ 
++static const struct clk_parent_data gcc_xo_uniphy0_rx_tx_ubi32_bias[] = {
++	{ .fw_name = "xo", .name = "xo" },
++	{ .name = "uniphy0_gcc_rx_clk" },
++	{ .name = "uniphy0_gcc_tx_clk" },
++	{ .hw = &ubi32_pll.clkr.hw },
++	{ .name = "bias_pll_cc_clk" },
++};
++
++static const struct parent_map gcc_xo_uniphy0_rx_tx_ubi32_bias_map[] = {
++	{ P_XO, 0 },
++	{ P_UNIPHY0_RX, 1 },
++	{ P_UNIPHY0_TX, 2 },
++	{ P_UBI32_PLL, 5 },
++	{ P_BIAS_PLL, 6 },
++};
++
+ static struct clk_rcg2 nss_port1_rx_clk_src = {
+ 	.cmd_rcgr = 0x68020,
+ 	.freq_tbl = ftbl_nss_port1_rx_clk_src,
+@@ -1547,8 +1434,8 @@ static struct clk_rcg2 nss_port1_rx_clk_
+ 	.parent_map = gcc_xo_uniphy0_rx_tx_ubi32_bias_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "nss_port1_rx_clk_src",
+-		.parent_names = gcc_xo_uniphy0_rx_tx_ubi32_bias,
+-		.num_parents = 5,
++		.parent_data = gcc_xo_uniphy0_rx_tx_ubi32_bias,
++		.num_parents = ARRAY_SIZE(gcc_xo_uniphy0_rx_tx_ubi32_bias),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1560,9 +1447,8 @@ static struct clk_regmap_div nss_port1_r
+ 	.clkr = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "nss_port1_rx_div_clk_src",
+-			.parent_names = (const char *[]){
+-				"nss_port1_rx_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port1_rx_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.ops = &clk_regmap_div_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1577,6 +1463,22 @@ static const struct freq_tbl ftbl_nss_po
+ 	{ }
+ };
+ 
++static const struct clk_parent_data gcc_xo_uniphy0_tx_rx_ubi32_bias[] = {
++	{ .fw_name = "xo", .name = "xo" },
++	{ .name = "uniphy0_gcc_tx_clk" },
++	{ .name = "uniphy0_gcc_rx_clk" },
++	{ .hw = &ubi32_pll.clkr.hw },
++	{ .name = "bias_pll_cc_clk" },
++};
++
++static const struct parent_map gcc_xo_uniphy0_tx_rx_ubi32_bias_map[] = {
++	{ P_XO, 0 },
++	{ P_UNIPHY0_TX, 1 },
++	{ P_UNIPHY0_RX, 2 },
++	{ P_UBI32_PLL, 5 },
++	{ P_BIAS_PLL, 6 },
++};
++
+ static struct clk_rcg2 nss_port1_tx_clk_src = {
+ 	.cmd_rcgr = 0x68028,
+ 	.freq_tbl = ftbl_nss_port1_tx_clk_src,
+@@ -1584,8 +1486,8 @@ static struct clk_rcg2 nss_port1_tx_clk_
+ 	.parent_map = gcc_xo_uniphy0_tx_rx_ubi32_bias_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "nss_port1_tx_clk_src",
+-		.parent_names = gcc_xo_uniphy0_tx_rx_ubi32_bias,
+-		.num_parents = 5,
++		.parent_data = gcc_xo_uniphy0_tx_rx_ubi32_bias,
++		.num_parents = ARRAY_SIZE(gcc_xo_uniphy0_tx_rx_ubi32_bias),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1597,9 +1499,8 @@ static struct clk_regmap_div nss_port1_t
+ 	.clkr = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "nss_port1_tx_div_clk_src",
+-			.parent_names = (const char *[]){
+-				"nss_port1_tx_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port1_tx_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.ops = &clk_regmap_div_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1614,8 +1515,8 @@ static struct clk_rcg2 nss_port2_rx_clk_
+ 	.parent_map = gcc_xo_uniphy0_rx_tx_ubi32_bias_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "nss_port2_rx_clk_src",
+-		.parent_names = gcc_xo_uniphy0_rx_tx_ubi32_bias,
+-		.num_parents = 5,
++		.parent_data = gcc_xo_uniphy0_rx_tx_ubi32_bias,
++		.num_parents = ARRAY_SIZE(gcc_xo_uniphy0_rx_tx_ubi32_bias),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1627,9 +1528,8 @@ static struct clk_regmap_div nss_port2_r
+ 	.clkr = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "nss_port2_rx_div_clk_src",
+-			.parent_names = (const char *[]){
+-				"nss_port2_rx_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port2_rx_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.ops = &clk_regmap_div_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1644,8 +1544,8 @@ static struct clk_rcg2 nss_port2_tx_clk_
+ 	.parent_map = gcc_xo_uniphy0_tx_rx_ubi32_bias_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "nss_port2_tx_clk_src",
+-		.parent_names = gcc_xo_uniphy0_tx_rx_ubi32_bias,
+-		.num_parents = 5,
++		.parent_data = gcc_xo_uniphy0_tx_rx_ubi32_bias,
++		.num_parents = ARRAY_SIZE(gcc_xo_uniphy0_tx_rx_ubi32_bias),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1657,9 +1557,8 @@ static struct clk_regmap_div nss_port2_t
+ 	.clkr = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "nss_port2_tx_div_clk_src",
+-			.parent_names = (const char *[]){
+-				"nss_port2_tx_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port2_tx_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.ops = &clk_regmap_div_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1674,8 +1573,8 @@ static struct clk_rcg2 nss_port3_rx_clk_
+ 	.parent_map = gcc_xo_uniphy0_rx_tx_ubi32_bias_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "nss_port3_rx_clk_src",
+-		.parent_names = gcc_xo_uniphy0_rx_tx_ubi32_bias,
+-		.num_parents = 5,
++		.parent_data = gcc_xo_uniphy0_rx_tx_ubi32_bias,
++		.num_parents = ARRAY_SIZE(gcc_xo_uniphy0_rx_tx_ubi32_bias),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1687,9 +1586,8 @@ static struct clk_regmap_div nss_port3_r
+ 	.clkr = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "nss_port3_rx_div_clk_src",
+-			.parent_names = (const char *[]){
+-				"nss_port3_rx_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port3_rx_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.ops = &clk_regmap_div_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1704,8 +1602,8 @@ static struct clk_rcg2 nss_port3_tx_clk_
+ 	.parent_map = gcc_xo_uniphy0_tx_rx_ubi32_bias_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "nss_port3_tx_clk_src",
+-		.parent_names = gcc_xo_uniphy0_tx_rx_ubi32_bias,
+-		.num_parents = 5,
++		.parent_data = gcc_xo_uniphy0_tx_rx_ubi32_bias,
++		.num_parents = ARRAY_SIZE(gcc_xo_uniphy0_tx_rx_ubi32_bias),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1717,9 +1615,8 @@ static struct clk_regmap_div nss_port3_t
+ 	.clkr = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "nss_port3_tx_div_clk_src",
+-			.parent_names = (const char *[]){
+-				"nss_port3_tx_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port3_tx_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.ops = &clk_regmap_div_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1734,8 +1631,8 @@ static struct clk_rcg2 nss_port4_rx_clk_
+ 	.parent_map = gcc_xo_uniphy0_rx_tx_ubi32_bias_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "nss_port4_rx_clk_src",
+-		.parent_names = gcc_xo_uniphy0_rx_tx_ubi32_bias,
+-		.num_parents = 5,
++		.parent_data = gcc_xo_uniphy0_rx_tx_ubi32_bias,
++		.num_parents = ARRAY_SIZE(gcc_xo_uniphy0_rx_tx_ubi32_bias),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1747,9 +1644,8 @@ static struct clk_regmap_div nss_port4_r
+ 	.clkr = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "nss_port4_rx_div_clk_src",
+-			.parent_names = (const char *[]){
+-				"nss_port4_rx_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port4_rx_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.ops = &clk_regmap_div_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1764,8 +1660,8 @@ static struct clk_rcg2 nss_port4_tx_clk_
+ 	.parent_map = gcc_xo_uniphy0_tx_rx_ubi32_bias_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "nss_port4_tx_clk_src",
+-		.parent_names = gcc_xo_uniphy0_tx_rx_ubi32_bias,
+-		.num_parents = 5,
++		.parent_data = gcc_xo_uniphy0_tx_rx_ubi32_bias,
++		.num_parents = ARRAY_SIZE(gcc_xo_uniphy0_tx_rx_ubi32_bias),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1777,9 +1673,8 @@ static struct clk_regmap_div nss_port4_t
+ 	.clkr = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "nss_port4_tx_div_clk_src",
+-			.parent_names = (const char *[]){
+-				"nss_port4_tx_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port4_tx_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.ops = &clk_regmap_div_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1799,6 +1694,27 @@ static const struct freq_tbl ftbl_nss_po
+ 	{ }
+ };
+ 
++static const struct clk_parent_data gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias[] = {
++	{ .fw_name = "xo", .name = "xo" },
++	{ .name = "uniphy0_gcc_rx_clk" },
++	{ .name = "uniphy0_gcc_tx_clk" },
++	{ .name = "uniphy1_gcc_rx_clk" },
++	{ .name = "uniphy1_gcc_tx_clk" },
++	{ .hw = &ubi32_pll.clkr.hw },
++	{ .name = "bias_pll_cc_clk" },
++};
++
++static const struct parent_map
++gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias_map[] = {
++	{ P_XO, 0 },
++	{ P_UNIPHY0_RX, 1 },
++	{ P_UNIPHY0_TX, 2 },
++	{ P_UNIPHY1_RX, 3 },
++	{ P_UNIPHY1_TX, 4 },
++	{ P_UBI32_PLL, 5 },
++	{ P_BIAS_PLL, 6 },
++};
++
+ static struct clk_rcg2 nss_port5_rx_clk_src = {
+ 	.cmd_rcgr = 0x68060,
+ 	.freq_tbl = ftbl_nss_port5_rx_clk_src,
+@@ -1806,8 +1722,8 @@ static struct clk_rcg2 nss_port5_rx_clk_
+ 	.parent_map = gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "nss_port5_rx_clk_src",
+-		.parent_names = gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias,
+-		.num_parents = 7,
++		.parent_data = gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias,
++		.num_parents = ARRAY_SIZE(gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1819,9 +1735,8 @@ static struct clk_regmap_div nss_port5_r
+ 	.clkr = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "nss_port5_rx_div_clk_src",
+-			.parent_names = (const char *[]){
+-				"nss_port5_rx_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port5_rx_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.ops = &clk_regmap_div_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1841,6 +1756,27 @@ static const struct freq_tbl ftbl_nss_po
+ 	{ }
+ };
+ 
++static const struct clk_parent_data gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias[] = {
++	{ .fw_name = "xo", .name = "xo" },
++	{ .name = "uniphy0_gcc_tx_clk" },
++	{ .name = "uniphy0_gcc_rx_clk" },
++	{ .name = "uniphy1_gcc_tx_clk" },
++	{ .name = "uniphy1_gcc_rx_clk" },
++	{ .hw = &ubi32_pll.clkr.hw },
++	{ .name = "bias_pll_cc_clk" },
++};
++
++static const struct parent_map
++gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias_map[] = {
++	{ P_XO, 0 },
++	{ P_UNIPHY0_TX, 1 },
++	{ P_UNIPHY0_RX, 2 },
++	{ P_UNIPHY1_TX, 3 },
++	{ P_UNIPHY1_RX, 4 },
++	{ P_UBI32_PLL, 5 },
++	{ P_BIAS_PLL, 6 },
++};
++
+ static struct clk_rcg2 nss_port5_tx_clk_src = {
+ 	.cmd_rcgr = 0x68068,
+ 	.freq_tbl = ftbl_nss_port5_tx_clk_src,
+@@ -1848,8 +1784,8 @@ static struct clk_rcg2 nss_port5_tx_clk_
+ 	.parent_map = gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "nss_port5_tx_clk_src",
+-		.parent_names = gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias,
+-		.num_parents = 7,
++		.parent_data = gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias,
++		.num_parents = ARRAY_SIZE(gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1861,9 +1797,8 @@ static struct clk_regmap_div nss_port5_t
+ 	.clkr = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "nss_port5_tx_div_clk_src",
+-			.parent_names = (const char *[]){
+-				"nss_port5_tx_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port5_tx_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.ops = &clk_regmap_div_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1883,6 +1818,22 @@ static const struct freq_tbl ftbl_nss_po
+ 	{ }
+ };
+ 
++static const struct clk_parent_data gcc_xo_uniphy2_rx_tx_ubi32_bias[] = {
++	{ .fw_name = "xo", .name = "xo" },
++	{ .name = "uniphy2_gcc_rx_clk" },
++	{ .name = "uniphy2_gcc_tx_clk" },
++	{ .hw = &ubi32_pll.clkr.hw },
++	{ .name = "bias_pll_cc_clk" },
++};
++
++static const struct parent_map gcc_xo_uniphy2_rx_tx_ubi32_bias_map[] = {
++	{ P_XO, 0 },
++	{ P_UNIPHY2_RX, 1 },
++	{ P_UNIPHY2_TX, 2 },
++	{ P_UBI32_PLL, 5 },
++	{ P_BIAS_PLL, 6 },
++};
++
+ static struct clk_rcg2 nss_port6_rx_clk_src = {
+ 	.cmd_rcgr = 0x68070,
+ 	.freq_tbl = ftbl_nss_port6_rx_clk_src,
+@@ -1890,8 +1841,8 @@ static struct clk_rcg2 nss_port6_rx_clk_
+ 	.parent_map = gcc_xo_uniphy2_rx_tx_ubi32_bias_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "nss_port6_rx_clk_src",
+-		.parent_names = gcc_xo_uniphy2_rx_tx_ubi32_bias,
+-		.num_parents = 5,
++		.parent_data = gcc_xo_uniphy2_rx_tx_ubi32_bias,
++		.num_parents = ARRAY_SIZE(gcc_xo_uniphy2_rx_tx_ubi32_bias),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1903,9 +1854,8 @@ static struct clk_regmap_div nss_port6_r
+ 	.clkr = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "nss_port6_rx_div_clk_src",
+-			.parent_names = (const char *[]){
+-				"nss_port6_rx_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port6_rx_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.ops = &clk_regmap_div_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1925,6 +1875,22 @@ static const struct freq_tbl ftbl_nss_po
+ 	{ }
+ };
+ 
++static const struct clk_parent_data gcc_xo_uniphy2_tx_rx_ubi32_bias[] = {
++	{ .fw_name = "xo", .name = "xo" },
++	{ .name = "uniphy2_gcc_tx_clk" },
++	{ .name = "uniphy2_gcc_rx_clk" },
++	{ .hw = &ubi32_pll.clkr.hw },
++	{ .name = "bias_pll_cc_clk" },
++};
++
++static const struct parent_map gcc_xo_uniphy2_tx_rx_ubi32_bias_map[] = {
++	{ P_XO, 0 },
++	{ P_UNIPHY2_TX, 1 },
++	{ P_UNIPHY2_RX, 2 },
++	{ P_UBI32_PLL, 5 },
++	{ P_BIAS_PLL, 6 },
++};
++
+ static struct clk_rcg2 nss_port6_tx_clk_src = {
+ 	.cmd_rcgr = 0x68078,
+ 	.freq_tbl = ftbl_nss_port6_tx_clk_src,
+@@ -1932,8 +1898,8 @@ static struct clk_rcg2 nss_port6_tx_clk_
+ 	.parent_map = gcc_xo_uniphy2_tx_rx_ubi32_bias_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "nss_port6_tx_clk_src",
+-		.parent_names = gcc_xo_uniphy2_tx_rx_ubi32_bias,
+-		.num_parents = 5,
++		.parent_data = gcc_xo_uniphy2_tx_rx_ubi32_bias,
++		.num_parents = ARRAY_SIZE(gcc_xo_uniphy2_tx_rx_ubi32_bias),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1945,9 +1911,8 @@ static struct clk_regmap_div nss_port6_t
+ 	.clkr = {
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "nss_port6_tx_div_clk_src",
+-			.parent_names = (const char *[]){
+-				"nss_port6_tx_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port6_tx_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.ops = &clk_regmap_div_ops,
+ 			.flags = CLK_SET_RATE_PARENT,
+@@ -1970,8 +1935,8 @@ static struct clk_rcg2 crypto_clk_src =
+ 	.parent_map = gcc_xo_gpll0_gpll0_out_main_div2_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "crypto_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll0_out_main_div2,
+-		.num_parents = 3,
++		.parent_data = gcc_xo_gpll0_gpll0_out_main_div2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll0_out_main_div2),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -1981,6 +1946,22 @@ static struct freq_tbl ftbl_gp_clk_src[]
+ 	{ }
+ };
+ 
++static const struct clk_parent_data gcc_xo_gpll0_gpll6_gpll0_sleep_clk[] = {
++	{ .fw_name = "xo", .name = "xo" },
++	{ .hw = &gpll0.clkr.hw },
++	{ .hw = &gpll6.clkr.hw },
++	{ .hw = &gpll0_out_main_div2.hw },
++	{ .fw_name = "sleep_clk", .name = "sleep_clk" },
++};
++
++static const struct parent_map gcc_xo_gpll0_gpll6_gpll0_sleep_clk_map[] = {
++	{ P_XO, 0 },
++	{ P_GPLL0, 1 },
++	{ P_GPLL6, 2 },
++	{ P_GPLL0_DIV2, 4 },
++	{ P_SLEEP_CLK, 6 },
++};
++
+ static struct clk_rcg2 gp1_clk_src = {
+ 	.cmd_rcgr = 0x08004,
+ 	.freq_tbl = ftbl_gp_clk_src,
+@@ -1989,8 +1970,8 @@ static struct clk_rcg2 gp1_clk_src = {
+ 	.parent_map = gcc_xo_gpll0_gpll6_gpll0_sleep_clk_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gp1_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll6_gpll0_sleep_clk,
+-		.num_parents = 5,
++		.parent_data = gcc_xo_gpll0_gpll6_gpll0_sleep_clk,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll6_gpll0_sleep_clk),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -2003,8 +1984,8 @@ static struct clk_rcg2 gp2_clk_src = {
+ 	.parent_map = gcc_xo_gpll0_gpll6_gpll0_sleep_clk_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gp2_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll6_gpll0_sleep_clk,
+-		.num_parents = 5,
++		.parent_data = gcc_xo_gpll0_gpll6_gpll0_sleep_clk,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll6_gpll0_sleep_clk),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -2017,8 +1998,8 @@ static struct clk_rcg2 gp3_clk_src = {
+ 	.parent_map = gcc_xo_gpll0_gpll6_gpll0_sleep_clk_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gp3_clk_src",
+-		.parent_names = gcc_xo_gpll0_gpll6_gpll0_sleep_clk,
+-		.num_parents = 5,
++		.parent_data = gcc_xo_gpll0_gpll6_gpll0_sleep_clk,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll6_gpll0_sleep_clk),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
+@@ -2030,9 +2011,8 @@ static struct clk_branch gcc_blsp1_ahb_c
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_blsp1_ahb_clk",
+-			.parent_names = (const char *[]){
+-				"pcnoc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcnoc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2047,9 +2027,8 @@ static struct clk_branch gcc_blsp1_qup1_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_blsp1_qup1_i2c_apps_clk",
+-			.parent_names = (const char *[]){
+-				"blsp1_qup1_i2c_apps_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&blsp1_qup1_i2c_apps_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2064,9 +2043,8 @@ static struct clk_branch gcc_blsp1_qup1_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_blsp1_qup1_spi_apps_clk",
+-			.parent_names = (const char *[]){
+-				"blsp1_qup1_spi_apps_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&blsp1_qup1_spi_apps_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2081,9 +2059,8 @@ static struct clk_branch gcc_blsp1_qup2_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_blsp1_qup2_i2c_apps_clk",
+-			.parent_names = (const char *[]){
+-				"blsp1_qup2_i2c_apps_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&blsp1_qup2_i2c_apps_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2098,9 +2075,8 @@ static struct clk_branch gcc_blsp1_qup2_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_blsp1_qup2_spi_apps_clk",
+-			.parent_names = (const char *[]){
+-				"blsp1_qup2_spi_apps_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&blsp1_qup2_spi_apps_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2115,9 +2091,8 @@ static struct clk_branch gcc_blsp1_qup3_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_blsp1_qup3_i2c_apps_clk",
+-			.parent_names = (const char *[]){
+-				"blsp1_qup3_i2c_apps_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&blsp1_qup3_i2c_apps_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2132,9 +2107,8 @@ static struct clk_branch gcc_blsp1_qup3_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_blsp1_qup3_spi_apps_clk",
+-			.parent_names = (const char *[]){
+-				"blsp1_qup3_spi_apps_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&blsp1_qup3_spi_apps_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2149,9 +2123,8 @@ static struct clk_branch gcc_blsp1_qup4_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_blsp1_qup4_i2c_apps_clk",
+-			.parent_names = (const char *[]){
+-				"blsp1_qup4_i2c_apps_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&blsp1_qup4_i2c_apps_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2166,9 +2139,8 @@ static struct clk_branch gcc_blsp1_qup4_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_blsp1_qup4_spi_apps_clk",
+-			.parent_names = (const char *[]){
+-				"blsp1_qup4_spi_apps_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&blsp1_qup4_spi_apps_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2183,9 +2155,8 @@ static struct clk_branch gcc_blsp1_qup5_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_blsp1_qup5_i2c_apps_clk",
+-			.parent_names = (const char *[]){
+-				"blsp1_qup5_i2c_apps_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&blsp1_qup5_i2c_apps_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2200,9 +2171,8 @@ static struct clk_branch gcc_blsp1_qup5_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_blsp1_qup5_spi_apps_clk",
+-			.parent_names = (const char *[]){
+-				"blsp1_qup5_spi_apps_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&blsp1_qup5_spi_apps_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2217,9 +2187,8 @@ static struct clk_branch gcc_blsp1_qup6_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_blsp1_qup6_i2c_apps_clk",
+-			.parent_names = (const char *[]){
+-				"blsp1_qup6_i2c_apps_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&blsp1_qup6_i2c_apps_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2234,9 +2203,8 @@ static struct clk_branch gcc_blsp1_qup6_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_blsp1_qup6_spi_apps_clk",
+-			.parent_names = (const char *[]){
+-				"blsp1_qup6_spi_apps_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&blsp1_qup6_spi_apps_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2251,9 +2219,8 @@ static struct clk_branch gcc_blsp1_uart1
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_blsp1_uart1_apps_clk",
+-			.parent_names = (const char *[]){
+-				"blsp1_uart1_apps_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&blsp1_uart1_apps_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2268,9 +2235,8 @@ static struct clk_branch gcc_blsp1_uart2
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_blsp1_uart2_apps_clk",
+-			.parent_names = (const char *[]){
+-				"blsp1_uart2_apps_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&blsp1_uart2_apps_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2285,9 +2251,8 @@ static struct clk_branch gcc_blsp1_uart3
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_blsp1_uart3_apps_clk",
+-			.parent_names = (const char *[]){
+-				"blsp1_uart3_apps_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&blsp1_uart3_apps_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2302,9 +2267,8 @@ static struct clk_branch gcc_blsp1_uart4
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_blsp1_uart4_apps_clk",
+-			.parent_names = (const char *[]){
+-				"blsp1_uart4_apps_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&blsp1_uart4_apps_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2319,9 +2283,8 @@ static struct clk_branch gcc_blsp1_uart5
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_blsp1_uart5_apps_clk",
+-			.parent_names = (const char *[]){
+-				"blsp1_uart5_apps_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&blsp1_uart5_apps_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2336,9 +2299,8 @@ static struct clk_branch gcc_blsp1_uart6
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_blsp1_uart6_apps_clk",
+-			.parent_names = (const char *[]){
+-				"blsp1_uart6_apps_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&blsp1_uart6_apps_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2354,9 +2316,8 @@ static struct clk_branch gcc_prng_ahb_cl
+ 		.enable_mask = BIT(8),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_prng_ahb_clk",
+-			.parent_names = (const char *[]){
+-				"pcnoc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcnoc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2371,9 +2332,8 @@ static struct clk_branch gcc_qpic_ahb_cl
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_qpic_ahb_clk",
+-			.parent_names = (const char *[]){
+-				"pcnoc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcnoc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2388,9 +2348,8 @@ static struct clk_branch gcc_qpic_clk =
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_qpic_clk",
+-			.parent_names = (const char *[]){
+-				"pcnoc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcnoc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2405,9 +2364,8 @@ static struct clk_branch gcc_pcie0_ahb_c
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_pcie0_ahb_clk",
+-			.parent_names = (const char *[]){
+-				"pcnoc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcnoc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2422,9 +2380,8 @@ static struct clk_branch gcc_pcie0_aux_c
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_pcie0_aux_clk",
+-			.parent_names = (const char *[]){
+-				"pcie0_aux_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcie0_aux_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2439,9 +2396,8 @@ static struct clk_branch gcc_pcie0_axi_m
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_pcie0_axi_m_clk",
+-			.parent_names = (const char *[]){
+-				"pcie0_axi_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcie0_axi_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2456,9 +2412,8 @@ static struct clk_branch gcc_pcie0_axi_s
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_pcie0_axi_s_clk",
+-			.parent_names = (const char *[]){
+-				"pcie0_axi_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcie0_axi_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2474,9 +2429,8 @@ static struct clk_branch gcc_pcie0_pipe_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_pcie0_pipe_clk",
+-			.parent_names = (const char *[]){
+-				"pcie0_pipe_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcie0_pipe_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2491,9 +2445,8 @@ static struct clk_branch gcc_sys_noc_pci
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_sys_noc_pcie0_axi_clk",
+-			.parent_names = (const char *[]){
+-				"pcie0_axi_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcie0_axi_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2508,9 +2461,8 @@ static struct clk_branch gcc_pcie1_ahb_c
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_pcie1_ahb_clk",
+-			.parent_names = (const char *[]){
+-				"pcnoc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcnoc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2525,9 +2477,8 @@ static struct clk_branch gcc_pcie1_aux_c
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_pcie1_aux_clk",
+-			.parent_names = (const char *[]){
+-				"pcie1_aux_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcie1_aux_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2542,9 +2493,8 @@ static struct clk_branch gcc_pcie1_axi_m
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_pcie1_axi_m_clk",
+-			.parent_names = (const char *[]){
+-				"pcie1_axi_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcie1_axi_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2559,9 +2509,8 @@ static struct clk_branch gcc_pcie1_axi_s
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_pcie1_axi_s_clk",
+-			.parent_names = (const char *[]){
+-				"pcie1_axi_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcie1_axi_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2577,9 +2526,8 @@ static struct clk_branch gcc_pcie1_pipe_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_pcie1_pipe_clk",
+-			.parent_names = (const char *[]){
+-				"pcie1_pipe_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcie1_pipe_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2594,9 +2542,8 @@ static struct clk_branch gcc_sys_noc_pci
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_sys_noc_pcie1_axi_clk",
+-			.parent_names = (const char *[]){
+-				"pcie1_axi_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcie1_axi_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2611,9 +2558,8 @@ static struct clk_branch gcc_usb0_aux_cl
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_usb0_aux_clk",
+-			.parent_names = (const char *[]){
+-				"usb0_aux_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&usb0_aux_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2628,9 +2574,8 @@ static struct clk_branch gcc_sys_noc_usb
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_sys_noc_usb0_axi_clk",
+-			.parent_names = (const char *[]){
+-				"usb0_master_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&usb0_master_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2645,9 +2590,8 @@ static struct clk_branch gcc_usb0_master
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_usb0_master_clk",
+-			.parent_names = (const char *[]){
+-				"usb0_master_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&usb0_master_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2662,9 +2606,8 @@ static struct clk_branch gcc_usb0_mock_u
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_usb0_mock_utmi_clk",
+-			.parent_names = (const char *[]){
+-				"usb0_mock_utmi_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&usb0_mock_utmi_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2679,9 +2622,8 @@ static struct clk_branch gcc_usb0_phy_cf
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_usb0_phy_cfg_ahb_clk",
+-			.parent_names = (const char *[]){
+-				"pcnoc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcnoc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2697,9 +2639,8 @@ static struct clk_branch gcc_usb0_pipe_c
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_usb0_pipe_clk",
+-			.parent_names = (const char *[]){
+-				"usb0_pipe_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&usb0_pipe_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2714,9 +2655,8 @@ static struct clk_branch gcc_usb0_sleep_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_usb0_sleep_clk",
+-			.parent_names = (const char *[]){
+-				"gcc_sleep_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&gcc_sleep_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2731,9 +2671,8 @@ static struct clk_branch gcc_usb1_aux_cl
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_usb1_aux_clk",
+-			.parent_names = (const char *[]){
+-				"usb1_aux_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&usb1_aux_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2748,9 +2687,8 @@ static struct clk_branch gcc_sys_noc_usb
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_sys_noc_usb1_axi_clk",
+-			.parent_names = (const char *[]){
+-				"usb1_master_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&usb1_master_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2765,9 +2703,8 @@ static struct clk_branch gcc_usb1_master
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_usb1_master_clk",
+-			.parent_names = (const char *[]){
+-				"usb1_master_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&usb1_master_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2782,9 +2719,8 @@ static struct clk_branch gcc_usb1_mock_u
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_usb1_mock_utmi_clk",
+-			.parent_names = (const char *[]){
+-				"usb1_mock_utmi_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&usb1_mock_utmi_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2799,9 +2735,8 @@ static struct clk_branch gcc_usb1_phy_cf
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_usb1_phy_cfg_ahb_clk",
+-			.parent_names = (const char *[]){
+-				"pcnoc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcnoc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2817,9 +2752,8 @@ static struct clk_branch gcc_usb1_pipe_c
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_usb1_pipe_clk",
+-			.parent_names = (const char *[]){
+-				"usb1_pipe_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&usb1_pipe_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2834,9 +2768,8 @@ static struct clk_branch gcc_usb1_sleep_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_usb1_sleep_clk",
+-			.parent_names = (const char *[]){
+-				"gcc_sleep_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&gcc_sleep_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2851,9 +2784,8 @@ static struct clk_branch gcc_sdcc1_ahb_c
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_sdcc1_ahb_clk",
+-			.parent_names = (const char *[]){
+-				"pcnoc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcnoc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2868,9 +2800,8 @@ static struct clk_branch gcc_sdcc1_apps_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_sdcc1_apps_clk",
+-			.parent_names = (const char *[]){
+-				"sdcc1_apps_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&sdcc1_apps_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2885,9 +2816,8 @@ static struct clk_branch gcc_sdcc1_ice_c
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_sdcc1_ice_core_clk",
+-			.parent_names = (const char *[]){
+-				"sdcc1_ice_core_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&sdcc1_ice_core_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2902,9 +2832,8 @@ static struct clk_branch gcc_sdcc2_ahb_c
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_sdcc2_ahb_clk",
+-			.parent_names = (const char *[]){
+-				"pcnoc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcnoc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2919,9 +2848,8 @@ static struct clk_branch gcc_sdcc2_apps_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_sdcc2_apps_clk",
+-			.parent_names = (const char *[]){
+-				"sdcc2_apps_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&sdcc2_apps_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2936,9 +2864,8 @@ static struct clk_branch gcc_mem_noc_nss
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_mem_noc_nss_axi_clk",
+-			.parent_names = (const char *[]){
+-				"nss_noc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_noc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2953,9 +2880,8 @@ static struct clk_branch gcc_nss_ce_apb_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_ce_apb_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ce_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ce_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2970,9 +2896,8 @@ static struct clk_branch gcc_nss_ce_axi_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_ce_axi_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ce_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ce_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -2987,9 +2912,8 @@ static struct clk_branch gcc_nss_cfg_clk
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_cfg_clk",
+-			.parent_names = (const char *[]){
+-				"pcnoc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcnoc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3004,9 +2928,8 @@ static struct clk_branch gcc_nss_crypto_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_crypto_clk",
+-			.parent_names = (const char *[]){
+-				"nss_crypto_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_crypto_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3021,9 +2944,8 @@ static struct clk_branch gcc_nss_csr_clk
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_csr_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ce_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ce_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3038,9 +2960,8 @@ static struct clk_branch gcc_nss_edma_cf
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_edma_cfg_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ppe_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ppe_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3055,9 +2976,8 @@ static struct clk_branch gcc_nss_edma_cl
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_edma_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ppe_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ppe_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3072,9 +2992,8 @@ static struct clk_branch gcc_nss_imem_cl
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_imem_clk",
+-			.parent_names = (const char *[]){
+-				"nss_imem_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_imem_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3089,9 +3008,8 @@ static struct clk_branch gcc_nss_noc_clk
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_noc_clk",
+-			.parent_names = (const char *[]){
+-				"nss_noc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_noc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3106,9 +3024,8 @@ static struct clk_branch gcc_nss_ppe_btq
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_ppe_btq_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ppe_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ppe_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3123,9 +3040,8 @@ static struct clk_branch gcc_nss_ppe_cfg
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_ppe_cfg_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ppe_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ppe_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3140,9 +3056,8 @@ static struct clk_branch gcc_nss_ppe_clk
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_ppe_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ppe_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ppe_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3157,9 +3072,8 @@ static struct clk_branch gcc_nss_ppe_ipe
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_ppe_ipe_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ppe_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ppe_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3174,9 +3088,8 @@ static struct clk_branch gcc_nss_ptp_ref
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_ptp_ref_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ppe_cdiv_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ppe_cdiv_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3192,9 +3105,8 @@ static struct clk_branch gcc_crypto_ppe_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_crypto_ppe_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ppe_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ppe_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3209,9 +3121,8 @@ static struct clk_branch gcc_nssnoc_ce_a
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nssnoc_ce_apb_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ce_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ce_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3226,9 +3137,8 @@ static struct clk_branch gcc_nssnoc_ce_a
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nssnoc_ce_axi_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ce_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ce_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3243,9 +3153,8 @@ static struct clk_branch gcc_nssnoc_cryp
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nssnoc_crypto_clk",
+-			.parent_names = (const char *[]){
+-				"nss_crypto_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_crypto_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3260,9 +3169,8 @@ static struct clk_branch gcc_nssnoc_ppe_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nssnoc_ppe_cfg_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ppe_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ppe_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3277,9 +3185,8 @@ static struct clk_branch gcc_nssnoc_ppe_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nssnoc_ppe_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ppe_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ppe_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3294,9 +3201,8 @@ static struct clk_branch gcc_nssnoc_qosg
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nssnoc_qosgen_ref_clk",
+-			.parent_names = (const char *[]){
+-				"gcc_xo_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&gcc_xo_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3311,9 +3217,8 @@ static struct clk_branch gcc_nssnoc_snoc
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nssnoc_snoc_clk",
+-			.parent_names = (const char *[]){
+-				"system_noc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&system_noc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3328,9 +3233,8 @@ static struct clk_branch gcc_nssnoc_time
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nssnoc_timeout_ref_clk",
+-			.parent_names = (const char *[]){
+-				"gcc_xo_div4_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&gcc_xo_div4_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3345,9 +3249,8 @@ static struct clk_branch gcc_nssnoc_ubi0
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nssnoc_ubi0_ahb_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ce_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ce_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3362,9 +3265,8 @@ static struct clk_branch gcc_nssnoc_ubi1
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nssnoc_ubi1_ahb_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ce_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ce_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3380,9 +3282,8 @@ static struct clk_branch gcc_ubi0_ahb_cl
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_ubi0_ahb_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ce_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ce_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3398,9 +3299,8 @@ static struct clk_branch gcc_ubi0_axi_cl
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_ubi0_axi_clk",
+-			.parent_names = (const char *[]){
+-				"nss_noc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_noc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3416,9 +3316,8 @@ static struct clk_branch gcc_ubi0_nc_axi
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_ubi0_nc_axi_clk",
+-			.parent_names = (const char *[]){
+-				"nss_noc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_noc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3434,9 +3333,8 @@ static struct clk_branch gcc_ubi0_core_c
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_ubi0_core_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ubi0_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ubi0_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3452,9 +3350,8 @@ static struct clk_branch gcc_ubi0_mpt_cl
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_ubi0_mpt_clk",
+-			.parent_names = (const char *[]){
+-				"ubi_mpt_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&ubi_mpt_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3470,9 +3367,8 @@ static struct clk_branch gcc_ubi1_ahb_cl
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_ubi1_ahb_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ce_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ce_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3488,9 +3384,8 @@ static struct clk_branch gcc_ubi1_axi_cl
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_ubi1_axi_clk",
+-			.parent_names = (const char *[]){
+-				"nss_noc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_noc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3506,9 +3401,8 @@ static struct clk_branch gcc_ubi1_nc_axi
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_ubi1_nc_axi_clk",
+-			.parent_names = (const char *[]){
+-				"nss_noc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_noc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3524,9 +3418,8 @@ static struct clk_branch gcc_ubi1_core_c
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_ubi1_core_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ubi1_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ubi1_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3542,9 +3435,8 @@ static struct clk_branch gcc_ubi1_mpt_cl
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_ubi1_mpt_clk",
+-			.parent_names = (const char *[]){
+-				"ubi_mpt_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&ubi_mpt_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3559,9 +3451,8 @@ static struct clk_branch gcc_cmn_12gpll_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_cmn_12gpll_ahb_clk",
+-			.parent_names = (const char *[]){
+-				"pcnoc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcnoc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3576,9 +3467,8 @@ static struct clk_branch gcc_cmn_12gpll_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_cmn_12gpll_sys_clk",
+-			.parent_names = (const char *[]){
+-				"gcc_xo_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&gcc_xo_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3593,9 +3483,8 @@ static struct clk_branch gcc_mdio_ahb_cl
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_mdio_ahb_clk",
+-			.parent_names = (const char *[]){
+-				"pcnoc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcnoc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3610,9 +3499,8 @@ static struct clk_branch gcc_uniphy0_ahb
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_uniphy0_ahb_clk",
+-			.parent_names = (const char *[]){
+-				"pcnoc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcnoc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3627,9 +3515,8 @@ static struct clk_branch gcc_uniphy0_sys
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_uniphy0_sys_clk",
+-			.parent_names = (const char *[]){
+-				"gcc_xo_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&gcc_xo_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3644,9 +3531,8 @@ static struct clk_branch gcc_uniphy1_ahb
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_uniphy1_ahb_clk",
+-			.parent_names = (const char *[]){
+-				"pcnoc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcnoc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3661,9 +3547,8 @@ static struct clk_branch gcc_uniphy1_sys
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_uniphy1_sys_clk",
+-			.parent_names = (const char *[]){
+-				"gcc_xo_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&gcc_xo_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3678,9 +3563,8 @@ static struct clk_branch gcc_uniphy2_ahb
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_uniphy2_ahb_clk",
+-			.parent_names = (const char *[]){
+-				"pcnoc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcnoc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3695,9 +3579,8 @@ static struct clk_branch gcc_uniphy2_sys
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_uniphy2_sys_clk",
+-			.parent_names = (const char *[]){
+-				"gcc_xo_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&gcc_xo_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3712,9 +3595,8 @@ static struct clk_branch gcc_nss_port1_r
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_port1_rx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port1_rx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port1_rx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3729,9 +3611,8 @@ static struct clk_branch gcc_nss_port1_t
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_port1_tx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port1_tx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port1_tx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3746,9 +3627,8 @@ static struct clk_branch gcc_nss_port2_r
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_port2_rx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port2_rx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port2_rx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3763,9 +3643,8 @@ static struct clk_branch gcc_nss_port2_t
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_port2_tx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port2_tx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port2_tx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3780,9 +3659,8 @@ static struct clk_branch gcc_nss_port3_r
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_port3_rx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port3_rx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port3_rx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3797,9 +3675,8 @@ static struct clk_branch gcc_nss_port3_t
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_port3_tx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port3_tx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port3_tx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3814,9 +3691,8 @@ static struct clk_branch gcc_nss_port4_r
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_port4_rx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port4_rx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port4_rx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3831,9 +3707,8 @@ static struct clk_branch gcc_nss_port4_t
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_port4_tx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port4_tx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port4_tx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3848,9 +3723,8 @@ static struct clk_branch gcc_nss_port5_r
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_port5_rx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port5_rx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port5_rx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3865,9 +3739,8 @@ static struct clk_branch gcc_nss_port5_t
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_port5_tx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port5_tx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port5_tx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3882,9 +3755,8 @@ static struct clk_branch gcc_nss_port6_r
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_port6_rx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port6_rx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port6_rx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3899,9 +3771,8 @@ static struct clk_branch gcc_nss_port6_t
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_nss_port6_tx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port6_tx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port6_tx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3916,9 +3787,8 @@ static struct clk_branch gcc_port1_mac_c
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_port1_mac_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ppe_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ppe_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3933,9 +3803,8 @@ static struct clk_branch gcc_port2_mac_c
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_port2_mac_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ppe_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ppe_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3950,9 +3819,8 @@ static struct clk_branch gcc_port3_mac_c
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_port3_mac_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ppe_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ppe_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3967,9 +3835,8 @@ static struct clk_branch gcc_port4_mac_c
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_port4_mac_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ppe_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ppe_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -3984,9 +3851,8 @@ static struct clk_branch gcc_port5_mac_c
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_port5_mac_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ppe_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ppe_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4001,9 +3867,8 @@ static struct clk_branch gcc_port6_mac_c
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_port6_mac_clk",
+-			.parent_names = (const char *[]){
+-				"nss_ppe_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_ppe_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4018,9 +3883,8 @@ static struct clk_branch gcc_uniphy0_por
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_uniphy0_port1_rx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port1_rx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port1_rx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4035,9 +3899,8 @@ static struct clk_branch gcc_uniphy0_por
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_uniphy0_port1_tx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port1_tx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port1_tx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4052,9 +3915,8 @@ static struct clk_branch gcc_uniphy0_por
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_uniphy0_port2_rx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port2_rx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port2_rx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4069,9 +3931,8 @@ static struct clk_branch gcc_uniphy0_por
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_uniphy0_port2_tx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port2_tx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port2_tx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4086,9 +3947,8 @@ static struct clk_branch gcc_uniphy0_por
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_uniphy0_port3_rx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port3_rx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port3_rx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4103,9 +3963,8 @@ static struct clk_branch gcc_uniphy0_por
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_uniphy0_port3_tx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port3_tx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port3_tx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4120,9 +3979,8 @@ static struct clk_branch gcc_uniphy0_por
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_uniphy0_port4_rx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port4_rx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port4_rx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4137,9 +3995,8 @@ static struct clk_branch gcc_uniphy0_por
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_uniphy0_port4_tx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port4_tx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port4_tx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4154,9 +4011,8 @@ static struct clk_branch gcc_uniphy0_por
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_uniphy0_port5_rx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port5_rx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port5_rx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4171,9 +4027,8 @@ static struct clk_branch gcc_uniphy0_por
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_uniphy0_port5_tx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port5_tx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port5_tx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4188,9 +4043,8 @@ static struct clk_branch gcc_uniphy1_por
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_uniphy1_port5_rx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port5_rx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port5_rx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4205,9 +4059,8 @@ static struct clk_branch gcc_uniphy1_por
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_uniphy1_port5_tx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port5_tx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port5_tx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4222,9 +4075,8 @@ static struct clk_branch gcc_uniphy2_por
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_uniphy2_port6_rx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port6_rx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port6_rx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4239,9 +4091,8 @@ static struct clk_branch gcc_uniphy2_por
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_uniphy2_port6_tx_clk",
+-			.parent_names = (const char *[]){
+-				"nss_port6_tx_div_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&nss_port6_tx_div_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4257,9 +4108,8 @@ static struct clk_branch gcc_crypto_ahb_
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_crypto_ahb_clk",
+-			.parent_names = (const char *[]){
+-				"pcnoc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcnoc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4275,9 +4125,8 @@ static struct clk_branch gcc_crypto_axi_
+ 		.enable_mask = BIT(1),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_crypto_axi_clk",
+-			.parent_names = (const char *[]){
+-				"pcnoc_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&pcnoc_clk_src.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4293,9 +4142,8 @@ static struct clk_branch gcc_crypto_clk
+ 		.enable_mask = BIT(2),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_crypto_clk",
+-			.parent_names = (const char *[]){
+-				"crypto_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&crypto_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4310,9 +4158,8 @@ static struct clk_branch gcc_gp1_clk = {
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_gp1_clk",
+-			.parent_names = (const char *[]){
+-				"gp1_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&gp1_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4327,9 +4174,8 @@ static struct clk_branch gcc_gp2_clk = {
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_gp2_clk",
+-			.parent_names = (const char *[]){
+-				"gp2_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&gp2_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4344,9 +4190,8 @@ static struct clk_branch gcc_gp3_clk = {
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_gp3_clk",
+-			.parent_names = (const char *[]){
+-				"gp3_clk_src"
+-			},
++			.parent_hws = (const struct clk_hw *[]){
++				&gp3_clk_src.clkr.hw },
+ 			.num_parents = 1,
+ 			.flags = CLK_SET_RATE_PARENT,
+ 			.ops = &clk_branch2_ops,
+@@ -4368,7 +4213,7 @@ static struct clk_rcg2 pcie0_rchng_clk_s
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "pcie0_rchng_clk_src",
+ 		.parent_data = gcc_xo_gpll0,
+-		.num_parents = 2,
++		.num_parents = ARRAY_SIZE(gcc_xo_gpll0),
+ 		.ops = &clk_rcg2_ops,
+ 	},
+ };
diff --git a/target/linux/qualcommax/patches-6.1/0008-v6.2-clk-qcom-reset-support-resetting-multiple-bits.patch b/target/linux/qualcommax/patches-6.1/0008-v6.2-clk-qcom-reset-support-resetting-multiple-bits.patch
new file mode 100644
index 00000000000000..e0725a66129323
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0008-v6.2-clk-qcom-reset-support-resetting-multiple-bits.patch
@@ -0,0 +1,59 @@
+From 813ba3e427671ba3ff35c825087b03f0ad91cf02 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Mon, 7 Nov 2022 14:28:59 +0100
+Subject: [PATCH] clk: qcom: reset: support resetting multiple bits
+
+This patch adds the support for giving the complete bitmask
+in reset structure and reset operation will use this bitmask
+for all reset operations.
+
+Currently, reset structure only takes a single bit for each reset
+and then calculates the bitmask by using the BIT() macro.
+
+However, this is not sufficient anymore for newer SoC-s like IPQ8074,
+IPQ6018 and more, since their networking resets require multiple bits
+to be asserted in order to properly reset the HW block completely.
+
+So, in order to allow asserting multiple bits add "bitmask" field to
+qcom_reset_map, and then use that bitmask value if its populated in the
+driver, if its not populated, then we just default to existing behaviour
+and calculate the bitmask on the fly.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221107132901.489240-1-robimarko@gmail.com
+---
+ drivers/clk/qcom/reset.c | 4 ++--
+ drivers/clk/qcom/reset.h | 1 +
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/qcom/reset.c
++++ b/drivers/clk/qcom/reset.c
+@@ -30,7 +30,7 @@ qcom_reset_assert(struct reset_controlle
+ 
+ 	rst = to_qcom_reset_controller(rcdev);
+ 	map = &rst->reset_map[id];
+-	mask = BIT(map->bit);
++	mask = map->bitmask ? map->bitmask : BIT(map->bit);
+ 
+ 	return regmap_update_bits(rst->regmap, map->reg, mask, mask);
+ }
+@@ -44,7 +44,7 @@ qcom_reset_deassert(struct reset_control
+ 
+ 	rst = to_qcom_reset_controller(rcdev);
+ 	map = &rst->reset_map[id];
+-	mask = BIT(map->bit);
++	mask = map->bitmask ? map->bitmask : BIT(map->bit);
+ 
+ 	return regmap_update_bits(rst->regmap, map->reg, mask, 0);
+ }
+--- a/drivers/clk/qcom/reset.h
++++ b/drivers/clk/qcom/reset.h
+@@ -12,6 +12,7 @@ struct qcom_reset_map {
+ 	unsigned int reg;
+ 	u8 bit;
+ 	u8 udelay;
++	u32 bitmask;
+ };
+ 
+ struct regmap;
diff --git a/target/linux/qualcommax/patches-6.1/0009-v6.2-dt-bindings-clock-qcom-ipq8074-add-missing-networkin.patch b/target/linux/qualcommax/patches-6.1/0009-v6.2-dt-bindings-clock-qcom-ipq8074-add-missing-networkin.patch
new file mode 100644
index 00000000000000..75f16a167373e2
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0009-v6.2-dt-bindings-clock-qcom-ipq8074-add-missing-networkin.patch
@@ -0,0 +1,39 @@
+From e78a40eb24187a8b4f9b89e2181f674df39c2013 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Mon, 7 Nov 2022 14:29:00 +0100
+Subject: [PATCH] dt-bindings: clock: qcom: ipq8074: add missing networking
+ resets
+
+Add bindings for the missing networking resets found in IPQ8074 GCC.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221107132901.489240-2-robimarko@gmail.com
+---
+ include/dt-bindings/clock/qcom,gcc-ipq8074.h | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/include/dt-bindings/clock/qcom,gcc-ipq8074.h
++++ b/include/dt-bindings/clock/qcom,gcc-ipq8074.h
+@@ -367,6 +367,20 @@
+ #define GCC_PCIE1_AHB_ARES			129
+ #define GCC_PCIE1_AXI_MASTER_STICKY_ARES	130
+ #define GCC_PCIE0_AXI_SLAVE_STICKY_ARES		131
++#define GCC_PPE_FULL_RESET			132
++#define GCC_UNIPHY0_SOFT_RESET			133
++#define GCC_UNIPHY0_XPCS_RESET			134
++#define GCC_UNIPHY1_SOFT_RESET			135
++#define GCC_UNIPHY1_XPCS_RESET			136
++#define GCC_UNIPHY2_SOFT_RESET			137
++#define GCC_UNIPHY2_XPCS_RESET			138
++#define GCC_EDMA_HW_RESET			139
++#define GCC_NSSPORT1_RESET			140
++#define GCC_NSSPORT2_RESET			141
++#define GCC_NSSPORT3_RESET			142
++#define GCC_NSSPORT4_RESET			143
++#define GCC_NSSPORT5_RESET			144
++#define GCC_NSSPORT6_RESET			145
+ 
+ #define USB0_GDSC				0
+ #define USB1_GDSC				1
diff --git a/target/linux/qualcommax/patches-6.1/0010-v6.2-clk-qcom-ipq8074-add-missing-networking-resets.patch b/target/linux/qualcommax/patches-6.1/0010-v6.2-clk-qcom-ipq8074-add-missing-networking-resets.patch
new file mode 100644
index 00000000000000..212fc84869c190
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0010-v6.2-clk-qcom-ipq8074-add-missing-networking-resets.patch
@@ -0,0 +1,41 @@
+From da76cb63d04dc22ed32123b8c1d084c006d67bfb Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Mon, 7 Nov 2022 14:29:01 +0100
+Subject: [PATCH] clk: qcom: ipq8074: add missing networking resets
+
+Downstream QCA 5.4 kernel defines networking resets which are not present
+in the mainline kernel but are required for the networking drivers.
+
+So, port the downstream resets and avoid using magic values for mask,
+construct mask for resets which require multiple bits to be set/cleared.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221107132901.489240-3-robimarko@gmail.com
+---
+ drivers/clk/qcom/gcc-ipq8074.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/clk/qcom/gcc-ipq8074.c
++++ b/drivers/clk/qcom/gcc-ipq8074.c
+@@ -4671,6 +4671,20 @@ static const struct qcom_reset_map gcc_i
+ 	[GCC_PCIE1_AXI_SLAVE_ARES] = { 0x76040, 4 },
+ 	[GCC_PCIE1_AHB_ARES] = { 0x76040, 5 },
+ 	[GCC_PCIE1_AXI_MASTER_STICKY_ARES] = { 0x76040, 6 },
++	[GCC_PPE_FULL_RESET] = { .reg = 0x68014, .bitmask = GENMASK(19, 16) },
++	[GCC_UNIPHY0_SOFT_RESET] = { .reg = 0x56004, .bitmask = GENMASK(13, 4) | BIT(1) },
++	[GCC_UNIPHY0_XPCS_RESET] = { 0x56004, 2 },
++	[GCC_UNIPHY1_SOFT_RESET] = { .reg = 0x56104, .bitmask = GENMASK(5, 4) | BIT(1) },
++	[GCC_UNIPHY1_XPCS_RESET] = { 0x56104, 2 },
++	[GCC_UNIPHY2_SOFT_RESET] = { .reg = 0x56204, .bitmask = GENMASK(5, 4) | BIT(1) },
++	[GCC_UNIPHY2_XPCS_RESET] = { 0x56204, 2 },
++	[GCC_EDMA_HW_RESET] = { .reg = 0x68014, .bitmask = GENMASK(21, 20) },
++	[GCC_NSSPORT1_RESET] = { .reg = 0x68014, .bitmask = BIT(24) | GENMASK(1, 0) },
++	[GCC_NSSPORT2_RESET] = { .reg = 0x68014, .bitmask = BIT(25) | GENMASK(3, 2) },
++	[GCC_NSSPORT3_RESET] = { .reg = 0x68014, .bitmask = BIT(26) | GENMASK(5, 4) },
++	[GCC_NSSPORT4_RESET] = { .reg = 0x68014, .bitmask = BIT(27) | GENMASK(9, 8) },
++	[GCC_NSSPORT5_RESET] = { .reg = 0x68014, .bitmask = BIT(28) | GENMASK(11, 10) },
++	[GCC_NSSPORT6_RESET] = { .reg = 0x68014, .bitmask = BIT(29) | GENMASK(13, 12) },
+ };
+ 
+ static struct gdsc *gcc_ipq8074_gdscs[] = {
diff --git a/target/linux/qualcommax/patches-6.1/0011-v6.2-clk-qcom-ipq8074-populate-fw_name-for-all-parents.patch b/target/linux/qualcommax/patches-6.1/0011-v6.2-clk-qcom-ipq8074-populate-fw_name-for-all-parents.patch
new file mode 100644
index 00000000000000..7372b1da8eda8f
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0011-v6.2-clk-qcom-ipq8074-populate-fw_name-for-all-parents.patch
@@ -0,0 +1,152 @@
+From 78936d46470938caa9a7ea529deeb36777b4f98e Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Wed, 16 Nov 2022 22:46:55 +0100
+Subject: [PATCH] clk: qcom: ipq8074: populate fw_name for all parents
+
+It appears that having only .name populated in parent_data for clocks
+which are only globally searchable currently will not work as the clk core
+won't copy that name if there is no .fw_name present as well.
+
+So, populate .fw_name for all parent clocks in parent_data.
+
+Fixes: ae55ad32e273 ("clk: qcom: ipq8074: convert to parent data")
+
+Co-developed-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221116214655.1116467-1-robimarko@gmail.com
+---
+ drivers/clk/qcom/gcc-ipq8074.c | 52 +++++++++++++++++-----------------
+ 1 file changed, 26 insertions(+), 26 deletions(-)
+
+--- a/drivers/clk/qcom/gcc-ipq8074.c
++++ b/drivers/clk/qcom/gcc-ipq8074.c
+@@ -680,7 +680,7 @@ static struct clk_rcg2 pcie0_aux_clk_src
+ };
+ 
+ static const struct clk_parent_data gcc_pcie20_phy0_pipe_clk_xo[] = {
+-	{ .name = "pcie20_phy0_pipe_clk" },
++	{ .fw_name = "pcie0_pipe", .name = "pcie20_phy0_pipe_clk" },
+ 	{ .fw_name = "xo", .name = "xo" },
+ };
+ 
+@@ -733,7 +733,7 @@ static struct clk_rcg2 pcie1_aux_clk_src
+ };
+ 
+ static const struct clk_parent_data gcc_pcie20_phy1_pipe_clk_xo[] = {
+-	{ .name = "pcie20_phy1_pipe_clk" },
++	{ .fw_name = "pcie1_pipe", .name = "pcie20_phy1_pipe_clk" },
+ 	{ .fw_name = "xo", .name = "xo" },
+ };
+ 
+@@ -1137,7 +1137,7 @@ static const struct freq_tbl ftbl_nss_no
+ 
+ static const struct clk_parent_data gcc_xo_bias_pll_nss_noc_clk_gpll0_gpll2[] = {
+ 	{ .fw_name = "xo", .name = "xo" },
+-	{ .name = "bias_pll_nss_noc_clk" },
++	{ .fw_name = "bias_pll_nss_noc_clk", .name = "bias_pll_nss_noc_clk" },
+ 	{ .hw = &gpll0.clkr.hw },
+ 	{ .hw = &gpll2.clkr.hw },
+ };
+@@ -1362,7 +1362,7 @@ static const struct freq_tbl ftbl_nss_pp
+ 
+ static const struct clk_parent_data gcc_xo_bias_gpll0_gpll4_nss_ubi32[] = {
+ 	{ .fw_name = "xo", .name = "xo" },
+-	{ .name = "bias_pll_cc_clk" },
++	{ .fw_name = "bias_pll_cc_clk", .name = "bias_pll_cc_clk" },
+ 	{ .hw = &gpll0.clkr.hw },
+ 	{ .hw = &gpll4.clkr.hw },
+ 	{ .hw = &nss_crypto_pll.clkr.hw },
+@@ -1413,10 +1413,10 @@ static const struct freq_tbl ftbl_nss_po
+ 
+ static const struct clk_parent_data gcc_xo_uniphy0_rx_tx_ubi32_bias[] = {
+ 	{ .fw_name = "xo", .name = "xo" },
+-	{ .name = "uniphy0_gcc_rx_clk" },
+-	{ .name = "uniphy0_gcc_tx_clk" },
++	{ .fw_name = "uniphy0_gcc_rx_clk", .name = "uniphy0_gcc_rx_clk" },
++	{ .fw_name = "uniphy0_gcc_tx_clk", .name = "uniphy0_gcc_tx_clk" },
+ 	{ .hw = &ubi32_pll.clkr.hw },
+-	{ .name = "bias_pll_cc_clk" },
++	{ .fw_name = "bias_pll_cc_clk", .name = "bias_pll_cc_clk" },
+ };
+ 
+ static const struct parent_map gcc_xo_uniphy0_rx_tx_ubi32_bias_map[] = {
+@@ -1465,10 +1465,10 @@ static const struct freq_tbl ftbl_nss_po
+ 
+ static const struct clk_parent_data gcc_xo_uniphy0_tx_rx_ubi32_bias[] = {
+ 	{ .fw_name = "xo", .name = "xo" },
+-	{ .name = "uniphy0_gcc_tx_clk" },
+-	{ .name = "uniphy0_gcc_rx_clk" },
++	{ .fw_name = "uniphy0_gcc_tx_clk", .name = "uniphy0_gcc_tx_clk" },
++	{ .fw_name = "uniphy0_gcc_rx_clk", .name = "uniphy0_gcc_rx_clk" },
+ 	{ .hw = &ubi32_pll.clkr.hw },
+-	{ .name = "bias_pll_cc_clk" },
++	{ .fw_name = "bias_pll_cc_clk", .name = "bias_pll_cc_clk" },
+ };
+ 
+ static const struct parent_map gcc_xo_uniphy0_tx_rx_ubi32_bias_map[] = {
+@@ -1696,12 +1696,12 @@ static const struct freq_tbl ftbl_nss_po
+ 
+ static const struct clk_parent_data gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias[] = {
+ 	{ .fw_name = "xo", .name = "xo" },
+-	{ .name = "uniphy0_gcc_rx_clk" },
+-	{ .name = "uniphy0_gcc_tx_clk" },
+-	{ .name = "uniphy1_gcc_rx_clk" },
+-	{ .name = "uniphy1_gcc_tx_clk" },
++	{ .fw_name = "uniphy0_gcc_rx_clk", .name = "uniphy0_gcc_rx_clk" },
++	{ .fw_name = "uniphy0_gcc_tx_clk", .name = "uniphy0_gcc_tx_clk" },
++	{ .fw_name = "uniphy1_gcc_rx_clk", .name = "uniphy1_gcc_rx_clk" },
++	{ .fw_name = "uniphy1_gcc_tx_clk", .name = "uniphy1_gcc_tx_clk" },
+ 	{ .hw = &ubi32_pll.clkr.hw },
+-	{ .name = "bias_pll_cc_clk" },
++	{ .fw_name = "bias_pll_cc_clk", .name = "bias_pll_cc_clk" },
+ };
+ 
+ static const struct parent_map
+@@ -1758,12 +1758,12 @@ static const struct freq_tbl ftbl_nss_po
+ 
+ static const struct clk_parent_data gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias[] = {
+ 	{ .fw_name = "xo", .name = "xo" },
+-	{ .name = "uniphy0_gcc_tx_clk" },
+-	{ .name = "uniphy0_gcc_rx_clk" },
+-	{ .name = "uniphy1_gcc_tx_clk" },
+-	{ .name = "uniphy1_gcc_rx_clk" },
++	{ .fw_name = "uniphy0_gcc_tx_clk", .name = "uniphy0_gcc_tx_clk" },
++	{ .fw_name = "uniphy0_gcc_rx_clk", .name = "uniphy0_gcc_rx_clk" },
++	{ .fw_name = "uniphy1_gcc_tx_clk", .name = "uniphy1_gcc_tx_clk" },
++	{ .fw_name = "uniphy1_gcc_rx_clk", .name = "uniphy1_gcc_rx_clk" },
+ 	{ .hw = &ubi32_pll.clkr.hw },
+-	{ .name = "bias_pll_cc_clk" },
++	{ .fw_name = "bias_pll_cc_clk", .name = "bias_pll_cc_clk" },
+ };
+ 
+ static const struct parent_map
+@@ -1820,10 +1820,10 @@ static const struct freq_tbl ftbl_nss_po
+ 
+ static const struct clk_parent_data gcc_xo_uniphy2_rx_tx_ubi32_bias[] = {
+ 	{ .fw_name = "xo", .name = "xo" },
+-	{ .name = "uniphy2_gcc_rx_clk" },
+-	{ .name = "uniphy2_gcc_tx_clk" },
++	{ .fw_name = "uniphy2_gcc_rx_clk", .name = "uniphy2_gcc_rx_clk" },
++	{ .fw_name = "uniphy2_gcc_tx_clk", .name = "uniphy2_gcc_tx_clk" },
+ 	{ .hw = &ubi32_pll.clkr.hw },
+-	{ .name = "bias_pll_cc_clk" },
++	{ .fw_name = "bias_pll_cc_clk", .name = "bias_pll_cc_clk" },
+ };
+ 
+ static const struct parent_map gcc_xo_uniphy2_rx_tx_ubi32_bias_map[] = {
+@@ -1877,10 +1877,10 @@ static const struct freq_tbl ftbl_nss_po
+ 
+ static const struct clk_parent_data gcc_xo_uniphy2_tx_rx_ubi32_bias[] = {
+ 	{ .fw_name = "xo", .name = "xo" },
+-	{ .name = "uniphy2_gcc_tx_clk" },
+-	{ .name = "uniphy2_gcc_rx_clk" },
++	{ .fw_name = "uniphy2_gcc_tx_clk", .name = "uniphy2_gcc_tx_clk" },
++	{ .fw_name = "uniphy2_gcc_rx_clk", .name = "uniphy2_gcc_rx_clk" },
+ 	{ .hw = &ubi32_pll.clkr.hw },
+-	{ .name = "bias_pll_cc_clk" },
++	{ .fw_name = "bias_pll_cc_clk", .name = "bias_pll_cc_clk" },
+ };
+ 
+ static const struct parent_map gcc_xo_uniphy2_tx_rx_ubi32_bias_map[] = {
diff --git a/target/linux/qualcommax/patches-6.1/0012-v6.2-arm64-dts-qcom-ipq8074-pass-XO-and-sleep-clocks-to-G.patch b/target/linux/qualcommax/patches-6.1/0012-v6.2-arm64-dts-qcom-ipq8074-pass-XO-and-sleep-clocks-to-G.patch
new file mode 100644
index 00000000000000..1f99de002bbc6b
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0012-v6.2-arm64-dts-qcom-ipq8074-pass-XO-and-sleep-clocks-to-G.patch
@@ -0,0 +1,36 @@
+From 9033c3c86ea0dd35bd2ab957317573b755967298 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Sun, 30 Oct 2022 18:57:03 +0100
+Subject: [PATCH] arm64: dts: qcom: ipq8074: pass XO and sleep clocks to GCC
+
+Pass XO and sleep clocks to the GCC controller so it does not have to
+find them by matching globaly by name.
+
+If not passed directly, driver maintains backwards compatibility by then
+falling back to global lookup.
+
+Since we are here, set cell numbers in decimal instead of hex.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221030175703.1103224-3-robimarko@gmail.com
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -361,9 +361,11 @@
+ 		gcc: gcc@1800000 {
+ 			compatible = "qcom,gcc-ipq8074";
+ 			reg = <0x01800000 0x80000>;
+-			#clock-cells = <0x1>;
++			clocks = <&xo>, <&sleep_clk>;
++			clock-names = "xo", "sleep_clk";
++			#clock-cells = <1>;
+ 			#power-domain-cells = <1>;
+-			#reset-cells = <0x1>;
++			#reset-cells = <1>;
+ 		};
+ 
+ 		tcsr_mutex: hwlock@1905000 {
diff --git a/target/linux/qualcommax/patches-6.1/0013-v6.2-arm64-dts-qcom-add-PMP8074-DTSI.patch b/target/linux/qualcommax/patches-6.1/0013-v6.2-arm64-dts-qcom-add-PMP8074-DTSI.patch
new file mode 100644
index 00000000000000..cd146420cf486f
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0013-v6.2-arm64-dts-qcom-add-PMP8074-DTSI.patch
@@ -0,0 +1,149 @@
+From fb76b808f8628215afebaf0f8af0bde635302590 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 19 Aug 2022 00:18:14 +0200
+Subject: [PATCH] arm64: dts: qcom: add PMP8074 DTSI
+
+PMP8074 is a companion PMIC to the Qualcomm IPQ8074 series that is
+controlled via SPMI.
+
+Add DTSI for it providing GPIO, regulator, RTC and VADC support.
+
+RTC is disabled by default as there is no built-in battery so it will
+loose time unless board vendor added a battery, so make it optional.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220818221815.346233-4-robimarko@gmail.com
+---
+ arch/arm64/boot/dts/qcom/pmp8074.dtsi | 125 ++++++++++++++++++++++++++
+ 1 file changed, 125 insertions(+)
+ create mode 100644 arch/arm64/boot/dts/qcom/pmp8074.dtsi
+
+--- /dev/null
++++ b/arch/arm64/boot/dts/qcom/pmp8074.dtsi
+@@ -0,0 +1,125 @@
++// SPDX-License-Identifier: GPL-2.0-only OR BSD-3-Clause
++
++#include <dt-bindings/spmi/spmi.h>
++#include <dt-bindings/iio/qcom,spmi-vadc.h>
++
++&spmi_bus {
++	pmic@0 {
++		compatible = "qcom,pmp8074", "qcom,spmi-pmic";
++		reg = <0x0 SPMI_USID>;
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		pmp8074_adc: adc@3100 {
++			compatible = "qcom,spmi-adc-rev2";
++			reg = <0x3100>;
++			interrupts = <0x0 0x31 0x0 IRQ_TYPE_EDGE_RISING>;
++			#address-cells = <1>;
++			#size-cells = <0>;
++			#io-channel-cells = <1>;
++
++			ref-gnd@0 {
++				reg = <ADC5_REF_GND>;
++				qcom,pre-scaling = <1 1>;
++			};
++
++			vref-1p25@1 {
++				reg = <ADC5_1P25VREF>;
++				qcom,pre-scaling = <1 1>;
++			};
++
++			vref-vadc@2 {
++				reg = <ADC5_VREF_VADC>;
++				qcom,pre-scaling = <1 1>;
++			};
++
++			pmic_die: die-temp@6 {
++				reg = <ADC5_DIE_TEMP>;
++				qcom,pre-scaling = <1 1>;
++			};
++
++			xo_therm: xo-temp@76 {
++				reg = <ADC5_XO_THERM_100K_PU>;
++				qcom,ratiometric;
++				qcom,hw-settle-time = <200>;
++				qcom,pre-scaling = <1 1>;
++			};
++
++			pa_therm1: thermistor1@77 {
++				reg = <ADC5_AMUX_THM1_100K_PU>;
++				qcom,ratiometric;
++				qcom,hw-settle-time = <200>;
++				qcom,pre-scaling = <1 1>;
++			};
++
++			pa_therm2: thermistor2@78 {
++				reg = <ADC5_AMUX_THM2_100K_PU>;
++				qcom,ratiometric;
++				qcom,hw-settle-time = <200>;
++				qcom,pre-scaling = <1 1>;
++			};
++
++			pa_therm3: thermistor3@79 {
++				reg = <ADC5_AMUX_THM3_100K_PU>;
++				qcom,ratiometric;
++				qcom,hw-settle-time = <200>;
++				qcom,pre-scaling = <1 1>;
++			};
++
++			vph-pwr@131 {
++				reg = <ADC5_VPH_PWR>;
++				qcom,pre-scaling = <1 3>;
++			};
++		};
++
++		pmp8074_rtc: rtc@6000 {
++			compatible = "qcom,pm8941-rtc";
++			reg = <0x6000>;
++			reg-names = "rtc", "alarm";
++			interrupts = <0x0 0x61 0x1 IRQ_TYPE_NONE>;
++			allow-set-time;
++			status = "disabled";
++		};
++
++		pmp8074_gpios: gpio@c000 {
++			compatible = "qcom,pmp8074-gpio", "qcom,spmi-gpio";
++			reg = <0xc000>;
++			gpio-controller;
++			#gpio-cells = <2>;
++			gpio-ranges = <&pmp8074_gpios 0 0 12>;
++			interrupt-controller;
++			#interrupt-cells = <2>;
++		};
++	};
++
++	pmic@1 {
++		compatible = "qcom,pmp8074", "qcom,spmi-pmic";
++		reg = <0x1 SPMI_USID>;
++
++		regulators {
++			compatible = "qcom,pmp8074-regulators";
++
++			s3: s3 {
++				regulator-name = "vdd_s3";
++				regulator-min-microvolt = <592000>;
++				regulator-max-microvolt = <1064000>;
++				regulator-always-on;
++				regulator-boot-on;
++			};
++
++			s4: s4 {
++				regulator-name = "vdd_s4";
++				regulator-min-microvolt = <712000>;
++				regulator-max-microvolt = <992000>;
++				regulator-always-on;
++				regulator-boot-on;
++			};
++
++			l11: l11 {
++				regulator-name = "l11";
++				regulator-min-microvolt = <1800000>;
++				regulator-max-microvolt = <3300000>;
++			};
++		};
++	};
++};
diff --git a/target/linux/qualcommax/patches-6.1/0014-v6.2-arm64-dts-qcom-ipq8074-hk01-add-VQMMC-supply.patch b/target/linux/qualcommax/patches-6.1/0014-v6.2-arm64-dts-qcom-ipq8074-hk01-add-VQMMC-supply.patch
new file mode 100644
index 00000000000000..ebd3763a58f778
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0014-v6.2-arm64-dts-qcom-ipq8074-hk01-add-VQMMC-supply.patch
@@ -0,0 +1,37 @@
+From 2c394cfc1779886048feca7dc7f4075da5f6328c Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 19 Aug 2022 00:18:15 +0200
+Subject: [PATCH] arm64: dts: qcom: ipq8074-hk01: add VQMMC supply
+
+Since now we have control over the PMP8074 PMIC providing various system
+voltages including L11 which provides the SDIO/eMMC I/O voltage set it as
+the SDHCI VQMMC supply.
+
+This allows SDHCI controller to switch to 1.8V I/O mode and support high
+speed modes like HS200 and HS400.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220818221815.346233-5-robimarko@gmail.com
+---
+ arch/arm64/boot/dts/qcom/ipq8074-hk01.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts
+@@ -3,6 +3,7 @@
+ /* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+  */
+ #include "ipq8074.dtsi"
++#include "pmp8074.dtsi"
+ 
+ / {
+ 	model = "Qualcomm Technologies, Inc. IPQ8074-HK01";
+@@ -84,6 +85,7 @@
+ 
+ &sdhc_1 {
+ 	status = "okay";
++	vqmmc-supply = <&l11>;
+ };
+ 
+ &qusb_phy_0 {
diff --git a/target/linux/qualcommax/patches-6.1/0015-v6.2-arm64-dts-qcom-hk01-use-GPIO-flags-for-tlmm.patch b/target/linux/qualcommax/patches-6.1/0015-v6.2-arm64-dts-qcom-hk01-use-GPIO-flags-for-tlmm.patch
new file mode 100644
index 00000000000000..e08f6d1f3c6380
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0015-v6.2-arm64-dts-qcom-hk01-use-GPIO-flags-for-tlmm.patch
@@ -0,0 +1,42 @@
+From 82ceb86227b1fc15c76d5fc691b2bf425f1a63b3 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Mon, 7 Nov 2022 10:29:30 +0100
+Subject: [PATCH] arm64: dts: qcom: hk01: use GPIO flags for tlmm
+
+Use respective GPIO_ACTIVE_LOW/HIGH flags for tlmm GPIOs instead of
+harcoding the cell value.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221107092930.33325-3-robimarko@gmail.com
+---
+ arch/arm64/boot/dts/qcom/ipq8074-hk01.dts | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts
+@@ -4,6 +4,7 @@
+  */
+ #include "ipq8074.dtsi"
+ #include "pmp8074.dtsi"
++#include <dt-bindings/gpio/gpio.h>
+ 
+ / {
+ 	model = "Qualcomm Technologies, Inc. IPQ8074-HK01";
+@@ -52,12 +53,12 @@
+ 
+ &pcie0 {
+ 	status = "okay";
+-	perst-gpios = <&tlmm 61 0x1>;
++	perst-gpios = <&tlmm 61 GPIO_ACTIVE_LOW>;
+ };
+ 
+ &pcie1 {
+ 	status = "okay";
+-	perst-gpios = <&tlmm 58 0x1>;
++	perst-gpios = <&tlmm 58 GPIO_ACTIVE_LOW>;
+ };
+ 
+ &pcie_qmp0 {
diff --git a/target/linux/qualcommax/patches-6.1/0016-v6.2-arm64-dts-qcom-ipq8074-Fix-up-comments.patch b/target/linux/qualcommax/patches-6.1/0016-v6.2-arm64-dts-qcom-ipq8074-Fix-up-comments.patch
new file mode 100644
index 00000000000000..a8bf2492f4a46e
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0016-v6.2-arm64-dts-qcom-ipq8074-Fix-up-comments.patch
@@ -0,0 +1,82 @@
+From 1b1c1423ca3e740984aa883512a72c4ea08fbe28 Mon Sep 17 00:00:00 2001
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+Date: Mon, 7 Nov 2022 15:55:17 +0100
+Subject: [PATCH] arm64: dts: qcom: ipq8074-*: Fix up comments
+
+Make sure all multiline C-style commends begin with just '/*' with
+the comment text starting on a new line.
+
+Also, fix up some whitespace within comments.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221107145522.6706-8-konrad.dybcio@linaro.org
+---
+ arch/arm64/boot/dts/qcom/ipq8074-hk01.dts    |  3 ++-
+ arch/arm64/boot/dts/qcom/ipq8074-hk10-c1.dts |  3 ++-
+ arch/arm64/boot/dts/qcom/ipq8074-hk10-c2.dts |  3 ++-
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi        | 12 ++++++------
+ 4 files changed, 12 insertions(+), 9 deletions(-)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts
+@@ -1,6 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /dts-v1/;
+-/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
++/*
++ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+  */
+ #include "ipq8074.dtsi"
+ #include "pmp8074.dtsi"
+--- a/arch/arm64/boot/dts/qcom/ipq8074-hk10-c1.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8074-hk10-c1.dts
+@@ -1,5 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+-/* Copyright (c) 2020 The Linux Foundation. All rights reserved.
++/*
++ * Copyright (c) 2020 The Linux Foundation. All rights reserved.
+  */
+ /dts-v1/;
+ 
+--- a/arch/arm64/boot/dts/qcom/ipq8074-hk10-c2.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8074-hk10-c2.dts
+@@ -1,6 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /dts-v1/;
+-/* Copyright (c) 2020 The Linux Foundation. All rights reserved.
++/*
++ * Copyright (c) 2020 The Linux Foundation. All rights reserved.
+  */
+ #include "ipq8074-hk10.dtsi"
+ 
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -129,10 +129,10 @@
+ 			status = "disabled";
+ 
+ 			usb1_ssphy: phy@58200 {
+-				reg = <0x00058200 0x130>,       /* Tx */
++				reg = <0x00058200 0x130>,     /* Tx */
+ 				      <0x00058400 0x200>,     /* Rx */
+-				      <0x00058800 0x1f8>,     /* PCS  */
+-				      <0x00058600 0x044>;     /* PCS misc*/
++				      <0x00058800 0x1f8>,     /* PCS */
++				      <0x00058600 0x044>;     /* PCS misc */
+ 				#phy-cells = <0>;
+ 				#clock-cells = <0>;
+ 				clocks = <&gcc GCC_USB1_PIPE_CLK>;
+@@ -172,10 +172,10 @@
+ 			status = "disabled";
+ 
+ 			usb0_ssphy: phy@78200 {
+-				reg = <0x00078200 0x130>,       /* Tx */
++				reg = <0x00078200 0x130>,     /* Tx */
+ 				      <0x00078400 0x200>,     /* Rx */
+-				      <0x00078800 0x1f8>,     /* PCS  */
+-				      <0x00078600 0x044>;     /* PCS misc*/
++				      <0x00078800 0x1f8>,     /* PCS */
++				      <0x00078600 0x044>;     /* PCS misc */
+ 				#phy-cells = <0>;
+ 				#clock-cells = <0>;
+ 				clocks = <&gcc GCC_USB0_PIPE_CLK>;
diff --git a/target/linux/qualcommax/patches-6.1/0017-v6.2-arm64-dts-qcom-ipq8074-align-TLMM-pin-configuration-.patch b/target/linux/qualcommax/patches-6.1/0017-v6.2-arm64-dts-qcom-ipq8074-align-TLMM-pin-configuration-.patch
new file mode 100644
index 00000000000000..1ce11406828b61
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0017-v6.2-arm64-dts-qcom-ipq8074-align-TLMM-pin-configuration-.patch
@@ -0,0 +1,60 @@
+From 5f20690f77878b1ba24ec88df01b92d5131a6780 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Tue, 8 Nov 2022 15:23:57 +0100
+Subject: [PATCH] arm64: dts: qcom: ipq8074: align TLMM pin configuration with
+ DT schema
+
+DT schema expects TLMM pin configuration nodes to be named with
+'-state' suffix and their optional children with '-pins' suffix.
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221108142357.67202-2-krzysztof.kozlowski@linaro.org
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -318,35 +318,35 @@
+ 			interrupt-controller;
+ 			#interrupt-cells = <0x2>;
+ 
+-			serial_4_pins: serial4-pinmux {
++			serial_4_pins: serial4-state {
+ 				pins = "gpio23", "gpio24";
+ 				function = "blsp4_uart1";
+ 				drive-strength = <8>;
+ 				bias-disable;
+ 			};
+ 
+-			i2c_0_pins: i2c-0-pinmux {
++			i2c_0_pins: i2c-0-state {
+ 				pins = "gpio42", "gpio43";
+ 				function = "blsp1_i2c";
+ 				drive-strength = <8>;
+ 				bias-disable;
+ 			};
+ 
+-			spi_0_pins: spi-0-pins {
++			spi_0_pins: spi-0-state {
+ 				pins = "gpio38", "gpio39", "gpio40", "gpio41";
+ 				function = "blsp0_spi";
+ 				drive-strength = <8>;
+ 				bias-disable;
+ 			};
+ 
+-			hsuart_pins: hsuart-pins {
++			hsuart_pins: hsuart-state {
+ 				pins = "gpio46", "gpio47", "gpio48", "gpio49";
+ 				function = "blsp2_uart";
+ 				drive-strength = <8>;
+ 				bias-disable;
+ 			};
+ 
+-			qpic_pins: qpic-pins {
++			qpic_pins: qpic-state {
+ 				pins = "gpio1", "gpio3", "gpio4",
+ 				       "gpio5", "gpio6", "gpio7",
+ 				       "gpio8", "gpio10", "gpio11",
diff --git a/target/linux/qualcommax/patches-6.1/0019-v6.3-arm64-dts-qcom-ipq8074-set-Gen2-PCIe-pcie-max-link-s.patch b/target/linux/qualcommax/patches-6.1/0019-v6.3-arm64-dts-qcom-ipq8074-set-Gen2-PCIe-pcie-max-link-s.patch
new file mode 100644
index 00000000000000..8719bf74c4d58c
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0019-v6.3-arm64-dts-qcom-ipq8074-set-Gen2-PCIe-pcie-max-link-s.patch
@@ -0,0 +1,24 @@
+From a4748d2850783d36f77ccf2b5fcc86ccf1800ef1 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Wed, 16 Nov 2022 22:48:36 +0100
+Subject: [PATCH] arm64: dts: qcom: ipq8074: set Gen2 PCIe pcie max-link-speed
+
+Add the generic 'max-link-speed' property to describe the Gen2 PCIe link
+generation limit.
+This allows the generic DWC code to configure the link speed correctly.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -766,6 +766,7 @@
+ 			linux,pci-domain = <1>;
+ 			bus-range = <0x00 0xff>;
+ 			num-lanes = <1>;
++			max-link-speed = <2>;
+ 			#address-cells = <3>;
+ 			#size-cells = <2>;
+ 
diff --git a/target/linux/qualcommax/patches-6.1/0020-v6.3-PCI-qcom-Add-support-for-IPQ8074-Gen3-port.patch b/target/linux/qualcommax/patches-6.1/0020-v6.3-PCI-qcom-Add-support-for-IPQ8074-Gen3-port.patch
new file mode 100644
index 00000000000000..60caee46cab96a
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0020-v6.3-PCI-qcom-Add-support-for-IPQ8074-Gen3-port.patch
@@ -0,0 +1,26 @@
+From f356132229b18ceef5d5ef9103bbaa9bdeb84c8d Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 13 Jan 2023 17:44:47 +0100
+Subject: [PATCH] PCI: qcom: Add IPQ8074 Gen3 port support
+
+IPQ8074 has one Gen2 and one Gen3 port, with Gen2 port already supported.
+Add compatible for Gen3 port which uses the same controller as IPQ6018.
+
+Link: https://lore.kernel.org/r/20230113164449.906002-7-robimarko@gmail.com
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+---
+ drivers/pci/controller/dwc/pcie-qcom.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -1745,6 +1745,7 @@ static const struct of_device_id qcom_pc
+ 	{ .compatible = "qcom,pcie-ipq8064", .data = &cfg_2_1_0 },
+ 	{ .compatible = "qcom,pcie-ipq8064-v2", .data = &cfg_2_1_0 },
+ 	{ .compatible = "qcom,pcie-ipq8074", .data = &cfg_2_3_3 },
++	{ .compatible = "qcom,pcie-ipq8074-gen3", .data = &cfg_2_9_0 },
+ 	{ .compatible = "qcom,pcie-msm8996", .data = &cfg_2_3_2 },
+ 	{ .compatible = "qcom,pcie-qcs404", .data = &cfg_2_4_0 },
+ 	{ .compatible = "qcom,pcie-sa8540p", .data = &cfg_1_9_0 },
diff --git a/target/linux/qualcommax/patches-6.1/0021-v6.3-clk-qcom-ipq8074-populate-fw_name-for-usb3phy-s.patch b/target/linux/qualcommax/patches-6.1/0021-v6.3-clk-qcom-ipq8074-populate-fw_name-for-usb3phy-s.patch
new file mode 100644
index 00000000000000..eb772be4cee807
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0021-v6.3-clk-qcom-ipq8074-populate-fw_name-for-usb3phy-s.patch
@@ -0,0 +1,38 @@
+From 614d31c231c7707322b643f409eeb7e28adc7f8c Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Sun, 8 Jan 2023 13:36:28 +0100
+Subject: [PATCH] clk: qcom: ipq8074: populate fw_name for usb3phy-s
+
+Having only .name populated in parent_data for clocks which are only
+globally searchable currently will not work as the clk core won't copy
+that name if there is no .fw_name present as well.
+
+So, populate .fw_name for usb3phy clocks in parent_data as they were
+missed by me in ("clk: qcom: ipq8074: populate fw_name for all parents").
+
+Fixes: ae55ad32e273 ("clk: qcom: ipq8074: convert to parent data")
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/clk/qcom/gcc-ipq8074.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/qcom/gcc-ipq8074.c
++++ b/drivers/clk/qcom/gcc-ipq8074.c
+@@ -934,7 +934,7 @@ static struct clk_rcg2 usb0_mock_utmi_cl
+ };
+ 
+ static const struct clk_parent_data gcc_usb3phy_0_cc_pipe_clk_xo[] = {
+-	{ .name = "usb3phy_0_cc_pipe_clk" },
++	{ .fw_name = "usb3phy_0_cc_pipe_clk", .name = "usb3phy_0_cc_pipe_clk" },
+ 	{ .fw_name = "xo", .name = "xo" },
+ };
+ 
+@@ -1002,7 +1002,7 @@ static struct clk_rcg2 usb1_mock_utmi_cl
+ };
+ 
+ static const struct clk_parent_data gcc_usb3phy_1_cc_pipe_clk_xo[] = {
+-	{ .name = "usb3phy_1_cc_pipe_clk" },
++	{ .fw_name = "usb3phy_1_cc_pipe_clk", .name = "usb3phy_1_cc_pipe_clk" },
+ 	{ .fw_name = "xo", .name = "xo" },
+ };
+ 
diff --git a/target/linux/qualcommax/patches-6.1/0022-v6.5-soc-qcom-mdt_loader-Fix-unconditional-call-to-scm_pa.patch b/target/linux/qualcommax/patches-6.1/0022-v6.5-soc-qcom-mdt_loader-Fix-unconditional-call-to-scm_pa.patch
new file mode 100644
index 00000000000000..72b38270c468ff
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0022-v6.5-soc-qcom-mdt_loader-Fix-unconditional-call-to-scm_pa.patch
@@ -0,0 +1,77 @@
+From b8295c6eb276b60f7b75c53a9703ca8fee01eba2 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Fri, 26 May 2023 13:09:17 +0200
+Subject: [PATCH] soc: qcom: mdt_loader: Fix unconditional call to
+ scm_pas_mem_setup
+
+Commit ebeb20a9cd3f ("soc: qcom: mdt_loader: Always invoke PAS
+mem_setup") dropped the relocate check and made pas_mem_setup run
+unconditionally. The code was later moved with commit f4e526ff7e38
+("soc: qcom: mdt_loader: Extract PAS operations") to
+qcom_mdt_pas_init() effectively losing track of what was actually
+done.
+
+The assumption that PAS mem_setup can be done anytime was effectively
+wrong, with no good reason and this caused regression on some SoC
+that use remoteproc to bringup ath11k. One example is IPQ8074 SoC that
+effectively broke resulting in remoteproc silently die and ath11k not
+working.
+
+On this SoC FW relocate is not enabled and PAS mem_setup was correctly
+skipped in previous kernel version resulting in correct bringup and
+function of remoteproc and ath11k.
+
+To fix the regression, reintroduce the relocate check in
+qcom_mdt_pas_init() and correctly skip PAS mem_setup where relocate is
+not enabled.
+
+Fixes: ebeb20a9cd3f ("soc: qcom: mdt_loader: Always invoke PAS mem_setup")
+Reported-by: Robert Marko <robimarko@gmail.com>
+Tested-by: Robert Marko <robimarko@gmail.com>
+Co-developed-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Cc: stable@vger.kernel.org
+---
+ drivers/soc/qcom/mdt_loader.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/drivers/soc/qcom/mdt_loader.c
++++ b/drivers/soc/qcom/mdt_loader.c
+@@ -210,6 +210,7 @@ int qcom_mdt_pas_init(struct device *dev
+ 	const struct elf32_hdr *ehdr;
+ 	phys_addr_t min_addr = PHYS_ADDR_MAX;
+ 	phys_addr_t max_addr = 0;
++	bool relocate = false;
+ 	size_t metadata_len;
+ 	void *metadata;
+ 	int ret;
+@@ -224,6 +225,9 @@ int qcom_mdt_pas_init(struct device *dev
+ 		if (!mdt_phdr_valid(phdr))
+ 			continue;
+ 
++		if (phdr->p_flags & QCOM_MDT_RELOCATABLE)
++			relocate = true;
++
+ 		if (phdr->p_paddr < min_addr)
+ 			min_addr = phdr->p_paddr;
+ 
+@@ -246,11 +250,13 @@ int qcom_mdt_pas_init(struct device *dev
+ 		goto out;
+ 	}
+ 
+-	ret = qcom_scm_pas_mem_setup(pas_id, mem_phys, max_addr - min_addr);
+-	if (ret) {
+-		/* Unable to set up relocation */
+-		dev_err(dev, "error %d setting up firmware %s\n", ret, fw_name);
+-		goto out;
++	if (relocate) {
++		ret = qcom_scm_pas_mem_setup(pas_id, mem_phys, max_addr - min_addr);
++		if (ret) {
++			/* Unable to set up relocation */
++			dev_err(dev, "error %d setting up firmware %s\n", ret, fw_name);
++			goto out;
++		}
+ 	}
+ 
+ out:
diff --git a/target/linux/qualcommax/patches-6.1/0023-v6.5-arm64-dts-qcom-ipq8074-add-critical-thermal-trips.patch b/target/linux/qualcommax/patches-6.1/0023-v6.5-arm64-dts-qcom-ipq8074-add-critical-thermal-trips.patch
new file mode 100644
index 00000000000000..e720eb2b851f70
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0023-v6.5-arm64-dts-qcom-ipq8074-add-critical-thermal-trips.patch
@@ -0,0 +1,199 @@
+From 56d3067cb694ba60d654e7f5ef231b6fabc4697f Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Wed, 7 Jun 2023 20:44:48 +0200
+Subject: [PATCH] arm64: dts: qcom: ipq8074: add critical thermal trips
+
+According to bindings, thermal zones must have associated trips as well.
+Since we currently dont have CPUFreq support and thus no passive cooling
+lets start by defining critical trips to protect the devices against
+severe overheating.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230607184448.2512179-1-robimarko@gmail.com
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 96 +++++++++++++++++++++++++++
+ 1 file changed, 96 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -896,6 +896,14 @@
+ 			polling-delay = <1000>;
+ 
+ 			thermal-sensors = <&tsens 4>;
++
++			trips {
++				nss-top-crit {
++					temperature = <110000>;
++					hysteresis = <1000>;
++					type = "critical";
++				};
++			};
+ 		};
+ 
+ 		nss0-thermal {
+@@ -903,6 +911,14 @@
+ 			polling-delay = <1000>;
+ 
+ 			thermal-sensors = <&tsens 5>;
++
++			trips {
++				nss-0-crit {
++					temperature = <110000>;
++					hysteresis = <1000>;
++					type = "critical";
++				};
++			};
+ 		};
+ 
+ 		nss1-thermal {
+@@ -910,6 +926,14 @@
+ 			polling-delay = <1000>;
+ 
+ 			thermal-sensors = <&tsens 6>;
++
++			trips {
++				nss-1-crit {
++					temperature = <110000>;
++					hysteresis = <1000>;
++					type = "critical";
++				};
++			};
+ 		};
+ 
+ 		wcss-phya0-thermal {
+@@ -917,6 +941,14 @@
+ 			polling-delay = <1000>;
+ 
+ 			thermal-sensors = <&tsens 7>;
++
++			trips {
++				wcss-phya0-crit {
++					temperature = <110000>;
++					hysteresis = <1000>;
++					type = "critical";
++				};
++			};
+ 		};
+ 
+ 		wcss-phya1-thermal {
+@@ -924,6 +956,14 @@
+ 			polling-delay = <1000>;
+ 
+ 			thermal-sensors = <&tsens 8>;
++
++			trips {
++				wcss-phya1-crit {
++					temperature = <110000>;
++					hysteresis = <1000>;
++					type = "critical";
++				};
++			};
+ 		};
+ 
+ 		cpu0_thermal: cpu0-thermal {
+@@ -931,6 +971,14 @@
+ 			polling-delay = <1000>;
+ 
+ 			thermal-sensors = <&tsens 9>;
++
++			trips {
++				cpu0-crit {
++					temperature = <110000>;
++					hysteresis = <1000>;
++					type = "critical";
++				};
++			};
+ 		};
+ 
+ 		cpu1_thermal: cpu1-thermal {
+@@ -938,6 +986,14 @@
+ 			polling-delay = <1000>;
+ 
+ 			thermal-sensors = <&tsens 10>;
++
++			trips {
++				cpu1-crit {
++					temperature = <110000>;
++					hysteresis = <1000>;
++					type = "critical";
++				};
++			};
+ 		};
+ 
+ 		cpu2_thermal: cpu2-thermal {
+@@ -945,6 +1001,14 @@
+ 			polling-delay = <1000>;
+ 
+ 			thermal-sensors = <&tsens 11>;
++
++			trips {
++				cpu2-crit {
++					temperature = <110000>;
++					hysteresis = <1000>;
++					type = "critical";
++				};
++			};
+ 		};
+ 
+ 		cpu3_thermal: cpu3-thermal {
+@@ -952,6 +1016,14 @@
+ 			polling-delay = <1000>;
+ 
+ 			thermal-sensors = <&tsens 12>;
++
++			trips {
++				cpu3-crit {
++					temperature = <110000>;
++					hysteresis = <1000>;
++					type = "critical";
++				};
++			};
+ 		};
+ 
+ 		cluster_thermal: cluster-thermal {
+@@ -959,6 +1031,14 @@
+ 			polling-delay = <1000>;
+ 
+ 			thermal-sensors = <&tsens 13>;
++
++			trips {
++				cluster-crit {
++					temperature = <110000>;
++					hysteresis = <1000>;
++					type = "critical";
++				};
++			};
+ 		};
+ 
+ 		wcss-phyb0-thermal {
+@@ -966,6 +1046,14 @@
+ 			polling-delay = <1000>;
+ 
+ 			thermal-sensors = <&tsens 14>;
++
++			trips {
++				wcss-phyb0-crit {
++					temperature = <110000>;
++					hysteresis = <1000>;
++					type = "critical";
++				};
++			};
+ 		};
+ 
+ 		wcss-phyb1-thermal {
+@@ -973,6 +1061,14 @@
+ 			polling-delay = <1000>;
+ 
+ 			thermal-sensors = <&tsens 15>;
++
++			trips {
++				wcss-phyb1-crit {
++					temperature = <110000>;
++					hysteresis = <1000>;
++					type = "critical";
++				};
++			};
+ 		};
+ 	};
+ };
diff --git a/target/linux/qualcommax/patches-6.1/0100-clk-qcom-clk-rcg2-introduce-support-for-multiple-con.patch b/target/linux/qualcommax/patches-6.1/0100-clk-qcom-clk-rcg2-introduce-support-for-multiple-con.patch
new file mode 100644
index 00000000000000..5713775948dca2
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0100-clk-qcom-clk-rcg2-introduce-support-for-multiple-con.patch
@@ -0,0 +1,203 @@
+From 032be4f49dda786fea9e1501212f6cd09a7ded96 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 3 Nov 2022 14:49:43 +0100
+Subject: [PATCH] clk: qcom: clk-rcg2: introduce support for multiple conf for
+ same freq
+
+Some RCG frequency can be reached by multiple configuration.
+
+We currently declare multiple configuration for the same frequency but
+that is not supported and always the first configuration will be taken.
+
+These multiple configuration are needed as based on the current parent
+configuration, it may be needed to use a different configuration to
+reach the same frequency.
+
+To handle this introduce 2 new macro, FM and C.
+
+- FM is used to declare an empty freq_tbl with just the frequency and an
+  array of confs to insert all the config for the provided frequency.
+
+- C is used to declare a fre_conf where src, pre_div, m and n are
+  provided.
+
+The driver is changed to handle this special freq_tbl and select the
+correct config by calculating the final rate and deciding based on the
+one that is less different than the requested one.
+
+Tested-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/clk/qcom/clk-rcg.h  | 14 ++++++-
+ drivers/clk/qcom/clk-rcg2.c | 84 +++++++++++++++++++++++++++++++++----
+ 2 files changed, 88 insertions(+), 10 deletions(-)
+
+--- a/drivers/clk/qcom/clk-rcg.h
++++ b/drivers/clk/qcom/clk-rcg.h
+@@ -7,7 +7,17 @@
+ #include <linux/clk-provider.h>
+ #include "clk-regmap.h"
+ 
+-#define F(f, s, h, m, n) { (f), (s), (2 * (h) - 1), (m), (n) }
++#define F(f, s, h, m, n) { (f), (s), (2 * (h) - 1), (m), (n), 0, NULL }
++
++#define FM(_f, _confs) { .freq = (_f), .confs_num = ARRAY_SIZE(_confs), .confs = (_confs) }
++#define C(s, h, m, n) { (s), (2 * (h) - 1), (m), (n) }
++
++struct freq_conf {
++	u8 src;
++	u8 pre_div;
++	u16 m;
++	u16 n;
++};
+ 
+ struct freq_tbl {
+ 	unsigned long freq;
+@@ -15,6 +25,8 @@ struct freq_tbl {
+ 	u8 pre_div;
+ 	u16 m;
+ 	u16 n;
++	int confs_num;
++	const struct freq_conf *confs;
+ };
+ 
+ /**
+--- a/drivers/clk/qcom/clk-rcg2.c
++++ b/drivers/clk/qcom/clk-rcg2.c
+@@ -209,11 +209,60 @@ clk_rcg2_recalc_rate(struct clk_hw *hw,
+ 	return __clk_rcg2_recalc_rate(hw, parent_rate, cfg);
+ }
+ 
++static void
++clk_rcg2_select_conf(struct clk_hw *hw, struct freq_tbl *f_tbl,
++		     const struct freq_tbl *f, unsigned long req_rate)
++{
++	unsigned long best_rate = 0, parent_rate, rate;
++	const struct freq_conf *conf, *best_conf;
++	struct clk_rcg2 *rcg = to_clk_rcg2(hw);
++	struct clk_hw *p;
++	int index, i;
++
++	/* Search in each provided config the one that is near the wanted rate */
++	for (i = 0, conf = f->confs; i < f->confs_num; i++, conf++) {
++		index = qcom_find_src_index(hw, rcg->parent_map, conf->src);
++		if (index < 0)
++			continue;
++
++		p = clk_hw_get_parent_by_index(hw, index);
++		if (!p)
++			continue;
++
++		parent_rate =  clk_hw_get_rate(p);
++		rate = calc_rate(parent_rate, conf->n, conf->m, conf->n, conf->pre_div);
++
++		if (rate == req_rate) {
++			best_conf = conf;
++			break;
++		}
++
++		if (abs(req_rate - rate) < abs(best_rate - rate)) {
++			best_rate = rate;
++			best_conf = conf;
++		}
++	}
++
++	/*
++	 * Very unlikely.
++	 * Force the first conf if we can't find a correct config.
++	 */
++	if (unlikely(i == f->confs_num))
++		best_conf = f->confs;
++
++	/* Apply the config */
++	f_tbl->src = best_conf->src;
++	f_tbl->pre_div = best_conf->pre_div;
++	f_tbl->m = best_conf->m;
++	f_tbl->n = best_conf->n;
++}
++
+ static int _freq_tbl_determine_rate(struct clk_hw *hw, const struct freq_tbl *f,
+ 				    struct clk_rate_request *req,
+ 				    enum freq_policy policy)
+ {
+ 	unsigned long clk_flags, rate = req->rate;
++	struct freq_tbl f_tbl;
+ 	struct clk_hw *p;
+ 	struct clk_rcg2 *rcg = to_clk_rcg2(hw);
+ 	int index;
+@@ -232,7 +281,15 @@ static int _freq_tbl_determine_rate(stru
+ 	if (!f)
+ 		return -EINVAL;
+ 
+-	index = qcom_find_src_index(hw, rcg->parent_map, f->src);
++	f_tbl = *f;
++	/*
++	 * A single freq may be reached by multiple configuration.
++	 * Try to find the bast one if we have this kind of freq_table.
++	 */
++	if (f->confs)
++		clk_rcg2_select_conf(hw, &f_tbl, f, rate);
++
++	index = qcom_find_src_index(hw, rcg->parent_map, f_tbl.src);
+ 	if (index < 0)
+ 		return index;
+ 
+@@ -242,18 +299,18 @@ static int _freq_tbl_determine_rate(stru
+ 		return -EINVAL;
+ 
+ 	if (clk_flags & CLK_SET_RATE_PARENT) {
+-		rate = f->freq;
+-		if (f->pre_div) {
++		rate = f_tbl.freq;
++		if (f_tbl.pre_div) {
+ 			if (!rate)
+ 				rate = req->rate;
+ 			rate /= 2;
+-			rate *= f->pre_div + 1;
++			rate *= f_tbl.pre_div + 1;
+ 		}
+ 
+-		if (f->n) {
++		if (f_tbl.n) {
+ 			u64 tmp = rate;
+-			tmp = tmp * f->n;
+-			do_div(tmp, f->m);
++			tmp = tmp * f_tbl.n;
++			do_div(tmp, f_tbl.m);
+ 			rate = tmp;
+ 		}
+ 	} else {
+@@ -261,7 +318,7 @@ static int _freq_tbl_determine_rate(stru
+ 	}
+ 	req->best_parent_hw = p;
+ 	req->best_parent_rate = rate;
+-	req->rate = f->freq;
++	req->rate = f_tbl.freq;
+ 
+ 	return 0;
+ }
+@@ -357,6 +414,7 @@ static int __clk_rcg2_set_rate(struct cl
+ {
+ 	struct clk_rcg2 *rcg = to_clk_rcg2(hw);
+ 	const struct freq_tbl *f;
++	struct freq_tbl f_tbl;
+ 
+ 	switch (policy) {
+ 	case FLOOR:
+@@ -372,7 +430,15 @@ static int __clk_rcg2_set_rate(struct cl
+ 	if (!f)
+ 		return -EINVAL;
+ 
+-	return clk_rcg2_configure(rcg, f);
++	f_tbl = *f;
++	/*
++	 * A single freq may be reached by multiple configuration.
++	 * Try to find the best one if we have this kind of freq_table.
++	 */
++	if (f->confs)
++		clk_rcg2_select_conf(hw, &f_tbl, f, rate);
++
++	return clk_rcg2_configure(rcg, &f_tbl);
+ }
+ 
+ static int clk_rcg2_set_rate(struct clk_hw *hw, unsigned long rate,
diff --git a/target/linux/qualcommax/patches-6.1/0101-clk-qcom-gcc-ipq8074-rework-nss_port5-6-clock-to-mul.patch b/target/linux/qualcommax/patches-6.1/0101-clk-qcom-gcc-ipq8074-rework-nss_port5-6-clock-to-mul.patch
new file mode 100644
index 00000000000000..32fb2d9d872735
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0101-clk-qcom-gcc-ipq8074-rework-nss_port5-6-clock-to-mul.patch
@@ -0,0 +1,129 @@
+From f778553f296792f4d1e8b3552603ad6116ea3eb3 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 3 Nov 2022 14:49:44 +0100
+Subject: [PATCH] clk: qcom: gcc-ipq8074: rework nss_port5/6 clock to multiple
+ conf
+
+Rework nss_port5/6 to use the new multiple configuration implementation
+and correctly fix the clocks for these port under some corner case.
+
+This is particularly relevant for device that have 2.5G or 10G port
+connected to port5 or port 6 on ipq8074. As the parent are shared
+across multiple port it may be required to select the correct
+configuration to accomplish the desired clock. Without this patch such
+port doesn't work in some specific ethernet speed as the clock will be
+set to the wrong frequency as we just select the first configuration for
+the related frequency instead of selecting the best one.
+
+Tested-by: Robert Marko <robimarko@gmail.com> # ipq8074 Qnap QHora-301W
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/clk/qcom/gcc-ipq8074.c | 64 +++++++++++++++++++++++++---------
+ 1 file changed, 48 insertions(+), 16 deletions(-)
+
+--- a/drivers/clk/qcom/gcc-ipq8074.c
++++ b/drivers/clk/qcom/gcc-ipq8074.c
+@@ -1682,13 +1682,21 @@ static struct clk_regmap_div nss_port4_t
+ 	},
+ };
+ 
++static const struct freq_conf ftbl_nss_port5_rx_clk_src_25[] = {
++	C(P_UNIPHY1_RX, 12.5, 0, 0),
++	C(P_UNIPHY0_RX, 5, 0, 0),
++};
++
++static const struct freq_conf ftbl_nss_port5_rx_clk_src_125[] = {
++	C(P_UNIPHY1_RX, 2.5, 0, 0),
++	C(P_UNIPHY0_RX, 1, 0, 0),
++};
++
+ static const struct freq_tbl ftbl_nss_port5_rx_clk_src[] = {
+ 	F(19200000, P_XO, 1, 0, 0),
+-	F(25000000, P_UNIPHY1_RX, 12.5, 0, 0),
+-	F(25000000, P_UNIPHY0_RX, 5, 0, 0),
++	FM(25000000, ftbl_nss_port5_rx_clk_src_25),
+ 	F(78125000, P_UNIPHY1_RX, 4, 0, 0),
+-	F(125000000, P_UNIPHY1_RX, 2.5, 0, 0),
+-	F(125000000, P_UNIPHY0_RX, 1, 0, 0),
++	FM(125000000, ftbl_nss_port5_rx_clk_src_125),
+ 	F(156250000, P_UNIPHY1_RX, 2, 0, 0),
+ 	F(312500000, P_UNIPHY1_RX, 1, 0, 0),
+ 	{ }
+@@ -1744,13 +1752,21 @@ static struct clk_regmap_div nss_port5_r
+ 	},
+ };
+ 
++static struct freq_conf ftbl_nss_port5_tx_clk_src_25[] = {
++	C(P_UNIPHY1_TX, 12.5, 0, 0),
++	C(P_UNIPHY0_TX, 5, 0, 0),
++};
++
++static struct freq_conf ftbl_nss_port5_tx_clk_src_125[] = {
++	C(P_UNIPHY1_TX, 2.5, 0, 0),
++	C(P_UNIPHY0_TX, 1, 0, 0),
++};
++
+ static const struct freq_tbl ftbl_nss_port5_tx_clk_src[] = {
+ 	F(19200000, P_XO, 1, 0, 0),
+-	F(25000000, P_UNIPHY1_TX, 12.5, 0, 0),
+-	F(25000000, P_UNIPHY0_TX, 5, 0, 0),
++	FM(25000000, ftbl_nss_port5_tx_clk_src_25),
+ 	F(78125000, P_UNIPHY1_TX, 4, 0, 0),
+-	F(125000000, P_UNIPHY1_TX, 2.5, 0, 0),
+-	F(125000000, P_UNIPHY0_TX, 1, 0, 0),
++	FM(125000000, ftbl_nss_port5_tx_clk_src_125),
+ 	F(156250000, P_UNIPHY1_TX, 2, 0, 0),
+ 	F(312500000, P_UNIPHY1_TX, 1, 0, 0),
+ 	{ }
+@@ -1806,13 +1822,21 @@ static struct clk_regmap_div nss_port5_t
+ 	},
+ };
+ 
++static struct freq_conf ftbl_nss_port6_rx_clk_src_25[] = {
++	C(P_UNIPHY2_RX, 5, 0, 0),
++	C(P_UNIPHY2_RX, 12.5, 0, 0),
++};
++
++static struct freq_conf ftbl_nss_port6_rx_clk_src_125[] = {
++	C(P_UNIPHY2_RX, 1, 0, 0),
++	C(P_UNIPHY2_RX, 2.5, 0, 0),
++};
++
+ static const struct freq_tbl ftbl_nss_port6_rx_clk_src[] = {
+ 	F(19200000, P_XO, 1, 0, 0),
+-	F(25000000, P_UNIPHY2_RX, 5, 0, 0),
+-	F(25000000, P_UNIPHY2_RX, 12.5, 0, 0),
++	FM(25000000, ftbl_nss_port6_rx_clk_src_25),
+ 	F(78125000, P_UNIPHY2_RX, 4, 0, 0),
+-	F(125000000, P_UNIPHY2_RX, 1, 0, 0),
+-	F(125000000, P_UNIPHY2_RX, 2.5, 0, 0),
++	FM(125000000, ftbl_nss_port6_rx_clk_src_125),
+ 	F(156250000, P_UNIPHY2_RX, 2, 0, 0),
+ 	F(312500000, P_UNIPHY2_RX, 1, 0, 0),
+ 	{ }
+@@ -1863,13 +1887,21 @@ static struct clk_regmap_div nss_port6_r
+ 	},
+ };
+ 
++static struct freq_conf ftbl_nss_port6_tx_clk_src_25[] = {
++	C(P_UNIPHY2_TX, 5, 0, 0),
++	C(P_UNIPHY2_TX, 12.5, 0, 0),
++};
++
++static struct freq_conf ftbl_nss_port6_tx_clk_src_125[] = {
++	C(P_UNIPHY2_TX, 1, 0, 0),
++	C(P_UNIPHY2_TX, 2.5, 0, 0),
++};
++
+ static const struct freq_tbl ftbl_nss_port6_tx_clk_src[] = {
+ 	F(19200000, P_XO, 1, 0, 0),
+-	F(25000000, P_UNIPHY2_TX, 5, 0, 0),
+-	F(25000000, P_UNIPHY2_TX, 12.5, 0, 0),
++	FM(25000000, ftbl_nss_port6_tx_clk_src_25),
+ 	F(78125000, P_UNIPHY2_TX, 4, 0, 0),
+-	F(125000000, P_UNIPHY2_TX, 1, 0, 0),
+-	F(125000000, P_UNIPHY2_TX, 2.5, 0, 0),
++	FM(125000000, ftbl_nss_port6_tx_clk_src_125),
+ 	F(156250000, P_UNIPHY2_TX, 2, 0, 0),
+ 	F(312500000, P_UNIPHY2_TX, 1, 0, 0),
+ 	{ }
diff --git a/target/linux/qualcommax/patches-6.1/0102-arm64-dts-ipq8074-add-reserved-memory-nodes.patch b/target/linux/qualcommax/patches-6.1/0102-arm64-dts-ipq8074-add-reserved-memory-nodes.patch
new file mode 100644
index 00000000000000..af53c077ff1eca
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0102-arm64-dts-ipq8074-add-reserved-memory-nodes.patch
@@ -0,0 +1,70 @@
+From ad2d07f71739351eeea1d8a120c0918e2c4b265f Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Wed, 22 Dec 2021 12:23:34 +0100
+Subject: [PATCH] arm64: dts: ipq8074: add reserved memory nodes
+
+IPQ8074 has multiple reserved memory ranges, if they are not defined
+then weird things tend to happen, board hangs and resets when PCI or
+WLAN is used etc.
+
+So, to avoid all of that add the reserved memory nodes from the downstream
+5.4 kernel from QCA.
+This is their default layout meant for devices with 1GB of RAM, but
+devices with lower ammounts can override the Q6 node.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 35 +++++++++++++++++++++++++++
+ 1 file changed, 35 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -85,6 +85,26 @@
+ 		#size-cells = <2>;
+ 		ranges;
+ 
++		nss@40000000 {
++			no-map;
++			reg = <0x0 0x40000000 0x0 0x01000000>;
++		};
++
++		tzapp_region: tzapp@4a400000 {
++			no-map;
++			reg = <0x0 0x4a400000 0x0 0x00200000>;
++		};
++
++		uboot@4a600000 {
++			no-map;
++			reg = <0x0 0x4a600000 0x0 0x00400000>;
++		};
++
++		sbl@4aa00000 {
++			no-map;
++			reg = <0x0 0x4aa00000 0x0 0x00100000>;
++		};
++
+ 		smem@4ab00000 {
+ 			compatible = "qcom,smem";
+ 			reg = <0x0 0x4ab00000 0x0 0x00100000>;
+@@ -97,6 +117,21 @@
+ 			no-map;
+ 			reg = <0x0 0x4ac00000 0x0 0x00400000>;
+ 		};
++
++		q6_region: wcnss@4b000000 {
++			no-map;
++			reg = <0x0 0x4b000000 0x0 0x05f00000>;
++		};
++
++		q6_etr_region: q6_etr_dump@50f00000 {
++			no-map;
++			reg = <0x0 0x50f00000 0x0 0x00100000>;
++		};
++
++		m3_dump_region: m3_dump@51000000 {
++			no-map;
++			reg = <0x0 0x51000000 0x0 0x100000>;
++		};
+ 	};
+ 
+ 	firmware {
diff --git a/target/linux/qualcommax/patches-6.1/0110-arm64-dts-qcom-ipq8074-pass-QMP-PCI-PHY-PIPE-clocks-.patch b/target/linux/qualcommax/patches-6.1/0110-arm64-dts-qcom-ipq8074-pass-QMP-PCI-PHY-PIPE-clocks-.patch
new file mode 100644
index 00000000000000..69d4126f7630cf
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0110-arm64-dts-qcom-ipq8074-pass-QMP-PCI-PHY-PIPE-clocks-.patch
@@ -0,0 +1,30 @@
+From 8a576b5bc9f0555d1d970cacabcaa24a3b74fa57 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Wed, 16 Nov 2022 22:15:01 +0100
+Subject: [PATCH] arm64: dts: qcom: ipq8074: pass QMP PCI PHY PIPE clocks to
+ GCC
+
+Pass QMP PCI PHY PIPE clocks to the GCC controller so it does not have to
+find them by matching globaly by name.
+
+If not passed directly, driver maintains backwards compatibility by then
+falling back to global lookup.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -396,8 +396,8 @@
+ 		gcc: gcc@1800000 {
+ 			compatible = "qcom,gcc-ipq8074";
+ 			reg = <0x01800000 0x80000>;
+-			clocks = <&xo>, <&sleep_clk>;
+-			clock-names = "xo", "sleep_clk";
++			clocks = <&xo>, <&sleep_clk>, <&pcie_phy0>, <&pcie_phy1>;
++			clock-names = "xo", "sleep_clk", "pcie0_pipe", "pcie1_pipe";
+ 			#clock-cells = <1>;
+ 			#power-domain-cells = <1>;
+ 			#reset-cells = <1>;
diff --git a/target/linux/qualcommax/patches-6.1/0111-arm64-dts-qcom-ipq8074-use-msi-parent-for-PCIe.patch b/target/linux/qualcommax/patches-6.1/0111-arm64-dts-qcom-ipq8074-use-msi-parent-for-PCIe.patch
new file mode 100644
index 00000000000000..9fefd8852ac17f
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0111-arm64-dts-qcom-ipq8074-use-msi-parent-for-PCIe.patch
@@ -0,0 +1,43 @@
+From fb1f6850be00d8dd8a54017be4c1336e224069ac Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Wed, 16 Nov 2022 22:26:25 +0100
+Subject: [PATCH] arm64: dts: qcom: ipq8074: use msi-parent for PCIe
+
+Instead of hardcoding the IRQ, simply use msi-parent instead.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -699,7 +699,7 @@
+ 			reg = <0x0b000000 0x1000>, <0x0b002000 0x1000>;
+ 			ranges = <0 0xb00a000 0xffd>;
+ 
+-			v2m@0 {
++			gic_v2m0: v2m@0 {
+ 				compatible = "arm,gic-v2m-frame";
+ 				msi-controller;
+ 				reg = <0x0 0xffd>;
+@@ -811,8 +811,7 @@
+ 			ranges = <0x81000000 0x0 0x00000000 0x10200000 0x0 0x10000>,   /* I/O */
+ 				 <0x82000000 0x0 0x10220000 0x10220000 0x0 0xfde0000>; /* MEM */
+ 
+-			interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "msi";
++			msi-parent = <&gic_v2m0>;
+ 			#interrupt-cells = <1>;
+ 			interrupt-map-mask = <0 0 0 0x7>;
+ 			interrupt-map = <0 0 0 1 &intc 0 142
+@@ -873,8 +872,7 @@
+ 			ranges = <0x81000000 0x0 0x00000000 0x20200000 0x0 0x10000>,   /* I/O */
+ 				 <0x82000000 0x0 0x20220000 0x20220000 0x0 0xfde0000>; /* MEM */
+ 
+-			interrupts = <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "msi";
++			msi-parent = <&gic_v2m0>;
+ 			#interrupt-cells = <1>;
+ 			interrupt-map-mask = <0 0 0 0x7>;
+ 			interrupt-map = <0 0 0 1 &intc 0 75
diff --git a/target/linux/qualcommax/patches-6.1/0112-remoteproc-qcom-Add-PRNG-proxy-clock.patch b/target/linux/qualcommax/patches-6.1/0112-remoteproc-qcom-Add-PRNG-proxy-clock.patch
new file mode 100644
index 00000000000000..0a984948b53f81
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0112-remoteproc-qcom-Add-PRNG-proxy-clock.patch
@@ -0,0 +1,155 @@
+From 125681433c8e526356947acf572fe8ca8ad32291 Mon Sep 17 00:00:00 2001
+From: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Date: Sat, 30 Jan 2021 10:50:05 +0530
+Subject: [PATCH] remoteproc: qcom: Add PRNG proxy clock
+
+PRNG clock is needed by the secure PIL, support for the same
+is added in subsequent patches.
+
+Signed-off-by: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Signed-off-by: Sricharan R <sricharan@codeaurora.org>
+Signed-off-by: Nikhil Prakash V <nprakash@codeaurora.org>
+---
+ drivers/remoteproc/qcom_q6v5_wcss.c | 65 +++++++++++++++++++++--------
+ 1 file changed, 47 insertions(+), 18 deletions(-)
+
+--- a/drivers/remoteproc/qcom_q6v5_wcss.c
++++ b/drivers/remoteproc/qcom_q6v5_wcss.c
+@@ -91,19 +91,6 @@ enum {
+ 	WCSS_QCS404,
+ };
+ 
+-struct wcss_data {
+-	const char *firmware_name;
+-	unsigned int crash_reason_smem;
+-	u32 version;
+-	bool aon_reset_required;
+-	bool wcss_q6_reset_required;
+-	const char *ssr_name;
+-	const char *sysmon_name;
+-	int ssctl_id;
+-	const struct rproc_ops *ops;
+-	bool requires_force_stop;
+-};
+-
+ struct q6v5_wcss {
+ 	struct device *dev;
+ 
+@@ -128,6 +115,7 @@ struct q6v5_wcss {
+ 	struct clk *qdsp6ss_xo_cbcr;
+ 	struct clk *qdsp6ss_core_gfmux;
+ 	struct clk *lcc_bcr_sleep;
++	struct clk *prng_clk;
+ 	struct regulator *cx_supply;
+ 	struct qcom_sysmon *sysmon;
+ 
+@@ -151,6 +139,21 @@ struct q6v5_wcss {
+ 	struct qcom_rproc_ssr ssr_subdev;
+ };
+ 
++struct wcss_data {
++	int (*init_clock)(struct q6v5_wcss *wcss);
++	int (*init_regulator)(struct q6v5_wcss *wcss);
++	const char *firmware_name;
++	unsigned int crash_reason_smem;
++	u32 version;
++	bool aon_reset_required;
++	bool wcss_q6_reset_required;
++	const char *ssr_name;
++	const char *sysmon_name;
++	int ssctl_id;
++	const struct rproc_ops *ops;
++	bool requires_force_stop;
++};
++
+ static int q6v5_wcss_reset(struct q6v5_wcss *wcss)
+ {
+ 	int ret;
+@@ -240,6 +243,12 @@ static int q6v5_wcss_start(struct rproc
+ 	struct q6v5_wcss *wcss = rproc->priv;
+ 	int ret;
+ 
++	ret = clk_prepare_enable(wcss->prng_clk);
++	if (ret) {
++		dev_err(wcss->dev, "prng clock enable failed\n");
++		return ret;
++	}
++
+ 	qcom_q6v5_prepare(&wcss->q6v5);
+ 
+ 	/* Release Q6 and WCSS reset */
+@@ -733,6 +742,7 @@ static int q6v5_wcss_stop(struct rproc *
+ 			return ret;
+ 	}
+ 
++	clk_disable_unprepare(wcss->prng_clk);
+ 	qcom_q6v5_unprepare(&wcss->q6v5);
+ 
+ 	return 0;
+@@ -900,7 +910,21 @@ static int q6v5_alloc_memory_region(stru
+ 	return 0;
+ }
+ 
+-static int q6v5_wcss_init_clock(struct q6v5_wcss *wcss)
++static int ipq8074_init_clock(struct q6v5_wcss *wcss)
++{
++	int ret;
++
++	wcss->prng_clk = devm_clk_get(wcss->dev, "prng");
++	if (IS_ERR(wcss->prng_clk)) {
++		ret = PTR_ERR(wcss->prng_clk);
++		if (ret != -EPROBE_DEFER)
++			dev_err(wcss->dev, "Failed to get prng clock\n");
++		return ret;
++	}
++	return 0;
++}
++
++static int qcs404_init_clock(struct q6v5_wcss *wcss)
+ {
+ 	int ret;
+ 
+@@ -990,7 +1014,7 @@ static int q6v5_wcss_init_clock(struct q
+ 	return 0;
+ }
+ 
+-static int q6v5_wcss_init_regulator(struct q6v5_wcss *wcss)
++static int qcs404_init_regulator(struct q6v5_wcss *wcss)
+ {
+ 	wcss->cx_supply = devm_regulator_get(wcss->dev, "cx");
+ 	if (IS_ERR(wcss->cx_supply))
+@@ -1034,12 +1058,14 @@ static int q6v5_wcss_probe(struct platfo
+ 	if (ret)
+ 		goto free_rproc;
+ 
+-	if (wcss->version == WCSS_QCS404) {
+-		ret = q6v5_wcss_init_clock(wcss);
++	if (desc->init_clock) {
++		ret = desc->init_clock(wcss);
+ 		if (ret)
+ 			goto free_rproc;
++	}
+ 
+-		ret = q6v5_wcss_init_regulator(wcss);
++	if (desc->init_regulator) {
++		ret = desc->init_regulator(wcss);
+ 		if (ret)
+ 			goto free_rproc;
+ 	}
+@@ -1087,6 +1113,7 @@ static int q6v5_wcss_remove(struct platf
+ }
+ 
+ static const struct wcss_data wcss_ipq8074_res_init = {
++	.init_clock = ipq8074_init_clock,
+ 	.firmware_name = "IPQ8074/q6_fw.mdt",
+ 	.crash_reason_smem = WCSS_CRASH_REASON,
+ 	.aon_reset_required = true,
+@@ -1096,6 +1123,8 @@ static const struct wcss_data wcss_ipq80
+ };
+ 
+ static const struct wcss_data wcss_qcs404_res_init = {
++	.init_clock = qcs404_init_clock,
++	.init_regulator = qcs404_init_regulator,
+ 	.crash_reason_smem = WCSS_CRASH_REASON,
+ 	.firmware_name = "wcnss.mdt",
+ 	.version = WCSS_QCS404,
diff --git a/target/linux/qualcommax/patches-6.1/0113-remoteproc-qcom-Add-secure-PIL-support.patch b/target/linux/qualcommax/patches-6.1/0113-remoteproc-qcom-Add-secure-PIL-support.patch
new file mode 100644
index 00000000000000..0328efc041bde6
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0113-remoteproc-qcom-Add-secure-PIL-support.patch
@@ -0,0 +1,143 @@
+From 7358d42dfbdfdb5d4f1d0d4c2e5c2bb4143a29b0 Mon Sep 17 00:00:00 2001
+From: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Date: Sat, 30 Jan 2021 10:50:06 +0530
+Subject: [PATCH] remoteproc: qcom: Add secure PIL support
+
+IPQ8074 uses secure PIL. Hence, adding the support for the same.
+
+Signed-off-by: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Signed-off-by: Sricharan R <sricharan@codeaurora.org>
+Signed-off-by: Nikhil Prakash V <nprakash@codeaurora.org>
+---
+ drivers/remoteproc/qcom_q6v5_wcss.c | 43 +++++++++++++++++++++++++++--
+ 1 file changed, 40 insertions(+), 3 deletions(-)
+
+--- a/drivers/remoteproc/qcom_q6v5_wcss.c
++++ b/drivers/remoteproc/qcom_q6v5_wcss.c
+@@ -18,6 +18,7 @@
+ #include <linux/regulator/consumer.h>
+ #include <linux/reset.h>
+ #include <linux/soc/qcom/mdt_loader.h>
++#include <linux/qcom_scm.h>
+ #include "qcom_common.h"
+ #include "qcom_pil_info.h"
+ #include "qcom_q6v5.h"
+@@ -86,6 +87,9 @@
+ #define TCSR_WCSS_CLK_ENABLE	0x14
+ 
+ #define MAX_HALT_REG		3
++
++#define WCNSS_PAS_ID		6
++
+ enum {
+ 	WCSS_IPQ8074,
+ 	WCSS_QCS404,
+@@ -134,6 +138,7 @@ struct q6v5_wcss {
+ 	unsigned int crash_reason_smem;
+ 	u32 version;
+ 	bool requires_force_stop;
++	bool need_mem_protection;
+ 
+ 	struct qcom_rproc_glink glink_subdev;
+ 	struct qcom_rproc_ssr ssr_subdev;
+@@ -152,6 +157,7 @@ struct wcss_data {
+ 	int ssctl_id;
+ 	const struct rproc_ops *ops;
+ 	bool requires_force_stop;
++	bool need_mem_protection;
+ };
+ 
+ static int q6v5_wcss_reset(struct q6v5_wcss *wcss)
+@@ -251,6 +257,15 @@ static int q6v5_wcss_start(struct rproc
+ 
+ 	qcom_q6v5_prepare(&wcss->q6v5);
+ 
++	if (wcss->need_mem_protection) {
++		ret = qcom_scm_pas_auth_and_reset(WCNSS_PAS_ID);
++		if (ret) {
++			dev_err(wcss->dev, "wcss_reset failed\n");
++			return ret;
++		}
++		goto wait_for_reset;
++	}
++
+ 	/* Release Q6 and WCSS reset */
+ 	ret = reset_control_deassert(wcss->wcss_reset);
+ 	if (ret) {
+@@ -285,6 +300,7 @@ static int q6v5_wcss_start(struct rproc
+ 	if (ret)
+ 		goto wcss_q6_reset;
+ 
++wait_for_reset:
+ 	ret = qcom_q6v5_wait_for_start(&wcss->q6v5, 5 * HZ);
+ 	if (ret == -ETIMEDOUT)
+ 		dev_err(wcss->dev, "start timed out\n");
+@@ -718,6 +734,15 @@ static int q6v5_wcss_stop(struct rproc *
+ 	struct q6v5_wcss *wcss = rproc->priv;
+ 	int ret;
+ 
++	if (wcss->need_mem_protection) {
++		ret = qcom_scm_pas_shutdown(WCNSS_PAS_ID);
++		if (ret) {
++			dev_err(wcss->dev, "not able to shutdown\n");
++			return ret;
++		}
++		goto pas_done;
++	}
++
+ 	/* WCSS powerdown */
+ 	if (wcss->requires_force_stop) {
+ 		ret = qcom_q6v5_request_stop(&wcss->q6v5, NULL);
+@@ -742,6 +767,7 @@ static int q6v5_wcss_stop(struct rproc *
+ 			return ret;
+ 	}
+ 
++pas_done:
+ 	clk_disable_unprepare(wcss->prng_clk);
+ 	qcom_q6v5_unprepare(&wcss->q6v5);
+ 
+@@ -765,9 +791,15 @@ static int q6v5_wcss_load(struct rproc *
+ 	struct q6v5_wcss *wcss = rproc->priv;
+ 	int ret;
+ 
+-	ret = qcom_mdt_load_no_init(wcss->dev, fw, rproc->firmware,
+-				    0, wcss->mem_region, wcss->mem_phys,
+-				    wcss->mem_size, &wcss->mem_reloc);
++	if (wcss->need_mem_protection)
++		ret = qcom_mdt_load(wcss->dev, fw, rproc->firmware,
++				    WCNSS_PAS_ID, wcss->mem_region,
++				    wcss->mem_phys, wcss->mem_size,
++				    &wcss->mem_reloc);
++	else
++		ret = qcom_mdt_load_no_init(wcss->dev, fw, rproc->firmware,
++					    0, wcss->mem_region, wcss->mem_phys,
++					    wcss->mem_size, &wcss->mem_reloc);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -1036,6 +1068,9 @@ static int q6v5_wcss_probe(struct platfo
+ 	if (!desc)
+ 		return -EINVAL;
+ 
++	if (desc->need_mem_protection && !qcom_scm_is_available())
++		return -EPROBE_DEFER;
++
+ 	rproc = rproc_alloc(&pdev->dev, pdev->name, desc->ops,
+ 			    desc->firmware_name, sizeof(*wcss));
+ 	if (!rproc) {
+@@ -1049,6 +1084,7 @@ static int q6v5_wcss_probe(struct platfo
+ 
+ 	wcss->version = desc->version;
+ 	wcss->requires_force_stop = desc->requires_force_stop;
++	wcss->need_mem_protection = desc->need_mem_protection;
+ 
+ 	ret = q6v5_wcss_init_mmio(wcss, pdev);
+ 	if (ret)
+@@ -1120,6 +1156,7 @@ static const struct wcss_data wcss_ipq80
+ 	.wcss_q6_reset_required = true,
+ 	.ops = &q6v5_wcss_ipq8074_ops,
+ 	.requires_force_stop = true,
++	.need_mem_protection = true,
+ };
+ 
+ static const struct wcss_data wcss_qcs404_res_init = {
diff --git a/target/linux/qualcommax/patches-6.1/0114-remoteproc-qcom-Add-support-for-split-q6-m3-wlan-fir.patch b/target/linux/qualcommax/patches-6.1/0114-remoteproc-qcom-Add-support-for-split-q6-m3-wlan-fir.patch
new file mode 100644
index 00000000000000..e5c9506c89ce2f
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0114-remoteproc-qcom-Add-support-for-split-q6-m3-wlan-fir.patch
@@ -0,0 +1,103 @@
+From b422c9d4f048b086ce83f44a7cfcddcce162897f Mon Sep 17 00:00:00 2001
+From: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Date: Sat, 30 Jan 2021 10:50:07 +0530
+Subject: [PATCH] remoteproc: qcom: Add support for split q6 + m3 wlan firmware
+
+IPQ8074 supports split firmware for q6 and m3 as well.
+So add support for loading the m3 firmware before q6.
+Now the drivers works fine for both split and unified
+firmwares.
+
+Signed-off-by: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Signed-off-by: Sricharan R <sricharan@codeaurora.org>
+Signed-off-by: Nikhil Prakash V <nprakash@codeaurora.org>
+---
+ drivers/remoteproc/qcom_q6v5_wcss.c | 33 +++++++++++++++++++++++++----
+ 1 file changed, 29 insertions(+), 4 deletions(-)
+
+--- a/drivers/remoteproc/qcom_q6v5_wcss.c
++++ b/drivers/remoteproc/qcom_q6v5_wcss.c
+@@ -139,6 +139,7 @@ struct q6v5_wcss {
+ 	u32 version;
+ 	bool requires_force_stop;
+ 	bool need_mem_protection;
++	const char *m3_firmware_name;
+ 
+ 	struct qcom_rproc_glink glink_subdev;
+ 	struct qcom_rproc_ssr ssr_subdev;
+@@ -147,7 +148,8 @@ struct q6v5_wcss {
+ struct wcss_data {
+ 	int (*init_clock)(struct q6v5_wcss *wcss);
+ 	int (*init_regulator)(struct q6v5_wcss *wcss);
+-	const char *firmware_name;
++	const char *q6_firmware_name;
++	const char *m3_firmware_name;
+ 	unsigned int crash_reason_smem;
+ 	u32 version;
+ 	bool aon_reset_required;
+@@ -789,8 +791,29 @@ static void *q6v5_wcss_da_to_va(struct r
+ static int q6v5_wcss_load(struct rproc *rproc, const struct firmware *fw)
+ {
+ 	struct q6v5_wcss *wcss = rproc->priv;
++	const struct firmware *m3_fw;
+ 	int ret;
+ 
++	if (wcss->m3_firmware_name) {
++		ret = request_firmware(&m3_fw, wcss->m3_firmware_name,
++				       wcss->dev);
++		if (ret)
++			goto skip_m3;
++
++		ret = qcom_mdt_load_no_init(wcss->dev, m3_fw,
++					    wcss->m3_firmware_name, 0,
++					    wcss->mem_region, wcss->mem_phys,
++					    wcss->mem_size, &wcss->mem_reloc);
++
++		release_firmware(m3_fw);
++
++		if (ret) {
++			dev_err(wcss->dev, "can't load m3_fw.bXX\n");
++			return ret;
++		}
++	}
++
++skip_m3:
+ 	if (wcss->need_mem_protection)
+ 		ret = qcom_mdt_load(wcss->dev, fw, rproc->firmware,
+ 				    WCNSS_PAS_ID, wcss->mem_region,
+@@ -1072,7 +1095,7 @@ static int q6v5_wcss_probe(struct platfo
+ 		return -EPROBE_DEFER;
+ 
+ 	rproc = rproc_alloc(&pdev->dev, pdev->name, desc->ops,
+-			    desc->firmware_name, sizeof(*wcss));
++			    desc->q6_firmware_name, sizeof(*wcss));
+ 	if (!rproc) {
+ 		dev_err(&pdev->dev, "failed to allocate rproc\n");
+ 		return -ENOMEM;
+@@ -1085,6 +1108,7 @@ static int q6v5_wcss_probe(struct platfo
+ 	wcss->version = desc->version;
+ 	wcss->requires_force_stop = desc->requires_force_stop;
+ 	wcss->need_mem_protection = desc->need_mem_protection;
++	wcss->m3_firmware_name = desc->m3_firmware_name;
+ 
+ 	ret = q6v5_wcss_init_mmio(wcss, pdev);
+ 	if (ret)
+@@ -1150,7 +1174,8 @@ static int q6v5_wcss_remove(struct platf
+ 
+ static const struct wcss_data wcss_ipq8074_res_init = {
+ 	.init_clock = ipq8074_init_clock,
+-	.firmware_name = "IPQ8074/q6_fw.mdt",
++	.q6_firmware_name = "IPQ8074/q6_fw.mdt",
++	.m3_firmware_name = "IPQ8074/m3_fw.mdt",
+ 	.crash_reason_smem = WCSS_CRASH_REASON,
+ 	.aon_reset_required = true,
+ 	.wcss_q6_reset_required = true,
+@@ -1163,7 +1188,7 @@ static const struct wcss_data wcss_qcs40
+ 	.init_clock = qcs404_init_clock,
+ 	.init_regulator = qcs404_init_regulator,
+ 	.crash_reason_smem = WCSS_CRASH_REASON,
+-	.firmware_name = "wcnss.mdt",
++	.q6_firmware_name = "wcnss.mdt",
+ 	.version = WCSS_QCS404,
+ 	.aon_reset_required = false,
+ 	.wcss_q6_reset_required = false,
diff --git a/target/linux/qualcommax/patches-6.1/0115-remoteproc-qcom-Add-ssr-subdevice-identifier.patch b/target/linux/qualcommax/patches-6.1/0115-remoteproc-qcom-Add-ssr-subdevice-identifier.patch
new file mode 100644
index 00000000000000..be63d46e8e4bac
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0115-remoteproc-qcom-Add-ssr-subdevice-identifier.patch
@@ -0,0 +1,24 @@
+From 3a8f67b4770c817b04794c9a02e3f88f85d86280 Mon Sep 17 00:00:00 2001
+From: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Date: Sat, 30 Jan 2021 10:50:08 +0530
+Subject: [PATCH] remoteproc: qcom: Add ssr subdevice identifier
+
+Add name for ssr subdevice on IPQ8074 SoC.
+
+Signed-off-by: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Signed-off-by: Sricharan R <sricharan@codeaurora.org>
+Signed-off-by: Nikhil Prakash V <nprakash@codeaurora.org>
+---
+ drivers/remoteproc/qcom_q6v5_wcss.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/remoteproc/qcom_q6v5_wcss.c
++++ b/drivers/remoteproc/qcom_q6v5_wcss.c
+@@ -1179,6 +1179,7 @@ static const struct wcss_data wcss_ipq80
+ 	.crash_reason_smem = WCSS_CRASH_REASON,
+ 	.aon_reset_required = true,
+ 	.wcss_q6_reset_required = true,
++	.ssr_name = "q6wcss",
+ 	.ops = &q6v5_wcss_ipq8074_ops,
+ 	.requires_force_stop = true,
+ 	.need_mem_protection = true,
diff --git a/target/linux/qualcommax/patches-6.1/0116-remoteproc-qcom-Update-regmap-offsets-for-halt-regis.patch b/target/linux/qualcommax/patches-6.1/0116-remoteproc-qcom-Update-regmap-offsets-for-halt-regis.patch
new file mode 100644
index 00000000000000..f0b717210fbe98
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0116-remoteproc-qcom-Update-regmap-offsets-for-halt-regis.patch
@@ -0,0 +1,79 @@
+From 8c73af6e8d78c66cfef0f551b00d375ec0b67ff3 Mon Sep 17 00:00:00 2001
+From: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Date: Sat, 30 Jan 2021 10:50:09 +0530
+Subject: [PATCH] remoteproc: qcom: Update regmap offsets for halt register
+
+Fixed issue in reading halt-regs parameter from device-tree.
+
+Signed-off-by: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Signed-off-by: Sricharan R <sricharan@codeaurora.org>
+---
+ drivers/remoteproc/qcom_q6v5_wcss.c | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+--- a/drivers/remoteproc/qcom_q6v5_wcss.c
++++ b/drivers/remoteproc/qcom_q6v5_wcss.c
+@@ -86,7 +86,7 @@
+ #define TCSR_WCSS_CLK_MASK	0x1F
+ #define TCSR_WCSS_CLK_ENABLE	0x14
+ 
+-#define MAX_HALT_REG		3
++#define MAX_HALT_REG		4
+ 
+ #define WCNSS_PAS_ID		6
+ 
+@@ -154,6 +154,7 @@ struct wcss_data {
+ 	u32 version;
+ 	bool aon_reset_required;
+ 	bool wcss_q6_reset_required;
++	bool bcr_reset_required;
+ 	const char *ssr_name;
+ 	const char *sysmon_name;
+ 	int ssctl_id;
+@@ -875,10 +876,13 @@ static int q6v5_wcss_init_reset(struct q
+ 		}
+ 	}
+ 
+-	wcss->wcss_q6_bcr_reset = devm_reset_control_get_exclusive(dev, "wcss_q6_bcr_reset");
+-	if (IS_ERR(wcss->wcss_q6_bcr_reset)) {
+-		dev_err(wcss->dev, "unable to acquire wcss_q6_bcr_reset\n");
+-		return PTR_ERR(wcss->wcss_q6_bcr_reset);
++	if (desc->bcr_reset_required) {
++		wcss->wcss_q6_bcr_reset = devm_reset_control_get_exclusive(dev,
++									   "wcss_q6_bcr_reset");
++		if (IS_ERR(wcss->wcss_q6_bcr_reset)) {
++			dev_err(wcss->dev, "unable to acquire wcss_q6_bcr_reset\n");
++			return PTR_ERR(wcss->wcss_q6_bcr_reset);
++		}
+ 	}
+ 
+ 	return 0;
+@@ -929,9 +933,9 @@ static int q6v5_wcss_init_mmio(struct q6
+ 		return -EINVAL;
+ 	}
+ 
+-	wcss->halt_q6 = halt_reg[0];
+-	wcss->halt_wcss = halt_reg[1];
+-	wcss->halt_nc = halt_reg[2];
++	wcss->halt_q6 = halt_reg[1];
++	wcss->halt_wcss = halt_reg[2];
++	wcss->halt_nc = halt_reg[3];
+ 
+ 	return 0;
+ }
+@@ -1179,6 +1183,7 @@ static const struct wcss_data wcss_ipq80
+ 	.crash_reason_smem = WCSS_CRASH_REASON,
+ 	.aon_reset_required = true,
+ 	.wcss_q6_reset_required = true,
++	.bcr_reset_required = false,
+ 	.ssr_name = "q6wcss",
+ 	.ops = &q6v5_wcss_ipq8074_ops,
+ 	.requires_force_stop = true,
+@@ -1193,6 +1198,7 @@ static const struct wcss_data wcss_qcs40
+ 	.version = WCSS_QCS404,
+ 	.aon_reset_required = false,
+ 	.wcss_q6_reset_required = false,
++	.bcr_reset_required = true,
+ 	.ssr_name = "mpss",
+ 	.sysmon_name = "wcnss",
+ 	.ssctl_id = 0x12,
diff --git a/target/linux/qualcommax/patches-6.1/0117-dt-bindings-clock-qcom-Add-reset-for-WCSSAON.patch b/target/linux/qualcommax/patches-6.1/0117-dt-bindings-clock-qcom-Add-reset-for-WCSSAON.patch
new file mode 100644
index 00000000000000..fe0e0f9e0bf730
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0117-dt-bindings-clock-qcom-Add-reset-for-WCSSAON.patch
@@ -0,0 +1,26 @@
+From ff7c6533ed8c4de58ed6c8aab03ea59c03eb4f31 Mon Sep 17 00:00:00 2001
+From: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Date: Sat, 30 Jan 2021 10:50:10 +0530
+Subject: [PATCH] dt-bindings: clock: qcom: Add reset for WCSSAON
+
+Add binding for WCSSAON reset required for Q6v5 reset on IPQ8074 SoC.
+
+Signed-off-by: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Signed-off-by: Sricharan R <sricharan@codeaurora.org>
+Signed-off-by: Nikhil Prakash V <nprakash@codeaurora.org>
+Acked-by: Rob Herring <robh@kernel.org>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+---
+ include/dt-bindings/clock/qcom,gcc-ipq8074.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/dt-bindings/clock/qcom,gcc-ipq8074.h
++++ b/include/dt-bindings/clock/qcom,gcc-ipq8074.h
+@@ -381,6 +381,7 @@
+ #define GCC_NSSPORT4_RESET			143
+ #define GCC_NSSPORT5_RESET			144
+ #define GCC_NSSPORT6_RESET			145
++#define GCC_WCSSAON_RESET			146
+ 
+ #define USB0_GDSC				0
+ #define USB1_GDSC				1
diff --git a/target/linux/qualcommax/patches-6.1/0118-clk-qcom-Add-WCSSAON-reset.patch b/target/linux/qualcommax/patches-6.1/0118-clk-qcom-Add-WCSSAON-reset.patch
new file mode 100644
index 00000000000000..791531775ef0f8
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0118-clk-qcom-Add-WCSSAON-reset.patch
@@ -0,0 +1,25 @@
+From 43d9788f546d24df22d8ba3fcc2497d7ccc198f3 Mon Sep 17 00:00:00 2001
+From: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Date: Sat, 30 Jan 2021 10:50:11 +0530
+Subject: [PATCH] clk: qcom: Add WCSSAON reset
+
+Add WCSSAON reset required for Q6v5 on IPQ8074 SoC.
+
+Signed-off-by: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Signed-off-by: Sricharan R <sricharan@codeaurora.org>
+Signed-off-by: Nikhil Prakash V <nprakash@codeaurora.org>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq8074.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/clk/qcom/gcc-ipq8074.c
++++ b/drivers/clk/qcom/gcc-ipq8074.c
+@@ -4717,6 +4717,7 @@ static const struct qcom_reset_map gcc_i
+ 	[GCC_NSSPORT4_RESET] = { .reg = 0x68014, .bitmask = BIT(27) | GENMASK(9, 8) },
+ 	[GCC_NSSPORT5_RESET] = { .reg = 0x68014, .bitmask = BIT(28) | GENMASK(11, 10) },
+ 	[GCC_NSSPORT6_RESET] = { .reg = 0x68014, .bitmask = BIT(29) | GENMASK(13, 12) },
++	[GCC_WCSSAON_RESET] = { 0x59010, 0 },
+ };
+ 
+ static struct gdsc *gcc_ipq8074_gdscs[] = {
diff --git a/target/linux/qualcommax/patches-6.1/0119-remoteproc-wcss-disable-auto-boot-for-IPQ8074.patch b/target/linux/qualcommax/patches-6.1/0119-remoteproc-wcss-disable-auto-boot-for-IPQ8074.patch
new file mode 100644
index 00000000000000..8674522a112925
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0119-remoteproc-wcss-disable-auto-boot-for-IPQ8074.patch
@@ -0,0 +1,48 @@
+From 406a332fd1bcc4e18d73cce390f56272fe9111d7 Mon Sep 17 00:00:00 2001
+From: Sivaprakash Murugesan <sivaprak@codeaurora.org>
+Date: Fri, 17 Apr 2020 16:37:10 +0530
+Subject: [PATCH] remoteproc: wcss: disable auto boot for IPQ8074
+
+There is no need for remoteproc to boot automatically, ath11k will trigger
+booting when its probing.
+
+Signed-off-by: Sivaprakash Murugesan <sivaprak@codeaurora.org>
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/remoteproc/qcom_q6v5_wcss.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/remoteproc/qcom_q6v5_wcss.c
++++ b/drivers/remoteproc/qcom_q6v5_wcss.c
+@@ -161,6 +161,7 @@ struct wcss_data {
+ 	const struct rproc_ops *ops;
+ 	bool requires_force_stop;
+ 	bool need_mem_protection;
++	bool need_auto_boot;
+ };
+ 
+ static int q6v5_wcss_reset(struct q6v5_wcss *wcss)
+@@ -1150,6 +1151,7 @@ static int q6v5_wcss_probe(struct platfo
+ 						      desc->sysmon_name,
+ 						      desc->ssctl_id);
+ 
++	rproc->auto_boot = desc->need_auto_boot;
+ 	ret = rproc_add(rproc);
+ 	if (ret)
+ 		goto free_rproc;
+@@ -1188,6 +1190,7 @@ static const struct wcss_data wcss_ipq80
+ 	.ops = &q6v5_wcss_ipq8074_ops,
+ 	.requires_force_stop = true,
+ 	.need_mem_protection = true,
++	.need_auto_boot = false,
+ };
+ 
+ static const struct wcss_data wcss_qcs404_res_init = {
+@@ -1204,6 +1207,7 @@ static const struct wcss_data wcss_qcs40
+ 	.ssctl_id = 0x12,
+ 	.ops = &q6v5_wcss_qcs404_ops,
+ 	.requires_force_stop = false,
++	.need_auto_boot = true,
+ };
+ 
+ static const struct of_device_id q6v5_wcss_of_match[] = {
diff --git a/target/linux/qualcommax/patches-6.1/0120-arm64-dts-qcom-Enable-Q6v5-WCSS-for-ipq8074-SoC.patch b/target/linux/qualcommax/patches-6.1/0120-arm64-dts-qcom-Enable-Q6v5-WCSS-for-ipq8074-SoC.patch
new file mode 100644
index 00000000000000..e37ba37e96049d
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0120-arm64-dts-qcom-Enable-Q6v5-WCSS-for-ipq8074-SoC.patch
@@ -0,0 +1,120 @@
+From 7388400b8bd42f71d040dbf2fdbdcb834fcc0ede Mon Sep 17 00:00:00 2001
+From: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Date: Sat, 30 Jan 2021 10:50:13 +0530
+Subject: [PATCH] arm64: dts: qcom: Enable Q6v5 WCSS for ipq8074 SoC
+
+Enable remoteproc WCSS PIL driver with glink and ssr subdevices.
+Also enables smp2p and mailboxes required for IPC.
+
+Signed-off-by: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Signed-off-by: Sricharan R <sricharan@codeaurora.org>
+Signed-off-by: Nikhil Prakash V <nprakash@codeaurora.org>
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 81 +++++++++++++++++++++++++++
+ 1 file changed, 81 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -140,6 +140,32 @@
+ 		};
+ 	};
+ 
++	wcss: smp2p-wcss {
++		compatible = "qcom,smp2p";
++		qcom,smem = <435>, <428>;
++
++		interrupt-parent = <&intc>;
++		interrupts = <0 322 1>;
++
++		mboxes = <&apcs_glb 9>;
++
++		qcom,local-pid = <0>;
++		qcom,remote-pid = <1>;
++
++		wcss_smp2p_out: master-kernel {
++			qcom,entry-name = "master-kernel";
++			qcom,smp2p-feature-ssr-ack;
++			#qcom,smem-state-cells = <1>;
++		};
++
++		wcss_smp2p_in: slave-kernel {
++			qcom,entry-name = "slave-kernel";
++
++			interrupt-controller;
++			#interrupt-cells = <2>;
++		};
++	};
++
+ 	soc: soc {
+ 		#address-cells = <0x1>;
+ 		#size-cells = <0x1>;
+@@ -409,6 +435,11 @@
+ 			#hwlock-cells = <1>;
+ 		};
+ 
++		tcsr_q6: syscon@1945000 {
++			compatible = "syscon";
++			reg = <0x01945000 0xe000>;
++		};
++
+ 		spmi_bus: spmi@200f000 {
+ 			compatible = "qcom,spmi-pmic-arb";
+ 			reg = <0x0200f000 0x001000>,
+@@ -913,6 +944,56 @@
+ 				      "axi_s_sticky";
+ 			status = "disabled";
+ 		};
++
++		q6v5_wcss: q6v5_wcss@cd00000 {
++			compatible = "qcom,ipq8074-wcss-pil";
++			reg = <0x0cd00000 0x4040>,
++			      <0x004ab000 0x20>;
++			reg-names = "qdsp6",
++				    "rmb";
++			qca,auto-restart;
++			qca,extended-intc;
++			interrupts-extended = <&intc 0 325 1>,
++					      <&wcss_smp2p_in 0 0>,
++					      <&wcss_smp2p_in 1 0>,
++					      <&wcss_smp2p_in 2 0>,
++					      <&wcss_smp2p_in 3 0>;
++			interrupt-names = "wdog",
++					  "fatal",
++					  "ready",
++					  "handover",
++					  "stop-ack";
++
++			resets = <&gcc GCC_WCSSAON_RESET>,
++				 <&gcc GCC_WCSS_BCR>,
++				 <&gcc GCC_WCSS_Q6_BCR>;
++
++			reset-names = "wcss_aon_reset",
++				      "wcss_reset",
++				      "wcss_q6_reset";
++
++			clocks = <&gcc GCC_PRNG_AHB_CLK>;
++			clock-names = "prng";
++
++			qcom,halt-regs = <&tcsr_q6 0xa000 0xd000 0x0>;
++
++			qcom,smem-states = <&wcss_smp2p_out 0>,
++					   <&wcss_smp2p_out 1>;
++			qcom,smem-state-names = "shutdown",
++						"stop";
++
++			memory-region = <&q6_region>;
++
++			glink-edge {
++				interrupts = <GIC_SPI 321 IRQ_TYPE_EDGE_RISING>;
++				qcom,remote-pid = <1>;
++				mboxes = <&apcs_glb 8>;
++
++				rpm_requests {
++					qcom,glink-channels = "IPCRTR";
++				};
++			};
++		};
+ 	};
+ 
+ 	timer {
diff --git a/target/linux/qualcommax/patches-6.1/0121-arm64-dts-ipq8074-Add-WLAN-node.patch b/target/linux/qualcommax/patches-6.1/0121-arm64-dts-ipq8074-Add-WLAN-node.patch
new file mode 100644
index 00000000000000..bd5410c934adcf
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0121-arm64-dts-ipq8074-Add-WLAN-node.patch
@@ -0,0 +1,135 @@
+From a67d1901741c162645eda0dbdc3a2c0c2aff5cf4 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Tue, 21 Dec 2021 14:49:36 +0100
+Subject: [PATCH] arm64: dts: ipq8074: Add WLAN node
+
+IPQ8074 has a AHB based Q6v5 802.11ax radios that are supported
+by the ath11k.
+
+Add the required DT node to enable the built-in radios.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 111 ++++++++++++++++++++++++++
+ 1 file changed, 111 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -994,6 +994,117 @@
+ 				};
+ 			};
+ 		};
++
++		wifi: wifi@c0000000 {
++			compatible = "qcom,ipq8074-wifi";
++			reg = <0xc000000 0x2000000>;
++
++			interrupts = <GIC_SPI 320 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 319 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 318 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 316 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 315 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 314 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 311 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 310 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 411 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 410 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 40 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 39 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 302 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 301 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 37 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 36 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 296 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 295 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 294 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 293 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 292 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 291 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 290 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 289 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 288 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 239 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 236 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 235 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 234 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 233 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 232 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 231 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 230 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 229 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 228 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 224 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 223 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 203 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 183 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 180 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 179 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 178 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 177 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 176 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 163 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 162 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 160 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 159 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 158 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 157 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 156 IRQ_TYPE_EDGE_RISING>;
++
++			interrupt-names = "misc-pulse1",
++					  "misc-latch",
++					  "sw-exception",
++					  "ce0",
++					  "ce1",
++					  "ce2",
++					  "ce3",
++					  "ce4",
++					  "ce5",
++					  "ce6",
++					  "ce7",
++					  "ce8",
++					  "ce9",
++					  "ce10",
++					  "ce11",
++					  "host2wbm-desc-feed",
++					  "host2reo-re-injection",
++					  "host2reo-command",
++					  "host2rxdma-monitor-ring3",
++					  "host2rxdma-monitor-ring2",
++					  "host2rxdma-monitor-ring1",
++					  "reo2ost-exception",
++					  "wbm2host-rx-release",
++					  "reo2host-status",
++					  "reo2host-destination-ring4",
++					  "reo2host-destination-ring3",
++					  "reo2host-destination-ring2",
++					  "reo2host-destination-ring1",
++					  "rxdma2host-monitor-destination-mac3",
++					  "rxdma2host-monitor-destination-mac2",
++					  "rxdma2host-monitor-destination-mac1",
++					  "ppdu-end-interrupts-mac3",
++					  "ppdu-end-interrupts-mac2",
++					  "ppdu-end-interrupts-mac1",
++					  "rxdma2host-monitor-status-ring-mac3",
++					  "rxdma2host-monitor-status-ring-mac2",
++					  "rxdma2host-monitor-status-ring-mac1",
++					  "host2rxdma-host-buf-ring-mac3",
++					  "host2rxdma-host-buf-ring-mac2",
++					  "host2rxdma-host-buf-ring-mac1",
++					  "rxdma2host-destination-ring-mac3",
++					  "rxdma2host-destination-ring-mac2",
++					  "rxdma2host-destination-ring-mac1",
++					  "host2tcl-input-ring4",
++					  "host2tcl-input-ring3",
++					  "host2tcl-input-ring2",
++					  "host2tcl-input-ring1",
++					  "wbm2host-tx-completions-ring3",
++					  "wbm2host-tx-completions-ring2",
++					  "wbm2host-tx-completions-ring1",
++					  "tcl2host-status-ring";
++			qcom,rproc = <&q6v5_wcss>;
++			status = "disabled";
++		};
+ 	};
+ 
+ 	timer {
diff --git a/target/linux/qualcommax/patches-6.1/0122-arm64-dts-ipq8074-add-CPU-clock.patch b/target/linux/qualcommax/patches-6.1/0122-arm64-dts-ipq8074-add-CPU-clock.patch
new file mode 100644
index 00000000000000..a3c5f344ab3aac
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0122-arm64-dts-ipq8074-add-CPU-clock.patch
@@ -0,0 +1,59 @@
+From cb3ef99c1553565e1dc0301ccd5c1c0fa2d15c15 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 31 Dec 2021 17:56:14 +0100
+Subject: [PATCH] arm64: dts: ipq8074: add CPU clock
+
+Now that CPU clock is exposed and can be controlled, add the necessary
+properties to the CPU nodes.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -5,6 +5,7 @@
+ 
+ #include <dt-bindings/interrupt-controller/arm-gic.h>
+ #include <dt-bindings/clock/qcom,gcc-ipq8074.h>
++#include <dt-bindings/clock/qcom,apss-ipq.h>
+ 
+ / {
+ 	#address-cells = <2>;
+@@ -38,6 +39,8 @@
+ 			reg = <0x0>;
+ 			next-level-cache = <&L2_0>;
+ 			enable-method = "psci";
++			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
++			clock-names = "cpu";
+ 		};
+ 
+ 		CPU1: cpu@1 {
+@@ -46,6 +49,8 @@
+ 			enable-method = "psci";
+ 			reg = <0x1>;
+ 			next-level-cache = <&L2_0>;
++			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
++			clock-names = "cpu";
+ 		};
+ 
+ 		CPU2: cpu@2 {
+@@ -54,6 +59,8 @@
+ 			enable-method = "psci";
+ 			reg = <0x2>;
+ 			next-level-cache = <&L2_0>;
++			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
++			clock-names = "cpu";
+ 		};
+ 
+ 		CPU3: cpu@3 {
+@@ -62,6 +69,8 @@
+ 			enable-method = "psci";
+ 			reg = <0x3>;
+ 			next-level-cache = <&L2_0>;
++			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
++			clock-names = "cpu";
+ 		};
+ 
+ 		L2_0: l2-cache {
diff --git a/target/linux/qualcommax/patches-6.1/0123-arm64-dts-ipq8074-add-cooling-cells-to-CPU-nodes.patch b/target/linux/qualcommax/patches-6.1/0123-arm64-dts-ipq8074-add-cooling-cells-to-CPU-nodes.patch
new file mode 100644
index 00000000000000..3520b381345dc7
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0123-arm64-dts-ipq8074-add-cooling-cells-to-CPU-nodes.patch
@@ -0,0 +1,48 @@
+From 347ca56e86c99021fad059b9a8ef101245b8507e Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 31 Dec 2021 20:38:06 +0100
+Subject: [PATCH] arm64: dts: ipq8074: add cooling cells to CPU nodes
+
+Since there is CPU Freq support as well as thermal sensor support
+now for the IPQ8074, add cooling cells to CPU nodes so that they can
+be used as cooling devices using CPU Freq.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -41,6 +41,7 @@
+ 			enable-method = "psci";
+ 			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
+ 			clock-names = "cpu";
++			#cooling-cells = <2>;
+ 		};
+ 
+ 		CPU1: cpu@1 {
+@@ -51,6 +52,7 @@
+ 			next-level-cache = <&L2_0>;
+ 			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
+ 			clock-names = "cpu";
++			#cooling-cells = <2>;
+ 		};
+ 
+ 		CPU2: cpu@2 {
+@@ -61,6 +63,7 @@
+ 			next-level-cache = <&L2_0>;
+ 			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
+ 			clock-names = "cpu";
++			#cooling-cells = <2>;
+ 		};
+ 
+ 		CPU3: cpu@3 {
+@@ -71,6 +74,7 @@
+ 			next-level-cache = <&L2_0>;
+ 			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
+ 			clock-names = "cpu";
++			#cooling-cells = <2>;
+ 		};
+ 
+ 		L2_0: l2-cache {
diff --git a/target/linux/qualcommax/patches-6.1/0128-cpufreq-qcom-nvmem-add-support-for-IPQ8074.patch b/target/linux/qualcommax/patches-6.1/0128-cpufreq-qcom-nvmem-add-support-for-IPQ8074.patch
new file mode 100644
index 00000000000000..09abbfa2e59d69
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0128-cpufreq-qcom-nvmem-add-support-for-IPQ8074.patch
@@ -0,0 +1,108 @@
+From 11592aa862e67f4477dee7e94d5c8244d893de1b Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Sat, 31 Dec 2022 13:03:41 +0100
+Subject: [PATCH] cpufreq: qcom-nvmem: add support for IPQ8074
+
+IPQ8074 comes in 2 families:
+* IPQ8070A/IPQ8071A (Acorn) up to 1.4GHz
+* IPQ8072A/IPQ8074A/IPQ8076A/IPQ8078A (Hawkeye) up to 2.2GHz
+
+So, in order to be able to share one OPP table lets add support for IPQ8074
+family based of SMEM SoC ID-s as speedbin fuse is always 0 on IPQ8074.
+
+IPQ8074 compatible is blacklisted from DT platdev as the cpufreq device
+will get created by NVMEM CPUFreq driver.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+Changes in v2:
+* Print an error if SMEM ID is not part of the IPQ8074 family
+and restrict the speed to Acorn variant (1.4GHz)
+---
+ drivers/cpufreq/cpufreq-dt-platdev.c |  1 +
+ drivers/cpufreq/qcom-cpufreq-nvmem.c | 43 ++++++++++++++++++++++++++++
+ 2 files changed, 44 insertions(+)
+
+--- a/drivers/cpufreq/cpufreq-dt-platdev.c
++++ b/drivers/cpufreq/cpufreq-dt-platdev.c
+@@ -164,6 +164,7 @@ static const struct of_device_id blockli
+ 	{ .compatible = "ti,omap3", },
+ 
+ 	{ .compatible = "qcom,ipq8064", },
++	{ .compatible = "qcom,ipq8074", },
+ 	{ .compatible = "qcom,apq8064", },
+ 	{ .compatible = "qcom,msm8974", },
+ 	{ .compatible = "qcom,msm8960", },
+--- a/drivers/cpufreq/qcom-cpufreq-nvmem.c
++++ b/drivers/cpufreq/qcom-cpufreq-nvmem.c
+@@ -31,6 +31,9 @@
+ 
+ #include <dt-bindings/arm/qcom,ids.h>
+ 
++#define IPQ8074_HAWKEYE_VERSION		BIT(0)
++#define IPQ8074_ACORN_VERSION		BIT(1)
++
+ struct qcom_cpufreq_drv;
+ 
+ struct qcom_cpufreq_match_data {
+@@ -204,6 +207,41 @@ len_error:
+ 	return ret;
+ }
+ 
++static int qcom_cpufreq_ipq8074_name_version(struct device *cpu_dev,
++					     struct nvmem_cell *speedbin_nvmem,
++					     char **pvs_name,
++					     struct qcom_cpufreq_drv *drv)
++{
++	u32 msm_id;
++	int ret;
++	*pvs_name = NULL;
++
++	ret = qcom_smem_get_soc_id(&msm_id);
++	if (ret)
++		return ret;
++
++	switch (msm_id) {
++	case QCOM_ID_IPQ8070A:
++	case QCOM_ID_IPQ8071A:
++		drv->versions = IPQ8074_ACORN_VERSION;
++		break;
++	case QCOM_ID_IPQ8072A:
++	case QCOM_ID_IPQ8074A:
++	case QCOM_ID_IPQ8076A:
++	case QCOM_ID_IPQ8078A:
++		drv->versions = IPQ8074_HAWKEYE_VERSION;
++		break;
++	default:
++		dev_err(cpu_dev,
++			"SoC ID %u is not part of IPQ8074 family, limiting to 1.4GHz!\n",
++			msm_id);
++		drv->versions = IPQ8074_ACORN_VERSION;
++		break;
++	}
++
++	return 0;
++}
++
+ static const struct qcom_cpufreq_match_data match_data_kryo = {
+ 	.get_version = qcom_cpufreq_kryo_name_version,
+ };
+@@ -218,6 +256,10 @@ static const struct qcom_cpufreq_match_d
+ 	.genpd_names = qcs404_genpd_names,
+ };
+ 
++static const struct qcom_cpufreq_match_data match_data_ipq8074 = {
++	.get_version = qcom_cpufreq_ipq8074_name_version,
++};
++
+ static int qcom_cpufreq_probe(struct platform_device *pdev)
+ {
+ 	struct qcom_cpufreq_drv *drv;
+@@ -363,6 +405,7 @@ static const struct of_device_id qcom_cp
+ 	{ .compatible = "qcom,msm8996", .data = &match_data_kryo },
+ 	{ .compatible = "qcom,qcs404", .data = &match_data_qcs404 },
+ 	{ .compatible = "qcom,ipq8064", .data = &match_data_krait },
++	{ .compatible = "qcom,ipq8074", .data = &match_data_ipq8074 },
+ 	{ .compatible = "qcom,apq8064", .data = &match_data_krait },
+ 	{ .compatible = "qcom,msm8974", .data = &match_data_krait },
+ 	{ .compatible = "qcom,msm8960", .data = &match_data_krait },
diff --git a/target/linux/qualcommax/patches-6.1/0129-arm64-dts-qcom-ipq8074-add-QFPROM-fuses.patch b/target/linux/qualcommax/patches-6.1/0129-arm64-dts-qcom-ipq8074-add-QFPROM-fuses.patch
new file mode 100644
index 00000000000000..3a6f4e9c874e6c
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0129-arm64-dts-qcom-ipq8074-add-QFPROM-fuses.patch
@@ -0,0 +1,128 @@
+From 04d2fc6a551bbd972a6428059b45ce79cb9de9d7 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 6 May 2022 22:38:24 +0200
+Subject: [PATCH] arm64: dts: qcom: ipq8074: add QFPROM fuses
+
+Add the QFPROM node and CPR fuses.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 107 ++++++++++++++++++++++++++
+ 1 file changed, 107 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -340,6 +340,113 @@
+ 			status = "disabled";
+ 		};
+ 
++		qfprom: efuse@a4000 {
++			compatible = "qcom,ipq8074-qfprom", "qcom,qfprom";
++			reg = <0x000a4000 0x1000>;
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			cpr_efuse_speedbin: speedbin@125 {
++				reg = <0x125 0x1>;
++				bits = <0 3>;
++			};
++
++			cpr_efuse_boost_cfg: boost_cfg@125 {
++				reg = <0x125 0x1>;
++				bits = <3 3>;
++			};
++
++			cpr_efuse_misc_volt_adj: misc_volt_adj@125 {
++				reg = <0x125 0x1>;
++				bits = <3 3>;
++			};
++
++			cpr_efuse_boost_volt: boost_volt@126 {
++				reg = <0x126 0x1>;
++				bits = <6 1>;
++			};
++
++			cpr_efuse_revision: revision@23e {
++				reg = <0x23e 0x1>;
++				bits = <5 3>;
++			};
++
++			cpr_efuse_ro_sel0: rosel0@249 {
++				reg = <0x249 0x1>;
++				bits = <0 4>;
++			};
++
++			cpr_efuse_ro_sel1: rosel1@248 {
++				reg = <0x248 0x1>;
++				bits = <4 4>;
++			};
++
++			cpr_efuse_ro_sel2: rosel2@248 {
++				reg = <0x248 0x2>;
++				bits = <0 4>;
++			};
++
++			cpr_efuse_ro_sel3: rosel3@249 {
++				reg = <0x249 0x1>;
++				bits = <4 4>;
++			};
++
++			cpr_efuse_init_voltage0: ivoltage0@23a {
++				reg = <0x23a 0x1>;
++				bits = <2 6>;
++			};
++
++			cpr_efuse_init_voltage1: ivoltage1@239 {
++				reg = <0x239 0x2>;
++				bits = <4 6>;
++			};
++
++			cpr_efuse_init_voltage2: ivoltage2@238 {
++				reg = <0x238 0x2>;
++				bits = <6 6>;
++			};
++
++			cpr_efuse_init_voltage3: ivoltage3@238 {
++				reg = <0x238 0x1>;
++				bits = <0 6>;
++			};
++
++			cpr_efuse_quot0: quot0@244 {
++				reg = <0x244 0x2>;
++				bits = <0 12>;
++			};
++
++			cpr_efuse_quot1: quot1@242 {
++				reg = <0x242 0x2>;
++				bits = <4 12>;
++			};
++
++			cpr_efuse_quot2: quot2@241 {
++				reg = <0x241 0x2>;
++				bits = <0 12>;
++			};
++
++			cpr_efuse_quot3: quot3@245 {
++				reg = <0x245 0x2>;
++				bits = <4 12>;
++			};
++
++			cpr_efuse_quot0_offset: quot0_offset@23d {
++				reg = <0x23d 0x2>;
++				bits = <6 7>;
++			};
++
++			cpr_efuse_quot1_offset: quot1_offset@23c {
++				reg = <0x23c 0x2>;
++				bits = <7 7>;
++			};
++
++			cpr_efuse_quot2_offset: quot2_offset@23c {
++				reg = <0x23c 0x1>;
++				bits = <0 7>;
++			};
++		};
++
+ 		prng: rng@e3000 {
+ 			compatible = "qcom,prng-ee";
+ 			reg = <0x000e3000 0x1000>;
diff --git a/target/linux/qualcommax/patches-6.1/0130-arm64-dts-qcom-ipq8074-add-CPU-OPP-table.patch b/target/linux/qualcommax/patches-6.1/0130-arm64-dts-qcom-ipq8074-add-CPU-OPP-table.patch
new file mode 100644
index 00000000000000..9c1e7b9d29c994
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0130-arm64-dts-qcom-ipq8074-add-CPU-OPP-table.patch
@@ -0,0 +1,102 @@
+From a20c4e8738a00087aa5d53fe5148ed484e23d229 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Sat, 31 Dec 2022 13:56:26 +0100
+Subject: [PATCH] arm64: dts: qcom: ipq8074: add CPU OPP table
+
+Now that there is NVMEM CPUFreq support for IPQ8074, we can add the OPP
+table for SoC.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 52 +++++++++++++++++++++++++++
+ 1 file changed, 52 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -42,6 +42,7 @@
+ 			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
+ 			clock-names = "cpu";
+ 			#cooling-cells = <2>;
++			operating-points-v2 = <&cpu_opp_table>;
+ 		};
+ 
+ 		CPU1: cpu@1 {
+@@ -53,6 +54,7 @@
+ 			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
+ 			clock-names = "cpu";
+ 			#cooling-cells = <2>;
++			operating-points-v2 = <&cpu_opp_table>;
+ 		};
+ 
+ 		CPU2: cpu@2 {
+@@ -64,6 +66,7 @@
+ 			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
+ 			clock-names = "cpu";
+ 			#cooling-cells = <2>;
++			operating-points-v2 = <&cpu_opp_table>;
+ 		};
+ 
+ 		CPU3: cpu@3 {
+@@ -75,6 +78,7 @@
+ 			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
+ 			clock-names = "cpu";
+ 			#cooling-cells = <2>;
++			operating-points-v2 = <&cpu_opp_table>;
+ 		};
+ 
+ 		L2_0: l2-cache {
+@@ -83,6 +87,54 @@
+ 		};
+ 	};
+ 
++	cpu_opp_table: opp-table {
++		compatible = "operating-points-v2-kryo-cpu";
++		nvmem-cells = <&cpr_efuse_speedbin>;
++		opp-shared;
++
++		opp-1017600000 {
++			opp-hz = /bits/ 64 <1017600000>;
++			opp-microvolt = <1>;
++			opp-supported-hw = <0xf>;
++			clock-latency-ns = <200000>;
++		};
++
++		opp-1382400000 {
++			opp-hz = /bits/ 64 <1382400000>;
++			opp-microvolt = <2>;
++			opp-supported-hw = <0xf>;
++			clock-latency-ns = <200000>;
++		};
++
++		opp-1651200000 {
++			opp-hz = /bits/ 64 <1651200000>;
++			opp-microvolt = <3>;
++			opp-supported-hw = <0x1>;
++			clock-latency-ns = <200000>;
++		};
++
++		opp-1843200000 {
++			opp-hz = /bits/ 64 <1843200000>;
++			opp-microvolt = <4>;
++			opp-supported-hw = <0x1>;
++			clock-latency-ns = <200000>;
++		};
++
++		opp-1920000000 {
++			opp-hz = /bits/ 64 <1920000000>;
++			opp-microvolt = <5>;
++			opp-supported-hw = <0x1>;
++			clock-latency-ns = <200000>;
++		};
++
++		opp-2208000000 {
++			opp-hz = /bits/ 64 <2208000000>;
++			opp-microvolt = <6>;
++			opp-supported-hw = <0x1>;
++			clock-latency-ns = <200000>;
++		};
++	};
++
+ 	pmu {
+ 		compatible = "arm,cortex-a53-pmu";
+ 		interrupts = <GIC_PPI 7 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
diff --git a/target/linux/qualcommax/patches-6.1/0132-mmc-core-disable-TRIM-on-Micron-MTFC4GACAJCN-1M.patch b/target/linux/qualcommax/patches-6.1/0132-mmc-core-disable-TRIM-on-Micron-MTFC4GACAJCN-1M.patch
new file mode 100644
index 00000000000000..8c2e59eeb480c7
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0132-mmc-core-disable-TRIM-on-Micron-MTFC4GACAJCN-1M.patch
@@ -0,0 +1,36 @@
+From f5aaf6669bd4f1f0218dd7fd5dc90941267ad860 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Tue, 30 May 2023 23:26:30 +0200
+Subject: [PATCH] mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M
+
+It seems that Micron MTFC4GACAJCN-1M despite advertising TRIM support does
+not work when the core is trying to use REQ_OP_WRITE_ZEROES.
+
+We are seeing the following errors in OpenWrt under 6.1 on Qnap Qhora 301W
+that we did not previously have and tracked it down to REQ_OP_WRITE_ZEROES:
+[   18.085950] I/O error, dev loop0, sector 596 op 0x9:(WRITE_ZEROES) flags 0x800 phys_seg 0 prio class 2
+
+Disabling TRIM makes the error go away, so lets add a quirk for this eMMC
+to disable TRIM.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/mmc/core/quirks.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/mmc/core/quirks.h
++++ b/drivers/mmc/core/quirks.h
+@@ -101,6 +101,13 @@ static const struct mmc_fixup __maybe_un
+ 		  MMC_QUIRK_TRIM_BROKEN),
+ 
+ 	/*
++	 * Micron MTFC4GACAJCN-1M advertises TRIM but it does not seems to
++	 * support being used to offload WRITE_ZEROES.
++	 */
++	MMC_FIXUP("Q2J54A", CID_MANFID_MICRON, 0x014e, add_quirk_mmc,
++		  MMC_QUIRK_TRIM_BROKEN),
++
++	/*
+ 	 * Some SD cards reports discard support while they don't
+ 	 */
+ 	MMC_FIXUP(CID_NAME_ANY, CID_MANFID_SANDISK_SD, 0x5344, add_quirk_sd,
diff --git a/target/linux/qualcommax/patches-6.1/0133-mmc-core-disable-TRIM-on-Kingston-EMMC04G-M627.patch b/target/linux/qualcommax/patches-6.1/0133-mmc-core-disable-TRIM-on-Kingston-EMMC04G-M627.patch
new file mode 100644
index 00000000000000..ac7af52a74eb71
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0133-mmc-core-disable-TRIM-on-Kingston-EMMC04G-M627.patch
@@ -0,0 +1,38 @@
+From 26c97b6fb7d291f55e0e4a410d266d1355118ed9 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Wed, 31 May 2023 20:21:26 +0200
+Subject: [PATCH] mmc: core: disable TRIM on Kingston EMMC04G-M627
+
+It seems that Kingston EMMC04G-M627 despite advertising TRIM support does
+not work when the core is trying to use REQ_OP_WRITE_ZEROES.
+
+We are seeing I/O errors in OpenWrt under 6.1 on Zyxel NBG7815 that we did
+not previously have and tracked it down to REQ_OP_WRITE_ZEROES.
+
+Trying to use fstrim seems to also throw errors like:
+[93010.835112] I/O error, dev loop0, sector 16902 op 0x3:(DISCARD) flags 0x800 phys_seg 1 prio class 2
+
+Disabling TRIM makes the error go away, so lets add a quirk for this eMMC
+to disable TRIM.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/mmc/core/quirks.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/mmc/core/quirks.h
++++ b/drivers/mmc/core/quirks.h
+@@ -108,6 +108,13 @@ static const struct mmc_fixup __maybe_un
+ 		  MMC_QUIRK_TRIM_BROKEN),
+ 
+ 	/*
++	 * Kingston EMMC04G-M627 advertises TRIM but it does not seems to
++	 * support being used to offload WRITE_ZEROES.
++	 */
++	MMC_FIXUP("M62704", CID_MANFID_KINGSTON, 0x0100, add_quirk_mmc,
++		  MMC_QUIRK_TRIM_BROKEN),
++
++	/*
+ 	 * Some SD cards reports discard support while they don't
+ 	 */
+ 	MMC_FIXUP(CID_NAME_ANY, CID_MANFID_SANDISK_SD, 0x5344, add_quirk_sd,
diff --git a/target/linux/qualcommax/patches-6.1/0900-power-Add-Qualcomm-APM.patch b/target/linux/qualcommax/patches-6.1/0900-power-Add-Qualcomm-APM.patch
new file mode 100644
index 00000000000000..2e5c72b7d1f6b7
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0900-power-Add-Qualcomm-APM.patch
@@ -0,0 +1,1047 @@
+From 6c98adf98236b8644b8f5e1aa7af9f1a88ea2766 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Mon, 11 Apr 2022 14:38:08 +0200
+Subject: [PATCH] power: Add Qualcomm APM
+
+Add Qualcomm APM driver, which allows scaling cache and memory fabrics.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/power/Kconfig          |   1 +
+ drivers/power/Makefile         |   1 +
+ drivers/power/qcom/Kconfig     |   7 +
+ drivers/power/qcom/Makefile    |   1 +
+ drivers/power/qcom/apm.c       | 944 +++++++++++++++++++++++++++++++++
+ include/linux/power/qcom/apm.h |  48 ++
+ 6 files changed, 1002 insertions(+)
+ create mode 100644 drivers/power/qcom/Kconfig
+ create mode 100644 drivers/power/qcom/Makefile
+ create mode 100644 drivers/power/qcom/apm.c
+ create mode 100644 include/linux/power/qcom/apm.h
+
+--- a/drivers/power/Kconfig
++++ b/drivers/power/Kconfig
+@@ -1,3 +1,4 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ source "drivers/power/reset/Kconfig"
+ source "drivers/power/supply/Kconfig"
++source "drivers/power/qcom/Kconfig"
+--- a/drivers/power/Makefile
++++ b/drivers/power/Makefile
+@@ -1,3 +1,4 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ obj-$(CONFIG_POWER_RESET)	+= reset/
+ obj-$(CONFIG_POWER_SUPPLY)	+= supply/
++obj-$(CONFIG_QCOM_APM)		+= qcom/
+--- /dev/null
++++ b/drivers/power/qcom/Kconfig
+@@ -0,0 +1,7 @@
++config QCOM_APM
++       bool "Qualcomm Technologies Inc platform specific APM driver"
++       help
++	Platform specific driver to manage the power source of
++	memory arrays. Interfaces with regulator drivers to ensure
++	SRAM Vmin requirements are met across different performance
++	levels.
+--- /dev/null
++++ b/drivers/power/qcom/Makefile
+@@ -0,0 +1 @@
++obj-$(CONFIG_QCOM_APM)		+= apm.o
+--- /dev/null
++++ b/drivers/power/qcom/apm.c
+@@ -0,0 +1,944 @@
++/*
++ * Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#define pr_fmt(fmt) "%s: " fmt, __func__
++
++#include <linux/debugfs.h>
++#include <linux/delay.h>
++#include <linux/of_device.h>
++#include <linux/init.h>
++#include <linux/io.h>
++#include <linux/kernel.h>
++#include <linux/list.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++#include <linux/string.h>
++#include <linux/power/qcom/apm.h>
++
++/*
++ *        VDD_APCC
++ * =============================================================
++ *       |      VDD_MX                  |                    |
++ *       |    ==========================|=============       |
++ *    ___|___   ___|___    ___|___   ___|___    ___|___   ___|___
++ *   |       | |       |  |       | |       |  |       | |       |
++ *   | APCC  | | MX HS |  | MX HS | | APCC  |  | MX HS | | APCC  |
++ *   |  HS   | |       |  |       | |  HS   |  |       | |  HS   |
++ *   |_______| |_______|  |_______| |_______|  |_______| |_______|
++ *       |_________|          |_________|         |__________|
++ *            |                    |                    |
++ *      ______|_____         ______|_____        _______|_____
++ *     |            |       |            |      |             |
++ *     |            |       |            |      |             |
++ *     |  CPU MEM   |       |   L2 MEM   |      |    L3 MEM   |
++ *     |   Arrays   |       |   Arrays   |      |    Arrays   |
++ *     |            |       |            |      |             |
++ *     |____________|       |____________|      |_____________|
++ *
++ */
++
++/* Register value definitions */
++#define APCS_GFMUXA_SEL_VAL            0x13
++#define APCS_GFMUXA_DESEL_VAL          0x03
++#define MSM_APM_MX_MODE_VAL            0x00
++#define MSM_APM_APCC_MODE_VAL          0x10
++#define MSM_APM_MX_DONE_VAL            0x00
++#define MSM_APM_APCC_DONE_VAL          0x03
++#define MSM_APM_OVERRIDE_SEL_VAL       0xb0
++#define MSM_APM_SEC_CLK_SEL_VAL        0x30
++#define SPM_EVENT_SET_VAL              0x01
++#define SPM_EVENT_CLEAR_VAL            0x00
++
++/* Register bit mask definitions */
++#define MSM_APM_CTL_STS_MASK            0x0f
++
++/* Register offset definitions */
++#define APCC_APM_MODE              0x00000098
++#define APCC_APM_CTL_STS           0x000000a8
++#define APCS_SPARE                 0x00000068
++#define APCS_VERSION               0x00000fd0
++
++#define HMSS_VERSION_1P2           0x10020000
++
++#define MSM_APM_SWITCH_TIMEOUT_US  10
++#define SPM_WAKEUP_DELAY_US        2
++#define SPM_EVENT_NUM              6
++
++#define MSM_APM_DRIVER_NAME        "qcom,msm-apm"
++
++enum {
++	MSM8996_ID,
++	MSM8953_ID,
++	IPQ807x_ID,
++};
++
++struct msm_apm_ctrl_dev {
++	struct list_head	list;
++	struct device		*dev;
++	enum msm_apm_supply	supply;
++	spinlock_t		lock;
++	void __iomem		*reg_base;
++	void __iomem		*apcs_csr_base;
++	void __iomem		**apcs_spm_events_addr;
++	void __iomem		*apc0_pll_ctl_addr;
++	void __iomem		*apc1_pll_ctl_addr;
++	u32			version;
++	struct dentry		*debugfs;
++	u32			msm_id;
++};
++
++#if defined(CONFIG_DEBUG_FS)
++static struct dentry *apm_debugfs_base;
++#endif
++
++static DEFINE_MUTEX(apm_ctrl_list_mutex);
++static LIST_HEAD(apm_ctrl_list);
++
++/*
++ * Get the resources associated with the APM controller from device tree
++ * and remap all I/O addresses that are relevant to this HW revision.
++ */
++static int msm_apm_ctrl_devm_ioremap(struct platform_device *pdev,
++				     struct msm_apm_ctrl_dev *ctrl)
++{
++	struct device *dev = &pdev->dev;
++	struct resource *res;
++	static const char *res_name[SPM_EVENT_NUM] = {
++		"apc0-l2-spm",
++		"apc1-l2-spm",
++		"apc0-cpu0-spm",
++		"apc0-cpu1-spm",
++		"apc1-cpu0-spm",
++		"apc1-cpu1-spm"
++	};
++	int i, ret = 0;
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "pm-apcc-glb");
++	if (!res) {
++		dev_err(dev, "Missing PM APCC Global register physical address");
++		return -EINVAL;
++	}
++	ctrl->reg_base = devm_ioremap(dev, res->start, resource_size(res));
++	if (!ctrl->reg_base) {
++		dev_err(dev, "Failed to map PM APCC Global registers\n");
++		return -ENOMEM;
++	}
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "apcs-csr");
++	if (!res) {
++		dev_err(dev, "Missing APCS CSR physical base address");
++		return -EINVAL;
++	}
++	ctrl->apcs_csr_base = devm_ioremap(dev, res->start, resource_size(res));
++	if (!ctrl->apcs_csr_base) {
++		dev_err(dev, "Failed to map APCS CSR registers\n");
++		return -ENOMEM;
++	}
++
++	ctrl->version = readl_relaxed(ctrl->apcs_csr_base + APCS_VERSION);
++
++	if (ctrl->version >= HMSS_VERSION_1P2)
++		return ret;
++
++	ctrl->apcs_spm_events_addr = devm_kzalloc(&pdev->dev,
++						  SPM_EVENT_NUM
++						  * sizeof(void __iomem *),
++						  GFP_KERNEL);
++	if (!ctrl->apcs_spm_events_addr) {
++		dev_err(dev, "Failed to allocate memory for APCS SPM event registers\n");
++		return -ENOMEM;
++	}
++
++	for (i = 0; i < SPM_EVENT_NUM; i++) {
++		res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
++						   res_name[i]);
++		if (!res) {
++			dev_err(dev, "Missing address for %s\n", res_name[i]);
++			ret = -EINVAL;
++			goto free_events;
++		}
++
++		ctrl->apcs_spm_events_addr[i] = devm_ioremap(dev, res->start,
++						resource_size(res));
++		if (!ctrl->apcs_spm_events_addr[i]) {
++			dev_err(dev, "Failed to map %s\n", res_name[i]);
++			ret = -ENOMEM;
++			goto free_events;
++		}
++
++		dev_dbg(dev, "%s event phys: %pa virt:0x%p\n", res_name[i],
++			&res->start, ctrl->apcs_spm_events_addr[i]);
++	}
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
++					   "apc0-pll-ctl");
++	if (!res) {
++		dev_err(dev, "Missing APC0 PLL CTL physical address\n");
++		ret = -EINVAL;
++		goto free_events;
++	}
++
++	ctrl->apc0_pll_ctl_addr = devm_ioremap(dev,
++					   res->start,
++					   resource_size(res));
++	if (!ctrl->apc0_pll_ctl_addr) {
++		dev_err(dev, "Failed to map APC0 PLL CTL register\n");
++		ret = -ENOMEM;
++		goto free_events;
++	}
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
++					   "apc1-pll-ctl");
++	if (!res) {
++		dev_err(dev, "Missing APC1 PLL CTL physical address\n");
++		ret = -EINVAL;
++		goto free_events;
++	}
++
++	ctrl->apc1_pll_ctl_addr = devm_ioremap(dev,
++					   res->start,
++					   resource_size(res));
++	if (!ctrl->apc1_pll_ctl_addr) {
++		dev_err(dev, "Failed to map APC1 PLL CTL register\n");
++		ret = -ENOMEM;
++		goto free_events;
++	}
++
++	return ret;
++
++free_events:
++	devm_kfree(dev, ctrl->apcs_spm_events_addr);
++	return ret;
++}
++
++/* 8953 register offset definition */
++#define MSM8953_APM_DLY_CNTR	0x2ac
++
++/* Register field shift definitions */
++#define APM_CTL_SEL_SWITCH_DLY_SHIFT	0
++#define APM_CTL_RESUME_CLK_DLY_SHIFT	8
++#define APM_CTL_HALT_CLK_DLY_SHIFT	16
++#define APM_CTL_POST_HALT_DLY_SHIFT	24
++
++/* Register field mask definitions */
++#define APM_CTL_SEL_SWITCH_DLY_MASK	GENMASK(7, 0)
++#define APM_CTL_RESUME_CLK_DLY_MASK	GENMASK(15, 8)
++#define APM_CTL_HALT_CLK_DLY_MASK	GENMASK(23, 16)
++#define APM_CTL_POST_HALT_DLY_MASK	GENMASK(31, 24)
++
++/*
++ * Get the resources associated with the msm8953 APM controller from
++ * device tree, remap all I/O addresses, and program the initial
++ * register configuration required for the 8953 APM controller device.
++ */
++static int msm8953_apm_ctrl_init(struct platform_device *pdev,
++				     struct msm_apm_ctrl_dev *ctrl)
++{
++	struct device *dev = &pdev->dev;
++	struct resource *res;
++	u32 delay_counter, val = 0, regval = 0;
++	int rc = 0;
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "pm-apcc-glb");
++	if (!res) {
++		dev_err(dev, "Missing PM APCC Global register physical address\n");
++		return -ENODEV;
++	}
++	ctrl->reg_base = devm_ioremap(dev, res->start, resource_size(res));
++	if (!ctrl->reg_base) {
++		dev_err(dev, "Failed to map PM APCC Global registers\n");
++		return -ENOMEM;
++	}
++
++	/*
++	 * Initial APM register configuration required before starting
++	 * APM HW controller.
++	 */
++	regval = readl_relaxed(ctrl->reg_base + MSM8953_APM_DLY_CNTR);
++	val = regval;
++
++	if (of_find_property(dev->of_node, "qcom,apm-post-halt-delay", NULL)) {
++		rc = of_property_read_u32(dev->of_node,
++				"qcom,apm-post-halt-delay", &delay_counter);
++		if (rc < 0) {
++			dev_err(dev, "apm-post-halt-delay read failed, rc = %d",
++				rc);
++			return rc;
++		}
++
++		val &= ~APM_CTL_POST_HALT_DLY_MASK;
++		val |= (delay_counter << APM_CTL_POST_HALT_DLY_SHIFT)
++			& APM_CTL_POST_HALT_DLY_MASK;
++	}
++
++	if (of_find_property(dev->of_node, "qcom,apm-halt-clk-delay", NULL)) {
++		rc = of_property_read_u32(dev->of_node,
++				"qcom,apm-halt-clk-delay", &delay_counter);
++		if (rc < 0) {
++			dev_err(dev, "apm-halt-clk-delay read failed, rc = %d",
++				rc);
++			return rc;
++		}
++
++		val &= ~APM_CTL_HALT_CLK_DLY_MASK;
++		val |= (delay_counter << APM_CTL_HALT_CLK_DLY_SHIFT)
++			& APM_CTL_HALT_CLK_DLY_MASK;
++	}
++
++	if (of_find_property(dev->of_node, "qcom,apm-resume-clk-delay", NULL)) {
++		rc = of_property_read_u32(dev->of_node,
++				"qcom,apm-resume-clk-delay", &delay_counter);
++		if (rc < 0) {
++			dev_err(dev, "apm-resume-clk-delay read failed, rc = %d",
++				rc);
++			return rc;
++		}
++
++		val &= ~APM_CTL_RESUME_CLK_DLY_MASK;
++		val |= (delay_counter << APM_CTL_RESUME_CLK_DLY_SHIFT)
++			& APM_CTL_RESUME_CLK_DLY_MASK;
++	}
++
++	if (of_find_property(dev->of_node, "qcom,apm-sel-switch-delay", NULL)) {
++		rc = of_property_read_u32(dev->of_node,
++				"qcom,apm-sel-switch-delay", &delay_counter);
++		if (rc < 0) {
++			dev_err(dev, "apm-sel-switch-delay read failed, rc = %d",
++				rc);
++			return rc;
++		}
++
++		val &= ~APM_CTL_SEL_SWITCH_DLY_MASK;
++		val |= (delay_counter << APM_CTL_SEL_SWITCH_DLY_SHIFT)
++			& APM_CTL_SEL_SWITCH_DLY_MASK;
++	}
++
++	if (val != regval) {
++		writel_relaxed(val, ctrl->reg_base + MSM8953_APM_DLY_CNTR);
++		/* make sure write completes before return */
++		mb();
++	}
++
++	return rc;
++}
++
++static int msm8996_apm_switch_to_mx(struct msm_apm_ctrl_dev *ctrl_dev)
++{
++	int i, timeout = MSM_APM_SWITCH_TIMEOUT_US;
++	u32 regval;
++	int ret = 0;
++	unsigned long flags;
++
++	spin_lock_irqsave(&ctrl_dev->lock, flags);
++
++	/* Perform revision-specific programming steps */
++	if (ctrl_dev->version < HMSS_VERSION_1P2) {
++		/* Clear SPM events */
++		for (i = 0; i < SPM_EVENT_NUM; i++)
++			writel_relaxed(SPM_EVENT_CLEAR_VAL,
++				       ctrl_dev->apcs_spm_events_addr[i]);
++
++		udelay(SPM_WAKEUP_DELAY_US);
++
++		/* Switch APC/CBF to GPLL0 clock */
++		writel_relaxed(APCS_GFMUXA_SEL_VAL,
++			       ctrl_dev->apcs_csr_base + APCS_SPARE);
++		ndelay(200);
++		writel_relaxed(MSM_APM_OVERRIDE_SEL_VAL,
++			       ctrl_dev->apc0_pll_ctl_addr);
++		ndelay(200);
++		writel_relaxed(MSM_APM_OVERRIDE_SEL_VAL,
++			       ctrl_dev->apc1_pll_ctl_addr);
++
++		/* Ensure writes complete before proceeding */
++		mb();
++	}
++
++	/* Switch arrays to MX supply and wait for its completion */
++	writel_relaxed(MSM_APM_MX_MODE_VAL, ctrl_dev->reg_base +
++		       APCC_APM_MODE);
++
++	/* Ensure write above completes before delaying */
++	mb();
++
++	while (timeout > 0) {
++		regval = readl_relaxed(ctrl_dev->reg_base + APCC_APM_CTL_STS);
++		if ((regval & MSM_APM_CTL_STS_MASK) ==
++		    MSM_APM_MX_DONE_VAL)
++			break;
++
++		udelay(1);
++		timeout--;
++	}
++
++	if (timeout == 0) {
++		ret = -ETIMEDOUT;
++		dev_err(ctrl_dev->dev, "APCC to MX APM switch timed out. APCC_APM_CTL_STS=0x%x\n",
++			regval);
++	}
++
++	/* Perform revision-specific programming steps */
++	if (ctrl_dev->version < HMSS_VERSION_1P2) {
++		/* Switch APC/CBF clocks to original source */
++		writel_relaxed(APCS_GFMUXA_DESEL_VAL,
++			       ctrl_dev->apcs_csr_base + APCS_SPARE);
++		ndelay(200);
++		writel_relaxed(MSM_APM_SEC_CLK_SEL_VAL,
++			       ctrl_dev->apc0_pll_ctl_addr);
++		ndelay(200);
++		writel_relaxed(MSM_APM_SEC_CLK_SEL_VAL,
++			       ctrl_dev->apc1_pll_ctl_addr);
++
++		/* Complete clock source switch before SPM event sequence */
++		mb();
++
++		/* Set SPM events */
++		for (i = 0; i < SPM_EVENT_NUM; i++)
++			writel_relaxed(SPM_EVENT_SET_VAL,
++				       ctrl_dev->apcs_spm_events_addr[i]);
++	}
++
++	if (!ret) {
++		ctrl_dev->supply = MSM_APM_SUPPLY_MX;
++		dev_dbg(ctrl_dev->dev, "APM supply switched to MX\n");
++	}
++
++	spin_unlock_irqrestore(&ctrl_dev->lock, flags);
++
++	return ret;
++}
++
++static int msm8996_apm_switch_to_apcc(struct msm_apm_ctrl_dev *ctrl_dev)
++{
++	int i, timeout = MSM_APM_SWITCH_TIMEOUT_US;
++	u32 regval;
++	int ret = 0;
++	unsigned long flags;
++
++	spin_lock_irqsave(&ctrl_dev->lock, flags);
++
++	/* Perform revision-specific programming steps */
++	if (ctrl_dev->version < HMSS_VERSION_1P2) {
++		/* Clear SPM events */
++		for (i = 0; i < SPM_EVENT_NUM; i++)
++			writel_relaxed(SPM_EVENT_CLEAR_VAL,
++				       ctrl_dev->apcs_spm_events_addr[i]);
++
++		udelay(SPM_WAKEUP_DELAY_US);
++
++		/* Switch APC/CBF to GPLL0 clock */
++		writel_relaxed(APCS_GFMUXA_SEL_VAL,
++			       ctrl_dev->apcs_csr_base + APCS_SPARE);
++		ndelay(200);
++		writel_relaxed(MSM_APM_OVERRIDE_SEL_VAL,
++			       ctrl_dev->apc0_pll_ctl_addr);
++		ndelay(200);
++		writel_relaxed(MSM_APM_OVERRIDE_SEL_VAL,
++			       ctrl_dev->apc1_pll_ctl_addr);
++
++		/* Ensure previous writes complete before proceeding */
++		mb();
++	}
++
++	/* Switch arrays to APCC supply and wait for its completion */
++	writel_relaxed(MSM_APM_APCC_MODE_VAL, ctrl_dev->reg_base +
++		       APCC_APM_MODE);
++
++	/* Ensure write above completes before delaying */
++	mb();
++
++	while (timeout > 0) {
++		regval = readl_relaxed(ctrl_dev->reg_base + APCC_APM_CTL_STS);
++		if ((regval & MSM_APM_CTL_STS_MASK) ==
++		    MSM_APM_APCC_DONE_VAL)
++			break;
++
++		udelay(1);
++		timeout--;
++	}
++
++	if (timeout == 0) {
++		ret = -ETIMEDOUT;
++		dev_err(ctrl_dev->dev, "MX to APCC APM switch timed out. APCC_APM_CTL_STS=0x%x\n",
++			regval);
++	}
++
++	/* Perform revision-specific programming steps */
++	if (ctrl_dev->version < HMSS_VERSION_1P2) {
++		/* Set SPM events */
++		for (i = 0; i < SPM_EVENT_NUM; i++)
++			writel_relaxed(SPM_EVENT_SET_VAL,
++				       ctrl_dev->apcs_spm_events_addr[i]);
++
++		/* Complete SPM event sequence before clock source switch */
++		mb();
++
++		/* Switch APC/CBF clocks to original source */
++		writel_relaxed(APCS_GFMUXA_DESEL_VAL,
++			       ctrl_dev->apcs_csr_base + APCS_SPARE);
++		ndelay(200);
++		writel_relaxed(MSM_APM_SEC_CLK_SEL_VAL,
++			       ctrl_dev->apc0_pll_ctl_addr);
++		ndelay(200);
++		writel_relaxed(MSM_APM_SEC_CLK_SEL_VAL,
++			       ctrl_dev->apc1_pll_ctl_addr);
++	}
++
++	if (!ret) {
++		ctrl_dev->supply = MSM_APM_SUPPLY_APCC;
++		dev_dbg(ctrl_dev->dev, "APM supply switched to APCC\n");
++	}
++
++	spin_unlock_irqrestore(&ctrl_dev->lock, flags);
++
++	return ret;
++}
++
++/* 8953 register value definitions */
++#define MSM8953_APM_MX_MODE_VAL            0x00
++#define MSM8953_APM_APCC_MODE_VAL          0x02
++#define MSM8953_APM_MX_DONE_VAL            0x00
++#define MSM8953_APM_APCC_DONE_VAL          0x03
++
++/* 8953 register offset definitions */
++#define MSM8953_APCC_APM_MODE              0x000002a8
++#define MSM8953_APCC_APM_CTL_STS           0x000002b0
++
++/* 8953 constants */
++#define MSM8953_APM_SWITCH_TIMEOUT_US      500
++
++/* Register bit mask definitions */
++#define MSM8953_APM_CTL_STS_MASK           0x1f
++
++static int msm8953_apm_switch_to_mx(struct msm_apm_ctrl_dev *ctrl_dev)
++{
++	int timeout = MSM8953_APM_SWITCH_TIMEOUT_US;
++	u32 regval;
++	int ret = 0;
++	unsigned long flags;
++
++	spin_lock_irqsave(&ctrl_dev->lock, flags);
++
++	/* Switch arrays to MX supply and wait for its completion */
++	writel_relaxed(MSM8953_APM_MX_MODE_VAL, ctrl_dev->reg_base +
++		       MSM8953_APCC_APM_MODE);
++
++	/* Ensure write above completes before delaying */
++	mb();
++
++	while (timeout > 0) {
++		regval = readl_relaxed(ctrl_dev->reg_base +
++					MSM8953_APCC_APM_CTL_STS);
++		if ((regval & MSM8953_APM_CTL_STS_MASK) ==
++				MSM8953_APM_MX_DONE_VAL)
++			break;
++
++		udelay(1);
++		timeout--;
++	}
++
++	if (timeout == 0) {
++		ret = -ETIMEDOUT;
++		dev_err(ctrl_dev->dev, "APCC to MX APM switch timed out. APCC_APM_CTL_STS=0x%x\n",
++			regval);
++	} else {
++		ctrl_dev->supply = MSM_APM_SUPPLY_MX;
++		dev_dbg(ctrl_dev->dev, "APM supply switched to MX\n");
++	}
++
++	spin_unlock_irqrestore(&ctrl_dev->lock, flags);
++
++	return ret;
++}
++
++static int msm8953_apm_switch_to_apcc(struct msm_apm_ctrl_dev *ctrl_dev)
++{
++	int timeout = MSM8953_APM_SWITCH_TIMEOUT_US;
++	u32 regval;
++	int ret = 0;
++	unsigned long flags;
++
++	spin_lock_irqsave(&ctrl_dev->lock, flags);
++
++	/* Switch arrays to APCC supply and wait for its completion */
++	writel_relaxed(MSM8953_APM_APCC_MODE_VAL, ctrl_dev->reg_base +
++		       MSM8953_APCC_APM_MODE);
++
++	/* Ensure write above completes before delaying */
++	mb();
++
++	while (timeout > 0) {
++		regval = readl_relaxed(ctrl_dev->reg_base +
++					MSM8953_APCC_APM_CTL_STS);
++		if ((regval & MSM8953_APM_CTL_STS_MASK) ==
++				MSM8953_APM_APCC_DONE_VAL)
++			break;
++
++		udelay(1);
++		timeout--;
++	}
++
++	if (timeout == 0) {
++		ret = -ETIMEDOUT;
++		dev_err(ctrl_dev->dev, "MX to APCC APM switch timed out. APCC_APM_CTL_STS=0x%x\n",
++			regval);
++	} else {
++		ctrl_dev->supply = MSM_APM_SUPPLY_APCC;
++		dev_dbg(ctrl_dev->dev, "APM supply switched to APCC\n");
++	}
++
++	spin_unlock_irqrestore(&ctrl_dev->lock, flags);
++
++	return ret;
++}
++
++static int msm_apm_switch_to_mx(struct msm_apm_ctrl_dev *ctrl_dev)
++{
++	int ret = 0;
++
++	switch (ctrl_dev->msm_id) {
++	case MSM8996_ID:
++		ret = msm8996_apm_switch_to_mx(ctrl_dev);
++		break;
++	case MSM8953_ID:
++	case IPQ807x_ID:
++		ret = msm8953_apm_switch_to_mx(ctrl_dev);
++		break;
++	}
++
++	return ret;
++}
++
++static int msm_apm_switch_to_apcc(struct msm_apm_ctrl_dev *ctrl_dev)
++{
++	int ret = 0;
++
++	switch (ctrl_dev->msm_id) {
++	case MSM8996_ID:
++		ret = msm8996_apm_switch_to_apcc(ctrl_dev);
++		break;
++	case MSM8953_ID:
++	case IPQ807x_ID:
++		ret = msm8953_apm_switch_to_apcc(ctrl_dev);
++		break;
++	}
++
++	return ret;
++}
++
++/**
++ * msm_apm_get_supply() - Returns the supply that is currently
++ *			powering the memory arrays
++ * @ctrl_dev:                   Pointer to an MSM APM controller device
++ *
++ * Returns the supply currently selected by the APM.
++ */
++int msm_apm_get_supply(struct msm_apm_ctrl_dev *ctrl_dev)
++{
++	return ctrl_dev->supply;
++}
++EXPORT_SYMBOL(msm_apm_get_supply);
++
++/**
++ * msm_apm_set_supply() - Perform the necessary steps to switch the voltage
++ *                        source of the memory arrays to a given supply
++ * @ctrl_dev:                   Pointer to an MSM APM controller device
++ * @supply:                     Power rail to use as supply for the memory
++ *                              arrays
++ *
++ * Returns 0 on success, -ETIMEDOUT on APM switch timeout, or -EPERM if
++ * the supply is not supported.
++ */
++int msm_apm_set_supply(struct msm_apm_ctrl_dev *ctrl_dev,
++		       enum msm_apm_supply supply)
++{
++	int ret;
++
++	switch (supply) {
++	case MSM_APM_SUPPLY_APCC:
++		ret = msm_apm_switch_to_apcc(ctrl_dev);
++		break;
++	case MSM_APM_SUPPLY_MX:
++		ret = msm_apm_switch_to_mx(ctrl_dev);
++		break;
++	default:
++		ret = -EPERM;
++		break;
++	}
++
++	return ret;
++}
++EXPORT_SYMBOL(msm_apm_set_supply);
++
++/**
++ * msm_apm_ctrl_dev_get() - get a handle to the MSM APM controller linked to
++ *                          the device in device tree
++ * @dev:                    Pointer to the device
++ *
++ * The device must specify "qcom,apm-ctrl" property in its device tree
++ * node which points to an MSM APM controller device node.
++ *
++ * Returns an MSM APM controller handle if successful or ERR_PTR on any error.
++ * If the APM controller device hasn't probed yet, ERR_PTR(-EPROBE_DEFER) is
++ * returned.
++ */
++struct msm_apm_ctrl_dev *msm_apm_ctrl_dev_get(struct device *dev)
++{
++	struct msm_apm_ctrl_dev *ctrl_dev = NULL;
++	struct msm_apm_ctrl_dev *dev_found = ERR_PTR(-EPROBE_DEFER);
++	struct device_node *ctrl_node;
++
++	if (!dev || !dev->of_node) {
++		pr_err("Invalid device node\n");
++		return ERR_PTR(-EINVAL);
++	}
++
++	ctrl_node = of_parse_phandle(dev->of_node, "qcom,apm-ctrl", 0);
++	if (!ctrl_node) {
++		pr_err("Could not find qcom,apm-ctrl property in %s\n",
++		       dev->of_node->full_name);
++		return ERR_PTR(-ENXIO);
++	}
++
++	mutex_lock(&apm_ctrl_list_mutex);
++	list_for_each_entry(ctrl_dev, &apm_ctrl_list, list) {
++		if (ctrl_dev->dev && ctrl_dev->dev->of_node == ctrl_node) {
++			dev_found = ctrl_dev;
++			break;
++		}
++	}
++	mutex_unlock(&apm_ctrl_list_mutex);
++
++	of_node_put(ctrl_node);
++	return dev_found;
++}
++EXPORT_SYMBOL(msm_apm_ctrl_dev_get);
++
++#if defined(CONFIG_DEBUG_FS)
++
++static int apm_supply_dbg_open(struct inode *inode, struct file *filep)
++{
++	filep->private_data = inode->i_private;
++
++	return 0;
++}
++
++static ssize_t apm_supply_dbg_read(struct file *filep, char __user *ubuf,
++				   size_t count, loff_t *ppos)
++{
++	struct msm_apm_ctrl_dev *ctrl_dev = filep->private_data;
++	char buf[10];
++	int len;
++
++	if (!ctrl_dev) {
++		pr_err("invalid apm ctrl handle\n");
++		return -ENODEV;
++	}
++
++	if (ctrl_dev->supply == MSM_APM_SUPPLY_APCC)
++		len = snprintf(buf, sizeof(buf), "APCC\n");
++	else if (ctrl_dev->supply == MSM_APM_SUPPLY_MX)
++		len = snprintf(buf, sizeof(buf), "MX\n");
++	else
++		len = snprintf(buf, sizeof(buf), "ERR\n");
++
++	return simple_read_from_buffer(ubuf, count, ppos, buf, len);
++}
++
++static const struct file_operations apm_supply_fops = {
++	.open = apm_supply_dbg_open,
++	.read = apm_supply_dbg_read,
++};
++
++static void apm_debugfs_base_init(void)
++{
++	apm_debugfs_base = debugfs_create_dir("msm-apm", NULL);
++
++	if (IS_ERR_OR_NULL(apm_debugfs_base))
++		pr_err("msm-apm debugfs base directory creation failed\n");
++}
++
++static void apm_debugfs_init(struct msm_apm_ctrl_dev *ctrl_dev)
++{
++	struct dentry *temp;
++
++	if (IS_ERR_OR_NULL(apm_debugfs_base)) {
++		pr_err("Base directory missing, cannot create apm debugfs nodes\n");
++		return;
++	}
++
++	ctrl_dev->debugfs = debugfs_create_dir(dev_name(ctrl_dev->dev),
++					       apm_debugfs_base);
++	if (IS_ERR_OR_NULL(ctrl_dev->debugfs)) {
++		pr_err("%s debugfs directory creation failed\n",
++		       dev_name(ctrl_dev->dev));
++		return;
++	}
++
++	temp = debugfs_create_file("supply", S_IRUGO, ctrl_dev->debugfs,
++				   ctrl_dev, &apm_supply_fops);
++	if (IS_ERR_OR_NULL(temp)) {
++		pr_err("supply mode creation failed\n");
++		return;
++	}
++}
++
++static void apm_debugfs_deinit(struct msm_apm_ctrl_dev *ctrl_dev)
++{
++	if (!IS_ERR_OR_NULL(ctrl_dev->debugfs))
++		debugfs_remove_recursive(ctrl_dev->debugfs);
++}
++
++static void apm_debugfs_base_remove(void)
++{
++	debugfs_remove_recursive(apm_debugfs_base);
++}
++#else
++
++static void apm_debugfs_base_init(void)
++{}
++
++static void apm_debugfs_init(struct msm_apm_ctrl_dev *ctrl_dev)
++{}
++
++static void apm_debugfs_deinit(struct msm_apm_ctrl_dev *ctrl_dev)
++{}
++
++static void apm_debugfs_base_remove(void)
++{}
++
++#endif
++
++static struct of_device_id msm_apm_match_table[] = {
++	{
++		.compatible = "qcom,msm-apm",
++		.data = (void *)(uintptr_t)MSM8996_ID,
++	},
++	{
++		.compatible = "qcom,msm8953-apm",
++		.data = (void *)(uintptr_t)MSM8953_ID,
++	},
++	{
++		.compatible = "qcom,ipq807x-apm",
++		.data = (void *)(uintptr_t)IPQ807x_ID,
++	},
++	{}
++};
++
++static int msm_apm_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct msm_apm_ctrl_dev *ctrl;
++	const struct of_device_id *match;
++	int ret = 0;
++
++	dev_dbg(dev, "probing MSM Array Power Mux driver\n");
++
++	if (!dev->of_node) {
++		dev_err(dev, "Device tree node is missing\n");
++		return -ENODEV;
++	}
++
++	match = of_match_device(msm_apm_match_table, dev);
++	if (!match)
++		return -ENODEV;
++
++	ctrl = devm_kzalloc(dev, sizeof(*ctrl), GFP_KERNEL);
++	if (!ctrl) {
++		dev_err(dev, "MSM APM controller memory allocation failed\n");
++		return -ENOMEM;
++	}
++
++	INIT_LIST_HEAD(&ctrl->list);
++	spin_lock_init(&ctrl->lock);
++	ctrl->dev = dev;
++	ctrl->msm_id = (uintptr_t)match->data;
++	platform_set_drvdata(pdev, ctrl);
++
++	switch (ctrl->msm_id) {
++	case MSM8996_ID:
++		ret = msm_apm_ctrl_devm_ioremap(pdev, ctrl);
++		if (ret) {
++			dev_err(dev, "Failed to add APM controller device\n");
++			return ret;
++		}
++		break;
++	case MSM8953_ID:
++	case IPQ807x_ID:
++		ret = msm8953_apm_ctrl_init(pdev, ctrl);
++		if (ret) {
++			dev_err(dev, "Failed to initialize APM controller device: ret=%d\n",
++				ret);
++			return ret;
++		}
++		break;
++	default:
++		dev_err(dev, "unable to add APM controller device for msm_id:%d\n",
++			ctrl->msm_id);
++		return -ENODEV;
++	}
++
++	apm_debugfs_init(ctrl);
++	mutex_lock(&apm_ctrl_list_mutex);
++	list_add_tail(&ctrl->list, &apm_ctrl_list);
++	mutex_unlock(&apm_ctrl_list_mutex);
++
++	dev_dbg(dev, "MSM Array Power Mux driver probe successful");
++
++	return ret;
++}
++
++static int msm_apm_remove(struct platform_device *pdev)
++{
++	struct msm_apm_ctrl_dev *ctrl_dev;
++
++	ctrl_dev = platform_get_drvdata(pdev);
++	if (ctrl_dev) {
++		mutex_lock(&apm_ctrl_list_mutex);
++		list_del(&ctrl_dev->list);
++		mutex_unlock(&apm_ctrl_list_mutex);
++		apm_debugfs_deinit(ctrl_dev);
++	}
++
++	return 0;
++}
++
++static struct platform_driver msm_apm_driver = {
++	.driver		= {
++		.name		= MSM_APM_DRIVER_NAME,
++		.of_match_table	= msm_apm_match_table,
++		.owner		= THIS_MODULE,
++	},
++	.probe		= msm_apm_probe,
++	.remove		= msm_apm_remove,
++};
++
++static int __init msm_apm_init(void)
++{
++	apm_debugfs_base_init();
++	return platform_driver_register(&msm_apm_driver);
++}
++
++static void __exit msm_apm_exit(void)
++{
++	platform_driver_unregister(&msm_apm_driver);
++	apm_debugfs_base_remove();
++}
++
++arch_initcall(msm_apm_init);
++module_exit(msm_apm_exit);
++
++MODULE_DESCRIPTION("MSM Array Power Mux driver");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/include/linux/power/qcom/apm.h
+@@ -0,0 +1,48 @@
++/*
++ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#ifndef __LINUX_POWER_QCOM_APM_H__
++#define __LINUX_POWER_QCOM_APM_H__
++
++#include <linux/device.h>
++#include <linux/err.h>
++
++/**
++ * enum msm_apm_supply - supported power rails to supply memory arrays
++ * %MSM_APM_SUPPLY_APCC:	to enable selection of VDD_APCC rail as supply
++ * %MSM_APM_SUPPLY_MX:		to enable selection of VDD_MX rail as supply
++ */
++enum msm_apm_supply {
++	MSM_APM_SUPPLY_APCC,
++	MSM_APM_SUPPLY_MX,
++};
++
++/* Handle used to identify an APM controller device  */
++struct msm_apm_ctrl_dev;
++
++#ifdef CONFIG_QCOM_APM
++struct msm_apm_ctrl_dev *msm_apm_ctrl_dev_get(struct device *dev);
++int msm_apm_set_supply(struct msm_apm_ctrl_dev *ctrl_dev,
++		       enum msm_apm_supply supply);
++int msm_apm_get_supply(struct msm_apm_ctrl_dev *ctrl_dev);
++
++#else
++static inline struct msm_apm_ctrl_dev *msm_apm_ctrl_dev_get(struct device *dev)
++{ return ERR_PTR(-EPERM); }
++static inline int msm_apm_set_supply(struct msm_apm_ctrl_dev *ctrl_dev,
++		       enum msm_apm_supply supply)
++{ return -EPERM; }
++static inline int msm_apm_get_supply(struct msm_apm_ctrl_dev *ctrl_dev)
++{ return -EPERM; }
++#endif
++#endif
diff --git a/target/linux/qualcommax/patches-6.1/0901-regulator-add-Qualcomm-CPR-regulators.patch b/target/linux/qualcommax/patches-6.1/0901-regulator-add-Qualcomm-CPR-regulators.patch
new file mode 100644
index 00000000000000..9b9f7159f35b08
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0901-regulator-add-Qualcomm-CPR-regulators.patch
@@ -0,0 +1,12144 @@
+From c9df32c057e43e38c8113199e64f7a64f8d341df Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Mon, 11 Apr 2022 14:35:36 +0200
+Subject: [PATCH] regulator: add Qualcomm CPR regulators
+
+Allow building Qualcomm CPR regulators.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/regulator/Kconfig               |   33 +
+ drivers/regulator/Makefile              |    3 +
+ drivers/regulator/cpr3-npu-regulator.c  |  695 +++
+ drivers/regulator/cpr3-regulator.c      | 5111 +++++++++++++++++++++++
+ drivers/regulator/cpr3-regulator.h      | 1211 ++++++
+ drivers/regulator/cpr3-util.c           | 2750 ++++++++++++
+ drivers/regulator/cpr4-apss-regulator.c | 1819 ++++++++
+ include/soc/qcom/socinfo.h              |  463 ++
+ 8 files changed, 12085 insertions(+)
+ create mode 100644 drivers/regulator/cpr3-npu-regulator.c
+ create mode 100644 drivers/regulator/cpr3-regulator.c
+ create mode 100644 drivers/regulator/cpr3-regulator.h
+ create mode 100644 drivers/regulator/cpr3-util.c
+ create mode 100644 drivers/regulator/cpr4-apss-regulator.c
+ create mode 100644 include/soc/qcom/socinfo.h
+
+--- a/drivers/regulator/Kconfig
++++ b/drivers/regulator/Kconfig
+@@ -1524,4 +1524,37 @@ config REGULATOR_QCOM_LABIBB
+ 	  boost regulator and IBB can be used as a negative boost regulator
+ 	  for LCD display panel.
+ 
++config REGULATOR_CPR3
++	bool "QCOM CPR3 regulator core support"
++	help
++	  This driver supports Core Power Reduction (CPR) version 3 controllers
++	  which are used by some Qualcomm Technologies, Inc. SoCs to
++	  manage important voltage regulators.  CPR3 controllers are capable of
++	  monitoring several ring oscillator sensing loops simultaneously.  The
++	  CPR3 controller informs software when the silicon conditions require
++	  the supply voltage to be increased or decreased.  On certain supply
++	  rails, the CPR3 controller is able to propagate the voltage increase
++	  or decrease requests all the way to the PMIC without software
++	  involvement.
++
++config REGULATOR_CPR3_NPU
++	bool "QCOM CPR3 regulator for NPU"
++	depends on OF && REGULATOR_CPR3
++	help
++	  This driver supports Qualcomm Technologies, Inc. NPU CPR3
++	  regulator Which will always operate in open loop.
++
++config REGULATOR_CPR4_APSS
++	bool "QCOM CPR4 regulator for APSS"
++	depends on OF && REGULATOR_CPR3
++	help
++	  This driver supports Qualcomm Technologies, Inc. APSS application
++	  processor specific features including memory array power mux (APM)
++	  switching, one CPR4 thread which monitor the two APSS clusters that
++	  are both powered by a shared supply, hardware closed-loop auto
++	  voltage stepping, voltage adjustments based on online core count,
++	  voltage adjustments based on temperature readings, and voltage
++	  adjustments for performance boost mode. This driver reads both initial
++	  voltage and CPR target quotient values out of hardware fuses.
++
+ endif
+--- a/drivers/regulator/Makefile
++++ b/drivers/regulator/Makefile
+@@ -110,6 +110,9 @@ obj-$(CONFIG_REGULATOR_QCOM_RPMH) += qco
+ obj-$(CONFIG_REGULATOR_QCOM_SMD_RPM) += qcom_smd-regulator.o
+ obj-$(CONFIG_REGULATOR_QCOM_SPMI) += qcom_spmi-regulator.o
+ obj-$(CONFIG_REGULATOR_QCOM_USB_VBUS) += qcom_usb_vbus-regulator.o
++obj-$(CONFIG_REGULATOR_CPR3) += cpr3-regulator.o cpr3-util.o
++obj-$(CONFIG_REGULATOR_CPR3_NPU) += cpr3-npu-regulator.o
++obj-$(CONFIG_REGULATOR_CPR4_APSS) += cpr4-apss-regulator.o
+ obj-$(CONFIG_REGULATOR_PALMAS) += palmas-regulator.o
+ obj-$(CONFIG_REGULATOR_PCA9450) += pca9450-regulator.o
+ obj-$(CONFIG_REGULATOR_PF8X00) += pf8x00-regulator.o
+--- /dev/null
++++ b/drivers/regulator/cpr3-npu-regulator.c
+@@ -0,0 +1,695 @@
++/*
++ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
++ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#include <linux/err.h>
++#include <linux/platform_device.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
++#include <linux/slab.h>
++#include <linux/thermal.h>
++
++#include "cpr3-regulator.h"
++
++#define IPQ807x_NPU_FUSE_CORNERS		2
++#define IPQ817x_NPU_FUSE_CORNERS		1
++#define IPQ807x_NPU_FUSE_STEP_VOLT		8000
++#define IPQ807x_NPU_VOLTAGE_FUSE_SIZE		6
++#define IPQ807x_NPU_CPR_CLOCK_RATE		19200000
++
++#define IPQ807x_NPU_CPR_TCSR_START		6
++#define IPQ807x_NPU_CPR_TCSR_END		7
++
++#define NPU_TSENS				5
++
++u32 g_valid_npu_fuse_count = IPQ807x_NPU_FUSE_CORNERS;
++/**
++ * struct cpr3_ipq807x_npu_fuses - NPU specific fuse data for IPQ807x
++ * @init_voltage:	Initial (i.e. open-loop) voltage fuse parameter value
++ *			for each fuse corner (raw, not converted to a voltage)
++ * This struct holds the values for all of the fuses read from memory.
++ */
++struct cpr3_ipq807x_npu_fuses {
++	u64	init_voltage[IPQ807x_NPU_FUSE_CORNERS];
++};
++
++/*
++ * Constants which define the name of each fuse corner.
++ */
++enum cpr3_ipq807x_npu_fuse_corner {
++	CPR3_IPQ807x_NPU_FUSE_CORNER_NOM	= 0,
++	CPR3_IPQ807x_NPU_FUSE_CORNER_TURBO	= 1,
++};
++
++static const char * const cpr3_ipq807x_npu_fuse_corner_name[] = {
++	[CPR3_IPQ807x_NPU_FUSE_CORNER_NOM]	= "NOM",
++	[CPR3_IPQ807x_NPU_FUSE_CORNER_TURBO]	= "TURBO",
++};
++
++/*
++ * IPQ807x NPU fuse parameter locations:
++ *
++ * Structs are organized with the following dimensions:
++ *	Outer: 0 to 1 for fuse corners from lowest to highest corner
++ *	Inner: large enough to hold the longest set of parameter segments which
++ *		fully defines a fuse parameter, +1 (for NULL termination).
++ *		Each segment corresponds to a contiguous group of bits from a
++ *		single fuse row.  These segments are concatentated together in
++ *		order to form the full fuse parameter value.  The segments for
++ *		a given parameter may correspond to different fuse rows.
++ */
++static struct cpr3_fuse_param
++ipq807x_npu_init_voltage_param[IPQ807x_NPU_FUSE_CORNERS][2] = {
++	{{73, 22, 27}, {} },
++	{{73, 16, 21}, {} },
++};
++
++/*
++ * Open loop voltage fuse reference voltages in microvolts for IPQ807x
++ */
++static int
++ipq807x_npu_fuse_ref_volt [IPQ807x_NPU_FUSE_CORNERS] = {
++	912000,
++	992000,
++};
++
++/*
++ * IPQ9574 (Few parameters are changed, remaining are same as IPQ807x)
++ */
++#define IPQ9574_NPU_FUSE_CORNERS		2
++#define IPQ9574_NPU_FUSE_STEP_VOLT		10000
++#define IPQ9574_NPU_CPR_CLOCK_RATE		24000000
++
++/*
++ * fues parameters for IPQ9574
++ */
++static struct cpr3_fuse_param
++ipq9574_npu_init_voltage_param[IPQ9574_NPU_FUSE_CORNERS][2] = {
++	{{105, 12, 17}, {} },
++	{{105,  6, 11}, {} },
++};
++
++/*
++ * Open loop voltage fuse reference voltages in microvolts for IPQ9574
++ */
++static int
++ipq9574_npu_fuse_ref_volt [IPQ9574_NPU_FUSE_CORNERS] = {
++	862500,
++	987500,
++};
++
++struct cpr3_controller *g_ctrl;
++
++void cpr3_npu_temp_notify(int sensor, int temp, int low_notif)
++{
++	u32 prev_sensor_state;
++
++	if (sensor != NPU_TSENS)
++		return;
++
++	prev_sensor_state = g_ctrl->cur_sensor_state;
++	if (low_notif)
++		g_ctrl->cur_sensor_state |= BIT(sensor);
++	else
++		g_ctrl->cur_sensor_state &= ~BIT(sensor);
++
++	if (!prev_sensor_state && g_ctrl->cur_sensor_state)
++		cpr3_handle_temp_open_loop_adjustment(g_ctrl, true);
++	else if (prev_sensor_state && !g_ctrl->cur_sensor_state)
++		cpr3_handle_temp_open_loop_adjustment(g_ctrl, false);
++}
++
++/**
++ * cpr3_ipq807x_npu_read_fuse_data() - load NPU specific fuse parameter values
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * This function allocates a cpr3_ipq807x_npu_fuses struct, fills it with
++ * values read out of hardware fuses, and finally copies common fuse values
++ * into the CPR3 regulator struct.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_ipq807x_npu_read_fuse_data(struct cpr3_regulator *vreg)
++{
++	void __iomem *base = vreg->thread->ctrl->fuse_base;
++	struct cpr3_ipq807x_npu_fuses *fuse;
++	int i, rc;
++
++	fuse = devm_kzalloc(vreg->thread->ctrl->dev, sizeof(*fuse), GFP_KERNEL);
++	if (!fuse)
++		return -ENOMEM;
++
++	for (i = 0; i < g_valid_npu_fuse_count; i++) {
++		rc = cpr3_read_fuse_param(base,
++					  vreg->cpr3_regulator_data->init_voltage_param[i],
++					  &fuse->init_voltage[i]);
++		if (rc) {
++			cpr3_err(vreg, "Unable to read fuse-corner %d initial voltage fuse, rc=%d\n",
++				 i, rc);
++			return rc;
++		}
++	}
++
++	vreg->fuse_corner_count	= g_valid_npu_fuse_count;
++	vreg->platform_fuses	= fuse;
++
++	return 0;
++}
++
++/**
++ * cpr3_npu_parse_corner_data() - parse NPU corner data from device tree
++ *		properties of the CPR3 regulator's device node
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_npu_parse_corner_data(struct cpr3_regulator *vreg)
++{
++	int rc;
++
++	rc = cpr3_parse_common_corner_data(vreg);
++	if (rc) {
++		cpr3_err(vreg, "error reading corner data, rc=%d\n", rc);
++		return rc;
++	}
++
++	return rc;
++}
++
++/**
++ * cpr3_ipq807x_npu_calculate_open_loop_voltages() - calculate the open-loop
++ *		voltage for each corner of a CPR3 regulator
++ * @vreg:		Pointer to the CPR3 regulator
++ * @temp_correction:    Temperature based correction
++ *
++ * If open-loop voltage interpolation is allowed in device tree, then
++ * this function calculates the open-loop voltage for a given corner using
++ * linear interpolation.  This interpolation is performed using the processor
++ * frequencies of the lower and higher Fmax corners along with their fused
++ * open-loop voltages.
++ *
++ * If open-loop voltage interpolation is not allowed, then this function uses
++ * the Fmax fused open-loop voltage for all of the corners associated with a
++ * given fuse corner.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_ipq807x_npu_calculate_open_loop_voltages(
++			struct cpr3_regulator *vreg, bool temp_correction)
++{
++	struct cpr3_ipq807x_npu_fuses *fuse = vreg->platform_fuses;
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	int i, j, rc = 0;
++	u64 freq_low, volt_low, freq_high, volt_high;
++	int *fuse_volt;
++	int *fmax_corner;
++
++	fuse_volt = kcalloc(vreg->fuse_corner_count, sizeof(*fuse_volt),
++			    GFP_KERNEL);
++	fmax_corner = kcalloc(vreg->fuse_corner_count, sizeof(*fmax_corner),
++			      GFP_KERNEL);
++	if (!fuse_volt || !fmax_corner) {
++		rc = -ENOMEM;
++		goto done;
++	}
++
++	for (i = 0; i < vreg->fuse_corner_count; i++) {
++		if (ctrl->cpr_global_setting == CPR_DISABLED)
++			fuse_volt[i] = vreg->cpr3_regulator_data->fuse_ref_volt[i];
++		else
++			fuse_volt[i] = cpr3_convert_open_loop_voltage_fuse(
++				vreg->cpr3_regulator_data->fuse_ref_volt[i],
++				vreg->cpr3_regulator_data->fuse_step_volt,
++				fuse->init_voltage[i],
++				IPQ807x_NPU_VOLTAGE_FUSE_SIZE);
++
++		/* Log fused open-loop voltage values for debugging purposes. */
++		cpr3_info(vreg, "fused %8s: open-loop=%7d uV\n",
++			  cpr3_ipq807x_npu_fuse_corner_name[i],
++			  fuse_volt[i]);
++	}
++
++	rc = cpr3_determine_part_type(vreg,
++			fuse_volt[CPR3_IPQ807x_NPU_FUSE_CORNER_TURBO]);
++	if (rc) {
++		cpr3_err(vreg,
++			"fused part type detection failed failed, rc=%d\n", rc);
++		goto done;
++	}
++
++	rc = cpr3_adjust_fused_open_loop_voltages(vreg, fuse_volt);
++	if (rc) {
++		cpr3_err(vreg,
++			"fused open-loop voltage adjustment failed, rc=%d\n",
++			rc);
++		goto done;
++	}
++	if (temp_correction) {
++		rc = cpr3_determine_temp_base_open_loop_correction(vreg,
++								fuse_volt);
++		if (rc) {
++			cpr3_err(vreg,
++				"temp open-loop voltage adj. failed, rc=%d\n",
++				rc);
++			goto done;
++		}
++	}
++
++	for (i = 1; i < vreg->fuse_corner_count; i++) {
++		if (fuse_volt[i] < fuse_volt[i - 1]) {
++			cpr3_info(vreg,
++				"fuse corner %d voltage=%d uV < fuse corner %d \
++				voltage=%d uV; overriding: fuse corner %d \
++				voltage=%d\n",
++				  i, fuse_volt[i], i - 1, fuse_volt[i - 1],
++				  i, fuse_volt[i - 1]);
++			fuse_volt[i] = fuse_volt[i - 1];
++		}
++	}
++
++	/* Determine highest corner mapped to each fuse corner */
++	j = vreg->fuse_corner_count - 1;
++	for (i = vreg->corner_count - 1; i >= 0; i--) {
++		if (vreg->corner[i].cpr_fuse_corner == j) {
++			fmax_corner[j] = i;
++			j--;
++		}
++	}
++
++	if (j >= 0) {
++		cpr3_err(vreg, "invalid fuse corner mapping\n");
++		rc = -EINVAL;
++		goto done;
++	}
++
++	/*
++	 * Interpolation is not possible for corners mapped to the lowest fuse
++	 * corner so use the fuse corner value directly.
++	 */
++	for (i = 0; i <= fmax_corner[0]; i++)
++		vreg->corner[i].open_loop_volt = fuse_volt[0];
++
++	/* Interpolate voltages for the higher fuse corners. */
++	for (i = 1; i < vreg->fuse_corner_count; i++) {
++		freq_low = vreg->corner[fmax_corner[i - 1]].proc_freq;
++		volt_low = fuse_volt[i - 1];
++		freq_high = vreg->corner[fmax_corner[i]].proc_freq;
++		volt_high = fuse_volt[i];
++
++		for (j = fmax_corner[i - 1] + 1; j <= fmax_corner[i]; j++)
++			vreg->corner[j].open_loop_volt = cpr3_interpolate(
++				freq_low, volt_low, freq_high, volt_high,
++				vreg->corner[j].proc_freq);
++	}
++
++done:
++	if (rc == 0) {
++		cpr3_debug(vreg, "unadjusted per-corner open-loop voltages:\n");
++		for (i = 0; i < vreg->corner_count; i++)
++			cpr3_debug(vreg, "open-loop[%2d] = %d uV\n", i,
++				   vreg->corner[i].open_loop_volt);
++
++		rc = cpr3_adjust_open_loop_voltages(vreg);
++		if (rc)
++			cpr3_err(vreg,
++				"open-loop voltage adjustment failed, rc=%d\n",
++				 rc);
++	}
++
++	kfree(fuse_volt);
++	kfree(fmax_corner);
++	return rc;
++}
++
++/**
++ * cpr3_npu_print_settings() - print out NPU CPR configuration settings into
++ *		the kernel log for debugging purposes
++ * @vreg:		Pointer to the CPR3 regulator
++ */
++static void cpr3_npu_print_settings(struct cpr3_regulator *vreg)
++{
++	struct cpr3_corner *corner;
++	int i;
++
++	cpr3_debug(vreg,
++		"Corner: Frequency (Hz), Fuse Corner, Floor (uV), \
++		Open-Loop (uV), Ceiling (uV)\n");
++	for (i = 0; i < vreg->corner_count; i++) {
++		corner = &vreg->corner[i];
++		cpr3_debug(vreg, "%3d: %10u, %2d, %7d, %7d, %7d\n",
++			   i, corner->proc_freq, corner->cpr_fuse_corner,
++			   corner->floor_volt, corner->open_loop_volt,
++			   corner->ceiling_volt);
++	}
++
++	if (vreg->thread->ctrl->apm)
++		cpr3_debug(vreg, "APM threshold = %d uV, APM adjust = %d uV\n",
++			   vreg->thread->ctrl->apm_threshold_volt,
++			   vreg->thread->ctrl->apm_adj_volt);
++}
++
++/**
++ * cpr3_ipq807x_npu_calc_temp_based_ol_voltages() - Calculate the open loop
++ * voltages based on temperature based correction margins
++ * @vreg:               Pointer to the CPR3 regulator
++ */
++
++static int
++cpr3_ipq807x_npu_calc_temp_based_ol_voltages(struct cpr3_regulator *vreg,
++						bool temp_correction)
++{
++	int rc, i;
++
++	rc = cpr3_ipq807x_npu_calculate_open_loop_voltages(vreg,
++							temp_correction);
++	if (rc) {
++		cpr3_err(vreg,
++			"unable to calculate open-loop voltages, rc=%d\n", rc);
++		return rc;
++	}
++
++	rc = cpr3_limit_open_loop_voltages(vreg);
++	if (rc) {
++		cpr3_err(vreg, "unable to limit open-loop voltages, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	cpr3_open_loop_voltage_as_ceiling(vreg);
++
++	rc = cpr3_limit_floor_voltages(vreg);
++	if (rc) {
++		cpr3_err(vreg, "unable to limit floor voltages, rc=%d\n", rc);
++		return rc;
++	}
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		if (temp_correction)
++			vreg->corner[i].cold_temp_open_loop_volt =
++				vreg->corner[i].open_loop_volt;
++		else
++			vreg->corner[i].normal_temp_open_loop_volt =
++				vreg->corner[i].open_loop_volt;
++	}
++
++	cpr3_npu_print_settings(vreg);
++
++	return rc;
++}
++
++/**
++ * cpr3_npu_init_thread() - perform steps necessary to initialize the
++ *		configuration data for a CPR3 thread
++ * @thread:		Pointer to the CPR3 thread
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_npu_init_thread(struct cpr3_thread *thread)
++{
++	int rc;
++
++	rc = cpr3_parse_common_thread_data(thread);
++	if (rc) {
++		cpr3_err(thread->ctrl,
++			"thread %u CPR thread data from DT- failed, rc=%d\n",
++			 thread->thread_id, rc);
++		return rc;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_npu_init_regulator() - perform all steps necessary to initialize the
++ *		configuration data for a CPR3 regulator
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_npu_init_regulator(struct cpr3_regulator *vreg)
++{
++	struct cpr3_ipq807x_npu_fuses *fuse;
++	int rc, cold_temp = 0;
++	bool can_adj_cold_temp = cpr3_can_adjust_cold_temp(vreg);
++
++	rc = cpr3_ipq807x_npu_read_fuse_data(vreg);
++	if (rc) {
++		cpr3_err(vreg, "unable to read CPR fuse data, rc=%d\n", rc);
++		return rc;
++	}
++
++	fuse = vreg->platform_fuses;
++
++	rc = cpr3_npu_parse_corner_data(vreg);
++	if (rc) {
++		cpr3_err(vreg,
++			"Cannot read CPR corner data from DT, rc=%d\n", rc);
++		return rc;
++	}
++
++	rc = cpr3_mem_acc_init(vreg);
++	if (rc) {
++		if (rc != -EPROBE_DEFER)
++			cpr3_err(vreg,
++			"Cannot initialize mem-acc regulator settings, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	if (can_adj_cold_temp) {
++		rc = cpr3_ipq807x_npu_calc_temp_based_ol_voltages(vreg, true);
++		if (rc) {
++			cpr3_err(vreg,
++			"unable to calculate open-loop voltages, rc=%d\n", rc);
++			return rc;
++		}
++	}
++
++	rc = cpr3_ipq807x_npu_calc_temp_based_ol_voltages(vreg, false);
++	if (rc) {
++		cpr3_err(vreg,
++			"unable to calculate open-loop voltages, rc=%d\n", rc);
++		return rc;
++	}
++
++	if (can_adj_cold_temp) {
++		cpr3_info(vreg,
++		"Normal and Cold condition init done. Default to normal.\n");
++
++		rc = cpr3_get_cold_temp_threshold(vreg, &cold_temp);
++		if (rc) {
++			cpr3_err(vreg,
++			"Get cold temperature threshold failed, rc=%d\n", rc);
++			return rc;
++		}
++		register_low_temp_notif(NPU_TSENS, cold_temp,
++							cpr3_npu_temp_notify);
++	}
++
++	return rc;
++}
++
++/**
++ * cpr3_npu_init_controller() - perform NPU CPR3 controller specific
++ *		initializations
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_npu_init_controller(struct cpr3_controller *ctrl)
++{
++	int rc;
++
++	rc = cpr3_parse_open_loop_common_ctrl_data(ctrl);
++	if (rc) {
++		if (rc != -EPROBE_DEFER)
++			cpr3_err(ctrl, "unable to parse common controller data, rc=%d\n",
++				 rc);
++		return rc;
++	}
++
++	ctrl->ctrl_type = CPR_CTRL_TYPE_CPR3;
++	ctrl->supports_hw_closed_loop = false;
++
++	return 0;
++}
++
++static const struct cpr3_reg_data ipq807x_cpr_npu = {
++	.cpr_valid_fuse_count = IPQ807x_NPU_FUSE_CORNERS,
++	.init_voltage_param = ipq807x_npu_init_voltage_param,
++	.fuse_ref_volt = ipq807x_npu_fuse_ref_volt,
++	.fuse_step_volt = IPQ807x_NPU_FUSE_STEP_VOLT,
++	.cpr_clk_rate = IPQ807x_NPU_CPR_CLOCK_RATE,
++};
++
++static const struct cpr3_reg_data ipq817x_cpr_npu = {
++	.cpr_valid_fuse_count = IPQ817x_NPU_FUSE_CORNERS,
++	.init_voltage_param = ipq807x_npu_init_voltage_param,
++	.fuse_ref_volt = ipq807x_npu_fuse_ref_volt,
++	.fuse_step_volt = IPQ807x_NPU_FUSE_STEP_VOLT,
++	.cpr_clk_rate = IPQ807x_NPU_CPR_CLOCK_RATE,
++};
++
++static const struct cpr3_reg_data ipq9574_cpr_npu = {
++	.cpr_valid_fuse_count = IPQ9574_NPU_FUSE_CORNERS,
++	.init_voltage_param = ipq9574_npu_init_voltage_param,
++	.fuse_ref_volt = ipq9574_npu_fuse_ref_volt,
++	.fuse_step_volt = IPQ9574_NPU_FUSE_STEP_VOLT,
++	.cpr_clk_rate = IPQ9574_NPU_CPR_CLOCK_RATE,
++};
++
++static struct of_device_id cpr3_regulator_match_table[] = {
++	{
++		.compatible = "qcom,cpr3-ipq807x-npu-regulator",
++		.data = &ipq807x_cpr_npu
++	},
++	{
++		.compatible = "qcom,cpr3-ipq817x-npu-regulator",
++		.data = &ipq817x_cpr_npu
++	},
++	{
++		.compatible = "qcom,cpr3-ipq9574-npu-regulator",
++		.data = &ipq9574_cpr_npu
++	},
++	{}
++};
++
++static int cpr3_npu_regulator_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct cpr3_controller *ctrl;
++	int i, rc;
++	const struct of_device_id *match;
++	struct cpr3_reg_data *cpr_data;
++
++	if (!dev->of_node) {
++		dev_err(dev, "Device tree node is missing\n");
++		return -EINVAL;
++	}
++
++	ctrl = devm_kzalloc(dev, sizeof(*ctrl), GFP_KERNEL);
++	if (!ctrl)
++		return -ENOMEM;
++	g_ctrl = ctrl;
++
++	match = of_match_device(cpr3_regulator_match_table, &pdev->dev);
++	if (!match)
++		return -ENODEV;
++
++	cpr_data = (struct cpr3_reg_data *)match->data;
++	g_valid_npu_fuse_count = cpr_data->cpr_valid_fuse_count;
++	dev_info(dev, "NPU CPR valid fuse count: %d\n", g_valid_npu_fuse_count);
++	ctrl->cpr_clock_rate = cpr_data->cpr_clk_rate;
++
++	ctrl->dev = dev;
++	/* Set to false later if anything precludes CPR operation. */
++	ctrl->cpr_allowed_hw = true;
++
++	rc = of_property_read_string(dev->of_node, "qcom,cpr-ctrl-name",
++				     &ctrl->name);
++	if (rc) {
++		cpr3_err(ctrl, "unable to read qcom,cpr-ctrl-name, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	rc = cpr3_map_fuse_base(ctrl, pdev);
++	if (rc) {
++		cpr3_err(ctrl, "could not map fuse base address\n");
++		return rc;
++	}
++
++	rc = cpr3_read_tcsr_setting(ctrl, pdev, IPQ807x_NPU_CPR_TCSR_START,
++				    IPQ807x_NPU_CPR_TCSR_END);
++	if (rc) {
++		cpr3_err(ctrl, "could not read CPR tcsr rsetting\n");
++		return rc;
++	}
++
++	rc = cpr3_allocate_threads(ctrl, 0, 0);
++	if (rc) {
++		cpr3_err(ctrl, "failed to allocate CPR thread array, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	if (ctrl->thread_count != 1) {
++		cpr3_err(ctrl, "expected 1 thread but found %d\n",
++			 ctrl->thread_count);
++		return -EINVAL;
++	}
++
++	rc = cpr3_npu_init_controller(ctrl);
++	if (rc) {
++		if (rc != -EPROBE_DEFER)
++			cpr3_err(ctrl, "failed to initialize CPR controller parameters, rc=%d\n",
++				 rc);
++		return rc;
++	}
++
++	rc = cpr3_npu_init_thread(&ctrl->thread[0]);
++	if (rc) {
++		cpr3_err(ctrl, "thread initialization failed, rc=%d\n", rc);
++		return rc;
++	}
++
++	for (i = 0; i < ctrl->thread[0].vreg_count; i++) {
++		ctrl->thread[0].vreg[i].cpr3_regulator_data = cpr_data;
++		rc = cpr3_npu_init_regulator(&ctrl->thread[0].vreg[i]);
++		if (rc) {
++			cpr3_err(&ctrl->thread[0].vreg[i], "regulator initialization failed, rc=%d\n",
++				 rc);
++			return rc;
++		}
++	}
++
++	platform_set_drvdata(pdev, ctrl);
++
++	return cpr3_open_loop_regulator_register(pdev, ctrl);
++}
++
++static int cpr3_npu_regulator_remove(struct platform_device *pdev)
++{
++	struct cpr3_controller *ctrl = platform_get_drvdata(pdev);
++
++	return cpr3_open_loop_regulator_unregister(ctrl);
++}
++
++static struct platform_driver cpr3_npu_regulator_driver = {
++	.driver		= {
++		.name		= "qcom,cpr3-npu-regulator",
++		.of_match_table	= cpr3_regulator_match_table,
++		.owner		= THIS_MODULE,
++	},
++	.probe		= cpr3_npu_regulator_probe,
++	.remove		= cpr3_npu_regulator_remove,
++};
++
++static int cpr3_regulator_init(void)
++{
++	return platform_driver_register(&cpr3_npu_regulator_driver);
++}
++arch_initcall(cpr3_regulator_init);
++
++static void cpr3_regulator_exit(void)
++{
++	platform_driver_unregister(&cpr3_npu_regulator_driver);
++}
++module_exit(cpr3_regulator_exit);
++
++MODULE_DESCRIPTION("QCOM CPR3 NPU regulator driver");
++MODULE_LICENSE("Dual BSD/GPLv2");
++MODULE_ALIAS("platform:npu-ipq807x");
+--- /dev/null
++++ b/drivers/regulator/cpr3-regulator.c
+@@ -0,0 +1,5111 @@
++/*
++ * Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#define pr_fmt(fmt) "%s: " fmt, __func__
++
++#include <linux/bitops.h>
++#include <linux/debugfs.h>
++#include <linux/delay.h>
++#include <linux/err.h>
++#include <linux/init.h>
++#include <linux/interrupt.h>
++#include <linux/io.h>
++#include <linux/kernel.h>
++#include <linux/ktime.h>
++#include <linux/list.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
++#include <linux/platform_device.h>
++#include <linux/pm_opp.h>
++#include <linux/slab.h>
++#include <linux/sort.h>
++#include <linux/string.h>
++#include <linux/uaccess.h>
++#include <linux/regulator/driver.h>
++#include <linux/regulator/machine.h>
++#include <linux/regulator/of_regulator.h>
++#include <linux/panic_notifier.h>
++
++#include "cpr3-regulator.h"
++
++#define CPR3_REGULATOR_CORNER_INVALID	(-1)
++#define CPR3_RO_MASK			GENMASK(CPR3_RO_COUNT - 1, 0)
++
++/* CPR3 registers */
++#define CPR3_REG_CPR_CTL			0x4
++#define CPR3_CPR_CTL_LOOP_EN_MASK		BIT(0)
++#define CPR3_CPR_CTL_LOOP_ENABLE		BIT(0)
++#define CPR3_CPR_CTL_LOOP_DISABLE		0
++#define CPR3_CPR_CTL_IDLE_CLOCKS_MASK		GENMASK(5, 1)
++#define CPR3_CPR_CTL_IDLE_CLOCKS_SHIFT		1
++#define CPR3_CPR_CTL_COUNT_MODE_MASK		GENMASK(7, 6)
++#define CPR3_CPR_CTL_COUNT_MODE_SHIFT		6
++#define CPR3_CPR_CTL_COUNT_MODE_ALL_AT_ONCE_MIN	0
++#define CPR3_CPR_CTL_COUNT_MODE_ALL_AT_ONCE_MAX	1
++#define CPR3_CPR_CTL_COUNT_MODE_STAGGERED	2
++#define CPR3_CPR_CTL_COUNT_MODE_ALL_AT_ONCE_AGE	3
++#define CPR3_CPR_CTL_COUNT_REPEAT_MASK		GENMASK(31, 9)
++#define CPR3_CPR_CTL_COUNT_REPEAT_SHIFT		9
++
++#define CPR3_REG_CPR_STATUS			0x8
++#define CPR3_CPR_STATUS_BUSY_MASK		BIT(0)
++#define CPR3_CPR_STATUS_AGING_MEASUREMENT_MASK	BIT(1)
++
++/*
++ * This register is not present on controllers that support HW closed-loop
++ * except CPR4 APSS controller.
++ */
++#define CPR3_REG_CPR_TIMER_AUTO_CONT		0xC
++
++#define CPR3_REG_CPR_STEP_QUOT			0x14
++#define CPR3_CPR_STEP_QUOT_MIN_MASK		GENMASK(5, 0)
++#define CPR3_CPR_STEP_QUOT_MIN_SHIFT		0
++#define CPR3_CPR_STEP_QUOT_MAX_MASK		GENMASK(11, 6)
++#define CPR3_CPR_STEP_QUOT_MAX_SHIFT		6
++
++#define CPR3_REG_GCNT(ro)			(0xA0 + 0x4 * (ro))
++
++#define CPR3_REG_SENSOR_BYPASS_WRITE(sensor)	(0xE0 + 0x4 * ((sensor) / 32))
++#define CPR3_REG_SENSOR_BYPASS_WRITE_BANK(bank)	(0xE0 + 0x4 * (bank))
++
++#define CPR3_REG_SENSOR_MASK_WRITE(sensor)	(0x120 + 0x4 * ((sensor) / 32))
++#define CPR3_REG_SENSOR_MASK_WRITE_BANK(bank)	(0x120 + 0x4 * (bank))
++#define CPR3_REG_SENSOR_MASK_READ(sensor)	(0x140 + 0x4 * ((sensor) / 32))
++
++#define CPR3_REG_SENSOR_OWNER(sensor)	(0x200 + 0x4 * (sensor))
++
++#define CPR3_REG_CONT_CMD		0x800
++#define CPR3_CONT_CMD_ACK		0x1
++#define CPR3_CONT_CMD_NACK		0x0
++
++#define CPR3_REG_THRESH(thread)		(0x808 + 0x440 * (thread))
++#define CPR3_THRESH_CONS_DOWN_MASK	GENMASK(3, 0)
++#define CPR3_THRESH_CONS_DOWN_SHIFT	0
++#define CPR3_THRESH_CONS_UP_MASK	GENMASK(7, 4)
++#define CPR3_THRESH_CONS_UP_SHIFT	4
++#define CPR3_THRESH_DOWN_THRESH_MASK	GENMASK(12, 8)
++#define CPR3_THRESH_DOWN_THRESH_SHIFT	8
++#define CPR3_THRESH_UP_THRESH_MASK	GENMASK(17, 13)
++#define CPR3_THRESH_UP_THRESH_SHIFT	13
++
++#define CPR3_REG_RO_MASK(thread)	(0x80C + 0x440 * (thread))
++
++#define CPR3_REG_RESULT0(thread)	(0x810 + 0x440 * (thread))
++#define CPR3_RESULT0_BUSY_MASK		BIT(0)
++#define CPR3_RESULT0_STEP_DN_MASK	BIT(1)
++#define CPR3_RESULT0_STEP_UP_MASK	BIT(2)
++#define CPR3_RESULT0_ERROR_STEPS_MASK	GENMASK(7, 3)
++#define CPR3_RESULT0_ERROR_STEPS_SHIFT	3
++#define CPR3_RESULT0_ERROR_MASK		GENMASK(19, 8)
++#define CPR3_RESULT0_ERROR_SHIFT	8
++#define CPR3_RESULT0_NEGATIVE_MASK	BIT(20)
++
++#define CPR3_REG_RESULT1(thread)	(0x814 + 0x440 * (thread))
++#define CPR3_RESULT1_QUOT_MIN_MASK	GENMASK(11, 0)
++#define CPR3_RESULT1_QUOT_MIN_SHIFT	0
++#define CPR3_RESULT1_QUOT_MAX_MASK	GENMASK(23, 12)
++#define CPR3_RESULT1_QUOT_MAX_SHIFT	12
++#define CPR3_RESULT1_RO_MIN_MASK	GENMASK(27, 24)
++#define CPR3_RESULT1_RO_MIN_SHIFT	24
++#define CPR3_RESULT1_RO_MAX_MASK	GENMASK(31, 28)
++#define CPR3_RESULT1_RO_MAX_SHIFT	28
++
++#define CPR3_REG_RESULT2(thread)		(0x818 + 0x440 * (thread))
++#define CPR3_RESULT2_STEP_QUOT_MIN_MASK		GENMASK(5, 0)
++#define CPR3_RESULT2_STEP_QUOT_MIN_SHIFT	0
++#define CPR3_RESULT2_STEP_QUOT_MAX_MASK		GENMASK(11, 6)
++#define CPR3_RESULT2_STEP_QUOT_MAX_SHIFT	6
++#define CPR3_RESULT2_SENSOR_MIN_MASK		GENMASK(23, 16)
++#define CPR3_RESULT2_SENSOR_MIN_SHIFT		16
++#define CPR3_RESULT2_SENSOR_MAX_MASK		GENMASK(31, 24)
++#define CPR3_RESULT2_SENSOR_MAX_SHIFT		24
++
++#define CPR3_REG_IRQ_EN			0x81C
++#define CPR3_REG_IRQ_CLEAR		0x820
++#define CPR3_REG_IRQ_STATUS		0x824
++#define CPR3_IRQ_UP			BIT(3)
++#define CPR3_IRQ_MID			BIT(2)
++#define CPR3_IRQ_DOWN			BIT(1)
++
++#define CPR3_REG_TARGET_QUOT(thread, ro) \
++					(0x840 + 0x440 * (thread) + 0x4 * (ro))
++
++/* Registers found only on controllers that support HW closed-loop. */
++#define CPR3_REG_PD_THROTTLE		0xE8
++#define CPR3_PD_THROTTLE_DISABLE	0x0
++
++#define CPR3_REG_HW_CLOSED_LOOP		0x3000
++#define CPR3_HW_CLOSED_LOOP_ENABLE	0x0
++#define CPR3_HW_CLOSED_LOOP_DISABLE	0x1
++
++#define CPR3_REG_CPR_TIMER_MID_CONT	0x3004
++#define CPR3_REG_CPR_TIMER_UP_DN_CONT	0x3008
++
++#define CPR3_REG_LAST_MEASUREMENT		0x7F8
++#define CPR3_LAST_MEASUREMENT_THREAD_DN_SHIFT	0
++#define CPR3_LAST_MEASUREMENT_THREAD_UP_SHIFT	4
++#define CPR3_LAST_MEASUREMENT_THREAD_DN(thread) \
++		(BIT(thread) << CPR3_LAST_MEASUREMENT_THREAD_DN_SHIFT)
++#define CPR3_LAST_MEASUREMENT_THREAD_UP(thread) \
++		(BIT(thread) << CPR3_LAST_MEASUREMENT_THREAD_UP_SHIFT)
++#define CPR3_LAST_MEASUREMENT_AGGR_DN		BIT(8)
++#define CPR3_LAST_MEASUREMENT_AGGR_MID		BIT(9)
++#define CPR3_LAST_MEASUREMENT_AGGR_UP		BIT(10)
++#define CPR3_LAST_MEASUREMENT_VALID		BIT(11)
++#define CPR3_LAST_MEASUREMENT_SAW_ERROR		BIT(12)
++#define CPR3_LAST_MEASUREMENT_PD_BYPASS_MASK	GENMASK(23, 16)
++#define CPR3_LAST_MEASUREMENT_PD_BYPASS_SHIFT	16
++
++/* CPR4 controller specific registers and bit definitions */
++#define CPR4_REG_CPR_TIMER_CLAMP			0x10
++#define CPR4_CPR_TIMER_CLAMP_THREAD_AGGREGATION_EN	BIT(27)
++
++#define CPR4_REG_MISC				0x700
++#define CPR4_MISC_MARGIN_TABLE_ROW_SELECT_MASK	GENMASK(23, 20)
++#define CPR4_MISC_MARGIN_TABLE_ROW_SELECT_SHIFT	20
++#define CPR4_MISC_TEMP_SENSOR_ID_START_MASK	GENMASK(27, 24)
++#define CPR4_MISC_TEMP_SENSOR_ID_START_SHIFT	24
++#define CPR4_MISC_TEMP_SENSOR_ID_END_MASK	GENMASK(31, 28)
++#define CPR4_MISC_TEMP_SENSOR_ID_END_SHIFT	28
++
++#define CPR4_REG_SAW_ERROR_STEP_LIMIT		0x7A4
++#define CPR4_SAW_ERROR_STEP_LIMIT_UP_MASK	GENMASK(4, 0)
++#define CPR4_SAW_ERROR_STEP_LIMIT_UP_SHIFT	0
++#define CPR4_SAW_ERROR_STEP_LIMIT_DN_MASK	GENMASK(9, 5)
++#define CPR4_SAW_ERROR_STEP_LIMIT_DN_SHIFT	5
++
++#define CPR4_REG_MARGIN_TEMP_CORE_TIMERS			0x7A8
++#define CPR4_MARGIN_TEMP_CORE_TIMERS_SETTLE_VOLTAGE_COUNT_MASK	GENMASK(28, 18)
++#define CPR4_MARGIN_TEMP_CORE_TIMERS_SETTLE_VOLTAGE_COUNT_SHIFT	18
++
++#define CPR4_REG_MARGIN_TEMP_CORE(core)		(0x7AC + 0x4 * (core))
++#define CPR4_MARGIN_TEMP_CORE_ADJ_MASK		GENMASK(7, 0)
++#define CPR4_MARGIN_TEMP_CORE_ADJ_SHIFT		8
++
++#define CPR4_REG_MARGIN_TEMP_POINT0N1		0x7F0
++#define CPR4_MARGIN_TEMP_POINT0_MASK		GENMASK(11, 0)
++#define CPR4_MARGIN_TEMP_POINT0_SHIFT		0
++#define CPR4_MARGIN_TEMP_POINT1_MASK		GENMASK(23, 12)
++#define CPR4_MARGIN_TEMP_POINT1_SHIFT		12
++#define CPR4_REG_MARGIN_TEMP_POINT2		0x7F4
++#define CPR4_MARGIN_TEMP_POINT2_MASK		GENMASK(11, 0)
++#define CPR4_MARGIN_TEMP_POINT2_SHIFT		0
++
++#define CPR4_REG_MARGIN_ADJ_CTL					0x7F8
++#define CPR4_MARGIN_ADJ_CTL_BOOST_EN				BIT(0)
++#define CPR4_MARGIN_ADJ_CTL_CORE_ADJ_EN				BIT(1)
++#define CPR4_MARGIN_ADJ_CTL_TEMP_ADJ_EN				BIT(2)
++#define CPR4_MARGIN_ADJ_CTL_TIMER_SETTLE_VOLTAGE_EN		BIT(3)
++#define CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_EN_MASK		BIT(4)
++#define CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_ENABLE		BIT(4)
++#define CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_DISABLE		0
++#define CPR4_MARGIN_ADJ_CTL_PER_RO_KV_MARGIN_EN			BIT(7)
++#define CPR4_MARGIN_ADJ_CTL_KV_MARGIN_ADJ_EN			BIT(8)
++#define CPR4_MARGIN_ADJ_CTL_PMIC_STEP_SIZE_MASK			GENMASK(16, 12)
++#define CPR4_MARGIN_ADJ_CTL_PMIC_STEP_SIZE_SHIFT		12
++#define CPR4_MARGIN_ADJ_CTL_INITIAL_TEMP_BAND_MASK		GENMASK(21, 19)
++#define CPR4_MARGIN_ADJ_CTL_INITIAL_TEMP_BAND_SHIFT		19
++#define CPR4_MARGIN_ADJ_CTL_MAX_NUM_CORES_MASK			GENMASK(25, 22)
++#define CPR4_MARGIN_ADJ_CTL_MAX_NUM_CORES_SHIFT			22
++#define CPR4_MARGIN_ADJ_CTL_KV_MARGIN_ADJ_STEP_QUOT_MASK	GENMASK(31, 26)
++#define CPR4_MARGIN_ADJ_CTL_KV_MARGIN_ADJ_STEP_QUOT_SHIFT	26
++
++#define CPR4_REG_CPR_MASK_THREAD(thread)	(0x80C + 0x440 * (thread))
++#define CPR4_CPR_MASK_THREAD_DISABLE_THREAD		BIT(31)
++#define CPR4_CPR_MASK_THREAD_RO_MASK4THREAD_MASK	GENMASK(15, 0)
++
++/*
++ * The amount of time to wait for the CPR controller to become idle when
++ * performing an aging measurement.
++ */
++#define CPR3_AGING_MEASUREMENT_TIMEOUT_NS	5000000
++
++/*
++ * The number of individual aging measurements to perform which are then
++ * averaged together in order to determine the final aging adjustment value.
++ */
++#define CPR3_AGING_MEASUREMENT_ITERATIONS	16
++
++/*
++ * Aging measurements for the aged and unaged ring oscillators take place a few
++ * microseconds apart.  If the vdd-supply voltage fluctuates between the two
++ * measurements, then the difference between them will be incorrect.  The
++ * difference could end up too high or too low.  This constant defines the
++ * number of lowest and highest measurements to ignore when averaging.
++ */
++#define CPR3_AGING_MEASUREMENT_FILTER		3
++
++/*
++ * The number of times to attempt the full aging measurement sequence before
++ * declaring a measurement failure.
++ */
++#define CPR3_AGING_RETRY_COUNT			5
++
++/*
++ * The maximum time to wait in microseconds for a CPR register write to
++ * complete.
++ */
++#define CPR3_REGISTER_WRITE_DELAY_US		200
++
++static DEFINE_MUTEX(cpr3_controller_list_mutex);
++static LIST_HEAD(cpr3_controller_list);
++static struct dentry *cpr3_debugfs_base;
++
++/**
++ * cpr3_read() - read four bytes from the memory address specified
++ * @ctrl:		Pointer to the CPR3 controller
++ * @offset:		Offset in bytes from the CPR3 controller's base address
++ *
++ * Return: memory address value
++ */
++static inline u32 cpr3_read(struct cpr3_controller *ctrl, u32 offset)
++{
++	if (!ctrl->cpr_enabled) {
++		cpr3_err(ctrl, "CPR register reads are not possible when CPR clocks are disabled\n");
++		return 0;
++	}
++
++	return readl_relaxed(ctrl->cpr_ctrl_base + offset);
++}
++
++/**
++ * cpr3_write() - write four bytes to the memory address specified
++ * @ctrl:		Pointer to the CPR3 controller
++ * @offset:		Offset in bytes from the CPR3 controller's base address
++ * @value:		Value to write to the memory address
++ *
++ * Return: none
++ */
++static inline void cpr3_write(struct cpr3_controller *ctrl, u32 offset,
++				u32 value)
++{
++	if (!ctrl->cpr_enabled) {
++		cpr3_err(ctrl, "CPR register writes are not possible when CPR clocks are disabled\n");
++		return;
++	}
++
++	writel_relaxed(value, ctrl->cpr_ctrl_base + offset);
++}
++
++/**
++ * cpr3_masked_write() - perform a read-modify-write sequence so that only
++ *		masked bits are modified
++ * @ctrl:		Pointer to the CPR3 controller
++ * @offset:		Offset in bytes from the CPR3 controller's base address
++ * @mask:		Mask identifying the bits that should be modified
++ * @value:		Value to write to the memory address
++ *
++ * Return: none
++ */
++static inline void cpr3_masked_write(struct cpr3_controller *ctrl, u32 offset,
++				u32 mask, u32 value)
++{
++	u32 reg_val, orig_val;
++
++	if (!ctrl->cpr_enabled) {
++		cpr3_err(ctrl, "CPR register writes are not possible when CPR clocks are disabled\n");
++		return;
++	}
++
++	reg_val = orig_val = readl_relaxed(ctrl->cpr_ctrl_base + offset);
++	reg_val &= ~mask;
++	reg_val |= value & mask;
++
++	if (reg_val != orig_val)
++		writel_relaxed(reg_val, ctrl->cpr_ctrl_base + offset);
++}
++
++/**
++ * cpr3_ctrl_loop_enable() - enable the CPR sensing loop for a given controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: none
++ */
++static inline void cpr3_ctrl_loop_enable(struct cpr3_controller *ctrl)
++{
++	if (ctrl->cpr_enabled && !(ctrl->aggr_corner.sdelta
++		&& ctrl->aggr_corner.sdelta->allow_boost))
++		cpr3_masked_write(ctrl, CPR3_REG_CPR_CTL,
++			CPR3_CPR_CTL_LOOP_EN_MASK, CPR3_CPR_CTL_LOOP_ENABLE);
++}
++
++/**
++ * cpr3_ctrl_loop_disable() - disable the CPR sensing loop for a given
++ *		controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: none
++ */
++static inline void cpr3_ctrl_loop_disable(struct cpr3_controller *ctrl)
++{
++	if (ctrl->cpr_enabled)
++		cpr3_masked_write(ctrl, CPR3_REG_CPR_CTL,
++			CPR3_CPR_CTL_LOOP_EN_MASK, CPR3_CPR_CTL_LOOP_DISABLE);
++}
++
++/**
++ * cpr3_clock_enable() - prepare and enable all clocks used by this CPR3
++ *		controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_clock_enable(struct cpr3_controller *ctrl)
++{
++	int rc;
++
++	rc = clk_prepare_enable(ctrl->bus_clk);
++	if (rc) {
++		cpr3_err(ctrl, "failed to enable bus clock, rc=%d\n", rc);
++		return rc;
++	}
++
++	rc = clk_prepare_enable(ctrl->iface_clk);
++	if (rc) {
++		cpr3_err(ctrl, "failed to enable interface clock, rc=%d\n", rc);
++		clk_disable_unprepare(ctrl->bus_clk);
++		return rc;
++	}
++
++	rc = clk_prepare_enable(ctrl->core_clk);
++	if (rc) {
++		cpr3_err(ctrl, "failed to enable core clock, rc=%d\n", rc);
++		clk_disable_unprepare(ctrl->iface_clk);
++		clk_disable_unprepare(ctrl->bus_clk);
++		return rc;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_clock_disable() - disable and unprepare all clocks used by this CPR3
++ *		controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: none
++ */
++static void cpr3_clock_disable(struct cpr3_controller *ctrl)
++{
++	clk_disable_unprepare(ctrl->core_clk);
++	clk_disable_unprepare(ctrl->iface_clk);
++	clk_disable_unprepare(ctrl->bus_clk);
++}
++
++/**
++ * cpr3_ctrl_clear_cpr4_config() - clear the CPR4 register configuration
++ *		programmed for current aggregated corner of a given controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static inline int cpr3_ctrl_clear_cpr4_config(struct cpr3_controller *ctrl)
++{
++	struct cpr4_sdelta *aggr_sdelta = ctrl->aggr_corner.sdelta;
++	bool cpr_enabled = ctrl->cpr_enabled;
++	int i, rc = 0;
++
++	if (!aggr_sdelta || !(aggr_sdelta->allow_core_count_adj
++		|| aggr_sdelta->allow_temp_adj || aggr_sdelta->allow_boost))
++		/* cpr4 features are not enabled */
++		return 0;
++
++	/* Ensure that CPR clocks are enabled before writing to registers. */
++	if (!cpr_enabled) {
++		rc = cpr3_clock_enable(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "clock enable failed, rc=%d\n", rc);
++			return rc;
++		}
++		ctrl->cpr_enabled = true;
++	}
++
++	/*
++	 * Clear feature enable configuration made for current
++	 * aggregated corner.
++	 */
++	cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++		CPR4_MARGIN_ADJ_CTL_MAX_NUM_CORES_MASK
++		| CPR4_MARGIN_ADJ_CTL_CORE_ADJ_EN
++		| CPR4_MARGIN_ADJ_CTL_TEMP_ADJ_EN
++		| CPR4_MARGIN_ADJ_CTL_KV_MARGIN_ADJ_EN
++		| CPR4_MARGIN_ADJ_CTL_BOOST_EN
++		| CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_EN_MASK, 0);
++
++	cpr3_masked_write(ctrl, CPR4_REG_MISC,
++			CPR4_MISC_MARGIN_TABLE_ROW_SELECT_MASK,
++			0 << CPR4_MISC_MARGIN_TABLE_ROW_SELECT_SHIFT);
++
++	for (i = 0; i <= aggr_sdelta->max_core_count; i++) {
++		/* Clear voltage margin adjustments programmed in TEMP_COREi */
++		cpr3_write(ctrl, CPR4_REG_MARGIN_TEMP_CORE(i), 0);
++	}
++
++	/* Turn off CPR clocks if they were off before this function call. */
++	if (!cpr_enabled) {
++		cpr3_clock_disable(ctrl);
++		ctrl->cpr_enabled = false;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_closed_loop_enable() - enable logical CPR closed-loop operation
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_closed_loop_enable(struct cpr3_controller *ctrl)
++{
++	int rc;
++
++	if (!ctrl->cpr_allowed_hw || !ctrl->cpr_allowed_sw) {
++		cpr3_err(ctrl, "cannot enable closed-loop CPR operation because it is disallowed\n");
++		return -EPERM;
++	} else if (ctrl->cpr_enabled) {
++		/* Already enabled */
++		return 0;
++	} else if (ctrl->cpr_suspended) {
++		/*
++		 * CPR must remain disabled as the system is entering suspend.
++		 */
++		return 0;
++	}
++
++	rc = cpr3_clock_enable(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "unable to enable CPR clocks, rc=%d\n", rc);
++		return rc;
++	}
++
++	ctrl->cpr_enabled = true;
++	cpr3_debug(ctrl, "CPR closed-loop operation enabled\n");
++
++	return 0;
++}
++
++/**
++ * cpr3_closed_loop_disable() - disable logical CPR closed-loop operation
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static inline int cpr3_closed_loop_disable(struct cpr3_controller *ctrl)
++{
++	if (!ctrl->cpr_enabled) {
++		/* Already disabled */
++		return 0;
++	}
++
++	cpr3_clock_disable(ctrl);
++	ctrl->cpr_enabled = false;
++	cpr3_debug(ctrl, "CPR closed-loop operation disabled\n");
++
++	return 0;
++}
++
++/**
++ * cpr3_regulator_get_gcnt() - returns the GCNT register value corresponding
++ *		to the clock rate and sensor time of the CPR3 controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: GCNT value
++ */
++static u32 cpr3_regulator_get_gcnt(struct cpr3_controller *ctrl)
++{
++	u64 temp;
++	unsigned int remainder;
++	u32 gcnt;
++
++	temp = (u64)ctrl->cpr_clock_rate * (u64)ctrl->sensor_time;
++	remainder = do_div(temp, 1000000000);
++	if (remainder)
++		temp++;
++	/*
++	 * GCNT == 0 corresponds to a single ref clock measurement interval so
++	 * offset GCNT values by 1.
++	 */
++	gcnt = temp - 1;
++
++	return gcnt;
++}
++
++/**
++ * cpr3_regulator_init_thread() - performs hardware initialization of CPR
++ *		thread registers
++ * @thread:		Pointer to the CPR3 thread
++ *
++ * CPR interface/bus clocks must be enabled before calling this function.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_init_thread(struct cpr3_thread *thread)
++{
++	u32 reg;
++
++	reg = (thread->consecutive_up << CPR3_THRESH_CONS_UP_SHIFT)
++		& CPR3_THRESH_CONS_UP_MASK;
++	reg |= (thread->consecutive_down << CPR3_THRESH_CONS_DOWN_SHIFT)
++		& CPR3_THRESH_CONS_DOWN_MASK;
++	reg |= (thread->up_threshold << CPR3_THRESH_UP_THRESH_SHIFT)
++		& CPR3_THRESH_UP_THRESH_MASK;
++	reg |= (thread->down_threshold << CPR3_THRESH_DOWN_THRESH_SHIFT)
++		& CPR3_THRESH_DOWN_THRESH_MASK;
++
++	cpr3_write(thread->ctrl, CPR3_REG_THRESH(thread->thread_id), reg);
++
++	/*
++	 * Mask all RO's initially so that unused thread doesn't contribute
++	 * to closed-loop voltage.
++	 */
++	cpr3_write(thread->ctrl, CPR3_REG_RO_MASK(thread->thread_id),
++		CPR3_RO_MASK);
++
++	return 0;
++}
++
++/**
++ * cpr4_regulator_init_temp_points() - performs hardware initialization of CPR4
++ *		registers to track tsen temperature data and also specify the
++ *		temperature band range values to apply different voltage margins
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * CPR interface/bus clocks must be enabled before calling this function.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_regulator_init_temp_points(struct cpr3_controller *ctrl)
++{
++	if (!ctrl->allow_temp_adj)
++		return 0;
++
++	cpr3_masked_write(ctrl, CPR4_REG_MISC,
++				CPR4_MISC_TEMP_SENSOR_ID_START_MASK,
++				ctrl->temp_sensor_id_start
++				<< CPR4_MISC_TEMP_SENSOR_ID_START_SHIFT);
++
++	cpr3_masked_write(ctrl, CPR4_REG_MISC,
++				CPR4_MISC_TEMP_SENSOR_ID_END_MASK,
++				ctrl->temp_sensor_id_end
++				<< CPR4_MISC_TEMP_SENSOR_ID_END_SHIFT);
++
++	cpr3_masked_write(ctrl, CPR4_REG_MARGIN_TEMP_POINT2,
++		CPR4_MARGIN_TEMP_POINT2_MASK,
++		(ctrl->temp_band_count == 4 ? ctrl->temp_points[2] : 0x7FF)
++		<< CPR4_MARGIN_TEMP_POINT2_SHIFT);
++
++	cpr3_masked_write(ctrl, CPR4_REG_MARGIN_TEMP_POINT0N1,
++		CPR4_MARGIN_TEMP_POINT1_MASK,
++		(ctrl->temp_band_count >= 3 ? ctrl->temp_points[1] : 0x7FF)
++		<< CPR4_MARGIN_TEMP_POINT1_SHIFT);
++
++	cpr3_masked_write(ctrl, CPR4_REG_MARGIN_TEMP_POINT0N1,
++		CPR4_MARGIN_TEMP_POINT0_MASK,
++		(ctrl->temp_band_count >= 2 ? ctrl->temp_points[0] : 0x7FF)
++		<< CPR4_MARGIN_TEMP_POINT0_SHIFT);
++	return 0;
++}
++
++/**
++ * cpr3_regulator_init_cpr4() - performs hardware initialization at the
++ *		controller and thread level required for CPR4 operation.
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * CPR interface/bus clocks must be enabled before calling this function.
++ * This function allocates sdelta structures and sdelta tables for aggregated
++ * corners of the controller and its threads.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_init_cpr4(struct cpr3_controller *ctrl)
++{
++	struct cpr3_thread *thread;
++	struct cpr3_regulator *vreg;
++	struct cpr4_sdelta *sdelta;
++	int i, j, ctrl_max_core_count, thread_max_core_count, rc = 0;
++	bool ctrl_valid_sdelta, thread_valid_sdelta;
++	u32 pmic_step_size = 1;
++	int thread_id = 0;
++	u64 temp;
++
++	if (ctrl->supports_hw_closed_loop) {
++		if (ctrl->saw_use_unit_mV)
++			pmic_step_size = ctrl->step_volt / 1000;
++		cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++				  CPR4_MARGIN_ADJ_CTL_PMIC_STEP_SIZE_MASK,
++				  (pmic_step_size
++				  << CPR4_MARGIN_ADJ_CTL_PMIC_STEP_SIZE_SHIFT));
++
++		cpr3_masked_write(ctrl, CPR4_REG_SAW_ERROR_STEP_LIMIT,
++				  CPR4_SAW_ERROR_STEP_LIMIT_DN_MASK,
++				  (ctrl->down_error_step_limit
++					<< CPR4_SAW_ERROR_STEP_LIMIT_DN_SHIFT));
++
++		cpr3_masked_write(ctrl, CPR4_REG_SAW_ERROR_STEP_LIMIT,
++				  CPR4_SAW_ERROR_STEP_LIMIT_UP_MASK,
++				  (ctrl->up_error_step_limit
++					<< CPR4_SAW_ERROR_STEP_LIMIT_UP_SHIFT));
++
++		/*
++		 * Enable thread aggregation regardless of which threads are
++		 * enabled or disabled.
++		 */
++		cpr3_masked_write(ctrl, CPR4_REG_CPR_TIMER_CLAMP,
++				  CPR4_CPR_TIMER_CLAMP_THREAD_AGGREGATION_EN,
++				  CPR4_CPR_TIMER_CLAMP_THREAD_AGGREGATION_EN);
++
++		switch (ctrl->thread_count) {
++		case 0:
++			/* Disable both threads */
++			cpr3_masked_write(ctrl, CPR4_REG_CPR_MASK_THREAD(0),
++				CPR4_CPR_MASK_THREAD_DISABLE_THREAD
++				    | CPR4_CPR_MASK_THREAD_RO_MASK4THREAD_MASK,
++				CPR4_CPR_MASK_THREAD_DISABLE_THREAD
++				    | CPR4_CPR_MASK_THREAD_RO_MASK4THREAD_MASK);
++
++			cpr3_masked_write(ctrl, CPR4_REG_CPR_MASK_THREAD(1),
++				CPR4_CPR_MASK_THREAD_DISABLE_THREAD
++				    | CPR4_CPR_MASK_THREAD_RO_MASK4THREAD_MASK,
++				CPR4_CPR_MASK_THREAD_DISABLE_THREAD
++				    | CPR4_CPR_MASK_THREAD_RO_MASK4THREAD_MASK);
++			break;
++		case 1:
++			/* Disable unused thread */
++			thread_id = ctrl->thread[0].thread_id ? 0 : 1;
++			cpr3_masked_write(ctrl,
++				CPR4_REG_CPR_MASK_THREAD(thread_id),
++				CPR4_CPR_MASK_THREAD_DISABLE_THREAD
++				    | CPR4_CPR_MASK_THREAD_RO_MASK4THREAD_MASK,
++				CPR4_CPR_MASK_THREAD_DISABLE_THREAD
++				    | CPR4_CPR_MASK_THREAD_RO_MASK4THREAD_MASK);
++			break;
++		}
++	}
++
++	if (!ctrl->allow_core_count_adj && !ctrl->allow_temp_adj
++		&& !ctrl->allow_boost) {
++		/*
++		 * Skip below configuration as none of the features
++		 * are enabled.
++		 */
++		return rc;
++	}
++
++	if (ctrl->supports_hw_closed_loop)
++		cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++				  CPR4_MARGIN_ADJ_CTL_TIMER_SETTLE_VOLTAGE_EN,
++				  CPR4_MARGIN_ADJ_CTL_TIMER_SETTLE_VOLTAGE_EN);
++
++	cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++			CPR4_MARGIN_ADJ_CTL_KV_MARGIN_ADJ_STEP_QUOT_MASK,
++			ctrl->step_quot_fixed
++			<< CPR4_MARGIN_ADJ_CTL_KV_MARGIN_ADJ_STEP_QUOT_SHIFT);
++
++	cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++			CPR4_MARGIN_ADJ_CTL_PER_RO_KV_MARGIN_EN,
++			(ctrl->use_dynamic_step_quot
++			? CPR4_MARGIN_ADJ_CTL_PER_RO_KV_MARGIN_EN : 0));
++
++	cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++			CPR4_MARGIN_ADJ_CTL_INITIAL_TEMP_BAND_MASK,
++			ctrl->initial_temp_band
++			<< CPR4_MARGIN_ADJ_CTL_INITIAL_TEMP_BAND_SHIFT);
++
++	rc = cpr4_regulator_init_temp_points(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "initialize temp points failed, rc=%d\n", rc);
++		return rc;
++	}
++
++	if (ctrl->voltage_settling_time) {
++		/*
++		 * Configure the settling timer used to account for
++		 * one VDD supply step.
++		 */
++		temp = (u64)ctrl->cpr_clock_rate
++				* (u64)ctrl->voltage_settling_time;
++		do_div(temp, 1000000000);
++		cpr3_masked_write(ctrl, CPR4_REG_MARGIN_TEMP_CORE_TIMERS,
++			CPR4_MARGIN_TEMP_CORE_TIMERS_SETTLE_VOLTAGE_COUNT_MASK,
++			temp
++		    << CPR4_MARGIN_TEMP_CORE_TIMERS_SETTLE_VOLTAGE_COUNT_SHIFT);
++	}
++
++	/*
++	 * Allocate memory for cpr4_sdelta structure and sdelta table for
++	 * controller aggregated corner by finding the maximum core count
++	 * used by any cpr3 regulators.
++	 */
++	ctrl_max_core_count = 1;
++	ctrl_valid_sdelta = false;
++	for (i = 0; i < ctrl->thread_count; i++) {
++		thread = &ctrl->thread[i];
++
++		/*
++		 * Allocate memory for cpr4_sdelta structure and sdelta table
++		 * for thread aggregated corner by finding the maximum core
++		 * count used by any cpr3 regulators of the thread.
++		 */
++		thread_max_core_count = 1;
++		thread_valid_sdelta = false;
++		for (j = 0; j < thread->vreg_count; j++) {
++			vreg = &thread->vreg[j];
++			thread_max_core_count = max(thread_max_core_count,
++							vreg->max_core_count);
++			thread_valid_sdelta |= (vreg->allow_core_count_adj
++							| vreg->allow_temp_adj
++							| vreg->allow_boost);
++		}
++		if (thread_valid_sdelta) {
++			sdelta = devm_kzalloc(ctrl->dev, sizeof(*sdelta),
++					GFP_KERNEL);
++			if (!sdelta)
++				return -ENOMEM;
++
++			sdelta->table = devm_kcalloc(ctrl->dev,
++						thread_max_core_count
++						* ctrl->temp_band_count,
++						sizeof(*sdelta->table),
++						GFP_KERNEL);
++			if (!sdelta->table)
++				return -ENOMEM;
++
++			sdelta->boost_table = devm_kcalloc(ctrl->dev,
++						ctrl->temp_band_count,
++						sizeof(*sdelta->boost_table),
++						GFP_KERNEL);
++			if (!sdelta->boost_table)
++				return -ENOMEM;
++
++			thread->aggr_corner.sdelta = sdelta;
++		}
++
++		ctrl_valid_sdelta |= thread_valid_sdelta;
++		ctrl_max_core_count = max(ctrl_max_core_count,
++						thread_max_core_count);
++	}
++
++	if (ctrl_valid_sdelta) {
++		sdelta = devm_kzalloc(ctrl->dev, sizeof(*sdelta), GFP_KERNEL);
++		if (!sdelta)
++			return -ENOMEM;
++
++		sdelta->table = devm_kcalloc(ctrl->dev, ctrl_max_core_count
++					* ctrl->temp_band_count,
++					sizeof(*sdelta->table), GFP_KERNEL);
++		if (!sdelta->table)
++			return -ENOMEM;
++
++		sdelta->boost_table = devm_kcalloc(ctrl->dev,
++					ctrl->temp_band_count,
++					sizeof(*sdelta->boost_table),
++					GFP_KERNEL);
++		if (!sdelta->boost_table)
++			return -ENOMEM;
++
++		ctrl->aggr_corner.sdelta = sdelta;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_write_temp_core_margin() - programs hardware SDELTA registers with
++ *		the voltage margin adjustments that need to be applied for
++ *		different online core-count and temperature bands.
++ * @ctrl:		Pointer to the CPR3 controller
++ * @addr:		SDELTA register address
++ * @temp_core_adj:	Array of voltage margin values for different temperature
++ *			bands.
++ *
++ * CPR interface/bus clocks must be enabled before calling this function.
++ *
++ * Return: none
++ */
++static void cpr3_write_temp_core_margin(struct cpr3_controller *ctrl,
++				 int addr, int *temp_core_adj)
++{
++	int i, margin_steps;
++	u32 reg = 0;
++
++	for (i = 0; i < ctrl->temp_band_count; i++) {
++		margin_steps = max(min(temp_core_adj[i], 127), -128);
++		reg |= (margin_steps & CPR4_MARGIN_TEMP_CORE_ADJ_MASK) <<
++			(i * CPR4_MARGIN_TEMP_CORE_ADJ_SHIFT);
++	}
++
++	cpr3_write(ctrl, addr, reg);
++	cpr3_debug(ctrl, "sdelta offset=0x%08x, val=0x%08x\n", addr, reg);
++}
++
++/**
++ * cpr3_controller_program_sdelta() - programs hardware SDELTA registers with
++ *		the voltage margin adjustments that need to be applied at
++ *		different online core-count and temperature bands. Also,
++ *		programs hardware register configuration for per-online-core
++ *		and per-temperature based adjustments.
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * CPR interface/bus clocks must be enabled before calling this function.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_controller_program_sdelta(struct cpr3_controller *ctrl)
++{
++	struct cpr3_corner *corner = &ctrl->aggr_corner;
++	struct cpr4_sdelta *sdelta = corner->sdelta;
++	int i, index, max_core_count, rc = 0;
++	bool cpr_enabled = ctrl->cpr_enabled;
++
++	if (!sdelta)
++		/* cpr4_sdelta not defined for current aggregated corner */
++		return 0;
++
++	if (ctrl->supports_hw_closed_loop && ctrl->cpr_enabled) {
++		cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++			CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_EN_MASK,
++			(ctrl->use_hw_closed_loop && !sdelta->allow_boost)
++			? CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_ENABLE : 0);
++	}
++
++	if (!sdelta->allow_core_count_adj && !sdelta->allow_temp_adj
++		&& !sdelta->allow_boost) {
++		/*
++		 * Per-online-core, per-temperature and voltage boost
++		 * adjustments are disabled for this aggregation corner.
++		 */
++		return 0;
++	}
++
++	/* Ensure that CPR clocks are enabled before writing to registers. */
++	if (!cpr_enabled) {
++		rc = cpr3_clock_enable(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "clock enable failed, rc=%d\n", rc);
++			return rc;
++		}
++		ctrl->cpr_enabled = true;
++	}
++
++	max_core_count = sdelta->max_core_count;
++
++	if (sdelta->allow_core_count_adj || sdelta->allow_temp_adj) {
++		if (sdelta->allow_core_count_adj) {
++			/* Program TEMP_CORE0 to same margins as TEMP_CORE1 */
++			cpr3_write_temp_core_margin(ctrl,
++				CPR4_REG_MARGIN_TEMP_CORE(0),
++				&sdelta->table[0]);
++		}
++
++		for (i = 0; i < max_core_count; i++) {
++			index = i * sdelta->temp_band_count;
++			/*
++			 * Program TEMP_COREi with voltage margin adjustments
++			 * that need to be applied when the number of cores
++			 * becomes i.
++			 */
++			cpr3_write_temp_core_margin(ctrl,
++				CPR4_REG_MARGIN_TEMP_CORE(
++						sdelta->allow_core_count_adj
++						? i + 1 : max_core_count),
++						&sdelta->table[index]);
++		}
++	}
++
++	if (sdelta->allow_boost) {
++		/* Program only boost_num_cores row of SDELTA */
++		cpr3_write_temp_core_margin(ctrl,
++			CPR4_REG_MARGIN_TEMP_CORE(sdelta->boost_num_cores),
++					&sdelta->boost_table[0]);
++	}
++
++	if (!sdelta->allow_core_count_adj && !sdelta->allow_boost) {
++		cpr3_masked_write(ctrl, CPR4_REG_MISC,
++			CPR4_MISC_MARGIN_TABLE_ROW_SELECT_MASK,
++			max_core_count
++			<< CPR4_MISC_MARGIN_TABLE_ROW_SELECT_SHIFT);
++	}
++
++	cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++		CPR4_MARGIN_ADJ_CTL_MAX_NUM_CORES_MASK
++		| CPR4_MARGIN_ADJ_CTL_CORE_ADJ_EN
++		| CPR4_MARGIN_ADJ_CTL_TEMP_ADJ_EN
++		| CPR4_MARGIN_ADJ_CTL_KV_MARGIN_ADJ_EN
++		| CPR4_MARGIN_ADJ_CTL_BOOST_EN,
++		max_core_count << CPR4_MARGIN_ADJ_CTL_MAX_NUM_CORES_SHIFT
++		| ((sdelta->allow_core_count_adj || sdelta->allow_boost)
++			? CPR4_MARGIN_ADJ_CTL_CORE_ADJ_EN : 0)
++		| ((sdelta->allow_temp_adj && ctrl->supports_hw_closed_loop)
++			? CPR4_MARGIN_ADJ_CTL_TEMP_ADJ_EN : 0)
++		| (((ctrl->use_hw_closed_loop && !sdelta->allow_boost)
++		    || !ctrl->supports_hw_closed_loop)
++			? CPR4_MARGIN_ADJ_CTL_KV_MARGIN_ADJ_EN : 0)
++		| (sdelta->allow_boost
++			?  CPR4_MARGIN_ADJ_CTL_BOOST_EN : 0));
++
++	/*
++	 * Ensure that all previous CPR register writes have completed before
++	 * continuing.
++	 */
++	mb();
++
++	/* Turn off CPR clocks if they were off before this function call. */
++	if (!cpr_enabled) {
++		cpr3_clock_disable(ctrl);
++		ctrl->cpr_enabled = false;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_regulator_init_ctrl() - performs hardware initialization of CPR
++ *		controller registers
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_init_ctrl(struct cpr3_controller *ctrl)
++{
++	int i, j, k, m, rc;
++	u32 ro_used = 0;
++	u32 gcnt, cont_dly, up_down_dly, val;
++	u64 temp;
++	char *mode;
++
++	if (ctrl->core_clk) {
++		rc = clk_set_rate(ctrl->core_clk, ctrl->cpr_clock_rate);
++		if (rc) {
++			cpr3_err(ctrl, "clk_set_rate(core_clk, %u) failed, rc=%d\n",
++				ctrl->cpr_clock_rate, rc);
++			return rc;
++		}
++	}
++
++	rc = cpr3_clock_enable(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "clock enable failed, rc=%d\n", rc);
++		return rc;
++	}
++	ctrl->cpr_enabled = true;
++
++	/* Find all RO's used by any corner of any regulator. */
++	for (i = 0; i < ctrl->thread_count; i++)
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++)
++			for (k = 0; k < ctrl->thread[i].vreg[j].corner_count;
++			     k++)
++				for (m = 0; m < CPR3_RO_COUNT; m++)
++					if (ctrl->thread[i].vreg[j].corner[k].
++					    target_quot[m])
++						ro_used |= BIT(m);
++
++	/* Configure the GCNT of the RO's that will be used */
++	gcnt = cpr3_regulator_get_gcnt(ctrl);
++	for (i = 0; i < CPR3_RO_COUNT; i++)
++		if (ro_used & BIT(i))
++			cpr3_write(ctrl, CPR3_REG_GCNT(i), gcnt);
++
++	/* Configure the loop delay time */
++	temp = (u64)ctrl->cpr_clock_rate * (u64)ctrl->loop_time;
++	do_div(temp, 1000000000);
++	cont_dly = temp;
++	if (ctrl->supports_hw_closed_loop
++		&& ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3)
++		cpr3_write(ctrl, CPR3_REG_CPR_TIMER_MID_CONT, cont_dly);
++	else
++		cpr3_write(ctrl, CPR3_REG_CPR_TIMER_AUTO_CONT, cont_dly);
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++		temp = (u64)ctrl->cpr_clock_rate *
++				(u64)ctrl->up_down_delay_time;
++		do_div(temp, 1000000000);
++		up_down_dly = temp;
++		if (ctrl->supports_hw_closed_loop)
++			cpr3_write(ctrl, CPR3_REG_CPR_TIMER_UP_DN_CONT,
++				up_down_dly);
++		cpr3_debug(ctrl, "up_down_dly=%u, up_down_delay_time=%u ns\n",
++			up_down_dly, ctrl->up_down_delay_time);
++	}
++
++	cpr3_debug(ctrl, "cpr_clock_rate=%u HZ, sensor_time=%u ns, loop_time=%u ns, gcnt=%u, cont_dly=%u\n",
++		ctrl->cpr_clock_rate, ctrl->sensor_time, ctrl->loop_time,
++		gcnt, cont_dly);
++
++	/* Configure CPR sensor operation */
++	val = (ctrl->idle_clocks << CPR3_CPR_CTL_IDLE_CLOCKS_SHIFT)
++		& CPR3_CPR_CTL_IDLE_CLOCKS_MASK;
++	val |= (ctrl->count_mode << CPR3_CPR_CTL_COUNT_MODE_SHIFT)
++		& CPR3_CPR_CTL_COUNT_MODE_MASK;
++	val |= (ctrl->count_repeat << CPR3_CPR_CTL_COUNT_REPEAT_SHIFT)
++		& CPR3_CPR_CTL_COUNT_REPEAT_MASK;
++	cpr3_write(ctrl, CPR3_REG_CPR_CTL, val);
++
++	cpr3_debug(ctrl, "idle_clocks=%u, count_mode=%u, count_repeat=%u; CPR_CTL=0x%08X\n",
++		ctrl->idle_clocks, ctrl->count_mode, ctrl->count_repeat, val);
++
++	/* Configure CPR default step quotients */
++	val = (ctrl->step_quot_init_min << CPR3_CPR_STEP_QUOT_MIN_SHIFT)
++		& CPR3_CPR_STEP_QUOT_MIN_MASK;
++	val |= (ctrl->step_quot_init_max << CPR3_CPR_STEP_QUOT_MAX_SHIFT)
++		& CPR3_CPR_STEP_QUOT_MAX_MASK;
++	cpr3_write(ctrl, CPR3_REG_CPR_STEP_QUOT, val);
++
++	cpr3_debug(ctrl, "step_quot_min=%u, step_quot_max=%u; STEP_QUOT=0x%08X\n",
++		ctrl->step_quot_init_min, ctrl->step_quot_init_max, val);
++
++	/* Configure the CPR sensor ownership */
++	for (i = 0; i < ctrl->sensor_count; i++)
++		cpr3_write(ctrl, CPR3_REG_SENSOR_OWNER(i),
++			   ctrl->sensor_owner[i]);
++
++	/* Configure per-thread registers */
++	for (i = 0; i < ctrl->thread_count; i++) {
++		rc = cpr3_regulator_init_thread(&ctrl->thread[i]);
++		if (rc) {
++			cpr3_err(ctrl, "CPR thread register initialization failed, rc=%d\n",
++				rc);
++			return rc;
++		}
++	}
++
++	if (ctrl->supports_hw_closed_loop) {
++		if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++			cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++				CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_EN_MASK,
++				ctrl->use_hw_closed_loop
++				? CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_ENABLE
++				: CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_DISABLE);
++		} else if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++			cpr3_write(ctrl, CPR3_REG_HW_CLOSED_LOOP,
++				ctrl->use_hw_closed_loop
++				? CPR3_HW_CLOSED_LOOP_ENABLE
++				: CPR3_HW_CLOSED_LOOP_DISABLE);
++
++			cpr3_debug(ctrl, "PD_THROTTLE=0x%08X\n",
++				ctrl->proc_clock_throttle);
++		}
++
++		if ((ctrl->use_hw_closed_loop ||
++		     ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) &&
++		    ctrl->vdd_limit_regulator) {
++			rc = regulator_enable(ctrl->vdd_limit_regulator);
++			if (rc) {
++				cpr3_err(ctrl, "CPR limit regulator enable failed, rc=%d\n",
++					rc);
++				return rc;
++			}
++		}
++	}
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		rc = cpr3_regulator_init_cpr4(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "CPR4-specific controller initialization failed, rc=%d\n",
++				rc);
++			return rc;
++		}
++	}
++
++	/* Ensure that all register writes complete before disabling clocks. */
++	wmb();
++
++	cpr3_clock_disable(ctrl);
++	ctrl->cpr_enabled = false;
++
++	if (!ctrl->cpr_allowed_sw || !ctrl->cpr_allowed_hw)
++		mode = "open-loop";
++	else if (ctrl->supports_hw_closed_loop)
++		mode = ctrl->use_hw_closed_loop
++			? "HW closed-loop" : "SW closed-loop";
++	else
++		mode = "closed-loop";
++
++	cpr3_info(ctrl, "Default CPR mode = %s", mode);
++
++	return 0;
++}
++
++/**
++ * cpr3_regulator_set_target_quot() - configure the target quotient for each
++ *		RO of the CPR3 thread and set the RO mask
++ * @thread:		Pointer to the CPR3 thread
++ *
++ * Return: none
++ */
++static void cpr3_regulator_set_target_quot(struct cpr3_thread *thread)
++{
++	u32 new_quot, last_quot;
++	int i;
++
++	if (thread->aggr_corner.ro_mask == CPR3_RO_MASK
++	    && thread->last_closed_loop_aggr_corner.ro_mask == CPR3_RO_MASK) {
++		/* Avoid writing target quotients since all RO's are masked. */
++		return;
++	} else if (thread->aggr_corner.ro_mask == CPR3_RO_MASK) {
++		cpr3_write(thread->ctrl, CPR3_REG_RO_MASK(thread->thread_id),
++			CPR3_RO_MASK);
++		thread->last_closed_loop_aggr_corner.ro_mask = CPR3_RO_MASK;
++		/*
++		 * Only the RO_MASK register needs to be written since all
++		 * RO's are masked.
++		 */
++		return;
++	} else if (thread->aggr_corner.ro_mask
++			!= thread->last_closed_loop_aggr_corner.ro_mask) {
++		cpr3_write(thread->ctrl, CPR3_REG_RO_MASK(thread->thread_id),
++			thread->aggr_corner.ro_mask);
++	}
++
++	for (i = 0; i < CPR3_RO_COUNT; i++) {
++		new_quot = thread->aggr_corner.target_quot[i];
++		last_quot = thread->last_closed_loop_aggr_corner.target_quot[i];
++		if (new_quot != last_quot)
++			cpr3_write(thread->ctrl,
++				CPR3_REG_TARGET_QUOT(thread->thread_id, i),
++				new_quot);
++	}
++
++	thread->last_closed_loop_aggr_corner = thread->aggr_corner;
++
++	return;
++}
++
++/**
++ * cpr3_update_vreg_closed_loop_volt() - update the last known settled
++ *		closed loop voltage for a CPR3 regulator
++ * @vreg:		Pointer to the CPR3 regulator
++ * @vdd_volt:		Last known settled voltage in microvolts for the
++ *			VDD supply
++ * @reg_last_measurement: Value read from the LAST_MEASUREMENT register
++ *
++ * Return: none
++ */
++static void cpr3_update_vreg_closed_loop_volt(struct cpr3_regulator *vreg,
++				int vdd_volt, u32 reg_last_measurement)
++{
++	bool step_dn, step_up, aggr_step_up, aggr_step_dn, aggr_step_mid;
++	bool valid, pd_valid, saw_error;
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	struct cpr3_corner *corner;
++	u32 id;
++
++	if (vreg->last_closed_loop_corner == CPR3_REGULATOR_CORNER_INVALID)
++		return;
++	else
++		corner = &vreg->corner[vreg->last_closed_loop_corner];
++
++	if (vreg->thread->last_closed_loop_aggr_corner.ro_mask
++	    == CPR3_RO_MASK  || !vreg->aggregated) {
++		return;
++	} else if (!ctrl->cpr_enabled || !ctrl->last_corner_was_closed_loop) {
++		return;
++	} else if (ctrl->thread_count == 1
++		 && vdd_volt >= corner->floor_volt
++		 && vdd_volt <= corner->ceiling_volt) {
++		corner->last_volt = vdd_volt;
++		cpr3_debug(vreg, "last_volt updated: last_volt[%d]=%d, ceiling_volt[%d]=%d, floor_volt[%d]=%d\n",
++			   vreg->last_closed_loop_corner, corner->last_volt,
++			   vreg->last_closed_loop_corner,
++			   corner->ceiling_volt,
++			   vreg->last_closed_loop_corner,
++			   corner->floor_volt);
++		return;
++	} else if (!ctrl->supports_hw_closed_loop) {
++		return;
++	} else if (ctrl->ctrl_type != CPR_CTRL_TYPE_CPR3) {
++		corner->last_volt = vdd_volt;
++		cpr3_debug(vreg, "last_volt updated: last_volt[%d]=%d, ceiling_volt[%d]=%d, floor_volt[%d]=%d\n",
++			   vreg->last_closed_loop_corner, corner->last_volt,
++			   vreg->last_closed_loop_corner,
++			   corner->ceiling_volt,
++			   vreg->last_closed_loop_corner,
++			   corner->floor_volt);
++		return;
++	}
++
++	/* CPR clocks are on and HW closed loop is supported */
++	valid = !!(reg_last_measurement & CPR3_LAST_MEASUREMENT_VALID);
++	if (!valid) {
++		cpr3_debug(vreg, "CPR_LAST_VALID_MEASUREMENT=0x%X valid bit not set\n",
++			   reg_last_measurement);
++		return;
++	}
++
++	id = vreg->thread->thread_id;
++
++	step_dn
++	       = !!(reg_last_measurement & CPR3_LAST_MEASUREMENT_THREAD_DN(id));
++	step_up
++	       = !!(reg_last_measurement & CPR3_LAST_MEASUREMENT_THREAD_UP(id));
++	aggr_step_dn = !!(reg_last_measurement & CPR3_LAST_MEASUREMENT_AGGR_DN);
++	aggr_step_mid
++		= !!(reg_last_measurement & CPR3_LAST_MEASUREMENT_AGGR_MID);
++	aggr_step_up = !!(reg_last_measurement & CPR3_LAST_MEASUREMENT_AGGR_UP);
++	saw_error = !!(reg_last_measurement & CPR3_LAST_MEASUREMENT_SAW_ERROR);
++	pd_valid
++	     = !((((reg_last_measurement & CPR3_LAST_MEASUREMENT_PD_BYPASS_MASK)
++		       >> CPR3_LAST_MEASUREMENT_PD_BYPASS_SHIFT)
++		      & vreg->pd_bypass_mask) == vreg->pd_bypass_mask);
++
++	if (!pd_valid) {
++		cpr3_debug(vreg, "CPR_LAST_VALID_MEASUREMENT=0x%X, all power domains bypassed\n",
++			   reg_last_measurement);
++		return;
++	} else if (step_dn && step_up) {
++		cpr3_err(vreg, "both up and down status bits set, CPR_LAST_VALID_MEASUREMENT=0x%X\n",
++			 reg_last_measurement);
++		return;
++	} else if (aggr_step_dn && step_dn && vdd_volt < corner->last_volt
++		   && vdd_volt >= corner->floor_volt) {
++		corner->last_volt = vdd_volt;
++	} else if (aggr_step_up && step_up && vdd_volt > corner->last_volt
++		   && vdd_volt <= corner->ceiling_volt) {
++		corner->last_volt = vdd_volt;
++	} else if (aggr_step_mid
++		   && vdd_volt >= corner->floor_volt
++		   && vdd_volt <= corner->ceiling_volt) {
++		corner->last_volt = vdd_volt;
++	} else if (saw_error && (vdd_volt == corner->ceiling_volt
++				 || vdd_volt == corner->floor_volt)) {
++		corner->last_volt = vdd_volt;
++	} else {
++		cpr3_debug(vreg, "last_volt not updated: last_volt[%d]=%d, ceiling_volt[%d]=%d, floor_volt[%d]=%d, vdd_volt=%d, CPR_LAST_VALID_MEASUREMENT=0x%X\n",
++			   vreg->last_closed_loop_corner, corner->last_volt,
++			   vreg->last_closed_loop_corner,
++			   corner->ceiling_volt,
++			   vreg->last_closed_loop_corner, corner->floor_volt,
++			   vdd_volt, reg_last_measurement);
++		return;
++	}
++
++	cpr3_debug(vreg, "last_volt updated: last_volt[%d]=%d, ceiling_volt[%d]=%d, floor_volt[%d]=%d, CPR_LAST_VALID_MEASUREMENT=0x%X\n",
++		   vreg->last_closed_loop_corner, corner->last_volt,
++		   vreg->last_closed_loop_corner, corner->ceiling_volt,
++		   vreg->last_closed_loop_corner, corner->floor_volt,
++		   reg_last_measurement);
++}
++
++/**
++ * cpr3_regulator_mem_acc_bhs_used() - determines if mem-acc regulators powered
++ *		through a BHS are associated with the CPR3 controller or any of
++ *		the CPR3 regulators it controls.
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * This function determines if the CPR3 controller or any of its CPR3 regulators
++ * need to manage mem-acc regulators that are currently powered through a BHS
++ * and whose corner selection is based upon a particular voltage threshold.
++ *
++ * Return: true or false
++ */
++static bool cpr3_regulator_mem_acc_bhs_used(struct cpr3_controller *ctrl)
++{
++	struct cpr3_regulator *vreg;
++	int i, j;
++
++	if (!ctrl->mem_acc_threshold_volt)
++		return false;
++
++	if (ctrl->mem_acc_regulator)
++		return true;
++
++	for (i = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++			vreg = &ctrl->thread[i].vreg[j];
++
++			if (vreg->mem_acc_regulator)
++				return true;
++		}
++	}
++
++	return false;
++}
++
++/**
++ * cpr3_regulator_config_bhs_mem_acc() - configure the mem-acc regulator
++ *		settings for hardware blocks currently powered through the BHS.
++ * @ctrl:		Pointer to the CPR3 controller
++ * @new_volt:		New voltage in microvolts that VDD supply needs to
++ *			end up at
++ * @last_volt:		Pointer to the last known voltage in microvolts for the
++ *			VDD supply
++ * @aggr_corner:	Pointer to the CPR3 corner which corresponds to the max
++ *			corner aggregated from all CPR3 threads managed by the
++ *			CPR3 controller
++ *
++ * This function programs the mem-acc regulator corners for CPR3 regulators
++ * whose LDO regulators are in bypassed state. The function also handles
++ * CPR3 controllers which utilize mem-acc regulators that operate independently
++ * from the LDO hardware and that must be programmed when the VDD supply
++ * crosses a particular voltage threshold.
++ *
++ * Return: 0 on success, errno on failure. If the VDD supply voltage is
++ * modified, last_volt is updated to reflect the new voltage setpoint.
++ */
++static int cpr3_regulator_config_bhs_mem_acc(struct cpr3_controller *ctrl,
++				     int new_volt, int *last_volt,
++				     struct cpr3_corner *aggr_corner)
++{
++	struct cpr3_regulator *vreg;
++	int i, j, rc, mem_acc_corn, safe_volt;
++	int mem_acc_volt = ctrl->mem_acc_threshold_volt;
++	int ref_volt;
++
++	if (!cpr3_regulator_mem_acc_bhs_used(ctrl))
++		return 0;
++
++	ref_volt = ctrl->use_hw_closed_loop ? aggr_corner->floor_volt :
++		new_volt;
++
++	if (((*last_volt < mem_acc_volt && mem_acc_volt <= ref_volt) ||
++	     (*last_volt >= mem_acc_volt && mem_acc_volt > ref_volt))) {
++		if (ref_volt < *last_volt)
++			safe_volt = max(mem_acc_volt, aggr_corner->last_volt);
++		else
++			safe_volt = max(mem_acc_volt, *last_volt);
++
++		rc = regulator_set_voltage(ctrl->vdd_regulator, safe_volt,
++					   new_volt < *last_volt ?
++					   ctrl->aggr_corner.ceiling_volt :
++					   new_volt);
++		if (rc) {
++			cpr3_err(ctrl, "regulator_set_voltage(vdd) == %d failed, rc=%d\n",
++				 safe_volt, rc);
++			return rc;
++		}
++
++		*last_volt = safe_volt;
++
++		mem_acc_corn = ref_volt < mem_acc_volt ?
++			ctrl->mem_acc_corner_map[CPR3_MEM_ACC_LOW_CORNER] :
++			ctrl->mem_acc_corner_map[CPR3_MEM_ACC_HIGH_CORNER];
++
++		if (ctrl->mem_acc_regulator) {
++			rc = regulator_set_voltage(ctrl->mem_acc_regulator,
++						   mem_acc_corn, mem_acc_corn);
++			if (rc) {
++				cpr3_err(ctrl, "regulator_set_voltage(mem_acc) == %d failed, rc=%d\n",
++					 mem_acc_corn, rc);
++				return rc;
++			}
++		}
++
++		for (i = 0; i < ctrl->thread_count; i++) {
++			for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++				vreg = &ctrl->thread[i].vreg[j];
++
++				if (!vreg->mem_acc_regulator)
++					continue;
++
++				rc = regulator_set_voltage(
++					vreg->mem_acc_regulator, mem_acc_corn,
++					mem_acc_corn);
++				if (rc) {
++					cpr3_err(vreg, "regulator_set_voltage(mem_acc) == %d failed, rc=%d\n",
++						 mem_acc_corn, rc);
++					return rc;
++				}
++			}
++		}
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_regulator_switch_apm_mode() - switch the mode of the APM controller
++ *		associated with a given CPR3 controller
++ * @ctrl:		Pointer to the CPR3 controller
++ * @new_volt:		New voltage in microvolts that VDD supply needs to
++ *			end up at
++ * @last_volt:		Pointer to the last known voltage in microvolts for the
++ *			VDD supply
++ * @aggr_corner:	Pointer to the CPR3 corner which corresponds to the max
++ *			corner aggregated from all CPR3 threads managed by the
++ *			CPR3 controller
++ *
++ * This function requests a switch of the APM mode while guaranteeing
++ * any LDO regulator hardware requirements are satisfied. The function must
++ * be called once it is known a new VDD supply setpoint crosses the APM
++ * voltage threshold.
++ *
++ * Return: 0 on success, errno on failure. If the VDD supply voltage is
++ * modified, last_volt is updated to reflect the new voltage setpoint.
++ */
++static int cpr3_regulator_switch_apm_mode(struct cpr3_controller *ctrl,
++					  int new_volt, int *last_volt,
++					  struct cpr3_corner *aggr_corner)
++{
++	struct regulator *vdd = ctrl->vdd_regulator;
++	int apm_volt = ctrl->apm_threshold_volt;
++	int orig_last_volt = *last_volt;
++	int rc;
++
++	rc = regulator_set_voltage(vdd, apm_volt, apm_volt);
++	if (rc) {
++		cpr3_err(ctrl, "regulator_set_voltage(vdd) == %d failed, rc=%d\n",
++			 apm_volt, rc);
++		return rc;
++	}
++
++	*last_volt = apm_volt;
++
++	rc = msm_apm_set_supply(ctrl->apm, new_volt >= apm_volt
++				? ctrl->apm_high_supply : ctrl->apm_low_supply);
++	if (rc) {
++		cpr3_err(ctrl, "APM switch failed, rc=%d\n", rc);
++		/* Roll back the voltage. */
++		regulator_set_voltage(vdd, orig_last_volt, INT_MAX);
++		*last_volt = orig_last_volt;
++		return rc;
++	}
++	return 0;
++}
++
++/**
++ * cpr3_regulator_config_voltage_crossings() - configure APM and mem-acc
++ *		settings depending upon a new VDD supply setpoint
++ *
++ * @ctrl:		Pointer to the CPR3 controller
++ * @new_volt:		New voltage in microvolts that VDD supply needs to
++ *			end up at
++ * @last_volt:		Pointer to the last known voltage in microvolts for the
++ *			VDD supply
++ * @aggr_corner:	Pointer to the CPR3 corner which corresponds to the max
++ *			corner aggregated from all CPR3 threads managed by the
++ *			CPR3 controller
++ *
++ * This function handles the APM and mem-acc regulator reconfiguration if
++ * the new VDD supply voltage will result in crossing their respective voltage
++ * thresholds.
++ *
++ * Return: 0 on success, errno on failure. If the VDD supply voltage is
++ * modified, last_volt is updated to reflect the new voltage setpoint.
++ */
++static int cpr3_regulator_config_voltage_crossings(struct cpr3_controller *ctrl,
++				   int new_volt, int *last_volt,
++				   struct cpr3_corner *aggr_corner)
++{
++	bool apm_crossing = false, mem_acc_crossing = false;
++	bool mem_acc_bhs_used;
++	int apm_volt = ctrl->apm_threshold_volt;
++	int mem_acc_volt = ctrl->mem_acc_threshold_volt;
++	int ref_volt, rc;
++
++	if (ctrl->apm && apm_volt > 0
++	    && ((*last_volt < apm_volt && apm_volt <= new_volt)
++		|| (*last_volt >= apm_volt && apm_volt > new_volt)))
++		apm_crossing = true;
++
++	mem_acc_bhs_used = cpr3_regulator_mem_acc_bhs_used(ctrl);
++
++	ref_volt = ctrl->use_hw_closed_loop ? aggr_corner->floor_volt :
++		new_volt;
++
++	if (mem_acc_bhs_used &&
++	    (((*last_volt < mem_acc_volt && mem_acc_volt <= ref_volt) ||
++	      (*last_volt >= mem_acc_volt && mem_acc_volt > ref_volt))))
++		mem_acc_crossing = true;
++
++	if (apm_crossing && mem_acc_crossing) {
++		if ((new_volt < *last_volt && apm_volt >= mem_acc_volt) ||
++		    (new_volt >= *last_volt && apm_volt < mem_acc_volt)) {
++			rc = cpr3_regulator_switch_apm_mode(ctrl, new_volt,
++							    last_volt,
++							    aggr_corner);
++			if (rc) {
++				cpr3_err(ctrl, "unable to switch APM mode\n");
++				return rc;
++			}
++
++			rc = cpr3_regulator_config_bhs_mem_acc(ctrl, new_volt,
++						       last_volt, aggr_corner);
++			if (rc) {
++				cpr3_err(ctrl, "unable to configure BHS mem-acc settings\n");
++				return rc;
++			}
++		} else {
++			rc = cpr3_regulator_config_bhs_mem_acc(ctrl, new_volt,
++						       last_volt, aggr_corner);
++			if (rc) {
++				cpr3_err(ctrl, "unable to configure BHS mem-acc settings\n");
++				return rc;
++			}
++
++			rc = cpr3_regulator_switch_apm_mode(ctrl, new_volt,
++							    last_volt,
++							    aggr_corner);
++			if (rc) {
++				cpr3_err(ctrl, "unable to switch APM mode\n");
++				return rc;
++			}
++		}
++	} else if (apm_crossing) {
++		rc = cpr3_regulator_switch_apm_mode(ctrl, new_volt, last_volt,
++						    aggr_corner);
++		if (rc) {
++			cpr3_err(ctrl, "unable to switch APM mode\n");
++			return rc;
++		}
++	} else if (mem_acc_crossing) {
++		rc = cpr3_regulator_config_bhs_mem_acc(ctrl, new_volt,
++						       last_volt, aggr_corner);
++		if (rc) {
++			cpr3_err(ctrl, "unable to configure BHS mem-acc settings\n");
++			return rc;
++		}
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_regulator_config_mem_acc() - configure the corner of the mem-acc
++ *			regulator associated with the CPR3 controller
++ * @ctrl:		Pointer to the CPR3 controller
++ * @aggr_corner:	Pointer to the CPR3 corner which corresponds to the max
++ *			corner aggregated from all CPR3 threads managed by the
++ *			CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_config_mem_acc(struct cpr3_controller *ctrl,
++					 struct cpr3_corner *aggr_corner)
++{
++	int rc;
++
++	if (ctrl->mem_acc_regulator && aggr_corner->mem_acc_volt) {
++		rc = regulator_set_voltage(ctrl->mem_acc_regulator,
++					   aggr_corner->mem_acc_volt,
++					   aggr_corner->mem_acc_volt);
++		if (rc) {
++			cpr3_err(ctrl, "regulator_set_voltage(mem_acc) == %d failed, rc=%d\n",
++				 aggr_corner->mem_acc_volt, rc);
++			return rc;
++		}
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_regulator_scale_vdd_voltage() - scale the CPR controlled VDD supply
++ *		voltage to the new level while satisfying any other hardware
++ *		requirements
++ * @ctrl:		Pointer to the CPR3 controller
++ * @new_volt:		New voltage in microvolts that VDD supply needs to end
++ *			up at
++ * @last_volt:		Last known voltage in microvolts for the VDD supply
++ * @aggr_corner:	Pointer to the CPR3 corner which corresponds to the max
++ *			corner aggregated from all CPR3 threads managed by the
++ *			CPR3 controller
++ *
++ * This function scales the CPR controlled VDD supply voltage from its
++ * current level to the new voltage that is specified.  If the supply is
++ * configured to use the APM and the APM threshold is crossed as a result of
++ * the voltage scaling, then this function also stops at the APM threshold,
++ * switches the APM source, and finally sets the final new voltage.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_scale_vdd_voltage(struct cpr3_controller *ctrl,
++				int new_volt, int last_volt,
++				struct cpr3_corner *aggr_corner)
++{
++	struct regulator *vdd = ctrl->vdd_regulator;
++	int rc;
++
++	if (new_volt < last_volt) {
++			rc = cpr3_regulator_config_mem_acc(ctrl, aggr_corner);
++			if (rc)
++				return rc;
++	} else {
++		/* Increasing VDD voltage */
++		if (ctrl->system_regulator) {
++			rc = regulator_set_voltage(ctrl->system_regulator,
++				aggr_corner->system_volt, INT_MAX);
++			if (rc) {
++				cpr3_err(ctrl, "regulator_set_voltage(system) == %d failed, rc=%d\n",
++					aggr_corner->system_volt, rc);
++				return rc;
++			}
++		}
++	}
++
++	rc = cpr3_regulator_config_voltage_crossings(ctrl, new_volt, &last_volt,
++						     aggr_corner);
++	if (rc) {
++		cpr3_err(ctrl, "unable to handle voltage threshold crossing configurations, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	/*
++	 * Subtract a small amount from the min_uV parameter so that the
++	 * set voltage request is not dropped by the framework due to being
++	 * duplicate.  This is needed in order to switch from hardware
++	 * closed-loop to open-loop successfully.
++	 */
++	rc = regulator_set_voltage(vdd, new_volt - (ctrl->cpr_enabled ? 0 : 1),
++				   aggr_corner->ceiling_volt);
++	if (rc) {
++		cpr3_err(ctrl, "regulator_set_voltage(vdd) == %d failed, rc=%d\n",
++			new_volt, rc);
++		return rc;
++	}
++
++	if (new_volt == last_volt && ctrl->supports_hw_closed_loop
++	    && ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		/*
++		 * CPR4 features enforce voltage reprogramming when the last
++		 * set voltage and new set voltage are same. This way, we can
++		 * ensure that SAW PMIC STATUS register is updated with newly
++		 * programmed voltage.
++		 */
++		rc = regulator_sync_voltage(vdd);
++		if (rc) {
++			cpr3_err(ctrl, "regulator_sync_voltage(vdd) == %d failed, rc=%d\n",
++				new_volt, rc);
++			return rc;
++		}
++	}
++
++	if (new_volt >= last_volt) {
++		rc = cpr3_regulator_config_mem_acc(ctrl, aggr_corner);
++		if (rc)
++			return rc;
++	} else {
++		/* Decreasing VDD voltage */
++		if (ctrl->system_regulator) {
++			rc = regulator_set_voltage(ctrl->system_regulator,
++				aggr_corner->system_volt, INT_MAX);
++			if (rc) {
++				cpr3_err(ctrl, "regulator_set_voltage(system) == %d failed, rc=%d\n",
++					aggr_corner->system_volt, rc);
++				return rc;
++			}
++		}
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_regulator_get_dynamic_floor_volt() - returns the current dynamic floor
++ *		voltage based upon static configurations and the state of all
++ *		power domains during the last CPR measurement
++ * @ctrl:		Pointer to the CPR3 controller
++ * @reg_last_measurement: Value read from the LAST_MEASUREMENT register
++ *
++ * When using HW closed-loop, the dynamic floor voltage is always returned
++ * regardless of the current state of the power domains.
++ *
++ * Return: dynamic floor voltage in microvolts or 0 if dynamic floor is not
++ *         currently required
++ */
++static int cpr3_regulator_get_dynamic_floor_volt(struct cpr3_controller *ctrl,
++		u32 reg_last_measurement)
++{
++	int dynamic_floor_volt = 0;
++	struct cpr3_regulator *vreg;
++	bool valid, pd_valid;
++	u32 bypass_bits;
++	int i, j;
++
++	if (!ctrl->supports_hw_closed_loop)
++		return 0;
++
++	if (likely(!ctrl->use_hw_closed_loop)) {
++		valid = !!(reg_last_measurement & CPR3_LAST_MEASUREMENT_VALID);
++		bypass_bits
++		 = (reg_last_measurement & CPR3_LAST_MEASUREMENT_PD_BYPASS_MASK)
++			>> CPR3_LAST_MEASUREMENT_PD_BYPASS_SHIFT;
++	} else {
++		/*
++		 * Ensure that the dynamic floor voltage is always used for
++		 * HW closed-loop since the conditions below cannot be evaluated
++		 * after each CPR measurement.
++		 */
++		valid = false;
++		bypass_bits = 0;
++	}
++
++	for (i = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++			vreg = &ctrl->thread[i].vreg[j];
++
++			if (!vreg->uses_dynamic_floor)
++				continue;
++
++			pd_valid = !((bypass_bits & vreg->pd_bypass_mask)
++					== vreg->pd_bypass_mask);
++
++			if (!valid || !pd_valid)
++				dynamic_floor_volt = max(dynamic_floor_volt,
++					vreg->corner[
++					 vreg->dynamic_floor_corner].last_volt);
++		}
++	}
++
++	return dynamic_floor_volt;
++}
++
++/**
++ * cpr3_regulator_max_sdelta_diff() - returns the maximum voltage difference in
++ *		microvolts that can result from different operating conditions
++ *		for the specified sdelta struct
++ * @sdelta:		Pointer to the sdelta structure
++ * @step_volt:		Step size in microvolts between available set
++ *			points of the VDD supply.
++ *
++ * Return: voltage difference between the highest and lowest adjustments if
++ *	sdelta and sdelta->table are valid, else 0.
++ */
++static int cpr3_regulator_max_sdelta_diff(const struct cpr4_sdelta *sdelta,
++				int step_volt)
++{
++	int i, j, index, sdelta_min = INT_MAX, sdelta_max = INT_MIN;
++
++	if (!sdelta || !sdelta->table)
++		return 0;
++
++	for (i = 0; i < sdelta->max_core_count; i++) {
++		for (j = 0; j < sdelta->temp_band_count; j++) {
++			index = i * sdelta->temp_band_count + j;
++			sdelta_min = min(sdelta_min, sdelta->table[index]);
++			sdelta_max = max(sdelta_max, sdelta->table[index]);
++		}
++	}
++
++	return (sdelta_max - sdelta_min) * step_volt;
++}
++
++/**
++ * cpr3_regulator_aggregate_sdelta() - check open-loop voltages of current
++ *		aggregated corner and current corner of a given regulator
++ *		and adjust the sdelta strucuture data of aggregate corner.
++ * @aggr_corner:	Pointer to accumulated aggregated corner which
++ *			is both an input and an output
++ * @corner:		Pointer to the corner to be aggregated with
++ *			aggr_corner
++ * @step_volt:		Step size in microvolts between available set
++ *			points of the VDD supply.
++ *
++ * Return: none
++ */
++static void cpr3_regulator_aggregate_sdelta(
++				struct cpr3_corner *aggr_corner,
++				const struct cpr3_corner *corner, int step_volt)
++{
++	struct cpr4_sdelta *aggr_sdelta, *sdelta;
++	int aggr_core_count, core_count, temp_band_count;
++	u32 aggr_index, index;
++	int i, j, sdelta_size, cap_steps, adjust_sdelta;
++
++	aggr_sdelta = aggr_corner->sdelta;
++	sdelta = corner->sdelta;
++
++	if (aggr_corner->open_loop_volt < corner->open_loop_volt) {
++		/*
++		 * Found the new dominant regulator as its open-loop requirement
++		 * is higher than previous dominant regulator. Calculate cap
++		 * voltage to limit the SDELTA values to make sure the runtime
++		 * (Core-count/temp) adjustments do not violate other
++		 * regulators' voltage requirements. Use cpr4_sdelta values of
++		 * new dominant regulator.
++		 */
++		aggr_sdelta->cap_volt = min(aggr_sdelta->cap_volt,
++						(corner->open_loop_volt -
++						aggr_corner->open_loop_volt));
++
++		/* Clear old data in the sdelta table */
++		sdelta_size = aggr_sdelta->max_core_count
++					* aggr_sdelta->temp_band_count;
++
++		if (aggr_sdelta->allow_core_count_adj
++			|| aggr_sdelta->allow_temp_adj)
++			memset(aggr_sdelta->table, 0, sdelta_size
++					* sizeof(*aggr_sdelta->table));
++
++		if (sdelta->allow_temp_adj || sdelta->allow_core_count_adj) {
++			/* Copy new data in sdelta table */
++			sdelta_size = sdelta->max_core_count
++						* sdelta->temp_band_count;
++			if (sdelta->table)
++				memcpy(aggr_sdelta->table, sdelta->table,
++					sdelta_size * sizeof(*sdelta->table));
++		}
++
++		if (sdelta->allow_boost) {
++			memcpy(aggr_sdelta->boost_table, sdelta->boost_table,
++				sdelta->temp_band_count
++				* sizeof(*sdelta->boost_table));
++			aggr_sdelta->boost_num_cores = sdelta->boost_num_cores;
++		} else if (aggr_sdelta->allow_boost) {
++			for (i = 0; i < aggr_sdelta->temp_band_count; i++) {
++				adjust_sdelta = (corner->open_loop_volt
++						- aggr_corner->open_loop_volt)
++						/ step_volt;
++				aggr_sdelta->boost_table[i] += adjust_sdelta;
++				aggr_sdelta->boost_table[i]
++					= min(aggr_sdelta->boost_table[i], 0);
++			}
++		}
++
++		aggr_corner->open_loop_volt = corner->open_loop_volt;
++		aggr_sdelta->allow_temp_adj = sdelta->allow_temp_adj;
++		aggr_sdelta->allow_core_count_adj
++					= sdelta->allow_core_count_adj;
++		aggr_sdelta->max_core_count = sdelta->max_core_count;
++		aggr_sdelta->temp_band_count = sdelta->temp_band_count;
++	} else if (aggr_corner->open_loop_volt > corner->open_loop_volt) {
++		/*
++		 * Adjust the cap voltage if the open-loop requirement of new
++		 * regulator is the next highest.
++		 */
++		aggr_sdelta->cap_volt = min(aggr_sdelta->cap_volt,
++						(aggr_corner->open_loop_volt
++						- corner->open_loop_volt));
++
++		if (sdelta->allow_boost) {
++			for (i = 0; i < aggr_sdelta->temp_band_count; i++) {
++				adjust_sdelta = (aggr_corner->open_loop_volt
++						- corner->open_loop_volt)
++						/ step_volt;
++				aggr_sdelta->boost_table[i] =
++					sdelta->boost_table[i] + adjust_sdelta;
++				aggr_sdelta->boost_table[i]
++					= min(aggr_sdelta->boost_table[i], 0);
++			}
++			aggr_sdelta->boost_num_cores = sdelta->boost_num_cores;
++		}
++	} else {
++		/*
++		 * Found another dominant regulator with same open-loop
++		 * requirement. Make cap voltage to '0'. Disable core-count
++		 * adjustments as we couldn't support for both regulators.
++		 * Keep enable temp based adjustments if enabled for both
++		 * regulators and choose mininum margin adjustment values
++		 * between them.
++		 */
++		aggr_sdelta->cap_volt = 0;
++		aggr_sdelta->allow_core_count_adj = false;
++
++		if (aggr_sdelta->allow_temp_adj
++					&& sdelta->allow_temp_adj) {
++			aggr_core_count = aggr_sdelta->max_core_count - 1;
++			core_count = sdelta->max_core_count - 1;
++			temp_band_count = sdelta->temp_band_count;
++			for (j = 0; j < temp_band_count; j++) {
++				aggr_index = aggr_core_count * temp_band_count
++						+ j;
++				index = core_count * temp_band_count + j;
++				aggr_sdelta->table[aggr_index] =
++					min(aggr_sdelta->table[aggr_index],
++						sdelta->table[index]);
++			}
++		} else {
++			aggr_sdelta->allow_temp_adj = false;
++		}
++
++		if (sdelta->allow_boost) {
++			memcpy(aggr_sdelta->boost_table, sdelta->boost_table,
++				sdelta->temp_band_count
++				* sizeof(*sdelta->boost_table));
++			aggr_sdelta->boost_num_cores = sdelta->boost_num_cores;
++		}
++	}
++
++	/* Keep non-dominant clients boost enable state */
++	aggr_sdelta->allow_boost |= sdelta->allow_boost;
++	if (aggr_sdelta->allow_boost)
++		aggr_sdelta->allow_core_count_adj = false;
++
++	if (aggr_sdelta->cap_volt && !(aggr_sdelta->cap_volt == INT_MAX)) {
++		core_count = aggr_sdelta->max_core_count;
++		temp_band_count = aggr_sdelta->temp_band_count;
++		/*
++		 * Convert cap voltage from uV to PMIC steps and use to limit
++		 * sdelta margin adjustments.
++		 */
++		cap_steps = aggr_sdelta->cap_volt / step_volt;
++		for (i = 0; i < core_count; i++)
++			for (j = 0; j < temp_band_count; j++) {
++				index = i * temp_band_count + j;
++				aggr_sdelta->table[index] =
++						min(aggr_sdelta->table[index],
++							cap_steps);
++		}
++	}
++}
++
++/**
++ * cpr3_regulator_aggregate_corners() - aggregate two corners together
++ * @aggr_corner:		Pointer to accumulated aggregated corner which
++ *				is both an input and an output
++ * @corner:			Pointer to the corner to be aggregated with
++ *				aggr_corner
++ * @aggr_quot:			Flag indicating that target quotients should be
++ *				aggregated as well.
++ * @step_volt:			Step size in microvolts between available set
++ *				points of the VDD supply.
++ *
++ * Return: none
++ */
++static void cpr3_regulator_aggregate_corners(struct cpr3_corner *aggr_corner,
++			const struct cpr3_corner *corner, bool aggr_quot,
++			int step_volt)
++{
++	int i;
++
++	aggr_corner->ceiling_volt
++		= max(aggr_corner->ceiling_volt, corner->ceiling_volt);
++	aggr_corner->floor_volt
++		= max(aggr_corner->floor_volt, corner->floor_volt);
++	aggr_corner->last_volt
++		= max(aggr_corner->last_volt, corner->last_volt);
++	aggr_corner->system_volt
++		= max(aggr_corner->system_volt, corner->system_volt);
++	aggr_corner->mem_acc_volt
++		= max(aggr_corner->mem_acc_volt, corner->mem_acc_volt);
++	aggr_corner->irq_en |= corner->irq_en;
++	aggr_corner->use_open_loop |= corner->use_open_loop;
++
++	if (aggr_quot) {
++		aggr_corner->ro_mask &= corner->ro_mask;
++
++		for (i = 0; i < CPR3_RO_COUNT; i++)
++			aggr_corner->target_quot[i]
++				= max(aggr_corner->target_quot[i],
++				      corner->target_quot[i]);
++	}
++
++	if (aggr_corner->sdelta && corner->sdelta
++		&& (aggr_corner->sdelta->table
++		|| aggr_corner->sdelta->boost_table)) {
++		cpr3_regulator_aggregate_sdelta(aggr_corner, corner, step_volt);
++	} else {
++		aggr_corner->open_loop_volt
++			= max(aggr_corner->open_loop_volt,
++				corner->open_loop_volt);
++	}
++}
++
++/**
++ * cpr3_regulator_update_ctrl_state() - update the state of the CPR controller
++ *		to reflect the corners used by all CPR3 regulators as well as
++ *		the CPR operating mode
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * This function aggregates the CPR parameters for all CPR3 regulators
++ * associated with the VDD supply.  Upon success, it sets the aggregated last
++ * known good voltage.
++ *
++ * The VDD supply voltage will not be physically configured unless this
++ * condition is met by at least one of the regulators of the controller:
++ * regulator->vreg_enabled == true &&
++ * regulator->current_corner != CPR3_REGULATOR_CORNER_INVALID
++ *
++ * CPR registers for the controller and each thread are updated as long as
++ * ctrl->cpr_enabled == true.
++ *
++ * Note, CPR3 controller lock must be held by the caller.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int _cpr3_regulator_update_ctrl_state(struct cpr3_controller *ctrl)
++{
++	struct cpr3_corner aggr_corner = {};
++	struct cpr3_thread *thread;
++	struct cpr3_regulator *vreg;
++	struct cpr4_sdelta *sdelta;
++	bool valid = false;
++	bool thread_valid;
++	int i, j, rc, new_volt, vdd_volt, dynamic_floor_volt, last_corner_volt;
++	u32 reg_last_measurement = 0, sdelta_size;
++	int *sdelta_table, *boost_table;
++
++	last_corner_volt = 0;
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		rc = cpr3_ctrl_clear_cpr4_config(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "failed to clear CPR4 configuration,rc=%d\n",
++				rc);
++			return rc;
++		}
++	}
++
++	cpr3_ctrl_loop_disable(ctrl);
++
++	vdd_volt = regulator_get_voltage(ctrl->vdd_regulator);
++	if (vdd_volt < 0) {
++		cpr3_err(ctrl, "regulator_get_voltage(vdd) failed, rc=%d\n",
++			 vdd_volt);
++		return vdd_volt;
++	}
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		/*
++		 * Save aggregated corner open-loop voltage which was programmed
++		 * during last corner switch which is used when programming new
++		 * aggregated corner open-loop voltage.
++		 */
++		last_corner_volt = ctrl->aggr_corner.open_loop_volt;
++	}
++
++	if (ctrl->cpr_enabled && ctrl->use_hw_closed_loop &&
++		ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3)
++		reg_last_measurement
++			= cpr3_read(ctrl, CPR3_REG_LAST_MEASUREMENT);
++
++	aggr_corner.sdelta = ctrl->aggr_corner.sdelta;
++	if (aggr_corner.sdelta) {
++		sdelta = aggr_corner.sdelta;
++		sdelta_table = sdelta->table;
++		if (sdelta_table) {
++			sdelta_size = sdelta->max_core_count *
++					sdelta->temp_band_count;
++			memset(sdelta_table, 0, sdelta_size
++					* sizeof(*sdelta_table));
++		}
++
++		boost_table = sdelta->boost_table;
++		if (boost_table)
++			memset(boost_table, 0, sdelta->temp_band_count
++					* sizeof(*boost_table));
++
++		memset(sdelta, 0, sizeof(*sdelta));
++		sdelta->table = sdelta_table;
++		sdelta->cap_volt = INT_MAX;
++		sdelta->boost_table = boost_table;
++	}
++
++	/* Aggregate the requests of all threads */
++	for (i = 0; i < ctrl->thread_count; i++) {
++		thread = &ctrl->thread[i];
++		thread_valid = false;
++
++		sdelta = thread->aggr_corner.sdelta;
++		if (sdelta) {
++			sdelta_table = sdelta->table;
++			if (sdelta_table) {
++				sdelta_size = sdelta->max_core_count *
++						sdelta->temp_band_count;
++				memset(sdelta_table, 0, sdelta_size
++						* sizeof(*sdelta_table));
++			}
++
++			boost_table = sdelta->boost_table;
++			if (boost_table)
++				memset(boost_table, 0, sdelta->temp_band_count
++						* sizeof(*boost_table));
++
++			memset(sdelta, 0, sizeof(*sdelta));
++			sdelta->table = sdelta_table;
++			sdelta->cap_volt = INT_MAX;
++			sdelta->boost_table = boost_table;
++		}
++
++		memset(&thread->aggr_corner, 0, sizeof(thread->aggr_corner));
++		thread->aggr_corner.sdelta = sdelta;
++		thread->aggr_corner.ro_mask = CPR3_RO_MASK;
++
++		for (j = 0; j < thread->vreg_count; j++) {
++			vreg = &thread->vreg[j];
++
++			if (ctrl->cpr_enabled && ctrl->use_hw_closed_loop)
++				cpr3_update_vreg_closed_loop_volt(vreg,
++						vdd_volt, reg_last_measurement);
++
++			if (!vreg->vreg_enabled
++			    || vreg->current_corner
++					    == CPR3_REGULATOR_CORNER_INVALID) {
++				/* Cannot participate in aggregation. */
++				vreg->aggregated = false;
++				continue;
++			} else {
++				vreg->aggregated = true;
++				thread_valid = true;
++			}
++
++			cpr3_regulator_aggregate_corners(&thread->aggr_corner,
++					&vreg->corner[vreg->current_corner],
++					true, ctrl->step_volt);
++		}
++
++		valid |= thread_valid;
++
++		if (thread_valid)
++			cpr3_regulator_aggregate_corners(&aggr_corner,
++					&thread->aggr_corner,
++					false, ctrl->step_volt);
++	}
++
++	if (valid && ctrl->cpr_allowed_hw && ctrl->cpr_allowed_sw) {
++		rc = cpr3_closed_loop_enable(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "could not enable CPR, rc=%d\n", rc);
++			return rc;
++		}
++	} else {
++		rc = cpr3_closed_loop_disable(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "could not disable CPR, rc=%d\n", rc);
++			return rc;
++		}
++	}
++
++	/* No threads are enabled with a valid corner so exit. */
++	if (!valid)
++		return 0;
++
++	/*
++	 * When using CPR hardware closed-loop, the voltage may vary anywhere
++	 * between the floor and ceiling voltage without software notification.
++	 * Therefore, it is required that the floor to ceiling range for the
++	 * aggregated corner not intersect the APM threshold voltage.  Adjust
++	 * the floor to ceiling range if this requirement is violated.
++	 *
++	 * The following algorithm is applied in the case that
++	 * floor < threshold <= ceiling:
++	 *	if open_loop >= threshold - adj, then floor = threshold
++	 *	else ceiling = threshold - step
++	 * where adj = an adjustment factor to ensure sufficient voltage margin
++	 * and step = VDD output step size
++	 *
++	 * The open-loop and last known voltages are also bounded by the new
++	 * floor or ceiling value as needed.
++	 */
++	if (ctrl->use_hw_closed_loop
++	    && aggr_corner.ceiling_volt >= ctrl->apm_threshold_volt
++	    && aggr_corner.floor_volt < ctrl->apm_threshold_volt) {
++
++		if (aggr_corner.open_loop_volt
++		    >= ctrl->apm_threshold_volt - ctrl->apm_adj_volt)
++			aggr_corner.floor_volt = ctrl->apm_threshold_volt;
++		else
++			aggr_corner.ceiling_volt
++				= ctrl->apm_threshold_volt - ctrl->step_volt;
++
++		aggr_corner.last_volt
++		    = max(aggr_corner.last_volt, aggr_corner.floor_volt);
++		aggr_corner.last_volt
++		    = min(aggr_corner.last_volt, aggr_corner.ceiling_volt);
++		aggr_corner.open_loop_volt
++		    = max(aggr_corner.open_loop_volt, aggr_corner.floor_volt);
++		aggr_corner.open_loop_volt
++		    = min(aggr_corner.open_loop_volt, aggr_corner.ceiling_volt);
++	}
++
++	if (ctrl->use_hw_closed_loop
++	    && aggr_corner.ceiling_volt >= ctrl->mem_acc_threshold_volt
++	    && aggr_corner.floor_volt < ctrl->mem_acc_threshold_volt) {
++		aggr_corner.floor_volt = ctrl->mem_acc_threshold_volt;
++		aggr_corner.last_volt = max(aggr_corner.last_volt,
++					     aggr_corner.floor_volt);
++		aggr_corner.open_loop_volt = max(aggr_corner.open_loop_volt,
++						  aggr_corner.floor_volt);
++	}
++
++	if (ctrl->use_hw_closed_loop) {
++		dynamic_floor_volt
++			= cpr3_regulator_get_dynamic_floor_volt(ctrl,
++							reg_last_measurement);
++		if (aggr_corner.floor_volt < dynamic_floor_volt) {
++			aggr_corner.floor_volt = dynamic_floor_volt;
++			aggr_corner.last_volt = max(aggr_corner.last_volt,
++							aggr_corner.floor_volt);
++			aggr_corner.open_loop_volt
++				= max(aggr_corner.open_loop_volt,
++					aggr_corner.floor_volt);
++			aggr_corner.ceiling_volt = max(aggr_corner.ceiling_volt,
++							aggr_corner.floor_volt);
++		}
++	}
++
++	if (ctrl->cpr_enabled && ctrl->last_corner_was_closed_loop) {
++		/*
++		 * Always program open-loop voltage for CPR4 controllers which
++		 * support hardware closed-loop.  Storing the last closed loop
++		 * voltage in corner structure can still help with debugging.
++		 */
++		if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3)
++			new_volt = aggr_corner.last_volt;
++		else if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4
++			 && ctrl->supports_hw_closed_loop)
++			new_volt = aggr_corner.open_loop_volt;
++		else
++			new_volt = min(aggr_corner.last_volt +
++			      cpr3_regulator_max_sdelta_diff(aggr_corner.sdelta,
++							     ctrl->step_volt),
++				       aggr_corner.ceiling_volt);
++
++		aggr_corner.last_volt = new_volt;
++	} else {
++		new_volt = aggr_corner.open_loop_volt;
++		aggr_corner.last_volt = aggr_corner.open_loop_volt;
++	}
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4
++	    && ctrl->supports_hw_closed_loop) {
++		/*
++		 * Store last aggregated corner open-loop voltage in vdd_volt
++		 * which is used when programming current aggregated corner
++		 * required voltage.
++		 */
++		vdd_volt = last_corner_volt;
++	}
++
++	cpr3_debug(ctrl, "setting new voltage=%d uV\n", new_volt);
++	rc = cpr3_regulator_scale_vdd_voltage(ctrl, new_volt,
++					      vdd_volt, &aggr_corner);
++	if (rc) {
++		cpr3_err(ctrl, "vdd voltage scaling failed, rc=%d\n", rc);
++		return rc;
++	}
++
++	/* Only update registers if CPR is enabled. */
++	if (ctrl->cpr_enabled) {
++		if (ctrl->use_hw_closed_loop) {
++			/* Hardware closed-loop */
++
++			/* Set ceiling and floor limits in hardware */
++			rc = regulator_set_voltage(ctrl->vdd_limit_regulator,
++				aggr_corner.floor_volt,
++				aggr_corner.ceiling_volt);
++			if (rc) {
++				cpr3_err(ctrl, "could not configure HW closed-loop voltage limits, rc=%d\n",
++					rc);
++				return rc;
++			}
++		} else {
++			/* Software closed-loop */
++
++			/*
++			 * Disable UP or DOWN interrupts when at ceiling or
++			 * floor respectively.
++			 */
++			if (new_volt == aggr_corner.floor_volt)
++				aggr_corner.irq_en &= ~CPR3_IRQ_DOWN;
++			if (new_volt == aggr_corner.ceiling_volt)
++				aggr_corner.irq_en &= ~CPR3_IRQ_UP;
++
++			cpr3_write(ctrl, CPR3_REG_IRQ_CLEAR,
++				CPR3_IRQ_UP | CPR3_IRQ_DOWN);
++			cpr3_write(ctrl, CPR3_REG_IRQ_EN, aggr_corner.irq_en);
++		}
++
++		for (i = 0; i < ctrl->thread_count; i++) {
++			cpr3_regulator_set_target_quot(&ctrl->thread[i]);
++
++			for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++				vreg = &ctrl->thread[i].vreg[j];
++
++				if (vreg->vreg_enabled)
++					vreg->last_closed_loop_corner
++						= vreg->current_corner;
++			}
++		}
++
++		if (ctrl->proc_clock_throttle) {
++			if (aggr_corner.ceiling_volt > aggr_corner.floor_volt
++			    && (ctrl->use_hw_closed_loop
++					|| new_volt < aggr_corner.ceiling_volt))
++				cpr3_write(ctrl, CPR3_REG_PD_THROTTLE,
++						ctrl->proc_clock_throttle);
++			else
++				cpr3_write(ctrl, CPR3_REG_PD_THROTTLE,
++						CPR3_PD_THROTTLE_DISABLE);
++		}
++
++		/*
++		 * Ensure that all CPR register writes complete before
++		 * re-enabling CPR loop operation.
++		 */
++		wmb();
++	} else if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4
++		   && ctrl->vdd_limit_regulator) {
++		/* Set ceiling and floor limits in hardware */
++		rc = regulator_set_voltage(ctrl->vdd_limit_regulator,
++			aggr_corner.floor_volt,
++			aggr_corner.ceiling_volt);
++		if (rc) {
++			cpr3_err(ctrl, "could not configure HW closed-loop voltage limits, rc=%d\n",
++				rc);
++			return rc;
++		}
++	}
++
++	ctrl->aggr_corner = aggr_corner;
++
++	if (ctrl->allow_core_count_adj || ctrl->allow_temp_adj
++		|| ctrl->allow_boost) {
++		rc = cpr3_controller_program_sdelta(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "failed to program sdelta, rc=%d\n", rc);
++			return rc;
++		}
++	}
++
++	/*
++	 * Only enable the CPR controller if it is possible to set more than
++	 * one vdd-supply voltage.
++	 */
++	if (aggr_corner.ceiling_volt > aggr_corner.floor_volt &&
++			!aggr_corner.use_open_loop)
++		cpr3_ctrl_loop_enable(ctrl);
++
++	ctrl->last_corner_was_closed_loop = ctrl->cpr_enabled;
++	cpr3_debug(ctrl, "CPR configuration updated\n");
++
++	return 0;
++}
++
++/**
++ * cpr3_regulator_wait_for_idle() - wait for the CPR controller to no longer be
++ *		busy
++ * @ctrl:		Pointer to the CPR3 controller
++ * @max_wait_ns:	Max wait time in nanoseconds
++ *
++ * Return: 0 on success or -ETIMEDOUT if the controller was still busy after
++ *	   the maximum delay time
++ */
++static int cpr3_regulator_wait_for_idle(struct cpr3_controller *ctrl,
++					s64 max_wait_ns)
++{
++	ktime_t start, end;
++	s64 time_ns;
++	u32 reg;
++
++	/*
++	 * Ensure that all previous CPR register writes have completed before
++	 * checking the status register.
++	 */
++	mb();
++
++	start = ktime_get();
++	do {
++		end = ktime_get();
++		time_ns = ktime_to_ns(ktime_sub(end, start));
++		if (time_ns > max_wait_ns) {
++			cpr3_err(ctrl, "CPR controller still busy after %lld us\n",
++				div_s64(time_ns, 1000));
++			return -ETIMEDOUT;
++		}
++		usleep_range(50, 100);
++		reg = cpr3_read(ctrl, CPR3_REG_CPR_STATUS);
++	} while (reg & CPR3_CPR_STATUS_BUSY_MASK);
++
++	return 0;
++}
++
++/**
++ * cmp_int() - int comparison function to be passed into the sort() function
++ *		which leads to ascending sorting
++ * @a:			First int value
++ * @b:			Second int value
++ *
++ * Return: >0 if a > b, 0 if a == b, <0 if a < b
++ */
++static int cmp_int(const void *a, const void *b)
++{
++	return *(int *)a - *(int *)b;
++}
++
++/**
++ * cpr3_regulator_measure_aging() - measure the quotient difference for the
++ *		specified CPR aging sensor
++ * @ctrl:		Pointer to the CPR3 controller
++ * @aging_sensor:	Aging sensor to measure
++ *
++ * Note that vdd-supply must be configured to the aging reference voltage before
++ * calling this function.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_measure_aging(struct cpr3_controller *ctrl,
++				struct cpr3_aging_sensor_info *aging_sensor)
++{
++	u32 mask, reg, result, quot_min, quot_max, sel_min, sel_max;
++	u32 quot_min_scaled, quot_max_scaled;
++	u32 gcnt, gcnt_ref, gcnt0_restore, gcnt1_restore, irq_restore;
++	u32 ro_mask_restore, cont_dly_restore, up_down_dly_restore = 0;
++	int quot_delta, quot_delta_scaled, quot_delta_scaled_sum;
++	int *quot_delta_results;
++	int rc, rc2, i, aging_measurement_count, filtered_count;
++	bool is_aging_measurement;
++
++	quot_delta_results = kcalloc(CPR3_AGING_MEASUREMENT_ITERATIONS,
++			sizeof(*quot_delta_results), GFP_KERNEL);
++	if (!quot_delta_results)
++		return -ENOMEM;
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		rc = cpr3_ctrl_clear_cpr4_config(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "failed to clear CPR4 configuration,rc=%d\n",
++				rc);
++			kfree(quot_delta_results);
++			return rc;
++		}
++	}
++
++	cpr3_ctrl_loop_disable(ctrl);
++
++	/* Enable up, down, and mid CPR interrupts */
++	irq_restore = cpr3_read(ctrl, CPR3_REG_IRQ_EN);
++	cpr3_write(ctrl, CPR3_REG_IRQ_EN,
++			CPR3_IRQ_UP | CPR3_IRQ_DOWN | CPR3_IRQ_MID);
++
++	/* Ensure that the aging sensor is assigned to CPR thread 0 */
++	cpr3_write(ctrl, CPR3_REG_SENSOR_OWNER(aging_sensor->sensor_id), 0);
++
++	/* Switch from HW to SW closed-loop if necessary */
++	if (ctrl->supports_hw_closed_loop) {
++		if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++			cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++				CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_EN_MASK,
++				CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_DISABLE);
++		} else if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++			cpr3_write(ctrl, CPR3_REG_HW_CLOSED_LOOP,
++				CPR3_HW_CLOSED_LOOP_DISABLE);
++		}
++	}
++
++	/* Configure the GCNT for RO0 and RO1 that are used for aging */
++	gcnt0_restore = cpr3_read(ctrl, CPR3_REG_GCNT(0));
++	gcnt1_restore = cpr3_read(ctrl, CPR3_REG_GCNT(1));
++	gcnt_ref = cpr3_regulator_get_gcnt(ctrl);
++	gcnt = gcnt_ref * 3 / 2;
++	cpr3_write(ctrl, CPR3_REG_GCNT(0), gcnt);
++	cpr3_write(ctrl, CPR3_REG_GCNT(1), gcnt);
++
++	/* Unmask all RO's */
++	ro_mask_restore = cpr3_read(ctrl, CPR3_REG_RO_MASK(0));
++	cpr3_write(ctrl, CPR3_REG_RO_MASK(0), 0);
++
++	/*
++	 * Mask all sensors except for the one to measure and bypass all
++	 * sensors in collapsible domains.
++	 */
++	for (i = 0; i <= ctrl->sensor_count / 32; i++) {
++		mask = GENMASK(min(31, ctrl->sensor_count - i * 32), 0);
++		if (aging_sensor->sensor_id / 32 >= i
++		    && aging_sensor->sensor_id / 32 < (i + 1))
++			mask &= ~BIT(aging_sensor->sensor_id % 32);
++		cpr3_write(ctrl, CPR3_REG_SENSOR_MASK_WRITE_BANK(i), mask);
++		cpr3_write(ctrl, CPR3_REG_SENSOR_BYPASS_WRITE_BANK(i),
++				aging_sensor->bypass_mask[i]);
++	}
++
++	/* Set CPR loop delays to 0 us */
++	if (ctrl->supports_hw_closed_loop
++		&& ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++		cont_dly_restore = cpr3_read(ctrl, CPR3_REG_CPR_TIMER_MID_CONT);
++		up_down_dly_restore = cpr3_read(ctrl,
++						CPR3_REG_CPR_TIMER_UP_DN_CONT);
++		cpr3_write(ctrl, CPR3_REG_CPR_TIMER_MID_CONT, 0);
++		cpr3_write(ctrl, CPR3_REG_CPR_TIMER_UP_DN_CONT, 0);
++	} else {
++		cont_dly_restore = cpr3_read(ctrl,
++						CPR3_REG_CPR_TIMER_AUTO_CONT);
++		cpr3_write(ctrl, CPR3_REG_CPR_TIMER_AUTO_CONT, 0);
++	}
++
++	/* Set count mode to all-at-once min with no repeat */
++	cpr3_masked_write(ctrl, CPR3_REG_CPR_CTL,
++		CPR3_CPR_CTL_COUNT_MODE_MASK | CPR3_CPR_CTL_COUNT_REPEAT_MASK,
++		CPR3_CPR_CTL_COUNT_MODE_ALL_AT_ONCE_MIN
++			<< CPR3_CPR_CTL_COUNT_MODE_SHIFT);
++
++	cpr3_ctrl_loop_enable(ctrl);
++
++	rc = cpr3_regulator_wait_for_idle(ctrl,
++					CPR3_AGING_MEASUREMENT_TIMEOUT_NS);
++	if (rc)
++		goto cleanup;
++
++	/* Set count mode to all-at-once aging */
++	cpr3_masked_write(ctrl, CPR3_REG_CPR_CTL, CPR3_CPR_CTL_COUNT_MODE_MASK,
++			CPR3_CPR_CTL_COUNT_MODE_ALL_AT_ONCE_AGE
++				<< CPR3_CPR_CTL_COUNT_MODE_SHIFT);
++
++	aging_measurement_count = 0;
++	for (i = 0; i < CPR3_AGING_MEASUREMENT_ITERATIONS; i++) {
++		/* Send CONT_NACK */
++		cpr3_write(ctrl, CPR3_REG_CONT_CMD, CPR3_CONT_CMD_NACK);
++
++		rc = cpr3_regulator_wait_for_idle(ctrl,
++					CPR3_AGING_MEASUREMENT_TIMEOUT_NS);
++		if (rc)
++			goto cleanup;
++
++		/* Check for PAGE_IS_AGE flag in status register */
++		reg = cpr3_read(ctrl, CPR3_REG_CPR_STATUS);
++		is_aging_measurement
++			= reg & CPR3_CPR_STATUS_AGING_MEASUREMENT_MASK;
++
++		/* Read CPR measurement results */
++		result = cpr3_read(ctrl, CPR3_REG_RESULT1(0));
++		quot_min = (result & CPR3_RESULT1_QUOT_MIN_MASK)
++				>> CPR3_RESULT1_QUOT_MIN_SHIFT;
++		quot_max = (result & CPR3_RESULT1_QUOT_MAX_MASK)
++				>> CPR3_RESULT1_QUOT_MAX_SHIFT;
++		sel_min = (result & CPR3_RESULT1_RO_MIN_MASK)
++				>> CPR3_RESULT1_RO_MIN_SHIFT;
++		sel_max = (result & CPR3_RESULT1_RO_MAX_MASK)
++				>> CPR3_RESULT1_RO_MAX_SHIFT;
++
++		/*
++		 * Scale the quotients so that they are equivalent to the fused
++		 * values.  This accounts for the difference in measurement
++		 * interval times.
++		 */
++		quot_min_scaled = quot_min * (gcnt_ref + 1) / (gcnt + 1);
++		quot_max_scaled = quot_max * (gcnt_ref + 1) / (gcnt + 1);
++
++		if (sel_max == 1) {
++			quot_delta = quot_max - quot_min;
++			quot_delta_scaled = quot_max_scaled - quot_min_scaled;
++		} else {
++			quot_delta = quot_min - quot_max;
++			quot_delta_scaled = quot_min_scaled - quot_max_scaled;
++		}
++
++		if (is_aging_measurement)
++			quot_delta_results[aging_measurement_count++]
++				= quot_delta_scaled;
++
++		cpr3_debug(ctrl, "aging results: page_is_age=%u, sel_min=%u, sel_max=%u, quot_min=%u, quot_max=%u, quot_delta=%d, quot_min_scaled=%u, quot_max_scaled=%u, quot_delta_scaled=%d\n",
++			is_aging_measurement, sel_min, sel_max, quot_min,
++			quot_max, quot_delta, quot_min_scaled, quot_max_scaled,
++			quot_delta_scaled);
++	}
++
++	filtered_count
++		= aging_measurement_count - CPR3_AGING_MEASUREMENT_FILTER * 2;
++	if (filtered_count > 0) {
++		sort(quot_delta_results, aging_measurement_count,
++			sizeof(*quot_delta_results), cmp_int, NULL);
++
++		quot_delta_scaled_sum = 0;
++		for (i = 0; i < filtered_count; i++)
++			quot_delta_scaled_sum
++				+= quot_delta_results[i
++					+ CPR3_AGING_MEASUREMENT_FILTER];
++
++		aging_sensor->measured_quot_diff
++			= quot_delta_scaled_sum / filtered_count;
++		cpr3_info(ctrl, "average quotient delta=%d (count=%d)\n",
++			aging_sensor->measured_quot_diff,
++			filtered_count);
++	} else {
++		cpr3_err(ctrl, "%d aging measurements completed after %d iterations\n",
++			aging_measurement_count,
++			CPR3_AGING_MEASUREMENT_ITERATIONS);
++		rc = -EBUSY;
++	}
++
++cleanup:
++	kfree(quot_delta_results);
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		rc2 = cpr3_ctrl_clear_cpr4_config(ctrl);
++		if (rc2) {
++			cpr3_err(ctrl, "failed to clear CPR4 configuration,rc=%d\n",
++				rc2);
++			rc = rc2;
++		}
++	}
++
++	cpr3_ctrl_loop_disable(ctrl);
++
++	cpr3_write(ctrl, CPR3_REG_IRQ_EN, irq_restore);
++
++	cpr3_write(ctrl, CPR3_REG_RO_MASK(0), ro_mask_restore);
++
++	cpr3_write(ctrl, CPR3_REG_GCNT(0), gcnt0_restore);
++	cpr3_write(ctrl, CPR3_REG_GCNT(1), gcnt1_restore);
++
++	if (ctrl->supports_hw_closed_loop
++		&& ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++		cpr3_write(ctrl, CPR3_REG_CPR_TIMER_MID_CONT, cont_dly_restore);
++		cpr3_write(ctrl, CPR3_REG_CPR_TIMER_UP_DN_CONT,
++				up_down_dly_restore);
++	} else {
++		cpr3_write(ctrl, CPR3_REG_CPR_TIMER_AUTO_CONT,
++				cont_dly_restore);
++	}
++
++	for (i = 0; i <= ctrl->sensor_count / 32; i++) {
++		cpr3_write(ctrl, CPR3_REG_SENSOR_MASK_WRITE_BANK(i), 0);
++		cpr3_write(ctrl, CPR3_REG_SENSOR_BYPASS_WRITE_BANK(i), 0);
++	}
++
++	cpr3_masked_write(ctrl, CPR3_REG_CPR_CTL,
++		CPR3_CPR_CTL_COUNT_MODE_MASK | CPR3_CPR_CTL_COUNT_REPEAT_MASK,
++		(ctrl->count_mode << CPR3_CPR_CTL_COUNT_MODE_SHIFT)
++		| (ctrl->count_repeat << CPR3_CPR_CTL_COUNT_REPEAT_SHIFT));
++
++	cpr3_write(ctrl, CPR3_REG_SENSOR_OWNER(aging_sensor->sensor_id),
++			ctrl->sensor_owner[aging_sensor->sensor_id]);
++
++	cpr3_write(ctrl, CPR3_REG_IRQ_CLEAR,
++			CPR3_IRQ_UP | CPR3_IRQ_DOWN | CPR3_IRQ_MID);
++
++	if (ctrl->supports_hw_closed_loop) {
++		if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++			cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++				CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_EN_MASK,
++				ctrl->use_hw_closed_loop
++				? CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_ENABLE
++				: CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_DISABLE);
++		} else if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++			cpr3_write(ctrl, CPR3_REG_HW_CLOSED_LOOP,
++				ctrl->use_hw_closed_loop
++				? CPR3_HW_CLOSED_LOOP_ENABLE
++				: CPR3_HW_CLOSED_LOOP_DISABLE);
++		}
++	}
++
++	return rc;
++}
++
++/**
++ * cpr3_regulator_readjust_volt_and_quot() - readjust the target quotients as
++ *		well as the floor, ceiling, and open-loop voltages for the
++ *		regulator by removing the old adjustment and adding the new one
++ * @vreg:		Pointer to the CPR3 regulator
++ * @old_adjust_volt:	Old aging adjustment voltage in microvolts
++ * @new_adjust_volt:	New aging adjustment voltage in microvolts
++ *
++ * Also reset the cached closed loop voltage (last_volt) to equal the open-loop
++ * voltage for each corner.
++ *
++ * Return: None
++ */
++static void cpr3_regulator_readjust_volt_and_quot(struct cpr3_regulator *vreg,
++		int old_adjust_volt, int new_adjust_volt)
++{
++	unsigned long long temp;
++	int i, j, old_volt, new_volt, rounded_volt;
++
++	if (!vreg->aging_allowed)
++		return;
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		temp = (unsigned long long)old_adjust_volt
++			* (unsigned long long)vreg->corner[i].aging_derate;
++		do_div(temp, 1000);
++		old_volt = temp;
++
++		temp = (unsigned long long)new_adjust_volt
++			* (unsigned long long)vreg->corner[i].aging_derate;
++		do_div(temp, 1000);
++		new_volt = temp;
++
++		old_volt = min(vreg->aging_max_adjust_volt, old_volt);
++		new_volt = min(vreg->aging_max_adjust_volt, new_volt);
++
++		for (j = 0; j < CPR3_RO_COUNT; j++) {
++			if (vreg->corner[i].target_quot[j] != 0) {
++				vreg->corner[i].target_quot[j]
++					+= cpr3_quot_adjustment(
++						vreg->corner[i].ro_scale[j],
++						new_volt)
++					   - cpr3_quot_adjustment(
++						vreg->corner[i].ro_scale[j],
++						old_volt);
++			}
++		}
++
++		rounded_volt = CPR3_ROUND(new_volt,
++					vreg->thread->ctrl->step_volt);
++
++		if (!vreg->aging_allow_open_loop_adj)
++			rounded_volt = 0;
++
++		vreg->corner[i].ceiling_volt
++			= vreg->corner[i].unaged_ceiling_volt + rounded_volt;
++		vreg->corner[i].ceiling_volt = min(vreg->corner[i].ceiling_volt,
++					      vreg->corner[i].abs_ceiling_volt);
++		vreg->corner[i].floor_volt
++			= vreg->corner[i].unaged_floor_volt + rounded_volt;
++		vreg->corner[i].floor_volt = min(vreg->corner[i].floor_volt,
++						vreg->corner[i].ceiling_volt);
++		vreg->corner[i].open_loop_volt
++			= vreg->corner[i].unaged_open_loop_volt + rounded_volt;
++		vreg->corner[i].open_loop_volt
++			= min(vreg->corner[i].open_loop_volt,
++				vreg->corner[i].ceiling_volt);
++
++		vreg->corner[i].last_volt = vreg->corner[i].open_loop_volt;
++
++		cpr3_debug(vreg, "corner %d: applying %d uV closed-loop and %d uV open-loop voltage margin adjustment\n",
++			i, new_volt, rounded_volt);
++	}
++}
++
++/**
++ * cpr3_regulator_set_aging_ref_adjustment() - adjust target quotients for the
++ *		regulators managed by this CPR controller to account for aging
++ * @ctrl:		Pointer to the CPR3 controller
++ * @ref_adjust_volt:	New aging reference adjustment voltage in microvolts to
++ *			apply to all regulators managed by this CPR controller
++ *
++ * The existing aging adjustment as defined by ctrl->aging_ref_adjust_volt is
++ * first removed and then the adjustment is applied.  Lastly, the value of
++ * ctrl->aging_ref_adjust_volt is updated to ref_adjust_volt.
++ */
++static void cpr3_regulator_set_aging_ref_adjustment(
++		struct cpr3_controller *ctrl, int ref_adjust_volt)
++{
++	struct cpr3_regulator *vreg;
++	int i, j;
++
++	for (i = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++			vreg = &ctrl->thread[i].vreg[j];
++			cpr3_regulator_readjust_volt_and_quot(vreg,
++				ctrl->aging_ref_adjust_volt, ref_adjust_volt);
++		}
++	}
++
++	ctrl->aging_ref_adjust_volt = ref_adjust_volt;
++}
++
++/**
++ * cpr3_regulator_aging_adjust() - adjust the target quotients for regulators
++ *		based on the output of CPR aging sensors
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_aging_adjust(struct cpr3_controller *ctrl)
++{
++	struct cpr3_regulator *vreg;
++	struct cpr3_corner restore_aging_corner;
++	struct cpr3_corner *corner;
++	int *restore_current_corner;
++	bool *restore_vreg_enabled;
++	int i, j, id, rc, rc2, vreg_count, aging_volt, max_aging_volt = 0;
++	u32 reg;
++
++	if (!ctrl->aging_required || !ctrl->cpr_enabled
++	    || ctrl->aggr_corner.ceiling_volt == 0
++	    || ctrl->aggr_corner.ceiling_volt > ctrl->aging_ref_volt)
++		return 0;
++
++	for (i = 0, vreg_count = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++			vreg = &ctrl->thread[i].vreg[j];
++			vreg_count++;
++
++			if (vreg->aging_allowed && vreg->vreg_enabled
++			    && vreg->current_corner > vreg->aging_corner)
++				return 0;
++		}
++	}
++
++	/* Verify that none of the aging sensors are currently masked. */
++	for (i = 0; i < ctrl->aging_sensor_count; i++) {
++		id = ctrl->aging_sensor[i].sensor_id;
++		reg = cpr3_read(ctrl, CPR3_REG_SENSOR_MASK_READ(id));
++		if (reg & BIT(id % 32))
++			return 0;
++	}
++
++	/*
++	 * Verify that the aging possible register (if specified) has an
++	 * acceptable value.
++	 */
++	if (ctrl->aging_possible_reg) {
++		reg = readl_relaxed(ctrl->aging_possible_reg);
++		reg &= ctrl->aging_possible_mask;
++		if (reg != ctrl->aging_possible_val)
++			return 0;
++	}
++
++	restore_current_corner = kcalloc(vreg_count,
++				sizeof(*restore_current_corner), GFP_KERNEL);
++	restore_vreg_enabled = kcalloc(vreg_count,
++				sizeof(*restore_vreg_enabled), GFP_KERNEL);
++	if (!restore_current_corner || !restore_vreg_enabled) {
++		kfree(restore_current_corner);
++		kfree(restore_vreg_enabled);
++		return -ENOMEM;
++	}
++
++	/* Force all regulators to the aging corner */
++	for (i = 0, vreg_count = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++, vreg_count++) {
++			vreg = &ctrl->thread[i].vreg[j];
++
++			restore_current_corner[vreg_count]
++				= vreg->current_corner;
++			restore_vreg_enabled[vreg_count]
++				= vreg->vreg_enabled;
++
++			vreg->current_corner = vreg->aging_corner;
++			vreg->vreg_enabled = true;
++		}
++	}
++
++	/* Force one of the regulators to require the aging reference voltage */
++	vreg = &ctrl->thread[0].vreg[0];
++	corner = &vreg->corner[vreg->current_corner];
++	restore_aging_corner = *corner;
++	corner->ceiling_volt = ctrl->aging_ref_volt;
++	corner->floor_volt = ctrl->aging_ref_volt;
++	corner->open_loop_volt = ctrl->aging_ref_volt;
++	corner->last_volt = ctrl->aging_ref_volt;
++
++	/* Skip last_volt caching */
++	ctrl->last_corner_was_closed_loop = false;
++
++	/* Set the vdd supply voltage to the aging reference voltage */
++	rc = _cpr3_regulator_update_ctrl_state(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "unable to force vdd-supply to the aging reference voltage=%d uV, rc=%d\n",
++			ctrl->aging_ref_volt, rc);
++		goto cleanup;
++	}
++
++	if (ctrl->aging_vdd_mode) {
++		rc = regulator_set_mode(ctrl->vdd_regulator,
++					ctrl->aging_vdd_mode);
++		if (rc) {
++			cpr3_err(ctrl, "unable to configure vdd-supply for mode=%u, rc=%d\n",
++				ctrl->aging_vdd_mode, rc);
++			goto cleanup;
++		}
++	}
++
++	/* Perform aging measurement on all aging sensors */
++	for (i = 0; i < ctrl->aging_sensor_count; i++) {
++		for (j = 0; j < CPR3_AGING_RETRY_COUNT; j++) {
++			rc = cpr3_regulator_measure_aging(ctrl,
++					&ctrl->aging_sensor[i]);
++			if (!rc)
++				break;
++		}
++
++		if (!rc) {
++			aging_volt =
++				cpr3_voltage_adjustment(
++					ctrl->aging_sensor[i].ro_scale,
++					ctrl->aging_sensor[i].measured_quot_diff
++					- ctrl->aging_sensor[i].init_quot_diff);
++			max_aging_volt = max(max_aging_volt, aging_volt);
++		} else {
++			cpr3_err(ctrl, "CPR aging measurement failed after %d tries, rc=%d\n",
++				j, rc);
++			ctrl->aging_failed = true;
++			ctrl->aging_required = false;
++			goto cleanup;
++		}
++	}
++
++cleanup:
++	vreg = &ctrl->thread[0].vreg[0];
++	vreg->corner[vreg->current_corner] = restore_aging_corner;
++
++	for (i = 0, vreg_count = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++, vreg_count++) {
++			vreg = &ctrl->thread[i].vreg[j];
++			vreg->current_corner
++				= restore_current_corner[vreg_count];
++			vreg->vreg_enabled = restore_vreg_enabled[vreg_count];
++		}
++	}
++
++	kfree(restore_current_corner);
++	kfree(restore_vreg_enabled);
++
++	/* Adjust the CPR target quotients according to the aging measurement */
++	if (!rc) {
++		cpr3_regulator_set_aging_ref_adjustment(ctrl, max_aging_volt);
++
++		cpr3_info(ctrl, "aging measurement successful; aging reference adjustment voltage=%d uV\n",
++			ctrl->aging_ref_adjust_volt);
++		ctrl->aging_succeeded = true;
++		ctrl->aging_required = false;
++	}
++
++	if (ctrl->aging_complete_vdd_mode) {
++		rc = regulator_set_mode(ctrl->vdd_regulator,
++					ctrl->aging_complete_vdd_mode);
++		if (rc)
++			cpr3_err(ctrl, "unable to configure vdd-supply for mode=%u, rc=%d\n",
++				ctrl->aging_complete_vdd_mode, rc);
++	}
++
++	/* Skip last_volt caching */
++	ctrl->last_corner_was_closed_loop = false;
++
++	/*
++	 * Restore vdd-supply to the voltage before the aging measurement and
++	 * restore the CPR3 controller hardware state.
++	 */
++	rc2 = _cpr3_regulator_update_ctrl_state(ctrl);
++
++	/* Stop last_volt caching on for the next request */
++	ctrl->last_corner_was_closed_loop = false;
++
++	return rc ? rc : rc2;
++}
++
++/**
++ * cpr3_regulator_update_ctrl_state() - update the state of the CPR controller
++ *		to reflect the corners used by all CPR3 regulators as well as
++ *		the CPR operating mode and perform aging adjustments if needed
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Note, CPR3 controller lock must be held by the caller.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_update_ctrl_state(struct cpr3_controller *ctrl)
++{
++	int rc;
++
++	rc = _cpr3_regulator_update_ctrl_state(ctrl);
++	if (rc)
++		return rc;
++
++	return cpr3_regulator_aging_adjust(ctrl);
++}
++
++/**
++ * cpr3_regulator_set_voltage() - set the voltage corner for the CPR3 regulator
++ *			associated with the regulator device
++ * @rdev:		Regulator device pointer for the cpr3-regulator
++ * @corner:		New voltage corner to set (offset by CPR3_CORNER_OFFSET)
++ * @corner_max:		Maximum voltage corner allowed (offset by
++ *			CPR3_CORNER_OFFSET)
++ * @selector:		Pointer which is filled with the selector value for the
++ *			corner
++ *
++ * This function is passed as a callback function into the regulator ops that
++ * are registered for each cpr3-regulator device.  The VDD voltage will not be
++ * physically configured until both this function and cpr3_regulator_enable()
++ * are called.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_set_voltage(struct regulator_dev *rdev,
++		int corner, int corner_max, unsigned *selector)
++{
++	struct cpr3_regulator *vreg = rdev_get_drvdata(rdev);
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	int rc = 0;
++	int last_corner;
++
++	corner -= CPR3_CORNER_OFFSET;
++	corner_max -= CPR3_CORNER_OFFSET;
++	*selector = corner;
++
++	mutex_lock(&ctrl->lock);
++
++	if (!vreg->vreg_enabled) {
++		vreg->current_corner = corner;
++		cpr3_debug(vreg, "stored corner=%d\n", corner);
++		goto done;
++	} else if (vreg->current_corner == corner) {
++		goto done;
++	}
++
++	last_corner = vreg->current_corner;
++	vreg->current_corner = corner;
++
++	if (vreg->cpr4_regulator_data != NULL)
++		if (vreg->cpr4_regulator_data->mem_acc_funcs != NULL)
++			vreg->cpr4_regulator_data->mem_acc_funcs->set_mem_acc(rdev);
++
++	rc = cpr3_regulator_update_ctrl_state(ctrl);
++	if (rc) {
++		cpr3_err(vreg, "could not update CPR state, rc=%d\n", rc);
++		vreg->current_corner = last_corner;
++	}
++
++	if (vreg->cpr4_regulator_data != NULL)
++		if (vreg->cpr4_regulator_data->mem_acc_funcs != NULL)
++			vreg->cpr4_regulator_data->mem_acc_funcs->clear_mem_acc(rdev);
++
++	cpr3_debug(vreg, "set corner=%d\n", corner);
++done:
++	mutex_unlock(&ctrl->lock);
++
++	return rc;
++}
++
++/**
++ * cpr3_handle_temp_open_loop_adjustment() - voltage based cold temperature
++ *
++ * @rdev:		Regulator device pointer for the cpr3-regulator
++ * @is_cold:		Flag to denote enter/exit cold condition
++ *
++ * This function is adjusts voltage margin based on cold condition
++ *
++ * Return: 0 = success
++ */
++
++int cpr3_handle_temp_open_loop_adjustment(struct cpr3_controller *ctrl,
++								bool is_cold)
++{
++	int i ,j, k, rc;
++	struct cpr3_regulator *vreg;
++
++	mutex_lock(&ctrl->lock);
++	for (i = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++			vreg = &ctrl->thread[i].vreg[j];
++			for (k = 0; k < vreg->corner_count; k++) {
++				vreg->corner[k].open_loop_volt = is_cold ?
++				    vreg->corner[k].cold_temp_open_loop_volt :
++				    vreg->corner[k].normal_temp_open_loop_volt;
++			}
++		}
++	}
++	rc = cpr3_regulator_update_ctrl_state(ctrl);
++	mutex_unlock(&ctrl->lock);
++
++	return rc;
++}
++
++/**
++ * cpr3_regulator_get_voltage() - get the voltage corner for the CPR3 regulator
++ *			associated with the regulator device
++ * @rdev:		Regulator device pointer for the cpr3-regulator
++ *
++ * This function is passed as a callback function into the regulator ops that
++ * are registered for each cpr3-regulator device.
++ *
++ * Return: voltage corner value offset by CPR3_CORNER_OFFSET
++ */
++static int cpr3_regulator_get_voltage(struct regulator_dev *rdev)
++{
++	struct cpr3_regulator *vreg = rdev_get_drvdata(rdev);
++
++	if (vreg->current_corner == CPR3_REGULATOR_CORNER_INVALID)
++		return CPR3_CORNER_OFFSET;
++	else
++		return vreg->current_corner + CPR3_CORNER_OFFSET;
++}
++
++/**
++ * cpr3_regulator_list_voltage() - return the voltage corner mapped to the
++ *			specified selector
++ * @rdev:		Regulator device pointer for the cpr3-regulator
++ * @selector:		Regulator selector
++ *
++ * This function is passed as a callback function into the regulator ops that
++ * are registered for each cpr3-regulator device.
++ *
++ * Return: voltage corner value offset by CPR3_CORNER_OFFSET
++ */
++static int cpr3_regulator_list_voltage(struct regulator_dev *rdev,
++		unsigned selector)
++{
++	struct cpr3_regulator *vreg = rdev_get_drvdata(rdev);
++
++	if (selector < vreg->corner_count)
++		return selector + CPR3_CORNER_OFFSET;
++	else
++		return 0;
++}
++
++/**
++ * cpr3_regulator_is_enabled() - return the enable state of the CPR3 regulator
++ * @rdev:		Regulator device pointer for the cpr3-regulator
++ *
++ * This function is passed as a callback function into the regulator ops that
++ * are registered for each cpr3-regulator device.
++ *
++ * Return: true if regulator is enabled, false if regulator is disabled
++ */
++static int cpr3_regulator_is_enabled(struct regulator_dev *rdev)
++{
++	struct cpr3_regulator *vreg = rdev_get_drvdata(rdev);
++
++	return vreg->vreg_enabled;
++}
++
++/**
++ * cpr3_regulator_enable() - enable the CPR3 regulator
++ * @rdev:		Regulator device pointer for the cpr3-regulator
++ *
++ * This function is passed as a callback function into the regulator ops that
++ * are registered for each cpr3-regulator device.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_enable(struct regulator_dev *rdev)
++{
++	struct cpr3_regulator *vreg = rdev_get_drvdata(rdev);
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	int rc = 0;
++
++	if (vreg->vreg_enabled == true)
++		return 0;
++
++	mutex_lock(&ctrl->lock);
++
++	if (ctrl->system_regulator) {
++		rc = regulator_enable(ctrl->system_regulator);
++		if (rc) {
++			cpr3_err(ctrl, "regulator_enable(system) failed, rc=%d\n",
++				rc);
++			goto done;
++		}
++	}
++
++	rc = regulator_enable(ctrl->vdd_regulator);
++	if (rc) {
++		cpr3_err(vreg, "regulator_enable(vdd) failed, rc=%d\n", rc);
++		goto done;
++	}
++
++	vreg->vreg_enabled = true;
++	rc = cpr3_regulator_update_ctrl_state(ctrl);
++	if (rc) {
++		cpr3_err(vreg, "could not update CPR state, rc=%d\n", rc);
++		regulator_disable(ctrl->vdd_regulator);
++		vreg->vreg_enabled = false;
++		goto done;
++	}
++
++	cpr3_debug(vreg, "Enabled\n");
++done:
++	mutex_unlock(&ctrl->lock);
++
++	return rc;
++}
++
++/**
++ * cpr3_regulator_disable() - disable the CPR3 regulator
++ * @rdev:		Regulator device pointer for the cpr3-regulator
++ *
++ * This function is passed as a callback function into the regulator ops that
++ * are registered for each cpr3-regulator device.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_disable(struct regulator_dev *rdev)
++{
++	struct cpr3_regulator *vreg = rdev_get_drvdata(rdev);
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	int rc, rc2;
++
++	if (vreg->vreg_enabled == false)
++		return 0;
++
++	mutex_lock(&ctrl->lock);
++	rc = regulator_disable(ctrl->vdd_regulator);
++	if (rc) {
++		cpr3_err(vreg, "regulator_disable(vdd) failed, rc=%d\n", rc);
++		goto done;
++	}
++
++	vreg->vreg_enabled = false;
++	rc = cpr3_regulator_update_ctrl_state(ctrl);
++	if (rc) {
++		cpr3_err(vreg, "could not update CPR state, rc=%d\n", rc);
++		rc2 = regulator_enable(ctrl->vdd_regulator);
++		vreg->vreg_enabled = true;
++		goto done;
++	}
++
++	if (ctrl->system_regulator) {
++		rc = regulator_disable(ctrl->system_regulator);
++		if (rc) {
++			cpr3_err(ctrl, "regulator_disable(system) failed, rc=%d\n",
++				rc);
++			goto done;
++		}
++	}
++
++	cpr3_debug(vreg, "Disabled\n");
++done:
++	mutex_unlock(&ctrl->lock);
++
++	return rc;
++}
++
++static struct regulator_ops cpr3_regulator_ops = {
++	.enable			= cpr3_regulator_enable,
++	.disable		= cpr3_regulator_disable,
++	.is_enabled		= cpr3_regulator_is_enabled,
++	.set_voltage		= cpr3_regulator_set_voltage,
++	.get_voltage		= cpr3_regulator_get_voltage,
++	.list_voltage		= cpr3_regulator_list_voltage,
++};
++
++/**
++ * cpr3_print_result() - print CPR measurement results to the kernel log for
++ *		debugging purposes
++ * @thread:		Pointer to the CPR3 thread
++ *
++ * Return: None
++ */
++static void cpr3_print_result(struct cpr3_thread *thread)
++{
++	struct cpr3_controller *ctrl = thread->ctrl;
++	u32 result[3], busy, step_dn, step_up, error_steps, error, negative;
++	u32 quot_min, quot_max, ro_min, ro_max, step_quot_min, step_quot_max;
++	u32 sensor_min, sensor_max;
++	char *sign;
++
++	result[0] = cpr3_read(ctrl, CPR3_REG_RESULT0(thread->thread_id));
++	result[1] = cpr3_read(ctrl, CPR3_REG_RESULT1(thread->thread_id));
++	result[2] = cpr3_read(ctrl, CPR3_REG_RESULT2(thread->thread_id));
++
++	busy = !!(result[0] & CPR3_RESULT0_BUSY_MASK);
++	step_dn = !!(result[0] & CPR3_RESULT0_STEP_DN_MASK);
++	step_up = !!(result[0] & CPR3_RESULT0_STEP_UP_MASK);
++	error_steps = (result[0] & CPR3_RESULT0_ERROR_STEPS_MASK)
++			>> CPR3_RESULT0_ERROR_STEPS_SHIFT;
++	error = (result[0] & CPR3_RESULT0_ERROR_MASK)
++			>> CPR3_RESULT0_ERROR_SHIFT;
++	negative = !!(result[0] & CPR3_RESULT0_NEGATIVE_MASK);
++
++	quot_min = (result[1] & CPR3_RESULT1_QUOT_MIN_MASK)
++			>> CPR3_RESULT1_QUOT_MIN_SHIFT;
++	quot_max = (result[1] & CPR3_RESULT1_QUOT_MAX_MASK)
++			>> CPR3_RESULT1_QUOT_MAX_SHIFT;
++	ro_min = (result[1] & CPR3_RESULT1_RO_MIN_MASK)
++			>> CPR3_RESULT1_RO_MIN_SHIFT;
++	ro_max = (result[1] & CPR3_RESULT1_RO_MAX_MASK)
++			>> CPR3_RESULT1_RO_MAX_SHIFT;
++
++	step_quot_min = (result[2] & CPR3_RESULT2_STEP_QUOT_MIN_MASK)
++			>> CPR3_RESULT2_STEP_QUOT_MIN_SHIFT;
++	step_quot_max = (result[2] & CPR3_RESULT2_STEP_QUOT_MAX_MASK)
++			>> CPR3_RESULT2_STEP_QUOT_MAX_SHIFT;
++	sensor_min = (result[2] & CPR3_RESULT2_SENSOR_MIN_MASK)
++			>> CPR3_RESULT2_SENSOR_MIN_SHIFT;
++	sensor_max = (result[2] & CPR3_RESULT2_SENSOR_MAX_MASK)
++			>> CPR3_RESULT2_SENSOR_MAX_SHIFT;
++
++	sign = negative ? "-" : "";
++	cpr3_debug(ctrl, "thread %u: busy=%u, step_dn=%u, step_up=%u, error_steps=%s%u, error=%s%u\n",
++		thread->thread_id, busy, step_dn, step_up, sign, error_steps,
++		sign, error);
++	cpr3_debug(ctrl, "thread %u: quot_min=%u, quot_max=%u, ro_min=%u, ro_max=%u\n",
++		thread->thread_id, quot_min, quot_max, ro_min, ro_max);
++	cpr3_debug(ctrl, "thread %u: step_quot_min=%u, step_quot_max=%u, sensor_min=%u, sensor_max=%u\n",
++		thread->thread_id, step_quot_min, step_quot_max, sensor_min,
++		sensor_max);
++}
++
++/**
++ * cpr3_thread_busy() - returns if the specified CPR3 thread is busy taking
++ *		a measurement
++ * @thread:		Pointer to the CPR3 thread
++ *
++ * Return: CPR3 busy status
++ */
++static bool cpr3_thread_busy(struct cpr3_thread *thread)
++{
++	u32 result;
++
++	result = cpr3_read(thread->ctrl, CPR3_REG_RESULT0(thread->thread_id));
++
++	return !!(result & CPR3_RESULT0_BUSY_MASK);
++}
++
++/**
++ * cpr3_irq_handler() - CPR interrupt handler callback function used for
++ *		software closed-loop operation
++ * @irq:		CPR interrupt number
++ * @data:		Private data corresponding to the CPR3 controller
++ *			pointer
++ *
++ * This function increases or decreases the vdd supply voltage based upon the
++ * CPR controller recommendation.
++ *
++ * Return: IRQ_HANDLED
++ */
++static irqreturn_t cpr3_irq_handler(int irq, void *data)
++{
++	struct cpr3_controller *ctrl = data;
++	struct cpr3_corner *aggr = &ctrl->aggr_corner;
++	u32 cont = CPR3_CONT_CMD_NACK;
++	u32 reg_last_measurement = 0;
++	struct cpr3_regulator *vreg;
++	struct cpr3_corner *corner;
++	unsigned long flags;
++	int i, j, new_volt, last_volt, dynamic_floor_volt, rc;
++	u32 irq_en, status, cpr_status, ctl;
++	bool up, down;
++
++	mutex_lock(&ctrl->lock);
++
++	if (!ctrl->cpr_enabled) {
++		cpr3_debug(ctrl, "CPR interrupt received but CPR is disabled\n");
++		mutex_unlock(&ctrl->lock);
++		return IRQ_HANDLED;
++	} else if (ctrl->use_hw_closed_loop) {
++		cpr3_debug(ctrl, "CPR interrupt received but CPR is using HW closed-loop\n");
++		goto done;
++	}
++
++	/*
++	 * CPR IRQ status checking and CPR controller disabling must happen
++	 * atomically and without invening delay in order to avoid an interrupt
++	 * storm caused by the handler racing with the CPR controller.
++	 */
++	local_irq_save(flags);
++	preempt_disable();
++
++	status = cpr3_read(ctrl, CPR3_REG_IRQ_STATUS);
++	up = status & CPR3_IRQ_UP;
++	down = status & CPR3_IRQ_DOWN;
++
++	if (!up && !down) {
++		/*
++		 * Toggle the CPR controller off and then back on since the
++		 * hardware and software states are out of sync.  This condition
++		 * occurs after an aging measurement completes as the CPR IRQ
++		 * physically triggers during the aging measurement but the
++		 * handler is stuck waiting on the mutex lock.
++		 */
++		cpr3_ctrl_loop_disable(ctrl);
++
++		local_irq_restore(flags);
++		preempt_enable();
++
++		/* Wait for the loop disable write to complete */
++		mb();
++
++		/* Wait for BUSY=1 and LOOP_EN=0 in CPR controller registers. */
++		for (i = 0; i < CPR3_REGISTER_WRITE_DELAY_US / 10; i++) {
++			cpr_status = cpr3_read(ctrl, CPR3_REG_CPR_STATUS);
++			ctl = cpr3_read(ctrl, CPR3_REG_CPR_CTL);
++			if (cpr_status & CPR3_CPR_STATUS_BUSY_MASK
++			    && (ctl & CPR3_CPR_CTL_LOOP_EN_MASK)
++					== CPR3_CPR_CTL_LOOP_DISABLE)
++				break;
++			udelay(10);
++		}
++		if (i == CPR3_REGISTER_WRITE_DELAY_US / 10)
++			cpr3_debug(ctrl, "CPR controller not disabled after %d us\n",
++				CPR3_REGISTER_WRITE_DELAY_US);
++
++		/* Clear interrupt status */
++		cpr3_write(ctrl, CPR3_REG_IRQ_CLEAR,
++			CPR3_IRQ_UP | CPR3_IRQ_DOWN);
++
++		/* Wait for the interrupt clearing write to complete */
++		mb();
++
++		/* Wait for IRQ_STATUS register to be cleared. */
++		for (i = 0; i < CPR3_REGISTER_WRITE_DELAY_US / 10; i++) {
++			status = cpr3_read(ctrl, CPR3_REG_IRQ_STATUS);
++			if (!(status & (CPR3_IRQ_UP | CPR3_IRQ_DOWN)))
++				break;
++			udelay(10);
++		}
++		if (i == CPR3_REGISTER_WRITE_DELAY_US / 10)
++			cpr3_debug(ctrl, "CPR interrupts not cleared after %d us\n",
++				CPR3_REGISTER_WRITE_DELAY_US);
++
++		cpr3_ctrl_loop_enable(ctrl);
++
++		cpr3_debug(ctrl, "CPR interrupt received but no up or down status bit is set\n");
++
++		mutex_unlock(&ctrl->lock);
++		return IRQ_HANDLED;
++	} else if (up && down) {
++		cpr3_debug(ctrl, "both up and down status bits set\n");
++		/* The up flag takes precedence over the down flag. */
++		down = false;
++	}
++
++	if (ctrl->supports_hw_closed_loop)
++		reg_last_measurement
++			= cpr3_read(ctrl, CPR3_REG_LAST_MEASUREMENT);
++	dynamic_floor_volt = cpr3_regulator_get_dynamic_floor_volt(ctrl,
++							reg_last_measurement);
++
++	local_irq_restore(flags);
++	preempt_enable();
++
++	irq_en = aggr->irq_en;
++	last_volt = aggr->last_volt;
++
++	for (i = 0; i < ctrl->thread_count; i++) {
++		if (cpr3_thread_busy(&ctrl->thread[i])) {
++			cpr3_debug(ctrl, "CPR thread %u busy when it should be waiting for SW cont\n",
++				ctrl->thread[i].thread_id);
++			goto done;
++		}
++	}
++
++	new_volt = up ? last_volt + ctrl->step_volt
++		      : last_volt - ctrl->step_volt;
++
++	/* Re-enable UP/DOWN interrupt when its opposite is received. */
++	irq_en |= up ? CPR3_IRQ_DOWN : CPR3_IRQ_UP;
++
++	if (new_volt > aggr->ceiling_volt) {
++		new_volt = aggr->ceiling_volt;
++		irq_en &= ~CPR3_IRQ_UP;
++		cpr3_debug(ctrl, "limiting to ceiling=%d uV\n",
++			aggr->ceiling_volt);
++	} else if (new_volt < aggr->floor_volt) {
++		new_volt = aggr->floor_volt;
++		irq_en &= ~CPR3_IRQ_DOWN;
++		cpr3_debug(ctrl, "limiting to floor=%d uV\n", aggr->floor_volt);
++	}
++
++	if (down && new_volt < dynamic_floor_volt) {
++		/*
++		 * The vdd-supply voltage should not be decreased below the
++		 * dynamic floor voltage.  However, it is not necessary (and
++		 * counter productive) to force the voltage up to this level
++		 * if it happened to be below it since the closed-loop voltage
++		 * must have gotten there in a safe manner while the power
++		 * domains for the CPR3 regulator imposing the dynamic floor
++		 * were not bypassed.
++		 */
++		new_volt = last_volt;
++		irq_en &= ~CPR3_IRQ_DOWN;
++		cpr3_debug(ctrl, "limiting to dynamic floor=%d uV\n",
++			dynamic_floor_volt);
++	}
++
++	for (i = 0; i < ctrl->thread_count; i++)
++		cpr3_print_result(&ctrl->thread[i]);
++
++	cpr3_debug(ctrl, "%s: new_volt=%d uV, last_volt=%d uV\n",
++		up ? "UP" : "DN", new_volt, last_volt);
++
++	if (ctrl->proc_clock_throttle && last_volt == aggr->ceiling_volt
++	    && new_volt < last_volt)
++		cpr3_write(ctrl, CPR3_REG_PD_THROTTLE,
++				ctrl->proc_clock_throttle);
++
++	if (new_volt != last_volt) {
++		rc = cpr3_regulator_scale_vdd_voltage(ctrl, new_volt,
++						      last_volt,
++						      aggr);
++		if (rc) {
++			cpr3_err(ctrl, "scale_vdd() failed to set vdd=%d uV, rc=%d\n",
++				 new_volt, rc);
++			goto done;
++		}
++		cont = CPR3_CONT_CMD_ACK;
++
++		/*
++		 * Update the closed-loop voltage for all regulators managed
++		 * by this CPR controller.
++		 */
++		for (i = 0; i < ctrl->thread_count; i++) {
++			for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++				vreg = &ctrl->thread[i].vreg[j];
++				cpr3_update_vreg_closed_loop_volt(vreg,
++					new_volt, reg_last_measurement);
++			}
++		}
++	}
++
++	if (ctrl->proc_clock_throttle && new_volt == aggr->ceiling_volt)
++		cpr3_write(ctrl, CPR3_REG_PD_THROTTLE,
++				CPR3_PD_THROTTLE_DISABLE);
++
++	corner = &ctrl->thread[0].vreg[0].corner[
++			ctrl->thread[0].vreg[0].current_corner];
++
++	if (irq_en != aggr->irq_en) {
++		aggr->irq_en = irq_en;
++		cpr3_write(ctrl, CPR3_REG_IRQ_EN, irq_en);
++	}
++
++	aggr->last_volt = new_volt;
++
++done:
++	/* Clear interrupt status */
++	cpr3_write(ctrl, CPR3_REG_IRQ_CLEAR, CPR3_IRQ_UP | CPR3_IRQ_DOWN);
++
++	/* ACK or NACK the CPR controller */
++	cpr3_write(ctrl, CPR3_REG_CONT_CMD, cont);
++
++	mutex_unlock(&ctrl->lock);
++	return IRQ_HANDLED;
++}
++
++/**
++ * cpr3_ceiling_irq_handler() - CPR ceiling reached interrupt handler callback
++ *		function used for hardware closed-loop operation
++ * @irq:		CPR ceiling interrupt number
++ * @data:		Private data corresponding to the CPR3 controller
++ *			pointer
++ *
++ * This function disables processor clock throttling and closed-loop operation
++ * when the ceiling voltage is reached.
++ *
++ * Return: IRQ_HANDLED
++ */
++static irqreturn_t cpr3_ceiling_irq_handler(int irq, void *data)
++{
++	struct cpr3_controller *ctrl = data;
++	int volt;
++
++	mutex_lock(&ctrl->lock);
++
++	if (!ctrl->cpr_enabled) {
++		cpr3_debug(ctrl, "CPR ceiling interrupt received but CPR is disabled\n");
++		goto done;
++	} else if (!ctrl->use_hw_closed_loop) {
++		cpr3_debug(ctrl, "CPR ceiling interrupt received but CPR is using SW closed-loop\n");
++		goto done;
++	}
++
++	volt = regulator_get_voltage(ctrl->vdd_regulator);
++	if (volt < 0) {
++		cpr3_err(ctrl, "could not get vdd voltage, rc=%d\n", volt);
++		goto done;
++	} else if (volt != ctrl->aggr_corner.ceiling_volt) {
++		cpr3_debug(ctrl, "CPR ceiling interrupt received but vdd voltage: %d uV != ceiling voltage: %d uV\n",
++			volt, ctrl->aggr_corner.ceiling_volt);
++		goto done;
++	}
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++		/*
++		 * Since the ceiling voltage has been reached, disable processor
++		 * clock throttling as well as CPR closed-loop operation.
++		 */
++		cpr3_write(ctrl, CPR3_REG_PD_THROTTLE,
++				CPR3_PD_THROTTLE_DISABLE);
++		cpr3_ctrl_loop_disable(ctrl);
++		cpr3_debug(ctrl, "CPR closed-loop and throttling disabled\n");
++	}
++
++done:
++	mutex_unlock(&ctrl->lock);
++	return IRQ_HANDLED;
++}
++
++/**
++ * cpr3_regulator_vreg_register() - register a regulator device for a CPR3
++ *		regulator
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * This function initializes all regulator framework related structures and then
++ * calls regulator_register() for the CPR3 regulator.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_vreg_register(struct cpr3_regulator *vreg)
++{
++	struct regulator_config config = {};
++	struct regulator_desc *rdesc;
++	struct regulator_init_data *init_data;
++	int rc;
++
++	init_data = of_get_regulator_init_data(vreg->thread->ctrl->dev,
++						vreg->of_node, &vreg->rdesc);
++	if (!init_data) {
++		cpr3_err(vreg, "regulator init data is missing\n");
++		return -EINVAL;
++	}
++
++	init_data->constraints.input_uV = init_data->constraints.max_uV;
++	rdesc			= &vreg->rdesc;
++	init_data->constraints.valid_ops_mask |=
++		REGULATOR_CHANGE_VOLTAGE | REGULATOR_CHANGE_STATUS;
++	rdesc->ops = &cpr3_regulator_ops;
++
++	rdesc->n_voltages	= vreg->corner_count;
++	rdesc->name		= init_data->constraints.name;
++	rdesc->owner		= THIS_MODULE;
++	rdesc->type		= REGULATOR_VOLTAGE;
++
++	config.dev		= vreg->thread->ctrl->dev;
++	config.driver_data	= vreg;
++	config.init_data	= init_data;
++	config.of_node		= vreg->of_node;
++
++	vreg->rdev = regulator_register(vreg->thread->ctrl->dev, rdesc, &config);
++	if (IS_ERR(vreg->rdev)) {
++		rc = PTR_ERR(vreg->rdev);
++		cpr3_err(vreg, "regulator_register failed, rc=%d\n", rc);
++		return rc;
++	}
++
++	return 0;
++}
++
++static int debugfs_int_set(void *data, u64 val)
++{
++	*(int *)data = val;
++	return 0;
++}
++
++static int debugfs_int_get(void *data, u64 *val)
++{
++	*val = *(int *)data;
++	return 0;
++}
++DEFINE_SIMPLE_ATTRIBUTE(fops_int, debugfs_int_get, debugfs_int_set, "%lld\n");
++DEFINE_SIMPLE_ATTRIBUTE(fops_int_ro, debugfs_int_get, NULL, "%lld\n");
++DEFINE_SIMPLE_ATTRIBUTE(fops_int_wo, NULL, debugfs_int_set, "%lld\n");
++
++/**
++ * debugfs_create_int - create a debugfs file that is used to read and write a
++ *		signed int value
++ * @name:		Pointer to a string containing the name of the file to
++ *			create
++ * @mode:		The permissions that the file should have
++ * @parent:		Pointer to the parent dentry for this file.  This should
++ *			be a directory dentry if set.  If this parameter is
++ *			%NULL, then the file will be created in the root of the
++ *			debugfs filesystem.
++ * @value:		Pointer to the variable that the file should read to and
++ *			write from
++ *
++ * This function creates a file in debugfs with the given name that
++ * contains the value of the variable @value.  If the @mode variable is so
++ * set, it can be read from, and written to.
++ *
++ * This function will return a pointer to a dentry if it succeeds.  This
++ * pointer must be passed to the debugfs_remove() function when the file is
++ * to be removed.  If an error occurs, %NULL will be returned.
++ */
++static struct dentry *debugfs_create_int(const char *name, umode_t mode,
++				struct dentry *parent, int *value)
++{
++	/* if there are no write bits set, make read only */
++	if (!(mode & S_IWUGO))
++		return debugfs_create_file(name, mode, parent, value,
++					   &fops_int_ro);
++	/* if there are no read bits set, make write only */
++	if (!(mode & S_IRUGO))
++		return debugfs_create_file(name, mode, parent, value,
++					   &fops_int_wo);
++
++	return debugfs_create_file(name, mode, parent, value, &fops_int);
++}
++
++static int debugfs_bool_get(void *data, u64 *val)
++{
++	*val = *(bool *)data;
++	return 0;
++}
++DEFINE_SIMPLE_ATTRIBUTE(fops_bool_ro, debugfs_bool_get, NULL, "%lld\n");
++
++/**
++ * struct cpr3_debug_corner_info - data structure used by the
++ *		cpr3_debugfs_create_corner_int function
++ * @vreg:		Pointer to the CPR3 regulator
++ * @index:		Pointer to the corner array index
++ * @member_offset:	Offset in bytes from the beginning of struct cpr3_corner
++ *			to the beginning of the value to be read from
++ * @corner:		Pointer to the CPR3 corner array
++ */
++struct cpr3_debug_corner_info {
++	struct cpr3_regulator	*vreg;
++	int			*index;
++	size_t			member_offset;
++	struct cpr3_corner	*corner;
++};
++
++static int cpr3_debug_corner_int_get(void *data, u64 *val)
++{
++	struct cpr3_debug_corner_info *info = data;
++	struct cpr3_controller *ctrl = info->vreg->thread->ctrl;
++	int i;
++
++	mutex_lock(&ctrl->lock);
++
++	i = *info->index;
++	if (i < 0)
++		i = 0;
++
++	*val = *(int *)((char *)&info->vreg->corner[i] + info->member_offset);
++
++	mutex_unlock(&ctrl->lock);
++
++	return 0;
++}
++DEFINE_SIMPLE_ATTRIBUTE(cpr3_debug_corner_int_fops, cpr3_debug_corner_int_get,
++			NULL, "%lld\n");
++
++/**
++ * cpr3_debugfs_create_corner_int - create a debugfs file that is used to read
++ *		a signed int value out of a CPR3 regulator's corner array
++ * @vreg:		Pointer to the CPR3 regulator
++ * @name:		Pointer to a string containing the name of the file to
++ *			create
++ * @mode:		The permissions that the file should have
++ * @parent:		Pointer to the parent dentry for this file.  This should
++ *			be a directory dentry if set.  If this parameter is
++ *			%NULL, then the file will be created in the root of the
++ *			debugfs filesystem.
++ * @index:		Pointer to the corner array index
++ * @member_offset:	Offset in bytes from the beginning of struct cpr3_corner
++ *			to the beginning of the value to be read from
++ *
++ * This function creates a file in debugfs with the given name that
++ * contains the value of the int type variable vreg->corner[index].member
++ * where member_offset == offsetof(struct cpr3_corner, member).
++ */
++static struct dentry *cpr3_debugfs_create_corner_int(
++		struct cpr3_regulator *vreg, const char *name, umode_t mode,
++		struct dentry *parent, int *index, size_t member_offset)
++{
++	struct cpr3_debug_corner_info *info;
++
++	info = devm_kzalloc(vreg->thread->ctrl->dev, sizeof(*info), GFP_KERNEL);
++	if (!info)
++		return NULL;
++
++	info->vreg = vreg;
++	info->index = index;
++	info->member_offset = member_offset;
++
++	return debugfs_create_file(name, mode, parent, info,
++				   &cpr3_debug_corner_int_fops);
++}
++
++static int cpr3_debug_quot_open(struct inode *inode, struct file *file)
++{
++	struct cpr3_debug_corner_info *info = inode->i_private;
++	struct cpr3_thread *thread = info->vreg->thread;
++	int size, i, pos;
++	u32 *quot;
++	char *buf;
++
++	/*
++	 * Max size:
++	 *  - 10 digits + ' ' or '\n' = 11 bytes per number
++	 *  - terminating '\0'
++	 */
++	size = CPR3_RO_COUNT * 11;
++	buf = kzalloc(size + 1, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	file->private_data = buf;
++
++	mutex_lock(&thread->ctrl->lock);
++
++	quot = info->corner[*info->index].target_quot;
++
++	for (i = 0, pos = 0; i < CPR3_RO_COUNT; i++)
++		pos += scnprintf(buf + pos, size - pos, "%u%c",
++			quot[i], i < CPR3_RO_COUNT - 1 ? ' ' : '\n');
++
++	mutex_unlock(&thread->ctrl->lock);
++
++	return nonseekable_open(inode, file);
++}
++
++static ssize_t cpr3_debug_quot_read(struct file *file, char __user *buf,
++		size_t len, loff_t *ppos)
++{
++	return simple_read_from_buffer(buf, len, ppos, file->private_data,
++					strlen(file->private_data));
++}
++
++static int cpr3_debug_quot_release(struct inode *inode, struct file *file)
++{
++	kfree(file->private_data);
++
++	return 0;
++}
++
++static const struct file_operations cpr3_debug_quot_fops = {
++	.owner	 = THIS_MODULE,
++	.open	 = cpr3_debug_quot_open,
++	.release = cpr3_debug_quot_release,
++	.read	 = cpr3_debug_quot_read,
++};
++
++/**
++ * cpr3_regulator_debugfs_corner_add() - add debugfs files to expose
++ *		configuration data for the CPR corner
++ * @vreg:		Pointer to the CPR3 regulator
++ * @corner_dir:		Pointer to the parent corner dentry for the new files
++ * @index:		Pointer to the corner array index
++ *
++ * Return: none
++ */
++static void cpr3_regulator_debugfs_corner_add(struct cpr3_regulator *vreg,
++		struct dentry *corner_dir, int *index)
++{
++	struct cpr3_debug_corner_info *info;
++	struct dentry *temp;
++
++	temp = cpr3_debugfs_create_corner_int(vreg, "floor_volt", S_IRUGO,
++		corner_dir, index, offsetof(struct cpr3_corner, floor_volt));
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "floor_volt debugfs file creation failed\n");
++		return;
++	}
++
++	temp = cpr3_debugfs_create_corner_int(vreg, "ceiling_volt", S_IRUGO,
++		corner_dir, index, offsetof(struct cpr3_corner, ceiling_volt));
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "ceiling_volt debugfs file creation failed\n");
++		return;
++	}
++
++	temp = cpr3_debugfs_create_corner_int(vreg, "open_loop_volt", S_IRUGO,
++		corner_dir, index,
++		offsetof(struct cpr3_corner, open_loop_volt));
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "open_loop_volt debugfs file creation failed\n");
++		return;
++	}
++
++	temp = cpr3_debugfs_create_corner_int(vreg, "last_volt", S_IRUGO,
++		corner_dir, index, offsetof(struct cpr3_corner, last_volt));
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "last_volt debugfs file creation failed\n");
++		return;
++	}
++
++	info = devm_kzalloc(vreg->thread->ctrl->dev, sizeof(*info), GFP_KERNEL);
++	if (!info)
++		return;
++
++	info->vreg = vreg;
++	info->index = index;
++	info->corner = vreg->corner;
++
++	temp = debugfs_create_file("target_quots", S_IRUGO, corner_dir,
++				info, &cpr3_debug_quot_fops);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "target_quots debugfs file creation failed\n");
++		return;
++	}
++}
++
++/**
++ * cpr3_debug_corner_index_set() - debugfs callback used to change the
++ *		value of the CPR3 regulator debug_corner index
++ * @data:		Pointer to private data which is equal to the CPR3
++ *			regulator pointer
++ * @val:		New value for debug_corner
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_debug_corner_index_set(void *data, u64 val)
++{
++	struct cpr3_regulator *vreg = data;
++
++	if (val < CPR3_CORNER_OFFSET || val > vreg->corner_count) {
++		cpr3_err(vreg, "invalid corner index %llu; allowed values: %d-%d\n",
++			val, CPR3_CORNER_OFFSET, vreg->corner_count);
++		return -EINVAL;
++	}
++
++	mutex_lock(&vreg->thread->ctrl->lock);
++	vreg->debug_corner = val - CPR3_CORNER_OFFSET;
++	mutex_unlock(&vreg->thread->ctrl->lock);
++
++	return 0;
++}
++
++/**
++ * cpr3_debug_corner_index_get() - debugfs callback used to retrieve
++ *		the value of the CPR3 regulator debug_corner index
++ * @data:		Pointer to private data which is equal to the CPR3
++ *			regulator pointer
++ * @val:		Output parameter written with the value of
++ *			debug_corner
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_debug_corner_index_get(void *data, u64 *val)
++{
++	struct cpr3_regulator *vreg = data;
++
++	*val = vreg->debug_corner + CPR3_CORNER_OFFSET;
++
++	return 0;
++}
++DEFINE_SIMPLE_ATTRIBUTE(cpr3_debug_corner_index_fops,
++			cpr3_debug_corner_index_get,
++			cpr3_debug_corner_index_set,
++			"%llu\n");
++
++/**
++ * cpr3_debug_current_corner_index_get() - debugfs callback used to retrieve
++ *		the value of the CPR3 regulator current_corner index
++ * @data:		Pointer to private data which is equal to the CPR3
++ *			regulator pointer
++ * @val:		Output parameter written with the value of
++ *			current_corner
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_debug_current_corner_index_get(void *data, u64 *val)
++{
++	struct cpr3_regulator *vreg = data;
++
++	*val = vreg->current_corner + CPR3_CORNER_OFFSET;
++
++	return 0;
++}
++DEFINE_SIMPLE_ATTRIBUTE(cpr3_debug_current_corner_index_fops,
++			cpr3_debug_current_corner_index_get,
++			NULL, "%llu\n");
++
++/**
++ * cpr3_regulator_debugfs_vreg_add() - add debugfs files to expose configuration
++ *		data for the CPR3 regulator
++ * @vreg:		Pointer to the CPR3 regulator
++ * @thread_dir		CPR3 thread debugfs directory handle
++ *
++ * Return: none
++ */
++static void cpr3_regulator_debugfs_vreg_add(struct cpr3_regulator *vreg,
++				struct dentry *thread_dir)
++{
++	struct dentry *temp, *corner_dir, *vreg_dir;
++
++	vreg_dir = debugfs_create_dir(vreg->name, thread_dir);
++	if (IS_ERR_OR_NULL(vreg_dir)) {
++		cpr3_err(vreg, "%s debugfs directory creation failed\n",
++			vreg->name);
++		return;
++	}
++
++	temp = debugfs_create_int("speed_bin_fuse", S_IRUGO, vreg_dir,
++				  &vreg->speed_bin_fuse);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "speed_bin_fuse debugfs file creation failed\n");
++		return;
++	}
++
++	temp = debugfs_create_int("cpr_rev_fuse", S_IRUGO, vreg_dir,
++				  &vreg->cpr_rev_fuse);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "cpr_rev_fuse debugfs file creation failed\n");
++		return;
++	}
++
++	temp = debugfs_create_int("fuse_combo", S_IRUGO, vreg_dir,
++				  &vreg->fuse_combo);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "fuse_combo debugfs file creation failed\n");
++		return;
++	}
++
++	temp = debugfs_create_int("corner_count", S_IRUGO, vreg_dir,
++				  &vreg->corner_count);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "corner_count debugfs file creation failed\n");
++		return;
++	}
++
++	corner_dir = debugfs_create_dir("corner", vreg_dir);
++	if (IS_ERR_OR_NULL(corner_dir)) {
++		cpr3_err(vreg, "corner debugfs directory creation failed\n");
++		return;
++	}
++
++	temp = debugfs_create_file("index", S_IRUGO | S_IWUSR, corner_dir,
++				vreg, &cpr3_debug_corner_index_fops);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "index debugfs file creation failed\n");
++		return;
++	}
++
++	cpr3_regulator_debugfs_corner_add(vreg, corner_dir,
++					&vreg->debug_corner);
++
++	corner_dir = debugfs_create_dir("current_corner", vreg_dir);
++	if (IS_ERR_OR_NULL(corner_dir)) {
++		cpr3_err(vreg, "current_corner debugfs directory creation failed\n");
++		return;
++	}
++
++	temp = debugfs_create_file("index", S_IRUGO, corner_dir,
++				vreg, &cpr3_debug_current_corner_index_fops);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "index debugfs file creation failed\n");
++		return;
++	}
++
++	cpr3_regulator_debugfs_corner_add(vreg, corner_dir,
++					  &vreg->current_corner);
++}
++
++/**
++ * cpr3_regulator_debugfs_thread_add() - add debugfs files to expose
++ *		configuration data for the CPR thread
++ * @thread:		Pointer to the CPR3 thread
++ *
++ * Return: none
++ */
++static void cpr3_regulator_debugfs_thread_add(struct cpr3_thread *thread)
++{
++	struct cpr3_controller *ctrl = thread->ctrl;
++	struct dentry *aggr_dir, *temp, *thread_dir;
++	struct cpr3_debug_corner_info *info;
++	char buf[20];
++	int *index;
++	int i;
++
++	scnprintf(buf, sizeof(buf), "thread%u", thread->thread_id);
++	thread_dir = debugfs_create_dir(buf, thread->ctrl->debugfs);
++	if (IS_ERR_OR_NULL(thread_dir)) {
++		cpr3_err(ctrl, "thread %u %s debugfs directory creation failed\n",
++			thread->thread_id, buf);
++		return;
++	}
++
++	aggr_dir = debugfs_create_dir("max_aggregated_params", thread_dir);
++	if (IS_ERR_OR_NULL(aggr_dir)) {
++		cpr3_err(ctrl, "thread %u max_aggregated_params debugfs directory creation failed\n",
++			thread->thread_id);
++		return;
++	}
++
++	temp = debugfs_create_int("floor_volt", S_IRUGO, aggr_dir,
++				  &thread->aggr_corner.floor_volt);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "thread %u aggr floor_volt debugfs file creation failed\n",
++			thread->thread_id);
++		return;
++	}
++
++	temp = debugfs_create_int("ceiling_volt", S_IRUGO, aggr_dir,
++				  &thread->aggr_corner.ceiling_volt);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "thread %u aggr ceiling_volt debugfs file creation failed\n",
++			thread->thread_id);
++		return;
++	}
++
++	temp = debugfs_create_int("open_loop_volt", S_IRUGO, aggr_dir,
++				  &thread->aggr_corner.open_loop_volt);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "thread %u aggr open_loop_volt debugfs file creation failed\n",
++			thread->thread_id);
++		return;
++	}
++
++	temp = debugfs_create_int("last_volt", S_IRUGO, aggr_dir,
++				  &thread->aggr_corner.last_volt);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "thread %u aggr last_volt debugfs file creation failed\n",
++			thread->thread_id);
++		return;
++	}
++
++	info = devm_kzalloc(thread->ctrl->dev, sizeof(*info), GFP_KERNEL);
++	index = devm_kzalloc(thread->ctrl->dev, sizeof(*index), GFP_KERNEL);
++	if (!info || !index)
++		return;
++	*index = 0;
++	info->vreg = &thread->vreg[0];
++	info->index = index;
++	info->corner = &thread->aggr_corner;
++
++	temp = debugfs_create_file("target_quots", S_IRUGO, aggr_dir,
++				info, &cpr3_debug_quot_fops);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "thread %u target_quots debugfs file creation failed\n",
++			thread->thread_id);
++		return;
++	}
++
++	for (i = 0; i < thread->vreg_count; i++)
++		cpr3_regulator_debugfs_vreg_add(&thread->vreg[i], thread_dir);
++}
++
++/**
++ * cpr3_debug_closed_loop_enable_set() - debugfs callback used to change the
++ *		value of the CPR controller cpr_allowed_sw flag which enables or
++ *		disables closed-loop operation
++ * @data:		Pointer to private data which is equal to the CPR
++ *			controller pointer
++ * @val:		New value for cpr_allowed_sw
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_debug_closed_loop_enable_set(void *data, u64 val)
++{
++	struct cpr3_controller *ctrl = data;
++	bool enable = !!val;
++	int rc;
++
++	mutex_lock(&ctrl->lock);
++
++	if (ctrl->cpr_allowed_sw == enable)
++		goto done;
++
++	if (enable && !ctrl->cpr_allowed_hw) {
++		cpr3_err(ctrl, "CPR closed-loop operation is not allowed\n");
++		goto done;
++	}
++
++	ctrl->cpr_allowed_sw = enable;
++
++	rc = cpr3_regulator_update_ctrl_state(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "could not change CPR enable state=%u, rc=%d\n",
++			 enable, rc);
++		goto done;
++	}
++
++	if (ctrl->proc_clock_throttle && !ctrl->cpr_enabled) {
++		rc = cpr3_clock_enable(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "clock enable failed, rc=%d\n",
++				 rc);
++			goto done;
++		}
++		ctrl->cpr_enabled = true;
++
++		cpr3_write(ctrl, CPR3_REG_PD_THROTTLE,
++			   CPR3_PD_THROTTLE_DISABLE);
++
++		cpr3_clock_disable(ctrl);
++		ctrl->cpr_enabled = false;
++	}
++
++	cpr3_debug(ctrl, "closed-loop=%s\n", enable ? "enabled" : "disabled");
++done:
++	mutex_unlock(&ctrl->lock);
++	return 0;
++}
++
++/**
++ * cpr3_debug_closed_loop_enable_get() - debugfs callback used to retrieve
++ *		the value of the CPR controller cpr_allowed_sw flag which
++ *		indicates if closed-loop operation is enabled
++ * @data:		Pointer to private data which is equal to the CPR
++ *			controller pointer
++ * @val:		Output parameter written with the value of
++ *			cpr_allowed_sw
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_debug_closed_loop_enable_get(void *data, u64 *val)
++{
++	struct cpr3_controller *ctrl = data;
++
++	*val = ctrl->cpr_allowed_sw;
++
++	return 0;
++}
++DEFINE_SIMPLE_ATTRIBUTE(cpr3_debug_closed_loop_enable_fops,
++			cpr3_debug_closed_loop_enable_get,
++			cpr3_debug_closed_loop_enable_set,
++			"%llu\n");
++
++/**
++ * cpr3_debug_hw_closed_loop_enable_set() - debugfs callback used to change the
++ *		value of the CPR controller use_hw_closed_loop flag which
++ *		switches between software closed-loop and hardware closed-loop
++ *		operation for CPR3 and CPR4 controllers and between open-loop
++ *		and full hardware closed-loop operation for CPRh controllers.
++ * @data:		Pointer to private data which is equal to the CPR
++ *			controller pointer
++ * @val:		New value for use_hw_closed_loop
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_debug_hw_closed_loop_enable_set(void *data, u64 val)
++{
++	struct cpr3_controller *ctrl = data;
++	bool use_hw_closed_loop = !!val;
++	struct cpr3_regulator *vreg;
++	bool cpr_enabled;
++	int i, j, k, rc;
++
++	mutex_lock(&ctrl->lock);
++
++	if (ctrl->use_hw_closed_loop == use_hw_closed_loop)
++		goto done;
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		rc = cpr3_ctrl_clear_cpr4_config(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "failed to clear CPR4 configuration,rc=%d\n",
++				rc);
++			goto done;
++		}
++	}
++
++	cpr3_ctrl_loop_disable(ctrl);
++
++	ctrl->use_hw_closed_loop = use_hw_closed_loop;
++
++	cpr_enabled = ctrl->cpr_enabled;
++
++	/* Ensure that CPR clocks are enabled before writing to registers. */
++	if (!cpr_enabled) {
++		rc = cpr3_clock_enable(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "clock enable failed, rc=%d\n", rc);
++			goto done;
++		}
++		ctrl->cpr_enabled = true;
++	}
++
++	if (ctrl->use_hw_closed_loop)
++		cpr3_write(ctrl, CPR3_REG_IRQ_EN, 0);
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++			CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_EN_MASK,
++			ctrl->use_hw_closed_loop
++			? CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_ENABLE
++			: CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_DISABLE);
++	} else if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++		cpr3_write(ctrl, CPR3_REG_HW_CLOSED_LOOP,
++			ctrl->use_hw_closed_loop
++			? CPR3_HW_CLOSED_LOOP_ENABLE
++			: CPR3_HW_CLOSED_LOOP_DISABLE);
++	}
++
++	/* Turn off CPR clocks if they were off before this function call. */
++	if (!cpr_enabled) {
++		cpr3_clock_disable(ctrl);
++		ctrl->cpr_enabled = false;
++	}
++
++	if (ctrl->use_hw_closed_loop && ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++		rc = regulator_enable(ctrl->vdd_limit_regulator);
++		if (rc) {
++			cpr3_err(ctrl, "CPR limit regulator enable failed, rc=%d\n",
++				rc);
++			goto done;
++		}
++	} else if (!ctrl->use_hw_closed_loop
++			&& ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++		rc = regulator_disable(ctrl->vdd_limit_regulator);
++		if (rc) {
++			cpr3_err(ctrl, "CPR limit regulator disable failed, rc=%d\n",
++				rc);
++			goto done;
++		}
++	}
++
++	/*
++	 * Due to APM and mem-acc floor restriction constraints,
++	 * the closed-loop voltage may be different when using
++	 * software closed-loop vs hardware closed-loop.  Therefore,
++	 * reset the cached closed-loop voltage for all corners to the
++	 * corresponding open-loop voltage when switching between
++	 * SW and HW closed-loop mode.
++	 */
++	for (i = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++			vreg = &ctrl->thread[i].vreg[j];
++			for (k = 0; k < vreg->corner_count; k++)
++				vreg->corner[k].last_volt
++				= vreg->corner[k].open_loop_volt;
++		}
++	}
++
++	/* Skip last_volt caching */
++	ctrl->last_corner_was_closed_loop = false;
++
++	rc = cpr3_regulator_update_ctrl_state(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "could not change CPR HW closed-loop enable state=%u, rc=%d\n",
++			 use_hw_closed_loop, rc);
++		goto done;
++	}
++
++	cpr3_debug(ctrl, "CPR mode=%s\n",
++		   use_hw_closed_loop ?
++		   "HW closed-loop" : "SW closed-loop");
++done:
++	mutex_unlock(&ctrl->lock);
++	return 0;
++}
++
++/**
++ * cpr3_debug_hw_closed_loop_enable_get() - debugfs callback used to retrieve
++ *		the value of the CPR controller use_hw_closed_loop flag which
++ *		indicates if hardware closed-loop operation is being used in
++ *		place of software closed-loop operation
++ * @data:		Pointer to private data which is equal to the CPR
++ *			controller pointer
++ * @val:		Output parameter written with the value of
++ *			use_hw_closed_loop
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_debug_hw_closed_loop_enable_get(void *data, u64 *val)
++{
++	struct cpr3_controller *ctrl = data;
++
++	*val = ctrl->use_hw_closed_loop;
++
++	return 0;
++}
++DEFINE_SIMPLE_ATTRIBUTE(cpr3_debug_hw_closed_loop_enable_fops,
++			cpr3_debug_hw_closed_loop_enable_get,
++			cpr3_debug_hw_closed_loop_enable_set,
++			"%llu\n");
++
++/**
++ * cpr3_debug_trigger_aging_measurement_set() - debugfs callback used to trigger
++ *		another CPR measurement
++ * @data:		Pointer to private data which is equal to the CPR
++ *			controller pointer
++ * @val:		Unused
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_debug_trigger_aging_measurement_set(void *data, u64 val)
++{
++	struct cpr3_controller *ctrl = data;
++	int rc;
++
++	mutex_lock(&ctrl->lock);
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		rc = cpr3_ctrl_clear_cpr4_config(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "failed to clear CPR4 configuration,rc=%d\n",
++				rc);
++			goto done;
++		}
++	}
++
++	cpr3_ctrl_loop_disable(ctrl);
++
++	cpr3_regulator_set_aging_ref_adjustment(ctrl, INT_MAX);
++	ctrl->aging_required = true;
++	ctrl->aging_succeeded = false;
++	ctrl->aging_failed = false;
++
++	rc = cpr3_regulator_update_ctrl_state(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "could not update the CPR controller state, rc=%d\n",
++			rc);
++		goto done;
++	}
++
++done:
++	mutex_unlock(&ctrl->lock);
++	return 0;
++}
++DEFINE_SIMPLE_ATTRIBUTE(cpr3_debug_trigger_aging_measurement_fops,
++			NULL,
++			cpr3_debug_trigger_aging_measurement_set,
++			"%llu\n");
++
++/**
++ * cpr3_regulator_debugfs_ctrl_add() - add debugfs files to expose configuration
++ *		data for the CPR controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: none
++ */
++static void cpr3_regulator_debugfs_ctrl_add(struct cpr3_controller *ctrl)
++{
++	struct dentry *temp, *aggr_dir;
++	int i;
++
++	/* Add cpr3-regulator base directory if it isn't present already. */
++	if (cpr3_debugfs_base == NULL) {
++		cpr3_debugfs_base = debugfs_create_dir("cpr3-regulator", NULL);
++		if (IS_ERR_OR_NULL(cpr3_debugfs_base)) {
++			cpr3_err(ctrl, "cpr3-regulator debugfs base directory creation failed\n");
++			cpr3_debugfs_base = NULL;
++			return;
++		}
++	}
++
++	ctrl->debugfs = debugfs_create_dir(ctrl->name, cpr3_debugfs_base);
++	if (IS_ERR_OR_NULL(ctrl->debugfs)) {
++		cpr3_err(ctrl, "cpr3-regulator controller debugfs directory creation failed\n");
++		return;
++	}
++
++	temp = debugfs_create_file("cpr_closed_loop_enable", S_IRUGO | S_IWUSR,
++					ctrl->debugfs, ctrl,
++					&cpr3_debug_closed_loop_enable_fops);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "cpr_closed_loop_enable debugfs file creation failed\n");
++		return;
++	}
++
++	if (ctrl->supports_hw_closed_loop) {
++		temp = debugfs_create_file("use_hw_closed_loop",
++					S_IRUGO | S_IWUSR, ctrl->debugfs, ctrl,
++					&cpr3_debug_hw_closed_loop_enable_fops);
++		if (IS_ERR_OR_NULL(temp)) {
++			cpr3_err(ctrl, "use_hw_closed_loop debugfs file creation failed\n");
++			return;
++		}
++	}
++
++	temp = debugfs_create_int("thread_count", S_IRUGO, ctrl->debugfs,
++				  &ctrl->thread_count);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "thread_count debugfs file creation failed\n");
++		return;
++	}
++
++	if (ctrl->apm) {
++		temp = debugfs_create_int("apm_threshold_volt", S_IRUGO,
++				ctrl->debugfs, &ctrl->apm_threshold_volt);
++		if (IS_ERR_OR_NULL(temp)) {
++			cpr3_err(ctrl, "apm_threshold_volt debugfs file creation failed\n");
++			return;
++		}
++	}
++
++	if (ctrl->aging_required || ctrl->aging_succeeded
++	    || ctrl->aging_failed) {
++		temp = debugfs_create_int("aging_adj_volt", S_IRUGO,
++				ctrl->debugfs, &ctrl->aging_ref_adjust_volt);
++		if (IS_ERR_OR_NULL(temp)) {
++			cpr3_err(ctrl, "aging_adj_volt debugfs file creation failed\n");
++			return;
++		}
++
++		temp = debugfs_create_file("aging_succeeded", S_IRUGO,
++			ctrl->debugfs, &ctrl->aging_succeeded, &fops_bool_ro);
++		if (IS_ERR_OR_NULL(temp)) {
++			cpr3_err(ctrl, "aging_succeeded debugfs file creation failed\n");
++			return;
++		}
++
++		temp = debugfs_create_file("aging_failed", S_IRUGO,
++			ctrl->debugfs, &ctrl->aging_failed, &fops_bool_ro);
++		if (IS_ERR_OR_NULL(temp)) {
++			cpr3_err(ctrl, "aging_failed debugfs file creation failed\n");
++			return;
++		}
++
++		temp = debugfs_create_file("aging_trigger", S_IWUSR,
++			ctrl->debugfs, ctrl,
++			&cpr3_debug_trigger_aging_measurement_fops);
++		if (IS_ERR_OR_NULL(temp)) {
++			cpr3_err(ctrl, "aging_trigger debugfs file creation failed\n");
++			return;
++		}
++	}
++
++	aggr_dir = debugfs_create_dir("max_aggregated_voltages", ctrl->debugfs);
++	if (IS_ERR_OR_NULL(aggr_dir)) {
++		cpr3_err(ctrl, "max_aggregated_voltages debugfs directory creation failed\n");
++		return;
++	}
++
++	temp = debugfs_create_int("floor_volt", S_IRUGO, aggr_dir,
++				  &ctrl->aggr_corner.floor_volt);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "aggr floor_volt debugfs file creation failed\n");
++		return;
++	}
++
++	temp = debugfs_create_int("ceiling_volt", S_IRUGO, aggr_dir,
++				  &ctrl->aggr_corner.ceiling_volt);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "aggr ceiling_volt debugfs file creation failed\n");
++		return;
++	}
++
++	temp = debugfs_create_int("open_loop_volt", S_IRUGO, aggr_dir,
++				  &ctrl->aggr_corner.open_loop_volt);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "aggr open_loop_volt debugfs file creation failed\n");
++		return;
++	}
++
++	temp = debugfs_create_int("last_volt", S_IRUGO, aggr_dir,
++				  &ctrl->aggr_corner.last_volt);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "aggr last_volt debugfs file creation failed\n");
++		return;
++	}
++
++	for (i = 0; i < ctrl->thread_count; i++)
++		cpr3_regulator_debugfs_thread_add(&ctrl->thread[i]);
++}
++
++/**
++ * cpr3_regulator_debugfs_ctrl_remove() - remove debugfs files for the CPR
++ *		controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Note, this function must be called after the controller has been removed from
++ * cpr3_controller_list and while the cpr3_controller_list_mutex lock is held.
++ *
++ * Return: none
++ */
++static void cpr3_regulator_debugfs_ctrl_remove(struct cpr3_controller *ctrl)
++{
++	if (list_empty(&cpr3_controller_list)) {
++		debugfs_remove_recursive(cpr3_debugfs_base);
++		cpr3_debugfs_base = NULL;
++	} else {
++		debugfs_remove_recursive(ctrl->debugfs);
++	}
++}
++
++/**
++ * cpr3_regulator_init_ctrl_data() - performs initialization of CPR controller
++ *					elements
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_init_ctrl_data(struct cpr3_controller *ctrl)
++{
++	/* Read the initial vdd voltage from hardware. */
++	ctrl->aggr_corner.last_volt
++		= regulator_get_voltage(ctrl->vdd_regulator);
++	if (ctrl->aggr_corner.last_volt < 0) {
++		cpr3_err(ctrl, "regulator_get_voltage(vdd) failed, rc=%d\n",
++				ctrl->aggr_corner.last_volt);
++		return ctrl->aggr_corner.last_volt;
++	}
++	ctrl->aggr_corner.open_loop_volt = ctrl->aggr_corner.last_volt;
++
++	return 0;
++}
++
++/**
++ * cpr3_regulator_init_vreg_data() - performs initialization of common CPR3
++ *		regulator elements and validate aging configurations
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_init_vreg_data(struct cpr3_regulator *vreg)
++{
++	int i, j;
++	bool init_aging;
++
++	vreg->current_corner = CPR3_REGULATOR_CORNER_INVALID;
++	vreg->last_closed_loop_corner = CPR3_REGULATOR_CORNER_INVALID;
++
++	init_aging = vreg->aging_allowed && vreg->thread->ctrl->aging_required;
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		vreg->corner[i].last_volt = vreg->corner[i].open_loop_volt;
++		vreg->corner[i].irq_en = CPR3_IRQ_UP | CPR3_IRQ_DOWN;
++
++		vreg->corner[i].ro_mask = 0;
++		for (j = 0; j < CPR3_RO_COUNT; j++) {
++			if (vreg->corner[i].target_quot[j] == 0)
++				vreg->corner[i].ro_mask |= BIT(j);
++		}
++
++		if (init_aging) {
++			vreg->corner[i].unaged_floor_volt
++				= vreg->corner[i].floor_volt;
++			vreg->corner[i].unaged_ceiling_volt
++				= vreg->corner[i].ceiling_volt;
++			vreg->corner[i].unaged_open_loop_volt
++				= vreg->corner[i].open_loop_volt;
++		}
++
++		if (vreg->aging_allowed) {
++			if (vreg->corner[i].unaged_floor_volt <= 0) {
++				cpr3_err(vreg, "invalid unaged_floor_volt[%d] = %d\n",
++					i, vreg->corner[i].unaged_floor_volt);
++				return -EINVAL;
++			}
++			if (vreg->corner[i].unaged_ceiling_volt <= 0) {
++				cpr3_err(vreg, "invalid unaged_ceiling_volt[%d] = %d\n",
++					i, vreg->corner[i].unaged_ceiling_volt);
++				return -EINVAL;
++			}
++			if (vreg->corner[i].unaged_open_loop_volt <= 0) {
++				cpr3_err(vreg, "invalid unaged_open_loop_volt[%d] = %d\n",
++				      i, vreg->corner[i].unaged_open_loop_volt);
++				return -EINVAL;
++			}
++		}
++	}
++
++	if (vreg->aging_allowed && vreg->corner[vreg->aging_corner].ceiling_volt
++	    > vreg->thread->ctrl->aging_ref_volt) {
++		cpr3_err(vreg, "aging corner %d ceiling voltage = %d > aging ref voltage = %d uV\n",
++			vreg->aging_corner,
++			vreg->corner[vreg->aging_corner].ceiling_volt,
++			vreg->thread->ctrl->aging_ref_volt);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_regulator_suspend() - perform common required CPR3 power down steps
++ *		before the system enters suspend
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_regulator_suspend(struct cpr3_controller *ctrl)
++{
++	int rc;
++
++	mutex_lock(&ctrl->lock);
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		rc = cpr3_ctrl_clear_cpr4_config(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "failed to clear CPR4 configuration,rc=%d\n",
++				rc);
++			mutex_unlock(&ctrl->lock);
++			return rc;
++		}
++	}
++
++	cpr3_ctrl_loop_disable(ctrl);
++
++	rc = cpr3_closed_loop_disable(ctrl);
++	if (rc)
++		cpr3_err(ctrl, "could not disable CPR, rc=%d\n", rc);
++
++	ctrl->cpr_suspended = true;
++
++	mutex_unlock(&ctrl->lock);
++	return 0;
++}
++
++/**
++ * cpr3_regulator_resume() - perform common required CPR3 power up steps after
++ *		the system resumes from suspend
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_regulator_resume(struct cpr3_controller *ctrl)
++{
++	int rc;
++
++	mutex_lock(&ctrl->lock);
++
++	ctrl->cpr_suspended = false;
++	rc = cpr3_regulator_update_ctrl_state(ctrl);
++	if (rc)
++		cpr3_err(ctrl, "could not enable CPR, rc=%d\n", rc);
++
++	mutex_unlock(&ctrl->lock);
++	return 0;
++}
++
++/**
++ * cpr3_regulator_validate_controller() - verify the data passed in via the
++ *		cpr3_controller data structure
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_validate_controller(struct cpr3_controller *ctrl)
++{
++	struct cpr3_thread *thread;
++	struct cpr3_regulator *vreg;
++	int i, j, allow_boost_vreg_count = 0;
++
++	if (!ctrl->vdd_regulator) {
++		cpr3_err(ctrl, "vdd regulator missing\n");
++		return -EINVAL;
++	} else if (ctrl->sensor_count <= 0
++		   || ctrl->sensor_count > CPR3_MAX_SENSOR_COUNT) {
++		cpr3_err(ctrl, "invalid CPR sensor count=%d\n",
++			ctrl->sensor_count);
++		return -EINVAL;
++	} else if (!ctrl->sensor_owner) {
++		cpr3_err(ctrl, "CPR sensor ownership table missing\n");
++		return -EINVAL;
++	}
++
++	if (ctrl->aging_required) {
++		for (i = 0; i < ctrl->aging_sensor_count; i++) {
++			if (ctrl->aging_sensor[i].sensor_id
++			    >= ctrl->sensor_count) {
++				cpr3_err(ctrl, "aging_sensor[%d] id=%u is not in the value range 0-%d",
++					i, ctrl->aging_sensor[i].sensor_id,
++					ctrl->sensor_count - 1);
++				return -EINVAL;
++			}
++		}
++	}
++
++	for (i = 0; i < ctrl->thread_count; i++) {
++		thread = &ctrl->thread[i];
++		for (j = 0; j < thread->vreg_count; j++) {
++			vreg = &thread->vreg[j];
++			if (vreg->allow_boost)
++				allow_boost_vreg_count++;
++		}
++	}
++
++	if (allow_boost_vreg_count > 1) {
++		/*
++		 * Boost feature is not allowed to be used for more
++		 * than one CPR3 regulator of a CPR3 controller.
++		 */
++		cpr3_err(ctrl, "Boost feature is enabled for more than one regulator\n");
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_panic_callback() - panic notification callback function. This function
++ *		is invoked when a kernel panic occurs.
++ * @nfb:	Notifier block pointer of CPR3 controller
++ * @event:	Value passed unmodified to notifier function
++ * @data:	Pointer passed unmodified to notifier function
++ *
++ * Return: NOTIFY_OK
++ */
++static int cpr3_panic_callback(struct notifier_block *nfb,
++			unsigned long event, void *data)
++{
++	struct cpr3_controller *ctrl = container_of(nfb,
++				struct cpr3_controller, panic_notifier);
++	struct cpr3_panic_regs_info *regs_info = ctrl->panic_regs_info;
++	struct cpr3_reg_info *reg;
++	int i = 0;
++
++	for (i = 0; i < regs_info->reg_count; i++) {
++		reg = &(regs_info->regs[i]);
++		reg->value = readl_relaxed(reg->virt_addr);
++		pr_err("%s[0x%08x] = 0x%08x\n", reg->name, reg->addr,
++			reg->value);
++	}
++	/*
++	 * Barrier to ensure that the information has been updated in the
++	 * structure.
++	 */
++	mb();
++
++	return NOTIFY_OK;
++}
++
++/**
++ * cpr3_regulator_register() - register the regulators for a CPR3 controller and
++ *		perform CPR hardware initialization
++ * @pdev:		Platform device pointer for the CPR3 controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_regulator_register(struct platform_device *pdev,
++			struct cpr3_controller *ctrl)
++{
++	struct device *dev = &pdev->dev;
++	struct resource *res;
++	int i, j, rc;
++
++	if (!dev->of_node) {
++		dev_err(dev, "%s: Device tree node is missing\n", __func__);
++		return -EINVAL;
++	}
++
++	if (!ctrl || !ctrl->name) {
++		dev_err(dev, "%s: CPR controller data is missing\n", __func__);
++		return -EINVAL;
++	}
++
++	rc = cpr3_regulator_validate_controller(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "controller validation failed, rc=%d\n", rc);
++		return rc;
++	}
++
++	mutex_init(&ctrl->lock);
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "cpr_ctrl");
++	if (!res || !res->start) {
++		cpr3_err(ctrl, "CPR controller address is missing\n");
++		return -ENXIO;
++	}
++	ctrl->cpr_ctrl_base = devm_ioremap(dev, res->start, resource_size(res));
++
++	if (ctrl->aging_possible_mask) {
++		/*
++		 * Aging possible register address is required if an aging
++		 * possible mask has been specified.
++		 */
++		res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
++						"aging_allowed");
++		if (!res || !res->start) {
++			cpr3_err(ctrl, "CPR aging allowed address is missing\n");
++			return -ENXIO;
++		}
++		ctrl->aging_possible_reg = devm_ioremap(dev, res->start,
++							resource_size(res));
++	}
++
++	ctrl->irq = platform_get_irq_byname(pdev, "cpr");
++	if (ctrl->irq < 0) {
++		cpr3_err(ctrl, "missing CPR interrupt\n");
++		return ctrl->irq;
++	}
++
++	if (ctrl->supports_hw_closed_loop) {
++		if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++			ctrl->ceiling_irq = platform_get_irq_byname(pdev,
++						"ceiling");
++			if (ctrl->ceiling_irq < 0) {
++				cpr3_err(ctrl, "missing ceiling interrupt\n");
++				return ctrl->ceiling_irq;
++			}
++		}
++	}
++
++	rc = cpr3_regulator_init_ctrl_data(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "CPR controller data initialization failed, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	for (i = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++			rc = cpr3_regulator_init_vreg_data(
++						&ctrl->thread[i].vreg[j]);
++			if (rc)
++				return rc;
++			cpr3_print_quots(&ctrl->thread[i].vreg[j]);
++		}
++	}
++
++	/*
++	 * Add the maximum possible aging voltage margin until it is possible
++	 * to perform an aging measurement.
++	 */
++	if (ctrl->aging_required)
++		cpr3_regulator_set_aging_ref_adjustment(ctrl, INT_MAX);
++
++	rc = cpr3_regulator_init_ctrl(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "CPR controller initialization failed, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	/* Register regulator devices for all threads. */
++	for (i = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++			rc = cpr3_regulator_vreg_register(
++					&ctrl->thread[i].vreg[j]);
++			if (rc) {
++				cpr3_err(&ctrl->thread[i].vreg[j], "failed to register regulator, rc=%d\n",
++					rc);
++				goto free_regulators;
++			}
++		}
++	}
++
++	rc = devm_request_threaded_irq(dev, ctrl->irq, NULL,
++				       cpr3_irq_handler,
++				       IRQF_ONESHOT |
++				       IRQF_TRIGGER_RISING,
++				       "cpr3", ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "could not request IRQ %d, rc=%d\n",
++			 ctrl->irq, rc);
++		goto free_regulators;
++	}
++
++	if (ctrl->supports_hw_closed_loop &&
++	    ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++		rc = devm_request_threaded_irq(dev, ctrl->ceiling_irq, NULL,
++			cpr3_ceiling_irq_handler,
++			IRQF_ONESHOT | IRQF_TRIGGER_RISING,
++			"cpr3_ceiling", ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "could not request ceiling IRQ %d, rc=%d\n",
++				ctrl->ceiling_irq, rc);
++			goto free_regulators;
++		}
++	}
++
++	mutex_lock(&cpr3_controller_list_mutex);
++	cpr3_regulator_debugfs_ctrl_add(ctrl);
++	list_add(&ctrl->list, &cpr3_controller_list);
++	mutex_unlock(&cpr3_controller_list_mutex);
++
++	if (ctrl->panic_regs_info) {
++		/* Register panic notification call back */
++		ctrl->panic_notifier.notifier_call = cpr3_panic_callback;
++		atomic_notifier_chain_register(&panic_notifier_list,
++			&ctrl->panic_notifier);
++	}
++
++	return 0;
++
++free_regulators:
++	for (i = 0; i < ctrl->thread_count; i++)
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++)
++			if (!IS_ERR_OR_NULL(ctrl->thread[i].vreg[j].rdev))
++				regulator_unregister(
++					ctrl->thread[i].vreg[j].rdev);
++	return rc;
++}
++
++/**
++ * cpr3_open_loop_regulator_register() - register the regulators for a CPR3
++ *			controller which will always work in Open loop and
++ *			won't support close loop.
++ * @pdev:		Platform device pointer for the CPR3 controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_open_loop_regulator_register(struct platform_device *pdev,
++				      struct cpr3_controller *ctrl)
++{
++	struct device *dev = &pdev->dev;
++	struct cpr3_regulator *vreg;
++	int i, j, rc;
++
++	if (!dev->of_node) {
++		dev_err(dev, "%s: Device tree node is missing\n", __func__);
++		return -EINVAL;
++	}
++
++	if (!ctrl || !ctrl->name) {
++		dev_err(dev, "%s: CPR controller data is missing\n", __func__);
++		return -EINVAL;
++	}
++
++	if (!ctrl->vdd_regulator) {
++		cpr3_err(ctrl, "vdd regulator missing\n");
++		return -EINVAL;
++	}
++
++	mutex_init(&ctrl->lock);
++
++	rc = cpr3_regulator_init_ctrl_data(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "CPR controller data initialization failed, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	for (i = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++			vreg = &ctrl->thread[i].vreg[j];
++			vreg->corner[i].last_volt =
++				vreg->corner[i].open_loop_volt;
++		}
++	}
++
++	/* Register regulator devices for all threads. */
++	for (i = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++			rc = cpr3_regulator_vreg_register(
++					&ctrl->thread[i].vreg[j]);
++			if (rc) {
++				cpr3_err(&ctrl->thread[i].vreg[j], "failed to register regulator, rc=%d\n",
++					 rc);
++				goto free_regulators;
++			}
++		}
++	}
++
++	mutex_lock(&cpr3_controller_list_mutex);
++	list_add(&ctrl->list, &cpr3_controller_list);
++	mutex_unlock(&cpr3_controller_list_mutex);
++
++	return 0;
++
++free_regulators:
++	for (i = 0; i < ctrl->thread_count; i++)
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++)
++			if (!IS_ERR_OR_NULL(ctrl->thread[i].vreg[j].rdev))
++				regulator_unregister(
++					ctrl->thread[i].vreg[j].rdev);
++	return rc;
++}
++
++/**
++ * cpr3_regulator_unregister() - unregister the regulators for a CPR3 controller
++ *		and perform CPR hardware shutdown
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_regulator_unregister(struct cpr3_controller *ctrl)
++{
++	int i, j, rc = 0;
++
++	mutex_lock(&cpr3_controller_list_mutex);
++	list_del(&ctrl->list);
++	cpr3_regulator_debugfs_ctrl_remove(ctrl);
++	mutex_unlock(&cpr3_controller_list_mutex);
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		rc = cpr3_ctrl_clear_cpr4_config(ctrl);
++		if (rc)
++			cpr3_err(ctrl, "failed to clear CPR4 configuration,rc=%d\n",
++				rc);
++	}
++
++	cpr3_ctrl_loop_disable(ctrl);
++
++	cpr3_closed_loop_disable(ctrl);
++
++	if (ctrl->vdd_limit_regulator) {
++		regulator_disable(ctrl->vdd_limit_regulator);
++	}
++
++	for (i = 0; i < ctrl->thread_count; i++)
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++)
++			regulator_unregister(ctrl->thread[i].vreg[j].rdev);
++
++	if (ctrl->panic_notifier.notifier_call)
++		atomic_notifier_chain_unregister(&panic_notifier_list,
++			&ctrl->panic_notifier);
++
++	return 0;
++}
++
++/**
++ * cpr3_open_loop_regulator_unregister() - unregister the regulators for a CPR3
++ *			open loop controller and perform CPR hardware shutdown
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_open_loop_regulator_unregister(struct cpr3_controller *ctrl)
++{
++	int i, j;
++
++	mutex_lock(&cpr3_controller_list_mutex);
++	list_del(&ctrl->list);
++	mutex_unlock(&cpr3_controller_list_mutex);
++
++	if (ctrl->vdd_limit_regulator) {
++		regulator_disable(ctrl->vdd_limit_regulator);
++	}
++
++	for (i = 0; i < ctrl->thread_count; i++)
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++)
++			regulator_unregister(ctrl->thread[i].vreg[j].rdev);
++
++	if (ctrl->panic_notifier.notifier_call)
++		atomic_notifier_chain_unregister(&panic_notifier_list,
++			&ctrl->panic_notifier);
++
++	return 0;
++}
+--- /dev/null
++++ b/drivers/regulator/cpr3-regulator.h
+@@ -0,0 +1,1211 @@
++/*
++ * Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#ifndef __REGULATOR_CPR3_REGULATOR_H__
++#define __REGULATOR_CPR3_REGULATOR_H__
++
++#include <linux/clk.h>
++#include <linux/mutex.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/types.h>
++#include <linux/power/qcom/apm.h>
++#include <linux/regulator/driver.h>
++
++struct cpr3_controller;
++struct cpr3_thread;
++
++/**
++ * struct cpr3_fuse_param - defines one contiguous segment of a fuse parameter
++ *			    that is contained within a given row.
++ * @row:	Fuse row number
++ * @bit_start:	The first bit within the row of the fuse parameter segment
++ * @bit_end:	The last bit within the row of the fuse parameter segment
++ *
++ * Each fuse row is 64 bits in length.  bit_start and bit_end may take values
++ * from 0 to 63.  bit_start must be less than or equal to bit_end.
++ */
++struct cpr3_fuse_param {
++	unsigned		row;
++	unsigned		bit_start;
++	unsigned		bit_end;
++};
++
++/* Each CPR3 sensor has 16 ring oscillators */
++#define CPR3_RO_COUNT		16
++
++/* The maximum number of sensors that can be present on a single CPR loop. */
++#define CPR3_MAX_SENSOR_COUNT	256
++
++/* This constant is used when allocating array printing buffers. */
++#define MAX_CHARS_PER_INT	10
++
++/**
++ * struct cpr4_sdelta - CPR4 controller specific data structure for the sdelta
++ *			adjustment table which is used to adjust the VDD supply
++ *			voltage automatically based upon the temperature and/or
++ *			the number of online CPU cores.
++ * @allow_core_count_adj: Core count adjustments are allowed.
++ * @allow_temp_adj:	Temperature based adjustments are allowed.
++ * @max_core_count:	Maximum number of cores considered for core count
++ *			adjustment logic.
++ * @temp_band_count:	Number of temperature bands considered for temperature
++ *			based adjustment logic.
++ * @cap_volt:		CAP in uV to apply to SDELTA margins with multiple
++ *			cpr3-regulators defined for single controller.
++ * @table:		SDELTA table with per-online-core and temperature based
++ *			adjustments of size (max_core_count * temp_band_count)
++ *			Outer: core count
++ *			Inner: temperature band
++ *			Each element has units of VDD supply steps. Positive
++ *			values correspond to a reduction in voltage and negative
++ *			value correspond to an increase (this follows the SDELTA
++ *			register semantics).
++ * @allow_boost:	Voltage boost allowed.
++ * @boost_num_cores:	The number of online cores at which the boost voltage
++ *			adjustments will be applied
++ * @boost_table:	SDELTA table with boost voltage adjustments of size
++ *			temp_band_count. Each element has units of VDD supply
++ *			steps. Positive values correspond to a reduction in
++ *			voltage and negative value correspond to an increase
++ *			(this follows the SDELTA register semantics).
++ */
++struct cpr4_sdelta {
++	bool	allow_core_count_adj;
++	bool	allow_temp_adj;
++	int	max_core_count;
++	int	temp_band_count;
++	int	cap_volt;
++	int	*table;
++	bool	allow_boost;
++	int	boost_num_cores;
++	int	*boost_table;
++};
++
++/**
++ * struct cpr3_corner - CPR3 virtual voltage corner data structure
++ * @floor_volt:		CPR closed-loop floor voltage in microvolts
++ * @ceiling_volt:	CPR closed-loop ceiling voltage in microvolts
++ * @open_loop_volt:	CPR open-loop voltage (i.e. initial voltage) in
++ *			microvolts
++ * @last_volt:		Last known settled CPR closed-loop voltage which is used
++ *			when switching to a new corner
++ * @abs_ceiling_volt:	The absolute CPR closed-loop ceiling voltage in
++ *			microvolts.  This is used to limit the ceiling_volt
++ *			value when it is increased as a result of aging
++ *			adjustment.
++ * @unaged_floor_volt:	The CPR closed-loop floor voltage in microvolts before
++ *			any aging adjustment is performed
++ * @unaged_ceiling_volt: The CPR closed-loop ceiling voltage in microvolts
++ *			before any aging adjustment is performed
++ * @unaged_open_loop_volt: The CPR open-loop voltage (i.e. initial voltage) in
++ *			microvolts before any aging adjusment is performed
++ * @system_volt:	The system-supply voltage in microvolts or corners or
++ *			levels
++ * @mem_acc_volt:	The mem-acc-supply voltage in corners
++ * @proc_freq:		Processor frequency in Hertz. For CPR rev. 3 and 4
++ *			conrollers, this field is only used by platform specific
++ *			CPR3 driver for interpolation. For CPRh-compliant
++ *			controllers, this frequency is also utilized by the
++ *			clock driver to determine the corner to CPU clock
++ *			frequency mappings.
++ * @cpr_fuse_corner:	Fused corner index associated with this virtual corner
++ *			(only used by platform specific CPR3 driver for
++ *			mapping purposes)
++ * @target_quot:	Array of target quotient values to use for each ring
++ *			oscillator (RO) for this corner.  A value of 0 should be
++ *			specified as the target quotient for each RO that is
++ *			unused by this corner.
++ * @ro_scale:		Array of CPR ring oscillator (RO) scaling factors.  The
++ *			scaling factor for each RO is defined from RO0 to RO15
++ *			with units of QUOT/V.  A value of 0 may be specified for
++ *			an RO that is unused.
++ * @ro_mask:		Bitmap where each of the 16 LSBs indicate if the
++ *			corresponding ROs should be masked for this corner
++ * @irq_en:		Bitmap of the CPR interrupts to enable for this corner
++ * @aging_derate:	The amount to derate the aging voltage adjustment
++ *			determined for the reference corner in units of uV/mV.
++ *			E.g. a value of 900 would imply that the adjustment for
++ *			this corner should be 90% (900/1000) of that for the
++ *			reference corner.
++ * @use_open_loop:	Boolean indicating that open-loop (i.e CPR disabled) as
++ *			opposed to closed-loop operation must be used for this
++ *			corner on CPRh controllers.
++ * @sdelta:		The CPR4 controller specific data for this corner. This
++ *			field is applicable for CPR4 controllers.
++ *
++ * The value of last_volt is initialized inside of the cpr3_regulator_register()
++ * call with the open_loop_volt value.  It can later be updated to the settled
++ * VDD supply voltage.  The values for unaged_floor_volt, unaged_ceiling_volt,
++ * and unaged_open_loop_volt are initialized inside of cpr3_regulator_register()
++ * if ctrl->aging_required == true.  These three values must be pre-initialized
++ * if cpr3_regulator_register() is called with ctrl->aging_required == false and
++ * ctrl->aging_succeeded == true.
++ *
++ * The values of ro_mask and irq_en are initialized inside of the
++ * cpr3_regulator_register() call.
++ */
++struct cpr3_corner {
++	int			floor_volt;
++	int			ceiling_volt;
++	int			cold_temp_open_loop_volt;
++	int			normal_temp_open_loop_volt;
++	int			open_loop_volt;
++	int			last_volt;
++	int			abs_ceiling_volt;
++	int			unaged_floor_volt;
++	int			unaged_ceiling_volt;
++	int			unaged_open_loop_volt;
++	int			system_volt;
++	int			mem_acc_volt;
++	u32			proc_freq;
++	int			cpr_fuse_corner;
++	u32			target_quot[CPR3_RO_COUNT];
++	u32			ro_scale[CPR3_RO_COUNT];
++	u32			ro_mask;
++	u32			irq_en;
++	int			aging_derate;
++	bool			use_open_loop;
++	struct cpr4_sdelta	*sdelta;
++};
++
++/**
++ * struct cprh_corner_band - CPRh controller specific data structure which
++ *			encapsulates the range of corners and the SDELTA
++ *			adjustment table to be applied to the corners within
++ *			the min and max bounds of the corner band.
++ * @corner:		Corner number which defines the corner band boundary
++ * @sdelta:		The SDELTA adjustment table which contains core-count
++ *			and temp based margin adjustments that are applicable
++ *			to the corner band.
++ */
++struct cprh_corner_band {
++	int			corner;
++	struct cpr4_sdelta	*sdelta;
++};
++
++/**
++ * struct cpr3_fuse_parameters - CPR4 fuse specific data structure which has
++ * 			the required fuse parameters need for Close Loop CPR
++ * @(*apss_ro_sel_param)[2]:       Pointer to RO select fuse details
++ * @(*apss_init_voltage_param)[2]: Pointer to Target voltage fuse details
++ * @(*apss_target_quot_param)[2]:  Pointer to Target quot fuse details
++ * @(*apss_quot_offset_param)[2]:  Pointer to quot offset fuse details
++ * @cpr_fusing_rev_param:          Pointer to CPR revision fuse details
++ * @apss_speed_bin_param:          Pointer to Speed bin fuse details
++ * @cpr_boost_fuse_cfg_param:      Pointer to Boost fuse cfg details
++ * @apss_boost_fuse_volt_param:    Pointer to Boost fuse volt details
++ * @misc_fuse_volt_adj_param:      Pointer to Misc fuse volt fuse details
++ */
++struct cpr3_fuse_parameters {
++	struct cpr3_fuse_param (*apss_ro_sel_param)[2];
++	struct cpr3_fuse_param (*apss_init_voltage_param)[2];
++	struct cpr3_fuse_param (*apss_target_quot_param)[2];
++	struct cpr3_fuse_param (*apss_quot_offset_param)[2];
++	struct cpr3_fuse_param *cpr_fusing_rev_param;
++	struct cpr3_fuse_param *apss_speed_bin_param;
++	struct cpr3_fuse_param *cpr_boost_fuse_cfg_param;
++	struct cpr3_fuse_param *apss_boost_fuse_volt_param;
++	struct cpr3_fuse_param *misc_fuse_volt_adj_param;
++};
++
++struct cpr4_mem_acc_func {
++	void (*set_mem_acc)(struct regulator_dev *);
++	void (*clear_mem_acc)(struct regulator_dev *);
++};
++
++/**
++ * struct cpr4_reg_data - CPR4 regulator specific data structure which is
++ * target specific
++ * @cpr_valid_fuse_count: Number of valid fuse corners
++ * @fuse_ref_volt: 	  Pointer to fuse reference voltage
++ * @fuse_step_volt: 	  CPR step voltage available in fuse
++ * @cpr_clk_rate: 	  CPR clock rate
++ * @boost_fuse_ref_volt:  Boost fuse reference voltage
++ * @boost_ceiling_volt:   Boost ceiling voltage
++ * @boost_floor_volt: 	  Boost floor voltage
++ * @cpr3_fuse_params:     Pointer to CPR fuse parameters
++ * @mem_acc_funcs:        Pointer to MEM ACC set/clear functions
++ **/
++struct cpr4_reg_data {
++	u32 cpr_valid_fuse_count;
++	int *fuse_ref_volt;
++	u32 fuse_step_volt;
++	u32 cpr_clk_rate;
++	int boost_fuse_ref_volt;
++	int boost_ceiling_volt;
++	int boost_floor_volt;
++	struct cpr3_fuse_parameters *cpr3_fuse_params;
++	struct cpr4_mem_acc_func *mem_acc_funcs;
++};
++/**
++ * struct cpr3_reg_data - CPR3 regulator specific data structure which is
++ * target specific
++ * @cpr_valid_fuse_count: Number of valid fuse corners
++ * @(*init_voltage_param)[2]: Pointer to Target voltage fuse details
++ * @fuse_ref_volt: 	  Pointer to fuse reference voltage
++ * @fuse_step_volt: 	  CPR step voltage available in fuse
++ * @cpr_clk_rate: 	  CPR clock rate
++ * @cpr3_fuse_params:     Pointer to CPR fuse parameters
++ **/
++struct cpr3_reg_data {
++	u32 cpr_valid_fuse_count;
++	struct cpr3_fuse_param (*init_voltage_param)[2];
++	int *fuse_ref_volt;
++	u32 fuse_step_volt;
++	u32 cpr_clk_rate;
++};
++
++/**
++ * struct cpr3_regulator - CPR3 logical regulator instance associated with a
++ *			given CPR3 hardware thread
++ * @of_node:		Device node associated with the device tree child node
++ *			of this CPR3 regulator
++ * @thread:		Pointer to the CPR3 thread which manages this CPR3
++ *			regulator
++ * @name:		Unique name for this CPR3 regulator which is filled
++ *			using the device tree regulator-name property
++ * @rdesc:		Regulator description for this CPR3 regulator
++ * @rdev:		Regulator device pointer for the regulator registered
++ *			for this CPR3 regulator
++ * @mem_acc_regulator:	Pointer to the optional mem-acc supply regulator used
++ *			to manage memory circuitry settings based upon CPR3
++ *			regulator output voltage.
++ * @corner:		Array of all corners supported by this CPR3 regulator
++ * @corner_count:	The number of elements in the corner array
++ * @corner_band:	Array of all corner bands supported by CPRh compatible
++ *			controllers
++ * @cpr4_regulator_data Target specific cpr4 regulator data
++ * @cpr3_regulator_data Target specific cpr3 regulator data
++ * @corner_band_count:	The number of elements in the corner band array
++ * @platform_fuses:	Pointer to platform specific CPR fuse data (only used by
++ *			platform specific CPR3 driver)
++ * @speed_bin_fuse:	Value read from the speed bin fuse parameter
++ * @speed_bins_supported: The number of speed bins supported by the device tree
++ *			configuration for this CPR3 regulator
++ * @cpr_rev_fuse:	Value read from the CPR fusing revision fuse parameter
++ * @fuse_combo:		Platform specific enum value identifying the specific
++ *			combination of fuse values found on a given chip
++ * @fuse_combos_supported: The number of fuse combinations supported by the
++ *			device tree configuration for this CPR3 regulator
++ * @fuse_corner_count:	Number of corners defined by fuse parameters
++ * @fuse_corner_map:	Array of length fuse_corner_count which specifies the
++ *			highest corner associated with each fuse corner.  Note
++ *			that each element must correspond to a valid corner
++ *			and that element values must be strictly increasing.
++ *			Also, it is acceptable for the lowest fuse corner to map
++ *			to a corner other than the lowest.  Likewise, it is
++ *			acceptable for the highest fuse corner to map to a
++ *			corner other than the highest.
++ * @fuse_combo_corner_sum: The sum of the corner counts across all fuse combos
++ * @fuse_combo_offset:	The device tree property array offset for the selected
++ *			fuse combo
++ * @speed_bin_corner_sum: The sum of the corner counts across all speed bins
++ *			This may be specified as 0 if per speed bin parsing
++ *			support is not required.
++ * @speed_bin_offset:	The device tree property array offset for the selected
++ *			speed bin
++ * @fuse_combo_corner_band_sum: The sum of the corner band counts across all
++ *			fuse combos
++ * @fuse_combo_corner_band_offset: The device tree property array offset for
++ *			the corner band count corresponding to the selected
++ *			fuse combo
++ * @speed_bin_corner_band_sum: The sum of the corner band counts across all
++ *			speed bins. This may be specified as 0 if per speed bin
++ *			parsing support is not required
++ * @speed_bin_corner_band_offset: The device tree property array offset for the
++ *			corner band count corresponding to the selected speed
++ *			bin
++ * @pd_bypass_mask:	Bit mask of power domains associated with this CPR3
++ *			regulator
++ * @dynamic_floor_corner: Index identifying the voltage corner for the CPR3
++ *			regulator whose last_volt value should be used as the
++ *			global CPR floor voltage if all of the power domains
++ *			associated with this CPR3 regulator are bypassed
++ * @uses_dynamic_floor: Boolean flag indicating that dynamic_floor_corner should
++ *			be utilized for the CPR3 regulator
++ * @current_corner:	Index identifying the currently selected voltage corner
++ *			for the CPR3 regulator or less than 0 if no corner has
++ *			been requested
++ * @last_closed_loop_corner: Index identifying the last voltage corner for the
++ *			CPR3 regulator which was configured when operating in
++ *			CPR closed-loop mode or less than 0 if no corner has
++ *			been requested.  CPR registers are only written to when
++ *			using closed-loop mode.
++ * @aggregated:		Boolean flag indicating that this CPR3 regulator
++ *			participated in the last aggregation event
++ * @debug_corner:	Index identifying voltage corner used for displaying
++ *			corner configuration values in debugfs
++ * @vreg_enabled:	Boolean defining the enable state of the CPR3
++ *			regulator's regulator within the regulator framework.
++ * @aging_allowed:	Boolean defining if CPR aging adjustments are allowed
++ *			for this CPR3 regulator given the fuse combo of the
++ *			device
++ * @aging_allow_open_loop_adj: Boolean defining if the open-loop voltage of each
++ *			corner of this regulator should be adjusted as a result
++ *			of an aging measurement.  This flag can be set to false
++ *			when the open-loop voltage adjustments have been
++ *			specified such that they include the maximum possible
++ *			aging adjustment.  This flag is only used if
++ *			aging_allowed == true.
++ * @aging_corner:	The corner that should be configured for this regulator
++ *			when an aging measurement is performed.
++ * @aging_max_adjust_volt: The maximum aging voltage margin in microvolts that
++ *			may be added to the target quotients of this regulator.
++ *			A value of 0 may be specified if this regulator does not
++ *			require any aging adjustment.
++ * @allow_core_count_adj: Core count adjustments are allowed for this regulator.
++ * @allow_temp_adj:	Temperature based adjustments are allowed for this
++ *			regulator.
++ * @max_core_count:	Maximum number of cores considered for core count
++ *			adjustment logic.
++ * @allow_boost:	Voltage boost allowed for this regulator.
++ *
++ * This structure contains both configuration and runtime state data.  The
++ * elements current_corner, last_closed_loop_corner, aggregated, debug_corner,
++ * and vreg_enabled are state variables.
++ */
++struct cpr3_regulator {
++	struct device_node	*of_node;
++	struct cpr3_thread	*thread;
++	const char		*name;
++	struct regulator_desc	rdesc;
++	struct regulator_dev	*rdev;
++	struct regulator	*mem_acc_regulator;
++	struct cpr3_corner	*corner;
++	int			corner_count;
++	struct cprh_corner_band *corner_band;
++	struct cpr4_reg_data    *cpr4_regulator_data;
++	struct cpr3_reg_data    *cpr3_regulator_data;
++	u32			corner_band_count;
++
++	void			*platform_fuses;
++	int			speed_bin_fuse;
++	int			speed_bins_supported;
++	int			cpr_rev_fuse;
++	int			part_type;
++	int			part_type_supported;
++	int			fuse_combo;
++	int			fuse_combos_supported;
++	int			fuse_corner_count;
++	int			*fuse_corner_map;
++	int			fuse_combo_corner_sum;
++	int			fuse_combo_offset;
++	int			speed_bin_corner_sum;
++	int			speed_bin_offset;
++	int			fuse_combo_corner_band_sum;
++	int			fuse_combo_corner_band_offset;
++	int			speed_bin_corner_band_sum;
++	int			speed_bin_corner_band_offset;
++	u32			pd_bypass_mask;
++	int			dynamic_floor_corner;
++	bool			uses_dynamic_floor;
++
++	int			current_corner;
++	int			last_closed_loop_corner;
++	bool			aggregated;
++	int			debug_corner;
++	bool			vreg_enabled;
++
++	bool			aging_allowed;
++	bool			aging_allow_open_loop_adj;
++	int			aging_corner;
++	int			aging_max_adjust_volt;
++
++	bool			allow_core_count_adj;
++	bool			allow_temp_adj;
++	int			max_core_count;
++	bool			allow_boost;
++};
++
++/**
++ * struct cpr3_thread - CPR3 hardware thread data structure
++ * @thread_id:		Hardware thread ID
++ * @of_node:		Device node associated with the device tree child node
++ *			of this CPR3 thread
++ * @ctrl:		Pointer to the CPR3 controller which manages this thread
++ * @vreg:		Array of CPR3 regulators handled by the CPR3 thread
++ * @vreg_count:		Number of elements in the vreg array
++ * @aggr_corner:	CPR corner containing the in process aggregated voltage
++ *			and target quotient configurations which will be applied
++ * @last_closed_loop_aggr_corner: CPR corner containing the most recent
++ *			configurations which were written into hardware
++ *			registers when operating in closed loop mode (i.e. with
++ *			CPR enabled)
++ * @consecutive_up:	The number of consecutive CPR step up events needed to
++ *			to trigger an up interrupt
++ * @consecutive_down:	The number of consecutive CPR step down events needed to
++ *			to trigger a down interrupt
++ * @up_threshold:	The number CPR error steps required to generate an up
++ *			event
++ * @down_threshold:	The number CPR error steps required to generate a down
++ *			event
++ *
++ * This structure contains both configuration and runtime state data.  The
++ * elements aggr_corner and last_closed_loop_aggr_corner are state variables.
++ */
++struct cpr3_thread {
++	u32			thread_id;
++	struct device_node	*of_node;
++	struct cpr3_controller	*ctrl;
++	struct cpr3_regulator	*vreg;
++	int			vreg_count;
++	struct cpr3_corner	aggr_corner;
++	struct cpr3_corner	last_closed_loop_aggr_corner;
++
++	u32			consecutive_up;
++	u32			consecutive_down;
++	u32			up_threshold;
++	u32			down_threshold;
++};
++
++/* Per CPR controller data */
++/**
++ * enum cpr3_mem_acc_corners - Constants which define the number of mem-acc
++ *		regulator corners available in the mem-acc corner map array.
++ * %CPR3_MEM_ACC_LOW_CORNER:	Index in mem-acc corner map array mapping to the
++ *				mem-acc regulator corner
++ *				to be used for low voltage vdd supply
++ * %CPR3_MEM_ACC_HIGH_CORNER:	Index in mem-acc corner map array mapping to the
++ *				mem-acc regulator corner to be used for high
++ *				voltage vdd supply
++ * %CPR3_MEM_ACC_CORNERS:	Number of elements in the mem-acc corner map
++ *				array
++ */
++enum cpr3_mem_acc_corners {
++	CPR3_MEM_ACC_LOW_CORNER		= 0,
++	CPR3_MEM_ACC_HIGH_CORNER	= 1,
++	CPR3_MEM_ACC_CORNERS		= 2,
++};
++
++/**
++ * enum cpr3_count_mode - CPR3 controller count mode which defines the
++ *		method that CPR sensor data is acquired
++ * %CPR3_COUNT_MODE_ALL_AT_ONCE_MIN:	Capture all CPR sensor readings
++ *					simultaneously and report the minimum
++ *					value seen in successive measurements
++ * %CPR3_COUNT_MODE_ALL_AT_ONCE_MAX:	Capture all CPR sensor readings
++ *					simultaneously and report the maximum
++ *					value seen in successive measurements
++ * %CPR3_COUNT_MODE_STAGGERED:		Read one sensor at a time in a
++ *					sequential fashion
++ * %CPR3_COUNT_MODE_ALL_AT_ONCE_AGE:	Capture all CPR aging sensor readings
++ *					simultaneously.
++ */
++enum cpr3_count_mode {
++	CPR3_COUNT_MODE_ALL_AT_ONCE_MIN	= 0,
++	CPR3_COUNT_MODE_ALL_AT_ONCE_MAX	= 1,
++	CPR3_COUNT_MODE_STAGGERED	= 2,
++	CPR3_COUNT_MODE_ALL_AT_ONCE_AGE	= 3,
++};
++
++/**
++ * enum cpr_controller_type - supported CPR controller hardware types
++ * %CPR_CTRL_TYPE_CPR3:	HW has CPR3 controller
++ * %CPR_CTRL_TYPE_CPR4:	HW has CPR4 controller
++ */
++enum cpr_controller_type {
++	CPR_CTRL_TYPE_CPR3,
++	CPR_CTRL_TYPE_CPR4,
++};
++
++/**
++ * cpr_setting - supported CPR global settings
++ * %CPR_DEFAULT: default mode from dts will be used
++ * %CPR_DISABLED: ceiling voltage will be used for all the corners
++ * %CPR_OPEN_LOOP_EN: CPR will work in OL
++ * %CPR_CLOSED_LOOP_EN: CPR will work in CL, if supported
++ */
++enum cpr_setting {
++	CPR_DEFAULT		= 0,
++	CPR_DISABLED		= 1,
++	CPR_OPEN_LOOP_EN	= 2,
++	CPR_CLOSED_LOOP_EN	= 3,
++};
++
++/**
++ * struct cpr3_aging_sensor_info - CPR3 aging sensor information
++ * @sensor_id		The index of the CPR3 sensor to be used in the aging
++ *			measurement.
++ * @ro_scale		The CPR ring oscillator (RO) scaling factor for the
++ *			aging sensor with units of QUOT/V.
++ * @init_quot_diff:	The fused quotient difference between aged and un-aged
++ *			paths that was measured at manufacturing time.
++ * @measured_quot_diff: The quotient difference measured at runtime.
++ * @bypass_mask:	Bit mask of the CPR sensors that must be bypassed during
++ *			the aging measurement for this sensor
++ *
++ * This structure contains both configuration and runtime state data.  The
++ * element measured_quot_diff is a state variable.
++ */
++struct cpr3_aging_sensor_info {
++	u32			sensor_id;
++	u32			ro_scale;
++	int			init_quot_diff;
++	int			measured_quot_diff;
++	u32			bypass_mask[CPR3_MAX_SENSOR_COUNT / 32];
++};
++
++/**
++ * struct cpr3_reg_info - Register information data structure
++ * @name:	Register name
++ * @addr:	Register physical address
++ * @value:	Register content
++ * @virt_addr:	Register virtual address
++ *
++ * This data structure is used to dump some critical register contents
++ * when the device crashes due to a kernel panic.
++ */
++struct cpr3_reg_info {
++	const char	*name;
++	u32		addr;
++	u32		value;
++	void __iomem	*virt_addr;
++};
++
++/**
++ * struct cpr3_panic_regs_info - Data structure to dump critical register
++ *		contents.
++ * @reg_count:		Number of elements in the regs array
++ * @regs:		Array of critical registers information
++ *
++ * This data structure is used to dump critical register contents when
++ * the device crashes due to a kernel panic.
++ */
++struct cpr3_panic_regs_info {
++	int			reg_count;
++	struct cpr3_reg_info	*regs;
++};
++
++/**
++ * struct cpr3_controller - CPR3 controller data structure
++ * @dev:		Device pointer for the CPR3 controller device
++ * @name:		Unique name for the CPR3 controller
++ * @ctrl_id:		Controller ID corresponding to the VDD supply number
++ *			that this CPR3 controller manages.
++ * @cpr_ctrl_base:	Virtual address of the CPR3 controller base register
++ * @fuse_base:		Virtual address of fuse row 0
++ * @aging_possible_reg:	Virtual address of an optional platform-specific
++ *			register that must be ready to determine if it is
++ *			possible to perform an aging measurement.
++ * @list:		list head used in a global cpr3-regulator list so that
++ *			cpr3-regulator structs can be found easily in RAM dumps
++ * @thread:		Array of CPR3 threads managed by the CPR3 controller
++ * @thread_count:	Number of elements in the thread array
++ * @sensor_owner:	Array of thread IDs indicating which thread owns a given
++ *			CPR sensor
++ * @sensor_count:	The number of CPR sensors found on the CPR loop managed
++ *			by this CPR controller.  Must be equal to the number of
++ *			elements in the sensor_owner array
++ * @soc_revision:	Revision number of the SoC.  This may be unused by
++ *			platforms that do not have different behavior for
++ *			different SoC revisions.
++ * @lock:		Mutex lock used to ensure mutual exclusion between
++ *			all of the threads associated with the controller
++ * @vdd_regulator:	Pointer to the VDD supply regulator which this CPR3
++ *			controller manages
++ * @system_regulator:	Pointer to the optional system-supply regulator upon
++ *			which the VDD supply regulator depends.
++ * @mem_acc_regulator:	Pointer to the optional mem-acc supply regulator used
++ *			to manage memory circuitry settings based upon the
++ *			VDD supply output voltage.
++ * @vdd_limit_regulator: Pointer to the VDD supply limit regulator which is used
++ *			for hardware closed-loop in order specify ceiling and
++ *			floor voltage limits (platform specific)
++ * @system_supply_max_volt: Voltage in microvolts which corresponds to the
++ *			absolute ceiling voltage of the system-supply
++ * @mem_acc_threshold_volt: mem-acc threshold voltage in microvolts
++ * @mem_acc_corner_map: mem-acc regulator corners mapping to low and high
++ *			voltage mem-acc settings for the memories powered by
++ *			this CPR3 controller and its associated CPR3 regulators
++ * @mem_acc_crossover_volt: Voltage in microvolts corresponding to the voltage
++ *			that the VDD supply must be set to while a MEM ACC
++ *			switch is in progress. This element must be initialized
++ *			for CPRh controllers when a MEM ACC threshold voltage is
++ *			defined.
++ * @core_clk:		Pointer to the CPR3 controller core clock
++ * @iface_clk:		Pointer to the CPR3 interface clock (platform specific)
++ * @bus_clk:		Pointer to the CPR3 bus clock (platform specific)
++ * @irq:		CPR interrupt number
++ * @irq_affinity_mask:	The cpumask for the CPUs which the CPR interrupt should
++ *			have affinity for
++ * @cpu_hotplug_notifier: CPU hotplug notifier used to reset IRQ affinity when a
++ *			CPU is brought back online
++ * @ceiling_irq:	Interrupt number for the interrupt that is triggered
++ *			when hardware closed-loop attempts to exceed the ceiling
++ *			voltage
++ * @apm:		Handle to the array power mux (APM)
++ * @apm_threshold_volt:	Voltage in microvolts which defines the threshold
++ *			voltage to determine the APM supply selection for
++ *			each corner
++ * @apm_crossover_volt:	Voltage in microvolts corresponding to the voltage that
++ *			the VDD supply must be set to while an APM switch is in
++ *			progress. This element must be initialized for CPRh
++ *			controllers when an APM threshold voltage is defined
++ * @apm_adj_volt:	Minimum difference between APM threshold voltage and
++ *			open-loop voltage which allows the APM threshold voltage
++ *			to be used as a ceiling
++ * @apm_high_supply:	APM supply to configure if VDD voltage is greater than
++ *			or equal to the APM threshold voltage
++ * @apm_low_supply:	APM supply to configure if the VDD voltage is less than
++ *			the APM threshold voltage
++ * @base_volt:		Minimum voltage in microvolts supported by the VDD
++ *			supply managed by this CPR controller
++ * @corner_switch_delay_time: The delay time in nanoseconds used by the CPR
++ *			controller to wait for voltage settling before
++ *			acknowledging the OSM block after corner changes
++ * @cpr_clock_rate:	CPR reference clock frequency in Hz.
++ * @sensor_time:	The time in nanoseconds that each sensor takes to
++ *			perform a measurement.
++ * @loop_time:		The time in nanoseconds between consecutive CPR
++ *			measurements.
++ * @up_down_delay_time: The time to delay in nanoseconds between consecutive CPR
++ *			measurements when the last measurement recommended
++ *			increasing or decreasing the vdd-supply voltage.
++ *			(platform specific)
++ * @idle_clocks:	Number of CPR reference clock ticks that the CPR
++ *			controller waits in transitional states.
++ * @step_quot_init_min:	The default minimum CPR step quotient value.  The step
++ *			quotient is the number of additional ring oscillator
++ *			ticks observed when increasing one step in vdd-supply
++ *			output voltage.
++ * @step_quot_init_max:	The default maximum CPR step quotient value.
++ * @step_volt:		Step size in microvolts between available set points
++ *			of the VDD supply
++ * @down_error_step_limit: CPR4 hardware closed-loop down error step limit which
++ *			defines the maximum number of VDD supply regulator steps
++ *			that the voltage may be reduced as the result of a
++ *			single CPR measurement.
++ * @up_error_step_limit: CPR4 hardware closed-loop up error step limit which
++ *			defines the maximum number of VDD supply regulator steps
++ *			that the voltage may be increased as the result of a
++ *			single CPR measurement.
++ * @count_mode:		CPR controller count mode
++ * @count_repeat:	Number of times to perform consecutive sensor
++ *			measurements when using all-at-once count modes.
++ * @proc_clock_throttle: Defines the processor clock frequency throttling
++ *			register value to use.  This can be used to reduce the
++ *			clock frequency when a power domain exits a low power
++ *			mode until CPR settles at a new voltage.
++ *			(platform specific)
++ * @cpr_allowed_hw:	Boolean which indicates if closed-loop CPR operation is
++ *			permitted for a given chip based upon hardware fuse
++ *			values
++ * @cpr_allowed_sw:	Boolean which indicates if closed-loop CPR operation is
++ *			permitted based upon software policies
++ * @supports_hw_closed_loop: Boolean which indicates if this CPR3/4 controller
++ *			physically supports hardware closed-loop CPR operation
++ * @use_hw_closed_loop:	Boolean which indicates that this controller will be
++ *			using hardware closed-loop operation in place of
++ *			software closed-loop operation.
++ * @ctrl_type:		CPR controller type
++ * @saw_use_unit_mV:	Boolean which indicates the unit used in SAW PVC
++ *			interface is mV.
++ * @aggr_corner:	CPR corner containing the most recently aggregated
++ *			voltage configurations which are being used currently
++ * @cpr_enabled:	Boolean which indicates that the CPR controller is
++ *			enabled and operating in closed-loop mode.  CPR clocks
++ *			have been prepared and enabled whenever this flag is
++ *			true.
++ * @last_corner_was_closed_loop: Boolean indicating if the last known corners
++ *			were updated during closed loop operation.
++ * @cpr_suspended:	Boolean which indicates that CPR has been temporarily
++ *			disabled while enterring system suspend.
++ * @debugfs:		Pointer to the debugfs directory of this CPR3 controller
++ * @aging_ref_volt:	Reference voltage in microvolts to configure when
++ *			performing CPR aging measurements.
++ * @aging_vdd_mode:	vdd-supply regulator mode to configure before performing
++ *			a CPR aging measurement.  It should be one of
++ *			REGULATOR_MODE_*.
++ * @aging_complete_vdd_mode: vdd-supply regulator mode to configure after
++ *			performing a CPR aging measurement.  It should be one of
++ *			REGULATOR_MODE_*.
++ * @aging_ref_adjust_volt: The reference aging voltage margin in microvolts that
++ *			should be added to the target quotients of the
++ *			regulators managed by this controller after derating.
++ * @aging_required:	Flag which indicates that a CPR aging measurement still
++ *			needs to be performed for this CPR3 controller.
++ * @aging_succeeded:	Flag which indicates that a CPR aging measurement has
++ *			completed successfully.
++ * @aging_failed:	Flag which indicates that a CPR aging measurement has
++ *			failed to complete successfully.
++ * @aging_sensor:	Array of CPR3 aging sensors which are used to perform
++ *			aging measurements at a runtime.
++ * @aging_sensor_count:	Number of elements in the aging_sensor array
++ * @aging_possible_mask: Optional bitmask used to mask off the
++ *			aging_possible_reg register.
++ * @aging_possible_val:	Optional value that the masked aging_possible_reg
++ *			register must have in order for a CPR aging measurement
++ *			to be possible.
++ * @step_quot_fixed:	Fixed step quotient value used for target quotient
++ *			adjustment if use_dynamic_step_quot is not set.
++ *			This parameter is only relevant for CPR4 controllers
++ *			when using the per-online-core or per-temperature
++ *			adjustments.
++ * @initial_temp_band:	Temperature band used for calculation of base-line
++ *			target quotients (fused).
++ * @use_dynamic_step_quot: Boolean value which indicates that margin adjustment
++ *			of target quotient will be based on the step quotient
++ *			calculated dynamically in hardware for each RO.
++ * @allow_core_count_adj: Core count adjustments are allowed for this controller
++ * @allow_temp_adj:	Temperature based adjustments are allowed for
++ *			this controller
++ * @allow_boost:	Voltage boost allowed for this controller.
++ * @temp_band_count:	Number of temperature bands used for temperature based
++ *			adjustment logic
++ * @temp_points:	Array of temperature points in decidegrees Celsius used
++ *			to specify the ranges for selected temperature bands.
++ *			The array must have (temp_band_count - 1) elements
++ *			allocated.
++ * @temp_sensor_id_start: Start ID of temperature sensors used for temperature
++ *			based adjustments.
++ * @temp_sensor_id_end:	End ID of temperature sensors used for temperature
++ *			based adjustments.
++ * @voltage_settling_time: The time in nanoseconds that it takes for the
++ *			VDD supply voltage to settle after being increased or
++ *			decreased by step_volt microvolts which is used when
++ *			SDELTA voltage margin adjustments are applied.
++ * @cpr_global_setting:	Global setting for this CPR controller
++ * @panic_regs_info:	Array of panic registers information which provides the
++ *			list of registers to dump when the device crashes.
++ * @panic_notifier:	Notifier block registered to global panic notifier list.
++ *
++ * This structure contains both configuration and runtime state data.  The
++ * elements cpr_allowed_sw, use_hw_closed_loop, aggr_corner, cpr_enabled,
++ * last_corner_was_closed_loop, cpr_suspended, aging_ref_adjust_volt,
++ * aging_required, aging_succeeded, and aging_failed are state variables.
++ *
++ * The apm* elements do not need to be initialized if the VDD supply managed by
++ * the CPR3 controller does not utilize an APM.
++ *
++ * The elements step_quot_fixed, initial_temp_band, allow_core_count_adj,
++ * allow_temp_adj and temp* need to be initialized for CPR4 controllers which
++ * are using per-online-core or per-temperature adjustments.
++ */
++struct cpr3_controller {
++	struct device		*dev;
++	const char		*name;
++	int			ctrl_id;
++	void __iomem		*cpr_ctrl_base;
++	void __iomem		*fuse_base;
++	void __iomem		*aging_possible_reg;
++	struct list_head	list;
++	struct cpr3_thread	*thread;
++	int			thread_count;
++	u8			*sensor_owner;
++	int			sensor_count;
++	int			soc_revision;
++	struct mutex		lock;
++	struct regulator	*vdd_regulator;
++	struct regulator	*system_regulator;
++	struct regulator	*mem_acc_regulator;
++	struct regulator	*vdd_limit_regulator;
++	int			system_supply_max_volt;
++	int			mem_acc_threshold_volt;
++	int			mem_acc_corner_map[CPR3_MEM_ACC_CORNERS];
++	int			mem_acc_crossover_volt;
++	struct clk		*core_clk;
++	struct clk		*iface_clk;
++	struct clk		*bus_clk;
++	int			irq;
++	struct cpumask		irq_affinity_mask;
++	struct notifier_block	cpu_hotplug_notifier;
++	int			ceiling_irq;
++	struct msm_apm_ctrl_dev *apm;
++	int			apm_threshold_volt;
++	int			apm_crossover_volt;
++	int			apm_adj_volt;
++	enum msm_apm_supply	apm_high_supply;
++	enum msm_apm_supply	apm_low_supply;
++	int			base_volt;
++	u32			corner_switch_delay_time;
++	u32			cpr_clock_rate;
++	u32			sensor_time;
++	u32			loop_time;
++	u32			up_down_delay_time;
++	u32			idle_clocks;
++	u32			step_quot_init_min;
++	u32			step_quot_init_max;
++	int			step_volt;
++	u32			down_error_step_limit;
++	u32			up_error_step_limit;
++	enum cpr3_count_mode	count_mode;
++	u32			count_repeat;
++	u32			proc_clock_throttle;
++	bool			cpr_allowed_hw;
++	bool			cpr_allowed_sw;
++	bool			supports_hw_closed_loop;
++	bool			use_hw_closed_loop;
++	enum cpr_controller_type ctrl_type;
++	bool			saw_use_unit_mV;
++	struct cpr3_corner	aggr_corner;
++	bool			cpr_enabled;
++	bool			last_corner_was_closed_loop;
++	bool			cpr_suspended;
++	struct dentry		*debugfs;
++
++	int			aging_ref_volt;
++	unsigned int		aging_vdd_mode;
++	unsigned int		aging_complete_vdd_mode;
++	int			aging_ref_adjust_volt;
++	bool			aging_required;
++	bool			aging_succeeded;
++	bool			aging_failed;
++	struct cpr3_aging_sensor_info *aging_sensor;
++	int			aging_sensor_count;
++	u32			cur_sensor_state;
++	u32			aging_possible_mask;
++	u32			aging_possible_val;
++
++	u32			step_quot_fixed;
++	u32			initial_temp_band;
++	bool			use_dynamic_step_quot;
++	bool			allow_core_count_adj;
++	bool			allow_temp_adj;
++	bool			allow_boost;
++	int			temp_band_count;
++	int			*temp_points;
++	u32			temp_sensor_id_start;
++	u32			temp_sensor_id_end;
++	u32			voltage_settling_time;
++	enum cpr_setting	cpr_global_setting;
++	struct cpr3_panic_regs_info *panic_regs_info;
++	struct notifier_block	panic_notifier;
++};
++
++/* Used for rounding voltages to the closest physically available set point. */
++#define CPR3_ROUND(n, d) (DIV_ROUND_UP(n, d) * (d))
++
++#define cpr3_err(cpr3_thread, message, ...) \
++	pr_err("%s: " message, (cpr3_thread)->name, ##__VA_ARGS__)
++#define cpr3_info(cpr3_thread, message, ...) \
++	pr_info("%s: " message, (cpr3_thread)->name, ##__VA_ARGS__)
++#define cpr3_debug(cpr3_thread, message, ...) \
++	pr_debug("%s: " message, (cpr3_thread)->name, ##__VA_ARGS__)
++
++/*
++ * Offset subtracted from voltage corner values passed in from the regulator
++ * framework in order to get internal voltage corner values.  This is needed
++ * since the regulator framework treats 0 as an error value at regulator
++ * registration time.
++ */
++#define CPR3_CORNER_OFFSET	1
++
++#ifdef CONFIG_REGULATOR_CPR3
++
++int cpr3_regulator_register(struct platform_device *pdev,
++			struct cpr3_controller *ctrl);
++int cpr3_open_loop_regulator_register(struct platform_device *pdev,
++				      struct cpr3_controller *ctrl);
++int cpr3_regulator_unregister(struct cpr3_controller *ctrl);
++int cpr3_open_loop_regulator_unregister(struct cpr3_controller *ctrl);
++int cpr3_regulator_suspend(struct cpr3_controller *ctrl);
++int cpr3_regulator_resume(struct cpr3_controller *ctrl);
++
++int cpr3_allocate_threads(struct cpr3_controller *ctrl, u32 min_thread_id,
++			u32 max_thread_id);
++int cpr3_map_fuse_base(struct cpr3_controller *ctrl,
++			struct platform_device *pdev);
++int cpr3_read_tcsr_setting(struct cpr3_controller *ctrl,
++			   struct platform_device *pdev, u8 start, u8 end);
++int cpr3_read_fuse_param(void __iomem *fuse_base_addr,
++			const struct cpr3_fuse_param *param, u64 *param_value);
++int cpr3_convert_open_loop_voltage_fuse(int ref_volt, int step_volt, u32 fuse,
++			int fuse_len);
++u64 cpr3_interpolate(u64 x1, u64 y1, u64 x2, u64 y2, u64 x);
++int cpr3_parse_array_property(struct cpr3_regulator *vreg,
++			const char *prop_name, int tuple_size, u32 *out);
++int cpr3_parse_corner_array_property(struct cpr3_regulator *vreg,
++			const char *prop_name, int tuple_size, u32 *out);
++int cpr3_parse_corner_band_array_property(struct cpr3_regulator *vreg,
++			const char *prop_name, int tuple_size, u32 *out);
++int cpr3_parse_common_corner_data(struct cpr3_regulator *vreg);
++int cpr3_parse_thread_u32(struct cpr3_thread *thread, const char *propname,
++			u32 *out_value, u32 value_min, u32 value_max);
++int cpr3_parse_ctrl_u32(struct cpr3_controller *ctrl, const char *propname,
++			u32 *out_value, u32 value_min, u32 value_max);
++int cpr3_parse_common_thread_data(struct cpr3_thread *thread);
++int cpr3_parse_common_ctrl_data(struct cpr3_controller *ctrl);
++int cpr3_parse_open_loop_common_ctrl_data(struct cpr3_controller *ctrl);
++int cpr3_limit_open_loop_voltages(struct cpr3_regulator *vreg);
++void cpr3_open_loop_voltage_as_ceiling(struct cpr3_regulator *vreg);
++int cpr3_limit_floor_voltages(struct cpr3_regulator *vreg);
++void cpr3_print_quots(struct cpr3_regulator *vreg);
++int cpr3_determine_part_type(struct cpr3_regulator *vreg, int fuse_volt);
++int cpr3_determine_temp_base_open_loop_correction(struct cpr3_regulator *vreg,
++			int *fuse_volt);
++int cpr3_adjust_fused_open_loop_voltages(struct cpr3_regulator *vreg,
++			int *fuse_volt);
++int cpr3_adjust_open_loop_voltages(struct cpr3_regulator *vreg);
++int cpr3_quot_adjustment(int ro_scale, int volt_adjust);
++int cpr3_voltage_adjustment(int ro_scale, int quot_adjust);
++int cpr3_parse_closed_loop_voltage_adjustments(struct cpr3_regulator *vreg,
++			u64 *ro_sel, int *volt_adjust,
++			int *volt_adjust_fuse, int *ro_scale);
++int cpr4_parse_core_count_temp_voltage_adj(struct cpr3_regulator *vreg,
++			bool use_corner_band);
++int cpr3_apm_init(struct cpr3_controller *ctrl);
++int cpr3_mem_acc_init(struct cpr3_regulator *vreg);
++void cprh_adjust_voltages_for_apm(struct cpr3_regulator *vreg);
++void cprh_adjust_voltages_for_mem_acc(struct cpr3_regulator *vreg);
++int cpr3_adjust_target_quotients(struct cpr3_regulator *vreg,
++			int *fuse_volt_adjust);
++int cpr3_handle_temp_open_loop_adjustment(struct cpr3_controller *ctrl,
++			bool is_cold);
++int cpr3_get_cold_temp_threshold(struct cpr3_regulator *vreg, int *cold_temp);
++bool cpr3_can_adjust_cold_temp(struct cpr3_regulator *vreg);
++
++#else
++
++static inline int cpr3_regulator_register(struct platform_device *pdev,
++			struct cpr3_controller *ctrl)
++{
++	return -ENXIO;
++}
++
++static inline int
++cpr3_open_loop_regulator_register(struct platform_device *pdev,
++				  struct cpr3_controller *ctrl);
++{
++	return -ENXIO;
++}
++
++static inline int cpr3_regulator_unregister(struct cpr3_controller *ctrl)
++{
++	return -ENXIO;
++}
++
++static inline int
++cpr3_open_loop_regulator_unregister(struct cpr3_controller *ctrl)
++{
++	return -ENXIO;
++}
++
++static inline int cpr3_regulator_suspend(struct cpr3_controller *ctrl)
++{
++	return -ENXIO;
++}
++
++static inline int cpr3_regulator_resume(struct cpr3_controller *ctrl)
++{
++	return -ENXIO;
++}
++
++static inline int cpr3_get_thread_name(struct cpr3_thread *thread,
++			struct device_node *thread_node)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_allocate_threads(struct cpr3_controller *ctrl,
++			u32 min_thread_id, u32 max_thread_id)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_map_fuse_base(struct cpr3_controller *ctrl,
++			struct platform_device *pdev)
++{
++	return -ENXIO;
++}
++
++static inline int cpr3_read_tcsr_setting(struct cpr3_controller *ctrl,
++			   struct platform_device *pdev, u8 start, u8 end)
++{
++	return 0;
++}
++
++static inline int cpr3_read_fuse_param(void __iomem *fuse_base_addr,
++			const struct cpr3_fuse_param *param, u64 *param_value)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_convert_open_loop_voltage_fuse(int ref_volt,
++			int step_volt, u32 fuse, int fuse_len)
++{
++	return -EPERM;
++}
++
++static inline u64 cpr3_interpolate(u64 x1, u64 y1, u64 x2, u64 y2, u64 x)
++{
++	return 0;
++}
++
++static inline int cpr3_parse_array_property(struct cpr3_regulator *vreg,
++			const char *prop_name, int tuple_size, u32 *out)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_parse_corner_array_property(struct cpr3_regulator *vreg,
++			const char *prop_name, int tuple_size, u32 *out)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_parse_corner_band_array_property(
++			struct cpr3_regulator *vreg, const char *prop_name,
++			int tuple_size, u32 *out)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_parse_common_corner_data(struct cpr3_regulator *vreg)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_parse_thread_u32(struct cpr3_thread *thread,
++			const char *propname, u32 *out_value, u32 value_min,
++			u32 value_max)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_parse_ctrl_u32(struct cpr3_controller *ctrl,
++			const char *propname, u32 *out_value, u32 value_min,
++			u32 value_max)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_parse_common_thread_data(struct cpr3_thread *thread)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_parse_common_ctrl_data(struct cpr3_controller *ctrl)
++{
++	return -EPERM;
++}
++
++static inline int
++cpr3_parse_open_loop_common_ctrl_data(struct cpr3_controller *ctrl)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_limit_open_loop_voltages(struct cpr3_regulator *vreg)
++{
++	return -EPERM;
++}
++
++static inline void cpr3_open_loop_voltage_as_ceiling(
++			struct cpr3_regulator *vreg)
++{
++	return;
++}
++
++static inline int cpr3_limit_floor_voltages(struct cpr3_regulator *vreg)
++{
++	return -EPERM;
++}
++
++static inline void cpr3_print_quots(struct cpr3_regulator *vreg)
++{
++	return;
++}
++
++static inline int
++cpr3_determine_part_type(struct cpr3_regulator *vreg, int fuse_volt)
++{
++	return -EPERM;
++}
++
++static inline int
++cpr3_determine_temp_base_open_loop_correction(struct cpr3_regulator *vreg,
++			int *fuse_volt)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_adjust_fused_open_loop_voltages(
++			struct cpr3_regulator *vreg, int *fuse_volt)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_adjust_open_loop_voltages(struct cpr3_regulator *vreg)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_quot_adjustment(int ro_scale, int volt_adjust)
++{
++	return 0;
++}
++
++static inline int cpr3_voltage_adjustment(int ro_scale, int quot_adjust)
++{
++	return 0;
++}
++
++static inline int cpr3_parse_closed_loop_voltage_adjustments(
++			struct cpr3_regulator *vreg, u64 *ro_sel,
++			int *volt_adjust, int *volt_adjust_fuse, int *ro_scale)
++{
++	return 0;
++}
++
++static inline int cpr4_parse_core_count_temp_voltage_adj(
++			struct cpr3_regulator *vreg, bool use_corner_band)
++{
++	return 0;
++}
++
++static inline int cpr3_apm_init(struct cpr3_controller *ctrl)
++{
++	return 0;
++}
++
++static inline int cpr3_mem_acc_init(struct cpr3_regulator *vreg)
++{
++	return 0;
++}
++
++static inline void cprh_adjust_voltages_for_apm(struct cpr3_regulator *vreg)
++{
++}
++
++static inline void cprh_adjust_voltages_for_mem_acc(struct cpr3_regulator *vreg)
++{
++}
++
++static inline int cpr3_adjust_target_quotients(struct cpr3_regulator *vreg,
++			int *fuse_volt_adjust)
++{
++	return 0;
++}
++
++static inline int
++cpr3_handle_temp_open_loop_adjustment(struct cpr3_controller *ctrl,
++			bool is_cold)
++{
++	return 0;
++}
++
++static inline bool
++cpr3_can_adjust_cold_temp(struct cpr3_regulator *vreg)
++{
++	return false;
++}
++
++static inline int
++cpr3_get_cold_temp_threshold(struct cpr3_regulator *vreg, int *cold_temp)
++{
++	return 0;
++}
++#endif /* CONFIG_REGULATOR_CPR3 */
++
++#endif /* __REGULATOR_CPR_REGULATOR_H__ */
+--- /dev/null
++++ b/drivers/regulator/cpr3-util.c
+@@ -0,0 +1,2750 @@
++/*
++ * Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++/*
++ * This file contains utility functions to be used by platform specific CPR3
++ * regulator drivers.
++ */
++
++#define pr_fmt(fmt) "%s: " fmt, __func__
++
++#include <linux/cpumask.h>
++#include <linux/device.h>
++#include <linux/io.h>
++#include <linux/kernel.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++#include <linux/types.h>
++
++#include <soc/qcom/socinfo.h>
++
++#include "cpr3-regulator.h"
++
++#define BYTES_PER_FUSE_ROW		8
++#define MAX_FUSE_ROW_BIT		63
++
++#define CPR3_CONSECUTIVE_UP_DOWN_MIN	0
++#define CPR3_CONSECUTIVE_UP_DOWN_MAX	15
++#define CPR3_UP_DOWN_THRESHOLD_MIN	0
++#define CPR3_UP_DOWN_THRESHOLD_MAX	31
++#define CPR3_STEP_QUOT_MIN		0
++#define CPR3_STEP_QUOT_MAX		63
++#define CPR3_IDLE_CLOCKS_MIN		0
++#define CPR3_IDLE_CLOCKS_MAX		31
++
++/* This constant has units of uV/mV so 1000 corresponds to 100%. */
++#define CPR3_AGING_DERATE_UNITY		1000
++
++/**
++ * cpr3_allocate_regulators() - allocate and initialize CPR3 regulators for a
++ *		given thread based upon device tree data
++ * @thread:		Pointer to the CPR3 thread
++ *
++ * This function allocates the thread->vreg array based upon the number of
++ * device tree regulator subnodes.  It also initializes generic elements of each
++ * regulator struct such as name, of_node, and thread.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_allocate_regulators(struct cpr3_thread *thread)
++{
++	struct device_node *node;
++	int i, rc;
++
++	thread->vreg_count = 0;
++
++	for_each_available_child_of_node(thread->of_node, node) {
++		thread->vreg_count++;
++	}
++
++	thread->vreg = devm_kcalloc(thread->ctrl->dev, thread->vreg_count,
++			sizeof(*thread->vreg), GFP_KERNEL);
++	if (!thread->vreg)
++		return -ENOMEM;
++
++	i = 0;
++	for_each_available_child_of_node(thread->of_node, node) {
++		thread->vreg[i].of_node = node;
++		thread->vreg[i].thread = thread;
++
++		rc = of_property_read_string(node, "regulator-name",
++						&thread->vreg[i].name);
++		if (rc) {
++			dev_err(thread->ctrl->dev, "could not find regulator name, rc=%d\n",
++				rc);
++			return rc;
++		}
++
++		i++;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_allocate_threads() - allocate and initialize CPR3 threads for a given
++ *			     controller based upon device tree data
++ * @ctrl:		Pointer to the CPR3 controller
++ * @min_thread_id:	Minimum allowed hardware thread ID for this controller
++ * @max_thread_id:	Maximum allowed hardware thread ID for this controller
++ *
++ * This function allocates the ctrl->thread array based upon the number of
++ * device tree thread subnodes.  It also initializes generic elements of each
++ * thread struct such as thread_id, of_node, ctrl, and vreg array.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_allocate_threads(struct cpr3_controller *ctrl, u32 min_thread_id,
++			u32 max_thread_id)
++{
++	struct device *dev = ctrl->dev;
++	struct device_node *thread_node;
++	int i, j, rc;
++
++	ctrl->thread_count = 0;
++
++	for_each_available_child_of_node(dev->of_node, thread_node) {
++		ctrl->thread_count++;
++	}
++
++	ctrl->thread = devm_kcalloc(dev, ctrl->thread_count,
++			sizeof(*ctrl->thread), GFP_KERNEL);
++	if (!ctrl->thread)
++		return -ENOMEM;
++
++	i = 0;
++	for_each_available_child_of_node(dev->of_node, thread_node) {
++		ctrl->thread[i].of_node = thread_node;
++		ctrl->thread[i].ctrl = ctrl;
++
++		rc = of_property_read_u32(thread_node, "qcom,cpr-thread-id",
++					  &ctrl->thread[i].thread_id);
++		if (rc) {
++			dev_err(dev, "could not read DT property qcom,cpr-thread-id, rc=%d\n",
++				rc);
++			return rc;
++		}
++
++		if (ctrl->thread[i].thread_id < min_thread_id ||
++				ctrl->thread[i].thread_id > max_thread_id) {
++			dev_err(dev, "invalid thread id = %u; not within [%u, %u]\n",
++				ctrl->thread[i].thread_id, min_thread_id,
++				max_thread_id);
++			return -EINVAL;
++		}
++
++		/* Verify that the thread ID is unique for all child nodes. */
++		for (j = 0; j < i; j++) {
++			if (ctrl->thread[j].thread_id
++					== ctrl->thread[i].thread_id) {
++				dev_err(dev, "duplicate thread id = %u found\n",
++					ctrl->thread[i].thread_id);
++				return -EINVAL;
++			}
++		}
++
++		rc = cpr3_allocate_regulators(&ctrl->thread[i]);
++		if (rc)
++			return rc;
++
++		i++;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_map_fuse_base() - ioremap the base address of the fuse region
++ * @ctrl:	Pointer to the CPR3 controller
++ * @pdev:	Platform device pointer for the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_map_fuse_base(struct cpr3_controller *ctrl,
++			struct platform_device *pdev)
++{
++	struct resource *res;
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "fuse_base");
++	if (!res || !res->start) {
++		dev_err(&pdev->dev, "fuse base address is missing\n");
++		return -ENXIO;
++	}
++
++	ctrl->fuse_base = devm_ioremap(&pdev->dev, res->start,
++						resource_size(res));
++
++	return 0;
++}
++
++/**
++ * cpr3_read_tcsr_setting - reads the CPR setting bits from TCSR register
++ * @ctrl:	Pointer to the CPR3 controller
++ * @pdev:	Platform device pointer for the CPR3 controller
++ * @start:	start bit in TCSR register
++ * @end:	end bit in TCSR register
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_read_tcsr_setting(struct cpr3_controller *ctrl,
++			   struct platform_device *pdev, u8 start, u8 end)
++{
++	struct resource *res;
++	void __iomem *tcsr_reg;
++	u32 val;
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
++					   "cpr_tcsr_reg");
++	if (!res || !res->start)
++		return 0;
++
++	tcsr_reg = ioremap(res->start, resource_size(res));
++	if (!tcsr_reg) {
++		dev_err(&pdev->dev, "tcsr ioremap failed\n");
++		return 0;
++	}
++
++	val = readl_relaxed(tcsr_reg);
++	val &= GENMASK(end, start);
++	val >>= start;
++
++	switch (val) {
++	case 1:
++		ctrl->cpr_global_setting = CPR_DISABLED;
++		break;
++	case 2:
++		ctrl->cpr_global_setting = CPR_OPEN_LOOP_EN;
++		break;
++	case 3:
++		ctrl->cpr_global_setting = CPR_CLOSED_LOOP_EN;
++		break;
++	default:
++		ctrl->cpr_global_setting = CPR_DEFAULT;
++	}
++
++	iounmap(tcsr_reg);
++
++	return 0;
++}
++
++/**
++ * cpr3_read_fuse_param() - reads a CPR3 fuse parameter out of eFuses
++ * @fuse_base_addr:	Virtual memory address of the eFuse base address
++ * @param:		Null terminated array of fuse param segments to read
++ *			from
++ * @param_value:	Output with value read from the eFuses
++ *
++ * This function reads from each of the parameter segments listed in the param
++ * array and concatenates their values together.  Reading stops when an element
++ * is reached which has all 0 struct values.  The total number of bits specified
++ * for the fuse parameter across all segments must be less than or equal to 64.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_read_fuse_param(void __iomem *fuse_base_addr,
++		const struct cpr3_fuse_param *param, u64 *param_value)
++{
++	u64 fuse_val, val;
++	int bits;
++	int bits_total = 0;
++
++	*param_value = 0;
++
++	while (param->row || param->bit_start || param->bit_end) {
++		if (param->bit_start > param->bit_end
++		    || param->bit_end > MAX_FUSE_ROW_BIT) {
++			pr_err("Invalid fuse parameter segment: row=%u, start=%u, end=%u\n",
++				param->row, param->bit_start, param->bit_end);
++			return -EINVAL;
++		}
++
++		bits = param->bit_end - param->bit_start + 1;
++		if (bits_total + bits > 64) {
++			pr_err("Invalid fuse parameter segments; total bits = %d\n",
++				bits_total + bits);
++			return -EINVAL;
++		}
++
++		fuse_val = readq_relaxed(fuse_base_addr
++					 + param->row * BYTES_PER_FUSE_ROW);
++		val = (fuse_val >> param->bit_start) & ((1ULL << bits) - 1);
++		*param_value |= val << bits_total;
++		bits_total += bits;
++
++		param++;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_convert_open_loop_voltage_fuse() - converts an open loop voltage fuse
++ *		value into an absolute voltage with units of microvolts
++ * @ref_volt:		Reference voltage in microvolts
++ * @step_volt:		The step size in microvolts of the fuse LSB
++ * @fuse:		Open loop voltage fuse value
++ * @fuse_len:		The bit length of the fuse value
++ *
++ * The MSB of the fuse parameter corresponds to a sign bit.  If it is set, then
++ * the lower bits correspond to the number of steps to go down from the
++ * reference voltage.  If it is not set, then the lower bits correspond to the
++ * number of steps to go up from the reference voltage.
++ */
++int cpr3_convert_open_loop_voltage_fuse(int ref_volt, int step_volt, u32 fuse,
++					int fuse_len)
++{
++	int sign, steps;
++
++	sign = (fuse & (1 << (fuse_len - 1))) ? -1 : 1;
++	steps = fuse & ((1 << (fuse_len - 1)) - 1);
++
++	return ref_volt + sign * steps * step_volt;
++}
++
++/**
++ * cpr3_interpolate() - performs linear interpolation
++ * @x1		Lower known x value
++ * @y1		Lower known y value
++ * @x2		Upper known x value
++ * @y2		Upper known y value
++ * @x		Intermediate x value
++ *
++ * Returns y where (x, y) falls on the line between (x1, y1) and (x2, y2).
++ * It is required that x1 < x2, y1 <= y2, and x1 <= x <= x2.  If these
++ * conditions are not met, then y2 will be returned.
++ */
++u64 cpr3_interpolate(u64 x1, u64 y1, u64 x2, u64 y2, u64 x)
++{
++	u64 temp;
++
++	if (x1 >= x2 || y1 > y2 || x1 > x || x > x2)
++		return y2;
++
++	temp = (x2 - x) * (y2 - y1);
++	do_div(temp, (u32)(x2 - x1));
++
++	return y2 - temp;
++}
++
++/**
++ * cpr3_parse_array_property() - fill an array from a portion of the values
++ *		specified for a device tree property
++ * @vreg:		Pointer to the CPR3 regulator
++ * @prop_name:		The name of the device tree property to read from
++ * @tuple_size:		The number of elements in each tuple
++ * @out:		Output data array which must be of size tuple_size
++ *
++ * cpr3_parse_common_corner_data() must be called for vreg before this function
++ * is called so that fuse combo and speed bin size elements are initialized.
++ *
++ * Three formats are supported for the device tree property:
++ * 1. Length == tuple_size
++ *	(reading begins at index 0)
++ * 2. Length == tuple_size * vreg->fuse_combos_supported
++ *	(reading begins at index tuple_size * vreg->fuse_combo)
++ * 3. Length == tuple_size * vreg->speed_bins_supported
++ *	(reading begins at index tuple_size * vreg->speed_bin_fuse)
++ *
++ * All other property lengths are treated as errors.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_parse_array_property(struct cpr3_regulator *vreg,
++		const char *prop_name, int tuple_size, u32 *out)
++{
++	struct device_node *node = vreg->of_node;
++	int len = 0;
++	int i, offset, rc;
++
++	if (!of_find_property(node, prop_name, &len)) {
++		cpr3_err(vreg, "property %s is missing\n", prop_name);
++		return -EINVAL;
++	}
++
++	if (len == tuple_size * sizeof(u32)) {
++		offset = 0;
++	} else if (len == tuple_size * vreg->fuse_combos_supported
++				     * sizeof(u32)) {
++		offset = tuple_size * vreg->fuse_combo;
++	} else if (vreg->speed_bins_supported > 0 &&
++		 len == tuple_size * vreg->speed_bins_supported * sizeof(u32)) {
++		offset = tuple_size * vreg->speed_bin_fuse;
++	} else {
++		if (vreg->speed_bins_supported > 0)
++			cpr3_err(vreg, "property %s has invalid length=%d, should be %zu, %zu, or %zu\n",
++				prop_name, len,
++				tuple_size * sizeof(u32),
++				tuple_size * vreg->speed_bins_supported
++					   * sizeof(u32),
++				tuple_size * vreg->fuse_combos_supported
++					   * sizeof(u32));
++		else
++			cpr3_err(vreg, "property %s has invalid length=%d, should be %zu or %zu\n",
++				prop_name, len,
++				tuple_size * sizeof(u32),
++				tuple_size * vreg->fuse_combos_supported
++					   * sizeof(u32));
++		return -EINVAL;
++	}
++
++	for (i = 0; i < tuple_size; i++) {
++		rc = of_property_read_u32_index(node, prop_name, offset + i,
++						&out[i]);
++		if (rc) {
++			cpr3_err(vreg, "error reading property %s, rc=%d\n",
++				prop_name, rc);
++			return rc;
++		}
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_parse_corner_array_property() - fill a per-corner array from a portion
++ *		of the values specified for a device tree property
++ * @vreg:		Pointer to the CPR3 regulator
++ * @prop_name:		The name of the device tree property to read from
++ * @tuple_size:		The number of elements in each per-corner tuple
++ * @out:		Output data array which must be of size:
++ *			tuple_size * vreg->corner_count
++ *
++ * cpr3_parse_common_corner_data() must be called for vreg before this function
++ * is called so that fuse combo and speed bin size elements are initialized.
++ *
++ * Three formats are supported for the device tree property:
++ * 1. Length == tuple_size * vreg->corner_count
++ *	(reading begins at index 0)
++ * 2. Length == tuple_size * vreg->fuse_combo_corner_sum
++ *	(reading begins at index tuple_size * vreg->fuse_combo_offset)
++ * 3. Length == tuple_size * vreg->speed_bin_corner_sum
++ *	(reading begins at index tuple_size * vreg->speed_bin_offset)
++ *
++ * All other property lengths are treated as errors.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_parse_corner_array_property(struct cpr3_regulator *vreg,
++		const char *prop_name, int tuple_size, u32 *out)
++{
++	struct device_node *node = vreg->of_node;
++	int len = 0;
++	int i, offset, rc;
++
++	if (!of_find_property(node, prop_name, &len)) {
++		cpr3_err(vreg, "property %s is missing\n", prop_name);
++		return -EINVAL;
++	}
++
++	if (len == tuple_size * vreg->corner_count * sizeof(u32)) {
++		offset = 0;
++	} else if (len == tuple_size * vreg->fuse_combo_corner_sum
++				     * sizeof(u32)) {
++		offset = tuple_size * vreg->fuse_combo_offset;
++	} else if (vreg->speed_bin_corner_sum > 0 &&
++		 len == tuple_size * vreg->speed_bin_corner_sum * sizeof(u32)) {
++		offset = tuple_size * vreg->speed_bin_offset;
++	} else {
++		if (vreg->speed_bin_corner_sum > 0)
++			cpr3_err(vreg, "property %s has invalid length=%d, should be %zu, %zu, or %zu\n",
++				prop_name, len,
++				tuple_size * vreg->corner_count * sizeof(u32),
++				tuple_size * vreg->speed_bin_corner_sum
++					   * sizeof(u32),
++				tuple_size * vreg->fuse_combo_corner_sum
++					   * sizeof(u32));
++		else
++			cpr3_err(vreg, "property %s has invalid length=%d, should be %zu or %zu\n",
++				prop_name, len,
++				tuple_size * vreg->corner_count * sizeof(u32),
++				tuple_size * vreg->fuse_combo_corner_sum
++					   * sizeof(u32));
++		return -EINVAL;
++	}
++
++	for (i = 0; i < tuple_size * vreg->corner_count; i++) {
++		rc = of_property_read_u32_index(node, prop_name, offset + i,
++						&out[i]);
++		if (rc) {
++			cpr3_err(vreg, "error reading property %s, rc=%d\n",
++				prop_name, rc);
++			return rc;
++		}
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_parse_corner_band_array_property() - fill a per-corner band array
++ *		from a portion of the values specified for a device tree
++ *		property
++ * @vreg:		Pointer to the CPR3 regulator
++ * @prop_name:		The name of the device tree property to read from
++ * @tuple_size:		The number of elements in each per-corner band tuple
++ * @out:		Output data array which must be of size:
++ *			tuple_size * vreg->corner_band_count
++ *
++ * cpr3_parse_common_corner_data() must be called for vreg before this function
++ * is called so that fuse combo and speed bin size elements are initialized.
++ * In addition, corner band fuse combo and speed bin sum and offset elements
++ * must be initialized prior to executing this function.
++ *
++ * Three formats are supported for the device tree property:
++ * 1. Length == tuple_size * vreg->corner_band_count
++ *	(reading begins at index 0)
++ * 2. Length == tuple_size * vreg->fuse_combo_corner_band_sum
++ *	(reading begins at index tuple_size *
++ *		vreg->fuse_combo_corner_band_offset)
++ * 3. Length == tuple_size * vreg->speed_bin_corner_band_sum
++ *	(reading begins at index tuple_size *
++ *		vreg->speed_bin_corner_band_offset)
++ *
++ * All other property lengths are treated as errors.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_parse_corner_band_array_property(struct cpr3_regulator *vreg,
++		const char *prop_name, int tuple_size, u32 *out)
++{
++	struct device_node *node = vreg->of_node;
++	int len = 0;
++	int i, offset, rc;
++
++	if (!of_find_property(node, prop_name, &len)) {
++		cpr3_err(vreg, "property %s is missing\n", prop_name);
++		return -EINVAL;
++	}
++
++	if (len == tuple_size * vreg->corner_band_count * sizeof(u32)) {
++		offset = 0;
++	} else if (len == tuple_size * vreg->fuse_combo_corner_band_sum
++				     * sizeof(u32)) {
++		offset = tuple_size * vreg->fuse_combo_corner_band_offset;
++	} else if (vreg->speed_bin_corner_band_sum > 0 &&
++		 len == tuple_size * vreg->speed_bin_corner_band_sum *
++		   sizeof(u32)) {
++		offset = tuple_size * vreg->speed_bin_corner_band_offset;
++	} else {
++		if (vreg->speed_bin_corner_band_sum > 0)
++			cpr3_err(vreg, "property %s has invalid length=%d, should be %zu, %zu, or %zu\n",
++				prop_name, len,
++				tuple_size * vreg->corner_band_count *
++				 sizeof(u32),
++				tuple_size * vreg->speed_bin_corner_band_sum
++					   * sizeof(u32),
++				tuple_size * vreg->fuse_combo_corner_band_sum
++					   * sizeof(u32));
++		else
++			cpr3_err(vreg, "property %s has invalid length=%d, should be %zu or %zu\n",
++				prop_name, len,
++				tuple_size * vreg->corner_band_count *
++				 sizeof(u32),
++				tuple_size * vreg->fuse_combo_corner_band_sum
++					   * sizeof(u32));
++		return -EINVAL;
++	}
++
++	for (i = 0; i < tuple_size * vreg->corner_band_count; i++) {
++		rc = of_property_read_u32_index(node, prop_name, offset + i,
++						&out[i]);
++		if (rc) {
++			cpr3_err(vreg, "error reading property %s, rc=%d\n",
++				prop_name, rc);
++			return rc;
++		}
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_parse_common_corner_data() - parse common CPR3 properties relating to
++ *		the corners supported by a CPR3 regulator from device tree
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * This function reads, validates, and utilizes the following device tree
++ * properties: qcom,cpr-fuse-corners, qcom,cpr-fuse-combos, qcom,cpr-speed-bins,
++ * qcom,cpr-speed-bin-corners, qcom,cpr-corners, qcom,cpr-voltage-ceiling,
++ * qcom,cpr-voltage-floor, qcom,corner-frequencies,
++ * and qcom,cpr-corner-fmax-map.
++ *
++ * It initializes these CPR3 regulator elements: corner, corner_count,
++ * fuse_combos_supported, fuse_corner_map, and speed_bins_supported.  It
++ * initializes these elements for each corner: ceiling_volt, floor_volt,
++ * proc_freq, and cpr_fuse_corner.
++ *
++ * It requires that the following CPR3 regulator elements be initialized before
++ * being called: fuse_corner_count, fuse_combo, and speed_bin_fuse.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_parse_common_corner_data(struct cpr3_regulator *vreg)
++{
++	struct device_node *node = vreg->of_node;
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	u32 max_fuse_combos, fuse_corners, aging_allowed = 0;
++	u32 max_speed_bins = 0;
++	u32 *combo_corners;
++	u32 *speed_bin_corners;
++	u32 *temp;
++	int i, j, rc;
++
++	rc = of_property_read_u32(node, "qcom,cpr-fuse-corners", &fuse_corners);
++	if (rc) {
++		cpr3_err(vreg, "error reading property qcom,cpr-fuse-corners, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	if (vreg->fuse_corner_count != fuse_corners) {
++		cpr3_err(vreg, "device tree config supports %d fuse corners but the hardware has %d fuse corners\n",
++			fuse_corners, vreg->fuse_corner_count);
++		return -EINVAL;
++	}
++
++	rc = of_property_read_u32(node, "qcom,cpr-fuse-combos",
++				&max_fuse_combos);
++	if (rc) {
++		cpr3_err(vreg, "error reading property qcom,cpr-fuse-combos, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	/*
++	 * Sanity check against arbitrarily large value to avoid excessive
++	 * memory allocation.
++	 */
++	if (max_fuse_combos > 100 || max_fuse_combos == 0) {
++		cpr3_err(vreg, "qcom,cpr-fuse-combos is invalid: %u\n",
++			max_fuse_combos);
++		return -EINVAL;
++	}
++
++	if (vreg->fuse_combo >= max_fuse_combos) {
++		cpr3_err(vreg, "device tree config supports fuse combos 0-%u but the hardware has combo %d\n",
++			max_fuse_combos - 1, vreg->fuse_combo);
++		BUG_ON(1);
++		return -EINVAL;
++	}
++
++	vreg->fuse_combos_supported = max_fuse_combos;
++
++	of_property_read_u32(node, "qcom,cpr-speed-bins", &max_speed_bins);
++
++	/*
++	 * Sanity check against arbitrarily large value to avoid excessive
++	 * memory allocation.
++	 */
++	if (max_speed_bins > 100) {
++		cpr3_err(vreg, "qcom,cpr-speed-bins is invalid: %u\n",
++			max_speed_bins);
++		return -EINVAL;
++	}
++
++	if (max_speed_bins && vreg->speed_bin_fuse >= max_speed_bins) {
++		cpr3_err(vreg, "device tree config supports speed bins 0-%u but the hardware has speed bin %d\n",
++			max_speed_bins - 1, vreg->speed_bin_fuse);
++		BUG();
++		return -EINVAL;
++	}
++
++	vreg->speed_bins_supported = max_speed_bins;
++
++	combo_corners = kcalloc(vreg->fuse_combos_supported,
++				sizeof(*combo_corners), GFP_KERNEL);
++	if (!combo_corners)
++		return -ENOMEM;
++
++	rc = of_property_read_u32_array(node, "qcom,cpr-corners", combo_corners,
++					vreg->fuse_combos_supported);
++	if (rc == -EOVERFLOW) {
++		/* Single value case */
++		rc = of_property_read_u32(node, "qcom,cpr-corners",
++					combo_corners);
++		for (i = 1; i < vreg->fuse_combos_supported; i++)
++			combo_corners[i] = combo_corners[0];
++	}
++	if (rc) {
++		cpr3_err(vreg, "error reading property qcom,cpr-corners, rc=%d\n",
++			rc);
++		kfree(combo_corners);
++		return rc;
++	}
++
++	vreg->fuse_combo_offset = 0;
++	vreg->fuse_combo_corner_sum = 0;
++	for (i = 0; i < vreg->fuse_combos_supported; i++) {
++		vreg->fuse_combo_corner_sum += combo_corners[i];
++		if (i < vreg->fuse_combo)
++			vreg->fuse_combo_offset += combo_corners[i];
++	}
++
++	vreg->corner_count = combo_corners[vreg->fuse_combo];
++
++	kfree(combo_corners);
++
++	vreg->speed_bin_offset = 0;
++	vreg->speed_bin_corner_sum = 0;
++	if (vreg->speed_bins_supported > 0) {
++		speed_bin_corners = kcalloc(vreg->speed_bins_supported,
++					sizeof(*speed_bin_corners), GFP_KERNEL);
++		if (!speed_bin_corners)
++			return -ENOMEM;
++
++		rc = of_property_read_u32_array(node,
++				"qcom,cpr-speed-bin-corners", speed_bin_corners,
++				vreg->speed_bins_supported);
++		if (rc) {
++			cpr3_err(vreg, "error reading property qcom,cpr-speed-bin-corners, rc=%d\n",
++				rc);
++			kfree(speed_bin_corners);
++			return rc;
++		}
++
++		for (i = 0; i < vreg->speed_bins_supported; i++) {
++			vreg->speed_bin_corner_sum += speed_bin_corners[i];
++			if (i < vreg->speed_bin_fuse)
++				vreg->speed_bin_offset += speed_bin_corners[i];
++		}
++
++		if (speed_bin_corners[vreg->speed_bin_fuse]
++		    != vreg->corner_count) {
++			cpr3_err(vreg, "qcom,cpr-corners and qcom,cpr-speed-bin-corners conflict on number of corners: %d vs %u\n",
++				vreg->corner_count,
++				speed_bin_corners[vreg->speed_bin_fuse]);
++			kfree(speed_bin_corners);
++			return -EINVAL;
++		}
++
++		kfree(speed_bin_corners);
++	}
++
++	vreg->corner = devm_kcalloc(ctrl->dev, vreg->corner_count,
++				    sizeof(*vreg->corner), GFP_KERNEL);
++	temp = kcalloc(vreg->corner_count, sizeof(*temp), GFP_KERNEL);
++	if (!vreg->corner || !temp)
++		return -ENOMEM;
++
++	rc = cpr3_parse_corner_array_property(vreg, "qcom,cpr-voltage-ceiling",
++			1, temp);
++	if (rc)
++		goto free_temp;
++	for (i = 0; i < vreg->corner_count; i++) {
++		vreg->corner[i].ceiling_volt
++			= CPR3_ROUND(temp[i], ctrl->step_volt);
++		vreg->corner[i].abs_ceiling_volt = vreg->corner[i].ceiling_volt;
++	}
++
++	rc = cpr3_parse_corner_array_property(vreg, "qcom,cpr-voltage-floor",
++			1, temp);
++	if (rc)
++		goto free_temp;
++	for (i = 0; i < vreg->corner_count; i++)
++		vreg->corner[i].floor_volt
++			= CPR3_ROUND(temp[i], ctrl->step_volt);
++
++	/* Validate ceiling and floor values */
++	for (i = 0; i < vreg->corner_count; i++) {
++		if (vreg->corner[i].floor_volt
++		    > vreg->corner[i].ceiling_volt) {
++			cpr3_err(vreg, "CPR floor[%d]=%d > ceiling[%d]=%d uV\n",
++				i, vreg->corner[i].floor_volt,
++				i, vreg->corner[i].ceiling_volt);
++			rc = -EINVAL;
++			goto free_temp;
++		}
++	}
++
++	/* Load optional system-supply voltages */
++	if (of_find_property(vreg->of_node, "qcom,system-voltage", NULL)) {
++		rc = cpr3_parse_corner_array_property(vreg,
++			"qcom,system-voltage", 1, temp);
++		if (rc)
++			goto free_temp;
++		for (i = 0; i < vreg->corner_count; i++)
++			vreg->corner[i].system_volt = temp[i];
++	}
++
++	rc = cpr3_parse_corner_array_property(vreg, "qcom,corner-frequencies",
++			1, temp);
++	if (rc)
++		goto free_temp;
++	for (i = 0; i < vreg->corner_count; i++)
++		vreg->corner[i].proc_freq = temp[i];
++
++	/* Validate frequencies */
++	for (i = 1; i < vreg->corner_count; i++) {
++		if (vreg->corner[i].proc_freq
++		    < vreg->corner[i - 1].proc_freq) {
++			cpr3_err(vreg, "invalid frequency: freq[%d]=%u < freq[%d]=%u\n",
++				i, vreg->corner[i].proc_freq, i - 1,
++				vreg->corner[i - 1].proc_freq);
++			rc = -EINVAL;
++			goto free_temp;
++		}
++	}
++
++	vreg->fuse_corner_map = devm_kcalloc(ctrl->dev, vreg->fuse_corner_count,
++				    sizeof(*vreg->fuse_corner_map), GFP_KERNEL);
++	if (!vreg->fuse_corner_map) {
++		rc = -ENOMEM;
++		goto free_temp;
++	}
++
++	rc = cpr3_parse_array_property(vreg, "qcom,cpr-corner-fmax-map",
++		vreg->fuse_corner_count, temp);
++	if (rc)
++		goto free_temp;
++	for (i = 0; i < vreg->fuse_corner_count; i++) {
++		vreg->fuse_corner_map[i] = temp[i] - CPR3_CORNER_OFFSET;
++		if (temp[i] < CPR3_CORNER_OFFSET
++		    || temp[i] > vreg->corner_count + CPR3_CORNER_OFFSET) {
++			cpr3_err(vreg, "invalid corner value specified in qcom,cpr-corner-fmax-map: %u\n",
++				temp[i]);
++			rc = -EINVAL;
++			goto free_temp;
++		} else if (i > 0 && temp[i - 1] >= temp[i]) {
++			cpr3_err(vreg, "invalid corner %u less than or equal to previous corner %u\n",
++				temp[i], temp[i - 1]);
++			rc = -EINVAL;
++			goto free_temp;
++		}
++	}
++	if (temp[vreg->fuse_corner_count - 1] != vreg->corner_count)
++		cpr3_debug(vreg, "Note: highest Fmax corner %u in qcom,cpr-corner-fmax-map does not match highest supported corner %d\n",
++			temp[vreg->fuse_corner_count - 1],
++			vreg->corner_count);
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		for (j = 0; j < vreg->fuse_corner_count; j++) {
++			if (i + CPR3_CORNER_OFFSET <= temp[j]) {
++				vreg->corner[i].cpr_fuse_corner = j;
++				break;
++			}
++		}
++		if (j == vreg->fuse_corner_count) {
++			/*
++			 * Handle the case where the highest fuse corner maps
++			 * to a corner below the highest corner.
++			 */
++			vreg->corner[i].cpr_fuse_corner
++				= vreg->fuse_corner_count - 1;
++		}
++	}
++
++	if (of_find_property(vreg->of_node,
++				"qcom,allow-aging-voltage-adjustment", NULL)) {
++		rc = cpr3_parse_array_property(vreg,
++			"qcom,allow-aging-voltage-adjustment",
++			1, &aging_allowed);
++		if (rc)
++			goto free_temp;
++
++		vreg->aging_allowed = aging_allowed;
++	}
++
++	if (of_find_property(vreg->of_node,
++		       "qcom,allow-aging-open-loop-voltage-adjustment", NULL)) {
++		rc = cpr3_parse_array_property(vreg,
++			"qcom,allow-aging-open-loop-voltage-adjustment",
++			1, &aging_allowed);
++		if (rc)
++			goto free_temp;
++
++		vreg->aging_allow_open_loop_adj = aging_allowed;
++	}
++
++	if (vreg->aging_allowed) {
++		if (ctrl->aging_ref_volt <= 0) {
++			cpr3_err(ctrl, "qcom,cpr-aging-ref-voltage must be specified\n");
++			rc = -EINVAL;
++			goto free_temp;
++		}
++
++		rc = cpr3_parse_array_property(vreg,
++			"qcom,cpr-aging-max-voltage-adjustment",
++			1, &vreg->aging_max_adjust_volt);
++		if (rc)
++			goto free_temp;
++
++		rc = cpr3_parse_array_property(vreg,
++			"qcom,cpr-aging-ref-corner", 1, &vreg->aging_corner);
++		if (rc) {
++			goto free_temp;
++		} else if (vreg->aging_corner < CPR3_CORNER_OFFSET
++			   || vreg->aging_corner > vreg->corner_count - 1
++							+ CPR3_CORNER_OFFSET) {
++			cpr3_err(vreg, "aging reference corner=%d not in range [%d, %d]\n",
++				vreg->aging_corner, CPR3_CORNER_OFFSET,
++				vreg->corner_count - 1 + CPR3_CORNER_OFFSET);
++			rc = -EINVAL;
++			goto free_temp;
++		}
++		vreg->aging_corner -= CPR3_CORNER_OFFSET;
++
++		if (of_find_property(vreg->of_node, "qcom,cpr-aging-derate",
++					NULL)) {
++			rc = cpr3_parse_corner_array_property(vreg,
++				"qcom,cpr-aging-derate", 1, temp);
++			if (rc)
++				goto free_temp;
++
++			for (i = 0; i < vreg->corner_count; i++)
++				vreg->corner[i].aging_derate = temp[i];
++		} else {
++			for (i = 0; i < vreg->corner_count; i++)
++				vreg->corner[i].aging_derate
++					= CPR3_AGING_DERATE_UNITY;
++		}
++	}
++
++free_temp:
++	kfree(temp);
++	return rc;
++}
++
++/**
++ * cpr3_parse_thread_u32() - parse the specified property from the CPR3 thread's
++ *		device tree node and verify that it is within the allowed limits
++ * @thread:		Pointer to the CPR3 thread
++ * @propname:		The name of the device tree property to read
++ * @out_value:		The output pointer to fill with the value read
++ * @value_min:		The minimum allowed property value
++ * @value_max:		The maximum allowed property value
++ *
++ * This function prints a verbose error message if the property is missing or
++ * has a value which is not within the specified range.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_parse_thread_u32(struct cpr3_thread *thread, const char *propname,
++		       u32 *out_value, u32 value_min, u32 value_max)
++{
++	int rc;
++
++	rc = of_property_read_u32(thread->of_node, propname, out_value);
++	if (rc) {
++		cpr3_err(thread->ctrl, "thread %u error reading property %s, rc=%d\n",
++			thread->thread_id, propname, rc);
++		return rc;
++	}
++
++	if (*out_value < value_min || *out_value > value_max) {
++		cpr3_err(thread->ctrl, "thread %u %s=%u is invalid; allowed range: [%u, %u]\n",
++			thread->thread_id, propname, *out_value, value_min,
++			value_max);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_parse_ctrl_u32() - parse the specified property from the CPR3
++ *		controller's device tree node and verify that it is within the
++ *		allowed limits
++ * @ctrl:		Pointer to the CPR3 controller
++ * @propname:		The name of the device tree property to read
++ * @out_value:		The output pointer to fill with the value read
++ * @value_min:		The minimum allowed property value
++ * @value_max:		The maximum allowed property value
++ *
++ * This function prints a verbose error message if the property is missing or
++ * has a value which is not within the specified range.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_parse_ctrl_u32(struct cpr3_controller *ctrl, const char *propname,
++		       u32 *out_value, u32 value_min, u32 value_max)
++{
++	int rc;
++
++	rc = of_property_read_u32(ctrl->dev->of_node, propname, out_value);
++	if (rc) {
++		cpr3_err(ctrl, "error reading property %s, rc=%d\n",
++			propname, rc);
++		return rc;
++	}
++
++	if (*out_value < value_min || *out_value > value_max) {
++		cpr3_err(ctrl, "%s=%u is invalid; allowed range: [%u, %u]\n",
++			propname, *out_value, value_min, value_max);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_parse_common_thread_data() - parse common CPR3 thread properties from
++ *		device tree
++ * @thread:		Pointer to the CPR3 thread
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_parse_common_thread_data(struct cpr3_thread *thread)
++{
++	int rc;
++
++	rc = cpr3_parse_thread_u32(thread, "qcom,cpr-consecutive-up",
++			&thread->consecutive_up, CPR3_CONSECUTIVE_UP_DOWN_MIN,
++			CPR3_CONSECUTIVE_UP_DOWN_MAX);
++	if (rc)
++		return rc;
++
++	rc = cpr3_parse_thread_u32(thread, "qcom,cpr-consecutive-down",
++			&thread->consecutive_down, CPR3_CONSECUTIVE_UP_DOWN_MIN,
++			CPR3_CONSECUTIVE_UP_DOWN_MAX);
++	if (rc)
++		return rc;
++
++	rc = cpr3_parse_thread_u32(thread, "qcom,cpr-up-threshold",
++			&thread->up_threshold, CPR3_UP_DOWN_THRESHOLD_MIN,
++			CPR3_UP_DOWN_THRESHOLD_MAX);
++	if (rc)
++		return rc;
++
++	rc = cpr3_parse_thread_u32(thread, "qcom,cpr-down-threshold",
++			&thread->down_threshold, CPR3_UP_DOWN_THRESHOLD_MIN,
++			CPR3_UP_DOWN_THRESHOLD_MAX);
++	if (rc)
++		return rc;
++
++	return rc;
++}
++
++/**
++ * cpr3_parse_irq_affinity() - parse CPR IRQ affinity information
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_parse_irq_affinity(struct cpr3_controller *ctrl)
++{
++	struct device_node *cpu_node;
++	int i, cpu;
++	int len = 0;
++
++	if (!of_find_property(ctrl->dev->of_node, "qcom,cpr-interrupt-affinity",
++				&len)) {
++		/* No IRQ affinity required */
++		return 0;
++	}
++
++	len /= sizeof(u32);
++
++	for (i = 0; i < len; i++) {
++		cpu_node = of_parse_phandle(ctrl->dev->of_node,
++					    "qcom,cpr-interrupt-affinity", i);
++		if (!cpu_node) {
++			cpr3_err(ctrl, "could not find CPU node %d\n", i);
++			return -EINVAL;
++		}
++
++		for_each_possible_cpu(cpu) {
++			if (of_get_cpu_node(cpu, NULL) == cpu_node) {
++				cpumask_set_cpu(cpu, &ctrl->irq_affinity_mask);
++				break;
++			}
++		}
++		of_node_put(cpu_node);
++	}
++
++	return 0;
++}
++
++static int cpr3_panic_notifier_init(struct cpr3_controller *ctrl)
++{
++	struct device_node *node = ctrl->dev->of_node;
++	struct cpr3_panic_regs_info *panic_regs_info;
++	struct cpr3_reg_info *regs;
++	int i, reg_count, len, rc = 0;
++
++	if (!of_find_property(node, "qcom,cpr-panic-reg-addr-list", &len)) {
++		/* panic register address list not specified */
++		return rc;
++	}
++
++	reg_count = len / sizeof(u32);
++	if (!reg_count) {
++		cpr3_err(ctrl, "qcom,cpr-panic-reg-addr-list has invalid len = %d\n",
++			len);
++		return -EINVAL;
++	}
++
++	if (!of_find_property(node, "qcom,cpr-panic-reg-name-list", NULL)) {
++		cpr3_err(ctrl, "property qcom,cpr-panic-reg-name-list not specified\n");
++		return -EINVAL;
++	}
++
++	len = of_property_count_strings(node, "qcom,cpr-panic-reg-name-list");
++	if (reg_count != len) {
++		cpr3_err(ctrl, "qcom,cpr-panic-reg-name-list should have %d strings\n",
++			reg_count);
++		return -EINVAL;
++	}
++
++	panic_regs_info = devm_kzalloc(ctrl->dev, sizeof(*panic_regs_info),
++					GFP_KERNEL);
++	if (!panic_regs_info)
++		return -ENOMEM;
++
++	regs = devm_kcalloc(ctrl->dev, reg_count, sizeof(*regs), GFP_KERNEL);
++	if (!regs)
++		return -ENOMEM;
++
++	for (i = 0; i < reg_count; i++) {
++		rc = of_property_read_string_index(node,
++				"qcom,cpr-panic-reg-name-list", i,
++				&(regs[i].name));
++		if (rc) {
++			cpr3_err(ctrl, "error reading property qcom,cpr-panic-reg-name-list, rc=%d\n",
++				rc);
++			return rc;
++		}
++
++		rc = of_property_read_u32_index(node,
++				"qcom,cpr-panic-reg-addr-list", i,
++				&(regs[i].addr));
++		if (rc) {
++			cpr3_err(ctrl, "error reading property qcom,cpr-panic-reg-addr-list, rc=%d\n",
++				rc);
++			return rc;
++		}
++		regs[i].virt_addr = devm_ioremap(ctrl->dev, regs[i].addr, 0x4);
++		if (!regs[i].virt_addr) {
++			pr_err("Unable to map panic register addr 0x%08x\n",
++				regs[i].addr);
++			return -EINVAL;
++		}
++		regs[i].value = 0xFFFFFFFF;
++	}
++
++	panic_regs_info->reg_count = reg_count;
++	panic_regs_info->regs = regs;
++	ctrl->panic_regs_info = panic_regs_info;
++
++	return rc;
++}
++
++/**
++ * cpr3_parse_common_ctrl_data() - parse common CPR3 controller properties from
++ *		device tree
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_parse_common_ctrl_data(struct cpr3_controller *ctrl)
++{
++	int rc;
++
++	rc = cpr3_parse_ctrl_u32(ctrl, "qcom,cpr-sensor-time",
++			&ctrl->sensor_time, 0, UINT_MAX);
++	if (rc)
++		return rc;
++
++	rc = cpr3_parse_ctrl_u32(ctrl, "qcom,cpr-loop-time",
++			&ctrl->loop_time, 0, UINT_MAX);
++	if (rc)
++		return rc;
++
++	rc = cpr3_parse_ctrl_u32(ctrl, "qcom,cpr-idle-cycles",
++			&ctrl->idle_clocks, CPR3_IDLE_CLOCKS_MIN,
++			CPR3_IDLE_CLOCKS_MAX);
++	if (rc)
++		return rc;
++
++	rc = cpr3_parse_ctrl_u32(ctrl, "qcom,cpr-step-quot-init-min",
++			&ctrl->step_quot_init_min, CPR3_STEP_QUOT_MIN,
++			CPR3_STEP_QUOT_MAX);
++	if (rc)
++		return rc;
++
++	rc = cpr3_parse_ctrl_u32(ctrl, "qcom,cpr-step-quot-init-max",
++			&ctrl->step_quot_init_max, CPR3_STEP_QUOT_MIN,
++			CPR3_STEP_QUOT_MAX);
++	if (rc)
++		return rc;
++
++	rc = of_property_read_u32(ctrl->dev->of_node, "qcom,voltage-step",
++				&ctrl->step_volt);
++	if (rc) {
++		cpr3_err(ctrl, "error reading property qcom,voltage-step, rc=%d\n",
++			rc);
++		return rc;
++	}
++	if (ctrl->step_volt <= 0) {
++		cpr3_err(ctrl, "qcom,voltage-step=%d is invalid\n",
++			ctrl->step_volt);
++		return -EINVAL;
++	}
++
++	rc = cpr3_parse_ctrl_u32(ctrl, "qcom,cpr-count-mode",
++			&ctrl->count_mode, CPR3_COUNT_MODE_ALL_AT_ONCE_MIN,
++			CPR3_COUNT_MODE_STAGGERED);
++	if (rc)
++		return rc;
++
++	/* Count repeat is optional */
++	ctrl->count_repeat = 0;
++	of_property_read_u32(ctrl->dev->of_node, "qcom,cpr-count-repeat",
++			&ctrl->count_repeat);
++
++	ctrl->cpr_allowed_sw =
++		of_property_read_bool(ctrl->dev->of_node, "qcom,cpr-enable") ||
++		ctrl->cpr_global_setting == CPR_CLOSED_LOOP_EN;
++
++	rc = cpr3_parse_irq_affinity(ctrl);
++	if (rc)
++		return rc;
++
++	/* Aging reference voltage is optional */
++	ctrl->aging_ref_volt = 0;
++	of_property_read_u32(ctrl->dev->of_node, "qcom,cpr-aging-ref-voltage",
++			&ctrl->aging_ref_volt);
++
++	/* Aging possible bitmask is optional */
++	ctrl->aging_possible_mask = 0;
++	of_property_read_u32(ctrl->dev->of_node,
++			"qcom,cpr-aging-allowed-reg-mask",
++			&ctrl->aging_possible_mask);
++
++	if (ctrl->aging_possible_mask) {
++		/*
++		 * Aging possible register value required if bitmask is
++		 * specified
++		 */
++		rc = cpr3_parse_ctrl_u32(ctrl,
++				"qcom,cpr-aging-allowed-reg-value",
++				&ctrl->aging_possible_val, 0, UINT_MAX);
++		if (rc)
++			return rc;
++	}
++
++	if (of_find_property(ctrl->dev->of_node, "clock-names", NULL)) {
++		ctrl->core_clk = devm_clk_get(ctrl->dev, "core_clk");
++		if (IS_ERR(ctrl->core_clk)) {
++			rc = PTR_ERR(ctrl->core_clk);
++			if (rc != -EPROBE_DEFER)
++				cpr3_err(ctrl, "unable request core clock, rc=%d\n",
++				rc);
++			return rc;
++		}
++	}
++
++	rc = cpr3_panic_notifier_init(ctrl);
++	if (rc)
++		return rc;
++
++	if (of_find_property(ctrl->dev->of_node, "vdd-supply", NULL)) {
++		ctrl->vdd_regulator = devm_regulator_get(ctrl->dev, "vdd");
++		if (IS_ERR(ctrl->vdd_regulator)) {
++			rc = PTR_ERR(ctrl->vdd_regulator);
++			if (rc != -EPROBE_DEFER)
++				cpr3_err(ctrl, "unable to request vdd regulator, rc=%d\n",
++					 rc);
++			return rc;
++		}
++	} else {
++		cpr3_err(ctrl, "vdd supply is not defined\n");
++		return -ENODEV;
++	}
++
++	ctrl->system_regulator = devm_regulator_get_optional(ctrl->dev,
++								"system");
++	if (IS_ERR(ctrl->system_regulator)) {
++		rc = PTR_ERR(ctrl->system_regulator);
++		if (rc != -EPROBE_DEFER) {
++			rc = 0;
++			ctrl->system_regulator = NULL;
++		} else {
++			return rc;
++		}
++	}
++
++	ctrl->mem_acc_regulator = devm_regulator_get_optional(ctrl->dev,
++							      "mem-acc");
++	if (IS_ERR(ctrl->mem_acc_regulator)) {
++		rc = PTR_ERR(ctrl->mem_acc_regulator);
++		if (rc != -EPROBE_DEFER) {
++			rc = 0;
++			ctrl->mem_acc_regulator = NULL;
++		} else {
++			return rc;
++		}
++	}
++
++	return rc;
++}
++
++/**
++ * cpr3_parse_open_loop_common_ctrl_data() - parse common open loop CPR3
++ *			controller properties from device tree
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_parse_open_loop_common_ctrl_data(struct cpr3_controller *ctrl)
++{
++	int rc;
++
++	rc = of_property_read_u32(ctrl->dev->of_node, "qcom,voltage-step",
++				  &ctrl->step_volt);
++	if (rc) {
++		cpr3_err(ctrl, "error reading property qcom,voltage-step, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	if (ctrl->step_volt <= 0) {
++		cpr3_err(ctrl, "qcom,voltage-step=%d is invalid\n",
++			 ctrl->step_volt);
++		return -EINVAL;
++	}
++
++	if (of_find_property(ctrl->dev->of_node, "vdd-supply", NULL)) {
++		ctrl->vdd_regulator = devm_regulator_get(ctrl->dev, "vdd");
++		if (IS_ERR(ctrl->vdd_regulator)) {
++			rc = PTR_ERR(ctrl->vdd_regulator);
++			if (rc != -EPROBE_DEFER)
++				cpr3_err(ctrl, "unable to request vdd regulator, rc=%d\n",
++					 rc);
++			return rc;
++		}
++	} else {
++		cpr3_err(ctrl, "vdd supply is not defined\n");
++		return -ENODEV;
++	}
++
++	ctrl->system_regulator = devm_regulator_get_optional(ctrl->dev,
++								"system");
++	if (IS_ERR(ctrl->system_regulator)) {
++		rc = PTR_ERR(ctrl->system_regulator);
++		if (rc != -EPROBE_DEFER) {
++			rc = 0;
++			ctrl->system_regulator = NULL;
++		} else {
++			return rc;
++		}
++	} else {
++		rc = regulator_enable(ctrl->system_regulator);
++	}
++
++	ctrl->mem_acc_regulator = devm_regulator_get_optional(ctrl->dev,
++							      "mem-acc");
++	if (IS_ERR(ctrl->mem_acc_regulator)) {
++		rc = PTR_ERR(ctrl->mem_acc_regulator);
++		if (rc != -EPROBE_DEFER) {
++			rc = 0;
++			ctrl->mem_acc_regulator = NULL;
++		} else {
++			return rc;
++		}
++	}
++
++	return rc;
++}
++
++/**
++ * cpr3_limit_open_loop_voltages() - modify the open-loop voltage of each corner
++ *				so that it fits within the floor to ceiling
++ *				voltage range of the corner
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * This function clips the open-loop voltage for each corner so that it is
++ * limited to the floor to ceiling range.  It also rounds each open-loop voltage
++ * so that it corresponds to a set point available to the underlying regulator.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_limit_open_loop_voltages(struct cpr3_regulator *vreg)
++{
++	int i, volt;
++
++	cpr3_debug(vreg, "open-loop voltages after trimming and rounding:\n");
++	for (i = 0; i < vreg->corner_count; i++) {
++		volt = CPR3_ROUND(vreg->corner[i].open_loop_volt,
++					vreg->thread->ctrl->step_volt);
++		if (volt < vreg->corner[i].floor_volt)
++			volt = vreg->corner[i].floor_volt;
++		else if (volt > vreg->corner[i].ceiling_volt)
++			volt = vreg->corner[i].ceiling_volt;
++		vreg->corner[i].open_loop_volt = volt;
++		cpr3_debug(vreg, "corner[%2d]: open-loop=%d uV\n", i, volt);
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_open_loop_voltage_as_ceiling() - configures the ceiling voltage for each
++ *		corner to equal the open-loop voltage if the relevant device
++ *		tree property is found for the CPR3 regulator
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * This function assumes that the the open-loop voltage for each corner has
++ * already been rounded to the nearest allowed set point and that it falls
++ * within the floor to ceiling range.
++ *
++ * Return: none
++ */
++void cpr3_open_loop_voltage_as_ceiling(struct cpr3_regulator *vreg)
++{
++	int i;
++
++	if (!of_property_read_bool(vreg->of_node,
++				"qcom,cpr-scaled-open-loop-voltage-as-ceiling"))
++		return;
++
++	for (i = 0; i < vreg->corner_count; i++)
++		vreg->corner[i].ceiling_volt
++			= vreg->corner[i].open_loop_volt;
++}
++
++/**
++ * cpr3_limit_floor_voltages() - raise the floor voltage of each corner so that
++ *		the optional maximum floor to ceiling voltage range specified in
++ *		device tree is satisfied
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * This function also ensures that the open-loop voltage for each corner falls
++ * within the final floor to ceiling voltage range and that floor voltages
++ * increase monotonically.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_limit_floor_voltages(struct cpr3_regulator *vreg)
++{
++	char *prop = "qcom,cpr-floor-to-ceiling-max-range";
++	int i, floor_new;
++	u32 *floor_range;
++	int rc = 0;
++
++	if (!of_find_property(vreg->of_node, prop, NULL))
++		goto enforce_monotonicity;
++
++	floor_range = kcalloc(vreg->corner_count, sizeof(*floor_range),
++				GFP_KERNEL);
++	if (!floor_range)
++		return -ENOMEM;
++
++	rc = cpr3_parse_corner_array_property(vreg, prop, 1, floor_range);
++	if (rc)
++		goto free_floor_adjust;
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		if ((s32)floor_range[i] >= 0) {
++			floor_new = CPR3_ROUND(vreg->corner[i].ceiling_volt
++							- floor_range[i],
++						vreg->thread->ctrl->step_volt);
++
++			vreg->corner[i].floor_volt = max(floor_new,
++						vreg->corner[i].floor_volt);
++			if (vreg->corner[i].open_loop_volt
++			    < vreg->corner[i].floor_volt)
++				vreg->corner[i].open_loop_volt
++					= vreg->corner[i].floor_volt;
++		}
++	}
++
++free_floor_adjust:
++	kfree(floor_range);
++
++enforce_monotonicity:
++	/* Ensure that floor voltages increase monotonically. */
++	for (i = 1; i < vreg->corner_count; i++) {
++		if (vreg->corner[i].floor_volt
++		    < vreg->corner[i - 1].floor_volt) {
++			cpr3_debug(vreg, "corner %d floor voltage=%d uV < corner %d voltage=%d uV; overriding: corner %d voltage=%d\n",
++				i, vreg->corner[i].floor_volt,
++				i - 1, vreg->corner[i - 1].floor_volt,
++				i, vreg->corner[i - 1].floor_volt);
++			vreg->corner[i].floor_volt
++				= vreg->corner[i - 1].floor_volt;
++
++			if (vreg->corner[i].open_loop_volt
++			    < vreg->corner[i].floor_volt)
++				vreg->corner[i].open_loop_volt
++					= vreg->corner[i].floor_volt;
++			if (vreg->corner[i].ceiling_volt
++			    < vreg->corner[i].floor_volt)
++				vreg->corner[i].ceiling_volt
++					= vreg->corner[i].floor_volt;
++		}
++	}
++
++	return rc;
++}
++
++/**
++ * cpr3_print_quots() - print CPR target quotients into the kernel log for
++ *		debugging purposes
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * Return: none
++ */
++void cpr3_print_quots(struct cpr3_regulator *vreg)
++{
++	int i, j, pos;
++	size_t buflen;
++	char *buf;
++
++	buflen = sizeof(*buf) * CPR3_RO_COUNT * (MAX_CHARS_PER_INT + 2);
++	buf = kzalloc(buflen, GFP_KERNEL);
++	if (!buf)
++		return;
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		for (j = 0, pos = 0; j < CPR3_RO_COUNT; j++)
++			pos += scnprintf(buf + pos, buflen - pos, " %u",
++				vreg->corner[i].target_quot[j]);
++		cpr3_debug(vreg, "target quots[%2d]:%s\n", i, buf);
++	}
++
++	kfree(buf);
++}
++
++/**
++ * cpr3_determine_part_type() - determine the part type (SS/TT/FF).
++ *
++ * qcom,cpr-part-types prop tells the number of part types for which correction
++ * voltages are different. Another prop qcom,cpr-parts-voltage will contain the
++ * open loop fuse voltage which will be compared with this part voltage
++ * and accordingly part type will de determined.
++ *
++ * if qcom,cpr-part-types has value n, then qcom,cpr-parts-voltage will be
++ * array of n - 1 elements which will contain the voltage in increasing order.
++ * This function compares the fused volatge with all these voltage and returns
++ * the first index for which the fused volatge is greater.
++ *
++ * @vreg:		Pointer to the CPR3 regulator
++ * @fuse_volt:		fused open loop voltage which will be compared with
++ *                      qcom,cpr-parts-voltage array
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_determine_part_type(struct cpr3_regulator *vreg, int fuse_volt)
++{
++	int i, rc, len;
++	u32 volt;
++	int soc_version_major;
++	char prop_name[100];
++	const char prop_name_def[] = "qcom,cpr-parts-voltage";
++	const char prop_name_v2[] = "qcom,cpr-parts-voltage-v2";
++
++	soc_version_major = read_ipq_soc_version_major();
++        BUG_ON(soc_version_major <= 0);
++
++	if (of_property_read_u32(vreg->of_node, "qcom,cpr-part-types",
++				  &vreg->part_type_supported))
++		return 0;
++
++	if (soc_version_major > 1)
++		strlcpy(prop_name, prop_name_v2, sizeof(prop_name_v2));
++	else
++		strlcpy(prop_name, prop_name_def, sizeof(prop_name_def));
++
++	if (!of_find_property(vreg->of_node, prop_name, &len)) {
++		cpr3_err(vreg, "property %s is missing\n", prop_name);
++		return -EINVAL;
++	}
++
++	if (len != (vreg->part_type_supported - 1) * sizeof(u32)) {
++		cpr3_err(vreg, "wrong len in qcom,cpr-parts-voltage\n");
++		return -EINVAL;
++	}
++
++	for (i = 0; i < vreg->part_type_supported - 1; i++) {
++		rc = of_property_read_u32_index(vreg->of_node,
++					prop_name, i, &volt);
++		if (rc) {
++			cpr3_err(vreg, "error reading property %s, rc=%d\n",
++				 prop_name, rc);
++			return rc;
++		}
++
++		if (fuse_volt < volt)
++			break;
++	}
++
++	vreg->part_type = i;
++	return 0;
++}
++
++int cpr3_determine_temp_base_open_loop_correction(struct cpr3_regulator *vreg,
++		int *fuse_volt)
++{
++	int i, rc, prev_volt;
++	int *volt_adjust;
++	char prop_str[75];
++	int soc_version_major = read_ipq_soc_version_major();
++
++	BUG_ON(soc_version_major <= 0);
++
++	if (vreg->part_type_supported) {
++		if (soc_version_major > 1)
++			snprintf(prop_str, sizeof(prop_str),
++			"qcom,cpr-cold-temp-voltage-adjustment-v2-%d",
++			vreg->part_type);
++		else
++			snprintf(prop_str, sizeof(prop_str),
++			"qcom,cpr-cold-temp-voltage-adjustment-%d",
++			vreg->part_type);
++	} else {
++		strlcpy(prop_str, "qcom,cpr-cold-temp-voltage-adjustment",
++			sizeof(prop_str));
++	}
++
++	if (!of_find_property(vreg->of_node, prop_str, NULL)) {
++		/* No adjustment required. */
++		cpr3_info(vreg, "No cold temperature adjustment required.\n");
++		return 0;
++	}
++
++	volt_adjust = kcalloc(vreg->fuse_corner_count, sizeof(*volt_adjust),
++	GFP_KERNEL);
++	if (!volt_adjust)
++		return -ENOMEM;
++
++	rc = cpr3_parse_array_property(vreg, prop_str,
++			vreg->fuse_corner_count, volt_adjust);
++	if (rc) {
++		cpr3_err(vreg, "could not load cold temp voltage adjustments, rc=%d\n",
++			rc);
++		goto done;
++	}
++
++	for (i = 0; i < vreg->fuse_corner_count; i++) {
++		if (volt_adjust[i]) {
++			prev_volt = fuse_volt[i];
++			fuse_volt[i] += volt_adjust[i];
++			cpr3_debug(vreg,
++				"adjusted fuse corner %d open-loop voltage: %d -> %d uV\n",
++				i, prev_volt, fuse_volt[i]);
++		}
++	}
++
++done:
++	kfree(volt_adjust);
++	return rc;
++}
++
++/**
++ * cpr3_can_adjust_cold_temp() - Is cold temperature adjustment available
++ *
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * This function checks the cold temperature threshold is available
++ *
++ * Return: true on cold temperature threshold is available, else false
++ */
++bool cpr3_can_adjust_cold_temp(struct cpr3_regulator *vreg)
++{
++	char prop_str[75];
++	int soc_version_major = read_ipq_soc_version_major();
++
++	BUG_ON(soc_version_major <= 0);
++
++	if (soc_version_major > 1)
++		strlcpy(prop_str, "qcom,cpr-cold-temp-threshold-v2",
++			sizeof(prop_str));
++	else
++		strlcpy(prop_str, "qcom,cpr-cold-temp-threshold",
++			sizeof(prop_str));
++
++	if (!of_find_property(vreg->of_node, prop_str, NULL)) {
++		/* No adjustment required. */
++		return false;
++	} else
++		return true;
++}
++
++/**
++ * cpr3_get_cold_temp_threshold() - get cold temperature threshold
++ *
++ * @vreg:		Pointer to the CPR3 regulator
++ * @cold_temp:		cold temperature read.
++ *
++ * This function reads the cold temperature threshold below which
++ * cold temperature adjustment margins will be applied.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_get_cold_temp_threshold(struct cpr3_regulator *vreg, int *cold_temp)
++{
++	int rc;
++	u32 temp;
++	char req_prop_str[75], prop_str[75];
++	int soc_version_major = read_ipq_soc_version_major();
++
++	BUG_ON(soc_version_major <= 0);
++
++	if (vreg->part_type_supported) {
++		if (soc_version_major > 1)
++			snprintf(req_prop_str, sizeof(req_prop_str),
++			"qcom,cpr-cold-temp-voltage-adjustment-v2-%d",
++			vreg->part_type);
++		else
++			snprintf(req_prop_str, sizeof(req_prop_str),
++			"qcom,cpr-cold-temp-voltage-adjustment-%d",
++			vreg->part_type);
++	} else {
++		strlcpy(req_prop_str, "qcom,cpr-cold-temp-voltage-adjustment",
++			sizeof(req_prop_str));
++	}
++
++	if (soc_version_major > 1)
++		strlcpy(prop_str, "qcom,cpr-cold-temp-threshold-v2",
++			sizeof(prop_str));
++	else
++		strlcpy(prop_str, "qcom,cpr-cold-temp-threshold",
++			sizeof(prop_str));
++
++	if (!of_find_property(vreg->of_node, req_prop_str, NULL)) {
++		/* No adjustment required. */
++		cpr3_info(vreg, "Cold temperature adjustment not required.\n");
++		return 0;
++	}
++
++	if (!of_find_property(vreg->of_node, prop_str, NULL)) {
++		/* No adjustment required. */
++                cpr3_err(vreg, "Missing %s required for %s\n",
++			prop_str, req_prop_str);
++		return -EINVAL;
++        }
++
++	rc = of_property_read_u32(vreg->of_node, prop_str, &temp);
++	if (rc) {
++		cpr3_err(vreg, "error reading property %s, rc=%d\n",
++			prop_str, rc);
++		return rc;
++	}
++
++	*cold_temp = temp;
++	return 0;
++}
++
++/**
++ * cpr3_adjust_fused_open_loop_voltages() - adjust the fused open-loop voltages
++ *		for each fuse corner according to device tree values
++ * @vreg:		Pointer to the CPR3 regulator
++ * @fuse_volt:		Pointer to an array of the fused open-loop voltage
++ *			values
++ *
++ * Voltage values in fuse_volt are modified in place.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_adjust_fused_open_loop_voltages(struct cpr3_regulator *vreg,
++		int *fuse_volt)
++{
++	int i, rc, prev_volt;
++	int *volt_adjust;
++	char prop_str[75];
++	int soc_version_major = read_ipq_soc_version_major();
++
++	BUG_ON(soc_version_major <= 0);
++
++	if (vreg->part_type_supported) {
++		if (soc_version_major > 1)
++			snprintf(prop_str, sizeof(prop_str),
++			"qcom,cpr-open-loop-voltage-fuse-adjustment-v2-%d",
++			vreg->part_type);
++		else
++		snprintf(prop_str, sizeof(prop_str),
++			 "qcom,cpr-open-loop-voltage-fuse-adjustment-%d",
++			 vreg->part_type);
++	} else {
++		strlcpy(prop_str, "qcom,cpr-open-loop-voltage-fuse-adjustment",
++			sizeof(prop_str));
++	}
++
++	if (!of_find_property(vreg->of_node, prop_str, NULL)) {
++		/* No adjustment required. */
++		return 0;
++	}
++
++	volt_adjust = kcalloc(vreg->fuse_corner_count, sizeof(*volt_adjust),
++				GFP_KERNEL);
++	if (!volt_adjust)
++		return -ENOMEM;
++
++	rc = cpr3_parse_array_property(vreg,
++		prop_str, vreg->fuse_corner_count, volt_adjust);
++	if (rc) {
++		cpr3_err(vreg, "could not load open-loop fused voltage adjustments, rc=%d\n",
++			rc);
++		goto done;
++	}
++
++	for (i = 0; i < vreg->fuse_corner_count; i++) {
++		if (volt_adjust[i]) {
++			prev_volt = fuse_volt[i];
++			fuse_volt[i] += volt_adjust[i];
++			cpr3_debug(vreg, "adjusted fuse corner %d open-loop voltage: %d --> %d uV\n",
++				i, prev_volt, fuse_volt[i]);
++		}
++	}
++
++done:
++	kfree(volt_adjust);
++	return rc;
++}
++
++/**
++ * cpr3_adjust_open_loop_voltages() - adjust the open-loop voltages for each
++ *		corner according to device tree values
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_adjust_open_loop_voltages(struct cpr3_regulator *vreg)
++{
++	int i, rc, prev_volt, min_volt;
++	int *volt_adjust, *volt_diff;
++
++	if (!of_find_property(vreg->of_node,
++			"qcom,cpr-open-loop-voltage-adjustment", NULL)) {
++		/* No adjustment required. */
++		return 0;
++	}
++
++	volt_adjust = kcalloc(vreg->corner_count, sizeof(*volt_adjust),
++				GFP_KERNEL);
++	volt_diff = kcalloc(vreg->corner_count, sizeof(*volt_diff), GFP_KERNEL);
++	if (!volt_adjust || !volt_diff) {
++		rc = -ENOMEM;
++		goto done;
++	}
++
++	rc = cpr3_parse_corner_array_property(vreg,
++		"qcom,cpr-open-loop-voltage-adjustment", 1, volt_adjust);
++	if (rc) {
++		cpr3_err(vreg, "could not load open-loop voltage adjustments, rc=%d\n",
++			rc);
++		goto done;
++	}
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		if (volt_adjust[i]) {
++			prev_volt = vreg->corner[i].open_loop_volt;
++			vreg->corner[i].open_loop_volt += volt_adjust[i];
++			cpr3_debug(vreg, "adjusted corner %d open-loop voltage: %d --> %d uV\n",
++				i, prev_volt, vreg->corner[i].open_loop_volt);
++		}
++	}
++
++	if (of_find_property(vreg->of_node,
++			"qcom,cpr-open-loop-voltage-min-diff", NULL)) {
++		rc = cpr3_parse_corner_array_property(vreg,
++			"qcom,cpr-open-loop-voltage-min-diff", 1, volt_diff);
++		if (rc) {
++			cpr3_err(vreg, "could not load minimum open-loop voltage differences, rc=%d\n",
++				rc);
++			goto done;
++		}
++	}
++
++	/*
++	 * Ensure that open-loop voltages increase monotonically with respect
++	 * to configurable minimum allowed differences.
++	 */
++	for (i = 1; i < vreg->corner_count; i++) {
++		min_volt = vreg->corner[i - 1].open_loop_volt + volt_diff[i];
++		if (vreg->corner[i].open_loop_volt < min_volt) {
++			cpr3_debug(vreg, "adjusted corner %d open-loop voltage=%d uV < corner %d voltage=%d uV + min diff=%d uV; overriding: corner %d voltage=%d\n",
++				i, vreg->corner[i].open_loop_volt,
++				i - 1, vreg->corner[i - 1].open_loop_volt,
++				volt_diff[i], i, min_volt);
++			vreg->corner[i].open_loop_volt = min_volt;
++		}
++	}
++
++done:
++	kfree(volt_diff);
++	kfree(volt_adjust);
++	return rc;
++}
++
++/**
++ * cpr3_quot_adjustment() - returns the quotient adjustment value resulting from
++ *		the specified voltage adjustment and RO scaling factor
++ * @ro_scale:		The CPR ring oscillator (RO) scaling factor with units
++ *			of QUOT/V
++ * @volt_adjust:	The amount to adjust the voltage by in units of
++ *			microvolts.  This value may be positive or negative.
++ */
++int cpr3_quot_adjustment(int ro_scale, int volt_adjust)
++{
++	unsigned long long temp;
++	int quot_adjust;
++	int sign = 1;
++
++	if (ro_scale < 0) {
++		sign = -sign;
++		ro_scale = -ro_scale;
++	}
++
++	if (volt_adjust < 0) {
++		sign = -sign;
++		volt_adjust = -volt_adjust;
++	}
++
++	temp = (unsigned long long)ro_scale * (unsigned long long)volt_adjust;
++	do_div(temp, 1000000);
++
++	quot_adjust = temp;
++	quot_adjust *= sign;
++
++	return quot_adjust;
++}
++
++/**
++ * cpr3_voltage_adjustment() - returns the voltage adjustment value resulting
++ *		from the specified quotient adjustment and RO scaling factor
++ * @ro_scale:		The CPR ring oscillator (RO) scaling factor with units
++ *			of QUOT/V
++ * @quot_adjust:	The amount to adjust the quotient by in units of
++ *			QUOT.  This value may be positive or negative.
++ */
++int cpr3_voltage_adjustment(int ro_scale, int quot_adjust)
++{
++	unsigned long long temp;
++	int volt_adjust;
++	int sign = 1;
++
++	if (ro_scale < 0) {
++		sign = -sign;
++		ro_scale = -ro_scale;
++	}
++
++	if (quot_adjust < 0) {
++		sign = -sign;
++		quot_adjust = -quot_adjust;
++	}
++
++	if (ro_scale == 0)
++		return 0;
++
++	temp = (unsigned long long)quot_adjust * 1000000;
++	do_div(temp, ro_scale);
++
++	volt_adjust = temp;
++	volt_adjust *= sign;
++
++	return volt_adjust;
++}
++
++/**
++ * cpr3_parse_closed_loop_voltage_adjustments() - load per-fuse-corner and
++ *		per-corner closed-loop adjustment values from device tree
++ * @vreg:		Pointer to the CPR3 regulator
++ * @ro_sel:		Array of ring oscillator values selected for each
++ *			fuse corner
++ * @volt_adjust:	Pointer to array which will be filled with the
++ *			per-corner closed-loop adjustment voltages
++ * @volt_adjust_fuse:	Pointer to array which will be filled with the
++ *			per-fuse-corner closed-loop adjustment voltages
++ * @ro_scale:		Pointer to array which will be filled with the
++ *			per-fuse-corner RO scaling factor values with units of
++ *			QUOT/V
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_parse_closed_loop_voltage_adjustments(
++			struct cpr3_regulator *vreg, u64 *ro_sel,
++			int *volt_adjust, int *volt_adjust_fuse, int *ro_scale)
++{
++	int i, rc;
++	u32 *ro_all_scale;
++
++	char volt_adj[] = "qcom,cpr-closed-loop-voltage-adjustment";
++	char volt_fuse_adj[] = "qcom,cpr-closed-loop-voltage-fuse-adjustment";
++	char ro_scaling[] = "qcom,cpr-ro-scaling-factor";
++
++	if (!of_find_property(vreg->of_node, volt_adj, NULL)
++	    && !of_find_property(vreg->of_node, volt_fuse_adj, NULL)
++	    && !vreg->aging_allowed) {
++		/* No adjustment required. */
++		return 0;
++	} else if (!of_find_property(vreg->of_node, ro_scaling, NULL)) {
++		cpr3_err(vreg, "Missing %s required for closed-loop voltage adjustment.\n",
++				ro_scaling);
++		return -EINVAL;
++	}
++
++	ro_all_scale = kcalloc(vreg->fuse_corner_count * CPR3_RO_COUNT,
++				sizeof(*ro_all_scale), GFP_KERNEL);
++	if (!ro_all_scale)
++		return -ENOMEM;
++
++	rc = cpr3_parse_array_property(vreg, ro_scaling,
++		vreg->fuse_corner_count * CPR3_RO_COUNT, ro_all_scale);
++	if (rc) {
++		cpr3_err(vreg, "could not load RO scaling factors, rc=%d\n",
++			rc);
++		goto done;
++	}
++
++	for (i = 0; i < vreg->fuse_corner_count; i++)
++		ro_scale[i] = ro_all_scale[i * CPR3_RO_COUNT + ro_sel[i]];
++
++	for (i = 0; i < vreg->corner_count; i++)
++		memcpy(vreg->corner[i].ro_scale,
++		 &ro_all_scale[vreg->corner[i].cpr_fuse_corner * CPR3_RO_COUNT],
++		 sizeof(*ro_all_scale) * CPR3_RO_COUNT);
++
++	if (of_find_property(vreg->of_node, volt_fuse_adj, NULL)) {
++		rc = cpr3_parse_array_property(vreg, volt_fuse_adj,
++			vreg->fuse_corner_count, volt_adjust_fuse);
++		if (rc) {
++			cpr3_err(vreg, "could not load closed-loop fused voltage adjustments, rc=%d\n",
++				rc);
++			goto done;
++		}
++	}
++
++	if (of_find_property(vreg->of_node, volt_adj, NULL)) {
++		rc = cpr3_parse_corner_array_property(vreg, volt_adj,
++			1, volt_adjust);
++		if (rc) {
++			cpr3_err(vreg, "could not load closed-loop voltage adjustments, rc=%d\n",
++				rc);
++			goto done;
++		}
++	}
++
++done:
++	kfree(ro_all_scale);
++	return rc;
++}
++
++/**
++ * cpr3_apm_init() - initialize APM data for a CPR3 controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * This function loads memory array power mux (APM) data from device tree
++ * if it is present and requests a handle to the appropriate APM controller
++ * device.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_apm_init(struct cpr3_controller *ctrl)
++{
++	struct device_node *node = ctrl->dev->of_node;
++	int rc;
++
++	if (!of_find_property(node, "qcom,apm-ctrl", NULL)) {
++		/* No APM used */
++		return 0;
++	}
++
++	ctrl->apm = msm_apm_ctrl_dev_get(ctrl->dev);
++	if (IS_ERR(ctrl->apm)) {
++		rc = PTR_ERR(ctrl->apm);
++		if (rc != -EPROBE_DEFER)
++			cpr3_err(ctrl, "APM get failed, rc=%d\n", rc);
++		return rc;
++	}
++
++	rc = of_property_read_u32(node, "qcom,apm-threshold-voltage",
++				&ctrl->apm_threshold_volt);
++	if (rc) {
++		cpr3_err(ctrl, "error reading qcom,apm-threshold-voltage, rc=%d\n",
++			rc);
++		return rc;
++	}
++	ctrl->apm_threshold_volt
++		= CPR3_ROUND(ctrl->apm_threshold_volt, ctrl->step_volt);
++
++	/* No error check since this is an optional property. */
++	of_property_read_u32(node, "qcom,apm-hysteresis-voltage",
++				&ctrl->apm_adj_volt);
++	ctrl->apm_adj_volt = CPR3_ROUND(ctrl->apm_adj_volt, ctrl->step_volt);
++
++	ctrl->apm_high_supply = MSM_APM_SUPPLY_APCC;
++	ctrl->apm_low_supply = MSM_APM_SUPPLY_MX;
++
++	return 0;
++}
++
++/**
++ * cpr3_mem_acc_init() - initialize mem-acc regulator data for
++ *		a CPR3 regulator
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_mem_acc_init(struct cpr3_regulator *vreg)
++{
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	u32 *temp;
++	int i, rc;
++
++	if (!ctrl->mem_acc_regulator) {
++		cpr3_info(ctrl, "not using memory accelerator regulator\n");
++		return 0;
++	}
++
++	temp = kcalloc(vreg->corner_count, sizeof(*temp), GFP_KERNEL);
++	if (!temp)
++		return -ENOMEM;
++
++	rc = cpr3_parse_corner_array_property(vreg, "qcom,mem-acc-voltage",
++					      1, temp);
++	if (rc) {
++		cpr3_err(ctrl, "could not load mem-acc corners, rc=%d\n", rc);
++	} else {
++		for (i = 0; i < vreg->corner_count; i++)
++			vreg->corner[i].mem_acc_volt = temp[i];
++	}
++
++	kfree(temp);
++	return rc;
++}
++
++/**
++ * cpr4_load_core_and_temp_adj() - parse amount of voltage adjustment for
++ *		per-online-core and per-temperature voltage adjustment for a
++ *		given corner or corner band from device tree.
++ * @vreg:	Pointer to the CPR3 regulator
++ * @num:	Corner number or corner band number
++ * @use_corner_band:	Boolean indicating if the CPR3 regulator supports
++ *			adjustments per corner band
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_load_core_and_temp_adj(struct cpr3_regulator *vreg,
++					int num, bool use_corner_band)
++{
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	struct cpr4_sdelta *sdelta;
++	int sdelta_size, i, j, pos, rc = 0;
++	char str[75];
++	size_t buflen;
++	char *buf;
++
++	sdelta = use_corner_band ? vreg->corner_band[num].sdelta :
++		vreg->corner[num].sdelta;
++
++	if (!sdelta->allow_core_count_adj && !sdelta->allow_temp_adj) {
++		/* corner doesn't need sdelta table */
++		sdelta->max_core_count = 0;
++		sdelta->temp_band_count = 0;
++		return rc;
++	}
++
++	sdelta_size = sdelta->max_core_count * sdelta->temp_band_count;
++	if (use_corner_band)
++		snprintf(str, sizeof(str),
++			 "corner_band=%d core_config_count=%d temp_band_count=%d sdelta_size=%d\n",
++			 num, sdelta->max_core_count,
++			 sdelta->temp_band_count, sdelta_size);
++	else
++		snprintf(str, sizeof(str),
++			 "corner=%d core_config_count=%d temp_band_count=%d sdelta_size=%d\n",
++			 num, sdelta->max_core_count,
++			 sdelta->temp_band_count, sdelta_size);
++
++	cpr3_debug(vreg, "%s", str);
++
++	sdelta->table = devm_kcalloc(ctrl->dev, sdelta_size,
++				sizeof(*sdelta->table), GFP_KERNEL);
++	if (!sdelta->table)
++		return -ENOMEM;
++
++	if (use_corner_band)
++		snprintf(str, sizeof(str),
++			 "qcom,cpr-corner-band%d-temp-core-voltage-adjustment",
++			 num + CPR3_CORNER_OFFSET);
++	else
++		snprintf(str, sizeof(str),
++			 "qcom,cpr-corner%d-temp-core-voltage-adjustment",
++			 num + CPR3_CORNER_OFFSET);
++
++	rc = cpr3_parse_array_property(vreg, str, sdelta_size,
++				sdelta->table);
++	if (rc) {
++		cpr3_err(vreg, "could not load %s, rc=%d\n", str, rc);
++		return rc;
++	}
++
++	/*
++	 * Convert sdelta margins from uV to PMIC steps and apply negation to
++	 * follow the SDELTA register semantics.
++	 */
++	for (i = 0; i < sdelta_size; i++)
++		sdelta->table[i] = -(sdelta->table[i] / ctrl->step_volt);
++
++	buflen = sizeof(*buf) * sdelta_size * (MAX_CHARS_PER_INT + 2);
++	buf = kzalloc(buflen, GFP_KERNEL);
++	if (!buf)
++		return rc;
++
++	for (i = 0; i < sdelta->max_core_count; i++) {
++		for (j = 0, pos = 0; j < sdelta->temp_band_count; j++)
++			pos += scnprintf(buf + pos, buflen - pos, " %u",
++			 sdelta->table[i * sdelta->temp_band_count + j]);
++		cpr3_debug(vreg, "sdelta[%d]:%s\n", i, buf);
++	}
++
++	kfree(buf);
++	return rc;
++}
++
++/**
++ * cpr4_parse_core_count_temp_voltage_adj() - parse configuration data for
++ *		per-online-core and per-temperature voltage adjustment for
++ *		a CPR3 regulator from device tree.
++ * @vreg:	Pointer to the CPR3 regulator
++ * @use_corner_band:	Boolean indicating if the CPR3 regulator supports
++ *			adjustments per corner band
++ *
++ * This function supports parsing of per-online-core and per-temperature
++ * adjustments per corner or per corner band. CPR controllers which support
++ * corner bands apply the same adjustments to all corners within a corner band.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr4_parse_core_count_temp_voltage_adj(
++			struct cpr3_regulator *vreg, bool use_corner_band)
++{
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	struct device_node *node = vreg->of_node;
++	struct cpr3_corner *corner;
++	struct cpr4_sdelta *sdelta;
++	int i, sdelta_table_count, rc = 0;
++	int *allow_core_count_adj = NULL, *allow_temp_adj = NULL;
++	char prop_str[75];
++
++	if (of_find_property(node, use_corner_band ?
++			     "qcom,corner-band-allow-temp-adjustment"
++			     : "qcom,corner-allow-temp-adjustment", NULL)) {
++		if (!ctrl->allow_temp_adj) {
++			cpr3_err(ctrl, "Temperature adjustment configurations missing\n");
++			return -EINVAL;
++		}
++
++		vreg->allow_temp_adj = true;
++	}
++
++	if (of_find_property(node, use_corner_band ?
++			     "qcom,corner-band-allow-core-count-adjustment"
++			     : "qcom,corner-allow-core-count-adjustment",
++			     NULL)) {
++		rc = of_property_read_u32(node, "qcom,max-core-count",
++				&vreg->max_core_count);
++		if (rc) {
++			cpr3_err(vreg, "error reading qcom,max-core-count, rc=%d\n",
++				rc);
++			return -EINVAL;
++		}
++
++		vreg->allow_core_count_adj = true;
++		ctrl->allow_core_count_adj = true;
++	}
++
++	if (!vreg->allow_temp_adj && !vreg->allow_core_count_adj) {
++		/*
++		 * Both per-online-core and temperature based adjustments are
++		 * disabled for this regulator.
++		 */
++		return 0;
++	} else if (!vreg->allow_core_count_adj) {
++		/*
++		 * Only per-temperature voltage adjusments are allowed.
++		 * Keep max core count value as 1 to allocate SDELTA.
++		 */
++		vreg->max_core_count = 1;
++	}
++
++	if (vreg->allow_core_count_adj) {
++		allow_core_count_adj = kcalloc(vreg->corner_count,
++					sizeof(*allow_core_count_adj),
++					GFP_KERNEL);
++		if (!allow_core_count_adj)
++			return -ENOMEM;
++
++		snprintf(prop_str, sizeof(prop_str), "%s", use_corner_band ?
++			 "qcom,corner-band-allow-core-count-adjustment" :
++			 "qcom,corner-allow-core-count-adjustment");
++
++		rc = use_corner_band ?
++			cpr3_parse_corner_band_array_property(vreg, prop_str,
++					      1, allow_core_count_adj) :
++			cpr3_parse_corner_array_property(vreg, prop_str,
++						 1, allow_core_count_adj);
++		if (rc) {
++			cpr3_err(vreg, "error reading %s, rc=%d\n", prop_str,
++				 rc);
++			goto done;
++		}
++	}
++
++	if (vreg->allow_temp_adj) {
++		allow_temp_adj = kcalloc(vreg->corner_count,
++					sizeof(*allow_temp_adj), GFP_KERNEL);
++		if (!allow_temp_adj) {
++			rc = -ENOMEM;
++			goto done;
++		}
++
++		snprintf(prop_str, sizeof(prop_str), "%s", use_corner_band ?
++			 "qcom,corner-band-allow-temp-adjustment" :
++			 "qcom,corner-allow-temp-adjustment");
++
++		rc = use_corner_band ?
++			cpr3_parse_corner_band_array_property(vreg, prop_str,
++						      1, allow_temp_adj) :
++			cpr3_parse_corner_array_property(vreg, prop_str,
++						 1, allow_temp_adj);
++		if (rc) {
++			cpr3_err(vreg, "error reading %s, rc=%d\n", prop_str,
++				 rc);
++			goto done;
++		}
++	}
++
++	sdelta_table_count = use_corner_band ? vreg->corner_band_count :
++		vreg->corner_count;
++
++	for (i = 0; i < sdelta_table_count; i++) {
++		sdelta = devm_kzalloc(ctrl->dev, sizeof(*corner->sdelta),
++				      GFP_KERNEL);
++		if (!sdelta) {
++			rc = -ENOMEM;
++			goto done;
++		}
++
++		if (allow_core_count_adj)
++			sdelta->allow_core_count_adj = allow_core_count_adj[i];
++		if (allow_temp_adj)
++			sdelta->allow_temp_adj = allow_temp_adj[i];
++		sdelta->max_core_count = vreg->max_core_count;
++		sdelta->temp_band_count = ctrl->temp_band_count;
++
++		if (use_corner_band)
++			vreg->corner_band[i].sdelta = sdelta;
++		else
++			vreg->corner[i].sdelta = sdelta;
++
++		rc = cpr4_load_core_and_temp_adj(vreg, i, use_corner_band);
++		if (rc) {
++			cpr3_err(vreg, "corner/band %d core and temp adjustment loading failed, rc=%d\n",
++				 i, rc);
++			goto done;
++		}
++	}
++
++done:
++	kfree(allow_core_count_adj);
++	kfree(allow_temp_adj);
++
++	return rc;
++}
++
++/**
++ * cprh_adjust_voltages_for_apm() - adjust per-corner floor and ceiling voltages
++ *		so that they do not overlap the APM threshold voltage.
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * The memory array power mux (APM) must be configured for a specific supply
++ * based upon where the VDD voltage lies with respect to the APM threshold
++ * voltage.  When using CPR hardware closed-loop, the voltage may vary anywhere
++ * between the floor and ceiling voltage without software notification.
++ * Therefore, it is required that the floor to ceiling range for every corner
++ * not intersect the APM threshold voltage.  This function adjusts the floor to
++ * ceiling range for each corner which violates this requirement.
++ *
++ * The following algorithm is applied:
++ *	if floor < threshold <= ceiling:
++ *		if open_loop >= threshold, then floor = threshold - adj
++ *		else ceiling = threshold - step
++ * where:
++ *	adj = APM hysteresis voltage established to minimize the number of
++ *	      corners with artificially increased floor voltages
++ *	step = voltage in microvolts of a single step of the VDD supply
++ *
++ * The open-loop voltage is also bounded by the new floor or ceiling value as
++ * needed.
++ *
++ * Return: none
++ */
++void cprh_adjust_voltages_for_apm(struct cpr3_regulator *vreg)
++{
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	struct cpr3_corner *corner;
++	int i, adj, threshold, prev_ceiling, prev_floor, prev_open_loop;
++
++	if (!ctrl->apm_threshold_volt) {
++		/* APM not being used. */
++		return;
++	}
++
++	ctrl->apm_threshold_volt = CPR3_ROUND(ctrl->apm_threshold_volt,
++						ctrl->step_volt);
++	ctrl->apm_adj_volt = CPR3_ROUND(ctrl->apm_adj_volt, ctrl->step_volt);
++
++	threshold = ctrl->apm_threshold_volt;
++	adj = ctrl->apm_adj_volt;
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		corner = &vreg->corner[i];
++
++		if (threshold <= corner->floor_volt
++		    || threshold > corner->ceiling_volt)
++			continue;
++
++		prev_floor = corner->floor_volt;
++		prev_ceiling = corner->ceiling_volt;
++		prev_open_loop = corner->open_loop_volt;
++
++		if (corner->open_loop_volt >= threshold) {
++			corner->floor_volt = max(corner->floor_volt,
++						 threshold - adj);
++			if (corner->open_loop_volt < corner->floor_volt)
++				corner->open_loop_volt = corner->floor_volt;
++		} else {
++			corner->ceiling_volt = threshold - ctrl->step_volt;
++		}
++
++		if (corner->floor_volt != prev_floor
++		    || corner->ceiling_volt != prev_ceiling
++		    || corner->open_loop_volt != prev_open_loop)
++			cpr3_debug(vreg, "APM threshold=%d, APM adj=%d changed corner %d voltages; prev: floor=%d, ceiling=%d, open-loop=%d; new: floor=%d, ceiling=%d, open-loop=%d\n",
++				threshold, adj, i, prev_floor, prev_ceiling,
++				prev_open_loop, corner->floor_volt,
++				corner->ceiling_volt, corner->open_loop_volt);
++	}
++}
++
++/**
++ * cprh_adjust_voltages_for_mem_acc() - adjust per-corner floor and ceiling
++ *		voltages so that they do not intersect the MEM ACC threshold
++ *		voltage
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * The following algorithm is applied:
++ *	if floor < threshold <= ceiling:
++ *		if open_loop >= threshold, then floor = threshold
++ *		else ceiling = threshold - step
++ * where:
++ *	step = voltage in microvolts of a single step of the VDD supply
++ *
++ * The open-loop voltage is also bounded by the new floor or ceiling value as
++ * needed.
++ *
++ * Return: none
++ */
++void cprh_adjust_voltages_for_mem_acc(struct cpr3_regulator *vreg)
++{
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	struct cpr3_corner *corner;
++	int i, threshold, prev_ceiling, prev_floor, prev_open_loop;
++
++	if (!ctrl->mem_acc_threshold_volt) {
++		/* MEM ACC not being used. */
++		return;
++	}
++
++	ctrl->mem_acc_threshold_volt = CPR3_ROUND(ctrl->mem_acc_threshold_volt,
++						ctrl->step_volt);
++
++	threshold = ctrl->mem_acc_threshold_volt;
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		corner = &vreg->corner[i];
++
++		if (threshold <= corner->floor_volt
++		    || threshold > corner->ceiling_volt)
++			continue;
++
++		prev_floor = corner->floor_volt;
++		prev_ceiling = corner->ceiling_volt;
++		prev_open_loop = corner->open_loop_volt;
++
++		if (corner->open_loop_volt >= threshold) {
++			corner->floor_volt = max(corner->floor_volt, threshold);
++			if (corner->open_loop_volt < corner->floor_volt)
++				corner->open_loop_volt = corner->floor_volt;
++		} else {
++			corner->ceiling_volt = threshold - ctrl->step_volt;
++		}
++
++		if (corner->floor_volt != prev_floor
++		    || corner->ceiling_volt != prev_ceiling
++		    || corner->open_loop_volt != prev_open_loop)
++			cpr3_debug(vreg, "MEM ACC threshold=%d changed corner %d voltages; prev: floor=%d, ceiling=%d, open-loop=%d; new: floor=%d, ceiling=%d, open-loop=%d\n",
++				threshold, i, prev_floor, prev_ceiling,
++				prev_open_loop, corner->floor_volt,
++				corner->ceiling_volt, corner->open_loop_volt);
++	}
++}
++
++/**
++ * cpr3_apply_closed_loop_offset_voltages() - modify the closed-loop voltage
++ *		adjustments by the amounts that are needed for this
++ *		fuse combo
++ * @vreg:		Pointer to the CPR3 regulator
++ * @volt_adjust:	Array of closed-loop voltage adjustment values of length
++ *			vreg->corner_count which is further adjusted based upon
++ *			offset voltage fuse values.
++ * @fuse_volt_adjust:	Fused closed-loop voltage adjustment values of length
++ *			vreg->fuse_corner_count.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_apply_closed_loop_offset_voltages(struct cpr3_regulator *vreg,
++			int *volt_adjust, int *fuse_volt_adjust)
++{
++	u32 *corner_map;
++	int rc = 0, i;
++
++	if (!of_find_property(vreg->of_node,
++		"qcom,cpr-fused-closed-loop-voltage-adjustment-map", NULL)) {
++		/* No closed-loop offset required. */
++		return 0;
++	}
++
++	corner_map = kcalloc(vreg->corner_count, sizeof(*corner_map),
++				GFP_KERNEL);
++	if (!corner_map)
++		return -ENOMEM;
++
++	rc = cpr3_parse_corner_array_property(vreg,
++		"qcom,cpr-fused-closed-loop-voltage-adjustment-map",
++		1, corner_map);
++	if (rc)
++		goto done;
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		if (corner_map[i] == 0) {
++			continue;
++		} else if (corner_map[i] > vreg->fuse_corner_count) {
++			cpr3_err(vreg, "corner %d mapped to invalid fuse corner: %u\n",
++				i, corner_map[i]);
++			rc = -EINVAL;
++			goto done;
++		}
++
++		volt_adjust[i] += fuse_volt_adjust[corner_map[i] - 1];
++	}
++
++done:
++	kfree(corner_map);
++	return rc;
++}
++
++/**
++ * cpr3_enforce_inc_quotient_monotonicity() - Ensure that target quotients
++ *		increase monotonically from lower to higher corners
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * Return: 0 on success, errno on failure
++ */
++static void cpr3_enforce_inc_quotient_monotonicity(struct cpr3_regulator *vreg)
++{
++	int i, j;
++
++	for (i = 1; i < vreg->corner_count; i++) {
++		for (j = 0; j < CPR3_RO_COUNT; j++) {
++			if (vreg->corner[i].target_quot[j]
++			    && vreg->corner[i].target_quot[j]
++					< vreg->corner[i - 1].target_quot[j]) {
++				cpr3_debug(vreg, "corner %d RO%u target quot=%u < corner %d RO%u target quot=%u; overriding: corner %d RO%u target quot=%u\n",
++					i, j,
++					vreg->corner[i].target_quot[j],
++					i - 1, j,
++					vreg->corner[i - 1].target_quot[j],
++					i, j,
++					vreg->corner[i - 1].target_quot[j]);
++				vreg->corner[i].target_quot[j]
++					= vreg->corner[i - 1].target_quot[j];
++			}
++		}
++	}
++}
++
++/**
++ * cpr3_enforce_dec_quotient_monotonicity() - Ensure that target quotients
++ *		decrease monotonically from higher to lower corners
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * Return: 0 on success, errno on failure
++ */
++static void cpr3_enforce_dec_quotient_monotonicity(struct cpr3_regulator *vreg)
++{
++	int i, j;
++
++	for (i = vreg->corner_count - 2; i >= 0; i--) {
++		for (j = 0; j < CPR3_RO_COUNT; j++) {
++			if (vreg->corner[i + 1].target_quot[j]
++			    && vreg->corner[i].target_quot[j]
++					> vreg->corner[i + 1].target_quot[j]) {
++				cpr3_debug(vreg, "corner %d RO%u target quot=%u > corner %d RO%u target quot=%u; overriding: corner %d RO%u target quot=%u\n",
++					i, j,
++					vreg->corner[i].target_quot[j],
++					i + 1, j,
++					vreg->corner[i + 1].target_quot[j],
++					i, j,
++					vreg->corner[i + 1].target_quot[j]);
++				vreg->corner[i].target_quot[j]
++					= vreg->corner[i + 1].target_quot[j];
++			}
++		}
++	}
++}
++
++/**
++ * _cpr3_adjust_target_quotients() - adjust the target quotients for each
++ *		corner of the regulator according to input adjustment and
++ *		scaling arrays
++ * @vreg:		Pointer to the CPR3 regulator
++ * @volt_adjust:	Pointer to an array of closed-loop voltage adjustments
++ *			with units of microvolts.  The array must have
++ *			vreg->corner_count number of elements.
++ * @ro_scale:		Pointer to a flattened 2D array of RO scaling factors.
++ *			The array must have an inner dimension of CPR3_RO_COUNT
++ *			and an outer dimension of vreg->corner_count
++ * @label:		Null terminated string providing a label for the type
++ *			of adjustment.
++ *
++ * Return: true if any corners received a positive voltage adjustment (> 0),
++ *	   else false
++ */
++static bool _cpr3_adjust_target_quotients(struct cpr3_regulator *vreg,
++		const int *volt_adjust, const int *ro_scale, const char *label)
++{
++	int i, j, quot_adjust;
++	bool is_increasing = false;
++	u32 prev_quot;
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		for (j = 0; j < CPR3_RO_COUNT; j++) {
++			if (vreg->corner[i].target_quot[j]) {
++				quot_adjust = cpr3_quot_adjustment(
++					ro_scale[i * CPR3_RO_COUNT + j],
++					volt_adjust[i]);
++				if (quot_adjust) {
++					prev_quot = vreg->corner[i].
++							target_quot[j];
++					vreg->corner[i].target_quot[j]
++						+= quot_adjust;
++					cpr3_debug(vreg, "adjusted corner %d RO%d target quot %s: %u --> %u (%d uV)\n",
++						i, j, label, prev_quot,
++						vreg->corner[i].target_quot[j],
++						volt_adjust[i]);
++				}
++			}
++		}
++		if (volt_adjust[i] > 0)
++			is_increasing = true;
++	}
++
++	return is_increasing;
++}
++
++/**
++ * cpr3_adjust_target_quotients() - adjust the target quotients for each
++ *			corner according to device tree values and fuse values
++ * @vreg:		Pointer to the CPR3 regulator
++ * @fuse_volt_adjust:	Fused closed-loop voltage adjustment values of length
++ *			vreg->fuse_corner_count. This parameter could be null
++ *			pointer when no fused adjustments are needed.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_adjust_target_quotients(struct cpr3_regulator *vreg,
++			int *fuse_volt_adjust)
++{
++	int i, rc;
++	int *volt_adjust, *ro_scale;
++	bool explicit_adjustment, fused_adjustment, is_increasing;
++
++	explicit_adjustment = of_find_property(vreg->of_node,
++		"qcom,cpr-closed-loop-voltage-adjustment", NULL);
++	fused_adjustment = of_find_property(vreg->of_node,
++		"qcom,cpr-fused-closed-loop-voltage-adjustment-map", NULL);
++
++	if (!explicit_adjustment && !fused_adjustment && !vreg->aging_allowed) {
++		/* No adjustment required. */
++		return 0;
++	} else if (!of_find_property(vreg->of_node,
++			"qcom,cpr-ro-scaling-factor", NULL)) {
++		cpr3_err(vreg, "qcom,cpr-ro-scaling-factor is required for closed-loop voltage adjustment, but is missing\n");
++		return -EINVAL;
++	}
++
++	volt_adjust = kcalloc(vreg->corner_count, sizeof(*volt_adjust),
++				GFP_KERNEL);
++	ro_scale = kcalloc(vreg->corner_count * CPR3_RO_COUNT,
++				sizeof(*ro_scale), GFP_KERNEL);
++	if (!volt_adjust || !ro_scale) {
++		rc = -ENOMEM;
++		goto done;
++	}
++
++	rc = cpr3_parse_corner_array_property(vreg,
++			"qcom,cpr-ro-scaling-factor", CPR3_RO_COUNT, ro_scale);
++	if (rc) {
++		cpr3_err(vreg, "could not load RO scaling factors, rc=%d\n",
++			rc);
++		goto done;
++	}
++
++	for (i = 0; i < vreg->corner_count; i++)
++		memcpy(vreg->corner[i].ro_scale, &ro_scale[i * CPR3_RO_COUNT],
++			sizeof(*ro_scale) * CPR3_RO_COUNT);
++
++	if (explicit_adjustment) {
++		rc = cpr3_parse_corner_array_property(vreg,
++			"qcom,cpr-closed-loop-voltage-adjustment",
++			1, volt_adjust);
++		if (rc) {
++			cpr3_err(vreg, "could not load closed-loop voltage adjustments, rc=%d\n",
++				rc);
++			goto done;
++		}
++
++		_cpr3_adjust_target_quotients(vreg, volt_adjust, ro_scale,
++			"from DT");
++		cpr3_enforce_inc_quotient_monotonicity(vreg);
++	}
++
++	if (fused_adjustment && fuse_volt_adjust) {
++		memset(volt_adjust, 0,
++			sizeof(*volt_adjust) * vreg->corner_count);
++
++		rc = cpr3_apply_closed_loop_offset_voltages(vreg, volt_adjust,
++				fuse_volt_adjust);
++		if (rc) {
++			cpr3_err(vreg, "could not apply fused closed-loop voltage reductions, rc=%d\n",
++				rc);
++			goto done;
++		}
++
++		is_increasing = _cpr3_adjust_target_quotients(vreg, volt_adjust,
++					ro_scale, "from fuse");
++		if (is_increasing)
++			cpr3_enforce_inc_quotient_monotonicity(vreg);
++		else
++			cpr3_enforce_dec_quotient_monotonicity(vreg);
++	}
++
++done:
++	kfree(volt_adjust);
++	kfree(ro_scale);
++	return rc;
++}
+--- /dev/null
++++ b/drivers/regulator/cpr4-apss-regulator.c
+@@ -0,0 +1,1819 @@
++/*
++ * Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#define pr_fmt(fmt) "%s: " fmt, __func__
++
++#include <linux/bitops.h>
++#include <linux/debugfs.h>
++#include <linux/err.h>
++#include <linux/init.h>
++#include <linux/interrupt.h>
++#include <linux/io.h>
++#include <linux/kernel.h>
++#include <linux/list.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
++#include <linux/platform_device.h>
++#include <linux/pm_opp.h>
++#include <linux/slab.h>
++#include <linux/string.h>
++#include <linux/uaccess.h>
++#include <linux/regulator/driver.h>
++#include <linux/regulator/machine.h>
++#include <linux/regulator/of_regulator.h>
++
++#include "cpr3-regulator.h"
++
++#define IPQ807x_APSS_FUSE_CORNERS	4
++#define IPQ817x_APPS_FUSE_CORNERS	2
++#define IPQ6018_APSS_FUSE_CORNERS 	4
++#define IPQ9574_APSS_FUSE_CORNERS       4
++
++u32 g_valid_fuse_count = IPQ807x_APSS_FUSE_CORNERS;
++
++/**
++ * struct cpr4_ipq807x_apss_fuses - APSS specific fuse data for IPQ807x
++ * @ro_sel:		Ring oscillator select fuse parameter value for each
++ *			fuse corner
++ * @init_voltage:	Initial (i.e. open-loop) voltage fuse parameter value
++ *			for each fuse corner (raw, not converted to a voltage)
++ * @target_quot:	CPR target quotient fuse parameter value for each fuse
++ *			corner
++ * @quot_offset:	CPR target quotient offset fuse parameter value for each
++ *			fuse corner (raw, not unpacked) used for target quotient
++ *			interpolation
++ * @speed_bin:		Application processor speed bin fuse parameter value for
++ *			the given chip
++ * @cpr_fusing_rev:	CPR fusing revision fuse parameter value
++ * @boost_cfg:		CPR boost configuration fuse parameter value
++ * @boost_voltage:	CPR boost voltage fuse parameter value (raw, not
++ *			converted to a voltage)
++ *
++ * This struct holds the values for all of the fuses read from memory.
++ */
++struct cpr4_ipq807x_apss_fuses {
++	u64	ro_sel[IPQ807x_APSS_FUSE_CORNERS];
++	u64	init_voltage[IPQ807x_APSS_FUSE_CORNERS];
++	u64	target_quot[IPQ807x_APSS_FUSE_CORNERS];
++	u64	quot_offset[IPQ807x_APSS_FUSE_CORNERS];
++	u64	speed_bin;
++	u64	cpr_fusing_rev;
++	u64	boost_cfg;
++	u64	boost_voltage;
++	u64	misc;
++};
++
++/*
++ * fuse combo = fusing revision + 8 * (speed bin)
++ * where: fusing revision = 0 - 7 and speed bin = 0 - 7
++ */
++#define CPR4_IPQ807x_APSS_FUSE_COMBO_COUNT	64
++
++/*
++ * Constants which define the name of each fuse corner.
++ */
++enum cpr4_ipq807x_apss_fuse_corner {
++	CPR4_IPQ807x_APSS_FUSE_CORNER_SVS	= 0,
++	CPR4_IPQ807x_APSS_FUSE_CORNER_NOM	= 1,
++	CPR4_IPQ807x_APSS_FUSE_CORNER_TURBO	= 2,
++	CPR4_IPQ807x_APSS_FUSE_CORNER_STURBO	= 3,
++};
++
++static const char * const cpr4_ipq807x_apss_fuse_corner_name[] = {
++	[CPR4_IPQ807x_APSS_FUSE_CORNER_SVS]	= "SVS",
++	[CPR4_IPQ807x_APSS_FUSE_CORNER_NOM]	= "NOM",
++	[CPR4_IPQ807x_APSS_FUSE_CORNER_TURBO]	= "TURBO",
++	[CPR4_IPQ807x_APSS_FUSE_CORNER_STURBO]	= "STURBO",
++};
++
++/*
++ * IPQ807x APSS fuse parameter locations:
++ *
++ * Structs are organized with the following dimensions:
++ *	Outer: 0 to 3 for fuse corners from lowest to highest corner
++ *	Inner: large enough to hold the longest set of parameter segments which
++ *		fully defines a fuse parameter, +1 (for NULL termination).
++ *		Each segment corresponds to a contiguous group of bits from a
++ *		single fuse row.  These segments are concatentated together in
++ *		order to form the full fuse parameter value.  The segments for
++ *		a given parameter may correspond to different fuse rows.
++ */
++static struct cpr3_fuse_param
++ipq807x_apss_ro_sel_param[IPQ807x_APSS_FUSE_CORNERS][2] = {
++	{{73,  8, 11}, {} },
++	{{73,  4,  7}, {} },
++	{{73,  0,  3}, {} },
++	{{73, 12, 15}, {} },
++};
++
++static struct cpr3_fuse_param
++ipq807x_apss_init_voltage_param[IPQ807x_APSS_FUSE_CORNERS][2] = {
++	{{71, 18, 23}, {} },
++	{{71, 12, 17}, {} },
++	{{71,  6, 11}, {} },
++	{{71,  0,  5}, {} },
++};
++
++static struct cpr3_fuse_param
++ipq807x_apss_target_quot_param[IPQ807x_APSS_FUSE_CORNERS][2] = {
++	{{72, 32, 43}, {} },
++	{{72, 20, 31}, {} },
++	{{72,  8, 19}, {} },
++	{{72, 44, 55}, {} },
++};
++
++static struct cpr3_fuse_param
++ipq807x_apss_quot_offset_param[IPQ807x_APSS_FUSE_CORNERS][2] = {
++	{{} },
++	{{71, 46, 52}, {} },
++	{{71, 39, 45}, {} },
++	{{71, 32, 38}, {} },
++};
++
++static struct cpr3_fuse_param ipq807x_cpr_fusing_rev_param[] = {
++	{71, 53, 55},
++	{},
++};
++
++static struct cpr3_fuse_param ipq807x_apss_speed_bin_param[] = {
++	{36, 40, 42},
++	{},
++};
++
++static struct cpr3_fuse_param ipq807x_cpr_boost_fuse_cfg_param[] = {
++	{36, 43, 45},
++	{},
++};
++
++static struct cpr3_fuse_param ipq807x_apss_boost_fuse_volt_param[] = {
++	{71, 0, 5},
++	{},
++};
++
++static struct cpr3_fuse_param ipq807x_misc_fuse_volt_adj_param[] = {
++	{36, 54, 54},
++	{},
++};
++
++static struct cpr3_fuse_parameters ipq807x_fuse_params = {
++	.apss_ro_sel_param = ipq807x_apss_ro_sel_param,
++	.apss_init_voltage_param = ipq807x_apss_init_voltage_param,
++	.apss_target_quot_param = ipq807x_apss_target_quot_param,
++	.apss_quot_offset_param = ipq807x_apss_quot_offset_param,
++	.cpr_fusing_rev_param = ipq807x_cpr_fusing_rev_param,
++	.apss_speed_bin_param = ipq807x_apss_speed_bin_param,
++	.cpr_boost_fuse_cfg_param = ipq807x_cpr_boost_fuse_cfg_param,
++	.apss_boost_fuse_volt_param = ipq807x_apss_boost_fuse_volt_param,
++	.misc_fuse_volt_adj_param = ipq807x_misc_fuse_volt_adj_param
++};
++
++/*
++ * The number of possible values for misc fuse is
++ * 2^(#bits defined for misc fuse)
++ */
++#define IPQ807x_MISC_FUSE_VAL_COUNT		BIT(1)
++
++/*
++ * Open loop voltage fuse reference voltages in microvolts for IPQ807x
++ */
++static int ipq807x_apss_fuse_ref_volt
++	[IPQ807x_APSS_FUSE_CORNERS] = {
++	720000,
++	864000,
++	992000,
++	1064000,
++};
++
++#define IPQ807x_APSS_FUSE_STEP_VOLT		8000
++#define IPQ807x_APSS_VOLTAGE_FUSE_SIZE	6
++#define IPQ807x_APSS_QUOT_OFFSET_SCALE	5
++
++#define IPQ807x_APSS_CPR_SENSOR_COUNT	6
++
++#define IPQ807x_APSS_CPR_CLOCK_RATE		19200000
++
++#define IPQ807x_APSS_MAX_TEMP_POINTS	3
++#define IPQ807x_APSS_TEMP_SENSOR_ID_START	4
++#define IPQ807x_APSS_TEMP_SENSOR_ID_END	13
++/*
++ * Boost voltage fuse reference and ceiling voltages in microvolts for
++ * IPQ807x.
++ */
++#define IPQ807x_APSS_BOOST_FUSE_REF_VOLT	1140000
++#define IPQ807x_APSS_BOOST_CEILING_VOLT	1140000
++#define IPQ807x_APSS_BOOST_FLOOR_VOLT	900000
++#define MAX_BOOST_CONFIG_FUSE_VALUE		8
++
++#define IPQ807x_APSS_CPR_SDELTA_CORE_COUNT	15
++
++#define IPQ807x_APSS_CPR_TCSR_START		8
++#define IPQ807x_APSS_CPR_TCSR_END		9
++
++/*
++ * Array of integer values mapped to each of the boost config fuse values to
++ * indicate boost enable/disable status.
++ */
++static bool boost_fuse[MAX_BOOST_CONFIG_FUSE_VALUE] = {0, 1, 1, 1, 1, 1, 1, 1};
++
++/*
++ * IPQ6018 (Few parameters are changed, remaining are same as IPQ807x)
++ */
++#define IPQ6018_APSS_FUSE_STEP_VOLT		12500
++#define IPQ6018_APSS_CPR_CLOCK_RATE		24000000
++
++static struct cpr3_fuse_param
++ipq6018_apss_ro_sel_param[IPQ6018_APSS_FUSE_CORNERS][2] = {
++	{{75,  8, 11}, {} },
++	{{75,  4,  7}, {} },
++	{{75,  0,  3}, {} },
++	{{75, 12, 15}, {} },
++};
++
++static struct cpr3_fuse_param
++ipq6018_apss_init_voltage_param[IPQ6018_APSS_FUSE_CORNERS][2] = {
++	{{73, 18, 23}, {} },
++	{{73, 12, 17}, {} },
++	{{73,  6, 11}, {} },
++	{{73,  0,  5}, {} },
++};
++
++static struct cpr3_fuse_param
++ipq6018_apss_target_quot_param[IPQ6018_APSS_FUSE_CORNERS][2] = {
++	{{74, 32, 43}, {} },
++	{{74, 20, 31}, {} },
++	{{74,  8, 19}, {} },
++	{{74, 44, 55}, {} },
++};
++
++static struct cpr3_fuse_param
++ipq6018_apss_quot_offset_param[IPQ6018_APSS_FUSE_CORNERS][2] = {
++	{{} },
++	{{73, 48, 55}, {} },
++	{{73, 40, 47}, {} },
++	{{73, 32, 39}, {} },
++};
++
++static struct cpr3_fuse_param ipq6018_cpr_fusing_rev_param[] = {
++	{75, 16, 18},
++	{},
++};
++
++static struct cpr3_fuse_param ipq6018_apss_speed_bin_param[] = {
++	{36, 40, 42},
++	{},
++};
++
++static struct cpr3_fuse_param ipq6018_cpr_boost_fuse_cfg_param[] = {
++	{36, 43, 45},
++	{},
++};
++
++static struct cpr3_fuse_param ipq6018_apss_boost_fuse_volt_param[] = {
++	{73, 0, 5},
++	{},
++};
++
++static struct cpr3_fuse_param ipq6018_misc_fuse_volt_adj_param[] = {
++	{36, 54, 54},
++	{},
++};
++
++static struct cpr3_fuse_parameters ipq6018_fuse_params = {
++	.apss_ro_sel_param = ipq6018_apss_ro_sel_param,
++	.apss_init_voltage_param = ipq6018_apss_init_voltage_param,
++	.apss_target_quot_param = ipq6018_apss_target_quot_param,
++	.apss_quot_offset_param = ipq6018_apss_quot_offset_param,
++	.cpr_fusing_rev_param = ipq6018_cpr_fusing_rev_param,
++	.apss_speed_bin_param = ipq6018_apss_speed_bin_param,
++	.cpr_boost_fuse_cfg_param = ipq6018_cpr_boost_fuse_cfg_param,
++	.apss_boost_fuse_volt_param = ipq6018_apss_boost_fuse_volt_param,
++	.misc_fuse_volt_adj_param = ipq6018_misc_fuse_volt_adj_param
++};
++
++
++/*
++ * Boost voltage fuse reference and ceiling voltages in microvolts for
++ * IPQ6018.
++ */
++#define IPQ6018_APSS_BOOST_FUSE_REF_VOLT	1140000
++#define IPQ6018_APSS_BOOST_CEILING_VOLT	1140000
++#define IPQ6018_APSS_BOOST_FLOOR_VOLT	900000
++
++/*
++ * Open loop voltage fuse reference voltages in microvolts for IPQ807x
++ */
++static int ipq6018_apss_fuse_ref_volt
++	[IPQ6018_APSS_FUSE_CORNERS] = {
++	725000,
++	862500,
++	987500,
++	1062500,
++};
++
++/*
++ * IPQ6018 Memory ACC settings on TCSR
++ *
++ * Turbo_L1: write TCSR_MEM_ACC_SW_OVERRIDE_LEGACY_APC0 0x10
++ *           write TCSR_CUSTOM_VDDAPC0_ACC_1            0x1
++ * Other modes: write TCSR_MEM_ACC_SW_OVERRIDE_LEGACY_APC0 0x0
++ *              write TCSR_CUSTOM_VDDAPC0_ACC_1            0x0
++ *
++ */
++#define IPQ6018_APSS_MEM_ACC_TCSR_COUNT         2
++#define TCSR_MEM_ACC_SW_OVERRIDE_LEGACY_APC0    0x1946178
++#define TCSR_CUSTOM_VDDAPC0_ACC_1               0x1946124
++
++struct mem_acc_tcsr {
++	u32 phy_addr;
++	void __iomem *ioremap_addr;
++	u32 value;
++};
++
++static struct mem_acc_tcsr ipq6018_mem_acc_tcsr[IPQ6018_APSS_MEM_ACC_TCSR_COUNT] = {
++	{TCSR_MEM_ACC_SW_OVERRIDE_LEGACY_APC0, NULL, 0x10},
++	{TCSR_CUSTOM_VDDAPC0_ACC_1, NULL, 0x1},
++};
++
++/*
++ * IPQ9574 (Few parameters are changed, remaining are same as IPQ6018)
++ */
++#define IPQ9574_APSS_FUSE_STEP_VOLT             10000
++
++static struct cpr3_fuse_param
++ipq9574_apss_ro_sel_param[IPQ9574_APSS_FUSE_CORNERS][2] = {
++	{{107, 4, 7}, {} },
++	{{107, 0, 3}, {} },
++	{{106, 4, 7}, {} },
++	{{106, 0, 3}, {} },
++};
++
++static struct cpr3_fuse_param
++ipq9574_apss_init_voltage_param[IPQ9574_APSS_FUSE_CORNERS][2] = {
++	{{104, 24, 29}, {} },
++	{{104, 18, 23}, {} },
++	{{104, 12, 17}, {} },
++	{{104,  6, 11}, {} },
++};
++
++static struct cpr3_fuse_param
++ipq9574_apss_target_quot_param[IPQ9574_APSS_FUSE_CORNERS][2] = {
++	{{106, 32, 43}, {} },
++	{{106, 20, 31}, {} },
++	{{106,  8, 19}, {} },
++	{{106, 44, 55}, {} },
++};
++
++static struct cpr3_fuse_param
++ipq9574_apss_quot_offset_param[IPQ9574_APSS_FUSE_CORNERS][2] = {
++	{{} },
++	{{105, 48, 55}, {} },
++	{{105, 40, 47}, {} },
++	{{105, 32, 39}, {} },
++};
++
++static struct cpr3_fuse_param ipq9574_cpr_fusing_rev_param[] = {
++	{107, 8, 10},
++	{},
++};
++
++static struct cpr3_fuse_param ipq9574_apss_speed_bin_param[] = {
++	{0, 40, 42},
++	{},
++};
++
++static struct cpr3_fuse_param ipq9574_cpr_boost_fuse_cfg_param[] = {
++	{0, 43, 45},
++	{},
++};
++
++static struct cpr3_fuse_param ipq9574_apss_boost_fuse_volt_param[] = {
++	{104, 0, 5},
++	{},
++};
++
++static struct cpr3_fuse_param ipq9574_misc_fuse_volt_adj_param[] = {
++	{0, 54, 54},
++	{},
++};
++
++static struct cpr3_fuse_parameters ipq9574_fuse_params = {
++	.apss_ro_sel_param = ipq9574_apss_ro_sel_param,
++	.apss_init_voltage_param = ipq9574_apss_init_voltage_param,
++	.apss_target_quot_param = ipq9574_apss_target_quot_param,
++	.apss_quot_offset_param = ipq9574_apss_quot_offset_param,
++	.cpr_fusing_rev_param = ipq9574_cpr_fusing_rev_param,
++	.apss_speed_bin_param = ipq9574_apss_speed_bin_param,
++	.cpr_boost_fuse_cfg_param = ipq9574_cpr_boost_fuse_cfg_param,
++	.apss_boost_fuse_volt_param = ipq9574_apss_boost_fuse_volt_param,
++	.misc_fuse_volt_adj_param = ipq9574_misc_fuse_volt_adj_param
++};
++
++/*
++ * Open loop voltage fuse reference voltages in microvolts for IPQ9574
++ */
++static int ipq9574_apss_fuse_ref_volt
++	[IPQ9574_APSS_FUSE_CORNERS] = {
++	725000,
++	862500,
++	987500,
++	1062500,
++};
++
++/**
++ * cpr4_ipq807x_apss_read_fuse_data() - load APSS specific fuse parameter values
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * This function allocates a cpr4_ipq807x_apss_fuses struct, fills it with
++ * values read out of hardware fuses, and finally copies common fuse values
++ * into the CPR3 regulator struct.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_ipq807x_apss_read_fuse_data(struct cpr3_regulator *vreg)
++{
++	void __iomem *base = vreg->thread->ctrl->fuse_base;
++	struct cpr4_ipq807x_apss_fuses *fuse;
++	int i, rc;
++
++	fuse = devm_kzalloc(vreg->thread->ctrl->dev, sizeof(*fuse), GFP_KERNEL);
++	if (!fuse)
++		return -ENOMEM;
++
++	rc = cpr3_read_fuse_param(base, vreg->cpr4_regulator_data->cpr3_fuse_params->apss_speed_bin_param,
++				  &fuse->speed_bin);
++	if (rc) {
++		cpr3_err(vreg, "Unable to read speed bin fuse, rc=%d\n", rc);
++		return rc;
++	}
++	cpr3_info(vreg, "speed bin = %llu\n", fuse->speed_bin);
++
++	rc = cpr3_read_fuse_param(base, vreg->cpr4_regulator_data->cpr3_fuse_params->cpr_fusing_rev_param,
++				  &fuse->cpr_fusing_rev);
++	if (rc) {
++		cpr3_err(vreg, "Unable to read CPR fusing revision fuse, rc=%d\n",
++			rc);
++		return rc;
++	}
++	cpr3_info(vreg, "CPR fusing revision = %llu\n", fuse->cpr_fusing_rev);
++
++	rc = cpr3_read_fuse_param(base, vreg->cpr4_regulator_data->cpr3_fuse_params->misc_fuse_volt_adj_param,
++				  &fuse->misc);
++	if (rc) {
++		cpr3_err(vreg, "Unable to read misc voltage adjustment fuse, rc=%d\n",
++			rc);
++		return rc;
++	}
++	cpr3_info(vreg, "CPR misc fuse value = %llu\n", fuse->misc);
++	if (fuse->misc >= IPQ807x_MISC_FUSE_VAL_COUNT) {
++		cpr3_err(vreg, "CPR misc fuse value = %llu, should be < %lu\n",
++			fuse->misc, IPQ807x_MISC_FUSE_VAL_COUNT);
++		return -EINVAL;
++	}
++
++	for (i = 0; i < g_valid_fuse_count; i++) {
++		rc = cpr3_read_fuse_param(base,
++				vreg->cpr4_regulator_data->cpr3_fuse_params->apss_init_voltage_param[i],
++				&fuse->init_voltage[i]);
++		if (rc) {
++			cpr3_err(vreg, "Unable to read fuse-corner %d initial voltage fuse, rc=%d\n",
++				i, rc);
++			return rc;
++		}
++
++		rc = cpr3_read_fuse_param(base,
++				vreg->cpr4_regulator_data->cpr3_fuse_params->apss_target_quot_param[i],
++				&fuse->target_quot[i]);
++		if (rc) {
++			cpr3_err(vreg, "Unable to read fuse-corner %d target quotient fuse, rc=%d\n",
++				i, rc);
++			return rc;
++		}
++
++		rc = cpr3_read_fuse_param(base,
++				vreg->cpr4_regulator_data->cpr3_fuse_params->apss_ro_sel_param[i],
++				&fuse->ro_sel[i]);
++		if (rc) {
++			cpr3_err(vreg, "Unable to read fuse-corner %d RO select fuse, rc=%d\n",
++				i, rc);
++			return rc;
++		}
++
++		rc = cpr3_read_fuse_param(base,
++				vreg->cpr4_regulator_data->cpr3_fuse_params->apss_quot_offset_param[i],
++				&fuse->quot_offset[i]);
++		if (rc) {
++			cpr3_err(vreg, "Unable to read fuse-corner %d quotient offset fuse, rc=%d\n",
++				i, rc);
++			return rc;
++		}
++	}
++
++	rc = cpr3_read_fuse_param(base, vreg->cpr4_regulator_data->cpr3_fuse_params->cpr_boost_fuse_cfg_param,
++				  &fuse->boost_cfg);
++	if (rc) {
++		cpr3_err(vreg, "Unable to read CPR boost config fuse, rc=%d\n",
++			rc);
++		return rc;
++	}
++	cpr3_info(vreg, "Voltage boost fuse config = %llu boost = %s\n",
++			fuse->boost_cfg, boost_fuse[fuse->boost_cfg]
++			? "enable" : "disable");
++
++	rc = cpr3_read_fuse_param(base,
++				vreg->cpr4_regulator_data->cpr3_fuse_params->apss_boost_fuse_volt_param,
++				&fuse->boost_voltage);
++	if (rc) {
++		cpr3_err(vreg, "failed to read boost fuse voltage, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	vreg->fuse_combo = fuse->cpr_fusing_rev + 8 * fuse->speed_bin;
++	if (vreg->fuse_combo >= CPR4_IPQ807x_APSS_FUSE_COMBO_COUNT) {
++		cpr3_err(vreg, "invalid CPR fuse combo = %d found\n",
++			vreg->fuse_combo);
++		return -EINVAL;
++	}
++
++	vreg->speed_bin_fuse	= fuse->speed_bin;
++	vreg->cpr_rev_fuse	= fuse->cpr_fusing_rev;
++	vreg->fuse_corner_count	= g_valid_fuse_count;
++	vreg->platform_fuses	= fuse;
++
++	return 0;
++}
++
++/**
++ * cpr4_apss_parse_corner_data() - parse APSS corner data from device tree
++ *		properties of the CPR3 regulator's device node
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_apss_parse_corner_data(struct cpr3_regulator *vreg)
++{
++	struct device_node *node = vreg->of_node;
++	struct cpr4_ipq807x_apss_fuses *fuse = vreg->platform_fuses;
++	u32 *temp = NULL;
++	int i, rc;
++
++	rc = cpr3_parse_common_corner_data(vreg);
++	if (rc) {
++		cpr3_err(vreg, "error reading corner data, rc=%d\n", rc);
++		return rc;
++	}
++
++	/* If fuse has incorrect RO Select values and dtsi has "qcom,cpr-ro-sel"
++	 * entry with RO select values other than zero, then dtsi values will
++	 * be used.
++	 */
++	if (of_find_property(node, "qcom,cpr-ro-sel", NULL)) {
++		temp = kcalloc(vreg->fuse_corner_count, sizeof(*temp),
++				GFP_KERNEL);
++		if (!temp)
++			return -ENOMEM;
++
++		rc = cpr3_parse_array_property(vreg, "qcom,cpr-ro-sel",
++				vreg->fuse_corner_count, temp);
++		if (rc)
++			goto done;
++
++		for (i = 0; i < vreg->fuse_corner_count; i++) {
++			if (temp[i] != 0)
++				fuse->ro_sel[i] = temp[i];
++		}
++	}
++done:
++	kfree(temp);
++	return rc;
++}
++
++/**
++ * cpr4_apss_parse_misc_fuse_voltage_adjustments() - fill an array from a
++ *		portion of the voltage adjustments specified based on
++ *		miscellaneous fuse bits.
++ * @vreg:		Pointer to the CPR3 regulator
++ * @volt_adjust:	Voltage adjustment output data array which must be
++ *			of size vreg->corner_count
++ *
++ * cpr3_parse_common_corner_data() must be called for vreg before this function
++ * is called so that speed bin size elements are initialized.
++ *
++ * Two formats are supported for the device tree property:
++ * 1. Length == tuple_list_size * vreg->corner_count
++ *	(reading begins at index 0)
++ * 2. Length == tuple_list_size * vreg->speed_bin_corner_sum
++ *	(reading begins at index tuple_list_size * vreg->speed_bin_offset)
++ *
++ * Here, tuple_list_size is the number of possible values for misc fuse.
++ * All other property lengths are treated as errors.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_apss_parse_misc_fuse_voltage_adjustments(
++	struct cpr3_regulator *vreg, u32 *volt_adjust)
++{
++	struct device_node *node = vreg->of_node;
++	struct cpr4_ipq807x_apss_fuses *fuse = vreg->platform_fuses;
++	int tuple_list_size = IPQ807x_MISC_FUSE_VAL_COUNT;
++	int i, offset, rc, len = 0;
++	const char *prop_name = "qcom,cpr-misc-fuse-voltage-adjustment";
++
++	if (!of_find_property(node, prop_name, &len)) {
++		cpr3_err(vreg, "property %s is missing\n", prop_name);
++		return -EINVAL;
++	}
++
++	if (len == tuple_list_size * vreg->corner_count * sizeof(u32)) {
++		offset = 0;
++	} else if (vreg->speed_bin_corner_sum > 0 &&
++			len == tuple_list_size * vreg->speed_bin_corner_sum
++			* sizeof(u32)) {
++		offset = tuple_list_size * vreg->speed_bin_offset
++			+ fuse->misc * vreg->corner_count;
++	} else {
++		if (vreg->speed_bin_corner_sum > 0)
++			cpr3_err(vreg, "property %s has invalid length=%d, should be %zu or %zu\n",
++				prop_name, len,
++				tuple_list_size * vreg->corner_count
++					* sizeof(u32),
++				tuple_list_size * vreg->speed_bin_corner_sum
++					* sizeof(u32));
++		else
++			cpr3_err(vreg, "property %s has invalid length=%d, should be %zu\n",
++				prop_name, len,
++				tuple_list_size * vreg->corner_count
++				* sizeof(u32));
++		return -EINVAL;
++	}
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		rc = of_property_read_u32_index(node, prop_name, offset + i,
++						&volt_adjust[i]);
++		if (rc) {
++			cpr3_err(vreg, "error reading property %s, rc=%d\n",
++				prop_name, rc);
++			return rc;
++		}
++	}
++
++	return 0;
++}
++
++/**
++ * cpr4_ipq807x_apss_calculate_open_loop_voltages() - calculate the open-loop
++ *		voltage for each corner of a CPR3 regulator
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * If open-loop voltage interpolation is allowed in device tree, then
++ * this function calculates the open-loop voltage for a given corner using
++ * linear interpolation.  This interpolation is performed using the processor
++ * frequencies of the lower and higher Fmax corners along with their fused
++ * open-loop voltages.
++ *
++ * If open-loop voltage interpolation is not allowed, then this function uses
++ * the Fmax fused open-loop voltage for all of the corners associated with a
++ * given fuse corner.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_ipq807x_apss_calculate_open_loop_voltages(
++			struct cpr3_regulator *vreg)
++{
++	struct device_node *node = vreg->of_node;
++	struct cpr4_ipq807x_apss_fuses *fuse = vreg->platform_fuses;
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	int i, j, rc = 0;
++	bool allow_interpolation;
++	u64 freq_low, volt_low, freq_high, volt_high;
++	int *fuse_volt, *misc_adj_volt;
++	int *fmax_corner;
++
++	fuse_volt = kcalloc(vreg->fuse_corner_count, sizeof(*fuse_volt),
++				GFP_KERNEL);
++	fmax_corner = kcalloc(vreg->fuse_corner_count, sizeof(*fmax_corner),
++				GFP_KERNEL);
++	if (!fuse_volt || !fmax_corner) {
++		rc = -ENOMEM;
++		goto done;
++	}
++
++	for (i = 0; i < vreg->fuse_corner_count; i++) {
++		if (ctrl->cpr_global_setting == CPR_DISABLED)
++			fuse_volt[i] = vreg->cpr4_regulator_data->fuse_ref_volt[i];
++		else
++			fuse_volt[i] = cpr3_convert_open_loop_voltage_fuse(
++				vreg->cpr4_regulator_data->fuse_ref_volt[i],
++				vreg->cpr4_regulator_data->fuse_step_volt,
++				fuse->init_voltage[i],
++				IPQ807x_APSS_VOLTAGE_FUSE_SIZE);
++
++		/* Log fused open-loop voltage values for debugging purposes. */
++		cpr3_info(vreg, "fused %8s: open-loop=%7d uV\n",
++			  cpr4_ipq807x_apss_fuse_corner_name[i],
++			  fuse_volt[i]);
++	}
++
++	rc = cpr3_determine_part_type(vreg,
++			  fuse_volt[vreg->fuse_corner_count - 1]);
++	if (rc) {
++		cpr3_err(vreg, "fused part type detection failed failed, rc=%d\n",
++			rc);
++		goto done;
++	}
++
++	rc = cpr3_adjust_fused_open_loop_voltages(vreg, fuse_volt);
++	if (rc) {
++		cpr3_err(vreg, "fused open-loop voltage adjustment failed, rc=%d\n",
++			rc);
++		goto done;
++	}
++
++	allow_interpolation = of_property_read_bool(node,
++				"qcom,allow-voltage-interpolation");
++
++	for (i = 1; i < vreg->fuse_corner_count; i++) {
++		if (fuse_volt[i] < fuse_volt[i - 1]) {
++			cpr3_info(vreg, "fuse corner %d voltage=%d uV < fuse corner %d voltage=%d uV; overriding: fuse corner %d voltage=%d\n",
++				i, fuse_volt[i], i - 1, fuse_volt[i - 1],
++				i, fuse_volt[i - 1]);
++			fuse_volt[i] = fuse_volt[i - 1];
++		}
++	}
++
++	if (!allow_interpolation) {
++		/* Use fused open-loop voltage for lower frequencies. */
++		for (i = 0; i < vreg->corner_count; i++)
++			vreg->corner[i].open_loop_volt
++				= fuse_volt[vreg->corner[i].cpr_fuse_corner];
++		goto done;
++	}
++
++	/* Determine highest corner mapped to each fuse corner */
++	j = vreg->fuse_corner_count - 1;
++	for (i = vreg->corner_count - 1; i >= 0; i--) {
++		if (vreg->corner[i].cpr_fuse_corner == j) {
++			fmax_corner[j] = i;
++			j--;
++		}
++	}
++	if (j >= 0) {
++		cpr3_err(vreg, "invalid fuse corner mapping\n");
++		rc = -EINVAL;
++		goto done;
++	}
++
++	/*
++	 * Interpolation is not possible for corners mapped to the lowest fuse
++	 * corner so use the fuse corner value directly.
++	 */
++	for (i = 0; i <= fmax_corner[0]; i++)
++		vreg->corner[i].open_loop_volt = fuse_volt[0];
++
++	/* Interpolate voltages for the higher fuse corners. */
++	for (i = 1; i < vreg->fuse_corner_count; i++) {
++		freq_low = vreg->corner[fmax_corner[i - 1]].proc_freq;
++		volt_low = fuse_volt[i - 1];
++		freq_high = vreg->corner[fmax_corner[i]].proc_freq;
++		volt_high = fuse_volt[i];
++
++		for (j = fmax_corner[i - 1] + 1; j <= fmax_corner[i]; j++)
++			vreg->corner[j].open_loop_volt = cpr3_interpolate(
++				freq_low, volt_low, freq_high, volt_high,
++				vreg->corner[j].proc_freq);
++	}
++
++done:
++	if (rc == 0) {
++		cpr3_debug(vreg, "unadjusted per-corner open-loop voltages:\n");
++		for (i = 0; i < vreg->corner_count; i++)
++			cpr3_debug(vreg, "open-loop[%2d] = %d uV\n", i,
++				vreg->corner[i].open_loop_volt);
++
++		rc = cpr3_adjust_open_loop_voltages(vreg);
++		if (rc)
++			cpr3_err(vreg, "open-loop voltage adjustment failed, rc=%d\n",
++				rc);
++
++		if (of_find_property(node,
++			"qcom,cpr-misc-fuse-voltage-adjustment",
++			NULL)) {
++			misc_adj_volt = kcalloc(vreg->corner_count,
++					sizeof(*misc_adj_volt), GFP_KERNEL);
++			if (!misc_adj_volt) {
++				rc = -ENOMEM;
++				goto _exit;
++			}
++
++			rc = cpr4_apss_parse_misc_fuse_voltage_adjustments(vreg,
++				misc_adj_volt);
++			if (rc) {
++				cpr3_err(vreg, "qcom,cpr-misc-fuse-voltage-adjustment reading failed, rc=%d\n",
++					rc);
++				kfree(misc_adj_volt);
++				goto _exit;
++			}
++
++			for (i = 0; i < vreg->corner_count; i++)
++				vreg->corner[i].open_loop_volt
++						+= misc_adj_volt[i];
++			kfree(misc_adj_volt);
++		}
++	}
++
++_exit:
++	kfree(fuse_volt);
++	kfree(fmax_corner);
++	return rc;
++}
++
++/**
++ * cpr4_ipq807x_apss_set_no_interpolation_quotients() - use the fused target
++ *		quotient values for lower frequencies.
++ * @vreg:		Pointer to the CPR3 regulator
++ * @volt_adjust:	Pointer to array of per-corner closed-loop adjustment
++ *			voltages
++ * @volt_adjust_fuse:	Pointer to array of per-fuse-corner closed-loop
++ *			adjustment voltages
++ * @ro_scale:		Pointer to array of per-fuse-corner RO scaling factor
++ *			values with units of QUOT/V
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_ipq807x_apss_set_no_interpolation_quotients(
++			struct cpr3_regulator *vreg, int *volt_adjust,
++			int *volt_adjust_fuse, int *ro_scale)
++{
++	struct cpr4_ipq807x_apss_fuses *fuse = vreg->platform_fuses;
++	u32 quot, ro;
++	int quot_adjust;
++	int i, fuse_corner;
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		fuse_corner = vreg->corner[i].cpr_fuse_corner;
++		quot = fuse->target_quot[fuse_corner];
++		quot_adjust = cpr3_quot_adjustment(ro_scale[fuse_corner],
++					   volt_adjust_fuse[fuse_corner] +
++					   volt_adjust[i]);
++		ro = fuse->ro_sel[fuse_corner];
++		vreg->corner[i].target_quot[ro] = quot + quot_adjust;
++		cpr3_debug(vreg, "corner=%d RO=%u target quot=%u\n",
++			  i, ro, quot);
++
++		if (quot_adjust)
++			cpr3_debug(vreg, "adjusted corner %d RO%u target quot: %u --> %u (%d uV)\n",
++				  i, ro, quot, vreg->corner[i].target_quot[ro],
++				  volt_adjust_fuse[fuse_corner] +
++				  volt_adjust[i]);
++	}
++
++	return 0;
++}
++
++/**
++ * cpr4_ipq807x_apss_calculate_target_quotients() - calculate the CPR target
++ *		quotient for each corner of a CPR3 regulator
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * If target quotient interpolation is allowed in device tree, then this
++ * function calculates the target quotient for a given corner using linear
++ * interpolation.  This interpolation is performed using the processor
++ * frequencies of the lower and higher Fmax corners along with the fused
++ * target quotient and quotient offset of the higher Fmax corner.
++ *
++ * If target quotient interpolation is not allowed, then this function uses
++ * the Fmax fused target quotient for all of the corners associated with a
++ * given fuse corner.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_ipq807x_apss_calculate_target_quotients(
++			struct cpr3_regulator *vreg)
++{
++	struct cpr4_ipq807x_apss_fuses *fuse = vreg->platform_fuses;
++	int rc;
++	bool allow_interpolation;
++	u64 freq_low, freq_high, prev_quot;
++	u64 *quot_low;
++	u64 *quot_high;
++	u32 quot, ro;
++	int i, j, fuse_corner, quot_adjust;
++	int *fmax_corner;
++	int *volt_adjust, *volt_adjust_fuse, *ro_scale;
++	int *voltage_adj_misc;
++
++	/* Log fused quotient values for debugging purposes. */
++	for (i = CPR4_IPQ807x_APSS_FUSE_CORNER_SVS;
++		i < vreg->fuse_corner_count; i++)
++		cpr3_info(vreg, "fused %8s: quot[%2llu]=%4llu, quot_offset[%2llu]=%4llu\n",
++			cpr4_ipq807x_apss_fuse_corner_name[i],
++			fuse->ro_sel[i], fuse->target_quot[i],
++			fuse->ro_sel[i], fuse->quot_offset[i] *
++			IPQ807x_APSS_QUOT_OFFSET_SCALE);
++
++	allow_interpolation = of_property_read_bool(vreg->of_node,
++					"qcom,allow-quotient-interpolation");
++
++	volt_adjust = kcalloc(vreg->corner_count, sizeof(*volt_adjust),
++					GFP_KERNEL);
++	volt_adjust_fuse = kcalloc(vreg->fuse_corner_count,
++					sizeof(*volt_adjust_fuse), GFP_KERNEL);
++	ro_scale = kcalloc(vreg->fuse_corner_count, sizeof(*ro_scale),
++					GFP_KERNEL);
++	fmax_corner = kcalloc(vreg->fuse_corner_count, sizeof(*fmax_corner),
++					GFP_KERNEL);
++	quot_low = kcalloc(vreg->fuse_corner_count, sizeof(*quot_low),
++					GFP_KERNEL);
++	quot_high = kcalloc(vreg->fuse_corner_count, sizeof(*quot_high),
++					GFP_KERNEL);
++	if (!volt_adjust || !volt_adjust_fuse || !ro_scale ||
++	    !fmax_corner || !quot_low || !quot_high) {
++		rc = -ENOMEM;
++		goto done;
++	}
++
++	rc = cpr3_parse_closed_loop_voltage_adjustments(vreg, &fuse->ro_sel[0],
++				volt_adjust, volt_adjust_fuse, ro_scale);
++	if (rc) {
++		cpr3_err(vreg, "could not load closed-loop voltage adjustments, rc=%d\n",
++			rc);
++		goto done;
++	}
++
++	if (of_find_property(vreg->of_node,
++		"qcom,cpr-misc-fuse-voltage-adjustment", NULL)) {
++		voltage_adj_misc = kcalloc(vreg->corner_count,
++				sizeof(*voltage_adj_misc), GFP_KERNEL);
++		if (!voltage_adj_misc) {
++			rc = -ENOMEM;
++			goto done;
++		}
++
++		rc = cpr4_apss_parse_misc_fuse_voltage_adjustments(vreg,
++			voltage_adj_misc);
++		if (rc) {
++			cpr3_err(vreg, "qcom,cpr-misc-fuse-voltage-adjustment reading failed, rc=%d\n",
++				rc);
++			kfree(voltage_adj_misc);
++			goto done;
++		}
++
++		for (i = 0; i < vreg->corner_count; i++)
++			volt_adjust[i] += voltage_adj_misc[i];
++
++		kfree(voltage_adj_misc);
++	}
++
++	if (!allow_interpolation) {
++		/* Use fused target quotients for lower frequencies. */
++		return cpr4_ipq807x_apss_set_no_interpolation_quotients(
++				vreg, volt_adjust, volt_adjust_fuse, ro_scale);
++	}
++
++	/* Determine highest corner mapped to each fuse corner */
++	j = vreg->fuse_corner_count - 1;
++	for (i = vreg->corner_count - 1; i >= 0; i--) {
++		if (vreg->corner[i].cpr_fuse_corner == j) {
++			fmax_corner[j] = i;
++			j--;
++		}
++	}
++	if (j >= 0) {
++		cpr3_err(vreg, "invalid fuse corner mapping\n");
++		rc = -EINVAL;
++		goto done;
++	}
++
++	/*
++	 * Interpolation is not possible for corners mapped to the lowest fuse
++	 * corner so use the fuse corner value directly.
++	 */
++	i = CPR4_IPQ807x_APSS_FUSE_CORNER_SVS;
++	quot_adjust = cpr3_quot_adjustment(ro_scale[i], volt_adjust_fuse[i]);
++	quot = fuse->target_quot[i] + quot_adjust;
++	quot_high[i] = quot_low[i] = quot;
++	ro = fuse->ro_sel[i];
++	if (quot_adjust)
++		cpr3_debug(vreg, "adjusted fuse corner %d RO%u target quot: %llu --> %u (%d uV)\n",
++			i, ro, fuse->target_quot[i], quot, volt_adjust_fuse[i]);
++
++	for (i = 0; i <= fmax_corner[CPR4_IPQ807x_APSS_FUSE_CORNER_SVS];
++		i++)
++		vreg->corner[i].target_quot[ro] = quot;
++
++	for (i = CPR4_IPQ807x_APSS_FUSE_CORNER_NOM;
++	     i < vreg->fuse_corner_count; i++) {
++		quot_high[i] = fuse->target_quot[i];
++		if (fuse->ro_sel[i] == fuse->ro_sel[i - 1])
++			quot_low[i] = quot_high[i - 1];
++		else
++			quot_low[i] = quot_high[i]
++					- fuse->quot_offset[i]
++					  * IPQ807x_APSS_QUOT_OFFSET_SCALE;
++		if (quot_high[i] < quot_low[i]) {
++			cpr3_debug(vreg, "quot_high[%d]=%llu < quot_low[%d]=%llu; overriding: quot_high[%d]=%llu\n",
++				i, quot_high[i], i, quot_low[i],
++				i, quot_low[i]);
++			quot_high[i] = quot_low[i];
++		}
++	}
++
++	/* Perform per-fuse-corner target quotient adjustment */
++	for (i = 1; i < vreg->fuse_corner_count; i++) {
++		quot_adjust = cpr3_quot_adjustment(ro_scale[i],
++						   volt_adjust_fuse[i]);
++		if (quot_adjust) {
++			prev_quot = quot_high[i];
++			quot_high[i] += quot_adjust;
++			cpr3_debug(vreg, "adjusted fuse corner %d RO%llu target quot: %llu --> %llu (%d uV)\n",
++				i, fuse->ro_sel[i], prev_quot, quot_high[i],
++				volt_adjust_fuse[i]);
++		}
++
++		if (fuse->ro_sel[i] == fuse->ro_sel[i - 1])
++			quot_low[i] = quot_high[i - 1];
++		else
++			quot_low[i] += cpr3_quot_adjustment(ro_scale[i],
++						    volt_adjust_fuse[i - 1]);
++
++		if (quot_high[i] < quot_low[i]) {
++			cpr3_debug(vreg, "quot_high[%d]=%llu < quot_low[%d]=%llu after adjustment; overriding: quot_high[%d]=%llu\n",
++				i, quot_high[i], i, quot_low[i],
++				i, quot_low[i]);
++			quot_high[i] = quot_low[i];
++		}
++	}
++
++	/* Interpolate voltages for the higher fuse corners. */
++	for (i = 1; i < vreg->fuse_corner_count; i++) {
++		freq_low = vreg->corner[fmax_corner[i - 1]].proc_freq;
++		freq_high = vreg->corner[fmax_corner[i]].proc_freq;
++
++		ro = fuse->ro_sel[i];
++		for (j = fmax_corner[i - 1] + 1; j <= fmax_corner[i]; j++)
++			vreg->corner[j].target_quot[ro] = cpr3_interpolate(
++				freq_low, quot_low[i], freq_high, quot_high[i],
++				vreg->corner[j].proc_freq);
++	}
++
++	/* Perform per-corner target quotient adjustment */
++	for (i = 0; i < vreg->corner_count; i++) {
++		fuse_corner = vreg->corner[i].cpr_fuse_corner;
++		ro = fuse->ro_sel[fuse_corner];
++		quot_adjust = cpr3_quot_adjustment(ro_scale[fuse_corner],
++						   volt_adjust[i]);
++		if (quot_adjust) {
++			prev_quot = vreg->corner[i].target_quot[ro];
++			vreg->corner[i].target_quot[ro] += quot_adjust;
++			cpr3_debug(vreg, "adjusted corner %d RO%u target quot: %llu --> %u (%d uV)\n",
++				i, ro, prev_quot,
++				vreg->corner[i].target_quot[ro],
++				volt_adjust[i]);
++		}
++	}
++
++	/* Ensure that target quotients increase monotonically */
++	for (i = 1; i < vreg->corner_count; i++) {
++		ro = fuse->ro_sel[vreg->corner[i].cpr_fuse_corner];
++		if (fuse->ro_sel[vreg->corner[i - 1].cpr_fuse_corner] == ro
++		    && vreg->corner[i].target_quot[ro]
++				< vreg->corner[i - 1].target_quot[ro]) {
++			cpr3_debug(vreg, "adjusted corner %d RO%u target quot=%u < adjusted corner %d RO%u target quot=%u; overriding: corner %d RO%u target quot=%u\n",
++				i, ro, vreg->corner[i].target_quot[ro],
++				i - 1, ro, vreg->corner[i - 1].target_quot[ro],
++				i, ro, vreg->corner[i - 1].target_quot[ro]);
++			vreg->corner[i].target_quot[ro]
++				= vreg->corner[i - 1].target_quot[ro];
++		}
++	}
++
++done:
++	kfree(volt_adjust);
++	kfree(volt_adjust_fuse);
++	kfree(ro_scale);
++	kfree(fmax_corner);
++	kfree(quot_low);
++	kfree(quot_high);
++	return rc;
++}
++
++/**
++ * cpr4_apss_print_settings() - print out APSS CPR configuration settings into
++ *		the kernel log for debugging purposes
++ * @vreg:		Pointer to the CPR3 regulator
++ */
++static void cpr4_apss_print_settings(struct cpr3_regulator *vreg)
++{
++	struct cpr3_corner *corner;
++	int i;
++
++	cpr3_debug(vreg, "Corner: Frequency (Hz), Fuse Corner, Floor (uV), Open-Loop (uV), Ceiling (uV)\n");
++	for (i = 0; i < vreg->corner_count; i++) {
++		corner = &vreg->corner[i];
++		cpr3_debug(vreg, "%3d: %10u, %2d, %7d, %7d, %7d\n",
++			i, corner->proc_freq, corner->cpr_fuse_corner,
++			corner->floor_volt, corner->open_loop_volt,
++			corner->ceiling_volt);
++	}
++
++	if (vreg->thread->ctrl->apm)
++		cpr3_debug(vreg, "APM threshold = %d uV, APM adjust = %d uV\n",
++			vreg->thread->ctrl->apm_threshold_volt,
++			vreg->thread->ctrl->apm_adj_volt);
++}
++
++/**
++ * cpr4_apss_init_thread() - perform steps necessary to initialize the
++ *		configuration data for a CPR3 thread
++ * @thread:		Pointer to the CPR3 thread
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_apss_init_thread(struct cpr3_thread *thread)
++{
++	int rc;
++
++	rc = cpr3_parse_common_thread_data(thread);
++	if (rc) {
++		cpr3_err(thread->ctrl, "thread %u unable to read CPR thread data from device tree, rc=%d\n",
++			thread->thread_id, rc);
++		return rc;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr4_apss_parse_temp_adj_properties() - parse temperature based
++ *		adjustment properties from device tree.
++ * @ctrl:	Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_apss_parse_temp_adj_properties(struct cpr3_controller *ctrl)
++{
++	struct device_node *of_node = ctrl->dev->of_node;
++	int rc, i, len, temp_point_count;
++
++	if (!of_find_property(of_node, "qcom,cpr-temp-point-map", &len)) {
++		/*
++		 * Temperature based adjustments are not defined. Single
++		 * temperature band is still valid for per-online-core
++		 * adjustments.
++		 */
++		ctrl->temp_band_count = 1;
++		return 0;
++	}
++
++	temp_point_count = len / sizeof(u32);
++	if (temp_point_count <= 0 ||
++	    temp_point_count > IPQ807x_APSS_MAX_TEMP_POINTS) {
++		cpr3_err(ctrl, "invalid number of temperature points %d > %d (max)\n",
++			 temp_point_count, IPQ807x_APSS_MAX_TEMP_POINTS);
++		return -EINVAL;
++	}
++
++	ctrl->temp_points = devm_kcalloc(ctrl->dev, temp_point_count,
++					sizeof(*ctrl->temp_points), GFP_KERNEL);
++	if (!ctrl->temp_points)
++		return -ENOMEM;
++
++	rc = of_property_read_u32_array(of_node, "qcom,cpr-temp-point-map",
++					ctrl->temp_points, temp_point_count);
++	if (rc) {
++		cpr3_err(ctrl, "error reading property qcom,cpr-temp-point-map, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	for (i = 0; i < temp_point_count; i++)
++		cpr3_debug(ctrl, "Temperature Point %d=%d\n", i,
++				   ctrl->temp_points[i]);
++
++	/*
++	 * If t1, t2, and t3 are the temperature points, then the temperature
++	 * bands are: (-inf, t1], (t1, t2], (t2, t3], and (t3, inf).
++	 */
++	ctrl->temp_band_count = temp_point_count + 1;
++	cpr3_debug(ctrl, "Number of temp bands =%d\n", ctrl->temp_band_count);
++
++	rc = of_property_read_u32(of_node, "qcom,cpr-initial-temp-band",
++				  &ctrl->initial_temp_band);
++	if (rc) {
++		cpr3_err(ctrl, "error reading qcom,cpr-initial-temp-band, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	if (ctrl->initial_temp_band >= ctrl->temp_band_count) {
++		cpr3_err(ctrl, "Initial temperature band value %d should be in range [0 - %d]\n",
++			ctrl->initial_temp_band, ctrl->temp_band_count - 1);
++		return -EINVAL;
++	}
++
++	ctrl->temp_sensor_id_start = IPQ807x_APSS_TEMP_SENSOR_ID_START;
++	ctrl->temp_sensor_id_end = IPQ807x_APSS_TEMP_SENSOR_ID_END;
++	ctrl->allow_temp_adj = true;
++	return rc;
++}
++
++/**
++ * cpr4_apss_parse_boost_properties() - parse configuration data for boost
++ *		voltage adjustment for CPR3 regulator from device tree.
++ * @vreg:	Pointer to the CPR3 regulator
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_apss_parse_boost_properties(struct cpr3_regulator *vreg)
++{
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	struct cpr4_ipq807x_apss_fuses *fuse = vreg->platform_fuses;
++	struct cpr3_corner *corner;
++	int i, boost_voltage, final_boost_volt, rc = 0;
++	int *boost_table = NULL, *boost_temp_adj = NULL;
++	int boost_voltage_adjust = 0, boost_num_cores = 0;
++	u32 boost_allowed = 0;
++
++	if (!boost_fuse[fuse->boost_cfg])
++		/* Voltage boost is disabled in fuse */
++		return 0;
++
++	if (of_find_property(vreg->of_node, "qcom,allow-boost", NULL)) {
++		rc = cpr3_parse_array_property(vreg, "qcom,allow-boost", 1,
++				&boost_allowed);
++		if (rc)
++			return rc;
++	}
++
++	if (!boost_allowed) {
++		/* Voltage boost is not enabled for this regulator */
++		return 0;
++	}
++
++	boost_voltage = cpr3_convert_open_loop_voltage_fuse(
++				vreg->cpr4_regulator_data->boost_fuse_ref_volt,
++				vreg->cpr4_regulator_data->fuse_step_volt,
++				fuse->boost_voltage,
++				IPQ807x_APSS_VOLTAGE_FUSE_SIZE);
++
++	/* Log boost voltage value for debugging purposes. */
++	cpr3_info(vreg, "Boost open-loop=%7d uV\n", boost_voltage);
++
++	if (of_find_property(vreg->of_node,
++			"qcom,cpr-boost-voltage-fuse-adjustment", NULL)) {
++		rc = cpr3_parse_array_property(vreg,
++			"qcom,cpr-boost-voltage-fuse-adjustment",
++			1, &boost_voltage_adjust);
++		if (rc) {
++			cpr3_err(vreg, "qcom,cpr-boost-voltage-fuse-adjustment reading failed, rc=%d\n",
++				rc);
++			return rc;
++		}
++
++		boost_voltage += boost_voltage_adjust;
++		/* Log boost voltage value for debugging purposes. */
++		cpr3_info(vreg, "Adjusted boost open-loop=%7d uV\n",
++			boost_voltage);
++	}
++
++	/* Limit boost voltage value between ceiling and floor voltage limits */
++	boost_voltage = min(boost_voltage, vreg->cpr4_regulator_data->boost_ceiling_volt);
++	boost_voltage = max(boost_voltage, vreg->cpr4_regulator_data->boost_floor_volt);
++
++	/*
++	 * The boost feature can only be used for the highest voltage corner.
++	 * Also, keep core-count adjustments disabled when the boost feature
++	 * is enabled.
++	 */
++	corner = &vreg->corner[vreg->corner_count - 1];
++	if (!corner->sdelta) {
++		/*
++		 * If core-count/temp adjustments are not defined, the cpr4
++		 * sdelta for this corner will not be allocated. Allocate it
++		 * here for boost configuration.
++		 */
++		corner->sdelta = devm_kzalloc(ctrl->dev,
++					sizeof(*corner->sdelta), GFP_KERNEL);
++		if (!corner->sdelta)
++			return -ENOMEM;
++	}
++	corner->sdelta->temp_band_count = ctrl->temp_band_count;
++
++	rc = of_property_read_u32(vreg->of_node, "qcom,cpr-num-boost-cores",
++				&boost_num_cores);
++	if (rc) {
++		cpr3_err(vreg, "qcom,cpr-num-boost-cores reading failed, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	if (boost_num_cores <= 0 ||
++	    boost_num_cores > IPQ807x_APSS_CPR_SDELTA_CORE_COUNT) {
++		cpr3_err(vreg, "Invalid boost number of cores = %d\n",
++			boost_num_cores);
++		return -EINVAL;
++	}
++	corner->sdelta->boost_num_cores = boost_num_cores;
++
++	boost_table = devm_kcalloc(ctrl->dev, corner->sdelta->temp_band_count,
++					sizeof(*boost_table), GFP_KERNEL);
++	if (!boost_table)
++		return -ENOMEM;
++
++	if (of_find_property(vreg->of_node,
++				"qcom,cpr-boost-temp-adjustment", NULL)) {
++		boost_temp_adj = kcalloc(corner->sdelta->temp_band_count,
++					sizeof(*boost_temp_adj), GFP_KERNEL);
++		if (!boost_temp_adj)
++			return -ENOMEM;
++
++		rc = cpr3_parse_array_property(vreg,
++				"qcom,cpr-boost-temp-adjustment",
++				corner->sdelta->temp_band_count,
++				boost_temp_adj);
++		if (rc) {
++			cpr3_err(vreg, "qcom,cpr-boost-temp-adjustment reading failed, rc=%d\n",
++				rc);
++			goto done;
++		}
++	}
++
++	for (i = 0; i < corner->sdelta->temp_band_count; i++) {
++		/* Apply static adjustments to boost voltage */
++		final_boost_volt = boost_voltage + (boost_temp_adj == NULL
++						? 0 : boost_temp_adj[i]);
++		/*
++		 * Limit final adjusted boost voltage value between ceiling
++		 * and floor voltage limits
++		 */
++		final_boost_volt = min(final_boost_volt,
++					vreg->cpr4_regulator_data->boost_ceiling_volt);
++		final_boost_volt = max(final_boost_volt,
++					vreg->cpr4_regulator_data->boost_floor_volt);
++
++		boost_table[i] = (corner->open_loop_volt - final_boost_volt)
++					/ ctrl->step_volt;
++		cpr3_debug(vreg, "Adjusted boost voltage margin for temp band %d = %d steps\n",
++			i, boost_table[i]);
++	}
++
++	corner->ceiling_volt = vreg->cpr4_regulator_data->boost_ceiling_volt;
++	corner->sdelta->boost_table = boost_table;
++	corner->sdelta->allow_boost = true;
++	corner->sdelta->allow_core_count_adj = false;
++	vreg->allow_boost = true;
++	ctrl->allow_boost = true;
++done:
++	kfree(boost_temp_adj);
++	return rc;
++}
++
++/**
++ * cpr4_apss_init_regulator() - perform all steps necessary to initialize the
++ *		configuration data for a CPR3 regulator
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_apss_init_regulator(struct cpr3_regulator *vreg)
++{
++	struct cpr4_ipq807x_apss_fuses *fuse;
++	int rc;
++
++	rc = cpr4_ipq807x_apss_read_fuse_data(vreg);
++	if (rc) {
++		cpr3_err(vreg, "unable to read CPR fuse data, rc=%d\n", rc);
++		return rc;
++	}
++
++	fuse = vreg->platform_fuses;
++
++	rc = cpr4_apss_parse_corner_data(vreg);
++	if (rc) {
++		cpr3_err(vreg, "unable to read CPR corner data from device tree, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	rc = cpr3_mem_acc_init(vreg);
++	if (rc) {
++		if (rc != -EPROBE_DEFER)
++			cpr3_err(vreg, "unable to initialize mem-acc regulator settings, rc=%d\n",
++				 rc);
++		return rc;
++	}
++
++	rc = cpr4_ipq807x_apss_calculate_open_loop_voltages(vreg);
++	if (rc) {
++		cpr3_err(vreg, "unable to calculate open-loop voltages, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	rc = cpr3_limit_open_loop_voltages(vreg);
++	if (rc) {
++		cpr3_err(vreg, "unable to limit open-loop voltages, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	cpr3_open_loop_voltage_as_ceiling(vreg);
++
++	rc = cpr3_limit_floor_voltages(vreg);
++	if (rc) {
++		cpr3_err(vreg, "unable to limit floor voltages, rc=%d\n", rc);
++		return rc;
++	}
++
++	rc = cpr4_ipq807x_apss_calculate_target_quotients(vreg);
++	if (rc) {
++		cpr3_err(vreg, "unable to calculate target quotients, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	rc = cpr4_parse_core_count_temp_voltage_adj(vreg, false);
++	if (rc) {
++		cpr3_err(vreg, "unable to parse temperature and core count voltage adjustments, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	if (vreg->allow_core_count_adj && (vreg->max_core_count <= 0
++				   || vreg->max_core_count >
++				   IPQ807x_APSS_CPR_SDELTA_CORE_COUNT)) {
++		cpr3_err(vreg, "qcom,max-core-count has invalid value = %d\n",
++			 vreg->max_core_count);
++		return -EINVAL;
++	}
++
++	rc = cpr4_apss_parse_boost_properties(vreg);
++	if (rc) {
++		cpr3_err(vreg, "unable to parse boost adjustments, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	cpr4_apss_print_settings(vreg);
++
++	return rc;
++}
++
++/**
++ * cpr4_apss_init_controller() - perform APSS CPR4 controller specific
++ *		initializations
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_apss_init_controller(struct cpr3_controller *ctrl)
++{
++	int rc;
++
++	rc = cpr3_parse_common_ctrl_data(ctrl);
++	if (rc) {
++		if (rc != -EPROBE_DEFER)
++			cpr3_err(ctrl, "unable to parse common controller data, rc=%d\n",
++				rc);
++		return rc;
++	}
++
++	rc = of_property_read_u32(ctrl->dev->of_node,
++				  "qcom,cpr-down-error-step-limit",
++				  &ctrl->down_error_step_limit);
++	if (rc) {
++		cpr3_err(ctrl, "error reading qcom,cpr-down-error-step-limit, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	rc = of_property_read_u32(ctrl->dev->of_node,
++				  "qcom,cpr-up-error-step-limit",
++				  &ctrl->up_error_step_limit);
++	if (rc) {
++		cpr3_err(ctrl, "error reading qcom,cpr-up-error-step-limit, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	/*
++	 * Use fixed step quotient if specified otherwise use dynamic
++	 * calculated per RO step quotient
++	 */
++	of_property_read_u32(ctrl->dev->of_node, "qcom,cpr-step-quot-fixed",
++			&ctrl->step_quot_fixed);
++	ctrl->use_dynamic_step_quot = ctrl->step_quot_fixed ? false : true;
++
++	ctrl->saw_use_unit_mV = of_property_read_bool(ctrl->dev->of_node,
++					"qcom,cpr-saw-use-unit-mV");
++
++	of_property_read_u32(ctrl->dev->of_node,
++			"qcom,cpr-voltage-settling-time",
++			&ctrl->voltage_settling_time);
++
++	if (of_find_property(ctrl->dev->of_node, "vdd-limit-supply", NULL)) {
++		ctrl->vdd_limit_regulator =
++			devm_regulator_get(ctrl->dev, "vdd-limit");
++		if (IS_ERR(ctrl->vdd_limit_regulator)) {
++			rc = PTR_ERR(ctrl->vdd_limit_regulator);
++			if (rc != -EPROBE_DEFER)
++				cpr3_err(ctrl, "unable to request vdd-limit regulator, rc=%d\n",
++					 rc);
++			return rc;
++		}
++	}
++
++	rc = cpr3_apm_init(ctrl);
++	if (rc) {
++		if (rc != -EPROBE_DEFER)
++			cpr3_err(ctrl, "unable to initialize APM settings, rc=%d\n",
++				rc);
++		return rc;
++	}
++
++	rc = cpr4_apss_parse_temp_adj_properties(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "unable to parse temperature adjustment properties, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	ctrl->sensor_count = IPQ807x_APSS_CPR_SENSOR_COUNT;
++
++	/*
++	 * APSS only has one thread (0) per controller so the zeroed
++	 * array does not need further modification.
++	 */
++	ctrl->sensor_owner = devm_kcalloc(ctrl->dev, ctrl->sensor_count,
++		sizeof(*ctrl->sensor_owner), GFP_KERNEL);
++	if (!ctrl->sensor_owner)
++		return -ENOMEM;
++
++	ctrl->ctrl_type = CPR_CTRL_TYPE_CPR4;
++	ctrl->supports_hw_closed_loop = false;
++	ctrl->use_hw_closed_loop = of_property_read_bool(ctrl->dev->of_node,
++						"qcom,cpr-hw-closed-loop");
++	return 0;
++}
++
++static int cpr4_apss_regulator_suspend(struct platform_device *pdev,
++				pm_message_t state)
++{
++	struct cpr3_controller *ctrl = platform_get_drvdata(pdev);
++
++	return cpr3_regulator_suspend(ctrl);
++}
++
++static int cpr4_apss_regulator_resume(struct platform_device *pdev)
++{
++	struct cpr3_controller *ctrl = platform_get_drvdata(pdev);
++
++	return cpr3_regulator_resume(ctrl);
++}
++
++static void ipq6018_set_mem_acc(struct regulator_dev *rdev)
++{
++	struct cpr3_regulator *vreg = rdev_get_drvdata(rdev);
++
++	ipq6018_mem_acc_tcsr[0].ioremap_addr =
++		ioremap(ipq6018_mem_acc_tcsr[0].phy_addr, 0x4);
++	ipq6018_mem_acc_tcsr[1].ioremap_addr =
++		ioremap(ipq6018_mem_acc_tcsr[1].phy_addr, 0x4);
++
++	if ((ipq6018_mem_acc_tcsr[0].ioremap_addr != NULL) &&
++			(ipq6018_mem_acc_tcsr[1].ioremap_addr != NULL) &&
++			(vreg->current_corner == (vreg->corner_count - CPR3_CORNER_OFFSET))) {
++
++		writel_relaxed(ipq6018_mem_acc_tcsr[0].value,
++				ipq6018_mem_acc_tcsr[0].ioremap_addr);
++		writel_relaxed(ipq6018_mem_acc_tcsr[1].value,
++				ipq6018_mem_acc_tcsr[1].ioremap_addr);
++	}
++}
++
++static void ipq6018_clr_mem_acc(struct regulator_dev *rdev)
++{
++	struct cpr3_regulator *vreg = rdev_get_drvdata(rdev);
++
++	if ((ipq6018_mem_acc_tcsr[0].ioremap_addr != NULL) &&
++			(ipq6018_mem_acc_tcsr[1].ioremap_addr != NULL) &&
++			(vreg->current_corner != vreg->corner_count - CPR3_CORNER_OFFSET)) {
++		writel_relaxed(0x0, ipq6018_mem_acc_tcsr[0].ioremap_addr);
++		writel_relaxed(0x0, ipq6018_mem_acc_tcsr[1].ioremap_addr);
++	}
++
++	iounmap(ipq6018_mem_acc_tcsr[0].ioremap_addr);
++	iounmap(ipq6018_mem_acc_tcsr[1].ioremap_addr);
++}
++
++static struct cpr4_mem_acc_func ipq6018_mem_acc_funcs = {
++	.set_mem_acc = ipq6018_set_mem_acc,
++	.clear_mem_acc = ipq6018_clr_mem_acc
++};
++
++static const struct cpr4_reg_data ipq807x_cpr_apss = {
++	.cpr_valid_fuse_count = IPQ807x_APSS_FUSE_CORNERS,
++	.fuse_ref_volt = ipq807x_apss_fuse_ref_volt,
++	.fuse_step_volt = IPQ807x_APSS_FUSE_STEP_VOLT,
++	.cpr_clk_rate = IPQ807x_APSS_CPR_CLOCK_RATE,
++	.boost_fuse_ref_volt= IPQ807x_APSS_BOOST_FUSE_REF_VOLT,
++	.boost_ceiling_volt= IPQ807x_APSS_BOOST_CEILING_VOLT,
++	.boost_floor_volt= IPQ807x_APSS_BOOST_FLOOR_VOLT,
++	.cpr3_fuse_params = &ipq807x_fuse_params,
++	.mem_acc_funcs = NULL,
++};
++
++static const struct cpr4_reg_data ipq817x_cpr_apss = {
++	.cpr_valid_fuse_count = IPQ817x_APPS_FUSE_CORNERS,
++	.fuse_ref_volt = ipq807x_apss_fuse_ref_volt,
++	.fuse_step_volt = IPQ807x_APSS_FUSE_STEP_VOLT,
++	.cpr_clk_rate = IPQ807x_APSS_CPR_CLOCK_RATE,
++	.boost_fuse_ref_volt= IPQ807x_APSS_BOOST_FUSE_REF_VOLT,
++	.boost_ceiling_volt= IPQ807x_APSS_BOOST_CEILING_VOLT,
++	.boost_floor_volt= IPQ807x_APSS_BOOST_FLOOR_VOLT,
++	.cpr3_fuse_params = &ipq807x_fuse_params,
++	.mem_acc_funcs = NULL,
++};
++
++static const struct cpr4_reg_data ipq6018_cpr_apss = {
++	.cpr_valid_fuse_count = IPQ6018_APSS_FUSE_CORNERS,
++	.fuse_ref_volt = ipq6018_apss_fuse_ref_volt,
++	.fuse_step_volt = IPQ6018_APSS_FUSE_STEP_VOLT,
++	.cpr_clk_rate = IPQ6018_APSS_CPR_CLOCK_RATE,
++	.boost_fuse_ref_volt = IPQ6018_APSS_BOOST_FUSE_REF_VOLT,
++	.boost_ceiling_volt = IPQ6018_APSS_BOOST_CEILING_VOLT,
++	.boost_floor_volt = IPQ6018_APSS_BOOST_FLOOR_VOLT,
++	.cpr3_fuse_params = &ipq6018_fuse_params,
++	.mem_acc_funcs = &ipq6018_mem_acc_funcs,
++};
++
++static const struct cpr4_reg_data ipq9574_cpr_apss = {
++	.cpr_valid_fuse_count = IPQ9574_APSS_FUSE_CORNERS,
++	.fuse_ref_volt = ipq9574_apss_fuse_ref_volt,
++	.fuse_step_volt = IPQ9574_APSS_FUSE_STEP_VOLT,
++	.cpr_clk_rate = IPQ6018_APSS_CPR_CLOCK_RATE,
++	.boost_fuse_ref_volt = IPQ6018_APSS_BOOST_FUSE_REF_VOLT,
++	.boost_ceiling_volt = IPQ6018_APSS_BOOST_CEILING_VOLT,
++	.boost_floor_volt = IPQ6018_APSS_BOOST_FLOOR_VOLT,
++	.cpr3_fuse_params = &ipq9574_fuse_params,
++	.mem_acc_funcs = NULL,
++};
++
++static struct of_device_id cpr4_regulator_match_table[] = {
++	{
++		.compatible = "qcom,cpr4-ipq807x-apss-regulator",
++		.data = &ipq807x_cpr_apss
++	},
++	{
++		.compatible = "qcom,cpr4-ipq817x-apss-regulator",
++		.data = &ipq817x_cpr_apss
++	},
++	{
++		.compatible = "qcom,cpr4-ipq6018-apss-regulator",
++		.data = &ipq6018_cpr_apss
++	},
++	{
++		.compatible = "qcom,cpr4-ipq9574-apss-regulator",
++		.data = &ipq9574_cpr_apss
++	},
++	{}
++};
++
++static int cpr4_apss_regulator_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct cpr3_controller *ctrl;
++	const struct of_device_id *match;
++	struct cpr4_reg_data *cpr_data;
++	int i, rc;
++
++	if (!dev->of_node) {
++		dev_err(dev, "Device tree node is missing\n");
++		return -EINVAL;
++	}
++
++	ctrl = devm_kzalloc(dev, sizeof(*ctrl), GFP_KERNEL);
++	if (!ctrl)
++		return -ENOMEM;
++
++	match = of_match_device(cpr4_regulator_match_table, &pdev->dev);
++	if (!match)
++		return -ENODEV;
++
++	cpr_data = (struct cpr4_reg_data *)match->data;
++	g_valid_fuse_count = cpr_data->cpr_valid_fuse_count;
++	dev_info(dev, "CPR valid fuse count: %d\n", g_valid_fuse_count);
++	ctrl->cpr_clock_rate = cpr_data->cpr_clk_rate;
++
++	ctrl->dev = dev;
++	/* Set to false later if anything precludes CPR operation. */
++	ctrl->cpr_allowed_hw = true;
++
++	rc = of_property_read_string(dev->of_node, "qcom,cpr-ctrl-name",
++					&ctrl->name);
++	if (rc) {
++		cpr3_err(ctrl, "unable to read qcom,cpr-ctrl-name, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	rc = cpr3_map_fuse_base(ctrl, pdev);
++	if (rc) {
++		cpr3_err(ctrl, "could not map fuse base address\n");
++		return rc;
++	}
++
++	rc = cpr3_read_tcsr_setting(ctrl, pdev, IPQ807x_APSS_CPR_TCSR_START,
++				    IPQ807x_APSS_CPR_TCSR_END);
++	if (rc) {
++		cpr3_err(ctrl, "could not read CPR tcsr setting\n");
++		return rc;
++	}
++
++	rc = cpr3_allocate_threads(ctrl, 0, 0);
++	if (rc) {
++		cpr3_err(ctrl, "failed to allocate CPR thread array, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	if (ctrl->thread_count != 1) {
++		cpr3_err(ctrl, "expected 1 thread but found %d\n",
++			ctrl->thread_count);
++		return -EINVAL;
++	}
++
++	rc = cpr4_apss_init_controller(ctrl);
++	if (rc) {
++		if (rc != -EPROBE_DEFER)
++			cpr3_err(ctrl, "failed to initialize CPR controller parameters, rc=%d\n",
++				rc);
++		return rc;
++	}
++
++	rc = cpr4_apss_init_thread(&ctrl->thread[0]);
++	if (rc) {
++		cpr3_err(ctrl, "thread initialization failed, rc=%d\n", rc);
++		return rc;
++	}
++
++	for (i = 0; i < ctrl->thread[0].vreg_count; i++) {
++		ctrl->thread[0].vreg[i].cpr4_regulator_data = cpr_data;
++		rc = cpr4_apss_init_regulator(&ctrl->thread[0].vreg[i]);
++		if (rc) {
++			cpr3_err(&ctrl->thread[0].vreg[i], "regulator initialization failed, rc=%d\n",
++				 rc);
++			return rc;
++		}
++	}
++
++	platform_set_drvdata(pdev, ctrl);
++
++	return cpr3_regulator_register(pdev, ctrl);
++}
++
++static int cpr4_apss_regulator_remove(struct platform_device *pdev)
++{
++	struct cpr3_controller *ctrl = platform_get_drvdata(pdev);
++
++	return cpr3_regulator_unregister(ctrl);
++}
++
++static struct platform_driver cpr4_apss_regulator_driver = {
++	.driver		= {
++		.name		= "qcom,cpr4-apss-regulator",
++		.of_match_table	= cpr4_regulator_match_table,
++		.owner		= THIS_MODULE,
++	},
++	.probe		= cpr4_apss_regulator_probe,
++	.remove		= cpr4_apss_regulator_remove,
++	.suspend	= cpr4_apss_regulator_suspend,
++	.resume		= cpr4_apss_regulator_resume,
++};
++
++static int cpr4_regulator_init(void)
++{
++	return platform_driver_register(&cpr4_apss_regulator_driver);
++}
++
++static void cpr4_regulator_exit(void)
++{
++	platform_driver_unregister(&cpr4_apss_regulator_driver);
++}
++
++MODULE_DESCRIPTION("CPR4 APSS regulator driver");
++MODULE_LICENSE("GPL v2");
++
++arch_initcall(cpr4_regulator_init);
++module_exit(cpr4_regulator_exit);
+--- /dev/null
++++ b/include/soc/qcom/socinfo.h
+@@ -0,0 +1,463 @@
++/* Copyright (c) 2009-2014, 2016, 2020, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#ifndef _ARCH_ARM_MACH_MSM_SOCINFO_H_
++#define _ARCH_ARM_MACH_MSM_SOCINFO_H_
++
++#include <linux/of.h>
++
++#define CPU_IPQ8074 323
++#define CPU_IPQ8072 342
++#define CPU_IPQ8076 343
++#define CPU_IPQ8078 344
++#define CPU_IPQ8070 375
++#define CPU_IPQ8071 376
++
++#define CPU_IPQ8072A 389
++#define CPU_IPQ8074A 390
++#define CPU_IPQ8076A 391
++#define CPU_IPQ8078A 392
++#define CPU_IPQ8070A 395
++#define CPU_IPQ8071A 396
++
++#define CPU_IPQ8172  397
++#define CPU_IPQ8173  398
++#define CPU_IPQ8174  399
++
++#define CPU_IPQ6018 402
++#define CPU_IPQ6028 403
++#define CPU_IPQ6000 421
++#define CPU_IPQ6010 422
++#define CPU_IPQ6005 453
++
++#define CPU_IPQ5010 446
++#define CPU_IPQ5018 447
++#define CPU_IPQ5028 448
++#define CPU_IPQ5000 503
++#define CPU_IPQ0509 504
++#define CPU_IPQ0518 505
++
++#define CPU_IPQ9514 510
++#define CPU_IPQ9554 512
++#define CPU_IPQ9570 513
++#define CPU_IPQ9574 514
++#define CPU_IPQ9550 511
++#define CPU_IPQ9510 521
++
++static inline int read_ipq_soc_version_major(void)
++{
++	const int *prop;
++	prop = of_get_property(of_find_node_by_path("/"), "soc_version_major",
++				NULL);
++
++	if (!prop)
++		return -EINVAL;
++
++	return le32_to_cpu(*prop);
++}
++
++static inline int read_ipq_cpu_type(void)
++{
++	const int *prop;
++	prop = of_get_property(of_find_node_by_path("/"), "cpu_type", NULL);
++	/*
++	 * Return Default CPU type if "cpu_type" property is not found in DTSI
++	 */
++	if (!prop)
++		return CPU_IPQ8074;
++
++	return le32_to_cpu(*prop);
++}
++
++static inline int cpu_is_ipq8070(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ8070;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq8071(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ8071;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq8072(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ8072;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq8074(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ8074;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq8076(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ8076;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq8078(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ8078;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq8072a(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ8072A;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq8074a(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ8074A;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq8076a(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ8076A;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq8078a(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ8078A;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq8070a(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ8070A;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq8071a(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ8071A;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq8172(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ8172;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq8173(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ8173;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq8174(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ8174;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq6018(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ6018;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq6028(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ6028;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq6000(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ6000;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq6010(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ6010;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq6005(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ6005;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq5010(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ5010;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq5018(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ5018;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq5028(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ5028;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq5000(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ5000;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq0509(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ0509;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq0518(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ0518;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq9514(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ9514;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq9554(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ9554;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq9570(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ9570;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq9574(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ9574;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq9550(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ9550;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq9510(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return read_ipq_cpu_type() == CPU_IPQ9510;
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq807x(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return  cpu_is_ipq8072() || cpu_is_ipq8074() ||
++		cpu_is_ipq8076() || cpu_is_ipq8078() ||
++		cpu_is_ipq8070() || cpu_is_ipq8071() ||
++		cpu_is_ipq8072a() || cpu_is_ipq8074a() ||
++		cpu_is_ipq8076a() || cpu_is_ipq8078a() ||
++		cpu_is_ipq8070a() || cpu_is_ipq8071a() ||
++		cpu_is_ipq8172() || cpu_is_ipq8173() ||
++		cpu_is_ipq8174();
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq60xx(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return  cpu_is_ipq6018() || cpu_is_ipq6028() ||
++		cpu_is_ipq6000() || cpu_is_ipq6010() ||
++		cpu_is_ipq6005();
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq50xx(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return  cpu_is_ipq5010() || cpu_is_ipq5018() ||
++		cpu_is_ipq5028() || cpu_is_ipq5000() ||
++		cpu_is_ipq0509() || cpu_is_ipq0518();
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_ipq95xx(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return  cpu_is_ipq9514() || cpu_is_ipq9554() ||
++		cpu_is_ipq9570() || cpu_is_ipq9574() ||
++		cpu_is_ipq9550() || cpu_is_ipq9510();
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_nss_crypto_enabled(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return  cpu_is_ipq807x() || cpu_is_ipq60xx() ||
++		cpu_is_ipq50xx() || cpu_is_ipq9570() ||
++		cpu_is_ipq9550() || cpu_is_ipq9574() ||
++		cpu_is_ipq9554();
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_internal_wifi_enabled(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return  cpu_is_ipq807x() || cpu_is_ipq60xx() ||
++		cpu_is_ipq50xx() || cpu_is_ipq9514() ||
++		cpu_is_ipq9554() || cpu_is_ipq9574();
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_uniphy1_enabled(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return  cpu_is_ipq807x() || cpu_is_ipq60xx() ||
++		cpu_is_ipq9554() || cpu_is_ipq9570() ||
++		cpu_is_ipq9574() || cpu_is_ipq9550();
++#else
++	return 0;
++#endif
++}
++
++static inline int cpu_is_uniphy2_enabled(void)
++{
++#ifdef CONFIG_ARCH_QCOM
++	return  cpu_is_ipq807x() || cpu_is_ipq9570() ||
++		cpu_is_ipq9574();
++#else
++	return 0;
++#endif
++}
++
++#endif /* _ARCH_ARM_MACH_MSM_SOCINFO_H_ */
diff --git a/target/linux/qualcommax/patches-6.1/0902-arm64-dts-ipq8074-add-label-to-clocks.patch b/target/linux/qualcommax/patches-6.1/0902-arm64-dts-ipq8074-add-label-to-clocks.patch
new file mode 100644
index 00000000000000..9b8b4df12b2874
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.1/0902-arm64-dts-ipq8074-add-label-to-clocks.patch
@@ -0,0 +1,24 @@
+From 6baf7e4abcea6f7ac21eccf072a20078b39d064c Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Wed, 9 Feb 2022 23:13:26 +0100
+Subject: [PATCH] arm64: dts: ipq8074: add label to clocks
+
+Add label to clocks node as that makes it easy to add the NSS fixed
+clocks that are required in their DTSI.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -15,7 +15,7 @@
+ 	compatible = "qcom,ipq8074";
+ 	interrupt-parent = <&intc>;
+ 
+-	clocks {
++	clocks: clocks {
+ 		sleep_clk: sleep_clk {
+ 			compatible = "fixed-clock";
+ 			clock-frequency = <32768>;
diff --git a/target/linux/ramips/Makefile b/target/linux/ramips/Makefile
index 7d34dfe6761b15..77b82d5334c220 100644
--- a/target/linux/ramips/Makefile
+++ b/target/linux/ramips/Makefile
@@ -10,8 +10,7 @@ BOARDNAME:=MediaTek Ralink MIPS
 SUBTARGETS:=mt7620 mt7621 mt76x8 rt288x rt305x rt3883
 FEATURES:=squashfs gpio
 
-KERNEL_PATCHVER:=5.10
-KERNEL_TESTING_PATCHVER:=5.15
+KERNEL_PATCHVER:=5.15
 
 define Target/Description
 	Build firmware images for Ralink RT288x/RT3xxx based boards.
diff --git a/target/linux/ramips/dts/mt7620a_ampedwireless_b1200ex.dts b/target/linux/ramips/dts/mt7620a_ampedwireless_b1200ex.dts
new file mode 100644
index 00000000000000..10871140e9d70b
--- /dev/null
+++ b/target/linux/ramips/dts/mt7620a_ampedwireless_b1200ex.dts
@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7620a_edimax_ew-747x.dtsi"
+
+/ {
+	compatible = "ampedwireless,b1200ex", "ralink,mt7620a-soc";
+	model = "Amped Wireless B1200EX";
+
+	leds {
+		wlan2g {
+			label = "green:wlan2g";
+			gpios = <&gpio2 30 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1radio";
+		};
+
+		wlan5g {
+			label = "green:wlan5g";
+			gpios = <&gpio2 31 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0radio";
+		};
+
+		signal_strength {
+			label = "green:signal_strength";
+			gpios = <&gpio2 29 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
diff --git a/target/linux/ramips/dts/mt7620a_edimax_ew-7476rpc.dts b/target/linux/ramips/dts/mt7620a_edimax_ew-7476rpc.dts
index ebab7e40899906..e4fc2d03e45c16 100644
--- a/target/linux/ramips/dts/mt7620a_edimax_ew-7476rpc.dts
+++ b/target/linux/ramips/dts/mt7620a_edimax_ew-7476rpc.dts
@@ -5,4 +5,39 @@
 / {
 	compatible = "edimax,ew-7476rpc", "ralink,mt7620a-soc";
 	model = "Edimax EW-7476RPC";
+
+	keys {
+		switch_high {
+			label = "switch high";
+			gpios = <&gpio2 22 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+			linux,input-type = <EV_SW>;
+		};
+
+		switch_off {
+			label = "switch off";
+			gpios = <&gpio2 23 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_1>;
+			linux,input-type = <EV_SW>;
+		};
+	};
+
+	leds {
+		wlan2g {
+			label = "blue:wlan2g";
+			gpios = <&gpio2 30 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1radio";
+		};
+
+		wlan5g {
+			label = "blue:wlan5g";
+			gpios = <&gpio2 31 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0radio";
+		};
+
+		crossband {
+			label = "green:crossband";
+			gpios = <&gpio2 29 GPIO_ACTIVE_LOW>;
+		};
+	};
 };
diff --git a/target/linux/ramips/dts/mt7620a_edimax_ew-7478ac.dts b/target/linux/ramips/dts/mt7620a_edimax_ew-7478ac.dts
index a0fa2e3da8f0d1..97da9cda4b93e3 100644
--- a/target/linux/ramips/dts/mt7620a_edimax_ew-7478ac.dts
+++ b/target/linux/ramips/dts/mt7620a_edimax_ew-7478ac.dts
@@ -5,4 +5,39 @@
 / {
 	compatible = "edimax,ew-7478ac", "ralink,mt7620a-soc";
 	model = "Edimax EW-7478AC";
+
+	keys {
+		switch_high {
+			label = "switch high";
+			gpios = <&gpio2 22 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+			linux,input-type = <EV_SW>;
+		};
+
+		switch_off {
+			label = "switch off";
+			gpios = <&gpio2 23 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_1>;
+			linux,input-type = <EV_SW>;
+		};
+	};
+
+	leds {
+		wlan2g {
+			label = "blue:wlan2g";
+			gpios = <&gpio2 30 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1radio";
+		};
+
+		wlan5g {
+			label = "blue:wlan5g";
+			gpios = <&gpio2 31 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0radio";
+		};
+
+		crossband {
+			label = "green:crossband";
+			gpios = <&gpio2 29 GPIO_ACTIVE_LOW>;
+		};
+	};
 };
diff --git a/target/linux/ramips/dts/mt7620a_edimax_ew-747x.dtsi b/target/linux/ramips/dts/mt7620a_edimax_ew-747x.dtsi
index 1d77c27f5f3796..abac0208d0722b 100644
--- a/target/linux/ramips/dts/mt7620a_edimax_ew-747x.dtsi
+++ b/target/linux/ramips/dts/mt7620a_edimax_ew-747x.dtsi
@@ -24,20 +24,6 @@
 			gpios = <&gpio2 20 GPIO_ACTIVE_LOW>;
 			linux,code = <KEY_RESTART>;
 		};
-
-		switch_high {
-			label = "switch high";
-			gpios = <&gpio2 22 GPIO_ACTIVE_LOW>;
-			linux,code = <BTN_0>;
-			linux,input-type = <EV_SW>;
-		};
-
-		switch_off {
-			label = "switch off";
-			gpios = <&gpio2 23 GPIO_ACTIVE_LOW>;
-			linux,code = <BTN_1>;
-			linux,input-type = <EV_SW>;
-		};
 	};
 
 	leds {
@@ -53,27 +39,10 @@
 			gpios = <&gpio2 26 GPIO_ACTIVE_LOW>;
 		};
 
-		wlan2g {
-			label = "blue:wlan2g";
-			gpios = <&gpio2 30 GPIO_ACTIVE_LOW>;
-			linux,default-trigger = "phy1radio";
-		};
-
-		wlan5g {
-			label = "blue:wlan5g";
-			gpios = <&gpio2 31 GPIO_ACTIVE_LOW>;
-			linux,default-trigger = "phy0radio";
-		};
-
 		wps {
 			label = "green:wps";
 			gpios = <&gpio2 28 GPIO_ACTIVE_LOW>;
 		};
-
-		crossband {
-			label = "green:crossband";
-			gpios = <&gpio2 29 GPIO_ACTIVE_LOW>;
-		};
 	};
 };
 
@@ -206,6 +175,8 @@
 
 &wmac {
 	ralink,mtd-eeprom = <&factory 0x0>;
+	nvmem-cells = <&macaddr_factory_4>;
+	nvmem-cell-names = "mac-address";
 };
 
 &pcie {
@@ -216,7 +187,10 @@
 	wifi@0,0 {
 		reg = <0x0000 0 0 0 0>;
 		mediatek,mtd-eeprom = <&factory 0x8000>;
-		mediatek,2ghz = <0>;
+		ieee80211-freq-limit = <5000000 6000000>;
+		nvmem-cells = <&macaddr_factory_4>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <2>;
 	};
 };
 
diff --git a/target/linux/ramips/dts/mt7620a_engenius_epg600.dts b/target/linux/ramips/dts/mt7620a_engenius_epg600.dts
new file mode 100644
index 00000000000000..311103f3e86e52
--- /dev/null
+++ b/target/linux/ramips/dts/mt7620a_engenius_epg600.dts
@@ -0,0 +1,228 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7620a.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "engenius,epg600", "ralink,mt7620a-soc";
+	model = "EnGenius EPG600";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio0 1 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+		wps {
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&gpio0 2 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+		reg {
+			linux,code = <BTN_0>;
+			gpios = <&gpio2 7 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: power {
+			label = "amber:power";
+			gpios = <&gpio0 9 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+
+		wlan2g {
+			label = "blue:wlan2g";
+			gpios = <&gpio3 0 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		wlan5g {
+			label = "blue:wlan5g";
+			gpios = <&gpio0 7 GPIO_ACTIVE_LOW>;
+		};
+
+		wps2g {
+			label = "blue:wps2g";
+			gpios = <&gpio1 15 GPIO_ACTIVE_LOW>;
+		};
+
+		wps5g {
+			label = "amber:wps5g";
+			gpios = <&gpio2 6 GPIO_ACTIVE_LOW>;
+		};
+
+		line {
+			label = "blue:line";
+			gpios = <&gpio2 14 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&gpio1 {
+	status = "okay";
+};
+
+&gpio2 {
+	status = "okay";
+};
+
+&gpio3 {
+	status = "okay";
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <30000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x30000 0x10000>;
+			};
+
+			factory: partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			rf: partition@50000 {
+				label = "rf";
+				reg = <0x50000 0x10000>;
+				read-only;
+			};
+
+			partition@60000 {
+				label = "firmware";
+				reg = <0x60000 0xf40000>;
+				compatible = "denx,uimage";
+			};
+
+			partition@fa0000 {
+				label = "backup";
+				reg = <0xfa0000 0x10000>;
+				read-only;
+			};
+
+			partition@fb0000 {
+				label = "storage";
+				reg = <0xfb0000 0x50000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&ethernet {
+	pinctrl-names = "default";
+	pinctrl-0 = <&mdio_pins &rgmii1_pins &rgmii2_pins>;
+
+	nvmem-cells = <&macaddr_rf_4>;
+	nvmem-cell-names = "mac-address";
+
+	port@5 {
+		status = "okay";
+
+		phy-mode = "rgmii-txid";
+
+		mediatek,fixed-link = <1000 1 1 1>;
+	};
+
+	mdio-bus {
+		status = "okay";
+
+		ethernet-phy@0 {
+			reg = <0>;
+			phy-mode = "rgmii";
+
+			qca,ar8327-initvals = <
+				0x04 0x07600000 /* PORT0 PAD MODE CTRL */
+				0x08 0x01000000 /* PORT5 PAD MODE CTRL */
+				0x0c 0x07600000 /* PORT6 PAD MODE CTRL */
+				0x10 0x40000000 /* POWER-ON STRAPPING  */
+				0x7c 0x0000007e /* PORT0_STATUS */
+				0x94 0x0000007e /* PORT6_STATUS */
+			>;
+		};
+	};
+};
+
+&gsw {
+	mediatek,ephy-disable;
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,1,0 {
+		compatible = "pci1814,3091";
+		reg = <0x0 1 0 0 0>;
+		ralink,mtd-eeprom = <&factory 0x0>;
+	};
+};
+
+&wmac {
+	ralink,mtd-eeprom = <&rf 0x0>;
+};
+
+&ehci {
+	status = "okay";
+};
+
+&ohci {
+	status = "okay";
+};
+
+&state_default {
+	default {
+		groups = "ephy", "wled", "spi refclk", "i2c", "uartf", "nd_sd";
+		function = "gpio";
+	};
+};
+
+&rf {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_rf_4: macaddr@4 {
+		reg = <0x4 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7620a_youku_x2.dts b/target/linux/ramips/dts/mt7620a_youku_x2.dts
new file mode 100644
index 00000000000000..ad9e252f65f5d4
--- /dev/null
+++ b/target/linux/ramips/dts/mt7620a_youku_x2.dts
@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7620a_youku_yk-l1.dtsi"
+
+/ {
+	compatible = "youku,x2", "ralink,mt7620a-soc";
+	model = "Youku X2";
+};
+
+&ethernet {
+	mediatek,portmap = "wllll";
+};
+
+&firmware {
+	reg = <0x50000 0xfb0000>;
+};
+
+&led_wlan {
+	linux,default-trigger = "phy1tpt";
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x8000>;
+		ieee80211-freq-limit = <5000000 6000000>;
+
+		led {
+			led-sources = <2>;
+			led-active-low;
+		};
+	};
+};
diff --git a/target/linux/ramips/dts/mt7620a_youku_yk-l1.dtsi b/target/linux/ramips/dts/mt7620a_youku_yk-l1.dtsi
index d15d2c0f4b66ec..5af7b343d9b4d6 100644
--- a/target/linux/ramips/dts/mt7620a_youku_yk-l1.dtsi
+++ b/target/linux/ramips/dts/mt7620a_youku_yk-l1.dtsi
@@ -15,7 +15,7 @@
 	leds {
 		compatible = "gpio-leds";
 
-		wlan {
+		led_wlan: wlan {
 			label = "blue:wlan";
 			gpios = <&gpio3 0 GPIO_ACTIVE_LOW>;
 			linux,default-trigger = "phy0tpt";
@@ -86,8 +86,9 @@
 			};
 
 			firmware: partition@50000 {
-				compatible = "denx,uimage";
+				compatible = "openwrt,uimage", "denx,uimage";
 				label = "firmware";
+				openwrt,ih-magic = <0x12291000>;
 				/* reg property is set based on flash size in DTS files */
 			};
 		};
diff --git a/target/linux/ramips/dts/mt7620n_snr_cpe-w4n-mt.dts b/target/linux/ramips/dts/mt7620n_snr_cpe-w4n-mt.dts
new file mode 100644
index 00000000000000..97e604364290ea
--- /dev/null
+++ b/target/linux/ramips/dts/mt7620n_snr_cpe-w4n-mt.dts
@@ -0,0 +1,122 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7620n.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "snr,cpe-w4n-mt", "ralink,mt7620n-soc";
+	model = "SNR-CPE-W4N (rev.M)";
+
+	aliases {
+		led-boot = &led_wps;
+		led-failsafe = &led_sys;
+		led-running = &led_wps;
+		led-upgrade = &led_sys;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_sys: sys {
+			label = "green:sys";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio1 14 GPIO_ACTIVE_LOW>; // GPIO#38
+			panic-indicator;
+		};
+
+		led_wps: wps {
+			label = "green:wps";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WPS;
+			gpios = <&gpio1 15 GPIO_ACTIVE_HIGH>; // GPIO#39
+		};
+
+		wlan {
+			label = "green:wlan";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN;
+			gpios = <&gpio3 0 GPIO_ACTIVE_LOW>; // GPIO#72
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "Reset Button";
+			gpios = <&gpio0 1 GPIO_ACTIVE_HIGH>; // GPIO#1
+			linux,code = <KEY_RESTART>;
+		};
+	};
+};
+
+&gpio0 {
+	status = "okay";
+};
+
+&gpio1 {
+	status = "okay";
+};
+
+&gpio3 {
+	status = "okay";
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <48000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "Bootloader";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "Config";
+				reg = <0x30000 0x10000>;
+			};
+
+			factory: partition@40000 {
+				label = "Factory";
+				reg = <0x40000 0x100000>;
+				read-only;
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x50000 0x7b0000>;
+			};
+
+			partition@30000_1 {
+				label = "uboot-env";
+				reg = <0x30000 0x1000>;
+			};
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "spi refclk";
+		function = "gpio";
+	};
+};
+
+&wmac {
+	ralink,mtd-eeprom = <&factory 0x0>;
+};
diff --git a/target/linux/ramips/dts/mt7620n_zyxel_keenetic-lite-iii-a.dts b/target/linux/ramips/dts/mt7620n_zyxel_keenetic-lite-iii-a.dts
new file mode 100644
index 00000000000000..0d1c4696d79472
--- /dev/null
+++ b/target/linux/ramips/dts/mt7620n_zyxel_keenetic-lite-iii-a.dts
@@ -0,0 +1,144 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7620n.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "zyxel,keenetic-lite-iii-a", "ralink,mt7620n-soc";
+	model = "ZyXEL Keenetic Lite III (rev. A)";
+
+	aliases {
+		led-boot = &led_wan;
+		led-failsafe = &led_wan;
+		led-running = &led_wan;
+		led-upgrade = &led_wan;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+ 
+		reset {
+			label = "reset";
+			gpios = <&gpio0 1 GPIO_ACTIVE_LOW>; // #GPIO1
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio0 2 GPIO_ACTIVE_LOW>; // #GPIO2
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+
+		sw0 {
+			label = "sw0";
+			gpios = <&gpio0 17 GPIO_ACTIVE_LOW>; // #GPIO17
+			linux,code = <BTN_0>;
+		};
+
+		sw1 {
+			label = "sw1";
+			gpios = <&gpio0 20 GPIO_ACTIVE_LOW>; // #GPIO20
+			linux,code = <BTN_1>;
+		};
+
+		sw2 {
+			label = "sw2";
+			gpios = <&gpio0 21 GPIO_ACTIVE_LOW>; // #GPIO21
+			linux,code = <BTN_2>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_wan: wan {
+			label = "green:wan";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio1 14 GPIO_ACTIVE_LOW>; // #GPIO38
+		};
+
+		wifi {
+			label = "green:wifi";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN;
+			gpios = <&gpio3 0 GPIO_ACTIVE_HIGH>; // #GPIO72
+		};
+	};
+
+};
+
+&gpio0 {
+	status = "okay";
+};
+
+&gpio1 {
+	status = "okay";
+};
+
+&gpio3 {
+	status = "okay";
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <48000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "U-Boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "U-Config";
+				reg = <0x30000 0x10000>;
+			};
+
+			factory: partition@40000 {
+				label = "RF-EEPROM";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x50000 0x7a0000>;
+			};
+
+			partition@7f0000 {
+				label = "Config";
+				reg = <0x7f0000 0x10000>;
+			};
+
+			partition@0_1 {
+				label = "Full";
+				reg = <0x0 0x800000>;
+			};
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2c";
+		function = "gpio";
+	};
+};
+
+&wmac {
+	ralink,mtd-eeprom = <&factory 0x0>;
+};
diff --git a/target/linux/ramips/dts/mt7621.dtsi b/target/linux/ramips/dts/mt7621.dtsi
index c9f50a62f34779..3e076741a91e68 100644
--- a/target/linux/ramips/dts/mt7621.dtsi
+++ b/target/linux/ramips/dts/mt7621.dtsi
@@ -41,15 +41,6 @@
 		bootargs = "console=ttyS0,57600";
 	};
 
-#ifdef DTS_LEGACY
-	pll: pll {
-		compatible = "mediatek,mt7621-pll", "syscon";
-
-		#clock-cells = <1>;
-		clock-output-names = "cpu", "bus";
-	};
-#endif
-
 	sysclock: sysclock {
 		#clock-cells = <0>;
 		compatible = "fixed-clock";
@@ -67,16 +58,12 @@
 		#size-cells = <1>;
 
 		sysc: syscon@0 {
-#ifdef DTS_LEGACY
-			compatible = "mtk,mt7621-sysc", "syscon";
-#else
 			compatible = "mediatek,mt7621-sysc", "syscon";
 			#clock-cells = <1>;
 			ralink,memctl = <&memc>;
 			clock-output-names = "xtal", "cpu", "bus",
 					     "50m", "125m", "150m",
 					     "250m", "270m";
-#endif
 			reg = <0x0 0x100>;
 		};
 
@@ -149,11 +136,7 @@
 		};
 
 		memc: syscon@5000 {
-#ifdef DTS_LEGACY
-			compatible = "mtk,mt7621-memc", "syscon";
-#else
 			compatible = "mediatek,mt7621-memc", "syscon";
-#endif
 			reg = <0x5000 0x1000>;
 		};
 
@@ -213,11 +196,7 @@
 			compatible = "ralink,mt7621-spi";
 			reg = <0xb00 0x100>;
 
-#ifdef DTS_LEGACY
-			clocks = <&pll MT7621_CLK_BUS>;
-#else
 			clocks = <&sysc MT7621_CLK_BUS>;
-#endif
 
 			resets = <&rstctrl 18>;
 			reset-names = "spi";
@@ -425,11 +404,7 @@
 		timer {
 			compatible = "mti,gic-timer";
 			interrupts = <GIC_LOCAL 1 IRQ_TYPE_NONE>;
-#ifdef DTS_LEGACY
-			clocks = <&pll MT7621_CLK_CPU>;
-#else
 			clocks = <&sysc MT7621_CLK_CPU>;
-#endif
 		};
 	};
 
@@ -466,14 +441,9 @@
 		compatible = "mediatek,mt7621-eth";
 		reg = <0x1e100000 0x10000>;
 
-#ifdef DTS_LEGACY
-		clocks = <&sysclock>;
-		clock-names = "ethif";
-#else
 		clocks = <&sysc MT7621_CLK_FE>,
 			 <&sysc MT7621_CLK_ETH>;
 		clock-names = "fe", "ethif";
-#endif
 
 		#address-cells = <1>;
 		#size-cells = <0>;
@@ -505,7 +475,7 @@
 			compatible = "mediatek,eth-mac";
 			reg = <1>;
 			status = "disabled";
-			phy-mode = "rgmii-rxid";
+			phy-mode = "rgmii";
 		};
 
 		mdio: mdio-bus {
@@ -558,7 +528,6 @@
 
 					port@6 {
 						reg = <6>;
-						label = "cpu";
 						ethernet = <&gmac0>;
 						phy-mode = "rgmii";
 
@@ -587,36 +556,16 @@
 
 		device_type = "pci";
 
-#ifdef DTS_LEGACY
-		ranges = <0x02000000 0 0x00000000 0x60000000 0 0x10000000>, /* pci memory */
-			 <0x01000000 0 0x00000000 0x1e160000 0 0x00010000>; /* io space */
-#else
 		ranges = <0x02000000 0 0x60000000 0x60000000 0 0x10000000>, /* pci memory */
 			 <0x01000000 0 0x00000000 0x1e160000 0 0x00010000>; /* io space */
-#endif
 
 		status = "disabled";
 
-#ifdef DTS_LEGACY
-		interrupt-parent = <&gic>;
-		interrupts = <GIC_SHARED 4 IRQ_TYPE_LEVEL_HIGH
-				GIC_SHARED 24 IRQ_TYPE_LEVEL_HIGH
-				GIC_SHARED 25 IRQ_TYPE_LEVEL_HIGH>;
-
-
-		resets = <&rstctrl 24>, <&rstctrl 25>, <&rstctrl 26>;
-		reset-names = "pcie0", "pcie1", "pcie2";
-		clocks = <&clkctrl 24>, <&clkctrl 25>, <&clkctrl 26>;
-		clock-names = "pcie0", "pcie1", "pcie2";
-		phys = <&pcie0_phy 1>, <&pcie2_phy 0>;
-		phy-names = "pcie-phy0", "pcie-phy2";
-#else
 		#interrupt-cells = <1>;
 		interrupt-map-mask = <0xF800 0 0 0>;
 		interrupt-map = <0x0000 0 0 0 &gic GIC_SHARED 4 IRQ_TYPE_LEVEL_HIGH>,
 				<0x0800 0 0 0 &gic GIC_SHARED 24 IRQ_TYPE_LEVEL_HIGH>,
 				<0x1000 0 0 0 &gic GIC_SHARED 25 IRQ_TYPE_LEVEL_HIGH>;
-#endif
 
 		reset-gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
 
@@ -626,7 +575,6 @@
 			#size-cells = <2>;
 			device_type = "pci";
 			ranges;
-#ifndef DTS_LEGACY
 			#interrupt-cells = <1>;
 			interrupt-map-mask = <0 0 0 0>;
 			interrupt-map = <0 0 0 0 &gic GIC_SHARED 4 IRQ_TYPE_LEVEL_HIGH>;
@@ -634,7 +582,6 @@
 			clocks = <&sysc MT7621_CLK_PCIE0>;
 			phys = <&pcie0_phy 1>;
 			phy-names = "pcie-phy0";
-#endif
 		};
 
 		pcie1: pcie@1,0 {
@@ -643,7 +590,6 @@
 			#size-cells = <2>;
 			device_type = "pci";
 			ranges;
-#ifndef DTS_LEGACY
 			#interrupt-cells = <1>;
 			interrupt-map-mask = <0 0 0 0>;
 			interrupt-map = <0 0 0 0 &gic GIC_SHARED 24 IRQ_TYPE_LEVEL_HIGH>;
@@ -651,7 +597,6 @@
 			clocks = <&sysc MT7621_CLK_PCIE1>;
 			phys = <&pcie0_phy 1>;
 			phy-names = "pcie-phy1";
-#endif
 		};
 
 		pcie2: pcie@2,0 {
@@ -660,7 +605,6 @@
 			#size-cells = <2>;
 			device_type = "pci";
 			ranges;
-#ifndef DTS_LEGACY
 			#interrupt-cells = <1>;
 			interrupt-map-mask = <0 0 0 0>;
 			interrupt-map = <0 0 0 0 &gic GIC_SHARED 25 IRQ_TYPE_LEVEL_HIGH>;
@@ -668,25 +612,20 @@
 			clocks = <&sysc MT7621_CLK_PCIE2>;
 			phys = <&pcie2_phy 0>;
 			phy-names = "pcie-phy2";
-#endif
 		};
 	};
 
 	pcie0_phy: pcie-phy@1e149000 {
 		compatible = "mediatek,mt7621-pci-phy";
 		reg = <0x1e149000 0x0700>;
-#ifndef DTS_LEGACY
 		clocks = <&sysc MT7621_CLK_XTAL>;
-#endif
 		#phy-cells = <1>;
 	};
 
 	pcie2_phy: pcie-phy@1e14a000 {
 		compatible = "mediatek,mt7621-pci-phy";
 		reg = <0x1e14a000 0x0700>;
-#ifndef DTS_LEGACY
 		clocks = <&sysc MT7621_CLK_XTAL>;
-#endif
 		#phy-cells = <1>;
 	};
 };
diff --git a/target/linux/ramips/dts/mt7621_afoundry_ew1200.dts b/target/linux/ramips/dts/mt7621_afoundry_ew1200.dts
index 119acd977c03c7..8d33f542dc1af0 100644
--- a/target/linux/ramips/dts/mt7621_afoundry_ew1200.dts
+++ b/target/linux/ramips/dts/mt7621_afoundry_ew1200.dts
@@ -90,18 +90,30 @@
 };
 
 &pcie0 {
-	mt76@0,0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
 		reg = <0x0000 0 0 0 0>;
 		mediatek,mtd-eeprom = <&factory 0x8000>;
 		ieee80211-freq-limit = <5000000 6000000>;
+
+		led {
+			led-sources = <2>;
+			led-active-low;
+		};
 	};
 };
 
 &pcie1 {
-	mt76@0,0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
 		reg = <0x0000 0 0 0 0>;
 		mediatek,mtd-eeprom = <&factory 0x0000>;
 		ieee80211-freq-limit = <2400000 2500000>;
+
+		led {
+			led-sources = <0>;
+			led-active-low;
+		};
 	};
 };
 
diff --git a/target/linux/ramips/dts/mt7621_arcadyan_we420223-99.dts b/target/linux/ramips/dts/mt7621_arcadyan_we420223-99.dts
new file mode 100644
index 00000000000000..3ae441f8e3be55
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_arcadyan_we420223-99.dts
@@ -0,0 +1,219 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	model = "Arcadyan WE420223-99";
+	compatible = "arcadyan,we420223-99", "mediatek,mt7621-soc";
+
+	aliases {
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_green;
+		led-upgrade = &led_wps_green;
+		led-wifi = &led_wifi_green;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,57600 ubi.mtd=5 root=/dev/ubiblock0_0";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power_green: power_green {
+			label = "green:power";
+			gpios = <&gpio 42 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_POWER;
+			default-state = "on";
+		};
+
+		led_power_red: power_red {
+			label = "red:power";
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_FAULT;
+		};
+
+		led_wifi_blue: wifi_blue {
+			label = "blue:wifi";
+			gpios = <&gpio 41 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WLAN;
+		};
+
+		led_wifi_green: wifi_green {
+			label = "green:wifi";
+			gpios = <&gpio 43 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN;
+		};
+
+		led_wps_red: wps_red {
+			label = "red:wps";
+			gpios = <&gpio 45 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WPS;
+		};
+
+		led_wps_green: wps_green {
+			label = "green:wps";
+			gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WPS;
+		};
+
+		led_followme_r: followme_red {
+			label = "red:followme";
+			gpios = <&gpio 47 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_RED>;
+		};
+
+		led_followme_g: followme_green {
+			label = "green:followme";
+			gpios = <&gpio 48 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+
+		reg = <0>;
+		spi-max-frequency = <70000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "ALL";
+				reg = <0x0 0x2000000>;
+				read-only;
+			};
+
+			partition@1 {
+				label = "Bootloader";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "Config";
+				reg = <0x30000 0x10000>;
+			};
+
+			factory: partition@40000 {
+				label = "Factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			partition@50000 {
+				label = "kernel";
+				reg = <0x50000 0x1f60000>;
+			};
+
+			partition@490000 {
+				label = "rootfs";
+				reg = <0x490000 0x1b20000>;
+			};
+
+			partition@1000000 {
+				label = "Kernel2";
+				reg = <0x1000000 0xfb0000>;
+			};
+
+			partition@1440000 {
+				label = "RootFS2";
+				reg = <0x1440000 0xb70000>;
+			};
+
+			partition@1fb0000 {
+				label = "glbcfg";
+				reg = <0x1fb0000 0x10000>;
+				read-only;
+			};
+
+			partition@1fc0000 {
+				label = "board_data";
+				reg = <0x1fc0000 0x10000>;
+				read-only;
+			};
+
+			partition@1fd0000 {
+				label = "glbcfg2";
+				reg = <0x1fd0000 0x10000>;
+				read-only;
+			};
+
+			partition@1fe0000 {
+				label = "board_data2";
+				reg = <0x1fe0000 0x10000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&xhci {
+	status = "disabled";
+};
+
+&switch0 {
+	ports {
+		port@1 {
+			status = "okay";
+			label = "swp1";
+		};
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	label = "swp0";
+	phy-handle = <&ethphy0>;
+};
+
+&mdio {
+	ethphy0: ethernet-phy@0 {
+		reg = <0>;
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie1 {
+	mt76@0,0 {
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0000>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_arcadyan_wg4xx223.dtsi b/target/linux/ramips/dts/mt7621_arcadyan_wg4xx223.dtsi
index 8c4be8440d590b..b924d71190fbda 100644
--- a/target/linux/ramips/dts/mt7621_arcadyan_wg4xx223.dtsi
+++ b/target/linux/ramips/dts/mt7621_arcadyan_wg4xx223.dtsi
@@ -158,7 +158,7 @@
 	status = "okay";
 };
 
-&pcie0 {
+&pcie1 {
 	wifi@0,0 {
 		compatible = "mediatek,mt76";
 		reg = <0x0000 0 0 0 0>;
diff --git a/target/linux/ramips/dts/mt7621_asus_rp-ac56.dts b/target/linux/ramips/dts/mt7621_asus_rp-ac56.dts
index 5ae0ca6e820ba4..50047999be7a84 100644
--- a/target/linux/ramips/dts/mt7621_asus_rp-ac56.dts
+++ b/target/linux/ramips/dts/mt7621_asus_rp-ac56.dts
@@ -106,7 +106,7 @@
 };
 
 &gpio {
-       status = "okay";
+	status = "okay";
 };
 
 &spi0 {
@@ -208,12 +208,12 @@
 };
 
 &switch0 {
-        ports {
-                port@0 {
-                        status = "okay";
-                        label = "lan";
-                };
-        };
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan";
+		};
+	};
 };
 
 &xhci {
diff --git a/target/linux/ramips/dts/mt7621_asus_rt-ac57u-v1.dts b/target/linux/ramips/dts/mt7621_asus_rt-ac57u-v1.dts
new file mode 100644
index 00000000000000..bb1c86c2d5df83
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_asus_rt-ac57u-v1.dts
@@ -0,0 +1,195 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "asus,rt-ac57u-v1", "mediatek,mt7621-soc";
+	model = "ASUS RT-AC57U v1";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: power {
+			label = "blue:power";
+			gpios = <&gpio 48 GPIO_ACTIVE_LOW>;
+		};
+
+		usb {
+			label = "blue:usb";
+			gpios = <&gpio 47 GPIO_ACTIVE_LOW>;
+			trigger-sources = <&ehci_port2>;
+			linux,default-trigger = "usbport";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 43 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 41 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+	};
+
+	led-regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "LED-Power";
+		gpio = <&gpio 46 GPIO_ACTIVE_LOW>;
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-always-on;
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "config";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x50000 0xfb0000>;
+			};
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x8000>;
+
+		led {
+			led-sources = <2>;
+			led-active-low;
+		};
+	};
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0000>;
+
+		led {
+			led-active-low;
+		};
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_e000>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy0>;
+
+	nvmem-cells = <&macaddr_factory_e006>;
+	nvmem-cell-names = "mac-address";
+};
+
+&mdio {
+	ethphy0: ethernet-phy@0 {
+		reg = <0>;
+	};
+};
+
+&switch0 {
+	ports {
+		port@1 {
+			status = "okay";
+			label = "lan1";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@4 {
+			status = "okay";
+			label = "lan4";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "sdhci";
+		function = "gpio";
+	};
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_e000: macaddr@e000 {
+		reg = <0xe000 0x6>;
+	};
+
+	macaddr_factory_e006: macaddr@e006 {
+		reg = <0xe006 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_asus_rt-ax53u.dts b/target/linux/ramips/dts/mt7621_asus_rt-ax53u.dts
index fc1a00a1c90956..d740d00c6dffd7 100644
--- a/target/linux/ramips/dts/mt7621_asus_rt-ax53u.dts
+++ b/target/linux/ramips/dts/mt7621_asus_rt-ax53u.dts
@@ -26,11 +26,21 @@
 	leds {
 		compatible = "gpio-leds";
 
-		led_power: led-0 {
+		led_power: power {
+			label = "blue:power";
 			color = <LED_COLOR_ID_BLUE>;
-                        function = LED_FUNCTION_POWER;
+			function = LED_FUNCTION_POWER;
 			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
 		};
+
+		led_usb {
+			label = "blue:usb";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_USB;
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+			trigger-sources = <&ehci_port2>;
+			linux,default-trigger = "usbport";
+		};
 	};
 
 	keys {
@@ -53,6 +63,11 @@
 &nand {
 	status = "okay";
 
+	mediatek,nmbm;
+	mediatek,bmt-remap-range =
+		<0x000000 0x7e0000>,
+		<0x35e0000 0x7800000>;
+
 	partitions {
 		compatible = "fixed-partitions";
 		#address-cells = <1>;
@@ -60,12 +75,21 @@
 
 		partition@0 {
 			label = "u-boot";
-			reg = <0x0 0xe0000>;
+			reg = <0x0 0x80000>;
 			read-only;
 		};
 
-		partition@e0000 {
+		/*
+		 * u-boot gets split here while keeping u-boot read-only,
+		 * which allows safe usage of fw_setenv
+		 */
+		partition@80000 {
 			label = "u-boot-env";
+			reg = <0x80000 0x60000>;
+		};
+
+		partition@e0000 {
+			label = "nvram";
 			reg = <0xe0000 0x100000>;
 			read-only;
 		};
@@ -91,13 +115,22 @@
 		};
 
 		partition@3e0000 {
-			label = "kernel";
-			reg = <0x3e0000 0x400000>;
-		};
+			label = "firmware";
+			reg = <0x3e0000 0x3200000>;
+
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
 
-		partition@7e0000 {
-			label = "ubi";
-			reg = <0x7e0000 0x2e00000>;
+			partition@0 {
+				label = "kernel";
+				reg = <0x0 0x400000>;
+			};
+
+			partition@400000 {
+				label = "ubi";
+				reg = <0x400000 0x2e00000>;
+			};
 		};
 
 		partition@35e0000 {
@@ -105,7 +138,12 @@
 			reg = <0x35e0000 0x3200000>;
 		};
 
-		/* Last 8M possibly store the bad block table */
+		partition@67e0000 {
+			label = "jffs2";
+			reg = <0x67e0000 0x1020000>;
+		};
+
+		/* Last 8M are reserved for NMBM management (bad blocks) */
 	};
 };
 
@@ -158,11 +196,6 @@
 			status = "okay";
 			label = "lan3";
 		};
-
-		port@4 {
-			status = "okay";
-			label = "lan4";
-		};
 	};
 };
 
diff --git a/target/linux/ramips/dts/mt7621_asus_rt-ax54.dts b/target/linux/ramips/dts/mt7621_asus_rt-ax54.dts
new file mode 100644
index 00000000000000..3191692e4ef30a
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_asus_rt-ax54.dts
@@ -0,0 +1,186 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "asus,rt-ax54", "mediatek,mt7621-soc";
+	model = "ASUS RT-AX54";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+		bootargs-override = "console=ttyS0,115200";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: power {
+			label = "blue:power";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_POWER;
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		};
+
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		key-restart {
+			label = "reset";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		key-wps {
+			label = "wps";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	mediatek,nmbm;
+	mediatek,bmt-max-ratio = <1>;
+	mediatek,bmt-max-reserved-blocks = <64>;
+	mediatek,bmt-remap-range = <0x000000 0x7e0000>;
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "u-boot";
+			reg = <0x0 0x80000>;
+			read-only;
+		};
+
+		/*
+		 * u-boot gets split here while keeping u-boot read-only,
+		 * which allows safe usage of fw_setenv
+		 */
+		partition@80000 {
+			label = "u-boot-env";
+			reg = <0x80000 0x60000>;
+		};
+
+		partition@e0000 {
+			label = "nvram";
+			reg = <0xe0000 0x100000>;
+			read-only;
+		};
+
+		factory: partition@1e0000 {
+			label = "factory";
+			reg = <0x1e0000 0x100000>;
+			read-only;
+
+			compatible = "nvmem-cells";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			macaddr_factory_4: macaddr@4 {
+				reg = <0x4 0x6>;
+			};
+		};
+
+		factory2: partition@2e0000 {
+			label = "factory2";
+			reg = <0x2e0000 0x100000>;
+			read-only;
+		};
+
+		partition@3e0000 {
+			label = "kernel";
+			reg = <0x3e0000 0x400000>;
+		};
+
+		partition@7e0000 {
+			label = "ubi";
+			reg = <0x7e0000 0x7020000>;
+		};
+
+		/* Last 8M are reserved for NMBM management (bad blocks) */
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0000>;
+		mediatek,disable-radar-background;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_4>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy4>;
+
+	nvmem-cells = <&macaddr_factory_4>;
+	nvmem-cell-names = "mac-address";
+};
+
+&mdio {
+	ethphy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan4";
+		};
+
+		port@1 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan1";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "uart2", "uart3", "jtag", "wdt";
+		function = "gpio";
+	};
+};
+
diff --git a/target/linux/ramips/dts/mt7621_beeline_smartbox-turbo-plus.dts b/target/linux/ramips/dts/mt7621_beeline_smartbox-turbo-plus.dts
new file mode 100644
index 00000000000000..507920bac22c0e
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_beeline_smartbox-turbo-plus.dts
@@ -0,0 +1,248 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "beeline,smartbox-turbo-plus", "mediatek,mt7621-soc";
+	model = "Beeline SmartBox TURBO+";
+
+	aliases {
+		label-mac-device = &gmac0;
+
+		led-boot = &led_status_green;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_red;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			label = "blue:wan";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&gpio 13 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_green: led-1 {
+			label = "green:status";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 15 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_red: led-2 {
+			label = "red:status";
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 16 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	ubi-concat {
+		compatible = "mtd-concat";
+		devices = <&ubiconcat0 &ubiconcat1 &ubiconcat2>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "ubi";
+				reg = <0x0 0x4f80000>;
+			};
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	partitions {
+		compatible = "sercomm,sc-partitions", "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "u-boot";
+			reg = <0x0 0x100000>;
+			sercomm,scpart-id = <0>;
+			read-only;
+		};
+
+		partition@100000 {
+			label = "dynamic partition map";
+			reg = <0x100000 0x100000>;
+			sercomm,scpart-id = <1>;
+			read-only;
+		};
+
+		factory: partition@200000 {
+			label = "Factory";
+			reg = <0x200000 0x100000>;
+			sercomm,scpart-id = <2>;
+			read-only;
+
+			compatible = "nvmem-cells";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			macaddr_factory_21000: macaddr@21000 {
+				reg = <0x21000 0x6>;
+			};
+		};
+
+		partition@300000 {
+			label = "Boot Flag";
+			reg = <0x300000 0x100000>;
+			sercomm,scpart-id = <3>;
+		};
+
+		partition@400000 {
+			label = "kernel";
+			reg = <0x400000 0x600000>;
+			sercomm,scpart-id = <4>;
+		};
+
+		partition@a00000 {
+			label = "Kernel 2";
+			reg = <0xa00000 0x600000>;
+			sercomm,scpart-id = <5>;
+			read-only;
+		};
+
+		ubiconcat0: partition@1000000 {
+			label = "File System 1";
+			reg = <0x1000000 0x2000000>;
+			sercomm,scpart-id = <6>;
+		};
+
+		partition@3000000 {
+			label = "File System 2";
+			reg = <0x3000000 0x2000000>;
+			sercomm,scpart-id = <7>;
+			read-only;
+		};
+
+		ubiconcat1: partition@5000000 {
+			label = "Configuration/log";
+			reg = <0x5000000 0x1400000>;
+			sercomm,scpart-id = <8>;
+		};
+
+		ubiconcat2: partition@6400000 {
+			label = "application tmp buffer (Ftool)";
+			reg = <0x6400000 0x1b80000>;
+			sercomm,scpart-id = <9>;
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x8000>;
+		ieee80211-freq-limit = <5000000 6000000>;
+
+		nvmem-cells = <&macaddr_factory_21000>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <(5)>;
+	};
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0>;
+		ieee80211-freq-limit = <2400000 2500000>;
+
+		nvmem-cells = <&macaddr_factory_21000>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <(4)>;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_21000>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy0>;
+
+	nvmem-cells = <&macaddr_factory_21000>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <(1)>;
+};
+
+&mdio {
+	ethphy0: ethernet-phy@0 {
+		reg = <0>;
+	};
+};
+
+&switch0 {
+	ports {
+		port@1 {
+			status = "okay";
+			label = "lan1";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@4 {
+			status = "okay";
+			label = "lan4";
+		};
+	};
+};
+
+&uartlite3 {
+	status = "okay";
+	current-speed = <57600>;
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "jtag";
+		function = "gpio";
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_beeline_smartbox-turbo.dts b/target/linux/ramips/dts/mt7621_beeline_smartbox-turbo.dts
index 733be13e1366a8..df80f49e97ea37 100644
--- a/target/linux/ramips/dts/mt7621_beeline_smartbox-turbo.dts
+++ b/target/linux/ramips/dts/mt7621_beeline_smartbox-turbo.dts
@@ -1,183 +1,14 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 
-#include "mt7621.dtsi"
-
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
-#include <dt-bindings/leds/common.h>
+#include "mt7621_sercomm_dxx_nand_256m.dtsi"
 
 / {
 	compatible = "beeline,smartbox-turbo", "mediatek,mt7621-soc";
 	model = "Beeline SmartBox TURBO";
-
-	aliases {
-		label-mac-device = &gmac0;
-
-		led-boot = &led_status_green;
-		led-failsafe = &led_status_red;
-		led-running = &led_status_green;
-		led-upgrade = &led_status_red;
-	};
-
-	leds {
-		compatible = "gpio-leds";
-
-		led-1 {
-			label = "blue:wan";
-			color = <LED_COLOR_ID_BLUE>;
-			function = LED_FUNCTION_WAN;
-			gpios = <&gpio 13 GPIO_ACTIVE_HIGH>;
-		};
-
-		led_status_green: led-0 {
-			label = "green:status";
-			color = <LED_COLOR_ID_GREEN>;
-			function = LED_FUNCTION_STATUS;
-			gpios = <&gpio 15 GPIO_ACTIVE_HIGH>;
-		};
-
-		led_status_red: led-2 {
-			label = "red:status";
-			color = <LED_COLOR_ID_RED>;
-			function = LED_FUNCTION_STATUS;
-			gpios = <&gpio 16 GPIO_ACTIVE_HIGH>;
-		};
-	};
-
-	keys {
-		compatible = "gpio-keys";
-
-		wps {
-			label = "wps";
-			gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
-			linux,code = <KEY_WPS_BUTTON>;
-		};
-
-		reset {
-			label = "reset";
-			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
-			linux,code = <KEY_RESTART>;
-		};
-	};
-
-	ubi-concat {
-		compatible = "mtd-concat";
-		devices = <&ubiconcat0 &ubiconcat1 &ubiconcat2 \
-			&ubiconcat3>;
-
-		partitions {
-			compatible = "fixed-partitions";
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			partition@0 {
-				label = "ubi";
-				reg = <0x0 0xca00000>;
-			};
-		};
-	};
-};
-
-&nand {
-	status = "okay";
-
-	partitions {
-		compatible = "sercomm,sc-partitions", "fixed-partitions";
-		#address-cells = <1>;
-		#size-cells = <1>;
-
-		partition@0 {
-			label = "u-boot";
-			reg = <0x0 0x100000>;
-			sercomm,scpart-id = <0>;
-			read-only;
-		};
-
-		partition@100000 {
-			label = "dynamic partition map";
-			reg = <0x100000 0x100000>;
-			sercomm,scpart-id = <1>;
-			read-only;
-		};
-
-		factory: partition@200000 {
-			label = "Factory";
-			reg = <0x200000 0x100000>;
-			sercomm,scpart-id = <2>;
-			read-only;
-
-			compatible = "nvmem-cells";
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			macaddr_factory_21000: macaddr@21000 {
-				reg = <0x21000 0x6>;
-			};
-		};
-
-		partition@300000 {
-			label = "Boot Flag";
-			reg = <0x300000 0x100000>;
-			sercomm,scpart-id = <3>;
-		};
-
-		partition@400000 {
-			label = "kernel";
-			reg = <0x400000 0x600000>;
-			sercomm,scpart-id = <4>;
-		};
-
-		partition@a00000 {
-			label = "Kernel 2";
-			reg = <0xa00000 0x600000>;
-			sercomm,scpart-id = <5>;
-			read-only;
-		};
-
-		ubiconcat0: partition@1000000 {
-			label = "File System 1";
-			reg = <0x1000000 0x2000000>;
-			sercomm,scpart-id = <6>;
-		};
-
-		partition@3000000 {
-			label = "File System 2";
-			reg = <0x3000000 0x2000000>;
-			sercomm,scpart-id = <7>;
-			read-only;
-		};
-
-		ubiconcat1: partition@5000000 {
-			label = "Configuration/log";
-			reg = <0x5000000 0x1400000>;
-			sercomm,scpart-id = <8>;
-		};
-
-		ubiconcat2: partition@6400000 {
-			label = "Debug (Ftool)";
-			reg = <0x6400000 0x1a00000>;
-			sercomm,scpart-id = <9>;
-		};
-
-		ubiconcat3: partition@8000000 {
-			label = "container";
-			reg = <0x8000000 0x7c00000>;
-			sercomm,scpart-id = <10>;
-		};
-	};
-};
-
-&pcie {
-	status = "okay";
 };
 
 &pcie0 {
 	wifi@0,0 {
-		compatible = "mediatek,mt76";
-		reg = <0x0000 0 0 0 0>;
-		mediatek,mtd-eeprom = <&factory 0x8000>;
-		ieee80211-freq-limit = <5000000 6000000>;
-
 		nvmem-cells = <&macaddr_factory_21000>;
 		nvmem-cell-names = "mac-address";
 		mac-address-increment = <(5)>;
@@ -186,69 +17,14 @@
 
 &pcie1 {
 	wifi@0,0 {
-		compatible = "mediatek,mt76";
-		reg = <0x0000 0 0 0 0>;
-		mediatek,mtd-eeprom = <&factory 0x0>;
-		ieee80211-freq-limit = <2400000 2500000>;
-
 		nvmem-cells = <&macaddr_factory_21000>;
 		nvmem-cell-names = "mac-address";
 		mac-address-increment = <(4)>;
 	};
 };
 
-&gmac0 {
-	nvmem-cells = <&macaddr_factory_21000>;
-	nvmem-cell-names = "mac-address";
-};
-
 &gmac1 {
-	status = "okay";
-	label = "wan";
-	phy-handle = <&ethphy0>;
-
 	nvmem-cells = <&macaddr_factory_21000>;
 	nvmem-cell-names = "mac-address";
 	mac-address-increment = <(1)>;
 };
-
-&mdio {
-	ethphy0: ethernet-phy@0 {
-		reg = <0>;
-	};
-};
-
-&switch0 {
-	ports {
-		port@1 {
-			status = "okay";
-			label = "lan1";
-		};
-
-		port@2 {
-			status = "okay";
-			label = "lan2";
-		};
-
-		port@3 {
-			status = "okay";
-			label = "lan3";
-		};
-
-		port@4 {
-			status = "okay";
-			label = "lan4";
-		};
-	};
-};
-
-&uartlite3 {
-	status = "okay";
-};
-
-&state_default {
-	gpio {
-		groups = "jtag", "uart2";
-		function = "gpio";
-	};
-};
diff --git a/target/linux/ramips/dts/mt7621_belkin_rt1800.dts b/target/linux/ramips/dts/mt7621_belkin_rt1800.dts
index 7bf7d894454ce3..16ae7324290355 100644
--- a/target/linux/ramips/dts/mt7621_belkin_rt1800.dts
+++ b/target/linux/ramips/dts/mt7621_belkin_rt1800.dts
@@ -40,12 +40,24 @@
 	leds {
 		compatible = "gpio-leds";
 
+		led-wps {
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_WPS;
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		};
+
 		led_power: led-power {
 			label = "white:power";
 			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
 			default-state = "on";
 		};
 
+		led-wan2 {
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
 		led-wan {
 			color = <LED_COLOR_ID_WHITE>;
 			function = LED_FUNCTION_WAN;
@@ -125,6 +137,13 @@
 	};
 };
 
+&state_default {
+	gpio {
+		groups = "i2c", "uart3", "jtag", "wdt";
+		function = "gpio";
+	};
+};
+
 &gmac1 {
 	status = "okay";
 	label = "wan";
diff --git a/target/linux/ramips/dts/mt7621_cudy_m1800.dts b/target/linux/ramips/dts/mt7621_cudy_m1800.dts
new file mode 100644
index 00000000000000..314fdb206ca112
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_cudy_m1800.dts
@@ -0,0 +1,177 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "cudy,m1800", "mediatek,mt7621-soc";
+	model = "Cudy M1800";
+
+	aliases {
+		led-boot = &led_internet_white;
+		led-failsafe = &led_internet_white;
+		led-running = &led_internet_white;
+		led-upgrade = &led_internet_white;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_internet_white: internet-white {
+			label = "white:internet";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		internet-red {
+			label = "red:internet";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_bdinfo_de00>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <1>;
+};
+
+&gmac1 {
+	status = "okay";
+	label = "lan";
+	phy-handle = <&ethphy4>;
+
+	nvmem-cells = <&macaddr_bdinfo_de00>;
+	nvmem-cell-names = "mac-address";
+};
+
+&mdio {
+	ethphy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0000>;
+		mediatek,disable-radar-background;
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <50000000>;
+		m25p,fast-read;
+		broken-flash-reset;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x50000 0xfb0000>;
+			};
+
+			partition@1000000 {
+				label = "app";
+				reg = <0x1000000 0xfd0000>;
+				read-only;
+			};
+
+			partition@1fd0000 {
+				label = "debug";
+				reg = <0x1fd0000 0x10000>;
+				read-only;
+			};
+
+			partition@1fe0000 {
+				label = "backup";
+				reg = <0x1fe0000 0x10000>;
+				read-only;
+			};
+
+			partition@1ff0000 {
+				label = "bdinfo";
+				reg = <0x1ff0000 0x10000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_bdinfo_de00: macaddr@de00 {
+					reg = <0xde00 0x6>;
+				};
+			};
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "jtag", "uart3";
+		function = "gpio";
+	};
+};
+
+&switch0 {
+	ports {
+		port@3 {
+			status = "okay";
+			label = "wan";
+		};
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_cudy_wr1300-v1.dts b/target/linux/ramips/dts/mt7621_cudy_wr1300-v1.dts
new file mode 100644
index 00000000000000..cc1afdc95bd6a5
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_cudy_wr1300-v1.dts
@@ -0,0 +1,216 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "cudy,wr1300-v1", "mediatek,mt7621-soc";
+	model = "Cudy WR1300 v1";
+
+	aliases {
+		led-boot = &led_sys;
+		led-failsafe = &led_sys;
+		led-running = &led_sys;
+		led-upgrade = &led_sys;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_sys: sys {
+			label = "green:sys";
+			gpios = <&gpio 15 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb {
+			label = "green:usb";
+			gpios = <&gpio 14 GPIO_ACTIVE_HIGH>;
+			trigger-sources = <&xhci_ehci_port1>, <&ehci_port2>;
+			linux,default-trigger = "usbport";
+		};
+
+		wps {
+			label = "green:wps";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x50000 0xf80000>;
+			};
+
+			partition@fd0000 {
+				label = "debug";
+				reg = <0xfd0000 0x10000>;
+				read-only;
+			};
+
+			partition@fe0000 {
+				label = "backup";
+				reg = <0xfe0000 0x10000>;
+				read-only;
+			};
+
+			bdinfo: partition@ff0000 {
+				label = "bdinfo";
+				reg = <0xff0000 0x10000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "pci14c3,7603";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0000>;
+		nvmem-cells = <&macaddr_bdinfo_de00>;
+		nvmem-cell-names = "mac-address";
+		ieee80211-freq-limit = <2400000 2500000>;
+
+		led {
+			led-active-low;
+		};
+	};
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "pci14c3,7662";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x8000>;
+		nvmem-cells = <&macaddr_bdinfo_de00>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <2>;
+		ieee80211-freq-limit = <5000000 6000000>;
+
+		led {
+			led-sources = <2>;
+			led-active-low;
+		};
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_bdinfo_de00>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy4>;
+
+	nvmem-cells = <&macaddr_bdinfo_de00>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <1>;
+};
+
+&mdio {
+	ethphy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan4";
+		};
+
+		port@1 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan1";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "wdt", "i2c", "jtag";
+		function = "gpio";
+	};
+};
+
+&bdinfo {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_bdinfo_de00: macaddr@de00 {
+		reg = <0xde00 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_cudy_wr1300-v2.dts b/target/linux/ramips/dts/mt7621_cudy_wr1300-v2.dts
new file mode 100644
index 00000000000000..a5d2fc46079343
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_cudy_wr1300-v2.dts
@@ -0,0 +1,198 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "cudy,wr1300-v2", "mediatek,mt7621-soc";
+	model = "Cudy WR1300 v2";
+
+	aliases {
+		led-boot = &led_sys;
+		led-failsafe = &led_sys;
+		led-running = &led_sys;
+		led-upgrade = &led_sys;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_sys: sys {
+			label = "green:sys";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "green:wps";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <40000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x50000 0xf80000>;
+			};
+
+			partition@fd0000 {
+				label = "debug";
+				reg = <0xfd0000 0x10000>;
+				read-only;
+			};
+
+			partition@fe0000 {
+				label = "backup";
+				reg = <0xfe0000 0x10000>;
+				read-only;
+			};
+
+			bdinfo: partition@ff0000 {
+				label = "bdinfo";
+				reg = <0xff0000 0x10000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0000>;
+		nvmem-cells = <&macaddr_bdinfo_de00>;
+		nvmem-cell-names = "mac-address";
+	};
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x8000>;
+		nvmem-cells = <&macaddr_bdinfo_de00>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <2>;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_bdinfo_de00>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy4>;
+
+	nvmem-cells = <&macaddr_bdinfo_de00>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <1>;
+};
+
+&mdio {
+	ethphy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan4";
+		};
+
+		port@1 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan1";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "wdt", "i2c", "jtag";
+		function = "gpio";
+	};
+};
+
+&bdinfo {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_bdinfo_de00: macaddr@de00 {
+		reg = <0xde00 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_cudy_x6-v1.dts b/target/linux/ramips/dts/mt7621_cudy_x6-v1.dts
new file mode 100644
index 00000000000000..cfae15e5659aa8
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_cudy_x6-v1.dts
@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621_cudy_x6.dtsi"
+
+/ {
+	compatible = "cudy,x6-v1", "mediatek,mt7621-soc";
+	model = "CUDY X6 v1";
+};
+
+&partitions {
+	partition@50000 {
+		compatible = "denx,uimage";
+		label = "firmware";
+		reg = <0x50000 0x1f80000>;
+	};
+
+	partition@1fd0000 {
+		label = "debug";
+		reg = <0x1fd0000 0x10000>;
+		read-only;
+	};
+
+	partition@1fe0000 {
+		label = "backup";
+		reg = <0x1fe0000 0x10000>;
+		read-only;
+	};
+
+	partition@1ff0000 {
+		label = "bdinfo";
+		reg = <0x1ff0000 0x10000>;
+		read-only;
+
+		compatible = "nvmem-cells";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		macaddr_bdinfo_de00: macaddr@de00 {
+			reg = <0xde00 0x6>;
+		};
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_bdinfo_de00>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	nvmem-cells = <&macaddr_bdinfo_de00>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <1>;
+};
+
+&wifi {
+	nvmem-cells = <&macaddr_bdinfo_de00>;
+	nvmem-cell-names = "mac-address";
+};
diff --git a/target/linux/ramips/dts/mt7621_cudy_x6-v2.dts b/target/linux/ramips/dts/mt7621_cudy_x6-v2.dts
new file mode 100644
index 00000000000000..16fa15befc4d1e
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_cudy_x6-v2.dts
@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621_cudy_x6.dtsi"
+
+/ {
+	compatible = "cudy,x6-v2", "mediatek,mt7621-soc";
+	model = "CUDY X6 v2";
+};
+
+&partitions {
+	partition@50000 {
+		compatible = "denx,uimage";
+		label = "firmware";
+		reg = <0x50000 0xf80000>;
+	};
+
+	partition@fd0000 {
+		label = "debug";
+		reg = <0xfd0000 0x10000>;
+		read-only;
+	};
+
+	partition@fe0000 {
+		label = "backup";
+		reg = <0xfe0000 0x10000>;
+		read-only;
+	};
+
+	partition@ff0000 {
+		label = "bdinfo";
+		reg = <0xff0000 0x10000>;
+		read-only;
+
+		compatible = "nvmem-cells";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		macaddr_bdinfo_de00: macaddr@de00 {
+			reg = <0xde00 0x6>;
+		};
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_bdinfo_de00>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	nvmem-cells = <&macaddr_bdinfo_de00>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <1>;
+};
+
+&wifi {
+	nvmem-cells = <&macaddr_bdinfo_de00>;
+	nvmem-cell-names = "mac-address";
+};
diff --git a/target/linux/ramips/dts/mt7621_cudy_x6.dtsi b/target/linux/ramips/dts/mt7621_cudy_x6.dtsi
new file mode 100644
index 00000000000000..4c34f58a4b2a99
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_cudy_x6.dtsi
@@ -0,0 +1,143 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	aliases {
+		led-boot = &led_internet_blue;
+		led-failsafe = &led_internet_red;
+		led-running = &led_internet_blue;
+		led-upgrade = &led_internet_red;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_internet_blue: internet_blue {
+			label = "blue:internet";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		led_internet_red: internet_red {
+			label = "red:internet";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <50000000>;
+
+		partitions: partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			/* additional partitions in DTS */
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie1 {
+	wifi:wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0000>;
+		mediatek,disable-radar-background;
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy4>;
+};
+
+&mdio {
+	ethphy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan1";
+		};
+
+		port@1 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan4";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "uart3", "jtag";
+		function = "gpio";
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_d-team_newifi-d2.dts b/target/linux/ramips/dts/mt7621_d-team_newifi-d2.dts
index c04fe9e245daa4..33deb21dcaa061 100644
--- a/target/linux/ramips/dts/mt7621_d-team_newifi-d2.dts
+++ b/target/linux/ramips/dts/mt7621_d-team_newifi-d2.dts
@@ -5,7 +5,7 @@
 
 / {
 	compatible = "d-team,newifi-d2", "mediatek,mt7621-soc";
-	model = "Newifi-D2";
+	model = "D-Team Newifi D2";
 
 	aliases {
 		led-boot = &led_power_blue;
diff --git a/target/linux/ramips/dts/mt7621_dlink_dap-1620-b1.dts b/target/linux/ramips/dts/mt7621_dlink_dap-1620-b1.dts
new file mode 100644
index 00000000000000..919e5be4b9cc73
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_dlink_dap-1620-b1.dts
@@ -0,0 +1,158 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "dlink,dap-1620-b1", "mediatek,mt7621-soc";
+	model = "D-Link DAP-1620 B1";
+
+	aliases {
+		label-mac-device = &gmac0;
+
+		led-boot = &led_status_red;
+		led-failsafe = &led_status_green;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_red;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_red: status_red {
+			label = "red:status";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_green: status_green {
+			label = "green:status";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		};
+
+		rssi_low_red {
+			label = "red:rssilow";
+			gpios = <&gpio 25 GPIO_ACTIVE_LOW>;
+		};
+
+		rssi_low_green {
+			label = "green:rssilow";
+			gpios = <&gpio 24 GPIO_ACTIVE_LOW>;
+		};
+
+		rssi_med_green {
+			label = "green:rssimed";
+			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
+		};
+
+		rssi_high_green {
+			label = "green:rssihigh";
+			gpios = <&gpio 22 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <50000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_factory_e000: macaddr@e000 {
+					reg = <0xe000 0x6>;
+				};
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x50000 0xfb0000>;
+			};
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0>;
+		/* The correct MAC addresses are set in 10_fix_wifi_mac. */
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_e000>;
+	nvmem-cell-names = "mac-address";
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan";
+		};
+	};
+};
+
+&ethernet {
+	pinctrl-0 = <&mdio_pins>, <&rgmii1_pins>;
+};
+
+&state_default {
+	gpio {
+		groups = "uart3", "jtag", "wdt";
+		function = "gpio";
+	};
+};
+
diff --git a/target/linux/ramips/dts/mt7621_dlink_dap-x1860-a1.dts b/target/linux/ramips/dts/mt7621_dlink_dap-x1860-a1.dts
new file mode 100644
index 00000000000000..818d2d8c413191
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_dlink_dap-x1860-a1.dts
@@ -0,0 +1,209 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "dlink,dap-x1860-a1", "mediatek,mt7621-soc";
+	model = "D-Link DAP-X1860 A1";
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	aliases {
+		label-mac-device = &gmac0;
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_red;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 6 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power_green: power_green {
+			label = "green:power";
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+
+		led_power_red: power_red {
+			label = "red:power";
+			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
+		};
+
+		power_orange {
+			label = "orange:power";
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+		};
+
+		rssihigh {
+			label = "green:rssihigh";
+			gpios = <&gpio 22 GPIO_ACTIVE_LOW>;
+		};
+
+		rssimedium {
+			label = "green:rssimedium";
+			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
+		};
+
+		rssilow_orange {
+			label = "orange:rssilow";
+			gpios = <&gpio 26 GPIO_ACTIVE_LOW>;
+		};
+
+		rssilow_green {
+			label = "green:rssilow";
+			gpios = <&gpio 27 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	virtual_flash {
+		compatible = "mtd-concat";
+
+		devices = <&fwconcat0 &fwconcat1>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "ubi";
+				reg = <0x0 0x0>;
+			};
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	mediatek,nmbm;
+	/* rsvd = Remapping Range / NAND Erase-Size */
+	/* rsvd = 0x800000 / 0x20000 */
+	mediatek,bmt-max-reserved-blocks = <64>;
+	/* Remapping should include raw-nand we operate upon without UBI layer. */
+	/* This includes (at least) the kernel which has to be loaded by U-Boot.*/
+	mediatek,bmt-remap-range =
+		<0x0 0x980000>;
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "bootloader";
+			reg = <0x0 0x80000>;
+			read-only;
+		};
+
+		partition@80000 {
+			label = "config";
+			reg = <0x80000 0x80000>;
+			read-only;
+		};
+
+		factory: partition@100000 {
+			label = "factory";
+			reg = <0x100000 0x80000>;
+			read-only;
+
+			compatible = "nvmem-cells";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			macaddr_factory_4: macaddr@4 {
+				reg = <0x4 0x6>;
+			};
+		};
+
+		partition@180000 {
+			label = "kernel";
+			reg = <0x180000 0x0800000>;
+		};
+
+		fwconcat0: partition@980000 {
+			label = "fwconcat0";
+			reg = <0x980000 0x2c00000>;
+		};
+
+		partition@3580000 {
+			label = "manufacture";
+			reg = <0x3580000 0x400000>;
+			read-only;
+		};
+
+		partition@3980000 {
+			label = "storage";
+			reg = <0x3980000 0x680000>;
+			read-only;
+		};
+
+		fwconcat1: partition@4000000 {
+			label = "fwconcat1";
+			reg = <0x4000000 0x3800000>;
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0>;
+		mediatek,disable-radar-background;
+	};
+};
+
+&ethernet {
+	pinctrl-0 = <&mdio_pins>, <&rgmii1_pins>;
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_4>;
+	nvmem-cell-names = "mac-address";
+};
+
+&switch0 {
+	gpio-controller;
+	#gpio-cells = <2>;
+
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "uart2";
+		function = "gpio";
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_dlink_dir-1935-a1.dts b/target/linux/ramips/dts/mt7621_dlink_dir-1935-a1.dts
new file mode 100644
index 00000000000000..a6a0eb8ba044f4
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_dlink_dir-1935-a1.dts
@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621_dlink_dir-8xx.dtsi"
+#include "mt7621_dlink_flash-16m-a1.dtsi"
+
+/ {
+	compatible = "dlink,dir-1935-a1", "mediatek,mt7621-soc";
+	model = "D-Link DIR-1935 A1";
+
+	aliases {
+		label-mac-device = &gmac0;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_e000>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	nvmem-cells = <&macaddr_factory_e006>;
+	nvmem-cell-names = "mac-address";
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_e000: macaddr@e000 {
+		reg = <0xe000 0x6>;
+	};
+
+	macaddr_factory_e006: macaddr@e006 {
+		reg = <0xe006 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_dlink_dir-3060-a1.dts b/target/linux/ramips/dts/mt7621_dlink_dir-3060-a1.dts
new file mode 100644
index 00000000000000..943143ad634de2
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_dlink_dir-3060-a1.dts
@@ -0,0 +1,241 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "dlink,dir-3060-a1", "mediatek,mt7621-soc";
+	model = "D-Link DIR-3060 A1";
+
+	aliases {
+		label-mac-device = &gmac0;
+		led-boot = &led_power_orange;
+		led-failsafe = &led_power_white;
+		led-running = &led_power_white;
+		led-upgrade = &led_net_orange;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 6 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power_orange: power_orange {
+			label = "orange:power";
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_white: power_white {
+			label = "white:power";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+		};
+
+		led_net_orange: net_orange {
+			label = "orange:net";
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+		};
+
+		net_white {
+			label = "white:net";
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+		};
+
+		usb2_white {
+			label = "white:usb2";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			trigger-sources = <&ehci_port2>;
+			linux,default-trigger = "usbport";
+		};
+
+		usb3_white {
+			label = "white:usb3";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+			trigger-sources = <&xhci_ehci_port1>;
+			linux,default-trigger = "usbport";
+		};
+
+		wlan2g {
+			label = "white:wlan2g";
+			gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy0radio";
+		};
+
+		wlan5glb {
+			label = "white:wlan5glb";
+			gpios = <&gpio 9 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy1radio";
+		};
+
+		wlan5ghb {
+			label = "white:wlan5ghb";
+			gpios = <&gpio 5 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy2radio";
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "Bootloader";
+			reg = <0x0 0x80000>;
+			read-only;
+		};
+
+		partition@80000 {
+			label = "config";
+			reg = <0x80000 0x80000>;
+			read-only;
+		};
+
+		factory: partition@100000 {
+			label = "factory";
+			reg = <0x100000 0x40000>;
+			read-only;
+		};
+
+		partition@140000 {
+			label = "config2";
+			reg = <0x140000 0x40000>;
+			read-only;
+		};
+
+		partition@180000 {
+			label = "firmware";
+			compatible = "openwrt,uimage", "denx,uimage";
+			openwrt,padding = <96>;
+			reg = <0x180000 0x2800000>;
+		};
+
+		partition@2980000 {
+			label = "private";
+			reg = <0x2980000 0x2000000>;
+			read-only;
+		};
+
+		partition@4980000 {
+			label = "firmware2";
+			reg = <0x4980000 0x2800000>;
+			read-only;
+		};
+
+		partition@7180000 {
+			label = "mydlink";
+			reg = <0x7180000 0x600000>;
+			read-only;
+		};
+
+		partition@7780000 {
+			label = "reserved";
+			reg = <0x7780000 0x880000>;
+			read-only;
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi0: wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0>;
+		ieee80211-freq-limit = <2400000 6000000>;
+		nvmem-cells = <&macaddr_factory_e000>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <1>;
+	};
+};
+
+&pcie1 {
+	wifi1: wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x8000>;
+		ieee80211-freq-limit = <5000000 6000000>;
+		nvmem-cells = <&macaddr_factory_e000>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <3>;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_e000>;
+	nvmem-cell-names = "mac-address";
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan4";
+		};
+
+		port@1 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan1";
+		};
+
+		port@4 {
+			status = "okay";
+			label = "wan";
+			nvmem-cells = <&macaddr_factory_e006>;
+			nvmem-cell-names = "mac-address";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "uart3", "jtag", "wdt";
+		function = "gpio";
+	};
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_e000: macaddr@e000 {
+		reg = <0xe000 0x6>;
+	};
+
+	macaddr_factory_e006: macaddr@e006 {
+		reg = <0xe006 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_dlink_dir-853-a1.dts b/target/linux/ramips/dts/mt7621_dlink_dir-853-a1.dts
new file mode 100644
index 00000000000000..2b6b811abe6550
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_dlink_dir-853-a1.dts
@@ -0,0 +1,216 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "dlink,dir-853-a1", "mediatek,mt7621-soc";
+	model = "D-Link DIR-853 A1";
+
+	aliases {
+		led-boot = &led_power_orange;
+		led-failsafe = &led_power_blue;
+		led-running = &led_power_blue;
+		led-upgrade = &led_net_orange;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		wifi {
+			label = "wifi";
+			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		wlan5g {
+			label = "blue:wlan5g";
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1radio";
+		};
+
+		wlan2g {
+			label = "blue:wlan2g";
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0radio";
+		};
+
+		usb_blue {
+			label = "blue:usb";
+			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
+			trigger-sources = <&xhci_ehci_port1>;
+			linux,default-trigger = "usbport";
+		};
+
+		led_power_orange: power_orange {
+			label = "orange:power";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_blue: power_blue {
+			label = "blue:power";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		};
+
+		led_net_orange: net_orange {
+			label = "orange:net";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		net_blue {
+			label = "blue:net";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <50000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			partition@50000 {
+				label = "config2_stock";
+				reg = <0x50000 0x10000>;
+				read-only;
+			};
+
+			partition@60000 {
+				compatible = "openwrt,uimage", "denx,uimage";
+				openwrt,padding = <96>;
+				label = "firmware";
+				reg = <0x60000 0xf50000>;
+			};
+
+			partition@fb0000 {
+				label = "private_stock";
+				reg = <0xfb0000 0x50000>;
+				read-only;
+			};
+		};
+	};
+};
+
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0>;
+
+		/* The correct Mac addresses are set in 10_fix_wifi_mac. */
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_e000>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy4>;
+
+	nvmem-cells = <&macaddr_factory_e006>;
+	nvmem-cell-names = "mac-address";
+};
+
+&mdio {
+	ethphy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan4";
+		};
+
+		port@1 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan1";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "uart2", "uart3", "jtag", "wdt";
+		function = "gpio";
+	};
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_e000: macaddr@e000 {
+		reg = <0xe000 0x6>;
+	};
+
+	macaddr_factory_e006: macaddr@e006 {
+		reg = <0xe006 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_elecom_wrc-2533ghbk-i.dts b/target/linux/ramips/dts/mt7621_elecom_wrc-2533ghbk-i.dts
index 8da1099dc94852..8eef1eb5811166 100644
--- a/target/linux/ramips/dts/mt7621_elecom_wrc-2533ghbk-i.dts
+++ b/target/linux/ramips/dts/mt7621_elecom_wrc-2533ghbk-i.dts
@@ -1,206 +1,46 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 
-#include "mt7621.dtsi"
-
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
+#include "mt7621_elecom_wrc-2533ghbk.dtsi"
 
 / {
 	compatible = "elecom,wrc-2533ghbk-i", "mediatek,mt7621-soc";
 	model = "ELECOM WRC-2533GHBK-I";
-
-	aliases {
-		led-boot = &led_power;
-		led-failsafe = &led_power;
-		led-running = &led_power;
-		led-upgrade = &led_power;
-	};
-
-	leds {
-		compatible = "gpio-leds";
-
-		wps {
-			label = "red:wps";
-			gpios = <&gpio 7 GPIO_ACTIVE_HIGH>;
-		};
-
-		led_power: power {
-			label = "white:power";
-			gpios = <&gpio 12 GPIO_ACTIVE_HIGH>;
-		};
-
-		wlan2g {
-			label = "white:wlan2g";
-			gpios = <&gpio 14 GPIO_ACTIVE_HIGH>;
-			linux,default-trigger = "phy0radio";
-		};
-
-		wlan5g {
-			label = "white:wlan5g";
-			gpios = <&gpio 15 GPIO_ACTIVE_HIGH>;
-			linux,default-trigger = "phy1radio";
-		};
-	};
-
-	keys {
-		compatible = "gpio-keys";
-
-		auto {
-			label = "auto";
-			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
-			linux,code = <BTN_0>;
-			linux,input-type = <EV_SW>;
-		};
-
-		reset {
-			label = "reset";
-			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
-			linux,code = <KEY_RESTART>;
-		};
-
-		wps {
-			label = "wps";
-			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
-			linux,code = <KEY_WPS_BUTTON>;
-		};
-	};
 };
 
-&spi0 {
-	status = "okay";
-
-	flash@0 {
-		compatible = "jedec,spi-nor";
-		reg = <0>;
-		spi-max-frequency = <40000000>;
-
-		partitions {
-			compatible = "fixed-partitions";
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			partition@0 {
-				label = "u-boot";
-				reg = <0x0 0x30000>;
-				read-only;
-			};
-
-			partition@30000 {
-				label = "u-boot-env";
-				reg = <0x30000 0x10000>;
-				read-only;
-			};
-
-			factory: partition@40000 {
-				label = "factory";
-				reg = <0x40000 0x10000>;
-				read-only;
-			};
-
-			partition@50000 {
-				compatible = "denx,uimage";
-				label = "firmware";
-				reg = <0x50000 0x9a0000>;
-			};
-
-			partition@9f0000 {
-				label = "TM_1";
-				reg = <0x9f0000 0x200000>;
-				read-only;
-			};
-
-			partition@bf0000 {
-				label = "TM_2";
-				reg = <0xbf0000 0x200000>;
-				read-only;
-			};
-
-			partition@df0000 {
-				label = "manufacture";
-				reg = <0xdf0000 0x180000>;
-				read-only;
-			};
-
-			partition@f70000 {
-				label = "backup";
-				reg = <0xf70000 0x10000>;
-				read-only;
-			};
-
-			partition@f80000 {
-				label = "storage";
-				reg = <0xf80000 0x80000>;
-				read-only;
-			};
-		};
+&partitions {
+	partition@50000 {
+		compatible = "denx,uimage";
+		label = "firmware";
+		reg = <0x50000 0x9a0000>;
 	};
-};
-
-&gmac1 {
-	status = "okay";
-	label = "wan";
-	phy-handle = <&ethphy0>;
-};
 
-&mdio {
-	ethphy0: ethernet-phy@0 {
-		reg = <0>;
+	partition@9f0000 {
+		label = "TM_1";
+		reg = <0x9f0000 0x200000>;
+		read-only;
 	};
-};
-
-&switch0 {
-	ports {
-		port@1 {
-			status = "okay";
-			label = "lan4";
-		};
 
-		port@2 {
-			status = "okay";
-			label = "lan3";
-		};
-
-		port@3 {
-			status = "okay";
-			label = "lan2";
-		};
-
-		port@4 {
-			status = "okay";
-			label = "lan1";
-		};
+	partition@bf0000 {
+		label = "TM_2";
+		reg = <0xbf0000 0x200000>;
+		read-only;
 	};
-};
 
-&state_default {
-	gpio {
-		groups = "uart2", "uart3", "jtag", "wdt";
-		function = "gpio";
+	partition@df0000 {
+		label = "manufacture";
+		reg = <0xdf0000 0x180000>;
+		read-only;
 	};
-};
 
-&pcie {
-	status = "okay";
-};
-
-&pcie0 {
-	wifi@0,0 {
-		compatible = "mediatek,mt76";
-		reg = <0x0000 0 0 0 0>;
-		mediatek,mtd-eeprom = <&factory 0x0>;
-		ieee80211-freq-limit = <2400000 2500000>;
+	partition@f70000 {
+		label = "backup";
+		reg = <0xf70000 0x10000>;
+		read-only;
 	};
-};
 
-&pcie1 {
-	wifi@0,0 {
-		compatible = "mediatek,mt76";
-		reg = <0x0000 0 0 0 0>;
-		mediatek,mtd-eeprom = <&factory 0x8000>;
-		ieee80211-freq-limit = <5000000 6000000>;
+	partition@f80000 {
+		label = "storage";
+		reg = <0xf80000 0x80000>;
+		read-only;
 	};
 };
-
-&xhci {
-	status = "disabled";
-};
diff --git a/target/linux/ramips/dts/mt7621_elecom_wrc-2533ghbk.dtsi b/target/linux/ramips/dts/mt7621_elecom_wrc-2533ghbk.dtsi
new file mode 100644
index 00000000000000..e9f968dbe021ed
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_elecom_wrc-2533ghbk.dtsi
@@ -0,0 +1,178 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		wps {
+			label = "red:wps";
+			gpios = <&gpio 7 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WPS;
+		};
+
+		led_power: power {
+			label = "white:power";
+			gpios = <&gpio 12 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_WHITE>;
+			function = LED_FUNCTION_POWER;
+		};
+
+		wlan2g {
+			label = "white:wlan2g";
+			gpios = <&gpio 14 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_WHITE>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <1>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wlan5g {
+			label = "white:wlan5g";
+			gpios = <&gpio 15 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_WHITE>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <2>;
+			linux,default-trigger = "phy1tpt";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		auto {
+			label = "auto";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+			linux,input-type = <EV_SW>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <40000000>;
+
+		partitions: partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy0>;
+};
+
+&mdio {
+	ethphy0: ethernet-phy@0 {
+		reg = <0>;
+	};
+};
+
+&switch0 {
+	ports {
+		port@1 {
+			status = "okay";
+			label = "lan4";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@4 {
+			status = "okay";
+			label = "lan1";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "uart2", "uart3", "jtag", "wdt";
+		function = "gpio";
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0>;
+		ieee80211-freq-limit = <2400000 2500000>;
+	};
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x8000>;
+		ieee80211-freq-limit = <5000000 6000000>;
+	};
+};
+
+&xhci {
+	status = "disabled";
+};
diff --git a/target/linux/ramips/dts/mt7621_elecom_wrc-2533ghbk2-t.dts b/target/linux/ramips/dts/mt7621_elecom_wrc-2533ghbk2-t.dts
new file mode 100644
index 00000000000000..f17c2c7112bc84
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_elecom_wrc-2533ghbk2-t.dts
@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621_elecom_wrc-2533ghbk.dtsi"
+
+/ {
+	compatible = "elecom,wrc-2533ghbk2-t", "mediatek,mt7621-soc";
+	model = "ELECOM WRC-2533GHBK2-T";
+};
+
+&partitions {
+	partition@50000 {
+		compatible = "denx,uimage";
+		label = "firmware";
+		reg = <0x50000 0x7a0000>;
+	};
+
+	partition@7f0000 {
+		label = "TM_1";
+		reg = <0x7f0000 0x200000>;
+		read-only;
+	};
+
+	partition@9f0000 {
+		label = "TM_2";
+		reg = <0x9f0000 0x400000>;
+		read-only;
+	};
+
+	partition@df0000 {
+		label = "manufacture";
+		reg = <0xdf0000 0x190000>;
+		read-only;
+	};
+
+	partition@f80000 {
+		label = "storage";
+		reg = <0xf80000 0x80000>;
+		read-only;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_etisalat_s3.dts b/target/linux/ramips/dts/mt7621_etisalat_s3.dts
new file mode 100644
index 00000000000000..65d168fd803259
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_etisalat_s3.dts
@@ -0,0 +1,247 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "etisalat,s3", "mediatek,mt7621-soc";
+	model = "Etisalat S3";
+
+	aliases {
+		label-mac-device = &gmac0;
+
+		led-boot = &led_status_green;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_red;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			label = "blue:wan";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&gpio 13 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_green: led-1 {
+			label = "green:status";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 15 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_red: led-2 {
+			label = "red:status";
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 16 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	ubi-concat {
+		compatible = "mtd-concat";
+		devices = <&ubiconcat0 &ubiconcat1 &ubiconcat2>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "ubi";
+				reg = <0x0 0x4f80000>;
+			};
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	partitions {
+		compatible = "sercomm,sc-partitions", "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "u-boot";
+			reg = <0x0 0x100000>;
+			sercomm,scpart-id = <0>;
+			read-only;
+		};
+
+		partition@100000 {
+			label = "dynamic partition map";
+			reg = <0x100000 0x100000>;
+			sercomm,scpart-id = <1>;
+			read-only;
+		};
+
+		factory: partition@200000 {
+			label = "Factory";
+			reg = <0x200000 0x100000>;
+			sercomm,scpart-id = <2>;
+			read-only;
+
+			compatible = "nvmem-cells";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			macaddr_factory_21000: macaddr@21000 {
+				reg = <0x21000 0x6>;
+			};
+		};
+
+		partition@300000 {
+			label = "Boot Flag";
+			reg = <0x300000 0x100000>;
+			sercomm,scpart-id = <3>;
+		};
+
+		partition@400000 {
+			label = "kernel";
+			reg = <0x400000 0x600000>;
+			sercomm,scpart-id = <4>;
+		};
+
+		partition@a00000 {
+			label = "Kernel 2";
+			reg = <0xa00000 0x600000>;
+			sercomm,scpart-id = <5>;
+			read-only;
+		};
+
+		ubiconcat0: partition@1000000 {
+			label = "File System 1";
+			reg = <0x1000000 0x2000000>;
+			sercomm,scpart-id = <6>;
+		};
+
+		partition@3000000 {
+			label = "File System 2";
+			reg = <0x3000000 0x2000000>;
+			sercomm,scpart-id = <7>;
+			read-only;
+		};
+
+		ubiconcat1: partition@5000000 {
+			label = "Configuration/log";
+			reg = <0x5000000 0x1400000>;
+			sercomm,scpart-id = <8>;
+		};
+
+		ubiconcat2: partition@6400000 {
+			label = "application tmp buffer (Ftool)";
+			reg = <0x6400000 0x1b80000>;
+			sercomm,scpart-id = <9>;
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x8000>;
+		ieee80211-freq-limit = <5000000 6000000>;
+
+		nvmem-cells = <&macaddr_factory_21000>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <(3)>;
+	};
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0>;
+		ieee80211-freq-limit = <2400000 2500000>;
+
+		nvmem-cells = <&macaddr_factory_21000>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <(2)>;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_21000>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy0>;
+
+	nvmem-cells = <&macaddr_factory_21000>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <(11)>;
+};
+
+&mdio {
+	ethphy0: ethernet-phy@0 {
+		reg = <0>;
+	};
+};
+
+&switch0 {
+	ports {
+		port@1 {
+			status = "okay";
+			label = "lan1";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@4 {
+			status = "okay";
+			label = "lan4";
+		};
+	};
+};
+
+&uartlite3 {
+	status = "okay";
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "jtag";
+		function = "gpio";
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_glinet_gl-mt1300.dts b/target/linux/ramips/dts/mt7621_glinet_gl-mt1300.dts
index a332a87a572757..d5440b3a5108e0 100644
--- a/target/linux/ramips/dts/mt7621_glinet_gl-mt1300.dts
+++ b/target/linux/ramips/dts/mt7621_glinet_gl-mt1300.dts
@@ -67,8 +67,7 @@
 	flash@0 {
 		compatible = "jedec,spi-nor";
 		reg = <0>;
-		spi-max-frequency = <80000000>;
-		m25p,fast-read;
+		spi-max-frequency = <50000000>;
 		broken-flash-reset;
 
 		partitions {
diff --git a/target/linux/ramips/dts/mt7621_gnubee_gb-pc1.dts b/target/linux/ramips/dts/mt7621_gnubee_gb-pc1.dts
index 29f9f09ee587a5..809df6dde334ee 100644
--- a/target/linux/ramips/dts/mt7621_gnubee_gb-pc1.dts
+++ b/target/linux/ramips/dts/mt7621_gnubee_gb-pc1.dts
@@ -27,16 +27,6 @@
 	leds {
 		compatible = "gpio-leds";
 
-		ethblack_act {
-			label = "green:ethblack_act";
-			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
-		};
-
-		ethblue_act {
-			label = "green:ethblue_act";
-			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
-		};
-
 		power {
 			label = "green:power";
 			gpios = <&gpio 6 GPIO_ACTIVE_LOW>;
diff --git a/target/linux/ramips/dts/mt7621_gnubee_gb-pc2.dts b/target/linux/ramips/dts/mt7621_gnubee_gb-pc2.dts
index cd72ea1d62801b..c18f10250226de 100644
--- a/target/linux/ramips/dts/mt7621_gnubee_gb-pc2.dts
+++ b/target/linux/ramips/dts/mt7621_gnubee_gb-pc2.dts
@@ -27,16 +27,26 @@
 	leds {
 		compatible = "gpio-leds";
 
-		ethblack_act {
-			label = "green:ethblack_act";
+		ethblack-green {
+			label = "green:ethblack";
 			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
 		};
 
-		ethblue_act {
-			label = "green:ethblue_act";
+		ethblue-green {
+			label = "green:ethblue";
 			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
 		};
 
+		ethyellow-green {
+			label = "green:ethyellow";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		ethyellow-orange {
+			label = "orange:ethyellow";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		};
+
 		power {
 			label = "green:power";
 			gpios = <&gpio 6 GPIO_ACTIVE_LOW>;
@@ -108,6 +118,7 @@
 &gmac1 {
 	status = "okay";
 	label = "ethyellow";
+	phy-mode = "rgmii-rxid";
 	phy-handle = <&ethphy5>;
 
 	nvmem-cells = <&macaddr_factory_e000>;
@@ -117,7 +128,6 @@
 &mdio {
 	ethphy5: ethernet-phy@5 {
 		reg = <5>;
-		phy-mode = "rgmii-rxid";
 	};
 };
 
diff --git a/target/linux/ramips/dts/mt7621_h3c_tx180x.dtsi b/target/linux/ramips/dts/mt7621_h3c_tx180x.dtsi
index 61f2f8cc98c01a..fe374bfa6b01f0 100644
--- a/target/linux/ramips/dts/mt7621_h3c_tx180x.dtsi
+++ b/target/linux/ramips/dts/mt7621_h3c_tx180x.dtsi
@@ -16,6 +16,7 @@
 
 	chosen {
 		bootargs = "console=ttyS0,115200";
+		bootargs-override = "console=ttyS0,115200";
 	};
 
 	keys {
@@ -137,8 +138,11 @@
 	};
 };
 
-&pcie2 {
-	status = "disabled";
+&state_default {
+	gpio {
+		groups = "jtag";
+		function = "gpio";
+	};
 };
 
 &switch0 {
diff --git a/target/linux/ramips/dts/mt7621_haier-sim_wr1800k.dtsi b/target/linux/ramips/dts/mt7621_haier-sim_wr1800k.dtsi
new file mode 100644
index 00000000000000..4dd6f3b0ae5533
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_haier-sim_wr1800k.dtsi
@@ -0,0 +1,183 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	aliases {
+		label-mac-device = &gmac1;
+		led-boot = &led_status_red;
+		led-failsafe = &led_status_blue;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_blue;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+		bootargs-override = "console=ttyS0,115200";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_blue: led-0 {
+			label = "blue:status";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 6 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_green: led-1 {
+			label = "green:status";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_red: led-2 {
+			label = "red:status";
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_8004>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy4>;
+
+	nvmem-cells = <&macaddr_factory_8004>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <(-3)>;
+};
+
+&mdio {
+	ethphy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&nand {
+	status = "okay";
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "u-boot";
+			reg = <0x0000000 0x0080000>;
+			read-only;
+		};
+
+		partition@80000 {
+			label = "u-boot-env";
+			reg = <0x0080000 0x0080000>;
+		};
+
+		factory: partition@100000 {
+			label = "factory";
+			reg = <0x0100000 0x0080000>;
+			read-only;
+
+			compatible = "nvmem-cells";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			macaddr_factory_8004: macaddr@8004 {
+				reg = <0x8004 0x6>;
+			};
+		};
+
+		partition@180000 {
+			label = "firmware";
+			reg = <0x0180000 0x7a80000>;
+
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "kernel";
+				reg = <0x0000000 0x0400000>;
+			};
+
+			partition@400000 {
+				label = "ubi";
+				reg = <0x0400000 0x7680000>;
+			};
+		};
+
+		/* last 128KiB *32 is reserved for bad blocks management */
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0>;
+		mediatek,disable-radar-background;
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "uart3", "wdt";
+		function = "gpio";
+	};
+};
+
+&switch0 {
+	ports {
+		port@1 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan1";
+		};
+	};
+};
+
+&xhci {
+	status = "disabled";
+};
diff --git a/target/linux/ramips/dts/mt7621_haier_har-20s2u1.dts b/target/linux/ramips/dts/mt7621_haier_har-20s2u1.dts
new file mode 100644
index 00000000000000..dede7dbb200ce3
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_haier_har-20s2u1.dts
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621_haier-sim_wr1800k.dtsi"
+
+/ {
+	compatible = "haier,har-20s2u1", "mediatek,mt7621-soc";
+	model = "Haier HAR-20S2U1";
+};
diff --git a/target/linux/ramips/dts/mt7621_hanyang_hyc-g920.dts b/target/linux/ramips/dts/mt7621_hanyang_hyc-g920.dts
new file mode 100644
index 00000000000000..c4e28b96df5da6
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_hanyang_hyc-g920.dts
@@ -0,0 +1,198 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "hanyang,hyc-g920", "mediatek,mt7621-soc";
+	model = "CJ-Hello HYC-G920";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+		bootargs-override = "console=ttyS0,115200";
+	};
+	
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: power {
+			label = "red:power";
+			gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
+		};
+
+		usb {
+			label = "green:usb";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			trigger-sources = <&ehci_port2>;
+			linux,default-trigger = "usbport";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <40000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "bootloader";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "mac";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x50000 0xfb0000>;
+			};
+
+			partition@fb0000 {
+				label = "config ";
+				reg = <0xfb0000 0x20000>;
+				read-only;
+			};
+
+			partition@fd0000 {
+				label = "config_bak ";
+				reg = <0xfd0000 0x20000>;
+				read-only;
+			};
+
+			partition@ff0000 {
+				label = "mac_bak ";
+				reg = <0xff0000 0x10000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x8000>;
+		ieee80211-freq-limit = <5000000 6000000>;
+
+		led {
+			led-sources = <2>;
+			led-active-low;
+		};
+	};
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0000>;
+		ieee80211-freq-limit = <2400000 2500000>;
+
+		led {
+			led-sources = <2>;
+			led-active-low;
+		};
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_4>;
+	nvmem-cell-names = "mac-address";
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "wan";
+			nvmem-cells = <&macaddr_factory_4>;
+			nvmem-cell-names = "mac-address";
+			mac-address-increment = <1>;
+		};
+
+		port@1 {
+			status = "okay";
+			label = "lan1";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@4 {
+			status = "okay";
+			label = "lan4";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "sdhci";
+		function = "gpio";
+	};
+};
+	
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_4: macaddr@4 {
+		reg = <0x4 0x6>;
+	};
+
+	macaddr_factory_8004: macaddr@8004 {
+		reg = <0x8004 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_huasifei_ws1208v2.dts b/target/linux/ramips/dts/mt7621_huasifei_ws1208v2.dts
new file mode 100644
index 00000000000000..fe77f6520746a5
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_huasifei_ws1208v2.dts
@@ -0,0 +1,185 @@
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "huasifei,ws1208v2", "mediatek,mt7621-soc";
+	model = "Huasifei WS1208V2";
+
+	aliases {
+		led-boot = &led_status;
+		led-failsafe = &led_status;
+		led-running = &led_status;
+		led-upgrade = &led_status;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "Reset";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status: led-status {
+			label = "green:status";
+			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
+		};
+
+		led-cellular {
+			label = "green:cellular";
+			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
+		};
+
+		led-wlan5g {
+			label = "green:wlan5g";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		led-wlan2g {
+			label = "green:wlan2g";
+			gpios = <&gpio 5 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led-usb {
+			label = "green:usb";
+			gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
+			trigger-sources = <&xhci_ehci_port1>;
+			linux,default-trigger = "usbport";
+		};
+	};
+};
+
+&sdhci {
+	status = "okay";
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_factory_e000: macaddr@e000 {
+					reg = <0xe000 0x6>;
+				};
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				reg = <0x50000 0xfb0000>;
+				label = "firmware";
+			};
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "pci14c3,7603";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0000>;
+	};
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "pci14c3,7662";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x8000>;
+		ieee80211-freq-limit = <5000000 6000000>;
+
+		led {
+			led-sources = <2>;
+		};
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_e000>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy4>;
+
+	nvmem-cells = <&macaddr_factory_e000>;
+	nvmem-cell-names = "mac-address";
+};
+
+&mdio {
+	ethphy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan1";
+		};
+
+		port@1 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan4";
+		};
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_iodata_wn-dx1200gr.dts b/target/linux/ramips/dts/mt7621_iodata_wn-dx1200gr.dts
index 4837f29a46ce3b..653132bc6192f2 100644
--- a/target/linux/ramips/dts/mt7621_iodata_wn-dx1200gr.dts
+++ b/target/linux/ramips/dts/mt7621_iodata_wn-dx1200gr.dts
@@ -58,6 +58,11 @@
 &nand {
 	status = "okay";
 
+	mediatek,bbt;
+	mediatek,bmt-remap-range =
+		<0x0000000 0x0800000>,
+		<0x3600000 0x4980000>;
+
 	partitions {
 		compatible = "fixed-partitions";
 		#address-cells = <1>;
diff --git a/target/linux/ramips/dts/mt7621_iodata_wn-xx-xr.dtsi b/target/linux/ramips/dts/mt7621_iodata_wn-xx-xr.dtsi
index 89e7f4b3e9fc2b..4b42fcb7de72e5 100644
--- a/target/linux/ramips/dts/mt7621_iodata_wn-xx-xr.dtsi
+++ b/target/linux/ramips/dts/mt7621_iodata_wn-xx-xr.dtsi
@@ -55,6 +55,11 @@
 &nand {
 	status = "okay";
 
+	mediatek,bbt;
+	mediatek,bmt-remap-range =
+		<0x0000000 0x0800000>,
+		<0x3600000 0x4980000>;
+
 	partitions: partitions {
 		compatible = "fixed-partitions";
 		#address-cells = <1>;
diff --git a/target/linux/ramips/dts/mt7621_keenetic_kn-3010.dts b/target/linux/ramips/dts/mt7621_keenetic_kn-3010.dts
new file mode 100644
index 00000000000000..69080df6822ae4
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_keenetic_kn-3010.dts
@@ -0,0 +1,258 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "keenetic,kn-3010", "mediatek,mt7621-soc";
+	model = "Keenetic KN-3010";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: power {
+			label = "green:power";
+			gpios = <&gpio 45 GPIO_ACTIVE_HIGH>;
+		};
+
+		internet {
+			label = "green:internet";
+			gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
+		};
+
+		wifi2 {
+			label = "green:wifi2";
+			gpios = <&gpio 47 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wifi5 {
+			label = "green:wifi5";
+			gpios = <&gpio 48 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		fn {
+			label = "fn";
+			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 41 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	virtual_flash {
+		compatible = "mtd-concat";
+		devices = <&firmware1 &firmware2>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x0 0x1ec0000>;
+			};
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "uart3", "sdhci";
+		function = "gpio";
+	};
+};
+
+&xhci {
+	status = "disabled";
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <31000000>;
+
+		partitions: partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-config";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@40000 {
+				label = "rf-eeprom";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			firmware1: partition@50000 {
+				label = "firmware_1";
+				reg = <0x50000 0xf60000>;
+			};
+
+			partition@fb0000 {
+				label = "config_1";
+				reg = <0xfb0000 0x40000>;
+				read-only;
+			};
+
+			partition@ff0000 {
+				label = "dump";
+				reg = <0xff0000 0x10000>;
+				read-only;
+			};
+
+			partition@1000000 {
+				label = "u-state";
+				reg = <0x1000000 0x30000>;
+				read-only;
+			};
+
+			partition@1030000 {
+				label = "u-config_res";
+				reg = <0x1030000 0x10000>;
+				read-only;
+			};
+
+			partition@1040000 {
+				label = "rf-eeprom_res";
+				reg = <0x1040000 0x10000>;
+				read-only;
+			};
+
+			firmware2: partition@1050000 {
+				label = "firmware_2";
+				reg = <0x1050000 0xf60000>;
+			};
+
+			partition@1fb0000 {
+				label = "config_2";
+				reg = <0x1fb0000 0x40000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&mdio {
+	ethphy0: ethernet-phy@0 {
+		reg = <0>;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_4>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy0>;
+
+	nvmem-cells = <&macaddr_factory_28>;
+	nvmem-cell-names = "mac-address";
+};
+
+&switch0 {
+	ports {
+		port@1 {
+			status = "okay";
+			label = "lan1";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@4 {
+			status = "okay";
+			label = "lan4";
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0000>;
+		ieee80211-freq-limit = <2400000 2500000>;
+	};
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0400>;
+		ieee80211-freq-limit = <5000000 6000000>;
+	};
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_4: macaddr@4 {
+		reg = <0x4 0x6>;
+	};
+
+	macaddr_factory_28: macaddr@28 {
+		reg = <0x28 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_lenovo_newifi-d1.dts b/target/linux/ramips/dts/mt7621_lenovo_newifi-d1.dts
index a6e38234dafba4..810ca3361af51f 100644
--- a/target/linux/ramips/dts/mt7621_lenovo_newifi-d1.dts
+++ b/target/linux/ramips/dts/mt7621_lenovo_newifi-d1.dts
@@ -5,7 +5,7 @@
 
 / {
 	compatible = "lenovo,newifi-d1", "mediatek,mt7621-soc";
-	model = "Newifi-D1";
+	model = "Lenovo Newifi D1";
 
 	aliases {
 		led-boot = &led_blue;
diff --git a/target/linux/ramips/dts/mt7621_linksys_e7350.dts b/target/linux/ramips/dts/mt7621_linksys_e7350.dts
index 0cdfcb468389f5..ea8a6841488a8f 100644
--- a/target/linux/ramips/dts/mt7621_linksys_e7350.dts
+++ b/target/linux/ramips/dts/mt7621_linksys_e7350.dts
@@ -57,40 +57,6 @@
 			function = LED_FUNCTION_WAN;
 			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
 		};
-
-		led-wan2 {
-			color = <LED_COLOR_ID_BLUE>;
-			function = LED_FUNCTION_WAN;
-			gpios = <&switch0 0 GPIO_ACTIVE_LOW>;
-		};
-
-		led-lan4 {
-			color = <LED_COLOR_ID_BLUE>;
-			function = LED_FUNCTION_LAN;
-			function-enumerator = <4>;
-			gpios = <&switch0 3 GPIO_ACTIVE_LOW>;
-		};
-
-		led-lan3 {
-			color = <LED_COLOR_ID_BLUE>;
-			function = LED_FUNCTION_LAN;
-			function-enumerator = <3>;
-			gpios = <&switch0 6 GPIO_ACTIVE_LOW>;
-		};
-
-		led-lan2 {
-			color = <LED_COLOR_ID_BLUE>;
-			function = LED_FUNCTION_LAN;
-			function-enumerator = <2>;
-			gpios = <&switch0 9 GPIO_ACTIVE_HIGH>;
-		};
-
-		led-lan1 {
-			color = <LED_COLOR_ID_BLUE>;
-			function = LED_FUNCTION_LAN;
-			function-enumerator = <1>;
-			gpios = <&switch0 12 GPIO_ACTIVE_LOW>;
-		};
 	};
 };
 
@@ -165,6 +131,13 @@
 	};
 };
 
+&state_default {
+	gpio {
+		groups = "i2c", "uart3", "jtag", "wdt";
+		function = "gpio";
+	};
+};
+
 &gmac1 {
 	status = "okay";
 	label = "wan";
@@ -178,9 +151,6 @@
 };
 
 &switch0 {
-	gpio-controller;
-	#gpio-cells = <2>;
-
 	ports {
 		port@1 {
 			status = "okay";
diff --git a/target/linux/ramips/dts/mt7621_linksys_ea6350-v4.dts b/target/linux/ramips/dts/mt7621_linksys_ea6350-v4.dts
index 654c9aa70f4ebc..71e8dcedbf0cfc 100644
--- a/target/linux/ramips/dts/mt7621_linksys_ea6350-v4.dts
+++ b/target/linux/ramips/dts/mt7621_linksys_ea6350-v4.dts
@@ -8,7 +8,7 @@
 };
 
 &gmac1 {
-        phy-handle = <&ethphy4>;
+	phy-handle = <&ethphy4>;
 };
 
 &mdio {
diff --git a/target/linux/ramips/dts/mt7621_linksys_re7000.dts b/target/linux/ramips/dts/mt7621_linksys_re7000.dts
new file mode 100644
index 00000000000000..5e33f4891590ae
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_linksys_re7000.dts
@@ -0,0 +1,154 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "linksys,re7000", "mediatek,mt7621-soc";
+	model = "Linksys RE7000";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		wifi {
+			label = "orange:wifi";
+			gpios = <&gpio 9 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wps {
+			label = "orange:wps";
+			gpios = <&gpio 24 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_power: power {
+			label = "green:power";
+			gpios = <&gpio 25 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x30000 0x1000>;
+			};
+
+			partition@32000 {
+				label = "config";
+				reg = <0x32000 0xe000>;
+				read-only;
+			};
+
+			factory: partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x50000 0xfb0000>;
+			};
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "uart2", "rgmii2";
+		function = "gpio";
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	mt76@0,0 {
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0000>;
+		ieee80211-freq-limit = <2400000 2500000>;
+	};
+};
+
+&pcie1 {
+	mt76@0,0 {
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x8000>;
+		ieee80211-freq-limit = <5000000 6000000>;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_2e>;
+	nvmem-cell-names = "mac-address";
+};
+
+&ethernet {
+	pinctrl-0 = <&mdio_pins>, <&rgmii1_pins>;
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan";
+		};
+	};
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_2e: macaddr@2e {
+		reg = <0x2e 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_mercusys_mr70x-v1.dts b/target/linux/ramips/dts/mt7621_mercusys_mr70x-v1.dts
new file mode 100644
index 00000000000000..245d130a1fcdab
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_mercusys_mr70x-v1.dts
@@ -0,0 +1,165 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "mercusys,mr70x-v1", "mediatek,mt7621-soc";
+	model = "Mercusys MR70X v1";
+
+	aliases {
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_orange;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_orange;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power_green: power-green {
+			label = "green:power";
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_orange: power-orange {
+			label = "orange:power";
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x040000>;
+				read-only;
+			};
+
+			partition@40000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x040000 0xf60000>;
+			};
+
+			config: partition@fa0000 {
+				label = "config";
+				reg = <0xfa0000 0x010000>;
+				read-only;
+			};
+
+			partition@fb0000 {
+				label = "tplink";
+				reg = <0xfb0000 0x040000>;
+				read-only;
+			};
+
+			radio: partition@ff0000 {
+				label = "radio";
+				reg = <0xff0000 0x010000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&radio 0x0>;
+		nvmem-cells = <&macaddr_config_8>;
+		nvmem-cell-names = "mac-address";
+		mediatek,disable-radar-background;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_config_8>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy0>;
+
+	nvmem-cells = <&macaddr_config_8>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <1>;
+};
+
+&mdio {
+	ethphy0: ethernet-phy@0 {
+		reg = <0>;
+	};
+};
+
+&switch0 {
+	ports {
+		port@1 {
+			status = "okay";
+			label = "lan1";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan3";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "uart3";
+		function = "gpio";
+	};
+};
+
+&config {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_config_8: macaddr@8 {
+		reg = <0x8 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_mikrotik_ltap-2hnd.dts b/target/linux/ramips/dts/mt7621_mikrotik_ltap-2hnd.dts
new file mode 100644
index 00000000000000..feeda9685e6870
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_mikrotik_ltap-2hnd.dts
@@ -0,0 +1,171 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621_mikrotik.dtsi"
+
+/ {
+	compatible = "mikrotik,ltap-2hnd", "mediatek,mt7621-soc";
+	model = "MikroTik RouterBOARD LtAP-2HnD";
+
+	aliases {
+		led-boot = &led_usr;
+		led-failsafe = &led_usr;
+		led-running = &led_usr;
+		led-upgrade = &led_usr;
+	};
+
+	ath9k-leds {
+		compatible = "gpio-leds";
+
+		rssi0 {
+			label = "green:rssi0";
+			gpios = <&ath9k 0 GPIO_ACTIVE_LOW>;
+		};
+		rssi1 {
+			label = "green:rssi1";
+			gpios = <&ath9k 1 GPIO_ACTIVE_LOW>;
+		};
+		rssi2 {
+			label = "green:rssi2";
+			gpios = <&ath9k 2 GPIO_ACTIVE_LOW>;
+		};
+		rssi3 {
+			label = "green:rssi3";
+			gpios = <&ath9k 3 GPIO_ACTIVE_LOW>;
+		};
+		rssi4 {
+			label = "green:rssi4";
+			gpios = <&ath9k 4 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		pwr {
+			label = "blue:pwr";
+			gpios = <&gpio 23 GPIO_ACTIVE_HIGH>;
+			default-state = "on";
+		};
+
+		led_usr: usr {
+			label = "green:usr";
+			gpios = <&gpio 0 GPIO_ACTIVE_HIGH>;
+		};
+
+		gps {
+			label = "green:gps";
+			gpios = <&gpio 28 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	/* TODO: find GPIOs for the WLAN antenna switches */
+	gpio-export {
+		compatible = "gpio-export";
+
+		usb-select {
+			gpio-export,name = "usb-select";
+			gpio-export,output = <1>;
+			gpios = <&gpio 12 GPIO_ACTIVE_HIGH>;
+		};
+		gps-reset {
+			gpio-export,name = "gps-reset";
+			gpio-export,output = <1>;
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		};
+		sim-select {
+			gpio-export,name = "sim-select";
+			gpio-export,output = <1>;
+			gpios = <&gpio 25 GPIO_ACTIVE_HIGH>;
+		};
+		gps-ant-select {
+			/* internal antenna = 0 */
+			gpio-export,name = "gps-ant-select";
+			gpio-export,output = <0>;
+			gpios = <&gpio 27 GPIO_ACTIVE_HIGH>;
+		};
+		lte-reset {
+			gpio-export,name = "lte-reset";
+			gpio-export,output = <1>;
+			gpios = <&gpio 29 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	pps {
+		compatible = "pps-gpio";
+		gpios = <&gpio 14 GPIO_ACTIVE_HIGH>;
+	};
+
+	pcie1_vcc_reg {
+		compatible = "regulator-fixed";
+		regulator-name = "pcie1_vcc";
+
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		gpio = <&gpio 10 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+		regulator-boot-on;
+	};
+
+	pcie2_vcc_reg {
+		compatible = "regulator-fixed";
+		regulator-name = "pcie2_vcc";
+
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		gpio = <&gpio 11 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+		regulator-boot-on;
+	};
+};
+
+&partitions {
+	partition@40000 {
+		compatible = "mikrotik,minor";
+		label = "firmware";
+		reg = <0x040000 0xfc0000>;
+	};
+};
+
+&ethernet {
+	pinctrl-0 = <&mdio_pins>, <&rgmii1_pins>;
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan";
+		};
+	};
+};
+
+&pcie0 {
+	status = "okay";
+
+	ath9k: wifi@0,0 {
+		compatible = "pci168c,0030";
+		reg = <0x0000 0 0 0 0>;
+		qca,no-eeprom;
+		gpio-controller;
+		#gpio-cells = <2>;
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "uart2", "wdt", "rgmii2";
+		function = "gpio";
+	};
+};
+
+&i2c {
+	status = "okay";
+};
+
+&pcie {
+	status = "okay";
+};
+
+&uartlite3 {
+	status = "okay";
+};
diff --git a/target/linux/ramips/dts/mt7621_mikrotik_routerboard-760igs.dts b/target/linux/ramips/dts/mt7621_mikrotik_routerboard-760igs.dts
index ed0b4e52cf9175..8b88cfe0a31e5e 100644
--- a/target/linux/ramips/dts/mt7621_mikrotik_routerboard-760igs.dts
+++ b/target/linux/ramips/dts/mt7621_mikrotik_routerboard-760igs.dts
@@ -49,6 +49,7 @@
 	status = "okay";
 
 	label = "sfp";
+	phy-mode = "rgmii-rxid";
 	phy-handle = <&ephy7>;
 };
 
diff --git a/target/linux/ramips/dts/mt7621_netgear_sercomm_ayx.dtsi b/target/linux/ramips/dts/mt7621_netgear_sercomm_ayx.dtsi
index 0ae6ab46f7a314..691aba106341f5 100644
--- a/target/linux/ramips/dts/mt7621_netgear_sercomm_ayx.dtsi
+++ b/target/linux/ramips/dts/mt7621_netgear_sercomm_ayx.dtsi
@@ -96,7 +96,7 @@
 	};
 };
 
-&pcie1 {
+&pcie2 {
 	wifi@0,0 {
 		compatible = "mediatek,mt76";
 		reg = <0x0 0 0 0 0>;
diff --git a/target/linux/ramips/dts/mt7621_netgear_sercomm_bzv.dtsi b/target/linux/ramips/dts/mt7621_netgear_sercomm_bzv.dtsi
index 9fa4af8fd666ce..ab96b8fdd121e4 100644
--- a/target/linux/ramips/dts/mt7621_netgear_sercomm_bzv.dtsi
+++ b/target/linux/ramips/dts/mt7621_netgear_sercomm_bzv.dtsi
@@ -223,47 +223,208 @@
 	status = "okay";
 
 	partitions {
-		compatible = "fixed-partitions";
+		compatible = "sercomm,sc-partitions", "fixed-partitions";
 		#address-cells = <1>;
 		#size-cells = <1>;
 
 		partition@0 {
 			label = "u-boot";
 			reg = <0x0 0x100000>;
+			sercomm,scpart-id = <0>;
 			read-only;
 		};
 
 		partition@100000 {
 			label = "SC PART_MAP";
 			reg = <0x100000 0x100000>;
+			sercomm,scpart-id = <1>;
 			read-only;
 		};
 
 		partition@200000 {
 			label = "kernel";
 			reg = <0x200000 0x400000>;
+			sercomm,scpart-id = <2>;
 		};
 
 		partition@600000 {
 			label = "ubi";
 			reg = <0x600000 0x2800000>;
+			sercomm,scpart-id = <3>;
 		};
 
 		partition@2e00000 {
-			label = "reserved0";
-			reg = <0x2e00000 0x1800000>;
+			label = "English UI";
+			reg = <0x2e00000 0x200000>;
+			sercomm,scpart-id = <4>;
+			read-only;
+		};
+
+		partition@3000000 {
+			label = "ML1";
+			reg = <0x3000000 0x200000>;
+			sercomm,scpart-id = <5>;
+			read-only;
+		};
+
+		partition@3200000 {
+			label = "ML2";
+			reg = <0x3200000 0x200000>;
+			sercomm,scpart-id = <6>;
+			read-only;
+		};
+
+		partition@3400000 {
+			label = "ML3";
+			reg = <0x3400000 0x200000>;
+			sercomm,scpart-id = <7>;
+			read-only;
+		};
+
+		partition@3600000 {
+			label = "ML4";
+			reg = <0x3600000 0x200000>;
+			sercomm,scpart-id = <8>;
+			read-only;
+		};
+
+		partition@3800000 {
+			label = "ML5";
+			reg = <0x3800000 0x200000>;
+			sercomm,scpart-id = <9>;
+			read-only;
+		};
+
+		partition@3a00000 {
+			label = "ML6";
+			reg = <0x3a00000 0x200000>;
+			sercomm,scpart-id = <10>;
+			read-only;
+		};
+
+		partition@3c00000 {
+			label = "ML7";
+			reg = <0x3c00000 0x200000>;
+			sercomm,scpart-id = <11>;
+			read-only;
+		};
+
+		partition@3e00000 {
+			label = "ML8";
+			reg = <0x3e00000 0x200000>;
+			sercomm,scpart-id = <12>;
+			read-only;
+		};
+
+		partition@4000000 {
+			label = "ML9";
+			reg = <0x4000000 0x200000>;
+			sercomm,scpart-id = <13>;
+			read-only;
+		};
+
+		partition@4200000 {
+			label = "ML10";
+			reg = <0x4200000 0x200000>;
+			sercomm,scpart-id = <14>;
+			read-only;
+		};
+
+		partition@4400000 {
+			label = "ML11";
+			reg = <0x4400000 0x200000>;
+			sercomm,scpart-id = <15>;
 			read-only;
 		};
 
 		factory: partition@4600000 {
 			label = "factory";
 			reg = <0x4600000 0x200000>;
+			sercomm,scpart-id = <16>;
 			read-only;
 		};
 
 		partition@4800000 {
+			label = "SC Private Data";
+			reg = <0x4800000 0x200000>;
+			sercomm,scpart-id = <17>;
+			read-only;
+		};
+
+		partition@4a00000 {
+			label = "POT";
+			reg = <0x4a00000 0x200000>;
+			sercomm,scpart-id = <18>;
+			read-only;
+		};
+
+		partition@4c00000 {
+			label = "Traffic Meter";
+			reg = <0x4c00000 0x200000>;
+			sercomm,scpart-id = <19>;
+			read-only;
+		};
+
+		partition@4e00000 {
+			label = "SC PID";
+			reg = <0x4e00000 0x200000>;
+			sercomm,scpart-id = <20>;
+			read-only;
+		};
+
+		partition@5000000 {
+			label = "SC Nvram";
+			reg = <0x5000000 0x200000>;
+			sercomm,scpart-id = <21>;
+			read-only;
+		};
+
+		partition@5200000 {
+			label = "Ralink Nvram";
+			reg = <0x5200000 0x200000>;
+			sercomm,scpart-id = <22>;
+			read-only;
+		};
+
+		partition@5400000 {
+			label = "reserved0";
+			reg = <0x5400000 0x200000>;
+			sercomm,scpart-id = <23>;
+			read-only;
+		};
+
+		partition@5600000 {
 			label = "reserved1";
-			reg = <0x4800000 0x3800000>;
+			reg = <0x5600000 0x200000>;
+			sercomm,scpart-id = <24>;
+			read-only;
+		};
+
+		partition@5800000 {
+			label = "reserved2";
+			reg = <0x5800000 0x200000>;
+			sercomm,scpart-id = <25>;
+			read-only;
+		};
+
+		partition@5a00000 {
+			label = "reserved3";
+			reg = <0x5a00000 0x200000>;
+			sercomm,scpart-id = <26>;
+			read-only;
+		};
+
+		partition@5c00000 {
+			label = "reserved4";
+			reg = <0x5c00000 0x200000>;
+			sercomm,scpart-id = <27>;
+			read-only;
+		};
+
+		partition@5e00000 {
+			label = "reserved5";
+			reg = <0x5e00000 0x2180000>;
+			sercomm,scpart-id = <28>;
 			read-only;
 		};
 	};
diff --git a/target/linux/ramips/dts/mt7621_netgear_sercomm_chj.dtsi b/target/linux/ramips/dts/mt7621_netgear_sercomm_chj.dtsi
index eaf12a891ef267..cd9582e5412072 100644
--- a/target/linux/ramips/dts/mt7621_netgear_sercomm_chj.dtsi
+++ b/target/linux/ramips/dts/mt7621_netgear_sercomm_chj.dtsi
@@ -151,47 +151,208 @@
 	status = "okay";
 
 	partitions {
-		compatible = "fixed-partitions";
+		compatible = "sercomm,sc-partitions", "fixed-partitions";
 		#address-cells = <1>;
 		#size-cells = <1>;
 
 		partition@0 {
 			label = "u-boot";
 			reg = <0x0 0x100000>;
+			sercomm,scpart-id = <0>;
 			read-only;
 		};
 
 		partition@100000 {
 			label = "SC PART_MAP";
 			reg = <0x100000 0x100000>;
+			sercomm,scpart-id = <1>;
 			read-only;
 		};
 
 		partition@200000 {
 			label = "kernel";
 			reg = <0x200000 0x400000>;
+			sercomm,scpart-id = <2>;
 		};
 
 		partition@600000 {
 			label = "ubi";
 			reg = <0x600000 0x2800000>;
+			sercomm,scpart-id = <3>;
 		};
 
 		partition@2e00000 {
-			label = "reserved0";
-			reg = <0x2e00000 0x1800000>;
+			label = "English UI";
+			reg = <0x2e00000 0x200000>;
+			sercomm,scpart-id = <4>;
+			read-only;
+		};
+
+		partition@3000000 {
+			label = "ML1";
+			reg = <0x3000000 0x200000>;
+			sercomm,scpart-id = <5>;
+			read-only;
+		};
+
+		partition@3200000 {
+			label = "ML2";
+			reg = <0x3200000 0x200000>;
+			sercomm,scpart-id = <6>;
+			read-only;
+		};
+
+		partition@3400000 {
+			label = "ML3";
+			reg = <0x3400000 0x200000>;
+			sercomm,scpart-id = <7>;
+			read-only;
+		};
+
+		partition@3600000 {
+			label = "ML4";
+			reg = <0x3600000 0x200000>;
+			sercomm,scpart-id = <8>;
+			read-only;
+		};
+
+		partition@3800000 {
+			label = "ML5";
+			reg = <0x3800000 0x200000>;
+			sercomm,scpart-id = <9>;
+			read-only;
+		};
+
+		partition@3a00000 {
+			label = "ML6";
+			reg = <0x3a00000 0x200000>;
+			sercomm,scpart-id = <10>;
+			read-only;
+		};
+
+		partition@3c00000 {
+			label = "ML7";
+			reg = <0x3c00000 0x200000>;
+			sercomm,scpart-id = <11>;
+			read-only;
+		};
+
+		partition@3e00000 {
+			label = "ML8";
+			reg = <0x3e00000 0x200000>;
+			sercomm,scpart-id = <12>;
+			read-only;
+		};
+
+		partition@4000000 {
+			label = "ML9";
+			reg = <0x4000000 0x200000>;
+			sercomm,scpart-id = <13>;
+			read-only;
+		};
+
+		partition@4200000 {
+			label = "ML10";
+			reg = <0x4200000 0x200000>;
+			sercomm,scpart-id = <14>;
+			read-only;
+		};
+
+		partition@4400000 {
+			label = "ML11";
+			reg = <0x4400000 0x200000>;
+			sercomm,scpart-id = <15>;
 			read-only;
 		};
 
 		factory: partition@4600000 {
 			label = "factory";
 			reg = <0x4600000 0x200000>;
+			sercomm,scpart-id = <16>;
 			read-only;
 		};
 
 		partition@4800000 {
+			label = "SC Private Data";
+			reg = <0x4800000 0x200000>;
+			sercomm,scpart-id = <17>;
+			read-only;
+		};
+
+		partition@4a00000 {
+			label = "POT";
+			reg = <0x4a00000 0x200000>;
+			sercomm,scpart-id = <18>;
+			read-only;
+		};
+
+		partition@4c00000 {
+			label = "Traffic Meter";
+			reg = <0x4c00000 0x200000>;
+			sercomm,scpart-id = <19>;
+			read-only;
+		};
+
+		partition@4e00000 {
+			label = "SC PID";
+			reg = <0x4e00000 0x200000>;
+			sercomm,scpart-id = <20>;
+			read-only;
+		};
+
+		partition@5000000 {
+			label = "SC Nvram";
+			reg = <0x5000000 0x200000>;
+			sercomm,scpart-id = <21>;
+			read-only;
+		};
+
+		partition@5200000 {
+			label = "Ralink Nvram";
+			reg = <0x5200000 0x200000>;
+			sercomm,scpart-id = <22>;
+			read-only;
+		};
+
+		partition@5400000 {
+			label = "reserved0";
+			reg = <0x5400000 0x200000>;
+			sercomm,scpart-id = <23>;
+			read-only;
+		};
+
+		partition@5600000 {
 			label = "reserved1";
-			reg = <0x4800000 0x3800000>;
+			reg = <0x5600000 0x200000>;
+			sercomm,scpart-id = <24>;
+			read-only;
+		};
+
+		partition@5800000 {
+			label = "reserved2";
+			reg = <0x5800000 0x200000>;
+			sercomm,scpart-id = <25>;
+			read-only;
+		};
+
+		partition@5a00000 {
+			label = "reserved3";
+			reg = <0x5a00000 0x200000>;
+			sercomm,scpart-id = <26>;
+			read-only;
+		};
+
+		partition@5c00000 {
+			label = "reserved4";
+			reg = <0x5c00000 0x200000>;
+			sercomm,scpart-id = <27>;
+			read-only;
+		};
+
+		partition@5e00000 {
+			label = "reserved5";
+			reg = <0x5e00000 0x2180000>;
+			sercomm,scpart-id = <28>;
 			read-only;
 		};
 	};
diff --git a/target/linux/ramips/dts/mt7621_netgear_wac104.dts b/target/linux/ramips/dts/mt7621_netgear_wac104.dts
index 3b5d6ae2d99bb5..97aa4a90d1b2a7 100644
--- a/target/linux/ramips/dts/mt7621_netgear_wac104.dts
+++ b/target/linux/ramips/dts/mt7621_netgear_wac104.dts
@@ -122,7 +122,7 @@
 	};
 };
 
-&pcie1 {
+&pcie2 {
 	wifi@0,0 {
 		compatible = "mediatek,mt76";
 		reg = <0x0 0 0 0 0>;
diff --git a/target/linux/ramips/dts/mt7621_netgear_wax202.dts b/target/linux/ramips/dts/mt7621_netgear_wax202.dts
index f17a8053630ea1..fbe17ef0d38cbb 100644
--- a/target/linux/ramips/dts/mt7621_netgear_wax202.dts
+++ b/target/linux/ramips/dts/mt7621_netgear_wax202.dts
@@ -53,31 +53,16 @@
 			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
 		};
 
-		led_lan1_green: lan1_green {
-			label = "green:lan1";
-			gpios = <&switch0 3 GPIO_ACTIVE_LOW>;
-		};
-
 		led_lan1_orange: lan1_orange {
 			label = "orange:lan1";
 			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
 		};
 
-		led_lan2_green: lan2_green {
-			label = "green:lan2";
-			gpios = <&switch0 6 GPIO_ACTIVE_LOW>;
-		};
-
 		led_lan2_orange: lan2_orange {
 			label = "orange:lan2";
 			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
 		};
 
-		led_lan3_green: lan3_green {
-			label = "green:lan3";
-			gpios = <&switch0 12 GPIO_ACTIVE_LOW>;
-		};
-
 		led_lan3_orange: lan3_orange {
 			label = "orange:lan3";
 			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
@@ -232,10 +217,6 @@
 	};
 };
 
-&pcie2 {
-	status = "disabled";
-};
-
 &state_default {
 	gpio {
 		groups = "uart3", "uart2", "jtag", "wdt";
@@ -256,9 +237,6 @@
 };
 
 &switch0 {
-	gpio-controller;
-	#gpio-cells = <2>;
-
 	ports {
 		port@1 {
 			status = "okay";
diff --git a/target/linux/ramips/dts/mt7621_oraybox_x3a.dts b/target/linux/ramips/dts/mt7621_oraybox_x3a.dts
index fd7a8e6eca1d3e..fe26e5af6f9c91 100644
--- a/target/linux/ramips/dts/mt7621_oraybox_x3a.dts
+++ b/target/linux/ramips/dts/mt7621_oraybox_x3a.dts
@@ -145,7 +145,7 @@
 };
 
 &switch0 {
-	ports {		
+	ports {
 		port@2 {
 			status = "okay";
 			label = "lan2";
diff --git a/target/linux/ramips/dts/mt7621_raisecom_msg1500-x-00.dts b/target/linux/ramips/dts/mt7621_raisecom_msg1500-x-00.dts
index 3c5f1e520c79e8..5d713c00987fb2 100644
--- a/target/linux/ramips/dts/mt7621_raisecom_msg1500-x-00.dts
+++ b/target/linux/ramips/dts/mt7621_raisecom_msg1500-x-00.dts
@@ -13,6 +13,7 @@
 		led-boot = &led_usb;
 		led-failsafe = &led_usb;
 		led-upgrade = &led_usb;
+		label-mac-device = &gmac0;
 	};
 
 	leds {
@@ -79,12 +80,32 @@
 			label = "Config";
 			reg = <0x80000 0x80000>;
 			read-only;
+
+			compatible = "nvmem-cells";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			macaddr_config_8014: macaddr@8014 {
+				reg = <0x8014 0x11>;
+			};
+
+			macaddr_config_8036: macaddr@8036 {
+				reg = <0x8036 0x11>;
+			};
 		};
 
 		factory: partition@100000 {
 			label = "Factory";
 			reg = <0x100000 0x40000>;
 			read-only;
+
+			compatible = "nvmem-cells";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			macaddr_factory_4: macaddr@4 {
+				reg = <0x4 0x6>;
+			};
 		};
 
 		partition@140000 {
@@ -115,10 +136,18 @@
 	};
 };
 
+&gmac0 {
+	nvmem-cells = <&macaddr_config_8014>;
+	nvmem-cell-names = "mac-address-ascii";
+};
+
 &gmac1 {
 	status = "okay";
 	label = "wan";
 	phy-handle = <&ethphy4>;
+
+	nvmem-cells = <&macaddr_config_8036>;
+	nvmem-cell-names = "mac-address-ascii";
 };
 
 &mdio {
@@ -157,13 +186,3 @@
 		function = "gpio";
 	};
 };
-
-&factory {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_factory_4: macaddr@4 {
-		reg = <0x4 0x6>;
-	};
-};
diff --git a/target/linux/ramips/dts/mt7621_rostelecom_rt-sf-1.dts b/target/linux/ramips/dts/mt7621_rostelecom_rt-sf-1.dts
new file mode 100644
index 00000000000000..c476cf94957318
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_rostelecom_rt-sf-1.dts
@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621_sercomm_dxx_nand_256m.dtsi"
+
+/ {
+	compatible = "rostelecom,rt-sf-1", "mediatek,mt7621-soc";
+	model = "Rostelecom RT-SF-1";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		nvmem-cells = <&macaddr_factory_21000>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <(3)>;
+	};
+};
+
+&pcie1 {
+	wifi@0,0 {
+		nvmem-cells = <&macaddr_factory_21000>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <(2)>;
+	};
+};
+
+&gmac1 {
+	nvmem-cells = <&macaddr_factory_21000>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <(11)>;
+};
diff --git a/target/linux/ramips/dts/mt7621_sercomm_dxx_nand_256m.dtsi b/target/linux/ramips/dts/mt7621_sercomm_dxx_nand_256m.dtsi
new file mode 100644
index 00000000000000..a0534bdabd9582
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_sercomm_dxx_nand_256m.dtsi
@@ -0,0 +1,239 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	aliases {
+		label-mac-device = &gmac0;
+
+		led-boot = &led_status_green;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_red;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-1 {
+			label = "blue:wan";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&gpio 13 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_green: led-0 {
+			label = "green:status";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 15 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_red: led-2 {
+			label = "red:status";
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 16 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	ubi-concat {
+		compatible = "mtd-concat";
+		devices = <&ubiconcat0 &ubiconcat1 &ubiconcat2 \
+			&ubiconcat3>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "ubi";
+				reg = <0x0 0xca00000>;
+			};
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	partitions {
+		compatible = "sercomm,sc-partitions", "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "u-boot";
+			reg = <0x0 0x100000>;
+			sercomm,scpart-id = <0>;
+			read-only;
+		};
+
+		partition@100000 {
+			label = "dynamic partition map";
+			reg = <0x100000 0x100000>;
+			sercomm,scpart-id = <1>;
+			read-only;
+		};
+
+		factory: partition@200000 {
+			label = "Factory";
+			reg = <0x200000 0x100000>;
+			sercomm,scpart-id = <2>;
+			read-only;
+
+			compatible = "nvmem-cells";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			macaddr_factory_21000: macaddr@21000 {
+				reg = <0x21000 0x6>;
+			};
+		};
+
+		partition@300000 {
+			label = "Boot Flag";
+			reg = <0x300000 0x100000>;
+			sercomm,scpart-id = <3>;
+		};
+
+		partition@400000 {
+			label = "kernel";
+			reg = <0x400000 0x600000>;
+			sercomm,scpart-id = <4>;
+		};
+
+		partition@a00000 {
+			label = "Kernel 2";
+			reg = <0xa00000 0x600000>;
+			sercomm,scpart-id = <5>;
+			read-only;
+		};
+
+		ubiconcat0: partition@1000000 {
+			label = "File System 1";
+			reg = <0x1000000 0x2000000>;
+			sercomm,scpart-id = <6>;
+		};
+
+		partition@3000000 {
+			label = "File System 2";
+			reg = <0x3000000 0x2000000>;
+			sercomm,scpart-id = <7>;
+			read-only;
+		};
+
+		ubiconcat1: partition@5000000 {
+			label = "Configuration/log";
+			reg = <0x5000000 0x1400000>;
+			sercomm,scpart-id = <8>;
+		};
+
+		ubiconcat2: partition@6400000 {
+			label = "Debug (Ftool)";
+			reg = <0x6400000 0x1a00000>;
+			sercomm,scpart-id = <9>;
+		};
+
+		ubiconcat3: partition@8000000 {
+			label = "Container";
+			reg = <0x8000000 0x7c00000>;
+			sercomm,scpart-id = <10>;
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x8000>;
+		ieee80211-freq-limit = <5000000 6000000>;
+	};
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0>;
+		ieee80211-freq-limit = <2400000 2500000>;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_21000>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy0>;
+};
+
+&mdio {
+	ethphy0: ethernet-phy@0 {
+		reg = <0>;
+	};
+};
+
+&switch0 {
+	ports {
+		port@1 {
+			status = "okay";
+			label = "lan1";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@4 {
+			status = "okay";
+			label = "lan4";
+		};
+	};
+};
+
+&uartlite3 {
+	status = "okay";
+};
+
+&state_default {
+	gpio {
+		groups = "jtag", "uart2";
+		function = "gpio";
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_sim_simax1800t.dts b/target/linux/ramips/dts/mt7621_sim_simax1800t.dts
new file mode 100644
index 00000000000000..3c5c9179d24b81
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_sim_simax1800t.dts
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621_haier-sim_wr1800k.dtsi"
+
+/ {
+	compatible = "sim,simax1800t", "mediatek,mt7621-soc";
+	model = "SIM SIMAX1800T";
+};
diff --git a/target/linux/ramips/dts/mt7621_snr_snr-cpe-me1.dts b/target/linux/ramips/dts/mt7621_snr_snr-cpe-me1.dts
new file mode 100644
index 00000000000000..7f0dbf772df631
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_snr_snr-cpe-me1.dts
@@ -0,0 +1,212 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "snr,snr-cpe-me1", "mediatek,mt7621-soc";
+	model = "SNR-CPE-ME1";
+
+	aliases {
+		label-mac-device = &gmac1;
+
+		led-boot = &led_usb;
+		led-failsafe = &led_vpn;
+		led-running = &led_green;
+		led-upgrade = &led_sys;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_usb: led-0 { // USB Activity
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_USB;
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>; // [JTAG] JTDO
+		};
+
+		led_vpn: led-1 { // VPN Activity
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_INDICATOR;
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>; // [JTAG] JTCLK
+		};
+
+		led_sys: led-2 { // System config
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>; // [I2C] I2C_SD
+			panic-indicator;
+		};
+
+		led_green: led-3 { // ? LED
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_HEARTBEAT;
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>; // [JTAG] JTMS
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "Reset Button";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>; // [JTAG] JTDI
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	reg_usb_vbus: regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "usb_vbus";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		gpio = <&gpio 17 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-3.3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_e000>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy4>;
+
+	nvmem-cells = <&macaddr_factory_e006>;
+	nvmem-cell-names = "mac-address";
+};
+
+&mdio {
+	ethphy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 { // MT7603EN
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0000>;
+		ieee80211-freq-limit = <2400000 2500000>;
+	};
+};
+
+&pcie1 { // MT7610EN
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x8000>;
+		ieee80211-freq-limit = <5000000 6000000>;
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 { // GD25Q128CSIG
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <44000000>; // 44 MHz
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "Bootloader";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "Config";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@40000 {
+				label = "Factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_factory_e000: macaddr@e000 {
+					reg = <0xe000 0x6>;
+				};
+
+				macaddr_factory_e006: macaddr@e006 {
+					reg = <0xe006 0x6>;
+				};
+			};
+
+			partition@50000 {
+				compatible = "openwrt,uimage", "denx,uimage";
+				label = "firmware";
+				reg = <0x50000 0xfb0000>;
+			};
+
+			partition@30001 {
+				label = "uboot-env";
+				reg = <0x30000 0x1000>;
+			};
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "jtag";
+		function = "gpio";
+	};
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan4";
+		};
+
+		port@1 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan1";
+		};
+	};
+};
+
+&xhci {
+	vbus-supply = <&reg_usb_vbus>;
+	vusb33-supply = <&reg_3p3v>;
+};
diff --git a/target/linux/ramips/dts/mt7621_snr_snr-cpe-me2-lite.dts b/target/linux/ramips/dts/mt7621_snr_snr-cpe-me2-lite.dts
new file mode 100644
index 00000000000000..38cd1cd8fd87c0
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_snr_snr-cpe-me2-lite.dts
@@ -0,0 +1,173 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "snr,snr-cpe-me2-lite", "mediatek,mt7621-soc";
+	model = "SNR-CPE-ME2-Lite";
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_sys: led-0 {
+			label = "green:sys";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 15 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_vpn: led-1 {
+			label = "green:vpn";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "jtag", "wdt";
+		function = "gpio";
+	};
+};
+
+&gdma {
+	status = "okay";
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <104000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "config";
+				reg = <0x30000 0x10000>;
+			};
+
+			factory: partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x50000 0xfb0000>;
+			};
+		};
+	};
+};
+
+&sdhci {
+	status = "okay";
+};
+
+&mdio {
+	ethphy0: ethernet-phy@0 {
+		reg = <0>;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_e000>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy0>;
+
+	nvmem-cells = <&macaddr_factory_e006>;
+	nvmem-cell-names = "mac-address";
+};
+
+&switch0 {
+	ports {
+		port@1 {
+			status = "okay";
+			label = "lan1";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@4 {
+			status = "okay";
+			label = "lan4";
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0000>;
+		ieee80211-freq-limit = <2400000 2500000>;
+	};
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x8000>;
+		ieee80211-freq-limit = <5000000 6000000>;
+	};
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_e000: macaddr@e000 {
+		reg = <0xe000 0x6>;
+	};
+
+	macaddr_factory_e006: macaddr@e006 {
+		reg = <0xe006 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_snr_snr-cpe-me2-sfp.dts b/target/linux/ramips/dts/mt7621_snr_snr-cpe-me2-sfp.dts
new file mode 100644
index 00000000000000..2a5dfe379c64e0
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_snr_snr-cpe-me2-sfp.dts
@@ -0,0 +1,219 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "snr,snr-cpe-me2-sfp", "mediatek,mt7621-soc";
+	model = "SNR-CPE-ME2-SFP";
+
+	aliases {
+		led-boot = &led_sys;
+		led-failsafe = &led_sys;
+		led-running = &led_sys;
+		led-upgrade = &led_sys;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_sys: sys {
+			label = "green:sys";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		vpn {
+			label = "green:vpn";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+		};
+
+		usb {
+			label = "green:usb";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_USB;
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			trigger-sources = <&xhci_ehci_port1>;
+			linux,default-trigger = "usbport";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	sfp_wan: sfp0 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c>;
+		los-gpios = <&gpio 8 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpios = <&gpio 6 GPIO_ACTIVE_LOW>;
+		tx-disable-gpios = <&gpio 9 GPIO_ACTIVE_HIGH>;
+		maximum-power-milliwatt = <1000>;
+	};
+
+	reg_usb_vbus: regulator-usb {
+		compatible = "regulator-fixed";
+		regulator-name = "usb_vbus";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		gpio = <&gpio 17 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-3.3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "uart2", "uart3", "jtag";
+		function = "gpio";
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 { // GD25Q127CSIG
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <44000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "config";
+				reg = <0x30000 0x10000>;
+			};
+
+			factory: partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x50000 0xfb0000>;
+			};
+
+			partition@30001 {
+				label = "uboot-env";
+				reg = <0x30000 0x1000>;
+			};
+		};
+	};
+};
+
+&gpio {
+	// driver issue, bypass
+	enable_sfp {
+		gpio-hog;
+		gpios = <9 GPIO_ACTIVE_LOW>;
+		output-low;
+	};
+};
+
+&mdio {
+	phy_sfp: ethernet-phy@0 {
+		reg = <0>;
+		sfp = <&sfp_wan>;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_e000>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-mode = "rgmii-rxid";
+	phy-handle = <&phy_sfp>;
+
+	nvmem-cells = <&macaddr_factory_e006>;
+	nvmem-cell-names = "mac-address";
+};
+
+&switch0 {
+	ports {
+		port@1 {
+			status = "okay";
+			label = "lan1";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@4 {
+			status = "okay";
+			label = "lan4";
+		};
+	};
+};
+
+&xhci {
+	vusb33-supply = <&reg_3p3v>;
+	vbus-supply = <&reg_usb_vbus>;
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0000>;
+	};
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_e000: macaddr@e000 {
+		reg = <0xe000 0x6>;
+	};
+
+	macaddr_factory_e006: macaddr@e006 {
+		reg = <0xe006 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_tozed_zlt-s12-pro.dts b/target/linux/ramips/dts/mt7621_tozed_zlt-s12-pro.dts
new file mode 100644
index 00000000000000..5a94bbda829de0
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_tozed_zlt-s12-pro.dts
@@ -0,0 +1,245 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "tozed,zlt-s12-pro", "mediatek,mt7621-soc";
+	model = "TOZED ZLT S12 PRO";
+
+	aliases {
+		led-boot = &led_power_blue;
+		led-failsafe = &led_power_yellow;
+		led-running = &led_power_blue;
+		led-upgrade = &led_power_blue;
+		label-mac-device = &wifi1;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-modem-blue {
+			label = "blue:modem";
+			gpios = <&gpio 33 GPIO_ACTIVE_LOW>;
+		};
+
+		led-modem-red {
+			label = "red:modem";
+			gpios = <&gpio 27 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_blue: led-power-blue {
+			label = "blue:power";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_yellow: led-power-yellow {
+			label = "yellow:power";
+			gpios = <&gpio 29 GPIO_ACTIVE_LOW>;
+		};
+
+		led-wifi {
+			label = "blue:wifi";
+			gpios = <&gpio 28 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led-signal1 {
+			label = "blue:signal1";
+			gpios = <&gpio 25 GPIO_ACTIVE_LOW>;
+		};
+
+		led-signal2 {
+			label = "blue:signal2";
+			gpios = <&gpio 24 GPIO_ACTIVE_LOW>;
+		};
+
+		led-signal3 {
+			label = "blue:signal3";
+			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
+		};
+
+		led-signal4 {
+			label = "blue:signal4";
+			gpios = <&gpio 22 GPIO_ACTIVE_LOW>;
+		};
+
+		led-signal5 {
+			label = "blue:signal5";
+			gpios = <&gpio 26 GPIO_ACTIVE_LOW>;
+		};
+
+		led-phone {
+			label = "blue:phone";
+			gpios = <&gpio 31 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "reset";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		button-rfkill {
+			label = "rfkill";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+		};
+
+		button-wps {
+			label = "wps";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	gpio_export {
+		compatible = "gpio-export";
+
+		lt72_ant0 {
+			gpio-export,name = "lt72_ant0";
+			gpio-export,input = <0>;
+			gpios = <&gpio 6 GPIO_ACTIVE_HIGH>;
+		};
+
+		lt72_ant1 {
+			gpio-export,name = "lt72_ant1";
+			gpio-export,input = <0>;
+			gpios = <&gpio 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		lt72_power {
+			gpio-export,name = "lt72_power";
+			gpio-export,output = <1>;
+			gpios = <&gpio 14 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x30000 0x8000>;
+				read-only;
+			};
+
+			// Stock config partition
+			partition@38000 {
+				label = "tozed-conf";
+				reg = <0x38000 0x8000>;
+				read-only;
+			};
+
+			factory: partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_factory_e000: macaddr@e000 {
+					reg = <0xe000 0x6>;
+				};
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x50000 0xfb0000>;
+			};
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi0: mt76@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x8000>;
+		ieee80211-freq-limit = <5000000 6000000>;
+	};
+};
+
+&pcie1 {
+	wifi1: mt76@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0000>;
+		ieee80211-freq-limit = <2400000 2500000>;
+	};
+};
+
+&ethernet {
+	pinctrl-0 = <&mdio_pins>, <&rgmii1_pins>;
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_e000>;
+	nvmem-cell-names = "mac-address";
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "wan";
+		};
+
+		port@1 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@4 {
+			status = "okay";
+			label = "lan1";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "wdt", "rgmii2", "jtag", "uart3";
+		function = "gpio";
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_tplink_archer-ax23-v1.dts b/target/linux/ramips/dts/mt7621_tplink_archer-ax23-v1.dts
new file mode 100644
index 00000000000000..50834c586643ec
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_tplink_archer-ax23-v1.dts
@@ -0,0 +1,203 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "tplink,archer-ax23-v1", "mediatek,mt7621-soc";
+	model = "TP-Link Archer AX23 v1";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "rfkill";
+			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: power {
+			label = "green:power";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+		};
+
+		wifi2g {
+			label = "green:wifi2g";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wifi5g {
+			label = "green:wifi5g";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		wan-green {
+			label = "green:wan";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		};
+
+		wan-orange {
+			label = "orange:wan";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		};
+
+		lan {
+			label = "green:lan";
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "green:wps";
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x040000>;
+				read-only;
+			};
+
+			partition@40000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x040000 0xf60000>;
+			};
+
+			config: partition@fa0000 {
+				label = "config";
+				reg = <0xfa0000 0x010000>;
+				read-only;
+			};
+
+			partition@fb0000 {
+				label = "tplink";
+				reg = <0xfb0000 0x040000>;
+				read-only;
+			};
+
+			radio: partition@ff0000 {
+				label = "radio";
+				reg = <0xff0000 0x010000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&radio 0x0>;
+		nvmem-cells = <&macaddr_config_8>;
+		nvmem-cell-names = "mac-address";
+		mediatek,disable-radar-background;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_config_8>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy4>;
+
+	nvmem-cells = <&macaddr_config_8>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <1>;
+};
+
+&mdio {
+	ethphy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan1";
+		};
+
+		port@1 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan4";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "uart3", "jtag", "wdt";
+		function = "gpio";
+	};
+};
+
+&config {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_config_8: macaddr@8 {
+		reg = <0x8 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_tplink_deco-m4r-v4.dts b/target/linux/ramips/dts/mt7621_tplink_deco-m4r-v4.dts
new file mode 100644
index 00000000000000..3d17dbf599cdcb
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_tplink_deco-m4r-v4.dts
@@ -0,0 +1,203 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "tplink,deco-m4r-v4", "mediatek,mt7621-soc";
+	model = "TP-Link Deco M4R v4";
+
+	aliases {
+		label-mac-device = &gmac0;
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200n8";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+
+		led {
+			label = "led";
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+			debounce_interval = <60>;
+			linux,code = <KEY_BRIGHTNESS_TOGGLE>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		rssi {
+			label = "green:rssi";
+			gpios = <&gpio 5 GPIO_ACTIVE_LOW>;
+		};
+
+		lan {
+			label = "green:lan";
+			gpios = <&gpio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		sys {
+			label = "green:sys";
+			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
+		};
+
+		wifi2g {
+			label = "green:wifi2g";
+			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		logo_red {
+			label = "red:logo";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+			/* match usage in v1 and v2 */
+			linux,default-trigger = "phy0tpt";
+		};
+
+		logo_blue {
+			label = "blue:logo";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+			/* match usage in v1 and v2 */
+			linux,default-trigger = "phy1tpt";
+
+		};
+
+		led_power: logo_green {
+			label = "green:logo";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			/* match usage in v1 and v2 */
+			default_state = "on";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "uart2", "uart3", "jtag", "wdt";
+		function = "gpio";
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <40000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x40000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "firmware";
+				compatible = "denx,uimage";
+				reg = <0x40000 0xf60000>;
+			};
+
+			config: partition@fa0000 {
+				label = "config";
+				reg = <0xfa0000 0x010000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_config_8: macaddr@8 {
+					reg = <0x8 0x6>;
+				};
+			};
+
+			partition@fb0000 {
+				label = "tplink";
+				reg = <0xfb0000 0x040000>;
+				read-only;
+			};
+
+			radio: partition@ff0000 {
+				label = "radio";
+				reg = <0xff0000 0x10000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&ethernet {
+	pinctrl-names = "default";
+	pinctrl-0 = <&rgmii1_pins &mdio_pins>;
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_config_8>;
+	nvmem-cell-names = "mac-address";
+	label = "dsa";
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "eth0";
+		};
+
+		port@1 {
+			status = "okay";
+			label = "eth1";
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&radio 0x0>;
+		ieee80211-freq-limit = <2400000 2500000>;
+	};
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&radio 0x8000>;
+		ieee80211-freq-limit = <5000000 6000000>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_tplink_eap615-wall-v1.dts b/target/linux/ramips/dts/mt7621_tplink_eap615-wall-v1.dts
index 594a9e7bb1b8c3..58e4bbf75741f0 100644
--- a/target/linux/ramips/dts/mt7621_tplink_eap615-wall-v1.dts
+++ b/target/linux/ramips/dts/mt7621_tplink_eap615-wall-v1.dts
@@ -148,10 +148,6 @@
 	};
 };
 
-&pcie2 {
-	status = "disabled";
-};
-
 &gmac0 {
 	nvmem-cells = <&macaddr_info_8>;
 	nvmem-cell-names = "mac-address";
@@ -173,7 +169,6 @@
 };
 
 &switch0 {
-	compatible = "mediatek,mt7530";
 	ports {
 		port@1 {
 			status = "okay";
diff --git a/target/linux/ramips/dts/mt7621_tplink_ec330-g5u-v1.dts b/target/linux/ramips/dts/mt7621_tplink_ec330-g5u-v1.dts
new file mode 100644
index 00000000000000..6c9cc407015b38
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_tplink_ec330-g5u-v1.dts
@@ -0,0 +1,328 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "tplink,ec330-g5u-v1", "mediatek,mt7621-soc";
+	model = "TP-Link EC330-G5u v1";
+
+	aliases {
+		label-mac-device = &gmac0;
+
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_USB;
+			function-enumerator = <0>;
+			gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
+			trigger-sources = <&xhci_ehci_port1>;
+			linux,default-trigger = "usbport";
+		};
+
+		led-1 {
+			label = "blue:wps";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WPS;
+			function-enumerator = <0>;
+			gpios = <&gpio 5 GPIO_ACTIVE_LOW>;
+		};
+
+		led-2 {
+			label = "blue:ethernet";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <0>;
+			gpios = <&gpio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		led-3 {
+			label = "amber:internet";
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_WAN;
+			function-enumerator = <0>;
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		};
+
+		led-4 {
+			label = "blue:internet";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WAN;
+			function-enumerator = <1>;
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		};
+
+		led-5 {
+			label = "blue:wireless_5g";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <0>;
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1radio";
+		};
+
+		led-6 {
+			label = "blue:wireless_2g";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <1>;
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0radio";
+		};
+
+		led_power: led-7 {
+			label = "blue:power";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <0>;
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		led {
+			label = "led";
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+			linux,code = <KEY_LIGHTS_TOGGLE>;
+		};
+
+		wifi {
+			label = "wifi on/off";
+			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+			linux,code = <KEY_RFKILL>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	gpio-export {
+		compatible = "gpio-export";
+
+		led-light {
+			gpio-export,name = "led-light";
+			gpio-export,output = <0>;
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	ubi-concat {
+		compatible = "mtd-concat";
+		devices = <&ubiconcat0 &ubiconcat1>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "ubi";
+				reg = <0x0 0x3c00000>;
+			};
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "u-boot";
+			reg = <0x0 0x400000>;
+			read-only;
+
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot-first";
+				reg = <0x0 0x20000>;
+				read-only;
+			};
+
+			partition@20000 {
+				label = "u-boot-main";
+				reg = <0x20000 0x40000>;
+				read-only;
+			};
+
+			partition@60000 {
+				label = "u-boot-main-reserve";
+				reg = <0x60000 0x40000>;
+				read-only;
+			};
+		};
+
+		partition@400000 {
+			label = "os0";
+			reg = <0x400000 0x3000000>;
+
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "kernel";
+				reg = <0x0 0x400000>;
+			};
+
+			ubiconcat0: partition@400000 {
+				label = "ubi-os0";
+				reg = <0x400000 0x2c00000>;
+			};
+		};
+
+		partition@3400000 {
+			label = "os1";
+			reg = <0x3400000 0x3000000>;
+			read-only;
+		};
+
+		ubiconcat1: partition@6400000 {
+			label = "userfs";
+			reg = <0x6400000 0x1000000>;
+		};
+
+		partition@7400000 {
+			label = "u-boot-env";
+			reg = <0x7400000 0x400000>;
+		};
+
+		factory: partition@7800000 {
+			label = "factory";
+			reg = <0x7800000 0x400000>;
+			read-only;
+
+			compatible = "nvmem-cells";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			macaddr_factory_165: macaddr@165 {
+				reg = <0x165 0x11>;
+			};
+		};
+
+		partition@0_wholeflash {
+			label = "wholeflash";
+			reg = <0x0 0x7f80000>;
+			read-only;
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x8000>;
+		ieee80211-freq-limit = <2400000 2500000>;
+
+		nvmem-cells = <&macaddr_factory_165>;
+		nvmem-cell-names = "mac-address-ascii";
+	};
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x14000>;
+		ieee80211-freq-limit = <5000000 6000000>;
+
+		nvmem-cells = <&macaddr_factory_165>;
+		nvmem-cell-names = "mac-address-ascii";
+		mac-address-increment = <(2)>;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_165>;
+	nvmem-cell-names = "mac-address-ascii";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy0>;
+
+	nvmem-cells = <&macaddr_factory_165>;
+	nvmem-cell-names = "mac-address-ascii";
+	mac-address-increment = <(1)>;
+};
+
+&mdio {
+	ethphy0: ethernet-phy@0 {
+		reg = <0>;
+	};
+};
+
+&switch0 {
+	ports {
+		port@1 {
+			status = "okay";
+			label = "lan1";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@4 {
+			status = "okay";
+			label = "lan4";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "jtag", "uart2", "uart3", "wdt";
+		function = "gpio";
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_tplink_er605-v2.dts b/target/linux/ramips/dts/mt7621_tplink_er605-v2.dts
new file mode 100644
index 00000000000000..04935e3e99b438
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_tplink_er605-v2.dts
@@ -0,0 +1,183 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	model = "TP-Link ER605 v2";
+	compatible = "tplink,er605-v2", "mediatek,mt7621-soc";
+
+	chosen {
+		bootargs = "console=ttyS0,115200 noinitrd";
+		// Override bootargs because u-boot passes wrong root parameter.
+		// Instead allow kernel determine root automatically by looking for rootfs volume
+		bootargs-override = "console=ttyS0,115200 noinitrd ubi.mtd=3,2048";
+	};
+
+	aliases {
+		led-boot = &led_system;
+		led-failsafe = &led_system;
+		led-running = &led_system;
+		led-upgrade = &led_system;
+		label-mac-device = &gmac0;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_usb: usb {
+			label = "green:usb";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_power: power {
+			label = "green:power";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+
+		led_system: system {
+			label = "green:system";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 7 GPIO_ACTIVE_HIGH>;
+			default-state = "keep";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset button";
+			gpios = <&gpio 8 GPIO_ACTIVE_HIGH>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	reg_usb_vbus: regulator-usb {
+		compatible = "regulator-fixed";
+		regulator-name = "usb_vbus";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		gpio = <&gpio 10 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-3.3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+};
+
+&gmac0 {
+	label = "dsa";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "eth0";
+	phy-handle = <&ethphy0>;
+};
+
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "disabled";
+		};
+
+		port@1 {
+			status = "okay";
+			label = "eth1";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "eth2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "eth3";
+		};
+
+		port@4 {
+			status = "okay";
+			label = "eth4";
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "u-boot";
+			reg = <0x0 0x80000>;
+			read-only;
+		};
+
+		partition@80000 {
+			label = "u-boot-env";
+			reg = <0x80000 0x80000>;
+			read-only;
+		};
+
+		factory: partition@100000 {
+			label = "factory";
+			reg = <0x100000 0x40000>;
+			read-only;
+		};
+
+		partition@140000 {
+			label = "firmware";
+			reg = <0x140000 0x7cc0000>;
+		};
+
+		partition@7e00000 {
+			label = "panic-ops";
+			reg = <0x7e00000 0x200000>;
+		};
+	};
+};
+
+
+&mdio {
+	ethphy0: ethernet-phy@0 {
+		reg = <0>;
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "uart2", "uart3", "pcie", "jtag";
+		function = "gpio";
+	};
+};
+
+&spi0 {
+	status = "disabled";
+};
+
+&xhci {
+	vusb33-supply = <&reg_3p3v>;
+	vbus-supply = <&reg_usb_vbus>;
+};
+
diff --git a/target/linux/ramips/dts/mt7621_tplink_mr600-v2-eu.dts b/target/linux/ramips/dts/mt7621_tplink_mr600-v2-eu.dts
new file mode 100644
index 00000000000000..b7475ec15badb1
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_tplink_mr600-v2-eu.dts
@@ -0,0 +1,207 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "tplink,mr600-v2-eu", "mediatek,mt7621-soc";
+	model = "TP-Link MR600 v2 (EU)";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		wlan {
+			label = "wlan";
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WLAN>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: power {
+			label = "white:power";
+			gpios = <&gpio 6 GPIO_ACTIVE_LOW>;
+		};
+		wlan {
+			label = "white:wlan";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+		wan {
+			label = "white:wan";
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+		};
+
+		signal1 {
+			label = "white:signal1";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		};
+
+		signal2 {
+			label = "white:signal2";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		};
+
+		signal3 {
+			label = "white:signal3";
+			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
+		};
+
+		4g {
+			label = "white:4g";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+		};
+		lan {
+			label = "white:lan";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <80000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "uboot";
+				reg = <0x00000 0x20000>;
+				read-only;
+			};
+
+			partition@20000 {
+				compatible = "openwrt,uimage";
+				openwrt,offset = <512>; /* account for the 512-byte long header */
+				label = "firmware";
+				reg = <0x20000 0xfa0000>;
+			};
+
+			romfile: partition@fc0000 {
+				label = "romfile";
+				reg = <0xfc0000 0x10000>;
+				read-only;
+			};
+
+			partition@fd0000 {
+				label = "config";
+				reg = <0xfd0000 0x10000>;
+				read-only;
+			};
+
+			radio: partition@fe0000 {
+				label = "radio";
+				reg = <0xfe0000 0x10000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+
+&pcie0 {
+	mt76@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&macaddr_romfile_f100>;
+		nvmem-cell-names = "mac-address";
+		mediatek,mtd-eeprom = <&radio 0x0>;
+		mtd-mac-address = <&romfile 0xf100>;
+		ieee80211-freq-limit = <2400000 2500000>;
+	};
+};
+
+&pcie1 {
+	mt76@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&radio 0x8000>;
+		ieee80211-freq-limit = <5000000 6000000>;
+		nvmem-cells = <&macaddr_romfile_f100>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <(-1)>;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_romfile_f100>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy4>;
+
+	nvmem-cells = <&macaddr_romfile_f100>;
+	nvmem-cell-names = "mac-address";
+};
+
+&mdio {
+	ethphy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+
+&switch0 {
+	ports {
+		port@1 {
+			status = "okay";
+			label = "lan1";
+		};
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+		port@3 {
+			status = "okay";
+			label = "lan3";
+		};
+	};
+};
+
+&romfile {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_romfile_f100: romfile@f100 {
+		reg = <0xf100 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_ubnt_usw-flex.dts b/target/linux/ramips/dts/mt7621_ubnt_usw-flex.dts
index e148242387f3cf..ff328bd858b397 100644
--- a/target/linux/ramips/dts/mt7621_ubnt_usw-flex.dts
+++ b/target/linux/ramips/dts/mt7621_ubnt_usw-flex.dts
@@ -164,14 +164,10 @@
 			};
 
 			partition@1a0000 {
+				/* Combine kernel0 / kernel1 */
 				compatible = "denx,fit";
 				label = "firmware";
-				reg = <0x1a0000 0x730000>;
-			};
-
-			partition@8d0000 {
-				label = "kernel1";
-				reg = <0x8d0000 0x730000>;
+				reg = <0x1a0000 0xe60000>;
 			};
 		};
 	};
diff --git a/target/linux/ramips/dts/mt7621_unielec_u7621-01-16m.dts b/target/linux/ramips/dts/mt7621_unielec_u7621-01-16m.dts
index 6e75d1b9309f9f..8780b17b80b8f0 100644
--- a/target/linux/ramips/dts/mt7621_unielec_u7621-01-16m.dts
+++ b/target/linux/ramips/dts/mt7621_unielec_u7621-01-16m.dts
@@ -53,9 +53,8 @@
 };
 
 &gmac1 {
-	nvmem-cells = <&macaddr_factory_e000>;
+	nvmem-cells = <&macaddr_factory_e006>;
 	nvmem-cell-names = "mac-address";
-	mac-address-increment = <1>;
 };
 
 &factory {
@@ -66,4 +65,8 @@
 	macaddr_factory_e000: macaddr@e000 {
 		reg = <0xe000 0x6>;
 	};
+
+	macaddr_factory_e006: macaddr@e006 {
+		reg = <0xe006 0x6>;
+	};
 };
diff --git a/target/linux/ramips/dts/mt7621_unielec_u7621-06-16m.dts b/target/linux/ramips/dts/mt7621_unielec_u7621-06-16m.dts
index d7dd4ccd46169b..212c0009425f04 100644
--- a/target/linux/ramips/dts/mt7621_unielec_u7621-06-16m.dts
+++ b/target/linux/ramips/dts/mt7621_unielec_u7621-06-16m.dts
@@ -58,9 +58,8 @@
 };
 
 &gmac1 {
-	nvmem-cells = <&macaddr_factory_e000>;
+	nvmem-cells = <&macaddr_factory_e006>;
 	nvmem-cell-names = "mac-address";
-	mac-address-increment = <1>;
 };
 
 &factory {
@@ -71,4 +70,8 @@
 	macaddr_factory_e000: macaddr@e000 {
 		reg = <0xe000 0x6>;
 	};
+
+	macaddr_factory_e006: macaddr@e006 {
+		reg = <0xe006 0x6>;
+	};
 };
diff --git a/target/linux/ramips/dts/mt7621_unielec_u7621-06-32m.dts b/target/linux/ramips/dts/mt7621_unielec_u7621-06-32m.dts
new file mode 100644
index 00000000000000..dc9a9773a240fd
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_unielec_u7621-06-32m.dts
@@ -0,0 +1,78 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ *  Copyright(c) 2017 Kristian Evensen <kristian.evensen@gmail.com>.
+ *  Copyright(c) 2017 Piotr Dymacz <pepe2k@gmail.com>.
+ *  Copyright(c) 2018 Nishant Sharma <codemarauder@gmail.com>.
+ *  All rights reserved.
+ */
+
+#include "mt7621_unielec_u7621-06.dtsi"
+
+/ {
+	compatible = "unielec,u7621-06-32m", "unielec,u7621-06", "mediatek,mt7621-soc";
+	model = "UniElec U7621-06 (32M flash)";
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "bootloader";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "config";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			firmware: partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x50000 0x1fb0000>;
+			};
+		};
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_e000>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	nvmem-cells = <&macaddr_factory_e006>;
+	nvmem-cell-names = "mac-address";
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_e000: macaddr@e000 {
+		reg = <0xe000 0x6>;
+	};
+
+	macaddr_factory_e006: macaddr@e006 {
+		reg = <0xe006 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_unielec_u7621-06-64m.dts b/target/linux/ramips/dts/mt7621_unielec_u7621-06-64m.dts
index 669340f194c328..f196432111b688 100644
--- a/target/linux/ramips/dts/mt7621_unielec_u7621-06-64m.dts
+++ b/target/linux/ramips/dts/mt7621_unielec_u7621-06-64m.dts
@@ -59,9 +59,8 @@
 };
 
 &gmac1 {
-	nvmem-cells = <&macaddr_factory_e000>;
+	nvmem-cells = <&macaddr_factory_e006>;
 	nvmem-cell-names = "mac-address";
-	mac-address-increment = <1>;
 };
 
 &factory {
@@ -72,4 +71,8 @@
 	macaddr_factory_e000: macaddr@e000 {
 		reg = <0xe000 0x6>;
 	};
+
+	macaddr_factory_e006: macaddr@e006 {
+		reg = <0xe006 0x6>;
+	};
 };
diff --git a/target/linux/ramips/dts/mt7621_wavlink_ws-wn572hp3-4g.dts b/target/linux/ramips/dts/mt7621_wavlink_ws-wn572hp3-4g.dts
new file mode 100644
index 00000000000000..60d0708a80e83f
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_wavlink_ws-wn572hp3-4g.dts
@@ -0,0 +1,184 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "wavlink,ws-wn572hp3-4g", "mediatek,mt7621-soc";
+	model = "Wavlink WS-WN572HP3 4G";
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	aliases {
+		label-mac-device = &wifi1;
+		led-boot = &led_status_blue;
+		led-failsafe = &led_status_blue;
+		led-running = &led_status_blue;
+		led-upgrade = &led_status_blue;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "Reset Button";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		rssihigh {
+			label = "blue:rssihigh";
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+		};
+
+		rssimedium {
+			label = "blue:rssimedium";
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+		};
+
+		rssilow {
+			label = "blue:rssilow";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_blue: status_blue {
+			label = "blue:status";
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+		};
+
+		// gpio 15 would be Quectels PWRKEY if used
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <40000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "config";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			partition@50000 {
+				compatible = "denx,fit";
+				label = "firmware";
+				reg = <0x50000 0xf30000>;
+			};
+
+			partition@f00000 {
+				label = "vendor";
+				reg = <0xf80000 0x80000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi0: mt76@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0>;
+	};
+};
+
+&pcie1 {
+	wifi1: mt76@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x8000>;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_e000>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy4>;
+
+	nvmem-cells = <&macaddr_factory_e006>;
+	nvmem-cell-names = "mac-address";
+};
+
+&mdio {
+	ethphy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&switch0 {
+	ports {
+		port@1 {
+			status = "okay";
+			label = "lan";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "wdt";
+		function = "gpio";
+	};
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_e000: macaddr@e000 {
+		reg = <0xe000 0x6>;
+	};
+
+	macaddr_factory_e006: macaddr@e006 {
+		reg = <0xe006 0x6>;
+	};
+};
+
+&wifi0{
+	ieee80211-freq-limit = <2400000 2500000>;
+};
+
+&wifi1{
+	ieee80211-freq-limit = <5000000 6000000>;
+};
+
diff --git a/target/linux/ramips/dts/mt7621_xiaomi_mi-router-3-pro.dts b/target/linux/ramips/dts/mt7621_xiaomi_mi-router-3-pro.dts
index 64f588dc501503..34d0e4a03188c2 100644
--- a/target/linux/ramips/dts/mt7621_xiaomi_mi-router-3-pro.dts
+++ b/target/linux/ramips/dts/mt7621_xiaomi_mi-router-3-pro.dts
@@ -4,6 +4,7 @@
 
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
 
 / {
 	compatible = "xiaomi,mi-router-3-pro", "mediatek,mt7621-soc";
@@ -24,43 +25,60 @@
 	leds {
 		compatible = "gpio-leds";
 
-		led_status_red: status_red {
+		led_status_red: led-0 {
 			label = "red:status";
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
 			gpios = <&gpio 6 GPIO_ACTIVE_LOW>;
 		};
 
-		led_status_blue: status_blue {
+		led_status_blue: led-1 {
 			label = "blue:status";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
 			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
 		};
 
-		led_status_yellow: status_yellow {
+		led_status_yellow: led-2 {
 			label = "yellow:status";
+			color = <LED_COLOR_ID_YELLOW>;
+			function = LED_FUNCTION_STATUS;
 			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
 		};
 
-		wan_amber {
+		led-3 {
 			label = "amber:wan";
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_WAN;
 			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
-			linux,default-trigger = "dsa-0.0:04:1Gbps";
+			linux,default-trigger = "mt7530-0:04:1Gbps";
 		};
 
-		lan3_amber {
+		led-4 {
 			label = "amber:lan3";
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <3>;
 			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
-			linux,default-trigger = "dsa-0.0:03:1Gbps";
+			linux,default-trigger = "mt7530-0:03:1Gbps";
 		};
 
-		lan2_amber {
+		led-5 {
 			label = "amber:lan2";
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <2>;
 			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
-			linux,default-trigger = "dsa-0.0:02:1Gbps";
+			linux,default-trigger = "mt7530-0:02:1Gbps";
 		};
 
-		lan1_amber {
+		led-6 {
 			label = "amber:lan1";
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <1>;
 			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
-			linux,default-trigger = "dsa-0.0:01:1Gbps";
+			linux,default-trigger = "mt7530-0:01:1Gbps";
 		};
 	};
 
diff --git a/target/linux/ramips/dts/mt7621_xiaomi_mi-router-3g.dts b/target/linux/ramips/dts/mt7621_xiaomi_mi-router-3g.dts
index 1a19579208b01d..c13c0c95709994 100644
--- a/target/linux/ramips/dts/mt7621_xiaomi_mi-router-3g.dts
+++ b/target/linux/ramips/dts/mt7621_xiaomi_mi-router-3g.dts
@@ -1,4 +1,5 @@
 #include "mt7621_xiaomi_nand_128m.dtsi"
+#include <dt-bindings/leds/common.h>
 
 / {
 	compatible = "xiaomi,mi-router-3g", "mediatek,mt7621-soc";
@@ -15,37 +16,51 @@
 	leds {
 		compatible = "gpio-leds";
 
-		led_status_red: status_red {
+		led_status_red: led-0 {
 			label = "red:status";
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
 			gpios = <&gpio 6 GPIO_ACTIVE_LOW>;
 		};
 
-		led_status_blue: status_blue {
+		led_status_blue: led-1 {
 			label = "blue:status";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
 			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
 		};
 
-		led_status_yellow: status_yellow {
+		led_status_yellow: led-2 {
 			label = "yellow:status";
+			color = <LED_COLOR_ID_YELLOW>;
+			function = LED_FUNCTION_STATUS;
 			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
 		};
 
-		wan_amber {
+		led-3 {
 			label = "amber:wan";
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_WAN;
 			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
-			linux,default-trigger = "dsa-0.0:01:1Gbps";
+			linux,default-trigger = "mt7530-0:01:1Gbps";
 		};
 
-		lan1_amber {
+		led-4 {
 			label = "amber:lan1";
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <1>;
 			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
-			linux,default-trigger = "dsa-0.0:03:1Gbps";
+			linux,default-trigger = "mt7530-0:03:1Gbps";
 		};
 
-		lan2_amber {
+		led-5 {
 			label = "amber:lan2";
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <2>;
 			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
-			linux,default-trigger = "dsa-0.0:02:1Gbps";
+			linux,default-trigger = "mt7530-0:02:1Gbps";
 		};
 	};
 
diff --git a/target/linux/ramips/dts/mt7621_xiaomi_mi-router-4a-3g-v2.dtsi b/target/linux/ramips/dts/mt7621_xiaomi_mi-router-4a-3g-v2.dtsi
index a0ee79ae23ce47..d05872337be26f 100644
--- a/target/linux/ramips/dts/mt7621_xiaomi_mi-router-4a-3g-v2.dtsi
+++ b/target/linux/ramips/dts/mt7621_xiaomi_mi-router-4a-3g-v2.dtsi
@@ -1,23 +1,12 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 
-#include "mt7621.dtsi"
-
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
+#include "mt7621_xiaomi_mi-router-4a-common.dtsi"
 
 / {
 	aliases {
-		led-boot = &led_status_yellow;
-		led-failsafe = &led_status_yellow;
-		led-running = &led_status_blue;
-		led-upgrade = &led_status_yellow;
 		label-mac-device = &gmac1;
 	};
 
-	chosen {
-		bootargs = "console=ttyS0,115200n8";
-	};
-
 	leds {
 		compatible = "gpio-leds";
 
@@ -31,108 +20,16 @@
 			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
 		};
 	};
-
-	keys {
-		compatible = "gpio-keys";
-
-		reset {
-			label = "reset";
-			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
-			linux,code = <KEY_RESTART>;
-		};
-	};
 };
 
-&spi0 {
-	status = "okay";
-
-	flash@0 {
-		compatible = "jedec,spi-nor";
-		reg = <0>;
-		spi-max-frequency = <50000000>;
-		m25p,fast-read;
-
-		partitions {
-			compatible = "fixed-partitions";
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			partition@0 {
-				label = "u-boot";
-				reg = <0x0 0x30000>;
-				read-only;
-			};
-
-			partition@30000 {
-				label = "u-boot-env";
-				reg = <0x30000 0x10000>;
-				read-only;
-			};
-
-			partition@40000 {
-				label = "Bdata";
-				reg = <0x40000 0x10000>;
-				read-only;
-			};
-
-			factory: partition@50000 {
-				label = "factory";
-				reg = <0x50000 0x10000>;
-				read-only;
-			};
-
-			partition@60000 {
-				label = "crash";
-				reg = <0x60000 0x10000>;
-				read-only;
-			};
-
-			partition@70000 {
-				label = "cfg_bak";
-				reg = <0x70000 0x10000>;
-				read-only;
-			};
-
-			partition@80000 {
-				label = "overlay";
-				reg = <0x80000 0x100000>;
-				read-only;
-			};
-
-			firmware: partition@180000 {
-				compatible = "denx,uimage";
-				label = "firmware";
-				reg = <0x180000 0xe80000>;
-			};
-		};
-	};
+&wifi0 {
+	mediatek,mtd-eeprom = <&factory 0x8000>;
+	ieee80211-freq-limit = <5000000 6000000>;
 };
 
-&pcie {
-	status = "okay";
-};
-
-&pcie0 {
-	wifi@0,0 {
-		compatible = "pci14c3,7662";
-		reg = <0x0000 0 0 0 0>;
-		mediatek,mtd-eeprom = <&factory 0x8000>;
-		ieee80211-freq-limit = <5000000 6000000>;
-	};
-};
-
-&pcie1 {
-	wifi@0,0 {
-		compatible = "pci14c3,7603";
-		reg = <0x0000 0 0 0 0>;
-		mediatek,mtd-eeprom = <&factory 0x0000>;
-		ieee80211-freq-limit = <2400000 2500000>;
-	};
-};
-
-&gmac0 {
-	nvmem-cells = <&macaddr_factory_e000>;
-	nvmem-cell-names = "mac-address";
+&wifi1 {
+	mediatek,mtd-eeprom = <&factory 0x0000>;
+	ieee80211-freq-limit = <2400000 2500000>;
 };
 
 &gmac1 {
@@ -163,24 +60,3 @@
 		};
 	};
 };
-
-&state_default {
-	gpio {
-		groups = "jtag", "uart2", "uart3", "wdt";
-		function = "gpio";
-	};
-};
-
-&factory {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_factory_e000: macaddr@e000 {
-		reg = <0xe000 0x6>;
-	};
-
-	macaddr_factory_e006: macaddr@e006 {
-		reg = <0xe006 0x6>;
-	};
-};
diff --git a/target/linux/ramips/dts/mt7621_xiaomi_mi-router-4a-common.dtsi b/target/linux/ramips/dts/mt7621_xiaomi_mi-router-4a-common.dtsi
new file mode 100644
index 00000000000000..efc32733e9bc16
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_xiaomi_mi-router-4a-common.dtsi
@@ -0,0 +1,138 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	aliases {
+		led-boot = &led_status_yellow;
+		led-failsafe = &led_status_yellow;
+		led-running = &led_status_blue;
+		led-upgrade = &led_status_yellow;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200n8";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <50000000>;
+		m25p,fast-read;
+
+		partitions: partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "Bdata";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@50000 {
+				label = "factory";
+				reg = <0x50000 0x10000>;
+				read-only;
+			};
+
+			partition@60000 {
+				label = "crash";
+				reg = <0x60000 0x10000>;
+				read-only;
+			};
+
+			partition@70000 {
+				label = "cfg_bak";
+				reg = <0x70000 0x10000>;
+				read-only;
+			};
+
+			partition@80000 {
+				label = "overlay";
+				reg = <0x80000 0x100000>;
+				read-only;
+			};
+
+			firmware: partition@180000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x180000 0xe80000>;
+			};
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi0: wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+	};
+};
+
+&pcie1 {
+	wifi1: wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_e000>;
+	nvmem-cell-names = "mac-address";
+};
+
+&state_default {
+	gpio {
+		groups = "jtag", "uart2", "uart3", "wdt";
+		function = "gpio";
+	};
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_e000: macaddr@e000 {
+		reg = <0xe000 0x6>;
+	};
+
+	macaddr_factory_e006: macaddr@e006 {
+		reg = <0xe006 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_xiaomi_mi-router-4a-gigabit-v2.dts b/target/linux/ramips/dts/mt7621_xiaomi_mi-router-4a-gigabit-v2.dts
new file mode 100644
index 00000000000000..67ff6ea11e161f
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_xiaomi_mi-router-4a-gigabit-v2.dts
@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621_xiaomi_mi-router-4a-common.dtsi"
+
+/ {
+	compatible = "xiaomi,mi-router-4a-gigabit-v2", "mediatek,mt7621-soc";
+	model = "Xiaomi Mi Router 4A Gigabit Edition v2";
+
+	aliases {
+		label-mac-device = &wan;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_blue: status_blue {
+			label = "blue:status";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_yellow: status_yellow {
+			label = "yellow:status";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		wan_blue {
+			label = "blue:wan";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		};
+
+		wan_yellow {
+			label = "yellow:wan";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&partitions {
+	partition@180000 {
+		// size changed against to the common dtsi
+		reg = <0x180000 0xe70000>;
+	};
+
+	partition@ff0000 {
+		label = "Config";
+		reg = <0xff0000 0x10000>;
+		read-only;
+	};
+};
+
+&wifi0 {
+	mediatek,mtd-eeprom = <&factory 0x0000>;
+	ieee80211-freq-limit = <2400000 2500000>;
+};
+
+&wifi1 {
+	mediatek,mtd-eeprom = <&factory 0x8000>;
+	ieee80211-freq-limit = <5000000 6000000>;
+};
+
+&switch0 {
+	ports {
+		port@1 {
+			status = "okay";
+			label = "lan1";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		wan: port@3 {
+			status = "okay";
+			label = "wan";
+			nvmem-cells = <&macaddr_factory_e006>;
+			nvmem-cell-names = "mac-address";
+		};
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_youku_yk-l2.dts b/target/linux/ramips/dts/mt7621_youku_yk-l2.dts
index e588e047eb52dd..5342b40507af3f 100644
--- a/target/linux/ramips/dts/mt7621_youku_yk-l2.dts
+++ b/target/linux/ramips/dts/mt7621_youku_yk-l2.dts
@@ -95,8 +95,9 @@
 			};
 
 			partition@50000 {
-				compatible = "denx,uimage";
+				compatible = "openwrt,uimage", "denx,uimage";
 				label = "firmware";
+				openwrt,ih-magic = <0x12291000>;
 				reg = <0x50000 0xfb0000>;
 			};
 		};
diff --git a/target/linux/ramips/dts/mt7621_yuncore_fap640.dts b/target/linux/ramips/dts/mt7621_yuncore_fap640.dts
new file mode 100644
index 00000000000000..d525dde385b4d9
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_yuncore_fap640.dts
@@ -0,0 +1,218 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "yuncore,fap640", "mediatek,mt7621-soc";
+	model = "YunCore FAP640";
+
+	aliases {
+		led-boot = &led_status_blue;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_red;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_green: status_green {
+			label = "green:status";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_red: status_red {
+			label = "red:status";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_blue: status_blue {
+			label = "blue:status";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+		};
+
+		wan {
+			label = "green:wan";
+			gpios = <&switch0 12 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "mt7530-0:04:link";
+		};
+
+		lan1 {
+			label = "green:lan1";
+			gpios = <&switch0 9 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "mt7530-0:03:link";
+		};
+
+		lan2 {
+			label = "green:lan2";
+			gpios = <&switch0 6 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "mt7530-0:02:link";
+		};
+
+		lan3 {
+			label = "green:lan3";
+			gpios = <&switch0 3 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "mt7530-0:01:link";
+		};
+
+		lan4 {
+			label = "green:lan4";
+			gpios = <&switch0 0 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "mt7530-0:00:link";
+		};
+	};
+
+	watchdog {
+		compatible = "linux,wdt-gpio";
+		gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
+		hw_algo = "toggle";
+		hw_margin_ms = <200>;
+		always-running;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <80000000>;
+		m25p,fast-read;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "Bootloader";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "Config";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			/* range 0x40000 to 0x50000 is empty in vendor
+			 * firmware, so we do not use it either
+			 */
+
+			factory: partition@50000 {
+				label = "Factory";
+				reg = <0x50000 0x40000>;
+				read-only;
+			};
+
+			partition@90000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x90000 0xf70000>;
+			};
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0>;
+		mediatek,disable-radar-background;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_e006>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy4>;
+
+	nvmem-cells = <&macaddr_factory_0004>;
+	nvmem-cell-names = "mac-address";
+};
+
+&mdio {
+	ethphy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+
+&switch0 {
+	gpio-controller;
+	#gpio-cells = <2>;
+
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan4";
+		};
+
+		port@1 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan1";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "jtag", "wdt";
+		function = "gpio";
+	};
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_0004: macaddr@0004 {
+		reg = <0x0004 0x6>;
+	};
+
+	macaddr_factory_e006: macaddr@e006 {
+		reg = <0xe006 0x6>;
+	};
+};
+
diff --git a/target/linux/ramips/dts/mt7621_yuncore_fap690.dts b/target/linux/ramips/dts/mt7621_yuncore_fap690.dts
new file mode 100644
index 00000000000000..a998b95d4c51ee
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_yuncore_fap690.dts
@@ -0,0 +1,149 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "yuncore,fap690", "mediatek,mt7621-soc";
+	model = "YunCore FAP690";
+
+	aliases {
+		led-boot = &led_status_green;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_red;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_green: status_green {
+			label = "green:status";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_red: status_red {
+			label = "red:status";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_blue: status_blue {
+			label = "blue:status";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	watchdog {
+		compatible = "linux,wdt-gpio";
+		gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
+		hw_algo = "toggle";
+		hw_margin_ms = <200>;
+		always-running;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <80000000>;
+		m25p,fast-read;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "Bootloader";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "Config";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			/* range 0x40000 to 0x50000 is empty in vendor
+			 * firmware, so we do not use it either
+			 */
+
+			factory: partition@50000 {
+				label = "Factory";
+				reg = <0x50000 0x40000>;
+				read-only;
+			};
+
+			partition@90000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x90000 0xf70000>;
+			};
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0>;
+		mediatek,disable-radar-background;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_0004>;
+	nvmem-cell-names = "mac-address";
+};
+
+&switch0 {
+	ports {
+		port@4 {
+			status = "okay";
+			label = "lan";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "jtag", "wdt";
+		function = "gpio";
+	};
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_0004: macaddr@0004 {
+		reg = <0x0004 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_zbtlink_zbt-we1326.dts b/target/linux/ramips/dts/mt7621_zbtlink_zbt-we1326.dts
index 6aafe385ae6872..99b9652b7ab31c 100644
--- a/target/linux/ramips/dts/mt7621_zbtlink_zbt-we1326.dts
+++ b/target/linux/ramips/dts/mt7621_zbtlink_zbt-we1326.dts
@@ -121,19 +121,31 @@
 	status = "okay";
 };
 
-&pcie0 {
-	wifi0: mt76@0,0 {
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
 		reg = <0x0000 0 0 0 0>;
 		mediatek,mtd-eeprom = <&factory 0x8000>;
 		ieee80211-freq-limit = <5000000 6000000>;
+
+		led {
+			led-sources = <2>;
+			led-active-low;
+		};
 	};
 };
 
-&pcie1 {
-	wifi1: mt76@0,0 {
+&pcie2 {
+	wifi1: wifi@0,0 {
+		compatible = "mediatek,mt76";
 		reg = <0x0000 0 0 0 0>;
 		mediatek,mtd-eeprom = <&factory 0x0000>;
 		ieee80211-freq-limit = <2400000 2500000>;
+
+		led {
+			led-sources = <0>;
+			led-active-low;
+		};
 	};
 };
 
diff --git a/target/linux/ramips/dts/mt7621_zbtlink_zbt-wg1602-v04-16m.dts b/target/linux/ramips/dts/mt7621_zbtlink_zbt-wg1602-v04-16m.dts
new file mode 100644
index 00000000000000..61bac037422ab5
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_zbtlink_zbt-wg1602-v04-16m.dts
@@ -0,0 +1,10 @@
+#include "mt7621_zbtlink_zbt-wg1602-v04.dtsi"
+
+/ {
+	compatible = "zbtlink,zbt-wg1602-v04-16m", "zbtlink,zbt-wg1602-v04", "mediatek,mt7621-soc";
+	model = "Zbtlink ZBT-WG1602-V04 (16M)";
+};
+
+&firmware {
+	reg = <0x50000 0xfb0000>;
+};
diff --git a/target/linux/ramips/dts/mt7621_zbtlink_zbt-wg1602-v04-32m.dts b/target/linux/ramips/dts/mt7621_zbtlink_zbt-wg1602-v04-32m.dts
new file mode 100644
index 00000000000000..a3072c116b2c8b
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_zbtlink_zbt-wg1602-v04-32m.dts
@@ -0,0 +1,10 @@
+#include "mt7621_zbtlink_zbt-wg1602-v04.dtsi"
+
+/ {
+	compatible = "zbtlink,zbt-wg1602-v04-32m", "zbtlink,zbt-wg1602-v04", "mediatek,mt7621-soc";
+	model = "Zbtlink ZBT-WG1602-V04 (32M)";
+};
+
+&firmware {
+	reg = <0x50000 0x1fb0000>;
+};
diff --git a/target/linux/ramips/dts/mt7621_zbtlink_zbt-wg1602-v04.dtsi b/target/linux/ramips/dts/mt7621_zbtlink_zbt-wg1602-v04.dtsi
new file mode 100644
index 00000000000000..64492af4d8a276
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_zbtlink_zbt-wg1602-v04.dtsi
@@ -0,0 +1,215 @@
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "zbtlink,zbt-wg1602", "mediatek,mt7621-soc";
+
+	aliases {
+		led-boot = &led_sm;
+		led-failsafe = &led_sm;
+		led-running = &led_sm;
+		led-upgrade = &led_sm;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_sm: sm {
+			label = "green:sm";
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+		};
+
+		4g1 {
+			label = "green:4g1";
+			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
+		};
+
+		4g2 {
+			label = "green:4g2";
+			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	watchdog {
+		compatible = "linux,wdt-gpio";
+		gpios = <&gpio 3 GPIO_ACTIVE_HIGH>;
+		hw_algo = "toggle";
+		/* hw_margin_ms is actually ~120s but driver limits it to 60s */
+		hw_margin_ms = <60000>;
+		always-running;
+	};
+
+	gpio-export {
+		compatible = "gpio-export";
+		#size-cells = <0>;
+
+		4g1-pwr {
+			gpio-export,name = "4g1-pwr";
+			gpio-export,output = <1>;
+			gpios = <&gpio 8 GPIO_ACTIVE_HIGH>;
+		};
+
+		4g2-pwr {
+			gpio-export,name = "4g2-pwr";
+			gpio-export,output = <1>;
+			gpios = <&gpio 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		ext-usb {
+			gpio-export,name = "ext-usb";
+			gpio-export,output = <1>;
+			gpios = <&gpio 6 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&sdhci {
+	status = "okay";
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			firmware: partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+			};
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi0: wifi@0,0 {
+		compatible = "pci14c3,7603";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0000>;
+	};
+};
+
+&pcie1 {
+	wifi1: wifi@0,0 {
+		compatible = "pci14c3,7662";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x8000>;
+		ieee80211-freq-limit = <5000000 6000000>;
+
+		led {
+			led-sources = <2>;
+		};
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_e000>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy4>;
+
+	nvmem-cells = <&macaddr_factory_e006>;
+	nvmem-cell-names = "mac-address";
+};
+
+&mdio {
+	ethphy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan1";
+		};
+
+		port@1 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan4";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "uart2", "wdt";
+		function = "gpio";
+	};
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_e000: macaddr@e000 {
+		reg = <0xe000 0x6>;
+	};
+
+	macaddr_factory_e006: macaddr@e006 {
+		reg = <0xe006 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_zbtlink_zbt-wg1608.dtsi b/target/linux/ramips/dts/mt7621_zbtlink_zbt-wg1608.dtsi
index f19cb4db171134..59fab90ed1d2d5 100644
--- a/target/linux/ramips/dts/mt7621_zbtlink_zbt-wg1608.dtsi
+++ b/target/linux/ramips/dts/mt7621_zbtlink_zbt-wg1608.dtsi
@@ -51,40 +51,6 @@
 			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
 			linux,default-trigger = "phy1tpt";
 		};
-
-		lan1 {
-			color = <LED_COLOR_ID_GREEN>;
-			function = LED_FUNCTION_LAN;
-			function-enumerator = <1>;
-			gpios = <&switch0 0 GPIO_ACTIVE_LOW>;
-		};
-
-		lan2 {
-			color = <LED_COLOR_ID_GREEN>;
-			function = LED_FUNCTION_LAN;
-			function-enumerator = <2>;
-			gpios = <&switch0 3 GPIO_ACTIVE_LOW>;
-		};
-
-		lan3 {
-			color = <LED_COLOR_ID_GREEN>;
-			function = LED_FUNCTION_LAN;
-			function-enumerator = <3>;
-			gpios = <&switch0 6 GPIO_ACTIVE_LOW>;
-		};
-
-		lan4 {
-			color = <LED_COLOR_ID_GREEN>;
-			function = LED_FUNCTION_LAN;
-			function-enumerator = <4>;
-			gpios = <&switch0 9 GPIO_ACTIVE_HIGH>;
-		};
-
-		wan {
-			color = <LED_COLOR_ID_GREEN>;
-			function = LED_FUNCTION_WAN;
-			gpios = <&switch0 12 GPIO_ACTIVE_LOW>;
-		};
 	};
 };
 
@@ -186,9 +152,6 @@
 };
 
 &switch0 {
-	gpio-controller;
-	#gpio-cells = <2>;
-
 	ports {
 		port@0 {
 			status = "okay";
diff --git a/target/linux/ramips/dts/mt7621_zyxel_nwa50ax.dts b/target/linux/ramips/dts/mt7621_zyxel_nwa50ax.dts
index 62ba49e797ee56..2cdaa40a1c38ba 100644
--- a/target/linux/ramips/dts/mt7621_zyxel_nwa50ax.dts
+++ b/target/linux/ramips/dts/mt7621_zyxel_nwa50ax.dts
@@ -49,8 +49,8 @@
 };
 
 &state_default {
-        gpio {
-                groups = "uart3", "rgmii2";
-                function = "gpio";
-        };
+	gpio {
+		groups = "uart3", "rgmii2";
+		function = "gpio";
+	};
 };
diff --git a/target/linux/ramips/dts/mt7621_zyxel_wsm20.dts b/target/linux/ramips/dts/mt7621_zyxel_wsm20.dts
new file mode 100644
index 00000000000000..299d982dc11795
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_zyxel_wsm20.dts
@@ -0,0 +1,233 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "zyxel,wsm20", "mediatek,mt7621-soc";
+	model = "ZyXEL WSM20";
+
+	aliases {
+		led-boot = &led_system_white;
+		led-failsafe = &led_system_red;
+		led-running = &led_system_white;
+		led-upgrade = &led_system_red;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		bootargs-override = "console=ttyS0,115200n1";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_system_white: led-0 {
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+			label = "white:system";
+		};
+
+		led_system_red: led-1 {
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+			label = "red:system";
+		};
+
+		led-2 {
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+			label = "green:led1";
+		};
+
+		led-3 {
+			gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
+			label = "white:led2";
+		};
+
+		led-4 {
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			label = "green:led3";
+		};
+
+		led-5 {
+			gpios = <&gpio 17 GPIO_ACTIVE_HIGH>;
+			label = "red:led4";
+		};
+
+		led-6 {
+			gpios = <&gpio 5 GPIO_ACTIVE_HIGH>;
+			label = "white:led5";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		led {
+			label = "led";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_LIGHTS_TOGGLE>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 6 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			reg = <0x0 0x100000>;
+			label = "Bootloader";
+			read-only;
+		};
+
+		partition@100000 {
+			reg = <0x100000 0x100000>;
+			label = "Config";
+		};
+
+		factory: partition@200000 {
+			reg = <0x200000 0x1c0000>;
+			label = "Factory";
+			read-only;
+		};
+
+		partition@3c0000 {
+			reg = <0x3c0000 0x2800000>;
+			label = "firmware";
+
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "kernel";
+				reg = <0x0 0x800000>;
+			};
+
+			partition@800000 {
+				label = "ubi";
+				reg = <0x800000 0x2000000>;
+			};
+		};
+
+		partition@2bc0000 {
+			reg = <0x2bc0000 0x2800000>;
+			label = "Kernel2";
+		};
+
+		partition@53c0000 {
+			reg = <0x53c0000 0x100000>;
+			label = "persist";
+		};
+
+		partition@54c0000 {
+			reg = <0x54c0000 0x400000>;
+			label = "rootfs_data";
+			read-only;
+		};
+
+		partition@58C0000 {
+			reg = <0x58c0000 0x25c0000>;
+			label = "app";
+			read-only;
+		};
+
+		partition@7e80000 {
+			reg = <0x7e80000 0x100000>;
+			label = "crt";
+			read-only;
+		};
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_1fdfa>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy0>;
+
+	nvmem-cells = <&macaddr_factory_1fdf4>;
+	nvmem-cell-names = "mac-address";
+};
+
+&mdio {
+	ethphy0: ethernet-phy@0 {
+		reg = <0>;
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0>;
+		mediatek,disable-radar-background;
+	};
+};
+
+&pcie2 {
+	status = "disabled";
+};
+
+&switch0 {
+	ports {
+		port@1 {
+			status = "okay";
+			label = "lan3";
+		};
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+		port@3 {
+			status = "okay";
+			label = "lan1";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "uart3", "jtag", "wdt";
+		function = "gpio";
+	};
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_1fdfa: macaddr@1fdfa {
+		reg = <0x1fdfa 0x6>;
+	};
+
+	macaddr_factory_1fdf4: macaddr@1fdf4 {
+		reg = <0x1fdf4 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7628an_glinet_gl-mt300n-v2.dts b/target/linux/ramips/dts/mt7628an_glinet_gl-mt300n-v2.dts
index b002b618b34d3a..a3ce8cc59212cf 100644
--- a/target/linux/ramips/dts/mt7628an_glinet_gl-mt300n-v2.dts
+++ b/target/linux/ramips/dts/mt7628an_glinet_gl-mt300n-v2.dts
@@ -75,7 +75,7 @@
 
 &state_default {
 	gpio {
-		groups = "wdt", "gpio", "wled_an", "p0led_an", "p1led_an", "i2s";
+		groups = "wdt", "gpio", "wled_an", "p0led_an", "p1led_an", "i2s", "i2c";
 		function = "gpio";
 	};
 };
@@ -131,10 +131,6 @@
 	};
 };
 
-&i2c {
-	status = "okay";
-};
-
 &uart1 {
 	status = "okay";
 };
diff --git a/target/linux/ramips/dts/mt7628an_hiwifi_hc5611.dts b/target/linux/ramips/dts/mt7628an_hiwifi_hc5611.dts
new file mode 100644
index 00000000000000..17de299b3cbc43
--- /dev/null
+++ b/target/linux/ramips/dts/mt7628an_hiwifi_hc5611.dts
@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7628an_hiwifi_hc5x61a.dtsi"
+
+/ {
+	compatible = "hiwifi,hc5611", "mediatek,mt7628an-soc";
+	model = "HiWiFi HC5611";
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_system: system {
+			label = "green:system";
+			gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
+			default-state = "on";
+		};
+
+		internet {
+			label = "red:internet";
+			gpios = <&gpio 6 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "gpio", "spi cs1", "wdt";
+		function = "gpio";
+	};
+};
diff --git a/target/linux/ramips/dts/mt7628an_keenetic_kn-1613.dts b/target/linux/ramips/dts/mt7628an_keenetic_kn-1613.dts
new file mode 100644
index 00000000000000..4281682503a39d
--- /dev/null
+++ b/target/linux/ramips/dts/mt7628an_keenetic_kn-1613.dts
@@ -0,0 +1,223 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+#include "mt7628an.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "keenetic,kn-1613", "mediatek,mt7628an-soc";
+	model = "Keenetic KN-1613";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: power {
+			label = "green:power";
+			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		internet {
+			label = "green:internet";
+			gpios = <&gpio 38 GPIO_ACTIVE_LOW>;
+		};
+
+		wifi2 {
+			label = "green:wifi2";
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wifi5 {
+			label = "green:wifi5";
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		fn {
+			label = "fn";
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 44 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 37 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	virtual_flash {
+		compatible = "mtd-concat";
+		devices = <&firmware1 &firmware2>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x0 0x1ec0000>;
+			};
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2s", "i2c", "gpio", "refclk", "wdt", "wled_an";
+		function = "gpio";
+	};
+};
+
+&usbphy {
+	status = "disabled";
+};
+
+&ehci {
+	status = "disabled";
+};
+
+&ohci {
+	status = "disabled";
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <32000000>;
+
+		partitions: partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-config";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@40000 {
+				label = "rf-eeprom";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			firmware1: partition@50000 {
+				label = "firmware_1";
+				reg = <0x50000 0xf60000>;
+			};
+
+			partition@fb0000 {
+				label = "config_1";
+				reg = <0xfb0000 0x40000>;
+				read-only;
+			};
+
+			partition@ff0000 {
+				label = "dump";
+				reg = <0xff0000 0x10000>;
+				read-only;
+			};
+
+			partition@1000000 {
+				label = "u-state";
+				reg = <0x1000000 0x30000>;
+				read-only;
+			};
+
+			partition@1030000 {
+				label = "u-config_res";
+				reg = <0x1030000 0x10000>;
+				read-only;
+			};
+
+			partition@1040000 {
+				label = "rf-eeprom_res";
+				reg = <0x1040000 0x10000>;
+				read-only;
+			};
+
+			firmware2: partition@1050000 {
+				label = "firmware_2";
+				reg = <0x1050000 0xf60000>;
+			};
+
+			partition@1fb0000 {
+				label = "config_2";
+				reg = <0x1fb0000 0x40000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&ethernet {
+	nvmem-cells = <&macaddr_factory_4>;
+	nvmem-cell-names = "mac-address";
+};
+
+&esw {
+	mediatek,portmap = <0x3e>;
+};
+
+&wmac {
+	status = "okay";
+
+	mediatek,mtd-eeprom = <&factory 0x0>;
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0400>;
+		ieee80211-freq-limit = <5000000 6000000>;
+	};
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_4: macaddr@4 {
+		reg = <0x4 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7628an_linksys_e5400.dts b/target/linux/ramips/dts/mt7628an_linksys_e5400.dts
new file mode 100644
index 00000000000000..3a6403fe7f8df9
--- /dev/null
+++ b/target/linux/ramips/dts/mt7628an_linksys_e5400.dts
@@ -0,0 +1,163 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7628an.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "linksys,e5400", "mediatek,mt7628an-soc";
+	model = "Linksys E5400";
+
+	aliases {
+		led-boot = &led_wps;
+		led-failsafe = &led_wps;
+		led-running = &led_wps;
+		led-upgrade = &led_wps;
+		label-mac-device = &ethernet;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x0 0x4000000>;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 38 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_wps: wps {
+			label = "green:wps";
+			gpios = <&gpio 37 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <40000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_factory_28: macaddr@28 {
+					reg = <0x28 0x6>;
+				};
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x50000 0xfa0000>;
+			};
+
+			partition@ff0000 {
+				label = "cbtinfo";
+				reg = <0xff0000 0x10000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&ehci {
+	status = "disabled";
+};
+
+&esw {
+	mediatek,portmap = <0x2f>;
+	mediatek,portdisable = <0x20>;
+};
+
+&ethernet {
+	nvmem-cells = <&macaddr_factory_28>;
+	nvmem-cell-names = "mac-address";
+};
+
+&ohci {
+	status = "disabled";
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi5: wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x8000>;
+		ieee80211-freq-limit = <5000000 6000000>;
+
+		nvmem-cells = <&macaddr_factory_28>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <3>;
+	};
+};
+
+&state_default {
+	gpio {
+		group = "gpio", "i2c", "i2s", "refclk", "uart1", "wdt", "wled_an";
+		function = "gpio";
+	};
+};
+
+&usbphy {
+	status = "disabled";
+};
+
+&wmac {
+	status = "okay";
+
+	mediatek,mtd-eeprom = <&factory 0x0>;
+	nvmem-cells = <&macaddr_factory_28>;
+	nvmem-cell-names = "mac-address";
+	mac-address-increment = <2>;
+};
+
diff --git a/target/linux/ramips/dts/mt7628an_oraybox_x1.dts b/target/linux/ramips/dts/mt7628an_oraybox_x1.dts
new file mode 100644
index 00000000000000..eb9a20aae05653
--- /dev/null
+++ b/target/linux/ramips/dts/mt7628an_oraybox_x1.dts
@@ -0,0 +1,129 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "mt7628an.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "oraybox,x1", "mediatek,mt7628an-soc";
+	model = "OrayBox X1";
+
+	aliases {
+		led-boot = &led_status_white;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_white;
+		led-upgrade = &led_status_red;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_blue: status-blue {
+			label = "blue:status";
+			gpios = <&gpio 37 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_red: status-red {
+			label = "red:status";
+			gpios = <&gpio 1 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_white: status-white {
+			label = "white:status";
+			gpios = <&gpio 44 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 38 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <40000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "kpanic";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x50000 0xf00000>;
+			};
+
+			bdinfo: partition@fe0000 {
+				label = "bdinfo";
+				reg = <0xfe0000 0x10000>;
+				read-only;
+			};
+
+			partition@ff0000 {
+				label = "reserve";
+				reg = <0xff0000 0x10000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "jtag", "wdt";
+		function = "gpio";
+	};
+};
+
+&ethernet {
+	nvmem-cells = <&macaddr_bdinfo_9>;
+	nvmem-cell-names = "mac-address";
+};
+
+&wmac {
+	status = "okay";
+};
+
+&bdinfo {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_bdinfo_9: macaddr@9 {
+		reg = <0x9 0x6>;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7628an_tplink_re200-v2.dts b/target/linux/ramips/dts/mt7628an_tplink_re200-v2.dts
index a7e5e5110d4a4e..9f398ae0ff6dd9 100644
--- a/target/linux/ramips/dts/mt7628an_tplink_re200-v2.dts
+++ b/target/linux/ramips/dts/mt7628an_tplink_re200-v2.dts
@@ -5,4 +5,20 @@
 / {
 	compatible = "tplink,re200-v2", "mediatek,mt7628an-soc";
 	model = "TP-Link RE200 v2";
+
+	leds {
+		wifi2g_red {
+			label = "red:wifi2g";
+			gpios = <&gpio 43 GPIO_ACTIVE_LOW>;
+		};
+
+		wifi5g_red {
+			label = "red:wifi5g";
+			gpios = <&gpio 40 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&led_power {
+	gpios = <&gpio 44 GPIO_ACTIVE_LOW>;
 };
diff --git a/target/linux/ramips/dts/mt7628an_tplink_re200-v3.dts b/target/linux/ramips/dts/mt7628an_tplink_re200-v3.dts
index 2c4e09ee2ea917..7bb60c2a084b24 100644
--- a/target/linux/ramips/dts/mt7628an_tplink_re200-v3.dts
+++ b/target/linux/ramips/dts/mt7628an_tplink_re200-v3.dts
@@ -5,4 +5,15 @@
 / {
 	compatible = "tplink,re200-v3", "mediatek,mt7628an-soc";
 	model = "TP-Link RE200 v3";
+
+	leds {
+		wifi_red {
+			label = "red:wifi";
+			gpios = <&gpio 40 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&led_power {
+	gpios = <&gpio 43 GPIO_ACTIVE_LOW>;
 };
diff --git a/target/linux/ramips/dts/mt7628an_tplink_re200-v4.dts b/target/linux/ramips/dts/mt7628an_tplink_re200-v4.dts
index 83f1f3accadb97..9cde6a1f7482c2 100644
--- a/target/linux/ramips/dts/mt7628an_tplink_re200-v4.dts
+++ b/target/linux/ramips/dts/mt7628an_tplink_re200-v4.dts
@@ -5,4 +5,15 @@
 / {
 	compatible = "tplink,re200-v4", "mediatek,mt7628an-soc";
 	model = "TP-Link RE200 v4";
+
+	leds {
+		wifi_red {
+			label = "red:wifi";
+			gpios = <&gpio 40 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&led_power {
+	gpios = <&gpio 43 GPIO_ACTIVE_LOW>;
 };
diff --git a/target/linux/ramips/dts/mt7628an_tplink_re200.dtsi b/target/linux/ramips/dts/mt7628an_tplink_re200.dtsi
index d6b06ba2fcb1a8..1a8b26b1cce3e8 100644
--- a/target/linux/ramips/dts/mt7628an_tplink_re200.dtsi
+++ b/target/linux/ramips/dts/mt7628an_tplink_re200.dtsi
@@ -54,7 +54,6 @@
 
 		led_power: power {
 			label = "green:power";
-			gpios = <&gpio 44 GPIO_ACTIVE_LOW>;
 		};
 
 		wifi2g_green {
@@ -68,16 +67,6 @@
 			gpios = <&gpio 42 GPIO_ACTIVE_LOW>;
 			linux,default-trigger = "phy1tpt";
 		};
-
-		wifi2g_red {
-			label = "red:wifi2g";
-			gpios = <&gpio 43 GPIO_ACTIVE_LOW>;
-		};
-
-		wifi5g_red {
-			label = "red:wifi5g";
-			gpios = <&gpio 40 GPIO_ACTIVE_LOW>;
-		};
 	};
 };
 
diff --git a/target/linux/ramips/dts/mt7628an_tplink_re220-v2.dts b/target/linux/ramips/dts/mt7628an_tplink_re220-v2.dts
index 82d385a24d78e3..aa2db574819b3d 100644
--- a/target/linux/ramips/dts/mt7628an_tplink_re220-v2.dts
+++ b/target/linux/ramips/dts/mt7628an_tplink_re220-v2.dts
@@ -5,4 +5,20 @@
 / {
 	compatible = "tplink,re220-v2", "mediatek,mt7628an-soc";
 	model = "TP-Link RE220 v2";
+
+	leds {
+		wifi2g_red {
+			label = "red:wifi2g";
+			gpios = <&gpio 43 GPIO_ACTIVE_LOW>;
+		};
+
+		wifi5g_red {
+			label = "red:wifi5g";
+			gpios = <&gpio 40 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&led_power {
+	gpios = <&gpio 44 GPIO_ACTIVE_LOW>;
 };
diff --git a/target/linux/ramips/dts/mt7628an_tplink_re305-v3.dts b/target/linux/ramips/dts/mt7628an_tplink_re305-v3.dts
index 652aebec834636..21df0fb3e69d6f 100644
--- a/target/linux/ramips/dts/mt7628an_tplink_re305-v3.dts
+++ b/target/linux/ramips/dts/mt7628an_tplink_re305-v3.dts
@@ -13,7 +13,7 @@
 	flash@0 {
 		compatible = "jedec,spi-nor";
 		reg = <0>;
-		spi-max-frequency = <50000000>;
+		spi-max-frequency = <10000000>;
 
 		partitions {
 			compatible = "fixed-partitions";
diff --git a/target/linux/ramips/dts/mt7628an_xiaomi_mi-ra75.dts b/target/linux/ramips/dts/mt7628an_xiaomi_mi-ra75.dts
new file mode 100644
index 00000000000000..173bcd992d73e7
--- /dev/null
+++ b/target/linux/ramips/dts/mt7628an_xiaomi_mi-ra75.dts
@@ -0,0 +1,132 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7628an_xiaomi_mi-router-4.dtsi"
+
+/ {
+	compatible = "xiaomi,mi-ra75", "mediatek,mt7628an-soc";
+	model = "Xiaomi Mi AC1200 WLAN Range Extender RA75";
+	aliases {
+		led-boot = &led_system_amber;
+		led-failsafe = &led_system_amber;
+		led-running = &led_system_blue;
+		led-upgrade = &led_system_amber;
+		label-mac-device = &ethernet;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_system_blue: system_blue {
+			label = "blue:system";
+			gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
+		};
+		led_system_amber: system_amber {
+			label = "amber:system";
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+		};
+		led_signal_blue: signal_blue {
+			label = "blue:signal";
+			gpios = <&gpio 44 GPIO_ACTIVE_LOW>;
+		};
+		led_signal_amber: signal_amber {
+			label = "amber:signal";
+			gpios = <&gpio 37 GPIO_ACTIVE_LOW>;
+		};
+		led_signal_red: signal_red {
+			label = "red:signal";
+			gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 38 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+		wps {
+			label = "wps";
+			gpios = <&gpio 67 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+};
+
+&state_default {
+	gpio {
+		groups = "gpio", "refclk", "wdt", "wled_an", "uart1";
+		function = "gpio";
+	};
+};
+
+&partitions {
+	partition@60000 {
+		label = "overlay";
+		reg = <0x60000 0x100000>;
+		read-only;
+	};
+
+	partition@160000 {
+		label = "firmware";
+		reg = <0x160000 0xea0000>;
+		compatible = "denx,uimage";
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x8000>;
+		ieee80211-freq-limit = <5000000 6000000>;
+	};
+};
+
+&ethernet {
+	nvmem-cells = <&macaddr_factory_28>;
+	nvmem-cell-names = "mac-address";
+};
+
+&wmac {
+	ralink,mtd-eeprom = <&factory 0x0>;
+};
+
+
+&esw {
+	mediatek,portmap = <0x3e>;
+	mediatek,portdisable = <0x2a>;
+};
+
+&ehci {
+	status = "disabled";
+};
+
+&ohci {
+	status = "disabled";
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_4: macaddr@4 {
+		reg = <0x4 0x6>;
+	};
+
+	macaddr_factory_28: macaddr@28 {
+		reg = <0x28 0x6>;
+	};
+	macaddr_factory_8004: macaddr@8004 {
+		reg = <0x8004 0x6>;
+	};
+};
+
+
diff --git a/target/linux/ramips/dts/mt7628an_xiaomi_mi-router-4.dtsi b/target/linux/ramips/dts/mt7628an_xiaomi_mi-router-4.dtsi
index 0a48c060192166..59d269bf03eeae 100644
--- a/target/linux/ramips/dts/mt7628an_xiaomi_mi-router-4.dtsi
+++ b/target/linux/ramips/dts/mt7628an_xiaomi_mi-router-4.dtsi
@@ -6,32 +6,10 @@
 #include <dt-bindings/input/input.h>
 
 / {
-	aliases {
-		led-boot = &led_power_yellow;
-		led-failsafe = &led_power_yellow;
-		led-running = &led_power_blue;
-		led-upgrade = &led_power_yellow;
-		label-mac-device = &ethernet;
-	};
-
 	chosen {
 		bootargs = "console=ttyS0,115200";
 	};
 
-	leds {
-		compatible = "gpio-leds";
-
-		led_power_blue: power_blue {
-			label = "blue:power";
-			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
-		};
-
-		led_power_yellow: power_yellow {
-			label = "yellow:power";
-			gpios = <&gpio 44 GPIO_ACTIVE_LOW>;
-		};
-	};
-
 	keys {
 		compatible = "gpio-keys";
 
@@ -93,7 +71,7 @@
 
 &state_default {
 	gpio {
-		groups = "gpio", "wdt", "wled_an";
+		groups = "gpio", "refclk", "wdt", "wled_an";
 		function = "gpio";
 	};
 };
diff --git a/target/linux/ramips/dts/mt7628an_xiaomi_mi-router-4a-100m-intl.dts b/target/linux/ramips/dts/mt7628an_xiaomi_mi-router-4a-100m-intl.dts
index cdf259c51a610d..863191bc4b7cfc 100644
--- a/target/linux/ramips/dts/mt7628an_xiaomi_mi-router-4a-100m-intl.dts
+++ b/target/linux/ramips/dts/mt7628an_xiaomi_mi-router-4a-100m-intl.dts
@@ -5,6 +5,34 @@
 / {
 	compatible = "xiaomi,mi-router-4a-100m-intl", "mediatek,mt7628an-soc";
 	model = "Xiaomi Mi Router 4A (100M International Edition)";
+
+	aliases {
+		led-boot = &led_power_yellow;
+		led-failsafe = &led_power_yellow;
+		led-running = &led_power_blue;
+		led-upgrade = &led_power_yellow;
+		label-mac-device = &ethernet;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power_blue: power_blue {
+			label = "blue:power";
+			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_yellow: power_yellow {
+			label = "yellow:power";
+			gpios = <&gpio 44 GPIO_ACTIVE_LOW>;
+		};
+
+		wan {
+			label = "blue:wan";
+			gpios = <&gpio 37 GPIO_ACTIVE_LOW>;
+		};
+	};
+
 };
 
 &partitions {
diff --git a/target/linux/ramips/dts/mt7628an_xiaomi_mi-router-4a-100m.dts b/target/linux/ramips/dts/mt7628an_xiaomi_mi-router-4a-100m.dts
index 626b36366d833f..5ddc7af4621e93 100644
--- a/target/linux/ramips/dts/mt7628an_xiaomi_mi-router-4a-100m.dts
+++ b/target/linux/ramips/dts/mt7628an_xiaomi_mi-router-4a-100m.dts
@@ -5,6 +5,34 @@
 / {
 	compatible = "xiaomi,mi-router-4a-100m", "mediatek,mt7628an-soc";
 	model = "Xiaomi Mi Router 4A (100M Edition)";
+
+	aliases {
+		led-boot = &led_power_yellow;
+		led-failsafe = &led_power_yellow;
+		led-running = &led_power_blue;
+		led-upgrade = &led_power_yellow;
+		label-mac-device = &ethernet;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power_blue: power_blue {
+			label = "blue:power";
+			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_yellow: power_yellow {
+			label = "yellow:power";
+			gpios = <&gpio 44 GPIO_ACTIVE_LOW>;
+		};
+
+		wan {
+			label = "blue:wan";
+			gpios = <&gpio 37 GPIO_ACTIVE_LOW>;
+		};
+	};
+
 };
 
 &partitions {
diff --git a/target/linux/ramips/dts/mt7628an_xiaomi_mi-router-4c.dts b/target/linux/ramips/dts/mt7628an_xiaomi_mi-router-4c.dts
index e3aae273a9ac6a..e9bbf76e4baa28 100644
--- a/target/linux/ramips/dts/mt7628an_xiaomi_mi-router-4c.dts
+++ b/target/linux/ramips/dts/mt7628an_xiaomi_mi-router-4c.dts
@@ -7,8 +7,33 @@
 	model = "Xiaomi Mi Router 4C";
 
 	aliases {
+		led-boot = &led_power_yellow;
+		led-failsafe = &led_power_yellow;
+		led-running = &led_power_blue;
+		led-upgrade = &led_power_yellow;
 		label-mac-device = &ethernet;
 	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power_blue: power_blue {
+			label = "blue:power";
+			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_yellow: power_yellow {
+			label = "yellow:power";
+			gpios = <&gpio 44 GPIO_ACTIVE_LOW>;
+		};
+
+		wan {
+			label = "blue:wan";
+			gpios = <&gpio 37 GPIO_ACTIVE_LOW>;
+		};
+
+	};
+
 };
 
 &flash0 {
diff --git a/target/linux/ramips/dts/mt7628an_zyxel_keenetic-extra-ii.dts b/target/linux/ramips/dts/mt7628an_zyxel_keenetic-extra-ii.dts
index d292b211afce93..c53289debf0934 100644
--- a/target/linux/ramips/dts/mt7628an_zyxel_keenetic-extra-ii.dts
+++ b/target/linux/ramips/dts/mt7628an_zyxel_keenetic-extra-ii.dts
@@ -46,7 +46,6 @@
 		led_power: power {
 			label = "green:power";
 			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
-			default-state = "keep";
 		};
 
 		internet {
@@ -77,6 +76,23 @@
 			gpios = <&gpio 6 GPIO_ACTIVE_HIGH>;
 		};
 	};
+
+	virtual_flash {
+		compatible = "mtd-concat";
+		devices = <&firmware1 &firmware2>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x0 0x1d20000>;
+			};
+		};
+	};
 };
 
 &spi0 {
@@ -85,8 +101,7 @@
 	flash@0 {
 		compatible = "jedec,spi-nor";
 		reg = <0>;
-		spi-max-frequency = <10000000>;
-		broken-flash-reset;
+		spi-max-frequency = <32000000>;
 
 		partitions {
 			compatible = "fixed-partitions";
@@ -106,14 +121,13 @@
 			};
 
 			factory: partition@40000 {
-				label = "factory";
+				label = "rf-eeprom";
 				reg = <0x40000 0x10000>;
 				read-only;
 			};
 
-			partition@50000 {
-				compatible = "denx,uimage";
-				label = "firmware";
+			firmware1: partition@50000 {
+				label = "firmware_1";
 				reg = <0x50000 0xe90000>;
 			};
 
@@ -153,10 +167,9 @@
 				read-only;
 			};
 
-			partition@1050000 {
+			firmware2: partition@1050000 {
 				label = "firmware_2";
 				reg = <0x1050000 0xe90000>;
-				read-only;
 			};
 
 			partition@1ee0000 {
@@ -189,6 +202,7 @@
 
 &pcie0 {
 	mt76@0,0 {
+		compatible = "mediatek,mt76";
 		reg = <0x0000 0 0 0 0>;
 		mediatek,mtd-eeprom = <&factory 0x8000>;
 		ieee80211-freq-limit = <5000000 6000000>;
diff --git a/target/linux/ramips/dts/rt5350_dlink_dwr-512-b.dts b/target/linux/ramips/dts/rt5350_dlink_dwr-512-b.dts
index a7fc4765b76bef..7bb1d81abf9623 100644
--- a/target/linux/ramips/dts/rt5350_dlink_dwr-512-b.dts
+++ b/target/linux/ramips/dts/rt5350_dlink_dwr-512-b.dts
@@ -116,7 +116,7 @@
 	spidev@0 {
 		#address-cells = <1>;
 		#size-cells = <1>;
-		compatible = "siliconlabs,si3210";
+		compatible = "silabs,si3210";
 
 		reg = <0>;
 		spi-max-frequency = <1000000>;
diff --git a/target/linux/ramips/files/drivers/mmc/host/mtk-mmc/dbg.c b/target/linux/ramips/files/drivers/mmc/host/mtk-mmc/dbg.c
index d897b121634883..fc5f1e4985a348 100644
--- a/target/linux/ramips/files/drivers/mmc/host/mtk-mmc/dbg.c
+++ b/target/linux/ramips/files/drivers/mmc/host/mtk-mmc/dbg.c
@@ -48,8 +48,6 @@
 #include "mt6575_sd.h"
 #include <linux/seq_file.h>
 
-static char cmd_buf[256];
-
 /* for debug zone */
 unsigned int sd_debug_zone[4] = {
 	0,
@@ -59,6 +57,9 @@ unsigned int sd_debug_zone[4] = {
 };
 
 #if defined(MT6575_SD_DEBUG)
+
+static char cmd_buf[256];
+
 /* for driver profile */
 #define TICKS_ONE_MS  (13000)
 u32 gpt_enable;
diff --git a/target/linux/ramips/files/drivers/mtd/nand/raw/mt7621_nand.c b/target/linux/ramips/files/drivers/mtd/nand/raw/mt7621_nand.c
index f3a81ee4e24101..89cc7e2624af08 100644
--- a/target/linux/ramips/files/drivers/mtd/nand/raw/mt7621_nand.c
+++ b/target/linux/ramips/files/drivers/mtd/nand/raw/mt7621_nand.c
@@ -1006,7 +1006,7 @@ static int mt7621_nfc_read_page_hwecc(struct nand_chip *nand, uint8_t *buf,
 {
 	struct mt7621_nfc *nfc = nand_get_controller_data(nand);
 	struct mtd_info *mtd = nand_to_mtd(nand);
-	int bitflips = 0;
+	int bitflips = 0, ret = 0;
 	int rc, i;
 
 	nand_read_page_op(nand, page, 0, NULL, 0);
@@ -1031,7 +1031,7 @@ static int mt7621_nfc_read_page_hwecc(struct nand_chip *nand, uint8_t *buf,
 		mt7621_nfc_read_sector_fdm(nfc, i);
 
 		if (rc < 0) {
-			bitflips = -EIO;
+			ret = -EIO;
 			continue;
 		}
 
@@ -1043,10 +1043,11 @@ static int mt7621_nfc_read_page_hwecc(struct nand_chip *nand, uint8_t *buf,
 			dev_dbg(nfc->dev,
 				 "Uncorrectable ECC error at page %d.%d\n",
 				 page, i);
-			bitflips = -EBADMSG;
+			bitflips = nand->ecc.strength + 1;
 			mtd->ecc_stats.failed++;
-		} else if (bitflips >= 0) {
-			bitflips += rc;
+		} else {
+			if (rc > bitflips)
+				bitflips = rc;
 			mtd->ecc_stats.corrected += rc;
 		}
 	}
@@ -1055,6 +1056,9 @@ static int mt7621_nfc_read_page_hwecc(struct nand_chip *nand, uint8_t *buf,
 
 	nfi_write16(nfc, NFI_CON, 0);
 
+	if (ret < 0)
+		return ret;
+
 	return bitflips;
 }
 
diff --git a/target/linux/ramips/files/drivers/net/ethernet/ralink/esw_rt3050.c b/target/linux/ramips/files/drivers/net/ethernet/ralink/esw_rt3050.c
index fe787fe92f909c..47471eb1973e8e 100644
--- a/target/linux/ramips/files/drivers/net/ethernet/ralink/esw_rt3050.c
+++ b/target/linux/ramips/files/drivers/net/ethernet/ralink/esw_rt3050.c
@@ -766,7 +766,6 @@ static irqreturn_t esw_interrupt(int irq, void *_esw)
 {
 	struct rt305x_esw *esw = (struct rt305x_esw *) _esw;
 	u32 status;
-	int i;
 
 	status = esw_r32(esw, RT305X_ESW_REG_ISR);
 	if (status & RT305X_ESW_PORT_ST_CHG) {
@@ -1533,7 +1532,7 @@ int rt3050_esw_init(struct fe_priv *priv)
 	}
 
 	dev_info(&pdev->dev, "mediatek esw at 0x%08lx, irq %d initialized\n",
-		   esw->base, esw->irq);
+		 (long unsigned int)esw->base, esw->irq);
 
 	return 0;
 }
diff --git a/target/linux/ramips/files/drivers/net/ethernet/ralink/gsw_mt7620.c b/target/linux/ramips/files/drivers/net/ethernet/ralink/gsw_mt7620.c
index 7c91e5840b64f0..84b6e305a4f9e3 100644
--- a/target/linux/ramips/files/drivers/net/ethernet/ralink/gsw_mt7620.c
+++ b/target/linux/ramips/files/drivers/net/ethernet/ralink/gsw_mt7620.c
@@ -61,26 +61,20 @@ static irqreturn_t gsw_interrupt_mt7620(int irq, void *_priv)
 	return IRQ_HANDLED;
 }
 
-static void mt7620_hw_init(struct mt7620_gsw *gsw)
+static void mt7620_ephy_init(struct mt7620_gsw *gsw)
 {
 	u32 i;
 	u32 val;
 	u32 is_BGA = (rt_sysc_r32(SYSC_REG_CHIP_REV_ID) >> 16) & 1;
 
-	/* Internal ethernet requires PCIe RC mode */
-	rt_sysc_w32(rt_sysc_r32(SYSC_REG_CFG1) | PCIE_RC_MODE, SYSC_REG_CFG1);
-
-	mtk_switch_w32(gsw, mtk_switch_r32(gsw, GSW_REG_CKGCR) & ~(0x3 << 4), GSW_REG_CKGCR);
-
-	/* Enable MIB stats */
-	mtk_switch_w32(gsw, mtk_switch_r32(gsw, GSW_REG_MIB_CNT_EN) | (1 << 1), GSW_REG_MIB_CNT_EN);
-
 	if (gsw->ephy_disable) {
 		mtk_switch_w32(gsw, mtk_switch_r32(gsw, GSW_REG_GPC1) |
 			(gsw->ephy_base << 16) | (0x1f << 24),
 			GSW_REG_GPC1);
 
 		pr_info("gsw: internal ephy disabled\n");
+
+		return;
 	} else if (gsw->ephy_base) {
 		mtk_switch_w32(gsw, mtk_switch_r32(gsw, GSW_REG_GPC1) |
 			(gsw->ephy_base << 16),
@@ -158,12 +152,6 @@ static void mt7620_hw_init(struct mt7620_gsw *gsw)
 	_mt7620_mii_write(gsw, gsw->ephy_base + 2, 16, 0x1515);
 	_mt7620_mii_write(gsw, gsw->ephy_base + 3, 16, 0x0f0f);
 
-	/* CPU Port6 Force Link 1G, FC ON */
-	mtk_switch_w32(gsw, 0x5e33b, GSW_REG_PORT_PMCR(6));
-
-	/* Set Port 6 as CPU Port */
-	mtk_switch_w32(gsw, 0x7f7f7fe0, 0x0010);
-
 	/* setup port 4 */
 	if (gsw->port4_ephy) {
 		val = rt_sysc_r32(SYSC_REG_CFG1);
@@ -177,6 +165,24 @@ static void mt7620_hw_init(struct mt7620_gsw *gsw)
 	}
 }
 
+static void mt7620_mac_init(struct mt7620_gsw *gsw)
+{
+	/* Internal ethernet requires PCIe RC mode */
+	rt_sysc_w32(rt_sysc_r32(SYSC_REG_CFG1) | PCIE_RC_MODE, SYSC_REG_CFG1);
+
+	/* Keep Global Clocks on Idle traffic */
+	mtk_switch_w32(gsw, mtk_switch_r32(gsw, GSW_REG_CKGCR) & ~(0x3 << 4), GSW_REG_CKGCR);
+
+	/* Set Port 6 to Force Link 1G, Flow Control ON */
+	mtk_switch_w32(gsw, 0x5e33b, GSW_REG_PORT_PMCR(6));
+
+	/* Set Port 6 as CPU Port */
+	mtk_switch_w32(gsw, 0x7f7f7fe0, 0x0010);
+
+	/* Enable MIB stats */
+	mtk_switch_w32(gsw, mtk_switch_r32(gsw, GSW_REG_MIB_CNT_EN) | (1 << 1), GSW_REG_MIB_CNT_EN);
+}
+
 static const struct of_device_id mediatek_gsw_match[] = {
 	{ .compatible = "mediatek,mt7620-gsw" },
 	{},
@@ -191,6 +197,7 @@ int mtk_gsw_init(struct fe_priv *priv)
 	struct platform_device *pdev = of_find_device_by_node(np);
 	struct mt7620_gsw *gsw;
 	const __be32 *id;
+	int ret;
 	u8 val;
 
 	if (!pdev)
@@ -222,11 +229,17 @@ int mtk_gsw_init(struct fe_priv *priv)
 	else
 		gsw->ephy_base = 0;
 
-	mt7620_hw_init(gsw);
+	mt7620_mac_init(gsw);
+
+	mt7620_ephy_init(gsw);
 
 	if (gsw->irq) {
-		request_irq(gsw->irq, gsw_interrupt_mt7620, 0,
-			    "gsw", priv);
+		ret = request_irq(gsw->irq, gsw_interrupt_mt7620, 0,
+				  "gsw", priv);
+		if (ret) {
+			dev_err(&pdev->dev, "Failed to request irq");
+			return ret;
+		}
 		mtk_switch_w32(gsw, ~PORT_IRQ_ST_CHG, GSW_REG_IMR);
 	}
 
diff --git a/target/linux/ramips/files/drivers/net/ethernet/ralink/mdio.c b/target/linux/ramips/files/drivers/net/ethernet/ralink/mdio.c
index b923b02af9f0ae..a6448443c01f3e 100644
--- a/target/linux/ramips/files/drivers/net/ethernet/ralink/mdio.c
+++ b/target/linux/ramips/files/drivers/net/ethernet/ralink/mdio.c
@@ -64,11 +64,7 @@ int fe_connect_phy_node(struct fe_priv *priv, struct device_node *phy_node, int
 {
 	const __be32 *_phy_addr = NULL;
 	struct phy_device *phydev;
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 10, 0)
-	int phy_mode;
-#else
 	phy_interface_t phy_mode = PHY_INTERFACE_MODE_NA;
-#endif
 
 	_phy_addr = of_get_property(phy_node, "reg", NULL);
 
@@ -77,13 +73,8 @@ int fe_connect_phy_node(struct fe_priv *priv, struct device_node *phy_node, int
 		return -EINVAL;
 	}
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 10, 0)
-	phy_mode = of_get_phy_mode(phy_node);
-	if (phy_mode < 0) {
-#else
 	of_get_phy_mode(phy_node, &phy_mode);
 	if (phy_mode == PHY_INTERFACE_MODE_NA) {
-#endif
 		dev_err(priv->dev, "incorrect phy-mode %d\n", phy_mode);
 		priv->phy->phy_node[port] = NULL;
 		return -EINVAL;
diff --git a/target/linux/ramips/files/drivers/net/ethernet/ralink/mdio_rt2880.c b/target/linux/ramips/files/drivers/net/ethernet/ralink/mdio_rt2880.c
index 6242cf9b4234c4..0c47d118464c6f 100644
--- a/target/linux/ramips/files/drivers/net/ethernet/ralink/mdio_rt2880.c
+++ b/target/linux/ramips/files/drivers/net/ethernet/ralink/mdio_rt2880.c
@@ -156,11 +156,7 @@ void rt2880_port_init(struct fe_priv *priv, struct device_node *np)
 	const __be32 *id = of_get_property(np, "reg", NULL);
 	const __be32 *link;
 	int size;
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 10, 0)
-	int phy_mode;
-#else
 	phy_interface_t phy_mode = PHY_INTERFACE_MODE_NA;
-#endif
 
 	if (!id || (be32_to_cpu(*id) != 0)) {
 		pr_err("%s: invalid port id\n", np->name);
@@ -176,11 +172,7 @@ void rt2880_port_init(struct fe_priv *priv, struct device_node *np)
 		return;
 	}
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 10, 0)
-	phy_mode = of_get_phy_mode(np);
-#else
 	of_get_phy_mode(np, &phy_mode);
-#endif
 	switch (phy_mode) {
 	case PHY_INTERFACE_MODE_RGMII:
 		break;
diff --git a/target/linux/ramips/files/drivers/net/ethernet/ralink/mtk_eth_soc.c b/target/linux/ramips/files/drivers/net/ethernet/ralink/mtk_eth_soc.c
index e07e5ed5a8f892..b79b34893808c2 100644
--- a/target/linux/ramips/files/drivers/net/ethernet/ralink/mtk_eth_soc.c
+++ b/target/linux/ramips/files/drivers/net/ethernet/ralink/mtk_eth_soc.c
@@ -1096,11 +1096,7 @@ static int fe_poll(struct napi_struct *napi, int budget)
 	return rx_done;
 }
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 10, 0)
-static void fe_tx_timeout(struct net_device *dev)
-#else
 static void fe_tx_timeout(struct net_device *dev, unsigned int txqueue)
-#endif
 {
 	struct fe_priv *priv = netdev_priv(dev);
 	struct fe_tx_ring *ring = &priv->tx_ring;
@@ -1561,7 +1557,9 @@ static int fe_probe(struct platform_device *pdev)
 	struct clk *sysclk;
 	int err, napi_weight;
 
-	device_reset(&pdev->dev);
+	err = device_reset(&pdev->dev);
+	if (err)
+		dev_err(&pdev->dev, "failed to reset device\n");
 
 	match = of_match_device(of_fe_match, &pdev->dev);
 	soc = (struct fe_soc_data *)match->data;
diff --git a/target/linux/ramips/files/drivers/net/ethernet/ralink/soc_mt7620.c b/target/linux/ramips/files/drivers/net/ethernet/ralink/soc_mt7620.c
index 42685eebc330d9..a4b2908d59e3d9 100644
--- a/target/linux/ramips/files/drivers/net/ethernet/ralink/soc_mt7620.c
+++ b/target/linux/ramips/files/drivers/net/ethernet/ralink/soc_mt7620.c
@@ -144,11 +144,7 @@ static void mt7620_port_init(struct fe_priv *priv, struct device_node *np)
 	struct mt7620_gsw *gsw = (struct mt7620_gsw *)priv->soc->swpriv;
 	const __be32 *_id = of_get_property(np, "reg", NULL);
 	const __be32 *phy_addr;
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 10, 0)
-	int phy_mode;
-#else
 	phy_interface_t phy_mode = PHY_INTERFACE_MODE_NA;
-#endif
 	int size, id;
 	int shift = 12;
 	u32 val, mask = 0;
@@ -178,11 +174,7 @@ static void mt7620_port_init(struct fe_priv *priv, struct device_node *np)
 		priv->phy->phy_fixed[id] = NULL;
 	}
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 10, 0)
-	phy_mode = of_get_phy_mode(np);
-#else
 	of_get_phy_mode(np, &phy_mode);
-#endif
 	switch (phy_mode) {
 	case PHY_INTERFACE_MODE_RGMII:
 		mask = 0;
diff --git a/target/linux/ramips/files/drivers/pinctrl/pinctrl-aw9523.c b/target/linux/ramips/files/drivers/pinctrl/pinctrl-aw9523.c
index 4e75c9bf079d64..4900c5a0c0e0fb 100644
--- a/target/linux/ramips/files/drivers/pinctrl/pinctrl-aw9523.c
+++ b/target/linux/ramips/files/drivers/pinctrl/pinctrl-aw9523.c
@@ -386,11 +386,6 @@ static const struct pinconf_ops aw9523_pinconf_ops = {
 	.is_generic = true,
 };
 
-#if LINUX_VERSION_CODE <= KERNEL_VERSION(5, 5, 0)
-#define GPIO_LINE_DIRECTION_IN	1
-#define GPIO_LINE_DIRECTION_OUT	0
-#endif
-
 /*
  * aw9523_get_pin_direction - Get pin direction
  * @regmap: Regmap structure
@@ -437,11 +432,6 @@ static int aw9523_get_port_state(struct regmap *regmap, u8 pin,
 	return regmap_read(regmap, reg, state);
 }
 
-#if LINUX_VERSION_CODE <= KERNEL_VERSION(5, 5, 0)
-#undef GPIO_LINE_DIRECTION_IN
-#undef GPIO_LINE_DIRECTION_OUT
-#endif
-
 static int aw9523_gpio_irq_type(struct irq_data *d, unsigned int type)
 {
 	switch (type) {
diff --git a/target/linux/ramips/image/Makefile b/target/linux/ramips/image/Makefile
index d48b22023115ea..c080456e7a7527 100644
--- a/target/linux/ramips/image/Makefile
+++ b/target/linux/ramips/image/Makefile
@@ -28,11 +28,6 @@ LOADER_FLASH_START := $(ldrflashstart-y)
 
 KERNEL_DTB = kernel-bin | append-dtb | lzma
 
-define Build/edimax-header
-	$(STAGING_DIR_HOST)/bin/mkedimaximg -i $@ -o $@.new $(1)
-	@mv $@.new $@
-endef
-
 define Build/jcg-header
 	$(STAGING_DIR_HOST)/bin/jcgimage -v $(1) \
 		$(if $(JCG_MAXSIZE), -m $$(($(subst k, * 1024,$(JCG_MAXSIZE)))),) \
@@ -48,6 +43,7 @@ define Build/loader-common
 		BOARD="$(BOARDNAME)" PLATFORM="$(LOADER_PLATFORM)" \
 		LZMA_TEXT_START=$(LZMA_TEXT_START) \
 		LOADADDR=$(LOADADDR) \
+		SUBTARGET=$(SUBTARGET) \
 		$(1) compile loader.$(LOADER_TYPE)
 	mv "$@.$(LOADER_TYPE)" "$@"
 	rm -rf $@.src
@@ -176,6 +172,7 @@ endef
 
 define Device/Default
   PROFILES = Default
+  BLOCKSIZE := 64k
   KERNEL := $(KERNEL_DTB) | uImage lzma
   KERNEL_LOADADDR := $(loadaddr-y)
   LZMA_TEXT_START := 0x81800000
@@ -189,7 +186,6 @@ define Device/Default
 endef
 
 define Device/netgear_sercomm_nor
-  BLOCKSIZE := 64k
   DEVICE_VENDOR := NETGEAR
   IMAGES += factory.img
   IMAGE/default := append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs | \
@@ -201,7 +197,6 @@ define Device/netgear_sercomm_nor
 endef
 
 define Device/seama
-  BLOCKSIZE := 64k
   SEAMA_MTDBLOCK := 2
   IMAGES += factory.bin
 
@@ -218,7 +213,15 @@ endef
 
 define Device/uimage-lzma-loader
   LOADER_TYPE := bin
-  KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | uImage none
+  KERNEL/lzma-loader := kernel-bin | append-dtb | lzma | loader-kernel
+  KERNEL := $$(KERNEL/lzma-loader) | uImage none
+endef
+
+define Device/seama-lzma-loader
+  $(Device/seama)
+  $(Device/uimage-lzma-loader)
+  KERNEL := $$(KERNEL/lzma-loader) | relocate-kernel | lzma -a0
+  KERNEL_INITRAMFS := $$(KERNEL/lzma-loader) | uImage none
 endef
 
 include $(SUBTARGET).mk
diff --git a/target/linux/ramips/image/common-sercomm.mk b/target/linux/ramips/image/common-sercomm.mk
index e96cba879c42bd..fbe29d701749be 100644
--- a/target/linux/ramips/image/common-sercomm.mk
+++ b/target/linux/ramips/image/common-sercomm.mk
@@ -1,4 +1,5 @@
 DEVICE_VARS += SERCOMM_KERNEL_OFFSET SERCOMM_ROOTFS_OFFSET
+DEVICE_VARS += SERCOMM_KERNEL2_OFFSET SERCOMM_ROOTFS2_OFFSET
 
 define Build/sercomm-crypto
 	$(TOPDIR)/scripts/sercomm-crypto.py \
@@ -16,6 +17,23 @@ define Build/sercomm-crypto
 	rm -f $@.enc $@.key
 endef
 
+define Build/sercomm-factory-cqr
+	$(TOPDIR)/scripts/sercomm-pid.py \
+		--hw-version $(SERCOMM_HWVER) \
+		--hw-id $(SERCOMM_HWID) \
+		--sw-version $(SERCOMM_SWVER) \
+		--pid-file $@.fhdr
+	printf $$(stat -c%s $(IMAGE_KERNEL)) | \
+		dd seek=$$((0x70)) of=$@.fhdr bs=1 conv=notrunc 2>/dev/null
+	printf $$(($$(stat -c%s $@)-$$(stat -c%s $(IMAGE_KERNEL))-$$((0x200)))) | \
+		dd seek=$$((0x80)) of=$@.fhdr bs=1 conv=notrunc 2>/dev/null
+	dd bs=$$((0x200)) skip=1 if=$@ conv=notrunc 2>/dev/null | \
+		$(MKHASH) md5 | awk '{print $$1}' | tr -d '\n' | \
+		dd seek=$$((0x1e0)) of=$@.fhdr bs=1 conv=notrunc 2>/dev/null
+	dd if=$@ >> $@.fhdr 2>/dev/null
+	mv $@.fhdr $@
+endef
+
 define Build/sercomm-kernel
 	$(TOPDIR)/scripts/sercomm-kernel-header.py \
 		--kernel-image $@ \
@@ -26,6 +44,22 @@ define Build/sercomm-kernel
 	mv $@.hdr $@
 endef
 
+define Build/sercomm-kernel-factory
+	$(TOPDIR)/scripts/sercomm-kernel-header.py \
+		--kernel-image $@ \
+		--kernel-offset $(SERCOMM_KERNEL_OFFSET) \
+		--rootfs-offset $(SERCOMM_ROOTFS_OFFSET) \
+		--output-header $@.khdr1
+	$(TOPDIR)/scripts/sercomm-kernel-header.py \
+		--kernel-image $@ \
+		--kernel-offset $(SERCOMM_KERNEL2_OFFSET) \
+		--rootfs-offset $(SERCOMM_ROOTFS2_OFFSET) \
+		--output-header $@.khdr2
+	cat $@.khdr1 $@.khdr2 > $@.khdr
+	dd if=$@ >> $@.khdr 2>/dev/null
+	mv $@.khdr $@
+endef
+
 define Build/sercomm-part-tag
 	$(call Build/sercomm-part-tag-common,$(word 1,$(1)) $@)
 endef
@@ -51,7 +85,7 @@ define Build/sercomm-payload
 	$(TOPDIR)/scripts/sercomm-payload.py \
 		--input-file $@ \
 		--output-file $@.tmp \
-		--pid "$$(cat $@.pid | od -t x1 -An -v | tr -d '\n')"
+		--pid-file $@.pid
 	mv $@.tmp $@
 	rm $@.pid
 endef
@@ -64,24 +98,37 @@ define Build/sercomm-prepend-tagged-kernel
 	mv $(IMAGE_KERNEL).tagged $@
 endef
 
-define Device/sercomm_dxx
-  $(Device/dsa-migration)
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  KERNEL_SIZE := 6144k
-  UBINIZE_OPTS := -E 5
+define Device/sercomm
+  $(Device/nand)
   LOADER_TYPE := bin
+  KERNEL_SIZE := 6144k
   KERNEL_LOADADDR := 0x81001000
   LZMA_TEXT_START := 0x82800000
+  SERCOMM_KERNEL_OFFSET := 0x400100
+  SERCOMM_ROOTFS_OFFSET := 0x1000000
+  IMAGES += factory.img
+endef
+
+define Device/sercomm_cxx
+  $(Device/sercomm)
+  SERCOMM_KERNEL2_OFFSET := 0xa00100
+  SERCOMM_ROOTFS2_OFFSET := 0x3000000
+  KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | lzma -a0 | \
+	uImage lzma
+  IMAGE/sysupgrade.bin := append-kernel | sercomm-kernel | \
+	sysupgrade-tar kernel=$$$$@ | append-metadata
+  IMAGE/factory.img := append-kernel | sercomm-kernel-factory | \
+	append-ubi | sercomm-factory-cqr
+endef
+
+define Device/sercomm_dxx
+  $(Device/sercomm)
   KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | lzma -a0 | \
 	uImage lzma | sercomm-kernel
   KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel | \
 	lzma -a0 | uImage lzma
-  IMAGES += factory.img
   IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
-  IMAGE/factory.img := append-ubi | sercomm-part-tag rootfs | \
-	sercomm-prepend-tagged-kernel kernel | gzip | sercomm-payload | \
-	sercomm-crypto
-  SERCOMM_KERNEL_OFFSET := 0x400100
-  SERCOMM_ROOTFS_OFFSET := 0x1000000
+  IMAGE/factory.img := append-ubi | check-size | \
+	sercomm-part-tag rootfs | sercomm-prepend-tagged-kernel kernel | \
+	gzip | sercomm-payload | sercomm-crypto
 endef
diff --git a/target/linux/ramips/image/common-tp-link.mk b/target/linux/ramips/image/common-tp-link.mk
index 915a086f98b4c2..cb26275960537c 100644
--- a/target/linux/ramips/image/common-tp-link.mk
+++ b/target/linux/ramips/image/common-tp-link.mk
@@ -1,6 +1,19 @@
 DEVICE_VARS += TPLINK_FLASHLAYOUT TPLINK_HWID TPLINK_HWREV TPLINK_HWREVADD
 DEVICE_VARS += TPLINK_HVERSION TPLINK_BOARD_ID TPLINK_HEADER_VERSION
 
+define Build/uImage-tplink-c9
+	mkimage \
+		-A $(LINUX_KARCH) \
+		-O linux \
+		-T $(word 1,$(1)) \
+		-C none \
+		-a $(KERNEL_LOADADDR) \
+		-e $(KERNEL_LOADADDR) \
+		-n $(wordlist 2,$(words $(1)),$(1)) \
+		-d $@ $@.new
+	mv $@.new $@
+endef
+
 define Device/tplink-v1
   DEVICE_VENDOR := TP-Link
   TPLINK_FLASHLAYOUT :=
diff --git a/target/linux/ramips/image/lzma-loader/Makefile b/target/linux/ramips/image/lzma-loader/Makefile
index 4cf700d8c6463b..7b87941e029302 100644
--- a/target/linux/ramips/image/lzma-loader/Makefile
+++ b/target/linux/ramips/image/lzma-loader/Makefile
@@ -18,6 +18,8 @@ FLASH_OFFS	:=
 FLASH_MAX	:=
 BOARD		:=
 PLATFORM	:=
+SUBTARGET	:=
+CACHE_FLAGS    := -DCONFIG_CACHELINE_SIZE=32
 
 ifeq ($(TARGET_DIR),)
 TARGET_DIR	:= $(KDIR)
@@ -46,6 +48,8 @@ loader-compile: $(PKG_BUILD_DIR)/.prepared
 		FLASH_MAX=$(FLASH_MAX) \
 		BOARD="$(BOARD)" \
 		PLATFORM="$(PLATFORM)" \
+		SUBTARGET="$(SUBTARGET)" \
+		CACHE_FLAGS="$(CACHE_FLAGS)" \
 		clean all
 
 loader.gz: $(PKG_BUILD_DIR)/loader.bin
diff --git a/target/linux/ramips/image/lzma-loader/src/Makefile b/target/linux/ramips/image/lzma-loader/src/Makefile
index 97fd6dad47b271..478cf17f29cb9c 100644
--- a/target/linux/ramips/image/lzma-loader/src/Makefile
+++ b/target/linux/ramips/image/lzma-loader/src/Makefile
@@ -23,6 +23,7 @@ FLASH_START	:=
 FLASH_OFFS	:=
 FLASH_MAX	:=
 PLATFORM	:=
+SUBTARGET	:=
 CACHE_FLAGS	:=
 
 CC		:= $(CROSS_COMPILE)gcc
@@ -31,8 +32,6 @@ OBJCOPY		:= $(CROSS_COMPILE)objcopy
 OBJDUMP		:= $(CROSS_COMPILE)objdump
 
 
-include $(PLATFORM).mk
-
 BIN_FLAGS	:= -O binary -R .reginfo -R .note -R .comment -R .mdebug \
 		   -R .MIPS.abiflags -S
 
@@ -54,7 +53,27 @@ LDFLAGS		+= -flto -fwhole-program -Wl,-z,max-page-size=4096
 
 O_FORMAT 	= $(shell $(OBJDUMP) -i | head -2 | grep elf32)
 
-OBJECTS		:= head.o loader.o cache.o board-$(PLATFORM).o printf.o LzmaDecode.o
+OBJECTS		:= head.o loader.o cache.o board.o printf.o LzmaDecode.o
+
+ifeq ($(strip $(SUBTARGET)),)
+$(error "Please specify a SUBTARGET!")
+endif
+
+ifeq ($(strip $(SUBTARGET)),mt7620)
+CFLAGS	+= -DSOC_MT7620
+endif
+
+ifeq ($(strip $(SUBTARGET)),mt7621)
+CFLAGS	+= -DSOC_MT7621
+endif
+
+ifeq ($(strip $(SUBTARGET)),rt305x)
+CFLAGS	+= -DSOC_RT305X
+endif
+
+ifeq ($(strip $(SUBTARGET)),rt3883)
+CFLAGS	+= -DSOC_RT3883
+endif
 
 ifneq ($(strip $(LOADER_DATA)),)
 OBJECTS		+= data.o
diff --git a/target/linux/ramips/image/lzma-loader/src/board.c b/target/linux/ramips/image/lzma-loader/src/board.c
new file mode 100644
index 00000000000000..ae9da380738b90
--- /dev/null
+++ b/target/linux/ramips/image/lzma-loader/src/board.c
@@ -0,0 +1,48 @@
+/*
+ * Arch specific code for ramips based boards
+ *
+ * Copyright (C) 2013 John Crispin <blogic@openwrt.org>
+ * Copyright (C) 2018 Tobias Schramm <tobleminer@gmail.com>
+ * Copyright (C) 2023 Antonio Vázquez <antoniovazquezblanco@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ */
+
+#include <stdint.h>
+
+#if defined(SOC_MT7620) || defined(SOC_RT3883)
+#define UART_BASE			0xb0000c00
+#define UART_THR			(UART_BASE + 0x04)
+#define UART_LSR			(UART_BASE + 0x1c)
+#define UART_LSR_THRE_MASK	0x40
+#elif defined(SOC_MT7621)
+#define UART_BASE			0xbe000c00
+#define UART_THR			(UART_BASE + 0x00)
+#define UART_LSR			(UART_BASE + 0x14)
+#define UART_LSR_THRE_MASK	0x20
+#elif defined(SOC_RT305X)
+#define UART_BASE			0x10000500
+#define UART_THR			(UART_BASE + 0x04)
+#define UART_LSR			(UART_BASE + 0x1c)
+#define UART_LSR_THRE_MASK	0x20
+#else
+#error "Unsupported SOC..."
+#endif
+
+// Helper functions
+#define READREG(r)		(*(volatile uint32_t *)(r))
+#define WRITEREG(r,v)	(*(volatile uint32_t *)(r)) = v
+
+
+void board_init(void)
+{
+}
+
+void board_putc(int ch)
+{
+	while ((READREG(UART_LSR) & UART_LSR_THRE_MASK) == 0);
+	WRITEREG(UART_THR, ch);
+	while ((READREG(UART_LSR) & UART_LSR_THRE_MASK) == 0);
+}
diff --git a/target/linux/ramips/image/mt7620.mk b/target/linux/ramips/image/mt7620.mk
index f6ad162779cd00..7c2ff740f05726 100644
--- a/target/linux/ramips/image/mt7620.mk
+++ b/target/linux/ramips/image/mt7620.mk
@@ -54,7 +54,7 @@ define Device/alfa-network_tube-e4g
   DEVICE_VENDOR := ALFA Network
   DEVICE_MODEL := Tube-E4G
   DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci uboot-envtools uqmi -iwinfo \
-	-kmod-rt2800-soc -wpad-basic-wolfssl
+	-kmod-rt2800-soc -wpad-basic-mbedtls
   SUPPORTED_DEVICES += tube-e4g
 endef
 TARGET_DEVICES += alfa-network_tube-e4g
@@ -75,10 +75,22 @@ define Device/amit_jboot
   DEVICE_PACKAGES := jboot-tools kmod-usb2 kmod-usb-ohci
 endef
 
+define Device/ampedwireless_b1200ex
+  SOC := mt7620a
+  DEVICE_VENDOR := Amped Wireless
+  DEVICE_MODEL := B1200EX
+  IMAGE_SIZE := 7744k
+  IMAGE/sysupgrade.bin := append-kernel | append-rootfs | \
+	edimax-header -s CSYS -m RN10 -f 0x70000 -S 0x01100000 | pad-rootfs | \
+	check-size | append-metadata
+  DEVICE_PACKAGES := kmod-mt76x2 kmod-phy-realtek
+endef
+TARGET_DEVICES += ampedwireless_b1200ex
+
 define Device/asus_rp-n53
   SOC := mt7620a
   IMAGE_SIZE := 7872k
-  DEVICE_VENDOR := Asus
+  DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RP-N53
   DEVICE_PACKAGES := kmod-rt2800-pci
   SUPPORTED_DEVICES += rp-n53
@@ -88,7 +100,7 @@ TARGET_DEVICES += asus_rp-n53
 define Device/asus_rt-ac51u
   SOC := mt7620a
   IMAGE_SIZE := 16064k
-  DEVICE_VENDOR := Asus
+  DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RT-AC51U
   DEVICE_PACKAGES := kmod-mt76x0e kmod-usb2 kmod-usb-ohci \
 	kmod-usb-ledtrig-usbport
@@ -99,7 +111,7 @@ TARGET_DEVICES += asus_rt-ac51u
 define Device/asus_rt-ac54u
   SOC := mt7620a
   IMAGE_SIZE := 16064k
-  DEVICE_VENDOR := Asus
+  DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RT-AC54U
   DEVICE_PACKAGES := kmod-mt76x2 kmod-usb2 kmod-usb-ohci \
 	kmod-usb-ledtrig-usbport
@@ -109,16 +121,17 @@ TARGET_DEVICES += asus_rt-ac54u
 define Device/asus_rt-n12p
   SOC := mt7620n
   IMAGE_SIZE := 16064k
-  DEVICE_VENDOR := Asus
+  DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RT-N11P/RT-N12+/RT-N12Eb1
   SUPPORTED_DEVICES += rt-n12p
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_rt-n12p
 
 define Device/asus_rt-n14u
   SOC := mt7620n
   IMAGE_SIZE := 16064k
-  DEVICE_VENDOR := Asus
+  DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RT-N14u
   DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci
   SUPPORTED_DEVICES += rt-n14u
@@ -179,13 +192,13 @@ define Device/comfast_cf-wr800n
   DEVICE_VENDOR := Comfast
   DEVICE_MODEL := CF-WR800N
   SUPPORTED_DEVICES += cf-wr800n
+  DEFAULT := n
 endef
 TARGET_DEVICES += comfast_cf-wr800n
 
 define Device/dlink_dch-m225
   $(Device/seama)
   SOC := mt7620a
-  BLOCKSIZE := 4k
   SEAMA_SIGNATURE := wapn22_dlink.2013gui_dap1320b
   IMAGE_SIZE := 6848k
   DEVICE_VENDOR := D-Link
@@ -230,6 +243,7 @@ define Device/dlink_dwr-116-a1
   DLINK_ROM_ID := DLK6E3803001
   DLINK_FAMILY_MEMBER := 0x6E38
   DLINK_FIRMWARE_SIZE := 0x7E0000
+  DEFAULT := n
 endef
 TARGET_DEVICES += dlink_dwr-116-a1
 
@@ -371,7 +385,6 @@ define Device/edimax_br-6478ac-v2
   DEVICE_VENDOR := Edimax
   DEVICE_MODEL := BR-6478AC
   DEVICE_VARIANT := V2
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 7744k
   IMAGE/sysupgrade.bin := append-kernel | append-rootfs | \
 	edimax-header -s CSYS -m RN68 -f 0x70000 -S 0x01100000 | pad-rootfs | \
@@ -385,7 +398,6 @@ define Device/edimax_ew-7476rpc
   SOC := mt7620a
   DEVICE_VENDOR := Edimax
   DEVICE_MODEL := EW-7476RPC
-  BLOCKSIZE := 4k
   IMAGE_SIZE := 7744k
   IMAGE/sysupgrade.bin := append-kernel | append-rootfs | \
 	edimax-header -s CSYS -m RN79 -f 0x70000 -S 0x01100000 | pad-rootfs | \
@@ -398,7 +410,6 @@ define Device/edimax_ew-7478ac
   SOC := mt7620a
   DEVICE_VENDOR := Edimax
   DEVICE_MODEL := EW-7478AC
-  BLOCKSIZE := 4k
   IMAGE_SIZE := 7744k
   IMAGE/sysupgrade.bin := append-kernel | append-rootfs | \
 	edimax-header -s CSYS -m RN70 -f 0x70000 -S 0x01100000 | pad-rootfs | \
@@ -411,7 +422,6 @@ define Device/edimax_ew-7478apc
   SOC := mt7620a
   DEVICE_VENDOR := Edimax
   DEVICE_MODEL := EW-7478APC
-  BLOCKSIZE := 4k
   IMAGE_SIZE := 7744k
   IMAGE/sysupgrade.bin := append-kernel | append-rootfs | \
 	edimax-header -s CSYS -m RN75 -f 0x70000 -S 0x01100000 | pad-rootfs | \
@@ -433,9 +443,22 @@ define Device/elecom_wrh-300cr
 endef
 TARGET_DEVICES += elecom_wrh-300cr
 
+define Device/engenius_epg600
+  $(Device/uimage-lzma-loader)
+  SOC := mt7620a
+  IMAGE_SIZE := 15616k
+  IMAGES += factory.dlf
+  IMAGE/factory.dlf := $$(sysupgrade_bin) | check-size | \
+	senao-header -r 0x101 -p 0x6a -t 2
+  DEVICE_VENDOR := EnGenius
+  DEVICE_MODEL := EPG600
+  DEVICE_PACKAGES += kmod-rt2800-pci kmod-usb-storage \
+	kmod-usb-ohci kmod-usb2 uboot-envtools
+endef
+TARGET_DEVICES += engenius_epg600
+
 define Device/engenius_esr600
   SOC := mt7620a
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 15616k
   IMAGES += factory.dlf
   IMAGE/factory.dlf := $$(sysupgrade_bin) | check-size | \
@@ -732,7 +755,6 @@ TARGET_DEVICES += microduino_microwrt
 define Device/netcore_nw5212
   SOC := mt7620a
   IMAGE_SIZE := 16064k
-  BLOCKSIZE := 4k
   DEVICE_VENDOR := Netcore
   DEVICE_MODEL := NW5212
   DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci
@@ -743,7 +765,6 @@ define Device/netgear_ex2700
   SOC := mt7620a
   NETGEAR_HW_ID := 29764623+4+0+32+2x2+0
   NETGEAR_BOARD_ID := EX2700
-  BLOCKSIZE := 4k
   IMAGE_SIZE := 3776k
   IMAGES += factory.bin
   KERNEL := $(KERNEL_DTB) | uImage lzma | pad-offset 64k 64 | \
@@ -759,7 +780,6 @@ TARGET_DEVICES += netgear_ex2700
 define Device/netgear_ex3700
   SOC := mt7620a
   NETGEAR_BOARD_ID := U12H319T00_NETGEAR
-  BLOCKSIZE := 4k
   IMAGE_SIZE := 7744k
   IMAGES += factory.chk
   IMAGE/factory.chk := $$(sysupgrade_bin) | check-size | netgear-chk
@@ -773,7 +793,6 @@ TARGET_DEVICES += netgear_ex3700
 define Device/netgear_ex6120
   SOC := mt7620a
   NETGEAR_BOARD_ID := U12H319T30_NETGEAR
-  BLOCKSIZE := 4k
   IMAGE_SIZE := 7744k
   IMAGES += factory.chk
   IMAGE/factory.chk := $$(sysupgrade_bin) | check-size | netgear-chk
@@ -786,7 +805,6 @@ TARGET_DEVICES += netgear_ex6120
 define Device/netgear_ex6130
   SOC := mt7620a
   NETGEAR_BOARD_ID := U12H319T50_NETGEAR
-  BLOCKSIZE := 4k
   IMAGE_SIZE := 7744k
   IMAGES += factory.chk
   IMAGE/factory.chk := $$(sysupgrade_bin) | check-size | netgear-chk
@@ -799,7 +817,6 @@ TARGET_DEVICES += netgear_ex6130
 define Device/netgear_jwnr2010-v5
   $(Device/netgear_sercomm_nor)
   SOC := mt7620n
-  BLOCKSIZE := 4k
   IMAGE_SIZE := 3840k
   DEVICE_MODEL := JWNR2010
   DEVICE_VARIANT := v5
@@ -815,7 +832,6 @@ TARGET_DEVICES += netgear_jwnr2010-v5
 define Device/netgear_pr2000
   $(Device/netgear_sercomm_nor)
   SOC := mt7620n
-  BLOCKSIZE := 4k
   IMAGE_SIZE := 15488k
   DEVICE_MODEL := PR2000
   DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci
@@ -832,7 +848,6 @@ define Device/netgear_wn3000rp-v3
   IMAGE_SIZE := 7872k
   NETGEAR_HW_ID := 29764836+8+0+32+2x2+0
   NETGEAR_BOARD_ID := WN3000RPv3
-  BLOCKSIZE := 4k
   IMAGES += factory.bin
   KERNEL := $(KERNEL_DTB) | uImage lzma | pad-offset 64k 64 | \
 	append-uImage-fakehdr filesystem
@@ -841,6 +856,7 @@ define Device/netgear_wn3000rp-v3
   DEVICE_MODEL := WN3000RP
   DEVICE_VARIANT := v3
   SUPPORTED_DEVICES += wn3000rpv3
+  DEFAULT := n
 endef
 TARGET_DEVICES += netgear_wn3000rp-v3
 
@@ -849,7 +865,6 @@ define Device/netgear_wn3100rp-v2
   IMAGE_SIZE := 7872k
   NETGEAR_HW_ID := 29764883+8+0+32+2x2+0
   NETGEAR_BOARD_ID := WN3100RPv2
-  BLOCKSIZE := 4k
   IMAGES += factory.bin
   KERNEL := $(KERNEL_DTB) | uImage lzma | pad-offset 64k 64 | \
 	append-uImage-fakehdr filesystem
@@ -873,7 +888,6 @@ TARGET_DEVICES += netis_wf2770
 
 define Device/nexx_wt3020-4m
   SOC := mt7620n
-  BLOCKSIZE := 4k
   IMAGE_SIZE := 3776k
   IMAGES += factory.bin
   IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | \
@@ -1079,7 +1093,6 @@ TARGET_DEVICES += sercomm_na930
 
 define Device/sitecom_wlr-4100-v1-002
   SOC := mt7620a
-  BLOCKSIZE := 4k
   IMAGE_SIZE := 7744k
   IMAGES += factory.dlf
   IMAGE/factory.dlf := $$(sysupgrade_bin) | check-size | \
@@ -1091,6 +1104,17 @@ define Device/sitecom_wlr-4100-v1-002
 endef
 TARGET_DEVICES += sitecom_wlr-4100-v1-002
 
+define Device/snr_cpe-w4n-mt
+  $(Device/uimage-lzma-loader)
+  SOC := mt7620n
+  IMAGE_SIZE := 7360k
+  DEVICE_VENDOR := SNR
+  DEVICE_MODEL := CPE-W4N
+  DEVICE_VARIANT := MT
+  UIMAGE_NAME := SNR-CPE-W4N-MT
+endef
+TARGET_DEVICES += snr_cpe-w4n-mt
+
 define Device/tplink_archer-c20i
   $(Device/tplink-v2)
   SOC := mt7620a
@@ -1205,7 +1229,6 @@ TARGET_DEVICES += trendnet_tew-810dr
 define Device/vonets_var11n-300
   SOC := mt7620n
   IMAGE_SIZE := 3776k
-  BLOCKSIZE := 4k
   DEVICE_VENDOR := Vonets
   DEVICE_MODEL := VAR11N-300
   DEFAULT := n
@@ -1273,6 +1296,18 @@ define Device/xiaomi_miwifi-mini
 endef
 TARGET_DEVICES += xiaomi_miwifi-mini
 
+define Device/youku_x2
+  SOC := mt7620a
+  IMAGE_SIZE := 16064k
+  DEVICE_VENDOR := Youku
+  DEVICE_MODEL := X2
+  DEVICE_PACKAGES := kmod-mt76x2 kmod-usb2 kmod-usb-ohci \
+	kmod-sdhci-mt7620 kmod-usb-ledtrig-usbport
+  UIMAGE_MAGIC := 0x12291000
+  UIMAGE_NAME := 400000000000000000001000
+endef
+TARGET_DEVICES += youku_x2
+
 define Device/youku_yk-l1
   SOC := mt7620a
   IMAGE_SIZE := 32448k
@@ -1281,6 +1316,8 @@ define Device/youku_yk-l1
   DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-sdhci-mt7620 \
 	kmod-usb-ledtrig-usbport
   SUPPORTED_DEVICES += youku-yk1 youku,yk1
+  UIMAGE_MAGIC := 0x12291000
+  UIMAGE_NAME := 400000000000000000000000
 endef
 TARGET_DEVICES += youku_yk-l1
 
@@ -1291,6 +1328,8 @@ define Device/youku_yk-l1c
   DEVICE_MODEL := YK-L1c
   DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-sdhci-mt7620 \
 	kmod-usb-ledtrig-usbport
+  UIMAGE_MAGIC := 0x12291000
+  UIMAGE_NAME := 400000000000000000000000
 endef
 TARGET_DEVICES += youku_yk-l1c
 
@@ -1403,6 +1442,7 @@ define Device/zbtlink_zbt-wr8305rt
   DEVICE_MODEL := ZBT-WR8305RT
   DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci
   SUPPORTED_DEVICES += zbt-wr8305rt
+  DEFAULT := n
 endef
 TARGET_DEVICES += zbtlink_zbt-wr8305rt
 
@@ -1416,6 +1456,18 @@ define Device/zte_q7
 endef
 TARGET_DEVICES += zte_q7
 
+define Device/zyxel_keenetic-lite-iii-a
+  SOC := mt7620n
+  IMAGE_SIZE := 7872k
+  DEVICE_VENDOR := ZyXEL
+  DEVICE_MODEL := Keenetic Lite III
+  DEVICE_VARIANT := A
+  IMAGES += factory.bin
+  IMAGE/factory.bin := $$(sysupgrade_bin) | pad-to 64k | check-size | \
+		zyimage -d 2102018 -v "ZyXEL Keenetic Lite III"
+endef
+TARGET_DEVICES += zyxel_keenetic-lite-iii-a
+
 define Device/zyxel_keenetic-omni
   SOC := mt7620n
   IMAGE_SIZE := 7872k
diff --git a/target/linux/ramips/image/mt7621.mk b/target/linux/ramips/image/mt7621.mk
index ca6ee4cc1f0611..b8fa0cefdb3fb1 100644
--- a/target/linux/ramips/image/mt7621.mk
+++ b/target/linux/ramips/image/mt7621.mk
@@ -7,12 +7,7 @@ include ./common-tp-link.mk
 
 DEFAULT_SOC := mt7621
 
-KERNEL_DTB += -d21
-DEVICE_VARS += ELECOM_HWNAME LINKSYS_HWNAME
-
-ifdef CONFIG_LINUX_5_10
-  DTS_CPPFLAGS += -DDTS_LEGACY
-endif
+DEVICE_VARS += ELECOM_HWNAME LINKSYS_HWNAME DLINK_HWID
 
 define Build/arcadyan-trx
 	echo -ne "hsqs" > $@.hsqs
@@ -37,21 +32,14 @@ define Build/h3c-blank-header
 	mv $@.blank $@
 endef
 
-define Build/iodata-factory
-	$(eval fw_size=$(word 1,$(1)))
-	$(eval fw_type=$(word 2,$(1)))
-	$(eval product=$(word 3,$(1)))
-	$(eval factory_bin=$(word 4,$(1)))
-	if [ -e $(KDIR)/tmp/$(KERNEL_INITRAMFS_IMAGE) -a "$$(stat -c%s $@)" -lt "$(fw_size)" ]; then \
-		$(CP) $(KDIR)/tmp/$(KERNEL_INITRAMFS_IMAGE) $(factory_bin); \
-		$(STAGING_DIR_HOST)/bin/mksenaofw \
-			-r 0x30a -p $(product) -t $(fw_type) \
-			-e $(factory_bin) -o $(factory_bin).new; \
-		mv $(factory_bin).new $(factory_bin); \
-		$(CP) $(factory_bin) $(BIN_DIR)/; \
-	else \
-		echo "WARNING: initramfs kernel image too big, cannot generate factory image (actual $$(stat -c%s $@); max $(fw_size))" >&2; \
-	fi
+define Build/haier-sim_wr1800k-factory
+  mkdir -p "$@.tmp"
+  mv "$@" "$@.tmp/UploadBrush-bin.img"
+  $(MKHASH) md5 "$@.tmp/UploadBrush-bin.img" | head -c32 > "$@.tmp/check_MD5.txt"
+  $(TAR) -czf "$@.tmp.tgz" -C "$@.tmp" UploadBrush-bin.img check_MD5.txt
+  $(STAGING_DIR_HOST)/bin/openssl aes-256-cbc -e -salt -in "$@.tmp.tgz" -out "$@" -k QiLunSmartWL
+  printf %32s $(DEVICE_MODEL) >> "$@"
+  rm -rf "$@.tmp" "$@.tmp.tgz"
 endef
 
 define Build/iodata-mstc-header
@@ -70,6 +58,29 @@ define Build/iodata-mstc-header
 	)
 endef
 
+define Build/znet-header
+	$(eval version=$(word 1,$(1)))
+	( \
+		data_size_crc="$$(dd if=$@ 2>/dev/null | gzip -c | \
+			tail -c 8 | od -An -N4 -tx4 --endian big | tr -d ' \n')"; \
+		payload_len="$$(dd if=$@ bs=4 count=1 skip=1 2>/dev/null | od -An -tdI --endian big | tr -d ' \n')"; \
+		payload_size_crc="$$(dd if=$@ ibs=1 count=$$payload_len 2>/dev/null | gzip -c | \
+			tail -c 8 | od -An -N4 -tx4 --endian big | tr -d ' \n')"; \
+		echo -ne "\x5A\x4E\x45\x54" | dd bs=4 count=1 conv=sync 2>/dev/null; \
+		echo -ne "$$(printf '%08x' $$(stat -c%s $@) | fold -s2 | xargs -I {} echo \\x{} | tac | tr -d '\n')" | \
+			dd bs=4 count=1 conv=sync 2>/dev/null; \
+		echo -ne "$$(echo $$data_size_crc | sed 's/../\\x&/g')" | \
+			dd bs=4 count=1 conv=sync 2>/dev/null; \
+		echo -ne "$$(echo $$payload_size_crc | sed 's/../\\x&/g')" | \
+			dd bs=4 count=1 conv=sync 2>/dev/null; \
+		echo -ne "\x12\x34\x56\x78" | dd bs=4 count=1 conv=sync 2>/dev/null; \
+		echo -ne "$(version)" | dd bs=28 count=1 conv=sync 2>/dev/null; \
+		dd if=/dev/zero bs=262096 count=1 conv=sync 2>/dev/null | tr "\000" "\377"; \
+		cat $@; \
+	) > $@.new
+	mv $@.new $@
+endef
+
 define Build/belkin-header
 	$(eval magic=$(word 1,$(1)))
 	$(eval hw_ver=$(word 2,$(1)))
@@ -137,22 +148,32 @@ define Device/dsa-migration
   DEVICE_COMPAT_MESSAGE := Config cannot be migrated from swconfig to DSA
 endef
 
+define Device/nand
+  $(Device/dsa-migration)
+  BLOCKSIZE := 128k
+  KERNEL_SIZE := 4096k
+  PAGESIZE := 2048
+  UBINIZE_OPTS := -E 5
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+
 define Device/adslr_g7
   $(Device/dsa-migration)
   IMAGE_SIZE := 16064k
   DEVICE_VENDOR := ADSLR
   DEVICE_MODEL := G7
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
 endef
 TARGET_DEVICES += adslr_g7
 
 define Device/afoundry_ew1200
   $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
   IMAGE_SIZE := 16064k
   DEVICE_VENDOR := AFOUNDRY
   DEVICE_MODEL := EW1200
   DEVICE_PACKAGES := kmod-ata-ahci kmod-mt76x2 kmod-mt7603 kmod-usb3 \
-	kmod-usb-ledtrig-usbport
+	kmod-usb-ledtrig-usbport -uboot-envtools
   SUPPORTED_DEVICES += ew1200
 endef
 TARGET_DEVICES += afoundry_ew1200
@@ -162,24 +183,19 @@ define Device/alfa-network_quad-e4g
   IMAGE_SIZE := 16064k
   DEVICE_VENDOR := ALFA Network
   DEVICE_MODEL := Quad-E4G
-  DEVICE_PACKAGES := kmod-ata-ahci kmod-sdhci-mt7620 kmod-usb3 uboot-envtools \
-	-wpad-basic-wolfssl
+  DEVICE_PACKAGES := kmod-ata-ahci kmod-sdhci-mt7620 kmod-usb3 \
+	-wpad-basic-mbedtls
   SUPPORTED_DEVICES += quad-e4g
 endef
 TARGET_DEVICES += alfa-network_quad-e4g
 
 define Device/ampedwireless_ally_common
-  $(Device/dsa-migration)
+  $(Device/nand)
   DEVICE_VENDOR := Amped Wireless
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware uboot-envtools
+  DEVICE_PACKAGES := kmod-mt7615-firmware
   IMAGE_SIZE := 32768k
-  KERNEL_SIZE := 4096k
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  UBINIZE_OPTS := -E 5
   KERNEL_INITRAMFS := $(KERNEL_DTB) | uImage lzma -n 'flashable-initramfs' |\
 	edimax-header -s CSYS -m RN68 -f 0x001c0000 -S 0x01100000
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
 endef
 
 define Device/ampedwireless_ally-r1900k
@@ -195,21 +211,49 @@ define Device/ampedwireless_ally-00x19k
 endef
 TARGET_DEVICES += ampedwireless_ally-00x19k
 
+define Device/arcadyan_we420223-99
+  $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
+  DEVICE_VENDOR := Arcadyan
+  DEVICE_MODEL := WE420223-99
+  DEVICE_ALT0_VENDOR := KPN
+  DEVICE_ALT0_MODEL := Experia WiFi
+  IMAGE_SIZE := 32128k
+  KERNEL_SIZE := 4352k
+  UBINIZE_OPTS := -E 5
+  PAGESIZE := 1
+  SUBPAGESIZE := 1
+  VID_HDR_OFFSET := 64
+  KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | \
+	uImage none | arcadyan-trx 0x746f435d
+  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel | \
+	uImage none
+  IMAGES += factory.trx
+  IMAGE/factory.trx := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | check-size
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
+endef
+TARGET_DEVICES += arcadyan_we420223-99
+
 define Device/asiarf_ap7621-001
   $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
   IMAGE_SIZE := 16000k
   DEVICE_VENDOR := AsiaRF
   DEVICE_MODEL := AP7621-001
-  DEVICE_PACKAGES := kmod-sdhci-mt7620 kmod-mt76x2 kmod-usb3 -wpad-basic-wolfssl
+  DEVICE_PACKAGES := kmod-sdhci-mt7620 kmod-mt76x2 kmod-usb3 \
+	-wpad-basic-mbedtls -uboot-envtools
 endef
 TARGET_DEVICES += asiarf_ap7621-001
 
 define Device/asiarf_ap7621-nv1
   $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
   IMAGE_SIZE := 16000k
   DEVICE_VENDOR := AsiaRF
   DEVICE_MODEL := AP7621-NV1
-  DEVICE_PACKAGES := kmod-sdhci-mt7620 kmod-mt76x2 kmod-usb3 -wpad-basic-wolfssl
+  DEVICE_PACKAGES := kmod-sdhci-mt7620 kmod-mt76x2 kmod-usb3 \
+	-wpad-basic-mbedtls -uboot-envtools
 endef
 TARGET_DEVICES += asiarf_ap7621-nv1
 
@@ -219,9 +263,8 @@ define Device/asus_rp-ac56
   DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RP-AC56
   IMAGE_SIZE := 16000k
-  BLOCKSIZE := 64k
   DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 \
-	kmod-i2c-ralink kmod-sound-mt7620
+	kmod-i2c-ralink kmod-sound-mt7620 -uboot-envtools
   IMAGES += factory.bin
   IMAGE/factory.bin := append-kernel | append-rootfs | pad-rootfs | check-size
   IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | \
@@ -239,103 +282,106 @@ define Device/asus_rp-ac87
   IMAGE/factory.bin := append-kernel | append-rootfs | pad-rootfs | check-size
   IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | \
 	check-size | append-metadata
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware rssileds
+  DEVICE_PACKAGES := kmod-mt7615-firmware rssileds -uboot-envtools
 endef
 TARGET_DEVICES += asus_rp-ac87
 
-define Device/asus_rt-ac57u
+define Device/asus_rt-ac57u-v1
   $(Device/dsa-migration)
   DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RT-AC57U
+  DEVICE_VARIANT := v1
   DEVICE_ALT0_VENDOR := ASUS
   DEVICE_ALT0_MODEL := RT-AC1200GU
   IMAGE_SIZE := 16064k
   DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
 	kmod-usb-ledtrig-usbport
+  SUPPORTED_DEVICES += asus,rt-ac57u
 endef
-TARGET_DEVICES += asus_rt-ac57u
+TARGET_DEVICES += asus_rt-ac57u-v1
 
 define Device/asus_rt-ac65p
-  $(Device/dsa-migration)
+  $(Device/nand)
   DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RT-AC65P
   IMAGE_SIZE := 51200k
-  UBINIZE_OPTS := -E 5
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  KERNEL_SIZE := 4096k
   IMAGES += factory.bin
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
 	check-size
-  DEVICE_PACKAGES := kmod-usb3 kmod-mt7615e kmod-mt7615-firmware uboot-envtools
+  DEVICE_PACKAGES := kmod-usb3 kmod-mt7615-firmware
 endef
 TARGET_DEVICES += asus_rt-ac65p
 
 define Device/asus_rt-ac85p
-  $(Device/dsa-migration)
+  $(Device/nand)
   DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RT-AC85P
   IMAGE_SIZE := 51200k
-  UBINIZE_OPTS := -E 5
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  KERNEL_SIZE := 4096k
   IMAGES += factory.bin
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
 	check-size
-  DEVICE_PACKAGES := kmod-usb3 kmod-mt7615e kmod-mt7615-firmware uboot-envtools
+  DEVICE_PACKAGES := kmod-usb3 kmod-mt7615-firmware
 endef
 TARGET_DEVICES += asus_rt-ac85p
 
 define Device/asus_rt-n56u-b1
   $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
   DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RT-N56U
   DEVICE_VARIANT := B1
   IMAGE_SIZE := 16064k
   DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
-	kmod-usb-ledtrig-usbport
+	kmod-usb-ledtrig-usbport -uboot-envtools
 endef
 TARGET_DEVICES += asus_rt-n56u-b1
 
 define Device/asus_rt-ax53u
-  $(Device/dsa-migration)
+  $(Device/nand)
   DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RT-AX53U
+  DEVICE_ALT0_VENDOR := ASUS
+  DEVICE_ALT0_MODEL := RT-AX1800U
   IMAGE_SIZE := 51200k
-  UBINIZE_OPTS := -E 5
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  KERNEL_SIZE := 4096k
   IMAGES += factory.bin
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
 	check-size
-  DEVICE_PACKAGES := kmod-mt7915e kmod-usb3 uboot-envtools
+  DEVICE_PACKAGES := kmod-mt7915-firmware kmod-usb3 kmod-usb-ledtrig-usbport
 endef
 TARGET_DEVICES += asus_rt-ax53u
 
+define Device/asus_rt-ax54
+  $(Device/nand)
+  DEVICE_VENDOR := ASUS
+  DEVICE_MODEL := RT-AX54
+  DEVICE_ALT0_VENDOR := ASUS
+  DEVICE_ALT0_MODEL := RT-AX54HP
+  DEVICE_ALT1_VENDOR := ASUS
+  DEVICE_ALT1_MODEL := RT-AX1800HP
+  DEVICE_ALT2_VENDOR := ASUS
+  DEVICE_ALT2_MODEL := RT-AX1800S
+  IMAGE_SIZE := 51200k
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
+	check-size
+  DEVICE_PACKAGES := kmod-mt7915-firmware
+endef
+TARGET_DEVICES += asus_rt-ax54
+
 define Device/beeline_smartbox-flash
-  $(Device/dsa-migration)
+  $(Device/nand)
   $(Device/uimage-lzma-loader)
   DEVICE_VENDOR := Beeline
   DEVICE_MODEL := SmartBox Flash
   IMAGE_SIZE := 32768k
   KERNEL_SIZE := 4352k
-  UBINIZE_OPTS := -E 5
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
   KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | \
 	uImage none | arcadyan-trx 0x746f435d | pad-to $$(KERNEL_SIZE)
   KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel | \
 	uImage none
   IMAGES += factory.trx
   IMAGE/factory.trx := append-kernel | append-ubi | check-size
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
-  DEVICE_PACKAGES := kmod-usb3 kmod-mt7615e kmod-mt7615-firmware \
-	uboot-envtools uencrypt
+  DEVICE_PACKAGES := kmod-usb3 kmod-mt7615-firmware uencrypt-mbedtls
 endef
 TARGET_DEVICES += beeline_smartbox-flash
 
@@ -348,7 +394,7 @@ define Device/beeline_smartbox-giga
   DEVICE_VENDOR := Beeline
   DEVICE_MODEL := SmartBox GIGA
   DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
-	kmod-usb3 uboot-envtools
+	kmod-usb3
 endef
 TARGET_DEVICES += beeline_smartbox-giga
 
@@ -360,27 +406,33 @@ define Device/beeline_smartbox-turbo
   SERCOMM_SWVER := 1004
   DEVICE_VENDOR := Beeline
   DEVICE_MODEL := SmartBox TURBO
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7615-firmware \
-	kmod-usb3 uboot-envtools
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware kmod-usb3
 endef
 TARGET_DEVICES += beeline_smartbox-turbo
 
+define Device/beeline_smartbox-turbo-plus
+  $(Device/sercomm_cxx)
+  IMAGE_SIZE := 32768k
+  SERCOMM_HWID := CQR
+  SERCOMM_HWVER := 10000
+  SERCOMM_SWVER := 2010
+  DEVICE_VENDOR := Beeline
+  DEVICE_MODEL := SmartBox TURBO+
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware kmod-usb3
+endef
+TARGET_DEVICES += beeline_smartbox-turbo-plus
+
 define Device/belkin_rt1800
-  $(Device/dsa-migration)
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  KERNEL_SIZE := 4096k
+  $(Device/nand)
   IMAGE_SIZE := 49152k
   DEVICE_VENDOR := Belkin
   DEVICE_MODEL := RT1800
-  DEVICE_PACKAGES := kmod-mt7915e kmod-usb3 uboot-envtools
-  UBINIZE_OPTS := -E 5
+  DEVICE_PACKAGES := kmod-mt7915-firmware kmod-usb3
   KERNEL_LOADADDR := 0x82000000
   KERNEL := kernel-bin | relocate-kernel 0x80001000 | lzma | \
 	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb | \
 	append-squashfs4-fakeroot
   IMAGES += factory.bin
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | \
 	append-ubi | check-size | belkin-header RT18 1 9.9.9
 endef
@@ -393,7 +445,7 @@ define Device/buffalo_wsr-1166dhp
   IMAGE_SIZE := 15936k
   DEVICE_VENDOR := Buffalo
   DEVICE_MODEL := WSR-1166DHP
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 -uboot-envtools
   SUPPORTED_DEVICES += wsr-1166
 endef
 TARGET_DEVICES += buffalo_wsr-1166dhp
@@ -407,16 +459,17 @@ define Device/buffalo_wsr-2533dhpl
   DEVICE_ALT0_VENDOR := Buffalo
   DEVICE_ALT0_MODEL := WSR-2533DHP
   IMAGE/sysupgrade.bin := trx | pad-rootfs | append-metadata
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
 endef
 TARGET_DEVICES += buffalo_wsr-2533dhpl
 
 define Device/buffalo_wsr-600dhp
   $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
   IMAGE_SIZE := 16064k
   DEVICE_VENDOR := Buffalo
   DEVICE_MODEL := WSR-600DHP
-  DEVICE_PACKAGES := kmod-mt7603 kmod-rt2800-pci
+  DEVICE_PACKAGES := kmod-mt7603 kmod-rt2800-pci -uboot-envtools
   SUPPORTED_DEVICES += wsr-600
 endef
 TARGET_DEVICES += buffalo_wsr-600dhp
@@ -427,19 +480,43 @@ define Device/bolt_arion
   IMAGE_SIZE := 32448k
   DEVICE_VENDOR := BOLT
   DEVICE_MODEL := Arion
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 uboot-envtools
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2
 endef
 TARGET_DEVICES += bolt_arion
 
-define Device/cudy_wr1300
+define Device/cudy_m1800
+  $(Device/dsa-migration)
+  DEVICE_VENDOR := Cudy
+  DEVICE_MODEL := M1800
+  IMAGE_SIZE := 16064k
+  UIMAGE_NAME := R17
+  DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
+endef
+TARGET_DEVICES += cudy_m1800
+
+define Device/cudy_wr1300-v1
   $(Device/dsa-migration)
   IMAGE_SIZE := 15872k
   DEVICE_VENDOR := Cudy
   DEVICE_MODEL := WR1300
+  DEVICE_VARIANT := v1
   DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb2 kmod-usb3 \
-	kmod-usb-ledtrig-usbport
+	kmod-usb-ledtrig-usbport -uboot-envtools
+  SUPPORTED_DEVICES += cudy,wr1300 R10
 endef
-TARGET_DEVICES += cudy_wr1300
+TARGET_DEVICES += cudy_wr1300-v1
+
+define Device/cudy_wr1300-v2
+  $(Device/dsa-migration)
+  IMAGE_SIZE := 15872k
+  DEVICE_VENDOR := Cudy
+  DEVICE_MODEL := WR1300
+  DEVICE_VARIANT := v2
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
+	-uboot-envtools
+  SUPPORTED_DEVICES += cudy,wr1300 R23
+endef
+TARGET_DEVICES += cudy_wr1300-v2
 
 define Device/cudy_wr2100
   $(Device/dsa-migration)
@@ -447,25 +524,72 @@ define Device/cudy_wr2100
   DEVICE_MODEL := WR2100
   IMAGE_SIZE := 15872k
   UIMAGE_NAME := R11
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware -uboot-envtools
 endef
 TARGET_DEVICES += cudy_wr2100
 
-define Device/cudy_x6
+define Device/cudy_x6-v1
   $(Device/dsa-migration)
   IMAGE_SIZE := 32256k
   DEVICE_VENDOR := Cudy
   DEVICE_MODEL := X6
+  DEVICE_VARIANT := v1
   UIMAGE_NAME := R13
-  DEVICE_PACKAGES := kmod-mt7915e
+  DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
+  SUPPORTED_DEVICES += cudy,x6 R13
+endef
+TARGET_DEVICES += cudy_x6-v1
+
+define Device/cudy_x6-v2
+  $(Device/dsa-migration)
+  IMAGE_SIZE := 15872k
+  DEVICE_VENDOR := Cudy
+  DEVICE_MODEL := X6
+  DEVICE_VARIANT := v2
+  UIMAGE_NAME := R30
+  DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
+  SUPPORTED_DEVICES += cudy,x6 R30
 endef
-TARGET_DEVICES += cudy_x6
+TARGET_DEVICES += cudy_x6-v2
+
+define Device/dlink_dap-1620-b1
+  DEVICE_VENDOR := D-Link
+  DEVICE_MODEL := DAP-1620
+  DEVICE_VARIANT := B1
+  DEVICE_PACKAGES := kmod-mt7615-firmware rssileds
+  DLINK_HWID := MT76XMT7621-RP-PR2475-NA
+  IMAGE_SIZE := 16064k
+  IMAGES += factory.bin
+  IMAGE/factory.bin := $$(sysupgrade_bin) | \
+    check-size 11009992 | pad-to 11009992 | \
+    append-md5sum-ascii-salted ffff | \
+    append-string $$(DLINK_HWID) | \
+    check-size
+endef
+TARGET_DEVICES += dlink_dap-1620-b1
+
+define Device/dlink_dap-x1860-a1
+  $(Device/nand)
+  IMAGE_SIZE := 53248k
+  DEVICE_VENDOR := D-Link
+  DEVICE_MODEL := DAP-X1860
+  DEVICE_VARIANT := A1
+  KERNEL_SIZE := 8192k
+  KERNEL_LOADADDR := 0x82000000
+  KERNEL := kernel-bin | relocate-kernel 0x80001000 | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
+	check-size | elx-header 011b0060 8844A2D168B45A2D
+  DEVICE_PACKAGES := kmod-mt7915-firmware rssileds -uboot-envtools
+endef
+TARGET_DEVICES += dlink_dap-x1860-a1
 
 define Device/dlink_dir-8xx-a1
   $(Device/dsa-migration)
   IMAGE_SIZE := 16000k
   DEVICE_VENDOR := D-Link
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
   KERNEL := $$(KERNEL) | uimage-sgehdr
   IMAGES += factory.bin
   IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | \
@@ -477,29 +601,32 @@ define Device/dlink_dir-8xx-r1
   $(Device/dsa-migration)
   IMAGE_SIZE := 16064k
   DEVICE_VENDOR := D-Link
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
   KERNEL_INITRAMFS := $$(KERNEL)
   IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | \
 	check-size | append-metadata
 endef
 
 define Device/dlink_dir-xx60-a1
-  $(Device/dsa-migration)
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  KERNEL_SIZE := 4096k
+  $(Device/nand)
   IMAGE_SIZE := 40960k
-  UBINIZE_OPTS := -E 5
   DEVICE_VENDOR := D-Link
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware kmod-usb3 \
-	kmod-usb-ledtrig-usbport
+  DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 \
+	kmod-usb-ledtrig-usbport -uboot-envtools
   KERNEL := $$(KERNEL) | uimage-sgehdr
   IMAGES += factory.bin
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
 	check-size
 endef
 
+define Device/dlink_dir-1935-a1
+  $(Device/dlink_dir-8xx-a1)
+  DEVICE_MODEL := DIR-1935
+  DEVICE_VARIANT := A1
+  DEVICE_PACKAGES += kmod-usb3
+endef
+TARGET_DEVICES += dlink_dir-1935-a1
+
 define Device/dlink_dir-1960-a1
   $(Device/dlink_dir-xx60-a1)
   DEVICE_MODEL := DIR-1960
@@ -521,6 +648,21 @@ define Device/dlink_dir-2660-a1
 endef
 TARGET_DEVICES += dlink_dir-2660-a1
 
+define Device/dlink_dir-3060-a1
+  $(Device/dlink_dir-xx60-a1)
+  DEVICE_MODEL := DIR-3060
+  DEVICE_VARIANT := A1
+endef
+TARGET_DEVICES += dlink_dir-3060-a1
+
+define Device/dlink_dir-853-a1
+  $(Device/dlink_dir-8xx-a1)
+  DEVICE_MODEL := DIR-853
+  DEVICE_VARIANT := A1
+  DEVICE_PACKAGES += kmod-usb3 kmod-usb-ledtrig-usbport
+endef
+TARGET_DEVICES += dlink_dir-853-a1
+
 define Device/dlink_dir-853-a3
   $(Device/dlink_dir-xx60-a1)
   DEVICE_MODEL := DIR-853
@@ -538,16 +680,14 @@ TARGET_DEVICES += dlink_dir-853-r1
 
 define Device/dlink_dir-860l-b1
   $(Device/dsa-migration)
-  $(Device/seama)
+  $(Device/seama-lzma-loader)
   SEAMA_SIGNATURE := wrgac13_dlink.2013gui_dir860lb
-  LOADER_TYPE := bin
-  KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | relocate-kernel | \
-	lzma -a0 | uImage lzma
   IMAGE_SIZE := 16064k
   DEVICE_VENDOR := D-Link
   DEVICE_MODEL := DIR-860L
   DEVICE_VARIANT := B1
-  DEVICE_PACKAGES := kmod-mt76x2 kmod-usb3 kmod-usb-ledtrig-usbport
+  DEVICE_PACKAGES := kmod-mt76x2 kmod-usb3 kmod-usb-ledtrig-usbport \
+	-uboot-envtools
   SUPPORTED_DEVICES += dir-860l-b1
 endef
 TARGET_DEVICES += dlink_dir-860l-b1
@@ -603,7 +743,8 @@ define Device/dual-q_h721
   IMAGE_SIZE := 16064k
   DEVICE_VENDOR := Dual-Q
   DEVICE_MODEL := H721
-  DEVICE_PACKAGES := kmod-ata-ahci kmod-sdhci-mt7620 kmod-usb3 -wpad-basic-wolfssl
+  DEVICE_PACKAGES := kmod-ata-ahci kmod-sdhci-mt7620 kmod-usb3 \
+	-wpad-basic-mbedtls -uboot-envtools
 endef
 TARGET_DEVICES += dual-q_h721
 
@@ -611,10 +752,10 @@ define Device/d-team_newifi-d2
   $(Device/dsa-migration)
   $(Device/uimage-lzma-loader)
   IMAGE_SIZE := 32448k
-  DEVICE_VENDOR := Newifi
-  DEVICE_MODEL := D2
+  DEVICE_VENDOR := D-Team
+  DEVICE_MODEL := Newifi D2
   DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
-	kmod-usb-ledtrig-usbport
+	kmod-usb-ledtrig-usbport -uboot-envtools
 endef
 TARGET_DEVICES += d-team_newifi-d2
 
@@ -624,7 +765,7 @@ define Device/d-team_pbr-m1
   DEVICE_VENDOR := PandoraBox
   DEVICE_MODEL := PBR-M1
   DEVICE_PACKAGES := kmod-ata-ahci kmod-mt7603 kmod-mt76x2 kmod-sdhci-mt7620 \
-	kmod-usb3 kmod-usb-ledtrig-usbport
+	kmod-usb3 kmod-usb-ledtrig-usbport -uboot-envtools
   SUPPORTED_DEVICES += pbr-m1
 endef
 TARGET_DEVICES += d-team_pbr-m1
@@ -640,7 +781,7 @@ define Device/edimax_ra21s
   IMAGES += factory.bin
   IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | \
 	elx-header 02020040 8844A2D168B45A2D
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
 endef
 TARGET_DEVICES += edimax_ra21s
 
@@ -659,7 +800,7 @@ define Device/edimax_re23s
   IMAGE/factory.bin := append-kernel | append-rootfs | \
 	edimax-header -s CSYS -m RN76 -f 0x70000 -S 0x01100000 | pad-rootfs | \
 	check-size
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
 endef
 TARGET_DEVICES += edimax_re23s
 
@@ -672,7 +813,7 @@ define Device/edimax_rg21s
   IMAGES += factory.bin
   IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | \
 	elx-header 02020038 8844A2D168B45A2D
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
 endef
 TARGET_DEVICES += edimax_rg21s
 
@@ -684,7 +825,7 @@ define Device/elecom_wrc-1167ghbk2-s
   IMAGES += factory.bin
   IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | \
 	elecom-wrc-gs-factory WRC-1167GHBK2-S 0.00
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
 endef
 TARGET_DEVICES += elecom_wrc-1167ghbk2-s
 
@@ -696,7 +837,7 @@ define Device/elecom_wrc-gs
   IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | \
 	elecom-wrc-gs-factory $$$$(ELECOM_HWNAME) 0.00 -N | \
 	append-string MT7621_ELECOM_$$$$(ELECOM_HWNAME)
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
 endef
 
 define Device/elecom_wrc-1167gs2-b
@@ -747,6 +888,20 @@ define Device/elecom_wrc-1900gst
 endef
 TARGET_DEVICES += elecom_wrc-1900gst
 
+define Device/elecom_wrc-2533ghbk2-t
+  $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
+  DEVICE_VENDOR := ELECOM
+  DEVICE_MODEL := WRC-2533GHBK2-T
+  IMAGE_SIZE := 7808k
+  IMAGES += factory.bin
+  IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | \
+	elx-header 0107003b 8844A2D168B45A2D | \
+	elecom-product-header WRC-2533GHBK2-T
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
+endef
+TARGET_DEVICES += elecom_wrc-2533ghbk2-t
+
 define Device/elecom_wrc-2533ghbk-i
   $(Device/dsa-migration)
   $(Device/uimage-lzma-loader)
@@ -757,7 +912,7 @@ define Device/elecom_wrc-2533ghbk-i
   IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | \
 	elx-header 0107002d 8844A2D168B45A2D | \
 	elecom-product-header WRC-2533GHBK-I
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
 endef
 TARGET_DEVICES += elecom_wrc-2533ghbk-i
 
@@ -785,12 +940,25 @@ define Device/elecom_wrc-2533gst2
 endef
 TARGET_DEVICES += elecom_wrc-2533gst2
 
+define Device/etisalat_s3
+  $(Device/sercomm_dxx)
+  IMAGE_SIZE := 32768k
+  SERCOMM_HWID := DDK
+  SERCOMM_HWVER := 10000
+  SERCOMM_SWVER := 4009
+  DEVICE_VENDOR := Etisalat
+  DEVICE_MODEL := S3
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware kmod-usb3
+endef
+TARGET_DEVICES += etisalat_s3
+
 define Device/firefly_firewrt
   $(Device/dsa-migration)
   IMAGE_SIZE := 16064k
   DEVICE_VENDOR := Firefly
   DEVICE_MODEL := FireWRT
-  DEVICE_PACKAGES := kmod-mt76x2 kmod-usb3 kmod-usb-ledtrig-usbport
+  DEVICE_PACKAGES := kmod-mt76x2 kmod-usb3 kmod-usb-ledtrig-usbport \
+	-uboot-envtools
   SUPPORTED_DEVICES += firewrt
 endef
 TARGET_DEVICES += firefly_firewrt
@@ -801,7 +969,7 @@ define Device/gehua_ghl-r-001
   DEVICE_VENDOR := GeHua
   DEVICE_MODEL := GHL-R-001
   DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
-	kmod-usb-ledtrig-usbport
+	kmod-usb-ledtrig-usbport -uboot-envtools
 endef
 TARGET_DEVICES += gehua_ghl-r-001
 
@@ -810,7 +978,7 @@ define Device/glinet_gl-mt1300
   IMAGE_SIZE := 32448k
   DEVICE_VENDOR := GL.iNet
   DEVICE_MODEL := GL-MT1300
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware kmod-usb3
+  DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 -uboot-envtools
 endef
 TARGET_DEVICES += glinet_gl-mt1300
 
@@ -819,7 +987,8 @@ define Device/gnubee_gb-pc1
   $(Device/uimage-lzma-loader)
   DEVICE_VENDOR := GnuBee
   DEVICE_MODEL := Personal Cloud One
-  DEVICE_PACKAGES := kmod-ata-ahci kmod-usb3 kmod-sdhci-mt7620 -wpad-basic-wolfssl
+  DEVICE_PACKAGES := kmod-ata-ahci kmod-usb3 kmod-sdhci-mt7620 \
+	-wpad-basic-mbedtls -uboot-envtools
   IMAGE_SIZE := 32448k
 endef
 TARGET_DEVICES += gnubee_gb-pc1
@@ -829,25 +998,32 @@ define Device/gnubee_gb-pc2
   $(Device/uimage-lzma-loader)
   DEVICE_VENDOR := GnuBee
   DEVICE_MODEL := Personal Cloud Two
-  DEVICE_PACKAGES := kmod-ata-ahci kmod-usb3 kmod-sdhci-mt7620 -wpad-basic-wolfssl
+  DEVICE_PACKAGES := kmod-ata-ahci kmod-usb3 kmod-sdhci-mt7620 \
+	-wpad-basic-mbedtls -uboot-envtools
   IMAGE_SIZE := 32448k
 endef
 TARGET_DEVICES += gnubee_gb-pc2
 
-define Device/h3c_tx180x
+define Device/hanyang_hyc-g920
   $(Device/dsa-migration)
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
+  $(Device/uimage-lzma-loader)
+  DEVICE_VENDOR := Hanyang
+  DEVICE_MODEL := CJ-Hello HYC-G920
+  IMAGE_SIZE := 15744k
+  DEVICE_PACKAGES := kmod-usb3 kmod-mt76x2 kmod-usb-ledtrig-usbport
+endef
+TARGET_DEVICES += hanyang_hyc-g920
+
+define Device/h3c_tx180x
+  $(Device/nand)
   KERNEL_SIZE := 8192k
   IMAGE_SIZE := 120832k
-  UBINIZE_OPTS := -E 5
   KERNEL_LOADADDR := 0x82000000
   KERNEL_INITRAMFS := kernel-bin | relocate-kernel 0x80001000 | lzma | \
 	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
   KERNEL := $$(KERNEL_INITRAMFS) | h3c-blank-header
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   DEVICE_VENDOR := H3C
-  DEVICE_PACKAGES := kmod-mt7915e uboot-envtools
+  DEVICE_PACKAGES := kmod-mt7915-firmware
 endef
 
 define Device/h3c_tx1800-plus
@@ -868,30 +1044,47 @@ define Device/h3c_tx1806
 endef
 TARGET_DEVICES += h3c_tx1806
 
+define Device/haier-sim_wr1800k
+  $(Device/nand)
+  IMAGE_SIZE := 125440k
+  KERNEL_LOADADDR := 0x82000000
+  KERNEL := kernel-bin | relocate-kernel 0x80001000 | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+  ARTIFACTS := initramfs-factory.bin
+  ARTIFACT/initramfs-factory.bin := append-image-stage initramfs-kernel.bin | \
+	haier-sim_wr1800k-factory
+endif
+  DEVICE_PACKAGES := kmod-mt7915-firmware
+endef
+
+define Device/haier_har-20s2u1
+  $(Device/haier-sim_wr1800k)
+  DEVICE_VENDOR := Haier
+  DEVICE_MODEL := HAR-20S2U1
+endef
+TARGET_DEVICES += haier_har-20s2u1
+
 define Device/hilink_hlk-7621a-evb
   $(Device/dsa-migration)
   $(Device/uimage-lzma-loader)
   DEVICE_VENDOR := HiLink
   DEVICE_MODEL := HLK-7621A evaluation board
-  DEVICE_PACKAGES += kmod-mt76x2 kmod-usb3
+  DEVICE_PACKAGES += kmod-mt76x2 kmod-usb3 -uboot-envtools
   IMAGE_SIZE := 32448k
 endef
 TARGET_DEVICES += hilink_hlk-7621a-evb
 
 define Device/hiwifi_hc5962
-  $(Device/dsa-migration)
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  KERNEL_SIZE := 4096k
-  UBINIZE_OPTS := -E 5
+  $(Device/nand)
+  $(Device/uimage-lzma-loader)
   IMAGE_SIZE := 32768k
   IMAGES += factory.bin
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
 	check-size
   DEVICE_VENDOR := HiWiFi
   DEVICE_MODEL := HC5962
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 -uboot-envtools
 endef
 TARGET_DEVICES += hiwifi_hc5962
 
@@ -910,33 +1103,41 @@ define Device/humax_e10
   IMAGE/factory.bin := append-kernel | append-rootfs | pad-rootfs | \
 	edimax-header -s CSYS -m EA03 -f 0x70000 -S 0x01100000 | \
 	check-size | zip upg -P f013c26cf0a320fb71d03356dcb6bb63
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware kmod-usb3
+  DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 -uboot-envtools
 endef
 TARGET_DEVICES += humax_e10
 
+define Device/huasifei_ws1208v2
+  $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
+  IMAGE_SIZE := 16064k
+  DEVICE_VENDOR := Huasifei
+  DEVICE_MODEL := WS1208V2
+  DEVICE_PACKAGES := kmod-ata-ahci kmod-mt7603 kmod-mt76x2 kmod-sdhci-mt7620 \
+	kmod-usb3 kmod-usb-net-cdc-mbim kmod-usb-net-qmi-wwan \
+	kmod-usb-serial-option -uboot-envtools
+endef
+TARGET_DEVICES += huasifei_ws1208v2
+
 define Device/iodata_wn-ax1167gr
   $(Device/dsa-migration)
   $(Device/uimage-lzma-loader)
   IMAGE_SIZE := 15552k
-  KERNEL_INITRAMFS := $$(KERNEL) | \
-	iodata-factory 7864320 4 0x1055 $(KDIR)/tmp/$$(KERNEL_INITRAMFS_PREFIX)-factory.bin
   DEVICE_VENDOR := I-O DATA
   DEVICE_MODEL := WN-AX1167GR
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2
+  ARTIFACTS := initramfs-factory.bin
+  ARTIFACT/initramfs-factory.bin := append-image-stage initramfs-kernel.bin | \
+	check-size 7680k | senao-header -r 0x30a -p 0x1055 -t 4
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 -uboot-envtools
 endef
 TARGET_DEVICES += iodata_wn-ax1167gr
 
 define Device/iodata_nand
-  $(Device/dsa-migration)
+  $(Device/nand)
   DEVICE_VENDOR := I-O DATA
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  UBINIZE_OPTS := -E 5
-  KERNEL_SIZE := 4096k
   IMAGE_SIZE := 51200k
   LOADER_TYPE := bin
   KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | lzma | uImage lzma
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
 endef
 
 # The OEM webinterface expects an kernel with initramfs which has the uImage
@@ -950,7 +1151,7 @@ define Device/iodata_wn-ax1167gr2
   DEVICE_MODEL := WN-AX1167GR2
   KERNEL_INITRAMFS := $(KERNEL_DTB) | loader-kernel | lzma | \
 	uImage lzma -M 0x434f4d42 -n '3.10(XBC.1)b10' | iodata-mstc-header
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
 endef
 TARGET_DEVICES += iodata_wn-ax1167gr2
 
@@ -959,7 +1160,7 @@ define Device/iodata_wn-ax2033gr
   DEVICE_MODEL := WN-AX2033GR
   KERNEL_INITRAMFS := $(KERNEL_DTB) | loader-kernel | lzma | \
 	uImage lzma -M 0x434f4d42 -n '3.10(VST.1)C10' | iodata-mstc-header
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware -uboot-envtools
 endef
 TARGET_DEVICES += iodata_wn-ax2033gr
 
@@ -968,7 +1169,7 @@ define Device/iodata_wn-dx1167r
   DEVICE_MODEL := WN-DX1167R
   KERNEL_INITRAMFS := $(KERNEL_DTB) | loader-kernel | lzma | \
 	uImage lzma -M 0x434f4d43 -n '3.10(XIK.1)b10' | iodata-mstc-header
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
 endef
 TARGET_DEVICES += iodata_wn-dx1167r
 
@@ -977,7 +1178,8 @@ define Device/iodata_wn-dx1200gr
   DEVICE_MODEL := WN-DX1200GR
   KERNEL_INITRAMFS := $(KERNEL_DTB) | loader-kernel | lzma | \
 	uImage lzma -M 0x434f4d43 -n '3.10(XIQ.0)b20' | iodata-mstc-header
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
+	-uboot-envtools
 endef
 TARGET_DEVICES += iodata_wn-dx1200gr
 
@@ -986,7 +1188,7 @@ define Device/iodata_wn-dx2033gr
   DEVICE_MODEL := WN-DX2033GR
   KERNEL_INITRAMFS := $(KERNEL_DTB) | loader-kernel | lzma | \
 	uImage lzma -M 0x434f4d42 -n '3.10(XID.0)b30' | iodata-mstc-header
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware -uboot-envtools
 endef
 TARGET_DEVICES += iodata_wn-dx2033gr
 
@@ -996,7 +1198,7 @@ define Device/iodata_wn-gx300gr
   IMAGE_SIZE := 7616k
   DEVICE_VENDOR := I-O DATA
   DEVICE_MODEL := WN-GX300GR
-  DEVICE_PACKAGES := kmod-mt7603
+  DEVICE_PACKAGES := kmod-mt7603 -uboot-envtools
 endef
 TARGET_DEVICES += iodata_wn-gx300gr
 
@@ -1009,7 +1211,7 @@ define Device/iodata_wnpr2600g
   IMAGES += factory.bin
   IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | \
 	elx-header 0104003a 8844A2D168B45A2D
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
 endef
 TARGET_DEVICES += iodata_wnpr2600g
 
@@ -1019,7 +1221,7 @@ define Device/iptime_a3002mesh
   UIMAGE_NAME := a3002me
   DEVICE_VENDOR := ipTIME
   DEVICE_MODEL := A3002MESH
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
 endef
 TARGET_DEVICES += iptime_a3002mesh
 
@@ -1030,24 +1232,20 @@ define Device/iptime_a3004ns-dual
   UIMAGE_NAME := a3004nd
   DEVICE_VENDOR := ipTIME
   DEVICE_MODEL := A3004NS-dual
-  DEVICE_PACKAGES := kmod-usb3 kmod-mt76x2 kmod-usb-ledtrig-usbport
+  DEVICE_PACKAGES := kmod-usb3 kmod-mt76x2 kmod-usb-ledtrig-usbport \
+	-uboot-envtools
 endef
 TARGET_DEVICES += iptime_a3004ns-dual
 
 define Device/iptime_a3004t
-  $(Device/dsa-migration)
+  $(Device/nand)
   $(Device/uimage-lzma-loader)
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
   FILESYSTEMS := squashfs
-  KERNEL_SIZE := 4096k
   IMAGE_SIZE := 129280k
   UIMAGE_NAME := a3004t
-  UBINIZE_OPTS := -E 5
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   DEVICE_VENDOR := ipTIME
   DEVICE_MODEL := A3004T
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware kmod-usb3
+  DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 -uboot-envtools
 endef
 TARGET_DEVICES += iptime_a3004t
 
@@ -1057,8 +1255,8 @@ define Device/iptime_a6004ns-m
   UIMAGE_NAME := a6004nm
   DEVICE_VENDOR := ipTIME
   DEVICE_MODEL := A6004NS-M
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware kmod-usb3 \
-	kmod-usb-ledtrig-usbport
+  DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 \
+	kmod-usb-ledtrig-usbport -uboot-envtools
 endef
 TARGET_DEVICES += iptime_a6004ns-m
 
@@ -1068,8 +1266,8 @@ define Device/iptime_a6ns-m
   UIMAGE_NAME := a6nm
   DEVICE_VENDOR := ipTIME
   DEVICE_MODEL := A6ns-M
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware kmod-usb3 \
-	kmod-usb-ledtrig-usbport
+  DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 \
+	kmod-usb-ledtrig-usbport -uboot-envtools
 endef
 TARGET_DEVICES += iptime_a6ns-m
 
@@ -1079,42 +1277,32 @@ define Device/iptime_a8004t
   UIMAGE_NAME := a8004t
   DEVICE_VENDOR := ipTIME
   DEVICE_MODEL := A8004T
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware kmod-usb3
+  DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 -uboot-envtools
 endef
 TARGET_DEVICES += iptime_a8004t
 
 define Device/iptime_ax2004m
-  $(Device/dsa-migration)
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  KERNEL_SIZE := 4096k
+  $(Device/nand)
   IMAGE_SIZE := 121344k
-  UBINIZE_OPTS := -E 5
   KERNEL_LOADADDR := 0x82000000
   KERNEL := kernel-bin | relocate-kernel 0x80001000 | lzma | \
 	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
   IMAGES += recovery.bin
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   IMAGE/recovery.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
 	check-size | iptime-crc32 ax2004m
   DEVICE_VENDOR := ipTIME
   DEVICE_MODEL := AX2004M
-  DEVICE_PACKAGES := kmod-mt7915e kmod-usb3
+  DEVICE_PACKAGES := kmod-mt7915-firmware kmod-usb3 -uboot-envtools
 endef
 TARGET_DEVICES += iptime_ax2004m
 
 define Device/iptime_t5004
-  $(Device/dsa-migration)
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  KERNEL_SIZE := 4096k
+  $(Device/nand)
   IMAGE_SIZE := 129280k
-  UBINIZE_OPTS := -E 5
   UIMAGE_NAME := t5004
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   DEVICE_VENDOR := ipTIME
   DEVICE_MODEL := T5004
-  DEVICE_PACKAGES := -wpad-basic-wolfssl
+  DEVICE_PACKAGES := -wpad-basic-mbedtls -uboot-envtools
 endef
 TARGET_DEVICES += iptime_t5004
 
@@ -1126,25 +1314,21 @@ define Device/jcg_jhr-ac876m
   JCG_MAXSIZE := 16064k
   DEVICE_VENDOR := JCG
   DEVICE_MODEL := JHR-AC876M
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware kmod-usb3 \
-	kmod-usb-ledtrig-usbport
+  DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 \
+	kmod-usb-ledtrig-usbport -uboot-envtools
 endef
 TARGET_DEVICES += jcg_jhr-ac876m
 
 define Device/jcg_q20
-  $(Device/dsa-migration)
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  UBINIZE_OPTS := -E 5
-  KERNEL_SIZE := 4096k
+  $(Device/nand)
+  $(Device/uimage-lzma-loader)
   IMAGE_SIZE := 91136k
   IMAGES += factory.bin
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
 	check-size
   DEVICE_VENDOR := JCG
   DEVICE_MODEL := Q20
-  DEVICE_PACKAGES := kmod-mt7915e uboot-envtools
+  DEVICE_PACKAGES := kmod-mt7915-firmware
 endef
 TARGET_DEVICES += jcg_q20
 
@@ -1157,36 +1341,44 @@ define Device/jcg_y2
   JCG_MAXSIZE := 16064k
   DEVICE_VENDOR := JCG
   DEVICE_MODEL := Y2
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware kmod-usb3
+  DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 -uboot-envtools
 endef
 TARGET_DEVICES += jcg_y2
 
+define Device/keenetic_kn-3010
+  $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
+  IMAGE_SIZE := 31488k
+  DEVICE_VENDOR := Keenetic
+  DEVICE_MODEL := KN-3010
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
+	-uboot-envtools
+  IMAGES += factory.bin
+  IMAGE/factory.bin := $$(sysupgrade_bin) | pad-to $$$$(BLOCKSIZE) | \
+	check-size | zyimage -d 0x803010 -v "KN-3010"
+endef
+TARGET_DEVICES += keenetic_kn-3010
+
 define Device/lenovo_newifi-d1
   $(Device/dsa-migration)
   $(Device/uimage-lzma-loader)
   IMAGE_SIZE := 32448k
-  DEVICE_VENDOR := Newifi
-  DEVICE_MODEL := D1
+  DEVICE_VENDOR := Lenovo
+  DEVICE_MODEL := Newifi D1
   DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 kmod-sdhci-mt7620 \
-	kmod-usb-ledtrig-usbport
+	kmod-usb-ledtrig-usbport -uboot-envtools
   SUPPORTED_DEVICES += newifi-d1
 endef
 TARGET_DEVICES += lenovo_newifi-d1
 
 define Device/linksys_e5600
-  $(Device/dsa-migration)
+  $(Device/nand)
   $(Device/uimage-lzma-loader)
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  KERNEL_SIZE := 4096k
   IMAGE_SIZE := 26624k
   DEVICE_VENDOR := Linksys
   DEVICE_MODEL := E5600
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
-	uboot-envtools
-  UBINIZE_OPTS := -E 5
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap
   IMAGES += factory.bin
-  IMAGE/sysupgrade.bin := sysupgrade-tar | check-size | append-metadata
   IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | \
 	append-ubi | check-size | gemtek-trailer
 endef
@@ -1202,18 +1394,12 @@ endef
 TARGET_DEVICES += linksys_e7350
 
 define Device/linksys_ea7xxx
-  $(Device/dsa-migration)
+  $(Device/nand)
   $(Device/uimage-lzma-loader)
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  KERNEL_SIZE := 4096k
   IMAGE_SIZE := 36864k
   DEVICE_VENDOR := Linksys
-  DEVICE_PACKAGES := kmod-usb3 kmod-mt7615e kmod-mt7615-firmware \
-	uboot-envtools
-  UBINIZE_OPTS := -E 5
+  DEVICE_PACKAGES := kmod-usb3 kmod-mt7615-firmware
   IMAGES := sysupgrade.bin factory.bin
-  IMAGE/sysupgrade.bin := sysupgrade-tar | check-size | append-metadata
   IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | \
 	append-ubi | check-size | linksys-image type=$$$$(LINKSYS_HWNAME)
 endef
@@ -1270,40 +1456,62 @@ TARGET_DEVICES += linksys_ea8100-v2
 
 define Device/linksys_re6500
   $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
   IMAGE_SIZE := 7872k
   DEVICE_VENDOR := Linksys
   DEVICE_MODEL := RE6500
-  DEVICE_PACKAGES := kmod-mt76x2
+  DEVICE_PACKAGES := kmod-mt76x2 -uboot-envtools
   SUPPORTED_DEVICES += re6500
 endef
 TARGET_DEVICES += linksys_re6500
 
+define Device/linksys_re7000
+  $(Device/uimage-lzma-loader)
+  IMAGE_SIZE := 16064k
+  DEVICE_VENDOR := Linksys
+  DEVICE_MODEL := RE7000
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware
+endef
+TARGET_DEVICES += linksys_re7000
+
 define Device/mediatek_ap-mt7621a-v60
   $(Device/dsa-migration)
   IMAGE_SIZE := 7872k
   DEVICE_VENDOR := Mediatek
   DEVICE_MODEL := AP-MT7621A-V60 EVB
-  DEVICE_PACKAGES := kmod-usb3 kmod-sdhci-mt7620 kmod-sound-mt7620 -wpad-basic-wolfssl
+  DEVICE_PACKAGES := kmod-usb3 kmod-sdhci-mt7620 kmod-sound-mt7620 \
+	-wpad-basic-mbedtls -uboot-envtools
 endef
 TARGET_DEVICES += mediatek_ap-mt7621a-v60
 
 define Device/mediatek_mt7621-eval-board
   $(Device/dsa-migration)
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 15104k
   DEVICE_VENDOR := MediaTek
   DEVICE_MODEL := MT7621 EVB
-  DEVICE_PACKAGES := -wpad-basic-wolfssl
+  DEVICE_PACKAGES := -wpad-basic-mbedtls -uboot-envtools
   SUPPORTED_DEVICES += mt7621
 endef
 TARGET_DEVICES += mediatek_mt7621-eval-board
 
+define Device/mercusys_mr70x-v1
+  $(Device/dsa-migration)
+  $(Device/tplink-safeloader)
+  DEVICE_VENDOR := Mercusys
+  DEVICE_MODEL := MR70X
+  DEVICE_VARIANT := v1
+  DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
+  TPLINK_BOARD_ID := MR70X
+  KERNEL := $(KERNEL_DTB) | uImage lzma
+  IMAGE_SIZE := 15744k
+endef
+TARGET_DEVICES += mercusys_mr70x-v1
+
 define Device/MikroTik
   $(Device/dsa-migration)
   DEVICE_VENDOR := MikroTik
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 16128k
-  DEVICE_PACKAGES := kmod-usb3
+  DEVICE_PACKAGES := kmod-usb3 -uboot-envtools
   KERNEL_NAME := vmlinuz
   KERNEL := kernel-bin | append-dtb-elf
   IMAGE/sysupgrade.bin := append-kernel | kernel2minor -s 1024 | \
@@ -1311,10 +1519,17 @@ define Device/MikroTik
 	append-metadata
 endef
 
+define Device/mikrotik_ltap-2hnd
+  $(Device/MikroTik)
+  DEVICE_MODEL := LtAP-2HnD
+  DEVICE_PACKAGES += kmod-ath9k kmod-pps-gpio rssileds
+endef
+TARGET_DEVICES += mikrotik_ltap-2hnd
+
 define Device/mikrotik_routerboard-750gr3
   $(Device/MikroTik)
   DEVICE_MODEL := RouterBOARD 750Gr3
-  DEVICE_PACKAGES += -wpad-basic-wolfssl
+  DEVICE_PACKAGES += -wpad-basic-mbedtls
   SUPPORTED_DEVICES += mikrotik,rb750gr3
 endef
 TARGET_DEVICES += mikrotik_routerboard-750gr3
@@ -1322,14 +1537,14 @@ TARGET_DEVICES += mikrotik_routerboard-750gr3
 define Device/mikrotik_routerboard-760igs
   $(Device/MikroTik)
   DEVICE_MODEL := RouterBOARD 760iGS
-  DEVICE_PACKAGES += kmod-sfp -wpad-basic-wolfssl
+  DEVICE_PACKAGES += kmod-sfp -wpad-basic-mbedtls
 endef
 TARGET_DEVICES += mikrotik_routerboard-760igs
 
 define Device/mikrotik_routerboard-m11g
   $(Device/MikroTik)
   DEVICE_MODEL := RouterBOARD M11G
-  DEVICE_PACKAGES := -wpad-basic-wolfssl
+  DEVICE_PACKAGES := -wpad-basic-mbedtls
   SUPPORTED_DEVICES += mikrotik,rbm11g
 endef
 TARGET_DEVICES += mikrotik_routerboard-m11g
@@ -1337,7 +1552,7 @@ TARGET_DEVICES += mikrotik_routerboard-m11g
 define Device/mikrotik_routerboard-m33g
   $(Device/MikroTik)
   DEVICE_MODEL := RouterBOARD M33G
-  DEVICE_PACKAGES := -wpad-basic-wolfssl
+  DEVICE_PACKAGES := -wpad-basic-mbedtls
   SUPPORTED_DEVICES += mikrotik,rbm33g
 endef
 TARGET_DEVICES += mikrotik_routerboard-m33g
@@ -1349,7 +1564,7 @@ define Device/mqmaker_witi
   DEVICE_VENDOR := MQmaker
   DEVICE_MODEL := WiTi
   DEVICE_PACKAGES := kmod-ata-ahci kmod-mt76x2 kmod-sdhci-mt7620 kmod-usb3 \
-	kmod-usb-ledtrig-usbport
+	kmod-usb-ledtrig-usbport -uboot-envtools
   SUPPORTED_DEVICES += witi mqmaker,witi-256m mqmaker,witi-512m
 endef
 TARGET_DEVICES += mqmaker_witi
@@ -1362,36 +1577,33 @@ define Device/mtc_wr1201
   DEVICE_MODEL := Wireless Router WR1201
   KERNEL_INITRAMFS := $(KERNEL_DTB) | uImage lzma -n 'WR1201_8_128'
   DEVICE_PACKAGES := kmod-sdhci-mt7620 kmod-mt76x2 kmod-usb3 \
-	kmod-usb-ledtrig-usbport
+	kmod-usb-ledtrig-usbport -uboot-envtools
 endef
 TARGET_DEVICES += mtc_wr1201
 
 define Device/mts_wg430223
-  $(Device/dsa-migration)
+  $(Device/nand)
   $(Device/uimage-lzma-loader)
   DEVICE_VENDOR := MTS
   DEVICE_MODEL := WG430223
   IMAGE_SIZE := 32768k
   KERNEL_SIZE := 4352k
-  UBINIZE_OPTS := -E 5
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
   KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | \
 	uImage none | arcadyan-trx 0x53485231 | pad-to $$(KERNEL_SIZE)
   KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel | \
 	uImage none
   IMAGES += factory.trx
   IMAGE/factory.trx := append-kernel | append-ubi | check-size
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware uboot-envtools uencrypt
+  DEVICE_PACKAGES := kmod-mt7615-firmware uencrypt-mbedtls
 endef
 TARGET_DEVICES += mts_wg430223
 
 define Device/netgear_ex6150
   $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
   DEVICE_VENDOR := NETGEAR
   DEVICE_MODEL := EX6150
-  DEVICE_PACKAGES := kmod-mt76x2
+  DEVICE_PACKAGES := kmod-mt76x2 -uboot-envtools
   NETGEAR_BOARD_ID := U12H318T00_NETGEAR
   IMAGE_SIZE := 14848k
   IMAGES += factory.chk
@@ -1400,21 +1612,17 @@ endef
 TARGET_DEVICES += netgear_ex6150
 
 define Device/netgear_sercomm_nand
-  $(Device/dsa-migration)
+  $(Device/nand)
   $(Device/uimage-lzma-loader)
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  KERNEL_SIZE := 4096k
-  UBINIZE_OPTS := -E 5
   IMAGES += factory.img kernel.bin rootfs.bin
   IMAGE/factory.img := pad-extra 2048k | append-kernel | pad-to 6144k | \
 	append-ubi | pad-to $$$$(BLOCKSIZE) | sercom-footer | pad-to 128 | \
 	zip $$$$(SERCOMM_HWNAME).bin | sercom-seal
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   IMAGE/kernel.bin := append-kernel
   IMAGE/rootfs.bin := append-ubi | check-size
   DEVICE_VENDOR := NETGEAR
-  DEVICE_PACKAGES := kmod-mt7603 kmod-usb3 kmod-usb-ledtrig-usbport
+  DEVICE_PACKAGES := kmod-mt7603 kmod-usb3 kmod-usb-ledtrig-usbport \
+	-uboot-envtools
 endef
 
 define Device/netgear_r6220
@@ -1439,7 +1647,7 @@ define Device/netgear_r6260
   SERCOMM_HWVER := A001
   SERCOMM_SWVER := 0x0052
   IMAGE_SIZE := 40960k
-  DEVICE_PACKAGES += kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES += kmod-mt7615-firmware
 endef
 TARGET_DEVICES += netgear_r6260
 
@@ -1451,7 +1659,7 @@ define Device/netgear_r6350
   SERCOMM_HWVER := A001
   SERCOMM_SWVER := 0x0052
   IMAGE_SIZE := 40960k
-  DEVICE_PACKAGES += kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES += kmod-mt7615-firmware
 endef
 TARGET_DEVICES += netgear_r6350
 
@@ -1470,7 +1678,7 @@ define Device/netgear_r6700-v2
   SERCOMM_HWVER := A001
   SERCOMM_SWVER := 0x1032
   IMAGE_SIZE := 40960k
-  DEVICE_PACKAGES += kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES += kmod-mt7615-firmware
 endef
 TARGET_DEVICES += netgear_r6700-v2
 
@@ -1482,7 +1690,7 @@ define Device/netgear_r6800
   SERCOMM_HWVER := A001
   SERCOMM_SWVER := 0x0062
   IMAGE_SIZE := 40960k
-  DEVICE_PACKAGES += kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES += kmod-mt7615-firmware
 endef
 TARGET_DEVICES += netgear_r6800
 
@@ -1494,7 +1702,7 @@ define Device/netgear_r6850
   SERCOMM_HWVER := A001
   SERCOMM_SWVER := 0x0052
   IMAGE_SIZE := 40960k
-  DEVICE_PACKAGES += kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES += kmod-mt7615-firmware
 endef
 TARGET_DEVICES += netgear_r6850
 
@@ -1507,7 +1715,7 @@ define Device/netgear_r6900-v2
   SERCOMM_HWVER := A001
   SERCOMM_SWVER := 0x1032
   IMAGE_SIZE := 40960k
-  DEVICE_PACKAGES += kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES += kmod-mt7615-firmware
 endef
 TARGET_DEVICES += netgear_r6900-v2
 
@@ -1519,7 +1727,7 @@ define Device/netgear_r7200
   SERCOMM_HWVER := A001
   SERCOMM_SWVER := 0x1032
   IMAGE_SIZE := 40960k
-  DEVICE_PACKAGES += kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES += kmod-mt7615-firmware
 endef
 TARGET_DEVICES += netgear_r7200
 
@@ -1531,7 +1739,7 @@ define Device/netgear_r7450
   SERCOMM_HWVER := A001
   SERCOMM_SWVER := 0x1032
   IMAGE_SIZE := 40960k
-  DEVICE_PACKAGES += kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES += kmod-mt7615-firmware
 endef
 TARGET_DEVICES += netgear_r7450
 
@@ -1555,22 +1763,18 @@ define Device/netgear_wac124
   SERCOMM_HWVER := A003
   SERCOMM_SWVER := 0x0402
   IMAGE_SIZE := 40960k
-  DEVICE_PACKAGES += kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES += kmod-mt7615-firmware
 endef
 TARGET_DEVICES += netgear_wac124
 
 define Device/netgear_wax202
-  $(Device/dsa-migration)
+  $(Device/nand)
   DEVICE_VENDOR := NETGEAR
   DEVICE_MODEL := WAX202
-  DEVICE_PACKAGES := kmod-mt7915e
+  DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
   NETGEAR_ENC_MODEL := WAX202
   NETGEAR_ENC_REGION := US
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  UBINIZE_OPTS := -E 5
   IMAGE_SIZE := 38912k
-  KERNEL_SIZE := 4096k
   KERNEL_LOADADDR := 0x82000000
   KERNEL := kernel-bin | relocate-kernel 0x80001000 | lzma | \
 	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb | \
@@ -1578,7 +1782,6 @@ define Device/netgear_wax202
   IMAGES += factory.img
   IMAGE/factory.img := append-kernel | pad-to $$(KERNEL_SIZE) | \
 	append-ubi | check-size | netgear-encrypted-factory
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
 endef
 TARGET_DEVICES += netgear_wax202
 
@@ -1595,28 +1798,25 @@ define Device/netgear_wndr3700-v5
   SERCOMM_SWVER := 0x1054
   SERCOMM_PAD := 320k
   DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
-	kmod-usb-ledtrig-usbport
+	kmod-usb-ledtrig-usbport -uboot-envtools
   SUPPORTED_DEVICES += wndr3700v5
 endef
 TARGET_DEVICES += netgear_wndr3700-v5
 
 define Device/netis_wf2881
-  $(Device/dsa-migration)
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
+  $(Device/nand)
+  $(Device/uimage-lzma-loader)
   FILESYSTEMS := squashfs
-  KERNEL_SIZE := 4096k
   IMAGE_SIZE := 129280k
-  UBINIZE_OPTS := -E 5
   UIMAGE_NAME := WF2881_0.0.00
-  KERNEL_INITRAMFS := $(KERNEL_DTB) | netis-tail WF2881 | uImage lzma
+  KERNEL_INITRAMFS := $$(KERNEL) | netis-tail WF2881
   IMAGES += factory.bin
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-ubi | \
 	check-size
   DEVICE_VENDOR := NETIS
   DEVICE_MODEL := WF2881
-  DEVICE_PACKAGES := kmod-mt76x2 kmod-usb3 kmod-usb-ledtrig-usbport
+  DEVICE_PACKAGES := kmod-mt76x2 kmod-usb3 kmod-usb-ledtrig-usbport \
+	-uboot-envtools
 endef
 TARGET_DEVICES += netis_wf2881
 
@@ -1626,7 +1826,7 @@ define Device/oraybox_x3a
   IMAGE_SIZE := 15360k
   DEVICE_VENDOR := OrayBox
   DEVICE_MODEL := X3A
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
 endef
 TARGET_DEVICES += oraybox_x3a
 
@@ -1638,7 +1838,7 @@ define Device/phicomm_k2p
   DEVICE_ALT0_VENDOR := Phicomm
   DEVICE_ALT0_MODEL := KE 2P
   SUPPORTED_DEVICES += k2p
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
 endef
 TARGET_DEVICES += phicomm_k2p
 
@@ -1648,25 +1848,21 @@ define Device/planex_vr500
   IMAGE_SIZE := 65216k
   DEVICE_VENDOR := Planex
   DEVICE_MODEL := VR500
-  DEVICE_PACKAGES := kmod-usb3 -wpad-basic-wolfssl
+  DEVICE_PACKAGES := kmod-usb3 -wpad-basic-mbedtls -uboot-envtools
   SUPPORTED_DEVICES += vr500
 endef
 TARGET_DEVICES += planex_vr500
 
 define Device/raisecom_msg1500-x-00
-  $(Device/dsa-migration)
+  $(Device/nand)
   $(Device/uimage-lzma-loader)
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  KERNEL_SIZE := 4096k
   IMAGE_SIZE := 129280k
-  UBINIZE_OPTS := -E 5
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   DEVICE_VENDOR := RAISECOM
   DEVICE_MODEL := MSG1500
   DEVICE_VARIANT := X.00
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware kmod-usb3 \
-	kmod-usb-ledtrig-usbport uboot-envtools
+  DEVICE_ALT0_VENDOR := Nokia
+  DEVICE_ALT0_MODEL := A-040W-Q
+  DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 kmod-usb-ledtrig-usbport
 endef
 TARGET_DEVICES += raisecom_msg1500-x-00
 
@@ -1674,13 +1870,26 @@ define Device/renkforce_ws-wn530hp3-a
   $(Device/dsa-migration)
   DEVICE_VENDOR := Renkforce
   DEVICE_MODEL := WS-WN530HP3-A
-  DEVICE_PACKAGES += kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap
+  DEVICE_PACKAGES += kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
+	-uboot-envtools
   IMAGE/sysupgrade.bin := append-kernel | pad-to 65536 | append-rootfs | \
 	check-size | append-metadata
   IMAGE_SIZE := 15040k
 endef
 TARGET_DEVICES += renkforce_ws-wn530hp3-a
 
+define Device/rostelecom_rt-sf-1
+  $(Device/sercomm_dxx)
+  IMAGE_SIZE := 32768k
+  SERCOMM_HWID := DKG
+  SERCOMM_HWVER := 10110
+  SERCOMM_SWVER := 1026
+  DEVICE_VENDOR := Rostelecom
+  DEVICE_MODEL := RT-SF-1
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware kmod-usb3
+endef
+TARGET_DEVICES += rostelecom_rt-sf-1
+
 define Device/samknows_whitebox-v8
   $(Device/dsa-migration)
   $(Device/uimage-lzma-loader)
@@ -1688,46 +1897,80 @@ define Device/samknows_whitebox-v8
   DEVICE_VENDOR := SamKnows
   DEVICE_MODEL := Whitebox 8
   DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
-	kmod-usb-ledtrig-usbport uboot-envtools
+	kmod-usb-ledtrig-usbport
   SUPPORTED_DEVICES += sk-wb8
 endef
 TARGET_DEVICES += samknows_whitebox-v8
 
 define Device/sercomm_na502
-  $(Device/uimage-lzma-loader)
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
+  $(Device/nand)
   IMAGE_SIZE := 20480k
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
-  UBINIZE_OPTS := -E 5
-  KERNEL_SIZE := 4096k
   DEVICE_VENDOR := SERCOMM
   DEVICE_MODEL := NA502
-  DEVICE_PACKAGES := kmod-mt76x2 kmod-mt7603 kmod-usb3
+  DEVICE_PACKAGES := kmod-mt76x2 kmod-mt7603 kmod-usb3 -uboot-envtools
 endef
 TARGET_DEVICES += sercomm_na502
 
 define Device/sercomm_na502s
-  $(Device/uimage-lzma-loader)
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
+  $(Device/nand)
   IMAGE_SIZE := 20971520
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
-  UBINIZE_OPTS := -E 5
-  KERNEL_SIZE := 4096k
   DEVICE_VENDOR := SERCOMM
   DEVICE_MODEL := NA502S
   DEVICE_PACKAGES := kmod-mt76x2 kmod-mt7603 kmod-usb3 kmod-usb-serial \
-  		kmod-usb-serial-xr_usb_serial_common
+		kmod-usb-serial-xr_usb_serial_common -uboot-envtools
 endef
 TARGET_DEVICES += sercomm_na502s
 
+define Device/sim_simax1800t
+  $(Device/haier-sim_wr1800k)
+  DEVICE_VENDOR := SIM
+  DEVICE_MODEL := SIMAX1800T
+endef
+TARGET_DEVICES += sim_simax1800t
+
+define Device/snr_snr-cpe-me1
+	$(Device/dsa-migration)
+	$(Device/uimage-lzma-loader)
+	IMAGE_SIZE := 15040k
+	DEVICE_VENDOR := SNR
+	DEVICE_MODEL := SNR-CPE-ME1
+	UIMAGE_NAME := SNR-CPE-ME1-5GHZ-MT
+	DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x0e kmod-usb3 \
+		kmod-usb-ledtrig-usbport uboot-envtools
+endef
+TARGET_DEVICES += snr_snr-cpe-me1
+
+define Device/snr_snr-cpe-me2-lite
+  $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
+  IMAGE_SIZE := 16064k
+  DEVICE_VENDOR := SNR
+  DEVICE_MODEL := SNR-CPE-ME2-Lite
+  UIMAGE_NAME := $$(DEVICE_MODEL)
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
+	-uboot-envtools
+endef
+TARGET_DEVICES += snr_snr-cpe-me2-lite
+
+define Device/snr_snr-cpe-me2-sfp
+  $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
+  IMAGE_SIZE := 16064k
+  DEVICE_VENDOR := SNR
+  DEVICE_MODEL := SNR-CPE-ME2-SFP
+  UIMAGE_NAME := $$(DEVICE_MODEL)
+  DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 \
+	    kmod-sfp kmod-usb-ledtrig-usbport uboot-envtools
+endef
+TARGET_DEVICES += snr_snr-cpe-me2-sfp
+
 define Device/storylink_sap-g3200u3
   $(Device/dsa-migration)
   IMAGE_SIZE := 7872k
   DEVICE_VENDOR := STORYLiNK
   DEVICE_MODEL := SAP-G3200U3
-  DEVICE_PACKAGES := kmod-mt76x2 kmod-usb3 kmod-usb-ledtrig-usbport
+  DEVICE_PACKAGES := kmod-mt76x2 kmod-usb3 kmod-usb-ledtrig-usbport \
+	-uboot-envtools
   SUPPORTED_DEVICES += sap-g3200u3
 endef
 TARGET_DEVICES += storylink_sap-g3200u3
@@ -1737,7 +1980,7 @@ define Device/telco-electronics_x1
   IMAGE_SIZE := 16064k
   DEVICE_VENDOR := Telco Electronics
   DEVICE_MODEL := X1
-  DEVICE_PACKAGES := kmod-usb3 kmod-mt76
+  DEVICE_PACKAGES := kmod-usb3 kmod-mt76 -uboot-envtools
 endef
 TARGET_DEVICES += telco-electronics_x1
 
@@ -1746,7 +1989,7 @@ define Device/tenbay_t-mb5eu-v01
   DEVICE_VENDOR := Tenbay
   DEVICE_MODEL := T-MB5EU-V01
   DEVICE_DTS_CONFIG := config@1
-  DEVICE_PACKAGES += kmod-mt7915e kmod-usb3
+  DEVICE_PACKAGES += kmod-mt7915-firmware kmod-usb3 -uboot-envtools
   KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
   IMAGE_SIZE := 15808k
   SUPPORTED_DEVICES += mt7621-dm2-t-mb5eu-v01-nor
@@ -1759,7 +2002,7 @@ define Device/thunder_timecloud
   IMAGE_SIZE := 16064k
   DEVICE_VENDOR := Thunder
   DEVICE_MODEL := Timecloud
-  DEVICE_PACKAGES := kmod-usb3 -wpad-basic-wolfssl
+  DEVICE_PACKAGES := kmod-usb3 -wpad-basic-mbedtls -uboot-envtools
   SUPPORTED_DEVICES += timecloud
 endef
 TARGET_DEVICES += thunder_timecloud
@@ -1770,7 +2013,7 @@ define Device/totolink_a7000r
   UIMAGE_NAME := C8340R1C-9999
   DEVICE_VENDOR := TOTOLINK
   DEVICE_MODEL := A7000R
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
 endef
 TARGET_DEVICES += totolink_a7000r
 
@@ -1780,17 +2023,39 @@ define Device/totolink_x5000r
   UIMAGE_NAME := C8343R-9999
   DEVICE_VENDOR := TOTOLINK
   DEVICE_MODEL := X5000R
-  DEVICE_PACKAGES := kmod-mt7915e
+  DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
 endef
 TARGET_DEVICES += totolink_x5000r
 
+define Device/tozed_zlt-s12-pro
+  $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
+  IMAGE_SIZE := 16064k
+  DEVICE_VENDOR := TOZED
+  DEVICE_MODEL := ZLT S12 PRO
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 comgt-ncm -uboot-envtools
+endef
+TARGET_DEVICES += tozed_zlt-s12-pro
+
+define Device/tplink_archer-ax23-v1
+  $(Device/dsa-migration)
+  $(Device/tplink-safeloader)
+  DEVICE_MODEL := Archer AX23
+  DEVICE_VARIANT := v1
+  DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
+  TPLINK_BOARD_ID := ARCHER-AX23-V1
+  KERNEL := $(KERNEL_DTB) | uImage lzma
+  IMAGE_SIZE := 15744k
+endef
+TARGET_DEVICES += tplink_archer-ax23-v1
+
 define Device/tplink_archer-a6-v3
   $(Device/dsa-migration)
   $(Device/tplink-safeloader)
   DEVICE_MODEL := Archer A6
   DEVICE_VARIANT := V3
   DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e \
-	kmod-mt7663-firmware-ap
+	kmod-mt7663-firmware-ap -uboot-envtools
   TPLINK_BOARD_ID := ARCHER-A6-V3
   KERNEL := $(KERNEL_DTB) | uImage lzma
   IMAGE_SIZE := 15744k
@@ -1802,8 +2067,8 @@ define Device/tplink_archer-c6-v3
   $(Device/tplink-safeloader)
   DEVICE_MODEL := Archer C6
   DEVICE_VARIANT := V3
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e \
-	kmod-mt7663-firmware-ap
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
+	-uboot-envtools
   TPLINK_BOARD_ID := ARCHER-C6-V3
   KERNEL := $(KERNEL_DTB) | uImage lzma
   IMAGE_SIZE := 15744k
@@ -1815,21 +2080,34 @@ define Device/tplink_archer-c6u-v1
   $(Device/tplink-safeloader)
   DEVICE_MODEL := Archer C6U
   DEVICE_VARIANT := v1
-  DEVICE_PACKAGES := kmod-mt7603 \
-	kmod-mt7615e kmod-mt7663-firmware-ap \
-	kmod-usb3 kmod-usb-ledtrig-usbport
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
+	kmod-usb3 kmod-usb-ledtrig-usbport -uboot-envtools
   KERNEL := $(KERNEL_DTB) | uImage lzma
   TPLINK_BOARD_ID := ARCHER-C6U-V1
   IMAGE_SIZE := 15744k
 endef
 TARGET_DEVICES += tplink_archer-c6u-v1
 
+define Device/tplink_deco-m4r-v4
+  $(Device/dsa-migration)
+  $(Device/tplink-safeloader)
+  DEVICE_MODEL := Deco M4R
+  DEVICE_VARIANT := v4
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
+	-uboot-envtools
+  KERNEL := $(KERNEL_DTB) | uImage lzma
+  TPLINK_BOARD_ID := DECO-M4R-V4
+  IMAGE_SIZE := 15744k
+endef
+TARGET_DEVICES += tplink_deco-m4r-v4
+
 define Device/tplink_eap235-wall-v1
   $(Device/dsa-migration)
   $(Device/tplink-safeloader)
   DEVICE_MODEL := EAP235-Wall
   DEVICE_VARIANT := v1
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
+	-uboot-envtools
   TPLINK_BOARD_ID := EAP235-WALL-V1
   IMAGE_SIZE := 13440k
   IMAGE/factory.bin := append-rootfs | tplink-safeloader factory | \
@@ -1842,7 +2120,7 @@ define Device/tplink_eap615-wall-v1
   $(Device/tplink-safeloader)
   DEVICE_MODEL := EAP615-Wall
   DEVICE_VARIANT := v1
-  DEVICE_PACKAGES := kmod-mt7915e
+  DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
   TPLINK_BOARD_ID := EAP615-WALL-V1
   KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb | pad-to 64k
   KERNEL_INITRAMFS := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd
@@ -1850,12 +2128,66 @@ define Device/tplink_eap615-wall-v1
 endef
 TARGET_DEVICES += tplink_eap615-wall-v1
 
+define Device/tplink_ec330-g5u-v1
+  $(Device/nand)
+  LOADER := bin
+  IMAGE_SIZE := 49152k
+  DEVICE_VENDOR := TP-Link
+  DEVICE_MODEL := EC330-G5u
+  DEVICE_ALT0_VENDOR := TP-Link
+  DEVICE_ALT0_MODEL := Archer C9ERT
+  DEVICE_VARIANT := v1
+  DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb-ledtrig-usbport kmod-usb3
+  KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | \
+	uImage-tplink-c9 standalone '$(call toupper,$(LINUX_KARCH)) \
+		$(VERSION_DIST) Linux-$(LINUX_VERSION)' | \
+	uImage-tplink-c9 firmware 'OS IMAGE ($(VERSION_DIST))'
+  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel | \
+	uImage none
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | \
+	append-ubi | check-size
+endef
+TARGET_DEVICES += tplink_ec330-g5u-v1
+
+define Device/tplink_er605-v2
+  $(Device/nand)
+  DEVICE_VENDOR := TP-Link
+  DEVICE_MODEL := ER605
+  DEVICE_VARIANT := v2
+  DEVICE_PACKAGES := -wpad-basic-mbedtls kmod-usb3 -uboot-envtools
+  KERNEL_IN_UBI := 1
+  KERNEL_LOADADDR := 0x82000000
+  KERNEL := kernel-bin | relocate-kernel 0x80001000 | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  IMAGES += sysupgrade.tar
+  IMAGE_SIZE := 127744k
+endef
+TARGET_DEVICES += tplink_er605-v2
+
+define Device/tplink_mr600-v2-eu
+  $(Device/dsa-migration)
+  $(Device/tplink-v2)
+  DEVICE_MODEL := MR600
+  DEVICE_VARIANT := v2 (EU)
+  TPLINK_FLASHLAYOUT := 16Mltq
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
+		kmod-usb-net-qmi-wwan uqmi kmod-usb3 -uboot-envtools
+  IMAGE/factory.bin := tplink-v2-image -e -a 0x10000
+  IMAGE/sysupgrade.bin := tplink-v2-image -s -e -a 0x10000 | check-size | \
+	append-metadata
+  KERNEL := $(KERNEL_DTB) | uImage lzma
+  KERNEL_INITRAMFS := $$(KERNEL) | tplink-v2-header
+  TPLINK_BOARD_ID := MR600-V2-EU
+  IMAGE_SIZE := 16384k
+endef
+TARGET_DEVICES += tplink_mr600-v2-eu
+
 define Device/tplink_re350-v1
   $(Device/dsa-migration)
   $(Device/tplink-safeloader)
   DEVICE_MODEL := RE350
   DEVICE_VARIANT := v1
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 -uboot-envtools
   TPLINK_BOARD_ID := RE350-V1
   IMAGE_SIZE := 6016k
   SUPPORTED_DEVICES += re350-v1
@@ -1867,7 +2199,7 @@ define Device/tplink_re500-v1
   $(Device/tplink-safeloader)
   DEVICE_MODEL := RE500
   DEVICE_VARIANT := v1
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
   TPLINK_BOARD_ID := RE500-V1
   IMAGE_SIZE := 14208k
 endef
@@ -1878,7 +2210,7 @@ define Device/tplink_re650-v1
   $(Device/tplink-safeloader)
   DEVICE_MODEL := RE650
   DEVICE_VARIANT := v1
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
   TPLINK_BOARD_ID := RE650-V1
   IMAGE_SIZE := 14208k
 endef
@@ -1889,7 +2221,7 @@ define Device/tplink_re650-v2
   $(Device/tplink-safeloader)
   DEVICE_MODEL := RE650
   DEVICE_VARIANT := v2
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
   TPLINK_BOARD_ID := RE650-V2
   IMAGE_SIZE := 7994k
 endef
@@ -1900,7 +2232,8 @@ define Device/tplink_tl-wpa8631p-v3
   $(Device/tplink-safeloader)
   DEVICE_MODEL := TL-WPA8631P
   DEVICE_VARIANT := v3
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
+	-uboot-envtools
   TPLINK_BOARD_ID := TL-WPA8631P-V3
   IMAGE_SIZE := 7232k
 endef
@@ -1916,7 +2249,7 @@ define Device/ubnt_edgerouter_common
   KERNEL_INITRAMFS := $$(KERNEL) | \
 	ubnt-erx-factory-image $(KDIR)/tmp/$$(KERNEL_INITRAMFS_PREFIX)-factory.tar
   IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
-  DEVICE_PACKAGES += -wpad-basic-wolfssl
+  DEVICE_PACKAGES += -wpad-basic-mbedtls -uboot-envtools
 endef
 
 define Device/ubnt_edgerouter-x
@@ -1941,7 +2274,8 @@ define Device/ubnt_unifi-6-lite
   DEVICE_VENDOR := Ubiquiti
   DEVICE_MODEL := UniFi 6 Lite
   DEVICE_DTS_CONFIG := config@1
-  DEVICE_PACKAGES += kmod-mt7603 kmod-mt7915e
+  DEVICE_DTS_LOADADDR := 0x87000000
+  DEVICE_PACKAGES += kmod-mt7603 kmod-mt7915-firmware -uboot-envtools
   KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
   IMAGE_SIZE := 15424k
 endef
@@ -1952,8 +2286,10 @@ define Device/ubnt_unifi-flexhd
   DEVICE_VENDOR := Ubiquiti
   DEVICE_MODEL := UniFi FlexHD
   DEVICE_DTS_CONFIG := config@2
+  DEVICE_DTS_LOADADDR := 0x87000000
   KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
-  DEVICE_PACKAGES += kmod-mt7603 kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES += kmod-mt7603 kmod-mt7615-firmware kmod-leds-ubnt-ledbar \
+	-uboot-envtools
   IMAGE_SIZE := 15552k
 endef
 TARGET_DEVICES += ubnt_unifi-flexhd
@@ -1962,7 +2298,7 @@ define Device/ubnt_unifi-nanohd
   $(Device/dsa-migration)
   DEVICE_VENDOR := Ubiquiti
   DEVICE_MODEL := UniFi nanoHD
-  DEVICE_PACKAGES += kmod-mt7603 kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES += kmod-mt7603 kmod-mt7615-firmware -uboot-envtools
   IMAGE_SIZE := 15552k
 endef
 TARGET_DEVICES += ubnt_unifi-nanohd
@@ -1972,8 +2308,10 @@ define Device/ubnt_usw-flex
   DEVICE_VENDOR := Ubiquiti
   DEVICE_MODEL := UniFi Switch Flex
   DEVICE_DTS_CONFIG := config@1
+  DEVICE_DTS_LOADADDR := 0x87000000
+  DEVICE_PACKAGES += -uboot-envtools
   KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
-  IMAGE_SIZE := 7360k
+  IMAGE_SIZE := 14720k
 endef
 TARGET_DEVICES += ubnt_usw-flex
 
@@ -1984,7 +2322,7 @@ define Device/unielec_u7621-01-16m
   DEVICE_VENDOR := UniElec
   DEVICE_MODEL := U7621-01
   DEVICE_VARIANT := 16M
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 -uboot-envtools
 endef
 TARGET_DEVICES += unielec_u7621-01-16m
 
@@ -1995,11 +2333,25 @@ define Device/unielec_u7621-06-16m
   DEVICE_VENDOR := UniElec
   DEVICE_MODEL := U7621-06
   DEVICE_VARIANT := 16M
-  DEVICE_PACKAGES := kmod-ata-ahci kmod-sdhci-mt7620 kmod-usb3 -wpad-basic-wolfssl
+  DEVICE_PACKAGES := kmod-ata-ahci kmod-sdhci-mt7620 kmod-usb3 \
+	-wpad-basic-mbedtls -uboot-envtools
   SUPPORTED_DEVICES += u7621-06-256M-16M unielec,u7621-06-256m-16m
 endef
 TARGET_DEVICES += unielec_u7621-06-16m
 
+define Device/unielec_u7621-06-32m
+  $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
+  IMAGE_SIZE := 32448k
+  DEVICE_VENDOR := UniElec
+  DEVICE_MODEL := U7621-06
+  DEVICE_VARIANT := 32M
+  DEVICE_PACKAGES := kmod-ata-ahci kmod-sdhci-mt7620 kmod-usb3 \
+	-wpad-basic-mbedtls -uboot-envtools
+  SUPPORTED_DEVICES += unielec,u7621-06-32m
+endef
+TARGET_DEVICES += unielec_u7621-06-32m
+
 define Device/unielec_u7621-06-64m
   $(Device/dsa-migration)
   $(Device/uimage-lzma-loader)
@@ -2007,7 +2359,8 @@ define Device/unielec_u7621-06-64m
   DEVICE_VENDOR := UniElec
   DEVICE_MODEL := U7621-06
   DEVICE_VARIANT := 64M
-  DEVICE_PACKAGES := kmod-ata-ahci kmod-sdhci-mt7620 kmod-usb3 -wpad-basic-wolfssl
+  DEVICE_PACKAGES := kmod-ata-ahci kmod-sdhci-mt7620 kmod-usb3 \
+	-wpad-basic-mbedtls -uboot-envtools
   SUPPORTED_DEVICES += unielec,u7621-06-512m-64m
 endef
 TARGET_DEVICES += unielec_u7621-06-64m
@@ -2016,7 +2369,7 @@ define Device/wavlink_wl-wn531a6
   $(Device/dsa-migration)
   DEVICE_VENDOR := Wavlink
   DEVICE_MODEL := WL-WN531A6
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7615-firmware kmod-usb3
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware kmod-usb3 -uboot-envtools
   IMAGE_SIZE := 15040k
 endef
 TARGET_DEVICES += wavlink_wl-wn531a6
@@ -2026,11 +2379,27 @@ define Device/wavlink_wl-wn533a8
   DEVICE_VENDOR := Wavlink
   DEVICE_MODEL := WL-WN533A8
   KERNEL_INITRAMFS_SUFFIX := -WN533A8$$(KERNEL_SUFFIX)
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware kmod-usb3
+  DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 -uboot-envtools
   IMAGE_SIZE := 15040k
 endef
 TARGET_DEVICES += wavlink_wl-wn533a8
 
+define Device/wavlink_ws-wn572hp3-4g
+  $(Device/dsa-migration)
+  DEVICE_VENDOR := Wavlink
+  DEVICE_MODEL := WS-WN572HP3
+  DEVICE_VARIANT := 4G
+  IMAGE_SIZE := 15040k
+  KERNEL_LOADADDR := 0x82000000
+  KERNEL := kernel-bin | relocate-kernel 0x80001000 | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  IMAGE/sysupgrade.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
+	append-rootfs | pad-rootfs | check-size | append-metadata
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
+	kmod-usb3 kmod-usb-net-rndis comgt-ncm -uboot-envtools
+endef
+TARGET_DEVICES += wavlink_ws-wn572hp3-4g
+
 define Device/wevo_11acnas
   $(Device/dsa-migration)
   $(Device/uimage-lzma-loader)
@@ -2039,7 +2408,7 @@ define Device/wevo_11acnas
   DEVICE_VENDOR := WeVO
   DEVICE_MODEL := 11AC NAS Router
   DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
-	kmod-usb-ledtrig-usbport
+	kmod-usb-ledtrig-usbport -uboot-envtools
   SUPPORTED_DEVICES += 11acnas
 endef
 TARGET_DEVICES += wevo_11acnas
@@ -2053,7 +2422,7 @@ define Device/wevo_w2914ns-v2
   DEVICE_MODEL := W2914NS
   DEVICE_VARIANT := v2
   DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
-	kmod-usb-ledtrig-usbport
+	kmod-usb-ledtrig-usbport -uboot-envtools
   SUPPORTED_DEVICES += w2914nsv2
 endef
 TARGET_DEVICES += wevo_w2914ns-v2
@@ -2067,23 +2436,17 @@ define Device/winstars_ws-wn583a6
   DEVICE_ALT0_VENDOR := Gemeita
   DEVICE_ALT0_MODEL := AC2100
   KERNEL_INITRAMFS_SUFFIX := -WN583A6$$(KERNEL_SUFFIX)
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware -uboot-envtools
 endef
 TARGET_DEVICES += winstars_ws-wn583a6
 
 define Device/xiaomi_nand_separate
-  $(Device/dsa-migration)
+  $(Device/nand)
   $(Device/uimage-lzma-loader)
   DEVICE_VENDOR := Xiaomi
-  DEVICE_PACKAGES := uboot-envtools
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  KERNEL_SIZE := 4096k
-  UBINIZE_OPTS := -E 5
   IMAGES += kernel1.bin rootfs0.bin
   IMAGE/kernel1.bin := append-kernel
   IMAGE/rootfs0.bin := append-ubi | check-size
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
 endef
 
 define Device/xiaomi_mi-router-3g
@@ -2091,7 +2454,7 @@ define Device/xiaomi_mi-router-3g
   DEVICE_MODEL := Mi Router 3G
   IMAGE_SIZE := 124416k
   DEVICE_PACKAGES += kmod-mt7603 kmod-mt76x2 kmod-usb3 \
-	kmod-usb-ledtrig-usbport
+	kmod-usb-ledtrig-usbport -uboot-envtools
   SUPPORTED_DEVICES += R3G mir3g xiaomi,mir3g
 endef
 TARGET_DEVICES += xiaomi_mi-router-3g
@@ -2103,27 +2466,21 @@ define Device/xiaomi_mi-router-3g-v2
   DEVICE_VENDOR := Xiaomi
   DEVICE_MODEL := Mi Router 3G
   DEVICE_VARIANT := v2
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 -uboot-envtools
   SUPPORTED_DEVICES += xiaomi,mir3g-v2
 endef
 TARGET_DEVICES += xiaomi_mi-router-3g-v2
 
 define Device/xiaomi_mi-router-3-pro
-  $(Device/dsa-migration)
+  $(Device/nand)
   $(Device/uimage-lzma-loader)
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  KERNEL_SIZE:= 4096k
-  UBINIZE_OPTS := -E 5
   IMAGE_SIZE := 255488k
   DEVICE_VENDOR := Xiaomi
   DEVICE_MODEL := Mi Router 3 Pro
   IMAGES += factory.bin
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
 	check-size
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware kmod-usb3 \
-	kmod-usb-ledtrig-usbport uboot-envtools
+  DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 kmod-usb-ledtrig-usbport
   SUPPORTED_DEVICES += xiaomi,mir3p
 endef
 TARGET_DEVICES += xiaomi_mi-router-3-pro
@@ -2143,32 +2500,39 @@ define Device/xiaomi_mi-router-4a-gigabit
   DEVICE_VENDOR := Xiaomi
   DEVICE_MODEL := Mi Router 4A
   DEVICE_VARIANT := Gigabit Edition
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 -uboot-envtools
 endef
 TARGET_DEVICES += xiaomi_mi-router-4a-gigabit
 
+define Device/xiaomi_mi-router-4a-gigabit-v2
+  $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
+  IMAGE_SIZE := 14784k
+  DEVICE_VENDOR := Xiaomi
+  DEVICE_MODEL := Mi Router 4A
+  DEVICE_VARIANT := Gigabit Edition v2
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
+	-uboot-envtools
+endef
+TARGET_DEVICES += xiaomi_mi-router-4a-gigabit-v2
+
 define Device/xiaomi_mi-router-ac2100
   $(Device/xiaomi_nand_separate)
   DEVICE_MODEL := Mi Router AC2100
   IMAGE_SIZE := 120320k
-  DEVICE_PACKAGES += kmod-mt7603 kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES += kmod-mt7603 kmod-mt7615-firmware -uboot-envtools
 endef
 TARGET_DEVICES += xiaomi_mi-router-ac2100
 
 define Device/xiaomi_mi-router-cr660x
-  $(Device/dsa-migration)
+  $(Device/nand)
   $(Device/uimage-lzma-loader)
   DEVICE_VENDOR := Xiaomi
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  KERNEL_SIZE := 4096k
-  UBINIZE_OPTS := -E 5
   IMAGE_SIZE := 128512k
   IMAGES += firmware.bin
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   IMAGE/firmware.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
 	check-size
-  DEVICE_PACKAGES += kmod-mt7915e uboot-envtools
+  DEVICE_PACKAGES += kmod-mt7915-firmware
 endef
 
 define Device/xiaomi_mi-router-cr6606
@@ -2193,7 +2557,7 @@ define Device/xiaomi_redmi-router-ac2100
   $(Device/xiaomi_nand_separate)
   DEVICE_MODEL := Redmi Router AC2100
   IMAGE_SIZE := 120320k
-  DEVICE_PACKAGES += kmod-mt7603 kmod-mt7615e kmod-mt7615-firmware
+  DEVICE_PACKAGES += kmod-mt7603 kmod-mt7615-firmware
 endef
 TARGET_DEVICES += xiaomi_redmi-router-ac2100
 
@@ -2202,7 +2566,8 @@ define Device/xiaoyu_xy-c5
   IMAGE_SIZE := 32448k
   DEVICE_VENDOR := XiaoYu
   DEVICE_MODEL := XY-C5
-  DEVICE_PACKAGES := kmod-ata-ahci kmod-usb3 -wpad-basic-wolfssl
+  DEVICE_PACKAGES := kmod-ata-ahci kmod-usb3 -wpad-basic-mbedtls \
+	-uboot-envtools
 endef
 TARGET_DEVICES += xiaoyu_xy-c5
 
@@ -2212,7 +2577,7 @@ define Device/xzwifi_creativebox-v1
   DEVICE_VENDOR := CreativeBox
   DEVICE_MODEL := v1
   DEVICE_PACKAGES := kmod-ata-ahci kmod-mt7603 kmod-mt76x2 kmod-sdhci-mt7620 \
-	kmod-usb3 -wpad-basic-wolfssl
+	kmod-usb3 -wpad-basic-mbedtls -uboot-envtools
 endef
 TARGET_DEVICES += xzwifi_creativebox-v1
 
@@ -2222,7 +2587,7 @@ define Device/youhua_wr1200js
   DEVICE_VENDOR := YouHua
   DEVICE_MODEL := WR1200JS
   DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
-	kmod-usb-ledtrig-usbport
+	kmod-usb-ledtrig-usbport -uboot-envtools
 endef
 TARGET_DEVICES += youhua_wr1200js
 
@@ -2232,7 +2597,9 @@ define Device/youku_yk-l2
   DEVICE_VENDOR := Youku
   DEVICE_MODEL := YK-L2
   DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
-	kmod-usb-ledtrig-usbport
+	kmod-usb-ledtrig-usbport -uboot-envtools
+  UIMAGE_MAGIC := 0x12291000
+  UIMAGE_NAME := 400000000000000000003000
 endef
 TARGET_DEVICES += youku_yk-l2
 
@@ -2241,17 +2608,40 @@ define Device/yuncore_ax820
   IMAGE_SIZE := 15808k
   DEVICE_VENDOR := YunCore
   DEVICE_MODEL := AX820
-  DEVICE_PACKAGES := kmod-mt7915e
+  DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
 endef
 TARGET_DEVICES += yuncore_ax820
 
+define Device/yuncore_fap640
+  $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
+  IMAGE_SIZE := 15808k
+  DEVICE_VENDOR := YunCore
+  DEVICE_MODEL := FAP640
+  DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
+endef
+TARGET_DEVICES += yuncore_fap640
+
+define Device/yuncore_fap690
+  $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
+  IMAGE_SIZE := 15808k
+  DEVICE_VENDOR := YunCore
+  DEVICE_MODEL := FAP690
+  DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
+endef
+TARGET_DEVICES += yuncore_fap690
+
 define Device/zbtlink_zbt-we1326
   $(Device/dsa-migration)
   $(Device/uimage-lzma-loader)
   IMAGE_SIZE := 16064k
   DEVICE_VENDOR := Zbtlink
   DEVICE_MODEL := ZBT-WE1326
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 kmod-sdhci-mt7620
+  DEVICE_ALT0_VENDOR := Wiflyer
+  DEVICE_ALT0_MODEL := WF3526-P
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 kmod-sdhci-mt7620 \
+	-uboot-envtools
   SUPPORTED_DEVICES += zbt-we1326
 endef
 TARGET_DEVICES += zbtlink_zbt-we1326
@@ -2263,7 +2653,7 @@ define Device/zbtlink_zbt-we3526
   DEVICE_VENDOR := Zbtlink
   DEVICE_MODEL := ZBT-WE3526
   DEVICE_PACKAGES := kmod-sdhci-mt7620 kmod-mt7603 kmod-mt76x2 kmod-usb3 \
-	kmod-usb-ledtrig-usbport
+	kmod-usb-ledtrig-usbport -uboot-envtools
 endef
 TARGET_DEVICES += zbtlink_zbt-we3526
 
@@ -2275,10 +2665,34 @@ define Device/zbtlink_zbt-wg1602-16m
   DEVICE_MODEL := ZBT-WG1602
   DEVICE_VARIANT := 16M
   DEVICE_PACKAGES := kmod-sdhci-mt7620 kmod-mt7603 kmod-mt76x2 kmod-usb3 \
-	kmod-usb-ledtrig-usbport
+	kmod-usb-ledtrig-usbport -uboot-envtools
 endef
 TARGET_DEVICES += zbtlink_zbt-wg1602-16m
 
+define Device/zbtlink_zbt-wg1602-v04-16m
+  $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
+  IMAGE_SIZE := 16064k
+  DEVICE_VENDOR := Zbtlink
+  DEVICE_MODEL := ZBT-WG1602-V04
+  DEVICE_VARIANT := 16M
+  DEVICE_PACKAGES := kmod-sdhci-mt7620 kmod-mt7603 kmod-mt76x2 kmod-usb3 \
+        kmod-usb-ledtrig-usbport -uboot-envtools
+endef
+TARGET_DEVICES += zbtlink_zbt-wg1602-v04-16m
+
+define Device/zbtlink_zbt-wg1602-v04-32m
+  $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
+  IMAGE_SIZE := 32128k
+  DEVICE_VENDOR := Zbtlink
+  DEVICE_MODEL := ZBT-WG1602-V04
+  DEVICE_VARIANT := 32M
+  DEVICE_PACKAGES := kmod-sdhci-mt7620 kmod-mt7603 kmod-mt76x2 kmod-usb3 \
+        kmod-usb-ledtrig-usbport -uboot-envtools
+endef
+TARGET_DEVICES += zbtlink_zbt-wg1602-v04-32m
+
 define Device/zbtlink_zbt-wg1608-16m
   $(Device/dsa-migration)
   $(Device/uimage-lzma-loader)
@@ -2287,7 +2701,8 @@ define Device/zbtlink_zbt-wg1608-16m
   DEVICE_MODEL := ZBT-WG1608
   DEVICE_VARIANT := 16M
   DEVICE_PACKAGES := kmod-sdhci-mt7620 kmod-mt7603 kmod-mt7615e \
-	kmod-mt7663-firmware-ap kmod-usb3 kmod-usb-ledtrig-usbport
+	kmod-mt7663-firmware-ap kmod-usb3 kmod-usb-ledtrig-usbport \
+	-uboot-envtools
 endef
 TARGET_DEVICES += zbtlink_zbt-wg1608-16m
 
@@ -2298,7 +2713,7 @@ define Device/zbtlink_zbt-wg2626
   DEVICE_VENDOR := Zbtlink
   DEVICE_MODEL := ZBT-WG2626
   DEVICE_PACKAGES := kmod-ata-ahci kmod-sdhci-mt7620 kmod-mt76x2 kmod-usb3 \
-	kmod-usb-ledtrig-usbport
+	kmod-usb-ledtrig-usbport -uboot-envtools
   SUPPORTED_DEVICES += zbt-wg2626
 endef
 TARGET_DEVICES += zbtlink_zbt-wg2626
@@ -2311,7 +2726,7 @@ define Device/zbtlink_zbt-wg3526-16m
   DEVICE_MODEL := ZBT-WG3526
   DEVICE_VARIANT := 16M
   DEVICE_PACKAGES := kmod-ata-ahci kmod-sdhci-mt7620 kmod-mt7603 kmod-mt76x2 \
-	kmod-usb3 kmod-usb-ledtrig-usbport
+	kmod-usb3 kmod-usb-ledtrig-usbport -uboot-envtools
   SUPPORTED_DEVICES += zbt-wg3526 zbt-wg3526-16M
 endef
 TARGET_DEVICES += zbtlink_zbt-wg3526-16m
@@ -2324,7 +2739,7 @@ define Device/zbtlink_zbt-wg3526-32m
   DEVICE_MODEL := ZBT-WG3526
   DEVICE_VARIANT := 32M
   DEVICE_PACKAGES := kmod-ata-ahci kmod-sdhci-mt7620 kmod-mt7603 kmod-mt76x2 \
-	kmod-usb3 kmod-usb-ledtrig-usbport
+	kmod-usb3 kmod-usb-ledtrig-usbport -uboot-envtools
   SUPPORTED_DEVICES += ac1200pro zbt-wg3526-32M
 endef
 TARGET_DEVICES += zbtlink_zbt-wg3526-32m
@@ -2335,57 +2750,46 @@ define Device/zio_freezio
   DEVICE_VENDOR := ZIO
   DEVICE_MODEL := FREEZIO
   DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
-	kmod-usb-ledtrig-usbport
+	kmod-usb-ledtrig-usbport -uboot-envtools
 endef
 TARGET_DEVICES += zio_freezio
 
 define Device/zyxel_lte3301-plus
-  $(Device/dsa-migration)
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  UBINIZE_OPTS := -E 5
+  $(Device/nand)
   DEVICE_VENDOR := ZyXEL
   DEVICE_MODEL := LTE3301-PLUS
-  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware kmod-usb3 \
-	uboot-envtools kmod-usb-ledtrig-usbport kmod-usb-net-qmi-wwan \
-	kmod-usb-serial-option uqmi
+  KERNEL_SIZE := 31488k
+  DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 kmod-usb-ledtrig-usbport \
+	kmod-usb-net-qmi-wwan kmod-usb-serial-option uqmi
   KERNEL := $(KERNEL_DTB) | uImage lzma | \
 	zytrx-header $$(DEVICE_MODEL) $$(VERSION_DIST)-$$(REVISION)
   KERNEL_INITRAMFS := $(KERNEL_DTB) | uImage lzma | \
 	zytrx-header $$(DEVICE_MODEL) 9.99(ABQU.1)$$(VERSION_DIST)-recovery
   KERNEL_INITRAMFS_SUFFIX := -recovery.bin
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
 endef
 TARGET_DEVICES += zyxel_lte3301-plus
 
 define Device/zyxel_nr7101
-  $(Device/dsa-migration)
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  UBINIZE_OPTS := -E 5
+  $(Device/nand)
   DEVICE_VENDOR := ZyXEL
   DEVICE_MODEL := NR7101
-  DEVICE_PACKAGES := kmod-mt7603 kmod-usb3 uboot-envtools kmod-usb-net-qmi-wwan kmod-usb-serial-option uqmi
+  KERNEL_SIZE := 31488k
+  DEVICE_PACKAGES := kmod-mt7603 kmod-usb3 kmod-usb-net-qmi-wwan kmod-usb-serial-option uqmi
   KERNEL := $(KERNEL_DTB) | uImage lzma | zytrx-header $$(DEVICE_MODEL) $$(VERSION_DIST)-$$(REVISION)
   KERNEL_INITRAMFS := $(KERNEL_DTB) | uImage lzma | zytrx-header $$(DEVICE_MODEL) 9.99(ABUV.9)$$(VERSION_DIST)-recovery
   KERNEL_INITRAMFS_SUFFIX := -recovery.bin
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
 endef
 TARGET_DEVICES += zyxel_nr7101
 
 define Device/zyxel_nwa-ax
-  $(Device/dsa-migration)
+  $(Device/nand)
   DEVICE_VENDOR := ZyXEL
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
   KERNEL_SIZE := 8192k
-  UBINIZE_OPTS := -E 5
-  DEVICE_PACKAGES := kmod-mt7915e uboot-envtools zyxel-bootconfig
+  DEVICE_PACKAGES := kmod-mt7915-firmware zyxel-bootconfig
   KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
   IMAGES += factory.bin ramboot-factory.bin
   IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | zyxel-nwa-fit
   IMAGE/ramboot-factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
 endef
 
 define Device/zyxel_nwa50ax
@@ -2401,16 +2805,24 @@ endef
 TARGET_DEVICES += zyxel_nwa55axe
 
 define Device/zyxel_wap6805
-  $(Device/dsa-migration)
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  KERNEL_SIZE := 4096k
-  UBINIZE_OPTS := -E 5
+  $(Device/nand)
+  $(Device/uimage-lzma-loader)
   IMAGE_SIZE := 32448k
   DEVICE_VENDOR := ZyXEL
   DEVICE_MODEL := WAP6805
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7621-qtn-rgmii
-  KERNEL := $(KERNEL_DTB) | uImage lzma | uimage-padhdr 160
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7621-qtn-rgmii -uboot-envtools
+  KERNEL := $$(KERNEL/lzma-loader) | uImage none | uimage-padhdr 160
 endef
 TARGET_DEVICES += zyxel_wap6805
+
+define Device/zyxel_wsm20
+  $(Device/nand)
+  KERNEL_SIZE := 8192k
+  IMAGE_SIZE := 41943040
+  DEVICE_VENDOR := ZyXEL
+  DEVICE_MODEL := WSM20
+  DEVICE_PACKAGES := kmod-mt7915-firmware
+  KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb | znet-header V1.00(ABZF.0)C0
+  KERNEL_INITRAMFS := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb | znet-header V1.00(ABZF.0)C0
+endef
+TARGET_DEVICES += zyxel_wsm20
diff --git a/target/linux/ramips/image/mt76x8.mk b/target/linux/ramips/image/mt76x8.mk
index 100d5d9c6c04ed..816009ac182fcc 100644
--- a/target/linux/ramips/image/mt76x8.mk
+++ b/target/linux/ramips/image/mt76x8.mk
@@ -40,9 +40,9 @@ TARGET_DEVICES += alfa-network_awusfree1
 
 define Device/asus_rt-ac1200
   IMAGE_SIZE := 16064k
-  DEVICE_VENDOR := Asus
+  DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RT-AC1200
-  DEVICE_ALT0_VENDOR := Asus
+  DEVICE_ALT0_VENDOR := ASUS
   DEVICE_ALT0_MODEL := RT-N600
   DEVICE_PACKAGES := kmod-mt76x2 kmod-usb2 kmod-usb-ohci \
 	kmod-usb-ledtrig-usbport
@@ -50,11 +50,12 @@ endef
 TARGET_DEVICES += asus_rt-ac1200
 
 define Device/asus_rt-ac1200-v2
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 16064k
-  DEVICE_VENDOR := Asus
+  DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RT-AC1200
   DEVICE_VARIANT := V2
+  DEVICE_ALT0_VENDOR := ASUS
+  DEVICE_ALT0_MODEL := RT-AC750L
   IMAGES += factory.bin
   IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
 	append-rootfs | pad-rootfs
@@ -64,15 +65,16 @@ TARGET_DEVICES += asus_rt-ac1200-v2
 
 define Device/asus_rt-n10p-v3
   IMAGE_SIZE := 7872k
-  DEVICE_VENDOR := Asus
+  DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RT-N10P
   DEVICE_VARIANT := V3
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_rt-n10p-v3
 
 define Device/asus_rt-n11p-b1
   IMAGE_SIZE := 7872k
-  DEVICE_VENDOR := Asus
+  DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RT-N11P
   DEVICE_VARIANT := B1
   DEVICE_ALT0_VENDOR := ASUS
@@ -81,12 +83,13 @@ define Device/asus_rt-n11p-b1
   DEVICE_ALT1_VENDOR := ASUS
   DEVICE_ALT1_MODEL := RT-N300
   DEVICE_ALT1_VARIANT := B1
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_rt-n11p-b1
 
 define Device/asus_rt-n12-vp-b1
   IMAGE_SIZE := 7872k
-  DEVICE_VENDOR := Asus
+  DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RT-N12 VP
   DEVICE_VARIANT := B1
 endef
@@ -243,6 +246,14 @@ define Device/hilink_hlk-7688a
 endef
 TARGET_DEVICES += hilink_hlk-7688a
 
+define Device/hiwifi_hc5611
+  IMAGE_SIZE := 15808k
+  DEVICE_VENDOR := HiWiFi
+  DEVICE_MODEL := HC5611
+  DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci
+endef
+TARGET_DEVICES += hiwifi_hc5611
+
 define Device/hiwifi_hc5661a
   IMAGE_SIZE := 15808k
   DEVICE_VENDOR := HiWiFi
@@ -312,6 +323,17 @@ define Device/jotale_js76x8-32m
 endef
 TARGET_DEVICES += jotale_js76x8-32m
 
+define Device/keenetic_kn-1613
+  IMAGE_SIZE := 31488k
+  DEVICE_VENDOR := Keenetic
+  DEVICE_MODEL := KN-1613
+  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7663-firmware-ap
+  IMAGES += factory.bin
+  IMAGE/factory.bin := $$(sysupgrade_bin) | pad-to $$$$(BLOCKSIZE) | \
+	check-size | zyimage -d 0x801613 -v "KN-1613"
+endef
+TARGET_DEVICES += keenetic_kn-1613
+
 define Device/kroks_kndrt31r16
   IMAGE_SIZE := 16064k
   DEVICE_VENDOR := Kroks
@@ -334,6 +356,21 @@ define Device/kroks_kndrt31r19
 endef
 TARGET_DEVICES += kroks_kndrt31r19
 
+define Device/linksys_e5400
+  IMAGE_SIZE := 16000k
+  DEVICE_VENDOR := Linksys
+  DEVICE_MODEL := E5400
+  DEVICE_ALT0_VENDOR := Linksys
+  DEVICE_ALT0_MODEL := E2500
+  DEVICE_ALT0_VARIANT := v4
+  DEVICE_ALT1_VENDOR := Linksys
+  DEVICE_ALT1_MODEL := E5300
+  DEVICE_ALT2_VENDOR := Linksys
+  DEVICE_ALT2_MODEL := E5350
+  DEVICE_PACKAGES := kmod-mt76x2
+endef
+TARGET_DEVICES += linksys_e5400
+
 define Device/mediatek_linkit-smart-7688
   IMAGE_SIZE := 32448k
   DEVICE_VENDOR := MediaTek
@@ -344,7 +381,6 @@ endef
 TARGET_DEVICES += mediatek_linkit-smart-7688
 
 define Device/mediatek_mt7628an-eval-board
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 7872k
   DEVICE_VENDOR := MediaTek
   DEVICE_MODEL := MT7628 EVB
@@ -437,6 +473,14 @@ define Device/onion_omega2p
 endef
 TARGET_DEVICES += onion_omega2p
 
+define Device/oraybox_x1
+  IMAGE_SIZE := 15360k
+  DEVICE_VENDOR := OrayBox
+  DEVICE_MODEL := X1
+  DEVICE_PACKAGES:= kmod-usb2 kmod-usb-ohci
+endef
+TARGET_DEVICES += oraybox_x1
+
 define Device/rakwireless_rak633
   IMAGE_SIZE := 7872k
   DEVICE_VENDOR := Rakwireless
@@ -976,6 +1020,16 @@ define Device/xiaomi_miwifi-nano
 endef
 TARGET_DEVICES += xiaomi_miwifi-nano
 
+define Device/xiaomi_mi-ra75
+  IMAGE_SIZE := 14976k
+  DEVICE_VENDOR := Xiaomi
+  DEVICE_MODEL := MiWiFi Range Extender AC1200 
+  DEVICE_VARIANT := RA75
+  DEVICE_PACKAGES := kmod-mt76x2
+  SUPPORTED_DEVICES += xiaomi,mira75
+endef
+TARGET_DEVICES += xiaomi_mi-ra75
+
 define Device/zbtlink_zbt-we1226
   IMAGE_SIZE := 7872k
   DEVICE_VENDOR := Zbtlink
@@ -984,8 +1038,7 @@ endef
 TARGET_DEVICES += zbtlink_zbt-we1226
 
 define Device/zyxel_keenetic-extra-ii
-  IMAGE_SIZE := 14912k
-  BLOCKSIZE := 64k
+  IMAGE_SIZE := 29824k
   DEVICE_VENDOR := ZyXEL
   DEVICE_MODEL := Keenetic Extra II
   DEVICE_PACKAGES := kmod-mt76x2 kmod-usb2 kmod-usb-ohci \
diff --git a/target/linux/ramips/image/rt288x.mk b/target/linux/ramips/image/rt288x.mk
index eff5a22030c2ff..0fdb35d963b641 100644
--- a/target/linux/ramips/image/rt288x.mk
+++ b/target/linux/ramips/image/rt288x.mk
@@ -12,7 +12,6 @@ define Build/gemtek-header
 endef
 
 define Device/airlink101_ar670w
-  BLOCKSIZE := 64k
   DEVICE_VENDOR := Airlink
   DEVICE_MODEL := AR670W
   IMAGE_SIZE := 3840k
@@ -38,9 +37,8 @@ endef
 TARGET_DEVICES += airlink101_ar725w
 
 define Device/asus_rt-n15
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 3776k
-  DEVICE_VENDOR := Asus
+  DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RT-N15
   DEVICE_PACKAGES := kmod-switch-rtl8366s
   SUPPORTED_DEVICES += rt-n15
@@ -56,11 +54,11 @@ define Device/belkin_f5d8235-v1
   DEVICE_PACKAGES := kmod-switch-rtl8366s kmod-usb-ohci kmod-usb-ohci-pci \
 	kmod-usb2 kmod-usb2-pci kmod-usb-ledtrig-usbport
   SUPPORTED_DEVICES += f5d8235-v1
+  DEFAULT := n
 endef
 TARGET_DEVICES += belkin_f5d8235-v1
 
 define Device/buffalo_wli-tx4-ag300n
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 3776k
   DEVICE_VENDOR := Buffalo
   DEVICE_MODEL := WLI-TX4-AG300N
@@ -71,7 +69,6 @@ endef
 TARGET_DEVICES += buffalo_wli-tx4-ag300n
 
 define Device/buffalo_wzr-agl300nh
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 3776k
   DEVICE_VENDOR := Buffalo
   DEVICE_MODEL := WZR-AGL300NH
@@ -82,7 +79,6 @@ endef
 TARGET_DEVICES += buffalo_wzr-agl300nh
 
 define Device/dlink_dap-1522-a1
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 3712k
   DEVICE_VENDOR := D-Link
   DEVICE_MODEL := DAP-1522
@@ -98,7 +94,6 @@ endef
 TARGET_DEVICES += dlink_dap-1522-a1
 
 define Device/ralink_v11st-fe
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 3776k
   DEVICE_VENDOR := Ralink
   DEVICE_MODEL := V11ST-FE
diff --git a/target/linux/ramips/image/rt305x.mk b/target/linux/ramips/image/rt305x.mk
index 6b8dada3c91f93..815e03a8d44269 100644
--- a/target/linux/ramips/image/rt305x.mk
+++ b/target/linux/ramips/image/rt305x.mk
@@ -43,6 +43,7 @@ define Device/7links_px-4885-8m
   DEVICE_PACKAGES := kmod-usb-dwc2 kmod-usb2 kmod-usb-ohci \
 	kmod-usb-ledtrig-usbport kmod-leds-gpio
   SUPPORTED_DEVICES += px-4885-8M
+  DEFAULT := n
 endef
 TARGET_DEVICES += 7links_px-4885-8m
 
@@ -53,6 +54,7 @@ define Device/8devices_carambola
   DEVICE_MODEL := Carambola
   DEVICE_PACKAGES :=
   SUPPORTED_DEVICES += carambola
+  DEFAULT := n
 endef
 TARGET_DEVICES += 8devices_carambola
 
@@ -62,12 +64,12 @@ define Device/accton_wr6202
   DEVICE_VENDOR := Accton
   DEVICE_MODEL := WR6202
   SUPPORTED_DEVICES += wr6202
+  DEFAULT := n
 endef
 TARGET_DEVICES += accton_wr6202
 
 define Device/airlive_air3gii
   SOC := rt5350
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 3776k
   DEVICE_VENDOR := AirLive
   DEVICE_MODEL := Air3GII
@@ -82,6 +84,7 @@ define Device/alfa-network_w502u
   DEVICE_VENDOR := ALFA
   DEVICE_MODEL := Networks W502U
   SUPPORTED_DEVICES += w502u
+  DEFAULT := n
 endef
 TARGET_DEVICES += alfa-network_w502u
 
@@ -105,6 +108,7 @@ define Device/allnet_all0256n-8m
   DEVICE_VARIANT := 8M
   DEVICE_PACKAGES := rssileds
   SUPPORTED_DEVICES += all0256n-8M
+  DEFAULT := n
 endef
 TARGET_DEVICES += allnet_all0256n-8m
 
@@ -120,6 +124,7 @@ endef
 TARGET_DEVICES += allnet_all5002
 
 define Device/allnet_all5003
+  $(Device/uimage-lzma-loader)
   SOC := rt5350
   IMAGE_SIZE := 32448k
   DEVICE_VENDOR := Allnet
@@ -127,6 +132,7 @@ define Device/allnet_all5003
   DEVICE_PACKAGES := kmod-usb-ohci kmod-usb2 kmod-usb-ledtrig-usbport \
 	kmod-i2c-gpio kmod-hwmon-lm92 kmod-gpio-pcf857x
   SUPPORTED_DEVICES += all5003
+  DEFAULT := n
 endef
 TARGET_DEVICES += allnet_all5003
 
@@ -138,6 +144,7 @@ define Device/alphanetworks_asl26555-16m
   DEVICE_VARIANT := 16M
   DEVICE_PACKAGES := kmod-usb-dwc2 kmod-usb-ledtrig-usbport
   SUPPORTED_DEVICES += asl26555 asl26555-16M
+  DEFAULT := n
 endef
 TARGET_DEVICES += alphanetworks_asl26555-16m
 
@@ -148,6 +155,7 @@ define Device/alphanetworks_asl26555-8m
   DEVICE_MODEL := ASL26555
   DEVICE_PACKAGES := kmod-usb-dwc2 kmod-usb-ledtrig-usbport
   SUPPORTED_DEVICES += asl26555 asl26555-8M
+  DEFAULT := n
 endef
 TARGET_DEVICES += alphanetworks_asl26555-8m
 
@@ -159,6 +167,7 @@ define Device/arcwireless_freestation5
   DEVICE_PACKAGES := kmod-usb-dwc2 kmod-rt2500-usb kmod-rt2800-usb \
 	kmod-rt2x00-usb
   SUPPORTED_DEVICES += freestation5
+  DEFAULT := n
 endef
 TARGET_DEVICES += arcwireless_freestation5
 
@@ -173,7 +182,6 @@ TARGET_DEVICES += argus_atp-52b
 
 define Device/asiarf_awapn2403
   SOC := rt3052
-  BLOCKSIZE := 4k
   IMAGE_SIZE := 3776k
   DEVICE_VENDOR := AsiaRF
   DEVICE_MODEL := AWAPN2403
@@ -202,14 +210,14 @@ define Device/asiarf_awm002-evb-8m
   DEVICE_VARIANT := 8M
   DEVICE_PACKAGES := kmod-usb-ohci kmod-usb2 kmod-i2c-gpio
   SUPPORTED_DEVICES += awm002-evb-8M
+  DEFAULT := n
 endef
 TARGET_DEVICES += asiarf_awm002-evb-8m
 
 define Device/asus_rt-g32-b1
   SOC := rt3050
-  BLOCKSIZE := 4k
   IMAGE_SIZE := 3776k
-  DEVICE_VENDOR := Asus
+  DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RT-G32
   DEVICE_VARIANT := B1
   SUPPORTED_DEVICES += rt-g32-b1
@@ -219,9 +227,8 @@ TARGET_DEVICES += asus_rt-g32-b1
 
 define Device/asus_rt-n10-plus
   SOC := rt3050
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 3776k
-  DEVICE_VENDOR := Asus
+  DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RT-N10+
   SUPPORTED_DEVICES += rt-n10-plus
   DEFAULT := n
@@ -231,18 +238,18 @@ TARGET_DEVICES += asus_rt-n10-plus
 define Device/asus_rt-n13u
   SOC := rt3052
   IMAGE_SIZE := 7872k
-  DEVICE_VENDOR := Asus
+  DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RT-N13U
   DEVICE_PACKAGES := kmod-leds-gpio kmod-rt2800-pci kmod-usb-dwc2
   SUPPORTED_DEVICES += rt-n13u
+  DEFAULT := n
 endef
 TARGET_DEVICES += asus_rt-n13u
 
 define Device/asus_wl-330n
   SOC := rt3050
-  BLOCKSIZE := 4k
   IMAGE_SIZE := 3776k
-  DEVICE_VENDOR := Asus
+  DEVICE_VENDOR := ASUS
   DEVICE_MODEL := WL-330N
   SUPPORTED_DEVICES += wl-330n
   DEFAULT := n
@@ -251,9 +258,8 @@ TARGET_DEVICES += asus_wl-330n
 
 define Device/asus_wl-330n3g
   SOC := rt3050
-  BLOCKSIZE := 4k
   IMAGE_SIZE := 3776k
-  DEVICE_VENDOR := Asus
+  DEVICE_VENDOR := ASUS
   DEVICE_MODEL := WL-330N3G
   DEVICE_PACKAGES :=
   SUPPORTED_DEVICES += wl-330n3g
@@ -267,6 +273,7 @@ define Device/aximcom_mr-102n
   DEVICE_VENDOR := AXIMCom
   DEVICE_MODEL := MR-102N
   SUPPORTED_DEVICES += mr-102n
+  DEFAULT := n
 endef
 TARGET_DEVICES += aximcom_mr-102n
 
@@ -279,6 +286,7 @@ define Device/aztech_hw550-3g
   DEVICE_ALT0_MODEL := ALL0239-3G
   DEVICE_PACKAGES := kmod-usb-dwc2 kmod-usb-ledtrig-usbport
   SUPPORTED_DEVICES += hw550-3g
+  DEFAULT := n
 endef
 TARGET_DEVICES += aztech_hw550-3g
 
@@ -290,6 +298,7 @@ define Device/belkin_f5d8235-v2
   DEVICE_VARIANT := v2
   DEVICE_PACKAGES := kmod-switch-rtl8366rb
   SUPPORTED_DEVICES += f5d8235-v2
+  DEFAULT := n
 endef
 TARGET_DEVICES += belkin_f5d8235-v2
 
@@ -299,12 +308,12 @@ define Device/belkin_f7c027
   DEVICE_VENDOR := Belkin
   DEVICE_MODEL := F7C027
   SUPPORTED_DEVICES += f7c027
+  DEFAULT := n
 endef
 TARGET_DEVICES += belkin_f7c027
 
 define Device/buffalo_whr-g300n
   SOC := rt3052
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 3712k
   DEVICE_VENDOR := Buffalo
   DEVICE_MODEL := WHR-G300N
@@ -326,6 +335,7 @@ define Device/dlink_dap-1350
   DEVICE_VENDOR := D-Link
   DEVICE_MODEL := DAP-1350
   SUPPORTED_DEVICES += dap-1350
+  DEFAULT := n
 endef
 TARGET_DEVICES += dlink_dap-1350
 
@@ -370,12 +380,12 @@ TARGET_DEVICES += dlink_dir-300-b1
 
 define Device/dlink_dir-300-b7
   SOC := rt5350
-  BLOCKSIZE := 4k
   IMAGE_SIZE := 7872k
   DEVICE_VENDOR := D-Link
   DEVICE_MODEL := DIR-300
   DEVICE_VARIANT := B7
   SUPPORTED_DEVICES += dir-300-b7
+  DEFAULT := n
 endef
 TARGET_DEVICES += dlink_dir-300-b7
 
@@ -386,6 +396,7 @@ define Device/dlink_dir-320-b1
   DEVICE_MODEL := DIR-320
   DEVICE_VARIANT := B1
   SUPPORTED_DEVICES += dir-320-b1
+  DEFAULT := n
 endef
 TARGET_DEVICES += dlink_dir-320-b1
 
@@ -406,7 +417,6 @@ TARGET_DEVICES += dlink_dir-600-b1
 define Device/dlink_dir-610-a1
   $(Device/seama)
   SOC := rt5350
-  BLOCKSIZE := 4k
   SEAMA_SIGNATURE := wrgn59_dlob.hans_dir610
   KERNEL := $(KERNEL_DTB)
   IMAGE_SIZE := 3776k
@@ -435,7 +445,6 @@ TARGET_DEVICES += dlink_dir-615-d
 define Device/dlink_dir-615-h1
   $(Device/uimage-lzma-loader)
   SOC := rt3352
-  BLOCKSIZE := 4k
   IMAGES += factory.bin
   IMAGE_SIZE := 3776k
   IMAGE/factory.bin := $$(sysupgrade_bin) | senao-header -r 0x218 -p 0x30 -t 3
@@ -454,6 +463,7 @@ define Device/dlink_dir-620-a1
   DEVICE_MODEL := DIR-620
   DEVICE_VARIANT := A1
   SUPPORTED_DEVICES += dir-620-a1
+  DEFAULT := n
 endef
 TARGET_DEVICES += dlink_dir-620-a1
 
@@ -464,6 +474,7 @@ define Device/dlink_dir-620-d1
   DEVICE_MODEL := DIR-620
   DEVICE_VARIANT := D1
   SUPPORTED_DEVICES += dir-620-d1
+  DEFAULT := n
 endef
 TARGET_DEVICES += dlink_dir-620-d1
 
@@ -483,6 +494,7 @@ define Device/dlink_dwr-512-b
   IMAGE/sysupgrade.bin := mkdlinkfw | pad-rootfs | append-metadata
   IMAGE/factory.bin := mkdlinkfw | pad-rootfs | mkdlinkfw-factory
   SUPPORTED_DEVICES += dwr-512-b
+  DEFAULT := n
 endef
 TARGET_DEVICES += dlink_dwr-512-b
 
@@ -493,6 +505,7 @@ define Device/easyacc_wizard-8800
   DEVICE_VENDOR := EasyAcc
   DEVICE_MODEL := WIZARD 8800
   SUPPORTED_DEVICES += wizard8800
+  DEFAULT := n
 endef
 TARGET_DEVICES += easyacc_wizard-8800
 
@@ -524,7 +537,6 @@ TARGET_DEVICES += edimax_3g-6200nl
 
 define Device/engenius_esr-9753
   SOC := rt3052
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 3776k
   DEVICE_VENDOR := EnGenius
   DEVICE_MODEL := ESR-9753
@@ -548,7 +560,6 @@ TARGET_DEVICES += fon_fonera-20n
 
 define Device/hame_mpr-a1
   SOC := rt5350
-  BLOCKSIZE := 4k
   IMAGE_SIZE := 3776k
   UIMAGE_NAME:= Linux Kernel Image
   DEVICE_VENDOR := HAME
@@ -569,6 +580,7 @@ define Device/hame_mpr-a2
   DEVICE_VARIANT := A2
   DEVICE_PACKAGES := kmod-usb-ohci kmod-usb2
   SUPPORTED_DEVICES += mpr-a2
+  DEFAULT := n
 endef
 TARGET_DEVICES += hame_mpr-a2
 
@@ -608,7 +620,6 @@ TARGET_DEVICES += hootoo_ht-tm02
 
 define Device/huawei_d105
   SOC := rt3050
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 3776k
   DEVICE_VENDOR := Huawei
   DEVICE_MODEL := D105
@@ -623,6 +634,7 @@ define Device/huawei_hg255d
   DEVICE_VENDOR := HuaWei
   DEVICE_MODEL := HG255D
   SUPPORTED_DEVICES += hg255d
+  DEFAULT := n
 endef
 TARGET_DEVICES += huawei_hg255d
 
@@ -635,6 +647,7 @@ define Device/intenso_memory2move
   DEVICE_PACKAGES := kmod-usb2 kmod-usb-storage kmod-scsi-core kmod-fs-ext4 \
 	kmod-fs-vfat block-mount
   SUPPORTED_DEVICES += m2m
+  DEFAULT := n
 endef
 TARGET_DEVICES += intenso_memory2move
 
@@ -680,6 +693,7 @@ define Device/mofinetwork_mofi3500-3gn
   DEVICE_VENDOR := MoFi Network
   DEVICE_MODEL := MOFI3500-3GN
   SUPPORTED_DEVICES += mofi3500-3gn
+  DEFAULT := n
 endef
 TARGET_DEVICES += mofinetwork_mofi3500-3gn
 
@@ -742,6 +756,7 @@ define Device/nexx_wt1520-8m
   DEVICE_MODEL := WT1520
   DEVICE_VARIANT := 8M
   SUPPORTED_DEVICES += wt1520-8M
+  DEFAULT := n
 endef
 TARGET_DEVICES += nexx_wt1520-8m
 
@@ -753,6 +768,7 @@ define Device/nixcore_x1-16m
   DEVICE_VARIANT := 16M
   DEVICE_PACKAGES := kmod-usb-ohci kmod-usb2 kmod-i2c-ralink kmod-spi-dev
   SUPPORTED_DEVICES += nixcore-x1 nixcore-x1-16M
+  DEFAULT := n
 endef
 TARGET_DEVICES += nixcore_x1-16m
 
@@ -764,6 +780,7 @@ define Device/nixcore_x1-8m
   DEVICE_VARIANT := 8M
   DEVICE_PACKAGES := kmod-usb-ohci kmod-usb2 kmod-i2c-ralink kmod-spi-dev
   SUPPORTED_DEVICES += nixcore-x1 nixcore-x1-8M
+  DEFAULT := n
 endef
 TARGET_DEVICES += nixcore_x1-8m
 
@@ -775,6 +792,7 @@ define Device/olimex_rt5350f-olinuxino
   DEVICE_MODEL := RT5350F-OLinuXino
   DEVICE_PACKAGES := kmod-usb-ohci kmod-usb2 kmod-i2c-ralink kmod-spi-dev
   SUPPORTED_DEVICES += rt5350f-olinuxino
+  DEFAULT := n
 endef
 TARGET_DEVICES += olimex_rt5350f-olinuxino
 
@@ -786,6 +804,7 @@ define Device/olimex_rt5350f-olinuxino-evb
   DEVICE_MODEL := RT5350F-OLinuXino-EVB
   DEVICE_PACKAGES := kmod-usb-ohci kmod-usb2 kmod-i2c-ralink kmod-spi-dev
   SUPPORTED_DEVICES += rt5350f-olinuxino-evb
+  DEFAULT := n
 endef
 TARGET_DEVICES += olimex_rt5350f-olinuxino-evb
 
@@ -804,12 +823,12 @@ define Device/omnima_miniembwifi
   DEVICE_VENDOR := Omnima
   DEVICE_MODEL := MiniEMBWiFi
   SUPPORTED_DEVICES += miniembwifi
+  DEFAULT := n
 endef
 TARGET_DEVICES += omnima_miniembwifi
 
 define Device/petatel_psr-680w
   SOC := rt3052
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 3776k
   DEVICE_VENDOR := Petatel
   DEVICE_MODEL := PSR-680W Wireless 3G Router
@@ -820,7 +839,6 @@ TARGET_DEVICES += petatel_psr-680w
 
 define Device/planex_mzk-dp150n
   SOC := rt5350
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 3776k
   DEVICE_VENDOR := Planex
   DEVICE_MODEL := MZK-DP150N
@@ -849,6 +867,7 @@ define Device/planex_mzk-wdpr
   DEVICE_VENDOR := Planex
   DEVICE_MODEL := MZK-WDPR
   SUPPORTED_DEVICES += mzk-wdpr
+  DEFAULT := n
 endef
 TARGET_DEVICES += planex_mzk-wdpr
 
@@ -901,6 +920,7 @@ define Device/poray_m4-8m
   DEVICE_VARIANT := 8M
   DEVICE_PACKAGES := kmod-usb2
   SUPPORTED_DEVICES += m4-8M
+  DEFAULT := n
 endef
 TARGET_DEVICES += poray_m4-8m
 
@@ -914,6 +934,7 @@ define Device/poray_x5
   DEVICE_MODEL := X5/X6
   DEVICE_PACKAGES := kmod-usb2
   SUPPORTED_DEVICES += x5
+  DEFAULT := n
 endef
 TARGET_DEVICES += poray_x5
 
@@ -927,6 +948,7 @@ define Device/poray_x8
   DEVICE_MODEL := X8
   DEVICE_PACKAGES := kmod-usb2
   SUPPORTED_DEVICES += x8
+  DEFAULT := n
 endef
 TARGET_DEVICES += poray_x8
 
@@ -937,12 +959,12 @@ define Device/prolink_pwh2004
   DEVICE_MODEL := PWH2004
   DEVICE_PACKAGES :=
   SUPPORTED_DEVICES += pwh2004
+  DEFAULT := n
 endef
 TARGET_DEVICES += prolink_pwh2004
 
 define Device/ralink_v22rw-2x2
   SOC := rt3052
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 3776k
   DEVICE_VENDOR := Ralink
   DEVICE_MODEL := AP-RT3052-V22RW-2X2
@@ -953,7 +975,6 @@ TARGET_DEVICES += ralink_v22rw-2x2
 
 define Device/sitecom_wl-351
   SOC := rt3052
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 3776k
   DEVICE_VENDOR := Sitecom
   DEVICE_MODEL := WL-351 v1
@@ -965,7 +986,6 @@ TARGET_DEVICES += sitecom_wl-351
 
 define Device/skyline_sl-r7205
   SOC := rt3052
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 3776k
   DEVICE_VENDOR := Skyline
   DEVICE_MODEL := SL-R7205 Wireless 3G Router
@@ -976,7 +996,6 @@ TARGET_DEVICES += skyline_sl-r7205
 
 define Device/sparklan_wcr-150gn
   SOC := rt3050
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 3776k
   DEVICE_VENDOR := Sparklan
   DEVICE_MODEL := WCR-150GN
@@ -991,12 +1010,12 @@ define Device/teltonika_rut5xx
   DEVICE_VENDOR := Teltonika
   DEVICE_MODEL := RUT5XX
   SUPPORTED_DEVICES += rut5xx
+  DEFAULT := n
 endef
 TARGET_DEVICES += teltonika_rut5xx
 
 define Device/tenda_3g150b
   SOC := rt5350
-  BLOCKSIZE := 4k
   IMAGE_SIZE := 3776k
   UIMAGE_NAME:= Linux Kernel Image
   DEVICE_VENDOR := Tenda
@@ -1044,7 +1063,6 @@ TARGET_DEVICES += tenda_w306r-v2
 
 define Device/trendnet_tew-638apb-v2
   SOC := rt3050
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 3776k
   IMAGE/sysupgrade.bin := $$(sysupgrade_bin) | umedia-header 0x026382 | \
 	check-size | append-metadata
@@ -1062,6 +1080,7 @@ define Device/trendnet_tew-714tru
   DEVICE_VENDOR := TRENDnet
   DEVICE_MODEL := TEW-714TRU
   SUPPORTED_DEVICES += tew-714tru
+  DEFAULT := n
 endef
 TARGET_DEVICES += trendnet_tew-714tru
 
@@ -1097,12 +1116,12 @@ define Device/unbranded_wr512-3gn-8m
   DEVICE_MODEL := WR512-3GN
   DEVICE_VARIANT := 8M
   SUPPORTED_DEVICES += wr512-3gn-8M
+  DEFAULT := n
 endef
 TARGET_DEVICES += unbranded_wr512-3gn-8m
 
 define Device/unbranded_xdx-rn502j
   SOC := rt3052
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 3776k
   DEVICE_VENDOR := Unbranded
   DEVICE_MODEL := XDX-RN502J
@@ -1113,7 +1132,6 @@ TARGET_DEVICES += unbranded_xdx-rn502j
 
 define Device/upvel_ur-326n4g
   SOC := rt3052
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 3776k
   DEVICE_VENDOR := UPVEL
   DEVICE_MODEL := UR-326N4G
@@ -1130,6 +1148,7 @@ define Device/upvel_ur-336un
   DEVICE_MODEL := UR-336UN
   DEVICE_PACKAGES := kmod-usb-dwc2 kmod-usb-ledtrig-usbport
   SUPPORTED_DEVICES += ur-336un
+  DEFAULT := n
 endef
 TARGET_DEVICES += upvel_ur-336un
 
@@ -1141,6 +1160,7 @@ define Device/vocore_vocore-16m
   DEVICE_VARIANT := 16M
   DEVICE_PACKAGES := kmod-usb-ohci kmod-usb2 kmod-i2c-ralink kmod-spi-dev
   SUPPORTED_DEVICES += vocore vocore-16M
+  DEFAULT := n
 endef
 TARGET_DEVICES += vocore_vocore-16m
 
@@ -1152,6 +1172,7 @@ define Device/vocore_vocore-8m
   DEVICE_VARIANT := 8M
   DEVICE_PACKAGES := kmod-usb-ohci kmod-usb2 kmod-i2c-ralink kmod-spi-dev
   SUPPORTED_DEVICES += vocore vocore-8M
+  DEFAULT := n
 endef
 TARGET_DEVICES += vocore_vocore-8m
 
@@ -1171,6 +1192,7 @@ define Device/wiznet_wizfi630a
   DEVICE_VENDOR := WIZnet
   DEVICE_MODEL := WizFi630A
   SUPPORTED_DEVICES += wizfi630a
+  DEFAULT := n
 endef
 TARGET_DEVICES += wiznet_wizfi630a
 
@@ -1180,6 +1202,7 @@ define Device/zorlik_zl5900v2
   DEVICE_VENDOR := Zorlik
   DEVICE_MODEL := ZL5900V2
   DEVICE_PACKAGES := kmod-usb-ohci kmod-usb2
+  DEFAULT := n
 endef
 TARGET_DEVICES += zorlik_zl5900v2
 
@@ -1196,13 +1219,13 @@ TARGET_DEVICES += zte_mf283plus
 
 define Device/zyxel_keenetic
   SOC := rt3052
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 7872k
   DEVICE_VENDOR := ZyXEL
   DEVICE_MODEL := Keenetic
   DEVICE_PACKAGES := kmod-usb2 kmod-usb-ehci kmod-usb-ledtrig-usbport \
 	kmod-usb-dwc2
   SUPPORTED_DEVICES += kn
+  DEFAULT := n
 endef
 TARGET_DEVICES += zyxel_keenetic
 
@@ -1213,6 +1236,7 @@ define Device/zyxel_keenetic-4g-b
   DEVICE_VENDOR := ZyXEL
   DEVICE_MODEL := Keenetic 4G
   DEVICE_VARIANT := B
+  DEFAULT := n
 endef
 TARGET_DEVICES += zyxel_keenetic-4g-b
 
@@ -1223,6 +1247,7 @@ define Device/zyxel_keenetic-lite-b
   DEVICE_VENDOR := ZyXEL
   DEVICE_MODEL := Keenetic Lite
   DEVICE_VARIANT := B
+  DEFAULT := n
 endef
 TARGET_DEVICES += zyxel_keenetic-lite-b
 
@@ -1237,7 +1262,6 @@ TARGET_DEVICES += zyxel_keenetic-start
 
 define Device/zyxel_nbg-419n
   SOC := rt3052
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 3776k
   DEVICE_VENDOR := ZyXEL
   DEVICE_MODEL := NBG-419N
diff --git a/target/linux/ramips/image/rt3883.mk b/target/linux/ramips/image/rt3883.mk
index e76678be1a1c97..04300992965c73 100644
--- a/target/linux/ramips/image/rt3883.mk
+++ b/target/linux/ramips/image/rt3883.mk
@@ -7,10 +7,9 @@ endef
 
 define Device/asus_rt-n56u
   SOC := rt3662
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 7872k
   IMAGE/sysupgrade.bin += | mkrtn56uimg -s
-  DEVICE_VENDOR := Asus
+  DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RT-N56U
   DEVICE_PACKAGES := kmod-usb-ohci kmod-usb2
   SUPPORTED_DEVICES += rt-n56u
@@ -18,26 +17,22 @@ endef
 TARGET_DEVICES += asus_rt-n56u
 
 define Device/belkin_f9k1109v1
+  $(Device/uimage-lzma-loader)
   SOC := rt3883
-  BLOCKSIZE := 64k
   DEVICE_VENDOR := Belkin
   DEVICE_MODEL := F9K1109
   DEVICE_VARIANT := Version 1.0
   DEVICE_PACKAGES := kmod-usb-ohci kmod-usb2 kmod-usb-ledtrig-usbport
   IMAGE_SIZE := 7808k
-  KERNEL := kernel-bin | append-dtb | lzma -d16 | uImage lzma
   # Stock firmware checks for this uImage image name during upload.
   UIMAGE_NAME := N750F9K1103VB
 endef
 TARGET_DEVICES += belkin_f9k1109v1
 
 define Device/dlink_dir-645
-  $(Device/seama)
-  $(Device/uimage-lzma-loader)
+  $(Device/seama-lzma-loader)
   SOC := rt3662
-  BLOCKSIZE := 4k
   IMAGE_SIZE := 7872k
-  KERNEL := kernel-bin | append-dtb | lzma -d10
   SEAMA_SIGNATURE := wrgn39_dlob.hans_dir645
   DEVICE_VENDOR := D-Link
   DEVICE_MODEL := DIR-645
@@ -48,7 +43,6 @@ TARGET_DEVICES += dlink_dir-645
 
 define Device/edimax_br-6475nd
   SOC := rt3662
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 7744k
   IMAGE/sysupgrade.bin := append-kernel | append-rootfs | \
 	edimax-header -s CSYS -m RN54 -f 0x70000 -S 0x01100000 | pad-rootfs | \
@@ -62,7 +56,6 @@ TARGET_DEVICES += edimax_br-6475nd
 define Device/engenius_esr600h
   $(Device/uimage-lzma-loader)
   SOC := rt3662
-  BLOCKSIZE := 4k
   IMAGE_SIZE := 7872k
   IMAGES += factory.dlf
   IMAGE/factory.dlf := $$(sysupgrade_bin) | check-size | \
@@ -75,17 +68,16 @@ TARGET_DEVICES += engenius_esr600h
 
 define Device/loewe_wmdr-143n
   SOC := rt3662
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 7872k
   DEVICE_VENDOR := Loewe
   DEVICE_MODEL := WMDR-143N
   SUPPORTED_DEVICES += wmdr-143n
+  DEFAULT := n
 endef
 TARGET_DEVICES += loewe_wmdr-143n
 
 define Device/omnima_hpm
   SOC := rt3662
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 16064k
   DEVICE_VENDOR := Omnima
   DEVICE_MODEL := HPM
@@ -110,7 +102,6 @@ TARGET_DEVICES += samsung_cy-swr1100
 define Device/sitecom_wlr-6000
   $(Device/uimage-lzma-loader)
   SOC := rt3883
-  BLOCKSIZE := 4k
   IMAGE_SIZE := 7244k
   IMAGES += factory.dlf
   IMAGE/factory.dlf := $$(sysupgrade_bin) | check-size | \
@@ -124,7 +115,6 @@ TARGET_DEVICES += sitecom_wlr-6000
 
 define Device/trendnet_tew-691gr
   SOC := rt3883
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 7872k
   IMAGES += factory.bin
   IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | umedia-header 0x026910
@@ -136,7 +126,6 @@ TARGET_DEVICES += trendnet_tew-691gr
 
 define Device/trendnet_tew-692gr
   SOC := rt3883
-  BLOCKSIZE := 64k
   IMAGE_SIZE := 7872k
   IMAGES += factory.bin
   IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | umedia-header 0x026920
diff --git a/target/linux/ramips/mt7620/base-files/etc/board.d/01_leds b/target/linux/ramips/mt7620/base-files/etc/board.d/01_leds
index b1dc36672d8a79..2deda0861a933e 100644
--- a/target/linux/ramips/mt7620/base-files/etc/board.d/01_leds
+++ b/target/linux/ramips/mt7620/base-files/etc/board.d/01_leds
@@ -55,6 +55,7 @@ planex,mzk-ex300np|\
 zbtlink,zbt-we826-16m|\
 zbtlink,zbt-we826-32m|\
 zbtlink,zbt-wr8305rt|\
+zyxel,keenetic-lite-iii-a|\
 zyxel,keenetic-omni|\
 zyxel,keenetic-omni-ii|\
 zyxel,keenetic-viva)
@@ -101,6 +102,7 @@ edimax,br-6478ac-v2|\
 edimax,ew-7478apc)
 	ucidef_set_led_netdev "wifi_led" "wifi" "blue:wlan" "wlan0"
 	;;
+ampedwireless,b1200ex|\
 edimax,ew-7476rpc|\
 edimax,ew-7478ac)
 	ucidef_set_led_switch "lan" "lan" "green:lan"  "switch0" "0x20"
@@ -150,6 +152,11 @@ kingston,mlwg2|\
 sanlinking,d240)
 	ucidef_set_led_netdev "wifi_led" "wifi" "blue:wifi" "wlan0"
 	;;
+snr,cpe-w4n-mt)
+	ucidef_set_led_heartbeat "wps" "WPS" "green:wps"
+	ucidef_set_led_timer "sys" "System" "green:sys" "500" "500"
+	ucidef_set_led_wlan "wlan" "Wi-Fi" "green:wlan" "phy0tpt"
+	;;
 lenovo,newifi-y1)
 	ucidef_set_led_netdev "wifi" "WIFI" "blue:wifi" "wlan1"
 	ucidef_set_led_netdev "wifi5g" "WIFI5G" "blue:wifi5g" "wlan0"
diff --git a/target/linux/ramips/mt7620/base-files/etc/board.d/02_network b/target/linux/ramips/mt7620/base-files/etc/board.d/02_network
index 79df10205613f0..787e123e31be10 100644
--- a/target/linux/ramips/mt7620/base-files/etc/board.d/02_network
+++ b/target/linux/ramips/mt7620/base-files/etc/board.d/02_network
@@ -28,6 +28,7 @@ ramips_setup_interfaces()
 	zbtlink,zbt-we826-32m|\
 	zbtlink,zbt-we826-e|\
 	zbtlink,zbt-wr8305rt|\
+	zyxel,keenetic-lite-iii-a|\
 	zyxel,keenetic-omni)
 		ucidef_add_switch "switch0" \
 			"0:lan" "1:lan" "2:lan" "3:lan" "4:wan" "6@eth0"
@@ -38,6 +39,7 @@ ramips_setup_interfaces()
 			"3:lan" "4:wan" "6@eth0"
 		;;
 	alfa-network,tube-e4g|\
+	ampedwireless,b1200ex|\
 	buffalo,wmr-300|\
 	dlink,dch-m225|\
 	edimax,ew-7476rpc|\
@@ -85,6 +87,7 @@ ramips_setup_interfaces()
 	glinet,gl-mt300n|\
 	glinet,gl-mt750|\
 	hiwifi,hc5661|\
+	snr,cpe-w4n-mt|\
 	wrtnode,wrtnode|\
 	zbtlink,zbt-wa05|\
 	zyxel,keenetic-omni-ii)
@@ -147,6 +150,7 @@ ramips_setup_interfaces()
 		ucidef_add_switch "switch1" \
 			"1:lan" "2:lan" "3:lan" "4:lan" "0:wan" "6@eth0"
 		;;
+	engenius,epg600|\
 	engenius,esr600|\
 	lava,lr-25g001|\
 	sitecom,wlr-4100-v1-002)
@@ -237,6 +241,10 @@ ramips_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"5:lan" "4:wan" "6@eth0"
 		;;
+	youku,x2)
+		ucidef_add_switch "switch0" \
+			"1:lan:2" "4:lan:1" "0:wan" "6@eth0"
+		;;
 	youku,yk-l1|\
 	youku,yk-l1c)
 		ucidef_add_switch "switch0" \
@@ -326,9 +334,11 @@ ramips_setup_macs()
 	edimax,br-6478ac-v2)
 		wan_mac=$(macaddr_add "$(mtd_get_mac_binary factory 0x4)" 2)
 		;;
+	engenius,epg600|\
 	engenius,esr600)
 		lan_mac=$(mtd_get_mac_ascii u-boot-env ethaddr)
 		wan_mac=$(mtd_get_mac_ascii u-boot-env wanaddr)
+		label_mac=$wan_mac
 		;;
 	glinet,gl-mt300a|\
 	glinet,gl-mt300n|\
@@ -368,6 +378,7 @@ ramips_setup_macs()
 	ohyeah,oy-0001|\
 	wavlink,wl-wn530hg4|\
 	wevo,air-duo|\
+	youku,x2|\
 	youku,yk-l1|\
 	youku,yk-l1c)
 		wan_mac=$(mtd_get_mac_binary factory 0x2e)
@@ -375,6 +386,11 @@ ramips_setup_macs()
 	linksys,e1700)
 		wan_mac=$(mtd_get_mac_ascii config WAN_MAC_ADDR)
 		;;
+	snr,cpe-w4n-mt)
+		lan_mac=$(mtd_get_mac_binary Factory 0x28)
+		wan_mac=$(mtd_get_mac_binary Factory 0x2e)
+		label_mac=$wan_mac
+		;;
 	tplink,archer-c2-v1|\
 	tplink,archer-c20-v1|\
 	tplink,archer-c20i|\
@@ -389,6 +405,11 @@ ramips_setup_macs()
 	zbtlink,zbt-we1026-5g-16m)
 		label_mac=$(mtd_get_mac_binary factory 0x4)
 		;;
+	zyxel,keenetic-lite-iii-a)
+		lan_mac=$(mtd_get_mac_binary RF-EEPROM 0x4)		
+		wan_mac=$(mtd_get_mac_binary RF-EEPROM 0x28)
+		label_mac=$wan_mac
+		;;
 	zyxel,keenetic-omni|\
 	zyxel,keenetic-omni-ii|\
 	zyxel,keenetic-viva)
diff --git a/target/linux/ramips/mt7620/config-5.15 b/target/linux/ramips/mt7620/config-5.15
index 5c6464d4a28160..fdca30fecbf379 100644
--- a/target/linux/ramips/mt7620/config-5.15
+++ b/target/linux/ramips/mt7620/config-5.15
@@ -21,6 +21,7 @@ CONFIG_CPU_HAS_DIEI=y
 CONFIG_CPU_HAS_PREFETCH=y
 CONFIG_CPU_HAS_RIXI=y
 CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_LITTLE_ENDIAN=y
 CONFIG_CPU_MIPS32=y
 # CONFIG_CPU_MIPS32_R1 is not set
 CONFIG_CPU_MIPS32_R2=y
@@ -64,6 +65,7 @@ CONFIG_GENERIC_LIB_LSHRDI3=y
 CONFIG_GENERIC_LIB_UCMPDI2=y
 CONFIG_GENERIC_PCI_IOMAP=y
 CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
 CONFIG_GENERIC_SCHED_CLOCK=y
 CONFIG_GENERIC_SMP_IDLE_THREAD=y
 CONFIG_GENERIC_TIME_VSYSCALL=y
@@ -112,6 +114,7 @@ CONFIG_MODULES_USE_ELF_REL=y
 # CONFIG_MT7621_WDT is not set
 # CONFIG_MTD_CFI_INTELEXT is not set
 CONFIG_MTD_CMDLINE_PARTS=y
+# CONFIG_MTD_PARSER_TPLINK_SAFELOADER is not set
 CONFIG_MTD_PHYSMAP=y
 CONFIG_MTD_SPI_NOR=y
 CONFIG_MTD_SPI_NOR_USE_VARIABLE_ERASE=y
@@ -150,8 +153,9 @@ CONFIG_PHYLIB=y
 # CONFIG_PHY_MT7621_PCI is not set
 CONFIG_PHY_RALINK_USB=y
 CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_AW9523 is not set
 CONFIG_PINCTRL_MT7620=y
-# CONFIG_PINCTRL_RALINK is not set
+CONFIG_PINCTRL_RALINK=y
 # CONFIG_PINCTRL_SINGLE is not set
 CONFIG_PTP_1588_CLOCK_OPTIONAL=y
 CONFIG_RALINK=y
diff --git a/target/linux/ramips/mt7620/target.mk b/target/linux/ramips/mt7620/target.mk
index 5fc61e49cf8f31..34488f95afb958 100644
--- a/target/linux/ramips/mt7620/target.mk
+++ b/target/linux/ramips/mt7620/target.mk
@@ -7,7 +7,7 @@ BOARDNAME:=MT7620 based boards
 FEATURES+=usb ramdisk
 CPU_TYPE:=24kc
 
-DEFAULT_PACKAGES += kmod-rt2800-soc wpad-basic-wolfssl swconfig
+DEFAULT_PACKAGES += kmod-rt2800-soc wpad-basic-mbedtls swconfig
 
 define Target/Description
 	Build firmware images for Ralink MT7620 based boards.
diff --git a/target/linux/ramips/mt7621/base-files/etc/board.d/01_leds b/target/linux/ramips/mt7621/base-files/etc/board.d/01_leds
index 0ac67e967043a0..9b15da0d22b636 100644
--- a/target/linux/ramips/mt7621/base-files/etc/board.d/01_leds
+++ b/target/linux/ramips/mt7621/base-files/etc/board.d/01_leds
@@ -19,13 +19,25 @@ asus,rp-ac87)
 	ucidef_set_led_rssi "rssimed-wlan1" "RSSIMED" "green:rssimed-wlan1" "wlan1" "40" "100"
 	ucidef_set_led_rssi "rssihigh-wlan1" "RSSIHIGH" "green:rssihigh-wlan1" "wlan1" "70" "100"
 	;;
+asus,rt-ax53u)
+	ucidef_set_led_usbport "usb" "USB" "blue:usb" "usb1-port2"
+	ucidef_set_led_wlan "wlan2g" "WiFi 2.4GHz" "mt76-phy0" "phy0tpt"
+	ucidef_set_led_wlan "wlan5g" "WiFi 5GHz" "mt76-phy1" "phy1tpt"
+	;;
+asus,rt-ax54)
+	ucidef_set_led_wlan "wlan2g" "WiFi 2.4GHz" "mt76-phy0" "phy0tpt"
+	ucidef_set_led_wlan "wlan5g" "WiFi 5GHz" "mt76-phy1" "phy1tpt"
+	;;
 asus,rt-n56u-b1)
 	ucidef_set_led_netdev "lan" "LAN link" "blue:lan" "br-lan"
 	ucidef_set_led_netdev "wan" "WAN link" "blue:wan" "wan"
 	;;
 beeline,smartbox-flash|\
 beeline,smartbox-giga|\
-beeline,smartbox-turbo)
+beeline,smartbox-turbo|\
+beeline,smartbox-turbo-plus|\
+etisalat,s3|\
+rostelecom,rt-sf-1)
 	ucidef_set_led_netdev "wan" "wan" "blue:wan" "wan"
 	;;
 belkin,rt1800)
@@ -49,17 +61,37 @@ jcg,y2|\
 xzwifi,creativebox-v1)
 	ucidef_set_led_netdev "internet" "internet" "blue:internet" "wan"
 	;;
+dlink,dap-1620-b1)
+	ucidef_set_rssimon "wlan1" "200000" "1"
+	ucidef_set_led_rssi "rssilow" "RSSILOW" "red:rssilow" "wlan1" "1" "40"
+	ucidef_set_led_rssi "rssimediumlow" "RSSIMEDIUMLOW" "green:rssilow" "wlan1" "21" "100"
+	ucidef_set_led_rssi "rssimediumhigh" "RSSIMEDIUMHIGH" "green:rssimed" "wlan1" "61" "100"
+	ucidef_set_led_rssi "rssihigh" "RSSIHIGH" "green:rssihigh" "wlan1" "81" "100"
+	;;
+dlink,dap-x1860-a1)
+	ucidef_set_rssimon "wlan1" "200000" "1"
+	ucidef_set_led_rssi "rssilow" "RSSILOW" "orange:rssilow" "wlan1" "1" "25"
+	ucidef_set_led_rssi "rssimediumlow" "RSSIMEDIUMLOW" "green:rssilow" "wlan1" "26" "100"
+	ucidef_set_led_rssi "rssimediumhigh" "RSSIMEDIUMHIGH" "green:rssimedium" "wlan1" "51" "100"
+	ucidef_set_led_rssi "rssihigh" "RSSIHIGH" "green:rssihigh" "wlan1" "76" "100"
+	;;
 dlink,dir-1960-a1|\
 dlink,dir-2640-a1|\
 dlink,dir-2660-a1)
 	ucidef_set_led_netdev "wan" "wan" "white:net" "wan"
 	;;
+dlink,dir-3060-a1)
+	ucidef_set_led_netdev "net_white" "WAN Link" "white:net" "wan" "link"
+	ucidef_set_led_netdev "net_orange" "WAN Activity" "orange:net" "wan" "tx rx"
+	;;
+dlink,dir-853-a1|\
 dlink,dir-853-a3)
 	ucidef_set_led_netdev "wan" "wan" "blue:net" "wan"
 	;;
 dlink,dir-853-r1)
 	ucidef_set_led_netdev "internet" "internet" "blue:net" "wan"
 	;;
+dlink,dir-1935-a1|\
 dlink,dir-860l-b1|\
 dlink,dir-867-a1|\
 dlink,dir-878-a1|\
@@ -67,21 +99,18 @@ dlink,dir-882-a1|\
 dlink,dir-882-r1)
 	ucidef_set_led_netdev "wan" "wan" "green:net" "wan"
 	;;
-gnubee,gb-pc1|\
 gnubee,gb-pc2)
-	ucidef_set_led_netdev "ethblack_act" "ethblack act" "green:ethblack_act" "ethblack" "tx rx"
-	ucidef_set_led_netdev "ethblue_act" "ethblue act" "green:ethblue_act" "ethblue" "tx rx"
+	ucidef_set_led_netdev "ethyellow" "ethyellow" "orange:ethyellow" "ethyellow" "link tx rx"
+	;;
+huasifei,ws1208v2)
+	ucidef_set_led_netdev "wwan0" "wwan0" "green:cellular" "wwan0" "link tx rx"
+	;;
+keenetic,kn-3010)
+	ucidef_set_led_netdev "internet" "internet" "green:internet" "wan"
 	;;
 linksys,e5600)
 	ucidef_set_led_netdev "wan" "wan link" "blue:wan" "wan" "link"
 	;;
-linksys,e7350)
-	ucidef_set_led_netdev "lan1" "lan1" "blue:lan-1" "lan1"
-	ucidef_set_led_netdev "lan2" "lan2" "blue:lan-2" "lan2"
-	ucidef_set_led_netdev "lan3" "lan4" "blue:lan-3" "lan3"
-	ucidef_set_led_netdev "lan4" "lan4" "blue:lan-4" "lan4"
-	ucidef_set_led_netdev "wan" "wan" "blue:wan" "wan"
-	;;
 linksys,ea6350-v4|\
 linksys,ea7300-v1|\
 linksys,ea7300-v2|\
@@ -97,6 +126,7 @@ linksys,ea8100-v2)
 mikrotik,routerboard-760igs)
 	ucidef_set_led_netdev "sfp" "SFP" "blue:sfp" "sfp"
 	;;
+mikrotik,ltap-2hnd|\
 mikrotik,routerboard-m11g)
 	ucidef_set_rssimon "wlan0" "200000" "1"
 	ucidef_set_led_rssi "rssilow" "RSSILOW" "green:rssi0" "wlan0" "1" "100"
@@ -129,26 +159,40 @@ netgear,r7450)
 	;;
 netgear,wax202)
 	ucidef_set_led_netdev "internet" "Internet" "green:net" "wan"
-	ucidef_set_led_netdev "lan1" "LAN1" "green:lan1" "lan1"
-	ucidef_set_led_netdev "lan2" "LAN2" "green:lan2" "lan2"
-	ucidef_set_led_netdev "lan3" "LAN3" "green:lan3" "lan3"
 	;;
 oraybox,x3a)
 	ucidef_set_led_netdev "wan" "wan link" "red:status" "wan"
 	ucidef_set_led_netdev "lan" "lan link" "green:status" "br-lan"
 	;;
+snr,snr-cpe-me1)
+	ucidef_set_led_usbport "usb" "USB" "green:usb" "usb1-port1" "usb2-port1"
+	;;
 tplink,archer-a6-v3|\
+tplink,archer-ax23-v1|\
 tplink,archer-c6-v3|\
 tplink,archer-c6u-v1)
 	ucidef_set_led_netdev "lan" "LAN" "green:lan" "br-lan"
 	ucidef_set_led_netdev "wan" "WAN" "green:wan" "wan"
 	;;
+tplink,deco-m4r-v4)
+	ucidef_set_led_netdev "lan" "LAN" "green:lan" "br-lan"
+	;;
+tplink,ec330-g5u-v1)
+	ucidef_set_led_netdev "lan" "Ethernet" "blue:ethernet" "br-lan" "link tx rx"
+	ucidef_set_led_netdev "wan" "Internet" "blue:internet" "wan" "link tx rx"
+	ucidef_set_led_netdev "wan-off" "Internet-off" "amber:internet" "wan" "link"
+	;;
 tplink,re350-v1)
 	ucidef_set_led_netdev "wifi2g" "Wifi 2.4G" "blue:wifi2G" "wlan0"
 	ucidef_set_led_netdev "wifi5g" "Wifi 5G" "blue:wifi5G" "wlan1"
 	ucidef_set_led_netdev "eth_act" "LAN act" "green:eth_act" "lan" "tx rx"
 	ucidef_set_led_netdev "eth_link" "LAN link" "green:eth_link" "lan" "link"
 	;;
+tplink,mr600-v2-eu)
+	ucidef_set_led_netdev "lan" "LAN" "white:lan" "br-lan"
+	ucidef_set_led_netdev "wan" "WAN" "white:wan" "wan"
+	ucidef_set_led_netdev "4g" "4G" "white:4g" "wwan0"
+	;;
 tplink,re500-v1|\
 tplink,re650-v1|\
 tplink,re650-v2)
@@ -158,6 +202,9 @@ tplink,re650-v2)
 tplink,tl-wpa8631p-v3)
 	ucidef_set_led_netdev "lan" "LAN" "green:lan" "br-lan"
 	;;
+xiaomi,mi-router-4a-gigabit-v2)
+	ucidef_set_led_netdev "wan" "wan" "blue:wan" "wan" "link"
+	;;
 xiaomi,mi-router-ac2100)
 	ucidef_set_led_netdev "wan-blue" "WAN (blue)" "blue:wan" "wan"
 	;;
@@ -172,17 +219,13 @@ xiaomi,redmi-router-ac2100)
 youhua,wr1200js)
 	ucidef_set_led_netdev "internet" "INTERNET" "green:wan" "wan"
 	;;
+yuncore,fap690)
+	ucidef_set_led_netdev "eth_link" "LAN link" "blue:status" "lan" "link"
+	;;
 yuncore,ax820)
 	ucidef_set_led_netdev "lan" "LAN" "green:lan" "lan"
 	ucidef_set_led_netdev "wan" "WAN" "green:wan" "wan"
 	;;
-zbtlink,zbt-wg1608-16m)
-	ucidef_set_led_netdev "lan1" "LAN1" "green:lan-1" "lan1"
-	ucidef_set_led_netdev "lan2" "LAN2" "green:lan-2" "lan2"
-	ucidef_set_led_netdev "lan3" "LAN3" "green:lan-3" "lan3"
-	ucidef_set_led_netdev "lan4" "LAN4" "green:lan-4" "lan4"
-	ucidef_set_led_netdev "wan" "WAN" "green:wan" "wan"
-	;;
 zyxel,lte3301-plus)
 	ucidef_set_led_netdev "internet" "internet" "white:internet" "wwan0"
 	;;
diff --git a/target/linux/ramips/mt7621/base-files/etc/board.d/02_network b/target/linux/ramips/mt7621/base-files/etc/board.d/02_network
index 8a9a0af7b01002..cd746e84eeae88 100644
--- a/target/linux/ramips/mt7621/base-files/etc/board.d/02_network
+++ b/target/linux/ramips/mt7621/base-files/etc/board.d/02_network
@@ -8,10 +8,17 @@ ramips_setup_interfaces()
 	local board="$1"
 
 	case $board in
+	arcadyan,we420223-99)
+		ucidef_set_interface_lan "swp0 swp1"
+		;;
 	ampedwireless,ally-00x19k|\
 	asus,rp-ac56|\
 	asus,rp-ac87|\
+	dlink,dap-1620-b1|\
+	dlink,dap-x1860-a1|\
 	edimax,re23s|\
+	linksys,re7000|\
+	mikrotik,ltap-2hnd|\
 	mikrotik,routerboard-m11g|\
 	netgear,ex6150|\
 	sercomm,na502|\
@@ -24,27 +31,33 @@ ramips_setup_interfaces()
 	ubnt,unifi-6-lite|\
 	ubnt,unifi-flexhd|\
 	ubnt,unifi-nanohd|\
+	yuncore,fap690|\
 	zyxel,nwa50ax|\
 	zyxel,nwa55axe)
 		ucidef_set_interface_lan "lan"
 		;;
 	ampedwireless,ally-r1900k|\
+	asus,rt-ax53u|\
 	gehua,ghl-r-001|\
 	h3c,tx1800-plus|\
 	h3c,tx1801-plus|\
 	h3c,tx1806|\
+	haier,har-20s2u1|\
 	hiwifi,hc5962|\
 	netgear,wax202|\
+	sim,simax1800t|\
 	xiaomi,mi-router-3-pro|\
 	xiaomi,mi-router-ac2100|\
 	xiaomi,mi-router-cr6606|\
 	xiaomi,mi-router-cr6608|\
 	xiaomi,mi-router-cr6609|\
-	xiaomi,redmi-router-ac2100)
+	xiaomi,redmi-router-ac2100|\
+	zyxel,wsm20)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" "wan"
 		;;
 	asiarf,ap7621-001|\
 	humax,e10|\
+	wavlink,ws-wn572hp3-4g|\
 	winstars,ws-wn583a6)
 		ucidef_set_interfaces_lan_wan "lan" "wan"
 		;;
@@ -62,7 +75,8 @@ ramips_setup_interfaces()
 	xiaomi,mi-router-3g|\
 	xiaomi,mi-router-3g-v2|\
 	xiaomi,mi-router-4|\
-	xiaomi,mi-router-4a-gigabit)
+	xiaomi,mi-router-4a-gigabit|\
+	xiaomi,mi-router-4a-gigabit-v2)
 		ucidef_set_interfaces_lan_wan "lan1 lan2" "wan"
 		;;
 	bolt,arion)
@@ -72,6 +86,11 @@ ramips_setup_interfaces()
 		uci add_list firewall.@zone[1].network='eth_data'
 		uci add_list firewall.@zone[1].network='eth_om'
 		;;
+	cudy,m1800|\
+	yuncore,ax820|\
+	zyxel,nt7101)
+		ucidef_set_interfaces_lan_wan "lan" "wan"
+		;;
 	gnubee,gb-pc1)
 		ucidef_set_interface_lan "ethblack ethblue"
 		;;
@@ -89,13 +108,27 @@ ramips_setup_interfaces()
 	mikrotik,routerboard-760igs)
 		ucidef_set_interfaces_lan_wan "lan2 lan3 lan4 lan5" "wan sfp"
 		;;
+	tozed,zlt-s12-pro)
+		ucidef_set_interface_lan "lan1 lan2 lan3 wan"
+		ucidef_set_interface "wwan" device "/dev/ttyUSB0" protocol "ncm"
+		uci add_list firewall.@zone[1].network='wwan'
+		;;
+	tplink,deco-m4r-v4)
+		ucidef_set_interfaces_lan_wan "eth1" "eth0"
+		;;
 	tplink,eap235-wall-v1|\
 	tplink,eap615-wall-v1)
 		ucidef_set_interface_lan "lan0 lan1 lan2 lan3"
 		;;
+	tplink,er605-v2)
+		ucidef_set_interfaces_lan_wan "eth1 eth2 eth3 eth4" "eth0"
+		;;
 	tplink,tl-wpa8631p-v3)
 		ucidef_set_interface_lan "lan1 lan2 lan3 plc0"
 		;;
+	tplink,mr600-v2-eu)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" "wan"
+		;;
 	ubnt,edgerouter-x)
 		ucidef_set_interfaces_lan_wan "eth1 eth2 eth3 eth4" "eth0"
 		;;
@@ -105,10 +138,6 @@ ramips_setup_interfaces()
 	ubnt,usw-flex)
 		ucidef_set_interface_lan "lan1 lan2 lan3 lan4 lan5"
 		;;
-	yuncore,ax820|\
-	zyxel,nr7101)
-		ucidef_set_interfaces_lan_wan "lan" "wan"
-		;;
 	zyxel,wap6805)
 		ucidef_set_interface_lan "lan1 lan2 lan3 lan4"
 		ucidef_set_interface "qtn" ifname "eth1" protocol "static" ipaddr "1.1.1.1" netmask "255.255.255.0"
@@ -136,6 +165,11 @@ ramips_setup_macs()
 		wan_mac=$(mtd_get_mac_ascii hwconfig HW.WAN.MAC.Address)
 		label_mac=$lan_mac
 		;;
+	arcadyan,we420223-99)
+		label_mac=$(mtd_get_mac_ascii board_data mac)
+		lan_mac=$label_mac
+		ucidef_set_network_device_mac eth0 $(macaddr_add "$label_mac" 3)
+	;;
 	asus,rt-ac65p|\
 	asus,rt-ac85p)
 		wan_mac=$(mtd_get_mac_ascii u-boot-env et1macaddr)
@@ -147,9 +181,9 @@ ramips_setup_macs()
 		lan_mac=$label_mac
 		;;
 	buffalo,wsr-1166dhp)
-		local index="$(find_mtd_index "board_data")"
-		wan_mac="$(grep -m1 mac= "/dev/mtd${index}" | cut -d= -f2)"
+		wan_mac=$(mtd_get_mac_ascii board_data "mac")
 		lan_mac=$wan_mac
+		label_mac=$wan_mac
 		;;
 	dlink,dir-860l-b1)
 		lan_mac=$(mtd_get_mac_ascii factory lanmac)
@@ -160,6 +194,7 @@ ramips_setup_macs()
 		lan_mac=$(mtd_get_mac_ascii u-boot-env ethaddr)
 		wan_mac=$(mtd_get_mac_ascii u-boot-env wanaddr)
 		;;
+	elecom,wrc-2533ghbk2-t|\
 	elecom,wrc-2533ghbk-i)
 		lan_mac=$(mtd_get_mac_ascii u-boot-env ethaddr)
 		wan_mac=$(mtd_get_mac_ascii u-boot-env wanaddr)
@@ -212,6 +247,21 @@ ramips_setup_macs()
 		wan_mac=$(mtd_get_mac_ascii Config wan_hwaddr)
 		label_mac=$lan_mac
 		;;
+	mikrotik,ltap-2hnd)
+		label_mac=$(cat "/sys/firmware/mikrotik/hard_config/mac_base")
+		lan_mac=$label_mac
+		;;
+	tplink,er605-v2)
+		CI_UBIPART="firmware"
+		label_mac=$(mtd_get_mac_uci_config_ubi "tddp")
+		lan_mac=$label_mac
+		wan_mac=$(macaddr_add "$label_mac" 1)
+		;;
+	tplink,mr600-v2-eu)
+		label_mac=$(cat "/sys/class/net/eth0/address")
+		wwan_mac=$(macaddr_add $label_mac 1)
+		ucidef_set_interface "wwan0" device "/dev/cdc-wdm0" protocol "qmi" macaddr "$wwan_mac"
+		;;
 	mikrotik,routerboard-750gr3|\
 	mikrotik,routerboard-760igs|\
 	mikrotik,routerboard-m11g|\
@@ -230,11 +280,6 @@ ramips_setup_macs()
 		wan_mac=$(macaddr_add "$lan_mac" 1)
 		label_mac=$lan_mac
 		;;
-	raisecom,msg1500-x-00)
-		lan_mac=$(mtd_get_mac_ascii Config protest_lan_mac)
-		wan_mac=$(mtd_get_mac_ascii Config protest_wan_mac)
-		label_mac=$lan_mac
-		;;
 	yuncore,ax820)
 		label_mac=$(mtd_get_mac_binary Factory 0x4)
 		;;
diff --git a/target/linux/ramips/mt7621/base-files/etc/board.d/03_gpio_switches b/target/linux/ramips/mt7621/base-files/etc/board.d/03_gpio_switches
index 4bf2aa37e0d169..aebb4163716310 100644
--- a/target/linux/ramips/mt7621/base-files/etc/board.d/03_gpio_switches
+++ b/target/linux/ramips/mt7621/base-files/etc/board.d/03_gpio_switches
@@ -12,6 +12,13 @@ mikrotik,routerboard-760igs)
 telco-electronics,x1)
 	ucidef_add_gpio_switch "modem_reset" "Modem Reset" "496"
 	;;
+tozed,zlt-s12-pro)
+	ucidef_add_gpio_switch "lt72_power" "Power LTE modem" "lt72_power" "1"
+	;;
+tplink,eap235-wall-v1|\
+tplink,eap615-wall-v1)
+	ucidef_add_gpio_switch "poe_passthrough" "PoE Passthrough" "poe-passthrough"
+	;;
 ubnt,edgerouter-x)
 	ucidef_add_gpio_switch "poe_passthrough" "PoE Passthrough" "480"
 	;;
diff --git a/target/linux/ramips/mt7621/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom b/target/linux/ramips/mt7621/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
new file mode 100644
index 00000000000000..0bf5e85cd0134d
--- /dev/null
+++ b/target/linux/ramips/mt7621/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
@@ -0,0 +1,33 @@
+#!/bin/sh
+
+[ -e /lib/firmware/$FIRMWARE ] && exit 0
+
+. /lib/functions/caldata.sh
+
+caldata_mikrotik_ath9k() {
+	local offset=$(($1))
+	local count=$(($2))
+	local macaddr=$3
+	local wlan_data="/sys/firmware/mikrotik/hard_config/wlan_data"
+
+	caldata_from_file $wlan_data $offset $count /tmp/$FIRMWARE
+	ath9k_patch_mac "$macaddr" /tmp/$FIRMWARE
+	caldata_sysfsload_from_file /tmp/$FIRMWARE 0x0 $count
+	rm -f /tmp/$FIRMWARE
+}
+
+board=$(board_name)
+
+case "$FIRMWARE" in
+"ath9k-eeprom-pci-0000:01:00.0.bin")
+	case $board in
+	mikrotik,ltap-2hnd)
+		mac_base="$(cat /sys/firmware/mikrotik/hard_config/mac_base)"
+		caldata_mikrotik_ath9k 0x5000 0x440 $(macaddr_add "$mac_base" 1)
+		;;
+	*)
+		caldata_die "board $board is not supported yet"
+		;;
+	esac
+	;;
+esac
diff --git a/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/05-wifi-migrate b/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/05-wifi-migrate
new file mode 100644
index 00000000000000..6504dc81a58c53
--- /dev/null
+++ b/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/05-wifi-migrate
@@ -0,0 +1,75 @@
+#!/bin/sh
+
+# This must run before 10-wifi-detect
+
+
+[ "${ACTION}" = "add" ] || return
+
+
+. /lib/functions.sh
+
+
+check_radio()
+{
+	local cfg="$1" to="$2"
+
+	config_get path "$cfg" path
+
+	[ "$path" = "$to" ] && PATH_EXISTS=true
+}
+
+do_migrate_radio()
+{
+	local cfg="$1" from="$2" to="$3"
+
+	config_get path "$cfg" path
+
+	[ "$path" = "$from" ] || return
+
+	uci set "wireless.${cfg}.path=${to}"
+	WIRELESS_CHANGED=true
+
+	logger -t wifi-migrate "Updated path of wireless.${cfg} from '${from}' to '${to}'"
+}
+
+migrate_radio()
+{
+	local from="$1" to="$2"
+
+	config_load wireless
+
+	# Check if there is already a section with the target path: In this case, the system
+	# was already upgraded to a version without this migration script before; better bail out,
+	# as we can't be sure we don't break more than we fix.
+	PATH_EXISTS=false
+	config_foreach check_radio wifi-device "$to"
+	$PATH_EXISTS && return
+
+	config_foreach do_migrate_radio wifi-device "$from" "$to"
+}
+
+
+WIRELESS_CHANGED=false
+
+case "$(board_name)" in
+arcadyan,we420223-99|\
+beeline,smartbox-flash|\
+mts,wg430223)
+	migrate_radio '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0' '1e140000.pcie/pci0000:00/0000:00:01.0/0000:01:00.0'
+	migrate_radio '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0+1' '1e140000.pcie/pci0000:00/0000:00:01.0/0000:01:00.0+1'
+	;;
+netgear,r6220|\
+netgear,wac104|\
+netgear,wndr3700-v5)
+	migrate_radio '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0' '1e140000.pcie/pci0000:00/0000:00:02.0/0000:02:00.0'
+	;;
+zbtlink,zbt-we1326)
+	migrate_radio '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0' '1e140000.pcie/pci0000:00/0000:00:02.0/0000:02:00.0'
+	migrate_radio '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0' '1e140000.pcie/pci0000:00/0000:00:01.0/0000:01:00.0'
+	;;
+
+esac
+
+$WIRELESS_CHANGED && uci commit wireless
+
+exit 0
diff --git a/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac b/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
index 3c2872ae2cbdde..80c72735430017 100644
--- a/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
+++ b/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
@@ -10,6 +10,15 @@ PHYNBR=${DEVPATH##*/phy}
 board=$(board_name)
 
 case "$board" in
+	arcadyan,we420223-99)
+		if [ "$PHYNBR" = "0" ]; then
+			mac24=$(macaddr_add "$(get_mac_label)" "0xf00001")
+			echo -n "$mac24" > /sys${DEVPATH}/macaddress
+		elif [ "$PHYNBR" = "1" ]; then
+			mac5=$(macaddr_add "$(get_mac_label)" 1)
+			echo -n "$mac5" > /sys${DEVPATH}/macaddress
+		fi
+		;;
 	beeline,smartbox-flash)
 		hw_mac_addr=$(macaddr_add $(mtd_get_mac_encrypted_arcadyan "board_data") 1)
 		[ "$PHYNBR" = "0" ] && echo -n "$hw_mac_addr" > /sys${DEVPATH}/macaddress
@@ -18,9 +27,26 @@ case "$board" in
 		hw_mac_addr=$(macaddr_unsetbit $hw_mac_addr 28)
 		[ "$PHYNBR" = "1" ] && macaddr_setbit_la $hw_mac_addr > /sys${DEVPATH}/macaddress
 		;;
-	cudy,x6)
+	cudy,x6-v1|\
+	cudy,x6-v2)
+		hw_mac_addr="$(mtd_get_mac_binary bdinfo 0xde00)"
+		[ "$PHYNBR" = "1" ] && \
+		macaddr_setbit_la "$(macaddr_add $hw_mac_addr 0x100000)" > /sys${DEVPATH}/macaddress
+		;;
+	dlink,dap-1620-b1|\
+	dlink,dir-853-a1)
+		lan_mac_addr="$(mtd_get_mac_binary factory 0xe000)"
+		[ "$PHYNBR" = "0" ] && \
+			macaddr_add $lan_mac_addr 1 > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && \
+			macaddr_add $lan_mac_addr 2 > /sys${DEVPATH}/macaddress
+		;;
+	dlink,dap-x1860-a1)
 		hw_mac_addr="$(mtd_get_mac_binary factory 0x4)"
-		macaddr_add $hw_mac_addr "$PHYNBR" > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "0" ] && \
+			macaddr_add $hw_mac_addr 1 > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && \
+			macaddr_add $hw_mac_addr 4 > /sys${DEVPATH}/macaddress
 		;;
 	dlink,dir-853-a3)
 		[ "$PHYNBR" = "0" ] && \
@@ -45,6 +71,12 @@ case "$board" in
 		[ "$PHYNBR" = "0" ] && echo -n ${addr:0:9}'1'${addr:10:7} > /sys${DEVPATH}/macaddress
 		[ "$PHYNBR" = "1" ] && echo -n ${addr:0:9}'7'${addr:10:7} > /sys${DEVPATH}/macaddress
 		;;
+	haier,har-20s2u1|\
+	jcg,y2|\
+	sim,simax1800t)
+		[ "$PHYNBR" = "1" ] && \
+			macaddr_setbit_la "$(mtd_get_mac_binary factory 0x4)" > /sys${DEVPATH}/macaddress
+		;;
 	hiwifi,hc5962)
 		label_mac=$(mtd_get_mac_ascii bdinfo "Vfac_mac ")
 		[ "$PHYNBR" = "0" ] && [ -n "$label_mac" ] && \
@@ -69,10 +101,6 @@ case "$board" in
 		[ "$PHYNBR" = "1" ] && \
 			macaddr_setbit_la "$(mtd_get_mac_binary Factory 0x4)" > /sys${DEVPATH}/macaddress
 		;;
-	jcg,y2)
-		[ "$PHYNBR" = "1" ] && \
-			macaddr_setbit_la "$(mtd_get_mac_binary factory 0x4)" > /sys${DEVPATH}/macaddress
-		;;
 	linksys,e5600|\
 	linksys,ea6350-v4|\
 	linksys,ea7300-v1|\
@@ -95,6 +123,11 @@ case "$board" in
 		[ "$PHYNBR" = "0" ] && macaddr_add $hw_mac_addr 2 > /sys${DEVPATH}/macaddress
 		[ "$PHYNBR" = "1" ] && macaddr_add $hw_mac_addr 3 > /sys${DEVPATH}/macaddress
 		;;
+	mercusys,mr70x-v1|\
+	tplink,archer-ax23-v1)
+		hw_mac_addr="$(mtd_get_mac_binary config 0x8)"
+		[ "$PHYNBR" = "1" ] &&  macaddr_add "$hw_mac_addr" -1 > "/sys${DEVPATH}/macaddress"
+		;;
 	mts,wg430223)
 		hw_mac_addr=$(macaddr_add $(mtd_get_mac_encrypted_arcadyan "board_data") 1)
 		[ "$PHYNBR" = "0" ] && echo -n "$hw_mac_addr" > /sys${DEVPATH}/macaddress
@@ -111,13 +144,20 @@ case "$board" in
 		;;
 	raisecom,msg1500-x-00)
 		[ "$PHYNBR" = "0" ] && \
-			macaddr_setbit_la "$(mtd_get_mac_ascii Config protest_lan_mac)" \
-				> /sys${DEVPATH}/macaddress
+			macaddr_setbit_la "$(get_mac_label)" > /sys${DEVPATH}/macaddress
+		;;
+	snr,snr-cpe-me2-sfp)
+		hw_mac_addr="$(mtd_get_mac_binary factory 0x8004)"
+		[ "$PHYNBR" = "1" ] &&  echo -n "$hw_mac_addr" > /sys${DEVPATH}/macaddress
 		;;
 	tenbay,t-mb5eu-v01)
 		hw_mac_addr="$(mtd_get_mac_binary factory 0x4)"
 		[ "$PHYNBR" = "1" ] &&  macaddr_add $hw_mac_addr "0x100000" > /sys${DEVPATH}/macaddress
 		;;
+	totolink,x5000r)
+		hw_mac_addr="$(mtd_get_mac_binary factory 0x4)"
+		[ "$PHYNBR" = "1" ] &&  macaddr_add $hw_mac_addr 4 > /sys${DEVPATH}/macaddress
+		;;
 	tplink,eap615-wall-v1)
 		hw_mac_addr="$(mtd_get_mac_binary product-info 0x8)"
 		macaddr_add "$hw_mac_addr" "$PHYNBR" > "/sys${DEVPATH}/macaddress"
@@ -126,10 +166,21 @@ case "$board" in
 		[ "$PHYNBR" = "1" ] && \
 			macaddr_setbit_la "$(mtd_get_mac_binary Factory 0xe000)" > /sys${DEVPATH}/macaddress
 		;;
+	yuncore,fap640|\
+	yuncore,fap690)
+		hw_mac_addr="$(mtd_get_mac_binary Factory 0x4)"
+		[ "$PHYNBR" = "0" ] && macaddr_setbit_la "$hw_mac_addr" > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && echo -n "$hw_mac_addr" > /sys${DEVPATH}/macaddress
+		;;
 	zyxel,nwa50ax|\
 	zyxel,nwa55axe)
 		hw_mac_addr="$(mtd_get_mac_binary mrd 0x1fff8)"
 		[ "$PHYNBR" = "0" ] && macaddr_add $hw_mac_addr 1 > /sys${DEVPATH}/macaddress
 		[ "$PHYNBR" = "1" ] && macaddr_add $hw_mac_addr 2 > /sys${DEVPATH}/macaddress
 		;;
+	zyxel,wsm20)
+		hw_mac_addr="$(mtd_get_mac_binary Factory 0x1fdfa)"
+		[ "$PHYNBR" = "0" ] && macaddr_add $hw_mac_addr 1 > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && macaddr_add $hw_mac_addr 2 > /sys${DEVPATH}/macaddress
+		;;
 esac
diff --git a/target/linux/ramips/mt7621/base-files/etc/init.d/bootcount b/target/linux/ramips/mt7621/base-files/etc/init.d/bootcount
index 99b318a922c3aa..9db700bff5560b 100755
--- a/target/linux/ramips/mt7621/base-files/etc/init.d/bootcount
+++ b/target/linux/ramips/mt7621/base-files/etc/init.d/bootcount
@@ -8,7 +8,9 @@ boot() {
 		[ -n "$(fw_printenv bootcount bootchanged 2>/dev/null)" ] &&\
 			echo -e "bootcount\nbootchanged\n" | /usr/sbin/fw_setenv -s -
 		;;
-	beeline,smartbox-turbo)
+	beeline,smartbox-turbo|\
+	beeline,smartbox-turbo-plus|\
+	rostelecom,rt-sf-1)
 		[[ $(hexdump -n 1 -e '/1 "%1d"' -s $((0x20001)) /dev/mtd3) == \
 			$((0xff)) ]] || printf '\xff' | dd of=/dev/mtdblock3 \
 			count=1 bs=1 seek=$((0x20001))
diff --git a/target/linux/ramips/mt7621/base-files/etc/rc.button/lights_toggle b/target/linux/ramips/mt7621/base-files/etc/rc.button/lights_toggle
new file mode 100644
index 00000000000000..c008b633a4e077
--- /dev/null
+++ b/target/linux/ramips/mt7621/base-files/etc/rc.button/lights_toggle
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+[[ "${ACTION}" = "released" ]] || exit 0
+
+. /lib/functions.sh
+
+case "$(board_name)" in
+tplink,ec330-g5u-v1)
+	led_light="/sys/class/gpio/led-light/value"
+	echo "$((!$(cat $led_light)))" > "$led_light"
+;;
+	*)
+;;
+esac
+
+return 0
diff --git a/target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh b/target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh
index 05907536fe4798..cef58ec3bad2b4 100755
--- a/target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh
@@ -33,6 +33,7 @@ platform_do_upgrade() {
 			fw_setenv --lock / bootImage 0 || exit 1
 		fi
 		;;
+	mikrotik,ltap-2hnd|\
 	mikrotik,routerboard-750gr3|\
 	mikrotik,routerboard-760igs|\
 	mikrotik,routerboard-m11g|\
@@ -51,20 +52,27 @@ platform_do_upgrade() {
 	case "$board" in
 	ampedwireless,ally-00x19k|\
 	ampedwireless,ally-r1900k|\
+	arcadyan,we420223-99|\
 	asus,rt-ac65p|\
 	asus,rt-ac85p|\
 	asus,rt-ax53u|\
+	asus,rt-ax54|\
 	beeline,smartbox-flash|\
 	beeline,smartbox-giga|\
 	beeline,smartbox-turbo|\
+	beeline,smartbox-turbo-plus|\
 	belkin,rt1800|\
+	dlink,dap-x1860-a1|\
 	dlink,dir-1960-a1|\
 	dlink,dir-2640-a1|\
 	dlink,dir-2660-a1|\
+	dlink,dir-3060-a1|\
 	dlink,dir-853-a3|\
+	etisalat,s3|\
 	h3c,tx1800-plus|\
 	h3c,tx1801-plus|\
 	h3c,tx1806|\
+	haier,har-20s2u1|\
 	hiwifi,hc5962|\
 	iptime,a3004t|\
 	iptime,ax2004m|\
@@ -93,8 +101,11 @@ platform_do_upgrade() {
 	netgear,wax202|\
 	netis,wf2881|\
 	raisecom,msg1500-x-00|\
+	rostelecom,rt-sf-1|\
 	sercomm,na502|\
 	sercomm,na502s|\
+	sim,simax1800t|\
+	tplink,ec330-g5u-v1|\
 	xiaomi,mi-router-3g|\
 	xiaomi,mi-router-3-pro|\
 	xiaomi,mi-router-4|\
@@ -118,6 +129,12 @@ platform_do_upgrade() {
 		iodata_mstc_upgrade_prepare "0x1fe75"
 		nand_do_upgrade "$1"
 		;;
+	tplink,er605-v2)
+		echo "Upgrading tplink,er605-v2"
+		CI_UBIPART="firmware"
+		CI_KERNPART="kernel"
+		nand_do_upgrade "$1"
+		;;
 	ubnt,edgerouter-x|\
 	ubnt,edgerouter-x-sfp)
 		platform_upgrade_ubnt_erx "$1"
@@ -139,6 +156,10 @@ platform_do_upgrade() {
 		CI_KERNPART="Kernel"
 		nand_do_upgrade "$1"
 		;;
+	zyxel,wsm20)
+		zyxel_mstc_upgrade_prepare
+		nand_do_upgrade "$1"
+		;;
 	*)
 		default_do_upgrade "$1"
 		;;
diff --git a/target/linux/ramips/mt7621/base-files/lib/upgrade/zyxel.sh b/target/linux/ramips/mt7621/base-files/lib/upgrade/zyxel.sh
new file mode 100644
index 00000000000000..59c8d237dda424
--- /dev/null
+++ b/target/linux/ramips/mt7621/base-files/lib/upgrade/zyxel.sh
@@ -0,0 +1,39 @@
+#
+# Copyright (C) 2023 OpenWrt.org
+#
+
+. /lib/functions.sh
+
+zyxel_mstc_prepare_fail() {
+	echo "failed to check and prepare the environment, rebooting..."
+	umount -a
+	reboot -f
+}
+
+zyxel_mstc_upgrade_prepare() {
+	local persist_mtd="$(find_mtd_part persist)"
+	local firmware_mtd="$(find_mtd_part firmware)"
+
+	if [ -z "$persist_mtd" ] || [ -z "$firmware_mtd" ]; then
+		echo 'cannot find mtd partition(s) "persist" or "firmware"'
+		zyxel_mstc_prepare_fail
+	fi
+
+	local bootnum=$(hexdump -s 4 -n 1 -e '"%x"' ${persist_mtd})
+
+	if [ "$bootnum" != "1" ] && [ "$bootnum" != "2" ]; then
+		echo "failed to get bootnum, please check the value at 0x4 in ${persist_mtd}"
+		zyxel_mstc_prepare_fail
+	fi
+	echo "current: bootnum => ${bootnum}"
+
+	[ "$(fw_printenv -n bootmenu_delay)" = "3" ] || fw_setenv bootmenu_delay 3
+
+	if [ "$bootnum" = "2" ]; then
+		if ! ( echo -ne "\x01" | dd of=${persist_mtd} count=1 bs=1 seek=4 conv=notrunc 2>/dev/null ); then
+			echo "failed to set new boot partition"
+			zyxel_mstc_prepare_fail
+		fi
+		echo "### switch to 1st os-image on next boot ###"
+	fi
+}
diff --git a/target/linux/ramips/mt7621/config-5.15 b/target/linux/ramips/mt7621/config-5.15
index 53127a57607157..1b4330c2d16648 100644
--- a/target/linux/ramips/mt7621/config-5.15
+++ b/target/linux/ramips/mt7621/config-5.15
@@ -11,7 +11,6 @@ CONFIG_BOARD_SCACHE=y
 CONFIG_BOUNCE=y
 CONFIG_CEVT_R4K=y
 CONFIG_CLKSRC_MIPS_GIC=y
-# CONFIG_CLKSRC_PISTACHIO is not set
 CONFIG_CLK_MT7621=y
 CONFIG_CLOCKSOURCE_WATCHDOG=y
 CONFIG_CLONE_BACKWARDS=y
@@ -19,7 +18,6 @@ CONFIG_CMDLINE="rootfstype=squashfs,jffs2"
 CONFIG_CMDLINE_BOOL=y
 # CONFIG_CMDLINE_OVERRIDE is not set
 CONFIG_COMMON_CLK=y
-# CONFIG_COMMON_CLK_PISTACHIO is not set
 CONFIG_COMPAT_32BIT_TIME=y
 CONFIG_CPU_GENERIC_DUMP_TLB=y
 CONFIG_CPU_HAS_DIEI=y
@@ -28,6 +26,7 @@ CONFIG_CPU_HAS_RIXI=y
 CONFIG_CPU_HAS_SYNC=y
 CONFIG_CPU_IDLE=y
 CONFIG_CPU_IDLE_GOV_TEO=y
+CONFIG_CPU_LITTLE_ENDIAN=y
 CONFIG_CPU_MIPS32=y
 # CONFIG_CPU_MIPS32_R1 is not set
 CONFIG_CPU_MIPS32_R2=y
@@ -42,7 +41,6 @@ CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
 CONFIG_CPU_SUPPORTS_HIGHMEM=y
 CONFIG_CPU_SUPPORTS_MSA=y
 CONFIG_CRC16=y
-CONFIG_CRYPTO_BLAKE2S=y
 CONFIG_CRYPTO_DEFLATE=y
 CONFIG_CRYPTO_HASH_INFO=y
 CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
@@ -106,7 +104,6 @@ CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_GPIO=y
 CONFIG_I2C_MT7621=y
 CONFIG_ICPLUS_PHY=y
-# CONFIG_INGENIC_CGU_JZ4760 is not set
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_IRQCHIP=y
 CONFIG_IRQ_DOMAIN=y
@@ -116,13 +113,10 @@ CONFIG_IRQ_MIPS_CPU=y
 CONFIG_IRQ_WORK=y
 CONFIG_KMAP_LOCAL=y
 CONFIG_LED_TRIGGER_PHY=y
-CONFIG_LEDS_UBNT_LEDBAR=y
 CONFIG_LIBFDT=y
 CONFIG_LOCK_DEBUGGING_SUPPORT=y
 CONFIG_LZO_COMPRESS=y
 CONFIG_LZO_DECOMPRESS=y
-# CONFIG_MACH_NINTENDO64 is not set
-# CONFIG_MACH_REALTEK_RTL is not set
 CONFIG_MDIO_BUS=y
 CONFIG_MDIO_DEVICE=y
 CONFIG_MDIO_DEVRES=y
@@ -167,6 +161,7 @@ CONFIG_MTD_NAND_ECC=y
 CONFIG_MTD_NAND_ECC_SW_HAMMING=y
 CONFIG_MTD_NAND_MT7621=y
 CONFIG_MTD_NAND_MTK_BMT=y
+# CONFIG_MTD_PARSER_TPLINK_SAFELOADER is not set
 CONFIG_MTD_PHYSMAP=y
 CONFIG_MTD_RAW_NAND=y
 CONFIG_MTD_ROUTERBOOT_PARTS=y
@@ -189,6 +184,8 @@ CONFIG_NEED_DMA_MAP_STATE=y
 CONFIG_NET_DEVLINK=y
 CONFIG_NET_DSA=y
 CONFIG_NET_DSA_MT7530=y
+CONFIG_NET_DSA_MT7530_MDIO=y
+# CONFIG_NET_DSA_MT7530_MMIO is not set
 CONFIG_NET_DSA_TAG_MTK=y
 CONFIG_NET_FLOW_LIMIT=y
 CONFIG_NET_MEDIATEK_SOC=y
@@ -219,16 +216,12 @@ CONFIG_PERF_USE_VMALLOC=y
 CONFIG_PGTABLE_LEVELS=2
 CONFIG_PHYLIB=y
 CONFIG_PHYLINK=y
-# CONFIG_PHY_INGENIC_USB is not set
 CONFIG_PHY_MT7621_PCI=y
-# CONFIG_PHY_PISTACHIO_USB is not set
 # CONFIG_PHY_RALINK_USB is not set
 CONFIG_PINCTRL=y
 CONFIG_PINCTRL_AW9523=y
 CONFIG_PINCTRL_MT7621=y
-# CONFIG_PINCTRL_PISTACHIO is not set
 CONFIG_PINCTRL_RALINK=y
-CONFIG_PINCTRL_RT2880=y
 # CONFIG_PINCTRL_SINGLE is not set
 CONFIG_PINCTRL_SX150X=y
 CONFIG_POWER_RESET=y
diff --git a/target/linux/ramips/mt7621/target.mk b/target/linux/ramips/mt7621/target.mk
index d1f987b2e03da2..153ff08421d690 100644
--- a/target/linux/ramips/mt7621/target.mk
+++ b/target/linux/ramips/mt7621/target.mk
@@ -10,7 +10,7 @@ KERNELNAME:=vmlinux vmlinuz
 # make Kernel/CopyImage use $LINUX_DIR/vmlinuz
 IMAGES_DIR:=../../..
 
-DEFAULT_PACKAGES += wpad-basic-wolfssl
+DEFAULT_PACKAGES += wpad-basic-mbedtls uboot-envtools
 
 define Target/Description
 	Build firmware images for Ralink MT7621 based boards.
diff --git a/target/linux/ramips/mt76x8/base-files/etc/board.d/01_leds b/target/linux/ramips/mt76x8/base-files/etc/board.d/01_leds
index 0af01d4393272b..792bd13ebc1ae6 100644
--- a/target/linux/ramips/mt76x8/base-files/etc/board.d/01_leds
+++ b/target/linux/ramips/mt76x8/base-files/etc/board.d/01_leds
@@ -46,13 +46,22 @@ skylab,skw92a)
 hilink,hlk-7688a)
 	ucidef_set_led_wlan "wlan" "WLAN" "green:wlan" "phy0tpt"
 	;;
+hiwifi,hc5611)
+	ucidef_set_led_netdev "internet" "internet" "red:internet" "br-lan" "tx rx"
+	;;
 hiwifi,hc5661a|\
 hiwifi,hc5761a)
 	ucidef_set_led_switch "internet" "internet" "blue:internet" "switch0" "0x10"
 	;;
+keenetic,kn-1613)
+	ucidef_set_led_switch "internet" "internet" "green:internet" "switch0" "0x01"
+	;;
 mediatek,linkit-smart-7688)
 	ucidef_set_led_wlan "wifi" "wifi" "orange:wifi" "phy0tpt"
 	;;
+oraybox,x1)
+	ucidef_set_led_netdev "wifi" "wifi" "blue:status" "wlan0"
+	;;
 rakwireless,rak633)
 	ucidef_set_led_netdev "wifi_led" "wifi" "blue:wifi" "wlan0"
 	;;
@@ -144,6 +153,13 @@ wavlink,wl-wn578a2)
 	ucidef_set_led_switch "lan" "lan" "green:lan" "switch0" "0x8"
 	ucidef_set_led_switch "wan" "wan" "green:wan" "switch0" "0x10"
 	;;
+xiaomi,mi-router-4a-100m|\
+xiaomi,mi-router-4a-100m-intl)
+	ucidef_set_led_switch "wan" "WAN" "blue:wan" "switch0" "0x01"
+	;;
+xiaomi,mi-router-4c)
+	ucidef_set_led_switch "wan" "WAN" "blue:wan" "switch0" "0x02"
+	;;
 zbtlink,zbt-we1226)
 	ucidef_set_led_netdev "wifi_led" "wifi" "green:wlan" "wlan0"
 	ucidef_set_led_switch "lan1" "LAN1" "green:lan1" "switch0" "0x01"
diff --git a/target/linux/ramips/mt76x8/base-files/etc/board.d/02_network b/target/linux/ramips/mt76x8/base-files/etc/board.d/02_network
index 963a20c653a3f8..6bcdea971b2f8d 100644
--- a/target/linux/ramips/mt76x8/base-files/etc/board.d/02_network
+++ b/target/linux/ramips/mt76x8/base-files/etc/board.d/02_network
@@ -14,6 +14,7 @@ ramips_setup_interfaces()
 	glinet,microuter-n300|\
 	glinet,vixmini|\
 	hak5,wifi-pineapple-mk7|\
+	hiwifi,hc5611|\
 	mediatek,linkit-smart-7688|\
 	minew,g1-c|\
 	onion,omega2p|\
@@ -117,10 +118,22 @@ ramips_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"0:lan" "1:lan" "2:lan" "6@eth0"
 		;;
+	keenetic,kn-1613|\
 	motorola,mwr03)
 		ucidef_add_switch "switch0" \
 			"1:lan" "2:lan" "3:lan" "0:wan" "6@eth0"
 		;;
+	kroks,kndrt31r19)
+		ucidef_add_switch "switch0" \
+			"0:lan" "6@eth0"
+		ucidef_add_switch_attr "switch0" "enable" "false"
+		ucidef_set_interface_lan "eth0"
+		ucidef_set_interface "wan" device "/dev/cdc-wdm0" protocol "qmi"
+		;;
+	linksys,e5400)
+		ucidef_add_switch "switch0" \
+			"0:lan:1" "1:lan:2" "2:lan:3" "3:lan:4" "4:wan" "6@eth0"
+		;;
 	netgear,r6020|\
 	netgear,r6080|\
 	netgear,r6120|\
@@ -128,11 +141,14 @@ ramips_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"0:lan:4" "1:lan:3" "2:lan:2" "3:lan:1" "4:wan" "6@eth0"
 		;;
+	oraybox,x1)
+		ucidef_add_switch "switch0" \
+			"3:lan" "6@eth0"
+		;;
 	rakwireless,rak633)
 		ucidef_add_switch "switch0" \
 			"0:wan" "1:lan" "2:lan" "3:lan" "4:lan" "6t@eth0"
 		;;
-	kroks,kndrt31r19|\
 	tplink,tl-mr3020-v3)
 		ucidef_add_switch "switch0" \
 			"0:lan" "6@eth0"
@@ -216,10 +232,10 @@ ramips_setup_macs()
 	netgear,r6080|\
 	netgear,r6120|\
 	wrtnode,wrtnode2p|\
-	wrtnode,wrtnode2r|\
-	zyxel,keenetic-extra-ii)
+	wrtnode,wrtnode2r)
 		wan_mac=$(macaddr_add "$(mtd_get_mac_binary factory 0x4)" 1)
 		;;
+	hiwifi,hc5611|\
 	hiwifi,hc5661a|\
 	hiwifi,hc5761a|\
 	hiwifi,hc5861b)
@@ -240,6 +256,13 @@ ramips_setup_macs()
 	totolink,lr1200)
 		wan_mac=$(mtd_get_mac_binary factory 0x2e)
 		;;
+	keenetic,kn-1613|\
+	zyxel,keenetic-extra-ii)
+		wan_mac=$(mtd_get_mac_binary rf-eeprom 0x28)
+		;;
+	linksys,e5400)
+		wan_mac=$(mtd_get_mac_binary factory 0x22)
+		;;
 	mercury,mac1200r-v2)
 		wan_mac=$(macaddr_add "$(mtd_get_mac_binary factory_info 0xd)" 1)
 		;;
diff --git a/target/linux/ramips/mt76x8/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac b/target/linux/ramips/mt76x8/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
index b8f8faee9ca284..c9e205a0fc143b 100644
--- a/target/linux/ramips/mt76x8/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
+++ b/target/linux/ramips/mt76x8/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
@@ -10,6 +10,7 @@ PHYNBR=${DEVPATH##*/phy}
 board=$(board_name)
 
 case "$board" in
+	hiwifi,hc5611|\
 	hiwifi,hc5661a|\
 	hiwifi,hc5761a|\
 	hiwifi,hc5861b)
diff --git a/target/linux/ramips/mt76x8/config-5.15 b/target/linux/ramips/mt76x8/config-5.15
index b16a9a5cded93e..7248aa66332274 100644
--- a/target/linux/ramips/mt76x8/config-5.15
+++ b/target/linux/ramips/mt76x8/config-5.15
@@ -21,6 +21,7 @@ CONFIG_CPU_HAS_DIEI=y
 CONFIG_CPU_HAS_PREFETCH=y
 CONFIG_CPU_HAS_RIXI=y
 CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_LITTLE_ENDIAN=y
 CONFIG_CPU_MIPS32=y
 # CONFIG_CPU_MIPS32_R1 is not set
 CONFIG_CPU_MIPS32_R2=y
@@ -111,11 +112,14 @@ CONFIG_MODULES_USE_ELF_REL=y
 CONFIG_MT7621_WDT=y
 # CONFIG_MTD_CFI_INTELEXT is not set
 CONFIG_MTD_CMDLINE_PARTS=y
+# CONFIG_MTD_PARSER_TPLINK_SAFELOADER is not set
 CONFIG_MTD_PARSER_TRX=y
 CONFIG_MTD_PHYSMAP=y
 CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPI_NOR_USE_VARIABLE_ERASE=y
 CONFIG_MTD_SPLIT_TPLINK_FW=y
 CONFIG_MTD_SPLIT_UIMAGE_FW=y
+CONFIG_MTD_VIRT_CONCAT=y
 CONFIG_NEED_DMA_MAP_STATE=y
 CONFIG_NEED_PER_CPU_KM=y
 CONFIG_NET_RALINK_ESW_RT3050=y
@@ -144,6 +148,7 @@ CONFIG_PHYLIB=y
 # CONFIG_PHY_MT7621_PCI is not set
 CONFIG_PHY_RALINK_USB=y
 CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_AW9523 is not set
 CONFIG_PINCTRL_MT7620=y
 CONFIG_PINCTRL_RALINK=y
 # CONFIG_PINCTRL_SINGLE is not set
diff --git a/target/linux/ramips/mt76x8/target.mk b/target/linux/ramips/mt76x8/target.mk
index f939e4ca4c67f6..862736cb2f38c8 100644
--- a/target/linux/ramips/mt76x8/target.mk
+++ b/target/linux/ramips/mt76x8/target.mk
@@ -7,7 +7,7 @@ BOARDNAME:=MT76x8 based boards
 FEATURES+=usb ramdisk
 CPU_TYPE:=24kc
 
-DEFAULT_PACKAGES += kmod-mt7603 wpad-basic-wolfssl swconfig
+DEFAULT_PACKAGES += kmod-mt7603 wpad-basic-mbedtls swconfig
 
 define Target/Description
 	Build firmware images for Ralink MT76x8 based boards.
diff --git a/target/linux/ramips/patches-5.15/100-v5.16-PCI-mt7621-Add-MediaTek-MT7621-PCIe-host-controller-.patch b/target/linux/ramips/patches-5.15/100-v5.16-PCI-mt7621-Add-MediaTek-MT7621-PCIe-host-controller-.patch
new file mode 100644
index 00000000000000..1c8c7cd3d0c4e3
--- /dev/null
+++ b/target/linux/ramips/patches-5.15/100-v5.16-PCI-mt7621-Add-MediaTek-MT7621-PCIe-host-controller-.patch
@@ -0,0 +1,1418 @@
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Date: Wed, 22 Sep 2021 07:00:34 +0200
+Subject: [PATCH] PCI: mt7621: Add MediaTek MT7621 PCIe host controller driver
+
+Add driver for the PCIe controller of the MT7621 SoC.
+
+[bhelgaas: rename from pci-mt7621.c to pcie-mt7621.c; also rename Kconfig
+symbol from PCI_MT7621 to PCIE_MT7621]
+Link: https://lore.kernel.org/r/20210922050035.18162-3-sergio.paracuellos@gmail.com
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ rename drivers/{staging/mt7621-pci/pci-mt7621.c => pci/controller/pcie-mt7621.c} (95%)
+ delete mode 100644 drivers/staging/mt7621-pci/Kconfig
+ delete mode 100644 drivers/staging/mt7621-pci/Makefile
+ delete mode 100644 drivers/staging/mt7621-pci/TODO
+ delete mode 100644 drivers/staging/mt7621-pci/mediatek,mt7621-pci.txt
+
+--- a/arch/mips/ralink/Kconfig
++++ b/arch/mips/ralink/Kconfig
+@@ -51,7 +51,8 @@ choice
+ 		select SYS_SUPPORTS_HIGHMEM
+ 		select MIPS_GIC
+ 		select CLKSRC_MIPS_GIC
+-		select HAVE_PCI if PCI_MT7621
++		select HAVE_PCI
++		select PCI_DRIVERS_GENERIC
+ 		select SOC_BUS
+ endchoice
+ 
+--- a/drivers/pci/controller/Kconfig
++++ b/drivers/pci/controller/Kconfig
+@@ -312,6 +312,14 @@ config PCIE_HISI_ERR
+ 	  Say Y here if you want error handling support
+ 	  for the PCIe controller's errors on HiSilicon HIP SoCs
+ 
++config PCIE_MT7621
++	tristate "MediaTek MT7621 PCIe Controller"
++	depends on (RALINK && SOC_MT7621) || (MIPS && COMPILE_TEST)
++	select PHY_MT7621_PCI
++	default SOC_MT7621
++	help
++	  This selects a driver for the MediaTek MT7621 PCIe Controller.
++
+ source "drivers/pci/controller/dwc/Kconfig"
+ source "drivers/pci/controller/mobiveil/Kconfig"
+ source "drivers/pci/controller/cadence/Kconfig"
+--- a/drivers/pci/controller/Makefile
++++ b/drivers/pci/controller/Makefile
+@@ -37,6 +37,8 @@ obj-$(CONFIG_VMD) += vmd.o
+ obj-$(CONFIG_PCIE_BRCMSTB) += pcie-brcmstb.o
+ obj-$(CONFIG_PCI_LOONGSON) += pci-loongson.o
+ obj-$(CONFIG_PCIE_HISI_ERR) += pcie-hisi-error.o
++obj-$(CONFIG_PCIE_MT7621) += pcie-mt7621.o
++
+ # pcie-hisi.o quirks are needed even without CONFIG_PCIE_DW
+ obj-y				+= dwc/
+ obj-y				+= mobiveil/
+--- a/drivers/staging/Kconfig
++++ b/drivers/staging/Kconfig
+@@ -86,8 +86,6 @@ source "drivers/staging/vc04_services/Kc
+ 
+ source "drivers/staging/pi433/Kconfig"
+ 
+-source "drivers/staging/mt7621-pci/Kconfig"
+-
+ source "drivers/staging/mt7621-dma/Kconfig"
+ 
+ source "drivers/staging/ralink-gdma/Kconfig"
+--- a/drivers/staging/Makefile
++++ b/drivers/staging/Makefile
+@@ -33,7 +33,6 @@ obj-$(CONFIG_KS7010)		+= ks7010/
+ obj-$(CONFIG_GREYBUS)		+= greybus/
+ obj-$(CONFIG_BCM2835_VCHIQ)	+= vc04_services/
+ obj-$(CONFIG_PI433)		+= pi433/
+-obj-$(CONFIG_PCI_MT7621)	+= mt7621-pci/
+ obj-$(CONFIG_SOC_MT7621)	+= mt7621-dma/
+ obj-$(CONFIG_DMA_RALINK)	+= ralink-gdma/
+ obj-$(CONFIG_SOC_MT7621)	+= mt7621-dts/
+--- a/drivers/staging/mt7621-pci/Kconfig
++++ /dev/null
+@@ -1,8 +0,0 @@
+-# SPDX-License-Identifier: GPL-2.0
+-config PCI_MT7621
+-	tristate "MediaTek MT7621 PCI Controller"
+-	depends on RALINK
+-	select PCI_DRIVERS_GENERIC
+-	help
+-	  This selects a driver for the MediaTek MT7621 PCI Controller.
+-
+--- a/drivers/staging/mt7621-pci/Makefile
++++ /dev/null
+@@ -1,2 +0,0 @@
+-# SPDX-License-Identifier: GPL-2.0
+-obj-$(CONFIG_PCI_MT7621)       += pci-mt7621.o
+--- a/drivers/staging/mt7621-pci/TODO
++++ /dev/null
+@@ -1,4 +0,0 @@
+-
+-- general code review and cleanup
+-
+-Cc: NeilBrown <neil@brown.name>
+--- a/drivers/staging/mt7621-pci/mediatek,mt7621-pci.txt
++++ /dev/null
+@@ -1,104 +0,0 @@
+-MediaTek MT7621 PCIe controller
+-
+-Required properties:
+-- compatible: "mediatek,mt7621-pci"
+-- device_type: Must be "pci"
+-- reg: Base addresses and lengths of the PCIe subsys and root ports.
+-- bus-range: Range of bus numbers associated with this controller.
+-- #address-cells: Address representation for root ports (must be 3)
+-- pinctrl-names : The pin control state names.
+-- pinctrl-0: The "default" pinctrl state.
+-- #size-cells: Size representation for root ports (must be 2)
+-- ranges: Ranges for the PCI memory and I/O regions.
+-- #interrupt-cells: Must be 1
+-- interrupt-map-mask and interrupt-map: Standard PCI IRQ mapping properties.
+-  Please refer to the standard PCI bus binding document for a more detailed
+-  explanation.
+-- status: either "disabled" or "okay".
+-- resets: Must contain an entry for each entry in reset-names.
+-  See ../reset/reset.txt for details.
+-- reset-names: Must be "pcie0", "pcie1", "pcieN"... based on the number of
+-  root ports.
+-- clocks: Must contain an entry for each entry in clock-names.
+-  See ../clocks/clock-bindings.txt for details.
+-- clock-names: Must be "pcie0", "pcie1", "pcieN"... based on the number of
+-  root ports.
+-- reset-gpios: GPIO specs for the reset pins.
+-
+-In addition, the device tree node must have sub-nodes describing each PCIe port
+-interface, having the following mandatory properties:
+-
+-Required properties:
+-- reg: Only the first four bytes are used to refer to the correct bus number
+-      and device number.
+-- #address-cells: Must be 3
+-- #size-cells: Must be 2
+-- ranges: Sub-ranges distributed from the PCIe controller node. An empty
+-  property is sufficient.
+-- bus-range: Range of bus numbers associated with this port.
+-
+-Example for MT7621:
+-
+-	pcie: pcie@1e140000 {
+-		compatible = "mediatek,mt7621-pci";
+-        reg = <0x1e140000 0x100    /* host-pci bridge registers */
+-               0x1e142000 0x100    /* pcie port 0 RC control registers */
+-               0x1e143000 0x100    /* pcie port 1 RC control registers */
+-               0x1e144000 0x100>;  /* pcie port 2 RC control registers */
+-
+-		#address-cells = <3>;
+-		#size-cells = <2>;
+-
+-		pinctrl-names = "default";
+-		pinctrl-0 = <&pcie_pins>;
+-
+-		device_type = "pci";
+-
+-		bus-range = <0 255>;
+-		ranges = <
+-			0x02000000 0 0x00000000 0x60000000 0 0x10000000 /* pci memory */
+-			0x01000000 0 0x00000000 0x1e160000 0 0x00010000 /* io space */
+-		>;
+-
+-		#interrupt-cells = <1>;
+-		interrupt-map-mask = <0xF0000 0 0 1>;
+-		interrupt-map = <0x10000 0 0 1 &gic GIC_SHARED 4 IRQ_TYPE_LEVEL_HIGH>,
+-				<0x20000 0 0 1 &gic GIC_SHARED 24 IRQ_TYPE_LEVEL_HIGH>,
+-				<0x30000 0 0 1 &gic GIC_SHARED 25 IRQ_TYPE_LEVEL_HIGH>;
+-
+-		status = "disabled";
+-
+-		resets = <&rstctrl 24 &rstctrl 25 &rstctrl 26>;
+-		reset-names = "pcie0", "pcie1", "pcie2";
+-		clocks = <&clkctrl 24 &clkctrl 25 &clkctrl 26>;
+-		clock-names = "pcie0", "pcie1", "pcie2";
+-
+-		reset-gpios = <&gpio 19 GPIO_ACTIVE_LOW>,
+-				<&gpio 8 GPIO_ACTIVE_LOW>,
+-				<&gpio 7 GPIO_ACTIVE_LOW>;
+-
+-		pcie@0,0 {
+-			reg = <0x0000 0 0 0 0>;
+-			#address-cells = <3>;
+-			#size-cells = <2>;
+-			ranges;
+-			bus-range = <0x00 0xff>;
+-		};
+-
+-		pcie@1,0 {
+-			reg = <0x0800 0 0 0 0>;
+-			#address-cells = <3>;
+-			#size-cells = <2>;
+-			ranges;
+-			bus-range = <0x00 0xff>;
+-		};
+-
+-		pcie@2,0 {
+-			reg = <0x1000 0 0 0 0>;
+-			#address-cells = <3>;
+-			#size-cells = <2>;
+-			ranges;
+-			bus-range = <0x00 0xff>;
+-		};
+-	};
+-
+--- a/drivers/staging/mt7621-pci/pci-mt7621.c
++++ /dev/null
+@@ -1,601 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0+
+-/*
+- * BRIEF MODULE DESCRIPTION
+- *     PCI init for Ralink RT2880 solution
+- *
+- * Copyright 2007 Ralink Inc. (bruce_chang@ralinktech.com.tw)
+- *
+- * May 2007 Bruce Chang
+- * Initial Release
+- *
+- * May 2009 Bruce Chang
+- * support RT2880/RT3883 PCIe
+- *
+- * May 2011 Bruce Chang
+- * support RT6855/MT7620 PCIe
+- */
+-
+-#include <linux/bitops.h>
+-#include <linux/clk.h>
+-#include <linux/delay.h>
+-#include <linux/gpio/consumer.h>
+-#include <linux/module.h>
+-#include <linux/of.h>
+-#include <linux/of_address.h>
+-#include <linux/of_pci.h>
+-#include <linux/of_platform.h>
+-#include <linux/pci.h>
+-#include <linux/phy/phy.h>
+-#include <linux/platform_device.h>
+-#include <linux/reset.h>
+-#include <linux/sys_soc.h>
+-
+-/* MediaTek specific configuration registers */
+-#define PCIE_FTS_NUM			0x70c
+-#define PCIE_FTS_NUM_MASK		GENMASK(15, 8)
+-#define PCIE_FTS_NUM_L0(x)		(((x) & 0xff) << 8)
+-
+-/* Host-PCI bridge registers */
+-#define RALINK_PCI_PCICFG_ADDR		0x0000
+-#define RALINK_PCI_PCIMSK_ADDR		0x000C
+-#define RALINK_PCI_CONFIG_ADDR		0x0020
+-#define RALINK_PCI_CONFIG_DATA		0x0024
+-#define RALINK_PCI_MEMBASE		0x0028
+-#define RALINK_PCI_IOBASE		0x002C
+-
+-/* PCIe RC control registers */
+-#define RALINK_PCI_ID			0x0030
+-#define RALINK_PCI_CLASS		0x0034
+-#define RALINK_PCI_SUBID		0x0038
+-#define RALINK_PCI_STATUS		0x0050
+-
+-/* Some definition values */
+-#define PCIE_REVISION_ID		BIT(0)
+-#define PCIE_CLASS_CODE			(0x60400 << 8)
+-#define PCIE_BAR_MAP_MAX		GENMASK(30, 16)
+-#define PCIE_BAR_ENABLE			BIT(0)
+-#define PCIE_PORT_INT_EN(x)		BIT(20 + (x))
+-#define PCIE_PORT_LINKUP		BIT(0)
+-#define PCIE_PORT_CNT			3
+-
+-#define PERST_DELAY_MS			100
+-
+-/**
+- * struct mt7621_pcie_port - PCIe port information
+- * @base: I/O mapped register base
+- * @list: port list
+- * @pcie: pointer to PCIe host info
+- * @clk: pointer to the port clock gate
+- * @phy: pointer to PHY control block
+- * @pcie_rst: pointer to port reset control
+- * @gpio_rst: gpio reset
+- * @slot: port slot
+- * @enabled: indicates if port is enabled
+- */
+-struct mt7621_pcie_port {
+-	void __iomem *base;
+-	struct list_head list;
+-	struct mt7621_pcie *pcie;
+-	struct clk *clk;
+-	struct phy *phy;
+-	struct reset_control *pcie_rst;
+-	struct gpio_desc *gpio_rst;
+-	u32 slot;
+-	bool enabled;
+-};
+-
+-/**
+- * struct mt7621_pcie - PCIe host information
+- * @base: IO Mapped Register Base
+- * @dev: Pointer to PCIe device
+- * @ports: pointer to PCIe port information
+- * @resets_inverted: depends on chip revision
+- * reset lines are inverted.
+- */
+-struct mt7621_pcie {
+-	struct device *dev;
+-	void __iomem *base;
+-	struct list_head ports;
+-	bool resets_inverted;
+-};
+-
+-static inline u32 pcie_read(struct mt7621_pcie *pcie, u32 reg)
+-{
+-	return readl_relaxed(pcie->base + reg);
+-}
+-
+-static inline void pcie_write(struct mt7621_pcie *pcie, u32 val, u32 reg)
+-{
+-	writel_relaxed(val, pcie->base + reg);
+-}
+-
+-static inline void pcie_rmw(struct mt7621_pcie *pcie, u32 reg, u32 clr, u32 set)
+-{
+-	u32 val = readl_relaxed(pcie->base + reg);
+-
+-	val &= ~clr;
+-	val |= set;
+-	writel_relaxed(val, pcie->base + reg);
+-}
+-
+-static inline u32 pcie_port_read(struct mt7621_pcie_port *port, u32 reg)
+-{
+-	return readl_relaxed(port->base + reg);
+-}
+-
+-static inline void pcie_port_write(struct mt7621_pcie_port *port,
+-				   u32 val, u32 reg)
+-{
+-	writel_relaxed(val, port->base + reg);
+-}
+-
+-static inline u32 mt7621_pcie_get_cfgaddr(unsigned int bus, unsigned int slot,
+-					 unsigned int func, unsigned int where)
+-{
+-	return (((where & 0xF00) >> 8) << 24) | (bus << 16) | (slot << 11) |
+-		(func << 8) | (where & 0xfc) | 0x80000000;
+-}
+-
+-static void __iomem *mt7621_pcie_map_bus(struct pci_bus *bus,
+-					 unsigned int devfn, int where)
+-{
+-	struct mt7621_pcie *pcie = bus->sysdata;
+-	u32 address = mt7621_pcie_get_cfgaddr(bus->number, PCI_SLOT(devfn),
+-					     PCI_FUNC(devfn), where);
+-
+-	writel_relaxed(address, pcie->base + RALINK_PCI_CONFIG_ADDR);
+-
+-	return pcie->base + RALINK_PCI_CONFIG_DATA + (where & 3);
+-}
+-
+-struct pci_ops mt7621_pcie_ops = {
+-	.map_bus	= mt7621_pcie_map_bus,
+-	.read		= pci_generic_config_read,
+-	.write		= pci_generic_config_write,
+-};
+-
+-static u32 read_config(struct mt7621_pcie *pcie, unsigned int dev, u32 reg)
+-{
+-	u32 address = mt7621_pcie_get_cfgaddr(0, dev, 0, reg);
+-
+-	pcie_write(pcie, address, RALINK_PCI_CONFIG_ADDR);
+-	return pcie_read(pcie, RALINK_PCI_CONFIG_DATA);
+-}
+-
+-static void write_config(struct mt7621_pcie *pcie, unsigned int dev,
+-			 u32 reg, u32 val)
+-{
+-	u32 address = mt7621_pcie_get_cfgaddr(0, dev, 0, reg);
+-
+-	pcie_write(pcie, address, RALINK_PCI_CONFIG_ADDR);
+-	pcie_write(pcie, val, RALINK_PCI_CONFIG_DATA);
+-}
+-
+-static inline void mt7621_rst_gpio_pcie_assert(struct mt7621_pcie_port *port)
+-{
+-	if (port->gpio_rst)
+-		gpiod_set_value(port->gpio_rst, 1);
+-}
+-
+-static inline void mt7621_rst_gpio_pcie_deassert(struct mt7621_pcie_port *port)
+-{
+-	if (port->gpio_rst)
+-		gpiod_set_value(port->gpio_rst, 0);
+-}
+-
+-static inline bool mt7621_pcie_port_is_linkup(struct mt7621_pcie_port *port)
+-{
+-	return (pcie_port_read(port, RALINK_PCI_STATUS) & PCIE_PORT_LINKUP) != 0;
+-}
+-
+-static inline void mt7621_control_assert(struct mt7621_pcie_port *port)
+-{
+-	struct mt7621_pcie *pcie = port->pcie;
+-
+-	if (pcie->resets_inverted)
+-		reset_control_assert(port->pcie_rst);
+-	else
+-		reset_control_deassert(port->pcie_rst);
+-}
+-
+-static inline void mt7621_control_deassert(struct mt7621_pcie_port *port)
+-{
+-	struct mt7621_pcie *pcie = port->pcie;
+-
+-	if (pcie->resets_inverted)
+-		reset_control_deassert(port->pcie_rst);
+-	else
+-		reset_control_assert(port->pcie_rst);
+-}
+-
+-static int setup_cm_memory_region(struct pci_host_bridge *host)
+-{
+-	struct mt7621_pcie *pcie = pci_host_bridge_priv(host);
+-	struct device *dev = pcie->dev;
+-	struct resource_entry *entry;
+-	resource_size_t mask;
+-
+-	entry = resource_list_first_type(&host->windows, IORESOURCE_MEM);
+-	if (!entry) {
+-		dev_err(dev, "Cannot get memory resource\n");
+-		return -EINVAL;
+-	}
+-
+-	if (mips_cps_numiocu(0)) {
+-		/*
+-		 * FIXME: hardware doesn't accept mask values with 1s after
+-		 * 0s (e.g. 0xffef), so it would be great to warn if that's
+-		 * about to happen
+-		 */
+-		mask = ~(entry->res->end - entry->res->start);
+-
+-		write_gcr_reg1_base(entry->res->start);
+-		write_gcr_reg1_mask(mask | CM_GCR_REGn_MASK_CMTGT_IOCU0);
+-		dev_info(dev, "PCI coherence region base: 0x%08llx, mask/settings: 0x%08llx\n",
+-			 (unsigned long long)read_gcr_reg1_base(),
+-			 (unsigned long long)read_gcr_reg1_mask());
+-	}
+-
+-	return 0;
+-}
+-
+-static int mt7621_pcie_parse_port(struct mt7621_pcie *pcie,
+-				  struct device_node *node,
+-				  int slot)
+-{
+-	struct mt7621_pcie_port *port;
+-	struct device *dev = pcie->dev;
+-	struct platform_device *pdev = to_platform_device(dev);
+-	char name[10];
+-	int err;
+-
+-	port = devm_kzalloc(dev, sizeof(*port), GFP_KERNEL);
+-	if (!port)
+-		return -ENOMEM;
+-
+-	port->base = devm_platform_ioremap_resource(pdev, slot + 1);
+-	if (IS_ERR(port->base))
+-		return PTR_ERR(port->base);
+-
+-	port->clk = devm_get_clk_from_child(dev, node, NULL);
+-	if (IS_ERR(port->clk)) {
+-		dev_err(dev, "failed to get pcie%d clock\n", slot);
+-		return PTR_ERR(port->clk);
+-	}
+-
+-	port->pcie_rst = of_reset_control_get_exclusive(node, NULL);
+-	if (PTR_ERR(port->pcie_rst) == -EPROBE_DEFER) {
+-		dev_err(dev, "failed to get pcie%d reset control\n", slot);
+-		return PTR_ERR(port->pcie_rst);
+-	}
+-
+-	snprintf(name, sizeof(name), "pcie-phy%d", slot);
+-	port->phy = devm_of_phy_get(dev, node, name);
+-	if (IS_ERR(port->phy)) {
+-		dev_err(dev, "failed to get pcie-phy%d\n", slot);
+-		err = PTR_ERR(port->phy);
+-		goto remove_reset;
+-	}
+-
+-	port->gpio_rst = devm_gpiod_get_index_optional(dev, "reset", slot,
+-						       GPIOD_OUT_LOW);
+-	if (IS_ERR(port->gpio_rst)) {
+-		dev_err(dev, "Failed to get GPIO for PCIe%d\n", slot);
+-		err = PTR_ERR(port->gpio_rst);
+-		goto remove_reset;
+-	}
+-
+-	port->slot = slot;
+-	port->pcie = pcie;
+-
+-	INIT_LIST_HEAD(&port->list);
+-	list_add_tail(&port->list, &pcie->ports);
+-
+-	return 0;
+-
+-remove_reset:
+-	reset_control_put(port->pcie_rst);
+-	return err;
+-}
+-
+-static int mt7621_pcie_parse_dt(struct mt7621_pcie *pcie)
+-{
+-	struct device *dev = pcie->dev;
+-	struct platform_device *pdev = to_platform_device(dev);
+-	struct device_node *node = dev->of_node, *child;
+-	int err;
+-
+-	pcie->base = devm_platform_ioremap_resource(pdev, 0);
+-	if (IS_ERR(pcie->base))
+-		return PTR_ERR(pcie->base);
+-
+-	for_each_available_child_of_node(node, child) {
+-		int slot;
+-
+-		err = of_pci_get_devfn(child);
+-		if (err < 0) {
+-			of_node_put(child);
+-			dev_err(dev, "failed to parse devfn: %d\n", err);
+-			return err;
+-		}
+-
+-		slot = PCI_SLOT(err);
+-
+-		err = mt7621_pcie_parse_port(pcie, child, slot);
+-		if (err) {
+-			of_node_put(child);
+-			return err;
+-		}
+-	}
+-
+-	return 0;
+-}
+-
+-static int mt7621_pcie_init_port(struct mt7621_pcie_port *port)
+-{
+-	struct mt7621_pcie *pcie = port->pcie;
+-	struct device *dev = pcie->dev;
+-	u32 slot = port->slot;
+-	int err;
+-
+-	err = phy_init(port->phy);
+-	if (err) {
+-		dev_err(dev, "failed to initialize port%d phy\n", slot);
+-		return err;
+-	}
+-
+-	err = phy_power_on(port->phy);
+-	if (err) {
+-		dev_err(dev, "failed to power on port%d phy\n", slot);
+-		phy_exit(port->phy);
+-		return err;
+-	}
+-
+-	port->enabled = true;
+-
+-	return 0;
+-}
+-
+-static void mt7621_pcie_reset_assert(struct mt7621_pcie *pcie)
+-{
+-	struct mt7621_pcie_port *port;
+-
+-	list_for_each_entry(port, &pcie->ports, list) {
+-		/* PCIe RC reset assert */
+-		mt7621_control_assert(port);
+-
+-		/* PCIe EP reset assert */
+-		mt7621_rst_gpio_pcie_assert(port);
+-	}
+-
+-	msleep(PERST_DELAY_MS);
+-}
+-
+-static void mt7621_pcie_reset_rc_deassert(struct mt7621_pcie *pcie)
+-{
+-	struct mt7621_pcie_port *port;
+-
+-	list_for_each_entry(port, &pcie->ports, list)
+-		mt7621_control_deassert(port);
+-}
+-
+-static void mt7621_pcie_reset_ep_deassert(struct mt7621_pcie *pcie)
+-{
+-	struct mt7621_pcie_port *port;
+-
+-	list_for_each_entry(port, &pcie->ports, list)
+-		mt7621_rst_gpio_pcie_deassert(port);
+-
+-	msleep(PERST_DELAY_MS);
+-}
+-
+-static int mt7621_pcie_init_ports(struct mt7621_pcie *pcie)
+-{
+-	struct device *dev = pcie->dev;
+-	struct mt7621_pcie_port *port, *tmp;
+-	u8 num_disabled = 0;
+-	int err;
+-
+-	mt7621_pcie_reset_assert(pcie);
+-	mt7621_pcie_reset_rc_deassert(pcie);
+-
+-	list_for_each_entry_safe(port, tmp, &pcie->ports, list) {
+-		u32 slot = port->slot;
+-
+-		if (slot == 1) {
+-			port->enabled = true;
+-			continue;
+-		}
+-
+-		err = mt7621_pcie_init_port(port);
+-		if (err) {
+-			dev_err(dev, "Initiating port %d failed\n", slot);
+-			list_del(&port->list);
+-		}
+-	}
+-
+-	mt7621_pcie_reset_ep_deassert(pcie);
+-
+-	tmp = NULL;
+-	list_for_each_entry(port, &pcie->ports, list) {
+-		u32 slot = port->slot;
+-
+-		if (!mt7621_pcie_port_is_linkup(port)) {
+-			dev_err(dev, "pcie%d no card, disable it (RST & CLK)\n",
+-				slot);
+-			mt7621_control_assert(port);
+-			port->enabled = false;
+-			num_disabled++;
+-
+-			if (slot == 0) {
+-				tmp = port;
+-				continue;
+-			}
+-
+-			if (slot == 1 && tmp && !tmp->enabled)
+-				phy_power_off(tmp->phy);
+-		}
+-	}
+-
+-	return (num_disabled != PCIE_PORT_CNT) ? 0 : -ENODEV;
+-}
+-
+-static void mt7621_pcie_enable_port(struct mt7621_pcie_port *port)
+-{
+-	struct mt7621_pcie *pcie = port->pcie;
+-	u32 slot = port->slot;
+-	u32 val;
+-
+-	/* enable pcie interrupt */
+-	val = pcie_read(pcie, RALINK_PCI_PCIMSK_ADDR);
+-	val |= PCIE_PORT_INT_EN(slot);
+-	pcie_write(pcie, val, RALINK_PCI_PCIMSK_ADDR);
+-
+-	/* map 2G DDR region */
+-	pcie_port_write(port, PCIE_BAR_MAP_MAX | PCIE_BAR_ENABLE,
+-			PCI_BASE_ADDRESS_0);
+-
+-	/* configure class code and revision ID */
+-	pcie_port_write(port, PCIE_CLASS_CODE | PCIE_REVISION_ID,
+-			RALINK_PCI_CLASS);
+-
+-	/* configure RC FTS number to 250 when it leaves L0s */
+-	val = read_config(pcie, slot, PCIE_FTS_NUM);
+-	val &= ~PCIE_FTS_NUM_MASK;
+-	val |= PCIE_FTS_NUM_L0(0x50);
+-	write_config(pcie, slot, PCIE_FTS_NUM, val);
+-}
+-
+-static int mt7621_pcie_enable_ports(struct pci_host_bridge *host)
+-{
+-	struct mt7621_pcie *pcie = pci_host_bridge_priv(host);
+-	struct device *dev = pcie->dev;
+-	struct mt7621_pcie_port *port;
+-	struct resource_entry *entry;
+-	int err;
+-
+-	entry = resource_list_first_type(&host->windows, IORESOURCE_IO);
+-	if (!entry) {
+-		dev_err(dev, "Cannot get io resource\n");
+-		return -EINVAL;
+-	}
+-
+-	/* Setup MEMWIN and IOWIN */
+-	pcie_write(pcie, 0xffffffff, RALINK_PCI_MEMBASE);
+-	pcie_write(pcie, entry->res->start, RALINK_PCI_IOBASE);
+-
+-	list_for_each_entry(port, &pcie->ports, list) {
+-		if (port->enabled) {
+-			err = clk_prepare_enable(port->clk);
+-			if (err) {
+-				dev_err(dev, "enabling clk pcie%d\n",
+-					port->slot);
+-				return err;
+-			}
+-
+-			mt7621_pcie_enable_port(port);
+-			dev_info(dev, "PCIE%d enabled\n", port->slot);
+-		}
+-	}
+-
+-	return 0;
+-}
+-
+-static int mt7621_pcie_register_host(struct pci_host_bridge *host)
+-{
+-	struct mt7621_pcie *pcie = pci_host_bridge_priv(host);
+-
+-	host->ops = &mt7621_pcie_ops;
+-	host->sysdata = pcie;
+-	return pci_host_probe(host);
+-}
+-
+-static const struct soc_device_attribute mt7621_pcie_quirks_match[] = {
+-	{ .soc_id = "mt7621", .revision = "E2" },
+-	{ /* sentinel */ }
+-};
+-
+-static int mt7621_pcie_probe(struct platform_device *pdev)
+-{
+-	struct device *dev = &pdev->dev;
+-	const struct soc_device_attribute *attr;
+-	struct mt7621_pcie_port *port;
+-	struct mt7621_pcie *pcie;
+-	struct pci_host_bridge *bridge;
+-	int err;
+-
+-	if (!dev->of_node)
+-		return -ENODEV;
+-
+-	bridge = devm_pci_alloc_host_bridge(dev, sizeof(*pcie));
+-	if (!bridge)
+-		return -ENOMEM;
+-
+-	pcie = pci_host_bridge_priv(bridge);
+-	pcie->dev = dev;
+-	platform_set_drvdata(pdev, pcie);
+-	INIT_LIST_HEAD(&pcie->ports);
+-
+-	attr = soc_device_match(mt7621_pcie_quirks_match);
+-	if (attr)
+-		pcie->resets_inverted = true;
+-
+-	err = mt7621_pcie_parse_dt(pcie);
+-	if (err) {
+-		dev_err(dev, "Parsing DT failed\n");
+-		return err;
+-	}
+-
+-	err = mt7621_pcie_init_ports(pcie);
+-	if (err) {
+-		dev_err(dev, "Nothing connected in virtual bridges\n");
+-		return 0;
+-	}
+-
+-	err = mt7621_pcie_enable_ports(bridge);
+-	if (err) {
+-		dev_err(dev, "Error enabling pcie ports\n");
+-		goto remove_resets;
+-	}
+-
+-	err = setup_cm_memory_region(bridge);
+-	if (err) {
+-		dev_err(dev, "Error setting up iocu mem regions\n");
+-		goto remove_resets;
+-	}
+-
+-	return mt7621_pcie_register_host(bridge);
+-
+-remove_resets:
+-	list_for_each_entry(port, &pcie->ports, list)
+-		reset_control_put(port->pcie_rst);
+-
+-	return err;
+-}
+-
+-static int mt7621_pcie_remove(struct platform_device *pdev)
+-{
+-	struct mt7621_pcie *pcie = platform_get_drvdata(pdev);
+-	struct mt7621_pcie_port *port;
+-
+-	list_for_each_entry(port, &pcie->ports, list)
+-		reset_control_put(port->pcie_rst);
+-
+-	return 0;
+-}
+-
+-static const struct of_device_id mt7621_pcie_ids[] = {
+-	{ .compatible = "mediatek,mt7621-pci" },
+-	{},
+-};
+-MODULE_DEVICE_TABLE(of, mt7621_pcie_ids);
+-
+-static struct platform_driver mt7621_pcie_driver = {
+-	.probe = mt7621_pcie_probe,
+-	.remove = mt7621_pcie_remove,
+-	.driver = {
+-		.name = "mt7621-pci",
+-		.of_match_table = of_match_ptr(mt7621_pcie_ids),
+-	},
+-};
+-builtin_platform_driver(mt7621_pcie_driver);
+--- /dev/null
++++ b/drivers/pci/controller/pcie-mt7621.c
+@@ -0,0 +1,600 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * BRIEF MODULE DESCRIPTION
++ *     PCI init for Ralink RT2880 solution
++ *
++ * Copyright 2007 Ralink Inc. (bruce_chang@ralinktech.com.tw)
++ *
++ * May 2007 Bruce Chang
++ * Initial Release
++ *
++ * May 2009 Bruce Chang
++ * support RT2880/RT3883 PCIe
++ *
++ * May 2011 Bruce Chang
++ * support RT6855/MT7620 PCIe
++ */
++
++#include <linux/bitops.h>
++#include <linux/clk.h>
++#include <linux/delay.h>
++#include <linux/gpio/consumer.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/of_address.h>
++#include <linux/of_pci.h>
++#include <linux/of_platform.h>
++#include <linux/pci.h>
++#include <linux/phy/phy.h>
++#include <linux/platform_device.h>
++#include <linux/reset.h>
++#include <linux/sys_soc.h>
++
++/* MediaTek-specific configuration registers */
++#define PCIE_FTS_NUM			0x70c
++#define PCIE_FTS_NUM_MASK		GENMASK(15, 8)
++#define PCIE_FTS_NUM_L0(x)		(((x) & 0xff) << 8)
++
++/* Host-PCI bridge registers */
++#define RALINK_PCI_PCICFG_ADDR		0x0000
++#define RALINK_PCI_PCIMSK_ADDR		0x000c
++#define RALINK_PCI_CONFIG_ADDR		0x0020
++#define RALINK_PCI_CONFIG_DATA		0x0024
++#define RALINK_PCI_MEMBASE		0x0028
++#define RALINK_PCI_IOBASE		0x002c
++
++/* PCIe RC control registers */
++#define RALINK_PCI_ID			0x0030
++#define RALINK_PCI_CLASS		0x0034
++#define RALINK_PCI_SUBID		0x0038
++#define RALINK_PCI_STATUS		0x0050
++
++/* Some definition values */
++#define PCIE_REVISION_ID		BIT(0)
++#define PCIE_CLASS_CODE			(0x60400 << 8)
++#define PCIE_BAR_MAP_MAX		GENMASK(30, 16)
++#define PCIE_BAR_ENABLE			BIT(0)
++#define PCIE_PORT_INT_EN(x)		BIT(20 + (x))
++#define PCIE_PORT_LINKUP		BIT(0)
++#define PCIE_PORT_CNT			3
++
++#define PERST_DELAY_MS			100
++
++/**
++ * struct mt7621_pcie_port - PCIe port information
++ * @base: I/O mapped register base
++ * @list: port list
++ * @pcie: pointer to PCIe host info
++ * @clk: pointer to the port clock gate
++ * @phy: pointer to PHY control block
++ * @pcie_rst: pointer to port reset control
++ * @gpio_rst: gpio reset
++ * @slot: port slot
++ * @enabled: indicates if port is enabled
++ */
++struct mt7621_pcie_port {
++	void __iomem *base;
++	struct list_head list;
++	struct mt7621_pcie *pcie;
++	struct clk *clk;
++	struct phy *phy;
++	struct reset_control *pcie_rst;
++	struct gpio_desc *gpio_rst;
++	u32 slot;
++	bool enabled;
++};
++
++/**
++ * struct mt7621_pcie - PCIe host information
++ * @base: IO Mapped Register Base
++ * @dev: Pointer to PCIe device
++ * @ports: pointer to PCIe port information
++ * @resets_inverted: depends on chip revision
++ * reset lines are inverted.
++ */
++struct mt7621_pcie {
++	void __iomem *base;
++	struct device *dev;
++	struct list_head ports;
++	bool resets_inverted;
++};
++
++static inline u32 pcie_read(struct mt7621_pcie *pcie, u32 reg)
++{
++	return readl_relaxed(pcie->base + reg);
++}
++
++static inline void pcie_write(struct mt7621_pcie *pcie, u32 val, u32 reg)
++{
++	writel_relaxed(val, pcie->base + reg);
++}
++
++static inline void pcie_rmw(struct mt7621_pcie *pcie, u32 reg, u32 clr, u32 set)
++{
++	u32 val = readl_relaxed(pcie->base + reg);
++
++	val &= ~clr;
++	val |= set;
++	writel_relaxed(val, pcie->base + reg);
++}
++
++static inline u32 pcie_port_read(struct mt7621_pcie_port *port, u32 reg)
++{
++	return readl_relaxed(port->base + reg);
++}
++
++static inline void pcie_port_write(struct mt7621_pcie_port *port,
++				   u32 val, u32 reg)
++{
++	writel_relaxed(val, port->base + reg);
++}
++
++static inline u32 mt7621_pci_get_cfgaddr(unsigned int bus, unsigned int slot,
++					 unsigned int func, unsigned int where)
++{
++	return (((where & 0xf00) >> 8) << 24) | (bus << 16) | (slot << 11) |
++		(func << 8) | (where & 0xfc) | 0x80000000;
++}
++
++static void __iomem *mt7621_pcie_map_bus(struct pci_bus *bus,
++					 unsigned int devfn, int where)
++{
++	struct mt7621_pcie *pcie = bus->sysdata;
++	u32 address = mt7621_pci_get_cfgaddr(bus->number, PCI_SLOT(devfn),
++					     PCI_FUNC(devfn), where);
++
++	writel_relaxed(address, pcie->base + RALINK_PCI_CONFIG_ADDR);
++
++	return pcie->base + RALINK_PCI_CONFIG_DATA + (where & 3);
++}
++
++struct pci_ops mt7621_pci_ops = {
++	.map_bus	= mt7621_pcie_map_bus,
++	.read		= pci_generic_config_read,
++	.write		= pci_generic_config_write,
++};
++
++static u32 read_config(struct mt7621_pcie *pcie, unsigned int dev, u32 reg)
++{
++	u32 address = mt7621_pci_get_cfgaddr(0, dev, 0, reg);
++
++	pcie_write(pcie, address, RALINK_PCI_CONFIG_ADDR);
++	return pcie_read(pcie, RALINK_PCI_CONFIG_DATA);
++}
++
++static void write_config(struct mt7621_pcie *pcie, unsigned int dev,
++			 u32 reg, u32 val)
++{
++	u32 address = mt7621_pci_get_cfgaddr(0, dev, 0, reg);
++
++	pcie_write(pcie, address, RALINK_PCI_CONFIG_ADDR);
++	pcie_write(pcie, val, RALINK_PCI_CONFIG_DATA);
++}
++
++static inline void mt7621_rst_gpio_pcie_assert(struct mt7621_pcie_port *port)
++{
++	if (port->gpio_rst)
++		gpiod_set_value(port->gpio_rst, 1);
++}
++
++static inline void mt7621_rst_gpio_pcie_deassert(struct mt7621_pcie_port *port)
++{
++	if (port->gpio_rst)
++		gpiod_set_value(port->gpio_rst, 0);
++}
++
++static inline bool mt7621_pcie_port_is_linkup(struct mt7621_pcie_port *port)
++{
++	return (pcie_port_read(port, RALINK_PCI_STATUS) & PCIE_PORT_LINKUP) != 0;
++}
++
++static inline void mt7621_control_assert(struct mt7621_pcie_port *port)
++{
++	struct mt7621_pcie *pcie = port->pcie;
++
++	if (pcie->resets_inverted)
++		reset_control_assert(port->pcie_rst);
++	else
++		reset_control_deassert(port->pcie_rst);
++}
++
++static inline void mt7621_control_deassert(struct mt7621_pcie_port *port)
++{
++	struct mt7621_pcie *pcie = port->pcie;
++
++	if (pcie->resets_inverted)
++		reset_control_deassert(port->pcie_rst);
++	else
++		reset_control_assert(port->pcie_rst);
++}
++
++static int setup_cm_memory_region(struct pci_host_bridge *host)
++{
++	struct mt7621_pcie *pcie = pci_host_bridge_priv(host);
++	struct device *dev = pcie->dev;
++	struct resource_entry *entry;
++	resource_size_t mask;
++
++	entry = resource_list_first_type(&host->windows, IORESOURCE_MEM);
++	if (!entry) {
++		dev_err(dev, "cannot get memory resource\n");
++		return -EINVAL;
++	}
++
++	if (mips_cps_numiocu(0)) {
++		/*
++		 * FIXME: hardware doesn't accept mask values with 1s after
++		 * 0s (e.g. 0xffef), so it would be great to warn if that's
++		 * about to happen
++		 */
++		mask = ~(entry->res->end - entry->res->start);
++
++		write_gcr_reg1_base(entry->res->start);
++		write_gcr_reg1_mask(mask | CM_GCR_REGn_MASK_CMTGT_IOCU0);
++		dev_info(dev, "PCI coherence region base: 0x%08llx, mask/settings: 0x%08llx\n",
++			 (unsigned long long)read_gcr_reg1_base(),
++			 (unsigned long long)read_gcr_reg1_mask());
++	}
++
++	return 0;
++}
++
++static int mt7621_pcie_parse_port(struct mt7621_pcie *pcie,
++				  struct device_node *node,
++				  int slot)
++{
++	struct mt7621_pcie_port *port;
++	struct device *dev = pcie->dev;
++	struct platform_device *pdev = to_platform_device(dev);
++	char name[10];
++	int err;
++
++	port = devm_kzalloc(dev, sizeof(*port), GFP_KERNEL);
++	if (!port)
++		return -ENOMEM;
++
++	port->base = devm_platform_ioremap_resource(pdev, slot + 1);
++	if (IS_ERR(port->base))
++		return PTR_ERR(port->base);
++
++	port->clk = devm_get_clk_from_child(dev, node, NULL);
++	if (IS_ERR(port->clk)) {
++		dev_err(dev, "failed to get pcie%d clock\n", slot);
++		return PTR_ERR(port->clk);
++	}
++
++	port->pcie_rst = of_reset_control_get_exclusive(node, NULL);
++	if (PTR_ERR(port->pcie_rst) == -EPROBE_DEFER) {
++		dev_err(dev, "failed to get pcie%d reset control\n", slot);
++		return PTR_ERR(port->pcie_rst);
++	}
++
++	snprintf(name, sizeof(name), "pcie-phy%d", slot);
++	port->phy = devm_of_phy_get(dev, node, name);
++	if (IS_ERR(port->phy)) {
++		dev_err(dev, "failed to get pcie-phy%d\n", slot);
++		err = PTR_ERR(port->phy);
++		goto remove_reset;
++	}
++
++	port->gpio_rst = devm_gpiod_get_index_optional(dev, "reset", slot,
++						       GPIOD_OUT_LOW);
++	if (IS_ERR(port->gpio_rst)) {
++		dev_err(dev, "failed to get GPIO for PCIe%d\n", slot);
++		err = PTR_ERR(port->gpio_rst);
++		goto remove_reset;
++	}
++
++	port->slot = slot;
++	port->pcie = pcie;
++
++	INIT_LIST_HEAD(&port->list);
++	list_add_tail(&port->list, &pcie->ports);
++
++	return 0;
++
++remove_reset:
++	reset_control_put(port->pcie_rst);
++	return err;
++}
++
++static int mt7621_pcie_parse_dt(struct mt7621_pcie *pcie)
++{
++	struct device *dev = pcie->dev;
++	struct platform_device *pdev = to_platform_device(dev);
++	struct device_node *node = dev->of_node, *child;
++	int err;
++
++	pcie->base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(pcie->base))
++		return PTR_ERR(pcie->base);
++
++	for_each_available_child_of_node(node, child) {
++		int slot;
++
++		err = of_pci_get_devfn(child);
++		if (err < 0) {
++			of_node_put(child);
++			dev_err(dev, "failed to parse devfn: %d\n", err);
++			return err;
++		}
++
++		slot = PCI_SLOT(err);
++
++		err = mt7621_pcie_parse_port(pcie, child, slot);
++		if (err) {
++			of_node_put(child);
++			return err;
++		}
++	}
++
++	return 0;
++}
++
++static int mt7621_pcie_init_port(struct mt7621_pcie_port *port)
++{
++	struct mt7621_pcie *pcie = port->pcie;
++	struct device *dev = pcie->dev;
++	u32 slot = port->slot;
++	int err;
++
++	err = phy_init(port->phy);
++	if (err) {
++		dev_err(dev, "failed to initialize port%d phy\n", slot);
++		return err;
++	}
++
++	err = phy_power_on(port->phy);
++	if (err) {
++		dev_err(dev, "failed to power on port%d phy\n", slot);
++		phy_exit(port->phy);
++		return err;
++	}
++
++	port->enabled = true;
++
++	return 0;
++}
++
++static void mt7621_pcie_reset_assert(struct mt7621_pcie *pcie)
++{
++	struct mt7621_pcie_port *port;
++
++	list_for_each_entry(port, &pcie->ports, list) {
++		/* PCIe RC reset assert */
++		mt7621_control_assert(port);
++
++		/* PCIe EP reset assert */
++		mt7621_rst_gpio_pcie_assert(port);
++	}
++
++	msleep(PERST_DELAY_MS);
++}
++
++static void mt7621_pcie_reset_rc_deassert(struct mt7621_pcie *pcie)
++{
++	struct mt7621_pcie_port *port;
++
++	list_for_each_entry(port, &pcie->ports, list)
++		mt7621_control_deassert(port);
++}
++
++static void mt7621_pcie_reset_ep_deassert(struct mt7621_pcie *pcie)
++{
++	struct mt7621_pcie_port *port;
++
++	list_for_each_entry(port, &pcie->ports, list)
++		mt7621_rst_gpio_pcie_deassert(port);
++
++	msleep(PERST_DELAY_MS);
++}
++
++static int mt7621_pcie_init_ports(struct mt7621_pcie *pcie)
++{
++	struct device *dev = pcie->dev;
++	struct mt7621_pcie_port *port, *tmp;
++	u8 num_disabled = 0;
++	int err;
++
++	mt7621_pcie_reset_assert(pcie);
++	mt7621_pcie_reset_rc_deassert(pcie);
++
++	list_for_each_entry_safe(port, tmp, &pcie->ports, list) {
++		u32 slot = port->slot;
++
++		if (slot == 1) {
++			port->enabled = true;
++			continue;
++		}
++
++		err = mt7621_pcie_init_port(port);
++		if (err) {
++			dev_err(dev, "initializing port %d failed\n", slot);
++			list_del(&port->list);
++		}
++	}
++
++	mt7621_pcie_reset_ep_deassert(pcie);
++
++	tmp = NULL;
++	list_for_each_entry(port, &pcie->ports, list) {
++		u32 slot = port->slot;
++
++		if (!mt7621_pcie_port_is_linkup(port)) {
++			dev_err(dev, "pcie%d no card, disable it (RST & CLK)\n",
++				slot);
++			mt7621_control_assert(port);
++			port->enabled = false;
++			num_disabled++;
++
++			if (slot == 0) {
++				tmp = port;
++				continue;
++			}
++
++			if (slot == 1 && tmp && !tmp->enabled)
++				phy_power_off(tmp->phy);
++		}
++	}
++
++	return (num_disabled != PCIE_PORT_CNT) ? 0 : -ENODEV;
++}
++
++static void mt7621_pcie_enable_port(struct mt7621_pcie_port *port)
++{
++	struct mt7621_pcie *pcie = port->pcie;
++	u32 slot = port->slot;
++	u32 val;
++
++	/* enable pcie interrupt */
++	val = pcie_read(pcie, RALINK_PCI_PCIMSK_ADDR);
++	val |= PCIE_PORT_INT_EN(slot);
++	pcie_write(pcie, val, RALINK_PCI_PCIMSK_ADDR);
++
++	/* map 2G DDR region */
++	pcie_port_write(port, PCIE_BAR_MAP_MAX | PCIE_BAR_ENABLE,
++			PCI_BASE_ADDRESS_0);
++
++	/* configure class code and revision ID */
++	pcie_port_write(port, PCIE_CLASS_CODE | PCIE_REVISION_ID,
++			RALINK_PCI_CLASS);
++
++	/* configure RC FTS number to 250 when it leaves L0s */
++	val = read_config(pcie, slot, PCIE_FTS_NUM);
++	val &= ~PCIE_FTS_NUM_MASK;
++	val |= PCIE_FTS_NUM_L0(0x50);
++	write_config(pcie, slot, PCIE_FTS_NUM, val);
++}
++
++static int mt7621_pcie_enable_ports(struct pci_host_bridge *host)
++{
++	struct mt7621_pcie *pcie = pci_host_bridge_priv(host);
++	struct device *dev = pcie->dev;
++	struct mt7621_pcie_port *port;
++	struct resource_entry *entry;
++	int err;
++
++	entry = resource_list_first_type(&host->windows, IORESOURCE_IO);
++	if (!entry) {
++		dev_err(dev, "cannot get io resource\n");
++		return -EINVAL;
++	}
++
++	/* Setup MEMWIN and IOWIN */
++	pcie_write(pcie, 0xffffffff, RALINK_PCI_MEMBASE);
++	pcie_write(pcie, entry->res->start, RALINK_PCI_IOBASE);
++
++	list_for_each_entry(port, &pcie->ports, list) {
++		if (port->enabled) {
++			err = clk_prepare_enable(port->clk);
++			if (err) {
++				dev_err(dev, "enabling clk pcie%d\n",
++					port->slot);
++				return err;
++			}
++
++			mt7621_pcie_enable_port(port);
++			dev_info(dev, "PCIE%d enabled\n", port->slot);
++		}
++	}
++
++	return 0;
++}
++
++static int mt7621_pcie_register_host(struct pci_host_bridge *host)
++{
++	struct mt7621_pcie *pcie = pci_host_bridge_priv(host);
++
++	host->ops = &mt7621_pci_ops;
++	host->sysdata = pcie;
++	return pci_host_probe(host);
++}
++
++static const struct soc_device_attribute mt7621_pci_quirks_match[] = {
++	{ .soc_id = "mt7621", .revision = "E2" }
++};
++
++static int mt7621_pci_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	const struct soc_device_attribute *attr;
++	struct mt7621_pcie_port *port;
++	struct mt7621_pcie *pcie;
++	struct pci_host_bridge *bridge;
++	int err;
++
++	if (!dev->of_node)
++		return -ENODEV;
++
++	bridge = devm_pci_alloc_host_bridge(dev, sizeof(*pcie));
++	if (!bridge)
++		return -ENOMEM;
++
++	pcie = pci_host_bridge_priv(bridge);
++	pcie->dev = dev;
++	platform_set_drvdata(pdev, pcie);
++	INIT_LIST_HEAD(&pcie->ports);
++
++	attr = soc_device_match(mt7621_pci_quirks_match);
++	if (attr)
++		pcie->resets_inverted = true;
++
++	err = mt7621_pcie_parse_dt(pcie);
++	if (err) {
++		dev_err(dev, "parsing DT failed\n");
++		return err;
++	}
++
++	err = mt7621_pcie_init_ports(pcie);
++	if (err) {
++		dev_err(dev, "nothing connected in virtual bridges\n");
++		return 0;
++	}
++
++	err = mt7621_pcie_enable_ports(bridge);
++	if (err) {
++		dev_err(dev, "error enabling pcie ports\n");
++		goto remove_resets;
++	}
++
++	err = setup_cm_memory_region(bridge);
++	if (err) {
++		dev_err(dev, "error setting up iocu mem regions\n");
++		goto remove_resets;
++	}
++
++	return mt7621_pcie_register_host(bridge);
++
++remove_resets:
++	list_for_each_entry(port, &pcie->ports, list)
++		reset_control_put(port->pcie_rst);
++
++	return err;
++}
++
++static int mt7621_pci_remove(struct platform_device *pdev)
++{
++	struct mt7621_pcie *pcie = platform_get_drvdata(pdev);
++	struct mt7621_pcie_port *port;
++
++	list_for_each_entry(port, &pcie->ports, list)
++		reset_control_put(port->pcie_rst);
++
++	return 0;
++}
++
++static const struct of_device_id mt7621_pci_ids[] = {
++	{ .compatible = "mediatek,mt7621-pci" },
++	{},
++};
++MODULE_DEVICE_TABLE(of, mt7621_pci_ids);
++
++static struct platform_driver mt7621_pci_driver = {
++	.probe = mt7621_pci_probe,
++	.remove = mt7621_pci_remove,
++	.driver = {
++		.name = "mt7621-pci",
++		.of_match_table = of_match_ptr(mt7621_pci_ids),
++	},
++};
++builtin_platform_driver(mt7621_pci_driver);
diff --git a/target/linux/ramips/patches-5.15/101-v5.17-PCI-mt7621-Rename-mt7621_pci_-to-mt7621_pcie_.patch b/target/linux/ramips/patches-5.15/101-v5.17-PCI-mt7621-Rename-mt7621_pci_-to-mt7621_pcie_.patch
new file mode 100644
index 00000000000000..916477511d2cab
--- /dev/null
+++ b/target/linux/ramips/patches-5.15/101-v5.17-PCI-mt7621-Rename-mt7621_pci_-to-mt7621_pcie_.patch
@@ -0,0 +1,134 @@
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Wed, 22 Dec 2021 19:10:48 -0600
+Subject: [PATCH] PCI: mt7621: Rename mt7621_pci_ to mt7621_pcie_
+
+Rename mt7621_pci_* structs and functions to mt7621_pcie_* for consistency
+with the rest of the file.
+
+Link: https://lore.kernel.org/r/20211223011054.1227810-18-helgaas@kernel.org
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Cc: Matthias Brugger <matthias.bgg@gmail.com>
+---
+
+--- a/drivers/pci/controller/pcie-mt7621.c
++++ b/drivers/pci/controller/pcie-mt7621.c
+@@ -93,8 +93,8 @@ struct mt7621_pcie_port {
+  * reset lines are inverted.
+  */
+ struct mt7621_pcie {
+-	void __iomem *base;
+ 	struct device *dev;
++	void __iomem *base;
+ 	struct list_head ports;
+ 	bool resets_inverted;
+ };
+@@ -129,7 +129,7 @@ static inline void pcie_port_write(struc
+ 	writel_relaxed(val, port->base + reg);
+ }
+ 
+-static inline u32 mt7621_pci_get_cfgaddr(unsigned int bus, unsigned int slot,
++static inline u32 mt7621_pcie_get_cfgaddr(unsigned int bus, unsigned int slot,
+ 					 unsigned int func, unsigned int where)
+ {
+ 	return (((where & 0xf00) >> 8) << 24) | (bus << 16) | (slot << 11) |
+@@ -140,7 +140,7 @@ static void __iomem *mt7621_pcie_map_bus
+ 					 unsigned int devfn, int where)
+ {
+ 	struct mt7621_pcie *pcie = bus->sysdata;
+-	u32 address = mt7621_pci_get_cfgaddr(bus->number, PCI_SLOT(devfn),
++	u32 address = mt7621_pcie_get_cfgaddr(bus->number, PCI_SLOT(devfn),
+ 					     PCI_FUNC(devfn), where);
+ 
+ 	writel_relaxed(address, pcie->base + RALINK_PCI_CONFIG_ADDR);
+@@ -148,7 +148,7 @@ static void __iomem *mt7621_pcie_map_bus
+ 	return pcie->base + RALINK_PCI_CONFIG_DATA + (where & 3);
+ }
+ 
+-struct pci_ops mt7621_pci_ops = {
++struct pci_ops mt7621_pcie_ops = {
+ 	.map_bus	= mt7621_pcie_map_bus,
+ 	.read		= pci_generic_config_read,
+ 	.write		= pci_generic_config_write,
+@@ -156,7 +156,7 @@ struct pci_ops mt7621_pci_ops = {
+ 
+ static u32 read_config(struct mt7621_pcie *pcie, unsigned int dev, u32 reg)
+ {
+-	u32 address = mt7621_pci_get_cfgaddr(0, dev, 0, reg);
++	u32 address = mt7621_pcie_get_cfgaddr(0, dev, 0, reg);
+ 
+ 	pcie_write(pcie, address, RALINK_PCI_CONFIG_ADDR);
+ 	return pcie_read(pcie, RALINK_PCI_CONFIG_DATA);
+@@ -165,7 +165,7 @@ static u32 read_config(struct mt7621_pci
+ static void write_config(struct mt7621_pcie *pcie, unsigned int dev,
+ 			 u32 reg, u32 val)
+ {
+-	u32 address = mt7621_pci_get_cfgaddr(0, dev, 0, reg);
++	u32 address = mt7621_pcie_get_cfgaddr(0, dev, 0, reg);
+ 
+ 	pcie_write(pcie, address, RALINK_PCI_CONFIG_ADDR);
+ 	pcie_write(pcie, val, RALINK_PCI_CONFIG_DATA);
+@@ -505,16 +505,16 @@ static int mt7621_pcie_register_host(str
+ {
+ 	struct mt7621_pcie *pcie = pci_host_bridge_priv(host);
+ 
+-	host->ops = &mt7621_pci_ops;
++	host->ops = &mt7621_pcie_ops;
+ 	host->sysdata = pcie;
+ 	return pci_host_probe(host);
+ }
+ 
+-static const struct soc_device_attribute mt7621_pci_quirks_match[] = {
++static const struct soc_device_attribute mt7621_pcie_quirks_match[] = {
+ 	{ .soc_id = "mt7621", .revision = "E2" }
+ };
+ 
+-static int mt7621_pci_probe(struct platform_device *pdev)
++static int mt7621_pcie_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
+ 	const struct soc_device_attribute *attr;
+@@ -535,7 +535,7 @@ static int mt7621_pci_probe(struct platf
+ 	platform_set_drvdata(pdev, pcie);
+ 	INIT_LIST_HEAD(&pcie->ports);
+ 
+-	attr = soc_device_match(mt7621_pci_quirks_match);
++	attr = soc_device_match(mt7621_pcie_quirks_match);
+ 	if (attr)
+ 		pcie->resets_inverted = true;
+ 
+@@ -572,7 +572,7 @@ remove_resets:
+ 	return err;
+ }
+ 
+-static int mt7621_pci_remove(struct platform_device *pdev)
++static int mt7621_pcie_remove(struct platform_device *pdev)
+ {
+ 	struct mt7621_pcie *pcie = platform_get_drvdata(pdev);
+ 	struct mt7621_pcie_port *port;
+@@ -583,18 +583,18 @@ static int mt7621_pci_remove(struct plat
+ 	return 0;
+ }
+ 
+-static const struct of_device_id mt7621_pci_ids[] = {
++static const struct of_device_id mt7621_pcie_ids[] = {
+ 	{ .compatible = "mediatek,mt7621-pci" },
+ 	{},
+ };
+-MODULE_DEVICE_TABLE(of, mt7621_pci_ids);
++MODULE_DEVICE_TABLE(of, mt7621_pcie_ids);
+ 
+-static struct platform_driver mt7621_pci_driver = {
+-	.probe = mt7621_pci_probe,
+-	.remove = mt7621_pci_remove,
++static struct platform_driver mt7621_pcie_driver = {
++	.probe = mt7621_pcie_probe,
++	.remove = mt7621_pcie_remove,
+ 	.driver = {
+ 		.name = "mt7621-pci",
+-		.of_match_table = of_match_ptr(mt7621_pci_ids),
++		.of_match_table = of_match_ptr(mt7621_pcie_ids),
+ 	},
+ };
+-builtin_platform_driver(mt7621_pci_driver);
++builtin_platform_driver(mt7621_pcie_driver);
diff --git a/target/linux/ramips/patches-5.15/102-v5.17-PCI-mt7621-Declare-mt7621_pci_ops-static.patch b/target/linux/ramips/patches-5.15/102-v5.17-PCI-mt7621-Declare-mt7621_pci_ops-static.patch
new file mode 100644
index 00000000000000..815ecc7d373f63
--- /dev/null
+++ b/target/linux/ramips/patches-5.15/102-v5.17-PCI-mt7621-Declare-mt7621_pci_ops-static.patch
@@ -0,0 +1,30 @@
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Date: Wed, 17 Nov 2021 16:29:52 +0100
+Subject: [PATCH] PCI: mt7621: Declare mt7621_pci_ops static
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Sparse complains about mt7621_pci_ops symbol is not declared and asks if
+it should be declared as static instead. Sparse is right. Hence declare
+symbol as static.
+
+Link: https://lore.kernel.org/r/20211117152952.12271-1-sergio.paracuellos@gmail.com
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Krzysztof Wilczyński <kw@linux.com>
+---
+
+--- a/drivers/pci/controller/pcie-mt7621.c
++++ b/drivers/pci/controller/pcie-mt7621.c
+@@ -148,7 +148,7 @@ static void __iomem *mt7621_pcie_map_bus
+ 	return pcie->base + RALINK_PCI_CONFIG_DATA + (where & 3);
+ }
+ 
+-struct pci_ops mt7621_pcie_ops = {
++static struct pci_ops mt7621_pcie_ops = {
+ 	.map_bus	= mt7621_pcie_map_bus,
+ 	.read		= pci_generic_config_read,
+ 	.write		= pci_generic_config_write,
diff --git a/target/linux/ramips/patches-5.15/103-v5.17-PCI-mt7621-Move-MIPS-setup-to-pcibios_root_bridge_pr.patch b/target/linux/ramips/patches-5.15/103-v5.17-PCI-mt7621-Move-MIPS-setup-to-pcibios_root_bridge_pr.patch
new file mode 100644
index 00000000000000..4b46b3e3f6235e
--- /dev/null
+++ b/target/linux/ramips/patches-5.15/103-v5.17-PCI-mt7621-Move-MIPS-setup-to-pcibios_root_bridge_pr.patch
@@ -0,0 +1,119 @@
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Date: Tue, 7 Dec 2021 11:49:21 +0100
+Subject: [PATCH] PCI: mt7621: Move MIPS setup to pcibios_root_bridge_prepare()
+
+On the MIPS ralink mt7621 platform, we need to set up I/O coherency units
+based on the host bridge apertures.
+
+To remove this arch dependency from the driver itself, move the coherency
+setup from the driver to pcibios_root_bridge_prepare().
+
+[bhelgaas: squash add/remove into one patch, commit log]
+Link: https://lore.kernel.org/r/20211207104924.21327-3-sergio.paracuellos@gmail.com
+Link: https://lore.kernel.org/r/20211207104924.21327-4-sergio.paracuellos@gmail.com
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>             # arch/mips
+Acked-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>   # arch/mips
+---
+
+--- a/arch/mips/ralink/mt7621.c
++++ b/arch/mips/ralink/mt7621.c
+@@ -10,6 +10,8 @@
+ #include <linux/slab.h>
+ #include <linux/sys_soc.h>
+ #include <linux/memblock.h>
++#include <linux/pci.h>
++#include <linux/bug.h>
+ 
+ #include <asm/bootinfo.h>
+ #include <asm/mipsregs.h>
+@@ -25,6 +27,35 @@
+ static u32 detect_magic __initdata;
+ static struct ralink_soc_info *soc_info_ptr;
+ 
++int pcibios_root_bridge_prepare(struct pci_host_bridge *bridge)
++{
++	struct resource_entry *entry;
++	resource_size_t mask;
++
++	entry = resource_list_first_type(&bridge->windows, IORESOURCE_MEM);
++	if (!entry) {
++		pr_err("Cannot get memory resource\n");
++		return -EINVAL;
++	}
++
++	if (mips_cps_numiocu(0)) {
++		/*
++		 * Hardware doesn't accept mask values with 1s after
++		 * 0s (e.g. 0xffef), so warn if that's happen
++		 */
++		mask = ~(entry->res->end - entry->res->start) & CM_GCR_REGn_MASK_ADDRMASK;
++		WARN_ON(mask && BIT(ffz(~mask)) - 1 != ~mask);
++
++		write_gcr_reg1_base(entry->res->start);
++		write_gcr_reg1_mask(mask | CM_GCR_REGn_MASK_CMTGT_IOCU0);
++		pr_info("PCI coherence region base: 0x%08llx, mask/settings: 0x%08llx\n",
++			(unsigned long long)read_gcr_reg1_base(),
++			(unsigned long long)read_gcr_reg1_mask());
++	}
++
++	return 0;
++}
++
+ phys_addr_t mips_cpc_default_phys_base(void)
+ {
+ 	panic("Cannot detect cpc address");
+--- a/drivers/pci/controller/pcie-mt7621.c
++++ b/drivers/pci/controller/pcie-mt7621.c
+@@ -208,37 +208,6 @@ static inline void mt7621_control_deasse
+ 		reset_control_assert(port->pcie_rst);
+ }
+ 
+-static int setup_cm_memory_region(struct pci_host_bridge *host)
+-{
+-	struct mt7621_pcie *pcie = pci_host_bridge_priv(host);
+-	struct device *dev = pcie->dev;
+-	struct resource_entry *entry;
+-	resource_size_t mask;
+-
+-	entry = resource_list_first_type(&host->windows, IORESOURCE_MEM);
+-	if (!entry) {
+-		dev_err(dev, "cannot get memory resource\n");
+-		return -EINVAL;
+-	}
+-
+-	if (mips_cps_numiocu(0)) {
+-		/*
+-		 * FIXME: hardware doesn't accept mask values with 1s after
+-		 * 0s (e.g. 0xffef), so it would be great to warn if that's
+-		 * about to happen
+-		 */
+-		mask = ~(entry->res->end - entry->res->start);
+-
+-		write_gcr_reg1_base(entry->res->start);
+-		write_gcr_reg1_mask(mask | CM_GCR_REGn_MASK_CMTGT_IOCU0);
+-		dev_info(dev, "PCI coherence region base: 0x%08llx, mask/settings: 0x%08llx\n",
+-			 (unsigned long long)read_gcr_reg1_base(),
+-			 (unsigned long long)read_gcr_reg1_mask());
+-	}
+-
+-	return 0;
+-}
+-
+ static int mt7621_pcie_parse_port(struct mt7621_pcie *pcie,
+ 				  struct device_node *node,
+ 				  int slot)
+@@ -557,12 +526,6 @@ static int mt7621_pcie_probe(struct plat
+ 		goto remove_resets;
+ 	}
+ 
+-	err = setup_cm_memory_region(bridge);
+-	if (err) {
+-		dev_err(dev, "error setting up iocu mem regions\n");
+-		goto remove_resets;
+-	}
+-
+ 	return mt7621_pcie_register_host(bridge);
+ 
+ remove_resets:
diff --git a/target/linux/ramips/patches-5.15/104-v5.17-PCI-mt7621-Drop-of_match_ptr-to-avoid-unused-variabl.patch b/target/linux/ramips/patches-5.15/104-v5.17-PCI-mt7621-Drop-of_match_ptr-to-avoid-unused-variabl.patch
new file mode 100644
index 00000000000000..0913a452c608f4
--- /dev/null
+++ b/target/linux/ramips/patches-5.15/104-v5.17-PCI-mt7621-Drop-of_match_ptr-to-avoid-unused-variabl.patch
@@ -0,0 +1,35 @@
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Date: Mon, 24 Jan 2022 12:30:02 +0100
+Subject: [PATCH] PCI: mt7621: Drop of_match_ptr() to avoid unused variable
+
+We have stubs for most OF interfaces even when CONFIG_OF is not set, so we
+allow building of pcie-mt7621.c in that case for compile testing.
+
+When CONFIG_OF is not set, "of_match_ptr(mt7621_pcie_ids)" compiles to
+NULL, which leaves mt7621_pcie_ids unused:
+
+  $ make W=1
+  drivers/pci/controller/pcie-mt7621.c:549:34: warning: unused variable 'mt7621_pcie_ids' [-Wunused-const-variable]
+
+Drop of_match_ptr() to avoid the unused variable warning.
+
+[bhelgaas: commit log]
+Fixes: 2bdd5238e756 ("PCI: mt7621: Add MediaTek MT7621 PCIe host controller driver")
+Link: https://lore.kernel.org/r/20220124113003.406224-2-sergio.paracuellos@gmail.com
+Link: https://lore.kernel.org/r/202201241754.igtHzgHv-lkp@intel.com
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+---
+
+--- a/drivers/pci/controller/pcie-mt7621.c
++++ b/drivers/pci/controller/pcie-mt7621.c
+@@ -557,7 +557,7 @@ static struct platform_driver mt7621_pci
+ 	.remove = mt7621_pcie_remove,
+ 	.driver = {
+ 		.name = "mt7621-pci",
+-		.of_match_table = of_match_ptr(mt7621_pcie_ids),
++		.of_match_table = mt7621_pcie_ids,
+ 	},
+ };
+ builtin_platform_driver(mt7621_pcie_driver);
diff --git a/target/linux/ramips/patches-5.15/105-v5.17-PCI-mt7621-Remove-unused-function-pcie_rmw.patch b/target/linux/ramips/patches-5.15/105-v5.17-PCI-mt7621-Remove-unused-function-pcie_rmw.patch
new file mode 100644
index 00000000000000..0323588e5a77c7
--- /dev/null
+++ b/target/linux/ramips/patches-5.15/105-v5.17-PCI-mt7621-Remove-unused-function-pcie_rmw.patch
@@ -0,0 +1,35 @@
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Date: Mon, 24 Jan 2022 12:30:03 +0100
+Subject: [PATCH] PCI: mt7621: Remove unused function pcie_rmw()
+
+Function pcie_rmw() is not being used at all and can be deleted. Hence get
+rid of it, which fixes this warning:
+
+  drivers/pci/controller/pcie-mt7621.c:112:20: warning: unused function 'pcie_rmw' [-Wunused-function]
+
+Fixes: 2bdd5238e756 ("PCI: mt7621: Add MediaTek MT7621 PCIe host controller driver")
+Link: https://lore.kernel.org/r/20220124113003.406224-3-sergio.paracuellos@gmail.com
+Link: https://lore.kernel.org/all/202201241754.igtHzgHv-lkp@intel.com/
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+---
+
+--- a/drivers/pci/controller/pcie-mt7621.c
++++ b/drivers/pci/controller/pcie-mt7621.c
+@@ -109,15 +109,6 @@ static inline void pcie_write(struct mt7
+ 	writel_relaxed(val, pcie->base + reg);
+ }
+ 
+-static inline void pcie_rmw(struct mt7621_pcie *pcie, u32 reg, u32 clr, u32 set)
+-{
+-	u32 val = readl_relaxed(pcie->base + reg);
+-
+-	val &= ~clr;
+-	val |= set;
+-	writel_relaxed(val, pcie->base + reg);
+-}
+-
+ static inline u32 pcie_port_read(struct mt7621_pcie_port *port, u32 reg)
+ {
+ 	return readl_relaxed(port->base + reg);
diff --git a/target/linux/ramips/patches-5.15/106-v5.17-PCI-Let-pcibios_root_bridge_prepare-access-bridge-wi.patch b/target/linux/ramips/patches-5.15/106-v5.17-PCI-Let-pcibios_root_bridge_prepare-access-bridge-wi.patch
new file mode 100644
index 00000000000000..2fbbf9a7aa5d5a
--- /dev/null
+++ b/target/linux/ramips/patches-5.15/106-v5.17-PCI-Let-pcibios_root_bridge_prepare-access-bridge-wi.patch
@@ -0,0 +1,38 @@
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Date: Tue, 7 Dec 2021 11:49:20 +0100
+Subject: [PATCH] PCI: Let pcibios_root_bridge_prepare() access bridge->windows
+
+When pci_register_host_bridge() is called, bridge->windows are already
+available. However these windows are being moved temporarily from there.
+
+To let pcibios_root_bridge_prepare() have access to these windows, move the
+windows movement after calling this function. This is useful for the MIPS
+ralink mt7621 platform so it can set up I/O coherence units and avoid
+custom MIPS code in the mt7621 PCIe controller driver.
+
+Link: https://lore.kernel.org/r/20211207104924.21327-2-sergio.paracuellos@gmail.com
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+---
+
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -898,8 +898,6 @@ static int pci_register_host_bridge(stru
+ 
+ 	bridge->bus = bus;
+ 
+-	/* Temporarily move resources off the list */
+-	list_splice_init(&bridge->windows, &resources);
+ 	bus->sysdata = bridge->sysdata;
+ 	bus->ops = bridge->ops;
+ 	bus->number = bus->busn_res.start = bridge->busnr;
+@@ -925,6 +923,8 @@ static int pci_register_host_bridge(stru
+ 	if (err)
+ 		goto free;
+ 
++	/* Temporarily move resources off the list */
++	list_splice_init(&bridge->windows, &resources);
+ 	err = device_add(&bridge->dev);
+ 	if (err) {
+ 		put_device(&bridge->dev);
diff --git a/target/linux/ramips/patches-5.15/107-v6.2-PCI-mt7621-Add-sentinel-to-quirks-table.patch b/target/linux/ramips/patches-5.15/107-v6.2-PCI-mt7621-Add-sentinel-to-quirks-table.patch
new file mode 100644
index 00000000000000..c055f0096ddc55
--- /dev/null
+++ b/target/linux/ramips/patches-5.15/107-v6.2-PCI-mt7621-Add-sentinel-to-quirks-table.patch
@@ -0,0 +1,38 @@
+From 19098934f910b4d47cb30251dd39ffa57bef9523 Mon Sep 17 00:00:00 2001
+From: John Thomson <git@johnthomson.fastmail.com.au>
+Date: Tue, 6 Dec 2022 06:46:45 +1000
+Subject: [PATCH] PCI: mt7621: Add sentinel to quirks table
+
+Current driver is missing a sentinel in the struct soc_device_attribute
+array, which causes an oops when assessed by the
+soc_device_match(mt7621_pcie_quirks_match) call.
+
+This was only exposed once the CONFIG_SOC_MT7621 mt7621 soc_dev_attr
+was fixed to register the SOC as a device, in:
+
+commit 7c18b64bba3b ("mips: ralink: mt7621: do not use kzalloc too early")
+
+Fix it by adding the required sentinel.
+
+Link: https://lore.kernel.org/lkml/26ebbed1-0fe9-4af9-8466-65f841d0b382@app.fastmail.com
+Link: https://lore.kernel.org/r/20221205204645.301301-1-git@johnthomson.fastmail.com.au
+Fixes: b483b4e4d3f6 ("staging: mt7621-pci: add quirks for 'E2' revision using 'soc_device_attribute'")
+Signed-off-by: John Thomson <git@johnthomson.fastmail.com.au>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Acked-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+---
+ drivers/pci/controller/pcie-mt7621.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/controller/pcie-mt7621.c
++++ b/drivers/pci/controller/pcie-mt7621.c
+@@ -471,7 +471,8 @@ static int mt7621_pcie_register_host(str
+ }
+ 
+ static const struct soc_device_attribute mt7621_pcie_quirks_match[] = {
+-	{ .soc_id = "mt7621", .revision = "E2" }
++	{ .soc_id = "mt7621", .revision = "E2" },
++	{ /* sentinel */ }
+ };
+ 
+ static int mt7621_pcie_probe(struct platform_device *pdev)
diff --git a/target/linux/ramips/patches-5.15/108-v6.3-PCI-mt7621-Delay-phy-ports-initialization.patch b/target/linux/ramips/patches-5.15/108-v6.3-PCI-mt7621-Delay-phy-ports-initialization.patch
new file mode 100644
index 00000000000000..de1d4cfc123a1f
--- /dev/null
+++ b/target/linux/ramips/patches-5.15/108-v6.3-PCI-mt7621-Delay-phy-ports-initialization.patch
@@ -0,0 +1,52 @@
+From 0cb2a8f3456ff1cc51d571e287a48e8fddc98ec2 Mon Sep 17 00:00:00 2001
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Date: Sat, 31 Dec 2022 08:40:41 +0100
+Subject: PCI: mt7621: Delay phy ports initialization
+
+Some devices like ZBT WE1326 and ZBT WF3526-P and some Netgear models need
+to delay phy port initialization after calling the mt7621_pcie_init_port()
+driver function to get into reliable boots for both warm and hard resets.
+
+The delay required to detect the ports seems to be in the range [75-100]
+milliseconds.
+
+If the ports are not detected the controller is not functional.
+
+There is no datasheet or something similar to really understand why this
+extra delay is needed only for these devices and it is not for most of
+the boards that are built on mt7621 SoC.
+
+This issue has been reported by openWRT community and the complete
+discussion is in [0]. The 100 milliseconds delay has been tested in all
+devices to validate it.
+
+Add the extra 100 milliseconds delay to fix the issue.
+
+[0]: https://github.com/openwrt/openwrt/pull/11220
+
+Link: https://lore.kernel.org/r/20221231074041.264738-1-sergio.paracuellos@gmail.com
+Fixes: 2bdd5238e756 ("PCI: mt7621: Add MediaTek MT7621 PCIe host controller driver")
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+---
+ drivers/pci/controller/pcie-mt7621.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/pci/controller/pcie-mt7621.c
++++ b/drivers/pci/controller/pcie-mt7621.c
+@@ -58,6 +58,7 @@
+ #define PCIE_PORT_LINKUP		BIT(0)
+ #define PCIE_PORT_CNT			3
+ 
++#define INIT_PORTS_DELAY_MS		100
+ #define PERST_DELAY_MS			100
+ 
+ /**
+@@ -374,6 +375,7 @@ static int mt7621_pcie_init_ports(struct
+ 		}
+ 	}
+ 
++	msleep(INIT_PORTS_DELAY_MS);
+ 	mt7621_pcie_reset_ep_deassert(pcie);
+ 
+ 	tmp = NULL;
diff --git a/target/linux/ramips/patches-5.15/109-drivers-mt7621-dma-handle-error-from-device_reset.patch b/target/linux/ramips/patches-5.15/109-drivers-mt7621-dma-handle-error-from-device_reset.patch
new file mode 100644
index 00000000000000..a4543337ff42c8
--- /dev/null
+++ b/target/linux/ramips/patches-5.15/109-drivers-mt7621-dma-handle-error-from-device_reset.patch
@@ -0,0 +1,31 @@
+From 3f6dfa25128e428acfba20792bc7506d58806baa Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Sun, 7 May 2023 01:06:17 +0200
+Subject: [PATCH] drivers: mt7621-dma: handle error from device_reset
+
+Handle error from device reset to fix compilation warning.
+Fix compilation warning:
+drivers/staging/mt7621-dma/hsdma-mt7621.c: In function 'mtk_hsdma_probe':
+drivers/staging/mt7621-dma/hsdma-mt7621.c:685:9: error: ignoring return value of 'device_reset' declared with attribute 'warn_unused_result' [-Werror=unused-result]
+  685 |         device_reset(&pdev->dev);
+      |         ^~~~~~~~~~~~~~~~~~~~~~~~
+cc1: all warnings being treated as errors
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/staging/mt7621-dma/hsdma-mt7621.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/mt7621-dma/hsdma-mt7621.c
++++ b/drivers/staging/mt7621-dma/hsdma-mt7621.c
+@@ -682,7 +682,9 @@ static int mtk_hsdma_probe(struct platfo
+ 		return ret;
+ 	}
+ 
+-	device_reset(&pdev->dev);
++	ret = device_reset(&pdev->dev);
++	if (ret)
++		dev_err(&pdev->dev, "failed to reset device\n");
+ 
+ 	dd = &hsdma->ddev;
+ 	dma_cap_set(DMA_MEMCPY, dd->cap_mask);
diff --git a/target/linux/ramips/patches-5.15/405-mtd-spi-nor-Add-support-for-BoHong-bh25q128as.patch b/target/linux/ramips/patches-5.15/405-mtd-spi-nor-Add-support-for-BoHong-bh25q128as.patch
index b997a1d480b18a..4fd05fe64ed74e 100644
--- a/target/linux/ramips/patches-5.15/405-mtd-spi-nor-Add-support-for-BoHong-bh25q128as.patch
+++ b/target/linux/ramips/patches-5.15/405-mtd-spi-nor-Add-support-for-BoHong-bh25q128as.patch
@@ -55,7 +55,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 +};
 --- a/drivers/mtd/spi-nor/core.c
 +++ b/drivers/mtd/spi-nor/core.c
-@@ -1841,6 +1841,7 @@ int spi_nor_sr2_bit7_quad_enable(struct
+@@ -1843,6 +1843,7 @@ int spi_nor_sr2_bit7_quad_enable(struct
  
  static const struct spi_nor_manufacturer *manufacturers[] = {
  	&spi_nor_atmel,
diff --git a/target/linux/ramips/patches-5.15/700-net-ethernet-mediatek-support-net-labels.patch b/target/linux/ramips/patches-5.15/700-net-ethernet-mediatek-support-net-labels.patch
index 43526f3c4a76fa..e57e6fa83b25ce 100644
--- a/target/linux/ramips/patches-5.15/700-net-ethernet-mediatek-support-net-labels.patch
+++ b/target/linux/ramips/patches-5.15/700-net-ethernet-mediatek-support-net-labels.patch
@@ -14,7 +14,7 @@ Signed-off-by: René van Dorst <opensource@vdorst.com>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -3230,6 +3230,7 @@ static const struct net_device_ops mtk_n
+@@ -4633,6 +4633,7 @@ static const struct net_device_ops mtk_n
  
  static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np)
  {
@@ -22,9 +22,9 @@ Signed-off-by: René van Dorst <opensource@vdorst.com>
  	const __be32 *_id = of_get_property(np, "reg", NULL);
  	phy_interface_t phy_mode;
  	struct phylink *phylink;
-@@ -3349,6 +3350,9 @@ static int mtk_add_mac(struct mtk_eth *e
- 	else
- 		eth->netdev[id]->max_mtu = MTK_MAX_RX_LENGTH_2K - MTK_RX_ETH_HLEN;
+@@ -4791,6 +4792,9 @@ static int mtk_add_mac(struct mtk_eth *e
+ 		register_netdevice_notifier(&mac->device_notifier);
+ 	}
  
 +	if (name)
 +		strlcpy(eth->netdev[id]->name, name, IFNAMSIZ);
diff --git a/target/linux/ramips/patches-5.15/720-Revert-net-phy-simplify-phy_link_change-arguments.patch b/target/linux/ramips/patches-5.15/720-Revert-net-phy-simplify-phy_link_change-arguments.patch
index 94e99da015e1b8..87f319abb56130 100644
--- a/target/linux/ramips/patches-5.15/720-Revert-net-phy-simplify-phy_link_change-arguments.patch
+++ b/target/linux/ramips/patches-5.15/720-Revert-net-phy-simplify-phy_link_change-arguments.patch
@@ -16,7 +16,7 @@ still required by target/linux/ramips/files/drivers/net/ethernet/ralink/mdio.c
 
 --- a/drivers/net/phy/phy.c
 +++ b/drivers/net/phy/phy.c
-@@ -59,13 +59,13 @@ static const char *phy_state_to_str(enum
+@@ -71,13 +71,13 @@ static void phy_process_state_change(str
  
  static void phy_link_up(struct phy_device *phydev)
  {
@@ -33,7 +33,7 @@ still required by target/linux/ramips/files/drivers/net/ethernet/ralink/mdio.c
  	phy_led_trigger_change_speed(phydev);
  }
  
-@@ -551,7 +551,7 @@ int phy_start_cable_test(struct phy_devi
+@@ -563,7 +563,7 @@ int phy_start_cable_test(struct phy_devi
  		goto out;
  
  	/* Mark the carrier down until the test is complete */
@@ -42,7 +42,7 @@ still required by target/linux/ramips/files/drivers/net/ethernet/ralink/mdio.c
  
  	netif_testing_on(dev);
  	err = phydev->drv->cable_test_start(phydev);
-@@ -622,7 +622,7 @@ int phy_start_cable_test_tdr(struct phy_
+@@ -634,7 +634,7 @@ int phy_start_cable_test_tdr(struct phy_
  		goto out;
  
  	/* Mark the carrier down until the test is complete */
@@ -51,7 +51,7 @@ still required by target/linux/ramips/files/drivers/net/ethernet/ralink/mdio.c
  
  	netif_testing_on(dev);
  	err = phydev->drv->cable_test_tdr_start(phydev, config);
-@@ -694,7 +694,7 @@ static int phy_check_link_status(struct
+@@ -706,7 +706,7 @@ static int phy_check_link_status(struct
  		phy_link_up(phydev);
  	} else if (!phydev->link && phydev->state != PHY_NOLINK) {
  		phydev->state = PHY_NOLINK;
@@ -60,7 +60,7 @@ still required by target/linux/ramips/files/drivers/net/ethernet/ralink/mdio.c
  	}
  
  	return 0;
-@@ -1177,7 +1177,7 @@ void phy_state_machine(struct work_struc
+@@ -1192,7 +1192,7 @@ void phy_state_machine(struct work_struc
  	case PHY_HALTED:
  		if (phydev->link) {
  			phydev->link = 0;
@@ -71,7 +71,7 @@ still required by target/linux/ramips/files/drivers/net/ethernet/ralink/mdio.c
  		break;
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
-@@ -1029,14 +1029,16 @@ struct phy_device *phy_find_first(struct
+@@ -1035,14 +1035,16 @@ struct phy_device *phy_find_first(struct
  }
  EXPORT_SYMBOL(phy_find_first);
  
@@ -95,7 +95,7 @@ still required by target/linux/ramips/files/drivers/net/ethernet/ralink/mdio.c
  		phydev->mii_ts->link_state(phydev->mii_ts, phydev);
 --- a/drivers/net/phy/phylink.c
 +++ b/drivers/net/phy/phylink.c
-@@ -1323,7 +1323,8 @@ void phylink_destroy(struct phylink *pl)
+@@ -1322,7 +1322,8 @@ void phylink_destroy(struct phylink *pl)
  }
  EXPORT_SYMBOL_GPL(phylink_destroy);
  
@@ -107,7 +107,7 @@ still required by target/linux/ramips/files/drivers/net/ethernet/ralink/mdio.c
  	bool tx_pause, rx_pause;
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -703,7 +703,7 @@ struct phy_device {
+@@ -706,7 +706,7 @@ struct phy_device {
  	u8 mdix;
  	u8 mdix_ctrl;
  
diff --git a/target/linux/ramips/patches-5.15/721-NET-no-auto-carrier-off-support.patch b/target/linux/ramips/patches-5.15/721-NET-no-auto-carrier-off-support.patch
index 365bdc688020a1..5205a8f9367be4 100644
--- a/target/linux/ramips/patches-5.15/721-NET-no-auto-carrier-off-support.patch
+++ b/target/linux/ramips/patches-5.15/721-NET-no-auto-carrier-off-support.patch
@@ -11,7 +11,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 
 --- a/drivers/net/phy/phy.c
 +++ b/drivers/net/phy/phy.c
-@@ -694,7 +694,10 @@ static int phy_check_link_status(struct
+@@ -706,7 +706,10 @@ static int phy_check_link_status(struct
  		phy_link_up(phydev);
  	} else if (!phydev->link && phydev->state != PHY_NOLINK) {
  		phydev->state = PHY_NOLINK;
@@ -23,7 +23,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	}
  
  	return 0;
-@@ -1177,7 +1180,10 @@ void phy_state_machine(struct work_struc
+@@ -1192,7 +1195,10 @@ void phy_state_machine(struct work_struc
  	case PHY_HALTED:
  		if (phydev->link) {
  			phydev->link = 0;
@@ -37,7 +37,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  		break;
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -620,6 +620,7 @@ struct phy_device {
+@@ -622,6 +622,7 @@ struct phy_device {
  	unsigned downshifted_rate:1;
  	unsigned is_on_sfp_module:1;
  	unsigned mac_managed_pm:1;
diff --git a/target/linux/ramips/patches-5.15/810-uvc-add-iPassion-iP2970-support.patch b/target/linux/ramips/patches-5.15/810-uvc-add-iPassion-iP2970-support.patch
index ae7e886f9492bc..88809ae68d0ce4 100644
--- a/target/linux/ramips/patches-5.15/810-uvc-add-iPassion-iP2970-support.patch
+++ b/target/linux/ramips/patches-5.15/810-uvc-add-iPassion-iP2970-support.patch
@@ -13,7 +13,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 
 --- a/drivers/media/usb/uvc/uvc_driver.c
 +++ b/drivers/media/usb/uvc/uvc_driver.c
-@@ -3164,6 +3164,18 @@ static const struct usb_device_id uvc_id
+@@ -3158,6 +3158,18 @@ static const struct usb_device_id uvc_id
  	  .bInterfaceSubClass	= 1,
  	  .bInterfaceProtocol	= 0,
  	  .driver_info		= UVC_INFO_META(V4L2_META_FMT_D4XX) },
@@ -34,7 +34,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	{ USB_INTERFACE_INFO(USB_CLASS_VIDEO, 1, UVC_PC_PROTOCOL_15) },
 --- a/drivers/media/usb/uvc/uvc_status.c
 +++ b/drivers/media/usb/uvc/uvc_status.c
-@@ -223,6 +223,7 @@ static void uvc_status_complete(struct u
+@@ -224,6 +224,7 @@ static void uvc_status_complete(struct u
  			if (uvc_event_control(urb, status, len))
  				/* The URB will be resubmitted in work context. */
  				return;
@@ -42,7 +42,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  			break;
  		}
  
-@@ -271,6 +272,7 @@ int uvc_status_init(struct uvc_device *d
+@@ -272,6 +273,7 @@ int uvc_status_init(struct uvc_device *d
  	}
  
  	pipe = usb_rcvintpipe(dev->udev, ep->desc.bEndpointAddress);
@@ -214,7 +214,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	/* Mark the buffer as done if the EOF marker is set. */
  	if (data[1] & UVC_STREAM_EOF && buf->bytesused != 0) {
  		uvc_dbg(stream->dev, FRAME, "Frame complete (EOF found)\n");
-@@ -1799,6 +1944,8 @@ static int uvc_init_video_isoc(struct uv
+@@ -1801,6 +1946,8 @@ static int uvc_init_video_isoc(struct uv
  	if (npackets == 0)
  		return -ENOMEM;
  
@@ -225,18 +225,16 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	for_each_uvc_urb(uvc_urb, stream) {
 --- a/drivers/media/usb/uvc/uvcvideo.h
 +++ b/drivers/media/usb/uvc/uvcvideo.h
-@@ -209,7 +209,9 @@
- #define UVC_QUIRK_RESTORE_CTRLS_ON_INIT	0x00000400
+@@ -210,6 +210,8 @@
  #define UVC_QUIRK_FORCE_Y8		0x00000800
  #define UVC_QUIRK_FORCE_BPP		0x00001000
--
-+#define UVC_QUIRK_MOTION		0x00001000
-+#define UVC_QUIRK_SINGLE_ISO		0x00002000
-+ 
+ #define UVC_QUIRK_WAKE_AUTOSUSPEND	0x00002000
++#define UVC_QUIRK_MOTION		0x00004000
++#define UVC_QUIRK_SINGLE_ISO		0x00008000
+ 
  /* Format flags */
  #define UVC_FMT_FLAG_COMPRESSED		0x00000001
- #define UVC_FMT_FLAG_STREAM		0x00000002
-@@ -700,6 +702,7 @@ struct uvc_device {
+@@ -701,6 +703,7 @@ struct uvc_device {
  	u8 *status;
  	struct input_dev *input;
  	char input_phys[64];
diff --git a/target/linux/ramips/patches-5.15/821-SPI-ralink-add-Ralink-SoC-spi-driver.patch b/target/linux/ramips/patches-5.15/821-SPI-ralink-add-Ralink-SoC-spi-driver.patch
index 342350d0c6afea..fa119ab211ecc0 100644
--- a/target/linux/ramips/patches-5.15/821-SPI-ralink-add-Ralink-SoC-spi-driver.patch
+++ b/target/linux/ramips/patches-5.15/821-SPI-ralink-add-Ralink-SoC-spi-driver.patch
@@ -16,7 +16,7 @@ Acked-by: John Crispin <blogic@openwrt.org>
 
 --- a/drivers/spi/Kconfig
 +++ b/drivers/spi/Kconfig
-@@ -719,6 +719,12 @@ config SPI_QCOM_GENI
+@@ -718,6 +718,12 @@ config SPI_QCOM_GENI
  	  This driver can also be built as a module.  If so, the module
  	  will be called spi-geni-qcom.
  
@@ -41,7 +41,7 @@ Acked-by: John Crispin <blogic@openwrt.org>
  obj-$(CONFIG_SPI_S3C64XX)		+= spi-s3c64xx.o
 --- /dev/null
 +++ b/drivers/spi/spi-rt2880.c
-@@ -0,0 +1,530 @@
+@@ -0,0 +1,535 @@
 +/*
 + * spi-rt2880.c -- Ralink RT288x/RT305x SPI controller driver
 + *
@@ -514,8 +514,13 @@ Acked-by: John Crispin <blogic@openwrt.org>
 +	rs->base = base;
 +	rs->clk = clk;
 +
-+	if (atomic_inc_return(&hw_reset_count) == 1)
-+		device_reset(&pdev->dev);
++	if (atomic_inc_return(&hw_reset_count) == 1) {
++		ret = device_reset(&pdev->dev);
++		if (ret) {
++			dev_err(&pdev->dev, "device_reset error.\n");
++			goto err_master;
++		}
++	}
 +
 +	ret = devm_spi_register_master(&pdev->dev, master);
 +	if (ret < 0) {
diff --git a/target/linux/ramips/patches-5.15/825-i2c-MIPS-adds-ralink-I2C-driver.patch b/target/linux/ramips/patches-5.15/825-i2c-MIPS-adds-ralink-I2C-driver.patch
index 5a4491c95a6974..da6f8e5a1e1e78 100644
--- a/target/linux/ramips/patches-5.15/825-i2c-MIPS-adds-ralink-I2C-driver.patch
+++ b/target/linux/ramips/patches-5.15/825-i2c-MIPS-adds-ralink-I2C-driver.patch
@@ -69,7 +69,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  obj-$(CONFIG_I2C_QUP)		+= i2c-qup.o
 --- /dev/null
 +++ b/drivers/i2c/busses/i2c-ralink.c
-@@ -0,0 +1,435 @@
+@@ -0,0 +1,440 @@
 +/*
 + * drivers/i2c/busses/i2c-ralink.c
 + *
@@ -245,7 +245,12 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +
 +static void rt_i2c_reset(struct rt_i2c *i2c)
 +{
-+	device_reset(i2c->adap.dev.parent);
++	int ret;
++
++	ret = device_reset(i2c->adap.dev.parent);
++	if (ret)
++		dev_err(i2c->dev, "Failed to reset device");
++
 +	barrier();
 +	rt_i2c_w32(i2c, i2c->clk_div, REG_CLKDIV_REG);
 +}
diff --git a/target/linux/ramips/patches-5.15/830-mmc-MIPS-ralink-add-sdhci-for-mt7620a-SoC.patch b/target/linux/ramips/patches-5.15/830-mmc-MIPS-ralink-add-sdhci-for-mt7620a-SoC.patch
index 1992850d814ff7..21538859a55713 100644
--- a/target/linux/ramips/patches-5.15/830-mmc-MIPS-ralink-add-sdhci-for-mt7620a-SoC.patch
+++ b/target/linux/ramips/patches-5.15/830-mmc-MIPS-ralink-add-sdhci-for-mt7620a-SoC.patch
@@ -25,7 +25,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 
 --- a/drivers/mmc/host/Kconfig
 +++ b/drivers/mmc/host/Kconfig
-@@ -1091,3 +1091,5 @@ config MMC_OWL
+@@ -1092,3 +1092,5 @@ config MMC_OWL
  
  config MMC_SDHCI_EXTERNAL_DMA
  	bool
diff --git a/target/linux/ramips/patches-5.15/835-asoc-add-mt7620-support.patch b/target/linux/ramips/patches-5.15/835-asoc-add-mt7620-support.patch
index 633c5120e096f9..551fdd8b3c760b 100644
--- a/target/linux/ramips/patches-5.15/835-asoc-add-mt7620-support.patch
+++ b/target/linux/ramips/patches-5.15/835-asoc-add-mt7620-support.patch
@@ -60,7 +60,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +obj-$(CONFIG_SND_RALINK_SOC_I2S) += snd-soc-ralink-i2s.o
 --- /dev/null
 +++ b/sound/soc/ralink/ralink-i2s.c
-@@ -0,0 +1,966 @@
+@@ -0,0 +1,970 @@
 +/*
 + *  Copyright (C) 2010, Lars-Peter Clausen <lars@metafoo.de>
 + *  Copyright (C) 2016 Michael Lee <igvtee@gmail.com>
@@ -945,7 +945,11 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +
 +	ralink_i2s_init_dma_data(i2s, res);
 +
-+	device_reset(&pdev->dev);
++	ret = device_reset(&pdev->dev);
++	if (ret) {
++		dev_err(&pdev->dev, "failed to reset device\n");
++		goto err_clk_disable;
++	}
 +
 +	ret = ralink_i2s_debugfs_create(i2s);
 +	if (ret) {
diff --git a/target/linux/ramips/patches-5.15/845-pwm-add-mediatek-support.patch b/target/linux/ramips/patches-5.15/845-pwm-add-mediatek-support.patch
index 7792b7d63cf56d..06074d6031028e 100644
--- a/target/linux/ramips/patches-5.15/845-pwm-add-mediatek-support.patch
+++ b/target/linux/ramips/patches-5.15/845-pwm-add-mediatek-support.patch
@@ -41,7 +41,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  obj-$(CONFIG_PWM_NTXEC)		+= pwm-ntxec.o
 --- /dev/null
 +++ b/drivers/pwm/pwm-mediatek-ramips.c
-@@ -0,0 +1,173 @@
+@@ -0,0 +1,175 @@
 +/*
 + * Mediatek Pulse Width Modulator driver
 + *
@@ -190,7 +190,9 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +	for (i = 0; i < NUM_PWM; i++)
 +		pwm_disable(&pc->chip.pwms[i]);
 +
-+	return pwmchip_remove(&pc->chip);
++	pwmchip_remove(&pc->chip);
++
++	return 0;
 +}
 +
 +static const struct of_device_id mtk_pwm_of_match[] = {
diff --git a/target/linux/ramips/patches-5.15/850-awake-rt305x-dwc2-controller.patch b/target/linux/ramips/patches-5.15/850-awake-rt305x-dwc2-controller.patch
index 28f72a23ea75e3..3f2a524a75b276 100644
--- a/target/linux/ramips/patches-5.15/850-awake-rt305x-dwc2-controller.patch
+++ b/target/linux/ramips/patches-5.15/850-awake-rt305x-dwc2-controller.patch
@@ -1,6 +1,6 @@
 --- a/drivers/usb/dwc2/platform.c
 +++ b/drivers/usb/dwc2/platform.c
-@@ -510,6 +510,12 @@ static int dwc2_driver_probe(struct plat
+@@ -498,6 +498,12 @@ static int dwc2_driver_probe(struct plat
  	if (retval)
  		return retval;
  
diff --git a/target/linux/ramips/rt288x/config-5.15 b/target/linux/ramips/rt288x/config-5.15
index 07e839999eec4c..0e4afe367efdc3 100644
--- a/target/linux/ramips/rt288x/config-5.15
+++ b/target/linux/ramips/rt288x/config-5.15
@@ -17,6 +17,7 @@ CONFIG_CPU_HAS_DIEI=y
 CONFIG_CPU_HAS_PREFETCH=y
 CONFIG_CPU_HAS_RIXI=y
 CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_LITTLE_ENDIAN=y
 CONFIG_CPU_MIPS32=y
 # CONFIG_CPU_MIPS32_R1 is not set
 CONFIG_CPU_MIPS32_R2=y
@@ -102,6 +103,7 @@ CONFIG_MODULES_USE_ELF_REL=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_PHYSMAP=y
 CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPI_NOR_USE_VARIABLE_ERASE=y
 CONFIG_MTD_SPLIT_LZMA_FW=y
 CONFIG_MTD_SPLIT_UIMAGE_FW=y
 CONFIG_MTD_SPLIT_WRGG_FW=y
@@ -133,6 +135,7 @@ CONFIG_PHYLIB=y
 # CONFIG_PHY_MT7621_PCI is not set
 # CONFIG_PHY_RALINK_USB is not set
 CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_AW9523 is not set
 CONFIG_PINCTRL_RALINK=y
 CONFIG_PINCTRL_RT288X=y
 # CONFIG_PINCTRL_SINGLE is not set
diff --git a/target/linux/ramips/rt288x/target.mk b/target/linux/ramips/rt288x/target.mk
index 814ac97e8953ed..87e10ff2fd9140 100644
--- a/target/linux/ramips/rt288x/target.mk
+++ b/target/linux/ramips/rt288x/target.mk
@@ -7,7 +7,7 @@ BOARDNAME:=RT288x based boards
 FEATURES+=small_flash
 CPU_TYPE:=24kc
 
-DEFAULT_PACKAGES += kmod-rt2800-soc wpad-basic-wolfssl swconfig
+DEFAULT_PACKAGES += kmod-rt2800-soc wpad-basic-mbedtls swconfig
 
 define Target/Description
 	Build firmware images for Ralink RT288x based boards.
diff --git a/target/linux/ramips/rt305x/config-5.15 b/target/linux/ramips/rt305x/config-5.15
index d4833b61b06d92..fccc7370a50304 100644
--- a/target/linux/ramips/rt305x/config-5.15
+++ b/target/linux/ramips/rt305x/config-5.15
@@ -19,6 +19,7 @@ CONFIG_CPU_HAS_DIEI=y
 CONFIG_CPU_HAS_PREFETCH=y
 CONFIG_CPU_HAS_RIXI=y
 CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_LITTLE_ENDIAN=y`
 CONFIG_CPU_MIPS32=y
 # CONFIG_CPU_MIPS32_R1 is not set
 CONFIG_CPU_MIPS32_R2=y
@@ -105,7 +106,7 @@ CONFIG_MODULES_USE_ELF_REL=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_PHYSMAP=y
 CONFIG_MTD_SPI_NOR=y
-CONFIG_MTD_SPI_NOR_USE_4K_SECTORS=y
+CONFIG_MTD_SPI_NOR_USE_VARIABLE_ERASE=y
 CONFIG_MTD_SPLIT_JIMAGE_FW=y
 CONFIG_MTD_SPLIT_SEAMA_FW=y
 CONFIG_MTD_SPLIT_UIMAGE_FW=y
@@ -133,6 +134,7 @@ CONFIG_PHYLIB=y
 # CONFIG_PHY_MT7621_PCI is not set
 CONFIG_PHY_RALINK_USB=y
 CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_AW9523 is not set
 CONFIG_PINCTRL_RALINK=y
 CONFIG_PINCTRL_RT305X=y
 # CONFIG_PINCTRL_SINGLE is not set
diff --git a/target/linux/ramips/rt305x/target.mk b/target/linux/ramips/rt305x/target.mk
index 27ad670ca440a7..759ad2d4562e4d 100644
--- a/target/linux/ramips/rt305x/target.mk
+++ b/target/linux/ramips/rt305x/target.mk
@@ -7,7 +7,7 @@ BOARDNAME:=RT3x5x/RT5350 based boards
 FEATURES+=usb ramdisk small_flash
 CPU_TYPE:=24kc
 
-DEFAULT_PACKAGES += kmod-rt2800-soc wpad-basic-wolfssl swconfig
+DEFAULT_PACKAGES += kmod-rt2800-soc wpad-basic-mbedtls swconfig
 
 define Target/Description
 	Build firmware images for Ralink RT3x5x/RT5350 based boards.
diff --git a/target/linux/ramips/rt3883/config-5.15 b/target/linux/ramips/rt3883/config-5.15
index 8637885254c1a2..3d412e8b9d9587 100644
--- a/target/linux/ramips/rt3883/config-5.15
+++ b/target/linux/ramips/rt3883/config-5.15
@@ -18,6 +18,7 @@ CONFIG_CPU_HAS_DIEI=y
 CONFIG_CPU_HAS_PREFETCH=y
 CONFIG_CPU_HAS_RIXI=y
 CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_LITTLE_ENDIAN=y
 CONFIG_CPU_MIPS32=y
 # CONFIG_CPU_MIPS32_R1 is not set
 CONFIG_CPU_MIPS32_R2=y
@@ -103,7 +104,7 @@ CONFIG_MODULES_USE_ELF_REL=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_PHYSMAP=y
 CONFIG_MTD_SPI_NOR=y
-CONFIG_MTD_SPI_NOR_USE_4K_SECTORS=y
+CONFIG_MTD_SPI_NOR_USE_VARIABLE_ERASE=y
 CONFIG_MTD_SPLIT_SEAMA_FW=y
 CONFIG_MTD_SPLIT_UIMAGE_FW=y
 CONFIG_NEED_DMA_MAP_STATE=y
@@ -133,6 +134,7 @@ CONFIG_PHYLIB=y
 # CONFIG_PHY_MT7621_PCI is not set
 CONFIG_PHY_RALINK_USB=y
 CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_AW9523 is not set
 CONFIG_PINCTRL_RALINK=y
 CONFIG_PINCTRL_RT3883=y
 # CONFIG_PINCTRL_SINGLE is not set
diff --git a/target/linux/ramips/rt3883/target.mk b/target/linux/ramips/rt3883/target.mk
index ff878a0a597bea..c1039625f11c3f 100644
--- a/target/linux/ramips/rt3883/target.mk
+++ b/target/linux/ramips/rt3883/target.mk
@@ -7,7 +7,7 @@ BOARDNAME:=RT3662/RT3883 based boards
 FEATURES+=usb pci small_flash
 CPU_TYPE:=74kc
 
-DEFAULT_PACKAGES += kmod-rt2800-pci kmod-rt2800-soc wpad-basic-wolfssl swconfig
+DEFAULT_PACKAGES += kmod-rt2800-pci kmod-rt2800-soc wpad-basic-mbedtls swconfig
 
 define Target/Description
 	Build firmware images for Ralink RT3662/RT3883 based boards.
diff --git a/target/linux/realtek/Makefile b/target/linux/realtek/Makefile
index 037ba7ac7db893..cd86bdc11e6181 100644
--- a/target/linux/realtek/Makefile
+++ b/target/linux/realtek/Makefile
@@ -9,7 +9,7 @@ DEVICE_TYPE:=basic
 FEATURES:=ramdisk squashfs
 SUBTARGETS:=rtl838x rtl839x rtl930x rtl931x
 
-KERNEL_PATCHVER:=5.10
+KERNEL_PATCHVER:=5.15
 
 define Target/Description
 	Build firmware images for Realtek RTL83xx based boards.
@@ -17,8 +17,17 @@ endef
 
 include $(INCLUDE_DIR)/target.mk
 
-DEFAULT_PACKAGES += uboot-envtools ethtool kmod-gpio-button-hotplug \
-	firewall4 nftables kmod-nft-offload odhcp6c \
-	ip-full ip-bridge tc-bpf
+DEFAULT_PACKAGES += \
+	ethtool \
+	firewall4 \
+	ip-bridge \
+	ip-full \
+	kmod-gpio-button-hotplug \
+	kmod-nft-offload \
+	nftables \
+	odhcp6c \
+	tc-bpf \
+	uboot-envtools \
+
 
 $(eval $(call BuildTarget))
diff --git a/target/linux/realtek/dts-5.15/rtl8380_d-link_dgs-1210-10mp-f.dts b/target/linux/realtek/dts-5.15/rtl8380_d-link_dgs-1210-10mp-f.dts
new file mode 100644
index 00000000000000..664cab599981ab
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8380_d-link_dgs-1210-10mp-f.dts
@@ -0,0 +1,140 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl838x.dtsi"
+#include "rtl83xx_d-link_dgs-1210_common.dtsi"
+#include "rtl83xx_d-link_dgs-1210_gpio.dtsi"
+
+/ {
+	compatible = "d-link,dgs-1210-10mp-f", "realtek,rtl8382-soc", "realtek,rtl838x-soc";
+
+	model = "D-Link DGS-1210-10MP F";
+
+	/* i2c for sfp port9 */
+	i2c0: i2c-gpio-0 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 6 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 7 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp0: sfp-p9 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c0>;
+		los-gpio = <&gpio1 9 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 8 GPIO_ACTIVE_LOW>;
+		tx-disable-gpio = <&gpio1 11 GPIO_ACTIVE_HIGH>;
+	};
+
+	/* i2c for sfp port10 */
+	i2c1: i2c-gpio-1 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 1 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 2 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp1: sfp-p10 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c1>;
+		los-gpio = <&gpio1 4 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 3 GPIO_ACTIVE_LOW>;
+		tx-disable-gpio = <&gpio1 12 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&leds {
+	link_act {
+		label = "green:link_act";
+		gpios = <&gpio1 28 GPIO_ACTIVE_LOW>;
+	};
+
+	poe {
+		label = "green:poe";
+		gpios = <&gpio1 29 GPIO_ACTIVE_LOW>;
+	};
+
+	poe_max {
+		label = "yellow:poe_max";
+		gpios = <&gpio1 27 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&keys {
+	mode {
+		label = "mode";
+		gpios = <&gpio1 30 GPIO_ACTIVE_LOW>;
+		linux,code = <KEY_LIGHTS_TOGGLE>;
+	};
+};
+
+&uart1 {
+	status = "okay";
+};
+
+&ethernet0 {
+	mdio: mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		INTERNAL_PHY(8)
+		INTERNAL_PHY(9)
+		INTERNAL_PHY(10)
+		INTERNAL_PHY(11)
+		INTERNAL_PHY(12)
+		INTERNAL_PHY(13)
+		INTERNAL_PHY(14)
+		INTERNAL_PHY(15)
+		INTERNAL_PHY(24)
+		INTERNAL_PHY(26)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(8, 1, internal)
+		SWITCH_PORT(9, 2, internal)
+		SWITCH_PORT(10, 3, internal)
+		SWITCH_PORT(11, 4, internal)
+		SWITCH_PORT(12, 5, internal)
+		SWITCH_PORT(13, 6, internal)
+		SWITCH_PORT(14, 7, internal)
+		SWITCH_PORT(15, 8, internal)
+
+		port@24 {
+			reg = <24>;
+			label = "lan9";
+			phy-handle = <&phy24>;
+			phy-mode = "1000base-x";
+			managed = "in-band-status";
+			sfp = <&sfp0>;
+		};
+
+		port@26 {
+			reg = <26>;
+			label = "lan10";
+			phy-handle = <&phy26>;
+			phy-mode = "1000base-x";
+			managed = "in-band-status";
+			sfp = <&sfp1>;
+		};
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8380_engenius_ews2910p.dts b/target/linux/realtek/dts-5.15/rtl8380_engenius_ews2910p.dts
new file mode 100644
index 00000000000000..9b5ddb5ed4110f
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8380_engenius_ews2910p.dts
@@ -0,0 +1,229 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl838x.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "engenius,ews2910p", "realtek,rtl838x-soc";
+	model = "EnGenius EWS2910P";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_fault;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x0 0x10000000>;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio0 11 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		led_mode {
+			label = "led-mode";
+			gpios = <&gpio0 13 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+		};
+	};
+
+	gpio1: rtl8231-gpio {
+		compatible = "realtek,rtl8231-gpio";
+		#gpio-cells = <2>;
+		gpio-controller;
+		indirect-access-bus-id = <0>;
+
+		poe_enable {
+			gpio-hog;
+			gpios = <1 GPIO_ACTIVE_HIGH>;
+			output-high;
+			line-name = "poe-enable";
+		};
+
+		sff_p9_gpios {
+			gpio-hog;
+			gpios = < 6 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>,
+				< 11 GPIO_ACTIVE_HIGH>, /* los-gpio */
+				< 12 GPIO_ACTIVE_LOW>;   /* mod-def0-gpio */
+			input;
+			line-name = "sff-p9-gpios";
+		};
+	};
+
+	gpio-export {
+		compatible = "gpio-export";
+
+		sff-p9-tx-disable {
+			gpio-export,name = "sff-p9-tx-disable";
+			gpio-export,output = <1>;
+			gpios = <&gpio1 10 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	gpio-restart {
+		compatible = "gpio-restart";
+		gpios = <&gpio1 0 GPIO_ACTIVE_LOW>;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: led-0 {
+			label = "green:power";
+			gpios = <&gpio1 3 GPIO_ACTIVE_LOW>;
+		};
+
+		led_lan_mode: led-1 {
+			label = "green:lan-mode";
+			gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
+		};
+
+		led_fault: led-2 {
+			label = "amber:fault";
+			gpios = <&gpio1 2 GPIO_ACTIVE_LOW>;
+		};
+
+		led_poe_max: led-3 {
+			label = "amber:poe-max";
+			gpios = <&gpio0 12 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	i2c1: i2c-gpio-1 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 7 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 31 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+	sfp1: sfp-p10 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c1>;
+		tx-disable-gpio = <&gpio1 13 GPIO_ACTIVE_HIGH>;
+		los-gpio = <&gpio1 14 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 21 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x80000>;
+				read-only;
+			};
+			partition@80000 {
+				label = "u-boot-env";
+				reg = <0x80000 0x10000>;
+				read-only;
+			};
+			partition@90000 {
+				label = "u-boot-env2";
+				reg = <0x90000 0x10000>;
+			};
+			partition@a0000 {
+				label = "rootfs_data";
+				reg = <0xa0000 0xd60000>;
+			};
+			partition@e00000 {
+				label = "jffs2-log";
+				reg = <0xe00000 0x200000>;
+			};
+			partition@1000000 {
+				compatible = "openwrt,uimage";
+				label = "firmware";
+				reg = <0x1000000 0x800000>;
+				openwrt,ih-magic = <0x03802910>;
+			};
+			partition@1800000 {
+				label = "firmware2";
+				reg = <0x1800000 0x800000>;
+			};
+		};
+	};
+};
+
+&ethernet0 {
+	mdio: mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		INTERNAL_PHY(8)
+		INTERNAL_PHY(9)
+		INTERNAL_PHY(10)
+		INTERNAL_PHY(11)
+		INTERNAL_PHY(12)
+		INTERNAL_PHY(13)
+		INTERNAL_PHY(14)
+		INTERNAL_PHY(15)
+
+		INTERNAL_PHY(24)
+		INTERNAL_PHY(26)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(8, 1, internal)
+		SWITCH_PORT(9, 2, internal)
+		SWITCH_PORT(10, 3, internal)
+		SWITCH_PORT(11, 4, internal)
+		SWITCH_PORT(12, 5, internal)
+		SWITCH_PORT(13, 6, internal)
+		SWITCH_PORT(14, 7, internal)
+		SWITCH_PORT(15, 8, internal)
+
+		SWITCH_SFP_PORT(24, 9, 1000base-x)
+
+		port@26 {
+			reg = <26>;
+			label = "lan10";
+			phy-mode = "1000base-x";
+			phy-handle = <&phy26>;
+			managed = "in-band-status";
+			sfp = <&sfp1>;
+		};
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
+
+&uart1 {
+	status = "okay";
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8380_hpe_1920-8g.dts b/target/linux/realtek/dts-5.15/rtl8380_hpe_1920-8g.dts
new file mode 100644
index 00000000000000..6ddb2d8dcc6026
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8380_hpe_1920-8g.dts
@@ -0,0 +1,115 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl838x.dtsi"
+#include "rtl838x_hpe_1920.dtsi"
+
+/ {
+	compatible = "hpe,1920-8g", "realtek,rtl838x-soc";
+	model = "HPE 1920-8G (JG920A)";
+
+	gpio1: rtl8231-gpio {
+		compatible = "realtek,rtl8231-gpio";
+		#gpio-cells = <2>;
+		gpio-controller;
+		indirect-access-bus-id = <0>;
+	};
+
+	i2c0: i2c-gpio-0 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 23 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 24 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp0: sfp-0 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c0>;
+		los-gpio = <&gpio1 26 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 25 GPIO_ACTIVE_LOW>;
+		// tx-fault and tx-disable unconnected
+	};
+
+	i2c1: i2c-gpio-1 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 13 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 14 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp1: sfp-1 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c1>;
+		los-gpio = <&gpio1 22 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 21 GPIO_ACTIVE_LOW>;
+		// tx-fault and tx-disable unconnected
+	};
+};
+
+&ethernet0 {
+	mdio: mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		INTERNAL_PHY(8)
+		INTERNAL_PHY(9)
+		INTERNAL_PHY(10)
+		INTERNAL_PHY(11)
+		INTERNAL_PHY(12)
+		INTERNAL_PHY(13)
+		INTERNAL_PHY(14)
+		INTERNAL_PHY(15)
+
+		INTERNAL_PHY(24)
+		INTERNAL_PHY(26)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(8, 1, internal)
+		SWITCH_PORT(9, 2, internal)
+		SWITCH_PORT(10, 3, internal)
+		SWITCH_PORT(11, 4, internal)
+		SWITCH_PORT(12, 5, internal)
+		SWITCH_PORT(13, 6, internal)
+		SWITCH_PORT(14, 7, internal)
+		SWITCH_PORT(15, 8, internal)
+
+		port@24 {
+			reg = <24>;
+			label = "lan9";
+			phy-handle = <&phy24>;
+			phy-mode = "1000base-x";
+			managed = "in-band-status";
+			sfp = <&sfp0>;
+		};
+
+		port@26 {
+			reg = <26>;
+			label = "lan10";
+			phy-handle = <&phy26>;
+			phy-mode = "1000base-x";
+			managed = "in-band-status";
+			sfp = <&sfp1>;
+		};
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8380_netgear_gigabit.dtsi b/target/linux/realtek/dts-5.15/rtl8380_netgear_gigabit.dtsi
new file mode 100644
index 00000000000000..5e587f278d6da3
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8380_netgear_gigabit.dtsi
@@ -0,0 +1,85 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl838x.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "realtek,rtl838x-soc";
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x0 0x8000000>;
+	};
+
+	keys {
+		pinctrl-names = "default";
+		pinctrl-0 = <&pinmux_disable_sys_led>;
+
+		compatible = "gpio-keys";
+
+		mode {
+			label = "reset";
+			gpios = <&gpio0 0 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	gpio-restart {
+		compatible = "gpio-restart";
+		gpios = <&gpio0 13 GPIO_ACTIVE_LOW>;
+		open-source;
+	};
+
+	gpio1: rtl8231-gpio {
+		compatible = "realtek,rtl8231-gpio";
+		#gpio-cells = <2>;
+		gpio-controller;
+		indirect-access-bus-id = <31>;
+	};
+};
+
+&ethernet0 {
+	mdio: mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		INTERNAL_PHY(8)
+		INTERNAL_PHY(9)
+		INTERNAL_PHY(10)
+		INTERNAL_PHY(11)
+		INTERNAL_PHY(12)
+		INTERNAL_PHY(13)
+		INTERNAL_PHY(14)
+		INTERNAL_PHY(15)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(8, 1, internal)
+		SWITCH_PORT(9, 2, internal)
+		SWITCH_PORT(10, 3, internal)
+		SWITCH_PORT(11, 4, internal)
+		SWITCH_PORT(12, 5, internal)
+		SWITCH_PORT(13, 6, internal)
+		SWITCH_PORT(14, 7, internal)
+		SWITCH_PORT(15, 8, internal)
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8380_netgear_gigabit_1xx.dtsi b/target/linux/realtek/dts-5.15/rtl8380_netgear_gigabit_1xx.dtsi
new file mode 100644
index 00000000000000..fd44543bb42a8d
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8380_netgear_gigabit_1xx.dtsi
@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl8380_netgear_gigabit.dtsi"
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <50000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0000000 0x00e0000>;
+				read-only;
+			};
+
+			partition@e0000 {
+				label = "u-boot-env";
+				reg = <0x00e0000 0x0010000>;
+			};
+
+			partition@f0000 {
+				label = "u-boot-env2";
+				reg = <0x00f0000 0x0010000>;
+			};
+
+			partition@100000 {
+				label = "jffs";
+				reg = <0x0100000 0x0100000>;
+				read-only;
+			};
+
+			partition@200000 {
+				label = "jffs2";
+				reg = <0x0200000 0x0100000>;
+				read-only;
+			};
+
+			partition@300000 {
+				label = "firmware";
+				compatible = "openwrt,uimage", "denx,uimage";
+				openwrt,ih-magic = <0x4e474520>;
+				reg = <0x0300000 0x0e80000>;
+			};
+
+			partition@1180000 {
+				label = "runtime2";
+				reg = <0x1180000 0x0e80000>;
+				read-only;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8380_netgear_gigabit_3xx.dtsi b/target/linux/realtek/dts-5.15/rtl8380_netgear_gigabit_3xx.dtsi
new file mode 100644
index 00000000000000..0ade665c988a78
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8380_netgear_gigabit_3xx.dtsi
@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl8380_netgear_gigabit.dtsi"
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <50000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0000000 0x00e0000>;
+				read-only;
+			};
+
+			partition@e0000 {
+				label = "u-boot-env";
+				reg = <0x00e0000 0x0010000>;
+			};
+
+			partition@f0000 {
+				label = "u-boot-env2";
+				reg = <0x00f0000 0x0010000>;
+			};
+
+			partition@100000 {
+				label = "jffs";
+				reg = <0x0100000 0x0100000>;
+				read-only;
+			};
+
+			partition@200000 {
+				label = "jffs2";
+				reg = <0x0200000 0x0100000>;
+				read-only;
+			};
+
+			partition@300000 {
+				label = "firmware";
+				compatible = "openwrt,uimage", "denx,uimage";
+				openwrt,ih-magic = <0x4e474335>;
+				reg = <0x0300000 0x0e80000>;
+			};
+
+			partition@1180000 {
+				label = "runtime2";
+				reg = <0x1180000 0x0e80000>;
+				read-only;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8380_netgear_gs108t-v3.dts b/target/linux/realtek/dts-5.15/rtl8380_netgear_gs108t-v3.dts
new file mode 100644
index 00000000000000..e149834d446116
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8380_netgear_gs108t-v3.dts
@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl8380_netgear_gigabit_1xx.dtsi"
+
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "netgear,gs108t-v3", "realtek,rtl838x-soc";
+	model = "Netgear GS108T v3";
+
+	aliases {
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_amber;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_amber;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power_amber: led-0 {
+			label = "amber:power";
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_POWER;
+			gpios = <&gpio1 32 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_green: led-1 {
+			label = "green:power";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_POWER;
+			gpios = <&gpio1 31 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8380_netgear_gs110tpp-v1.dts b/target/linux/realtek/dts-5.15/rtl8380_netgear_gs110tpp-v1.dts
new file mode 100644
index 00000000000000..b61af62ea5361e
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8380_netgear_gs110tpp-v1.dts
@@ -0,0 +1,57 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl8380_netgear_gigabit_1xx.dtsi"
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "netgear,gs110tpp-v1", "realtek,rtl838x-soc";
+	model = "Netgear GS110TPP v1";
+
+	aliases {
+		led-boot = &led_status_green;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_blue;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_red: led-0 {
+			label = "red:status";
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio1 31 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_green: led-1 {
+			label = "green:status";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio1 32 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_blue: led-2 {
+			label = "blue:status";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio1 34 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&uart1 {
+	status = "okay";
+};
+
+&mdio {
+	EXTERNAL_PHY(16)
+	EXTERNAL_PHY(17)
+};
+
+&switch0 {
+	ports {
+		SWITCH_PORT(16, 9, qsgmii)
+		SWITCH_PORT(17, 10, qsgmii)
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8380_netgear_gs308t-v1.dts b/target/linux/realtek/dts-5.15/rtl8380_netgear_gs308t-v1.dts
new file mode 100644
index 00000000000000..cd69e80186c315
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8380_netgear_gs308t-v1.dts
@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl8380_netgear_gigabit_3xx.dtsi"
+
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "netgear,gs308t-v1", "realtek,rtl838x-soc";
+	model = "Netgear GS308T v1";
+
+	aliases {
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_amber;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_amber;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power_amber: led-0 {
+			label = "amber:power";
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_POWER;
+			gpios = <&gpio1 32 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_green: led-1 {
+			label = "green:power";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_POWER;
+			gpios = <&gpio1 31 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8380_netgear_gs310tp-v1.dts b/target/linux/realtek/dts-5.15/rtl8380_netgear_gs310tp-v1.dts
new file mode 100644
index 00000000000000..dacd504ac49822
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8380_netgear_gs310tp-v1.dts
@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl8380_netgear_gigabit_3xx.dtsi"
+
+/ {
+	compatible = "netgear,gs310tp-v1", "realtek,rtl838x-soc";
+	model = "Netgear GS310TP v1";
+
+};
+
+&uart1 {
+	status = "okay";
+};
+
+&mdio {
+	INTERNAL_PHY(24)
+	INTERNAL_PHY(26)
+};
+
+&switch0 {
+	ports {
+		SWITCH_SFP_PORT(24, 9, rgmii-id)
+		SWITCH_SFP_PORT(26, 10, rgmii-id)
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8380_panasonic_m8eg-pn28080k.dts b/target/linux/realtek/dts-5.15/rtl8380_panasonic_m8eg-pn28080k.dts
new file mode 100644
index 00000000000000..f9d58f5b66e60e
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8380_panasonic_m8eg-pn28080k.dts
@@ -0,0 +1,133 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl838x.dtsi"
+#include "rtl83xx_panasonic_mxxeg-pn28xx0k.dtsi"
+
+#include <dt-bindings/interrupt-controller/irq.h>
+
+/ {
+	compatible = "panasonic,m8eg-pn28080k", "realtek,rtl8380-soc";
+	model = "Panasonic Switch-M8eG PN28080K";
+
+	aliases {
+		led-boot = &led_status_eco_green;
+		led-failsafe = &led_status_eco_amber;
+		led-running = &led_status_eco_green;
+		led-upgrade = &led_status_eco_green;
+	};
+
+	sfp0: sfp-p9 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c0>;
+		tx-fault-gpio = <&gpio1 0 GPIO_ACTIVE_HIGH>;
+		tx-disable-gpio = <&gpio1 1 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 2 GPIO_ACTIVE_LOW>;
+		los-gpio = <&gpio1 3 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&leds {
+	led_status_eco_amber: led-5 {
+		label = "amber:status_eco";
+		gpios = <&gpio2 1 GPIO_ACTIVE_LOW>;
+		color = <LED_COLOR_ID_AMBER>;
+		function = LED_FUNCTION_STATUS;
+		function-enumerator = <1>;
+	};
+
+	led_status_eco_green: led-6 {
+		label = "green:status_eco";
+		gpios = <&gpio2 2 GPIO_ACTIVE_LOW>;
+		color = <LED_COLOR_ID_GREEN>;
+		function = LED_FUNCTION_STATUS;
+		function-enumerator = <2>;
+	};
+};
+
+&i2c_gpio_0 {
+	scl-gpios = <&gpio0 0 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+	sda-gpios = <&gpio0 1 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+};
+
+&i2c_gpio_1 {
+	scl-gpios = <&gpio0 12 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+	sda-gpios = <&gpio0 13 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+};
+
+&gpio1 {
+	interrupt-controller;
+	#interrupt-cells = <2>;
+	interrupt-parent = <&gpio0>;
+	interrupts = <2 IRQ_TYPE_EDGE_FALLING>;
+};
+
+&gpio2 {
+	interrupt-controller;
+	#interrupt-cells = <2>;
+	interrupt-parent = <&gpio0>;
+	interrupts = <2 IRQ_TYPE_EDGE_FALLING>;
+};
+
+&i2c_switch {
+	i2c0: i2c@0 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0>;
+	};
+};
+
+&ethernet0 {
+	mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		INTERNAL_PHY(8)
+		INTERNAL_PHY(9)
+		INTERNAL_PHY(10)
+		INTERNAL_PHY(11)
+		INTERNAL_PHY(12)
+		INTERNAL_PHY(13)
+		INTERNAL_PHY(14)
+		INTERNAL_PHY(15)
+
+		INTERNAL_PHY(24)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(8, 1, internal)
+		SWITCH_PORT(9, 2, internal)
+		SWITCH_PORT(10, 3, internal)
+		SWITCH_PORT(11, 4, internal)
+		SWITCH_PORT(12, 5, internal)
+		SWITCH_PORT(13, 6, internal)
+		SWITCH_PORT(14, 7, internal)
+		SWITCH_PORT(15, 8, internal)
+
+		port@24 {
+			reg = <24>;
+			label = "lan9";
+			phy-mode = "1000base-x";
+			phy-handle = <&phy24>;
+			managed = "in-band-status";
+			sfp = <&sfp0>;
+		};
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8380_tplink_sg2008p-v1.dts b/target/linux/realtek/dts-5.15/rtl8380_tplink_sg2008p-v1.dts
new file mode 100644
index 00000000000000..bf43e412b1c6c3
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8380_tplink_sg2008p-v1.dts
@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl8380_tplink_sg2xxx.dtsi"
+
+/ {
+	compatible = "tplink,sg2008p-v1", "realtek,rtl838x-soc";
+	model = "TP-Link SG2008P v1";
+};
+
+&tps23861_20 {
+	status = "disabled";
+};
+
+&phy24 {
+	status = "disabled";
+};
+
+&phy26 {
+	status = "disabled";
+};
+
+&port24 {
+	status = "disabled";
+};
+
+&port26 {
+	status = "disabled";
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8380_tplink_sg2210p-v3.dts b/target/linux/realtek/dts-5.15/rtl8380_tplink_sg2210p-v3.dts
new file mode 100644
index 00000000000000..4b0022c388903f
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8380_tplink_sg2210p-v3.dts
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl8380_tplink_sg2xxx.dtsi"
+
+/ {
+	compatible = "tplink,sg2210p-v3", "realtek,rtl838x-soc";
+	model = "TP-Link SG2210P v3";
+};
+
+&port24 {
+	label = "lan-sfp2";
+};
+
+&port26 {
+	label = "lan-sfp1";
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8380_tplink_sg2xxx.dtsi b/target/linux/realtek/dts-5.15/rtl8380_tplink_sg2xxx.dtsi
new file mode 100644
index 00000000000000..e727a9405ad75b
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8380_tplink_sg2xxx.dtsi
@@ -0,0 +1,183 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl838x.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+		label-mac-device = &ethernet0;
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x0 0x10000000>;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio0 2 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	gpio-restart {
+		compatible = "gpio-restart";
+		gpios = <&gpio0 3 GPIO_ACTIVE_LOW>;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: led-0 {
+			label = "green:power";
+			gpios = <&gpio0 13 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	i2c1: i2c-gpio-1 {
+		compatible = "i2c-gpio";
+		scl-gpios = <&gpio0 0 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		sda-gpios = <&gpio0 1 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		tps23861_20: tps23861@20 {
+			compatible = "ti,tps23861";
+			reg = <0x20>;
+			shunt-resistor-micro-ohms = <255000>;
+		};
+
+		tps23861_28: tps23861@28 {
+			compatible = "ti,tps23861";
+			reg = <0x28>;
+			shunt-resistor-micro-ohms = <255000>;
+		};
+	};
+
+	watchdog {
+		compatible = "linux,wdt-gpio";
+		gpios = <&gpio0 11 GPIO_ACTIVE_HIGH>;
+		hw_algo = "toggle";
+		/* SGM706 specs: typical 1.6s, but minimum 1.0s. */
+		hw_margin_ms = <1000>;
+	};
+};
+
+&gpio0 {
+	watchdog-enable {
+		gpio-hog;
+		gpios = <14 GPIO_ACTIVE_LOW>;
+		output-low;
+		line-name = "watchdog-enable";
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0xe0000>;
+				read-only;
+			};
+			partition@e0000 {
+				label = "u-boot-env";
+				reg = <0xe0000 0x20000>;
+			};
+			partition@100000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x100000 0x1a00000>;
+			};
+			partition@1b00000 {
+				label = "usrappfs";
+				reg = <0x1b00000 0x400000>;
+			};
+			partition@1f00000 {
+				compatible = "nvmem-cells";
+				label = "para";
+				reg = <0x1f00000 0x100000>;
+				#address-cells = <1>;
+				#size-cells = <1>;
+				read-only;
+
+				factory_macaddr: macaddr@fdff4 {
+					reg = <0xfdff4 0x6>;
+				};
+			};
+		};
+	};
+};
+
+&ethernet0 {
+	nvmem-cells = <&factory_macaddr>;
+	nvmem-cell-names = "mac-address";
+
+	mdio: mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		INTERNAL_PHY(8)
+		INTERNAL_PHY(9)
+		INTERNAL_PHY(10)
+		INTERNAL_PHY(11)
+		INTERNAL_PHY(12)
+		INTERNAL_PHY(13)
+		INTERNAL_PHY(14)
+		INTERNAL_PHY(15)
+
+		INTERNAL_PHY(24)
+		INTERNAL_PHY(26)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(15, 1, internal)
+		SWITCH_PORT(14, 2, internal)
+		SWITCH_PORT(13, 3, internal)
+		SWITCH_PORT(12, 4, internal)
+		SWITCH_PORT(11, 5, internal)
+		SWITCH_PORT(10, 6, internal)
+		SWITCH_PORT(9, 7, internal)
+		SWITCH_PORT(8, 8, internal)
+
+		SWITCH_SFP_PORT(24, 9, 1000base-x)
+		SWITCH_SFP_PORT(26, 10, 1000base-x)
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8380_zyxel_gs1900-10hp.dts b/target/linux/realtek/dts-5.15/rtl8380_zyxel_gs1900-10hp.dts
new file mode 100644
index 00000000000000..82df6789a95c01
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8380_zyxel_gs1900-10hp.dts
@@ -0,0 +1,75 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl8380_zyxel_gs1900.dtsi"
+
+/ {
+	compatible = "zyxel,gs1900-10hp", "realtek,rtl838x-soc";
+	model = "ZyXEL GS1900-10HP Switch";
+
+	/* i2c of the left SFP cage: port 9 */
+	i2c0: i2c-gpio-0 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 24 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 25 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp0: sfp-p9 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c0>;
+		los-gpio = <&gpio1 27 GPIO_ACTIVE_HIGH>;
+		tx-fault-gpio = <&gpio1 22 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 26 GPIO_ACTIVE_LOW>;
+		tx-disable-gpio = <&gpio1 23 GPIO_ACTIVE_HIGH>;
+	};
+
+	/* i2c of the right SFP cage: port 10 */
+	i2c1: i2c-gpio-1 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 30 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 31 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp1: sfp-p10 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c1>;
+		los-gpio = <&gpio1 33 GPIO_ACTIVE_HIGH>;
+		tx-fault-gpio = <&gpio1 28 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 32 GPIO_ACTIVE_LOW>;
+		tx-disable-gpio = <&gpio1 29 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&uart1 {
+	status = "okay";
+};
+
+&mdio {
+	INTERNAL_PHY(24)
+	INTERNAL_PHY(26)
+};
+
+&switch0 {
+	ports {
+		port@24 {
+			reg = <24>;
+			label = "lan9";
+			phy-mode = "1000base-x";
+			managed = "in-band-status";
+			sfp = <&sfp0>;
+		};
+
+		port@26 {
+			reg = <26>;
+			label = "lan10";
+			phy-mode = "1000base-x";
+			managed = "in-band-status";
+			sfp = <&sfp1>;
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8380_zyxel_gs1900-8.dts b/target/linux/realtek/dts-5.15/rtl8380_zyxel_gs1900-8.dts
new file mode 100644
index 00000000000000..e9c5efe603920f
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8380_zyxel_gs1900-8.dts
@@ -0,0 +1,12 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl8380_zyxel_gs1900.dtsi"
+
+/ {
+	compatible = "zyxel,gs1900-8", "realtek,rtl838x-soc";
+	model = "ZyXEL GS1900-8 Switch";
+};
+
+&gpio1 {
+	/delete-node/ poe_enable;
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8380_zyxel_gs1900-8hp-v1.dts b/target/linux/realtek/dts-5.15/rtl8380_zyxel_gs1900-8hp-v1.dts
new file mode 100644
index 00000000000000..5ee340eac68242
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8380_zyxel_gs1900-8hp-v1.dts
@@ -0,0 +1,12 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl8380_zyxel_gs1900.dtsi"
+
+/ {
+	compatible = "zyxel,gs1900-8hp-v1", "realtek,rtl838x-soc";
+	model = "ZyXEL GS1900-8HP v1 Switch";
+};
+
+&uart1 {
+	status = "okay";
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8380_zyxel_gs1900-8hp-v2.dts b/target/linux/realtek/dts-5.15/rtl8380_zyxel_gs1900-8hp-v2.dts
new file mode 100644
index 00000000000000..07684622555667
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8380_zyxel_gs1900-8hp-v2.dts
@@ -0,0 +1,12 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl8380_zyxel_gs1900.dtsi"
+
+/ {
+	compatible = "zyxel,gs1900-8hp-v2", "realtek,rtl838x-soc";
+	model = "ZyXEL GS1900-8HP v2 Switch";
+};
+
+&uart1 {
+	status = "okay";
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8380_zyxel_gs1900.dtsi b/target/linux/realtek/dts-5.15/rtl8380_zyxel_gs1900.dtsi
new file mode 100644
index 00000000000000..5993c1b798dfcd
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8380_zyxel_gs1900.dtsi
@@ -0,0 +1,149 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl838x.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	aliases {
+		led-boot = &led_sys;
+		led-failsafe = &led_sys;
+		led-running = &led_sys;
+		led-upgrade = &led_sys;
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x0 0x8000000>;
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <20>;
+
+		reset {
+			label = "reset";
+			gpios = <&gpio1 3 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		pinctrl-names = "default";
+		pinctrl-0 = <&pinmux_disable_sys_led>;
+		compatible = "gpio-leds";
+
+		led_sys: sys {
+			label = "green:sys";
+			gpios = <&gpio0 0 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	gpio1: rtl8231-gpio {
+		compatible = "realtek,rtl8231-gpio";
+		#gpio-cells = <2>;
+		gpio-controller;
+		indirect-access-bus-id = <0>;
+
+		poe_enable {
+			gpio-hog;
+			gpios = <13 GPIO_ACTIVE_HIGH>;
+			output-high;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x40000>;
+				read-only;
+			};
+			partition@40000 {
+				label = "u-boot-env";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+			partition@50000 {
+				label = "u-boot-env2";
+				reg = <0x50000 0x10000>;
+			};
+			partition@60000 {
+				label = "jffs";
+				reg = <0x60000 0x100000>;
+			};
+			partition@160000 {
+				label = "jffs2";
+				reg = <0x160000 0x100000>;
+			};
+			partition@b260000 {
+				label = "firmware";
+				reg = <0x260000 0x6d0000>;
+				compatible = "openwrt,uimage", "denx,uimage";
+				openwrt,ih-magic = <0x83800000>;
+			};
+			partition@930000 {
+				label = "runtime2";
+				reg = <0x930000 0x6d0000>;
+			};
+		};
+	};
+};
+
+&ethernet0 {
+	mdio: mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		INTERNAL_PHY(8)
+		INTERNAL_PHY(9)
+		INTERNAL_PHY(10)
+		INTERNAL_PHY(11)
+		INTERNAL_PHY(12)
+		INTERNAL_PHY(13)
+		INTERNAL_PHY(14)
+		INTERNAL_PHY(15)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(8, 1, internal)
+		SWITCH_PORT(9, 2, internal)
+		SWITCH_PORT(10, 3, internal)
+		SWITCH_PORT(11, 4, internal)
+		SWITCH_PORT(12, 5, internal)
+		SWITCH_PORT(13, 6, internal)
+		SWITCH_PORT(14, 7, internal)
+		SWITCH_PORT(15, 8, internal)
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8382_allnet_all-sg8208m.dts b/target/linux/realtek/dts-5.15/rtl8382_allnet_all-sg8208m.dts
new file mode 100644
index 00000000000000..320cb08ac7de70
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8382_allnet_all-sg8208m.dts
@@ -0,0 +1,141 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl838x.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "allnet,all-sg8208m", "realtek,rtl838x-soc";
+	model = "ALLNET ALL-SG8208M";
+
+	aliases {
+		led-boot = &led_sys;
+		led-failsafe = &led_sys;
+		led-running = &led_sys;
+		led-upgrade = &led_sys;
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x0 0x8000000>;
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <20>;
+
+		/* is this pin 3 on the external RTL8231 (&gpio1)? */
+		/*reset {
+			label = "reset";
+			gpios = <&gpio0 67 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};*/
+	};
+
+	leds {
+		pinctrl-names = "default";
+		pinctrl-0 = <&pinmux_disable_sys_led>;
+		compatible = "gpio-leds";
+
+		led_sys: sys {
+			label = "green:sys";
+			gpios = <&gpio0 0 GPIO_ACTIVE_HIGH>;
+		};
+		// GPIO 25: power on/off all port leds
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x80000>;
+				read-only;
+			};
+
+			partition@80000 {
+				label = "u-boot-env";
+				reg = <0x80000 0x10000>;
+				read-only;
+			};
+
+			partition@90000 {
+				label = "u-boot-env2";
+				reg = <0x90000 0x10000>;
+			};
+
+			partition@a0000 {
+				label = "jffs";
+				reg = <0xa0000 0x100000>;
+			};
+
+			partition@1a0000 {
+				label = "jffs2";
+				reg = <0x1a0000 0x100000>;
+			};
+
+			partition@2a0000 {
+				label = "firmware";
+				reg = <0x2a0000 0xd60000>;
+				compatible = "openwrt,uimage", "denx,uimage";
+				openwrt,ih-magic = <0x00000006>;
+			};
+		};
+	};
+};
+
+&ethernet0 {
+	mdio: mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		INTERNAL_PHY(8)
+		INTERNAL_PHY(9)
+		INTERNAL_PHY(10)
+		INTERNAL_PHY(11)
+		INTERNAL_PHY(12)
+		INTERNAL_PHY(13)
+		INTERNAL_PHY(14)
+		INTERNAL_PHY(15)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(8, 1, internal)
+		SWITCH_PORT(9, 2, internal)
+		SWITCH_PORT(10, 3, internal)
+		SWITCH_PORT(11, 4, internal)
+		SWITCH_PORT(12, 5, internal)
+		SWITCH_PORT(13, 6, internal)
+		SWITCH_PORT(14, 7, internal)
+		SWITCH_PORT(15, 8, internal)
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8382_apresia_aplgs120gtss.dts b/target/linux/realtek/dts-5.15/rtl8382_apresia_aplgs120gtss.dts
new file mode 100644
index 00000000000000..15120265c97c33
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8382_apresia_aplgs120gtss.dts
@@ -0,0 +1,270 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl838x.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "apresia,aplgs120gtss", "realtek,rtl8382-soc";
+	model = "APRESIA ApresiaLightGS120GT-SS";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x0 0x10000000>;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: led-0 {
+			label = "green:pwr";
+			gpios = <&gpio0 0 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_POWER;
+		};
+
+		led-1 {
+			label = "red:loop";
+			gpios = <&gpio1 10 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_FAULT;
+		};
+
+		/* LED chip is soldered, but no hole on the case */
+		led-2 {
+			label = "green:unused";
+			gpios = <&gpio1 36 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <20>;
+
+		reset {
+			label = "reset";
+			gpios = <&gpio1 33 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	gpio-restart {
+		compatible = "gpio-restart";
+		gpios = <&gpio1 34 GPIO_ACTIVE_LOW>;
+		open-source;
+	};
+
+	gpio1: rtl8231-gpio {
+		compatible = "realtek,rtl8231-gpio";
+		#gpio-cells = <2>;
+		gpio-controller;
+		indirect-access-bus-id = <0>;
+	};
+
+	i2c0: i2c-gpio-0 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 1 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 2 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	i2c1: i2c-gpio-1 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 6 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 7 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	i2c2: i2c-gpio-2 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 11 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 12 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	i2c3: i2c-gpio-3 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 22 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 23 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	/* 4x TX-Disable lines are provided by RTL8214FC */
+	sfp0: sfp-p17 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c1>;
+		los-gpio = <&gpio1 9 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 8 GPIO_ACTIVE_LOW>;
+	};
+
+	sfp1: sfp-p18 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c0>;
+		los-gpio = <&gpio1 4 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 3 GPIO_ACTIVE_LOW>;
+	};
+
+	sfp2: sfp-p19 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c3>;
+		los-gpio = <&gpio1 25 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 24 GPIO_ACTIVE_LOW>;
+	};
+
+	sfp3: sfp-p20 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c2>;
+		los-gpio = <&gpio1 14 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 13 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&gpio0 {
+	rtl8231_reset {
+		gpio-hog;
+		gpios = <1 GPIO_ACTIVE_HIGH>;
+		output-high;
+		line-name = "rtl8231-reset";
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x80000>;
+				read-only;
+			};
+
+			partition@80000 {
+				label = "u-boot-env";
+				reg = <0x80000 0x40000>;
+			};
+
+			partition@c0000 {
+				label = "u-boot-env2";
+				reg = <0xc0000 0x40000>;
+			};
+
+			partition@100000 {
+				compatible = "openwrt,uimage", "denx,uimage";
+				label = "firmware";
+				reg = <0x100000 0xe80000>;
+				openwrt,ih-magic = <0x12345000>;
+			};
+
+			partition@f80000 {
+				label = "firmware2";
+				reg = <0xf80000 0xe80000>;
+			};
+
+			partition@1e00000 {
+				label = "jffs2";
+				reg = <0x1e00000 0x200000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&ethernet0 {
+	mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		EXTERNAL_PHY(0)
+		EXTERNAL_PHY(1)
+		EXTERNAL_PHY(2)
+		EXTERNAL_PHY(3)
+		EXTERNAL_PHY(4)
+		EXTERNAL_PHY(5)
+		EXTERNAL_PHY(6)
+		EXTERNAL_PHY(7)
+
+		INTERNAL_PHY(8)
+		INTERNAL_PHY(9)
+		INTERNAL_PHY(10)
+		INTERNAL_PHY(11)
+		INTERNAL_PHY(12)
+		INTERNAL_PHY(13)
+		INTERNAL_PHY(14)
+		INTERNAL_PHY(15)
+
+		EXTERNAL_SFP_PHY_FULL(24, 0)
+		EXTERNAL_SFP_PHY_FULL(25, 1)
+		EXTERNAL_SFP_PHY_FULL(26, 2)
+		EXTERNAL_SFP_PHY_FULL(27, 3)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(0, 1, qsgmii)
+		SWITCH_PORT(1, 2, qsgmii)
+		SWITCH_PORT(2, 3, qsgmii)
+		SWITCH_PORT(3, 4, qsgmii)
+		SWITCH_PORT(4, 5, qsgmii)
+		SWITCH_PORT(5, 6, qsgmii)
+		SWITCH_PORT(6, 7, qsgmii)
+		SWITCH_PORT(7, 8, qsgmii)
+
+		SWITCH_PORT(8, 9, internal)
+		SWITCH_PORT(9, 10, internal)
+		SWITCH_PORT(10, 11, internal)
+		SWITCH_PORT(11, 12, internal)
+		SWITCH_PORT(12, 13, internal)
+		SWITCH_PORT(13, 14, internal)
+		SWITCH_PORT(14, 15, internal)
+		SWITCH_PORT(15, 16, internal)
+
+		SWITCH_PORT(24, 17, qsgmii)
+		SWITCH_PORT(25, 18, qsgmii)
+		SWITCH_PORT(26, 19, qsgmii)
+		SWITCH_PORT(27, 20, qsgmii)
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8382_d-link_dgs-1210-10p.dts b/target/linux/realtek/dts-5.15/rtl8382_d-link_dgs-1210-10p.dts
new file mode 100644
index 00000000000000..16934ede3b88a3
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8382_d-link_dgs-1210-10p.dts
@@ -0,0 +1,102 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl838x.dtsi"
+#include "rtl83xx_d-link_dgs-1210_common.dtsi"
+
+/ {
+	compatible = "d-link,dgs-1210-10p", "realtek,rtl838x-soc";
+	model = "D-Link DGS-1210-10P";
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <20>;
+
+		mode {
+			label = "mode";
+			gpios = <&gpio1 30 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_LIGHTS_TOGGLE>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio1 33 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		link_act {
+			label = "green:link_act";
+			gpios = <&gpio1 28 GPIO_ACTIVE_LOW>;
+		};
+
+		poe {
+			label = "green:poe";
+			gpios = <&gpio1 29 GPIO_ACTIVE_LOW>;
+		};
+
+		poe_max {
+			label = "yellow:poe_max";
+			gpios = <&gpio1 27 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio1: rtl8231-gpio {
+		compatible = "realtek,rtl8231-gpio";
+		#gpio-cells = <2>;
+		gpio-controller;
+		indirect-access-bus-id = <0>;
+	};
+};
+
+&uart1 {
+	status = "okay";
+};
+
+&ethernet0 {
+	mdio: mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		INTERNAL_PHY(8)
+		INTERNAL_PHY(9)
+		INTERNAL_PHY(10)
+		INTERNAL_PHY(11)
+		INTERNAL_PHY(12)
+		INTERNAL_PHY(13)
+		INTERNAL_PHY(14)
+		INTERNAL_PHY(15)
+		INTERNAL_PHY(24)
+		INTERNAL_PHY(26)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(8, 1, internal)
+		SWITCH_PORT(9, 2, internal)
+		SWITCH_PORT(10, 3, internal)
+		SWITCH_PORT(11, 4, internal)
+		SWITCH_PORT(12, 5, internal)
+		SWITCH_PORT(13, 6, internal)
+		SWITCH_PORT(14, 7, internal)
+		SWITCH_PORT(15, 8, internal)
+		SWITCH_SFP_PORT(24, 9, rgmii-id)
+		SWITCH_SFP_PORT(26, 10, rgmii-id)
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8382_d-link_dgs-1210-16.dts b/target/linux/realtek/dts-5.15/rtl8382_d-link_dgs-1210-16.dts
new file mode 100644
index 00000000000000..35f41b9e4d56d7
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8382_d-link_dgs-1210-16.dts
@@ -0,0 +1,81 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl838x.dtsi"
+#include "rtl83xx_d-link_dgs-1210_common.dtsi"
+
+/ {
+	compatible = "d-link,dgs-1210-16", "realtek,rtl838x-soc";
+	model = "D-Link DGS-1210-16";
+};
+
+&ethernet0 {
+	mdio: mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		EXTERNAL_PHY(0)
+		EXTERNAL_PHY(1)
+		EXTERNAL_PHY(2)
+		EXTERNAL_PHY(3)
+		EXTERNAL_PHY(4)
+		EXTERNAL_PHY(5)
+		EXTERNAL_PHY(6)
+		EXTERNAL_PHY(7)
+
+		INTERNAL_PHY(8)
+		INTERNAL_PHY(9)
+		INTERNAL_PHY(10)
+		INTERNAL_PHY(11)
+		INTERNAL_PHY(12)
+		INTERNAL_PHY(13)
+		INTERNAL_PHY(14)
+		INTERNAL_PHY(15)
+
+		EXTERNAL_SFP_PHY(24)
+		EXTERNAL_SFP_PHY(25)
+		EXTERNAL_SFP_PHY(26)
+		EXTERNAL_SFP_PHY(27)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(0, 1, qsgmii)
+		SWITCH_PORT(1, 2, qsgmii)
+		SWITCH_PORT(2, 3, qsgmii)
+		SWITCH_PORT(3, 4, qsgmii)
+		SWITCH_PORT(4, 5, qsgmii)
+		SWITCH_PORT(5, 6, qsgmii)
+		SWITCH_PORT(6, 7, qsgmii)
+		SWITCH_PORT(7, 8, qsgmii)
+
+		SWITCH_PORT(8, 9, internal)
+		SWITCH_PORT(9, 10, internal)
+		SWITCH_PORT(10, 11, internal)
+		SWITCH_PORT(11, 12, internal)
+		SWITCH_PORT(12, 13, internal)
+		SWITCH_PORT(13, 14, internal)
+		SWITCH_PORT(14, 15, internal)
+		SWITCH_PORT(15, 16, internal)
+
+		SWITCH_PORT(24, 17, qsgmii)
+		SWITCH_PORT(25, 18, qsgmii)
+		SWITCH_PORT(26, 19, qsgmii)
+		SWITCH_PORT(27, 20, qsgmii)
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8382_d-link_dgs-1210-20.dts b/target/linux/realtek/dts-5.15/rtl8382_d-link_dgs-1210-20.dts
new file mode 100644
index 00000000000000..dacc50676d4f3a
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8382_d-link_dgs-1210-20.dts
@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl838x.dtsi"
+#include "rtl83xx_d-link_dgs-1210_common.dtsi"
+#include "rtl83xx_d-link_dgs-1210_gpio.dtsi"
+
+/ {
+	compatible = "d-link,dgs-1210-20", "realtek,rtl838x-soc";
+	model = "D-Link DGS-1210-20";
+};
+
+&ethernet0 {
+	mdio: mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		EXTERNAL_PHY(0)
+		EXTERNAL_PHY(1)
+		EXTERNAL_PHY(2)
+		EXTERNAL_PHY(3)
+		EXTERNAL_PHY(4)
+		EXTERNAL_PHY(5)
+		EXTERNAL_PHY(6)
+		EXTERNAL_PHY(7)
+
+		INTERNAL_PHY(8)
+		INTERNAL_PHY(9)
+		INTERNAL_PHY(10)
+		INTERNAL_PHY(11)
+		INTERNAL_PHY(12)
+		INTERNAL_PHY(13)
+		INTERNAL_PHY(14)
+		INTERNAL_PHY(15)
+
+		EXTERNAL_SFP_PHY(24)
+		EXTERNAL_SFP_PHY(25)
+		EXTERNAL_SFP_PHY(26)
+		EXTERNAL_SFP_PHY(27)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(0, 1, qsgmii)
+		SWITCH_PORT(1, 2, qsgmii)
+		SWITCH_PORT(2, 3, qsgmii)
+		SWITCH_PORT(3, 4, qsgmii)
+		SWITCH_PORT(4, 5, qsgmii)
+		SWITCH_PORT(5, 6, qsgmii)
+		SWITCH_PORT(6, 7, qsgmii)
+		SWITCH_PORT(7, 8, qsgmii)
+
+		SWITCH_PORT(8, 9, internal)
+		SWITCH_PORT(9, 10, internal)
+		SWITCH_PORT(10, 11, internal)
+		SWITCH_PORT(11, 12, internal)
+		SWITCH_PORT(12, 13, internal)
+		SWITCH_PORT(13, 14, internal)
+		SWITCH_PORT(14, 15, internal)
+		SWITCH_PORT(15, 16, internal)
+
+		SWITCH_PORT(24, 17, qsgmii)
+		SWITCH_PORT(25, 18, qsgmii)
+		SWITCH_PORT(26, 19, qsgmii)
+		SWITCH_PORT(27, 20, qsgmii)
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8382_d-link_dgs-1210-28.dts b/target/linux/realtek/dts-5.15/rtl8382_d-link_dgs-1210-28.dts
new file mode 100644
index 00000000000000..0bcb196b7c9732
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8382_d-link_dgs-1210-28.dts
@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl838x.dtsi"
+#include "rtl83xx_d-link_dgs-1210_common.dtsi"
+#include "rtl83xx_d-link_dgs-1210_gpio.dtsi"
+#include "rtl8382_d-link_dgs-1210-28_common.dtsi"
+
+/ {
+	compatible = "d-link,dgs-1210-28", "realtek,rtl838x-soc";
+	model = "D-Link DGS-1210-28";
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8382_d-link_dgs-1210-28_common.dtsi b/target/linux/realtek/dts-5.15/rtl8382_d-link_dgs-1210-28_common.dtsi
new file mode 100644
index 00000000000000..17866d5f038f3c
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8382_d-link_dgs-1210-28_common.dtsi
@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+&ethernet0 {
+	mdio: mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		EXTERNAL_PHY(0)
+		EXTERNAL_PHY(1)
+		EXTERNAL_PHY(2)
+		EXTERNAL_PHY(3)
+		EXTERNAL_PHY(4)
+		EXTERNAL_PHY(5)
+		EXTERNAL_PHY(6)
+		EXTERNAL_PHY(7)
+
+		INTERNAL_PHY(8)
+		INTERNAL_PHY(9)
+		INTERNAL_PHY(10)
+		INTERNAL_PHY(11)
+		INTERNAL_PHY(12)
+		INTERNAL_PHY(13)
+		INTERNAL_PHY(14)
+		INTERNAL_PHY(15)
+
+		EXTERNAL_PHY(16)
+		EXTERNAL_PHY(17)
+		EXTERNAL_PHY(18)
+		EXTERNAL_PHY(19)
+		EXTERNAL_PHY(20)
+		EXTERNAL_PHY(21)
+		EXTERNAL_PHY(22)
+		EXTERNAL_PHY(23)
+
+		EXTERNAL_SFP_PHY(24)
+		EXTERNAL_SFP_PHY(25)
+		EXTERNAL_SFP_PHY(26)
+		EXTERNAL_SFP_PHY(27)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(0, 1, qsgmii)
+		SWITCH_PORT(1, 2, qsgmii)
+		SWITCH_PORT(2, 3, qsgmii)
+		SWITCH_PORT(3, 4, qsgmii)
+		SWITCH_PORT(4, 5, qsgmii)
+		SWITCH_PORT(5, 6, qsgmii)
+		SWITCH_PORT(6, 7, qsgmii)
+		SWITCH_PORT(7, 8, qsgmii)
+
+		SWITCH_PORT(8, 9, internal)
+		SWITCH_PORT(9, 10, internal)
+		SWITCH_PORT(10, 11, internal)
+		SWITCH_PORT(11, 12, internal)
+		SWITCH_PORT(12, 13, internal)
+		SWITCH_PORT(13, 14, internal)
+		SWITCH_PORT(14, 15, internal)
+		SWITCH_PORT(15, 16, internal)
+
+		SWITCH_PORT(16, 17, qsgmii)
+		SWITCH_PORT(17, 18, qsgmii)
+		SWITCH_PORT(18, 19, qsgmii)
+		SWITCH_PORT(19, 20, qsgmii)
+		SWITCH_PORT(20, 21, qsgmii)
+		SWITCH_PORT(21, 22, qsgmii)
+		SWITCH_PORT(22, 23, qsgmii)
+		SWITCH_PORT(23, 24, qsgmii)
+
+		SWITCH_PORT(24, 25, qsgmii)
+		SWITCH_PORT(25, 26, qsgmii)
+		SWITCH_PORT(26, 27, qsgmii)
+		SWITCH_PORT(27, 28, qsgmii)
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8382_d-link_dgs-1210-28mp-f.dts b/target/linux/realtek/dts-5.15/rtl8382_d-link_dgs-1210-28mp-f.dts
new file mode 100644
index 00000000000000..ce008229b3334f
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8382_d-link_dgs-1210-28mp-f.dts
@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl838x.dtsi"
+#include "rtl83xx_d-link_dgs-1210_common.dtsi"
+#include "rtl83xx_d-link_dgs-1210_gpio.dtsi"
+#include "rtl8382_d-link_dgs-1210-28_common.dtsi"
+
+/ {
+	compatible = "d-link,dgs-1210-28mp-f", "realtek,rtl8382-soc", "realtek,rtl838x-soc";
+	model = "D-Link DGS-1210-28MP F";
+};
+
+&leds {
+	link_act {
+		label = "green:link_act";
+		gpios = <&gpio1 28 GPIO_ACTIVE_LOW>;
+	};
+
+	poe {
+		label = "green:poe";
+		gpios = <&gpio1 29 GPIO_ACTIVE_LOW>;
+	};
+
+	poe_max {
+		label = "yellow:poe_max";
+		gpios = <&gpio1 27 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&keys {
+	mode {
+		label = "mode";
+		gpios = <&gpio1 30 GPIO_ACTIVE_LOW>;
+		linux,code = <BTN_0>;
+	};
+};
+
+&uart1 {
+	status = "okay";
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8382_hpe_1920-16g.dts b/target/linux/realtek/dts-5.15/rtl8382_hpe_1920-16g.dts
new file mode 100644
index 00000000000000..59043b2f6f7994
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8382_hpe_1920-16g.dts
@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl8382_hpe_1920.dtsi"
+
+/ {
+	compatible = "hpe,1920-16g", "realtek,rtl838x-soc";
+	model = "HPE 1920-16G (JG923A)";
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(8, 1, internal)
+		SWITCH_PORT(9, 2, internal)
+		SWITCH_PORT(10, 3, internal)
+		SWITCH_PORT(11, 4, internal)
+		SWITCH_PORT(12, 5, internal)
+		SWITCH_PORT(13, 6, internal)
+		SWITCH_PORT(14, 7, internal)
+		SWITCH_PORT(15, 8, internal)
+
+		SWITCH_PORT(16, 9, qsgmii)
+		SWITCH_PORT(17, 10, qsgmii)
+		SWITCH_PORT(18, 11, qsgmii)
+		SWITCH_PORT(19, 12, qsgmii)
+		SWITCH_PORT(20, 13, qsgmii)
+		SWITCH_PORT(21, 14, qsgmii)
+		SWITCH_PORT(22, 15, qsgmii)
+		SWITCH_PORT(23, 16, qsgmii)
+
+		SWITCH_PORT(24, 17, qsgmii)
+		SWITCH_PORT(25, 18, qsgmii)
+		SWITCH_PORT(26, 19, qsgmii)
+		SWITCH_PORT(27, 20, qsgmii)
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8382_hpe_1920-24g.dts b/target/linux/realtek/dts-5.15/rtl8382_hpe_1920-24g.dts
new file mode 100644
index 00000000000000..61781c708e288d
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8382_hpe_1920-24g.dts
@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl8382_hpe_1920.dtsi"
+
+/ {
+	compatible = "hpe,1920-24g", "realtek,rtl838x-soc";
+	model = "HPE 1920-24G (JG924A)";
+};
+
+&mdio {
+	EXTERNAL_PHY(0)
+	EXTERNAL_PHY(1)
+	EXTERNAL_PHY(2)
+	EXTERNAL_PHY(3)
+	EXTERNAL_PHY(4)
+	EXTERNAL_PHY(5)
+	EXTERNAL_PHY(6)
+	EXTERNAL_PHY(7)
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(0, 1, qsgmii)
+		SWITCH_PORT(1, 2, qsgmii)
+		SWITCH_PORT(2, 3, qsgmii)
+		SWITCH_PORT(3, 4, qsgmii)
+		SWITCH_PORT(4, 5, qsgmii)
+		SWITCH_PORT(5, 6, qsgmii)
+		SWITCH_PORT(6, 7, qsgmii)
+		SWITCH_PORT(7, 8, qsgmii)
+
+		SWITCH_PORT(8, 9, internal)
+		SWITCH_PORT(9, 10, internal)
+		SWITCH_PORT(10, 11, internal)
+		SWITCH_PORT(11, 12, internal)
+		SWITCH_PORT(12, 13, internal)
+		SWITCH_PORT(13, 14, internal)
+		SWITCH_PORT(14, 15, internal)
+		SWITCH_PORT(15, 16, internal)
+
+		SWITCH_PORT(16, 17, qsgmii)
+		SWITCH_PORT(17, 18, qsgmii)
+		SWITCH_PORT(18, 19, qsgmii)
+		SWITCH_PORT(19, 20, qsgmii)
+		SWITCH_PORT(20, 21, qsgmii)
+		SWITCH_PORT(21, 22, qsgmii)
+		SWITCH_PORT(22, 23, qsgmii)
+		SWITCH_PORT(23, 24, qsgmii)
+
+		SWITCH_PORT(24, 25, qsgmii)
+		SWITCH_PORT(25, 26, qsgmii)
+		SWITCH_PORT(26, 27, qsgmii)
+		SWITCH_PORT(27, 28, qsgmii)
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8382_hpe_1920.dtsi b/target/linux/realtek/dts-5.15/rtl8382_hpe_1920.dtsi
new file mode 100644
index 00000000000000..5368b41c276916
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8382_hpe_1920.dtsi
@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl838x.dtsi"
+#include "rtl838x_hpe_1920.dtsi"
+
+/ {
+	gpio1: rtl8231-gpio {
+		compatible = "realtek,rtl8231-gpio";
+		#gpio-cells = <2>;
+		gpio-controller;
+		indirect-access-bus-id = <0>;
+	};
+
+	i2c0: i2c-gpio-0 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 13 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 14 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp0: sfp-0 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c0>;
+		los-gpio = <&gpio1 22 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 21 GPIO_ACTIVE_LOW>;
+		// tx-fault unconnected
+		// tx-disable connected to RTL8214FC
+	};
+
+	i2c1: i2c-gpio-1 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 23 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 24 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp1: sfp-1 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c1>;
+		los-gpio = <&gpio1 26 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 25 GPIO_ACTIVE_LOW>;
+		// tx-fault unconnected
+		// tx-disable connected to RTL8214FC
+	};
+
+	i2c2: i2c-gpio-2 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 27 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 28 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp2: sfp-2 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c2>;
+		los-gpio = <&gpio1 30 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 29 GPIO_ACTIVE_LOW>;
+		// tx-fault unconnected
+		// tx-disable connected to RTL8214FC
+	};
+
+	i2c3: i2c-gpio-3 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 31 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 32 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp3: sfp-3 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c3>;
+		los-gpio = <&gpio1 34 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 33 GPIO_ACTIVE_LOW>;
+		// tx-fault unconnected
+		// tx-disable connected to RTL8214FC
+	};
+};
+
+&ethernet0 {
+	mdio: mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		INTERNAL_PHY(8)
+		INTERNAL_PHY(9)
+		INTERNAL_PHY(10)
+		INTERNAL_PHY(11)
+		INTERNAL_PHY(12)
+		INTERNAL_PHY(13)
+		INTERNAL_PHY(14)
+		INTERNAL_PHY(15)
+
+		EXTERNAL_PHY(16)
+		EXTERNAL_PHY(17)
+		EXTERNAL_PHY(18)
+		EXTERNAL_PHY(19)
+		EXTERNAL_PHY(20)
+		EXTERNAL_PHY(21)
+		EXTERNAL_PHY(22)
+		EXTERNAL_PHY(23)
+
+		EXTERNAL_SFP_PHY_FULL(24, 0)
+		EXTERNAL_SFP_PHY_FULL(25, 1)
+		EXTERNAL_SFP_PHY_FULL(26, 2)
+		EXTERNAL_SFP_PHY_FULL(27, 3)
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8382_inaba_aml2-17gp.dts b/target/linux/realtek/dts-5.15/rtl8382_inaba_aml2-17gp.dts
new file mode 100644
index 00000000000000..48081414941f2d
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8382_inaba_aml2-17gp.dts
@@ -0,0 +1,158 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl838x.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "inaba,aml2-17gp", "realtek,rtl838x-soc";
+	model = "INABA Abaniact AML2-17GP";
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x0 0x8000000>;
+	};
+
+	keys {
+		pinctrl-names = "default";
+		pinctrl-0 = <&pinmux_disable_sys_led>;
+
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio0 0 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x80000>;
+				read-only;
+			};
+
+			partition@80000 {
+				label = "u-boot-env";
+				reg = <0x80000 0x10000>;
+				read-only;
+			};
+
+			partition@90000 {
+				label = "u-boot-env2";
+				reg = <0x90000 0x10000>;
+			};
+
+			partition@a0000 {
+				label = "jffs2_cfg";
+				reg = <0xa0000 0x400000>;
+				read-only;
+			};
+
+			partition@4a0000 {
+				label = "jffs2_log";
+				reg = <0x4a0000 0x100000>;
+				read-only;
+			};
+
+			partition@5a0000 {
+				compatible = "openwrt,uimage", "denx,uimage";
+				label = "firmware";
+				reg = <0x5a0000 0xd30000>;
+				openwrt,ih-magic = <0x83800000>;
+			};
+
+			partition@12d0000 {
+				label = "runtime2";
+				reg = <0x12d0000 0xd30000>;
+			};
+		};
+	};
+};
+
+&ethernet0 {
+	mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		INTERNAL_PHY(8)
+		INTERNAL_PHY(9)
+		INTERNAL_PHY(10)
+		INTERNAL_PHY(11)
+		INTERNAL_PHY(12)
+		INTERNAL_PHY(13)
+		INTERNAL_PHY(14)
+		INTERNAL_PHY(15)
+
+		EXTERNAL_PHY(16)
+		EXTERNAL_PHY(17)
+		EXTERNAL_PHY(18)
+		EXTERNAL_PHY(19)
+		EXTERNAL_PHY(20)
+		EXTERNAL_PHY(21)
+		EXTERNAL_PHY(22)
+		EXTERNAL_PHY(23)
+
+		EXTERNAL_PHY(24)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(8, 1, internal)
+		SWITCH_PORT(9, 2, internal)
+		SWITCH_PORT(10, 3, internal)
+		SWITCH_PORT(11, 4, internal)
+		SWITCH_PORT(12, 5, internal)
+		SWITCH_PORT(13, 6, internal)
+		SWITCH_PORT(14, 7, internal)
+		SWITCH_PORT(15, 8, internal)
+
+		SWITCH_PORT(16, 9, qsgmii)
+		SWITCH_PORT(17, 10, qsgmii)
+		SWITCH_PORT(18, 11, qsgmii)
+		SWITCH_PORT(19, 12, qsgmii)
+		SWITCH_PORT(20, 13, qsgmii)
+		SWITCH_PORT(21, 14, qsgmii)
+		SWITCH_PORT(22, 15, qsgmii)
+		SWITCH_PORT(23, 16, qsgmii)
+
+		port@24 {
+			reg = <24>;
+			label = "wan";
+			phy-handle = <&phy24>;
+			phy-mode = "qsgmii";
+		};
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8382_iodata_bsh-g24mb.dts b/target/linux/realtek/dts-5.15/rtl8382_iodata_bsh-g24mb.dts
new file mode 100644
index 00000000000000..8ea28ed2fde48b
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8382_iodata_bsh-g24mb.dts
@@ -0,0 +1,193 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl838x.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "iodata,bsh-g24mb", "realtek,rtl838x-soc";
+	model = "I-O DATA BSH-G24MB";
+
+	aliases {
+		led-boot = &led_sys_loop;
+		led-failsafe = &led_sys_loop;
+		led-upgrade = &led_sys_loop;
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x0 0x8000000>;
+	};
+
+	leds {
+		pinctrl-names = "default";
+		pinctrl-0 = <&pinmux_disable_sys_led>;
+		compatible = "gpio-leds";
+
+		led_sys_loop: led {
+			label = "red:sys_loop";
+			gpios = <&gpio0 0 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <20>;
+
+		reset {
+			label = "reset";
+			gpios = <&gpio1 3 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	gpio1: rtl8231-gpio {
+		compatible = "realtek,rtl8231-gpio";
+		#gpio-cells = <2>;
+		gpio-controller;
+		indirect-access-bus-id = <0>;
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x80000>;
+				read-only;
+			};
+
+			partition@80000 {
+				label = "u-boot-env";
+				reg = <0x80000 0x10000>;
+				read-only;
+			};
+
+			partition@90000 {
+				label = "u-boot-env2";
+				reg = <0x90000 0x10000>;
+			};
+
+			partition@a0000 {
+				label = "jffs2_cfg";
+				reg = <0xa0000 0x100000>;
+				read-only;
+			};
+
+			partition@1a0000 {
+				label = "jffs2_log";
+				reg = <0x1a0000 0x100000>;
+				read-only;
+			};
+
+			/*
+			 * use 2x OS partitions in OpenWrt
+			 *
+			 * 0x2A0000-0x94FFFF: RUNTIME
+			 * 0x950000-0xFFFFFF: RUNTIME2 (not used in stock)
+			 */
+			partition@2a0000 {
+				compatible = "openwrt,uimage", "denx,uimage";
+				label = "firmware";
+				reg = <0x2a0000 0xd60000>;
+				openwrt,ih-magic = <0x83800013>;
+			};
+		};
+	};
+};
+
+&ethernet0 {
+	mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		EXTERNAL_PHY(0)
+		EXTERNAL_PHY(1)
+		EXTERNAL_PHY(2)
+		EXTERNAL_PHY(3)
+		EXTERNAL_PHY(4)
+		EXTERNAL_PHY(5)
+		EXTERNAL_PHY(6)
+		EXTERNAL_PHY(7)
+
+		INTERNAL_PHY(8)
+		INTERNAL_PHY(9)
+		INTERNAL_PHY(10)
+		INTERNAL_PHY(11)
+		INTERNAL_PHY(12)
+		INTERNAL_PHY(13)
+		INTERNAL_PHY(14)
+		INTERNAL_PHY(15)
+
+		EXTERNAL_PHY(16)
+		EXTERNAL_PHY(17)
+		EXTERNAL_PHY(18)
+		EXTERNAL_PHY(19)
+		EXTERNAL_PHY(20)
+		EXTERNAL_PHY(21)
+		EXTERNAL_PHY(22)
+		EXTERNAL_PHY(23)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(0, 1, qsgmii)
+		SWITCH_PORT(1, 2, qsgmii)
+		SWITCH_PORT(2, 3, qsgmii)
+		SWITCH_PORT(3, 4, qsgmii)
+		SWITCH_PORT(4, 5, qsgmii)
+		SWITCH_PORT(5, 6, qsgmii)
+		SWITCH_PORT(6, 7, qsgmii)
+		SWITCH_PORT(7, 8, qsgmii)
+
+		SWITCH_PORT(8, 9, internal)
+		SWITCH_PORT(9, 10, internal)
+		SWITCH_PORT(10, 11, internal)
+		SWITCH_PORT(11, 12, internal)
+		SWITCH_PORT(12, 13, internal)
+		SWITCH_PORT(13, 14, internal)
+		SWITCH_PORT(14, 15, internal)
+		SWITCH_PORT(15, 16, internal)
+
+		SWITCH_PORT(16, 17, qsgmii)
+		SWITCH_PORT(17, 18, qsgmii)
+		SWITCH_PORT(18, 19, qsgmii)
+		SWITCH_PORT(19, 20, qsgmii)
+		SWITCH_PORT(20, 21, qsgmii)
+		SWITCH_PORT(21, 22, qsgmii)
+		SWITCH_PORT(22, 23, qsgmii)
+		SWITCH_PORT(23, 24, qsgmii)
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8382_panasonic_m16eg-pn28160k.dts b/target/linux/realtek/dts-5.15/rtl8382_panasonic_m16eg-pn28160k.dts
new file mode 100644
index 00000000000000..c3b29a87ff390a
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8382_panasonic_m16eg-pn28160k.dts
@@ -0,0 +1,171 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl838x.dtsi"
+#include "rtl83xx_panasonic_mxxeg-pn28xx0k.dtsi"
+
+#include <dt-bindings/interrupt-controller/irq.h>
+
+/ {
+	compatible = "panasonic,m16eg-pn28160k", "realtek,rtl8382-soc";
+	model = "Panasonic Switch-M16eG PN28160K";
+
+	aliases {
+		led-boot = &led_status_eco_green;
+		led-failsafe = &led_status_eco_amber;
+		led-running = &led_status_eco_green;
+		led-upgrade = &led_status_eco_green;
+	};
+
+	/*
+	 * sfp0/1 are "combo" port with each TP port (23/24), and they are
+	 * connected to the RTL8218FB. Currently, there is no support for
+	 * the chip and only TP ports work by the RTL8218D support.
+	 */
+	sfp0: sfp-p23 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c0>;
+		tx-fault-gpio = <&gpio1 0 GPIO_ACTIVE_HIGH>;
+		tx-disable-gpio = <&gpio1 1 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 2 GPIO_ACTIVE_LOW>;
+		los-gpio = <&gpio1 3 GPIO_ACTIVE_HIGH>;
+	};
+
+	sfp1: sfp-p24 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c1>;
+		tx-fault-gpio = <&gpio1 4 GPIO_ACTIVE_HIGH>;
+		tx-disable-gpio = <&gpio1 5 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 6 GPIO_ACTIVE_LOW>;
+		los-gpio = <&gpio1 7 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&leds {
+	led_status_eco_amber: led-5 {
+		label = "amber:status_eco";
+		gpios = <&gpio2 1 GPIO_ACTIVE_LOW>;
+		color = <LED_COLOR_ID_AMBER>;
+		function = LED_FUNCTION_STATUS;
+		function-enumerator = <1>;
+	};
+
+	led_status_eco_green: led-6 {
+		label = "green:status_eco";
+		gpios = <&gpio2 2 GPIO_ACTIVE_LOW>;
+		color = <LED_COLOR_ID_GREEN>;
+		function = LED_FUNCTION_STATUS;
+		function-enumerator = <2>;
+	};
+};
+
+&i2c_gpio_0 {
+	scl-gpios = <&gpio0 0 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+	sda-gpios = <&gpio0 1 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+};
+
+&i2c_gpio_1 {
+	scl-gpios = <&gpio0 12 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+	sda-gpios = <&gpio0 13 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+};
+
+&gpio2 {
+	interrupt-controller;
+	#interrupt-cells = <2>;
+	interrupt-parent = <&gpio0>;
+	interrupts = <2 IRQ_TYPE_EDGE_FALLING>;
+
+	/*
+	 * GPIO12 (IO1_4): RTL8218FB
+	 *
+	 * This GPIO pin should be specified as "reset-gpio" in mdio node, but
+	 * RTL8218FB phy won't be configured on RTL8218D support in the current
+	 * phy driver. So, ethernet ports on the phy will be broken after hard-
+	 * resetting.
+	 * (RTL8218FB phy will be detected as RTL8218D by the phy driver)
+	 * At the moment, configure this GPIO pin as gpio-hog to avoid breaking
+	 * by resetting.
+	 */
+	ext_switch_reset {
+		gpio-hog;
+		gpios = <12 GPIO_ACTIVE_HIGH>;
+		output-high;
+		line-name = "ext-switch-reset";
+	};
+};
+
+&i2c_switch {
+	i2c0: i2c@0 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0>;
+	};
+
+	i2c1: i2c@1 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <1>;
+	};
+};
+
+&ethernet0 {
+	mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		INTERNAL_PHY(8)
+		INTERNAL_PHY(9)
+		INTERNAL_PHY(10)
+		INTERNAL_PHY(11)
+		INTERNAL_PHY(12)
+		INTERNAL_PHY(13)
+		INTERNAL_PHY(14)
+		INTERNAL_PHY(15)
+
+		/* RTL8218FB */
+		EXTERNAL_PHY(16)
+		EXTERNAL_PHY(17)
+		EXTERNAL_PHY(18)
+		EXTERNAL_PHY(19)
+		EXTERNAL_PHY(20)
+		EXTERNAL_PHY(21)
+		EXTERNAL_PHY(22)
+		EXTERNAL_PHY(23)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(8, 1, internal)
+		SWITCH_PORT(9, 2, internal)
+		SWITCH_PORT(10, 3, internal)
+		SWITCH_PORT(11, 4, internal)
+		SWITCH_PORT(12, 5, internal)
+		SWITCH_PORT(13, 6, internal)
+		SWITCH_PORT(14, 7, internal)
+		SWITCH_PORT(15, 8, internal)
+
+		SWITCH_PORT(16, 9, qsgmii)
+		SWITCH_PORT(17, 10, qsgmii)
+		SWITCH_PORT(18, 11, qsgmii)
+		SWITCH_PORT(19, 12, qsgmii)
+		SWITCH_PORT(20, 13, qsgmii)
+		SWITCH_PORT(21, 14, qsgmii)
+		SWITCH_PORT(22, 15, qsgmii)
+		SWITCH_PORT(23, 16, qsgmii)
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8382_panasonic_m24eg-pn28240k.dts b/target/linux/realtek/dts-5.15/rtl8382_panasonic_m24eg-pn28240k.dts
new file mode 100644
index 00000000000000..1fa9d2cdc7f475
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8382_panasonic_m24eg-pn28240k.dts
@@ -0,0 +1,190 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl838x.dtsi"
+#include "rtl83xx_panasonic_mxxeg-pn28xx0k.dtsi"
+
+#include <dt-bindings/interrupt-controller/irq.h>
+
+/ {
+	compatible = "panasonic,m24eg-pn28240k", "realtek,rtl8382-soc";
+	model = "Panasonic Switch-M24eG PN28240K";
+
+	aliases {
+		led-boot = &led_status_eco_green;
+		led-failsafe = &led_status_eco_amber;
+		led-running = &led_status_eco_green;
+		led-upgrade = &led_status_eco_green;
+	};
+
+	/*
+	 * sfp0/1 are "combo" port with each TP port (23/24), and they are
+	 * connected to the RTL8218FB. Currently, there is no support for
+	 * the chip and only TP ports work by the RTL8218D support.
+	 */
+	sfp0: sfp-p23 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c0>;
+		tx-fault-gpio = <&gpio1 0 GPIO_ACTIVE_HIGH>;
+		tx-disable-gpio = <&gpio1 1 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 2 GPIO_ACTIVE_LOW>;
+		los-gpio = <&gpio1 3 GPIO_ACTIVE_HIGH>;
+	};
+
+	sfp1: sfp-p24 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c1>;
+		tx-fault-gpio = <&gpio1 4 GPIO_ACTIVE_HIGH>;
+		tx-disable-gpio = <&gpio1 5 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 6 GPIO_ACTIVE_LOW>;
+		los-gpio = <&gpio1 7 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&leds {
+	led_status_eco_amber: led-5 {
+		label = "amber:status_eco";
+		gpios = <&gpio2 1 GPIO_ACTIVE_LOW>;
+		color = <LED_COLOR_ID_AMBER>;
+		function = LED_FUNCTION_STATUS;
+		function-enumerator = <1>;
+	};
+
+	led_status_eco_green: led-6 {
+		label = "green:status_eco";
+		gpios = <&gpio2 2 GPIO_ACTIVE_LOW>;
+		color = <LED_COLOR_ID_GREEN>;
+		function = LED_FUNCTION_STATUS;
+		function-enumerator = <2>;
+	};
+};
+
+&i2c_gpio_0 {
+	scl-gpios = <&gpio0 0 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+	sda-gpios = <&gpio0 1 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+};
+
+&i2c_gpio_1 {
+	scl-gpios = <&gpio0 12 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+	sda-gpios = <&gpio0 13 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+};
+
+&gpio2 {
+	interrupt-controller;
+	#interrupt-cells = <2>;
+	interrupt-parent = <&gpio0>;
+	interrupts = <2 IRQ_TYPE_EDGE_FALLING>;
+
+	/*
+	 * GPIO12 (IO1_4): RTL8218B + RTL8218FB
+	 *
+	 * This GPIO pin should be specified as "reset-gpio" in mdio node,
+	 * but the current configuration of RTL8218B phy in the phy driver
+	 * seems to be incomplete and RTL8218FB phy won't be configured on
+	 * RTL8218D support. So, ethernet ports on these phys will be broken
+	 * after hard-resetting.
+	 * (RTL8218FB phy will be detected as RTL8218D by the phy driver)
+	 * At the moment, configure this GPIO pin as gpio-hog to avoid breaking
+	 * by resetting.
+	 */
+	ext_switch_reset {
+		gpio-hog;
+		gpios = <12 GPIO_ACTIVE_HIGH>;
+		output-high;
+		line-name = "ext-switch-reset";
+	};
+};
+
+&i2c_switch {
+	i2c0: i2c@0 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0>;
+	};
+
+	i2c1: i2c@1 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <1>;
+	};
+};
+
+&ethernet0 {
+	mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		EXTERNAL_PHY(0)
+		EXTERNAL_PHY(1)
+		EXTERNAL_PHY(2)
+		EXTERNAL_PHY(3)
+		EXTERNAL_PHY(4)
+		EXTERNAL_PHY(5)
+		EXTERNAL_PHY(6)
+		EXTERNAL_PHY(7)
+
+		INTERNAL_PHY(8)
+		INTERNAL_PHY(9)
+		INTERNAL_PHY(10)
+		INTERNAL_PHY(11)
+		INTERNAL_PHY(12)
+		INTERNAL_PHY(13)
+		INTERNAL_PHY(14)
+		INTERNAL_PHY(15)
+
+		/* RTL8218FB */
+		EXTERNAL_PHY(16)
+		EXTERNAL_PHY(17)
+		EXTERNAL_PHY(18)
+		EXTERNAL_PHY(19)
+		EXTERNAL_PHY(20)
+		EXTERNAL_PHY(21)
+		EXTERNAL_PHY(22)
+		EXTERNAL_PHY(23)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(0, 1, qsgmii)
+		SWITCH_PORT(1, 2, qsgmii)
+		SWITCH_PORT(2, 3, qsgmii)
+		SWITCH_PORT(3, 4, qsgmii)
+		SWITCH_PORT(4, 5, qsgmii)
+		SWITCH_PORT(5, 6, qsgmii)
+		SWITCH_PORT(6, 7, qsgmii)
+		SWITCH_PORT(7, 8, qsgmii)
+
+		SWITCH_PORT(8, 9, internal)
+		SWITCH_PORT(9, 10, internal)
+		SWITCH_PORT(10, 11, internal)
+		SWITCH_PORT(11, 12, internal)
+		SWITCH_PORT(12, 13, internal)
+		SWITCH_PORT(13, 14, internal)
+		SWITCH_PORT(14, 15, internal)
+		SWITCH_PORT(15, 16, internal)
+
+		SWITCH_PORT(16, 17, qsgmii)
+		SWITCH_PORT(17, 18, qsgmii)
+		SWITCH_PORT(18, 19, qsgmii)
+		SWITCH_PORT(19, 20, qsgmii)
+		SWITCH_PORT(20, 21, qsgmii)
+		SWITCH_PORT(21, 22, qsgmii)
+		SWITCH_PORT(22, 23, qsgmii)
+		SWITCH_PORT(23, 24, qsgmii)
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8382_zyxel_gs1900-16.dts b/target/linux/realtek/dts-5.15/rtl8382_zyxel_gs1900-16.dts
new file mode 100644
index 00000000000000..ac2eea7015da72
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8382_zyxel_gs1900-16.dts
@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl8380_zyxel_gs1900.dtsi"
+
+/ {
+	compatible = "zyxel,gs1900-16", "realtek,rtl838x-soc";
+	model = "ZyXEL GS1900-16";
+};
+
+&mdio {
+	EXTERNAL_PHY(16)
+	EXTERNAL_PHY(17)
+	EXTERNAL_PHY(18)
+	EXTERNAL_PHY(19)
+	EXTERNAL_PHY(20)
+	EXTERNAL_PHY(21)
+	EXTERNAL_PHY(22)
+	EXTERNAL_PHY(23)
+};
+
+&switch0 {
+	ports {
+		SWITCH_PORT(16, 9, qsgmii)
+		SWITCH_PORT(17, 10, qsgmii)
+		SWITCH_PORT(18, 11, qsgmii)
+		SWITCH_PORT(19, 12, qsgmii)
+		SWITCH_PORT(20, 13, qsgmii)
+		SWITCH_PORT(21, 14, qsgmii)
+		SWITCH_PORT(22, 15, qsgmii)
+		SWITCH_PORT(23, 16, qsgmii)
+	};
+};
+
+&gpio1 {
+	/delete-node/ poe_enable;
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8382_zyxel_gs1900-24-v1.dts b/target/linux/realtek/dts-5.15/rtl8382_zyxel_gs1900-24-v1.dts
new file mode 100644
index 00000000000000..81482dde1090de
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8382_zyxel_gs1900-24-v1.dts
@@ -0,0 +1,128 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl8380_zyxel_gs1900.dtsi"
+
+/ {
+	compatible = "zyxel,gs1900-24-v1", "realtek,rtl838x-soc";
+	model = "ZyXEL GS1900-24 v1";
+
+	memory@0 {
+		reg = <0x0 0x4000000>;
+	};
+
+	/* i2c of the left SFP cage: port 25 */
+	i2c0: i2c-gpio-0 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 24 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 25 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp0: sfp-p25 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c0>;
+		los-gpio = <&gpio1 27 GPIO_ACTIVE_HIGH>;
+		tx-fault-gpio = <&gpio1 22 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 26 GPIO_ACTIVE_LOW>;
+		tx-disable-gpio = <&gpio1 23 GPIO_ACTIVE_HIGH>;
+	};
+
+	/* i2c of the right SFP cage: port 26 */
+	i2c1: i2c-gpio-1 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 30 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 31 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp1: sfp-p26 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c1>;
+		los-gpio = <&gpio1 33 GPIO_ACTIVE_HIGH>;
+		tx-fault-gpio = <&gpio1 28 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 32 GPIO_ACTIVE_LOW>;
+		tx-disable-gpio = <&gpio1 29 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&uart1 {
+	status = "okay";
+};
+
+&mdio {
+	EXTERNAL_PHY(0)
+	EXTERNAL_PHY(1)
+	EXTERNAL_PHY(2)
+	EXTERNAL_PHY(3)
+	EXTERNAL_PHY(4)
+	EXTERNAL_PHY(5)
+	EXTERNAL_PHY(6)
+	EXTERNAL_PHY(7)
+
+	EXTERNAL_PHY(16)
+	EXTERNAL_PHY(17)
+	EXTERNAL_PHY(18)
+	EXTERNAL_PHY(19)
+	EXTERNAL_PHY(20)
+	EXTERNAL_PHY(21)
+	EXTERNAL_PHY(22)
+	EXTERNAL_PHY(23)
+
+	INTERNAL_PHY(24)
+	INTERNAL_PHY(26)
+};
+
+&switch0 {
+	ports {
+		SWITCH_PORT(0, 1, qsgmii)
+		SWITCH_PORT(1, 2, qsgmii)
+		SWITCH_PORT(2, 3, qsgmii)
+		SWITCH_PORT(3, 4, qsgmii)
+		SWITCH_PORT(4, 5, qsgmii)
+		SWITCH_PORT(5, 6, qsgmii)
+		SWITCH_PORT(6, 7, qsgmii)
+		SWITCH_PORT(7, 8, qsgmii)
+
+		SWITCH_PORT(8, 9, internal)
+		SWITCH_PORT(9, 10, internal)
+		SWITCH_PORT(10, 11, internal)
+		SWITCH_PORT(11, 12, internal)
+		SWITCH_PORT(12, 13, internal)
+		SWITCH_PORT(13, 14, internal)
+		SWITCH_PORT(14, 15, internal)
+		SWITCH_PORT(15, 16, internal)
+
+		SWITCH_PORT(16, 17, qsgmii)
+		SWITCH_PORT(17, 18, qsgmii)
+		SWITCH_PORT(18, 19, qsgmii)
+		SWITCH_PORT(19, 20, qsgmii)
+		SWITCH_PORT(20, 21, qsgmii)
+		SWITCH_PORT(21, 22, qsgmii)
+		SWITCH_PORT(22, 23, qsgmii)
+		SWITCH_PORT(23, 24, qsgmii)
+
+		port@24 {
+			reg = <24>;
+			label = "lan25";
+			phy-mode = "1000base-x";
+			managed = "in-band-status";
+			sfp = <&sfp0>;
+		};
+
+		port@26 {
+			reg = <26>;
+			label = "lan26";
+			phy-mode = "1000base-x";
+			managed = "in-band-status";
+			sfp = <&sfp1>;
+		};
+	};
+};
+
+&gpio1 {
+	/delete-node/ poe_enable;
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8382_zyxel_gs1900-24e.dts b/target/linux/realtek/dts-5.15/rtl8382_zyxel_gs1900-24e.dts
new file mode 100644
index 00000000000000..3d00034a3b5d8e
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8382_zyxel_gs1900-24e.dts
@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl8380_zyxel_gs1900.dtsi"
+
+/ {
+	compatible = "zyxel,gs1900-24e", "realtek,rtl838x-soc";
+	model = "ZyXEL GS1900-24E";
+};
+
+&mdio {
+	EXTERNAL_PHY(0)
+	EXTERNAL_PHY(1)
+	EXTERNAL_PHY(2)
+	EXTERNAL_PHY(3)
+	EXTERNAL_PHY(4)
+	EXTERNAL_PHY(5)
+	EXTERNAL_PHY(6)
+	EXTERNAL_PHY(7)
+
+	EXTERNAL_PHY(16)
+	EXTERNAL_PHY(17)
+	EXTERNAL_PHY(18)
+	EXTERNAL_PHY(19)
+	EXTERNAL_PHY(20)
+	EXTERNAL_PHY(21)
+	EXTERNAL_PHY(22)
+	EXTERNAL_PHY(23)
+};
+
+&switch0 {
+	ports {
+		SWITCH_PORT(1, 1, qsgmii)
+		SWITCH_PORT(0, 2, qsgmii)
+		SWITCH_PORT(3, 3, qsgmii)
+		SWITCH_PORT(2, 4, qsgmii)
+		SWITCH_PORT(5, 5, qsgmii)
+		SWITCH_PORT(4, 6, qsgmii)
+		SWITCH_PORT(7, 7, qsgmii)
+		SWITCH_PORT(6, 8, qsgmii)
+
+		SWITCH_PORT(9, 9, internal)
+		SWITCH_PORT(8, 10, internal)
+		SWITCH_PORT(11, 11, internal)
+		SWITCH_PORT(10, 12, internal)
+		SWITCH_PORT(13, 13, internal)
+		SWITCH_PORT(12, 14, internal)
+		SWITCH_PORT(15, 15, internal)
+		SWITCH_PORT(14, 16, internal)
+
+		SWITCH_PORT(17, 17, qsgmii)
+		SWITCH_PORT(16, 18, qsgmii)
+		SWITCH_PORT(19, 19, qsgmii)
+		SWITCH_PORT(18, 20, qsgmii)
+		SWITCH_PORT(21, 21, qsgmii)
+		SWITCH_PORT(20, 22, qsgmii)
+		SWITCH_PORT(23, 23, qsgmii)
+		SWITCH_PORT(22, 24, qsgmii)
+	};
+};
+
+&gpio1 {
+	/delete-node/ poe_enable;
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8382_zyxel_gs1900-24hp-v1.dts b/target/linux/realtek/dts-5.15/rtl8382_zyxel_gs1900-24hp-v1.dts
new file mode 100644
index 00000000000000..7bb3410a318ada
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8382_zyxel_gs1900-24hp-v1.dts
@@ -0,0 +1,125 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl8380_zyxel_gs1900.dtsi"
+
+/ {
+	compatible = "zyxel,gs1900-24hp-v1", "realtek,rtl838x-soc";
+	model = "ZyXEL GS1900-24HP v1";
+
+	memory@0 {
+		reg = <0x0 0x4000000>;
+	};
+
+	/* i2c of the left SFP cage: port 25 */
+	i2c0: i2c-gpio-0 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 24 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 25 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp0: sfp-p25 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c0>;
+		los-gpio = <&gpio1 27 GPIO_ACTIVE_HIGH>;
+		tx-fault-gpio = <&gpio1 22 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 26 GPIO_ACTIVE_LOW>;
+		tx-disable-gpio = <&gpio1 23 GPIO_ACTIVE_HIGH>;
+	};
+
+	/* i2c of the right SFP cage: port 26 */
+	i2c1: i2c-gpio-1 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 30 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 31 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp1: sfp-p26 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c1>;
+		los-gpio = <&gpio1 33 GPIO_ACTIVE_HIGH>;
+		tx-fault-gpio = <&gpio1 28 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 32 GPIO_ACTIVE_LOW>;
+		tx-disable-gpio = <&gpio1 29 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&uart1 {
+	status = "okay";
+};
+
+&mdio {
+	EXTERNAL_PHY(0)
+	EXTERNAL_PHY(1)
+	EXTERNAL_PHY(2)
+	EXTERNAL_PHY(3)
+	EXTERNAL_PHY(4)
+	EXTERNAL_PHY(5)
+	EXTERNAL_PHY(6)
+	EXTERNAL_PHY(7)
+
+	EXTERNAL_PHY(16)
+	EXTERNAL_PHY(17)
+	EXTERNAL_PHY(18)
+	EXTERNAL_PHY(19)
+	EXTERNAL_PHY(20)
+	EXTERNAL_PHY(21)
+	EXTERNAL_PHY(22)
+	EXTERNAL_PHY(23)
+
+	INTERNAL_PHY(24)
+	INTERNAL_PHY(26)
+};
+
+&switch0 {
+	ports {
+		SWITCH_PORT(0, 1, qsgmii)
+		SWITCH_PORT(1, 2, qsgmii)
+		SWITCH_PORT(2, 3, qsgmii)
+		SWITCH_PORT(3, 4, qsgmii)
+		SWITCH_PORT(4, 5, qsgmii)
+		SWITCH_PORT(5, 6, qsgmii)
+		SWITCH_PORT(6, 7, qsgmii)
+		SWITCH_PORT(7, 8, qsgmii)
+
+		SWITCH_PORT(8, 9, internal)
+		SWITCH_PORT(9, 10, internal)
+		SWITCH_PORT(10, 11, internal)
+		SWITCH_PORT(11, 12, internal)
+		SWITCH_PORT(12, 13, internal)
+		SWITCH_PORT(13, 14, internal)
+		SWITCH_PORT(14, 15, internal)
+		SWITCH_PORT(15, 16, internal)
+
+		SWITCH_PORT(16, 17, qsgmii)
+		SWITCH_PORT(17, 18, qsgmii)
+		SWITCH_PORT(18, 19, qsgmii)
+		SWITCH_PORT(19, 20, qsgmii)
+		SWITCH_PORT(20, 21, qsgmii)
+		SWITCH_PORT(21, 22, qsgmii)
+		SWITCH_PORT(22, 23, qsgmii)
+		SWITCH_PORT(23, 24, qsgmii)
+
+		port@24 {
+			reg = <24>;
+			label = "lan25";
+			phy-mode = "1000base-x";
+			managed = "in-band-status";
+			sfp = <&sfp0>;
+		};
+
+		port@26 {
+			reg = <26>;
+			label = "lan26";
+			phy-mode = "1000base-x";
+			managed = "in-band-status";
+			sfp = <&sfp1>;
+		};
+	};
+};
+
diff --git a/target/linux/realtek/dts-5.15/rtl8382_zyxel_gs1900-24hp-v2.dts b/target/linux/realtek/dts-5.15/rtl8382_zyxel_gs1900-24hp-v2.dts
new file mode 100644
index 00000000000000..7b6a9a1e7fd388
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8382_zyxel_gs1900-24hp-v2.dts
@@ -0,0 +1,121 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl8380_zyxel_gs1900.dtsi"
+
+/ {
+	compatible = "zyxel,gs1900-24hp-v2", "realtek,rtl838x-soc";
+	model = "ZyXEL GS1900-24HP v2 Switch";
+
+	/* i2c of the left SFP cage: port 25 */
+	i2c0: i2c-gpio-0 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 24 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 25 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp0: sfp-p25 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c0>;
+		los-gpio = <&gpio1 27 GPIO_ACTIVE_HIGH>;
+		tx-fault-gpio = <&gpio1 22 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 26 GPIO_ACTIVE_LOW>;
+		tx-disable-gpio = <&gpio1 23 GPIO_ACTIVE_HIGH>;
+	};
+
+	/* i2c of the right SFP cage: port 26 */
+	i2c1: i2c-gpio-1 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 30 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 31 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp1: sfp-p26 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c1>;
+		los-gpio = <&gpio1 33 GPIO_ACTIVE_HIGH>;
+		tx-fault-gpio = <&gpio1 28 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 32 GPIO_ACTIVE_LOW>;
+		tx-disable-gpio = <&gpio1 29 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&uart1 {
+	status = "okay";
+};
+
+&mdio {
+	EXTERNAL_PHY(0)
+	EXTERNAL_PHY(1)
+	EXTERNAL_PHY(2)
+	EXTERNAL_PHY(3)
+	EXTERNAL_PHY(4)
+	EXTERNAL_PHY(5)
+	EXTERNAL_PHY(6)
+	EXTERNAL_PHY(7)
+
+	EXTERNAL_PHY(16)
+	EXTERNAL_PHY(17)
+	EXTERNAL_PHY(18)
+	EXTERNAL_PHY(19)
+	EXTERNAL_PHY(20)
+	EXTERNAL_PHY(21)
+	EXTERNAL_PHY(22)
+	EXTERNAL_PHY(23)
+
+	INTERNAL_PHY(24)
+	INTERNAL_PHY(26)
+};
+
+&switch0 {
+	ports {
+		SWITCH_PORT(0, 1, qsgmii)
+		SWITCH_PORT(1, 2, qsgmii)
+		SWITCH_PORT(2, 3, qsgmii)
+		SWITCH_PORT(3, 4, qsgmii)
+		SWITCH_PORT(4, 5, qsgmii)
+		SWITCH_PORT(5, 6, qsgmii)
+		SWITCH_PORT(6, 7, qsgmii)
+		SWITCH_PORT(7, 8, qsgmii)
+
+		SWITCH_PORT(8, 9, internal)
+		SWITCH_PORT(9, 10, internal)
+		SWITCH_PORT(10, 11, internal)
+		SWITCH_PORT(11, 12, internal)
+		SWITCH_PORT(12, 13, internal)
+		SWITCH_PORT(13, 14, internal)
+		SWITCH_PORT(14, 15, internal)
+		SWITCH_PORT(15, 16, internal)
+
+		SWITCH_PORT(16, 17, qsgmii)
+		SWITCH_PORT(17, 18, qsgmii)
+		SWITCH_PORT(18, 19, qsgmii)
+		SWITCH_PORT(19, 20, qsgmii)
+		SWITCH_PORT(20, 21, qsgmii)
+		SWITCH_PORT(21, 22, qsgmii)
+		SWITCH_PORT(22, 23, qsgmii)
+		SWITCH_PORT(23, 24, qsgmii)
+
+
+		port@24 {
+			reg = <24>;
+			label = "lan25";
+			phy-mode = "1000base-x";
+			managed = "in-band-status";
+			sfp = <&sfp0>;
+		};
+
+		port@26 {
+			reg = <26>;
+			label = "lan26";
+			phy-mode = "1000base-x";
+			managed = "in-band-status";
+			sfp = <&sfp1>;
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl838x.dtsi b/target/linux/realtek/dts-5.15/rtl838x.dtsi
new file mode 100644
index 00000000000000..13ba6450b2d6f0
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl838x.dtsi
@@ -0,0 +1,293 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include <dt-bindings/clock/rtl83xx-clk.h>
+
+/dts-v1/;
+
+#define STRINGIZE(s) #s
+#define LAN_LABEL(p, s) STRINGIZE(p ## s)
+#define SWITCH_PORT_LABEL(n) LAN_LABEL(lan, n)
+
+#define INTERNAL_PHY(n) \
+	phy##n: ethernet-phy@##n { \
+		reg = <##n>; \
+		compatible = "ethernet-phy-ieee802.3-c22"; \
+		phy-is-integrated; \
+	};
+
+#define EXTERNAL_PHY(n) \
+	phy##n: ethernet-phy@##n { \
+		reg = <##n>; \
+		compatible = "ethernet-phy-ieee802.3-c22"; \
+	};
+
+#define EXTERNAL_SFP_PHY(n) \
+	phy##n: ethernet-phy@##n { \
+		compatible = "ethernet-phy-ieee802.3-c22"; \
+		sfp; \
+		media = "fibre"; \
+		reg = <##n>; \
+	};
+
+#define EXTERNAL_SFP_PHY_FULL(n, s) \
+	phy##n: ethernet-phy@##n { \
+		compatible = "ethernet-phy-ieee802.3-c22"; \
+		sfp = <&sfp##s>; \
+		reg = <##n>; \
+	};
+
+#define SWITCH_PORT(n, s, m) \
+	port##n: port@##n { \
+		reg = <##n>; \
+		label = SWITCH_PORT_LABEL(s) ; \
+		phy-handle = <&phy##n>; \
+		phy-mode = #m ; \
+	};
+
+#define SWITCH_SFP_PORT(n, s, m) \
+	port##n: port@##n { \
+		reg = <##n>; \
+		label = SWITCH_PORT_LABEL(s) ; \
+		phy-handle = <&phy##n>; \
+		phy-mode = #m ; \
+		fixed-link { \
+			speed = <1000>; \
+			full-duplex; \
+		}; \
+	};
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	compatible = "realtek,rtl838x-soc";
+
+	osc: oscillator {
+		compatible = "fixed-clock";
+		#clock-cells = <0>;
+		clock-frequency = <25000000>;
+	};
+
+	ccu: clock-controller {
+		compatible = "realtek,rtl8380-clock";
+		#clock-cells = <1>;
+		clocks = <&osc>;
+		clock-names = "ref_clk";
+	};
+
+	cpus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		cpu@0 {
+			compatible = "mips,mips4KEc";
+			reg = <0>;
+			clocks = <&ccu CLK_CPU>;
+			operating-points-v2 = <&cpu_opp_table>;
+		};
+	};
+
+	cpu_opp_table: opp-table-0 {
+		compatible = "operating-points-v2";
+		opp-shared;
+
+		opp00 {
+			opp-hz = /bits/ 64 <325000000>;
+		};
+		opp01 {
+			opp-hz = /bits/ 64 <350000000>;
+		};
+		opp02 {
+			opp-hz = /bits/ 64 <375000000>;
+		};
+		opp03 {
+			opp-hz = /bits/ 64 <400000000>;
+		};
+		opp04 {
+			opp-hz = /bits/ 64 <425000000>;
+		};
+		opp05 {
+			opp-hz = /bits/ 64 <450000000>;
+		};
+		opp06 {
+			opp-hz = /bits/ 64 <475000000>;
+		};
+		opp07 {
+			opp-hz = /bits/ 64 <500000000>;
+		};
+	};
+
+	aliases {
+		serial0 = &uart0;
+		serial1 = &uart1;
+	};
+
+	chosen {
+		bootargs = "earlycon";
+		stdout-path = "serial0:115200n8";
+	};
+
+	cpuintc: cpuintc {
+		compatible = "mti,cpu-interrupt-controller";
+		#address-cells = <0>;
+		#interrupt-cells = <1>;
+		interrupt-controller;
+	};
+
+	soc: soc {
+		compatible = "simple-bus";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges = <0x0 0x18000000 0x10000>;
+
+		intc: interrupt-controller@3000 {
+			compatible = "realtek,rtl8380-intc", "realtek,rtl-intc";
+			reg = <0x3000 0x18>;
+			interrupt-controller;
+			#interrupt-cells = <2>;
+
+			interrupt-parent = <&cpuintc>;
+			interrupts = <2>, <3>, <4>, <5>, <6>;
+		};
+
+		spi0: spi@1200 {
+			compatible = "realtek,rtl8380-spi";
+			reg = <0x1200 0x100>;
+
+			#address-cells = <1>;
+			#size-cells = <0>;
+		};
+
+		timer0: timer@3100 {
+			compatible = "realtek,rtl8380-timer", "realtek,otto-timer";
+			reg = <0x3100 0x10>, <0x3110 0x10>, <0x3120 0x10>,
+			      <0x3130 0x10>, <0x3140 0x10>;
+
+			interrupt-parent = <&intc>;
+			interrupts = <29 4>, <28 4>, <17 4>, <16 4>, <15 4>;
+			clocks = <&ccu CLK_LXB>;
+		};
+
+		uart0: uart@2000 {
+			compatible = "ns16550a";
+			reg = <0x2000 0x100>;
+
+			clocks = <&ccu CLK_LXB>;
+
+			interrupt-parent = <&intc>;
+			interrupts = <31 1>;
+
+			reg-io-width = <1>;
+			reg-shift = <2>;
+			fifo-size = <1>;
+			no-loopback-test;
+		};
+
+		uart1: uart@2100 {
+			pinctrl-names = "default";
+			pinctrl-0 = <&enable_uart1>;
+
+			compatible = "ns16550a";
+			reg = <0x2100 0x100>;
+
+			clocks = <&ccu CLK_LXB>;
+
+			interrupt-parent = <&intc>;
+			interrupts = <30 0>;
+
+			reg-io-width = <1>;
+			reg-shift = <2>;
+			fifo-size = <1>;
+			no-loopback-test;
+
+			status = "disabled";
+		};
+
+		watchdog0: watchdog@3150 {
+			compatible = "realtek,rtl8380-wdt";
+			reg = <0x3150 0xc>;
+
+			realtek,reset-mode = "soc";
+
+			clocks = <&ccu CLK_LXB>;
+			timeout-sec = <30>;
+
+			interrupt-parent = <&intc>;
+			interrupt-names = "phase1", "phase2";
+			interrupts = <19 3>, <18 4>;
+		};
+
+		gpio0: gpio-controller@3500 {
+			compatible = "realtek,rtl8380-gpio", "realtek,otto-gpio";
+			reg = <0x3500 0x20>;
+
+			gpio-controller;
+			#gpio-cells = <2>;
+			ngpios = <24>;
+
+			interrupt-controller;
+			#interrupt-cells = <2>;
+			interrupt-parent = <&intc>;
+			interrupts = <23 3>;
+		};
+	};
+
+	pinmux: pinmux@1b001000 {
+		compatible = "pinctrl-single";
+		reg = <0x1b001000 0x4>;
+
+		pinctrl-single,bit-per-mux;
+		pinctrl-single,register-width = <32>;
+		pinctrl-single,function-mask = <0x1>;
+		#pinctrl-cells = <2>;
+
+		enable_uart1: pinmux_enable_uart1 {
+			pinctrl-single,bits = <0x0 0x10 0x10>;
+		};
+	};
+
+	/* LED_GLB_CTRL */
+	pinmux_led: pinmux@1b00a000 {
+		compatible = "pinctrl-single";
+		reg = <0x1b00a000 0x4>;
+
+		pinctrl-single,bit-per-mux;
+		pinctrl-single,register-width = <32>;
+		pinctrl-single,function-mask = <0x1>;
+		#pinctrl-cells = <2>;
+
+		/* enable GPIO 0 */
+		pinmux_disable_sys_led: disable_sys_led {
+			pinctrl-single,bits = <0x0 0x0 0x8000>;
+		};
+	};
+
+	ethernet0: ethernet@1b00a300 {
+		compatible = "realtek,rtl838x-eth";
+		reg = <0x1b00a300 0x100>;
+		interrupt-parent = <&intc>;
+		interrupts = <24 3>;
+		#interrupt-cells = <1>;
+		phy-mode = "internal";
+
+		fixed-link {
+			speed = <1000>;
+			full-duplex;
+		};
+	};
+
+	sram0: sram@9f000000 {
+		compatible = "mmio-sram";
+		reg = <0x9f000000 0x10000>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges = <0 0x9f000000 0x10000>;
+	};
+
+	switch0: switch@1b000000 {
+		compatible = "realtek,rtl83xx-switch";
+
+		interrupt-parent = <&intc>;
+		interrupts = <20 2>;
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl838x_hpe_1920.dtsi b/target/linux/realtek/dts-5.15/rtl838x_hpe_1920.dtsi
new file mode 100644
index 00000000000000..e18f61345ea38a
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl838x_hpe_1920.dtsi
@@ -0,0 +1,96 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	chosen {
+		stdout-path = "serial0:38400n8";
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x0 0x8000000>;
+	};
+
+	watchdog1: watchdog {
+		// PT7A7514
+		compatible = "linux,wdt-gpio";
+		gpios = <&gpio0 0 GPIO_ACTIVE_HIGH>;
+		hw_algo = "toggle";
+		hw_margin_ms = <1000>;
+		always-running;
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&pinmux_disable_sys_led>;
+	};
+};
+
+&watchdog0 {
+	status = "disabled";
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <50000000>;
+		m25p,fast-read;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "bootware_basic";
+				reg = <0x0 0x50000>;
+				read-only;
+			};
+
+			partition@0x60000 {
+				label = "bootware_data";
+				reg = <0x60000 0x30000>;
+				read-only;
+			};
+
+			partition@0x90000 {
+				label = "bootware_extend";
+				reg = <0x90000 0x40000>;
+				read-only;
+			};
+
+			partition@0x100000 {
+				label = "bootware_basic_backup";
+				reg = <0x100000 0x50000>;
+				read-only;
+			};
+
+			partition@0x160000 {
+				label = "bootware_data_backup";
+				reg = <0x160000 0x30000>;
+				read-only;
+			};
+
+			partition@0x190000 {
+				label = "bootware_extend_backup";
+				reg = <0x190000 0x40000>;
+				read-only;
+			};
+
+			partition@0x300000 {
+				label = "firmware";
+				compatible = "h3c,vfs-firmware";
+				reg = <0x300000 0x1cf0000>;
+			};
+
+			partition@0x1ff0000 {
+				label = "factory";
+				reg = <0x1ff0000 0x10000>;
+				read-only;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8393_d-link_dgs-1210-52.dts b/target/linux/realtek/dts-5.15/rtl8393_d-link_dgs-1210-52.dts
new file mode 100644
index 00000000000000..5b876e7c431dae
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8393_d-link_dgs-1210-52.dts
@@ -0,0 +1,163 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl839x.dtsi"
+#include "rtl83xx_d-link_dgs-1210_common.dtsi"
+#include "rtl83xx_d-link_dgs-1210_gpio.dtsi"
+#include "rtl839x_d-link_dgs-1210_gpio.dtsi"
+
+/ {
+	compatible = "d-link,dgs-1210-52", "realtek,rtl8393-soc";
+	model = "D-Link DGS-1210-52";
+};
+
+&ethernet0 {
+	mdio: mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		/* External phy RTL8218B #1 */
+		EXTERNAL_PHY(0)
+		EXTERNAL_PHY(1)
+		EXTERNAL_PHY(2)
+		EXTERNAL_PHY(3)
+		EXTERNAL_PHY(4)
+		EXTERNAL_PHY(5)
+		EXTERNAL_PHY(6)
+		EXTERNAL_PHY(7)
+
+		/* External phy RTL8218B #2 */
+		EXTERNAL_PHY(8)
+		EXTERNAL_PHY(9)
+		EXTERNAL_PHY(10)
+		EXTERNAL_PHY(11)
+		EXTERNAL_PHY(12)
+		EXTERNAL_PHY(13)
+		EXTERNAL_PHY(14)
+		EXTERNAL_PHY(15)
+
+		/* External phy RTL8218B #3 */
+		EXTERNAL_PHY(16)
+		EXTERNAL_PHY(17)
+		EXTERNAL_PHY(18)
+		EXTERNAL_PHY(19)
+		EXTERNAL_PHY(20)
+		EXTERNAL_PHY(21)
+		EXTERNAL_PHY(22)
+		EXTERNAL_PHY(23)
+
+		/* External phy RTL8218B #4 */
+		EXTERNAL_PHY(24)
+		EXTERNAL_PHY(25)
+		EXTERNAL_PHY(26)
+		EXTERNAL_PHY(27)
+		EXTERNAL_PHY(28)
+		EXTERNAL_PHY(29)
+		EXTERNAL_PHY(30)
+		EXTERNAL_PHY(31)
+
+		/* External phy RTL8218B #5 */
+		EXTERNAL_PHY(32)
+		EXTERNAL_PHY(33)
+		EXTERNAL_PHY(34)
+		EXTERNAL_PHY(35)
+		EXTERNAL_PHY(36)
+		EXTERNAL_PHY(37)
+		EXTERNAL_PHY(38)
+		EXTERNAL_PHY(39)
+
+		/* External phy RTL8218B #6 */
+		EXTERNAL_PHY(40)
+		EXTERNAL_PHY(41)
+		EXTERNAL_PHY(42)
+		EXTERNAL_PHY(43)
+		EXTERNAL_PHY(44)
+		EXTERNAL_PHY(45)
+		EXTERNAL_PHY(46)
+		EXTERNAL_PHY(47)
+
+		/* External phy RTL8214FC */
+		EXTERNAL_SFP_PHY_FULL(48, 0)
+		EXTERNAL_SFP_PHY_FULL(49, 1)
+		EXTERNAL_SFP_PHY_FULL(50, 2)
+		EXTERNAL_SFP_PHY_FULL(51, 3)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(0, 1, qsgmii)
+		SWITCH_PORT(1, 2, qsgmii)
+		SWITCH_PORT(2, 3, qsgmii)
+		SWITCH_PORT(3, 4, qsgmii)
+		SWITCH_PORT(4, 5, qsgmii)
+		SWITCH_PORT(5, 6, qsgmii)
+		SWITCH_PORT(6, 7, qsgmii)
+		SWITCH_PORT(7, 8, qsgmii)
+
+		SWITCH_PORT(8, 9, qsgmii)
+		SWITCH_PORT(9, 10, qsgmii)
+		SWITCH_PORT(10, 11, qsgmii)
+		SWITCH_PORT(11, 12, qsgmii)
+		SWITCH_PORT(12, 13, qsgmii)
+		SWITCH_PORT(13, 14, qsgmii)
+		SWITCH_PORT(14, 15, qsgmii)
+		SWITCH_PORT(15, 16, qsgmii)
+
+		SWITCH_PORT(16, 17, qsgmii)
+		SWITCH_PORT(17, 18, qsgmii)
+		SWITCH_PORT(18, 19, qsgmii)
+		SWITCH_PORT(19, 20, qsgmii)
+		SWITCH_PORT(20, 21, qsgmii)
+		SWITCH_PORT(21, 22, qsgmii)
+		SWITCH_PORT(22, 23, qsgmii)
+		SWITCH_PORT(23, 24, qsgmii)
+
+		SWITCH_PORT(24, 25, qsgmii)
+		SWITCH_PORT(25, 26, qsgmii)
+		SWITCH_PORT(26, 27, qsgmii)
+		SWITCH_PORT(27, 28, qsgmii)
+		SWITCH_PORT(28, 29, qsgmii)
+		SWITCH_PORT(29, 30, qsgmii)
+		SWITCH_PORT(30, 31, qsgmii)
+		SWITCH_PORT(31, 32, qsgmii)
+
+		SWITCH_PORT(32, 33, qsgmii)
+		SWITCH_PORT(33, 34, qsgmii)
+		SWITCH_PORT(34, 35, qsgmii)
+		SWITCH_PORT(35, 36, qsgmii)
+		SWITCH_PORT(36, 37, qsgmii)
+		SWITCH_PORT(37, 38, qsgmii)
+		SWITCH_PORT(38, 39, qsgmii)
+		SWITCH_PORT(39, 40, qsgmii)
+
+		SWITCH_PORT(40, 41, qsgmii)
+		SWITCH_PORT(41, 42, qsgmii)
+		SWITCH_PORT(42, 43, qsgmii)
+		SWITCH_PORT(43, 44, qsgmii)
+		SWITCH_PORT(44, 45, qsgmii)
+		SWITCH_PORT(45, 46, qsgmii)
+		SWITCH_PORT(46, 47, qsgmii)
+		SWITCH_PORT(47, 48, qsgmii)
+
+		SWITCH_PORT(48, 49, qsgmii)
+		SWITCH_PORT(49, 50, qsgmii)
+		SWITCH_PORT(50, 51, qsgmii)
+		SWITCH_PORT(51, 52, qsgmii)
+
+		/* CPU-Port */
+		port@52 {
+			ethernet = <&ethernet0>;
+			reg = <52>;
+			phy-mode = "qsgmii";
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8393_netgear_gs750e.dts b/target/linux/realtek/dts-5.15/rtl8393_netgear_gs750e.dts
new file mode 100644
index 00000000000000..750af3e94fa617
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8393_netgear_gs750e.dts
@@ -0,0 +1,252 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl839x.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "netgear,gs750e", "realtek,rtl8393-soc";
+	model = "Netgear GS750E";
+
+	aliases {
+		label-mac-device = &ethernet0;
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x0 0x8000000>;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio0 11 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	gpio-restart {
+		compatible = "gpio-restart";
+		gpios = <&gpio0 10 GPIO_ACTIVE_LOW>;
+	};
+
+	virtual_flash {
+		compatible = "mtd-concat";
+
+		devices = <&fwconcat0>, <&fwconcat1>, <&fwconcat2>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "firmware";
+				reg = <0x0 0x760000>;
+				compatible = "openwrt,uimage", "denx,uimage";
+				openwrt,ih-magic = <0x174e4741>;
+			};
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x80000>;
+				read-only;
+			};
+
+			partition@80000 {
+				label = "u-boot-env";
+				reg = <0x80000 0x10000>;
+				read-only;
+			};
+
+			partition@90000 {
+				label = "u-boot-env2";
+				reg = <0x90000 0x10000>;
+				read-only;
+			};
+
+			fwconcat1: partition@a0000 {
+				label = "jffs2_cfg";
+				reg = <0xa0000 0x80000>;
+			};
+
+			fwconcat2: partition@120000 {
+				label = "jffs2_log";
+				reg = <0x120000 0x80000>;
+			};
+
+			fwconcat0: partition@1a0000 {
+				label = "runtime";
+				reg = <0x1a0000 0x660000>;
+			};
+		};
+	};
+};
+
+&ethernet0 {
+	mdio: mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reset-gpios = <&gpio0 23 GPIO_ACTIVE_LOW>;
+
+		/* External phy RTL8218B #1 */
+		EXTERNAL_PHY(0)
+		EXTERNAL_PHY(1)
+		EXTERNAL_PHY(2)
+		EXTERNAL_PHY(3)
+		EXTERNAL_PHY(4)
+		EXTERNAL_PHY(5)
+		EXTERNAL_PHY(6)
+		EXTERNAL_PHY(7)
+
+		/* External phy RTL8218B #2 */
+		EXTERNAL_PHY(8)
+		EXTERNAL_PHY(9)
+		EXTERNAL_PHY(10)
+		EXTERNAL_PHY(11)
+		EXTERNAL_PHY(12)
+		EXTERNAL_PHY(13)
+		EXTERNAL_PHY(14)
+		EXTERNAL_PHY(15)
+
+		/* External phy RTL8218B #3 */
+		EXTERNAL_PHY(16)
+		EXTERNAL_PHY(17)
+		EXTERNAL_PHY(18)
+		EXTERNAL_PHY(19)
+		EXTERNAL_PHY(20)
+		EXTERNAL_PHY(21)
+		EXTERNAL_PHY(22)
+		EXTERNAL_PHY(23)
+
+		/* External phy RTL8218B #4 */
+		EXTERNAL_PHY(24)
+		EXTERNAL_PHY(25)
+		EXTERNAL_PHY(26)
+		EXTERNAL_PHY(27)
+		EXTERNAL_PHY(28)
+		EXTERNAL_PHY(29)
+		EXTERNAL_PHY(30)
+		EXTERNAL_PHY(31)
+
+		/* External phy RTL8218B #5 */
+		EXTERNAL_PHY(32)
+		EXTERNAL_PHY(33)
+		EXTERNAL_PHY(34)
+		EXTERNAL_PHY(35)
+		EXTERNAL_PHY(36)
+		EXTERNAL_PHY(37)
+		EXTERNAL_PHY(38)
+		EXTERNAL_PHY(39)
+
+		/* External phy RTL8218B #6 */
+		EXTERNAL_PHY(40)
+		EXTERNAL_PHY(41)
+		EXTERNAL_PHY(42)
+		EXTERNAL_PHY(43)
+		EXTERNAL_PHY(44)
+		EXTERNAL_PHY(45)
+		EXTERNAL_PHY(46)
+		EXTERNAL_PHY(47)
+
+		/* RTL8393 Internal SerDes */
+		INTERNAL_PHY(48)
+		INTERNAL_PHY(49)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(0, 1, qsgmii)
+		SWITCH_PORT(1, 2, qsgmii)
+		SWITCH_PORT(2, 3, qsgmii)
+		SWITCH_PORT(3, 4, qsgmii)
+		SWITCH_PORT(4, 5, qsgmii)
+		SWITCH_PORT(5, 6, qsgmii)
+		SWITCH_PORT(6, 7, qsgmii)
+		SWITCH_PORT(7, 8, qsgmii)
+
+		SWITCH_PORT(8, 9, qsgmii)
+		SWITCH_PORT(9, 0, qsgmii)
+		SWITCH_PORT(10, 11, qsgmii)
+		SWITCH_PORT(11, 12, qsgmii)
+		SWITCH_PORT(12, 13, qsgmii)
+		SWITCH_PORT(13, 14, qsgmii)
+		SWITCH_PORT(14, 15, qsgmii)
+		SWITCH_PORT(15, 16, qsgmii)
+
+		SWITCH_PORT(16, 17, qsgmii)
+		SWITCH_PORT(17, 18, qsgmii)
+		SWITCH_PORT(18, 19, qsgmii)
+		SWITCH_PORT(19, 20, qsgmii)
+		SWITCH_PORT(20, 21, qsgmii)
+		SWITCH_PORT(21, 22, qsgmii)
+		SWITCH_PORT(22, 23, qsgmii)
+		SWITCH_PORT(23, 24, qsgmii)
+
+		SWITCH_PORT(24, 25, qsgmii)
+		SWITCH_PORT(25, 26, qsgmii)
+		SWITCH_PORT(26, 27, qsgmii)
+		SWITCH_PORT(27, 28, qsgmii)
+		SWITCH_PORT(28, 29, qsgmii)
+		SWITCH_PORT(29, 30, qsgmii)
+		SWITCH_PORT(30, 31, qsgmii)
+		SWITCH_PORT(31, 32, qsgmii)
+
+		SWITCH_PORT(32, 33, qsgmii)
+		SWITCH_PORT(33, 34, qsgmii)
+		SWITCH_PORT(34, 35, qsgmii)
+		SWITCH_PORT(35, 36, qsgmii)
+		SWITCH_PORT(36, 37, qsgmii)
+		SWITCH_PORT(37, 38, qsgmii)
+		SWITCH_PORT(38, 39, qsgmii)
+		SWITCH_PORT(39, 40, qsgmii)
+
+		SWITCH_PORT(40, 41, qsgmii)
+		SWITCH_PORT(41, 42, qsgmii)
+		SWITCH_PORT(42, 43, qsgmii)
+		SWITCH_PORT(43, 44, qsgmii)
+		SWITCH_PORT(44, 45, qsgmii)
+		SWITCH_PORT(45, 46, qsgmii)
+		SWITCH_PORT(46, 47, qsgmii)
+		SWITCH_PORT(47, 48, qsgmii)
+
+		/* SFP cages */
+		SWITCH_SFP_PORT(48, 49, sgmii)
+		SWITCH_SFP_PORT(49, 50, sgmii)
+
+		/* CPU-Port */
+		port@52 {
+			ethernet = <&ethernet0>;
+			reg = <52>;
+			phy-mode = "qsgmii";
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8393_panasonic_m48eg-pn28480k.dts b/target/linux/realtek/dts-5.15/rtl8393_panasonic_m48eg-pn28480k.dts
new file mode 100644
index 00000000000000..6a7eb6eb8137b6
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8393_panasonic_m48eg-pn28480k.dts
@@ -0,0 +1,380 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl839x.dtsi"
+#include "rtl83xx_panasonic_mxxeg-pn28xx0k.dtsi"
+
+#include <dt-bindings/interrupt-controller/irq.h>
+
+/ {
+	compatible = "panasonic,m48eg-pn28480k", "realtek,rtl8393-soc";
+	model = "Panasonic Switch-M48eG PN28480K";
+
+	aliases {
+		led-boot = &led_status_eco_green;
+		led-failsafe = &led_status_eco_amber;
+		led-running = &led_status_eco_green;
+		led-upgrade = &led_status_eco_green;
+	};
+
+	fan: gpio-fan {
+		compatible = "gpio-fan";
+		gpios = <&gpio0 19 GPIO_ACTIVE_HIGH>;
+		/* the actual speeds (rpm) are unknown, just use dummy values */
+		gpio-fan,speed-map = <1 0>, <2 1>;
+		#cooling-cells = <2>;
+	};
+
+	/*
+	 * sfp0/1/2/3 are "combo" port with each TP port (45/46/47/48),
+	 * and they are connected to the RTL8218FB. Currently, there is
+	 * no support for the chip and only TP ports work by the RTL8218B
+	 * support.
+	 */
+	sfp0: sfp-p45 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c0>;
+		tx-fault-gpio = <&gpio1 0 GPIO_ACTIVE_HIGH>;
+		tx-disable-gpio = <&gpio1 1 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 2 GPIO_ACTIVE_LOW>;
+		los-gpio = <&gpio1 3 GPIO_ACTIVE_HIGH>;
+	};
+
+	sfp1: sfp-p46 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c1>;
+		tx-fault-gpio = <&gpio1 4 GPIO_ACTIVE_HIGH>;
+		tx-disable-gpio = <&gpio1 5 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 6 GPIO_ACTIVE_LOW>;
+		los-gpio = <&gpio1 7 GPIO_ACTIVE_HIGH>;
+	};
+
+	sfp2: sfp-p47 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c2>;
+		tx-fault-gpio = <&gpio1 8 GPIO_ACTIVE_HIGH>;
+		tx-disable-gpio = <&gpio1 9 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 10 GPIO_ACTIVE_LOW>;
+		los-gpio = <&gpio1 11 GPIO_ACTIVE_HIGH>;
+	};
+
+	sfp3: sfp-p48 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c3>;
+		tx-fault-gpio = <&gpio1 12 GPIO_ACTIVE_HIGH>;
+		tx-disable-gpio = <&gpio1 13 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 14 GPIO_ACTIVE_LOW>;
+		los-gpio = <&gpio1 15 GPIO_ACTIVE_HIGH>;
+	};
+
+	thermal-zones {
+		/*
+		 * Zone for SoC temperature
+		 *
+		 * Fan speed:
+		 *
+		 * -  0-44 celsius: Low
+		 * - 45-54 celsius: High
+		 */
+		cpu-thermal {
+			polling-delay-passive = <1000>;
+			polling-delay = <2000>;
+
+			thermal-sensors = <&tsens_soc>;
+
+			trips {
+				cpu_alert: trip-point {
+					temperature = <45000>;
+					hysteresis = <4000>;
+					type = "active";
+				};
+
+				cpu_crit {
+					temperature = <55000>;
+					hysteresis = <1000>;
+					type = "critical";
+				};
+			};
+
+			cooling-maps {
+				map {
+					trip = <&cpu_alert>;
+					cooling-device = <&fan 0 1>;
+				};
+			};
+		};
+
+		 /*
+		 * Zone for system temperature
+		 *
+		 * Fan speed:
+		 *
+		 * -  0-39 celsius: Low
+		 * - 40-49 celsius: High
+		 *
+		 * Note: official recommended ranges of temperature on each
+		 *       fan speed setting:
+		 *
+		 *       - Low speed : 0-40 celsius
+		 *       - High speed: 0-50 celsius
+		 *
+		 *       (stock firmware doesn't support auto-selection of
+		 *        speed and need to be selected manually by user)
+		 */
+		sys-thermal {
+			polling-delay-passive = <1000>;
+			polling-delay = <2000>;
+
+			thermal-sensors = <&tsens_sys>;
+
+			trips {
+				sys_alert: trip-point {
+					temperature = <40000>;
+					hysteresis = <4000>;
+					type = "active";
+				};
+
+				sys_crit {
+					temperature = <50000>;
+					hysteresis = <2000>;
+					type = "critical";
+				};
+			};
+
+			cooling-maps {
+				map {
+					trip = <&sys_alert>;
+					cooling-device = <&fan 0 1>;
+				};
+			};
+		};
+	};
+};
+
+&leds {
+	led_status_eco_amber: led-5 {
+		label = "amber:status_eco";
+		gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>;
+		color = <LED_COLOR_ID_AMBER>;
+		function = LED_FUNCTION_STATUS;
+		function-enumerator = <1>;
+	};
+
+	led_status_eco_green: led-6 {
+		label = "green:status_eco";
+		gpios = <&gpio2 2 GPIO_ACTIVE_HIGH>;
+		color = <LED_COLOR_ID_GREEN>;
+		function = LED_FUNCTION_STATUS;
+		function-enumerator = <2>;
+	};
+};
+
+&i2c_gpio_0 {
+	scl-gpios = <&gpio0 16 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+	sda-gpios = <&gpio0 17 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+
+	/* Microchip TCN75A (for SoC) */
+	tsens_soc: sensor@48 {
+		compatible = "microchip,tcn75";
+		reg = <0x48>;
+		#thermal-sensor-cells = <0>;
+	};
+
+	/* Microchip TCN75A (for System) */
+	tsens_sys: sensor@49 {
+		compatible = "microchip,tcn75";
+		reg = <0x49>;
+		#thermal-sensor-cells = <0>;
+	};
+};
+
+&i2c_gpio_1 {
+	scl-gpios = <&gpio0 14 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+	sda-gpios = <&gpio0 15 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+};
+
+&gpio2 {
+	interrupt-controller;
+	#interrupt-cells = <2>;
+	interrupt-parent = <&gpio0>;
+	interrupts = <18 IRQ_TYPE_EDGE_FALLING>;
+
+	/*
+	 * GPIO12 (IO1_4): 5x RTL8218B + RTL8218FB
+	 *
+	 * This GPIO pin should be specified as "reset-gpio" in mdio node,
+	 * but the current configuration of RTL8218B phy in the phy driver
+	 * seems to be incomplete and RTL8218FB phy won't be configured on
+	 * RTL8218D support. So, ethernet ports on these phys will be broken
+	 * after hard-resetting.
+	 * (RTL8218FB phy will be detected as RTL8218D by the phy driver)
+	 * At the moment, configure this GPIO pin as gpio-hog to avoid breaking
+	 * by resetting.
+	 */
+	ext_switch_reset {
+		gpio-hog;
+		gpios = <12 GPIO_ACTIVE_HIGH>;
+		output-high;
+		line-name = "ext-switch-reset";
+	};
+};
+
+&i2c_switch {
+	i2c0: i2c@0 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0>;
+	};
+
+	i2c1: i2c@1 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <1>;
+	};
+
+	i2c2: i2c@2 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <2>;
+	};
+
+	i2c3: i2c@3 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <3>;
+	};
+};
+
+&ethernet0 {
+	mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		EXTERNAL_PHY(0)
+		EXTERNAL_PHY(1)
+		EXTERNAL_PHY(2)
+		EXTERNAL_PHY(3)
+		EXTERNAL_PHY(4)
+		EXTERNAL_PHY(5)
+		EXTERNAL_PHY(6)
+		EXTERNAL_PHY(7)
+
+		EXTERNAL_PHY(8)
+		EXTERNAL_PHY(9)
+		EXTERNAL_PHY(10)
+		EXTERNAL_PHY(11)
+		EXTERNAL_PHY(12)
+		EXTERNAL_PHY(13)
+		EXTERNAL_PHY(14)
+		EXTERNAL_PHY(15)
+
+		EXTERNAL_PHY(16)
+		EXTERNAL_PHY(17)
+		EXTERNAL_PHY(18)
+		EXTERNAL_PHY(19)
+		EXTERNAL_PHY(20)
+		EXTERNAL_PHY(21)
+		EXTERNAL_PHY(22)
+		EXTERNAL_PHY(23)
+
+		EXTERNAL_PHY(24)
+		EXTERNAL_PHY(25)
+		EXTERNAL_PHY(26)
+		EXTERNAL_PHY(27)
+		EXTERNAL_PHY(28)
+		EXTERNAL_PHY(29)
+		EXTERNAL_PHY(30)
+		EXTERNAL_PHY(31)
+
+		EXTERNAL_PHY(32)
+		EXTERNAL_PHY(33)
+		EXTERNAL_PHY(34)
+		EXTERNAL_PHY(35)
+		EXTERNAL_PHY(36)
+		EXTERNAL_PHY(37)
+		EXTERNAL_PHY(38)
+		EXTERNAL_PHY(39)
+
+		/* RTL8218FB */
+		EXTERNAL_PHY(40)
+		EXTERNAL_PHY(41)
+		EXTERNAL_PHY(42)
+		EXTERNAL_PHY(43)
+		EXTERNAL_PHY(44)
+		EXTERNAL_PHY(45)
+		EXTERNAL_PHY(46)
+		EXTERNAL_PHY(47)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(0, 1, qsgmii)
+		SWITCH_PORT(1, 2, qsgmii)
+		SWITCH_PORT(2, 3, qsgmii)
+		SWITCH_PORT(3, 4, qsgmii)
+		SWITCH_PORT(4, 5, qsgmii)
+		SWITCH_PORT(5, 6, qsgmii)
+		SWITCH_PORT(6, 7, qsgmii)
+		SWITCH_PORT(7, 8, qsgmii)
+
+		SWITCH_PORT(8, 9, qsgmii)
+		SWITCH_PORT(9, 10, qsgmii)
+		SWITCH_PORT(10, 11, qsgmii)
+		SWITCH_PORT(11, 12, qsgmii)
+		SWITCH_PORT(12, 13, qsgmii)
+		SWITCH_PORT(13, 14, qsgmii)
+		SWITCH_PORT(14, 15, qsgmii)
+		SWITCH_PORT(15, 16, qsgmii)
+
+		SWITCH_PORT(16, 17, qsgmii)
+		SWITCH_PORT(17, 18, qsgmii)
+		SWITCH_PORT(18, 19, qsgmii)
+		SWITCH_PORT(19, 20, qsgmii)
+		SWITCH_PORT(20, 21, qsgmii)
+		SWITCH_PORT(21, 22, qsgmii)
+		SWITCH_PORT(22, 23, qsgmii)
+		SWITCH_PORT(23, 24, qsgmii)
+
+		SWITCH_PORT(24, 25, qsgmii)
+		SWITCH_PORT(25, 26, qsgmii)
+		SWITCH_PORT(26, 27, qsgmii)
+		SWITCH_PORT(27, 28, qsgmii)
+		SWITCH_PORT(28, 29, qsgmii)
+		SWITCH_PORT(29, 30, qsgmii)
+		SWITCH_PORT(30, 31, qsgmii)
+		SWITCH_PORT(31, 32, qsgmii)
+
+		SWITCH_PORT(32, 33, qsgmii)
+		SWITCH_PORT(33, 34, qsgmii)
+		SWITCH_PORT(34, 35, qsgmii)
+		SWITCH_PORT(35, 36, qsgmii)
+		SWITCH_PORT(36, 37, qsgmii)
+		SWITCH_PORT(37, 38, qsgmii)
+		SWITCH_PORT(38, 39, qsgmii)
+		SWITCH_PORT(39, 40, qsgmii)
+
+		SWITCH_PORT(40, 41, qsgmii)
+		SWITCH_PORT(41, 42, qsgmii)
+		SWITCH_PORT(42, 43, qsgmii)
+		SWITCH_PORT(43, 44, qsgmii)
+		SWITCH_PORT(44, 45, qsgmii)
+		SWITCH_PORT(45, 46, qsgmii)
+		SWITCH_PORT(46, 47, qsgmii)
+		SWITCH_PORT(47, 48, qsgmii)
+
+		port@52 {
+			ethernet = <&ethernet0>;
+			reg = <52>;
+			phy-mode = "internal";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8393_tplink_sg2452p-v4.dts b/target/linux/realtek/dts-5.15/rtl8393_tplink_sg2452p-v4.dts
new file mode 100644
index 00000000000000..d2221c1d2f0460
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8393_tplink_sg2452p-v4.dts
@@ -0,0 +1,422 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl839x.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "tplink,sg2452p-v4", "realtek,rtl8393-soc";
+	model = "TP-Link SG2452P v4";
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x0 0x10000000>;
+	};
+
+	aliases {
+		led-boot = &led_sys;
+		led-failsafe = &led_sys;
+		led-running = &led_sys;
+		led-upgrade = &led_sys;
+		label-mac-device = &ethernet0;
+	};
+
+	chosen {
+		stdout-path = "serial0:38400n8";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio0 20 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		speed {
+			label = "speed";
+			gpios = <&gpio0 19 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+		};
+	};
+
+	gpio_fan_sys {
+		compatible = "gpio-fan";
+		alarm-gpios = <&gpio0 12 GPIO_ACTIVE_LOW>;
+	};
+
+	gpio_fan_psu_1 {
+		pinctrl-names = "default";
+		pinctrl-0 = <&disable_jtag>;
+		compatible = "gpio-fan";
+
+		alarm-gpios = <&gpio0 7 GPIO_ACTIVE_LOW>;
+		gpios = <&gpio0 4 GPIO_ACTIVE_LOW>;
+		/* the actual speeds (rpm) are unknown, just use dummy values */
+		gpio-fan,speed-map = <1 0>, <2 1>;
+		#cooling-cells = <2>;
+	};
+
+	gpio_fan_psu_2 {
+		/* This fan runs in parallel to PSU1 fan, but has a separate
+		 * alarm GPIO. This is not (yet) supported by the gpio-fan driver,
+		 * so a separate instance is added
+		 */
+		compatible = "gpio-fan";
+		alarm-gpios = <&gpio0 14 GPIO_ACTIVE_LOW>;
+	};
+
+	leds {
+		pinctrl-names = "default";
+		compatible = "gpio-leds";
+
+		led-0 {
+			label = "green:speed";
+			gpios = <&gpio0 8 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_INDICATOR;
+		};
+
+		led-1 {
+			label = "green:poe";
+			gpios = <&gpio0 9 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_INDICATOR;
+		};
+
+		led_sys: led-2 {
+			label = "green:sys";
+			gpios = <&gpio0 13 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+		};
+
+		led-3 {
+			label = "green:fan";
+			gpios = <&gpio0 15 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+		};
+
+		led-4 {
+			label = "amber:fan";
+			gpios = <&gpio0 16 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_AMBER>;
+			function = "fault-fan";
+		};
+
+		led-5 {
+			label = "green:poe-max";
+			gpios = <&gpio0 18 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = "alarm-poe";
+		};
+	};
+
+	i2c-gpio-0 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio0 2 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio0 1 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		/* LAN9 - LAN12 */
+		tps23861@5 {
+			compatible = "ti,tps23861";
+			reg = <0x05>;
+		};
+
+		/* LAN17 - LAN20 */
+		tps23861@6 {
+			compatible = "ti,tps23861";
+			reg = <0x06>;
+		};
+
+		/* LAN45 - LAN48 */
+		tps23861@9 {
+			compatible = "ti,tps23861";
+			reg = <0x09>;
+		};
+
+		/* LAN37 - LAN40 */
+		tps23861@a {
+			compatible = "ti,tps23861";
+			reg = <0x0a>;
+		};
+
+		/* LAN1 - LAN4 */
+		tps23861@14 {
+			compatible = "ti,tps23861";
+			reg = <0x14>;
+		};
+
+		/* LAN25 - LAN28 */
+		tps23861@24 {
+			compatible = "ti,tps23861";
+			reg = <0x24>;
+		};
+
+		/* LAN33 - LAN 36 */
+		tps23861@25 {
+			compatible = "ti,tps23861";
+			reg = <0x25>;
+		};
+
+		/* LAN41 - LAN44 */
+		tps23861@26 {
+			compatible = "ti,tps23861";
+			reg = <0x26>;
+		};
+
+		/* LAN13 - LAN16 */
+		tps23861@29 {
+			compatible = "ti,tps23861";
+			reg = <0x29>;
+		};
+
+		/* LAN29 - LAN32 */
+		tps23861@2c {
+			compatible = "ti,tps23861";
+			reg = <0x2c>;
+		};
+
+		/* LAN5 - LAN8 */
+		tps23861@48 {
+			compatible = "ti,tps23861";
+			reg = <0x48>;
+		};
+
+		/* LAN21 - LAN24 */
+		tps23861@49 {
+			compatible = "ti,tps23861";
+			reg = <0x49>;
+		};
+	};
+
+	gpio-restart {
+		compatible = "gpio-restart";
+		gpios = <&gpio0 17 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&gpio0 {
+	poe-enable {
+		gpio-hog;
+		gpios = <23 GPIO_ACTIVE_HIGH>;
+		output-high;
+		line-name = "poe-enable";
+	};
+};
+
+&spi0 {
+	status = "okay";
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0xe0000>;
+				read-only;
+			};
+			partition@e0000 {
+				label = "u-boot-env";
+				reg = <0xe0000 0x20000>;
+			};
+
+			/* We use the "sys", "usrimg1" and "usrimg2" partitions
+			 *  as firmware since the kernel needs to be in "sys", but the
+			 *  partition is too small to hold the "rootfs" as well.
+			 *  The original partition map contains:
+			 *
+			 *   partition@100000 {
+			 *       label = "sys";
+			 *       reg = <0x100000 0x600000>;
+			 *   };
+			 *   partition@700000 {
+			 *       label = "usrimg1";
+			 *       reg = <0x700000 0xa00000>;
+			 *   };
+			 *   partition@1100000 {
+			 *       label = "usrimg2";
+			 *       reg = <0x1100000 0xa00000>;
+			 *   };
+			 */
+
+			partition@100000 {
+				label = "firmware";
+				reg = <0x100000 0x1a00000>;
+			};
+			partition@1b00000 {
+				label = "usrappfs";
+				reg = <0x1b00000 0x400000>;
+			};
+			partition@1f00000 {
+				compatible = "nvmem-cells";
+				label = "para";
+				reg = <0x1f00000 0x100000>;
+				#address-cells = <1>;
+				#size-cells = <1>;
+				read-only;
+
+				factory_macaddr: macaddr@fdff4 {
+					reg = <0xfdff4 0x6>;
+				};
+			};
+		};
+	};
+};
+
+&ethernet0 {
+	nvmem-cells = <&factory_macaddr>;
+	nvmem-cell-names = "mac-address";
+
+	mdio: mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		/* External phy RTL8218B #1 */
+		EXTERNAL_PHY(0)
+		EXTERNAL_PHY(1)
+		EXTERNAL_PHY(2)
+		EXTERNAL_PHY(3)
+		EXTERNAL_PHY(4)
+		EXTERNAL_PHY(5)
+		EXTERNAL_PHY(6)
+		EXTERNAL_PHY(7)
+
+		/* External phy RTL8218B #2 */
+		EXTERNAL_PHY(8)
+		EXTERNAL_PHY(9)
+		EXTERNAL_PHY(10)
+		EXTERNAL_PHY(11)
+		EXTERNAL_PHY(12)
+		EXTERNAL_PHY(13)
+		EXTERNAL_PHY(14)
+		EXTERNAL_PHY(15)
+
+		/* External phy RTL8218B #3 */
+		EXTERNAL_PHY(16)
+		EXTERNAL_PHY(17)
+		EXTERNAL_PHY(18)
+		EXTERNAL_PHY(19)
+		EXTERNAL_PHY(20)
+		EXTERNAL_PHY(21)
+		EXTERNAL_PHY(22)
+		EXTERNAL_PHY(23)
+
+		/* External phy RTL8218B #4 */
+		EXTERNAL_PHY(24)
+		EXTERNAL_PHY(25)
+		EXTERNAL_PHY(26)
+		EXTERNAL_PHY(27)
+		EXTERNAL_PHY(28)
+		EXTERNAL_PHY(29)
+		EXTERNAL_PHY(30)
+		EXTERNAL_PHY(31)
+
+		/* External phy RTL8218B #5 */
+		EXTERNAL_PHY(32)
+		EXTERNAL_PHY(33)
+		EXTERNAL_PHY(34)
+		EXTERNAL_PHY(35)
+		EXTERNAL_PHY(36)
+		EXTERNAL_PHY(37)
+		EXTERNAL_PHY(38)
+		EXTERNAL_PHY(39)
+
+		/* External phy RTL8218B #6 */
+		EXTERNAL_PHY(40)
+		EXTERNAL_PHY(41)
+		EXTERNAL_PHY(42)
+		EXTERNAL_PHY(43)
+		EXTERNAL_PHY(44)
+		EXTERNAL_PHY(45)
+		EXTERNAL_PHY(46)
+		EXTERNAL_PHY(47)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(0, 01, qsgmii)
+		SWITCH_PORT(1, 02, qsgmii)
+		SWITCH_PORT(2, 03, qsgmii)
+		SWITCH_PORT(3, 04, qsgmii)
+		SWITCH_PORT(4, 05, qsgmii)
+		SWITCH_PORT(5, 06, qsgmii)
+		SWITCH_PORT(6, 07, qsgmii)
+		SWITCH_PORT(7, 08, qsgmii)
+
+		SWITCH_PORT(8, 09, qsgmii)
+		SWITCH_PORT(9, 10, qsgmii)
+		SWITCH_PORT(10, 11, qsgmii)
+		SWITCH_PORT(11, 12, qsgmii)
+		SWITCH_PORT(12, 13, qsgmii)
+		SWITCH_PORT(13, 14, qsgmii)
+		SWITCH_PORT(14, 15, qsgmii)
+		SWITCH_PORT(15, 16, qsgmii)
+
+		SWITCH_PORT(16, 17, qsgmii)
+		SWITCH_PORT(17, 18, qsgmii)
+		SWITCH_PORT(18, 19, qsgmii)
+		SWITCH_PORT(19, 20, qsgmii)
+		SWITCH_PORT(20, 21, qsgmii)
+		SWITCH_PORT(21, 22, qsgmii)
+		SWITCH_PORT(22, 23, qsgmii)
+		SWITCH_PORT(23, 24, qsgmii)
+
+		SWITCH_PORT(24, 25, qsgmii)
+		SWITCH_PORT(25, 26, qsgmii)
+		SWITCH_PORT(26, 27, qsgmii)
+		SWITCH_PORT(27, 28, qsgmii)
+		SWITCH_PORT(28, 29, qsgmii)
+		SWITCH_PORT(29, 30, qsgmii)
+		SWITCH_PORT(30, 31, qsgmii)
+		SWITCH_PORT(31, 32, qsgmii)
+
+		SWITCH_PORT(32, 33, qsgmii)
+		SWITCH_PORT(33, 34, qsgmii)
+		SWITCH_PORT(34, 35, qsgmii)
+		SWITCH_PORT(35, 36, qsgmii)
+		SWITCH_PORT(36, 37, qsgmii)
+		SWITCH_PORT(37, 38, qsgmii)
+		SWITCH_PORT(38, 39, qsgmii)
+		SWITCH_PORT(39, 40, qsgmii)
+
+		SWITCH_PORT(40, 41, qsgmii)
+		SWITCH_PORT(41, 42, qsgmii)
+		SWITCH_PORT(42, 43, qsgmii)
+		SWITCH_PORT(43, 44, qsgmii)
+		SWITCH_PORT(44, 45, qsgmii)
+		SWITCH_PORT(45, 46, qsgmii)
+		SWITCH_PORT(46, 47, qsgmii)
+		SWITCH_PORT(47, 48, qsgmii)
+
+		/* CPU-Port */
+		port@52 {
+			ethernet = <&ethernet0>;
+			reg = <52>;
+			phy-mode = "internal";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl8393_zyxel_gs1900-48.dts b/target/linux/realtek/dts-5.15/rtl8393_zyxel_gs1900-48.dts
new file mode 100644
index 00000000000000..c7ddd8313a3214
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl8393_zyxel_gs1900-48.dts
@@ -0,0 +1,320 @@
+/dts-v1/;
+
+#include "rtl839x.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "zyxel,gs1900-48", "realtek,rtl8393-soc";
+	model = "Zyxel GS1900-48";
+
+	aliases {
+		led-boot = &led_sys;
+		led-failsafe = &led_sys;
+		led-running = &led_sys;
+		led-upgrade = &led_sys;
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x0 0x8000000>;
+	};
+
+	leds {
+		pinctrl-names = "default";
+		pinctrl-0 = <&pinmux_disable_sys_led>;
+		compatible = "gpio-leds";
+
+		led_sys: sys {
+			label = "green:sys";
+			gpios = <&gpio0 0 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	gpio1: rtl8231-gpio {
+		compatible = "realtek,rtl8231-gpio";
+		#gpio-cells = <2>;
+		indirect-access-bus-id = <3>;
+		gpio-controller;
+	};
+
+	gpio-restart {
+		compatible = "gpio-restart";
+		gpios = <&gpio1 5 GPIO_ACTIVE_LOW>;
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <20>;
+
+		mode {
+			label = "reset";
+			gpios = <&gpio1 3 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	/* i2c of the left SFP cage: port 49 */
+	i2c0: i2c-gpio-0 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 24 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 25 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp0: sfp-p9 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c0>;
+		los-gpio = <&gpio1 27 GPIO_ACTIVE_HIGH>;
+		tx-fault-gpio = <&gpio1 22 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 26 GPIO_ACTIVE_LOW>;
+		tx-disable-gpio = <&gpio1 23 GPIO_ACTIVE_HIGH>;
+	};
+
+	/* i2c of the right SFP cage: port 50 */
+	i2c1: i2c-gpio-1 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 30 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 31 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp1: sfp-p10 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c1>;
+		los-gpio = <&gpio1 33 GPIO_ACTIVE_HIGH>;
+		tx-fault-gpio = <&gpio1 28 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 32 GPIO_ACTIVE_LOW>;
+		tx-disable-gpio = <&gpio1 29 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&spi0 {
+	status = "okay";
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x40000>;
+				read-only;
+			};
+			partition@40000 {
+				label = "u-boot-env";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+			partition@50000 {
+				label = "u-boot-env2";
+				reg = <0x50000 0x10000>;
+				read-only;
+			};
+			partition@60000 {
+				label = "jffs";
+				reg = <0x60000 0x100000>;
+			};
+			partition@160000 {
+				label = "jffs2";
+				reg = <0x160000 0x100000>;
+			};
+			partition@260000 {
+				label = "firmware";
+				reg = <0x260000 0x6d0000>;
+				compatible = "openwrt,uimage", "denx,uimage";
+				openwrt,ih-magic = <0x83800000>;
+			};
+			partition@930000 {
+				label = "runtime2";
+				reg = <0x930000 0x6d0000>;
+			};
+		};
+	};
+};
+
+&ethernet0 {
+	mdio: mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		/* External phy RTL8218B #1 */
+		EXTERNAL_PHY(0)
+		EXTERNAL_PHY(1)
+		EXTERNAL_PHY(2)
+		EXTERNAL_PHY(3)
+		EXTERNAL_PHY(4)
+		EXTERNAL_PHY(5)
+		EXTERNAL_PHY(6)
+		EXTERNAL_PHY(7)
+
+		/* External phy RTL8218B #2 */
+		EXTERNAL_PHY(8)
+		EXTERNAL_PHY(9)
+		EXTERNAL_PHY(10)
+		EXTERNAL_PHY(11)
+		EXTERNAL_PHY(12)
+		EXTERNAL_PHY(13)
+		EXTERNAL_PHY(14)
+		EXTERNAL_PHY(15)
+
+		/* External phy RTL8218B #3 */
+		EXTERNAL_PHY(16)
+		EXTERNAL_PHY(17)
+		EXTERNAL_PHY(18)
+		EXTERNAL_PHY(19)
+		EXTERNAL_PHY(20)
+		EXTERNAL_PHY(21)
+		EXTERNAL_PHY(22)
+		EXTERNAL_PHY(23)
+
+		/* External phy RTL8218B #4 */
+		EXTERNAL_PHY(24)
+		EXTERNAL_PHY(25)
+		EXTERNAL_PHY(26)
+		EXTERNAL_PHY(27)
+		EXTERNAL_PHY(28)
+		EXTERNAL_PHY(29)
+		EXTERNAL_PHY(30)
+		EXTERNAL_PHY(31)
+
+		/* External phy RTL8218B #5 */
+		EXTERNAL_PHY(32)
+		EXTERNAL_PHY(33)
+		EXTERNAL_PHY(34)
+		EXTERNAL_PHY(35)
+		EXTERNAL_PHY(36)
+		EXTERNAL_PHY(37)
+		EXTERNAL_PHY(38)
+		EXTERNAL_PHY(39)
+
+		/* External phy RTL8218B #6 */
+		EXTERNAL_PHY(40)
+		EXTERNAL_PHY(41)
+		EXTERNAL_PHY(42)
+		EXTERNAL_PHY(43)
+		EXTERNAL_PHY(44)
+		EXTERNAL_PHY(45)
+		EXTERNAL_PHY(46)
+		EXTERNAL_PHY(47)
+
+		/* RTL8393 Internal SerDes */
+		INTERNAL_PHY(48)
+		INTERNAL_PHY(49)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(0, 01, qsgmii)
+		SWITCH_PORT(1, 02, qsgmii)
+		SWITCH_PORT(2, 03, qsgmii)
+		SWITCH_PORT(3, 04, qsgmii)
+		SWITCH_PORT(4, 05, qsgmii)
+		SWITCH_PORT(5, 06, qsgmii)
+		SWITCH_PORT(6, 07, qsgmii)
+		SWITCH_PORT(7, 08, qsgmii)
+
+		SWITCH_PORT(8, 09, qsgmii)
+		SWITCH_PORT(9, 10, qsgmii)
+		SWITCH_PORT(10, 11, qsgmii)
+		SWITCH_PORT(11, 12, qsgmii)
+		SWITCH_PORT(12, 13, qsgmii)
+		SWITCH_PORT(13, 14, qsgmii)
+		SWITCH_PORT(14, 15, qsgmii)
+		SWITCH_PORT(15, 16, qsgmii)
+
+		SWITCH_PORT(16, 17, qsgmii)
+		SWITCH_PORT(17, 18, qsgmii)
+		SWITCH_PORT(18, 19, qsgmii)
+		SWITCH_PORT(19, 20, qsgmii)
+		SWITCH_PORT(20, 21, qsgmii)
+		SWITCH_PORT(21, 22, qsgmii)
+		SWITCH_PORT(22, 23, qsgmii)
+		SWITCH_PORT(23, 24, qsgmii)
+
+		SWITCH_PORT(24, 25, qsgmii)
+		SWITCH_PORT(25, 26, qsgmii)
+		SWITCH_PORT(26, 27, qsgmii)
+		SWITCH_PORT(27, 28, qsgmii)
+		SWITCH_PORT(28, 29, qsgmii)
+		SWITCH_PORT(29, 30, qsgmii)
+		SWITCH_PORT(30, 31, qsgmii)
+		SWITCH_PORT(31, 32, qsgmii)
+
+		SWITCH_PORT(32, 33, qsgmii)
+		SWITCH_PORT(33, 34, qsgmii)
+		SWITCH_PORT(34, 35, qsgmii)
+		SWITCH_PORT(35, 36, qsgmii)
+		SWITCH_PORT(36, 37, qsgmii)
+		SWITCH_PORT(37, 38, qsgmii)
+		SWITCH_PORT(38, 39, qsgmii)
+		SWITCH_PORT(39, 40, qsgmii)
+
+		SWITCH_PORT(40, 41, qsgmii)
+		SWITCH_PORT(41, 42, qsgmii)
+		SWITCH_PORT(42, 43, qsgmii)
+		SWITCH_PORT(43, 44, qsgmii)
+		SWITCH_PORT(44, 45, qsgmii)
+		SWITCH_PORT(45, 46, qsgmii)
+		SWITCH_PORT(46, 47, qsgmii)
+		SWITCH_PORT(47, 48, qsgmii)
+
+		/* SFP cages */
+		port@48 {
+			reg = <48>;
+			label = "lan49";
+			phy-mode = "sgmii";
+			phy-handle = <&phy48>;
+			sfp = <&sfp0>;
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+				pause;
+			};
+
+		};
+
+		port@49 {
+			reg = <49>;
+			label = "lan50";
+			phy-mode = "sgmii";
+			phy-handle = <&phy49>;
+			sfp = <&sfp1>;
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+				pause;
+			};
+
+		};
+
+		/* CPU-Port */
+		port@52 {
+			ethernet = <&ethernet0>;
+			reg = <52>;
+			phy-mode = "qsgmii";
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl839x.dtsi b/target/linux/realtek/dts-5.15/rtl839x.dtsi
new file mode 100644
index 00000000000000..3f87f5622e23df
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl839x.dtsi
@@ -0,0 +1,325 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include <dt-bindings/clock/rtl83xx-clk.h>
+
+/dts-v1/;
+
+#define STRINGIZE(s) #s
+#define LAN_LABEL(p, s) STRINGIZE(p ## s)
+#define SWITCH_PORT_LABEL(n) LAN_LABEL(lan, n)
+
+#define INTERNAL_PHY(n) \
+	phy##n: ethernet-phy@##n { \
+		reg = <##n>; \
+		compatible = "ethernet-phy-ieee802.3-c22"; \
+		phy-is-integrated; \
+	};
+
+#define EXTERNAL_PHY(n) \
+	phy##n: ethernet-phy@##n { \
+		reg = <##n>; \
+		compatible = "ethernet-phy-ieee802.3-c22"; \
+	};
+
+#define EXTERNAL_SFP_PHY(n) \
+	phy##n: ethernet-phy@##n { \
+		compatible = "ethernet-phy-ieee802.3-c22"; \
+		sfp; \
+		media = "fibre"; \
+		reg = <##n>; \
+	};
+
+#define EXTERNAL_SFP_PHY_FULL(n, s) \
+	phy##n: ethernet-phy@##n { \
+		compatible = "ethernet-phy-ieee802.3-c22"; \
+		sfp = <&sfp##s>; \
+		reg = <##n>; \
+	};
+
+#define SWITCH_PORT(n, s, m) \
+	port@##n { \
+		reg = <##n>; \
+		label = SWITCH_PORT_LABEL(s) ; \
+		phy-handle = <&phy##n>; \
+		phy-mode = #m ; \
+	};
+
+#define SWITCH_SFP_PORT(n, s, m) \
+	port@##n { \
+		reg = <##n>; \
+		label = SWITCH_PORT_LABEL(s) ; \
+		phy-handle = <&phy##n>; \
+		phy-mode = #m ; \
+		fixed-link { \
+			speed = <1000>; \
+			full-duplex; \
+		}; \
+	};
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	compatible = "realtek,rtl839x-soc";
+
+	osc: oscillator {
+		compatible = "fixed-clock";
+		#clock-cells = <0>;
+		clock-frequency = <25000000>;
+	};
+
+	ccu: clock-controller {
+		compatible = "realtek,rtl8390-clock";
+		#clock-cells = <1>;
+		clocks = <&osc>;
+		clock-names = "ref_clk";
+	};
+
+	cpus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		cpu@0 {
+			compatible = "mips,mips34Kc";
+			reg = <0>;
+			clocks = <&ccu CLK_CPU>;
+			operating-points-v2 = <&cpu_opp_table>;
+		};
+
+		cpu@1 {
+			compatible = "mips,mips34Kc";
+			reg = <1>;
+			clocks = <&ccu CLK_CPU>;
+			operating-points-v2 = <&cpu_opp_table>;
+		};
+	};
+
+	cpu_opp_table: opp-table-0 {
+		compatible = "operating-points-v2";
+		opp-shared;
+
+		opp00 {
+			opp-hz = /bits/ 64 <425000000>;
+		};
+		opp01 {
+			opp-hz = /bits/ 64 <450000000>;
+		};
+		opp02 {
+			opp-hz = /bits/ 64 <475000000>;
+		};
+		opp03 {
+			opp-hz = /bits/ 64 <500000000>;
+		};
+		opp04 {
+			opp-hz = /bits/ 64 <525000000>;
+		};
+		opp05 {
+			opp-hz = /bits/ 64 <550000000>;
+		};
+		opp06 {
+			opp-hz = /bits/ 64 <575000000>;
+		};
+		opp07 {
+			opp-hz = /bits/ 64 <600000000>;
+		};
+		opp08 {
+			opp-hz = /bits/ 64 <625000000>;
+		};
+		opp09 {
+			opp-hz = /bits/ 64 <650000000>;
+		};
+		opp10 {
+			opp-hz = /bits/ 64 <675000000>;
+		};
+		opp11 {
+			opp-hz = /bits/ 64 <700000000>;
+		};
+		opp12 {
+			opp-hz = /bits/ 64 <725000000>;
+		};
+		opp13 {
+			opp-hz = /bits/ 64 <750000000>;
+		};
+	};
+
+	aliases {
+		serial0 = &uart0;
+		serial1 = &uart1;
+	};
+
+	chosen {
+		bootargs = "earlycon";
+		stdout-path = "serial0:115200n8";
+	};
+
+	cpuintc: cpuintc {
+		compatible = "mti,cpu-interrupt-controller";
+		#address-cells = <0>;
+		#interrupt-cells = <1>;
+		interrupt-controller;
+	};
+
+	soc: soc {
+		compatible = "simple-bus";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges = <0x0 0x18000000 0x10000>;
+
+		intc: interrupt-controller@3000 {
+			compatible = "realtek,rtl8390-intc", "realtek,rtl-intc";
+			reg = <0x3000 0x18>, <0x3018 0x18>;
+			interrupt-controller;
+			#interrupt-cells = <2>;
+
+			interrupt-parent = <&cpuintc>;
+			interrupts = <2>, <3>, <4>, <5>, <6>;
+		};
+
+		spi0: spi@1200 {
+			compatible = "realtek,rtl8380-spi";
+			reg = <0x1200 0x100>;
+
+			#address-cells = <1>;
+			#size-cells = <0>;
+		};
+
+		timer0: timer@3100 {
+			compatible = "realtek,rtl8390-timer", "realtek,otto-timer";
+			reg = <0x3100 0x10>, <0x3110 0x10>, <0x3120 0x10>,
+			      <0x3130 0x10>, <0x3140 0x10>;
+
+			interrupt-parent = <&intc>;
+			interrupts = <29 4>, <28 4>, <17 4>, <16 4>, <15 4>;
+			clocks = <&ccu CLK_LXB>;
+		};
+
+		uart0: uart@2000 {
+			compatible = "ns16550a";
+			reg = <0x2000 0x100>;
+
+			clocks = <&ccu CLK_LXB>;
+
+			interrupt-parent = <&intc>;
+			interrupts = <31 1>;
+
+			reg-io-width = <1>;
+			reg-shift = <2>;
+			fifo-size = <1>;
+			no-loopback-test;
+		};
+
+		uart1: uart@2100 {
+			pinctrl-names = "default";
+			pinctrl-0 = <&enable_uart1>;
+
+			compatible = "ns16550a";
+			reg = <0x2100 0x100>;
+
+			clocks = <&ccu CLK_LXB>;
+
+			interrupt-parent = <&intc>;
+			interrupts = <30 2>;
+
+			reg-io-width = <1>;
+			reg-shift = <2>;
+			fifo-size = <1>;
+			no-loopback-test;
+
+			status = "disabled";
+		};
+
+		gpio0: gpio-controller@3500 {
+			compatible = "realtek,rtl8390-gpio", "realtek,otto-gpio";
+			reg = <0x3500 0x20>;
+
+			gpio-controller;
+			#gpio-cells = <2>;
+			ngpios = <24>;
+
+			interrupt-controller;
+			#interrupt-cells = <2>;
+			interrupt-parent = <&intc>;
+			interrupts = <23 2>;
+		};
+
+		watchdog0: watchdog@3150 {
+			compatible = "realtek,rtl8390-wdt";
+			reg = <0x3150 0xc>;
+
+			realtek,reset-mode = "soc";
+
+			clocks = <&ccu CLK_LXB>;
+			timeout-sec = <30>;
+
+			interrupt-parent = <&intc>;
+			interrupt-names = "phase1", "phase2";
+			interrupts = <19 4>, <18 4>;
+		};
+
+	};
+
+	pinmux@1b000004 {
+		compatible = "pinctrl-single";
+		reg = <0x1b000004 0x4>;
+
+		pinctrl-single,bit-per-mux;
+		pinctrl-single,register-width = <32>;
+		pinctrl-single,function-mask = <0x1>;
+		#pinctrl-cells = <2>;
+
+		enable_uart1: pinmux_enable_uart1 {
+			pinctrl-single,bits = <0x0 0x1 0x3>;
+		};
+
+		disable_jtag: pinmux_disable_jtag {
+			pinctrl-single,bits = <0x0 0x2 0x3>;
+		};
+	};
+
+	/* LED_GLB_CTRL */
+	pinmux@1b0000e4 {
+		compatible = "pinctrl-single";
+		reg = <0x1b0000e4 0x4>;
+
+		pinctrl-single,bit-per-mux;
+		pinctrl-single,register-width = <32>;
+		pinctrl-single,function-mask = <0x1>;
+		#pinctrl-cells = <2>;
+
+		/* enable GPIO 0 */
+		pinmux_disable_sys_led: disable_sys_led {
+			pinctrl-single,bits = <0x0 0x0 0x4000>;
+		};
+	};
+
+	ethernet0: ethernet@1b00a300 {
+		compatible = "realtek,rtl838x-eth";
+		reg = <0x1b00a300 0x100>;
+
+		interrupt-parent = <&intc>;
+		interrupts = <24 3>;
+
+		phy-mode = "internal";
+
+		fixed-link {
+			speed = <1000>;
+			full-duplex;
+		};
+	};
+
+	sram0: sram@9f000000 {
+		compatible = "mmio-sram";
+		reg = <0x9f000000 0x18000>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges = <0 0x9f000000 0x18000>;
+	};
+
+	switch0: switch@1b000000 {
+		status = "okay";
+		compatible = "realtek,rtl83xx-switch";
+
+		interrupt-parent = <&intc>;
+		interrupts = <20 2>;
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl839x_d-link_dgs-1210_gpio.dtsi b/target/linux/realtek/dts-5.15/rtl839x_d-link_dgs-1210_gpio.dtsi
new file mode 100644
index 00000000000000..260ab67ef3e0f3
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl839x_d-link_dgs-1210_gpio.dtsi
@@ -0,0 +1,75 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/ {
+	/* Lan 49 */
+	i2c0: i2c-gpio-0 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 6 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 7 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp0: sfp-p49 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c0>;
+		los-gpio = <&gpio1 9 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 8 GPIO_ACTIVE_LOW>;
+		/* tx-disable-gpio handled by RTL8214FC based on media setting */
+	};
+
+	/* Lan 50 */
+	i2c1: i2c-gpio-1 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 1 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 2 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp1: sfp-p50 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c1>;
+		los-gpio = <&gpio1 4 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 3 GPIO_ACTIVE_LOW>;
+		/* tx-disable-gpio handled by RTL8214FC based on media setting */
+	};
+
+	/* Lan 51 */
+	i2c2: i2c-gpio-2 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 22 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 23 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp2: sfp-p51 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c2>;
+		los-gpio = <&gpio1 25 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 24 GPIO_ACTIVE_LOW>;
+		/* tx-disable-gpio handled by RTL8214FC based on media setting */
+	};
+
+	/* Lan 52 */
+	i2c3: i2c-gpio-3 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 11 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 12 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	sfp3: sfp-p52 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c3>;
+		los-gpio = <&gpio1 14 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 13 GPIO_ACTIVE_LOW>;
+		/* tx-disable-gpio handled by RTL8214FC based on media setting */
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl83xx_d-link_dgs-1210_common.dtsi b/target/linux/realtek/dts-5.15/rtl83xx_d-link_dgs-1210_common.dtsi
new file mode 100644
index 00000000000000..1e3cafa9381d8d
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl83xx_d-link_dgs-1210_common.dtsi
@@ -0,0 +1,83 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x0 0x8000000>;
+	};
+
+	leds: leds {
+		pinctrl-names = "default";
+		pinctrl-0 = <&pinmux_disable_sys_led>;
+		compatible = "gpio-leds";
+
+		led_power: power {
+			label = "green:power";
+			gpios = <&gpio0 0 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&gpio0 {
+	indirect-access-bus-id = <0>;
+};
+
+&spi0 {
+	status = "okay";
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x00000000 0x80000>;
+				read-only;
+			};
+			partition@80000 {
+				label = "u-boot-env";
+				reg = <0x00080000 0x40000>;
+			};
+			partition@c0000 {
+				label = "board-name";
+				reg = <0x000c0000 0x40000>;
+			};
+			partition@280000 {
+				label = "firmware";
+				compatible = "denx,uimage";
+				reg = <0x00100000 0xd80000>;
+			};
+			partition@be80000 {
+				label = "kernel2";
+				reg = <0x00e80000 0x180000>;
+			};
+			partition@1000000 {
+				label = "sysinfo";
+				reg = <0x01000000 0x40000>;
+			};
+			partition@1040000 {
+				label = "rootfs2";
+				reg = <0x01040000 0xc00000>;
+			};
+			partition@1c40000 {
+				label = "jffs2";
+				reg = <0x01c40000 0x3c0000>;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl83xx_d-link_dgs-1210_gpio.dtsi b/target/linux/realtek/dts-5.15/rtl83xx_d-link_dgs-1210_gpio.dtsi
new file mode 100644
index 00000000000000..b1477aa182148a
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl83xx_d-link_dgs-1210_gpio.dtsi
@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/ {
+	gpio-restart {
+		compatible = "gpio-restart";
+		gpios = <&gpio1 34 GPIO_ACTIVE_LOW>;
+		open-source;
+	};
+
+	keys: keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <20>;
+
+		reset {
+			label = "reset";
+			gpios = <&gpio1 33 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	gpio1: rtl8231-gpio {
+		compatible = "realtek,rtl8231-gpio";
+		#gpio-cells = <2>;
+		gpio-controller;
+		indirect-access-bus-id = <0>;
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl83xx_panasonic_mxxeg-pn28xx0k.dtsi b/target/linux/realtek/dts-5.15/rtl83xx_panasonic_mxxeg-pn28xx0k.dtsi
new file mode 100644
index 00000000000000..f04e98b9cfec45
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl83xx_panasonic_mxxeg-pn28xx0k.dtsi
@@ -0,0 +1,196 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	chosen {
+		stdout-path = "serial0:9600n8";
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x0 0x8000000>;
+	};
+
+	leds: leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			label = "amber:any_col";
+			gpios = <&gpio2 0 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_FAULT;
+		};
+
+		led-1 {
+			label = "green:giga";
+			gpios = <&gpio2 8 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_INDICATOR;
+			function-enumerator = <1>;
+		};
+
+		led-2 {
+			label = "green:100m";
+			gpios = <&gpio2 9 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_INDICATOR;
+			function-enumerator = <2>;
+		};
+
+		led-3 {
+			label = "green:full";
+			gpios = <&gpio2 10 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_INDICATOR;
+			function-enumerator = <3>;
+		};
+
+		led-4 {
+			label = "green:loop_history";
+			gpios = <&gpio2 11 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_INDICATOR;
+			function-enumerator = <4>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		led_mode {
+			label = "led-mode";
+			gpios = <&gpio2 15 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+		};
+	};
+
+	gpio-restart {
+		compatible = "gpio-restart";
+		gpios = <&gpio2 3 GPIO_ACTIVE_HIGH>;
+	};
+
+	i2c_gpio_0: i2c-gpio-0 {
+		compatible = "i2c-gpio";
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		gpio1: gpio@20 {
+			compatible = "nxp,pca9555";
+			reg = <0x20>;
+			gpio-controller;
+			#gpio-cells = <2>;
+		};
+
+		gpio2: gpio@75 {
+			compatible = "nxp,pca9539";
+			reg = <0x75>;
+			gpio-controller;
+			#gpio-cells = <2>;
+
+			/*
+			 * GPIO14 (IO1_6): Shift Register RESET (port LED)
+			 * - Switch-M8eG  PN28080K:  3x 74HC164
+			 * - Switch-M16eG PN28160K:  4x 74HC164
+			 * - Switch-M24eG PN28240K:  6x 74HC164
+			 * - Switch-M48eG PN28480K: 12x 74HC164
+			 */
+			portled_sregister_reset {
+				gpio-hog;
+				gpios = <14 GPIO_ACTIVE_HIGH>;
+				output-high;
+				line-name = "portled-sregister-reset";
+			};
+		};
+	};
+
+	i2c_gpio_1: i2c-gpio-1 {
+		compatible = "i2c-gpio";
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		i2c_switch: i2c-switch@70 {
+			compatible = "nxp,pca9545";
+			reset-gpios = <&gpio2 13 GPIO_ACTIVE_LOW>;
+			reg = <0x70>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x80000>;
+				read-only;
+			};
+
+			partition@80000 {
+				label = "u-boot-env";
+				reg = <0x80000 0x10000>;
+			};
+
+			partition@90000 {
+				label = "u-boot-env2";
+				reg = <0x90000 0x10000>;
+			};
+
+			partition@a0000 {
+				label = "sysinfo";
+				reg = <0xa0000 0x60000>;
+				read-only;
+			};
+
+			/*
+			 * Filesystem area in stock firmware
+			 * (0x100000-0x1DFFFFF)
+			 *
+			 * stock firmware images are required to pass
+			 * the checking by the U-Boot, also for OpenWrt
+			 *
+			 * in OpenWrt:
+			 * - 0x100000-0xDFFFFF (13M): stock images
+			 * - 0xE00000-0x1DFFFFF(16M): OpenWrt image
+			 */
+			partition@100000 {
+				label = "fs_reserved";
+				reg = <0x100000 0xd00000>;
+			};
+
+			partition@e00000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0xe00000 0x1000000>;
+			};
+
+			partition@1e00000 {
+				label = "vlog_data";
+				reg = <0x1e00000 0x100000>;
+				read-only;
+			};
+
+			partition@1f00000 {
+				label = "elog_data";
+				reg = <0x1f00000 0x100000>;
+				read-only;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl9302_zyxel_xgs1250-12.dts b/target/linux/realtek/dts-5.15/rtl9302_zyxel_xgs1250-12.dts
new file mode 100644
index 00000000000000..a9821b2cc62010
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl9302_zyxel_xgs1250-12.dts
@@ -0,0 +1,326 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/dts-v1/;
+
+#include "rtl930x.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "zyxel,xgs1250-12", "realtek,rtl838x-soc";
+	model = "Zyxel XGS1250-12 Switch";
+
+	aliases {
+		led-boot = &led_pwr_sys;
+		led-failsafe = &led_pwr_sys;
+		led-running = &led_pwr_sys;
+		led-upgrade = &led_pwr_sys;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		mode {
+			label = "reset";
+			gpios = <&gpio0 22 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	/* i2c of the SFP cage: port 12 */
+	i2c0: i2c-rtl9300 {
+		compatible = "realtek,rtl9300-i2c";
+		reg = <0x1b00036c 0x3c>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+		sda-pin = <10>;
+		scl-pin = <8>;
+		clock-frequency = <100000>;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&pinmux_disable_sys_led>;
+
+		led_pwr_sys: led-0 {
+			label = "green:power";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_POWER;
+			gpios = <&gpio0 0 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	sfp0: sfp-p12 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c0>;
+		los-gpio = <&gpio0 17 GPIO_ACTIVE_HIGH>;
+		tx-fault-gpio = <&gpio0 20 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio0 16 GPIO_ACTIVE_LOW>;
+		tx-disable-gpio = <&gpio0 15 GPIO_ACTIVE_HIGH>;
+	};
+
+	led_set: led_set@0 {
+		compatible = "realtek,rtl9300-leds";
+		active-low;
+
+		led_set0 = <0x0000 0xffff 0x0a20 0x0b80>; // LED set 0: 1000Mbps,  10/100Mbps
+		led_set1 = <0x0a0b 0x0a28 0x0a82 0x0a0b>; // LED set 1: (10G, 5G, 2.5G) (2.5G, 1G)
+							  // (5G, 10/100) (10G, 5G, 2.5G)
+		led_set2 = <0x0000 0xffff 0x0a20 0x0a01>; // LED set 2: 1000MBit, 10GBit
+	};
+};
+
+&spi0 {
+	status = "okay";
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0xe0000>;
+				read-only;
+			};
+			partition@e0000 {
+				label = "u-boot-env";
+				reg = <0xe0000 0x10000>;
+			};
+			partition@f0000 {
+				label = "u-boot-env2";
+				reg = <0xf0000 0x10000>;
+				read-only;
+			};
+			partition@100000 {
+				label = "jffs";
+				reg = <0x100000 0x100000>;
+			};
+			partition@200000 {
+				label = "jffs2";
+				reg = <0x200000 0x100000>;
+			};
+			partition@b300000 {
+				label = "firmware";
+				reg = <0x300000 0xce0000>;
+				compatible = "openwrt,uimage", "denx,uimage";
+				openwrt,ih-magic = <0x93001250>;
+			};
+			partition@fe0000 {
+				label = "log";
+				reg = <0xfe0000 0x20000>;
+			};
+		};
+	};
+};
+
+&ethernet0 {
+	mdio: mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		/* External RTL8218D PHY */
+		phy0: ethernet-phy@0 {
+			reg = <0>;
+			compatible = "ethernet-phy-ieee802.3-c22";
+			rtl9300,smi-address = <0 0>;
+			sds = < 2 >;
+			// Disabled because we do not know how to bring up again
+			// reset-gpios = <&gpio0 21 GPIO_ACTIVE_LOW>;
+		};
+		phy1: ethernet-phy@1 {
+			reg = <1>;
+			compatible = "ethernet-phy-ieee802.3-c22";
+			rtl9300,smi-address = <0 1>;
+		};
+		phy2: ethernet-phy@2 {
+			reg = <2>;
+			compatible = "ethernet-phy-ieee802.3-c22";
+			rtl9300,smi-address = <0 2>;
+		};
+		phy3: ethernet-phy@3 {
+			reg = <3>;
+			compatible = "ethernet-phy-ieee802.3-c22";
+			rtl9300,smi-address = <0 3>;
+		};
+		phy4: ethernet-phy@4 {
+			reg = <4>;
+			compatible = "ethernet-phy-ieee802.3-c22";
+			rtl9300,smi-address = <0 4>;
+		};
+		phy5: ethernet-phy@5 {
+			reg = <5>;
+			compatible = "ethernet-phy-ieee802.3-c22";
+			rtl9300,smi-address = <0 5>;
+		};
+		phy6: ethernet-phy@6 {
+			reg = <6>;
+			compatible = "ethernet-phy-ieee802.3-c22";
+			rtl9300,smi-address = <0 6>;
+		};
+		phy7: ethernet-phy@7 {
+			reg = <7>;
+			compatible = "ethernet-phy-ieee802.3-c22";
+			rtl9300,smi-address = <0 7>;
+		};
+
+		/* External Aquantia 113C PHYs */
+		phy24: ethernet-phy@24 {
+			reg = <24>;
+			compatible = "ethernet-phy-ieee802.3-c45";
+			rtl9300,smi-address = <1 8>;
+			sds = < 6 >;
+			// Disabled because we do not know how to bring up again
+			// reset-gpios = <&gpio0 21 GPIO_ACTIVE_LOW>;
+		};
+
+		phy25: ethernet-phy@25 {
+			reg = <25>;
+			compatible = "ethernet-phy-ieee802.3-c45";
+			rtl9300,smi-address = <2 8>;
+			sds = < 7 >;
+			// Disabled because we do not know how to bring up again
+			// reset-gpios = <&gpio0 21 GPIO_ACTIVE_LOW>;
+		};
+
+		phy26: ethernet-phy@26 {
+			reg = <26>;
+			compatible = "ethernet-phy-ieee802.3-c45";
+			rtl9300,smi-address = <3 8>;
+			sds = < 8 >;
+			// Disabled because we do not know how to bring up again
+			// reset-gpios = <&gpio0 21 GPIO_ACTIVE_LOW>;
+		};
+
+		/* SFP Ports */
+		phy27: ethernet-phy@27 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			phy-is-integrated;
+			reg = <27>;
+			rtl9300,smi-address = <4 0>;
+			sds = < 9 >;
+		};
+
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "lan1";
+			phy-handle = <&phy0>;
+			phy-mode = "xgmii";
+			led-set = <0>;
+		};
+		port@1 {
+			reg = <1>;
+			label = "lan2";
+			phy-handle = <&phy1>;
+			phy-mode = "xgmii";
+			led-set = <0>;
+		};
+		port@2 {
+			reg = <2>;
+			label = "lan3";
+			phy-handle = <&phy2>;
+			phy-mode = "xgmii";
+			led-set = <0>;
+		};
+		port@3 {
+			reg = <3>;
+			label = "lan4";
+			phy-handle = <&phy3>;
+			phy-mode = "xgmii";
+			led-set = <0>;
+		};
+		port@4 {
+			reg = <4>;
+			label = "lan5";
+			phy-handle = <&phy4>;
+			phy-mode = "xgmii";
+			led-set = <0>;
+		};
+		port@5 {
+			reg = <5>;
+			label = "lan6";
+			phy-handle = <&phy5>;
+			phy-mode = "xgmii";
+			led-set = <0>;
+		};
+		port@6 {
+			reg = <6>;
+			label = "lan7";
+			phy-handle = <&phy6>;
+			phy-mode = "xgmii";
+			led-set = <0>;
+		};
+		port@7 {
+			reg = <7>;
+			label = "lan8";
+			phy-handle = <&phy7>;
+			phy-mode = "xgmii";
+			led-set = <0>;
+		};
+
+		port@24 {
+			reg = <24>;
+			label = "lan9";
+			phy-mode = "usxgmii";
+			phy-handle = <&phy24>;
+			led-set = <1>;
+		};
+		port@25 {
+			reg = <25>;
+			label = "lan10";
+			phy-mode = "usxgmii";
+			phy-handle = <&phy25>;
+			led-set = <1>;
+		};
+		port@26 {
+			reg = <26>;
+			label = "lan11";
+			phy-mode = "usxgmii";
+			phy-handle = <&phy26>;
+			led-set = <1>;
+		};
+
+		port@27 {
+			reg = <27>;
+			label = "lan12";
+			phy-mode = "10gbase-r";
+			phy-handle = <&phy27>;
+			sfp = <&sfp0>;
+			led-set = <2>;
+
+			fixed-link {
+				speed = <10000>;
+				full-duplex;
+				pause;
+			};
+
+		};
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+			fixed-link {
+				speed = <10000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl930x.dtsi b/target/linux/realtek/dts-5.15/rtl930x.dtsi
new file mode 100644
index 00000000000000..9b0a5781a2630b
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl930x.dtsi
@@ -0,0 +1,183 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	compatible = "realtek,rtl838x-soc";
+
+	cpus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		frequency = <800000000>;
+
+		cpu@0 {
+			compatible = "mips,mips34Kc";
+			reg = <0>;
+		};
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x0 0x8000000>;
+	};
+
+	aliases {
+		serial0 = &uart0;
+		serial1 = &uart1;
+	};
+
+	chosen {
+		bootargs = "earlycon";
+		stdout-path = "serial0:115200n8";
+	};
+
+	cpuintc: cpuintc {
+		compatible = "mti,cpu-interrupt-controller";
+		#address-cells = <0>;
+		#interrupt-cells = <1>;
+		interrupt-controller;
+	};
+
+	lx_clk: lx_clk {
+		compatible = "fixed-clock";
+		#clock-cells = <0>;
+		clock-frequency  = <175000000>;
+	};
+
+	soc: soc {
+		compatible = "simple-bus";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges = <0x0 0x18000000 0x10000>;
+
+		intc: interrupt-controller@3000 {
+			compatible = "realtek,rtl9300-intc", "realtek,rtl-intc";
+			reg = <0x3000 0x18>, <0x3018 0x18>;
+			interrupt-controller;
+			#interrupt-cells = <2>;
+
+			interrupt-parent = <&cpuintc>;
+			interrupts = <2>, <3>, <4>, <5>, <6>, <7>;
+		};
+
+		spi0: spi@1200 {
+			compatible = "realtek,rtl8380-spi";
+			reg = <0x1200 0x100>;
+
+			#address-cells = <1>;
+			#size-cells = <0>;
+		};
+
+		timer0: timer@3200 {
+			compatible = "realtek,rtl930x-timer", "realtek,otto-timer";
+			reg = <0x3200 0x10>, <0x3210 0x10>, <0x3220 0x10>,
+			      <0x3230 0x10>, <0x3240 0x10>;
+
+			interrupt-parent = <&intc>;
+			interrupts = <7 4>, <8 4>, <9 4>, <10 4>, <11 4>;
+			clocks = <&lx_clk>;
+		};
+
+		uart0: uart@2000 {
+			compatible = "ns16550a";
+			reg = <0x2000 0x100>;
+
+			clocks = <&lx_clk>;
+
+			interrupt-parent = <&intc>;
+			interrupts = <30 1>;
+
+			reg-io-width = <1>;
+			reg-shift = <2>;
+			fifo-size = <1>;
+			no-loopback-test;
+		};
+
+		uart1: uart@2100 {
+			compatible = "ns16550a";
+			reg = <0x2100 0x100>;
+
+			clocks = <&lx_clk>;
+
+			interrupt-parent = <&intc>;
+			interrupts = <31 0>;
+
+			reg-io-width = <1>;
+			reg-shift = <2>;
+			fifo-size = <1>;
+			no-loopback-test;
+
+			status = "disabled";
+		};
+
+		watchdog0: watchdog@3260 {
+			compatible = "realtek,rtl9300-wdt";
+			reg = <0x3260 0xc>;
+
+			realtek,reset-mode = "soc";
+
+			clocks = <&lx_clk>;
+			timeout-sec = <30>;
+
+			interrupt-parent = <&intc>;
+			interrupt-names = "phase1", "phase2";
+			interrupts = <5 4>, <6 4>;
+		};
+
+		gpio0: gpio-controller@3300 {
+			compatible = "realtek,rtl9300-gpio", "realtek,otto-gpio";
+			reg = <0x3300 0x1c>, <0x3338 0x8>;
+
+			gpio-controller;
+			#gpio-cells = <2>;
+			ngpios = <24>;
+
+			interrupt-controller;
+			#interrupt-cells = <2>;
+			interrupt-parent = <&intc>;
+			interrupts = <13 1>;
+		};
+
+	};
+
+	pinmux_led: pinmux@1b00cc00 {
+		compatible = "pinctrl-single";
+		reg = <0x1b00cc00 0x4>;
+
+		pinctrl-single,bit-per-mux;
+		pinctrl-single,register-width = <32>;
+		pinctrl-single,function-mask = <0x1>;
+		#pinctrl-cells = <2>;
+
+		/* enable GPIO 0 */
+		pinmux_disable_sys_led: disable_sys_led {
+			pinctrl-single,bits = <0x0 0x0 0x1000>;
+		};
+	};
+
+	ethernet0: ethernet@1b00a300 {
+		compatible = "realtek,rtl838x-eth";
+		reg = <0x1b00a300 0x100>;
+
+		interrupt-parent = <&intc>;
+		interrupts = <24 3>;
+
+		phy-mode = "internal";
+
+		fixed-link {
+			speed = <1000>;
+			full-duplex;
+		};
+	};
+
+	switch0: switch@1b000000 {
+		compatible = "realtek,rtl83xx-switch";
+		status = "okay";
+
+		interrupt-parent = <&intc>;
+		interrupts = <23 2>;
+	};
+};
diff --git a/target/linux/realtek/dts-5.15/rtl931x.dtsi b/target/linux/realtek/dts-5.15/rtl931x.dtsi
new file mode 100644
index 00000000000000..61599e89b54e92
--- /dev/null
+++ b/target/linux/realtek/dts-5.15/rtl931x.dtsi
@@ -0,0 +1,206 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include <dt-bindings/interrupt-controller/mips-gic.h>
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	compatible = "realtek,rtl838x-soc";
+
+	cpus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		frequency = <1000000000>;
+
+		cpu@0 {
+			compatible = "mti,interaptive";
+			reg = <0>;
+		};
+
+		cpu@1 {
+			compatible = "mti,interaptive";
+			reg = <1>;
+		};
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x0 0x10000000>;
+	};
+
+	aliases {
+		serial0 = &uart0;
+		serial1 = &uart1;
+	};
+
+	chosen {
+		bootargs = "earlycon";
+		stdout-path = "serial0:115200n8";
+	};
+
+	lx_clk: lx_clk {
+		compatible = "fixed-clock";
+		#clock-cells = <0>;
+		clock-frequency = <200000000>;
+	};
+
+	cpuclock: cpuclock@0 {
+		#clock-cells = <0>;
+		compatible = "fixed-clock";
+
+		/* FIXME: there should be way to detect this */
+		clock-frequency = <1000000000>;
+	};
+
+	cpuintc: cpuintc {
+		compatible = "mti,cpu-interrupt-controller";
+		#address-cells = <0>;
+		#interrupt-cells = <1>;
+		interrupt-controller;
+	};
+
+	gic: interrupt-controller@1ddc0000 {
+		compatible = "mti,gic";
+		reg = <0x1ddc0000 0x20000>;
+
+		interrupt-controller;
+		#interrupt-cells = <3>;
+
+		/*
+		 * Declare the interrupt-parent even though the mti,gic
+		 * binding doesn't require it, such that the kernel can
+		 * figure out that cpu_intc is the root interrupt
+		 * controller & should be probed first.
+		 */
+		interrupt-parent = <&cpuintc>;
+
+		timer {
+			compatible = "mti,gic-timer";
+			interrupts = <GIC_LOCAL 1 IRQ_TYPE_NONE>;
+			clocks = <&cpuclock>;
+		};
+	};
+
+	soc: soc {
+		compatible = "simple-bus";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges = <0x0 0x18000000 0x10000>;
+
+		spi0: spi@1200 {
+			status = "okay";
+
+			compatible = "realtek,rtl8380-spi";
+			reg = <0x1200 0x100>;
+
+			#address-cells = <1>;
+			#size-cells = <0>;
+		};
+
+		watchdog0: watchdog@3260 {
+			compatible = "realtek,rtl9310-wdt";
+			reg = <0x3260 0xc>;
+
+			realtek,reset-mode = "soc";
+
+			clocks = <&lx_clk>;
+			timeout-sec = <30>;
+
+			interrupt-parent = <&gic>;
+			interrupt-names = "phase1", "phase2";
+			interrupts = <GIC_SHARED 8 IRQ_TYPE_LEVEL_HIGH>, <GIC_SHARED 9 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		gpio0: gpio-controller@3300 {
+			compatible = "realtek,rtl9310-gpio", "realtek,otto-gpio";
+			reg = <0x3300 0x1c>;
+
+			gpio-controller;
+			#gpio-cells = <2>;
+			ngpios = <32>;
+
+			interrupt-controller;
+			#interrupt-cells = <3>;
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_SHARED 20 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		uart0: uart@2000 {
+			compatible = "ns16550a";
+			reg = <0x2000 0x100>;
+
+			clock-frequency = <200000000>;
+
+			interrupt-parent = <&gic>;
+			#interrupt-cells = <3>;
+			interrupts = <GIC_SHARED 22 IRQ_TYPE_LEVEL_HIGH>;
+
+			reg-io-width = <1>;
+			reg-shift = <2>;
+			fifo-size = <1>;
+			no-loopback-test;
+		};
+
+		uart1: uart@2100 {
+			compatible = "ns16550a";
+			reg = <0x2100 0x100>;
+
+			clock-frequency = <200000000>;
+
+			interrupt-parent = <&gic>;
+			#interrupt-cells = <3>;
+			interrupts = <GIC_SHARED 23 IRQ_TYPE_LEVEL_HIGH>;
+
+			reg-io-width = <1>;
+			reg-shift = <2>;
+			fifo-size = <1>;
+			no-loopback-test;
+
+			status = "disabled";
+		};
+	};
+
+	pinmux: pinmux@1b001358 {
+		compatible = "pinctrl-single";
+		reg = <0x1b001358 0x4>;
+
+		pinctrl-single,bit-per-mux;
+		pinctrl-single,register-width = <32>;
+		pinctrl-single,function-mask = <0x1>;
+		#pinctrl-cells = <2>;
+
+		/* Enable GPIO6 and GPIO7, possibly unknown others */
+		pinmux_disable_jtag: disable_jtag {
+			pinctrl-single,bits = <0x0 0x0 0x8000>;
+		};
+
+		/* Controls GPIO0 */
+		pinmux_disable_sys_led: disable_sys_led {
+			pinctrl-single,bits = <0x0 0x0 0x100>;
+		};
+	};
+
+	ethernet0: ethernet@1b00a300 {
+		status = "okay";
+		compatible = "realtek,rtl838x-eth";
+		reg = <0x1b00a300 0x100>;
+		interrupt-parent = <&gic>;
+		#interrupt-cells = <3>;
+		interrupts = <GIC_SHARED 16 IRQ_TYPE_LEVEL_HIGH>;
+		phy-mode = "internal";
+		fixed-link {
+			speed = <1000>;
+			full-duplex;
+		};
+	};
+
+	switch0: switch@1b000000 {
+		compatible = "realtek,rtl83xx-switch";
+		status = "okay";
+
+		interrupt-parent = <&gic>;
+		#interrupt-cells = <3>;
+		interrupts = <GIC_SHARED 15 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
diff --git a/target/linux/realtek/files-5.15/Documentation/devicetree/bindings/realtek,otto-timer.yaml b/target/linux/realtek/files-5.15/Documentation/devicetree/bindings/realtek,otto-timer.yaml
new file mode 100644
index 00000000000000..40e834e3775263
--- /dev/null
+++ b/target/linux/realtek/files-5.15/Documentation/devicetree/bindings/realtek,otto-timer.yaml
@@ -0,0 +1,85 @@
+# SPDX-License-Identifier: GPL-2.0
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/timer/realtek,rtl8300-timer.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Realtek Timer Device Tree Bindings
+
+maintainers:
+  - Markus Stockhausen <markus.stockhausen@gmx.de>
+
+description: |
+  The Realtek SOCs of the RTL83XX and RTL93XX series have at least 5 known
+  timers with corresponding interrupt lines . Their speed is derived from the
+  Lexra Bus (LXB) by dividers. Each timer has a block of 4 control registers in
+  the address range 0xb800xxxx with following start offsets.
+
+  RTL83XX: 0x3100, 0x3110, 0x3120, 0x3130, 0x3140
+  RTL93XX: 0x3200, 0x3210, 0x3220, 0x3230, 0x3240
+
+properties:
+  compatible:
+    items:
+      - enum:
+        - realtek,rtl8380-timer
+        - realtek,rtl8390-timer
+        - realtek,rtl9300-timer
+      - const: realtek,otto-timer
+
+  reg:
+    minItems: 5
+    maxItems: 5
+    description:
+      List of timer register addresses.
+
+  interrupts:
+    minItems: 5
+    maxItems: 5
+    description:
+      List of timer interrupts.
+
+  clocks:
+    maxItems: 1
+
+required:
+  - compatible
+  - reg
+  - interrupts
+  - clocks
+
+additionalProperties: false
+
+examples:
+  - |
+    timer0: timer@3100 {
+      compatible = "realtek,rtl8380-timer", "realtek,otto-timer";
+      reg = <0x3100 0x10>, <0x3110 0x10>, <0x3120 0x10>,
+            <0x3130 0x10>, <0x3140 0x10>;
+
+      interrupt-parent = <&intc>;
+      interrupts = <29 4>, <28 4>, <17 4>, <16 4>, <15 4>;
+      clocks = <&ccu CLK_LXB>;
+    };
+  - |
+    timer0: timer@3100 {
+      compatible = "realtek,rtl8390-timer", "realtek,otto-timer";
+      reg = <0x3100 0x10>, <0x3110 0x10>, <0x3120 0x10>,
+            <0x3130 0x10>, <0x3140 0x10>;
+
+      interrupt-parent = <&intc>;
+      interrupts = <29 4>, <28 4>, <17 4>, <16 4>, <15 4>;
+      clocks = <&ccu CLK_LXB>;
+    };
+  - |
+    timer0: timer@3200 {
+      compatible = "realtek,rtl9300-timer", "realtek,otto-timer";
+      reg = <0x3200 0x10>, <0x3210 0x10>, <0x3220 0x10>,
+            <0x3230 0x10>, <0x3240 0x10>;
+
+      interrupt-parent = <&intc>;
+      interrupts = <7 4>, <8 4>, <9 4>, <10 4>, <11 4>;
+      clocks = <&ccu CLK_LXB>;
+    };
+
+...
diff --git a/target/linux/realtek/files-5.15/arch/mips/include/asm/mach-rtl838x/ioremap.h b/target/linux/realtek/files-5.15/arch/mips/include/asm/mach-rtl838x/ioremap.h
new file mode 100644
index 00000000000000..c49a0957923372
--- /dev/null
+++ b/target/linux/realtek/files-5.15/arch/mips/include/asm/mach-rtl838x/ioremap.h
@@ -0,0 +1,29 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+#ifndef RTL838X_IOREMAP_H_
+#define RTL838X_IOREMAP_H_
+
+static inline int is_rtl838x_internal_registers(phys_addr_t offset)
+{
+	/* IO-Block */
+	if (offset >= 0xb8000000 && offset < 0xb9000000)
+		return 1;
+	/* Switch block */
+	if (offset >= 0xbb000000 && offset < 0xbc000000)
+		return 1;
+	return 0;
+}
+
+static inline void __iomem *plat_ioremap(phys_addr_t offset, unsigned long size,
+					 unsigned long flags)
+{
+	if (is_rtl838x_internal_registers(offset))
+		return (void __iomem *)offset;
+	return NULL;
+}
+
+static inline int plat_iounmap(const volatile void __iomem *addr)
+{
+	return is_rtl838x_internal_registers((unsigned long)addr);
+}
+
+#endif
diff --git a/target/linux/realtek/files-5.15/arch/mips/include/asm/mach-rtl838x/mach-rtl83xx.h b/target/linux/realtek/files-5.15/arch/mips/include/asm/mach-rtl838x/mach-rtl83xx.h
new file mode 100644
index 00000000000000..d9c0b311aeaa51
--- /dev/null
+++ b/target/linux/realtek/files-5.15/arch/mips/include/asm/mach-rtl838x/mach-rtl83xx.h
@@ -0,0 +1,414 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2006-2012 Tony Wu (tonywu@realtek.com)
+ * Copyright (C) 2020 B. Koblitz
+ */
+#ifndef _MACH_RTL838X_H_
+#define _MACH_RTL838X_H_
+
+#include <asm/types.h>
+/*
+ * Register access macros
+ */
+
+#define RTL838X_SW_BASE		((volatile void *) 0xBB000000)
+
+#define rtl83xx_r32(reg)	readl(reg)
+#define rtl83xx_w32(val, reg)	writel(val, reg)
+#define rtl83xx_w32_mask(clear, set, reg) rtl83xx_w32((rtl83xx_r32(reg) & ~(clear)) | (set), reg)
+
+#define rtl83xx_r8(reg)		readb(reg)
+#define rtl83xx_w8(val, reg)	writeb(val, reg)
+
+#define sw_r32(reg)		readl(RTL838X_SW_BASE + reg)
+#define sw_w32(val, reg)	writel(val, RTL838X_SW_BASE + reg)
+#define sw_w32_mask(clear, set, reg)	\
+				sw_w32((sw_r32(reg) & ~(clear)) | (set), reg)
+#define sw_r64(reg)		((((u64)readl(RTL838X_SW_BASE + reg)) << 32) | \
+				readl(RTL838X_SW_BASE + reg + 4))
+
+#define sw_w64(val, reg)	do { \
+					writel((u32)((val) >> 32), RTL838X_SW_BASE + reg); \
+					writel((u32)((val) & 0xffffffff), \
+							RTL838X_SW_BASE + reg + 4); \
+				} while (0)
+
+/*
+ * SPRAM
+ */
+#define RTL838X_ISPRAM_BASE	0x0
+#define RTL838X_DSPRAM_BASE	0x0
+
+/*
+ * IRQ Controller
+ */
+#define RTL838X_IRQ_CPU_BASE	0
+#define RTL838X_IRQ_CPU_NUM	8
+#define RTL838X_IRQ_ICTL_BASE	(RTL838X_IRQ_CPU_BASE + RTL838X_IRQ_CPU_NUM)
+#define RTL838X_IRQ_ICTL_NUM	32
+
+#define RTL83XX_IRQ_UART0		31
+#define RTL83XX_IRQ_UART1		30
+#define RTL83XX_IRQ_TC0			29
+#define RTL83XX_IRQ_TC1			28
+#define RTL83XX_IRQ_OCPTO		27
+#define RTL83XX_IRQ_HLXTO		26
+#define RTL83XX_IRQ_SLXTO		25
+#define RTL83XX_IRQ_NIC			24
+#define RTL83XX_IRQ_GPIO_ABCD		23
+#define RTL83XX_IRQ_GPIO_EFGH		22
+#define RTL83XX_IRQ_RTC			21
+#define RTL83XX_IRQ_SWCORE		20
+#define RTL83XX_IRQ_WDT_IP1		19
+#define RTL83XX_IRQ_WDT_IP2		18
+
+#define RTL9300_UART1_IRQ		31
+#define RTL9300_UART0_IRQ		30
+#define RTL9300_USB_H2_IRQ		28
+#define RTL9300_NIC_IRQ			24
+#define RTL9300_SWCORE_IRQ		23
+#define RTL9300_GPIO_ABC_IRQ		13
+#define RTL9300_TC4_IRQ			11
+#define RTL9300_TC3_IRQ			10
+#define RTL9300_TC2_IRQ			 9
+#define RTL9300_TC1_IRQ			 8
+#define RTL9300_TC0_IRQ			 7
+
+
+/*
+ * MIPS32R2 counter
+ */
+#define RTL838X_COMPARE_IRQ	(RTL838X_IRQ_CPU_BASE + 7)
+
+/*
+ *  ICTL
+ *  Base address 0xb8003000UL
+ */
+#define RTL838X_ICTL1_IRQ	(RTL838X_IRQ_CPU_BASE + 2)
+#define RTL838X_ICTL2_IRQ	(RTL838X_IRQ_CPU_BASE + 3)
+#define RTL838X_ICTL3_IRQ	(RTL838X_IRQ_CPU_BASE + 4)
+#define RTL838X_ICTL4_IRQ	(RTL838X_IRQ_CPU_BASE + 5)
+#define RTL838X_ICTL5_IRQ	(RTL838X_IRQ_CPU_BASE + 6)
+
+#define GIMR			(0x00)
+#define UART0_IE		(1 << 31)
+#define UART1_IE		(1 << 30)
+#define TC0_IE			(1 << 29)
+#define TC1_IE			(1 << 28)
+#define OCPTO_IE		(1 << 27)
+#define HLXTO_IE		(1 << 26)
+#define SLXTO_IE		(1 << 25)
+#define NIC_IE			(1 << 24)
+#define GPIO_ABCD_IE		(1 << 23)
+#define GPIO_EFGH_IE		(1 << 22)
+#define RTC_IE			(1 << 21)
+#define WDT_IP1_IE		(1 << 19)
+#define WDT_IP2_IE		(1 << 18)
+
+#define GISR			(0x04)
+#define UART0_IP		(1 << 31)
+#define UART1_IP		(1 << 30)
+#define TC0_IP			(1 << 29)
+#define TC1_IP			(1 << 28)
+#define OCPTO_IP		(1 << 27)
+#define HLXTO_IP		(1 << 26)
+#define SLXTO_IP		(1 << 25)
+#define NIC_IP			(1 << 24)
+#define GPIO_ABCD_IP		(1 << 23)
+#define GPIO_EFGH_IP		(1 << 22)
+#define RTC_IP			(1 << 21)
+#define WDT_IP1_IP		(1 << 19)
+#define WDT_IP2_IP		(1 << 18)
+
+
+/* Interrupt Routing Selection */
+#define UART0_RS		2
+#define UART1_RS		1
+#define TC0_RS			5
+#define TC1_RS			1
+#define OCPTO_RS		1
+#define HLXTO_RS		1
+#define SLXTO_RS		1
+#define NIC_RS			4
+#define GPIO_ABCD_RS		4
+#define GPIO_EFGH_RS		4
+#define RTC_RS			4
+#define	SWCORE_RS		3
+#define WDT_IP1_RS		4
+#define WDT_IP2_RS		5
+
+/* Interrupt IRQ Assignments */
+#define UART0_IRQ		31
+#define UART1_IRQ		30
+#define TC0_IRQ			29
+#define TC1_IRQ			28
+#define OCPTO_IRQ		27
+#define HLXTO_IRQ		26
+#define SLXTO_IRQ		25
+#define NIC_IRQ			24
+#define GPIO_ABCD_IRQ		23
+#define GPIO_EFGH_IRQ		22
+#define RTC_IRQ			21
+#define	SWCORE_IRQ		20
+#define WDT_IP1_IRQ		19
+#define WDT_IP2_IRQ		18
+
+#define SYSTEM_FREQ		200000000
+#define RTL838X_UART0_BASE	((volatile void *)(0xb8002000UL))
+#define RTL838X_UART0_BAUD	38400  /* ex. 19200 or 38400 or 57600 or 115200 */
+#define RTL838X_UART0_FREQ	(SYSTEM_FREQ - RTL838X_UART0_BAUD * 24)
+#define RTL838X_UART0_MAPBASE	0x18002000UL
+#define RTL838X_UART0_MAPSIZE	0x100
+#define RTL838X_UART0_IRQ	UART0_IRQ
+
+#define RTL838X_UART1_BASE	((volatile void *)(0xb8002100UL))
+#define RTL838X_UART1_BAUD	38400  /* ex. 19200 or 38400 or 57600 or 115200 */
+#define RTL838X_UART1_FREQ	(SYSTEM_FREQ - RTL838X_UART1_BAUD * 24)
+#define RTL838X_UART1_MAPBASE	0x18002100UL
+#define RTL838X_UART1_MAPSIZE	0x100
+#define RTL838X_UART1_IRQ	UART1_IRQ
+
+#define UART0_RBR		(RTL838X_UART0_BASE + 0x000)
+#define UART0_THR		(RTL838X_UART0_BASE + 0x000)
+#define UART0_DLL		(RTL838X_UART0_BASE + 0x000)
+#define UART0_IER		(RTL838X_UART0_BASE + 0x004)
+#define UART0_DLM		(RTL838X_UART0_BASE + 0x004)
+#define UART0_IIR		(RTL838X_UART0_BASE + 0x008)
+#define UART0_FCR		(RTL838X_UART0_BASE + 0x008)
+#define UART0_LCR		(RTL838X_UART0_BASE + 0x00C)
+#define UART0_MCR		(RTL838X_UART0_BASE + 0x010)
+#define UART0_LSR		(RTL838X_UART0_BASE + 0x014)
+
+#define UART1_RBR		(RTL838X_UART1_BASE + 0x000)
+#define UART1_THR		(RTL838X_UART1_BASE + 0x000)
+#define UART1_DLL		(RTL838X_UART1_BASE + 0x000)
+#define UART1_IER		(RTL838X_UART1_BASE + 0x004)
+#define UART1_DLM		(RTL838X_UART1_BASE + 0x004)
+#define UART1_IIR		(RTL838X_UART1_BASE + 0x008)
+#define UART1_FCR		(RTL838X_UART1_BASE + 0x008)
+#define UART1_LCR		(RTL838X_UART1_BASE + 0x00C)
+#define UART1_MCR		(RTL838X_UART1_BASE + 0x010)
+#define UART1_LSR		(RTL838X_UART1_BASE + 0x014)
+
+/*
+ * Memory Controller
+ */
+#define MC_MCR			0xB8001000
+#define MC_MCR_VAL		0x00000000
+
+#define MC_DCR			0xB8001004
+#define MC_DCR0_VAL		0x54480000
+
+#define MC_DTCR			0xB8001008
+#define MC_DTCR_VAL		0xFFFF05C0
+
+/*
+ * GPIO
+ */
+#define GPIO_CTRL_REG_BASE		((volatile void *) 0xb8003500)
+#define RTL838X_GPIO_PABC_CNR		(GPIO_CTRL_REG_BASE + 0x0)
+#define RTL838X_GPIO_PABC_TYPE		(GPIO_CTRL_REG_BASE + 0x04)
+#define RTL838X_GPIO_PABC_DIR		(GPIO_CTRL_REG_BASE + 0x8)
+#define RTL838X_GPIO_PABC_DATA		(GPIO_CTRL_REG_BASE + 0xc)
+#define RTL838X_GPIO_PABC_ISR		(GPIO_CTRL_REG_BASE + 0x10)
+#define RTL838X_GPIO_PAB_IMR		(GPIO_CTRL_REG_BASE + 0x14)
+#define RTL838X_GPIO_PC_IMR		(GPIO_CTRL_REG_BASE + 0x18)
+
+#define RTL930X_GPIO_CTRL_REG_BASE      ((volatile void *) 0xb8003300)
+#define RTL930X_GPIO_PABCD_DIR          (RTL930X_GPIO_CTRL_REG_BASE + 0x8)
+#define RTL930X_GPIO_PABCD_DAT          (RTL930X_GPIO_CTRL_REG_BASE + 0xc)
+#define RTL930X_GPIO_PABCD_ISR          (RTL930X_GPIO_CTRL_REG_BASE + 0x10)
+#define RTL930X_GPIO_PAB_IMR            (RTL930X_GPIO_CTRL_REG_BASE + 0x14)
+#define RTL930X_GPIO_PCD_IMR            (RTL930X_GPIO_CTRL_REG_BASE + 0x18)
+
+#define RTL838X_MODEL_NAME_INFO		(0x00D4)
+#define RTL839X_MODEL_NAME_INFO		(0x0FF0)
+#define RTL93XX_MODEL_NAME_INFO		(0x0004)
+#define RTL931X_CHIP_INFO_ADDR		(0x0008)
+
+#define RTL838X_LED_GLB_CTRL		(0xA000)
+#define RTL839X_LED_GLB_CTRL		(0x00E4)
+#define RTL9302_LED_GLB_CTRL		(0xcc00)
+#define RTL930X_LED_GLB_CTRL		(0xCC00)
+#define RTL931X_LED_GLB_CTRL		(0x0600)
+
+#define RTL838X_EXT_GPIO_DIR		(0xA08C)
+#define RTL839X_EXT_GPIO_DIR		(0x0214)
+#define RTL838X_EXT_GPIO_DATA		(0xA094)
+#define RTL839X_EXT_GPIO_DATA		(0x021c)
+#define RTL838X_EXT_GPIO_INDRT_ACCESS	(0xA09C)
+#define RTL839X_EXT_GPIO_INDRT_ACCESS	(0x0224)
+#define RTL838X_EXTRA_GPIO_CTRL		(0xA0E0)
+#define RTL838X_DMY_REG5		(0x0144)
+#define RTL838X_EXTRA_GPIO_CTRL		(0xA0E0)
+
+#define RTL838X_GMII_INTF_SEL		(0x1000)
+#define RTL838X_IO_DRIVING_ABILITY_CTRL	(0x1010)
+
+#define RTL838X_GPIO_A7		31
+#define RTL838X_GPIO_A6		30
+#define RTL838X_GPIO_A5		29
+#define RTL838X_GPIO_A4		28
+#define RTL838X_GPIO_A3		27
+#define RTL838X_GPIO_A2		26
+#define RTL838X_GPIO_A1		25
+#define RTL838X_GPIO_A0		24
+#define RTL838X_GPIO_B7		23
+#define RTL838X_GPIO_B6		22
+#define RTL838X_GPIO_B5		21
+#define RTL838X_GPIO_B4		20
+#define RTL838X_GPIO_B3		19
+#define RTL838X_GPIO_B2		18
+#define RTL838X_GPIO_B1		17
+#define RTL838X_GPIO_B0		16
+#define RTL838X_GPIO_C7		15
+#define RTL838X_GPIO_C6		14
+#define RTL838X_GPIO_C5		13
+#define RTL838X_GPIO_C4		12
+#define RTL838X_GPIO_C3		11
+#define RTL838X_GPIO_C2		10
+#define RTL838X_GPIO_C1		9
+#define RTL838X_GPIO_C0		8
+
+#define RTL838X_INT_RW_CTRL		(0x0058)
+#define RTL838X_EXT_VERSION		(0x00D0)
+#define RTL838X_PLL_CML_CTRL		(0x0FF8)
+#define RTL838X_STRAP_DBG		(0x100C)
+
+/*
+ * Reset
+ */
+#define	RGCR				(0x1E70)
+#define RTL838X_RST_GLB_CTRL_0		(0x003c)
+#define RTL838X_RST_GLB_CTRL_1		(0x0040)
+#define RTL839X_RST_GLB_CTRL		(0x0014)
+#define RTL930X_RST_GLB_CTRL_0		(0x000c)
+#define RTL931X_RST_GLB_CTRL		(0x0400)
+
+/* LED control by switch */
+#define RTL838X_LED_MODE_SEL		(0x1004)
+#define RTL838X_LED_MODE_CTRL		(0xA004)
+#define RTL838X_LED_P_EN_CTRL		(0xA008)
+
+/* LED control by software */
+#define RTL838X_LED_SW_CTRL		(0x0128)
+#define RTL839X_LED_SW_CTRL		(0xA00C)
+#define RTL838X_LED_SW_P_EN_CTRL	(0xA010)
+#define RTL839X_LED_SW_P_EN_CTRL	(0x012C)
+#define RTL838X_LED0_SW_P_EN_CTRL	(0xA010)
+#define RTL839X_LED0_SW_P_EN_CTRL	(0x012C)
+#define RTL838X_LED1_SW_P_EN_CTRL	(0xA014)
+#define RTL839X_LED1_SW_P_EN_CTRL	(0x0130)
+#define RTL838X_LED2_SW_P_EN_CTRL	(0xA018)
+#define RTL839X_LED2_SW_P_EN_CTRL	(0x0134)
+#define RTL838X_LED_SW_P_CTRL		(0xA01C)
+#define RTL839X_LED_SW_P_CTRL		(0x0144)
+
+#define RTL839X_MAC_EFUSE_CTRL		(0x02ac)
+
+/*
+ * MDIO via Realtek's SMI interface
+ */
+#define RTL838X_SMI_GLB_CTRL		(0xa100)
+#define RTL838X_SMI_ACCESS_PHY_CTRL_0	(0xa1b8)
+#define RTL838X_SMI_ACCESS_PHY_CTRL_1	(0xa1bc)
+#define RTL838X_SMI_ACCESS_PHY_CTRL_2	(0xa1c0)
+#define RTL838X_SMI_ACCESS_PHY_CTRL_3	(0xa1c4)
+#define RTL838X_SMI_PORT0_5_ADDR_CTRL	(0xa1c8)
+#define RTL838X_SMI_POLL_CTRL		(0xa17c)
+
+#define RTL839X_SMI_GLB_CTRL		(0x03f8)
+#define RTL839X_SMI_PORT_POLLING_CTRL	(0x03fc)
+#define RTL839X_PHYREG_ACCESS_CTRL	(0x03DC)
+#define RTL839X_PHYREG_CTRL		(0x03E0)
+#define RTL839X_PHYREG_PORT_CTRL	(0x03E4)
+#define RTL839X_PHYREG_DATA_CTRL	(0x03F0)
+#define RTL839X_PHYREG_MMD_CTRL		(0x3F4)
+
+#define RTL930X_SMI_GLB_CTRL		(0xCA00)
+#define RTL930X_SMI_POLL_CTRL		(0xca90)
+#define RTL930X_SMI_PORT0_15_POLLING_SEL (0xCA08)
+#define RTL930X_SMI_PORT16_27_POLLING_SEL (0xCA0C)
+#define RTL930X_SMI_PORT0_5_ADDR	(0xCB80)
+#define RTL930X_SMI_ACCESS_PHY_CTRL_0	(0xCB70)
+#define RTL930X_SMI_ACCESS_PHY_CTRL_1	(0xCB74)
+#define RTL930X_SMI_ACCESS_PHY_CTRL_2	(0xCB78)
+#define RTL930X_SMI_ACCESS_PHY_CTRL_3	(0xCB7C)
+
+#define RTL931X_SMI_GLB_CTRL1		(0x0CBC)
+#define RTL931X_SMI_GLB_CTRL0		(0x0CC0)
+#define RTL931X_SMI_PORT_POLLING_CTRL	(0x0CCC)
+#define RTL931X_SMI_PORT_ADDR		(0x0C74)
+#define RTL931X_SMI_PORT_POLLING_SEL	(0x0C9C)
+#define RTL9310_SMI_PORT_POLLING_CTRL	(0x0CCC)
+#define RTL931X_SMI_INDRT_ACCESS_CTRL_0	(0x0C00)
+#define RTL931X_SMI_INDRT_ACCESS_CTRL_1	(0x0C04)
+#define RTL931X_SMI_INDRT_ACCESS_CTRL_2	(0x0C08)
+#define RTL931X_SMI_INDRT_ACCESS_CTRL_3	(0x0C10)
+#define RTL931X_SMI_INDRT_ACCESS_BC_PHYID_CTRL (0x0C14)
+#define RTL931X_SMI_INDRT_ACCESS_MMD_CTRL (0xC18)
+#define RTL931X_MAC_L2_GLOBAL_CTRL2	(0x1358)
+#define RTL931X_MAC_L2_GLOBAL_CTRL1	(0x5548)
+
+/* Switch interrupts */
+#define RTL838X_IMR_GLB			(0x1100)
+#define RTL838X_IMR_PORT_LINK_STS_CHG	(0x1104)
+#define RTL838X_ISR_GLB_SRC		(0x1148)
+#define RTL838X_ISR_PORT_LINK_STS_CHG	(0x114C)
+
+#define RTL839X_IMR_GLB			(0x0064)
+#define RTL839X_IMR_PORT_LINK_STS_CHG	(0x0068)
+#define RTL839X_ISR_GLB_SRC		(0x009c)
+#define RTL839X_ISR_PORT_LINK_STS_CHG	(0x00a0)
+
+#define RTL930X_IMR_GLB			(0xC628)
+#define RTL930X_IMR_PORT_LINK_STS_CHG	(0xC62C)
+#define RTL930X_ISR_GLB			(0xC658)
+#define RTL930X_ISR_PORT_LINK_STS_CHG	(0xC660)
+
+/* IMR_GLB does not exit on RTL931X */
+#define RTL931X_IMR_PORT_LINK_STS_CHG	(0x126C)
+#define RTL931X_ISR_GLB_SRC		(0x12B4)
+#define RTL931X_ISR_PORT_LINK_STS_CHG	(0x12B8)
+
+/* Definition of family IDs */
+#define RTL8389_FAMILY_ID   (0x8389)
+#define RTL8328_FAMILY_ID   (0x8328)
+#define RTL8390_FAMILY_ID   (0x8390)
+#define RTL8350_FAMILY_ID   (0x8350)
+#define RTL8380_FAMILY_ID   (0x8380)
+#define RTL8330_FAMILY_ID   (0x8330)
+#define RTL9300_FAMILY_ID   (0x9300)
+#define RTL9310_FAMILY_ID   (0x9310)
+
+/* SPI Support */
+#define RTL931X_SPI_CTRL0		(0x103C)
+
+/* Basic SoC Features */
+#define RTL838X_CPU_PORT			28
+#define RTL839X_CPU_PORT			52
+#define RTL930X_CPU_PORT			28
+#define RTL931X_CPU_PORT			56
+
+struct rtl83xx_soc_info {
+	unsigned char *name;
+	unsigned int id;
+	unsigned int family;
+	unsigned char *compatible;
+	volatile void *sw_base;
+	volatile void *icu_base;
+	int cpu_port;
+};
+
+/* rtl83xx-related functions used across subsystems */
+int rtl838x_smi_wait_op(int timeout);
+int rtl838x_read_phy(u32 port, u32 page, u32 reg, u32 *val);
+int rtl838x_write_phy(u32 port, u32 page, u32 reg, u32 val);
+int rtl839x_read_phy(u32 port, u32 page, u32 reg, u32 *val);
+int rtl839x_write_phy(u32 port, u32 page, u32 reg, u32 val);
+int rtl930x_read_phy(u32 port, u32 page, u32 reg, u32 *val);
+int rtl930x_write_phy(u32 port, u32 page, u32 reg, u32 val);
+int rtl931x_read_phy(u32 port, u32 page, u32 reg, u32 *val);
+int rtl931x_write_phy(u32 port, u32 page, u32 reg, u32 val);
+
+#endif   /* _MACH_RTL838X_H_ */
diff --git a/target/linux/realtek/files-5.15/arch/mips/rtl838x/Makefile b/target/linux/realtek/files-5.15/arch/mips/rtl838x/Makefile
new file mode 100644
index 00000000000000..a9d1666d4652e8
--- /dev/null
+++ b/target/linux/realtek/files-5.15/arch/mips/rtl838x/Makefile
@@ -0,0 +1,5 @@
+#
+# Makefile for the rtl838x specific parts of the kernel
+#
+
+obj-y := setup.o prom.o
diff --git a/target/linux/realtek/files-5.15/arch/mips/rtl838x/Platform b/target/linux/realtek/files-5.15/arch/mips/rtl838x/Platform
new file mode 100644
index 00000000000000..98f18cac1be13b
--- /dev/null
+++ b/target/linux/realtek/files-5.15/arch/mips/rtl838x/Platform
@@ -0,0 +1,5 @@
+#
+# Realtek RTL838x SoCs
+#
+cflags-$(CONFIG_RTL83XX)   += -I$(srctree)/arch/mips/include/asm/mach-rtl838x/
+load-$(CONFIG_RTL83XX)     += 0xffffffff80100000
diff --git a/target/linux/realtek/files-5.15/arch/mips/rtl838x/prom.c b/target/linux/realtek/files-5.15/arch/mips/rtl838x/prom.c
new file mode 100644
index 00000000000000..0c98af954859e1
--- /dev/null
+++ b/target/linux/realtek/files-5.15/arch/mips/rtl838x/prom.c
@@ -0,0 +1,212 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * prom.c
+ * Early intialization code for the Realtek RTL838X SoC
+ *
+ * based on the original BSP by
+ * Copyright (C) 2006-2012 Tony Wu (tonywu@realtek.com)
+ * Copyright (C) 2020 B. Koblitz
+ *
+ */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/of_fdt.h>
+#include <linux/libfdt.h>
+#include <asm/bootinfo.h>
+#include <asm/addrspace.h>
+#include <asm/page.h>
+#include <asm/cpu.h>
+#include <asm/fw/fw.h>
+#include <asm/smp-ops.h>
+#include <asm/mips-cps.h>
+
+#include <mach-rtl83xx.h>
+
+extern char arcs_cmdline[];
+
+struct rtl83xx_soc_info soc_info;
+const void *fdt;
+
+#ifdef CONFIG_MIPS_MT_SMP
+extern const struct plat_smp_ops vsmp_smp_ops;
+static struct plat_smp_ops rtl_smp_ops;
+
+static void rtl_init_secondary(void)
+{
+#ifndef CONFIG_CEVT_R4K
+/*
+ * These devices are low on resources. There might be the chance that CEVT_R4K
+ * is not enabled in kernel build. Nevertheless the timer and interrupt 7 might
+ * be active by default after startup of secondary VPE. With no registered
+ * handler that leads to continuous unhandeled interrupts. In this case disable
+ * counting (DC) in the core and confirm a pending interrupt.
+ */
+	write_c0_cause(read_c0_cause() | CAUSEF_DC);
+	write_c0_compare(0);
+#endif /* CONFIG_CEVT_R4K */
+/*
+ * Enable all CPU interrupts, as everything is managed by the external
+ * controller. TODO: Standard vsmp_init_secondary() has special treatment for
+ * Malta if external GIC is available. Maybe we need this too.
+ */
+	if (mips_gic_present())
+		pr_warn("%s: GIC present. Maybe interrupt enabling required.\n", __func__);
+	else
+		set_c0_status(ST0_IM);
+}
+#endif /* CONFIG_MIPS_MT_SMP */
+
+const char *get_system_type(void)
+{
+	return soc_info.name;
+}
+
+void __init prom_free_prom_memory(void)
+{
+
+}
+
+void __init device_tree_init(void)
+{
+	if (!fdt_check_header(&__appended_dtb)) {
+		fdt = &__appended_dtb;
+		pr_info("Using appended Device Tree.\n");
+	}
+	initial_boot_params = (void *)fdt;
+	unflatten_and_copy_device_tree();
+}
+
+void __init identify_rtl9302(void)
+{
+	switch (sw_r32(RTL93XX_MODEL_NAME_INFO) & 0xfffffff0) {
+	case 0x93020810:
+		soc_info.name = "RTL9302A 12x2.5G";
+		break;
+	case 0x93021010:
+		soc_info.name = "RTL9302B 8x2.5G";
+		break;
+	case 0x93021810:
+		soc_info.name = "RTL9302C 16x2.5G";
+		break;
+	case 0x93022010:
+		soc_info.name = "RTL9302D 24x2.5G";
+		break;
+	case 0x93020800:
+		soc_info.name = "RTL9302A";
+		break;
+	case 0x93021000:
+		soc_info.name = "RTL9302B";
+		break;
+	case 0x93021800:
+		soc_info.name = "RTL9302C";
+		break;
+	case 0x93022000:
+		soc_info.name = "RTL9302D";
+		break;
+	case 0x93023001:
+		soc_info.name = "RTL9302F";
+		break;
+	default:
+		soc_info.name = "RTL9302";
+	}
+}
+
+void __init prom_init(void)
+{
+	uint32_t model;
+
+	model = sw_r32(RTL838X_MODEL_NAME_INFO);
+	pr_info("RTL838X model is %x\n", model);
+	model = model >> 16 & 0xFFFF;
+
+	if ((model != 0x8328) && (model != 0x8330) && (model != 0x8332)
+	    && (model != 0x8380) && (model != 0x8382)) {
+		model = sw_r32(RTL839X_MODEL_NAME_INFO);
+		pr_info("RTL839X model is %x\n", model);
+		model = model >> 16 & 0xFFFF;
+	}
+
+	if ((model & 0x8390) != 0x8380 && (model & 0x8390) != 0x8390) {
+		model = sw_r32(RTL93XX_MODEL_NAME_INFO);
+		pr_info("RTL93XX model is %x\n", model);
+		model = model >> 16 & 0xFFFF;
+	}
+
+	soc_info.id = model;
+
+	switch (model) {
+	case 0x8328:
+		soc_info.name = "RTL8328";
+		soc_info.family = RTL8328_FAMILY_ID;
+		break;
+	case 0x8332:
+		soc_info.name = "RTL8332";
+		soc_info.family = RTL8380_FAMILY_ID;
+		break;
+	case 0x8380:
+		soc_info.name = "RTL8380";
+		soc_info.family = RTL8380_FAMILY_ID;
+		break;
+	case 0x8382:
+		soc_info.name = "RTL8382";
+		soc_info.family = RTL8380_FAMILY_ID;
+		break;
+	case 0x8390:
+		soc_info.name = "RTL8390";
+		soc_info.family = RTL8390_FAMILY_ID;
+		break;
+	case 0x8391:
+		soc_info.name = "RTL8391";
+		soc_info.family = RTL8390_FAMILY_ID;
+		break;
+	case 0x8392:
+		soc_info.name = "RTL8392";
+		soc_info.family = RTL8390_FAMILY_ID;
+		break;
+	case 0x8393:
+		soc_info.name = "RTL8393";
+		soc_info.family = RTL8390_FAMILY_ID;
+		break;
+	case 0x9301:
+		soc_info.name = "RTL9301";
+		soc_info.family = RTL9300_FAMILY_ID;
+		break;
+	case 0x9302:
+		identify_rtl9302();
+		soc_info.family = RTL9300_FAMILY_ID;
+		break;
+	case 0x9303:
+		soc_info.name = "RTL9303";
+		soc_info.family = RTL9300_FAMILY_ID;
+		break;
+	case 0x9313:
+		soc_info.name = "RTL9313";
+		soc_info.family = RTL9310_FAMILY_ID;
+		break;
+	default:
+		soc_info.name = "DEFAULT";
+		soc_info.family = 0;
+	}
+
+	pr_info("SoC Type: %s\n", get_system_type());
+
+	fw_init_cmdline();
+
+	mips_cpc_probe();
+
+	if (!register_cps_smp_ops())
+		return;
+
+#ifdef CONFIG_MIPS_MT_SMP
+	if (cpu_has_mipsmt) {
+		rtl_smp_ops = vsmp_smp_ops;
+		rtl_smp_ops.init_secondary = rtl_init_secondary;
+		register_smp_ops(&rtl_smp_ops);
+		return;
+	}
+#endif
+
+	register_up_smp_ops();
+}
diff --git a/target/linux/realtek/files-5.15/arch/mips/rtl838x/setup.c b/target/linux/realtek/files-5.15/arch/mips/rtl838x/setup.c
new file mode 100644
index 00000000000000..546b2fa2f81320
--- /dev/null
+++ b/target/linux/realtek/files-5.15/arch/mips/rtl838x/setup.c
@@ -0,0 +1,102 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Setup for the Realtek RTL838X SoC:
+ *	Memory, Timer and Serial
+ *
+ * Copyright (C) 2020 B. Koblitz
+ * based on the original BSP by
+ * Copyright (C) 2006-2012 Tony Wu (tonywu@realtek.com)
+ *
+ */
+
+#include <linux/console.h>
+#include <linux/init.h>
+#include <linux/clkdev.h>
+#include <linux/clk-provider.h>
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/of_fdt.h>
+#include <linux/irqchip.h>
+
+#include <asm/addrspace.h>
+#include <asm/io.h>
+#include <asm/bootinfo.h>
+#include <asm/time.h>
+#include <asm/prom.h>
+#include <asm/smp-ops.h>
+
+#include "mach-rtl83xx.h"
+
+extern struct rtl83xx_soc_info soc_info;
+
+void __init plat_mem_setup(void)
+{
+	void *dtb;
+
+	set_io_port_base(KSEG1);
+
+	dtb = get_fdt();
+	if (!dtb)
+		panic("no dtb found");
+
+	/*
+	 * Load the devicetree. This causes the chosen node to be
+	 * parsed resulting in our memory appearing
+	 */
+	__dt_setup_arch(dtb);
+}
+
+void plat_time_init_fallback(void)
+{
+	struct device_node *np;
+	u32 freq = 500000000;
+
+	np = of_find_node_by_name(NULL, "cpus");
+	if (!np) {
+		pr_err("Missing 'cpus' DT node, using default frequency.");
+	} else {
+		if (of_property_read_u32(np, "frequency", &freq) < 0)
+			pr_err("No 'frequency' property in DT, using default.");
+		else
+			pr_info("CPU frequency from device tree: %dMHz", freq / 1000000);
+		of_node_put(np);
+	}
+	mips_hpt_frequency = freq / 2;
+}
+
+void __init plat_time_init(void)
+{
+/*
+ * Initialization routine resembles generic MIPS plat_time_init() with
+ * lazy error handling. The final fallback is only needed until we have
+ * converted all device trees to new clock syntax.
+ */
+	struct device_node *np;
+	struct clk *clk;
+
+	of_clk_init(NULL);
+
+	mips_hpt_frequency = 0;
+	np = of_get_cpu_node(0, NULL);
+	if (!np) {
+		pr_err("Failed to get CPU node\n");
+	} else {
+		clk = of_clk_get(np, 0);
+		if (IS_ERR(clk)) {
+			pr_err("Failed to get CPU clock: %ld\n", PTR_ERR(clk));
+		} else {
+			mips_hpt_frequency = clk_get_rate(clk) / 2;
+			clk_put(clk);
+		}
+	}
+
+	if (!mips_hpt_frequency)
+		plat_time_init_fallback();
+
+	timer_probe();
+}
+
+void __init arch_init_irq(void)
+{
+	irqchip_init();
+}
diff --git a/target/linux/realtek/files-5.15/drivers/clk/realtek/Kconfig b/target/linux/realtek/files-5.15/drivers/clk/realtek/Kconfig
new file mode 100644
index 00000000000000..4cf3cd963399a2
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/clk/realtek/Kconfig
@@ -0,0 +1,19 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+menuconfig COMMON_CLK_REALTEK
+	bool "Support for Realtek's clock controllers"
+	depends on RTL83XX
+
+if COMMON_CLK_REALTEK
+
+config COMMON_CLK_RTL83XX
+	bool "Clock driver for Realtek RTL83XX"
+	depends on RTL83XX
+	select SRAM
+	help
+	  This driver adds support for the Realtek RTL83xx series basic clocks.
+	  This includes chips in the RTL838x series, such as RTL8380, RTL8381,
+	  RTL832, as well as chips from the RTL839x series, such as RTL8390,
+	  RT8391, RTL8392, RTL8393 and RTL8396.
+
+endif
diff --git a/target/linux/realtek/files-5.15/drivers/clk/realtek/Makefile b/target/linux/realtek/files-5.15/drivers/clk/realtek/Makefile
new file mode 100644
index 00000000000000..7bc4ed910c5226
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/clk/realtek/Makefile
@@ -0,0 +1,2 @@
+# SPDX-License-Identifier: GPL-2.0-only
+obj-$(CONFIG_COMMON_CLK_RTL83XX) += clk-rtl83xx.o clk-rtl838x-sram.o clk-rtl839x-sram.o
diff --git a/target/linux/realtek/files-5.15/drivers/clk/realtek/clk-rtl838x-sram.S b/target/linux/realtek/files-5.15/drivers/clk/realtek/clk-rtl838x-sram.S
new file mode 100644
index 00000000000000..24317231330a65
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/clk/realtek/clk-rtl838x-sram.S
@@ -0,0 +1,149 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Realtek RTL838X SRAM clock setters
+ * Copyright (C) 2022 Markus Stockhausen <markus.stockhausen@gmx.de>
+ */
+
+#include <dt-bindings/clock/rtl83xx-clk.h>
+
+#include "clk-rtl83xx.h"
+
+#define rGLB	$t0
+#define rCTR	$t1
+#define rMSK	$t2
+#define rSLP	$t3
+#define rTMP	$t4
+
+.set	noreorder
+
+.globl	rtcl_838x_dram_start
+rtcl_838x_dram_start:
+
+/*
+ * Functions start here and should avoid access to normal memory. REMARK! Do not forget about
+ * stack pointer and dirty caches that might interfere.
+ */
+
+.globl	rtcl_838x_dram_set_rate
+.ent	rtcl_838x_dram_set_rate
+rtcl_838x_dram_set_rate:
+
+#ifdef CONFIG_RTL838X
+
+	li	rCTR, RTL_SW_CORE_BASE
+	addiu	rGLB, rCTR, RTL838X_PLL_GLB_CTRL
+	ori	rTMP, $0, CLK_CPU
+	beq	$a0, rTMP, pre_cpu
+	ori	rTMP, $0, CLK_MEM
+	beq	$a0, rTMP, pre_mem
+	nop
+pre_lxb:
+	ori	rSLP, $0, RTL838X_GLB_CTRL_LXB_PLL_READY_MASK
+	addiu	rCTR, rCTR, RTL838X_PLL_LXB_CTRL0
+	b	main_set
+	ori	rMSK, $0, RTL838X_GLB_CTRL_EN_LXB_PLL_MASK
+pre_mem:
+	/* simple 64K data cache flush to avoid unexpected memory access */
+	li	rMSK, RTL_SRAM_BASE
+	li	rTMP, 2048
+pre_flush:
+	lw	$0, 0(rMSK)
+	addiu	rMSK, rMSK, 32
+	addiu	rTMP, rTMP, -1
+	bne	rTMP, $0, pre_flush
+	lw	$0, -4(rMSK)
+
+	ori	rSLP, $0, RTL838X_GLB_CTRL_MEM_PLL_READY_MASK
+	addiu	rCTR, rCTR, RTL838X_PLL_MEM_CTRL0
+	b	main_set
+	ori	rMSK, $0, RTL838X_GLB_CTRL_EN_MEM_PLL_MASK
+pre_cpu:
+	/* switch CPU to LXB clock */
+	ori	rMSK, $0, RTL838X_GLB_CTRL_CPU_PLL_SC_MUX_MASK
+	nor	rMSK, rMSK, $0
+	sync
+	lw	rTMP, 0(rGLB)
+	and	rTMP, rTMP, rMSK
+	sw	rTMP, 0(rGLB)
+	sync
+
+	ori	rSLP, $0, RTL838X_GLB_CTRL_CPU_PLL_READY_MASK
+	addiu	rCTR, rCTR, RTL838X_PLL_CPU_CTRL0
+	ori	rMSK, $0, RTL838X_GLB_CTRL_EN_CPU_PLL_MASK
+main_set:
+	/* disable PLL */
+	nor	rMSK, rMSK, 0
+	sync
+	lw	rTMP, 0(rGLB)
+	sync
+	and	rTMP, rTMP, rMSK
+	sync
+	sw	rTMP, 0(rGLB)
+
+	/* set new PLL values */
+	sync
+	sw	$a1, 0(rCTR)
+	sw	$a2, 4(rCTR)
+	sync
+
+	/* enable PLL (will reset it and clear ready status) */
+	nor	rMSK, rMSK, 0
+	sync
+	lw	rTMP, 0(rGLB)
+	sync
+	or	rTMP, rTMP, rMSK
+	sync
+	sw	rTMP, 0(rGLB)
+
+	/* wait for PLL to become ready */
+wait_ready:
+	lw	rTMP, 0(rGLB)
+	and	rTMP, rTMP, rSLP
+	bne	rTMP, $0, wait_ready
+	sync
+
+	/* branch to post processing */
+	ori	rTMP, $0, CLK_CPU
+	beq	$a0, rTMP, post_cpu
+	ori	rTMP, $0, CLK_MEM
+	beq	$a0, rTMP, post_mem
+	nop
+post_lxb:
+	jr	$ra
+	nop
+post_mem:
+	jr	$ra
+	nop
+post_cpu:
+	/* stabilize clock to avoid crash, empirically determined */
+	ori	rSLP, $0, 0x3000
+wait_cpu:
+	bnez	rSLP, wait_cpu
+	addiu	rSLP, rSLP, -1
+
+	/* switch CPU to PLL clock */
+	ori	rMSK, $0, RTL838X_GLB_CTRL_CPU_PLL_SC_MUX_MASK
+	sync
+	lw	rTMP, 0(rGLB)
+	or	rTMP, rTMP, rMSK
+	sw	rTMP, 0(rGLB)
+	sync
+	jr	$ra
+	nop
+
+#else /* !CONFIG_RTL838X */
+
+	jr	$ra
+	nop
+
+#endif
+
+.end	rtcl_838x_dram_set_rate
+
+/*
+ * End marker. Do not delete.
+ */
+	.word RTL_SRAM_MARKER
+.globl	rtcl_838x_dram_size
+rtcl_838x_dram_size:
+	.word .-rtcl_838x_dram_start
diff --git a/target/linux/realtek/files-5.15/drivers/clk/realtek/clk-rtl839x-sram.S b/target/linux/realtek/files-5.15/drivers/clk/realtek/clk-rtl839x-sram.S
new file mode 100644
index 00000000000000..eb44cd90f14953
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/clk/realtek/clk-rtl839x-sram.S
@@ -0,0 +1,141 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Realtek RTL839X SRAM clock setters
+ * Copyright (C) 2022 Markus Stockhausen <markus.stockhausen@gmx.de>
+ */
+
+#include <asm/mipsregs.h>
+#include <dt-bindings/clock/rtl83xx-clk.h>
+
+#include "clk-rtl83xx.h"
+
+#define rGLB	$t0
+#define rCTR	$t1
+#define rMSK	$t2
+#define rSLP1	$t3
+#define rSLP2	$t4
+#define rSLP3	$t5
+#define rTMP	$t6
+#define rCP0	$t7
+
+.set	noreorder
+
+.globl	rtcl_839x_dram_start
+rtcl_839x_dram_start:
+
+/*
+ * Functions start here and should avoid access to normal memory. REMARK! Do not forget about
+ * stack pointer and dirty caches that might interfere.
+ */
+
+.globl	rtcl_839x_dram_set_rate
+.ent	rtcl_839x_dram_set_rate
+rtcl_839x_dram_set_rate:
+
+#ifdef CONFIG_RTL839X
+
+	/* disable MIPS 34K branch and return prediction */
+        mfc0    rCP0, CP0_CONFIG, 7
+        ori     rTMP, rCP0, 0xc
+        mtc0    rTMP, CP0_CONFIG, 7
+
+	li	rCTR, RTL_SW_CORE_BASE
+	addiu	rGLB, rCTR, RTL839X_PLL_GLB_CTRL
+	ori	rTMP, $0, CLK_CPU
+	beq	$a0, rTMP, pre_cpu
+	ori	rTMP, $0, CLK_MEM
+	beq	$a0, rTMP, pre_mem
+	nop
+pre_lxb:
+	li	rSLP1, 0x400000
+	li	rSLP2, 0x400000
+	li	rSLP3, 0x400000
+	addiu	rCTR, rCTR, RTL839X_PLL_LXB_CTRL0
+	b	main_set
+	ori	rMSK, $0, RTL839X_GLB_CTRL_LXB_CLKSEL_MASK
+pre_mem:
+	/* try to avoid memory access with simple 64K data cache flush */
+	li	rMSK, RTL_SRAM_BASE
+	li	rTMP, 2048
+pre_flush:
+	lw	$0, 0(rMSK)
+	addiu	rMSK, rMSK, 32
+	addiu	rTMP, rTMP, -1
+	bne	rTMP, $0, pre_flush
+	lw	$0, -4(rMSK)
+
+	li	rSLP1, 0x10000
+	li	rSLP2, 0x10000
+	li	rSLP3, 0x10000
+	addiu	rCTR, rCTR, RTL839X_PLL_MEM_CTRL0
+	b	main_set
+	ori	rMSK, $0, RTL839X_GLB_CTRL_MEM_CLKSEL_MASK
+pre_cpu:
+	li	rSLP1, 0x1000
+	li	rSLP2, 0x1000
+	li	rSLP3, 0x200
+	addiu	rCTR, rCTR, RTL839X_PLL_CPU_CTRL0
+	ori	rMSK, $0, RTL839X_GLB_CTRL_CPU_CLKSEL_MASK
+main_set:
+	/* switch to fixed clock */
+	sync
+	lw	rTMP, 0(rGLB)
+	sync
+	or	rTMP, rTMP, rMSK
+	sync
+	sw	rTMP, 0(rGLB)
+
+	/* wait until fixed clock in use */
+	or	rTMP, rSLP1, $0
+wait_fixclock:
+	bnez	rTMP, wait_fixclock
+	addiu	rTMP, rTMP, -1
+
+	/* set new PLL values */
+	sync
+	sw	$a1, 0(rCTR)
+	sw	$a2, 4(rCTR)
+	sync
+
+	/* wait for value takeover */
+	or	rTMP, rSLP2, $0
+wait_pll:
+	bnez	rTMP, wait_pll
+	addiu	rTMP, rTMP, -1
+
+	/* switch back to PLL clock*/
+	nor	rMSK, rMSK, $0
+	sync
+	lw	rTMP, 0(rGLB)
+	sync
+	and	rTMP, rTMP, rMSK
+	sync
+	sw	rTMP, 0(rGLB)
+
+	/* wait until PLL clock in use */
+	or	rTMP, rSLP3, $0
+wait_pllclock:
+	bnez	rTMP, wait_pllclock
+	addiu	rTMP, rTMP, -1
+
+	/* restore branch prediction */
+	mtc0    rCP0, CP0_CONFIG, 7
+	jr	$ra
+	nop
+
+#else /* !CONFIG_RTL839X */
+
+	jr	$ra
+	nop
+
+#endif
+
+.end	rtcl_839x_dram_set_rate
+
+/*
+ * End marker. Do not delete.
+ */
+	 .word RTL_SRAM_MARKER
+.globl	rtcl_839x_dram_size
+rtcl_839x_dram_size:
+	.word .-rtcl_839x_dram_start
diff --git a/target/linux/realtek/files-5.15/drivers/clk/realtek/clk-rtl83xx.c b/target/linux/realtek/files-5.15/drivers/clk/realtek/clk-rtl83xx.c
new file mode 100644
index 00000000000000..0cca32ab3447b2
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/clk/realtek/clk-rtl83xx.c
@@ -0,0 +1,770 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Realtek RTL83XX clock driver
+ * Copyright (C) 2022 Markus Stockhausen <markus.stockhausen@gmx.de>
+ *
+ * This driver provides basic clock support for the central core clock unit (CCU) and its PLLs
+ * inside the RTL838X and RTL8389X SOC. Currently CPU, memory and LXB clock information can be
+ * accessed. To make use of the driver add the following devices and configurations at the
+ * appropriate locations to the DT.
+ *
+ * #include <dt-bindings/clock/rtl83xx-clk.h>
+ *
+ * sram0: sram@9f000000 {
+ *   compatible = "mmio-sram";
+ *   reg = <0x9f000000 0x18000>;
+ *   #address-cells = <1>;
+ *   #size-cells = <1>;
+ *   ranges = <0 0x9f000000 0x18000>;
+ * };
+ *
+ * osc: oscillator {
+ *   compatible = "fixed-clock";
+ *   #clock-cells = <0>;
+ *   clock-frequency = <25000000>;
+ * };
+ *
+ * ccu: clock-controller {
+ *   compatible = "realtek,rtl8380-clock";
+ *   #clock-cells = <1>;
+ *   clocks = <&osc>;
+ *   clock-names = "ref_clk";
+ * };
+ *
+ *
+ * The SRAM part is needed to be able to set clocks. When changing clocks the code must not run
+ * from DRAM. Otherwise system might freeze. Take care to adjust CCU compatibility, SRAM address
+ * and size to the target SOC device. Afterwards one can access/identify the clocks in the other
+ * DT devices with <&ccu CLK_CPU>, <&ccu CLK_MEM> or <&ccu CLK_LXB>. Additionally the clocks can
+ * be used inside the kernel with
+ *
+ * cpu_clk = clk_get(NULL, "cpu_clk");
+ * mem_clk = clk_get(NULL, "mem_clk");
+ * lxb_clk = clk_get(NULL, "lxb_clk");
+ *
+ * This driver can be directly used by the DT based cpufreq driver (CONFIG_CPUFREQ_DT) if CPU
+ * references the right clock and sane operating points (OPP) are provided. E.g.
+ *
+ * cpu@0 {
+ *   compatible = "mips,mips4KEc";
+ *   reg = <0>;
+ *   clocks = <&ccu CLK_CPU>;
+ *   operating-points-v2 = <&cpu_opp_table>;
+ * };
+ *
+ * cpu_opp_table: opp-table-0 {
+ *   compatible = "operating-points-v2";
+ *   opp-shared;
+ *   opp00 {
+ *     opp-hz = /bits/ 64 <425000000>;
+ *   };
+ *   ...
+ * }
+ */
+
+#include <asm/cacheflush.h>
+#include <asm/mipsmtregs.h>
+#include <dt-bindings/clock/rtl83xx-clk.h>
+#include <linux/clk.h>
+#include <linux/clk-provider.h>
+#include <linux/clkdev.h>
+#include <linux/cpu.h>
+#include <linux/delay.h>
+#include <linux/genalloc.h>
+#include <linux/io.h>
+#include <linux/ioport.h>
+#include <linux/of_address.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+
+#include "clk-rtl83xx.h"
+
+#define read_sw(reg)		ioread32(((void *)RTL_SW_CORE_BASE) + reg)
+#define read_soc(reg)		ioread32(((void *)RTL_SOC_BASE) + reg)
+
+#define write_sw(val, reg)	iowrite32(val, ((void *)RTL_SW_CORE_BASE) + reg)
+#define write_soc(val, reg)	iowrite32(val, ((void *)RTL_SOC_BASE) + reg)
+
+/*
+ * some hardware specific definitions
+ */
+
+#define SOC_RTL838X		0
+#define SOC_RTL839X		1
+#define SOC_COUNT		2
+
+#define MEM_DDR1		1
+#define MEM_DDR2		2
+#define MEM_DDR3		3
+
+#define REG_CTRL0		0
+#define REG_CTRL1		1
+#define REG_COUNT		2
+
+#define OSC_RATE		25000000
+
+static const int rtcl_regs[SOC_COUNT][REG_COUNT][CLK_COUNT] = {
+	{
+		{ RTL838X_PLL_CPU_CTRL0, RTL838X_PLL_MEM_CTRL0, RTL838X_PLL_LXB_CTRL0 },
+		{ RTL838X_PLL_CPU_CTRL1, RTL838X_PLL_MEM_CTRL1, RTL838X_PLL_LXB_CTRL1 },
+	}, {
+		{ RTL839X_PLL_CPU_CTRL0, RTL839X_PLL_MEM_CTRL0, RTL839X_PLL_LXB_CTRL0 },
+		{ RTL839X_PLL_CPU_CTRL1, RTL839X_PLL_MEM_CTRL1, RTL839X_PLL_LXB_CTRL1 },
+	}
+};
+
+#define RTCL_REG_SET(_rate, _ctrl0, _ctrl1)	\
+	{					\
+		.rate = _rate,			\
+		.ctrl0 = _ctrl0,		\
+		.ctrl1 = _ctrl1,		\
+	}
+
+struct rtcl_reg_set {
+	unsigned int rate;
+	unsigned int ctrl0;
+	unsigned int ctrl1;
+};
+
+/*
+ * The following configuration tables are valid operation points for their
+ * corresponding PLLs. The magic numbers are precalculated mulitpliers and
+ * dividers to keep the driver simple. They also provide rates outside the
+ * allowed physical specifications. E.g. DDR3 memory has a lower limit of 303
+ * MHz or the CPU might get unstable if set to anything above its startup
+ * frequency. Additionally the Realtek SOCs tend to expect CPU speed larger
+ * than MEM speed larger than LXB speed. The caller or DT configuration must
+ * take care that only valid operating points are selected.
+ */
+
+static const struct rtcl_reg_set rtcl_838x_cpu_reg_set[] = {
+	RTCL_REG_SET(300000000, 0x045c8, 0x1414530e),
+	RTCL_REG_SET(325000000, 0x04648, 0x1414530e),
+	RTCL_REG_SET(350000000, 0x046c8, 0x1414530e),
+	RTCL_REG_SET(375000000, 0x04748, 0x1414530e),
+	RTCL_REG_SET(400000000, 0x045c8, 0x0c14530e),
+	RTCL_REG_SET(425000000, 0x04628, 0x0c14530e),
+	RTCL_REG_SET(450000000, 0x04688, 0x0c14530e),
+	RTCL_REG_SET(475000000, 0x046e8, 0x0c14530e),
+	RTCL_REG_SET(500000000, 0x04748, 0x0c14530e),
+	RTCL_REG_SET(525000000, 0x047a8, 0x0c14530e),
+	RTCL_REG_SET(550000000, 0x04808, 0x0c14530e),
+	RTCL_REG_SET(575000000, 0x04868, 0x0c14530e),
+	RTCL_REG_SET(600000000, 0x048c8, 0x0c14530e),
+	RTCL_REG_SET(625000000, 0x04928, 0x0c14530e)
+};
+
+static const struct rtcl_reg_set rtcl_838x_mem_reg_set[] = {
+	RTCL_REG_SET(200000000, 0x041bc, 0x14018C80),
+	RTCL_REG_SET(225000000, 0x0417c, 0x0c018C80),
+	RTCL_REG_SET(250000000, 0x041ac, 0x0c018C80),
+	RTCL_REG_SET(275000000, 0x0412c, 0x04018C80),
+	RTCL_REG_SET(300000000, 0x0414c, 0x04018c80),
+	RTCL_REG_SET(325000000, 0x0416c, 0x04018c80),
+	RTCL_REG_SET(350000000, 0x0418c, 0x04018c80),
+	RTCL_REG_SET(375000000, 0x041ac, 0x04018c80)
+};
+
+static const struct rtcl_reg_set rtcl_838x_lxb_reg_set[] = {
+	RTCL_REG_SET(100000000, 0x043c8, 0x001ad30e),
+	RTCL_REG_SET(125000000, 0x043c8, 0x001ad30e),
+	RTCL_REG_SET(150000000, 0x04508, 0x1c1ad30e),
+	RTCL_REG_SET(175000000, 0x04508, 0x1c1ad30e),
+	RTCL_REG_SET(200000000, 0x047c8, 0x001ad30e)
+};
+
+static const struct rtcl_reg_set rtcl_839x_cpu_reg_set[] = {
+	RTCL_REG_SET(400000000, 0x0414c, 0x00000005),
+	RTCL_REG_SET(425000000, 0x041ec, 0x00000006),
+	RTCL_REG_SET(450000000, 0x0417c, 0x00000005),
+	RTCL_REG_SET(475000000, 0x0422c, 0x00000006),
+	RTCL_REG_SET(500000000, 0x041ac, 0x00000005),
+	RTCL_REG_SET(525000000, 0x0426c, 0x00000006),
+	RTCL_REG_SET(550000000, 0x0412c, 0x00000004),
+	RTCL_REG_SET(575000000, 0x042ac, 0x00000006),
+	RTCL_REG_SET(600000000, 0x0414c, 0x00000004),
+	RTCL_REG_SET(625000000, 0x042ec, 0x00000006),
+	RTCL_REG_SET(650000000, 0x0416c, 0x00000004),
+	RTCL_REG_SET(675000000, 0x04324, 0x00000006),
+	RTCL_REG_SET(700000000, 0x0418c, 0x00000004),
+	RTCL_REG_SET(725000000, 0x0436c, 0x00000006),
+	RTCL_REG_SET(750000000, 0x0438c, 0x00000006),
+	RTCL_REG_SET(775000000, 0x043ac, 0x00000006),
+	RTCL_REG_SET(800000000, 0x043cc, 0x00000006),
+	RTCL_REG_SET(825000000, 0x043ec, 0x00000006),
+	RTCL_REG_SET(850000000, 0x0440c, 0x00000006)
+};
+
+static const struct rtcl_reg_set rtcl_839x_mem_reg_set[] = {
+	RTCL_REG_SET(100000000, 0x041cc, 0x00000000),
+	RTCL_REG_SET(125000000, 0x041ac, 0x00000007),
+	RTCL_REG_SET(150000000, 0x0414c, 0x00000006),
+	RTCL_REG_SET(175000000, 0x0418c, 0x00000006),
+	RTCL_REG_SET(200000000, 0x041cc, 0x00000006),
+	RTCL_REG_SET(225000000, 0x0417c, 0x00000005),
+	RTCL_REG_SET(250000000, 0x041ac, 0x00000005),
+	RTCL_REG_SET(275000000, 0x0412c, 0x00000004),
+	RTCL_REG_SET(300000000, 0x0414c, 0x00000004),
+	RTCL_REG_SET(325000000, 0x0416c, 0x00000004),
+	RTCL_REG_SET(350000000, 0x0418c, 0x00000004),
+	RTCL_REG_SET(375000000, 0x041ac, 0x00000004),
+	RTCL_REG_SET(400000000, 0x041cc, 0x00000004)
+};
+
+static const struct rtcl_reg_set rtcl_839x_lxb_reg_set[] = {
+	RTCL_REG_SET(50000000, 0x1414c, 0x00000003),
+	RTCL_REG_SET(100000000, 0x0814c, 0x00000003),
+	RTCL_REG_SET(150000000, 0x0414c, 0x00000003),
+	RTCL_REG_SET(200000000, 0x0414c, 0x00000007)
+};
+
+struct rtcl_rtab_set {
+	int count;
+	const struct rtcl_reg_set *rset;
+};
+
+#define RTCL_RTAB_SET(_rset)			\
+	{					\
+		.count = ARRAY_SIZE(_rset),	\
+		.rset = _rset,			\
+	}
+
+static const struct rtcl_rtab_set rtcl_rtab_set[SOC_COUNT][CLK_COUNT] = {
+	{
+		RTCL_RTAB_SET(rtcl_838x_cpu_reg_set),
+		RTCL_RTAB_SET(rtcl_838x_mem_reg_set),
+		RTCL_RTAB_SET(rtcl_838x_lxb_reg_set)
+	}, {
+		RTCL_RTAB_SET(rtcl_839x_cpu_reg_set),
+		RTCL_RTAB_SET(rtcl_839x_mem_reg_set),
+		RTCL_RTAB_SET(rtcl_839x_lxb_reg_set)
+	}
+};
+
+#define RTCL_ROUND_SET(_min, _max, _step)	\
+	{					\
+		.min = _min,			\
+		.max = _max,			\
+		.step = _step,			\
+	}
+
+struct rtcl_round_set {
+	unsigned long min;
+	unsigned long max;
+	unsigned long step;
+};
+
+static const struct rtcl_round_set rtcl_round_set[SOC_COUNT][CLK_COUNT] = {
+	{
+		RTCL_ROUND_SET(300000000, 625000000, 25000000),
+		RTCL_ROUND_SET(200000000, 375000000, 25000000),
+		RTCL_ROUND_SET(100000000, 200000000, 25000000)
+	}, {
+		RTCL_ROUND_SET(400000000, 850000000, 25000000),
+		RTCL_ROUND_SET(100000000, 400000000, 25000000),
+		RTCL_ROUND_SET(50000000, 200000000, 50000000)
+	}
+};
+
+static const int rtcl_divn3[] = { 2, 3, 4, 6 };
+static const int rtcl_xdiv[] = { 2, 4, 2 };
+
+/*
+ * module data structures
+ */
+
+#define RTCL_CLK_INFO(_idx, _name, _pname, _dname)	\
+	{						\
+		.idx = _idx,				\
+		.name = _name,				\
+		.parent_name = _pname,			\
+		.display_name = _dname,			\
+	}
+
+struct rtcl_clk_info {
+	unsigned int idx;
+	const char *name;
+	const char *parent_name;
+	const char *display_name;
+};
+
+struct rtcl_clk {
+	struct clk_hw hw;
+	unsigned int idx;
+	unsigned long min;
+	unsigned long max;
+	unsigned long rate;
+	unsigned long startup;
+};
+
+static const struct rtcl_clk_info rtcl_clk_info[CLK_COUNT] = {
+	RTCL_CLK_INFO(CLK_CPU, "cpu_clk", "ref_clk", "CPU"),
+	RTCL_CLK_INFO(CLK_MEM, "mem_clk", "ref_clk", "MEM"),
+	RTCL_CLK_INFO(CLK_LXB, "lxb_clk", "ref_clk", "LXB")
+};
+
+struct rtcl_dram {
+	int type;
+	int buswidth;
+};
+
+struct rtcl_sram {
+	int *pmark;
+	unsigned long vbase;
+};
+
+struct rtcl_ccu {
+	spinlock_t lock;
+	unsigned int soc;
+	struct rtcl_sram sram;
+	struct rtcl_dram dram;
+	struct device_node *np;
+	struct platform_device *pdev;
+	struct rtcl_clk clks[CLK_COUNT];
+};
+
+struct rtcl_ccu *rtcl_ccu;
+
+#define rtcl_hw_to_clk(_hw) container_of(_hw, struct rtcl_clk, hw)
+
+/*
+ * SRAM relocatable assembler functions. The dram() parts point to normal kernel
+ * memory while the sram() parts are the same functions but relocated to SRAM.
+ */
+
+extern void	rtcl_838x_dram_start(void);
+extern int	rtcl_838x_dram_size;
+
+extern void	(*rtcl_838x_dram_set_rate)(int clk_idx, int ctrl0, int ctrl1);
+static void	(*rtcl_838x_sram_set_rate)(int clk_idx, int ctrl0, int ctrl1);
+
+extern void	rtcl_839x_dram_start(void);
+extern int	rtcl_839x_dram_size;
+
+extern void	(*rtcl_839x_dram_set_rate)(int clk_idx, int ctrl0, int ctrl1);
+static void	(*rtcl_839x_sram_set_rate)(int clk_idx, int ctrl0, int ctrl1);
+
+/*
+ * clock setter/getter functions
+ */
+
+static unsigned long rtcl_recalc_rate(struct clk_hw *hw, unsigned long parent_rate)
+{
+	struct rtcl_clk *clk = rtcl_hw_to_clk(hw);
+	unsigned int ctrl0, ctrl1, div1, div2, cmu_ncode_in;
+	unsigned int cmu_sel_prediv, cmu_sel_div4, cmu_divn2, cmu_divn2_selb, cmu_divn3_sel;
+
+	if ((clk->idx >= CLK_COUNT) || (!rtcl_ccu) || (rtcl_ccu->soc >= SOC_COUNT))
+		return 0;
+
+	ctrl0 = read_sw(rtcl_regs[rtcl_ccu->soc][REG_CTRL0][clk->idx]);
+	ctrl1 = read_sw(rtcl_regs[rtcl_ccu->soc][REG_CTRL1][clk->idx]);
+
+	cmu_sel_prediv = 1 << RTL_PLL_CTRL0_CMU_SEL_PREDIV(ctrl0);
+	cmu_sel_div4 = RTL_PLL_CTRL0_CMU_SEL_DIV4(ctrl0) ? 4 : 1;
+	cmu_ncode_in = RTL_PLL_CTRL0_CMU_NCODE_IN(ctrl0) + 4;
+	cmu_divn2 = RTL_PLL_CTRL0_CMU_DIVN2(ctrl0) + 4;
+
+	switch (rtcl_ccu->soc) {
+	case SOC_RTL838X:
+		if ((ctrl0 == 0) && (ctrl1 == 0) && (clk->idx == CLK_LXB))
+			return 200000000;
+
+		cmu_divn2_selb = RTL838X_PLL_CTRL1_CMU_DIVN2_SELB(ctrl1);
+		cmu_divn3_sel = rtcl_divn3[RTL838X_PLL_CTRL1_CMU_DIVN3_SEL(ctrl1)];
+		break;
+	case SOC_RTL839X:
+		cmu_divn2_selb = RTL839X_PLL_CTRL1_CMU_DIVN2_SELB(ctrl1);
+		cmu_divn3_sel = rtcl_divn3[RTL839X_PLL_CTRL1_CMU_DIVN3_SEL(ctrl1)];
+		break;
+	}
+	div1 = cmu_divn2_selb ? cmu_divn3_sel : cmu_divn2;
+	div2 = rtcl_xdiv[clk->idx];
+
+	return (((parent_rate / 16) * cmu_ncode_in) / (div1 * div2)) *
+		cmu_sel_prediv * cmu_sel_div4 * 16;
+}
+
+static int rtcl_838x_set_rate(int clk_idx, const struct rtcl_reg_set *reg)
+{
+	unsigned long irqflags;
+/*
+ * Runtime of this function (including locking)
+ * CPU: up to 14000 cycles / up to 56 us at 250 MHz (half default speed)
+ */
+	spin_lock_irqsave(&rtcl_ccu->lock, irqflags);
+	rtcl_838x_sram_set_rate(clk_idx, reg->ctrl0, reg->ctrl1);
+	spin_unlock_irqrestore(&rtcl_ccu->lock, irqflags);
+
+	return 0;
+}
+
+static int rtcl_839x_set_rate(int clk_idx, const struct rtcl_reg_set *reg)
+{
+	unsigned long vpflags;
+	unsigned long irqflags;
+/*
+ * Runtime of this function (including locking)
+ * CPU: up to 31000 cycles / up to 89 us at 350 MHz (half default speed)
+ */
+	spin_lock_irqsave(&rtcl_ccu->lock, irqflags);
+	vpflags = dvpe();
+	rtcl_839x_sram_set_rate(clk_idx, reg->ctrl0, reg->ctrl1);
+	evpe(vpflags);
+	spin_unlock_irqrestore(&rtcl_ccu->lock, irqflags);
+
+	return 0;
+}
+
+static int rtcl_set_rate(struct clk_hw *hw, unsigned long rate, unsigned long parent_rate)
+{
+	int tab_idx;
+	struct rtcl_clk *clk = rtcl_hw_to_clk(hw);
+	const struct rtcl_rtab_set *rtab = &rtcl_rtab_set[rtcl_ccu->soc][clk->idx];
+	const struct rtcl_round_set *round = &rtcl_round_set[rtcl_ccu->soc][clk->idx];
+
+	if ((parent_rate != OSC_RATE) || (!rtcl_ccu->sram.vbase))
+		return -EINVAL;
+/*
+ * Currently we do not know if SRAM is stable on these devices. Maybe someone
+ * changes memory in this region and does not care about proper allocation. So
+ * check if something might go wrong.
+ */
+	if (unlikely(*rtcl_ccu->sram.pmark != RTL_SRAM_MARKER)) {
+		dev_err(&rtcl_ccu->pdev->dev, "SRAM code lost\n");
+		return -EINVAL;
+	}
+
+	tab_idx = (rate - round->min) / round->step;
+	if ((tab_idx < 0) || (tab_idx >= rtab->count) || (rtab->rset[tab_idx].rate != rate))
+		return -EINVAL;
+
+	rtcl_ccu->clks[clk->idx].rate = rate;
+
+	switch (rtcl_ccu->soc) {
+	case SOC_RTL838X:
+		return rtcl_838x_set_rate(clk->idx, &rtab->rset[tab_idx]);
+	case SOC_RTL839X:
+		return rtcl_839x_set_rate(clk->idx, &rtab->rset[tab_idx]);
+	}
+
+	return -ENXIO;
+}
+
+static long rtcl_round_rate(struct clk_hw *hw, unsigned long rate, unsigned long *parent_rate)
+{
+	struct rtcl_clk *clk = rtcl_hw_to_clk(hw);
+	unsigned long rrate = max(clk->min, min(clk->max, rate));
+	const struct rtcl_round_set *round = &rtcl_round_set[rtcl_ccu->soc][clk->idx];
+
+	rrate = ((rrate + (round->step >> 1)) / round->step) * round->step;
+	rrate -= (rrate > clk->max) ? round->step : 0;
+	rrate += (rrate < clk->min) ? round->step : 0;
+
+	return rrate;
+}
+
+/*
+ * Initialization functions to register the CCU and its clocks
+ */
+
+#define RTCL_SRAM_FUNC(SOC, PBASE, FN) ({				\
+        rtcl_##SOC##_sram_##FN = ((void *)&rtcl_##SOC##_dram_##FN -	\
+                                  (void *)&rtcl_##SOC##_dram_start) +	\
+                                  (void *)PBASE; })
+
+static const struct clk_ops rtcl_clk_ops = {
+	.set_rate = rtcl_set_rate,
+	.round_rate = rtcl_round_rate,
+	.recalc_rate = rtcl_recalc_rate,
+};
+
+static int rtcl_ccu_create(struct device_node *np)
+{
+	int soc;
+
+	if (of_device_is_compatible(np, "realtek,rtl8380-clock"))
+		soc = SOC_RTL838X;
+	else if (of_device_is_compatible(np, "realtek,rtl8390-clock"))
+		soc = SOC_RTL839X;
+	else
+		return -ENXIO;
+
+	rtcl_ccu = kzalloc(sizeof(*rtcl_ccu), GFP_KERNEL);
+	if (IS_ERR(rtcl_ccu))
+		return -ENOMEM;
+
+	rtcl_ccu->np = np;
+	rtcl_ccu->soc = soc;
+	rtcl_ccu->dram.type = RTL_MC_MCR_DRAMTYPE(read_soc(RTL_MC_MCR));
+	rtcl_ccu->dram.buswidth = RTL_MC_DCR_BUSWIDTH(read_soc(RTL_MC_DCR));
+	spin_lock_init(&rtcl_ccu->lock);
+
+	return 0;
+}
+
+int rtcl_register_clkhw(int clk_idx)
+{
+	int ret;
+	struct clk *clk;
+	struct clk_init_data hw_init = { };
+	struct rtcl_clk *rclk = &rtcl_ccu->clks[clk_idx];
+	struct clk_parent_data parent_data = { .fw_name = rtcl_clk_info[clk_idx].parent_name };
+
+	rclk->idx = clk_idx;
+	rclk->hw.init = &hw_init;
+
+	hw_init.num_parents = 1;
+	hw_init.ops = &rtcl_clk_ops;
+	hw_init.parent_data = &parent_data;
+	hw_init.name = rtcl_clk_info[clk_idx].name;
+
+	ret = of_clk_hw_register(rtcl_ccu->np, &rclk->hw);
+	if (ret)
+		return ret;
+
+	clk_hw_register_clkdev(&rclk->hw, rtcl_clk_info[clk_idx].name, NULL);
+
+	clk = clk_get(NULL, rtcl_clk_info[clk_idx].name);
+	rclk->startup = clk_get_rate(clk);
+	clk_put(clk);
+
+	switch (clk_idx) {
+	case CLK_CPU:
+		rclk->min = rtcl_round_set[rtcl_ccu->soc][clk_idx].min;
+		rclk->max = rtcl_round_set[rtcl_ccu->soc][clk_idx].max;
+		break;
+	default:
+/*
+ * TODO: This driver supports PLL reclocking and nothing else. Additional
+ * required steps for non CPU PLLs are missing. E.g. if we want to change memory
+ * clocks the right way we must adapt a lot of other settings. This includes
+ * MCR and DTRx timing registers (0xb80001000, 0xb8001008, ...) and a DLL reset
+ * so that hardware operates in the allowed limits. This is far too complex
+ * without official support. Avoid this for now.
+ */
+		rclk->min = rclk->max = rclk->startup;
+		break;
+	}
+
+	return 0;
+}
+
+static struct clk_hw *rtcl_get_clkhw(struct of_phandle_args *clkspec, void *prv)
+{
+	unsigned int idx = clkspec->args[0];
+
+	if (idx >= CLK_COUNT) {
+		pr_err("%s: Invalid index %u\n", __func__, idx);
+		return ERR_PTR(-EINVAL);
+	}
+
+	return &rtcl_ccu->clks[idx].hw;
+}
+
+static int rtcl_ccu_register_clocks(void)
+{
+	int clk_idx, ret;
+
+	for (clk_idx = 0; clk_idx < CLK_COUNT; clk_idx++) {
+		ret = rtcl_register_clkhw(clk_idx);
+		if (ret) {
+			pr_err("%s: Couldn't register %s clock\n",
+				__func__, rtcl_clk_info[clk_idx].display_name);
+			goto err_hw_unregister;
+		}
+	}
+
+	ret = of_clk_add_hw_provider(rtcl_ccu->np, rtcl_get_clkhw, rtcl_ccu);
+	if (ret) {
+		pr_err("%s: Couldn't register clock provider of %s\n",
+			__func__, of_node_full_name(rtcl_ccu->np));
+		goto err_hw_unregister;
+	}
+
+	return 0;
+
+err_hw_unregister:
+	for (--clk_idx; clk_idx >= 0; --clk_idx)
+		clk_hw_unregister(&rtcl_ccu->clks[clk_idx].hw);
+
+	return ret;
+}
+
+int rtcl_init_sram(void)
+{
+	struct gen_pool *sram_pool;
+	phys_addr_t sram_pbase;
+	unsigned long sram_vbase;
+	struct device_node *node;
+	struct platform_device *pdev = NULL;
+	void *dram_start;
+	int dram_size;
+	const char *wrn = ", rate setting disabled.\n";
+
+	switch (rtcl_ccu->soc) {
+	case SOC_RTL838X:
+		dram_start = &rtcl_838x_dram_start;
+		dram_size = rtcl_838x_dram_size;
+		break;
+	case SOC_RTL839X:
+		dram_start = &rtcl_839x_dram_start;
+		dram_size = rtcl_839x_dram_size;
+		break;
+	default:
+		return -ENXIO;
+	}
+
+	for_each_compatible_node(node, NULL, "mmio-sram") {
+		pdev = of_find_device_by_node(node);
+		if (pdev) {
+			of_node_put(node);
+			break;
+		}
+	}
+
+	if (!pdev) {
+		dev_warn(&rtcl_ccu->pdev->dev, "no SRAM device found%s", wrn);
+		return -ENXIO;
+	}
+
+	sram_pool = gen_pool_get(&pdev->dev, NULL);
+	if (!sram_pool) {
+		dev_warn(&rtcl_ccu->pdev->dev, "SRAM pool unavailable%s", wrn);
+		goto err_put_device;
+	}
+
+	sram_vbase = gen_pool_alloc(sram_pool, dram_size);
+	if (!sram_vbase) {
+		dev_warn(&rtcl_ccu->pdev->dev, "can not allocate SRAM%s", wrn);
+		goto err_put_device;
+	}
+
+	sram_pbase = gen_pool_virt_to_phys(sram_pool, sram_vbase);
+	memcpy((void *)sram_pbase, dram_start, dram_size);
+	flush_icache_range((unsigned long)sram_pbase, (unsigned long)(sram_pbase + dram_size));
+
+	switch (rtcl_ccu->soc) {
+	case SOC_RTL838X:
+		RTCL_SRAM_FUNC(838x, sram_pbase, set_rate);
+		break;
+	case SOC_RTL839X:
+		RTCL_SRAM_FUNC(839x, sram_pbase, set_rate);
+		break;
+	}
+
+	rtcl_ccu->sram.pmark = (int *)((void *)sram_pbase + (dram_size - 4));
+	rtcl_ccu->sram.vbase = sram_vbase;
+
+	return 0;
+
+err_put_device:
+	put_device(&pdev->dev);
+
+	return -ENXIO;
+}
+
+void rtcl_ccu_log_early(void)
+{
+	char meminfo[80], clkinfo[255], msg[255] = "rtl83xx-clk: initialized";
+
+	sprintf(meminfo, " (%d Bit DDR%d)", rtcl_ccu->dram.buswidth, rtcl_ccu->dram.type);
+	for (int clk_idx = 0; clk_idx < CLK_COUNT; clk_idx++) {
+		sprintf(clkinfo, ", %s %lu MHz", rtcl_clk_info[clk_idx].display_name,
+			rtcl_ccu->clks[clk_idx].startup / 1000000);
+		if (clk_idx == CLK_MEM)
+			strcat(clkinfo, meminfo);
+		strcat(msg, clkinfo);
+	}
+	pr_info("%s\n", msg);
+}
+
+void rtcl_ccu_log_late(void)
+{
+	struct rtcl_clk *rclk;
+	bool overclock = false;
+	char clkinfo[80], msg[255] = "rate setting enabled";
+
+	for (int clk_idx = 0; clk_idx < CLK_COUNT; clk_idx++) {
+		rclk = &rtcl_ccu->clks[clk_idx];
+		overclock |= rclk->max > rclk->startup;
+		sprintf(clkinfo, ", %s %lu-%lu MHz", rtcl_clk_info[clk_idx].display_name,
+			rclk->min / 1000000, rclk->max / 1000000);
+		strcat(msg, clkinfo);
+	}
+	if (overclock)
+		strcat(msg, ", OVERCLOCK AT OWN RISK");
+
+	dev_info(&rtcl_ccu->pdev->dev, "%s\n", msg);
+}
+
+/*
+ * Early registration: This module provides core startup clocks that are needed
+ * for generic SOC init and for further builtin devices (e.g. UART). Register
+ * asap via clock framework.
+ */
+
+static void __init rtcl_probe_early(struct device_node *np)
+{
+	if (rtcl_ccu_create(np))
+		return;
+
+	if (rtcl_ccu_register_clocks())
+		kfree(rtcl_ccu);
+	else
+		rtcl_ccu_log_early();
+}
+
+CLK_OF_DECLARE_DRIVER(rtl838x_clk, "realtek,rtl8380-clock", rtcl_probe_early);
+CLK_OF_DECLARE_DRIVER(rtl839x_clk, "realtek,rtl8390-clock", rtcl_probe_early);
+
+/*
+ * Late registration: Finally register as normal platform driver. At this point
+ * we can make use of other modules like SRAM.
+ */
+
+static const struct of_device_id rtcl_dt_ids[] = {
+	{ .compatible = "realtek,rtl8380-clock" },
+	{ .compatible = "realtek,rtl8390-clock" },
+	{}
+};
+
+static int rtcl_probe_late(struct platform_device *pdev)
+{
+	int ret;
+
+	if (!rtcl_ccu) {
+		dev_err(&pdev->dev, "early initialization not run");
+		return -ENXIO;
+	}
+	rtcl_ccu->pdev = pdev;
+	ret = rtcl_init_sram();
+	if (ret)
+		return ret;
+
+	rtcl_ccu_log_late();
+
+	return 0;
+}
+
+static struct platform_driver rtcl_platform_driver = {
+	.driver = {
+		.name = "rtl83xx-clk",
+		.of_match_table = rtcl_dt_ids,
+	},
+	.probe = rtcl_probe_late,
+};
+
+static int __init rtcl_init_subsys(void)
+{
+	return platform_driver_register(&rtcl_platform_driver);
+}
+
+/*
+ * The driver does not know when SRAM module has finally loaded. With an
+ * arch_initcall() we might overtake SRAM initialization. Be polite and give the
+ * system a little more time.
+ */
+
+subsys_initcall(rtcl_init_subsys);
diff --git a/target/linux/realtek/files-5.15/drivers/clk/realtek/clk-rtl83xx.h b/target/linux/realtek/files-5.15/drivers/clk/realtek/clk-rtl83xx.h
new file mode 100644
index 00000000000000..a69b16b475eb0d
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/clk/realtek/clk-rtl83xx.h
@@ -0,0 +1,75 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Realtek RTL83XX clock headers
+ * Copyright (C) 2022 Markus Stockhausen <markus.stockhausen@gmx.de>
+ */
+
+/*
+ * Switch registers (e.g. PLL)
+ */
+
+#define RTL_SW_CORE_BASE			(0xbb000000)
+
+#define RTL838X_PLL_GLB_CTRL			(0x0fc0)
+#define RTL838X_PLL_CPU_CTRL0			(0x0fc4)
+#define RTL838X_PLL_CPU_CTRL1			(0x0fc8)
+#define RTL838X_PLL_LXB_CTRL0			(0x0fd0)
+#define RTL838X_PLL_LXB_CTRL1			(0x0fd4)
+#define RTL838X_PLL_MEM_CTRL0			(0x0fdc)
+#define RTL838X_PLL_MEM_CTRL1			(0x0fe0)
+
+#define RTL839X_PLL_GLB_CTRL			(0x0024)
+#define RTL839X_PLL_CPU_CTRL0			(0x0028)
+#define RTL839X_PLL_CPU_CTRL1			(0x002c)
+#define RTL839X_PLL_LXB_CTRL0			(0x0038)
+#define RTL839X_PLL_LXB_CTRL1			(0x003c)
+#define RTL839X_PLL_MEM_CTRL0			(0x0048)
+#define RTL839X_PLL_MEM_CTRL1			(0x004c)
+
+#define RTL_PLL_CTRL0_CMU_SEL_PREDIV(v)		(((v) >> 0) & 0x3)
+#define RTL_PLL_CTRL0_CMU_SEL_DIV4(v)		(((v) >> 2) & 0x1)
+#define RTL_PLL_CTRL0_CMU_NCODE_IN(v)		(((v) >> 4) & 0xff)
+#define RTL_PLL_CTRL0_CMU_DIVN2(v)		(((v) >> 12) & 0xff)
+
+#define RTL838X_GLB_CTRL_EN_CPU_PLL_MASK	(1 << 0)
+#define RTL838X_GLB_CTRL_EN_LXB_PLL_MASK	(1 << 1)
+#define RTL838X_GLB_CTRL_EN_MEM_PLL_MASK	(1 << 2)
+#define RTL838X_GLB_CTRL_CPU_PLL_READY_MASK	(1 << 8)
+#define RTL838X_GLB_CTRL_LXB_PLL_READY_MASK	(1 << 9)
+#define RTL838X_GLB_CTRL_MEM_PLL_READY_MASK	(1 << 10)
+#define RTL838X_GLB_CTRL_CPU_PLL_SC_MUX_MASK	(1 << 12)
+
+#define RTL838X_PLL_CTRL1_CMU_DIVN2_SELB(v)	(((v) >> 26) & 0x1)
+#define RTL838X_PLL_CTRL1_CMU_DIVN3_SEL(v)	(((v) >> 27) & 0x3)
+
+#define RTL839X_GLB_CTRL_CPU_CLKSEL_MASK	(1 << 11)
+#define RTL839X_GLB_CTRL_MEM_CLKSEL_MASK	(1 << 12)
+#define RTL839X_GLB_CTRL_LXB_CLKSEL_MASK	(1 << 13)
+
+#define RTL839X_PLL_CTRL1_CMU_DIVN2_SELB(v)	(((v) >> 2) & 0x1)
+#define RTL839X_PLL_CTRL1_CMU_DIVN3_SEL(v)	(((v) >> 0) & 0x3)
+
+/*
+ * Core registers (e.g. memory controller)
+ */
+
+#define RTL_SOC_BASE				(0xB8000000)
+
+#define RTL_MC_MCR				(0x1000)
+#define RTL_MC_DCR				(0x1004)
+#define RTL_MC_DTR0				(0x1008)
+#define RTL_MC_DTR1				(0x100c)
+#define RTL_MC_DTR2				(0x1010)
+#define RTL_MC_DMCR				(0x101c)
+#define RTL_MC_DACCR				(0x1500)
+#define RTL_MC_DCDR				(0x1060)
+
+#define RTL_MC_MCR_DRAMTYPE(v)			((((v) >> 28) & 0xf) + 1)
+#define RTL_MC_DCR_BUSWIDTH(v)			(8 << (((v) >> 24) & 0xf))
+
+/*
+ * Other stuff
+ */
+
+#define RTL_SRAM_MARKER				(0x5eaf00d5)
+#define RTL_SRAM_BASE				(0x9f000000)
diff --git a/target/linux/realtek/files-5.15/drivers/clocksource/timer-rtl-otto.c b/target/linux/realtek/files-5.15/drivers/clocksource/timer-rtl-otto.c
new file mode 100644
index 00000000000000..086f62112aec32
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/clocksource/timer-rtl-otto.c
@@ -0,0 +1,286 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#include <linux/clk.h>
+#include <linux/clockchips.h>
+#include <linux/cpu.h>
+#include <linux/cpuhotplug.h>
+#include <linux/interrupt.h>
+#include <linux/sched_clock.h>
+
+#include "timer-of.h"
+
+#define RTTM_DATA		0x0
+#define RTTM_CNT		0x4
+#define RTTM_CTRL		0x8
+#define RTTM_INT		0xc
+
+#define RTTM_CTRL_ENABLE	BIT(28)
+#define RTTM_INT_PENDING	BIT(16)
+#define RTTM_INT_ENABLE		BIT(20)
+
+/*
+ * The Otto platform provides multiple 28 bit timers/counters with the following
+ * operating logic. If enabled the timer counts up. Per timer one can set a
+ * maximum counter value as an end marker. If end marker is reached the timer
+ * fires an interrupt. If the timer "overflows" by reaching the end marker or
+ * by adding 1 to 0x0fffffff the counter is reset to 0. When this happens and
+ * the timer is in operating mode COUNTER it stops. In mode TIMER it will
+ * continue to count up.
+ */
+#define RTTM_CTRL_COUNTER	0
+#define RTTM_CTRL_TIMER		BIT(24)
+
+#define RTTM_BIT_COUNT		28
+#define RTTM_MIN_DELTA		8
+#define RTTM_MAX_DELTA		CLOCKSOURCE_MASK(28)
+
+/*
+ * Timers are derived from the LXB clock frequency. Usually this is a fixed
+ * multiple of the 25 MHz oscillator. The 930X SOC is an exception from that.
+ * Its LXB clock has only dividers and uses the switch PLL of 2.45 GHz as its
+ * base. The only meaningful frequencies we can achieve from that are 175.000
+ * MHz and 153.125 MHz. The greatest common divisor of all explained possible
+ * speeds is 3125000. Pin the timers to this 3.125 MHz reference frequency.
+ */
+#define RTTM_TICKS_PER_SEC	3125000
+
+struct rttm_cs {
+	struct timer_of		to;
+	struct clocksource	cs;
+};
+
+/* Simple internal register functions */
+static inline void rttm_set_counter(void __iomem *base, unsigned int counter)
+{
+	iowrite32(counter, base + RTTM_CNT);
+}
+
+static inline unsigned int rttm_get_counter(void __iomem *base)
+{
+	return ioread32(base + RTTM_CNT);
+}
+
+static inline void rttm_set_period(void __iomem *base, unsigned int period)
+{
+	iowrite32(period, base + RTTM_DATA);
+}
+
+static inline void rttm_disable_timer(void __iomem *base)
+{
+	iowrite32(0, base + RTTM_CTRL);
+}
+
+static inline void rttm_enable_timer(void __iomem *base, u32 mode, u32 divisor)
+{
+	iowrite32(RTTM_CTRL_ENABLE | mode | divisor, base + RTTM_CTRL);
+}
+
+static inline void rttm_ack_irq(void __iomem *base)
+{
+	iowrite32(ioread32(base + RTTM_INT) | RTTM_INT_PENDING, base + RTTM_INT);
+}
+
+static inline void rttm_enable_irq(void __iomem *base)
+{
+	iowrite32(RTTM_INT_ENABLE, base + RTTM_INT);
+}
+
+static inline void rttm_disable_irq(void __iomem *base)
+{
+	iowrite32(0, base + RTTM_INT);
+}
+
+/* Aggregated control functions for kernel clock framework */
+#define RTTM_DEBUG(base)					\
+	pr_debug("------------- %s %d %08x\n", __func__,	\
+	smp_processor_id(), (u32)base)
+
+static irqreturn_t rttm_timer_interrupt(int irq, void *dev_id)
+{
+	struct clock_event_device *clkevt = dev_id;
+	struct timer_of *to = to_timer_of(clkevt);
+
+	rttm_ack_irq(to->of_base.base);
+	RTTM_DEBUG(to->of_base.base);
+	clkevt->event_handler(clkevt);
+
+	return IRQ_HANDLED;
+}
+
+static void rttm_stop_timer(void __iomem *base)
+{
+	rttm_disable_timer(base);
+	rttm_ack_irq(base);
+}
+
+static void rttm_start_timer(struct timer_of *to, u32 mode)
+{
+	rttm_set_counter(to->of_base.base, 0);
+	rttm_enable_timer(to->of_base.base, mode, to->of_clk.rate / RTTM_TICKS_PER_SEC);
+}
+
+static int rttm_next_event(unsigned long delta, struct clock_event_device *clkevt)
+{
+	struct timer_of *to = to_timer_of(clkevt);
+
+	RTTM_DEBUG(to->of_base.base);
+	rttm_stop_timer(to->of_base.base);
+	rttm_set_period(to->of_base.base, delta);
+	rttm_start_timer(to, RTTM_CTRL_COUNTER);
+
+	return 0;
+}
+
+static int rttm_state_oneshot(struct clock_event_device *clkevt)
+{
+	struct timer_of *to = to_timer_of(clkevt);
+
+	RTTM_DEBUG(to->of_base.base);
+	rttm_stop_timer(to->of_base.base);
+	rttm_set_period(to->of_base.base, RTTM_TICKS_PER_SEC / HZ);
+	rttm_start_timer(to, RTTM_CTRL_COUNTER);
+
+	return 0;
+}
+
+static int rttm_state_periodic(struct clock_event_device *clkevt)
+{
+	struct timer_of *to = to_timer_of(clkevt);
+
+	RTTM_DEBUG(to->of_base.base);
+	rttm_stop_timer(to->of_base.base);
+	rttm_set_period(to->of_base.base, RTTM_TICKS_PER_SEC / HZ);
+	rttm_start_timer(to, RTTM_CTRL_TIMER);
+
+	return 0;
+}
+
+static int rttm_state_shutdown(struct clock_event_device *clkevt)
+{
+	struct timer_of *to = to_timer_of(clkevt);
+
+	RTTM_DEBUG(to->of_base.base);
+	rttm_stop_timer(to->of_base.base);
+
+	return 0;
+}
+
+static void rttm_setup_timer(void __iomem *base)
+{
+	RTTM_DEBUG(base);
+	rttm_stop_timer(base);
+	rttm_set_period(base, 0);
+}
+
+static u64 rttm_read_clocksource(struct clocksource *cs)
+{
+	struct rttm_cs *rcs = container_of(cs, struct rttm_cs, cs);
+
+	return (u64)rttm_get_counter(rcs->to.of_base.base);
+}
+
+/* Module initialization part. */
+static DEFINE_PER_CPU(struct timer_of, rttm_to) = {
+	.flags				= TIMER_OF_BASE | TIMER_OF_CLOCK | TIMER_OF_IRQ,
+	.of_irq = {
+		.flags			= IRQF_PERCPU | IRQF_TIMER,
+		.handler		= rttm_timer_interrupt,
+	},
+	.clkevt = {
+		.rating			= 400,
+		.features		= CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT,
+		.set_state_periodic	= rttm_state_periodic,
+		.set_state_shutdown	= rttm_state_shutdown,
+		.set_state_oneshot	= rttm_state_oneshot,
+		.set_next_event		= rttm_next_event
+	},
+};
+
+static int rttm_enable_clocksource(struct clocksource *cs)
+{
+	struct rttm_cs *rcs = container_of(cs, struct rttm_cs, cs);
+
+	rttm_disable_irq(rcs->to.of_base.base);
+	rttm_setup_timer(rcs->to.of_base.base);
+	rttm_enable_timer(rcs->to.of_base.base, RTTM_CTRL_TIMER,
+			  rcs->to.of_clk.rate / RTTM_TICKS_PER_SEC);
+
+	return 0;
+}
+
+struct rttm_cs rttm_cs = {
+	.to = {
+		.flags	= TIMER_OF_BASE | TIMER_OF_CLOCK,
+	},
+	.cs = {
+		.name	= "realtek_otto_timer",
+		.rating	= 400,
+		.mask	= CLOCKSOURCE_MASK(RTTM_BIT_COUNT),
+		.flags	= CLOCK_SOURCE_IS_CONTINUOUS,
+		.read	= rttm_read_clocksource,
+	}
+};
+
+static u64 notrace rttm_read_clock(void)
+{
+	return (u64)rttm_get_counter(rttm_cs.to.of_base.base);
+}
+
+static int rttm_cpu_starting(unsigned int cpu)
+{
+	struct timer_of *to = per_cpu_ptr(&rttm_to, cpu);
+
+	RTTM_DEBUG(to->of_base.base);
+	to->clkevt.cpumask = cpumask_of(cpu);
+	irq_force_affinity(to->of_irq.irq, to->clkevt.cpumask);
+	clockevents_config_and_register(&to->clkevt, RTTM_TICKS_PER_SEC,
+					RTTM_MIN_DELTA, RTTM_MAX_DELTA);
+	rttm_enable_irq(to->of_base.base);
+
+	return 0;
+}
+
+static int __init rttm_probe(struct device_node *np)
+{
+	int cpu, cpu_rollback;
+	struct timer_of *to;
+	int clkidx = num_possible_cpus();
+
+	/* Use the first n timers as per CPU clock event generators */
+	for_each_possible_cpu(cpu) {
+		to = per_cpu_ptr(&rttm_to, cpu);
+		to->of_irq.index = to->of_base.index = cpu;
+		if (timer_of_init(np, to)) {
+			pr_err("%s: setup of timer %d failed\n", __func__, cpu);
+			goto rollback;
+		}
+		rttm_setup_timer(to->of_base.base);
+	}
+
+	/* Activate the n'th + 1 timer as a stable CPU clocksource. */
+	to = &rttm_cs.to;
+	to->of_base.index = clkidx;
+	timer_of_init(np, to);
+	if (rttm_cs.to.of_base.base && rttm_cs.to.of_clk.rate) {
+		rttm_enable_clocksource(&rttm_cs.cs);
+		clocksource_register_hz(&rttm_cs.cs, RTTM_TICKS_PER_SEC);
+		sched_clock_register(rttm_read_clock, RTTM_BIT_COUNT, RTTM_TICKS_PER_SEC);
+	} else
+		pr_err("%s: setup of timer %d as clocksoure failed", __func__, clkidx);
+
+	return cpuhp_setup_state(CPUHP_AP_REALTEK_TIMER_STARTING,
+				"timer/realtek:online",
+				rttm_cpu_starting, NULL);
+rollback:
+	pr_err("%s: timer registration failed\n", __func__);
+	for_each_possible_cpu(cpu_rollback) {
+		if (cpu_rollback == cpu)
+			break;
+		to = per_cpu_ptr(&rttm_to, cpu_rollback);
+		timer_of_cleanup(to);
+	}
+
+	return -EINVAL;
+}
+
+TIMER_OF_DECLARE(otto_timer, "realtek,otto-timer", rttm_probe);
diff --git a/target/linux/realtek/files-5.15/drivers/gpio/gpio-rtl8231.c b/target/linux/realtek/files-5.15/drivers/gpio/gpio-rtl8231.c
new file mode 100644
index 00000000000000..2821591a97ed9d
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/gpio/gpio-rtl8231.c
@@ -0,0 +1,364 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <linux/gpio/driver.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <asm/mach-rtl838x/mach-rtl83xx.h>
+
+/* RTL8231 registers for LED control */
+#define RTL8231_LED_FUNC0			0x0000
+#define RTL8231_LED_FUNC1			0x0001
+#define RTL8231_READY_MASK			0x03f0
+#define RTL8231_READY_VALUE			0x0370
+#define RTL8231_GPIO_PIN_SEL(gpio)		((0x0002) + ((gpio) >> 4))
+#define RTL8231_GPIO_DIR(gpio)			((0x0005) + ((gpio) >> 4))
+#define RTL8231_GPIO_DATA(gpio)			((0x001C) + ((gpio) >> 4))
+
+#define USEC_TIMEOUT 5000
+
+#define RTL8231_SMI_BUS_ID_MAX			0x1F
+
+struct rtl8231_gpios {
+	struct gpio_chip gc;
+	struct device *dev;
+	u32 id;
+	u32 smi_bus_id;
+	u16 reg_shadow[0x20];
+	u32 reg_cached;
+	int ext_gpio_indrt_access;
+};
+
+extern struct rtl83xx_soc_info soc_info;
+
+DEFINE_MUTEX(miim_lock);
+
+static u32 rtl8231_read(struct rtl8231_gpios *gpios, u32 reg)
+{
+	u32 t = 0, n = 0;
+
+	reg &= 0x1f;
+
+	/* Calculate read register address */
+	t = (gpios->smi_bus_id << 2) | (reg << 7);
+
+	/* Set execution bit: cleared when operation completed */
+	t |= 1;
+
+	/* Start execution */
+	sw_w32(t, gpios->ext_gpio_indrt_access);
+	do {
+		udelay(1);
+		t = sw_r32(gpios->ext_gpio_indrt_access);
+		n++;
+	} while ((t & 1) && (n < USEC_TIMEOUT));
+
+	if (n >= USEC_TIMEOUT)
+		return 0x80000000;
+
+	pr_debug("%s: %x, %x, %x\n", __func__, gpios->smi_bus_id,
+		reg, (t & 0xffff0000) >> 16);
+
+	return (t & 0xffff0000) >> 16;
+}
+
+static int rtl8231_write(struct rtl8231_gpios *gpios, u32 reg, u32 data)
+{
+	u32 t = 0, n = 0;
+
+	pr_debug("%s: %x, %x, %x\n", __func__, gpios->smi_bus_id, reg, data);
+	reg &= 0x1f;
+
+	t = (gpios->smi_bus_id << 2) | (reg << 7) | (data << 16);
+	/* Set write bit */
+	t |= 2;
+
+	/* Set execution bit: cleared when operation completed */
+	t |= 1;
+
+	/* Start execution */
+	sw_w32(t, gpios->ext_gpio_indrt_access);
+	do {
+		udelay(1);
+		t = sw_r32(gpios->ext_gpio_indrt_access);
+	} while ((t & 1) && (n < USEC_TIMEOUT));
+
+	if (n >= USEC_TIMEOUT)
+		return -1;
+
+	return 0;
+}
+
+static u32 rtl8231_read_cached(struct rtl8231_gpios *gpios, u32 reg)
+{
+	if (reg > 0x1f)
+		return 0;
+
+	if (gpios->reg_cached & (1 << reg))
+		return gpios->reg_shadow[reg];
+
+	return rtl8231_read(gpios, reg);
+}
+
+/* Set Direction of the RTL8231 pin:
+ * dir 1: input
+ * dir 0: output
+ */
+static int rtl8231_pin_dir(struct rtl8231_gpios *gpios, u32 gpio, u32 dir)
+{
+	u32 v;
+	int pin_sel_addr = RTL8231_GPIO_PIN_SEL(gpio);
+	int pin_dir_addr = RTL8231_GPIO_DIR(gpio);
+	int dpin = gpio % 16;
+
+	if (gpio > 31) {
+		pr_debug("WARNING: HIGH pin\n");
+		dpin += 5;
+		pin_dir_addr = pin_sel_addr;
+	}
+
+	v = rtl8231_read_cached(gpios, pin_dir_addr);
+	if (v & 0x80000000) {
+		pr_err("Error reading RTL8231\n");
+		return -1;
+	}
+
+	v = (v & ~(1 << dpin)) | (dir << dpin);
+	rtl8231_write(gpios, pin_dir_addr, v);
+	gpios->reg_shadow[pin_dir_addr] = v;
+	gpios->reg_cached |= 1 << pin_dir_addr;
+
+	return 0;
+}
+
+static int rtl8231_pin_dir_get(struct rtl8231_gpios *gpios, u32 gpio, u32 *dir)
+{
+	/* dir 1: input
+	 * dir 0: output
+	 */
+
+	u32  v;
+	int pin_dir_addr = RTL8231_GPIO_DIR(gpio);
+	int pin = gpio % 16;
+
+	if (gpio > 31) {
+		pin_dir_addr = RTL8231_GPIO_PIN_SEL(gpio);
+		pin += 5;
+	}
+
+	v = rtl8231_read(gpios, pin_dir_addr);
+	if (v & (1 << pin))
+		*dir = 1;
+	else
+		*dir = 0;
+
+	return 0;
+}
+
+static int rtl8231_pin_set(struct rtl8231_gpios *gpios, u32 gpio, u32 data)
+{
+	u32 v = rtl8231_read(gpios, RTL8231_GPIO_DATA(gpio));
+
+	pr_debug("%s: %d to %d\n", __func__, gpio, data);
+	if (v & 0x80000000) {
+		pr_err("Error reading RTL8231\n");
+		return -1;
+	}
+	v = (v & ~(1 << (gpio % 16))) | (data << (gpio % 16));
+	rtl8231_write(gpios, RTL8231_GPIO_DATA(gpio), v);
+	gpios->reg_shadow[RTL8231_GPIO_DATA(gpio)] = v;
+	gpios->reg_cached |= 1 << RTL8231_GPIO_DATA(gpio);
+
+	return 0;
+}
+
+static int rtl8231_pin_get(struct rtl8231_gpios *gpios, u32 gpio, u16 *state)
+{
+	u32 v = rtl8231_read(gpios, RTL8231_GPIO_DATA(gpio));
+
+	if (v & 0x80000000) {
+		pr_err("Error reading RTL8231\n");
+		return -1;
+	}
+
+	*state = v & 0xffff;
+
+	return 0;
+}
+
+static int rtl8231_direction_input(struct gpio_chip *gc, unsigned int offset)
+{
+	int err;
+	struct rtl8231_gpios *gpios = gpiochip_get_data(gc);
+
+	pr_debug("%s: %d\n", __func__, offset);
+	mutex_lock(&miim_lock);
+	err = rtl8231_pin_dir(gpios, offset, 1);
+	mutex_unlock(&miim_lock);
+
+	return err;
+}
+
+static int rtl8231_direction_output(struct gpio_chip *gc, unsigned int offset, int value)
+{
+	int err;
+	struct rtl8231_gpios *gpios = gpiochip_get_data(gc);
+
+	pr_debug("%s: %d\n", __func__, offset);
+	mutex_lock(&miim_lock);
+	err = rtl8231_pin_dir(gpios, offset, 0);
+	mutex_unlock(&miim_lock);
+
+	if (!err)
+		err = rtl8231_pin_set(gpios, offset, value);
+
+	return err;
+}
+
+static int rtl8231_get_direction(struct gpio_chip *gc, unsigned int offset)
+{
+	u32 v = 0;
+	struct rtl8231_gpios *gpios = gpiochip_get_data(gc);
+
+	pr_debug("%s: %d\n", __func__, offset);
+	mutex_lock(&miim_lock);
+	rtl8231_pin_dir_get(gpios, offset, &v);
+	mutex_unlock(&miim_lock);
+
+	return v;
+}
+
+static int rtl8231_gpio_get(struct gpio_chip *gc, unsigned int offset)
+{
+	u16 state = 0;
+	struct rtl8231_gpios *gpios = gpiochip_get_data(gc);
+
+	mutex_lock(&miim_lock);
+	rtl8231_pin_get(gpios, offset, &state);
+	mutex_unlock(&miim_lock);
+
+	if (state & (1 << (offset % 16)))
+		return 1;
+
+	return 0;
+}
+
+void rtl8231_gpio_set(struct gpio_chip *gc, unsigned int offset, int value)
+{
+	struct rtl8231_gpios *gpios = gpiochip_get_data(gc);
+
+	rtl8231_pin_set(gpios, offset, value);
+}
+
+int rtl8231_init(struct rtl8231_gpios *gpios)
+{
+	u32 ret;
+
+	pr_info("%s called, MDIO bus ID: %d\n", __func__, gpios->smi_bus_id);
+
+	gpios->reg_cached = 0;
+
+	if (soc_info.family == RTL8390_FAMILY_ID) {
+		/* RTL8390: Enable external gpio in global led control register */
+		sw_w32_mask(0x7 << 18, 0x4 << 18, RTL839X_LED_GLB_CTRL);
+	} else if (soc_info.family == RTL8380_FAMILY_ID) {
+		/* RTL8380: Enable RTL8231 indirect access mode */
+		sw_w32_mask(0, 1, RTL838X_EXTRA_GPIO_CTRL);
+		sw_w32_mask(3, 1, RTL838X_DMY_REG5);
+	}
+
+	ret = rtl8231_read(gpios, RTL8231_LED_FUNC1);
+	if ((ret & 0x80000000) || ((ret & RTL8231_READY_MASK) != RTL8231_READY_VALUE))
+		return -ENXIO;
+
+	/* Select GPIO functionality and force input direction for pins 0-36 */
+	rtl8231_write(gpios, RTL8231_GPIO_PIN_SEL(0), 0xffff);
+	rtl8231_write(gpios, RTL8231_GPIO_DIR(0), 0xffff);
+	rtl8231_write(gpios, RTL8231_GPIO_PIN_SEL(16), 0xffff);
+	rtl8231_write(gpios, RTL8231_GPIO_DIR(16), 0xffff);
+	rtl8231_write(gpios, RTL8231_GPIO_PIN_SEL(32), 0x03ff);
+
+	/* Set LED_Start to enable drivers for output mode */
+	rtl8231_write(gpios, RTL8231_LED_FUNC0, 1 << 1);
+
+	return 0;
+}
+
+static const struct of_device_id rtl8231_gpio_of_match[] = {
+	{ .compatible = "realtek,rtl8231-gpio" },
+	{},
+};
+
+MODULE_DEVICE_TABLE(of, rtl8231_gpio_of_match);
+
+static int rtl8231_gpio_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct device_node *np = dev->of_node;
+	struct rtl8231_gpios *gpios;
+	int err;
+
+	pr_info("Probing RTL8231 GPIOs\n");
+
+	if (!np) {
+		dev_err(&pdev->dev, "No DT found\n");
+		return -EINVAL;
+	}
+
+	gpios = devm_kzalloc(dev, sizeof(*gpios), GFP_KERNEL);
+	if (!gpios)
+		return -ENOMEM;
+
+	gpios->id = soc_info.id;
+	if (soc_info.family == RTL8380_FAMILY_ID) {
+		gpios->ext_gpio_indrt_access = RTL838X_EXT_GPIO_INDRT_ACCESS;
+	}
+
+	if (soc_info.family == RTL8390_FAMILY_ID) {
+		gpios->ext_gpio_indrt_access = RTL839X_EXT_GPIO_INDRT_ACCESS;
+	}
+
+	err = of_property_read_u32(np, "indirect-access-bus-id", &gpios->smi_bus_id);
+	if (!err && gpios->smi_bus_id > RTL8231_SMI_BUS_ID_MAX)
+		err = -EINVAL;
+
+	if (err) {
+		dev_err(dev, "invalid or missing indirect-access-bus-id\n");
+		return err;
+	}
+
+	err = rtl8231_init(gpios);
+	if (err) {
+		dev_err(dev, "no device found at bus address %d\n", gpios->smi_bus_id);
+		return err;
+	}
+
+	gpios->dev = dev;
+	gpios->gc.base = -1;
+	gpios->gc.ngpio = 37;
+	gpios->gc.label = "rtl8231";
+	gpios->gc.parent = dev;
+	gpios->gc.owner = THIS_MODULE;
+	gpios->gc.can_sleep = true;
+
+	gpios->gc.direction_input = rtl8231_direction_input;
+	gpios->gc.direction_output = rtl8231_direction_output;
+	gpios->gc.set = rtl8231_gpio_set;
+	gpios->gc.get = rtl8231_gpio_get;
+	gpios->gc.get_direction = rtl8231_get_direction;
+
+	return devm_gpiochip_add_data(dev, &gpios->gc, gpios);
+}
+
+static struct platform_driver rtl8231_gpio_driver = {
+	.driver = {
+		.name = "rtl8231-gpio",
+		.of_match_table	= rtl8231_gpio_of_match,
+	},
+	.probe = rtl8231_gpio_probe,
+};
+
+module_platform_driver(rtl8231_gpio_driver);
+
+MODULE_DESCRIPTION("Realtek RTL8231 GPIO expansion chip support");
+MODULE_LICENSE("GPL v2");
diff --git a/target/linux/realtek/files-5.15/drivers/i2c/busses/i2c-rtl9300.c b/target/linux/realtek/files-5.15/drivers/i2c/busses/i2c-rtl9300.c
new file mode 100644
index 00000000000000..54d916d17a923c
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/i2c/busses/i2c-rtl9300.c
@@ -0,0 +1,486 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <linux/module.h>
+#include <linux/of_platform.h>
+#include "i2c-rtl9300.h"
+
+#define REG(i, x)	(i->base + x + (i->scl_num ? i->mst2_offset : 0))
+#define REG_MASK(i, clear, set, reg)	\
+			writel((readl(REG(i, reg)) & ~(clear)) | (set), REG(i, reg))
+
+struct i2c_drv_data {
+	int scl0_pin;
+	int scl1_pin;
+	int sda0_pin;
+	struct i2c_algorithm *algo;
+	int (*read)(struct rtl9300_i2c *i2c, u8 *buf, int len);
+	int (*write)(struct rtl9300_i2c *i2c, u8 *buf, int len);
+	void (*reg_addr_set)(struct rtl9300_i2c *i2c, u32 reg, u16 len);
+	int (*config_xfer)(struct rtl9300_i2c *i2c, u16 addr, u16 len);
+	int (*execute_xfer)(struct rtl9300_i2c *i2c, char read_write, int size,
+			    union i2c_smbus_data * data, int len);
+	void (*writel)(struct rtl9300_i2c *i2c, u32 data);
+	void (*config_io)(struct rtl9300_i2c *i2c, int scl_num, int sda_num);
+	u32 mst2_offset;
+};
+
+DEFINE_MUTEX(i2c_lock);
+
+static void rtl9300_i2c_reg_addr_set(struct rtl9300_i2c *i2c, u32 reg, u16 len)
+{
+	/* Set register address width */
+	REG_MASK(i2c, 0x3 << RTL9300_I2C_CTRL2_MADDR_WIDTH, len << RTL9300_I2C_CTRL2_MADDR_WIDTH,
+		 RTL9300_I2C_CTRL2);
+
+	/* Set register address */
+	REG_MASK(i2c, 0xffffff << RTL9300_I2C_CTRL1_MEM_ADDR, reg << RTL9300_I2C_CTRL1_MEM_ADDR,
+		 RTL9300_I2C_CTRL1);
+}
+
+static void rtl9310_i2c_reg_addr_set(struct rtl9300_i2c *i2c, u32 reg, u16 len)
+{
+	/* Set register address width */
+	REG_MASK(i2c, 0x3 << RTL9310_I2C_CTRL_MADDR_WIDTH, len << RTL9310_I2C_CTRL_MADDR_WIDTH,
+		 RTL9310_I2C_CTRL);
+
+	/* Set register address */
+	writel(reg, REG(i2c, RTL9310_I2C_MEMADDR));
+}
+
+static void rtl9300_i2c_config_io(struct rtl9300_i2c *i2c, int scl_num, int sda_num)
+{
+	u32 v;
+
+	/* Set SCL pin */
+	REG_MASK(i2c, 0, BIT(RTL9300_I2C_CTRL1_GPIO8_SCL_SEL), RTL9300_I2C_CTRL1);
+
+	/* Set SDA pin */
+	REG_MASK(i2c, 0x7 << RTL9300_I2C_CTRL1_SDA_OUT_SEL,
+		 i2c->sda_num << RTL9300_I2C_CTRL1_SDA_OUT_SEL, RTL9300_I2C_CTRL1);
+
+	/* Set SDA pin to I2C functionality */
+	v = readl(i2c->base + RTL9300_I2C_MST_GLB_CTRL);
+	v |= BIT(i2c->sda_num);
+	writel(v, i2c->base + RTL9300_I2C_MST_GLB_CTRL);
+}
+
+static void rtl9310_i2c_config_io(struct rtl9300_i2c *i2c, int scl_num, int sda_num)
+{
+	u32 v;
+
+	/* Set SCL pin */
+	REG_MASK(i2c, 0, BIT(RTL9310_I2C_MST_IF_SEL_GPIO_SCL_SEL + scl_num), RTL9310_I2C_MST_IF_SEL);
+
+	/* Set SDA pin */
+	REG_MASK(i2c, 0x7 << RTL9310_I2C_CTRL_SDA_OUT_SEL,
+		 i2c->sda_num << RTL9310_I2C_CTRL_SDA_OUT_SEL, RTL9310_I2C_CTRL);
+
+	/* Set SDA pin to I2C functionality */
+	v = readl(i2c->base + RTL9310_I2C_MST_IF_SEL);
+	v |= BIT(i2c->sda_num);
+	writel(v, i2c->base + RTL9310_I2C_MST_IF_SEL);
+}
+
+static int rtl9300_i2c_config_xfer(struct rtl9300_i2c *i2c, u16 addr, u16 len)
+{
+	/* Set bus frequency */
+	REG_MASK(i2c, 0x3 << RTL9300_I2C_CTRL2_SCL_FREQ,
+		 i2c->bus_freq << RTL9300_I2C_CTRL2_SCL_FREQ, RTL9300_I2C_CTRL2);
+
+	/* Set slave device address */
+	REG_MASK(i2c, 0x7f << RTL9300_I2C_CTRL2_DEV_ADDR,
+		 addr << RTL9300_I2C_CTRL2_DEV_ADDR, RTL9300_I2C_CTRL2);
+
+	/* Set data length */
+	REG_MASK(i2c, 0xf << RTL9300_I2C_CTRL2_DATA_WIDTH,
+		 ((len - 1) & 0xf) << RTL9300_I2C_CTRL2_DATA_WIDTH, RTL9300_I2C_CTRL2);
+
+	/* Set read mode to random */
+	REG_MASK(i2c, 0x1 << RTL9300_I2C_CTRL2_READ_MODE, 0, RTL9300_I2C_CTRL2);
+
+	return 0;
+}
+
+static int rtl9310_i2c_config_xfer(struct rtl9300_i2c *i2c, u16 addr, u16 len)
+{
+	/* Set bus frequency */
+	REG_MASK(i2c, 0x3 << RTL9310_I2C_CTRL_SCL_FREQ,
+		 i2c->bus_freq << RTL9310_I2C_CTRL_SCL_FREQ, RTL9310_I2C_CTRL);
+
+	/* Set slave device address */
+	REG_MASK(i2c, 0x7f << RTL9310_I2C_CTRL_DEV_ADDR,
+		 addr << RTL9310_I2C_CTRL_DEV_ADDR, RTL9310_I2C_CTRL);
+
+	/* Set data length */
+	REG_MASK(i2c, 0xf << RTL9310_I2C_CTRL_DATA_WIDTH,
+		 ((len - 1) & 0xf) << RTL9310_I2C_CTRL_DATA_WIDTH, RTL9310_I2C_CTRL);
+
+	/* Set read mode to random */
+	REG_MASK(i2c, 0x1 << RTL9310_I2C_CTRL_READ_MODE, 0, RTL9310_I2C_CTRL);
+
+	return 0;
+}
+
+static int i2c_read(void __iomem *r0, u8 *buf, int len)
+{
+	if (len > 16)
+		return -EIO;
+
+	for (int i = 0; i < len; i++) {
+		u32 v;
+
+		if (i % 4 == 0)
+			v = readl(r0 + i);
+		buf[i] = v;
+		v >>= 8;
+	}
+
+	return len;
+}
+
+static int i2c_write(void __iomem *r0, u8 *buf, int len)
+{
+	if (len > 16)
+		return -EIO;
+
+	for (int i = 0; i < len; i++) {
+		u32 v;
+
+		if (! (i % 4))
+			v = 0;
+		v <<= 8;
+		v |= buf[i];
+		if (i % 4 == 3 || i == len - 1)
+			writel(v, r0 + (i / 4) * 4);
+	}
+
+	return len;
+}
+
+static int rtl9300_i2c_read(struct rtl9300_i2c *i2c, u8 *buf, int len)
+{
+	return i2c_read(REG(i2c, RTL9300_I2C_DATA_WORD0), buf, len);
+}
+
+static int rtl9300_i2c_write(struct rtl9300_i2c *i2c, u8 *buf, int len)
+{
+	return i2c_write(REG(i2c, RTL9300_I2C_DATA_WORD0), buf, len);
+}
+
+static int rtl9310_i2c_read(struct rtl9300_i2c *i2c, u8 *buf, int len)
+{
+	return i2c_read(REG(i2c, RTL9310_I2C_DATA), buf, len);
+}
+
+static int rtl9310_i2c_write(struct rtl9300_i2c *i2c, u8 *buf, int len)
+{
+	return i2c_write(REG(i2c, RTL9310_I2C_DATA), buf, len);
+}
+
+static void rtl9300_writel(struct rtl9300_i2c *i2c, u32 data)
+{
+	writel(data, REG(i2c, RTL9300_I2C_DATA_WORD0));
+}
+
+static void rtl9310_writel(struct rtl9300_i2c *i2c, u32 data)
+{
+	writel(data, REG(i2c, RTL9310_I2C_DATA));
+}
+
+
+static int rtl9300_execute_xfer(struct rtl9300_i2c *i2c, char read_write,
+				int size, union i2c_smbus_data * data, int len)
+{
+	u32 v;
+
+	if (read_write == I2C_SMBUS_READ)
+		REG_MASK(i2c, BIT(RTL9300_I2C_CTRL1_RWOP), 0, RTL9300_I2C_CTRL1);
+	else
+		REG_MASK(i2c, 0, BIT(RTL9300_I2C_CTRL1_RWOP), RTL9300_I2C_CTRL1);
+
+	REG_MASK(i2c, 0, BIT(RTL9300_I2C_CTRL1_I2C_TRIG), RTL9300_I2C_CTRL1);
+	do {
+		v = readl(REG(i2c, RTL9300_I2C_CTRL1));
+	} while (v & BIT(RTL9300_I2C_CTRL1_I2C_TRIG));
+
+	if (v & BIT(RTL9300_I2C_CTRL1_I2C_FAIL))
+		return -EIO;
+
+	if (read_write == I2C_SMBUS_READ) {
+		if (size == I2C_SMBUS_BYTE || size == I2C_SMBUS_BYTE_DATA){
+			data->byte = readl(REG(i2c, RTL9300_I2C_DATA_WORD0));
+		} else if (size == I2C_SMBUS_WORD_DATA) {
+			data->word = readl(REG(i2c, RTL9300_I2C_DATA_WORD0));
+		} else if (len > 0) {
+			rtl9300_i2c_read(i2c, &data->block[0], len);
+		}
+	}
+
+	return 0;
+}
+
+static int rtl9310_execute_xfer(struct rtl9300_i2c *i2c, char read_write,
+				int size, union i2c_smbus_data * data, int len)
+{
+	u32 v;
+
+	if (read_write == I2C_SMBUS_READ)
+		REG_MASK(i2c, BIT(RTL9310_I2C_CTRL_RWOP), 0, RTL9310_I2C_CTRL);
+	else
+		REG_MASK(i2c, 0, BIT(RTL9310_I2C_CTRL_RWOP), RTL9310_I2C_CTRL);
+
+	REG_MASK(i2c, 0, BIT(RTL9310_I2C_CTRL_I2C_TRIG), RTL9310_I2C_CTRL);
+	do {
+		v = readl(REG(i2c, RTL9310_I2C_CTRL));
+	} while (v & BIT(RTL9310_I2C_CTRL_I2C_TRIG));
+
+	if (v & BIT(RTL9310_I2C_CTRL_I2C_FAIL))
+		return -EIO;
+
+	if (read_write == I2C_SMBUS_READ) {
+		if (size == I2C_SMBUS_BYTE || size == I2C_SMBUS_BYTE_DATA){
+			data->byte = readl(REG(i2c, RTL9310_I2C_DATA));
+		} else if (size == I2C_SMBUS_WORD_DATA) {
+			data->word = readl(REG(i2c, RTL9310_I2C_DATA));
+		} else if (len > 0) {
+			rtl9310_i2c_read(i2c, &data->block[0], len);
+		}
+	}
+
+	return 0;
+}
+
+static int rtl9300_i2c_smbus_xfer(struct i2c_adapter * adap, u16 addr,
+		  unsigned short flags, char read_write,
+		  u8 command, int size, union i2c_smbus_data * data)
+{
+	struct rtl9300_i2c *i2c = i2c_get_adapdata(adap);
+	struct i2c_drv_data *drv_data = (struct i2c_drv_data *)device_get_match_data(i2c->dev);
+	int len = 0, ret;
+
+	mutex_lock(&i2c_lock);
+	switch (size) {
+	case I2C_SMBUS_QUICK:
+		drv_data->config_xfer(i2c, addr, 0);
+		drv_data->reg_addr_set(i2c, 0, 0);
+		break;
+
+	case I2C_SMBUS_BYTE:
+		if (read_write == I2C_SMBUS_WRITE) {
+			drv_data->config_xfer(i2c, addr, 0);
+			drv_data->reg_addr_set(i2c, command, 1);
+		} else {
+			drv_data->config_xfer(i2c, addr, 1);
+			drv_data->reg_addr_set(i2c, 0, 0);
+		}
+		break;
+
+	case I2C_SMBUS_BYTE_DATA:
+		pr_debug("I2C_SMBUS_BYTE_DATA %02x, read %d cmd %02x\n", addr, read_write, command);
+		drv_data->reg_addr_set(i2c, command, 1);
+		drv_data->config_xfer(i2c, addr, 1);
+
+		if (read_write == I2C_SMBUS_WRITE) {
+			pr_debug("--> data %02x\n", data->byte);
+			drv_data->writel(i2c, data->byte);
+		}
+		break;
+
+	case I2C_SMBUS_WORD_DATA:
+		pr_debug("I2C_SMBUS_WORD %02x, read %d\n", addr, read_write);
+		drv_data->reg_addr_set(i2c, command, 1);
+		drv_data->config_xfer(i2c, addr, 2);
+		if (read_write == I2C_SMBUS_WRITE)
+			drv_data->writel(i2c, data->word);
+		break;
+
+	case I2C_SMBUS_BLOCK_DATA:
+		pr_debug("I2C_SMBUS_BLOCK_DATA %02x, read %d, len %d\n",
+			addr, read_write, data->block[0]);
+		drv_data->reg_addr_set(i2c, command, 1);
+		drv_data->config_xfer(i2c, addr, data->block[0]);
+		if (read_write == I2C_SMBUS_WRITE)
+			drv_data->write(i2c, &data->block[1], data->block[0]);
+		len = data->block[0];
+		break;
+
+	default:
+		dev_warn(&adap->dev, "Unsupported transaction %d\n", size);
+		return -EOPNOTSUPP;
+	}
+
+	ret = drv_data->execute_xfer(i2c, read_write, size, data, len);
+
+	mutex_unlock(&i2c_lock);
+
+	return ret;
+}
+
+static u32 rtl9300_i2c_func(struct i2c_adapter *a)
+{
+	return I2C_FUNC_SMBUS_QUICK | I2C_FUNC_SMBUS_BYTE |
+	       I2C_FUNC_SMBUS_BYTE_DATA | I2C_FUNC_SMBUS_WORD_DATA |
+	       I2C_FUNC_SMBUS_BLOCK_DATA;
+}
+
+static const struct i2c_algorithm rtl9300_i2c_algo = {
+	.smbus_xfer	= rtl9300_i2c_smbus_xfer,
+	.functionality	= rtl9300_i2c_func,
+};
+
+struct i2c_adapter_quirks rtl9300_i2c_quirks = {
+	.flags		= I2C_AQ_NO_CLK_STRETCH,
+	.max_read_len	= 16,
+	.max_write_len	= 16,
+};
+
+static int rtl9300_i2c_probe(struct platform_device *pdev)
+{
+	struct resource *res;
+	struct rtl9300_i2c *i2c;
+	struct i2c_adapter *adap;
+	struct i2c_drv_data *drv_data;
+	struct device_node *node = pdev->dev.of_node;
+	u32 clock_freq, pin;
+	int ret = 0;
+
+	pr_info("%s probing I2C adapter\n", __func__);
+
+	if (!node) {
+		dev_err(i2c->dev, "No DT found\n");
+		return -EINVAL;
+	}
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+
+	drv_data = (struct i2c_drv_data *) device_get_match_data(&pdev->dev);
+
+	i2c = devm_kzalloc(&pdev->dev, sizeof(struct rtl9300_i2c), GFP_KERNEL);
+	if (!i2c)
+		return -ENOMEM;
+
+	i2c->base = devm_ioremap_resource(&pdev->dev, res);
+	i2c->mst2_offset = drv_data->mst2_offset;
+	if (IS_ERR(i2c->base))
+		return PTR_ERR(i2c->base);
+
+	pr_debug("%s base memory %08x\n", __func__, (u32)i2c->base);
+	i2c->dev = &pdev->dev;
+
+	if (of_property_read_u32(node, "clock-frequency", &clock_freq)) {
+		clock_freq = I2C_MAX_STANDARD_MODE_FREQ;
+	}
+	switch(clock_freq) {
+	case I2C_MAX_STANDARD_MODE_FREQ:
+		i2c->bus_freq = RTL9300_I2C_STD_FREQ;
+		break;
+
+	case I2C_MAX_FAST_MODE_FREQ:
+		i2c->bus_freq = RTL9300_I2C_FAST_FREQ;
+		break;
+	default:
+		dev_warn(i2c->dev, "clock-frequency %d not supported\n", clock_freq);
+		return -EINVAL;
+	}
+
+	dev_info(&pdev->dev, "SCL speed %d, mode is %d\n", clock_freq, i2c->bus_freq);
+
+	if (of_property_read_u32(node, "scl-pin", &pin)) {
+		dev_warn(i2c->dev, "SCL pin not found in DT, using default\n");
+		pin = drv_data->scl0_pin;
+	}
+	if (!(pin == drv_data->scl0_pin || pin == drv_data->scl1_pin)) {
+		dev_warn(i2c->dev, "SCL pin %d not supported\n", pin);
+		return -EINVAL;
+	}
+	i2c->scl_num = pin == drv_data->scl0_pin ? 0 : 1;
+	pr_info("%s scl_num %d\n", __func__, i2c->scl_num);
+
+	if (of_property_read_u32(node, "sda-pin", &pin)) {
+		dev_warn(i2c->dev, "SDA pin not found in DT, using default \n");
+		pin = drv_data->sda0_pin;
+	}
+	i2c->sda_num = pin - drv_data->sda0_pin;
+	if (i2c->sda_num < 0 || i2c->sda_num > 7) {
+		dev_warn(i2c->dev, "SDA pin %d not supported\n", pin);
+		return -EINVAL;
+	}
+	pr_info("%s sda_num %d\n", __func__, i2c->sda_num);
+
+	adap = &i2c->adap;
+	adap->owner = THIS_MODULE;
+	adap->algo = &rtl9300_i2c_algo;
+	adap->retries = 3;
+	adap->dev.parent = &pdev->dev;
+	i2c_set_adapdata(adap, i2c);
+	adap->dev.of_node = node;
+	strlcpy(adap->name, dev_name(&pdev->dev), sizeof(adap->name));
+
+	platform_set_drvdata(pdev, i2c);
+
+	drv_data->config_io(i2c, i2c->scl_num, i2c->sda_num);
+
+	ret = i2c_add_adapter(adap);
+
+	return ret;
+}
+
+static int rtl9300_i2c_remove(struct platform_device *pdev)
+{
+	struct rtl9300_i2c *i2c = platform_get_drvdata(pdev);
+
+	i2c_del_adapter(&i2c->adap);
+
+	return 0;
+}
+
+struct i2c_drv_data rtl9300_i2c_drv_data = {
+	.scl0_pin = 8,
+	.scl1_pin = 17,
+	.sda0_pin = 9,
+	.read = rtl9300_i2c_read,
+	.read = rtl9300_i2c_write,
+	.reg_addr_set = rtl9300_i2c_reg_addr_set,
+	.config_xfer = rtl9300_i2c_config_xfer,
+	.execute_xfer = rtl9300_execute_xfer,
+	.writel = rtl9300_writel,
+	.config_io = rtl9300_i2c_config_io,
+	.mst2_offset = 0x1c,
+};
+
+struct i2c_drv_data rtl9310_i2c_drv_data = {
+	.scl0_pin = 13,
+	.scl1_pin = 14,
+	.sda0_pin = 0,
+	.read = rtl9310_i2c_read,
+	.read = rtl9310_i2c_write,
+	.reg_addr_set = rtl9310_i2c_reg_addr_set,
+	.config_xfer = rtl9310_i2c_config_xfer,
+	.execute_xfer = rtl9310_execute_xfer,
+	.writel = rtl9310_writel,
+	.config_io = rtl9310_i2c_config_io,
+	.mst2_offset = 0x18,
+};
+
+static const struct of_device_id i2c_rtl9300_dt_ids[] = {
+	{ .compatible = "realtek,rtl9300-i2c", .data = (void *) &rtl9300_i2c_drv_data },
+	{ .compatible = "realtek,rtl9310-i2c", .data = (void *) &rtl9310_i2c_drv_data },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, rtl838x_eth_of_ids);
+
+static struct platform_driver rtl9300_i2c_driver = {
+	.probe		= rtl9300_i2c_probe,
+	.remove		= rtl9300_i2c_remove,
+	.driver		= {
+		.name	= "i2c-rtl9300",
+		.pm 	= NULL,
+		.of_match_table = i2c_rtl9300_dt_ids,
+	},
+};
+
+module_platform_driver(rtl9300_i2c_driver);
+
+MODULE_AUTHOR("Birger Koblitz");
+MODULE_DESCRIPTION("RTL9300 I2C host driver");
+MODULE_LICENSE("GPL v2");
diff --git a/target/linux/realtek/files-5.15/drivers/i2c/busses/i2c-rtl9300.h b/target/linux/realtek/files-5.15/drivers/i2c/busses/i2c-rtl9300.h
new file mode 100644
index 00000000000000..617a1b6632cf33
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/i2c/busses/i2c-rtl9300.h
@@ -0,0 +1,62 @@
+#ifndef I2C_RTL9300_H
+#define I2C_RTL9300_H
+
+#include <linux/i2c.h>
+
+#define RTL9300_I2C_CTRL1			0x00
+#define RTL9300_I2C_CTRL1_MEM_ADDR		8
+#define RTL9300_I2C_CTRL1_SDA_OUT_SEL		4
+#define RTL9300_I2C_CTRL1_GPIO8_SCL_SEL		3
+#define RTL9300_I2C_CTRL1_RWOP			2
+#define RTL9300_I2C_CTRL1_I2C_FAIL		1
+#define RTL9300_I2C_CTRL1_I2C_TRIG		0
+
+#define RTL9300_I2C_CTRL2			0x04
+#define RTL9300_I2C_CTRL2_DRIVE_ACK_DELAY	20
+#define RTL9300_I2C_CTRL2_CHECK_ACK_DELAY	16
+#define RTL9300_I2C_CTRL2_READ_MODE		15
+#define RTL9300_I2C_CTRL2_DEV_ADDR		8
+#define RTL9300_I2C_CTRL2_DATA_WIDTH		4
+#define RTL9300_I2C_CTRL2_MADDR_WIDTH		2
+#define RTL9300_I2C_CTRL2_SCL_FREQ		0
+
+#define RTL9300_I2C_DATA_WORD0			0x08
+
+#define RTL9300_I2C_MST_GLB_CTRL		0x18
+
+#define RTL9310_I2C_MST_IF_CTRL			0x00
+
+#define RTL9310_I2C_MST_IF_SEL			0x04
+#define RTL9310_I2C_MST_IF_SEL_GPIO_SCL_SEL	12
+
+#define RTL9310_I2C_CTRL			0x08
+#define RTL9310_I2C_CTRL_SCL_FREQ		30
+#define RTL9310_I2C_CTRL_CHECK_ACK_DELAY	26
+#define RTL9310_I2C_CTRL_DRIVE_ACK_DELAY	22
+#define RTL9310_I2C_CTRL_SDA_OUT_SEL		18
+#define RTL9310_I2C_CTRL_DEV_ADDR		11
+#define RTL9310_I2C_CTRL_MADDR_WIDTH		9
+#define RTL9310_I2C_CTRL_DATA_WIDTH		5
+#define RTL9310_I2C_CTRL_READ_MODE		4
+#define RTL9310_I2C_CTRL_RWOP			2
+#define RTL9310_I2C_CTRL_I2C_FAIL		1
+#define RTL9310_I2C_CTRL_I2C_TRIG		0
+
+#define RTL9310_I2C_MEMADDR			0x0c
+
+#define RTL9310_I2C_DATA			0x10
+
+#define RTL9300_I2C_STD_FREQ		0
+#define RTL9300_I2C_FAST_FREQ		1
+
+struct rtl9300_i2c {
+	void __iomem *base;
+	u32 mst2_offset;
+	struct device *dev;
+	struct i2c_adapter adap;
+	u8 bus_freq;
+	u8 sda_num;			/* SDA channel number */
+	u8 scl_num;			/* SCL channel, mapping to master 1 or 2 */
+};
+
+#endif
diff --git a/target/linux/realtek/files-5.15/drivers/i2c/muxes/i2c-mux-rtl9300.c b/target/linux/realtek/files-5.15/drivers/i2c/muxes/i2c-mux-rtl9300.c
new file mode 100644
index 00000000000000..57036d9d566a31
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/i2c/muxes/i2c-mux-rtl9300.c
@@ -0,0 +1,293 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * I2C multiplexer for the 2 I2C Masters of the RTL9300
+ * with up to 8 channels each, but which are not entirely
+ * independent of each other
+ */
+#include <linux/i2c-mux.h>
+#include <linux/module.h>
+#include <linux/mux/consumer.h>
+#include <linux/of_device.h>
+#include <linux/of_address.h>
+#include <linux/platform_device.h>
+
+#include "../busses/i2c-rtl9300.h"
+
+#define NUM_MASTERS		2
+#define NUM_BUSSES		8
+
+#define REG(mst, x)	(mux->base + x + (mst ? mux->i2c->mst2_offset : 0))
+#define REG_MASK(mst, clear, set, reg)	\
+			writel((readl(REG((mst),(reg))) & ~(clear)) | (set), REG((mst),(reg)))
+
+struct channel {
+	u8 sda_num;
+	u8 scl_num;
+};
+
+static struct channel channels[NUM_MASTERS * NUM_BUSSES];
+
+struct rtl9300_mux {
+	void __iomem *base;
+	struct device *dev;
+	struct i2c_adapter *parent;
+	struct rtl9300_i2c * i2c;
+};
+
+struct i2c_mux_data  {
+	int scl0_pin;
+	int scl1_pin;
+	int sda0_pin;
+	int sda_pins;
+	int (*i2c_mux_select)(struct i2c_mux_core *muxc, u32 chan);
+	int (*i2c_mux_deselect)(struct i2c_mux_core *muxc, u32 chan);
+	void (*sda_sel)(struct i2c_mux_core *muxc, int pin);
+};
+
+static int rtl9300_i2c_mux_select(struct i2c_mux_core *muxc, u32 chan)
+{
+	struct rtl9300_mux *mux = i2c_mux_priv(muxc);
+
+	/* Set SCL pin */
+	REG_MASK(channels[chan].scl_num, 0,
+		 BIT(RTL9300_I2C_CTRL1_GPIO8_SCL_SEL), RTL9300_I2C_CTRL1);
+
+	/* Set SDA pin */
+	REG_MASK(channels[chan].scl_num, 0x7 << RTL9300_I2C_CTRL1_SDA_OUT_SEL,
+		 channels[chan].sda_num << RTL9300_I2C_CTRL1_SDA_OUT_SEL, RTL9300_I2C_CTRL1);
+
+	mux->i2c->sda_num = channels[chan].sda_num;
+	mux->i2c->scl_num = channels[chan].scl_num;
+
+	return 0;
+}
+
+static int rtl9310_i2c_mux_select(struct i2c_mux_core *muxc, u32 chan)
+{
+	struct rtl9300_mux *mux = i2c_mux_priv(muxc);
+
+	/* Set SCL pin */
+	REG_MASK(0, 0, BIT(RTL9310_I2C_MST_IF_SEL_GPIO_SCL_SEL + channels[chan].scl_num),
+		 RTL9310_I2C_MST_IF_SEL);
+
+	/* Set SDA pin */
+	REG_MASK(channels[chan].scl_num, 0xf << RTL9310_I2C_CTRL_SDA_OUT_SEL,
+		 channels[chan].sda_num << RTL9310_I2C_CTRL_SDA_OUT_SEL, RTL9310_I2C_CTRL);
+
+	mux->i2c->sda_num = channels[chan].sda_num;
+	mux->i2c->scl_num = channels[chan].scl_num;
+
+	return 0;
+}
+
+static int rtl9300_i2c_mux_deselect(struct i2c_mux_core *muxc, u32 chan)
+{
+	return 0;
+}
+
+static void rtl9300_sda_sel(struct i2c_mux_core *muxc, int pin)
+{
+	struct rtl9300_mux *mux = i2c_mux_priv(muxc);
+	u32 v;
+
+	/* Set SDA pin to I2C functionality */
+	v = readl(REG(0, RTL9300_I2C_MST_GLB_CTRL));
+	v |= BIT(pin);
+	writel(v, REG(0, RTL9300_I2C_MST_GLB_CTRL));
+}
+
+static void rtl9310_sda_sel(struct i2c_mux_core *muxc, int pin)
+{
+	struct rtl9300_mux *mux = i2c_mux_priv(muxc);
+	u32 v;
+
+	/* Set SDA pin to I2C functionality */
+	v = readl(REG(0, RTL9310_I2C_MST_IF_SEL));
+	v |= BIT(pin);
+	writel(v, REG(0, RTL9310_I2C_MST_IF_SEL));
+}
+
+static struct device_node *mux_parent_adapter(struct device *dev, struct rtl9300_mux *mux)
+{
+	struct device_node *node = dev->of_node;
+	struct device_node *parent_np;
+	struct i2c_adapter *parent;
+
+	parent_np = of_parse_phandle(node, "i2c-parent", 0);
+	if (!parent_np) {
+		dev_err(dev, "Cannot parse i2c-parent\n");
+		return ERR_PTR(-ENODEV);
+	}
+	parent = of_find_i2c_adapter_by_node(parent_np);
+	of_node_put(parent_np);
+	if (!parent)
+		return ERR_PTR(-EPROBE_DEFER);
+
+	if (!(of_device_is_compatible(parent_np, "realtek,rtl9300-i2c") ||
+	    of_device_is_compatible(parent_np, "realtek,rtl9310-i2c"))){
+		dev_err(dev, "I2C parent not an RTL9300 I2C controller\n");
+		return ERR_PTR(-ENODEV);
+	}
+
+	mux->parent = parent;
+	mux->i2c = (struct rtl9300_i2c *)i2c_get_adapdata(parent);
+	mux->base = mux->i2c->base;
+
+	return parent_np;
+}
+
+struct i2c_mux_data rtl9300_i2c_mux_data = {
+	.scl0_pin = 8,
+	.scl1_pin = 17,
+	.sda0_pin = 9,
+	.sda_pins = 8,
+	.i2c_mux_select = rtl9300_i2c_mux_select,
+	.i2c_mux_deselect = rtl9300_i2c_mux_deselect,
+	.sda_sel = rtl9300_sda_sel,
+};
+
+struct i2c_mux_data rtl9310_i2c_mux_data = {
+	.scl0_pin = 13,
+	.scl1_pin = 14,
+	.sda0_pin = 0,
+	.sda_pins = 16,
+	.i2c_mux_select = rtl9310_i2c_mux_select,
+	.i2c_mux_deselect = rtl9300_i2c_mux_deselect,
+	.sda_sel = rtl9310_sda_sel,
+};
+
+static const struct of_device_id rtl9300_i2c_mux_of_match[] = {
+	{ .compatible = "realtek,i2c-mux-rtl9300", .data = (void *) &rtl9300_i2c_mux_data},
+	{ .compatible = "realtek,i2c-mux-rtl9310", .data = (void *) &rtl9310_i2c_mux_data},
+	{},
+};
+
+MODULE_DEVICE_TABLE(of, rtl9300_i2c_mux_of_match);
+
+static int rtl9300_i2c_mux_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node;
+	struct device_node *parent_np;
+	struct device_node *child;
+	struct i2c_mux_core *muxc;
+	struct rtl9300_mux *mux;
+	struct i2c_mux_data *mux_data;
+	int children;
+	int ret;
+
+	pr_info("%s probing I2C adapter\n", __func__);
+
+	if (!node) {
+		dev_err(dev, "No DT found\n");
+		return -EINVAL;
+	}
+
+	mux = devm_kzalloc(dev, sizeof(*mux), GFP_KERNEL);
+	if (!mux)
+		return -ENOMEM;
+
+	mux->dev = dev;
+
+	mux_data = (struct i2c_mux_data *) device_get_match_data(dev);
+
+	parent_np = mux_parent_adapter(dev, mux);
+	if (IS_ERR(parent_np))
+		return dev_err_probe(dev, PTR_ERR(parent_np), "i2c-parent adapter not found\n");
+
+	pr_info("%s base memory %08x\n", __func__, (u32)mux->base);
+
+	children = of_get_child_count(node);
+
+	muxc = i2c_mux_alloc(mux->parent, dev, children, 0, 0,
+			     mux_data->i2c_mux_select, mux_data->i2c_mux_deselect);
+	if (!muxc) {
+		ret = -ENOMEM;
+		goto err_parent;
+	}
+	muxc->priv = mux;
+
+	platform_set_drvdata(pdev, muxc);
+
+	for_each_child_of_node(node, child) {
+		u32 chan;
+		u32 pin;
+
+		ret = of_property_read_u32(child, "reg", &chan);
+		if (ret < 0) {
+			dev_err(dev, "no reg property for node '%pOFn'\n",
+				child);
+			goto err_children;
+		}
+
+		if (chan >= NUM_MASTERS * NUM_BUSSES) {
+			dev_err(dev, "invalid reg %u\n", chan);
+			ret = -EINVAL;
+			goto err_children;
+		}
+
+		if (of_property_read_u32(child, "scl-pin", &pin)) {
+			dev_warn(dev, "SCL pin not found in DT, using default\n");
+			pin = mux_data->scl0_pin;
+		}
+		if (!(pin == mux_data->scl0_pin || pin == mux_data->scl1_pin)) {
+			dev_warn(dev, "SCL pin %d not supported\n", pin);
+			ret = -EINVAL;
+			goto err_children;
+		}
+		channels[chan].scl_num = pin == mux_data->scl0_pin ? 0 : 1;
+		pr_info("%s channel %d scl_num %d\n", __func__, chan, channels[chan].scl_num);
+
+		if (of_property_read_u32(child, "sda-pin", &pin)) {
+			dev_warn(dev, "SDA pin not found in DT, using default \n");
+			pin = mux_data->sda0_pin;
+		}
+		channels[chan].sda_num = pin - mux_data->sda0_pin;
+		if (channels[chan].sda_num < 0 || channels[chan].sda_num >= mux_data->sda_pins) {
+			dev_warn(dev, "SDA pin %d not supported\n", pin);
+			return -EINVAL;
+		}
+		pr_info("%s channel %d sda_num %d\n", __func__, chan, channels[chan].sda_num);
+
+		mux_data->sda_sel(muxc, channels[chan].sda_num);
+
+		ret = i2c_mux_add_adapter(muxc, 0, chan, 0);
+		if (ret)
+			goto err_children;
+	}
+
+	dev_info(dev, "%d-port mux on %s adapter\n", children, mux->parent->name);
+
+	return 0;
+
+err_children:
+	i2c_mux_del_adapters(muxc);
+err_parent:
+	i2c_put_adapter(mux->parent);
+
+	return ret;
+}
+
+static int rtl9300_i2c_mux_remove(struct platform_device *pdev)
+{
+	struct i2c_mux_core *muxc = platform_get_drvdata(pdev);
+
+	i2c_mux_del_adapters(muxc);
+	i2c_put_adapter(muxc->parent);
+
+	return 0;
+}
+
+static struct platform_driver i2c_mux_driver = {
+	.probe	= rtl9300_i2c_mux_probe,
+	.remove	= rtl9300_i2c_mux_remove,
+	.driver	= {
+		.name	= "i2c-mux-rtl9300",
+		.of_match_table = rtl9300_i2c_mux_of_match,
+	},
+};
+module_platform_driver(i2c_mux_driver);
+
+MODULE_DESCRIPTION("RTL9300 I2C multiplexer driver");
+MODULE_AUTHOR("Birger Koblitz");
+MODULE_LICENSE("GPL v2");
diff --git a/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/Kconfig b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/Kconfig
new file mode 100644
index 00000000000000..3124ee8d20c219
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/Kconfig
@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: GPL-2.0-only
+config NET_DSA_RTL83XX
+	tristate "Realtek RTL838x/RTL839x switch support"
+	depends on RTL83XX
+	select NET_DSA_TAG_TRAILER
+	help
+	  This driver adds support for Realtek RTL83xx series switching.
diff --git a/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/Makefile b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/Makefile
new file mode 100644
index 00000000000000..8752c797004d74
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/Makefile
@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: GPL-2.0
+obj-$(CONFIG_NET_DSA_RTL83XX)	+= common.o dsa.o \
+	rtl838x.o rtl839x.o rtl930x.o rtl931x.o debugfs.o qos.o tc.o
diff --git a/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/common.c b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/common.c
new file mode 100644
index 00000000000000..0434312afcef46
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/common.c
@@ -0,0 +1,1705 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <linux/of_mdio.h>
+#include <linux/of_platform.h>
+#include <net/arp.h>
+#include <net/nexthop.h>
+#include <net/neighbour.h>
+#include <net/netevent.h>
+#include <linux/etherdevice.h>
+#include <linux/if_vlan.h>
+#include <linux/inetdevice.h>
+#include <linux/rhashtable.h>
+#include <linux/of_net.h>
+#include <asm/mach-rtl838x/mach-rtl83xx.h>
+
+#include "rtl83xx.h"
+
+extern struct rtl83xx_soc_info soc_info;
+
+extern const struct rtl838x_reg rtl838x_reg;
+extern const struct rtl838x_reg rtl839x_reg;
+extern const struct rtl838x_reg rtl930x_reg;
+extern const struct rtl838x_reg rtl931x_reg;
+
+extern const struct dsa_switch_ops rtl83xx_switch_ops;
+extern const struct dsa_switch_ops rtl930x_switch_ops;
+
+DEFINE_MUTEX(smi_lock);
+
+int rtl83xx_port_get_stp_state(struct rtl838x_switch_priv *priv, int port)
+{
+	u32 msti = 0;
+	u32 port_state[4];
+	int index, bit;
+	int pos = port;
+	int n = priv->port_width << 1;
+
+	/* Ports above or equal CPU port can never be configured */
+	if (port >= priv->cpu_port)
+		return -1;
+
+	mutex_lock(&priv->reg_mutex);
+
+	/* For the RTL839x and following, the bits are left-aligned in the 64/128 bit field */
+	if (priv->family_id == RTL8390_FAMILY_ID)
+		pos += 12;
+	if (priv->family_id == RTL9300_FAMILY_ID)
+		pos += 3;
+	if (priv->family_id == RTL9310_FAMILY_ID)
+		pos += 8;
+
+	index = n - (pos >> 4) - 1;
+	bit = (pos << 1) % 32;
+
+	priv->r->stp_get(priv, msti, port_state);
+
+	mutex_unlock(&priv->reg_mutex);
+
+	return (port_state[index] >> bit) & 3;
+}
+
+static struct table_reg rtl838x_tbl_regs[] = {
+	TBL_DESC(0x6900, 0x6908, 3, 15, 13, 1),		/* RTL8380_TBL_L2 */
+	TBL_DESC(0x6914, 0x6918, 18, 14, 12, 1),	/* RTL8380_TBL_0 */
+	TBL_DESC(0xA4C8, 0xA4CC, 6, 14, 12, 1),		/* RTL8380_TBL_1 */
+
+	TBL_DESC(0x1180, 0x1184, 3, 16, 14, 0),		/* RTL8390_TBL_L2 */
+	TBL_DESC(0x1190, 0x1194, 17, 15, 12, 0),	/* RTL8390_TBL_0 */
+	TBL_DESC(0x6B80, 0x6B84, 4, 14, 12, 0),		/* RTL8390_TBL_1 */
+	TBL_DESC(0x611C, 0x6120, 9, 8, 6, 0),		/* RTL8390_TBL_2 */
+
+	TBL_DESC(0xB320, 0xB334, 3, 18, 16, 0),		/* RTL9300_TBL_L2 */
+	TBL_DESC(0xB340, 0xB344, 19, 16, 12, 0),	/* RTL9300_TBL_0 */
+	TBL_DESC(0xB3A0, 0xB3A4, 20, 16, 13, 0),	/* RTL9300_TBL_1 */
+	TBL_DESC(0xCE04, 0xCE08, 6, 14, 12, 0),		/* RTL9300_TBL_2 */
+	TBL_DESC(0xD600, 0xD604, 30, 7, 6, 0),		/* RTL9300_TBL_HSB */
+	TBL_DESC(0x7880, 0x7884, 22, 9, 8, 0),		/* RTL9300_TBL_HSA */
+
+	TBL_DESC(0x8500, 0x8508, 8, 19, 15, 0),		/* RTL9310_TBL_0 */
+	TBL_DESC(0x40C0, 0x40C4, 22, 16, 14, 0),	/* RTL9310_TBL_1 */
+	TBL_DESC(0x8528, 0x852C, 6, 18, 14, 0),		/* RTL9310_TBL_2 */
+	TBL_DESC(0x0200, 0x0204, 9, 15, 12, 0),		/* RTL9310_TBL_3 */
+	TBL_DESC(0x20dc, 0x20e0, 29, 7, 6, 0),		/* RTL9310_TBL_4 */
+	TBL_DESC(0x7e1c, 0x7e20, 53, 8, 6, 0),		/* RTL9310_TBL_5 */
+};
+
+void rtl_table_init(void)
+{
+	for (int i = 0; i < RTL_TBL_END; i++)
+		mutex_init(&rtl838x_tbl_regs[i].lock);
+}
+
+/* Request access to table t in table access register r
+ * Returns a handle to a lock for that table
+ */
+struct table_reg *rtl_table_get(rtl838x_tbl_reg_t r, int t)
+{
+	if (r >= RTL_TBL_END)
+		return NULL;
+
+	if (t >= BIT(rtl838x_tbl_regs[r].c_bit-rtl838x_tbl_regs[r].t_bit))
+		return NULL;
+
+	mutex_lock(&rtl838x_tbl_regs[r].lock);
+	rtl838x_tbl_regs[r].tbl = t;
+
+	return &rtl838x_tbl_regs[r];
+}
+
+/* Release a table r, unlock the corresponding lock */
+void rtl_table_release(struct table_reg *r)
+{
+	if (!r)
+		return;
+
+/*	pr_info("Unlocking %08x\n", (u32)r); */
+	mutex_unlock(&r->lock);
+/*	pr_info("Unlock done\n"); */
+}
+
+static int rtl_table_exec(struct table_reg *r, bool is_write, int idx)
+{
+	int ret = 0;
+	u32 cmd, val;
+
+	/* Read/write bit has inverted meaning on RTL838x */
+	if (r->rmode)
+		cmd = is_write ? 0 : BIT(r->c_bit);
+	else
+		cmd = is_write ? BIT(r->c_bit) : 0;
+
+	cmd |= BIT(r->c_bit + 1); /* Execute bit */
+	cmd |= r->tbl << r->t_bit; /* Table type */
+	cmd |= idx & (BIT(r->t_bit) - 1); /* Index */
+
+	sw_w32(cmd, r->addr);
+
+	ret = readx_poll_timeout(sw_r32, r->addr, val,
+				 !(val & BIT(r->c_bit + 1)), 20, 10000);
+	if (ret)
+		pr_err("%s: timeout\n", __func__);
+
+	return ret;
+}
+
+/* Reads table index idx into the data registers of the table */
+int rtl_table_read(struct table_reg *r, int idx)
+{
+	return rtl_table_exec(r, false, idx);
+}
+
+/* Writes the content of the table data registers into the table at index idx */
+int rtl_table_write(struct table_reg *r, int idx)
+{
+	return rtl_table_exec(r, true, idx);
+}
+
+/* Returns the address of the ith data register of table register r
+ * the address is relative to the beginning of the Switch-IO block at 0xbb000000
+ */
+inline u16 rtl_table_data(struct table_reg *r, int i)
+{
+	if (i >= r->max_data)
+		i = r->max_data - 1;
+	return r->data + i * 4;
+}
+
+inline u32 rtl_table_data_r(struct table_reg *r, int i)
+{
+	return sw_r32(rtl_table_data(r, i));
+}
+
+inline void rtl_table_data_w(struct table_reg *r, u32 v, int i)
+{
+	sw_w32(v, rtl_table_data(r, i));
+}
+
+/* Port register accessor functions for the RTL838x and RTL930X SoCs */
+void rtl838x_mask_port_reg(u64 clear, u64 set, int reg)
+{
+	sw_w32_mask((u32)clear, (u32)set, reg);
+}
+
+void rtl838x_set_port_reg(u64 set, int reg)
+{
+	sw_w32((u32)set, reg);
+}
+
+u64 rtl838x_get_port_reg(int reg)
+{
+	return ((u64)sw_r32(reg));
+}
+
+/* Port register accessor functions for the RTL839x and RTL931X SoCs */
+void rtl839x_mask_port_reg_be(u64 clear, u64 set, int reg)
+{
+	sw_w32_mask((u32)(clear >> 32), (u32)(set >> 32), reg);
+	sw_w32_mask((u32)(clear & 0xffffffff), (u32)(set & 0xffffffff), reg + 4);
+}
+
+u64 rtl839x_get_port_reg_be(int reg)
+{
+	u64 v = sw_r32(reg);
+
+	v <<= 32;
+	v |= sw_r32(reg + 4);
+
+	return v;
+}
+
+void rtl839x_set_port_reg_be(u64 set, int reg)
+{
+	sw_w32(set >> 32, reg);
+	sw_w32(set & 0xffffffff, reg + 4);
+}
+
+void rtl839x_mask_port_reg_le(u64 clear, u64 set, int reg)
+{
+	sw_w32_mask((u32)clear, (u32)set, reg);
+	sw_w32_mask((u32)(clear >> 32), (u32)(set >> 32), reg + 4);
+}
+
+void rtl839x_set_port_reg_le(u64 set, int reg)
+{
+	sw_w32(set, reg);
+	sw_w32(set >> 32, reg + 4);
+}
+
+u64 rtl839x_get_port_reg_le(int reg)
+{
+	u64 v = sw_r32(reg + 4);
+
+	v <<= 32;
+	v |= sw_r32(reg);
+
+	return v;
+}
+
+int read_phy(u32 port, u32 page, u32 reg, u32 *val)
+{
+	switch (soc_info.family) {
+	case RTL8380_FAMILY_ID:
+		return rtl838x_read_phy(port, page, reg, val);
+	case RTL8390_FAMILY_ID:
+		return rtl839x_read_phy(port, page, reg, val);
+	case RTL9300_FAMILY_ID:
+		return rtl930x_read_phy(port, page, reg, val);
+	case RTL9310_FAMILY_ID:
+		return rtl931x_read_phy(port, page, reg, val);
+	}
+
+	return -1;
+}
+
+int write_phy(u32 port, u32 page, u32 reg, u32 val)
+{
+	switch (soc_info.family) {
+	case RTL8380_FAMILY_ID:
+		return rtl838x_write_phy(port, page, reg, val);
+	case RTL8390_FAMILY_ID:
+		return rtl839x_write_phy(port, page, reg, val);
+	case RTL9300_FAMILY_ID:
+		return rtl930x_write_phy(port, page, reg, val);
+	case RTL9310_FAMILY_ID:
+		return rtl931x_write_phy(port, page, reg, val);
+	}
+
+	return -1;
+}
+
+static int __init rtl83xx_mdio_probe(struct rtl838x_switch_priv *priv)
+{
+	struct device *dev = priv->dev;
+	struct device_node *dn, *phy_node, *mii_np = dev->of_node;
+	struct mii_bus *bus;
+	int ret;
+	u32 pn;
+
+	pr_debug("In %s\n", __func__);
+	mii_np = of_find_compatible_node(NULL, NULL, "realtek,rtl838x-mdio");
+	if (mii_np) {
+		pr_debug("Found compatible MDIO node!\n");
+	} else {
+		dev_err(priv->dev, "no %s child node found", "mdio-bus");
+		return -ENODEV;
+	}
+
+	priv->mii_bus = of_mdio_find_bus(mii_np);
+	if (!priv->mii_bus) {
+		pr_debug("Deferring probe of mdio bus\n");
+		return -EPROBE_DEFER;
+	}
+	if (!of_device_is_available(mii_np))
+		ret = -ENODEV;
+
+	bus = devm_mdiobus_alloc(priv->ds->dev);
+	if (!bus)
+		return -ENOMEM;
+
+	bus->name = "rtl838x slave mii";
+
+	/* Since the NIC driver is loaded first, we can use the mdio rw functions
+	 * assigned there.
+	 */
+	bus->read = priv->mii_bus->read;
+	bus->write = priv->mii_bus->write;
+	bus->read_paged = priv->mii_bus->read_paged;
+	bus->write_paged = priv->mii_bus->write_paged;
+	snprintf(bus->id, MII_BUS_ID_SIZE, "%s-%d", bus->name, dev->id);
+
+	bus->parent = dev;
+	priv->ds->slave_mii_bus = bus;
+	priv->ds->slave_mii_bus->priv = priv->mii_bus->priv;
+	priv->ds->slave_mii_bus->access_capabilities = priv->mii_bus->access_capabilities;
+
+	ret = mdiobus_register(priv->ds->slave_mii_bus);
+	if (ret && mii_np) {
+		of_node_put(dn);
+		return ret;
+	}
+
+	dn = of_find_compatible_node(NULL, NULL, "realtek,rtl83xx-switch");
+	if (!dn) {
+		dev_err(priv->dev, "No RTL switch node in DTS\n");
+		return -ENODEV;
+	}
+
+	for_each_node_by_name(dn, "port") {
+		phy_interface_t interface;
+		u32 led_set;
+
+		if (!of_device_is_available(dn))
+			continue;
+
+		if (of_property_read_u32(dn, "reg", &pn))
+			continue;
+
+		phy_node = of_parse_phandle(dn, "phy-handle", 0);
+		if (!phy_node) {
+			if (pn != priv->cpu_port)
+				dev_err(priv->dev, "Port node %d misses phy-handle\n", pn);
+			continue;
+		}
+
+		if (of_property_read_u32(phy_node, "sds", &priv->ports[pn].sds_num))
+			priv->ports[pn].sds_num = -1;
+		pr_debug("%s port %d has SDS %d\n", __func__, pn, priv->ports[pn].sds_num);
+
+		if (of_get_phy_mode(dn, &interface))
+			interface = PHY_INTERFACE_MODE_NA;
+		if (interface == PHY_INTERFACE_MODE_HSGMII)
+			priv->ports[pn].is2G5 = true;
+		if (interface == PHY_INTERFACE_MODE_USXGMII)
+			priv->ports[pn].is2G5 = priv->ports[pn].is10G = true;
+		if (interface == PHY_INTERFACE_MODE_10GBASER)
+			priv->ports[pn].is10G = true;
+
+		if (of_property_read_u32(dn, "led-set", &led_set))
+			led_set = 0;
+		priv->ports[pn].led_set = led_set;
+
+		/* Check for the integrated SerDes of the RTL8380M first */
+		if (of_property_read_bool(phy_node, "phy-is-integrated")
+		    && priv->id == 0x8380 && pn >= 24) {
+			pr_debug("----> FÓUND A SERDES\n");
+			priv->ports[pn].phy = PHY_RTL838X_SDS;
+			continue;
+		}
+
+		if (priv->id >= 0x9300) {
+			priv->ports[pn].phy_is_integrated = false;
+			if (of_property_read_bool(phy_node, "phy-is-integrated")) {
+				priv->ports[pn].phy_is_integrated = true;
+				priv->ports[pn].phy = PHY_RTL930X_SDS;
+			}
+		} else {
+			if (of_property_read_bool(phy_node, "phy-is-integrated") &&
+			    !of_property_read_bool(phy_node, "sfp")) {
+				priv->ports[pn].phy = PHY_RTL8218B_INT;
+				continue;
+			}
+		}
+
+		if (!of_property_read_bool(phy_node, "phy-is-integrated") &&
+		    of_property_read_bool(phy_node, "sfp")) {
+			priv->ports[pn].phy = PHY_RTL8214FC;
+			continue;
+		}
+
+		if (!of_property_read_bool(phy_node, "phy-is-integrated") &&
+		    !of_property_read_bool(phy_node, "sfp")) {
+			priv->ports[pn].phy = PHY_RTL8218B_EXT;
+			continue;
+		}
+	}
+
+	/* Disable MAC polling the PHY so that we can start configuration */
+	priv->r->set_port_reg_le(0ULL, priv->r->smi_poll_ctrl);
+
+	/* Enable PHY control via SoC */
+	if (priv->family_id == RTL8380_FAMILY_ID) {
+		/* Enable SerDes NWAY and PHY control via SoC */
+		sw_w32_mask(BIT(7), BIT(15), RTL838X_SMI_GLB_CTRL);
+	} else if (priv->family_id == RTL8390_FAMILY_ID) {
+		/* Disable PHY polling via SoC */
+		sw_w32_mask(BIT(7), 0, RTL839X_SMI_GLB_CTRL);
+	}
+
+	/* Power on fibre ports and reset them if necessary */
+	if (priv->ports[24].phy == PHY_RTL838X_SDS) {
+		pr_debug("Powering on fibre ports & reset\n");
+		rtl8380_sds_power(24, 1);
+		rtl8380_sds_power(26, 1);
+	}
+
+	pr_debug("%s done\n", __func__);
+
+	return 0;
+}
+
+static int __init rtl83xx_get_l2aging(struct rtl838x_switch_priv *priv)
+{
+	int t = sw_r32(priv->r->l2_ctrl_1);
+
+	t &= priv->family_id == RTL8380_FAMILY_ID ? 0x7fffff : 0x1FFFFF;
+
+	if (priv->family_id == RTL8380_FAMILY_ID)
+		t = t * 128 / 625; /* Aging time in seconds. 0: L2 aging disabled */
+	else
+		t = (t * 3) / 5;
+
+	pr_debug("L2 AGING time: %d sec\n", t);
+	pr_debug("Dynamic aging for ports: %x\n", sw_r32(priv->r->l2_port_aging_out));
+
+	return t;
+}
+
+/* Caller must hold priv->reg_mutex */
+int rtl83xx_lag_add(struct dsa_switch *ds, int group, int port, struct netdev_lag_upper_info *info)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	int i;
+	u32 algomsk = 0;
+	u32 algoidx = 0;
+
+	if (info->tx_type != NETDEV_LAG_TX_TYPE_HASH) {
+		pr_err("%s: Only mode LACP 802.3ad (4) allowed.\n", __func__);
+		return -EINVAL;
+	}
+
+	if (group >= priv->n_lags) {
+		pr_err("%s: LAG %d invalid.\n", __func__, group);
+		return -EINVAL;
+	}
+
+	if (port >= priv->cpu_port) {
+		pr_err("%s: Port %d invalid.\n", __func__, port);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < priv->n_lags; i++) {
+		if (priv->lags_port_members[i] & BIT_ULL(port))
+			break;
+	}
+	if (i != priv->n_lags) {
+		pr_err("%s: Port %d already member of LAG %d.\n", __func__, port, i);
+		return -ENOSPC;
+	}
+
+	switch(info->hash_type) {
+	case NETDEV_LAG_HASH_L2:
+		algomsk |= TRUNK_DISTRIBUTION_ALGO_DMAC_BIT;
+		algomsk |= TRUNK_DISTRIBUTION_ALGO_SMAC_BIT;
+	break;
+	case NETDEV_LAG_HASH_L23:
+		algomsk |= TRUNK_DISTRIBUTION_ALGO_DMAC_BIT;
+		algomsk |= TRUNK_DISTRIBUTION_ALGO_SMAC_BIT;
+		algomsk |= TRUNK_DISTRIBUTION_ALGO_SIP_BIT; /* source ip */
+		algomsk |= TRUNK_DISTRIBUTION_ALGO_DIP_BIT; /* dest ip */
+		algoidx = 1;
+	break;
+	case NETDEV_LAG_HASH_L34:
+		algomsk |= TRUNK_DISTRIBUTION_ALGO_SRC_L4PORT_BIT; /* sport */
+		algomsk |= TRUNK_DISTRIBUTION_ALGO_DST_L4PORT_BIT; /* dport */
+		algomsk |= TRUNK_DISTRIBUTION_ALGO_SIP_BIT; /* source ip */
+		algomsk |= TRUNK_DISTRIBUTION_ALGO_DIP_BIT; /* dest ip */
+		algoidx = 2;
+	break;
+	default:
+		algomsk |= 0x7f;
+	}
+	priv->r->set_distribution_algorithm(group, algoidx, algomsk);
+	priv->r->mask_port_reg_be(0, BIT_ULL(port), priv->r->trk_mbr_ctr(group));
+	priv->lags_port_members[group] |= BIT_ULL(port);
+
+	pr_info("%s: Added port %d to LAG %d. Members now %016llx.\n",
+		 __func__, port, group, priv->lags_port_members[group]);
+
+	return 0;
+}
+
+/* Caller must hold priv->reg_mutex */
+int rtl83xx_lag_del(struct dsa_switch *ds, int group, int port)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+
+	if (group >= priv->n_lags) {
+		pr_err("%s: LAG %d invalid.\n", __func__, group);
+		return -EINVAL;
+	}
+
+	if (port >= priv->cpu_port) {
+		pr_err("%s: Port %d invalid.\n", __func__, port);
+		return -EINVAL;
+	}
+
+	if (!(priv->lags_port_members[group] & BIT_ULL(port))) {
+		pr_err("%s: Port %d not member of LAG %d.\n", __func__, port, group);
+		return -ENOSPC;
+	}
+
+	/* 0x7f algo mask all */
+	priv->r->mask_port_reg_be(BIT_ULL(port), 0, priv->r->trk_mbr_ctr(group));
+	priv->lags_port_members[group] &= ~BIT_ULL(port);
+
+	pr_info("%s: Removed port %d from LAG %d. Members now %016llx.\n",
+		 __func__, port, group, priv->lags_port_members[group]);
+
+	return 0;
+}
+
+// Currently Unused
+// /* Allocate a 64 bit octet counter located in the LOG HW table */
+// static int rtl83xx_octet_cntr_alloc(struct rtl838x_switch_priv *priv)
+// {
+// 	int idx;
+
+// 	mutex_lock(&priv->reg_mutex);
+
+// 	idx = find_first_zero_bit(priv->octet_cntr_use_bm, MAX_COUNTERS);
+// 	if (idx >= priv->n_counters) {
+// 		mutex_unlock(&priv->reg_mutex);
+// 		return -1;
+// 	}
+
+// 	set_bit(idx, priv->octet_cntr_use_bm);
+// 	mutex_unlock(&priv->reg_mutex);
+
+// 	return idx;
+// }
+
+/* Allocate a 32-bit packet counter
+ * 2 32-bit packet counters share the location of a 64-bit octet counter
+ * Initially there are no free packet counters and 2 new ones need to be freed
+ * by allocating the corresponding octet counter
+ */
+int rtl83xx_packet_cntr_alloc(struct rtl838x_switch_priv *priv)
+{
+	int idx, j;
+
+	mutex_lock(&priv->reg_mutex);
+
+	/* Because initially no packet counters are free, the logic is reversed:
+	 * a 0-bit means the counter is already allocated (for octets)
+	 */
+	idx = find_first_bit(priv->packet_cntr_use_bm, MAX_COUNTERS * 2);
+	if (idx >= priv->n_counters * 2) {
+		j = find_first_zero_bit(priv->octet_cntr_use_bm, MAX_COUNTERS);
+		if (j >= priv->n_counters) {
+			mutex_unlock(&priv->reg_mutex);
+			return -1;
+		}
+		set_bit(j, priv->octet_cntr_use_bm);
+		idx = j * 2;
+		set_bit(j * 2 + 1, priv->packet_cntr_use_bm);
+
+	} else {
+		clear_bit(idx, priv->packet_cntr_use_bm);
+	}
+
+	mutex_unlock(&priv->reg_mutex);
+
+	return idx;
+}
+
+/* Add an L2 nexthop entry for the L3 routing system / PIE forwarding in the SoC
+ * Use VID and MAC in rtl838x_l2_entry to identify either a free slot in the L2 hash table
+ * or mark an existing entry as a nexthop by setting it's nexthop bit
+ * Called from the L3 layer
+ * The index in the L2 hash table is filled into nh->l2_id;
+ */
+int rtl83xx_l2_nexthop_add(struct rtl838x_switch_priv *priv, struct rtl83xx_nexthop *nh)
+{
+	struct rtl838x_l2_entry e;
+	u64 seed = priv->r->l2_hash_seed(nh->mac, nh->rvid);
+	u32 key = priv->r->l2_hash_key(priv, seed);
+	int idx = -1;
+	u64 entry;
+
+	pr_debug("%s searching for %08llx vid %d with key %d, seed: %016llx\n",
+		__func__, nh->mac, nh->rvid, key, seed);
+
+	e.type = L2_UNICAST;
+	u64_to_ether_addr(nh->mac, &e.mac[0]);
+	e.port = nh->port;
+
+	/* Loop over all entries in the hash-bucket and over the second block on 93xx SoCs */
+	for (int i = 0; i < priv->l2_bucket_size; i++) {
+		entry = priv->r->read_l2_entry_using_hash(key, i, &e);
+
+		if (!e.valid || ((entry & 0x0fffffffffffffffULL) == seed)) {
+			idx = i > 3 ? ((key >> 14) & 0xffff) | i >> 1
+					: ((key << 2) | i) & 0xffff;
+			break;
+		}
+	}
+
+	if (idx < 0) {
+		pr_err("%s: No more L2 forwarding entries available\n", __func__);
+		return -1;
+	}
+
+	/* Found an existing (e->valid is true) or empty entry, make it a nexthop entry */
+	nh->l2_id = idx;
+	if (e.valid) {
+		nh->port = e.port;
+		nh->vid = e.vid;		/* Save VID */
+		nh->rvid = e.rvid;
+		nh->dev_id = e.stack_dev;
+		/* If the entry is already a valid next hop entry, don't change it */
+		if (e.next_hop)
+			return 0;
+	} else {
+		e.valid = true;
+		e.is_static = true;
+		e.rvid = nh->rvid;
+		e.is_ip_mc = false;
+		e.is_ipv6_mc = false;
+		e.block_da = false;
+		e.block_sa = false;
+		e.suspended = false;
+		e.age = 0;			/* With port-ignore */
+		e.port = priv->port_ignore;
+		u64_to_ether_addr(nh->mac, &e.mac[0]);
+	}
+	e.next_hop = true;
+	e.nh_route_id = nh->id;			/* NH route ID takes place of VID */
+	e.nh_vlan_target = false;
+
+	priv->r->write_l2_entry_using_hash(idx >> 2, idx & 0x3, &e);
+
+	return 0;
+}
+
+/* Removes a Layer 2 next hop entry in the forwarding database
+ * If it was static, the entire entry is removed, otherwise the nexthop bit is cleared
+ * and we wait until the entry ages out
+ */
+int rtl83xx_l2_nexthop_rm(struct rtl838x_switch_priv *priv, struct rtl83xx_nexthop *nh)
+{
+	struct rtl838x_l2_entry e;
+	u32 key = nh->l2_id >> 2;
+	int i = nh->l2_id & 0x3;
+	u64 entry = entry = priv->r->read_l2_entry_using_hash(key, i, &e);
+
+	pr_debug("%s: id %d, key %d, index %d\n", __func__, nh->l2_id, key, i);
+	if (!e.valid) {
+		dev_err(priv->dev, "unknown nexthop, id %x\n", nh->l2_id);
+		return -1;
+	}
+
+	if (e.is_static)
+		e.valid = false;
+	e.next_hop = false;
+	e.vid = nh->vid;		/* Restore VID */
+	e.rvid = nh->rvid;
+
+	priv->r->write_l2_entry_using_hash(key, i, &e);
+
+	return 0;
+}
+
+static int rtl83xx_handle_changeupper(struct rtl838x_switch_priv *priv,
+				      struct net_device *ndev,
+				      struct netdev_notifier_changeupper_info *info)
+{
+	struct net_device *upper = info->upper_dev;
+	struct netdev_lag_upper_info *lag_upper_info = NULL;
+	int i, j, err;
+
+	if (!netif_is_lag_master(upper))
+		return 0;
+
+	mutex_lock(&priv->reg_mutex);
+
+	for (i = 0; i < priv->n_lags; i++) {
+		if ((!priv->lag_devs[i]) || (priv->lag_devs[i] == upper))
+			break;
+	}
+	for (j = 0; j < priv->cpu_port; j++) {
+		if (priv->ports[j].dp->slave == ndev)
+			break;
+	}
+	if (j >= priv->cpu_port) {
+		err = -EINVAL;
+		goto out;
+	}
+
+	if (info->linking) {
+		lag_upper_info = info->upper_info;
+		if (!priv->lag_devs[i])
+			priv->lag_devs[i] = upper;
+		err = rtl83xx_lag_add(priv->ds, i, priv->ports[j].dp->index, lag_upper_info);
+		if (err) {
+			err = -EINVAL;
+			goto out;
+		}
+	} else {
+		if (!priv->lag_devs[i])
+			err = -EINVAL;
+		err = rtl83xx_lag_del(priv->ds, i, priv->ports[j].dp->index);
+		if (err) {
+			err = -EINVAL;
+			goto out;
+		}
+		if (!priv->lags_port_members[i])
+			priv->lag_devs[i] = NULL;
+	}
+
+out:
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+/* Is the lower network device a DSA slave network device of our RTL930X-switch?
+ * Unfortunately we cannot just follow dev->dsa_prt as this is only set for the
+ * DSA master device.
+ */
+int rtl83xx_port_is_under(const struct net_device * dev, struct rtl838x_switch_priv *priv)
+{
+/* TODO: On 5.12:
+ * 	if(!dsa_slave_dev_check(dev)) {
+ *		netdev_info(dev, "%s: not a DSA device.\n", __func__);
+ *		return -EINVAL;
+ *	}
+ */
+
+	for (int i = 0; i < priv->cpu_port; i++) {
+		if (!priv->ports[i].dp)
+			continue;
+		if (priv->ports[i].dp->slave == dev)
+			return i;
+	}
+
+	return -EINVAL;
+}
+
+static int rtl83xx_netdevice_event(struct notifier_block *this,
+				   unsigned long event, void *ptr)
+{
+	struct net_device *ndev = netdev_notifier_info_to_dev(ptr);
+	struct rtl838x_switch_priv *priv;
+	int err;
+
+	pr_debug("In: %s, event: %lu\n", __func__, event);
+
+	if ((event != NETDEV_CHANGEUPPER) && (event != NETDEV_CHANGELOWERSTATE))
+		return NOTIFY_DONE;
+
+	priv = container_of(this, struct rtl838x_switch_priv, nb);
+	switch (event) {
+	case NETDEV_CHANGEUPPER:
+		err = rtl83xx_handle_changeupper(priv, ndev, ptr);
+		break;
+	}
+
+	if (err)
+		return err;
+
+	return NOTIFY_DONE;
+}
+
+const static struct rhashtable_params route_ht_params = {
+	.key_len     = sizeof(u32),
+	.key_offset  = offsetof(struct rtl83xx_route, gw_ip),
+	.head_offset = offsetof(struct rtl83xx_route, linkage),
+};
+
+/* Updates an L3 next hop entry in the ROUTING table */
+static int rtl83xx_l3_nexthop_update(struct rtl838x_switch_priv *priv,  __be32 ip_addr, u64 mac)
+{
+	struct rtl83xx_route *r;
+	struct rhlist_head *tmp, *list;
+
+	rcu_read_lock();
+	list = rhltable_lookup(&priv->routes, &ip_addr, route_ht_params);
+	if (!list) {
+		rcu_read_unlock();
+		return -ENOENT;
+	}
+
+	rhl_for_each_entry_rcu(r, tmp, list, linkage) {
+		pr_info("%s: Setting up fwding: ip %pI4, GW mac %016llx\n",
+			__func__, &ip_addr, mac);
+
+		/* Reads the ROUTING table entry associated with the route */
+		priv->r->route_read(r->id, r);
+		pr_info("Route with id %d to %pI4 / %d\n", r->id, &r->dst_ip, r->prefix_len);
+
+		r->nh.mac = r->nh.gw = mac;
+		r->nh.port = priv->port_ignore;
+		r->nh.id = r->id;
+
+		/* Do we need to explicitly add a DMAC entry with the route's nh index? */
+		if (priv->r->set_l3_egress_mac)
+			priv->r->set_l3_egress_mac(r->id, mac);
+
+		/* Update ROUTING table: map gateway-mac and switch-mac id to route id */
+		rtl83xx_l2_nexthop_add(priv, &r->nh);
+
+		r->attr.valid = true;
+		r->attr.action = ROUTE_ACT_FORWARD;
+		r->attr.type = 0;
+		r->attr.hit = false; /* Reset route-used indicator */
+
+		/* Add PIE entry with dst_ip and prefix_len */
+		r->pr.dip = r->dst_ip;
+		r->pr.dip_m = inet_make_mask(r->prefix_len);
+
+		if (r->is_host_route) {
+			int slot = priv->r->find_l3_slot(r, false);
+
+			pr_info("%s: Got slot for route: %d\n", __func__, slot);
+			priv->r->host_route_write(slot, r);
+		} else {
+			priv->r->route_write(r->id, r);
+			r->pr.fwd_sel = true;
+			r->pr.fwd_data = r->nh.l2_id;
+			r->pr.fwd_act = PIE_ACT_ROUTE_UC;
+		}
+
+		if (priv->r->set_l3_nexthop)
+			priv->r->set_l3_nexthop(r->nh.id, r->nh.l2_id, r->nh.if_id);
+
+		if (r->pr.id < 0) {
+			r->pr.packet_cntr = rtl83xx_packet_cntr_alloc(priv);
+			if (r->pr.packet_cntr >= 0) {
+				pr_info("Using packet counter %d\n", r->pr.packet_cntr);
+				r->pr.log_sel = true;
+				r->pr.log_data = r->pr.packet_cntr;
+			}
+			priv->r->pie_rule_add(priv, &r->pr);
+		} else {
+			int pkts = priv->r->packet_cntr_read(r->pr.packet_cntr);
+			pr_info("%s: total packets: %d\n", __func__, pkts);
+
+			priv->r->pie_rule_write(priv, r->pr.id, &r->pr);
+		}
+	}
+	rcu_read_unlock();
+
+	return 0;
+}
+
+static int rtl83xx_port_ipv4_resolve(struct rtl838x_switch_priv *priv,
+				     struct net_device *dev, __be32 ip_addr)
+{
+	struct neighbour *n = neigh_lookup(&arp_tbl, &ip_addr, dev);
+	int err = 0;
+	u64 mac;
+
+	if (!n) {
+		n = neigh_create(&arp_tbl, &ip_addr, dev);
+		if (IS_ERR(n))
+			return PTR_ERR(n);
+	}
+
+	/* If the neigh is already resolved, then go ahead and
+	 * install the entry, otherwise start the ARP process to
+	 * resolve the neigh.
+	 */
+	if (n->nud_state & NUD_VALID) {
+		mac = ether_addr_to_u64(n->ha);
+		pr_info("%s: resolved mac: %016llx\n", __func__, mac);
+		rtl83xx_l3_nexthop_update(priv, ip_addr, mac);
+	} else {
+		pr_info("%s: need to wait\n", __func__);
+		neigh_event_send(n, NULL);
+	}
+
+	neigh_release(n);
+
+	return err;
+}
+
+struct rtl83xx_walk_data {
+	struct rtl838x_switch_priv *priv;
+	int port;
+};
+
+static int rtl83xx_port_lower_walk(struct net_device *lower, struct netdev_nested_priv *_priv)
+{
+	struct rtl83xx_walk_data *data = (struct rtl83xx_walk_data *)_priv->data;
+	struct rtl838x_switch_priv *priv = data->priv;
+	int ret = 0;
+	int index;
+
+	index = rtl83xx_port_is_under(lower, priv);
+	data->port = index;
+	if (index >= 0) {
+		pr_debug("Found DSA-port, index %d\n", index);
+		ret = 1;
+	}
+
+	return ret;
+}
+
+int rtl83xx_port_dev_lower_find(struct net_device *dev, struct rtl838x_switch_priv *priv)
+{
+	struct rtl83xx_walk_data data;
+	struct netdev_nested_priv _priv;
+
+	data.priv = priv;
+	data.port = 0;
+	_priv.data = (void *)&data;
+
+	netdev_walk_all_lower_dev(dev, rtl83xx_port_lower_walk, &_priv);
+
+	return data.port;
+}
+
+static struct rtl83xx_route *rtl83xx_route_alloc(struct rtl838x_switch_priv *priv, u32 ip)
+{
+	struct rtl83xx_route *r;
+	int idx = 0, err;
+
+	mutex_lock(&priv->reg_mutex);
+
+	idx = find_first_zero_bit(priv->route_use_bm, MAX_ROUTES);
+	pr_debug("%s id: %d, ip %pI4\n", __func__, idx, &ip);
+
+	r = kzalloc(sizeof(*r), GFP_KERNEL);
+	if (!r) {
+		mutex_unlock(&priv->reg_mutex);
+		return r;
+	}
+
+	r->id = idx;
+	r->gw_ip = ip;
+	r->pr.id = -1; /* We still need to allocate a rule in HW */
+	r->is_host_route = false;
+
+	err = rhltable_insert(&priv->routes, &r->linkage, route_ht_params);
+	if (err) {
+		pr_err("Could not insert new rule\n");
+		mutex_unlock(&priv->reg_mutex);
+		goto out_free;
+	}
+
+	set_bit(idx, priv->route_use_bm);
+
+	mutex_unlock(&priv->reg_mutex);
+
+	return r;
+
+out_free:
+	kfree(r);
+
+	return NULL;
+}
+
+
+static struct rtl83xx_route *rtl83xx_host_route_alloc(struct rtl838x_switch_priv *priv, u32 ip)
+{
+	struct rtl83xx_route *r;
+	int idx = 0, err;
+
+	mutex_lock(&priv->reg_mutex);
+
+	idx = find_first_zero_bit(priv->host_route_use_bm, MAX_HOST_ROUTES);
+	pr_debug("%s id: %d, ip %pI4\n", __func__, idx, &ip);
+
+	r = kzalloc(sizeof(*r), GFP_KERNEL);
+	if (!r) {
+		mutex_unlock(&priv->reg_mutex);
+		return r;
+	}
+
+	/* We require a unique route ID irrespective of whether it is a prefix or host
+	 * route (on RTL93xx) as we use this ID to associate a DMAC and next-hop entry
+	 */
+	r->id = idx + MAX_ROUTES;
+
+	r->gw_ip = ip;
+	r->pr.id = -1; /* We still need to allocate a rule in HW */
+	r->is_host_route = true;
+
+	err = rhltable_insert(&priv->routes, &r->linkage, route_ht_params);
+	if (err) {
+		pr_err("Could not insert new rule\n");
+		mutex_unlock(&priv->reg_mutex);
+		goto out_free;
+	}
+
+	set_bit(idx, priv->host_route_use_bm);
+
+	mutex_unlock(&priv->reg_mutex);
+
+	return r;
+
+out_free:
+	kfree(r);
+
+	return NULL;
+}
+
+
+
+static void rtl83xx_route_rm(struct rtl838x_switch_priv *priv, struct rtl83xx_route *r)
+{
+	int id;
+
+	if (rhltable_remove(&priv->routes, &r->linkage, route_ht_params))
+		dev_warn(priv->dev, "Could not remove route\n");
+
+	if (r->is_host_route) {
+		id = priv->r->find_l3_slot(r, false);
+		pr_debug("%s: Got id for host route: %d\n", __func__, id);
+		r->attr.valid = false;
+		priv->r->host_route_write(id, r);
+		clear_bit(r->id - MAX_ROUTES, priv->host_route_use_bm);
+	} else {
+		/* If there is a HW representation of the route, delete it */
+		if (priv->r->route_lookup_hw) {
+			id = priv->r->route_lookup_hw(r);
+			pr_info("%s: Got id for prefix route: %d\n", __func__, id);
+			r->attr.valid = false;
+			priv->r->route_write(id, r);
+		}
+		clear_bit(r->id, priv->route_use_bm);
+	}
+
+	kfree(r);
+}
+
+static int rtl83xx_fib4_del(struct rtl838x_switch_priv *priv,
+			    struct fib_entry_notifier_info *info)
+{
+	struct fib_nh *nh = fib_info_nh(info->fi, 0);
+	struct rtl83xx_route *r;
+	struct rhlist_head *tmp, *list;
+
+	pr_debug("In %s, ip %pI4, len %d\n", __func__, &info->dst, info->dst_len);
+	rcu_read_lock();
+	list = rhltable_lookup(&priv->routes, &nh->fib_nh_gw4, route_ht_params);
+	if (!list) {
+		rcu_read_unlock();
+		pr_err("%s: no such gateway: %pI4\n", __func__, &nh->fib_nh_gw4);
+		return -ENOENT;
+	}
+	rhl_for_each_entry_rcu(r, tmp, list, linkage) {
+		if (r->dst_ip == info->dst && r->prefix_len == info->dst_len) {
+			pr_info("%s: found a route with id %d, nh-id %d\n",
+				__func__, r->id, r->nh.id);
+			break;
+		}
+	}
+	rcu_read_unlock();
+
+	rtl83xx_l2_nexthop_rm(priv, &r->nh);
+
+	pr_debug("%s: Releasing packet counter %d\n", __func__, r->pr.packet_cntr);
+	set_bit(r->pr.packet_cntr, priv->packet_cntr_use_bm);
+	priv->r->pie_rule_rm(priv, &r->pr);
+
+	rtl83xx_route_rm(priv, r);
+
+	nh->fib_nh_flags &= ~RTNH_F_OFFLOAD;
+
+	return 0;
+}
+
+/* On the RTL93xx, an L3 termination endpoint MAC address on which the router waits
+ * for packets to be routed needs to be allocated.
+ */
+static int rtl83xx_alloc_router_mac(struct rtl838x_switch_priv *priv, u64 mac)
+{
+	int free_mac = -1;
+	struct rtl93xx_rt_mac m;
+
+	mutex_lock(&priv->reg_mutex);
+	for (int i = 0; i < MAX_ROUTER_MACS; i++) {
+		priv->r->get_l3_router_mac(i, &m);
+		if (free_mac < 0 && !m.valid) {
+			free_mac = i;
+			continue;
+		}
+		if (m.valid && m.mac == mac) {
+			free_mac = i;
+			break;
+		}
+	}
+
+	if (free_mac < 0) {
+		pr_err("No free router MACs, cannot offload\n");
+		mutex_unlock(&priv->reg_mutex);
+		return -1;
+	}
+
+	m.valid = true;
+	m.mac = mac;
+	m.p_type = 0; /* An individual port, not a trunk port */
+	m.p_id = 0x3f;			/* Listen on any port */
+	m.p_id_mask = 0;
+	m.vid = 0;			/* Listen on any VLAN... */
+	m.vid_mask = 0; 		/* ... so mask needs to be 0 */
+	m.mac_mask = 0xffffffffffffULL;	/* We want an exact match of the interface MAC */
+	m.action = L3_FORWARD;		/* Route the packet */
+	priv->r->set_l3_router_mac(free_mac, &m);
+
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+static int rtl83xx_alloc_egress_intf(struct rtl838x_switch_priv *priv, u64 mac, int vlan)
+{
+	int free_mac = -1;
+	struct rtl838x_l3_intf intf;
+	u64 m;
+
+	mutex_lock(&priv->reg_mutex);
+	for (int i = 0; i < MAX_SMACS; i++) {
+		m = priv->r->get_l3_egress_mac(L3_EGRESS_DMACS + i);
+		if (free_mac < 0 && !m) {
+			free_mac = i;
+			continue;
+		}
+		if (m == mac) {
+			mutex_unlock(&priv->reg_mutex);
+			return i;
+		}
+	}
+
+	if (free_mac < 0) {
+		pr_err("No free egress interface, cannot offload\n");
+		return -1;
+	}
+
+	/* Set up default egress interface 1 */
+	intf.vid = vlan;
+	intf.smac_idx = free_mac;
+	intf.ip4_mtu_id = 1;
+	intf.ip6_mtu_id = 1;
+	intf.ttl_scope = 1; /* TTL */
+	intf.hl_scope = 1;  /* Hop Limit */
+	intf.ip4_icmp_redirect = intf.ip6_icmp_redirect = 2;  /* FORWARD */
+	intf.ip4_pbr_icmp_redirect = intf.ip6_pbr_icmp_redirect = 2; /* FORWARD; */
+	priv->r->set_l3_egress_intf(free_mac, &intf);
+
+	priv->r->set_l3_egress_mac(L3_EGRESS_DMACS + free_mac, mac);
+
+	mutex_unlock(&priv->reg_mutex);
+
+	return free_mac;
+}
+
+static int rtl83xx_fib4_add(struct rtl838x_switch_priv *priv,
+			    struct fib_entry_notifier_info *info)
+{
+	struct fib_nh *nh = fib_info_nh(info->fi, 0);
+	struct net_device *dev = fib_info_nh(info->fi, 0)->fib_nh_dev;
+	int port;
+	struct rtl83xx_route *r;
+	bool to_localhost;
+	int vlan = is_vlan_dev(dev) ? vlan_dev_vlan_id(dev) : 0;
+
+	pr_debug("In %s, ip %pI4, len %d\n", __func__, &info->dst, info->dst_len);
+	if (!info->dst) {
+		pr_info("Not offloading default route for now\n");
+		return 0;
+	}
+
+	pr_debug("GW: %pI4, interface name %s, mac %016llx, vlan %d\n", &nh->fib_nh_gw4, dev->name,
+		ether_addr_to_u64(dev->dev_addr), vlan
+	);
+
+	port = rtl83xx_port_dev_lower_find(dev, priv);
+	if (port < 0)
+		return -1;
+
+	/* For now we only work with routes that have a gateway and are not ourself */
+/*	if ((!nh->fib_nh_gw4) && (info->dst_len != 32)) */
+/*		return 0; */
+
+	if ((info->dst & 0xff) == 0xff)
+		return 0;
+
+	/* Do not offload routes to 192.168.100.x */
+	if ((info->dst & 0xffffff00) == 0xc0a86400)
+		return 0;
+
+	/* Do not offload routes to 127.x.x.x */
+	if ((info->dst & 0xff000000) == 0x7f000000)
+		return 0;
+
+	/* Allocate route or host-route (entry if hardware supports this) */
+	if (info->dst_len == 32 && priv->r->host_route_write)
+		r = rtl83xx_host_route_alloc(priv, nh->fib_nh_gw4);
+	else
+		r = rtl83xx_route_alloc(priv, nh->fib_nh_gw4);
+
+	if (!r) {
+		pr_err("%s: No more free route entries\n", __func__);
+		return -1;
+	}
+
+	r->dst_ip = info->dst;
+	r->prefix_len = info->dst_len;
+	r->nh.rvid = vlan;
+	to_localhost = !nh->fib_nh_gw4;
+
+	if (priv->r->set_l3_router_mac) {
+		u64 mac = ether_addr_to_u64(dev->dev_addr);
+
+		pr_debug("Local route and router mac %016llx\n", mac);
+
+		if (rtl83xx_alloc_router_mac(priv, mac))
+			goto out_free_rt;
+
+		/* vid = 0: Do not care about VID */
+		r->nh.if_id = rtl83xx_alloc_egress_intf(priv, mac, vlan);
+		if (r->nh.if_id < 0)
+			goto out_free_rmac;
+
+		if (to_localhost) {
+			int slot;
+
+			r->nh.mac = mac;
+			r->nh.port = priv->port_ignore;
+			r->attr.valid = true;
+			r->attr.action = ROUTE_ACT_TRAP2CPU;
+			r->attr.type = 0;
+
+			slot = priv->r->find_l3_slot(r, false);
+			pr_debug("%s: Got slot for route: %d\n", __func__, slot);
+			priv->r->host_route_write(slot, r);
+		}
+	}
+
+	/* We need to resolve the mac address of the GW */
+	if (!to_localhost)
+		rtl83xx_port_ipv4_resolve(priv, dev, nh->fib_nh_gw4);
+
+	nh->fib_nh_flags |= RTNH_F_OFFLOAD;
+
+	return 0;
+
+out_free_rmac:
+out_free_rt:
+	return 0;
+}
+
+static int rtl83xx_fib6_add(struct rtl838x_switch_priv *priv,
+			    struct fib6_entry_notifier_info *info)
+{
+	pr_debug("In %s\n", __func__);
+/*	nh->fib_nh_flags |= RTNH_F_OFFLOAD; */
+
+	return 0;
+}
+
+struct net_event_work {
+	struct work_struct work;
+	struct rtl838x_switch_priv *priv;
+	u64 mac;
+	u32 gw_addr;
+};
+
+static void rtl83xx_net_event_work_do(struct work_struct *work)
+{
+	struct net_event_work *net_work =
+		container_of(work, struct net_event_work, work);
+	struct rtl838x_switch_priv *priv = net_work->priv;
+
+	rtl83xx_l3_nexthop_update(priv, net_work->gw_addr, net_work->mac);
+
+	kfree(net_work);
+}
+
+static int rtl83xx_netevent_event(struct notifier_block *this,
+				 unsigned long event, void *ptr)
+{
+	struct rtl838x_switch_priv *priv;
+	struct net_device *dev;
+	struct neighbour *n = ptr;
+	int err, port;
+	struct net_event_work *net_work;
+
+	priv = container_of(this, struct rtl838x_switch_priv, ne_nb);
+
+	switch (event) {
+	case NETEVENT_NEIGH_UPDATE:
+		if (n->tbl != &arp_tbl)
+			return NOTIFY_DONE;
+		dev = n->dev;
+		port = rtl83xx_port_dev_lower_find(dev, priv);
+		if (port < 0 || !(n->nud_state & NUD_VALID)) {
+			pr_debug("%s: Neigbour invalid, not updating\n", __func__);
+			return NOTIFY_DONE;
+		}
+
+		net_work = kzalloc(sizeof(*net_work), GFP_ATOMIC);
+		if (!net_work)
+			return NOTIFY_BAD;
+
+		INIT_WORK(&net_work->work, rtl83xx_net_event_work_do);
+		net_work->priv = priv;
+
+		net_work->mac = ether_addr_to_u64(n->ha);
+		net_work->gw_addr = *(__be32 *) n->primary_key;
+
+		pr_debug("%s: updating neighbour on port %d, mac %016llx\n",
+			__func__, port, net_work->mac);
+		schedule_work(&net_work->work);
+		if (err)
+			netdev_warn(dev, "failed to handle neigh update (err %d)\n", err);
+		break;
+	}
+
+	return NOTIFY_DONE;
+}
+
+struct rtl83xx_fib_event_work {
+	struct work_struct work;
+	union {
+		struct fib_entry_notifier_info fen_info;
+		struct fib6_entry_notifier_info fen6_info;
+		struct fib_rule_notifier_info fr_info;
+	};
+	struct rtl838x_switch_priv *priv;
+	bool is_fib6;
+	unsigned long event;
+};
+
+static void rtl83xx_fib_event_work_do(struct work_struct *work)
+{
+	struct rtl83xx_fib_event_work *fib_work =
+		container_of(work, struct rtl83xx_fib_event_work, work);
+	struct rtl838x_switch_priv *priv = fib_work->priv;
+	struct fib_rule *rule;
+	int err;
+
+	/* Protect internal structures from changes */
+	rtnl_lock();
+	pr_debug("%s: doing work, event %ld\n", __func__, fib_work->event);
+	switch (fib_work->event) {
+	case FIB_EVENT_ENTRY_ADD:
+	case FIB_EVENT_ENTRY_REPLACE:
+	case FIB_EVENT_ENTRY_APPEND:
+		if (fib_work->is_fib6) {
+			err = rtl83xx_fib6_add(priv, &fib_work->fen6_info);
+		} else {
+			err = rtl83xx_fib4_add(priv, &fib_work->fen_info);
+			fib_info_put(fib_work->fen_info.fi);
+		}
+		if (err)
+			pr_err("%s: FIB4 failed\n", __func__);
+		break;
+	case FIB_EVENT_ENTRY_DEL:
+		rtl83xx_fib4_del(priv, &fib_work->fen_info);
+		fib_info_put(fib_work->fen_info.fi);
+		break;
+	case FIB_EVENT_RULE_ADD:
+	case FIB_EVENT_RULE_DEL:
+		rule = fib_work->fr_info.rule;
+		if (!fib4_rule_default(rule))
+			pr_err("%s: FIB4 default rule failed\n", __func__);
+		fib_rule_put(rule);
+		break;
+	}
+	rtnl_unlock();
+	kfree(fib_work);
+}
+
+/* Called with rcu_read_lock() */
+static int rtl83xx_fib_event(struct notifier_block *this, unsigned long event, void *ptr)
+{
+	struct fib_notifier_info *info = ptr;
+	struct rtl838x_switch_priv *priv;
+	struct rtl83xx_fib_event_work *fib_work;
+
+	if ((info->family != AF_INET && info->family != AF_INET6 &&
+	     info->family != RTNL_FAMILY_IPMR &&
+	     info->family != RTNL_FAMILY_IP6MR))
+		return NOTIFY_DONE;
+
+	priv = container_of(this, struct rtl838x_switch_priv, fib_nb);
+
+	fib_work = kzalloc(sizeof(*fib_work), GFP_ATOMIC);
+	if (!fib_work)
+		return NOTIFY_BAD;
+
+	INIT_WORK(&fib_work->work, rtl83xx_fib_event_work_do);
+	fib_work->priv = priv;
+	fib_work->event = event;
+	fib_work->is_fib6 = false;
+
+	switch (event) {
+	case FIB_EVENT_ENTRY_ADD:
+	case FIB_EVENT_ENTRY_REPLACE:
+	case FIB_EVENT_ENTRY_APPEND:
+	case FIB_EVENT_ENTRY_DEL:
+		pr_debug("%s: FIB_ENTRY ADD/DEL, event %ld\n", __func__, event);
+		if (info->family == AF_INET) {
+			struct fib_entry_notifier_info *fen_info = ptr;
+
+			if (fen_info->fi->fib_nh_is_v6) {
+				NL_SET_ERR_MSG_MOD(info->extack,
+					"IPv6 gateway with IPv4 route is not supported");
+				kfree(fib_work);
+				return notifier_from_errno(-EINVAL);
+			}
+
+			memcpy(&fib_work->fen_info, ptr, sizeof(fib_work->fen_info));
+			/* Take referece on fib_info to prevent it from being
+			* freed while work is queued. Release it afterwards.
+			*/
+			fib_info_hold(fib_work->fen_info.fi);
+
+		} else if (info->family == AF_INET6) {
+			//struct fib6_entry_notifier_info *fen6_info = ptr;
+			pr_warn("%s: FIB_RULE ADD/DEL for IPv6 not supported\n", __func__);
+			kfree(fib_work);
+			return NOTIFY_DONE;
+		}
+		break;
+
+	case FIB_EVENT_RULE_ADD:
+	case FIB_EVENT_RULE_DEL:
+		pr_debug("%s: FIB_RULE ADD/DEL, event: %ld\n", __func__, event);
+		memcpy(&fib_work->fr_info, ptr, sizeof(fib_work->fr_info));
+		fib_rule_get(fib_work->fr_info.rule);
+		break;
+	}
+
+	schedule_work(&fib_work->work);
+
+	return NOTIFY_DONE;
+}
+
+static int __init rtl83xx_sw_probe(struct platform_device *pdev)
+{
+	int err = 0;
+	struct rtl838x_switch_priv *priv;
+	struct device *dev = &pdev->dev;
+	u64 bpdu_mask;
+
+	pr_debug("Probing RTL838X switch device\n");
+	if (!pdev->dev.of_node) {
+		dev_err(dev, "No DT found\n");
+		return -EINVAL;
+	}
+
+	/* Initialize access to RTL switch tables */
+	rtl_table_init();
+
+	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	priv->ds = devm_kzalloc(dev, sizeof(*priv->ds), GFP_KERNEL);
+
+	if (!priv->ds)
+		return -ENOMEM;
+	priv->ds->dev = dev;
+	priv->ds->priv = priv;
+	priv->ds->ops = &rtl83xx_switch_ops;
+	priv->ds->needs_standalone_vlan_filtering = true;
+	priv->dev = dev;
+
+	mutex_init(&priv->reg_mutex);
+
+	priv->family_id = soc_info.family;
+	priv->id = soc_info.id;
+	switch(soc_info.family) {
+	case RTL8380_FAMILY_ID:
+		priv->ds->ops = &rtl83xx_switch_ops;
+		priv->cpu_port = RTL838X_CPU_PORT;
+		priv->port_mask = 0x1f;
+		priv->port_width = 1;
+		priv->irq_mask = 0x0FFFFFFF;
+		priv->r = &rtl838x_reg;
+		priv->ds->num_ports = 29;
+		priv->fib_entries = 8192;
+		rtl8380_get_version(priv);
+		priv->n_lags = 8;
+		priv->l2_bucket_size = 4;
+		priv->n_pie_blocks = 12;
+		priv->port_ignore = 0x1f;
+		priv->n_counters = 128;
+		break;
+	case RTL8390_FAMILY_ID:
+		priv->ds->ops = &rtl83xx_switch_ops;
+		priv->cpu_port = RTL839X_CPU_PORT;
+		priv->port_mask = 0x3f;
+		priv->port_width = 2;
+		priv->irq_mask = 0xFFFFFFFFFFFFFULL;
+		priv->r = &rtl839x_reg;
+		priv->ds->num_ports = 53;
+		priv->fib_entries = 16384;
+		rtl8390_get_version(priv);
+		priv->n_lags = 16;
+		priv->l2_bucket_size = 4;
+		priv->n_pie_blocks = 18;
+		priv->port_ignore = 0x3f;
+		priv->n_counters = 1024;
+		break;
+	case RTL9300_FAMILY_ID:
+		priv->ds->ops = &rtl930x_switch_ops;
+		priv->cpu_port = RTL930X_CPU_PORT;
+		priv->port_mask = 0x1f;
+		priv->port_width = 1;
+		priv->irq_mask = 0x0FFFFFFF;
+		priv->r = &rtl930x_reg;
+		priv->ds->num_ports = 29;
+		priv->fib_entries = 16384;
+		priv->version = RTL8390_VERSION_A;
+		priv->n_lags = 16;
+		sw_w32(1, RTL930X_ST_CTRL);
+		priv->l2_bucket_size = 8;
+		priv->n_pie_blocks = 16;
+		priv->port_ignore = 0x3f;
+		priv->n_counters = 2048;
+		break;
+	case RTL9310_FAMILY_ID:
+		priv->ds->ops = &rtl930x_switch_ops;
+		priv->cpu_port = RTL931X_CPU_PORT;
+		priv->port_mask = 0x3f;
+		priv->port_width = 2;
+		priv->irq_mask = 0xFFFFFFFFFFFFFULL;
+		priv->r = &rtl931x_reg;
+		priv->ds->num_ports = 57;
+		priv->fib_entries = 16384;
+		priv->version = RTL8390_VERSION_A;
+		priv->n_lags = 16;
+		priv->l2_bucket_size = 8;
+		break;
+	}
+	pr_debug("Chip version %c\n", priv->version);
+
+	err = rtl83xx_mdio_probe(priv);
+	if (err) {
+		/* Probing fails the 1st time because of missing ethernet driver
+		 * initialization. Use this to disable traffic in case the bootloader left if on
+		 */
+		return err;
+	}
+
+	err = dsa_register_switch(priv->ds);
+	if (err) {
+		dev_err(dev, "Error registering switch: %d\n", err);
+		return err;
+	}
+
+	/* dsa_to_port returns dsa_port from the port list in
+	 * dsa_switch_tree, the tree is built when the switch
+	 * is registered by dsa_register_switch
+	 */
+	for (int i = 0; i <= priv->cpu_port; i++)
+		priv->ports[i].dp = dsa_to_port(priv->ds, i);
+
+	/* Enable link and media change interrupts. Are the SERDES masks needed? */
+	sw_w32_mask(0, 3, priv->r->isr_glb_src);
+
+	priv->r->set_port_reg_le(priv->irq_mask, priv->r->isr_port_link_sts_chg);
+	priv->r->set_port_reg_le(priv->irq_mask, priv->r->imr_port_link_sts_chg);
+
+	priv->link_state_irq = platform_get_irq(pdev, 0);
+	pr_info("LINK state irq: %d\n", priv->link_state_irq);
+	switch (priv->family_id) {
+	case RTL8380_FAMILY_ID:
+		err = request_irq(priv->link_state_irq, rtl838x_switch_irq,
+		                  IRQF_SHARED, "rtl838x-link-state", priv->ds);
+		break;
+	case RTL8390_FAMILY_ID:
+		err = request_irq(priv->link_state_irq, rtl839x_switch_irq,
+		                  IRQF_SHARED, "rtl839x-link-state", priv->ds);
+		break;
+	case RTL9300_FAMILY_ID:
+		err = request_irq(priv->link_state_irq, rtl930x_switch_irq,
+				  IRQF_SHARED, "rtl930x-link-state", priv->ds);
+		break;
+	case RTL9310_FAMILY_ID:
+		err = request_irq(priv->link_state_irq, rtl931x_switch_irq,
+		                  IRQF_SHARED, "rtl931x-link-state", priv->ds);
+		break;
+	}
+	if (err) {
+		dev_err(dev, "Error setting up switch interrupt.\n");
+		/* Need to free allocated switch here */
+	}
+
+	/* Enable interrupts for switch, on RTL931x, the IRQ is always on globally */
+	if (soc_info.family != RTL9310_FAMILY_ID)
+		sw_w32(0x1, priv->r->imr_glb);
+
+	rtl83xx_get_l2aging(priv);
+
+	rtl83xx_setup_qos(priv);
+
+	priv->r->l3_setup(priv);
+
+	/* Clear all destination ports for mirror groups */
+	for (int i = 0; i < 4; i++)
+		priv->mirror_group_ports[i] = -1;
+
+	/* Register netdevice event callback to catch changes in link aggregation groups */
+	priv->nb.notifier_call = rtl83xx_netdevice_event;
+	if (register_netdevice_notifier(&priv->nb)) {
+		priv->nb.notifier_call = NULL;
+		dev_err(dev, "Failed to register LAG netdev notifier\n");
+		goto err_register_nb;
+	}
+
+	/* Initialize hash table for L3 routing */
+	rhltable_init(&priv->routes, &route_ht_params);
+
+	/* Register netevent notifier callback to catch notifications about neighboring
+	 * changes to update nexthop entries for L3 routing.
+	 */
+	priv->ne_nb.notifier_call = rtl83xx_netevent_event;
+	if (register_netevent_notifier(&priv->ne_nb)) {
+		priv->ne_nb.notifier_call = NULL;
+		dev_err(dev, "Failed to register netevent notifier\n");
+		goto err_register_ne_nb;
+	}
+
+	priv->fib_nb.notifier_call = rtl83xx_fib_event;
+
+	/* Register Forwarding Information Base notifier to offload routes where
+	 * where possible
+	 * Only FIBs pointing to our own netdevs are programmed into
+	 * the device, so no need to pass a callback.
+	 */
+	err = register_fib_notifier(&init_net, &priv->fib_nb, NULL, NULL);
+	if (err)
+		goto err_register_fib_nb;
+
+	/* TODO: put this into l2_setup() */
+	/* Flood BPDUs to all ports including cpu-port */
+	if (soc_info.family != RTL9300_FAMILY_ID) {
+		bpdu_mask = soc_info.family == RTL8380_FAMILY_ID ? 0x1FFFFFFF : 0x1FFFFFFFFFFFFF;
+		priv->r->set_port_reg_be(bpdu_mask, priv->r->rma_bpdu_fld_pmask);
+
+		/* TRAP 802.1X frames (EAPOL) to the CPU-Port, bypass STP and VLANs */
+		sw_w32(7, priv->r->spcl_trap_eapol_ctrl);
+
+		rtl838x_dbgfs_init(priv);
+	} else {
+		rtl930x_dbgfs_init(priv);
+	}
+
+	return 0;
+
+err_register_fib_nb:
+	unregister_netevent_notifier(&priv->ne_nb);
+err_register_ne_nb:
+	unregister_netdevice_notifier(&priv->nb);
+err_register_nb:
+	return err;
+}
+
+static int rtl83xx_sw_remove(struct platform_device *pdev)
+{
+	/* TODO: */
+	pr_debug("Removing platform driver for rtl83xx-sw\n");
+
+	return 0;
+}
+
+static const struct of_device_id rtl83xx_switch_of_ids[] = {
+	{ .compatible = "realtek,rtl83xx-switch"},
+	{ /* sentinel */ }
+};
+
+
+MODULE_DEVICE_TABLE(of, rtl83xx_switch_of_ids);
+
+static struct platform_driver rtl83xx_switch_driver = {
+	.probe = rtl83xx_sw_probe,
+	.remove = rtl83xx_sw_remove,
+	.driver = {
+		.name = "rtl83xx-switch",
+		.pm = NULL,
+		.of_match_table = rtl83xx_switch_of_ids,
+	},
+};
+
+module_platform_driver(rtl83xx_switch_driver);
+
+MODULE_AUTHOR("B. Koblitz");
+MODULE_DESCRIPTION("RTL83XX SoC Switch Driver");
+MODULE_LICENSE("GPL");
diff --git a/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/debugfs.c b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/debugfs.c
new file mode 100644
index 00000000000000..f46833f6f7b5c2
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/debugfs.c
@@ -0,0 +1,729 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <linux/debugfs.h>
+#include <linux/kernel.h>
+#include <asm/mach-rtl838x/mach-rtl83xx.h>
+
+#include "rtl83xx.h"
+
+#define RTL838X_DRIVER_NAME "rtl838x"
+
+#define RTL8380_LED_GLB_CTRL			(0xA000)
+#define RTL8380_LED_MODE_SEL			(0x1004)
+#define RTL8380_LED_MODE_CTRL			(0xA004)
+#define RTL8380_LED_P_EN_CTRL			(0xA008)
+#define RTL8380_LED_SW_CTRL			(0xA00C)
+#define RTL8380_LED0_SW_P_EN_CTRL		(0xA010)
+#define RTL8380_LED1_SW_P_EN_CTRL		(0xA014)
+#define RTL8380_LED2_SW_P_EN_CTRL		(0xA018)
+#define RTL8380_LED_SW_P_CTRL(p)		(0xA01C + (((p) << 2)))
+
+#define RTL8390_LED_GLB_CTRL			(0x00E4)
+#define RTL8390_LED_SET_2_3_CTRL		(0x00E8)
+#define RTL8390_LED_SET_0_1_CTRL		(0x00EC)
+#define RTL8390_LED_COPR_SET_SEL_CTRL(p)	(0x00F0 + (((p >> 4) << 2)))
+#define RTL8390_LED_FIB_SET_SEL_CTRL(p)		(0x0100 + (((p >> 4) << 2)))
+#define RTL8390_LED_COPR_PMASK_CTRL(p)		(0x0110 + (((p >> 5) << 2)))
+#define RTL8390_LED_FIB_PMASK_CTRL(p)		(0x00118 + (((p >> 5) << 2)))
+#define RTL8390_LED_COMBO_CTRL(p)		(0x0120 + (((p >> 5) << 2)))
+#define RTL8390_LED_SW_CTRL			(0x0128)
+#define RTL8390_LED_SW_P_EN_CTRL(p)		(0x012C + (((p / 10) << 2)))
+#define RTL8390_LED_SW_P_CTRL(p)		(0x0144 + (((p) << 2)))
+
+#define RTL838X_MIR_QID_CTRL(grp)		(0xAD44 + (((grp) << 2)))
+#define RTL838X_MIR_RSPAN_VLAN_CTRL(grp)	(0xA340 + (((grp) << 2)))
+#define RTL838X_MIR_RSPAN_VLAN_CTRL_MAC(grp)	(0xAA70 + (((grp) << 2)))
+#define RTL838X_MIR_RSPAN_TX_CTRL		(0xA350)
+#define RTL838X_MIR_RSPAN_TX_TAG_RM_CTRL	(0xAA80)
+#define RTL838X_MIR_RSPAN_TX_TAG_EN_CTRL	(0xAA84)
+#define RTL839X_MIR_RSPAN_VLAN_CTRL(grp)	(0xA340 + (((grp) << 2)))
+#define RTL839X_MIR_RSPAN_TX_CTRL		(0x69b0)
+#define RTL839X_MIR_RSPAN_TX_TAG_RM_CTRL	(0x2550)
+#define RTL839X_MIR_RSPAN_TX_TAG_EN_CTRL	(0x2554)
+#define RTL839X_MIR_SAMPLE_RATE_CTRL		(0x2558)
+
+#define RTL838X_STAT_PRVTE_DROP_COUNTERS	(0x6A00)
+#define RTL839X_STAT_PRVTE_DROP_COUNTERS	(0x3E00)
+#define RTL930X_STAT_PRVTE_DROP_COUNTERS	(0xB5B8)
+#define RTL931X_STAT_PRVTE_DROP_COUNTERS	(0xd800)
+
+int rtl83xx_port_get_stp_state(struct rtl838x_switch_priv *priv, int port);
+void rtl83xx_port_stp_state_set(struct dsa_switch *ds, int port, u8 state);
+void rtl83xx_fast_age(struct dsa_switch *ds, int port);
+u32 rtl838x_get_egress_rate(struct rtl838x_switch_priv *priv, int port);
+u32 rtl839x_get_egress_rate(struct rtl838x_switch_priv *priv, int port);
+int rtl838x_set_egress_rate(struct rtl838x_switch_priv *priv, int port, u32 rate);
+int rtl839x_set_egress_rate(struct rtl838x_switch_priv *priv, int port, u32 rate);
+
+
+const char *rtl838x_drop_cntr[] = {
+    "ALE_TX_GOOD_PKTS", "MAC_RX_DROP", "ACL_FWD_DROP", "HW_ATTACK_PREVENTION_DROP",
+    "RMA_DROP", "VLAN_IGR_FLTR_DROP", "INNER_OUTER_CFI_EQUAL_1_DROP", "PORT_MOVE_DROP",
+    "NEW_SA_DROP", "MAC_LIMIT_SYS_DROP", "MAC_LIMIT_VLAN_DROP", "MAC_LIMIT_PORT_DROP",
+    "SWITCH_MAC_DROP", "ROUTING_EXCEPTION_DROP", "DA_LKMISS_DROP", "RSPAN_DROP",
+    "ACL_LKMISS_DROP", "ACL_DROP", "INBW_DROP", "IGR_METER_DROP",
+    "ACCEPT_FRAME_TYPE_DROP", "STP_IGR_DROP", "INVALID_SA_DROP", "SA_BLOCKING_DROP",
+    "DA_BLOCKING_DROP", "L2_INVALID_DPM_DROP", "MCST_INVALID_DPM_DROP", "RX_FLOW_CONTROL_DROP",
+    "STORM_SPPRS_DROP", "LALS_DROP", "VLAN_EGR_FILTER_DROP", "STP_EGR_DROP",
+    "SRC_PORT_FILTER_DROP", "PORT_ISOLATION_DROP", "ACL_FLTR_DROP", "MIRROR_FLTR_DROP",
+    "TX_MAX_DROP", "LINK_DOWN_DROP", "FLOW_CONTROL_DROP", "BRIDGE .1d discards"
+};
+
+const char *rtl839x_drop_cntr[] = {
+    "ALE_TX_GOOD_PKTS", "ERROR_PKTS", "EGR_ACL_DROP", "EGR_METER_DROP",
+    "OAM", "CFM" "VLAN_IGR_FLTR", "VLAN_ERR",
+    "INNER_OUTER_CFI_EQUAL_1", "VLAN_TAG_FORMAT", "SRC_PORT_SPENDING_TREE", "INBW",
+    "RMA", "HW_ATTACK_PREVENTION", "PROTO_STORM", "MCAST_SA",
+    "IGR_ACL_DROP", "IGR_METER_DROP", "DFLT_ACTION_FOR_MISS_ACL_AND_C2SC", "NEW_SA",
+    "PORT_MOVE", "SA_BLOCKING", "ROUTING_EXCEPTION", "SRC_PORT_SPENDING_TREE_NON_FWDING",
+    "MAC_LIMIT", "UNKNOW_STORM", "MISS_DROP", "CPU_MAC_DROP",
+    "DA_BLOCKING", "SRC_PORT_FILTER_BEFORE_EGR_ACL", "VLAN_EGR_FILTER", "SPANNING_TRE",
+    "PORT_ISOLATION", "OAM_EGRESS_DROP", "MIRROR_ISOLATION", "MAX_LEN_BEFORE_EGR_ACL",
+    "SRC_PORT_FILTER_BEFORE_MIRROR", "MAX_LEN_BEFORE_MIRROR", "SPECIAL_CONGEST_BEFORE_MIRROR",
+    "LINK_STATUS_BEFORE_MIRROR",
+    "WRED_BEFORE_MIRROR", "MAX_LEN_AFTER_MIRROR", "SPECIAL_CONGEST_AFTER_MIRROR",
+    "LINK_STATUS_AFTER_MIRROR",
+    "WRED_AFTER_MIRROR"
+};
+
+const char *rtl930x_drop_cntr[] = {
+	"OAM_PARSER", "UC_RPF", "DEI_CFI", "MAC_IP_SUBNET_BASED_VLAN", "VLAN_IGR_FILTER",
+	"L2_UC_MC", "IPV_IP6_MC_BRIDGE", "PTP", "USER_DEF_0_3", "RESERVED",
+	"RESERVED1", "RESERVED2", "BPDU_RMA", "LACP", "LLDP",
+	"EAPOL", "XX_RMA", "L3_IPUC_NON_IP", "IP4_IP6_HEADER_ERROR", "L3_BAD_IP",
+	"L3_DIP_DMAC_MISMATCH", "IP4_IP_OPTION", "IP_UC_MC_ROUTING_LOOK_UP_MISS", "L3_DST_NULL_INTF",
+	"L3_PBR_NULL_INTF",
+	"HOST_NULL_INTF", "ROUTE_NULL_INTF", "BRIDGING_ACTION", "ROUTING_ACTION", "IPMC_RPF",
+	"L2_NEXTHOP_AGE_OUT", "L3_UC_TTL_FAIL", "L3_MC_TTL_FAIL", "L3_UC_MTU_FAIL", "L3_MC_MTU_FAIL",
+	"L3_UC_ICMP_REDIR", "IP6_MLD_OTHER_ACT", "ND", "IP_MC_RESERVED", "IP6_HBH",
+	"INVALID_SA", "L2_HASH_FULL", "NEW_SA", "PORT_MOVE_FORBID", "STATIC_PORT_MOVING",
+	"DYNMIC_PORT_MOVING", "L3_CRC", "MAC_LIMIT", "ATTACK_PREVENT", "ACL_FWD_ACTION",
+	"OAMPDU", "OAM_MUX", "TRUNK_FILTER", "ACL_DROP", "IGR_BW",
+	"ACL_METER", "VLAN_ACCEPT_FRAME_TYPE", "MSTP_SRC_DROP_DISABLED_BLOCKING", "SA_BLOCK", "DA_BLOCK",
+	"STORM_CONTROL", "VLAN_EGR_FILTER", "MSTP_DESTINATION_DROP", "SRC_PORT_FILTER", "PORT_ISOLATION",
+	"TX_MAX_FRAME_SIZE", "EGR_LINK_STATUS", "MAC_TX_DISABLE", "MAC_PAUSE_FRAME", "MAC_RX_DROP",
+	"MIRROR_ISOLATE", "RX_FC", "EGR_QUEUE", "HSM_RUNOUT", "ROUTING_DISABLE", "INVALID_L2_NEXTHOP_ENTRY",
+	"L3_MC_SRC_FLT", "CPUTAG_FLT", "FWD_PMSK_NULL", "IPUC_ROUTING_LOOKUP_MISS", "MY_DEV_DROP",
+	"STACK_NONUC_BLOCKING_PMSK", "STACK_PORT_NOT_FOUND", "ACL_LOOPBACK_DROP", "IP6_ROUTING_EXT_HEADER"
+};
+
+const char *rtl931x_drop_cntr[] = {
+	"ALE_RX_GOOD_PKTS", "RX_MAX_FRAME_SIZE", "MAC_RX_DROP", "OPENFLOW_IP_MPLS_TTL", "OPENFLOW_TBL_MISS",
+	"IGR_BW", "SPECIAL_CONGEST", "EGR_QUEUE", "RESERVED", "EGR_LINK_STATUS", "STACK_UCAST_NONUCAST_TTL", /* 10 */
+	"STACK_NONUC_BLOCKING_PMSK", "L2_CRC", "SRC_PORT_FILTER", "PARSER_PACKET_TOO_LONG", "PARSER_MALFORM_PACKET",
+	"MPLS_OVER_2_LBL", "EACL_METER", "IACL_METER", "PROTO_STORM", "INVALID_CAPWAP_HEADER", /* 20 */
+	"MAC_IP_SUBNET_BASED_VLAN", "OAM_PARSER", "UC_MC_RPF", "IP_MAC_BINDING_MATCH_MISMATCH", "SA_BLOCK",
+	"TUNNEL_IP_ADDRESS_CHECK", "EACL_DROP", "IACL_DROP", "ATTACK_PREVENT", "SYSTEM_PORT_LIMIT_LEARN", /* 30 */
+	"OAMPDU", "CCM_RX", "CFM_UNKNOWN_TYPE", "LBM_LBR_LTM_LTR", "Y_1731", "VLAN_LIMIT_LEARN",
+	"VLAN_ACCEPT_FRAME_TYPE", "CFI_1", "STATIC_DYNAMIC_PORT_MOVING", "PORT_MOVE_FORBID", /* 40 */
+	"L3_CRC", "BPDU_PTP_LLDP_EAPOL_RMA", "MSTP_SRC_DROP_DISABLED_BLOCKING", "INVALID_SA", "NEW_SA",
+	"VLAN_IGR_FILTER", "IGR_VLAN_CONVERT", "GRATUITOUS_ARP", "MSTP_SRC_DROP", "L2_HASH_FULL", /* 50 */
+	"MPLS_UNKNOWN_LBL", "L3_IPUC_NON_IP", "TTL", "MTU", "ICMP_REDIRECT", "STORM_CONTROL", "L3_DIP_DMAC_MISMATCH",
+	"IP4_IP_OPTION", "IP6_HBH_EXT_HEADER", "IP4_IP6_HEADER_ERROR", /* 60 */
+	"ROUTING_IP_ADDR_CHECK", "ROUTING_EXCEPTION", "DA_BLOCK", "OAM_MUX", "PORT_ISOLATION", "VLAN_EGR_FILTER",
+	"MIRROR_ISOLATE", "MSTP_DESTINATION_DROP", "L2_MC_BRIDGE", "IP_UC_MC_ROUTING_LOOK_UP_MISS", /* 70 */
+	"L2_UC", "L2_MC", "IP4_MC", "IP6_MC", "L3_UC_MC_ROUTE", "UNKNOWN_L2_UC_FLPM", "BC_FLPM",
+	"VLAN_PRO_UNKNOWN_L2_MC_FLPM", "VLAN_PRO_UNKNOWN_IP4_MC_FLPM", "VLAN_PROFILE_UNKNOWN_IP6_MC_FLPM", /* 80 */
+};
+
+static ssize_t rtl838x_common_read(char __user *buffer, size_t count,
+					loff_t *ppos, unsigned int value)
+{
+	char *buf;
+	ssize_t len;
+
+	if (*ppos != 0)
+		return 0;
+
+	buf = kasprintf(GFP_KERNEL, "0x%08x\n", value);
+	if (!buf)
+		return -ENOMEM;
+
+	if (count < strlen(buf)) {
+		kfree(buf);
+		return -ENOSPC;
+	}
+
+	len = simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
+	kfree(buf);
+
+	return len;
+}
+
+static ssize_t rtl838x_common_write(const char __user *buffer, size_t count,
+				 loff_t *ppos, unsigned int *value)
+{
+	char b[32];
+	ssize_t len;
+	int ret;
+
+	if (*ppos != 0)
+		return -EINVAL;
+
+	if (count >= sizeof(b))
+		return -ENOSPC;
+
+	len = simple_write_to_buffer(b, sizeof(b) - 1, ppos,
+				     buffer, count);
+	if (len < 0)
+		return len;
+
+	b[len] = '\0';
+	ret = kstrtouint(b, 16, value);
+	if (ret)
+		return -EIO;
+
+	return len;
+}
+
+static ssize_t stp_state_read(struct file *filp, char __user *buffer, size_t count,
+			     loff_t *ppos)
+{
+	struct rtl838x_port *p = filp->private_data;
+	struct dsa_switch *ds = p->dp->ds;
+	int value = rtl83xx_port_get_stp_state(ds->priv, p->dp->index);
+
+	if (value < 0)
+		return -EINVAL;
+
+	return rtl838x_common_read(buffer, count, ppos, (u32)value);
+}
+
+static ssize_t stp_state_write(struct file *filp, const char __user *buffer,
+				size_t count, loff_t *ppos)
+{
+	struct rtl838x_port *p = filp->private_data;
+	u32 value;
+	size_t res = rtl838x_common_write(buffer, count, ppos, &value);
+	if (res < 0)
+		return res;
+
+	rtl83xx_port_stp_state_set(p->dp->ds, p->dp->index, (u8)value);
+
+	return res;
+}
+
+static const struct file_operations stp_state_fops = {
+	.owner = THIS_MODULE,
+	.open = simple_open,
+	.read = stp_state_read,
+	.write = stp_state_write,
+};
+
+static ssize_t drop_counter_read(struct file *filp, char __user *buffer, size_t count,
+			     loff_t *ppos)
+{
+	struct rtl838x_switch_priv *priv = filp->private_data;
+	const char **d;
+	u32 v;
+	char *buf;
+	int n = 0, len, offset;
+	int num;
+
+	switch (priv->family_id) {
+	case RTL8380_FAMILY_ID:
+		d = rtl838x_drop_cntr;
+		offset = RTL838X_STAT_PRVTE_DROP_COUNTERS;
+		num = 40;
+		break;
+	case RTL8390_FAMILY_ID:
+		d = rtl839x_drop_cntr;
+		offset = RTL839X_STAT_PRVTE_DROP_COUNTERS;
+		num = 45;
+		break;
+	case RTL9300_FAMILY_ID:
+		d = rtl930x_drop_cntr;
+		offset = RTL930X_STAT_PRVTE_DROP_COUNTERS;
+		num = 85;
+		break;
+	case RTL9310_FAMILY_ID:
+		d = rtl931x_drop_cntr;
+		offset = RTL931X_STAT_PRVTE_DROP_COUNTERS;
+		num = 81;
+		break;
+	}
+
+	buf = kmalloc(30 * num, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	for (int i = 0; i < num; i++) {
+		v = sw_r32(offset + (i << 2)) & 0xffff;
+		n += sprintf(buf + n, "%s: %d\n", d[i], v);
+	}
+
+	if (count < strlen(buf)) {
+		kfree(buf);
+		return -ENOSPC;
+	}
+
+	len = simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
+	kfree(buf);
+
+	return len;
+}
+
+static const struct file_operations drop_counter_fops = {
+	.owner = THIS_MODULE,
+	.open = simple_open,
+	.read = drop_counter_read,
+};
+
+static void l2_table_print_entry(struct seq_file *m, struct rtl838x_switch_priv *priv,
+				 struct rtl838x_l2_entry *e)
+{
+	u64 portmask;
+
+	if (e->type == L2_UNICAST) {
+		seq_puts(m, "L2_UNICAST\n");
+
+		seq_printf(m, "  mac %02x:%02x:%02x:%02x:%02x:%02x vid %u rvid %u\n",
+			e->mac[0], e->mac[1], e->mac[2], e->mac[3], e->mac[4], e->mac[5],
+			e->vid, e->rvid);
+
+		seq_printf(m, "  port %d age %d", e->port, e->age);
+		if (e->is_static)
+			seq_puts(m, " static");
+		if (e->block_da)
+			seq_puts(m, " block_da");
+		if (e->block_sa)
+			seq_puts(m, " block_sa");
+		if (e->suspended)
+			seq_puts(m, " suspended");
+		if (e->next_hop)
+			seq_printf(m, " next_hop route_id %u", e->nh_route_id);
+		seq_puts(m, "\n");
+
+	} else {
+		if (e->type == L2_MULTICAST) {
+			seq_puts(m, "L2_MULTICAST\n");
+
+			seq_printf(m, "  mac %02x:%02x:%02x:%02x:%02x:%02x vid %u rvid %u\n",
+				e->mac[0], e->mac[1], e->mac[2], e->mac[3], e->mac[4], e->mac[5],
+				e->vid, e->rvid);
+		}
+
+		if (e->type == IP4_MULTICAST || e->type == IP6_MULTICAST) {
+			seq_puts(m, (e->type == IP4_MULTICAST) ?
+				    "IP4_MULTICAST\n" : "IP6_MULTICAST\n");
+
+			seq_printf(m, "  gip %08x sip %08x vid %u rvid %u\n",
+				e->mc_gip, e->mc_sip, e->vid, e->rvid);
+		}
+
+		portmask = priv->r->read_mcast_pmask(e->mc_portmask_index);
+		seq_printf(m, "  index %u ports", e->mc_portmask_index);
+		for (int i = 0; i < 64; i++) {
+			if (portmask & BIT_ULL(i))
+				seq_printf(m, " %d", i);
+		}
+		seq_puts(m, "\n");
+	}
+
+	seq_puts(m, "\n");
+}
+
+static int l2_table_show(struct seq_file *m, void *v)
+{
+	struct rtl838x_switch_priv *priv = m->private;
+	struct rtl838x_l2_entry e;
+	int bucket, index;
+
+	mutex_lock(&priv->reg_mutex);
+
+	for (int i = 0; i < priv->fib_entries; i++) {
+		bucket = i >> 2;
+		index = i & 0x3;
+		priv->r->read_l2_entry_using_hash(bucket, index, &e);
+
+		if (!e.valid)
+			continue;
+
+		seq_printf(m, "Hash table bucket %d index %d ", bucket, index);
+		l2_table_print_entry(m, priv, &e);
+
+		if (!((i + 1) % 64))
+			cond_resched();
+	}
+
+	for (int i = 0; i < 64; i++) {
+		priv->r->read_cam(i, &e);
+
+		if (!e.valid)
+			continue;
+
+		seq_printf(m, "CAM index %d ", i);
+		l2_table_print_entry(m, priv, &e);
+	}
+
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+static int l2_table_open(struct inode *inode, struct file *filp)
+{
+	return single_open(filp, l2_table_show, inode->i_private);
+}
+
+static const struct file_operations l2_table_fops = {
+	.owner = THIS_MODULE,
+	.open = l2_table_open,
+	.read = seq_read,
+	.llseek = seq_lseek,
+	.release = single_release,
+};
+
+static ssize_t age_out_read(struct file *filp, char __user *buffer, size_t count,
+			     loff_t *ppos)
+{
+	struct rtl838x_port *p = filp->private_data;
+	struct dsa_switch *ds = p->dp->ds;
+	struct rtl838x_switch_priv *priv = ds->priv;
+	int value = sw_r32(priv->r->l2_port_aging_out);
+
+	if (value < 0)
+		return -EINVAL;
+
+	return rtl838x_common_read(buffer, count, ppos, (u32)value);
+}
+
+static ssize_t age_out_write(struct file *filp, const char __user *buffer,
+				size_t count, loff_t *ppos)
+{
+	struct rtl838x_port *p = filp->private_data;
+	u32 value;
+	size_t res = rtl838x_common_write(buffer, count, ppos, &value);
+	if (res < 0)
+		return res;
+
+	rtl83xx_fast_age(p->dp->ds, p->dp->index);
+
+	return res;
+}
+
+static const struct file_operations age_out_fops = {
+	.owner = THIS_MODULE,
+	.open = simple_open,
+	.read = age_out_read,
+	.write = age_out_write,
+};
+
+static ssize_t port_egress_rate_read(struct file *filp, char __user *buffer, size_t count,
+				loff_t *ppos)
+{
+	struct rtl838x_port *p = filp->private_data;
+	struct dsa_switch *ds = p->dp->ds;
+	struct rtl838x_switch_priv *priv = ds->priv;
+	int value;
+	if (priv->family_id == RTL8380_FAMILY_ID)
+		value = rtl838x_get_egress_rate(priv, p->dp->index);
+	else
+		value = rtl839x_get_egress_rate(priv, p->dp->index);
+
+	if (value < 0)
+		return -EINVAL;
+
+	return rtl838x_common_read(buffer, count, ppos, (u32)value);
+}
+
+static ssize_t port_egress_rate_write(struct file *filp, const char __user *buffer,
+				size_t count, loff_t *ppos)
+{
+	struct rtl838x_port *p = filp->private_data;
+	struct dsa_switch *ds = p->dp->ds;
+	struct rtl838x_switch_priv *priv = ds->priv;
+	u32 value;
+	size_t res = rtl838x_common_write(buffer, count, ppos, &value);
+	if (res < 0)
+		return res;
+
+	if (priv->family_id == RTL8380_FAMILY_ID)
+		rtl838x_set_egress_rate(priv, p->dp->index, value);
+	else
+		rtl839x_set_egress_rate(priv, p->dp->index, value);
+
+	return res;
+}
+
+static const struct file_operations port_egress_fops = {
+	.owner = THIS_MODULE,
+	.open = simple_open,
+	.read = port_egress_rate_read,
+	.write = port_egress_rate_write,
+};
+
+
+static const struct debugfs_reg32 port_ctrl_regs[] = {
+	{ .name = "port_isolation", .offset = RTL838X_PORT_ISO_CTRL(0), },
+	{ .name = "mac_force_mode", .offset = RTL838X_MAC_FORCE_MODE_CTRL, },
+};
+
+void rtl838x_dbgfs_cleanup(struct rtl838x_switch_priv *priv)
+{
+	debugfs_remove_recursive(priv->dbgfs_dir);
+
+/*	kfree(priv->dbgfs_entries); */
+}
+
+static int rtl838x_dbgfs_port_init(struct dentry *parent, struct rtl838x_switch_priv *priv,
+				   int port)
+{
+	struct dentry *port_dir;
+	struct debugfs_regset32 *port_ctrl_regset;
+
+	port_dir = debugfs_create_dir(priv->ports[port].dp->name, parent);
+
+	if (priv->family_id == RTL8380_FAMILY_ID) {
+		debugfs_create_x32("storm_rate_uc", 0644, port_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL838X_STORM_CTRL_PORT_UC(port)));
+
+		debugfs_create_x32("storm_rate_mc", 0644, port_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL838X_STORM_CTRL_PORT_MC(port)));
+
+		debugfs_create_x32("storm_rate_bc", 0644, port_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL838X_STORM_CTRL_PORT_BC(port)));
+	} else {
+		debugfs_create_x32("storm_rate_uc", 0644, port_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL839X_STORM_CTRL_PORT_UC_0(port)));
+
+		debugfs_create_x32("storm_rate_mc", 0644, port_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL839X_STORM_CTRL_PORT_MC_0(port)));
+
+		debugfs_create_x32("storm_rate_bc", 0644, port_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL839X_STORM_CTRL_PORT_BC_0(port)));
+	}
+
+	debugfs_create_u32("id", 0444, port_dir, (u32 *)&priv->ports[port].dp->index);
+
+	port_ctrl_regset = devm_kzalloc(priv->dev, sizeof(*port_ctrl_regset), GFP_KERNEL);
+	if (!port_ctrl_regset)
+		return -ENOMEM;
+
+	port_ctrl_regset->regs = port_ctrl_regs;
+	port_ctrl_regset->nregs = ARRAY_SIZE(port_ctrl_regs);
+	port_ctrl_regset->base = (void *)(RTL838X_SW_BASE + (port << 2));
+	debugfs_create_regset32("port_ctrl", 0400, port_dir, port_ctrl_regset);
+
+	debugfs_create_file("stp_state", 0600, port_dir, &priv->ports[port], &stp_state_fops);
+	debugfs_create_file("age_out", 0600, port_dir, &priv->ports[port], &age_out_fops);
+	debugfs_create_file("port_egress_rate", 0600, port_dir, &priv->ports[port],
+			    &port_egress_fops);
+	return 0;
+}
+
+static int rtl838x_dbgfs_leds(struct dentry *parent, struct rtl838x_switch_priv *priv)
+{
+	struct dentry *led_dir;
+
+	led_dir = debugfs_create_dir("led", parent);
+
+	if (priv->family_id == RTL8380_FAMILY_ID) {
+		debugfs_create_x32("led_glb_ctrl", 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8380_LED_GLB_CTRL));
+		debugfs_create_x32("led_mode_sel", 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8380_LED_MODE_SEL));
+		debugfs_create_x32("led_mode_ctrl", 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8380_LED_MODE_CTRL));
+		debugfs_create_x32("led_p_en_ctrl", 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8380_LED_P_EN_CTRL));
+		debugfs_create_x32("led_sw_ctrl", 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8380_LED_SW_CTRL));
+		debugfs_create_x32("led0_sw_p_en_ctrl", 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8380_LED0_SW_P_EN_CTRL));
+		debugfs_create_x32("led1_sw_p_en_ctrl", 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8380_LED1_SW_P_EN_CTRL));
+		debugfs_create_x32("led2_sw_p_en_ctrl", 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8380_LED2_SW_P_EN_CTRL));
+		for (int p = 0; p < 28; p++) {
+			char led_sw_p_ctrl_name[20];
+
+			snprintf(led_sw_p_ctrl_name, sizeof(led_sw_p_ctrl_name),
+				 "led_sw_p_ctrl.%02d", p);
+			debugfs_create_x32(led_sw_p_ctrl_name, 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8380_LED_SW_P_CTRL(p)));
+		}
+	} else if (priv->family_id == RTL8390_FAMILY_ID) {
+		char port_led_name[20];
+
+		debugfs_create_x32("led_glb_ctrl", 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8390_LED_GLB_CTRL));
+		debugfs_create_x32("led_set_2_3", 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8390_LED_SET_2_3_CTRL));
+		debugfs_create_x32("led_set_0_1", 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8390_LED_SET_0_1_CTRL));
+		for (int p = 0; p < 4; p++) {
+			snprintf(port_led_name, sizeof(port_led_name), "led_copr_set_sel.%1d", p);
+			debugfs_create_x32(port_led_name, 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8390_LED_COPR_SET_SEL_CTRL(p << 4)));
+			snprintf(port_led_name, sizeof(port_led_name), "led_fib_set_sel.%1d", p);
+			debugfs_create_x32(port_led_name, 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8390_LED_FIB_SET_SEL_CTRL(p << 4)));
+		}
+		debugfs_create_x32("led_copr_pmask_ctrl_0", 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8390_LED_COPR_PMASK_CTRL(0)));
+		debugfs_create_x32("led_copr_pmask_ctrl_1", 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8390_LED_COPR_PMASK_CTRL(32)));
+		debugfs_create_x32("led_fib_pmask_ctrl_0", 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8390_LED_FIB_PMASK_CTRL(0)));
+		debugfs_create_x32("led_fib_pmask_ctrl_1", 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8390_LED_FIB_PMASK_CTRL(32)));
+		debugfs_create_x32("led_combo_ctrl_0", 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8390_LED_COMBO_CTRL(0)));
+		debugfs_create_x32("led_combo_ctrl_1", 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8390_LED_COMBO_CTRL(32)));
+		debugfs_create_x32("led_sw_ctrl", 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8390_LED_SW_CTRL));
+		for (int p = 0; p < 5; p++) {
+			snprintf(port_led_name, sizeof(port_led_name), "led_sw_p_en_ctrl.%1d", p);
+			debugfs_create_x32(port_led_name, 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8390_LED_SW_P_EN_CTRL(p * 10)));
+		}
+		for (int p = 0; p < 28; p++) {
+			snprintf(port_led_name, sizeof(port_led_name), "led_sw_p_ctrl.%02d", p);
+			debugfs_create_x32(port_led_name, 0644, led_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL8390_LED_SW_P_CTRL(p)));
+		}
+	}
+	return 0;
+}
+
+void rtl838x_dbgfs_init(struct rtl838x_switch_priv *priv)
+{
+	struct dentry *rtl838x_dir;
+	struct dentry *port_dir;
+	struct dentry *mirror_dir;
+	struct debugfs_regset32 *port_ctrl_regset;
+	int ret;
+	char lag_name[10];
+	char mirror_name[10];
+
+	pr_info("%s called\n", __func__);
+	rtl838x_dir = debugfs_lookup(RTL838X_DRIVER_NAME, NULL);
+	if (!rtl838x_dir)
+		rtl838x_dir = debugfs_create_dir(RTL838X_DRIVER_NAME, NULL);
+
+	priv->dbgfs_dir = rtl838x_dir;
+
+	debugfs_create_u32("soc", 0444, rtl838x_dir,
+			   (u32 *)(RTL838X_SW_BASE + RTL838X_MODEL_NAME_INFO));
+
+	/* Create one directory per port */
+	for (int i = 0; i < priv->cpu_port; i++) {
+		if (priv->ports[i].phy) {
+			ret = rtl838x_dbgfs_port_init(rtl838x_dir, priv, i);
+			if (ret)
+				goto err;
+		}
+	}
+
+	/* Create directory for CPU-port */
+	port_dir = debugfs_create_dir("cpu_port", rtl838x_dir);
+	port_ctrl_regset = devm_kzalloc(priv->dev, sizeof(*port_ctrl_regset), GFP_KERNEL);
+	if (!port_ctrl_regset) {
+		ret = -ENOMEM;
+		goto err;
+	}
+
+	port_ctrl_regset->regs = port_ctrl_regs;
+	port_ctrl_regset->nregs = ARRAY_SIZE(port_ctrl_regs);
+	port_ctrl_regset->base = (void *)(RTL838X_SW_BASE + (priv->cpu_port << 2));
+	debugfs_create_regset32("port_ctrl", 0400, port_dir, port_ctrl_regset);
+	debugfs_create_u8("id", 0444, port_dir, &priv->cpu_port);
+
+	/* Create entries for LAGs */
+	for (int i = 0; i < priv->n_lags; i++) {
+		snprintf(lag_name, sizeof(lag_name), "lag.%02d", i);
+		if (priv->family_id == RTL8380_FAMILY_ID)
+			debugfs_create_x32(lag_name, 0644, rtl838x_dir,
+				(u32 *)(RTL838X_SW_BASE + priv->r->trk_mbr_ctr(i)));
+		else
+			debugfs_create_x64(lag_name, 0644, rtl838x_dir,
+				(u64 *)(RTL838X_SW_BASE + priv->r->trk_mbr_ctr(i)));
+	}
+
+	/* Create directories for mirror groups */
+	for (int i = 0; i < 4; i++) {
+		snprintf(mirror_name, sizeof(mirror_name), "mirror.%1d", i);
+		mirror_dir = debugfs_create_dir(mirror_name, rtl838x_dir);
+		if (priv->family_id == RTL8380_FAMILY_ID) {
+			debugfs_create_x32("ctrl", 0644, mirror_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL838X_MIR_CTRL + i * 4));
+			debugfs_create_x32("ingress_pm", 0644, mirror_dir,
+				(u32 *)(RTL838X_SW_BASE + priv->r->mir_spm + i * 4));
+			debugfs_create_x32("egress_pm", 0644, mirror_dir,
+				(u32 *)(RTL838X_SW_BASE + priv->r->mir_dpm + i * 4));
+			debugfs_create_x32("qid", 0644, mirror_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL838X_MIR_QID_CTRL(i)));
+			debugfs_create_x32("rspan_vlan", 0644, mirror_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL838X_MIR_RSPAN_VLAN_CTRL(i)));
+			debugfs_create_x32("rspan_vlan_mac", 0644, mirror_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL838X_MIR_RSPAN_VLAN_CTRL_MAC(i)));
+			debugfs_create_x32("rspan_tx", 0644, mirror_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL838X_MIR_RSPAN_TX_CTRL));
+			debugfs_create_x32("rspan_tx_tag_rm", 0644, mirror_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL838X_MIR_RSPAN_TX_TAG_RM_CTRL));
+			debugfs_create_x32("rspan_tx_tag_en", 0644, mirror_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL838X_MIR_RSPAN_TX_TAG_EN_CTRL));
+		} else {
+			debugfs_create_x32("ctrl", 0644, mirror_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL839X_MIR_CTRL + i * 4));
+			debugfs_create_x64("ingress_pm", 0644, mirror_dir,
+				(u64 *)(RTL838X_SW_BASE + priv->r->mir_spm + i * 8));
+			debugfs_create_x64("egress_pm", 0644, mirror_dir,
+				(u64 *)(RTL838X_SW_BASE + priv->r->mir_dpm + i * 8));
+			debugfs_create_x32("rspan_vlan", 0644, mirror_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL839X_MIR_RSPAN_VLAN_CTRL(i)));
+			debugfs_create_x32("rspan_tx", 0644, mirror_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL839X_MIR_RSPAN_TX_CTRL));
+			debugfs_create_x32("rspan_tx_tag_rm", 0644, mirror_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL839X_MIR_RSPAN_TX_TAG_RM_CTRL));
+			debugfs_create_x32("rspan_tx_tag_en", 0644, mirror_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL839X_MIR_RSPAN_TX_TAG_EN_CTRL));
+			debugfs_create_x64("sample_rate", 0644, mirror_dir,
+				(u64 *)(RTL838X_SW_BASE + RTL839X_MIR_SAMPLE_RATE_CTRL));
+		}
+	}
+
+	if (priv->family_id == RTL8380_FAMILY_ID)
+		debugfs_create_x32("bpdu_flood_mask", 0644, rtl838x_dir,
+				(u32 *)(RTL838X_SW_BASE + priv->r->rma_bpdu_fld_pmask));
+	else
+		debugfs_create_x64("bpdu_flood_mask", 0644, rtl838x_dir,
+				(u64 *)(RTL838X_SW_BASE + priv->r->rma_bpdu_fld_pmask));
+
+	if (priv->family_id == RTL8380_FAMILY_ID)
+		debugfs_create_x32("vlan_ctrl", 0644, rtl838x_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL838X_VLAN_CTRL));
+	else
+		debugfs_create_x32("vlan_ctrl", 0644, rtl838x_dir,
+				(u32 *)(RTL838X_SW_BASE + RTL839X_VLAN_CTRL));
+
+	ret = rtl838x_dbgfs_leds(rtl838x_dir, priv);
+	if (ret)
+		goto err;
+
+	debugfs_create_file("drop_counters", 0400, rtl838x_dir, priv, &drop_counter_fops);
+
+	debugfs_create_file("l2_table", 0400, rtl838x_dir, priv, &l2_table_fops);
+
+	return;
+err:
+	rtl838x_dbgfs_cleanup(priv);
+}
+
+void rtl930x_dbgfs_init(struct rtl838x_switch_priv *priv)
+{
+	struct dentry *dbg_dir;
+
+	pr_info("%s called\n", __func__);
+	dbg_dir = debugfs_lookup(RTL838X_DRIVER_NAME, NULL);
+	if (!dbg_dir)
+		dbg_dir = debugfs_create_dir(RTL838X_DRIVER_NAME, NULL);
+
+	priv->dbgfs_dir = dbg_dir;
+
+	debugfs_create_file("drop_counters", 0400, dbg_dir, priv, &drop_counter_fops);
+
+	debugfs_create_file("l2_table", 0400, dbg_dir, priv, &l2_table_fops);
+}
diff --git a/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/dsa.c b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/dsa.c
new file mode 100644
index 00000000000000..5744c70ea3f0fd
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/dsa.c
@@ -0,0 +1,2219 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <net/dsa.h>
+#include <linux/etherdevice.h>
+#include <linux/if_bridge.h>
+#include <asm/mach-rtl838x/mach-rtl83xx.h>
+
+#include "rtl83xx.h"
+
+extern struct rtl83xx_soc_info soc_info;
+
+static void rtl83xx_init_stats(struct rtl838x_switch_priv *priv)
+{
+	mutex_lock(&priv->reg_mutex);
+
+	/* Enable statistics module: all counters plus debug.
+	 * On RTL839x all counters are enabled by default
+	 */
+	if (priv->family_id == RTL8380_FAMILY_ID)
+		sw_w32_mask(0, 3, RTL838X_STAT_CTRL);
+
+	/* Reset statistics counters */
+	sw_w32_mask(0, 1, priv->r->stat_rst);
+
+	mutex_unlock(&priv->reg_mutex);
+}
+
+static void rtl83xx_enable_phy_polling(struct rtl838x_switch_priv *priv)
+{
+	u64 v = 0;
+
+	msleep(1000);
+	/* Enable all ports with a PHY, including the SFP-ports */
+	for (int i = 0; i < priv->cpu_port; i++) {
+		if (priv->ports[i].phy)
+			v |= BIT_ULL(i);
+	}
+
+	pr_info("%s: %16llx\n", __func__, v);
+	priv->r->set_port_reg_le(v, priv->r->smi_poll_ctrl);
+
+	/* PHY update complete, there is no global PHY polling enable bit on the 9300 */
+	if (priv->family_id == RTL8390_FAMILY_ID)
+		sw_w32_mask(0, BIT(7), RTL839X_SMI_GLB_CTRL);
+	else if(priv->family_id == RTL9300_FAMILY_ID)
+		sw_w32_mask(0, 0x8000, RTL838X_SMI_GLB_CTRL);
+}
+
+const struct rtl83xx_mib_desc rtl83xx_mib[] = {
+	MIB_DESC(2, 0xf8, "ifInOctets"),
+	MIB_DESC(2, 0xf0, "ifOutOctets"),
+	MIB_DESC(1, 0xec, "dot1dTpPortInDiscards"),
+	MIB_DESC(1, 0xe8, "ifInUcastPkts"),
+	MIB_DESC(1, 0xe4, "ifInMulticastPkts"),
+	MIB_DESC(1, 0xe0, "ifInBroadcastPkts"),
+	MIB_DESC(1, 0xdc, "ifOutUcastPkts"),
+	MIB_DESC(1, 0xd8, "ifOutMulticastPkts"),
+	MIB_DESC(1, 0xd4, "ifOutBroadcastPkts"),
+	MIB_DESC(1, 0xd0, "ifOutDiscards"),
+	MIB_DESC(1, 0xcc, ".3SingleCollisionFrames"),
+	MIB_DESC(1, 0xc8, ".3MultipleCollisionFrames"),
+	MIB_DESC(1, 0xc4, ".3DeferredTransmissions"),
+	MIB_DESC(1, 0xc0, ".3LateCollisions"),
+	MIB_DESC(1, 0xbc, ".3ExcessiveCollisions"),
+	MIB_DESC(1, 0xb8, ".3SymbolErrors"),
+	MIB_DESC(1, 0xb4, ".3ControlInUnknownOpcodes"),
+	MIB_DESC(1, 0xb0, ".3InPauseFrames"),
+	MIB_DESC(1, 0xac, ".3OutPauseFrames"),
+	MIB_DESC(1, 0xa8, "DropEvents"),
+	MIB_DESC(1, 0xa4, "tx_BroadcastPkts"),
+	MIB_DESC(1, 0xa0, "tx_MulticastPkts"),
+	MIB_DESC(1, 0x9c, "CRCAlignErrors"),
+	MIB_DESC(1, 0x98, "tx_UndersizePkts"),
+	MIB_DESC(1, 0x94, "rx_UndersizePkts"),
+	MIB_DESC(1, 0x90, "rx_UndersizedropPkts"),
+	MIB_DESC(1, 0x8c, "tx_OversizePkts"),
+	MIB_DESC(1, 0x88, "rx_OversizePkts"),
+	MIB_DESC(1, 0x84, "Fragments"),
+	MIB_DESC(1, 0x80, "Jabbers"),
+	MIB_DESC(1, 0x7c, "Collisions"),
+	MIB_DESC(1, 0x78, "tx_Pkts64Octets"),
+	MIB_DESC(1, 0x74, "rx_Pkts64Octets"),
+	MIB_DESC(1, 0x70, "tx_Pkts65to127Octets"),
+	MIB_DESC(1, 0x6c, "rx_Pkts65to127Octets"),
+	MIB_DESC(1, 0x68, "tx_Pkts128to255Octets"),
+	MIB_DESC(1, 0x64, "rx_Pkts128to255Octets"),
+	MIB_DESC(1, 0x60, "tx_Pkts256to511Octets"),
+	MIB_DESC(1, 0x5c, "rx_Pkts256to511Octets"),
+	MIB_DESC(1, 0x58, "tx_Pkts512to1023Octets"),
+	MIB_DESC(1, 0x54, "rx_Pkts512to1023Octets"),
+	MIB_DESC(1, 0x50, "tx_Pkts1024to1518Octets"),
+	MIB_DESC(1, 0x4c, "rx_StatsPkts1024to1518Octets"),
+	MIB_DESC(1, 0x48, "tx_Pkts1519toMaxOctets"),
+	MIB_DESC(1, 0x44, "rx_Pkts1519toMaxOctets"),
+	MIB_DESC(1, 0x40, "rxMacDiscards")
+};
+
+
+/* DSA callbacks */
+
+
+static enum dsa_tag_protocol rtl83xx_get_tag_protocol(struct dsa_switch *ds,
+						      int port,
+						      enum dsa_tag_protocol mprot)
+{
+	/* The switch does not tag the frames, instead internally the header
+	 * structure for each packet is tagged accordingly.
+	 */
+	return DSA_TAG_PROTO_TRAILER;
+}
+
+/* Initialize all VLANS */
+static void rtl83xx_vlan_setup(struct rtl838x_switch_priv *priv)
+{
+	struct rtl838x_vlan_info info;
+
+	pr_info("In %s\n", __func__);
+
+	priv->r->vlan_profile_setup(0);
+	priv->r->vlan_profile_setup(1);
+	pr_info("UNKNOWN_MC_PMASK: %016llx\n", priv->r->read_mcast_pmask(UNKNOWN_MC_PMASK));
+	priv->r->vlan_profile_dump(0);
+
+	info.fid = 0;			/* Default Forwarding ID / MSTI */
+	info.hash_uc_fid = false;	/* Do not build the L2 lookup hash with FID, but VID */
+	info.hash_mc_fid = false;	/* Do the same for Multicast packets */
+	info.profile_id = 0;		/* Use default Vlan Profile 0 */
+	info.tagged_ports = 0;		/* Initially no port members */
+	if (priv->family_id == RTL9310_FAMILY_ID) {
+		info.if_id = 0;
+		info.multicast_grp_mask = 0;
+		info.l2_tunnel_list_id = -1;
+	}
+
+	/* Initialize all vlans 0-4095 */
+	for (int i = 0; i < MAX_VLANS; i ++)
+		priv->r->vlan_set_tagged(i, &info);
+
+	/* reset PVIDs; defaults to 1 on reset */
+	for (int i = 0; i <= priv->ds->num_ports; i++) {
+		priv->r->vlan_port_pvid_set(i, PBVLAN_TYPE_INNER, 0);
+		priv->r->vlan_port_pvid_set(i, PBVLAN_TYPE_OUTER, 0);
+		priv->r->vlan_port_pvidmode_set(i, PBVLAN_TYPE_INNER, PBVLAN_MODE_UNTAG_AND_PRITAG);
+		priv->r->vlan_port_pvidmode_set(i, PBVLAN_TYPE_OUTER, PBVLAN_MODE_UNTAG_AND_PRITAG);
+	}
+
+	/* Set forwarding action based on inner VLAN tag */
+	for (int i = 0; i < priv->cpu_port; i++)
+		priv->r->vlan_fwd_on_inner(i, true);
+}
+
+static void rtl83xx_setup_bpdu_traps(struct rtl838x_switch_priv *priv)
+{
+	for (int i = 0; i < priv->cpu_port; i++)
+		priv->r->set_receive_management_action(i, BPDU, COPY2CPU);
+}
+
+static void rtl83xx_port_set_salrn(struct rtl838x_switch_priv *priv,
+				   int port, bool enable)
+{
+	int shift = SALRN_PORT_SHIFT(port);
+	int val = enable ? SALRN_MODE_HARDWARE : SALRN_MODE_DISABLED;
+
+	sw_w32_mask(SALRN_MODE_MASK << shift, val << shift,
+		    priv->r->l2_port_new_salrn(port));
+}
+
+static int rtl83xx_setup(struct dsa_switch *ds)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+
+	pr_debug("%s called\n", __func__);
+
+	/* Disable MAC polling the PHY so that we can start configuration */
+	priv->r->set_port_reg_le(0ULL, priv->r->smi_poll_ctrl);
+
+	for (int i = 0; i < ds->num_ports; i++)
+		priv->ports[i].enable = false;
+	priv->ports[priv->cpu_port].enable = true;
+
+	/* Configure ports so they are disabled by default, but once enabled
+	 * they will work in isolated mode (only traffic between port and CPU).
+	 */
+	for (int i = 0; i < priv->cpu_port; i++) {
+		if (priv->ports[i].phy) {
+			priv->ports[i].pm = BIT_ULL(priv->cpu_port);
+			priv->r->traffic_set(i, BIT_ULL(i));
+		}
+	}
+	priv->r->traffic_set(priv->cpu_port, BIT_ULL(priv->cpu_port));
+
+	/* For standalone ports, forward packets even if a static fdb
+	 * entry for the source address exists on another port.
+	 */
+	if (priv->r->set_static_move_action) {
+		for (int i = 0; i <= priv->cpu_port; i++)
+			priv->r->set_static_move_action(i, true);
+	}
+
+	if (priv->family_id == RTL8380_FAMILY_ID)
+		rtl838x_print_matrix();
+	else
+		rtl839x_print_matrix();
+
+	rtl83xx_init_stats(priv);
+
+	rtl83xx_vlan_setup(priv);
+
+	rtl83xx_setup_bpdu_traps(priv);
+
+	ds->configure_vlan_while_not_filtering = true;
+
+	priv->r->l2_learning_setup();
+
+	rtl83xx_port_set_salrn(priv, priv->cpu_port, false);
+	ds->assisted_learning_on_cpu_port = true;
+
+	/* Make sure all frames sent to the switch's MAC are trapped to the CPU-port
+	 *  0: FWD, 1: DROP, 2: TRAP2CPU
+	 */
+	if (priv->family_id == RTL8380_FAMILY_ID)
+		sw_w32(0x2, RTL838X_SPCL_TRAP_SWITCH_MAC_CTRL);
+	else
+		sw_w32(0x2, RTL839X_SPCL_TRAP_SWITCH_MAC_CTRL);
+
+	/* Enable MAC Polling PHY again */
+	rtl83xx_enable_phy_polling(priv);
+	pr_debug("Please wait until PHY is settled\n");
+	msleep(1000);
+	priv->r->pie_init(priv);
+
+	return 0;
+}
+
+static int rtl93xx_setup(struct dsa_switch *ds)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+
+	pr_info("%s called\n", __func__);
+
+	/* Disable MAC polling the PHY so that we can start configuration */
+	if (priv->family_id == RTL9300_FAMILY_ID)
+		sw_w32(0, RTL930X_SMI_POLL_CTRL);
+
+	if (priv->family_id == RTL9310_FAMILY_ID) {
+		sw_w32(0, RTL931X_SMI_PORT_POLLING_CTRL);
+		sw_w32(0, RTL931X_SMI_PORT_POLLING_CTRL + 4);
+	}
+
+	/* Disable all ports except CPU port */
+	for (int i = 0; i < ds->num_ports; i++)
+		priv->ports[i].enable = false;
+	priv->ports[priv->cpu_port].enable = true;
+
+	/* Configure ports so they are disabled by default, but once enabled
+	 * they will work in isolated mode (only traffic between port and CPU).
+	 */
+	for (int i = 0; i < priv->cpu_port; i++) {
+		if (priv->ports[i].phy) {
+			priv->ports[i].pm = BIT_ULL(priv->cpu_port);
+			priv->r->traffic_set(i, BIT_ULL(i));
+		}
+	}
+	priv->r->traffic_set(priv->cpu_port, BIT_ULL(priv->cpu_port));
+
+	rtl930x_print_matrix();
+
+	/* TODO: Initialize statistics */
+
+	rtl83xx_vlan_setup(priv);
+
+	ds->configure_vlan_while_not_filtering = true;
+
+	priv->r->l2_learning_setup();
+
+	rtl83xx_port_set_salrn(priv, priv->cpu_port, false);
+	ds->assisted_learning_on_cpu_port = true;
+
+	rtl83xx_enable_phy_polling(priv);
+
+	priv->r->pie_init(priv);
+
+	priv->r->led_init(priv);
+
+	return 0;
+}
+
+static int rtl93xx_get_sds(struct phy_device *phydev)
+{
+	struct device *dev = &phydev->mdio.dev;
+	struct device_node *dn;
+	u32 sds_num;
+
+	if (!dev)
+		return -1;
+	if (dev->of_node) {
+		dn = dev->of_node;
+		if (of_property_read_u32(dn, "sds", &sds_num))
+			sds_num = -1;
+	} else {
+		dev_err(dev, "No DT node.\n");
+		return -1;
+	}
+
+	return sds_num;
+}
+
+static void rtl83xx_phylink_validate(struct dsa_switch *ds, int port,
+				     unsigned long *supported,
+				     struct phylink_link_state *state)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	__ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
+
+	pr_debug("In %s port %d, state is %d", __func__, port, state->interface);
+
+	if (!phy_interface_mode_is_rgmii(state->interface) &&
+	    state->interface != PHY_INTERFACE_MODE_NA &&
+	    state->interface != PHY_INTERFACE_MODE_1000BASEX &&
+	    state->interface != PHY_INTERFACE_MODE_MII &&
+	    state->interface != PHY_INTERFACE_MODE_REVMII &&
+	    state->interface != PHY_INTERFACE_MODE_GMII &&
+	    state->interface != PHY_INTERFACE_MODE_QSGMII &&
+	    state->interface != PHY_INTERFACE_MODE_INTERNAL &&
+	    state->interface != PHY_INTERFACE_MODE_SGMII) {
+		bitmap_zero(supported, __ETHTOOL_LINK_MODE_MASK_NBITS);
+		dev_err(ds->dev,
+			"Unsupported interface: %d for port %d\n",
+			state->interface, port);
+		return;
+	}
+
+	/* Allow all the expected bits */
+	phylink_set(mask, Autoneg);
+	phylink_set_port_modes(mask);
+	phylink_set(mask, Pause);
+	phylink_set(mask, Asym_Pause);
+
+	/* With the exclusion of MII and Reverse MII, we support Gigabit,
+	 * including Half duplex
+	 */
+	if (state->interface != PHY_INTERFACE_MODE_MII &&
+	    state->interface != PHY_INTERFACE_MODE_REVMII) {
+		phylink_set(mask, 1000baseT_Full);
+		phylink_set(mask, 1000baseT_Half);
+	}
+
+	/* On both the 8380 and 8382, ports 24-27 are SFP ports */
+	if (port >= 24 && port <= 27 && priv->family_id == RTL8380_FAMILY_ID)
+		phylink_set(mask, 1000baseX_Full);
+
+	/* On the RTL839x family of SoCs, ports 48 to 51 are SFP ports */
+	if (port >= 48 && port <= 51 && priv->family_id == RTL8390_FAMILY_ID)
+		phylink_set(mask, 1000baseX_Full);
+
+	phylink_set(mask, 10baseT_Half);
+	phylink_set(mask, 10baseT_Full);
+	phylink_set(mask, 100baseT_Half);
+	phylink_set(mask, 100baseT_Full);
+
+	bitmap_and(supported, supported, mask,
+		   __ETHTOOL_LINK_MODE_MASK_NBITS);
+	bitmap_and(state->advertising, state->advertising, mask,
+		   __ETHTOOL_LINK_MODE_MASK_NBITS);
+}
+
+static void rtl93xx_phylink_validate(struct dsa_switch *ds, int port,
+				     unsigned long *supported,
+				     struct phylink_link_state *state)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	__ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
+
+	pr_debug("In %s port %d, state is %d (%s)", __func__, port, state->interface,
+		 phy_modes(state->interface));
+
+	if (!phy_interface_mode_is_rgmii(state->interface) &&
+	    state->interface != PHY_INTERFACE_MODE_NA &&
+	    state->interface != PHY_INTERFACE_MODE_1000BASEX &&
+	    state->interface != PHY_INTERFACE_MODE_MII &&
+	    state->interface != PHY_INTERFACE_MODE_REVMII &&
+	    state->interface != PHY_INTERFACE_MODE_GMII &&
+	    state->interface != PHY_INTERFACE_MODE_QSGMII &&
+	    state->interface != PHY_INTERFACE_MODE_XGMII &&
+	    state->interface != PHY_INTERFACE_MODE_HSGMII &&
+	    state->interface != PHY_INTERFACE_MODE_10GBASER &&
+	    state->interface != PHY_INTERFACE_MODE_10GKR &&
+	    state->interface != PHY_INTERFACE_MODE_USXGMII &&
+	    state->interface != PHY_INTERFACE_MODE_INTERNAL &&
+	    state->interface != PHY_INTERFACE_MODE_SGMII) {
+		bitmap_zero(supported, __ETHTOOL_LINK_MODE_MASK_NBITS);
+		dev_err(ds->dev,
+			"Unsupported interface: %d for port %d\n",
+			state->interface, port);
+		return;
+	}
+
+	/* Allow all the expected bits */
+	phylink_set(mask, Autoneg);
+	phylink_set_port_modes(mask);
+	phylink_set(mask, Pause);
+	phylink_set(mask, Asym_Pause);
+
+	/* With the exclusion of MII and Reverse MII, we support Gigabit,
+	 * including Half duplex
+	 */
+	if (state->interface != PHY_INTERFACE_MODE_MII &&
+	    state->interface != PHY_INTERFACE_MODE_REVMII) {
+		phylink_set(mask, 1000baseT_Full);
+		phylink_set(mask, 1000baseT_Half);
+	}
+
+	/* Internal phys of the RTL93xx family provide 10G */
+	if (priv->ports[port].phy_is_integrated &&
+	    state->interface == PHY_INTERFACE_MODE_1000BASEX) {
+		phylink_set(mask, 1000baseX_Full);
+	} else if (priv->ports[port].phy_is_integrated) {
+		phylink_set(mask, 1000baseX_Full);
+		phylink_set(mask, 10000baseKR_Full);
+		phylink_set(mask, 10000baseSR_Full);
+		phylink_set(mask, 10000baseCR_Full);
+	}
+	if (state->interface == PHY_INTERFACE_MODE_INTERNAL) {
+		phylink_set(mask, 1000baseX_Full);
+		phylink_set(mask, 1000baseT_Full);
+		phylink_set(mask, 10000baseKR_Full);
+		phylink_set(mask, 10000baseT_Full);
+		phylink_set(mask, 10000baseSR_Full);
+		phylink_set(mask, 10000baseCR_Full);
+	}
+
+	if (state->interface == PHY_INTERFACE_MODE_USXGMII)
+		phylink_set(mask, 10000baseT_Full);
+
+	phylink_set(mask, 10baseT_Half);
+	phylink_set(mask, 10baseT_Full);
+	phylink_set(mask, 100baseT_Half);
+	phylink_set(mask, 100baseT_Full);
+
+	bitmap_and(supported, supported, mask,
+		   __ETHTOOL_LINK_MODE_MASK_NBITS);
+	bitmap_and(state->advertising, state->advertising, mask,
+		   __ETHTOOL_LINK_MODE_MASK_NBITS);
+	pr_debug("%s leaving supported: %*pb", __func__, __ETHTOOL_LINK_MODE_MASK_NBITS, supported);
+}
+
+static int rtl83xx_phylink_mac_link_state(struct dsa_switch *ds, int port,
+					  struct phylink_link_state *state)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	u64 speed;
+	u64 link;
+
+	if (port < 0 || port > priv->cpu_port)
+		return -EINVAL;
+
+	state->link = 0;
+	link = priv->r->get_port_reg_le(priv->r->mac_link_sts);
+	if (link & BIT_ULL(port))
+		state->link = 1;
+	pr_debug("%s: link state port %d: %llx\n", __func__, port, link & BIT_ULL(port));
+
+	state->duplex = 0;
+	if (priv->r->get_port_reg_le(priv->r->mac_link_dup_sts) & BIT_ULL(port))
+		state->duplex = 1;
+
+	speed = priv->r->get_port_reg_le(priv->r->mac_link_spd_sts(port));
+	speed >>= (port % 16) << 1;
+	switch (speed & 0x3) {
+	case 0:
+		state->speed = SPEED_10;
+		break;
+	case 1:
+		state->speed = SPEED_100;
+		break;
+	case 2:
+		state->speed = SPEED_1000;
+		break;
+	case 3:
+		if (priv->family_id == RTL9300_FAMILY_ID
+			&& (port == 24 || port == 26)) /* Internal serdes */
+			state->speed = SPEED_2500;
+		else
+			state->speed = SPEED_100; /* Is in fact 500Mbit */
+	}
+
+	state->pause &= (MLO_PAUSE_RX | MLO_PAUSE_TX);
+	if (priv->r->get_port_reg_le(priv->r->mac_rx_pause_sts) & BIT_ULL(port))
+		state->pause |= MLO_PAUSE_RX;
+	if (priv->r->get_port_reg_le(priv->r->mac_tx_pause_sts) & BIT_ULL(port))
+		state->pause |= MLO_PAUSE_TX;
+
+	return 1;
+}
+
+static int rtl93xx_phylink_mac_link_state(struct dsa_switch *ds, int port,
+					  struct phylink_link_state *state)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	u64 speed;
+	u64 link;
+	u64 media;
+
+	if (port < 0 || port > priv->cpu_port)
+		return -EINVAL;
+
+	/* On the RTL9300 for at least the RTL8226B PHY, the MAC-side link
+	 * state needs to be read twice in order to read a correct result.
+	 * This would not be necessary for ports connected e.g. to RTL8218D
+	 * PHYs.
+	 */
+	state->link = 0;
+	link = priv->r->get_port_reg_le(priv->r->mac_link_sts);
+	link = priv->r->get_port_reg_le(priv->r->mac_link_sts);
+	if (link & BIT_ULL(port))
+		state->link = 1;
+
+	if (priv->family_id == RTL9310_FAMILY_ID)
+		media = priv->r->get_port_reg_le(RTL931X_MAC_LINK_MEDIA_STS);
+
+	if (priv->family_id == RTL9300_FAMILY_ID)
+		media = sw_r32(RTL930X_MAC_LINK_MEDIA_STS);
+
+	if (media & BIT_ULL(port))
+		state->link = 1;
+
+	pr_debug("%s: link state port %d: %llx, media %llx\n", __func__, port,
+		 link & BIT_ULL(port), media);
+
+	state->duplex = 0;
+	if (priv->r->get_port_reg_le(priv->r->mac_link_dup_sts) & BIT_ULL(port))
+		state->duplex = 1;
+
+	speed = priv->r->get_port_reg_le(priv->r->mac_link_spd_sts(port));
+	speed >>= (port % 8) << 2;
+	switch (speed & 0xf) {
+	case 0:
+		state->speed = SPEED_10;
+		break;
+	case 1:
+		state->speed = SPEED_100;
+		break;
+	case 2:
+	case 7:
+		state->speed = SPEED_1000;
+		break;
+	case 4:
+		state->speed = SPEED_10000;
+		break;
+	case 5:
+	case 8:
+		state->speed = SPEED_2500;
+		break;
+	case 6:
+		state->speed = SPEED_5000;
+		break;
+	default:
+		pr_err("%s: unknown speed: %d\n", __func__, (u32)speed & 0xf);
+	}
+
+	if (priv->family_id == RTL9310_FAMILY_ID
+		&& (port >= 52 || port <= 55)) { /* Internal serdes */
+			state->speed = SPEED_10000;
+			state->link = 1;
+			state->duplex = 1;
+	}
+
+	pr_debug("%s: speed is: %d %d\n", __func__, (u32)speed & 0xf, state->speed);
+	state->pause &= (MLO_PAUSE_RX | MLO_PAUSE_TX);
+	if (priv->r->get_port_reg_le(priv->r->mac_rx_pause_sts) & BIT_ULL(port))
+		state->pause |= MLO_PAUSE_RX;
+	if (priv->r->get_port_reg_le(priv->r->mac_tx_pause_sts) & BIT_ULL(port))
+		state->pause |= MLO_PAUSE_TX;
+
+	return 1;
+}
+
+static void rtl83xx_config_interface(int port, phy_interface_t interface)
+{
+	u32 old, int_shift, sds_shift;
+
+	switch (port) {
+	case 24:
+		int_shift = 0;
+		sds_shift = 5;
+		break;
+	case 26:
+		int_shift = 3;
+		sds_shift = 0;
+		break;
+	default:
+		return;
+	}
+
+	old = sw_r32(RTL838X_SDS_MODE_SEL);
+	switch (interface) {
+	case PHY_INTERFACE_MODE_1000BASEX:
+		if ((old >> sds_shift & 0x1f) == 4)
+			return;
+		sw_w32_mask(0x7 << int_shift, 1 << int_shift, RTL838X_INT_MODE_CTRL);
+		sw_w32_mask(0x1f << sds_shift, 4 << sds_shift, RTL838X_SDS_MODE_SEL);
+		break;
+	case PHY_INTERFACE_MODE_SGMII:
+		if ((old >> sds_shift & 0x1f) == 2)
+			return;
+		sw_w32_mask(0x7 << int_shift, 2 << int_shift, RTL838X_INT_MODE_CTRL);
+		sw_w32_mask(0x1f << sds_shift, 2 << sds_shift, RTL838X_SDS_MODE_SEL);
+		break;
+	default:
+		return;
+	}
+	pr_debug("configured port %d for interface %s\n", port, phy_modes(interface));
+}
+
+static void rtl83xx_phylink_mac_config(struct dsa_switch *ds, int port,
+					unsigned int mode,
+					const struct phylink_link_state *state)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	u32 reg;
+	int speed_bit = priv->family_id == RTL8380_FAMILY_ID ? 4 : 3;
+
+	pr_debug("%s port %d, mode %x\n", __func__, port, mode);
+
+	if (port == priv->cpu_port) {
+		/* Set Speed, duplex, flow control
+		 * FORCE_EN | LINK_EN | NWAY_EN | DUP_SEL
+		 * | SPD_SEL = 0b10 | FORCE_FC_EN | PHY_MASTER_SLV_MANUAL_EN
+		 * | MEDIA_SEL
+		 */
+		if (priv->family_id == RTL8380_FAMILY_ID) {
+			sw_w32(0x6192F, priv->r->mac_force_mode_ctrl(priv->cpu_port));
+			/* allow CRC errors on CPU-port */
+			sw_w32_mask(0, 0x8, RTL838X_MAC_PORT_CTRL(priv->cpu_port));
+		} else {
+			sw_w32_mask(0, 3, priv->r->mac_force_mode_ctrl(priv->cpu_port));
+		}
+		return;
+	}
+
+	reg = sw_r32(priv->r->mac_force_mode_ctrl(port));
+	/* Auto-Negotiation does not work for MAC in RTL8390 */
+	if (priv->family_id == RTL8380_FAMILY_ID) {
+		if (mode == MLO_AN_PHY || phylink_autoneg_inband(mode)) {
+			pr_debug("PHY autonegotiates\n");
+			reg |= RTL838X_NWAY_EN;
+			sw_w32(reg, priv->r->mac_force_mode_ctrl(port));
+			rtl83xx_config_interface(port, state->interface);
+			return;
+		}
+	}
+
+	if (mode != MLO_AN_FIXED)
+		pr_debug("Fixed state.\n");
+
+	/* Clear id_mode_dis bit, and the existing port mode, let
+		 * RGMII_MODE_EN bet set by mac_link_{up,down}  */
+	if (priv->family_id == RTL8380_FAMILY_ID) {
+		reg &= ~(RTL838X_RX_PAUSE_EN | RTL838X_TX_PAUSE_EN);
+		if (state->pause & MLO_PAUSE_TXRX_MASK) {
+			if (state->pause & MLO_PAUSE_TX)
+				reg |= RTL838X_TX_PAUSE_EN;
+			reg |= RTL838X_RX_PAUSE_EN;
+		}
+	} else if (priv->family_id == RTL8390_FAMILY_ID) {
+		reg &= ~(RTL839X_RX_PAUSE_EN | RTL839X_TX_PAUSE_EN);
+		if (state->pause & MLO_PAUSE_TXRX_MASK) {
+			if (state->pause & MLO_PAUSE_TX)
+				reg |= RTL839X_TX_PAUSE_EN;
+			reg |= RTL839X_RX_PAUSE_EN;
+		}
+	}
+
+
+	reg &= ~(3 << speed_bit);
+	switch (state->speed) {
+	case SPEED_1000:
+		reg |= 2 << speed_bit;
+		break;
+	case SPEED_100:
+		reg |= 1 << speed_bit;
+		break;
+	default:
+		break; /* Ignore, including 10MBit which has a speed value of 0 */
+	}
+
+	if (priv->family_id == RTL8380_FAMILY_ID) {
+		reg &= ~(RTL838X_DUPLEX_MODE | RTL838X_FORCE_LINK_EN);
+		if (state->link)
+			reg |= RTL838X_FORCE_LINK_EN;
+		if (state->duplex == RTL838X_DUPLEX_MODE)
+			reg |= RTL838X_DUPLEX_MODE;
+	} else if (priv->family_id == RTL8390_FAMILY_ID) {
+		reg &= ~(RTL839X_DUPLEX_MODE | RTL839X_FORCE_LINK_EN);
+		if (state->link)
+			reg |= RTL839X_FORCE_LINK_EN;
+		if (state->duplex == RTL839X_DUPLEX_MODE)
+			reg |= RTL839X_DUPLEX_MODE;
+	}
+
+	/* LAG members must use DUPLEX and we need to enable the link */
+	if (priv->lagmembers & BIT_ULL(port)) {
+		switch(priv->family_id) {
+		case RTL8380_FAMILY_ID:
+			reg |= (RTL838X_DUPLEX_MODE | RTL838X_FORCE_LINK_EN);
+		break;
+		case RTL8390_FAMILY_ID:
+			reg |= (RTL839X_DUPLEX_MODE | RTL839X_FORCE_LINK_EN);
+		break;
+		}
+	}
+
+	/* Disable AN */
+	if (priv->family_id == RTL8380_FAMILY_ID)
+		reg &= ~RTL838X_NWAY_EN;
+	sw_w32(reg, priv->r->mac_force_mode_ctrl(port));
+}
+
+static void rtl931x_phylink_mac_config(struct dsa_switch *ds, int port,
+					unsigned int mode,
+					const struct phylink_link_state *state)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	int sds_num;
+	u32 reg, band;
+
+	sds_num = priv->ports[port].sds_num;
+	pr_info("%s: speed %d sds_num %d\n", __func__, state->speed, sds_num);
+
+	switch (state->interface) {
+	case PHY_INTERFACE_MODE_HSGMII:
+		pr_info("%s setting mode PHY_INTERFACE_MODE_HSGMII\n", __func__);
+		band = rtl931x_sds_cmu_band_get(sds_num, PHY_INTERFACE_MODE_HSGMII);
+		rtl931x_sds_init(sds_num, PHY_INTERFACE_MODE_HSGMII);
+		band = rtl931x_sds_cmu_band_set(sds_num, true, 62, PHY_INTERFACE_MODE_HSGMII);
+		break;
+	case PHY_INTERFACE_MODE_1000BASEX:
+		band = rtl931x_sds_cmu_band_get(sds_num, PHY_INTERFACE_MODE_1000BASEX);
+		rtl931x_sds_init(sds_num, PHY_INTERFACE_MODE_1000BASEX);
+		break;
+	case PHY_INTERFACE_MODE_XGMII:
+		band = rtl931x_sds_cmu_band_get(sds_num, PHY_INTERFACE_MODE_XGMII);
+		rtl931x_sds_init(sds_num, PHY_INTERFACE_MODE_XGMII);
+		break;
+	case PHY_INTERFACE_MODE_10GBASER:
+	case PHY_INTERFACE_MODE_10GKR:
+		band = rtl931x_sds_cmu_band_get(sds_num, PHY_INTERFACE_MODE_10GBASER);
+		rtl931x_sds_init(sds_num, PHY_INTERFACE_MODE_10GBASER);
+		break;
+	case PHY_INTERFACE_MODE_USXGMII:
+		/* Translates to MII_USXGMII_10GSXGMII */
+		band = rtl931x_sds_cmu_band_get(sds_num, PHY_INTERFACE_MODE_USXGMII);
+		rtl931x_sds_init(sds_num, PHY_INTERFACE_MODE_USXGMII);
+		break;
+	case PHY_INTERFACE_MODE_SGMII:
+		pr_info("%s setting mode PHY_INTERFACE_MODE_SGMII\n", __func__);
+		band = rtl931x_sds_cmu_band_get(sds_num, PHY_INTERFACE_MODE_SGMII);
+		rtl931x_sds_init(sds_num, PHY_INTERFACE_MODE_SGMII);
+		band = rtl931x_sds_cmu_band_set(sds_num, true, 62, PHY_INTERFACE_MODE_SGMII);
+		break;
+	case PHY_INTERFACE_MODE_QSGMII:
+		band = rtl931x_sds_cmu_band_get(sds_num, PHY_INTERFACE_MODE_QSGMII);
+		rtl931x_sds_init(sds_num, PHY_INTERFACE_MODE_QSGMII);
+		break;
+	default:
+		pr_err("%s: unknown serdes mode: %s\n",
+			__func__, phy_modes(state->interface));
+		return;
+	}
+
+	reg = sw_r32(priv->r->mac_force_mode_ctrl(port));
+	pr_info("%s reading FORCE_MODE_CTRL: %08x\n", __func__, reg);
+
+	reg &= ~(RTL931X_DUPLEX_MODE | RTL931X_FORCE_EN | RTL931X_FORCE_LINK_EN);
+
+	reg &= ~(0xf << 12);
+	reg |= 0x2 << 12; /* Set SMI speed to 0x2 */
+
+	reg |= RTL931X_TX_PAUSE_EN | RTL931X_RX_PAUSE_EN;
+
+	if (priv->lagmembers & BIT_ULL(port))
+		reg |= RTL931X_DUPLEX_MODE;
+
+	if (state->duplex == DUPLEX_FULL)
+		reg |= RTL931X_DUPLEX_MODE;
+
+	sw_w32(reg, priv->r->mac_force_mode_ctrl(port));
+
+}
+
+static void rtl93xx_phylink_mac_config(struct dsa_switch *ds, int port,
+					unsigned int mode,
+					const struct phylink_link_state *state)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	int sds_num, sds_mode;
+	u32 reg;
+
+	pr_info("%s port %d, mode %x, phy-mode: %s, speed %d, link %d\n", __func__,
+		port, mode, phy_modes(state->interface), state->speed, state->link);
+
+	/* Nothing to be done for the CPU-port */
+	if (port == priv->cpu_port)
+		return;
+
+	if (priv->family_id == RTL9310_FAMILY_ID)
+		return rtl931x_phylink_mac_config(ds, port, mode, state);
+
+	sds_num = priv->ports[port].sds_num;
+	pr_info("%s SDS is %d\n", __func__, sds_num);
+	if (sds_num >= 0) {
+		switch (state->interface) {
+		case PHY_INTERFACE_MODE_HSGMII:
+			sds_mode = 0x12;
+			break;
+		case PHY_INTERFACE_MODE_1000BASEX:
+			sds_mode = 0x04;
+			break;
+		case PHY_INTERFACE_MODE_XGMII:
+			sds_mode = 0x10;
+			break;
+		case PHY_INTERFACE_MODE_10GBASER:
+		case PHY_INTERFACE_MODE_10GKR:
+			sds_mode = 0x1b; /* 10G 1000X Auto */
+			break;
+		case PHY_INTERFACE_MODE_USXGMII:
+			sds_mode = 0x0d;
+			break;
+		default:
+			pr_err("%s: unknown serdes mode: %s\n",
+			       __func__, phy_modes(state->interface));
+			return;
+		}
+		if (state->interface == PHY_INTERFACE_MODE_10GBASER)
+			rtl9300_serdes_setup(sds_num, state->interface);
+	}
+
+	reg = sw_r32(priv->r->mac_force_mode_ctrl(port));
+	reg &= ~(0xf << 3);
+
+	switch (state->speed) {
+	case SPEED_10000:
+		reg |= 4 << 3;
+		break;
+	case SPEED_5000:
+		reg |= 6 << 3;
+		break;
+	case SPEED_2500:
+		reg |= 5 << 3;
+		break;
+	case SPEED_1000:
+		reg |= 2 << 3;
+		break;
+	default:
+		reg |= 2 << 3;
+		break;
+	}
+
+	if (state->link)
+		reg |= RTL930X_FORCE_LINK_EN;
+
+	if (priv->lagmembers & BIT_ULL(port))
+		reg |= RTL930X_DUPLEX_MODE | RTL930X_FORCE_LINK_EN;
+
+	if (state->duplex == DUPLEX_FULL)
+		reg |= RTL930X_DUPLEX_MODE;
+
+	if (priv->ports[port].phy_is_integrated)
+		reg &= ~RTL930X_FORCE_EN; /* Clear MAC_FORCE_EN to allow SDS-MAC link */
+	else
+		reg |= RTL930X_FORCE_EN;
+
+	sw_w32(reg, priv->r->mac_force_mode_ctrl(port));
+}
+
+static void rtl83xx_phylink_mac_link_down(struct dsa_switch *ds, int port,
+				     unsigned int mode,
+				     phy_interface_t interface)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+
+	/* Stop TX/RX to port */
+	sw_w32_mask(0x3, 0, priv->r->mac_port_ctrl(port));
+
+	/* No longer force link */
+	sw_w32_mask(0x3, 0, priv->r->mac_force_mode_ctrl(port));
+}
+
+static void rtl93xx_phylink_mac_link_down(struct dsa_switch *ds, int port,
+				     unsigned int mode,
+				     phy_interface_t interface)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	u32 v = 0;
+
+	/* Stop TX/RX to port */
+	sw_w32_mask(0x3, 0, priv->r->mac_port_ctrl(port));
+
+	/* No longer force link */
+	if (priv->family_id == RTL9300_FAMILY_ID)
+		v = RTL930X_FORCE_EN | RTL930X_FORCE_LINK_EN;
+	else if (priv->family_id == RTL9310_FAMILY_ID)
+		v = RTL931X_FORCE_EN | RTL931X_FORCE_LINK_EN;
+	sw_w32_mask(v, 0, priv->r->mac_force_mode_ctrl(port));
+}
+
+static void rtl83xx_phylink_mac_link_up(struct dsa_switch *ds, int port,
+				   unsigned int mode,
+				   phy_interface_t interface,
+				   struct phy_device *phydev,
+				   int speed, int duplex,
+				   bool tx_pause, bool rx_pause)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	/* Restart TX/RX to port */
+	sw_w32_mask(0, 0x3, priv->r->mac_port_ctrl(port));
+	/* TODO: Set speed/duplex/pauses */
+}
+
+static void rtl93xx_phylink_mac_link_up(struct dsa_switch *ds, int port,
+				   unsigned int mode,
+				   phy_interface_t interface,
+				   struct phy_device *phydev,
+				   int speed, int duplex,
+				   bool tx_pause, bool rx_pause)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+
+	/* Restart TX/RX to port */
+	sw_w32_mask(0, 0x3, priv->r->mac_port_ctrl(port));
+	/* TODO: Set speed/duplex/pauses */
+}
+
+static void rtl83xx_get_strings(struct dsa_switch *ds,
+				int port, u32 stringset, u8 *data)
+{
+	if (stringset != ETH_SS_STATS)
+		return;
+
+	for (int i = 0; i < ARRAY_SIZE(rtl83xx_mib); i++)
+		strncpy(data + i * ETH_GSTRING_LEN, rtl83xx_mib[i].name,
+			ETH_GSTRING_LEN);
+}
+
+static void rtl83xx_get_ethtool_stats(struct dsa_switch *ds, int port,
+				      uint64_t *data)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	const struct rtl83xx_mib_desc *mib;
+	u64 h;
+
+	for (int i = 0; i < ARRAY_SIZE(rtl83xx_mib); i++) {
+		mib = &rtl83xx_mib[i];
+
+		data[i] = sw_r32(priv->r->stat_port_std_mib + (port << 8) + 252 - mib->offset);
+		if (mib->size == 2) {
+			h = sw_r32(priv->r->stat_port_std_mib + (port << 8) + 248 - mib->offset);
+			data[i] |= h << 32;
+		}
+	}
+}
+
+static int rtl83xx_get_sset_count(struct dsa_switch *ds, int port, int sset)
+{
+	if (sset != ETH_SS_STATS)
+		return 0;
+
+	return ARRAY_SIZE(rtl83xx_mib);
+}
+
+static int rtl83xx_mc_group_alloc(struct rtl838x_switch_priv *priv, int port)
+{
+	int mc_group = find_first_zero_bit(priv->mc_group_bm, MAX_MC_GROUPS - 1);
+	u64 portmask;
+
+	if (mc_group >= MAX_MC_GROUPS - 1)
+		return -1;
+
+	set_bit(mc_group, priv->mc_group_bm);
+	portmask = BIT_ULL(port);
+	priv->r->write_mcast_pmask(mc_group, portmask);
+
+	return mc_group;
+}
+
+static u64 rtl83xx_mc_group_add_port(struct rtl838x_switch_priv *priv, int mc_group, int port)
+{
+	u64 portmask = priv->r->read_mcast_pmask(mc_group);
+
+	pr_debug("%s: %d\n", __func__, port);
+
+	portmask |= BIT_ULL(port);
+	priv->r->write_mcast_pmask(mc_group, portmask);
+
+	return portmask;
+}
+
+static u64 rtl83xx_mc_group_del_port(struct rtl838x_switch_priv *priv, int mc_group, int port)
+{
+	u64 portmask = priv->r->read_mcast_pmask(mc_group);
+
+	pr_debug("%s: %d\n", __func__, port);
+
+	portmask &= ~BIT_ULL(port);
+	priv->r->write_mcast_pmask(mc_group, portmask);
+	if (!portmask)
+		clear_bit(mc_group, priv->mc_group_bm);
+
+	return portmask;
+}
+
+static int rtl83xx_port_enable(struct dsa_switch *ds, int port,
+				struct phy_device *phydev)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	u64 v;
+
+	pr_debug("%s: %x %d", __func__, (u32) priv, port);
+	priv->ports[port].enable = true;
+
+	/* enable inner tagging on egress, do not keep any tags */
+	priv->r->vlan_port_keep_tag_set(port, 0, 1);
+
+	if (dsa_is_cpu_port(ds, port))
+		return 0;
+
+	/* add port to switch mask of CPU_PORT */
+	priv->r->traffic_enable(priv->cpu_port, port);
+
+	if (priv->is_lagmember[port]) {
+		pr_debug("%s: %d is lag slave. ignore\n", __func__, port);
+		return 0;
+	}
+
+	/* add all other ports in the same bridge to switch mask of port */
+	v = priv->r->traffic_get(port);
+	v |= priv->ports[port].pm;
+	priv->r->traffic_set(port, v);
+
+	/* TODO: Figure out if this is necessary */
+	if (priv->family_id == RTL9300_FAMILY_ID) {
+		sw_w32_mask(0, BIT(port), RTL930X_L2_PORT_SABLK_CTRL);
+		sw_w32_mask(0, BIT(port), RTL930X_L2_PORT_DABLK_CTRL);
+	}
+
+	if (priv->ports[port].sds_num < 0)
+		priv->ports[port].sds_num = rtl93xx_get_sds(phydev);
+
+	return 0;
+}
+
+static void rtl83xx_port_disable(struct dsa_switch *ds, int port)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	u64 v;
+
+	pr_debug("%s %x: %d", __func__, (u32)priv, port);
+	/* you can only disable user ports */
+	if (!dsa_is_user_port(ds, port))
+		return;
+
+	/* BUG: This does not work on RTL931X */
+	/* remove port from switch mask of CPU_PORT */
+	priv->r->traffic_disable(priv->cpu_port, port);
+
+	/* remove all other ports in the same bridge from switch mask of port */
+	v = priv->r->traffic_get(port);
+	v &= ~priv->ports[port].pm;
+	priv->r->traffic_set(port, v);
+
+	priv->ports[port].enable = false;
+}
+
+static int rtl83xx_set_mac_eee(struct dsa_switch *ds, int port,
+			       struct ethtool_eee *e)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+
+	if (e->eee_enabled && !priv->eee_enabled) {
+		pr_info("Globally enabling EEE\n");
+		priv->r->init_eee(priv, true);
+	}
+
+	priv->r->port_eee_set(priv, port, e->eee_enabled);
+
+	if (e->eee_enabled)
+		pr_info("Enabled EEE for port %d\n", port);
+	else
+		pr_info("Disabled EEE for port %d\n", port);
+
+	return 0;
+}
+
+static int rtl83xx_get_mac_eee(struct dsa_switch *ds, int port,
+			       struct ethtool_eee *e)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+
+	e->supported = SUPPORTED_100baseT_Full | SUPPORTED_1000baseT_Full;
+
+	priv->r->eee_port_ability(priv, e, port);
+
+	e->eee_enabled = priv->ports[port].eee_enabled;
+
+	e->eee_active = !!(e->advertised & e->lp_advertised);
+
+	return 0;
+}
+
+static int rtl93xx_get_mac_eee(struct dsa_switch *ds, int port,
+			       struct ethtool_eee *e)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+
+	e->supported = SUPPORTED_100baseT_Full |
+	               SUPPORTED_1000baseT_Full |
+	               SUPPORTED_2500baseX_Full;
+
+	priv->r->eee_port_ability(priv, e, port);
+
+	e->eee_enabled = priv->ports[port].eee_enabled;
+
+	e->eee_active = !!(e->advertised & e->lp_advertised);
+
+	return 0;
+}
+
+static int rtl83xx_set_ageing_time(struct dsa_switch *ds, unsigned int msec)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+
+	priv->r->set_ageing_time(msec);
+
+	return 0;
+}
+
+static int rtl83xx_port_bridge_join(struct dsa_switch *ds, int port,
+					struct net_device *bridge)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	u64 port_bitmap = BIT_ULL(priv->cpu_port), v;
+
+	pr_debug("%s %x: %d %llx", __func__, (u32)priv, port, port_bitmap);
+
+	if (priv->is_lagmember[port]) {
+		pr_debug("%s: %d is lag slave. ignore\n", __func__, port);
+		return 0;
+	}
+
+	mutex_lock(&priv->reg_mutex);
+	for (int i = 0; i < ds->num_ports; i++) {
+		/* Add this port to the port matrix of the other ports in the
+		 * same bridge. If the port is disabled, port matrix is kept
+		 * and not being setup until the port becomes enabled.
+		 */
+		if (dsa_is_user_port(ds, i) && !priv->is_lagmember[i] && i != port) {
+			if (dsa_to_port(ds, i)->bridge_dev != bridge)
+				continue;
+			if (priv->ports[i].enable)
+				priv->r->traffic_enable(i, port);
+
+			priv->ports[i].pm |= BIT_ULL(port);
+			port_bitmap |= BIT_ULL(i);
+		}
+	}
+
+	/* Add all other ports to this port matrix. */
+	if (priv->ports[port].enable) {
+		priv->r->traffic_enable(priv->cpu_port, port);
+		v = priv->r->traffic_get(port);
+		v |= port_bitmap;
+		priv->r->traffic_set(port, v);
+	}
+	priv->ports[port].pm |= port_bitmap;
+
+	if (priv->r->set_static_move_action)
+		priv->r->set_static_move_action(port, false);
+
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+static void rtl83xx_port_bridge_leave(struct dsa_switch *ds, int port,
+					struct net_device *bridge)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	u64 port_bitmap = 0, v;
+
+	pr_debug("%s %x: %d", __func__, (u32)priv, port);
+	mutex_lock(&priv->reg_mutex);
+	for (int i = 0; i < ds->num_ports; i++) {
+		/* Remove this port from the port matrix of the other ports
+		 * in the same bridge. If the port is disabled, port matrix
+		 * is kept and not being setup until the port becomes enabled.
+		 * And the other port's port matrix cannot be broken when the
+		 * other port is still a VLAN-aware port.
+		 */
+		if (dsa_is_user_port(ds, i) && i != port) {
+			if (dsa_to_port(ds, i)->bridge_dev != bridge)
+				continue;
+			if (priv->ports[i].enable)
+				priv->r->traffic_disable(i, port);
+
+			priv->ports[i].pm &= ~BIT_ULL(port);
+			port_bitmap |= BIT_ULL(i);
+		}
+	}
+
+	/* Remove all other ports from this port matrix. */
+	if (priv->ports[port].enable) {
+		v = priv->r->traffic_get(port);
+		v &= ~port_bitmap;
+		priv->r->traffic_set(port, v);
+	}
+	priv->ports[port].pm &= ~port_bitmap;
+
+	if (priv->r->set_static_move_action)
+		priv->r->set_static_move_action(port, true);
+
+	mutex_unlock(&priv->reg_mutex);
+}
+
+void rtl83xx_port_stp_state_set(struct dsa_switch *ds, int port, u8 state)
+{
+	u32 msti = 0;
+	u32 port_state[4];
+	int index, bit;
+	int pos = port;
+	struct rtl838x_switch_priv *priv = ds->priv;
+	int n = priv->port_width << 1;
+
+	/* Ports above or equal CPU port can never be configured */
+	if (port >= priv->cpu_port)
+		return;
+
+	mutex_lock(&priv->reg_mutex);
+
+	/* For the RTL839x and following, the bits are left-aligned, 838x and 930x
+	 * have 64 bit fields, 839x and 931x have 128 bit fields
+	 */
+	if (priv->family_id == RTL8390_FAMILY_ID)
+		pos += 12;
+	if (priv->family_id == RTL9300_FAMILY_ID)
+		pos += 3;
+	if (priv->family_id == RTL9310_FAMILY_ID)
+		pos += 8;
+
+	index = n - (pos >> 4) - 1;
+	bit = (pos << 1) % 32;
+
+	priv->r->stp_get(priv, msti, port_state);
+
+	pr_debug("Current state, port %d: %d\n", port, (port_state[index] >> bit) & 3);
+	port_state[index] &= ~(3 << bit);
+
+	switch (state) {
+	case BR_STATE_DISABLED: /* 0 */
+		port_state[index] |= (0 << bit);
+		break;
+	case BR_STATE_BLOCKING:  /* 4 */
+	case BR_STATE_LISTENING: /* 1 */
+		port_state[index] |= (1 << bit);
+		break;
+	case BR_STATE_LEARNING: /* 2 */
+		port_state[index] |= (2 << bit);
+		break;
+	case BR_STATE_FORWARDING: /* 3 */
+		port_state[index] |= (3 << bit);
+	default:
+		break;
+	}
+
+	priv->r->stp_set(priv, msti, port_state);
+
+	mutex_unlock(&priv->reg_mutex);
+}
+
+void rtl83xx_fast_age(struct dsa_switch *ds, int port)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	int s = priv->family_id == RTL8390_FAMILY_ID ? 2 : 0;
+
+	pr_debug("FAST AGE port %d\n", port);
+	mutex_lock(&priv->reg_mutex);
+	/* RTL838X_L2_TBL_FLUSH_CTRL register bits, 839x has 1 bit larger
+	 * port fields:
+	 * 0-4: Replacing port
+	 * 5-9: Flushed/replaced port
+	 * 10-21: FVID
+	 * 22: Entry types: 1: dynamic, 0: also static
+	 * 23: Match flush port
+	 * 24: Match FVID
+	 * 25: Flush (0) or replace (1) L2 entries
+	 * 26: Status of action (1: Start, 0: Done)
+	 */
+	sw_w32(1 << (26 + s) | 1 << (23 + s) | port << (5 + (s / 2)), priv->r->l2_tbl_flush_ctrl);
+
+	do { } while (sw_r32(priv->r->l2_tbl_flush_ctrl) & BIT(26 + s));
+
+	mutex_unlock(&priv->reg_mutex);
+}
+
+void rtl931x_fast_age(struct dsa_switch *ds, int port)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+
+	pr_info("%s port %d\n", __func__, port);
+	mutex_lock(&priv->reg_mutex);
+	sw_w32(port << 11, RTL931X_L2_TBL_FLUSH_CTRL + 4);
+
+	sw_w32(BIT(24) | BIT(28), RTL931X_L2_TBL_FLUSH_CTRL);
+
+	do { } while (sw_r32(RTL931X_L2_TBL_FLUSH_CTRL) & BIT (28));
+
+	mutex_unlock(&priv->reg_mutex);
+}
+
+void rtl930x_fast_age(struct dsa_switch *ds, int port)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+
+	if (priv->family_id == RTL9310_FAMILY_ID)
+		return rtl931x_fast_age(ds, port);
+
+	pr_debug("FAST AGE port %d\n", port);
+	mutex_lock(&priv->reg_mutex);
+	sw_w32(port << 11, RTL930X_L2_TBL_FLUSH_CTRL + 4);
+
+	sw_w32(BIT(26) | BIT(30), RTL930X_L2_TBL_FLUSH_CTRL);
+
+	do { } while (sw_r32(priv->r->l2_tbl_flush_ctrl) & BIT(30));
+
+	mutex_unlock(&priv->reg_mutex);
+}
+
+static int rtl83xx_vlan_filtering(struct dsa_switch *ds, int port,
+				  bool vlan_filtering,
+				  struct netlink_ext_ack *extack)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+
+	pr_debug("%s: port %d\n", __func__, port);
+	mutex_lock(&priv->reg_mutex);
+
+	if (vlan_filtering) {
+		/* Enable ingress and egress filtering
+		 * The VLAN_PORT_IGR_FILTER register uses 2 bits for each port to define
+		 * the filter action:
+		 * 0: Always Forward
+		 * 1: Drop packet
+		 * 2: Trap packet to CPU port
+		 * The Egress filter used 1 bit per state (0: DISABLED, 1: ENABLED)
+		 */
+		if (port != priv->cpu_port)
+			priv->r->set_vlan_igr_filter(port, IGR_DROP);
+
+		priv->r->set_vlan_egr_filter(port, EGR_ENABLE);
+	} else {
+		/* Disable ingress and egress filtering */
+		if (port != priv->cpu_port)
+			priv->r->set_vlan_igr_filter(port, IGR_FORWARD);
+
+		priv->r->set_vlan_egr_filter(port, EGR_DISABLE);
+	}
+
+	/* Do we need to do something to the CPU-Port, too? */
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+static int rtl83xx_vlan_prepare(struct dsa_switch *ds, int port,
+				const struct switchdev_obj_port_vlan *vlan)
+{
+	struct rtl838x_vlan_info info;
+	struct rtl838x_switch_priv *priv = ds->priv;
+
+	priv->r->vlan_tables_read(0, &info);
+
+	pr_debug("VLAN 0: Tagged ports %llx, untag %llx, profile %d, MC# %d, UC# %d, FID %x\n",
+		info.tagged_ports, info.untagged_ports, info.profile_id,
+		info.hash_mc_fid, info.hash_uc_fid, info.fid);
+
+	priv->r->vlan_tables_read(1, &info);
+	pr_debug("VLAN 1: Tagged ports %llx, untag %llx, profile %d, MC# %d, UC# %d, FID %x\n",
+		info.tagged_ports, info.untagged_ports, info.profile_id,
+		info.hash_mc_fid, info.hash_uc_fid, info.fid);
+	priv->r->vlan_set_untagged(1, info.untagged_ports);
+	pr_debug("SET: Untagged ports, VLAN %d: %llx\n", 1, info.untagged_ports);
+
+	priv->r->vlan_set_tagged(1, &info);
+	pr_debug("SET: Tagged ports, VLAN %d: %llx\n", 1, info.tagged_ports);
+
+	return 0;
+}
+
+static void rtl83xx_vlan_set_pvid(struct rtl838x_switch_priv *priv,
+				  int port, int pvid)
+{
+	/* Set both inner and outer PVID of the port */
+	priv->r->vlan_port_pvid_set(port, PBVLAN_TYPE_INNER, pvid);
+	priv->r->vlan_port_pvid_set(port, PBVLAN_TYPE_OUTER, pvid);
+	priv->r->vlan_port_pvidmode_set(port, PBVLAN_TYPE_INNER,
+					PBVLAN_MODE_UNTAG_AND_PRITAG);
+	priv->r->vlan_port_pvidmode_set(port, PBVLAN_TYPE_OUTER,
+					PBVLAN_MODE_UNTAG_AND_PRITAG);
+
+	priv->ports[port].pvid = pvid;
+}
+
+static int rtl83xx_vlan_add(struct dsa_switch *ds, int port,
+			    const struct switchdev_obj_port_vlan *vlan,
+			    struct netlink_ext_ack *extack)
+{
+	struct rtl838x_vlan_info info;
+	struct rtl838x_switch_priv *priv = ds->priv;
+	int err;
+
+	pr_debug("%s port %d, vid %d, flags %x\n",
+		__func__, port, vlan->vid, vlan->flags);
+
+	if (vlan->vid > 4095) {
+		dev_err(priv->dev, "VLAN out of range: %d", vlan->vid);
+		return -ENOTSUPP;
+	}
+
+	err = rtl83xx_vlan_prepare(ds, port, vlan);
+	if (err)
+		return err;
+
+	mutex_lock(&priv->reg_mutex);
+
+	if (vlan->flags & BRIDGE_VLAN_INFO_PVID)
+		rtl83xx_vlan_set_pvid(priv, port, vlan->vid);
+	else if (priv->ports[port].pvid == vlan->vid)
+		rtl83xx_vlan_set_pvid(priv, port, 0);
+
+	/* Get port memberships of this vlan */
+	priv->r->vlan_tables_read(vlan->vid, &info);
+
+	/* new VLAN? */
+	if (!info.tagged_ports) {
+		info.fid = 0;
+		info.hash_mc_fid = false;
+		info.hash_uc_fid = false;
+		info.profile_id = 0;
+	}
+
+	/* sanitize untagged_ports - must be a subset */
+	if (info.untagged_ports & ~info.tagged_ports)
+		info.untagged_ports = 0;
+
+	info.tagged_ports |= BIT_ULL(port);
+	if (vlan->flags & BRIDGE_VLAN_INFO_UNTAGGED)
+		info.untagged_ports |= BIT_ULL(port);
+	else
+		info.untagged_ports &= ~BIT_ULL(port);
+
+	priv->r->vlan_set_untagged(vlan->vid, info.untagged_ports);
+	pr_debug("Untagged ports, VLAN %d: %llx\n", vlan->vid, info.untagged_ports);
+
+	priv->r->vlan_set_tagged(vlan->vid, &info);
+	pr_debug("Tagged ports, VLAN %d: %llx\n", vlan->vid, info.tagged_ports);
+
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+static int rtl83xx_vlan_del(struct dsa_switch *ds, int port,
+			    const struct switchdev_obj_port_vlan *vlan)
+{
+	struct rtl838x_vlan_info info;
+	struct rtl838x_switch_priv *priv = ds->priv;
+	u16 pvid;
+
+	pr_debug("%s: port %d, vid %d, flags %x\n",
+		__func__, port, vlan->vid, vlan->flags);
+
+	if (vlan->vid > 4095) {
+		dev_err(priv->dev, "VLAN out of range: %d", vlan->vid);
+		return -ENOTSUPP;
+	}
+
+	mutex_lock(&priv->reg_mutex);
+	pvid = priv->ports[port].pvid;
+
+	/* Reset to default if removing the current PVID */
+	if (vlan->vid == pvid) {
+		rtl83xx_vlan_set_pvid(priv, port, 0);
+	}
+	/* Get port memberships of this vlan */
+	priv->r->vlan_tables_read(vlan->vid, &info);
+
+	/* remove port from both tables */
+	info.untagged_ports &= (~BIT_ULL(port));
+	info.tagged_ports &= (~BIT_ULL(port));
+
+	priv->r->vlan_set_untagged(vlan->vid, info.untagged_ports);
+	pr_debug("Untagged ports, VLAN %d: %llx\n", vlan->vid, info.untagged_ports);
+
+	priv->r->vlan_set_tagged(vlan->vid, &info);
+	pr_debug("Tagged ports, VLAN %d: %llx\n", vlan->vid, info.tagged_ports);
+
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+static void rtl83xx_setup_l2_uc_entry(struct rtl838x_l2_entry *e, int port, int vid, u64 mac)
+{
+	memset(e, 0, sizeof(*e));
+
+	e->type = L2_UNICAST;
+	e->valid = true;
+
+	e->age = 3;
+	e->is_static = true;
+
+	e->port = port;
+
+	e->rvid = e->vid = vid;
+	e->is_ip_mc = e->is_ipv6_mc = false;
+	u64_to_ether_addr(mac, e->mac);
+}
+
+static void rtl83xx_setup_l2_mc_entry(struct rtl838x_l2_entry *e, int vid, u64 mac, int mc_group)
+{
+	memset(e, 0, sizeof(*e));
+
+	e->type = L2_MULTICAST;
+	e->valid = true;
+
+	e->mc_portmask_index = mc_group;
+
+	e->rvid = e->vid = vid;
+	e->is_ip_mc = e->is_ipv6_mc = false;
+	u64_to_ether_addr(mac, e->mac);
+}
+
+/* Uses the seed to identify a hash bucket in the L2 using the derived hash key and then loops
+ * over the entries in the bucket until either a matching entry is found or an empty slot
+ * Returns the filled in rtl838x_l2_entry and the index in the bucket when an entry was found
+ * when an empty slot was found and must exist is false, the index of the slot is returned
+ * when no slots are available returns -1
+ */
+static int rtl83xx_find_l2_hash_entry(struct rtl838x_switch_priv *priv, u64 seed,
+				     bool must_exist, struct rtl838x_l2_entry *e)
+{
+	int idx = -1;
+	u32 key = priv->r->l2_hash_key(priv, seed);
+	u64 entry;
+
+	pr_debug("%s: using key %x, for seed %016llx\n", __func__, key, seed);
+	/* Loop over all entries in the hash-bucket and over the second block on 93xx SoCs */
+	for (int i = 0; i < priv->l2_bucket_size; i++) {
+		entry = priv->r->read_l2_entry_using_hash(key, i, e);
+		pr_debug("valid %d, mac %016llx\n", e->valid, ether_addr_to_u64(&e->mac[0]));
+		if (must_exist && !e->valid)
+			continue;
+		if (!e->valid || ((entry & 0x0fffffffffffffffULL) == seed)) {
+			idx = i > 3 ? ((key >> 14) & 0xffff) | i >> 1 : ((key << 2) | i) & 0xffff;
+			break;
+		}
+	}
+
+	return idx;
+}
+
+/* Uses the seed to identify an entry in the CAM by looping over all its entries
+ * Returns the filled in rtl838x_l2_entry and the index in the CAM when an entry was found
+ * when an empty slot was found the index of the slot is returned
+ * when no slots are available returns -1
+ */
+static int rtl83xx_find_l2_cam_entry(struct rtl838x_switch_priv *priv, u64 seed,
+				     bool must_exist, struct rtl838x_l2_entry *e)
+{
+	int idx = -1;
+	u64 entry;
+
+	for (int i = 0; i < 64; i++) {
+		entry = priv->r->read_cam(i, e);
+		if (!must_exist && !e->valid) {
+			if (idx < 0) /* First empty entry? */
+				idx = i;
+			break;
+		} else if ((entry & 0x0fffffffffffffffULL) == seed) {
+			pr_debug("Found entry in CAM\n");
+			idx = i;
+			break;
+		}
+	}
+
+	return idx;
+}
+
+static int rtl83xx_port_fdb_add(struct dsa_switch *ds, int port,
+				const unsigned char *addr, u16 vid)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	u64 mac = ether_addr_to_u64(addr);
+	struct rtl838x_l2_entry e;
+	int err = 0, idx;
+	u64 seed = priv->r->l2_hash_seed(mac, vid);
+
+	if (priv->is_lagmember[port]) {
+		pr_debug("%s: %d is lag slave. ignore\n", __func__, port);
+		return 0;
+	}
+
+	mutex_lock(&priv->reg_mutex);
+
+	idx = rtl83xx_find_l2_hash_entry(priv, seed, false, &e);
+
+	/* Found an existing or empty entry */
+	if (idx >= 0) {
+		rtl83xx_setup_l2_uc_entry(&e, port, vid, mac);
+		priv->r->write_l2_entry_using_hash(idx >> 2, idx & 0x3, &e);
+		goto out;
+	}
+
+	/* Hash buckets full, try CAM */
+	idx = rtl83xx_find_l2_cam_entry(priv, seed, false, &e);
+
+	if (idx >= 0) {
+		rtl83xx_setup_l2_uc_entry(&e, port, vid, mac);
+		priv->r->write_cam(idx, &e);
+		goto out;
+	}
+
+	err = -ENOTSUPP;
+
+out:
+	mutex_unlock(&priv->reg_mutex);
+
+	return err;
+}
+
+static int rtl83xx_port_fdb_del(struct dsa_switch *ds, int port,
+			   const unsigned char *addr, u16 vid)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	u64 mac = ether_addr_to_u64(addr);
+	struct rtl838x_l2_entry e;
+	int err = 0, idx;
+	u64 seed = priv->r->l2_hash_seed(mac, vid);
+
+	pr_debug("In %s, mac %llx, vid: %d\n", __func__, mac, vid);
+	mutex_lock(&priv->reg_mutex);
+
+	idx = rtl83xx_find_l2_hash_entry(priv, seed, true, &e);
+
+	if (idx >= 0) {
+		pr_debug("Found entry index %d, key %d and bucket %d\n", idx, idx >> 2, idx & 3);
+		e.valid = false;
+		priv->r->write_l2_entry_using_hash(idx >> 2, idx & 0x3, &e);
+		goto out;
+	}
+
+	/* Check CAM for spillover from hash buckets */
+	idx = rtl83xx_find_l2_cam_entry(priv, seed, true, &e);
+
+	if (idx >= 0) {
+		e.valid = false;
+		priv->r->write_cam(idx, &e);
+		goto out;
+	}
+	err = -ENOENT;
+
+out:
+	mutex_unlock(&priv->reg_mutex);
+
+	return err;
+}
+
+static int rtl83xx_port_fdb_dump(struct dsa_switch *ds, int port,
+				 dsa_fdb_dump_cb_t *cb, void *data)
+{
+	struct rtl838x_l2_entry e;
+	struct rtl838x_switch_priv *priv = ds->priv;
+
+	mutex_lock(&priv->reg_mutex);
+
+	for (int i = 0; i < priv->fib_entries; i++) {
+		priv->r->read_l2_entry_using_hash(i >> 2, i & 0x3, &e);
+
+		if (!e.valid)
+			continue;
+
+		if (e.port == port || e.port == RTL930X_PORT_IGNORE)
+			cb(e.mac, e.vid, e.is_static, data);
+
+		if (!((i + 1) % 64))
+			cond_resched();
+	}
+
+	for (int i = 0; i < 64; i++) {
+		priv->r->read_cam(i, &e);
+
+		if (!e.valid)
+			continue;
+
+		if (e.port == port)
+			cb(e.mac, e.vid, e.is_static, data);
+	}
+
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+static int rtl83xx_port_mdb_add(struct dsa_switch *ds, int port,
+			const struct switchdev_obj_port_mdb *mdb)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	u64 mac = ether_addr_to_u64(mdb->addr);
+	struct rtl838x_l2_entry e;
+	int err = 0, idx;
+	int vid = mdb->vid;
+	u64 seed = priv->r->l2_hash_seed(mac, vid);
+	int mc_group;
+
+	if (priv->id >= 0x9300)
+		return -EOPNOTSUPP;
+
+	pr_debug("In %s port %d, mac %llx, vid: %d\n", __func__, port, mac, vid);
+
+	if (priv->is_lagmember[port]) {
+		pr_debug("%s: %d is lag slave. ignore\n", __func__, port);
+		return -EINVAL;
+	}
+
+	mutex_lock(&priv->reg_mutex);
+
+	idx = rtl83xx_find_l2_hash_entry(priv, seed, false, &e);
+
+	/* Found an existing or empty entry */
+	if (idx >= 0) {
+		if (e.valid) {
+			pr_debug("Found an existing entry %016llx, mc_group %d\n",
+				ether_addr_to_u64(e.mac), e.mc_portmask_index);
+			rtl83xx_mc_group_add_port(priv, e.mc_portmask_index, port);
+		} else {
+			pr_debug("New entry for seed %016llx\n", seed);
+			mc_group = rtl83xx_mc_group_alloc(priv, port);
+			if (mc_group < 0) {
+				err = -ENOTSUPP;
+				goto out;
+			}
+			rtl83xx_setup_l2_mc_entry(&e, vid, mac, mc_group);
+			priv->r->write_l2_entry_using_hash(idx >> 2, idx & 0x3, &e);
+		}
+		goto out;
+	}
+
+	/* Hash buckets full, try CAM */
+	idx = rtl83xx_find_l2_cam_entry(priv, seed, false, &e);
+
+	if (idx >= 0) {
+		if (e.valid) {
+			pr_debug("Found existing CAM entry %016llx, mc_group %d\n",
+				 ether_addr_to_u64(e.mac), e.mc_portmask_index);
+			rtl83xx_mc_group_add_port(priv, e.mc_portmask_index, port);
+		} else {
+			pr_debug("New entry\n");
+			mc_group = rtl83xx_mc_group_alloc(priv, port);
+			if (mc_group < 0) {
+				err = -ENOTSUPP;
+				goto out;
+			}
+			rtl83xx_setup_l2_mc_entry(&e, vid, mac, mc_group);
+			priv->r->write_cam(idx, &e);
+		}
+		goto out;
+	}
+
+	err = -ENOTSUPP;
+
+out:
+	mutex_unlock(&priv->reg_mutex);
+	if (err)
+		dev_err(ds->dev, "failed to add MDB entry\n");
+
+	return err;
+}
+
+int rtl83xx_port_mdb_del(struct dsa_switch *ds, int port,
+			const struct switchdev_obj_port_mdb *mdb)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	u64 mac = ether_addr_to_u64(mdb->addr);
+	struct rtl838x_l2_entry e;
+	int err = 0, idx;
+	int vid = mdb->vid;
+	u64 seed = priv->r->l2_hash_seed(mac, vid);
+	u64 portmask;
+
+	pr_debug("In %s, port %d, mac %llx, vid: %d\n", __func__, port, mac, vid);
+
+	if (priv->is_lagmember[port]) {
+		pr_info("%s: %d is lag slave. ignore\n", __func__, port);
+		return 0;
+	}
+
+	mutex_lock(&priv->reg_mutex);
+
+	idx = rtl83xx_find_l2_hash_entry(priv, seed, true, &e);
+
+	if (idx >= 0) {
+		pr_debug("Found entry index %d, key %d and bucket %d\n", idx, idx >> 2, idx & 3);
+		portmask = rtl83xx_mc_group_del_port(priv, e.mc_portmask_index, port);
+		if (!portmask) {
+			e.valid = false;
+			priv->r->write_l2_entry_using_hash(idx >> 2, idx & 0x3, &e);
+		}
+		goto out;
+	}
+
+	/* Check CAM for spillover from hash buckets */
+	idx = rtl83xx_find_l2_cam_entry(priv, seed, true, &e);
+
+	if (idx >= 0) {
+		portmask = rtl83xx_mc_group_del_port(priv, e.mc_portmask_index, port);
+		if (!portmask) {
+			e.valid = false;
+			priv->r->write_cam(idx, &e);
+		}
+		goto out;
+	}
+	/* TODO: Re-enable with a newer kernel: err = -ENOENT; */
+
+out:
+	mutex_unlock(&priv->reg_mutex);
+
+	return err;
+}
+
+static int rtl83xx_port_mirror_add(struct dsa_switch *ds, int port,
+				   struct dsa_mall_mirror_tc_entry *mirror,
+				   bool ingress)
+{
+	/* We support 4 mirror groups, one destination port per group */
+	int group;
+	struct rtl838x_switch_priv *priv = ds->priv;
+	int ctrl_reg, dpm_reg, spm_reg;
+
+	pr_debug("In %s\n", __func__);
+
+	for (group = 0; group < 4; group++) {
+		if (priv->mirror_group_ports[group] == mirror->to_local_port)
+			break;
+	}
+	if (group >= 4) {
+		for (group = 0; group < 4; group++) {
+			if (priv->mirror_group_ports[group] < 0)
+				break;
+		}
+	}
+
+	if (group >= 4)
+		return -ENOSPC;
+
+	ctrl_reg = priv->r->mir_ctrl + group * 4;
+	dpm_reg = priv->r->mir_dpm + group * 4 * priv->port_width;
+	spm_reg = priv->r->mir_spm + group * 4 * priv->port_width;
+
+	pr_debug("Using group %d\n", group);
+	mutex_lock(&priv->reg_mutex);
+
+	if (priv->family_id == RTL8380_FAMILY_ID) {
+		/* Enable mirroring to port across VLANs (bit 11) */
+		sw_w32(1 << 11 | (mirror->to_local_port << 4) | 1, ctrl_reg);
+	} else {
+		/* Enable mirroring to destination port */
+		sw_w32((mirror->to_local_port << 4) | 1, ctrl_reg);
+	}
+
+	if (ingress && (priv->r->get_port_reg_be(spm_reg) & (1ULL << port))) {
+		mutex_unlock(&priv->reg_mutex);
+		return -EEXIST;
+	}
+	if ((!ingress) && (priv->r->get_port_reg_be(dpm_reg) & (1ULL << port))) {
+		mutex_unlock(&priv->reg_mutex);
+		return -EEXIST;
+	}
+
+	if (ingress)
+		priv->r->mask_port_reg_be(0, 1ULL << port, spm_reg);
+	else
+		priv->r->mask_port_reg_be(0, 1ULL << port, dpm_reg);
+
+	priv->mirror_group_ports[group] = mirror->to_local_port;
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+static void rtl83xx_port_mirror_del(struct dsa_switch *ds, int port,
+				    struct dsa_mall_mirror_tc_entry *mirror)
+{
+	int group = 0;
+	struct rtl838x_switch_priv *priv = ds->priv;
+	int ctrl_reg, dpm_reg, spm_reg;
+
+	pr_debug("In %s\n", __func__);
+	for (group = 0; group < 4; group++) {
+		if (priv->mirror_group_ports[group] == mirror->to_local_port)
+			break;
+	}
+	if (group >= 4)
+		return;
+
+	ctrl_reg = priv->r->mir_ctrl + group * 4;
+	dpm_reg = priv->r->mir_dpm + group * 4 * priv->port_width;
+	spm_reg = priv->r->mir_spm + group * 4 * priv->port_width;
+
+	mutex_lock(&priv->reg_mutex);
+	if (mirror->ingress) {
+		/* Ingress, clear source port matrix */
+		priv->r->mask_port_reg_be(1ULL << port, 0, spm_reg);
+	} else {
+		/* Egress, clear destination port matrix */
+		priv->r->mask_port_reg_be(1ULL << port, 0, dpm_reg);
+	}
+
+	if (!(sw_r32(spm_reg) || sw_r32(dpm_reg))) {
+		priv->mirror_group_ports[group] = -1;
+		sw_w32(0, ctrl_reg);
+	}
+
+	mutex_unlock(&priv->reg_mutex);
+}
+
+static int rtl83xx_port_pre_bridge_flags(struct dsa_switch *ds, int port, struct switchdev_brport_flags flags, struct netlink_ext_ack *extack)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	unsigned long features = 0;
+	pr_debug("%s: %d %lX\n", __func__, port, flags.val);
+	if (priv->r->enable_learning)
+		features |= BR_LEARNING;
+	if (priv->r->enable_flood)
+		features |= BR_FLOOD;
+	if (priv->r->enable_mcast_flood)
+		features |= BR_MCAST_FLOOD;
+	if (priv->r->enable_bcast_flood)
+		features |= BR_BCAST_FLOOD;
+	if (flags.mask & ~(features))
+		return -EINVAL;
+
+	return 0;
+}
+
+static int rtl83xx_port_bridge_flags(struct dsa_switch *ds, int port, struct switchdev_brport_flags flags, struct netlink_ext_ack *extack)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+
+	pr_debug("%s: %d %lX\n", __func__, port, flags.val);
+	if (priv->r->enable_learning && (flags.mask & BR_LEARNING))
+		priv->r->enable_learning(port, !!(flags.val & BR_LEARNING));
+
+	if (priv->r->enable_flood && (flags.mask & BR_FLOOD))
+		priv->r->enable_flood(port, !!(flags.val & BR_FLOOD));
+
+	if (priv->r->enable_mcast_flood && (flags.mask & BR_MCAST_FLOOD))
+		priv->r->enable_mcast_flood(port, !!(flags.val & BR_MCAST_FLOOD));
+
+	if (priv->r->enable_bcast_flood && (flags.mask & BR_BCAST_FLOOD))
+		priv->r->enable_bcast_flood(port, !!(flags.val & BR_BCAST_FLOOD));
+
+	return 0;
+}
+
+static bool rtl83xx_lag_can_offload(struct dsa_switch *ds,
+				      struct net_device *lag,
+				      struct netdev_lag_upper_info *info)
+{
+	int id;
+
+	id = dsa_lag_id(ds->dst, lag);
+	if (id < 0 || id >= ds->num_lag_ids)
+		return false;
+
+	if (info->tx_type != NETDEV_LAG_TX_TYPE_HASH) {
+		return false;
+	}
+	if (info->hash_type != NETDEV_LAG_HASH_L2 && info->hash_type != NETDEV_LAG_HASH_L23)
+		return false;
+
+	return true;
+}
+
+static int rtl83xx_port_lag_change(struct dsa_switch *ds, int port)
+{
+	pr_debug("%s: %d\n", __func__, port);
+	/* Nothing to be done... */
+
+	return 0;
+}
+
+static int rtl83xx_port_lag_join(struct dsa_switch *ds, int port,
+				   struct net_device *lag,
+				   struct netdev_lag_upper_info *info)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	int i, err = 0;
+
+	if (!rtl83xx_lag_can_offload(ds, lag, info))
+		return -EOPNOTSUPP;
+
+	mutex_lock(&priv->reg_mutex);
+
+	for (i = 0; i < priv->n_lags; i++) {
+		if ((!priv->lag_devs[i]) || (priv->lag_devs[i] == lag))
+			break;
+	}
+	if (port >= priv->cpu_port) {
+		err = -EINVAL;
+		goto out;
+	}
+	pr_info("port_lag_join: group %d, port %d\n",i, port);
+	if (!priv->lag_devs[i])
+		priv->lag_devs[i] = lag;
+
+	if (priv->lag_primary[i] == -1) {
+		priv->lag_primary[i] = port;
+	} else
+		priv->is_lagmember[port] = 1;
+
+	priv->lagmembers |= (1ULL << port);
+
+	pr_debug("lag_members = %llX\n", priv->lagmembers);
+	err = rtl83xx_lag_add(priv->ds, i, port, info);
+	if (err) {
+		err = -EINVAL;
+		goto out;
+	}
+
+out:
+	mutex_unlock(&priv->reg_mutex);
+
+	return err;
+}
+
+static int rtl83xx_port_lag_leave(struct dsa_switch *ds, int port,
+				    struct net_device *lag)
+{
+	int i, group = -1, err;
+	struct rtl838x_switch_priv *priv = ds->priv;
+
+	mutex_lock(&priv->reg_mutex);
+	for (i = 0; i < priv->n_lags; i++) {
+		if (priv->lags_port_members[i] & BIT_ULL(port)) {
+			group = i;
+			break;
+		}
+	}
+
+	if (group == -1) {
+		pr_info("port_lag_leave: port %d is not a member\n", port);
+		err = -EINVAL;
+		goto out;
+	}
+
+	if (port >= priv->cpu_port) {
+		err = -EINVAL;
+		goto out;
+	}
+	pr_info("port_lag_del: group %d, port %d\n",group, port);
+	priv->lagmembers &=~ (1ULL << port);
+	priv->lag_primary[i] = -1;
+	priv->is_lagmember[port] = 0;
+	pr_debug("lag_members = %llX\n", priv->lagmembers);
+	err = rtl83xx_lag_del(priv->ds, group, port);
+	if (err) {
+		err = -EINVAL;
+		goto out;
+	}
+	if (!priv->lags_port_members[i])
+		priv->lag_devs[i] = NULL;
+
+out:
+	mutex_unlock(&priv->reg_mutex);
+	return 0;
+}
+
+int dsa_phy_read(struct dsa_switch *ds, int phy_addr, int phy_reg)
+{
+	u32 val;
+	u32 offset = 0;
+	struct rtl838x_switch_priv *priv = ds->priv;
+
+	if ((phy_addr >= 24) &&
+	    (phy_addr <= 27) &&
+	    (priv->ports[24].phy == PHY_RTL838X_SDS)) {
+		if (phy_addr == 26)
+			offset = 0x100;
+		val = sw_r32(RTL838X_SDS4_FIB_REG0 + offset + (phy_reg << 2)) & 0xffff;
+		return val;
+	}
+
+	read_phy(phy_addr, 0, phy_reg, &val);
+	return val;
+}
+
+int dsa_phy_write(struct dsa_switch *ds, int phy_addr, int phy_reg, u16 val)
+{
+	u32 offset = 0;
+	struct rtl838x_switch_priv *priv = ds->priv;
+
+	if ((phy_addr >= 24) &&
+	    (phy_addr <= 27) &&
+	    (priv->ports[24].phy == PHY_RTL838X_SDS)) {
+		if (phy_addr == 26)
+			offset = 0x100;
+		sw_w32(val, RTL838X_SDS4_FIB_REG0 + offset + (phy_reg << 2));
+		return 0;
+	}
+	return write_phy(phy_addr, 0, phy_reg, val);
+}
+
+const struct dsa_switch_ops rtl83xx_switch_ops = {
+	.get_tag_protocol	= rtl83xx_get_tag_protocol,
+	.setup			= rtl83xx_setup,
+
+	.phy_read		= dsa_phy_read,
+	.phy_write		= dsa_phy_write,
+
+	.phylink_validate	= rtl83xx_phylink_validate,
+	.phylink_mac_link_state	= rtl83xx_phylink_mac_link_state,
+	.phylink_mac_config	= rtl83xx_phylink_mac_config,
+	.phylink_mac_link_down	= rtl83xx_phylink_mac_link_down,
+	.phylink_mac_link_up	= rtl83xx_phylink_mac_link_up,
+
+	.get_strings		= rtl83xx_get_strings,
+	.get_ethtool_stats	= rtl83xx_get_ethtool_stats,
+	.get_sset_count		= rtl83xx_get_sset_count,
+
+	.port_enable		= rtl83xx_port_enable,
+	.port_disable		= rtl83xx_port_disable,
+
+	.get_mac_eee		= rtl83xx_get_mac_eee,
+	.set_mac_eee		= rtl83xx_set_mac_eee,
+
+	.set_ageing_time	= rtl83xx_set_ageing_time,
+	.port_bridge_join	= rtl83xx_port_bridge_join,
+	.port_bridge_leave	= rtl83xx_port_bridge_leave,
+	.port_stp_state_set	= rtl83xx_port_stp_state_set,
+	.port_fast_age		= rtl83xx_fast_age,
+
+	.port_vlan_filtering	= rtl83xx_vlan_filtering,
+	.port_vlan_add		= rtl83xx_vlan_add,
+	.port_vlan_del		= rtl83xx_vlan_del,
+
+	.port_fdb_add		= rtl83xx_port_fdb_add,
+	.port_fdb_del		= rtl83xx_port_fdb_del,
+	.port_fdb_dump		= rtl83xx_port_fdb_dump,
+
+	.port_mdb_add		= rtl83xx_port_mdb_add,
+	.port_mdb_del		= rtl83xx_port_mdb_del,
+
+	.port_mirror_add	= rtl83xx_port_mirror_add,
+	.port_mirror_del	= rtl83xx_port_mirror_del,
+
+	.port_lag_change	= rtl83xx_port_lag_change,
+	.port_lag_join		= rtl83xx_port_lag_join,
+	.port_lag_leave		= rtl83xx_port_lag_leave,
+
+	.port_pre_bridge_flags	= rtl83xx_port_pre_bridge_flags,
+	.port_bridge_flags	= rtl83xx_port_bridge_flags,
+};
+
+const struct dsa_switch_ops rtl930x_switch_ops = {
+	.get_tag_protocol	= rtl83xx_get_tag_protocol,
+	.setup			= rtl93xx_setup,
+
+	.phy_read		= dsa_phy_read,
+	.phy_write		= dsa_phy_write,
+
+	.phylink_validate	= rtl93xx_phylink_validate,
+	.phylink_mac_link_state	= rtl93xx_phylink_mac_link_state,
+	.phylink_mac_config	= rtl93xx_phylink_mac_config,
+	.phylink_mac_link_down	= rtl93xx_phylink_mac_link_down,
+	.phylink_mac_link_up	= rtl93xx_phylink_mac_link_up,
+
+	.get_strings		= rtl83xx_get_strings,
+	.get_ethtool_stats	= rtl83xx_get_ethtool_stats,
+	.get_sset_count		= rtl83xx_get_sset_count,
+
+	.port_enable		= rtl83xx_port_enable,
+	.port_disable		= rtl83xx_port_disable,
+
+	.get_mac_eee		= rtl93xx_get_mac_eee,
+	.set_mac_eee		= rtl83xx_set_mac_eee,
+
+	.set_ageing_time	= rtl83xx_set_ageing_time,
+	.port_bridge_join	= rtl83xx_port_bridge_join,
+	.port_bridge_leave	= rtl83xx_port_bridge_leave,
+	.port_stp_state_set	= rtl83xx_port_stp_state_set,
+	.port_fast_age		= rtl930x_fast_age,
+
+	.port_vlan_filtering	= rtl83xx_vlan_filtering,
+	.port_vlan_add		= rtl83xx_vlan_add,
+	.port_vlan_del		= rtl83xx_vlan_del,
+
+	.port_fdb_add		= rtl83xx_port_fdb_add,
+	.port_fdb_del		= rtl83xx_port_fdb_del,
+	.port_fdb_dump		= rtl83xx_port_fdb_dump,
+
+	.port_mdb_add		= rtl83xx_port_mdb_add,
+	.port_mdb_del		= rtl83xx_port_mdb_del,
+
+	.port_lag_change	= rtl83xx_port_lag_change,
+	.port_lag_join		= rtl83xx_port_lag_join,
+	.port_lag_leave		= rtl83xx_port_lag_leave,
+
+	.port_pre_bridge_flags	= rtl83xx_port_pre_bridge_flags,
+	.port_bridge_flags	= rtl83xx_port_bridge_flags,
+};
diff --git a/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/qos.c b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/qos.c
new file mode 100644
index 00000000000000..d101e1c97e6567
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/qos.c
@@ -0,0 +1,565 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <net/dsa.h>
+#include <linux/delay.h>
+#include <asm/mach-rtl838x/mach-rtl83xx.h>
+
+#include "rtl83xx.h"
+
+static struct rtl838x_switch_priv *switch_priv;
+extern struct rtl83xx_soc_info soc_info;
+
+enum scheduler_type {
+	WEIGHTED_FAIR_QUEUE = 0,
+	WEIGHTED_ROUND_ROBIN,
+};
+
+int max_available_queue[] = {0, 1, 2, 3, 4, 5, 6, 7};
+int default_queue_weights[] = {1, 1, 1, 1, 1, 1, 1, 1};
+int dot1p_priority_remapping[] = {0, 1, 2, 3, 4, 5, 6, 7};
+
+static void rtl839x_read_scheduling_table(int port)
+{
+	u32 cmd = 1 << 9 | /* Execute cmd */
+	          0 << 8 | /* Read */
+	          0 << 6 | /* Table type 0b00 */
+	          (port & 0x3f);
+	rtl839x_exec_tbl2_cmd(cmd);
+}
+
+static void rtl839x_write_scheduling_table(int port)
+{
+	u32 cmd = 1 << 9 | /* Execute cmd */
+	          1 << 8 | /* Write */
+	          0 << 6 | /* Table type 0b00 */
+	          (port & 0x3f);
+	rtl839x_exec_tbl2_cmd(cmd);
+}
+
+static void rtl839x_read_out_q_table(int port)
+{
+	u32 cmd = 1 << 9 | /* Execute cmd */
+	          0 << 8 | /* Read */
+	          2 << 6 | /* Table type 0b10 */
+	          (port & 0x3f);
+	rtl839x_exec_tbl2_cmd(cmd);
+}
+
+static void rtl838x_storm_enable(struct rtl838x_switch_priv *priv, int port, bool enable)
+{
+	/* Enable Storm control for that port for UC, MC, and BC */
+	if (enable)
+		sw_w32(0x7, RTL838X_STORM_CTRL_LB_CTRL(port));
+	else
+		sw_w32(0x0, RTL838X_STORM_CTRL_LB_CTRL(port));
+}
+
+u32 rtl838x_get_egress_rate(struct rtl838x_switch_priv *priv, int port)
+{
+	if (port > priv->cpu_port)
+		return 0;
+
+	return sw_r32(RTL838X_SCHED_P_EGR_RATE_CTRL(port)) & 0x3fff;
+}
+
+/* Sets the rate limit, 10MBit/s is equal to a rate value of 625 */
+int rtl838x_set_egress_rate(struct rtl838x_switch_priv *priv, int port, u32 rate)
+{
+	u32 old_rate;
+
+	if (port > priv->cpu_port)
+		return -1;
+
+	old_rate = sw_r32(RTL838X_SCHED_P_EGR_RATE_CTRL(port));
+	sw_w32(rate, RTL838X_SCHED_P_EGR_RATE_CTRL(port));
+
+	return old_rate;
+}
+
+/* Set the rate limit for a particular queue in Bits/s
+ * units of the rate is 16Kbps
+ */
+void rtl838x_egress_rate_queue_limit(struct rtl838x_switch_priv *priv, int port,
+					    int queue, u32 rate)
+{
+	if (port > priv->cpu_port)
+		return;
+
+	if (queue > 7)
+		return;
+
+	sw_w32(rate, RTL838X_SCHED_Q_EGR_RATE_CTRL(port, queue));
+}
+
+static void rtl838x_rate_control_init(struct rtl838x_switch_priv *priv)
+{
+	pr_info("Enabling Storm control\n");
+	/* TICK_PERIOD_PPS */
+	if (priv->id == 0x8380)
+		sw_w32_mask(0x3ff << 20, 434 << 20, RTL838X_SCHED_LB_TICK_TKN_CTRL_0);
+
+	/* Set burst rate */
+	sw_w32(0x00008000, RTL838X_STORM_CTRL_BURST_0); /* UC */
+	sw_w32(0x80008000, RTL838X_STORM_CTRL_BURST_1); /* MC and BC */
+
+	/* Set burst Packets per Second to 32 */
+	sw_w32(0x00000020, RTL838X_STORM_CTRL_BURST_PPS_0); /* UC */
+	sw_w32(0x00200020, RTL838X_STORM_CTRL_BURST_PPS_1); /* MC and BC */
+
+	/* Include IFG in storm control, rate based on bytes/s (0 = packets) */
+	sw_w32_mask(0, 1 << 6 | 1 << 5, RTL838X_STORM_CTRL);
+	/* Bandwidth control includes preamble and IFG (10 Bytes) */
+	sw_w32_mask(0, 1, RTL838X_SCHED_CTRL);
+
+	/* On SoCs except RTL8382M, set burst size of port egress */
+	if (priv->id != 0x8382)
+		sw_w32_mask(0xffff, 0x800, RTL838X_SCHED_LB_THR);
+
+	/* Enable storm control on all ports with a PHY and limit rates,
+	 * for UC and MC for both known and unknown addresses
+	 */
+	for (int i = 0; i < priv->cpu_port; i++) {
+		if (priv->ports[i].phy) {
+			sw_w32((1 << 18) | 0x8000, RTL838X_STORM_CTRL_PORT_UC(i));
+			sw_w32((1 << 18) | 0x8000, RTL838X_STORM_CTRL_PORT_MC(i));
+			sw_w32(0x8000, RTL838X_STORM_CTRL_PORT_BC(i));
+			rtl838x_storm_enable(priv, i, true);
+		}
+	}
+
+	/* Attack prevention, enable all attack prevention measures */
+	/* sw_w32(0x1ffff, RTL838X_ATK_PRVNT_CTRL); */
+	/* Attack prevention, drop (bit = 0) problematic packets on all ports.
+	 * Setting bit = 1 means: trap to CPU
+	 */
+	/* sw_w32(0, RTL838X_ATK_PRVNT_ACT); */
+	/* Enable attack prevention on all ports */
+	/* sw_w32(0x0fffffff, RTL838X_ATK_PRVNT_PORT_EN); */
+}
+
+/* Sets the rate limit, 10MBit/s is equal to a rate value of 625 */
+u32 rtl839x_get_egress_rate(struct rtl838x_switch_priv *priv, int port)
+{
+	u32 rate;
+
+	pr_debug("%s: Getting egress rate on port %d to %d\n", __func__, port, rate);
+	if (port >= priv->cpu_port)
+		return 0;
+
+	mutex_lock(&priv->reg_mutex);
+
+	rtl839x_read_scheduling_table(port);
+
+	rate = sw_r32(RTL839X_TBL_ACCESS_DATA_2(7));
+	rate <<= 12;
+	rate |= sw_r32(RTL839X_TBL_ACCESS_DATA_2(8)) >> 20;
+
+	mutex_unlock(&priv->reg_mutex);
+
+	return rate;
+}
+
+/* Sets the rate limit, 10MBit/s is equal to a rate value of 625, returns previous rate */
+int rtl839x_set_egress_rate(struct rtl838x_switch_priv *priv, int port, u32 rate)
+{
+	u32 old_rate;
+
+	pr_debug("%s: Setting egress rate on port %d to %d\n", __func__, port, rate);
+	if (port >= priv->cpu_port)
+		return -1;
+
+	mutex_lock(&priv->reg_mutex);
+
+	rtl839x_read_scheduling_table(port);
+
+	old_rate = sw_r32(RTL839X_TBL_ACCESS_DATA_2(7)) & 0xff;
+	old_rate <<= 12;
+	old_rate |= sw_r32(RTL839X_TBL_ACCESS_DATA_2(8)) >> 20;
+	sw_w32_mask(0xff, (rate >> 12) & 0xff, RTL839X_TBL_ACCESS_DATA_2(7));
+	sw_w32_mask(0xfff << 20, rate << 20, RTL839X_TBL_ACCESS_DATA_2(8));
+
+	rtl839x_write_scheduling_table(port);
+
+	mutex_unlock(&priv->reg_mutex);
+
+	return old_rate;
+}
+
+/* Set the rate limit for a particular queue in Bits/s
+ * units of the rate is 16Kbps
+ */
+void rtl839x_egress_rate_queue_limit(struct rtl838x_switch_priv *priv, int port,
+					int queue, u32 rate)
+{
+	int lsb = 128 + queue * 20;
+	int low_byte = 8 - (lsb >> 5);
+	int start_bit = lsb - (low_byte << 5);
+	u32 high_mask = 0xfffff	>> (32 - start_bit);
+
+	pr_debug("%s: Setting egress rate on port %d, queue %d to %d\n",
+		__func__, port, queue, rate);
+	if (port >= priv->cpu_port)
+		return;
+	if (queue > 7)
+		return;
+
+	mutex_lock(&priv->reg_mutex);
+
+	rtl839x_read_scheduling_table(port);
+
+	sw_w32_mask(0xfffff << start_bit, (rate & 0xfffff) << start_bit,
+		    RTL839X_TBL_ACCESS_DATA_2(low_byte));
+	if (high_mask)
+		sw_w32_mask(high_mask, (rate & 0xfffff) >> (32- start_bit),
+			    RTL839X_TBL_ACCESS_DATA_2(low_byte - 1));
+
+	rtl839x_write_scheduling_table(port);
+
+	mutex_unlock(&priv->reg_mutex);
+}
+
+static void rtl839x_rate_control_init(struct rtl838x_switch_priv *priv)
+{
+	pr_info("%s: enabling rate control\n", __func__);
+	/* Tick length and token size settings for SoC with 250MHz,
+	 * RTL8350 family would use 50MHz
+	 */
+	/* Set the special tick period */
+	sw_w32(976563, RTL839X_STORM_CTRL_SPCL_LB_TICK_TKN_CTRL);
+	/* Ingress tick period and token length 10G */
+	sw_w32(18 << 11 | 151, RTL839X_IGR_BWCTRL_LB_TICK_TKN_CTRL_0);
+	/* Ingress tick period and token length 1G */
+	sw_w32(245 << 11 | 129, RTL839X_IGR_BWCTRL_LB_TICK_TKN_CTRL_1);
+	/* Egress tick period 10G, bytes/token 10G and tick period 1G, bytes/token 1G */
+	sw_w32(18 << 24 | 151 << 16 | 185 << 8 | 97, RTL839X_SCHED_LB_TICK_TKN_CTRL);
+	/* Set the tick period of the CPU and the Token Len */
+	sw_w32(3815 << 8 | 1, RTL839X_SCHED_LB_TICK_TKN_PPS_CTRL);
+
+	/* Set the Weighted Fair Queueing burst size */
+	sw_w32_mask(0xffff, 4500, RTL839X_SCHED_LB_THR);
+
+	/* Storm-rate calculation is based on bytes/sec (bit 5), include IFG (bit 6) */
+	sw_w32_mask(0, 1 << 5 | 1 << 6, RTL839X_STORM_CTRL);
+
+	/* Based on the rate control mode being bytes/s
+	 * set tick period and token length for 10G
+	 */
+	sw_w32(18 << 10 | 151, RTL839X_STORM_CTRL_LB_TICK_TKN_CTRL_0);
+	/* and for 1G ports */
+	sw_w32(246 << 10 | 129, RTL839X_STORM_CTRL_LB_TICK_TKN_CTRL_1);
+
+	/* Set default burst rates on all ports (the same for 1G / 10G) with a PHY
+	 * for UC, MC and BC
+	 * For 1G port, the minimum burst rate is 1700, maximum 65535,
+	 * For 10G ports it is 2650 and 1048575 respectively */
+	for (int p = 0; p < priv->cpu_port; p++) {
+		if (priv->ports[p].phy && !priv->ports[p].is10G) {
+			sw_w32_mask(0xffff, 0x8000, RTL839X_STORM_CTRL_PORT_UC_1(p));
+			sw_w32_mask(0xffff, 0x8000, RTL839X_STORM_CTRL_PORT_MC_1(p));
+			sw_w32_mask(0xffff, 0x8000, RTL839X_STORM_CTRL_PORT_BC_1(p));
+		}
+	}
+
+	/* Setup ingress/egress per-port rate control */
+	for (int p = 0; p < priv->cpu_port; p++) {
+		if (!priv->ports[p].phy)
+			continue;
+
+		if (priv->ports[p].is10G)
+			rtl839x_set_egress_rate(priv, p, 625000); /* 10GB/s */
+		else
+			rtl839x_set_egress_rate(priv, p, 62500);  /* 1GB/s */
+
+		/* Setup queues: all RTL83XX SoCs have 8 queues, maximum rate */
+		for (int q = 0; q < 8; q++)
+			rtl839x_egress_rate_queue_limit(priv, p, q, 0xfffff);
+
+		if (priv->ports[p].is10G) {
+			/* Set high threshold to maximum */
+			sw_w32_mask(0xffff, 0xffff, RTL839X_IGR_BWCTRL_PORT_CTRL_10G_0(p));
+		} else {
+			/* Set high threshold to maximum */
+			sw_w32_mask(0xffff, 0xffff, RTL839X_IGR_BWCTRL_PORT_CTRL_1(p));
+		}
+	}
+
+	/* Set global ingress low watermark rate */
+	sw_w32(65532, RTL839X_IGR_BWCTRL_CTRL_LB_THR);
+}
+
+
+
+void rtl838x_setup_prio2queue_matrix(int *min_queues)
+{
+	u32 v = 0;
+
+	pr_info("Current Intprio2queue setting: %08x\n", sw_r32(RTL838X_QM_INTPRI2QID_CTRL));
+	for (int i = 0; i < MAX_PRIOS; i++)
+		v |= i << (min_queues[i] * 3);
+	sw_w32(v, RTL838X_QM_INTPRI2QID_CTRL);
+}
+
+void rtl839x_setup_prio2queue_matrix(int *min_queues)
+{
+	pr_info("Current Intprio2queue setting: %08x\n", sw_r32(RTL839X_QM_INTPRI2QID_CTRL(0)));
+	for (int i = 0; i < MAX_PRIOS; i++) {
+		int q = min_queues[i];
+		sw_w32(i << (q * 3), RTL839X_QM_INTPRI2QID_CTRL(q));
+	}
+}
+
+/* Sets the CPU queue depending on the internal priority of a packet */
+void rtl83xx_setup_prio2queue_cpu_matrix(int *max_queues)
+{
+	int reg = soc_info.family == RTL8380_FAMILY_ID ? RTL838X_QM_PKT2CPU_INTPRI_MAP
+					: RTL839X_QM_PKT2CPU_INTPRI_MAP;
+	u32 v = 0;
+
+	pr_info("QM_PKT2CPU_INTPRI_MAP: %08x\n", sw_r32(reg));
+	for (int i = 0; i < MAX_PRIOS; i++)
+		v |= max_queues[i] << (i * 3);
+	sw_w32(v, reg);
+}
+
+void rtl83xx_setup_default_prio2queue(void)
+{
+	if (soc_info.family == RTL8380_FAMILY_ID) {
+		rtl838x_setup_prio2queue_matrix(max_available_queue);
+	} else {
+		rtl839x_setup_prio2queue_matrix(max_available_queue);
+	}
+	rtl83xx_setup_prio2queue_cpu_matrix(max_available_queue);
+}
+
+/* Sets the output queue assigned to a port, the port can be the CPU-port */
+void rtl839x_set_egress_queue(int port, int queue)
+{
+	sw_w32(queue << ((port % 10) *3), RTL839X_QM_PORT_QNUM(port));
+}
+
+/* Sets the priority assigned of an ingress port, the port can be the CPU-port */
+void rtl83xx_set_ingress_priority(int port, int priority)
+{
+	if (soc_info.family == RTL8380_FAMILY_ID)
+		sw_w32(priority << ((port % 10) *3), RTL838X_PRI_SEL_PORT_PRI(port));
+	else
+		sw_w32(priority << ((port % 10) *3), RTL839X_PRI_SEL_PORT_PRI(port));
+}
+
+int rtl839x_get_scheduling_algorithm(struct rtl838x_switch_priv *priv, int port)
+{
+	u32 v;
+
+	mutex_lock(&priv->reg_mutex);
+
+	rtl839x_read_scheduling_table(port);
+	v = sw_r32(RTL839X_TBL_ACCESS_DATA_2(8));
+
+	mutex_unlock(&priv->reg_mutex);
+
+	if (v & BIT(19))
+		return WEIGHTED_ROUND_ROBIN;
+
+	return WEIGHTED_FAIR_QUEUE;
+}
+
+void rtl839x_set_scheduling_algorithm(struct rtl838x_switch_priv *priv, int port,
+				      enum scheduler_type sched)
+{
+	enum scheduler_type t = rtl839x_get_scheduling_algorithm(priv, port);
+	u32 v, oam_state, oam_port_state;
+	u32 count;
+	int i, egress_rate;
+
+	mutex_lock(&priv->reg_mutex);
+	/* Check whether we need to empty the egress queue of that port due to Errata E0014503 */
+	if (sched == WEIGHTED_FAIR_QUEUE && t == WEIGHTED_ROUND_ROBIN && port != priv->cpu_port) {
+		/* Read Operations, Adminstatrion and Management control register */
+		oam_state = sw_r32(RTL839X_OAM_CTRL);
+
+		/* Get current OAM state */
+		oam_port_state = sw_r32(RTL839X_OAM_PORT_ACT_CTRL(port));
+
+		/* Disable OAM to block traffice */
+		v = sw_r32(RTL839X_OAM_CTRL);
+		sw_w32_mask(0, 1, RTL839X_OAM_CTRL);
+		v = sw_r32(RTL839X_OAM_CTRL);
+
+		/* Set to trap action OAM forward (bits 1, 2) and OAM Mux Action Drop (bit 0) */
+		sw_w32(0x2, RTL839X_OAM_PORT_ACT_CTRL(port));
+
+		/* Set port egress rate to unlimited */
+		egress_rate = rtl839x_set_egress_rate(priv, port, 0xFFFFF);
+
+		/* Wait until the egress used page count of that port is 0 */
+		i = 0;
+		do {
+			usleep_range(100, 200);
+			rtl839x_read_out_q_table(port);
+			count = sw_r32(RTL839X_TBL_ACCESS_DATA_2(6));
+			count >>= 20;
+			i++;
+		} while (i < 3500 && count > 0);
+	}
+
+	/* Actually set the scheduling algorithm */
+	rtl839x_read_scheduling_table(port);
+	sw_w32_mask(BIT(19), sched ? BIT(19) : 0, RTL839X_TBL_ACCESS_DATA_2(8));
+	rtl839x_write_scheduling_table(port);
+
+	if (sched == WEIGHTED_FAIR_QUEUE && t == WEIGHTED_ROUND_ROBIN && port != priv->cpu_port) {
+		/* Restore OAM state to control register */
+		sw_w32(oam_state, RTL839X_OAM_CTRL);
+
+		/* Restore trap action state */
+		sw_w32(oam_port_state, RTL839X_OAM_PORT_ACT_CTRL(port));
+
+		/* Restore port egress rate */
+		rtl839x_set_egress_rate(priv, port, egress_rate);
+	}
+
+	mutex_unlock(&priv->reg_mutex);
+}
+
+void rtl839x_set_scheduling_queue_weights(struct rtl838x_switch_priv *priv, int port,
+					  int *queue_weights)
+{
+	mutex_lock(&priv->reg_mutex);
+
+	rtl839x_read_scheduling_table(port);
+
+	for (int i = 0; i < 8; i++) {
+		int lsb = 48 + i * 8;
+		int low_byte = 8 - (lsb >> 5);
+		int start_bit = lsb - (low_byte << 5);
+		int high_mask = 0x3ff >> (32 - start_bit);
+
+		sw_w32_mask(0x3ff << start_bit, (queue_weights[i] & 0x3ff) << start_bit,
+				RTL839X_TBL_ACCESS_DATA_2(low_byte));
+		if (high_mask)
+			sw_w32_mask(high_mask, (queue_weights[i] & 0x3ff) >> (32- start_bit),
+					RTL839X_TBL_ACCESS_DATA_2(low_byte - 1));
+	}
+
+	rtl839x_write_scheduling_table(port);
+	mutex_unlock(&priv->reg_mutex);
+}
+
+void rtl838x_config_qos(void)
+{
+	u32 v;
+
+	pr_info("Setting up RTL838X QoS\n");
+	pr_info("RTL838X_PRI_SEL_TBL_CTRL(i): %08x\n", sw_r32(RTL838X_PRI_SEL_TBL_CTRL(0)));
+	rtl83xx_setup_default_prio2queue();
+
+	/* Enable inner (bit 12) and outer (bit 13) priority remapping from DSCP */
+	sw_w32_mask(0, BIT(12) | BIT(13), RTL838X_PRI_DSCP_INVLD_CTRL0);
+
+	/* Set default weight for calculating internal priority, in prio selection group 0
+	 * Port based (prio 3), Port outer-tag (4), DSCP (5), Inner Tag (6), Outer Tag (7)
+	 */
+	v = 3 | (4 << 3) | (5 << 6) | (6 << 9) | (7 << 12);
+	sw_w32(v, RTL838X_PRI_SEL_TBL_CTRL(0));
+
+	/* Set the inner and outer priority one-to-one to re-marked outer dot1p priority */
+	v = 0;
+	for (int p = 0; p < 8; p++)
+		v |= p << (3 * p);
+	sw_w32(v, RTL838X_RMK_OPRI_CTRL);
+	sw_w32(v, RTL838X_RMK_IPRI_CTRL);
+
+	v = 0;
+	for (int p = 0; p < 8; p++)
+		v |= (dot1p_priority_remapping[p] & 0x7) << (p * 3);
+	sw_w32(v, RTL838X_PRI_SEL_IPRI_REMAP);
+
+	/* On all ports set scheduler type to WFQ */
+	for (int i = 0; i <= soc_info.cpu_port; i++)
+		sw_w32(0, RTL838X_SCHED_P_TYPE_CTRL(i));
+
+	/* Enable egress scheduler for CPU-Port */
+	sw_w32_mask(0, BIT(8), RTL838X_SCHED_LB_CTRL(soc_info.cpu_port));
+
+	/* Enable egress drop allways on */
+	sw_w32_mask(0, BIT(11), RTL838X_FC_P_EGR_DROP_CTRL(soc_info.cpu_port));
+
+	/* Give special trap frames priority 7 (BPDUs) and routing exceptions: */
+	sw_w32_mask(0, 7 << 3 | 7, RTL838X_QM_PKT2CPU_INTPRI_2);
+	/* Give RMA frames priority 7: */
+	sw_w32_mask(0, 7, RTL838X_QM_PKT2CPU_INTPRI_1);
+}
+
+void rtl839x_config_qos(void)
+{
+	u32 v;
+	struct rtl838x_switch_priv *priv = switch_priv;
+
+	pr_info("Setting up RTL839X QoS\n");
+	pr_info("RTL839X_PRI_SEL_TBL_CTRL(i): %08x\n", sw_r32(RTL839X_PRI_SEL_TBL_CTRL(0)));
+	rtl83xx_setup_default_prio2queue();
+
+	for (int port = 0; port < soc_info.cpu_port; port++)
+		sw_w32(7, RTL839X_QM_PORT_QNUM(port));
+
+	/* CPU-port gets queue number 7 */
+	sw_w32(7, RTL839X_QM_PORT_QNUM(soc_info.cpu_port));
+
+	for (int port = 0; port <= soc_info.cpu_port; port++) {
+		rtl83xx_set_ingress_priority(port, 0);
+		rtl839x_set_scheduling_algorithm(priv, port, WEIGHTED_FAIR_QUEUE);
+		rtl839x_set_scheduling_queue_weights(priv, port, default_queue_weights);
+		/* Do re-marking based on outer tag */
+		sw_w32_mask(0, BIT(port % 32), RTL839X_RMK_PORT_DEI_TAG_CTRL(port));
+	}
+
+	/* Remap dot1p priorities to internal priority, for this the outer tag needs be re-marked */
+	v = 0;
+	for (int p = 0; p < 8; p++)
+		v |= (dot1p_priority_remapping[p] & 0x7) << (p * 3);
+	sw_w32(v, RTL839X_PRI_SEL_IPRI_REMAP);
+
+	/* Configure Drop Precedence for Drop Eligible Indicator (DEI)
+	 * Index 0: 0
+	 * Index 1: 2
+	 * Each indicator is 2 bits long
+	 */
+	sw_w32(2 << 2, RTL839X_PRI_SEL_DEI2DP_REMAP);
+
+	/* Re-mark DEI: 4 bit-fields of 2 bits each, field 0 is bits 0-1, ... */
+	sw_w32((0x1 << 2) | (0x1 << 4), RTL839X_RMK_DEI_CTRL);
+
+	/* Set Congestion avoidance drop probability to 0 for drop precedences 0-2 (bits 24-31)
+	 * low threshold (bits 0-11) to 4095 and high threshold (bits 12-23) to 4095
+	 * Weighted Random Early Detection (WRED) is used
+	 */
+	sw_w32(4095 << 12| 4095, RTL839X_WRED_PORT_THR_CTRL(0));
+	sw_w32(4095 << 12| 4095, RTL839X_WRED_PORT_THR_CTRL(1));
+	sw_w32(4095 << 12| 4095, RTL839X_WRED_PORT_THR_CTRL(2));
+
+	/* Set queue-based congestion avoidance properties, register fields are as
+	 * for forward RTL839X_WRED_PORT_THR_CTRL
+	 */
+	for (int q = 0; q < 8; q++) {
+		sw_w32(255 << 24 | 78 << 12 | 68, RTL839X_WRED_QUEUE_THR_CTRL(q, 0));
+		sw_w32(255 << 24 | 74 << 12 | 64, RTL839X_WRED_QUEUE_THR_CTRL(q, 0));
+		sw_w32(255 << 24 | 70 << 12 | 60, RTL839X_WRED_QUEUE_THR_CTRL(q, 0));
+	}
+}
+
+void __init rtl83xx_setup_qos(struct rtl838x_switch_priv *priv)
+{
+	switch_priv = priv;
+
+	pr_info("In %s\n", __func__);
+
+	if (priv->family_id == RTL8380_FAMILY_ID)
+		return rtl838x_config_qos();
+	else if (priv->family_id == RTL8390_FAMILY_ID)
+		return rtl839x_config_qos();
+
+	if (priv->family_id == RTL8380_FAMILY_ID)
+		rtl838x_rate_control_init(priv);
+	else if (priv->family_id == RTL8390_FAMILY_ID)
+		rtl839x_rate_control_init(priv);
+}
diff --git a/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/rtl838x.c b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/rtl838x.c
new file mode 100644
index 00000000000000..adff404fddd430
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/rtl838x.c
@@ -0,0 +1,2036 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <asm/mach-rtl838x/mach-rtl83xx.h>
+#include <linux/etherdevice.h>
+#include <linux/iopoll.h>
+#include <net/nexthop.h>
+
+#include "rtl83xx.h"
+
+#define RTL838X_VLAN_PORT_TAG_STS_UNTAG				0x0
+#define RTL838X_VLAN_PORT_TAG_STS_TAGGED			0x1
+#define RTL838X_VLAN_PORT_TAG_STS_PRIORITY_TAGGED		0x2
+
+#define RTL838X_VLAN_PORT_TAG_STS_CTRL_BASE			0xA530
+/* port 0-28 */
+#define RTL838X_VLAN_PORT_TAG_STS_CTRL(port) \
+		RTL838X_VLAN_PORT_TAG_STS_CTRL_BASE + (port << 2)
+
+#define RTL838X_VLAN_PORT_TAG_STS_CTRL_EGR_P_OTAG_KEEP_MASK	GENMASK(11,10)
+#define RTL838X_VLAN_PORT_TAG_STS_CTRL_EGR_P_ITAG_KEEP_MASK	GENMASK(9,8)
+#define RTL838X_VLAN_PORT_TAG_STS_CTRL_IGR_P_OTAG_KEEP_MASK	GENMASK(7,6)
+#define RTL838X_VLAN_PORT_TAG_STS_CTRL_IGR_P_ITAG_KEEP_MASK	GENMASK(5,4)
+#define RTL838X_VLAN_PORT_TAG_STS_CTRL_OTAG_STS_MASK		GENMASK(3,2)
+#define RTL838X_VLAN_PORT_TAG_STS_CTRL_ITAG_STS_MASK		GENMASK(1,0)
+
+extern struct mutex smi_lock;
+
+/* see_dal_maple_acl_log2PhyTmplteField and src/app/diag_v2/src/diag_acl.c */
+/* Definition of the RTL838X-specific template field IDs as used in the PIE */
+enum template_field_id {
+	TEMPLATE_FIELD_SPMMASK = 0,
+	TEMPLATE_FIELD_SPM0 = 1,	/* Source portmask ports 0-15 */
+	TEMPLATE_FIELD_SPM1 = 2,	/* Source portmask ports 16-28 */
+	TEMPLATE_FIELD_RANGE_CHK = 3,
+	TEMPLATE_FIELD_DMAC0 = 4,	/* Destination MAC [15:0] */
+	TEMPLATE_FIELD_DMAC1 = 5,	/* Destination MAC [31:16] */
+	TEMPLATE_FIELD_DMAC2 = 6,	/* Destination MAC [47:32] */
+	TEMPLATE_FIELD_SMAC0 = 7,	/* Source MAC [15:0] */
+	TEMPLATE_FIELD_SMAC1 = 8,	/* Source MAC [31:16] */
+	TEMPLATE_FIELD_SMAC2 = 9,	/* Source MAC [47:32] */
+	TEMPLATE_FIELD_ETHERTYPE = 10,	/* Ethernet typ */
+	TEMPLATE_FIELD_OTAG = 11,	/* Outer VLAN tag */
+	TEMPLATE_FIELD_ITAG = 12,	/* Inner VLAN tag */
+	TEMPLATE_FIELD_SIP0 = 13,	/* IPv4 or IPv6 source IP[15:0] or ARP/RARP */
+					/* source protocol address in header */
+	TEMPLATE_FIELD_SIP1 = 14,	/* IPv4 or IPv6 source IP[31:16] or ARP/RARP */
+	TEMPLATE_FIELD_DIP0 = 15,	/* IPv4 or IPv6 destination IP[15:0] */
+	TEMPLATE_FIELD_DIP1 = 16,	/* IPv4 or IPv6 destination IP[31:16] */
+	TEMPLATE_FIELD_IP_TOS_PROTO = 17, /* IPv4 TOS/IPv6 traffic class and */
+					  /* IPv4 proto/IPv6 next header fields */
+	TEMPLATE_FIELD_L34_HEADER = 18,	/* packet with extra tag and IPv6 with auth, dest, */
+					/* frag, route, hop-by-hop option header, */
+					/* IGMP type, TCP flag */
+	TEMPLATE_FIELD_L4_SPORT = 19,	/* TCP/UDP source port */
+	TEMPLATE_FIELD_L4_DPORT = 20,	/* TCP/UDP destination port */
+	TEMPLATE_FIELD_ICMP_IGMP = 21,
+	TEMPLATE_FIELD_IP_RANGE = 22,
+	TEMPLATE_FIELD_FIELD_SELECTOR_VALID = 23, /* Field selector mask */
+	TEMPLATE_FIELD_FIELD_SELECTOR_0 = 24,
+	TEMPLATE_FIELD_FIELD_SELECTOR_1 = 25,
+	TEMPLATE_FIELD_FIELD_SELECTOR_2 = 26,
+	TEMPLATE_FIELD_FIELD_SELECTOR_3 = 27,
+	TEMPLATE_FIELD_SIP2 = 28,	/* IPv6 source IP[47:32] */
+	TEMPLATE_FIELD_SIP3 = 29,	/* IPv6 source IP[63:48] */
+	TEMPLATE_FIELD_SIP4 = 30,	/* IPv6 source IP[79:64] */
+	TEMPLATE_FIELD_SIP5 = 31,	/* IPv6 source IP[95:80] */
+	TEMPLATE_FIELD_SIP6 = 32,	/* IPv6 source IP[111:96] */
+	TEMPLATE_FIELD_SIP7 = 33,	/* IPv6 source IP[127:112] */
+	TEMPLATE_FIELD_DIP2 = 34,	/* IPv6 destination IP[47:32] */
+	TEMPLATE_FIELD_DIP3 = 35,	/* IPv6 destination IP[63:48] */
+	TEMPLATE_FIELD_DIP4 = 36,	/* IPv6 destination IP[79:64] */
+	TEMPLATE_FIELD_DIP5 = 37,	/* IPv6 destination IP[95:80] */
+	TEMPLATE_FIELD_DIP6 = 38,	/* IPv6 destination IP[111:96] */
+	TEMPLATE_FIELD_DIP7 = 39,	/* IPv6 destination IP[127:112] */
+	TEMPLATE_FIELD_FWD_VID = 40,	/* Forwarding VLAN-ID */
+	TEMPLATE_FIELD_FLOW_LABEL = 41,
+};
+
+/* The RTL838X SoCs use 5 fixed templates with definitions for which data fields are to
+ * be copied from the Ethernet Frame header into the 12 User-definable fields of the Packet
+ * Inspection Engine's buffer. The following defines the field contents for each of the fixed
+ * templates. Additionally, 3 user-definable templates can be set up via the definitions
+ * in RTL838X_ACL_TMPLTE_CTRL control registers.
+ * TODO: See all src/app/diag_v2/src/diag_pie.c
+ */
+#define N_FIXED_TEMPLATES 5
+static enum template_field_id fixed_templates[N_FIXED_TEMPLATES][N_FIXED_FIELDS] =
+{
+	{
+	  TEMPLATE_FIELD_SPM0, TEMPLATE_FIELD_SPM1, TEMPLATE_FIELD_OTAG,
+	  TEMPLATE_FIELD_SMAC0, TEMPLATE_FIELD_SMAC1, TEMPLATE_FIELD_SMAC2,
+	  TEMPLATE_FIELD_DMAC0, TEMPLATE_FIELD_DMAC1, TEMPLATE_FIELD_DMAC2,
+	  TEMPLATE_FIELD_ETHERTYPE, TEMPLATE_FIELD_ITAG, TEMPLATE_FIELD_RANGE_CHK
+	}, {
+	  TEMPLATE_FIELD_SIP0, TEMPLATE_FIELD_SIP1, TEMPLATE_FIELD_DIP0,
+	  TEMPLATE_FIELD_DIP1,TEMPLATE_FIELD_IP_TOS_PROTO, TEMPLATE_FIELD_L4_SPORT,
+	  TEMPLATE_FIELD_L4_DPORT, TEMPLATE_FIELD_ICMP_IGMP, TEMPLATE_FIELD_ITAG,
+	  TEMPLATE_FIELD_RANGE_CHK, TEMPLATE_FIELD_SPM0, TEMPLATE_FIELD_SPM1
+	}, {
+	  TEMPLATE_FIELD_DMAC0, TEMPLATE_FIELD_DMAC1, TEMPLATE_FIELD_DMAC2,
+	  TEMPLATE_FIELD_ITAG, TEMPLATE_FIELD_ETHERTYPE, TEMPLATE_FIELD_IP_TOS_PROTO,
+	  TEMPLATE_FIELD_L4_DPORT, TEMPLATE_FIELD_L4_SPORT, TEMPLATE_FIELD_SIP0,
+	  TEMPLATE_FIELD_SIP1, TEMPLATE_FIELD_DIP0, TEMPLATE_FIELD_DIP1
+	}, {
+	  TEMPLATE_FIELD_DIP0, TEMPLATE_FIELD_DIP1, TEMPLATE_FIELD_DIP2,
+	  TEMPLATE_FIELD_DIP3, TEMPLATE_FIELD_DIP4, TEMPLATE_FIELD_DIP5,
+	  TEMPLATE_FIELD_DIP6, TEMPLATE_FIELD_DIP7, TEMPLATE_FIELD_L4_DPORT,
+	  TEMPLATE_FIELD_L4_SPORT, TEMPLATE_FIELD_ICMP_IGMP, TEMPLATE_FIELD_IP_TOS_PROTO
+	}, {
+	  TEMPLATE_FIELD_SIP0, TEMPLATE_FIELD_SIP1, TEMPLATE_FIELD_SIP2,
+	  TEMPLATE_FIELD_SIP3, TEMPLATE_FIELD_SIP4, TEMPLATE_FIELD_SIP5,
+	  TEMPLATE_FIELD_SIP6, TEMPLATE_FIELD_SIP7, TEMPLATE_FIELD_ITAG,
+	  TEMPLATE_FIELD_RANGE_CHK, TEMPLATE_FIELD_SPM0, TEMPLATE_FIELD_SPM1
+	},
+};
+
+void rtl838x_print_matrix(void)
+{
+	unsigned volatile int *ptr8;
+
+	ptr8 = RTL838X_SW_BASE + RTL838X_PORT_ISO_CTRL(0);
+	for (int i = 0; i < 28; i += 8)
+		pr_debug("> %8x %8x %8x %8x %8x %8x %8x %8x\n",
+			ptr8[i + 0], ptr8[i + 1], ptr8[i + 2], ptr8[i + 3],
+			ptr8[i + 4], ptr8[i + 5], ptr8[i + 6], ptr8[i + 7]);
+	pr_debug("CPU_PORT> %8x\n", ptr8[28]);
+}
+
+static inline int rtl838x_port_iso_ctrl(int p)
+{
+	return RTL838X_PORT_ISO_CTRL(p);
+}
+
+static inline void rtl838x_exec_tbl0_cmd(u32 cmd)
+{
+	sw_w32(cmd, RTL838X_TBL_ACCESS_CTRL_0);
+	do { } while (sw_r32(RTL838X_TBL_ACCESS_CTRL_0) & BIT(15));
+}
+
+static inline void rtl838x_exec_tbl1_cmd(u32 cmd)
+{
+	sw_w32(cmd, RTL838X_TBL_ACCESS_CTRL_1);
+	do { } while (sw_r32(RTL838X_TBL_ACCESS_CTRL_1) & BIT(15));
+}
+
+static inline int rtl838x_tbl_access_data_0(int i)
+{
+	return RTL838X_TBL_ACCESS_DATA_0(i);
+}
+
+static void rtl838x_vlan_tables_read(u32 vlan, struct rtl838x_vlan_info *info)
+{
+	u32 v;
+	/* Read VLAN table (0) via register 0 */
+	struct table_reg *r = rtl_table_get(RTL8380_TBL_0, 0);
+
+	rtl_table_read(r, vlan);
+	info->tagged_ports = sw_r32(rtl_table_data(r, 0));
+	v = sw_r32(rtl_table_data(r, 1));
+	pr_debug("VLAN_READ %d: %016llx %08x\n", vlan, info->tagged_ports, v);
+	rtl_table_release(r);
+
+	info->profile_id = v & 0x7;
+	info->hash_mc_fid = !!(v & 0x8);
+	info->hash_uc_fid = !!(v & 0x10);
+	info->fid = (v >> 5) & 0x3f;
+
+	/* Read UNTAG table (0) via table register 1 */
+	r = rtl_table_get(RTL8380_TBL_1, 0);
+	rtl_table_read(r, vlan);
+	info->untagged_ports = sw_r32(rtl_table_data(r, 0));
+	rtl_table_release(r);
+}
+
+static void rtl838x_vlan_set_tagged(u32 vlan, struct rtl838x_vlan_info *info)
+{
+	u32 v;
+	/* Access VLAN table (0) via register 0 */
+	struct table_reg *r = rtl_table_get(RTL8380_TBL_0, 0);
+
+	sw_w32(info->tagged_ports, rtl_table_data(r, 0));
+
+	v = info->profile_id;
+	v |= info->hash_mc_fid ? 0x8 : 0;
+	v |= info->hash_uc_fid ? 0x10 : 0;
+	v |= ((u32)info->fid) << 5;
+	sw_w32(v, rtl_table_data(r, 1));
+
+	rtl_table_write(r, vlan);
+	rtl_table_release(r);
+}
+
+static void rtl838x_vlan_set_untagged(u32 vlan, u64 portmask)
+{
+	/* Access UNTAG table (0) via register 1 */
+	struct table_reg *r = rtl_table_get(RTL8380_TBL_1, 0);
+
+	sw_w32(portmask & 0x1fffffff, rtl_table_data(r, 0));
+	rtl_table_write(r, vlan);
+	rtl_table_release(r);
+}
+
+/* Sets the L2 forwarding to be based on either the inner VLAN tag or the outer
+ */
+static void rtl838x_vlan_fwd_on_inner(int port, bool is_set)
+{
+	if (is_set)
+		sw_w32_mask(BIT(port), 0, RTL838X_VLAN_PORT_FWD);
+	else
+		sw_w32_mask(0, BIT(port), RTL838X_VLAN_PORT_FWD);
+}
+
+static u64 rtl838x_l2_hash_seed(u64 mac, u32 vid)
+{
+	return mac << 12 | vid;
+}
+
+/* Applies the same hash algorithm as the one used currently by the ASIC to the seed
+ * and returns a key into the L2 hash table
+ */
+static u32 rtl838x_l2_hash_key(struct rtl838x_switch_priv *priv, u64 seed)
+{
+	u32 h1, h2, h3, h;
+
+	if (sw_r32(priv->r->l2_ctrl_0) & 1) {
+		h1 = (seed >> 11) & 0x7ff;
+		h1 = ((h1 & 0x1f) << 6) | ((h1 >> 5) & 0x3f);
+
+		h2 = (seed >> 33) & 0x7ff;
+		h2 = ((h2 & 0x3f) << 5) | ((h2 >> 6) & 0x1f);
+
+		h3 = (seed >> 44) & 0x7ff;
+		h3 = ((h3 & 0x7f) << 4) | ((h3 >> 7) & 0xf);
+
+		h = h1 ^ h2 ^ h3 ^ ((seed >> 55) & 0x1ff);
+		h ^= ((seed >> 22) & 0x7ff) ^ (seed & 0x7ff);
+	} else {
+		h = ((seed >> 55) & 0x1ff) ^ ((seed >> 44) & 0x7ff) ^
+		    ((seed >> 33) & 0x7ff) ^ ((seed >> 22) & 0x7ff) ^
+		    ((seed >> 11) & 0x7ff) ^ (seed & 0x7ff);
+	}
+
+	return h;
+}
+
+static inline int rtl838x_mac_force_mode_ctrl(int p)
+{
+	return RTL838X_MAC_FORCE_MODE_CTRL + (p << 2);
+}
+
+static inline int rtl838x_mac_port_ctrl(int p)
+{
+	return RTL838X_MAC_PORT_CTRL(p);
+}
+
+static inline int rtl838x_l2_port_new_salrn(int p)
+{
+	return RTL838X_L2_PORT_NEW_SALRN(p);
+}
+
+static inline int rtl838x_l2_port_new_sa_fwd(int p)
+{
+	return RTL838X_L2_PORT_NEW_SA_FWD(p);
+}
+
+static inline int rtl838x_mac_link_spd_sts(int p)
+{
+	return RTL838X_MAC_LINK_SPD_STS(p);
+}
+
+inline static int rtl838x_trk_mbr_ctr(int group)
+{
+	return RTL838X_TRK_MBR_CTR + (group << 2);
+}
+
+/* Fills an L2 entry structure from the SoC registers */
+static void rtl838x_fill_l2_entry(u32 r[], struct rtl838x_l2_entry *e)
+{
+	/* Table contains different entry types, we need to identify the right one:
+	 * Check for MC entries, first
+	 * In contrast to the RTL93xx SoCs, there is no valid bit, use heuristics to
+	 * identify valid entries
+	 */
+	e->is_ip_mc = !!(r[0] & BIT(22));
+	e->is_ipv6_mc = !!(r[0] & BIT(21));
+	e->type = L2_INVALID;
+
+	if (!e->is_ip_mc && !e->is_ipv6_mc) {
+		e->mac[0] = (r[1] >> 20);
+		e->mac[1] = (r[1] >> 12);
+		e->mac[2] = (r[1] >> 4);
+		e->mac[3] = (r[1] & 0xf) << 4 | (r[2] >> 28);
+		e->mac[4] = (r[2] >> 20);
+		e->mac[5] = (r[2] >> 12);
+
+		e->rvid = r[2] & 0xfff;
+		e->vid = r[0] & 0xfff;
+
+		/* Is it a unicast entry? check multicast bit */
+		if (!(e->mac[0] & 1)) {
+			e->is_static = !!((r[0] >> 19) & 1);
+			e->port = (r[0] >> 12) & 0x1f;
+			e->block_da = !!(r[1] & BIT(30));
+			e->block_sa = !!(r[1] & BIT(31));
+			e->suspended = !!(r[1] & BIT(29));
+			e->next_hop = !!(r[1] & BIT(28));
+			if (e->next_hop) {
+				pr_debug("Found next hop entry, need to read extra data\n");
+				e->nh_vlan_target = !!(r[0] & BIT(9));
+				e->nh_route_id = r[0] & 0x1ff;
+				e->vid = e->rvid;
+			}
+			e->age = (r[0] >> 17) & 0x3;
+			e->valid = true;
+
+			/* A valid entry has one of mutli-cast, aging, sa/da-blocking,
+			 * next-hop or static entry bit set
+			 */
+			if (!(r[0] & 0x007c0000) && !(r[1] & 0xd0000000))
+				e->valid = false;
+			else
+				e->type = L2_UNICAST;
+		} else { /* L2 multicast */
+			pr_debug("Got L2 MC entry: %08x %08x %08x\n", r[0], r[1], r[2]);
+			e->valid = true;
+			e->type = L2_MULTICAST;
+			e->mc_portmask_index = (r[0] >> 12) & 0x1ff;
+		}
+	} else { /* IPv4 and IPv6 multicast */
+		e->valid = true;
+		e->mc_portmask_index = (r[0] >> 12) & 0x1ff;
+		e->mc_gip = (r[1] << 20) | (r[2] >> 12);
+		e->rvid = r[2] & 0xfff;
+	}
+	if (e->is_ip_mc)
+		e->type = IP4_MULTICAST;
+	if (e->is_ipv6_mc)
+		e->type = IP6_MULTICAST;
+}
+
+/* Fills the 3 SoC table registers r[] with the information of in the rtl838x_l2_entry */
+static void rtl838x_fill_l2_row(u32 r[], struct rtl838x_l2_entry *e)
+{
+	u64 mac = ether_addr_to_u64(e->mac);
+
+	if (!e->valid) {
+		r[0] = r[1] = r[2] = 0;
+		return;
+	}
+
+	r[0] = e->is_ip_mc ? BIT(22) : 0;
+	r[0] |= e->is_ipv6_mc ? BIT(21) : 0;
+
+	if (!e->is_ip_mc && !e->is_ipv6_mc) {
+		r[1] = mac >> 20;
+		r[2] = (mac & 0xfffff) << 12;
+
+		/* Is it a unicast entry? check multicast bit */
+		if (!(e->mac[0] & 1)) {
+			r[0] |= e->is_static ? BIT(19) : 0;
+			r[0] |= (e->port & 0x3f) << 12;
+			r[0] |= e->vid;
+			r[1] |= e->block_da ? BIT(30) : 0;
+			r[1] |= e->block_sa ? BIT(31) : 0;
+			r[1] |= e->suspended ? BIT(29) : 0;
+			r[2] |= e->rvid & 0xfff;
+			if (e->next_hop) {
+				r[1] |= BIT(28);
+				r[0] |= e->nh_vlan_target ? BIT(9) : 0;
+				r[0] |= e->nh_route_id & 0x1ff;
+			}
+			r[0] |= (e->age & 0x3) << 17;
+		} else { /* L2 Multicast */
+			r[0] |= (e->mc_portmask_index & 0x1ff) << 12;
+			r[2] |= e->rvid & 0xfff;
+			r[0] |= e->vid & 0xfff;
+			pr_debug("FILL MC: %08x %08x %08x\n", r[0], r[1], r[2]);
+		}
+	} else { /* IPv4 and IPv6 multicast */
+		r[0] |= (e->mc_portmask_index & 0x1ff) << 12;
+		r[1] = e->mc_gip >> 20;
+		r[2] = e->mc_gip << 12;
+		r[2] |= e->rvid;
+	}
+}
+
+/* Read an L2 UC or MC entry out of a hash bucket of the L2 forwarding table
+ * hash is the id of the bucket and pos is the position of the entry in that bucket
+ * The data read from the SoC is filled into rtl838x_l2_entry
+ */
+static u64 rtl838x_read_l2_entry_using_hash(u32 hash, u32 pos, struct rtl838x_l2_entry *e)
+{
+	u32 r[3];
+	struct table_reg *q = rtl_table_get(RTL8380_TBL_L2, 0); /* Access L2 Table 0 */
+	u32 idx = (0 << 14) | (hash << 2) | pos; /* Search SRAM, with hash and at pos in bucket */
+
+	rtl_table_read(q, idx);
+	for (int i = 0; i < 3; i++)
+		r[i] = sw_r32(rtl_table_data(q, i));
+
+	rtl_table_release(q);
+
+	rtl838x_fill_l2_entry(r, e);
+	if (!e->valid)
+		return 0;
+
+	return (((u64) r[1]) << 32) | (r[2]);  /* mac and vid concatenated as hash seed */
+}
+
+static void rtl838x_write_l2_entry_using_hash(u32 hash, u32 pos, struct rtl838x_l2_entry *e)
+{
+	u32 r[3];
+	struct table_reg *q = rtl_table_get(RTL8380_TBL_L2, 0);
+
+	u32 idx = (0 << 14) | (hash << 2) | pos; /* Access SRAM, with hash and at pos in bucket */
+
+	rtl838x_fill_l2_row(r, e);
+
+	for (int i = 0; i < 3; i++)
+		sw_w32(r[i], rtl_table_data(q, i));
+
+	rtl_table_write(q, idx);
+	rtl_table_release(q);
+}
+
+static u64 rtl838x_read_cam(int idx, struct rtl838x_l2_entry *e)
+{
+	u32 r[3];
+	struct table_reg *q = rtl_table_get(RTL8380_TBL_L2, 1); /* Access L2 Table 1 */
+
+	rtl_table_read(q, idx);
+	for (int i = 0; i < 3; i++)
+		r[i] = sw_r32(rtl_table_data(q, i));
+
+	rtl_table_release(q);
+
+	rtl838x_fill_l2_entry(r, e);
+	if (!e->valid)
+		return 0;
+
+	pr_debug("Found in CAM: R1 %x R2 %x R3 %x\n", r[0], r[1], r[2]);
+
+	/* Return MAC with concatenated VID ac concatenated ID */
+	return (((u64) r[1]) << 32) | r[2];
+}
+
+static void rtl838x_write_cam(int idx, struct rtl838x_l2_entry *e)
+{
+	u32 r[3];
+	struct table_reg *q = rtl_table_get(RTL8380_TBL_L2, 1); /* Access L2 Table 1 */
+
+	rtl838x_fill_l2_row(r, e);
+
+	for (int i = 0; i < 3; i++)
+		sw_w32(r[i], rtl_table_data(q, i));
+
+	rtl_table_write(q, idx);
+	rtl_table_release(q);
+}
+
+static u64 rtl838x_read_mcast_pmask(int idx)
+{
+	u32 portmask;
+	/* Read MC_PMSK (2) via register RTL8380_TBL_L2 */
+	struct table_reg *q = rtl_table_get(RTL8380_TBL_L2, 2);
+
+	rtl_table_read(q, idx);
+	portmask = sw_r32(rtl_table_data(q, 0));
+	rtl_table_release(q);
+
+	return portmask;
+}
+
+static void rtl838x_write_mcast_pmask(int idx, u64 portmask)
+{
+	/* Access MC_PMSK (2) via register RTL8380_TBL_L2 */
+	struct table_reg *q = rtl_table_get(RTL8380_TBL_L2, 2);
+
+	sw_w32(((u32)portmask) & 0x1fffffff, rtl_table_data(q, 0));
+	rtl_table_write(q, idx);
+	rtl_table_release(q);
+}
+
+static void rtl838x_vlan_profile_setup(int profile)
+{
+	u32 pmask_id = UNKNOWN_MC_PMASK;
+	/* Enable L2 Learning BIT 0, portmask UNKNOWN_MC_PMASK for unknown MC traffic flooding */
+	u32 p = 1 | pmask_id << 1 | pmask_id << 10 | pmask_id << 19;
+
+	sw_w32(p, RTL838X_VLAN_PROFILE(profile));
+
+	/* RTL8380 and RTL8390 use an index into the portmask table to set the
+	 * unknown multicast portmask, setup a default at a safe location
+	 * On RTL93XX, the portmask is directly set in the profile,
+	 * see e.g. rtl9300_vlan_profile_setup
+	 */
+	rtl838x_write_mcast_pmask(UNKNOWN_MC_PMASK, 0x1fffffff);
+}
+
+static void rtl838x_l2_learning_setup(void)
+{
+	/* Set portmask for broadcast traffic and unknown unicast address flooding
+	 * to the reserved entry in the portmask table used also for
+	 * multicast flooding */
+	sw_w32(UNKNOWN_MC_PMASK << 12 | UNKNOWN_MC_PMASK, RTL838X_L2_FLD_PMSK);
+
+	/* Enable learning constraint system-wide (bit 0), per-port (bit 1)
+	 * and per vlan (bit 2) */
+	sw_w32(0x7, RTL838X_L2_LRN_CONSTRT_EN);
+
+	/* Limit learning to maximum: 16k entries, after that just flood (bits 0-1) */
+	sw_w32((0x3fff << 2) | 0, RTL838X_L2_LRN_CONSTRT);
+
+	/* Do not trap ARP packets to CPU_PORT */
+	sw_w32(0, RTL838X_SPCL_TRAP_ARP_CTRL);
+}
+
+static void rtl838x_enable_learning(int port, bool enable)
+{
+	/* Limit learning to maximum: 16k entries */
+
+	sw_w32_mask(0x3fff << 2, enable ? (0x3fff << 2) : 0,
+		    RTL838X_L2_PORT_LRN_CONSTRT + (port << 2));
+}
+
+static void rtl838x_enable_flood(int port, bool enable)
+{
+	/* 0: Forward
+	 * 1: Disable
+	 * 2: to CPU
+	 * 3: Copy to CPU
+	 */
+	sw_w32_mask(0x3, enable ? 0 : 1,
+		    RTL838X_L2_PORT_LRN_CONSTRT + (port << 2));
+}
+
+static void rtl838x_enable_mcast_flood(int port, bool enable)
+{
+
+}
+
+static void rtl838x_enable_bcast_flood(int port, bool enable)
+{
+
+}
+
+static void rtl838x_set_static_move_action(int port, bool forward)
+{
+	int shift = MV_ACT_PORT_SHIFT(port);
+	u32 val = forward ? MV_ACT_FORWARD : MV_ACT_DROP;
+
+	sw_w32_mask(MV_ACT_MASK << shift, val << shift,
+		    RTL838X_L2_PORT_STATIC_MV_ACT(port));
+}
+
+static void rtl838x_stp_get(struct rtl838x_switch_priv *priv, u16 msti, u32 port_state[])
+{
+	u32 cmd = 1 << 15 | /* Execute cmd */
+	          1 << 14 | /* Read */
+	          2 << 12 | /* Table type 0b10 */
+	          (msti & 0xfff);
+	priv->r->exec_tbl0_cmd(cmd);
+
+	for (int i = 0; i < 2; i++)
+		port_state[i] = sw_r32(priv->r->tbl_access_data_0(i));
+}
+
+static void rtl838x_stp_set(struct rtl838x_switch_priv *priv, u16 msti, u32 port_state[])
+{
+	u32 cmd = 1 << 15 | /* Execute cmd */
+	          0 << 14 | /* Write */
+	          2 << 12 | /* Table type 0b10 */
+	          (msti & 0xfff);
+
+	for (int i = 0; i < 2; i++)
+		sw_w32(port_state[i], priv->r->tbl_access_data_0(i));
+	priv->r->exec_tbl0_cmd(cmd);
+}
+
+u64 rtl838x_traffic_get(int source)
+{
+	return rtl838x_get_port_reg(rtl838x_port_iso_ctrl(source));
+}
+
+void rtl838x_traffic_set(int source, u64 dest_matrix)
+{
+	rtl838x_set_port_reg(dest_matrix, rtl838x_port_iso_ctrl(source));
+}
+
+void rtl838x_traffic_enable(int source, int dest)
+{
+	rtl838x_mask_port_reg(0, BIT(dest), rtl838x_port_iso_ctrl(source));
+}
+
+void rtl838x_traffic_disable(int source, int dest)
+{
+	rtl838x_mask_port_reg(BIT(dest), 0, rtl838x_port_iso_ctrl(source));
+}
+
+/* Enables or disables the EEE/EEEP capability of a port */
+static void rtl838x_port_eee_set(struct rtl838x_switch_priv *priv, int port, bool enable)
+{
+	u32 v;
+
+	/* This works only for Ethernet ports, and on the RTL838X, ports from 24 are SFP */
+	if (port >= 24)
+		return;
+
+	pr_debug("In %s: setting port %d to %d\n", __func__, port, enable);
+	v = enable ? 0x3 : 0x0;
+
+	/* Set EEE state for 100 (bit 9) & 1000MBit (bit 10) */
+	sw_w32_mask(0x3 << 9, v << 9, priv->r->mac_force_mode_ctrl(port));
+
+	/* Set TX/RX EEE state */
+	if (enable) {
+		sw_w32_mask(0, BIT(port), RTL838X_EEE_PORT_TX_EN);
+		sw_w32_mask(0, BIT(port), RTL838X_EEE_PORT_RX_EN);
+	} else {
+		sw_w32_mask(BIT(port), 0, RTL838X_EEE_PORT_TX_EN);
+		sw_w32_mask(BIT(port), 0, RTL838X_EEE_PORT_RX_EN);
+	}
+	priv->ports[port].eee_enabled = enable;
+}
+
+
+/* Get EEE own capabilities and negotiation result */
+static int rtl838x_eee_port_ability(struct rtl838x_switch_priv *priv,
+				    struct ethtool_eee *e, int port)
+{
+	u64 link;
+
+	if (port >= 24)
+		return 0;
+
+	link = rtl839x_get_port_reg_le(RTL838X_MAC_LINK_STS);
+	if (!(link & BIT(port)))
+		return 0;
+
+	if (sw_r32(rtl838x_mac_force_mode_ctrl(port)) & BIT(9))
+		e->advertised |= ADVERTISED_100baseT_Full;
+
+	if (sw_r32(rtl838x_mac_force_mode_ctrl(port)) & BIT(10))
+		e->advertised |= ADVERTISED_1000baseT_Full;
+
+	if (sw_r32(RTL838X_MAC_EEE_ABLTY) & BIT(port)) {
+		e->lp_advertised = ADVERTISED_100baseT_Full;
+		e->lp_advertised |= ADVERTISED_1000baseT_Full;
+		return 1;
+	}
+
+	return 0;
+}
+
+static void rtl838x_init_eee(struct rtl838x_switch_priv *priv, bool enable)
+{
+	pr_info("Setting up EEE, state: %d\n", enable);
+	sw_w32_mask(0x4, 0, RTL838X_SMI_GLB_CTRL);
+
+	/* Set timers for EEE */
+	sw_w32(0x5001411, RTL838X_EEE_TX_TIMER_GIGA_CTRL);
+	sw_w32(0x5001417, RTL838X_EEE_TX_TIMER_GELITE_CTRL);
+
+	/* Enable EEE MAC support on ports */
+	for (int i = 0; i < priv->cpu_port; i++) {
+		if (priv->ports[i].phy)
+			rtl838x_port_eee_set(priv, i, enable);
+	}
+	priv->eee_enabled = enable;
+}
+
+static void rtl838x_pie_lookup_enable(struct rtl838x_switch_priv *priv, int index)
+{
+	int block = index / PIE_BLOCK_SIZE;
+	u32 block_state = sw_r32(RTL838X_ACL_BLK_LOOKUP_CTRL);
+
+	/* Make sure rule-lookup is enabled in the block */
+	if (!(block_state & BIT(block)))
+		sw_w32(block_state | BIT(block), RTL838X_ACL_BLK_LOOKUP_CTRL);
+}
+
+static void rtl838x_pie_rule_del(struct rtl838x_switch_priv *priv, int index_from, int index_to)
+{
+	int block_from = index_from / PIE_BLOCK_SIZE;
+	int block_to = index_to / PIE_BLOCK_SIZE;
+	u32 v = (index_from << 1)| (index_to << 12 ) | BIT(0);
+	u32 block_state;
+
+	pr_debug("%s: from %d to %d\n", __func__, index_from, index_to);
+	mutex_lock(&priv->reg_mutex);
+
+	/* Remember currently active blocks */
+	block_state = sw_r32(RTL838X_ACL_BLK_LOOKUP_CTRL);
+
+	/* Make sure rule-lookup is disabled in the relevant blocks */
+	for (int block = block_from; block <= block_to; block++) {
+		if (block_state & BIT(block))
+			sw_w32(block_state & (~BIT(block)), RTL838X_ACL_BLK_LOOKUP_CTRL);
+	}
+
+	/* Write from-to and execute bit into control register */
+	sw_w32(v, RTL838X_ACL_CLR_CTRL);
+
+	/* Wait until command has completed */
+	do {
+	} while (sw_r32(RTL838X_ACL_CLR_CTRL) & BIT(0));
+
+	/* Re-enable rule lookup */
+	for (int block = block_from; block <= block_to; block++) {
+		if (!(block_state & BIT(block)))
+			sw_w32(block_state | BIT(block), RTL838X_ACL_BLK_LOOKUP_CTRL);
+	}
+
+	mutex_unlock(&priv->reg_mutex);
+}
+
+/* Reads the intermediate representation of the templated match-fields of the
+ * PIE rule in the pie_rule structure and fills in the raw data fields in the
+ * raw register space r[].
+ * The register space configuration size is identical for the RTL8380/90 and RTL9300,
+ * however the RTL9310 has 2 more registers / fields and the physical field-ids
+ * are specific to every platform.
+ */
+static void rtl838x_write_pie_templated(u32 r[], struct pie_rule *pr, enum template_field_id t[])
+{
+	for (int i = 0; i < N_FIXED_FIELDS; i++) {
+		enum template_field_id field_type = t[i];
+		u16 data = 0, data_m = 0;
+
+		switch (field_type) {
+		case TEMPLATE_FIELD_SPM0:
+			data = pr->spm;
+			data_m = pr->spm_m;
+			break;
+		case TEMPLATE_FIELD_SPM1:
+			data = pr->spm >> 16;
+			data_m = pr->spm_m >> 16;
+			break;
+		case TEMPLATE_FIELD_OTAG:
+			data = pr->otag;
+			data_m = pr->otag_m;
+			break;
+		case TEMPLATE_FIELD_SMAC0:
+			data = pr->smac[4];
+			data = (data << 8) | pr->smac[5];
+			data_m = pr->smac_m[4];
+			data_m = (data_m << 8) | pr->smac_m[5];
+			break;
+		case TEMPLATE_FIELD_SMAC1:
+			data = pr->smac[2];
+			data = (data << 8) | pr->smac[3];
+			data_m = pr->smac_m[2];
+			data_m = (data_m << 8) | pr->smac_m[3];
+			break;
+		case TEMPLATE_FIELD_SMAC2:
+			data = pr->smac[0];
+			data = (data << 8) | pr->smac[1];
+			data_m = pr->smac_m[0];
+			data_m = (data_m << 8) | pr->smac_m[1];
+			break;
+		case TEMPLATE_FIELD_DMAC0:
+			data = pr->dmac[4];
+			data = (data << 8) | pr->dmac[5];
+			data_m = pr->dmac_m[4];
+			data_m = (data_m << 8) | pr->dmac_m[5];
+			break;
+		case TEMPLATE_FIELD_DMAC1:
+			data = pr->dmac[2];
+			data = (data << 8) | pr->dmac[3];
+			data_m = pr->dmac_m[2];
+			data_m = (data_m << 8) | pr->dmac_m[3];
+			break;
+		case TEMPLATE_FIELD_DMAC2:
+			data = pr->dmac[0];
+			data = (data << 8) | pr->dmac[1];
+			data_m = pr->dmac_m[0];
+			data_m = (data_m << 8) | pr->dmac_m[1];
+			break;
+		case TEMPLATE_FIELD_ETHERTYPE:
+			data = pr->ethertype;
+			data_m = pr->ethertype_m;
+			break;
+		case TEMPLATE_FIELD_ITAG:
+			data = pr->itag;
+			data_m = pr->itag_m;
+			break;
+		case TEMPLATE_FIELD_RANGE_CHK:
+			data = pr->field_range_check;
+			data_m = pr->field_range_check_m;
+			break;
+		case TEMPLATE_FIELD_SIP0:
+			if (pr->is_ipv6) {
+				data = pr->sip6.s6_addr16[7];
+				data_m = pr->sip6_m.s6_addr16[7];
+			} else {
+				data = pr->sip;
+				data_m = pr->sip_m;
+			}
+			break;
+		case TEMPLATE_FIELD_SIP1:
+			if (pr->is_ipv6) {
+				data = pr->sip6.s6_addr16[6];
+				data_m = pr->sip6_m.s6_addr16[6];
+			} else {
+				data = pr->sip >> 16;
+				data_m = pr->sip_m >> 16;
+			}
+			break;
+		case TEMPLATE_FIELD_SIP2:
+		case TEMPLATE_FIELD_SIP3:
+		case TEMPLATE_FIELD_SIP4:
+		case TEMPLATE_FIELD_SIP5:
+		case TEMPLATE_FIELD_SIP6:
+		case TEMPLATE_FIELD_SIP7:
+			data = pr->sip6.s6_addr16[5 - (field_type - TEMPLATE_FIELD_SIP2)];
+			data_m = pr->sip6_m.s6_addr16[5 - (field_type - TEMPLATE_FIELD_SIP2)];
+			break;
+		case TEMPLATE_FIELD_DIP0:
+			if (pr->is_ipv6) {
+				data = pr->dip6.s6_addr16[7];
+				data_m = pr->dip6_m.s6_addr16[7];
+			} else {
+				data = pr->dip;
+				data_m = pr->dip_m;
+			}
+			break;
+		case TEMPLATE_FIELD_DIP1:
+			if (pr->is_ipv6) {
+				data = pr->dip6.s6_addr16[6];
+				data_m = pr->dip6_m.s6_addr16[6];
+			} else {
+				data = pr->dip >> 16;
+				data_m = pr->dip_m >> 16;
+			}
+			break;
+		case TEMPLATE_FIELD_DIP2:
+		case TEMPLATE_FIELD_DIP3:
+		case TEMPLATE_FIELD_DIP4:
+		case TEMPLATE_FIELD_DIP5:
+		case TEMPLATE_FIELD_DIP6:
+		case TEMPLATE_FIELD_DIP7:
+			data = pr->dip6.s6_addr16[5 - (field_type - TEMPLATE_FIELD_DIP2)];
+			data_m = pr->dip6_m.s6_addr16[5 - (field_type - TEMPLATE_FIELD_DIP2)];
+			break;
+		case TEMPLATE_FIELD_IP_TOS_PROTO:
+			data = pr->tos_proto;
+			data_m = pr->tos_proto_m;
+			break;
+		case TEMPLATE_FIELD_L4_SPORT:
+			data = pr->sport;
+			data_m = pr->sport_m;
+			break;
+		case TEMPLATE_FIELD_L4_DPORT:
+			data = pr->dport;
+			data_m = pr->dport_m;
+			break;
+		case TEMPLATE_FIELD_ICMP_IGMP:
+			data = pr->icmp_igmp;
+			data_m = pr->icmp_igmp_m;
+			break;
+		default:
+			pr_info("%s: unknown field %d\n", __func__, field_type);
+			continue;
+		}
+		if (!(i % 2)) {
+			r[5 - i / 2] = data;
+			r[12 - i / 2] = data_m;
+		} else {
+			r[5 - i / 2] |= ((u32)data) << 16;
+			r[12 - i / 2] |= ((u32)data_m) << 16;
+		}
+	}
+}
+
+/* Creates the intermediate representation of the templated match-fields of the
+ * PIE rule in the pie_rule structure by reading the raw data fields in the
+ * raw register space r[].
+ * The register space configuration size is identical for the RTL8380/90 and RTL9300,
+ * however the RTL9310 has 2 more registers / fields and the physical field-ids
+ */
+static void rtl838x_read_pie_templated(u32 r[], struct pie_rule *pr, enum template_field_id t[])
+{
+	for (int i = 0; i < N_FIXED_FIELDS; i++) {
+		enum template_field_id field_type = t[i];
+		u16 data, data_m;
+
+		field_type = t[i];
+		if (!(i % 2)) {
+			data = r[5 - i / 2];
+			data_m = r[12 - i / 2];
+		} else {
+			data = r[5 - i / 2] >> 16;
+			data_m = r[12 - i / 2] >> 16;
+		}
+
+		switch (field_type) {
+		case TEMPLATE_FIELD_SPM0:
+			pr->spm = (pr->spn << 16) | data;
+			pr->spm_m = (pr->spn << 16) | data_m;
+			break;
+		case TEMPLATE_FIELD_SPM1:
+			pr->spm = data;
+			pr->spm_m = data_m;
+			break;
+		case TEMPLATE_FIELD_OTAG:
+			pr->otag = data;
+			pr->otag_m = data_m;
+			break;
+		case TEMPLATE_FIELD_SMAC0:
+			pr->smac[4] = data >> 8;
+			pr->smac[5] = data;
+			pr->smac_m[4] = data >> 8;
+			pr->smac_m[5] = data;
+			break;
+		case TEMPLATE_FIELD_SMAC1:
+			pr->smac[2] = data >> 8;
+			pr->smac[3] = data;
+			pr->smac_m[2] = data >> 8;
+			pr->smac_m[3] = data;
+			break;
+		case TEMPLATE_FIELD_SMAC2:
+			pr->smac[0] = data >> 8;
+			pr->smac[1] = data;
+			pr->smac_m[0] = data >> 8;
+			pr->smac_m[1] = data;
+			break;
+		case TEMPLATE_FIELD_DMAC0:
+			pr->dmac[4] = data >> 8;
+			pr->dmac[5] = data;
+			pr->dmac_m[4] = data >> 8;
+			pr->dmac_m[5] = data;
+			break;
+		case TEMPLATE_FIELD_DMAC1:
+			pr->dmac[2] = data >> 8;
+			pr->dmac[3] = data;
+			pr->dmac_m[2] = data >> 8;
+			pr->dmac_m[3] = data;
+			break;
+		case TEMPLATE_FIELD_DMAC2:
+			pr->dmac[0] = data >> 8;
+			pr->dmac[1] = data;
+			pr->dmac_m[0] = data >> 8;
+			pr->dmac_m[1] = data;
+			break;
+		case TEMPLATE_FIELD_ETHERTYPE:
+			pr->ethertype = data;
+			pr->ethertype_m = data_m;
+			break;
+		case TEMPLATE_FIELD_ITAG:
+			pr->itag = data;
+			pr->itag_m = data_m;
+			break;
+		case TEMPLATE_FIELD_RANGE_CHK:
+			pr->field_range_check = data;
+			pr->field_range_check_m = data_m;
+			break;
+		case TEMPLATE_FIELD_SIP0:
+			pr->sip = data;
+			pr->sip_m = data_m;
+			break;
+		case TEMPLATE_FIELD_SIP1:
+			pr->sip = (pr->sip << 16) | data;
+			pr->sip_m = (pr->sip << 16) | data_m;
+			break;
+		case TEMPLATE_FIELD_SIP2:
+			pr->is_ipv6 = true;
+			/* Make use of limitiations on the position of the match values */
+			ipv6_addr_set(&pr->sip6, pr->sip, r[5 - i / 2],
+				      r[4 - i / 2], r[3 - i / 2]);
+			ipv6_addr_set(&pr->sip6_m, pr->sip_m, r[5 - i / 2],
+				      r[4 - i / 2], r[3 - i / 2]);
+		case TEMPLATE_FIELD_SIP3:
+		case TEMPLATE_FIELD_SIP4:
+		case TEMPLATE_FIELD_SIP5:
+		case TEMPLATE_FIELD_SIP6:
+		case TEMPLATE_FIELD_SIP7:
+			break;
+		case TEMPLATE_FIELD_DIP0:
+			pr->dip = data;
+			pr->dip_m = data_m;
+			break;
+		case TEMPLATE_FIELD_DIP1:
+			pr->dip = (pr->dip << 16) | data;
+			pr->dip_m = (pr->dip << 16) | data_m;
+			break;
+		case TEMPLATE_FIELD_DIP2:
+			pr->is_ipv6 = true;
+			ipv6_addr_set(&pr->dip6, pr->dip, r[5 - i / 2],
+				      r[4 - i / 2], r[3 - i / 2]);
+			ipv6_addr_set(&pr->dip6_m, pr->dip_m, r[5 - i / 2],
+				      r[4 - i / 2], r[3 - i / 2]);
+		case TEMPLATE_FIELD_DIP3:
+		case TEMPLATE_FIELD_DIP4:
+		case TEMPLATE_FIELD_DIP5:
+		case TEMPLATE_FIELD_DIP6:
+		case TEMPLATE_FIELD_DIP7:
+			break;
+		case TEMPLATE_FIELD_IP_TOS_PROTO:
+			pr->tos_proto = data;
+			pr->tos_proto_m = data_m;
+			break;
+		case TEMPLATE_FIELD_L4_SPORT:
+			pr->sport = data;
+			pr->sport_m = data_m;
+			break;
+		case TEMPLATE_FIELD_L4_DPORT:
+			pr->dport = data;
+			pr->dport_m = data_m;
+			break;
+		case TEMPLATE_FIELD_ICMP_IGMP:
+			pr->icmp_igmp = data;
+			pr->icmp_igmp_m = data_m;
+			break;
+		default:
+			pr_info("%s: unknown field %d\n", __func__, field_type);
+		}
+	}
+}
+
+static void rtl838x_read_pie_fixed_fields(u32 r[], struct pie_rule *pr)
+{
+	pr->spmmask_fix = (r[6] >> 22) & 0x3;
+	pr->spn = (r[6] >> 16) & 0x3f;
+	pr->mgnt_vlan = (r[6] >> 15) & 1;
+	pr->dmac_hit_sw = (r[6] >> 14) & 1;
+	pr->not_first_frag = (r[6] >> 13) & 1;
+	pr->frame_type_l4 = (r[6] >> 10) & 7;
+	pr->frame_type = (r[6] >> 8) & 3;
+	pr->otag_fmt = (r[6] >> 7) & 1;
+	pr->itag_fmt = (r[6] >> 6) & 1;
+	pr->otag_exist = (r[6] >> 5) & 1;
+	pr->itag_exist = (r[6] >> 4) & 1;
+	pr->frame_type_l2 = (r[6] >> 2) & 3;
+	pr->tid = r[6] & 3;
+
+	pr->spmmask_fix_m = (r[13] >> 22) & 0x3;
+	pr->spn_m = (r[13] >> 16) & 0x3f;
+	pr->mgnt_vlan_m = (r[13] >> 15) & 1;
+	pr->dmac_hit_sw_m = (r[13] >> 14) & 1;
+	pr->not_first_frag_m = (r[13] >> 13) & 1;
+	pr->frame_type_l4_m = (r[13] >> 10) & 7;
+	pr->frame_type_m = (r[13] >> 8) & 3;
+	pr->otag_fmt_m = (r[13] >> 7) & 1;
+	pr->itag_fmt_m = (r[13] >> 6) & 1;
+	pr->otag_exist_m = (r[13] >> 5) & 1;
+	pr->itag_exist_m = (r[13] >> 4) & 1;
+	pr->frame_type_l2_m = (r[13] >> 2) & 3;
+	pr->tid_m = r[13] & 3;
+
+	pr->valid = r[14] & BIT(31);
+	pr->cond_not = r[14] & BIT(30);
+	pr->cond_and1 = r[14] & BIT(29);
+	pr->cond_and2 = r[14] & BIT(28);
+	pr->ivalid = r[14] & BIT(27);
+
+	pr->drop = (r[17] >> 14) & 3;
+	pr->fwd_sel = r[17] & BIT(13);
+	pr->ovid_sel = r[17] & BIT(12);
+	pr->ivid_sel = r[17] & BIT(11);
+	pr->flt_sel = r[17] & BIT(10);
+	pr->log_sel = r[17] & BIT(9);
+	pr->rmk_sel = r[17] & BIT(8);
+	pr->meter_sel = r[17] & BIT(7);
+	pr->tagst_sel = r[17] & BIT(6);
+	pr->mir_sel = r[17] & BIT(5);
+	pr->nopri_sel = r[17] & BIT(4);
+	pr->cpupri_sel = r[17] & BIT(3);
+	pr->otpid_sel = r[17] & BIT(2);
+	pr->itpid_sel = r[17] & BIT(1);
+	pr->shaper_sel = r[17] & BIT(0);
+}
+
+static void rtl838x_write_pie_fixed_fields(u32 r[],  struct pie_rule *pr)
+{
+	r[6] = ((u32) (pr->spmmask_fix & 0x3)) << 22;
+	r[6] |= ((u32) (pr->spn & 0x3f)) << 16;
+	r[6] |= pr->mgnt_vlan ? BIT(15) : 0;
+	r[6] |= pr->dmac_hit_sw ? BIT(14) : 0;
+	r[6] |= pr->not_first_frag ? BIT(13) : 0;
+	r[6] |= ((u32) (pr->frame_type_l4 & 0x7)) << 10;
+	r[6] |= ((u32) (pr->frame_type & 0x3)) << 8;
+	r[6] |= pr->otag_fmt ? BIT(7) : 0;
+	r[6] |= pr->itag_fmt ? BIT(6) : 0;
+	r[6] |= pr->otag_exist ? BIT(5) : 0;
+	r[6] |= pr->itag_exist ? BIT(4) : 0;
+	r[6] |= ((u32) (pr->frame_type_l2 & 0x3)) << 2;
+	r[6] |= ((u32) (pr->tid & 0x3));
+
+	r[13] = ((u32) (pr->spmmask_fix_m & 0x3)) << 22;
+	r[13] |= ((u32) (pr->spn_m & 0x3f)) << 16;
+	r[13] |= pr->mgnt_vlan_m ? BIT(15) : 0;
+	r[13] |= pr->dmac_hit_sw_m ? BIT(14) : 0;
+	r[13] |= pr->not_first_frag_m ? BIT(13) : 0;
+	r[13] |= ((u32) (pr->frame_type_l4_m & 0x7)) << 10;
+	r[13] |= ((u32) (pr->frame_type_m & 0x3)) << 8;
+	r[13] |= pr->otag_fmt_m ? BIT(7) : 0;
+	r[13] |= pr->itag_fmt_m ? BIT(6) : 0;
+	r[13] |= pr->otag_exist_m ? BIT(5) : 0;
+	r[13] |= pr->itag_exist_m ? BIT(4) : 0;
+	r[13] |= ((u32) (pr->frame_type_l2_m & 0x3)) << 2;
+	r[13] |= ((u32) (pr->tid_m & 0x3));
+
+	r[14] = pr->valid ? BIT(31) : 0;
+	r[14] |= pr->cond_not ? BIT(30) : 0;
+	r[14] |= pr->cond_and1 ? BIT(29) : 0;
+	r[14] |= pr->cond_and2 ? BIT(28) : 0;
+	r[14] |= pr->ivalid ? BIT(27) : 0;
+
+	if (pr->drop)
+		r[17] = 0x1 << 14;	/* Standard drop action */
+	else
+		r[17] = 0;
+	r[17] |= pr->fwd_sel ? BIT(13) : 0;
+	r[17] |= pr->ovid_sel ? BIT(12) : 0;
+	r[17] |= pr->ivid_sel ? BIT(11) : 0;
+	r[17] |= pr->flt_sel ? BIT(10) : 0;
+	r[17] |= pr->log_sel ? BIT(9) : 0;
+	r[17] |= pr->rmk_sel ? BIT(8) : 0;
+	r[17] |= pr->meter_sel ? BIT(7) : 0;
+	r[17] |= pr->tagst_sel ? BIT(6) : 0;
+	r[17] |= pr->mir_sel ? BIT(5) : 0;
+	r[17] |= pr->nopri_sel ? BIT(4) : 0;
+	r[17] |= pr->cpupri_sel ? BIT(3) : 0;
+	r[17] |= pr->otpid_sel ? BIT(2) : 0;
+	r[17] |= pr->itpid_sel ? BIT(1) : 0;
+	r[17] |= pr->shaper_sel ? BIT(0) : 0;
+}
+
+static int rtl838x_write_pie_action(u32 r[],  struct pie_rule *pr)
+{
+	u16 *aif = (u16 *)&r[17];
+	u16 data;
+	int fields_used = 0;
+
+	aif--;
+
+	pr_debug("%s, at %08x\n", __func__, (u32)aif);
+	/* Multiple actions can be linked to a match of a PIE rule,
+	 * they have different precedence depending on their type and this precedence
+	 * defines which Action Information Field (0-4) in the IACL table stores
+	 * the additional data of the action (like e.g. the port number a packet is
+	 * forwarded to) */
+	/* TODO: count bits in selectors to limit to a maximum number of actions */
+	if (pr->fwd_sel) { /* Forwarding action */
+		data = pr->fwd_act << 13;
+		data |= pr->fwd_data;
+		data |= pr->bypass_all ? BIT(12) : 0;
+		data |= pr->bypass_ibc_sc ? BIT(11) : 0;
+		data |= pr->bypass_igr_stp ? BIT(10) : 0;
+		*aif-- = data;
+		fields_used++;
+	}
+
+	if (pr->ovid_sel) { /* Outer VID action */
+		data = (pr->ovid_act & 0x3) << 12;
+		data |= pr->ovid_data;
+		*aif-- = data;
+		fields_used++;
+	}
+
+	if (pr->ivid_sel) { /* Inner VID action */
+		data = (pr->ivid_act & 0x3) << 12;
+		data |= pr->ivid_data;
+		*aif-- = data;
+		fields_used++;
+	}
+
+	if (pr->flt_sel) { /* Filter action */
+		*aif-- = pr->flt_data;
+		fields_used++;
+	}
+
+	if (pr->log_sel) { /* Log action */
+		if (fields_used >= 4)
+			return -1;
+		*aif-- = pr->log_data;
+		fields_used++;
+	}
+
+	if (pr->rmk_sel) { /* Remark action */
+		if (fields_used >= 4)
+			return -1;
+		*aif-- = pr->rmk_data;
+		fields_used++;
+	}
+
+	if (pr->meter_sel) { /* Meter action */
+		if (fields_used >= 4)
+			return -1;
+		*aif-- = pr->meter_data;
+		fields_used++;
+	}
+
+	if (pr->tagst_sel) { /* Egress Tag Status action */
+		if (fields_used >= 4)
+			return -1;
+		*aif-- = pr->tagst_data;
+		fields_used++;
+	}
+
+	if (pr->mir_sel) { /* Mirror action */
+		if (fields_used >= 4)
+			return -1;
+		*aif-- = pr->mir_data;
+		fields_used++;
+	}
+
+	if (pr->nopri_sel) { /* Normal Priority action */
+		if (fields_used >= 4)
+			return -1;
+		*aif-- = pr->nopri_data;
+		fields_used++;
+	}
+
+	if (pr->cpupri_sel) { /* CPU Priority action */
+		if (fields_used >= 4)
+			return -1;
+		*aif-- = pr->nopri_data;
+		fields_used++;
+	}
+
+	if (pr->otpid_sel) { /* OTPID action */
+		if (fields_used >= 4)
+			return -1;
+		*aif-- = pr->otpid_data;
+		fields_used++;
+	}
+
+	if (pr->itpid_sel) { /* ITPID action */
+		if (fields_used >= 4)
+			return -1;
+		*aif-- = pr->itpid_data;
+		fields_used++;
+	}
+
+	if (pr->shaper_sel) { /* Traffic shaper action */
+		if (fields_used >= 4)
+			return -1;
+		*aif-- = pr->shaper_data;
+		fields_used++;
+	}
+
+	return 0;
+}
+
+static void rtl838x_read_pie_action(u32 r[],  struct pie_rule *pr)
+{
+	u16 *aif = (u16 *)&r[17];
+
+	aif--;
+
+	pr_debug("%s, at %08x\n", __func__, (u32)aif);
+	if (pr->drop)
+		pr_debug("%s: Action Drop: %d", __func__, pr->drop);
+
+	if (pr->fwd_sel){ /* Forwarding action */
+		pr->fwd_act = *aif >> 13;
+		pr->fwd_data = *aif--;
+		pr->bypass_all = pr->fwd_data & BIT(12);
+		pr->bypass_ibc_sc = pr->fwd_data & BIT(11);
+		pr->bypass_igr_stp = pr->fwd_data & BIT(10);
+		if (pr->bypass_all || pr->bypass_ibc_sc || pr->bypass_igr_stp)
+			pr->bypass_sel = true;
+	}
+	if (pr->ovid_sel) /* Outer VID action */
+		pr->ovid_data = *aif--;
+	if (pr->ivid_sel) /* Inner VID action */
+		pr->ivid_data = *aif--;
+	if (pr->flt_sel) /* Filter action */
+		pr->flt_data = *aif--;
+	if (pr->log_sel) /* Log action */
+		pr->log_data = *aif--;
+	if (pr->rmk_sel) /* Remark action */
+		pr->rmk_data = *aif--;
+	if (pr->meter_sel) /* Meter action */
+		pr->meter_data = *aif--;
+	if (pr->tagst_sel) /* Egress Tag Status action */
+		pr->tagst_data = *aif--;
+	if (pr->mir_sel) /* Mirror action */
+		pr->mir_data = *aif--;
+	if (pr->nopri_sel) /* Normal Priority action */
+		pr->nopri_data = *aif--;
+	if (pr->cpupri_sel) /* CPU Priority action */
+		pr->nopri_data = *aif--;
+	if (pr->otpid_sel) /* OTPID action */
+		pr->otpid_data = *aif--;
+	if (pr->itpid_sel) /* ITPID action */
+		pr->itpid_data = *aif--;
+	if (pr->shaper_sel) /* Traffic shaper action */
+		pr->shaper_data = *aif--;
+}
+
+static void rtl838x_pie_rule_dump_raw(u32 r[])
+{
+	pr_info("Raw IACL table entry:\n");
+	pr_info("Match  : %08x %08x %08x %08x %08x %08x\n", r[0], r[1], r[2], r[3], r[4], r[5]);
+	pr_info("Fixed  : %08x\n", r[6]);
+	pr_info("Match M: %08x %08x %08x %08x %08x %08x\n", r[7], r[8], r[9], r[10], r[11], r[12]);
+	pr_info("Fixed M: %08x\n", r[13]);
+	pr_info("AIF    : %08x %08x %08x\n", r[14], r[15], r[16]);
+	pr_info("Sel    : %08x\n", r[17]);
+}
+
+// Currently not used
+// static void rtl838x_pie_rule_dump(struct  pie_rule *pr)
+// {
+// 	pr_info("Drop: %d, fwd: %d, ovid: %d, ivid: %d, flt: %d, log: %d, rmk: %d, meter: %d tagst: %d, mir: %d, nopri: %d, cpupri: %d, otpid: %d, itpid: %d, shape: %d\n",
+// 		pr->drop, pr->fwd_sel, pr->ovid_sel, pr->ivid_sel, pr->flt_sel, pr->log_sel, pr->rmk_sel, pr->log_sel, pr->tagst_sel, pr->mir_sel, pr->nopri_sel,
+// 		pr->cpupri_sel, pr->otpid_sel, pr->itpid_sel, pr->shaper_sel);
+// 	if (pr->fwd_sel)
+// 		pr_info("FWD: %08x\n", pr->fwd_data);
+// 	pr_info("TID: %x, %x\n", pr->tid, pr->tid_m);
+// }
+
+static int rtl838x_pie_rule_read(struct rtl838x_switch_priv *priv, int idx, struct  pie_rule *pr)
+{
+	/* Read IACL table (1) via register 0 */
+	struct table_reg *q = rtl_table_get(RTL8380_TBL_0, 1);
+	u32 r[18];
+	int block = idx / PIE_BLOCK_SIZE;
+	u32 t_select = sw_r32(RTL838X_ACL_BLK_TMPLTE_CTRL(block));
+
+	memset(pr, 0, sizeof(*pr));
+	rtl_table_read(q, idx);
+	for (int i = 0; i < 18; i++)
+		r[i] = sw_r32(rtl_table_data(q, i));
+
+	rtl_table_release(q);
+
+	rtl838x_read_pie_fixed_fields(r, pr);
+	if (!pr->valid)
+		return 0;
+
+	pr_info("%s: template_selectors %08x, tid: %d\n", __func__, t_select, pr->tid);
+	rtl838x_pie_rule_dump_raw(r);
+
+	rtl838x_read_pie_templated(r, pr, fixed_templates[(t_select >> (pr->tid * 3)) & 0x7]);
+
+	rtl838x_read_pie_action(r, pr);
+
+	return 0;
+}
+
+static int rtl838x_pie_rule_write(struct rtl838x_switch_priv *priv, int idx, struct pie_rule *pr)
+{
+	/* Access IACL table (1) via register 0 */
+	struct table_reg *q = rtl_table_get(RTL8380_TBL_0, 1);
+	u32 r[18];
+	int err;
+	int block = idx / PIE_BLOCK_SIZE;
+	u32 t_select = sw_r32(RTL838X_ACL_BLK_TMPLTE_CTRL(block));
+
+	pr_debug("%s: %d, t_select: %08x\n", __func__, idx, t_select);
+
+	for (int i = 0; i < 18; i++)
+		r[i] = 0;
+
+	if (!pr->valid) {
+		err = -EINVAL;
+		pr_err("Rule invalid\n");
+		goto errout;
+	}
+
+	rtl838x_write_pie_fixed_fields(r, pr);
+
+	pr_debug("%s: template %d\n", __func__, (t_select >> (pr->tid * 3)) & 0x7);
+	rtl838x_write_pie_templated(r, pr, fixed_templates[(t_select >> (pr->tid * 3)) & 0x7]);
+
+	err = rtl838x_write_pie_action(r, pr);
+	if (err) {
+		pr_err("Rule actions too complex\n");
+		goto errout;
+	}
+
+/*	rtl838x_pie_rule_dump_raw(r); */
+
+	for (int i = 0; i < 18; i++)
+		sw_w32(r[i], rtl_table_data(q, i));
+
+errout:
+	rtl_table_write(q, idx);
+	rtl_table_release(q);
+
+	return err;
+}
+
+static bool rtl838x_pie_templ_has(int t, enum template_field_id field_type)
+{
+	enum template_field_id ft;
+
+	for (int i = 0; i < N_FIXED_FIELDS; i++) {
+		ft = fixed_templates[t][i];
+		if (field_type == ft)
+			return true;
+	}
+
+	return false;
+}
+
+static int rtl838x_pie_verify_template(struct rtl838x_switch_priv *priv,
+				       struct pie_rule *pr, int t, int block)
+{
+	int i;
+
+	if (!pr->is_ipv6 && pr->sip_m && !rtl838x_pie_templ_has(t, TEMPLATE_FIELD_SIP0))
+		return -1;
+
+	if (!pr->is_ipv6 && pr->dip_m && !rtl838x_pie_templ_has(t, TEMPLATE_FIELD_DIP0))
+		return -1;
+
+	if (pr->is_ipv6) {
+		if ((pr->sip6_m.s6_addr32[0] ||
+		     pr->sip6_m.s6_addr32[1] ||
+		     pr->sip6_m.s6_addr32[2] ||
+		     pr->sip6_m.s6_addr32[3]) &&
+		    !rtl838x_pie_templ_has(t, TEMPLATE_FIELD_SIP2))
+			return -1;
+		if ((pr->dip6_m.s6_addr32[0] ||
+		     pr->dip6_m.s6_addr32[1] ||
+		     pr->dip6_m.s6_addr32[2] ||
+		     pr->dip6_m.s6_addr32[3]) &&
+		    !rtl838x_pie_templ_has(t, TEMPLATE_FIELD_DIP2))
+			return -1;
+	}
+
+	if (ether_addr_to_u64(pr->smac) && !rtl838x_pie_templ_has(t, TEMPLATE_FIELD_SMAC0))
+		return -1;
+
+	if (ether_addr_to_u64(pr->dmac) && !rtl838x_pie_templ_has(t, TEMPLATE_FIELD_DMAC0))
+		return -1;
+
+	/* TODO: Check more */
+
+	i = find_first_zero_bit(&priv->pie_use_bm[block * 4], PIE_BLOCK_SIZE);
+
+	if (i >= PIE_BLOCK_SIZE)
+		return -1;
+
+	return i + PIE_BLOCK_SIZE * block;
+}
+
+static int rtl838x_pie_rule_add(struct rtl838x_switch_priv *priv, struct pie_rule *pr)
+{
+	int idx, block, j;
+
+	pr_debug("In %s\n", __func__);
+
+	mutex_lock(&priv->pie_mutex);
+
+	for (block = 0; block < priv->n_pie_blocks; block++) {
+		for (j = 0; j < 3; j++) {
+			int t = (sw_r32(RTL838X_ACL_BLK_TMPLTE_CTRL(block)) >> (j * 3)) & 0x7;
+			pr_debug("Testing block %d, template %d, template id %d\n", block, j, t);
+			idx = rtl838x_pie_verify_template(priv, pr, t, block);
+			if (idx >= 0)
+				break;
+		}
+		if (j < 3)
+			break;
+	}
+
+	if (block >= priv->n_pie_blocks) {
+		mutex_unlock(&priv->pie_mutex);
+		return -EOPNOTSUPP;
+	}
+
+	pr_debug("Using block: %d, index %d, template-id %d\n", block, idx, j);
+	set_bit(idx, priv->pie_use_bm);
+
+	pr->valid = true;
+	pr->tid = j;  /* Mapped to template number */
+	pr->tid_m = 0x3;
+	pr->id = idx;
+
+	rtl838x_pie_lookup_enable(priv, idx);
+	rtl838x_pie_rule_write(priv, idx, pr);
+
+	mutex_unlock(&priv->pie_mutex);
+
+	return 0;
+}
+
+static void rtl838x_pie_rule_rm(struct rtl838x_switch_priv *priv, struct pie_rule *pr)
+{
+	int idx = pr->id;
+
+	rtl838x_pie_rule_del(priv, idx, idx);
+	clear_bit(idx, priv->pie_use_bm);
+}
+
+/* Initializes the Packet Inspection Engine:
+ * powers it up, enables default matching templates for all blocks
+ * and clears all rules possibly installed by u-boot
+ */
+static void rtl838x_pie_init(struct rtl838x_switch_priv *priv)
+{
+	u32 template_selectors;
+
+	mutex_init(&priv->pie_mutex);
+
+	/* Enable ACL lookup on all ports, including CPU_PORT */
+	for (int i = 0; i <= priv->cpu_port; i++)
+		sw_w32(1, RTL838X_ACL_PORT_LOOKUP_CTRL(i));
+
+	/* Power on all PIE blocks */
+	for (int i = 0; i < priv->n_pie_blocks; i++)
+		sw_w32_mask(0, BIT(i), RTL838X_ACL_BLK_PWR_CTRL);
+
+	/* Include IPG in metering */
+	sw_w32(1, RTL838X_METER_GLB_CTRL);
+
+	/* Delete all present rules */
+	rtl838x_pie_rule_del(priv, 0, priv->n_pie_blocks * PIE_BLOCK_SIZE - 1);
+
+	/* Routing bypasses source port filter: disable write-protection, first */
+	sw_w32_mask(0, 3, RTL838X_INT_RW_CTRL);
+	sw_w32_mask(0, 1, RTL838X_DMY_REG27);
+	sw_w32_mask(3, 0, RTL838X_INT_RW_CTRL);
+
+	/* Enable predefined templates 0, 1 and 2 for even blocks */
+	template_selectors = 0 | (1 << 3) | (2 << 6);
+	for (int i = 0; i < 6; i += 2)
+		sw_w32(template_selectors, RTL838X_ACL_BLK_TMPLTE_CTRL(i));
+
+	/* Enable predefined templates 0, 3 and 4 (IPv6 support) for odd blocks */
+	template_selectors = 0 | (3 << 3) | (4 << 6);
+	for (int i = 1; i < priv->n_pie_blocks; i += 2)
+		sw_w32(template_selectors, RTL838X_ACL_BLK_TMPLTE_CTRL(i));
+
+	/* Group each pair of physical blocks together to a logical block */
+	sw_w32(0b10101010101, RTL838X_ACL_BLK_GROUP_CTRL);
+}
+
+static u32 rtl838x_packet_cntr_read(int counter)
+{
+	u32 v;
+
+	/* Read LOG table (3) via register RTL8380_TBL_0 */
+	struct table_reg *r = rtl_table_get(RTL8380_TBL_0, 3);
+
+	pr_debug("In %s, id %d\n", __func__, counter);
+	rtl_table_read(r, counter / 2);
+
+	pr_debug("Registers: %08x %08x\n",
+		sw_r32(rtl_table_data(r, 0)), sw_r32(rtl_table_data(r, 1)));
+	/* The table has a size of 2 registers */
+	if (counter % 2)
+		v = sw_r32(rtl_table_data(r, 0));
+	else
+		v = sw_r32(rtl_table_data(r, 1));
+
+	rtl_table_release(r);
+
+	return v;
+}
+
+static void rtl838x_packet_cntr_clear(int counter)
+{
+	/* Access LOG table (3) via register RTL8380_TBL_0 */
+	struct table_reg *r = rtl_table_get(RTL8380_TBL_0, 3);
+
+	pr_debug("In %s, id %d\n", __func__, counter);
+	/* The table has a size of 2 registers */
+	if (counter % 2)
+		sw_w32(0, rtl_table_data(r, 0));
+	else
+		sw_w32(0, rtl_table_data(r, 1));
+
+	rtl_table_write(r, counter / 2);
+
+	rtl_table_release(r);
+}
+
+static void rtl838x_route_read(int idx, struct rtl83xx_route *rt)
+{
+	/* Read ROUTING table (2) via register RTL8380_TBL_1 */
+	struct table_reg *r = rtl_table_get(RTL8380_TBL_1, 2);
+
+	pr_debug("In %s, id %d\n", __func__, idx);
+	rtl_table_read(r, idx);
+
+	/* The table has a size of 2 registers */
+	rt->nh.gw = sw_r32(rtl_table_data(r, 0));
+	rt->nh.gw <<= 32;
+	rt->nh.gw |= sw_r32(rtl_table_data(r, 1));
+
+	rtl_table_release(r);
+}
+
+static void rtl838x_route_write(int idx, struct rtl83xx_route *rt)
+{
+	/* Access ROUTING table (2) via register RTL8380_TBL_1 */
+	struct table_reg *r = rtl_table_get(RTL8380_TBL_1, 2);
+
+	pr_debug("In %s, id %d, gw: %016llx\n", __func__, idx, rt->nh.gw);
+	sw_w32(rt->nh.gw >> 32, rtl_table_data(r, 0));
+	sw_w32(rt->nh.gw, rtl_table_data(r, 1));
+	rtl_table_write(r, idx);
+
+	rtl_table_release(r);
+}
+
+static int rtl838x_l3_setup(struct rtl838x_switch_priv *priv)
+{
+	/* Nothing to be done */
+	return 0;
+}
+
+void rtl838x_vlan_port_keep_tag_set(int port, bool keep_outer, bool keep_inner)
+{
+	sw_w32(FIELD_PREP(RTL838X_VLAN_PORT_TAG_STS_CTRL_OTAG_STS_MASK,
+			  keep_outer ? RTL838X_VLAN_PORT_TAG_STS_TAGGED : RTL838X_VLAN_PORT_TAG_STS_UNTAG) |
+	       FIELD_PREP(RTL838X_VLAN_PORT_TAG_STS_CTRL_ITAG_STS_MASK,
+			  keep_inner ? RTL838X_VLAN_PORT_TAG_STS_TAGGED : RTL838X_VLAN_PORT_TAG_STS_UNTAG),
+	       RTL838X_VLAN_PORT_TAG_STS_CTRL(port));
+}
+
+void rtl838x_vlan_port_pvidmode_set(int port, enum pbvlan_type type, enum pbvlan_mode mode)
+{
+	if (type == PBVLAN_TYPE_INNER)
+		sw_w32_mask(0x3, mode, RTL838X_VLAN_PORT_PB_VLAN + (port << 2));
+	else
+		sw_w32_mask(0x3 << 14, mode << 14, RTL838X_VLAN_PORT_PB_VLAN + (port << 2));
+}
+
+void rtl838x_vlan_port_pvid_set(int port, enum pbvlan_type type, int pvid)
+{
+	if (type == PBVLAN_TYPE_INNER)
+		sw_w32_mask(0xfff << 2, pvid << 2, RTL838X_VLAN_PORT_PB_VLAN + (port << 2));
+	else
+		sw_w32_mask(0xfff << 16, pvid << 16, RTL838X_VLAN_PORT_PB_VLAN + (port << 2));
+}
+
+static int rtl838x_set_ageing_time(unsigned long msec)
+{
+	int t = sw_r32(RTL838X_L2_CTRL_1);
+
+	t &= 0x7FFFFF;
+	t = t * 128 / 625; /* Aging time in seconds. 0: L2 aging disabled */
+	pr_debug("L2 AGING time: %d sec\n", t);
+
+	t = (msec * 625 + 127000) / 128000;
+	t = t > 0x7FFFFF ? 0x7FFFFF : t;
+	sw_w32_mask(0x7FFFFF, t, RTL838X_L2_CTRL_1);
+	pr_debug("Dynamic aging for ports: %x\n", sw_r32(RTL838X_L2_PORT_AGING_OUT));
+
+	return 0;
+}
+
+static void rtl838x_set_igr_filter(int port, enum igr_filter state)
+{
+	sw_w32_mask(0x3 << ((port & 0xf)<<1), state << ((port & 0xf)<<1),
+		    RTL838X_VLAN_PORT_IGR_FLTR + (((port >> 4) << 2)));
+}
+
+static void rtl838x_set_egr_filter(int port, enum egr_filter state)
+{
+	sw_w32_mask(0x1 << (port % 0x1d), state << (port % 0x1d),
+		    RTL838X_VLAN_PORT_EGR_FLTR + (((port / 29) << 2)));
+}
+
+void rtl838x_set_distribution_algorithm(int group, int algoidx, u32 algomsk)
+{
+	algoidx &= 1; /* RTL838X only supports 2 concurrent algorithms */
+	sw_w32_mask(1 << (group % 8), algoidx << (group % 8),
+		    RTL838X_TRK_HASH_IDX_CTRL + ((group >> 3) << 2));
+	sw_w32(algomsk, RTL838X_TRK_HASH_CTRL + (algoidx << 2));
+}
+
+void rtl838x_set_receive_management_action(int port, rma_ctrl_t type, action_type_t action)
+{
+	switch(type) {
+	case BPDU:
+		sw_w32_mask(3 << ((port & 0xf) << 1), (action & 0x3) << ((port & 0xf) << 1),
+			    RTL838X_RMA_BPDU_CTRL + ((port >> 4) << 2));
+		break;
+	case PTP:
+		sw_w32_mask(3 << ((port & 0xf) << 1), (action & 0x3) << ((port & 0xf) << 1),
+			    RTL838X_RMA_PTP_CTRL + ((port >> 4) << 2));
+		break;
+	case LLTP:
+		sw_w32_mask(3 << ((port & 0xf) << 1), (action & 0x3) << ((port & 0xf) << 1),
+			    RTL838X_RMA_LLTP_CTRL + ((port >> 4) << 2));
+		break;
+	default:
+		break;
+	}
+}
+
+const struct rtl838x_reg rtl838x_reg = {
+	.mask_port_reg_be = rtl838x_mask_port_reg,
+	.set_port_reg_be = rtl838x_set_port_reg,
+	.get_port_reg_be = rtl838x_get_port_reg,
+	.mask_port_reg_le = rtl838x_mask_port_reg,
+	.set_port_reg_le = rtl838x_set_port_reg,
+	.get_port_reg_le = rtl838x_get_port_reg,
+	.stat_port_rst = RTL838X_STAT_PORT_RST,
+	.stat_rst = RTL838X_STAT_RST,
+	.stat_port_std_mib = RTL838X_STAT_PORT_STD_MIB,
+	.port_iso_ctrl = rtl838x_port_iso_ctrl,
+	.traffic_enable = rtl838x_traffic_enable,
+	.traffic_disable = rtl838x_traffic_disable,
+	.traffic_get = rtl838x_traffic_get,
+	.traffic_set = rtl838x_traffic_set,
+	.l2_ctrl_0 = RTL838X_L2_CTRL_0,
+	.l2_ctrl_1 = RTL838X_L2_CTRL_1,
+	.l2_port_aging_out = RTL838X_L2_PORT_AGING_OUT,
+	.set_ageing_time = rtl838x_set_ageing_time,
+	.smi_poll_ctrl = RTL838X_SMI_POLL_CTRL,
+	.l2_tbl_flush_ctrl = RTL838X_L2_TBL_FLUSH_CTRL,
+	.exec_tbl0_cmd = rtl838x_exec_tbl0_cmd,
+	.exec_tbl1_cmd = rtl838x_exec_tbl1_cmd,
+	.tbl_access_data_0 = rtl838x_tbl_access_data_0,
+	.isr_glb_src = RTL838X_ISR_GLB_SRC,
+	.isr_port_link_sts_chg = RTL838X_ISR_PORT_LINK_STS_CHG,
+	.imr_port_link_sts_chg = RTL838X_IMR_PORT_LINK_STS_CHG,
+	.imr_glb = RTL838X_IMR_GLB,
+	.vlan_tables_read = rtl838x_vlan_tables_read,
+	.vlan_set_tagged = rtl838x_vlan_set_tagged,
+	.vlan_set_untagged = rtl838x_vlan_set_untagged,
+	.mac_force_mode_ctrl = rtl838x_mac_force_mode_ctrl,
+	.vlan_profile_dump = rtl838x_vlan_profile_dump,
+	.vlan_profile_setup = rtl838x_vlan_profile_setup,
+	.vlan_fwd_on_inner = rtl838x_vlan_fwd_on_inner,
+	.set_vlan_igr_filter = rtl838x_set_igr_filter,
+	.set_vlan_egr_filter = rtl838x_set_egr_filter,
+	.enable_learning = rtl838x_enable_learning,
+	.enable_flood = rtl838x_enable_flood,
+	.enable_mcast_flood = rtl838x_enable_mcast_flood,
+	.enable_bcast_flood = rtl838x_enable_bcast_flood,
+	.set_static_move_action = rtl838x_set_static_move_action,
+	.stp_get = rtl838x_stp_get,
+	.stp_set = rtl838x_stp_set,
+	.mac_port_ctrl = rtl838x_mac_port_ctrl,
+	.l2_port_new_salrn = rtl838x_l2_port_new_salrn,
+	.l2_port_new_sa_fwd = rtl838x_l2_port_new_sa_fwd,
+	.mir_ctrl = RTL838X_MIR_CTRL,
+	.mir_dpm = RTL838X_MIR_DPM_CTRL,
+	.mir_spm = RTL838X_MIR_SPM_CTRL,
+	.mac_link_sts = RTL838X_MAC_LINK_STS,
+	.mac_link_dup_sts = RTL838X_MAC_LINK_DUP_STS,
+	.mac_link_spd_sts = rtl838x_mac_link_spd_sts,
+	.mac_rx_pause_sts = RTL838X_MAC_RX_PAUSE_STS,
+	.mac_tx_pause_sts = RTL838X_MAC_TX_PAUSE_STS,
+	.read_l2_entry_using_hash = rtl838x_read_l2_entry_using_hash,
+	.write_l2_entry_using_hash = rtl838x_write_l2_entry_using_hash,
+	.read_cam = rtl838x_read_cam,
+	.write_cam = rtl838x_write_cam,
+	.vlan_port_keep_tag_set = rtl838x_vlan_port_keep_tag_set,
+	.vlan_port_pvidmode_set = rtl838x_vlan_port_pvidmode_set,
+	.vlan_port_pvid_set = rtl838x_vlan_port_pvid_set,
+	.trk_mbr_ctr = rtl838x_trk_mbr_ctr,
+	.rma_bpdu_fld_pmask = RTL838X_RMA_BPDU_FLD_PMSK,
+	.spcl_trap_eapol_ctrl = RTL838X_SPCL_TRAP_EAPOL_CTRL,
+	.init_eee = rtl838x_init_eee,
+	.port_eee_set = rtl838x_port_eee_set,
+	.eee_port_ability = rtl838x_eee_port_ability,
+	.l2_hash_seed = rtl838x_l2_hash_seed,
+	.l2_hash_key = rtl838x_l2_hash_key,
+	.read_mcast_pmask = rtl838x_read_mcast_pmask,
+	.write_mcast_pmask = rtl838x_write_mcast_pmask,
+	.pie_init = rtl838x_pie_init,
+	.pie_rule_read = rtl838x_pie_rule_read,
+	.pie_rule_write = rtl838x_pie_rule_write,
+	.pie_rule_add = rtl838x_pie_rule_add,
+	.pie_rule_rm = rtl838x_pie_rule_rm,
+	.l2_learning_setup = rtl838x_l2_learning_setup,
+	.packet_cntr_read = rtl838x_packet_cntr_read,
+	.packet_cntr_clear = rtl838x_packet_cntr_clear,
+	.route_read = rtl838x_route_read,
+	.route_write = rtl838x_route_write,
+	.l3_setup = rtl838x_l3_setup,
+	.set_distribution_algorithm = rtl838x_set_distribution_algorithm,
+	.set_receive_management_action = rtl838x_set_receive_management_action,
+};
+
+irqreturn_t rtl838x_switch_irq(int irq, void *dev_id)
+{
+	struct dsa_switch *ds = dev_id;
+	u32 status = sw_r32(RTL838X_ISR_GLB_SRC);
+	u32 ports = sw_r32(RTL838X_ISR_PORT_LINK_STS_CHG);
+	u32 link;
+
+	/* Clear status */
+	sw_w32(ports, RTL838X_ISR_PORT_LINK_STS_CHG);
+	pr_info("RTL8380 Link change: status: %x, ports %x\n", status, ports);
+
+	for (int i = 0; i < 28; i++) {
+		if (ports & BIT(i)) {
+			link = sw_r32(RTL838X_MAC_LINK_STS);
+			if (link & BIT(i))
+				dsa_port_phylink_mac_change(ds, i, true);
+			else
+				dsa_port_phylink_mac_change(ds, i, false);
+		}
+	}
+
+	return IRQ_HANDLED;
+}
+
+int rtl838x_smi_wait_op(int timeout)
+{
+	int ret = 0;
+	u32 val;
+
+	ret = readx_poll_timeout(sw_r32, RTL838X_SMI_ACCESS_PHY_CTRL_1,
+				 val, !(val & 0x1), 20, timeout);
+	if (ret)
+		pr_err("%s: timeout\n", __func__);
+
+	return ret;
+}
+
+/* Reads a register in a page from the PHY */
+int rtl838x_read_phy(u32 port, u32 page, u32 reg, u32 *val)
+{
+	int err;
+	u32 v;
+	u32 park_page;
+
+	if (port > 31) {
+		*val = 0xffff;
+		return 0;
+	}
+
+	if (page > 4095 || reg > 31)
+		return -ENOTSUPP;
+
+	mutex_lock(&smi_lock);
+
+	err = rtl838x_smi_wait_op(100000);
+	if (err)
+		goto errout;
+
+	sw_w32_mask(0xffff0000, port << 16, RTL838X_SMI_ACCESS_PHY_CTRL_2);
+
+	park_page = sw_r32(RTL838X_SMI_ACCESS_PHY_CTRL_1) & ((0x1f << 15) | 0x2);
+	v = reg << 20 | page << 3;
+	sw_w32(v | park_page, RTL838X_SMI_ACCESS_PHY_CTRL_1);
+	sw_w32_mask(0, 1, RTL838X_SMI_ACCESS_PHY_CTRL_1);
+
+	err = rtl838x_smi_wait_op(100000);
+	if (err)
+		goto errout;
+
+	*val = sw_r32(RTL838X_SMI_ACCESS_PHY_CTRL_2) & 0xffff;
+
+	err = 0;
+
+errout:
+	mutex_unlock(&smi_lock);
+
+	return err;
+}
+
+/* Write to a register in a page of the PHY */
+int rtl838x_write_phy(u32 port, u32 page, u32 reg, u32 val)
+{
+	int err;
+	u32 v;
+	u32 park_page;
+
+	val &= 0xffff;
+	if (port > 31 || page > 4095 || reg > 31)
+		return -ENOTSUPP;
+
+	mutex_lock(&smi_lock);
+	err = rtl838x_smi_wait_op(100000);
+	if (err)
+		goto errout;
+
+	sw_w32(BIT(port), RTL838X_SMI_ACCESS_PHY_CTRL_0);
+	mdelay(10);
+
+	sw_w32_mask(0xffff0000, val << 16, RTL838X_SMI_ACCESS_PHY_CTRL_2);
+
+	park_page = sw_r32(RTL838X_SMI_ACCESS_PHY_CTRL_1) & ((0x1f << 15) | 0x2);
+	v = reg << 20 | page << 3 | 0x4;
+	sw_w32(v | park_page, RTL838X_SMI_ACCESS_PHY_CTRL_1);
+	sw_w32_mask(0, 1, RTL838X_SMI_ACCESS_PHY_CTRL_1);
+
+	err = rtl838x_smi_wait_op(100000);
+	if (err)
+		goto errout;
+
+	err = 0;
+
+errout:
+	mutex_unlock(&smi_lock);
+
+	return err;
+}
+
+/* Read an mmd register of a PHY */
+int rtl838x_read_mmd_phy(u32 port, u32 addr, u32 reg, u32 *val)
+{
+	int err;
+	u32 v;
+
+	mutex_lock(&smi_lock);
+
+	err = rtl838x_smi_wait_op(100000);
+	if (err)
+		goto errout;
+
+	sw_w32(1 << port, RTL838X_SMI_ACCESS_PHY_CTRL_0);
+	mdelay(10);
+
+	sw_w32_mask(0xffff0000, port << 16, RTL838X_SMI_ACCESS_PHY_CTRL_2);
+
+	v = addr << 16 | reg;
+	sw_w32(v, RTL838X_SMI_ACCESS_PHY_CTRL_3);
+
+	/* mmd-access | read | cmd-start */
+	v = 1 << 1 | 0 << 2 | 1;
+	sw_w32(v, RTL838X_SMI_ACCESS_PHY_CTRL_1);
+
+	err = rtl838x_smi_wait_op(100000);
+	if (err)
+		goto errout;
+
+	*val = sw_r32(RTL838X_SMI_ACCESS_PHY_CTRL_2) & 0xffff;
+
+	err = 0;
+
+errout:
+	mutex_unlock(&smi_lock);
+
+	return err;
+}
+
+/* Write to an mmd register of a PHY */
+int rtl838x_write_mmd_phy(u32 port, u32 addr, u32 reg, u32 val)
+{
+	int err;
+	u32 v;
+
+	pr_debug("MMD write: port %d, dev %d, reg %d, val %x\n", port, addr, reg, val);
+	val &= 0xffff;
+	mutex_lock(&smi_lock);
+
+	err = rtl838x_smi_wait_op(100000);
+	if (err)
+		goto errout;
+
+	sw_w32(1 << port, RTL838X_SMI_ACCESS_PHY_CTRL_0);
+	mdelay(10);
+
+	sw_w32_mask(0xffff0000, val << 16, RTL838X_SMI_ACCESS_PHY_CTRL_2);
+
+	sw_w32_mask(0x1f << 16, addr << 16, RTL838X_SMI_ACCESS_PHY_CTRL_3);
+	sw_w32_mask(0xffff, reg, RTL838X_SMI_ACCESS_PHY_CTRL_3);
+	/* mmd-access | write | cmd-start */
+	v = 1 << 1 | 1 << 2 | 1;
+	sw_w32(v, RTL838X_SMI_ACCESS_PHY_CTRL_1);
+
+	err = rtl838x_smi_wait_op(100000);
+	if (err)
+		goto errout;
+
+	err = 0;
+
+errout:
+	mutex_unlock(&smi_lock);
+	return err;
+}
+
+void rtl8380_get_version(struct rtl838x_switch_priv *priv)
+{
+	u32 rw_save, info_save;
+	u32 info;
+
+	rw_save = sw_r32(RTL838X_INT_RW_CTRL);
+	sw_w32(rw_save | 0x3, RTL838X_INT_RW_CTRL);
+
+	info_save = sw_r32(RTL838X_CHIP_INFO);
+	sw_w32(info_save | 0xA0000000, RTL838X_CHIP_INFO);
+
+	info = sw_r32(RTL838X_CHIP_INFO);
+	sw_w32(info_save, RTL838X_CHIP_INFO);
+	sw_w32(rw_save, RTL838X_INT_RW_CTRL);
+
+	if ((info & 0xFFFF) == 0x6275) {
+		if (((info >> 16) & 0x1F) == 0x1)
+			priv->version = RTL8380_VERSION_A;
+		else if (((info >> 16) & 0x1F) == 0x2)
+			priv->version = RTL8380_VERSION_B;
+		else
+			priv->version = RTL8380_VERSION_B;
+	} else {
+		priv->version = '-';
+	}
+}
+
+void rtl838x_vlan_profile_dump(int profile)
+{
+	u32 p;
+
+	if (profile < 0 || profile > 7)
+		return;
+
+	p = sw_r32(RTL838X_VLAN_PROFILE(profile));
+
+	pr_info("VLAN profile %d: L2 learning: %d, UNKN L2MC FLD PMSK %d, \
+		UNKN IPMC FLD PMSK %d, UNKN IPv6MC FLD PMSK: %d",
+		profile, p & 1, (p >> 1) & 0x1ff, (p >> 10) & 0x1ff, (p >> 19) & 0x1ff);
+}
+
+void rtl8380_sds_rst(int mac)
+{
+	u32 offset = (mac == 24) ? 0 : 0x100;
+
+	sw_w32_mask(1 << 11, 0, RTL838X_SDS4_FIB_REG0 + offset);
+	sw_w32_mask(0x3, 0, RTL838X_SDS4_REG28 + offset);
+	sw_w32_mask(0x3, 0x3, RTL838X_SDS4_REG28 + offset);
+	sw_w32_mask(0, 0x1 << 6, RTL838X_SDS4_DUMMY0 + offset);
+	sw_w32_mask(0x1 << 6, 0, RTL838X_SDS4_DUMMY0 + offset);
+	pr_debug("SERDES reset: %d\n", mac);
+}
+
+int rtl8380_sds_power(int mac, int val)
+{
+	u32 mode = (val == 1) ? 0x4 : 0x9;
+	u32 offset = (mac == 24) ? 5 : 0;
+
+	if ((mac != 24) && (mac != 26)) {
+		pr_err("%s: not a fibre port: %d\n", __func__, mac);
+		return -1;
+	}
+
+	sw_w32_mask(0x1f << offset, mode << offset, RTL838X_SDS_MODE_SEL);
+
+	rtl8380_sds_rst(mac);
+
+	return 0;
+}
diff --git a/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/rtl838x.h b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/rtl838x.h
new file mode 100644
index 00000000000000..24d18d61fafde3
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/rtl838x.h
@@ -0,0 +1,1102 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#ifndef _RTL838X_H
+#define _RTL838X_H
+
+#include <net/dsa.h>
+
+/* Register definition */
+#define RTL838X_MAC_PORT_CTRL(port)		(0xd560 + (((port) << 7)))
+#define RTL839X_MAC_PORT_CTRL(port)		(0x8004 + (((port) << 7)))
+#define RTL930X_MAC_PORT_CTRL(port)		(0x3260 + (((port) << 6)))
+#define RTL931X_MAC_PORT_CTRL			(0x6004)
+
+#define RTL930X_MAC_L2_PORT_CTRL(port)		(0x3268 + (((port) << 6)))
+#define RTL931X_MAC_L2_PORT_CTRL		(0x6000)
+
+#define RTL838X_RST_GLB_CTRL_0			(0x003c)
+
+#define RTL838X_MAC_FORCE_MODE_CTRL		(0xa104)
+#define RTL839X_MAC_FORCE_MODE_CTRL		(0x02bc)
+#define RTL930X_MAC_FORCE_MODE_CTRL		(0xCA1C)
+#define RTL931X_MAC_FORCE_MODE_CTRL		(0x0DCC)
+
+#define RTL838X_DMY_REG31			(0x3b28)
+#define RTL838X_SDS_MODE_SEL			(0x0028)
+#define RTL838X_SDS_CFG_REG			(0x0034)
+#define RTL838X_INT_MODE_CTRL			(0x005c)
+#define RTL838X_CHIP_INFO			(0x00d8)
+#define RTL839X_CHIP_INFO			(0x0ff4)
+#define RTL838X_PORT_ISO_CTRL(port)		(0x4100 + ((port) << 2))
+#define RTL839X_PORT_ISO_CTRL(port)		(0x1400 + ((port) << 3))
+
+/* Packet statistics */
+#define RTL838X_STAT_PORT_STD_MIB		(0x1200)
+#define RTL839X_STAT_PORT_STD_MIB		(0xC000)
+#define RTL930X_STAT_PORT_MIB_CNTR		(0x0664)
+#define RTL838X_STAT_RST			(0x3100)
+#define RTL839X_STAT_RST			(0xF504)
+#define RTL930X_STAT_RST			(0x3240)
+#define RTL931X_STAT_RST			(0x7ef4)
+#define RTL838X_STAT_PORT_RST			(0x3104)
+#define RTL839X_STAT_PORT_RST			(0xF508)
+#define RTL930X_STAT_PORT_RST			(0x3244)
+#define RTL931X_STAT_PORT_RST			(0x7ef8)
+#define RTL838X_STAT_CTRL			(0x3108)
+#define RTL839X_STAT_CTRL			(0x04cc)
+#define RTL930X_STAT_CTRL			(0x3248)
+#define RTL931X_STAT_CTRL			(0x5720)
+
+/* Registers of the internal Serdes of the 8390 */
+#define RTL8390_SDS0_1_XSG0			(0xA000)
+#define RTL8390_SDS0_1_XSG1			(0xA100)
+#define RTL839X_SDS12_13_XSG0			(0xB800)
+#define RTL839X_SDS12_13_XSG1			(0xB900)
+#define RTL839X_SDS12_13_PWR0			(0xb880)
+#define RTL839X_SDS12_13_PWR1			(0xb980)
+
+/* Registers of the internal Serdes of the 8380 */
+#define RTL838X_SDS4_FIB_REG0			(0xF800)
+#define RTL838X_SDS4_REG28			(0xef80)
+#define RTL838X_SDS4_DUMMY0			(0xef8c)
+#define RTL838X_SDS5_EXT_REG6			(0xf18c)
+
+/* VLAN registers */
+#define RTL838X_VLAN_CTRL			(0x3A74)
+#define RTL838X_VLAN_PROFILE(idx)		(0x3A88 + ((idx) << 2))
+#define RTL838X_VLAN_PORT_EGR_FLTR		(0x3A84)
+#define RTL838X_VLAN_PORT_PB_VLAN		(0x3C00)
+#define RTL838X_VLAN_PORT_IGR_FLTR		(0x3A7C)
+
+#define RTL839X_VLAN_PROFILE(idx)		(0x25C0 + (((idx) << 3)))
+#define RTL839X_VLAN_CTRL			(0x26D4)
+#define RTL839X_VLAN_PORT_PB_VLAN		(0x26D8)
+#define RTL839X_VLAN_PORT_IGR_FLTR		(0x27B4)
+#define RTL839X_VLAN_PORT_EGR_FLTR		(0x27C4)
+
+#define RTL930X_VLAN_PROFILE_SET(idx)		(0x9c60 + (((idx) * 20)))
+#define RTL930X_VLAN_CTRL			(0x82D4)
+#define RTL930X_VLAN_PORT_PB_VLAN		(0x82D8)
+#define RTL930X_VLAN_PORT_IGR_FLTR		(0x83C0)
+#define RTL930X_VLAN_PORT_EGR_FLTR		(0x83C8)
+
+#define RTL931X_VLAN_PROFILE_SET(idx)		(0x9800 + (((idx) * 28)))
+#define RTL931X_VLAN_CTRL			(0x94E4)
+#define RTL931X_VLAN_PORT_IGR_CTRL		(0x94E8)
+#define RTL931X_VLAN_PORT_IGR_FLTR		(0x96B4)
+#define RTL931X_VLAN_PORT_EGR_FLTR		(0x96C4)
+
+/* Table access registers */
+#define RTL838X_TBL_ACCESS_CTRL_0		(0x6914)
+#define RTL838X_TBL_ACCESS_DATA_0(idx)		(0x6918 + ((idx) << 2))
+#define RTL838X_TBL_ACCESS_CTRL_1		(0xA4C8)
+#define RTL838X_TBL_ACCESS_DATA_1(idx)		(0xA4CC + ((idx) << 2))
+
+#define RTL839X_TBL_ACCESS_CTRL_0		(0x1190)
+#define RTL839X_TBL_ACCESS_DATA_0(idx)		(0x1194 + ((idx) << 2))
+#define RTL839X_TBL_ACCESS_CTRL_1		(0x6b80)
+#define RTL839X_TBL_ACCESS_DATA_1(idx)		(0x6b84 + ((idx) << 2))
+#define RTL839X_TBL_ACCESS_CTRL_2		(0x611C)
+#define RTL839X_TBL_ACCESS_DATA_2(i)		(0x6120 + (((i) << 2)))
+
+#define RTL930X_TBL_ACCESS_CTRL_0		(0xB340)
+#define RTL930X_TBL_ACCESS_DATA_0(idx)		(0xB344 + ((idx) << 2))
+#define RTL930X_TBL_ACCESS_CTRL_1		(0xB3A0)
+#define RTL930X_TBL_ACCESS_DATA_1(idx)		(0xB3A4 + ((idx) << 2))
+#define RTL930X_TBL_ACCESS_CTRL_2		(0xCE04)
+#define RTL930X_TBL_ACCESS_DATA_2(i)		(0xCE08 + (((i) << 2)))
+
+#define RTL931X_TBL_ACCESS_CTRL_0		(0x8500)
+#define RTL931X_TBL_ACCESS_DATA_0(idx)		(0x8508 + ((idx) << 2))
+#define RTL931X_TBL_ACCESS_CTRL_1		(0x40C0)
+#define RTL931X_TBL_ACCESS_DATA_1(idx)		(0x40C4 + ((idx) << 2))
+#define RTL931X_TBL_ACCESS_CTRL_2		(0x8528)
+#define RTL931X_TBL_ACCESS_DATA_2(i)		(0x852C + (((i) << 2)))
+#define RTL931X_TBL_ACCESS_CTRL_3		(0x0200)
+#define RTL931X_TBL_ACCESS_DATA_3(i)		(0x0204 + (((i) << 2)))
+#define RTL931X_TBL_ACCESS_CTRL_4		(0x20DC)
+#define RTL931X_TBL_ACCESS_DATA_4(i)		(0x20E0 + (((i) << 2)))
+#define RTL931X_TBL_ACCESS_CTRL_5		(0x7E1C)
+#define RTL931X_TBL_ACCESS_DATA_5(i)		(0x7E20 + (((i) << 2)))
+
+/* MAC handling */
+#define RTL838X_MAC_LINK_STS			(0xa188)
+#define RTL839X_MAC_LINK_STS			(0x0390)
+#define RTL930X_MAC_LINK_STS			(0xCB10)
+#define RTL931X_MAC_LINK_STS			(0x0EC0)
+#define RTL838X_MAC_LINK_SPD_STS(p)		(0xa190 + (((p >> 4) << 2)))
+#define RTL839X_MAC_LINK_SPD_STS(p)		(0x03a0 + (((p >> 4) << 2)))
+#define RTL930X_MAC_LINK_SPD_STS(p)		(0xCB18 + (((p >> 3) << 2)))
+#define RTL931X_MAC_LINK_SPD_STS		(0x0ED0)
+#define RTL838X_MAC_LINK_DUP_STS		(0xa19c)
+#define RTL839X_MAC_LINK_DUP_STS		(0x03b0)
+#define RTL930X_MAC_LINK_DUP_STS		(0xCB28)
+#define RTL931X_MAC_LINK_DUP_STS		(0x0EF0)
+#define RTL838X_MAC_TX_PAUSE_STS		(0xa1a0)
+#define RTL839X_MAC_TX_PAUSE_STS		(0x03b8)
+#define RTL930X_MAC_TX_PAUSE_STS		(0xCB2C)
+#define RTL931X_MAC_TX_PAUSE_STS		(0x0EF8)
+#define RTL838X_MAC_RX_PAUSE_STS		(0xa1a4)
+#define RTL839X_MAC_RX_PAUSE_STS		(0x03c0)
+#define RTL930X_MAC_RX_PAUSE_STS		(0xCB30)
+#define RTL931X_MAC_RX_PAUSE_STS		(0x0F00)
+#define RTL930X_MAC_LINK_MEDIA_STS		(0xCB14)
+#define RTL931X_MAC_LINK_MEDIA_STS		(0x0EC8)
+
+/* MAC link state bits */
+#define RTL838X_FORCE_EN			(1 << 0)
+#define RTL838X_FORCE_LINK_EN			(1 << 1)
+#define RTL838X_NWAY_EN				(1 << 2)
+#define RTL838X_DUPLEX_MODE			(1 << 3)
+#define RTL838X_TX_PAUSE_EN			(1 << 6)
+#define RTL838X_RX_PAUSE_EN			(1 << 7)
+#define RTL838X_MAC_FORCE_FC_EN			(1 << 8)
+
+#define RTL839X_FORCE_EN			(1 << 0)
+#define RTL839X_FORCE_LINK_EN			(1 << 1)
+#define RTL839X_DUPLEX_MODE			(1 << 2)
+#define RTL839X_TX_PAUSE_EN			(1 << 5)
+#define RTL839X_RX_PAUSE_EN			(1 << 6)
+#define RTL839X_MAC_FORCE_FC_EN			(1 << 7)
+
+#define RTL930X_FORCE_EN			(1 << 0)
+#define RTL930X_FORCE_LINK_EN			(1 << 1)
+#define RTL930X_DUPLEX_MODE			(1 << 2)
+#define RTL930X_TX_PAUSE_EN			(1 << 7)
+#define RTL930X_RX_PAUSE_EN			(1 << 8)
+#define RTL930X_MAC_FORCE_FC_EN			(1 << 9)
+
+#define RTL931X_FORCE_EN			(1 << 9)
+#define RTL931X_FORCE_LINK_EN			(1 << 0)
+#define RTL931X_DUPLEX_MODE			(1 << 2)
+#define RTL931X_MAC_FORCE_FC_EN			(1 << 4)
+#define RTL931X_TX_PAUSE_EN			(1 << 16)
+#define RTL931X_RX_PAUSE_EN			(1 << 17)
+
+/* EEE */
+#define RTL838X_MAC_EEE_ABLTY			(0xa1a8)
+#define RTL838X_EEE_PORT_TX_EN			(0x014c)
+#define RTL838X_EEE_PORT_RX_EN			(0x0150)
+#define RTL838X_EEE_CLK_STOP_CTRL		(0x0148)
+#define RTL838X_EEE_TX_TIMER_GIGA_CTRL		(0xaa04)
+#define RTL838X_EEE_TX_TIMER_GELITE_CTRL	(0xaa08)
+
+#define RTL839X_EEE_TX_TIMER_GELITE_CTRL	(0x042C)
+#define RTL839X_EEE_TX_TIMER_GIGA_CTRL		(0x0430)
+#define RTL839X_EEE_TX_TIMER_10G_CTRL		(0x0434)
+#define RTL839X_EEE_CTRL(p)			(0x8008 + ((p) << 7))
+#define RTL839X_MAC_EEE_ABLTY			(0x03C8)
+
+#define RTL930X_MAC_EEE_ABLTY			(0xCB34)
+#define RTL930X_EEE_CTRL(p)			(0x3274 + ((p) << 6))
+#define RTL930X_EEEP_PORT_CTRL(p)		(0x3278 + ((p) << 6))
+
+/* L2 functionality */
+#define RTL838X_L2_CTRL_0			(0x3200)
+#define RTL839X_L2_CTRL_0			(0x3800)
+#define RTL930X_L2_CTRL				(0x8FD8)
+#define RTL931X_L2_CTRL				(0xC800)
+#define RTL838X_L2_CTRL_1			(0x3204)
+#define RTL839X_L2_CTRL_1			(0x3804)
+#define RTL930X_L2_AGE_CTRL			(0x8FDC)
+#define RTL931X_L2_AGE_CTRL			(0xC804)
+#define RTL838X_L2_PORT_AGING_OUT		(0x3358)
+#define RTL839X_L2_PORT_AGING_OUT		(0x3b74)
+#define	RTL930X_L2_PORT_AGE_CTRL		(0x8FE0)
+#define	RTL931X_L2_PORT_AGE_CTRL		(0xc808)
+#define RTL838X_TBL_ACCESS_L2_CTRL		(0x6900)
+#define RTL839X_TBL_ACCESS_L2_CTRL		(0x1180)
+#define RTL930X_TBL_ACCESS_L2_CTRL		(0xB320)
+#define RTL930X_TBL_ACCESS_L2_METHOD_CTRL	(0xB324)
+#define RTL838X_TBL_ACCESS_L2_DATA(idx)		(0x6908 + ((idx) << 2))
+#define RTL839X_TBL_ACCESS_L2_DATA(idx)		(0x1184 + ((idx) << 2))
+#define RTL930X_TBL_ACCESS_L2_DATA(idx)		(0xab08 + ((idx) << 2))
+
+#define RTL838X_L2_TBL_FLUSH_CTRL		(0x3370)
+#define RTL839X_L2_TBL_FLUSH_CTRL		(0x3ba0)
+#define RTL930X_L2_TBL_FLUSH_CTRL		(0x9404)
+#define RTL931X_L2_TBL_FLUSH_CTRL		(0xCD9C)
+
+#define RTL838X_L2_LRN_CONSTRT			(0x329C)
+#define RTL839X_L2_LRN_CONSTRT			(0x3910)
+#define RTL930X_L2_LRN_CONSTRT_CTRL		(0x909c)
+#define RTL931X_L2_LRN_CONSTRT_CTRL		(0xC964)
+
+#define RTL838X_L2_FLD_PMSK			(0x3288)
+#define RTL839X_L2_FLD_PMSK			(0x38EC)
+#define RTL930X_L2_BC_FLD_PMSK			(0x9068)
+#define RTL931X_L2_BC_FLD_PMSK			(0xC8FC)
+
+#define RTL930X_L2_UNKN_UC_FLD_PMSK		(0x9064)
+#define RTL931X_L2_UNKN_UC_FLD_PMSK		(0xC8F4)
+
+#define RTL838X_L2_LRN_CONSTRT_EN		(0x3368)
+#define RTL838X_L2_PORT_LRN_CONSTRT		(0x32A0)
+#define RTL839X_L2_PORT_LRN_CONSTRT		(0x3914)
+
+#define RTL838X_L2_PORT_NEW_SALRN(p)		(0x328c + (((p >> 4) << 2)))
+#define RTL839X_L2_PORT_NEW_SALRN(p)		(0x38F0 + (((p >> 4) << 2)))
+#define RTL930X_L2_PORT_SALRN(p)		(0x8FEC + (((p >> 4) << 2)))
+#define RTL931X_L2_PORT_NEW_SALRN(p)		(0xC820 + (((p >> 4) << 2)))
+
+#define SALRN_PORT_SHIFT(p)			((p % 16) * 2)
+#define SALRN_MODE_MASK				0x3
+#define SALRN_MODE_HARDWARE			0
+#define SALRN_MODE_DISABLED			2
+
+#define RTL838X_L2_PORT_NEW_SA_FWD(p)		(0x3294 + (((p >> 4) << 2)))
+#define RTL839X_L2_PORT_NEW_SA_FWD(p)		(0x3900 + (((p >> 4) << 2)))
+#define RTL930X_L2_PORT_NEW_SA_FWD(p)		(0x8FF4 + (((p / 10) << 2)))
+#define RTL931X_L2_PORT_NEW_SA_FWD(p)		(0xC830 + (((p / 10) << 2)))
+
+#define RTL838X_L2_PORT_MV_ACT(p)		(0x335c + (((p >> 4) << 2)))
+#define RTL839X_L2_PORT_MV_ACT(p)		(0x3b80 + (((p >> 4) << 2)))
+
+#define RTL838X_L2_PORT_STATIC_MV_ACT(p)	(0x327c + (((p >> 4) << 2)))
+#define RTL839X_L2_PORT_STATIC_MV_ACT(p)	(0x38dc + (((p >> 4) << 2)))
+
+#define MV_ACT_PORT_SHIFT(p)			((p % 16) * 2)
+#define MV_ACT_MASK				0x3
+#define MV_ACT_FORWARD				0
+#define MV_ACT_DROP				1
+#define MV_ACT_TRAP2CPU				2
+#define MV_ACT_COPY2CPU				3
+
+#define RTL930X_ST_CTRL				(0x8798)
+
+#define RTL930X_L2_PORT_SABLK_CTRL		(0x905c)
+#define RTL930X_L2_PORT_DABLK_CTRL		(0x9060)
+
+#define RTL838X_L2_PORT_LM_ACT(p)		(0x3208 + ((p) << 2))
+#define RTL838X_VLAN_PORT_FWD			(0x3A78)
+#define RTL839X_VLAN_PORT_FWD			(0x27AC)
+#define RTL930X_VLAN_PORT_FWD			(0x834C)
+#define RTL931X_VLAN_PORT_FWD			(0x95CC)
+#define RTL838X_VLAN_FID_CTRL			(0x3aa8)
+
+/* Port Mirroring */
+#define RTL838X_MIR_CTRL			(0x5D00)
+#define RTL838X_MIR_DPM_CTRL			(0x5D20)
+#define RTL838X_MIR_SPM_CTRL			(0x5D10)
+
+#define RTL839X_MIR_CTRL			(0x2500)
+#define RTL839X_MIR_DPM_CTRL			(0x2530)
+#define RTL839X_MIR_SPM_CTRL			(0x2510)
+
+#define RTL930X_MIR_CTRL			(0xA2A0)
+#define RTL930X_MIR_DPM_CTRL			(0xA2C0)
+#define RTL930X_MIR_SPM_CTRL			(0xA2B0)
+
+#define RTL931X_MIR_CTRL			(0xAF00)
+#define RTL931X_MIR_DPM_CTRL			(0xAF30)
+#define RTL931X_MIR_SPM_CTRL			(0xAF10)
+
+/* Storm/rate control and scheduling */
+#define RTL838X_STORM_CTRL			(0x4700)
+#define RTL839X_STORM_CTRL			(0x1800)
+#define RTL838X_STORM_CTRL_LB_CTRL(p)		(0x4884 + (((p) << 2)))
+#define RTL838X_STORM_CTRL_BURST_PPS_0		(0x4874)
+#define RTL838X_STORM_CTRL_BURST_PPS_1		(0x4878)
+#define RTL838X_STORM_CTRL_BURST_0		(0x487c)
+#define RTL838X_STORM_CTRL_BURST_1		(0x4880)
+#define RTL839X_STORM_CTRL_LB_TICK_TKN_CTRL_0	(0x1804)
+#define RTL839X_STORM_CTRL_LB_TICK_TKN_CTRL_1	(0x1808)
+#define RTL838X_SCHED_CTRL			(0xB980)
+#define RTL839X_SCHED_CTRL			(0x60F4)
+#define RTL838X_SCHED_LB_TICK_TKN_CTRL_0	(0xAD58)
+#define RTL838X_SCHED_LB_TICK_TKN_CTRL_1	(0xAD5C)
+#define RTL839X_SCHED_LB_TICK_TKN_CTRL_0	(0x1804)
+#define RTL839X_SCHED_LB_TICK_TKN_CTRL_1	(0x1808)
+#define RTL839X_STORM_CTRL_SPCL_LB_TICK_TKN_CTRL (0x2000)
+#define RTL839X_IGR_BWCTRL_LB_TICK_TKN_CTRL_0	(0x1604)
+#define RTL839X_IGR_BWCTRL_LB_TICK_TKN_CTRL_1	(0x1608)
+#define RTL839X_SCHED_LB_TICK_TKN_CTRL		(0x60F8)
+#define RTL839X_SCHED_LB_TICK_TKN_PPS_CTRL	(0x6200)
+#define RTL838X_SCHED_LB_THR			(0xB984)
+#define RTL839X_SCHED_LB_THR			(0x60FC)
+#define RTL838X_SCHED_P_EGR_RATE_CTRL(p)	(0xC008 + (((p) << 7)))
+#define RTL838X_SCHED_Q_EGR_RATE_CTRL(p, q)	(0xC00C + (p << 7) + (((q) << 2)))
+#define RTL838X_STORM_CTRL_PORT_BC_EXCEED	(0x470C)
+#define RTL838X_STORM_CTRL_PORT_MC_EXCEED	(0x4710)
+#define RTL838X_STORM_CTRL_PORT_UC_EXCEED	(0x4714)
+#define RTL839X_STORM_CTRL_PORT_BC_EXCEED(p)	(0x180c + (((p >> 5) << 2)))
+#define RTL839X_STORM_CTRL_PORT_MC_EXCEED(p)	(0x1814 + (((p >> 5) << 2)))
+#define RTL839X_STORM_CTRL_PORT_UC_EXCEED(p)	(0x181c + (((p >> 5) << 2)))
+#define RTL838X_STORM_CTRL_PORT_UC(p)		(0x4718 + (((p) << 2)))
+#define RTL838X_STORM_CTRL_PORT_MC(p)		(0x478c + (((p) << 2)))
+#define RTL838X_STORM_CTRL_PORT_BC(p)		(0x4800 + (((p) << 2)))
+#define RTL839X_STORM_CTRL_PORT_UC_0(p)		(0x185C + (((p) << 3)))
+#define RTL839X_STORM_CTRL_PORT_UC_1(p)		(0x1860 + (((p) << 3)))
+#define RTL839X_STORM_CTRL_PORT_MC_0(p)		(0x19FC + (((p) << 3)))
+#define RTL839X_STORM_CTRL_PORT_MC_1(p)		(0x1a00 + (((p) << 3)))
+#define RTL839X_STORM_CTRL_PORT_BC_0(p)		(0x1B9C + (((p) << 3)))
+#define RTL839X_STORM_CTRL_PORT_BC_1(p)		(0x1BA0 + (((p) << 3)))
+#define RTL839X_TBL_ACCESS_CTRL_2		(0x611C)
+#define RTL839X_TBL_ACCESS_DATA_2(i)		(0x6120 + (((i) << 2)))
+#define RTL839X_IGR_BWCTRL_PORT_CTRL_10G_0(p)	(0x1618 + (((p) << 3)))
+#define RTL839X_IGR_BWCTRL_PORT_CTRL_10G_1(p)	(0x161C + (((p) << 3)))
+#define RTL839X_IGR_BWCTRL_PORT_CTRL_0(p)	(0x1640 + (((p) << 3)))
+#define RTL839X_IGR_BWCTRL_PORT_CTRL_1(p)	(0x1644 + (((p) << 3)))
+#define RTL839X_IGR_BWCTRL_CTRL_LB_THR		(0x1614)
+
+/* Link aggregation (Trunking) */
+#define TRUNK_DISTRIBUTION_ALGO_SPA_BIT         0x01
+#define TRUNK_DISTRIBUTION_ALGO_SMAC_BIT        0x02
+#define TRUNK_DISTRIBUTION_ALGO_DMAC_BIT        0x04
+#define TRUNK_DISTRIBUTION_ALGO_SIP_BIT         0x08
+#define TRUNK_DISTRIBUTION_ALGO_DIP_BIT         0x10
+#define TRUNK_DISTRIBUTION_ALGO_SRC_L4PORT_BIT  0x20
+#define TRUNK_DISTRIBUTION_ALGO_DST_L4PORT_BIT  0x40
+#define TRUNK_DISTRIBUTION_ALGO_MASKALL         0x7F
+
+#define TRUNK_DISTRIBUTION_ALGO_L2_SPA_BIT         0x01
+#define TRUNK_DISTRIBUTION_ALGO_L2_SMAC_BIT        0x02
+#define TRUNK_DISTRIBUTION_ALGO_L2_DMAC_BIT        0x04
+#define TRUNK_DISTRIBUTION_ALGO_L2_VLAN_BIT         0x08
+#define TRUNK_DISTRIBUTION_ALGO_L2_MASKALL         0xF
+
+#define TRUNK_DISTRIBUTION_ALGO_L3_SPA_BIT         0x01
+#define TRUNK_DISTRIBUTION_ALGO_L3_SMAC_BIT        0x02
+#define TRUNK_DISTRIBUTION_ALGO_L3_DMAC_BIT        0x04
+#define TRUNK_DISTRIBUTION_ALGO_L3_VLAN_BIT         0x08
+#define TRUNK_DISTRIBUTION_ALGO_L3_SIP_BIT         0x10
+#define TRUNK_DISTRIBUTION_ALGO_L3_DIP_BIT         0x20
+#define TRUNK_DISTRIBUTION_ALGO_L3_SRC_L4PORT_BIT  0x40
+#define TRUNK_DISTRIBUTION_ALGO_L3_DST_L4PORT_BIT  0x80
+#define TRUNK_DISTRIBUTION_ALGO_L3_PROTO_BIT  0x100
+#define TRUNK_DISTRIBUTION_ALGO_L3_FLOW_LABEL_BIT  0x200
+#define TRUNK_DISTRIBUTION_ALGO_L3_MASKALL         0x3FF
+
+#define RTL838X_TRK_MBR_CTR                     (0x3E00)
+#define RTL838X_TRK_HASH_IDX_CTRL               (0x3E20)
+#define RTL838X_TRK_HASH_CTRL                   (0x3E24)
+
+#define RTL839X_TRK_MBR_CTR                     (0x2200)
+#define RTL839X_TRK_HASH_IDX_CTRL               (0x2280)
+#define RTL839X_TRK_HASH_CTRL                   (0x2284)
+
+#define RTL930X_TRK_MBR_CTRL                    (0xA41C)
+#define RTL930X_TRK_HASH_CTRL                   (0x9F80)
+
+#define RTL931X_TRK_MBR_CTRL                    (0xB8D0)
+#define RTL931X_TRK_HASH_CTRL                   (0xBA70)
+
+/* Attack prevention */
+#define RTL838X_ATK_PRVNT_PORT_EN		(0x5B00)
+#define RTL838X_ATK_PRVNT_CTRL			(0x5B04)
+#define RTL838X_ATK_PRVNT_ACT			(0x5B08)
+#define RTL838X_ATK_PRVNT_STS			(0x5B1C)
+
+/* 802.1X */
+#define RTL838X_RMA_BPDU_FLD_PMSK		(0x4348)
+#define RTL930X_RMA_BPDU_FLD_PMSK		(0x9F18)
+#define RTL931X_RMA_BPDU_FLD_PMSK		(0x8950)
+#define RTL839X_RMA_BPDU_FLD_PMSK		(0x125C)
+
+#define RTL838X_SPCL_TRAP_CTRL			(0x6980)
+#define RTL838X_SPCL_TRAP_EAPOL_CTRL		(0x6988)
+#define RTL838X_SPCL_TRAP_ARP_CTRL		(0x698C)
+#define RTL838X_SPCL_TRAP_IGMP_CTRL		(0x6984)
+#define RTL838X_SPCL_TRAP_IPV6_CTRL		(0x6994)
+#define RTL838X_SPCL_TRAP_SWITCH_MAC_CTRL	(0x6998)
+
+#define RTL839X_SPCL_TRAP_CTRL			(0x1054)
+#define RTL839X_SPCL_TRAP_EAPOL_CTRL		(0x105C)
+#define RTL839X_SPCL_TRAP_ARP_CTRL		(0x1060)
+#define RTL839X_SPCL_TRAP_IGMP_CTRL		(0x1058)
+#define RTL839X_SPCL_TRAP_IPV6_CTRL		(0x1064)
+#define RTL839X_SPCL_TRAP_SWITCH_MAC_CTRL	(0x1068)
+#define RTL839X_SPCL_TRAP_SWITCH_IPV4_ADDR_CTRL	(0x106C)
+#define RTL839X_SPCL_TRAP_CRC_CTRL		(0x1070)
+/* special port action controls */
+/* values:
+ *      0 = FORWARD (default)
+ *      1 = DROP
+ *      2 = TRAP2CPU
+ *      3 = FLOOD IN ALL PORT
+ *
+ *      Register encoding.
+ *      offset = CTRL + (port >> 4) << 2
+ *      value/mask = 3 << ((port & 0xF) << 1)
+ */
+
+typedef enum {
+	BPDU = 0,
+	PTP,
+	PTP_UDP,
+	PTP_ETH2,
+	LLTP,
+	EAPOL,
+	GRATARP,
+} rma_ctrl_t;
+
+typedef enum {
+	FORWARD = 0,
+	DROP,
+	TRAP2CPU,
+	FLOODALL,
+	TRAP2MASTERCPU,
+	COPY2CPU,
+} action_type_t;
+
+#define RTL838X_RMA_BPDU_CTRL			(0x4330)
+#define RTL839X_RMA_BPDU_CTRL			(0x122C)
+#define RTL930X_RMA_BPDU_CTRL			(0x9E7C)
+#define RTL931X_RMA_BPDU_CTRL			(0x881C)
+
+#define RTL838X_RMA_PTP_CTRL			(0x4338)
+#define RTL839X_RMA_PTP_CTRL			(0x123C)
+#define RTL930X_RMA_PTP_CTRL			(0x9E88)
+#define RTL931X_RMA_PTP_CTRL			(0x8834)
+
+#define RTL838X_RMA_LLTP_CTRL			(0x4340)
+#define RTL839X_RMA_LLTP_CTRL			(0x124C)
+#define RTL930X_RMA_LLTP_CTRL			(0x9EFC)
+#define RTL931X_RMA_LLTP_CTRL			(0x8918)
+
+#define RTL930X_RMA_EAPOL_CTRL			(0x9F08)
+#define RTL931X_RMA_EAPOL_CTRL			(0x8930)
+#define RTL931X_TRAP_ARP_GRAT_PORT_ACT		(0x8C04)
+
+/* QoS */
+#define RTL838X_QM_INTPRI2QID_CTRL		(0x5F00)
+#define RTL839X_QM_INTPRI2QID_CTRL(q)		(0x1110 + (q << 2))
+#define RTL839X_QM_PORT_QNUM(p)			(0x1130 + (((p / 10) << 2)))
+#define RTL838X_PRI_SEL_PORT_PRI(p)		(0x5FB8 + (((p / 10) << 2)))
+#define RTL839X_PRI_SEL_PORT_PRI(p)		(0x10A8 + (((p / 10) << 2)))
+#define RTL838X_QM_PKT2CPU_INTPRI_MAP		(0x5F10)
+#define RTL839X_QM_PKT2CPU_INTPRI_MAP		(0x1154)
+#define RTL838X_PRI_SEL_CTRL			(0x10E0)
+#define RTL839X_PRI_SEL_CTRL			(0x10E0)
+#define RTL838X_PRI_SEL_TBL_CTRL(i)		(0x5FD8 + (((i) << 2)))
+#define RTL839X_PRI_SEL_TBL_CTRL(i)		(0x10D0 + (((i) << 2)))
+#define RTL838X_QM_PKT2CPU_INTPRI_0		(0x5F04)
+#define RTL838X_QM_PKT2CPU_INTPRI_1		(0x5F08)
+#define RTL838X_QM_PKT2CPU_INTPRI_2		(0x5F0C)
+#define RTL839X_OAM_CTRL			(0x2100)
+#define RTL839X_OAM_PORT_ACT_CTRL(p)	 	(0x2104 + (((p) << 2)))
+#define RTL839X_RMK_PORT_DEI_TAG_CTRL(p)	(0x6A9C + (((p >> 5) << 2)))
+#define RTL839X_PRI_SEL_IPRI_REMAP		(0x1080)
+#define RTL838X_PRI_SEL_IPRI_REMAP		(0x5F8C)
+#define RTL839X_PRI_SEL_DEI2DP_REMAP		(0x10EC)
+#define RTL839X_PRI_SEL_DSCP2DP_REMAP_ADDR(i)	(0x10F0 + (((i >> 4) << 2)))
+#define RTL839X_RMK_DEI_CTRL			(0x6AA4)
+#define RTL839X_WRED_PORT_THR_CTRL(i)		(0x6084 + ((i) << 2))
+#define RTL839X_WRED_QUEUE_THR_CTRL(q, i) 	(0x6090 + ((q) * 12) + ((i) << 2))
+#define RTL838X_PRI_DSCP_INVLD_CTRL0		(0x5FE8)
+#define RTL838X_RMK_IPRI_CTRL			(0xA460)
+#define RTL838X_RMK_OPRI_CTRL			(0xA464)
+#define RTL838X_SCHED_P_TYPE_CTRL(p)		(0xC04C + (((p) << 7)))
+#define RTL838X_SCHED_LB_CTRL(p)		(0xC004 + (((p) << 7)))
+#define RTL838X_FC_P_EGR_DROP_CTRL(p)		(0x6B1C + (((p) << 2)))
+
+/* Debug features */
+#define RTL930X_STAT_PRVTE_DROP_COUNTER0	(0xB5B8)
+
+/* Packet Inspection Engine */
+#define RTL838X_METER_GLB_CTRL			(0x4B08)
+#define RTL839X_METER_GLB_CTRL			(0x1300)
+#define RTL930X_METER_GLB_CTRL			(0xa0a0)
+#define RTL931X_METER_GLB_CTRL			(0x411C)
+
+#define RTL839X_ACL_CTRL			(0x1288)
+
+#define RTL838X_ACL_BLK_LOOKUP_CTRL		(0x6100)
+#define RTL839X_ACL_BLK_LOOKUP_CTRL		(0x1280)
+#define RTL930X_PIE_BLK_LOOKUP_CTRL		(0xa5a0)
+#define RTL931X_PIE_BLK_LOOKUP_CTRL		(0x4180)
+
+#define RTL838X_ACL_BLK_PWR_CTRL		(0x6104)
+#define RTL839X_PS_ACL_PWR_CTRL			(0x049c)
+
+#define RTL838X_ACL_BLK_TMPLTE_CTRL(block)	(0x6108 + ((block) << 2))
+#define RTL839X_ACL_BLK_TMPLTE_CTRL(block)	(0x128c + ((block) << 2))
+#define RTL930X_PIE_BLK_TMPLTE_CTRL(block)	(0xa624 + ((block) << 2))
+#define RTL931X_PIE_BLK_TMPLTE_CTRL(block)	(0x4214 + ((block) << 2))
+
+#define RTL838X_ACL_BLK_GROUP_CTRL		(0x615C)
+#define RTL839X_ACL_BLK_GROUP_CTRL		(0x12ec)
+
+#define RTL838X_ACL_CLR_CTRL			(0x6168)
+#define RTL839X_ACL_CLR_CTRL			(0x12fc)
+#define RTL930X_PIE_CLR_CTRL			(0xa66c)
+#define RTL931X_PIE_CLR_CTRL			(0x42D8)
+
+#define RTL838X_DMY_REG27			(0x3378)
+
+#define RTL838X_ACL_PORT_LOOKUP_CTRL(p)		(0x616C + (((p) << 2)))
+#define RTL930X_ACL_PORT_LOOKUP_CTRL(p)		(0xA784 + (((p) << 2)))
+#define RTL931X_ACL_PORT_LOOKUP_CTRL(p)		(0x44F8 + (((p) << 2)))
+
+#define RTL930X_PIE_BLK_PHASE_CTRL		(0xA5A4)
+#define RTL931X_PIE_BLK_PHASE_CTRL		(0x4184)
+
+/* PIE actions */
+#define PIE_ACT_COPY_TO_PORT	2
+#define PIE_ACT_REDIRECT_TO_PORT 4
+#define PIE_ACT_ROUTE_UC	6
+#define PIE_ACT_VID_ASSIGN	0
+
+/* L3 actions */
+#define L3_FORWARD		0
+#define L3_DROP			1
+#define L3_TRAP2CPU		2
+#define L3_COPY2CPU		3
+#define L3_TRAP2MASTERCPU	4
+#define L3_COPY2MASTERCPU	5
+#define L3_HARDDROP		6
+
+/* Route actions */
+#define ROUTE_ACT_FORWARD	0
+#define ROUTE_ACT_TRAP2CPU	1
+#define ROUTE_ACT_COPY2CPU	2
+#define ROUTE_ACT_DROP		3
+
+/* L3 Routing */
+#define RTL839X_ROUTING_SA_CTRL 		0x6afc
+#define RTL930X_L3_HOST_TBL_CTRL		(0xAB48)
+#define RTL930X_L3_IPUC_ROUTE_CTRL		(0xAB4C)
+#define RTL930X_L3_IP6UC_ROUTE_CTRL		(0xAB50)
+#define RTL930X_L3_IPMC_ROUTE_CTRL		(0xAB54)
+#define RTL930X_L3_IP6MC_ROUTE_CTRL		(0xAB58)
+#define RTL930X_L3_IP_MTU_CTRL(i)		(0xAB5C + ((i >> 1) << 2))
+#define RTL930X_L3_IP6_MTU_CTRL(i)		(0xAB6C + ((i >> 1) << 2))
+#define RTL930X_L3_HW_LU_KEY_CTRL		(0xAC9C)
+#define RTL930X_L3_HW_LU_KEY_IP_CTRL		(0xACA0)
+#define RTL930X_L3_HW_LU_CTRL			(0xACC0)
+#define RTL930X_L3_IP_ROUTE_CTRL		0xab44
+
+/* Port LED Control */
+#define RTL930X_LED_PORT_NUM_CTRL(p)		(0xCC04 + (((p >> 4) << 2)))
+#define RTL930X_LED_SET0_0_CTRL			(0xCC28)
+#define RTL930X_LED_PORT_COPR_SET_SEL_CTRL(p)	(0xCC2C + (((p >> 4) << 2)))
+#define RTL930X_LED_PORT_FIB_SET_SEL_CTRL(p)	(0xCC34 + (((p >> 4) << 2)))
+#define RTL930X_LED_PORT_COPR_MASK_CTRL		(0xCC3C)
+#define RTL930X_LED_PORT_FIB_MASK_CTRL		(0xCC40)
+#define RTL930X_LED_PORT_COMBO_MASK_CTRL	(0xCC44)
+
+#define RTL931X_LED_PORT_NUM_CTRL(p)		(0x0604 + (((p >> 4) << 2)))
+#define RTL931X_LED_SET0_0_CTRL			(0x0630)
+#define RTL931X_LED_PORT_COPR_SET_SEL_CTRL(p)	(0x0634 + (((p >> 4) << 2)))
+#define RTL931X_LED_PORT_FIB_SET_SEL_CTRL(p)	(0x0644 + (((p >> 4) << 2)))
+#define RTL931X_LED_PORT_COPR_MASK_CTRL		(0x0654)
+#define RTL931X_LED_PORT_FIB_MASK_CTRL		(0x065c)
+#define RTL931X_LED_PORT_COMBO_MASK_CTRL	(0x0664)
+
+#define MAX_VLANS 4096
+#define MAX_LAGS 16
+#define MAX_PRIOS 8
+#define RTL930X_PORT_IGNORE 0x3f
+#define MAX_MC_GROUPS 512
+#define UNKNOWN_MC_PMASK (MAX_MC_GROUPS - 1)
+#define PIE_BLOCK_SIZE 128
+#define MAX_PIE_ENTRIES (18 * PIE_BLOCK_SIZE)
+#define N_FIXED_FIELDS 12
+#define N_FIXED_FIELDS_RTL931X 14
+#define MAX_COUNTERS 2048
+#define MAX_ROUTES 512
+#define MAX_HOST_ROUTES 1536
+#define MAX_INTF_MTUS 8
+#define DEFAULT_MTU 1536
+#define MAX_INTERFACES 100
+#define MAX_ROUTER_MACS 64
+#define L3_EGRESS_DMACS 2048
+#define MAX_SMACS 64
+
+enum phy_type {
+	PHY_NONE = 0,
+	PHY_RTL838X_SDS = 1,
+	PHY_RTL8218B_INT = 2,
+	PHY_RTL8218B_EXT = 3,
+	PHY_RTL8214FC = 4,
+	PHY_RTL839X_SDS = 5,
+	PHY_RTL930X_SDS = 6,
+};
+
+enum pbvlan_type {
+	PBVLAN_TYPE_INNER = 0,
+	PBVLAN_TYPE_OUTER,
+};
+
+enum pbvlan_mode {
+	PBVLAN_MODE_UNTAG_AND_PRITAG = 0,
+	PBVLAN_MODE_UNTAG_ONLY,
+	PBVLAN_MODE_ALL_PKT,
+};
+
+struct rtl838x_port {
+	bool enable;
+	u64 pm;
+	u16 pvid;
+	bool eee_enabled;
+	enum phy_type phy;
+	bool phy_is_integrated;
+	bool is10G;
+	bool is2G5;
+	int sds_num;
+	int led_set;
+	const struct dsa_port *dp;
+};
+
+struct rtl838x_vlan_info {
+	u64 untagged_ports;
+	u64 tagged_ports;
+	u8 profile_id;
+	bool hash_mc_fid;
+	bool hash_uc_fid;
+	u8 fid; /* AKA MSTI */
+
+	/* The following fields are used only by the RTL931X */
+	int if_id;		/* Interface (index in L3_EGR_INTF_IDX) */
+	u16 multicast_grp_mask;
+	int l2_tunnel_list_id;
+};
+
+enum l2_entry_type {
+	L2_INVALID = 0,
+	L2_UNICAST = 1,
+	L2_MULTICAST = 2,
+	IP4_MULTICAST = 3,
+	IP6_MULTICAST = 4,
+};
+
+struct rtl838x_l2_entry {
+	u8 mac[6];
+	u16 vid;
+	u16 rvid;
+	u8 port;
+	bool valid;
+	enum l2_entry_type type;
+	bool is_static;
+	bool is_ip_mc;
+	bool is_ipv6_mc;
+	bool block_da;
+	bool block_sa;
+	bool suspended;
+	bool next_hop;
+	int age;
+	u8 trunk;
+	bool is_trunk;
+	u8 stack_dev;
+	u16 mc_portmask_index;
+	u32 mc_gip;
+	u32 mc_sip;
+	u16 mc_mac_index;
+	u16 nh_route_id;
+	bool nh_vlan_target;  /* Only RTL83xx: VLAN used for next hop */
+
+	/* The following is only valid on RTL931x */
+	bool is_open_flow;
+	bool is_pe_forward;
+	bool is_local_forward;
+	bool is_remote_forward;
+	bool is_l2_tunnel;
+	int l2_tunnel_id;
+	int l2_tunnel_list_id;
+};
+
+enum fwd_rule_action {
+	FWD_RULE_ACTION_NONE = 0,
+	FWD_RULE_ACTION_FWD = 1,
+};
+
+enum pie_phase {
+	PHASE_VACL = 0,
+	PHASE_IACL = 1,
+};
+
+enum igr_filter {
+	IGR_FORWARD = 0,
+	IGR_DROP = 1,
+	IGR_TRAP = 2,
+};
+
+enum egr_filter {
+	EGR_DISABLE = 0,
+	EGR_ENABLE = 1,
+};
+
+/* Intermediate representation of a  Packet Inspection Engine Rule
+ * as suggested by the Kernel's tc flower offload subsystem
+ * Field meaning is universal across SoC families, but data content is specific
+ * to SoC family (e.g. because of different port ranges) */
+struct pie_rule {
+	int id;
+	enum pie_phase phase;	/* Phase in which this template is applied */
+	int packet_cntr;	/* ID of a packet counter assigned to this rule */
+	int octet_cntr;		/* ID of a byte counter assigned to this rule */
+	u32 last_packet_cnt;
+	u64 last_octet_cnt;
+
+	/* The following are requirements for the pie template */
+	bool is_egress;
+	bool is_ipv6;		/* This is a rule with IPv6 fields */
+
+	/* Fixed fields that are always matched against on RTL8380 */
+	u8 spmmask_fix;
+	u8 spn;			/* Source port number */
+	bool stacking_port;	/* Source port is stacking port */
+	bool mgnt_vlan;		/* Packet arrived on management VLAN */
+	bool dmac_hit_sw;	/* The packet's destination MAC matches one of the device's */
+	bool content_too_deep;	/* The content of the packet cannot be parsed: too many layers */
+	bool not_first_frag;	/* Not the first IP fragment */
+	u8 frame_type_l4;	/* 0: UDP, 1: TCP, 2: ICMP/ICMPv6, 3: IGMP */
+	u8 frame_type;		/* 0: ARP, 1: L2 only, 2: IPv4, 3: IPv6 */
+	bool otag_fmt;		/* 0: outer tag packet, 1: outer priority tag or untagged */
+	bool itag_fmt;		/* 0: inner tag packet, 1: inner priority tag or untagged */
+	bool otag_exist;	/* packet with outer tag */
+	bool itag_exist;	/* packet with inner tag */
+	bool frame_type_l2;	/* 0: Ethernet, 1: LLC_SNAP, 2: LLC_Other, 3: Reserved */
+	bool igr_normal_port;	/* Ingress port is not cpu or stacking port */
+	u8 tid;			/* The template ID defining the what the templated fields mean */
+
+	/* Masks for the fields that are always matched against on RTL8380 */
+	u8 spmmask_fix_m;
+	u8 spn_m;
+	bool stacking_port_m;
+	bool mgnt_vlan_m;
+	bool dmac_hit_sw_m;
+	bool content_too_deep_m;
+	bool not_first_frag_m;
+	u8 frame_type_l4_m;
+	u8 frame_type_m;
+	bool otag_fmt_m;
+	bool itag_fmt_m;
+	bool otag_exist_m;
+	bool itag_exist_m;
+	bool frame_type_l2_m;
+	bool igr_normal_port_m;
+	u8 tid_m;
+
+	/* Logical operations between rules, special rules for rule numbers apply */
+	bool valid;
+	bool cond_not;		/* Matches when conditions not match */
+	bool cond_and1;		/* And this rule 2n with the next rule 2n+1 in same block */
+	bool cond_and2;		/* And this rule m in block 2n with rule m in block 2n+1 */
+	bool ivalid;
+
+	/* Actions to be performed */
+	bool drop;		/* Drop the packet */
+	bool fwd_sel;		/* Forward packet: to port, portmask, dest route, next rule, drop */
+	bool ovid_sel;		/* So something to outer vlan-id: shift, re-assign */
+	bool ivid_sel;		/* Do something to inner vlan-id: shift, re-assign */
+	bool flt_sel;		/* Filter the packet when sending to certain ports */
+	bool log_sel;		/* Log the packet in one of the LOG-table counters */
+	bool rmk_sel;		/* Re-mark the packet, i.e. change the priority-tag */
+	bool meter_sel;		/* Meter the packet, i.e. limit rate of this type of packet */
+	bool tagst_sel;		/* Change the ergress tag */
+	bool mir_sel;		/* Mirror the packet to a Link Aggregation Group */
+	bool nopri_sel;		/* Change the normal priority */
+	bool cpupri_sel;	/* Change the CPU priority */
+	bool otpid_sel;		/* Change Outer Tag Protocol Identifier (802.1q) */
+	bool itpid_sel;		/* Change Inner Tag Protocol Identifier (802.1q) */
+	bool shaper_sel;	/* Apply traffic shaper */
+	bool mpls_sel;		/* MPLS actions */
+	bool bypass_sel;	/* Bypass actions */
+	bool fwd_sa_lrn;	/* Learn the source address when forwarding */
+	bool fwd_mod_to_cpu;	/* Forward the modified VLAN tag format to CPU-port */
+
+	/* Fields used in predefined templates 0-2 on RTL8380 / 90 / 9300 */
+	u64 spm;		/* Source Port Matrix */
+	u16 otag;		/* Outer VLAN-ID */
+	u8 smac[ETH_ALEN];	/* Source MAC address */
+	u8 dmac[ETH_ALEN];	/* Destination MAC address */
+	u16 ethertype;		/* Ethernet frame type field in ethernet header */
+	u16 itag;		/* Inner VLAN-ID */
+	u16 field_range_check;
+	u32 sip;		/* Source IP */
+	struct in6_addr sip6;	/* IPv6 Source IP */
+	u32 dip;		/* Destination IP */
+	struct in6_addr dip6;	/* IPv6 Destination IP */
+	u16 tos_proto;		/* IPv4: TOS + Protocol fields, IPv6: Traffic class + next header */
+	u16 sport;		/* TCP/UDP source port */
+	u16 dport;		/* TCP/UDP destination port */
+	u16 icmp_igmp;
+	u16 tcp_info;
+	u16 dsap_ssap;		/* Destination / Source Service Access Point bytes (802.3) */
+
+	u64 spm_m;
+	u16 otag_m;
+	u8 smac_m[ETH_ALEN];
+	u8 dmac_m[ETH_ALEN];
+	u8 ethertype_m;
+	u16 itag_m;
+	u16 field_range_check_m;
+	u32 sip_m;
+	struct in6_addr sip6_m;	/* IPv6 Source IP mask */
+	u32 dip_m;
+	struct in6_addr dip6_m;	/* IPv6 Destination IP mask */
+	u16 tos_proto_m;
+	u16 sport_m;
+	u16 dport_m;
+	u16 icmp_igmp_m;
+	u16 tcp_info_m;
+	u16 dsap_ssap_m;
+
+	/* Data associated with actions */
+	u8 fwd_act;		/* Type of forwarding action */
+				/* 0: permit, 1: drop, 2: copy to port id, 4: copy to portmask */
+				/* 4: redirect to portid, 5: redirect to portmask */
+				/* 6: route, 7: vlan leaky (only 8380) */
+	u16 fwd_data;		/* Additional data for forwarding action, e.g. destination port */
+	u8 ovid_act;
+	u16 ovid_data;		/* Outer VLAN ID */
+	u8 ivid_act;
+	u16 ivid_data;		/* Inner VLAN ID */
+	u16 flt_data;		/* Filtering data */
+	u16 log_data;		/* ID of packet or octet counter in LOG table, on RTL93xx */
+				/* unnecessary since PIE-Rule-ID == LOG-counter-ID */
+	bool log_octets;
+	u8 mpls_act;		/* MPLS action type */
+	u16 mpls_lib_idx;	/* MPLS action data */
+
+	u16 rmk_data;		/* Data for remarking */
+	u16 meter_data;		/* ID of meter for bandwidth control */
+	u16 tagst_data;
+	u16 mir_data;
+	u16 nopri_data;
+	u16 cpupri_data;
+	u16 otpid_data;
+	u16 itpid_data;
+	u16 shaper_data;
+
+	/* Bypass actions, ignored on RTL8380 */
+	bool bypass_all;	/* Not clear */
+	bool bypass_igr_stp;	/* Bypass Ingress STP state */
+	bool bypass_ibc_sc;	/* Bypass Ingress Bandwidth Control and Storm Control */
+};
+
+struct rtl838x_l3_intf {
+	u16 vid;
+	u8 smac_idx;
+	u8 ip4_mtu_id;
+	u8 ip6_mtu_id;
+	u16 ip4_mtu;
+	u16 ip6_mtu;
+	u8 ttl_scope;
+	u8 hl_scope;
+	u8 ip4_icmp_redirect;
+	u8 ip6_icmp_redirect;
+	u8 ip4_pbr_icmp_redirect;
+	u8 ip6_pbr_icmp_redirect;
+};
+
+/* An entry in the RTL93XX SoC's ROUTER_MAC tables setting up a termination point
+ * for the L3 routing system. Packets arriving and matching an entry in this table
+ * will be considered for routing.
+ * Mask fields state whether the corresponding data fields matter for matching
+ */
+struct rtl93xx_rt_mac {
+	bool valid;	/* Valid or not */
+	bool p_type;	/* Individual (0) or trunk (1) port */
+	bool p_mask;	/* Whether the port type is used */
+	u8 p_id;
+	u8 p_id_mask;	/* Mask for the port */
+	u8 action;	/* Routing action performed: 0: FORWARD, 1: DROP, 2: TRAP2CPU */
+			/*   3: COPY2CPU, 4: TRAP2MASTERCPU, 5: COPY2MASTERCPU, 6: HARDDROP */
+	u16 vid;
+	u16 vid_mask;
+	u64 mac;	/* MAC address used as source MAC in the routed packet */
+	u64 mac_mask;
+};
+
+struct rtl83xx_nexthop {
+	u16 id;		/* ID: L3_NEXT_HOP table-index or route-index set in L2_NEXT_HOP */
+	u32 dev_id;
+	u16 port;
+	u16 vid;	/* VLAN-ID for L2 table entry (saved from L2-UC entry) */
+	u16 rvid;	/* Relay VID/FID for the L2 table entry */
+	u64 mac;	/* The MAC address of the entry in the L2_NEXT_HOP table */
+	u16 mac_id;
+	u16 l2_id;	/* Index of this next hop forwarding entry in L2 FIB table */
+	u64 gw;		/* The gateway MAC address packets are forwarded to */
+	int if_id;	/* Interface (into L3_EGR_INTF_IDX) */
+};
+
+struct rtl838x_switch_priv;
+
+struct rtl83xx_flow {
+	unsigned long cookie;
+	struct rhash_head node;
+	struct rcu_head rcu_head;
+	struct rtl838x_switch_priv *priv;
+	struct pie_rule rule;
+	u32 flags;
+};
+
+struct rtl93xx_route_attr {
+	bool valid;
+	bool hit;
+	bool ttl_dec;
+	bool ttl_check;
+	bool dst_null;
+	bool qos_as;
+	u8 qos_prio;
+	u8 type;
+	u8 action;
+};
+
+struct rtl83xx_route {
+	u32 gw_ip;			/* IP of the route's gateway */
+	u32 dst_ip;			/* IP of the destination net */
+	struct in6_addr dst_ip6;
+	int prefix_len;			/* Network prefix len of the destination net */
+	bool is_host_route;
+	int id;				/* ID number of this route */
+	struct rhlist_head linkage;
+	u16 switch_mac_id;		/* Index into switch's own MACs, RTL839X only */
+	struct rtl83xx_nexthop nh;
+	struct pie_rule pr;
+	struct rtl93xx_route_attr attr;
+};
+
+struct rtl838x_reg {
+	void (*mask_port_reg_be)(u64 clear, u64 set, int reg);
+	void (*set_port_reg_be)(u64 set, int reg);
+	u64 (*get_port_reg_be)(int reg);
+	void (*mask_port_reg_le)(u64 clear, u64 set, int reg);
+	void (*set_port_reg_le)(u64 set, int reg);
+	u64 (*get_port_reg_le)(int reg);
+	int stat_port_rst;
+	int stat_rst;
+	int stat_port_std_mib;
+	int (*port_iso_ctrl)(int p);
+	void (*traffic_enable)(int source, int dest);
+	void (*traffic_disable)(int source, int dest);
+	void (*traffic_set)(int source, u64 dest_matrix);
+	u64 (*traffic_get)(int source);
+	int l2_ctrl_0;
+	int l2_ctrl_1;
+	int smi_poll_ctrl;
+	u32 l2_port_aging_out;
+	int l2_tbl_flush_ctrl;
+	void (*exec_tbl0_cmd)(u32 cmd);
+	void (*exec_tbl1_cmd)(u32 cmd);
+	int (*tbl_access_data_0)(int i);
+	int isr_glb_src;
+	int isr_port_link_sts_chg;
+	int imr_port_link_sts_chg;
+	int imr_glb;
+	void (*vlan_tables_read)(u32 vlan, struct rtl838x_vlan_info *info);
+	void (*vlan_set_tagged)(u32 vlan, struct rtl838x_vlan_info *info);
+	void (*vlan_set_untagged)(u32 vlan, u64 portmask);
+	void (*vlan_profile_dump)(int index);
+	void (*vlan_profile_setup)(int profile);
+	void (*vlan_port_pvidmode_set)(int port, enum pbvlan_type type, enum pbvlan_mode mode);
+	void (*vlan_port_pvid_set)(int port, enum pbvlan_type type, int pvid);
+	void (*vlan_port_keep_tag_set)(int port, bool keep_outer, bool keep_inner);
+	void (*set_vlan_igr_filter)(int port, enum igr_filter state);
+	void (*set_vlan_egr_filter)(int port, enum egr_filter state);
+	void (*enable_learning)(int port, bool enable);
+	void (*enable_flood)(int port, bool enable);
+	void (*enable_mcast_flood)(int port, bool enable);
+	void (*enable_bcast_flood)(int port, bool enable);
+	void (*set_static_move_action)(int port, bool forward);
+	void (*stp_get)(struct rtl838x_switch_priv *priv, u16 msti, u32 port_state[]);
+	void (*stp_set)(struct rtl838x_switch_priv *priv, u16 msti, u32 port_state[]);
+	int  (*mac_force_mode_ctrl)(int port);
+	int  (*mac_port_ctrl)(int port);
+	int  (*l2_port_new_salrn)(int port);
+	int  (*l2_port_new_sa_fwd)(int port);
+	int (*set_ageing_time)(unsigned long msec);
+	int mir_ctrl;
+	int mir_dpm;
+	int mir_spm;
+	int mac_link_sts;
+	int mac_link_dup_sts;
+	int  (*mac_link_spd_sts)(int port);
+	int mac_rx_pause_sts;
+	int mac_tx_pause_sts;
+	u64 (*read_l2_entry_using_hash)(u32 hash, u32 position, struct rtl838x_l2_entry *e);
+	void (*write_l2_entry_using_hash)(u32 hash, u32 pos, struct rtl838x_l2_entry *e);
+	u64 (*read_cam)(int idx, struct rtl838x_l2_entry *e);
+	void (*write_cam)(int idx, struct rtl838x_l2_entry *e);
+	int (*trk_mbr_ctr)(int group);
+	int rma_bpdu_fld_pmask;
+	int spcl_trap_eapol_ctrl;
+	void (*init_eee)(struct rtl838x_switch_priv *priv, bool enable);
+	void (*port_eee_set)(struct rtl838x_switch_priv *priv, int port, bool enable);
+	int (*eee_port_ability)(struct rtl838x_switch_priv *priv,
+				struct ethtool_eee *e, int port);
+	u64 (*l2_hash_seed)(u64 mac, u32 vid);
+	u32 (*l2_hash_key)(struct rtl838x_switch_priv *priv, u64 seed);
+	u64 (*read_mcast_pmask)(int idx);
+	void (*write_mcast_pmask)(int idx, u64 portmask);
+	void (*vlan_fwd_on_inner)(int port, bool is_set);
+	void (*pie_init)(struct rtl838x_switch_priv *priv);
+	int (*pie_rule_read)(struct rtl838x_switch_priv *priv, int idx, struct  pie_rule *pr);
+	int (*pie_rule_write)(struct rtl838x_switch_priv *priv, int idx, struct pie_rule *pr);
+	int (*pie_rule_add)(struct rtl838x_switch_priv *priv, struct pie_rule *rule);
+	void (*pie_rule_rm)(struct rtl838x_switch_priv *priv, struct pie_rule *rule);
+	void (*l2_learning_setup)(void);
+	u32 (*packet_cntr_read)(int counter);
+	void (*packet_cntr_clear)(int counter);
+	void (*route_read)(int idx, struct rtl83xx_route *rt);
+	void (*route_write)(int idx, struct rtl83xx_route *rt);
+	void (*host_route_write)(int idx, struct rtl83xx_route *rt);
+	int (*l3_setup)(struct rtl838x_switch_priv *priv);
+	void (*set_l3_nexthop)(int idx, u16 dmac_id, u16 interface);
+	void (*get_l3_nexthop)(int idx, u16 *dmac_id, u16 *interface);
+	u64 (*get_l3_egress_mac)(u32 idx);
+	void (*set_l3_egress_mac)(u32 idx, u64 mac);
+	int (*find_l3_slot)(struct rtl83xx_route *rt, bool must_exist);
+	int (*route_lookup_hw)(struct rtl83xx_route *rt);
+	void (*get_l3_router_mac)(u32 idx, struct rtl93xx_rt_mac *m);
+	void (*set_l3_router_mac)(u32 idx, struct rtl93xx_rt_mac *m);
+	void (*set_l3_egress_intf)(int idx, struct rtl838x_l3_intf *intf);
+	void (*set_distribution_algorithm)(int group, int algoidx, u32 algomask);
+	void (*set_receive_management_action)(int port, rma_ctrl_t type, action_type_t action);
+	void (*led_init)(struct rtl838x_switch_priv *priv);
+};
+
+struct rtl838x_switch_priv {
+	/* Switch operation */
+	struct dsa_switch *ds;
+	struct device *dev;
+	u16 id;
+	u16 family_id;
+	char version;
+	struct rtl838x_port ports[57];
+	struct mutex reg_mutex;		/* Mutex for individual register manipulations */
+	struct mutex pie_mutex;		/* Mutex for Packet Inspection Engine */
+	int link_state_irq;
+	int mirror_group_ports[4];
+	struct mii_bus *mii_bus;
+	const struct rtl838x_reg *r;
+	u8 cpu_port;
+	u8 port_mask;
+	u8 port_width;
+	u8 port_ignore;
+	u64 irq_mask;
+	u32 fib_entries;
+	int l2_bucket_size;
+	struct dentry *dbgfs_dir;
+	int n_lags;
+	u64 lags_port_members[MAX_LAGS];
+	struct net_device *lag_devs[MAX_LAGS];
+	u32 lag_primary[MAX_LAGS];
+	u32 is_lagmember[57];
+	u64 lagmembers;
+	struct notifier_block nb;  /* TODO: change to different name */
+	struct notifier_block ne_nb;
+	struct notifier_block fib_nb;
+	bool eee_enabled;
+	unsigned long int mc_group_bm[MAX_MC_GROUPS >> 5];
+	int n_pie_blocks;
+	struct rhashtable tc_ht;
+	unsigned long int pie_use_bm[MAX_PIE_ENTRIES >> 5];
+	int n_counters;
+	unsigned long int octet_cntr_use_bm[MAX_COUNTERS >> 5];
+	unsigned long int packet_cntr_use_bm[MAX_COUNTERS >> 4];
+	struct rhltable routes;
+	unsigned long int route_use_bm[MAX_ROUTES >> 5];
+	unsigned long int host_route_use_bm[MAX_HOST_ROUTES >> 5];
+	struct rtl838x_l3_intf *interfaces[MAX_INTERFACES];
+	u16 intf_mtus[MAX_INTF_MTUS];
+	int intf_mtu_count[MAX_INTF_MTUS];
+};
+
+void rtl838x_dbgfs_init(struct rtl838x_switch_priv *priv);
+void rtl930x_dbgfs_init(struct rtl838x_switch_priv *priv);
+
+#endif /* _RTL838X_H */
diff --git a/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/rtl839x.c b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/rtl839x.c
new file mode 100644
index 00000000000000..ff80a9074edf1e
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/rtl839x.c
@@ -0,0 +1,1911 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <asm/mach-rtl838x/mach-rtl83xx.h>
+#include <linux/etherdevice.h>
+
+#include "rtl83xx.h"
+
+#define RTL839X_VLAN_PORT_TAG_STS_UNTAG				0x0
+#define RTL839X_VLAN_PORT_TAG_STS_TAGGED			0x1
+#define RTL839X_VLAN_PORT_TAG_STS_PRIORITY_TAGGED		0x2
+
+#define RTL839X_VLAN_PORT_TAG_STS_CTRL_BASE			0x6828
+/* port 0-52 */
+#define RTL839X_VLAN_PORT_TAG_STS_CTRL(port) \
+		RTL839X_VLAN_PORT_TAG_STS_CTRL_BASE + (port << 2)
+#define RTL839X_VLAN_PORT_TAG_STS_CTRL_OTAG_STS_MASK		GENMASK(7,6)
+#define RTL839X_VLAN_PORT_TAG_STS_CTRL_ITAG_STS_MASK		GENMASK(5,4)
+#define RTL839X_VLAN_PORT_TAG_STS_CTRL_EGR_P_OTAG_KEEP_MASK	GENMASK(3,3)
+#define RTL839X_VLAN_PORT_TAG_STS_CTRL_EGR_P_ITAG_KEEP_MASK	GENMASK(2,2)
+#define RTL839X_VLAN_PORT_TAG_STS_CTRL_IGR_P_OTAG_KEEP_MASK	GENMASK(1,1)
+#define RTL839X_VLAN_PORT_TAG_STS_CTRL_IGR_P_ITAG_KEEP_MASK	GENMASK(0,0)
+
+extern struct mutex smi_lock;
+extern struct rtl83xx_soc_info soc_info;
+
+/* Definition of the RTL839X-specific template field IDs as used in the PIE */
+enum template_field_id {
+	TEMPLATE_FIELD_SPMMASK = 0,
+	TEMPLATE_FIELD_SPM0 = 1,		/* Source portmask ports 0-15 */
+	TEMPLATE_FIELD_SPM1 = 2,		/* Source portmask ports 16-31 */
+	TEMPLATE_FIELD_SPM2 = 3,		/* Source portmask ports 32-47 */
+	TEMPLATE_FIELD_SPM3 = 4,		/* Source portmask ports 48-56 */
+	TEMPLATE_FIELD_DMAC0 = 5,		/* Destination MAC [15:0] */
+	TEMPLATE_FIELD_DMAC1 = 6,		/* Destination MAC [31:16] */
+	TEMPLATE_FIELD_DMAC2 = 7,		/* Destination MAC [47:32] */
+	TEMPLATE_FIELD_SMAC0 = 8,		/* Source MAC [15:0] */
+	TEMPLATE_FIELD_SMAC1 = 9,		/* Source MAC [31:16] */
+	TEMPLATE_FIELD_SMAC2 = 10,		/* Source MAC [47:32] */
+	TEMPLATE_FIELD_ETHERTYPE = 11,		/* Ethernet frame type field */
+	/* Field-ID 12 is not used */
+	TEMPLATE_FIELD_OTAG = 13,
+	TEMPLATE_FIELD_ITAG = 14,
+	TEMPLATE_FIELD_SIP0 = 15,
+	TEMPLATE_FIELD_SIP1 = 16,
+	TEMPLATE_FIELD_DIP0 = 17,
+	TEMPLATE_FIELD_DIP1 = 18,
+	TEMPLATE_FIELD_IP_TOS_PROTO = 19,
+	TEMPLATE_FIELD_IP_FLAG = 20,
+	TEMPLATE_FIELD_L4_SPORT = 21,
+	TEMPLATE_FIELD_L4_DPORT = 22,
+	TEMPLATE_FIELD_L34_HEADER = 23,
+	TEMPLATE_FIELD_ICMP_IGMP = 24,
+	TEMPLATE_FIELD_VID_RANG0 = 25,
+	TEMPLATE_FIELD_VID_RANG1 = 26,
+	TEMPLATE_FIELD_L4_PORT_RANG = 27,
+	TEMPLATE_FIELD_FIELD_SELECTOR_VALID = 28,
+	TEMPLATE_FIELD_FIELD_SELECTOR_0 = 29,
+	TEMPLATE_FIELD_FIELD_SELECTOR_1 = 30,
+	TEMPLATE_FIELD_FIELD_SELECTOR_2 = 31,
+	TEMPLATE_FIELD_FIELD_SELECTOR_3 = 32,
+	TEMPLATE_FIELD_FIELD_SELECTOR_4 = 33,
+	TEMPLATE_FIELD_FIELD_SELECTOR_5 = 34,
+	TEMPLATE_FIELD_SIP2 = 35,
+	TEMPLATE_FIELD_SIP3 = 36,
+	TEMPLATE_FIELD_SIP4 = 37,
+	TEMPLATE_FIELD_SIP5 = 38,
+	TEMPLATE_FIELD_SIP6 = 39,
+	TEMPLATE_FIELD_SIP7 = 40,
+	TEMPLATE_FIELD_OLABEL = 41,
+	TEMPLATE_FIELD_ILABEL = 42,
+	TEMPLATE_FIELD_OILABEL = 43,
+	TEMPLATE_FIELD_DPMMASK = 44,
+	TEMPLATE_FIELD_DPM0 = 45,
+	TEMPLATE_FIELD_DPM1 = 46,
+	TEMPLATE_FIELD_DPM2 = 47,
+	TEMPLATE_FIELD_DPM3 = 48,
+	TEMPLATE_FIELD_L2DPM0 = 49,
+	TEMPLATE_FIELD_L2DPM1 = 50,
+	TEMPLATE_FIELD_L2DPM2 = 51,
+	TEMPLATE_FIELD_L2DPM3 = 52,
+	TEMPLATE_FIELD_IVLAN = 53,
+	TEMPLATE_FIELD_OVLAN = 54,
+	TEMPLATE_FIELD_FWD_VID = 55,
+	TEMPLATE_FIELD_DIP2 = 56,
+	TEMPLATE_FIELD_DIP3 = 57,
+	TEMPLATE_FIELD_DIP4 = 58,
+	TEMPLATE_FIELD_DIP5 = 59,
+	TEMPLATE_FIELD_DIP6 = 60,
+	TEMPLATE_FIELD_DIP7 = 61,
+};
+
+/* Number of fixed templates predefined in the SoC */
+#define N_FIXED_TEMPLATES 5
+static enum template_field_id fixed_templates[N_FIXED_TEMPLATES][N_FIXED_FIELDS] =
+{
+	{
+	  TEMPLATE_FIELD_SPM0, TEMPLATE_FIELD_SPM1, TEMPLATE_FIELD_ITAG,
+	  TEMPLATE_FIELD_SMAC0, TEMPLATE_FIELD_SMAC1, TEMPLATE_FIELD_SMAC2,
+	  TEMPLATE_FIELD_DMAC0, TEMPLATE_FIELD_DMAC1, TEMPLATE_FIELD_DMAC2,
+	  TEMPLATE_FIELD_ETHERTYPE, TEMPLATE_FIELD_SPM2, TEMPLATE_FIELD_SPM3
+	}, {
+	  TEMPLATE_FIELD_SIP0, TEMPLATE_FIELD_SIP1, TEMPLATE_FIELD_DIP0,
+	  TEMPLATE_FIELD_DIP1,TEMPLATE_FIELD_IP_TOS_PROTO, TEMPLATE_FIELD_L4_SPORT,
+	  TEMPLATE_FIELD_L4_DPORT, TEMPLATE_FIELD_ICMP_IGMP, TEMPLATE_FIELD_SPM0,
+	  TEMPLATE_FIELD_SPM1, TEMPLATE_FIELD_SPM2, TEMPLATE_FIELD_SPM3
+	}, {
+	  TEMPLATE_FIELD_DMAC0, TEMPLATE_FIELD_DMAC1, TEMPLATE_FIELD_DMAC2,
+	  TEMPLATE_FIELD_ITAG, TEMPLATE_FIELD_ETHERTYPE, TEMPLATE_FIELD_IP_TOS_PROTO,
+	  TEMPLATE_FIELD_L4_DPORT, TEMPLATE_FIELD_L4_SPORT, TEMPLATE_FIELD_SIP0,
+	  TEMPLATE_FIELD_SIP1, TEMPLATE_FIELD_DIP0, TEMPLATE_FIELD_DIP1
+	}, {
+	  TEMPLATE_FIELD_DIP0, TEMPLATE_FIELD_DIP1, TEMPLATE_FIELD_DIP2,
+	  TEMPLATE_FIELD_DIP3, TEMPLATE_FIELD_DIP4, TEMPLATE_FIELD_DIP5,
+	  TEMPLATE_FIELD_DIP6, TEMPLATE_FIELD_DIP7, TEMPLATE_FIELD_L4_DPORT,
+	  TEMPLATE_FIELD_L4_SPORT, TEMPLATE_FIELD_ICMP_IGMP, TEMPLATE_FIELD_IP_TOS_PROTO
+	}, {
+	  TEMPLATE_FIELD_SIP0, TEMPLATE_FIELD_SIP1, TEMPLATE_FIELD_SIP2,
+	  TEMPLATE_FIELD_SIP3, TEMPLATE_FIELD_SIP4, TEMPLATE_FIELD_SIP5,
+	  TEMPLATE_FIELD_SIP6, TEMPLATE_FIELD_SIP7, TEMPLATE_FIELD_SPM0,
+	  TEMPLATE_FIELD_SPM1, TEMPLATE_FIELD_SPM2, TEMPLATE_FIELD_SPM3
+	},
+};
+
+void rtl839x_print_matrix(void)
+{
+	volatile u64 *ptr9;
+
+	ptr9 = RTL838X_SW_BASE + RTL839X_PORT_ISO_CTRL(0);
+	for (int i = 0; i < 52; i += 4)
+		pr_debug("> %16llx %16llx %16llx %16llx\n",
+			ptr9[i + 0], ptr9[i + 1], ptr9[i + 2], ptr9[i + 3]);
+	pr_debug("CPU_PORT> %16llx\n", ptr9[52]);
+}
+
+static inline int rtl839x_port_iso_ctrl(int p)
+{
+	return RTL839X_PORT_ISO_CTRL(p);
+}
+
+static inline void rtl839x_exec_tbl0_cmd(u32 cmd)
+{
+	sw_w32(cmd, RTL839X_TBL_ACCESS_CTRL_0);
+	do { } while (sw_r32(RTL839X_TBL_ACCESS_CTRL_0) & BIT(16));
+}
+
+static inline void rtl839x_exec_tbl1_cmd(u32 cmd)
+{
+	sw_w32(cmd, RTL839X_TBL_ACCESS_CTRL_1);
+	do { } while (sw_r32(RTL839X_TBL_ACCESS_CTRL_1) & BIT(16));
+}
+
+inline void rtl839x_exec_tbl2_cmd(u32 cmd)
+{
+	sw_w32(cmd, RTL839X_TBL_ACCESS_CTRL_2);
+	do { } while (sw_r32(RTL839X_TBL_ACCESS_CTRL_2) & (1 << 9));
+}
+
+static inline int rtl839x_tbl_access_data_0(int i)
+{
+	return RTL839X_TBL_ACCESS_DATA_0(i);
+}
+
+static void rtl839x_vlan_tables_read(u32 vlan, struct rtl838x_vlan_info *info)
+{
+	u32 u, v, w;
+	/* Read VLAN table (0) via register 0 */
+	struct table_reg *r = rtl_table_get(RTL8390_TBL_0, 0);
+
+	rtl_table_read(r, vlan);
+	u = sw_r32(rtl_table_data(r, 0));
+	v = sw_r32(rtl_table_data(r, 1));
+	w = sw_r32(rtl_table_data(r, 2));
+	rtl_table_release(r);
+
+	info->tagged_ports = u;
+	info->tagged_ports = (info->tagged_ports << 21) | ((v >> 11) & 0x1fffff);
+	info->profile_id = w >> 30 | ((v & 1) << 2);
+	info->hash_mc_fid = !!(w & BIT(2));
+	info->hash_uc_fid = !!(w & BIT(3));
+	info->fid = (v >> 3) & 0xff;
+
+	/* Read UNTAG table (0) via table register 1 */
+	r = rtl_table_get(RTL8390_TBL_1, 0);
+	rtl_table_read(r, vlan);
+	u = sw_r32(rtl_table_data(r, 0));
+	v = sw_r32(rtl_table_data(r, 1));
+	rtl_table_release(r);
+
+	info->untagged_ports = u;
+	info->untagged_ports = (info->untagged_ports << 21) | ((v >> 11) & 0x1fffff);
+}
+
+static void rtl839x_vlan_set_tagged(u32 vlan, struct rtl838x_vlan_info *info)
+{
+	u32 u, v, w;
+	/* Access VLAN table (0) via register 0 */
+	struct table_reg *r = rtl_table_get(RTL8390_TBL_0, 0);
+
+	u = info->tagged_ports >> 21;
+	v = info->tagged_ports << 11;
+	v |= ((u32)info->fid) << 3;
+	v |= info->hash_uc_fid ? BIT(2) : 0;
+	v |= info->hash_mc_fid ? BIT(1) : 0;
+	v |= (info->profile_id & 0x4) ? 1 : 0;
+	w = ((u32)(info->profile_id & 3)) << 30;
+
+	sw_w32(u, rtl_table_data(r, 0));
+	sw_w32(v, rtl_table_data(r, 1));
+	sw_w32(w, rtl_table_data(r, 2));
+
+	rtl_table_write(r, vlan);
+	rtl_table_release(r);
+}
+
+static void rtl839x_vlan_set_untagged(u32 vlan, u64 portmask)
+{
+	u32 u, v;
+
+	/* Access UNTAG table (0) via table register 1 */
+	struct table_reg *r = rtl_table_get(RTL8390_TBL_1, 0);
+
+	u = portmask >> 21;
+	v = portmask << 11;
+
+	sw_w32(u, rtl_table_data(r, 0));
+	sw_w32(v, rtl_table_data(r, 1));
+	rtl_table_write(r, vlan);
+
+	rtl_table_release(r);
+}
+
+/* Sets the L2 forwarding to be based on either the inner VLAN tag or the outer */
+static void rtl839x_vlan_fwd_on_inner(int port, bool is_set)
+{
+	if (is_set)
+		rtl839x_mask_port_reg_be(BIT_ULL(port), 0ULL, RTL839X_VLAN_PORT_FWD);
+	else
+		rtl839x_mask_port_reg_be(0ULL, BIT_ULL(port), RTL839X_VLAN_PORT_FWD);
+}
+
+/* Hash seed is vid (actually rvid) concatenated with the MAC address */
+static u64 rtl839x_l2_hash_seed(u64 mac, u32 vid)
+{
+	u64 v = vid;
+
+	v <<= 48;
+	v |= mac;
+
+	return v;
+}
+
+/* Applies the same hash algorithm as the one used currently by the ASIC to the seed
+ * and returns a key into the L2 hash table
+ */
+static u32 rtl839x_l2_hash_key(struct rtl838x_switch_priv *priv, u64 seed)
+{
+	u32 h1, h2, h;
+
+	if (sw_r32(priv->r->l2_ctrl_0) & 1) {
+		h1 = (u32) (((seed >> 60) & 0x3f) ^ ((seed >> 54) & 0x3f) ^
+		           ((seed >> 36) & 0x3f) ^ ((seed >> 30) & 0x3f) ^
+		           ((seed >> 12) & 0x3f) ^ ((seed >> 6) & 0x3f));
+		h2 = (u32) (((seed >> 48) & 0x3f) ^ ((seed >> 42) & 0x3f) ^
+		           ((seed >> 24) & 0x3f) ^ ((seed >> 18) & 0x3f) ^
+		           (seed & 0x3f));
+		h = (h1 << 6) | h2;
+	} else {
+		h = (seed >> 60) ^
+		    ((((seed >> 48) & 0x3f) << 6) | ((seed >> 54) & 0x3f)) ^
+		    ((seed >> 36) & 0xfff) ^ ((seed >> 24) & 0xfff) ^
+		    ((seed >> 12) & 0xfff) ^ (seed & 0xfff);
+	}
+
+	return h;
+}
+
+static inline int rtl839x_mac_force_mode_ctrl(int p)
+{
+	return RTL839X_MAC_FORCE_MODE_CTRL + (p << 2);
+}
+
+static inline int rtl839x_mac_port_ctrl(int p)
+{
+	return RTL839X_MAC_PORT_CTRL(p);
+}
+
+static inline int rtl839x_l2_port_new_salrn(int p)
+{
+	return RTL839X_L2_PORT_NEW_SALRN(p);
+}
+
+static inline int rtl839x_l2_port_new_sa_fwd(int p)
+{
+	return RTL839X_L2_PORT_NEW_SA_FWD(p);
+}
+
+static inline int rtl839x_mac_link_spd_sts(int p)
+{
+	return RTL839X_MAC_LINK_SPD_STS(p);
+}
+
+static inline int rtl839x_trk_mbr_ctr(int group)
+{
+	return RTL839X_TRK_MBR_CTR + (group << 3);
+}
+
+static void rtl839x_fill_l2_entry(u32 r[], struct rtl838x_l2_entry *e)
+{
+	/* Table contains different entry types, we need to identify the right one:
+	 * Check for MC entries, first
+	 */
+	e->is_ip_mc = !!(r[2] & BIT(31));
+	e->is_ipv6_mc = !!(r[2] & BIT(30));
+	e->type = L2_INVALID;
+	if (!e->is_ip_mc && !e->is_ipv6_mc) {
+		e->mac[0] = (r[0] >> 12);
+		e->mac[1] = (r[0] >> 4);
+		e->mac[2] = ((r[1] >> 28) | (r[0] << 4));
+		e->mac[3] = (r[1] >> 20);
+		e->mac[4] = (r[1] >> 12);
+		e->mac[5] = (r[1] >> 4);
+
+		e->vid = (r[2] >> 4) & 0xfff;
+		e->rvid = (r[0] >> 20) & 0xfff;
+
+		/* Is it a unicast entry? check multicast bit */
+		if (!(e->mac[0] & 1)) {
+			e->is_static = !!((r[2] >> 18) & 1);
+			e->port = (r[2] >> 24) & 0x3f;
+			e->block_da = !!(r[2] & (1 << 19));
+			e->block_sa = !!(r[2] & (1 << 20));
+			e->suspended = !!(r[2] & (1 << 17));
+			e->next_hop = !!(r[2] & (1 << 16));
+			if (e->next_hop) {
+				pr_debug("Found next hop entry, need to read data\n");
+				e->nh_vlan_target = !!(r[2] & BIT(15));
+				e->nh_route_id = (r[2] >> 4) & 0x1ff;
+				e->vid = e->rvid;
+			}
+			e->age = (r[2] >> 21) & 3;
+			e->valid = true;
+			if (!(r[2] & 0xc0fd0000)) /* Check for valid entry */
+				e->valid = false;
+			else
+				e->type = L2_UNICAST;
+		} else {
+			e->valid = true;
+			e->type = L2_MULTICAST;
+			e->mc_portmask_index = (r[2] >> 6) & 0xfff;
+			e->vid = e->rvid;
+		}
+	} else { /* IPv4 and IPv6 multicast */
+		e->vid = e->rvid = (r[0] << 20) & 0xfff;
+		e->mc_gip = r[1];
+		e->mc_portmask_index = (r[2] >> 6) & 0xfff;
+	}
+	if (e->is_ip_mc) {
+		e->valid = true;
+		e->type = IP4_MULTICAST;
+	}
+	if (e->is_ipv6_mc) {
+		e->valid = true;
+		e->type = IP6_MULTICAST;
+	}
+	/* pr_info("%s: vid %d, rvid: %d\n", __func__, e->vid, e->rvid); */
+}
+
+/* Fills the 3 SoC table registers r[] with the information in the rtl838x_l2_entry */
+static void rtl839x_fill_l2_row(u32 r[], struct rtl838x_l2_entry *e)
+{
+	if (!e->valid) {
+		r[0] = r[1] = r[2] = 0;
+		return;
+	}
+
+	r[2] = e->is_ip_mc ? BIT(31) : 0;
+	r[2] |= e->is_ipv6_mc ? BIT(30) : 0;
+
+	if (!e->is_ip_mc  && !e->is_ipv6_mc) {
+		r[0] = ((u32)e->mac[0]) << 12;
+		r[0] |= ((u32)e->mac[1]) << 4;
+		r[0] |= ((u32)e->mac[2]) >> 4;
+		r[1] = ((u32)e->mac[2]) << 28;
+		r[1] |= ((u32)e->mac[3]) << 20;
+		r[1] |= ((u32)e->mac[4]) << 12;
+		r[1] |= ((u32)e->mac[5]) << 4;
+
+		if (!(e->mac[0] & 1)) { /* Not multicast */
+			r[2] |= e->is_static ? BIT(18) : 0;
+			r[0] |= ((u32)e->rvid) << 20;
+			r[2] |= e->port << 24;
+			r[2] |= e->block_da ? BIT(19) : 0;
+			r[2] |= e->block_sa ? BIT(20) : 0;
+			r[2] |= e->suspended ? BIT(17) : 0;
+			r[2] |= ((u32)e->age) << 21;
+			if (e->next_hop) {
+				r[2] |= BIT(16);
+				r[2] |= e->nh_vlan_target ? BIT(15) : 0;
+				r[2] |= (e->nh_route_id & 0x7ff) << 4;
+			} else {
+				r[2] |= e->vid << 4;
+			}
+			pr_debug("Write L2 NH: %08x %08x %08x\n", r[0], r[1], r[2]);
+		} else {  /* L2 Multicast */
+			r[0] |= ((u32)e->rvid) << 20;
+			r[2] |= ((u32)e->mc_portmask_index) << 6;
+		}
+	} else { /* IPv4 or IPv6 MC entry */
+		r[0] = ((u32)e->rvid) << 20;
+		r[1] = e->mc_gip;
+		r[2] |= ((u32)e->mc_portmask_index) << 6;
+	}
+}
+
+/* Read an L2 UC or MC entry out of a hash bucket of the L2 forwarding table
+ * hash is the id of the bucket and pos is the position of the entry in that bucket
+ * The data read from the SoC is filled into rtl838x_l2_entry
+ */
+static u64 rtl839x_read_l2_entry_using_hash(u32 hash, u32 pos, struct rtl838x_l2_entry *e)
+{
+	u32 r[3];
+	struct table_reg *q = rtl_table_get(RTL8390_TBL_L2, 0);
+	u32 idx = (0 << 14) | (hash << 2) | pos; /* Search SRAM, with hash and at pos in bucket */
+
+	rtl_table_read(q, idx);
+	for (int i = 0; i < 3; i++)
+		r[i] = sw_r32(rtl_table_data(q, i));
+
+	rtl_table_release(q);
+
+	rtl839x_fill_l2_entry(r, e);
+	if (!e->valid)
+		return 0;
+
+	return rtl839x_l2_hash_seed(ether_addr_to_u64(&e->mac[0]), e->rvid);
+}
+
+static void rtl839x_write_l2_entry_using_hash(u32 hash, u32 pos, struct rtl838x_l2_entry *e)
+{
+	u32 r[3];
+	struct table_reg *q = rtl_table_get(RTL8390_TBL_L2, 0);
+
+	u32 idx = (0 << 14) | (hash << 2) | pos; /* Access SRAM, with hash and at pos in bucket */
+
+	rtl839x_fill_l2_row(r, e);
+
+	for (int i = 0; i < 3; i++)
+		sw_w32(r[i], rtl_table_data(q, i));
+
+	rtl_table_write(q, idx);
+	rtl_table_release(q);
+}
+
+static u64 rtl839x_read_cam(int idx, struct rtl838x_l2_entry *e)
+{
+	u32 r[3];
+	struct table_reg *q = rtl_table_get(RTL8390_TBL_L2, 1); /* Access L2 Table 1 */
+
+	rtl_table_read(q, idx);
+	for (int i = 0; i < 3; i++)
+		r[i] = sw_r32(rtl_table_data(q, i));
+
+	rtl_table_release(q);
+
+	rtl839x_fill_l2_entry(r, e);
+	if (!e->valid)
+		return 0;
+
+	pr_debug("Found in CAM: R1 %x R2 %x R3 %x\n", r[0], r[1], r[2]);
+
+	/* Return MAC with concatenated VID ac concatenated ID */
+	return rtl839x_l2_hash_seed(ether_addr_to_u64(&e->mac[0]), e->rvid);
+}
+
+static void rtl839x_write_cam(int idx, struct rtl838x_l2_entry *e)
+{
+	u32 r[3];
+	struct table_reg *q = rtl_table_get(RTL8390_TBL_L2, 1); /* Access L2 Table 1 */
+
+	rtl839x_fill_l2_row(r, e);
+
+	for (int i = 0; i < 3; i++)
+		sw_w32(r[i], rtl_table_data(q, i));
+
+	rtl_table_write(q, idx);
+	rtl_table_release(q);
+}
+
+static u64 rtl839x_read_mcast_pmask(int idx)
+{
+	u64 portmask;
+	/* Read MC_PMSK (2) via register RTL8390_TBL_L2 */
+	struct table_reg *q = rtl_table_get(RTL8390_TBL_L2, 2);
+
+	rtl_table_read(q, idx);
+	portmask = sw_r32(rtl_table_data(q, 0));
+	portmask <<= 32;
+	portmask |= sw_r32(rtl_table_data(q, 1));
+	portmask >>= 11;  /* LSB is bit 11 in data registers */
+	rtl_table_release(q);
+
+	return portmask;
+}
+
+static void rtl839x_write_mcast_pmask(int idx, u64 portmask)
+{
+	/* Access MC_PMSK (2) via register RTL8380_TBL_L2 */
+	struct table_reg *q = rtl_table_get(RTL8390_TBL_L2, 2);
+
+	portmask <<= 11; /* LSB is bit 11 in data registers */
+	sw_w32((u32)(portmask >> 32), rtl_table_data(q, 0));
+	sw_w32((u32)((portmask & 0xfffff800)), rtl_table_data(q, 1));
+	rtl_table_write(q, idx);
+	rtl_table_release(q);
+}
+
+static void rtl839x_vlan_profile_setup(int profile)
+{
+	u32 p[2];
+	u32 pmask_id = UNKNOWN_MC_PMASK;
+
+	p[0] = pmask_id; /* Use portmaks 0xfff for unknown IPv6 MC flooding */
+	/* Enable L2 Learning BIT 0, portmask UNKNOWN_MC_PMASK for IP/L2-MC traffic flooding */
+	p[1] = 1 | pmask_id << 1 | pmask_id << 13;
+
+	sw_w32(p[0], RTL839X_VLAN_PROFILE(profile));
+	sw_w32(p[1], RTL839X_VLAN_PROFILE(profile) + 4);
+
+	rtl839x_write_mcast_pmask(UNKNOWN_MC_PMASK, 0x001fffffffffffff);
+}
+
+u64 rtl839x_traffic_get(int source)
+{
+	return rtl839x_get_port_reg_be(rtl839x_port_iso_ctrl(source));
+}
+
+void rtl839x_traffic_set(int source, u64 dest_matrix)
+{
+	rtl839x_set_port_reg_be(dest_matrix, rtl839x_port_iso_ctrl(source));
+}
+
+void rtl839x_traffic_enable(int source, int dest)
+{
+	rtl839x_mask_port_reg_be(0, BIT_ULL(dest), rtl839x_port_iso_ctrl(source));
+}
+
+void rtl839x_traffic_disable(int source, int dest)
+{
+	rtl839x_mask_port_reg_be(BIT_ULL(dest), 0, rtl839x_port_iso_ctrl(source));
+}
+
+static void rtl839x_l2_learning_setup(void)
+{
+	/* Set portmask for broadcast (offset bit 12) and unknown unicast (offset 0)
+	 * address flooding to the reserved entry in the portmask table used
+	 * also for multicast flooding */
+	sw_w32(UNKNOWN_MC_PMASK << 12 | UNKNOWN_MC_PMASK, RTL839X_L2_FLD_PMSK);
+
+	/* Limit learning to maximum: 32k entries, after that just flood (bits 0-1) */
+	sw_w32((0x7fff << 2) | 0, RTL839X_L2_LRN_CONSTRT);
+
+	/* Do not trap ARP packets to CPU_PORT */
+	sw_w32(0, RTL839X_SPCL_TRAP_ARP_CTRL);
+}
+
+static void rtl839x_enable_learning(int port, bool enable)
+{
+	/* Limit learning to maximum: 32k entries */
+
+	sw_w32_mask(0x7fff << 2, enable ? (0x7fff << 2) : 0,
+		    RTL839X_L2_PORT_LRN_CONSTRT + (port << 2));
+}
+
+static void rtl839x_enable_flood(int port, bool enable)
+{
+	/* 0: Forward
+	 * 1: Disable
+	 * 2: to CPU
+	 * 3: Copy to CPU
+	 */
+	sw_w32_mask(0x3, enable ? 0 : 1,
+		    RTL839X_L2_PORT_LRN_CONSTRT + (port << 2));
+}
+
+static void rtl839x_enable_mcast_flood(int port, bool enable)
+{
+
+}
+
+static void rtl839x_enable_bcast_flood(int port, bool enable)
+{
+
+}
+
+static void rtl839x_set_static_move_action(int port, bool forward)
+{
+	int shift = MV_ACT_PORT_SHIFT(port);
+	u32 val = forward ? MV_ACT_FORWARD : MV_ACT_DROP;
+
+	sw_w32_mask(MV_ACT_MASK << shift, val << shift,
+		    RTL839X_L2_PORT_STATIC_MV_ACT(port));
+}
+
+irqreturn_t rtl839x_switch_irq(int irq, void *dev_id)
+{
+	struct dsa_switch *ds = dev_id;
+	u32 status = sw_r32(RTL839X_ISR_GLB_SRC);
+	u64 ports = rtl839x_get_port_reg_le(RTL839X_ISR_PORT_LINK_STS_CHG);
+	u64 link;
+
+	/* Clear status */
+	rtl839x_set_port_reg_le(ports, RTL839X_ISR_PORT_LINK_STS_CHG);
+	pr_debug("RTL8390 Link change: status: %x, ports %llx\n", status, ports);
+
+	for (int i = 0; i < RTL839X_CPU_PORT; i++) {
+		if (ports & BIT_ULL(i)) {
+			link = rtl839x_get_port_reg_le(RTL839X_MAC_LINK_STS);
+			if (link & BIT_ULL(i))
+				dsa_port_phylink_mac_change(ds, i, true);
+			else
+				dsa_port_phylink_mac_change(ds, i, false);
+		}
+	}
+
+	return IRQ_HANDLED;
+}
+
+/* TODO: unused */
+int rtl8390_sds_power(int mac, int val)
+{
+	u32 offset = (mac == 48) ? 0x0 : 0x100;
+	u32 mode = val ? 0 : 1;
+
+	pr_debug("In %s: mac %d, set %d\n", __func__, mac, val);
+
+	if ((mac != 48) && (mac != 49)) {
+		pr_err("%s: not an SFP port: %d\n", __func__, mac);
+		return -1;
+	}
+
+	/* Set bit 1003. 1000 starts at 7c */
+	sw_w32_mask(BIT(11), mode << 11, RTL839X_SDS12_13_PWR0 + offset);
+
+	return 0;
+}
+
+static int rtl839x_smi_wait_op(int timeout)
+{
+	int ret = 0;
+	u32 val;
+
+	ret = readx_poll_timeout(sw_r32, RTL839X_PHYREG_ACCESS_CTRL,
+				 val, !(val & 0x1), 20, timeout);
+	if (ret)
+		pr_err("%s: timeout\n", __func__);
+
+	return ret;
+}
+
+int rtl839x_read_phy(u32 port, u32 page, u32 reg, u32 *val)
+{
+	u32 v;
+	int err = 0;
+
+	if (port > 63 || page > 4095 || reg > 31)
+		return -ENOTSUPP;
+
+	/* Take bug on RTL839x Rev <= C into account */
+	if (port >= RTL839X_CPU_PORT)
+		return -EIO;
+
+	mutex_lock(&smi_lock);
+
+	sw_w32_mask(0xffff0000, port << 16, RTL839X_PHYREG_DATA_CTRL);
+	v = reg << 5 | page << 10 | ((page == 0x1fff) ? 0x1f : 0) << 23;
+	sw_w32(v, RTL839X_PHYREG_ACCESS_CTRL);
+
+	sw_w32(0x1ff, RTL839X_PHYREG_CTRL);
+
+	v |= 1;
+	sw_w32(v, RTL839X_PHYREG_ACCESS_CTRL);
+
+	err = rtl839x_smi_wait_op(100000);
+	if (err)
+		goto errout;
+
+	*val = sw_r32(RTL839X_PHYREG_DATA_CTRL) & 0xffff;
+
+errout:
+	mutex_unlock(&smi_lock);
+
+	return err;
+}
+
+int rtl839x_write_phy(u32 port, u32 page, u32 reg, u32 val)
+{
+	u32 v;
+	int err = 0;
+
+	val &= 0xffff;
+	if (port > 63 || page > 4095 || reg > 31)
+		return -ENOTSUPP;
+
+	/* Take bug on RTL839x Rev <= C into account */
+	if (port >= RTL839X_CPU_PORT)
+		return -EIO;
+
+	mutex_lock(&smi_lock);
+
+	/* Set PHY to access */
+	rtl839x_set_port_reg_le(BIT_ULL(port), RTL839X_PHYREG_PORT_CTRL);
+
+	sw_w32_mask(0xffff0000, val << 16, RTL839X_PHYREG_DATA_CTRL);
+
+	v = reg << 5 | page << 10 | ((page == 0x1fff) ? 0x1f : 0) << 23;
+	sw_w32(v, RTL839X_PHYREG_ACCESS_CTRL);
+
+	sw_w32(0x1ff, RTL839X_PHYREG_CTRL);
+
+	v |= BIT(3) | 1; /* Write operation and execute */
+	sw_w32(v, RTL839X_PHYREG_ACCESS_CTRL);
+
+	err = rtl839x_smi_wait_op(100000);
+	if (err)
+		goto errout;
+
+	if (sw_r32(RTL839X_PHYREG_ACCESS_CTRL) & 0x2)
+		err = -EIO;
+
+errout:
+	mutex_unlock(&smi_lock);
+
+	return err;
+}
+
+/* Read an mmd register of the PHY */
+int rtl839x_read_mmd_phy(u32 port, u32 devnum, u32 regnum, u32 *val)
+{
+	int err = 0;
+	u32 v;
+
+	/* Take bug on RTL839x Rev <= C into account */
+	if (port >= RTL839X_CPU_PORT)
+		return -EIO;
+
+	mutex_lock(&smi_lock);
+
+	/* Set PHY to access */
+	sw_w32_mask(0xffff << 16, port << 16, RTL839X_PHYREG_DATA_CTRL);
+
+	/* Set MMD device number and register to write to */
+	sw_w32(devnum << 16 | (regnum & 0xffff), RTL839X_PHYREG_MMD_CTRL);
+
+	v = BIT(2) | BIT(0); /* MMD-access | EXEC */
+	sw_w32(v, RTL839X_PHYREG_ACCESS_CTRL);
+
+	err = rtl839x_smi_wait_op(100000);
+	if (err)
+		goto errout;
+
+	/* There is no error-checking via BIT 1 of v, as it does not seem to be set correctly */
+	*val = (sw_r32(RTL839X_PHYREG_DATA_CTRL) & 0xffff);
+	pr_debug("%s: port %d, regnum: %x, val: %x (err %d)\n", __func__, port, regnum, *val, err);
+
+errout:
+	mutex_unlock(&smi_lock);
+
+	return err;
+}
+
+/* Write to an mmd register of the PHY */
+int rtl839x_write_mmd_phy(u32 port, u32 devnum, u32 regnum, u32 val)
+{
+	int err = 0;
+	u32 v;
+
+	/* Take bug on RTL839x Rev <= C into account */
+	if (port >= RTL839X_CPU_PORT)
+		return -EIO;
+
+	mutex_lock(&smi_lock);
+
+	/* Set PHY to access */
+	rtl839x_set_port_reg_le(BIT_ULL(port), RTL839X_PHYREG_PORT_CTRL);
+
+	/* Set data to write */
+	sw_w32_mask(0xffff << 16, val << 16, RTL839X_PHYREG_DATA_CTRL);
+
+	/* Set MMD device number and register to write to */
+	sw_w32(devnum << 16 | (regnum & 0xffff), RTL839X_PHYREG_MMD_CTRL);
+
+	v = BIT(3) | BIT(2) | BIT(0); /* WRITE | MMD-access | EXEC */
+	sw_w32(v, RTL839X_PHYREG_ACCESS_CTRL);
+
+	err = rtl839x_smi_wait_op(100000);
+	if (err)
+		goto errout;
+
+	pr_debug("%s: port %d, regnum: %x, val: %x (err %d)\n", __func__, port, regnum, val, err);
+
+errout:
+	mutex_unlock(&smi_lock);
+
+	return err;
+}
+
+void rtl8390_get_version(struct rtl838x_switch_priv *priv)
+{
+	u32 info, model;
+
+	sw_w32_mask(0xf << 28, 0xa << 28, RTL839X_CHIP_INFO);
+	info = sw_r32(RTL839X_CHIP_INFO);
+
+	model = sw_r32(RTL839X_MODEL_NAME_INFO);
+	priv->version = RTL8390_VERSION_A + ((model & 0x3f) >> 1);
+
+	pr_info("RTL839X Chip-Info: %x, version %c\n", info, priv->version);
+}
+
+void rtl839x_vlan_profile_dump(int profile)
+{
+	u32 p[2];
+
+	if (profile < 0 || profile > 7)
+		return;
+
+	p[0] = sw_r32(RTL839X_VLAN_PROFILE(profile));
+	p[1] = sw_r32(RTL839X_VLAN_PROFILE(profile) + 4);
+
+	pr_info("VLAN profile %d: L2 learning: %d, UNKN L2MC FLD PMSK %d, \
+		UNKN IPMC FLD PMSK %d, UNKN IPv6MC FLD PMSK: %d",
+		profile, p[1] & 1, (p[1] >> 1) & 0xfff, (p[1] >> 13) & 0xfff,
+		(p[0]) & 0xfff);
+	pr_info("VLAN profile %d: raw %08x, %08x\n", profile, p[0], p[1]);
+}
+
+static void rtl839x_stp_get(struct rtl838x_switch_priv *priv, u16 msti, u32 port_state[])
+{
+	u32 cmd = 1 << 16 | /* Execute cmd */
+	          0 << 15 | /* Read */
+	          5 << 12 | /* Table type 0b101 */
+	          (msti & 0xfff);
+	priv->r->exec_tbl0_cmd(cmd);
+
+	for (int i = 0; i < 4; i++)
+		port_state[i] = sw_r32(priv->r->tbl_access_data_0(i));
+}
+
+static void rtl839x_stp_set(struct rtl838x_switch_priv *priv, u16 msti, u32 port_state[])
+{
+	u32 cmd = 1 << 16 | /* Execute cmd */
+	          1 << 15 | /* Write */
+	          5 << 12 | /* Table type 0b101 */
+	          (msti & 0xfff);
+	for (int i = 0; i < 4; i++)
+		sw_w32(port_state[i], priv->r->tbl_access_data_0(i));
+	priv->r->exec_tbl0_cmd(cmd);
+}
+
+/* Enables or disables the EEE/EEEP capability of a port */
+void rtl839x_port_eee_set(struct rtl838x_switch_priv *priv, int port, bool enable)
+{
+	u32 v;
+
+	/* This works only for Ethernet ports, and on the RTL839X, ports above 47 are SFP */
+	if (port >= 48)
+		return;
+
+	enable = true;
+	pr_debug("In %s: setting port %d to %d\n", __func__, port, enable);
+	v = enable ? 0xf : 0x0;
+
+	/* Set EEE for 100, 500, 1000MBit and 10GBit */
+	sw_w32_mask(0xf << 8, v << 8, rtl839x_mac_force_mode_ctrl(port));
+
+	/* Set TX/RX EEE state */
+	v = enable ? 0x3 : 0x0;
+	sw_w32(v, RTL839X_EEE_CTRL(port));
+
+	priv->ports[port].eee_enabled = enable;
+}
+
+/* Get EEE own capabilities and negotiation result */
+int rtl839x_eee_port_ability(struct rtl838x_switch_priv *priv, struct ethtool_eee *e, int port)
+{
+	u64 link, a;
+
+	if (port >= 48)
+		return 0;
+
+	link = rtl839x_get_port_reg_le(RTL839X_MAC_LINK_STS);
+	if (!(link & BIT_ULL(port)))
+		return 0;
+
+	if (sw_r32(rtl839x_mac_force_mode_ctrl(port)) & BIT(8))
+		e->advertised |= ADVERTISED_100baseT_Full;
+
+	if (sw_r32(rtl839x_mac_force_mode_ctrl(port)) & BIT(10))
+		e->advertised |= ADVERTISED_1000baseT_Full;
+
+	a = rtl839x_get_port_reg_le(RTL839X_MAC_EEE_ABLTY);
+	pr_info("Link partner: %016llx\n", a);
+	if (rtl839x_get_port_reg_le(RTL839X_MAC_EEE_ABLTY) & BIT_ULL(port)) {
+		e->lp_advertised = ADVERTISED_100baseT_Full;
+		e->lp_advertised |= ADVERTISED_1000baseT_Full;
+		return 1;
+	}
+
+	return 0;
+}
+
+static void rtl839x_init_eee(struct rtl838x_switch_priv *priv, bool enable)
+{
+	pr_info("Setting up EEE, state: %d\n", enable);
+
+	/* Set wake timer for TX and pause timer both to 0x21 */
+	sw_w32_mask(0xff << 20| 0xff, 0x21 << 20| 0x21, RTL839X_EEE_TX_TIMER_GELITE_CTRL);
+	/* Set pause wake timer for GIGA-EEE to 0x11 */
+	sw_w32_mask(0xff << 20, 0x11 << 20, RTL839X_EEE_TX_TIMER_GIGA_CTRL);
+	/* Set pause wake timer for 10GBit ports to 0x11 */
+	sw_w32_mask(0xff << 20, 0x11 << 20, RTL839X_EEE_TX_TIMER_10G_CTRL);
+
+	/* Setup EEE on all ports */
+	for (int i = 0; i < priv->cpu_port; i++) {
+		if (priv->ports[i].phy)
+			rtl839x_port_eee_set(priv, i, enable);
+	}
+	priv->eee_enabled = enable;
+}
+
+static void rtl839x_pie_lookup_enable(struct rtl838x_switch_priv *priv, int index)
+{
+	int block = index / PIE_BLOCK_SIZE;
+
+	sw_w32_mask(0, BIT(block), RTL839X_ACL_BLK_LOOKUP_CTRL);
+}
+
+/* Delete a range of Packet Inspection Engine rules */
+static int rtl839x_pie_rule_del(struct rtl838x_switch_priv *priv, int index_from, int index_to)
+{
+	u32 v = (index_from << 1)| (index_to << 13 ) | BIT(0);
+
+	pr_debug("%s: from %d to %d\n", __func__, index_from, index_to);
+	mutex_lock(&priv->reg_mutex);
+
+	/* Write from-to and execute bit into control register */
+	sw_w32(v, RTL839X_ACL_CLR_CTRL);
+
+	/* Wait until command has completed */
+	do {
+	} while (sw_r32(RTL839X_ACL_CLR_CTRL) & BIT(0));
+
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+/* Reads the intermediate representation of the templated match-fields of the
+ * PIE rule in the pie_rule structure and fills in the raw data fields in the
+ * raw register space r[].
+ * The register space configuration size is identical for the RTL8380/90 and RTL9300,
+ * however the RTL9310 has 2 more registers / fields and the physical field-ids are different
+ * on all SoCs
+ * On the RTL8390 the template mask registers are not word-aligned!
+ */
+static void rtl839x_write_pie_templated(u32 r[], struct pie_rule *pr, enum template_field_id t[])
+{
+	for (int i = 0; i < N_FIXED_FIELDS; i++) {
+		enum template_field_id field_type = t[i];
+		u16 data = 0, data_m = 0;
+
+		switch (field_type) {
+		case TEMPLATE_FIELD_SPM0:
+			data = pr->spm;
+			data_m = pr->spm_m;
+			break;
+		case TEMPLATE_FIELD_SPM1:
+			data = pr->spm >> 16;
+			data_m = pr->spm_m >> 16;
+			break;
+		case TEMPLATE_FIELD_SPM2:
+			data = pr->spm >> 32;
+			data_m = pr->spm_m >> 32;
+			break;
+		case TEMPLATE_FIELD_SPM3:
+			data = pr->spm >> 48;
+			data_m = pr->spm_m >> 48;
+			break;
+		case TEMPLATE_FIELD_OTAG:
+			data = pr->otag;
+			data_m = pr->otag_m;
+			break;
+		case TEMPLATE_FIELD_SMAC0:
+			data = pr->smac[4];
+			data = (data << 8) | pr->smac[5];
+			data_m = pr->smac_m[4];
+			data_m = (data_m << 8) | pr->smac_m[5];
+			break;
+		case TEMPLATE_FIELD_SMAC1:
+			data = pr->smac[2];
+			data = (data << 8) | pr->smac[3];
+			data_m = pr->smac_m[2];
+			data_m = (data_m << 8) | pr->smac_m[3];
+			break;
+		case TEMPLATE_FIELD_SMAC2:
+			data = pr->smac[0];
+			data = (data << 8) | pr->smac[1];
+			data_m = pr->smac_m[0];
+			data_m = (data_m << 8) | pr->smac_m[1];
+			break;
+		case TEMPLATE_FIELD_DMAC0:
+			data = pr->dmac[4];
+			data = (data << 8) | pr->dmac[5];
+			data_m = pr->dmac_m[4];
+			data_m = (data_m << 8) | pr->dmac_m[5];
+			break;
+		case TEMPLATE_FIELD_DMAC1:
+			data = pr->dmac[2];
+			data = (data << 8) | pr->dmac[3];
+			data_m = pr->dmac_m[2];
+			data_m = (data_m << 8) | pr->dmac_m[3];
+			break;
+		case TEMPLATE_FIELD_DMAC2:
+			data = pr->dmac[0];
+			data = (data << 8) | pr->dmac[1];
+			data_m = pr->dmac_m[0];
+			data_m = (data_m << 8) | pr->dmac_m[1];
+			break;
+		case TEMPLATE_FIELD_ETHERTYPE:
+			data = pr->ethertype;
+			data_m = pr->ethertype_m;
+			break;
+		case TEMPLATE_FIELD_ITAG:
+			data = pr->itag;
+			data_m = pr->itag_m;
+			break;
+		case TEMPLATE_FIELD_SIP0:
+			if (pr->is_ipv6) {
+				data = pr->sip6.s6_addr16[7];
+				data_m = pr->sip6_m.s6_addr16[7];
+			} else {
+				data = pr->sip;
+				data_m = pr->sip_m;
+			}
+			break;
+		case TEMPLATE_FIELD_SIP1:
+			if (pr->is_ipv6) {
+				data = pr->sip6.s6_addr16[6];
+				data_m = pr->sip6_m.s6_addr16[6];
+			} else {
+				data = pr->sip >> 16;
+				data_m = pr->sip_m >> 16;
+			}
+			break;
+		case TEMPLATE_FIELD_SIP2:
+		case TEMPLATE_FIELD_SIP3:
+		case TEMPLATE_FIELD_SIP4:
+		case TEMPLATE_FIELD_SIP5:
+		case TEMPLATE_FIELD_SIP6:
+		case TEMPLATE_FIELD_SIP7:
+			data = pr->sip6.s6_addr16[5 - (field_type - TEMPLATE_FIELD_SIP2)];
+			data_m = pr->sip6_m.s6_addr16[5 - (field_type - TEMPLATE_FIELD_SIP2)];
+			break;
+		case TEMPLATE_FIELD_DIP0:
+			if (pr->is_ipv6) {
+				data = pr->dip6.s6_addr16[7];
+				data_m = pr->dip6_m.s6_addr16[7];
+			} else {
+				data = pr->dip;
+				data_m = pr->dip_m;
+			}
+			break;
+		case TEMPLATE_FIELD_DIP1:
+			if (pr->is_ipv6) {
+				data = pr->dip6.s6_addr16[6];
+				data_m = pr->dip6_m.s6_addr16[6];
+			} else {
+				data = pr->dip >> 16;
+				data_m = pr->dip_m >> 16;
+			}
+			break;
+		case TEMPLATE_FIELD_DIP2:
+		case TEMPLATE_FIELD_DIP3:
+		case TEMPLATE_FIELD_DIP4:
+		case TEMPLATE_FIELD_DIP5:
+		case TEMPLATE_FIELD_DIP6:
+		case TEMPLATE_FIELD_DIP7:
+			data = pr->dip6.s6_addr16[5 - (field_type - TEMPLATE_FIELD_DIP2)];
+			data_m = pr->dip6_m.s6_addr16[5 - (field_type - TEMPLATE_FIELD_DIP2)];
+			break;
+		case TEMPLATE_FIELD_IP_TOS_PROTO:
+			data = pr->tos_proto;
+			data_m = pr->tos_proto_m;
+			break;
+		case TEMPLATE_FIELD_L4_SPORT:
+			data = pr->sport;
+			data_m = pr->sport_m;
+			break;
+		case TEMPLATE_FIELD_L4_DPORT:
+			data = pr->dport;
+			data_m = pr->dport_m;
+			break;
+		case TEMPLATE_FIELD_ICMP_IGMP:
+			data = pr->icmp_igmp;
+			data_m = pr->icmp_igmp_m;
+			break;
+		default:
+			pr_info("%s: unknown field %d\n", __func__, field_type);
+		}
+
+		/* On the RTL8390, the mask fields are not word aligned! */
+		if (!(i % 2)) {
+			r[5 - i / 2] = data;
+			r[12 - i / 2] |= ((u32)data_m << 8);
+		} else {
+			r[5 - i / 2] |= ((u32)data) << 16;
+			r[12 - i / 2] |= ((u32)data_m) << 24;
+			r[11 - i / 2] |= ((u32)data_m) >> 8;
+		}
+	}
+}
+
+/* Creates the intermediate representation of the templated match-fields of the
+ * PIE rule in the pie_rule structure by reading the raw data fields in the
+ * raw register space r[].
+ * The register space configuration size is identical for the RTL8380/90 and RTL9300,
+ * however the RTL9310 has 2 more registers / fields and the physical field-ids
+ * On the RTL8390 the template mask registers are not word-aligned!
+ */
+void rtl839x_read_pie_templated(u32 r[], struct pie_rule *pr, enum template_field_id t[])
+{
+	for (int i = 0; i < N_FIXED_FIELDS; i++) {
+		enum template_field_id field_type = t[i];
+		u16 data, data_m;
+
+		if (!(i % 2)) {
+			data = r[5 - i / 2];
+			data_m = r[12 - i / 2];
+		} else {
+			data = r[5 - i / 2] >> 16;
+			data_m = r[12 - i / 2] >> 16;
+		}
+
+		switch (field_type) {
+		case TEMPLATE_FIELD_SPM0:
+			pr->spm = (pr->spn << 16) | data;
+			pr->spm_m = (pr->spn << 16) | data_m;
+			break;
+		case TEMPLATE_FIELD_SPM1:
+			pr->spm = data;
+			pr->spm_m = data_m;
+			break;
+		case TEMPLATE_FIELD_OTAG:
+			pr->otag = data;
+			pr->otag_m = data_m;
+			break;
+		case TEMPLATE_FIELD_SMAC0:
+			pr->smac[4] = data >> 8;
+			pr->smac[5] = data;
+			pr->smac_m[4] = data >> 8;
+			pr->smac_m[5] = data;
+			break;
+		case TEMPLATE_FIELD_SMAC1:
+			pr->smac[2] = data >> 8;
+			pr->smac[3] = data;
+			pr->smac_m[2] = data >> 8;
+			pr->smac_m[3] = data;
+			break;
+		case TEMPLATE_FIELD_SMAC2:
+			pr->smac[0] = data >> 8;
+			pr->smac[1] = data;
+			pr->smac_m[0] = data >> 8;
+			pr->smac_m[1] = data;
+			break;
+		case TEMPLATE_FIELD_DMAC0:
+			pr->dmac[4] = data >> 8;
+			pr->dmac[5] = data;
+			pr->dmac_m[4] = data >> 8;
+			pr->dmac_m[5] = data;
+			break;
+		case TEMPLATE_FIELD_DMAC1:
+			pr->dmac[2] = data >> 8;
+			pr->dmac[3] = data;
+			pr->dmac_m[2] = data >> 8;
+			pr->dmac_m[3] = data;
+			break;
+		case TEMPLATE_FIELD_DMAC2:
+			pr->dmac[0] = data >> 8;
+			pr->dmac[1] = data;
+			pr->dmac_m[0] = data >> 8;
+			pr->dmac_m[1] = data;
+			break;
+		case TEMPLATE_FIELD_ETHERTYPE:
+			pr->ethertype = data;
+			pr->ethertype_m = data_m;
+			break;
+		case TEMPLATE_FIELD_ITAG:
+			pr->itag = data;
+			pr->itag_m = data_m;
+			break;
+		case TEMPLATE_FIELD_SIP0:
+			pr->sip = data;
+			pr->sip_m = data_m;
+			break;
+		case TEMPLATE_FIELD_SIP1:
+			pr->sip = (pr->sip << 16) | data;
+			pr->sip_m = (pr->sip << 16) | data_m;
+			break;
+		case TEMPLATE_FIELD_SIP2:
+			pr->is_ipv6 = true;
+			/* Make use of limitiations on the position of the match values */
+			ipv6_addr_set(&pr->sip6, pr->sip, r[5 - i / 2],
+				      r[4 - i / 2], r[3 - i / 2]);
+			ipv6_addr_set(&pr->sip6_m, pr->sip_m, r[5 - i / 2],
+				      r[4 - i / 2], r[3 - i / 2]);
+		case TEMPLATE_FIELD_SIP3:
+		case TEMPLATE_FIELD_SIP4:
+		case TEMPLATE_FIELD_SIP5:
+		case TEMPLATE_FIELD_SIP6:
+		case TEMPLATE_FIELD_SIP7:
+			break;
+
+		case TEMPLATE_FIELD_DIP0:
+			pr->dip = data;
+			pr->dip_m = data_m;
+			break;
+
+		case TEMPLATE_FIELD_DIP1:
+			pr->dip = (pr->dip << 16) | data;
+			pr->dip_m = (pr->dip << 16) | data_m;
+			break;
+
+		case TEMPLATE_FIELD_DIP2:
+			pr->is_ipv6 = true;
+			ipv6_addr_set(&pr->dip6, pr->dip, r[5 - i / 2],
+				      r[4 - i / 2], r[3 - i / 2]);
+			ipv6_addr_set(&pr->dip6_m, pr->dip_m, r[5 - i / 2],
+				      r[4 - i / 2], r[3 - i / 2]);
+		case TEMPLATE_FIELD_DIP3:
+		case TEMPLATE_FIELD_DIP4:
+		case TEMPLATE_FIELD_DIP5:
+		case TEMPLATE_FIELD_DIP6:
+		case TEMPLATE_FIELD_DIP7:
+			break;
+		case TEMPLATE_FIELD_IP_TOS_PROTO:
+			pr->tos_proto = data;
+			pr->tos_proto_m = data_m;
+			break;
+		case TEMPLATE_FIELD_L4_SPORT:
+			pr->sport = data;
+			pr->sport_m = data_m;
+			break;
+		case TEMPLATE_FIELD_L4_DPORT:
+			pr->dport = data;
+			pr->dport_m = data_m;
+			break;
+		case TEMPLATE_FIELD_ICMP_IGMP:
+			pr->icmp_igmp = data;
+			pr->icmp_igmp_m = data_m;
+			break;
+		default:
+			pr_info("%s: unknown field %d\n", __func__, field_type);
+		}
+	}
+}
+
+static void rtl839x_read_pie_fixed_fields(u32 r[], struct pie_rule *pr)
+{
+	pr->spmmask_fix = (r[6] >> 30) & 0x3;
+	pr->spn = (r[6] >> 24) & 0x3f;
+	pr->mgnt_vlan = (r[6] >> 23) & 1;
+	pr->dmac_hit_sw = (r[6] >> 22) & 1;
+	pr->not_first_frag = (r[6] >> 21) & 1;
+	pr->frame_type_l4 = (r[6] >> 18) & 7;
+	pr->frame_type = (r[6] >> 16) & 3;
+	pr->otag_fmt = (r[6] >> 15) & 1;
+	pr->itag_fmt = (r[6] >> 14) & 1;
+	pr->otag_exist = (r[6] >> 13) & 1;
+	pr->itag_exist = (r[6] >> 12) & 1;
+	pr->frame_type_l2 = (r[6] >> 10) & 3;
+	pr->tid = (r[6] >> 8) & 3;
+
+	pr->spmmask_fix_m = (r[12] >> 6) & 0x3;
+	pr->spn_m = r[12]  & 0x3f;
+	pr->mgnt_vlan_m = (r[13] >> 31) & 1;
+	pr->dmac_hit_sw_m = (r[13] >> 30) & 1;
+	pr->not_first_frag_m = (r[13] >> 29) & 1;
+	pr->frame_type_l4_m = (r[13] >> 26) & 7;
+	pr->frame_type_m = (r[13] >> 24) & 3;
+	pr->otag_fmt_m = (r[13] >> 23) & 1;
+	pr->itag_fmt_m = (r[13] >> 22) & 1;
+	pr->otag_exist_m = (r[13] >> 21) & 1;
+	pr->itag_exist_m = (r[13] >> 20) & 1;
+	pr->frame_type_l2_m = (r[13] >> 18) & 3;
+	pr->tid_m = (r[13] >> 16) & 3;
+
+	pr->valid = r[13] & BIT(15);
+	pr->cond_not = r[13] & BIT(14);
+	pr->cond_and1 = r[13] & BIT(13);
+	pr->cond_and2 = r[13] & BIT(12);
+}
+
+static void rtl839x_write_pie_fixed_fields(u32 r[],  struct pie_rule *pr)
+{
+	r[6] = ((u32) (pr->spmmask_fix & 0x3)) << 30;
+	r[6] |= ((u32) (pr->spn & 0x3f)) << 24;
+	r[6] |= pr->mgnt_vlan ? BIT(23) : 0;
+	r[6] |= pr->dmac_hit_sw ? BIT(22) : 0;
+	r[6] |= pr->not_first_frag ? BIT(21) : 0;
+	r[6] |= ((u32) (pr->frame_type_l4 & 0x7)) << 18;
+	r[6] |= ((u32) (pr->frame_type & 0x3)) << 16;
+	r[6] |= pr->otag_fmt ? BIT(15) : 0;
+	r[6] |= pr->itag_fmt ? BIT(14) : 0;
+	r[6] |= pr->otag_exist ? BIT(13) : 0;
+	r[6] |= pr->itag_exist ? BIT(12) : 0;
+	r[6] |= ((u32) (pr->frame_type_l2 & 0x3)) << 10;
+	r[6] |= ((u32) (pr->tid & 0x3)) << 8;
+
+	r[12] |= ((u32) (pr->spmmask_fix_m & 0x3)) << 6;
+	r[12] |= (u32) (pr->spn_m & 0x3f);
+	r[13] |= pr->mgnt_vlan_m ? BIT(31) : 0;
+	r[13] |= pr->dmac_hit_sw_m ? BIT(30) : 0;
+	r[13] |= pr->not_first_frag_m ? BIT(29) : 0;
+	r[13] |= ((u32) (pr->frame_type_l4_m & 0x7)) << 26;
+	r[13] |= ((u32) (pr->frame_type_m & 0x3)) << 24;
+	r[13] |= pr->otag_fmt_m ? BIT(23) : 0;
+	r[13] |= pr->itag_fmt_m ? BIT(22) : 0;
+	r[13] |= pr->otag_exist_m ? BIT(21) : 0;
+	r[13] |= pr->itag_exist_m ? BIT(20) : 0;
+	r[13] |= ((u32) (pr->frame_type_l2_m & 0x3)) << 18;
+	r[13] |= ((u32) (pr->tid_m & 0x3)) << 16;
+
+	r[13] |= pr->valid ? BIT(15) : 0;
+	r[13] |= pr->cond_not ? BIT(14) : 0;
+	r[13] |= pr->cond_and1 ? BIT(13) : 0;
+	r[13] |= pr->cond_and2 ? BIT(12) : 0;
+}
+
+static void rtl839x_write_pie_action(u32 r[],  struct pie_rule *pr)
+{
+	if (pr->drop) {
+		r[13] |= 0x9;	/* Set ACT_MASK_FWD & FWD_ACT = DROP */
+		r[13] |= BIT(3);
+	} else {
+		r[13] |= pr->fwd_sel ? BIT(3) : 0;
+		r[13] |= pr->fwd_act;
+	}
+	r[13] |= pr->bypass_sel ? BIT(11) : 0;
+	r[13] |= pr->mpls_sel ? BIT(10) : 0;
+	r[13] |= pr->nopri_sel ? BIT(9) : 0;
+	r[13] |= pr->ovid_sel ? BIT(8) : 0;
+	r[13] |= pr->ivid_sel ? BIT(7) : 0;
+	r[13] |= pr->meter_sel ? BIT(6) : 0;
+	r[13] |= pr->mir_sel ? BIT(5) : 0;
+	r[13] |= pr->log_sel ? BIT(4) : 0;
+
+	r[14] |= ((u32)(pr->fwd_data & 0x3fff)) << 18;
+	r[14] |= pr->log_octets ? BIT(17) : 0;
+	r[14] |= ((u32)(pr->log_data & 0x7ff)) << 4;
+	r[14] |= (pr->mir_data & 0x3) << 3;
+	r[14] |= ((u32)(pr->meter_data >> 7)) & 0x7;
+	r[15] |= (u32)(pr->meter_data) << 26;
+	r[15] |= ((u32)(pr->ivid_act) << 23) & 0x3;
+	r[15] |= ((u32)(pr->ivid_data) << 9) & 0xfff;
+	r[15] |= ((u32)(pr->ovid_act) << 6) & 0x3;
+	r[15] |= ((u32)(pr->ovid_data) >> 4) & 0xff;
+	r[16] |= ((u32)(pr->ovid_data) & 0xf) << 28;
+	r[16] |= ((u32)(pr->nopri_data) & 0x7) << 20;
+	r[16] |= ((u32)(pr->mpls_act) & 0x7) << 20;
+	r[16] |= ((u32)(pr->mpls_lib_idx) & 0x7) << 20;
+	r[16] |= pr->bypass_all ? BIT(9) : 0;
+	r[16] |= pr->bypass_igr_stp ? BIT(8) : 0;
+	r[16] |= pr->bypass_ibc_sc ? BIT(7) : 0;
+}
+
+static void rtl839x_read_pie_action(u32 r[],  struct pie_rule *pr)
+{
+	if (r[13] & BIT(3)) { /* ACT_MASK_FWD set, is it a drop? */
+		if ((r[14] & 0x7) == 1) {
+			pr->drop = true;
+		} else {
+			pr->fwd_sel = true;
+			pr->fwd_act = r[14] & 0x7;
+		}
+	}
+
+	pr->bypass_sel = r[13] & BIT(11);
+	pr->mpls_sel = r[13] & BIT(10);
+	pr->nopri_sel = r[13] & BIT(9);
+	pr->ovid_sel = r[13] & BIT(8);
+	pr->ivid_sel = r[13] & BIT(7);
+	pr->meter_sel = r[13] & BIT(6);
+	pr->mir_sel = r[13] & BIT(5);
+	pr->log_sel = r[13] & BIT(4);
+
+	/* TODO: Read in data fields */
+
+	pr->bypass_all = r[16] & BIT(9);
+	pr->bypass_igr_stp = r[16] & BIT(8);
+	pr->bypass_ibc_sc = r[16] & BIT(7);
+}
+
+void rtl839x_pie_rule_dump_raw(u32 r[])
+{
+	pr_info("Raw IACL table entry:\n");
+	pr_info("Match  : %08x %08x %08x %08x %08x %08x\n", r[0], r[1], r[2], r[3], r[4], r[5]);
+	pr_info("Fixed  : %06x\n", r[6] >> 8);
+	pr_info("Match M: %08x %08x %08x %08x %08x %08x\n",
+		(r[6] << 24) | (r[7] >> 8), (r[7] << 24) | (r[8] >> 8), (r[8] << 24) | (r[9] >> 8),
+		(r[9] << 24) | (r[10] >> 8), (r[10] << 24) | (r[11] >> 8),
+		(r[11] << 24) | (r[12] >> 8));
+	pr_info("R[13]:   %08x\n", r[13]);
+	pr_info("Fixed M: %06x\n", ((r[12] << 16) | (r[13] >> 16)) & 0xffffff);
+	pr_info("Valid / not / and1 / and2 : %1x\n", (r[13] >> 12) & 0xf);
+	pr_info("r 13-16: %08x %08x %08x %08x\n", r[13], r[14], r[15], r[16]);
+}
+
+void rtl839x_pie_rule_dump(struct  pie_rule *pr)
+{
+	pr_info("Drop: %d, fwd: %d, ovid: %d, ivid: %d, flt: %d, log: %d, rmk: %d, meter: %d tagst: %d, mir: %d, nopri: %d, cpupri: %d, otpid: %d, itpid: %d, shape: %d\n",
+		pr->drop, pr->fwd_sel, pr->ovid_sel, pr->ivid_sel, pr->flt_sel, pr->log_sel, pr->rmk_sel, pr->log_sel, pr->tagst_sel, pr->mir_sel, pr->nopri_sel,
+		pr->cpupri_sel, pr->otpid_sel, pr->itpid_sel, pr->shaper_sel);
+	if (pr->fwd_sel)
+		pr_info("FWD: %08x\n", pr->fwd_data);
+	pr_info("TID: %x, %x\n", pr->tid, pr->tid_m);
+}
+
+static int rtl839x_pie_rule_read(struct rtl838x_switch_priv *priv, int idx, struct  pie_rule *pr)
+{
+	/* Read IACL table (2) via register 0 */
+	struct table_reg *q = rtl_table_get(RTL8380_TBL_0, 2);
+	u32 r[17];
+	int block = idx / PIE_BLOCK_SIZE;
+	u32 t_select = sw_r32(RTL839X_ACL_BLK_TMPLTE_CTRL(block));
+
+	memset(pr, 0, sizeof(*pr));
+	rtl_table_read(q, idx);
+	for (int i = 0; i < 17; i++)
+		r[i] = sw_r32(rtl_table_data(q, i));
+
+	rtl_table_release(q);
+
+	rtl839x_read_pie_fixed_fields(r, pr);
+	if (!pr->valid)
+		return 0;
+
+	pr_debug("%s: template_selectors %08x, tid: %d\n", __func__, t_select, pr->tid);
+	rtl839x_pie_rule_dump_raw(r);
+
+	rtl839x_read_pie_templated(r, pr, fixed_templates[(t_select >> (pr->tid * 3)) & 0x7]);
+
+	rtl839x_read_pie_action(r, pr);
+
+	return 0;
+}
+
+static int rtl839x_pie_rule_write(struct rtl838x_switch_priv *priv, int idx, struct pie_rule *pr)
+{
+	/* Access IACL table (2) via register 0 */
+	struct table_reg *q = rtl_table_get(RTL8390_TBL_0, 2);
+	u32 r[17];
+	int block = idx / PIE_BLOCK_SIZE;
+	u32 t_select = sw_r32(RTL839X_ACL_BLK_TMPLTE_CTRL(block));
+
+	pr_debug("%s: %d, t_select: %08x\n", __func__, idx, t_select);
+
+	for (int i = 0; i < 17; i++)
+		r[i] = 0;
+
+	if (!pr->valid) {
+		rtl_table_write(q, idx);
+		rtl_table_release(q);
+		return 0;
+	}
+	rtl839x_write_pie_fixed_fields(r, pr);
+
+	pr_debug("%s: template %d\n", __func__, (t_select >> (pr->tid * 3)) & 0x7);
+	rtl839x_write_pie_templated(r, pr, fixed_templates[(t_select >> (pr->tid * 3)) & 0x7]);
+
+	rtl839x_write_pie_action(r, pr);
+
+/*	rtl839x_pie_rule_dump_raw(r); */
+
+	for (int i = 0; i < 17; i++)
+		sw_w32(r[i], rtl_table_data(q, i));
+
+	rtl_table_write(q, idx);
+	rtl_table_release(q);
+
+	return 0;
+}
+
+static bool rtl839x_pie_templ_has(int t, enum template_field_id field_type)
+{
+	for (int i = 0; i < N_FIXED_FIELDS; i++) {
+		enum template_field_id ft = fixed_templates[t][i];
+		if (field_type == ft)
+			return true;
+	}
+
+	return false;
+}
+
+static int rtl839x_pie_verify_template(struct rtl838x_switch_priv *priv,
+				       struct pie_rule *pr, int t, int block)
+{
+	int i;
+
+	if (!pr->is_ipv6 && pr->sip_m && !rtl839x_pie_templ_has(t, TEMPLATE_FIELD_SIP0))
+		return -1;
+
+	if (!pr->is_ipv6 && pr->dip_m && !rtl839x_pie_templ_has(t, TEMPLATE_FIELD_DIP0))
+		return -1;
+
+	if (pr->is_ipv6) {
+		if ((pr->sip6_m.s6_addr32[0] ||
+		     pr->sip6_m.s6_addr32[1] ||
+		     pr->sip6_m.s6_addr32[2] ||
+		     pr->sip6_m.s6_addr32[3]) &&
+		    !rtl839x_pie_templ_has(t, TEMPLATE_FIELD_SIP2))
+			return -1;
+		if ((pr->dip6_m.s6_addr32[0] ||
+		     pr->dip6_m.s6_addr32[1] ||
+		     pr->dip6_m.s6_addr32[2] ||
+		     pr->dip6_m.s6_addr32[3]) &&
+		    !rtl839x_pie_templ_has(t, TEMPLATE_FIELD_DIP2))
+			return -1;
+	}
+
+	if (ether_addr_to_u64(pr->smac) && !rtl839x_pie_templ_has(t, TEMPLATE_FIELD_SMAC0))
+		return -1;
+
+	if (ether_addr_to_u64(pr->dmac) && !rtl839x_pie_templ_has(t, TEMPLATE_FIELD_DMAC0))
+		return -1;
+
+	/* TODO: Check more */
+
+	i = find_first_zero_bit(&priv->pie_use_bm[block * 4], PIE_BLOCK_SIZE);
+
+	if (i >= PIE_BLOCK_SIZE)
+		return -1;
+
+	return i + PIE_BLOCK_SIZE * block;
+}
+
+static int rtl839x_pie_rule_add(struct rtl838x_switch_priv *priv, struct pie_rule *pr)
+{
+	int idx, block, j, t;
+	int min_block = 0;
+	int max_block = priv->n_pie_blocks / 2;
+
+	if (pr->is_egress) {
+		min_block = max_block;
+		max_block = priv->n_pie_blocks;
+	}
+
+	mutex_lock(&priv->pie_mutex);
+
+	for (block = min_block; block < max_block; block++) {
+		for (j = 0; j < 2; j++) {
+			t = (sw_r32(RTL839X_ACL_BLK_TMPLTE_CTRL(block)) >> (j * 3)) & 0x7;
+			idx = rtl839x_pie_verify_template(priv, pr, t, block);
+			if (idx >= 0)
+				break;
+		}
+		if (j < 2)
+			break;
+	}
+
+	if (block >= priv->n_pie_blocks) {
+		mutex_unlock(&priv->pie_mutex);
+		return -EOPNOTSUPP;
+	}
+
+	set_bit(idx, priv->pie_use_bm);
+
+	pr->valid = true;
+	pr->tid = j;  /* Mapped to template number */
+	pr->tid_m = 0x3;
+	pr->id = idx;
+
+	rtl839x_pie_lookup_enable(priv, idx);
+	rtl839x_pie_rule_write(priv, idx, pr);
+
+	mutex_unlock(&priv->pie_mutex);
+
+	return 0;
+}
+
+static void rtl839x_pie_rule_rm(struct rtl838x_switch_priv *priv, struct pie_rule *pr)
+{
+	int idx = pr->id;
+
+	rtl839x_pie_rule_del(priv, idx, idx);
+	clear_bit(idx, priv->pie_use_bm);
+}
+
+static void rtl839x_pie_init(struct rtl838x_switch_priv *priv)
+{
+	u32 template_selectors;
+
+	mutex_init(&priv->pie_mutex);
+
+	/* Power on all PIE blocks */
+	for (int i = 0; i < priv->n_pie_blocks; i++)
+		sw_w32_mask(0, BIT(i), RTL839X_PS_ACL_PWR_CTRL);
+
+	/* Set ingress and egress ACL blocks to 50/50: first Egress block is 9 */
+	sw_w32_mask(0x1f, 9, RTL839X_ACL_CTRL);  /* Writes 9 to cutline field */
+
+	/* Include IPG in metering */
+	sw_w32(1, RTL839X_METER_GLB_CTRL);
+
+	/* Delete all present rules */
+	rtl839x_pie_rule_del(priv, 0, priv->n_pie_blocks * PIE_BLOCK_SIZE - 1);
+
+	/* Enable predefined templates 0, 1 for blocks 0-2 */
+	template_selectors = 0 | (1 << 3);
+	for (int i = 0; i < 3; i++)
+		sw_w32(template_selectors, RTL839X_ACL_BLK_TMPLTE_CTRL(i));
+
+	/* Enable predefined templates 2, 3 for blocks 3-5 */
+	template_selectors = 2 | (3 << 3);
+	for (int i = 3; i < 6; i++)
+		sw_w32(template_selectors, RTL839X_ACL_BLK_TMPLTE_CTRL(i));
+
+	/* Enable predefined templates 1, 4 for blocks 6-8 */
+	template_selectors = 2 | (3 << 3);
+	for (int i = 6; i < 9; i++)
+		sw_w32(template_selectors, RTL839X_ACL_BLK_TMPLTE_CTRL(i));
+
+	/* Enable predefined templates 0, 1 for blocks 9-11 */
+	template_selectors = 0 | (1 << 3);
+	for (int i = 9; i < 12; i++)
+		sw_w32(template_selectors, RTL839X_ACL_BLK_TMPLTE_CTRL(i));
+
+	/* Enable predefined templates 2, 3 for blocks 12-14 */
+	template_selectors = 2 | (3 << 3);
+	for (int i = 12; i < 15; i++)
+		sw_w32(template_selectors, RTL839X_ACL_BLK_TMPLTE_CTRL(i));
+
+	/* Enable predefined templates 1, 4 for blocks 15-17 */
+	template_selectors = 2 | (3 << 3);
+	for (int i = 15; i < 18; i++)
+		sw_w32(template_selectors, RTL839X_ACL_BLK_TMPLTE_CTRL(i));
+}
+
+static u32 rtl839x_packet_cntr_read(int counter)
+{
+	u32 v;
+
+	/* Read LOG table (4) via register RTL8390_TBL_0 */
+	struct table_reg *r = rtl_table_get(RTL8390_TBL_0, 4);
+
+	pr_debug("In %s, id %d\n", __func__, counter);
+	rtl_table_read(r, counter / 2);
+
+	/* The table has a size of 2 registers */
+	if (counter % 2)
+		v = sw_r32(rtl_table_data(r, 0));
+	else
+		v = sw_r32(rtl_table_data(r, 1));
+
+	rtl_table_release(r);
+
+	return v;
+}
+
+static void rtl839x_packet_cntr_clear(int counter)
+{
+	/* Access LOG table (4) via register RTL8390_TBL_0 */
+	struct table_reg *r = rtl_table_get(RTL8390_TBL_0, 4);
+
+	pr_debug("In %s, id %d\n", __func__, counter);
+	/* The table has a size of 2 registers */
+	if (counter % 2)
+		sw_w32(0, rtl_table_data(r, 0));
+	else
+		sw_w32(0, rtl_table_data(r, 1));
+
+	rtl_table_write(r, counter / 2);
+
+	rtl_table_release(r);
+}
+
+static void rtl839x_route_read(int idx, struct rtl83xx_route *rt)
+{
+	u64 v;
+	/* Read ROUTING table (2) via register RTL8390_TBL_1 */
+	struct table_reg *r = rtl_table_get(RTL8390_TBL_1, 2);
+
+	pr_debug("In %s\n", __func__);
+	rtl_table_read(r, idx);
+
+	/* The table has a size of 2 registers */
+	v = sw_r32(rtl_table_data(r, 0));
+	v <<= 32;
+	v |= sw_r32(rtl_table_data(r, 1));
+	rt->switch_mac_id = (v >> 12) & 0xf;
+	rt->nh.gw = v >> 16;
+
+	rtl_table_release(r);
+}
+
+static void rtl839x_route_write(int idx, struct rtl83xx_route *rt)
+{
+	u32 v;
+
+	/* Read ROUTING table (2) via register RTL8390_TBL_1 */
+	struct table_reg *r = rtl_table_get(RTL8390_TBL_1, 2);
+
+	pr_debug("In %s\n", __func__);
+	sw_w32(rt->nh.gw >> 16, rtl_table_data(r, 0));
+	v = rt->nh.gw << 16;
+	v |= rt->switch_mac_id << 12;
+	sw_w32(v, rtl_table_data(r, 1));
+	rtl_table_write(r, idx);
+
+	rtl_table_release(r);
+}
+
+/* Configure the switch's own MAC addresses used when routing packets */
+static void rtl839x_setup_port_macs(struct rtl838x_switch_priv *priv)
+{
+	struct net_device *dev;
+	u64 mac;
+
+	pr_debug("%s: got port %08x\n", __func__, (u32)priv->ports[priv->cpu_port].dp);
+	dev = priv->ports[priv->cpu_port].dp->slave;
+	mac = ether_addr_to_u64(dev->dev_addr);
+
+	for (int i = 0; i < 15; i++) {
+		mac++;  /* BUG: VRRP for testing */
+		sw_w32(mac >> 32, RTL839X_ROUTING_SA_CTRL + i * 8);
+		sw_w32(mac, RTL839X_ROUTING_SA_CTRL + i * 8 + 4);
+	}
+}
+
+int rtl839x_l3_setup(struct rtl838x_switch_priv *priv)
+{
+	rtl839x_setup_port_macs(priv);
+
+	return 0;
+}
+
+void rtl839x_vlan_port_keep_tag_set(int port, bool keep_outer, bool keep_inner)
+{
+	sw_w32(FIELD_PREP(RTL839X_VLAN_PORT_TAG_STS_CTRL_OTAG_STS_MASK,
+			  keep_outer ? RTL839X_VLAN_PORT_TAG_STS_TAGGED : RTL839X_VLAN_PORT_TAG_STS_UNTAG) |
+	       FIELD_PREP(RTL839X_VLAN_PORT_TAG_STS_CTRL_ITAG_STS_MASK,
+			  keep_inner ? RTL839X_VLAN_PORT_TAG_STS_TAGGED : RTL839X_VLAN_PORT_TAG_STS_UNTAG),
+	       RTL839X_VLAN_PORT_TAG_STS_CTRL(port));
+}
+
+void rtl839x_vlan_port_pvidmode_set(int port, enum pbvlan_type type, enum pbvlan_mode mode)
+{
+	if (type == PBVLAN_TYPE_INNER)
+		sw_w32_mask(0x3, mode, RTL839X_VLAN_PORT_PB_VLAN + (port << 2));
+	else
+		sw_w32_mask(0x3 << 14, mode << 14, RTL839X_VLAN_PORT_PB_VLAN + (port << 2));
+}
+
+void rtl839x_vlan_port_pvid_set(int port, enum pbvlan_type type, int pvid)
+{
+	if (type == PBVLAN_TYPE_INNER)
+		sw_w32_mask(0xfff << 2, pvid << 2, RTL839X_VLAN_PORT_PB_VLAN + (port << 2));
+	else
+		sw_w32_mask(0xfff << 16, pvid << 16, RTL839X_VLAN_PORT_PB_VLAN + (port << 2));
+}
+
+static int rtl839x_set_ageing_time(unsigned long msec)
+{
+	int t = sw_r32(RTL839X_L2_CTRL_1);
+
+	t &= 0x1FFFFF;
+	t = t * 3 / 5; /* Aging time in seconds. 0: L2 aging disabled */
+	pr_debug("L2 AGING time: %d sec\n", t);
+
+	t = (msec * 5 + 2000) / 3000;
+	t = t > 0x1FFFFF ? 0x1FFFFF : t;
+	sw_w32_mask(0x1FFFFF, t, RTL839X_L2_CTRL_1);
+	pr_debug("Dynamic aging for ports: %x\n", sw_r32(RTL839X_L2_PORT_AGING_OUT));
+
+	return 0;
+}
+
+static void rtl839x_set_igr_filter(int port,  enum igr_filter state)
+{
+	sw_w32_mask(0x3 << ((port & 0xf)<<1), state << ((port & 0xf)<<1),
+		    RTL839X_VLAN_PORT_IGR_FLTR + (((port >> 4) << 2)));
+}
+
+static void rtl839x_set_egr_filter(int port,  enum egr_filter state)
+{
+	sw_w32_mask(0x1 << (port % 0x20), state << (port % 0x20),
+			RTL839X_VLAN_PORT_EGR_FLTR + (((port >> 5) << 2)));
+}
+
+void rtl839x_set_distribution_algorithm(int group, int algoidx, u32 algomsk)
+{
+	sw_w32_mask(3 << ((group & 0xf) << 1), algoidx << ((group & 0xf) << 1),
+		    RTL839X_TRK_HASH_IDX_CTRL + ((group >> 4) << 2));
+	sw_w32(algomsk, RTL839X_TRK_HASH_CTRL + (algoidx << 2));
+}
+
+void rtl839x_set_receive_management_action(int port, rma_ctrl_t type, action_type_t action)
+{
+	switch(type) {
+	case BPDU:
+		sw_w32_mask(3 << ((port & 0xf) << 1), (action & 0x3) << ((port & 0xf) << 1),
+			    RTL839X_RMA_BPDU_CTRL + ((port >> 4) << 2));
+		break;
+	case PTP:
+		sw_w32_mask(3 << ((port & 0xf) << 1), (action & 0x3) << ((port & 0xf) << 1),
+			    RTL839X_RMA_PTP_CTRL + ((port >> 4) << 2));
+		break;
+	case LLTP:
+		sw_w32_mask(3 << ((port & 0xf) << 1), (action & 0x3) << ((port & 0xf) << 1),
+			    RTL839X_RMA_LLTP_CTRL + ((port >> 4) << 2));
+		break;
+	default:
+		break;
+	}
+}
+
+const struct rtl838x_reg rtl839x_reg = {
+	.mask_port_reg_be = rtl839x_mask_port_reg_be,
+	.set_port_reg_be = rtl839x_set_port_reg_be,
+	.get_port_reg_be = rtl839x_get_port_reg_be,
+	.mask_port_reg_le = rtl839x_mask_port_reg_le,
+	.set_port_reg_le = rtl839x_set_port_reg_le,
+	.get_port_reg_le = rtl839x_get_port_reg_le,
+	.stat_port_rst = RTL839X_STAT_PORT_RST,
+	.stat_rst = RTL839X_STAT_RST,
+	.stat_port_std_mib = RTL839X_STAT_PORT_STD_MIB,
+	.traffic_enable = rtl839x_traffic_enable,
+	.traffic_disable = rtl839x_traffic_disable,
+	.traffic_get = rtl839x_traffic_get,
+	.traffic_set = rtl839x_traffic_set,
+	.port_iso_ctrl = rtl839x_port_iso_ctrl,
+	.l2_ctrl_0 = RTL839X_L2_CTRL_0,
+	.l2_ctrl_1 = RTL839X_L2_CTRL_1,
+	.l2_port_aging_out = RTL839X_L2_PORT_AGING_OUT,
+	.set_ageing_time = rtl839x_set_ageing_time,
+	.smi_poll_ctrl = RTL839X_SMI_PORT_POLLING_CTRL,
+	.l2_tbl_flush_ctrl = RTL839X_L2_TBL_FLUSH_CTRL,
+	.exec_tbl0_cmd = rtl839x_exec_tbl0_cmd,
+	.exec_tbl1_cmd = rtl839x_exec_tbl1_cmd,
+	.tbl_access_data_0 = rtl839x_tbl_access_data_0,
+	.isr_glb_src = RTL839X_ISR_GLB_SRC,
+	.isr_port_link_sts_chg = RTL839X_ISR_PORT_LINK_STS_CHG,
+	.imr_port_link_sts_chg = RTL839X_IMR_PORT_LINK_STS_CHG,
+	.imr_glb = RTL839X_IMR_GLB,
+	.vlan_tables_read = rtl839x_vlan_tables_read,
+	.vlan_set_tagged = rtl839x_vlan_set_tagged,
+	.vlan_set_untagged = rtl839x_vlan_set_untagged,
+	.vlan_profile_dump = rtl839x_vlan_profile_dump,
+	.vlan_profile_setup = rtl839x_vlan_profile_setup,
+	.vlan_fwd_on_inner = rtl839x_vlan_fwd_on_inner,
+	.vlan_port_keep_tag_set = rtl839x_vlan_port_keep_tag_set,
+	.vlan_port_pvidmode_set = rtl839x_vlan_port_pvidmode_set,
+	.vlan_port_pvid_set = rtl839x_vlan_port_pvid_set,
+	.set_vlan_igr_filter = rtl839x_set_igr_filter,
+	.set_vlan_egr_filter = rtl839x_set_egr_filter,
+	.enable_learning = rtl839x_enable_learning,
+	.enable_flood = rtl839x_enable_flood,
+	.enable_mcast_flood = rtl839x_enable_mcast_flood,
+	.enable_bcast_flood = rtl839x_enable_bcast_flood,
+	.set_static_move_action = rtl839x_set_static_move_action,
+	.stp_get = rtl839x_stp_get,
+	.stp_set = rtl839x_stp_set,
+	.mac_force_mode_ctrl = rtl839x_mac_force_mode_ctrl,
+	.mac_port_ctrl = rtl839x_mac_port_ctrl,
+	.l2_port_new_salrn = rtl839x_l2_port_new_salrn,
+	.l2_port_new_sa_fwd = rtl839x_l2_port_new_sa_fwd,
+	.mir_ctrl = RTL839X_MIR_CTRL,
+	.mir_dpm = RTL839X_MIR_DPM_CTRL,
+	.mir_spm = RTL839X_MIR_SPM_CTRL,
+	.mac_link_sts = RTL839X_MAC_LINK_STS,
+	.mac_link_dup_sts = RTL839X_MAC_LINK_DUP_STS,
+	.mac_link_spd_sts = rtl839x_mac_link_spd_sts,
+	.mac_rx_pause_sts = RTL839X_MAC_RX_PAUSE_STS,
+	.mac_tx_pause_sts = RTL839X_MAC_TX_PAUSE_STS,
+	.read_l2_entry_using_hash = rtl839x_read_l2_entry_using_hash,
+	.write_l2_entry_using_hash = rtl839x_write_l2_entry_using_hash,
+	.read_cam = rtl839x_read_cam,
+	.write_cam = rtl839x_write_cam,
+	.trk_mbr_ctr = rtl839x_trk_mbr_ctr,
+	.rma_bpdu_fld_pmask = RTL839X_RMA_BPDU_FLD_PMSK,
+	.spcl_trap_eapol_ctrl = RTL839X_SPCL_TRAP_EAPOL_CTRL,
+	.init_eee = rtl839x_init_eee,
+	.port_eee_set = rtl839x_port_eee_set,
+	.eee_port_ability = rtl839x_eee_port_ability,
+	.l2_hash_seed = rtl839x_l2_hash_seed,
+	.l2_hash_key = rtl839x_l2_hash_key,
+	.read_mcast_pmask = rtl839x_read_mcast_pmask,
+	.write_mcast_pmask = rtl839x_write_mcast_pmask,
+	.pie_init = rtl839x_pie_init,
+	.pie_rule_read = rtl839x_pie_rule_read,
+	.pie_rule_write = rtl839x_pie_rule_write,
+	.pie_rule_add = rtl839x_pie_rule_add,
+	.pie_rule_rm = rtl839x_pie_rule_rm,
+	.l2_learning_setup = rtl839x_l2_learning_setup,
+	.packet_cntr_read = rtl839x_packet_cntr_read,
+	.packet_cntr_clear = rtl839x_packet_cntr_clear,
+	.route_read = rtl839x_route_read,
+	.route_write = rtl839x_route_write,
+	.l3_setup = rtl839x_l3_setup,
+	.set_distribution_algorithm = rtl839x_set_distribution_algorithm,
+	.set_receive_management_action = rtl839x_set_receive_management_action,
+};
diff --git a/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/rtl83xx.h b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/rtl83xx.h
new file mode 100644
index 00000000000000..679f0533b4fc0a
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/rtl83xx.h
@@ -0,0 +1,136 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#ifndef _NET_DSA_RTL83XX_H
+#define _NET_DSA_RTL83XX_H
+
+#include <net/dsa.h>
+#include "rtl838x.h"
+
+
+#define RTL8380_VERSION_A 'A'
+#define RTL8390_VERSION_A 'A'
+#define RTL8380_VERSION_B 'B'
+
+struct fdb_update_work {
+	struct work_struct work;
+	struct net_device *ndev;
+	u64 macs[];
+};
+
+#define MIB_DESC(_size, _offset, _name) {.size = _size, .offset = _offset, .name = _name}
+struct rtl83xx_mib_desc {
+	unsigned int size;
+	unsigned int offset;
+	const char *name;
+};
+
+/* API for switch table access */
+struct table_reg {
+	u16 addr;
+	u16 data;
+	u8  max_data;
+	u8 c_bit;
+	u8 t_bit;
+	u8 rmode;
+	u8 tbl;
+	struct mutex lock;
+};
+
+#define TBL_DESC(_addr, _data, _max_data, _c_bit, _t_bit, _rmode) \
+		{  .addr = _addr, .data = _data, .max_data = _max_data, .c_bit = _c_bit, \
+		    .t_bit = _t_bit, .rmode = _rmode \
+		}
+
+typedef enum {
+	RTL8380_TBL_L2 = 0,
+	RTL8380_TBL_0,
+	RTL8380_TBL_1,
+	RTL8390_TBL_L2,
+	RTL8390_TBL_0,
+	RTL8390_TBL_1,
+	RTL8390_TBL_2,
+	RTL9300_TBL_L2,
+	RTL9300_TBL_0,
+	RTL9300_TBL_1,
+	RTL9300_TBL_2,
+	RTL9300_TBL_HSB,
+	RTL9300_TBL_HSA,
+	RTL9310_TBL_0,
+	RTL9310_TBL_1,
+	RTL9310_TBL_2,
+	RTL9310_TBL_3,
+	RTL9310_TBL_4,
+	RTL9310_TBL_5,
+	RTL_TBL_END
+} rtl838x_tbl_reg_t;
+
+void rtl_table_init(void);
+struct table_reg *rtl_table_get(rtl838x_tbl_reg_t r, int t);
+void rtl_table_release(struct table_reg *r);
+int rtl_table_read(struct table_reg *r, int idx);
+int rtl_table_write(struct table_reg *r, int idx);
+inline u16 rtl_table_data(struct table_reg *r, int i);
+inline u32 rtl_table_data_r(struct table_reg *r, int i);
+inline void rtl_table_data_w(struct table_reg *r, u32 v, int i);
+
+void __init rtl83xx_setup_qos(struct rtl838x_switch_priv *priv);
+
+int rtl83xx_packet_cntr_alloc(struct rtl838x_switch_priv *priv);
+
+int rtl83xx_port_is_under(const struct net_device * dev, struct rtl838x_switch_priv *priv);
+
+int read_phy(u32 port, u32 page, u32 reg, u32 *val);
+int write_phy(u32 port, u32 page, u32 reg, u32 val);
+
+/* Port register accessor functions for the RTL839x and RTL931X SoCs */
+void rtl839x_mask_port_reg_be(u64 clear, u64 set, int reg);
+u64 rtl839x_get_port_reg_be(int reg);
+void rtl839x_set_port_reg_be(u64 set, int reg);
+void rtl839x_mask_port_reg_le(u64 clear, u64 set, int reg);
+void rtl839x_set_port_reg_le(u64 set, int reg);
+u64 rtl839x_get_port_reg_le(int reg);
+
+/* Port register accessor functions for the RTL838x and RTL930X SoCs */
+void rtl838x_mask_port_reg(u64 clear, u64 set, int reg);
+void rtl838x_set_port_reg(u64 set, int reg);
+u64 rtl838x_get_port_reg(int reg);
+
+/* RTL838x-specific */
+u32 rtl838x_hash(struct rtl838x_switch_priv *priv, u64 seed);
+irqreturn_t rtl838x_switch_irq(int irq, void *dev_id);
+void rtl8380_get_version(struct rtl838x_switch_priv *priv);
+void rtl838x_vlan_profile_dump(int index);
+int rtl83xx_dsa_phy_read(struct dsa_switch *ds, int phy_addr, int phy_reg);
+void rtl8380_sds_rst(int mac);
+int rtl8380_sds_power(int mac, int val);
+void rtl838x_print_matrix(void);
+
+/* RTL839x-specific */
+u32 rtl839x_hash(struct rtl838x_switch_priv *priv, u64 seed);
+irqreturn_t rtl839x_switch_irq(int irq, void *dev_id);
+void rtl8390_get_version(struct rtl838x_switch_priv *priv);
+void rtl839x_vlan_profile_dump(int index);
+int rtl83xx_dsa_phy_write(struct dsa_switch *ds, int phy_addr, int phy_reg, u16 val);
+void rtl839x_exec_tbl2_cmd(u32 cmd);
+void rtl839x_print_matrix(void);
+
+/* RTL930x-specific */
+u32 rtl930x_hash(struct rtl838x_switch_priv *priv, u64 seed);
+irqreturn_t rtl930x_switch_irq(int irq, void *dev_id);
+irqreturn_t rtl839x_switch_irq(int irq, void *dev_id);
+void rtl930x_vlan_profile_dump(int index);
+int rtl9300_sds_power(int mac, int val);
+void rtl9300_sds_rst(int sds_num, u32 mode);
+int rtl9300_serdes_setup(int sds_num, phy_interface_t phy_mode);
+void rtl930x_print_matrix(void);
+
+/* RTL931x-specific */
+irqreturn_t rtl931x_switch_irq(int irq, void *dev_id);
+int rtl931x_sds_cmu_band_get(int sds, phy_interface_t mode);
+int rtl931x_sds_cmu_band_set(int sds, bool enable, u32 band, phy_interface_t mode);
+void rtl931x_sds_init(u32 sds, phy_interface_t mode);
+
+int rtl83xx_lag_add(struct dsa_switch *ds, int group, int port, struct netdev_lag_upper_info *info);
+int rtl83xx_lag_del(struct dsa_switch *ds, int group, int port);
+
+#endif /* _NET_DSA_RTL83XX_H */
diff --git a/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/rtl930x.c b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/rtl930x.c
new file mode 100644
index 00000000000000..c4f200bc0e02e9
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/rtl930x.c
@@ -0,0 +1,2545 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <asm/mach-rtl838x/mach-rtl83xx.h>
+#include <linux/etherdevice.h>
+#include <linux/inetdevice.h>
+
+#include "rtl83xx.h"
+
+#define RTL930X_VLAN_PORT_TAG_STS_INTERNAL			0x0
+#define RTL930X_VLAN_PORT_TAG_STS_UNTAG				0x1
+#define RTL930X_VLAN_PORT_TAG_STS_TAGGED			0x2
+#define RTL930X_VLAN_PORT_TAG_STS_PRIORITY_TAGGED		0x3
+
+#define RTL930X_VLAN_PORT_TAG_STS_CTRL_BASE			0xCE24
+/* port 0-28 */
+#define RTL930X_VLAN_PORT_TAG_STS_CTRL(port) \
+		RTL930X_VLAN_PORT_TAG_STS_CTRL_BASE + (port << 2)
+#define RTL930X_VLAN_PORT_TAG_STS_CTRL_EGR_OTAG_STS_MASK	GENMASK(7,6)
+#define RTL930X_VLAN_PORT_TAG_STS_CTRL_EGR_ITAG_STS_MASK	GENMASK(5,4)
+#define RTL930X_VLAN_PORT_TAG_STS_CTRL_EGR_P_OTAG_KEEP_MASK	GENMASK(3,3)
+#define RTL930X_VLAN_PORT_TAG_STS_CTRL_EGR_P_ITAG_KEEP_MASK	GENMASK(2,2)
+#define RTL930X_VLAN_PORT_TAG_STS_CTRL_IGR_P_OTAG_KEEP_MASK	GENMASK(1,1)
+#define RTL930X_VLAN_PORT_TAG_STS_CTRL_IGR_P_ITAG_KEEP_MASK	GENMASK(0,0)
+
+#define RTL930X_LED_GLB_ACTIVE_LOW				BIT(22)
+
+extern struct mutex smi_lock;
+extern struct rtl83xx_soc_info soc_info;
+
+/* Definition of the RTL930X-specific template field IDs as used in the PIE */
+enum template_field_id {
+	TEMPLATE_FIELD_SPM0 = 0,		/* Source portmask ports 0-15 */
+	TEMPLATE_FIELD_SPM1 = 1,		/* Source portmask ports 16-31 */
+	TEMPLATE_FIELD_DMAC0 = 2,		/* Destination MAC [15:0] */
+	TEMPLATE_FIELD_DMAC1 = 3,		/* Destination MAC [31:16] */
+	TEMPLATE_FIELD_DMAC2 = 4,		/* Destination MAC [47:32] */
+	TEMPLATE_FIELD_SMAC0 = 5,		/* Source MAC [15:0] */
+	TEMPLATE_FIELD_SMAC1 = 6,		/* Source MAC [31:16] */
+	TEMPLATE_FIELD_SMAC2 = 7,		/* Source MAC [47:32] */
+	TEMPLATE_FIELD_ETHERTYPE = 8,		/* Ethernet frame type field */
+	TEMPLATE_FIELD_OTAG = 9,
+	TEMPLATE_FIELD_ITAG = 10,
+	TEMPLATE_FIELD_SIP0 = 11,
+	TEMPLATE_FIELD_SIP1 = 12,
+	TEMPLATE_FIELD_DIP0 = 13,
+	TEMPLATE_FIELD_DIP1 = 14,
+	TEMPLATE_FIELD_IP_TOS_PROTO = 15,
+	TEMPLATE_FIELD_L4_SPORT = 16,
+	TEMPLATE_FIELD_L4_DPORT = 17,
+	TEMPLATE_FIELD_L34_HEADER = 18,
+	TEMPLATE_FIELD_TCP_INFO = 19,
+	TEMPLATE_FIELD_FIELD_SELECTOR_VALID = 20,
+	TEMPLATE_FIELD_FIELD_SELECTOR_0 = 21,
+	TEMPLATE_FIELD_FIELD_SELECTOR_1 = 22,
+	TEMPLATE_FIELD_FIELD_SELECTOR_2 = 23,
+	TEMPLATE_FIELD_FIELD_SELECTOR_3 = 24,
+	TEMPLATE_FIELD_FIELD_SELECTOR_4 = 25,
+	TEMPLATE_FIELD_FIELD_SELECTOR_5 = 26,
+	TEMPLATE_FIELD_SIP2 = 27,
+	TEMPLATE_FIELD_SIP3 = 28,
+	TEMPLATE_FIELD_SIP4 = 29,
+	TEMPLATE_FIELD_SIP5 = 30,
+	TEMPLATE_FIELD_SIP6 = 31,
+	TEMPLATE_FIELD_SIP7 = 32,
+	TEMPLATE_FIELD_DIP2 = 33,
+	TEMPLATE_FIELD_DIP3 = 34,
+	TEMPLATE_FIELD_DIP4 = 35,
+	TEMPLATE_FIELD_DIP5 = 36,
+	TEMPLATE_FIELD_DIP6 = 37,
+	TEMPLATE_FIELD_DIP7 = 38,
+	TEMPLATE_FIELD_PKT_INFO = 39,
+	TEMPLATE_FIELD_FLOW_LABEL = 40,
+	TEMPLATE_FIELD_DSAP_SSAP = 41,
+	TEMPLATE_FIELD_SNAP_OUI = 42,
+	TEMPLATE_FIELD_FWD_VID = 43,
+	TEMPLATE_FIELD_RANGE_CHK = 44,
+	TEMPLATE_FIELD_VLAN_GMSK = 45,		/* VLAN Group Mask/IP range check */
+	TEMPLATE_FIELD_DLP = 46,
+	TEMPLATE_FIELD_META_DATA = 47,
+	TEMPLATE_FIELD_SRC_FWD_VID = 48,
+	TEMPLATE_FIELD_SLP = 49,
+};
+
+/* The meaning of TEMPLATE_FIELD_VLAN depends on phase and the configuration in
+ * RTL930X_PIE_CTRL. We use always the same definition and map to the inner VLAN tag:
+ */
+#define TEMPLATE_FIELD_VLAN TEMPLATE_FIELD_ITAG
+
+/* Number of fixed templates predefined in the RTL9300 SoC */
+#define N_FIXED_TEMPLATES 5
+/* RTL9300 specific predefined templates */
+static enum template_field_id fixed_templates[N_FIXED_TEMPLATES][N_FIXED_FIELDS] =
+{
+	{
+	  TEMPLATE_FIELD_DMAC0, TEMPLATE_FIELD_DMAC1, TEMPLATE_FIELD_DMAC2,
+	  TEMPLATE_FIELD_SMAC0, TEMPLATE_FIELD_SMAC1, TEMPLATE_FIELD_SMAC2,
+	  TEMPLATE_FIELD_VLAN, TEMPLATE_FIELD_IP_TOS_PROTO, TEMPLATE_FIELD_DSAP_SSAP,
+	  TEMPLATE_FIELD_ETHERTYPE, TEMPLATE_FIELD_SPM0, TEMPLATE_FIELD_SPM1
+	}, {
+	  TEMPLATE_FIELD_SIP0, TEMPLATE_FIELD_SIP1, TEMPLATE_FIELD_DIP0,
+	  TEMPLATE_FIELD_DIP1, TEMPLATE_FIELD_IP_TOS_PROTO, TEMPLATE_FIELD_TCP_INFO,
+	  TEMPLATE_FIELD_L4_SPORT, TEMPLATE_FIELD_L4_DPORT, TEMPLATE_FIELD_VLAN,
+	  TEMPLATE_FIELD_RANGE_CHK, TEMPLATE_FIELD_SPM0, TEMPLATE_FIELD_SPM1
+	}, {
+	  TEMPLATE_FIELD_DMAC0, TEMPLATE_FIELD_DMAC1, TEMPLATE_FIELD_DMAC2,
+	  TEMPLATE_FIELD_VLAN, TEMPLATE_FIELD_ETHERTYPE, TEMPLATE_FIELD_IP_TOS_PROTO,
+	  TEMPLATE_FIELD_SIP0, TEMPLATE_FIELD_SIP1, TEMPLATE_FIELD_DIP0,
+	  TEMPLATE_FIELD_DIP1, TEMPLATE_FIELD_L4_SPORT, TEMPLATE_FIELD_L4_DPORT
+	}, {
+	  TEMPLATE_FIELD_DIP0, TEMPLATE_FIELD_DIP1, TEMPLATE_FIELD_DIP2,
+	  TEMPLATE_FIELD_DIP3, TEMPLATE_FIELD_DIP4, TEMPLATE_FIELD_DIP5,
+	  TEMPLATE_FIELD_DIP6, TEMPLATE_FIELD_DIP7, TEMPLATE_FIELD_IP_TOS_PROTO,
+	  TEMPLATE_FIELD_TCP_INFO, TEMPLATE_FIELD_L4_SPORT, TEMPLATE_FIELD_L4_DPORT
+	}, {
+	  TEMPLATE_FIELD_SIP0, TEMPLATE_FIELD_SIP1, TEMPLATE_FIELD_SIP2,
+	  TEMPLATE_FIELD_SIP3, TEMPLATE_FIELD_SIP4, TEMPLATE_FIELD_SIP5,
+	  TEMPLATE_FIELD_SIP6, TEMPLATE_FIELD_SIP7, TEMPLATE_FIELD_VLAN,
+	  TEMPLATE_FIELD_RANGE_CHK, TEMPLATE_FIELD_SPM1, TEMPLATE_FIELD_SPM1
+	},
+};
+
+void rtl930x_print_matrix(void)
+{
+	struct table_reg *r = rtl_table_get(RTL9300_TBL_0, 6);
+
+	for (int i = 0; i < 29; i++) {
+		rtl_table_read(r, i);
+		pr_debug("> %08x\n", sw_r32(rtl_table_data(r, 0)));
+	}
+	rtl_table_release(r);
+}
+
+inline void rtl930x_exec_tbl0_cmd(u32 cmd)
+{
+	sw_w32(cmd, RTL930X_TBL_ACCESS_CTRL_0);
+	do { } while (sw_r32(RTL930X_TBL_ACCESS_CTRL_0) & (1 << 17));
+}
+
+inline void rtl930x_exec_tbl1_cmd(u32 cmd)
+{
+	sw_w32(cmd, RTL930X_TBL_ACCESS_CTRL_1);
+	do { } while (sw_r32(RTL930X_TBL_ACCESS_CTRL_1) & (1 << 17));
+}
+
+inline int rtl930x_tbl_access_data_0(int i)
+{
+	return RTL930X_TBL_ACCESS_DATA_0(i);
+}
+
+static inline int rtl930x_l2_port_new_salrn(int p)
+{
+	return RTL930X_L2_PORT_SALRN(p);
+}
+
+static inline int rtl930x_l2_port_new_sa_fwd(int p)
+{
+	/* TODO: The definition of the fields changed, because of the master-cpu in a stack */
+	return RTL930X_L2_PORT_NEW_SA_FWD(p);
+}
+
+inline static int rtl930x_trk_mbr_ctr(int group)
+{
+	return RTL930X_TRK_MBR_CTRL + (group << 2);
+}
+
+static void rtl930x_vlan_tables_read(u32 vlan, struct rtl838x_vlan_info *info)
+{
+	u32 v, w;
+	/* Read VLAN table (1) via register 0 */
+	struct table_reg *r = rtl_table_get(RTL9300_TBL_0, 1);
+
+	rtl_table_read(r, vlan);
+	v = sw_r32(rtl_table_data(r, 0));
+	w = sw_r32(rtl_table_data(r, 1));
+	pr_debug("VLAN_READ %d: %08x %08x\n", vlan, v, w);
+	rtl_table_release(r);
+
+	info->tagged_ports = v >> 3;
+	info->profile_id = (w >> 24) & 7;
+	info->hash_mc_fid = !!(w & BIT(27));
+	info->hash_uc_fid = !!(w & BIT(28));
+	info->fid = ((v & 0x7) << 3) | ((w >> 29) & 0x7);
+
+	/* Read UNTAG table via table register 2 */
+	r = rtl_table_get(RTL9300_TBL_2, 0);
+	rtl_table_read(r, vlan);
+	v = sw_r32(rtl_table_data(r, 0));
+	rtl_table_release(r);
+
+	info->untagged_ports = v >> 3;
+}
+
+static void rtl930x_vlan_set_tagged(u32 vlan, struct rtl838x_vlan_info *info)
+{
+	u32 v, w;
+	/* Access VLAN table (1) via register 0 */
+	struct table_reg *r = rtl_table_get(RTL9300_TBL_0, 1);
+
+	v = info->tagged_ports << 3;
+	v |= ((u32)info->fid) >> 3;
+
+	w = ((u32)info->fid) << 29;
+	w |= info->hash_mc_fid ? BIT(27) : 0;
+	w |= info->hash_uc_fid ? BIT(28) : 0;
+	w |= info->profile_id << 24;
+
+	sw_w32(v, rtl_table_data(r, 0));
+	sw_w32(w, rtl_table_data(r, 1));
+
+	rtl_table_write(r, vlan);
+	rtl_table_release(r);
+}
+
+void rtl930x_vlan_profile_dump(int profile)
+{
+	u32 p[5];
+
+	if (profile < 0 || profile > 7)
+		return;
+
+	p[0] = sw_r32(RTL930X_VLAN_PROFILE_SET(profile));
+	p[1] = sw_r32(RTL930X_VLAN_PROFILE_SET(profile) + 4);
+	p[2] = sw_r32(RTL930X_VLAN_PROFILE_SET(profile) + 8) & 0x1FFFFFFF;
+	p[3] = sw_r32(RTL930X_VLAN_PROFILE_SET(profile) + 12) & 0x1FFFFFFF;
+	p[4] = sw_r32(RTL930X_VLAN_PROFILE_SET(profile) + 16) & 0x1FFFFFFF;
+
+	pr_info("VLAN %d: L2 learn: %d; Unknown MC PMasks: L2 %0x, IPv4 %0x, IPv6: %0x",
+		profile, p[0] & (3 << 21), p[2], p[3], p[4]);
+	pr_info("  Routing enabled: IPv4 UC %c, IPv6 UC %c, IPv4 MC %c, IPv6 MC %c\n",
+		p[0] & BIT(17) ? 'y' : 'n', p[0] & BIT(16) ? 'y' : 'n',
+		p[0] & BIT(13) ? 'y' : 'n', p[0] & BIT(12) ? 'y' : 'n');
+	pr_info("  Bridge enabled: IPv4 MC %c, IPv6 MC %c,\n",
+		p[0] & BIT(15) ? 'y' : 'n', p[0] & BIT(14) ? 'y' : 'n');
+	pr_info("VLAN profile %d: raw %08x %08x %08x %08x %08x\n",
+		profile, p[0], p[1], p[2], p[3], p[4]);
+}
+
+static void rtl930x_vlan_set_untagged(u32 vlan, u64 portmask)
+{
+	struct table_reg *r = rtl_table_get(RTL9300_TBL_2, 0);
+
+	sw_w32(portmask << 3, rtl_table_data(r, 0));
+	rtl_table_write(r, vlan);
+	rtl_table_release(r);
+}
+
+/* Sets the L2 forwarding to be based on either the inner VLAN tag or the outer */
+static void rtl930x_vlan_fwd_on_inner(int port, bool is_set)
+{
+	/* Always set all tag modes to fwd based on either inner or outer tag */
+	if (is_set)
+		sw_w32_mask(0, 0xf, RTL930X_VLAN_PORT_FWD + (port << 2));
+	else
+		sw_w32_mask(0xf, 0, RTL930X_VLAN_PORT_FWD + (port << 2));
+}
+
+static void rtl930x_vlan_profile_setup(int profile)
+{
+	u32 p[5];
+
+	pr_info("In %s\n", __func__);
+	p[0] = sw_r32(RTL930X_VLAN_PROFILE_SET(profile));
+	p[1] = sw_r32(RTL930X_VLAN_PROFILE_SET(profile) + 4);
+
+	/* Enable routing of Ipv4/6 Unicast and IPv4/6 Multicast traffic */
+	p[0] |= BIT(17) | BIT(16) | BIT(13) | BIT(12);
+	p[2] = 0x1fffffff; /* L2 unknown MC flooding portmask all ports, including the CPU-port */
+	p[3] = 0x1fffffff; /* IPv4 unknown MC flooding portmask */
+	p[4] = 0x1fffffff; /* IPv6 unknown MC flooding portmask */
+
+	sw_w32(p[0], RTL930X_VLAN_PROFILE_SET(profile));
+	sw_w32(p[1], RTL930X_VLAN_PROFILE_SET(profile) + 4);
+	sw_w32(p[2], RTL930X_VLAN_PROFILE_SET(profile) + 8);
+	sw_w32(p[3], RTL930X_VLAN_PROFILE_SET(profile) + 12);
+	sw_w32(p[4], RTL930X_VLAN_PROFILE_SET(profile) + 16);
+}
+
+static void rtl930x_l2_learning_setup(void)
+{
+	/* Portmask for flooding broadcast traffic */
+	sw_w32(0x1fffffff, RTL930X_L2_BC_FLD_PMSK);
+
+	/* Portmask for flooding unicast traffic with unknown destination */
+	sw_w32(0x1fffffff, RTL930X_L2_UNKN_UC_FLD_PMSK);
+
+	/* Limit learning to maximum: 32k entries, after that just flood (bits 0-1) */
+	sw_w32((0x7fff << 2) | 0, RTL930X_L2_LRN_CONSTRT_CTRL);
+}
+
+static void rtl930x_stp_get(struct rtl838x_switch_priv *priv, u16 msti, u32 port_state[])
+{
+	u32 cmd = 1 << 17 | /* Execute cmd */
+	          0 << 16 | /* Read */
+	          4 << 12 | /* Table type 0b10 */
+	          (msti & 0xfff);
+	priv->r->exec_tbl0_cmd(cmd);
+
+	for (int i = 0; i < 2; i++)
+		port_state[i] = sw_r32(RTL930X_TBL_ACCESS_DATA_0(i));
+	pr_debug("MSTI: %d STATE: %08x, %08x\n", msti, port_state[0], port_state[1]);
+}
+
+static void rtl930x_stp_set(struct rtl838x_switch_priv *priv, u16 msti, u32 port_state[])
+{
+	u32 cmd = 1 << 17 | /* Execute cmd */
+	          1 << 16 | /* Write */
+	          4 << 12 | /* Table type 4 */
+	          (msti & 0xfff);
+
+	for (int i = 0; i < 2; i++)
+		sw_w32(port_state[i], RTL930X_TBL_ACCESS_DATA_0(i));
+	priv->r->exec_tbl0_cmd(cmd);
+}
+
+static inline int rtl930x_mac_force_mode_ctrl(int p)
+{
+	return RTL930X_MAC_FORCE_MODE_CTRL + (p << 2);
+}
+
+static inline int rtl930x_mac_port_ctrl(int p)
+{
+	return RTL930X_MAC_L2_PORT_CTRL(p);
+}
+
+static inline int rtl930x_mac_link_spd_sts(int p)
+{
+	return RTL930X_MAC_LINK_SPD_STS(p);
+}
+
+static u64 rtl930x_l2_hash_seed(u64 mac, u32 vid)
+{
+	u64 v = vid;
+
+	v <<= 48;
+	v |= mac;
+
+	return v;
+}
+
+/* Calculate both the block 0 and the block 1 hash by applyingthe same hash
+ * algorithm as the one used currently by the ASIC to the seed, and return
+ * both hashes in the lower and higher word of the return value since only 12 bit of
+ * the hash are significant
+ */
+static u32 rtl930x_l2_hash_key(struct rtl838x_switch_priv *priv, u64 seed)
+{
+	u32 k0, k1, h1, h2, h;
+
+	k0 = (u32) (((seed >> 55) & 0x1f) ^
+	           ((seed >> 44) & 0x7ff) ^
+	           ((seed >> 33) & 0x7ff) ^
+	           ((seed >> 22) & 0x7ff) ^
+	           ((seed >> 11) & 0x7ff) ^
+	           (seed & 0x7ff));
+
+	h1 = (seed >> 11) & 0x7ff;
+	h1 = ((h1 & 0x1f) << 6) | ((h1 >> 5) & 0x3f);
+
+	h2 = (seed >> 33) & 0x7ff;
+	h2 = ((h2 & 0x3f) << 5)| ((h2 >> 6) & 0x3f);
+
+	k1 = (u32) (((seed << 55) & 0x1f) ^
+	           ((seed >> 44) & 0x7ff) ^
+	           h2 ^
+	           ((seed >> 22) & 0x7ff) ^
+	           h1 ^
+	           (seed & 0x7ff));
+
+	/* Algorithm choice for block 0 */
+	if (sw_r32(RTL930X_L2_CTRL) & BIT(0))
+		h = k1;
+	else
+		h = k0;
+
+	/* Algorithm choice for block 1
+	 * Since k0 and k1 are < 2048, adding 2048 will offset the hash into the second
+	 * half of hash-space
+	 * 2048 is in fact the hash-table size 16384 divided by 4 hashes per bucket
+	 * divided by 2 to divide the hash space in 2
+	 */
+	if (sw_r32(RTL930X_L2_CTRL) & BIT(1))
+		h |= (k1 + 2048) << 16;
+	else
+		h |= (k0 + 2048) << 16;
+
+	return h;
+}
+
+/* Fills an L2 entry structure from the SoC registers */
+static void rtl930x_fill_l2_entry(u32 r[], struct rtl838x_l2_entry *e)
+{
+	pr_debug("In %s valid?\n", __func__);
+	e->valid = !!(r[2] & BIT(31));
+	if (!e->valid)
+		return;
+
+	pr_debug("In %s is valid\n", __func__);
+	e->is_ip_mc = false;
+	e->is_ipv6_mc = false;
+
+	/* TODO: Is there not a function to copy directly MAC memory? */
+	e->mac[0] = (r[0] >> 24);
+	e->mac[1] = (r[0] >> 16);
+	e->mac[2] = (r[0] >> 8);
+	e->mac[3] = r[0];
+	e->mac[4] = (r[1] >> 24);
+	e->mac[5] = (r[1] >> 16);
+
+	e->next_hop = !!(r[2] & BIT(12));
+	e->rvid = r[1] & 0xfff;
+
+	/* Is it a unicast entry? check multicast bit */
+	if (!(e->mac[0] & 1)) {
+		e->type = L2_UNICAST;
+		e->is_static = !!(r[2] & BIT(14));
+		e->port = (r[2] >> 20) & 0x3ff;
+		/* Check for trunk port */
+		if (r[2] & BIT(30)) {
+			e->is_trunk = true;
+			e->stack_dev = (e->port >> 9) & 1;
+			e->trunk = e->port & 0x3f;
+		} else {
+			e->is_trunk = false;
+			e->stack_dev = (e->port >> 6) & 0xf;
+			e->port = e->port & 0x3f;
+		}
+
+		e->block_da = !!(r[2] & BIT(15));
+		e->block_sa = !!(r[2] & BIT(16));
+		e->suspended = !!(r[2] & BIT(13));
+		e->age = (r[2] >> 17) & 3;
+		e->valid = true;
+		/* the UC_VID field in hardware is used for the VID or for the route id */
+		if (e->next_hop) {
+			e->nh_route_id = r[2] & 0x7ff;
+			e->vid = 0;
+		} else {
+			e->vid = r[2] & 0xfff;
+			e->nh_route_id = 0;
+		}
+	} else {
+		e->valid = true;
+		e->type = L2_MULTICAST;
+		e->mc_portmask_index = (r[2] >> 16) & 0x3ff;
+	}
+}
+
+/* Fills the 3 SoC table registers r[] with the information of in the rtl838x_l2_entry */
+static void rtl930x_fill_l2_row(u32 r[], struct rtl838x_l2_entry *e)
+{
+	u32 port;
+
+	if (!e->valid) {
+		r[0] = r[1] = r[2] = 0;
+		return;
+	}
+
+	r[2] = BIT(31);	/* Set valid bit */
+
+	r[0] = ((u32)e->mac[0]) << 24 |
+	       ((u32)e->mac[1]) << 16 |
+	       ((u32)e->mac[2]) << 8 |
+	       ((u32)e->mac[3]);
+	r[1] = ((u32)e->mac[4]) << 24 |
+	       ((u32)e->mac[5]) << 16;
+
+	r[2] |= e->next_hop ? BIT(12) : 0;
+
+	if (e->type == L2_UNICAST) {
+		r[2] |= e->is_static ? BIT(14) : 0;
+		r[1] |= e->rvid & 0xfff;
+		r[2] |= (e->port & 0x3ff) << 20;
+		if (e->is_trunk) {
+			r[2] |= BIT(30);
+			port = e->stack_dev << 9 | (e->port & 0x3f);
+		} else {
+			port = (e->stack_dev & 0xf) << 6;
+			port |= e->port & 0x3f;
+		}
+		r[2] |= port << 20;
+		r[2] |= e->block_da ? BIT(15) : 0;
+		r[2] |= e->block_sa ? BIT(17) : 0;
+		r[2] |= e->suspended ? BIT(13) : 0;
+		r[2] |= (e->age & 0x3) << 17;
+		/* the UC_VID field in hardware is used for the VID or for the route id */
+		if (e->next_hop)
+			r[2] |= e->nh_route_id & 0x7ff;
+		else
+			r[2] |= e->vid & 0xfff;
+	} else { /* L2_MULTICAST */
+		r[2] |= (e->mc_portmask_index & 0x3ff) << 16;
+		r[2] |= e->mc_mac_index & 0x7ff;
+	}
+}
+
+/* Read an L2 UC or MC entry out of a hash bucket of the L2 forwarding table
+ * hash is the id of the bucket and pos is the position of the entry in that bucket
+ * The data read from the SoC is filled into rtl838x_l2_entry
+ */
+static u64 rtl930x_read_l2_entry_using_hash(u32 hash, u32 pos, struct rtl838x_l2_entry *e)
+{
+	u32 r[3];
+	struct table_reg *q = rtl_table_get(RTL9300_TBL_L2, 0);
+	u32 idx;
+	u64 mac;
+	u64 seed;
+
+	pr_debug("%s: hash %08x, pos: %d\n", __func__, hash, pos);
+
+	/* On the RTL93xx, 2 different hash algorithms are used making it a
+	 * total of 8 buckets that need to be searched, 4 for each hash-half
+	 * Use second hash space when bucket is between 4 and 8
+	 */
+	if (pos >= 4) {
+		pos -= 4;
+		hash >>= 16;
+	} else {
+		hash &= 0xffff;
+	}
+
+	idx = (0 << 14) | (hash << 2) | pos; /* Search SRAM, with hash and at pos in bucket */
+	pr_debug("%s: NOW hash %08x, pos: %d\n", __func__, hash, pos);
+
+	rtl_table_read(q, idx);
+	for (int i = 0; i < 3; i++)
+		r[i] = sw_r32(rtl_table_data(q, i));
+
+	rtl_table_release(q);
+
+	rtl930x_fill_l2_entry(r, e);
+
+	pr_debug("%s: valid: %d, nh: %d\n", __func__, e->valid, e->next_hop);
+	if (!e->valid)
+		return 0;
+
+	mac = ((u64)e->mac[0]) << 40 |
+	      ((u64)e->mac[1]) << 32 |
+	      ((u64)e->mac[2]) << 24 |
+	      ((u64)e->mac[3]) << 16 |
+	      ((u64)e->mac[4]) << 8 |
+	      ((u64)e->mac[5]);
+
+	seed = rtl930x_l2_hash_seed(mac, e->rvid);
+	pr_debug("%s: mac %016llx, seed %016llx\n", __func__, mac, seed);
+
+	/* return vid with concatenated mac as unique id */
+	return seed;
+}
+
+static void rtl930x_write_l2_entry_using_hash(u32 hash, u32 pos, struct rtl838x_l2_entry *e)
+{
+	u32 r[3];
+	struct table_reg *q = rtl_table_get(RTL9300_TBL_L2, 0);
+	u32 idx = (0 << 14) | (hash << 2) | pos; /* Access SRAM, with hash and at pos in bucket */
+
+	pr_debug("%s: hash %d, pos %d\n", __func__, hash, pos);
+	pr_debug("%s: index %d -> mac %02x:%02x:%02x:%02x:%02x:%02x\n", __func__, idx,
+		e->mac[0], e->mac[1], e->mac[2], e->mac[3],e->mac[4],e->mac[5]);
+
+	rtl930x_fill_l2_row(r, e);
+
+	for (int i = 0; i < 3; i++)
+		sw_w32(r[i], rtl_table_data(q, i));
+
+	rtl_table_write(q, idx);
+	rtl_table_release(q);
+}
+
+static u64 rtl930x_read_cam(int idx, struct rtl838x_l2_entry *e)
+{
+	u32 r[3];
+	struct table_reg *q = rtl_table_get(RTL9300_TBL_L2, 1);
+
+	rtl_table_read(q, idx);
+	for (int i = 0; i < 3; i++)
+		r[i] = sw_r32(rtl_table_data(q, i));
+
+	rtl_table_release(q);
+
+	rtl930x_fill_l2_entry(r, e);
+	if (!e->valid)
+		return 0;
+
+	/* return mac with concatenated vid as unique id */
+	return ((u64)r[0] << 28) | ((r[1] & 0xffff0000) >> 4) | e->vid;
+}
+
+static void rtl930x_write_cam(int idx, struct rtl838x_l2_entry *e)
+{
+	u32 r[3];
+	struct table_reg *q = rtl_table_get(RTL9300_TBL_L2, 1); /* Access L2 Table 1 */
+
+	rtl930x_fill_l2_row(r, e);
+
+	for (int i = 0; i < 3; i++)
+		sw_w32(r[i], rtl_table_data(q, i));
+
+	rtl_table_write(q, idx);
+	rtl_table_release(q);
+}
+
+static u64 rtl930x_read_mcast_pmask(int idx)
+{
+	u32 portmask;
+	/* Read MC_PORTMASK (2) via register RTL9300_TBL_L2 */
+	struct table_reg *q = rtl_table_get(RTL9300_TBL_L2, 2);
+
+	rtl_table_read(q, idx);
+	portmask = sw_r32(rtl_table_data(q, 0));
+	portmask >>= 3;
+	rtl_table_release(q);
+
+	pr_debug("%s: Index idx %d has portmask %08x\n", __func__, idx, portmask);
+
+	return portmask;
+}
+
+static void rtl930x_write_mcast_pmask(int idx, u64 portmask)
+{
+	u32 pm = portmask;
+
+	/* Access MC_PORTMASK (2) via register RTL9300_TBL_L2 */
+	struct table_reg *q = rtl_table_get(RTL9300_TBL_L2, 2);
+
+	pr_debug("%s: Index idx %d has portmask %08x\n", __func__, idx, pm);
+	pm <<= 3;
+	sw_w32(pm, rtl_table_data(q, 0));
+	rtl_table_write(q, idx);
+	rtl_table_release(q);
+}
+
+u64 rtl930x_traffic_get(int source)
+{
+	u32 v;
+	struct table_reg *r = rtl_table_get(RTL9300_TBL_0, 6);
+
+	rtl_table_read(r, source);
+	v = sw_r32(rtl_table_data(r, 0));
+	rtl_table_release(r);
+	v = v >> 3;
+
+	return v;
+}
+
+/* Enable traffic between a source port and a destination port matrix */
+void rtl930x_traffic_set(int source, u64 dest_matrix)
+{
+	struct table_reg *r = rtl_table_get(RTL9300_TBL_0, 6);
+
+	sw_w32((dest_matrix << 3), rtl_table_data(r, 0));
+	rtl_table_write(r, source);
+	rtl_table_release(r);
+}
+
+void rtl930x_traffic_enable(int source, int dest)
+{
+	struct table_reg *r = rtl_table_get(RTL9300_TBL_0, 6);
+	rtl_table_read(r, source);
+	sw_w32_mask(0, BIT(dest + 3), rtl_table_data(r, 0));
+	rtl_table_write(r, source);
+	rtl_table_release(r);
+}
+
+void rtl930x_traffic_disable(int source, int dest)
+{
+	struct table_reg *r = rtl_table_get(RTL9300_TBL_0, 6);
+	rtl_table_read(r, source);
+	sw_w32_mask(BIT(dest + 3), 0, rtl_table_data(r, 0));
+	rtl_table_write(r, source);
+	rtl_table_release(r);
+}
+
+void rtl9300_dump_debug(void)
+{
+	u16 r = RTL930X_STAT_PRVTE_DROP_COUNTER0;
+
+	for (int i = 0; i < 10; i ++) {
+		pr_info("# %d %08x %08x %08x %08x %08x %08x %08x %08x\n", i * 8,
+			sw_r32(r), sw_r32(r + 4), sw_r32(r + 8), sw_r32(r + 12),
+			sw_r32(r + 16), sw_r32(r + 20), sw_r32(r + 24), sw_r32(r + 28));
+		r += 32;
+	}
+	pr_info("# %08x %08x %08x %08x %08x\n",
+		sw_r32(r), sw_r32(r + 4), sw_r32(r + 8), sw_r32(r + 12), sw_r32(r + 16));
+	rtl930x_print_matrix();
+	pr_info("RTL930X_L2_PORT_SABLK_CTRL: %08x, RTL930X_L2_PORT_DABLK_CTRL %08x\n",
+		sw_r32(RTL930X_L2_PORT_SABLK_CTRL), sw_r32(RTL930X_L2_PORT_DABLK_CTRL)
+
+	);
+}
+
+irqreturn_t rtl930x_switch_irq(int irq, void *dev_id)
+{
+	struct dsa_switch *ds = dev_id;
+	u32 ports = sw_r32(RTL930X_ISR_PORT_LINK_STS_CHG);
+	u32 link;
+
+	/* Clear status */
+	sw_w32(ports, RTL930X_ISR_PORT_LINK_STS_CHG);
+
+	for (int i = 0; i < 28; i++) {
+		if (ports & BIT(i)) {
+			/* Read the register twice because of issues with latency at least
+			 * with the external RTL8226 PHY on the XGS1210
+			 */
+			link = sw_r32(RTL930X_MAC_LINK_STS);
+			link = sw_r32(RTL930X_MAC_LINK_STS);
+			if (link & BIT(i))
+				dsa_port_phylink_mac_change(ds, i, true);
+			else
+				dsa_port_phylink_mac_change(ds, i, false);
+		}
+	}
+
+	return IRQ_HANDLED;
+}
+
+int rtl930x_write_phy(u32 port, u32 page, u32 reg, u32 val)
+{
+	u32 v;
+	int err = 0;
+
+	pr_debug("%s: port %d, page: %d, reg: %x, val: %x\n", __func__, port, page, reg, val);
+
+	if (port > 63 || page > 4095 || reg > 31)
+		return -ENOTSUPP;
+
+	val &= 0xffff;
+	mutex_lock(&smi_lock);
+
+	sw_w32(BIT(port), RTL930X_SMI_ACCESS_PHY_CTRL_0);
+	sw_w32_mask(0xffff << 16, val << 16, RTL930X_SMI_ACCESS_PHY_CTRL_2);
+	v = reg << 20 | page << 3 | 0x1f << 15 | BIT(2) | BIT(0);
+	sw_w32(v, RTL930X_SMI_ACCESS_PHY_CTRL_1);
+
+	do {
+		v = sw_r32(RTL930X_SMI_ACCESS_PHY_CTRL_1);
+	} while (v & 0x1);
+
+	if (v & 0x2)
+		err = -EIO;
+
+	mutex_unlock(&smi_lock);
+
+	return err;
+}
+
+int rtl930x_read_phy(u32 port, u32 page, u32 reg, u32 *val)
+{
+	u32 v;
+	int err = 0;
+
+	if (port > 63 || page > 4095 || reg > 31)
+		return -ENOTSUPP;
+
+	mutex_lock(&smi_lock);
+
+	sw_w32_mask(0xffff << 16, port << 16, RTL930X_SMI_ACCESS_PHY_CTRL_2);
+	v = reg << 20 | page << 3 | 0x1f << 15 | 1;
+	sw_w32(v, RTL930X_SMI_ACCESS_PHY_CTRL_1);
+
+	do {
+		v = sw_r32(RTL930X_SMI_ACCESS_PHY_CTRL_1);
+	} while ( v & 0x1);
+
+	if (v & BIT(25)) {
+		pr_debug("Error reading phy %d, register %d\n", port, reg);
+		err = -EIO;
+	}
+	*val = (sw_r32(RTL930X_SMI_ACCESS_PHY_CTRL_2) & 0xffff);
+
+	pr_debug("%s: port %d, page: %d, reg: %x, val: %x\n", __func__, port, page, reg, *val);
+
+	mutex_unlock(&smi_lock);
+
+	return err;
+}
+
+/* Write to an mmd register of the PHY */
+int rtl930x_write_mmd_phy(u32 port, u32 devnum, u32 regnum, u32 val)
+{
+	int err = 0;
+	u32 v;
+
+	mutex_lock(&smi_lock);
+
+	/* Set PHY to access */
+	sw_w32(BIT(port), RTL930X_SMI_ACCESS_PHY_CTRL_0);
+
+	/* Set data to write */
+	sw_w32_mask(0xffff << 16, val << 16, RTL930X_SMI_ACCESS_PHY_CTRL_2);
+
+	/* Set MMD device number and register to write to */
+	sw_w32(devnum << 16 | (regnum & 0xffff), RTL930X_SMI_ACCESS_PHY_CTRL_3);
+
+	v = BIT(2) | BIT(1) | BIT(0); /* WRITE | MMD-access | EXEC */
+	sw_w32(v, RTL930X_SMI_ACCESS_PHY_CTRL_1);
+
+	do {
+		v = sw_r32(RTL930X_SMI_ACCESS_PHY_CTRL_1);
+	} while (v & BIT(0));
+
+	pr_debug("%s: port %d, regnum: %x, val: %x (err %d)\n", __func__, port, regnum, val, err);
+	mutex_unlock(&smi_lock);
+	return err;
+}
+
+/* Read an mmd register of the PHY */
+int rtl930x_read_mmd_phy(u32 port, u32 devnum, u32 regnum, u32 *val)
+{
+	int err = 0;
+	u32 v;
+
+	mutex_lock(&smi_lock);
+
+	/* Set PHY to access */
+	sw_w32_mask(0xffff << 16, port << 16, RTL930X_SMI_ACCESS_PHY_CTRL_2);
+
+	/* Set MMD device number and register to write to */
+	sw_w32(devnum << 16 | (regnum & 0xffff), RTL930X_SMI_ACCESS_PHY_CTRL_3);
+
+	v = BIT(1) | BIT(0); /* MMD-access | EXEC */
+	sw_w32(v, RTL930X_SMI_ACCESS_PHY_CTRL_1);
+
+	do {
+		v = sw_r32(RTL930X_SMI_ACCESS_PHY_CTRL_1);
+	} while (v & BIT(0));
+	/* There is no error-checking via BIT 25 of v, as it does not seem to be set correctly */
+	*val = (sw_r32(RTL930X_SMI_ACCESS_PHY_CTRL_2) & 0xffff);
+	pr_debug("%s: port %d, regnum: %x, val: %x (err %d)\n", __func__, port, regnum, *val, err);
+
+	mutex_unlock(&smi_lock);
+
+	return err;
+}
+
+/* Calculate both the block 0 and the block 1 hash, and return in
+ * lower and higher word of the return value since only 12 bit of
+ * the hash are significant
+ */
+u32 rtl930x_hash(struct rtl838x_switch_priv *priv, u64 seed)
+{
+	u32 k0, k1, h1, h2, h;
+
+	k0 = (u32) (((seed >> 55) & 0x1f) ^
+	            ((seed >> 44) & 0x7ff) ^
+	            ((seed >> 33) & 0x7ff) ^
+	            ((seed >> 22) & 0x7ff) ^
+	            ((seed >> 11) & 0x7ff) ^
+	            (seed & 0x7ff));
+
+	h1 = (seed >> 11) & 0x7ff;
+	h1 = ((h1 & 0x1f) << 6) | ((h1 >> 5) & 0x3f);
+
+	h2 = (seed >> 33) & 0x7ff;
+	h2 = ((h2 & 0x3f) << 5) | ((h2 >> 6) & 0x3f);
+
+	k1 = (u32) (((seed << 55) & 0x1f) ^
+	           ((seed >> 44) & 0x7ff) ^
+	           h2 ^
+	           ((seed >> 22) & 0x7ff) ^
+	           h1 ^
+	           (seed & 0x7ff));
+
+	/* Algorithm choice for block 0 */
+	if (sw_r32(RTL930X_L2_CTRL) & BIT(0))
+		h = k1;
+	else
+		h = k0;
+
+	/* Algorithm choice for block 1
+	 * Since k0 and k1 are < 2048, adding 2048 will offset the hash into the second
+	 * half of hash-space
+	 * 2048 is in fact the hash-table size 16384 divided by 4 hashes per bucket
+	 * divided by 2 to divide the hash space in 2
+	 */
+	if (sw_r32(RTL930X_L2_CTRL) & BIT(1))
+		h |= (k1 + 2048) << 16;
+	else
+		h |= (k0 + 2048) << 16;
+
+	return h;
+}
+
+/* Enables or disables the EEE/EEEP capability of a port */
+void rtl930x_port_eee_set(struct rtl838x_switch_priv *priv, int port, bool enable)
+{
+	u32 v;
+
+	/* This works only for Ethernet ports, and on the RTL930X, ports from 26 are SFP */
+	if (port >= 26)
+		return;
+
+	pr_debug("In %s: setting port %d to %d\n", __func__, port, enable);
+	v = enable ? 0x3f : 0x0;
+
+	/* Set EEE/EEEP state for 100, 500, 1000MBit and 2.5, 5 and 10GBit */
+	sw_w32_mask(0, v << 10, rtl930x_mac_force_mode_ctrl(port));
+
+	/* Set TX/RX EEE state */
+	v = enable ? 0x3 : 0x0;
+	sw_w32(v, RTL930X_EEE_CTRL(port));
+
+	priv->ports[port].eee_enabled = enable;
+}
+
+/* Get EEE own capabilities and negotiation result */
+int rtl930x_eee_port_ability(struct rtl838x_switch_priv *priv, struct ethtool_eee *e, int port)
+{
+	u32 link, a;
+
+	if (port >= 26)
+		return -ENOTSUPP;
+
+	pr_info("In %s, port %d\n", __func__, port);
+	link = sw_r32(RTL930X_MAC_LINK_STS);
+	link = sw_r32(RTL930X_MAC_LINK_STS);
+	if (!(link & BIT(port)))
+		return 0;
+
+	pr_info("Setting advertised\n");
+	if (sw_r32(rtl930x_mac_force_mode_ctrl(port)) & BIT(10))
+		e->advertised |= ADVERTISED_100baseT_Full;
+
+	if (sw_r32(rtl930x_mac_force_mode_ctrl(port)) & BIT(12))
+		e->advertised |= ADVERTISED_1000baseT_Full;
+
+	if (priv->ports[port].is2G5 && sw_r32(rtl930x_mac_force_mode_ctrl(port)) & BIT(13)) {
+		pr_info("ADVERTISING 2.5G EEE\n");
+		e->advertised |= ADVERTISED_2500baseX_Full;
+	}
+
+	if (priv->ports[port].is10G && sw_r32(rtl930x_mac_force_mode_ctrl(port)) & BIT(15))
+		e->advertised |= ADVERTISED_10000baseT_Full;
+
+	a = sw_r32(RTL930X_MAC_EEE_ABLTY);
+	a = sw_r32(RTL930X_MAC_EEE_ABLTY);
+	pr_info("Link partner: %08x\n", a);
+	if (a & BIT(port)) {
+		e->lp_advertised = ADVERTISED_100baseT_Full;
+		e->lp_advertised |= ADVERTISED_1000baseT_Full;
+		if (priv->ports[port].is2G5)
+			e->lp_advertised |= ADVERTISED_2500baseX_Full;
+		if (priv->ports[port].is10G)
+			e->lp_advertised |= ADVERTISED_10000baseT_Full;
+	}
+
+	/* Read 2x to clear latched state */
+	a = sw_r32(RTL930X_EEEP_PORT_CTRL(port));
+	a = sw_r32(RTL930X_EEEP_PORT_CTRL(port));
+	pr_info("%s RTL930X_EEEP_PORT_CTRL: %08x\n", __func__, a);
+
+	return 0;
+}
+
+static void rtl930x_init_eee(struct rtl838x_switch_priv *priv, bool enable)
+{
+	pr_info("Setting up EEE, state: %d\n", enable);
+
+	/* Setup EEE on all ports */
+	for (int i = 0; i < priv->cpu_port; i++) {
+		if (priv->ports[i].phy)
+			rtl930x_port_eee_set(priv, i, enable);
+	}
+
+	priv->eee_enabled = enable;
+}
+#define HASH_PICK(val, lsb, len)   ((val & (((1 << len) - 1) << lsb)) >> lsb)
+
+static u32 rtl930x_l3_hash4(u32 ip, int algorithm, bool move_dip)
+{
+	u32 rows[4];
+	u32 hash;
+	u32 s0, s1, pH;
+
+	memset(rows, 0, sizeof(rows));
+
+	rows[0] = HASH_PICK(ip, 27, 5);
+	rows[1] = HASH_PICK(ip, 18, 9);
+	rows[2] = HASH_PICK(ip, 9, 9);
+
+	if (!move_dip)
+		rows[3] = HASH_PICK(ip, 0, 9);
+
+	if (!algorithm) {
+		hash = rows[0] ^ rows[1] ^ rows[2] ^ rows[3];
+	} else {
+		s0 = rows[0] + rows[1] + rows[2];
+		s1 = (s0 & 0x1ff) + ((s0 & (0x1ff << 9)) >> 9);
+		pH = (s1 & 0x1ff) + ((s1 & (0x1ff << 9)) >> 9);
+		hash = pH ^ rows[3];
+	}
+	return hash;
+}
+
+// Currently not used
+// static u32 rtl930x_l3_hash6(struct in6_addr *ip6, int algorithm, bool move_dip)
+// {
+// 	u32 rows[16];
+// 	u32 hash;
+// 	u32 s0, s1, pH;
+
+// 	rows[0] = (HASH_PICK(ip6->s6_addr[0], 6, 2) << 0);
+// 	rows[1] = (HASH_PICK(ip6->s6_addr[0], 0, 6) << 3) | HASH_PICK(ip6->s6_addr[1], 5, 3);
+// 	rows[2] = (HASH_PICK(ip6->s6_addr[1], 0, 5) << 4) | HASH_PICK(ip6->s6_addr[2], 4, 4);
+// 	rows[3] = (HASH_PICK(ip6->s6_addr[2], 0, 4) << 5) | HASH_PICK(ip6->s6_addr[3], 3, 5);
+// 	rows[4] = (HASH_PICK(ip6->s6_addr[3], 0, 3) << 6) | HASH_PICK(ip6->s6_addr[4], 2, 6);
+// 	rows[5] = (HASH_PICK(ip6->s6_addr[4], 0, 2) << 7) | HASH_PICK(ip6->s6_addr[5], 1, 7);
+// 	rows[6] = (HASH_PICK(ip6->s6_addr[5], 0, 1) << 8) | HASH_PICK(ip6->s6_addr[6], 0, 8);
+// 	rows[7] = (HASH_PICK(ip6->s6_addr[7], 0, 8) << 1) | HASH_PICK(ip6->s6_addr[8], 7, 1);
+// 	rows[8] = (HASH_PICK(ip6->s6_addr[8], 0, 7) << 2) | HASH_PICK(ip6->s6_addr[9], 6, 2);
+// 	rows[9] = (HASH_PICK(ip6->s6_addr[9], 0, 6) << 3) | HASH_PICK(ip6->s6_addr[10], 5, 3);
+// 	rows[10] = (HASH_PICK(ip6->s6_addr[10], 0, 5) << 4) | HASH_PICK(ip6->s6_addr[11], 4, 4);
+// 	if (!algorithm) {
+// 		rows[11] = (HASH_PICK(ip6->s6_addr[11], 0, 4) << 5) |
+// 		           (HASH_PICK(ip6->s6_addr[12], 3, 5) << 0);
+// 		rows[12] = (HASH_PICK(ip6->s6_addr[12], 0, 3) << 6) |
+// 		           (HASH_PICK(ip6->s6_addr[13], 2, 6) << 0);
+// 		rows[13] = (HASH_PICK(ip6->s6_addr[13], 0, 2) << 7) |
+// 		           (HASH_PICK(ip6->s6_addr[14], 1, 7) << 0);
+// 		if (!move_dip) {
+// 			rows[14] = (HASH_PICK(ip6->s6_addr[14], 0, 1) << 8) |
+// 			           (HASH_PICK(ip6->s6_addr[15], 0, 8) << 0);
+// 		}
+// 		hash = rows[0] ^ rows[1] ^ rows[2] ^ rows[3] ^ rows[4] ^
+// 		       rows[5] ^ rows[6] ^ rows[7] ^ rows[8] ^ rows[9] ^
+// 		       rows[10] ^ rows[11] ^ rows[12] ^ rows[13] ^ rows[14];
+// 	} else {
+// 		rows[11] = (HASH_PICK(ip6->s6_addr[11], 0, 4) << 5);
+// 		rows[12] = (HASH_PICK(ip6->s6_addr[12], 3, 5) << 0);
+// 		rows[13] = (HASH_PICK(ip6->s6_addr[12], 0, 3) << 6) |
+// 		           HASH_PICK(ip6->s6_addr[13], 2, 6);
+// 		rows[14] = (HASH_PICK(ip6->s6_addr[13], 0, 2) << 7) |
+// 		           HASH_PICK(ip6->s6_addr[14], 1, 7);
+// 		if (!move_dip) {
+// 			rows[15] = (HASH_PICK(ip6->s6_addr[14], 0, 1) << 8) |
+// 			           (HASH_PICK(ip6->s6_addr[15], 0, 8) << 0);
+// 		}
+// 		s0 = rows[12] + rows[13] + rows[14];
+// 		s1 = (s0 & 0x1ff) + ((s0 & (0x1ff << 9)) >> 9);
+// 		pH = (s1 & 0x1ff) + ((s1 & (0x1ff << 9)) >> 9);
+// 		hash = rows[0] ^ rows[1] ^ rows[2] ^ rows[3] ^ rows[4] ^
+// 		       rows[5] ^ rows[6] ^ rows[7] ^ rows[8] ^ rows[9] ^
+// 		       rows[10] ^ rows[11] ^ pH ^ rows[15];
+// 	}
+// 	return hash;
+// }
+
+/* Read a prefix route entry from the L3_PREFIX_ROUTE_IPUC table
+ * We currently only support IPv4 and IPv6 unicast route
+ */
+static void rtl930x_route_read(int idx, struct rtl83xx_route *rt)
+{
+	u32 v, ip4_m;
+	bool host_route, default_route;
+	struct in6_addr ip6_m;
+
+	/* Read L3_PREFIX_ROUTE_IPUC table (2) via register RTL9300_TBL_1 */
+	struct table_reg *r = rtl_table_get(RTL9300_TBL_1, 2);
+
+	rtl_table_read(r, idx);
+	/* The table has a size of 11 registers */
+	rt->attr.valid = !!(sw_r32(rtl_table_data(r, 0)) & BIT(31));
+	if (!rt->attr.valid)
+		goto out;
+
+	rt->attr.type = (sw_r32(rtl_table_data(r, 0)) >> 29) & 0x3;
+
+	v = sw_r32(rtl_table_data(r, 10));
+	host_route = !!(v & BIT(21));
+	default_route = !!(v & BIT(20));
+	rt->prefix_len = -1;
+	pr_info("%s: host route %d, default_route %d\n", __func__, host_route, default_route);
+
+	switch (rt->attr.type) {
+	case 0: /* IPv4 Unicast route */
+		rt->dst_ip = sw_r32(rtl_table_data(r, 4));
+		ip4_m = sw_r32(rtl_table_data(r, 9));
+		pr_info("%s: Read ip4 mask: %08x\n", __func__, ip4_m);
+		rt->prefix_len = host_route ? 32 : -1;
+		rt->prefix_len = (rt->prefix_len < 0 && default_route) ? 0 : -1;
+		if (rt->prefix_len < 0)
+			rt->prefix_len = inet_mask_len(ip4_m);
+		break;
+	case 2: /* IPv6 Unicast route */
+		ipv6_addr_set(&rt->dst_ip6,
+			      sw_r32(rtl_table_data(r, 1)), sw_r32(rtl_table_data(r, 2)),
+			      sw_r32(rtl_table_data(r, 3)), sw_r32(rtl_table_data(r, 4)));
+		ipv6_addr_set(&ip6_m,
+			      sw_r32(rtl_table_data(r, 6)), sw_r32(rtl_table_data(r, 7)),
+			      sw_r32(rtl_table_data(r, 8)), sw_r32(rtl_table_data(r, 9)));
+		rt->prefix_len = host_route ? 128 : 0;
+		rt->prefix_len = (rt->prefix_len < 0 && default_route) ? 0 : -1;
+		if (rt->prefix_len < 0)
+			rt->prefix_len = find_last_bit((unsigned long int *)&ip6_m.s6_addr32,
+							 128);
+		break;
+	case 1: /* IPv4 Multicast route */
+	case 3: /* IPv6 Multicast route */
+		pr_warn("%s: route type not supported\n", __func__);
+		goto out;
+	}
+
+	rt->attr.hit = !!(v & BIT(22));
+	rt->attr.action = (v >> 18) & 3;
+	rt->nh.id = (v >> 7) & 0x7ff;
+	rt->attr.ttl_dec = !!(v & BIT(6));
+	rt->attr.ttl_check = !!(v & BIT(5));
+	rt->attr.dst_null = !!(v & BIT(4));
+	rt->attr.qos_as = !!(v & BIT(3));
+	rt->attr.qos_prio =  v & 0x7;
+	pr_info("%s: index %d is valid: %d\n", __func__, idx, rt->attr.valid);
+	pr_info("%s: next_hop: %d, hit: %d, action :%d, ttl_dec %d, ttl_check %d, dst_null %d\n",
+		__func__, rt->nh.id, rt->attr.hit, rt->attr.action,
+		rt->attr.ttl_dec, rt->attr.ttl_check, rt->attr.dst_null);
+	pr_info("%s: GW: %pI4, prefix_len: %d\n", __func__, &rt->dst_ip, rt->prefix_len);
+out:
+	rtl_table_release(r);
+}
+
+static void rtl930x_net6_mask(int prefix_len, struct in6_addr *ip6_m)
+{
+	int o, b;
+	/* Define network mask */
+	o = prefix_len >> 3;
+	b = prefix_len & 0x7;
+	memset(ip6_m->s6_addr, 0xff, o);
+	ip6_m->s6_addr[o] |= b ? 0xff00 >> b : 0x00;
+}
+
+/* Read a host route entry from the table using its index
+ * We currently only support IPv4 and IPv6 unicast route
+ */
+static void rtl930x_host_route_read(int idx, struct rtl83xx_route *rt)
+{
+	u32 v;
+	/* Read L3_HOST_ROUTE_IPUC table (1) via register RTL9300_TBL_1 */
+	struct table_reg *r = rtl_table_get(RTL9300_TBL_1, 1);
+
+	idx = ((idx / 6) * 8) + (idx % 6);
+
+	pr_debug("In %s, physical index %d\n", __func__, idx);
+	rtl_table_read(r, idx);
+	/* The table has a size of 5 (for UC, 11 for MC) registers */
+	v = sw_r32(rtl_table_data(r, 0));
+	rt->attr.valid = !!(v & BIT(31));
+	if (!rt->attr.valid)
+		goto out;
+	rt->attr.type = (v >> 29) & 0x3;
+	switch (rt->attr.type) {
+	case 0: /* IPv4 Unicast route */
+		rt->dst_ip = sw_r32(rtl_table_data(r, 4));
+		break;
+	case 2: /* IPv6 Unicast route */
+		ipv6_addr_set(&rt->dst_ip6,
+			      sw_r32(rtl_table_data(r, 3)), sw_r32(rtl_table_data(r, 2)),
+			      sw_r32(rtl_table_data(r, 1)), sw_r32(rtl_table_data(r, 0)));
+		break;
+	case 1: /* IPv4 Multicast route */
+	case 3: /* IPv6 Multicast route */
+		pr_warn("%s: route type not supported\n", __func__);
+		goto out;
+	}
+
+	rt->attr.hit = !!(v & BIT(20));
+	rt->attr.dst_null = !!(v & BIT(19));
+	rt->attr.action = (v >> 17) & 3;
+	rt->nh.id = (v >> 6) & 0x7ff;
+	rt->attr.ttl_dec = !!(v & BIT(5));
+	rt->attr.ttl_check = !!(v & BIT(4));
+	rt->attr.qos_as = !!(v & BIT(3));
+	rt->attr.qos_prio =  v & 0x7;
+	pr_debug("%s: index %d is valid: %d\n", __func__, idx, rt->attr.valid);
+	pr_debug("%s: next_hop: %d, hit: %d, action :%d, ttl_dec %d, ttl_check %d, dst_null %d\n",
+		__func__, rt->nh.id, rt->attr.hit, rt->attr.action, rt->attr.ttl_dec, rt->attr.ttl_check,
+		rt->attr.dst_null);
+	pr_debug("%s: Destination: %pI4\n", __func__, &rt->dst_ip);
+
+out:
+	rtl_table_release(r);
+}
+
+/* Write a host route entry from the table using its index
+ * We currently only support IPv4 and IPv6 unicast route
+ */
+static void rtl930x_host_route_write(int idx, struct rtl83xx_route *rt)
+{
+	u32 v;
+	/* Access L3_HOST_ROUTE_IPUC table (1) via register RTL9300_TBL_1 */
+	struct table_reg *r = rtl_table_get(RTL9300_TBL_1, 1);
+	/* The table has a size of 5 (for UC, 11 for MC) registers */
+
+	idx = ((idx / 6) * 8) + (idx % 6);
+
+	pr_debug("%s: index %d is valid: %d\n", __func__, idx, rt->attr.valid);
+	pr_debug("%s: next_hop: %d, hit: %d, action :%d, ttl_dec %d, ttl_check %d, dst_null %d\n",
+		__func__, rt->nh.id, rt->attr.hit, rt->attr.action, rt->attr.ttl_dec, rt->attr.ttl_check,
+		rt->attr.dst_null);
+	pr_debug("%s: GW: %pI4, prefix_len: %d\n", __func__, &rt->dst_ip, rt->prefix_len);
+
+	v = BIT(31); /* Entry is valid */
+	v |= (rt->attr.type & 0x3) << 29;
+	v |= rt->attr.hit ? BIT(20) : 0;
+	v |= rt->attr.dst_null ? BIT(19) : 0;
+	v |= (rt->attr.action & 0x3) << 17;
+	v |= (rt->nh.id & 0x7ff) << 6;
+	v |= rt->attr.ttl_dec ? BIT(5) : 0;
+	v |= rt->attr.ttl_check ? BIT(4) : 0;
+	v |= rt->attr.qos_as ? BIT(3) : 0;
+	v |= rt->attr.qos_prio & 0x7;
+
+	sw_w32(v, rtl_table_data(r, 0));
+	switch (rt->attr.type) {
+	case 0: /* IPv4 Unicast route */
+		sw_w32(0, rtl_table_data(r, 1));
+		sw_w32(0, rtl_table_data(r, 2));
+		sw_w32(0, rtl_table_data(r, 3));
+		sw_w32(rt->dst_ip, rtl_table_data(r, 4));
+		break;
+	case 2: /* IPv6 Unicast route */
+		sw_w32(rt->dst_ip6.s6_addr32[0], rtl_table_data(r, 1));
+		sw_w32(rt->dst_ip6.s6_addr32[1], rtl_table_data(r, 2));
+		sw_w32(rt->dst_ip6.s6_addr32[2], rtl_table_data(r, 3));
+		sw_w32(rt->dst_ip6.s6_addr32[3], rtl_table_data(r, 4));
+		break;
+	case 1: /* IPv4 Multicast route */
+	case 3: /* IPv6 Multicast route */
+		pr_warn("%s: route type not supported\n", __func__);
+		goto out;
+	}
+
+	rtl_table_write(r, idx);
+
+out:
+	rtl_table_release(r);
+}
+
+/* Look up the index of a prefix route in the routing table CAM for unicast IPv4/6 routes
+ * using hardware offload.
+ */
+static int rtl930x_route_lookup_hw(struct rtl83xx_route *rt)
+{
+	u32 ip4_m, v;
+	struct in6_addr ip6_m;
+
+	if (rt->attr.type == 1 || rt->attr.type == 3) /* Hardware only supports UC routes */
+		return -1;
+
+	sw_w32_mask(0x3 << 19, rt->attr.type, RTL930X_L3_HW_LU_KEY_CTRL);
+	if (rt->attr.type) { /* IPv6 */
+		rtl930x_net6_mask(rt->prefix_len, &ip6_m);
+		for (int i = 0; i < 4; i++)
+			sw_w32(rt->dst_ip6.s6_addr32[0] & ip6_m.s6_addr32[0],
+			       RTL930X_L3_HW_LU_KEY_IP_CTRL + (i << 2));
+	} else { /* IPv4 */
+		ip4_m = inet_make_mask(rt->prefix_len);
+		sw_w32(0, RTL930X_L3_HW_LU_KEY_IP_CTRL);
+		sw_w32(0, RTL930X_L3_HW_LU_KEY_IP_CTRL + 4);
+		sw_w32(0, RTL930X_L3_HW_LU_KEY_IP_CTRL + 8);
+		v = rt->dst_ip & ip4_m;
+		pr_info("%s: searching for %pI4\n", __func__, &v);
+		sw_w32(v, RTL930X_L3_HW_LU_KEY_IP_CTRL + 12);
+	}
+
+	/* Execute CAM lookup in SoC */
+	sw_w32(BIT(15), RTL930X_L3_HW_LU_CTRL);
+
+	/* Wait until execute bit clears and result is ready */
+	do {
+		v = sw_r32(RTL930X_L3_HW_LU_CTRL);
+	} while (v & BIT(15));
+
+	pr_info("%s: found: %d, index: %d\n", __func__, !!(v & BIT(14)), v & 0x1ff);
+
+	/* Test if search successful (BIT 14 set) */
+	if (v & BIT(14))
+		return v & 0x1ff;
+
+	return -1;
+}
+
+static int rtl930x_find_l3_slot(struct rtl83xx_route *rt, bool must_exist)
+{
+	int slot_width, algorithm, addr, idx;
+	u32 hash;
+	struct rtl83xx_route route_entry;
+
+	/* IPv6 entries take up 3 slots */
+	slot_width = (rt->attr.type == 0) || (rt->attr.type == 2) ? 1 : 3;
+
+	for (int t = 0; t < 2; t++) {
+		algorithm = (sw_r32(RTL930X_L3_HOST_TBL_CTRL) >> (2 + t)) & 0x1;
+		hash = rtl930x_l3_hash4(rt->dst_ip, algorithm, false);
+
+		pr_debug("%s: table %d, algorithm %d, hash %04x\n", __func__, t, algorithm, hash);
+
+		for (int s = 0; s < 6; s += slot_width) {
+			addr = (t << 12) | ((hash & 0x1ff) << 3) | s;
+			pr_debug("%s physical address %d\n", __func__, addr);
+			idx = ((addr / 8) * 6) + (addr % 8);
+			pr_debug("%s logical address %d\n", __func__, idx);
+
+			rtl930x_host_route_read(idx, &route_entry);
+			pr_debug("%s route valid %d, route dest: %pI4, hit %d\n", __func__,
+				rt->attr.valid, &rt->dst_ip, rt->attr.hit);
+			if (!must_exist && rt->attr.valid)
+				return idx;
+			if (must_exist && route_entry.dst_ip == rt->dst_ip)
+				return idx;
+		}
+	}
+
+	return -1;
+}
+
+/* Write a prefix route into the routing table CAM at position idx
+ * Currently only IPv4 and IPv6 unicast routes are supported
+ */
+static void rtl930x_route_write(int idx, struct rtl83xx_route *rt)
+{
+	u32 v, ip4_m;
+	struct in6_addr ip6_m;
+	/* Access L3_PREFIX_ROUTE_IPUC table (2) via register RTL9300_TBL_1 */
+	/* The table has a size of 11 registers (20 for MC) */
+	struct table_reg *r = rtl_table_get(RTL9300_TBL_1, 2);
+
+	pr_debug("%s: index %d is valid: %d\n", __func__, idx, rt->attr.valid);
+	pr_debug("%s: nexthop: %d, hit: %d, action :%d, ttl_dec %d, ttl_check %d, dst_null %d\n",
+		__func__, rt->nh.id, rt->attr.hit, rt->attr.action,
+		rt->attr.ttl_dec, rt->attr.ttl_check, rt->attr.dst_null);
+	pr_debug("%s: GW: %pI4, prefix_len: %d\n", __func__, &rt->dst_ip, rt->prefix_len);
+
+	v = rt->attr.valid ? BIT(31) : 0;
+	v |= (rt->attr.type & 0x3) << 29;
+	sw_w32(v, rtl_table_data(r, 0));
+
+	v = rt->attr.hit ? BIT(22) : 0;
+	v |= (rt->attr.action & 0x3) << 18;
+	v |= (rt->nh.id & 0x7ff) << 7;
+	v |= rt->attr.ttl_dec ? BIT(6) : 0;
+	v |= rt->attr.ttl_check ? BIT(5) : 0;
+	v |= rt->attr.dst_null ? BIT(6) : 0;
+	v |= rt->attr.qos_as ? BIT(6) : 0;
+	v |= rt->attr.qos_prio & 0x7;
+	v |= rt->prefix_len == 0 ? BIT(20) : 0; /* set default route bit */
+
+	/* set bit mask for entry type always to 0x3 */
+	sw_w32(0x3 << 29, rtl_table_data(r, 5));
+
+	switch (rt->attr.type) {
+	case 0: /* IPv4 Unicast route */
+		sw_w32(0, rtl_table_data(r, 1));
+		sw_w32(0, rtl_table_data(r, 2));
+		sw_w32(0, rtl_table_data(r, 3));
+		sw_w32(rt->dst_ip, rtl_table_data(r, 4));
+
+		v |= rt->prefix_len == 32 ? BIT(21) : 0; /* set host-route bit */
+		ip4_m = inet_make_mask(rt->prefix_len);
+		sw_w32(0, rtl_table_data(r, 6));
+		sw_w32(0, rtl_table_data(r, 7));
+		sw_w32(0, rtl_table_data(r, 8));
+		sw_w32(ip4_m, rtl_table_data(r, 9));
+		break;
+	case 2: /* IPv6 Unicast route */
+		sw_w32(rt->dst_ip6.s6_addr32[0], rtl_table_data(r, 1));
+		sw_w32(rt->dst_ip6.s6_addr32[1], rtl_table_data(r, 2));
+		sw_w32(rt->dst_ip6.s6_addr32[2], rtl_table_data(r, 3));
+		sw_w32(rt->dst_ip6.s6_addr32[3], rtl_table_data(r, 4));
+
+		v |= rt->prefix_len == 128 ? BIT(21) : 0; /* set host-route bit */
+
+		rtl930x_net6_mask(rt->prefix_len, &ip6_m);
+
+		sw_w32(ip6_m.s6_addr32[0], rtl_table_data(r, 6));
+		sw_w32(ip6_m.s6_addr32[1], rtl_table_data(r, 7));
+		sw_w32(ip6_m.s6_addr32[2], rtl_table_data(r, 8));
+		sw_w32(ip6_m.s6_addr32[3], rtl_table_data(r, 9));
+		break;
+	case 1: /* IPv4 Multicast route */
+	case 3: /* IPv6 Multicast route */
+		pr_warn("%s: route type not supported\n", __func__);
+		rtl_table_release(r);
+		return;
+	}
+	sw_w32(v, rtl_table_data(r, 10));
+
+	pr_debug("%s: %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x\n", __func__,
+		sw_r32(rtl_table_data(r, 0)), sw_r32(rtl_table_data(r, 1)), sw_r32(rtl_table_data(r, 2)),
+		sw_r32(rtl_table_data(r, 3)), sw_r32(rtl_table_data(r, 4)), sw_r32(rtl_table_data(r, 5)),
+		sw_r32(rtl_table_data(r, 6)), sw_r32(rtl_table_data(r, 7)), sw_r32(rtl_table_data(r, 8)),
+		sw_r32(rtl_table_data(r, 9)), sw_r32(rtl_table_data(r, 10)));
+
+	rtl_table_write(r, idx);
+	rtl_table_release(r);
+}
+
+
+/* Get the destination MAC and L3 egress interface ID of a nexthop entry from
+ * the SoC's L3_NEXTHOP table
+ */
+static void rtl930x_get_l3_nexthop(int idx, u16 *dmac_id, u16 *interface)
+{
+	u32 v;
+	/* Read L3_NEXTHOP table (3) via register RTL9300_TBL_1 */
+	struct table_reg *r = rtl_table_get(RTL9300_TBL_1, 3);
+
+	rtl_table_read(r, idx);
+	/* The table has a size of 1 register */
+	v = sw_r32(rtl_table_data(r, 0));
+	rtl_table_release(r);
+
+	*dmac_id = (v >> 7) & 0x7fff;
+	*interface = v & 0x7f;
+}
+
+// Currently not used
+// static int rtl930x_l3_mtu_del(struct rtl838x_switch_priv *priv, int mtu)
+// {
+// 	int i;
+
+// 	for (i = 0; i < MAX_INTF_MTUS; i++) {
+// 		if (mtu == priv->intf_mtus[i])
+// 			break;
+// 	}
+// 	if (i >= MAX_INTF_MTUS || !priv->intf_mtu_count[i]) {
+// 		pr_err("%s: No MTU slot found for MTU: %d\n", __func__, mtu);
+// 		return -EINVAL;
+// 	}
+
+// 	priv->intf_mtu_count[i]--;
+// }
+
+// Currently not used
+// static int rtl930x_l3_mtu_add(struct rtl838x_switch_priv *priv, int mtu)
+// {
+// 	int i, free_mtu;
+// 	int mtu_id;
+
+// 	/* Try to find an existing mtu-value or a free slot */
+// 	free_mtu = MAX_INTF_MTUS;
+// 	for (i = 0; i < MAX_INTF_MTUS && priv->intf_mtus[i] != mtu; i++) {
+// 		if ((!priv->intf_mtu_count[i]) && (free_mtu == MAX_INTF_MTUS))
+// 			free_mtu = i;
+// 	}
+// 	i = (i < MAX_INTF_MTUS) ? i : free_mtu;
+// 	if (i < MAX_INTF_MTUS) {
+// 		mtu_id = i;
+// 	} else {
+// 		pr_err("%s: No free MTU slot available!\n", __func__);
+// 		return -EINVAL;
+// 	}
+
+// 	priv->intf_mtus[i] = mtu;
+// 	pr_info("Writing MTU %d to slot %d\n", priv->intf_mtus[i], i);
+// 	/* Set MTU-value of the slot TODO: distinguish between IPv4/IPv6 routes / slots */
+// 	sw_w32_mask(0xffff << ((i % 2) * 16), priv->intf_mtus[i] << ((i % 2) * 16),
+// 		    RTL930X_L3_IP_MTU_CTRL(i));
+// 	sw_w32_mask(0xffff << ((i % 2) * 16), priv->intf_mtus[i] << ((i % 2) * 16),
+// 		    RTL930X_L3_IP6_MTU_CTRL(i));
+
+// 	priv->intf_mtu_count[i]++;
+
+// 	return mtu_id;
+// }
+
+
+// Currently not used
+// /* Creates an interface for a route by setting up the HW tables in the SoC
+// static int rtl930x_l3_intf_add(struct rtl838x_switch_priv *priv, struct rtl838x_l3_intf *intf)
+// {
+// 	int i, intf_id, mtu_id;
+// 	/* number of MTU-values < 16384 *\/
+
+// 	/* Use the same IPv6 mtu as the ip4 mtu for this route if unset */
+// 	intf->ip6_mtu = intf->ip6_mtu ? intf->ip6_mtu : intf->ip4_mtu;
+
+// 	mtu_id = rtl930x_l3_mtu_add(priv, intf->ip4_mtu);
+// 	pr_info("%s: added mtu %d with mtu-id %d\n", __func__, intf->ip4_mtu, mtu_id);
+// 	if (mtu_id < 0)
+// 		return -ENOSPC;
+// 	intf->ip4_mtu_id = mtu_id;
+// 	intf->ip6_mtu_id = mtu_id;
+
+// 	for (i = 0; i < MAX_INTERFACES; i++) {
+// 		if (!priv->interfaces[i])
+// 			break;
+// 	}
+// 	if (i >= MAX_INTERFACES) {
+// 		pr_err("%s: cannot find free interface entry\n", __func__);
+// 		return -EINVAL;
+// 	}
+// 	intf_id = i;
+// 	priv->interfaces[i] = kzalloc(sizeof(struct rtl838x_l3_intf), GFP_KERNEL);
+// 	if (!priv->interfaces[i]) {
+// 		pr_err("%s: no memory to allocate new interface\n", __func__);
+// 		return -ENOMEM;
+// 	}
+// }
+
+/* Set the destination MAC and L3 egress interface ID for a nexthop entry in the SoC's
+ * L3_NEXTHOP table. The nexthop entry is identified by idx.
+ * dmac_id is the reference to the L2 entry in the L2 forwarding table, special values are
+ * 0x7ffe: TRAP2CPU
+ * 0x7ffd: TRAP2MASTERCPU
+ * 0x7fff: DMAC_ID_DROP
+ */
+static void rtl930x_set_l3_nexthop(int idx, u16 dmac_id, u16 interface)
+{
+	/* Access L3_NEXTHOP table (3) via register RTL9300_TBL_1 */
+	struct table_reg *r = rtl_table_get(RTL9300_TBL_1, 3);
+
+	pr_info("%s: Writing to L3_NEXTHOP table, index %d, dmac_id %d, interface %d\n",
+		__func__, idx, dmac_id, interface);
+	sw_w32(((dmac_id & 0x7fff) << 7) | (interface & 0x7f), rtl_table_data(r, 0));
+
+	pr_info("%s: %08x\n", __func__, sw_r32(rtl_table_data(r,0)));
+	rtl_table_write(r, idx);
+	rtl_table_release(r);
+}
+
+static void rtl930x_pie_lookup_enable(struct rtl838x_switch_priv *priv, int index)
+{
+	int block = index / PIE_BLOCK_SIZE;
+
+	sw_w32_mask(0, BIT(block), RTL930X_PIE_BLK_LOOKUP_CTRL);
+}
+
+/* Reads the intermediate representation of the templated match-fields of the
+ * PIE rule in the pie_rule structure and fills in the raw data fields in the
+ * raw register space r[].
+ * The register space configuration size is identical for the RTL8380/90 and RTL9300,
+ * however the RTL9310 has 2 more registers / fields and the physical field-ids are different
+ * on all SoCs
+ * On the RTL9300 the mask fields are not word-aligend!
+ */
+static void rtl930x_write_pie_templated(u32 r[], struct pie_rule *pr, enum template_field_id t[])
+{
+	for (int i = 0; i < N_FIXED_FIELDS; i++) {
+		enum template_field_id field_type = t[i];
+		u16 data = 0, data_m = 0;
+
+		switch (field_type) {
+		case TEMPLATE_FIELD_SPM0:
+			data = pr->spm;
+			data_m = pr->spm_m;
+			break;
+		case TEMPLATE_FIELD_SPM1:
+			data = pr->spm >> 16;
+			data_m = pr->spm_m >> 16;
+			break;
+		case TEMPLATE_FIELD_OTAG:
+			data = pr->otag;
+			data_m = pr->otag_m;
+			break;
+		case TEMPLATE_FIELD_SMAC0:
+			data = pr->smac[4];
+			data = (data << 8) | pr->smac[5];
+			data_m = pr->smac_m[4];
+			data_m = (data_m << 8) | pr->smac_m[5];
+			break;
+		case TEMPLATE_FIELD_SMAC1:
+			data = pr->smac[2];
+			data = (data << 8) | pr->smac[3];
+			data_m = pr->smac_m[2];
+			data_m = (data_m << 8) | pr->smac_m[3];
+			break;
+		case TEMPLATE_FIELD_SMAC2:
+			data = pr->smac[0];
+			data = (data << 8) | pr->smac[1];
+			data_m = pr->smac_m[0];
+			data_m = (data_m << 8) | pr->smac_m[1];
+			break;
+		case TEMPLATE_FIELD_DMAC0:
+			data = pr->dmac[4];
+			data = (data << 8) | pr->dmac[5];
+			data_m = pr->dmac_m[4];
+			data_m = (data_m << 8) | pr->dmac_m[5];
+			break;
+		case TEMPLATE_FIELD_DMAC1:
+			data = pr->dmac[2];
+			data = (data << 8) | pr->dmac[3];
+			data_m = pr->dmac_m[2];
+			data_m = (data_m << 8) | pr->dmac_m[3];
+			break;
+		case TEMPLATE_FIELD_DMAC2:
+			data = pr->dmac[0];
+			data = (data << 8) | pr->dmac[1];
+			data_m = pr->dmac_m[0];
+			data_m = (data_m << 8) | pr->dmac_m[1];
+			break;
+		case TEMPLATE_FIELD_ETHERTYPE:
+			data = pr->ethertype;
+			data_m = pr->ethertype_m;
+			break;
+		case TEMPLATE_FIELD_ITAG:
+			data = pr->itag;
+			data_m = pr->itag_m;
+			break;
+		case TEMPLATE_FIELD_SIP0:
+			if (pr->is_ipv6) {
+				data = pr->sip6.s6_addr16[7];
+				data_m = pr->sip6_m.s6_addr16[7];
+			} else {
+				data = pr->sip;
+				data_m = pr->sip_m;
+			}
+			break;
+		case TEMPLATE_FIELD_SIP1:
+			if (pr->is_ipv6) {
+				data = pr->sip6.s6_addr16[6];
+				data_m = pr->sip6_m.s6_addr16[6];
+			} else {
+				data = pr->sip >> 16;
+				data_m = pr->sip_m >> 16;
+			}
+			break;
+		case TEMPLATE_FIELD_SIP2:
+		case TEMPLATE_FIELD_SIP3:
+		case TEMPLATE_FIELD_SIP4:
+		case TEMPLATE_FIELD_SIP5:
+		case TEMPLATE_FIELD_SIP6:
+		case TEMPLATE_FIELD_SIP7:
+			data = pr->sip6.s6_addr16[5 - (field_type - TEMPLATE_FIELD_SIP2)];
+			data_m = pr->sip6_m.s6_addr16[5 - (field_type - TEMPLATE_FIELD_SIP2)];
+			break;
+		case TEMPLATE_FIELD_DIP0:
+			if (pr->is_ipv6) {
+				data = pr->dip6.s6_addr16[7];
+				data_m = pr->dip6_m.s6_addr16[7];
+			} else {
+				data = pr->dip;
+				data_m = pr->dip_m;
+			}
+			break;
+		case TEMPLATE_FIELD_DIP1:
+			if (pr->is_ipv6) {
+				data = pr->dip6.s6_addr16[6];
+				data_m = pr->dip6_m.s6_addr16[6];
+			} else {
+				data = pr->dip >> 16;
+				data_m = pr->dip_m >> 16;
+			}
+			break;
+		case TEMPLATE_FIELD_DIP2:
+		case TEMPLATE_FIELD_DIP3:
+		case TEMPLATE_FIELD_DIP4:
+		case TEMPLATE_FIELD_DIP5:
+		case TEMPLATE_FIELD_DIP6:
+		case TEMPLATE_FIELD_DIP7:
+			data = pr->dip6.s6_addr16[5 - (field_type - TEMPLATE_FIELD_DIP2)];
+			data_m = pr->dip6_m.s6_addr16[5 - (field_type - TEMPLATE_FIELD_DIP2)];
+			break;
+		case TEMPLATE_FIELD_IP_TOS_PROTO:
+			data = pr->tos_proto;
+			data_m = pr->tos_proto_m;
+			break;
+		case TEMPLATE_FIELD_L4_SPORT:
+			data = pr->sport;
+			data_m = pr->sport_m;
+			break;
+		case TEMPLATE_FIELD_L4_DPORT:
+			data = pr->dport;
+			data_m = pr->dport_m;
+			break;
+		case TEMPLATE_FIELD_DSAP_SSAP:
+			data = pr->dsap_ssap;
+			data_m = pr->dsap_ssap_m;
+			break;
+		case TEMPLATE_FIELD_TCP_INFO:
+			data = pr->tcp_info;
+			data_m = pr->tcp_info_m;
+			break;
+		case TEMPLATE_FIELD_RANGE_CHK:
+			pr_warn("Warning: TEMPLATE_FIELD_RANGE_CHK: not configured\n");
+			break;
+		default:
+			pr_info("%s: unknown field %d\n", __func__, field_type);
+		}
+
+		/* On the RTL9300, the mask fields are not word aligned! */
+		if (!(i % 2)) {
+			r[5 - i / 2] = data;
+			r[12 - i / 2] |= ((u32)data_m << 8);
+		} else {
+			r[5 - i / 2] |= ((u32)data) << 16;
+			r[12 - i / 2] |= ((u32)data_m) << 24;
+			r[11 - i / 2] |= ((u32)data_m) >> 8;
+		}
+	}
+}
+
+// Currently not used
+// static void rtl930x_read_pie_fixed_fields(u32 r[], struct pie_rule *pr)
+// {
+// 	pr->stacking_port = r[6] & BIT(31);
+// 	pr->spn = (r[6] >> 24) & 0x7f;
+// 	pr->mgnt_vlan = r[6] & BIT(23);
+// 	if (pr->phase == PHASE_IACL)
+// 		pr->dmac_hit_sw = r[6] & BIT(22);
+// 	else
+// 		pr->content_too_deep = r[6] & BIT(22);
+// 	pr->not_first_frag = r[6]  & BIT(21);
+// 	pr->frame_type_l4 = (r[6] >> 18) & 7;
+// 	pr->frame_type = (r[6] >> 16) & 3;
+// 	pr->otag_fmt = (r[6] >> 15) & 1;
+// 	pr->itag_fmt = (r[6] >> 14) & 1;
+// 	pr->otag_exist = (r[6] >> 13) & 1;
+// 	pr->itag_exist = (r[6] >> 12) & 1;
+// 	pr->frame_type_l2 = (r[6] >> 10) & 3;
+// 	pr->igr_normal_port = (r[6] >> 9) & 1;
+// 	pr->tid = (r[6] >> 8) & 1;
+
+// 	pr->stacking_port_m = r[12] & BIT(7);
+// 	pr->spn_m = r[12]  & 0x7f;
+// 	pr->mgnt_vlan_m = r[13] & BIT(31);
+// 	if (pr->phase == PHASE_IACL)
+// 		pr->dmac_hit_sw_m = r[13] & BIT(30);
+// 	else
+// 		pr->content_too_deep_m = r[13] & BIT(30);
+// 	pr->not_first_frag_m = r[13] & BIT(29);
+// 	pr->frame_type_l4_m = (r[13] >> 26) & 7;
+// 	pr->frame_type_m = (r[13] >> 24) & 3;
+// 	pr->otag_fmt_m = r[13] & BIT(23);
+// 	pr->itag_fmt_m = r[13] & BIT(22);
+// 	pr->otag_exist_m = r[13] & BIT(21);
+// 	pr->itag_exist_m = r[13] & BIT (20);
+// 	pr->frame_type_l2_m = (r[13] >> 18) & 3;
+// 	pr->igr_normal_port_m = r[13] & BIT(17);
+// 	pr->tid_m = (r[13] >> 16) & 1;
+
+// 	pr->valid = r[13] & BIT(15);
+// 	pr->cond_not = r[13] & BIT(14);
+// 	pr->cond_and1 = r[13] & BIT(13);
+// 	pr->cond_and2 = r[13] & BIT(12);
+// }
+
+static void rtl930x_write_pie_fixed_fields(u32 r[],  struct pie_rule *pr)
+{
+	r[6] = pr->stacking_port ? BIT(31) : 0;
+	r[6] |= ((u32) (pr->spn & 0x7f)) << 24;
+	r[6] |= pr->mgnt_vlan ? BIT(23) : 0;
+	if (pr->phase == PHASE_IACL)
+		r[6] |= pr->dmac_hit_sw ? BIT(22) : 0;
+	else
+		r[6] |= pr->content_too_deep ? BIT(22) : 0;
+	r[6] |= pr->not_first_frag ? BIT(21) : 0;
+	r[6] |= ((u32) (pr->frame_type_l4 & 0x7)) << 18;
+	r[6] |= ((u32) (pr->frame_type & 0x3)) << 16;
+	r[6] |= pr->otag_fmt ? BIT(15) : 0;
+	r[6] |= pr->itag_fmt ? BIT(14) : 0;
+	r[6] |= pr->otag_exist ? BIT(13) : 0;
+	r[6] |= pr->itag_exist ? BIT(12) : 0;
+	r[6] |= ((u32) (pr->frame_type_l2 & 0x3)) << 10;
+	r[6] |= pr->igr_normal_port ? BIT(9) : 0;
+	r[6] |= ((u32) (pr->tid & 0x1)) << 8;
+
+	r[12] |= pr->stacking_port_m ? BIT(7) : 0;
+	r[12] |= (u32) (pr->spn_m & 0x7f);
+	r[13] |= pr->mgnt_vlan_m ? BIT(31) : 0;
+	if (pr->phase == PHASE_IACL)
+		r[13] |= pr->dmac_hit_sw_m ? BIT(30) : 0;
+	else
+		r[13] |= pr->content_too_deep_m ? BIT(30) : 0;
+	r[13] |= pr->not_first_frag_m ? BIT(29) : 0;
+	r[13] |= ((u32) (pr->frame_type_l4_m & 0x7)) << 26;
+	r[13] |= ((u32) (pr->frame_type_m & 0x3)) << 24;
+	r[13] |= pr->otag_fmt_m ? BIT(23) : 0;
+	r[13] |= pr->itag_fmt_m ? BIT(22) : 0;
+	r[13] |= pr->otag_exist_m ? BIT(21) : 0;
+	r[13] |= pr->itag_exist_m ? BIT(20) : 0;
+	r[13] |= ((u32) (pr->frame_type_l2_m & 0x3)) << 18;
+	r[13] |= pr->igr_normal_port_m ? BIT(17) : 0;
+	r[13] |= ((u32) (pr->tid_m & 0x1)) << 16;
+
+	r[13] |= pr->valid ? BIT(15) : 0;
+	r[13] |= pr->cond_not ? BIT(14) : 0;
+	r[13] |= pr->cond_and1 ? BIT(13) : 0;
+	r[13] |= pr->cond_and2 ? BIT(12) : 0;
+}
+
+static void rtl930x_write_pie_action(u32 r[],  struct pie_rule *pr)
+{
+	/* Either drop or forward */
+	if (pr->drop) {
+		r[14] |= BIT(24) | BIT(25) | BIT(26); /* Do Green, Yellow and Red drops */
+		/* Actually DROP, not PERMIT in Green / Yellow / Red */
+		r[14] |= BIT(23) | BIT(22) | BIT(20);
+	} else {
+		r[14] |= pr->fwd_sel ? BIT(27) : 0;
+		r[14] |= pr->fwd_act << 18;
+		r[14] |= BIT(14); /* We overwrite any drop */
+	}
+	if (pr->phase == PHASE_VACL)
+		r[14] |= pr->fwd_sa_lrn ? BIT(15) : 0;
+	r[13] |= pr->bypass_sel ? BIT(5) : 0;
+	r[13] |= pr->nopri_sel ? BIT(4) : 0;
+	r[13] |= pr->tagst_sel ? BIT(3) : 0;
+	r[13] |= pr->ovid_sel ? BIT(1) : 0;
+	r[14] |= pr->ivid_sel ? BIT(31) : 0;
+	r[14] |= pr->meter_sel ? BIT(30) : 0;
+	r[14] |= pr->mir_sel ? BIT(29) : 0;
+	r[14] |= pr->log_sel ? BIT(28) : 0;
+
+	r[14] |= ((u32)(pr->fwd_data & 0x3fff)) << 3;
+	r[15] |= pr->log_octets ? BIT(31) : 0;
+	r[15] |= (u32)(pr->meter_data) << 23;
+
+	r[15] |= ((u32)(pr->ivid_act) << 21) & 0x3;
+	r[15] |= ((u32)(pr->ivid_data) << 9) & 0xfff;
+	r[16] |= ((u32)(pr->ovid_act) << 30) & 0x3;
+	r[16] |= ((u32)(pr->ovid_data) & 0xfff) << 16;
+	r[16] |= (pr->mir_data & 0x3) << 6;
+	r[17] |= ((u32)(pr->tagst_data) & 0xf) << 28;
+	r[17] |= ((u32)(pr->nopri_data) & 0x7) << 25;
+	r[17] |= pr->bypass_ibc_sc ? BIT(16) : 0;
+}
+
+void rtl930x_pie_rule_dump_raw(u32 r[])
+{
+	pr_info("Raw IACL table entry:\n");
+	pr_info("r 0 - 7: %08x %08x %08x %08x %08x %08x %08x %08x\n",
+		r[0], r[1], r[2], r[3], r[4], r[5], r[6], r[7]);
+	pr_info("r 8 - 15: %08x %08x %08x %08x %08x %08x %08x %08x\n",
+		r[8], r[9], r[10], r[11], r[12], r[13], r[14], r[15]);
+	pr_info("r 16 - 18: %08x %08x %08x\n", r[16], r[17], r[18]);
+	pr_info("Match  : %08x %08x %08x %08x %08x %08x\n", r[0], r[1], r[2], r[3], r[4], r[5]);
+	pr_info("Fixed  : %06x\n", r[6] >> 8);
+	pr_info("Match M: %08x %08x %08x %08x %08x %08x\n",
+		(r[6] << 24) | (r[7] >> 8), (r[7] << 24) | (r[8] >> 8), (r[8] << 24) | (r[9] >> 8),
+		(r[9] << 24) | (r[10] >> 8), (r[10] << 24) | (r[11] >> 8),
+		(r[11] << 24) | (r[12] >> 8));
+	pr_info("R[13]:   %08x\n", r[13]);
+	pr_info("Fixed M: %06x\n", ((r[12] << 16) | (r[13] >> 16)) & 0xffffff);
+	pr_info("Valid / not / and1 / and2 : %1x\n", (r[13] >> 12) & 0xf);
+	pr_info("r 13-16: %08x %08x %08x %08x\n", r[13], r[14], r[15], r[16]);
+}
+
+static int rtl930x_pie_rule_write(struct rtl838x_switch_priv *priv, int idx, struct pie_rule *pr)
+{
+	/* Access IACL table (2) via register 0 */
+	struct table_reg *q = rtl_table_get(RTL9300_TBL_0, 2);
+	u32 r[19];
+	int block = idx / PIE_BLOCK_SIZE;
+	u32 t_select = sw_r32(RTL930X_PIE_BLK_TMPLTE_CTRL(block));
+
+	pr_debug("%s: %d, t_select: %08x\n", __func__, idx, t_select);
+
+	for (int i = 0; i < 19; i++)
+		r[i] = 0;
+
+	if (!pr->valid) {
+		rtl_table_write(q, idx);
+		rtl_table_release(q);
+		return 0;
+	}
+	rtl930x_write_pie_fixed_fields(r, pr);
+
+	pr_debug("%s: template %d\n", __func__, (t_select >> (pr->tid * 4)) & 0xf);
+	rtl930x_write_pie_templated(r, pr, fixed_templates[(t_select >> (pr->tid * 4)) & 0xf]);
+
+	rtl930x_write_pie_action(r, pr);
+
+/*	rtl930x_pie_rule_dump_raw(r); */
+
+	for (int i = 0; i < 19; i++)
+		sw_w32(r[i], rtl_table_data(q, i));
+
+	rtl_table_write(q, idx);
+	rtl_table_release(q);
+
+	return 0;
+}
+
+static bool rtl930x_pie_templ_has(int t, enum template_field_id field_type)
+{
+	for (int i = 0; i < N_FIXED_FIELDS; i++) {
+		enum template_field_id ft = fixed_templates[t][i];
+		if (field_type == ft)
+			return true;
+	}
+
+	return false;
+}
+
+/* Verify that the rule pr is compatible with a given template t in block block
+ * Note that this function is SoC specific since the values of e.g. TEMPLATE_FIELD_SIP0
+ * depend on the SoC
+ */
+static int rtl930x_pie_verify_template(struct rtl838x_switch_priv *priv,
+				       struct pie_rule *pr, int t, int block)
+{
+	int i;
+
+	if (!pr->is_ipv6 && pr->sip_m && !rtl930x_pie_templ_has(t, TEMPLATE_FIELD_SIP0))
+		return -1;
+
+	if (!pr->is_ipv6 && pr->dip_m && !rtl930x_pie_templ_has(t, TEMPLATE_FIELD_DIP0))
+		return -1;
+
+	if (pr->is_ipv6) {
+		if ((pr->sip6_m.s6_addr32[0] ||
+		     pr->sip6_m.s6_addr32[1] ||
+		     pr->sip6_m.s6_addr32[2] ||
+		     pr->sip6_m.s6_addr32[3]) &&
+		    !rtl930x_pie_templ_has(t, TEMPLATE_FIELD_SIP2))
+			return -1;
+		if ((pr->dip6_m.s6_addr32[0] ||
+		     pr->dip6_m.s6_addr32[1] ||
+		     pr->dip6_m.s6_addr32[2] ||
+		     pr->dip6_m.s6_addr32[3]) &&
+		    !rtl930x_pie_templ_has(t, TEMPLATE_FIELD_DIP2))
+			return -1;
+	}
+
+	if (ether_addr_to_u64(pr->smac) && !rtl930x_pie_templ_has(t, TEMPLATE_FIELD_SMAC0))
+		return -1;
+
+	if (ether_addr_to_u64(pr->dmac) && !rtl930x_pie_templ_has(t, TEMPLATE_FIELD_DMAC0))
+		return -1;
+
+	/* TODO: Check more */
+
+	i = find_first_zero_bit(&priv->pie_use_bm[block * 4], PIE_BLOCK_SIZE);
+
+	if (i >= PIE_BLOCK_SIZE)
+		return -1;
+
+	return i + PIE_BLOCK_SIZE * block;
+}
+
+static int rtl930x_pie_rule_add(struct rtl838x_switch_priv *priv, struct pie_rule *pr)
+{
+	int idx, block, j, t;
+	int min_block = 0;
+	int max_block = priv->n_pie_blocks / 2;
+
+	if (pr->is_egress) {
+		min_block = max_block;
+		max_block = priv->n_pie_blocks;
+	}
+	pr_debug("In %s\n", __func__);
+
+	mutex_lock(&priv->pie_mutex);
+
+	for (block = min_block; block < max_block; block++) {
+		for (j = 0; j < 2; j++) {
+			t = (sw_r32(RTL930X_PIE_BLK_TMPLTE_CTRL(block)) >> (j * 4)) & 0xf;
+			pr_debug("Testing block %d, template %d, template id %d\n", block, j, t);
+			pr_debug("%s: %08x\n",
+				__func__, sw_r32(RTL930X_PIE_BLK_TMPLTE_CTRL(block)));
+			idx = rtl930x_pie_verify_template(priv, pr, t, block);
+			if (idx >= 0)
+				break;
+		}
+		if (j < 2)
+			break;
+	}
+
+	if (block >= priv->n_pie_blocks) {
+		mutex_unlock(&priv->pie_mutex);
+		return -EOPNOTSUPP;
+	}
+
+	pr_debug("Using block: %d, index %d, template-id %d\n", block, idx, j);
+	set_bit(idx, priv->pie_use_bm);
+
+	pr->valid = true;
+	pr->tid = j;  /* Mapped to template number */
+	pr->tid_m = 0x1;
+	pr->id = idx;
+
+	rtl930x_pie_lookup_enable(priv, idx);
+	rtl930x_pie_rule_write(priv, idx, pr);
+
+	mutex_unlock(&priv->pie_mutex);
+	return 0;
+}
+
+/* Delete a range of Packet Inspection Engine rules */
+static int rtl930x_pie_rule_del(struct rtl838x_switch_priv *priv, int index_from, int index_to)
+{
+	u32 v = (index_from << 1)| (index_to << 12 ) | BIT(0);
+
+	pr_debug("%s: from %d to %d\n", __func__, index_from, index_to);
+	mutex_lock(&priv->reg_mutex);
+
+	/* Write from-to and execute bit into control register */
+	sw_w32(v, RTL930X_PIE_CLR_CTRL);
+
+	/* Wait until command has completed */
+	do {
+	} while (sw_r32(RTL930X_PIE_CLR_CTRL) & BIT(0));
+
+	mutex_unlock(&priv->reg_mutex);
+	return 0;
+}
+
+static void rtl930x_pie_rule_rm(struct rtl838x_switch_priv *priv, struct pie_rule *pr)
+{
+	int idx = pr->id;
+
+	rtl930x_pie_rule_del(priv, idx, idx);
+	clear_bit(idx, priv->pie_use_bm);
+}
+
+static void rtl930x_pie_init(struct rtl838x_switch_priv *priv)
+{
+	u32 template_selectors;
+
+	mutex_init(&priv->pie_mutex);
+
+	pr_info("%s\n", __func__);
+	/* Enable ACL lookup on all ports, including CPU_PORT */
+	for (int i = 0; i <= priv->cpu_port; i++)
+		sw_w32(1, RTL930X_ACL_PORT_LOOKUP_CTRL(i));
+
+	/* Include IPG in metering */
+	sw_w32_mask(0, 1, RTL930X_METER_GLB_CTRL);
+
+	/* Delete all present rules, block size is 128 on all SoC families */
+	rtl930x_pie_rule_del(priv, 0, priv->n_pie_blocks * 128 - 1);
+
+	/* Assign blocks 0-7 to VACL phase (bit = 0), blocks 8-15 to IACL (bit = 1) */
+	sw_w32(0xff00, RTL930X_PIE_BLK_PHASE_CTRL);
+
+	/* Enable predefined templates 0, 1 for first quarter of all blocks */
+	template_selectors = 0 | (1 << 4);
+	for (int i = 0; i < priv->n_pie_blocks / 4; i++)
+		sw_w32(template_selectors, RTL930X_PIE_BLK_TMPLTE_CTRL(i));
+
+	/* Enable predefined templates 2, 3 for second quarter of all blocks */
+	template_selectors = 2 | (3 << 4);
+	for (int i = priv->n_pie_blocks / 4; i < priv->n_pie_blocks / 2; i++)
+		sw_w32(template_selectors, RTL930X_PIE_BLK_TMPLTE_CTRL(i));
+
+	/* Enable predefined templates 0, 1 for third half of all blocks */
+	template_selectors = 0 | (1 << 4);
+	for (int i = priv->n_pie_blocks / 2; i < priv->n_pie_blocks * 3 / 4; i++)
+		sw_w32(template_selectors, RTL930X_PIE_BLK_TMPLTE_CTRL(i));
+
+	/* Enable predefined templates 2, 3 for fourth quater of all blocks */
+	template_selectors = 2 | (3 << 4);
+	for (int i = priv->n_pie_blocks * 3 / 4; i < priv->n_pie_blocks; i++)
+		sw_w32(template_selectors, RTL930X_PIE_BLK_TMPLTE_CTRL(i));
+
+}
+
+/* Sets up an egress interface for L3 actions
+ * Actions for ip4/6_icmp_redirect, ip4/6_pbr_icmp_redirect are:
+ * 0: FORWARD, 1: DROP, 2: TRAP2CPU, 3: COPY2CPU, 4: TRAP2MASTERCPU 5: COPY2MASTERCPU
+ * 6: HARDDROP
+ * idx is the index in the HW interface table: idx < 0x80
+ */
+static void rtl930x_set_l3_egress_intf(int idx, struct rtl838x_l3_intf *intf)
+{
+	u32 u, v;
+	/* Read L3_EGR_INTF table (4) via register RTL9300_TBL_1 */
+	struct table_reg *r = rtl_table_get(RTL9300_TBL_1, 4);
+
+	/* The table has 2 registers */
+	u = (intf->vid & 0xfff) << 9;
+	u |= (intf->smac_idx & 0x3f) << 3;
+	u |= (intf->ip4_mtu_id & 0x7);
+
+	v = (intf->ip6_mtu_id & 0x7) << 28;
+	v |= (intf->ttl_scope & 0xff) << 20;
+	v |= (intf->hl_scope & 0xff) << 12;
+	v |= (intf->ip4_icmp_redirect & 0x7) << 9;
+	v |= (intf->ip6_icmp_redirect & 0x7)<< 6;
+	v |= (intf->ip4_pbr_icmp_redirect & 0x7) << 3;
+	v |= (intf->ip6_pbr_icmp_redirect & 0x7);
+
+	sw_w32(u, rtl_table_data(r, 0));
+	sw_w32(v, rtl_table_data(r, 1));
+
+	pr_info("%s writing to index %d: %08x %08x\n", __func__, idx, u, v);
+	rtl_table_write(r, idx & 0x7f);
+	rtl_table_release(r);
+}
+
+/* Reads a MAC entry for L3 termination as entry point for routing
+ * from the hardware table
+ * idx is the index into the L3_ROUTER_MAC table
+ */
+static void rtl930x_get_l3_router_mac(u32 idx, struct rtl93xx_rt_mac *m)
+{
+	u32 v, w;
+	/* Read L3_ROUTER_MAC table (0) via register RTL9300_TBL_1 */
+	struct table_reg *r = rtl_table_get(RTL9300_TBL_1, 0);
+
+	rtl_table_read(r, idx);
+	/* The table has a size of 7 registers, 64 entries */
+	v = sw_r32(rtl_table_data(r, 0));
+	w = sw_r32(rtl_table_data(r, 3));
+	m->valid = !!(v & BIT(20));
+	if (!m->valid)
+		goto out;
+
+	m->p_type = !!(v & BIT(19));
+	m->p_id = (v >> 13) & 0x3f;  /* trunk id of port */
+	m->vid = v & 0xfff;
+	m->vid_mask = w & 0xfff;
+	m->action = sw_r32(rtl_table_data(r, 6)) & 0x7;
+	m->mac_mask = ((((u64)sw_r32(rtl_table_data(r, 5))) << 32) & 0xffffffffffffULL) |
+	              (sw_r32(rtl_table_data(r, 4)));
+	m->mac = ((((u64)sw_r32(rtl_table_data(r, 1))) << 32) & 0xffffffffffffULL) |
+	         (sw_r32(rtl_table_data(r, 2)));
+	/* Bits L3_INTF and BMSK_L3_INTF are 0 */
+
+out:
+	rtl_table_release(r);
+}
+
+/* Writes a MAC entry for L3 termination as entry point for routing
+ * into the hardware table
+ * idx is the index into the L3_ROUTER_MAC table
+ */
+static void rtl930x_set_l3_router_mac(u32 idx, struct rtl93xx_rt_mac *m)
+{
+	u32 v, w;
+	/* Read L3_ROUTER_MAC table (0) via register RTL9300_TBL_1 */
+	struct table_reg *r = rtl_table_get(RTL9300_TBL_1, 0);
+
+	/* The table has a size of 7 registers, 64 entries */
+	v = BIT(20); /* mac entry valid, port type is 0: individual */
+	v |= (m->p_id & 0x3f) << 13;
+	v |= (m->vid & 0xfff); /* Set the interface_id to the vlan id */
+
+	w = m->vid_mask;
+	w |= (m->p_id_mask & 0x3f) << 13;
+
+	sw_w32(v, rtl_table_data(r, 0));
+	sw_w32(w, rtl_table_data(r, 3));
+
+	/* Set MAC address, L3_INTF (bit 12 in register 1) needs to be 0 */
+	sw_w32((u32)(m->mac), rtl_table_data(r, 2));
+	sw_w32(m->mac >> 32, rtl_table_data(r, 1));
+
+	/* Set MAC address mask, BMSK_L3_INTF (bit 12 in register 5) needs to be 0 */
+	sw_w32((u32)(m->mac_mask >> 32), rtl_table_data(r, 4));
+	sw_w32((u32)m->mac_mask, rtl_table_data(r, 5));
+
+	sw_w32(m->action & 0x7, rtl_table_data(r, 6));
+
+	pr_debug("%s writing index %d: %08x %08x %08x %08x %08x %08x %08x\n", __func__, idx,
+		sw_r32(rtl_table_data(r, 0)), sw_r32(rtl_table_data(r, 1)), sw_r32(rtl_table_data(r, 2)),
+		sw_r32(rtl_table_data(r, 3)), sw_r32(rtl_table_data(r, 4)), sw_r32(rtl_table_data(r, 5)),
+		sw_r32(rtl_table_data(r, 6))
+	);
+	rtl_table_write(r, idx);
+	rtl_table_release(r);
+}
+
+/* Get the Destination-MAC of an L3 egress interface or the Source MAC for routed packets
+ * from the SoC's L3_EGR_INTF_MAC table
+ * Indexes 0-2047 are DMACs, 2048+ are SMACs
+ */
+static u64 rtl930x_get_l3_egress_mac(u32 idx)
+{
+	u64 mac;
+	/* Read L3_EGR_INTF_MAC table (2) via register RTL9300_TBL_2 */
+	struct table_reg *r = rtl_table_get(RTL9300_TBL_2, 2);
+
+	rtl_table_read(r, idx);
+	/* The table has a size of 2 registers */
+	mac = sw_r32(rtl_table_data(r, 0));
+	mac <<= 32;
+	mac |= sw_r32(rtl_table_data(r, 1));
+	rtl_table_release(r);
+
+	return mac;
+}
+
+/* Set the Destination-MAC of a route or the Source MAC of an L3 egress interface
+ * in the SoC's L3_EGR_INTF_MAC table
+ * Indexes 0-2047 are DMACs, 2048+ are SMACs
+ */
+static void rtl930x_set_l3_egress_mac(u32 idx, u64 mac)
+{
+	/* Access L3_EGR_INTF_MAC table (2) via register RTL9300_TBL_2 */
+	struct table_reg *r = rtl_table_get(RTL9300_TBL_2, 2);
+
+	/* The table has a size of 2 registers */
+	sw_w32(mac >> 32, rtl_table_data(r, 0));
+	sw_w32(mac, rtl_table_data(r, 1));
+
+	pr_debug("%s: setting index %d to %016llx\n", __func__, idx, mac);
+	rtl_table_write(r, idx);
+	rtl_table_release(r);
+}
+
+/* Configure L3 routing settings of the device:
+ * - MTUs
+ * - Egress interface
+ * - The router's MAC address on which routed packets are expected
+ * - MAC addresses used as source macs of routed packets
+ */
+int rtl930x_l3_setup(struct rtl838x_switch_priv *priv)
+{
+	/* Setup MTU with id 0 for default interface */
+	for (int i = 0; i < MAX_INTF_MTUS; i++)
+		priv->intf_mtu_count[i] = priv->intf_mtus[i] = 0;
+
+	priv->intf_mtu_count[0] = 0; /* Needs to stay forever */
+	priv->intf_mtus[0] = DEFAULT_MTU;
+	sw_w32_mask(0xffff, DEFAULT_MTU, RTL930X_L3_IP_MTU_CTRL(0));
+	sw_w32_mask(0xffff, DEFAULT_MTU, RTL930X_L3_IP6_MTU_CTRL(0));
+	priv->intf_mtus[1] = DEFAULT_MTU;
+	sw_w32_mask(0xffff0000, DEFAULT_MTU << 16, RTL930X_L3_IP_MTU_CTRL(0));
+	sw_w32_mask(0xffff0000, DEFAULT_MTU << 16, RTL930X_L3_IP6_MTU_CTRL(0));
+
+	sw_w32_mask(0xffff, DEFAULT_MTU, RTL930X_L3_IP_MTU_CTRL(1));
+	sw_w32_mask(0xffff, DEFAULT_MTU, RTL930X_L3_IP6_MTU_CTRL(1));
+	sw_w32_mask(0xffff0000, DEFAULT_MTU << 16, RTL930X_L3_IP_MTU_CTRL(1));
+	sw_w32_mask(0xffff0000, DEFAULT_MTU << 16, RTL930X_L3_IP6_MTU_CTRL(1));
+
+	/* Clear all source port MACs */
+	for (int i = 0; i < MAX_SMACS; i++)
+		rtl930x_set_l3_egress_mac(L3_EGRESS_DMACS + i, 0ULL);
+
+	/* Configure the default L3 hash algorithm */
+	sw_w32_mask(BIT(2), 0, RTL930X_L3_HOST_TBL_CTRL);  /* Algorithm selection 0 = 0 */
+	sw_w32_mask(0, BIT(3), RTL930X_L3_HOST_TBL_CTRL);  /* Algorithm selection 1 = 1 */
+
+	pr_info("L3_IPUC_ROUTE_CTRL %08x, IPMC_ROUTE %08x, IP6UC_ROUTE %08x, IP6MC_ROUTE %08x\n",
+		sw_r32(RTL930X_L3_IPUC_ROUTE_CTRL), sw_r32(RTL930X_L3_IPMC_ROUTE_CTRL),
+		sw_r32(RTL930X_L3_IP6UC_ROUTE_CTRL), sw_r32(RTL930X_L3_IP6MC_ROUTE_CTRL));
+	sw_w32_mask(0, 1, RTL930X_L3_IPUC_ROUTE_CTRL);
+	sw_w32_mask(0, 1, RTL930X_L3_IP6UC_ROUTE_CTRL);
+	sw_w32_mask(0, 1, RTL930X_L3_IPMC_ROUTE_CTRL);
+	sw_w32_mask(0, 1, RTL930X_L3_IP6MC_ROUTE_CTRL);
+
+	sw_w32(0x00002001, RTL930X_L3_IPUC_ROUTE_CTRL);
+	sw_w32(0x00014581, RTL930X_L3_IP6UC_ROUTE_CTRL);
+	sw_w32(0x00000501, RTL930X_L3_IPMC_ROUTE_CTRL);
+	sw_w32(0x00012881, RTL930X_L3_IP6MC_ROUTE_CTRL);
+
+	pr_info("L3_IPUC_ROUTE_CTRL %08x, IPMC_ROUTE %08x, IP6UC_ROUTE %08x, IP6MC_ROUTE %08x\n",
+		sw_r32(RTL930X_L3_IPUC_ROUTE_CTRL), sw_r32(RTL930X_L3_IPMC_ROUTE_CTRL),
+		sw_r32(RTL930X_L3_IP6UC_ROUTE_CTRL), sw_r32(RTL930X_L3_IP6MC_ROUTE_CTRL));
+
+	/* Trap non-ip traffic to the CPU-port (e.g. ARP so we stay reachable) */
+	sw_w32_mask(0x3 << 8, 0x1 << 8, RTL930X_L3_IP_ROUTE_CTRL);
+	pr_info("L3_IP_ROUTE_CTRL %08x\n", sw_r32(RTL930X_L3_IP_ROUTE_CTRL));
+
+	/* PORT_ISO_RESTRICT_ROUTE_CTRL? */
+
+	/* Do not use prefix route 0 because of HW limitations */
+	set_bit(0, priv->route_use_bm);
+
+	return 0;
+}
+
+static u32 rtl930x_packet_cntr_read(int counter)
+{
+	u32 v;
+
+	/* Read LOG table (3) via register RTL9300_TBL_0 */
+	struct table_reg *r = rtl_table_get(RTL9300_TBL_0, 3);
+
+	pr_debug("In %s, id %d\n", __func__, counter);
+	rtl_table_read(r, counter / 2);
+
+	pr_debug("Registers: %08x %08x\n",
+		sw_r32(rtl_table_data(r, 0)), sw_r32(rtl_table_data(r, 1)));
+	/* The table has a size of 2 registers */
+	if (counter % 2)
+		v = sw_r32(rtl_table_data(r, 0));
+	else
+		v = sw_r32(rtl_table_data(r, 1));
+
+	rtl_table_release(r);
+
+	return v;
+}
+
+static void rtl930x_packet_cntr_clear(int counter)
+{
+	/* Access LOG table (3) via register RTL9300_TBL_0 */
+	struct table_reg *r = rtl_table_get(RTL9300_TBL_0, 3);
+
+	pr_info("In %s, id %d\n", __func__, counter);
+	/* The table has a size of 2 registers */
+	if (counter % 2)
+		sw_w32(0, rtl_table_data(r, 0));
+	else
+		sw_w32(0, rtl_table_data(r, 1));
+
+	rtl_table_write(r, counter / 2);
+
+	rtl_table_release(r);
+}
+
+void rtl930x_vlan_port_keep_tag_set(int port, bool keep_outer, bool keep_inner)
+{
+	sw_w32(FIELD_PREP(RTL930X_VLAN_PORT_TAG_STS_CTRL_EGR_OTAG_STS_MASK,
+			  keep_outer ? RTL930X_VLAN_PORT_TAG_STS_TAGGED : RTL930X_VLAN_PORT_TAG_STS_UNTAG) |
+	       FIELD_PREP(RTL930X_VLAN_PORT_TAG_STS_CTRL_EGR_ITAG_STS_MASK,
+			  keep_inner ? RTL930X_VLAN_PORT_TAG_STS_TAGGED : RTL930X_VLAN_PORT_TAG_STS_UNTAG),
+	       RTL930X_VLAN_PORT_TAG_STS_CTRL(port));
+}
+
+void rtl930x_vlan_port_pvidmode_set(int port, enum pbvlan_type type, enum pbvlan_mode mode)
+{
+	if (type == PBVLAN_TYPE_INNER)
+		sw_w32_mask(0x3, mode, RTL930X_VLAN_PORT_PB_VLAN + (port << 2));
+	else
+		sw_w32_mask(0x3 << 14, mode << 14 ,RTL930X_VLAN_PORT_PB_VLAN + (port << 2));
+}
+
+void rtl930x_vlan_port_pvid_set(int port, enum pbvlan_type type, int pvid)
+{
+	if (type == PBVLAN_TYPE_INNER)
+		sw_w32_mask(0xfff << 2, pvid << 2, RTL930X_VLAN_PORT_PB_VLAN + (port << 2));
+	else
+		sw_w32_mask(0xfff << 16, pvid << 16, RTL930X_VLAN_PORT_PB_VLAN + (port << 2));
+}
+
+static int rtl930x_set_ageing_time(unsigned long msec)
+{
+	int t = sw_r32(RTL930X_L2_AGE_CTRL);
+
+	t &= 0x1FFFFF;
+	t = (t * 7) / 10;
+	pr_debug("L2 AGING time: %d sec\n", t);
+
+	t = (msec / 100 + 6) / 7;
+	t = t > 0x1FFFFF ? 0x1FFFFF : t;
+	sw_w32_mask(0x1FFFFF, t, RTL930X_L2_AGE_CTRL);
+	pr_debug("Dynamic aging for ports: %x\n", sw_r32(RTL930X_L2_PORT_AGE_CTRL));
+
+	return 0;
+}
+
+static void rtl930x_set_igr_filter(int port,  enum igr_filter state)
+{
+	sw_w32_mask(0x3 << ((port & 0xf)<<1), state << ((port & 0xf)<<1),
+		    RTL930X_VLAN_PORT_IGR_FLTR + (((port >> 4) << 2)));
+}
+
+static void rtl930x_set_egr_filter(int port,  enum egr_filter state)
+{
+	sw_w32_mask(0x1 << (port % 0x1D), state << (port % 0x1D),
+		    RTL930X_VLAN_PORT_EGR_FLTR + (((port / 29) << 2)));
+}
+
+void rtl930x_set_distribution_algorithm(int group, int algoidx, u32 algomsk)
+{
+	u32 l3shift = 0;
+	u32 newmask = 0;
+
+	/* TODO: for now we set algoidx to 0 */
+	algoidx = 0;
+	if (algomsk & TRUNK_DISTRIBUTION_ALGO_SIP_BIT) {
+		l3shift = 4;
+		newmask |= TRUNK_DISTRIBUTION_ALGO_L3_SIP_BIT;
+	}
+	if (algomsk & TRUNK_DISTRIBUTION_ALGO_DIP_BIT) {
+		l3shift = 4;
+		newmask |= TRUNK_DISTRIBUTION_ALGO_L3_DIP_BIT;
+	}
+	if (algomsk & TRUNK_DISTRIBUTION_ALGO_SRC_L4PORT_BIT) {
+		l3shift = 4;
+		newmask |= TRUNK_DISTRIBUTION_ALGO_L3_SRC_L4PORT_BIT;
+	}
+	if (algomsk & TRUNK_DISTRIBUTION_ALGO_SRC_L4PORT_BIT) {
+		l3shift = 4;
+		newmask |= TRUNK_DISTRIBUTION_ALGO_L3_SRC_L4PORT_BIT;
+	}
+
+	if (l3shift == 4) {
+		if (algomsk & TRUNK_DISTRIBUTION_ALGO_SMAC_BIT)
+			newmask |= TRUNK_DISTRIBUTION_ALGO_L3_SMAC_BIT;
+
+		if (algomsk & TRUNK_DISTRIBUTION_ALGO_DMAC_BIT)
+			newmask |= TRUNK_DISTRIBUTION_ALGO_L3_DMAC_BIT;
+	} else  {
+		if (algomsk & TRUNK_DISTRIBUTION_ALGO_SMAC_BIT)
+			newmask |= TRUNK_DISTRIBUTION_ALGO_L2_SMAC_BIT;
+		if (algomsk & TRUNK_DISTRIBUTION_ALGO_DMAC_BIT)
+			newmask |= TRUNK_DISTRIBUTION_ALGO_L2_DMAC_BIT;
+	}
+
+	sw_w32(newmask << l3shift, RTL930X_TRK_HASH_CTRL + (algoidx << 2));
+}
+
+static void rtl930x_led_init(struct rtl838x_switch_priv *priv)
+{
+	struct device_node *node;
+	u32 pm = 0;
+
+	pr_info("%s called\n", __func__);
+	node = of_find_compatible_node(NULL, NULL, "realtek,rtl9300-leds");
+	if (!node) {
+		pr_info("%s No compatible LED node found\n", __func__);
+		return;
+	}
+
+	for (int i = 0; i < priv->cpu_port; i++) {
+		int pos = (i << 1) % 32;
+		u32 set;
+		u32 v;
+
+		sw_w32_mask(0x3 << pos, 0, RTL930X_LED_PORT_FIB_SET_SEL_CTRL(i));
+		sw_w32_mask(0x3 << pos, 0, RTL930X_LED_PORT_COPR_SET_SEL_CTRL(i));
+
+		if (!priv->ports[i].phy)
+			continue;
+
+		v = 0x1;
+		if (priv->ports[i].is10G)
+			v = 0x3;
+		if (priv->ports[i].phy_is_integrated)
+			v = 0x1;
+		sw_w32_mask(0x3 << pos, v << pos, RTL930X_LED_PORT_NUM_CTRL(i));
+
+		pm |= BIT(i);
+
+		set = priv->ports[i].led_set;
+		sw_w32_mask(0, set << pos, RTL930X_LED_PORT_COPR_SET_SEL_CTRL(i));
+		sw_w32_mask(0, set << pos, RTL930X_LED_PORT_FIB_SET_SEL_CTRL(i));
+	}
+
+	for (int i = 0; i < 4; i++) {
+		const __be32 *led_set;
+		char set_name[9];
+		u32 setlen;
+		u32 v;
+
+		sprintf(set_name, "led_set%d", i);
+		led_set = of_get_property(node, set_name, &setlen);
+		if (!led_set || setlen != 16)
+			break;
+		v = be32_to_cpup(led_set) << 16 | be32_to_cpup(led_set + 1);
+		sw_w32(v, RTL930X_LED_SET0_0_CTRL - 4 - i * 8);
+		v = be32_to_cpup(led_set + 2) << 16 | be32_to_cpup(led_set + 3);
+		sw_w32(v, RTL930X_LED_SET0_0_CTRL - i * 8);
+	}
+
+	/* Set LED mode to serial (0x1) */
+	sw_w32_mask(0x3, 0x1, RTL930X_LED_GLB_CTRL);
+
+	/* Set LED active state */
+	if (of_property_read_bool(node, "active-low"))
+		sw_w32_mask(RTL930X_LED_GLB_ACTIVE_LOW, 0, RTL930X_LED_GLB_CTRL);
+	else
+		sw_w32_mask(0, RTL930X_LED_GLB_ACTIVE_LOW, RTL930X_LED_GLB_CTRL);
+
+	/* Set port type masks */
+	sw_w32(pm, RTL930X_LED_PORT_COPR_MASK_CTRL);
+	sw_w32(pm, RTL930X_LED_PORT_FIB_MASK_CTRL);
+	sw_w32(pm, RTL930X_LED_PORT_COMBO_MASK_CTRL);
+
+	for (int i = 0; i < 24; i++)
+		pr_info("%s %08x: %08x\n",__func__, 0xbb00cc00 + i * 4, sw_r32(0xcc00 + i * 4));
+}
+
+const struct rtl838x_reg rtl930x_reg = {
+	.mask_port_reg_be = rtl838x_mask_port_reg,
+	.set_port_reg_be = rtl838x_set_port_reg,
+	.get_port_reg_be = rtl838x_get_port_reg,
+	.mask_port_reg_le = rtl838x_mask_port_reg,
+	.set_port_reg_le = rtl838x_set_port_reg,
+	.get_port_reg_le = rtl838x_get_port_reg,
+	.stat_port_rst = RTL930X_STAT_PORT_RST,
+	.stat_rst = RTL930X_STAT_RST,
+	.stat_port_std_mib = RTL930X_STAT_PORT_MIB_CNTR,
+	.traffic_enable = rtl930x_traffic_enable,
+	.traffic_disable = rtl930x_traffic_disable,
+	.traffic_get = rtl930x_traffic_get,
+	.traffic_set = rtl930x_traffic_set,
+	.l2_ctrl_0 = RTL930X_L2_CTRL,
+	.l2_ctrl_1 = RTL930X_L2_AGE_CTRL,
+	.l2_port_aging_out = RTL930X_L2_PORT_AGE_CTRL,
+	.set_ageing_time = rtl930x_set_ageing_time,
+	.smi_poll_ctrl = RTL930X_SMI_POLL_CTRL, /* TODO: Difference to RTL9300_SMI_PRVTE_POLLING_CTRL */
+	.l2_tbl_flush_ctrl = RTL930X_L2_TBL_FLUSH_CTRL,
+	.exec_tbl0_cmd = rtl930x_exec_tbl0_cmd,
+	.exec_tbl1_cmd = rtl930x_exec_tbl1_cmd,
+	.tbl_access_data_0 = rtl930x_tbl_access_data_0,
+	.isr_glb_src = RTL930X_ISR_GLB,
+	.isr_port_link_sts_chg = RTL930X_ISR_PORT_LINK_STS_CHG,
+	.imr_port_link_sts_chg = RTL930X_IMR_PORT_LINK_STS_CHG,
+	.imr_glb = RTL930X_IMR_GLB,
+	.vlan_tables_read = rtl930x_vlan_tables_read,
+	.vlan_set_tagged = rtl930x_vlan_set_tagged,
+	.vlan_set_untagged = rtl930x_vlan_set_untagged,
+	.vlan_profile_dump = rtl930x_vlan_profile_dump,
+	.vlan_profile_setup = rtl930x_vlan_profile_setup,
+	.vlan_fwd_on_inner = rtl930x_vlan_fwd_on_inner,
+	.set_vlan_igr_filter = rtl930x_set_igr_filter,
+	.set_vlan_egr_filter = rtl930x_set_egr_filter,
+	.stp_get = rtl930x_stp_get,
+	.stp_set = rtl930x_stp_set,
+	.mac_force_mode_ctrl = rtl930x_mac_force_mode_ctrl,
+	.mac_port_ctrl = rtl930x_mac_port_ctrl,
+	.l2_port_new_salrn = rtl930x_l2_port_new_salrn,
+	.l2_port_new_sa_fwd = rtl930x_l2_port_new_sa_fwd,
+	.mir_ctrl = RTL930X_MIR_CTRL,
+	.mir_dpm = RTL930X_MIR_DPM_CTRL,
+	.mir_spm = RTL930X_MIR_SPM_CTRL,
+	.mac_link_sts = RTL930X_MAC_LINK_STS,
+	.mac_link_dup_sts = RTL930X_MAC_LINK_DUP_STS,
+	.mac_link_spd_sts = rtl930x_mac_link_spd_sts,
+	.mac_rx_pause_sts = RTL930X_MAC_RX_PAUSE_STS,
+	.mac_tx_pause_sts = RTL930X_MAC_TX_PAUSE_STS,
+	.read_l2_entry_using_hash = rtl930x_read_l2_entry_using_hash,
+	.write_l2_entry_using_hash = rtl930x_write_l2_entry_using_hash,
+	.read_cam = rtl930x_read_cam,
+	.write_cam = rtl930x_write_cam,
+	.vlan_port_keep_tag_set = rtl930x_vlan_port_keep_tag_set,
+	.vlan_port_pvidmode_set = rtl930x_vlan_port_pvidmode_set,
+	.vlan_port_pvid_set = rtl930x_vlan_port_pvid_set,
+	.trk_mbr_ctr = rtl930x_trk_mbr_ctr,
+	.rma_bpdu_fld_pmask = RTL930X_RMA_BPDU_FLD_PMSK,
+	.init_eee = rtl930x_init_eee,
+	.port_eee_set = rtl930x_port_eee_set,
+	.eee_port_ability = rtl930x_eee_port_ability,
+	.l2_hash_seed = rtl930x_l2_hash_seed,
+	.l2_hash_key = rtl930x_l2_hash_key,
+	.read_mcast_pmask = rtl930x_read_mcast_pmask,
+	.write_mcast_pmask = rtl930x_write_mcast_pmask,
+	.pie_init = rtl930x_pie_init,
+	.pie_rule_write = rtl930x_pie_rule_write,
+	.pie_rule_add = rtl930x_pie_rule_add,
+	.pie_rule_rm = rtl930x_pie_rule_rm,
+	.l2_learning_setup = rtl930x_l2_learning_setup,
+	.packet_cntr_read = rtl930x_packet_cntr_read,
+	.packet_cntr_clear = rtl930x_packet_cntr_clear,
+	.route_read = rtl930x_route_read,
+	.route_write = rtl930x_route_write,
+	.host_route_write = rtl930x_host_route_write,
+	.l3_setup = rtl930x_l3_setup,
+	.set_l3_nexthop = rtl930x_set_l3_nexthop,
+	.get_l3_nexthop = rtl930x_get_l3_nexthop,
+	.get_l3_egress_mac = rtl930x_get_l3_egress_mac,
+	.set_l3_egress_mac = rtl930x_set_l3_egress_mac,
+	.find_l3_slot = rtl930x_find_l3_slot,
+	.route_lookup_hw = rtl930x_route_lookup_hw,
+	.get_l3_router_mac = rtl930x_get_l3_router_mac,
+	.set_l3_router_mac = rtl930x_set_l3_router_mac,
+	.set_l3_egress_intf = rtl930x_set_l3_egress_intf,
+	.set_distribution_algorithm = rtl930x_set_distribution_algorithm,
+	.led_init = rtl930x_led_init,
+};
diff --git a/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/rtl931x.c b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/rtl931x.c
new file mode 100644
index 00000000000000..3221109c1804ca
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/rtl931x.c
@@ -0,0 +1,1694 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <asm/mach-rtl838x/mach-rtl83xx.h>
+#include <linux/etherdevice.h>
+
+#include "rtl83xx.h"
+
+#define RTL931X_VLAN_PORT_TAG_STS_INTERNAL			0x0
+#define RTL931X_VLAN_PORT_TAG_STS_UNTAG				0x1
+#define RTL931X_VLAN_PORT_TAG_STS_TAGGED			0x2
+#define RTL931X_VLAN_PORT_TAG_STS_PRIORITY_TAGGED		0x3
+
+#define RTL931X_VLAN_PORT_TAG_CTRL_BASE				0x4860
+/* port 0-56 */
+#define RTL931X_VLAN_PORT_TAG_CTRL(port) \
+		RTL931X_VLAN_PORT_TAG_CTRL_BASE + (port << 2)
+#define RTL931X_VLAN_PORT_TAG_EGR_OTAG_STS_MASK			GENMASK(13,12)
+#define RTL931X_VLAN_PORT_TAG_EGR_ITAG_STS_MASK			GENMASK(11,10)
+#define RTL931X_VLAN_PORT_TAG_EGR_OTAG_KEEP_MASK		GENMASK(9,9)
+#define RTL931X_VLAN_PORT_TAG_EGR_ITAG_KEEP_MASK		GENMASK(8,8)
+#define RTL931X_VLAN_PORT_TAG_IGR_OTAG_KEEP_MASK		GENMASK(7,7)
+#define RTL931X_VLAN_PORT_TAG_IGR_ITAG_KEEP_MASK		GENMASK(6,6)
+#define RTL931X_VLAN_PORT_TAG_OTPID_IDX_MASK			GENMASK(5,4)
+#define RTL931X_VLAN_PORT_TAG_OTPID_KEEP_MASK			GENMASK(3,3)
+#define RTL931X_VLAN_PORT_TAG_ITPID_IDX_MASK			GENMASK(2,1)
+#define RTL931X_VLAN_PORT_TAG_ITPID_KEEP_MASK			GENMASK(0,0)
+
+extern struct mutex smi_lock;
+extern struct rtl83xx_soc_info soc_info;
+
+/* Definition of the RTL931X-specific template field IDs as used in the PIE */
+enum template_field_id {
+	TEMPLATE_FIELD_SPM0 = 1,
+	TEMPLATE_FIELD_SPM1 = 2,
+	TEMPLATE_FIELD_SPM2 = 3,
+	TEMPLATE_FIELD_SPM3 = 4,
+	TEMPLATE_FIELD_DMAC0 = 9,
+	TEMPLATE_FIELD_DMAC1 = 10,
+	TEMPLATE_FIELD_DMAC2 = 11,
+	TEMPLATE_FIELD_SMAC0 = 12,
+	TEMPLATE_FIELD_SMAC1 = 13,
+	TEMPLATE_FIELD_SMAC2 = 14,
+	TEMPLATE_FIELD_ETHERTYPE = 15,
+	TEMPLATE_FIELD_OTAG = 16,
+	TEMPLATE_FIELD_ITAG = 17,
+	TEMPLATE_FIELD_SIP0 = 18,
+	TEMPLATE_FIELD_SIP1 = 19,
+	TEMPLATE_FIELD_DIP0 = 20,
+	TEMPLATE_FIELD_DIP1 = 21,
+	TEMPLATE_FIELD_IP_TOS_PROTO = 22,
+	TEMPLATE_FIELD_L4_SPORT = 23,
+	TEMPLATE_FIELD_L4_DPORT = 24,
+	TEMPLATE_FIELD_L34_HEADER = 25,
+	TEMPLATE_FIELD_TCP_INFO = 26,
+	TEMPLATE_FIELD_SIP2 = 34,
+	TEMPLATE_FIELD_SIP3 = 35,
+	TEMPLATE_FIELD_SIP4 = 36,
+	TEMPLATE_FIELD_SIP5 = 37,
+	TEMPLATE_FIELD_SIP6 = 38,
+	TEMPLATE_FIELD_SIP7 = 39,
+	TEMPLATE_FIELD_DIP2 = 42,
+	TEMPLATE_FIELD_DIP3 = 43,
+	TEMPLATE_FIELD_DIP4 = 44,
+	TEMPLATE_FIELD_DIP5 = 45,
+	TEMPLATE_FIELD_DIP6 = 46,
+	TEMPLATE_FIELD_DIP7 = 47,
+	TEMPLATE_FIELD_FLOW_LABEL = 49,
+	TEMPLATE_FIELD_DSAP_SSAP = 50,
+	TEMPLATE_FIELD_FWD_VID = 52,
+	TEMPLATE_FIELD_RANGE_CHK = 53,
+	TEMPLATE_FIELD_SLP = 55,
+	TEMPLATE_FIELD_DLP = 56,
+	TEMPLATE_FIELD_META_DATA = 57,
+	TEMPLATE_FIELD_FIRST_MPLS1 = 60,
+	TEMPLATE_FIELD_FIRST_MPLS2 = 61,
+	TEMPLATE_FIELD_DPM3 = 8,
+};
+
+/* The meaning of TEMPLATE_FIELD_VLAN depends on phase and the configuration in
+ * RTL931X_PIE_CTRL. We use always the same definition and map to the inner VLAN tag:
+ */
+#define TEMPLATE_FIELD_VLAN TEMPLATE_FIELD_ITAG
+
+/* Number of fixed templates predefined in the RTL9300 SoC */
+#define N_FIXED_TEMPLATES 5
+/* RTL931x specific predefined templates */
+static enum template_field_id fixed_templates[N_FIXED_TEMPLATES][N_FIXED_FIELDS_RTL931X] =
+{
+	{
+		TEMPLATE_FIELD_DMAC0, TEMPLATE_FIELD_DMAC1, TEMPLATE_FIELD_DMAC2,
+		TEMPLATE_FIELD_SMAC0, TEMPLATE_FIELD_SMAC1, TEMPLATE_FIELD_SMAC2,
+		TEMPLATE_FIELD_VLAN, TEMPLATE_FIELD_IP_TOS_PROTO, TEMPLATE_FIELD_DSAP_SSAP,
+		TEMPLATE_FIELD_ETHERTYPE, TEMPLATE_FIELD_SPM0, TEMPLATE_FIELD_SPM1,
+		TEMPLATE_FIELD_SPM2, TEMPLATE_FIELD_SPM3
+	}, {
+		TEMPLATE_FIELD_SIP0, TEMPLATE_FIELD_SIP1, TEMPLATE_FIELD_DIP0,
+		TEMPLATE_FIELD_DIP1, TEMPLATE_FIELD_IP_TOS_PROTO, TEMPLATE_FIELD_TCP_INFO,
+		TEMPLATE_FIELD_L4_SPORT, TEMPLATE_FIELD_L4_DPORT, TEMPLATE_FIELD_VLAN,
+		TEMPLATE_FIELD_RANGE_CHK, TEMPLATE_FIELD_SPM0, TEMPLATE_FIELD_SPM1,
+		TEMPLATE_FIELD_SPM2, TEMPLATE_FIELD_SPM3
+	}, {
+		TEMPLATE_FIELD_DMAC0, TEMPLATE_FIELD_DMAC1, TEMPLATE_FIELD_DMAC2,
+		TEMPLATE_FIELD_VLAN, TEMPLATE_FIELD_ETHERTYPE, TEMPLATE_FIELD_IP_TOS_PROTO,
+		TEMPLATE_FIELD_SIP0, TEMPLATE_FIELD_SIP1, TEMPLATE_FIELD_DIP0,
+		TEMPLATE_FIELD_DIP1, TEMPLATE_FIELD_L4_SPORT, TEMPLATE_FIELD_L4_DPORT,
+		TEMPLATE_FIELD_META_DATA, TEMPLATE_FIELD_SLP
+	}, {
+		TEMPLATE_FIELD_DIP0, TEMPLATE_FIELD_DIP1, TEMPLATE_FIELD_DIP2,
+		TEMPLATE_FIELD_DIP3, TEMPLATE_FIELD_DIP4, TEMPLATE_FIELD_DIP5,
+		TEMPLATE_FIELD_DIP6, TEMPLATE_FIELD_DIP7, TEMPLATE_FIELD_IP_TOS_PROTO,
+		TEMPLATE_FIELD_TCP_INFO, TEMPLATE_FIELD_L4_SPORT, TEMPLATE_FIELD_L4_DPORT,
+		TEMPLATE_FIELD_RANGE_CHK, TEMPLATE_FIELD_SLP
+	}, {
+		TEMPLATE_FIELD_SIP0, TEMPLATE_FIELD_SIP1, TEMPLATE_FIELD_SIP2,
+		TEMPLATE_FIELD_SIP3, TEMPLATE_FIELD_SIP4, TEMPLATE_FIELD_SIP5,
+		TEMPLATE_FIELD_SIP6, TEMPLATE_FIELD_SIP7, TEMPLATE_FIELD_META_DATA,
+		TEMPLATE_FIELD_VLAN, TEMPLATE_FIELD_SPM0, TEMPLATE_FIELD_SPM1,
+		TEMPLATE_FIELD_SPM2, TEMPLATE_FIELD_SPM3
+	},
+};
+
+inline void rtl931x_exec_tbl0_cmd(u32 cmd)
+{
+	sw_w32(cmd, RTL931X_TBL_ACCESS_CTRL_0);
+	do { } while (sw_r32(RTL931X_TBL_ACCESS_CTRL_0) & (1 << 20));
+}
+
+inline void rtl931x_exec_tbl1_cmd(u32 cmd)
+{
+	sw_w32(cmd, RTL931X_TBL_ACCESS_CTRL_1);
+	do { } while (sw_r32(RTL931X_TBL_ACCESS_CTRL_1) & (1 << 17));
+}
+
+inline int rtl931x_tbl_access_data_0(int i)
+{
+	return RTL931X_TBL_ACCESS_DATA_0(i);
+}
+
+void rtl931x_vlan_profile_dump(int index)
+{
+	u64 profile[4];
+
+	if (index < 0 || index > 15)
+		return;
+
+	profile[0] = sw_r32(RTL931X_VLAN_PROFILE_SET(index));
+	profile[1] = (sw_r32(RTL931X_VLAN_PROFILE_SET(index) + 4) & 0x1FFFFFFFULL) << 32 |
+	             (sw_r32(RTL931X_VLAN_PROFILE_SET(index) + 8) & 0xFFFFFFFF);
+	profile[2] = (sw_r32(RTL931X_VLAN_PROFILE_SET(index) + 16) & 0x1FFFFFFFULL) << 32 |
+	             (sw_r32(RTL931X_VLAN_PROFILE_SET(index) + 12) & 0xFFFFFFFF);
+	profile[3] = (sw_r32(RTL931X_VLAN_PROFILE_SET(index) + 20) & 0x1FFFFFFFULL) << 32 |
+	             (sw_r32(RTL931X_VLAN_PROFILE_SET(index) + 24) & 0xFFFFFFFF);
+
+	pr_info("VLAN %d: L2 learning: %d, L2 Unknown MultiCast Field %llx, \
+		IPv4 Unknown MultiCast Field %llx, IPv6 Unknown MultiCast Field: %llx",
+		index, (u32) (profile[0] & (3 << 14)), profile[1], profile[2], profile[3]);
+}
+
+static void rtl931x_stp_get(struct rtl838x_switch_priv *priv, u16 msti, u32 port_state[])
+{
+	u32 cmd = 1 << 20 | /* Execute cmd */
+	          0 << 19 | /* Read */
+	          5 << 15 | /* Table type 0b101 */
+	          (msti & 0x3fff);
+	priv->r->exec_tbl0_cmd(cmd);
+
+	for (int i = 0; i < 4; i++)
+		port_state[i] = sw_r32(priv->r->tbl_access_data_0(i));
+}
+
+static void rtl931x_stp_set(struct rtl838x_switch_priv *priv, u16 msti, u32 port_state[])
+{
+	u32 cmd = 1 << 20 | /* Execute cmd */
+	          1 << 19 | /* Write */
+	          5 << 15 | /* Table type 0b101 */
+	          (msti & 0x3fff);
+	for (int i = 0; i < 4; i++)
+		sw_w32(port_state[i], priv->r->tbl_access_data_0(i));
+	priv->r->exec_tbl0_cmd(cmd);
+}
+
+inline static int rtl931x_trk_mbr_ctr(int group)
+{
+	return RTL931X_TRK_MBR_CTRL + (group << 2);
+}
+
+static void rtl931x_vlan_tables_read(u32 vlan, struct rtl838x_vlan_info *info)
+{
+	u32 v, w, x, y;
+	/* Read VLAN table (3) via register 0 */
+	struct table_reg *r = rtl_table_get(RTL9310_TBL_0, 3);
+
+	rtl_table_read(r, vlan);
+	v = sw_r32(rtl_table_data(r, 0));
+	w = sw_r32(rtl_table_data(r, 1));
+	x = sw_r32(rtl_table_data(r, 2));
+	y = sw_r32(rtl_table_data(r, 3));
+	rtl_table_release(r);
+
+	pr_debug("VLAN_READ %d: %08x %08x %08x %08x\n", vlan, v, w, x, y);
+	info->tagged_ports = ((u64) v) << 25 | (w >> 7);
+	info->profile_id = (x >> 16) & 0xf;
+	info->fid = w & 0x7f;				/* AKA MSTI depending on context */
+	info->hash_uc_fid = !!(x & BIT(31));
+	info->hash_mc_fid = !!(x & BIT(30));
+	info->if_id = (x >> 20) & 0x3ff;
+	info->profile_id = (x >> 16) & 0xf;
+	info->multicast_grp_mask = x & 0xffff;
+	if (x & BIT(31))
+		info->l2_tunnel_list_id = y >> 18;
+	else
+		info->l2_tunnel_list_id = -1;
+	pr_debug("%s read tagged %016llx, profile-id %d, uc %d, mc %d, intf-id %d\n", __func__,
+		info->tagged_ports, info->profile_id, info->hash_uc_fid, info->hash_mc_fid,
+		info->if_id);
+
+	/* Read UNTAG table via table register 3 */
+	r = rtl_table_get(RTL9310_TBL_3, 0);
+	rtl_table_read(r, vlan);
+	v = ((u64)sw_r32(rtl_table_data(r, 0))) << 25;
+	v |= sw_r32(rtl_table_data(r, 1)) >> 7;
+	rtl_table_release(r);
+
+	info->untagged_ports = v;
+}
+
+static void rtl931x_vlan_set_tagged(u32 vlan, struct rtl838x_vlan_info *info)
+{
+	u32 v, w, x, y;
+	/* Access VLAN table (1) via register 0 */
+	struct table_reg *r = rtl_table_get(RTL9310_TBL_0, 3);
+
+	v = info->tagged_ports >> 25;
+	w = (info->tagged_ports & 0x1fffff) << 7;
+	w |= info->fid & 0x7f;
+	x = info->hash_uc_fid ? BIT(31) : 0;
+	x |= info->hash_mc_fid ? BIT(30) : 0;
+	x |= info->if_id & 0x3ff << 20;
+	x |= (info->profile_id & 0xf) << 16;
+	x |= info->multicast_grp_mask & 0xffff;
+	if (info->l2_tunnel_list_id >= 0) {
+		y = info->l2_tunnel_list_id << 18;
+		y |= BIT(31);
+	} else {
+		y = 0;
+	}
+
+	sw_w32(v, rtl_table_data(r, 0));
+	sw_w32(w, rtl_table_data(r, 1));
+	sw_w32(x, rtl_table_data(r, 2));
+	sw_w32(y, rtl_table_data(r, 3));
+
+	rtl_table_write(r, vlan);
+	rtl_table_release(r);
+}
+
+static void rtl931x_vlan_set_untagged(u32 vlan, u64 portmask)
+{
+	struct table_reg *r = rtl_table_get(RTL9310_TBL_3, 0);
+
+	rtl839x_set_port_reg_be(portmask << 7, rtl_table_data(r, 0));
+	rtl_table_write(r, vlan);
+	rtl_table_release(r);
+}
+
+static inline int rtl931x_mac_force_mode_ctrl(int p)
+{
+	return RTL931X_MAC_FORCE_MODE_CTRL + (p << 2);
+}
+
+static inline int rtl931x_mac_link_spd_sts(int p)
+{
+	return RTL931X_MAC_LINK_SPD_STS + (((p >> 3) << 2));
+}
+
+static inline int rtl931x_mac_port_ctrl(int p)
+{
+	return RTL931X_MAC_L2_PORT_CTRL + (p << 7);
+}
+
+static inline int rtl931x_l2_port_new_salrn(int p)
+{
+	return RTL931X_L2_PORT_NEW_SALRN(p);
+}
+
+static inline int rtl931x_l2_port_new_sa_fwd(int p)
+{
+	return RTL931X_L2_PORT_NEW_SA_FWD(p);
+}
+
+irqreturn_t rtl931x_switch_irq(int irq, void *dev_id)
+{
+	struct dsa_switch *ds = dev_id;
+	u32 status = sw_r32(RTL931X_ISR_GLB_SRC);
+	u64 ports = rtl839x_get_port_reg_le(RTL931X_ISR_PORT_LINK_STS_CHG);
+	u64 link;
+
+	/* Clear status */
+	rtl839x_set_port_reg_le(ports, RTL931X_ISR_PORT_LINK_STS_CHG);
+	pr_debug("RTL931X Link change: status: %x, ports %016llx\n", status, ports);
+
+	link = rtl839x_get_port_reg_le(RTL931X_MAC_LINK_STS);
+	/* Must re-read this to get correct status */
+	link = rtl839x_get_port_reg_le(RTL931X_MAC_LINK_STS);
+	pr_debug("RTL931X Link change: status: %x, link status %016llx\n", status, link);
+
+	for (int i = 0; i < 56; i++) {
+		if (ports & BIT_ULL(i)) {
+			if (link & BIT_ULL(i)) {
+				pr_info("%s port %d up\n", __func__, i);
+				dsa_port_phylink_mac_change(ds, i, true);
+			} else {
+				pr_info("%s port %d down\n", __func__, i);
+				dsa_port_phylink_mac_change(ds, i, false);
+			}
+		}
+	}
+
+	return IRQ_HANDLED;
+}
+
+int rtl931x_write_phy(u32 port, u32 page, u32 reg, u32 val)
+{
+	u32 v;
+	int err = 0;
+
+	val &= 0xffff;
+	if (port > 63 || page > 4095 || reg > 31)
+		return -ENOTSUPP;
+
+	mutex_lock(&smi_lock);
+	pr_debug("%s: writing to phy %d %d %d %d\n", __func__, port, page, reg, val);
+	/* Clear both port registers */
+	sw_w32(0, RTL931X_SMI_INDRT_ACCESS_CTRL_2);
+	sw_w32(0, RTL931X_SMI_INDRT_ACCESS_CTRL_2 + 4);
+	sw_w32_mask(0, BIT(port % 32), RTL931X_SMI_INDRT_ACCESS_CTRL_2 + (port / 32) * 4);
+
+	sw_w32_mask(0xffff, val, RTL931X_SMI_INDRT_ACCESS_CTRL_3);
+
+	v = reg << 6 | page << 11 ;
+	sw_w32(v, RTL931X_SMI_INDRT_ACCESS_CTRL_0);
+
+	sw_w32(0x1ff, RTL931X_SMI_INDRT_ACCESS_CTRL_1);
+
+	v |= BIT(4) | 1; /* Write operation and execute */
+	sw_w32(v, RTL931X_SMI_INDRT_ACCESS_CTRL_0);
+
+	do {
+	} while (sw_r32(RTL931X_SMI_INDRT_ACCESS_CTRL_0) & 0x1);
+
+	if (sw_r32(RTL931X_SMI_INDRT_ACCESS_CTRL_0) & 0x2)
+		err = -EIO;
+
+	mutex_unlock(&smi_lock);
+
+	return err;
+}
+
+int rtl931x_read_phy(u32 port, u32 page, u32 reg, u32 *val)
+{
+	u32 v;
+
+	if (port > 63 || page > 4095 || reg > 31)
+		return -ENOTSUPP;
+
+	mutex_lock(&smi_lock);
+
+	sw_w32(port << 5, RTL931X_SMI_INDRT_ACCESS_BC_PHYID_CTRL);
+
+	v = reg << 6 | page << 11 | 1;
+	sw_w32(v, RTL931X_SMI_INDRT_ACCESS_CTRL_0);
+
+	do {
+	} while (sw_r32(RTL931X_SMI_INDRT_ACCESS_CTRL_0) & 0x1);
+
+	v = sw_r32(RTL931X_SMI_INDRT_ACCESS_CTRL_0);
+	*val = sw_r32(RTL931X_SMI_INDRT_ACCESS_CTRL_3);
+	*val = (*val & 0xffff0000) >> 16;
+
+	pr_debug("%s: port %d, page: %d, reg: %x, val: %x, v: %08x\n",
+		__func__, port, page, reg, *val, v);
+
+	mutex_unlock(&smi_lock);
+
+	return 0;
+}
+
+/* Read an mmd register of the PHY */
+int rtl931x_read_mmd_phy(u32 port, u32 devnum, u32 regnum, u32 *val)
+{
+	int err = 0;
+	u32 v;
+	/* Select PHY register type
+	 * If select 1G/10G MMD register type, registers EXT_PAGE, MAIN_PAGE and REG settings are don’t care.
+	 * 0x0  Normal register (Clause 22)
+	 * 0x1: 1G MMD register (MMD via Clause 22 registers 13 and 14)
+	 * 0x2: 10G MMD register (MMD via Clause 45)
+	 */
+	int type = (regnum & MII_ADDR_C45)?2:1;
+
+	mutex_lock(&smi_lock);
+
+	/* Set PHY to access via port-number */
+	sw_w32(port << 5, RTL931X_SMI_INDRT_ACCESS_BC_PHYID_CTRL);
+
+	/* Set MMD device number and register to write to */
+	sw_w32(devnum << 16 | mdiobus_c45_regad(regnum), RTL931X_SMI_INDRT_ACCESS_MMD_CTRL);
+
+	v = type << 2 | BIT(0); /* MMD-access-type | EXEC */
+	sw_w32(v, RTL931X_SMI_INDRT_ACCESS_CTRL_0);
+
+	do {
+		v = sw_r32(RTL931X_SMI_INDRT_ACCESS_CTRL_0);
+	} while (v & BIT(0));
+
+	/* Check for error condition */
+	if (v & BIT(1))
+		err = -EIO;
+
+	*val = sw_r32(RTL931X_SMI_INDRT_ACCESS_CTRL_3) >> 16;
+
+	pr_debug("%s: port %d, dev: %x, regnum: %x, val: %x (err %d)\n", __func__,
+		 port, devnum, mdiobus_c45_regad(regnum), *val, err);
+
+	mutex_unlock(&smi_lock);
+
+	return err;
+}
+
+/* Write to an mmd register of the PHY */
+int rtl931x_write_mmd_phy(u32 port, u32 devnum, u32 regnum, u32 val)
+{
+	int err = 0;
+	u32 v;
+	int type = (regnum & MII_ADDR_C45)?2:1;
+	u64 pm;
+
+	mutex_lock(&smi_lock);
+
+	/* Set PHY to access via port-mask */
+	pm = (u64)1 << port;
+	sw_w32((u32)pm, RTL931X_SMI_INDRT_ACCESS_CTRL_2);
+	sw_w32((u32)(pm >> 32), RTL931X_SMI_INDRT_ACCESS_CTRL_2 + 4);
+
+	/* Set data to write */
+	sw_w32_mask(0xffff, val, RTL931X_SMI_INDRT_ACCESS_CTRL_3);
+
+	/* Set MMD device number and register to write to */
+	sw_w32(devnum << 16 | mdiobus_c45_regad(regnum), RTL931X_SMI_INDRT_ACCESS_MMD_CTRL);
+
+	v = BIT(4) | type << 2 | BIT(0); /* WRITE | MMD-access-type | EXEC */
+	sw_w32(v, RTL931X_SMI_INDRT_ACCESS_CTRL_0);
+
+	do {
+		v = sw_r32(RTL931X_SMI_INDRT_ACCESS_CTRL_0);
+	} while (v & BIT(0));
+
+	pr_debug("%s: port %d, dev: %x, regnum: %x, val: %x (err %d)\n", __func__,
+		 port, devnum, mdiobus_c45_regad(regnum), val, err);
+	mutex_unlock(&smi_lock);
+
+	return err;
+}
+
+void rtl931x_print_matrix(void)
+{
+	volatile u64 *ptr = RTL838X_SW_BASE + RTL839X_PORT_ISO_CTRL(0);
+
+	for (int i = 0; i < 52; i += 4)
+		pr_info("> %16llx %16llx %16llx %16llx\n",
+			ptr[i + 0], ptr[i + 1], ptr[i + 2], ptr[i + 3]);
+	pr_info("CPU_PORT> %16llx\n", ptr[52]);
+}
+
+void rtl931x_set_receive_management_action(int port, rma_ctrl_t type, action_type_t action)
+{
+	u32 value = 0;
+
+	/* hack for value mapping */
+	if (type == GRATARP && action == COPY2CPU)
+		action = TRAP2MASTERCPU;
+
+	switch(action) {
+	case FORWARD:
+		value = 0;
+		break;
+	case DROP:
+		value = 1;
+		break;
+	case TRAP2CPU:
+		value = 2;
+		break;
+	case TRAP2MASTERCPU:
+		value = 3;
+		break;
+	case FLOODALL:
+		value = 4;
+		break;
+	default:
+		break;
+	}
+
+	switch(type) {
+	case BPDU:
+		sw_w32_mask(7 << ((port % 10) * 3), value << ((port % 10) * 3), RTL931X_RMA_BPDU_CTRL + ((port / 10) << 2));
+	break;
+	case PTP:
+		/* udp */
+		sw_w32_mask(3 << 2, value << 2, RTL931X_RMA_PTP_CTRL + (port << 2));
+		/* eth2 */
+		sw_w32_mask(3, value, RTL931X_RMA_PTP_CTRL + (port << 2));
+	break;
+	case PTP_UDP:
+		sw_w32_mask(3 << 2, value << 2, RTL931X_RMA_PTP_CTRL + (port << 2));
+	break;
+	case PTP_ETH2:
+		sw_w32_mask(3, value, RTL931X_RMA_PTP_CTRL + (port << 2));
+	break;
+	case LLTP:
+		sw_w32_mask(7 << ((port % 10) * 3), value << ((port % 10) * 3), RTL931X_RMA_LLTP_CTRL + ((port / 10) << 2));
+	break;
+	case EAPOL:
+		sw_w32_mask(7 << ((port % 10) * 3), value << ((port % 10) * 3), RTL931X_RMA_EAPOL_CTRL + ((port / 10) << 2));
+	break;
+	case GRATARP:
+		sw_w32_mask(3 << ((port & 0xf) << 1), value << ((port & 0xf) << 1), RTL931X_TRAP_ARP_GRAT_PORT_ACT + ((port >> 4) << 2));
+	break;
+	}
+}
+
+u64 rtl931x_traffic_get(int source)
+{
+	u32 v;
+	struct table_reg *r = rtl_table_get(RTL9310_TBL_0, 6);
+
+	rtl_table_read(r, source);
+	v = sw_r32(rtl_table_data(r, 0));
+	rtl_table_release(r);
+	v = v >> 3;
+
+	return v;
+}
+
+/* Enable traffic between a source port and a destination port matrix */
+void rtl931x_traffic_set(int source, u64 dest_matrix)
+{
+	struct table_reg *r = rtl_table_get(RTL9310_TBL_0, 6);
+
+	sw_w32((dest_matrix << 3), rtl_table_data(r, 0));
+	rtl_table_write(r, source);
+	rtl_table_release(r);
+}
+
+void rtl931x_traffic_enable(int source, int dest)
+{
+	struct table_reg *r = rtl_table_get(RTL9310_TBL_0, 6);
+	rtl_table_read(r, source);
+	sw_w32_mask(0, BIT(dest + 3), rtl_table_data(r, 0));
+	rtl_table_write(r, source);
+	rtl_table_release(r);
+}
+
+void rtl931x_traffic_disable(int source, int dest)
+{
+	struct table_reg *r = rtl_table_get(RTL9310_TBL_0, 6);
+	rtl_table_read(r, source);
+	sw_w32_mask(BIT(dest + 3), 0, rtl_table_data(r, 0));
+	rtl_table_write(r, source);
+	rtl_table_release(r);
+}
+
+static u64 rtl931x_l2_hash_seed(u64 mac, u32 vid)
+{
+	u64 v = vid;
+
+	v <<= 48;
+	v |= mac;
+
+	return v;
+}
+
+/* Calculate both the block 0 and the block 1 hash by applyingthe same hash
+ * algorithm as the one used currently by the ASIC to the seed, and return
+ * both hashes in the lower and higher word of the return value since only 12 bit of
+ * the hash are significant.
+ */
+static u32 rtl931x_l2_hash_key(struct rtl838x_switch_priv *priv, u64 seed)
+{
+	u32 h, h0, h1, h2, h3, h4, k0, k1;
+
+	h0 = seed & 0xfff;
+	h1 = (seed >> 12) & 0xfff;
+	h2 = (seed >> 24) & 0xfff;
+	h3 = (seed >> 36) & 0xfff;
+	h4 = (seed >> 48) & 0xfff;
+	h4 = ((h4 & 0x7) << 9) | ((h4 >> 3) & 0x1ff);
+	k0 = h0 ^ h1 ^ h2 ^ h3 ^ h4;
+
+	h0 = seed & 0xfff;
+	h0 = ((h0 & 0x1ff) << 3) | ((h0 >> 9) & 0x7);
+	h1 = (seed >> 12) & 0xfff;
+	h1 = ((h1 & 0x3f) << 6) | ((h1 >> 6) & 0x3f);
+	h2 = (seed >> 24) & 0xfff;
+	h3 = (seed >> 36) & 0xfff;
+	h3 = ((h3 & 0x3f) << 6) | ((h3 >> 6) & 0x3f);
+	h4 = (seed >> 48) & 0xfff;
+	k1 = h0 ^ h1 ^ h2 ^ h3 ^ h4;
+
+	/* Algorithm choice for block 0 */
+	if (sw_r32(RTL931X_L2_CTRL) & BIT(0))
+		h = k1;
+	else
+		h = k0;
+
+	/* Algorithm choice for block 1
+	 * Since k0 and k1 are < 4096, adding 4096 will offset the hash into the second
+	 * half of hash-space
+	 * 4096 is in fact the hash-table size 32768 divided by 4 hashes per bucket
+	 * divided by 2 to divide the hash space in 2
+	 */
+	if (sw_r32(RTL931X_L2_CTRL) & BIT(1))
+		h |= (k1 + 4096) << 16;
+	else
+		h |= (k0 + 4096) << 16;
+
+	return h;
+}
+
+/* Fills an L2 entry structure from the SoC registers */
+static void rtl931x_fill_l2_entry(u32 r[], struct rtl838x_l2_entry *e)
+{
+	pr_debug("In %s valid?\n", __func__);
+	e->valid = !!(r[0] & BIT(31));
+	if (!e->valid)
+		return;
+
+	pr_debug("%s: entry valid, raw: %08x %08x %08x %08x\n", __func__, r[0], r[1], r[2], r[3]);
+	e->is_ip_mc = false;
+	e->is_ipv6_mc = false;
+
+	e->mac[0] = r[0] >> 8;
+	e->mac[1] = r[0];
+	e->mac[2] = r[1] >> 24;
+	e->mac[3] = r[1] >> 16;
+	e->mac[4] = r[1] >> 8;
+	e->mac[5] = r[1];
+
+	e->is_open_flow = !!(r[0] & BIT(30));
+	e->is_pe_forward = !!(r[0] & BIT(29));
+	e->next_hop = !!(r[2] & BIT(30));
+	e->rvid = (r[0] >> 16) & 0xfff;
+
+	/* Is it a unicast entry? check multicast bit */
+	if (!(e->mac[0] & 1)) {
+		e->type = L2_UNICAST;
+		e->is_l2_tunnel = !!(r[2] & BIT(31));
+		e->is_static = !!(r[2] & BIT(13));
+		e->port = (r[2] >> 19) & 0x3ff;
+		/* Check for trunk port */
+		if (r[2] & BIT(29)) {
+			e->is_trunk = true;
+			e->stack_dev = (e->port >> 9) & 1;
+			e->trunk = e->port & 0x3f;
+		} else {
+			e->is_trunk = false;
+			e->stack_dev = (e->port >> 6) & 0xf;
+			e->port = e->port & 0x3f;
+		}
+
+		e->block_da = !!(r[2] & BIT(14));
+		e->block_sa = !!(r[2] & BIT(15));
+		e->suspended = !!(r[2] & BIT(12));
+		e->age = (r[2] >> 16) & 3;
+
+		/* the UC_VID field in hardware is used for the VID or for the route id */
+		if (e->next_hop) {
+			e->nh_route_id = r[2] & 0x7ff;
+			e->vid = 0;
+		} else {
+			e->vid = r[2] & 0xfff;
+			e->nh_route_id = 0;
+		}
+		if (e->is_l2_tunnel)
+			e->l2_tunnel_id = ((r[2] & 0xff) << 4) | (r[3] >> 28);
+		/* TODO: Implement VLAN conversion */
+	} else {
+		e->type = L2_MULTICAST;
+		e->is_local_forward = !!(r[2] & BIT(31));
+		e->is_remote_forward = !!(r[2] & BIT(17));
+		e->mc_portmask_index = (r[2] >> 18) & 0xfff;
+		e->l2_tunnel_list_id = (r[2] >> 4) & 0x1fff;
+	}
+}
+
+/* Fills the 3 SoC table registers r[] with the information of in the rtl838x_l2_entry */
+static void rtl931x_fill_l2_row(u32 r[], struct rtl838x_l2_entry *e)
+{
+	u32 port;
+
+	if (!e->valid) {
+		r[0] = r[1] = r[2] = 0;
+		return;
+	}
+
+	r[2] = BIT(31);	/* Set valid bit */
+
+	r[0] = ((u32)e->mac[0]) << 24 |
+	       ((u32)e->mac[1]) << 16 |
+	       ((u32)e->mac[2]) << 8 |
+	       ((u32)e->mac[3]);
+	r[1] = ((u32)e->mac[4]) << 24 |
+	       ((u32)e->mac[5]) << 16;
+
+	r[2] |= e->next_hop ? BIT(12) : 0;
+
+	if (e->type == L2_UNICAST) {
+		r[2] |= e->is_static ? BIT(14) : 0;
+		r[1] |= e->rvid & 0xfff;
+		r[2] |= (e->port & 0x3ff) << 20;
+		if (e->is_trunk) {
+			r[2] |= BIT(30);
+			port = e->stack_dev << 9 | (e->port & 0x3f);
+		} else {
+			port = (e->stack_dev & 0xf) << 6;
+			port |= e->port & 0x3f;
+		}
+		r[2] |= port << 20;
+		r[2] |= e->block_da ? BIT(15) : 0;
+		r[2] |= e->block_sa ? BIT(17) : 0;
+		r[2] |= e->suspended ? BIT(13) : 0;
+		r[2] |= (e->age & 0x3) << 17;
+		/* the UC_VID field in hardware is used for the VID or for the route id */
+		if (e->next_hop)
+			r[2] |= e->nh_route_id & 0x7ff;
+		else
+			r[2] |= e->vid & 0xfff;
+	} else { /* L2_MULTICAST */
+		r[2] |= (e->mc_portmask_index & 0x3ff) << 16;
+		r[2] |= e->mc_mac_index & 0x7ff;
+	}
+}
+
+/* Read an L2 UC or MC entry out of a hash bucket of the L2 forwarding table
+ * hash is the id of the bucket and pos is the position of the entry in that bucket
+ * The data read from the SoC is filled into rtl838x_l2_entry
+ */
+static u64 rtl931x_read_l2_entry_using_hash(u32 hash, u32 pos, struct rtl838x_l2_entry *e)
+{
+	u32 r[4];
+	struct table_reg *q = rtl_table_get(RTL9310_TBL_0, 0);
+	u32 idx;
+	u64 mac;
+	u64 seed;
+
+	pr_debug("%s: hash %08x, pos: %d\n", __func__, hash, pos);
+
+	/* On the RTL93xx, 2 different hash algorithms are used making it a total of
+	 * 8 buckets that need to be searched, 4 for each hash-half
+	 * Use second hash space when bucket is between 4 and 8
+	 */
+	if (pos >= 4) {
+		pos -= 4;
+		hash >>= 16;
+	} else {
+		hash &= 0xffff;
+	}
+
+	idx = (0 << 14) | (hash << 2) | pos; /* Search SRAM, with hash and at pos in bucket */
+	pr_debug("%s: NOW hash %08x, pos: %d\n", __func__, hash, pos);
+
+	rtl_table_read(q, idx);
+	for (int i = 0; i < 4; i++)
+		r[i] = sw_r32(rtl_table_data(q, i));
+
+	rtl_table_release(q);
+
+	rtl931x_fill_l2_entry(r, e);
+
+	pr_debug("%s: valid: %d, nh: %d\n", __func__, e->valid, e->next_hop);
+	if (!e->valid)
+		return 0;
+
+	mac = ((u64)e->mac[0]) << 40 |
+	      ((u64)e->mac[1]) << 32 |
+	      ((u64)e->mac[2]) << 24 |
+	      ((u64)e->mac[3]) << 16 |
+	      ((u64)e->mac[4]) << 8 |
+	      ((u64)e->mac[5]);
+
+	seed = rtl931x_l2_hash_seed(mac, e->rvid);
+	pr_debug("%s: mac %016llx, seed %016llx\n", __func__, mac, seed);
+
+	/* return vid with concatenated mac as unique id */
+	return seed;
+}
+
+static u64 rtl931x_read_cam(int idx, struct rtl838x_l2_entry *e)
+{
+	return 0;
+}
+
+static void rtl931x_write_cam(int idx, struct rtl838x_l2_entry *e)
+{
+}
+
+static void rtl931x_write_l2_entry_using_hash(u32 hash, u32 pos, struct rtl838x_l2_entry *e)
+{
+	u32 r[4];
+	struct table_reg *q = rtl_table_get(RTL9310_TBL_0, 0);
+	u32 idx = (0 << 14) | (hash << 2) | pos; /* Access SRAM, with hash and at pos in bucket */
+
+	pr_info("%s: hash %d, pos %d\n", __func__, hash, pos);
+	pr_info("%s: index %d -> mac %02x:%02x:%02x:%02x:%02x:%02x\n", __func__, idx,
+		e->mac[0], e->mac[1], e->mac[2], e->mac[3],e->mac[4],e->mac[5]);
+
+	rtl931x_fill_l2_row(r, e);
+	pr_info("%s: %d: %08x %08x %08x\n", __func__, idx, r[0], r[1], r[2]);
+
+	for (int i = 0; i < 4; i++)
+		sw_w32(r[i], rtl_table_data(q, i));
+
+	rtl_table_write(q, idx);
+	rtl_table_release(q);
+}
+
+static void rtl931x_vlan_fwd_on_inner(int port, bool is_set)
+{
+	/* Always set all tag modes to fwd based on either inner or outer tag */
+	if (is_set)
+		sw_w32_mask(0, 0xf, RTL931X_VLAN_PORT_FWD + (port << 2));
+	else
+		sw_w32_mask(0xf, 0, RTL931X_VLAN_PORT_FWD + (port << 2));
+}
+
+static void rtl931x_vlan_profile_setup(int profile)
+{
+	u32 p[7];
+
+	pr_info("In %s\n", __func__);
+
+	if (profile > 15)
+		return;
+
+	p[0] = sw_r32(RTL931X_VLAN_PROFILE_SET(profile));
+
+	/* Enable routing of Ipv4/6 Unicast and IPv4/6 Multicast traffic */
+	/* p[0] |= BIT(17) | BIT(16) | BIT(13) | BIT(12); */
+	p[0] |= 0x3 << 11; /* COPY2CPU */
+
+	p[1] = 0x1FFFFFF; /* L2 unknwon MC flooding portmask all ports, including the CPU-port */
+	p[2] = 0xFFFFFFFF;
+	p[3] = 0x1FFFFFF; /* IPv4 unknwon MC flooding portmask */
+	p[4] = 0xFFFFFFFF;
+	p[5] = 0x1FFFFFF; /* IPv6 unknwon MC flooding portmask */
+	p[6] = 0xFFFFFFFF;
+
+	for (int i = 0; i < 7; i++)
+		sw_w32(p[i], RTL931X_VLAN_PROFILE_SET(profile) + i * 4);
+	pr_info("Leaving %s\n", __func__);
+}
+
+static void rtl931x_l2_learning_setup(void)
+{
+	/* Portmask for flooding broadcast traffic */
+	rtl839x_set_port_reg_be(0x1FFFFFFFFFFFFFF, RTL931X_L2_BC_FLD_PMSK);
+
+	/* Portmask for flooding unicast traffic with unknown destination */
+	rtl839x_set_port_reg_be(0x1FFFFFFFFFFFFFF, RTL931X_L2_UNKN_UC_FLD_PMSK);
+
+	/* Limit learning to maximum: 64k entries, after that just flood (bits 0-2) */
+	sw_w32((0xffff << 3) | FORWARD, RTL931X_L2_LRN_CONSTRT_CTRL);
+}
+
+static u64 rtl931x_read_mcast_pmask(int idx)
+{
+	u64 portmask;
+	/* Read MC_PMSK (2) via register RTL9310_TBL_0 */
+	struct table_reg *q = rtl_table_get(RTL9310_TBL_0, 2);
+
+	rtl_table_read(q, idx);
+	portmask = sw_r32(rtl_table_data(q, 0));
+	portmask <<= 32;
+	portmask |= sw_r32(rtl_table_data(q, 1));
+	portmask >>= 7;
+	rtl_table_release(q);
+
+	pr_debug("%s: Index idx %d has portmask %016llx\n", __func__, idx, portmask);
+
+	return portmask;
+}
+
+static void rtl931x_write_mcast_pmask(int idx, u64 portmask)
+{
+	u64 pm = portmask;
+
+	/* Access MC_PMSK (2) via register RTL9310_TBL_0 */
+	struct table_reg *q = rtl_table_get(RTL9310_TBL_0, 2);
+
+	pr_debug("%s: Index idx %d has portmask %016llx\n", __func__, idx, pm);
+	pm <<= 7;
+	sw_w32((u32)(pm >> 32), rtl_table_data(q, 0));
+	sw_w32((u32)pm, rtl_table_data(q, 1));
+	rtl_table_write(q, idx);
+	rtl_table_release(q);
+}
+
+
+static int rtl931x_set_ageing_time(unsigned long msec)
+{
+	int t = sw_r32(RTL931X_L2_AGE_CTRL);
+
+	t &= 0x1FFFFF;
+	t = (t * 8) / 10;
+	pr_debug("L2 AGING time: %d sec\n", t);
+
+	t = (msec / 100 + 7) / 8;
+	t = t > 0x1FFFFF ? 0x1FFFFF : t;
+	sw_w32_mask(0x1FFFFF, t, RTL931X_L2_AGE_CTRL);
+	pr_debug("Dynamic aging for ports: %x\n", sw_r32(RTL931X_L2_PORT_AGE_CTRL));
+
+	return 0;
+}
+void rtl931x_sw_init(struct rtl838x_switch_priv *priv)
+{
+/*	rtl931x_sds_init(priv); */
+}
+
+static void rtl931x_pie_lookup_enable(struct rtl838x_switch_priv *priv, int index)
+{
+	int block = index / PIE_BLOCK_SIZE;
+
+	sw_w32_mask(0, BIT(block), RTL931X_PIE_BLK_LOOKUP_CTRL);
+}
+
+/* Fills the data in the intermediate representation in the pie_rule structure
+ * into a data field for a given template field field_type
+ * TODO: This function looks very similar to the function of the rtl9300, but
+ * since it uses the physical template_field_id, which are different for each
+ * SoC and there are other field types, it is actually not. If we would also use
+ * an intermediate representation for a field type, we would could have one
+ * pie_data_fill function for all SoCs, provided we have also for each SoC a
+ * function to map between physical and intermediate field type
+ */
+int rtl931x_pie_data_fill(enum template_field_id field_type, struct pie_rule *pr, u16 *data, u16 *data_m)
+{
+	*data = *data_m = 0;
+
+	switch (field_type) {
+	case TEMPLATE_FIELD_SPM0:
+		*data = pr->spm;
+		*data_m = pr->spm_m;
+		break;
+	case TEMPLATE_FIELD_SPM1:
+		*data = pr->spm >> 16;
+		*data_m = pr->spm_m >> 16;
+		break;
+	case TEMPLATE_FIELD_OTAG:
+		*data = pr->otag;
+		*data_m = pr->otag_m;
+		break;
+	case TEMPLATE_FIELD_SMAC0:
+		*data = pr->smac[4];
+		*data = (*data << 8) | pr->smac[5];
+		*data_m = pr->smac_m[4];
+		*data_m = (*data_m << 8) | pr->smac_m[5];
+		break;
+	case TEMPLATE_FIELD_SMAC1:
+		*data = pr->smac[2];
+		*data = (*data << 8) | pr->smac[3];
+		*data_m = pr->smac_m[2];
+		*data_m = (*data_m << 8) | pr->smac_m[3];
+		break;
+	case TEMPLATE_FIELD_SMAC2:
+		*data = pr->smac[0];
+		*data = (*data << 8) | pr->smac[1];
+		*data_m = pr->smac_m[0];
+		*data_m = (*data_m << 8) | pr->smac_m[1];
+		break;
+	case TEMPLATE_FIELD_DMAC0:
+		*data = pr->dmac[4];
+		*data = (*data << 8) | pr->dmac[5];
+		*data_m = pr->dmac_m[4];
+		*data_m = (*data_m << 8) | pr->dmac_m[5];
+		break;
+	case TEMPLATE_FIELD_DMAC1:
+		*data = pr->dmac[2];
+		*data = (*data << 8) | pr->dmac[3];
+		*data_m = pr->dmac_m[2];
+		*data_m = (*data_m << 8) | pr->dmac_m[3];
+		break;
+	case TEMPLATE_FIELD_DMAC2:
+		*data = pr->dmac[0];
+		*data = (*data << 8) | pr->dmac[1];
+		*data_m = pr->dmac_m[0];
+		*data_m = (*data_m << 8) | pr->dmac_m[1];
+		break;
+	case TEMPLATE_FIELD_ETHERTYPE:
+		*data = pr->ethertype;
+		*data_m = pr->ethertype_m;
+		break;
+	case TEMPLATE_FIELD_ITAG:
+		*data = pr->itag;
+		*data_m = pr->itag_m;
+		break;
+	case TEMPLATE_FIELD_SIP0:
+		if (pr->is_ipv6) {
+			*data = pr->sip6.s6_addr16[7];
+			*data_m = pr->sip6_m.s6_addr16[7];
+		} else {
+			*data = pr->sip;
+			*data_m = pr->sip_m;
+		}
+		break;
+	case TEMPLATE_FIELD_SIP1:
+		if (pr->is_ipv6) {
+			*data = pr->sip6.s6_addr16[6];
+			*data_m = pr->sip6_m.s6_addr16[6];
+		} else {
+			*data = pr->sip >> 16;
+			*data_m = pr->sip_m >> 16;
+		}
+		break;
+	case TEMPLATE_FIELD_SIP2:
+	case TEMPLATE_FIELD_SIP3:
+	case TEMPLATE_FIELD_SIP4:
+	case TEMPLATE_FIELD_SIP5:
+	case TEMPLATE_FIELD_SIP6:
+	case TEMPLATE_FIELD_SIP7:
+		*data = pr->sip6.s6_addr16[5 - (field_type - TEMPLATE_FIELD_SIP2)];
+		*data_m = pr->sip6_m.s6_addr16[5 - (field_type - TEMPLATE_FIELD_SIP2)];
+		break;
+	case TEMPLATE_FIELD_DIP0:
+		if (pr->is_ipv6) {
+			*data = pr->dip6.s6_addr16[7];
+			*data_m = pr->dip6_m.s6_addr16[7];
+		} else {
+			*data = pr->dip;
+			*data_m = pr->dip_m;
+		}
+		break;
+		case TEMPLATE_FIELD_DIP1:
+		if (pr->is_ipv6) {
+			*data = pr->dip6.s6_addr16[6];
+			*data_m = pr->dip6_m.s6_addr16[6];
+		} else {
+			*data = pr->dip >> 16;
+			*data_m = pr->dip_m >> 16;
+		}
+		break;
+	case TEMPLATE_FIELD_DIP2:
+	case TEMPLATE_FIELD_DIP3:
+	case TEMPLATE_FIELD_DIP4:
+	case TEMPLATE_FIELD_DIP5:
+	case TEMPLATE_FIELD_DIP6:
+	case TEMPLATE_FIELD_DIP7:
+		*data = pr->dip6.s6_addr16[5 - (field_type - TEMPLATE_FIELD_DIP2)];
+		*data_m = pr->dip6_m.s6_addr16[5 - (field_type - TEMPLATE_FIELD_DIP2)];
+		break;
+	case TEMPLATE_FIELD_IP_TOS_PROTO:
+		*data = pr->tos_proto;
+		*data_m = pr->tos_proto_m;
+		break;
+	case TEMPLATE_FIELD_L4_SPORT:
+		*data = pr->sport;
+		*data_m = pr->sport_m;
+		break;
+	case TEMPLATE_FIELD_L4_DPORT:
+		*data = pr->dport;
+		*data_m = pr->dport_m;
+		break;
+	case TEMPLATE_FIELD_DSAP_SSAP:
+		*data = pr->dsap_ssap;
+		*data_m = pr->dsap_ssap_m;
+		break;
+	case TEMPLATE_FIELD_TCP_INFO:
+		*data = pr->tcp_info;
+		*data_m = pr->tcp_info_m;
+		break;
+	case TEMPLATE_FIELD_RANGE_CHK:
+		pr_info("TEMPLATE_FIELD_RANGE_CHK: not configured\n");
+		break;
+	default:
+		pr_info("%s: unknown field %d\n", __func__, field_type);
+		return -1;
+	}
+
+	return 0;
+}
+
+/* Reads the intermediate representation of the templated match-fields of the
+ * PIE rule in the pie_rule structure and fills in the raw data fields in the
+ * raw register space r[].
+ * The register space configuration size is identical for the RTL8380/90 and RTL9300,
+ * however the RTL931X has 2 more registers / fields and the physical field-ids are different
+ * on all SoCs
+ * On the RTL9300 the mask fields are not word-aligend!
+ */
+static void rtl931x_write_pie_templated(u32 r[], struct pie_rule *pr, enum template_field_id t[])
+{
+	for (int i = 0; i < N_FIXED_FIELDS; i++) {
+		u16 data, data_m;
+
+		rtl931x_pie_data_fill(t[i], pr, &data, &data_m);
+
+		/* On the RTL9300, the mask fields are not word aligned! */
+		if (!(i % 2)) {
+			r[5 - i / 2] = data;
+			r[12 - i / 2] |= ((u32)data_m << 8);
+		} else {
+			r[5 - i / 2] |= ((u32)data) << 16;
+			r[12 - i / 2] |= ((u32)data_m) << 24;
+			r[11 - i / 2] |= ((u32)data_m) >> 8;
+		}
+	}
+}
+
+// Currently unused
+// static void rtl931x_read_pie_fixed_fields(u32 r[], struct pie_rule *pr)
+// {
+// 	pr->mgnt_vlan = r[7] & BIT(31);
+// 	if (pr->phase == PHASE_IACL)
+// 		pr->dmac_hit_sw = r[7] & BIT(30);
+// 	else  /* TODO: EACL/VACL phase handling */
+// 		pr->content_too_deep = r[7] & BIT(30);
+// 	pr->not_first_frag = r[7]  & BIT(29);
+// 	pr->frame_type_l4 = (r[7] >> 26) & 7;
+// 	pr->frame_type = (r[7] >> 24) & 3;
+// 	pr->otag_fmt = (r[7] >> 23) & 1;
+// 	pr->itag_fmt = (r[7] >> 22) & 1;
+// 	pr->otag_exist = (r[7] >> 21) & 1;
+// 	pr->itag_exist = (r[7] >> 20) & 1;
+// 	pr->frame_type_l2 = (r[7] >> 18) & 3;
+// 	pr->igr_normal_port = (r[7] >> 17) & 1;
+// 	pr->tid = (r[7] >> 16) & 1;
+
+// 	pr->mgnt_vlan_m = r[14] & BIT(15);
+// 	if (pr->phase == PHASE_IACL)
+// 		pr->dmac_hit_sw_m = r[14] & BIT(14);
+// 	else
+// 		pr->content_too_deep_m = r[14] & BIT(14);
+// 	pr->not_first_frag_m = r[14] & BIT(13);
+// 	pr->frame_type_l4_m = (r[14] >> 10) & 7;
+// 	pr->frame_type_m = (r[14] >> 8) & 3;
+// 	pr->otag_fmt_m = r[14] & BIT(7);
+// 	pr->itag_fmt_m = r[14] & BIT(6);
+// 	pr->otag_exist_m = r[14] & BIT(5);
+// 	pr->itag_exist_m = r[14] & BIT (4);
+// 	pr->frame_type_l2_m = (r[14] >> 2) & 3;
+// 	pr->igr_normal_port_m = r[14] & BIT(1);
+// 	pr->tid_m = r[14] & 1;
+
+// 	pr->valid = r[15] & BIT(31);
+// 	pr->cond_not = r[15] & BIT(30);
+// 	pr->cond_and1 = r[15] & BIT(29);
+// 	pr->cond_and2 = r[15] & BIT(28);
+// }
+
+static void rtl931x_write_pie_fixed_fields(u32 r[],  struct pie_rule *pr)
+{
+	r[7] |= pr->mgnt_vlan ? BIT(31) : 0;
+	if (pr->phase == PHASE_IACL)
+		r[7] |= pr->dmac_hit_sw ? BIT(30) : 0;
+	else
+		r[7] |= pr->content_too_deep ? BIT(30) : 0;
+	r[7] |= pr->not_first_frag ? BIT(29) : 0;
+	r[7] |= ((u32) (pr->frame_type_l4 & 0x7)) << 26;
+	r[7] |= ((u32) (pr->frame_type & 0x3)) << 24;
+	r[7] |= pr->otag_fmt ? BIT(23) : 0;
+	r[7] |= pr->itag_fmt ? BIT(22) : 0;
+	r[7] |= pr->otag_exist ? BIT(21) : 0;
+	r[7] |= pr->itag_exist ? BIT(20) : 0;
+	r[7] |= ((u32) (pr->frame_type_l2 & 0x3)) << 18;
+	r[7] |= pr->igr_normal_port ? BIT(17) : 0;
+	r[7] |= ((u32) (pr->tid & 0x1)) << 16;
+
+	r[14] |= pr->mgnt_vlan_m ? BIT(15) : 0;
+	if (pr->phase == PHASE_IACL)
+		r[14] |= pr->dmac_hit_sw_m ? BIT(14) : 0;
+	else
+		r[14] |= pr->content_too_deep_m ? BIT(14) : 0;
+	r[14] |= pr->not_first_frag_m ? BIT(13) : 0;
+	r[14] |= ((u32) (pr->frame_type_l4_m & 0x7)) << 10;
+	r[14] |= ((u32) (pr->frame_type_m & 0x3)) << 8;
+	r[14] |= pr->otag_fmt_m ? BIT(7) : 0;
+	r[14] |= pr->itag_fmt_m ? BIT(6) : 0;
+	r[14] |= pr->otag_exist_m ? BIT(5) : 0;
+	r[14] |= pr->itag_exist_m ? BIT(4) : 0;
+	r[14] |= ((u32) (pr->frame_type_l2_m & 0x3)) << 2;
+	r[14] |= pr->igr_normal_port_m ? BIT(1) : 0;
+	r[14] |= (u32) (pr->tid_m & 0x1);
+
+	r[15] |= pr->valid ? BIT(31) : 0;
+	r[15] |= pr->cond_not ? BIT(30) : 0;
+	r[15] |= pr->cond_and1 ? BIT(29) : 0;
+	r[15] |= pr->cond_and2 ? BIT(28) : 0;
+}
+
+static void rtl931x_write_pie_action(u32 r[],  struct pie_rule *pr)
+{
+	/* Either drop or forward */
+	if (pr->drop) {
+		r[15] |= BIT(11) | BIT(12) | BIT(13); /* Do Green, Yellow and Red drops */
+		/* Actually DROP, not PERMIT in Green / Yellow / Red */
+		r[16] |= BIT(27) | BIT(28) | BIT(29);
+	} else {
+		r[15] |= pr->fwd_sel ? BIT(14) : 0;
+		r[16] |= pr->fwd_act << 24;
+		r[16] |= BIT(21); /* We overwrite any drop */
+	}
+	if (pr->phase == PHASE_VACL)
+		r[16] |= pr->fwd_sa_lrn ? BIT(22) : 0;
+	r[15] |= pr->bypass_sel ? BIT(10) : 0;
+	r[15] |= pr->nopri_sel ? BIT(21) : 0;
+	r[15] |= pr->tagst_sel ? BIT(20) : 0;
+	r[15] |= pr->ovid_sel ? BIT(18) : 0;
+	r[15] |= pr->ivid_sel ? BIT(16) : 0;
+	r[15] |= pr->meter_sel ? BIT(27) : 0;
+	r[15] |= pr->mir_sel ? BIT(15) : 0;
+	r[15] |= pr->log_sel ? BIT(26) : 0;
+
+	r[16] |= ((u32)(pr->fwd_data & 0xfff)) << 9;
+/*	r[15] |= pr->log_octets ? BIT(31) : 0; */
+	r[15] |= (u32)(pr->meter_data) >> 2;
+	r[16] |= (((u32)(pr->meter_data) >> 7) & 0x3) << 29;
+
+	r[16] |= ((u32)(pr->ivid_act & 0x3)) << 21;
+	r[15] |= ((u32)(pr->ivid_data & 0xfff)) << 9;
+	r[16] |= ((u32)(pr->ovid_act & 0x3)) << 30;
+	r[16] |= ((u32)(pr->ovid_data & 0xfff)) << 16;
+	r[16] |= ((u32)(pr->mir_data & 0x3)) << 6;
+	r[17] |= ((u32)(pr->tagst_data & 0xf)) << 28;
+	r[17] |= ((u32)(pr->nopri_data & 0x7)) << 25;
+	r[17] |= pr->bypass_ibc_sc ? BIT(16) : 0;
+}
+
+void rtl931x_pie_rule_dump_raw(u32 r[])
+{
+	pr_info("Raw IACL table entry:\n");
+	pr_info("r 0 - 7: %08x %08x %08x %08x %08x %08x %08x %08x\n",
+		r[0], r[1], r[2], r[3], r[4], r[5], r[6], r[7]);
+	pr_info("r 8 - 15: %08x %08x %08x %08x %08x %08x %08x %08x\n",
+		r[8], r[9], r[10], r[11], r[12], r[13], r[14], r[15]);
+	pr_info("r 16 - 18: %08x %08x %08x\n", r[16], r[17], r[18]);
+	pr_info("Match  : %08x %08x %08x %08x %08x %08x\n", r[0], r[1], r[2], r[3], r[4], r[5]);
+	pr_info("Fixed  : %06x\n", r[6] >> 8);
+	pr_info("Match M: %08x %08x %08x %08x %08x %08x\n",
+		(r[6] << 24) | (r[7] >> 8), (r[7] << 24) | (r[8] >> 8), (r[8] << 24) | (r[9] >> 8),
+		(r[9] << 24) | (r[10] >> 8), (r[10] << 24) | (r[11] >> 8),
+		(r[11] << 24) | (r[12] >> 8));
+	pr_info("R[13]:   %08x\n", r[13]);
+	pr_info("Fixed M: %06x\n", ((r[12] << 16) | (r[13] >> 16)) & 0xffffff);
+	pr_info("Valid / not / and1 / and2 : %1x\n", (r[13] >> 12) & 0xf);
+	pr_info("r 13-16: %08x %08x %08x %08x\n", r[13], r[14], r[15], r[16]);
+}
+
+static int rtl931x_pie_rule_write(struct rtl838x_switch_priv *priv, int idx, struct pie_rule *pr)
+{
+	/* Access IACL table (0) via register 1, the table size is 4096 */
+	struct table_reg *q = rtl_table_get(RTL9310_TBL_1, 0);
+	u32 r[22];
+	int block = idx / PIE_BLOCK_SIZE;
+	u32 t_select = sw_r32(RTL931X_PIE_BLK_TMPLTE_CTRL(block));
+
+	pr_info("%s: %d, t_select: %08x\n", __func__, idx, t_select);
+
+	for (int i = 0; i < 22; i++)
+		r[i] = 0;
+
+	if (!pr->valid) {
+		rtl_table_write(q, idx);
+		rtl_table_release(q);
+		return 0;
+	}
+	rtl931x_write_pie_fixed_fields(r, pr);
+
+	pr_info("%s: template %d\n", __func__, (t_select >> (pr->tid * 4)) & 0xf);
+	rtl931x_write_pie_templated(r, pr, fixed_templates[(t_select >> (pr->tid * 4)) & 0xf]);
+
+	rtl931x_write_pie_action(r, pr);
+
+	rtl931x_pie_rule_dump_raw(r);
+
+	for (int i = 0; i < 22; i++)
+		sw_w32(r[i], rtl_table_data(q, i));
+
+	rtl_table_write(q, idx);
+	rtl_table_release(q);
+
+	return 0;
+}
+
+static bool rtl931x_pie_templ_has(int t, enum template_field_id field_type)
+{
+	for (int i = 0; i < N_FIXED_FIELDS_RTL931X; i++) {
+		enum template_field_id ft = fixed_templates[t][i];
+		if (field_type == ft)
+			return true;
+	}
+
+	return false;
+}
+
+/* Verify that the rule pr is compatible with a given template t in block block
+ * Note that this function is SoC specific since the values of e.g. TEMPLATE_FIELD_SIP0
+ * depend on the SoC
+ */
+static int rtl931x_pie_verify_template(struct rtl838x_switch_priv *priv,
+				       struct pie_rule *pr, int t, int block)
+{
+	int i;
+
+	if (!pr->is_ipv6 && pr->sip_m && !rtl931x_pie_templ_has(t, TEMPLATE_FIELD_SIP0))
+		return -1;
+
+	if (!pr->is_ipv6 && pr->dip_m && !rtl931x_pie_templ_has(t, TEMPLATE_FIELD_DIP0))
+		return -1;
+
+	if (pr->is_ipv6) {
+		if ((pr->sip6_m.s6_addr32[0] ||
+		     pr->sip6_m.s6_addr32[1] ||
+		     pr->sip6_m.s6_addr32[2] ||
+		     pr->sip6_m.s6_addr32[3]) &&
+		    !rtl931x_pie_templ_has(t, TEMPLATE_FIELD_SIP2))
+			return -1;
+		if ((pr->dip6_m.s6_addr32[0] ||
+		     pr->dip6_m.s6_addr32[1] ||
+		     pr->dip6_m.s6_addr32[2] ||
+		     pr->dip6_m.s6_addr32[3]) &&
+		    !rtl931x_pie_templ_has(t, TEMPLATE_FIELD_DIP2))
+			return -1;
+	}
+
+	if (ether_addr_to_u64(pr->smac) && !rtl931x_pie_templ_has(t, TEMPLATE_FIELD_SMAC0))
+		return -1;
+
+	if (ether_addr_to_u64(pr->dmac) && !rtl931x_pie_templ_has(t, TEMPLATE_FIELD_DMAC0))
+		return -1;
+
+	/* TODO: Check more */
+
+	i = find_first_zero_bit(&priv->pie_use_bm[block * 4], PIE_BLOCK_SIZE);
+
+	if (i >= PIE_BLOCK_SIZE)
+		return -1;
+
+	return i + PIE_BLOCK_SIZE * block;
+}
+
+static int rtl931x_pie_rule_add(struct rtl838x_switch_priv *priv, struct pie_rule *pr)
+{
+	int idx, block, j;
+	int min_block = 0;
+	int max_block = priv->n_pie_blocks / 2;
+
+	if (pr->is_egress) {
+		min_block = max_block;
+		max_block = priv->n_pie_blocks;
+	}
+	pr_info("In %s\n", __func__);
+
+	mutex_lock(&priv->pie_mutex);
+
+	for (block = min_block; block < max_block; block++) {
+		for (j = 0; j < 2; j++) {
+			int t = (sw_r32(RTL931X_PIE_BLK_TMPLTE_CTRL(block)) >> (j * 4)) & 0xf;
+			pr_info("Testing block %d, template %d, template id %d\n", block, j, t);
+			pr_info("%s: %08x\n",
+				__func__, sw_r32(RTL931X_PIE_BLK_TMPLTE_CTRL(block)));
+			idx = rtl931x_pie_verify_template(priv, pr, t, block);
+			if (idx >= 0)
+				break;
+		}
+		if (j < 2)
+			break;
+	}
+
+	if (block >= priv->n_pie_blocks) {
+		mutex_unlock(&priv->pie_mutex);
+		return -EOPNOTSUPP;
+	}
+
+	pr_info("Using block: %d, index %d, template-id %d\n", block, idx, j);
+	set_bit(idx, priv->pie_use_bm);
+
+	pr->valid = true;
+	pr->tid = j;  /* Mapped to template number */
+	pr->tid_m = 0x1;
+	pr->id = idx;
+
+	rtl931x_pie_lookup_enable(priv, idx);
+	rtl931x_pie_rule_write(priv, idx, pr);
+
+	mutex_unlock(&priv->pie_mutex);
+
+	return 0;
+}
+
+/* Delete a range of Packet Inspection Engine rules */
+static int rtl931x_pie_rule_del(struct rtl838x_switch_priv *priv, int index_from, int index_to)
+{
+	u32 v = (index_from << 1)| (index_to << 13 ) | BIT(0);
+
+	pr_info("%s: from %d to %d\n", __func__, index_from, index_to);
+	mutex_lock(&priv->reg_mutex);
+
+	/* Write from-to and execute bit into control register */
+	sw_w32(v, RTL931X_PIE_CLR_CTRL);
+
+	/* Wait until command has completed */
+	do {
+	} while (sw_r32(RTL931X_PIE_CLR_CTRL) & BIT(0));
+
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+static void rtl931x_pie_rule_rm(struct rtl838x_switch_priv *priv, struct pie_rule *pr)
+{
+	int idx = pr->id;
+
+	rtl931x_pie_rule_del(priv, idx, idx);
+	clear_bit(idx, priv->pie_use_bm);
+}
+
+static void rtl931x_pie_init(struct rtl838x_switch_priv *priv)
+{
+	u32 template_selectors;
+
+	mutex_init(&priv->pie_mutex);
+
+	pr_info("%s\n", __func__);
+	/* Enable ACL lookup on all ports, including CPU_PORT */
+	for (int i = 0; i <= priv->cpu_port; i++)
+		sw_w32(1, RTL931X_ACL_PORT_LOOKUP_CTRL(i));
+
+	/* Include IPG in metering */
+	sw_w32_mask(0, 1, RTL931X_METER_GLB_CTRL);
+
+	/* Delete all present rules, block size is 128 on all SoC families */
+	rtl931x_pie_rule_del(priv, 0, priv->n_pie_blocks * 128 - 1);
+
+	/* Assign first half blocks 0-7 to VACL phase, second half to IACL */
+	/* 3 bits are used for each block, values for PIE blocks are */
+	/* 6: Disabled, 0: VACL, 1: IACL, 2: EACL */
+	/* And for OpenFlow Flow blocks: 3: Ingress Flow table 0, */
+	/* 4: Ingress Flow Table 3, 5: Egress flow table 0 */
+	for (int i = 0; i < priv->n_pie_blocks; i++) {
+		int pos = (i % 10) * 3;
+		u32 r = RTL931X_PIE_BLK_PHASE_CTRL + 4 * (i / 10);
+
+		if (i < priv->n_pie_blocks / 2)
+			sw_w32_mask(0x7 << pos, 0, r);
+		else
+			sw_w32_mask(0x7 << pos, 1 << pos, r);
+	}
+
+	/* Enable predefined templates 0, 1 for first quarter of all blocks */
+	template_selectors = 0 | (1 << 4);
+	for (int i = 0; i < priv->n_pie_blocks / 4; i++)
+		sw_w32(template_selectors, RTL931X_PIE_BLK_TMPLTE_CTRL(i));
+
+	/* Enable predefined templates 2, 3 for second quarter of all blocks */
+	template_selectors = 2 | (3 << 4);
+	for (int i = priv->n_pie_blocks / 4; i < priv->n_pie_blocks / 2; i++)
+		sw_w32(template_selectors, RTL931X_PIE_BLK_TMPLTE_CTRL(i));
+
+	/* Enable predefined templates 0, 1 for third quater of all blocks */
+	template_selectors = 0 | (1 << 4);
+	for (int i = priv->n_pie_blocks / 2; i < priv->n_pie_blocks * 3 / 4; i++)
+		sw_w32(template_selectors, RTL931X_PIE_BLK_TMPLTE_CTRL(i));
+
+	/* Enable predefined templates 2, 3 for fourth quater of all blocks */
+	template_selectors = 2 | (3 << 4);
+	for (int i = priv->n_pie_blocks * 3 / 4; i < priv->n_pie_blocks; i++)
+		sw_w32(template_selectors, RTL931X_PIE_BLK_TMPLTE_CTRL(i));
+
+}
+
+int rtl931x_l3_setup(struct rtl838x_switch_priv *priv)
+{
+	return 0;
+}
+
+void rtl931x_vlan_port_keep_tag_set(int port, bool keep_outer, bool keep_inner)
+{
+	sw_w32(FIELD_PREP(RTL931X_VLAN_PORT_TAG_EGR_OTAG_STS_MASK,
+			  keep_outer ? RTL931X_VLAN_PORT_TAG_STS_TAGGED : RTL931X_VLAN_PORT_TAG_STS_UNTAG) |
+	       FIELD_PREP(RTL931X_VLAN_PORT_TAG_EGR_ITAG_STS_MASK,
+			  keep_inner ? RTL931X_VLAN_PORT_TAG_STS_TAGGED : RTL931X_VLAN_PORT_TAG_STS_UNTAG),
+	       RTL931X_VLAN_PORT_TAG_CTRL(port));
+}
+
+void rtl931x_vlan_port_pvidmode_set(int port, enum pbvlan_type type, enum pbvlan_mode mode)
+{
+	if (type == PBVLAN_TYPE_INNER)
+		sw_w32_mask(0x3 << 12, mode << 12, RTL931X_VLAN_PORT_IGR_CTRL + (port << 2));
+	else
+		sw_w32_mask(0x3 << 26, mode << 26, RTL931X_VLAN_PORT_IGR_CTRL + (port << 2));
+}
+
+void rtl931x_vlan_port_pvid_set(int port, enum pbvlan_type type, int pvid)
+{
+	if (type == PBVLAN_TYPE_INNER)
+		sw_w32_mask(0xfff, pvid, RTL931X_VLAN_PORT_IGR_CTRL + (port << 2));
+	else
+		sw_w32_mask(0xfff << 14, pvid << 14, RTL931X_VLAN_PORT_IGR_CTRL + (port << 2));
+}
+
+static void rtl931x_set_igr_filter(int port, enum igr_filter state)
+{
+	sw_w32_mask(0x3 << ((port & 0xf)<<1), state << ((port & 0xf)<<1),
+		    RTL931X_VLAN_PORT_IGR_FLTR + (((port >> 4) << 2)));
+}
+
+static void rtl931x_set_egr_filter(int port,  enum egr_filter state)
+{
+	sw_w32_mask(0x1 << (port % 0x20), state << (port % 0x20),
+		    RTL931X_VLAN_PORT_EGR_FLTR + (((port >> 5) << 2)));
+}
+
+void rtl931x_set_distribution_algorithm(int group, int algoidx, u32 algomsk)
+{
+	u32 l3shift = 0;
+	u32 newmask = 0;
+
+	/* TODO: for now we set algoidx to 0 */
+	algoidx = 0;
+
+	if (algomsk & TRUNK_DISTRIBUTION_ALGO_SIP_BIT) {
+		l3shift = 4;
+		newmask |= TRUNK_DISTRIBUTION_ALGO_L3_SIP_BIT;
+	}
+	if (algomsk & TRUNK_DISTRIBUTION_ALGO_DIP_BIT) {
+		l3shift = 4;
+		newmask |= TRUNK_DISTRIBUTION_ALGO_L3_DIP_BIT;
+	}
+	if (algomsk & TRUNK_DISTRIBUTION_ALGO_SRC_L4PORT_BIT) {
+		l3shift = 4;
+		newmask |= TRUNK_DISTRIBUTION_ALGO_L3_SRC_L4PORT_BIT;
+	}
+	if (algomsk & TRUNK_DISTRIBUTION_ALGO_SRC_L4PORT_BIT) {
+		l3shift = 4;
+		newmask |= TRUNK_DISTRIBUTION_ALGO_L3_SRC_L4PORT_BIT;
+	}
+
+	if (l3shift == 4) {
+		if (algomsk & TRUNK_DISTRIBUTION_ALGO_SMAC_BIT)
+			newmask |= TRUNK_DISTRIBUTION_ALGO_L3_SMAC_BIT;
+		if (algomsk & TRUNK_DISTRIBUTION_ALGO_DMAC_BIT)
+			newmask |= TRUNK_DISTRIBUTION_ALGO_L3_DMAC_BIT;
+	} else {
+		if (algomsk & TRUNK_DISTRIBUTION_ALGO_SMAC_BIT)
+			newmask |= TRUNK_DISTRIBUTION_ALGO_L2_SMAC_BIT;
+		if (algomsk & TRUNK_DISTRIBUTION_ALGO_DMAC_BIT)
+			newmask |= TRUNK_DISTRIBUTION_ALGO_L2_DMAC_BIT;
+	}
+
+	sw_w32(newmask << l3shift, RTL931X_TRK_HASH_CTRL + (algoidx << 2));
+}
+
+static void rtl931x_led_init(struct rtl838x_switch_priv *priv)
+{
+	u64 pm_copper = 0, pm_fiber = 0;
+	struct device_node *node;
+
+	pr_info("%s called\n", __func__);
+	node = of_find_compatible_node(NULL, NULL, "realtek,rtl9300-leds");
+	if (!node) {
+		pr_info("%s No compatible LED node found\n", __func__);
+		return;
+	}
+
+	for (int i = 0; i < priv->cpu_port; i++) {
+		int pos = (i << 1) % 32;
+		u32 set;
+		u32 v;
+
+		sw_w32_mask(0x3 << pos, 0, RTL931X_LED_PORT_FIB_SET_SEL_CTRL(i));
+		sw_w32_mask(0x3 << pos, 0, RTL931X_LED_PORT_COPR_SET_SEL_CTRL(i));
+
+		if (!priv->ports[i].phy)
+			continue;
+
+		v = 0x1; /* Found on the EdgeCore, but we do not have any HW description */
+		sw_w32_mask(0x3 << pos, v << pos, RTL931X_LED_PORT_NUM_CTRL(i));
+
+		if (priv->ports[i].phy_is_integrated)
+		pm_fiber |= BIT_ULL(i);
+			else
+		pm_copper |= BIT_ULL(i);
+
+		set = priv->ports[i].led_set;
+		sw_w32_mask(0, set << pos, RTL931X_LED_PORT_COPR_SET_SEL_CTRL(i));
+		sw_w32_mask(0, set << pos, RTL931X_LED_PORT_FIB_SET_SEL_CTRL(i));
+	}
+
+	for (int i = 0; i < 4; i++) {
+		const __be32 *led_set;
+		char set_name[9];
+		u32 setlen;
+		u32 v;
+
+		sprintf(set_name, "led_set%d", i);
+		pr_info(">%s<\n", set_name);
+		led_set = of_get_property(node, set_name, &setlen);
+		if (!led_set || setlen != 16)
+			break;
+		v = be32_to_cpup(led_set) << 16 | be32_to_cpup(led_set + 1);
+		sw_w32(v, RTL931X_LED_SET0_0_CTRL - 4 - i * 8);
+		v = be32_to_cpup(led_set + 2) << 16 | be32_to_cpup(led_set + 3);
+		sw_w32(v, RTL931X_LED_SET0_0_CTRL - i * 8);
+	}
+
+	/* Set LED mode to serial (0x1) */
+	sw_w32_mask(0x3, 0x1, RTL931X_LED_GLB_CTRL);
+
+	rtl839x_set_port_reg_le(pm_copper, RTL931X_LED_PORT_COPR_MASK_CTRL);
+	rtl839x_set_port_reg_le(pm_fiber, RTL931X_LED_PORT_FIB_MASK_CTRL);
+	rtl839x_set_port_reg_le(pm_copper | pm_fiber, RTL931X_LED_PORT_COMBO_MASK_CTRL);
+
+	for (int i = 0; i < 32; i++)
+		pr_info("%s %08x: %08x\n",__func__, 0xbb000600 + i * 4, sw_r32(0x0600 + i * 4));
+}
+
+const struct rtl838x_reg rtl931x_reg = {
+	.mask_port_reg_be = rtl839x_mask_port_reg_be,
+	.set_port_reg_be = rtl839x_set_port_reg_be,
+	.get_port_reg_be = rtl839x_get_port_reg_be,
+	.mask_port_reg_le = rtl839x_mask_port_reg_le,
+	.set_port_reg_le = rtl839x_set_port_reg_le,
+	.get_port_reg_le = rtl839x_get_port_reg_le,
+	.stat_port_rst = RTL931X_STAT_PORT_RST,
+	.stat_rst = RTL931X_STAT_RST,
+	.stat_port_std_mib = 0,  /* Not defined */
+	.traffic_enable = rtl931x_traffic_enable,
+	.traffic_disable = rtl931x_traffic_disable,
+	.traffic_get = rtl931x_traffic_get,
+	.traffic_set = rtl931x_traffic_set,
+	.l2_ctrl_0 = RTL931X_L2_CTRL,
+	.l2_ctrl_1 = RTL931X_L2_AGE_CTRL,
+	.l2_port_aging_out = RTL931X_L2_PORT_AGE_CTRL,
+	.set_ageing_time = rtl931x_set_ageing_time,
+	/* .smi_poll_ctrl does not exist */
+	.l2_tbl_flush_ctrl = RTL931X_L2_TBL_FLUSH_CTRL,
+	.exec_tbl0_cmd = rtl931x_exec_tbl0_cmd,
+	.exec_tbl1_cmd = rtl931x_exec_tbl1_cmd,
+	.tbl_access_data_0 = rtl931x_tbl_access_data_0,
+	.isr_glb_src = RTL931X_ISR_GLB_SRC,
+	.isr_port_link_sts_chg = RTL931X_ISR_PORT_LINK_STS_CHG,
+	.imr_port_link_sts_chg = RTL931X_IMR_PORT_LINK_STS_CHG,
+	/* imr_glb does not exist on RTL931X */
+	.vlan_tables_read = rtl931x_vlan_tables_read,
+	.vlan_set_tagged = rtl931x_vlan_set_tagged,
+	.vlan_set_untagged = rtl931x_vlan_set_untagged,
+	.vlan_profile_dump = rtl931x_vlan_profile_dump,
+	.vlan_profile_setup = rtl931x_vlan_profile_setup,
+	.vlan_fwd_on_inner = rtl931x_vlan_fwd_on_inner,
+	.stp_get = rtl931x_stp_get,
+	.stp_set = rtl931x_stp_set,
+	.mac_force_mode_ctrl = rtl931x_mac_force_mode_ctrl,
+	.mac_port_ctrl = rtl931x_mac_port_ctrl,
+	.l2_port_new_salrn = rtl931x_l2_port_new_salrn,
+	.l2_port_new_sa_fwd = rtl931x_l2_port_new_sa_fwd,
+	.mir_ctrl = RTL931X_MIR_CTRL,
+	.mir_dpm = RTL931X_MIR_DPM_CTRL,
+	.mir_spm = RTL931X_MIR_SPM_CTRL,
+	.mac_link_sts = RTL931X_MAC_LINK_STS,
+	.mac_link_dup_sts = RTL931X_MAC_LINK_DUP_STS,
+	.mac_link_spd_sts = rtl931x_mac_link_spd_sts,
+	.mac_rx_pause_sts = RTL931X_MAC_RX_PAUSE_STS,
+	.mac_tx_pause_sts = RTL931X_MAC_TX_PAUSE_STS,
+	.read_l2_entry_using_hash = rtl931x_read_l2_entry_using_hash,
+	.write_l2_entry_using_hash = rtl931x_write_l2_entry_using_hash,
+	.read_cam = rtl931x_read_cam,
+	.write_cam = rtl931x_write_cam,
+	.vlan_port_keep_tag_set = rtl931x_vlan_port_keep_tag_set,
+	.vlan_port_pvidmode_set = rtl931x_vlan_port_pvidmode_set,
+	.vlan_port_pvid_set = rtl931x_vlan_port_pvid_set,
+	.trk_mbr_ctr = rtl931x_trk_mbr_ctr,
+	.set_vlan_igr_filter = rtl931x_set_igr_filter,
+	.set_vlan_egr_filter = rtl931x_set_egr_filter,
+	.set_distribution_algorithm = rtl931x_set_distribution_algorithm,
+	.l2_hash_key = rtl931x_l2_hash_key,
+	.read_mcast_pmask = rtl931x_read_mcast_pmask,
+	.write_mcast_pmask = rtl931x_write_mcast_pmask,
+	.pie_init = rtl931x_pie_init,
+	.pie_rule_write = rtl931x_pie_rule_write,
+	.pie_rule_add = rtl931x_pie_rule_add,
+	.pie_rule_rm = rtl931x_pie_rule_rm,
+	.l2_learning_setup = rtl931x_l2_learning_setup,
+	.l3_setup = rtl931x_l3_setup,
+	.led_init = rtl931x_led_init,
+};
diff --git a/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/tc.c b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/tc.c
new file mode 100644
index 00000000000000..3f7c31e04d38ea
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/tc.c
@@ -0,0 +1,410 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <net/dsa.h>
+#include <linux/delay.h>
+#include <linux/etherdevice.h>
+#include <linux/netdevice.h>
+#include <net/flow_offload.h>
+#include <linux/rhashtable.h>
+#include <asm/mach-rtl838x/mach-rtl83xx.h>
+
+#include "rtl83xx.h"
+#include "rtl838x.h"
+
+/* Parse the flow rule for the matching conditions */
+static int rtl83xx_parse_flow_rule(struct rtl838x_switch_priv *priv,
+			      struct flow_rule *rule, struct rtl83xx_flow *flow)
+{
+	struct flow_dissector *dissector = rule->match.dissector;
+
+	pr_debug("In %s\n", __func__);
+	/* KEY_CONTROL and KEY_BASIC are needed for forming a meaningful key */
+	if ((dissector->used_keys & BIT(FLOW_DISSECTOR_KEY_CONTROL)) == 0 ||
+	    (dissector->used_keys & BIT(FLOW_DISSECTOR_KEY_BASIC)) == 0) {
+		pr_err("Cannot form TC key: used_keys = 0x%x\n", dissector->used_keys);
+		return -EOPNOTSUPP;
+	}
+
+	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_BASIC)) {
+		struct flow_match_basic match;
+
+		pr_debug("%s: BASIC\n", __func__);
+		flow_rule_match_basic(rule, &match);
+		if (match.key->n_proto == htons(ETH_P_ARP))
+			flow->rule.frame_type = 0;
+		if (match.key->n_proto == htons(ETH_P_IP))
+			flow->rule.frame_type = 2;
+		if (match.key->n_proto == htons(ETH_P_IPV6))
+			flow->rule.frame_type = 3;
+		if ((match.key->n_proto == htons(ETH_P_ARP)) || flow->rule.frame_type)
+			flow->rule.frame_type_m = 3;
+		if (flow->rule.frame_type >= 2) {
+			if (match.key->ip_proto == IPPROTO_UDP)
+				flow->rule.frame_type_l4 = 0;
+			if (match.key->ip_proto == IPPROTO_TCP)
+				flow->rule.frame_type_l4 = 1;
+			if (match.key->ip_proto == IPPROTO_ICMP || match.key->ip_proto == IPPROTO_ICMPV6)
+				flow->rule.frame_type_l4 = 2;
+			if (match.key->ip_proto == IPPROTO_TCP)
+				flow->rule.frame_type_l4 = 3;
+			if ((match.key->ip_proto == IPPROTO_UDP) || flow->rule.frame_type_l4)
+				flow->rule.frame_type_l4_m = 7;
+		}
+	}
+
+	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
+		struct flow_match_eth_addrs match;
+
+		pr_debug("%s: ETH_ADDR\n", __func__);
+		flow_rule_match_eth_addrs(rule, &match);
+		ether_addr_copy(flow->rule.dmac, match.key->dst);
+		ether_addr_copy(flow->rule.dmac_m, match.mask->dst);
+		ether_addr_copy(flow->rule.smac, match.key->src);
+		ether_addr_copy(flow->rule.smac_m, match.mask->src);
+	}
+
+	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_VLAN)) {
+		struct flow_match_vlan match;
+
+		pr_debug("%s: VLAN\n", __func__);
+		flow_rule_match_vlan(rule, &match);
+		flow->rule.itag = match.key->vlan_id;
+		flow->rule.itag_m = match.mask->vlan_id;
+		/* TODO: What about match.key->vlan_priority? */
+	}
+
+	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_IPV4_ADDRS)) {
+		struct flow_match_ipv4_addrs match;
+
+		pr_debug("%s: IPV4\n", __func__);
+		flow_rule_match_ipv4_addrs(rule, &match);
+		flow->rule.is_ipv6 = false;
+		flow->rule.dip = match.key->dst;
+		flow->rule.dip_m = match.mask->dst;
+		flow->rule.sip = match.key->src;
+		flow->rule.sip_m = match.mask->src;
+	} else if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_IPV6_ADDRS)) {
+		struct flow_match_ipv6_addrs match;
+
+		pr_debug("%s: IPV6\n", __func__);
+		flow->rule.is_ipv6 = true;
+		flow_rule_match_ipv6_addrs(rule, &match);
+		flow->rule.dip6 = match.key->dst;
+		flow->rule.dip6_m = match.mask->dst;
+		flow->rule.sip6 = match.key->src;
+		flow->rule.sip6_m = match.mask->src;
+	}
+
+	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_PORTS)) {
+		struct flow_match_ports match;
+
+		pr_debug("%s: PORTS\n", __func__);
+		flow_rule_match_ports(rule, &match);
+		flow->rule.dport = match.key->dst;
+		flow->rule.dport_m = match.mask->dst;
+		flow->rule.sport = match.key->src;
+		flow->rule.sport_m = match.mask->src;
+	}
+
+	/* TODO: ICMP */
+	return 0;
+}
+
+static void rtl83xx_flow_bypass_all(struct rtl83xx_flow *flow)
+{
+	flow->rule.bypass_sel = true;
+	flow->rule.bypass_all = true;
+	flow->rule.bypass_igr_stp = true;
+	flow->rule.bypass_ibc_sc = true;
+}
+
+static int rtl83xx_parse_fwd(struct rtl838x_switch_priv *priv,
+			     const struct flow_action_entry *act, struct rtl83xx_flow *flow)
+{
+	struct net_device *dev = act->dev;
+	int port;
+
+	port = rtl83xx_port_is_under(dev, priv);
+	if (port < 0) {
+		netdev_info(dev, "%s: not a DSA device.\n", __func__);
+		return -EINVAL;
+	}
+
+	flow->rule.fwd_sel = true;
+	flow->rule.fwd_data = port;
+	pr_debug("Using port index: %d\n", port);
+	rtl83xx_flow_bypass_all(flow);
+
+	return 0;
+}
+
+static int rtl83xx_add_flow(struct rtl838x_switch_priv *priv, struct flow_cls_offload *f,
+			    struct rtl83xx_flow *flow)
+{
+	struct flow_rule *rule = flow_cls_offload_flow_rule(f);
+	const struct flow_action_entry *act;
+	int i, err;
+
+	pr_debug("%s\n", __func__);
+
+	rtl83xx_parse_flow_rule(priv, rule, flow);
+
+	flow_action_for_each(i, act, &rule->action) {
+		switch (act->id) {
+		case FLOW_ACTION_DROP:
+			pr_debug("%s: DROP\n", __func__);
+			flow->rule.drop = true;
+			rtl83xx_flow_bypass_all(flow);
+			return 0;
+
+		case FLOW_ACTION_TRAP:
+			pr_debug("%s: TRAP\n", __func__);
+			flow->rule.fwd_data = priv->cpu_port;
+			flow->rule.fwd_act = PIE_ACT_REDIRECT_TO_PORT;
+			rtl83xx_flow_bypass_all(flow);
+			break;
+
+		case FLOW_ACTION_MANGLE:
+			pr_err("%s: FLOW_ACTION_MANGLE not supported\n", __func__);
+			return -EOPNOTSUPP;
+
+		case FLOW_ACTION_ADD:
+			pr_err("%s: FLOW_ACTION_ADD not supported\n", __func__);
+			return -EOPNOTSUPP;
+
+		case FLOW_ACTION_VLAN_PUSH:
+			pr_debug("%s: VLAN_PUSH\n", __func__);
+/*			TODO: act->vlan.proto */
+			flow->rule.ivid_act = PIE_ACT_VID_ASSIGN;
+			flow->rule.ivid_sel = true;
+			flow->rule.ivid_data = htons(act->vlan.vid);
+			flow->rule.ovid_act = PIE_ACT_VID_ASSIGN;
+			flow->rule.ovid_sel = true;
+			flow->rule.ovid_data = htons(act->vlan.vid);
+			flow->rule.fwd_mod_to_cpu = true;
+			break;
+
+		case FLOW_ACTION_VLAN_POP:
+			pr_debug("%s: VLAN_POP\n", __func__);
+			flow->rule.ivid_act = PIE_ACT_VID_ASSIGN;
+			flow->rule.ivid_data = 0;
+			flow->rule.ivid_sel = true;
+			flow->rule.ovid_act = PIE_ACT_VID_ASSIGN;
+			flow->rule.ovid_data = 0;
+			flow->rule.ovid_sel = true;
+			flow->rule.fwd_mod_to_cpu = true;
+			break;
+
+		case FLOW_ACTION_CSUM:
+			pr_err("%s: FLOW_ACTION_CSUM not supported\n", __func__);
+			return -EOPNOTSUPP;
+
+		case FLOW_ACTION_REDIRECT:
+			pr_debug("%s: REDIRECT\n", __func__);
+			err = rtl83xx_parse_fwd(priv, act, flow);
+			if (err)
+				return err;
+			flow->rule.fwd_act = PIE_ACT_REDIRECT_TO_PORT;
+			break;
+
+		case FLOW_ACTION_MIRRED:
+			pr_debug("%s: MIRRED\n", __func__);
+			err = rtl83xx_parse_fwd(priv, act, flow);
+			if (err)
+				return err;
+			flow->rule.fwd_act = PIE_ACT_COPY_TO_PORT;
+			break;
+
+		default:
+			pr_err("%s: Flow action not supported: %d\n", __func__, act->id);
+			return -EOPNOTSUPP;
+		}
+	}
+
+	return 0;
+}
+
+static const struct rhashtable_params tc_ht_params = {
+	.head_offset = offsetof(struct rtl83xx_flow, node),
+	.key_offset = offsetof(struct rtl83xx_flow, cookie),
+	.key_len = sizeof(((struct rtl83xx_flow *)0)->cookie),
+	.automatic_shrinking = true,
+};
+
+static int rtl83xx_configure_flower(struct rtl838x_switch_priv *priv,
+				    struct flow_cls_offload *f)
+{
+	struct rtl83xx_flow *flow;
+	int err = 0;
+
+	pr_debug("In %s\n", __func__);
+
+	rcu_read_lock();
+	pr_debug("Cookie %08lx\n", f->cookie);
+	flow = rhashtable_lookup(&priv->tc_ht, &f->cookie, tc_ht_params);
+	if (flow) {
+		pr_info("%s: Got flow\n", __func__);
+		err = -EEXIST;
+		goto rcu_unlock;
+	}
+
+rcu_unlock:
+	rcu_read_unlock();
+	if (flow)
+		goto out;
+	pr_debug("%s: New flow\n", __func__);
+
+	flow = kzalloc(sizeof(*flow), GFP_KERNEL);
+	if (!flow) {
+		err = -ENOMEM;
+		goto out;
+	}
+
+	flow->cookie = f->cookie;
+	flow->priv = priv;
+
+	err = rhashtable_insert_fast(&priv->tc_ht, &flow->node, tc_ht_params);
+	if (err) {
+		pr_err("Could not insert add new rule\n");
+		goto out_free;
+	}
+
+	rtl83xx_add_flow(priv, f, flow); /* TODO: check error */
+
+	/* Add log action to flow */
+	flow->rule.packet_cntr = rtl83xx_packet_cntr_alloc(priv);
+	if (flow->rule.packet_cntr >= 0) {
+		pr_debug("Using packet counter %d\n", flow->rule.packet_cntr);
+		flow->rule.log_sel = true;
+		flow->rule.log_data = flow->rule.packet_cntr;
+	}
+
+	err = priv->r->pie_rule_add(priv, &flow->rule);
+	return err;
+
+out_free:
+	kfree(flow);
+out:
+	pr_err("%s: error %d\n", __func__, err);
+
+	return err;
+}
+
+static int rtl83xx_delete_flower(struct rtl838x_switch_priv *priv,
+				 struct flow_cls_offload * cls_flower)
+{
+	struct rtl83xx_flow *flow;
+
+	pr_debug("In %s\n", __func__);
+	rcu_read_lock();
+	flow = rhashtable_lookup_fast(&priv->tc_ht, &cls_flower->cookie, tc_ht_params);
+	if (!flow) {
+		rcu_read_unlock();
+		return -EINVAL;
+	}
+
+	priv->r->pie_rule_rm(priv, &flow->rule);
+
+	rhashtable_remove_fast(&priv->tc_ht, &flow->node, tc_ht_params);
+
+	kfree_rcu(flow, rcu_head);
+
+	rcu_read_unlock();
+
+	return 0;
+}
+
+static int rtl83xx_stats_flower(struct rtl838x_switch_priv *priv,
+				struct flow_cls_offload * cls_flower)
+{
+	struct rtl83xx_flow *flow;
+	unsigned long lastused = 0;
+	int total_packets, new_packets;
+
+	pr_debug("%s: \n", __func__);
+	flow = rhashtable_lookup_fast(&priv->tc_ht, &cls_flower->cookie, tc_ht_params);
+	if (!flow)
+		return -1;
+
+	if (flow->rule.packet_cntr >= 0) {
+		total_packets = priv->r->packet_cntr_read(flow->rule.packet_cntr);
+		pr_debug("Total packets: %d\n", total_packets);
+		new_packets = total_packets - flow->rule.last_packet_cnt;
+		flow->rule.last_packet_cnt = total_packets;
+	}
+
+	/* TODO: We need a second PIE rule to count the bytes */
+	flow_stats_update(&cls_flower->stats, 100 * new_packets, new_packets, 0, lastused,
+	                  FLOW_ACTION_HW_STATS_IMMEDIATE);
+
+	return 0;
+}
+
+static int rtl83xx_setup_tc_cls_flower(struct rtl838x_switch_priv *priv,
+				       struct flow_cls_offload *cls_flower)
+{
+	pr_debug("%s: %d\n", __func__, cls_flower->command);
+	switch (cls_flower->command) {
+	case FLOW_CLS_REPLACE:
+		return rtl83xx_configure_flower(priv, cls_flower);
+	case FLOW_CLS_DESTROY:
+		return rtl83xx_delete_flower(priv, cls_flower);
+	case FLOW_CLS_STATS:
+		return rtl83xx_stats_flower(priv, cls_flower);
+	default:
+		return -EOPNOTSUPP;
+	}
+}
+
+
+static int rtl83xx_setup_tc_block_cb(enum tc_setup_type type, void *type_data,
+				     void *cb_priv)
+{
+	struct rtl838x_switch_priv *priv = cb_priv;
+
+	switch (type) {
+	case TC_SETUP_CLSFLOWER:
+		pr_debug("%s: TC_SETUP_CLSFLOWER\n", __func__);
+		return rtl83xx_setup_tc_cls_flower(priv, type_data);
+	default:
+		return -EOPNOTSUPP;
+	}
+}
+
+static LIST_HEAD(rtl83xx_block_cb_list);
+
+int rtl83xx_setup_tc(struct net_device *dev, enum tc_setup_type type, void *type_data)
+{
+	struct rtl838x_switch_priv *priv;
+	struct flow_block_offload *f = type_data;
+	static bool first_time = true;
+	int err;
+
+	pr_debug("%s: %d\n", __func__, type);
+
+	if(!netdev_uses_dsa(dev)) {
+		pr_err("%s: no DSA\n", __func__);
+		return 0;
+	}
+	priv = dev->dsa_ptr->ds->priv;
+
+	switch (type) {
+	case TC_SETUP_BLOCK:
+		if (first_time) {
+			first_time = false;
+			err = rhashtable_init(&priv->tc_ht, &tc_ht_params);
+			if (err)
+				pr_err("%s: Could not initialize hash table\n", __func__);
+		}
+
+		f->unlocked_driver_cb = true;
+		return flow_block_cb_setup_simple(type_data,
+						  &rtl83xx_block_cb_list,
+						  rtl83xx_setup_tc_block_cb,
+						  priv, priv, true);
+	default:
+		return -EOPNOTSUPP;
+	}
+
+	return 0;
+}
diff --git a/target/linux/realtek/files-5.15/drivers/net/ethernet/rtl838x_eth.c b/target/linux/realtek/files-5.15/drivers/net/ethernet/rtl838x_eth.c
new file mode 100644
index 00000000000000..9dcb7a3b78ed7c
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/net/ethernet/rtl838x_eth.c
@@ -0,0 +1,2596 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* linux/drivers/net/ethernet/rtl838x_eth.c
+ * Copyright (C) 2020 B. Koblitz
+ */
+
+#include <linux/dma-mapping.h>
+#include <linux/etherdevice.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/platform_device.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/of.h>
+#include <linux/of_net.h>
+#include <linux/of_mdio.h>
+#include <linux/module.h>
+#include <linux/phylink.h>
+#include <linux/pkt_sched.h>
+#include <net/dsa.h>
+#include <net/switchdev.h>
+#include <asm/cacheflush.h>
+
+#include <asm/mach-rtl838x/mach-rtl83xx.h>
+#include "rtl838x_eth.h"
+
+extern struct rtl83xx_soc_info soc_info;
+
+/* Maximum number of RX rings is 8 on RTL83XX and 32 on the 93XX
+ * The ring is assigned by switch based on packet/port priortity
+ * Maximum number of TX rings is 2, Ring 2 being the high priority
+ * ring on the RTL93xx SoCs. MAX_RXLEN gives the maximum length
+ * for an RX ring, MAX_ENTRIES the maximum number of entries
+ * available in total for all queues.
+ */
+#define MAX_RXRINGS	32
+#define MAX_RXLEN	300
+#define MAX_ENTRIES	(300 * 8)
+#define TXRINGS		2
+#define TXRINGLEN	160
+#define NOTIFY_EVENTS	10
+#define NOTIFY_BLOCKS	10
+#define TX_EN		0x8
+#define RX_EN		0x4
+#define TX_EN_93XX	0x20
+#define RX_EN_93XX	0x10
+#define TX_DO		0x2
+#define WRAP		0x2
+#define MAX_PORTS	57
+#define MAX_SMI_BUSSES	4
+
+#define RING_BUFFER	1600
+
+struct p_hdr {
+	uint8_t		*buf;
+	uint16_t	reserved;
+	uint16_t	size;		/* buffer size */
+	uint16_t	offset;
+	uint16_t	len;		/* pkt len */
+	/* cpu_tag[0] is a reserved uint16_t on RTL83xx */
+	uint16_t	cpu_tag[10];
+} __packed __aligned(1);
+
+struct n_event {
+	uint32_t	type:2;
+	uint32_t	fidVid:12;
+	uint64_t	mac:48;
+	uint32_t	slp:6;
+	uint32_t	valid:1;
+	uint32_t	reserved:27;
+} __packed __aligned(1);
+
+struct ring_b {
+	uint32_t	rx_r[MAX_RXRINGS][MAX_RXLEN];
+	uint32_t	tx_r[TXRINGS][TXRINGLEN];
+	struct	p_hdr	rx_header[MAX_RXRINGS][MAX_RXLEN];
+	struct	p_hdr	tx_header[TXRINGS][TXRINGLEN];
+	uint32_t	c_rx[MAX_RXRINGS];
+	uint32_t	c_tx[TXRINGS];
+	uint8_t		tx_space[TXRINGS * TXRINGLEN * RING_BUFFER];
+	uint8_t		*rx_space;
+};
+
+struct notify_block {
+	struct n_event	events[NOTIFY_EVENTS];
+};
+
+struct notify_b {
+	struct notify_block	blocks[NOTIFY_BLOCKS];
+	u32			reserved1[8];
+	u32			ring[NOTIFY_BLOCKS];
+	u32			reserved2[8];
+};
+
+static void rtl838x_create_tx_header(struct p_hdr *h, unsigned int dest_port, int prio)
+{
+	/* cpu_tag[0] is reserved on the RTL83XX SoCs */
+	h->cpu_tag[1] = 0x0400;  /* BIT 10: RTL8380_CPU_TAG */
+	h->cpu_tag[2] = 0x0200;  /* Set only AS_DPM, to enable DPM settings below */
+	h->cpu_tag[3] = 0x0000;
+	h->cpu_tag[4] = BIT(dest_port) >> 16;
+	h->cpu_tag[5] = BIT(dest_port) & 0xffff;
+
+	/* Set internal priority (PRI) and enable (AS_PRI) */
+	if (prio >= 0)
+		h->cpu_tag[2] |= ((prio & 0x7) | BIT(3)) << 12;
+}
+
+static void rtl839x_create_tx_header(struct p_hdr *h, unsigned int dest_port, int prio)
+{
+	/* cpu_tag[0] is reserved on the RTL83XX SoCs */
+	h->cpu_tag[1] = 0x0100; /* RTL8390_CPU_TAG marker */
+	h->cpu_tag[2] = BIT(4); /* AS_DPM flag */
+	h->cpu_tag[3] = h->cpu_tag[4] = h->cpu_tag[5] = 0;
+	/* h->cpu_tag[1] |= BIT(1) | BIT(0); */ /* Bypass filter 1/2 */
+	if (dest_port >= 32) {
+		dest_port -= 32;
+		h->cpu_tag[2] |= (BIT(dest_port) >> 16) & 0xf;
+		h->cpu_tag[3] = BIT(dest_port) & 0xffff;
+	} else {
+		h->cpu_tag[4] = BIT(dest_port) >> 16;
+		h->cpu_tag[5] = BIT(dest_port) & 0xffff;
+	}
+
+	/* Set internal priority (PRI) and enable (AS_PRI) */
+	if (prio >= 0)
+		h->cpu_tag[2] |= ((prio & 0x7) | BIT(3)) << 8;
+}
+
+static void rtl930x_create_tx_header(struct p_hdr *h, unsigned int dest_port, int prio)
+{
+	h->cpu_tag[0] = 0x8000;  /* CPU tag marker */
+	h->cpu_tag[1] = h->cpu_tag[2] = 0;
+	h->cpu_tag[3] = 0;
+	h->cpu_tag[4] = 0;
+	h->cpu_tag[5] = 0;
+	h->cpu_tag[6] = BIT(dest_port) >> 16;
+	h->cpu_tag[7] = BIT(dest_port) & 0xffff;
+
+	/* Enable (AS_QID) and set priority queue (QID) */
+	if (prio >= 0)
+		h->cpu_tag[2] = (BIT(5) | (prio & 0x1f)) << 8;
+}
+
+static void rtl931x_create_tx_header(struct p_hdr *h, unsigned int dest_port, int prio)
+{
+	h->cpu_tag[0] = 0x8000;  /* CPU tag marker */
+	h->cpu_tag[1] = h->cpu_tag[2] = 0;
+	h->cpu_tag[3] = 0;
+	h->cpu_tag[4] = h->cpu_tag[5] = h->cpu_tag[6] = h->cpu_tag[7] = 0;
+	if (dest_port >= 32) {
+		dest_port -= 32;
+		h->cpu_tag[4] = BIT(dest_port) >> 16;
+		h->cpu_tag[5] = BIT(dest_port) & 0xffff;
+	} else {
+		h->cpu_tag[6] = BIT(dest_port) >> 16;
+		h->cpu_tag[7] = BIT(dest_port) & 0xffff;
+	}
+
+	/* Enable (AS_QID) and set priority queue (QID) */
+	if (prio >= 0)
+		h->cpu_tag[2] = (BIT(5) | (prio & 0x1f)) << 8;
+}
+
+// Currently unused
+// static void rtl93xx_header_vlan_set(struct p_hdr *h, int vlan)
+// {
+// 	h->cpu_tag[2] |= BIT(4); /* Enable VLAN forwarding offload */
+// 	h->cpu_tag[2] |= (vlan >> 8) & 0xf;
+// 	h->cpu_tag[3] |= (vlan & 0xff) << 8;
+// }
+
+struct rtl838x_rx_q {
+	int id;
+	struct rtl838x_eth_priv *priv;
+	struct napi_struct napi;
+};
+
+struct rtl838x_eth_priv {
+	struct net_device *netdev;
+	struct platform_device *pdev;
+	void *membase;
+	spinlock_t lock;
+	struct mii_bus *mii_bus;
+	struct rtl838x_rx_q rx_qs[MAX_RXRINGS];
+	struct phylink *phylink;
+	struct phylink_config phylink_config;
+	u16 id;
+	u16 family_id;
+	const struct rtl838x_eth_reg *r;
+	u8 cpu_port;
+	u32 lastEvent;
+	u16 rxrings;
+	u16 rxringlen;
+	u8 smi_bus[MAX_PORTS];
+	u8 smi_addr[MAX_PORTS];
+	u32 sds_id[MAX_PORTS];
+	bool smi_bus_isc45[MAX_SMI_BUSSES];
+	bool phy_is_internal[MAX_PORTS];
+	phy_interface_t interfaces[MAX_PORTS];
+};
+
+extern int rtl838x_phy_init(struct rtl838x_eth_priv *priv);
+extern int rtl838x_read_sds_phy(int phy_addr, int phy_reg);
+extern int rtl839x_read_sds_phy(int phy_addr, int phy_reg);
+extern int rtl839x_write_sds_phy(int phy_addr, int phy_reg, u16 v);
+extern int rtl930x_read_sds_phy(int phy_addr, int page, int phy_reg);
+extern int rtl930x_write_sds_phy(int phy_addr, int page, int phy_reg, u16 v);
+extern int rtl931x_read_sds_phy(int phy_addr, int page, int phy_reg);
+extern int rtl931x_write_sds_phy(int phy_addr, int page, int phy_reg, u16 v);
+extern int rtl930x_read_mmd_phy(u32 port, u32 devnum, u32 regnum, u32 *val);
+extern int rtl930x_write_mmd_phy(u32 port, u32 devnum, u32 regnum, u32 val);
+extern int rtl931x_read_mmd_phy(u32 port, u32 devnum, u32 regnum, u32 *val);
+extern int rtl931x_write_mmd_phy(u32 port, u32 devnum, u32 regnum, u32 val);
+
+/* On the RTL93XX, the RTL93XX_DMA_IF_RX_RING_CNTR track the fill level of
+ * the rings. Writing x into these registers substracts x from its content.
+ * When the content reaches the ring size, the ASIC no longer adds
+ * packets to this receive queue.
+ */
+void rtl838x_update_cntr(int r, int released)
+{
+	/* This feature is not available on RTL838x SoCs */
+}
+
+void rtl839x_update_cntr(int r, int released)
+{
+	/* This feature is not available on RTL839x SoCs */
+}
+
+void rtl930x_update_cntr(int r, int released)
+{
+	int pos = (r % 3) * 10;
+	u32 reg = RTL930X_DMA_IF_RX_RING_CNTR + ((r / 3) << 2);
+	u32 v = sw_r32(reg);
+
+	v = (v >> pos) & 0x3ff;
+	pr_debug("RX: Work done %d, old value: %d, pos %d, reg %04x\n", released, v, pos, reg);
+	sw_w32_mask(0x3ff << pos, released << pos, reg);
+	sw_w32(v, reg);
+}
+
+void rtl931x_update_cntr(int r, int released)
+{
+	int pos = (r % 3) * 10;
+	u32 reg = RTL931X_DMA_IF_RX_RING_CNTR + ((r / 3) << 2);
+	u32 v = sw_r32(reg);
+
+	v = (v >> pos) & 0x3ff;
+	sw_w32_mask(0x3ff << pos, released << pos, reg);
+	sw_w32(v, reg);
+}
+
+struct dsa_tag {
+	u8	reason;
+	u8	queue;
+	u16	port;
+	u8	l2_offloaded;
+	u8	prio;
+	bool	crc_error;
+};
+
+bool rtl838x_decode_tag(struct p_hdr *h, struct dsa_tag *t)
+{
+	/* cpu_tag[0] is reserved. Fields are off-by-one */
+	t->reason = h->cpu_tag[4] & 0xf;
+	t->queue = (h->cpu_tag[1] & 0xe0) >> 5;
+	t->port = h->cpu_tag[1] & 0x1f;
+	t->crc_error = t->reason == 13;
+
+	pr_debug("Reason: %d\n", t->reason);
+	if (t->reason != 6) /* NIC_RX_REASON_SPECIAL_TRAP */
+		t->l2_offloaded = 1;
+	else
+		t->l2_offloaded = 0;
+
+	return t->l2_offloaded;
+}
+
+bool rtl839x_decode_tag(struct p_hdr *h, struct dsa_tag *t)
+{
+	/* cpu_tag[0] is reserved. Fields are off-by-one */
+	t->reason = h->cpu_tag[5] & 0x1f;
+	t->queue = (h->cpu_tag[4] & 0xe000) >> 13;
+	t->port = h->cpu_tag[1] & 0x3f;
+	t->crc_error = h->cpu_tag[4] & BIT(6);
+
+	pr_debug("Reason: %d\n", t->reason);
+	if ((t->reason >= 7 && t->reason <= 13) || /* NIC_RX_REASON_RMA */
+	    (t->reason >= 23 && t->reason <= 25))  /* NIC_RX_REASON_SPECIAL_TRAP */
+		t->l2_offloaded = 0;
+	else
+		t->l2_offloaded = 1;
+
+	return t->l2_offloaded;
+}
+
+bool rtl930x_decode_tag(struct p_hdr *h, struct dsa_tag *t)
+{
+	t->reason = h->cpu_tag[7] & 0x3f;
+	t->queue =  (h->cpu_tag[2] >> 11) & 0x1f;
+	t->port = (h->cpu_tag[0] >> 8) & 0x1f;
+	t->crc_error = h->cpu_tag[1] & BIT(6);
+
+	pr_debug("Reason %d, port %d, queue %d\n", t->reason, t->port, t->queue);
+	if (t->reason >= 19 && t->reason <= 27)
+		t->l2_offloaded = 0;
+	else
+		t->l2_offloaded = 1;
+
+	return t->l2_offloaded;
+}
+
+bool rtl931x_decode_tag(struct p_hdr *h, struct dsa_tag *t)
+{
+	t->reason = h->cpu_tag[7] & 0x3f;
+	t->queue =  (h->cpu_tag[2] >> 11) & 0x1f;
+	t->port = (h->cpu_tag[0] >> 8) & 0x3f;
+	t->crc_error = h->cpu_tag[1] & BIT(6);
+
+	if (t->reason != 63)
+		pr_info("%s: Reason %d, port %d, queue %d\n", __func__, t->reason, t->port, t->queue);
+	if (t->reason >= 19 && t->reason <= 27)	/* NIC_RX_REASON_RMA */
+		t->l2_offloaded = 0;
+	else
+		t->l2_offloaded = 1;
+
+	return t->l2_offloaded;
+}
+
+/* Discard the RX ring-buffers, called as part of the net-ISR
+ * when the buffer runs over
+ */
+static void rtl838x_rb_cleanup(struct rtl838x_eth_priv *priv, int status)
+{
+	for (int r = 0; r < priv->rxrings; r++) {
+		struct ring_b *ring = priv->membase;
+		struct p_hdr *h;
+		u32 *last;
+
+		pr_debug("In %s working on r: %d\n", __func__, r);
+		last = (u32 *)KSEG1ADDR(sw_r32(priv->r->dma_if_rx_cur + r * 4));
+		do {
+			if ((ring->rx_r[r][ring->c_rx[r]] & 0x1))
+				break;
+			pr_debug("Got something: %d\n", ring->c_rx[r]);
+			h = &ring->rx_header[r][ring->c_rx[r]];
+			memset(h, 0, sizeof(struct p_hdr));
+			h->buf = (u8 *)KSEG1ADDR(ring->rx_space +
+			                         r * priv->rxringlen * RING_BUFFER +
+			                         ring->c_rx[r] * RING_BUFFER);
+			h->size = RING_BUFFER;
+			/* make sure the header is visible to the ASIC */
+			mb();
+
+			ring->rx_r[r][ring->c_rx[r]] = KSEG1ADDR(h) | 0x1 | (ring->c_rx[r] == (priv->rxringlen - 1) ?
+			                               WRAP :
+			                               0x1);
+			ring->c_rx[r] = (ring->c_rx[r] + 1) % priv->rxringlen;
+		} while (&ring->rx_r[r][ring->c_rx[r]] != last);
+	}
+}
+
+struct fdb_update_work {
+	struct work_struct work;
+	struct net_device *ndev;
+	u64 macs[NOTIFY_EVENTS + 1];
+};
+
+void rtl838x_fdb_sync(struct work_struct *work)
+{
+	const struct fdb_update_work *uw = container_of(work, struct fdb_update_work, work);
+
+	for (int i = 0; uw->macs[i]; i++) {
+	        struct switchdev_notifier_fdb_info info;
+	        u8 addr[ETH_ALEN];
+	        int action;
+
+		action = (uw->macs[i] & (1ULL << 63)) ?
+		         SWITCHDEV_FDB_ADD_TO_BRIDGE :
+		         SWITCHDEV_FDB_DEL_TO_BRIDGE;
+		u64_to_ether_addr(uw->macs[i] & 0xffffffffffffULL, addr);
+		info.addr = &addr[0];
+		info.vid = 0;
+		info.offloaded = 1;
+		pr_debug("FDB entry %d: %llx, action %d\n", i, uw->macs[0], action);
+		call_switchdev_notifiers(action, uw->ndev, &info.info, NULL);
+	}
+	kfree(work);
+}
+
+static void rtl839x_l2_notification_handler(struct rtl838x_eth_priv *priv)
+{
+	struct notify_b *nb = priv->membase + sizeof(struct ring_b);
+        u32 e = priv->lastEvent;
+
+	while (!(nb->ring[e] & 1)) {
+                struct fdb_update_work *w;
+                struct n_event *event;
+                u64 mac;
+                int i;
+
+		w = kzalloc(sizeof(*w), GFP_ATOMIC);
+		if (!w) {
+			pr_err("Out of memory: %s", __func__);
+			return;
+		}
+		INIT_WORK(&w->work, rtl838x_fdb_sync);
+
+		for (i = 0; i < NOTIFY_EVENTS; i++) {
+			event = &nb->blocks[e].events[i];
+			if (!event->valid)
+				continue;
+			mac = event->mac;
+			if (event->type)
+				mac |= 1ULL << 63;
+			w->ndev = priv->netdev;
+			w->macs[i] = mac;
+		}
+
+		/* Hand the ring entry back to the switch */
+		nb->ring[e] = nb->ring[e] | 1;
+		e = (e + 1) % NOTIFY_BLOCKS;
+
+		w->macs[i] = 0ULL;
+		schedule_work(&w->work);
+	}
+	priv->lastEvent = e;
+}
+
+static irqreturn_t rtl83xx_net_irq(int irq, void *dev_id)
+{
+	struct net_device *dev = dev_id;
+	struct rtl838x_eth_priv *priv = netdev_priv(dev);
+	u32 status = sw_r32(priv->r->dma_if_intr_sts);
+
+	pr_debug("IRQ: %08x\n", status);
+
+	/*  Ignore TX interrupt */
+	if ((status & 0xf0000)) {
+		/* Clear ISR */
+		sw_w32(0x000f0000, priv->r->dma_if_intr_sts);
+	}
+
+	/* RX interrupt */
+	if (status & 0x0ff00) {
+		/* ACK and disable RX interrupt for this ring */
+		sw_w32_mask(0xff00 & status, 0, priv->r->dma_if_intr_msk);
+		sw_w32(0x0000ff00 & status, priv->r->dma_if_intr_sts);
+		for (int i = 0; i < priv->rxrings; i++) {
+			if (status & BIT(i + 8)) {
+				pr_debug("Scheduling queue: %d\n", i);
+				napi_schedule(&priv->rx_qs[i].napi);
+			}
+		}
+	}
+
+	/* RX buffer overrun */
+	if (status & 0x000ff) {
+		pr_debug("RX buffer overrun: status %x, mask: %x\n",
+			 status, sw_r32(priv->r->dma_if_intr_msk));
+		sw_w32(status, priv->r->dma_if_intr_sts);
+		rtl838x_rb_cleanup(priv, status & 0xff);
+	}
+
+	if (priv->family_id == RTL8390_FAMILY_ID && status & 0x00100000) {
+		sw_w32(0x00100000, priv->r->dma_if_intr_sts);
+		rtl839x_l2_notification_handler(priv);
+	}
+
+	if (priv->family_id == RTL8390_FAMILY_ID && status & 0x00200000) {
+		sw_w32(0x00200000, priv->r->dma_if_intr_sts);
+		rtl839x_l2_notification_handler(priv);
+	}
+
+	if (priv->family_id == RTL8390_FAMILY_ID && status & 0x00400000) {
+		sw_w32(0x00400000, priv->r->dma_if_intr_sts);
+		rtl839x_l2_notification_handler(priv);
+	}
+
+	return IRQ_HANDLED;
+}
+
+static irqreturn_t rtl93xx_net_irq(int irq, void *dev_id)
+{
+	struct net_device *dev = dev_id;
+	struct rtl838x_eth_priv *priv = netdev_priv(dev);
+	u32 status_rx_r = sw_r32(priv->r->dma_if_intr_rx_runout_sts);
+	u32 status_rx = sw_r32(priv->r->dma_if_intr_rx_done_sts);
+	u32 status_tx = sw_r32(priv->r->dma_if_intr_tx_done_sts);
+
+	pr_debug("In %s, status_tx: %08x, status_rx: %08x, status_rx_r: %08x\n",
+		__func__, status_tx, status_rx, status_rx_r);
+
+	/*  Ignore TX interrupt */
+	if (status_tx) {
+		/* Clear ISR */
+		pr_debug("TX done\n");
+		sw_w32(status_tx, priv->r->dma_if_intr_tx_done_sts);
+	}
+
+	/* RX interrupt */
+	if (status_rx) {
+		pr_debug("RX IRQ\n");
+		/* ACK and disable RX interrupt for given rings */
+		sw_w32(status_rx, priv->r->dma_if_intr_rx_done_sts);
+		sw_w32_mask(status_rx, 0, priv->r->dma_if_intr_rx_done_msk);
+		for (int i = 0; i < priv->rxrings; i++) {
+			if (status_rx & BIT(i)) {
+				pr_debug("Scheduling queue: %d\n", i);
+				napi_schedule(&priv->rx_qs[i].napi);
+			}
+		}
+	}
+
+	/* RX buffer overrun */
+	if (status_rx_r) {
+		pr_debug("RX buffer overrun: status %x, mask: %x\n",
+		         status_rx_r, sw_r32(priv->r->dma_if_intr_rx_runout_msk));
+		sw_w32(status_rx_r, priv->r->dma_if_intr_rx_runout_sts);
+		rtl838x_rb_cleanup(priv, status_rx_r);
+	}
+
+	return IRQ_HANDLED;
+}
+
+static const struct rtl838x_eth_reg rtl838x_reg = {
+	.net_irq = rtl83xx_net_irq,
+	.mac_port_ctrl = rtl838x_mac_port_ctrl,
+	.dma_if_intr_sts = RTL838X_DMA_IF_INTR_STS,
+	.dma_if_intr_msk = RTL838X_DMA_IF_INTR_MSK,
+	.dma_if_ctrl = RTL838X_DMA_IF_CTRL,
+	.mac_force_mode_ctrl = RTL838X_MAC_FORCE_MODE_CTRL,
+	.dma_rx_base = RTL838X_DMA_RX_BASE,
+	.dma_tx_base = RTL838X_DMA_TX_BASE,
+	.dma_if_rx_ring_size = rtl838x_dma_if_rx_ring_size,
+	.dma_if_rx_ring_cntr = rtl838x_dma_if_rx_ring_cntr,
+	.dma_if_rx_cur = RTL838X_DMA_IF_RX_CUR,
+	.rst_glb_ctrl = RTL838X_RST_GLB_CTRL_0,
+	.get_mac_link_sts = rtl838x_get_mac_link_sts,
+	.get_mac_link_dup_sts = rtl838x_get_mac_link_dup_sts,
+	.get_mac_link_spd_sts = rtl838x_get_mac_link_spd_sts,
+	.get_mac_rx_pause_sts = rtl838x_get_mac_rx_pause_sts,
+	.get_mac_tx_pause_sts = rtl838x_get_mac_tx_pause_sts,
+	.mac = RTL838X_MAC,
+	.l2_tbl_flush_ctrl = RTL838X_L2_TBL_FLUSH_CTRL,
+	.update_cntr = rtl838x_update_cntr,
+	.create_tx_header = rtl838x_create_tx_header,
+	.decode_tag = rtl838x_decode_tag,
+};
+
+static const struct rtl838x_eth_reg rtl839x_reg = {
+	.net_irq = rtl83xx_net_irq,
+	.mac_port_ctrl = rtl839x_mac_port_ctrl,
+	.dma_if_intr_sts = RTL839X_DMA_IF_INTR_STS,
+	.dma_if_intr_msk = RTL839X_DMA_IF_INTR_MSK,
+	.dma_if_ctrl = RTL839X_DMA_IF_CTRL,
+	.mac_force_mode_ctrl = RTL839X_MAC_FORCE_MODE_CTRL,
+	.dma_rx_base = RTL839X_DMA_RX_BASE,
+	.dma_tx_base = RTL839X_DMA_TX_BASE,
+	.dma_if_rx_ring_size = rtl839x_dma_if_rx_ring_size,
+	.dma_if_rx_ring_cntr = rtl839x_dma_if_rx_ring_cntr,
+	.dma_if_rx_cur = RTL839X_DMA_IF_RX_CUR,
+	.rst_glb_ctrl = RTL839X_RST_GLB_CTRL,
+	.get_mac_link_sts = rtl839x_get_mac_link_sts,
+	.get_mac_link_dup_sts = rtl839x_get_mac_link_dup_sts,
+	.get_mac_link_spd_sts = rtl839x_get_mac_link_spd_sts,
+	.get_mac_rx_pause_sts = rtl839x_get_mac_rx_pause_sts,
+	.get_mac_tx_pause_sts = rtl839x_get_mac_tx_pause_sts,
+	.mac = RTL839X_MAC,
+	.l2_tbl_flush_ctrl = RTL839X_L2_TBL_FLUSH_CTRL,
+	.update_cntr = rtl839x_update_cntr,
+	.create_tx_header = rtl839x_create_tx_header,
+	.decode_tag = rtl839x_decode_tag,
+};
+
+static const struct rtl838x_eth_reg rtl930x_reg = {
+	.net_irq = rtl93xx_net_irq,
+	.mac_port_ctrl = rtl930x_mac_port_ctrl,
+	.dma_if_intr_rx_runout_sts = RTL930X_DMA_IF_INTR_RX_RUNOUT_STS,
+	.dma_if_intr_rx_done_sts = RTL930X_DMA_IF_INTR_RX_DONE_STS,
+	.dma_if_intr_tx_done_sts = RTL930X_DMA_IF_INTR_TX_DONE_STS,
+	.dma_if_intr_rx_runout_msk = RTL930X_DMA_IF_INTR_RX_RUNOUT_MSK,
+	.dma_if_intr_rx_done_msk = RTL930X_DMA_IF_INTR_RX_DONE_MSK,
+	.dma_if_intr_tx_done_msk = RTL930X_DMA_IF_INTR_TX_DONE_MSK,
+	.l2_ntfy_if_intr_sts = RTL930X_L2_NTFY_IF_INTR_STS,
+	.l2_ntfy_if_intr_msk = RTL930X_L2_NTFY_IF_INTR_MSK,
+	.dma_if_ctrl = RTL930X_DMA_IF_CTRL,
+	.mac_force_mode_ctrl = RTL930X_MAC_FORCE_MODE_CTRL,
+	.dma_rx_base = RTL930X_DMA_RX_BASE,
+	.dma_tx_base = RTL930X_DMA_TX_BASE,
+	.dma_if_rx_ring_size = rtl930x_dma_if_rx_ring_size,
+	.dma_if_rx_ring_cntr = rtl930x_dma_if_rx_ring_cntr,
+	.dma_if_rx_cur = RTL930X_DMA_IF_RX_CUR,
+	.rst_glb_ctrl = RTL930X_RST_GLB_CTRL_0,
+	.get_mac_link_sts = rtl930x_get_mac_link_sts,
+	.get_mac_link_dup_sts = rtl930x_get_mac_link_dup_sts,
+	.get_mac_link_spd_sts = rtl930x_get_mac_link_spd_sts,
+	.get_mac_rx_pause_sts = rtl930x_get_mac_rx_pause_sts,
+	.get_mac_tx_pause_sts = rtl930x_get_mac_tx_pause_sts,
+	.mac = RTL930X_MAC_L2_ADDR_CTRL,
+	.l2_tbl_flush_ctrl = RTL930X_L2_TBL_FLUSH_CTRL,
+	.update_cntr = rtl930x_update_cntr,
+	.create_tx_header = rtl930x_create_tx_header,
+	.decode_tag = rtl930x_decode_tag,
+};
+
+static const struct rtl838x_eth_reg rtl931x_reg = {
+	.net_irq = rtl93xx_net_irq,
+	.mac_port_ctrl = rtl931x_mac_port_ctrl,
+	.dma_if_intr_rx_runout_sts = RTL931X_DMA_IF_INTR_RX_RUNOUT_STS,
+	.dma_if_intr_rx_done_sts = RTL931X_DMA_IF_INTR_RX_DONE_STS,
+	.dma_if_intr_tx_done_sts = RTL931X_DMA_IF_INTR_TX_DONE_STS,
+	.dma_if_intr_rx_runout_msk = RTL931X_DMA_IF_INTR_RX_RUNOUT_MSK,
+	.dma_if_intr_rx_done_msk = RTL931X_DMA_IF_INTR_RX_DONE_MSK,
+	.dma_if_intr_tx_done_msk = RTL931X_DMA_IF_INTR_TX_DONE_MSK,
+	.l2_ntfy_if_intr_sts = RTL931X_L2_NTFY_IF_INTR_STS,
+	.l2_ntfy_if_intr_msk = RTL931X_L2_NTFY_IF_INTR_MSK,
+	.dma_if_ctrl = RTL931X_DMA_IF_CTRL,
+	.mac_force_mode_ctrl = RTL931X_MAC_FORCE_MODE_CTRL,
+	.dma_rx_base = RTL931X_DMA_RX_BASE,
+	.dma_tx_base = RTL931X_DMA_TX_BASE,
+	.dma_if_rx_ring_size = rtl931x_dma_if_rx_ring_size,
+	.dma_if_rx_ring_cntr = rtl931x_dma_if_rx_ring_cntr,
+	.dma_if_rx_cur = RTL931X_DMA_IF_RX_CUR,
+	.rst_glb_ctrl = RTL931X_RST_GLB_CTRL,
+	.get_mac_link_sts = rtl931x_get_mac_link_sts,
+	.get_mac_link_dup_sts = rtl931x_get_mac_link_dup_sts,
+	.get_mac_link_spd_sts = rtl931x_get_mac_link_spd_sts,
+	.get_mac_rx_pause_sts = rtl931x_get_mac_rx_pause_sts,
+	.get_mac_tx_pause_sts = rtl931x_get_mac_tx_pause_sts,
+	.mac = RTL931X_MAC_L2_ADDR_CTRL,
+	.l2_tbl_flush_ctrl = RTL931X_L2_TBL_FLUSH_CTRL,
+	.update_cntr = rtl931x_update_cntr,
+	.create_tx_header = rtl931x_create_tx_header,
+	.decode_tag = rtl931x_decode_tag,
+};
+
+static void rtl838x_hw_reset(struct rtl838x_eth_priv *priv)
+{
+	u32 int_saved, nbuf;
+	u32 reset_mask;
+
+	pr_info("RESETTING %x, CPU_PORT %d\n", priv->family_id, priv->cpu_port);
+	sw_w32_mask(0x3, 0, priv->r->mac_port_ctrl(priv->cpu_port));
+	mdelay(100);
+
+	/* Disable and clear interrupts */
+	if (priv->family_id == RTL9300_FAMILY_ID || priv->family_id == RTL9310_FAMILY_ID) {
+		sw_w32(0x00000000, priv->r->dma_if_intr_rx_runout_msk);
+		sw_w32(0xffffffff, priv->r->dma_if_intr_rx_runout_sts);
+		sw_w32(0x00000000, priv->r->dma_if_intr_rx_done_msk);
+		sw_w32(0xffffffff, priv->r->dma_if_intr_rx_done_sts);
+		sw_w32(0x00000000, priv->r->dma_if_intr_tx_done_msk);
+		sw_w32(0x0000000f, priv->r->dma_if_intr_tx_done_sts);
+	} else {
+		sw_w32(0x00000000, priv->r->dma_if_intr_msk);
+		sw_w32(0xffffffff, priv->r->dma_if_intr_sts);
+	}
+
+	if (priv->family_id == RTL8390_FAMILY_ID) {
+		/* Preserve L2 notification and NBUF settings */
+		int_saved = sw_r32(priv->r->dma_if_intr_msk);
+		nbuf = sw_r32(RTL839X_DMA_IF_NBUF_BASE_DESC_ADDR_CTRL);
+
+		/* Disable link change interrupt on RTL839x */
+		sw_w32(0, RTL839X_IMR_PORT_LINK_STS_CHG);
+		sw_w32(0, RTL839X_IMR_PORT_LINK_STS_CHG + 4);
+
+		sw_w32(0x00000000, priv->r->dma_if_intr_msk);
+		sw_w32(0xffffffff, priv->r->dma_if_intr_sts);
+	}
+
+	/* Reset NIC (SW_NIC_RST) and queues (SW_Q_RST) */
+	if (priv->family_id == RTL9300_FAMILY_ID || priv->family_id == RTL9310_FAMILY_ID)
+		reset_mask = 0x6;
+	else
+		reset_mask = 0xc;
+
+	sw_w32_mask(0, reset_mask, priv->r->rst_glb_ctrl);
+
+	do { /* Wait for reset of NIC and Queues done */
+		udelay(20);
+	} while (sw_r32(priv->r->rst_glb_ctrl) & reset_mask);
+	mdelay(100);
+
+	/* Setup Head of Line */
+	if (priv->family_id == RTL8380_FAMILY_ID)
+		sw_w32(0, RTL838X_DMA_IF_RX_RING_SIZE);  /* Disabled on RTL8380 */
+	if (priv->family_id == RTL8390_FAMILY_ID)
+		sw_w32(0xffffffff, RTL839X_DMA_IF_RX_RING_CNTR);
+	if (priv->family_id == RTL9300_FAMILY_ID || priv->family_id == RTL9310_FAMILY_ID) {
+		for (int i = 0; i < priv->rxrings; i++) {
+			int pos = (i % 3) * 10;
+
+			sw_w32_mask(0x3ff << pos, 0, priv->r->dma_if_rx_ring_size(i));
+			sw_w32_mask(0x3ff << pos, priv->rxringlen,
+			            priv->r->dma_if_rx_ring_cntr(i));
+		}
+	}
+
+	/* Re-enable link change interrupt */
+	if (priv->family_id == RTL8390_FAMILY_ID) {
+		sw_w32(0xffffffff, RTL839X_ISR_PORT_LINK_STS_CHG);
+		sw_w32(0xffffffff, RTL839X_ISR_PORT_LINK_STS_CHG + 4);
+		sw_w32(0xffffffff, RTL839X_IMR_PORT_LINK_STS_CHG);
+		sw_w32(0xffffffff, RTL839X_IMR_PORT_LINK_STS_CHG + 4);
+
+		/* Restore notification settings: on RTL838x these bits are null */
+		sw_w32_mask(7 << 20, int_saved & (7 << 20), priv->r->dma_if_intr_msk);
+		sw_w32(nbuf, RTL839X_DMA_IF_NBUF_BASE_DESC_ADDR_CTRL);
+	}
+}
+
+static void rtl838x_hw_ring_setup(struct rtl838x_eth_priv *priv)
+{
+	struct ring_b *ring = priv->membase;
+
+	for (int i = 0; i < priv->rxrings; i++)
+		sw_w32(KSEG1ADDR(&ring->rx_r[i]), priv->r->dma_rx_base + i * 4);
+
+	for (int i = 0; i < TXRINGS; i++)
+		sw_w32(KSEG1ADDR(&ring->tx_r[i]), priv->r->dma_tx_base + i * 4);
+}
+
+static void rtl838x_hw_en_rxtx(struct rtl838x_eth_priv *priv)
+{
+	/* Disable Head of Line features for all RX rings */
+	sw_w32(0xffffffff, priv->r->dma_if_rx_ring_size(0));
+
+	/* Truncate RX buffer to 0x640 (1600) bytes, pad TX */
+	sw_w32(0x06400020, priv->r->dma_if_ctrl);
+
+	/* Enable RX done, RX overflow and TX done interrupts */
+	sw_w32(0xfffff, priv->r->dma_if_intr_msk);
+
+	/* Enable DMA, engine expects empty FCS field */
+	sw_w32_mask(0, RX_EN | TX_EN, priv->r->dma_if_ctrl);
+
+	/* Restart TX/RX to CPU port */
+	sw_w32_mask(0x0, 0x3, priv->r->mac_port_ctrl(priv->cpu_port));
+	/* Set Speed, duplex, flow control
+	 * FORCE_EN | LINK_EN | NWAY_EN | DUP_SEL
+	 * | SPD_SEL = 0b10 | FORCE_FC_EN | PHY_MASTER_SLV_MANUAL_EN
+	 * | MEDIA_SEL
+	 */
+	sw_w32(0x6192F, priv->r->mac_force_mode_ctrl + priv->cpu_port * 4);
+
+	/* Enable CRC checks on CPU-port */
+	sw_w32_mask(0, BIT(3), priv->r->mac_port_ctrl(priv->cpu_port));
+}
+
+static void rtl839x_hw_en_rxtx(struct rtl838x_eth_priv *priv)
+{
+	/* Setup CPU-Port: RX Buffer */
+	sw_w32(0x0000c808, priv->r->dma_if_ctrl);
+
+	/* Enable Notify, RX done, RX overflow and TX done interrupts */
+	sw_w32(0x007fffff, priv->r->dma_if_intr_msk); /* Notify IRQ! */
+
+	/* Enable DMA */
+	sw_w32_mask(0, RX_EN | TX_EN, priv->r->dma_if_ctrl);
+
+	/* Restart TX/RX to CPU port, enable CRC checking */
+	sw_w32_mask(0x0, 0x3 | BIT(3), priv->r->mac_port_ctrl(priv->cpu_port));
+
+	/* CPU port joins Lookup Miss Flooding Portmask */
+	/* TODO: The code below should also work for the RTL838x */
+	sw_w32(0x28000, RTL839X_TBL_ACCESS_L2_CTRL);
+	sw_w32_mask(0, 0x80000000, RTL839X_TBL_ACCESS_L2_DATA(0));
+	sw_w32(0x38000, RTL839X_TBL_ACCESS_L2_CTRL);
+
+	/* Force CPU port link up */
+	sw_w32_mask(0, 3, priv->r->mac_force_mode_ctrl + priv->cpu_port * 4);
+}
+
+static void rtl93xx_hw_en_rxtx(struct rtl838x_eth_priv *priv)
+{
+	/* Setup CPU-Port: RX Buffer truncated at 1600 Bytes */
+	sw_w32(0x06400040, priv->r->dma_if_ctrl);
+
+	for (int i = 0; i < priv->rxrings; i++) {
+		int pos = (i % 3) * 10;
+		u32 v;
+
+		sw_w32_mask(0x3ff << pos, priv->rxringlen << pos, priv->r->dma_if_rx_ring_size(i));
+
+		/* Some SoCs have issues with missing underflow protection */
+		v = (sw_r32(priv->r->dma_if_rx_ring_cntr(i)) >> pos) & 0x3ff;
+		sw_w32_mask(0x3ff << pos, v, priv->r->dma_if_rx_ring_cntr(i));
+	}
+
+	/* Enable Notify, RX done, RX overflow and TX done interrupts */
+	sw_w32(0xffffffff, priv->r->dma_if_intr_rx_runout_msk);
+	sw_w32(0xffffffff, priv->r->dma_if_intr_rx_done_msk);
+	sw_w32(0x0000000f, priv->r->dma_if_intr_tx_done_msk);
+
+	/* Enable DMA */
+	sw_w32_mask(0, RX_EN_93XX | TX_EN_93XX, priv->r->dma_if_ctrl);
+
+	/* Restart TX/RX to CPU port, enable CRC checking */
+	sw_w32_mask(0x0, 0x3 | BIT(4), priv->r->mac_port_ctrl(priv->cpu_port));
+
+	if (priv->family_id == RTL9300_FAMILY_ID)
+		sw_w32_mask(0, BIT(priv->cpu_port), RTL930X_L2_UNKN_UC_FLD_PMSK);
+	else
+		sw_w32_mask(0, BIT(priv->cpu_port), RTL931X_L2_UNKN_UC_FLD_PMSK);
+
+	if (priv->family_id == RTL9300_FAMILY_ID)
+		sw_w32(0x217, priv->r->mac_force_mode_ctrl + priv->cpu_port * 4);
+	else
+		sw_w32(0x2a1d, priv->r->mac_force_mode_ctrl + priv->cpu_port * 4);
+}
+
+static void rtl838x_setup_ring_buffer(struct rtl838x_eth_priv *priv, struct ring_b *ring)
+{
+	for (int i = 0; i < priv->rxrings; i++) {
+	        struct p_hdr *h;
+                int j;
+
+		for (j = 0; j < priv->rxringlen; j++) {
+			h = &ring->rx_header[i][j];
+			memset(h, 0, sizeof(struct p_hdr));
+			h->buf = (u8 *)KSEG1ADDR(ring->rx_space +
+			                         i * priv->rxringlen * RING_BUFFER +
+			                         j * RING_BUFFER);
+			h->size = RING_BUFFER;
+			/* All rings owned by switch, last one wraps */
+			ring->rx_r[i][j] = KSEG1ADDR(h) | 1 | (j == (priv->rxringlen - 1) ?
+			                   WRAP :
+			                   0);
+		}
+		ring->c_rx[i] = 0;
+	}
+
+	for (int i = 0; i < TXRINGS; i++) {
+		struct p_hdr *h;
+		int j;
+
+		for (j = 0; j < TXRINGLEN; j++) {
+			h = &ring->tx_header[i][j];
+			memset(h, 0, sizeof(struct p_hdr));
+			h->buf = (u8 *)KSEG1ADDR(ring->tx_space +
+			                         i * TXRINGLEN * RING_BUFFER +
+			                         j * RING_BUFFER);
+			h->size = RING_BUFFER;
+			ring->tx_r[i][j] = KSEG1ADDR(&ring->tx_header[i][j]);
+		}
+		/* Last header is wrapping around */
+		ring->tx_r[i][j - 1] |= WRAP;
+		ring->c_tx[i] = 0;
+	}
+}
+
+static void rtl839x_setup_notify_ring_buffer(struct rtl838x_eth_priv *priv)
+{
+	struct notify_b *b = priv->membase + sizeof(struct ring_b);
+
+	for (int i = 0; i < NOTIFY_BLOCKS; i++)
+		b->ring[i] = KSEG1ADDR(&b->blocks[i]) | 1 | (i == (NOTIFY_BLOCKS - 1) ? WRAP : 0);
+
+	sw_w32((u32) b->ring, RTL839X_DMA_IF_NBUF_BASE_DESC_ADDR_CTRL);
+	sw_w32_mask(0x3ff << 2, 100 << 2, RTL839X_L2_NOTIFICATION_CTRL);
+
+	/* Setup notification events */
+	sw_w32_mask(0, 1 << 14, RTL839X_L2_CTRL_0); /* RTL8390_L2_CTRL_0_FLUSH_NOTIFY_EN */
+	sw_w32_mask(0, 1 << 12, RTL839X_L2_NOTIFICATION_CTRL); /* SUSPEND_NOTIFICATION_EN */
+
+	/* Enable Notification */
+	sw_w32_mask(0, 1 << 0, RTL839X_L2_NOTIFICATION_CTRL);
+	priv->lastEvent = 0;
+}
+
+static int rtl838x_eth_open(struct net_device *ndev)
+{
+	unsigned long flags;
+	struct rtl838x_eth_priv *priv = netdev_priv(ndev);
+	struct ring_b *ring = priv->membase;
+
+	pr_debug("%s called: RX rings %d(length %d), TX rings %d(length %d)\n",
+		__func__, priv->rxrings, priv->rxringlen, TXRINGS, TXRINGLEN);
+
+	spin_lock_irqsave(&priv->lock, flags);
+	rtl838x_hw_reset(priv);
+	rtl838x_setup_ring_buffer(priv, ring);
+	if (priv->family_id == RTL8390_FAMILY_ID) {
+		rtl839x_setup_notify_ring_buffer(priv);
+		/* Make sure the ring structure is visible to the ASIC */
+		mb();
+		flush_cache_all();
+	}
+
+	rtl838x_hw_ring_setup(priv);
+	phylink_start(priv->phylink);
+
+	for (int i = 0; i < priv->rxrings; i++)
+		napi_enable(&priv->rx_qs[i].napi);
+
+	switch (priv->family_id) {
+	case RTL8380_FAMILY_ID:
+		rtl838x_hw_en_rxtx(priv);
+		/* Trap IGMP/MLD traffic to CPU-Port */
+		sw_w32(0x3, RTL838X_SPCL_TRAP_IGMP_CTRL);
+		/* Flush learned FDB entries on link down of a port */
+		sw_w32_mask(0, BIT(7), RTL838X_L2_CTRL_0);
+		break;
+
+	case RTL8390_FAMILY_ID:
+		rtl839x_hw_en_rxtx(priv);
+		/* Trap MLD and IGMP messages to CPU_PORT */
+		sw_w32(0x3, RTL839X_SPCL_TRAP_IGMP_CTRL);
+		/* Flush learned FDB entries on link down of a port */
+		sw_w32_mask(0, BIT(7), RTL839X_L2_CTRL_0);
+		break;
+
+	case RTL9300_FAMILY_ID:
+		rtl93xx_hw_en_rxtx(priv);
+		/* Flush learned FDB entries on link down of a port */
+		sw_w32_mask(0, BIT(7), RTL930X_L2_CTRL);
+		/* Trap MLD and IGMP messages to CPU_PORT */
+		sw_w32((0x2 << 3) | 0x2,  RTL930X_VLAN_APP_PKT_CTRL);
+		break;
+
+	case RTL9310_FAMILY_ID:
+		rtl93xx_hw_en_rxtx(priv);
+
+		/* Trap MLD and IGMP messages to CPU_PORT */
+		sw_w32((0x2 << 3) | 0x2,  RTL931X_VLAN_APP_PKT_CTRL);
+
+		/* Disable External CPU access to switch, clear EXT_CPU_EN */
+		sw_w32_mask(BIT(2), 0, RTL931X_MAC_L2_GLOBAL_CTRL2);
+
+		/* Set PCIE_PWR_DOWN */
+		sw_w32_mask(0, BIT(1), RTL931X_PS_SOC_CTRL);
+		break;
+	}
+
+	netif_tx_start_all_queues(ndev);
+
+	spin_unlock_irqrestore(&priv->lock, flags);
+
+	return 0;
+}
+
+static void rtl838x_hw_stop(struct rtl838x_eth_priv *priv)
+{
+	u32 force_mac = priv->family_id == RTL8380_FAMILY_ID ? 0x6192C : 0x75;
+	u32 clear_irq = priv->family_id == RTL8380_FAMILY_ID ? 0x000fffff : 0x007fffff;
+
+	/* Disable RX/TX from/to CPU-port */
+	sw_w32_mask(0x3, 0, priv->r->mac_port_ctrl(priv->cpu_port));
+
+	/* Disable traffic */
+	if (priv->family_id == RTL9300_FAMILY_ID || priv->family_id == RTL9310_FAMILY_ID)
+		sw_w32_mask(RX_EN_93XX | TX_EN_93XX, 0, priv->r->dma_if_ctrl);
+	else
+		sw_w32_mask(RX_EN | TX_EN, 0, priv->r->dma_if_ctrl);
+	mdelay(200); /* Test, whether this is needed */
+
+	/* Block all ports */
+	if (priv->family_id == RTL8380_FAMILY_ID) {
+		sw_w32(0x03000000, RTL838X_TBL_ACCESS_DATA_0(0));
+		sw_w32(0x00000000, RTL838X_TBL_ACCESS_DATA_0(1));
+		sw_w32(1 << 15 | 2 << 12, RTL838X_TBL_ACCESS_CTRL_0);
+	}
+
+	/* Flush L2 address cache */
+	if (priv->family_id == RTL8380_FAMILY_ID) {
+		for (int i = 0; i <= priv->cpu_port; i++) {
+			sw_w32(1 << 26 | 1 << 23 | i << 5, priv->r->l2_tbl_flush_ctrl);
+			do { } while (sw_r32(priv->r->l2_tbl_flush_ctrl) & (1 << 26));
+		}
+	} else if (priv->family_id == RTL8390_FAMILY_ID) {
+		for (int i = 0; i <= priv->cpu_port; i++) {
+			sw_w32(1 << 28 | 1 << 25 | i << 5, priv->r->l2_tbl_flush_ctrl);
+			do { } while (sw_r32(priv->r->l2_tbl_flush_ctrl) & (1 << 28));
+		}
+	}
+	/* TODO: L2 flush register is 64 bit on RTL931X and 930X */
+
+	/* CPU-Port: Link down */
+	if (priv->family_id == RTL8380_FAMILY_ID || priv->family_id == RTL8390_FAMILY_ID)
+		sw_w32(force_mac, priv->r->mac_force_mode_ctrl + priv->cpu_port * 4);
+	else if (priv->family_id == RTL9300_FAMILY_ID)
+		sw_w32_mask(0x3, 0, priv->r->mac_force_mode_ctrl + priv->cpu_port *4);
+	else if (priv->family_id == RTL9310_FAMILY_ID)
+		sw_w32_mask(BIT(0) | BIT(9), 0, priv->r->mac_force_mode_ctrl + priv->cpu_port *4);
+	mdelay(100);
+
+	/* Disable all TX/RX interrupts */
+	if (priv->family_id == RTL9300_FAMILY_ID || priv->family_id == RTL9310_FAMILY_ID) {
+		sw_w32(0x00000000, priv->r->dma_if_intr_rx_runout_msk);
+		sw_w32(0xffffffff, priv->r->dma_if_intr_rx_runout_sts);
+		sw_w32(0x00000000, priv->r->dma_if_intr_rx_done_msk);
+		sw_w32(0xffffffff, priv->r->dma_if_intr_rx_done_sts);
+		sw_w32(0x00000000, priv->r->dma_if_intr_tx_done_msk);
+		sw_w32(0x0000000f, priv->r->dma_if_intr_tx_done_sts);
+	} else {
+		sw_w32(0x00000000, priv->r->dma_if_intr_msk);
+		sw_w32(clear_irq, priv->r->dma_if_intr_sts);
+	}
+
+	/* Disable TX/RX DMA */
+	sw_w32(0x00000000, priv->r->dma_if_ctrl);
+	mdelay(200);
+}
+
+static int rtl838x_eth_stop(struct net_device *ndev)
+{
+	struct rtl838x_eth_priv *priv = netdev_priv(ndev);
+
+	pr_info("in %s\n", __func__);
+
+	phylink_stop(priv->phylink);
+	rtl838x_hw_stop(priv);
+
+	for (int i = 0; i < priv->rxrings; i++)
+		napi_disable(&priv->rx_qs[i].napi);
+
+	netif_tx_stop_all_queues(ndev);
+
+	return 0;
+}
+
+static void rtl838x_eth_set_multicast_list(struct net_device *ndev)
+{
+	/* Flood all classes of RMA addresses (01-80-C2-00-00-{01..2F})
+	 * CTRL_0_FULL = GENMASK(21, 0) = 0x3FFFFF
+	 */
+	if (!(ndev->flags & (IFF_PROMISC | IFF_ALLMULTI))) {
+		sw_w32(0x0, RTL838X_RMA_CTRL_0);
+		sw_w32(0x0, RTL838X_RMA_CTRL_1);
+	}
+	if (ndev->flags & IFF_ALLMULTI)
+		sw_w32(GENMASK(21, 0), RTL838X_RMA_CTRL_0);
+	if (ndev->flags & IFF_PROMISC) {
+		sw_w32(GENMASK(21, 0), RTL838X_RMA_CTRL_0);
+		sw_w32(0x7fff, RTL838X_RMA_CTRL_1);
+	}
+}
+
+static void rtl839x_eth_set_multicast_list(struct net_device *ndev)
+{
+	/* Flood all classes of RMA addresses (01-80-C2-00-00-{01..2F})
+	 * CTRL_0_FULL = GENMASK(31, 2) = 0xFFFFFFFC
+	 * Lower two bits are reserved, corresponding to RMA 01-80-C2-00-00-00
+	 * CTRL_1_FULL = CTRL_2_FULL = GENMASK(31, 0)
+	 */
+	if (!(ndev->flags & (IFF_PROMISC | IFF_ALLMULTI))) {
+		sw_w32(0x0, RTL839X_RMA_CTRL_0);
+		sw_w32(0x0, RTL839X_RMA_CTRL_1);
+		sw_w32(0x0, RTL839X_RMA_CTRL_2);
+		sw_w32(0x0, RTL839X_RMA_CTRL_3);
+	}
+	if (ndev->flags & IFF_ALLMULTI) {
+		sw_w32(GENMASK(31, 2), RTL839X_RMA_CTRL_0);
+		sw_w32(GENMASK(31, 0), RTL839X_RMA_CTRL_1);
+		sw_w32(GENMASK(31, 0), RTL839X_RMA_CTRL_2);
+	}
+	if (ndev->flags & IFF_PROMISC) {
+		sw_w32(GENMASK(31, 2), RTL839X_RMA_CTRL_0);
+		sw_w32(GENMASK(31, 0), RTL839X_RMA_CTRL_1);
+		sw_w32(GENMASK(31, 0), RTL839X_RMA_CTRL_2);
+		sw_w32(0x3ff, RTL839X_RMA_CTRL_3);
+	}
+}
+
+static void rtl930x_eth_set_multicast_list(struct net_device *ndev)
+{
+	/* Flood all classes of RMA addresses (01-80-C2-00-00-{01..2F})
+	 * CTRL_0_FULL = GENMASK(31, 2) = 0xFFFFFFFC
+	 * Lower two bits are reserved, corresponding to RMA 01-80-C2-00-00-00
+	 * CTRL_1_FULL = CTRL_2_FULL = GENMASK(31, 0)
+	 */
+	if (ndev->flags & (IFF_ALLMULTI | IFF_PROMISC)) {
+		sw_w32(GENMASK(31, 2), RTL930X_RMA_CTRL_0);
+		sw_w32(GENMASK(31, 0), RTL930X_RMA_CTRL_1);
+		sw_w32(GENMASK(31, 0), RTL930X_RMA_CTRL_2);
+	} else {
+		sw_w32(0x0, RTL930X_RMA_CTRL_0);
+		sw_w32(0x0, RTL930X_RMA_CTRL_1);
+		sw_w32(0x0, RTL930X_RMA_CTRL_2);
+	}
+}
+
+static void rtl931x_eth_set_multicast_list(struct net_device *ndev)
+{
+	/* Flood all classes of RMA addresses (01-80-C2-00-00-{01..2F})
+	 * CTRL_0_FULL = GENMASK(31, 2) = 0xFFFFFFFC
+	 * Lower two bits are reserved, corresponding to RMA 01-80-C2-00-00-00.
+	 * CTRL_1_FULL = CTRL_2_FULL = GENMASK(31, 0)
+	 */
+	if (ndev->flags & (IFF_ALLMULTI | IFF_PROMISC)) {
+		sw_w32(GENMASK(31, 2), RTL931X_RMA_CTRL_0);
+		sw_w32(GENMASK(31, 0), RTL931X_RMA_CTRL_1);
+		sw_w32(GENMASK(31, 0), RTL931X_RMA_CTRL_2);
+	} else {
+		sw_w32(0x0, RTL931X_RMA_CTRL_0);
+		sw_w32(0x0, RTL931X_RMA_CTRL_1);
+		sw_w32(0x0, RTL931X_RMA_CTRL_2);
+	}
+}
+
+static void rtl838x_eth_tx_timeout(struct net_device *ndev, unsigned int txqueue)
+{
+	unsigned long flags;
+	struct rtl838x_eth_priv *priv = netdev_priv(ndev);
+
+	pr_warn("%s\n", __func__);
+	spin_lock_irqsave(&priv->lock, flags);
+	rtl838x_hw_stop(priv);
+	rtl838x_hw_ring_setup(priv);
+	rtl838x_hw_en_rxtx(priv);
+	netif_trans_update(ndev);
+	netif_start_queue(ndev);
+	spin_unlock_irqrestore(&priv->lock, flags);
+}
+
+static int rtl838x_eth_tx(struct sk_buff *skb, struct net_device *dev)
+{
+	int len;
+	struct rtl838x_eth_priv *priv = netdev_priv(dev);
+	struct ring_b *ring = priv->membase;
+	int ret;
+	unsigned long flags;
+	struct p_hdr *h;
+	int dest_port = -1;
+	int q = skb_get_queue_mapping(skb) % TXRINGS;
+
+	if (q) /* Check for high prio queue */
+		pr_debug("SKB priority: %d\n", skb->priority);
+
+	spin_lock_irqsave(&priv->lock, flags);
+	len = skb->len;
+
+	/* Check for DSA tagging at the end of the buffer */
+	if (netdev_uses_dsa(dev) &&
+	    skb->data[len - 4] == 0x80 &&
+	    skb->data[len - 3] < priv->cpu_port &&
+	    skb->data[len - 2] == 0x10 &&
+	    skb->data[len - 1] == 0x00) {
+		/* Reuse tag space for CRC if possible */
+		dest_port = skb->data[len - 3];
+		skb->data[len - 4] = skb->data[len - 3] = skb->data[len - 2] = skb->data[len - 1] = 0x00;
+		len -= 4;
+	}
+
+	len += 4; /* Add space for CRC */
+
+	if (skb_padto(skb, len)) {
+		ret = NETDEV_TX_OK;
+		goto txdone;
+	}
+
+	/* We can send this packet if CPU owns the descriptor */
+	if (!(ring->tx_r[q][ring->c_tx[q]] & 0x1)) {
+
+		/* Set descriptor for tx */
+		h = &ring->tx_header[q][ring->c_tx[q]];
+		h->size = len;
+		h->len = len;
+		/* On RTL8380 SoCs, small packet lengths being sent need adjustments */
+		if (priv->family_id == RTL8380_FAMILY_ID) {
+			if (len < ETH_ZLEN - 4)
+				h->len -= 4;
+		}
+
+		if (dest_port >= 0)
+			priv->r->create_tx_header(h, dest_port, skb->priority >> 1);
+
+		/* Copy packet data to tx buffer */
+		memcpy((void *)KSEG1ADDR(h->buf), skb->data, len);
+		/* Make sure packet data is visible to ASIC */
+		wmb();
+
+		/* Hand over to switch */
+		ring->tx_r[q][ring->c_tx[q]] |= 1;
+
+		/* Before starting TX, prevent a Lextra bus bug on RTL8380 SoCs */
+		if (priv->family_id == RTL8380_FAMILY_ID) {
+			for (int i = 0; i < 10; i++) {
+				u32 val = sw_r32(priv->r->dma_if_ctrl);
+				if ((val & 0xc) == 0xc)
+					break;
+			}
+		}
+
+		/* Tell switch to send data */
+		if (priv->family_id == RTL9310_FAMILY_ID || priv->family_id == RTL9300_FAMILY_ID) {
+			/* Ring ID q == 0: Low priority, Ring ID = 1: High prio queue */
+			if (!q)
+				sw_w32_mask(0, BIT(2), priv->r->dma_if_ctrl);
+			else
+				sw_w32_mask(0, BIT(3), priv->r->dma_if_ctrl);
+		} else {
+			sw_w32_mask(0, TX_DO, priv->r->dma_if_ctrl);
+		}
+
+		dev->stats.tx_packets++;
+		dev->stats.tx_bytes += len;
+		dev_kfree_skb(skb);
+		ring->c_tx[q] = (ring->c_tx[q] + 1) % TXRINGLEN;
+		ret = NETDEV_TX_OK;
+	} else {
+		dev_warn(&priv->pdev->dev, "Data is owned by switch\n");
+		ret = NETDEV_TX_BUSY;
+	}
+
+txdone:
+	spin_unlock_irqrestore(&priv->lock, flags);
+
+	return ret;
+}
+
+/* Return queue number for TX. On the RTL83XX, these queues have equal priority
+ * so we do round-robin
+ */
+u16 rtl83xx_pick_tx_queue(struct net_device *dev, struct sk_buff *skb,
+			  struct net_device *sb_dev)
+{
+	static u8 last = 0;
+
+	last++;
+	return last % TXRINGS;
+}
+
+/* Return queue number for TX. On the RTL93XX, queue 1 is the high priority queue
+ */
+u16 rtl93xx_pick_tx_queue(struct net_device *dev, struct sk_buff *skb,
+			  struct net_device *sb_dev)
+{
+	if (skb->priority >= TC_PRIO_CONTROL)
+		return 1;
+
+	return 0;
+}
+
+static int rtl838x_hw_receive(struct net_device *dev, int r, int budget)
+{
+	struct rtl838x_eth_priv *priv = netdev_priv(dev);
+	struct ring_b *ring = priv->membase;
+	LIST_HEAD(rx_list);
+	unsigned long flags;
+	int work_done = 0;
+	u32	*last;
+	bool dsa = netdev_uses_dsa(dev);
+
+	pr_debug("---------------------------------------------------------- RX - %d\n", r);
+	spin_lock_irqsave(&priv->lock, flags);
+	last = (u32 *)KSEG1ADDR(sw_r32(priv->r->dma_if_rx_cur + r * 4));
+
+	do {
+		struct sk_buff *skb;
+		struct dsa_tag tag;
+		struct p_hdr *h;
+		u8 *skb_data;
+		u8 *data;
+		int len;
+
+		if ((ring->rx_r[r][ring->c_rx[r]] & 0x1)) {
+			if (&ring->rx_r[r][ring->c_rx[r]] != last) {
+				netdev_warn(dev, "Ring contention: r: %x, last %x, cur %x\n",
+				    r, (uint32_t)last, (u32) &ring->rx_r[r][ring->c_rx[r]]);
+			}
+			break;
+		}
+
+		h = &ring->rx_header[r][ring->c_rx[r]];
+		data = (u8 *)KSEG1ADDR(h->buf);
+		len = h->len;
+		if (!len)
+			break;
+		work_done++;
+
+		len -= 4; /* strip the CRC */
+		/* Add 4 bytes for cpu_tag */
+		if (dsa)
+			len += 4;
+
+		skb = netdev_alloc_skb(dev, len + 4);
+		skb_reserve(skb, NET_IP_ALIGN);
+
+		if (likely(skb)) {
+			/* BUG: Prevent bug on RTL838x SoCs */
+			if (priv->family_id == RTL8380_FAMILY_ID) {
+				sw_w32(0xffffffff, priv->r->dma_if_rx_ring_size(0));
+				for (int i = 0; i < priv->rxrings; i++) {
+					unsigned int val;
+
+					/* Update each ring cnt */
+					val = sw_r32(priv->r->dma_if_rx_ring_cntr(i));
+					sw_w32(val, priv->r->dma_if_rx_ring_cntr(i));
+				}
+			}
+
+			skb_data = skb_put(skb, len);
+			/* Make sure data is visible */
+			mb();
+			memcpy(skb->data, (u8 *)KSEG1ADDR(data), len);
+			/* Overwrite CRC with cpu_tag */
+			if (dsa) {
+				priv->r->decode_tag(h, &tag);
+				skb->data[len - 4] = 0x80;
+				skb->data[len - 3] = tag.port;
+				skb->data[len - 2] = 0x10;
+				skb->data[len - 1] = 0x00;
+				if (tag.l2_offloaded)
+					skb->data[len - 3] |= 0x40;
+			}
+
+			if (tag.queue >= 0)
+				pr_debug("Queue: %d, len: %d, reason %d port %d\n",
+					 tag.queue, len, tag.reason, tag.port);
+
+			skb->protocol = eth_type_trans(skb, dev);
+			if (dev->features & NETIF_F_RXCSUM) {
+				if (tag.crc_error)
+					skb_checksum_none_assert(skb);
+				else
+					skb->ip_summed = CHECKSUM_UNNECESSARY;
+			}
+			dev->stats.rx_packets++;
+			dev->stats.rx_bytes += len;
+
+			list_add_tail(&skb->list, &rx_list);
+		} else {
+			if (net_ratelimit())
+				dev_warn(&dev->dev, "low on memory - packet dropped\n");
+			dev->stats.rx_dropped++;
+		}
+
+		/* Reset header structure */
+		memset(h, 0, sizeof(struct p_hdr));
+		h->buf = data;
+		h->size = RING_BUFFER;
+
+		ring->rx_r[r][ring->c_rx[r]] = KSEG1ADDR(h) | 0x1 | (ring->c_rx[r] == (priv->rxringlen - 1) ?
+		                               WRAP :
+		                               0x1);
+		ring->c_rx[r] = (ring->c_rx[r] + 1) % priv->rxringlen;
+		last = (u32 *)KSEG1ADDR(sw_r32(priv->r->dma_if_rx_cur + r * 4));
+	} while (&ring->rx_r[r][ring->c_rx[r]] != last && work_done < budget);
+
+	netif_receive_skb_list(&rx_list);
+
+	/* Update counters */
+	priv->r->update_cntr(r, 0);
+
+	spin_unlock_irqrestore(&priv->lock, flags);
+
+	return work_done;
+}
+
+static int rtl838x_poll_rx(struct napi_struct *napi, int budget)
+{
+	struct rtl838x_rx_q *rx_q = container_of(napi, struct rtl838x_rx_q, napi);
+	struct rtl838x_eth_priv *priv = rx_q->priv;
+	int work_done = 0;
+	int r = rx_q->id;
+	int work;
+
+	while (work_done < budget) {
+		work = rtl838x_hw_receive(priv->netdev, r, budget - work_done);
+		if (!work)
+			break;
+		work_done += work;
+	}
+
+	if (work_done < budget) {
+		napi_complete_done(napi, work_done);
+
+		/* Enable RX interrupt */
+		if (priv->family_id == RTL9300_FAMILY_ID || priv->family_id == RTL9310_FAMILY_ID)
+			sw_w32(0xffffffff, priv->r->dma_if_intr_rx_done_msk);
+		else
+			sw_w32_mask(0, 0xf00ff | BIT(r + 8), priv->r->dma_if_intr_msk);
+	}
+
+	return work_done;
+}
+
+
+static void rtl838x_validate(struct phylink_config *config,
+			 unsigned long *supported,
+			 struct phylink_link_state *state)
+{
+	__ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
+
+	pr_debug("In %s\n", __func__);
+
+	if (!phy_interface_mode_is_rgmii(state->interface) &&
+	    state->interface != PHY_INTERFACE_MODE_1000BASEX &&
+	    state->interface != PHY_INTERFACE_MODE_MII &&
+	    state->interface != PHY_INTERFACE_MODE_REVMII &&
+	    state->interface != PHY_INTERFACE_MODE_GMII &&
+	    state->interface != PHY_INTERFACE_MODE_QSGMII &&
+	    state->interface != PHY_INTERFACE_MODE_INTERNAL &&
+	    state->interface != PHY_INTERFACE_MODE_SGMII) {
+		bitmap_zero(supported, __ETHTOOL_LINK_MODE_MASK_NBITS);
+		pr_err("Unsupported interface: %d\n", state->interface);
+		return;
+	}
+
+	/* Allow all the expected bits */
+	phylink_set(mask, Autoneg);
+	phylink_set_port_modes(mask);
+	phylink_set(mask, Pause);
+	phylink_set(mask, Asym_Pause);
+
+	/* With the exclusion of MII and Reverse MII, we support Gigabit,
+	 * including Half duplex
+	 */
+	if (state->interface != PHY_INTERFACE_MODE_MII &&
+	    state->interface != PHY_INTERFACE_MODE_REVMII) {
+		phylink_set(mask, 1000baseT_Full);
+		phylink_set(mask, 1000baseT_Half);
+	}
+
+	phylink_set(mask, 10baseT_Half);
+	phylink_set(mask, 10baseT_Full);
+	phylink_set(mask, 100baseT_Half);
+	phylink_set(mask, 100baseT_Full);
+
+	bitmap_and(supported, supported, mask,
+		   __ETHTOOL_LINK_MODE_MASK_NBITS);
+	bitmap_and(state->advertising, state->advertising, mask,
+		   __ETHTOOL_LINK_MODE_MASK_NBITS);
+}
+
+
+static void rtl838x_mac_config(struct phylink_config *config,
+			       unsigned int mode,
+			       const struct phylink_link_state *state)
+{
+	/* This is only being called for the master device,
+	 * i.e. the CPU-Port. We don't need to do anything.
+	 */
+
+	pr_info("In %s, mode %x\n", __func__, mode);
+}
+
+static void rtl838x_mac_an_restart(struct phylink_config *config)
+{
+	struct net_device *dev = container_of(config->dev, struct net_device, dev);
+	struct rtl838x_eth_priv *priv = netdev_priv(dev);
+
+	/* This works only on RTL838x chips */
+	if (priv->family_id != RTL8380_FAMILY_ID)
+		return;
+
+	pr_debug("In %s\n", __func__);
+	/* Restart by disabling and re-enabling link */
+	sw_w32(0x6192D, priv->r->mac_force_mode_ctrl + priv->cpu_port * 4);
+	mdelay(20);
+	sw_w32(0x6192F, priv->r->mac_force_mode_ctrl + priv->cpu_port * 4);
+}
+
+static void rtl838x_mac_pcs_get_state(struct phylink_config *config,
+				  struct phylink_link_state *state)
+{
+	u32 speed;
+	struct net_device *dev = container_of(config->dev, struct net_device, dev);
+	struct rtl838x_eth_priv *priv = netdev_priv(dev);
+	int port = priv->cpu_port;
+
+	pr_info("In %s\n", __func__);
+
+	state->link = priv->r->get_mac_link_sts(port) ? 1 : 0;
+	state->duplex = priv->r->get_mac_link_dup_sts(port) ? 1 : 0;
+
+	pr_info("%s link status is %d\n", __func__, state->link);
+	speed = priv->r->get_mac_link_spd_sts(port);
+	switch (speed) {
+	case 0:
+		state->speed = SPEED_10;
+		break;
+	case 1:
+		state->speed = SPEED_100;
+		break;
+	case 2:
+		state->speed = SPEED_1000;
+		break;
+	case 5:
+		state->speed = SPEED_2500;
+		break;
+	case 6:
+		state->speed = SPEED_5000;
+		break;
+	case 4:
+		state->speed = SPEED_10000;
+		break;
+	default:
+		state->speed = SPEED_UNKNOWN;
+		break;
+	}
+
+	state->pause &= (MLO_PAUSE_RX | MLO_PAUSE_TX);
+	if (priv->r->get_mac_rx_pause_sts(port))
+		state->pause |= MLO_PAUSE_RX;
+	if (priv->r->get_mac_tx_pause_sts(port))
+		state->pause |= MLO_PAUSE_TX;
+}
+
+static void rtl838x_mac_link_down(struct phylink_config *config,
+				  unsigned int mode,
+				  phy_interface_t interface)
+{
+	struct net_device *dev = container_of(config->dev, struct net_device, dev);
+	struct rtl838x_eth_priv *priv = netdev_priv(dev);
+
+	pr_debug("In %s\n", __func__);
+	/* Stop TX/RX to port */
+	sw_w32_mask(0x03, 0, priv->r->mac_port_ctrl(priv->cpu_port));
+}
+
+static void rtl838x_mac_link_up(struct phylink_config *config,
+			    struct phy_device *phy, unsigned int mode,
+			    phy_interface_t interface, int speed, int duplex,
+			    bool tx_pause, bool rx_pause)
+{
+	struct net_device *dev = container_of(config->dev, struct net_device, dev);
+	struct rtl838x_eth_priv *priv = netdev_priv(dev);
+
+	pr_debug("In %s\n", __func__);
+	/* Restart TX/RX to port */
+	sw_w32_mask(0, 0x03, priv->r->mac_port_ctrl(priv->cpu_port));
+}
+
+static void rtl838x_set_mac_hw(struct net_device *dev, u8 *mac)
+{
+	struct rtl838x_eth_priv *priv = netdev_priv(dev);
+	unsigned long flags;
+
+	spin_lock_irqsave(&priv->lock, flags);
+	pr_debug("In %s\n", __func__);
+	sw_w32((mac[0] << 8) | mac[1], priv->r->mac);
+	sw_w32((mac[2] << 24) | (mac[3] << 16) | (mac[4] << 8) | mac[5], priv->r->mac + 4);
+
+	if (priv->family_id == RTL8380_FAMILY_ID) {
+		/* 2 more registers, ALE/MAC block */
+		sw_w32((mac[0] << 8) | mac[1], RTL838X_MAC_ALE);
+		sw_w32((mac[2] << 24) | (mac[3] << 16) | (mac[4] << 8) | mac[5],
+		       (RTL838X_MAC_ALE + 4));
+
+		sw_w32((mac[0] << 8) | mac[1], RTL838X_MAC2);
+		sw_w32((mac[2] << 24) | (mac[3] << 16) | (mac[4] << 8) | mac[5],
+		       RTL838X_MAC2 + 4);
+	}
+	spin_unlock_irqrestore(&priv->lock, flags);
+}
+
+static int rtl838x_set_mac_address(struct net_device *dev, void *p)
+{
+	struct rtl838x_eth_priv *priv = netdev_priv(dev);
+	const struct sockaddr *addr = p;
+	u8 *mac = (u8 *) (addr->sa_data);
+
+	if (!is_valid_ether_addr(addr->sa_data))
+		return -EADDRNOTAVAIL;
+
+	dev_addr_set(dev, addr->sa_data);
+	rtl838x_set_mac_hw(dev, mac);
+
+	pr_info("Using MAC %08x%08x\n", sw_r32(priv->r->mac), sw_r32(priv->r->mac + 4));
+
+	return 0;
+}
+
+static int rtl8390_init_mac(struct rtl838x_eth_priv *priv)
+{
+	/* We will need to set-up EEE and the egress-rate limitation */
+	return 0;
+}
+
+static int rtl8380_init_mac(struct rtl838x_eth_priv *priv)
+{
+	if (priv->family_id == 0x8390)
+		return rtl8390_init_mac(priv);
+
+	/* At present we do not know how to set up EEE on any other SoC than RTL8380 */
+	if (priv->family_id != 0x8380)
+		return 0;
+
+	pr_info("%s\n", __func__);
+	/* fix timer for EEE */
+	sw_w32(0x5001411, RTL838X_EEE_TX_TIMER_GIGA_CTRL);
+	sw_w32(0x5001417, RTL838X_EEE_TX_TIMER_GELITE_CTRL);
+
+	/* Init VLAN. TODO: Understand what is being done, here */
+	if (priv->id == 0x8382) {
+		for (int i = 0; i <= 28; i++)
+			sw_w32(0, 0xd57c + i * 0x80);
+	}
+	if (priv->id == 0x8380) {
+		for (int i = 8; i <= 28; i++)
+			sw_w32(0, 0xd57c + i * 0x80);
+	}
+
+	return 0;
+}
+
+static int rtl838x_get_link_ksettings(struct net_device *ndev,
+				      struct ethtool_link_ksettings *cmd)
+{
+	struct rtl838x_eth_priv *priv = netdev_priv(ndev);
+
+	pr_debug("%s called\n", __func__);
+
+	return phylink_ethtool_ksettings_get(priv->phylink, cmd);
+}
+
+static int rtl838x_set_link_ksettings(struct net_device *ndev,
+				      const struct ethtool_link_ksettings *cmd)
+{
+	struct rtl838x_eth_priv *priv = netdev_priv(ndev);
+
+	pr_debug("%s called\n", __func__);
+
+	return phylink_ethtool_ksettings_set(priv->phylink, cmd);
+}
+
+static int rtl838x_mdio_read_paged(struct mii_bus *bus, int mii_id, u16 page, int regnum)
+{
+	u32 val;
+	int err;
+	struct rtl838x_eth_priv *priv = bus->priv;
+
+	if (mii_id >= 24 && mii_id <= 27 && priv->id == 0x8380)
+		return rtl838x_read_sds_phy(mii_id, regnum);
+
+	if (regnum & (MII_ADDR_C45 | MII_ADDR_C22_MMD)) {
+		err = rtl838x_read_mmd_phy(mii_id,
+					   mdiobus_c45_devad(regnum),
+					   regnum, &val);
+		pr_debug("MMD: %d dev %x register %x read %x, err %d\n", mii_id,
+			 mdiobus_c45_devad(regnum), mdiobus_c45_regad(regnum),
+			 val, err);
+	} else {
+		pr_debug("PHY: %d register %x read %x, err %d\n", mii_id, regnum, val, err);
+		err = rtl838x_read_phy(mii_id, page, regnum, &val);
+	}
+	if (err)
+		return err;
+
+	return val;
+}
+
+static int rtl838x_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
+{
+	return rtl838x_mdio_read_paged(bus, mii_id, 0, regnum);
+}
+
+static int rtl839x_mdio_read_paged(struct mii_bus *bus, int mii_id, u16 page, int regnum)
+{
+	u32 val;
+	int err;
+	struct rtl838x_eth_priv *priv = bus->priv;
+
+	if (mii_id >= 48 && mii_id <= 49 && priv->id == 0x8393)
+		return rtl839x_read_sds_phy(mii_id, regnum);
+
+	if (regnum & (MII_ADDR_C45 | MII_ADDR_C22_MMD)) {
+		err = rtl839x_read_mmd_phy(mii_id,
+					   mdiobus_c45_devad(regnum),
+					   regnum, &val);
+		pr_debug("MMD: %d dev %x register %x read %x, err %d\n", mii_id,
+			 mdiobus_c45_devad(regnum), mdiobus_c45_regad(regnum),
+			 val, err);
+	} else {
+		err = rtl839x_read_phy(mii_id, page, regnum, &val);
+		pr_debug("PHY: %d register %x read %x, err %d\n", mii_id, regnum, val, err);
+	}
+
+	if (err)
+		return err;
+
+	return val;
+}
+
+static int rtl839x_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
+{
+	return rtl839x_mdio_read_paged(bus, mii_id, 0, regnum);
+}
+
+static int rtl930x_mdio_read_paged(struct mii_bus *bus, int mii_id, u16 page, int regnum)
+{
+	u32 val;
+	int err;
+	struct rtl838x_eth_priv *priv = bus->priv;
+
+	if (priv->phy_is_internal[mii_id])
+		return rtl930x_read_sds_phy(priv->sds_id[mii_id], page, regnum);
+
+	if (regnum & (MII_ADDR_C45 | MII_ADDR_C22_MMD)) {
+		err = rtl930x_read_mmd_phy(mii_id,
+					   mdiobus_c45_devad(regnum),
+					   regnum, &val);
+		pr_debug("MMD: %d dev %x register %x read %x, err %d\n", mii_id,
+			 mdiobus_c45_devad(regnum), mdiobus_c45_regad(regnum),
+			 val, err);
+	} else {
+		err = rtl930x_read_phy(mii_id, page, regnum, &val);
+		pr_debug("PHY: %d register %x read %x, err %d\n", mii_id, regnum, val, err);
+	}
+
+	if (err)
+		return err;
+
+	return val;
+}
+
+static int rtl930x_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
+{
+	return rtl930x_mdio_read_paged(bus, mii_id, 0, regnum);
+}
+
+static int rtl931x_mdio_read_paged(struct mii_bus *bus, int mii_id, u16 page, int regnum)
+{
+	u32 val;
+	int err, v;
+	struct rtl838x_eth_priv *priv = bus->priv;
+
+	pr_debug("%s: In here, port %d\n", __func__, mii_id);
+	if (priv->phy_is_internal[mii_id]) {
+		v = rtl931x_read_sds_phy(priv->sds_id[mii_id], page, regnum);
+		if (v < 0) {
+			err = v;
+		} else {
+			err = 0;
+			val = v;
+		}
+	} else {
+		if (regnum & (MII_ADDR_C45 | MII_ADDR_C22_MMD)) {
+			err = rtl931x_read_mmd_phy(mii_id,
+						   mdiobus_c45_devad(regnum),
+						   regnum, &val);
+			pr_debug("MMD: %d dev %x register %x read %x, err %d\n", mii_id,
+				 mdiobus_c45_devad(regnum), mdiobus_c45_regad(regnum),
+				 val, err);
+		} else {
+			err = rtl931x_read_phy(mii_id, page, regnum, &val);
+			pr_debug("PHY: %d register %x read %x, err %d\n", mii_id, regnum, val, err);
+		}
+	}
+
+	if (err)
+		return err;
+
+	return val;
+}
+
+static int rtl931x_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
+{
+	return rtl931x_mdio_read_paged(bus, mii_id, 0, regnum);
+}
+
+static int rtl838x_mdio_write_paged(struct mii_bus *bus, int mii_id, u16 page,
+				    int regnum, u16 value)
+{
+	u32 offset = 0;
+	struct rtl838x_eth_priv *priv = bus->priv;
+	int err;
+
+	if (mii_id >= 24 && mii_id <= 27 && priv->id == 0x8380) {
+		if (mii_id == 26)
+			offset = 0x100;
+		sw_w32(value, RTL838X_SDS4_FIB_REG0 + offset + (regnum << 2));
+		return 0;
+	}
+
+	if (regnum & (MII_ADDR_C45 | MII_ADDR_C22_MMD)) {
+		err = rtl838x_write_mmd_phy(mii_id, mdiobus_c45_devad(regnum),
+					    regnum, value);
+		pr_debug("MMD: %d dev %x register %x write %x, err %d\n", mii_id,
+			 mdiobus_c45_devad(regnum), mdiobus_c45_regad(regnum),
+			 value, err);
+
+		return err;
+	}
+	err = rtl838x_write_phy(mii_id, page, regnum, value);
+	pr_debug("PHY: %d register %x write %x, err %d\n", mii_id, regnum, value, err);
+
+	return err;
+}
+
+static int rtl838x_mdio_write(struct mii_bus *bus, int mii_id,
+			      int regnum, u16 value)
+{
+	return rtl838x_mdio_write_paged(bus, mii_id, 0, regnum, value);
+}
+
+static int rtl839x_mdio_write_paged(struct mii_bus *bus, int mii_id, u16 page,
+				    int regnum, u16 value)
+{
+	struct rtl838x_eth_priv *priv = bus->priv;
+	int err;
+
+	if (mii_id >= 48 && mii_id <= 49 && priv->id == 0x8393)
+		return rtl839x_write_sds_phy(mii_id, regnum, value);
+
+	if (regnum & (MII_ADDR_C45 | MII_ADDR_C22_MMD)) {
+		err = rtl839x_write_mmd_phy(mii_id, mdiobus_c45_devad(regnum),
+					    regnum, value);
+		pr_debug("MMD: %d dev %x register %x write %x, err %d\n", mii_id,
+			 mdiobus_c45_devad(regnum), mdiobus_c45_regad(regnum),
+			 value, err);
+
+		return err;
+	}
+
+	err = rtl839x_write_phy(mii_id, page, regnum, value);
+	pr_debug("PHY: %d register %x write %x, err %d\n", mii_id, regnum, value, err);
+
+	return err;
+}
+
+static int rtl839x_mdio_write(struct mii_bus *bus, int mii_id,
+			      int regnum, u16 value)
+{
+	return rtl839x_mdio_write_paged(bus, mii_id, 0, regnum, value);
+}
+
+static int rtl930x_mdio_write_paged(struct mii_bus *bus, int mii_id, u16 page,
+				    int regnum, u16 value)
+{
+	struct rtl838x_eth_priv *priv = bus->priv;
+	int err;
+
+	if (priv->phy_is_internal[mii_id])
+		return rtl930x_write_sds_phy(priv->sds_id[mii_id], page, regnum, value);
+
+	if (regnum & (MII_ADDR_C45 | MII_ADDR_C22_MMD))
+		return rtl930x_write_mmd_phy(mii_id, mdiobus_c45_devad(regnum),
+					     regnum, value);
+
+	err = rtl930x_write_phy(mii_id, page, regnum, value);
+	pr_debug("PHY: %d register %x write %x, err %d\n", mii_id, regnum, value, err);
+
+	return err;
+}
+
+static int rtl930x_mdio_write(struct mii_bus *bus, int mii_id,
+			      int regnum, u16 value)
+{
+	return rtl930x_mdio_write_paged(bus, mii_id, 0, regnum, value);
+}
+
+static int rtl931x_mdio_write_paged(struct mii_bus *bus, int mii_id, u16 page,
+				    int regnum, u16 value)
+{
+	struct rtl838x_eth_priv *priv = bus->priv;
+	int err;
+
+	if (priv->phy_is_internal[mii_id])
+		return rtl931x_write_sds_phy(priv->sds_id[mii_id], page, regnum, value);
+
+	if (regnum & (MII_ADDR_C45 | MII_ADDR_C22_MMD)) {
+		err = rtl931x_write_mmd_phy(mii_id, mdiobus_c45_devad(regnum),
+					    regnum, value);
+		pr_debug("MMD: %d dev %x register %x write %x, err %d\n", mii_id,
+			 mdiobus_c45_devad(regnum), mdiobus_c45_regad(regnum),
+			 value, err);
+
+		return err;
+	}
+
+	err = rtl931x_write_phy(mii_id, page, regnum, value);
+	pr_debug("PHY: %d register %x write %x, err %d\n", mii_id, regnum, value, err);
+
+	return err;
+}
+
+static int rtl931x_mdio_write(struct mii_bus *bus, int mii_id,
+			      int regnum, u16 value)
+{
+	return rtl931x_mdio_write_paged(bus, mii_id, 0, regnum, value);
+}
+
+static int rtl838x_mdio_reset(struct mii_bus *bus)
+{
+	pr_debug("%s called\n", __func__);
+	/* Disable MAC polling the PHY so that we can start configuration */
+	sw_w32(0x00000000, RTL838X_SMI_POLL_CTRL);
+
+	/* Enable PHY control via SoC */
+	sw_w32_mask(0, 1 << 15, RTL838X_SMI_GLB_CTRL);
+
+	/* Probably should reset all PHYs here... */
+	return 0;
+}
+
+static int rtl839x_mdio_reset(struct mii_bus *bus)
+{
+	return 0;
+
+	pr_debug("%s called\n", __func__);
+	/* BUG: The following does not work, but should! */
+	/* Disable MAC polling the PHY so that we can start configuration */
+	sw_w32(0x00000000, RTL839X_SMI_PORT_POLLING_CTRL);
+	sw_w32(0x00000000, RTL839X_SMI_PORT_POLLING_CTRL + 4);
+	/* Disable PHY polling via SoC */
+	sw_w32_mask(1 << 7, 0, RTL839X_SMI_GLB_CTRL);
+
+	/* Probably should reset all PHYs here... */
+	return 0;
+}
+
+u8 mac_type_bit[RTL930X_CPU_PORT] = {0, 0, 0, 0, 2, 2, 2, 2, 4, 4, 4, 4, 6, 6, 6, 6,
+				     8, 8, 8, 8, 10, 10, 10, 10, 12, 15, 18, 21};
+
+static int rtl930x_mdio_reset(struct mii_bus *bus)
+{
+	struct rtl838x_eth_priv *priv = bus->priv;
+	u32 c45_mask = 0;
+	u32 poll_sel[2];
+	u32 poll_ctrl = 0;
+	u32 private_poll_mask = 0;
+	u32 v;
+	bool uses_usxgmii = false; /* For the Aquantia PHYs */
+	bool uses_hisgmii = false; /* For the RTL8221/8226 */
+
+	/* Mapping of port to phy-addresses on an SMI bus */
+	poll_sel[0] = poll_sel[1] = 0;
+	for (int i = 0; i < RTL930X_CPU_PORT; i++) {
+		int pos;
+
+		if (priv->smi_bus[i] > 3)
+			continue;
+		pos = (i % 6) * 5;
+		sw_w32_mask(0x1f << pos, priv->smi_addr[i] << pos,
+			    RTL930X_SMI_PORT0_5_ADDR + (i / 6) * 4);
+
+		pos = (i * 2) % 32;
+		poll_sel[i / 16] |= priv->smi_bus[i] << pos;
+		poll_ctrl |= BIT(20 + priv->smi_bus[i]);
+	}
+
+	/* Configure which SMI bus is behind which port number */
+	sw_w32(poll_sel[0], RTL930X_SMI_PORT0_15_POLLING_SEL);
+	sw_w32(poll_sel[1], RTL930X_SMI_PORT16_27_POLLING_SEL);
+
+	/* Disable POLL_SEL for any SMI bus with a normal PHY (not RTL8295R for SFP+) */
+	sw_w32_mask(poll_ctrl, 0, RTL930X_SMI_GLB_CTRL);
+
+	/* Configure which SMI busses are polled in c45 based on a c45 PHY being on that bus */
+	for (int i = 0; i < 4; i++)
+		if (priv->smi_bus_isc45[i])
+			c45_mask |= BIT(i + 16);
+
+	pr_info("c45_mask: %08x\n", c45_mask);
+	sw_w32_mask(0, c45_mask, RTL930X_SMI_GLB_CTRL);
+
+	/* Set the MAC type of each port according to the PHY-interface */
+	/* Values are FE: 2, GE: 3, XGE/2.5G: 0(SERDES) or 1(otherwise), SXGE: 0 */
+	v = 0;
+	for (int i = 0; i < RTL930X_CPU_PORT; i++) {
+		switch (priv->interfaces[i]) {
+		case PHY_INTERFACE_MODE_10GBASER:
+			break;			/* Serdes: Value = 0 */
+		case PHY_INTERFACE_MODE_HSGMII:
+			private_poll_mask |= BIT(i);
+			fallthrough;
+		case PHY_INTERFACE_MODE_USXGMII:
+			v |= BIT(mac_type_bit[i]);
+			uses_usxgmii = true;
+			break;
+		case PHY_INTERFACE_MODE_QSGMII:
+			private_poll_mask |= BIT(i);
+			v |= 3 << mac_type_bit[i];
+			break;
+		default:
+			break;
+		}
+	}
+	sw_w32(v, RTL930X_SMI_MAC_TYPE_CTRL);
+
+	/* Set the private polling mask for all Realtek PHYs (i.e. not the 10GBit Aquantia ones) */
+	sw_w32(private_poll_mask, RTL930X_SMI_PRVTE_POLLING_CTRL);
+
+	/* The following magic values are found in the port configuration, they seem to
+	 * define different ways of polling a PHY. The below is for the Aquantia PHYs of
+	 * the XGS1250 and the RTL8226 of the XGS1210
+	 */
+	if (uses_usxgmii) {
+		sw_w32(0x01010000, RTL930X_SMI_10GPHY_POLLING_REG0_CFG);
+		sw_w32(0x01E7C400, RTL930X_SMI_10GPHY_POLLING_REG9_CFG);
+		sw_w32(0x01E7E820, RTL930X_SMI_10GPHY_POLLING_REG10_CFG);
+	}
+	if (uses_hisgmii) {
+		sw_w32(0x011FA400, RTL930X_SMI_10GPHY_POLLING_REG0_CFG);
+		sw_w32(0x013FA412, RTL930X_SMI_10GPHY_POLLING_REG9_CFG);
+		sw_w32(0x017FA414, RTL930X_SMI_10GPHY_POLLING_REG10_CFG);
+	}
+
+	pr_debug("%s: RTL930X_SMI_GLB_CTRL %08x\n", __func__,
+		 sw_r32(RTL930X_SMI_GLB_CTRL));
+	pr_debug("%s: RTL930X_SMI_PORT0_15_POLLING_SEL %08x\n", __func__,
+		 sw_r32(RTL930X_SMI_PORT0_15_POLLING_SEL));
+	pr_debug("%s: RTL930X_SMI_PORT16_27_POLLING_SEL %08x\n", __func__,
+		 sw_r32(RTL930X_SMI_PORT16_27_POLLING_SEL));
+	pr_debug("%s: RTL930X_SMI_MAC_TYPE_CTRL %08x\n", __func__,
+		 sw_r32(RTL930X_SMI_MAC_TYPE_CTRL));
+	pr_debug("%s: RTL930X_SMI_10GPHY_POLLING_REG0_CFG %08x\n", __func__,
+		 sw_r32(RTL930X_SMI_10GPHY_POLLING_REG0_CFG));
+	pr_debug("%s: RTL930X_SMI_10GPHY_POLLING_REG9_CFG %08x\n", __func__,
+		 sw_r32(RTL930X_SMI_10GPHY_POLLING_REG9_CFG));
+	pr_debug("%s: RTL930X_SMI_10GPHY_POLLING_REG10_CFG %08x\n", __func__,
+		 sw_r32(RTL930X_SMI_10GPHY_POLLING_REG10_CFG));
+	pr_debug("%s: RTL930X_SMI_PRVTE_POLLING_CTRL %08x\n", __func__,
+		 sw_r32(RTL930X_SMI_PRVTE_POLLING_CTRL));
+
+	return 0;
+}
+
+static int rtl931x_mdio_reset(struct mii_bus *bus)
+{
+	struct rtl838x_eth_priv *priv = bus->priv;
+	u32 c45_mask = 0;
+	u32 poll_sel[4];
+	u32 poll_ctrl = 0;
+	bool mdc_on[4];
+
+	pr_info("%s called\n", __func__);
+	/* Disable port polling for configuration purposes */
+	sw_w32(0, RTL931X_SMI_PORT_POLLING_CTRL);
+	sw_w32(0, RTL931X_SMI_PORT_POLLING_CTRL + 4);
+	msleep(100);
+
+	mdc_on[0] = mdc_on[1] = mdc_on[2] = mdc_on[3] = false;
+	/* Mapping of port to phy-addresses on an SMI bus */
+	poll_sel[0] = poll_sel[1] = poll_sel[2] = poll_sel[3] = 0;
+	for (int i = 0; i < 56; i++) {
+		u32 pos;
+
+		pos = (i % 6) * 5;
+		sw_w32_mask(0x1f << pos, priv->smi_addr[i] << pos, RTL931X_SMI_PORT_ADDR + (i / 6) * 4);
+		pos = (i * 2) % 32;
+		poll_sel[i / 16] |= priv->smi_bus[i] << pos;
+		poll_ctrl |= BIT(20 + priv->smi_bus[i]);
+		mdc_on[priv->smi_bus[i]] = true;
+	}
+
+	/* Configure which SMI bus is behind which port number */
+	for (int i = 0; i < 4; i++) {
+		pr_info("poll sel %d, %08x\n", i, poll_sel[i]);
+		sw_w32(poll_sel[i], RTL931X_SMI_PORT_POLLING_SEL + (i * 4));
+	}
+
+	/* Configure which SMI busses */
+	pr_info("%s: WAS RTL931X_MAC_L2_GLOBAL_CTRL2 %08x\n", __func__, sw_r32(RTL931X_MAC_L2_GLOBAL_CTRL2));
+	pr_info("c45_mask: %08x, RTL931X_SMI_GLB_CTRL0 was %X", c45_mask, sw_r32(RTL931X_SMI_GLB_CTRL0));
+	for (int i = 0; i < 4; i++) {
+		/* bus is polled in c45 */
+		if (priv->smi_bus_isc45[i])
+			c45_mask |= 0x2 << (i * 2);  /* Std. C45, non-standard is 0x3 */
+		/* Enable bus access via MDC */
+		if (mdc_on[i])
+			sw_w32_mask(0, BIT(9 + i), RTL931X_MAC_L2_GLOBAL_CTRL2);
+	}
+
+	pr_info("%s: RTL931X_MAC_L2_GLOBAL_CTRL2 %08x\n", __func__, sw_r32(RTL931X_MAC_L2_GLOBAL_CTRL2));
+	pr_info("c45_mask: %08x, RTL931X_SMI_GLB_CTRL0 was %X", c45_mask, sw_r32(RTL931X_SMI_GLB_CTRL0));
+
+	/* We have a 10G PHY enable polling
+	 * sw_w32(0x01010000, RTL931X_SMI_10GPHY_POLLING_SEL2);
+	 * sw_w32(0x01E7C400, RTL931X_SMI_10GPHY_POLLING_SEL3);
+	 * sw_w32(0x01E7E820, RTL931X_SMI_10GPHY_POLLING_SEL4);
+	 */
+	sw_w32_mask(0xff, c45_mask, RTL931X_SMI_GLB_CTRL1);
+
+	return 0;
+}
+
+static int rtl931x_chip_init(struct rtl838x_eth_priv *priv)
+{
+	pr_info("In %s\n", __func__);
+
+	/* Initialize Encapsulation memory and wait until finished */
+	sw_w32(0x1, RTL931X_MEM_ENCAP_INIT);
+	do { } while (sw_r32(RTL931X_MEM_ENCAP_INIT) & 1);
+	pr_info("%s: init ENCAP done\n", __func__);
+
+	/* Initialize Managemen Information Base memory and wait until finished */
+	sw_w32(0x1, RTL931X_MEM_MIB_INIT);
+	do { } while (sw_r32(RTL931X_MEM_MIB_INIT) & 1);
+	pr_info("%s: init MIB done\n", __func__);
+
+	/* Initialize ACL (PIE) memory and wait until finished */
+	sw_w32(0x1, RTL931X_MEM_ACL_INIT);
+	do { } while (sw_r32(RTL931X_MEM_ACL_INIT) & 1);
+	pr_info("%s: init ACL done\n", __func__);
+
+	/* Initialize ALE memory and wait until finished */
+	sw_w32(0xFFFFFFFF, RTL931X_MEM_ALE_INIT_0);
+	do { } while (sw_r32(RTL931X_MEM_ALE_INIT_0));
+	sw_w32(0x7F, RTL931X_MEM_ALE_INIT_1);
+	sw_w32(0x7ff, RTL931X_MEM_ALE_INIT_2);
+	do { } while (sw_r32(RTL931X_MEM_ALE_INIT_2) & 0x7ff);
+	pr_info("%s: init ALE done\n", __func__);
+
+	/* Enable ESD auto recovery */
+	sw_w32(0x1, RTL931X_MDX_CTRL_RSVD);
+
+	/* Init SPI, is this for thermal control or what? */
+	sw_w32_mask(0x7 << 11, 0x2 << 11, RTL931X_SPI_CTRL0);
+
+	return 0;
+}
+
+static int rtl838x_mdio_init(struct rtl838x_eth_priv *priv)
+{
+	struct device_node *mii_np, *dn;
+	u32 pn;
+	int ret;
+
+	pr_debug("%s called\n", __func__);
+	mii_np = of_get_child_by_name(priv->pdev->dev.of_node, "mdio-bus");
+
+	if (!mii_np) {
+		dev_err(&priv->pdev->dev, "no %s child node found", "mdio-bus");
+		return -ENODEV;
+	}
+
+	if (!of_device_is_available(mii_np)) {
+		ret = -ENODEV;
+		goto err_put_node;
+	}
+
+	priv->mii_bus = devm_mdiobus_alloc(&priv->pdev->dev);
+	if (!priv->mii_bus) {
+		ret = -ENOMEM;
+		goto err_put_node;
+	}
+
+	switch(priv->family_id) {
+	case RTL8380_FAMILY_ID:
+		priv->mii_bus->name = "rtl838x-eth-mdio";
+		priv->mii_bus->read = rtl838x_mdio_read;
+		priv->mii_bus->read_paged = rtl838x_mdio_read_paged;
+		priv->mii_bus->write = rtl838x_mdio_write;
+		priv->mii_bus->write_paged = rtl838x_mdio_write_paged;
+		priv->mii_bus->reset = rtl838x_mdio_reset;
+		break;
+	case RTL8390_FAMILY_ID:
+		priv->mii_bus->name = "rtl839x-eth-mdio";
+		priv->mii_bus->read = rtl839x_mdio_read;
+		priv->mii_bus->read_paged = rtl839x_mdio_read_paged;
+		priv->mii_bus->write = rtl839x_mdio_write;
+		priv->mii_bus->write_paged = rtl839x_mdio_write_paged;
+		priv->mii_bus->reset = rtl839x_mdio_reset;
+		break;
+	case RTL9300_FAMILY_ID:
+		priv->mii_bus->name = "rtl930x-eth-mdio";
+		priv->mii_bus->read = rtl930x_mdio_read;
+		priv->mii_bus->read_paged = rtl930x_mdio_read_paged;
+		priv->mii_bus->write = rtl930x_mdio_write;
+		priv->mii_bus->write_paged = rtl930x_mdio_write_paged;
+		priv->mii_bus->reset = rtl930x_mdio_reset;
+		priv->mii_bus->probe_capabilities = MDIOBUS_C22_C45;
+		break;
+	case RTL9310_FAMILY_ID:
+		priv->mii_bus->name = "rtl931x-eth-mdio";
+		priv->mii_bus->read = rtl931x_mdio_read;
+		priv->mii_bus->read_paged = rtl931x_mdio_read_paged;
+		priv->mii_bus->write = rtl931x_mdio_write;
+		priv->mii_bus->write_paged = rtl931x_mdio_write_paged;
+		priv->mii_bus->reset = rtl931x_mdio_reset;
+		priv->mii_bus->probe_capabilities = MDIOBUS_C22_C45;
+		break;
+	}
+	priv->mii_bus->access_capabilities = MDIOBUS_ACCESS_C22_MMD;
+	priv->mii_bus->priv = priv;
+	priv->mii_bus->parent = &priv->pdev->dev;
+
+	for_each_node_by_name(dn, "ethernet-phy") {
+		u32 smi_addr[2];
+
+		if (of_property_read_u32(dn, "reg", &pn))
+			continue;
+
+		if (of_property_read_u32_array(dn, "rtl9300,smi-address", &smi_addr[0], 2)) {
+			smi_addr[0] = 0;
+			smi_addr[1] = pn;
+		}
+
+		if (of_property_read_u32(dn, "sds", &priv->sds_id[pn]))
+			priv->sds_id[pn] = -1;
+		else {
+			pr_info("set sds port %d to %d\n", pn, priv->sds_id[pn]);
+		}
+
+		if (pn < MAX_PORTS) {
+			priv->smi_bus[pn] = smi_addr[0];
+			priv->smi_addr[pn] = smi_addr[1];
+		} else {
+			pr_err("%s: illegal port number %d\n", __func__, pn);
+		}
+
+		if (of_device_is_compatible(dn, "ethernet-phy-ieee802.3-c45"))
+			priv->smi_bus_isc45[smi_addr[0]] = true;
+
+		if (of_property_read_bool(dn, "phy-is-integrated")) {
+			priv->phy_is_internal[pn] = true;
+		}
+	}
+
+	dn = of_find_compatible_node(NULL, NULL, "realtek,rtl83xx-switch");
+	if (!dn) {
+		dev_err(&priv->pdev->dev, "No RTL switch node in DTS\n");
+		return -ENODEV;
+	}
+
+	for_each_node_by_name(dn, "port") {
+		if (of_property_read_u32(dn, "reg", &pn))
+			continue;
+		pr_debug("%s Looking at port %d\n", __func__, pn);
+		if (pn > priv->cpu_port)
+			continue;
+		if (of_get_phy_mode(dn, &priv->interfaces[pn]))
+			priv->interfaces[pn] = PHY_INTERFACE_MODE_NA;
+		pr_debug("%s phy mode of port %d is %s\n", __func__, pn, phy_modes(priv->interfaces[pn]));
+	}
+
+	snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%pOFn", mii_np);
+	ret = of_mdiobus_register(priv->mii_bus, mii_np);
+
+err_put_node:
+	of_node_put(mii_np);
+
+	return ret;
+}
+
+static int rtl838x_mdio_remove(struct rtl838x_eth_priv *priv)
+{
+	pr_debug("%s called\n", __func__);
+	if (!priv->mii_bus)
+		return 0;
+
+	mdiobus_unregister(priv->mii_bus);
+	mdiobus_free(priv->mii_bus);
+
+	return 0;
+}
+
+static netdev_features_t rtl838x_fix_features(struct net_device *dev,
+					  netdev_features_t features)
+{
+	return features;
+}
+
+static int rtl83xx_set_features(struct net_device *dev, netdev_features_t features)
+{
+	struct rtl838x_eth_priv *priv = netdev_priv(dev);
+
+	if ((features ^ dev->features) & NETIF_F_RXCSUM) {
+		if (!(features & NETIF_F_RXCSUM))
+			sw_w32_mask(BIT(3), 0, priv->r->mac_port_ctrl(priv->cpu_port));
+		else
+			sw_w32_mask(0, BIT(3), priv->r->mac_port_ctrl(priv->cpu_port));
+	}
+
+	return 0;
+}
+
+static int rtl93xx_set_features(struct net_device *dev, netdev_features_t features)
+{
+	struct rtl838x_eth_priv *priv = netdev_priv(dev);
+
+	if ((features ^ dev->features) & NETIF_F_RXCSUM) {
+		if (!(features & NETIF_F_RXCSUM))
+			sw_w32_mask(BIT(4), 0, priv->r->mac_port_ctrl(priv->cpu_port));
+		else
+			sw_w32_mask(0, BIT(4), priv->r->mac_port_ctrl(priv->cpu_port));
+	}
+
+	return 0;
+}
+
+static const struct net_device_ops rtl838x_eth_netdev_ops = {
+	.ndo_open = rtl838x_eth_open,
+	.ndo_stop = rtl838x_eth_stop,
+	.ndo_start_xmit = rtl838x_eth_tx,
+	.ndo_select_queue = rtl83xx_pick_tx_queue,
+	.ndo_set_mac_address = rtl838x_set_mac_address,
+	.ndo_validate_addr = eth_validate_addr,
+	.ndo_set_rx_mode = rtl838x_eth_set_multicast_list,
+	.ndo_tx_timeout = rtl838x_eth_tx_timeout,
+	.ndo_set_features = rtl83xx_set_features,
+	.ndo_fix_features = rtl838x_fix_features,
+	.ndo_setup_tc = rtl83xx_setup_tc,
+};
+
+static const struct net_device_ops rtl839x_eth_netdev_ops = {
+	.ndo_open = rtl838x_eth_open,
+	.ndo_stop = rtl838x_eth_stop,
+	.ndo_start_xmit = rtl838x_eth_tx,
+	.ndo_select_queue = rtl83xx_pick_tx_queue,
+	.ndo_set_mac_address = rtl838x_set_mac_address,
+	.ndo_validate_addr = eth_validate_addr,
+	.ndo_set_rx_mode = rtl839x_eth_set_multicast_list,
+	.ndo_tx_timeout = rtl838x_eth_tx_timeout,
+	.ndo_set_features = rtl83xx_set_features,
+	.ndo_fix_features = rtl838x_fix_features,
+	.ndo_setup_tc = rtl83xx_setup_tc,
+};
+
+static const struct net_device_ops rtl930x_eth_netdev_ops = {
+	.ndo_open = rtl838x_eth_open,
+	.ndo_stop = rtl838x_eth_stop,
+	.ndo_start_xmit = rtl838x_eth_tx,
+	.ndo_select_queue = rtl93xx_pick_tx_queue,
+	.ndo_set_mac_address = rtl838x_set_mac_address,
+	.ndo_validate_addr = eth_validate_addr,
+	.ndo_set_rx_mode = rtl930x_eth_set_multicast_list,
+	.ndo_tx_timeout = rtl838x_eth_tx_timeout,
+	.ndo_set_features = rtl93xx_set_features,
+	.ndo_fix_features = rtl838x_fix_features,
+	.ndo_setup_tc = rtl83xx_setup_tc,
+};
+
+static const struct net_device_ops rtl931x_eth_netdev_ops = {
+	.ndo_open = rtl838x_eth_open,
+	.ndo_stop = rtl838x_eth_stop,
+	.ndo_start_xmit = rtl838x_eth_tx,
+	.ndo_select_queue = rtl93xx_pick_tx_queue,
+	.ndo_set_mac_address = rtl838x_set_mac_address,
+	.ndo_validate_addr = eth_validate_addr,
+	.ndo_set_rx_mode = rtl931x_eth_set_multicast_list,
+	.ndo_tx_timeout = rtl838x_eth_tx_timeout,
+	.ndo_set_features = rtl93xx_set_features,
+	.ndo_fix_features = rtl838x_fix_features,
+};
+
+static const struct phylink_mac_ops rtl838x_phylink_ops = {
+	.validate = rtl838x_validate,
+	.mac_pcs_get_state = rtl838x_mac_pcs_get_state,
+	.mac_an_restart = rtl838x_mac_an_restart,
+	.mac_config = rtl838x_mac_config,
+	.mac_link_down = rtl838x_mac_link_down,
+	.mac_link_up = rtl838x_mac_link_up,
+};
+
+static const struct ethtool_ops rtl838x_ethtool_ops = {
+	.get_link_ksettings     = rtl838x_get_link_ksettings,
+	.set_link_ksettings     = rtl838x_set_link_ksettings,
+};
+
+static int __init rtl838x_eth_probe(struct platform_device *pdev)
+{
+	struct net_device *dev;
+	struct device_node *dn = pdev->dev.of_node;
+	struct rtl838x_eth_priv *priv;
+	struct resource *res, *mem;
+	phy_interface_t phy_mode;
+	struct phylink *phylink;
+	u8 mac_addr[ETH_ALEN];
+	int err = 0, rxrings, rxringlen;
+	struct ring_b *ring;
+
+	pr_info("Probing RTL838X eth device pdev: %x, dev: %x\n",
+		(u32)pdev, (u32)(&(pdev->dev)));
+
+	if (!dn) {
+		dev_err(&pdev->dev, "No DT found\n");
+		return -EINVAL;
+	}
+
+	rxrings = (soc_info.family == RTL8380_FAMILY_ID
+			|| soc_info.family == RTL8390_FAMILY_ID) ? 8 : 32;
+	rxrings = rxrings > MAX_RXRINGS ? MAX_RXRINGS : rxrings;
+	rxringlen = MAX_ENTRIES / rxrings;
+	rxringlen = rxringlen > MAX_RXLEN ? MAX_RXLEN : rxringlen;
+
+	dev = alloc_etherdev_mqs(sizeof(struct rtl838x_eth_priv), TXRINGS, rxrings);
+	if (!dev) {
+		err = -ENOMEM;
+		goto err_free;
+	}
+	SET_NETDEV_DEV(dev, &pdev->dev);
+	priv = netdev_priv(dev);
+
+	/* obtain buffer memory space */
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (res) {
+		mem = devm_request_mem_region(&pdev->dev, res->start,
+			resource_size(res), res->name);
+		if (!mem) {
+			dev_err(&pdev->dev, "cannot request memory space\n");
+			err = -ENXIO;
+			goto err_free;
+		}
+
+		dev->mem_start = mem->start;
+		dev->mem_end   = mem->end;
+	} else {
+		dev_err(&pdev->dev, "cannot request IO resource\n");
+		err = -ENXIO;
+		goto err_free;
+	}
+
+	/* Allocate buffer memory */
+	priv->membase = dmam_alloc_coherent(&pdev->dev, rxrings * rxringlen * RING_BUFFER +
+	                                    sizeof(struct ring_b) + sizeof(struct notify_b),
+	                                    (void *)&dev->mem_start, GFP_KERNEL);
+	if (!priv->membase) {
+		dev_err(&pdev->dev, "cannot allocate DMA buffer\n");
+		err = -ENOMEM;
+		goto err_free;
+	}
+
+	/* Allocate ring-buffer space at the end of the allocated memory */
+	ring = priv->membase;
+	ring->rx_space = priv->membase + sizeof(struct ring_b) + sizeof(struct notify_b);
+
+	spin_lock_init(&priv->lock);
+
+	dev->ethtool_ops = &rtl838x_ethtool_ops;
+	dev->min_mtu = ETH_ZLEN;
+	dev->max_mtu = 1536;
+	dev->features = NETIF_F_RXCSUM | NETIF_F_HW_CSUM;
+	dev->hw_features = NETIF_F_RXCSUM;
+
+	priv->id = soc_info.id;
+	priv->family_id = soc_info.family;
+	if (priv->id) {
+		pr_info("Found SoC ID: %4x: %s, family %x\n",
+			priv->id, soc_info.name, priv->family_id);
+	} else {
+		pr_err("Unknown chip id (%04x)\n", priv->id);
+		return -ENODEV;
+	}
+
+	switch (priv->family_id) {
+	case RTL8380_FAMILY_ID:
+		priv->cpu_port = RTL838X_CPU_PORT;
+		priv->r = &rtl838x_reg;
+		dev->netdev_ops = &rtl838x_eth_netdev_ops;
+		break;
+	case RTL8390_FAMILY_ID:
+		priv->cpu_port = RTL839X_CPU_PORT;
+		priv->r = &rtl839x_reg;
+		dev->netdev_ops = &rtl839x_eth_netdev_ops;
+		break;
+	case RTL9300_FAMILY_ID:
+		priv->cpu_port = RTL930X_CPU_PORT;
+		priv->r = &rtl930x_reg;
+		dev->netdev_ops = &rtl930x_eth_netdev_ops;
+		break;
+	case RTL9310_FAMILY_ID:
+		priv->cpu_port = RTL931X_CPU_PORT;
+		priv->r = &rtl931x_reg;
+		dev->netdev_ops = &rtl931x_eth_netdev_ops;
+		rtl931x_chip_init(priv);
+		break;
+	default:
+		pr_err("Unknown SoC family\n");
+		return -ENODEV;
+	}
+	priv->rxringlen = rxringlen;
+	priv->rxrings = rxrings;
+
+	/* Obtain device IRQ number */
+	dev->irq = platform_get_irq(pdev, 0);
+	if (dev->irq < 0) {
+		dev_err(&pdev->dev, "cannot obtain network-device IRQ\n");
+		goto err_free;
+	}
+
+	err = devm_request_irq(&pdev->dev, dev->irq, priv->r->net_irq,
+			       IRQF_SHARED, dev->name, dev);
+	if (err) {
+		dev_err(&pdev->dev, "%s: could not acquire interrupt: %d\n",
+			   __func__, err);
+		goto err_free;
+	}
+
+	rtl8380_init_mac(priv);
+
+	/* Try to get mac address in the following order:
+	 * 1) from device tree data
+	 * 2) from internal registers set by bootloader
+	 */
+	of_get_mac_address(pdev->dev.of_node, mac_addr);
+	if (is_valid_ether_addr(mac_addr)) {
+		rtl838x_set_mac_hw(dev, mac_addr);
+	} else {
+		mac_addr[0] = (sw_r32(priv->r->mac) >> 8) & 0xff;
+		mac_addr[1] = sw_r32(priv->r->mac) & 0xff;
+		mac_addr[2] = (sw_r32(priv->r->mac + 4) >> 24) & 0xff;
+		mac_addr[3] = (sw_r32(priv->r->mac + 4) >> 16) & 0xff;
+		mac_addr[4] = (sw_r32(priv->r->mac + 4) >> 8) & 0xff;
+		mac_addr[5] = sw_r32(priv->r->mac + 4) & 0xff;
+	}
+	dev_addr_set(dev, mac_addr);
+	/* if the address is invalid, use a random value */
+	if (!is_valid_ether_addr(dev->dev_addr)) {
+		struct sockaddr sa = { AF_UNSPEC };
+
+		netdev_warn(dev, "Invalid MAC address, using random\n");
+		eth_hw_addr_random(dev);
+		memcpy(sa.sa_data, dev->dev_addr, ETH_ALEN);
+		if (rtl838x_set_mac_address(dev, &sa))
+			netdev_warn(dev, "Failed to set MAC address.\n");
+	}
+	pr_info("Using MAC %08x%08x\n", sw_r32(priv->r->mac),
+					sw_r32(priv->r->mac + 4));
+	strcpy(dev->name, "eth%d");
+	priv->pdev = pdev;
+	priv->netdev = dev;
+
+	err = rtl838x_mdio_init(priv);
+	if (err)
+		goto err_free;
+
+	err = register_netdev(dev);
+	if (err)
+		goto err_free;
+
+	for (int i = 0; i < priv->rxrings; i++) {
+		priv->rx_qs[i].id = i;
+		priv->rx_qs[i].priv = priv;
+		netif_napi_add(dev, &priv->rx_qs[i].napi, rtl838x_poll_rx, 64);
+	}
+
+	platform_set_drvdata(pdev, dev);
+
+	phy_mode = PHY_INTERFACE_MODE_NA;
+	err = of_get_phy_mode(dn, &phy_mode);
+	if (err < 0) {
+		dev_err(&pdev->dev, "incorrect phy-mode\n");
+		err = -EINVAL;
+		goto err_free;
+	}
+	priv->phylink_config.dev = &dev->dev;
+	priv->phylink_config.type = PHYLINK_NETDEV;
+
+	phylink = phylink_create(&priv->phylink_config, pdev->dev.fwnode,
+				 phy_mode, &rtl838x_phylink_ops);
+
+	if (IS_ERR(phylink)) {
+		err = PTR_ERR(phylink);
+		goto err_free;
+	}
+	priv->phylink = phylink;
+
+	return 0;
+
+err_free:
+	pr_err("Error setting up netdev, freeing it again.\n");
+	free_netdev(dev);
+
+	return err;
+}
+
+static int rtl838x_eth_remove(struct platform_device *pdev)
+{
+	struct net_device *dev = platform_get_drvdata(pdev);
+	struct rtl838x_eth_priv *priv = netdev_priv(dev);
+
+	if (dev) {
+		pr_info("Removing platform driver for rtl838x-eth\n");
+		rtl838x_mdio_remove(priv);
+		rtl838x_hw_stop(priv);
+
+		netif_tx_stop_all_queues(dev);
+
+		for (int i = 0; i < priv->rxrings; i++)
+			netif_napi_del(&priv->rx_qs[i].napi);
+
+		unregister_netdev(dev);
+		free_netdev(dev);
+	}
+
+	return 0;
+}
+
+static const struct of_device_id rtl838x_eth_of_ids[] = {
+	{ .compatible = "realtek,rtl838x-eth"},
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, rtl838x_eth_of_ids);
+
+static struct platform_driver rtl838x_eth_driver = {
+	.probe = rtl838x_eth_probe,
+	.remove = rtl838x_eth_remove,
+	.driver = {
+		.name = "rtl838x-eth",
+		.pm = NULL,
+		.of_match_table = rtl838x_eth_of_ids,
+	},
+};
+
+module_platform_driver(rtl838x_eth_driver);
+
+MODULE_AUTHOR("B. Koblitz");
+MODULE_DESCRIPTION("RTL838X SoC Ethernet Driver");
+MODULE_LICENSE("GPL");
diff --git a/target/linux/realtek/files-5.15/drivers/net/ethernet/rtl838x_eth.h b/target/linux/realtek/files-5.15/drivers/net/ethernet/rtl838x_eth.h
new file mode 100644
index 00000000000000..7a5ff678a4cde3
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/net/ethernet/rtl838x_eth.h
@@ -0,0 +1,455 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#ifndef _RTL838X_ETH_H
+#define _RTL838X_ETH_H
+
+/* Register definition */
+
+/* Per port MAC control */
+#define RTL838X_MAC_PORT_CTRL			(0xd560)
+#define RTL839X_MAC_PORT_CTRL			(0x8004)
+#define RTL930X_MAC_L2_PORT_CTRL		(0x3268)
+#define RTL930X_MAC_PORT_CTRL			(0x3260)
+#define RTL931X_MAC_L2_PORT_CTRL		(0x6000)
+#define RTL931X_MAC_PORT_CTRL			(0x6004)
+
+/* DMA interrupt control and status registers */
+#define RTL838X_DMA_IF_CTRL			(0x9f58)
+#define RTL838X_DMA_IF_INTR_STS			(0x9f54)
+#define RTL838X_DMA_IF_INTR_MSK			(0x9f50)
+
+#define RTL839X_DMA_IF_CTRL			(0x786c)
+#define RTL839X_DMA_IF_INTR_STS			(0x7868)
+#define RTL839X_DMA_IF_INTR_MSK			(0x7864)
+
+#define RTL930X_DMA_IF_CTRL			(0xe028)
+#define RTL930X_DMA_IF_INTR_RX_RUNOUT_STS	(0xe01C)
+#define RTL930X_DMA_IF_INTR_RX_DONE_STS		(0xe020)
+#define RTL930X_DMA_IF_INTR_TX_DONE_STS		(0xe024)
+#define RTL930X_DMA_IF_INTR_RX_RUNOUT_MSK	(0xe010)
+#define RTL930X_DMA_IF_INTR_RX_DONE_MSK		(0xe014)
+#define RTL930X_DMA_IF_INTR_TX_DONE_MSK		(0xe018)
+#define RTL930X_L2_NTFY_IF_INTR_MSK		(0xe04C)
+#define RTL930X_L2_NTFY_IF_INTR_STS		(0xe050)
+
+/* TODO: RTL931X_DMA_IF_CTRL has different bits meanings */
+#define RTL931X_DMA_IF_CTRL			(0x0928)
+#define RTL931X_DMA_IF_INTR_RX_RUNOUT_STS	(0x091c)
+#define RTL931X_DMA_IF_INTR_RX_DONE_STS		(0x0920)
+#define RTL931X_DMA_IF_INTR_TX_DONE_STS		(0x0924)
+#define RTL931X_DMA_IF_INTR_RX_RUNOUT_MSK	(0x0910)
+#define RTL931X_DMA_IF_INTR_RX_DONE_MSK		(0x0914)
+#define RTL931X_DMA_IF_INTR_TX_DONE_MSK		(0x0918)
+#define RTL931X_L2_NTFY_IF_INTR_MSK		(0x09E4)
+#define RTL931X_L2_NTFY_IF_INTR_STS		(0x09E8)
+
+#define RTL838X_MAC_FORCE_MODE_CTRL		(0xa104)
+#define RTL839X_MAC_FORCE_MODE_CTRL		(0x02bc)
+#define RTL930X_MAC_FORCE_MODE_CTRL		(0xCA1C)
+#define RTL931X_MAC_FORCE_MODE_CTRL		(0x0ddc)
+
+/* MAC address settings */
+#define RTL838X_MAC				(0xa9ec)
+#define RTL839X_MAC				(0x02b4)
+#define RTL838X_MAC_ALE				(0x6b04)
+#define RTL838X_MAC2				(0xa320)
+#define RTL930X_MAC_L2_ADDR_CTRL		(0xC714)
+#define RTL931X_MAC_L2_ADDR_CTRL		(0x135c)
+
+/* Ringbuffer setup */
+#define RTL838X_DMA_RX_BASE			(0x9f00)
+#define RTL839X_DMA_RX_BASE			(0x780c)
+#define RTL930X_DMA_RX_BASE			(0xdf00)
+#define RTL931X_DMA_RX_BASE			(0x0800)
+
+#define RTL838X_DMA_TX_BASE			(0x9f40)
+#define RTL839X_DMA_TX_BASE			(0x784c)
+#define RTL930X_DMA_TX_BASE			(0xe000)
+#define RTL931X_DMA_TX_BASE			(0x0900)
+
+#define RTL838X_DMA_IF_RX_RING_SIZE		(0xB7E4)
+#define RTL839X_DMA_IF_RX_RING_SIZE		(0x6038)
+#define RTL930X_DMA_IF_RX_RING_SIZE		(0x7C60)
+#define RTL931X_DMA_IF_RX_RING_SIZE		(0x2080)
+
+#define RTL838X_DMA_IF_RX_RING_CNTR		(0xB7E8)
+#define RTL839X_DMA_IF_RX_RING_CNTR		(0x603c)
+#define RTL930X_DMA_IF_RX_RING_CNTR		(0x7C8C)
+#define RTL931X_DMA_IF_RX_RING_CNTR		(0x20AC)
+
+#define RTL838X_DMA_IF_RX_CUR			(0x9F20)
+#define RTL839X_DMA_IF_RX_CUR			(0x782c)
+#define RTL930X_DMA_IF_RX_CUR			(0xdf80)
+#define RTL931X_DMA_IF_RX_CUR			(0x0880)
+
+#define RTL838X_DMA_IF_TX_CUR_DESC_ADDR_CTRL	(0x9F48)
+#define RTL930X_DMA_IF_TX_CUR_DESC_ADDR_CTRL	(0xE008)
+
+#define RTL838X_DMY_REG31			(0x3b28)
+#define RTL838X_SDS_MODE_SEL			(0x0028)
+#define RTL838X_SDS_CFG_REG			(0x0034)
+#define RTL838X_INT_MODE_CTRL			(0x005c)
+#define RTL838X_CHIP_INFO			(0x00d8)
+#define RTL838X_SDS4_REG28			(0xef80)
+#define RTL838X_SDS4_DUMMY0			(0xef8c)
+#define RTL838X_SDS5_EXT_REG6			(0xf18c)
+
+/* L2 features */
+#define RTL839X_TBL_ACCESS_L2_CTRL		(0x1180)
+#define RTL839X_TBL_ACCESS_L2_DATA(idx)		(0x1184 + ((idx) << 2))
+#define RTL838X_TBL_ACCESS_CTRL_0		(0x6914)
+#define RTL838X_TBL_ACCESS_DATA_0(idx)		(0x6918 + ((idx) << 2))
+
+/* MAC-side link state handling */
+#define RTL838X_MAC_LINK_STS			(0xa188)
+#define RTL839X_MAC_LINK_STS			(0x0390)
+#define RTL930X_MAC_LINK_STS			(0xCB10)
+#define RTL931X_MAC_LINK_STS			(0x0ec0)
+
+#define RTL838X_MAC_LINK_SPD_STS		(0xa190)
+#define RTL839X_MAC_LINK_SPD_STS		(0x03a0)
+#define RTL930X_MAC_LINK_SPD_STS		(0xCB18)
+#define RTL931X_MAC_LINK_SPD_STS		(0x0ed0)
+
+#define RTL838X_MAC_LINK_DUP_STS		(0xa19c)
+#define RTL839X_MAC_LINK_DUP_STS		(0x03b0)
+#define RTL930X_MAC_LINK_DUP_STS		(0xCB28)
+#define RTL931X_MAC_LINK_DUP_STS		(0x0ef0)
+
+/* TODO: RTL8390_MAC_LINK_MEDIA_STS_ADDR??? */
+
+#define RTL838X_MAC_TX_PAUSE_STS		(0xa1a0)
+#define RTL839X_MAC_TX_PAUSE_STS		(0x03b8)
+#define RTL930X_MAC_TX_PAUSE_STS		(0xCB2C)
+#define RTL931X_MAC_TX_PAUSE_STS		(0x0ef8)
+
+#define RTL838X_MAC_RX_PAUSE_STS		(0xa1a4)
+#define RTL839X_MAC_RX_PAUSE_STS		(0xCB30)
+#define RTL930X_MAC_RX_PAUSE_STS		(0xC2F8)
+#define RTL931X_MAC_RX_PAUSE_STS		(0x0f00)
+
+#define RTL838X_EEE_TX_TIMER_GIGA_CTRL		(0xaa04)
+#define RTL838X_EEE_TX_TIMER_GELITE_CTRL	(0xaa08)
+
+#define RTL930X_L2_UNKN_UC_FLD_PMSK		(0x9064)
+#define RTL931X_L2_UNKN_UC_FLD_PMSK		(0xC8F4)
+
+#define RTL839X_MAC_GLB_CTRL			(0x02a8)
+#define RTL839X_SCHED_LB_TICK_TKN_CTRL		(0x60f8)
+
+#define RTL838X_L2_TBL_FLUSH_CTRL		(0x3370)
+#define RTL839X_L2_TBL_FLUSH_CTRL		(0x3ba0)
+#define RTL930X_L2_TBL_FLUSH_CTRL		(0x9404)
+#define RTL931X_L2_TBL_FLUSH_CTRL		(0xCD9C)
+
+#define RTL930X_L2_PORT_SABLK_CTRL		(0x905c)
+#define RTL930X_L2_PORT_DABLK_CTRL		(0x9060)
+
+/* MAC link state bits */
+#define FORCE_EN				(1 << 0)
+#define FORCE_LINK_EN				(1 << 1)
+#define NWAY_EN					(1 << 2)
+#define DUPLX_MODE				(1 << 3)
+#define TX_PAUSE_EN				(1 << 6)
+#define RX_PAUSE_EN				(1 << 7)
+
+/* L2 Notification DMA interface */
+#define RTL839X_DMA_IF_NBUF_BASE_DESC_ADDR_CTRL	(0x785C)
+#define RTL839X_L2_NOTIFICATION_CTRL		(0x7808)
+#define RTL931X_L2_NTFY_RING_BASE_ADDR		(0x09DC)
+#define RTL931X_L2_NTFY_RING_CUR_ADDR		(0x09E0)
+#define RTL839X_L2_NOTIFICATION_CTRL		(0x7808)
+#define RTL931X_L2_NTFY_CTRL			(0xCDC8)
+#define RTL838X_L2_CTRL_0			(0x3200)
+#define RTL839X_L2_CTRL_0			(0x3800)
+#define RTL930X_L2_CTRL				(0x8FD8)
+#define RTL931X_L2_CTRL				(0xC800)
+
+/* TRAPPING to CPU-PORT */
+#define RTL838X_SPCL_TRAP_IGMP_CTRL		(0x6984)
+#define RTL838X_RMA_CTRL_0			(0x4300)
+#define RTL838X_RMA_CTRL_1			(0x4304)
+#define RTL839X_RMA_CTRL_0			(0x1200)
+
+#define RTL839X_SPCL_TRAP_IGMP_CTRL		(0x1058)
+#define RTL839X_RMA_CTRL_1			(0x1204)
+#define RTL839X_RMA_CTRL_2			(0x1208)
+#define RTL839X_RMA_CTRL_3			(0x120C)
+
+#define RTL930X_VLAN_APP_PKT_CTRL		(0xA23C)
+#define RTL930X_RMA_CTRL_0			(0x9E60)
+#define RTL930X_RMA_CTRL_1			(0x9E64)
+#define RTL930X_RMA_CTRL_2			(0x9E68)
+
+#define RTL931X_VLAN_APP_PKT_CTRL		(0x96b0)
+#define RTL931X_RMA_CTRL_0			(0x8800)
+#define RTL931X_RMA_CTRL_1			(0x8804)
+#define RTL931X_RMA_CTRL_2			(0x8808)
+
+/* Advanced SMI control for clause 45 PHYs */
+#define RTL930X_SMI_MAC_TYPE_CTRL		(0xCA04)
+#define RTL930X_SMI_PORT24_27_ADDR_CTRL		(0xCB90)
+#define RTL930X_SMI_PORT0_15_POLLING_SEL	(0xCA08)
+#define RTL930X_SMI_PORT16_27_POLLING_SEL	(0xCA0C)
+
+#define RTL930X_SMI_10GPHY_POLLING_REG0_CFG	(0xCBB4)
+#define RTL930X_SMI_10GPHY_POLLING_REG9_CFG	(0xCBB8)
+#define RTL930X_SMI_10GPHY_POLLING_REG10_CFG	(0xCBBC)
+#define RTL930X_SMI_PRVTE_POLLING_CTRL		(0xCA10)
+
+/* Registers of the internal Serdes of the 8390 */
+#define RTL839X_SDS12_13_XSG0			(0xB800)
+
+/* Chip configuration registers of the RTL9310 */
+#define RTL931X_MEM_ENCAP_INIT			(0x4854)
+#define RTL931X_MEM_MIB_INIT			(0x7E18)
+#define RTL931X_MEM_ACL_INIT			(0x40BC)
+#define RTL931X_MEM_ALE_INIT_0			(0x83F0)
+#define RTL931X_MEM_ALE_INIT_1			(0x83F4)
+#define RTL931X_MEM_ALE_INIT_2			(0x82E4)
+#define RTL931X_MDX_CTRL_RSVD			(0x0fcc)
+#define RTL931X_PS_SOC_CTRL			(0x13f8)
+#define RTL931X_SMI_10GPHY_POLLING_SEL2		(0xCF8)
+#define RTL931X_SMI_10GPHY_POLLING_SEL3		(0xCFC)
+#define RTL931X_SMI_10GPHY_POLLING_SEL4		(0xD00)
+
+/* Registers of the internal Serdes of the 8380 */
+#define RTL838X_SDS4_FIB_REG0			(0xF800)
+
+inline int rtl838x_mac_port_ctrl(int p)
+{
+	return RTL838X_MAC_PORT_CTRL + (p << 7);
+}
+
+inline int rtl839x_mac_port_ctrl(int p)
+{
+	return RTL839X_MAC_PORT_CTRL + (p << 7);
+}
+
+/* On the RTL931XX, the functionality of the MAC port control register is split up
+ * into RTL931X_MAC_L2_PORT_CTRL and RTL931X_MAC_PORT_CTRL the functionality used
+ * by the Ethernet driver is in the same bits now in RTL931X_MAC_L2_PORT_CTRL
+ */
+
+inline int rtl930x_mac_port_ctrl(int p)
+{
+	return RTL930X_MAC_L2_PORT_CTRL + (p << 6);
+}
+
+inline int rtl931x_mac_port_ctrl(int p)
+{
+	return RTL931X_MAC_L2_PORT_CTRL + (p << 7);
+}
+
+inline int rtl838x_dma_if_rx_ring_size(int i)
+{
+	return RTL838X_DMA_IF_RX_RING_SIZE + ((i >> 3) << 2);
+}
+
+inline int rtl839x_dma_if_rx_ring_size(int i)
+{
+	return RTL839X_DMA_IF_RX_RING_SIZE + ((i >> 3) << 2);
+}
+
+inline int rtl930x_dma_if_rx_ring_size(int i)
+{
+	return RTL930X_DMA_IF_RX_RING_SIZE + ((i / 3) << 2);
+}
+
+inline int rtl931x_dma_if_rx_ring_size(int i)
+{
+	return RTL931X_DMA_IF_RX_RING_SIZE + ((i / 3) << 2);
+}
+
+inline int rtl838x_dma_if_rx_ring_cntr(int i)
+{
+	return RTL838X_DMA_IF_RX_RING_CNTR + ((i >> 3) << 2);
+}
+
+inline int rtl839x_dma_if_rx_ring_cntr(int i)
+{
+	return RTL839X_DMA_IF_RX_RING_CNTR + ((i >> 3) << 2);
+}
+
+inline int rtl930x_dma_if_rx_ring_cntr(int i)
+{
+	return RTL930X_DMA_IF_RX_RING_CNTR + ((i / 3) << 2);
+}
+
+inline int rtl931x_dma_if_rx_ring_cntr(int i)
+{
+	return RTL931X_DMA_IF_RX_RING_CNTR + ((i / 3) << 2);
+}
+
+inline u32 rtl838x_get_mac_link_sts(int port)
+{
+	return (sw_r32(RTL838X_MAC_LINK_STS) & BIT(port));
+}
+
+inline u32 rtl839x_get_mac_link_sts(int p)
+{
+	return (sw_r32(RTL839X_MAC_LINK_STS + ((p >> 5) << 2)) & BIT(p % 32));
+}
+
+inline u32 rtl930x_get_mac_link_sts(int port)
+{
+	u32 link = sw_r32(RTL930X_MAC_LINK_STS);
+
+	link = sw_r32(RTL930X_MAC_LINK_STS);
+	pr_info("%s link state is %08x\n", __func__, link);
+	return link & BIT(port);
+}
+
+inline u32 rtl931x_get_mac_link_sts(int p)
+{
+	return (sw_r32(RTL931X_MAC_LINK_STS + ((p >> 5) << 2)) & BIT(p % 32));
+}
+
+inline u32 rtl838x_get_mac_link_dup_sts(int port)
+{
+	return (sw_r32(RTL838X_MAC_LINK_DUP_STS) & BIT(port));
+}
+
+inline u32 rtl839x_get_mac_link_dup_sts(int p)
+{
+	return (sw_r32(RTL839X_MAC_LINK_DUP_STS + ((p >> 5) << 2)) & BIT(p % 32));
+}
+
+inline u32 rtl930x_get_mac_link_dup_sts(int port)
+{
+	return (sw_r32(RTL930X_MAC_LINK_DUP_STS) & BIT(port));
+}
+
+inline u32 rtl931x_get_mac_link_dup_sts(int p)
+{
+	return (sw_r32(RTL931X_MAC_LINK_DUP_STS + ((p >> 5) << 2)) & BIT(p % 32));
+}
+
+inline u32 rtl838x_get_mac_link_spd_sts(int port)
+{
+	int r = RTL838X_MAC_LINK_SPD_STS + ((port >> 4) << 2);
+	u32 speed = sw_r32(r);
+
+	speed >>= (port % 16) << 1;
+	return (speed & 0x3);
+}
+
+inline u32 rtl839x_get_mac_link_spd_sts(int port)
+{
+	int r = RTL839X_MAC_LINK_SPD_STS + ((port >> 4) << 2);
+	u32 speed = sw_r32(r);
+
+	speed >>= (port % 16) << 1;
+	return (speed & 0x3);
+}
+
+
+inline u32 rtl930x_get_mac_link_spd_sts(int port)
+{
+	int r = RTL930X_MAC_LINK_SPD_STS + ((port >> 3) << 2);
+	u32 speed = sw_r32(r);
+
+	speed >>= (port % 8) << 2;
+	return (speed & 0xf);
+}
+
+inline u32 rtl931x_get_mac_link_spd_sts(int port)
+{
+	int r = RTL931X_MAC_LINK_SPD_STS + ((port >> 3) << 2);
+	u32 speed = sw_r32(r);
+
+	speed >>= (port % 8) << 2;
+	return (speed & 0xf);
+}
+
+inline u32 rtl838x_get_mac_rx_pause_sts(int port)
+{
+	return (sw_r32(RTL838X_MAC_RX_PAUSE_STS) & (1 << port));
+}
+
+inline u32 rtl839x_get_mac_rx_pause_sts(int p)
+{
+	return (sw_r32(RTL839X_MAC_RX_PAUSE_STS + ((p >> 5) << 2)) & BIT(p % 32));
+}
+
+inline u32 rtl930x_get_mac_rx_pause_sts(int port)
+{
+	return (sw_r32(RTL930X_MAC_RX_PAUSE_STS) & (1 << port));
+}
+
+inline u32 rtl931x_get_mac_rx_pause_sts(int p)
+{
+	return (sw_r32(RTL931X_MAC_RX_PAUSE_STS + ((p >> 5) << 2)) & BIT(p % 32));
+}
+
+inline u32 rtl838x_get_mac_tx_pause_sts(int port)
+{
+	return (sw_r32(RTL838X_MAC_TX_PAUSE_STS) & (1 << port));
+}
+
+inline u32 rtl839x_get_mac_tx_pause_sts(int p)
+{
+	return (sw_r32(RTL839X_MAC_TX_PAUSE_STS + ((p >> 5) << 2)) & BIT(p % 32));
+}
+
+inline u32 rtl930x_get_mac_tx_pause_sts(int port)
+{
+	return (sw_r32(RTL930X_MAC_TX_PAUSE_STS) & (1 << port));
+}
+
+inline u32 rtl931x_get_mac_tx_pause_sts(int p)
+{
+	return (sw_r32(RTL931X_MAC_TX_PAUSE_STS + ((p >> 5) << 2)) & BIT(p % 32));
+}
+
+struct p_hdr;
+struct dsa_tag;
+
+struct rtl838x_eth_reg {
+	irqreturn_t (*net_irq)(int irq, void *dev_id);
+	int (*mac_port_ctrl)(int port);
+	int dma_if_intr_sts;
+	int dma_if_intr_msk;
+	int dma_if_intr_rx_runout_sts;
+	int dma_if_intr_rx_done_sts;
+	int dma_if_intr_tx_done_sts;
+	int dma_if_intr_rx_runout_msk;
+	int dma_if_intr_rx_done_msk;
+	int dma_if_intr_tx_done_msk;
+	int l2_ntfy_if_intr_sts;
+	int l2_ntfy_if_intr_msk;
+	int dma_if_ctrl;
+	int mac_force_mode_ctrl;
+	int dma_rx_base;
+	int dma_tx_base;
+	int (*dma_if_rx_ring_size)(int ring);
+	int (*dma_if_rx_ring_cntr)(int ring);
+	int dma_if_rx_cur;
+	int rst_glb_ctrl;
+	u32 (*get_mac_link_sts)(int port);
+	u32 (*get_mac_link_dup_sts)(int port);
+	u32 (*get_mac_link_spd_sts)(int port);
+	u32 (*get_mac_rx_pause_sts)(int port);
+	u32 (*get_mac_tx_pause_sts)(int port);
+	int mac;
+	int l2_tbl_flush_ctrl;
+	void (*update_cntr)(int r, int work_done);
+	void (*create_tx_header)(struct p_hdr *h, unsigned int dest_port, int prio);
+	bool (*decode_tag)(struct p_hdr *h, struct dsa_tag *tag);
+};
+
+int rtl838x_write_phy(u32 port, u32 page, u32 reg, u32 val);
+int rtl838x_read_phy(u32 port, u32 page, u32 reg, u32 *val);
+int rtl838x_write_mmd_phy(u32 port, u32 addr, u32 reg, u32 val);
+int rtl838x_read_mmd_phy(u32 port, u32 addr, u32 reg, u32 *val);
+int rtl839x_write_phy(u32 port, u32 page, u32 reg, u32 val);
+int rtl839x_read_phy(u32 port, u32 page, u32 reg, u32 *val);
+int rtl839x_read_mmd_phy(u32 port, u32 devnum, u32 regnum, u32 *val);
+int rtl839x_write_mmd_phy(u32 port, u32 devnum, u32 regnum, u32 val);
+int rtl930x_write_phy(u32 port, u32 page, u32 reg, u32 val);
+int rtl930x_read_phy(u32 port, u32 page, u32 reg, u32 *val);
+int rtl931x_write_phy(u32 port, u32 page, u32 reg, u32 val);
+int rtl931x_read_phy(u32 port, u32 page, u32 reg, u32 *val);
+int rtl83xx_setup_tc(struct net_device *dev, enum tc_setup_type type, void *type_data);
+
+#endif /* _RTL838X_ETH_H */
diff --git a/target/linux/realtek/files-5.15/drivers/net/phy/rtl83xx-phy.c b/target/linux/realtek/files-5.15/drivers/net/phy/rtl83xx-phy.c
new file mode 100644
index 00000000000000..d47ba3e013adc6
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/net/phy/rtl83xx-phy.c
@@ -0,0 +1,4014 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Realtek RTL838X Ethernet MDIO interface driver
+ *
+ * Copyright (C) 2020 B. Koblitz
+ */
+
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <linux/of.h>
+#include <linux/phy.h>
+#include <linux/netdevice.h>
+#include <linux/firmware.h>
+#include <linux/crc32.h>
+#include <linux/sfp.h>
+
+#include <asm/mach-rtl838x/mach-rtl83xx.h>
+#include "rtl83xx-phy.h"
+
+extern struct rtl83xx_soc_info soc_info;
+extern struct mutex smi_lock;
+
+#define PHY_CTRL_REG	0
+#define PHY_POWER_BIT	11
+
+#define PHY_PAGE_2	2
+#define PHY_PAGE_4	4
+
+/* all Clause-22 RealTek MDIO PHYs use register 0x1f for page select */
+#define RTL8XXX_PAGE_SELECT		0x1f
+
+#define RTL8XXX_PAGE_MAIN		0x0000
+#define RTL821X_PAGE_PORT		0x0266
+#define RTL821X_PAGE_POWER		0x0a40
+#define RTL821X_PAGE_GPHY		0x0a42
+#define RTL821X_PAGE_MAC		0x0a43
+#define RTL821X_PAGE_STATE		0x0b80
+#define RTL821X_PAGE_PATCH		0x0b82
+
+/* Using the special page 0xfff with the MDIO controller found in
+ * RealTek SoCs allows to access the PHY in RAW mode, ie. bypassing
+ * the cache and paging engine of the MDIO controller.
+ */
+#define RTL83XX_PAGE_RAW		0x0fff
+
+/* internal RTL821X PHY uses register 0x1d to select media page */
+#define RTL821XINT_MEDIA_PAGE_SELECT	0x1d
+/* external RTL821X PHY uses register 0x1e to select media page */
+#define RTL821XEXT_MEDIA_PAGE_SELECT	0x1e
+
+#define RTL821X_MEDIA_PAGE_AUTO		0
+#define RTL821X_MEDIA_PAGE_COPPER	1
+#define RTL821X_MEDIA_PAGE_FIBRE	3
+#define RTL821X_MEDIA_PAGE_INTERNAL	8
+
+#define RTL9300_PHY_ID_MASK 0xf0ffffff
+
+/* This lock protects the state of the SoC automatically polling the PHYs over the SMI
+ * bus to detect e.g. link and media changes. For operations on the PHYs such as
+ * patching or other configuration changes such as EEE, polling needs to be disabled
+ * since otherwise these operations may fails or lead to unpredictable results.
+ */
+DEFINE_MUTEX(poll_lock);
+
+static const struct firmware rtl838x_8380_fw;
+static const struct firmware rtl838x_8214fc_fw;
+static const struct firmware rtl838x_8218b_fw;
+
+static u64 disable_polling(int port)
+{
+	u64 saved_state;
+
+	mutex_lock(&poll_lock);
+
+	switch (soc_info.family) {
+	case RTL8380_FAMILY_ID:
+		saved_state = sw_r32(RTL838X_SMI_POLL_CTRL);
+		sw_w32_mask(BIT(port), 0, RTL838X_SMI_POLL_CTRL);
+		break;
+	case RTL8390_FAMILY_ID:
+		saved_state = sw_r32(RTL839X_SMI_PORT_POLLING_CTRL + 4);
+		saved_state <<= 32;
+		saved_state |= sw_r32(RTL839X_SMI_PORT_POLLING_CTRL);
+		sw_w32_mask(BIT(port % 32), 0,
+		            RTL839X_SMI_PORT_POLLING_CTRL + ((port >> 5) << 2));
+		break;
+	case RTL9300_FAMILY_ID:
+		saved_state = sw_r32(RTL930X_SMI_POLL_CTRL);
+		sw_w32_mask(BIT(port), 0, RTL930X_SMI_POLL_CTRL);
+		break;
+	case RTL9310_FAMILY_ID:
+		pr_warn("%s not implemented for RTL931X\n", __func__);
+		break;
+	}
+
+	mutex_unlock(&poll_lock);
+
+	return saved_state;
+}
+
+static int resume_polling(u64 saved_state)
+{
+	mutex_lock(&poll_lock);
+
+	switch (soc_info.family) {
+	case RTL8380_FAMILY_ID:
+		sw_w32(saved_state, RTL838X_SMI_POLL_CTRL);
+		break;
+	case RTL8390_FAMILY_ID:
+		sw_w32(saved_state >> 32, RTL839X_SMI_PORT_POLLING_CTRL + 4);
+		sw_w32(saved_state, RTL839X_SMI_PORT_POLLING_CTRL);
+		break;
+	case RTL9300_FAMILY_ID:
+		sw_w32(saved_state, RTL930X_SMI_POLL_CTRL);
+		break;
+	case RTL9310_FAMILY_ID:
+		pr_warn("%s not implemented for RTL931X\n", __func__);
+		break;
+	}
+
+	mutex_unlock(&poll_lock);
+
+	return 0;
+}
+
+static void rtl8380_int_phy_on_off(struct phy_device *phydev, bool on)
+{
+	phy_modify(phydev, 0, BIT(11), on?0:BIT(11));
+}
+
+static void rtl8380_rtl8214fc_on_off(struct phy_device *phydev, bool on)
+{
+	/* fiber ports */
+	phy_write_paged(phydev, RTL83XX_PAGE_RAW, RTL821XEXT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_FIBRE);
+	phy_modify(phydev, 0x10, BIT(11), on?0:BIT(11));
+
+	/* copper ports */
+	phy_write_paged(phydev, RTL83XX_PAGE_RAW, RTL821XEXT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_COPPER);
+	phy_modify_paged(phydev, RTL821X_PAGE_POWER, 0x10, BIT(11), on?0:BIT(11));
+}
+
+static void rtl8380_phy_reset(struct phy_device *phydev)
+{
+	phy_modify(phydev, 0, BIT(15), BIT(15));
+}
+
+/* The access registers for SDS_MODE_SEL and the LSB for each SDS within */
+u16 rtl9300_sds_regs[] = { 0x0194, 0x0194, 0x0194, 0x0194, 0x02a0, 0x02a0, 0x02a0, 0x02a0,
+			   0x02A4, 0x02A4, 0x0198, 0x0198 };
+u8  rtl9300_sds_lsb[]  = { 0, 6, 12, 18, 0, 6, 12, 18, 0, 6, 0, 6};
+
+/* Reset the SerDes by powering it off and set a new operations mode
+ * of the SerDes. 0x1f is off. Other modes are
+ * 0x02: SGMII		0x04: 1000BX_FIBER	0x05: FIBER100
+ * 0x06: QSGMII		0x09: RSGMII		0x0d: USXGMII
+ * 0x10: XSGMII		0x12: HISGMII		0x16: 2500Base_X
+ * 0x17: RXAUI_LITE	0x19: RXAUI_PLUS	0x1a: 10G Base-R
+ * 0x1b: 10GR1000BX_AUTO			0x1f: OFF
+ */
+void rtl9300_sds_rst(int sds_num, u32 mode)
+{
+	pr_info("%s %d\n", __func__, mode);
+	if (sds_num < 0 || sds_num > 11) {
+		pr_err("Wrong SerDes number: %d\n", sds_num);
+		return;
+	}
+
+	sw_w32_mask(0x1f << rtl9300_sds_lsb[sds_num], 0x1f << rtl9300_sds_lsb[sds_num],
+		    rtl9300_sds_regs[sds_num]);
+	mdelay(10);
+
+	sw_w32_mask(0x1f << rtl9300_sds_lsb[sds_num], mode << rtl9300_sds_lsb[sds_num],
+		    rtl9300_sds_regs[sds_num]);
+	mdelay(10);
+
+	pr_debug("%s: 194:%08x 198:%08x 2a0:%08x 2a4:%08x\n", __func__,
+	         sw_r32(0x194), sw_r32(0x198), sw_r32(0x2a0), sw_r32(0x2a4));
+}
+
+void rtl9300_sds_set(int sds_num, u32 mode)
+{
+	pr_info("%s %d\n", __func__, mode);
+	if (sds_num < 0 || sds_num > 11) {
+		pr_err("Wrong SerDes number: %d\n", sds_num);
+		return;
+	}
+
+	sw_w32_mask(0x1f << rtl9300_sds_lsb[sds_num], mode << rtl9300_sds_lsb[sds_num],
+		    rtl9300_sds_regs[sds_num]);
+	mdelay(10);
+
+	pr_debug("%s: 194:%08x 198:%08x 2a0:%08x 2a4:%08x\n", __func__,
+	         sw_r32(0x194), sw_r32(0x198), sw_r32(0x2a0), sw_r32(0x2a4));
+}
+
+u32 rtl9300_sds_mode_get(int sds_num)
+{
+	u32 v;
+
+	if (sds_num < 0 || sds_num > 11) {
+		pr_err("Wrong SerDes number: %d\n", sds_num);
+		return 0;
+	}
+
+	v = sw_r32(rtl9300_sds_regs[sds_num]);
+	v >>= rtl9300_sds_lsb[sds_num];
+
+	return v & 0x1f;
+}
+
+/* On the RTL839x family of SoCs with inbuilt SerDes, these SerDes are accessed through
+ * a 2048 bit register that holds the contents of the PHY being simulated by the SoC.
+ */
+int rtl839x_read_sds_phy(int phy_addr, int phy_reg)
+{
+	int offset = 0;
+	int reg;
+	u32 val;
+
+	if (phy_addr == 49)
+		offset = 0x100;
+
+	/* For the RTL8393 internal SerDes, we simulate a PHY ID in registers 2/3
+	 * which would otherwise read as 0.
+	 */
+	if (soc_info.id == 0x8393) {
+		if (phy_reg == 2)
+			return 0x1c;
+		if (phy_reg == 3)
+			return 0x8393;
+	}
+
+	/* Register RTL839X_SDS12_13_XSG0 is 2048 bit broad, the MSB (bit 15) of the
+	 * 0th PHY register is bit 1023 (in byte 0x80). Because PHY-registers are 16
+	 * bit broad, we offset by reg << 1. In the SoC 2 registers are stored in
+	 * one 32 bit register.
+	 */
+	reg = (phy_reg << 1) & 0xfc;
+	val = sw_r32(RTL839X_SDS12_13_XSG0 + offset + 0x80 + reg);
+
+	if (phy_reg & 1)
+		val = (val >> 16) & 0xffff;
+	else
+		val &= 0xffff;
+
+	return val;
+}
+
+/* On the RTL930x family of SoCs, the internal SerDes are accessed through an IO
+ * register which simulates commands to an internal MDIO bus.
+ */
+int rtl930x_read_sds_phy(int phy_addr, int page, int phy_reg)
+{
+	int i;
+	u32 cmd = phy_addr << 2 | page << 7 | phy_reg << 13 | 1;
+
+	sw_w32(cmd, RTL930X_SDS_INDACS_CMD);
+
+	for (i = 0; i < 100; i++) {
+		if (!(sw_r32(RTL930X_SDS_INDACS_CMD) & 0x1))
+			break;
+		mdelay(1);
+	}
+
+	if (i >= 100)
+		return -EIO;
+
+	return sw_r32(RTL930X_SDS_INDACS_DATA) & 0xffff;
+}
+
+int rtl930x_write_sds_phy(int phy_addr, int page, int phy_reg, u16 v)
+{
+	int i;
+	u32 cmd;
+
+	sw_w32(v, RTL930X_SDS_INDACS_DATA);
+	cmd = phy_addr << 2 | page << 7 | phy_reg << 13 | 0x3;
+
+	for (i = 0; i < 100; i++) {
+		if (!(sw_r32(RTL930X_SDS_INDACS_CMD) & 0x1))
+			break;
+		mdelay(1);
+	}
+
+
+	if (i >= 100) {
+		pr_info("%s ERROR !!!!!!!!!!!!!!!!!!!!\n", __func__);
+		return -EIO;
+	}
+
+	return 0;
+}
+
+int rtl931x_read_sds_phy(int phy_addr, int page, int phy_reg)
+{
+	int i;
+	u32 cmd = phy_addr << 2 | page << 7 | phy_reg << 13 | 1;
+
+	pr_debug("%s: phy_addr(SDS-ID) %d, phy_reg: %d\n", __func__, phy_addr, phy_reg);
+	sw_w32(cmd, RTL931X_SERDES_INDRT_ACCESS_CTRL);
+
+	for (i = 0; i < 100; i++) {
+		if (!(sw_r32(RTL931X_SERDES_INDRT_ACCESS_CTRL) & 0x1))
+			break;
+		mdelay(1);
+	}
+
+	if (i >= 100)
+		return -EIO;
+
+	pr_debug("%s: returning %04x\n", __func__, sw_r32(RTL931X_SERDES_INDRT_DATA_CTRL) & 0xffff);
+
+	return sw_r32(RTL931X_SERDES_INDRT_DATA_CTRL) & 0xffff;
+}
+
+int rtl931x_write_sds_phy(int phy_addr, int page, int phy_reg, u16 v)
+{
+	int i;
+	u32 cmd;
+
+	cmd = phy_addr << 2 | page << 7 | phy_reg << 13;
+	sw_w32(cmd, RTL931X_SERDES_INDRT_ACCESS_CTRL);
+
+	sw_w32(v, RTL931X_SERDES_INDRT_DATA_CTRL);
+
+	cmd =  sw_r32(RTL931X_SERDES_INDRT_ACCESS_CTRL) | 0x3;
+	sw_w32(cmd, RTL931X_SERDES_INDRT_ACCESS_CTRL);
+
+	for (i = 0; i < 100; i++) {
+		if (!(sw_r32(RTL931X_SERDES_INDRT_ACCESS_CTRL) & 0x1))
+			break;
+		mdelay(1);
+	}
+
+	if (i >= 100)
+		return -EIO;
+
+	return 0;
+}
+
+/* On the RTL838x SoCs, the internal SerDes is accessed through direct access to
+ * standard PHY registers, where a 32 bit register holds a 16 bit word as found
+ * in a standard page 0 of a PHY
+ */
+int rtl838x_read_sds_phy(int phy_addr, int phy_reg)
+{
+	int offset = 0;
+	u32 val;
+
+	if (phy_addr == 26)
+		offset = 0x100;
+	val = sw_r32(RTL838X_SDS4_FIB_REG0 + offset + (phy_reg << 2)) & 0xffff;
+
+	return val;
+}
+
+int rtl839x_write_sds_phy(int phy_addr, int phy_reg, u16 v)
+{
+	int offset = 0;
+	int reg;
+	u32 val;
+
+	if (phy_addr == 49)
+		offset = 0x100;
+
+	reg = (phy_reg << 1) & 0xfc;
+	val = v;
+	if (phy_reg & 1) {
+		val = val << 16;
+		sw_w32_mask(0xffff0000, val,
+			    RTL839X_SDS12_13_XSG0 + offset + 0x80 + reg);
+	} else {
+		sw_w32_mask(0xffff, val,
+			    RTL839X_SDS12_13_XSG0 + offset + 0x80 + reg);
+	}
+
+	return 0;
+}
+
+/* Read the link and speed status of the 2 internal SGMII/1000Base-X
+ * ports of the RTL838x SoCs
+ */
+static int rtl8380_read_status(struct phy_device *phydev)
+{
+	int err;
+
+	err = genphy_read_status(phydev);
+
+	if (phydev->link) {
+		phydev->speed = SPEED_1000;
+		phydev->duplex = DUPLEX_FULL;
+	}
+
+	return err;
+}
+
+/* Read the link and speed status of the 2 internal SGMII/1000Base-X
+ * ports of the RTL8393 SoC
+ */
+static int rtl8393_read_status(struct phy_device *phydev)
+{
+	int offset = 0;
+	int err;
+	int phy_addr = phydev->mdio.addr;
+	u32 v;
+
+	err = genphy_read_status(phydev);
+	if (phy_addr == 49)
+		offset = 0x100;
+
+	if (phydev->link) {
+		phydev->speed = SPEED_100;
+		/* Read SPD_RD_00 (bit 13) and SPD_RD_01 (bit 6) out of the internal
+		 * PHY registers
+		 */
+		v = sw_r32(RTL839X_SDS12_13_XSG0 + offset + 0x80);
+		if (!(v & (1 << 13)) && (v & (1 << 6)))
+			phydev->speed = SPEED_1000;
+		phydev->duplex = DUPLEX_FULL;
+	}
+
+	return err;
+}
+
+static int rtl8226_read_page(struct phy_device *phydev)
+{
+	return __phy_read(phydev, RTL8XXX_PAGE_SELECT);
+}
+
+static int rtl8226_write_page(struct phy_device *phydev, int page)
+{
+	return __phy_write(phydev, RTL8XXX_PAGE_SELECT, page);
+}
+
+static int rtl8226_read_status(struct phy_device *phydev)
+{
+	int ret = 0;
+	u32 val;
+
+/* TODO: ret = genphy_read_status(phydev);
+ * 	if (ret < 0) {
+ * 		pr_info("%s: genphy_read_status failed\n", __func__);
+ * 		return ret;
+ * 	}
+ */
+
+	/* Link status must be read twice */
+	for (int i = 0; i < 2; i++)
+		val = phy_read_mmd(phydev, MMD_VEND2, 0xA402);
+
+	phydev->link = val & BIT(2) ? 1 : 0;
+	if (!phydev->link)
+		goto out;
+
+	/* Read duplex status */
+	val = phy_read_mmd(phydev, MMD_VEND2, 0xA434);
+	if (val < 0)
+		goto out;
+	phydev->duplex = !!(val & BIT(3));
+
+	/* Read speed */
+	val = phy_read_mmd(phydev, MMD_VEND2, 0xA434);
+	switch (val & 0x0630) {
+	case 0x0000:
+		phydev->speed = SPEED_10;
+		break;
+	case 0x0010:
+		phydev->speed = SPEED_100;
+		break;
+	case 0x0020:
+		phydev->speed = SPEED_1000;
+		break;
+	case 0x0200:
+		phydev->speed = SPEED_10000;
+		break;
+	case 0x0210:
+		phydev->speed = SPEED_2500;
+		break;
+	case 0x0220:
+		phydev->speed = SPEED_5000;
+		break;
+	default:
+		break;
+	}
+
+out:
+	return ret;
+}
+
+static int rtl8226_advertise_aneg(struct phy_device *phydev)
+{
+	int ret = 0;
+	u32 v;
+
+	pr_info("In %s\n", __func__);
+
+	v = phy_read_mmd(phydev, MMD_AN, 16);
+	if (v < 0)
+		goto out;
+
+	v |= BIT(5); /* HD 10M */
+	v |= BIT(6); /* FD 10M */
+	v |= BIT(7); /* HD 100M */
+	v |= BIT(8); /* FD 100M */
+
+	ret = phy_write_mmd(phydev, MMD_AN, 16, v);
+
+	/* Allow 1GBit */
+	v = phy_read_mmd(phydev, MMD_VEND2, 0xA412);
+	if (v < 0)
+		goto out;
+	v |= BIT(9); /* FD 1000M */
+
+	ret = phy_write_mmd(phydev, MMD_VEND2, 0xA412, v);
+	if (ret < 0)
+		goto out;
+
+	/* Allow 2.5G */
+	v = phy_read_mmd(phydev, MMD_AN, 32);
+	if (v < 0)
+		goto out;
+
+	v |= BIT(7);
+	ret = phy_write_mmd(phydev, MMD_AN, 32, v);
+
+out:
+	return ret;
+}
+
+static int rtl8226_config_aneg(struct phy_device *phydev)
+{
+	int ret = 0;
+	u32 v;
+
+	pr_debug("In %s\n", __func__);
+	if (phydev->autoneg == AUTONEG_ENABLE) {
+		ret = rtl8226_advertise_aneg(phydev);
+		if (ret)
+			goto out;
+		/* AutoNegotiationEnable */
+		v = phy_read_mmd(phydev, MMD_AN, 0);
+		if (v < 0)
+			goto out;
+
+		v |= BIT(12); /* Enable AN */
+		ret = phy_write_mmd(phydev, MMD_AN, 0, v);
+		if (ret < 0)
+			goto out;
+
+		/* RestartAutoNegotiation */
+		v = phy_read_mmd(phydev, MMD_VEND2, 0xA400);
+		if (v < 0)
+			goto out;
+		v |= BIT(9);
+
+		ret = phy_write_mmd(phydev, MMD_VEND2, 0xA400, v);
+	}
+
+/*	TODO: ret = __genphy_config_aneg(phydev, ret); */
+
+out:
+	return ret;
+}
+
+static int rtl8226_get_eee(struct phy_device *phydev,
+			   struct ethtool_eee *e)
+{
+	u32 val;
+	int addr = phydev->mdio.addr;
+
+	pr_debug("In %s, port %d, was enabled: %d\n", __func__, addr, e->eee_enabled);
+
+	val = phy_read_mmd(phydev, MMD_AN, 60);
+	if (e->eee_enabled) {
+		e->eee_enabled = !!(val & BIT(1));
+		if (!e->eee_enabled) {
+			val = phy_read_mmd(phydev, MMD_AN, 62);
+			e->eee_enabled = !!(val & BIT(0));
+		}
+	}
+	pr_debug("%s: enabled: %d\n", __func__, e->eee_enabled);
+
+	return 0;
+}
+
+static int rtl8226_set_eee(struct phy_device *phydev, struct ethtool_eee *e)
+{
+	int port = phydev->mdio.addr;
+	u64 poll_state;
+	bool an_enabled;
+	u32 val;
+
+	pr_info("In %s, port %d, enabled %d\n", __func__, port, e->eee_enabled);
+
+	poll_state = disable_polling(port);
+
+	/* Remember aneg state */
+	val = phy_read_mmd(phydev, MMD_AN, 0);
+	an_enabled = !!(val & BIT(12));
+
+	/* Setup 100/1000MBit */
+	val = phy_read_mmd(phydev, MMD_AN, 60);
+	if (e->eee_enabled)
+		val |= 0x6;
+	else
+		val &= 0x6;
+	phy_write_mmd(phydev, MMD_AN, 60, val);
+
+	/* Setup 2.5GBit */
+	val = phy_read_mmd(phydev, MMD_AN, 62);
+	if (e->eee_enabled)
+		val |= 0x1;
+	else
+		val &= 0x1;
+	phy_write_mmd(phydev, MMD_AN, 62, val);
+
+	/* RestartAutoNegotiation */
+	val = phy_read_mmd(phydev, MMD_VEND2, 0xA400);
+	val |= BIT(9);
+	phy_write_mmd(phydev, MMD_VEND2, 0xA400, val);
+
+	resume_polling(poll_state);
+
+	return 0;
+}
+
+static struct fw_header *rtl838x_request_fw(struct phy_device *phydev,
+					    const struct firmware *fw,
+					    const char *name)
+{
+	struct device *dev = &phydev->mdio.dev;
+	int err;
+	struct fw_header *h;
+	uint32_t checksum, my_checksum;
+
+	err = request_firmware(&fw, name, dev);
+	if (err < 0)
+		goto out;
+
+	if (fw->size < sizeof(struct fw_header)) {
+		pr_err("Firmware size too small.\n");
+		err = -EINVAL;
+		goto out;
+	}
+
+	h = (struct fw_header *) fw->data;
+	pr_info("Firmware loaded. Size %d, magic: %08x\n", fw->size, h->magic);
+
+	if (h->magic != 0x83808380) {
+		pr_err("Wrong firmware file: MAGIC mismatch.\n");
+		goto out;
+	}
+
+	checksum = h->checksum;
+	h->checksum = 0;
+	my_checksum = ~crc32(0xFFFFFFFFU, fw->data, fw->size);
+	if (checksum != my_checksum) {
+		pr_err("Firmware checksum mismatch.\n");
+		err = -EINVAL;
+		goto out;
+	}
+	h->checksum = checksum;
+
+	return h;
+out:
+	dev_err(dev, "Unable to load firmware %s (%d)\n", name, err);
+	return NULL;
+}
+
+static void rtl821x_phy_setup_package_broadcast(struct phy_device *phydev, bool enable)
+{
+	int mac = phydev->mdio.addr;
+
+	/* select main page 0 */
+	phy_write_paged(phydev, RTL83XX_PAGE_RAW, RTL8XXX_PAGE_SELECT, RTL8XXX_PAGE_MAIN);
+	/* write to 0x8 to register 0x1d on main page 0 */
+	phy_write_paged(phydev, RTL83XX_PAGE_RAW, RTL821XINT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_INTERNAL);
+	/* select page 0x266 */
+	phy_write_paged(phydev, RTL83XX_PAGE_RAW, RTL8XXX_PAGE_SELECT, RTL821X_PAGE_PORT);
+	/* set phy id and target broadcast bitmap in register 0x16 on page 0x266 */
+	phy_write_paged(phydev, RTL83XX_PAGE_RAW, 0x16, (enable?0xff00:0x00) | mac);
+	/* return to main page 0 */
+	phy_write_paged(phydev, RTL83XX_PAGE_RAW, RTL8XXX_PAGE_SELECT, RTL8XXX_PAGE_MAIN);
+	/* write to 0x0 to register 0x1d on main page 0 */
+	phy_write_paged(phydev, RTL83XX_PAGE_RAW, RTL821XINT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_AUTO);
+	mdelay(1);
+}
+
+static int rtl8390_configure_generic(struct phy_device *phydev)
+{
+	int mac = phydev->mdio.addr;
+	u32 val, phy_id;
+
+	val = phy_read(phydev, 2);
+	phy_id = val << 16;
+	val = phy_read(phydev, 3);
+	phy_id |= val;
+	pr_debug("Phy on MAC %d: %x\n", mac, phy_id);
+
+	/* Read internal PHY ID */
+	phy_write_paged(phydev, 31, 27, 0x0002);
+	val = phy_read_paged(phydev, 31, 28);
+
+	/* Internal RTL8218B, version 2 */
+	phydev_info(phydev, "Detected unknown %x\n", val);
+
+	return 0;
+}
+
+static int rtl8380_configure_int_rtl8218b(struct phy_device *phydev)
+{
+	u32 val, phy_id;
+	int mac = phydev->mdio.addr;
+	struct fw_header *h;
+	u32 *rtl838x_6275B_intPhy_perport;
+	u32 *rtl8218b_6276B_hwEsd_perport;
+
+	val = phy_read(phydev, 2);
+	phy_id = val << 16;
+	val = phy_read(phydev, 3);
+	phy_id |= val;
+	pr_debug("Phy on MAC %d: %x\n", mac, phy_id);
+
+	/* Read internal PHY ID */
+	phy_write_paged(phydev, 31, 27, 0x0002);
+	val = phy_read_paged(phydev, 31, 28);
+	if (val != 0x6275) {
+		phydev_err(phydev, "Expected internal RTL8218B, found PHY-ID %x\n", val);
+		return -1;
+	}
+
+	/* Internal RTL8218B, version 2 */
+	phydev_info(phydev, "Detected internal RTL8218B\n");
+
+	h = rtl838x_request_fw(phydev, &rtl838x_8380_fw, FIRMWARE_838X_8380_1);
+	if (!h)
+		return -1;
+
+	if (h->phy != 0x83800000) {
+		phydev_err(phydev, "Wrong firmware file: PHY mismatch.\n");
+		return -1;
+	}
+
+	rtl838x_6275B_intPhy_perport = (void *)h + sizeof(struct fw_header) + h->parts[8].start;
+	rtl8218b_6276B_hwEsd_perport = (void *)h + sizeof(struct fw_header) + h->parts[9].start;
+
+	// Currently not used
+	// if (sw_r32(RTL838X_DMY_REG31) == 0x1) {
+	// 	int ipd_flag = 1;
+	// }
+
+	val = phy_read(phydev, 0);
+	if (val & BIT(11))
+		rtl8380_int_phy_on_off(phydev, true);
+	else
+		rtl8380_phy_reset(phydev);
+	msleep(100);
+
+	/* Ready PHY for patch */
+	for (int p = 0; p < 8; p++) {
+		phy_package_port_write_paged(phydev, p, RTL83XX_PAGE_RAW, RTL8XXX_PAGE_SELECT, RTL821X_PAGE_PATCH);
+		phy_package_port_write_paged(phydev, p, RTL83XX_PAGE_RAW, 0x10, 0x0010);
+	}
+	msleep(500);
+	for (int p = 0; p < 8; p++) {
+		int i;
+
+		for (i = 0; i < 100 ; i++) {
+			val = phy_package_port_read_paged(phydev, p, RTL821X_PAGE_STATE, 0x10);
+			if (val & 0x40)
+				break;
+		}
+		if (i >= 100) {
+			phydev_err(phydev,
+			           "ERROR: Port %d not ready for patch.\n",
+			           mac + p);
+			return -1;
+		}
+	}
+	for (int p = 0; p < 8; p++) {
+		int i;
+
+		i = 0;
+		while (rtl838x_6275B_intPhy_perport[i * 2]) {
+			phy_package_port_write_paged(phydev, p, RTL83XX_PAGE_RAW,
+			                             rtl838x_6275B_intPhy_perport[i * 2],
+			                             rtl838x_6275B_intPhy_perport[i * 2 + 1]);
+			i++;
+		}
+		i = 0;
+		while (rtl8218b_6276B_hwEsd_perport[i * 2]) {
+			phy_package_port_write_paged(phydev, p, RTL83XX_PAGE_RAW,
+			                             rtl8218b_6276B_hwEsd_perport[i * 2],
+			                             rtl8218b_6276B_hwEsd_perport[i * 2 + 1]);
+			i++;
+		}
+	}
+
+	return 0;
+}
+
+static int rtl8380_configure_ext_rtl8218b(struct phy_device *phydev)
+{
+	u32 val, ipd, phy_id;
+	int mac = phydev->mdio.addr;
+	struct fw_header *h;
+	u32 *rtl8380_rtl8218b_perchip;
+	u32 *rtl8218B_6276B_rtl8380_perport;
+	u32 *rtl8380_rtl8218b_perport;
+
+	if (soc_info.family == RTL8380_FAMILY_ID && mac != 0 && mac != 16) {
+		phydev_err(phydev, "External RTL8218B must have PHY-IDs 0 or 16!\n");
+		return -1;
+	}
+	val = phy_read(phydev, 2);
+	phy_id = val << 16;
+	val = phy_read(phydev, 3);
+	phy_id |= val;
+	pr_info("Phy on MAC %d: %x\n", mac, phy_id);
+
+	/* Read internal PHY ID */
+	phy_write_paged(phydev, 31, 27, 0x0002);
+	val = phy_read_paged(phydev, 31, 28);
+	if (val != 0x6276) {
+		phydev_err(phydev, "Expected external RTL8218B, found PHY-ID %x\n", val);
+		return -1;
+	}
+	phydev_info(phydev, "Detected external RTL8218B\n");
+
+	h = rtl838x_request_fw(phydev, &rtl838x_8218b_fw, FIRMWARE_838X_8218b_1);
+	if (!h)
+		return -1;
+
+	if (h->phy != 0x8218b000) {
+		phydev_err(phydev, "Wrong firmware file: PHY mismatch.\n");
+		return -1;
+	}
+
+	rtl8380_rtl8218b_perchip = (void *)h + sizeof(struct fw_header) + h->parts[0].start;
+	rtl8218B_6276B_rtl8380_perport = (void *)h + sizeof(struct fw_header) + h->parts[1].start;
+	rtl8380_rtl8218b_perport = (void *)h + sizeof(struct fw_header) + h->parts[2].start;
+
+	val = phy_read(phydev, 0);
+	if (val & (1 << 11))
+		rtl8380_int_phy_on_off(phydev, true);
+	else
+		rtl8380_phy_reset(phydev);
+
+	msleep(100);
+
+	/* Get Chip revision */
+	phy_write_paged(phydev, RTL83XX_PAGE_RAW, RTL8XXX_PAGE_SELECT, RTL8XXX_PAGE_MAIN);
+	phy_write_paged(phydev, RTL83XX_PAGE_RAW, 0x1b, 0x4);
+	val = phy_read_paged(phydev, RTL83XX_PAGE_RAW, 0x1c);
+
+	phydev_info(phydev, "Detected chip revision %04x\n", val);
+
+	for (int i = 0; rtl8380_rtl8218b_perchip[i * 3] &&
+	                rtl8380_rtl8218b_perchip[i * 3 + 1]; i++) {
+		phy_package_port_write_paged(phydev, rtl8380_rtl8218b_perchip[i * 3],
+					     RTL83XX_PAGE_RAW, rtl8380_rtl8218b_perchip[i * 3 + 1],
+					     rtl8380_rtl8218b_perchip[i * 3 + 2]);
+	}
+
+	/* Enable PHY */
+	for (int i = 0; i < 8; i++) {
+		phy_package_port_write_paged(phydev, i, RTL83XX_PAGE_RAW, RTL8XXX_PAGE_SELECT, RTL8XXX_PAGE_MAIN);
+		phy_package_port_write_paged(phydev, i, RTL83XX_PAGE_RAW, 0x00, 0x1140);
+	}
+	mdelay(100);
+
+	/* Request patch */
+	for (int i = 0; i < 8; i++) {
+		phy_package_port_write_paged(phydev, i, RTL83XX_PAGE_RAW, RTL8XXX_PAGE_SELECT, RTL821X_PAGE_PATCH);
+		phy_package_port_write_paged(phydev, i, RTL83XX_PAGE_RAW, 0x10, 0x0010);
+	}
+
+	mdelay(300);
+
+	/* Verify patch readiness */
+	for (int i = 0; i < 8; i++) {
+		int l;
+
+		for (l = 0; l < 100; l++) {
+			val = phy_package_port_read_paged(phydev, i, RTL821X_PAGE_STATE, 0x10);
+			if (val & 0x40)
+				break;
+		}
+		if (l >= 100) {
+			phydev_err(phydev, "Could not patch PHY\n");
+			return -1;
+		}
+	}
+
+	/* Use Broadcast ID method for patching */
+	rtl821x_phy_setup_package_broadcast(phydev, true);
+
+	phy_write_paged(phydev, RTL83XX_PAGE_RAW, 30, 8);
+	phy_write_paged(phydev, 0x26e, 17, 0xb);
+	phy_write_paged(phydev, 0x26e, 16, 0x2);
+	mdelay(1);
+	ipd = phy_read_paged(phydev, 0x26e, 19);
+	phy_write_paged(phydev, 0, 30, 0);
+	ipd = (ipd >> 4) & 0xf; /* unused ? */
+
+	for (int i = 0; rtl8218B_6276B_rtl8380_perport[i * 2]; i++) {
+		phy_write_paged(phydev, RTL83XX_PAGE_RAW, rtl8218B_6276B_rtl8380_perport[i * 2],
+		                rtl8218B_6276B_rtl8380_perport[i * 2 + 1]);
+	}
+
+	/* Disable broadcast ID */
+	rtl821x_phy_setup_package_broadcast(phydev, false);
+
+	return 0;
+}
+
+static int rtl8218b_ext_match_phy_device(struct phy_device *phydev)
+{
+	int addr = phydev->mdio.addr;
+
+	/* Both the RTL8214FC and the external RTL8218B have the same
+	 * PHY ID. On the RTL838x, the RTL8218B can only be attached_dev
+	 * at PHY IDs 0-7, while the RTL8214FC must be attached via
+	 * the pair of SGMII/1000Base-X with higher PHY-IDs
+	 */
+	if (soc_info.family == RTL8380_FAMILY_ID)
+		return phydev->phy_id == PHY_ID_RTL8218B_E && addr < 8;
+	else
+		return phydev->phy_id == PHY_ID_RTL8218B_E;
+}
+
+static bool rtl8214fc_media_is_fibre(struct phy_device *phydev)
+{
+	int mac = phydev->mdio.addr;
+
+	static int reg[] = {16, 19, 20, 21};
+	u32 val;
+
+	phy_package_write_paged(phydev, RTL83XX_PAGE_RAW, RTL821XINT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_INTERNAL);
+	val = phy_package_read_paged(phydev, RTL821X_PAGE_PORT, reg[mac % 4]);
+	phy_package_write_paged(phydev, RTL83XX_PAGE_RAW, RTL821XINT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_AUTO);
+
+	if (val & BIT(11))
+		return false;
+
+	return true;
+}
+
+static void rtl8214fc_power_set(struct phy_device *phydev, int port, bool on)
+{
+	char *state = on ? "on" : "off";
+
+	if (port == PORT_FIBRE) {
+		pr_info("%s: Powering %s FIBRE (port %d)\n", __func__, state, phydev->mdio.addr);
+		phy_write_paged(phydev, RTL83XX_PAGE_RAW, RTL821XINT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_FIBRE);
+	} else {
+		pr_info("%s: Powering %s COPPER (port %d)\n", __func__, state, phydev->mdio.addr);
+		phy_write_paged(phydev, RTL83XX_PAGE_RAW, RTL821XINT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_COPPER);
+	}
+
+	if (on) {
+		phy_modify_paged(phydev, RTL821X_PAGE_POWER, 0x10, BIT(11), 0);
+	} else {
+		phy_modify_paged(phydev, RTL821X_PAGE_POWER, 0x10, 0, BIT(11));
+	}
+
+	phy_write_paged(phydev, RTL83XX_PAGE_RAW, RTL821XINT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_AUTO);
+}
+
+static int rtl8214fc_suspend(struct phy_device *phydev)
+{
+	rtl8214fc_power_set(phydev, PORT_MII, false);
+	rtl8214fc_power_set(phydev, PORT_FIBRE, false);
+
+	return 0;
+}
+
+static int rtl8214fc_resume(struct phy_device *phydev)
+{
+	if (rtl8214fc_media_is_fibre(phydev)) {
+		rtl8214fc_power_set(phydev, PORT_MII, false);
+		rtl8214fc_power_set(phydev, PORT_FIBRE, true);
+	} else {
+		rtl8214fc_power_set(phydev, PORT_FIBRE, false);
+		rtl8214fc_power_set(phydev, PORT_MII, true);
+	}
+
+	return 0;
+}
+
+static void rtl8214fc_media_set(struct phy_device *phydev, bool set_fibre)
+{
+	int mac = phydev->mdio.addr;
+
+	static int reg[] = {16, 19, 20, 21};
+	int val;
+
+	pr_info("%s: port %d, set_fibre: %d\n", __func__, mac, set_fibre);
+	phy_package_write_paged(phydev, RTL83XX_PAGE_RAW, RTL821XINT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_INTERNAL);
+	val = phy_package_read_paged(phydev, RTL821X_PAGE_PORT, reg[mac % 4]);
+
+	val |= BIT(10);
+	if (set_fibre) {
+		val &= ~BIT(11);
+	} else {
+		val |= BIT(11);
+	}
+
+	phy_package_write_paged(phydev, RTL83XX_PAGE_RAW, RTL821XINT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_INTERNAL);
+	phy_package_write_paged(phydev, RTL821X_PAGE_PORT, reg[mac % 4], val);
+	phy_package_write_paged(phydev, RTL83XX_PAGE_RAW, RTL821XINT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_AUTO);
+
+	if (!phydev->suspended) {
+		if (set_fibre) {
+			rtl8214fc_power_set(phydev, PORT_MII, false);
+			rtl8214fc_power_set(phydev, PORT_FIBRE, true);
+		} else {
+			rtl8214fc_power_set(phydev, PORT_FIBRE, false);
+			rtl8214fc_power_set(phydev, PORT_MII, true);
+		}
+	}
+}
+
+static int rtl8214fc_set_port(struct phy_device *phydev, int port)
+{
+	bool is_fibre = (port == PORT_FIBRE ? true : false);
+	int addr = phydev->mdio.addr;
+
+	pr_debug("%s port %d to %d\n", __func__, addr, port);
+
+	rtl8214fc_media_set(phydev, is_fibre);
+
+	return 0;
+}
+
+static int rtl8214fc_get_port(struct phy_device *phydev)
+{
+	int addr = phydev->mdio.addr;
+
+	pr_debug("%s: port %d\n", __func__, addr);
+	if (rtl8214fc_media_is_fibre(phydev))
+		return PORT_FIBRE;
+
+	return PORT_MII;
+}
+
+/* Enable EEE on the RTL8218B PHYs
+ * The method used is not the preferred way (which would be based on the MAC-EEE state,
+ * but the only way that works since the kernel first enables EEE in the MAC
+ * and then sets up the PHY. The MAC-based approach would require the oppsite.
+ */
+void rtl8218d_eee_set(struct phy_device *phydev, bool enable)
+{
+	u32 val;
+	bool an_enabled;
+
+	pr_debug("In %s %d, enable %d\n", __func__, phydev->mdio.addr, enable);
+	/* Set GPHY page to copper */
+	phy_write_paged(phydev, RTL821X_PAGE_GPHY, RTL821XEXT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_COPPER);
+
+	val = phy_read(phydev, 0);
+	an_enabled = val & BIT(12);
+
+	/* Enable 100M (bit 1) / 1000M (bit 2) EEE */
+	val = phy_read_mmd(phydev, 7, 60);
+	val |= BIT(2) | BIT(1);
+	phy_write_mmd(phydev, 7, 60, enable ? 0x6 : 0);
+
+	/* 500M EEE ability */
+	val = phy_read_paged(phydev, RTL821X_PAGE_GPHY, 20);
+	if (enable)
+		val |= BIT(7);
+	else
+		val &= ~BIT(7);
+	phy_write_paged(phydev, RTL821X_PAGE_GPHY, 20, val);
+
+	/* Restart AN if enabled */
+	if (an_enabled) {
+		val = phy_read(phydev, 0);
+		val |= BIT(9);
+		phy_write(phydev, 0, val);
+	}
+
+	/* GPHY page back to auto */
+	phy_write_paged(phydev, RTL821X_PAGE_GPHY, RTL821XEXT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_AUTO);
+}
+
+static int rtl8218b_get_eee(struct phy_device *phydev,
+			    struct ethtool_eee *e)
+{
+	u32 val;
+	int addr = phydev->mdio.addr;
+
+	pr_debug("In %s, port %d, was enabled: %d\n", __func__, addr, e->eee_enabled);
+
+	/* Set GPHY page to copper */
+	phy_write_paged(phydev, RTL821X_PAGE_GPHY, RTL821XINT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_COPPER);
+
+	val = phy_read_paged(phydev, 7, 60);
+	if (e->eee_enabled) {
+		/* Verify vs MAC-based EEE */
+		e->eee_enabled = !!(val & BIT(7));
+		if (!e->eee_enabled) {
+			val = phy_read_paged(phydev, RTL821X_PAGE_MAC, 25);
+			e->eee_enabled = !!(val & BIT(4));
+		}
+	}
+	pr_debug("%s: enabled: %d\n", __func__, e->eee_enabled);
+
+	/* GPHY page to auto */
+	phy_write_paged(phydev, RTL821X_PAGE_GPHY, RTL821XINT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_AUTO);
+
+	return 0;
+}
+
+static int rtl8218d_get_eee(struct phy_device *phydev,
+			    struct ethtool_eee *e)
+{
+	u32 val;
+	int addr = phydev->mdio.addr;
+
+	pr_debug("In %s, port %d, was enabled: %d\n", __func__, addr, e->eee_enabled);
+
+	/* Set GPHY page to copper */
+	phy_write_paged(phydev, RTL821X_PAGE_GPHY, RTL821XEXT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_COPPER);
+
+	val = phy_read_paged(phydev, 7, 60);
+	if (e->eee_enabled)
+		e->eee_enabled = !!(val & BIT(7));
+	pr_debug("%s: enabled: %d\n", __func__, e->eee_enabled);
+
+	/* GPHY page to auto */
+	phy_write_paged(phydev, RTL821X_PAGE_GPHY, RTL821XEXT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_AUTO);
+
+	return 0;
+}
+
+static int rtl8214fc_set_eee(struct phy_device *phydev,
+			     struct ethtool_eee *e)
+{
+	u32 poll_state;
+	int port = phydev->mdio.addr;
+	bool an_enabled;
+	u32 val;
+
+	pr_debug("In %s port %d, enabled %d\n", __func__, port, e->eee_enabled);
+
+	if (rtl8214fc_media_is_fibre(phydev)) {
+		netdev_err(phydev->attached_dev, "Port %d configured for FIBRE", port);
+		return -ENOTSUPP;
+	}
+
+	poll_state = disable_polling(port);
+
+	/* Set GPHY page to copper */
+	phy_write_paged(phydev, RTL821X_PAGE_GPHY, RTL821XINT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_COPPER);
+
+	/* Get auto-negotiation status */
+	val = phy_read(phydev, 0);
+	an_enabled = val & BIT(12);
+
+	pr_info("%s: aneg: %d\n", __func__, an_enabled);
+	val = phy_read_paged(phydev, RTL821X_PAGE_MAC, 25);
+	val &= ~BIT(5);  /* Use MAC-based EEE */
+	phy_write_paged(phydev, RTL821X_PAGE_MAC, 25, val);
+
+	/* Enable 100M (bit 1) / 1000M (bit 2) EEE */
+	phy_write_paged(phydev, 7, 60, e->eee_enabled ? 0x6 : 0);
+
+	/* 500M EEE ability */
+	val = phy_read_paged(phydev, RTL821X_PAGE_GPHY, 20);
+	if (e->eee_enabled)
+		val |= BIT(7);
+	else
+		val &= ~BIT(7);
+
+	phy_write_paged(phydev, RTL821X_PAGE_GPHY, 20, val);
+
+	/* Restart AN if enabled */
+	if (an_enabled) {
+		pr_info("%s: doing aneg\n", __func__);
+		val = phy_read(phydev, 0);
+		val |= BIT(9);
+		phy_write(phydev, 0, val);
+	}
+
+	/* GPHY page back to auto */
+	phy_write_paged(phydev, RTL821X_PAGE_GPHY, RTL821XINT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_AUTO);
+
+	resume_polling(poll_state);
+
+	return 0;
+}
+
+static int rtl8214fc_get_eee(struct phy_device *phydev,
+			     struct ethtool_eee *e)
+{
+	int addr = phydev->mdio.addr;
+
+	pr_debug("In %s port %d, enabled %d\n", __func__, addr, e->eee_enabled);
+	if (rtl8214fc_media_is_fibre(phydev)) {
+		netdev_err(phydev->attached_dev, "Port %d configured for FIBRE", addr);
+		return -ENOTSUPP;
+	}
+
+	return rtl8218b_get_eee(phydev, e);
+}
+
+static int rtl8218b_set_eee(struct phy_device *phydev, struct ethtool_eee *e)
+{
+	int port = phydev->mdio.addr;
+	u64 poll_state;
+	u32 val;
+	bool an_enabled;
+
+	pr_info("In %s, port %d, enabled %d\n", __func__, port, e->eee_enabled);
+
+	poll_state = disable_polling(port);
+
+	/* Set GPHY page to copper */
+	phy_write(phydev, RTL821XEXT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_COPPER);
+	val = phy_read(phydev, 0);
+	an_enabled = val & BIT(12);
+
+	if (e->eee_enabled) {
+		/* 100/1000M EEE Capability */
+		phy_write(phydev, 13, 0x0007);
+		phy_write(phydev, 14, 0x003C);
+		phy_write(phydev, 13, 0x4007);
+		phy_write(phydev, 14, 0x0006);
+
+		val = phy_read_paged(phydev, RTL821X_PAGE_MAC, 25);
+		val |= BIT(4);
+		phy_write_paged(phydev, RTL821X_PAGE_MAC, 25, val);
+	} else {
+		/* 100/1000M EEE Capability */
+		phy_write(phydev, 13, 0x0007);
+		phy_write(phydev, 14, 0x003C);
+		phy_write(phydev, 13, 0x0007);
+		phy_write(phydev, 14, 0x0000);
+
+		val = phy_read_paged(phydev, RTL821X_PAGE_MAC, 25);
+		val &= ~BIT(4);
+		phy_write_paged(phydev, RTL821X_PAGE_MAC, 25, val);
+	}
+
+	/* Restart AN if enabled */
+	if (an_enabled) {
+		val = phy_read(phydev, 0);
+		val |= BIT(9);
+		phy_write(phydev, 0, val);
+	}
+
+	/* GPHY page back to auto */
+	phy_write_paged(phydev, RTL821X_PAGE_GPHY, RTL821XEXT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_AUTO);
+
+	pr_info("%s done\n", __func__);
+	resume_polling(poll_state);
+
+	return 0;
+}
+
+static int rtl8218d_set_eee(struct phy_device *phydev, struct ethtool_eee *e)
+{
+	int addr = phydev->mdio.addr;
+	u64 poll_state;
+
+	pr_info("In %s, port %d, enabled %d\n", __func__, addr, e->eee_enabled);
+
+	poll_state = disable_polling(addr);
+
+	rtl8218d_eee_set(phydev, (bool) e->eee_enabled);
+
+	resume_polling(poll_state);
+
+	return 0;
+}
+
+static int rtl8214c_match_phy_device(struct phy_device *phydev)
+{
+	return phydev->phy_id == PHY_ID_RTL8214C;
+}
+
+static int rtl8380_configure_rtl8214c(struct phy_device *phydev)
+{
+	u32 phy_id, val;
+	int mac = phydev->mdio.addr;
+
+	val = phy_read(phydev, 2);
+	phy_id = val << 16;
+	val = phy_read(phydev, 3);
+	phy_id |= val;
+	pr_debug("Phy on MAC %d: %x\n", mac, phy_id);
+
+	phydev_info(phydev, "Detected external RTL8214C\n");
+
+	/* GPHY auto conf */
+	phy_write_paged(phydev, RTL821X_PAGE_GPHY, RTL821XINT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_AUTO);
+
+	return 0;
+}
+
+static int rtl8380_configure_rtl8214fc(struct phy_device *phydev)
+{
+	int mac = phydev->mdio.addr;
+	struct fw_header *h;
+	u32 *rtl8380_rtl8214fc_perchip;
+	u32 *rtl8380_rtl8214fc_perport;
+	u32 phy_id;
+	u32 val;
+
+	val = phy_read(phydev, 2);
+	phy_id = val << 16;
+	val = phy_read(phydev, 3);
+	phy_id |= val;
+	pr_debug("Phy on MAC %d: %x\n", mac, phy_id);
+
+	/* Read internal PHY id */
+	phy_write_paged(phydev, 0, RTL821XEXT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_COPPER);
+	phy_write_paged(phydev, 0x1f, 0x1b, 0x0002);
+	val = phy_read_paged(phydev, 0x1f, 0x1c);
+	if (val != 0x6276) {
+		phydev_err(phydev, "Expected external RTL8214FC, found PHY-ID %x\n", val);
+		return -1;
+	}
+	phydev_info(phydev, "Detected external RTL8214FC\n");
+
+	h = rtl838x_request_fw(phydev, &rtl838x_8214fc_fw, FIRMWARE_838X_8214FC_1);
+	if (!h)
+		return -1;
+
+	if (h->phy != 0x8214fc00) {
+		phydev_err(phydev, "Wrong firmware file: PHY mismatch.\n");
+		return -1;
+	}
+
+	rtl8380_rtl8214fc_perchip = (void *)h + sizeof(struct fw_header) + h->parts[0].start;
+
+	rtl8380_rtl8214fc_perport = (void *)h + sizeof(struct fw_header) + h->parts[1].start;
+
+	/* detect phy version */
+	phy_write_paged(phydev, RTL83XX_PAGE_RAW, 27, 0x0004);
+	val = phy_read_paged(phydev, RTL83XX_PAGE_RAW, 28);
+
+	val = phy_read(phydev, 16);
+	if (val & (1 << 11))
+		rtl8380_rtl8214fc_on_off(phydev, true);
+	else
+		rtl8380_phy_reset(phydev);
+
+	msleep(100);
+	phy_write_paged(phydev, 0, RTL821XEXT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_COPPER);
+
+	for (int i = 0; rtl8380_rtl8214fc_perchip[i * 3] &&
+	                rtl8380_rtl8214fc_perchip[i * 3 + 1]; i++) {
+		u32 page = 0;
+
+		if (rtl8380_rtl8214fc_perchip[i * 3 + 1] == 0x1f)
+			page = rtl8380_rtl8214fc_perchip[i * 3 + 2];
+		if (rtl8380_rtl8214fc_perchip[i * 3 + 1] == 0x13 && page == 0x260) {
+			val = phy_read_paged(phydev, 0x260, 13);
+			val = (val & 0x1f00) | (rtl8380_rtl8214fc_perchip[i * 3 + 2] & 0xe0ff);
+			phy_write_paged(phydev, RTL83XX_PAGE_RAW,
+					rtl8380_rtl8214fc_perchip[i * 3 + 1], val);
+		} else {
+			phy_write_paged(phydev, RTL83XX_PAGE_RAW,
+					rtl8380_rtl8214fc_perchip[i * 3 + 1],
+					rtl8380_rtl8214fc_perchip[i * 3 + 2]);
+		}
+	}
+
+	/* Force copper medium */
+	for (int i = 0; i < 4; i++) {
+		phy_package_port_write_paged(phydev, i, RTL83XX_PAGE_RAW, RTL8XXX_PAGE_SELECT, RTL8XXX_PAGE_MAIN);
+		phy_package_port_write_paged(phydev, i, RTL83XX_PAGE_RAW, RTL821XEXT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_COPPER);
+	}
+
+	/* Enable PHY */
+	for (int i = 0; i < 4; i++) {
+		phy_package_port_write_paged(phydev, i, RTL83XX_PAGE_RAW, RTL8XXX_PAGE_SELECT, RTL8XXX_PAGE_MAIN);
+		phy_package_port_write_paged(phydev, i, RTL83XX_PAGE_RAW, 0x00, 0x1140);
+	}
+	mdelay(100);
+
+	/* Disable Autosensing */
+	for (int i = 0; i < 4; i++) {
+		int l;
+
+		for (l = 0; l < 100; l++) {
+			val = phy_package_port_read_paged(phydev, i, RTL821X_PAGE_GPHY, 0x10);
+			if ((val & 0x7) >= 3)
+				break;
+		}
+		if (l >= 100) {
+			phydev_err(phydev, "Could not disable autosensing\n");
+			return -1;
+		}
+	}
+
+	/* Request patch */
+	for (int i = 0; i < 4; i++) {
+		phy_package_port_write_paged(phydev, i, RTL83XX_PAGE_RAW, RTL8XXX_PAGE_SELECT, RTL821X_PAGE_PATCH);
+		phy_package_port_write_paged(phydev, i, RTL83XX_PAGE_RAW, 0x10, 0x0010);
+	}
+	mdelay(300);
+
+	/* Verify patch readiness */
+	for (int i = 0; i < 4; i++) {
+		int l;
+
+		for (l = 0; l < 100; l++) {
+			val = phy_package_port_read_paged(phydev, i, RTL821X_PAGE_STATE, 0x10);
+			if (val & 0x40)
+				break;
+		}
+		if (l >= 100) {
+			phydev_err(phydev, "Could not patch PHY\n");
+			return -1;
+		}
+	}
+	/* Use Broadcast ID method for patching */
+	rtl821x_phy_setup_package_broadcast(phydev, true);
+
+	for (int i = 0; rtl8380_rtl8214fc_perport[i * 2]; i++) {
+		phy_write_paged(phydev, RTL83XX_PAGE_RAW, rtl8380_rtl8214fc_perport[i * 2],
+		                rtl8380_rtl8214fc_perport[i * 2 + 1]);
+	}
+
+	/* Disable broadcast ID */
+	rtl821x_phy_setup_package_broadcast(phydev, false);
+
+	/* Auto medium selection */
+	for (int i = 0; i < 4; i++) {
+		phy_write_paged(phydev, RTL83XX_PAGE_RAW, RTL8XXX_PAGE_SELECT, RTL8XXX_PAGE_MAIN);
+		phy_write_paged(phydev, RTL83XX_PAGE_RAW, RTL821XEXT_MEDIA_PAGE_SELECT, RTL821X_MEDIA_PAGE_AUTO);
+	}
+
+	return 0;
+}
+
+static int rtl8214fc_match_phy_device(struct phy_device *phydev)
+{
+	int addr = phydev->mdio.addr;
+
+	return phydev->phy_id == PHY_ID_RTL8214FC && addr >= 24;
+}
+
+static int rtl8380_configure_serdes(struct phy_device *phydev)
+{
+	u32 v;
+	u32 sds_conf_value;
+	int i;
+	struct fw_header *h;
+	u32 *rtl8380_sds_take_reset;
+	u32 *rtl8380_sds_common;
+	u32 *rtl8380_sds01_qsgmii_6275b;
+	u32 *rtl8380_sds23_qsgmii_6275b;
+	u32 *rtl8380_sds4_fiber_6275b;
+	u32 *rtl8380_sds5_fiber_6275b;
+	u32 *rtl8380_sds_reset;
+	u32 *rtl8380_sds_release_reset;
+
+	phydev_info(phydev, "Detected internal RTL8380 SERDES\n");
+
+	h = rtl838x_request_fw(phydev, &rtl838x_8218b_fw, FIRMWARE_838X_8380_1);
+	if (!h)
+		return -1;
+
+	if (h->magic != 0x83808380) {
+		phydev_err(phydev, "Wrong firmware file: magic number mismatch.\n");
+		return -1;
+	}
+
+	rtl8380_sds_take_reset = (void *)h + sizeof(struct fw_header) + h->parts[0].start;
+
+	rtl8380_sds_common = (void *)h + sizeof(struct fw_header) + h->parts[1].start;
+
+	rtl8380_sds01_qsgmii_6275b = (void *)h + sizeof(struct fw_header) + h->parts[2].start;
+
+	rtl8380_sds23_qsgmii_6275b = (void *)h + sizeof(struct fw_header) + h->parts[3].start;
+
+	rtl8380_sds4_fiber_6275b = (void *)h + sizeof(struct fw_header) + h->parts[4].start;
+
+	rtl8380_sds5_fiber_6275b = (void *)h + sizeof(struct fw_header) + h->parts[5].start;
+
+	rtl8380_sds_reset = (void *)h + sizeof(struct fw_header) + h->parts[6].start;
+
+	rtl8380_sds_release_reset = (void *)h + sizeof(struct fw_header) + h->parts[7].start;
+
+	/* Back up serdes power off value */
+	sds_conf_value = sw_r32(RTL838X_SDS_CFG_REG);
+	pr_info("SDS power down value: %x\n", sds_conf_value);
+
+	/* take serdes into reset */
+	i = 0;
+	while (rtl8380_sds_take_reset[2 * i]) {
+		sw_w32(rtl8380_sds_take_reset[2 * i + 1], rtl8380_sds_take_reset[2 * i]);
+		i++;
+		udelay(1000);
+	}
+
+	/* apply common serdes patch */
+	i = 0;
+	while (rtl8380_sds_common[2 * i]) {
+		sw_w32(rtl8380_sds_common[2 * i + 1], rtl8380_sds_common[2 * i]);
+		i++;
+		udelay(1000);
+	}
+
+	/* internal R/W enable */
+	sw_w32(3, RTL838X_INT_RW_CTRL);
+
+	/* SerDes ports 4 and 5 are FIBRE ports */
+	sw_w32_mask(0x7 | 0x38, 1 | (1 << 3), RTL838X_INT_MODE_CTRL);
+
+	/* SerDes module settings, SerDes 0-3 are QSGMII */
+	v = 0x6 << 25 | 0x6 << 20 | 0x6 << 15 | 0x6 << 10;
+	/* SerDes 4 and 5 are 1000BX FIBRE */
+	v |= 0x4 << 5 | 0x4;
+	sw_w32(v, RTL838X_SDS_MODE_SEL);
+
+	pr_info("PLL control register: %x\n", sw_r32(RTL838X_PLL_CML_CTRL));
+	sw_w32_mask(0xfffffff0, 0xaaaaaaaf & 0xf, RTL838X_PLL_CML_CTRL);
+	i = 0;
+	while (rtl8380_sds01_qsgmii_6275b[2 * i]) {
+		sw_w32(rtl8380_sds01_qsgmii_6275b[2 * i + 1],
+		       rtl8380_sds01_qsgmii_6275b[2 * i]);
+		i++;
+	}
+
+	i = 0;
+	while (rtl8380_sds23_qsgmii_6275b[2 * i]) {
+		sw_w32(rtl8380_sds23_qsgmii_6275b[2 * i + 1], rtl8380_sds23_qsgmii_6275b[2 * i]);
+		i++;
+	}
+
+	i = 0;
+	while (rtl8380_sds4_fiber_6275b[2 * i]) {
+		sw_w32(rtl8380_sds4_fiber_6275b[2 * i + 1], rtl8380_sds4_fiber_6275b[2 * i]);
+		i++;
+	}
+
+	i = 0;
+	while (rtl8380_sds5_fiber_6275b[2 * i]) {
+		sw_w32(rtl8380_sds5_fiber_6275b[2 * i + 1], rtl8380_sds5_fiber_6275b[2 * i]);
+		i++;
+	}
+
+	i = 0;
+	while (rtl8380_sds_reset[2 * i]) {
+		sw_w32(rtl8380_sds_reset[2 * i + 1], rtl8380_sds_reset[2 * i]);
+		i++;
+	}
+
+	i = 0;
+	while (rtl8380_sds_release_reset[2 * i]) {
+		sw_w32(rtl8380_sds_release_reset[2 * i + 1], rtl8380_sds_release_reset[2 * i]);
+		i++;
+	}
+
+	pr_info("SDS power down value now: %x\n", sw_r32(RTL838X_SDS_CFG_REG));
+	sw_w32(sds_conf_value, RTL838X_SDS_CFG_REG);
+
+	pr_info("Configuration of SERDES done\n");
+
+	return 0;
+}
+
+static int rtl8390_configure_serdes(struct phy_device *phydev)
+{
+	phydev_info(phydev, "Detected internal RTL8390 SERDES\n");
+
+	/* In autoneg state, force link, set SR4_CFG_EN_LINK_FIB1G */
+	sw_w32_mask(0, 1 << 18, RTL839X_SDS12_13_XSG0 + 0x0a);
+
+	/* Disable EEE: Clear FRE16_EEE_RSG_FIB1G, FRE16_EEE_STD_FIB1G,
+	 * FRE16_C1_PWRSAV_EN_FIB1G, FRE16_C2_PWRSAV_EN_FIB1G
+	 * and FRE16_EEE_QUIET_FIB1G
+	 */
+	sw_w32_mask(0x1f << 10, 0, RTL839X_SDS12_13_XSG0 + 0xe0);
+
+	return 0;
+}
+
+void rtl9300_sds_field_w(int sds, u32 page, u32 reg, int end_bit, int start_bit, u32 v)
+{
+	int l = end_bit - start_bit + 1;
+	u32 data = v;
+
+	if (l < 32) {
+		u32 mask = BIT(l) - 1;
+
+		data = rtl930x_read_sds_phy(sds, page, reg);
+		data &= ~(mask << start_bit);
+		data |= (v & mask) << start_bit;
+	}
+
+	rtl930x_write_sds_phy(sds, page, reg, data);
+}
+
+u32 rtl9300_sds_field_r(int sds, u32 page, u32 reg, int end_bit, int start_bit)
+{
+	int l = end_bit - start_bit + 1;
+	u32 v = rtl930x_read_sds_phy(sds, page, reg);
+
+	if (l >= 32)
+		return v;
+
+	return (v >> start_bit) & (BIT(l) - 1);
+}
+
+/* Read the link and speed status of the internal SerDes of the RTL9300
+ */
+static int rtl9300_read_status(struct phy_device *phydev)
+{
+	struct device *dev = &phydev->mdio.dev;
+	int phy_addr = phydev->mdio.addr;
+	struct device_node *dn;
+	u32 sds_num = 0, status, latch_status, mode;
+
+	if (dev->of_node) {
+		dn = dev->of_node;
+
+		if (of_property_read_u32(dn, "sds", &sds_num))
+			sds_num = -1;
+		pr_info("%s: Port %d, SerDes is %d\n", __func__, phy_addr, sds_num);
+	} else {
+		dev_err(dev, "No DT node.\n");
+		return -EINVAL;
+	}
+
+	if (sds_num < 0)
+		return 0;
+
+	mode = rtl9300_sds_mode_get(sds_num);
+	pr_info("%s got SDS mode %02x\n", __func__, mode);
+	if (mode == 0x1a) { /* 10GR mode */
+		status = rtl9300_sds_field_r(sds_num, 0x5, 0, 12, 12);
+		latch_status = rtl9300_sds_field_r(sds_num, 0x4, 1, 2, 2);
+		status |= rtl9300_sds_field_r(sds_num, 0x5, 0, 12, 12);
+		latch_status |= rtl9300_sds_field_r(sds_num, 0x4, 1, 2, 2);
+	} else {
+		status = rtl9300_sds_field_r(sds_num, 0x1, 29, 8, 0);
+		latch_status = rtl9300_sds_field_r(sds_num, 0x1, 30, 8, 0);
+		status |= rtl9300_sds_field_r(sds_num, 0x1, 29, 8, 0);
+		latch_status |= rtl9300_sds_field_r(sds_num, 0x1, 30, 8, 0);
+	}
+
+	pr_info("%s link status: status: %d, latch %d\n", __func__, status, latch_status);
+
+	if (latch_status) {
+		phydev->link = true;
+		if (mode == 0x1a)
+			phydev->speed = SPEED_10000;
+		else
+			phydev->speed = SPEED_1000;
+
+		phydev->duplex = DUPLEX_FULL;
+	}
+
+	return 0;
+}
+
+void rtl930x_sds_rx_rst(int sds_num, phy_interface_t phy_if)
+{
+	int page = 0x2e; /* 10GR and USXGMII */
+
+	if (phy_if == PHY_INTERFACE_MODE_1000BASEX)
+		page = 0x24;
+
+	rtl9300_sds_field_w(sds_num, page, 0x15, 4, 4, 0x1);
+	mdelay(5);
+	rtl9300_sds_field_w(sds_num, page, 0x15, 4, 4, 0x0);
+}
+
+/* Force PHY modes on 10GBit Serdes
+ */
+void rtl9300_force_sds_mode(int sds, phy_interface_t phy_if)
+{
+	int lc_value;
+	int sds_mode;
+	bool lc_on;
+	int lane_0 = (sds % 2) ? sds - 1 : sds;
+	u32 v;
+
+	pr_info("%s: SDS: %d, mode %d\n", __func__, sds, phy_if);
+	switch (phy_if) {
+	case PHY_INTERFACE_MODE_SGMII:
+		sds_mode = 0x2;
+		lc_on = false;
+		lc_value = 0x1;
+		break;
+
+	case PHY_INTERFACE_MODE_HSGMII:
+		sds_mode = 0x12;
+		lc_value = 0x3;
+		/* Configure LC */
+		break;
+
+	case PHY_INTERFACE_MODE_1000BASEX:
+		sds_mode = 0x04;
+		lc_on = false;
+		break;
+
+	case PHY_INTERFACE_MODE_2500BASEX:
+		sds_mode = 0x16;
+		lc_value = 0x3;
+		/* Configure LC */
+		break;
+
+	case PHY_INTERFACE_MODE_10GBASER:
+		sds_mode = 0x1a;
+		lc_on = true;
+		lc_value = 0x5;
+		break;
+
+	case PHY_INTERFACE_MODE_NA:
+		/* This will disable SerDes */
+		sds_mode = 0x1f;
+		break;
+
+	default:
+		pr_err("%s: unknown serdes mode: %s\n",
+		       __func__, phy_modes(phy_if));
+		return;
+	}
+
+	pr_info("%s --------------------- serdes %d forcing to %x ...\n", __func__, sds, sds_mode);
+	/* Power down SerDes */
+	rtl9300_sds_field_w(sds, 0x20, 0, 7, 6, 0x3);
+	if (sds == 5) pr_info("%s after %x\n", __func__, rtl930x_read_sds_phy(sds, 0x20, 0));
+
+	if (sds == 5) pr_info("%s a %x\n", __func__, rtl930x_read_sds_phy(sds, 0x1f, 9));
+	/* Force mode enable */
+	rtl9300_sds_field_w(sds, 0x1f, 9, 6, 6, 0x1);
+	if (sds == 5) pr_info("%s b %x\n", __func__, rtl930x_read_sds_phy(sds, 0x1f, 9));
+
+	/* SerDes off */
+	rtl9300_sds_field_w(sds, 0x1f, 9, 11, 7, 0x1f);
+
+	if (phy_if == PHY_INTERFACE_MODE_NA)
+		return;
+
+	if (sds == 5) pr_info("%s c %x\n", __func__, rtl930x_read_sds_phy(sds, 0x20, 18));
+	/* Enable LC and ring */
+	rtl9300_sds_field_w(lane_0, 0x20, 18, 3, 0, 0xf);
+
+	if (sds == lane_0)
+		rtl9300_sds_field_w(lane_0, 0x20, 18, 5, 4, 0x1);
+	else
+		rtl9300_sds_field_w(lane_0, 0x20, 18, 7, 6, 0x1);
+
+	rtl9300_sds_field_w(sds, 0x20, 0, 5, 4, 0x3);
+
+	if (lc_on)
+		rtl9300_sds_field_w(lane_0, 0x20, 18, 11, 8, lc_value);
+	else
+		rtl9300_sds_field_w(lane_0, 0x20, 18, 15, 12, lc_value);
+
+	/* Force analog LC & ring on */
+	rtl9300_sds_field_w(lane_0, 0x21, 11, 3, 0, 0xf);
+
+	v = lc_on ? 0x3 : 0x1;
+
+	if (sds == lane_0)
+		rtl9300_sds_field_w(lane_0, 0x20, 18, 5, 4, v);
+	else
+		rtl9300_sds_field_w(lane_0, 0x20, 18, 7, 6, v);
+
+	/* Force SerDes mode */
+	rtl9300_sds_field_w(sds, 0x1f, 9, 6, 6, 1);
+	rtl9300_sds_field_w(sds, 0x1f, 9, 11, 7, sds_mode);
+
+	/* Toggle LC or Ring */
+	for (int i = 0; i < 20; i++) {
+		u32 cr_0, cr_1, cr_2;
+		u32 m_bit, l_bit;
+
+		mdelay(200);
+
+		rtl930x_write_sds_phy(lane_0, 0x1f, 2, 53);
+
+		m_bit = (lane_0 == sds) ? (4) : (5);
+		l_bit = (lane_0 == sds) ? (4) : (5);
+
+		cr_0 = rtl9300_sds_field_r(lane_0, 0x1f, 20, m_bit, l_bit);
+		mdelay(10);
+		cr_1 = rtl9300_sds_field_r(lane_0, 0x1f, 20, m_bit, l_bit);
+		mdelay(10);
+		cr_2 = rtl9300_sds_field_r(lane_0, 0x1f, 20, m_bit, l_bit);
+
+		if (cr_0 && cr_1 && cr_2) {
+			u32 t;
+
+			if (phy_if != PHY_INTERFACE_MODE_10GBASER)
+				break;
+
+			t = rtl9300_sds_field_r(sds, 0x6, 0x1, 2, 2);
+			rtl9300_sds_field_w(sds, 0x6, 0x1, 2, 2, 0x1);
+
+			/* Reset FSM */
+			rtl9300_sds_field_w(sds, 0x6, 0x2, 12, 12, 0x1);
+			mdelay(10);
+			rtl9300_sds_field_w(sds, 0x6, 0x2, 12, 12, 0x0);
+			mdelay(10);
+
+			/* Need to read this twice */
+			v = rtl9300_sds_field_r(sds, 0x5, 0, 12, 12);
+			v = rtl9300_sds_field_r(sds, 0x5, 0, 12, 12);
+
+			rtl9300_sds_field_w(sds, 0x6, 0x1, 2, 2, t);
+
+			/* Reset FSM again */
+			rtl9300_sds_field_w(sds, 0x6, 0x2, 12, 12, 0x1);
+			mdelay(10);
+			rtl9300_sds_field_w(sds, 0x6, 0x2, 12, 12, 0x0);
+			mdelay(10);
+
+			if (v == 1)
+				break;
+		}
+
+		m_bit = (phy_if == PHY_INTERFACE_MODE_10GBASER) ? 3 : 1;
+		l_bit = (phy_if == PHY_INTERFACE_MODE_10GBASER) ? 2 : 0;
+
+		rtl9300_sds_field_w(lane_0, 0x21, 11, m_bit, l_bit, 0x2);
+		mdelay(10);
+		rtl9300_sds_field_w(lane_0, 0x21, 11, m_bit, l_bit, 0x3);
+	}
+
+	rtl930x_sds_rx_rst(sds, phy_if);
+
+	/* Re-enable power */
+	rtl9300_sds_field_w(sds, 0x20, 0, 7, 6, 0);
+
+	pr_info("%s --------------------- serdes %d forced to %x DONE\n", __func__, sds, sds_mode);
+}
+
+void rtl9300_sds_tx_config(int sds, phy_interface_t phy_if)
+{
+	/* parameters: rtl9303_80G_txParam_s2 */
+	int impedance = 0x8;
+	int pre_amp = 0x2;
+	int main_amp = 0x9;
+	int post_amp = 0x2;
+	int pre_en = 0x1;
+	int post_en = 0x1;
+	int page;
+
+	switch(phy_if) {
+	case PHY_INTERFACE_MODE_1000BASEX:
+		page = 0x25;
+		break;
+	case PHY_INTERFACE_MODE_HSGMII:
+	case PHY_INTERFACE_MODE_2500BASEX:
+		page = 0x29;
+		break;
+	case PHY_INTERFACE_MODE_10GBASER:
+		page = 0x2f;
+		break;
+	default:
+		pr_err("%s: unsupported PHY mode\n", __func__);
+		return;
+	}
+
+	rtl9300_sds_field_w(sds, page, 0x01, 15, 11, pre_amp);
+	rtl9300_sds_field_w(sds, page, 0x06,  4,  0, post_amp);
+	rtl9300_sds_field_w(sds, page, 0x07,  0,  0, pre_en);
+	rtl9300_sds_field_w(sds, page, 0x07,  3,  3, post_en);
+	rtl9300_sds_field_w(sds, page, 0x07,  8,  4, main_amp);
+	rtl9300_sds_field_w(sds, page, 0x18, 15, 12, impedance);
+}
+
+/* Wait for clock ready, this assumes the SerDes is in XGMII mode
+ * timeout is in ms
+ */
+int rtl9300_sds_clock_wait(int timeout)
+{
+	u32 v;
+	unsigned long start = jiffies;
+
+	do {
+		rtl9300_sds_field_w(2, 0x1f, 0x2, 15, 0, 53);
+		v = rtl9300_sds_field_r(2, 0x1f, 20, 5, 4);
+		if (v == 3)
+			return 0;
+	} while (jiffies < start + (HZ / 1000) * timeout);
+
+	return 1;
+}
+
+void rtl9300_serdes_mac_link_config(int sds, bool tx_normal, bool rx_normal)
+{
+	u32 v10, v1;
+
+	v10 = rtl930x_read_sds_phy(sds, 6, 2); /* 10GBit, page 6, reg 2 */
+	v1 = rtl930x_read_sds_phy(sds, 0, 0); /* 1GBit, page 0, reg 0 */
+	pr_info("%s: registers before %08x %08x\n", __func__, v10, v1);
+
+	v10 &= ~(BIT(13) | BIT(14));
+	v1 &= ~(BIT(8) | BIT(9));
+
+	v10 |= rx_normal ? 0 : BIT(13);
+	v1 |= rx_normal ? 0 : BIT(9);
+
+	v10 |= tx_normal ? 0 : BIT(14);
+	v1 |= tx_normal ? 0 : BIT(8);
+
+	rtl930x_write_sds_phy(sds, 6, 2, v10);
+	rtl930x_write_sds_phy(sds, 0, 0, v1);
+
+	v10 = rtl930x_read_sds_phy(sds, 6, 2);
+	v1 = rtl930x_read_sds_phy(sds, 0, 0);
+	pr_info("%s: registers after %08x %08x\n", __func__, v10, v1);
+}
+
+void rtl9300_sds_rxcal_dcvs_manual(u32 sds_num, u32 dcvs_id, bool manual, u32 dvcs_list[])
+{
+	if (manual) {
+		switch(dcvs_id) {
+		case 0:
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x1e, 14, 14, 0x1);
+			rtl9300_sds_field_w(sds_num, 0x2f, 0x03,  5,  5, dvcs_list[0]);
+			rtl9300_sds_field_w(sds_num, 0x2f, 0x03,  4,  0, dvcs_list[1]);
+			break;
+		case 1:
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x1e, 13, 13, 0x1);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x1d, 15, 15, dvcs_list[0]);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x1d, 14, 11, dvcs_list[1]);
+			break;
+		case 2:
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x1e, 12, 12, 0x1);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x1d, 10, 10, dvcs_list[0]);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x1d,  9,  6, dvcs_list[1]);
+			break;
+		case 3:
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x1e, 11, 11, 0x1);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x1d,  5,  5, dvcs_list[0]);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x1d,  4,  1, dvcs_list[1]);
+			break;
+		case 4:
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x01, 15, 15, 0x1);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x11, 10, 10, dvcs_list[0]);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x11,  9,  6, dvcs_list[1]);
+			break;
+		case 5:
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x02, 11, 11, 0x1);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x11,  4,  4, dvcs_list[0]);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x11,  3,  0, dvcs_list[1]);
+			break;
+		default:
+			break;
+		}
+	} else {
+		switch(dcvs_id) {
+		case 0:
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x1e, 14, 14, 0x0);
+			break;
+		case 1:
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x1e, 13, 13, 0x0);
+			break;
+		case 2:
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x1e, 12, 12, 0x0);
+			break;
+		case 3:
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x1e, 11, 11, 0x0);
+			break;
+		case 4:
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x01, 15, 15, 0x0);
+			break;
+		case 5:
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x02, 11, 11, 0x0);
+			break;
+		default:
+			break;
+		}
+		mdelay(1);
+	}
+}
+
+void rtl9300_sds_rxcal_dcvs_get(u32 sds_num, u32 dcvs_id, u32 dcvs_list[])
+{
+	u32 dcvs_sign_out = 0, dcvs_coef_bin = 0;
+	bool dcvs_manual;
+
+	if (!(sds_num % 2))
+		rtl930x_write_sds_phy(sds_num, 0x1f, 0x2, 0x2f);
+	else
+		rtl930x_write_sds_phy(sds_num - 1, 0x1f, 0x2, 0x31);
+
+	/* ##Page0x2E, Reg0x15[9], REG0_RX_EN_TEST=[1] */
+	rtl9300_sds_field_w(sds_num, 0x2e, 0x15, 9, 9, 0x1);
+
+	/* ##Page0x21, Reg0x06[11 6], REG0_RX_DEBUG_SEL=[1 0 x x x x] */
+	rtl9300_sds_field_w(sds_num, 0x21, 0x06, 11, 6, 0x20);
+
+	switch(dcvs_id) {
+	case 0:
+		rtl9300_sds_field_w(sds_num, 0x2f, 0x0c, 5, 0, 0x22);
+		mdelay(1);
+
+		/* ##DCVS0 Read Out */
+		dcvs_sign_out = rtl9300_sds_field_r(sds_num, 0x1f, 0x14,  4,  4);
+		dcvs_coef_bin = rtl9300_sds_field_r(sds_num, 0x1f, 0x14,  3,  0);
+		dcvs_manual = !!rtl9300_sds_field_r(sds_num, 0x2e, 0x1e, 14, 14);
+		break;
+
+	case 1:
+		rtl9300_sds_field_w(sds_num, 0x2f, 0x0c, 5, 0, 0x23);
+		mdelay(1);
+
+		/* ##DCVS0 Read Out */
+		dcvs_coef_bin = rtl9300_sds_field_r(sds_num, 0x1f, 0x14,  4,  4);
+		dcvs_coef_bin = rtl9300_sds_field_r(sds_num, 0x1f, 0x14,  3,  0);
+		dcvs_manual = !!rtl9300_sds_field_r(sds_num, 0x2e, 0x1e, 13, 13);
+		break;
+
+	case 2:
+		rtl9300_sds_field_w(sds_num, 0x2f, 0x0c, 5, 0, 0x24);
+		mdelay(1);
+
+		/* ##DCVS0 Read Out */
+		dcvs_sign_out = rtl9300_sds_field_r(sds_num, 0x1f, 0x14,  4,  4);
+		dcvs_coef_bin = rtl9300_sds_field_r(sds_num, 0x1f, 0x14,  3,  0);
+		dcvs_manual = !!rtl9300_sds_field_r(sds_num, 0x2e, 0x1e, 12, 12);
+		break;
+	case 3:
+		rtl9300_sds_field_w(sds_num, 0x2f, 0x0c, 5, 0, 0x25);
+		mdelay(1);
+
+		/* ##DCVS0 Read Out */
+		dcvs_sign_out = rtl9300_sds_field_r(sds_num, 0x1f, 0x14,  4,  4);
+		dcvs_coef_bin = rtl9300_sds_field_r(sds_num, 0x1f, 0x14,  3,  0);
+		dcvs_manual   = rtl9300_sds_field_r(sds_num, 0x2e, 0x1e, 11, 11);
+		break;
+
+	case 4:
+		rtl9300_sds_field_w(sds_num, 0x2f, 0x0c, 5, 0, 0x2c);
+		mdelay(1);
+
+		/* ##DCVS0 Read Out */
+		dcvs_sign_out = rtl9300_sds_field_r(sds_num, 0x1f, 0x14,  4,  4);
+		dcvs_coef_bin = rtl9300_sds_field_r(sds_num, 0x1f, 0x14,  3,  0);
+		dcvs_manual = !!rtl9300_sds_field_r(sds_num, 0x2e, 0x01, 15, 15);
+		break;
+
+	case 5:
+		rtl9300_sds_field_w(sds_num, 0x2f, 0x0c, 5, 0, 0x2d);
+		mdelay(1);
+
+		/* ##DCVS0 Read Out */
+		dcvs_sign_out = rtl9300_sds_field_r(sds_num, 0x1f, 0x14,  4,  4);
+		dcvs_coef_bin = rtl9300_sds_field_r(sds_num, 0x1f, 0x14,  3,  0);
+		dcvs_manual   = rtl9300_sds_field_r(sds_num, 0x2e, 0x02, 11, 11);
+		break;
+
+	default:
+		break;
+	}
+
+	if (dcvs_sign_out)
+		pr_info("%s DCVS %u Sign: -", __func__, dcvs_id);
+	else
+		pr_info("%s DCVS %u Sign: +", __func__, dcvs_id);
+
+	pr_info("DCVS %u even coefficient = %u", dcvs_id, dcvs_coef_bin);
+	pr_info("DCVS %u manual = %u", dcvs_id, dcvs_manual);
+
+	dcvs_list[0] = dcvs_sign_out;
+	dcvs_list[1] = dcvs_coef_bin;
+}
+
+void rtl9300_sds_rxcal_leq_manual(u32 sds_num, bool manual, u32 leq_gray)
+{
+	if (manual) {
+		rtl9300_sds_field_w(sds_num, 0x2e, 0x18, 15, 15, 0x1);
+		rtl9300_sds_field_w(sds_num, 0x2e, 0x16, 14, 10, leq_gray);
+	} else {
+		rtl9300_sds_field_w(sds_num, 0x2e, 0x18, 15, 15, 0x0);
+		mdelay(100);
+	}
+}
+
+void rtl9300_sds_rxcal_leq_offset_manual(u32 sds_num, bool manual, u32 offset)
+{
+	if (manual) {
+		rtl9300_sds_field_w(sds_num, 0x2e, 0x17, 6, 2, offset);
+	} else {
+		rtl9300_sds_field_w(sds_num, 0x2e, 0x17, 6, 2, offset);
+		mdelay(1);
+	}
+}
+
+#define GRAY_BITS 5
+u32 rtl9300_sds_rxcal_gray_to_binary(u32 gray_code)
+{
+	int i, j, m;
+	u32 g[GRAY_BITS];
+	u32 c[GRAY_BITS];
+	u32 leq_binary = 0;
+
+	for(i = 0; i < GRAY_BITS; i++)
+		g[i] = (gray_code & BIT(i)) >> i;
+
+	m = GRAY_BITS - 1;
+
+	c[m] = g[m];
+
+	for(i = 0; i < m; i++) {
+		c[i] = g[i];
+		for(j  = i + 1; j < GRAY_BITS; j++)
+			c[i] = c[i] ^ g[j];
+	}
+
+	for(i = 0; i < GRAY_BITS; i++)
+		leq_binary += c[i] << i;
+
+	return leq_binary;
+}
+
+u32 rtl9300_sds_rxcal_leq_read(int sds_num)
+{
+	u32 leq_gray, leq_bin;
+	bool leq_manual;
+
+	if (!(sds_num % 2))
+		rtl930x_write_sds_phy(sds_num, 0x1f, 0x2, 0x2f);
+	else
+		rtl930x_write_sds_phy(sds_num - 1, 0x1f, 0x2, 0x31);
+
+	/* ##Page0x2E, Reg0x15[9], REG0_RX_EN_TEST=[1] */
+	rtl9300_sds_field_w(sds_num, 0x2e, 0x15, 9, 9, 0x1);
+
+	/* ##Page0x21, Reg0x06[11 6], REG0_RX_DEBUG_SEL=[0 1 x x x x] */
+	rtl9300_sds_field_w(sds_num, 0x21, 0x06, 11, 6, 0x10);
+	mdelay(1);
+
+	/* ##LEQ Read Out */
+	leq_gray = rtl9300_sds_field_r(sds_num, 0x1f, 0x14, 7, 3);
+	leq_manual = !!rtl9300_sds_field_r(sds_num, 0x2e, 0x18, 15, 15);
+	leq_bin = rtl9300_sds_rxcal_gray_to_binary(leq_gray);
+
+	pr_info("LEQ_gray: %u, LEQ_bin: %u", leq_gray, leq_bin);
+	pr_info("LEQ manual: %u", leq_manual);
+
+	return leq_bin;
+}
+
+void rtl9300_sds_rxcal_vth_manual(u32 sds_num, bool manual, u32 vth_list[])
+{
+	if (manual) {
+		rtl9300_sds_field_w(sds_num, 0x2e, 0x0f, 13, 13, 0x1);
+		rtl9300_sds_field_w(sds_num, 0x2e, 0x13,  5,  3, vth_list[0]);
+		rtl9300_sds_field_w(sds_num, 0x2e, 0x13,  2,  0, vth_list[1]);
+	} else {
+		rtl9300_sds_field_w(sds_num, 0x2e, 0x0f, 13, 13, 0x0);
+		mdelay(10);
+	}
+}
+
+void rtl9300_sds_rxcal_vth_get(u32  sds_num, u32 vth_list[])
+{
+	u32 vth_manual;
+
+	/* ##Page0x1F, Reg0x02[15 0], REG_DBGO_SEL=[0x002F]; */ /* Lane0 */
+	/* ##Page0x1F, Reg0x02[15 0], REG_DBGO_SEL=[0x0031]; */ /* Lane1 */
+	if (!(sds_num % 2))
+		rtl930x_write_sds_phy(sds_num, 0x1f, 0x2, 0x2f);
+	else
+		rtl930x_write_sds_phy(sds_num - 1, 0x1f, 0x2, 0x31);
+
+	/* ##Page0x2E, Reg0x15[9], REG0_RX_EN_TEST=[1] */
+	rtl9300_sds_field_w(sds_num, 0x2e, 0x15, 9, 9, 0x1);
+	/* ##Page0x21, Reg0x06[11 6], REG0_RX_DEBUG_SEL=[1 0 x x x x] */
+	rtl9300_sds_field_w(sds_num, 0x21, 0x06, 11, 6, 0x20);
+	/* ##Page0x2F, Reg0x0C[5 0], REG0_COEF_SEL=[0 0 1 1 0 0] */
+	rtl9300_sds_field_w(sds_num, 0x2f, 0x0c, 5, 0, 0xc);
+
+	mdelay(1);
+
+	/* ##VthP & VthN Read Out */
+	vth_list[0] = rtl9300_sds_field_r(sds_num, 0x1f, 0x14, 2, 0); /* v_thp set bin */
+	vth_list[1] = rtl9300_sds_field_r(sds_num, 0x1f, 0x14, 5, 3); /* v_thn set bin */
+
+	pr_info("vth_set_bin = %d", vth_list[0]);
+	pr_info("vth_set_bin = %d", vth_list[1]);
+
+	vth_manual = !!rtl9300_sds_field_r(sds_num, 0x2e, 0x0f, 13, 13);
+	pr_info("Vth Maunal = %d", vth_manual);
+}
+
+void rtl9300_sds_rxcal_tap_manual(u32 sds_num, int tap_id, bool manual, u32 tap_list[])
+{
+	if (manual) {
+		switch(tap_id) {
+		case 0:
+			/* ##REG0_LOAD_IN_INIT[0]=1; REG0_TAP0_INIT[5:0]=Tap0_Value */
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x0f, tap_id + 7, tap_id + 7, 0x1);
+			rtl9300_sds_field_w(sds_num, 0x2f, 0x03, 5, 5, tap_list[0]);
+			rtl9300_sds_field_w(sds_num, 0x2f, 0x03, 4, 0, tap_list[1]);
+			break;
+		case 1:
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x0f, tap_id + 7, tap_id + 7, 0x1);
+			rtl9300_sds_field_w(sds_num, 0x21, 0x07, 6, 6, tap_list[0]);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x09, 11, 6, tap_list[1]);
+			rtl9300_sds_field_w(sds_num, 0x21, 0x07, 5, 5, tap_list[2]);
+			rtl9300_sds_field_w(sds_num, 0x2f, 0x12, 5, 0, tap_list[3]);
+			break;
+		case 2:
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x0f, tap_id + 7, tap_id + 7, 0x1);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x09, 5, 5, tap_list[0]);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x09, 4, 0, tap_list[1]);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x0a, 11, 11, tap_list[2]);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x0a, 10, 6, tap_list[3]);
+			break;
+		case 3:
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x0f, tap_id + 7, tap_id + 7, 0x1);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x0a, 5, 5, tap_list[0]);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x0a, 4, 0, tap_list[1]);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x06, 5, 5, tap_list[2]);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x06, 4, 0, tap_list[3]);
+			break;
+		case 4:
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x0f, tap_id + 7, tap_id + 7, 0x1);
+			rtl9300_sds_field_w(sds_num, 0x2f, 0x01, 5, 5, tap_list[0]);
+			rtl9300_sds_field_w(sds_num, 0x2f, 0x01, 4, 0, tap_list[1]);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x06, 11, 11, tap_list[2]);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x06, 10, 6, tap_list[3]);
+			break;
+		default:
+			break;
+		}
+	} else {
+		rtl9300_sds_field_w(sds_num, 0x2e, 0x0f, tap_id + 7, tap_id + 7, 0x0);
+		mdelay(10);
+	}
+}
+
+void rtl9300_sds_rxcal_tap_get(u32 sds_num, u32 tap_id, u32 tap_list[])
+{
+	u32 tap0_sign_out;
+	u32 tap0_coef_bin;
+	u32 tap_sign_out_even;
+	u32 tap_coef_bin_even;
+	u32 tap_sign_out_odd;
+	u32 tap_coef_bin_odd;
+	bool tap_manual;
+
+	if (!(sds_num % 2))
+		rtl930x_write_sds_phy(sds_num, 0x1f, 0x2, 0x2f);
+	else
+		rtl930x_write_sds_phy(sds_num - 1, 0x1f, 0x2, 0x31);
+
+	/* ##Page0x2E, Reg0x15[9], REG0_RX_EN_TEST=[1] */
+	rtl9300_sds_field_w(sds_num, 0x2e, 0x15, 9, 9, 0x1);
+	/* ##Page0x21, Reg0x06[11 6], REG0_RX_DEBUG_SEL=[1 0 x x x x] */
+	rtl9300_sds_field_w(sds_num, 0x21, 0x06, 11, 6, 0x20);
+
+	if (!tap_id) {
+		/* ##Page0x2F, Reg0x0C[5 0], REG0_COEF_SEL=[0 0 0 0 0 1] */
+		rtl9300_sds_field_w(sds_num, 0x2f, 0x0c, 5, 0, 0);
+		/* ##Tap1 Even Read Out */
+		mdelay(1);
+		tap0_sign_out = rtl9300_sds_field_r(sds_num, 0x1f, 0x14, 5, 5);
+		tap0_coef_bin = rtl9300_sds_field_r(sds_num, 0x1f, 0x14, 4, 0);
+
+		if (tap0_sign_out == 1)
+			pr_info("Tap0 Sign : -");
+		else
+			pr_info("Tap0 Sign : +");
+
+		pr_info("tap0_coef_bin = %d", tap0_coef_bin);
+
+		tap_list[0] = tap0_sign_out;
+		tap_list[1] = tap0_coef_bin;
+
+		tap_manual = !!rtl9300_sds_field_r(sds_num, 0x2e, 0x0f, 7, 7);
+		pr_info("tap0 manual = %u",tap_manual);
+	} else {
+		/* ##Page0x2F, Reg0x0C[5 0], REG0_COEF_SEL=[0 0 0 0 0 1] */
+		rtl9300_sds_field_w(sds_num, 0x2f, 0x0c, 5, 0, tap_id);
+		mdelay(1);
+		/* ##Tap1 Even Read Out */
+		tap_sign_out_even = rtl9300_sds_field_r(sds_num, 0x1f, 0x14, 5, 5);
+		tap_coef_bin_even = rtl9300_sds_field_r(sds_num, 0x1f, 0x14, 4, 0);
+
+		/* ##Page0x2F, Reg0x0C[5 0], REG0_COEF_SEL=[0 0 0 1 1 0] */
+		rtl9300_sds_field_w(sds_num, 0x2f, 0x0c, 5, 0, (tap_id + 5));
+		/* ##Tap1 Odd Read Out */
+		tap_sign_out_odd = rtl9300_sds_field_r(sds_num, 0x1f, 0x14, 5, 5);
+		tap_coef_bin_odd = rtl9300_sds_field_r(sds_num, 0x1f, 0x14, 4, 0);
+
+		if (tap_sign_out_even == 1)
+			pr_info("Tap %u even sign: -", tap_id);
+		else
+			pr_info("Tap %u even sign: +", tap_id);
+
+		pr_info("Tap %u even coefficient = %u", tap_id, tap_coef_bin_even);
+
+		if (tap_sign_out_odd == 1)
+			pr_info("Tap %u odd sign: -", tap_id);
+		else
+			pr_info("Tap %u odd sign: +", tap_id);
+
+		pr_info("Tap %u odd coefficient = %u", tap_id,tap_coef_bin_odd);
+
+		tap_list[0] = tap_sign_out_even;
+		tap_list[1] = tap_coef_bin_even;
+		tap_list[2] = tap_sign_out_odd;
+		tap_list[3] = tap_coef_bin_odd;
+
+		tap_manual = rtl9300_sds_field_r(sds_num, 0x2e, 0x0f, tap_id + 7, tap_id + 7);
+		pr_info("tap %u manual = %d",tap_id, tap_manual);
+	}
+}
+
+void rtl9300_do_rx_calibration_1(int sds, phy_interface_t phy_mode)
+{
+	/* From both rtl9300_rxCaliConf_serdes_myParam and rtl9300_rxCaliConf_phy_myParam */
+	int tap0_init_val = 0x1f; /* Initial Decision Fed Equalizer 0 tap */
+	int vth_min       = 0x0;
+
+	pr_info("start_1.1.1 initial value for sds %d\n", sds);
+	rtl930x_write_sds_phy(sds, 6,  0, 0);
+
+	/* FGCAL */
+	rtl9300_sds_field_w(sds, 0x2e, 0x01, 14, 14, 0x00);
+	rtl9300_sds_field_w(sds, 0x2e, 0x1c, 10,  5, 0x20);
+	rtl9300_sds_field_w(sds, 0x2f, 0x02,  0,  0, 0x01);
+
+	/* DCVS */
+	rtl9300_sds_field_w(sds, 0x2e, 0x1e, 14, 11, 0x00);
+	rtl9300_sds_field_w(sds, 0x2e, 0x01, 15, 15, 0x00);
+	rtl9300_sds_field_w(sds, 0x2e, 0x02, 11, 11, 0x00);
+	rtl9300_sds_field_w(sds, 0x2e, 0x1c,  4,  0, 0x00);
+	rtl9300_sds_field_w(sds, 0x2e, 0x1d, 15, 11, 0x00);
+	rtl9300_sds_field_w(sds, 0x2e, 0x1d, 10,  6, 0x00);
+	rtl9300_sds_field_w(sds, 0x2e, 0x1d,  5,  1, 0x00);
+	rtl9300_sds_field_w(sds, 0x2e, 0x02, 10,  6, 0x00);
+	rtl9300_sds_field_w(sds, 0x2e, 0x11,  4,  0, 0x00);
+	rtl9300_sds_field_w(sds, 0x2f, 0x00,  3,  0, 0x0f);
+	rtl9300_sds_field_w(sds, 0x2e, 0x04,  6,  6, 0x01);
+	rtl9300_sds_field_w(sds, 0x2e, 0x04,  7,  7, 0x01);
+
+	/* LEQ (Long Term Equivalent signal level) */
+	rtl9300_sds_field_w(sds, 0x2e, 0x16, 14,  8, 0x00);
+
+	/* DFE (Decision Fed Equalizer) */
+	rtl9300_sds_field_w(sds, 0x2f, 0x03,  5,  0, tap0_init_val);
+	rtl9300_sds_field_w(sds, 0x2e, 0x09, 11,  6, 0x00);
+	rtl9300_sds_field_w(sds, 0x2e, 0x09,  5,  0, 0x00);
+	rtl9300_sds_field_w(sds, 0x2e, 0x0a,  5,  0, 0x00);
+	rtl9300_sds_field_w(sds, 0x2f, 0x01,  5,  0, 0x00);
+	rtl9300_sds_field_w(sds, 0x2f, 0x12,  5,  0, 0x00);
+	rtl9300_sds_field_w(sds, 0x2e, 0x0a, 11,  6, 0x00);
+	rtl9300_sds_field_w(sds, 0x2e, 0x06,  5,  0, 0x00);
+	rtl9300_sds_field_w(sds, 0x2f, 0x01,  5,  0, 0x00);
+
+	/* Vth */
+	rtl9300_sds_field_w(sds, 0x2e, 0x13,  5,  3, 0x07);
+	rtl9300_sds_field_w(sds, 0x2e, 0x13,  2,  0, 0x07);
+	rtl9300_sds_field_w(sds, 0x2f, 0x0b,  5,  3, vth_min);
+
+	pr_info("end_1.1.1 --\n");
+
+	pr_info("start_1.1.2 Load DFE init. value\n");
+
+	rtl9300_sds_field_w(sds, 0x2e, 0x0f, 13,  7, 0x7f);
+
+	pr_info("end_1.1.2\n");
+
+	pr_info("start_1.1.3 disable LEQ training,enable DFE clock\n");
+
+	rtl9300_sds_field_w(sds, 0x2e, 0x17,  7,  7, 0x00);
+	rtl9300_sds_field_w(sds, 0x2e, 0x17,  6,  2, 0x00);
+	rtl9300_sds_field_w(sds, 0x2e, 0x0c,  8,  8, 0x00);
+	rtl9300_sds_field_w(sds, 0x2e, 0x0b,  4,  4, 0x01);
+	rtl9300_sds_field_w(sds, 0x2e, 0x12, 14, 14, 0x00);
+	rtl9300_sds_field_w(sds, 0x2f, 0x02, 15, 15, 0x00);
+
+	pr_info("end_1.1.3 --\n");
+
+	pr_info("start_1.1.4 offset cali setting\n");
+
+	rtl9300_sds_field_w(sds, 0x2e, 0x0f, 15, 14, 0x03);
+
+	pr_info("end_1.1.4\n");
+
+	pr_info("start_1.1.5 LEQ and DFE setting\n");
+
+	/* TODO: make this work for DAC cables of different lengths */
+	/* For a 10GBit serdes wit Fibre, SDS 8 or 9 */
+	if (phy_mode == PHY_INTERFACE_MODE_10GBASER || PHY_INTERFACE_MODE_1000BASEX)
+		rtl9300_sds_field_w(sds, 0x2e, 0x16,  3,  2, 0x02);
+	else
+		pr_err("%s not PHY-based or SerDes, implement DAC!\n", __func__);
+
+	/* No serdes, check for Aquantia PHYs */
+	rtl9300_sds_field_w(sds, 0x2e, 0x16,  3,  2, 0x02);
+
+	rtl9300_sds_field_w(sds, 0x2e, 0x0f,  6,  0, 0x5f);
+	rtl9300_sds_field_w(sds, 0x2f, 0x05,  7,  2, 0x1f);
+	rtl9300_sds_field_w(sds, 0x2e, 0x19,  9,  5, 0x1f);
+	rtl9300_sds_field_w(sds, 0x2f, 0x0b, 15,  9, 0x3c);
+	rtl9300_sds_field_w(sds, 0x2e, 0x0b,  1,  0, 0x03);
+
+	pr_info("end_1.1.5\n");
+}
+
+void rtl9300_do_rx_calibration_2_1(u32 sds_num)
+{
+	pr_info("start_1.2.1 ForegroundOffsetCal_Manual\n");
+
+	/* Gray config endis to 1 */
+	rtl9300_sds_field_w(sds_num, 0x2f, 0x02,  2,  2, 0x01);
+
+	/* ForegroundOffsetCal_Manual(auto mode) */
+	rtl9300_sds_field_w(sds_num, 0x2e, 0x01, 14, 14, 0x00);
+
+	pr_info("end_1.2.1");
+}
+
+void rtl9300_do_rx_calibration_2_2(int sds_num)
+{
+	/* Force Rx-Run = 0 */
+	rtl9300_sds_field_w(sds_num, 0x2e, 0x15, 8, 8, 0x0);
+
+	rtl930x_sds_rx_rst(sds_num, PHY_INTERFACE_MODE_10GBASER);
+}
+
+void rtl9300_do_rx_calibration_2_3(int sds_num)
+{
+	u32 fgcal_binary, fgcal_gray;
+	u32 offset_range;
+
+	pr_info("start_1.2.3 Foreground Calibration\n");
+
+	while(1) {
+		if (!(sds_num % 2))
+			rtl930x_write_sds_phy(sds_num, 0x1f, 0x2, 0x2f);
+		else
+			rtl930x_write_sds_phy(sds_num -1 , 0x1f, 0x2, 0x31);
+
+		/* ##Page0x2E, Reg0x15[9], REG0_RX_EN_TEST=[1] */
+		rtl9300_sds_field_w(sds_num, 0x2e, 0x15, 9, 9, 0x1);
+		/* ##Page0x21, Reg0x06[11 6], REG0_RX_DEBUG_SEL=[1 0 x x x x] */
+		rtl9300_sds_field_w(sds_num, 0x21, 0x06, 11, 6, 0x20);
+		/* ##Page0x2F, Reg0x0C[5 0], REG0_COEF_SEL=[0 0 1 1 1 1] */
+		rtl9300_sds_field_w(sds_num, 0x2f, 0x0c, 5, 0, 0xf);
+		/* ##FGCAL read gray */
+		fgcal_gray = rtl9300_sds_field_r(sds_num, 0x1f, 0x14, 5, 0);
+		/* ##Page0x2F, Reg0x0C[5 0], REG0_COEF_SEL=[0 0 1 1 1 0] */
+		rtl9300_sds_field_w(sds_num, 0x2f, 0x0c, 5, 0, 0xe);
+		/* ##FGCAL read binary */
+		fgcal_binary = rtl9300_sds_field_r(sds_num, 0x1f, 0x14, 5, 0);
+
+		pr_info("%s: fgcal_gray: %d, fgcal_binary %d\n",
+		        __func__, fgcal_gray, fgcal_binary);
+
+		offset_range = rtl9300_sds_field_r(sds_num, 0x2e, 0x15, 15, 14);
+
+		if (fgcal_binary > 60 || fgcal_binary < 3) {
+			if (offset_range == 3) {
+				pr_info("%s: Foreground Calibration result marginal!", __func__);
+				break;
+			} else {
+				offset_range++;
+				rtl9300_sds_field_w(sds_num, 0x2e, 0x15, 15, 14, offset_range);
+				rtl9300_do_rx_calibration_2_2(sds_num);
+			}
+		} else {
+			break;
+		}
+	}
+	pr_info("%s: end_1.2.3\n", __func__);
+}
+
+void rtl9300_do_rx_calibration_2(int sds)
+{
+	rtl930x_sds_rx_rst(sds, PHY_INTERFACE_MODE_10GBASER);
+	rtl9300_do_rx_calibration_2_1(sds);
+	rtl9300_do_rx_calibration_2_2(sds);
+	rtl9300_do_rx_calibration_2_3(sds);
+}
+
+void rtl9300_sds_rxcal_3_1(int sds_num, phy_interface_t phy_mode)
+{
+	pr_info("start_1.3.1");
+
+	/* ##1.3.1 */
+	if (phy_mode != PHY_INTERFACE_MODE_10GBASER && phy_mode != PHY_INTERFACE_MODE_1000BASEX)
+		rtl9300_sds_field_w(sds_num, 0x2e, 0xc, 8, 8, 0);
+
+	rtl9300_sds_field_w(sds_num, 0x2e, 0x17, 7, 7, 0x0);
+	rtl9300_sds_rxcal_leq_manual(sds_num, false, 0);
+
+	pr_info("end_1.3.1");
+}
+
+void rtl9300_sds_rxcal_3_2(int sds_num, phy_interface_t phy_mode)
+{
+	u32 sum10 = 0, avg10, int10;
+	int dac_long_cable_offset;
+	bool eq_hold_enabled;
+	int i;
+
+	if (phy_mode == PHY_INTERFACE_MODE_10GBASER || phy_mode == PHY_INTERFACE_MODE_1000BASEX) {
+		/* rtl9300_rxCaliConf_serdes_myParam */
+		dac_long_cable_offset = 3;
+		eq_hold_enabled = true;
+	} else {
+		/* rtl9300_rxCaliConf_phy_myParam */
+		dac_long_cable_offset = 0;
+		eq_hold_enabled = false;
+	}
+
+	if (phy_mode == PHY_INTERFACE_MODE_1000BASEX)
+		pr_warn("%s: LEQ only valid for 10GR!\n", __func__);
+
+	pr_info("start_1.3.2");
+
+	for(i = 0; i < 10; i++) {
+		sum10 += rtl9300_sds_rxcal_leq_read(sds_num);
+		mdelay(10);
+	}
+
+	avg10 = (sum10 / 10) + (((sum10 % 10) >= 5) ? 1 : 0);
+	int10 = sum10 / 10;
+
+	pr_info("sum10:%u, avg10:%u, int10:%u", sum10, avg10, int10);
+
+	if (phy_mode == PHY_INTERFACE_MODE_10GBASER || phy_mode == PHY_INTERFACE_MODE_1000BASEX) {
+		if (dac_long_cable_offset) {
+			rtl9300_sds_rxcal_leq_offset_manual(sds_num, 1, dac_long_cable_offset);
+			rtl9300_sds_field_w(sds_num, 0x2e, 0x17, 7, 7, eq_hold_enabled);
+			if (phy_mode == PHY_INTERFACE_MODE_10GBASER)
+				rtl9300_sds_rxcal_leq_manual(sds_num, true, avg10);
+		} else {
+			if (sum10 >= 5) {
+				rtl9300_sds_rxcal_leq_offset_manual(sds_num, 1, 3);
+				rtl9300_sds_field_w(sds_num, 0x2e, 0x17, 7, 7, 0x1);
+				if (phy_mode == PHY_INTERFACE_MODE_10GBASER)
+					rtl9300_sds_rxcal_leq_manual(sds_num, true, avg10);
+			} else {
+				rtl9300_sds_rxcal_leq_offset_manual(sds_num, 1, 0);
+				rtl9300_sds_field_w(sds_num, 0x2e, 0x17, 7, 7, 0x1);
+				if (phy_mode == PHY_INTERFACE_MODE_10GBASER)
+					rtl9300_sds_rxcal_leq_manual(sds_num, true, avg10);
+			}
+		}
+	}
+
+	pr_info("Sds:%u LEQ = %u",sds_num, rtl9300_sds_rxcal_leq_read(sds_num));
+
+	pr_info("end_1.3.2");
+}
+
+void rtl9300_do_rx_calibration_3(int sds_num, phy_interface_t phy_mode)
+{
+	rtl9300_sds_rxcal_3_1(sds_num, phy_mode);
+
+	if (phy_mode == PHY_INTERFACE_MODE_10GBASER || phy_mode == PHY_INTERFACE_MODE_1000BASEX)
+		rtl9300_sds_rxcal_3_2(sds_num, phy_mode);
+}
+
+void rtl9300_do_rx_calibration_4_1(int sds_num)
+{
+	u32 vth_list[2] = {0, 0};
+	u32 tap0_list[4] = {0, 0, 0, 0};
+
+	pr_info("start_1.4.1");
+
+	/* ##1.4.1 */
+	rtl9300_sds_rxcal_vth_manual(sds_num, false, vth_list);
+	rtl9300_sds_rxcal_tap_manual(sds_num, 0, false, tap0_list);
+	mdelay(200);
+
+	pr_info("end_1.4.1");
+}
+
+void rtl9300_do_rx_calibration_4_2(u32 sds_num)
+{
+	u32 vth_list[2];
+	u32 tap_list[4];
+
+	pr_info("start_1.4.2");
+
+	rtl9300_sds_rxcal_vth_get(sds_num, vth_list);
+	rtl9300_sds_rxcal_vth_manual(sds_num, true, vth_list);
+
+	mdelay(100);
+
+	rtl9300_sds_rxcal_tap_get(sds_num, 0, tap_list);
+	rtl9300_sds_rxcal_tap_manual(sds_num, 0, true, tap_list);
+
+	pr_info("end_1.4.2");
+}
+
+void rtl9300_do_rx_calibration_4(u32 sds_num)
+{
+	rtl9300_do_rx_calibration_4_1(sds_num);
+	rtl9300_do_rx_calibration_4_2(sds_num);
+}
+
+void rtl9300_do_rx_calibration_5_2(u32 sds_num)
+{
+	u32 tap1_list[4] = {0};
+	u32 tap2_list[4] = {0};
+	u32 tap3_list[4] = {0};
+	u32 tap4_list[4] = {0};
+
+	pr_info("start_1.5.2");
+
+	rtl9300_sds_rxcal_tap_manual(sds_num, 1, false, tap1_list);
+	rtl9300_sds_rxcal_tap_manual(sds_num, 2, false, tap2_list);
+	rtl9300_sds_rxcal_tap_manual(sds_num, 3, false, tap3_list);
+	rtl9300_sds_rxcal_tap_manual(sds_num, 4, false, tap4_list);
+
+	mdelay(30);
+
+	pr_info("end_1.5.2");
+}
+
+void rtl9300_do_rx_calibration_5(u32 sds_num, phy_interface_t phy_mode)
+{
+	if (phy_mode == PHY_INTERFACE_MODE_10GBASER) /* dfeTap1_4Enable true */
+		rtl9300_do_rx_calibration_5_2(sds_num);
+}
+
+
+void rtl9300_do_rx_calibration_dfe_disable(u32 sds_num)
+{
+	u32 tap1_list[4] = {0};
+	u32 tap2_list[4] = {0};
+	u32 tap3_list[4] = {0};
+	u32 tap4_list[4] = {0};
+
+	rtl9300_sds_rxcal_tap_manual(sds_num, 1, true, tap1_list);
+	rtl9300_sds_rxcal_tap_manual(sds_num, 2, true, tap2_list);
+	rtl9300_sds_rxcal_tap_manual(sds_num, 3, true, tap3_list);
+	rtl9300_sds_rxcal_tap_manual(sds_num, 4, true, tap4_list);
+
+	mdelay(10);
+}
+
+void rtl9300_do_rx_calibration(int sds, phy_interface_t phy_mode)
+{
+	u32 latch_sts;
+
+	rtl9300_do_rx_calibration_1(sds, phy_mode);
+	rtl9300_do_rx_calibration_2(sds);
+	rtl9300_do_rx_calibration_4(sds);
+	rtl9300_do_rx_calibration_5(sds, phy_mode);
+	mdelay(20);
+
+	/* Do this only for 10GR mode, SDS active in mode 0x1a */
+	if (rtl9300_sds_field_r(sds, 0x1f, 9, 11, 7) == 0x1a) {
+		pr_info("%s: SDS enabled\n", __func__);
+		latch_sts = rtl9300_sds_field_r(sds, 0x4, 1, 2, 2);
+		mdelay(1);
+		latch_sts = rtl9300_sds_field_r(sds, 0x4, 1, 2, 2);
+		if (latch_sts) {
+			rtl9300_do_rx_calibration_dfe_disable(sds);
+			rtl9300_do_rx_calibration_4(sds);
+			rtl9300_do_rx_calibration_5(sds, phy_mode);
+		}
+	}
+}
+
+int rtl9300_sds_sym_err_reset(int sds_num, phy_interface_t phy_mode)
+{
+	switch (phy_mode) {
+	case PHY_INTERFACE_MODE_XGMII:
+		break;
+
+	case PHY_INTERFACE_MODE_10GBASER:
+		/* Read twice to clear */
+		rtl930x_read_sds_phy(sds_num, 5, 1);
+		rtl930x_read_sds_phy(sds_num, 5, 1);
+		break;
+
+	case PHY_INTERFACE_MODE_1000BASEX:
+		rtl9300_sds_field_w(sds_num, 0x1, 24, 2, 0, 0);
+		rtl9300_sds_field_w(sds_num, 0x1, 3, 15, 8, 0);
+		rtl9300_sds_field_w(sds_num, 0x1, 2, 15, 0, 0);
+		break;
+
+	default:
+		pr_info("%s unsupported phy mode\n", __func__);
+		return -1;
+	}
+
+	return 0;
+}
+
+u32 rtl9300_sds_sym_err_get(int sds_num, phy_interface_t phy_mode)
+{
+	u32 v = 0;
+
+	switch (phy_mode) {
+	case PHY_INTERFACE_MODE_XGMII:
+		break;
+
+	case PHY_INTERFACE_MODE_10GBASER:
+		v = rtl930x_read_sds_phy(sds_num, 5, 1);
+		return v & 0xff;
+
+	default:
+		pr_info("%s unsupported PHY-mode\n", __func__);
+	}
+
+	return v;
+}
+
+int rtl9300_sds_check_calibration(int sds_num, phy_interface_t phy_mode)
+{
+	u32 errors1, errors2;
+
+	rtl9300_sds_sym_err_reset(sds_num, phy_mode);
+	rtl9300_sds_sym_err_reset(sds_num, phy_mode);
+
+	/* Count errors during 1ms */
+	errors1 = rtl9300_sds_sym_err_get(sds_num, phy_mode);
+	mdelay(1);
+	errors2 = rtl9300_sds_sym_err_get(sds_num, phy_mode);
+
+	switch (phy_mode) {
+		case PHY_INTERFACE_MODE_XGMII:
+
+			if ((errors2 - errors1 > 100) ||
+			    (errors1 >= 0xffff00) || (errors2 >= 0xffff00)) {
+				pr_info("%s XSGMII error rate too high\n", __func__);
+				return 1;
+			}
+			break;
+		case PHY_INTERFACE_MODE_10GBASER:
+			if (errors2 > 0) {
+				pr_info("%s 10GBASER error rate too high\n", __func__);
+				return 1;
+			}
+			break;
+		default:
+			return 1;
+	}
+
+	return 0;
+}
+
+void rtl9300_phy_enable_10g_1g(int sds_num)
+{
+	u32 v;
+
+	/* Enable 1GBit PHY */
+	v = rtl930x_read_sds_phy(sds_num, PHY_PAGE_2, PHY_CTRL_REG);
+	pr_info("%s 1gbit phy: %08x\n", __func__, v);
+	v &= ~BIT(PHY_POWER_BIT);
+	rtl930x_write_sds_phy(sds_num, PHY_PAGE_2, PHY_CTRL_REG, v);
+	pr_info("%s 1gbit phy enabled: %08x\n", __func__, v);
+
+	/* Enable 10GBit PHY */
+	v = rtl930x_read_sds_phy(sds_num, PHY_PAGE_4, PHY_CTRL_REG);
+	pr_info("%s 10gbit phy: %08x\n", __func__, v);
+	v &= ~BIT(PHY_POWER_BIT);
+	rtl930x_write_sds_phy(sds_num, PHY_PAGE_4, PHY_CTRL_REG, v);
+	pr_info("%s 10gbit phy after: %08x\n", __func__, v);
+
+	/* dal_longan_construct_mac_default_10gmedia_fiber */
+	v = rtl930x_read_sds_phy(sds_num, 0x1f, 11);
+	pr_info("%s set medium: %08x\n", __func__, v);
+	v |= BIT(1);
+	rtl930x_write_sds_phy(sds_num, 0x1f, 11, v);
+	pr_info("%s set medium after: %08x\n", __func__, v);
+}
+
+#define RTL930X_MAC_FORCE_MODE_CTRL		(0xCA1C)
+/* phy_mode = PHY_INTERFACE_MODE_10GBASER, sds_mode = 0x1a */
+int rtl9300_serdes_setup(int sds_num, phy_interface_t phy_mode)
+{
+	int sds_mode;
+	int calib_tries = 0;
+
+	switch (phy_mode) {
+	case PHY_INTERFACE_MODE_HSGMII:
+		sds_mode = 0x12;
+		break;
+	case PHY_INTERFACE_MODE_1000BASEX:
+		sds_mode = 0x04;
+		break;
+	case PHY_INTERFACE_MODE_XGMII:
+		sds_mode = 0x10;
+		break;
+	case PHY_INTERFACE_MODE_10GBASER:
+		sds_mode = 0x1a;
+		break;
+	case PHY_INTERFACE_MODE_USXGMII:
+		sds_mode = 0x0d;
+		break;
+	default:
+		pr_err("%s: unknown serdes mode: %s\n", __func__, phy_modes(phy_mode));
+		return -EINVAL;
+	}
+
+	/* Maybe use dal_longan_sds_init */
+
+	/* dal_longan_construct_serdesConfig_init */ /* Serdes Construct */
+	rtl9300_phy_enable_10g_1g(sds_num);
+
+	/* Set Serdes Mode */
+	rtl9300_sds_set(sds_num, 0x1a); /* 0x1b: RTK_MII_10GR1000BX_AUTO */
+
+	/* Do RX calibration */
+	do {
+		rtl9300_do_rx_calibration(sds_num, phy_mode);
+		calib_tries++;
+		mdelay(50);
+	} while (rtl9300_sds_check_calibration(sds_num, phy_mode) && calib_tries < 3);
+
+
+	return 0;
+}
+
+typedef struct {
+	u8 page;
+	u8 reg;
+	u16 data;
+} sds_config;
+
+sds_config rtl9300_a_sds_10gr_lane0[] =
+{
+	/* 1G */
+	{0x00, 0x0E, 0x3053}, {0x01, 0x14, 0x0100}, {0x21, 0x03, 0x8206},
+	{0x21, 0x05, 0x40B0}, {0x21, 0x06, 0x0010}, {0x21, 0x07, 0xF09F},
+	{0x21, 0x0C, 0x0007}, {0x21, 0x0D, 0x6009}, {0x21, 0x0E, 0x0000},
+	{0x21, 0x0F, 0x0008}, {0x24, 0x00, 0x0668}, {0x24, 0x02, 0xD020},
+	{0x24, 0x06, 0xC000}, {0x24, 0x0B, 0x1892}, {0x24, 0x0F, 0xFFDF},
+	{0x24, 0x12, 0x03C4}, {0x24, 0x13, 0x027F}, {0x24, 0x14, 0x1311},
+	{0x24, 0x16, 0x00C9}, {0x24, 0x17, 0xA100}, {0x24, 0x1A, 0x0001},
+	{0x24, 0x1C, 0x0400}, {0x25, 0x01, 0x0300}, {0x25, 0x02, 0x1017},
+	{0x25, 0x03, 0xFFDF}, {0x25, 0x05, 0x7F7C}, {0x25, 0x07, 0x8100},
+	{0x25, 0x08, 0x0001}, {0x25, 0x09, 0xFFD4}, {0x25, 0x0A, 0x7C2F},
+	{0x25, 0x0E, 0x003F}, {0x25, 0x0F, 0x0121}, {0x25, 0x10, 0x0020},
+	{0x25, 0x11, 0x8840}, {0x2B, 0x13, 0x0050}, {0x2B, 0x18, 0x8E88},
+	{0x2B, 0x19, 0x4902}, {0x2B, 0x1D, 0x2501}, {0x2D, 0x13, 0x0050},
+	{0x2D, 0x18, 0x8E88}, {0x2D, 0x19, 0x4902}, {0x2D, 0x1D, 0x2641},
+	{0x2F, 0x13, 0x0050}, {0x2F, 0x18, 0x8E88}, {0x2F, 0x19, 0x4902},
+	{0x2F, 0x1D, 0x66E1},
+	/* 3.125G */
+	{0x28, 0x00, 0x0668}, {0x28, 0x02, 0xD020}, {0x28, 0x06, 0xC000},
+	{0x28, 0x0B, 0x1892}, {0x28, 0x0F, 0xFFDF}, {0x28, 0x12, 0x01C4},
+	{0x28, 0x13, 0x027F}, {0x28, 0x14, 0x1311}, {0x28, 0x16, 0x00C9},
+	{0x28, 0x17, 0xA100}, {0x28, 0x1A, 0x0001}, {0x28, 0x1C, 0x0400},
+	{0x29, 0x01, 0x0300}, {0x29, 0x02, 0x1017}, {0x29, 0x03, 0xFFDF},
+	{0x29, 0x05, 0x7F7C}, {0x29, 0x07, 0x8100}, {0x29, 0x08, 0x0001},
+	{0x29, 0x09, 0xFFD4}, {0x29, 0x0A, 0x7C2F}, {0x29, 0x0E, 0x003F},
+	{0x29, 0x0F, 0x0121}, {0x29, 0x10, 0x0020}, {0x29, 0x11, 0x8840},
+	/* 10G */
+	{0x06, 0x0D, 0x0F00}, {0x06, 0x00, 0x0000}, {0x06, 0x01, 0xC800},
+	{0x21, 0x03, 0x8206}, {0x21, 0x05, 0x40B0}, {0x21, 0x06, 0x0010},
+	{0x21, 0x07, 0xF09F}, {0x21, 0x0C, 0x0007}, {0x21, 0x0D, 0x6009},
+	{0x21, 0x0E, 0x0000}, {0x21, 0x0F, 0x0008}, {0x2E, 0x00, 0xA668},
+	{0x2E, 0x02, 0xD020}, {0x2E, 0x06, 0xC000}, {0x2E, 0x0B, 0x1892},
+	{0x2E, 0x0F, 0xFFDF}, {0x2E, 0x11, 0x8280}, {0x2E, 0x12, 0x0044},
+	{0x2E, 0x13, 0x027F}, {0x2E, 0x14, 0x1311}, {0x2E, 0x17, 0xA100},
+	{0x2E, 0x1A, 0x0001}, {0x2E, 0x1C, 0x0400}, {0x2F, 0x01, 0x0300},
+	{0x2F, 0x02, 0x1217}, {0x2F, 0x03, 0xFFDF}, {0x2F, 0x05, 0x7F7C},
+	{0x2F, 0x07, 0x80C4}, {0x2F, 0x08, 0x0001}, {0x2F, 0x09, 0xFFD4},
+	{0x2F, 0x0A, 0x7C2F}, {0x2F, 0x0E, 0x003F}, {0x2F, 0x0F, 0x0121},
+	{0x2F, 0x10, 0x0020}, {0x2F, 0x11, 0x8840}, {0x2F, 0x14, 0xE008},
+	{0x2B, 0x13, 0x0050}, {0x2B, 0x18, 0x8E88}, {0x2B, 0x19, 0x4902},
+	{0x2B, 0x1D, 0x2501}, {0x2D, 0x13, 0x0050}, {0x2D, 0x17, 0x4109},
+	{0x2D, 0x18, 0x8E88}, {0x2D, 0x19, 0x4902}, {0x2D, 0x1C, 0x1109},
+	{0x2D, 0x1D, 0x2641}, {0x2F, 0x13, 0x0050}, {0x2F, 0x18, 0x8E88},
+	{0x2F, 0x19, 0x4902}, {0x2F, 0x1D, 0x76E1},
+};
+
+sds_config rtl9300_a_sds_10gr_lane1[] =
+{
+	/* 1G */
+	{0x00, 0x0E, 0x3053}, {0x01, 0x14, 0x0100}, {0x21, 0x03, 0x8206},
+	{0x21, 0x06, 0x0010}, {0x21, 0x07, 0xF09F}, {0x21, 0x0A, 0x0003},
+	{0x21, 0x0B, 0x0005}, {0x21, 0x0C, 0x0007}, {0x21, 0x0D, 0x6009},
+	{0x21, 0x0E, 0x0000}, {0x21, 0x0F, 0x0008}, {0x24, 0x00, 0x0668},
+	{0x24, 0x02, 0xD020}, {0x24, 0x06, 0xC000}, {0x24, 0x0B, 0x1892},
+	{0x24, 0x0F, 0xFFDF}, {0x24, 0x12, 0x03C4}, {0x24, 0x13, 0x027F},
+	{0x24, 0x14, 0x1311}, {0x24, 0x16, 0x00C9}, {0x24, 0x17, 0xA100},
+	{0x24, 0x1A, 0x0001}, {0x24, 0x1C, 0x0400}, {0x25, 0x00, 0x820F},
+	{0x25, 0x01, 0x0300}, {0x25, 0x02, 0x1017}, {0x25, 0x03, 0xFFDF},
+	{0x25, 0x05, 0x7F7C}, {0x25, 0x07, 0x8100}, {0x25, 0x08, 0x0001},
+	{0x25, 0x09, 0xFFD4}, {0x25, 0x0A, 0x7C2F}, {0x25, 0x0E, 0x003F},
+	{0x25, 0x0F, 0x0121}, {0x25, 0x10, 0x0020}, {0x25, 0x11, 0x8840},
+	{0x2B, 0x13, 0x3D87}, {0x2B, 0x14, 0x3108}, {0x2D, 0x13, 0x3C87},
+	{0x2D, 0x14, 0x1808},
+	/* 3.125G */
+	{0x28, 0x00, 0x0668}, {0x28, 0x02, 0xD020}, {0x28, 0x06, 0xC000},
+	{0x28, 0x0B, 0x1892}, {0x28, 0x0F, 0xFFDF}, {0x28, 0x12, 0x01C4},
+	{0x28, 0x13, 0x027F}, {0x28, 0x14, 0x1311}, {0x28, 0x16, 0x00C9},
+	{0x28, 0x17, 0xA100}, {0x28, 0x1A, 0x0001}, {0x28, 0x1C, 0x0400},
+	{0x29, 0x00, 0x820F}, {0x29, 0x01, 0x0300}, {0x29, 0x02, 0x1017},
+	{0x29, 0x03, 0xFFDF}, {0x29, 0x05, 0x7F7C}, {0x29, 0x07, 0x8100},
+	{0x29, 0x08, 0x0001}, {0x29, 0x0A, 0x7C2F}, {0x29, 0x0E, 0x003F},
+	{0x29, 0x0F, 0x0121}, {0x29, 0x10, 0x0020}, {0x29, 0x11, 0x8840},
+	/* 10G */
+	{0x06, 0x0D, 0x0F00}, {0x06, 0x00, 0x0000}, {0x06, 0x01, 0xC800},
+	{0x21, 0x03, 0x8206}, {0x21, 0x05, 0x40B0}, {0x21, 0x06, 0x0010},
+	{0x21, 0x07, 0xF09F}, {0x21, 0x0A, 0x0003}, {0x21, 0x0B, 0x0005},
+	{0x21, 0x0C, 0x0007}, {0x21, 0x0D, 0x6009}, {0x21, 0x0E, 0x0000},
+	{0x21, 0x0F, 0x0008}, {0x2E, 0x00, 0xA668}, {0x2E, 0x02, 0xD020},
+	{0x2E, 0x06, 0xC000}, {0x2E, 0x0B, 0x1892}, {0x2E, 0x0F, 0xFFDF},
+	{0x2E, 0x11, 0x8280}, {0x2E, 0x12, 0x0044}, {0x2E, 0x13, 0x027F},
+	{0x2E, 0x14, 0x1311}, {0x2E, 0x17, 0xA100}, {0x2E, 0x1A, 0x0001},
+	{0x2E, 0x1C, 0x0400}, {0x2F, 0x00, 0x820F}, {0x2F, 0x01, 0x0300},
+	{0x2F, 0x02, 0x1217}, {0x2F, 0x03, 0xFFDF}, {0x2F, 0x05, 0x7F7C},
+	{0x2F, 0x07, 0x80C4}, {0x2F, 0x08, 0x0001}, {0x2F, 0x09, 0xFFD4},
+	{0x2F, 0x0A, 0x7C2F}, {0x2F, 0x0E, 0x003F}, {0x2F, 0x0F, 0x0121},
+	{0x2F, 0x10, 0x0020}, {0x2F, 0x11, 0x8840}, {0x2B, 0x13, 0x3D87},
+	{0x2B, 0x14, 0x3108}, {0x2D, 0x13, 0x3C87}, {0x2D, 0x14, 0x1808},
+};
+
+int rtl9300_sds_cmu_band_get(int sds)
+{
+	u32 page;
+	u32 en;
+	u32 cmu_band;
+
+/*	page = rtl9300_sds_cmu_page_get(sds); */
+	page = 0x25; /* 10GR and 1000BX */
+	sds = (sds % 2) ? (sds - 1) : (sds);
+
+	rtl9300_sds_field_w(sds, page, 0x1c, 15, 15, 1);
+	rtl9300_sds_field_w(sds + 1, page, 0x1c, 15, 15, 1);
+
+	en = rtl9300_sds_field_r(sds, page, 27, 1, 1);
+	if(!en) { /* Auto mode */
+		rtl930x_write_sds_phy(sds, 0x1f, 0x02, 31);
+
+		cmu_band = rtl9300_sds_field_r(sds, 0x1f, 0x15, 5, 1);
+	} else {
+		cmu_band = rtl9300_sds_field_r(sds, page, 30, 4, 0);
+	}
+
+	return cmu_band;
+}
+
+int rtl9300_configure_serdes(struct phy_device *phydev)
+{
+	int phy_mode = PHY_INTERFACE_MODE_10GBASER;
+	struct device *dev = &phydev->mdio.dev;
+	int calib_tries = 0;
+	u32 sds_num = 0;
+	int sds_mode;
+
+	if (dev->of_node) {
+		struct device_node *dn = dev->of_node;
+		int phy_addr = phydev->mdio.addr;
+
+		if (of_property_read_u32(dn, "sds", &sds_num))
+			sds_num = -1;
+		pr_info("%s: Port %d, SerDes is %d\n", __func__, phy_addr, sds_num);
+	} else {
+		dev_err(dev, "No DT node.\n");
+		return -EINVAL;
+	}
+
+	if (sds_num < 0)
+		return 0;
+
+	if (phy_mode != PHY_INTERFACE_MODE_10GBASER) /* TODO: for now we only patch 10GR SerDes */
+		return 0;
+
+	switch (phy_mode) {
+	case PHY_INTERFACE_MODE_HSGMII:
+		sds_mode = 0x12;
+		break;
+	case PHY_INTERFACE_MODE_1000BASEX:
+		sds_mode = 0x04;
+		break;
+	case PHY_INTERFACE_MODE_XGMII:
+		sds_mode = 0x10;
+		break;
+	case PHY_INTERFACE_MODE_10GBASER:
+		sds_mode = 0x1a;
+		break;
+	case PHY_INTERFACE_MODE_USXGMII:
+		sds_mode = 0x0d;
+		break;
+	default:
+		pr_err("%s: unknown serdes mode: %s\n", __func__, phy_modes(phy_mode));
+		return -EINVAL;
+	}
+
+	pr_info("%s CMU BAND is %d\n", __func__, rtl9300_sds_cmu_band_get(sds_num));
+
+	/* Turn Off Serdes */
+	rtl9300_sds_rst(sds_num, 0x1f);
+
+	pr_info("%s PATCHING SerDes %d\n", __func__, sds_num);
+	if (sds_num % 2) {
+		for (int i = 0; i < sizeof(rtl9300_a_sds_10gr_lane1) / sizeof(sds_config); ++i) {
+			rtl930x_write_sds_phy(sds_num, rtl9300_a_sds_10gr_lane1[i].page,
+			                      rtl9300_a_sds_10gr_lane1[i].reg,
+			                      rtl9300_a_sds_10gr_lane1[i].data);
+		}
+	} else {
+		for (int i = 0; i < sizeof(rtl9300_a_sds_10gr_lane0) / sizeof(sds_config); ++i) {
+			rtl930x_write_sds_phy(sds_num, rtl9300_a_sds_10gr_lane0[i].page,
+			                      rtl9300_a_sds_10gr_lane0[i].reg,
+			                      rtl9300_a_sds_10gr_lane0[i].data);
+		}
+	}
+
+	rtl9300_phy_enable_10g_1g(sds_num);
+
+	/* Disable MAC */
+	sw_w32_mask(0, 1, RTL930X_MAC_FORCE_MODE_CTRL);
+	mdelay(20);
+
+	/* ----> dal_longan_sds_mode_set */
+	pr_info("%s: Configuring RTL9300 SERDES %d, mode %02x\n", __func__, sds_num, sds_mode);
+
+	/* Configure link to MAC */
+	rtl9300_serdes_mac_link_config(sds_num, true, true);	/* MAC Construct */
+
+	/* Disable MAC */
+	sw_w32_mask(0, 1, RTL930X_MAC_FORCE_MODE_CTRL);
+	mdelay(20);
+
+	rtl9300_force_sds_mode(sds_num, PHY_INTERFACE_MODE_NA);
+
+	/* Re-Enable MAC */
+	sw_w32_mask(1, 0, RTL930X_MAC_FORCE_MODE_CTRL);
+
+	rtl9300_force_sds_mode(sds_num, phy_mode);
+
+	/* Do RX calibration */
+	do {
+		rtl9300_do_rx_calibration(sds_num, phy_mode);
+		calib_tries++;
+		mdelay(50);
+	} while (rtl9300_sds_check_calibration(sds_num, phy_mode) && calib_tries < 3);
+
+	if (calib_tries >= 3)
+		pr_err("%s CALIBTRATION FAILED\n", __func__);
+
+	rtl9300_sds_tx_config(sds_num, phy_mode);
+
+	/* The clock needs only to be configured on the FPGA implementation */
+
+	return 0;
+}
+
+void rtl9310_sds_field_w(int sds, u32 page, u32 reg, int end_bit, int start_bit, u32 v)
+{
+	int l = end_bit - start_bit + 1;
+	u32 data = v;
+
+	if (l < 32) {
+		u32 mask = BIT(l) - 1;
+
+		data = rtl930x_read_sds_phy(sds, page, reg);
+		data &= ~(mask << start_bit);
+		data |= (v & mask) << start_bit;
+	}
+
+	rtl931x_write_sds_phy(sds, page, reg, data);
+}
+
+u32 rtl9310_sds_field_r(int sds, u32 page, u32 reg, int end_bit, int start_bit)
+{
+	int l = end_bit - start_bit + 1;
+	u32 v = rtl931x_read_sds_phy(sds, page, reg);
+
+	if (l >= 32)
+		return v;
+
+	return (v >> start_bit) & (BIT(l) - 1);
+}
+
+static void rtl931x_sds_rst(u32 sds)
+{
+	u32 o, v, o_mode;
+	int shift = ((sds & 0x3) << 3);
+
+	/* TODO: We need to lock this! */
+
+	o = sw_r32(RTL931X_PS_SERDES_OFF_MODE_CTRL_ADDR);
+	v = o | BIT(sds);
+	sw_w32(v, RTL931X_PS_SERDES_OFF_MODE_CTRL_ADDR);
+
+	o_mode = sw_r32(RTL931X_SERDES_MODE_CTRL + 4 * (sds >> 2));
+	v = BIT(7) | 0x1F;
+	sw_w32_mask(0xff << shift, v << shift, RTL931X_SERDES_MODE_CTRL + 4 * (sds >> 2));
+	sw_w32(o_mode, RTL931X_SERDES_MODE_CTRL + 4 * (sds >> 2));
+
+	sw_w32(o, RTL931X_PS_SERDES_OFF_MODE_CTRL_ADDR);
+}
+
+static void rtl931x_symerr_clear(u32 sds, phy_interface_t mode)
+{
+
+	switch (mode) {
+	case PHY_INTERFACE_MODE_NA:
+		break;
+	case PHY_INTERFACE_MODE_XGMII:
+		u32 xsg_sdsid_0, xsg_sdsid_1;
+
+		if (sds < 2)
+			xsg_sdsid_0 = sds;
+		else
+			xsg_sdsid_0 = (sds - 1) * 2;
+		xsg_sdsid_1 = xsg_sdsid_0 + 1;
+
+		for (int i = 0; i < 4; ++i) {
+			rtl9310_sds_field_w(xsg_sdsid_0, 0x1, 24,  2, 0, i);
+			rtl9310_sds_field_w(xsg_sdsid_0, 0x1,  3, 15, 8, 0x0);
+			rtl9310_sds_field_w(xsg_sdsid_0, 0x1,  2, 15, 0, 0x0);
+		}
+
+		for (int i = 0; i < 4; ++i) {
+			rtl9310_sds_field_w(xsg_sdsid_1, 0x1, 24,  2, 0, i);
+			rtl9310_sds_field_w(xsg_sdsid_1, 0x1,  3, 15, 8, 0x0);
+			rtl9310_sds_field_w(xsg_sdsid_1, 0x1,  2, 15, 0, 0x0);
+		}
+
+		rtl9310_sds_field_w(xsg_sdsid_0, 0x1, 0, 15, 0, 0x0);
+		rtl9310_sds_field_w(xsg_sdsid_0, 0x1, 1, 15, 8, 0x0);
+		rtl9310_sds_field_w(xsg_sdsid_1, 0x1, 0, 15, 0, 0x0);
+		rtl9310_sds_field_w(xsg_sdsid_1, 0x1, 1, 15, 8, 0x0);
+		break;
+	default:
+		break;
+	}
+
+	return;
+}
+
+static u32 rtl931x_get_analog_sds(u32 sds)
+{
+	u32 sds_map[] = { 0, 1, 2, 3, 6, 7, 10, 11, 14, 15, 18, 19, 22, 23 };
+
+	if (sds < 14)
+		return sds_map[sds];
+
+	return sds;
+}
+
+void rtl931x_sds_fiber_disable(u32 sds)
+{
+	u32 v = 0x3F;
+	u32 asds = rtl931x_get_analog_sds(sds);
+
+	rtl9310_sds_field_w(asds, 0x1F, 0x9, 11, 6, v);
+}
+
+static void rtl931x_sds_fiber_mode_set(u32 sds, phy_interface_t mode)
+{
+	u32 val, asds = rtl931x_get_analog_sds(sds);
+
+	/* clear symbol error count before changing mode */
+	rtl931x_symerr_clear(sds, mode);
+
+	val = 0x9F;
+	sw_w32(val, RTL931X_SERDES_MODE_CTRL + 4 * (sds >> 2));
+
+	switch (mode) {
+	case PHY_INTERFACE_MODE_SGMII:
+		val = 0x5;
+		break;
+
+	case PHY_INTERFACE_MODE_1000BASEX:
+		/* serdes mode FIBER1G */
+		val = 0x9;
+		break;
+
+	case PHY_INTERFACE_MODE_10GBASER:
+	case PHY_INTERFACE_MODE_10GKR:
+		val = 0x35;
+		break;
+/*	case MII_10GR1000BX_AUTO:
+		val = 0x39;
+		break; */
+
+
+	case PHY_INTERFACE_MODE_USXGMII:
+		val = 0x1B;
+		break;
+	default:
+		val = 0x25;
+	}
+
+	pr_info("%s writing analog SerDes Mode value %02x\n", __func__, val);
+	rtl9310_sds_field_w(asds, 0x1F, 0x9, 11, 6, val);
+
+	return;
+}
+
+static int rtl931x_sds_cmu_page_get(phy_interface_t mode)
+{
+	switch (mode) {
+	case PHY_INTERFACE_MODE_SGMII:
+	case PHY_INTERFACE_MODE_1000BASEX:	/* MII_1000BX_FIBER / 100BX_FIBER / 1000BX100BX_AUTO */
+		return 0x24;
+	case PHY_INTERFACE_MODE_HSGMII:
+	case PHY_INTERFACE_MODE_2500BASEX:	/* MII_2500Base_X: */
+		return 0x28;
+/*	case MII_HISGMII_5G: */
+/*		return 0x2a; */
+	case PHY_INTERFACE_MODE_QSGMII:
+		return 0x2a;			/* Code also has 0x34 */
+	case PHY_INTERFACE_MODE_XAUI:		/* MII_RXAUI_LITE: */
+		return 0x2c;
+	case PHY_INTERFACE_MODE_XGMII:		/* MII_XSGMII */
+	case PHY_INTERFACE_MODE_10GKR:
+	case PHY_INTERFACE_MODE_10GBASER:	/* MII_10GR */
+		return 0x2e;
+	default:
+		return -1;
+	}
+
+	return -1;
+}
+
+static void rtl931x_cmu_type_set(u32 asds, phy_interface_t mode, int chiptype)
+{
+	int cmu_type = 0; /* Clock Management Unit */
+	u32 cmu_page = 0;
+	u32 frc_cmu_spd;
+	u32 evenSds;
+	u32 lane, frc_lc_mode_bitnum, frc_lc_mode_val_bitnum;
+
+	switch (mode) {
+	case PHY_INTERFACE_MODE_NA:
+	case PHY_INTERFACE_MODE_10GKR:
+	case PHY_INTERFACE_MODE_XGMII:
+	case PHY_INTERFACE_MODE_10GBASER:
+	case PHY_INTERFACE_MODE_USXGMII:
+		return;
+
+/*	case MII_10GR1000BX_AUTO:
+		if (chiptype)
+			rtl9310_sds_field_w(asds, 0x24, 0xd, 14, 14, 0);
+		return; */
+
+	case PHY_INTERFACE_MODE_QSGMII:
+		cmu_type = 1;
+		frc_cmu_spd = 0;
+		break;
+
+	case PHY_INTERFACE_MODE_HSGMII:
+		cmu_type = 1;
+		frc_cmu_spd = 1;
+		break;
+
+	case PHY_INTERFACE_MODE_1000BASEX:
+		cmu_type = 1;
+		frc_cmu_spd = 0;
+		break;
+
+/*	case MII_1000BX100BX_AUTO:
+		cmu_type = 1;
+		frc_cmu_spd = 0;
+		break; */
+
+	case PHY_INTERFACE_MODE_SGMII:
+		cmu_type = 1;
+		frc_cmu_spd = 0;
+		break;
+
+	case PHY_INTERFACE_MODE_2500BASEX:
+		cmu_type = 1;
+		frc_cmu_spd = 1;
+		break;
+
+	default:
+		pr_info("SerDes %d mode is invalid\n", asds);
+		return;
+	}
+
+	if (cmu_type == 1)
+		cmu_page = rtl931x_sds_cmu_page_get(mode);
+
+	lane = asds % 2;
+
+	if (!lane) {
+		frc_lc_mode_bitnum = 4;
+		frc_lc_mode_val_bitnum = 5;
+	} else {
+		frc_lc_mode_bitnum = 6;
+		frc_lc_mode_val_bitnum = 7;
+	}
+
+	evenSds = asds - lane;
+
+	pr_info("%s: cmu_type %0d cmu_page %x frc_cmu_spd %d lane %d asds %d\n",
+	        __func__, cmu_type, cmu_page, frc_cmu_spd, lane, asds);
+
+	if (cmu_type == 1) {
+		pr_info("%s A CMU page 0x28 0x7 %08x\n", __func__, rtl931x_read_sds_phy(asds, 0x28, 0x7));
+		rtl9310_sds_field_w(asds, cmu_page, 0x7, 15, 15, 0);
+		pr_info("%s B CMU page 0x28 0x7 %08x\n", __func__, rtl931x_read_sds_phy(asds, 0x28, 0x7));
+		if (chiptype) {
+			rtl9310_sds_field_w(asds, cmu_page, 0xd, 14, 14, 0);
+		}
+
+		rtl9310_sds_field_w(evenSds, 0x20, 0x12, 3, 2, 0x3);
+		rtl9310_sds_field_w(evenSds, 0x20, 0x12, frc_lc_mode_bitnum, frc_lc_mode_bitnum, 1);
+		rtl9310_sds_field_w(evenSds, 0x20, 0x12, frc_lc_mode_val_bitnum, frc_lc_mode_val_bitnum, 0);
+		rtl9310_sds_field_w(evenSds, 0x20, 0x12, 12, 12, 1);
+		rtl9310_sds_field_w(evenSds, 0x20, 0x12, 15, 13, frc_cmu_spd);
+	}
+
+	pr_info("%s CMU page 0x28 0x7 %08x\n", __func__, rtl931x_read_sds_phy(asds, 0x28, 0x7));
+	return;
+}
+
+static void rtl931x_sds_rx_rst(u32 sds)
+{
+	u32 asds = rtl931x_get_analog_sds(sds);
+
+	if (sds < 2)
+		return;
+
+	rtl931x_write_sds_phy(asds, 0x2e, 0x12, 0x2740);
+	rtl931x_write_sds_phy(asds, 0x2f, 0x0, 0x0);
+	rtl931x_write_sds_phy(asds, 0x2f, 0x2, 0x2010);
+	rtl931x_write_sds_phy(asds, 0x20, 0x0, 0xc10);
+
+	rtl931x_write_sds_phy(asds, 0x2e, 0x12, 0x27c0);
+	rtl931x_write_sds_phy(asds, 0x2f, 0x0, 0xc000);
+	rtl931x_write_sds_phy(asds, 0x2f, 0x2, 0x6010);
+	rtl931x_write_sds_phy(asds, 0x20, 0x0, 0xc30);
+
+	mdelay(50);
+}
+
+// Currently not used
+// static void rtl931x_sds_disable(u32 sds)
+// {
+// 	u32 v = 0x1f;
+
+// 	v |= BIT(7);
+// 	sw_w32(v, RTL931X_SERDES_MODE_CTRL + (sds >> 2) * 4);
+// }
+
+static void rtl931x_sds_mii_mode_set(u32 sds, phy_interface_t mode)
+{
+	u32 val;
+
+	switch (mode) {
+	case PHY_INTERFACE_MODE_QSGMII:
+		val = 0x6;
+		break;
+	case PHY_INTERFACE_MODE_XGMII:
+		val = 0x10; /* serdes mode XSGMII */
+		break;
+	case PHY_INTERFACE_MODE_USXGMII:
+	case PHY_INTERFACE_MODE_2500BASEX:
+		val = 0xD;
+		break;
+	case PHY_INTERFACE_MODE_HSGMII:
+		val = 0x12;
+		break;
+	case PHY_INTERFACE_MODE_SGMII:
+		val = 0x2;
+		break;
+	default:
+		return;
+	}
+
+	val |= (1 << 7);
+
+	sw_w32(val, RTL931X_SERDES_MODE_CTRL + 4 * (sds >> 2));
+}
+
+static sds_config sds_config_10p3125g_type1[] = {
+	{ 0x2E, 0x00, 0x0107 }, { 0x2E, 0x01, 0x01A3 }, { 0x2E, 0x02, 0x6A24 },
+	{ 0x2E, 0x03, 0xD10D }, { 0x2E, 0x04, 0x8000 }, { 0x2E, 0x05, 0xA17E },
+	{ 0x2E, 0x06, 0xE31D }, { 0x2E, 0x07, 0x800E }, { 0x2E, 0x08, 0x0294 },
+	{ 0x2E, 0x09, 0x0CE4 }, { 0x2E, 0x0A, 0x7FC8 }, { 0x2E, 0x0B, 0xE0E7 },
+	{ 0x2E, 0x0C, 0x0200 }, { 0x2E, 0x0D, 0xDF80 }, { 0x2E, 0x0E, 0x0000 },
+	{ 0x2E, 0x0F, 0x1FC2 }, { 0x2E, 0x10, 0x0C3F }, { 0x2E, 0x11, 0x0000 },
+	{ 0x2E, 0x12, 0x27C0 }, { 0x2E, 0x13, 0x7E1D }, { 0x2E, 0x14, 0x1300 },
+	{ 0x2E, 0x15, 0x003F }, { 0x2E, 0x16, 0xBE7F }, { 0x2E, 0x17, 0x0090 },
+	{ 0x2E, 0x18, 0x0000 }, { 0x2E, 0x19, 0x4000 }, { 0x2E, 0x1A, 0x0000 },
+	{ 0x2E, 0x1B, 0x8000 }, { 0x2E, 0x1C, 0x011F }, { 0x2E, 0x1D, 0x0000 },
+	{ 0x2E, 0x1E, 0xC8FF }, { 0x2E, 0x1F, 0x0000 }, { 0x2F, 0x00, 0xC000 },
+	{ 0x2F, 0x01, 0xF000 }, { 0x2F, 0x02, 0x6010 }, { 0x2F, 0x12, 0x0EE7 },
+	{ 0x2F, 0x13, 0x0000 }
+};
+
+static sds_config sds_config_10p3125g_cmu_type1[] = {
+	{ 0x2F, 0x03, 0x4210 }, { 0x2F, 0x04, 0x0000 }, { 0x2F, 0x05, 0x0019 },
+	{ 0x2F, 0x06, 0x18A6 }, { 0x2F, 0x07, 0x2990 }, { 0x2F, 0x08, 0xFFF4 },
+	{ 0x2F, 0x09, 0x1F08 }, { 0x2F, 0x0A, 0x0000 }, { 0x2F, 0x0B, 0x8000 },
+	{ 0x2F, 0x0C, 0x4224 }, { 0x2F, 0x0D, 0x0000 }, { 0x2F, 0x0E, 0x0000 },
+	{ 0x2F, 0x0F, 0xA470 }, { 0x2F, 0x10, 0x8000 }, { 0x2F, 0x11, 0x037B }
+};
+
+void rtl931x_sds_init(u32 sds, phy_interface_t mode)
+{
+	u32 board_sds_tx_type1[] = {
+		0x01c3, 0x01c3, 0x01c3, 0x01a3, 0x01a3, 0x01a3,
+		0x0143, 0x0143, 0x0143, 0x0143, 0x0163, 0x0163,
+	};
+	u32 board_sds_tx[] = {
+		0x1a00, 0x1a00, 0x0200, 0x0200, 0x0200, 0x0200,
+		0x01a3, 0x01a3, 0x01a3, 0x01a3, 0x01e3, 0x01e3
+	};
+	u32 board_sds_tx2[] = {
+		0x0dc0, 0x01c0, 0x0200, 0x0180, 0x0160, 0x0123,
+		0x0123, 0x0163, 0x01a3, 0x01a0, 0x01c3, 0x09c3,
+	};
+	u32 asds, dSds, ori, model_info, val;
+	int chiptype = 0;
+
+	asds = rtl931x_get_analog_sds(sds);
+
+	if (sds > 13)
+		return;
+
+	pr_info("%s: set sds %d to mode %d\n", __func__, sds, mode);
+	val = rtl9310_sds_field_r(asds, 0x1F, 0x9, 11, 6);
+
+	pr_info("%s: fibermode %08X stored mode 0x%x analog SDS %d", __func__,
+			rtl931x_read_sds_phy(asds, 0x1f, 0x9), val, asds);
+	pr_info("%s: SGMII mode %08X in 0x24 0x9 analog SDS %d", __func__,
+			rtl931x_read_sds_phy(asds, 0x24, 0x9), asds);
+	pr_info("%s: CMU mode %08X stored even SDS %d", __func__,
+			rtl931x_read_sds_phy(asds & ~1, 0x20, 0x12), asds & ~1);
+	pr_info("%s: serdes_mode_ctrl %08X", __func__,  RTL931X_SERDES_MODE_CTRL + 4 * (sds >> 2));
+	pr_info("%s CMU page 0x24 0x7 %08x\n", __func__, rtl931x_read_sds_phy(asds, 0x24, 0x7));
+	pr_info("%s CMU page 0x26 0x7 %08x\n", __func__, rtl931x_read_sds_phy(asds, 0x26, 0x7));
+	pr_info("%s CMU page 0x28 0x7 %08x\n", __func__, rtl931x_read_sds_phy(asds, 0x28, 0x7));
+	pr_info("%s XSG page 0x0 0xe %08x\n", __func__, rtl931x_read_sds_phy(dSds, 0x0, 0xe));
+	pr_info("%s XSG2 page 0x0 0xe %08x\n", __func__, rtl931x_read_sds_phy(dSds + 1, 0x0, 0xe));
+
+	model_info = sw_r32(RTL93XX_MODEL_NAME_INFO);
+	if ((model_info >> 4) & 0x1) {
+		pr_info("detected chiptype 1\n");
+		chiptype = 1;
+	} else {
+		pr_info("detected chiptype 0\n");
+	}
+
+	if (sds < 2)
+		dSds = sds;
+	else
+		dSds = (sds - 1) * 2;
+
+	pr_info("%s: 2.5gbit %08X dsds %d", __func__,
+	        rtl931x_read_sds_phy(dSds, 0x1, 0x14), dSds);
+
+	pr_info("%s: RTL931X_PS_SERDES_OFF_MODE_CTRL_ADDR 0x%08X\n", __func__, sw_r32(RTL931X_PS_SERDES_OFF_MODE_CTRL_ADDR));
+	ori = sw_r32(RTL931X_PS_SERDES_OFF_MODE_CTRL_ADDR);
+	val = ori | (1 << sds);
+	sw_w32(val, RTL931X_PS_SERDES_OFF_MODE_CTRL_ADDR);
+
+	switch (mode) {
+	case PHY_INTERFACE_MODE_NA:
+		break;
+
+	case PHY_INTERFACE_MODE_XGMII: /* MII_XSGMII */
+
+		if (chiptype) {
+			u32 xsg_sdsid_1;
+			xsg_sdsid_1 = dSds + 1;
+			/* fifo inv clk */
+			rtl9310_sds_field_w(dSds, 0x1, 0x1, 7, 4, 0xf);
+			rtl9310_sds_field_w(dSds, 0x1, 0x1, 3, 0, 0xf);
+
+			rtl9310_sds_field_w(xsg_sdsid_1, 0x1, 0x1, 7, 4, 0xf);
+			rtl9310_sds_field_w(xsg_sdsid_1, 0x1, 0x1, 3, 0, 0xf);
+
+		}
+
+		rtl9310_sds_field_w(dSds, 0x0, 0xE, 12, 12, 1);
+		rtl9310_sds_field_w(dSds + 1, 0x0, 0xE, 12, 12, 1);
+		break;
+
+	case PHY_INTERFACE_MODE_USXGMII: /* MII_USXGMII_10GSXGMII/10GDXGMII/10GQXGMII: */
+		u32 op_code = 0x6003;
+		u32 evenSds;
+
+		if (chiptype) {
+			rtl9310_sds_field_w(asds, 0x6, 0x2, 12, 12, 1);
+
+			for (int i = 0; i < sizeof(sds_config_10p3125g_type1) / sizeof(sds_config); ++i) {
+				rtl931x_write_sds_phy(asds, sds_config_10p3125g_type1[i].page - 0x4, sds_config_10p3125g_type1[i].reg, sds_config_10p3125g_type1[i].data);
+			}
+
+			evenSds = asds - (asds % 2);
+
+			for (int i = 0; i < sizeof(sds_config_10p3125g_cmu_type1) / sizeof(sds_config); ++i) {
+				rtl931x_write_sds_phy(evenSds,
+				                      sds_config_10p3125g_cmu_type1[i].page - 0x4, sds_config_10p3125g_cmu_type1[i].reg, sds_config_10p3125g_cmu_type1[i].data);
+			}
+
+			rtl9310_sds_field_w(asds, 0x6, 0x2, 12, 12, 0);
+		} else {
+
+			rtl9310_sds_field_w(asds, 0x2e, 0xd, 6, 0, 0x0);
+			rtl9310_sds_field_w(asds, 0x2e, 0xd, 7, 7, 0x1);
+
+			rtl9310_sds_field_w(asds, 0x2e, 0x1c, 5, 0, 0x1E);
+			rtl9310_sds_field_w(asds, 0x2e, 0x1d, 11, 0, 0x00);
+			rtl9310_sds_field_w(asds, 0x2e, 0x1f, 11, 0, 0x00);
+			rtl9310_sds_field_w(asds, 0x2f, 0x0, 11, 0, 0x00);
+			rtl9310_sds_field_w(asds, 0x2f, 0x1, 11, 0, 0x00);
+
+			rtl9310_sds_field_w(asds, 0x2e, 0xf, 12, 6, 0x7F);
+			rtl931x_write_sds_phy(asds, 0x2f, 0x12, 0xaaa);
+
+			rtl931x_sds_rx_rst(sds);
+
+			rtl931x_write_sds_phy(asds, 0x7, 0x10, op_code);
+			rtl931x_write_sds_phy(asds, 0x6, 0x1d, 0x0480);
+			rtl931x_write_sds_phy(asds, 0x6, 0xe, 0x0400);
+		}
+		break;
+
+	case PHY_INTERFACE_MODE_10GBASER: /* MII_10GR / MII_10GR1000BX_AUTO: */
+	                                  /* configure 10GR fiber mode=1 */
+		rtl9310_sds_field_w(asds, 0x1f, 0xb, 1, 1, 1);
+
+		/* init fiber_1g */
+		rtl9310_sds_field_w(dSds, 0x3, 0x13, 15, 14, 0);
+
+		rtl9310_sds_field_w(dSds, 0x2, 0x0, 12, 12, 1);
+		rtl9310_sds_field_w(dSds, 0x2, 0x0, 6, 6, 1);
+		rtl9310_sds_field_w(dSds, 0x2, 0x0, 13, 13, 0);
+
+		/* init auto */
+		rtl9310_sds_field_w(asds, 0x1f, 13, 15, 0, 0x109e);
+		rtl9310_sds_field_w(asds, 0x1f, 0x6, 14, 10, 0x8);
+		rtl9310_sds_field_w(asds, 0x1f, 0x7, 10, 4, 0x7f);
+		break;
+
+	case PHY_INTERFACE_MODE_HSGMII:
+		rtl9310_sds_field_w(dSds, 0x1, 0x14, 8, 8, 1);
+		break;
+
+	case PHY_INTERFACE_MODE_1000BASEX: /* MII_1000BX_FIBER */
+		rtl9310_sds_field_w(dSds, 0x3, 0x13, 15, 14, 0);
+
+		rtl9310_sds_field_w(dSds, 0x2, 0x0, 12, 12, 1);
+		rtl9310_sds_field_w(dSds, 0x2, 0x0, 6, 6, 1);
+		rtl9310_sds_field_w(dSds, 0x2, 0x0, 13, 13, 0);
+		break;
+
+	case PHY_INTERFACE_MODE_SGMII:
+		rtl9310_sds_field_w(asds, 0x24, 0x9, 15, 15, 0);
+		break;
+
+	case PHY_INTERFACE_MODE_2500BASEX:
+		rtl9310_sds_field_w(dSds, 0x1, 0x14, 8, 8, 1);
+		break;
+
+	case PHY_INTERFACE_MODE_QSGMII:
+	default:
+		pr_info("%s: PHY mode %s not supported by SerDes %d\n",
+		        __func__, phy_modes(mode), sds);
+		return;
+	}
+
+	rtl931x_cmu_type_set(asds, mode, chiptype);
+
+	if (sds >= 2 && sds <= 13) {
+		if (chiptype)
+			rtl931x_write_sds_phy(asds, 0x2E, 0x1, board_sds_tx_type1[sds - 2]);
+		else {
+			val = 0xa0000;
+			sw_w32(val, RTL931X_CHIP_INFO_ADDR);
+			val = sw_r32(RTL931X_CHIP_INFO_ADDR);
+			if (val & BIT(28)) /* consider 9311 etc. RTL9313_CHIP_ID == HWP_CHIP_ID(unit)) */
+			{
+				rtl931x_write_sds_phy(asds, 0x2E, 0x1, board_sds_tx2[sds - 2]);
+			} else {
+				rtl931x_write_sds_phy(asds, 0x2E, 0x1, board_sds_tx[sds - 2]);
+			}
+			val = 0;
+			sw_w32(val, RTL931X_CHIP_INFO_ADDR);
+		}
+	}
+
+	val = ori & ~BIT(sds);
+	sw_w32(val, RTL931X_PS_SERDES_OFF_MODE_CTRL_ADDR);
+	pr_debug("%s: RTL931X_PS_SERDES_OFF_MODE_CTRL_ADDR 0x%08X\n", __func__, sw_r32(RTL931X_PS_SERDES_OFF_MODE_CTRL_ADDR));
+
+	if (mode == PHY_INTERFACE_MODE_XGMII ||
+	    mode == PHY_INTERFACE_MODE_QSGMII ||
+	    mode == PHY_INTERFACE_MODE_HSGMII ||
+	    mode == PHY_INTERFACE_MODE_SGMII ||
+	    mode == PHY_INTERFACE_MODE_USXGMII) {
+		if (mode == PHY_INTERFACE_MODE_XGMII)
+			rtl931x_sds_mii_mode_set(sds, mode);
+		else
+			rtl931x_sds_fiber_mode_set(sds, mode);
+	}
+}
+
+int rtl931x_sds_cmu_band_set(int sds, bool enable, u32 band, phy_interface_t mode)
+{
+	u32 asds;
+	int page = rtl931x_sds_cmu_page_get(mode);
+
+	sds -= (sds % 2);
+	sds = sds & ~1;
+	asds = rtl931x_get_analog_sds(sds);
+	page += 1;
+
+	if (enable) {
+		rtl9310_sds_field_w(asds, page, 0x7, 13, 13, 0);
+		rtl9310_sds_field_w(asds, page, 0x7, 11, 11, 0);
+	} else {
+		rtl9310_sds_field_w(asds, page, 0x7, 13, 13, 0);
+		rtl9310_sds_field_w(asds, page, 0x7, 11, 11, 0);
+	}
+
+	rtl9310_sds_field_w(asds, page, 0x7, 4, 0, band);
+
+	rtl931x_sds_rst(sds);
+
+	return 0;
+}
+
+int rtl931x_sds_cmu_band_get(int sds, phy_interface_t mode)
+{
+	int page = rtl931x_sds_cmu_page_get(mode);
+	u32 asds, band;
+
+	sds -= (sds % 2);
+	asds = rtl931x_get_analog_sds(sds);
+	page += 1;
+	rtl931x_write_sds_phy(asds, 0x1f, 0x02, 73);
+
+	rtl9310_sds_field_w(asds, page, 0x5, 15, 15, 1);
+	band = rtl9310_sds_field_r(asds, 0x1f, 0x15, 8, 3);
+	pr_info("%s band is: %d\n", __func__, band);
+
+	return band;
+}
+
+
+int rtl931x_link_sts_get(u32 sds)
+{
+	u32 sts, sts1, latch_sts, latch_sts1;
+	if (0){
+		u32 xsg_sdsid_0, xsg_sdsid_1;
+
+		xsg_sdsid_0 = sds < 2 ? sds : (sds - 1) * 2;
+		xsg_sdsid_1 = xsg_sdsid_0 + 1;
+
+		sts = rtl9310_sds_field_r(xsg_sdsid_0, 0x1, 29, 8, 0);
+		sts1 = rtl9310_sds_field_r(xsg_sdsid_1, 0x1, 29, 8, 0);
+		latch_sts = rtl9310_sds_field_r(xsg_sdsid_0, 0x1, 30, 8, 0);
+		latch_sts1 = rtl9310_sds_field_r(xsg_sdsid_1, 0x1, 30, 8, 0);
+	} else {
+		u32  asds, dsds;
+
+		asds = rtl931x_get_analog_sds(sds);
+		sts = rtl9310_sds_field_r(asds, 0x5, 0, 12, 12);
+		latch_sts = rtl9310_sds_field_r(asds, 0x4, 1, 2, 2);
+
+		dsds = sds < 2 ? sds : (sds - 1) * 2;
+		latch_sts1 = rtl9310_sds_field_r(dsds, 0x2, 1, 2, 2);
+		sts1 = rtl9310_sds_field_r(dsds, 0x2, 1, 2, 2);
+	}
+
+	pr_info("%s: serdes %d sts %d, sts1 %d, latch_sts %d, latch_sts1 %d\n", __func__,
+		sds, sts, sts1, latch_sts, latch_sts1);
+
+	return sts1;
+}
+
+static int rtl8214fc_sfp_insert(void *upstream, const struct sfp_eeprom_id *id)
+{
+	struct phy_device *phydev = upstream;
+
+	rtl8214fc_media_set(phydev, true);
+
+	return 0;
+}
+
+static void rtl8214fc_sfp_remove(void *upstream)
+{
+	struct phy_device *phydev = upstream;
+
+	rtl8214fc_media_set(phydev, false);
+}
+
+static const struct sfp_upstream_ops rtl8214fc_sfp_ops = {
+	.attach = phy_sfp_attach,
+	.detach = phy_sfp_detach,
+	.module_insert = rtl8214fc_sfp_insert,
+	.module_remove = rtl8214fc_sfp_remove,
+};
+
+static int rtl8214fc_phy_probe(struct phy_device *phydev)
+{
+	struct device *dev = &phydev->mdio.dev;
+	int addr = phydev->mdio.addr;
+	int ret = 0;
+
+	/* 839x has internal SerDes */
+	if (soc_info.id == 0x8393)
+		return -ENODEV;
+
+	/* All base addresses of the PHYs start at multiples of 8 */
+	devm_phy_package_join(dev, phydev, addr & (~7),
+				sizeof(struct rtl83xx_shared_private));
+
+	if (!(addr % 8)) {
+		struct rtl83xx_shared_private *shared = phydev->shared->priv;
+		shared->name = "RTL8214FC";
+		/* Configuration must be done while patching still possible */
+		ret = rtl8380_configure_rtl8214fc(phydev);
+		if (ret)
+			return ret;
+	}
+
+	return phy_sfp_probe(phydev, &rtl8214fc_sfp_ops);
+}
+
+static int rtl8214c_phy_probe(struct phy_device *phydev)
+{
+	struct device *dev = &phydev->mdio.dev;
+	int addr = phydev->mdio.addr;
+
+	/* All base addresses of the PHYs start at multiples of 8 */
+	devm_phy_package_join(dev, phydev, addr & (~7),
+				sizeof(struct rtl83xx_shared_private));
+
+	if (!(addr % 8)) {
+		struct rtl83xx_shared_private *shared = phydev->shared->priv;
+		shared->name = "RTL8214C";
+		/* Configuration must be done whil patching still possible */
+		return rtl8380_configure_rtl8214c(phydev);
+	}
+
+	return 0;
+}
+
+static int rtl8218b_ext_phy_probe(struct phy_device *phydev)
+{
+	struct device *dev = &phydev->mdio.dev;
+	int addr = phydev->mdio.addr;
+
+	/* All base addresses of the PHYs start at multiples of 8 */
+	devm_phy_package_join(dev, phydev, addr & (~7),
+				sizeof(struct rtl83xx_shared_private));
+
+	if (!(addr % 8)) {
+		struct rtl83xx_shared_private *shared = phydev->shared->priv;
+		shared->name = "RTL8218B (external)";
+		if (soc_info.family == RTL8380_FAMILY_ID) {
+			/* Configuration must be done while patching still possible */
+			return rtl8380_configure_ext_rtl8218b(phydev);
+		}
+	}
+
+	return 0;
+}
+
+static int rtl8218b_int_phy_probe(struct phy_device *phydev)
+{
+	struct device *dev = &phydev->mdio.dev;
+	int addr = phydev->mdio.addr;
+
+	if (soc_info.family != RTL8380_FAMILY_ID)
+		return -ENODEV;
+	if (addr >= 24)
+		return -ENODEV;
+
+	pr_debug("%s: id: %d\n", __func__, addr);
+	/* All base addresses of the PHYs start at multiples of 8 */
+	devm_phy_package_join(dev, phydev, addr & (~7),
+			      sizeof(struct rtl83xx_shared_private));
+
+	if (!(addr % 8)) {
+		struct rtl83xx_shared_private *shared = phydev->shared->priv;
+		shared->name = "RTL8218B (internal)";
+		/* Configuration must be done while patching still possible */
+		return rtl8380_configure_int_rtl8218b(phydev);
+	}
+
+	return 0;
+}
+
+static int rtl8218d_phy_probe(struct phy_device *phydev)
+{
+	struct device *dev = &phydev->mdio.dev;
+	int addr = phydev->mdio.addr;
+
+	pr_debug("%s: id: %d\n", __func__, addr);
+	/* All base addresses of the PHYs start at multiples of 8 */
+	devm_phy_package_join(dev, phydev, addr & (~7),
+			      sizeof(struct rtl83xx_shared_private));
+
+	/* All base addresses of the PHYs start at multiples of 8 */
+	if (!(addr % 8)) {
+		struct rtl83xx_shared_private *shared = phydev->shared->priv;
+		shared->name = "RTL8218D";
+		/* Configuration must be done while patching still possible */
+/* TODO:		return configure_rtl8218d(phydev); */
+	}
+
+	return 0;
+}
+
+static int rtl838x_serdes_probe(struct phy_device *phydev)
+{
+	int addr = phydev->mdio.addr;
+
+	if (soc_info.family != RTL8380_FAMILY_ID)
+		return -ENODEV;
+	if (addr < 24)
+		return -ENODEV;
+
+	/* On the RTL8380M, PHYs 24-27 connect to the internal SerDes */
+	if (soc_info.id == 0x8380) {
+		if (addr == 24)
+			return rtl8380_configure_serdes(phydev);
+		return 0;
+	}
+
+	return -ENODEV;
+}
+
+static int rtl8393_serdes_probe(struct phy_device *phydev)
+{
+	int addr = phydev->mdio.addr;
+
+	pr_info("%s: id: %d\n", __func__, addr);
+	if (soc_info.family != RTL8390_FAMILY_ID)
+		return -ENODEV;
+
+	if (addr < 24)
+		return -ENODEV;
+
+	return rtl8390_configure_serdes(phydev);
+}
+
+static int rtl8390_serdes_probe(struct phy_device *phydev)
+{
+	int addr = phydev->mdio.addr;
+
+	if (soc_info.family != RTL8390_FAMILY_ID)
+		return -ENODEV;
+
+	if (addr < 24)
+		return -ENODEV;
+
+	return rtl8390_configure_generic(phydev);
+}
+
+static int rtl9300_serdes_probe(struct phy_device *phydev)
+{
+	if (soc_info.family != RTL9300_FAMILY_ID)
+		return -ENODEV;
+
+	phydev_info(phydev, "Detected internal RTL9300 Serdes\n");
+
+	return rtl9300_configure_serdes(phydev);
+}
+
+static struct phy_driver rtl83xx_phy_driver[] = {
+	{
+		PHY_ID_MATCH_MODEL(PHY_ID_RTL8214C),
+		.name		= "Realtek RTL8214C",
+		.features	= PHY_GBIT_FEATURES,
+		.flags		= PHY_HAS_REALTEK_PAGES,
+		.match_phy_device = rtl8214c_match_phy_device,
+		.probe		= rtl8214c_phy_probe,
+		.suspend	= genphy_suspend,
+		.resume		= genphy_resume,
+		.set_loopback	= genphy_loopback,
+	},
+	{
+		PHY_ID_MATCH_MODEL(PHY_ID_RTL8214FC),
+		.name		= "Realtek RTL8214FC",
+		.features	= PHY_GBIT_FIBRE_FEATURES,
+		.flags		= PHY_HAS_REALTEK_PAGES,
+		.match_phy_device = rtl8214fc_match_phy_device,
+		.probe		= rtl8214fc_phy_probe,
+		.suspend	= rtl8214fc_suspend,
+		.resume		= rtl8214fc_resume,
+		.set_loopback	= genphy_loopback,
+		.set_port	= rtl8214fc_set_port,
+		.get_port	= rtl8214fc_get_port,
+		.set_eee	= rtl8214fc_set_eee,
+		.get_eee	= rtl8214fc_get_eee,
+	},
+	{
+		PHY_ID_MATCH_MODEL(PHY_ID_RTL8218B_E),
+		.name		= "Realtek RTL8218B (external)",
+		.features	= PHY_GBIT_FEATURES,
+		.flags		= PHY_HAS_REALTEK_PAGES,
+		.match_phy_device = rtl8218b_ext_match_phy_device,
+		.probe		= rtl8218b_ext_phy_probe,
+		.suspend	= genphy_suspend,
+		.resume		= genphy_resume,
+		.set_loopback	= genphy_loopback,
+		.set_eee	= rtl8218b_set_eee,
+		.get_eee	= rtl8218b_get_eee,
+	},
+	{
+		PHY_ID_MATCH_MODEL(PHY_ID_RTL8218D),
+		.name		= "REALTEK RTL8218D",
+		.features	= PHY_GBIT_FEATURES,
+		.flags		= PHY_HAS_REALTEK_PAGES,
+		.probe		= rtl8218d_phy_probe,
+		.suspend	= genphy_suspend,
+		.resume		= genphy_resume,
+		.set_loopback	= genphy_loopback,
+		.set_eee	= rtl8218d_set_eee,
+		.get_eee	= rtl8218d_get_eee,
+	},
+	{
+		PHY_ID_MATCH_MODEL(PHY_ID_RTL8221B),
+		.name           = "REALTEK RTL8221B",
+		.features       = PHY_GBIT_FEATURES,
+		.flags		= PHY_HAS_REALTEK_PAGES,
+		.suspend        = genphy_suspend,
+		.resume         = genphy_resume,
+		.set_loopback   = genphy_loopback,
+		.read_page      = rtl8226_read_page,
+		.write_page     = rtl8226_write_page,
+		.read_status    = rtl8226_read_status,
+		.config_aneg    = rtl8226_config_aneg,
+		.set_eee        = rtl8226_set_eee,
+		.get_eee        = rtl8226_get_eee,
+	},
+	{
+		PHY_ID_MATCH_MODEL(PHY_ID_RTL8226),
+		.name		= "REALTEK RTL8226",
+		.features	= PHY_GBIT_FEATURES,
+		.flags		= PHY_HAS_REALTEK_PAGES,
+		.suspend	= genphy_suspend,
+		.resume		= genphy_resume,
+		.set_loopback	= genphy_loopback,
+		.read_page	= rtl8226_read_page,
+		.write_page	= rtl8226_write_page,
+		.read_status	= rtl8226_read_status,
+		.config_aneg	= rtl8226_config_aneg,
+		.set_eee	= rtl8226_set_eee,
+		.get_eee	= rtl8226_get_eee,
+	},
+	{
+		PHY_ID_MATCH_MODEL(PHY_ID_RTL8218B_I),
+		.name		= "Realtek RTL8218B (internal)",
+		.features	= PHY_GBIT_FEATURES,
+		.flags		= PHY_HAS_REALTEK_PAGES,
+		.probe		= rtl8218b_int_phy_probe,
+		.suspend	= genphy_suspend,
+		.resume		= genphy_resume,
+		.set_loopback	= genphy_loopback,
+		.set_eee	= rtl8218b_set_eee,
+		.get_eee	= rtl8218b_get_eee,
+	},
+	{
+		PHY_ID_MATCH_MODEL(PHY_ID_RTL8218B_I),
+		.name		= "Realtek RTL8380 SERDES",
+		.features	= PHY_GBIT_FIBRE_FEATURES,
+		.flags		= PHY_HAS_REALTEK_PAGES,
+		.probe		= rtl838x_serdes_probe,
+		.suspend	= genphy_suspend,
+		.resume		= genphy_resume,
+		.set_loopback	= genphy_loopback,
+		.read_status	= rtl8380_read_status,
+	},
+	{
+		PHY_ID_MATCH_MODEL(PHY_ID_RTL8393_I),
+		.name		= "Realtek RTL8393 SERDES",
+		.features	= PHY_GBIT_FIBRE_FEATURES,
+		.flags		= PHY_HAS_REALTEK_PAGES,
+		.probe		= rtl8393_serdes_probe,
+		.suspend	= genphy_suspend,
+		.resume		= genphy_resume,
+		.set_loopback	= genphy_loopback,
+		.read_status	= rtl8393_read_status,
+	},
+	{
+		PHY_ID_MATCH_MODEL(PHY_ID_RTL8390_GENERIC),
+		.name		= "Realtek RTL8390 Generic",
+		.features	= PHY_GBIT_FIBRE_FEATURES,
+		.flags		= PHY_HAS_REALTEK_PAGES,
+		.probe		= rtl8390_serdes_probe,
+		.suspend	= genphy_suspend,
+		.resume		= genphy_resume,
+		.set_loopback	= genphy_loopback,
+	},
+	{
+		PHY_ID_MATCH_MODEL(PHY_ID_RTL9300_I),
+		.name		= "REALTEK RTL9300 SERDES",
+		.features	= PHY_GBIT_FIBRE_FEATURES,
+		.flags		= PHY_HAS_REALTEK_PAGES,
+		.probe		= rtl9300_serdes_probe,
+		.suspend	= genphy_suspend,
+		.resume		= genphy_resume,
+		.set_loopback	= genphy_loopback,
+		.read_status	= rtl9300_read_status,
+	},
+};
+
+module_phy_driver(rtl83xx_phy_driver);
+
+static struct mdio_device_id __maybe_unused rtl83xx_tbl[] = {
+	{ PHY_ID_MATCH_MODEL(PHY_ID_RTL8214FC) },
+	{ }
+};
+
+MODULE_DEVICE_TABLE(mdio, rtl83xx_tbl);
+
+MODULE_AUTHOR("B. Koblitz");
+MODULE_DESCRIPTION("RTL83xx PHY driver");
+MODULE_LICENSE("GPL");
diff --git a/target/linux/realtek/files-5.15/drivers/net/phy/rtl83xx-phy.h b/target/linux/realtek/files-5.15/drivers/net/phy/rtl83xx-phy.h
new file mode 100644
index 00000000000000..3b9123182913ab
--- /dev/null
+++ b/target/linux/realtek/files-5.15/drivers/net/phy/rtl83xx-phy.h
@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+struct rtl83xx_shared_private {
+	char *name;
+};
+
+struct __attribute__ ((__packed__)) part {
+	uint16_t start;
+	uint8_t wordsize;
+	uint8_t words;
+};
+
+struct __attribute__ ((__packed__)) fw_header {
+	uint32_t magic;
+	uint32_t phy;
+	uint32_t checksum;
+	uint32_t version;
+	struct part parts[10];
+};
+
+/* TODO: fixed path? */
+#define FIRMWARE_838X_8380_1	"rtl838x_phy/rtl838x_8380.fw"
+#define FIRMWARE_838X_8214FC_1	"rtl838x_phy/rtl838x_8214fc.fw"
+#define FIRMWARE_838X_8218b_1	"rtl838x_phy/rtl838x_8218b.fw"
+
+/* External RTL8218B and RTL8214FC IDs are identical */
+#define PHY_ID_RTL8214C		0x001cc942
+#define PHY_ID_RTL8214FC	0x001cc981
+#define PHY_ID_RTL8218B_E	0x001cc981
+#define PHY_ID_RTL8218D		0x001cc983
+#define PHY_ID_RTL8218B_I	0x001cca40
+#define PHY_ID_RTL8221B		0x001cc849
+#define PHY_ID_RTL8226		0x001cc838
+#define PHY_ID_RTL8390_GENERIC	0x001ccab0
+#define PHY_ID_RTL8393_I	0x001c8393
+#define PHY_ID_RTL9300_I	0x70d03106
+
+/* PHY MMD devices */
+#define MMD_AN		7
+#define MMD_VEND2	31
+
+/* Registers of the internal Serdes of the 8380 */
+#define RTL838X_SDS_MODE_SEL			(0x0028)
+#define RTL838X_SDS_CFG_REG			(0x0034)
+#define RTL838X_INT_MODE_CTRL			(0x005c)
+#define RTL838X_DMY_REG31			(0x3b28)
+
+#define RTL8380_SDS4_FIB_REG0			(0xF800)
+#define RTL838X_SDS4_REG28			(0xef80)
+#define RTL838X_SDS4_DUMMY0			(0xef8c)
+#define RTL838X_SDS5_EXT_REG6			(0xf18c)
+#define RTL838X_SDS4_FIB_REG0			(RTL838X_SDS4_REG28 + 0x880)
+#define RTL838X_SDS5_FIB_REG0			(RTL838X_SDS4_REG28 + 0x980)
+
+/* Registers of the internal SerDes of the RTL8390 */
+#define RTL839X_SDS12_13_XSG0			(0xB800)
+
+/* Registers of the internal Serdes of the 9300 */
+#define RTL930X_SDS_INDACS_CMD			(0x03B0)
+#define RTL930X_SDS_INDACS_DATA			(0x03B4)
+#define RTL930X_MAC_FORCE_MODE_CTRL		(0xCA1C)
+
+/* Registers of the internal SerDes of the 9310 */
+#define RTL931X_SERDES_INDRT_ACCESS_CTRL	(0x5638)
+#define RTL931X_SERDES_INDRT_DATA_CTRL		(0x563C)
+#define RTL931X_SERDES_MODE_CTRL		(0x13cc)
+#define RTL931X_PS_SERDES_OFF_MODE_CTRL_ADDR	(0x13F4)
+#define RTL931X_MAC_SERDES_MODE_CTRL(sds)	(0x136C + (((sds) << 2)))
diff --git a/target/linux/realtek/files-5.15/include/dt-bindings/clock/rtl83xx-clk.h b/target/linux/realtek/files-5.15/include/dt-bindings/clock/rtl83xx-clk.h
new file mode 100644
index 00000000000000..3937052cc50ff4
--- /dev/null
+++ b/target/linux/realtek/files-5.15/include/dt-bindings/clock/rtl83xx-clk.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2022 Markus Stockhausen
+ *
+ * RTL83XX clock indices
+ */
+#ifndef __DT_BINDINGS_CLOCK_RTL83XX_H
+#define __DT_BINDINGS_CLOCK_RTL83XX_H
+
+#define CLK_CPU		0
+#define CLK_MEM		1
+#define CLK_LXB		2
+#define CLK_COUNT	3
+
+#endif /* __DT_BINDINGS_CLOCK_RTL83XX_H */
diff --git a/target/linux/realtek/image/Makefile b/target/linux/realtek/image/Makefile
index 6165d99bfc513c..bb704ac8637eca 100644
--- a/target/linux/realtek/image/Makefile
+++ b/target/linux/realtek/image/Makefile
@@ -3,12 +3,18 @@
 include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/image.mk
 
-KERNEL_LOADADDR = 0x80000000
-KERNEL_ENTRY = 0x80000400
-
-DEVICE_VARS += ZYXEL_VERS DLINK_KERNEL_PART_SIZE
-DEVICE_VARS += CAMEO_KERNEL_PART CAMEO_ROOTFS_PART CAMEO_CUSTOMER_SIGNATURE CAMEO_BOARD_VERSION
-DEVICE_VARS += H3C_PRODUCT_ID H3C_DEVICE_ID
+KERNEL_LOADADDR = 0x80100000
+
+DEVICE_VARS += \
+        CAMEO_BOARD_MODEL \
+        CAMEO_BOARD_VERSION \
+        CAMEO_CUSTOMER_SIGNATURE \
+        CAMEO_KERNEL_PART \
+        CAMEO_KERNEL_PART_SIZE \
+        CAMEO_ROOTFS_PART \
+        H3C_DEVICE_ID \
+        H3C_PRODUCT_ID \
+        ZYXEL_VERS
 
 define Build/zyxel-vers
        ( echo VERS;\
@@ -18,25 +24,25 @@ define Build/zyxel-vers
        done ) >> $@
 endef
 
-define Build/dlink-cameo
-	$(SCRIPT_DIR)/cameo-tag.py $@ $(DLINK_KERNEL_PART_SIZE)
+define Build/cameo-tag
+	$(SCRIPT_DIR)/cameo-tag.py $@ $(CAMEO_KERNEL_PART_SIZE)
 endef
 
-define Build/dlink-version
+define Build/cameo-version
 	echo -n "OpenWrt" >> $@
 	dd if=/dev/zero bs=25 count=1 >> $@
 endef
 
-define Build/dlink-headers
-        dd if=$@ bs=$(DLINK_KERNEL_PART_SIZE) count=1 of=$@.kernel_part; \
-        dd if=$@ bs=$(DLINK_KERNEL_PART_SIZE) skip=1 of=$@.rootfs_part; \
+define Build/cameo-headers
+        dd if=$@ bs=$(CAMEO_KERNEL_PART_SIZE) count=1 of=$@.kernel_part; \
+        dd if=$@ bs=$(CAMEO_KERNEL_PART_SIZE) skip=1 of=$@.rootfs_part; \
         $(SCRIPT_DIR)/cameo-imghdr.py $@.kernel_part $@.kernel_part.hex \
-                "$(DEVICE_MODEL)" os $(CAMEO_KERNEL_PART) \
+                "$(CAMEO_BOARD_MODEL)" os $(CAMEO_KERNEL_PART) \
                 $(CAMEO_CUSTOMER_SIGNATURE) \
                 $(CAMEO_BOARD_VERSION) \
                 $(KERNEL_LOADADDR); \
         $(SCRIPT_DIR)/cameo-imghdr.py $@.rootfs_part $@.rootfs_part.hex \
-                "$(DEVICE_MODEL)" squashfs $(CAMEO_ROOTFS_PART) \
+                "$(CAMEO_BOARD_MODEL)" squashfs $(CAMEO_ROOTFS_PART) \
                 $(CAMEO_CUSTOMER_SIGNATURE) \
                 $(CAMEO_BOARD_VERSION); \
         cat $@.kernel_part.hex $@.rootfs_part.hex > $@
@@ -65,50 +71,28 @@ define Build/h3c-vfs
 	mv $@.new $@
 endef
 
-define Build/relocate-kernel
-	rm -rf $@.relocate
-	$(CP) ../../generic/image/relocate $@.relocate
-	$(MAKE) -j1 -C $@.relocate KERNEL_ADDR=$(KERNEL_LOADADDR) LZMA_TEXT_START=0x82000000 \
-		CROSS_COMPILE=$(TARGET_CROSS)
-	( \
-		dd if=$@.relocate/loader.bin bs=32 conv=sync && \
-		perl -e '@s = stat("$@"); print pack("N", @s[7])' && \
-		cat "$@" \
-	) > "$@.new"
-	mv "$@.new" "$@"
-	rm -rf $@.relocate
-endef
-
 define Device/Default
   PROFILES = Default
-  KERNEL := kernel-bin | append-dtb | gzip | uImage gzip
-  KERNEL_INITRAMFS := kernel-bin | append-dtb | gzip | uImage gzip
+  KERNEL := \
+	kernel-bin | \
+	append-dtb | \
+	libdeflate-gzip | \
+	uImage gzip
+  KERNEL_INITRAMFS := \
+	kernel-bin | \
+	append-dtb | \
+	libdeflate-gzip | \
+	uImage gzip
   DEVICE_DTS_DIR := ../dts-$(KERNEL_PATCHVER)
   DEVICE_DTS = $$(SOC)_$(1)
   IMAGES := sysupgrade.bin
-  IMAGE/sysupgrade.bin := append-kernel | pad-to 64k | append-rootfs | pad-rootfs | \
-	check-size | append-metadata
-endef
-
-define Device/hpe_1920
-  DEVICE_VENDOR := HPE
-  IMAGE_SIZE := 29632k
-  BLOCKSIZE := 64k
-  H3C_PRODUCT_ID := 0x3c010501
-  KERNEL := kernel-bin | append-dtb | relocate-kernel | 7z | h3c-image | h3c-vfs
-  KERNEL_INITRAMFS := kernel-bin | append-dtb | relocate-kernel | 7z | h3c-image
-  IMAGE/sysupgrade.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs | \
-  	pad-rootfs | check-size | append-metadata
-endef
-
-# "NGE" refers to the uImage magic
-define Device/netgear_nge
-  KERNEL := kernel-bin | append-dtb | lzma | uImage lzma
-  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | uImage lzma
-  SOC := rtl8380
-  IMAGE_SIZE := 14848k
-  UIMAGE_MAGIC := 0x4e474520
-  DEVICE_VENDOR := NETGEAR
+  IMAGE/sysupgrade.bin := \
+	append-kernel | \
+	pad-to 64k | \
+	append-rootfs | \
+	pad-rootfs | \
+	check-size | \
+	append-metadata
 endef
 
 include $(SUBTARGET).mk
diff --git a/target/linux/realtek/image/common.mk b/target/linux/realtek/image/common.mk
new file mode 100644
index 00000000000000..37370f1999839f
--- /dev/null
+++ b/target/linux/realtek/image/common.mk
@@ -0,0 +1,69 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+define Device/cameo-fw
+  CAMEO_BOARD_MODEL = $$(DEVICE_MODEL)
+  KERNEL := \
+	kernel-bin | \
+	append-dtb | \
+	libdeflate-gzip | \
+	uImage gzip | \
+	cameo-tag
+  IMAGES += factory_image1.bin
+  IMAGE/factory_image1.bin := \
+	append-kernel | \
+	pad-to 64k | \
+	append-rootfs | \
+	pad-rootfs | \
+	pad-to 16 | \
+	check-size | \
+	cameo-version | \
+	cameo-headers
+endef
+
+define Device/d-link_dgs-1210
+  $(Device/cameo-fw)
+  IMAGE_SIZE := 13824k
+  DEVICE_VENDOR := D-Link
+  CAMEO_KERNEL_PART_SIZE := 1572864
+  CAMEO_KERNEL_PART := 2
+  CAMEO_ROOTFS_PART := 3
+  CAMEO_CUSTOMER_SIGNATURE := 2
+  CAMEO_BOARD_VERSION := 32
+endef
+
+define Device/hpe_1920
+  DEVICE_VENDOR := HPE
+  IMAGE_SIZE := 29632k
+  BLOCKSIZE := 64k
+  H3C_PRODUCT_ID := 0x3c010501
+  KERNEL := \
+	kernel-bin | \
+	append-dtb | \
+	7z | \
+	h3c-image | \
+	h3c-vfs
+  KERNEL_INITRAMFS := \
+	kernel-bin | \
+	append-dtb | \
+	7z | \
+	h3c-image
+  IMAGE/sysupgrade.bin := \
+	append-kernel | \
+	pad-to $$$$(BLOCKSIZE) | \
+	append-rootfs | \
+	pad-rootfs | \
+	check-size | \
+	append-metadata
+endef
+
+define Device/zyxel_gs1900
+  DEVICE_VENDOR := ZyXEL
+  IMAGE_SIZE := 6976k
+  UIMAGE_MAGIC := 0x83800000
+  KERNEL_INITRAMFS := \
+	kernel-bin | \
+	append-dtb | \
+	libdeflate-gzip | \
+	zyxel-vers | \
+	uImage gzip
+endef
diff --git a/target/linux/realtek/image/rtl838x.mk b/target/linux/realtek/image/rtl838x.mk
index 36b19b3cbbf75c..7c7bc8a0e5ea50 100644
--- a/target/linux/realtek/image/rtl838x.mk
+++ b/target/linux/realtek/image/rtl838x.mk
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0-only
 
+include ./common.mk
 
 define Device/allnet_all-sg8208m
   SOC := rtl8382
@@ -11,21 +12,21 @@ define Device/allnet_all-sg8208m
 endef
 TARGET_DEVICES += allnet_all-sg8208m
 
-define Device/d-link_dgs-1210
+define Device/apresia_aplgs120gtss
+  $(Device/cameo-fw)
   SOC := rtl8382
-  IMAGE_SIZE := 13824k
-  DEVICE_VENDOR := D-Link
-  DLINK_KERNEL_PART_SIZE := 1572864
-  KERNEL := kernel-bin | append-dtb | gzip | uImage gzip | dlink-cameo
-  CAMEO_KERNEL_PART := 2
-  CAMEO_ROOTFS_PART := 3
+  IMAGE_SIZE := 14848k
+  DEVICE_VENDOR := APRESIA
+  DEVICE_MODEL := ApresiaLightGS120GT-SS
+  UIMAGE_MAGIC := 0x12345000
+  CAMEO_KERNEL_PART_SIZE := 1572864
+  CAMEO_KERNEL_PART := 3
+  CAMEO_ROOTFS_PART := 4
   CAMEO_CUSTOMER_SIGNATURE := 2
-  CAMEO_BOARD_VERSION := 32
-  IMAGES += factory_image1.bin
-  IMAGE/factory_image1.bin := append-kernel | pad-to 64k | \
-	append-rootfs | pad-rootfs | pad-to 16 | check-size | \
-	dlink-version | dlink-headers
+  CAMEO_BOARD_MODEL := APLGS120GTSS
+  CAMEO_BOARD_VERSION := 4
 endef
+TARGET_DEVICES += apresia_aplgs120gtss
 
 define Device/d-link_dgs-1210-10mp-f
   $(Device/d-link_dgs-1210)
@@ -38,6 +39,7 @@ TARGET_DEVICES += d-link_dgs-1210-10mp-f
 
 define Device/d-link_dgs-1210-10p
   $(Device/d-link_dgs-1210)
+  SOC := rtl8382
   DEVICE_MODEL := DGS-1210-10P
   DEVICE_PACKAGES += lua-rs232
 endef
@@ -45,31 +47,46 @@ TARGET_DEVICES += d-link_dgs-1210-10p
 
 define Device/d-link_dgs-1210-16
   $(Device/d-link_dgs-1210)
+  SOC := rtl8382
   DEVICE_MODEL := DGS-1210-16
 endef
 TARGET_DEVICES += d-link_dgs-1210-16
 
 define Device/d-link_dgs-1210-20
   $(Device/d-link_dgs-1210)
+  SOC := rtl8382
   DEVICE_MODEL := DGS-1210-20
 endef
 TARGET_DEVICES += d-link_dgs-1210-20
 
 define Device/d-link_dgs-1210-28
   $(Device/d-link_dgs-1210)
+  SOC := rtl8382
   DEVICE_MODEL := DGS-1210-28
 endef
 TARGET_DEVICES += d-link_dgs-1210-28
 
+define Device/d-link_dgs-1210-28mp-f
+  $(Device/d-link_dgs-1210)
+  SOC := rtl8382
+  DEVICE_MODEL := DGS-1210-28MP
+  DEVICE_VARIANT := F
+  DEVICE_PACKAGES += realtek-poe
+endef
+TARGET_DEVICES += d-link_dgs-1210-28mp-f
+
 # The "IMG-" uImage name allows flashing the iniramfs from the vendor Web UI.
 # Avoided for sysupgrade, as the vendor FW would do an incomplete flash.
 define Device/engenius_ews2910p
   SOC := rtl8380
   IMAGE_SIZE := 8192k
   DEVICE_VENDOR := EnGenius
-  DEVICE_MODEL := EWP2910P
+  DEVICE_MODEL := EWS2910P
   UIMAGE_MAGIC := 0x03802910
-  KERNEL_INITRAMFS := kernel-bin | append-dtb | gzip | \
+  KERNEL_INITRAMFS := \
+	kernel-bin | \
+	append-dtb | \
+	libdeflate-gzip | \
 	uImage gzip -n 'IMG-0.00.00-c0.0.00'
 endef
 TARGET_DEVICES += engenius_ews2910p
@@ -116,6 +133,24 @@ define Device/iodata_bsh-g24mb
 endef
 TARGET_DEVICES += iodata_bsh-g24mb
 
+# "NGE" refers to the uImage magic
+define Device/netgear_nge
+  KERNEL := \
+	kernel-bin | \
+	append-dtb | \
+	lzma | \
+	uImage lzma
+  KERNEL_INITRAMFS := \
+	kernel-bin | \
+	append-dtb | \
+	lzma | \
+	uImage lzma
+  SOC := rtl8380
+  IMAGE_SIZE := 14848k
+  UIMAGE_MAGIC := 0x4e474520
+  DEVICE_VENDOR := NETGEAR
+endef
+
 define Device/netgear_gs108t-v3
   $(Device/netgear_nge)
   DEVICE_MODEL := GS108T
@@ -199,17 +234,9 @@ define Device/tplink_sg2210p-v3
 endef
 TARGET_DEVICES += tplink_sg2210p-v3
 
-define Device/zyxel_gs1900
-  SOC := rtl8380
-  IMAGE_SIZE := 6976k
-  DEVICE_VENDOR := ZyXEL
-  UIMAGE_MAGIC := 0x83800000
-  KERNEL_INITRAMFS := kernel-bin | append-dtb | gzip | zyxel-vers | \
-	uImage gzip
-endef
-
 define Device/zyxel_gs1900-10hp
   $(Device/zyxel_gs1900)
+  SOC := rtl8380
   DEVICE_MODEL := GS1900-10HP
   ZYXEL_VERS := AAZI
 endef
@@ -225,6 +252,7 @@ TARGET_DEVICES += zyxel_gs1900-16
 
 define Device/zyxel_gs1900-8
   $(Device/zyxel_gs1900)
+  SOC := rtl8380
   DEVICE_MODEL := GS1900-8
   ZYXEL_VERS := AAHH
 endef
@@ -232,6 +260,7 @@ TARGET_DEVICES += zyxel_gs1900-8
 
 define Device/zyxel_gs1900-8hp-v1
   $(Device/zyxel_gs1900)
+  SOC := rtl8380
   DEVICE_MODEL := GS1900-8HP
   DEVICE_VARIANT := v1
   ZYXEL_VERS := AAHI
@@ -241,6 +270,7 @@ TARGET_DEVICES += zyxel_gs1900-8hp-v1
 
 define Device/zyxel_gs1900-8hp-v2
   $(Device/zyxel_gs1900)
+  SOC := rtl8380
   DEVICE_MODEL := GS1900-8HP
   DEVICE_VARIANT := v2
   ZYXEL_VERS := AAHI
diff --git a/target/linux/realtek/image/rtl839x.mk b/target/linux/realtek/image/rtl839x.mk
index b47c40924497fe..65078e0c4442eb 100644
--- a/target/linux/realtek/image/rtl839x.mk
+++ b/target/linux/realtek/image/rtl839x.mk
@@ -1,12 +1,44 @@
 # SPDX-License-Identifier: GPL-2.0-only
 
+include ./common.mk
+
+define Device/d-link_dgs-1210-52
+  $(Device/d-link_dgs-1210)
+  SOC := rtl8393
+  DEVICE_MODEL := DGS-1210-52
+endef
+TARGET_DEVICES += d-link_dgs-1210-52
+
+# When the factory image won't fit anymore, it can be removed.
+# New installation will be performed booting the initramfs image from
+# ram and then flashing the sysupgrade image from OpenWrt
+define Device/netgear_gs750e
+  SOC := rtl8393
+  IMAGE_SIZE := 7552k
+  FACTORY_SIZE := 6528k
+  DEVICE_VENDOR := NETGEAR
+  DEVICE_MODEL := GS750E
+  UIMAGE_MAGIC := 0x174e4741
+  IMAGES += factory.bix
+  IMAGE/factory.bix := \
+    append-kernel | \
+    pad-to 64k | \
+    append-rootfs | \
+    pad-rootfs | \
+    check-size $$$$(FACTORY_SIZE)
+endef
+TARGET_DEVICES += netgear_gs750e
+
 define Device/panasonic_m48eg-pn28480k
   SOC := rtl8393
   IMAGE_SIZE := 16384k
   DEVICE_VENDOR := Panasonic
   DEVICE_MODEL := Switch-M48eG
   DEVICE_VARIANT := PN28480K
-  DEVICE_PACKAGES := kmod-hwmon-gpiofan kmod-hwmon-lm75 kmod-i2c-mux-pca954x \
+  DEVICE_PACKAGES := \
+	kmod-hwmon-gpiofan \
+	kmod-hwmon-lm75 \
+	kmod-i2c-mux-pca954x \
 	kmod-thermal
 endef
 TARGET_DEVICES += panasonic_m48eg-pn28480k
@@ -18,18 +50,16 @@ define Device/tplink_sg2452p-v4
   DEVICE_VENDOR := TP-Link
   DEVICE_MODEL := SG2452P
   DEVICE_VARIANT := v4
-  DEVICE_PACKAGES := kmod-hwmon-gpiofan kmod-hwmon-tps23861
+  DEVICE_PACKAGES := \
+	  kmod-hwmon-gpiofan \
+	  kmod-hwmon-tps23861
 endef
 TARGET_DEVICES += tplink_sg2452p-v4
 
 define Device/zyxel_gs1900-48
+  $(Device/zyxel_gs1900)
   SOC := rtl8393
-  IMAGE_SIZE := 13952k
-  DEVICE_VENDOR := ZyXEL
-  UIMAGE_MAGIC := 0x83800000
-  ZYXEL_VERS := AAHO
   DEVICE_MODEL := GS1900-48
-  KERNEL_INITRAMFS := kernel-bin | append-dtb | gzip | zyxel-vers $$$$(ZYXEL_VERS) | \
-	uImage gzip
+  ZYXEL_VERS := AAHN
 endef
 TARGET_DEVICES += zyxel_gs1900-48
diff --git a/target/linux/realtek/image/rtl930x.mk b/target/linux/realtek/image/rtl930x.mk
index 191ea5b20430e8..f55c5c002bf03d 100644
--- a/target/linux/realtek/image/rtl930x.mk
+++ b/target/linux/realtek/image/rtl930x.mk
@@ -6,9 +6,12 @@ define Device/zyxel_xgs1250-12
   ZYXEL_VERS := ABWE
   DEVICE_VENDOR := Zyxel
   DEVICE_MODEL := XGS1250-12
-    IMAGE_SIZE := 13312k
-  KERNEL_INITRAMFS := kernel-bin | append-dtb | gzip | zyxel-vers $$$$(ZYXEL_VERS) | \
+  IMAGE_SIZE := 13312k
+  KERNEL_INITRAMFS := \
+	kernel-bin | \
+	append-dtb | \
+	gzip | \
+	zyxel-vers $$$$(ZYXEL_VERS) | \
 	uImage gzip
 endef
-
 TARGET_DEVICES += zyxel_xgs1250-12
diff --git a/target/linux/realtek/patches-5.15/008-5.17-watchdog-add-realtek-otto-watchdog-timer.patch b/target/linux/realtek/patches-5.15/008-5.17-watchdog-add-realtek-otto-watchdog-timer.patch
new file mode 100644
index 00000000000000..17ff729f525650
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/008-5.17-watchdog-add-realtek-otto-watchdog-timer.patch
@@ -0,0 +1,467 @@
+From 293903b9dfe43520f01374dc1661be11d6838c49 Mon Sep 17 00:00:00 2001
+From: Sander Vanheule <sander@svanheule.net>
+Date: Thu, 18 Nov 2021 17:29:52 +0100
+Subject: watchdog: Add Realtek Otto watchdog timer
+
+Realtek MIPS SoCs (platform name Otto) have a watchdog timer with
+pretimeout notifitication support. The WDT can (partially) hard reset,
+or soft reset the SoC.
+
+This driver implements all features as described in the devicetree
+binding, except the phase2 interrupt, and also functions as a restart
+handler. The cpu reset mode is considered to be a "warm" restart, since
+this mode does not reset all peripherals. Being an embedded system
+though, the "cpu" and "software" modes will still cause the bootloader
+to run on restart.
+
+It is not known how a forced system reset can be disabled on the
+supported platforms. This means that the phase2 interrupt will only fire
+at the same time as reset, so implementing phase2 is of little use.
+
+Signed-off-by: Sander Vanheule <sander@svanheule.net>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/6d060bccbdcc709cfa79203485db85aad3c3beb5.1637252610.git.sander@svanheule.net
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+---
+ MAINTAINERS                         |   7 +
+ drivers/watchdog/Kconfig            |  13 ++
+ drivers/watchdog/Makefile           |   1 +
+ drivers/watchdog/realtek_otto_wdt.c | 384 ++++++++++++++++++++++++++++++++++++
+ 4 files changed, 405 insertions(+)
+ create mode 100644 drivers/watchdog/realtek_otto_wdt.c
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -15902,6 +15902,13 @@ S:	Maintained
+ F:	include/sound/rt*.h
+ F:	sound/soc/codecs/rt*
+ 
++REALTEK OTTO WATCHDOG
++M:	Sander Vanheule <sander@svanheule.net>
++L:	linux-watchdog@vger.kernel.org
++S:	Maintained
++F:	Documentation/devicetree/bindings/watchdog/realtek,otto-wdt.yaml
++F:	driver/watchdog/realtek_otto_wdt.c
++
+ REALTEK RTL83xx SMI DSA ROUTER CHIPS
+ M:	Linus Walleij <linus.walleij@linaro.org>
+ S:	Maintained
+--- a/drivers/watchdog/Kconfig
++++ b/drivers/watchdog/Kconfig
+@@ -954,6 +954,19 @@ config RTD119X_WATCHDOG
+ 	  Say Y here to include support for the watchdog timer in
+ 	  Realtek RTD1295 SoCs.
+ 
++config REALTEK_OTTO_WDT
++	tristate "Realtek Otto MIPS watchdog support"
++	depends on MACH_REALTEK_RTL || COMPILE_TEST
++	depends on COMMON_CLK
++	select WATCHDOG_CORE
++	default MACH_REALTEK_RTL
++	help
++	  Say Y here to include support for the watchdog timer on Realtek
++	  RTL838x, RTL839x, RTL930x SoCs. This watchdog has pretimeout
++	  notifications and system reset on timeout.
++
++	  When built as a module this will be called realtek_otto_wdt.
++
+ config SPRD_WATCHDOG
+ 	tristate "Spreadtrum watchdog support"
+ 	depends on ARCH_SPRD || COMPILE_TEST
+--- a/drivers/watchdog/Makefile
++++ b/drivers/watchdog/Makefile
+@@ -171,6 +171,7 @@ obj-$(CONFIG_IMGPDC_WDT) += imgpdc_wdt.o
+ obj-$(CONFIG_MT7621_WDT) += mt7621_wdt.o
+ obj-$(CONFIG_PIC32_WDT) += pic32-wdt.o
+ obj-$(CONFIG_PIC32_DMT) += pic32-dmt.o
++obj-$(CONFIG_REALTEK_OTTO_WDT) += realtek_otto_wdt.o
+ 
+ # PARISC Architecture
+ 
+--- /dev/null
++++ b/drivers/watchdog/realtek_otto_wdt.c
+@@ -0,0 +1,384 @@
++// SPDX-License-Identifier: GPL-2.0-only
++
++/*
++ * Realtek Otto MIPS platform watchdog
++ *
++ * Watchdog timer that will reset the system after timeout, using the selected
++ * reset mode.
++ *
++ * Counter scaling and timeouts:
++ * - Base prescale of (2 << 25), providing tick duration T_0: 168ms @ 200MHz
++ * - PRESCALE: logarithmic prescaler adding a factor of {1, 2, 4, 8}
++ * - Phase 1: Times out after (PHASE1 + 1) × PRESCALE × T_0
++ *   Generates an interrupt, WDT cannot be stopped after phase 1
++ * - Phase 2: starts after phase 1, times out after (PHASE2 + 1) × PRESCALE × T_0
++ *   Resets the system according to RST_MODE
++ */
++
++#include <linux/bits.h>
++#include <linux/bitfield.h>
++#include <linux/clk.h>
++#include <linux/delay.h>
++#include <linux/interrupt.h>
++#include <linux/io.h>
++#include <linux/math.h>
++#include <linux/minmax.h>
++#include <linux/module.h>
++#include <linux/mod_devicetable.h>
++#include <linux/platform_device.h>
++#include <linux/property.h>
++#include <linux/reboot.h>
++#include <linux/watchdog.h>
++
++#define OTTO_WDT_REG_CNTR		0x0
++#define OTTO_WDT_CNTR_PING		BIT(31)
++
++#define OTTO_WDT_REG_INTR		0x4
++#define OTTO_WDT_INTR_PHASE_1		BIT(31)
++#define OTTO_WDT_INTR_PHASE_2		BIT(30)
++
++#define OTTO_WDT_REG_CTRL		0x8
++#define OTTO_WDT_CTRL_ENABLE		BIT(31)
++#define OTTO_WDT_CTRL_PRESCALE		GENMASK(30, 29)
++#define OTTO_WDT_CTRL_PHASE1		GENMASK(26, 22)
++#define OTTO_WDT_CTRL_PHASE2		GENMASK(19, 15)
++#define OTTO_WDT_CTRL_RST_MODE		GENMASK(1, 0)
++#define OTTO_WDT_MODE_SOC		0
++#define OTTO_WDT_MODE_CPU		1
++#define OTTO_WDT_MODE_SOFTWARE		2
++#define OTTO_WDT_CTRL_DEFAULT		OTTO_WDT_MODE_CPU
++
++#define OTTO_WDT_PRESCALE_MAX		3
++
++/*
++ * One higher than the max values contained in PHASE{1,2}, since a value of 0
++ * corresponds to one tick.
++ */
++#define OTTO_WDT_PHASE_TICKS_MAX	32
++
++/*
++ * The maximum reset delay is actually 2×32 ticks, but that would require large
++ * pretimeout values for timeouts longer than 32 ticks. Limit the maximum timeout
++ * to 32 + 1 to ensure small pretimeout values can be configured as expected.
++ */
++#define OTTO_WDT_TIMEOUT_TICKS_MAX	(OTTO_WDT_PHASE_TICKS_MAX + 1)
++
++struct otto_wdt_ctrl {
++	struct watchdog_device wdev;
++	struct device *dev;
++	void __iomem *base;
++	unsigned int clk_rate_khz;
++	int irq_phase1;
++};
++
++static int otto_wdt_start(struct watchdog_device *wdev)
++{
++	struct otto_wdt_ctrl *ctrl = watchdog_get_drvdata(wdev);
++	u32 v;
++
++	v = ioread32(ctrl->base + OTTO_WDT_REG_CTRL);
++	v |= OTTO_WDT_CTRL_ENABLE;
++	iowrite32(v, ctrl->base + OTTO_WDT_REG_CTRL);
++
++	return 0;
++}
++
++static int otto_wdt_stop(struct watchdog_device *wdev)
++{
++	struct otto_wdt_ctrl *ctrl = watchdog_get_drvdata(wdev);
++	u32 v;
++
++	v = ioread32(ctrl->base + OTTO_WDT_REG_CTRL);
++	v &= ~OTTO_WDT_CTRL_ENABLE;
++	iowrite32(v, ctrl->base + OTTO_WDT_REG_CTRL);
++
++	return 0;
++}
++
++static int otto_wdt_ping(struct watchdog_device *wdev)
++{
++	struct otto_wdt_ctrl *ctrl = watchdog_get_drvdata(wdev);
++
++	iowrite32(OTTO_WDT_CNTR_PING, ctrl->base + OTTO_WDT_REG_CNTR);
++
++	return 0;
++}
++
++static int otto_wdt_tick_ms(struct otto_wdt_ctrl *ctrl, int prescale)
++{
++	return DIV_ROUND_CLOSEST(1 << (25 + prescale), ctrl->clk_rate_khz);
++}
++
++/*
++ * The timer asserts the PHASE1/PHASE2 IRQs when the number of ticks exceeds
++ * the value stored in those fields. This means each phase will run for at least
++ * one tick, so small values need to be clamped to correctly reflect the timeout.
++ */
++static inline unsigned int div_round_ticks(unsigned int val, unsigned int tick_duration,
++		unsigned int min_ticks)
++{
++	return max(min_ticks, DIV_ROUND_UP(val, tick_duration));
++}
++
++static int otto_wdt_determine_timeouts(struct watchdog_device *wdev, unsigned int timeout,
++		unsigned int pretimeout)
++{
++	struct otto_wdt_ctrl *ctrl = watchdog_get_drvdata(wdev);
++	unsigned int pretimeout_ms = pretimeout * 1000;
++	unsigned int timeout_ms = timeout * 1000;
++	unsigned int prescale_next = 0;
++	unsigned int phase1_ticks;
++	unsigned int phase2_ticks;
++	unsigned int total_ticks;
++	unsigned int prescale;
++	unsigned int tick_ms;
++	u32 v;
++
++	do {
++		prescale = prescale_next;
++		if (prescale > OTTO_WDT_PRESCALE_MAX)
++			return -EINVAL;
++
++		tick_ms = otto_wdt_tick_ms(ctrl, prescale);
++		total_ticks = div_round_ticks(timeout_ms, tick_ms, 2);
++		phase1_ticks = div_round_ticks(timeout_ms - pretimeout_ms, tick_ms, 1);
++		phase2_ticks = total_ticks - phase1_ticks;
++
++		prescale_next++;
++	} while (phase1_ticks > OTTO_WDT_PHASE_TICKS_MAX
++		|| phase2_ticks > OTTO_WDT_PHASE_TICKS_MAX);
++
++	v = ioread32(ctrl->base + OTTO_WDT_REG_CTRL);
++
++	v &= ~(OTTO_WDT_CTRL_PRESCALE | OTTO_WDT_CTRL_PHASE1 | OTTO_WDT_CTRL_PHASE2);
++	v |= FIELD_PREP(OTTO_WDT_CTRL_PHASE1, phase1_ticks - 1);
++	v |= FIELD_PREP(OTTO_WDT_CTRL_PHASE2, phase2_ticks - 1);
++	v |= FIELD_PREP(OTTO_WDT_CTRL_PRESCALE, prescale);
++
++	iowrite32(v, ctrl->base + OTTO_WDT_REG_CTRL);
++
++	timeout_ms = total_ticks * tick_ms;
++	ctrl->wdev.timeout = timeout_ms / 1000;
++
++	pretimeout_ms = phase2_ticks * tick_ms;
++	ctrl->wdev.pretimeout = pretimeout_ms / 1000;
++
++	return 0;
++}
++
++static int otto_wdt_set_timeout(struct watchdog_device *wdev, unsigned int val)
++{
++	return otto_wdt_determine_timeouts(wdev, val, min(wdev->pretimeout, val - 1));
++}
++
++static int otto_wdt_set_pretimeout(struct watchdog_device *wdev, unsigned int val)
++{
++	return otto_wdt_determine_timeouts(wdev, wdev->timeout, val);
++}
++
++static int otto_wdt_restart(struct watchdog_device *wdev, unsigned long reboot_mode,
++		void *data)
++{
++	struct otto_wdt_ctrl *ctrl = watchdog_get_drvdata(wdev);
++	u32 reset_mode;
++	u32 v;
++
++	disable_irq(ctrl->irq_phase1);
++
++	switch (reboot_mode) {
++	case REBOOT_SOFT:
++		reset_mode = OTTO_WDT_MODE_SOFTWARE;
++		break;
++	case REBOOT_WARM:
++		reset_mode = OTTO_WDT_MODE_CPU;
++		break;
++	default:
++		reset_mode = OTTO_WDT_MODE_SOC;
++		break;
++	}
++
++	/* Configure for shortest timeout and wait for reset to occur */
++	v = FIELD_PREP(OTTO_WDT_CTRL_RST_MODE, reset_mode) | OTTO_WDT_CTRL_ENABLE;
++	iowrite32(v, ctrl->base + OTTO_WDT_REG_CTRL);
++
++	mdelay(3 * otto_wdt_tick_ms(ctrl, 0));
++
++	return 0;
++}
++
++static irqreturn_t otto_wdt_phase1_isr(int irq, void *dev_id)
++{
++	struct otto_wdt_ctrl *ctrl = dev_id;
++
++	iowrite32(OTTO_WDT_INTR_PHASE_1, ctrl->base + OTTO_WDT_REG_INTR);
++	dev_crit(ctrl->dev, "phase 1 timeout\n");
++	watchdog_notify_pretimeout(&ctrl->wdev);
++
++	return IRQ_HANDLED;
++}
++
++static const struct watchdog_ops otto_wdt_ops = {
++	.owner = THIS_MODULE,
++	.start = otto_wdt_start,
++	.stop = otto_wdt_stop,
++	.ping = otto_wdt_ping,
++	.set_timeout = otto_wdt_set_timeout,
++	.set_pretimeout = otto_wdt_set_pretimeout,
++	.restart = otto_wdt_restart,
++};
++
++static const struct watchdog_info otto_wdt_info = {
++	.identity = "Realtek Otto watchdog timer",
++	.options = WDIOF_KEEPALIVEPING |
++		WDIOF_MAGICCLOSE |
++		WDIOF_SETTIMEOUT |
++		WDIOF_PRETIMEOUT,
++};
++
++static void otto_wdt_clock_action(void *data)
++{
++	clk_disable_unprepare(data);
++}
++
++static int otto_wdt_probe_clk(struct otto_wdt_ctrl *ctrl)
++{
++	struct clk *clk = devm_clk_get(ctrl->dev, NULL);
++	int ret;
++
++	if (IS_ERR(clk))
++		return dev_err_probe(ctrl->dev, PTR_ERR(clk), "Failed to get clock\n");
++
++	ret = clk_prepare_enable(clk);
++	if (ret)
++		return dev_err_probe(ctrl->dev, ret, "Failed to enable clock\n");
++
++	ret = devm_add_action_or_reset(ctrl->dev, otto_wdt_clock_action, clk);
++	if (ret)
++		return ret;
++
++	ctrl->clk_rate_khz = clk_get_rate(clk) / 1000;
++	if (ctrl->clk_rate_khz == 0)
++		return dev_err_probe(ctrl->dev, -ENXIO, "Failed to get clock rate\n");
++
++	return 0;
++}
++
++static int otto_wdt_probe_reset_mode(struct otto_wdt_ctrl *ctrl)
++{
++	static const char *mode_property = "realtek,reset-mode";
++	const struct fwnode_handle *node = ctrl->dev->fwnode;
++	int mode_count;
++	u32 mode;
++	u32 v;
++
++	if (!node)
++		return -ENXIO;
++
++	mode_count = fwnode_property_string_array_count(node, mode_property);
++	if (mode_count < 0)
++		return mode_count;
++	else if (mode_count == 0)
++		return 0;
++	else if (mode_count != 1)
++		return -EINVAL;
++
++	if (fwnode_property_match_string(node, mode_property, "soc") == 0)
++		mode = OTTO_WDT_MODE_SOC;
++	else if (fwnode_property_match_string(node, mode_property, "cpu") == 0)
++		mode = OTTO_WDT_MODE_CPU;
++	else if (fwnode_property_match_string(node, mode_property, "software") == 0)
++		mode = OTTO_WDT_MODE_SOFTWARE;
++	else
++		return -EINVAL;
++
++	v = ioread32(ctrl->base + OTTO_WDT_REG_CTRL);
++	v &= ~OTTO_WDT_CTRL_RST_MODE;
++	v |= FIELD_PREP(OTTO_WDT_CTRL_RST_MODE, mode);
++	iowrite32(v, ctrl->base + OTTO_WDT_REG_CTRL);
++
++	return 0;
++}
++
++static int otto_wdt_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct otto_wdt_ctrl *ctrl;
++	unsigned int max_tick_ms;
++	int ret;
++
++	ctrl = devm_kzalloc(dev, sizeof(*ctrl), GFP_KERNEL);
++	if (!ctrl)
++		return -ENOMEM;
++
++	ctrl->dev = dev;
++	ctrl->base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(ctrl->base))
++		return PTR_ERR(ctrl->base);
++
++	/* Clear any old interrupts and reset initial state */
++	iowrite32(OTTO_WDT_INTR_PHASE_1 | OTTO_WDT_INTR_PHASE_2,
++			ctrl->base + OTTO_WDT_REG_INTR);
++	iowrite32(OTTO_WDT_CTRL_DEFAULT, ctrl->base + OTTO_WDT_REG_CTRL);
++
++	ret = otto_wdt_probe_clk(ctrl);
++	if (ret)
++		return ret;
++
++	ctrl->irq_phase1 = platform_get_irq_byname(pdev, "phase1");
++	if (ctrl->irq_phase1 < 0)
++		return ctrl->irq_phase1;
++
++	ret = devm_request_irq(dev, ctrl->irq_phase1, otto_wdt_phase1_isr, 0,
++			"realtek-otto-wdt", ctrl);
++	if (ret)
++		return dev_err_probe(dev, ret, "Failed to get IRQ for phase1\n");
++
++	ret = otto_wdt_probe_reset_mode(ctrl);
++	if (ret)
++		return dev_err_probe(dev, ret, "Invalid reset mode specified\n");
++
++	ctrl->wdev.parent = dev;
++	ctrl->wdev.info = &otto_wdt_info;
++	ctrl->wdev.ops = &otto_wdt_ops;
++
++	/*
++	 * Since pretimeout cannot be disabled, min. timeout is twice the
++	 * subsystem resolution. Max. timeout is ca. 43s at a bus clock of 200MHz.
++	 */
++	ctrl->wdev.min_timeout = 2;
++	max_tick_ms = otto_wdt_tick_ms(ctrl, OTTO_WDT_PRESCALE_MAX);
++	ctrl->wdev.max_hw_heartbeat_ms = max_tick_ms * OTTO_WDT_TIMEOUT_TICKS_MAX;
++	ctrl->wdev.timeout = min(30U, ctrl->wdev.max_hw_heartbeat_ms / 1000);
++
++	watchdog_set_drvdata(&ctrl->wdev, ctrl);
++	watchdog_init_timeout(&ctrl->wdev, 0, dev);
++	watchdog_stop_on_reboot(&ctrl->wdev);
++	watchdog_set_restart_priority(&ctrl->wdev, 128);
++
++	ret = otto_wdt_determine_timeouts(&ctrl->wdev, ctrl->wdev.timeout, 1);
++	if (ret)
++		return dev_err_probe(dev, ret, "Failed to set timeout\n");
++
++	return devm_watchdog_register_device(dev, &ctrl->wdev);
++}
++
++static const struct of_device_id otto_wdt_ids[] = {
++	{ .compatible = "realtek,rtl8380-wdt" },
++	{ .compatible = "realtek,rtl8390-wdt" },
++	{ .compatible = "realtek,rtl9300-wdt" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, otto_wdt_ids);
++
++static struct platform_driver otto_wdt_driver = {
++	.probe = otto_wdt_probe,
++	.driver = {
++		.name = "realtek-otto-watchdog",
++		.of_match_table	= otto_wdt_ids,
++	},
++};
++module_platform_driver(otto_wdt_driver);
++
++MODULE_LICENSE("GPL v2");
++MODULE_AUTHOR("Sander Vanheule <sander@svanheule.net>");
++MODULE_DESCRIPTION("Realtek Otto watchdog timer driver");
diff --git a/target/linux/realtek/patches-5.15/020-v5.17-net-mdio-add-helpers-to-extract-clause-45-regad-and-.patch b/target/linux/realtek/patches-5.15/020-v5.17-net-mdio-add-helpers-to-extract-clause-45-regad-and-.patch
new file mode 100644
index 00000000000000..da33aaa72f30c8
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/020-v5.17-net-mdio-add-helpers-to-extract-clause-45-regad-and-.patch
@@ -0,0 +1,53 @@
+From c6af53f038aa32cec12e8a305ba07c7ef168f1b0 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Tue, 4 Jan 2022 12:07:00 +0000
+Subject: [PATCH 2/3] net: mdio: add helpers to extract clause 45 regad and
+ devad fields
+
+Add a couple of helpers and definitions to extract the clause 45 regad
+and devad fields from the regnum passed into MDIO drivers.
+
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/linux/mdio.h | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/include/linux/mdio.h
++++ b/include/linux/mdio.h
+@@ -7,6 +7,7 @@
+ #define __LINUX_MDIO_H__
+ 
+ #include <uapi/linux/mdio.h>
++#include <linux/bitfield.h>
+ #include <linux/mod_devicetable.h>
+ 
+ /* Or MII_ADDR_C45 into regnum for read/write on mii_bus to enable the 21 bit
+@@ -14,6 +15,7 @@
+  */
+ #define MII_ADDR_C45		(1<<30)
+ #define MII_DEVADDR_C45_SHIFT	16
++#define MII_DEVADDR_C45_MASK	GENMASK(20, 16)
+ #define MII_REGADDR_C45_MASK	GENMASK(15, 0)
+ 
+ struct gpio_desc;
+@@ -355,6 +357,16 @@ static inline u32 mdiobus_c45_addr(int d
+ 	return MII_ADDR_C45 | devad << MII_DEVADDR_C45_SHIFT | regnum;
+ }
+ 
++static inline u16 mdiobus_c45_regad(u32 regnum)
++{
++	return FIELD_GET(MII_REGADDR_C45_MASK, regnum);
++}
++
++static inline u16 mdiobus_c45_devad(u32 regnum)
++{
++	return FIELD_GET(MII_DEVADDR_C45_MASK, regnum);
++}
++
+ static inline int __mdiobus_c45_read(struct mii_bus *bus, int prtad, int devad,
+ 				     u16 regnum)
+ {
diff --git a/target/linux/realtek/patches-5.15/021-v5.19-02-gpio-realtek-otto-Support-reversed-port-layouts.patch b/target/linux/realtek/patches-5.15/021-v5.19-02-gpio-realtek-otto-Support-reversed-port-layouts.patch
new file mode 100644
index 00000000000000..437e7862d912ac
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/021-v5.19-02-gpio-realtek-otto-Support-reversed-port-layouts.patch
@@ -0,0 +1,123 @@
+From 512c5be35223d9baa2629efa1084cf5210eaee80 Mon Sep 17 00:00:00 2001
+From: Sander Vanheule <sander@svanheule.net>
+Date: Sat, 9 Apr 2022 21:55:47 +0200
+Subject: [PATCH 2/6] gpio: realtek-otto: Support reversed port layouts
+
+The GPIO port layout on the RTL930x SoC series is reversed compared to
+the RTL838x and RTL839x SoC series. Add new port offset calculator
+functions to ensure the correct order is used when reading port IRQ
+data, and ensure bgpio uses the right byte ordering.
+
+Signed-off-by: Sander Vanheule <sander@svanheule.net>
+Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
+---
+ drivers/gpio/gpio-realtek-otto.c | 55 +++++++++++++++++++++++++++++---
+ 1 file changed, 51 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpio/gpio-realtek-otto.c
++++ b/drivers/gpio/gpio-realtek-otto.c
+@@ -58,6 +58,8 @@ struct realtek_gpio_ctrl {
+ 	raw_spinlock_t lock;
+ 	u16 intr_mask[REALTEK_GPIO_PORTS_PER_BANK];
+ 	u16 intr_type[REALTEK_GPIO_PORTS_PER_BANK];
++	unsigned int (*port_offset_u8)(unsigned int port);
++	unsigned int (*port_offset_u16)(unsigned int port);
+ };
+ 
+ /* Expand with more flags as devices with other quirks are added */
+@@ -69,6 +71,11 @@ enum realtek_gpio_flags {
+ 	 * line the IRQ handler was assigned to, causing uncaught interrupts.
+ 	 */
+ 	GPIO_INTERRUPTS_DISABLED = BIT(0),
++	/*
++	 * Port order is reversed, meaning DCBA register layout for 1-bit
++	 * fields, and [BA, DC] for 2-bit fields.
++	 */
++	GPIO_PORTS_REVERSED = BIT(1),
+ };
+ 
+ static struct realtek_gpio_ctrl *irq_data_to_ctrl(struct irq_data *data)
+@@ -86,21 +93,50 @@ static struct realtek_gpio_ctrl *irq_dat
+  * port. The two interrupt mask registers store two bits per GPIO, so use u16
+  * values.
+  */
++static unsigned int realtek_gpio_port_offset_u8(unsigned int port)
++{
++	return port;
++}
++
++static unsigned int realtek_gpio_port_offset_u16(unsigned int port)
++{
++	return 2 * port;
++}
++
++/*
++ * Reversed port order register access
++ *
++ * For registers with one bit per GPIO, all ports are stored as u8-s in one
++ * register in reversed order. The two interrupt mask registers store two bits
++ * per GPIO, so use u16 values. The first register contains ports 1 and 0, the
++ * second ports 3 and 2.
++ */
++static unsigned int realtek_gpio_port_offset_u8_rev(unsigned int port)
++{
++	return 3 - port;
++}
++
++static unsigned int realtek_gpio_port_offset_u16_rev(unsigned int port)
++{
++	return 2 * (port ^ 1);
++}
++
+ static void realtek_gpio_write_imr(struct realtek_gpio_ctrl *ctrl,
+ 	unsigned int port, u16 irq_type, u16 irq_mask)
+ {
+-	iowrite16(irq_type & irq_mask, ctrl->base + REALTEK_GPIO_REG_IMR + 2 * port);
++	iowrite16(irq_type & irq_mask,
++		ctrl->base + REALTEK_GPIO_REG_IMR + ctrl->port_offset_u16(port));
+ }
+ 
+ static void realtek_gpio_clear_isr(struct realtek_gpio_ctrl *ctrl,
+ 	unsigned int port, u8 mask)
+ {
+-	iowrite8(mask, ctrl->base + REALTEK_GPIO_REG_ISR + port);
++	iowrite8(mask, ctrl->base + REALTEK_GPIO_REG_ISR + ctrl->port_offset_u8(port));
+ }
+ 
+ static u8 realtek_gpio_read_isr(struct realtek_gpio_ctrl *ctrl, unsigned int port)
+ {
+-	return ioread8(ctrl->base + REALTEK_GPIO_REG_ISR + port);
++	return ioread8(ctrl->base + REALTEK_GPIO_REG_ISR + ctrl->port_offset_u8(port));
+ }
+ 
+ /* Set the rising and falling edge mask bits for a GPIO port pin */
+@@ -250,6 +286,7 @@ MODULE_DEVICE_TABLE(of, realtek_gpio_of_
+ static int realtek_gpio_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
++	unsigned long bgpio_flags;
+ 	unsigned int dev_flags;
+ 	struct gpio_irq_chip *girq;
+ 	struct realtek_gpio_ctrl *ctrl;
+@@ -277,10 +314,20 @@ static int realtek_gpio_probe(struct pla
+ 
+ 	raw_spin_lock_init(&ctrl->lock);
+ 
++	if (dev_flags & GPIO_PORTS_REVERSED) {
++		bgpio_flags = 0;
++		ctrl->port_offset_u8 = realtek_gpio_port_offset_u8_rev;
++		ctrl->port_offset_u16 = realtek_gpio_port_offset_u16_rev;
++	} else {
++		bgpio_flags = BGPIOF_BIG_ENDIAN_BYTE_ORDER;
++		ctrl->port_offset_u8 = realtek_gpio_port_offset_u8;
++		ctrl->port_offset_u16 = realtek_gpio_port_offset_u16;
++	}
++
+ 	err = bgpio_init(&ctrl->gc, dev, 4,
+ 		ctrl->base + REALTEK_GPIO_REG_DATA, NULL, NULL,
+ 		ctrl->base + REALTEK_GPIO_REG_DIR, NULL,
+-		BGPIOF_BIG_ENDIAN_BYTE_ORDER);
++		bgpio_flags);
+ 	if (err) {
+ 		dev_err(dev, "unable to init generic GPIO");
+ 		return err;
diff --git a/target/linux/realtek/patches-5.15/021-v5.19-03-gpio-realtek-otto-Support-per-cpu-interrupts.patch b/target/linux/realtek/patches-5.15/021-v5.19-03-gpio-realtek-otto-Support-per-cpu-interrupts.patch
new file mode 100644
index 00000000000000..b632095c362213
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/021-v5.19-03-gpio-realtek-otto-Support-per-cpu-interrupts.patch
@@ -0,0 +1,153 @@
+From 95fa6dbe58f286a8f87cb37b7516232eb678de2d Mon Sep 17 00:00:00 2001
+From: Sander Vanheule <sander@svanheule.net>
+Date: Sat, 9 Apr 2022 21:55:48 +0200
+Subject: [PATCH 3/6] gpio: realtek-otto: Support per-cpu interrupts
+
+On SoCs with multiple cores, it is possible that the GPIO interrupt
+controller supports assigning specific pins to one or more cores.
+
+IRQ balancing can be performed on a line-by-line basis if the parent
+interrupt is routed to all available cores, which is the default upon
+initialisation.
+
+Signed-off-by: Sander Vanheule <sander@svanheule.net>
+Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
+---
+ drivers/gpio/gpio-realtek-otto.c | 75 +++++++++++++++++++++++++++++++-
+ 1 file changed, 74 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpio/gpio-realtek-otto.c
++++ b/drivers/gpio/gpio-realtek-otto.c
+@@ -1,6 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ 
+ #include <linux/gpio/driver.h>
++#include <linux/cpumask.h>
+ #include <linux/irq.h>
+ #include <linux/minmax.h>
+ #include <linux/mod_devicetable.h>
+@@ -55,6 +56,8 @@
+ struct realtek_gpio_ctrl {
+ 	struct gpio_chip gc;
+ 	void __iomem *base;
++	void __iomem *cpumask_base;
++	struct cpumask cpu_irq_maskable;
+ 	raw_spinlock_t lock;
+ 	u16 intr_mask[REALTEK_GPIO_PORTS_PER_BANK];
+ 	u16 intr_type[REALTEK_GPIO_PORTS_PER_BANK];
+@@ -76,6 +79,11 @@ enum realtek_gpio_flags {
+ 	 * fields, and [BA, DC] for 2-bit fields.
+ 	 */
+ 	GPIO_PORTS_REVERSED = BIT(1),
++	/*
++	 * Interrupts can be enabled per cpu. This requires a secondary IO
++	 * range, where the per-cpu enable masks are located.
++	 */
++	GPIO_INTERRUPTS_PER_CPU = BIT(2),
+ };
+ 
+ static struct realtek_gpio_ctrl *irq_data_to_ctrl(struct irq_data *data)
+@@ -247,14 +255,61 @@ static void realtek_gpio_irq_handler(str
+ 	chained_irq_exit(irq_chip, desc);
+ }
+ 
++static inline void __iomem *realtek_gpio_irq_cpu_mask(struct realtek_gpio_ctrl *ctrl,
++	unsigned int port, int cpu)
++{
++	return ctrl->cpumask_base + ctrl->port_offset_u8(port) +
++		REALTEK_GPIO_PORTS_PER_BANK * cpu;
++}
++
++static int realtek_gpio_irq_set_affinity(struct irq_data *data,
++	const struct cpumask *dest, bool force)
++{
++	struct realtek_gpio_ctrl *ctrl = irq_data_to_ctrl(data);
++	unsigned int line = irqd_to_hwirq(data);
++	unsigned int port = line / 8;
++	unsigned int port_pin = line % 8;
++	void __iomem *irq_cpu_mask;
++	unsigned long flags;
++	int cpu;
++	u8 v;
++
++	if (!ctrl->cpumask_base)
++		return -ENXIO;
++
++	raw_spin_lock_irqsave(&ctrl->lock, flags);
++
++	for_each_cpu(cpu, &ctrl->cpu_irq_maskable) {
++		irq_cpu_mask = realtek_gpio_irq_cpu_mask(ctrl, port, cpu);
++		v = ioread8(irq_cpu_mask);
++
++		if (cpumask_test_cpu(cpu, dest))
++			v |= BIT(port_pin);
++		else
++			v &= ~BIT(port_pin);
++
++		iowrite8(v, irq_cpu_mask);
++	}
++
++	raw_spin_unlock_irqrestore(&ctrl->lock, flags);
++
++	irq_data_update_effective_affinity(data, dest);
++
++	return 0;
++}
++
+ static int realtek_gpio_irq_init(struct gpio_chip *gc)
+ {
+ 	struct realtek_gpio_ctrl *ctrl = gpiochip_get_data(gc);
+ 	unsigned int port;
++	int cpu;
+ 
+ 	for (port = 0; (port * 8) < gc->ngpio; port++) {
+ 		realtek_gpio_write_imr(ctrl, port, 0, 0);
+ 		realtek_gpio_clear_isr(ctrl, port, GENMASK(7, 0));
++
++		for_each_cpu(cpu, &ctrl->cpu_irq_maskable)
++			iowrite8(GENMASK(7, 0), realtek_gpio_irq_cpu_mask(ctrl, port, cpu));
+ 	}
+ 
+ 	return 0;
+@@ -266,6 +321,7 @@ static struct irq_chip realtek_gpio_irq_
+ 	.irq_mask = realtek_gpio_irq_mask,
+ 	.irq_unmask = realtek_gpio_irq_unmask,
+ 	.irq_set_type = realtek_gpio_irq_set_type,
++	.irq_set_affinity = realtek_gpio_irq_set_affinity,
+ };
+ 
+ static const struct of_device_id realtek_gpio_of_match[] = {
+@@ -290,8 +346,10 @@ static int realtek_gpio_probe(struct pla
+ 	unsigned int dev_flags;
+ 	struct gpio_irq_chip *girq;
+ 	struct realtek_gpio_ctrl *ctrl;
++	struct resource *res;
+ 	u32 ngpios;
+-	int err, irq;
++	unsigned int nr_cpus;
++	int cpu, err, irq;
+ 
+ 	ctrl = devm_kzalloc(dev, sizeof(*ctrl), GFP_KERNEL);
+ 	if (!ctrl)
+@@ -352,6 +410,21 @@ static int realtek_gpio_probe(struct pla
+ 		girq->init_hw = realtek_gpio_irq_init;
+ 	}
+ 
++	cpumask_clear(&ctrl->cpu_irq_maskable);
++
++	if ((dev_flags & GPIO_INTERRUPTS_PER_CPU) && irq > 0) {
++		ctrl->cpumask_base = devm_platform_get_and_ioremap_resource(pdev, 1, &res);
++		if (IS_ERR(ctrl->cpumask_base))
++			return dev_err_probe(dev, PTR_ERR(ctrl->cpumask_base),
++				"missing CPU IRQ mask registers");
++
++		nr_cpus = resource_size(res) / REALTEK_GPIO_PORTS_PER_BANK;
++		nr_cpus = min(nr_cpus, num_present_cpus());
++
++		for (cpu = 0; cpu < nr_cpus; cpu++)
++			cpumask_set_cpu(cpu, &ctrl->cpu_irq_maskable);
++	}
++
+ 	return devm_gpiochip_add_data(dev, &ctrl->gc, ctrl);
+ }
+ 
diff --git a/target/linux/realtek/patches-5.15/021-v5.19-04-gpio-realtek-otto-Add-RTL930x-support.patch b/target/linux/realtek/patches-5.15/021-v5.19-04-gpio-realtek-otto-Add-RTL930x-support.patch
new file mode 100644
index 00000000000000..9b2580313898ca
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/021-v5.19-04-gpio-realtek-otto-Add-RTL930x-support.patch
@@ -0,0 +1,29 @@
+From deaf1cecdeb052cdb5e92fd642016198724b44a4 Mon Sep 17 00:00:00 2001
+From: Sander Vanheule <sander@svanheule.net>
+Date: Sat, 9 Apr 2022 21:55:49 +0200
+Subject: [PATCH 4/6] gpio: realtek-otto: Add RTL930x support
+
+The RTL930x SoC series has support for 24 GPIOs, with the port order
+reversed compared to RTL838x and RTL839x. The RTL930x series also has
+two CPUs (VPEs) and can distribute individual GPIO interrupts between
+them.
+
+Signed-off-by: Sander Vanheule <sander@svanheule.net>
+Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
+---
+ drivers/gpio/gpio-realtek-otto.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpio/gpio-realtek-otto.c
++++ b/drivers/gpio/gpio-realtek-otto.c
+@@ -335,6 +335,10 @@ static const struct of_device_id realtek
+ 	{
+ 		.compatible = "realtek,rtl8390-gpio",
+ 	},
++	{
++		.compatible = "realtek,rtl9300-gpio",
++		.data = (void *)(GPIO_PORTS_REVERSED | GPIO_INTERRUPTS_PER_CPU)
++	},
+ 	{}
+ };
+ MODULE_DEVICE_TABLE(of, realtek_gpio_of_match);
diff --git a/target/linux/realtek/patches-5.15/021-v5.19-06-gpio-realtek-otto-Add-RTL931x-support.patch b/target/linux/realtek/patches-5.15/021-v5.19-06-gpio-realtek-otto-Add-RTL931x-support.patch
new file mode 100644
index 00000000000000..810856eb8911a3
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/021-v5.19-06-gpio-realtek-otto-Add-RTL931x-support.patch
@@ -0,0 +1,30 @@
+From d3bf3dc4bbbf6109bd9b4bd60089d36205ec4a37 Mon Sep 17 00:00:00 2001
+From: Sander Vanheule <sander@svanheule.net>
+Date: Sat, 9 Apr 2022 21:55:51 +0200
+Subject: [PATCH 6/6] gpio: realtek-otto: Add RTL931x support
+
+The RTL931x SoC series has support for 32 GPIOs, although not all lines
+may be broken out to a physical pad.
+
+The GPIO bank's parent interrupt can be routed to either or both of the
+SoC's CPU cores by the GIC. Line-by-line IRQ balancing is not possible
+on these SoCs.
+
+Signed-off-by: Sander Vanheule <sander@svanheule.net>
+Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
+---
+ drivers/gpio/gpio-realtek-otto.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpio/gpio-realtek-otto.c
++++ b/drivers/gpio/gpio-realtek-otto.c
+@@ -339,6 +339,9 @@ static const struct of_device_id realtek
+ 		.compatible = "realtek,rtl9300-gpio",
+ 		.data = (void *)(GPIO_PORTS_REVERSED | GPIO_INTERRUPTS_PER_CPU)
+ 	},
++	{
++		.compatible = "realtek,rtl9310-gpio",
++	},
+ 	{}
+ };
+ MODULE_DEVICE_TABLE(of, realtek_gpio_of_match);
diff --git a/target/linux/realtek/patches-5.15/300-mips-add-rtl838x-platform.patch b/target/linux/realtek/patches-5.15/300-mips-add-rtl838x-platform.patch
new file mode 100644
index 00000000000000..6407a49fb6b627
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/300-mips-add-rtl838x-platform.patch
@@ -0,0 +1,86 @@
+From fce11f68491b46b93df69de0630cd9edb90bc772 Mon Sep 17 00:00:00 2001
+From: Birger Koblitz <git@birger-koblitz.de>
+Date: Wed, 29 Dec 2021 21:54:21 +0100
+Subject: [PATCH] realtek: Create 4 different Realtek Platforms
+
+Creates RTL83XX as a basic kernel config parameter for the
+RTL838X, RTL839x, RTL930X and RTL931X platforms with respective
+configurations for the SoCs, which are introduced in addition.
+
+Submitted-by: Birger Koblitz <git@birger-koblitz.de>
+---
+ arch/mips/Kbuild.platforms                    |  1 +
+ arch/mips/Kconfig                             | 57 ++++++++++++++
+ 2 files changed, 58 insertions(+)
+
+--- a/arch/mips/Kbuild.platforms
++++ b/arch/mips/Kbuild.platforms
+@@ -23,6 +23,7 @@ platform-$(CONFIG_NLM_COMMON)		+= netlog
+ platform-$(CONFIG_PIC32MZDA)		+= pic32/
+ platform-$(CONFIG_RALINK)		+= ralink/
+ platform-$(CONFIG_MIKROTIK_RB532)	+= rb532/
++platform-$(CONFIG_RTL83XX)		+= rtl838x/
+ platform-$(CONFIG_SGI_IP22)		+= sgi-ip22/
+ platform-$(CONFIG_SGI_IP27)		+= sgi-ip27/
+ platform-$(CONFIG_SGI_IP28)		+= sgi-ip22/
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -1053,8 +1053,58 @@ config NLM_XLP_BOARD
+ 	  This board is based on Netlogic XLP Processor.
+ 	  Say Y here if you have a XLP based board.
+ 
++config RTL83XX
++	bool "Realtek based platforms"
++	select DMA_NONCOHERENT
++	select IRQ_MIPS_CPU
++	select NO_EXCEPT_FILL
++	select SYS_HAS_CPU_MIPS32_R1
++	select SYS_HAS_CPU_MIPS32_R2
++	select SYS_SUPPORTS_BIG_ENDIAN
++	select SYS_SUPPORTS_HIGHMEM
++	select SYS_SUPPORTS_32BIT_KERNEL
++	select SYS_SUPPORTS_MIPS16
++	select SYS_HAS_EARLY_PRINTK
++	select SYS_HAS_EARLY_PRINTK_8250
++	select USE_GENERIC_EARLY_PRINTK_8250
++	select BOOT_RAW
++	select PINCTRL
++	select ARCH_HAS_RESET_CONTROLLER
++	select RESET_CONTROLLER
++	select USE_OF
++
+ endchoice
+ 
++config RTL838X
++	bool "Realtek RTL838X based platforms"
++	depends on RTL83XX
++	select CPU_SUPPORTS_CPUFREQ
++	select MIPS_EXTERNAL_TIMER
++
++config RTL839X
++	bool "Realtek RTL839X based platforms"
++	depends on RTL83XX
++	select CPU_SUPPORTS_CPUFREQ
++	select MIPS_EXTERNAL_TIMER
++	select SYS_SUPPORTS_MULTITHREADING
++
++config RTL930X
++	bool "Realtek RTL930X based platforms"
++	depends on RTL83XX
++	select MIPS_CPU_SCACHE
++	select MIPS_EXTERNAL_TIMER
++	select SYS_SUPPORTS_MULTITHREADING
++
++config RTL931X
++	bool "Realtek RTL931X based platforms"
++	depends on RTL930X
++	select MIPS_GIC
++	select COMMON_CLK
++	select CLKSRC_MIPS_GIC
++	select SYS_SUPPORTS_VPE_LOADER
++	select SYS_SUPPORTS_SMP
++	select SYS_SUPPORTS_MIPS_CPS
++
+ source "arch/mips/alchemy/Kconfig"
+ source "arch/mips/ath25/Kconfig"
+ source "arch/mips/ath79/Kconfig"
diff --git a/target/linux/realtek/patches-5.15/301-gpio-add-rtl8231-driver.patch b/target/linux/realtek/patches-5.15/301-gpio-add-rtl8231-driver.patch
new file mode 100644
index 00000000000000..7603a037442445
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/301-gpio-add-rtl8231-driver.patch
@@ -0,0 +1,50 @@
+From 2b88563ee5aafd9571d965b7f2093a0f58d98a31 Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Thu, 26 Nov 2020 12:02:21 +0100
+Subject: [PATCH] realtek: update the tree to the latest refactored version
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+* rename the target to realtek
+* add refactored DSA driver
+* add latest gpio driver
+* lots of arch cleanups
+* new irq driver
+* additional boards
+
+Submitted-by: Bert Vermeulen <bert@biot.com>
+Submitted-by: Birger Koblitz <mail@birger-koblitz.de>
+Submitted-by: Sander Vanheule <sander@svanheule.net>
+Submitted-by: Bjørn Mork <bjorn@mork.no>
+Submitted-by: John Crispin <john@phrozen.org>
+---
+ drivers/gpio/Kconfig                          |    6 ++++++
+ drivers/gpio/Makefile                         |    1 +
+ 2 files changed, 7 insertions(+)
+
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -529,6 +529,12 @@ config GPIO_ROCKCHIP
+ 	help
+ 	  Say yes here to support GPIO on Rockchip SoCs.
+ 
++config GPIO_RTL8231
++	tristate "RTL8231 GPIO"
++	depends on RTL83XX
++	help
++	  Say yes here to support Realtek RTL8231 GPIO expansion chips.
++
+ config GPIO_SAMA5D2_PIOBU
+ 	tristate "SAMA5D2 PIOBU GPIO support"
+ 	depends on MFD_SYSCON
+--- a/drivers/gpio/Makefile
++++ b/drivers/gpio/Makefile
+@@ -129,6 +129,7 @@ obj-$(CONFIG_GPIO_RDC321X)		+= gpio-rdc3
+ obj-$(CONFIG_GPIO_REALTEK_OTTO)		+= gpio-realtek-otto.o
+ obj-$(CONFIG_GPIO_REG)			+= gpio-reg.o
+ obj-$(CONFIG_GPIO_ROCKCHIP)	+= gpio-rockchip.o
++obj-$(CONFIG_GPIO_RTL8231)		+= gpio-rtl8231.o
+ obj-$(CONFIG_ARCH_SA1100)		+= gpio-sa1100.o
+ obj-$(CONFIG_GPIO_SAMA5D2_PIOBU)	+= gpio-sama5d2-piobu.o
+ obj-$(CONFIG_GPIO_SCH311X)		+= gpio-sch311x.o
diff --git a/target/linux/realtek/patches-5.15/302-clocksource-add-otto-driver.patch b/target/linux/realtek/patches-5.15/302-clocksource-add-otto-driver.patch
new file mode 100644
index 00000000000000..63a5050ebb5fa9
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/302-clocksource-add-otto-driver.patch
@@ -0,0 +1,93 @@
+From 3cc8011171186d906c547bc6f0c1f8e350edc7cf Mon Sep 17 00:00:00 2001
+From: Markus Stockhausen <markus.stockhausen@gmx.de>
+Date: Mon, 3 Oct 2022 14:45:21 +0200
+Subject: [PATCH] realtek: resurrect timer driver
+
+Now that we provide a clock driver for the Reltek SOCs the CPU frequency might
+change on demand. This has direct visible effects during operation
+
+- the CEVT 4K timer is no longer a stable clocksource
+- after CPU frequencies changes time calculation works wrong
+- sched_clock falls back to kernel default interval (100 Hz)
+- timestamps in dmesg have only 2 digits left
+
+[    0.000000] sched_clock: 32 bits at 100 Hz, resolution 10000000ns, wraps ...
+[    0.060000] pid_max: default: 32768 minimum: 301
+[    0.070000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
+[    0.070000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
+[    0.080000] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
+[    0.090000] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, ...
+
+Looking around where we can start the CEVT timer for RTL930X is a good basis.
+Initially it was developed as a clocksource driver for the broken timer in that
+specific SOC series. Afterwards it was shifted around to the CEVT location,
+got SMP enablement and lost its clocksource feature. So we at least have
+something to copy from. As the timers on these devices are well understood
+the implementation follows this way:
+
+- leave the RTL930X implementation as is
+- provide a new driver for RTL83XX devices only
+- swap RTL930X driver at a later time
+
+Like the clock driver this patch contains a self contained module that is SOC
+independet and already provides full support for the RTL838X, RTL839X and
+RTL930X devices. Some of the new (or reestablished) features are:
+
+- simplified initialization routines
+- SMP setup with CPU hotplug framework
+- derived from LXB clock speed
+- supplied clocksource
+- dedicated register functions for better readability
+- documentation about some caveats
+
+Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
+[remove unused header includes, remove old CONFIG_MIPS dependency, add
+REALTEK_ prefix to driver symbol]
+Signed-off-by: Sander Vanheule <sander@svanheule.net>
+
+---
+ drivers/clocksource/Kconfig                   | 12 +++
+ drivers/clocksource/Makefile                  |  1 +
+ include/linux/cpuhotplug.h                    |  1 +
+ 3 files changed, 14 insertions(+)
+
+--- a/drivers/clocksource/Kconfig
++++ b/drivers/clocksource/Kconfig
+@@ -127,6 +127,17 @@ config RDA_TIMER
+ 	help
+ 	  Enables the support for the RDA Micro timer driver.
+ 
++config REALTEK_OTTO_TIMER
++	bool "Clocksource/timer for the Realtek Otto platform"
++	select COMMON_CLK
++	select TIMER_OF
++	help
++	  This driver adds support for the timers found in the Realtek RTL83xx
++	  and RTL93xx SoCs series. This includes chips such as RTL8380, RTL8381
++	  and RTL832, as well as chips from the RTL839x series, such as RTL8390
++	  RT8391, RTL8392, RTL8393 and RTL8396 and chips of the RTL930x series
++	  such as RTL9301, RTL9302 or RTL9303.
++
+ config SUN4I_TIMER
+ 	bool "Sun4i timer driver" if COMPILE_TEST
+ 	depends on HAS_IOMEM
+--- a/drivers/clocksource/Makefile
++++ b/drivers/clocksource/Makefile
+@@ -58,6 +58,7 @@ obj-$(CONFIG_MILBEAUT_TIMER)	+= timer-mi
+ obj-$(CONFIG_SPRD_TIMER)	+= timer-sprd.o
+ obj-$(CONFIG_NPCM7XX_TIMER)	+= timer-npcm7xx.o
+ obj-$(CONFIG_RDA_TIMER)		+= timer-rda.o
++obj-$(CONFIG_REALTEK_OTTO_TIMER)	+= timer-rtl-otto.o
+ 
+ obj-$(CONFIG_ARC_TIMERS)		+= arc_timer.o
+ obj-$(CONFIG_ARM_ARCH_TIMER)		+= arm_arch_timer.o
+--- a/include/linux/cpuhotplug.h
++++ b/include/linux/cpuhotplug.h
+@@ -176,6 +176,7 @@ enum cpuhp_state {
+ 	CPUHP_AP_MARCO_TIMER_STARTING,
+ 	CPUHP_AP_MIPS_GIC_TIMER_STARTING,
+ 	CPUHP_AP_ARC_TIMER_STARTING,
++	CPUHP_AP_REALTEK_TIMER_STARTING,
+ 	CPUHP_AP_RISCV_TIMER_STARTING,
+ 	CPUHP_AP_CLINT_TIMER_STARTING,
+ 	CPUHP_AP_CSKY_TIMER_STARTING,
diff --git a/target/linux/realtek/patches-5.15/303-gpio-update-dependencies-for-gpio-realtek-otto.patch b/target/linux/realtek/patches-5.15/303-gpio-update-dependencies-for-gpio-realtek-otto.patch
new file mode 100644
index 00000000000000..beaddcb58e624d
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/303-gpio-update-dependencies-for-gpio-realtek-otto.patch
@@ -0,0 +1,26 @@
+From 9bac1c20b8f39f2e0e342b087add5093b94feaed Mon Sep 17 00:00:00 2001
+From: INAGAKI Hiroshi <musashino.open@gmail.com>
+Date: Wed, 5 May 2021 22:05:39 +0900
+Subject: realtek: backport gpio-realtek-otto driver from 5.13 to 5.10
+
+This patch backports "gpio-realtek-otto" driver to Kernel 5.10.
+"MACH_REALTEK_RTL" is used as a platform name in upstream, but "RTL838X"
+is used in OpenWrt, so update the dependency by the additional patch.
+
+Submitted-by: INAGAKI Hiroshi <musashino.open@gmail.com>
+---
+ drivers/gpio/Kconfig                          |   4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -503,8 +503,8 @@ config GPIO_RDA
+ 
+ config GPIO_REALTEK_OTTO
+ 	tristate "Realtek Otto GPIO support"
+-	depends on MACH_REALTEK_RTL
+-	default MACH_REALTEK_RTL
++	depends on RTL83XX
++	default RTL838X
+ 	select GPIO_GENERIC
+ 	select GPIOLIB_IRQCHIP
+ 	help
diff --git a/target/linux/realtek/patches-5.15/304-spi-update-dependency-for-spi-realtek-rtl.patch b/target/linux/realtek/patches-5.15/304-spi-update-dependency-for-spi-realtek-rtl.patch
new file mode 100644
index 00000000000000..f2b57bacde9916
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/304-spi-update-dependency-for-spi-realtek-rtl.patch
@@ -0,0 +1,25 @@
+From 0b000cbfe0aa0323bffa855ef8449c0687a4c071 Mon Sep 17 00:00:00 2001
+From: INAGAKI Hiroshi <musashino.open@gmail.com>
+Date: Thu, 6 May 2021 19:30:58 +0900
+Subject: realtek: backport spi-realtek-rtl driver from 5.12 to 5.10
+
+This patch backports "spi-realtek-rtl" driver to Kernel 5.10 from 5.12.
+"MACH_REALTEK_RTL" is used as a platform name in upstream, but "RTL838X"
+is used in OpenWrt, so update the dependency by the additional patch.
+
+Submitted-by: INAGAKI Hiroshi <musashino.open@gmail.com>
+---
+ drivers/spi/Makefile                          |  2 +-
+ 1 files changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/spi/Makefile
++++ b/drivers/spi/Makefile
+@@ -97,7 +97,7 @@ obj-$(CONFIG_SPI_QUP)			+= spi-qup.o
+ obj-$(CONFIG_SPI_ROCKCHIP)		+= spi-rockchip.o
+ obj-$(CONFIG_SPI_ROCKCHIP_SFC)		+= spi-rockchip-sfc.o
+ obj-$(CONFIG_SPI_RB4XX)			+= spi-rb4xx.o
+-obj-$(CONFIG_MACH_REALTEK_RTL)		+= spi-realtek-rtl.o
++obj-$(CONFIG_RTL83XX)			+= spi-realtek-rtl.o
+ obj-$(CONFIG_SPI_RPCIF)			+= spi-rpc-if.o
+ obj-$(CONFIG_SPI_RSPI)			+= spi-rspi.o
+ obj-$(CONFIG_SPI_S3C24XX)		+= spi-s3c24xx-hw.o
diff --git a/target/linux/realtek/patches-5.15/305-irqchip-update-dependency-for-irq-realtek-rtl.patch b/target/linux/realtek/patches-5.15/305-irqchip-update-dependency-for-irq-realtek-rtl.patch
new file mode 100644
index 00000000000000..a94a3ff8ac7968
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/305-irqchip-update-dependency-for-irq-realtek-rtl.patch
@@ -0,0 +1,25 @@
+From 2cd00b51470a30198b048a5fca48a04db77e29cc Mon Sep 17 00:00:00 2001
+From: INAGAKI Hiroshi <musashino.open@gmail.com>
+Date: Fri, 21 May 2021 23:16:37 +0900
+Subject: [PATCH] realtek: backport irq-realtek-rtl driver from 5.12 to 5.10
+
+This patch backports "irq-realtek-rtl" driver to Kernel 5.10 from 5.12.
+"MACH_REALTEK_RTL" is used as a platform name in upstream, but "RTL838X"
+is used in OpenWrt, so update the dependency by the additional patch.
+
+Submitted-by: INAGAKI Hiroshi <musashino.open@gmail.com>
+---
+ drivers/irqchip/Makefile                      | 2 +-
+ 1 files changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/irqchip/Makefile
++++ b/drivers/irqchip/Makefile
+@@ -112,7 +112,7 @@ obj-$(CONFIG_LOONGSON_PCH_PIC)		+= irq-l
+ obj-$(CONFIG_LOONGSON_PCH_MSI)		+= irq-loongson-pch-msi.o
+ obj-$(CONFIG_MST_IRQ)			+= irq-mst-intc.o
+ obj-$(CONFIG_SL28CPLD_INTC)		+= irq-sl28cpld.o
+-obj-$(CONFIG_MACH_REALTEK_RTL)		+= irq-realtek-rtl.o
++obj-$(CONFIG_RTL83XX)			+= irq-realtek-rtl.o
+ obj-$(CONFIG_WPCM450_AIC)		+= irq-wpcm450-aic.o
+ obj-$(CONFIG_IRQ_IDT3243X)		+= irq-idt3243x.o
+ obj-$(CONFIG_APPLE_AIC)			+= irq-apple-aic.o
diff --git a/target/linux/realtek/patches-5.15/307-wdt-update-dependency-for-realtek-otto-wdt.patch b/target/linux/realtek/patches-5.15/307-wdt-update-dependency-for-realtek-otto-wdt.patch
new file mode 100644
index 00000000000000..b44aebea129c41
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/307-wdt-update-dependency-for-realtek-otto-wdt.patch
@@ -0,0 +1,32 @@
+From b8fc5eecdc5d33cf261986436597b5482ab856da Mon Sep 17 00:00:00 2001
+From: Sander Vanheule <sander@svanheule.net>
+Date: Sun, 14 Nov 2021 19:45:32 +0100
+Subject: [PATCH] realtek: Backport Realtek Otto WDT driver
+
+Add patch submitted upstream to linux-watchdog and replace the MIPS
+architecture symbols. Requires one extra patch for the DIV_ROUND_*
+macros, which have moved to a different header since 5.10.
+
+Submitted-by: Sander Vanheule <sander@svanheule.net>
+Tested-by: Stijn Segers <foss@volatilesystems.org>
+Tested-by: Paul Fertser <fercerpav@gmail.com>
+Tested-by: Stijn Tintel <stijn@linux-ipv6.be>
+---
+ drivers/watchdog/Kconfig                      | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/watchdog/Kconfig
++++ b/drivers/watchdog/Kconfig
+@@ -956,10 +956,10 @@ config RTD119X_WATCHDOG
+ 
+ config REALTEK_OTTO_WDT
+ 	tristate "Realtek Otto MIPS watchdog support"
+-	depends on MACH_REALTEK_RTL || COMPILE_TEST
++	depends on RTL83XX
+ 	depends on COMMON_CLK
+ 	select WATCHDOG_CORE
+-	default MACH_REALTEK_RTL
++	default RTL83XX
+ 	help
+ 	  Say Y here to include support for the watchdog timer on Realtek
+ 	  RTL838x, RTL839x, RTL930x SoCs. This watchdog has pretimeout
diff --git a/target/linux/realtek/patches-5.15/308-otto-wdt-fix-missing-math-header.patch b/target/linux/realtek/patches-5.15/308-otto-wdt-fix-missing-math-header.patch
new file mode 100644
index 00000000000000..78b145617fabcc
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/308-otto-wdt-fix-missing-math-header.patch
@@ -0,0 +1,28 @@
+From b8fc5eecdc5d33cf261986436597b5482ab856da Mon Sep 17 00:00:00 2001
+From: Sander Vanheule <sander@svanheule.net>
+Date: Sun, 14 Nov 2021 19:45:32 +0100
+Subject: [PATCH] realtek: Backport Realtek Otto WDT driver
+
+Add patch submitted upstream to linux-watchdog and replace the MIPS
+architecture symbols. Requires one extra patch for the DIV_ROUND_*
+macros, which have moved to a different header since 5.10.
+
+Submitted-by: Sander Vanheule <sander@svanheule.net>
+Tested-by: Stijn Segers <foss@volatilesystems.org>
+Tested-by: Paul Fertser <fercerpav@gmail.com>
+Tested-by: Stijn Tintel <stijn@linux-ipv6.be>
+---
+ drivers/watchdog/realtek_otto_wdt.c           | 2 +-
+ 1 files changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/watchdog/realtek_otto_wdt.c
++++ b/drivers/watchdog/realtek_otto_wdt.c
+@@ -21,7 +21,7 @@
+ #include <linux/delay.h>
+ #include <linux/interrupt.h>
+ #include <linux/io.h>
+-#include <linux/math.h>
++#include <linux/kernel.h>
+ #include <linux/minmax.h>
+ #include <linux/module.h>
+ #include <linux/mod_devicetable.h>
diff --git a/target/linux/realtek/patches-5.15/310-add-i2c-rtl9300-support.patch b/target/linux/realtek/patches-5.15/310-add-i2c-rtl9300-support.patch
new file mode 100644
index 00000000000000..2125aea77f0cf4
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/310-add-i2c-rtl9300-support.patch
@@ -0,0 +1,46 @@
+From 63a0a4d85bc900464c5b046b13808a582345f8c8 Mon Sep 17 00:00:00 2001
+From: Birger Koblitz <git@birger-koblitz.de>
+Date: Sat, 11 Dec 2021 20:14:47 +0100
+Subject: [PATCH] realtek: Add support for RTL9300/RTL9310 I2C controller
+
+This adds support for the RTL9300 and RTL9310 I2C controller.
+The controller implements the SMBus protocol for SMBus transfers
+over an I2C bus. The driver supports selecting one of the 2 possible
+SCL pins and any of the 8 possible SDA pins. Bus speeds of
+100kHz (standard speed) and 400kHz (high speed I2C) are supported.
+
+Submitted-by: Birger Koblitz <git@birger-koblitz.de>
+---
+ drivers/i2c/busses/Kconfig                    | 10 +++++++++
+ drivers/i2c/busses/Makefile                   |  1 +
+ 2 files changed, 11 insertions(+)
+
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -949,6 +949,16 @@ config I2C_RK3X
+ 	  This driver can also be built as a module. If so, the module will
+ 	  be called i2c-rk3x.
+ 
++config I2C_RTL9300
++	tristate "Realtek RTL9300 I2C adapter"
++	depends on OF
++	help
++	  Say Y here to include support for the I2C adapter in Realtek RTL9300
++	  and RTL9310 SoCs.
++
++	  This driver can also be built as a module. If so, the module will
++	  be called i2c-rtl9300.
++
+ config HAVE_S3C2410_I2C
+ 	bool
+ 	help
+--- a/drivers/i2c/busses/Makefile
++++ b/drivers/i2c/busses/Makefile
+@@ -94,6 +94,7 @@ obj-$(CONFIG_I2C_QCOM_GENI)	+= i2c-qcom-
+ obj-$(CONFIG_I2C_QUP)		+= i2c-qup.o
+ obj-$(CONFIG_I2C_RIIC)		+= i2c-riic.o
+ obj-$(CONFIG_I2C_RK3X)		+= i2c-rk3x.o
++obj-$(CONFIG_I2C_RTL9300)	+= i2c-rtl9300.o
+ obj-$(CONFIG_I2C_S3C2410)	+= i2c-s3c2410.o
+ obj-$(CONFIG_I2C_SH7760)	+= i2c-sh7760.o
+ obj-$(CONFIG_I2C_SH_MOBILE)	+= i2c-sh_mobile.o
diff --git a/target/linux/realtek/patches-5.15/311-add-i2c-mux-rtl9300-support.patch b/target/linux/realtek/patches-5.15/311-add-i2c-mux-rtl9300-support.patch
new file mode 100644
index 00000000000000..d0bfba45381f5c
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/311-add-i2c-mux-rtl9300-support.patch
@@ -0,0 +1,46 @@
+From f4bdb7fdccdfe3fa382abe77f72a16c2f2e6add0 Mon Sep 17 00:00:00 2001
+From: Birger Koblitz <git@birger-koblitz.de>
+Date: Sat, 11 Dec 2021 20:25:37 +0100
+Subject: [PATCH] realtek: Add support for RTL9300/RTL9310 I2C multiplexing
+
+The RTL9300/RTL9310 I2C controllers have support for 2 independent I2C
+masters, each with a fixed SCL pin, that cannot be changed. Each of these
+masters can use 8 (RTL9300) or 16 (RTL9310) different pins for SDA.
+This multiplexer directly controls the two masters and their shared
+IO configuration registers to allow multiplexing between any of these
+busses. The two masters cannot be used in parallel as the multiplex
+is protected by a standard multiplex lock.
+
+Submitted-by: Birger Koblitz <git@birger-koblitz.de>
+---
+ drivers/i2c/muxes/Kconfig                     |  9 +++++++
+ drivers/i2c/muxes/Makefile                    |  1 +
+ 2 files changed, 10 insertions(+)
+
+--- a/drivers/i2c/muxes/Kconfig
++++ b/drivers/i2c/muxes/Kconfig
+@@ -99,6 +99,15 @@ config I2C_MUX_REG
+ 	  This driver can also be built as a module.  If so, the module
+ 	  will be called i2c-mux-reg.
+ 
++config I2C_MUX_RTL9300
++	tristate "RTL9300 based I2C multiplexer"
++	help
++	  If you say yes to this option, support will be included for a
++	  RTL9300 based I2C multiplexer.
++
++	  This driver can also be built as a module.  If so, the module
++	  will be called i2c-mux-reg.
++
+ config I2C_DEMUX_PINCTRL
+ 	tristate "pinctrl-based I2C demultiplexer"
+ 	depends on PINCTRL && OF
+--- a/drivers/i2c/muxes/Makefile
++++ b/drivers/i2c/muxes/Makefile
+@@ -14,5 +14,6 @@ obj-$(CONFIG_I2C_MUX_PCA9541)	+= i2c-mux
+ obj-$(CONFIG_I2C_MUX_PCA954x)	+= i2c-mux-pca954x.o
+ obj-$(CONFIG_I2C_MUX_PINCTRL)	+= i2c-mux-pinctrl.o
+ obj-$(CONFIG_I2C_MUX_REG)	+= i2c-mux-reg.o
++obj-$(CONFIG_I2C_MUX_RTL9300)	+= i2c-mux-rtl9300.o
+ 
+ ccflags-$(CONFIG_I2C_DEBUG_BUS) := -DDEBUG
diff --git a/target/linux/realtek/patches-5.15/315-irqchip-irq-realtek-rtl-add-VPE-support.patch b/target/linux/realtek/patches-5.15/315-irqchip-irq-realtek-rtl-add-VPE-support.patch
new file mode 100644
index 00000000000000..102c9850ce4413
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/315-irqchip-irq-realtek-rtl-add-VPE-support.patch
@@ -0,0 +1,402 @@
+From 6c18e9c491959ac0674ebe36b09f9ddc3f2c9bce Mon Sep 17 00:00:00 2001
+From: Birger Koblitz <git@birger-koblitz.de>
+Date: Fri, 31 Dec 2021 11:56:49 +0100
+Subject: [PATCH] realtek: Add VPE support for the IRQ driver
+
+In order to support VSMP, enable support for both VPEs
+of the RTL839X and RTL930X SoCs in the irq-realtek-rtl
+driver. Add support for IRQ affinity setting.
+
+Submitted-by: Birger Koblitz <git@birger-koblitz.de>
+---
+ drivers/irqchip/irq-realtek-rtl.c             | 152 +++++++++++++++---
+ 1 file changed, 73 insertions(+), 76 deletions(-)
+
+--- a/drivers/irqchip/irq-realtek-rtl.c
++++ b/drivers/irqchip/irq-realtek-rtl.c
+@@ -21,21 +21,63 @@
+ #define RTL_ICTL_IRR2		0x10
+ #define RTL_ICTL_IRR3		0x14
+ 
+-#define REG(x)		(realtek_ictl_base + x)
++#define RTL_ICTL_NUM_INPUTS	32
++#define RTL_ICTL_NUM_OUTPUTS	15
+ 
+ static DEFINE_RAW_SPINLOCK(irq_lock);
+-static void __iomem *realtek_ictl_base;
++
++#define REG(offset, cpu)	(realtek_ictl_base[cpu] + offset)
++
++static void __iomem *realtek_ictl_base[NR_CPUS];
++static cpumask_t realtek_ictl_cpu_configurable;
++
++struct realtek_ictl_output {
++	/* IRQ controller data */
++	struct fwnode_handle *fwnode;
++	/* Output specific data */
++	unsigned int output_index;
++	struct irq_domain *domain;
++	u32 child_mask;
++};
++
++/*
++ * IRR0-IRR3 store 4 bits per interrupt, but Realtek uses inverted numbering,
++ * placing IRQ 31 in the first four bits. A routing value of '0' means the
++ * interrupt is left disconnected. Routing values {1..15} connect to output
++ * lines {0..14}.
++ */
++#define IRR_OFFSET(idx)		(4 * (3 - (idx * 4) / 32))
++#define IRR_SHIFT(idx)		((idx * 4) % 32)
++
++static inline u32 read_irr(void __iomem *irr0, int idx)
++{
++	return (readl(irr0 + IRR_OFFSET(idx)) >> IRR_SHIFT(idx)) & 0xf;
++}
++
++static inline void write_irr(void __iomem *irr0, int idx, u32 value)
++{
++	unsigned int offset = IRR_OFFSET(idx);
++	unsigned int shift = IRR_SHIFT(idx);
++	u32 irr;
++
++	irr = readl(irr0 + offset) & ~(0xf << shift);
++	irr |= (value & 0xf) << shift;
++	writel(irr, irr0 + offset);
++}
+ 
+ static void realtek_ictl_unmask_irq(struct irq_data *i)
+ {
+ 	unsigned long flags;
+ 	u32 value;
++	int cpu;
+ 
+ 	raw_spin_lock_irqsave(&irq_lock, flags);
+ 
+-	value = readl(REG(RTL_ICTL_GIMR));
+-	value |= BIT(i->hwirq);
+-	writel(value, REG(RTL_ICTL_GIMR));
++	for_each_cpu(cpu, &realtek_ictl_cpu_configurable) {
++		value = readl(REG(RTL_ICTL_GIMR, cpu));
++		value |= BIT(i->hwirq);
++		writel(value, REG(RTL_ICTL_GIMR, cpu));
++	}
+ 
+ 	raw_spin_unlock_irqrestore(&irq_lock, flags);
+ }
+@@ -44,52 +86,137 @@ static void realtek_ictl_mask_irq(struct
+ {
+ 	unsigned long flags;
+ 	u32 value;
++	int cpu;
+ 
+ 	raw_spin_lock_irqsave(&irq_lock, flags);
+ 
+-	value = readl(REG(RTL_ICTL_GIMR));
+-	value &= ~BIT(i->hwirq);
+-	writel(value, REG(RTL_ICTL_GIMR));
++	for_each_cpu(cpu, &realtek_ictl_cpu_configurable) {
++		value = readl(REG(RTL_ICTL_GIMR, cpu));
++		value &= ~BIT(i->hwirq);
++		writel(value, REG(RTL_ICTL_GIMR, cpu));
++	}
+ 
+ 	raw_spin_unlock_irqrestore(&irq_lock, flags);
+ }
+ 
++static int __maybe_unused realtek_ictl_irq_affinity(struct irq_data *i,
++	const struct cpumask *dest, bool force)
++{
++	struct realtek_ictl_output *output = i->domain->host_data;
++	cpumask_t cpu_configure;
++	cpumask_t cpu_disable;
++	cpumask_t cpu_enable;
++	unsigned long flags;
++	int cpu;
++
++	raw_spin_lock_irqsave(&irq_lock, flags);
++
++	cpumask_and(&cpu_configure, cpu_present_mask, &realtek_ictl_cpu_configurable);
++
++	cpumask_and(&cpu_enable, &cpu_configure, dest);
++	cpumask_andnot(&cpu_disable, &cpu_configure, dest);
++
++	for_each_cpu(cpu, &cpu_disable)
++		write_irr(REG(RTL_ICTL_IRR0, cpu), i->hwirq, 0);
++
++	for_each_cpu(cpu, &cpu_enable)
++		write_irr(REG(RTL_ICTL_IRR0, cpu), i->hwirq, output->output_index + 1);
++
++	irq_data_update_effective_affinity(i, &cpu_enable);
++
++	raw_spin_unlock_irqrestore(&irq_lock, flags);
++
++	return IRQ_SET_MASK_OK;
++}
++
+ static struct irq_chip realtek_ictl_irq = {
+ 	.name = "realtek-rtl-intc",
+ 	.irq_mask = realtek_ictl_mask_irq,
+ 	.irq_unmask = realtek_ictl_unmask_irq,
++#ifdef CONFIG_SMP
++	.irq_set_affinity = realtek_ictl_irq_affinity,
++#endif
+ };
+ 
+ static int intc_map(struct irq_domain *d, unsigned int irq, irq_hw_number_t hw)
+ {
++	struct realtek_ictl_output *output = d->host_data;
++	unsigned long flags;
++
+ 	irq_set_chip_and_handler(irq, &realtek_ictl_irq, handle_level_irq);
+ 
++	raw_spin_lock_irqsave(&irq_lock, flags);
++
++	output->child_mask |= BIT(hw);
++	write_irr(REG(RTL_ICTL_IRR0, 0), hw, output->output_index + 1);
++
++	raw_spin_unlock_irqrestore(&irq_lock, flags);
++
+ 	return 0;
+ }
+ 
++static int intc_select(struct irq_domain *d, struct irq_fwspec *fwspec,
++	enum irq_domain_bus_token bus_token)
++{
++	struct realtek_ictl_output *output = d->host_data;
++	bool routed_elsewhere;
++	unsigned long flags;
++	u32 routing_old;
++	int cpu;
++
++	if (fwspec->fwnode != output->fwnode)
++		return false;
++
++	/* Original specifiers had only one parameter */
++	if (fwspec->param_count < 2)
++		return true;
++
++	raw_spin_lock_irqsave(&irq_lock, flags);
++
++	/*
++	 * Inputs can only be routed to one output, so they shouldn't be
++	 * allowed to end up in multiple domains.
++	 */
++	for_each_cpu(cpu, &realtek_ictl_cpu_configurable) {
++		routing_old = read_irr(REG(RTL_ICTL_IRR0, cpu), fwspec->param[0]);
++		routed_elsewhere = routing_old && fwspec->param[1] != routing_old - 1;
++		if (routed_elsewhere) {
++			pr_warn("soc int %d already routed to output %d\n",
++				fwspec->param[0], routing_old - 1);
++			break;
++		}
++	}
++
++	raw_spin_unlock_irqrestore(&irq_lock, flags);
++
++	return !routed_elsewhere && fwspec->param[1] == output->output_index;
++}
++
+ static const struct irq_domain_ops irq_domain_ops = {
+ 	.map = intc_map,
++	.select = intc_select,
+ 	.xlate = irq_domain_xlate_onecell,
+ };
+ 
+ static void realtek_irq_dispatch(struct irq_desc *desc)
+ {
++	struct realtek_ictl_output *output = irq_desc_get_handler_data(desc);
+ 	struct irq_chip *chip = irq_desc_get_chip(desc);
+-	struct irq_domain *domain;
++	int cpu = smp_processor_id();
+ 	unsigned long pending;
+ 	unsigned int soc_int;
+ 
+ 	chained_irq_enter(chip, desc);
+-	pending = readl(REG(RTL_ICTL_GIMR)) & readl(REG(RTL_ICTL_GISR));
++	pending = readl(REG(RTL_ICTL_GIMR, cpu)) & readl(REG(RTL_ICTL_GISR, cpu))
++		& output->child_mask;
+ 
+ 	if (unlikely(!pending)) {
+ 		spurious_interrupt();
+ 		goto out;
+ 	}
+ 
+-	domain = irq_desc_get_handler_data(desc);
+-	for_each_set_bit(soc_int, &pending, 32)
+-		generic_handle_domain_irq(domain, soc_int);
++	for_each_set_bit(soc_int, &pending, RTL_ICTL_NUM_INPUTS)
++		generic_handle_domain_irq(output->domain, soc_int);
+ 
+ out:
+ 	chained_irq_exit(chip, desc);
+@@ -102,85 +229,110 @@ out:
+  * thus go into 4 IRRs. A routing value of '0' means the interrupt is left
+  * disconnected. Routing values {1..15} connect to output lines {0..14}.
+  */
+-static int __init map_interrupts(struct device_node *node, struct irq_domain *domain)
++static int __init setup_parent_interrupts(struct device_node *node, int *parents,
++	unsigned int num_parents)
+ {
+-	struct device_node *cpu_ictl;
+-	const __be32 *imap;
+-	u32 imaplen, soc_int, cpu_int, tmp, regs[4];
+-	int ret, i, irr_regs[] = {
+-		RTL_ICTL_IRR3,
+-		RTL_ICTL_IRR2,
+-		RTL_ICTL_IRR1,
+-		RTL_ICTL_IRR0,
+-	};
+-	u8 mips_irqs_set;
++	struct realtek_ictl_output *outputs;
++	struct realtek_ictl_output *output;
++	struct irq_domain *domain;
++	unsigned int p;
+ 
+-	ret = of_property_read_u32(node, "#address-cells", &tmp);
+-	if (ret || tmp)
+-		return -EINVAL;
++	outputs = kcalloc(num_parents, sizeof(*outputs), GFP_KERNEL);
++	if (!outputs)
++		return -ENOMEM;
+ 
+-	imap = of_get_property(node, "interrupt-map", &imaplen);
+-	if (!imap || imaplen % 3)
+-		return -EINVAL;
++	for (p = 0; p < num_parents; p++) {
++		output = outputs + p;
+ 
+-	mips_irqs_set = 0;
+-	memset(regs, 0, sizeof(regs));
+-	for (i = 0; i < imaplen; i += 3 * sizeof(u32)) {
+-		soc_int = be32_to_cpup(imap);
+-		if (soc_int > 31)
+-			return -EINVAL;
+-
+-		cpu_ictl = of_find_node_by_phandle(be32_to_cpup(imap + 1));
+-		if (!cpu_ictl)
+-			return -EINVAL;
+-		ret = of_property_read_u32(cpu_ictl, "#interrupt-cells", &tmp);
+-		of_node_put(cpu_ictl);
+-		if (ret || tmp != 1)
+-			return -EINVAL;
+-
+-		cpu_int = be32_to_cpup(imap + 2);
+-		if (cpu_int > 7 || cpu_int < 2)
+-			return -EINVAL;
+-
+-		if (!(mips_irqs_set & BIT(cpu_int))) {
+-			irq_set_chained_handler_and_data(cpu_int, realtek_irq_dispatch,
+-							 domain);
+-			mips_irqs_set |= BIT(cpu_int);
+-		}
++		domain = irq_domain_add_linear(node, RTL_ICTL_NUM_INPUTS, &irq_domain_ops, output);
++		if (!domain)
++			goto domain_err;
+ 
+-		/* Use routing values (1..6) for CPU interrupts (2..7) */
+-		regs[(soc_int * 4) / 32] |= (cpu_int - 1) << (soc_int * 4) % 32;
+-		imap += 3;
+-	}
++		output->fwnode = of_node_to_fwnode(node);
++		output->output_index = p;
++		output->domain = domain;
+ 
+-	for (i = 0; i < 4; i++)
+-		writel(regs[i], REG(irr_regs[i]));
++		irq_set_chained_handler_and_data(parents[p], realtek_irq_dispatch, output);
++	}
+ 
+ 	return 0;
++
++domain_err:
++	while (p--) {
++		irq_set_chained_handler_and_data(parents[p], NULL, NULL);
++		irq_domain_remove(outputs[p].domain);
++	}
++
++	kfree(outputs);
++
++	return -ENOMEM;
+ }
+ 
+ static int __init realtek_rtl_of_init(struct device_node *node, struct device_node *parent)
+ {
+-	struct irq_domain *domain;
+-	int ret;
++	int parent_irqs[RTL_ICTL_NUM_OUTPUTS];
++	struct of_phandle_args oirq;
++	unsigned int num_parents;
++	unsigned int soc_irq;
++	unsigned int p;
++	int cpu;
++
++	cpumask_clear(&realtek_ictl_cpu_configurable);
++
++	for (cpu = 0; cpu < NR_CPUS; cpu++) {
++		realtek_ictl_base[cpu] = of_iomap(node, cpu);
++		if (realtek_ictl_base[cpu]) {
++			cpumask_set_cpu(cpu, &realtek_ictl_cpu_configurable);
++
++			/* Disable all cascaded interrupts and clear routing */
++			writel(0, REG(RTL_ICTL_GIMR, cpu));
++			for (soc_irq = 0; soc_irq < RTL_ICTL_NUM_INPUTS; soc_irq++)
++				write_irr(REG(RTL_ICTL_IRR0, cpu), soc_irq, 0);
++		}
++	}
+ 
+-	realtek_ictl_base = of_iomap(node, 0);
+-	if (!realtek_ictl_base)
++	if (cpumask_empty(&realtek_ictl_cpu_configurable))
+ 		return -ENXIO;
+ 
+-	/* Disable all cascaded interrupts */
+-	writel(0, REG(RTL_ICTL_GIMR));
++	num_parents = of_irq_count(node);
++	if (num_parents > RTL_ICTL_NUM_OUTPUTS) {
++		pr_err("too many parent interrupts\n");
++		return -EINVAL;
++	}
+ 
+-	domain = irq_domain_add_simple(node, 32, 0,
+-				       &irq_domain_ops, NULL);
++	for (p = 0; p < num_parents; p++)
++		parent_irqs[p] = of_irq_get(node, p);
+ 
+-	ret = map_interrupts(node, domain);
+-	if (ret) {
+-		pr_err("invalid interrupt map\n");
+-		return ret;
++	if (WARN_ON(!num_parents)) {
++		/*
++		 * If DT contains no parent interrupts, assume MIPS CPU IRQ 2
++		 * (HW0) is connected to the first output. This is the case for
++		 * all known hardware anyway. "interrupt-map" is deprecated, so
++		 * don't bother trying to parse that.
++		 * Since this is to account for old devicetrees with one-cell
++		 * interrupt specifiers, only one output domain is needed.
++		 */
++		oirq.np = of_find_compatible_node(NULL, NULL, "mti,cpu-interrupt-controller");
++		if (oirq.np) {
++			oirq.args_count = 1;
++			oirq.args[0] = 2;
++
++			parent_irqs[0] = irq_create_of_mapping(&oirq);
++			num_parents = 1;
++		}
++
++		of_node_put(oirq.np);
+ 	}
+ 
+-	return 0;
++	/* Ensure we haven't collected any errors before proceeding */
++	for (p = 0; p < num_parents; p++) {
++		if (parent_irqs[p] < 0)
++			return parent_irqs[p];
++		if (!parent_irqs[p])
++			return -ENODEV;
++	}
++
++	return setup_parent_interrupts(node, &parent_irqs[0], num_parents);
+ }
+ 
+ IRQCHIP_DECLARE(realtek_rtl_intc, "realtek,rtl-intc", realtek_rtl_of_init);
diff --git a/target/linux/realtek/patches-5.15/316-otto-gpio-uniprocessor-irq-mask.patch b/target/linux/realtek/patches-5.15/316-otto-gpio-uniprocessor-irq-mask.patch
new file mode 100644
index 00000000000000..a13d70d6335e0b
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/316-otto-gpio-uniprocessor-irq-mask.patch
@@ -0,0 +1,51 @@
+From bde6311569ef25a00c3beaeabfd6b78b19651872 Mon Sep 17 00:00:00 2001
+From: Sander Vanheule <sander@svanheule.net>
+Date: Sun, 29 May 2022 19:38:09 +0200
+Subject: [PATCH] realtek: don't unmask non-maskable GPIO IRQs
+
+On uniprocessor builds, for_each_cpu(cpu, mask) will assume 'mask'
+always contains exactly one CPU, and ignore the actual mask contents.
+This causes the loop to run, even when it shouldn't on an empty mask,
+and tries to access an uninitialised pointer.
+
+Fix this by wrapping the loop in a cpumask_empty() check, to ensure it
+will not run on uniprocessor builds if the CPU mask is empty.
+
+Fixes: af6cd37f42f3 ("realtek: replace RTL93xx GPIO patches")
+Reported-by: INAGAKI Hiroshi <musashino.open@gmail.com>
+Reported-by: Robert Marko <robimarko@gmail.com>
+Tested-by: Robert Marko <robimarko@gmail.com>
+Submitted-by: Sander Vanheule <sander@svanheule.net>
+---
+ drivers/gpio/gpio-realtek-otto.c              | 9 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpio/gpio-realtek-otto.c
++++ b/drivers/gpio/gpio-realtek-otto.c
+@@ -301,6 +301,7 @@ static int realtek_gpio_irq_set_affinity
+ static int realtek_gpio_irq_init(struct gpio_chip *gc)
+ {
+ 	struct realtek_gpio_ctrl *ctrl = gpiochip_get_data(gc);
++	void __iomem *irq_cpu_mask;
+ 	unsigned int port;
+ 	int cpu;
+ 
+@@ -308,8 +309,16 @@ static int realtek_gpio_irq_init(struct
+ 		realtek_gpio_write_imr(ctrl, port, 0, 0);
+ 		realtek_gpio_clear_isr(ctrl, port, GENMASK(7, 0));
+ 
+-		for_each_cpu(cpu, &ctrl->cpu_irq_maskable)
+-			iowrite8(GENMASK(7, 0), realtek_gpio_irq_cpu_mask(ctrl, port, cpu));
++		/*
++		 * Uniprocessor builds assume a mask always contains one CPU,
++		 * so only start the loop if we have at least one maskable CPU.
++		 */
++		if(!cpumask_empty(&ctrl->cpu_irq_maskable)) {
++			for_each_cpu(cpu, &ctrl->cpu_irq_maskable) {
++				irq_cpu_mask = realtek_gpio_irq_cpu_mask(ctrl, port, cpu);
++				iowrite8(GENMASK(7, 0), irq_cpu_mask);
++			}
++		}
+ 	}
+ 
+ 	return 0;
diff --git a/target/linux/realtek/patches-5.15/317-gpio-realtek-otto-switch-to-32-bit-I-O.patch b/target/linux/realtek/patches-5.15/317-gpio-realtek-otto-switch-to-32-bit-I-O.patch
new file mode 100644
index 00000000000000..9f2c3b50b6116a
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/317-gpio-realtek-otto-switch-to-32-bit-I-O.patch
@@ -0,0 +1,368 @@
+From ee0175b3b44288c74d5292c2a9c2c154f6c0317e Mon Sep 17 00:00:00 2001
+From: Sander Vanheule <sander@svanheule.net>
+Date: Sun, 7 Aug 2022 21:21:15 +0200
+Subject: [PATCH] gpio: realtek-otto: switch to 32-bit I/O
+
+By using 16-bit I/O on the GPIO peripheral, which is apparently not safe
+on MIPS, the IMR can end up containing garbage. This then results in
+interrupt triggers for lines that don't have an interrupt handler
+associated. The irq_desc lookup fails, and the ISR will not be cleared,
+keeping the CPU busy until reboot, or until another IMR operation
+restores the correct value. This situation appears to happen very
+rarely, for < 0.5% of IMR writes.
+
+Instead of using 8-bit or 16-bit I/O operations on the 32-bit memory
+mapped peripheral registers, switch to using 32-bit I/O only, operating
+on the entire bank for all single bit line settings. For 2-bit line
+settings, with 16-bit port values, stick to manual (un)packing.
+
+This issue has been seen on RTL8382M (HPE 1920-16G), RTL8391M (Netgear
+GS728TP v2), and RTL8393M (D-Link DGS-1210-52 F3, Zyxel GS1900-48).
+
+Reported-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> # DGS-1210-52
+Reported-by: Birger Koblitz <mail@birger-koblitz.de> # GS728TP
+Reported-by: Jan Hoffmann <jan@3e8.eu> # 1920-16G
+Fixes: 0d82fb1127fb ("gpio: Add Realtek Otto GPIO support")
+Signed-off-by: Sander Vanheule <sander@svanheule.net>
+Cc: Paul Cercueil <paul@crapouillou.net>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
+
+Update patch for missing upstream changes:
+  - commit a01a40e33499 ("gpio: realtek-otto: Make the irqchip immutable")
+Signed-off-by: Sander Vanheule <sander@svanheule.net>
+
+---
+ drivers/gpio/gpio-realtek-otto.c | 166 ++++++++++++++++---------------
+ 1 file changed, 85 insertions(+), 81 deletions(-)
+
+--- a/drivers/gpio/gpio-realtek-otto.c
++++ b/drivers/gpio/gpio-realtek-otto.c
+@@ -46,10 +46,20 @@
+  * @lock: Lock for accessing the IRQ registers and values
+  * @intr_mask: Mask for interrupts lines
+  * @intr_type: Interrupt type selection
++ * @bank_read: Read a bank setting as a single 32-bit value
++ * @bank_write: Write a bank setting as a single 32-bit value
++ * @imr_line_pos: Bit shift of an IRQ line's IMR value.
++ *
++ * The DIR, DATA, and ISR registers consist of four 8-bit port values, packed
++ * into a single 32-bit register. Use @bank_read (@bank_write) to get (assign)
++ * a value from (to) these registers. The IMR register consists of four 16-bit
++ * port values, packed into two 32-bit registers. Use @imr_line_pos to get the
++ * bit shift of the 2-bit field for a line's IMR settings. Shifts larger than
++ * 32 overflow into the second register.
+  *
+  * Because the interrupt mask register (IMR) combines the function of IRQ type
+  * selection and masking, two extra values are stored. @intr_mask is used to
+- * mask/unmask the interrupts for a GPIO port, and @intr_type is used to store
++ * mask/unmask the interrupts for a GPIO line, and @intr_type is used to store
+  * the selected interrupt types. The logical AND of these values is written to
+  * IMR on changes.
+  */
+@@ -59,10 +69,11 @@ struct realtek_gpio_ctrl {
+ 	void __iomem *cpumask_base;
+ 	struct cpumask cpu_irq_maskable;
+ 	raw_spinlock_t lock;
+-	u16 intr_mask[REALTEK_GPIO_PORTS_PER_BANK];
+-	u16 intr_type[REALTEK_GPIO_PORTS_PER_BANK];
+-	unsigned int (*port_offset_u8)(unsigned int port);
+-	unsigned int (*port_offset_u16)(unsigned int port);
++	u8 intr_mask[REALTEK_GPIO_MAX];
++	u8 intr_type[REALTEK_GPIO_MAX];
++	u32 (*bank_read)(void __iomem *reg);
++	void (*bank_write)(void __iomem *reg, u32 value);
++	unsigned int (*line_imr_pos)(unsigned int line);
+ };
+ 
+ /* Expand with more flags as devices with other quirks are added */
+@@ -101,14 +112,22 @@ static struct realtek_gpio_ctrl *irq_dat
+  * port. The two interrupt mask registers store two bits per GPIO, so use u16
+  * values.
+  */
+-static unsigned int realtek_gpio_port_offset_u8(unsigned int port)
++static u32 realtek_gpio_bank_read_swapped(void __iomem *reg)
++{
++	return ioread32be(reg);
++}
++
++static void realtek_gpio_bank_write_swapped(void __iomem *reg, u32 value)
+ {
+-	return port;
++	iowrite32be(value, reg);
+ }
+ 
+-static unsigned int realtek_gpio_port_offset_u16(unsigned int port)
++static unsigned int realtek_gpio_line_imr_pos_swapped(unsigned int line)
+ {
+-	return 2 * port;
++	unsigned int port_pin = line % 8;
++	unsigned int port = line / 8;
++
++	return 2 * (8 * (port ^ 1) + port_pin);
+ }
+ 
+ /*
+@@ -119,64 +138,65 @@ static unsigned int realtek_gpio_port_of
+  * per GPIO, so use u16 values. The first register contains ports 1 and 0, the
+  * second ports 3 and 2.
+  */
+-static unsigned int realtek_gpio_port_offset_u8_rev(unsigned int port)
++static u32 realtek_gpio_bank_read(void __iomem *reg)
+ {
+-	return 3 - port;
++	return ioread32(reg);
+ }
+ 
+-static unsigned int realtek_gpio_port_offset_u16_rev(unsigned int port)
++static void realtek_gpio_bank_write(void __iomem *reg, u32 value)
+ {
+-	return 2 * (port ^ 1);
++	iowrite32(value, reg);
+ }
+ 
+-static void realtek_gpio_write_imr(struct realtek_gpio_ctrl *ctrl,
+-	unsigned int port, u16 irq_type, u16 irq_mask)
++static unsigned int realtek_gpio_line_imr_pos(unsigned int line)
+ {
+-	iowrite16(irq_type & irq_mask,
+-		ctrl->base + REALTEK_GPIO_REG_IMR + ctrl->port_offset_u16(port));
++	return 2 * line;
+ }
+ 
+-static void realtek_gpio_clear_isr(struct realtek_gpio_ctrl *ctrl,
+-	unsigned int port, u8 mask)
++static void realtek_gpio_clear_isr(struct realtek_gpio_ctrl *ctrl, u32 mask)
+ {
+-	iowrite8(mask, ctrl->base + REALTEK_GPIO_REG_ISR + ctrl->port_offset_u8(port));
++	ctrl->bank_write(ctrl->base + REALTEK_GPIO_REG_ISR, mask);
+ }
+ 
+-static u8 realtek_gpio_read_isr(struct realtek_gpio_ctrl *ctrl, unsigned int port)
++static u32 realtek_gpio_read_isr(struct realtek_gpio_ctrl *ctrl)
+ {
+-	return ioread8(ctrl->base + REALTEK_GPIO_REG_ISR + ctrl->port_offset_u8(port));
++	return ctrl->bank_read(ctrl->base + REALTEK_GPIO_REG_ISR);
+ }
+ 
+-/* Set the rising and falling edge mask bits for a GPIO port pin */
+-static u16 realtek_gpio_imr_bits(unsigned int pin, u16 value)
++/* Set the rising and falling edge mask bits for a GPIO pin */
++static void realtek_gpio_update_line_imr(struct realtek_gpio_ctrl *ctrl, unsigned int line)
+ {
+-	return (value & REALTEK_GPIO_IMR_LINE_MASK) << 2 * pin;
++	void __iomem *reg = ctrl->base + REALTEK_GPIO_REG_IMR;
++	unsigned int line_shift = ctrl->line_imr_pos(line);
++	unsigned int shift = line_shift % 32;
++	u32 irq_type = ctrl->intr_type[line];
++	u32 irq_mask = ctrl->intr_mask[line];
++	u32 reg_val;
++
++	reg += 4 * (line_shift / 32);
++	reg_val = ioread32(reg);
++	reg_val &= ~(REALTEK_GPIO_IMR_LINE_MASK << shift);
++	reg_val |= (irq_type & irq_mask & REALTEK_GPIO_IMR_LINE_MASK) << shift;
++	iowrite32(reg_val, reg);
+ }
+ 
+ static void realtek_gpio_irq_ack(struct irq_data *data)
+ {
+ 	struct realtek_gpio_ctrl *ctrl = irq_data_to_ctrl(data);
+ 	irq_hw_number_t line = irqd_to_hwirq(data);
+-	unsigned int port = line / 8;
+-	unsigned int port_pin = line % 8;
+ 
+-	realtek_gpio_clear_isr(ctrl, port, BIT(port_pin));
++	realtek_gpio_clear_isr(ctrl, BIT(line));
+ }
+ 
+ static void realtek_gpio_irq_unmask(struct irq_data *data)
+ {
+ 	struct realtek_gpio_ctrl *ctrl = irq_data_to_ctrl(data);
+ 	unsigned int line = irqd_to_hwirq(data);
+-	unsigned int port = line / 8;
+-	unsigned int port_pin = line % 8;
+ 	unsigned long flags;
+-	u16 m;
+ 
+ 	raw_spin_lock_irqsave(&ctrl->lock, flags);
+-	m = ctrl->intr_mask[port];
+-	m |= realtek_gpio_imr_bits(port_pin, REALTEK_GPIO_IMR_LINE_MASK);
+-	ctrl->intr_mask[port] = m;
+-	realtek_gpio_write_imr(ctrl, port, ctrl->intr_type[port], m);
++	ctrl->intr_mask[line] = REALTEK_GPIO_IMR_LINE_MASK;
++	realtek_gpio_update_line_imr(ctrl, line);
+ 	raw_spin_unlock_irqrestore(&ctrl->lock, flags);
+ }
+ 
+@@ -184,16 +204,11 @@ static void realtek_gpio_irq_mask(struct
+ {
+ 	struct realtek_gpio_ctrl *ctrl = irq_data_to_ctrl(data);
+ 	unsigned int line = irqd_to_hwirq(data);
+-	unsigned int port = line / 8;
+-	unsigned int port_pin = line % 8;
+ 	unsigned long flags;
+-	u16 m;
+ 
+ 	raw_spin_lock_irqsave(&ctrl->lock, flags);
+-	m = ctrl->intr_mask[port];
+-	m &= ~realtek_gpio_imr_bits(port_pin, REALTEK_GPIO_IMR_LINE_MASK);
+-	ctrl->intr_mask[port] = m;
+-	realtek_gpio_write_imr(ctrl, port, ctrl->intr_type[port], m);
++	ctrl->intr_mask[line] = 0;
++	realtek_gpio_update_line_imr(ctrl, line);
+ 	raw_spin_unlock_irqrestore(&ctrl->lock, flags);
+ }
+ 
+@@ -201,10 +216,8 @@ static int realtek_gpio_irq_set_type(str
+ {
+ 	struct realtek_gpio_ctrl *ctrl = irq_data_to_ctrl(data);
+ 	unsigned int line = irqd_to_hwirq(data);
+-	unsigned int port = line / 8;
+-	unsigned int port_pin = line % 8;
+ 	unsigned long flags;
+-	u16 type, t;
++	u8 type;
+ 
+ 	switch (flow_type & IRQ_TYPE_SENSE_MASK) {
+ 	case IRQ_TYPE_EDGE_FALLING:
+@@ -223,11 +236,8 @@ static int realtek_gpio_irq_set_type(str
+ 	irq_set_handler_locked(data, handle_edge_irq);
+ 
+ 	raw_spin_lock_irqsave(&ctrl->lock, flags);
+-	t = ctrl->intr_type[port];
+-	t &= ~realtek_gpio_imr_bits(port_pin, REALTEK_GPIO_IMR_LINE_MASK);
+-	t |= realtek_gpio_imr_bits(port_pin, type);
+-	ctrl->intr_type[port] = t;
+-	realtek_gpio_write_imr(ctrl, port, t, ctrl->intr_mask[port]);
++	ctrl->intr_type[line] = type;
++	realtek_gpio_update_line_imr(ctrl, line);
+ 	raw_spin_unlock_irqrestore(&ctrl->lock, flags);
+ 
+ 	return 0;
+@@ -238,28 +248,21 @@ static void realtek_gpio_irq_handler(str
+ 	struct gpio_chip *gc = irq_desc_get_handler_data(desc);
+ 	struct realtek_gpio_ctrl *ctrl = gpiochip_get_data(gc);
+ 	struct irq_chip *irq_chip = irq_desc_get_chip(desc);
+-	unsigned int lines_done;
+-	unsigned int port_pin_count;
+ 	unsigned long status;
+ 	int offset;
+ 
+ 	chained_irq_enter(irq_chip, desc);
+ 
+-	for (lines_done = 0; lines_done < gc->ngpio; lines_done += 8) {
+-		status = realtek_gpio_read_isr(ctrl, lines_done / 8);
+-		port_pin_count = min(gc->ngpio - lines_done, 8U);
+-		for_each_set_bit(offset, &status, port_pin_count)
+-			generic_handle_domain_irq(gc->irq.domain, offset + lines_done);
+-	}
++	status = realtek_gpio_read_isr(ctrl);
++	for_each_set_bit(offset, &status, gc->ngpio)
++		generic_handle_domain_irq(gc->irq.domain, offset);
+ 
+ 	chained_irq_exit(irq_chip, desc);
+ }
+ 
+-static inline void __iomem *realtek_gpio_irq_cpu_mask(struct realtek_gpio_ctrl *ctrl,
+-	unsigned int port, int cpu)
++static inline void __iomem *realtek_gpio_irq_cpu_mask(struct realtek_gpio_ctrl *ctrl, int cpu)
+ {
+-	return ctrl->cpumask_base + ctrl->port_offset_u8(port) +
+-		REALTEK_GPIO_PORTS_PER_BANK * cpu;
++	return ctrl->cpumask_base + REALTEK_GPIO_PORTS_PER_BANK * cpu;
+ }
+ 
+ static int realtek_gpio_irq_set_affinity(struct irq_data *data,
+@@ -267,12 +270,10 @@ static int realtek_gpio_irq_set_affinity
+ {
+ 	struct realtek_gpio_ctrl *ctrl = irq_data_to_ctrl(data);
+ 	unsigned int line = irqd_to_hwirq(data);
+-	unsigned int port = line / 8;
+-	unsigned int port_pin = line % 8;
+ 	void __iomem *irq_cpu_mask;
+ 	unsigned long flags;
+ 	int cpu;
+-	u8 v;
++	u32 v;
+ 
+ 	if (!ctrl->cpumask_base)
+ 		return -ENXIO;
+@@ -280,15 +281,15 @@ static int realtek_gpio_irq_set_affinity
+ 	raw_spin_lock_irqsave(&ctrl->lock, flags);
+ 
+ 	for_each_cpu(cpu, &ctrl->cpu_irq_maskable) {
+-		irq_cpu_mask = realtek_gpio_irq_cpu_mask(ctrl, port, cpu);
+-		v = ioread8(irq_cpu_mask);
++		irq_cpu_mask = realtek_gpio_irq_cpu_mask(ctrl, cpu);
++		v = ctrl->bank_read(irq_cpu_mask);
+ 
+ 		if (cpumask_test_cpu(cpu, dest))
+-			v |= BIT(port_pin);
++			v |= BIT(line);
+ 		else
+-			v &= ~BIT(port_pin);
++			v &= ~BIT(line);
+ 
+-		iowrite8(v, irq_cpu_mask);
++		ctrl->bank_write(irq_cpu_mask, v);
+ 	}
+ 
+ 	raw_spin_unlock_irqrestore(&ctrl->lock, flags);
+@@ -302,22 +303,23 @@ static int realtek_gpio_irq_init(struct
+ {
+ 	struct realtek_gpio_ctrl *ctrl = gpiochip_get_data(gc);
+ 	void __iomem *irq_cpu_mask;
+-	unsigned int port;
++	u32 mask_all = GENMASK(gc->ngpio - 1, 0);
++	unsigned int line;
+ 	int cpu;
+ 
+-	for (port = 0; (port * 8) < gc->ngpio; port++) {
+-		realtek_gpio_write_imr(ctrl, port, 0, 0);
+-		realtek_gpio_clear_isr(ctrl, port, GENMASK(7, 0));
+-
+-		/*
+-		 * Uniprocessor builds assume a mask always contains one CPU,
+-		 * so only start the loop if we have at least one maskable CPU.
+-		 */
+-		if(!cpumask_empty(&ctrl->cpu_irq_maskable)) {
+-			for_each_cpu(cpu, &ctrl->cpu_irq_maskable) {
+-				irq_cpu_mask = realtek_gpio_irq_cpu_mask(ctrl, port, cpu);
+-				iowrite8(GENMASK(7, 0), irq_cpu_mask);
+-			}
++	for (line = 0; line < gc->ngpio; line++)
++		realtek_gpio_update_line_imr(ctrl, line);
++
++	realtek_gpio_clear_isr(ctrl, mask_all);
++
++	/*
++	 * Uniprocessor builds assume a mask always contains one CPU,
++	 * so only start the loop if we have at least one maskable CPU.
++	 */
++	if(!cpumask_empty(&ctrl->cpu_irq_maskable)) {
++		for_each_cpu(cpu, &ctrl->cpu_irq_maskable) {
++			irq_cpu_mask = realtek_gpio_irq_cpu_mask(ctrl, cpu);
++			ctrl->bank_write(irq_cpu_mask, mask_all);
+ 		}
+ 	}
+ 
+@@ -390,12 +392,14 @@ static int realtek_gpio_probe(struct pla
+ 
+ 	if (dev_flags & GPIO_PORTS_REVERSED) {
+ 		bgpio_flags = 0;
+-		ctrl->port_offset_u8 = realtek_gpio_port_offset_u8_rev;
+-		ctrl->port_offset_u16 = realtek_gpio_port_offset_u16_rev;
++		ctrl->bank_read = realtek_gpio_bank_read;
++		ctrl->bank_write = realtek_gpio_bank_write;
++		ctrl->line_imr_pos = realtek_gpio_line_imr_pos;
+ 	} else {
+ 		bgpio_flags = BGPIOF_BIG_ENDIAN_BYTE_ORDER;
+-		ctrl->port_offset_u8 = realtek_gpio_port_offset_u8;
+-		ctrl->port_offset_u16 = realtek_gpio_port_offset_u16;
++		ctrl->bank_read = realtek_gpio_bank_read_swapped;
++		ctrl->bank_write = realtek_gpio_bank_write_swapped;
++		ctrl->line_imr_pos = realtek_gpio_line_imr_pos_swapped;
+ 	}
+ 
+ 	err = bgpio_init(&ctrl->gc, dev, 4,
diff --git a/target/linux/realtek/patches-5.15/318-add-rtl83xx-clk-support.patch b/target/linux/realtek/patches-5.15/318-add-rtl83xx-clk-support.patch
new file mode 100644
index 00000000000000..c63c165cd28449
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/318-add-rtl83xx-clk-support.patch
@@ -0,0 +1,33 @@
+From 800d5fb3c6a16661932c932bacd660e38d06b727 Mon Sep 17 00:00:00 2001
+From: Markus Stockhausen <markus.stockhausen@gmx.de>
+Date: Thu, 25 Aug 2022 08:22:36 +0200
+Subject: [PATCH] realtek: add patch to enable new clock driver in kernel
+
+Allow building the clock driver with kernel config options.
+
+Submitted-by: Markus Stockhausen <markus.stockhausen@gmx.de>
+---
+ drivers/clk/Kconfig                           | 1 +
+ drivers/clk/Makefile                          | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/clk/Kconfig
++++ b/drivers/clk/Kconfig
+@@ -405,6 +405,7 @@ source "drivers/clk/mstar/Kconfig"
+ source "drivers/clk/mvebu/Kconfig"
+ source "drivers/clk/pistachio/Kconfig"
+ source "drivers/clk/qcom/Kconfig"
++source "drivers/clk/realtek/Kconfig"
+ source "drivers/clk/ralink/Kconfig"
+ source "drivers/clk/renesas/Kconfig"
+ source "drivers/clk/rockchip/Kconfig"
+--- a/drivers/clk/Makefile
++++ b/drivers/clk/Makefile
+@@ -101,6 +101,7 @@ obj-$(CONFIG_COMMON_CLK_PISTACHIO)	+= pi
+ obj-$(CONFIG_COMMON_CLK_PXA)		+= pxa/
+ obj-$(CONFIG_COMMON_CLK_QCOM)		+= qcom/
+ obj-y					+= ralink/
++obj-$(CONFIG_COMMON_CLK_REALTEK)	+= realtek/
+ obj-y					+= renesas/
+ obj-$(CONFIG_ARCH_ROCKCHIP)		+= rockchip/
+ obj-$(CONFIG_COMMON_CLK_SAMSUNG)	+= samsung/
diff --git a/target/linux/realtek/patches-5.15/319-irqchip-irq-realtek-rtl-fix-VPE-affinity.patch b/target/linux/realtek/patches-5.15/319-irqchip-irq-realtek-rtl-fix-VPE-affinity.patch
new file mode 100644
index 00000000000000..0c29b7739e188b
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/319-irqchip-irq-realtek-rtl-fix-VPE-affinity.patch
@@ -0,0 +1,159 @@
+From 2cd00b51470a30198b048a5fca48a04db77e29cc Mon Sep 17 00:00:00 2001
+From: INAGAKI Hiroshi <musashino.open@gmail.com>
+Date: Fri, 21 May 2021 23:16:37 +0900
+Subject: [PATCH] realtek: backport irq-realtek-rtl driver from 5.12 to 5.10
+
+This patch backports "irq-realtek-rtl" driver to Kernel 5.10 from 5.12.
+"MACH_REALTEK_RTL" is used as a platform name in upstream, but "RTL838X"
+is used in OpenWrt, so update the dependency by the additional patch.
+
+Submitted-by: INAGAKI Hiroshi <musashino.open@gmail.com>
+---
+ drivers/irqchip/irq-realtek-rtl.c             | 38 +++++++++++------
+ 1 files changed, 58 insertions(+), 20 deletions(-)
+
+--- a/drivers/irqchip/irq-realtek-rtl.c
++++ b/drivers/irqchip/irq-realtek-rtl.c
+@@ -28,6 +28,7 @@ static DEFINE_RAW_SPINLOCK(irq_lock);
+ 
+ #define REG(offset, cpu)	(realtek_ictl_base[cpu] + offset)
+ 
++static u32 realtek_ictl_unmask[NR_CPUS];
+ static void __iomem *realtek_ictl_base[NR_CPUS];
+ static cpumask_t realtek_ictl_cpu_configurable;
+ 
+@@ -41,11 +42,29 @@ struct realtek_ictl_output {
+ };
+ 
+ /*
+- * IRR0-IRR3 store 4 bits per interrupt, but Realtek uses inverted numbering,
+- * placing IRQ 31 in the first four bits. A routing value of '0' means the
+- * interrupt is left disconnected. Routing values {1..15} connect to output
+- * lines {0..14}.
++ * Per CPU we have a set of 5 registers that determine interrupt handling for
++ * 32 external interrupts. GIMR (enable/disable interrupt) plus IRR0-IRR3 that
++ * contain "routing" or "priority" values. GIMR uses one bit for each interrupt
++ * and IRRx store 4 bits per interrupt. Realtek uses inverted numbering,
++ * placing IRQ 31 in the first four bits. The register combinations give the
++ * following results for a single interrupt in the wild:
++ *
++ * a) GIMR = 0 / IRRx > 0 -> no interrupts
++ * b) GIMR = 0 / IRRx = 0 -> no interrupts
++ * c) GIMR = 1 / IRRx > 0 -> interrupts
++ * d) GIMR = 1 / IRRx = 0 -> rare interrupts in SMP environment
++ *
++ * Combination d) seems to trigger interrupts only on a VPE if the other VPE
++ * has GIMR = 0 and IRRx > 0. E.g. busy without interrupts allowed. To provide
++ * IRQ balancing features in SMP this driver will handle the registers as
++ * follows:
++ *
++ * 1) set IRRx > 0 for VPE where the interrupt is desired
++ * 2) set IRRx = 0 for VPE where the interrupt is not desired
++ * 3) set both GIMR = 0 to mask (disabled) interrupt
++ * 4) set GIMR = 1 to unmask (enable) interrupt but only for VPE where IRRx > 0
+  */
++
+ #define IRR_OFFSET(idx)		(4 * (3 - (idx * 4) / 32))
+ #define IRR_SHIFT(idx)		((idx * 4) % 32)
+ 
+@@ -65,19 +84,33 @@ static inline void write_irr(void __iome
+ 	writel(irr, irr0 + offset);
+ }
+ 
++static inline void enable_gimr(int hwirq, int cpu)
++{
++	u32 value;
++
++	value = readl(REG(RTL_ICTL_GIMR, cpu));
++	value |= (BIT(hwirq) & realtek_ictl_unmask[cpu]);
++	writel(value, REG(RTL_ICTL_GIMR, cpu));
++}
++
++static inline void disable_gimr(int hwirq, int cpu)
++{
++	u32 value;
++
++	value = readl(REG(RTL_ICTL_GIMR, cpu));
++	value &= ~BIT(hwirq);
++	writel(value, REG(RTL_ICTL_GIMR, cpu));
++}
++
+ static void realtek_ictl_unmask_irq(struct irq_data *i)
+ {
+ 	unsigned long flags;
+-	u32 value;
+ 	int cpu;
+ 
+ 	raw_spin_lock_irqsave(&irq_lock, flags);
+ 
+-	for_each_cpu(cpu, &realtek_ictl_cpu_configurable) {
+-		value = readl(REG(RTL_ICTL_GIMR, cpu));
+-		value |= BIT(i->hwirq);
+-		writel(value, REG(RTL_ICTL_GIMR, cpu));
+-	}
++	for_each_cpu(cpu, &realtek_ictl_cpu_configurable)
++		enable_gimr(i->hwirq, cpu);
+ 
+ 	raw_spin_unlock_irqrestore(&irq_lock, flags);
+ }
+@@ -85,16 +118,12 @@ static void realtek_ictl_unmask_irq(stru
+ static void realtek_ictl_mask_irq(struct irq_data *i)
+ {
+ 	unsigned long flags;
+-	u32 value;
+ 	int cpu;
+ 
+ 	raw_spin_lock_irqsave(&irq_lock, flags);
+ 
+-	for_each_cpu(cpu, &realtek_ictl_cpu_configurable) {
+-		value = readl(REG(RTL_ICTL_GIMR, cpu));
+-		value &= ~BIT(i->hwirq);
+-		writel(value, REG(RTL_ICTL_GIMR, cpu));
+-	}
++	for_each_cpu(cpu, &realtek_ictl_cpu_configurable)
++		disable_gimr(i->hwirq, cpu);
+ 
+ 	raw_spin_unlock_irqrestore(&irq_lock, flags);
+ }
+@@ -116,11 +145,17 @@ static int __maybe_unused realtek_ictl_i
+ 	cpumask_and(&cpu_enable, &cpu_configure, dest);
+ 	cpumask_andnot(&cpu_disable, &cpu_configure, dest);
+ 
+-	for_each_cpu(cpu, &cpu_disable)
++	for_each_cpu(cpu, &cpu_disable) {
+ 		write_irr(REG(RTL_ICTL_IRR0, cpu), i->hwirq, 0);
++		realtek_ictl_unmask[cpu] &= ~BIT(i->hwirq);
++		disable_gimr(i->hwirq, cpu);
++	}
+ 
+-	for_each_cpu(cpu, &cpu_enable)
++	for_each_cpu(cpu, &cpu_enable) {
+ 		write_irr(REG(RTL_ICTL_IRR0, cpu), i->hwirq, output->output_index + 1);
++		realtek_ictl_unmask[cpu] |= BIT(i->hwirq);
++		enable_gimr(i->hwirq, cpu);
++	}
+ 
+ 	irq_data_update_effective_affinity(i, &cpu_enable);
+ 
+@@ -149,6 +184,7 @@ static int intc_map(struct irq_domain *d
+ 
+ 	output->child_mask |= BIT(hw);
+ 	write_irr(REG(RTL_ICTL_IRR0, 0), hw, output->output_index + 1);
++	realtek_ictl_unmask[0] |= BIT(hw);
+ 
+ 	raw_spin_unlock_irqrestore(&irq_lock, flags);
+ 
+@@ -285,9 +321,11 @@ static int __init realtek_rtl_of_init(st
+ 			cpumask_set_cpu(cpu, &realtek_ictl_cpu_configurable);
+ 
+ 			/* Disable all cascaded interrupts and clear routing */
+-			writel(0, REG(RTL_ICTL_GIMR, cpu));
+-			for (soc_irq = 0; soc_irq < RTL_ICTL_NUM_INPUTS; soc_irq++)
++			for (soc_irq = 0; soc_irq < RTL_ICTL_NUM_INPUTS; soc_irq++) {
+ 				write_irr(REG(RTL_ICTL_IRR0, cpu), soc_irq, 0);
++				realtek_ictl_unmask[cpu] &= ~BIT(soc_irq);
++				disable_gimr(soc_irq, cpu);
++			}
+ 		}
+ 	}
+ 
diff --git a/target/linux/realtek/patches-5.15/700-net-dsa-add-support-for-rtl838x-switch.patch b/target/linux/realtek/patches-5.15/700-net-dsa-add-support-for-rtl838x-switch.patch
new file mode 100644
index 00000000000000..8c6a4c36393f5f
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/700-net-dsa-add-support-for-rtl838x-switch.patch
@@ -0,0 +1,42 @@
+From 2b88563ee5aafd9571d965b7f2093a0f58d98a31 Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Thu, 26 Nov 2020 12:02:21 +0100
+Subject: net: dsa: Add support for rtl838x switch
+
+* rename the target to realtek
+* add refactored DSA driver
+* add latest gpio driver
+* lots of arch cleanups
+* new irq driver
+* additional boards
+
+Submitted-by: Bert Vermeulen <bert@biot.com>
+Submitted-by: Birger Koblitz <mail@birger-koblitz.de>
+Submitted-by: Sander Vanheule <sander@svanheule.net>
+Submitted-by: Bjørn Mork <bjorn@mork.no>
+Submitted-by: John Crispin <john@phrozen.org>
+---
+ drivers/net/dsa/rtl83xx/Kconfig               | 2 ++
+ drivers/net/dsa/rtl83xx/Makefile              | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/net/dsa/Kconfig
++++ b/drivers/net/dsa/Kconfig
+@@ -85,6 +85,8 @@ source "drivers/net/dsa/sja1105/Kconfig"
+ 
+ source "drivers/net/dsa/xrs700x/Kconfig"
+ 
++source "drivers/net/dsa/rtl83xx/Kconfig"
++
+ config NET_DSA_REALTEK_SMI
+ 	tristate "Realtek SMI Ethernet switch family support"
+ 	select NET_DSA_TAG_RTL4_A
+--- a/drivers/net/dsa/Makefile
++++ b/drivers/net/dsa/Makefile
+@@ -24,5 +24,6 @@ obj-y				+= microchip/
+ obj-y				+= mv88e6xxx/
+ obj-y				+= ocelot/
+ obj-y				+= qca/
++obj-y				+= rtl83xx/
+ obj-y				+= sja1105/
+ obj-y				+= xrs700x/
diff --git a/target/linux/realtek/patches-5.15/701-net-dsa-add-rtl838x-support-for-tag-trailer.patch b/target/linux/realtek/patches-5.15/701-net-dsa-add-rtl838x-support-for-tag-trailer.patch
new file mode 100644
index 00000000000000..0cb784fcbfa43d
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/701-net-dsa-add-rtl838x-support-for-tag-trailer.patch
@@ -0,0 +1,61 @@
+From 2b88563ee5aafd9571d965b7f2093a0f58d98a31 Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Thu, 26 Nov 2020 12:02:21 +0100
+Subject: net: dsa: Add rtl838x support for tag trailer
+
+* rename the target to realtek
+* add refactored DSA driver
+* add latest gpio driver
+* lots of arch cleanups
+* new irq driver
+* additional boards
+
+Submitted-by: Bert Vermeulen <bert@biot.com>
+Submitted-by: Birger Koblitz <mail@birger-koblitz.de>
+Submitted-by: Sander Vanheule <sander@svanheule.net>
+Submitted-by: Bjørn Mork <bjorn@mork.no>
+Submitted-by: John Crispin <john@phrozen.org>
+---
+ net/dsa/tag_trailer.c                         | 16 +++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+--- a/net/dsa/tag_trailer.c
++++ b/net/dsa/tag_trailer.c
+@@ -17,7 +17,12 @@ static struct sk_buff *trailer_xmit(stru
+ 
+ 	trailer = skb_put(skb, 4);
+ 	trailer[0] = 0x80;
++
++#ifdef CONFIG_NET_DSA_RTL83XX
++	trailer[1] = dp->index;
++#else
+ 	trailer[1] = 1 << dp->index;
++#endif /* CONFIG_NET_DSA_RTL838X */
+ 	trailer[2] = 0x10;
+ 	trailer[3] = 0x00;
+ 
+@@ -33,12 +38,23 @@ static struct sk_buff *trailer_rcv(struc
+ 		return NULL;
+ 
+ 	trailer = skb_tail_pointer(skb) - 4;
++
++#ifdef CONFIG_NET_DSA_RTL83XX
++	if (trailer[0] != 0x80 || (trailer[1] & 0x80) != 0x00 ||
++	    (trailer[2] & 0xef) != 0x00 || trailer[3] != 0x00)
++		return NULL;
++
++	if (trailer[1] & 0x40)
++		skb->offload_fwd_mark = 1;
++
++	source_port = trailer[1] & 0x3f;
++#else
+ 	if (trailer[0] != 0x80 || (trailer[1] & 0xf8) != 0x00 ||
+ 	    (trailer[2] & 0xef) != 0x00 || trailer[3] != 0x00)
+ 		return NULL;
+ 
+ 	source_port = trailer[1] & 7;
+-
++#endif
+ 	skb->dev = dsa_master_find_slave(dev, 0, source_port);
+ 	if (!skb->dev)
+ 		return NULL;
diff --git a/target/linux/realtek/patches-5.15/702-net-dsa-increase-dsa-max-ports-for-rtl838x.patch b/target/linux/realtek/patches-5.15/702-net-dsa-increase-dsa-max-ports-for-rtl838x.patch
new file mode 100644
index 00000000000000..63991d373cd3d5
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/702-net-dsa-increase-dsa-max-ports-for-rtl838x.patch
@@ -0,0 +1,32 @@
+From 2b88563ee5aafd9571d965b7f2093a0f58d98a31 Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Thu, 26 Nov 2020 12:02:21 +0100
+Subject: net: dsa: Increase max ports for rtl838x
+
+* rename the target to realtek
+* add refactored DSA driver
+* add latest gpio driver
+* lots of arch cleanups
+* new irq driver
+* additional boards
+
+Submitted-by: Bert Vermeulen <bert@biot.com>
+Submitted-by: Birger Koblitz <mail@birger-koblitz.de>
+Submitted-by: Sander Vanheule <sander@svanheule.net>
+Submitted-by: Bjørn Mork <bjorn@mork.no>
+Submitted-by: John Crispin <john@phrozen.org>
+---
+ include/linux/platform_data/dsa.h             | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/platform_data/dsa.h
++++ b/include/linux/platform_data/dsa.h
+@@ -6,7 +6,7 @@ struct device;
+ struct net_device;
+ 
+ #define DSA_MAX_SWITCHES	4
+-#define DSA_MAX_PORTS		12
++#define DSA_MAX_PORTS		54
+ #define DSA_RTABLE_NONE		-1
+ 
+ struct dsa_chip_data {
diff --git a/target/linux/realtek/patches-5.15/702-net-ethernet-add-support-for-rtl838x-ethernet.patch b/target/linux/realtek/patches-5.15/702-net-ethernet-add-support-for-rtl838x-ethernet.patch
new file mode 100644
index 00000000000000..1c25c42b911099
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/702-net-ethernet-add-support-for-rtl838x-ethernet.patch
@@ -0,0 +1,48 @@
+From 2b88563ee5aafd9571d965b7f2093a0f58d98a31 Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Thu, 26 Nov 2020 12:02:21 +0100
+Subject: net: ethernet: Add support for RTL838x ethernet
+
+* rename the target to realtek
+* add refactored DSA driver
+* add latest gpio driver
+* lots of arch cleanups
+* new irq driver
+* additional boards
+
+Submitted-by: Bert Vermeulen <bert@biot.com>
+Submitted-by: Birger Koblitz <mail@birger-koblitz.de>
+Submitted-by: Sander Vanheule <sander@svanheule.net>
+Submitted-by: Bjørn Mork <bjorn@mork.no>
+Submitted-by: John Crispin <john@phrozen.org>
+---
+ drivers/net/ethernet/Kconfig                  | 7 +-
+ drivers/net/ethernet/Makefile                 | 1 +
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/net/ethernet/Kconfig
++++ b/drivers/net/ethernet/Kconfig
+@@ -166,6 +166,13 @@ source "drivers/net/ethernet/rdc/Kconfig
+ source "drivers/net/ethernet/realtek/Kconfig"
+ source "drivers/net/ethernet/renesas/Kconfig"
+ source "drivers/net/ethernet/rocker/Kconfig"
++
++config NET_RTL838X
++	tristate "Realtek rtl838x Ethernet MAC support"
++	depends on RTL83XX
++	help
++	  Say Y here if you want to use the Realtek rtl838x Gbps Ethernet MAC.
++
+ source "drivers/net/ethernet/samsung/Kconfig"
+ source "drivers/net/ethernet/seeq/Kconfig"
+ source "drivers/net/ethernet/sgi/Kconfig"
+--- a/drivers/net/ethernet/Makefile
++++ b/drivers/net/ethernet/Makefile
+@@ -77,6 +77,7 @@ obj-$(CONFIG_NET_VENDOR_REALTEK) += real
+ obj-$(CONFIG_NET_VENDOR_RENESAS) += renesas/
+ obj-$(CONFIG_NET_VENDOR_RDC) += rdc/
+ obj-$(CONFIG_NET_VENDOR_ROCKER) += rocker/
++obj-$(CONFIG_NET_RTL838X) += rtl838x_eth.o
+ obj-$(CONFIG_NET_VENDOR_SAMSUNG) += samsung/
+ obj-$(CONFIG_NET_VENDOR_SEEQ) += seeq/
+ obj-$(CONFIG_NET_VENDOR_SILAN) += silan/
diff --git a/target/linux/realtek/patches-5.15/703-include-linux-add-phy-ops-for-rtl838x.patch b/target/linux/realtek/patches-5.15/703-include-linux-add-phy-ops-for-rtl838x.patch
new file mode 100644
index 00000000000000..04a110a2339486
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/703-include-linux-add-phy-ops-for-rtl838x.patch
@@ -0,0 +1,34 @@
+From 2b88563ee5aafd9571d965b7f2093a0f58d98a31 Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Thu, 26 Nov 2020 12:02:21 +0100
+Subject: phy: Add PHY ops for rtl838x EEE
+
+* rename the target to realtek
+* add refactored DSA driver
+* add latest gpio driver
+* lots of arch cleanups
+* new irq driver
+* additional boards
+
+Submitted-by: Bert Vermeulen <bert@biot.com>
+Submitted-by: Birger Koblitz <mail@birger-koblitz.de>
+Submitted-by: Sander Vanheule <sander@svanheule.net>
+Submitted-by: Bjørn Mork <bjorn@mork.no>
+Submitted-by: John Crispin <john@phrozen.org>
+---
+ include/linux/phy.h                           | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -984,6 +984,10 @@ struct phy_driver {
+ 	int (*led_blink_set)(struct phy_device *dev, u8 index,
+ 			     unsigned long *delay_on,
+ 			     unsigned long *delay_off);
++	int (*get_port)(struct phy_device *dev);
++	int (*set_port)(struct phy_device *dev, int port);
++	int (*get_eee)(struct phy_device *dev, struct ethtool_eee *e);
++	int (*set_eee)(struct phy_device *dev, struct ethtool_eee *e);
+ };
+ #define to_phy_driver(d) container_of(to_mdio_common_driver(d),		\
+ 				      struct phy_driver, mdiodrv)
diff --git a/target/linux/realtek/patches-5.15/704-drivers-net-phy-eee-support-for-rtl838x.patch b/target/linux/realtek/patches-5.15/704-drivers-net-phy-eee-support-for-rtl838x.patch
new file mode 100644
index 00000000000000..591f0cea13a3f1
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/704-drivers-net-phy-eee-support-for-rtl838x.patch
@@ -0,0 +1,61 @@
+From 2b88563ee5aafd9571d965b7f2093a0f58d98a31 Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Thu, 26 Nov 2020 12:02:21 +0100
+Subject: net: phy: EEE support for rtl838x
+
+* rename the target to realtek
+* add refactored DSA driver
+* add latest gpio driver
+* lots of arch cleanups
+* new irq driver
+* additional boards
+
+Submitted-by: Bert Vermeulen <bert@biot.com>
+Submitted-by: Birger Koblitz <mail@birger-koblitz.de>
+Submitted-by: Sander Vanheule <sander@svanheule.net>
+Submitted-by: Bjørn Mork <bjorn@mork.no>
+Submitted-by: John Crispin <john@phrozen.org>
+---
+ drivers/net/phy/phylink.                      | 14 +++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -1942,6 +1942,11 @@ int phylink_ethtool_ksettings_set(struct
+ 		 *   the presence of a PHY, this should not be changed as that
+ 		 *   should be determined from the media side advertisement.
+ 		 */
++		if (pl->phydev->drv->get_port && pl->phydev->drv->set_port) {
++			if(pl->phydev->drv->get_port(pl->phydev) != kset->base.port) {
++				pl->phydev->drv->set_port(pl->phydev, kset->base.port);
++			}
++		}
+ 		return phy_ethtool_ksettings_set(pl->phydev, kset);
+ 	}
+ 
+@@ -2245,8 +2250,11 @@ int phylink_ethtool_get_eee(struct phyli
+ 
+ 	ASSERT_RTNL();
+ 
+-	if (pl->phydev)
++	if (pl->phydev) {
++		if (pl->phydev->drv->get_eee)
++			return pl->phydev->drv->get_eee(pl->phydev, eee);
+ 		ret = phy_ethtool_get_eee(pl->phydev, eee);
++	}
+ 
+ 	return ret;
+ }
+@@ -2263,8 +2271,11 @@ int phylink_ethtool_set_eee(struct phyli
+ 
+ 	ASSERT_RTNL();
+ 
+-	if (pl->phydev)
++	if (pl->phydev) {
++		if (pl->phydev->drv->set_eee)
++			return pl->phydev->drv->set_eee(pl->phydev, eee);
+ 		ret = phy_ethtool_set_eee(pl->phydev, eee);
++	}
+ 
+ 	return ret;
+ }
diff --git a/target/linux/realtek/patches-5.15/704-include-linux-add-phy-hsgmii-mode.patch b/target/linux/realtek/patches-5.15/704-include-linux-add-phy-hsgmii-mode.patch
new file mode 100644
index 00000000000000..f9411e47d32477
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/704-include-linux-add-phy-hsgmii-mode.patch
@@ -0,0 +1,52 @@
+From 9d9bf16aa8d966834ac1280f96c37d22552c33d1 Mon Sep 17 00:00:00 2001
+From: Birger Koblitz <git@birger-koblitz.de>
+Date: Wed, 8 Sep 2021 16:13:18 +0200
+Subject: phy: Add PHY hsgmii mode
+
+This adds RTL93xx-specific MAC configuration routines that allow also configuration
+of 10GBit links for phylink. There is support for the Realtek-specific HISGMI
+protocol.
+
+Submitted-by: Birger Koblitz <git@birger-koblitz.de>
+---
+ drivers/net/phy/phylink.c                     | 2 ++
+ include/linux/phy.h                           | 3 +++
+ 2 file changed, 5 insertions(+)
+
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -403,6 +403,7 @@ void phylink_get_linkmodes(unsigned long
+ 
+ 	case PHY_INTERFACE_MODE_XGMII:
+ 	case PHY_INTERFACE_MODE_RXAUI:
++	case PHY_INTERFACE_MODE_HSGMII:
+ 	case PHY_INTERFACE_MODE_XAUI:
+ 	case PHY_INTERFACE_MODE_10GBASER:
+ 	case PHY_INTERFACE_MODE_10GKR:
+@@ -657,6 +658,7 @@ static int phylink_parse_mode(struct phy
+ 			fallthrough;
+ 		case PHY_INTERFACE_MODE_USXGMII:
+ 		case PHY_INTERFACE_MODE_10GKR:
++		case PHY_INTERFACE_MODE_HSGMII:
+ 		case PHY_INTERFACE_MODE_10GBASER:
+ 			phylink_set(pl->supported, 10baseT_Half);
+ 			phylink_set(pl->supported, 10baseT_Full);
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -139,6 +139,7 @@ typedef enum {
+ 	PHY_INTERFACE_MODE_XGMII,
+ 	PHY_INTERFACE_MODE_XLGMII,
+ 	PHY_INTERFACE_MODE_MOCA,
++	PHY_INTERFACE_MODE_HSGMII,
+ 	PHY_INTERFACE_MODE_QSGMII,
+ 	PHY_INTERFACE_MODE_TRGMII,
+ 	PHY_INTERFACE_MODE_100BASEX,
+@@ -244,6 +245,8 @@ static inline const char *phy_modes(phy_
+ 		return "xlgmii";
+ 	case PHY_INTERFACE_MODE_MOCA:
+ 		return "moca";
++	case PHY_INTERFACE_MODE_HSGMII:
++		return "hsgmii";
+ 	case PHY_INTERFACE_MODE_QSGMII:
+ 		return "qsgmii";
+ 	case PHY_INTERFACE_MODE_TRGMII:
diff --git a/target/linux/realtek/patches-5.15/705-add-rtl-phy.patch b/target/linux/realtek/patches-5.15/705-add-rtl-phy.patch
new file mode 100644
index 00000000000000..98c5e714b1946e
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/705-add-rtl-phy.patch
@@ -0,0 +1,39 @@
+From 89f71ebb355c624320c2b0ace8ae9488ff53cbeb Mon Sep 17 00:00:00 2001
+From: Birger Koblitz <mail@birger-koblitz.de>
+Date: Tue, 5 Jan 2021 20:40:52 +0100
+Subject: PHY: Add realtek PHY
+
+This fixes the build problems for the REALTEK target by adding a proper
+configuration option for the phy module.
+
+Submitted-by: Birger Koblitz <mail@birger-koblitz.de>
+---
+ drivers/net/phy/Kconfig                       | 6 ++++++
+ drivers/net/phy/Makefile                      | 1 +
+ 2 files changed, 7 insertions(+)
+
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -357,6 +357,12 @@ config REALTEK_PHY
+ 	help
+ 	  Supports the Realtek 821x PHY.
+ 
++config REALTEK_SOC_PHY
++	tristate "Realtek SoC PHYs"
++	depends on RTL83XX
++	help
++	  Supports the PHYs found in combination with Realtek Switch SoCs
++
+ config RENESAS_PHY
+ 	tristate "Renesas PHYs"
+ 	help
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -93,6 +93,7 @@ obj-$(CONFIG_NXP_C45_TJA11XX_PHY)	+= nxp
+ obj-$(CONFIG_NXP_TJA11XX_PHY)	+= nxp-tja11xx.o
+ obj-$(CONFIG_QSEMI_PHY)		+= qsemi.o
+ obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
++obj-$(CONFIG_REALTEK_SOC_PHY)   += rtl83xx-phy.o
+ obj-$(CONFIG_RENESAS_PHY)	+= uPD60620.o
+ obj-$(CONFIG_ROCKCHIP_PHY)	+= rockchip.o
+ obj-$(CONFIG_SMSC_PHY)		+= smsc.o
diff --git a/target/linux/realtek/patches-5.15/705-include-linux-phy-increase-phy-address-number-for-rtl839x.patch b/target/linux/realtek/patches-5.15/705-include-linux-phy-increase-phy-address-number-for-rtl839x.patch
new file mode 100644
index 00000000000000..56ce80bb20bdb3
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/705-include-linux-phy-increase-phy-address-number-for-rtl839x.patch
@@ -0,0 +1,32 @@
+From 2b88563ee5aafd9571d965b7f2093a0f58d98a31 Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Thu, 26 Nov 2020 12:02:21 +0100
+Subject: PHY: Increase max PHY adddress number
+
+* rename the target to realtek
+* add refactored DSA driver
+* add latest gpio driver
+* lots of arch cleanups
+* new irq driver
+* additional boards
+
+Submitted-by: Bert Vermeulen <bert@biot.com>
+Submitted-by: Birger Koblitz <mail@birger-koblitz.de>
+Submitted-by: Sander Vanheule <sander@svanheule.net>
+Submitted-by: Bjørn Mork <bjorn@mork.no>
+Submitted-by: John Crispin <john@phrozen.org>
+---
+ include/linux/phy.h                           | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -280,7 +280,7 @@ static inline const char *phy_modes(phy_
+ #define PHY_INIT_TIMEOUT	100000
+ #define PHY_FORCE_TIMEOUT	10
+ 
+-#define PHY_MAX_ADDR	32
++#define PHY_MAX_ADDR	64
+ 
+ /* Used when trying to connect to a specific phy (mii bus id:phy device id) */
+ #define PHY_ID_FMT "%s:%02x"
diff --git a/target/linux/realtek/patches-5.15/710-net-phy-sfp-re-probe-modules-on-DEV_UP-event.patch b/target/linux/realtek/patches-5.15/710-net-phy-sfp-re-probe-modules-on-DEV_UP-event.patch
new file mode 100644
index 00000000000000..87537a13f5a5cf
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/710-net-phy-sfp-re-probe-modules-on-DEV_UP-event.patch
@@ -0,0 +1,26 @@
+From a381ac0aa281fdb0b41a39d8a2bc08fd88f6db92 Mon Sep 17 00:00:00 2001
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+Date: Tue, 25 Feb 2020 16:32:37 +0100
+Subject: [PATCH 1/3] net: phy: sfp: re-probe modules on DEV_UP event
+
+Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
+---
+ drivers/net/phy/sfp.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -2153,6 +2153,13 @@ static void sfp_sm_module(struct sfp *sf
+ 		return;
+ 	}
+ 
++	/* Re-probe the SFP modules when an interface is brought up, as the MAC
++	 * do not report its link status (This means Phylink wouldn't be
++	 * triggered if the PHY had a link before a MAC is brought up).
++	 */
++	if (event == SFP_E_DEV_UP && sfp->sm_mod_state == SFP_MOD_PRESENT)
++		sfp_sm_mod_next(sfp, SFP_MOD_PROBE, T_SERIAL);
++
+ 	switch (sfp->sm_mod_state) {
+ 	default:
+ 		if (event == SFP_E_INSERT) {
diff --git a/target/linux/realtek/patches-5.15/711-net-phy-add-an-MDIO-SMBus-library.patch b/target/linux/realtek/patches-5.15/711-net-phy-add-an-MDIO-SMBus-library.patch
new file mode 100644
index 00000000000000..767a5d8ec56b02
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/711-net-phy-add-an-MDIO-SMBus-library.patch
@@ -0,0 +1,148 @@
+From d585c55b9f70cf9e8c66820d7efe7130c683f19e Mon Sep 17 00:00:00 2001
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+Date: Fri, 21 Feb 2020 11:51:27 +0100
+Subject: [PATCH 2/3] net: phy: add an MDIO SMBus library
+
+Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
+---
+ drivers/net/mdio/Kconfig      | 11 +++++++
+ drivers/net/mdio/Makefile     |  1 +
+ drivers/net/mdio/mdio-smbus.c | 62 +++++++++++++++++++++++++++++++++++
+ drivers/net/phy/Kconfig       |  1 +
+ include/linux/mdio/mdio-i2c.h | 16 +++++++++
+ 5 files changed, 91 insertions(+)
+ create mode 100644 drivers/net/mdio/mdio-smbus.c
+
+--- a/drivers/net/mdio/Kconfig
++++ b/drivers/net/mdio/Kconfig
+@@ -54,6 +54,17 @@ config MDIO_SUN4I
+ 	  interface units of the Allwinner SoC that have an EMAC (A10,
+ 	  A12, A10s, etc.)
+ 
++config MDIO_SMBUS
++	tristate
++	depends on I2C_SMBUS
++	help
++	  Support SMBus based PHYs. This provides a MDIO bus bridged
++	  to SMBus to allow PHYs connected in SMBus mode to be accessed
++	  using the existing infrastructure.
++
++	  This is library mode.
++
++
+ config MDIO_XGENE
+ 	tristate "APM X-Gene SoC MDIO bus controller"
+ 	depends on ARCH_XGENE || COMPILE_TEST
+--- a/drivers/net/mdio/Makefile
++++ b/drivers/net/mdio/Makefile
+@@ -19,6 +19,7 @@ obj-$(CONFIG_MDIO_MOXART)		+= mdio-moxar
+ obj-$(CONFIG_MDIO_MSCC_MIIM)		+= mdio-mscc-miim.o
+ obj-$(CONFIG_MDIO_MVUSB)		+= mdio-mvusb.o
+ obj-$(CONFIG_MDIO_OCTEON)		+= mdio-octeon.o
++obj-$(CONFIG_MDIO_SMBUS)		+= mdio-smbus.o
+ obj-$(CONFIG_MDIO_SUN4I)		+= mdio-sun4i.o
+ obj-$(CONFIG_MDIO_THUNDER)		+= mdio-thunder.o
+ obj-$(CONFIG_MDIO_XGENE)		+= mdio-xgene.o
+--- /dev/null
++++ b/drivers/net/mdio/mdio-smbus.c
+@@ -0,0 +1,62 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * MDIO SMBus bridge
++ *
++ * Copyright (C) 2020 Antoine Tenart
++ *
++ * Network PHYs can appear on SMBus when they are part of SFP modules.
++ */
++#include <linux/i2c.h>
++#include <linux/phy.h>
++#include <linux/mdio/mdio-i2c.h>
++
++static int smbus_mii_read(struct mii_bus *mii, int phy_id, int reg)
++{
++	struct i2c_adapter *i2c = mii->priv;
++	union i2c_smbus_data data;
++	int ret;
++
++	ret = i2c_smbus_xfer(i2c, i2c_mii_phy_addr(phy_id), 0, I2C_SMBUS_READ,
++			     reg, I2C_SMBUS_BYTE_DATA, &data);
++	if (ret < 0)
++		return 0xff;
++
++	return data.byte;
++}
++
++static int smbus_mii_write(struct mii_bus *mii, int phy_id, int reg, u16 val)
++{
++	struct i2c_adapter *i2c = mii->priv;
++	union i2c_smbus_data data;
++	int ret;
++
++	data.byte = val;
++
++	ret = i2c_smbus_xfer(i2c, i2c_mii_phy_addr(phy_id), 0, I2C_SMBUS_WRITE,
++			     reg, I2C_SMBUS_BYTE_DATA, &data);
++	return ret < 0 ? ret : 0;
++}
++
++struct mii_bus *mdio_smbus_alloc(struct device *parent, struct i2c_adapter *i2c)
++{
++	struct mii_bus *mii;
++
++	if (!i2c_check_functionality(i2c, I2C_FUNC_SMBUS_BYTE_DATA))
++		return ERR_PTR(-EINVAL);
++
++	mii = mdiobus_alloc();
++	if (!mii)
++		return ERR_PTR(-ENOMEM);
++
++	snprintf(mii->id, MII_BUS_ID_SIZE, "smbus:%s", dev_name(parent));
++	mii->parent = parent;
++	mii->read = smbus_mii_read;
++	mii->write = smbus_mii_write;
++	mii->priv = i2c;
++
++	return mii;
++}
++
++MODULE_AUTHOR("Antoine Tenart");
++MODULE_DESCRIPTION("MDIO SMBus bridge library");
++MODULE_LICENSE("GPL");
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -61,6 +61,7 @@ config SFP
+ 	depends on I2C && PHYLINK
+ 	depends on HWMON || HWMON=n
+ 	select MDIO_I2C
++	select MDIO_SMBUS
+ 
+ comment "Switch configuration API + drivers"
+ 
+--- a/include/linux/mdio/mdio-i2c.h
++++ b/include/linux/mdio/mdio-i2c.h
+@@ -12,5 +12,8 @@ struct i2c_adapter;
+ struct mii_bus;
+ 
+ struct mii_bus *mdio_i2c_alloc(struct device *parent, struct i2c_adapter *i2c);
++struct mii_bus *mdio_smbus_alloc(struct device *parent, struct i2c_adapter *i2c);
++bool i2c_mii_valid_phy_id(int phy_id);
++unsigned int i2c_mii_phy_addr(int phy_id);
+ 
+ #endif
+--- a/drivers/net/mdio/mdio-i2c.c
++++ b/drivers/net/mdio/mdio-i2c.c
+@@ -18,12 +18,12 @@
+  * specified to be present in SFP modules.  These correspond with PHY
+  * addresses 16 and 17.  Disallow access to these "phy" addresses.
+  */
+-static bool i2c_mii_valid_phy_id(int phy_id)
++bool i2c_mii_valid_phy_id(int phy_id)
+ {
+ 	return phy_id != 0x10 && phy_id != 0x11;
+ }
+ 
+-static unsigned int i2c_mii_phy_addr(int phy_id)
++unsigned int i2c_mii_phy_addr(int phy_id)
+ {
+ 	return phy_id + 0x40;
+ }
diff --git a/target/linux/realtek/patches-5.15/712-net-phy-sfp-add-support-for-SMBus.patch b/target/linux/realtek/patches-5.15/712-net-phy-sfp-add-support-for-SMBus.patch
new file mode 100644
index 00000000000000..1e203a2925a0f5
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/712-net-phy-sfp-add-support-for-SMBus.patch
@@ -0,0 +1,99 @@
+From 3cb0bde365d913c484d20224367a54a0eac780a7 Mon Sep 17 00:00:00 2001
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+Date: Fri, 21 Feb 2020 11:55:29 +0100
+Subject: [PATCH 3/3] net: phy: sfp: add support for SMBus
+
+Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
+---
+ drivers/net/phy/sfp.c | 68 ++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 54 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -549,32 +549,72 @@ static int sfp_i2c_write(struct sfp *sfp
+ 	return ret == ARRAY_SIZE(msgs) ? len : 0;
+ }
+ 
++static int sfp_smbus_read(struct sfp *sfp, bool a2, u8 dev_addr, void *buf,
++			  size_t len)
++{
++	u8 bus_addr = a2 ? 0x51 : 0x50, *val = buf;
++
++	bus_addr -= 0x40;
++
++	while (len > 0) {
++		*val = sfp->i2c_mii->read(sfp->i2c_mii, bus_addr, dev_addr);
++
++		val++;
++		dev_addr++;
++		len--;
++	}
++
++	return val - (u8 *)buf;
++}
++
++static int sfp_smbus_write(struct sfp *sfp, bool a2, u8 dev_addr, void *buf,
++			   size_t len)
++{
++	u8 bus_addr = a2 ? 0x51 : 0x50;
++	u16 val;
++
++	memcpy(&val, buf, len);
++
++	return sfp->i2c_mii->write(sfp->i2c_mii, bus_addr, dev_addr, val);
++}
++
+ static int sfp_i2c_configure(struct sfp *sfp, struct i2c_adapter *i2c)
+ {
+-	struct mii_bus *i2c_mii;
++	struct mii_bus *mii;
+ 	int ret;
+ 
+-	if (!i2c_check_functionality(i2c, I2C_FUNC_I2C))
+-		return -EINVAL;
+-
+ 	sfp->i2c = i2c;
+-	sfp->read = sfp_i2c_read;
+-	sfp->write = sfp_i2c_write;
+ 
+-	i2c_mii = mdio_i2c_alloc(sfp->dev, i2c);
+-	if (IS_ERR(i2c_mii))
+-		return PTR_ERR(i2c_mii);
++	if (i2c_check_functionality(i2c, I2C_FUNC_I2C)) {
++		sfp->read = sfp_i2c_read;
++		sfp->write = sfp_i2c_write;
++
++		mii = mdio_i2c_alloc(sfp->dev, i2c);
++		if (IS_ERR(mii))
++			return PTR_ERR(mii);
++
++		mii->name = "SFP I2C Bus";
++	} else if (i2c_check_functionality(i2c, I2C_FUNC_SMBUS_BYTE_DATA)) {
++		sfp->read = sfp_smbus_read;
++		sfp->write = sfp_smbus_write;
++
++		mii = mdio_smbus_alloc(sfp->dev, i2c);
++		if (IS_ERR(mii))
++			return PTR_ERR(mii);
+ 
+-	i2c_mii->name = "SFP I2C Bus";
+-	i2c_mii->phy_mask = ~0;
++		mii->name = "SFP SMBus";
++	} else {
++		return -EINVAL;
++	}
+ 
+-	ret = mdiobus_register(i2c_mii);
++	mii->phy_mask = ~0;
++	ret = mdiobus_register(mii);
+ 	if (ret < 0) {
+-		mdiobus_free(i2c_mii);
++		mdiobus_free(mii);
+ 		return ret;
+ 	}
+ 
+-	sfp->i2c_mii = i2c_mii;
++	sfp->i2c_mii = mii;
+ 
+ 	return 0;
+ }
diff --git a/target/linux/realtek/patches-5.15/800-net-mdio-support-hardware-assisted-indirect-access.patch b/target/linux/realtek/patches-5.15/800-net-mdio-support-hardware-assisted-indirect-access.patch
new file mode 100644
index 00000000000000..b0a8fadb5f4fbb
--- /dev/null
+++ b/target/linux/realtek/patches-5.15/800-net-mdio-support-hardware-assisted-indirect-access.patch
@@ -0,0 +1,840 @@
+From 5d84f16b0036b33487b94abef15ad3c224c81ee9 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 3 Feb 2022 16:38:50 +0000
+Subject: [PATCH] net: mdio: support hardware-assisted indirect access
+
+MDIO controllers found in Switch-SoCs can offload some MDIO operations
+to the hardware:
+ * MMD register access via Clause-22
+   Instead of using multiple operations to access MMD registers via
+   MII register MII_MMD_CTRL and MII_MMD_DATA some controllers
+   allow transparent access to MMD PHY registers.
+
+ * paged MII register access
+   Some PHYs (namely RealTek and Vitesse) use vendor-defined MII
+   register 0x1f for paged access. Some MDIO host controllers support
+   transparent paged access when used with such PHYs.
+
+ * add convenience accessors to fully support paged access also on
+   multi-PHY packages (like the embedded PHYs in RTL83xx):
+   phy_package_read_paged and phy_package_write_paged
+   phy_package_port_read and phy_package_port_write
+   phy_package_port_read_paged and phy_package_port_write_paged
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/mdio_bus.c | 335 ++++++++++++++++++++++++++++++++++++-
+ drivers/net/phy/phy-core.c |  66 +++++++-
+ include/linux/mdio.h       |  59 +++++++
+ include/linux/phy.h        | 129 ++++++++++++++
+ include/uapi/linux/mii.h   |   1 +
+ 5 files changed, 580 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/phy/mdio_bus.c
++++ b/drivers/net/phy/mdio_bus.c
+@@ -742,6 +742,32 @@ out:
+ }
+ 
+ /**
++ * __mdiobus_select_page - Unlocked version of the mdiobus_select_page function
++ * @bus: the mii_bus struct
++ * @addr: the phy address
++ * @page: register page to select
++ *
++ * Selects a MDIO bus register page. Caller must hold the mdio bus lock.
++ *
++ * NOTE: MUST NOT be called from interrupt context.
++ */
++int __mdiobus_select_page(struct mii_bus *bus, int addr, u16 page)
++{
++	lockdep_assert_held_once(&bus->mdio_lock);
++
++	if (bus->selected_page[addr] == page)
++		return 0;
++
++	bus->selected_page[addr] = page;
++	if (bus->read_paged)
++		return 0;
++
++	return bus->write(bus, addr, MII_MAINPAGE, page);
++
++}
++EXPORT_SYMBOL(__mdiobus_select_page);
++
++/**
+  * __mdiobus_read - Unlocked version of the mdiobus_read function
+  * @bus: the mii_bus struct
+  * @addr: the phy address
+@@ -757,7 +783,10 @@ int __mdiobus_read(struct mii_bus *bus,
+ 
+ 	lockdep_assert_held_once(&bus->mdio_lock);
+ 
+-	retval = bus->read(bus, addr, regnum);
++	if (bus->read_paged)
++		retval = bus->read_paged(bus, addr, bus->selected_page[addr], regnum);
++	else
++		retval = bus->read(bus, addr, regnum);
+ 
+ 	trace_mdio_access(bus, 1, addr, regnum, retval, retval);
+ 	mdiobus_stats_acct(&bus->stats[addr], true, retval);
+@@ -767,6 +796,40 @@ int __mdiobus_read(struct mii_bus *bus,
+ EXPORT_SYMBOL(__mdiobus_read);
+ 
+ /**
++ * __mdiobus_read_paged - Unlocked version of the mdiobus_read_paged function
++ * @bus: the mii_bus struct
++ * @addr: the phy address
++ * @page: the register page to access
++ * @regnum: register number to read
++ *
++ * Read a MDIO bus register. Caller must hold the mdio bus lock.
++ *
++ * NOTE: MUST NOT be called from interrupt context.
++ */
++int __mdiobus_read_paged(struct mii_bus *bus, int addr, u16 page, u32 regnum)
++{
++	int retval;
++	int oldpage;
++
++	lockdep_assert_held_once(&bus->mdio_lock);
++
++	if (bus->read_paged) {
++		retval = bus->read_paged(bus, addr, page, regnum);
++	} else {
++		oldpage = bus->selected_page[addr];
++		__mdiobus_select_page(bus, addr, page);
++		retval = bus->read(bus, addr, regnum);
++		__mdiobus_select_page(bus, addr, oldpage);
++	}
++
++	trace_mdio_access(bus, 1, addr, regnum, retval, retval);
++	mdiobus_stats_acct(&bus->stats[addr], true, retval);
++
++	return retval;
++}
++EXPORT_SYMBOL(__mdiobus_read_paged);
++
++/**
+  * __mdiobus_write - Unlocked version of the mdiobus_write function
+  * @bus: the mii_bus struct
+  * @addr: the phy address
+@@ -783,7 +846,10 @@ int __mdiobus_write(struct mii_bus *bus,
+ 
+ 	lockdep_assert_held_once(&bus->mdio_lock);
+ 
+-	err = bus->write(bus, addr, regnum, val);
++	if (bus->write_paged)
++		err = bus->write_paged(bus, addr, bus->selected_page[addr], regnum, val);
++	else
++		err = bus->write(bus, addr, regnum, val);
+ 
+ 	trace_mdio_access(bus, 0, addr, regnum, val, err);
+ 	mdiobus_stats_acct(&bus->stats[addr], false, err);
+@@ -793,6 +859,39 @@ int __mdiobus_write(struct mii_bus *bus,
+ EXPORT_SYMBOL(__mdiobus_write);
+ 
+ /**
++ * __mdiobus_write_paged - Unlocked version of the mdiobus_write_paged function
++ * @bus: the mii_bus struct
++ * @addr: the phy address
++ * @page: the register page to access
++ * @regnum: register number to write
++ * @val: value to write to @regnum
++ *
++ * Write a MDIO bus register. Caller must hold the mdio bus lock.
++ *
++ * NOTE: MUST NOT be called from interrupt context.
++ */
++int __mdiobus_write_paged(struct mii_bus *bus, int addr, u16 page, u32 regnum, u16 val)
++{
++	int err, oldpage;
++
++	lockdep_assert_held_once(&bus->mdio_lock);
++
++	if (bus->write_paged) {
++		err = bus->write_paged(bus, addr, page, regnum, val);
++	} else {
++		oldpage = bus->selected_page[addr];
++		__mdiobus_select_page(bus, addr, page);
++		err = bus->write(bus, addr, regnum, val);
++		__mdiobus_select_page(bus, addr, oldpage);
++	}
++	trace_mdio_access(bus, 0, addr, regnum, val, err);
++	mdiobus_stats_acct(&bus->stats[addr], false, err);
++	return err;
++}
++EXPORT_SYMBOL(__mdiobus_write_paged);
++
++
++/**
+  * __mdiobus_modify_changed - Unlocked version of the mdiobus_modify function
+  * @bus: the mii_bus struct
+  * @addr: the phy address
+@@ -825,6 +924,43 @@ int __mdiobus_modify_changed(struct mii_
+ EXPORT_SYMBOL_GPL(__mdiobus_modify_changed);
+ 
+ /**
++ * __mdiobus_modify_changed_paged - Unlocked version of the mdiobus_modify_paged function
++ * @bus: the mii_bus struct
++ * @addr: the phy address
++ * @regnum: register number to modify
++ * @mask: bit mask of bits to clear
++ * @set: bit mask of bits to set
++ *
++ * Read, modify, and if any change, write the register value back to the
++ * device. Any error returns a negative number.
++ *
++ * NOTE: MUST NOT be called from interrupt context.
++ */
++int __mdiobus_modify_changed_paged(struct mii_bus *bus, int addr, u32 regnum, u16 page,
++				   u16 mask, u16 set)
++{
++	int new, ret, oldpage;
++
++	oldpage = bus->selected_page[addr];
++	__mdiobus_select_page(bus, addr, page);
++
++	ret = __mdiobus_read_paged(bus, addr, page, regnum);
++	if (ret < 0)
++		return ret;
++
++	new = (ret & ~mask) | set;
++	if (new == ret)
++		return 0;
++
++	ret = __mdiobus_write_paged(bus, addr, page, regnum, new);
++
++	__mdiobus_select_page(bus, addr, oldpage);
++
++	return ret < 0 ? ret : 1;
++}
++EXPORT_SYMBOL_GPL(__mdiobus_modify_changed_paged);
++
++/**
+  * mdiobus_read_nested - Nested version of the mdiobus_read function
+  * @bus: the mii_bus struct
+  * @addr: the phy address
+@@ -850,6 +986,79 @@ int mdiobus_read_nested(struct mii_bus *
+ EXPORT_SYMBOL(mdiobus_read_nested);
+ 
+ /**
++ * mdiobus_select_page_nested - Nested version of the mdiobus_select_page function
++ * @bus: the mii_bus struct
++ * @addr: the phy address
++ * @page: register page to access
++ *
++ * In case of nested MDIO bus access avoid lockdep false positives by
++ * using mutex_lock_nested().
++ *
++ * NOTE: MUST NOT be called from interrupt context,
++ * because the bus read/write functions may wait for an interrupt
++ * to conclude the operation.
++ */
++int mdiobus_select_page_nested(struct mii_bus *bus, int addr, u16 page)
++{
++	int retval;
++
++	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++	retval = __mdiobus_select_page(bus, addr, page);
++	mutex_unlock(&bus->mdio_lock);
++
++	return retval;
++}
++EXPORT_SYMBOL(mdiobus_select_page_nested);
++
++/**
++ * mdiobus_read_paged_nested - Nested version of the mdiobus_read_paged function
++ * @bus: the mii_bus struct
++ * @addr: the phy address
++ * @page: register page to access
++ * @regnum: register number to read
++ *
++ * In case of nested MDIO bus access avoid lockdep false positives by
++ * using mutex_lock_nested().
++ *
++ * NOTE: MUST NOT be called from interrupt context,
++ * because the bus read/write functions may wait for an interrupt
++ * to conclude the operation.
++ */
++int mdiobus_read_paged_nested(struct mii_bus *bus, int addr, u16 page, u32 regnum)
++{
++	int retval;
++
++	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++	retval = __mdiobus_read_paged(bus, addr, page, regnum);
++	mutex_unlock(&bus->mdio_lock);
++
++	return retval;
++}
++EXPORT_SYMBOL(mdiobus_read_paged_nested);
++
++/**
++ * mdiobus_select_page - Convenience function for setting the MII register page
++ * @bus: the mii_bus struct
++ * @addr: the phy address
++ * @page: the register page to set
++ *
++ * NOTE: MUST NOT be called from interrupt context,
++ * because the bus read/write functions may wait for an interrupt
++ * to conclude the operation.
++ */
++int mdiobus_select_page(struct mii_bus *bus, int addr, u16 page)
++{
++	int retval;
++
++	mutex_lock(&bus->mdio_lock);
++	retval = __mdiobus_select_page(bus, addr, page);
++	mutex_unlock(&bus->mdio_lock);
++
++	return retval;
++}
++EXPORT_SYMBOL(mdiobus_select_page);
++
++/**
+  * mdiobus_read - Convenience function for reading a given MII mgmt register
+  * @bus: the mii_bus struct
+  * @addr: the phy address
+@@ -872,6 +1081,29 @@ int mdiobus_read(struct mii_bus *bus, in
+ EXPORT_SYMBOL(mdiobus_read);
+ 
+ /**
++ * mdiobus_read_paged - Convenience function for reading a given paged MII mgmt register
++ * @bus: the mii_bus struct
++ * @addr: the phy address
++ * @page: register page to access
++ * @regnum: register number to read
++ *
++ * NOTE: MUST NOT be called from interrupt context,
++ * because the bus read/write functions may wait for an interrupt
++ * to conclude the operation.
++ */
++int mdiobus_read_paged(struct mii_bus *bus, int addr, u16 page, u32 regnum)
++{
++	int retval;
++
++	mutex_lock(&bus->mdio_lock);
++	retval = __mdiobus_read_paged(bus, addr, page, regnum);
++	mutex_unlock(&bus->mdio_lock);
++
++	return retval;
++}
++EXPORT_SYMBOL(mdiobus_read_paged);
++
++/**
+  * mdiobus_write_nested - Nested version of the mdiobus_write function
+  * @bus: the mii_bus struct
+  * @addr: the phy address
+@@ -898,6 +1130,33 @@ int mdiobus_write_nested(struct mii_bus
+ EXPORT_SYMBOL(mdiobus_write_nested);
+ 
+ /**
++ * mdiobus_write_paged_nested - Nested version of the mdiobus_write_aged function
++ * @bus: the mii_bus struct
++ * @addr: the phy address
++ * @page: the register page to access
++ * @regnum: register number to write
++ * @val: value to write to @regnum
++ *
++ * In case of nested MDIO bus access avoid lockdep false positives by
++ * using mutex_lock_nested().
++ *
++ * NOTE: MUST NOT be called from interrupt context,
++ * because the bus read/write functions may wait for an interrupt
++ * to conclude the operation.
++ */
++int mdiobus_write_paged_nested(struct mii_bus *bus, int addr, u16 page, u32 regnum, u16 val)
++{
++	int err;
++
++	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
++	err = __mdiobus_write_paged(bus, addr, page, regnum, val);
++	mutex_unlock(&bus->mdio_lock);
++
++	return err;
++}
++EXPORT_SYMBOL(mdiobus_write_paged_nested);
++
++/**
+  * mdiobus_write - Convenience function for writing a given MII mgmt register
+  * @bus: the mii_bus struct
+  * @addr: the phy address
+@@ -921,6 +1180,30 @@ int mdiobus_write(struct mii_bus *bus, i
+ EXPORT_SYMBOL(mdiobus_write);
+ 
+ /**
++ * mdiobus_write_paged - Convenience function for writing a given paged MII mgmt register
++ * @bus: the mii_bus struct
++ * @addr: the phy address
++ * @page: the register page to access
++ * @regnum: register number to write
++ * @val: value to write to @regnum
++ *
++ * NOTE: MUST NOT be called from interrupt context,
++ * because the bus read/write functions may wait for an interrupt
++ * to conclude the operation.
++ */
++int mdiobus_write_paged(struct mii_bus *bus, int addr, u16 page, u32 regnum, u16 val)
++{
++	int err;
++
++	mutex_lock(&bus->mdio_lock);
++	err = __mdiobus_write_paged(bus, addr, page, regnum, val);
++	mutex_unlock(&bus->mdio_lock);
++
++	return err;
++}
++EXPORT_SYMBOL(mdiobus_write_paged);
++
++/**
+  * mdiobus_modify - Convenience function for modifying a given mdio device
+  *	register
+  * @bus: the mii_bus struct
+@@ -942,6 +1225,51 @@ int mdiobus_modify(struct mii_bus *bus,
+ EXPORT_SYMBOL_GPL(mdiobus_modify);
+ 
+ /**
++ * mdiobus_modify_paged - Convenience function for modifying a given mdio device
++ *	register
++ * @bus: the mii_bus struct
++ * @addr: the phy address
++ * @page: the register page to access
++ * @regnum: register number to write
++ * @mask: bit mask of bits to clear
++ * @set: bit mask of bits to set
++ */
++int mdiobus_modify_paged(struct mii_bus *bus, int addr, u16 page, u32 regnum, u16 mask, u16 set)
++{
++	int err;
++
++	mutex_lock(&bus->mdio_lock);
++	err = __mdiobus_modify_changed_paged(bus, addr, page, regnum, mask, set);
++	mutex_unlock(&bus->mdio_lock);
++
++	return err < 0 ? err : 0;
++}
++EXPORT_SYMBOL_GPL(mdiobus_modify_paged);
++
++/**
++ * mdiobus_modify_changed_paged - Convenience function for modifying a given paged
++ * mdio device register and returning if it changed
++ * @bus: the mii_bus struct
++ * @addr: the phy address
++ * @page: the register page to access
++ * @regnum: register number to write
++ * @mask: bit mask of bits to clear
++ * @set: bit mask of bits to set
++ */
++int mdiobus_modify_changed_paged(struct mii_bus *bus, int addr, u16 page, u32 regnum,
++				 u16 mask, u16 set)
++{
++	int err;
++
++	mutex_lock(&bus->mdio_lock);
++	err = __mdiobus_modify_changed_paged(bus, addr, page, regnum, mask, set);
++	mutex_unlock(&bus->mdio_lock);
++
++	return err;
++}
++EXPORT_SYMBOL_GPL(mdiobus_modify_changed_paged);
++
++/**
+  * mdio_bus_match - determine if given MDIO driver supports the given
+  *		    MDIO device
+  * @dev: target MDIO device
+--- a/drivers/net/phy/phy-core.c
++++ b/drivers/net/phy/phy-core.c
+@@ -482,10 +482,16 @@ int __phy_read_mmd(struct phy_device *ph
+ 		struct mii_bus *bus = phydev->mdio.bus;
+ 		int phy_addr = phydev->mdio.addr;
+ 
+-		mmd_phy_indirect(bus, phy_addr, devad, regnum);
+-
+-		/* Read the content of the MMD's selected register */
+-		val = __mdiobus_read(bus, phy_addr, MII_MMD_DATA);
++		if (bus->access_capabilities & MDIOBUS_ACCESS_C22_MMD) {
++			val = __mdiobus_c22_mmd_read(phydev->mdio.bus,
++						     phydev->mdio.addr,
++						     devad, regnum);
++		} else {
++			mmd_phy_indirect(bus, phy_addr, devad, regnum);
++
++			/* Read the content of the MMD's selected register */
++			val = __mdiobus_read(bus, phy_addr, MII_MMD_DATA);
++		}
+ 	}
+ 	return val;
+ }
+@@ -538,12 +544,18 @@ int __phy_write_mmd(struct phy_device *p
+ 		struct mii_bus *bus = phydev->mdio.bus;
+ 		int phy_addr = phydev->mdio.addr;
+ 
+-		mmd_phy_indirect(bus, phy_addr, devad, regnum);
++		if (bus->access_capabilities & MDIOBUS_ACCESS_C22_MMD) {
++			ret = __mdiobus_c22_mmd_write(phydev->mdio.bus,
++						      phydev->mdio.addr,
++						      devad, regnum, val);
++		} else {
++			mmd_phy_indirect(bus, phy_addr, devad, regnum);
+ 
+-		/* Write the data into MMD's selected register */
+-		__mdiobus_write(bus, phy_addr, MII_MMD_DATA, val);
++			/* Write the data into MMD's selected register */
++			__mdiobus_write(bus, phy_addr, MII_MMD_DATA, val);
+ 
+-		ret = 0;
++			ret = 0;
++		}
+ 	}
+ 	return ret;
+ }
+@@ -749,6 +761,13 @@ EXPORT_SYMBOL_GPL(phy_modify_mmd);
+ 
+ static int __phy_read_page(struct phy_device *phydev)
+ {
++	if (phydev->drv && phydev->drv->flags & PHY_HAS_REALTEK_PAGES) {
++		struct mii_bus *bus = phydev->mdio.bus;
++		int phy_addr = phydev->mdio.addr;
++
++		return bus->selected_page[phy_addr];
++	}
++
+ 	if (WARN_ONCE(!phydev->drv->read_page, "read_page callback not available, PHY driver not loaded?\n"))
+ 		return -EOPNOTSUPP;
+ 
+@@ -757,6 +776,13 @@ static int __phy_read_page(struct phy_de
+ 
+ static int __phy_write_page(struct phy_device *phydev, int page)
+ {
++	if (phydev->drv && phydev->drv->flags & PHY_HAS_REALTEK_PAGES) {
++		struct mii_bus *bus = phydev->mdio.bus;
++		int phy_addr = phydev->mdio.addr;
++
++		return __mdiobus_select_page(bus, phy_addr, page);
++	}
++
+ 	if (WARN_ONCE(!phydev->drv->write_page, "write_page callback not available, PHY driver not loaded?\n"))
+ 		return -EOPNOTSUPP;
+ 
+@@ -858,6 +884,18 @@ int phy_read_paged(struct phy_device *ph
+ {
+ 	int ret = 0, oldpage;
+ 
++	if (phydev->drv && phydev->drv->flags & PHY_HAS_REALTEK_PAGES) {
++		struct mii_bus *bus = phydev->mdio.bus;
++		int phy_addr = phydev->mdio.addr;
++
++		if (bus->read_paged) {
++			phy_lock_mdio_bus(phydev);
++			ret = bus->read_paged(bus, phy_addr, page, regnum);
++			phy_unlock_mdio_bus(phydev);
++			return ret;
++		}
++	}
++
+ 	oldpage = phy_select_page(phydev, page);
+ 	if (oldpage >= 0)
+ 		ret = __phy_read(phydev, regnum);
+@@ -879,6 +917,18 @@ int phy_write_paged(struct phy_device *p
+ {
+ 	int ret = 0, oldpage;
+ 
++	if (phydev->drv && phydev->drv->flags & PHY_HAS_REALTEK_PAGES) {
++		struct mii_bus *bus = phydev->mdio.bus;
++		int phy_addr = phydev->mdio.addr;
++
++		if (bus->write_paged) {
++			phy_lock_mdio_bus(phydev);
++			ret = bus->write_paged(bus, phy_addr, page, regnum, val);
++			phy_unlock_mdio_bus(phydev);
++			return ret;
++		}
++	}
++
+ 	oldpage = phy_select_page(phydev, page);
+ 	if (oldpage >= 0)
+ 		ret = __phy_write(phydev, regnum, val);
+--- a/include/linux/mdio.h
++++ b/include/linux/mdio.h
+@@ -14,6 +14,7 @@
+  * IEEE 802.3ae clause 45 addressing mode used by 10GIGE phy chips.
+  */
+ #define MII_ADDR_C45		(1<<30)
++#define MII_ADDR_C22_MMD	(1<<29)
+ #define MII_DEVADDR_C45_SHIFT	16
+ #define MII_DEVADDR_C45_MASK	GENMASK(20, 16)
+ #define MII_REGADDR_C45_MASK	GENMASK(15, 0)
+@@ -340,11 +341,19 @@ static inline void mii_10gbt_stat_mod_li
+ 			 advertising, lpa & MDIO_AN_10GBT_STAT_LP10G);
+ }
+ 
++int __mdiobus_select_page(struct mii_bus *bus, int addr, u16 page);
+ int __mdiobus_read(struct mii_bus *bus, int addr, u32 regnum);
+ int __mdiobus_write(struct mii_bus *bus, int addr, u32 regnum, u16 val);
+ int __mdiobus_modify_changed(struct mii_bus *bus, int addr, u32 regnum,
+ 			     u16 mask, u16 set);
+ 
++int __mdiobus_read_paged(struct mii_bus *bus, int addr, u16 page, u32 regnum);
++int __mdiobus_write_paged(struct mii_bus *bus, int addr, u16 page, u32 regnum, u16 val);
++int __mdiobus_modify_changed_paged(struct mii_bus *bus, int addr, u32 regnum, u16 page,
++				   u16 mask, u16 set);
++
++int mdiobus_select_page(struct mii_bus *bus, int addr, u16 page);
++int mdiobus_select_page_nested(struct mii_bus *bus, int addr, u16 page);
+ int mdiobus_read(struct mii_bus *bus, int addr, u32 regnum);
+ int mdiobus_read_nested(struct mii_bus *bus, int addr, u32 regnum);
+ int mdiobus_write(struct mii_bus *bus, int addr, u32 regnum, u16 val);
+@@ -352,11 +361,51 @@ int mdiobus_write_nested(struct mii_bus
+ int mdiobus_modify(struct mii_bus *bus, int addr, u32 regnum, u16 mask,
+ 		   u16 set);
+ 
++int mdiobus_read_paged(struct mii_bus *bus, int addr, u16 page, u32 regnum);
++int mdiobus_read_nested_paged(struct mii_bus *bus, int addr, u16 page, u32 regnum);
++int mdiobus_write_paged(struct mii_bus *bus, int addr, u16 page, u32 regnum, u16 val);
++int mdiobus_write_nested_paged(struct mii_bus *bus, int addr, u16 page, u32 regnum, u16 val);
++int mdiobus_modify_paged(struct mii_bus *bus, int addr, u16 page, u32 regnum, u16 mask,
++			 u16 set);
++int mdiobus_modify_changed_paged(struct mii_bus *bus, int addr, u16 page, u32 regnum,
++				 u16 mask, u16 set);
++
++static inline int mdiodev_read_paged(struct mdio_device *mdiodev, u16 page,
++				     u32 regnum)
++{
++	return mdiobus_read_paged(mdiodev->bus, mdiodev->addr, page, regnum);
++}
++
++static inline int mdiodev_write_paged(struct mdio_device *mdiodev, u16 page,
++				      u32 regnum, u16 val)
++{
++	return mdiobus_write_paged(mdiodev->bus, mdiodev->addr, page, regnum, val);
++}
++
++static inline int mdiodev_modify_paged(struct mdio_device *mdiodev, u16 page,
++				       u32 regnum, u16 mask, u16 set)
++{
++	return mdiobus_modify_paged(mdiodev->bus, mdiodev->addr, page, regnum,
++				    mask, set);
++}
++
++static inline int mdiodev_modify_changed_paged(struct mdio_device *mdiodev, u16 page,
++					       u32 regnum, u16 mask, u16 set)
++{
++	return mdiobus_modify_changed_paged(mdiodev->bus, mdiodev->addr, page, regnum,
++					    mask, set);
++}
++
+ static inline u32 mdiobus_c45_addr(int devad, u16 regnum)
+ {
+ 	return MII_ADDR_C45 | devad << MII_DEVADDR_C45_SHIFT | regnum;
+ }
+ 
++static inline u32 mdiobus_c22_mmd_addr(int devad, u16 regnum)
++{
++	return MII_ADDR_C22_MMD | devad << MII_DEVADDR_C45_SHIFT | regnum;
++}
++
+ static inline u16 mdiobus_c45_regad(u32 regnum)
+ {
+ 	return FIELD_GET(MII_REGADDR_C45_MASK, regnum);
+@@ -380,6 +429,19 @@ static inline int __mdiobus_c45_write(st
+ 			       val);
+ }
+ 
++static inline int __mdiobus_c22_mmd_read(struct mii_bus *bus, int prtad,
++					 int devad, u16 regnum)
++{
++	return __mdiobus_read(bus, prtad, mdiobus_c22_mmd_addr(devad, regnum));
++}
++
++static inline int __mdiobus_c22_mmd_write(struct mii_bus *bus, int prtad,
++					  int devad, u16 regnum, u16 val)
++{
++	return __mdiobus_write(bus, prtad, mdiobus_c22_mmd_addr(devad, regnum),
++			       val);
++}
++
+ static inline int mdiobus_c45_read(struct mii_bus *bus, int prtad, int devad,
+ 				   u16 regnum)
+ {
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -81,6 +81,7 @@ extern const int phy_10gbit_features_arr
+ #define PHY_IS_INTERNAL		0x00000001
+ #define PHY_RST_AFTER_CLK_EN	0x00000002
+ #define PHY_POLL_CABLE_TEST	0x00000004
++#define PHY_HAS_REALTEK_PAGES	0x00000010
+ #define MDIO_DEVICE_IS_PHY	0x80000000
+ 
+ /**
+@@ -421,6 +422,22 @@ struct mii_bus {
+ 
+ 	/** @shared: shared state across different PHYs */
+ 	struct phy_package_shared *shared[PHY_MAX_ADDR];
++
++	/** @access_capabilities: hardware-assisted access capabilties */
++	enum {
++		MDIOBUS_ACCESS_SOFTWARE_ONLY = 0,
++		MDIOBUS_ACCESS_C22_MMD = 0x1,
++	} access_capabilities;
++
++	/** @read: Perform a read transfer on the bus, offloading page access */
++	int (*read_paged)(struct mii_bus *bus, int addr, u16 page, int regnum);
++	/** @write: Perform a write transfer on the bus, offloading page access */
++	int (*write_paged)(struct mii_bus *bus, int addr, u16 page, int regnum, u16 val);
++	/** currently selected page when page access is offloaded
++	 * array should be PHY_MAX_ADDR+1size, but current design of the MDIO driver
++	 * uses port addresses as phy addresses and they are up to 6 bit.
++	 */
++	u16 selected_page[64];
+ };
+ #define to_mii_bus(d) container_of(d, struct mii_bus, dev)
+ 
+@@ -1795,6 +1812,66 @@ static inline int __phy_package_read(str
+ 	return __mdiobus_read(phydev->mdio.bus, shared->addr, regnum);
+ }
+ 
++static inline int phy_package_read_port(struct phy_device *phydev, u16 port, u32 regnum)
++{
++	struct phy_package_shared *shared = phydev->shared;
++
++	if (!shared)
++		return -EIO;
++
++	return mdiobus_read(phydev->mdio.bus, shared->addr + port, regnum);
++}
++
++static inline int __phy_package_read_port(struct phy_device *phydev, u16 port, u32 regnum)
++{
++	struct phy_package_shared *shared = phydev->shared;
++
++	if (!shared)
++		return -EIO;
++
++	return __mdiobus_read(phydev->mdio.bus, shared->addr + port, regnum);
++}
++
++static inline int phy_package_read_paged(struct phy_device *phydev, u16 page, u32 regnum)
++{
++	struct phy_package_shared *shared = phydev->shared;
++
++	if (!shared)
++		return -EIO;
++
++	return mdiobus_read_paged(phydev->mdio.bus, shared->addr, page, regnum);
++}
++
++static inline int __phy_package_read_paged(struct phy_device *phydev, u16 page, u32 regnum)
++{
++	struct phy_package_shared *shared = phydev->shared;
++
++	if (!shared)
++		return -EIO;
++
++	return __mdiobus_read_paged(phydev->mdio.bus, shared->addr, page, regnum);
++}
++
++static inline int phy_package_port_read_paged(struct phy_device *phydev, u16 port, u16 page, u32 regnum)
++{
++	struct phy_package_shared *shared = phydev->shared;
++
++	if (!shared)
++		return -EIO;
++
++	return mdiobus_read_paged(phydev->mdio.bus, shared->addr + port, page, regnum);
++}
++
++static inline int __phy_package_port_read_paged(struct phy_device *phydev, u16 port, u16 page, u32 regnum)
++{
++	struct phy_package_shared *shared = phydev->shared;
++
++	if (!shared)
++		return -EIO;
++
++	return __mdiobus_read_paged(phydev->mdio.bus, shared->addr + port, page, regnum);
++}
++
+ static inline int phy_package_write(struct phy_device *phydev,
+ 				    u32 regnum, u16 val)
+ {
+@@ -1817,6 +1894,72 @@ static inline int __phy_package_write(st
+ 	return __mdiobus_write(phydev->mdio.bus, shared->addr, regnum, val);
+ }
+ 
++static inline int phy_package_port_write(struct phy_device *phydev,
++				         u16 port, u32 regnum, u16 val)
++{
++	struct phy_package_shared *shared = phydev->shared;
++
++	if (!shared)
++		return -EIO;
++
++	return mdiobus_write(phydev->mdio.bus, shared->addr + port, regnum, val);
++}
++
++static inline int __phy_package_port_write(struct phy_device *phydev,
++				      u16 port, u32 regnum, u16 val)
++{
++	struct phy_package_shared *shared = phydev->shared;
++
++	if (!shared)
++		return -EIO;
++
++	return __mdiobus_write(phydev->mdio.bus, shared->addr + port, regnum, val);
++}
++
++static inline int phy_package_port_write_paged(struct phy_device *phydev,
++					u16 port, u16 page, u32 regnum, u16 val)
++{
++	struct phy_package_shared *shared = phydev->shared;
++
++	if (!shared)
++		return -EIO;
++
++	return mdiobus_write_paged(phydev->mdio.bus, shared->addr + port, page, regnum, val);
++}
++
++static inline int __phy_package_port_write_paged(struct phy_device *phydev,
++					u16 port, u16 page, u32 regnum, u16 val)
++{
++	struct phy_package_shared *shared = phydev->shared;
++
++	if (!shared)
++		return -EIO;
++
++	return __mdiobus_write_paged(phydev->mdio.bus, shared->addr + port, page, regnum, val);
++}
++
++static inline int phy_package_write_paged(struct phy_device *phydev,
++					  u16 page, u32 regnum, u16 val)
++{
++	struct phy_package_shared *shared = phydev->shared;
++
++	if (!shared)
++		return -EIO;
++
++	return mdiobus_write_paged(phydev->mdio.bus, shared->addr, page, regnum, val);
++}
++
++static inline int __phy_package_write_paged(struct phy_device *phydev,
++					  u16 page, u32 regnum, u16 val)
++{
++	struct phy_package_shared *shared = phydev->shared;
++
++	if (!shared)
++		return -EIO;
++
++	return __mdiobus_write_paged(phydev->mdio.bus, shared->addr, page, regnum, val);
++}
++
+ static inline bool __phy_package_set_once(struct phy_device *phydev,
+ 					  unsigned int b)
+ {
+--- a/include/uapi/linux/mii.h
++++ b/include/uapi/linux/mii.h
+@@ -36,6 +36,7 @@
+ #define MII_RESV2		0x1a	/* Reserved...                 */
+ #define MII_TPISTATUS		0x1b	/* TPI status for 10mbps       */
+ #define MII_NCONFIG		0x1c	/* Network interface config    */
++#define MII_MAINPAGE		0x1f	/* Page register               */
+ 
+ /* Basic mode control register. */
+ #define BMCR_RESV		0x003f	/* Unused...                   */
diff --git a/target/linux/realtek/rtl838x/config-5.15 b/target/linux/realtek/rtl838x/config-5.15
new file mode 100644
index 00000000000000..ad2c1b43cce8d7
--- /dev/null
+++ b/target/linux/realtek/rtl838x/config-5.15
@@ -0,0 +1,224 @@
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=4096
+# CONFIG_BMIPS_CPUFREQ is not set
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMMON_CLK_REALTEK=y
+CONFIG_COMMON_CLK_RTL83XX=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONSOLE_LOGLEVEL_DEFAULT=15
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CPU_FREQ=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+# CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_DIEI=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_RIXI=y
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_MIPS32=y
+# CONFIG_CPU_MIPS32_R1 is not set
+CONFIG_CPU_MIPS32_R2=y
+CONFIG_CPU_MIPSR2=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_CPUFREQ=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CPU_SUPPORTS_MSA=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_RNG2=y
+CONFIG_DEBUG_SECTION_MISMATCH=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_DTC=y
+CONFIG_EARLY_PRINTK=y
+CONFIG_EARLY_PRINTK_8250=y
+CONFIG_EXTRA_FIRMWARE="rtl838x_phy/rtl838x_8214fc.fw rtl838x_phy/rtl838x_8218b.fw rtl838x_phy/rtl838x_8380.fw"
+CONFIG_EXTRA_FIRMWARE_DIR="firmware"
+CONFIG_FIXED_PHY=y
+CONFIG_FORCE_MAX_ZONEORDER=13
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_PCA953X=y
+CONFIG_GPIO_PCA953X_IRQ=y
+CONFIG_GPIO_REALTEK_OTTO=y
+CONFIG_GPIO_RTL8231=y
+CONFIG_GPIO_WATCHDOG=y
+# CONFIG_GPIO_WATCHDOG_ARCH_INITCALL is not set
+CONFIG_GRO_CELLS=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDWARE_WATCHPOINTS=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HWMON=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_I2C=y
+CONFIG_I2C_ALGOBIT=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_GPIO=y
+CONFIG_I2C_MUX=y
+# CONFIG_I2C_MUX_RTL9300 is not set
+# CONFIG_I2C_RTL9300 is not set
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+CONFIG_JFFS2_ZLIB=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_MARVELL_PHY=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MDIO_I2C=y
+CONFIG_MDIO_SMBUS=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+# CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER is not set
+CONFIG_MIPS_CMDLINE_FROM_DTB=y
+CONFIG_MIPS_EBPF_JIT=y
+CONFIG_MIPS_EXTERNAL_TIMER=y
+CONFIG_MIPS_L1_CACHE_SHIFT=5
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+# CONFIG_MIPS_NO_APPENDED_DTB is not set
+CONFIG_MIPS_RAW_APPENDED_DTB=y
+CONFIG_MIPS_SPRAM=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_GEOMETRY=y
+CONFIG_MTD_CMDLINE_PARTS=y
+CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPLIT_BRNIMAGE_FW=y
+CONFIG_MTD_SPLIT_EVA_FW=y
+CONFIG_MTD_SPLIT_FIRMWARE=y
+CONFIG_MTD_SPLIT_H3C_VFS=y
+CONFIG_MTD_SPLIT_TPLINK_FW=y
+CONFIG_MTD_SPLIT_UIMAGE_FW=y
+CONFIG_MTD_VIRT_CONCAT=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_PER_CPU_KM=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_RTL83XX=y
+CONFIG_NET_DSA_TAG_TRAILER=y
+CONFIG_NET_RTL838X=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NO_EXCEPT_FILL=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_PCI_DRIVERS_LEGACY=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PINCTRL=y
+CONFIG_PM_OPP=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_GPIO_RESTART=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_RATIONAL=y
+CONFIG_REALTEK_OTTO_TIMER=y
+CONFIG_REALTEK_OTTO_WDT=y
+CONFIG_REALTEK_PHY=y
+CONFIG_REALTEK_SOC_PHY=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RTL838X=y
+# CONFIG_RTL839X is not set
+CONFIG_RTL83XX=y
+# CONFIG_RTL930X is not set
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SFP=y
+CONFIG_SPI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRAM=y
+CONFIG_SRCU=y
+CONFIG_SWPHY=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYS_HAS_CPU_MIPS32_R1=y
+CONFIG_SYS_HAS_CPU_MIPS32_R2=y
+CONFIG_SYS_HAS_EARLY_PRINTK=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+CONFIG_SYS_SUPPORTS_HIGHMEM=y
+CONFIG_SYS_SUPPORTS_MIPS16=y
+CONFIG_TARGET_ISA_REV=2
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TINY_SRCU=y
+CONFIG_USE_GENERIC_EARLY_PRINTK_8250=y
+CONFIG_USE_OF=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
diff --git a/target/linux/realtek/rtl838x/target.mk b/target/linux/realtek/rtl838x/target.mk
index ee658ea9862f20..e776676f663d42 100644
--- a/target/linux/realtek/rtl838x/target.mk
+++ b/target/linux/realtek/rtl838x/target.mk
@@ -5,11 +5,8 @@ CPU_TYPE:=4kec
 BOARD:=realtek
 BOARDNAME:=Realtek MIPS RTL838X
 
-KERNEL_PATCHVER:=5.10
-
 define Target/Description
 	Build firmware images for Realtek RTL838x based boards.
 endef
 
 FEATURES := $(filter-out mips16,$(FEATURES))
-
diff --git a/target/linux/realtek/rtl839x/config-5.15 b/target/linux/realtek/rtl839x/config-5.15
new file mode 100644
index 00000000000000..5fa52ba882eed3
--- /dev/null
+++ b/target/linux/realtek/rtl839x/config-5.15
@@ -0,0 +1,241 @@
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=4096
+# CONFIG_BMIPS_CPUFREQ is not set
+CONFIG_CLKDEV_LOOKUP=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMMON_CLK_REALTEK=y
+CONFIG_COMMON_CLK_RTL83XX=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONSOLE_LOGLEVEL_DEFAULT=15
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CPU_FREQ=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+# CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_DIEI=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_RIXI=y
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_MIPS32=y
+# CONFIG_CPU_MIPS32_R1 is not set
+CONFIG_CPU_MIPS32_R2=y
+CONFIG_CPU_MIPSR2=y
+CONFIG_CPU_MIPSR2_IRQ_EI=y
+CONFIG_CPU_MIPSR2_IRQ_VI=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_CPUFREQ=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CPU_SUPPORTS_MSA=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_RNG2=y
+CONFIG_DEBUG_SECTION_MISMATCH=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_DTC=y
+CONFIG_EARLY_PRINTK=y
+CONFIG_EARLY_PRINTK_8250=y
+CONFIG_FIXED_PHY=y
+CONFIG_FORCE_MAX_ZONEORDER=13
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_PCA953X=y
+CONFIG_GPIO_PCA953X_IRQ=y
+CONFIG_GPIO_REALTEK_OTTO=y
+CONFIG_GPIO_RTL8231=y
+CONFIG_GRO_CELLS=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDWARE_WATCHPOINTS=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HWMON=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_I2C=y
+CONFIG_I2C_ALGOBIT=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_GPIO=y
+# CONFIG_I2C_RTL9300 is not set
+# CONFIG_I2C_MUX_RTL9300 is not set
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+CONFIG_JFFS2_ZLIB=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_MARVELL_PHY=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MDIO_I2C=y
+CONFIG_MDIO_SMBUS=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+CONFIG_MIPS_CLOCK_VSYSCALL=y
+# CONFIG_MIPS_CMDLINE_DTB_EXTEND is not set
+# CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER is not set
+CONFIG_MIPS_CMDLINE_FROM_DTB=y
+CONFIG_MIPS_EBPF_JIT=y
+CONFIG_MIPS_EXTERNAL_TIMER=y
+CONFIG_MIPS_L1_CACHE_SHIFT=5
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+CONFIG_MIPS_MT=y
+# CONFIG_MIPS_MT_FPAFF is not set
+CONFIG_MIPS_MT_SMP=y
+# CONFIG_MIPS_NO_APPENDED_DTB is not set
+CONFIG_MIPS_NR_CPU_NR_MAP=2
+CONFIG_MIPS_PERF_SHARED_TC_COUNTERS=y
+CONFIG_MIPS_RAW_APPENDED_DTB=y
+CONFIG_MIPS_SPRAM=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_GEOMETRY=y
+CONFIG_MTD_CMDLINE_PARTS=y
+CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPLIT_BRNIMAGE_FW=y
+CONFIG_MTD_SPLIT_EVA_FW=y
+CONFIG_MTD_SPLIT_FIRMWARE=y
+CONFIG_MTD_SPLIT_TPLINK_FW=y
+CONFIG_MTD_SPLIT_UIMAGE_FW=y
+CONFIG_MTD_VIRT_CONCAT=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_RTL83XX=y
+CONFIG_NET_DSA_TAG_TRAILER=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_RTL838X=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NO_EXCEPT_FILL=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+CONFIG_NR_CPUS=2
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_PADATA=y
+CONFIG_PCI_DRIVERS_LEGACY=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PINCTRL=y
+CONFIG_PM_OPP=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_GPIO_RESTART=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RATIONAL=y
+CONFIG_REALTEK_OTTO_TIMER=y
+CONFIG_REALTEK_OTTO_WDT=y
+CONFIG_REALTEK_PHY=y
+CONFIG_REALTEK_SOC_PHY=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+# CONFIG_RTL838X is not set
+CONFIG_RTL839X=y
+CONFIG_RTL83XX=y
+# CONFIG_RTL930X is not set
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SFP=y
+CONFIG_SMP=y
+CONFIG_SMP_UP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SPI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRAM=y
+CONFIG_SRCU=y
+CONFIG_SWPHY=y
+CONFIG_SYNC_R4K=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYS_HAS_CPU_MIPS32_R1=y
+CONFIG_SYS_HAS_CPU_MIPS32_R2=y
+CONFIG_SYS_HAS_EARLY_PRINTK=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+CONFIG_SYS_SUPPORTS_HIGHMEM=y
+CONFIG_SYS_SUPPORTS_MIPS16=y
+CONFIG_SYS_SUPPORTS_MULTITHREADING=y
+CONFIG_SYS_SUPPORTS_SCHED_SMT=y
+CONFIG_SYS_SUPPORTS_SMP=y
+CONFIG_TARGET_ISA_REV=2
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TINY_SRCU=y
+CONFIG_USE_GENERIC_EARLY_PRINTK_8250=y
+CONFIG_USE_OF=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_XPS=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
diff --git a/target/linux/realtek/rtl839x/target.mk b/target/linux/realtek/rtl839x/target.mk
index 0bbd6a5d4a1ae5..b2f4e9c0dd260d 100644
--- a/target/linux/realtek/rtl839x/target.mk
+++ b/target/linux/realtek/rtl839x/target.mk
@@ -5,9 +5,6 @@ CPU_TYPE:=24kc
 BOARD:=realtek
 BOARDNAME:=Realtek MIPS RTL839X
 
-KERNEL_PATCHVER:=5.10
-
 define Target/Description
 	Build firmware images for Realtek RTL839x based boards.
 endef
-
diff --git a/target/linux/realtek/rtl930x/config-5.15 b/target/linux/realtek/rtl930x/config-5.15
new file mode 100644
index 00000000000000..af5f2ca7a313b4
--- /dev/null
+++ b/target/linux/realtek/rtl930x/config-5.15
@@ -0,0 +1,205 @@
+CONFIG_AQUANTIA_PHY=y
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BOARD_SCACHE=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+# CONFIG_COMMON_CLK_REALTEK is not set
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONSOLE_LOGLEVEL_DEFAULT=15
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_DIEI=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_RIXI=y
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_MIPS32=y
+# CONFIG_CPU_MIPS32_R1 is not set
+CONFIG_CPU_MIPS32_R2=y
+CONFIG_CPU_MIPSR2=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CPU_SUPPORTS_MSA=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_RNG2=y
+CONFIG_DEBUG_SECTION_MISMATCH=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_DTC=y
+CONFIG_EARLY_PRINTK=y
+CONFIG_EARLY_PRINTK_8250=y
+CONFIG_FIXED_PHY=y
+CONFIG_FORCE_MAX_ZONEORDER=13
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_PCA953X=y
+CONFIG_GPIO_REALTEK_OTTO=y
+CONFIG_GPIO_RTL8231=y
+CONFIG_GRO_CELLS=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDWARE_WATCHPOINTS=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HWMON=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_I2C=y
+CONFIG_I2C_ALGOBIT=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_GPIO=y
+CONFIG_I2C_MUX=y
+CONFIG_I2C_MUX_RTL9300=y
+CONFIG_I2C_RTL9300=y
+CONFIG_I2C_SMBUS=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+CONFIG_JFFS2_ZLIB=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_MARVELL_PHY=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MDIO_I2C=y
+CONFIG_MDIO_SMBUS=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+# CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER is not set
+CONFIG_MIPS_CMDLINE_FROM_DTB=y
+CONFIG_MIPS_CPU_SCACHE=y
+CONFIG_MIPS_EBPF_JIT=y
+CONFIG_MIPS_EXTERNAL_TIMER=y
+CONFIG_MIPS_L1_CACHE_SHIFT=5
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+# CONFIG_MIPS_MT_SMP is not set
+# CONFIG_MIPS_NO_APPENDED_DTB is not set
+CONFIG_MIPS_RAW_APPENDED_DTB=y
+CONFIG_MIPS_SPRAM=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_GEOMETRY=y
+CONFIG_MTD_CMDLINE_PARTS=y
+CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPLIT_BRNIMAGE_FW=y
+CONFIG_MTD_SPLIT_EVA_FW=y
+CONFIG_MTD_SPLIT_FIRMWARE=y
+CONFIG_MTD_SPLIT_TPLINK_FW=y
+CONFIG_MTD_SPLIT_UIMAGE_FW=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_PER_CPU_KM=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_RTL83XX=y
+CONFIG_NET_DSA_TAG_TRAILER=y
+CONFIG_NET_RTL838X=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NO_EXCEPT_FILL=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_PCI_DRIVERS_LEGACY=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PINCTRL=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_GPIO_RESTART=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_RATIONAL=y
+CONFIG_REALTEK_OTTO_TIMER=y
+CONFIG_REALTEK_OTTO_WDT=y
+CONFIG_REALTEK_PHY=y
+CONFIG_REALTEK_SOC_PHY=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RESET_CONTROLLER=y
+# CONFIG_RTL838X is not set
+# CONFIG_RTL839X is not set
+CONFIG_RTL83XX=y
+CONFIG_RTL930X=y
+# CONFIG_RTL931X is not set
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SFP=y
+CONFIG_SPI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRCU=y
+CONFIG_SWPHY=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYS_HAS_CPU_MIPS32_R1=y
+CONFIG_SYS_HAS_CPU_MIPS32_R2=y
+CONFIG_SYS_HAS_EARLY_PRINTK=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+CONFIG_SYS_SUPPORTS_HIGHMEM=y
+CONFIG_SYS_SUPPORTS_MIPS16=y
+CONFIG_SYS_SUPPORTS_MULTITHREADING=y
+CONFIG_TARGET_ISA_REV=2
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TINY_SRCU=y
+CONFIG_USE_GENERIC_EARLY_PRINTK_8250=y
+CONFIG_USE_OF=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
diff --git a/target/linux/realtek/rtl930x/target.mk b/target/linux/realtek/rtl930x/target.mk
index f6f204d0063896..a2b95f4db9beba 100644
--- a/target/linux/realtek/rtl930x/target.mk
+++ b/target/linux/realtek/rtl930x/target.mk
@@ -5,9 +5,6 @@ CPU_TYPE:=24kc
 BOARD:=realtek
 BOARDNAME:=Realtek MIPS RTL930X
 
-KERNEL_PATCHVER:=5.10
-
 define Target/Description
 	Build firmware images for Realtek RTL930x based boards.
 endef
-
diff --git a/target/linux/realtek/rtl931x/config-5.15 b/target/linux/realtek/rtl931x/config-5.15
new file mode 100644
index 00000000000000..2da27941c74c39
--- /dev/null
+++ b/target/linux/realtek/rtl931x/config-5.15
@@ -0,0 +1,241 @@
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BOARD_SCACHE=y
+CONFIG_CEVT_RTL9300=y
+CONFIG_CLKSRC_MIPS_GIC=y
+CONFIG_CLOCKSOURCE_WATCHDOG=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+# CONFIG_COMMON_CLK_REALTEK is not set
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONSOLE_LOGLEVEL_DEFAULT=15
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_DIEI=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_RIXI=y
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_MIPS32=y
+# CONFIG_CPU_MIPS32_R1 is not set
+CONFIG_CPU_MIPS32_R2=y
+CONFIG_CPU_MIPSR2=y
+CONFIG_CPU_MIPSR2_IRQ_EI=y
+CONFIG_CPU_MIPSR2_IRQ_VI=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CPU_SUPPORTS_MSA=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CSRC_R4K=y
+CONFIG_DEBUG_SECTION_MISMATCH=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_DTC=y
+CONFIG_EARLY_PRINTK=y
+CONFIG_EARLY_PRINTK_8250=y
+CONFIG_FIXED_PHY=y
+CONFIG_FORCE_MAX_ZONEORDER=13
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_REALTEK_OTTO=y
+CONFIG_GPIO_RTL8231=y
+CONFIG_GRO_CELLS=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDWARE_WATCHPOINTS=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HIGHMEM=y
+CONFIG_HWMON=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_I2C=y
+CONFIG_I2C_ALGOBIT=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_GPIO=y
+CONFIG_I2C_MUX=y
+CONFIG_I2C_MUX_RTL9300=y
+CONFIG_I2C_RTL9300=y
+CONFIG_I2C_SMBUS=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+CONFIG_JFFS2_ZLIB=y
+CONFIG_KMAP_LOCAL=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_MARVELL_PHY=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MDIO_I2C=y
+CONFIG_MDIO_SMBUS=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+CONFIG_MIPS_CLOCK_VSYSCALL=y
+CONFIG_MIPS_CM=y
+# CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER is not set
+CONFIG_MIPS_CMDLINE_FROM_DTB=y
+CONFIG_MIPS_CPC=y
+CONFIG_MIPS_CPS=y
+# CONFIG_MIPS_CPS_NS16550_BOOL is not set
+CONFIG_MIPS_CPU_SCACHE=y
+CONFIG_MIPS_EBPF_JIT=y
+CONFIG_MIPS_GIC=y
+CONFIG_MIPS_L1_CACHE_SHIFT=5
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+CONFIG_MIPS_MT=y
+CONFIG_MIPS_MT_FPAFF=y
+CONFIG_MIPS_MT_SMP=y
+# CONFIG_MIPS_NO_APPENDED_DTB is not set
+CONFIG_MIPS_NR_CPU_NR_MAP=2
+CONFIG_MIPS_PERF_SHARED_TC_COUNTERS=y
+CONFIG_MIPS_RAW_APPENDED_DTB=y
+CONFIG_MIPS_SPRAM=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_GEOMETRY=y
+CONFIG_MTD_CMDLINE_PARTS=y
+CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPLIT_BRNIMAGE_FW=y
+CONFIG_MTD_SPLIT_EVA_FW=y
+CONFIG_MTD_SPLIT_FIRMWARE=y
+CONFIG_MTD_SPLIT_TPLINK_FW=y
+CONFIG_MTD_SPLIT_UIMAGE_FW=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_RTL83XX=y
+CONFIG_NET_DSA_TAG_TRAILER=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_RTL838X=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NO_EXCEPT_FILL=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+CONFIG_NR_CPUS=2
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_PADATA=y
+CONFIG_PCI_DRIVERS_LEGACY=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PINCTRL=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RATIONAL=y
+# CONFIG_REALTEK_OTTO_TIMER is not set
+CONFIG_REALTEK_OTTO_WDT=y
+# CONFIG_REALTEK_PHY is not set
+CONFIG_REALTEK_SOC_PHY=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+# CONFIG_RTL838X is not set
+# CONFIG_RTL839X is not set
+CONFIG_RTL83XX=y
+CONFIG_RTL930X=y
+CONFIG_RTL931X=y
+CONFIG_SENSORS_GPIO_FAN=y
+CONFIG_SENSORS_LM75=y
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SFP=y
+CONFIG_SMP=y
+CONFIG_SMP_UP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SPI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SRCU=y
+CONFIG_SWPHY=y
+CONFIG_SYNC_R4K=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYS_HAS_CPU_MIPS32_R1=y
+CONFIG_SYS_HAS_CPU_MIPS32_R2=y
+CONFIG_SYS_HAS_EARLY_PRINTK=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+CONFIG_SYS_SUPPORTS_HIGHMEM=y
+CONFIG_SYS_SUPPORTS_HOTPLUG_CPU=y
+CONFIG_SYS_SUPPORTS_MIPS16=y
+CONFIG_SYS_SUPPORTS_MIPS_CPS=y
+CONFIG_SYS_SUPPORTS_MULTITHREADING=y
+CONFIG_SYS_SUPPORTS_SCHED_SMT=y
+CONFIG_SYS_SUPPORTS_SMP=y
+CONFIG_SYS_SUPPORTS_VPE_LOADER=y
+CONFIG_TARGET_ISA_REV=2
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_USE_GENERIC_EARLY_PRINTK_8250=y
+CONFIG_USE_OF=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_WEAK_ORDERING=y
+CONFIG_XPS=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
diff --git a/target/linux/realtek/rtl931x/target.mk b/target/linux/realtek/rtl931x/target.mk
index 39892e548428d7..eaa6b61214ca1a 100644
--- a/target/linux/realtek/rtl931x/target.mk
+++ b/target/linux/realtek/rtl931x/target.mk
@@ -5,8 +5,6 @@ CPU_TYPE:=24kc
 BOARD:=realtek
 BOARDNAME:=Realtek MIPS RTL931X
 
-KERNEL_PATCHVER:=5.10
-
 define Target/Description
 	Build firmware images for Realtek RTL931x based boards.
 endef
diff --git a/target/linux/rockchip/Makefile b/target/linux/rockchip/Makefile
index 1fbd4983da1955..f17f0bdf49085c 100644
--- a/target/linux/rockchip/Makefile
+++ b/target/linux/rockchip/Makefile
@@ -7,8 +7,8 @@ BOARDNAME:=Rockchip
 FEATURES:=ext4 audio usb usbgadget display gpio fpu pci pcie rootfs-part boot-part squashfs
 SUBTARGETS:=armv8
 
-KERNEL_PATCHVER:=5.10
-KERNEL_TESTING_PATCHVER:=5.15
+KERNEL_PATCHVER:=5.15
+KERNEL_TESTING_PATCHVER:=6.1
 
 define Target/Description
 	Build firmware image for Rockchip SoC devices.
diff --git a/target/linux/rockchip/armv8/base-files/etc/board.d/01_leds b/target/linux/rockchip/armv8/base-files/etc/board.d/01_leds
index b10c43ba6052ec..d82e47cf538f54 100644
--- a/target/linux/rockchip/armv8/base-files/etc/board.d/01_leds
+++ b/target/linux/rockchip/armv8/base-files/etc/board.d/01_leds
@@ -8,11 +8,11 @@ boardname="${board##*,}"
 board_config_update
 
 case $board in
-friendlyarm,nanopi-r2s)
-	ucidef_set_led_netdev "wan" "WAN" "$boardname:green:wan" "eth0"
-	ucidef_set_led_netdev "lan" "LAN" "$boardname:green:lan" "eth1"
-	;;
-friendlyarm,nanopi-r4s)
+friendlyarm,nanopi-r2c|\
+friendlyarm,nanopi-r2s|\
+friendlyarm,nanopi-r4s|\
+xunlong,orangepi-r1-plus|\
+xunlong,orangepi-r1-plus-lts)
 	ucidef_set_led_netdev "wan" "WAN" "green:wan" "eth0"
 	ucidef_set_led_netdev "lan" "LAN" "green:lan" "eth1"
 	;;
diff --git a/target/linux/rockchip/armv8/base-files/etc/board.d/02_network b/target/linux/rockchip/armv8/base-files/etc/board.d/02_network
index b0e64799471c5c..7ac5148275a4d7 100644
--- a/target/linux/rockchip/armv8/base-files/etc/board.d/02_network
+++ b/target/linux/rockchip/armv8/base-files/etc/board.d/02_network
@@ -7,8 +7,11 @@ rockchip_setup_interfaces()
 	local board="$1"
 
 	case "$board" in
+	friendlyarm,nanopi-r2c|\
 	friendlyarm,nanopi-r2s|\
-	friendlyarm,nanopi-r4s)
+	friendlyarm,nanopi-r4s|\
+	xunlong,orangepi-r1-plus|\
+	xunlong,orangepi-r1-plus-lts)
 		ucidef_set_interfaces_lan_wan 'eth1' 'eth0'
 		;;
 	*)
@@ -17,15 +20,6 @@ rockchip_setup_interfaces()
 	esac
 }
 
-generate_mac_from_mmc_cid()
-{
-	local mmc_dev=$1
-
-	local sd_hash=$(sha256sum /sys/class/block/$mmc_dev/device/cid)
-	local mac_base=$(macaddr_canonicalize "$(echo "${sd_hash}" | dd bs=1 count=12 2>/dev/null)")
-	echo "$(macaddr_unsetbit_mc "$(macaddr_setbit_la "${mac_base}")")"
-}
-
 nanopi_r4s_get_mac()
 {
 	local interface=$1
@@ -38,7 +32,7 @@ nanopi_r4s_get_mac()
 			address=$(macaddr_setbit_la "$address")
 		fi
 	else
-		address=$(generate_mac_from_mmc_cid mmcblk1)
+		address=$(macaddr_generate_from_mmc_cid mmcblk1)
 		if [ "$interface" = "lan" ]; then
 			address=$(macaddr_add "$address" 1)
 		fi
@@ -55,14 +49,19 @@ rockchip_setup_macs()
 	local label_mac=""
 
 	case "$board" in
+	friendlyarm,nanopi-r2c|\
 	friendlyarm,nanopi-r2s)
-		wan_mac=$(generate_mac_from_mmc_cid mmcblk0)
+		wan_mac=$(macaddr_generate_from_mmc_cid mmcblk0)
 		lan_mac=$(macaddr_add "$wan_mac" 1)
 		;;
 	friendlyarm,nanopi-r4s)
 		wan_mac=$(nanopi_r4s_get_mac wan)
 		lan_mac=$(nanopi_r4s_get_mac lan)
 		;;
+	xunlong,orangepi-r1-plus|\
+	xunlong,orangepi-r1-plus-lts)
+		wan_mac=$(macaddr_add "$(cat /sys/class/net/eth1/address)" -1)
+		;;
 	esac
 
 	[ -n "$lan_mac" ] && ucidef_set_interface_macaddr "lan" $lan_mac
diff --git a/target/linux/rockchip/armv8/base-files/etc/hotplug.d/net/40-net-smp-affinity b/target/linux/rockchip/armv8/base-files/etc/hotplug.d/net/40-net-smp-affinity
index c76e62a23a347b..bb119b9185ebab 100644
--- a/target/linux/rockchip/armv8/base-files/etc/hotplug.d/net/40-net-smp-affinity
+++ b/target/linux/rockchip/armv8/base-files/etc/hotplug.d/net/40-net-smp-affinity
@@ -29,7 +29,10 @@ set_interface_core() {
 }
 
 case "$(board_name)" in
-friendlyarm,nanopi-r2s)
+friendlyarm,nanopi-r2c|\
+friendlyarm,nanopi-r2s|\
+xunlong,orangepi-r1-plus|\
+xunlong,orangepi-r1-plus-lts)
 	set_interface_core 2 "eth0"
 	set_interface_core 4 "eth1" "xhci-hcd:usb3"
 	;;
diff --git a/target/linux/rockchip/armv8/config-5.15 b/target/linux/rockchip/armv8/config-5.15
index fa005294bca94a..08ce65d8eafb68 100644
--- a/target/linux/rockchip/armv8/config-5.15
+++ b/target/linux/rockchip/armv8/config-5.15
@@ -28,9 +28,9 @@ CONFIG_ARM64_ERRATUM_832075=y
 CONFIG_ARM64_ERRATUM_843419=y
 CONFIG_ARM64_ERRATUM_845719=y
 CONFIG_ARM64_ERRATUM_858921=y
+CONFIG_ARM64_ERRATUM_1742098=y
 CONFIG_ARM64_HW_AFDBM=y
 CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
-CONFIG_ARM64_MODULE_PLTS=y
 CONFIG_ARM64_PAGE_SHIFT=12
 CONFIG_ARM64_PAN=y
 CONFIG_ARM64_PA_BITS=48
@@ -39,7 +39,6 @@ CONFIG_ARM64_PTR_AUTH=y
 CONFIG_ARM64_PTR_AUTH_KERNEL=y
 CONFIG_ARM64_RAS_EXTN=y
 CONFIG_ARM64_SVE=y
-# CONFIG_ARM64_SW_TTBR0_PAN is not set
 CONFIG_ARM64_TAGGED_ADDR_ABI=y
 CONFIG_ARM64_VA_BITS=48
 # CONFIG_ARM64_VA_BITS_39 is not set
@@ -115,11 +114,7 @@ CONFIG_COMMON_CLK=y
 CONFIG_COMMON_CLK_RK808=y
 CONFIG_COMMON_CLK_ROCKCHIP=y
 CONFIG_COMMON_CLK_SCPI=y
-CONFIG_COMPAT=y
 CONFIG_COMPAT_32BIT_TIME=y
-CONFIG_COMPAT_BINFMT_ELF=y
-CONFIG_COMPAT_NETLINK_MESSAGES=y
-CONFIG_COMPAT_OLD_SIGACTION=y
 CONFIG_CONFIGFS_FS=y
 CONFIG_CONSOLE_TRANSLATIONS=y
 CONFIG_CONTIG_ALLOC=y
@@ -140,6 +135,7 @@ CONFIG_CPU_IDLE=y
 CONFIG_CPU_IDLE_GOV_MENU=y
 CONFIG_CPU_IDLE_MULTIPLE_DRIVERS=y
 CONFIG_CPU_ISOLATION=y
+CONFIG_CPU_LITTLE_ENDIAN=y
 CONFIG_CPU_PM=y
 CONFIG_CPU_RMAP=y
 CONFIG_CPU_THERMAL=y
@@ -154,13 +150,14 @@ CONFIG_CRYPTO_AES_ARM64=y
 CONFIG_CRYPTO_AES_ARM64_CE=y
 CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
 CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
-CONFIG_CRYPTO_BLAKE2S=y
 CONFIG_CRYPTO_CRC32=y
 CONFIG_CRYPTO_CRC32C=y
 CONFIG_CRYPTO_CRCT10DIF=y
 CONFIG_CRYPTO_CRCT10DIF_ARM64_CE=y
 CONFIG_CRYPTO_CRYPTD=y
+# CONFIG_CRYPTO_DEV_ROCKCHIP is not set
 CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_HW=y
 CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
 CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_SIMD=y
@@ -189,6 +186,7 @@ CONFIG_DUMMY_CONSOLE=y
 CONFIG_DWMAC_DWC_QOS_ETH=y
 CONFIG_DWMAC_GENERIC=y
 CONFIG_DWMAC_ROCKCHIP=y
+CONFIG_DW_WATCHDOG=y
 CONFIG_EDAC_SUPPORT=y
 CONFIG_EEPROM_AT24=y
 CONFIG_EMAC_ROCKCHIP=y
@@ -203,7 +201,6 @@ CONFIG_FIXED_PHY=y
 CONFIG_FIX_EARLYCON_MEM=y
 # CONFIG_FORTIFY_SOURCE is not set
 CONFIG_FRAME_POINTER=y
-CONFIG_FRAME_WARN=2048
 CONFIG_FS_IOMAP=y
 CONFIG_FS_MBCACHE=y
 CONFIG_FS_POSIX_ACL=y
@@ -244,8 +241,8 @@ CONFIG_GPIO_DWAPB=y
 CONFIG_GPIO_GENERIC=y
 CONFIG_GPIO_GENERIC_PLATFORM=y
 CONFIG_GPIO_ROCKCHIP=y
+CONFIG_GPIO_SYSCON=y
 CONFIG_HANDLE_DOMAIN_IRQ=y
-# CONFIG_HARDENED_USERCOPY is not set
 CONFIG_HARDIRQS_SW_RESEND=y
 CONFIG_HAS_DMA=y
 CONFIG_HAS_IOMEM=y
@@ -268,6 +265,7 @@ CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_COMPAT=y
 CONFIG_I2C_HELPER_AUTO=y
 CONFIG_I2C_RK3X=y
+CONFIG_IIO=y
 CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
 CONFIG_INDIRECT_PIO=y
 CONFIG_INPUT=y
@@ -276,10 +274,9 @@ CONFIG_INPUT_FF_MEMLESS=y
 CONFIG_INPUT_KEYBOARD=y
 CONFIG_INPUT_LEDS=y
 CONFIG_INPUT_MATRIXKMAP=y
+# CONFIG_INPUT_RK805_PWRKEY is not set
 CONFIG_IOMMU_API=y
 # CONFIG_IOMMU_DEBUGFS is not set
-# CONFIG_IOMMU_DEFAULT_DMA_LAZY is not set
-# CONFIG_IOMMU_DEFAULT_DMA_STRICT is not set
 CONFIG_IOMMU_DEFAULT_PASSTHROUGH=y
 CONFIG_IOMMU_DMA=y
 CONFIG_IOMMU_IOVA=y
@@ -289,7 +286,6 @@ CONFIG_IOMMU_IO_PGTABLE_LPAE=y
 # CONFIG_IOMMU_IO_PGTABLE_LPAE_SELFTEST is not set
 CONFIG_IOMMU_SUPPORT=y
 # CONFIG_IO_STRICT_DEVMEM is not set
-CONFIG_IO_URING=y
 CONFIG_IRQCHIP=y
 CONFIG_IRQ_DOMAIN=y
 CONFIG_IRQ_DOMAIN_HIERARCHY=y
@@ -301,6 +297,7 @@ CONFIG_JBD2=y
 CONFIG_JFFS2_ZLIB=y
 CONFIG_JUMP_LABEL=y
 CONFIG_KALLSYMS=y
+CONFIG_KCMP=y
 CONFIG_KEXEC_CORE=y
 CONFIG_KEXEC_FILE=y
 CONFIG_KSM=y
@@ -310,8 +307,6 @@ CONFIG_LEDS_PWM=y
 CONFIG_LEDS_SYSCON=y
 CONFIG_LEDS_TRIGGER_CPU=y
 CONFIG_LEDS_TRIGGER_PANIC=y
-CONFIG_LEGACY_PTYS=y
-CONFIG_LEGACY_PTY_COUNT=16
 CONFIG_LIBCRC32C=y
 CONFIG_LIBFDT=y
 CONFIG_LOCALVERSION_AUTO=y
@@ -353,6 +348,7 @@ CONFIG_MMC_SDHCI_OF_DWCMSHC=y
 # CONFIG_MMC_SDHCI_PCI is not set
 CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MODULES_USE_ELF_RELA=y
+CONFIG_MOTORCOMM_PHY=y
 CONFIG_MQ_IOSCHED_DEADLINE=y
 # CONFIG_MTD_CFI is not set
 CONFIG_MTD_CMDLINE_PARTS=y
@@ -364,6 +360,7 @@ CONFIG_MUTEX_SPIN_ON_OWNER=y
 CONFIG_NEED_DMA_MAP_STATE=y
 CONFIG_NEED_SG_DMA_LENGTH=y
 CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_PTP_CLASSIFY=y
 CONFIG_NET_SELFTESTS=y
 CONFIG_NLS=y
 CONFIG_NLS_ISO8859_1=y
@@ -372,6 +369,8 @@ CONFIG_NO_HZ_COMMON=y
 CONFIG_NO_HZ_IDLE=y
 CONFIG_NR_CPUS=256
 CONFIG_NVMEM=y
+CONFIG_NVMEM_ROCKCHIP_EFUSE=y
+# CONFIG_NVMEM_ROCKCHIP_OTP is not set
 CONFIG_NVMEM_SYSFS=y
 CONFIG_NVME_CORE=y
 # CONFIG_NVME_HWMON is not set
@@ -405,9 +404,11 @@ CONFIG_PCIEASPM_DEFAULT=y
 # CONFIG_PCIEASPM_POWERSAVE is not set
 # CONFIG_PCIEASPM_POWER_SUPERSAVE is not set
 CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_DW=y
+CONFIG_PCIE_DW_HOST=y
 CONFIG_PCIE_PME=y
 CONFIG_PCIE_ROCKCHIP=y
-# CONFIG_PCIE_ROCKCHIP_DW_HOST is not set
+CONFIG_PCIE_ROCKCHIP_DW_HOST=y
 CONFIG_PCIE_ROCKCHIP_HOST=y
 CONFIG_PCI_DOMAINS=y
 CONFIG_PCI_DOMAINS_GENERIC=y
@@ -430,7 +431,7 @@ CONFIG_PHY_ROCKCHIP_PCIE=y
 CONFIG_PHY_ROCKCHIP_TYPEC=y
 CONFIG_PHY_ROCKCHIP_USB=y
 CONFIG_PINCTRL=y
-# CONFIG_PINCTRL_RK805 is not set
+CONFIG_PINCTRL_RK805=y
 CONFIG_PINCTRL_ROCKCHIP=y
 # CONFIG_PINCTRL_SINGLE is not set
 CONFIG_PL330_DMA=y
@@ -445,6 +446,7 @@ CONFIG_PM_OPP=y
 CONFIG_POWER_RESET=y
 CONFIG_POWER_SUPPLY=y
 CONFIG_POWER_SUPPLY_HWMON=y
+CONFIG_PPS=y
 CONFIG_PREEMPT=y
 CONFIG_PREEMPTION=y
 CONFIG_PREEMPT_COUNT=y
@@ -454,6 +456,7 @@ CONFIG_PRINTK_TIME=y
 # CONFIG_PRINT_QUOTA_WARNING is not set
 CONFIG_PROC_PAGE_MONITOR=y
 CONFIG_PROC_VMCORE=y
+CONFIG_PTP_1588_CLOCK=y
 CONFIG_PTP_1588_CLOCK_OPTIONAL=y
 CONFIG_PWM=y
 CONFIG_PWM_ROCKCHIP=y
@@ -484,14 +487,13 @@ CONFIG_REGULATOR_RK808=y
 CONFIG_RELOCATABLE=y
 CONFIG_RESET_CONTROLLER=y
 CONFIG_RFS_ACCEL=y
-CONFIG_ROCKCHIP_EFUSE=y
 CONFIG_ROCKCHIP_GRF=y
 CONFIG_ROCKCHIP_IODOMAIN=y
 CONFIG_ROCKCHIP_IOMMU=y
 CONFIG_ROCKCHIP_MBOX=y
-# CONFIG_ROCKCHIP_OTP is not set
 CONFIG_ROCKCHIP_PHY=y
 CONFIG_ROCKCHIP_PM_DOMAINS=y
+# CONFIG_ROCKCHIP_SARADC is not set
 CONFIG_ROCKCHIP_THERMAL=y
 CONFIG_ROCKCHIP_TIMER=y
 CONFIG_RODATA_FULL_DEFAULT_ENABLED=y
@@ -584,6 +586,7 @@ CONFIG_TICK_CPU_ACCOUNTING=y
 CONFIG_TIMER_OF=y
 CONFIG_TIMER_PROBE=y
 CONFIG_TRACE_CLOCK=y
+CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y
 CONFIG_TRANSPARENT_HUGEPAGE=y
 CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y
 # CONFIG_TRANSPARENT_HUGEPAGE_MADVISE is not set
@@ -629,7 +632,7 @@ CONFIG_VM_EVENT_COUNTERS=y
 CONFIG_VT=y
 CONFIG_VT_CONSOLE=y
 CONFIG_VT_HW_CONSOLE_BINDING=y
-# CONFIG_WATCHDOG is not set
+CONFIG_WATCHDOG_CORE=y
 CONFIG_XARRAY_MULTI=y
 CONFIG_XPS=y
 CONFIG_XXHASH=y
@@ -639,10 +642,3 @@ CONFIG_XZ_DEC_BCJ=y
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_INFLATE=y
 CONFIG_ZONE_DMA32=y
-# CONFIG_DRM_ROCKCHIP is not set
-# CONFIG_SND_SOC_ROCKCHIP is not set
-# CONFIG_SND_SOC_RK817 is not set
-# CONFIG_INPUT_RK805_PWRKEY is not set
-# CONFIG_VIDEO_ROCKCHIP_ISP1 is not set
-# CONFIG_ROCKCHIP_SARADC is not set
-# CONFIG_CRYPTO_DEV_ROCKCHIP is not set
diff --git a/target/linux/rockchip/armv8/config-6.1 b/target/linux/rockchip/armv8/config-6.1
new file mode 100644
index 00000000000000..4d747537e238c5
--- /dev/null
+++ b/target/linux/rockchip/armv8/config-6.1
@@ -0,0 +1,690 @@
+CONFIG_64BIT=y
+CONFIG_ARCH_BINFMT_ELF_EXTRA_PHDRS=y
+CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_ARCH_FORCE_MAX_ORDER=11
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
+CONFIG_ARCH_MMAP_RND_BITS=18
+CONFIG_ARCH_MMAP_RND_BITS_MAX=33
+CONFIG_ARCH_MMAP_RND_BITS_MIN=18
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=11
+CONFIG_ARCH_NR_GPIO=0
+CONFIG_ARCH_PROC_KCORE_TEXT=y
+CONFIG_ARCH_ROCKCHIP=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_STACKWALK=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARCH_WANTS_NO_INSTR=y
+CONFIG_ARCH_WANTS_THP_SWAP=y
+CONFIG_ARC_EMAC_CORE=y
+CONFIG_ARM64=y
+CONFIG_ARM64_4K_PAGES=y
+CONFIG_ARM64_CNP=y
+CONFIG_ARM64_EPAN=y
+CONFIG_ARM64_ERRATUM_2051678=y
+CONFIG_ARM64_ERRATUM_2054223=y
+CONFIG_ARM64_ERRATUM_2067961=y
+CONFIG_ARM64_ERRATUM_2077057=y
+CONFIG_ARM64_ERRATUM_2658417=y
+CONFIG_ARM64_ERRATUM_819472=y
+CONFIG_ARM64_ERRATUM_824069=y
+CONFIG_ARM64_ERRATUM_826319=y
+CONFIG_ARM64_ERRATUM_827319=y
+CONFIG_ARM64_ERRATUM_832075=y
+CONFIG_ARM64_ERRATUM_843419=y
+CONFIG_ARM64_ERRATUM_858921=y
+CONFIG_ARM64_HW_AFDBM=y
+CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
+CONFIG_ARM64_PAGE_SHIFT=12
+CONFIG_ARM64_PAN=y
+CONFIG_ARM64_PA_BITS=48
+CONFIG_ARM64_PA_BITS_48=y
+CONFIG_ARM64_PTR_AUTH=y
+CONFIG_ARM64_PTR_AUTH_KERNEL=y
+CONFIG_ARM64_RAS_EXTN=y
+CONFIG_ARM64_SME=y
+CONFIG_ARM64_SVE=y
+CONFIG_ARM64_TAGGED_ADDR_ABI=y
+CONFIG_ARM64_VA_BITS=48
+# CONFIG_ARM64_VA_BITS_39 is not set
+CONFIG_ARM64_VA_BITS_48=y
+CONFIG_ARM64_WORKAROUND_CLEAN_CACHE=y
+CONFIG_ARM64_WORKAROUND_TSB_FLUSH_FAILURE=y
+CONFIG_ARM_AMBA=y
+CONFIG_ARM_ARCH_TIMER=y
+CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+CONFIG_ARM_ARCH_TIMER_OOL_WORKAROUND=y
+CONFIG_ARM_GIC=y
+CONFIG_ARM_GIC_V2M=y
+CONFIG_ARM_GIC_V3=y
+CONFIG_ARM_GIC_V3_ITS=y
+CONFIG_ARM_GIC_V3_ITS_PCI=y
+CONFIG_ARM_MHU=y
+CONFIG_ARM_MHU_V2=y
+CONFIG_ARM_PSCI_CPUIDLE=y
+CONFIG_ARM_PSCI_CPUIDLE_DOMAIN=y
+CONFIG_ARM_PSCI_FW=y
+# CONFIG_ARM_RK3399_DMC_DEVFREQ is not set
+CONFIG_ARM_SCPI_CPUFREQ=y
+CONFIG_ARM_SCPI_POWER_DOMAIN=y
+CONFIG_ARM_SCPI_PROTOCOL=y
+CONFIG_ARM_SMMU=y
+CONFIG_ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT=y
+# CONFIG_ARM_SMMU_LEGACY_DT_BINDINGS is not set
+CONFIG_ARM_SMMU_V3=y
+# CONFIG_ARM_SMMU_V3_SVA is not set
+CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+CONFIG_BACKLIGHT_GPIO=y
+CONFIG_BACKLIGHT_PWM=y
+CONFIG_BLK_DEV_BSG=y
+CONFIG_BLK_DEV_BSGLIB=y
+CONFIG_BLK_DEV_BSG_COMMON=y
+# CONFIG_BLK_DEV_INITRD is not set
+CONFIG_BLK_DEV_INTEGRITY=y
+CONFIG_BLK_DEV_INTEGRITY_T10=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_NVME=y
+CONFIG_BLK_DEV_PCIESSD_MTIP32XX=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+# CONFIG_BOSCH_BNO055_SERIAL is not set
+CONFIG_BRCMSTB_GISB_ARB=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_CC_HAVE_SHADOW_CALL_STACK=y
+CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
+CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
+CONFIG_CC_NO_ARRAY_BOUNDS=y
+CONFIG_CHARGER_GPIO=y
+# CONFIG_CHARGER_RK817 is not set
+CONFIG_CLKSRC_MMIO=y
+CONFIG_CLK_PX30=y
+CONFIG_CLK_RK3308=y
+CONFIG_CLK_RK3328=y
+CONFIG_CLK_RK3368=y
+CONFIG_CLK_RK3399=y
+CONFIG_CLK_RK3568=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CMA=y
+CONFIG_CMA_ALIGNMENT=8
+CONFIG_CMA_AREAS=7
+# CONFIG_CMA_DEBUG is not set
+# CONFIG_CMA_DEBUGFS is not set
+CONFIG_CMA_SIZE_MBYTES=5
+# CONFIG_CMA_SIZE_SEL_MAX is not set
+CONFIG_CMA_SIZE_SEL_MBYTES=y
+# CONFIG_CMA_SIZE_SEL_MIN is not set
+# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
+# CONFIG_CMA_SYSFS is not set
+CONFIG_COMMON_CLK=y
+CONFIG_COMMON_CLK_RK808=y
+CONFIG_COMMON_CLK_ROCKCHIP=y
+CONFIG_COMMON_CLK_SCPI=y
+CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONFIGFS_FS=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CONTEXT_TRACKING=y
+CONFIG_CONTEXT_TRACKING_IDLE=y
+CONFIG_CONTIG_ALLOC=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+CONFIG_CPU_FREQ=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+# CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set
+# CONFIG_CPU_FREQ_GOV_ONDEMAND is not set
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+# CONFIG_CPU_FREQ_GOV_USERSPACE is not set
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_IDLE_MULTIPLE_DRIVERS=y
+CONFIG_CPU_ISOLATION=y
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_THERMAL=y
+CONFIG_CRASH_CORE=y
+CONFIG_CRASH_DUMP=y
+CONFIG_CRC16=y
+# CONFIG_CRC32_SARWATE is not set
+CONFIG_CRC32_SLICEBY8=y
+CONFIG_CRC64=y
+CONFIG_CRC64_ROCKSOFT=y
+CONFIG_CRC_T10DIF=y
+CONFIG_CROSS_MEMORY_ATTACH=y
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_CE=y
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
+CONFIG_CRYPTO_CRC32=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_CRC64_ROCKSOFT=y
+CONFIG_CRYPTO_CRCT10DIF=y
+CONFIG_CRYPTO_CRCT10DIF_ARM64_CE=y
+CONFIG_CRYPTO_CRYPTD=y
+# CONFIG_CRYPTO_DEV_ROCKCHIP is not set
+CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_HW=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_SHA1=y
+CONFIG_CRYPTO_LIB_UTILS=y
+CONFIG_CRYPTO_POLYVAL=y
+CONFIG_CRYPTO_POLYVAL_ARM64_CE=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_SM3=y
+CONFIG_CRYPTO_SM3_NEON=y
+CONFIG_CRYPTO_SM4=y
+CONFIG_CRYPTO_SM4_ARM64_CE_BLK=y
+CONFIG_CRYPTO_SM4_ARM64_NEON_BLK=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_INFO=y
+# CONFIG_DEVFREQ_GOV_PASSIVE is not set
+CONFIG_DEVFREQ_GOV_PERFORMANCE=y
+CONFIG_DEVFREQ_GOV_POWERSAVE=y
+CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=y
+CONFIG_DEVFREQ_GOV_USERSPACE=y
+# CONFIG_DEVFREQ_THERMAL is not set
+CONFIG_DEVMEM=y
+# CONFIG_DEVPORT is not set
+CONFIG_DMADEVICES=y
+CONFIG_DMA_CMA=y
+CONFIG_DMA_DIRECT_REMAP=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_OPS=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DNOTIFY=y
+CONFIG_DTC=y
+CONFIG_DT_IDLE_GENPD=y
+CONFIG_DT_IDLE_STATES=y
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_DWMAC_DWC_QOS_ETH=y
+CONFIG_DWMAC_GENERIC=y
+CONFIG_DWMAC_ROCKCHIP=y
+CONFIG_DW_WATCHDOG=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EEPROM_AT24=y
+CONFIG_EMAC_ROCKCHIP=y
+CONFIG_ENERGY_MODEL=y
+CONFIG_EXCLUSIVE_SYSTEM_RAM=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXTCON=y
+CONFIG_F2FS_FS=y
+CONFIG_FANOTIFY=y
+CONFIG_FHANDLE=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+# CONFIG_FORTIFY_SOURCE is not set
+CONFIG_FRAME_POINTER=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FS_POSIX_ACL=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_FW_LOADER_SYSFS=y
+CONFIG_GCC11_NO_ARRAY_BOUNDS=y
+CONFIG_GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_REGS=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ARCH_TOPOLOGY=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_CSUM=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IOREMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_MSI_IRQ=y
+CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_DWAPB=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_GPIO_ROCKCHIP=y
+CONFIG_GPIO_SYSCON=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HID=y
+CONFIG_HID_GENERIC=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HOTPLUG_PCI=y
+# CONFIG_HOTPLUG_PCI_CPCI is not set
+# CONFIG_HOTPLUG_PCI_PCIE is not set
+# CONFIG_HOTPLUG_PCI_SHPC is not set
+CONFIG_HUGETLBFS=y
+CONFIG_HUGETLB_PAGE=y
+CONFIG_HWMON=y
+CONFIG_HWSPINLOCK=y
+CONFIG_HW_CONSOLE=y
+CONFIG_I2C=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_COMPAT=y
+CONFIG_I2C_HELPER_AUTO=y
+CONFIG_I2C_RK3X=y
+CONFIG_IIO=y
+CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
+CONFIG_INDIRECT_PIO=y
+CONFIG_INPUT=y
+CONFIG_INPUT_EVDEV=y
+CONFIG_INPUT_FF_MEMLESS=y
+CONFIG_INPUT_KEYBOARD=y
+CONFIG_INPUT_LEDS=y
+CONFIG_INPUT_MATRIXKMAP=y
+# CONFIG_INPUT_RK805_PWRKEY is not set
+CONFIG_IOMMU_API=y
+# CONFIG_IOMMU_DEBUGFS is not set
+# CONFIG_IOMMU_DEFAULT_DMA_LAZY is not set
+# CONFIG_IOMMU_DEFAULT_DMA_STRICT is not set
+CONFIG_IOMMU_DEFAULT_PASSTHROUGH=y
+CONFIG_IOMMU_DMA=y
+CONFIG_IOMMU_IOVA=y
+CONFIG_IOMMU_IO_PGTABLE=y
+# CONFIG_IOMMU_IO_PGTABLE_ARMV7S is not set
+# CONFIG_IOMMU_IO_PGTABLE_DART is not set
+CONFIG_IOMMU_IO_PGTABLE_LPAE=y
+# CONFIG_IOMMU_IO_PGTABLE_LPAE_SELFTEST is not set
+CONFIG_IOMMU_SUPPORT=y
+# CONFIG_IO_STRICT_DEVMEM is not set
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MSI_IOMMU=y
+CONFIG_IRQ_TIME_ACCOUNTING=y
+CONFIG_IRQ_WORK=y
+CONFIG_JBD2=y
+CONFIG_JFFS2_ZLIB=y
+CONFIG_JUMP_LABEL=y
+CONFIG_KALLSYMS=y
+CONFIG_KCMP=y
+CONFIG_KEXEC_CORE=y
+CONFIG_KEXEC_FILE=y
+CONFIG_KSM=y
+# CONFIG_LEDS_BRIGHTNESS_HW_CHANGED is not set
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PWM=y
+# CONFIG_LEDS_PWM_MULTICOLOR is not set
+CONFIG_LEDS_SYSCON=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_PANIC=y
+CONFIG_LIBCRC32C=y
+CONFIG_LIBFDT=y
+CONFIG_LOCALVERSION_AUTO=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_LOG_BUF_SHIFT=19
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MAGIC_SYSRQ_SERIAL=y
+CONFIG_MAILBOX=y
+# CONFIG_MAILBOX_TEST is not set
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_BUS_MUX=y
+CONFIG_MDIO_BUS_MUX_GPIO=y
+CONFIG_MDIO_BUS_MUX_MMIOREG=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MEMORY_ISOLATION=y
+CONFIG_MFD_CORE=y
+# CONFIG_MFD_KHADAS_MCU is not set
+CONFIG_MFD_RK808=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_CQHCI=y
+CONFIG_MMC_DW=y
+# CONFIG_MMC_DW_BLUEFIELD is not set
+# CONFIG_MMC_DW_EXYNOS is not set
+# CONFIG_MMC_DW_HI3798CV200 is not set
+# CONFIG_MMC_DW_K3 is not set
+# CONFIG_MMC_DW_PCI is not set
+CONFIG_MMC_DW_PLTFM=y
+CONFIG_MMC_DW_ROCKCHIP=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_OF_ARASAN=y
+CONFIG_MMC_SDHCI_OF_DWCMSHC=y
+# CONFIG_MMC_SDHCI_PCI is not set
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MODULES_USE_ELF_RELA=y
+CONFIG_MOTORCOMM_PHY=y
+CONFIG_MQ_IOSCHED_DEADLINE=y
+# CONFIG_MTD_CFI is not set
+CONFIG_MTD_CMDLINE_PARTS=y
+# CONFIG_MTD_COMPLEX_MAPPINGS is not set
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPI_NOR_USE_4K_SECTORS=y
+CONFIG_MTD_SPLIT_FIRMWARE=y
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_SG_DMA_LENGTH=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_PTP_CLASSIFY=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NLS=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_NOP_USB_XCEIV=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NR_CPUS=256
+CONFIG_NVMEM=y
+CONFIG_NVMEM_ROCKCHIP_EFUSE=y
+# CONFIG_NVMEM_ROCKCHIP_OTP is not set
+CONFIG_NVMEM_SYSFS=y
+CONFIG_NVME_CORE=y
+# CONFIG_NVME_HWMON is not set
+# CONFIG_NVME_MULTIPATH is not set
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_DYNAMIC=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IOMMU=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_OF_OVERLAY=y
+CONFIG_OF_RESOLVE=y
+# CONFIG_OVERLAY_FS_XINO_AUTO is not set
+CONFIG_PADATA=y
+CONFIG_PAGE_POOL=y
+CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
+CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
+# CONFIG_PANIC_ON_OOPS is not set
+CONFIG_PANIC_ON_OOPS_VALUE=0
+CONFIG_PANIC_TIMEOUT=0
+# CONFIG_PARTITION_ADVANCED is not set
+CONFIG_PARTITION_PERCPU=y
+CONFIG_PCI=y
+CONFIG_PCIEAER=y
+CONFIG_PCIEASPM=y
+CONFIG_PCIEASPM_DEFAULT=y
+# CONFIG_PCIEASPM_PERFORMANCE is not set
+# CONFIG_PCIEASPM_POWERSAVE is not set
+# CONFIG_PCIEASPM_POWER_SUPERSAVE is not set
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_DW=y
+CONFIG_PCIE_DW_HOST=y
+CONFIG_PCIE_PME=y
+CONFIG_PCIE_ROCKCHIP=y
+CONFIG_PCIE_ROCKCHIP_DW_HOST=y
+CONFIG_PCIE_ROCKCHIP_HOST=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PCI_MSI=y
+CONFIG_PCI_MSI_IRQ_DOMAIN=y
+CONFIG_PCI_STUB=y
+CONFIG_PCS_XPCS=y
+CONFIG_PGTABLE_LEVELS=4
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PHYS_ADDR_T_64BIT=y
+CONFIG_PHY_ROCKCHIP_DP=y
+# CONFIG_PHY_ROCKCHIP_DPHY_RX0 is not set
+CONFIG_PHY_ROCKCHIP_EMMC=y
+# CONFIG_PHY_ROCKCHIP_INNO_CSIDPHY is not set
+# CONFIG_PHY_ROCKCHIP_INNO_DSIDPHY is not set
+# CONFIG_PHY_ROCKCHIP_INNO_HDMI is not set
+CONFIG_PHY_ROCKCHIP_INNO_USB2=y
+# CONFIG_PHY_ROCKCHIP_NANENG_COMBO_PHY is not set
+CONFIG_PHY_ROCKCHIP_PCIE=y
+# CONFIG_PHY_ROCKCHIP_SNPS_PCIE3 is not set
+CONFIG_PHY_ROCKCHIP_TYPEC=y
+CONFIG_PHY_ROCKCHIP_USB=y
+CONFIG_PINCTRL=y
+CONFIG_PINCTRL_RK805=y
+CONFIG_PINCTRL_ROCKCHIP=y
+# CONFIG_PINCTRL_SINGLE is not set
+CONFIG_PL330_DMA=y
+CONFIG_PLATFORM_MHU=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_DEVFREQ=y
+# CONFIG_PM_DEVFREQ_EVENT is not set
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_PM_OPP=y
+CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_POWER_SUPPLY_HWMON=y
+CONFIG_PPS=y
+CONFIG_PREEMPT=y
+CONFIG_PREEMPTION=y
+CONFIG_PREEMPT_BUILD=y
+CONFIG_PREEMPT_COUNT=y
+# CONFIG_PREEMPT_NONE is not set
+CONFIG_PREEMPT_RCU=y
+CONFIG_PRINTK_TIME=y
+# CONFIG_PRINT_QUOTA_WARNING is not set
+CONFIG_PROC_PAGE_MONITOR=y
+CONFIG_PROC_VMCORE=y
+CONFIG_PTP_1588_CLOCK=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_PWM=y
+# CONFIG_PWM_CLK is not set
+CONFIG_PWM_ROCKCHIP=y
+CONFIG_PWM_SYSFS=y
+# CONFIG_PWM_XILINX is not set
+# CONFIG_QFMT_V2 is not set
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_QUOTA=y
+CONFIG_QUOTACTL=y
+CONFIG_RAID_ATTRS=y
+CONFIG_RANDOMIZE_BASE=y
+CONFIG_RANDOMIZE_MODULE_REGION_FULL=y
+CONFIG_RANDSTRUCT_NONE=y
+CONFIG_RAS=y
+CONFIG_RATIONAL=y
+# CONFIG_RAVE_SP_CORE is not set
+CONFIG_RCU_TRACE=y
+CONFIG_REALTEK_PHY=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_IRQ=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FAN53555=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_GPIO=y
+CONFIG_REGULATOR_PWM=y
+CONFIG_REGULATOR_RK808=y
+CONFIG_RELOCATABLE=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RFS_ACCEL=y
+CONFIG_ROCKCHIP_GRF=y
+CONFIG_ROCKCHIP_IODOMAIN=y
+CONFIG_ROCKCHIP_IOMMU=y
+CONFIG_ROCKCHIP_MBOX=y
+CONFIG_ROCKCHIP_PHY=y
+CONFIG_ROCKCHIP_PM_DOMAINS=y
+# CONFIG_ROCKCHIP_SARADC is not set
+CONFIG_ROCKCHIP_THERMAL=y
+CONFIG_ROCKCHIP_TIMER=y
+CONFIG_RODATA_FULL_DEFAULT_ENABLED=y
+CONFIG_RPS=y
+CONFIG_RSEQ=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_RK808=y
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RTC_NVMEM=y
+# CONFIG_RUNTIME_TESTING_MENU is not set
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+CONFIG_SCHED_MC=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+# CONFIG_SCSI_LOWLEVEL is not set
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_SCSI_SAS_ATTRS=y
+CONFIG_SCSI_SAS_HOST_SMP=y
+CONFIG_SCSI_SAS_LIBSAS=y
+# CONFIG_SECURITY_DMESG_RESTRICT is not set
+CONFIG_SENSORS_ARM_SCPI=y
+CONFIG_SERIAL_8250_DEPRECATED_OPTIONS=y
+CONFIG_SERIAL_8250_DW=y
+CONFIG_SERIAL_8250_DWLIB=y
+CONFIG_SERIAL_8250_EXAR=y
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_FSL=y
+CONFIG_SERIAL_8250_NR_UARTS=4
+CONFIG_SERIAL_8250_PCI=y
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_DEV_BUS=y
+CONFIG_SERIAL_DEV_CTRL_TTYPORT=y
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIO=y
+CONFIG_SERIO_AMBAKMI=y
+CONFIG_SERIO_LIBPS2=y
+CONFIG_SG_POOL=y
+CONFIG_SLUB_DEBUG=y
+CONFIG_SMP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOFTIRQ_ON_OWN_STACK=y
+CONFIG_SPARSEMEM=y
+CONFIG_SPARSEMEM_EXTREME=y
+CONFIG_SPARSEMEM_VMEMMAP=y
+CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SPI=y
+CONFIG_SPI_BITBANG=y
+CONFIG_SPI_DYNAMIC=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SPI_ROCKCHIP=y
+# CONFIG_SPI_ROCKCHIP_SFC is not set
+CONFIG_SPI_SPIDEV=y
+# CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU is not set
+CONFIG_SQUASHFS_DECOMP_SINGLE=y
+# CONFIG_SQUASHFS_EMBEDDED is not set
+CONFIG_SQUASHFS_FILE_CACHE=y
+# CONFIG_SQUASHFS_FILE_DIRECT is not set
+CONFIG_SRAM=y
+CONFIG_SRCU=y
+CONFIG_STACKDEPOT=y
+CONFIG_STACKPROTECTOR=y
+CONFIG_STACKPROTECTOR_PER_TASK=y
+CONFIG_STACKPROTECTOR_STRONG=y
+CONFIG_STACKTRACE=y
+CONFIG_STMMAC_ETH=y
+CONFIG_STMMAC_PLATFORM=y
+CONFIG_STRICT_DEVMEM=y
+# CONFIG_STRIP_ASM_SYMS is not set
+# CONFIG_SWAP is not set
+CONFIG_SWIOTLB=y
+CONFIG_SWPHY=y
+CONFIG_SYNC_FILE=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYSFS_SYSCALL=y
+# CONFIG_TEXTSEARCH is not set
+CONFIG_THERMAL=y
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_EMULATION=y
+CONFIG_THERMAL_GOV_POWER_ALLOCATOR=y
+CONFIG_THERMAL_GOV_STEP_WISE=y
+CONFIG_THERMAL_HWMON=y
+CONFIG_THERMAL_OF=y
+CONFIG_THREAD_INFO_IN_TASK=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TRACE_CLOCK=y
+CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y
+CONFIG_TRANSPARENT_HUGEPAGE=y
+CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y
+# CONFIG_TRANSPARENT_HUGEPAGE_MADVISE is not set
+CONFIG_TRANS_TABLE=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_TYPEC=y
+# CONFIG_TYPEC_ANX7411 is not set
+CONFIG_TYPEC_FUSB302=y
+# CONFIG_TYPEC_HD3SS3220 is not set
+# CONFIG_TYPEC_MUX_FSA4480 is not set
+# CONFIG_TYPEC_MUX_PI3USB30532 is not set
+# CONFIG_TYPEC_RT1719 is not set
+# CONFIG_TYPEC_STUSB160X is not set
+# CONFIG_TYPEC_TCPCI is not set
+CONFIG_TYPEC_TCPM=y
+# CONFIG_TYPEC_TPS6598X is not set
+# CONFIG_TYPEC_WUSB3801 is not set
+# CONFIG_UACCE is not set
+# CONFIG_UCLAMP_TASK is not set
+# CONFIG_UEVENT_HELPER is not set
+CONFIG_UNINLINE_SPIN_UNLOCK=y
+CONFIG_UNMAP_KERNEL_AT_EL0=y
+CONFIG_USB=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_DWC3=y
+CONFIG_USB_DWC3_HOST=y
+CONFIG_USB_DWC3_OF_SIMPLE=y
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_HCD_PLATFORM=y
+# CONFIG_USB_EHCI_ROOT_HUB_TT is not set
+CONFIG_USB_HID=y
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_HCD_PLATFORM=y
+CONFIG_USB_PHY=y
+CONFIG_USB_ROLE_SWITCH=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_ULPI=y
+CONFIG_USB_ULPI_BUS=y
+CONFIG_USB_ULPI_VIEWPORT=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_PLATFORM=y
+# CONFIG_VIRTIO_MENU is not set
+CONFIG_VMAP_STACK=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_XARRAY_MULTI=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_XZ_DEC_ARM=y
+CONFIG_XZ_DEC_ARMTHUMB=y
+CONFIG_XZ_DEC_BCJ=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZONE_DMA32=y
diff --git a/target/linux/rockchip/image/Makefile b/target/linux/rockchip/image/Makefile
index e4db1e5d58c62b..3b118201b687da 100644
--- a/target/linux/rockchip/image/Makefile
+++ b/target/linux/rockchip/image/Makefile
@@ -16,7 +16,6 @@ define Build/boot-common
 	rm -fR $@.boot
 	mkdir -p $@.boot
 
-	$(CP) $(DTS_DIR)/$(DEVICE_DTS).dtb $@.boot/rockchip.dtb
 	$(CP) $(IMAGE_KERNEL) $@.boot/kernel.img
 endef
 
@@ -48,9 +47,10 @@ endef
 ### Devices ###
 define Device/Default
   PROFILES := Default
-  KERNEL := kernel-bin
+  KERNEL = kernel-bin | lzma | fit lzma $$(DTS_DIR)/$$(DEVICE_DTS).dtb
   IMAGES := sysupgrade.img.gz
   DEVICE_DTS = rockchip/$$(SOC)-$(lastword $(subst _, ,$(1)))
+  UBOOT_DEVICE_NAME = $(lastword $(subst _, ,$(1)))-$$(SOC)
 endef
 
 include $(SUBTARGET).mk
diff --git a/target/linux/rockchip/image/armv8.mk b/target/linux/rockchip/image/armv8.mk
index 6cc31f1d8c4cbe..063dc6fd644795 100644
--- a/target/linux/rockchip/image/armv8.mk
+++ b/target/linux/rockchip/image/armv8.mk
@@ -2,12 +2,33 @@
 #
 # Copyright (C) 2020 Tobias Maedel
 
+# FIT will be loaded at 0x02080000. Leave 16M for that, align it to 2M and load the kernel after it.
+KERNEL_LOADADDR := 0x03200000
+
+define Device/firefly_roc-rk3328-cc
+  DEVICE_VENDOR := Firefly
+  DEVICE_MODEL := ROC-RK3328-CC
+  SOC := rk3328
+  DEVICE_DTS := rockchip/rk3328-roc-cc
+  UBOOT_DEVICE_NAME := roc-cc-rk3328
+  IMAGE/sysupgrade.img.gz := boot-common | boot-script | pine64-img | gzip | append-metadata
+endef
+TARGET_DEVICES += firefly_roc-rk3328-cc
+
+define Device/friendlyarm_nanopi-r2c
+  DEVICE_VENDOR := FriendlyARM
+  DEVICE_MODEL := NanoPi R2C
+  SOC := rk3328
+  IMAGE/sysupgrade.img.gz := boot-common | boot-script | pine64-img | gzip | append-metadata
+  DEVICE_PACKAGES := kmod-usb-net-rtl8152
+endef
+TARGET_DEVICES += friendlyarm_nanopi-r2c
+
 define Device/friendlyarm_nanopi-r2s
   DEVICE_VENDOR := FriendlyARM
   DEVICE_MODEL := NanoPi R2S
   SOC := rk3328
-  UBOOT_DEVICE_NAME := nanopi-r2s-rk3328
-  IMAGE/sysupgrade.img.gz := boot-common | boot-script nanopi-r2s | pine64-img | gzip | append-metadata
+  IMAGE/sysupgrade.img.gz := boot-common | boot-script | pine64-img | gzip | append-metadata
   DEVICE_PACKAGES := kmod-usb-net-rtl8152
 endef
 TARGET_DEVICES += friendlyarm_nanopi-r2s
@@ -17,8 +38,7 @@ define Device/friendlyarm_nanopi-r4s
   DEVICE_MODEL := NanoPi R4S
   DEVICE_VARIANT := 4GB LPDDR4
   SOC := rk3399
-  UBOOT_DEVICE_NAME := nanopi-r4s-rk3399
-  IMAGE/sysupgrade.img.gz := boot-common | boot-script nanopi-r4s | pine64-img | gzip | append-metadata
+  IMAGE/sysupgrade.img.gz := boot-common | boot-script | pine64-img | gzip | append-metadata
   DEVICE_PACKAGES := kmod-r8169
 endef
 TARGET_DEVICES += friendlyarm_nanopi-r4s
@@ -27,7 +47,6 @@ define Device/pine64_rockpro64
   DEVICE_VENDOR := Pine64
   DEVICE_MODEL := RockPro64
   SOC := rk3399
-  UBOOT_DEVICE_NAME := rockpro64-rk3399
   IMAGE/sysupgrade.img.gz := boot-common | boot-script | pine64-img | gzip | append-metadata
 endef
 TARGET_DEVICES += pine64_rockpro64
@@ -41,3 +60,21 @@ define Device/radxa_rock-pi-4a
   IMAGE/sysupgrade.img.gz := boot-common | boot-script | pine64-img | gzip | append-metadata
 endef
 TARGET_DEVICES += radxa_rock-pi-4a
+
+define Device/xunlong_orangepi-r1-plus
+  DEVICE_VENDOR := Xunlong
+  DEVICE_MODEL := Orange Pi R1 Plus
+  SOC := rk3328
+  IMAGE/sysupgrade.img.gz := boot-common | boot-script | pine64-img | gzip | append-metadata
+  DEVICE_PACKAGES := kmod-usb-net-rtl8152
+endef
+TARGET_DEVICES += xunlong_orangepi-r1-plus
+
+define Device/xunlong_orangepi-r1-plus-lts
+  DEVICE_VENDOR := Xunlong
+  DEVICE_MODEL := Orange Pi R1 Plus LTS
+  SOC := rk3328
+  IMAGE/sysupgrade.img.gz := boot-common | boot-script | pine64-img | gzip | append-metadata
+  DEVICE_PACKAGES := kmod-usb-net-rtl8152
+endef
+TARGET_DEVICES += xunlong_orangepi-r1-plus-lts
diff --git a/target/linux/rockchip/image/mmc.bootscript b/target/linux/rockchip/image/mmc.bootscript
index b70a62c4c7426f..60b59e1b6b73c6 100644
--- a/target/linux/rockchip/image/mmc.bootscript
+++ b/target/linux/rockchip/image/mmc.bootscript
@@ -1,8 +1,15 @@
 part uuid mmc ${devnum}:2 uuid
 
-setenv bootargs "console=ttyS2,1500000 console=tty1 earlycon=uart8250,mmio32,0xff1a0000 root=PARTUUID=${uuid} rw rootwait"
+if test $stdout = 'serial@fe660000' ;
+then serial_addr=',0xfe660000';
+elif test $stdout = 'serial@ff130000' ;
+then serial_addr=',0xff130000';
+elif test $stdout = 'serial@ff1a0000' ;
+then serial_addr=',0xff1a0000';
+fi;
+
+setenv bootargs "console=ttyS2,1500000 console=tty1 earlycon=uart8250,mmio32${serial_addr} swiotlb=1 root=PARTUUID=${uuid} rw rootwait";
 
-load mmc ${devnum}:1 ${fdt_addr_r} rockchip.dtb
 load mmc ${devnum}:1 ${kernel_addr_r} kernel.img
 
-booti ${kernel_addr_r} - ${fdt_addr_r}
+bootm ${kernel_addr_r}
diff --git a/target/linux/rockchip/patches-5.15/006-v6.4-arm64-dts-rockchip-Add-FriendlyARM-NanoPi-R2C.patch b/target/linux/rockchip/patches-5.15/006-v6.4-arm64-dts-rockchip-Add-FriendlyARM-NanoPi-R2C.patch
new file mode 100644
index 00000000000000..f58463b3d188b4
--- /dev/null
+++ b/target/linux/rockchip/patches-5.15/006-v6.4-arm64-dts-rockchip-Add-FriendlyARM-NanoPi-R2C.patch
@@ -0,0 +1,70 @@
+From 004589ff9df5b75672a78b6c3c4cba93202b14c9 Mon Sep 17 00:00:00 2001
+From: Tianling Shen <cnsztl@gmail.com>
+Date: Sat, 25 Mar 2023 15:40:20 +0800
+Subject: [PATCH] arm64: dts: rockchip: Add FriendlyARM NanoPi R2C
+
+The NanoPi R2C is a minor variant of NanoPi R2S with the on-board NIC
+chip changed from rtl8211e to yt8521s, and otherwise identical to R2S.
+
+Signed-off-by: Tianling Shen <cnsztl@gmail.com>
+Link: https://lore.kernel.org/r/20230325074022.9818-3-cnsztl@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ arch/arm64/boot/dts/rockchip/Makefile         |  1 +
+ .../boot/dts/rockchip/rk3328-nanopi-r2c.dts   | 40 +++++++++++++++++++
+ 2 files changed, 41 insertions(+)
+ create mode 100644 arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2c.dts
+
+--- a/arch/arm64/boot/dts/rockchip/Makefile
++++ b/arch/arm64/boot/dts/rockchip/Makefile
+@@ -9,6 +9,7 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3318-a9
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3326-odroid-go2.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-a1.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-evb.dtb
++dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2c.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2s.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-rock64.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-rock-pi-e.dtb
+--- /dev/null
++++ b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2c.dts
+@@ -0,0 +1,40 @@
++// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
++/*
++ * Copyright (c) 2021 FriendlyElec Computer Tech. Co., Ltd.
++ * (http://www.friendlyarm.com)
++ *
++ * Copyright (c) 2021-2023 Tianling Shen <cnsztl@gmail.com>
++ */
++
++/dts-v1/;
++#include "rk3328-nanopi-r2s.dts"
++
++/ {
++	model = "FriendlyElec NanoPi R2C";
++	compatible = "friendlyarm,nanopi-r2c", "rockchip,rk3328";
++};
++
++&gmac2io {
++	phy-handle = <&yt8521s>;
++	tx_delay = <0x22>;
++	rx_delay = <0x12>;
++
++	mdio {
++		/delete-node/ ethernet-phy@1;
++
++		yt8521s: ethernet-phy@3 {
++			compatible = "ethernet-phy-ieee802.3-c22";
++			reg = <3>;
++
++			motorcomm,clk-out-frequency-hz = <125000000>;
++			motorcomm,keep-pll-enabled;
++			motorcomm,auto-sleep-disabled;
++
++			pinctrl-0 = <&eth_phy_reset_pin>;
++			pinctrl-names = "default";
++			reset-assert-us = <10000>;
++			reset-deassert-us = <50000>;
++			reset-gpios = <&gpio1 RK_PC2 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
diff --git a/target/linux/rockchip/patches-5.15/007-v6.3-arm64-dts-rockchip-rk3328-Add-Orange-Pi-R1-Plus.patch b/target/linux/rockchip/patches-5.15/007-v6.3-arm64-dts-rockchip-rk3328-Add-Orange-Pi-R1-Plus.patch
new file mode 100644
index 00000000000000..053a4d0d8e27fa
--- /dev/null
+++ b/target/linux/rockchip/patches-5.15/007-v6.3-arm64-dts-rockchip-rk3328-Add-Orange-Pi-R1-Plus.patch
@@ -0,0 +1,407 @@
+From 51712e1d014aaaa4c6e1e7e84932d58b5c0f59ed Mon Sep 17 00:00:00 2001
+From: Chukun Pan <amadeus@jmu.edu.cn>
+Date: Sat, 3 Dec 2022 15:41:49 +0800
+Subject: [PATCH] arm64: dts: rockchip: rk3328: Add Orange Pi R1 Plus
+
+Orange Pi R1 Plus is a Rockchip RK3328 based SBC by Xunlong.
+
+This device is similar to the NanoPi R2S, and has a 16MB
+SPI NOR (mx25l12805d). The reset button is changed to
+directly reset the power supply, another detail is that
+both network ports have independent MAC addresses.
+
+Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
+Link: https://lore.kernel.org/r/20221203074149.11543-3-amadeus@jmu.edu.cn
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ arch/arm64/boot/dts/rockchip/Makefile         |   1 +
+ .../dts/rockchip/rk3328-orangepi-r1-plus.dts  | 373 ++++++++++++++++++
+ 2 files changed, 374 insertions(+)
+ create mode 100644 arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus.dts
+
+--- a/arch/arm64/boot/dts/rockchip/Makefile
++++ b/arch/arm64/boot/dts/rockchip/Makefile
+@@ -11,6 +11,7 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-a1
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-evb.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2c.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2s.dtb
++dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-orangepi-r1-plus.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-rock64.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-rock-pi-e.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-roc-cc.dtb
+--- /dev/null
++++ b/arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus.dts
+@@ -0,0 +1,373 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Based on rk3328-nanopi-r2s.dts, which is:
++ *   Copyright (c) 2020 David Bauer <mail@david-bauer.net>
++ */
++
++/dts-v1/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/leds/common.h>
++#include "rk3328.dtsi"
++
++/ {
++	model = "Xunlong Orange Pi R1 Plus";
++	compatible = "xunlong,orangepi-r1-plus", "rockchip,rk3328";
++
++	aliases {
++		ethernet1 = &rtl8153;
++		mmc0 = &sdmmc;
++	};
++
++	chosen {
++		stdout-path = "serial2:1500000n8";
++	};
++
++	gmac_clk: gmac-clock {
++		compatible = "fixed-clock";
++		clock-frequency = <125000000>;
++		clock-output-names = "gmac_clkin";
++		#clock-cells = <0>;
++	};
++
++	leds {
++		compatible = "gpio-leds";
++		pinctrl-0 = <&lan_led_pin>, <&sys_led_pin>, <&wan_led_pin>;
++		pinctrl-names = "default";
++
++		led-0 {
++			function = LED_FUNCTION_LAN;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&gpio2 RK_PB7 GPIO_ACTIVE_HIGH>;
++		};
++
++		led-1 {
++			function = LED_FUNCTION_STATUS;
++			color = <LED_COLOR_ID_RED>;
++			gpios = <&gpio3 RK_PC5 GPIO_ACTIVE_HIGH>;
++			linux,default-trigger = "heartbeat";
++		};
++
++		led-2 {
++			function = LED_FUNCTION_WAN;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&gpio2 RK_PC2 GPIO_ACTIVE_HIGH>;
++		};
++	};
++
++	vcc_sd: sdmmc-regulator {
++		compatible = "regulator-fixed";
++		gpio = <&gpio0 RK_PD6 GPIO_ACTIVE_LOW>;
++		pinctrl-0 = <&sdmmc0m1_pin>;
++		pinctrl-names = "default";
++		regulator-name = "vcc_sd";
++		regulator-boot-on;
++		vin-supply = <&vcc_io>;
++	};
++
++	vcc_sys: vcc-sys-regulator {
++		compatible = "regulator-fixed";
++		regulator-name = "vcc_sys";
++		regulator-always-on;
++		regulator-boot-on;
++		regulator-min-microvolt = <5000000>;
++		regulator-max-microvolt = <5000000>;
++	};
++
++	vdd_5v_lan: vdd-5v-lan-regulator {
++		compatible = "regulator-fixed";
++		enable-active-high;
++		gpio = <&gpio2 RK_PC6 GPIO_ACTIVE_HIGH>;
++		pinctrl-0 = <&lan_vdd_pin>;
++		pinctrl-names = "default";
++		regulator-name = "vdd_5v_lan";
++		regulator-always-on;
++		regulator-boot-on;
++		vin-supply = <&vcc_sys>;
++	};
++};
++
++&cpu0 {
++	cpu-supply = <&vdd_arm>;
++};
++
++&cpu1 {
++	cpu-supply = <&vdd_arm>;
++};
++
++&cpu2 {
++	cpu-supply = <&vdd_arm>;
++};
++
++&cpu3 {
++	cpu-supply = <&vdd_arm>;
++};
++
++&display_subsystem {
++	status = "disabled";
++};
++
++&gmac2io {
++	assigned-clocks = <&cru SCLK_MAC2IO>, <&cru SCLK_MAC2IO_EXT>;
++	assigned-clock-parents = <&gmac_clk>, <&gmac_clk>;
++	clock_in_out = "input";
++	phy-handle = <&rtl8211e>;
++	phy-mode = "rgmii";
++	phy-supply = <&vcc_io>;
++	pinctrl-0 = <&rgmiim1_pins>;
++	pinctrl-names = "default";
++	snps,aal;
++	rx_delay = <0x18>;
++	tx_delay = <0x24>;
++	status = "okay";
++
++	mdio {
++		compatible = "snps,dwmac-mdio";
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		rtl8211e: ethernet-phy@1 {
++			reg = <1>;
++			pinctrl-0 = <&eth_phy_reset_pin>;
++			pinctrl-names = "default";
++			reset-assert-us = <10000>;
++			reset-deassert-us = <50000>;
++			reset-gpios = <&gpio1 RK_PC2 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
++
++&i2c1 {
++	status = "okay";
++
++	rk805: pmic@18 {
++		compatible = "rockchip,rk805";
++		reg = <0x18>;
++		interrupt-parent = <&gpio1>;
++		interrupts = <24 IRQ_TYPE_LEVEL_LOW>;
++		#clock-cells = <1>;
++		clock-output-names = "xin32k", "rk805-clkout2";
++		gpio-controller;
++		#gpio-cells = <2>;
++		pinctrl-0 = <&pmic_int_l>;
++		pinctrl-names = "default";
++		rockchip,system-power-controller;
++		wakeup-source;
++
++		vcc1-supply = <&vcc_sys>;
++		vcc2-supply = <&vcc_sys>;
++		vcc3-supply = <&vcc_sys>;
++		vcc4-supply = <&vcc_sys>;
++		vcc5-supply = <&vcc_io>;
++		vcc6-supply = <&vcc_sys>;
++
++		regulators {
++			vdd_log: DCDC_REG1 {
++				regulator-name = "vdd_log";
++				regulator-always-on;
++				regulator-boot-on;
++				regulator-min-microvolt = <712500>;
++				regulator-max-microvolt = <1450000>;
++				regulator-ramp-delay = <12500>;
++
++				regulator-state-mem {
++					regulator-on-in-suspend;
++					regulator-suspend-microvolt = <1000000>;
++				};
++			};
++
++			vdd_arm: DCDC_REG2 {
++				regulator-name = "vdd_arm";
++				regulator-always-on;
++				regulator-boot-on;
++				regulator-min-microvolt = <712500>;
++				regulator-max-microvolt = <1450000>;
++				regulator-ramp-delay = <12500>;
++
++				regulator-state-mem {
++					regulator-on-in-suspend;
++					regulator-suspend-microvolt = <950000>;
++				};
++			};
++
++			vcc_ddr: DCDC_REG3 {
++				regulator-name = "vcc_ddr";
++				regulator-always-on;
++				regulator-boot-on;
++
++				regulator-state-mem {
++					regulator-on-in-suspend;
++				};
++			};
++
++			vcc_io: DCDC_REG4 {
++				regulator-name = "vcc_io";
++				regulator-always-on;
++				regulator-boot-on;
++				regulator-min-microvolt = <3300000>;
++				regulator-max-microvolt = <3300000>;
++
++				regulator-state-mem {
++					regulator-on-in-suspend;
++					regulator-suspend-microvolt = <3300000>;
++				};
++			};
++
++			vcc_18: LDO_REG1 {
++				regulator-name = "vcc_18";
++				regulator-always-on;
++				regulator-boot-on;
++				regulator-min-microvolt = <1800000>;
++				regulator-max-microvolt = <1800000>;
++
++				regulator-state-mem {
++					regulator-on-in-suspend;
++					regulator-suspend-microvolt = <1800000>;
++				};
++			};
++
++			vcc18_emmc: LDO_REG2 {
++				regulator-name = "vcc18_emmc";
++				regulator-always-on;
++				regulator-boot-on;
++				regulator-min-microvolt = <1800000>;
++				regulator-max-microvolt = <1800000>;
++
++				regulator-state-mem {
++					regulator-on-in-suspend;
++					regulator-suspend-microvolt = <1800000>;
++				};
++			};
++
++			vdd_10: LDO_REG3 {
++				regulator-name = "vdd_10";
++				regulator-always-on;
++				regulator-boot-on;
++				regulator-min-microvolt = <1000000>;
++				regulator-max-microvolt = <1000000>;
++
++				regulator-state-mem {
++					regulator-on-in-suspend;
++					regulator-suspend-microvolt = <1000000>;
++				};
++			};
++		};
++	};
++};
++
++&io_domains {
++	pmuio-supply = <&vcc_io>;
++	vccio1-supply = <&vcc_io>;
++	vccio2-supply = <&vcc18_emmc>;
++	vccio3-supply = <&vcc_io>;
++	vccio4-supply = <&vcc_io>;
++	vccio5-supply = <&vcc_io>;
++	vccio6-supply = <&vcc_io>;
++	status = "okay";
++};
++
++&pinctrl {
++	gmac2io {
++		eth_phy_reset_pin: eth-phy-reset-pin {
++			rockchip,pins = <1 RK_PC2 RK_FUNC_GPIO &pcfg_pull_down>;
++		};
++	};
++
++	leds {
++		lan_led_pin: lan-led-pin {
++			rockchip,pins = <2 RK_PB7 RK_FUNC_GPIO &pcfg_pull_none>;
++		};
++
++		sys_led_pin: sys-led-pin {
++			rockchip,pins = <3 RK_PC5 RK_FUNC_GPIO &pcfg_pull_none>;
++		};
++
++		wan_led_pin: wan-led-pin {
++			rockchip,pins = <2 RK_PC2 RK_FUNC_GPIO &pcfg_pull_none>;
++		};
++	};
++
++	lan {
++		lan_vdd_pin: lan-vdd-pin {
++			rockchip,pins = <2 RK_PC6 RK_FUNC_GPIO &pcfg_pull_none>;
++		};
++	};
++
++	pmic {
++		pmic_int_l: pmic-int-l {
++			rockchip,pins = <1 RK_PD0 RK_FUNC_GPIO &pcfg_pull_up>;
++		};
++	};
++};
++
++&pwm2 {
++	status = "okay";
++};
++
++&sdmmc {
++	bus-width = <4>;
++	cap-sd-highspeed;
++	disable-wp;
++	pinctrl-0 = <&sdmmc0_clk>, <&sdmmc0_cmd>, <&sdmmc0_dectn>, <&sdmmc0_bus4>;
++	pinctrl-names = "default";
++	vmmc-supply = <&vcc_sd>;
++	status = "okay";
++};
++
++&spi0 {
++	status = "okay";
++
++	flash@0 {
++		compatible = "jedec,spi-nor";
++		reg = <0>;
++		spi-max-frequency = <50000000>;
++	};
++};
++
++&tsadc {
++	rockchip,hw-tshut-mode = <0>;
++	rockchip,hw-tshut-polarity = <0>;
++	status = "okay";
++};
++
++&u2phy {
++	status = "okay";
++};
++
++&u2phy_host {
++	status = "okay";
++};
++
++&u2phy_otg {
++	status = "okay";
++};
++
++&uart2 {
++	status = "okay";
++};
++
++&usb20_otg {
++	dr_mode = "host";
++	status = "okay";
++};
++
++&usbdrd3 {
++	dr_mode = "host";
++	status = "okay";
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	/* Second port is for USB 3.0 */
++	rtl8153: device@2 {
++		compatible = "usbbda,8153";
++		reg = <2>;
++	};
++};
++
++&usb_host0_ehci {
++	status = "okay";
++};
++
++&usb_host0_ohci {
++	status = "okay";
++};
diff --git a/target/linux/rockchip/patches-5.15/008-v6.4-arm64-dts-rockchip-Add-Xunlong-OrangePi-R1-Plus-LTS.patch b/target/linux/rockchip/patches-5.15/008-v6.4-arm64-dts-rockchip-Add-Xunlong-OrangePi-R1-Plus-LTS.patch
new file mode 100644
index 00000000000000..cedf28dc799f05
--- /dev/null
+++ b/target/linux/rockchip/patches-5.15/008-v6.4-arm64-dts-rockchip-Add-Xunlong-OrangePi-R1-Plus-LTS.patch
@@ -0,0 +1,71 @@
+From 387b3bbac5ea6a0a105d685237f033ffe0f184f1 Mon Sep 17 00:00:00 2001
+From: Tianling Shen <cnsztl@gmail.com>
+Date: Sat, 25 Mar 2023 15:40:22 +0800
+Subject: [PATCH] arm64: dts: rockchip: Add Xunlong OrangePi R1 Plus LTS
+
+The OrangePi R1 Plus LTS is a minor variant of OrangePi R1 Plus with
+the on-board NIC chip changed from rtl8211e to yt8531c, and otherwise
+identical to OrangePi R1 Plus.
+
+Signed-off-by: Tianling Shen <cnsztl@gmail.com>
+Link: https://lore.kernel.org/r/20230325074022.9818-5-cnsztl@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ arch/arm64/boot/dts/rockchip/Makefile         |  1 +
+ .../rockchip/rk3328-orangepi-r1-plus-lts.dts  | 40 +++++++++++++++++++
+ 2 files changed, 41 insertions(+)
+ create mode 100644 arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus-lts.dts
+
+--- a/arch/arm64/boot/dts/rockchip/Makefile
++++ b/arch/arm64/boot/dts/rockchip/Makefile
+@@ -12,6 +12,7 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-ev
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2c.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2s.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-orangepi-r1-plus.dtb
++dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-orangepi-r1-plus-lts.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-rock64.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-rock-pi-e.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-roc-cc.dtb
+--- /dev/null
++++ b/arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus-lts.dts
+@@ -0,0 +1,40 @@
++// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
++/*
++ * Copyright (c) 2016 Xunlong Software. Co., Ltd.
++ * (http://www.orangepi.org)
++ *
++ * Copyright (c) 2021-2023 Tianling Shen <cnsztl@gmail.com>
++ */
++
++/dts-v1/;
++#include "rk3328-orangepi-r1-plus.dts"
++
++/ {
++	model = "Xunlong Orange Pi R1 Plus LTS";
++	compatible = "xunlong,orangepi-r1-plus-lts", "rockchip,rk3328";
++};
++
++&gmac2io {
++	phy-handle = <&yt8531c>;
++	tx_delay = <0x19>;
++	rx_delay = <0x05>;
++
++	mdio {
++		/delete-node/ ethernet-phy@1;
++
++		yt8531c: ethernet-phy@0 {
++			compatible = "ethernet-phy-ieee802.3-c22";
++			reg = <0>;
++
++			motorcomm,clk-out-frequency-hz = <125000000>;
++			motorcomm,keep-pll-enabled;
++			motorcomm,auto-sleep-disabled;
++
++			pinctrl-0 = <&eth_phy_reset_pin>;
++			pinctrl-names = "default";
++			reset-assert-us = <15000>;
++			reset-deassert-us = <50000>;
++			reset-gpios = <&gpio1 RK_PC2 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
diff --git a/target/linux/rockchip/patches-5.15/100-rockchip-use-system-LED-for-OpenWrt.patch b/target/linux/rockchip/patches-5.15/100-rockchip-use-system-LED-for-OpenWrt.patch
index 5ec7952bfeaf88..01009c5eb8411b 100644
--- a/target/linux/rockchip/patches-5.15/100-rockchip-use-system-LED-for-OpenWrt.patch
+++ b/target/linux/rockchip/patches-5.15/100-rockchip-use-system-LED-for-OpenWrt.patch
@@ -15,17 +15,51 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 
 --- a/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s.dts
 +++ b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s.dts
-@@ -18,6 +18,13 @@
+@@ -16,6 +16,11 @@
+ 	aliases {
+ 		ethernet1 = &rtl8153;
  		mmc0 = &sdmmc;
- 	};
- 
-+	aliases {
++
 +		led-boot = &sys_led;
 +		led-failsafe = &sys_led;
 +		led-running = &sys_led;
 +		led-upgrade = &sys_led;
-+	};
-+
+ 	};
+ 
  	chosen {
- 		stdout-path = "serial2:1500000n8";
+@@ -49,18 +54,18 @@
+ 
+ 		lan_led: led-0 {
+ 			gpios = <&gpio2 RK_PB7 GPIO_ACTIVE_HIGH>;
+-			label = "nanopi-r2s:green:lan";
++			label = "green:lan";
+ 		};
+ 
+ 		sys_led: led-1 {
+ 			gpios = <&gpio0 RK_PA2 GPIO_ACTIVE_HIGH>;
+-			label = "nanopi-r2s:red:sys";
++			label = "red:sys";
+ 			default-state = "on";
+ 		};
+ 
+ 		wan_led: led-2 {
+ 			gpios = <&gpio2 RK_PC2 GPIO_ACTIVE_HIGH>;
+-			label = "nanopi-r2s:green:wan";
++			label = "green:wan";
+ 		};
  	};
+ 
+--- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+@@ -13,6 +13,11 @@
+ 	aliases {
+ 		mmc0 = &sdmmc;
+ 		mmc1 = &emmc;
++
++		led-boot = &power_led;
++		led-failsafe = &power_led;
++		led-running = &power_led;
++		led-upgrade = &power_led;
+ 	};
+ 
+ 	chosen {
diff --git a/target/linux/rockchip/patches-5.15/103-arm64-rockchip-add-OF-node-for-USB-eth-on-NanoPi-R2S.patch b/target/linux/rockchip/patches-5.15/103-arm64-rockchip-add-OF-node-for-USB-eth-on-NanoPi-R2S.patch
index 5fe60d1adecc6e..2221077c97ced8 100644
--- a/target/linux/rockchip/patches-5.15/103-arm64-rockchip-add-OF-node-for-USB-eth-on-NanoPi-R2S.patch
+++ b/target/linux/rockchip/patches-5.15/103-arm64-rockchip-add-OF-node-for-USB-eth-on-NanoPi-R2S.patch
@@ -14,7 +14,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 
 --- a/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s.dts
 +++ b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s.dts
-@@ -404,6 +404,7 @@
+@@ -402,6 +402,7 @@
  	rtl8153: device@2 {
  		compatible = "usbbda,8153";
  		reg = <2>;
diff --git a/target/linux/rockchip/patches-5.15/105-nanopi-r4s-sd-signalling.patch b/target/linux/rockchip/patches-5.15/105-nanopi-r4s-sd-signalling.patch
index a04c14b70a72fd..856970738aaacd 100644
--- a/target/linux/rockchip/patches-5.15/105-nanopi-r4s-sd-signalling.patch
+++ b/target/linux/rockchip/patches-5.15/105-nanopi-r4s-sd-signalling.patch
@@ -10,6 +10,16 @@ userspace or following a kernel panic is always working.
 
 Signed-off-by: David Bauer <mail@david-bauer.net>
 
+--- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+@@ -335,7 +335,6 @@
+ 	sd-uhs-sdr12;
+ 	sd-uhs-sdr25;
+ 	sd-uhs-sdr50;
+-	sd-uhs-sdr104;
+ 	vmmc-supply = <&vcc_sd>;
+ 	vqmmc-supply = <&vcc_sdio>;
+ 	status = "okay";
 --- a/arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts
 +++ b/arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts
 @@ -121,6 +121,11 @@
diff --git a/target/linux/rockchip/patches-5.15/107-arm64-dts-rockchip-Update-LED-properties-for-Orange-.patch b/target/linux/rockchip/patches-5.15/107-arm64-dts-rockchip-Update-LED-properties-for-Orange-.patch
new file mode 100644
index 00000000000000..b1e26d4e3e27d7
--- /dev/null
+++ b/target/linux/rockchip/patches-5.15/107-arm64-dts-rockchip-Update-LED-properties-for-Orange-.patch
@@ -0,0 +1,56 @@
+From d2166e3b3680bd2b206aebf1e1ce4c0d346f3c50 Mon Sep 17 00:00:00 2001
+From: Tianling Shen <cnsztl@gmail.com>
+Date: Fri, 19 May 2023 12:10:52 +0800
+Subject: [PATCH] arm64: dts: rockchip: Update LED properties for Orange Pi R1
+ Plus
+
+Add OpenWrt's LED aliases for showing system status.
+Also replace function/color with legacy label as OpenWrt relys on it
+to update LED settings.
+
+Signed-off-by: Tianling Shen <cnsztl@gmail.com>
+---
+ .../dts/rockchip/rk3328-orangepi-r1-plus.dts    | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+--- a/arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus.dts
+@@ -17,6 +17,11 @@
+ 	aliases {
+ 		ethernet1 = &rtl8153;
+ 		mmc0 = &sdmmc;
++
++		led-boot = &status_led;
++		led-failsafe = &status_led;
++		led-running = &status_led;
++		led-upgrade = &status_led;
+ 	};
+ 
+ 	chosen {
+@@ -36,22 +41,18 @@
+ 		pinctrl-names = "default";
+ 
+ 		led-0 {
+-			function = LED_FUNCTION_LAN;
+-			color = <LED_COLOR_ID_GREEN>;
+ 			gpios = <&gpio2 RK_PB7 GPIO_ACTIVE_HIGH>;
++			label = "green:lan";
+ 		};
+ 
+-		led-1 {
+-			function = LED_FUNCTION_STATUS;
+-			color = <LED_COLOR_ID_RED>;
++		status_led: led-1 {
+ 			gpios = <&gpio3 RK_PC5 GPIO_ACTIVE_HIGH>;
+-			linux,default-trigger = "heartbeat";
++			label = "red:status";
+ 		};
+ 
+ 		led-2 {
+-			function = LED_FUNCTION_WAN;
+-			color = <LED_COLOR_ID_GREEN>;
+ 			gpios = <&gpio2 RK_PC2 GPIO_ACTIVE_HIGH>;
++			label = "green:wan";
+ 		};
+ 	};
+ 
diff --git a/target/linux/rockchip/patches-5.15/108-arm64-dts-rockchip-add-LED-configuration-to-Orange-P.patch b/target/linux/rockchip/patches-5.15/108-arm64-dts-rockchip-add-LED-configuration-to-Orange-P.patch
new file mode 100644
index 00000000000000..37b59925fc16dc
--- /dev/null
+++ b/target/linux/rockchip/patches-5.15/108-arm64-dts-rockchip-add-LED-configuration-to-Orange-P.patch
@@ -0,0 +1,24 @@
+From b46a530d12ada422b9d5b2b97059e0d3ed950b40 Mon Sep 17 00:00:00 2001
+From: Tianling Shen <cnsztl@gmail.com>
+Date: Fri, 19 May 2023 12:38:04 +0800
+Subject: [PATCH] arm64: dts: rockchip: add LED configuration to Orange Pi R1
+ Plus
+
+Add the correct value for the RTL8153 LED configuration register to
+match the blink behavior of the other port on the device.
+
+Signed-off-by: Tianling Shen <cnsztl@gmail.com>
+---
+ arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus.dts
+@@ -362,6 +362,7 @@
+ 	rtl8153: device@2 {
+ 		compatible = "usbbda,8153";
+ 		reg = <2>;
++		realtek,led-data = <0x87>;
+ 	};
+ };
+ 
diff --git a/target/linux/rockchip/patches-6.1/005-arm64-dts-rockchip-add-EEPROM-node-for-NanoPi-R4S.patch b/target/linux/rockchip/patches-6.1/005-arm64-dts-rockchip-add-EEPROM-node-for-NanoPi-R4S.patch
new file mode 100644
index 00000000000000..792028b29290f5
--- /dev/null
+++ b/target/linux/rockchip/patches-6.1/005-arm64-dts-rockchip-add-EEPROM-node-for-NanoPi-R4S.patch
@@ -0,0 +1,31 @@
+From af20b3384e8723077cc6484160b0cf4e9be321de Mon Sep 17 00:00:00 2001
+From: Tianling Shen <cnsztl@gmail.com>
+Date: Mon, 7 Jun 2021 15:45:37 +0800
+Subject: [PATCH] arm64: dts: rockchip: add EEPROM node for NanoPi R4S
+
+NanoPi R4S has a EEPROM attached to the 2nd I2C bus (U92), which
+stores the MAC address.
+
+Signed-off-by: Tianling Shen <cnsztl@gmail.com>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts
+@@ -68,6 +68,15 @@
+ 	status = "disabled";
+ };
+ 
++&i2c2 {
++	eeprom@51 {
++		compatible = "microchip,24c02", "atmel,24c02";
++		reg = <0x51>;
++		pagesize = <16>;
++		read-only; /* This holds our MAC */
++	};
++};
++
+ &i2c4 {
+ 	status = "disabled";
+ };
diff --git a/target/linux/rockchip/patches-6.1/006-v6.4-arm64-dts-rockchip-Add-FriendlyARM-NanoPi-R2C.patch b/target/linux/rockchip/patches-6.1/006-v6.4-arm64-dts-rockchip-Add-FriendlyARM-NanoPi-R2C.patch
new file mode 100644
index 00000000000000..049c8ad1af80d3
--- /dev/null
+++ b/target/linux/rockchip/patches-6.1/006-v6.4-arm64-dts-rockchip-Add-FriendlyARM-NanoPi-R2C.patch
@@ -0,0 +1,70 @@
+From 004589ff9df5b75672a78b6c3c4cba93202b14c9 Mon Sep 17 00:00:00 2001
+From: Tianling Shen <cnsztl@gmail.com>
+Date: Sat, 25 Mar 2023 15:40:20 +0800
+Subject: [PATCH] arm64: dts: rockchip: Add FriendlyARM NanoPi R2C
+
+The NanoPi R2C is a minor variant of NanoPi R2S with the on-board NIC
+chip changed from rtl8211e to yt8521s, and otherwise identical to R2S.
+
+Signed-off-by: Tianling Shen <cnsztl@gmail.com>
+Link: https://lore.kernel.org/r/20230325074022.9818-3-cnsztl@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ arch/arm64/boot/dts/rockchip/Makefile         |  1 +
+ .../boot/dts/rockchip/rk3328-nanopi-r2c.dts   | 40 +++++++++++++++++++
+ 2 files changed, 41 insertions(+)
+ create mode 100644 arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2c.dts
+
+--- a/arch/arm64/boot/dts/rockchip/Makefile
++++ b/arch/arm64/boot/dts/rockchip/Makefile
+@@ -10,6 +10,7 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3318-a9
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3326-odroid-go2.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-a1.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-evb.dtb
++dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2c.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2s.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-rock64.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-rock-pi-e.dtb
+--- /dev/null
++++ b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2c.dts
+@@ -0,0 +1,40 @@
++// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
++/*
++ * Copyright (c) 2021 FriendlyElec Computer Tech. Co., Ltd.
++ * (http://www.friendlyarm.com)
++ *
++ * Copyright (c) 2021-2023 Tianling Shen <cnsztl@gmail.com>
++ */
++
++/dts-v1/;
++#include "rk3328-nanopi-r2s.dts"
++
++/ {
++	model = "FriendlyElec NanoPi R2C";
++	compatible = "friendlyarm,nanopi-r2c", "rockchip,rk3328";
++};
++
++&gmac2io {
++	phy-handle = <&yt8521s>;
++	tx_delay = <0x22>;
++	rx_delay = <0x12>;
++
++	mdio {
++		/delete-node/ ethernet-phy@1;
++
++		yt8521s: ethernet-phy@3 {
++			compatible = "ethernet-phy-ieee802.3-c22";
++			reg = <3>;
++
++			motorcomm,clk-out-frequency-hz = <125000000>;
++			motorcomm,keep-pll-enabled;
++			motorcomm,auto-sleep-disabled;
++
++			pinctrl-0 = <&eth_phy_reset_pin>;
++			pinctrl-names = "default";
++			reset-assert-us = <10000>;
++			reset-deassert-us = <50000>;
++			reset-gpios = <&gpio1 RK_PC2 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
diff --git a/target/linux/rockchip/patches-6.1/007-v6.3-arm64-dts-rockchip-rk3328-Add-Orange-Pi-R1-Plus.patch b/target/linux/rockchip/patches-6.1/007-v6.3-arm64-dts-rockchip-rk3328-Add-Orange-Pi-R1-Plus.patch
new file mode 100644
index 00000000000000..4e48218b8943f9
--- /dev/null
+++ b/target/linux/rockchip/patches-6.1/007-v6.3-arm64-dts-rockchip-rk3328-Add-Orange-Pi-R1-Plus.patch
@@ -0,0 +1,407 @@
+From 51712e1d014aaaa4c6e1e7e84932d58b5c0f59ed Mon Sep 17 00:00:00 2001
+From: Chukun Pan <amadeus@jmu.edu.cn>
+Date: Sat, 3 Dec 2022 15:41:49 +0800
+Subject: [PATCH] arm64: dts: rockchip: rk3328: Add Orange Pi R1 Plus
+
+Orange Pi R1 Plus is a Rockchip RK3328 based SBC by Xunlong.
+
+This device is similar to the NanoPi R2S, and has a 16MB
+SPI NOR (mx25l12805d). The reset button is changed to
+directly reset the power supply, another detail is that
+both network ports have independent MAC addresses.
+
+Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
+Link: https://lore.kernel.org/r/20221203074149.11543-3-amadeus@jmu.edu.cn
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ arch/arm64/boot/dts/rockchip/Makefile         |   1 +
+ .../dts/rockchip/rk3328-orangepi-r1-plus.dts  | 373 ++++++++++++++++++
+ 2 files changed, 374 insertions(+)
+ create mode 100644 arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus.dts
+
+--- a/arch/arm64/boot/dts/rockchip/Makefile
++++ b/arch/arm64/boot/dts/rockchip/Makefile
+@@ -12,6 +12,7 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-a1
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-evb.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2c.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2s.dtb
++dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-orangepi-r1-plus.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-rock64.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-rock-pi-e.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-roc-cc.dtb
+--- /dev/null
++++ b/arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus.dts
+@@ -0,0 +1,373 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Based on rk3328-nanopi-r2s.dts, which is:
++ *   Copyright (c) 2020 David Bauer <mail@david-bauer.net>
++ */
++
++/dts-v1/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/leds/common.h>
++#include "rk3328.dtsi"
++
++/ {
++	model = "Xunlong Orange Pi R1 Plus";
++	compatible = "xunlong,orangepi-r1-plus", "rockchip,rk3328";
++
++	aliases {
++		ethernet1 = &rtl8153;
++		mmc0 = &sdmmc;
++	};
++
++	chosen {
++		stdout-path = "serial2:1500000n8";
++	};
++
++	gmac_clk: gmac-clock {
++		compatible = "fixed-clock";
++		clock-frequency = <125000000>;
++		clock-output-names = "gmac_clkin";
++		#clock-cells = <0>;
++	};
++
++	leds {
++		compatible = "gpio-leds";
++		pinctrl-0 = <&lan_led_pin>, <&sys_led_pin>, <&wan_led_pin>;
++		pinctrl-names = "default";
++
++		led-0 {
++			function = LED_FUNCTION_LAN;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&gpio2 RK_PB7 GPIO_ACTIVE_HIGH>;
++		};
++
++		led-1 {
++			function = LED_FUNCTION_STATUS;
++			color = <LED_COLOR_ID_RED>;
++			gpios = <&gpio3 RK_PC5 GPIO_ACTIVE_HIGH>;
++			linux,default-trigger = "heartbeat";
++		};
++
++		led-2 {
++			function = LED_FUNCTION_WAN;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&gpio2 RK_PC2 GPIO_ACTIVE_HIGH>;
++		};
++	};
++
++	vcc_sd: sdmmc-regulator {
++		compatible = "regulator-fixed";
++		gpio = <&gpio0 RK_PD6 GPIO_ACTIVE_LOW>;
++		pinctrl-0 = <&sdmmc0m1_pin>;
++		pinctrl-names = "default";
++		regulator-name = "vcc_sd";
++		regulator-boot-on;
++		vin-supply = <&vcc_io>;
++	};
++
++	vcc_sys: vcc-sys-regulator {
++		compatible = "regulator-fixed";
++		regulator-name = "vcc_sys";
++		regulator-always-on;
++		regulator-boot-on;
++		regulator-min-microvolt = <5000000>;
++		regulator-max-microvolt = <5000000>;
++	};
++
++	vdd_5v_lan: vdd-5v-lan-regulator {
++		compatible = "regulator-fixed";
++		enable-active-high;
++		gpio = <&gpio2 RK_PC6 GPIO_ACTIVE_HIGH>;
++		pinctrl-0 = <&lan_vdd_pin>;
++		pinctrl-names = "default";
++		regulator-name = "vdd_5v_lan";
++		regulator-always-on;
++		regulator-boot-on;
++		vin-supply = <&vcc_sys>;
++	};
++};
++
++&cpu0 {
++	cpu-supply = <&vdd_arm>;
++};
++
++&cpu1 {
++	cpu-supply = <&vdd_arm>;
++};
++
++&cpu2 {
++	cpu-supply = <&vdd_arm>;
++};
++
++&cpu3 {
++	cpu-supply = <&vdd_arm>;
++};
++
++&display_subsystem {
++	status = "disabled";
++};
++
++&gmac2io {
++	assigned-clocks = <&cru SCLK_MAC2IO>, <&cru SCLK_MAC2IO_EXT>;
++	assigned-clock-parents = <&gmac_clk>, <&gmac_clk>;
++	clock_in_out = "input";
++	phy-handle = <&rtl8211e>;
++	phy-mode = "rgmii";
++	phy-supply = <&vcc_io>;
++	pinctrl-0 = <&rgmiim1_pins>;
++	pinctrl-names = "default";
++	snps,aal;
++	rx_delay = <0x18>;
++	tx_delay = <0x24>;
++	status = "okay";
++
++	mdio {
++		compatible = "snps,dwmac-mdio";
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		rtl8211e: ethernet-phy@1 {
++			reg = <1>;
++			pinctrl-0 = <&eth_phy_reset_pin>;
++			pinctrl-names = "default";
++			reset-assert-us = <10000>;
++			reset-deassert-us = <50000>;
++			reset-gpios = <&gpio1 RK_PC2 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
++
++&i2c1 {
++	status = "okay";
++
++	rk805: pmic@18 {
++		compatible = "rockchip,rk805";
++		reg = <0x18>;
++		interrupt-parent = <&gpio1>;
++		interrupts = <24 IRQ_TYPE_LEVEL_LOW>;
++		#clock-cells = <1>;
++		clock-output-names = "xin32k", "rk805-clkout2";
++		gpio-controller;
++		#gpio-cells = <2>;
++		pinctrl-0 = <&pmic_int_l>;
++		pinctrl-names = "default";
++		rockchip,system-power-controller;
++		wakeup-source;
++
++		vcc1-supply = <&vcc_sys>;
++		vcc2-supply = <&vcc_sys>;
++		vcc3-supply = <&vcc_sys>;
++		vcc4-supply = <&vcc_sys>;
++		vcc5-supply = <&vcc_io>;
++		vcc6-supply = <&vcc_sys>;
++
++		regulators {
++			vdd_log: DCDC_REG1 {
++				regulator-name = "vdd_log";
++				regulator-always-on;
++				regulator-boot-on;
++				regulator-min-microvolt = <712500>;
++				regulator-max-microvolt = <1450000>;
++				regulator-ramp-delay = <12500>;
++
++				regulator-state-mem {
++					regulator-on-in-suspend;
++					regulator-suspend-microvolt = <1000000>;
++				};
++			};
++
++			vdd_arm: DCDC_REG2 {
++				regulator-name = "vdd_arm";
++				regulator-always-on;
++				regulator-boot-on;
++				regulator-min-microvolt = <712500>;
++				regulator-max-microvolt = <1450000>;
++				regulator-ramp-delay = <12500>;
++
++				regulator-state-mem {
++					regulator-on-in-suspend;
++					regulator-suspend-microvolt = <950000>;
++				};
++			};
++
++			vcc_ddr: DCDC_REG3 {
++				regulator-name = "vcc_ddr";
++				regulator-always-on;
++				regulator-boot-on;
++
++				regulator-state-mem {
++					regulator-on-in-suspend;
++				};
++			};
++
++			vcc_io: DCDC_REG4 {
++				regulator-name = "vcc_io";
++				regulator-always-on;
++				regulator-boot-on;
++				regulator-min-microvolt = <3300000>;
++				regulator-max-microvolt = <3300000>;
++
++				regulator-state-mem {
++					regulator-on-in-suspend;
++					regulator-suspend-microvolt = <3300000>;
++				};
++			};
++
++			vcc_18: LDO_REG1 {
++				regulator-name = "vcc_18";
++				regulator-always-on;
++				regulator-boot-on;
++				regulator-min-microvolt = <1800000>;
++				regulator-max-microvolt = <1800000>;
++
++				regulator-state-mem {
++					regulator-on-in-suspend;
++					regulator-suspend-microvolt = <1800000>;
++				};
++			};
++
++			vcc18_emmc: LDO_REG2 {
++				regulator-name = "vcc18_emmc";
++				regulator-always-on;
++				regulator-boot-on;
++				regulator-min-microvolt = <1800000>;
++				regulator-max-microvolt = <1800000>;
++
++				regulator-state-mem {
++					regulator-on-in-suspend;
++					regulator-suspend-microvolt = <1800000>;
++				};
++			};
++
++			vdd_10: LDO_REG3 {
++				regulator-name = "vdd_10";
++				regulator-always-on;
++				regulator-boot-on;
++				regulator-min-microvolt = <1000000>;
++				regulator-max-microvolt = <1000000>;
++
++				regulator-state-mem {
++					regulator-on-in-suspend;
++					regulator-suspend-microvolt = <1000000>;
++				};
++			};
++		};
++	};
++};
++
++&io_domains {
++	pmuio-supply = <&vcc_io>;
++	vccio1-supply = <&vcc_io>;
++	vccio2-supply = <&vcc18_emmc>;
++	vccio3-supply = <&vcc_io>;
++	vccio4-supply = <&vcc_io>;
++	vccio5-supply = <&vcc_io>;
++	vccio6-supply = <&vcc_io>;
++	status = "okay";
++};
++
++&pinctrl {
++	gmac2io {
++		eth_phy_reset_pin: eth-phy-reset-pin {
++			rockchip,pins = <1 RK_PC2 RK_FUNC_GPIO &pcfg_pull_down>;
++		};
++	};
++
++	leds {
++		lan_led_pin: lan-led-pin {
++			rockchip,pins = <2 RK_PB7 RK_FUNC_GPIO &pcfg_pull_none>;
++		};
++
++		sys_led_pin: sys-led-pin {
++			rockchip,pins = <3 RK_PC5 RK_FUNC_GPIO &pcfg_pull_none>;
++		};
++
++		wan_led_pin: wan-led-pin {
++			rockchip,pins = <2 RK_PC2 RK_FUNC_GPIO &pcfg_pull_none>;
++		};
++	};
++
++	lan {
++		lan_vdd_pin: lan-vdd-pin {
++			rockchip,pins = <2 RK_PC6 RK_FUNC_GPIO &pcfg_pull_none>;
++		};
++	};
++
++	pmic {
++		pmic_int_l: pmic-int-l {
++			rockchip,pins = <1 RK_PD0 RK_FUNC_GPIO &pcfg_pull_up>;
++		};
++	};
++};
++
++&pwm2 {
++	status = "okay";
++};
++
++&sdmmc {
++	bus-width = <4>;
++	cap-sd-highspeed;
++	disable-wp;
++	pinctrl-0 = <&sdmmc0_clk>, <&sdmmc0_cmd>, <&sdmmc0_dectn>, <&sdmmc0_bus4>;
++	pinctrl-names = "default";
++	vmmc-supply = <&vcc_sd>;
++	status = "okay";
++};
++
++&spi0 {
++	status = "okay";
++
++	flash@0 {
++		compatible = "jedec,spi-nor";
++		reg = <0>;
++		spi-max-frequency = <50000000>;
++	};
++};
++
++&tsadc {
++	rockchip,hw-tshut-mode = <0>;
++	rockchip,hw-tshut-polarity = <0>;
++	status = "okay";
++};
++
++&u2phy {
++	status = "okay";
++};
++
++&u2phy_host {
++	status = "okay";
++};
++
++&u2phy_otg {
++	status = "okay";
++};
++
++&uart2 {
++	status = "okay";
++};
++
++&usb20_otg {
++	dr_mode = "host";
++	status = "okay";
++};
++
++&usbdrd3 {
++	dr_mode = "host";
++	status = "okay";
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	/* Second port is for USB 3.0 */
++	rtl8153: device@2 {
++		compatible = "usbbda,8153";
++		reg = <2>;
++	};
++};
++
++&usb_host0_ehci {
++	status = "okay";
++};
++
++&usb_host0_ohci {
++	status = "okay";
++};
diff --git a/target/linux/rockchip/patches-6.1/008-v6.4-arm64-dts-rockchip-Add-Xunlong-OrangePi-R1-Plus-LTS.patch b/target/linux/rockchip/patches-6.1/008-v6.4-arm64-dts-rockchip-Add-Xunlong-OrangePi-R1-Plus-LTS.patch
new file mode 100644
index 00000000000000..78d3d51a17ad64
--- /dev/null
+++ b/target/linux/rockchip/patches-6.1/008-v6.4-arm64-dts-rockchip-Add-Xunlong-OrangePi-R1-Plus-LTS.patch
@@ -0,0 +1,71 @@
+From 387b3bbac5ea6a0a105d685237f033ffe0f184f1 Mon Sep 17 00:00:00 2001
+From: Tianling Shen <cnsztl@gmail.com>
+Date: Sat, 25 Mar 2023 15:40:22 +0800
+Subject: [PATCH] arm64: dts: rockchip: Add Xunlong OrangePi R1 Plus LTS
+
+The OrangePi R1 Plus LTS is a minor variant of OrangePi R1 Plus with
+the on-board NIC chip changed from rtl8211e to yt8531c, and otherwise
+identical to OrangePi R1 Plus.
+
+Signed-off-by: Tianling Shen <cnsztl@gmail.com>
+Link: https://lore.kernel.org/r/20230325074022.9818-5-cnsztl@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ arch/arm64/boot/dts/rockchip/Makefile         |  1 +
+ .../rockchip/rk3328-orangepi-r1-plus-lts.dts  | 40 +++++++++++++++++++
+ 2 files changed, 41 insertions(+)
+ create mode 100644 arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus-lts.dts
+
+--- a/arch/arm64/boot/dts/rockchip/Makefile
++++ b/arch/arm64/boot/dts/rockchip/Makefile
+@@ -13,6 +13,7 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-ev
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2c.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2s.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-orangepi-r1-plus.dtb
++dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-orangepi-r1-plus-lts.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-rock64.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-rock-pi-e.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-roc-cc.dtb
+--- /dev/null
++++ b/arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus-lts.dts
+@@ -0,0 +1,40 @@
++// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
++/*
++ * Copyright (c) 2016 Xunlong Software. Co., Ltd.
++ * (http://www.orangepi.org)
++ *
++ * Copyright (c) 2021-2023 Tianling Shen <cnsztl@gmail.com>
++ */
++
++/dts-v1/;
++#include "rk3328-orangepi-r1-plus.dts"
++
++/ {
++	model = "Xunlong Orange Pi R1 Plus LTS";
++	compatible = "xunlong,orangepi-r1-plus-lts", "rockchip,rk3328";
++};
++
++&gmac2io {
++	phy-handle = <&yt8531c>;
++	tx_delay = <0x19>;
++	rx_delay = <0x05>;
++
++	mdio {
++		/delete-node/ ethernet-phy@1;
++
++		yt8531c: ethernet-phy@0 {
++			compatible = "ethernet-phy-ieee802.3-c22";
++			reg = <0>;
++
++			motorcomm,clk-out-frequency-hz = <125000000>;
++			motorcomm,keep-pll-enabled;
++			motorcomm,auto-sleep-disabled;
++
++			pinctrl-0 = <&eth_phy_reset_pin>;
++			pinctrl-names = "default";
++			reset-assert-us = <15000>;
++			reset-deassert-us = <50000>;
++			reset-gpios = <&gpio1 RK_PC2 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
diff --git a/target/linux/rockchip/patches-6.1/100-rockchip-use-system-LED-for-OpenWrt.patch b/target/linux/rockchip/patches-6.1/100-rockchip-use-system-LED-for-OpenWrt.patch
new file mode 100644
index 00000000000000..01009c5eb8411b
--- /dev/null
+++ b/target/linux/rockchip/patches-6.1/100-rockchip-use-system-LED-for-OpenWrt.patch
@@ -0,0 +1,65 @@
+From 6731d2c9039fbe1ecf21915eab3acee0a999508a Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Fri, 10 Jul 2020 21:38:20 +0200
+Subject: [PATCH] rockchip: use system LED for OpenWrt
+
+Use the SYS LED on the casing for showing system status.
+
+This patch is kept separate from the NanoPi R2S support patch, as i plan
+on submitting the device support upstream.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s.dts | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s.dts
+@@ -16,6 +16,11 @@
+ 	aliases {
+ 		ethernet1 = &rtl8153;
+ 		mmc0 = &sdmmc;
++
++		led-boot = &sys_led;
++		led-failsafe = &sys_led;
++		led-running = &sys_led;
++		led-upgrade = &sys_led;
+ 	};
+ 
+ 	chosen {
+@@ -49,18 +54,18 @@
+ 
+ 		lan_led: led-0 {
+ 			gpios = <&gpio2 RK_PB7 GPIO_ACTIVE_HIGH>;
+-			label = "nanopi-r2s:green:lan";
++			label = "green:lan";
+ 		};
+ 
+ 		sys_led: led-1 {
+ 			gpios = <&gpio0 RK_PA2 GPIO_ACTIVE_HIGH>;
+-			label = "nanopi-r2s:red:sys";
++			label = "red:sys";
+ 			default-state = "on";
+ 		};
+ 
+ 		wan_led: led-2 {
+ 			gpios = <&gpio2 RK_PC2 GPIO_ACTIVE_HIGH>;
+-			label = "nanopi-r2s:green:wan";
++			label = "green:wan";
+ 		};
+ 	};
+ 
+--- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+@@ -13,6 +13,11 @@
+ 	aliases {
+ 		mmc0 = &sdmmc;
+ 		mmc1 = &emmc;
++
++		led-boot = &power_led;
++		led-failsafe = &power_led;
++		led-running = &power_led;
++		led-upgrade = &power_led;
+ 	};
+ 
+ 	chosen {
diff --git a/target/linux/rockchip/patches-6.1/103-arm64-rockchip-add-OF-node-for-USB-eth-on-NanoPi-R2S.patch b/target/linux/rockchip/patches-6.1/103-arm64-rockchip-add-OF-node-for-USB-eth-on-NanoPi-R2S.patch
new file mode 100644
index 00000000000000..2221077c97ced8
--- /dev/null
+++ b/target/linux/rockchip/patches-6.1/103-arm64-rockchip-add-OF-node-for-USB-eth-on-NanoPi-R2S.patch
@@ -0,0 +1,24 @@
+From 2795c8b31a686bdb8338f9404d18ef7a154f0d75 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sun, 26 Jul 2020 13:32:59 +0200
+Subject: [PATCH] arm64: rockchip: add OF node for USB eth on NanoPi R2S
+
+This adds the OF node for the USB3 ethernet adapter on the FriendlyARM
+NanoPi R2S. Add the correct value for the RTL8153 LED configuration
+register to match the blink behavior of the other port on the device.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s.dts | 7 +++++++
+ 1 file changed, 1 insertions(+)
+
+--- a/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s.dts
+@@ -402,6 +402,7 @@
+ 	rtl8153: device@2 {
+ 		compatible = "usbbda,8153";
+ 		reg = <2>;
++		realtek,led-data = <0x87>;
+ 	};
+ };
+ 
diff --git a/target/linux/rockchip/patches-6.1/105-nanopi-r4s-sd-signalling.patch b/target/linux/rockchip/patches-6.1/105-nanopi-r4s-sd-signalling.patch
new file mode 100644
index 00000000000000..856970738aaacd
--- /dev/null
+++ b/target/linux/rockchip/patches-6.1/105-nanopi-r4s-sd-signalling.patch
@@ -0,0 +1,36 @@
+From: David Bauer <mail@david-bauer.net>
+Subject: arm64: dts: rockchip: disable UHS modes for NanoPi R4S
+
+The NanoPi R4S leaves the SD card in 1.8V signalling when rebooting
+while U-Boot requires the card to be in 3.3V mode.
+
+Remove UHS support from the SD controller so the card remains in 3.3V
+mode. This reduces transfer speeds but ensures a reboot whether from
+userspace or following a kernel panic is always working.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+
+--- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+@@ -335,7 +335,6 @@
+ 	sd-uhs-sdr12;
+ 	sd-uhs-sdr25;
+ 	sd-uhs-sdr50;
+-	sd-uhs-sdr104;
+ 	vmmc-supply = <&vcc_sd>;
+ 	vqmmc-supply = <&vcc_sdio>;
+ 	status = "okay";
+--- a/arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts
+@@ -121,6 +121,11 @@
+ 	status = "disabled";
+ };
+ 
++&sdmmc {
++	/delete-property/ sd-uhs-sdr104;
++	cap-sd-highspeed;
++};
++
+ &u2phy0_host {
+ 	phy-supply = <&vdd_5v>;
+ };
diff --git a/target/linux/rockchip/patches-6.1/106-r4s-openwrt-leds.patch b/target/linux/rockchip/patches-6.1/106-r4s-openwrt-leds.patch
new file mode 100644
index 00000000000000..d7579d61e90ce3
--- /dev/null
+++ b/target/linux/rockchip/patches-6.1/106-r4s-openwrt-leds.patch
@@ -0,0 +1,16 @@
+--- a/arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts
+@@ -19,6 +19,13 @@
+ 	model = "FriendlyElec NanoPi R4S";
+ 	compatible = "friendlyarm,nanopi-r4s", "rockchip,rk3399";
+ 
++	aliases {
++		led-boot = &sys_led;
++		led-failsafe = &sys_led;
++		led-running = &sys_led;
++		led-upgrade = &sys_led;
++	};
++
+ 	/delete-node/ display-subsystem;
+ 
+ 	gpio-leds {
diff --git a/target/linux/rockchip/patches-6.1/107-arm64-dts-rockchip-Update-LED-properties-for-Orange-.patch b/target/linux/rockchip/patches-6.1/107-arm64-dts-rockchip-Update-LED-properties-for-Orange-.patch
new file mode 100644
index 00000000000000..b1e26d4e3e27d7
--- /dev/null
+++ b/target/linux/rockchip/patches-6.1/107-arm64-dts-rockchip-Update-LED-properties-for-Orange-.patch
@@ -0,0 +1,56 @@
+From d2166e3b3680bd2b206aebf1e1ce4c0d346f3c50 Mon Sep 17 00:00:00 2001
+From: Tianling Shen <cnsztl@gmail.com>
+Date: Fri, 19 May 2023 12:10:52 +0800
+Subject: [PATCH] arm64: dts: rockchip: Update LED properties for Orange Pi R1
+ Plus
+
+Add OpenWrt's LED aliases for showing system status.
+Also replace function/color with legacy label as OpenWrt relys on it
+to update LED settings.
+
+Signed-off-by: Tianling Shen <cnsztl@gmail.com>
+---
+ .../dts/rockchip/rk3328-orangepi-r1-plus.dts    | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+--- a/arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus.dts
+@@ -17,6 +17,11 @@
+ 	aliases {
+ 		ethernet1 = &rtl8153;
+ 		mmc0 = &sdmmc;
++
++		led-boot = &status_led;
++		led-failsafe = &status_led;
++		led-running = &status_led;
++		led-upgrade = &status_led;
+ 	};
+ 
+ 	chosen {
+@@ -36,22 +41,18 @@
+ 		pinctrl-names = "default";
+ 
+ 		led-0 {
+-			function = LED_FUNCTION_LAN;
+-			color = <LED_COLOR_ID_GREEN>;
+ 			gpios = <&gpio2 RK_PB7 GPIO_ACTIVE_HIGH>;
++			label = "green:lan";
+ 		};
+ 
+-		led-1 {
+-			function = LED_FUNCTION_STATUS;
+-			color = <LED_COLOR_ID_RED>;
++		status_led: led-1 {
+ 			gpios = <&gpio3 RK_PC5 GPIO_ACTIVE_HIGH>;
+-			linux,default-trigger = "heartbeat";
++			label = "red:status";
+ 		};
+ 
+ 		led-2 {
+-			function = LED_FUNCTION_WAN;
+-			color = <LED_COLOR_ID_GREEN>;
+ 			gpios = <&gpio2 RK_PC2 GPIO_ACTIVE_HIGH>;
++			label = "green:wan";
+ 		};
+ 	};
+ 
diff --git a/target/linux/rockchip/patches-6.1/108-arm64-dts-rockchip-add-LED-configuration-to-Orange-P.patch b/target/linux/rockchip/patches-6.1/108-arm64-dts-rockchip-add-LED-configuration-to-Orange-P.patch
new file mode 100644
index 00000000000000..37b59925fc16dc
--- /dev/null
+++ b/target/linux/rockchip/patches-6.1/108-arm64-dts-rockchip-add-LED-configuration-to-Orange-P.patch
@@ -0,0 +1,24 @@
+From b46a530d12ada422b9d5b2b97059e0d3ed950b40 Mon Sep 17 00:00:00 2001
+From: Tianling Shen <cnsztl@gmail.com>
+Date: Fri, 19 May 2023 12:38:04 +0800
+Subject: [PATCH] arm64: dts: rockchip: add LED configuration to Orange Pi R1
+ Plus
+
+Add the correct value for the RTL8153 LED configuration register to
+match the blink behavior of the other port on the device.
+
+Signed-off-by: Tianling Shen <cnsztl@gmail.com>
+---
+ arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus.dts
+@@ -362,6 +362,7 @@
+ 	rtl8153: device@2 {
+ 		compatible = "usbbda,8153";
+ 		reg = <2>;
++		realtek,led-data = <0x87>;
+ 	};
+ };
+ 
diff --git a/target/linux/sifiveu/Makefile b/target/linux/sifiveu/Makefile
new file mode 100644
index 00000000000000..f88164e7af330b
--- /dev/null
+++ b/target/linux/sifiveu/Makefile
@@ -0,0 +1,23 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2022 Toco Technologies <info@toco.ae>
+#
+include $(TOPDIR)/rules.mk
+
+ARCH:=riscv64
+BOARD:=sifiveu
+BOARDNAME:=SiFive U-based RISC-V boards
+FEATURES:=ext4
+KERNELNAME:=Image dtbs
+SUBTARGETS:=generic
+
+KERNEL_PATCHVER:=5.15
+
+include $(INCLUDE_DIR)/target.mk
+
+define Target/Description
+	Build firmware images for the SiFive U-based boards
+	(HiFive boards)
+endef
+
+$(eval $(call BuildTarget))
diff --git a/target/linux/sifiveu/base-files/etc/board.d/01_leds b/target/linux/sifiveu/base-files/etc/board.d/01_leds
new file mode 100644
index 00000000000000..5610a791ecd058
--- /dev/null
+++ b/target/linux/sifiveu/base-files/etc/board.d/01_leds
@@ -0,0 +1,21 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2022 OpenWrt.org
+#
+
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+sifive,hifive-unleashed-a00)
+	ucidef_set_led_netdev "lan" "LAN" "green:d3" "eth0"
+	;;
+sifive,hifive-unmatched-a00)
+	ucidef_set_led_netdev "lan" "LAN" "green:d2" "eth0"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/sifiveu/base-files/etc/board.d/02_network b/target/linux/sifiveu/base-files/etc/board.d/02_network
new file mode 100644
index 00000000000000..ca9f7f200808e7
--- /dev/null
+++ b/target/linux/sifiveu/base-files/etc/board.d/02_network
@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2022 OpenWrt.org
+#
+
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+*)
+	ucidef_set_interface_lan 'eth0'
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/sifiveu/base-files/etc/inittab b/target/linux/sifiveu/base-files/etc/inittab
new file mode 100644
index 00000000000000..69f97c47c814d3
--- /dev/null
+++ b/target/linux/sifiveu/base-files/etc/inittab
@@ -0,0 +1,4 @@
+::sysinit:/etc/init.d/rcS S boot
+::shutdown:/etc/init.d/rcS K shutdown
+ttySIF0::askfirst:/usr/libexec/login.sh
+tty1::askfirst:/usr/libexec/login.sh
diff --git a/target/linux/sifiveu/base-files/lib/preinit/79_move_config b/target/linux/sifiveu/base-files/lib/preinit/79_move_config
new file mode 100644
index 00000000000000..2796c4d01b64e5
--- /dev/null
+++ b/target/linux/sifiveu/base-files/lib/preinit/79_move_config
@@ -0,0 +1,19 @@
+# Copyright (C) 2012-2015 OpenWrt.org
+
+move_config() {
+	local partdev
+
+	. /lib/upgrade/common.sh
+
+	if export_bootdevice && export_partdevice partdev 3; then
+		if mount -t vfat -o rw,noatime "/dev/$partdev" /mnt; then
+			if [ -f "/mnt/$BACKUP_FILE" ]; then
+				mv -f "/mnt/$BACKUP_FILE" /
+			fi
+			umount /mnt
+		fi
+	fi
+}
+
+boot_hook_add preinit_mount_root move_config
+
diff --git a/target/linux/sifiveu/base-files/lib/upgrade/platform.sh b/target/linux/sifiveu/base-files/lib/upgrade/platform.sh
new file mode 100644
index 00000000000000..b5f6bada41937d
--- /dev/null
+++ b/target/linux/sifiveu/base-files/lib/upgrade/platform.sh
@@ -0,0 +1,86 @@
+platform_check_image() {
+	local diskdev partdev diff
+
+	export_bootdevice && export_partdevice diskdev 0 || {
+		echo "Unable to determine upgrade device"
+		return 1
+	}
+
+	get_partitions "/dev/$diskdev" bootdisk
+
+	#extract the boot sector from the image
+	get_image "$@" | dd of=/tmp/image.bs count=1 bs=512b 2>/dev/null
+
+	get_partitions /tmp/image.bs image
+
+	#compare tables
+	diff="$(grep -F -x -v -f /tmp/partmap.bootdisk /tmp/partmap.image)"
+
+	rm -f /tmp/image.bs /tmp/partmap.bootdisk /tmp/partmap.image
+
+	if [ -n "$diff" ]; then
+		echo "Partition layout has changed. Full image will be written."
+		ask_bool 0 "Abort" && exit 1
+		return 0
+	fi
+}
+
+platform_copy_config() {
+	local partdev
+
+	if export_partdevice partdev 3; then
+		mount -t vfat -o rw,noatime "/dev/$partdev" /mnt
+		cp -af "$UPGRADE_BACKUP" "/mnt/$BACKUP_FILE"
+		umount /mnt
+	fi
+}
+
+platform_do_upgrade() {
+	local diskdev partdev diff
+
+	export_bootdevice && export_partdevice diskdev 0 || {
+		echo "Unable to determine upgrade device"
+		return 1
+	}
+
+	sync
+
+	if [ "$UPGRADE_OPT_SAVE_PARTITIONS" = "1" ]; then
+		get_partitions "/dev/$diskdev" bootdisk
+
+		#extract the boot sector from the image
+		get_image "$@" | dd of=/tmp/image.bs count=1 bs=512b
+
+		get_partitions /tmp/image.bs image
+
+		#compare tables
+		diff="$(grep -F -x -v -f /tmp/partmap.bootdisk /tmp/partmap.image)"
+	else
+		diff=1
+	fi
+
+	if [ -n "$diff" ]; then
+		get_image "$@" | dd of="/dev/$diskdev" bs=4096 conv=fsync
+
+		# Separate removal and addtion is necessary; otherwise, partition 1
+		# will be missing if it overlaps with the old partition 2
+		partx -d - "/dev/$diskdev"
+		partx -a - "/dev/$diskdev"
+
+		return 0
+	fi
+
+	#iterate over each partition from the image and write it to the boot disk
+	while read part start size; do
+		if export_partdevice partdev $part; then
+			echo "Writing image to /dev/$partdev..."
+			get_image "$@" | dd of="/dev/$partdev" ibs="512" obs=1M skip="$start" count="$size" conv=fsync
+		else
+			echo "Unable to find partition $part device, skipped."
+		fi
+	done < /tmp/partmap.image
+
+	#copy partition uuid
+	echo "Writing new UUID to /dev/$diskdev..."
+	get_image "$@" | dd of="/dev/$diskdev" bs=1 skip=440 count=4 seek=440 conv=fsync
+}
diff --git a/target/linux/sifiveu/config-5.15 b/target/linux/sifiveu/config-5.15
new file mode 100644
index 00000000000000..de3fe5b46f7563
--- /dev/null
+++ b/target/linux/sifiveu/config-5.15
@@ -0,0 +1,362 @@
+CONFIG_64BIT=y
+CONFIG_ARCH_CLOCKSOURCE_INIT=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_ARCH_MMAP_RND_BITS=18
+CONFIG_ARCH_MMAP_RND_BITS_MAX=24
+CONFIG_ARCH_MMAP_RND_BITS_MIN=18
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX=y
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT=y
+# CONFIG_ARCH_RV32I is not set
+CONFIG_ARCH_RV64I=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_STACKWALK=y
+CONFIG_ASSOCIATIVE_ARRAY=y
+CONFIG_ATA=y
+CONFIG_ATA_VERBOSE_ERROR=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_MQ_VIRTIO=y
+CONFIG_CAVIUM_PTP=y
+CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
+CONFIG_CLK_ANALOGBITS_WRPLL_CLN28HPC=y
+CONFIG_CLK_SIFIVE=y
+CONFIG_CLK_SIFIVE_PRCI=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CLZ_TAB=y
+CONFIG_CMODEL_MEDANY=y
+# CONFIG_CMODEL_MEDLOW is not set
+CONFIG_COMMON_CLK=y
+# CONFIG_COMPAT_32BIT_TIME is not set
+CONFIG_COMPAT_BRK=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_COREDUMP=y
+CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y
+CONFIG_CPU_ISOLATION=y
+CONFIG_CPU_RMAP=y
+CONFIG_CRC16=y
+# CONFIG_CRC32_SARWATE is not set
+CONFIG_CRC32_SLICEBY8=y
+CONFIG_CRC7=y
+CONFIG_CRC_ITU_T=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_DRBG=y
+CONFIG_CRYPTO_DRBG_HMAC=y
+CONFIG_CRYPTO_DRBG_MENU=y
+CONFIG_CRYPTO_ECHAINIV=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_JITTERENTROPY=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=1
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_RNG_DEFAULT=y
+CONFIG_CRYPTO_RSA=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DECOMPRESS_GZIP=y
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_DNOTIFY=y
+CONFIG_DTC=y
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_EDAC=y
+# CONFIG_EDAC_DEBUG is not set
+CONFIG_EDAC_LEGACY_SYSFS=y
+CONFIG_EDAC_SIFIVE=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EFI=y
+CONFIG_EFIVAR_FS=m
+# CONFIG_EFI_BOOTLOADER_CONTROL is not set
+# CONFIG_EFI_CAPSULE_LOADER is not set
+# CONFIG_EFI_DISABLE_PCI_DMA is not set
+CONFIG_EFI_EARLYCON=y
+CONFIG_EFI_ESRT=y
+CONFIG_EFI_GENERIC_STUB=y
+CONFIG_EFI_PARAMS_FROM_FDT=y
+CONFIG_EFI_RUNTIME_WRAPPERS=y
+CONFIG_EFI_STUB=y
+# CONFIG_EFI_TEST is not set
+CONFIG_ELF_CORE=y
+CONFIG_ERRATA_SIFIVE=y
+CONFIG_ERRATA_SIFIVE_CIP_1200=y
+CONFIG_ERRATA_SIFIVE_CIP_453=y
+CONFIG_EXT4_FS=y
+CONFIG_FAILOVER=y
+CONFIG_FHANDLE=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FONT_8x16=y
+CONFIG_FONT_AUTOSELECT=y
+CONFIG_FONT_SUPPORT=y
+CONFIG_FPU=y
+CONFIG_FRAME_POINTER=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ARCH_TOPOLOGY=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CSUM=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IOREMAP=y
+CONFIG_GENERIC_IRQ_INJECTION=y
+CONFIG_GENERIC_IRQ_MULTI_HANDLER=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_MSI_IRQ=y
+CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GLOB=y
+CONFIG_GPIOLIB=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_CDEV_V1=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_SIFIVE=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HID=y
+CONFIG_HID_GENERIC=y
+CONFIG_HOTPLUG_PCI=y
+# CONFIG_HOTPLUG_PCI_CPCI is not set
+CONFIG_HOTPLUG_PCI_PCIE=y
+CONFIG_HOTPLUG_PCI_SHPC=y
+CONFIG_HVC_DRIVER=y
+CONFIG_HVC_RISCV_SBI=y
+CONFIG_HW_CONSOLE=y
+CONFIG_I2C=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_COMPAT=y
+CONFIG_I2C_HELPER_AUTO=y
+CONFIG_I2C_OCORES=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_INPUT=y
+# CONFIG_IOMMU_DEBUGFS is not set
+CONFIG_IOMMU_SUPPORT=y
+CONFIG_IO_URING=y
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+CONFIG_JBD2=y
+CONFIG_KALLSYMS=y
+CONFIG_KEYS=y
+CONFIG_LEDS_PWM=y
+CONFIG_LEDS_TRIGGER_DISK=y
+CONFIG_LEGACY_PTYS=y
+CONFIG_LEGACY_PTY_COUNT=256
+CONFIG_LIBFDT=y
+CONFIG_LOCALVERSION_AUTO=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_MACB=y
+# CONFIG_MACB_PCI is not set
+CONFIG_MACB_USE_HWSTAMP=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_CORE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MICROSEMI_PHY=y
+CONFIG_MIGRATION=y
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_CADENCE=y
+# CONFIG_MMC_SDHCI_PCI is not set
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SPI=y
+CONFIG_MMIOWB=y
+CONFIG_MODULES_USE_ELF_RELA=y
+CONFIG_MODULE_SECTIONS=y
+CONFIG_MPILIB=y
+CONFIG_MQ_IOSCHED_DEADLINE=y
+CONFIG_MQ_IOSCHED_KYBER=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPI_NOR_USE_4K_SECTORS=y
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_FAILOVER=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_PTP_CLASSIFY=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NLS=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_NR_CPUS=8
+CONFIG_NVMEM=y
+CONFIG_NVMEM_SYSFS=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_OID_REGISTRY=y
+CONFIG_PADATA=y
+CONFIG_PAGE_OFFSET=0xffffffe000000000
+CONFIG_PAGE_REPORTING=y
+CONFIG_PA_BITS=56
+CONFIG_PCI=y
+CONFIG_PCIEAER=y
+CONFIG_PCIEAER_INJECT=m
+CONFIG_PCIEASPM=y
+CONFIG_PCIEASPM_DEFAULT=y
+# CONFIG_PCIEASPM_PERFORMANCE is not set
+# CONFIG_PCIEASPM_POWERSAVE is not set
+# CONFIG_PCIEASPM_POWER_SUPERSAVE is not set
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_DPC=y
+CONFIG_PCIE_DW=y
+CONFIG_PCIE_DW_HOST=y
+CONFIG_PCIE_ECRC=y
+CONFIG_PCIE_FU740=y
+CONFIG_PCIE_PTM=y
+CONFIG_PCIE_XILINX=y
+CONFIG_PCI_DEBUG=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PCI_ECAM=y
+CONFIG_PCI_HOST_COMMON=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCI_MSI=y
+CONFIG_PCI_MSI_IRQ_DOMAIN=y
+CONFIG_PCI_SW_SWITCHTEC=y
+CONFIG_PGTABLE_LEVELS=3
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PHYS_ADDR_T_64BIT=y
+# CONFIG_PHYS_RAM_BASE_FIXED is not set
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_GPIO=y
+CONFIG_POWER_RESET_GPIO_RESTART=y
+CONFIG_POWER_RESET_RESTART=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_POWER_RESET_SYSCON_POWEROFF=y
+CONFIG_PPS=y
+CONFIG_PRINTK_TIME=y
+CONFIG_PTP_1588_CLOCK=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_PWM=y
+CONFIG_PWM_SIFIVE=y
+CONFIG_PWM_SYSFS=y
+CONFIG_RATIONAL=y
+CONFIG_RCU_TRACE=y
+CONFIG_RD_GZIP=y
+CONFIG_REALTEK_PHY=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_IRQ=y
+CONFIG_REGMAP_MMIO=y
+# CONFIG_RESET_ATTACK_MITIGATION is not set
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RESET_SIMPLE=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RISCV=y
+CONFIG_RISCV_ERRATA_ALTERNATIVE=y
+CONFIG_RISCV_INTC=y
+CONFIG_RISCV_ISA_C=y
+CONFIG_RISCV_SBI=y
+CONFIG_RISCV_SBI_V01=y
+CONFIG_RISCV_TIMER=y
+CONFIG_RPS=y
+CONFIG_RTC_CLASS=y
+# CONFIG_RTC_DRV_EFI is not set
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+CONFIG_SCHED_DEBUG=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+CONFIG_SERIAL_8250_DEPRECATED_OPTIONS=y
+CONFIG_SERIAL_8250_EXAR=y
+CONFIG_SERIAL_8250_NR_UARTS=4
+CONFIG_SERIAL_8250_PCI=y
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
+CONFIG_SERIAL_EARLYCON_RISCV_SBI=y
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_SIFIVE=y
+CONFIG_SERIAL_SIFIVE_CONSOLE=y
+CONFIG_SERIO=y
+CONFIG_SERIO_SERPORT=y
+CONFIG_SG_POOL=y
+CONFIG_SIFIVE_L2=y
+CONFIG_SIFIVE_PLIC=y
+CONFIG_SLUB_DEBUG=y
+CONFIG_SMP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+# CONFIG_SOC_MICROCHIP_POLARFIRE is not set
+CONFIG_SOC_SIFIVE=y
+# CONFIG_SOC_VIRT is not set
+CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SPI=y
+CONFIG_SPI_BITBANG=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SPI_SIFIVE=y
+CONFIG_SRCU=y
+CONFIG_STACKTRACE=y
+CONFIG_SWIOTLB=y
+CONFIG_SWPHY=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYSFB=y
+# CONFIG_SYSFB_SIMPLEFB is not set
+CONFIG_THREAD_INFO_IN_TASK=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TRACE_CLOCK=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_TUNE_GENERIC=y
+CONFIG_UCS2_STRING=y
+CONFIG_UEVENT_HELPER_PATH=""
+CONFIG_USB=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_EHCI_HCD=y
+# CONFIG_USB_EHCI_HCD_PLATFORM is not set
+CONFIG_USB_EHCI_PCI=y
+CONFIG_USB_HID=y
+CONFIG_USB_NET_DRIVERS=y
+CONFIG_USB_PCI=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_SUPPORT=y
+# CONFIG_USB_UHCI_HCD is not set
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_PCI=y
+# CONFIG_USB_XHCI_PLATFORM is not set
+CONFIG_VA_BITS=39
+CONFIG_VFAT_FS=y
+CONFIG_VGA_ARB=y
+CONFIG_VGA_ARB_MAX_GPUS=16
+CONFIG_VMAP_STACK=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+# CONFIG_VT_HW_CONSOLE_BINDING is not set
+CONFIG_WATCHDOG_CORE=y
+CONFIG_XPS=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZONE_DMA32=y
diff --git a/target/linux/sifiveu/generic/target.mk b/target/linux/sifiveu/generic/target.mk
new file mode 100644
index 00000000000000..f5cb1fb19b943f
--- /dev/null
+++ b/target/linux/sifiveu/generic/target.mk
@@ -0,0 +1 @@
+BOARDNAME:=Generic
diff --git a/target/linux/sifiveu/image/Config.in b/target/linux/sifiveu/image/Config.in
new file mode 100644
index 00000000000000..640869b92c8136
--- /dev/null
+++ b/target/linux/sifiveu/image/Config.in
@@ -0,0 +1,5 @@
+config SIFIVEU_SD_BOOT_PARTSIZE
+	int "Boot (SD Card) filesystem partition size (in MB)"
+	depends on TARGET_sifiveu
+	default 32
+
diff --git a/target/linux/sifiveu/image/Makefile b/target/linux/sifiveu/image/Makefile
new file mode 100644
index 00000000000000..ef3b13eeec4574
--- /dev/null
+++ b/target/linux/sifiveu/image/Makefile
@@ -0,0 +1,56 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2022 Toco Technologies <info@toco.ae>
+#
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/image.mk
+
+FAT32_BLOCK_SIZE=1024
+FAT32_BLOCKS=$(shell echo $$(($(CONFIG_SIFIVEU_SD_BOOT_PARTSIZE)*1024*1024/$(FAT32_BLOCK_SIZE))))
+
+KERNEL_LOADADDR:=0x80200000
+
+define Build/riscv-sdcard
+	rm -f $@.boot #$(KDIR_TMP)/$(IMG_PREFIX)-$(PROFILE)-boot.img
+	mkfs.fat $@.boot  -C $(FAT32_BLOCKS)
+
+	mcopy -i $@.boot $(STAGING_DIR_IMAGE)/$(DEVICE_NAME)-boot.scr ::boot.scr
+	mcopy -i $@.boot $(DTS_DIR)/$(DEVICE_DTS).dtb ::dtb
+	mcopy -i $@.boot $(IMAGE_KERNEL) ::Image
+
+	./gen_sifiveu_sdcard_img.sh \
+		$@ \
+		$@.boot \
+		$(IMAGE_ROOTFS) \
+		$(CONFIG_SIFIVEU_SD_BOOT_PARTSIZE) \
+		$(CONFIG_TARGET_ROOTFS_PARTSIZE) \
+		$(STAGING_DIR_IMAGE)/$(DEVICE_NAME)-u-boot.itb \
+		$(STAGING_DIR_IMAGE)/$(DEVICE_NAME)-u-boot.itb-spl
+endef
+
+define Device/Default
+  PROFILES := Default
+  KERNEL_NAME := Image
+  KERNEL := kernel-bin | libdeflate-gzip
+  IMAGES := sdcard.img.gz
+  IMAGE/sdcard.img.gz := riscv-sdcard | append-metadata | gzip
+endef
+
+define Device/sifive_unleashed
+  DEVICE_VENDOR := SiFive
+  DEVICE_MODEL := Unleashed (FU540)
+  DEVICE_DTS := sifive/hifive-unleashed-a00
+  UBOOT := sifive_unleashed
+endef
+TARGET_DEVICES += sifive_unleashed
+
+define Device/sifive_unmatched
+  DEVICE_VENDOR := SiFive
+  DEVICE_MODEL := Unmatched (FU740)
+  DEVICE_DTS := sifive/hifive-unmatched-a00
+  DEVICE_PACKAGES += kmod-eeprom-at24 kmod-hwmon-lm90
+  UBOOT := sifive_unmatched
+endef
+TARGET_DEVICES += sifive_unmatched
+
+$(eval $(call BuildImage))
diff --git a/target/linux/sifiveu/image/gen_sifiveu_sdcard_img.sh b/target/linux/sifiveu/image/gen_sifiveu_sdcard_img.sh
new file mode 100644
index 00000000000000..172f62485d8ed5
--- /dev/null
+++ b/target/linux/sifiveu/image/gen_sifiveu_sdcard_img.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2022 OpenWrt.org
+#
+
+set -ex
+[ $# -eq 7 ] || {
+    echo "SYNTAX: $0 <file> <bootfs image> <rootfs image> <bootfs size> <rootfs size> <u-boot ITB image> <u-boot SPL>"
+    exit 1
+}
+
+OUTPUT="$1"
+BOOTFS="$2"
+ROOTFS="$3"
+BOOTFSSIZE="$4"
+ROOTFSSIZE="$5"
+UBOOT="$6"
+UBOOT_SPL="$7"
+
+set $(ptgen -o $OUTPUT -v -g -T sifiveu_spl -N loader1 -p 1024 -T sifiveu_uboot -N loader2 -p 4096 -t ef -N boot -p ${BOOTFSSIZE}M -N rootfs -p ${ROOTFSSIZE}M)
+
+ROOTFSOFFSET=$(($7 / 512))
+
+dd bs=512 if="$UBOOT_SPL" of="$OUTPUT" seek=34 conv=notrunc
+dd bs=512 if="$UBOOT" of="$OUTPUT" seek=2082 conv=notrunc
+dd bs=512 if="$BOOTFS" of="$OUTPUT" seek=10274 conv=notrunc
+dd bs=512 if="$ROOTFS" of="$OUTPUT" seek=${ROOTFSOFFSET} conv=notrunc
diff --git a/target/linux/sifiveu/patches-5.15/0001-riscv-sifive-fu740-cpu-1-2-3-4-set-compatible-to-sif.patch b/target/linux/sifiveu/patches-5.15/0001-riscv-sifive-fu740-cpu-1-2-3-4-set-compatible-to-sif.patch
new file mode 100644
index 00000000000000..9a1c96813907bf
--- /dev/null
+++ b/target/linux/sifiveu/patches-5.15/0001-riscv-sifive-fu740-cpu-1-2-3-4-set-compatible-to-sif.patch
@@ -0,0 +1,49 @@
+From ab5c8f5492cce16ff2104393e2f1fa64a3ff6e88 Mon Sep 17 00:00:00 2001
+From: David Abdurachmanov <david.abdurachmanov@sifive.com>
+Date: Wed, 17 Feb 2021 06:06:14 -0800
+Subject: [PATCH 1/7] riscv: sifive: fu740: cpu{1,2,3,4} set compatible to
+ sifive,u74-mc
+
+Signed-off-by: David Abdurachmanov <david.abdurachmanov@sifive.com>
+---
+ arch/riscv/boot/dts/sifive/fu740-c000.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/riscv/boot/dts/sifive/fu740-c000.dtsi
++++ b/arch/riscv/boot/dts/sifive/fu740-c000.dtsi
+@@ -39,7 +39,7 @@
+ 			};
+ 		};
+ 		cpu1: cpu@1 {
+-			compatible = "sifive,bullet0", "riscv";
++			compatible = "sifive,u74-mc", "sifive,bullet0", "riscv";
+ 			d-cache-block-size = <64>;
+ 			d-cache-sets = <64>;
+ 			d-cache-size = <32768>;
+@@ -63,7 +63,7 @@
+ 			};
+ 		};
+ 		cpu2: cpu@2 {
+-			compatible = "sifive,bullet0", "riscv";
++			compatible = "sifive,u74-mc", "sifive,bullet0", "riscv";
+ 			d-cache-block-size = <64>;
+ 			d-cache-sets = <64>;
+ 			d-cache-size = <32768>;
+@@ -87,7 +87,7 @@
+ 			};
+ 		};
+ 		cpu3: cpu@3 {
+-			compatible = "sifive,bullet0", "riscv";
++			compatible = "sifive,u74-mc", "sifive,bullet0", "riscv";
+ 			d-cache-block-size = <64>;
+ 			d-cache-sets = <64>;
+ 			d-cache-size = <32768>;
+@@ -111,7 +111,7 @@
+ 			};
+ 		};
+ 		cpu4: cpu@4 {
+-			compatible = "sifive,bullet0", "riscv";
++			compatible = "sifive,u74-mc", "sifive,bullet0", "riscv";
+ 			d-cache-block-size = <64>;
+ 			d-cache-sets = <64>;
+ 			d-cache-size = <32768>;
diff --git a/target/linux/sifiveu/patches-5.15/0002-riscv-sifive-unmatched-update-regulators-values.patch b/target/linux/sifiveu/patches-5.15/0002-riscv-sifive-unmatched-update-regulators-values.patch
new file mode 100644
index 00000000000000..ac316e9d9b97d7
--- /dev/null
+++ b/target/linux/sifiveu/patches-5.15/0002-riscv-sifive-unmatched-update-regulators-values.patch
@@ -0,0 +1,104 @@
+From 657819ff477dd73cd71075609698aa57ba098d8c Mon Sep 17 00:00:00 2001
+From: David Abdurachmanov <david.abdurachmanov@sifive.com>
+Date: Wed, 15 Sep 2021 07:10:02 -0700
+Subject: [PATCH 2/7] riscv: sifive: unmatched: update regulators values
+
+These are the regulators values from the schematics for Rev3{A,B} boards.
+
+Note this is not fully correct as bcore1/bcore2 and bmem/bio are merged, but
+it's only supported in v5.15 kernel. See:
+
+541ee8f640327f951e7039278057827322231ab0 ("regulator: da9063: Add support for
+full-current mode.")
+
+This will be changed for v5.15 kernel based on the patch above.
+
+Signed-off-by: David Abdurachmanov <david.abdurachmanov@sifive.com>
+---
+ .../riscv/boot/dts/sifive/hifive-unmatched-a00.dts | 32 +++++++++++-----------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+--- a/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts
++++ b/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts
+@@ -73,16 +73,16 @@
+ 
+ 		regulators {
+ 			vdd_bcore1: bcore1 {
+-				regulator-min-microvolt = <900000>;
+-				regulator-max-microvolt = <900000>;
++				regulator-min-microvolt = <1050000>;
++				regulator-max-microvolt = <1050000>;
+ 				regulator-min-microamp = <5000000>;
+ 				regulator-max-microamp = <5000000>;
+ 				regulator-always-on;
+ 			};
+ 
+ 			vdd_bcore2: bcore2 {
+-				regulator-min-microvolt = <900000>;
+-				regulator-max-microvolt = <900000>;
++				regulator-min-microvolt = <1050000>;
++				regulator-max-microvolt = <1050000>;
+ 				regulator-min-microamp = <5000000>;
+ 				regulator-max-microamp = <5000000>;
+ 				regulator-always-on;
+@@ -137,48 +137,48 @@
+ 			};
+ 
+ 			vdd_ldo3: ldo3 {
+-				regulator-min-microvolt = <1800000>;
+-				regulator-max-microvolt = <1800000>;
++				regulator-min-microvolt = <3300000>;
++				regulator-max-microvolt = <3300000>;
+ 				regulator-min-microamp = <200000>;
+ 				regulator-max-microamp = <200000>;
+ 				regulator-always-on;
+ 			};
+ 
+ 			vdd_ldo4: ldo4 {
+-				regulator-min-microvolt = <1800000>;
+-				regulator-max-microvolt = <1800000>;
++				regulator-min-microvolt = <2500000>;
++				regulator-max-microvolt = <2500000>;
+ 				regulator-min-microamp = <200000>;
+ 				regulator-max-microamp = <200000>;
+ 				regulator-always-on;
+ 			};
+ 
+ 			vdd_ldo5: ldo5 {
+-				regulator-min-microvolt = <1800000>;
+-				regulator-max-microvolt = <1800000>;
++				regulator-min-microvolt = <3300000>;
++				regulator-max-microvolt = <3300000>;
+ 				regulator-min-microamp = <100000>;
+ 				regulator-max-microamp = <100000>;
+ 				regulator-always-on;
+ 			};
+ 
+ 			vdd_ldo6: ldo6 {
+-				regulator-min-microvolt = <3300000>;
+-				regulator-max-microvolt = <3300000>;
++				regulator-min-microvolt = <1800000>;
++				regulator-max-microvolt = <1800000>;
+ 				regulator-min-microamp = <200000>;
+ 				regulator-max-microamp = <200000>;
+ 				regulator-always-on;
+ 			};
+ 
+ 			vdd_ldo7: ldo7 {
+-				regulator-min-microvolt = <1800000>;
+-				regulator-max-microvolt = <1800000>;
++				regulator-min-microvolt = <3300000>;
++				regulator-max-microvolt = <3300000>;
+ 				regulator-min-microamp = <200000>;
+ 				regulator-max-microamp = <200000>;
+ 				regulator-always-on;
+ 			};
+ 
+ 			vdd_ldo8: ldo8 {
+-				regulator-min-microvolt = <1800000>;
+-				regulator-max-microvolt = <1800000>;
++				regulator-min-microvolt = <3300000>;
++				regulator-max-microvolt = <3300000>;
+ 				regulator-min-microamp = <200000>;
+ 				regulator-max-microamp = <200000>;
+ 				regulator-always-on;
diff --git a/target/linux/sifiveu/patches-5.15/0003-riscv-sifive-unmatched-define-PWM-LEDs.patch b/target/linux/sifiveu/patches-5.15/0003-riscv-sifive-unmatched-define-PWM-LEDs.patch
new file mode 100644
index 00000000000000..661e15905f9d53
--- /dev/null
+++ b/target/linux/sifiveu/patches-5.15/0003-riscv-sifive-unmatched-define-PWM-LEDs.patch
@@ -0,0 +1,69 @@
+From 2c2d8ac8c124a2938c9326c14b2dffd46d76b4a8 Mon Sep 17 00:00:00 2001
+From: David Abdurachmanov <david.abdurachmanov@sifive.com>
+Date: Mon, 13 Sep 2021 02:15:37 -0700
+Subject: [PATCH 3/7] riscv: sifive: unmatched: define PWM LEDs
+
+Add D2 (RGB) and D12 (green) LEDs for SiFive Unmatched board.
+
+Signed-off-by: David Abdurachmanov <david.abdurachmanov@sifive.com>
+---
+ .../riscv/boot/dts/sifive/hifive-unmatched-a00.dts | 41 ++++++++++++++++++++++
+ 1 file changed, 41 insertions(+)
+
+--- a/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts
++++ b/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts
+@@ -4,6 +4,8 @@
+ #include "fu740-c000.dtsi"
+ #include <dt-bindings/gpio/gpio.h>
+ #include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/leds/common.h>
++#include <dt-bindings/pwm/pwm.h>
+ 
+ /* Clock frequency (in Hz) of the PCB crystal for rtcclk */
+ #define RTCCLK_FREQ		1000000
+@@ -31,6 +33,45 @@
+ 	soc {
+ 	};
+ 
++	pwmleds {
++		compatible = "pwm-leds";
++		green-d12 {
++			label = "green:d12";
++			color = <LED_COLOR_ID_GREEN>;
++			pwms = <&pwm0 0 7812500 PWM_POLARITY_INVERTED>;
++			active-low = <1>;
++			max-brightness = <255>;
++			linux,default-trigger = "none";
++		};
++
++		green-d2 {
++			label = "green:d2";
++			color = <LED_COLOR_ID_GREEN>;
++			pwms = <&pwm0 1 7812500 PWM_POLARITY_INVERTED>;
++			active-low = <1>;
++			max-brightness = <255>;
++			linux,default-trigger = "none";
++		};
++
++		red-d2 {
++			label = "red:d2";
++			color = <LED_COLOR_ID_RED>;
++			pwms = <&pwm0 2 7812500 PWM_POLARITY_INVERTED>;
++			active-low = <1>;
++			max-brightness = <255>;
++			linux,default-trigger = "none";
++		};
++
++		blue-d2 {
++			label = "blue:d2";
++			color = <LED_COLOR_ID_BLUE>;
++			pwms = <&pwm0 3 7812500 PWM_POLARITY_INVERTED>;
++			active-low = <1>;
++			max-brightness = <255>;
++			linux,default-trigger = "none";
++		};
++	};
++
+ 	hfclk: hfclk {
+ 		#clock-cells = <0>;
+ 		compatible = "fixed-clock";
diff --git a/target/linux/sifiveu/patches-5.15/0004-riscv-sifive-unmatched-add-gpio-poweroff-node.patch b/target/linux/sifiveu/patches-5.15/0004-riscv-sifive-unmatched-add-gpio-poweroff-node.patch
new file mode 100644
index 00000000000000..6d09628cb3bd32
--- /dev/null
+++ b/target/linux/sifiveu/patches-5.15/0004-riscv-sifive-unmatched-add-gpio-poweroff-node.patch
@@ -0,0 +1,26 @@
+From 14ede57943bc4209755d08daf93ac7be967d7fbe Mon Sep 17 00:00:00 2001
+From: David Abdurachmanov <david.abdurachmanov@sifive.com>
+Date: Mon, 13 Sep 2021 02:18:30 -0700
+Subject: [PATCH 4/7] riscv: sifive: unmatched: add gpio-poweroff node
+
+Add gpio-poweroff node to allow powering off the system.
+
+Signed-off-by: David Abdurachmanov <david.abdurachmanov@sifive.com>
+---
+ arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts
++++ b/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts
+@@ -85,6 +85,11 @@
+ 		clock-frequency = <RTCCLK_FREQ>;
+ 		clock-output-names = "rtcclk";
+ 	};
++
++	gpio-poweroff {
++		compatible = "gpio-poweroff";
++		gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
++	};
+ };
+ 
+ &uart0 {
diff --git a/target/linux/sifiveu/patches-5.15/0005-riscv-sifive-unleashed-define-opp-table-cpufreq.patch b/target/linux/sifiveu/patches-5.15/0005-riscv-sifive-unleashed-define-opp-table-cpufreq.patch
new file mode 100644
index 00000000000000..c6b997dbbed54e
--- /dev/null
+++ b/target/linux/sifiveu/patches-5.15/0005-riscv-sifive-unleashed-define-opp-table-cpufreq.patch
@@ -0,0 +1,116 @@
+From d3cf2859a056273400fbdf9d389b75750ff6ca5e Mon Sep 17 00:00:00 2001
+From: David Abdurachmanov <david.abdurachmanov@sifive.com>
+Date: Fri, 14 May 2021 05:27:51 -0700
+Subject: [PATCH 6/7] riscv: sifive: unleashed: define opp table (cpufreq)
+
+Source: https://github.com/sifive/riscv-linux/commits/dev/paulw/cpufreq-dt-aloe-v5.3-rc4
+
+Signed-off-by: David Abdurachmanov <david.abdurachmanov@sifive.com>
+---
+ arch/riscv/Kconfig                                 |  8 +++++
+ arch/riscv/boot/dts/sifive/fu540-c000.dtsi         |  5 ++++
+ .../riscv/boot/dts/sifive/hifive-unleashed-a00.dts | 34 ++++++++++++++++++++++
+ 3 files changed, 47 insertions(+)
+
+--- a/arch/riscv/Kconfig
++++ b/arch/riscv/Kconfig
+@@ -566,6 +566,14 @@ config BUILTIN_DTB
+ 	depends on OF
+ 	default y if XIP_KERNEL
+ 
++menu "CPU Power Management"
++
++source "drivers/cpuidle/Kconfig"
++
++source "drivers/cpufreq/Kconfig"
++
++endmenu
++
+ menu "Power management options"
+ 
+ source "kernel/power/Kconfig"
+--- a/arch/riscv/boot/dts/sifive/fu540-c000.dtsi
++++ b/arch/riscv/boot/dts/sifive/fu540-c000.dtsi
+@@ -30,6 +30,7 @@
+ 			i-cache-size = <16384>;
+ 			reg = <0>;
+ 			riscv,isa = "rv64imac";
++			clocks = <&prci PRCI_CLK_COREPLL>;
+ 			status = "disabled";
+ 			cpu0_intc: interrupt-controller {
+ 				#interrupt-cells = <1>;
+@@ -54,6 +55,7 @@
+ 			reg = <1>;
+ 			riscv,isa = "rv64imafdc";
+ 			tlb-split;
++			clocks = <&prci PRCI_CLK_COREPLL>;
+ 			next-level-cache = <&l2cache>;
+ 			cpu1_intc: interrupt-controller {
+ 				#interrupt-cells = <1>;
+@@ -78,6 +80,7 @@
+ 			reg = <2>;
+ 			riscv,isa = "rv64imafdc";
+ 			tlb-split;
++			clocks = <&prci PRCI_CLK_COREPLL>;
+ 			next-level-cache = <&l2cache>;
+ 			cpu2_intc: interrupt-controller {
+ 				#interrupt-cells = <1>;
+@@ -102,6 +105,7 @@
+ 			reg = <3>;
+ 			riscv,isa = "rv64imafdc";
+ 			tlb-split;
++			clocks = <&prci PRCI_CLK_COREPLL>;
+ 			next-level-cache = <&l2cache>;
+ 			cpu3_intc: interrupt-controller {
+ 				#interrupt-cells = <1>;
+@@ -126,6 +130,7 @@
+ 			reg = <4>;
+ 			riscv,isa = "rv64imafdc";
+ 			tlb-split;
++			clocks = <&prci PRCI_CLK_COREPLL>;
+ 			next-level-cache = <&l2cache>;
+ 			cpu4_intc: interrupt-controller {
+ 				#interrupt-cells = <1>;
+--- a/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts
++++ b/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts
+@@ -84,6 +84,40 @@
+ 			label = "d4";
+ 		};
+ 	};
++
++	fu540_c000_opp_table: opp-table {
++		compatible = "operating-points-v2";
++		opp-shared;
++
++		opp-350000000 {
++			opp-hz = /bits/ 64 <350000000>;
++		};
++		opp-700000000 {
++			opp-hz = /bits/ 64 <700000000>;
++		};
++		opp-999999999 {
++			opp-hz = /bits/ 64 <999999999>;
++		};
++		opp-1400000000 {
++			opp-hz = /bits/ 64 <1400000000>;
++		};
++	};
++};
++
++&cpu0 {
++	operating-points-v2 = <&fu540_c000_opp_table>;
++};
++&cpu1 {
++	operating-points-v2 = <&fu540_c000_opp_table>;
++};
++&cpu2 {
++	operating-points-v2 = <&fu540_c000_opp_table>;
++};
++&cpu3 {
++	operating-points-v2 = <&fu540_c000_opp_table>;
++};
++&cpu4 {
++	operating-points-v2 = <&fu540_c000_opp_table>;
+ };
+ 
+ &uart0 {
diff --git a/target/linux/sifiveu/patches-5.15/0006-riscv-sbi-srst-support.patch b/target/linux/sifiveu/patches-5.15/0006-riscv-sbi-srst-support.patch
new file mode 100644
index 00000000000000..409001bcfa8c6c
--- /dev/null
+++ b/target/linux/sifiveu/patches-5.15/0006-riscv-sbi-srst-support.patch
@@ -0,0 +1,301 @@
+From mboxrd@z Thu Jan  1 00:00:00 1970
+Return-Path: <SRS0=S+R5=LD=lists.infradead.org=linux-riscv-bounces+linux-riscv=archiver.kernel.org@kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+X-Spam-Level: 
+X-Spam-Status: No, score=-21.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH,
+	DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,
+	INCLUDES_PATCH,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,MSGID_FROM_MTA_HEADER,
+	SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable
+	autolearn_force=no version=3.4.0
+Received: from mail.kernel.org (mail.kernel.org [198.145.29.99])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id 9A34CC48BCD
+	for <linux-riscv@archiver.kernel.org>; Wed,  9 Jun 2021 12:50:08 +0000 (UTC)
+Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133])
+	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
+	(No client certificate requested)
+	by mail.kernel.org (Postfix) with ESMTPS id 69795611C9
+	for <linux-riscv@archiver.kernel.org>; Wed,  9 Jun 2021 12:50:08 +0000 (UTC)
+DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 69795611C9
+Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=wdc.com
+Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-riscv-bounces+linux-riscv=archiver.kernel.org@lists.infradead.org
+DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
+	d=lists.infradead.org; s=bombadil.20210309; h=Sender:
+	Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post:
+	List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To:
+	Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description:
+	Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:
+	List-Owner; bh=64gRxQ9bX8C6wjLq0KuJ2lv98bQdXijt0LPnNpch3NU=; b=rgeSpoSWQ+Nca2
+	9PLsgI7dOYVdTu48CyVJStiizsvIvVFN2rBAgELHF2nRCCtoSiPMxgcpCKtDcm7sh9lC8AblCoBjN
+	LXiPRHVYJAcRNiWiQ0qOTqHdTbezFdzSjNOs6drbaiI4B8AZtychw1hP+ubsb5czAaz6510OEVct/
+	h5M4Tlljcn/WIyulBd/tnuUOZPT0XL6rb2+TvRQvjXDBFHN+bWqP8OjXKnE1FTvy5MF8OTlUgI6wr
+	3f4t/eS/PPbtXRD5raJzEwEQLJ6XY6NJABs40tKpWZNuUaqTfmonNdbP9y1htWhByhsAk+fw5WK/C
+	/KocvM6IzPmqGIBWcTdQ==;
+Received: from localhost ([::1] helo=bombadil.infradead.org)
+	by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux))
+	id 1lqxeS-00Do8i-Hj; Wed, 09 Jun 2021 12:49:44 +0000
+Received: from esa4.hgst.iphmx.com ([216.71.154.42])
+ by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux))
+ id 1lqx5h-00DbCQ-K0
+ for linux-riscv@lists.infradead.org; Wed, 09 Jun 2021 12:13:51 +0000
+DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;
+ d=wdc.com; i=@wdc.com; q=dns/txt; s=dkim.wdc.com;
+ t=1623240829; x=1654776829;
+ h=from:to:cc:subject:date:message-id:in-reply-to:
+ references:content-transfer-encoding:mime-version;
+ bh=s4va/Owvq7MQI8rUsD/e02RmaYfJNzYNcxlXspGRY7g=;
+ b=G5GD9eN+rv669E7jyRnRAt0jw83CxhIrSiDIjXuPmhWyMhKeQGD7ACRm
+ ii6o0zmOREhGihtwB6X/xpY/2ZvK+cxcHmJXa+Ykyn8QN+/YKFtg3svfj
+ eiTN7U/mEozCoGNd1wXu59RQj11Xz60DN/qEUlYFaL6SjukUgifFVgbvG
+ uUj8AM8+xf1jKHi3Q/6nVPpJX8uiW/NPFHrwI8hxUwYr9viQwxXvc7FNr
+ fR8bH2c/HiGacGYEHosgP0WT//d9Huqn4JNINvjidK4ZSJ74cXlr8KwMG
+ 8snmfx4UjEWMhK1lCYalJEU7nxXFfih/6DMuFRorETpWQ+424BAKUJdDH Q==;
+IronPort-SDR: pYhRsIZkhfmi45K4HfnZj39kxfUGpxs1e+q+Wh8kDE+ySh35HkJaaUcpP04mb7VeIVtPRx/h6Q
+ imv6sn8fYo/V8ezHAq4jpd1QadqInKi1ubLnCE3Zy7GnhVBepoV6FbI14Y01V+5QIUwYdFNcGG
+ RsxDOTQyU5AljH0Rc6WkrpdVf5jsrXXMddmlDdi6QsfKGy7MwQ/NYojNIqyLhRSgu5w2uTIE7X
+ atSbjb8j2a+EJUY0WgYTGfNHKCdQLAhjcsWZgU7Iu0vSaBU6A7seCkqun24dvF/zYuzEj7wedD
+ TvE=
+X-IronPort-AV: E=Sophos;i="5.83,260,1616428800"; d="scan'208";a="170575129"
+Received: from mail-dm6nam12lp2169.outbound.protection.outlook.com (HELO
+ NAM12-DM6-obe.outbound.protection.outlook.com) ([104.47.59.169])
+ by ob1.hgst.iphmx.com with ESMTP; 09 Jun 2021 20:13:48 +0800
+ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
+ b=hrlr4Qi66FmbQW45zI7QeA9nEYSvxO+tR++vUyFHxjRqnr6WtjKgHM8hPpp8oHXaK82U0+KQUc2+WjLbe8LihexXFQs5zRwBDwuArmkKt85cL3utD3OBzTkr4A9ZhRS5mzztnn9kvTFNplPjSydXPetJQIZ9WKmihJrdeaGQ+zQ//6TdDWVpLyBbqiBVUbUwlKQbpbbfHvzQCHYQbIiUcGn4vaSXYp2Xp1Z5yYVtrfDK+TemKG/8fKQoJjg/tdmDtQ97Cgw7nX6Oc9kdmoTIxFilMy4XjPciPcNOPdLmboGCt6+TMBeftLc1VFNnr7PwuxOogv4I7eJ/P9UaK57k5A==
+ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; 
+ s=arcselector9901;
+ h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
+ bh=Ibi36Vj2s7bu56DZaU1uSl4xNA3OB2FHlI/rBKn+8xo=;
+ b=CE3o+0GFLPMQuw0AK1IRf/vX00diXsjayn0MmpS7ntSVXgxXIAPT9aDtk7x0NovJBTk2LHI5Mtxvz6SwVnJzUqZmNsXUktEj5Iwdd8EPIIxgCOjugo/6WC0FqaFKNvJB4hQ0tjFxv+J5DexSJ8+mPx6Ucr4DwtUXrCWzOeXyF5YK68mU5FgttbyutW3CGsGkPgaPAdOxXOgJqyYu8X25unmzG12Jq2xC4oVKsbA+RfDiaMKm97q2Bhy+LcgJNS6/ktlFKSOVu1HQ0POYgba3mtldN3vg73wLbxrfsdoe4261aJpkM05GJFDzdTNp4t3rEGhNuLR1+8OmKfLlPeSU9w==
+ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass
+ smtp.mailfrom=wdc.com; dmarc=pass action=none header.from=wdc.com; dkim=pass
+ header.d=wdc.com; arc=none
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+ d=sharedspace.onmicrosoft.com; s=selector2-sharedspace-onmicrosoft-com;
+ h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
+ bh=Ibi36Vj2s7bu56DZaU1uSl4xNA3OB2FHlI/rBKn+8xo=;
+ b=Z76YsVxTHK6/ta19C5vwaBPYmtDa2GIM/ml4myQZfIaHFNzXPzZ+PFcYy/Xf1Ixd0GZHcuSZQYgs/SPHWATh+rOWBAislGv1zmSAG/g0tiDckB8WaCwh1e3qGW4ZmUTmAU7dxB0vn0pRSLTnc1hdCUZ73buM78qo9qwsQZv41d0=
+Authentication-Results: dabbelt.com; dkim=none (message not signed)
+ header.d=none;dabbelt.com; dmarc=none action=none header.from=wdc.com;
+Received: from CO6PR04MB7812.namprd04.prod.outlook.com (2603:10b6:303:138::6)
+ by CO6PR04MB7794.namprd04.prod.outlook.com (2603:10b6:303:13f::7)
+ with Microsoft SMTP Server (version=TLS1_2,
+ cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4219.21; Wed, 9 Jun
+ 2021 12:13:47 +0000
+Received: from CO6PR04MB7812.namprd04.prod.outlook.com
+ ([fe80::a153:b7f8:c87f:89f8]) by CO6PR04MB7812.namprd04.prod.outlook.com
+ ([fe80::a153:b7f8:c87f:89f8%9]) with mapi id 15.20.4219.021; Wed, 9 Jun 2021
+ 12:13:47 +0000
+From: Anup Patel <anup.patel@wdc.com>
+To: Palmer Dabbelt <palmer@dabbelt.com>,
+ Palmer Dabbelt <palmerdabbelt@google.com>,
+ Paul Walmsley <paul.walmsley@sifive.com>, Albert Ou <aou@eecs.berkeley.edu>
+Cc: Atish Patra <atish.patra@wdc.com>,
+ Alistair Francis <Alistair.Francis@wdc.com>,
+ Anup Patel <anup@brainfault.org>, linux-riscv@lists.infradead.org,
+ linux-kernel@vger.kernel.org, Anup Patel <anup.patel@wdc.com>
+Subject: [PATCH v7 1/1] RISC-V: Use SBI SRST extension when available
+Date: Wed,  9 Jun 2021 17:43:22 +0530
+Message-Id: <20210609121322.3058-2-anup.patel@wdc.com>
+X-Mailer: git-send-email 2.25.1
+In-Reply-To: <20210609121322.3058-1-anup.patel@wdc.com>
+References: <20210609121322.3058-1-anup.patel@wdc.com>
+X-Originating-IP: [122.172.176.125]
+X-ClientProxiedBy: MA1PR0101CA0036.INDPRD01.PROD.OUTLOOK.COM
+ (2603:1096:a00:22::22) To CO6PR04MB7812.namprd04.prod.outlook.com
+ (2603:10b6:303:138::6)
+MIME-Version: 1.0
+X-MS-Exchange-MessageSentRepresentingType: 1
+Received: from wdc.com (122.172.176.125) by
+ MA1PR0101CA0036.INDPRD01.PROD.OUTLOOK.COM (2603:1096:a00:22::22) with
+ Microsoft SMTP Server (version=TLS1_2,
+ cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4219.21 via Frontend
+ Transport; Wed, 9 Jun 2021 12:13:44 +0000
+X-MS-PublicTrafficType: Email
+X-MS-Office365-Filtering-Correlation-Id: 17406ef0-e8d7-4dc3-eee9-08d92b40085b
+X-MS-TrafficTypeDiagnostic: CO6PR04MB7794:
+X-MS-Exchange-Transport-Forked: True
+X-Microsoft-Antispam-PRVS: <CO6PR04MB77945CDDD1538EFCA060925B8D369@CO6PR04MB7794.namprd04.prod.outlook.com>
+WDCIPOUTBOUND: EOP-TRUE
+X-MS-Oob-TLC-OOBClassifiers: OLM:2887;
+X-MS-Exchange-SenderADCheck: 1
+X-Microsoft-Antispam: BCL:0;
+X-Microsoft-Antispam-Message-Info: IxB9oKL9LkeXCQ7mZ1A5qIcKlICr/TPZ/8V0ErM5hbqnvfK6Mf0mQL0tqqlJAOvLpCEVIyX7FllGqSlWsNG3ik/WbbDYQb9wAFCuFSAlGAeGppnJjJf0zfDAmp4NONB7kshKqtUYfGltTHTkV4ni+VEwWf/Q3T4vA0k3Jkt34iZFi9tOsSHkSWxPTsQyviBdCp3/36ZCVhYs6bXkf8sh0sA4Ql/l8t2zpcEUwjAm14ie3hOUBEp1W9qOz6StmR4xyl+zy49U38byeHu5XDF/qFT8FI4WclwFwxbDeTm8cU7MMg4D0xeR0Ytm2wVrgAdiapgQYLmxPIjIG96TRTbCupyuaJXmYcI6/x27PtiQYFwcpbRUjXDKRVX2WW74WHm88OOlTexD/OsbGHD6PVnc+InniK38yNcx06U9fIkDGSYWrJqLysALlO0V5gfkc35Fhttum638ES0S2sldGkFufM372EZeooczK7jeLMpoOTAnaLtPdTCGsHnnEDDbOK7NiptQlrLMhrNQ/70harAMmB6Vvdl+jvJi34DsuX+57WeQU8Ya1cyVxzFkWX2DwvPRsAnp/VNHzeQLc5MAIUYpwQvkJBcqihYMKrLMNOT94HmxBYmY2bcW/K9fXrPQ/whyJ5HoQuxydeiy7+QKg6FWnhguTACaaTKGKKIDIlfYA5FXYlZOaQ2iJFtiZP1GbxQnDEwz4SfGgCgBdiwqFm1NfGG7wRhqQa/Kgp3jBTHwaysCwcWu/Xdz/yiCV4lfQD/PTiOr5hmtld29G7WVDy9m6Q==
+X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:;
+ IPV:NLI; SFV:NSPM; H:CO6PR04MB7812.namprd04.prod.outlook.com; PTR:; CAT:NONE;
+ SFS:(4636009)(396003)(39860400002)(136003)(346002)(366004)(376002)(8676002)(316002)(55236004)(38100700002)(38350700002)(110136005)(86362001)(54906003)(4326008)(956004)(966005)(478600001)(26005)(186003)(55016002)(8936002)(2616005)(7696005)(52116002)(16526019)(5660300002)(8886007)(6666004)(1076003)(66476007)(66556008)(36756003)(66946007)(83380400001)(2906002)(44832011);
+ DIR:OUT; SFP:1102; 
+X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
+X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?2kfiFAcyFkAMcwkoCUqJGxdVnwsuTm5WWTXA4Pq0ZNAjWsfYI4MNugTA9f8C?=
+ =?us-ascii?Q?WaQrYEizTkvIlgRDqeKVRS0vaMaeU9XaSzO6UAJMnd0jY3BzkJgKUU9xj1aU?=
+ =?us-ascii?Q?vmwXKxCS+vZ2VKgLifaU1JCeemiJqV9aW+6AJEycq722bz9yXmcaJsaHWtX3?=
+ =?us-ascii?Q?4sSoLeVPvfzwzDZEEoGsZZi1G7inY2imGEgY/r3m5/qYvavJQ3An4e4sjEqZ?=
+ =?us-ascii?Q?Z4a4FAd/6c3X8cjmNwGvgWoAIM5WaJYFQe30MQ79alCUfZyiKB4tR0+5OGFd?=
+ =?us-ascii?Q?P/rQ169Z644JNKKcEabikpL7qZZJ6OMPTS7XR9x/7GzWOJ7soV3/3I2tfCdi?=
+ =?us-ascii?Q?xVsOK1DRF4y6gi5udvnb+Uu1U5wC1NlT0U/+TrnTSeY/IuLmMgFUysw+fQ+D?=
+ =?us-ascii?Q?DIVN44TKrMoEZKx9SKcx4jYpUGYvaCH4sVOAx3zWQC0Oz1Nz3/a/isywpQW9?=
+ =?us-ascii?Q?1I1kl/2N97K0EoWIPf6qPjyLVWXg1dOHfk6SjNW64JIIPUNnM3h7k2igDX3o?=
+ =?us-ascii?Q?d7lWyFfzoWhNC7opS71uzta+ti8aHxo+xzvYvf2wLb+fdyEP9t+oQVrEQYIW?=
+ =?us-ascii?Q?rAUKPqjEfAZOYBB28SaabfVt/QF6hFfV/0yJ/JV/Ie8ivC1t6iO+QZQscV7K?=
+ =?us-ascii?Q?d4Pg+xVSE+m+LsgNwO36cTTe6hSLBPnWU1NMOW2cxTRKGm0Lwd2HyjyKTBMD?=
+ =?us-ascii?Q?BcnKo9GXAVgOAGCG5cwEBN76q6sXxbWy0pjni3O2bLYBg4CIYCB/JNzOIfE0?=
+ =?us-ascii?Q?Toz6Qwc4aw5NxRLqz9IygGT6ZunRVUWUsgJrIt5U20elX+lRmtX1cqrQNTON?=
+ =?us-ascii?Q?ZHzuAI587pB0zK4EiS25hc9C8RtwjlY67heuMsYZDww5TU+NV3+0WN1/NrCX?=
+ =?us-ascii?Q?3kB7O188tvm1sWVhCaC6hk9s19nKGRgMS5OHXTMxhmyw1Dn/zorMYff3r9ZE?=
+ =?us-ascii?Q?sNiBI7fwru/Jsxt2/jNCpFaEYUa9JkrdSse76BXo/UxLALnxO3bzpym3Dq+T?=
+ =?us-ascii?Q?s4uEA8UncKM0e+Mhp9hW1c3DR61Qjj8wb+LV3XB0qYK/1rHs8IDdJ97tw1fp?=
+ =?us-ascii?Q?Ux9SlgS9YE2bEp6wxcX6TpA5DoYjqdlK50/4/DZ3YTXWlPTaQbt/j36TbEgZ?=
+ =?us-ascii?Q?hhIV08WX7EDjBz1QrFRppEtBghOJikHLdvPo6GnZkHNQ9cxaa8Jrk0iypK4d?=
+ =?us-ascii?Q?bMj47kiugWCGY+ZW2ioGV1GgH1aZEvAukQgTiAAiyGU83td11Q5Pv2N5ytvk?=
+ =?us-ascii?Q?i+Ux/DUoeU4VyqYnb69asjdyKI5RzIxQPdQAQ7x/TBlyPp/Yj2/v31b6lCYT?=
+ =?us-ascii?Q?b1iYdeIKK+6I6A+e/EUnPOKC?=
+X-OriginatorOrg: wdc.com
+X-MS-Exchange-CrossTenant-Network-Message-Id: 17406ef0-e8d7-4dc3-eee9-08d92b40085b
+X-MS-Exchange-CrossTenant-AuthSource: CO6PR04MB7812.namprd04.prod.outlook.com
+X-MS-Exchange-CrossTenant-AuthAs: Internal
+X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Jun 2021 12:13:47.1304 (UTC)
+X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
+X-MS-Exchange-CrossTenant-Id: b61c8803-16f3-4c35-9b17-6f65f441df86
+X-MS-Exchange-CrossTenant-MailboxType: HOSTED
+X-MS-Exchange-CrossTenant-UserPrincipalName: rHld9c5jovIZF30ZL04ehEJ81O0isWetsUM3vlp/0cN1LoJ5z8guKzUTANDGVGM0Eua+2cZ1jQGTC49NwWH4hA==
+X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO6PR04MB7794
+X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 
+X-CRM114-CacheID: sfid-20210609_051349_766689_30430D67 
+X-CRM114-Status: GOOD (  15.29  )
+X-BeenThere: linux-riscv@lists.infradead.org
+X-Mailman-Version: 2.1.34
+Precedence: list
+List-Id: <linux-riscv.lists.infradead.org>
+List-Unsubscribe: <http://lists.infradead.org/mailman/options/linux-riscv>,
+ <mailto:linux-riscv-request@lists.infradead.org?subject=unsubscribe>
+List-Archive: <http://lists.infradead.org/pipermail/linux-riscv/>
+List-Post: <mailto:linux-riscv@lists.infradead.org>
+List-Help: <mailto:linux-riscv-request@lists.infradead.org?subject=help>
+List-Subscribe: <http://lists.infradead.org/mailman/listinfo/linux-riscv>,
+ <mailto:linux-riscv-request@lists.infradead.org?subject=subscribe>
+Content-Type: text/plain; charset="us-ascii"
+Content-Transfer-Encoding: 7bit
+Sender: "linux-riscv" <linux-riscv-bounces@lists.infradead.org>
+Errors-To: linux-riscv-bounces+linux-riscv=archiver.kernel.org@lists.infradead.org
+
+The SBI SRST extension provides a standard way to poweroff and
+reboot the system irrespective to whether Linux RISC-V S-mode
+is running natively (HS-mode) or inside Guest/VM (VS-mode).
+
+The SBI SRST extension is available in the SBI v0.3 specification.
+(Refer, https://github.com/riscv/riscv-sbi-doc/releases/tag/v0.3.0-rc1)
+
+This patch extends Linux RISC-V SBI implementation to detect
+and use SBI SRST extension.
+
+Signed-off-by: Anup Patel <anup.patel@wdc.com>
+Reviewed-by: Atish Patra <atish.patra@wdc.com>
+---
+ arch/riscv/include/asm/sbi.h | 24 ++++++++++++++++++++++++
+ arch/riscv/kernel/sbi.c      | 35 +++++++++++++++++++++++++++++++++++
+ 2 files changed, 59 insertions(+)
+
+--- a/arch/riscv/include/asm/sbi.h
++++ b/arch/riscv/include/asm/sbi.h
+@@ -27,6 +27,7 @@ enum sbi_ext_id {
+ 	SBI_EXT_IPI = 0x735049,
+ 	SBI_EXT_RFENCE = 0x52464E43,
+ 	SBI_EXT_HSM = 0x48534D,
++	SBI_EXT_SRST = 0x53525354,
+ };
+ 
+ enum sbi_ext_base_fid {
+@@ -70,6 +71,21 @@ enum sbi_hsm_hart_status {
+ 	SBI_HSM_HART_STATUS_STOP_PENDING,
+ };
+ 
++enum sbi_ext_srst_fid {
++	SBI_EXT_SRST_RESET = 0,
++};
++
++enum sbi_srst_reset_type {
++	SBI_SRST_RESET_TYPE_SHUTDOWN = 0,
++	SBI_SRST_RESET_TYPE_COLD_REBOOT,
++	SBI_SRST_RESET_TYPE_WARM_REBOOT,
++};
++
++enum sbi_srst_reset_reason {
++	SBI_SRST_RESET_REASON_NONE = 0,
++	SBI_SRST_RESET_REASON_SYS_FAILURE,
++};
++
+ #define SBI_SPEC_VERSION_DEFAULT	0x1
+ #define SBI_SPEC_VERSION_MAJOR_SHIFT	24
+ #define SBI_SPEC_VERSION_MAJOR_MASK	0x7f
+@@ -148,6 +164,14 @@ static inline unsigned long sbi_minor_ve
+ 	return sbi_spec_version & SBI_SPEC_VERSION_MINOR_MASK;
+ }
+ 
++/* Make SBI version */
++static inline unsigned long sbi_mk_version(unsigned long major,
++					    unsigned long minor)
++{
++	return ((major & SBI_SPEC_VERSION_MAJOR_MASK) <<
++		SBI_SPEC_VERSION_MAJOR_SHIFT) | minor;
++}
++
+ int sbi_err_map_linux_errno(int err);
+ #else /* CONFIG_RISCV_SBI */
+ static inline int sbi_remote_fence_i(const unsigned long *hart_mask) { return -1; }
+--- a/arch/riscv/kernel/sbi.c
++++ b/arch/riscv/kernel/sbi.c
+@@ -7,6 +7,7 @@
+ 
+ #include <linux/init.h>
+ #include <linux/pm.h>
++#include <linux/reboot.h>
+ #include <asm/sbi.h>
+ #include <asm/smp.h>
+ 
+@@ -501,6 +502,32 @@ int sbi_remote_hfence_vvma_asid(const un
+ }
+ EXPORT_SYMBOL(sbi_remote_hfence_vvma_asid);
+ 
++static void sbi_srst_reset(unsigned long type, unsigned long reason)
++{
++	sbi_ecall(SBI_EXT_SRST, SBI_EXT_SRST_RESET, type, reason,
++		  0, 0, 0, 0);
++	pr_warn("%s: type=0x%lx reason=0x%lx failed\n",
++		__func__, type, reason);
++}
++
++static int sbi_srst_reboot(struct notifier_block *this,
++			   unsigned long mode, void *cmd)
++{
++	sbi_srst_reset((mode == REBOOT_WARM || mode == REBOOT_SOFT) ?
++		       SBI_SRST_RESET_TYPE_WARM_REBOOT :
++		       SBI_SRST_RESET_TYPE_COLD_REBOOT,
++		       SBI_SRST_RESET_REASON_NONE);
++	return NOTIFY_DONE;
++}
++
++static struct notifier_block sbi_srst_reboot_nb;
++
++static void sbi_srst_power_off(void)
++{
++	sbi_srst_reset(SBI_SRST_RESET_TYPE_SHUTDOWN,
++		       SBI_SRST_RESET_REASON_NONE);
++}
++
+ /**
+  * sbi_probe_extension() - Check if an SBI extension ID is supported or not.
+  * @extid: The extension ID to be probed.
+@@ -608,6 +635,14 @@ void __init sbi_init(void)
+ 		} else {
+ 			__sbi_rfence	= __sbi_rfence_v01;
+ 		}
++		if ((sbi_spec_version >= sbi_mk_version(0, 3)) &&
++		    (sbi_probe_extension(SBI_EXT_SRST) > 0)) {
++			pr_info("SBI SRST extension detected\n");
++			pm_power_off = sbi_srst_power_off;
++			sbi_srst_reboot_nb.notifier_call = sbi_srst_reboot;
++			sbi_srst_reboot_nb.priority = 192;
++			register_restart_handler(&sbi_srst_reboot_nb);
++		}
+ 	} else {
+ 		__sbi_set_timer = __sbi_set_timer_v01;
+ 		__sbi_send_ipi	= __sbi_send_ipi_v01;
diff --git a/target/linux/sunxi/Makefile b/target/linux/sunxi/Makefile
index 2a031c2df1c6bf..7a2b8af05a9eae 100644
--- a/target/linux/sunxi/Makefile
+++ b/target/linux/sunxi/Makefile
@@ -10,8 +10,7 @@ BOARDNAME:=Allwinner A1x/A20/A3x/H3/H5/R40
 FEATURES:=fpu usb ext4 display rootfs-part rtc squashfs
 SUBTARGETS:=cortexa8 cortexa7 cortexa53
 
-KERNEL_PATCHVER:=5.10
-KERNEL_TESTING_PATCHVER:=5.15
+KERNEL_PATCHVER:=5.15
 
 KERNELNAME:=zImage dtbs
 
diff --git a/target/linux/sunxi/base-files/etc/board.d/02_network b/target/linux/sunxi/base-files/etc/board.d/02_network
index 46ace1f67c599b..b295dc7daa426c 100644
--- a/target/linux/sunxi/base-files/etc/board.d/02_network
+++ b/target/linux/sunxi/base-files/etc/board.d/02_network
@@ -29,6 +29,27 @@ sunxi_setup_interfaces()
 	esac
 }
 
+nanopi_r1_get_mac()
+{
+	local interface=$1
+	local eeprom_path="/sys/bus/i2c/devices/2-0051/eeprom"
+	local address
+
+	if [ -f "$eeprom_path" ]; then
+		address=$(get_mac_binary "$eeprom_path" 0xfa)
+		if [ "$interface" = "lan" ]; then
+			address=$(macaddr_setbit_la "$address")
+		fi
+	else
+		address=$(macaddr_generate_from_mmc_cid mmcblk1)
+		if [ "$interface" = "lan" ]; then
+			address=$(macaddr_add "$address" 1)
+		fi
+	fi
+
+	echo "$address"
+}
+
 sunxi_setup_macs()
 {
 	local board="$1"
@@ -37,6 +58,10 @@ sunxi_setup_macs()
 	local label_mac=""
 
 	case "$board" in
+	friendlyarm,nanopi-r1)
+		wan_mac=$(nanopi_r1_get_mac wan)
+		lan_mac=$(nanopi_r1_get_mac lan)
+		;;
 	friendlyarm,nanopi-r1s-h5)
 		lan_mac=$(get_mac_binary "/sys/bus/i2c/devices/0-0051/eeprom" 0xfa)
 		;;
diff --git a/target/linux/sunxi/config-5.15 b/target/linux/sunxi/config-5.15
index c7dbc5a9f1ef4c..c33bb7ab6fd829 100644
--- a/target/linux/sunxi/config-5.15
+++ b/target/linux/sunxi/config-5.15
@@ -136,7 +136,6 @@ CONFIG_DVB_CORE=y
 CONFIG_DWMAC_GENERIC=y
 # CONFIG_DWMAC_SUN8I is not set
 CONFIG_DWMAC_SUNXI=y
-CONFIG_DYNAMIC_DEBUG=y
 CONFIG_EDAC_ATOMIC_SCRUB=y
 CONFIG_EDAC_SUPPORT=y
 CONFIG_ELF_CORE=y
@@ -162,7 +161,6 @@ CONFIG_FONT_SUPPORT=y
 CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y
 CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
-CONFIG_FRAME_WARN=2048
 CONFIG_FREEZER=y
 CONFIG_FS_IOMAP=y
 CONFIG_FS_MBCACHE=y
@@ -307,6 +305,7 @@ CONFIG_NO_HZ_IDLE=y
 CONFIG_NR_CPUS=8
 CONFIG_NVMEM=y
 CONFIG_NVMEM_SUNXI_SID=y
+CONFIG_NVMEM_SYSFS=y
 CONFIG_OF=y
 CONFIG_OF_ADDRESS=y
 CONFIG_OF_EARLY_FLATTREE=y
diff --git a/target/linux/sunxi/cortexa53/config-5.15 b/target/linux/sunxi/cortexa53/config-5.15
index 00a3d971fdabc3..85ace5d9288715 100644
--- a/target/linux/sunxi/cortexa53/config-5.15
+++ b/target/linux/sunxi/cortexa53/config-5.15
@@ -23,6 +23,7 @@ CONFIG_ARM_GIC_V3=y
 CONFIG_ARM_GIC_V3_ITS=y
 CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
 CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
+CONFIG_CPU_LITTLE_ENDIAN=y
 CONFIG_CRYPTO_AES_ARM64=y
 CONFIG_CRYPTO_AES_ARM64_CE=y
 CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
@@ -51,7 +52,6 @@ CONFIG_MUSB_PIO_ONLY=y
 CONFIG_NEED_SG_DMA_LENGTH=y
 CONFIG_NOP_USB_XCEIV=y
 CONFIG_NO_IOPORT_MAP=y
-CONFIG_NVMEM_SYSFS=y
 CONFIG_PARTITION_PERCPU=y
 CONFIG_PHY_SUN50I_USB3=y
 CONFIG_PINCTRL_SUN50I_A100=y
diff --git a/target/linux/sunxi/image/cortexa7.mk b/target/linux/sunxi/image/cortexa7.mk
index 74cdc6e996e5ef..5b9f27cef80393 100644
--- a/target/linux/sunxi/image/cortexa7.mk
+++ b/target/linux/sunxi/image/cortexa7.mk
@@ -23,7 +23,7 @@ define Device/friendlyarm_nanopi-m1-plus
   DEVICE_VENDOR := FriendlyARM
   DEVICE_MODEL := NanoPi M1 Plus
   DEVICE_PACKAGES:=kmod-leds-gpio kmod-brcmfmac \
-	cypress-firmware-43430-sdio wpad-basic-wolfssl
+	cypress-firmware-43430-sdio wpad-basic-mbedtls
   SOC := sun8i-h3
 endef
 TARGET_DEVICES += friendlyarm_nanopi-m1-plus
@@ -39,7 +39,7 @@ define Device/friendlyarm_nanopi-neo-air
   DEVICE_VENDOR := FriendlyARM
   DEVICE_MODEL := NanoPi NEO Air
   DEVICE_PACKAGES := kmod-leds-gpio kmod-brcmfmac \
-	brcmfmac-firmware-43430a0-sdio wpad-basic-wolfssl
+	brcmfmac-firmware-43430a0-sdio wpad-basic-mbedtls
   SOC := sun8i-h3
 endef
 TARGET_DEVICES += friendlyarm_nanopi-neo-air
@@ -48,7 +48,7 @@ define Device/friendlyarm_nanopi-r1
   DEVICE_VENDOR := FriendlyARM
   DEVICE_MODEL := NanoPi R1
   DEVICE_PACKAGES := kmod-usb-net-rtl8152 kmod-leds-gpio \
-	kmod-brcmfmac cypress-firmware-43430-sdio wpad-basic-wolfssl
+	kmod-brcmfmac cypress-firmware-43430-sdio wpad-basic-mbedtls
   SOC := sun8i-h3
 endef
 TARGET_DEVICES += friendlyarm_nanopi-r1
@@ -66,7 +66,7 @@ define Device/lamobo_lamobo-r1
   DEVICE_MODEL := Lamobo R1
   DEVICE_ALT0_VENDOR := Bananapi
   DEVICE_ALT0_MODEL := BPi-R1
-  DEVICE_PACKAGES := kmod-ata-sunxi kmod-rtl8192cu wpad-basic-wolfssl
+  DEVICE_PACKAGES := kmod-ata-sunxi kmod-rtl8192cu wpad-basic-mbedtls
   DEVICE_COMPAT_VERSION := 1.1
   DEVICE_COMPAT_MESSAGE := Config cannot be migrated from swconfig to DSA
   SOC := sun7i-a20
@@ -85,7 +85,7 @@ define Device/sinovoip_bananapi-m2-berry
   DEVICE_VENDOR := Sinovoip
   DEVICE_MODEL := Banana Pi M2 Berry
   DEVICE_PACKAGES:=kmod-ata-sunxi kmod-brcmfmac \
-	cypress-firmware-43430-sdio wpad-basic-wolfssl
+	cypress-firmware-43430-sdio wpad-basic-mbedtls
   SUPPORTED_DEVICES:=lemaker,bananapi-m2-berry
   SOC := sun8i-v40
 endef
@@ -95,7 +95,7 @@ define Device/sinovoip_bananapi-m2-ultra
   DEVICE_VENDOR := Sinovoip
   DEVICE_MODEL := Banana Pi M2 Ultra
   DEVICE_PACKAGES:=kmod-ata-sunxi kmod-brcmfmac \
-	brcmfmac-firmware-43430a0-sdio wpad-basic-wolfssl
+	brcmfmac-firmware-43430a0-sdio wpad-basic-mbedtls
   SUPPORTED_DEVICES:=lemaker,bananapi-m2-ultra
   SOC := sun8i-r40
 endef
@@ -171,7 +171,7 @@ define Device/sinovoip_bananapi-m2-plus
   DEVICE_VENDOR := Sinovoip
   DEVICE_MODEL := Banana Pi M2+
   DEVICE_PACKAGES:=kmod-leds-gpio kmod-brcmfmac \
-	brcmfmac-firmware-43430a0-sdio wpad-basic-wolfssl
+	brcmfmac-firmware-43430a0-sdio wpad-basic-mbedtls
   SOC := sun8i-h3
 endef
 TARGET_DEVICES += sinovoip_bananapi-m2-plus
diff --git a/target/linux/sunxi/image/cortexa8.mk b/target/linux/sunxi/image/cortexa8.mk
index ceb15a0fd8d95b..eafc2187e84beb 100644
--- a/target/linux/sunxi/image/cortexa8.mk
+++ b/target/linux/sunxi/image/cortexa8.mk
@@ -11,6 +11,16 @@ define Device/cubietech_a10-cubieboard
 endef
 TARGET_DEVICES += cubietech_a10-cubieboard
 
+define Device/haoyu_a10-marsboard
+  DEVICE_VENDOR := HAOYU Electronics
+  DEVICE_MODEL := MarsBoard A10
+  DEVICE_PACKAGES:=kmod-ata-core kmod-ata-sunxi kmod-sun4i-emac \
+	kmod-rtc-sunxi kmod-sound-core kmod-sound-soc-sunxi
+  SUPPORTED_DEVICES += marsboard,a10-marsboard
+  SOC := sun4i
+endef
+TARGET_DEVICES += haoyu_a10-marsboard
+
 define Device/linksprite_a10-pcduino
   DEVICE_VENDOR := LinkSprite
   DEVICE_MODEL := pcDuino
@@ -19,15 +29,6 @@ define Device/linksprite_a10-pcduino
 endef
 TARGET_DEVICES += linksprite_a10-pcduino
 
-define Device/marsboard_a10-marsboard
-  DEVICE_VENDOR := HAOYU Electronics
-  DEVICE_MODEL := MarsBoard A10
-  DEVICE_PACKAGES:=kmod-ata-core kmod-ata-sunxi kmod-sun4i-emac kmod-rtc-sunxi \
-	sound-soc-sunxi
-  SOC := sun4i
-endef
-TARGET_DEVICES += marsboard_a10-marsboard
-
 define Device/olimex_a10-olinuxino-lime
   DEVICE_VENDOR := Olimex
   DEVICE_MODEL := A10-OLinuXino-LIME
diff --git a/target/linux/sunxi/modules.mk b/target/linux/sunxi/modules.mk
index 99f4db76044696..8bbafe98a7b13b 100644
--- a/target/linux/sunxi/modules.mk
+++ b/target/linux/sunxi/modules.mk
@@ -5,8 +5,7 @@
 define KernelPackage/rtc-sunxi
     SUBMENU:=$(OTHER_MENU)
     TITLE:=Sunxi SoC built-in RTC support
-    DEPENDS:=@TARGET_sunxi
-    $(call AddDepends/rtc)
+    DEPENDS:=@(TARGET_sunxi&&RTC_SUPPORT)
     KCONFIG:= \
 	CONFIG_RTC_DRV_SUNXI \
 	CONFIG_RTC_CLASS=y
@@ -22,20 +21,20 @@ $(eval $(call KernelPackage,rtc-sunxi))
 
 define KernelPackage/sunxi-ir
     SUBMENU:=$(OTHER_MENU)
-    TITLE:=Sunxi SoC built-in IR support (A20)
-    DEPENDS:=@TARGET_sunxi +kmod-input-core
-    $(call AddDepends/rtc)
+    TITLE:=Sunxi SoC built-in IR support
+    DEPENDS:=@(TARGET_sunxi&&RTC_SUPPORT) +kmod-input-core
     KCONFIG:= \
 	CONFIG_MEDIA_SUPPORT=y \
 	CONFIG_MEDIA_RC_SUPPORT=y \
 	CONFIG_RC_DEVICES=y \
+	CONFIG_RC_CORE=y \
 	CONFIG_IR_SUNXI
     FILES:=$(LINUX_DIR)/drivers/media/rc/sunxi-cir.ko
     AUTOLOAD:=$(call AutoLoad,50,sunxi-cir)
 endef
 
 define KernelPackage/sunxi-ir/description
- Support for the AllWinner sunXi SoC's onboard IR (A20)
+ Support for the AllWinner sunXi SoC's onboard IR
 endef
 
 $(eval $(call KernelPackage,sunxi-ir))
diff --git a/target/linux/sunxi/profiles/00-default.mk b/target/linux/sunxi/profiles/00-default.mk
index 0541087a488d2b..0e3192adaf944c 100644
--- a/target/linux/sunxi/profiles/00-default.mk
+++ b/target/linux/sunxi/profiles/00-default.mk
@@ -13,7 +13,7 @@ define Profile/Default
 	kmod-sun4i-emac \
 	rtl8188eu-firmware \
 	swconfig \
-	wpad-basic-wolfssl
+	wpad-basic-mbedtls
   PRIORITY := 1
 endef
 
diff --git a/target/linux/tegra/Makefile b/target/linux/tegra/Makefile
index 76dfeab4026d55..43ca154e8a08d4 100644
--- a/target/linux/tegra/Makefile
+++ b/target/linux/tegra/Makefile
@@ -10,8 +10,9 @@ BOARDNAME := NVIDIA Tegra
 FEATURES := audio boot-part display ext4 fpu gpio pci pcie rootfs-part rtc squashfs usb
 CPU_TYPE := cortex-a9
 CPU_SUBTYPE := vfpv3-d16
+SUBTARGETS := generic
 
-KERNEL_PATCHVER := 5.10
+KERNEL_PATCHVER := 5.15
 
 include $(INCLUDE_DIR)/target.mk
 
diff --git a/target/linux/tegra/config-5.15 b/target/linux/tegra/config-5.15
new file mode 100644
index 00000000000000..257ffda252ad3a
--- /dev/null
+++ b/target/linux/tegra/config-5.15
@@ -0,0 +1,504 @@
+CONFIG_AC97_BUS=y
+# CONFIG_AHCI_TEGRA is not set
+CONFIG_ALIGNMENT_TRAP=y
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+CONFIG_ARCH_MULTIPLATFORM=y
+CONFIG_ARCH_MULTI_V6_V7=y
+CONFIG_ARCH_MULTI_V7=y
+CONFIG_ARCH_NEEDS_CPU_IDLE_COUPLED=y
+CONFIG_ARCH_NR_GPIO=1024
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX=y
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARCH_TEGRA=y
+# CONFIG_ARCH_TEGRA_114_SOC is not set
+# CONFIG_ARCH_TEGRA_124_SOC is not set
+CONFIG_ARCH_TEGRA_2x_SOC=y
+# CONFIG_ARCH_TEGRA_3x_SOC is not set
+CONFIG_ARM=y
+CONFIG_ARM_AMBA=y
+CONFIG_ARM_CPU_SUSPEND=y
+CONFIG_ARM_CRYPTO=y
+CONFIG_ARM_ERRATA_720789=y
+CONFIG_ARM_ERRATA_754327=y
+CONFIG_ARM_ERRATA_764369=y
+CONFIG_ARM_GIC=y
+CONFIG_ARM_HAS_SG_CHAIN=y
+CONFIG_ARM_HEAVY_MB=y
+CONFIG_ARM_L1_CACHE_SHIFT=6
+CONFIG_ARM_L1_CACHE_SHIFT_6=y
+CONFIG_ARM_PATCH_IDIV=y
+CONFIG_ARM_PATCH_PHYS_VIRT=y
+# CONFIG_ARM_PL172_MPMC is not set
+# CONFIG_ARM_SMMU is not set
+# CONFIG_ARM_TEGRA124_CPUFREQ is not set
+CONFIG_ARM_TEGRA20_CPUFREQ=y
+CONFIG_ARM_TEGRA_CPUIDLE=y
+CONFIG_ARM_THUMB=y
+CONFIG_ARM_THUMBEE=y
+CONFIG_ARM_UNWIND=y
+CONFIG_ARM_VIRT_EXT=y
+CONFIG_ASN1=y
+CONFIG_ATA=y
+CONFIG_ATAGS=y
+CONFIG_AUTO_ZRELADDR=y
+CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK=y
+CONFIG_BLK_DEV_BSG=y
+CONFIG_BLK_DEV_BSG_COMMON=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BOUNCE=y
+CONFIG_CACHE_L2X0=y
+CONFIG_CLKSRC_MMIO=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CLZ_TAB=y
+CONFIG_CMA=y
+CONFIG_CMA_ALIGNMENT=8
+CONFIG_CMA_AREAS=7
+# CONFIG_CMA_DEBUG is not set
+# CONFIG_CMA_DEBUGFS is not set
+CONFIG_CMA_SIZE_MBYTES=16
+# CONFIG_CMA_SIZE_SEL_MAX is not set
+CONFIG_CMA_SIZE_SEL_MBYTES=y
+# CONFIG_CMA_SIZE_SEL_MIN is not set
+# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
+# CONFIG_CMA_SYSFS is not set
+CONFIG_COMMON_CLK=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONTIG_ALLOC=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+CONFIG_CPU_32v6K=y
+CONFIG_CPU_32v7=y
+CONFIG_CPU_ABRT_EV7=y
+CONFIG_CPU_CACHE_V7=y
+CONFIG_CPU_CACHE_VIPT=y
+CONFIG_CPU_COPY_V6=y
+CONFIG_CPU_CP15=y
+CONFIG_CPU_CP15_MMU=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+# CONFIG_CPU_FREQ_STAT is not set
+CONFIG_CPU_HAS_ASID=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_PABRT_V7=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SPECTRE=y
+CONFIG_CPU_THUMB_CAPABLE=y
+CONFIG_CPU_TLB_V7=y
+CONFIG_CPU_V7=y
+CONFIG_CRC16=y
+# CONFIG_CRC32_SARWATE is not set
+CONFIG_CRC32_SLICEBY8=y
+CONFIG_CROSS_MEMORY_ATTACH=y
+CONFIG_CRYPTO_AES_ARM=y
+CONFIG_CRYPTO_CRC32=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_CRYPTD=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_DRBG=y
+CONFIG_CRYPTO_DRBG_HMAC=y
+CONFIG_CRYPTO_DRBG_MENU=y
+CONFIG_CRYPTO_ECHAINIV=y
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_JITTERENTROPY=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_LZ4=y
+CONFIG_CRYPTO_LZ4HC=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_RNG_DEFAULT=y
+CONFIG_CRYPTO_RSA=y
+CONFIG_CRYPTO_SEQIV=y
+CONFIG_CRYPTO_SHA1=y
+CONFIG_CRYPTO_SHA1_ARM=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA256_ARM=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_SHA512_ARM=y
+CONFIG_CRYPTO_TWOFISH=y
+CONFIG_CRYPTO_TWOFISH_COMMON=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DEBUG_ALIGN_RODATA=y
+CONFIG_DEBUG_LL_INCLUDE="mach/debug-macro.S"
+# CONFIG_DEVFREQ_GOV_PASSIVE is not set
+# CONFIG_DEVFREQ_GOV_PERFORMANCE is not set
+# CONFIG_DEVFREQ_GOV_POWERSAVE is not set
+CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=y
+# CONFIG_DEVFREQ_GOV_USERSPACE is not set
+CONFIG_DEVFREQ_THERMAL=y
+# CONFIG_DEVPORT is not set
+CONFIG_DMADEVICES=y
+CONFIG_DMA_CMA=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_OPS=y
+CONFIG_DMA_REMAP=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DNOTIFY=y
+CONFIG_DRM=y
+CONFIG_DRM_BRIDGE=y
+CONFIG_DRM_FBDEV_EMULATION=y
+CONFIG_DRM_FBDEV_OVERALLOC=100
+CONFIG_DRM_KMS_HELPER=y
+CONFIG_DRM_MIPI_DSI=y
+CONFIG_DRM_PANEL=y
+CONFIG_DRM_PANEL_BRIDGE=y
+CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y
+CONFIG_DRM_TEGRA=y
+# CONFIG_DRM_TEGRA_DEBUG is not set
+# CONFIG_DRM_TEGRA_STAGING is not set
+CONFIG_DTC=y
+CONFIG_EDAC_ATOMIC_SCRUB=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EXT4_FS=y
+CONFIG_EXTCON=y
+CONFIG_F2FS_FS=y
+CONFIG_FB=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+CONFIG_FB_CMDLINE=y
+CONFIG_FB_DEFERRED_IO=y
+CONFIG_FB_SYS_COPYAREA=y
+CONFIG_FB_SYS_FILLRECT=y
+CONFIG_FB_SYS_FOPS=y
+CONFIG_FB_SYS_IMAGEBLIT=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ARCH_TOPOLOGY=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_GENERIC_IRQ_MULTI_HANDLER=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_MSI_IRQ=y
+CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GENERIC_VDSO_32=y
+CONFIG_GLOB=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_TEGRA=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDEN_BRANCH_PREDICTOR=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HAVE_SMP=y
+CONFIG_HDMI=y
+CONFIG_HID=y
+CONFIG_HIDRAW=y
+CONFIG_HID_GENERIC=y
+CONFIG_HIGHMEM=y
+CONFIG_HIGHPTE=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HWMON=y
+CONFIG_HZ_FIXED=0
+CONFIG_HZ_PERIODIC=y
+CONFIG_I2C=y
+CONFIG_I2C_ALGOBIT=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_COMPAT=y
+CONFIG_I2C_TEGRA=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_INPUT=y
+CONFIG_INPUT_KEYBOARD=y
+CONFIG_INTERCONNECT=y
+CONFIG_IOMMU_API=y
+# CONFIG_IOMMU_DEBUGFS is not set
+CONFIG_IOMMU_DEFAULT_DMA_STRICT=y
+CONFIG_IOMMU_IOVA=y
+# CONFIG_IOMMU_IO_PGTABLE_ARMV7S is not set
+# CONFIG_IOMMU_IO_PGTABLE_LPAE is not set
+CONFIG_IOMMU_SUPPORT=y
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+CONFIG_JBD2=y
+CONFIG_KCMP=y
+CONFIG_KEYBOARD_ATKBD=y
+CONFIG_KMAP_LOCAL=y
+CONFIG_KMAP_LOCAL_NON_LINEAR_PTE_ARRAY=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_LZ4HC_COMPRESS=y
+CONFIG_LZ4_COMPRESS=y
+CONFIG_LZ4_DECOMPRESS=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MEMORY=y
+CONFIG_MEMORY_ISOLATION=y
+# CONFIG_MFD_ACER_A500_EC is not set
+# CONFIG_MFD_NVEC is not set
+CONFIG_MIGHT_HAVE_CACHE_L2X0=y
+CONFIG_MIGRATION=y
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_CQHCI=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_IO_ACCESSORS=y
+# CONFIG_MMC_SDHCI_PCI is not set
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SDHCI_TEGRA=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MPILIB=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPI_NOR_USE_4K_SECTORS=y
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_NEED_DMA_MAP_STATE=y
+# CONFIG_NEON is not set
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NLS=y
+CONFIG_NR_CPUS=4
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IOMMU=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OLD_SIGACTION=y
+CONFIG_OLD_SIGSUSPEND3=y
+CONFIG_OUTER_CACHE=y
+CONFIG_OUTER_CACHE_SYNC=y
+CONFIG_PADATA=y
+CONFIG_PAGE_OFFSET=0xC0000000
+CONFIG_PCI=y
+CONFIG_PCIEAER=y
+CONFIG_PCIEASPM=y
+CONFIG_PCIEASPM_DEFAULT=y
+# CONFIG_PCIEASPM_PERFORMANCE is not set
+# CONFIG_PCIEASPM_POWERSAVE is not set
+# CONFIG_PCIEASPM_POWER_SUPERSAVE is not set
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_PME=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PCI_MSI=y
+CONFIG_PCI_MSI_IRQ_DOMAIN=y
+CONFIG_PCI_TEGRA=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHY_TEGRA_XUSB=y
+CONFIG_PINCTRL=y
+CONFIG_PINCTRL_TEGRA=y
+CONFIG_PINCTRL_TEGRA20=y
+CONFIG_PINCTRL_TEGRA_XUSB=y
+CONFIG_PL310_ERRATA_727915=y
+CONFIG_PL310_ERRATA_769419=y
+CONFIG_PL353_SMC=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_DEVFREQ=y
+# CONFIG_PM_DEVFREQ_EVENT is not set
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_PM_OPP=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_GPIO=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PROC_PAGE_MONITOR=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_PWM=y
+CONFIG_PWM_SYSFS=y
+CONFIG_PWM_TEGRA=y
+CONFIG_RAS=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGMAP_SPI=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_GPIO=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+CONFIG_RTC_CLASS=y
+# CONFIG_RTC_DRV_CMOS is not set
+CONFIG_RTC_DRV_TEGRA=y
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RTC_NVMEM=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+# CONFIG_SCSI_LOWLEVEL is not set
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_SERIAL_8250_FSL=y
+CONFIG_SERIAL_8250_TEGRA=y
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_TEGRA=y
+CONFIG_SERIO=y
+CONFIG_SERIO_LIBPS2=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SG_POOL=y
+CONFIG_SMP=y
+CONFIG_SMP_ON_UP=y
+CONFIG_SND=y
+# CONFIG_SND_COMPRESS_OFFLOAD is not set
+CONFIG_SND_DMAENGINE_PCM=y
+# CONFIG_SND_DRIVERS is not set
+# CONFIG_SND_HDA_TEGRA is not set
+CONFIG_SND_JACK=y
+CONFIG_SND_JACK_INPUT_DEV=y
+# CONFIG_SND_PCI is not set
+CONFIG_SND_PCM=y
+# CONFIG_SND_PROC_FS is not set
+CONFIG_SND_SIMPLE_CARD=y
+CONFIG_SND_SIMPLE_CARD_UTILS=y
+CONFIG_SND_SOC=y
+CONFIG_SND_SOC_AC97_BUS=y
+CONFIG_SND_SOC_GENERIC_DMAENGINE_PCM=y
+CONFIG_SND_SOC_I2C_AND_SPI=y
+CONFIG_SND_SOC_TEGRA=y
+# CONFIG_SND_SOC_TEGRA186_DSPK is not set
+CONFIG_SND_SOC_TEGRA20_AC97=y
+CONFIG_SND_SOC_TEGRA20_DAS=y
+CONFIG_SND_SOC_TEGRA20_I2S=y
+CONFIG_SND_SOC_TEGRA20_SPDIF=y
+# CONFIG_SND_SOC_TEGRA210_ADMAIF is not set
+# CONFIG_SND_SOC_TEGRA210_AHUB is not set
+# CONFIG_SND_SOC_TEGRA210_DMIC is not set
+# CONFIG_SND_SOC_TEGRA210_I2S is not set
+# CONFIG_SND_SOC_TEGRA30_AHUB is not set
+# CONFIG_SND_SOC_TEGRA30_I2S is not set
+# CONFIG_SND_SOC_TEGRA_ALC5632 is not set
+CONFIG_SND_SOC_TEGRA_MACHINE_DRV=y
+# CONFIG_SND_SOC_TEGRA_MAX98090 is not set
+# CONFIG_SND_SOC_TEGRA_RT5640 is not set
+# CONFIG_SND_SOC_TEGRA_RT5677 is not set
+# CONFIG_SND_SOC_TEGRA_SGTL5000 is not set
+CONFIG_SND_SOC_TEGRA_TRIMSLICE=y
+# CONFIG_SND_SOC_TEGRA_WM8753 is not set
+# CONFIG_SND_SOC_TEGRA_WM8903 is not set
+# CONFIG_SND_SOC_TEGRA_WM9712 is not set
+CONFIG_SND_SOC_TLV320AIC23=y
+CONFIG_SND_SOC_TLV320AIC23_I2C=y
+# CONFIG_SND_USB is not set
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOC_BUS=y
+CONFIG_SOC_TEGRA20_VOLTAGE_COUPLER=y
+CONFIG_SOC_TEGRA_FLOWCTRL=y
+CONFIG_SOC_TEGRA_FUSE=y
+CONFIG_SOC_TEGRA_PMC=y
+CONFIG_SOUND=y
+CONFIG_SOUND_OSS_CORE=y
+CONFIG_SOUND_OSS_CORE_PRECLAIM=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SPI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+# CONFIG_SPI_TEGRA114 is not set
+CONFIG_SPI_TEGRA20_SFLASH=y
+CONFIG_SPI_TEGRA20_SLINK=y
+# CONFIG_SPI_TEGRA210_QUAD is not set
+CONFIG_SRCU=y
+CONFIG_SWP_EMULATE=y
+CONFIG_SYNC_FILE=y
+CONFIG_SYS_SUPPORTS_APM_EMULATION=y
+CONFIG_TEGRA20_APB_DMA=y
+CONFIG_TEGRA20_EMC=y
+CONFIG_TEGRA_AHB=y
+CONFIG_TEGRA_GMI=y
+CONFIG_TEGRA_HOST1X=y
+CONFIG_TEGRA_HOST1X_FIREWALL=y
+CONFIG_TEGRA_IOMMU_GART=y
+# CONFIG_TEGRA_IOMMU_SMMU is not set
+# CONFIG_TEGRA_IVC is not set
+CONFIG_TEGRA_MC=y
+# CONFIG_TEGRA_SOCTHERM is not set
+CONFIG_TEGRA_TIMER=y
+CONFIG_TEGRA_WATCHDOG=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+# CONFIG_UACCE is not set
+# CONFIG_UCLAMP_TASK is not set
+CONFIG_UNCOMPRESS_INCLUDE="debug/uncompress.h"
+CONFIG_UNWINDER_ARM=y
+CONFIG_USB=y
+CONFIG_USB_CHIPIDEA=y
+CONFIG_USB_CHIPIDEA_HOST=y
+CONFIG_USB_CHIPIDEA_TEGRA=y
+CONFIG_USB_CHIPIDEA_UDC=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_CONN_GPIO=y
+CONFIG_USB_EHCI_HCD=y
+# CONFIG_USB_EHCI_HCD_PLATFORM is not set
+CONFIG_USB_EHCI_TEGRA=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_HID=y
+CONFIG_USB_HIDDEV=y
+CONFIG_USB_PHY=y
+CONFIG_USB_ROLE_SWITCH=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_TEGRA_PHY=y
+# CONFIG_USB_TEGRA_XUDC is not set
+CONFIG_USB_ULPI=y
+CONFIG_USB_ULPI_BUS=y
+CONFIG_USB_ULPI_VIEWPORT=y
+# CONFIG_USB_XHCI_TEGRA is not set
+CONFIG_USE_OF=y
+CONFIG_VFP=y
+CONFIG_VFPv3=y
+CONFIG_WATCHDOG_CORE=y
+# CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set
+CONFIG_XPS=y
+CONFIG_XZ_DEC_ARM=y
+CONFIG_XZ_DEC_ARMTHUMB=y
+CONFIG_XZ_DEC_BCJ=y
+CONFIG_ZBOOT_ROM_BSS=0
+CONFIG_ZBOOT_ROM_TEXT=0
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
diff --git a/target/linux/tegra/generic/target.mk b/target/linux/tegra/generic/target.mk
new file mode 100644
index 00000000000000..f5cb1fb19b943f
--- /dev/null
+++ b/target/linux/tegra/generic/target.mk
@@ -0,0 +1 @@
+BOARDNAME:=Generic
diff --git a/target/linux/tegra/image/Makefile b/target/linux/tegra/image/Makefile
index 58c2fe74f8ba77..82394f4ab6fadb 100644
--- a/target/linux/tegra/image/Makefile
+++ b/target/linux/tegra/image/Makefile
@@ -43,7 +43,7 @@ define Device/compulab_trimslice
   DEVICE_MODEL := TrimSlice
   DEVICE_DTS := tegra20-trimslice
   DEVICE_PACKAGES := kmod-r8169 kmod-rt2800-usb kmod-rtc-em3027 \
-	kmod-usb-storage wpad-basic-wolfssl
+	kmod-usb-storage wpad-basic-mbedtls
   UBOOT := trimslice-mmc
 endef
 TARGET_DEVICES += compulab_trimslice
diff --git a/target/linux/tegra/patches-5.15/100-serial8250-on-tegra-hsuart-recover-from-spurious-interrupts-due-to-tegra2-silicon-bug.patch b/target/linux/tegra/patches-5.15/100-serial8250-on-tegra-hsuart-recover-from-spurious-interrupts-due-to-tegra2-silicon-bug.patch
new file mode 100644
index 00000000000000..8f01f73eb24a98
--- /dev/null
+++ b/target/linux/tegra/patches-5.15/100-serial8250-on-tegra-hsuart-recover-from-spurious-interrupts-due-to-tegra2-silicon-bug.patch
@@ -0,0 +1,77 @@
+From patchwork Fri Jul 13 11:32:42 2018
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: serial8250 on tegra hsuart: recover from spurious interrupts due to
+ tegra2 silicon bug
+X-Patchwork-Submitter: "David R. Piegdon" <lkml@p23q.org>
+X-Patchwork-Id: 943440
+Message-Id: <4676ea34-69ce-5422-1ded-94218b89f7d9@p23q.org>
+To: linux-tegra@vger.kernel.org
+Date: Fri, 13 Jul 2018 11:32:42 +0000
+From: "David R. Piegdon" <lkml@p23q.org>
+List-Id: <linux-tegra.vger.kernel.org>
+
+Hi,
+a while back I sent a few mails regarding spurious interrupts in the
+UARTA (hsuart) block of the Tegra2 SoC, when using the 8250 driver for
+it instead of the hsuart driver. After going down a pretty deep
+debugging/testing hole, I think I found a patch that fixes the issue. So
+far testing in a reboot-cycle suggests that the error frequency dropped
+from >3% of all reboots to at least <0.05% of all reboots. Tests
+continue to run over the weekend.
+
+The patch below already is a second iteration; the first did not reset
+the MCR or contain the lines below '// clear interrupts'. This resulted
+in no more spurious interrupts, but in a few % of spurious interrupts
+that were recovered the UART block did not receive any characters any
+more. So further resetting was required to fully reacquire operational
+state of the UART block.
+
+I'd love any comments/suggestions on this!
+
+Cheers,
+
+David
+
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -134,6 +134,38 @@ static irqreturn_t serial8250_interrupt(
+ 
+ 		if (l == i->head && pass_counter++ > PASS_LIMIT)
+ 			break;
++
++#ifdef CONFIG_ARCH_TEGRA_2x_SOC
++		if (!handled && (port->type == PORT_TEGRA)) {
++			/*
++			 * Fix Tegra 2 CPU silicon bug where sometimes
++			 * "TX holding register empty" interrupts result in a
++			 * bad (metastable?) state in Tegras HSUART IP core.
++			 * Only way to recover seems to be to reset all
++			 * interrupts as well as the TX queue and the MCR.
++			 * But we don't want to loose any outgoing characters,
++			 * so only do it if the RX and TX queues are empty.
++			 */
++			unsigned char lsr = port->serial_in(port, UART_LSR);
++			const unsigned char fifo_empty_mask =
++						(UART_LSR_TEMT | UART_LSR_THRE);
++			if (((lsr & (UART_LSR_DR | fifo_empty_mask)) ==
++							fifo_empty_mask)) {
++				port->serial_out(port, UART_IER, 0);
++				port->serial_out(port, UART_MCR, 0);
++				serial8250_clear_and_reinit_fifos(up);
++				port->serial_out(port, UART_MCR, up->mcr);
++				port->serial_out(port, UART_IER, up->ier);
++				// clear interrupts
++				serial_port_in(port, UART_LSR);
++				serial_port_in(port, UART_RX);
++				serial_port_in(port, UART_IIR);
++				serial_port_in(port, UART_MSR);
++				up->lsr_saved_flags = 0;
++				up->msr_saved_flags = 0;
++			}
++		}
++#endif
+ 	} while (l != end);
+ 
+ 	spin_unlock(&i->lock);
diff --git a/target/linux/tegra/patches-5.15/101-ARM-dtc-tegra-enable-front-panel-leds-in-TrimSlice.patch b/target/linux/tegra/patches-5.15/101-ARM-dtc-tegra-enable-front-panel-leds-in-TrimSlice.patch
new file mode 100644
index 00000000000000..b1e210b212de3a
--- /dev/null
+++ b/target/linux/tegra/patches-5.15/101-ARM-dtc-tegra-enable-front-panel-leds-in-TrimSlice.patch
@@ -0,0 +1,46 @@
+--- a/arch/arm/boot/dts/tegra20-trimslice.dts
++++ b/arch/arm/boot/dts/tegra20-trimslice.dts
+@@ -201,16 +201,17 @@
+ 			conf_ata {
+ 				nvidia,pins = "ata", "atc", "atd", "ate",
+ 					"crtp", "dap2", "dap3", "dap4", "dta",
+-					"dtb", "dtc", "dtd", "dte", "gmb",
+-					"gme", "i2cp", "pta", "slxc", "slxd",
+-					"spdi", "spdo", "uda";
++					"dtb", "dtc", "dtd", "gmb", "gme",
++					"i2cp", "pta", "slxc", "slxd", "spdi",
++					"spdo", "uda";
+ 				nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+ 				nvidia,tristate = <TEGRA_PIN_ENABLE>;
+ 			};
+ 			conf_atb {
+ 				nvidia,pins = "atb", "cdev1", "cdev2", "dap1",
+-					"gma", "gmc", "gmd", "gpu", "gpu7",
+-					"gpv", "sdio1", "slxa", "slxk", "uac";
++					"dte", "gma", "gmc", "gmd", "gpu",
++					"gpu7", "gpv", "sdio1", "slxa", "slxk",
++					"uac";
+ 				nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+ 				nvidia,tristate = <TEGRA_PIN_DISABLE>;
+ 			};
+@@ -396,6 +397,20 @@
+ 		};
+ 	};
+ 
++	gpio-leds {
++		compatible = "gpio-leds";
++
++		ds2 {
++			label = "trimslice:green:right";
++			gpios = <&gpio TEGRA_GPIO(D, 2) GPIO_ACTIVE_LOW>;
++		};
++
++		ds3 {
++			label = "trimslice:green:left";
++			gpios = <&gpio TEGRA_GPIO(BB, 5) GPIO_ACTIVE_LOW>;
++		};
++	};
++
+ 	poweroff {
+ 		compatible = "gpio-poweroff";
+ 		gpios = <&gpio TEGRA_GPIO(X, 7) GPIO_ACTIVE_LOW>;
diff --git a/target/linux/uml/Makefile b/target/linux/uml/Makefile
index 5c884fb9a05e94..ba3c7eae9dc443 100644
--- a/target/linux/uml/Makefile
+++ b/target/linux/uml/Makefile
@@ -13,11 +13,12 @@ BOARD:=uml
 BOARDNAME:=User Mode Linux
 FEATURES:=audio ext4 rootfs-part squashfs
 
-KERNEL_PATCHVER:=5.10
+KERNEL_PATCHVER:=5.15
+KERNEL_TESTING_PATCHVER:=6.1
 
 include $(INCLUDE_DIR)/target.mk
 
-DEFAULT_PACKAGES += wpad-basic-wolfssl kmod-mac80211-hwsim mkf2fs e2fsprogs
+DEFAULT_PACKAGES += wpad-basic-mbedtls kmod-mac80211-hwsim mkf2fs e2fsprogs
 
   endif
 endif
diff --git a/target/linux/uml/README.md b/target/linux/uml/README.md
index 63c68db57f3a3d..9275f9891b9044 100644
--- a/target/linux/uml/README.md
+++ b/target/linux/uml/README.md
@@ -28,7 +28,7 @@ console prompt. If you would like it in xterms, substitute `con=xterm` and
 `con0=xterm`. **No networking is configured** but it's a starting point. The
 resulting file system has just enough free space to start kicking the tires and
 playing in the world of 'embedded routers' along with all the resource
-restrictions that come with that world.  
+restrictions that come with that world.
 
 To configure networking and more refer to the *user mode linux* documentation
 online. A quick start goes along this line. Install the `uml-utilities`
diff --git a/target/linux/uml/config-5.15 b/target/linux/uml/config-5.15
new file mode 100644
index 00000000000000..549a31e1c62c08
--- /dev/null
+++ b/target/linux/uml/config-5.15
@@ -0,0 +1,141 @@
+CONFIG_3_LEVEL_PGTABLES=y
+CONFIG_64BIT=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_ARCH_EPHEMERAL_INODES=y
+CONFIG_ARCH_NO_PREEMPT=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_BLK_DEV_COW_COMMON=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_UBD=y
+CONFIG_BLK_DEV_UBD_SYNC=y
+CONFIG_BLK_MQ_VIRTIO=y
+CONFIG_CDROM=y
+# CONFIG_COMMON_CLK is not set
+# CONFIG_COMPAT_32BIT_TIME is not set
+CONFIG_CON_CHAN="xterm"
+CONFIG_CON_ZERO_CHAN="fd:0,fd:1"
+CONFIG_CPU_SUP_AMD=y
+CONFIG_CPU_SUP_CENTAUR=y
+CONFIG_CPU_SUP_HYGON=y
+CONFIG_CPU_SUP_INTEL=y
+CONFIG_CPU_SUP_ZHAOXIN=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_BLAKE2S=y
+CONFIG_CRYPTO_CRC32=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=11
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_SHA1=y
+# CONFIG_CRYPTO_TWOFISH_X86_64 is not set
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_DECOMPRESS_BZIP2=y
+CONFIG_DECOMPRESS_GZIP=y
+CONFIG_DNOTIFY=y
+# CONFIG_EARLY_PRINTK is not set
+CONFIG_EXT4_FS=y
+CONFIG_F2FS_FS=y
+CONFIG_FAILOVER=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+# CONFIG_GENERIC_CPU is not set
+CONFIG_GENERIC_CPU_DEVICES=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_HOSTFS=y
+CONFIG_HVC_DRIVER=y
+CONFIG_HW_RANDOM=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_IA32_FEAT_CTL=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_INIT_ENV_ARG_LIMIT=128
+CONFIG_IRQ_WORK=y
+CONFIG_ISO9660_FS=y
+CONFIG_JBD2=y
+# CONFIG_JFFS2_FS is not set
+CONFIG_KALLSYMS=y
+CONFIG_KERNEL_STACK_ORDER=2
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+# CONFIG_MATOM is not set
+CONFIG_MAY_HAVE_RUNTIME_DEPS=y
+CONFIG_MCONSOLE=y
+# CONFIG_MCORE2 is not set
+CONFIG_MEMFD_CREATE=y
+CONFIG_MIGRATION=y
+CONFIG_MK8=y
+# CONFIG_MMAPPER is not set
+CONFIG_MODULES_USE_ELF_RELA=y
+# CONFIG_MPSC is not set
+CONFIG_NAMESPACES=y
+CONFIG_NEED_PER_CPU_KM=y
+CONFIG_NET_FAILOVER=y
+# CONFIG_NET_NS is not set
+CONFIG_NLS=y
+CONFIG_NO_DMA=y
+CONFIG_NO_IOMEM=y
+CONFIG_NO_IOPORT_MAP=y
+CONFIG_NR_CPUS=1
+CONFIG_NULL_CHAN=y
+# CONFIG_OF is not set
+CONFIG_PGTABLE_LEVELS=3
+CONFIG_PHYS_ADDR_T_64BIT=y
+CONFIG_PORT_CHAN=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+# CONFIG_PROCESSOR_SELECT is not set
+CONFIG_PROC_PAGE_MONITOR=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_PTY_CHAN=y
+CONFIG_RD_BZIP2=y
+CONFIG_RD_GZIP=y
+CONFIG_RELAY=y
+CONFIG_SG_POOL=y
+CONFIG_SOFT_WATCHDOG=m
+CONFIG_SRCU=y
+CONFIG_SSL=y
+CONFIG_SSL_CHAN="pty"
+CONFIG_STACKTRACE=y
+CONFIG_STDERR_CONSOLE=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TINY_SRCU=y
+CONFIG_TTY_CHAN=y
+CONFIG_UML=y
+CONFIG_UML_NET=y
+CONFIG_UML_NET_DAEMON=y
+CONFIG_UML_NET_DETERMINISTIC_MAC=y
+CONFIG_UML_NET_ETHERTAP=y
+CONFIG_UML_NET_MCAST=y
+# CONFIG_UML_NET_PCAP is not set
+CONFIG_UML_NET_SLIP=y
+CONFIG_UML_NET_SLIRP=y
+CONFIG_UML_NET_TUNTAP=y
+# CONFIG_UML_NET_VDE is not set
+CONFIG_UML_NET_VECTOR=y
+# CONFIG_UML_PCI_OVER_VIRTIO is not set
+CONFIG_UML_RANDOM=y
+# CONFIG_UML_SOUND is not set
+CONFIG_UML_TIME_TRAVEL_SUPPORT=y
+CONFIG_UML_WATCHDOG=y
+CONFIG_UML_X86=y
+# CONFIG_USER_NS is not set
+CONFIG_VIRTIO=y
+CONFIG_VIRTIO_BLK=y
+CONFIG_VIRTIO_CONSOLE=y
+CONFIG_VIRTIO_NET=y
+CONFIG_VIRTIO_UML=y
+CONFIG_VMAP_STACK=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_X86_64=y
+CONFIG_X86_CMOV=y
+CONFIG_X86_CMPXCHG64=y
+CONFIG_X86_INTEL_USERCOPY=y
+CONFIG_X86_INTERNODE_CACHE_SHIFT=6
+CONFIG_X86_L1_CACHE_SHIFT=6
+CONFIG_X86_MINIMUM_CPU_FAMILY=64
+CONFIG_X86_TSC=y
+CONFIG_X86_USE_PPRO_CHECKSUM=y
+CONFIG_XTERM_CHAN=y
+CONFIG_ZLIB_INFLATE=y
diff --git a/target/linux/uml/config-6.1 b/target/linux/uml/config-6.1
new file mode 100644
index 00000000000000..da4eaac3ac3bb7
--- /dev/null
+++ b/target/linux/uml/config-6.1
@@ -0,0 +1,150 @@
+CONFIG_3_LEVEL_PGTABLES=y
+CONFIG_64BIT=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_ARCH_EPHEMERAL_INODES=y
+CONFIG_ARCH_NO_PREEMPT=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_BLK_DEV_COW_COMMON=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_UBD=y
+CONFIG_BLK_DEV_UBD_SYNC=y
+CONFIG_BLK_MQ_VIRTIO=y
+CONFIG_CDROM=y
+# CONFIG_COMMON_CLK is not set
+CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
+# CONFIG_COMPAT_32BIT_TIME is not set
+CONFIG_CON_CHAN="xterm"
+CONFIG_CON_ZERO_CHAN="fd:0,fd:1"
+CONFIG_CPU_SUP_AMD=y
+CONFIG_CPU_SUP_CENTAUR=y
+CONFIG_CPU_SUP_HYGON=y
+CONFIG_CPU_SUP_INTEL=y
+CONFIG_CPU_SUP_ZHAOXIN=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_CRC32=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=11
+CONFIG_CRYPTO_LIB_SHA1=y
+CONFIG_CRYPTO_LIB_UTILS=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_SHA1=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DECOMPRESS_BZIP2=y
+CONFIG_DECOMPRESS_GZIP=y
+CONFIG_DNOTIFY=y
+# CONFIG_EARLY_PRINTK is not set
+CONFIG_EXCLUSIVE_SYSTEM_RAM=y
+CONFIG_EXT4_FS=y
+CONFIG_F2FS_FS=y
+CONFIG_FAILOVER=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_FW_LOADER_SYSFS=y
+CONFIG_GCC11_NO_ARRAY_BOUNDS=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+# CONFIG_GENERIC_CPU is not set
+CONFIG_GENERIC_CPU_DEVICES=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GPIO_CDEV=y
+CONFIG_HOSTFS=y
+CONFIG_HVC_DRIVER=y
+CONFIG_HW_RANDOM=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_IA32_FEAT_CTL=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_INIT_ENV_ARG_LIMIT=128
+CONFIG_IRQ_WORK=y
+CONFIG_ISO9660_FS=y
+CONFIG_JBD2=y
+# CONFIG_JFFS2_FS is not set
+CONFIG_KALLSYMS=y
+CONFIG_KERNEL_STACK_ORDER=2
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+# CONFIG_MATOM is not set
+CONFIG_MAY_HAVE_RUNTIME_DEPS=y
+CONFIG_MCONSOLE=y
+# CONFIG_MCORE2 is not set
+CONFIG_MEMFD_CREATE=y
+CONFIG_MIGRATION=y
+CONFIG_MK8=y
+# CONFIG_MMAPPER is not set
+CONFIG_MODULES_USE_ELF_RELA=y
+# CONFIG_MPSC is not set
+CONFIG_NAMESPACES=y
+CONFIG_NEED_PER_CPU_KM=y
+CONFIG_NET_FAILOVER=y
+# CONFIG_NET_NS is not set
+CONFIG_NLS=y
+CONFIG_NO_DMA=y
+CONFIG_NO_IOMEM=y
+CONFIG_NO_IOPORT_MAP=y
+CONFIG_NR_CPUS=1
+CONFIG_NULL_CHAN=y
+# CONFIG_OF is not set
+CONFIG_PGTABLE_LEVELS=3
+CONFIG_PHYS_ADDR_T_64BIT=y
+CONFIG_PORT_CHAN=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+CONFIG_PREEMPT_NONE_BUILD=y
+# CONFIG_PROCESSOR_SELECT is not set
+CONFIG_PROC_PAGE_MONITOR=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_PTY_CHAN=y
+CONFIG_RANDSTRUCT_NONE=y
+CONFIG_RD_BZIP2=y
+CONFIG_RD_GZIP=y
+CONFIG_RELAY=y
+CONFIG_SG_POOL=y
+CONFIG_SOFT_WATCHDOG=m
+CONFIG_SRCU=y
+CONFIG_SSL=y
+CONFIG_SSL_CHAN="pty"
+CONFIG_STACKTRACE=y
+CONFIG_STDERR_CONSOLE=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TINY_SRCU=y
+CONFIG_TTY_CHAN=y
+CONFIG_UML=y
+CONFIG_UML_NET=y
+CONFIG_UML_NET_DAEMON=y
+CONFIG_UML_NET_DAEMON_DEFAULT_SOCK="/tmp/uml.ctl"
+CONFIG_UML_NET_DETERMINISTIC_MAC=y
+CONFIG_UML_NET_ETHERTAP=y
+CONFIG_UML_NET_MCAST=y
+# CONFIG_UML_NET_PCAP is not set
+CONFIG_UML_NET_SLIP=y
+CONFIG_UML_NET_SLIRP=y
+CONFIG_UML_NET_TUNTAP=y
+# CONFIG_UML_NET_VDE is not set
+CONFIG_UML_NET_VECTOR=y
+# CONFIG_UML_PCI_OVER_VIRTIO is not set
+CONFIG_UML_RANDOM=y
+# CONFIG_UML_SOUND is not set
+CONFIG_UML_TIME_TRAVEL_SUPPORT=y
+# CONFIG_UML_WATCHDOG is not set
+CONFIG_UML_X86=y
+# CONFIG_USER_NS is not set
+CONFIG_VIRTIO=y
+CONFIG_VIRTIO_ANCHOR=y
+CONFIG_VIRTIO_BLK=y
+CONFIG_VIRTIO_CONSOLE=y
+CONFIG_VIRTIO_NET=y
+CONFIG_VIRTIO_UML=y
+CONFIG_VMAP_STACK=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_X86_64=y
+CONFIG_X86_CMOV=y
+CONFIG_X86_CMPXCHG64=y
+CONFIG_X86_INTEL_USERCOPY=y
+CONFIG_X86_INTERNODE_CACHE_SHIFT=6
+CONFIG_X86_L1_CACHE_SHIFT=6
+CONFIG_X86_MINIMUM_CPU_FAMILY=64
+CONFIG_X86_TSC=y
+CONFIG_X86_USE_PPRO_CHECKSUM=y
+CONFIG_XTERM_CHAN=y
+CONFIG_XTERM_CHAN_DEFAULT_EMULATOR="xterm"
+CONFIG_ZLIB_INFLATE=y
diff --git a/target/linux/uml/patches-5.15/101-mconsole-exec.patch b/target/linux/uml/patches-5.15/101-mconsole-exec.patch
new file mode 100644
index 00000000000000..ceea41e013cf69
--- /dev/null
+++ b/target/linux/uml/patches-5.15/101-mconsole-exec.patch
@@ -0,0 +1,213 @@
+#
+# Minimalist mconsole exec patch 
+#
+# 3.10 version (with bit more synchronous behavior) by fingon at iki dot fi
+# Adaptation to kernel 3.3.8 made by David Fernández (david at dit.upm.es) for 
+# Starting point: mconsole-exec-2.6.30.patch for kernel 2.6.30
+# Author of original patch: Paolo Giarrusso, aka Blaisorblade 
+#                           (http://www.user-mode-linux.org/~blaisorblade)
+#
+# Known misfeatures:
+#
+# - If output is too long, blocks (and breaks horribly) 
+# (this misfeature from 3.10 patches, when minimalizing the patch;
+#  workaround: redirect to a shared filesystem if long output is expected)
+#
+# - Nothing useful is done with stdin
+#
+--- a/arch/um/drivers/mconsole.h
++++ b/arch/um/drivers/mconsole.h
+@@ -85,6 +85,7 @@ extern void mconsole_cad(struct mc_reque
+ extern void mconsole_stop(struct mc_request *req);
+ extern void mconsole_go(struct mc_request *req);
+ extern void mconsole_log(struct mc_request *req);
++extern void mconsole_exec(struct mc_request *req);
+ extern void mconsole_proc(struct mc_request *req);
+ extern void mconsole_stack(struct mc_request *req);
+ 
+--- a/arch/um/drivers/mconsole_kern.c
++++ b/arch/um/drivers/mconsole_kern.c
+@@ -4,6 +4,7 @@
+  * Copyright (C) 2001 - 2008 Jeff Dike (jdike@{addtoit,linux.intel}.com)
+  */
+ 
++#include <linux/kmod.h>
+ #include <linux/console.h>
+ #include <linux/ctype.h>
+ #include <linux/string.h>
+@@ -27,6 +28,7 @@
+ #include <linux/mount.h>
+ #include <linux/file.h>
+ #include <linux/uaccess.h>
++#include <linux/completion.h>
+ #include <asm/switch_to.h>
+ 
+ #include <init.h>
+@@ -124,6 +126,59 @@ void mconsole_log(struct mc_request *req
+ 	mconsole_reply(req, "", 0, 0);
+ }
+ 
++void mconsole_exec(struct mc_request *req)
++{
++  struct subprocess_info *sub_info;
++  int res, len;
++  struct file *out;
++  char buf[MCONSOLE_MAX_DATA];
++
++  char *envp[] = {
++    "HOME=/", "TERM=linux",
++    "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin",
++    NULL
++  };
++  char *argv[] = {
++    "/bin/sh", "-c",
++    req->request.data + strlen("exec "),
++    NULL
++  };
++
++  sub_info = call_usermodehelper_setup("/bin/sh", argv, envp, GFP_ATOMIC, NULL, NULL, NULL);
++  if (sub_info == NULL) {
++    mconsole_reply(req, "call_usermodehelper_setup failed", 1, 0);
++    return;
++  }
++  res = call_usermodehelper_stdoutpipe(sub_info, &out);
++  if (res < 0) {
++    kfree(sub_info);
++    mconsole_reply(req, "call_usermodehelper_stdoutpipe failed", 1, 0);
++    return;
++  }
++
++  res = call_usermodehelper_exec(sub_info, UMH_WAIT_PROC);
++  if (res < 0) {
++    kfree(sub_info);
++    mconsole_reply(req, "call_usermodehelper_exec failed", 1, 0);
++    return;
++  }
++
++  for (;;) {
++    len = out->f_op->read(out, buf, sizeof(buf), &out->f_pos);
++    if (len < 0) {
++      mconsole_reply(req, "reading output failed", 1, 0);
++      break;
++    }
++    if (len == 0)
++      break;
++    mconsole_reply_len(req, buf, len, 0, 1);
++  }
++  fput(out);
++
++  mconsole_reply_len(req, NULL, 0, 0, 0);
++}
++
++
+ void mconsole_proc(struct mc_request *req)
+ {
+ 	struct vfsmount *mnt = proc_mnt;
+@@ -190,6 +245,7 @@ void mconsole_proc(struct mc_request *re
+     stop - pause the UML; it will do nothing until it receives a 'go' \n\
+     go - continue the UML after a 'stop' \n\
+     log <string> - make UML enter <string> into the kernel log\n\
++    exec <string> - pass <string> to /bin/sh -c synchronously\n\
+     proc <file> - returns the contents of the UML's /proc/<file>\n\
+     stack <pid> - returns the stack of the specified pid\n\
+ "
+--- a/arch/um/drivers/mconsole_user.c
++++ b/arch/um/drivers/mconsole_user.c
+@@ -30,6 +30,7 @@ static struct mconsole_command commands[
+ 	{ "stop", mconsole_stop, MCONSOLE_PROC },
+ 	{ "go", mconsole_go, MCONSOLE_INTR },
+ 	{ "log", mconsole_log, MCONSOLE_INTR },
++	{ "exec", mconsole_exec, MCONSOLE_PROC },
+ 	{ "proc", mconsole_proc, MCONSOLE_PROC },
+ 	{ "stack", mconsole_stack, MCONSOLE_INTR },
+ };
+--- a/arch/um/os-Linux/file.c
++++ b/arch/um/os-Linux/file.c
+@@ -560,6 +560,8 @@ int os_create_unix_socket(const char *fi
+ 
+ 	addr.sun_family = AF_UNIX;
+ 
++	if (len > sizeof(addr.sun_path))
++		len = sizeof(addr.sun_path);
+ 	snprintf(addr.sun_path, len, "%s", file);
+ 
+ 	err = bind(sock, (struct sockaddr *) &addr, sizeof(addr));
+--- a/include/linux/kmod.h
++++ b/include/linux/kmod.h
+@@ -32,4 +32,6 @@ static inline int request_module_nowait(
+ #define try_then_request_module(x, mod...) (x)
+ #endif
+ 
++int call_usermodehelper_stdoutpipe(struct subprocess_info *sub_info, struct file **filp);
++
+ #endif /* __LINUX_KMOD_H__ */
+--- a/include/linux/umh.h
++++ b/include/linux/umh.h
+@@ -22,6 +22,7 @@ struct subprocess_info {
+ 	const char *path;
+ 	char **argv;
+ 	char **envp;
++	struct file *stdout;
+ 	int wait;
+ 	int retval;
+ 	int (*init)(struct subprocess_info *info, struct cred *new);
+--- a/kernel/umh.c
++++ b/kernel/umh.c
+@@ -28,6 +28,7 @@
+ #include <linux/async.h>
+ #include <linux/uaccess.h>
+ #include <linux/initrd.h>
++#include <linux/pipe_fs_i.h>
+ 
+ #include <trace/events/module.h>
+ 
+@@ -73,6 +74,28 @@ static int call_usermodehelper_exec_asyn
+ 	flush_signal_handlers(current, 1);
+ 	spin_unlock_irq(&current->sighand->siglock);
+ 
++	/* Install output when needed */
++	if (sub_info->stdout) {
++		struct files_struct *f = current->files;
++		struct fdtable *fdt;
++
++		sys_close(1);
++		sys_close(2);
++		get_file(sub_info->stdout);
++		fd_install(1, sub_info->stdout);
++		fd_install(2, sub_info->stdout);
++		spin_lock(&f->file_lock);
++		fdt = files_fdtable(f);
++		__set_bit(1, fdt->open_fds);
++		__clear_bit(1, fdt->close_on_exec);
++		__set_bit(2, fdt->open_fds);
++		__clear_bit(2, fdt->close_on_exec);
++		spin_unlock(&f->file_lock);
++
++		/* disallow core files */
++		current->signal->rlim[RLIMIT_CORE] = (struct rlimit){0, 0};
++	}
++
+ 	/*
+ 	 * Initial kernel threads share ther FS with init, in order to
+ 	 * get the init root directory. But we've now created a new
+@@ -332,6 +355,20 @@ static void helper_unlock(void)
+ 		wake_up(&running_helpers_waitq);
+ }
+ 
++int call_usermodehelper_stdoutpipe(struct subprocess_info *sub_info,
++					struct file **filp)
++{
++	struct file *f[2];
++
++	if (create_pipe_files(f, 0) < 0)
++		 return PTR_ERR(f);
++
++	sub_info->stdout = f[1];
++	*filp = f[0];
++	return 0;
++}
++EXPORT_SYMBOL(call_usermodehelper_stdoutpipe);
++
+ /**
+  * call_usermodehelper_setup - prepare to call a usermode helper
+  * @path: path to usermode executable
diff --git a/target/linux/uml/patches-5.15/102-pseudo-random-mac.patch b/target/linux/uml/patches-5.15/102-pseudo-random-mac.patch
new file mode 100644
index 00000000000000..045d2d0dbd9ae3
--- /dev/null
+++ b/target/linux/uml/patches-5.15/102-pseudo-random-mac.patch
@@ -0,0 +1,151 @@
+===============================================================================
+
+This patch makes MAC addresses of network interfaces predictable. In
+particular, it adds a small routine that computes MAC addresses of based on
+a SHA1 hash of the virtual machine name and interface ID.
+
+TECHNICAL INFORMATION:
+
+Applies to vanilla kernel 3.9.4.
+
+===============================================================================
+--- a/arch/um/drivers/Kconfig
++++ b/arch/um/drivers/Kconfig
+@@ -146,6 +146,20 @@ config UML_NET
+ 	  enable at least one of the following transport options to actually
+ 	  make use of UML networking.
+ 
++config UML_NET_DETERMINISTIC_MAC
++	bool "Use deterministic MAC addresses for network interfaces"
++	default y
++	depends on UML_NET
++	select CRYPTO_SHA1
++	help
++        Virtual network devices inside a User-Mode Linux instance must be
++        assigned a MAC (Ethernet) address. If none is specified on the UML
++        command line, one must be automatically computed. If this option is
++        enabled, a randomly generated address is used. Otherwise, if this
++        option is disabled, the address is generated from a SHA1 hash of
++        the umid of the UML instance and the interface name. The latter choice
++        is useful to make MAC addresses predictable.
++
+ config UML_NET_ETHERTAP
+ 	bool "Ethertap transport (obsolete)"
+ 	depends on UML_NET
+--- a/arch/um/drivers/net_kern.c
++++ b/arch/um/drivers/net_kern.c
+@@ -25,6 +25,14 @@
+ #include <net_kern.h>
+ #include <net_user.h>
+ 
++#include <crypto/sha1.h>
++#include <crypto/hash.h>
++#include <linux/string.h>
++#include <linux/crypto.h>
++#include <linux/err.h>
++#include <linux/scatterlist.h>
++#include "os.h"
++
+ #define DRIVER_NAME "uml-netdev"
+ 
+ static DEFINE_SPINLOCK(opened_lock);
+@@ -274,9 +282,55 @@ static const struct ethtool_ops uml_net_
+ 	.get_ts_info	= ethtool_op_get_ts_info,
+ };
+ 
++#ifdef CONFIG_UML_NET_DETERMINISTIC_MAC
++
++/* Compute a SHA1 hash of the UML instance's id and
++ *  * an interface name. */
++static int compute_hash(const char *umid, const char *ifname, char *hash)
++{
++	struct ahash_request *desc = NULL;
++	struct crypto_ahash *tfm = NULL;
++	struct scatterlist sg;
++	char *vmif = NULL;
++	int ret = -ENOMEM;
++
++	vmif = kmalloc(1024, GFP_KERNEL);
++	if (!vmif)
++		goto out;
++
++	strcpy (vmif, umid);
++	strcat (vmif, ifname);
++
++	tfm = crypto_alloc_ahash("sha1", 0, CRYPTO_ALG_ASYNC);
++	if (IS_ERR(tfm))
++		goto out;
++
++	desc = ahash_request_alloc(tfm, GFP_KERNEL);
++	if (!desc)
++		goto out;
++
++	crypto_ahash_clear_flags(tfm, ~0);
++
++	sg_init_table(&sg, 1);
++	sg_set_buf(&sg, vmif, strlen(vmif));
++
++	ahash_request_set_crypt(desc, &sg, hash, strlen(vmif));
++
++	ret = crypto_ahash_digest(desc);
++out:
++	crypto_free_ahash(tfm);
++	ahash_request_free(desc);
++	kfree(vmif);
++
++	return ret;
++}
++
++#endif
++
+ void uml_net_setup_etheraddr(struct net_device *dev, char *str)
+ {
+ 	unsigned char *addr = dev->dev_addr;
++	u8 hash[SHA1_DIGEST_SIZE];
+ 	char *end;
+ 	int i;
+ 
+@@ -319,9 +373,26 @@ void uml_net_setup_etheraddr(struct net_
+ 	return;
+ 
+ random:
++#ifndef CONFIG_UML_NET_DETERMINISTIC_MAC
+ 	printk(KERN_INFO
+ 	       "Choosing a random ethernet address for device %s\n", dev->name);
+ 	eth_hw_addr_random(dev);
++#else
++	printk(KERN_INFO
++	       "Computing a digest to use as ethernet address for device %s\n", dev->name);
++	if (compute_hash(get_umid(), dev->name, hash) < 0) {
++		printk(KERN_WARNING
++		       "Could not compute digest to use as ethernet address for device %s. "
++		       "Using random address instead.\n", dev->name);
++		random_ether_addr(addr);
++	}
++	else {
++		for (i=0; i < 6; i++)
++			addr[i] = (hash[i] + hash[i+6]) % 0x100;
++	}
++	addr [0] &= 0xfe; /* clear multicast bit */
++	addr [0] |= 0x02; /* set local assignment bit (IEEE802) */
++#endif
+ }
+ 
+ static DEFINE_SPINLOCK(devices_lock);
+--- a/kernel/umh.c
++++ b/kernel/umh.c
+@@ -356,12 +356,12 @@ static void helper_unlock(void)
+ }
+ 
+ int call_usermodehelper_stdoutpipe(struct subprocess_info *sub_info,
+-					struct file **filp)
++				   struct file **filp)
+ {
+ 	struct file *f[2];
+ 
+ 	if (create_pipe_files(f, 0) < 0)
+-		 return PTR_ERR(f);
++		return PTR_ERR(f);
+ 
+ 	sub_info->stdout = f[1];
+ 	*filp = f[0];
diff --git a/target/linux/uml/patches-5.15/104-um-increase-default-virtual-physical-memory-to-64.patch b/target/linux/uml/patches-5.15/104-um-increase-default-virtual-physical-memory-to-64.patch
new file mode 100644
index 00000000000000..3a67a7dbd07015
--- /dev/null
+++ b/target/linux/uml/patches-5.15/104-um-increase-default-virtual-physical-memory-to-64.patch
@@ -0,0 +1,40 @@
+From d7936f11aded13f03871c0d6502d611d6a1e2dc5 Mon Sep 17 00:00:00 2001
+Message-Id: <d7936f11aded13f03871c0d6502d611d6a1e2dc5.1659815468.git.chunkeey@gmail.com>
+In-Reply-To: <53b5c5f559cc95fc676cb4cc9e5a8d9f0cb8f58c.1659815468.git.chunkeey@gmail.com>
+References: <53b5c5f559cc95fc676cb4cc9e5a8d9f0cb8f58c.1659815468.git.chunkeey@gmail.com>
+From: Christian Lamparter <chunkeey@gmail.com>
+Date: Sat, 6 Aug 2022 19:27:20 +0200
+Subject: [PATCH v1 2/2] um: increase default virtual physical memory to 64 MiB
+To: linux-um@lists.infradead.org
+Cc: Richard Weinberger <richard@nod.at>,
+    Anton Ivanov <anton.ivanov@cambridgegreys.com>,
+    Johannes Berg <johannes@sipsolutions.net>
+
+The current 32 MiB of RAM causes OOMs to appear shortly after
+booting in a minimal OpenWrt 22.03 configuration with a
+5.10.134 kernel.
+
+Of course, passing a "mem=64M" (from the --help text) parameter
+works too, but it produces the following (info) message:
+
+| [    0.000000] Unknown kernel command line parameters "mem=64M", will be passed to user space.
+
+That's why, I think it would be nicer, if this is working out
+of the box again :).
+
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+---
+ arch/um/kernel/um_arch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/um/kernel/um_arch.c
++++ b/arch/um/kernel/um_arch.c
+@@ -130,7 +130,7 @@ static int have_root __initdata;
+ static int have_console __initdata;
+ 
+ /* Set in uml_mem_setup and modified in linux_main */
+-long long physmem_size = 32 * 1024 * 1024;
++long long physmem_size = 64 * 1024 * 1024;
+ EXPORT_SYMBOL(physmem_size);
+ 
+ static const char *usage_string =
diff --git a/target/linux/uml/patches-6.1/101-mconsole-exec.patch b/target/linux/uml/patches-6.1/101-mconsole-exec.patch
new file mode 100644
index 00000000000000..2ff9701eb9d494
--- /dev/null
+++ b/target/linux/uml/patches-6.1/101-mconsole-exec.patch
@@ -0,0 +1,213 @@
+#
+# Minimalist mconsole exec patch 
+#
+# 3.10 version (with bit more synchronous behavior) by fingon at iki dot fi
+# Adaptation to kernel 3.3.8 made by David Fernández (david at dit.upm.es) for 
+# Starting point: mconsole-exec-2.6.30.patch for kernel 2.6.30
+# Author of original patch: Paolo Giarrusso, aka Blaisorblade 
+#                           (http://www.user-mode-linux.org/~blaisorblade)
+#
+# Known misfeatures:
+#
+# - If output is too long, blocks (and breaks horribly) 
+# (this misfeature from 3.10 patches, when minimalizing the patch;
+#  workaround: redirect to a shared filesystem if long output is expected)
+#
+# - Nothing useful is done with stdin
+#
+--- a/arch/um/drivers/mconsole.h
++++ b/arch/um/drivers/mconsole.h
+@@ -85,6 +85,7 @@ extern void mconsole_cad(struct mc_reque
+ extern void mconsole_stop(struct mc_request *req);
+ extern void mconsole_go(struct mc_request *req);
+ extern void mconsole_log(struct mc_request *req);
++extern void mconsole_exec(struct mc_request *req);
+ extern void mconsole_proc(struct mc_request *req);
+ extern void mconsole_stack(struct mc_request *req);
+ 
+--- a/arch/um/drivers/mconsole_kern.c
++++ b/arch/um/drivers/mconsole_kern.c
+@@ -4,6 +4,7 @@
+  * Copyright (C) 2001 - 2008 Jeff Dike (jdike@{addtoit,linux.intel}.com)
+  */
+ 
++#include <linux/kmod.h>
+ #include <linux/console.h>
+ #include <linux/ctype.h>
+ #include <linux/string.h>
+@@ -27,6 +28,7 @@
+ #include <linux/mount.h>
+ #include <linux/file.h>
+ #include <linux/uaccess.h>
++#include <linux/completion.h>
+ #include <asm/switch_to.h>
+ 
+ #include <init.h>
+@@ -124,6 +126,59 @@ void mconsole_log(struct mc_request *req
+ 	mconsole_reply(req, "", 0, 0);
+ }
+ 
++void mconsole_exec(struct mc_request *req)
++{
++  struct subprocess_info *sub_info;
++  int res, len;
++  struct file *out;
++  char buf[MCONSOLE_MAX_DATA];
++
++  char *envp[] = {
++    "HOME=/", "TERM=linux",
++    "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin",
++    NULL
++  };
++  char *argv[] = {
++    "/bin/sh", "-c",
++    req->request.data + strlen("exec "),
++    NULL
++  };
++
++  sub_info = call_usermodehelper_setup("/bin/sh", argv, envp, GFP_ATOMIC, NULL, NULL, NULL);
++  if (sub_info == NULL) {
++    mconsole_reply(req, "call_usermodehelper_setup failed", 1, 0);
++    return;
++  }
++  res = call_usermodehelper_stdoutpipe(sub_info, &out);
++  if (res < 0) {
++    kfree(sub_info);
++    mconsole_reply(req, "call_usermodehelper_stdoutpipe failed", 1, 0);
++    return;
++  }
++
++  res = call_usermodehelper_exec(sub_info, UMH_WAIT_PROC);
++  if (res < 0) {
++    kfree(sub_info);
++    mconsole_reply(req, "call_usermodehelper_exec failed", 1, 0);
++    return;
++  }
++
++  for (;;) {
++    len = out->f_op->read(out, buf, sizeof(buf), &out->f_pos);
++    if (len < 0) {
++      mconsole_reply(req, "reading output failed", 1, 0);
++      break;
++    }
++    if (len == 0)
++      break;
++    mconsole_reply_len(req, buf, len, 0, 1);
++  }
++  fput(out);
++
++  mconsole_reply_len(req, NULL, 0, 0, 0);
++}
++
++
+ void mconsole_proc(struct mc_request *req)
+ {
+ 	struct vfsmount *mnt = proc_mnt;
+@@ -190,6 +245,7 @@ void mconsole_proc(struct mc_request *re
+     stop - pause the UML; it will do nothing until it receives a 'go' \n\
+     go - continue the UML after a 'stop' \n\
+     log <string> - make UML enter <string> into the kernel log\n\
++    exec <string> - pass <string> to /bin/sh -c synchronously\n\
+     proc <file> - returns the contents of the UML's /proc/<file>\n\
+     stack <pid> - returns the stack of the specified pid\n\
+ "
+--- a/arch/um/drivers/mconsole_user.c
++++ b/arch/um/drivers/mconsole_user.c
+@@ -30,6 +30,7 @@ static struct mconsole_command commands[
+ 	{ "stop", mconsole_stop, MCONSOLE_PROC },
+ 	{ "go", mconsole_go, MCONSOLE_INTR },
+ 	{ "log", mconsole_log, MCONSOLE_INTR },
++	{ "exec", mconsole_exec, MCONSOLE_PROC },
+ 	{ "proc", mconsole_proc, MCONSOLE_PROC },
+ 	{ "stack", mconsole_stack, MCONSOLE_INTR },
+ };
+--- a/arch/um/os-Linux/file.c
++++ b/arch/um/os-Linux/file.c
+@@ -560,6 +560,8 @@ int os_create_unix_socket(const char *fi
+ 
+ 	addr.sun_family = AF_UNIX;
+ 
++	if (len > sizeof(addr.sun_path))
++		len = sizeof(addr.sun_path);
+ 	snprintf(addr.sun_path, len, "%s", file);
+ 
+ 	err = bind(sock, (struct sockaddr *) &addr, sizeof(addr));
+--- a/include/linux/kmod.h
++++ b/include/linux/kmod.h
+@@ -32,4 +32,6 @@ static inline int request_module_nowait(
+ #define try_then_request_module(x, mod...) (x)
+ #endif
+ 
++int call_usermodehelper_stdoutpipe(struct subprocess_info *sub_info, struct file **filp);
++
+ #endif /* __LINUX_KMOD_H__ */
+--- a/include/linux/umh.h
++++ b/include/linux/umh.h
+@@ -23,6 +23,7 @@ struct subprocess_info {
+ 	const char *path;
+ 	char **argv;
+ 	char **envp;
++	struct file *stdout;
+ 	int wait;
+ 	int retval;
+ 	int (*init)(struct subprocess_info *info, struct cred *new);
+--- a/kernel/umh.c
++++ b/kernel/umh.c
+@@ -29,6 +29,7 @@
+ #include <linux/uaccess.h>
+ #include <linux/initrd.h>
+ #include <linux/freezer.h>
++#include <linux/pipe_fs_i.h>
+ 
+ #include <trace/events/module.h>
+ 
+@@ -74,6 +75,28 @@ static int call_usermodehelper_exec_asyn
+ 	flush_signal_handlers(current, 1);
+ 	spin_unlock_irq(&current->sighand->siglock);
+ 
++	/* Install output when needed */
++	if (sub_info->stdout) {
++		struct files_struct *f = current->files;
++		struct fdtable *fdt;
++
++		sys_close(1);
++		sys_close(2);
++		get_file(sub_info->stdout);
++		fd_install(1, sub_info->stdout);
++		fd_install(2, sub_info->stdout);
++		spin_lock(&f->file_lock);
++		fdt = files_fdtable(f);
++		__set_bit(1, fdt->open_fds);
++		__clear_bit(1, fdt->close_on_exec);
++		__set_bit(2, fdt->open_fds);
++		__clear_bit(2, fdt->close_on_exec);
++		spin_unlock(&f->file_lock);
++
++		/* disallow core files */
++		current->signal->rlim[RLIMIT_CORE] = (struct rlimit){0, 0};
++	}
++
+ 	/*
+ 	 * Initial kernel threads share ther FS with init, in order to
+ 	 * get the init root directory. But we've now created a new
+@@ -333,6 +356,20 @@ static void helper_unlock(void)
+ 		wake_up(&running_helpers_waitq);
+ }
+ 
++int call_usermodehelper_stdoutpipe(struct subprocess_info *sub_info,
++					struct file **filp)
++{
++	struct file *f[2];
++
++	if (create_pipe_files(f, 0) < 0)
++		 return PTR_ERR(f);
++
++	sub_info->stdout = f[1];
++	*filp = f[0];
++	return 0;
++}
++EXPORT_SYMBOL(call_usermodehelper_stdoutpipe);
++
+ /**
+  * call_usermodehelper_setup - prepare to call a usermode helper
+  * @path: path to usermode executable
diff --git a/target/linux/uml/patches-6.1/102-pseudo-random-mac.patch b/target/linux/uml/patches-6.1/102-pseudo-random-mac.patch
new file mode 100644
index 00000000000000..a752e1d2779da4
--- /dev/null
+++ b/target/linux/uml/patches-6.1/102-pseudo-random-mac.patch
@@ -0,0 +1,151 @@
+===============================================================================
+
+This patch makes MAC addresses of network interfaces predictable. In
+particular, it adds a small routine that computes MAC addresses of based on
+a SHA1 hash of the virtual machine name and interface ID.
+
+TECHNICAL INFORMATION:
+
+Applies to vanilla kernel 3.9.4.
+
+===============================================================================
+--- a/arch/um/drivers/Kconfig
++++ b/arch/um/drivers/Kconfig
+@@ -153,6 +153,20 @@ config UML_NET
+ 	  enable at least one of the following transport options to actually
+ 	  make use of UML networking.
+ 
++config UML_NET_DETERMINISTIC_MAC
++	bool "Use deterministic MAC addresses for network interfaces"
++	default y
++	depends on UML_NET
++	select CRYPTO_SHA1
++	help
++        Virtual network devices inside a User-Mode Linux instance must be
++        assigned a MAC (Ethernet) address. If none is specified on the UML
++        command line, one must be automatically computed. If this option is
++        enabled, a randomly generated address is used. Otherwise, if this
++        option is disabled, the address is generated from a SHA1 hash of
++        the umid of the UML instance and the interface name. The latter choice
++        is useful to make MAC addresses predictable.
++
+ config UML_NET_ETHERTAP
+ 	bool "Ethertap transport (obsolete)"
+ 	depends on UML_NET
+--- a/arch/um/drivers/net_kern.c
++++ b/arch/um/drivers/net_kern.c
+@@ -25,6 +25,14 @@
+ #include <net_kern.h>
+ #include <net_user.h>
+ 
++#include <crypto/sha1.h>
++#include <crypto/hash.h>
++#include <linux/string.h>
++#include <linux/crypto.h>
++#include <linux/err.h>
++#include <linux/scatterlist.h>
++#include "os.h"
++
+ #define DRIVER_NAME "uml-netdev"
+ 
+ static DEFINE_SPINLOCK(opened_lock);
+@@ -274,9 +282,55 @@ static const struct ethtool_ops uml_net_
+ 	.get_ts_info	= ethtool_op_get_ts_info,
+ };
+ 
++#ifdef CONFIG_UML_NET_DETERMINISTIC_MAC
++
++/* Compute a SHA1 hash of the UML instance's id and
++ *  * an interface name. */
++static int compute_hash(const char *umid, const char *ifname, char *hash)
++{
++	struct ahash_request *desc = NULL;
++	struct crypto_ahash *tfm = NULL;
++	struct scatterlist sg;
++	char *vmif = NULL;
++	int ret = -ENOMEM;
++
++	vmif = kmalloc(1024, GFP_KERNEL);
++	if (!vmif)
++		goto out;
++
++	strcpy (vmif, umid);
++	strcat (vmif, ifname);
++
++	tfm = crypto_alloc_ahash("sha1", 0, CRYPTO_ALG_ASYNC);
++	if (IS_ERR(tfm))
++		goto out;
++
++	desc = ahash_request_alloc(tfm, GFP_KERNEL);
++	if (!desc)
++		goto out;
++
++	crypto_ahash_clear_flags(tfm, ~0);
++
++	sg_init_table(&sg, 1);
++	sg_set_buf(&sg, vmif, strlen(vmif));
++
++	ahash_request_set_crypt(desc, &sg, hash, strlen(vmif));
++
++	ret = crypto_ahash_digest(desc);
++out:
++	crypto_free_ahash(tfm);
++	ahash_request_free(desc);
++	kfree(vmif);
++
++	return ret;
++}
++
++#endif
++
+ void uml_net_setup_etheraddr(struct net_device *dev, char *str)
+ {
+ 	u8 addr[ETH_ALEN];
++	u8 hash[SHA1_DIGEST_SIZE];
+ 	char *end;
+ 	int i;
+ 
+@@ -320,9 +374,26 @@ void uml_net_setup_etheraddr(struct net_
+ 	return;
+ 
+ random:
++#ifndef CONFIG_UML_NET_DETERMINISTIC_MAC
+ 	printk(KERN_INFO
+ 	       "Choosing a random ethernet address for device %s\n", dev->name);
+ 	eth_hw_addr_random(dev);
++#else
++	printk(KERN_INFO
++	       "Computing a digest to use as ethernet address for device %s\n", dev->name);
++	if (compute_hash(get_umid(), dev->name, hash) < 0) {
++		printk(KERN_WARNING
++		       "Could not compute digest to use as ethernet address for device %s. "
++		       "Using random address instead.\n", dev->name);
++		eth_random_addr(addr);
++	}
++	else {
++		for (i=0; i < 6; i++)
++			addr[i] = (hash[i] + hash[i+6]) % 0x100;
++	}
++	addr [0] &= 0xfe; /* clear multicast bit */
++	addr [0] |= 0x02; /* set local assignment bit (IEEE802) */
++#endif
+ }
+ 
+ static DEFINE_SPINLOCK(devices_lock);
+--- a/kernel/umh.c
++++ b/kernel/umh.c
+@@ -357,12 +357,12 @@ static void helper_unlock(void)
+ }
+ 
+ int call_usermodehelper_stdoutpipe(struct subprocess_info *sub_info,
+-					struct file **filp)
++				   struct file **filp)
+ {
+ 	struct file *f[2];
+ 
+ 	if (create_pipe_files(f, 0) < 0)
+-		 return PTR_ERR(f);
++		return PTR_ERR(f);
+ 
+ 	sub_info->stdout = f[1];
+ 	*filp = f[0];
diff --git a/target/linux/x86/64/config-5.15 b/target/linux/x86/64/config-5.15
index ec9a73c9e2ecab..d972668e543fbc 100644
--- a/target/linux/x86/64/config-5.15
+++ b/target/linux/x86/64/config-5.15
@@ -41,6 +41,8 @@ CONFIG_AGP=y
 CONFIG_AGP_INTEL=y
 # CONFIG_AGP_SIS is not set
 # CONFIG_AGP_VIA is not set
+CONFIG_AMD_IOMMU=y
+CONFIG_AMD_IOMMU_V2=y
 # CONFIG_AMD_PMC is not set
 # CONFIG_AMD_PTDMA is not set
 # CONFIG_AMD_SFH_HID is not set
@@ -148,7 +150,6 @@ CONFIG_DRM_TTM=y
 CONFIG_DRM_TTM_HELPER=y
 CONFIG_DRM_VIRTIO_GPU=y
 CONFIG_DRM_VRAM_HELPER=y
-# CONFIG_DRM_XEN_FRONTEND is not set
 CONFIG_EFI=y
 CONFIG_EFIVAR_FS=m
 # CONFIG_EFI_BOOTLOADER_CONTROL is not set
@@ -234,6 +235,7 @@ CONFIG_HW_RANDOM_VIRTIO=y
 CONFIG_HYPERV=y
 CONFIG_HYPERVISOR_GUEST=y
 CONFIG_HYPERV_BALLOON=y
+CONFIG_HYPERV_IOMMU=y
 CONFIG_HYPERV_KEYBOARD=y
 CONFIG_HYPERV_NET=y
 CONFIG_HYPERV_STORAGE=y
@@ -254,7 +256,11 @@ CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
 CONFIG_INPUT_XEN_KBDDEV_FRONTEND=y
 CONFIG_INTEL_GTT=y
 CONFIG_INTEL_IDLE=y
-# CONFIG_INTEL_IDXD_COMPAT is not set
+CONFIG_INTEL_IOMMU=y
+# CONFIG_INTEL_IOMMU_DEFAULT_ON is not set
+CONFIG_INTEL_IOMMU_FLOPPY_WA=y
+# CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON is not set
+# CONFIG_INTEL_IOMMU_SVM is not set
 # CONFIG_INTEL_IPS is not set
 # CONFIG_INTEL_MEI_HDCP is not set
 # CONFIG_INTEL_MENLOW is not set
@@ -265,12 +271,22 @@ CONFIG_INTEL_SOC_DTS_IOSF_CORE=y
 CONFIG_INTEL_SOC_DTS_THERMAL=y
 # CONFIG_INTEL_SPEED_SELECT_INTERFACE is not set
 # CONFIG_INTEL_TURBO_MAX_3 is not set
+# CONFIG_INTEL_TXT is not set
 # CONFIG_INTEL_UNCORE_FREQ_CONTROL is not set
 CONFIG_INTERVAL_TREE=y
+CONFIG_IOASID=y
+CONFIG_IOMMU_API=y
 # CONFIG_IOMMU_DEBUG is not set
+# CONFIG_IOMMU_DEBUGFS is not set
+CONFIG_IOMMU_DEFAULT_DMA_LAZY=y
+CONFIG_IOMMU_DMA=y
 CONFIG_IOMMU_HELPER=y
+CONFIG_IOMMU_IOVA=y
+CONFIG_IOMMU_SUPPORT=y
 CONFIG_IOSF_MBI=y
 # CONFIG_IOSF_MBI_DEBUG is not set
+CONFIG_IRQ_MSI_IOMMU=y
+CONFIG_IRQ_REMAP=y
 # CONFIG_ISCSI_IBFT is not set
 CONFIG_ISO9660_FS=y
 CONFIG_KALLSYMS_ABSOLUTE_PERCPU=y
@@ -350,21 +366,22 @@ CONFIG_PGTABLE_LEVELS=4
 CONFIG_PHYSICAL_ALIGN=0x1000000
 CONFIG_PHYS_ADDR_T_64BIT=y
 CONFIG_PINCTRL=y
-# CONFIG_PINCTRL_ALDERLAKE is not set
-# CONFIG_PINCTRL_BAYTRAIL is not set
-# CONFIG_PINCTRL_BROXTON is not set
-# CONFIG_PINCTRL_CANNONLAKE is not set
-# CONFIG_PINCTRL_CHERRYVIEW is not set
-# CONFIG_PINCTRL_DENVERTON is not set
-# CONFIG_PINCTRL_ELKHARTLAKE is not set
-# CONFIG_PINCTRL_EMMITSBURG is not set
-# CONFIG_PINCTRL_GEMINILAKE is not set
-# CONFIG_PINCTRL_JASPERLAKE is not set
-# CONFIG_PINCTRL_LAKEFIELD is not set
-# CONFIG_PINCTRL_LEWISBURG is not set
-# CONFIG_PINCTRL_LYNXPOINT is not set
-# CONFIG_PINCTRL_SUNRISEPOINT is not set
-# CONFIG_PINCTRL_TIGERLAKE is not set
+CONFIG_PINCTRL_ALDERLAKE=y
+CONFIG_PINCTRL_BAYTRAIL=y
+CONFIG_PINCTRL_BROXTON=y
+CONFIG_PINCTRL_CANNONLAKE=y
+CONFIG_PINCTRL_CHERRYVIEW=y
+CONFIG_PINCTRL_DENVERTON=y
+CONFIG_PINCTRL_ELKHARTLAKE=y
+CONFIG_PINCTRL_EMMITSBURG=y
+CONFIG_PINCTRL_GEMINILAKE=y
+CONFIG_PINCTRL_INTEL=y
+CONFIG_PINCTRL_JASPERLAKE=y
+CONFIG_PINCTRL_LAKEFIELD=y
+CONFIG_PINCTRL_LEWISBURG=y
+CONFIG_PINCTRL_LYNXPOINT=y
+CONFIG_PINCTRL_SUNRISEPOINT=y
+CONFIG_PINCTRL_TIGERLAKE=y
 CONFIG_PM=y
 # CONFIG_PMIC_OPREGION is not set
 CONFIG_PM_CLK=y
@@ -422,6 +439,7 @@ CONFIG_THERMAL_WRITABLE_TRIPS=y
 # CONFIG_TOSHIBA_BT_RFKILL is not set
 CONFIG_TREE_RCU=y
 CONFIG_TREE_SRCU=y
+# CONFIG_UACCE is not set
 # CONFIG_UCLAMP_TASK is not set
 CONFIG_UCS2_STRING=y
 # CONFIG_UNWINDER_ORC is not set
diff --git a/target/linux/x86/Makefile b/target/linux/x86/Makefile
index 880ac73df8c669..5368a779e54f88 100644
--- a/target/linux/x86/Makefile
+++ b/target/linux/x86/Makefile
@@ -10,14 +10,16 @@ BOARDNAME:=x86
 FEATURES:=squashfs ext4 vdi vmdk vhdx pcmcia targz fpu boot-part rootfs-part
 SUBTARGETS:=generic legacy geode 64
 
-KERNEL_PATCHVER:=5.10
-KERNEL_TESTING_PATCHVER:=5.15
+KERNEL_PATCHVER:=5.15
 
 KERNELNAME:=bzImage
 
 include $(INCLUDE_DIR)/target.mk
 
-DEFAULT_PACKAGES += partx-utils mkf2fs e2fsprogs kmod-button-hotplug
+DEFAULT_PACKAGES += \
+	partx-utils mkf2fs \
+	e2fsprogs kmod-button-hotplug \
+	grub2-bios-setup
 
 $(eval $(call BuildTarget))
 
diff --git a/target/linux/x86/base-files/etc/board.d/01_leds b/target/linux/x86/base-files/etc/board.d/01_leds
index 74ad2d59fe135e..efc5460df3ce86 100644
--- a/target/linux/x86/base-files/etc/board.d/01_leds
+++ b/target/linux/x86/base-files/etc/board.d/01_leds
@@ -11,11 +11,18 @@ cisco-mx100-hw)
 	ucidef_set_led_usbport "usb" "USB" "mx100:green:usb" "1-1-port2"
 	ucidef_set_led_default "diag" "DIAG" "mx100:green:tricolor" "1"
 	;;
-pc-engines-apu1|pc-engines-apu2|pc-engines-apu3)
+pc-engines-apu1|pc-engines-apu2|pc-engines-apu3|pc-engines-apu4|pc-engines-apu5|pc-engines-apu6)
 	ucidef_set_led_netdev "wan" "WAN" "apu:green:3" "eth0"
 	ucidef_set_led_netdev "lan" "LAN" "apu:green:2" "br-lan"
 	ucidef_set_led_default "diag" "DIAG" "apu:green:1" "1"
 	;;
+sophos-sg-105wr1|sophos-sg-125wr1|sophos-sg-135wr1|sophos-xg-105wr1|sophos-xg-125wr1|sophos-xg-135wr1)
+	ucidef_set_led_netdev "wlan" "WiFi" "ath9k-phy0" "phy0tpt"
+	;;
+sophos-sg-105wr2|sophos-sg-125wr2|sophos-sg-135wr2|sophos-xg-105wr2|sophos-xg-125wr2|sophos-xg-135wr2|\
+sophos-sg-105wr3|sophos-sg-125wr3|sophos-sg-135wr3|sophos-xg-105wr3|sophos-xg-125wr3|sophos-xg-135wr3)
+	ucidef_set_led_netdev "wlan" "WiFi" "ath10k-phy0" "phy0tpt"
+	;;
 traverse-technologies-geos)
 	ucidef_set_led_netdev "lan" "LAN" "geos:1" "br-lan" "tx rx"
 	ucidef_set_led_netdev "wlan" "WiFi" "geos:2" "phy0tpt"
diff --git a/target/linux/x86/base-files/etc/board.d/02_network b/target/linux/x86/base-files/etc/board.d/02_network
index 9335e297ba22bb..e00e8c04dd25c2 100644
--- a/target/linux/x86/base-files/etc/board.d/02_network
+++ b/target/linux/x86/base-files/etc/board.d/02_network
@@ -8,6 +8,14 @@
 board_config_update
 
 case "$(board_name)" in
+barracuda-networks-inc-barracuda-ng-firewall-f12)
+	ucidef_set_network_device_path "eth1" "pci0000:00/0000:00:14.0/0000:01:00.0"
+	ucidef_set_network_device_path "eth2" "pci0000:00/0000:00:14.1/0000:02:00.0"
+	ucidef_set_network_device_path "eth3" "pci0000:00/0000:00:13.0/0000:03:00.0"
+	ucidef_set_network_device_path "eth4" "pci0000:00/0000:00:13.1/0000:04:00.0"
+	ucidef_set_network_device_path "eth5" "pci0000:00/0000:00:13.2/0000:05:00.0"
+	ucidef_set_interfaces_lan_wan "eth2 eth3 eth4 eth5" "eth1"
+	;;
 cisco-mx100-hw)
 	ucidef_set_network_device_path "mgmt" "pci0000:00/0000:00:01.2/0000:03:00.3"
 	ucidef_set_network_device_path "wan" "pci0000:00/0000:00:01.2/0000:03:00.2"
@@ -26,6 +34,12 @@ cisco-mx100-hw)
 pc-engines-apu1|pc-engines-apu2|pc-engines-apu3)
 	ucidef_set_interfaces_lan_wan "eth1 eth2" "eth0"
 	;;
+pc-engines-apu5)
+	ucidef_set_interfaces_lan_wan "eth1" "eth0"
+	;;
+pc-engines-apu4|pc-engines-apu6)
+	ucidef_set_interfaces_lan_wan "eth1 eth2 eth3" "eth0"
+	;;
 roqos-roqos-core-rc10)
 	ucidef_set_interfaces_lan_wan "eth1" "eth0"
 	;;
@@ -50,6 +64,10 @@ sophos-sg-135r2|sophos-xg-135r2| \
 sophos-sg-135wr2|sophos-xg-135wr2)
 	ucidef_set_interfaces_lan_wan "eth0 eth2 eth3 eth4 eth5 eth6 eth7" "eth1"
 	;;
+sophos-sg-135r3|sophos-xg-135r3| \
+sophos-sg-135wr3|sophos-xg-135wr3)
+	ucidef_set_interfaces_lan_wan "eth0 eth1 eth2 eth3 eth5 eth7 eth8" "eth6"
+	;;
 traverse-technologies-geos)
 	ucidef_set_interface_lan "eth0 eth1"
 	ucidef_add_atm_bridge "0" "35" "llc" "bridged"
diff --git a/target/linux/x86/base-files/lib/upgrade/platform.sh b/target/linux/x86/base-files/lib/upgrade/platform.sh
index d8f2eba97ecbab..5dad7a538a597b 100644
--- a/target/linux/x86/base-files/lib/upgrade/platform.sh
+++ b/target/linux/x86/base-files/lib/upgrade/platform.sh
@@ -62,8 +62,7 @@ platform_do_bootloader_upgrade() {
 			-m "/tmp/device.map" \
 			-d "/tmp/boot/boot/grub" \
 			-r "hd0,${parttable}1" \
-			"/dev/$diskdev" \
-		&& touch /tmp/boot/boot/grub/upgraded
+			"/dev/$diskdev"
 
 		umount /tmp/boot
 	fi
diff --git a/target/linux/x86/config-5.15 b/target/linux/x86/config-5.15
index fba8dbac2928d2..aebe4f08c4a389 100644
--- a/target/linux/x86/config-5.15
+++ b/target/linux/x86/config-5.15
@@ -183,7 +183,6 @@ CONFIG_IO_DELAY_0X80=y
 # CONFIG_IO_DELAY_0XED is not set
 # CONFIG_IO_DELAY_NONE is not set
 # CONFIG_IO_DELAY_UDELAY is not set
-CONFIG_IO_URING=y
 CONFIG_IRQ_DOMAIN=y
 CONFIG_IRQ_DOMAIN_HIERARCHY=y
 CONFIG_IRQ_FORCED_THREADING=y
@@ -221,7 +220,7 @@ CONFIG_MEMFD_CREATE=y
 CONFIG_MICROCODE=y
 CONFIG_MICROCODE_AMD=y
 CONFIG_MICROCODE_INTEL=y
-CONFIG_MICROCODE_OLD_INTERFACE=y
+CONFIG_MICROCODE_LATE_LOADING=y
 CONFIG_MIGRATION=y
 # CONFIG_MK6 is not set
 # CONFIG_MK7 is not set
@@ -416,6 +415,7 @@ CONFIG_X86_MSR=y
 CONFIG_X86_PAT=y
 CONFIG_X86_PLATFORM_DEVICES=y
 # CONFIG_X86_PLATFORM_DRIVERS_DELL is not set
+# CONFIG_X86_PLATFORM_DRIVERS_HP is not set
 # CONFIG_X86_POWERNOW_K6 is not set
 # CONFIG_X86_POWERNOW_K7 is not set
 # CONFIG_X86_REBOOTFIXUPS is not set
diff --git a/target/linux/x86/generic/config-5.15 b/target/linux/x86/generic/config-5.15
index 91e6c1b4d89b4a..1da6ad555dae0d 100644
--- a/target/linux/x86/generic/config-5.15
+++ b/target/linux/x86/generic/config-5.15
@@ -106,7 +106,6 @@ CONFIG_DRM_TTM=y
 CONFIG_DRM_TTM_HELPER=y
 CONFIG_DRM_VIRTIO_GPU=y
 CONFIG_DRM_VRAM_HELPER=y
-# CONFIG_DRM_XEN_FRONTEND is not set
 CONFIG_EFI=y
 CONFIG_EFIVAR_FS=m
 # CONFIG_EFI_BOOTLOADER_CONTROL is not set
@@ -318,22 +317,22 @@ CONFIG_PCI_XEN=y
 CONFIG_PGTABLE_LEVELS=3
 CONFIG_PHYS_ADDR_T_64BIT=y
 CONFIG_PINCTRL=y
-# CONFIG_PINCTRL_ALDERLAKE is not set
+CONFIG_PINCTRL_ALDERLAKE=y
 CONFIG_PINCTRL_BAYTRAIL=y
 CONFIG_PINCTRL_BROXTON=y
 CONFIG_PINCTRL_CANNONLAKE=y
 CONFIG_PINCTRL_CHERRYVIEW=y
 CONFIG_PINCTRL_DENVERTON=y
-# CONFIG_PINCTRL_ELKHARTLAKE is not set
-# CONFIG_PINCTRL_EMMITSBURG is not set
+CONFIG_PINCTRL_ELKHARTLAKE=y
+CONFIG_PINCTRL_EMMITSBURG=y
 CONFIG_PINCTRL_GEMINILAKE=y
 CONFIG_PINCTRL_INTEL=y
-# CONFIG_PINCTRL_JASPERLAKE is not set
-# CONFIG_PINCTRL_LAKEFIELD is not set
-# CONFIG_PINCTRL_LEWISBURG is not set
-# CONFIG_PINCTRL_LYNXPOINT is not set
+CONFIG_PINCTRL_JASPERLAKE=y
+CONFIG_PINCTRL_LAKEFIELD=y
+CONFIG_PINCTRL_LEWISBURG=y
+CONFIG_PINCTRL_LYNXPOINT=y
 CONFIG_PINCTRL_SUNRISEPOINT=y
-# CONFIG_PINCTRL_TIGERLAKE is not set
+CONFIG_PINCTRL_TIGERLAKE=y
 CONFIG_PM=y
 # CONFIG_PMIC_OPREGION is not set
 CONFIG_PM_CLK=y
diff --git a/target/linux/x86/geode/config-5.15 b/target/linux/x86/geode/config-5.15
index 8b5bf266d72cbb..2ede23ea5ecd6b 100644
--- a/target/linux/x86/geode/config-5.15
+++ b/target/linux/x86/geode/config-5.15
@@ -131,6 +131,7 @@ CONFIG_SERIAL_MCTRL_GPIO=y
 # CONFIG_USB_UHCI_HCD is not set
 CONFIG_VIA_RHINE=y
 CONFIG_VIA_RHINE_MMIO=y
+CONFIG_WATCHDOG_CORE=y
 # CONFIG_WDT is not set
 # CONFIG_WIRELESS_HOTKEY is not set
 # CONFIG_X86_ACPI_CPUFREQ is not set
diff --git a/target/linux/x86/modules.mk b/target/linux/x86/modules.mk
index 28cb276f7ec481..511410d614bc81 100644
--- a/target/linux/x86/modules.mk
+++ b/target/linux/x86/modules.mk
@@ -2,27 +2,10 @@
 #
 # Copyright (C) 2017 Cezary Jackiewicz <cezary@eko.one.pll>
 
-define KernelPackage/amazon-ena
-  SUBMENU:=$(NETWORK_DEVICES_MENU)
-  TITLE:=Elastic Network Adapter (for Amazon AWS T3)
-  DEPENDS:=@TARGET_x86_64
-  KCONFIG:=CONFIG_ENA_ETHERNET
-  FILES:=$(LINUX_DIR)/drivers/net/ethernet/amazon/ena/ena.ko
-  AUTOLOAD:=$(call AutoLoad,12,ena)
-endef
-
-define KernelPackage/amazon-ena/description
-  This driver supports Elastic Network Adapter (ENA)
-  used by Amazon AWS T3 instances.
-endef
-
-$(eval $(call KernelPackage,amazon-ena))
-
-
 define KernelPackage/amd-xgbe
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=AMD Ethernet on SoC support
-  DEPENDS:=@PCI_SUPPORT @TARGET_x86_64 +kmod-lib-crc32c +kmod-ptp +kmod-libphy +(LINUX_5_10||LINUX_5_15):kmod-mdio-devres
+  DEPENDS:=@PCI_SUPPORT @TARGET_x86_64 +kmod-lib-crc32c +kmod-ptp +kmod-libphy +kmod-mdio-devres
   KCONFIG:=CONFIG_AMD_XGBE
   FILES:=$(LINUX_DIR)/drivers/net/ethernet/amd/xgbe/amd-xgbe.ko
   AUTOLOAD:=$(call AutoLoad,35,amd-xgbe)
@@ -39,7 +22,9 @@ define KernelPackage/f71808e-wdt
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Fintek F718xx/F818xx Watchdog Timer
   DEPENDS:=@TARGET_x86
-  KCONFIG:=CONFIG_F71808E_WDT
+  KCONFIG:=\
+	CONFIG_F71808E_WDT \
+	CONFIG_WATCHDOG_CORE=y
   FILES:=$(LINUX_DIR)/drivers/watchdog/f71808e_wdt.ko
   AUTOLOAD:=$(call AutoProbe,f71808e-wdt,1)
 endef
@@ -123,8 +108,10 @@ define KernelPackage/itco-wdt
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Intel iTCO Watchdog Timer
   DEPENDS:=@TARGET_x86
-  KCONFIG:=CONFIG_ITCO_WDT \
-           CONFIG_ITCO_VENDOR_SUPPORT=y
+  KCONFIG:=\
+	CONFIG_ITCO_WDT \
+	CONFIG_ITCO_VENDOR_SUPPORT=y \
+	CONFIG_WATCHDOG_CORE=y
   FILES:=$(LINUX_DIR)/drivers/watchdog/iTCO_wdt.ko \
          $(LINUX_DIR)/drivers/watchdog/iTCO_vendor_support.ko
   AUTOLOAD:=$(call AutoLoad,50,iTCO_vendor_support iTCO_wdt,1)
@@ -178,7 +165,9 @@ define KernelPackage/w83627hf-wdt
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Winbond 83627HF Watchdog Timer
   DEPENDS:=@TARGET_x86
-  KCONFIG:=CONFIG_W83627HF_WDT
+  KCONFIG:=\
+	CONFIG_W83627HF_WDT \
+	CONFIG_WATCHDOG_CORE=y
   FILES:=$(LINUX_DIR)/drivers/watchdog/w83627hf_wdt.ko
   AUTOLOAD:=$(call AutoLoad,50,w83627hf-wdt,1)
 endef
diff --git a/target/linux/x86/patches-5.15/103-pcengines_apu6_platform.patch b/target/linux/x86/patches-5.15/103-pcengines_apu6_platform.patch
new file mode 100644
index 00000000000000..9ec0a33c3110aa
--- /dev/null
+++ b/target/linux/x86/patches-5.15/103-pcengines_apu6_platform.patch
@@ -0,0 +1,280 @@
+From 970d9af9015a387bb81841faf05dcc1a171eb97a Mon Sep 17 00:00:00 2001
+From: Philip Prindeville <philipp@redfish-solutions.com>
+Date: Sun, 1 Jan 2023 15:25:04 -0700
+Subject: [PATCH v3 1/1] x86: Support APU5 in PCEngines platform driver
+To: platform-driver-x86@vger.kernel.org, linux-x86_64@vger.kernel.org
+Cc: Ed Wildgoose <lists@wildgooses.com>, Andres Salomon <dilinger@queued.net>, Andreas Eberlein <foodeas@aeberlein.de>, Paul Spooren <paul@spooren.de>
+
+PCEngines make a number of SBC. APU5 has 5 mpcie slots + MSATA.
+It also has support for 3x LTE modems with 6x SIM slots (pairs with a
+SIM switch device). Each mpcie slot for modems has a reset GPIO
+
+To ensure that the naming is sane between APU2-6 the GPIOS are
+renamed to be modem1-reset, modem2-reset, etc. This is significant
+because the slots that can be reset change between APU2 and APU3/4
+
+GPIO for simswap is moved to the end of the list as it could be dropped
+for APU2 boards (but causes no harm to leave it in, hardware could be
+added to a future rev of the board).
+
+Structure of the GPIOs for APU5 is extremely similar to APU2-4, but
+many lines are moved around and there are simply more
+modems/resets/sim-swap lines to breakout.
+
+Also added APU6, which is essentially APU4 with a different ethernet
+interface and SFP cage on eth0.
+
+Revision history:
+
+v1: originally titled, "apu6: add apu6 variation to apu2 driver family"
+this dealt only with detecting the APUv6, which is otherwise identical
+to the v4 excepting the SFP cage on eth0.
+
+v2: at Ed's request, merged with his previous pull-request titled
+"x86: Support APU5 in PCEngines platform driver", and some cleanup
+to that changeset (including dropping the table "apu5_driver_data"
+which did not have a defined type "struct apu_driver_data"), but got
+mistitled when the Subject of that commit got accidentally dropped.
+
+v3: retitled to match Ed's previous pull-request.
+
+Cc: platform-driver-x86@vger.kernel.org
+Cc: linux-x86_64@vger.kernel.org
+Reviewed-by: Andreas Eberlein <foodeas@aeberlein.de>
+Reviewed-by: Paul Spooren <paul@spooren.de>
+Signed-off-by: Ed Wildgoose <lists@wildgooses.com>
+Sighed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
+---
+ drivers/leds/leds-apu.c                |   2 +-
+ drivers/platform/x86/Kconfig           |   4 +-
+ drivers/platform/x86/pcengines-apuv2.c | 118 ++++++++++++++++++++++---
+ 3 files changed, 107 insertions(+), 17 deletions(-)
+
+--- a/drivers/leds/leds-apu.c
++++ b/drivers/leds/leds-apu.c
+@@ -183,7 +183,7 @@ static int __init apu_led_init(void)
+ 
+ 	if (!(dmi_match(DMI_SYS_VENDOR, "PC Engines") &&
+ 	      (dmi_match(DMI_PRODUCT_NAME, "APU") || dmi_match(DMI_PRODUCT_NAME, "apu1")))) {
+-		pr_err("No PC Engines APUv1 board detected. For APUv2,3 support, enable CONFIG_PCENGINES_APU2\n");
++		pr_err("No PC Engines APUv1 board detected. For APUv2,3,4,5,6 support, enable CONFIG_PCENGINES_APU2\n");
+ 		return -ENODEV;
+ 	}
+ 
+--- a/drivers/platform/x86/Kconfig
++++ b/drivers/platform/x86/Kconfig
+@@ -661,7 +661,7 @@ config XO1_RFKILL
+ 	  laptop.
+ 
+ config PCENGINES_APU2
+-	tristate "PC Engines APUv2/3 front button and LEDs driver"
++	tristate "PC Engines APUv2/3/4/5/6 front button and LEDs driver"
+ 	depends on INPUT && INPUT_KEYBOARD && GPIOLIB
+ 	depends on LEDS_CLASS
+ 	select GPIO_AMD_FCH
+@@ -669,7 +669,7 @@ config PCENGINES_APU2
+ 	select LEDS_GPIO
+ 	help
+ 	  This driver provides support for the front button and LEDs on
+-	  PC Engines APUv2/APUv3 board.
++	  PC Engines APUv2/APUv3/APUv4/APUv5/APUv6 board.
+ 
+ 	  To compile this driver as a module, choose M here: the module
+ 	  will be called pcengines-apuv2.
+--- a/drivers/platform/x86/pcengines-apuv2.c
++++ b/drivers/platform/x86/pcengines-apuv2.c
+@@ -1,10 +1,12 @@
+ // SPDX-License-Identifier: GPL-2.0+
+ 
+ /*
+- * PC-Engines APUv2/APUv3 board platform driver
++ * PC-Engines APUv2-6 board platform driver
+  * for GPIO buttons and LEDs
+  *
+  * Copyright (C) 2018 metux IT consult
++ * Copyright (C) 2022 Ed Wildgoose <lists@wildgooses.com>
++ * Copyright (C) 2022 Philip Prindeville <philipp@redfish-solutions.com>
+  * Author: Enrico Weigelt <info@metux.net>
+  */
+ 
+@@ -22,38 +24,70 @@
+ #include <linux/platform_data/gpio/gpio-amd-fch.h>
+ 
+ /*
+- * NOTE: this driver only supports APUv2/3 - not APUv1, as this one
++ * NOTE: this driver only supports APUv2-6 - not APUv1, as this one
+  * has completely different register layouts.
+  */
+ 
++/*
++ * There are a number of APU variants, with differing features
++ * APU2 has SIM slots 1/2 mapping to mPCIe sockets 1/2
++ * APU3/4 moved SIM slot 1 to mPCIe socket 3, ie logically reversed
++ * However, most APU3/4 have a SIM switch which we default on to reverse
++ * the order and keep physical SIM order matching physical modem order
++ * APU6 is approximately the same as APU4 with different ethernet layout
++ *
++ * APU5 has 3x SIM sockets, all with a SIM switch
++ * several GPIOs are shuffled (see schematic), including MODESW
++ */
++
+ /* Register mappings */
+ #define APU2_GPIO_REG_LED1		AMD_FCH_GPIO_REG_GPIO57
+ #define APU2_GPIO_REG_LED2		AMD_FCH_GPIO_REG_GPIO58
+ #define APU2_GPIO_REG_LED3		AMD_FCH_GPIO_REG_GPIO59_DEVSLP1
+ #define APU2_GPIO_REG_MODESW		AMD_FCH_GPIO_REG_GPIO32_GE1
+ #define APU2_GPIO_REG_SIMSWAP		AMD_FCH_GPIO_REG_GPIO33_GE2
+-#define APU2_GPIO_REG_MPCIE2		AMD_FCH_GPIO_REG_GPIO55_DEVSLP0
+-#define APU2_GPIO_REG_MPCIE3		AMD_FCH_GPIO_REG_GPIO51
++#define APU2_GPIO_REG_RESETM1		AMD_FCH_GPIO_REG_GPIO51
++#define APU2_GPIO_REG_RESETM2		AMD_FCH_GPIO_REG_GPIO55_DEVSLP0
++
++#define APU5_GPIO_REG_MODESW		AMT_FCH_GPIO_REG_GEVT22
++#define APU5_GPIO_REG_SIMSWAP1		AMD_FCH_GPIO_REG_GPIO68
++#define APU5_GPIO_REG_SIMSWAP2		AMD_FCH_GPIO_REG_GPIO32_GE1
++#define APU5_GPIO_REG_SIMSWAP3		AMD_FCH_GPIO_REG_GPIO33_GE2
++#define APU5_GPIO_REG_RESETM1		AMD_FCH_GPIO_REG_GPIO51
++#define APU5_GPIO_REG_RESETM2		AMD_FCH_GPIO_REG_GPIO55_DEVSLP0
++#define APU5_GPIO_REG_RESETM3		AMD_FCH_GPIO_REG_GPIO64
+ 
+ /* Order in which the GPIO lines are defined in the register list */
+ #define APU2_GPIO_LINE_LED1		0
+ #define APU2_GPIO_LINE_LED2		1
+ #define APU2_GPIO_LINE_LED3		2
+ #define APU2_GPIO_LINE_MODESW		3
+-#define APU2_GPIO_LINE_SIMSWAP		4
+-#define APU2_GPIO_LINE_MPCIE2		5
+-#define APU2_GPIO_LINE_MPCIE3		6
++#define APU2_GPIO_LINE_RESETM1		4
++#define APU2_GPIO_LINE_RESETM2		5
++#define APU2_GPIO_LINE_SIMSWAP		6
++
++#define APU5_GPIO_LINE_LED1		0
++#define APU5_GPIO_LINE_LED2		1
++#define APU5_GPIO_LINE_LED3		2
++#define APU5_GPIO_LINE_MODESW		3
++#define APU5_GPIO_LINE_RESETM1		4
++#define APU5_GPIO_LINE_RESETM2		5
++#define APU5_GPIO_LINE_RESETM3		6
++#define APU5_GPIO_LINE_SIMSWAP1		7
++#define APU5_GPIO_LINE_SIMSWAP2		8
++#define APU5_GPIO_LINE_SIMSWAP3		9
++
+ 
+-/* GPIO device */
++/* GPIO device - APU2/3/4/6 */
+ 
+ static int apu2_gpio_regs[] = {
+ 	[APU2_GPIO_LINE_LED1]		= APU2_GPIO_REG_LED1,
+ 	[APU2_GPIO_LINE_LED2]		= APU2_GPIO_REG_LED2,
+ 	[APU2_GPIO_LINE_LED3]		= APU2_GPIO_REG_LED3,
+ 	[APU2_GPIO_LINE_MODESW]		= APU2_GPIO_REG_MODESW,
++	[APU2_GPIO_LINE_RESETM1]	= APU2_GPIO_REG_RESETM1,
++	[APU2_GPIO_LINE_RESETM2]	= APU2_GPIO_REG_RESETM2,
+ 	[APU2_GPIO_LINE_SIMSWAP]	= APU2_GPIO_REG_SIMSWAP,
+-	[APU2_GPIO_LINE_MPCIE2]		= APU2_GPIO_REG_MPCIE2,
+-	[APU2_GPIO_LINE_MPCIE3]		= APU2_GPIO_REG_MPCIE3,
+ };
+ 
+ static const char * const apu2_gpio_names[] = {
+@@ -61,9 +95,9 @@ static const char * const apu2_gpio_name
+ 	[APU2_GPIO_LINE_LED2]		= "front-led2",
+ 	[APU2_GPIO_LINE_LED3]		= "front-led3",
+ 	[APU2_GPIO_LINE_MODESW]		= "front-button",
++	[APU2_GPIO_LINE_RESETM1]	= "modem1-reset",
++	[APU2_GPIO_LINE_RESETM2]	= "modem2-reset",
+ 	[APU2_GPIO_LINE_SIMSWAP]	= "simswap",
+-	[APU2_GPIO_LINE_MPCIE2]		= "mpcie2_reset",
+-	[APU2_GPIO_LINE_MPCIE3]		= "mpcie3_reset",
+ };
+ 
+ static const struct amd_fch_gpio_pdata board_apu2 = {
+@@ -72,6 +106,40 @@ static const struct amd_fch_gpio_pdata b
+ 	.gpio_names	= apu2_gpio_names,
+ };
+ 
++/* GPIO device - APU5 */
++
++static int apu5_gpio_regs[] = {
++	[APU5_GPIO_LINE_LED1]		= APU2_GPIO_REG_LED1,
++	[APU5_GPIO_LINE_LED2]		= APU2_GPIO_REG_LED2,
++	[APU5_GPIO_LINE_LED3]		= APU2_GPIO_REG_LED3,
++	[APU5_GPIO_LINE_MODESW]		= APU5_GPIO_REG_MODESW,
++	[APU5_GPIO_LINE_RESETM1]	= APU5_GPIO_REG_RESETM1,
++	[APU5_GPIO_LINE_RESETM2]	= APU5_GPIO_REG_RESETM2,
++	[APU5_GPIO_LINE_RESETM3]	= APU5_GPIO_REG_RESETM3,
++	[APU5_GPIO_LINE_SIMSWAP1]	= APU5_GPIO_REG_SIMSWAP1,
++	[APU5_GPIO_LINE_SIMSWAP2]	= APU5_GPIO_REG_SIMSWAP2,
++	[APU5_GPIO_LINE_SIMSWAP3]	= APU5_GPIO_REG_SIMSWAP3,
++};
++
++static const char * const apu5_gpio_names[] = {
++	[APU5_GPIO_LINE_LED1]		= "front-led1",
++	[APU5_GPIO_LINE_LED2]		= "front-led2",
++	[APU5_GPIO_LINE_LED3]		= "front-led3",
++	[APU5_GPIO_LINE_MODESW]		= "front-button",
++	[APU5_GPIO_LINE_RESETM1]	= "modem1-reset",
++	[APU5_GPIO_LINE_RESETM2]	= "modem2-reset",
++	[APU5_GPIO_LINE_RESETM3]	= "modem3-reset",
++	[APU5_GPIO_LINE_SIMSWAP1]	= "simswap1",
++	[APU5_GPIO_LINE_SIMSWAP2]	= "simswap2",
++	[APU5_GPIO_LINE_SIMSWAP3]	= "simswap3",
++};
++
++static const struct amd_fch_gpio_pdata board_apu5 = {
++	.gpio_num	= ARRAY_SIZE(apu5_gpio_regs),
++	.gpio_reg	= apu5_gpio_regs,
++	.gpio_names	= apu5_gpio_names,
++};
++
+ /* GPIO LEDs device */
+ 
+ static const struct gpio_led apu2_leds[] = {
+@@ -215,6 +283,24 @@ static const struct dmi_system_id apu_gp
+ 		},
+ 		.driver_data = (void *)&board_apu2,
+ 	},
++	/* APU5 w/ mainline BIOS */
++	{
++		.ident		= "apu5",
++		.matches	= {
++			DMI_MATCH(DMI_SYS_VENDOR, "PC Engines"),
++			DMI_MATCH(DMI_BOARD_NAME, "apu5")
++		},
++		.driver_data	= (void *)&board_apu5,
++	},
++	/* APU6 w/ mainline BIOS */
++	{
++		.ident		= "apu6",
++		.matches	= {
++			DMI_MATCH(DMI_SYS_VENDOR, "PC Engines"),
++			DMI_MATCH(DMI_BOARD_NAME, "apu6")
++		},
++		.driver_data	= (void *)&board_apu2,
++	},
+ 	{}
+ };
+ 
+@@ -249,7 +335,7 @@ static int __init apu_board_init(void)
+ 
+ 	id = dmi_first_match(apu_gpio_dmi_table);
+ 	if (!id) {
+-		pr_err("failed to detect APU board via DMI\n");
++		pr_err("No APU board detected via DMI\n");
+ 		return -ENODEV;
+ 	}
+ 
+@@ -288,8 +374,12 @@ module_init(apu_board_init);
+ module_exit(apu_board_exit);
+ 
+ MODULE_AUTHOR("Enrico Weigelt, metux IT consult <info@metux.net>");
+-MODULE_DESCRIPTION("PC Engines APUv2/APUv3 board GPIO/LEDs/keys driver");
++MODULE_DESCRIPTION("PC Engines APUv2-6 board GPIO/LEDs/keys driver");
+ MODULE_LICENSE("GPL");
+ MODULE_DEVICE_TABLE(dmi, apu_gpio_dmi_table);
+ MODULE_ALIAS("platform:pcengines-apuv2");
++MODULE_ALIAS("platform:pcengines-apuv3");
++MODULE_ALIAS("platform:pcengines-apuv4");
++MODULE_ALIAS("platform:pcengines-apuv5");
++MODULE_ALIAS("platform:pcengines-apuv6");
+ MODULE_SOFTDEP("pre: platform:" AMD_FCH_GPIO_DRIVER_NAME " platform:leds-gpio platform:gpio_keys_polled");
diff --git a/target/linux/zynq/Makefile b/target/linux/zynq/Makefile
index 83807913e41693..f48b58e598243e 100644
--- a/target/linux/zynq/Makefile
+++ b/target/linux/zynq/Makefile
@@ -10,6 +10,7 @@ BOARDNAME:=Xilinx Zynq 7000 SoCs
 FEATURES:=fpu gpio rtc usb usbgadget boot-part rootfs-part squashfs
 CPU_TYPE:=cortex-a9
 CPU_SUBTYPE:=neon
+SUBTARGETS:=generic
 
 # future support SUBTARGETS: for both zynq and zynqmp
 
@@ -17,7 +18,7 @@ define Target/Description
 	Build firmware image for Zynq 7000 SoC devices.
 endef
 
-KERNEL_PATCHVER:=5.10
+KERNEL_PATCHVER:=5.15
 
 include $(INCLUDE_DIR)/target.mk
 
diff --git a/target/linux/zynq/config-5.15 b/target/linux/zynq/config-5.15
new file mode 100644
index 00000000000000..d1d73924400040
--- /dev/null
+++ b/target/linux/zynq/config-5.15
@@ -0,0 +1,552 @@
+CONFIG_ALIGNMENT_TRAP=y
+# CONFIG_ALTERA_FREEZE_BRIDGE is not set
+# CONFIG_ALTERA_PR_IP_CORE is not set
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+CONFIG_ARCH_MULTIPLATFORM=y
+CONFIG_ARCH_MULTI_V6_V7=y
+CONFIG_ARCH_MULTI_V7=y
+CONFIG_ARCH_NR_GPIO=1024
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX=y
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARCH_VEXPRESS=y
+CONFIG_ARCH_VEXPRESS_CORTEX_A5_A9_ERRATA=y
+# CONFIG_ARCH_VEXPRESS_SPC is not set
+CONFIG_ARCH_ZYNQ=y
+CONFIG_ARM=y
+CONFIG_ARM_AMBA=y
+CONFIG_ARM_CPU_SUSPEND=y
+CONFIG_ARM_CRYPTO=y
+CONFIG_ARM_ERRATA_643719=y
+CONFIG_ARM_ERRATA_720789=y
+CONFIG_ARM_ERRATA_754322=y
+CONFIG_ARM_ERRATA_754327=y
+CONFIG_ARM_ERRATA_764369=y
+CONFIG_ARM_ERRATA_775420=y
+CONFIG_ARM_GIC=y
+CONFIG_ARM_GLOBAL_TIMER=y
+CONFIG_ARM_GT_INITIAL_PRESCALER_VAL=2
+CONFIG_ARM_HAS_SG_CHAIN=y
+CONFIG_ARM_HEAVY_MB=y
+CONFIG_ARM_L1_CACHE_SHIFT=6
+CONFIG_ARM_L1_CACHE_SHIFT_6=y
+CONFIG_ARM_PATCH_IDIV=y
+CONFIG_ARM_PATCH_PHYS_VIRT=y
+# CONFIG_ARM_PL172_MPMC is not set
+# CONFIG_ARM_SMMU is not set
+CONFIG_ARM_THUMB=y
+CONFIG_ARM_TIMER_SP804=y
+CONFIG_ARM_UNWIND=y
+CONFIG_ARM_VIRT_EXT=y
+CONFIG_ARM_ZYNQ_CPUIDLE=y
+CONFIG_ATAGS=y
+CONFIG_AUTO_ZRELADDR=y
+# CONFIG_AXI_DMAC is not set
+CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=16384
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BOUNCE=y
+CONFIG_CACHE_L2X0=y
+CONFIG_CADENCE_TTC_TIMER=y
+CONFIG_CADENCE_WATCHDOG=y
+CONFIG_CLKSRC_ARM_GLOBAL_TIMER_SCHED_CLOCK=y
+CONFIG_CLKSRC_MMIO=y
+CONFIG_CLKSRC_VERSATILE=y
+CONFIG_CLK_SP810=y
+CONFIG_CLK_VEXPRESS_OSC=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CMA=y
+CONFIG_CMA_ALIGNMENT=8
+CONFIG_CMA_AREAS=7
+# CONFIG_CMA_DEBUG is not set
+# CONFIG_CMA_DEBUGFS is not set
+CONFIG_CMA_SIZE_MBYTES=16
+# CONFIG_CMA_SIZE_SEL_MAX is not set
+CONFIG_CMA_SIZE_SEL_MBYTES=y
+# CONFIG_CMA_SIZE_SEL_MIN is not set
+# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
+# CONFIG_CMA_SYSFS is not set
+CONFIG_COMMON_CLK=y
+CONFIG_COMMON_CLK_SI570=y
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONNECTOR=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CONTIG_ALLOC=y
+CONFIG_COREDUMP=y
+# CONFIG_CPUFREQ_DT is not set
+CONFIG_CPU_32v6K=y
+CONFIG_CPU_32v7=y
+CONFIG_CPU_ABRT_EV7=y
+CONFIG_CPU_CACHE_V7=y
+CONFIG_CPU_CACHE_VIPT=y
+CONFIG_CPU_COPY_V6=y
+CONFIG_CPU_CP15=y
+CONFIG_CPU_CP15_MMU=y
+CONFIG_CPU_FREQ=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_HAS_ASID=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_PABRT_V7=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SPECTRE=y
+CONFIG_CPU_THERMAL=y
+CONFIG_CPU_THUMB_CAPABLE=y
+CONFIG_CPU_TLB_V7=y
+CONFIG_CPU_V7=y
+CONFIG_CRC16=y
+# CONFIG_CRC32_SARWATE is not set
+CONFIG_CRC32_SLICEBY8=y
+CONFIG_CROSS_MEMORY_ATTACH=y
+CONFIG_CRYPTO_CRC32=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_HW=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DEBUG_LL_INCLUDE="mach/debug-macro.S"
+CONFIG_DMADEVICES=y
+CONFIG_DMA_CMA=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_OPS=y
+CONFIG_DMA_REMAP=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DRM=y
+CONFIG_DRM_BRIDGE=y
+CONFIG_DRM_FBDEV_EMULATION=y
+CONFIG_DRM_FBDEV_OVERALLOC=100
+CONFIG_DRM_KMS_HELPER=y
+CONFIG_DRM_PANEL=y
+CONFIG_DRM_PANEL_BRIDGE=y
+CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y
+CONFIG_DTC=y
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_E1000E=y
+CONFIG_EDAC=y
+CONFIG_EDAC_ATOMIC_SCRUB=y
+# CONFIG_EDAC_DEBUG is not set
+CONFIG_EDAC_LEGACY_SYSFS=y
+CONFIG_EDAC_SUPPORT=y
+# CONFIG_EDAC_SYNOPSYS is not set
+CONFIG_EEPROM_AT24=y
+CONFIG_EEPROM_AT25=y
+CONFIG_ELF_CORE=y
+CONFIG_EXT4_FS=y
+CONFIG_EXTCON=y
+CONFIG_F2FS_FS=y
+CONFIG_FB=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+CONFIG_FB_CMDLINE=y
+CONFIG_FB_DEFERRED_IO=y
+CONFIG_FB_SYS_COPYAREA=y
+CONFIG_FB_SYS_FILLRECT=y
+CONFIG_FB_SYS_FOPS=y
+CONFIG_FB_SYS_IMAGEBLIT=y
+# CONFIG_FB_XILINX is not set
+CONFIG_FHANDLE=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FPGA=y
+CONFIG_FPGA_BRIDGE=y
+# CONFIG_FPGA_DFL is not set
+# CONFIG_FPGA_MGR_ALTERA_CVP is not set
+# CONFIG_FPGA_MGR_ALTERA_PS_SPI is not set
+# CONFIG_FPGA_MGR_ICE40_SPI is not set
+# CONFIG_FPGA_MGR_MACHXO2_SPI is not set
+# CONFIG_FPGA_MGR_XILINX_SPI is not set
+CONFIG_FPGA_MGR_ZYNQ_FPGA=y
+CONFIG_FPGA_REGION=y
+CONFIG_FREEZER=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CACHE=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ARCH_TOPOLOGY=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_GENERIC_IRQ_MULTI_HANDLER=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_MSI_IRQ=y
+CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GENERIC_VDSO_32=y
+CONFIG_GLOB=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_GPIO_ZYNQ=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDEN_BRANCH_PREDICTOR=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAVE_SMP=y
+CONFIG_HDMI=y
+CONFIG_HID=y
+CONFIG_HID_GENERIC=y
+CONFIG_HID_MICROSOFT=y
+CONFIG_HIGHMEM=y
+CONFIG_HIGHPTE=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HWMON=y
+CONFIG_HW_CONSOLE=y
+CONFIG_HZ_FIXED=0
+CONFIG_I2C=y
+CONFIG_I2C_ALGOBIT=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_CADENCE=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_COMPAT=y
+CONFIG_I2C_HELPER_AUTO=y
+CONFIG_I2C_MUX=y
+CONFIG_I2C_MUX_PCA954x=y
+CONFIG_ICST=y
+CONFIG_IIO=y
+CONFIG_IIO_BUFFER=y
+CONFIG_IIO_KFIFO_BUF=y
+CONFIG_IIO_TRIGGER=y
+CONFIG_IIO_TRIGGERED_BUFFER=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_INPUT=y
+CONFIG_INPUT_EVDEV=y
+CONFIG_INPUT_FF_MEMLESS=y
+CONFIG_INPUT_KEYBOARD=y
+CONFIG_INPUT_MOUSE=y
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_MOUSEDEV_PSAUX=y
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+CONFIG_INPUT_SPARSEKMAP=y
+# CONFIG_IOMMU_DEBUGFS is not set
+# CONFIG_IOMMU_IO_PGTABLE_ARMV7S is not set
+# CONFIG_IOMMU_IO_PGTABLE_LPAE is not set
+CONFIG_IOMMU_SUPPORT=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_BOOTP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_RARP=y
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+# CONFIG_ISDN is not set
+CONFIG_JBD2=y
+# CONFIG_JFFS2_COMPRESSION_OPTIONS is not set
+CONFIG_JFFS2_ZLIB=y
+CONFIG_KCMP=y
+CONFIG_KERNEL_GZIP=y
+# CONFIG_KERNEL_XZ is not set
+CONFIG_KEYBOARD_ATKBD=y
+CONFIG_KEYBOARD_GPIO=y
+CONFIG_KEYBOARD_GPIO_POLLED=y
+CONFIG_KMAP_LOCAL=y
+CONFIG_KMAP_LOCAL_NON_LINEAR_PTE_ARRAY=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_TRIGGER_BACKLIGHT=y
+CONFIG_LEDS_TRIGGER_CAMERA=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_GPIO=y
+CONFIG_LEDS_TRIGGER_ONESHOT=y
+CONFIG_LEDS_TRIGGER_TRANSIENT=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_MACB=y
+# CONFIG_MACB_PCI is not set
+CONFIG_MACB_USE_HWSTAMP=y
+CONFIG_MARVELL_PHY=y
+CONFIG_MDIO_BITBANG=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+# CONFIG_MDIO_GPIO is not set
+CONFIG_MEMFD_CREATE=y
+CONFIG_MEMORY=y
+CONFIG_MEMORY_ISOLATION=y
+CONFIG_MFD_CORE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MFD_VEXPRESS_SYSREG=y
+CONFIG_MIGHT_HAVE_CACHE_L2X0=y
+CONFIG_MIGRATION=y
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_CQHCI=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_OF_ARASAN=y
+# CONFIG_MMC_SDHCI_PCI is not set
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+# CONFIG_MODULE_STRIPPED is not set
+# CONFIG_MOUSE_BCM5974 is not set
+# CONFIG_MOUSE_CYAPA is not set
+CONFIG_MOUSE_PS2=y
+CONFIG_MOUSE_PS2_ALPS=y
+CONFIG_MOUSE_PS2_BYD=y
+CONFIG_MOUSE_PS2_CYPRESS=y
+# CONFIG_MOUSE_PS2_ELANTECH is not set
+CONFIG_MOUSE_PS2_FOCALTECH=y
+CONFIG_MOUSE_PS2_LOGIPS2PP=y
+CONFIG_MOUSE_PS2_SMBUS=y
+CONFIG_MOUSE_PS2_SYNAPTICS=y
+CONFIG_MOUSE_PS2_SYNAPTICS_SMBUS=y
+# CONFIG_MOUSE_PS2_TOUCHKIT is not set
+CONFIG_MOUSE_PS2_TRACKPOINT=y
+# CONFIG_MOUSE_SERIAL is not set
+# CONFIG_MOUSE_VSXXXAA is not set
+# CONFIG_MTD_CFI_INTELEXT is not set
+CONFIG_MTD_CMDLINE_PARTS=y
+# CONFIG_MTD_COMPLEX_MAPPINGS is not set
+CONFIG_MTD_PHYSMAP=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPI_NOR_USE_4K_SECTORS=y
+CONFIG_MTD_SPLIT_FIRMWARE=y
+# CONFIG_MTD_SPLIT_SQUASHFS_ROOT is not set
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEON=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_PTP_CLASSIFY=y
+CONFIG_NET_SELFTESTS=y
+# CONFIG_NET_VENDOR_CIRRUS is not set
+# CONFIG_NET_VENDOR_FARADAY is not set
+# CONFIG_NET_VENDOR_MARVELL is not set
+# CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_MICROCHIP is not set
+# CONFIG_NET_VENDOR_NATSEMI is not set
+# CONFIG_NET_VENDOR_SEEQ is not set
+# CONFIG_NET_VENDOR_SMSC is not set
+# CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_VIA is not set
+CONFIG_NLS=y
+CONFIG_NLS_ASCII=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_NOP_USB_XCEIV=y
+CONFIG_NO_HZ=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NO_IOPORT_MAP=y
+CONFIG_NR_CPUS=4
+CONFIG_NVMEM=y
+CONFIG_NVMEM_SYSFS=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+# CONFIG_OF_FPGA_REGION is not set
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_OLD_SIGACTION=y
+CONFIG_OLD_SIGSUSPEND3=y
+CONFIG_OUTER_CACHE=y
+CONFIG_OUTER_CACHE_SYNC=y
+CONFIG_PADATA=y
+CONFIG_PAGE_OFFSET=0xC0000000
+# CONFIG_PARTITION_ADVANCED is not set
+CONFIG_PCI=y
+CONFIG_PCIE_XILINX=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PCI_MSI=y
+CONFIG_PCI_MSI_IRQ_DOMAIN=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLINK=y
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_SINGLE is not set
+CONFIG_PINCTRL_ZYNQ=y
+CONFIG_PL310_ERRATA_588369=y
+CONFIG_PL310_ERRATA_727915=y
+CONFIG_PL310_ERRATA_753970=y
+CONFIG_PL310_ERRATA_769419=y
+CONFIG_PL330_DMA=y
+# CONFIG_PL353_SMC is not set
+CONFIG_PLAT_VERSATILE=y
+CONFIG_PM=y
+CONFIG_PMBUS=y
+CONFIG_PM_CLK=y
+CONFIG_PM_SLEEP=y
+CONFIG_PM_SLEEP_SMP=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_VEXPRESS=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PPS=y
+CONFIG_PROC_EVENTS=y
+CONFIG_PTP_1588_CLOCK=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_R8169=y
+CONFIG_RAS=y
+CONFIG_RATIONAL=y
+CONFIG_REALTEK_PHY=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+# CONFIG_REGULATOR_VEXPRESS is not set
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RESET_ZYNQ=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_PCF8563=y
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RTC_MC146818_LIB=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+# CONFIG_SCHED_CORE is not set
+CONFIG_SCHED_MC=y
+CONFIG_SCHED_SMT=y
+CONFIG_SENSORS_PMBUS=y
+CONFIG_SENSORS_UCD9000=y
+CONFIG_SENSORS_UCD9200=y
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIAL_XILINX_PS_UART=y
+CONFIG_SERIAL_XILINX_PS_UART_CONSOLE=y
+CONFIG_SERIO=y
+CONFIG_SERIO_LIBPS2=y
+CONFIG_SERIO_SERPORT=y
+CONFIG_SMP=y
+CONFIG_SMP_ON_UP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOC_BUS=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SPI=y
+CONFIG_SPI_BITBANG=y
+CONFIG_SPI_CADENCE=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SPI_XILINX=y
+CONFIG_SPI_ZYNQ_QSPI=y
+CONFIG_SRAM=y
+CONFIG_SRAM_EXEC=y
+CONFIG_SRCU=y
+# CONFIG_STRIP_ASM_SYMS is not set
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+CONFIG_SWPHY=y
+CONFIG_SWP_EMULATE=y
+CONFIG_SYNC_FILE=y
+CONFIG_SYSFS_SYSCALL=y
+CONFIG_SYS_SUPPORTS_APM_EMULATION=y
+# CONFIG_TEXTSEARCH is not set
+CONFIG_THERMAL=y
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_GOV_STEP_WISE=y
+CONFIG_THERMAL_HWMON=y
+CONFIG_THERMAL_OF=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UIO=y
+# CONFIG_UIO_AEC is not set
+# CONFIG_UIO_CIF is not set
+# CONFIG_UIO_DMEM_GENIRQ is not set
+# CONFIG_UIO_MF624 is not set
+# CONFIG_UIO_NETX is not set
+# CONFIG_UIO_PCI_GENERIC is not set
+CONFIG_UIO_PDRV_GENIRQ=y
+# CONFIG_UIO_PRUSS is not set
+# CONFIG_UIO_SERCOS3 is not set
+CONFIG_UNCOMPRESS_INCLUDE="debug/uncompress.h"
+CONFIG_UNWINDER_ARM=y
+CONFIG_USB=y
+CONFIG_USB_CHIPIDEA=y
+CONFIG_USB_CHIPIDEA_HOST=y
+CONFIG_USB_CHIPIDEA_UDC=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_EHCI_HCD=y
+# CONFIG_USB_EHCI_HCD_PLATFORM is not set
+# CONFIG_USB_EHCI_TT_NEWSCHED is not set
+CONFIG_USB_GADGET=y
+CONFIG_USB_GADGET_XILINX=y
+CONFIG_USB_HID=y
+CONFIG_USB_NET_DRIVERS=y
+CONFIG_USB_OTG=y
+CONFIG_USB_OTG_FSM=y
+CONFIG_USB_PHY=y
+CONFIG_USB_ROLE_SWITCH=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_ULPI=y
+CONFIG_USB_ULPI_BUS=y
+CONFIG_USB_ULPI_VIEWPORT=y
+CONFIG_USE_OF=y
+CONFIG_VEXPRESS_CONFIG=y
+CONFIG_VFP=y
+CONFIG_VFPv3=y
+CONFIG_VGA_ARB=y
+CONFIG_VGA_ARB_MAX_GPUS=16
+CONFIG_VITESSE_PHY=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_CONSOLE_SLEEP=y
+# CONFIG_VT_HW_CONSOLE_BINDING is not set
+CONFIG_WATCHDOG_CORE=y
+# CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set
+CONFIG_XILINX_EMACLITE=y
+# CONFIG_XILINX_INTC is not set
+# CONFIG_XILINX_PR_DECOUPLER is not set
+CONFIG_XILINX_WATCHDOG=y
+CONFIG_XILINX_XADC=y
+CONFIG_XPS=y
+CONFIG_XZ_DEC_ARM=y
+CONFIG_XZ_DEC_ARMTHUMB=y
+CONFIG_XZ_DEC_BCJ=y
+CONFIG_XZ_DEC_IA64=y
+CONFIG_XZ_DEC_POWERPC=y
+CONFIG_XZ_DEC_SPARC=y
+CONFIG_XZ_DEC_X86=y
+CONFIG_ZBOOT_ROM_BSS=0x0
+CONFIG_ZBOOT_ROM_TEXT=0x0
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
diff --git a/target/linux/zynq/generic/target.mk b/target/linux/zynq/generic/target.mk
new file mode 100644
index 00000000000000..f5cb1fb19b943f
--- /dev/null
+++ b/target/linux/zynq/generic/target.mk
@@ -0,0 +1 @@
+BOARDNAME:=Generic
diff --git a/target/sdk/Makefile b/target/sdk/Makefile
index be7e1ebf5198bd..b688eb4cba0239 100644
--- a/target/sdk/Makefile
+++ b/target/sdk/Makefile
@@ -29,11 +29,9 @@ EXCLUDE_DIRS:= \
 	*/man \
 	*/info \
 	*/root-* \
-	initial \
 	*.install.clean \
 	*.install.flags \
 	*.install \
-	*/doc \
 	*/share/locale
 
 SDK_DIRS = \
@@ -46,10 +44,10 @@ GIT_COMMIT:=$(shell git rev-parse HEAD 2>/dev/null)
 GIT_BRANCH:=$(filter-out master HEAD,$(shell git rev-parse --abbrev-ref HEAD 2>/dev/null))
 GIT_TAGNAME:=$(shell git show-ref --tags --dereference 2>/dev/null | sed -ne '/^$(GIT_COMMIT) / { s|^.*/||; s|\^.*||; p }')
 
-BASE_FEED:=$(if $(GIT_URL),src-git base $(GIT_URL)$(if $(GIT_BRANCH),;$(GIT_BRANCH),$(if $(GIT_TAGNAME),;$(GIT_TAGNAME))))
+BASE_FEED:=$(if $(GIT_URL),src-git-full base $(GIT_URL)$(if $(GIT_BRANCH),;$(GIT_BRANCH),$(if $(GIT_TAGNAME),;$(GIT_TAGNAME))))
 BASE_FEED:=$(if $(BASE_FEED),$(BASE_FEED),$(shell cd $(TOPDIR); LC_ALL=C git svn info 2>/dev/null | sed -ne 's/^URL: /src-gitsvn base /p'))
 BASE_FEED:=$(if $(BASE_FEED),$(BASE_FEED),$(shell cd $(TOPDIR); LC_ALL=C svn info 2>/dev/null | sed -ne 's/^URL: /src-svn base /p'))
-BASE_FEED:=$(if $(BASE_FEED),$(BASE_FEED),src-git base $(PROJECT_GIT)/openwrt/openwrt.git$(if $(GIT_BRANCH),;$(GIT_BRANCH),$(if $(GIT_TAGNAME),;$(GIT_TAGNAME))))
+BASE_FEED:=$(if $(BASE_FEED),$(BASE_FEED),src-git-full base $(PROJECT_GIT)/openwrt/openwrt.git$(if $(GIT_BRANCH),;$(GIT_BRANCH),$(if $(GIT_TAGNAME),;$(GIT_TAGNAME))))
 
 KDIR_BASE = $(patsubst $(TOPDIR)/%,%,$(LINUX_DIR))
 KDIR_ARCHES = $(LINUX_KARCH)
@@ -159,6 +157,8 @@ $(BIN_DIR)/$(SDK_NAME).tar.xz: clean
 		$(SDK_BUILD_DIR)/package/kernel/
 
 	-rm -rf $(SDK_BUILD_DIR)/$(STAGING_SUBDIR_HOST)/.prereq-build
+	-rm -rf $(SDK_BUILD_DIR)/$(STAGING_SUBDIR_HOST)/doc
+	-rm -rf $(SDK_BUILD_DIR)/$(STAGING_SUBDIR_HOST)/share/doc
 
 	-rm -f $(SDK_BUILD_DIR)/feeds.conf.default
 	$(if $(BASE_FEED),echo "$(BASE_FEED)" > $(SDK_BUILD_DIR)/feeds.conf.default)
diff --git a/target/sdk/files/Config.in b/target/sdk/files/Config.in
index 12c0f6a6246cfe..0cf68faa6e1296 100644
--- a/target/sdk/files/Config.in
+++ b/target/sdk/files/Config.in
@@ -18,12 +18,28 @@ menu "Global build settings"
 		bool "Cryptographically sign package lists"
 		default y
 
+	comment "General build options"
+
+	config BUILD_PATENTED
+		default n
+		bool "Compile with support for patented functionality"
+		help
+		  When this option is disabled, software which provides patented functionality
+		  will not be built.  In case software provides optional support for patented
+		  functionality, this optional support will get disabled for this package.
+
+	config BUILD_NLS
+		default n
+		bool "Compile with full language support"
+		help
+		  When this option is enabled, packages are built with the full versions of
+		  iconv and GNU gettext instead of the default OpenWrt stubs.
+
 	comment "Package build options"
 
 	config DEBUG
 		bool
 		prompt "Compile packages with debugging info"
-		default n
 		help
 		  Adds -g3 to the CFLAGS.
 
@@ -69,7 +85,6 @@ menu "Advanced configuration options (for developers)"
 
 	config BROKEN
 		bool "Show broken packages"
-		default n
 
 	config DOWNLOAD_FOLDER
 		string "Download folder"
@@ -101,19 +116,23 @@ menu "Advanced configuration options (for developers)"
 
 	config CCACHE
 		bool "Use ccache"
-		default n
 		help
 		  Compiler cache; see https://ccache.samba.org/
 
+	config CCACHE_DIR
+		string "Set ccache directory" if CCACHE
+		default ""
+		help
+		  Store ccache in this directory.
+		  If not set, uses './.ccache'
+
 	config BUILD_LOG
 		bool "Enable log files during build process"
-		default n
 		help
 		  If enabled, log files will be written to the ./log directory.
 
 	config SRC_TREE_OVERRIDE
 		bool "Enable package source tree override"
-		default n
 		help
 		  If enabled, you can force a package to use a git tree as source
 		  code instead of the normal tarball. Create a symlink 'git-src'
diff --git a/target/sdk/files/Makefile b/target/sdk/files/Makefile
index f620f0ef012605..89c6a109eee020 100644
--- a/target/sdk/files/Makefile
+++ b/target/sdk/files/Makefile
@@ -14,7 +14,9 @@ export TOPDIR LC_ALL LANG SDK
 
 world:
 
-DISTRO_PKG_CONFIG:=$(shell $(TOPDIR)/scripts/command_all.sh pkg-config | grep -E '\/usr' -m 1)
+DISTRO_PKG_CONFIG:=$(shell $(TOPDIR)/scripts/command_all.sh pkg-config | grep '/usr' -m 1)
+
+export ORIG_PATH:=$(if $(ORIG_PATH),$(ORIG_PATH),$(PATH))
 export PATH:=$(TOPDIR)/staging_dir/host/bin:$(PATH)
 
 ifneq ($(OPENWRT_BUILD),1)
diff --git a/target/toolchain/files/wrapper.sh b/target/toolchain/files/wrapper.sh
index 6a0cdfff6c55b8..09a9cac928abd9 100755
--- a/target/toolchain/files/wrapper.sh
+++ b/target/toolchain/files/wrapper.sh
@@ -43,10 +43,11 @@ TOOLCHAIN_BIN_DIR="$REALNAME_DIR/"
 
 # Set the PATH so that our run-time location is first
 # (get_feature is run from the path, so this has to be set)
+export ORIG_PATH=${ORIG_PATH:-$PATH}
 export PATH="$TOOLCHAIN_BIN_DIR":$PATH
 export GCC_HONOUR_COPTS
 
-TOOLCHAIN_SYSROOT="$TOOLCHAIN_BIN_DIR/../.."
+TOOLCHAIN_SYSROOT="$TOOLCHAIN_BIN_DIR/.."
 if [ ! -d "$TOOLCHAIN_SYSROOT" ]; then
 	echo "Error: Unable to determine sysroot (looking for $TOOLCHAIN_SYSROOT)!" >&2
 	exit 1
@@ -57,8 +58,8 @@ fi
 
 case $TOOLCHAIN_PLATFORM in
 	gnu|glibc|uclibc|musl)
-		GCC_SYSROOT_FLAGS="--sysroot=$TOOLCHAIN_SYSROOT -Wl,-rpath=$TOOLCHAIN_SYSROOT/lib:$TOOLCHAIN_SYSROOT/usr/lib"
-		LD_SYSROOT_FLAGS="-rpath=$TOOLCHAIN_SYSROOT/lib:$TOOLCHAIN_SYSROOT/usr/lib"
+		GCC_SYSROOT_FLAGS="--sysroot=$TOOLCHAIN_SYSROOT -Wl,-rpath-link=$TOOLCHAIN_SYSROOT/lib:$TOOLCHAIN_SYSROOT/usr/lib"
+		LD_SYSROOT_FLAGS="-rpath-link=$TOOLCHAIN_SYSROOT/lib:$TOOLCHAIN_SYSROOT/usr/lib"
 		;;
 	*)
 		GCC_SYSROOT_FLAGS=""
diff --git a/toolchain/Config.in b/toolchain/Config.in
index 6d3cc0a200cb70..b0273acafdd7dc 100644
--- a/toolchain/Config.in
+++ b/toolchain/Config.in
@@ -197,7 +197,6 @@ menuconfig EXTRA_TARGET_ARCH
 	bool
 	prompt "Enable an extra toolchain target architecture" if TOOLCHAINOPTS
 	depends on !sparc
-	default n
 	help
 	  Some builds may require a 'biarch' toolchain. This option
 	  allows you to specify an additional target arch.
@@ -252,7 +251,6 @@ config DWARVES
 	bool
 	prompt "Build pahole" if TOOLCHAINOPTS
 	depends on !HOST_OS_MACOS
-	default n
 	help
 	  Enable if you want to build pahole and the dwarves tools.
 
diff --git a/toolchain/Makefile b/toolchain/Makefile
index 5dccf8f82906b5..c0046293c9244a 100644
--- a/toolchain/Makefile
+++ b/toolchain/Makefile
@@ -21,8 +21,6 @@
 #    build & install the final libc
 # 7) toolchain/gcc/final/compile
 #    build & install the final gcc
-# 8) toolchain/libc/utils/compile
-#    build & install libc utilities
 #
 # For musl, steps 2 and 4 are skipped, and step 3 is done after 5
 
@@ -34,8 +32,8 @@ $(curdir)/builddirs := $(if $(CONFIG_GDB),gdb) $(if $(CONFIG_EXTERNAL_TOOLCHAIN)
 # builddir dependencies
 ifeq ($(CONFIG_EXTERNAL_TOOLCHAIN),)
   ifdef CONFIG_USE_MUSL
+    $(curdir)/gcc/initial/compile:=$(curdir)/binutils/compile
     $(curdir)/kernel-headers/compile:=$(curdir)/gcc/initial/compile
-    $(curdir)/$(LIBC)/compile:=$(curdir)/kernel-headers/compile
   else
     $(curdir)/builddirs += $(LIBC)/headers gcc/minimal
     $(curdir)/gcc/minimal/compile:=$(curdir)/binutils/compile
@@ -44,10 +42,8 @@ ifeq ($(CONFIG_EXTERNAL_TOOLCHAIN),)
     $(curdir)/gcc/initial/compile:=$(curdir)/$(LIBC)/headers/compile
   endif
 
-  $(curdir)/gcc/initial/compile+=$(curdir)/binutils/compile
-  $(curdir)/$(LIBC)/compile:=$(curdir)/gcc/initial/compile
-  $(curdir)/gcc/final/compile:=$(curdir)/$(LIBC)/compile $(curdir)/kernel-headers/compile
-  $(curdir)/$(LIBC)/utils/compile:=$(curdir)/gcc/final/compile
+  $(curdir)/$(LIBC)/compile:=$(curdir)/gcc/initial/compile $(curdir)/kernel-headers/compile
+  $(curdir)/gcc/final/compile:=$(curdir)/$(LIBC)/compile
 endif
 
 ifndef DUMP_TARGET_DB
@@ -85,12 +81,12 @@ $(curdir)/ := .config prereq
 $(curdir)//compile = $(STAGING_DIR)/.prepared $(TOOLCHAIN_DIR)/info.mk $(tools/stamp-compile)
 
 ifndef DUMP_TARGET_DB
-$(TOOLCHAIN_DIR)/stamp/.gcc-initial_installed:
+$(TOOLCHAIN_DIR)/stamp/.gcc_final_installed:
 endif
 
 $(curdir)/install: $(curdir)/compile
 
-$(eval $(call stampfile,$(curdir),toolchain,compile,$(TOOLCHAIN_DIR)/stamp/.gcc-initial_installed,,$(TOOLCHAIN_DIR)))
+$(eval $(call stampfile,$(curdir),toolchain,compile,$(TOOLCHAIN_DIR)/stamp/.gcc_final_installed,,$(TOOLCHAIN_DIR)))
 $(eval $(call stampfile,$(curdir),toolchain,check,$(TMP_DIR)/.build))
 $(eval $(call subdir,$(curdir)))
 
diff --git a/toolchain/binutils/Config.in b/toolchain/binutils/Config.in
index 0bc8bbd0a3f47f..e53384a00620ea 100644
--- a/toolchain/binutils/Config.in
+++ b/toolchain/binutils/Config.in
@@ -2,7 +2,7 @@
 
 choice
 	prompt "Binutils Version" if TOOLCHAINOPTS
-	default BINUTILS_USE_VERSION_2_37
+	default BINUTILS_USE_VERSION_2_40
 	help
 	  Select the version of binutils you wish to use.
 
@@ -17,6 +17,10 @@ choice
 	config BINUTILS_USE_VERSION_2_39
 		bool "Binutils 2.39"
 		select BINUTILS_VERSION_2_39
+
+	config BINUTILS_USE_VERSION_2_40
+		bool "Binutils 2.40"
+		select BINUTILS_VERSION_2_40
 endchoice
 
 config EXTRA_BINUTILS_CONFIG_OPTIONS
diff --git a/toolchain/binutils/Config.version b/toolchain/binutils/Config.version
index a79b72e17fec8a..c9f85844808663 100644
--- a/toolchain/binutils/Config.version
+++ b/toolchain/binutils/Config.version
@@ -1,6 +1,5 @@
 
 config BINUTILS_VERSION_2_37
-	default y if !TOOLCHAINOPTS
 	bool
 
 config BINUTILS_VERSION_2_38
@@ -9,8 +8,13 @@ config BINUTILS_VERSION_2_38
 config BINUTILS_VERSION_2_39
 	bool
 
+config BINUTILS_VERSION_2_40
+	default y if !TOOLCHAINOPTS
+	bool
+
 config BINUTILS_VERSION
 	string
 	default "2.37"			if BINUTILS_VERSION_2_37
 	default "2.38"			if BINUTILS_VERSION_2_38
 	default "2.39"			if BINUTILS_VERSION_2_39
+	default "2.40"			if BINUTILS_VERSION_2_40
diff --git a/toolchain/binutils/Makefile b/toolchain/binutils/Makefile
index 2903f8a7917793..ae7e953eb9222b 100644
--- a/toolchain/binutils/Makefile
+++ b/toolchain/binutils/Makefile
@@ -15,22 +15,6 @@ PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 
 TAR_OPTIONS += --exclude='*.rej'
 
-ifeq ($(PKG_VERSION),2.32)
-  PKG_HASH:=0ab6c55dd86a92ed561972ba15b9b70a8b9f75557f896446c82e8b36e473ee04
-endif
-
-ifeq ($(PKG_VERSION),2.34)
-  PKG_HASH:=f00b0e8803dc9bab1e2165bd568528135be734df3fabf8d0161828cd56028952
-endif
-
-ifeq ($(PKG_VERSION),2.35.2)
-  PKG_HASH:=dcd5b0416e7b0a9b24bed76cd8c6c132526805761863150a26d016415b8bdc7b
-endif
-
-ifeq ($(PKG_VERSION),2.36.1)
-  PKG_HASH:=e81d9edf373f193af428a0f256674aea62a9d74dfe93f65192d4eae030b0f3b0
-endif
-
 ifeq ($(PKG_VERSION),2.37)
   PKG_HASH:=820d9724f020a3e69cb337893a0b63c2db161dadcb0e06fc11dc29eb1e84a32c
 endif
@@ -43,20 +27,34 @@ ifeq ($(PKG_VERSION),2.39)
   PKG_HASH:=645c25f563b8adc0a81dbd6a41cffbf4d37083a382e02d5d3df4f65c09516d00
 endif
 
+ifeq ($(PKG_VERSION),2.40)
+  PKG_HASH:=0f8a4c272d7f17f369ded10a4aca28b8e304828e95526da482b0ccc4dfc9d8e1
+endif
+
 HOST_BUILD_PARALLEL:=1
 
 PATCH_DIR:=./patches/$(PKG_VERSION)
 
 include $(INCLUDE_DIR)/toolchain-build.mk
 
+ifdef CONFIG_GCC_USE_GRAPHITE
+  GRAPHITE_CONFIGURE:= --with-isl=$(STAGING_DIR_HOST)
+else
+  GRAPHITE_CONFIGURE:= --without-isl --without-cloog
+endif
+
 HOST_CONFIGURE_ARGS = \
 	--prefix=$(TOOLCHAIN_DIR) \
 	--build=$(GNU_HOST_NAME) \
 	--host=$(GNU_HOST_NAME) \
 	--target=$(REAL_GNU_TARGET_NAME) \
 	--with-sysroot=$(TOOLCHAIN_DIR) \
+	--with-system-zlib \
+	--with-zstd \
 	--enable-deterministic-archives \
 	--enable-plugins \
+	--enable-lto \
+	--disable-gprofng \
 	--disable-multilib \
 	--disable-werror \
 	--disable-nls \
@@ -86,7 +84,6 @@ define Host/Prepare
 	$(call Host/Prepare/Default)
 	ln -snf $(notdir $(HOST_BUILD_DIR)) $(BUILD_DIR_TOOLCHAIN)/$(PKG_NAME)
 	$(CP) $(SCRIPT_DIR)/config.{guess,sub} $(HOST_BUILD_DIR)/
-	$(SED) 's, " Linaro.*,,' $(HOST_BUILD_DIR)/bfd/version.h
 endef
 
 define Host/Compile
@@ -94,22 +91,10 @@ define Host/Compile
 endef
 
 define Host/Install
-	mkdir -p $(TOOLCHAIN_DIR)/initial
-	$(MAKE) -C $(HOST_BUILD_DIR) \
-		prefix=$(TOOLCHAIN_DIR)/initial \
-		install
 	$(MAKE) -C $(HOST_BUILD_DIR) \
-		prefix=$(TOOLCHAIN_DIR) \
 		install
-	$(call FixupLibdir,$(TOOLCHAIN_DIR)/initial)
-	$(RM) $(TOOLCHAIN_DIR)/initial/lib/libiberty.a
+	$(call FixupLibdir,$(TOOLCHAIN_DIR))
 	$(CP) $(TOOLCHAIN_DIR)/bin/$(REAL_GNU_TARGET_NAME)-readelf $(HOST_BUILD_PREFIX)/bin/readelf
-	# ARC gcc requires extlib.
-	# If extlib is not available in "initial" folder
-	# initial gcc will fail to build libc.
-	if [ -d $(TOOLCHAIN_DIR)/extlib ]; then \
-		$(CP) -r $(TOOLCHAIN_DIR)/extlib $(TOOLCHAIN_DIR)/initial/; \
-	fi
 endef
 
 define Host/Clean
diff --git a/toolchain/binutils/patches/2.39/005-ld-fix-NEWS-typos.patch b/toolchain/binutils/patches/2.39/005-ld-fix-NEWS-typos.patch
new file mode 100644
index 00000000000000..39c61d931906b2
--- /dev/null
+++ b/toolchain/binutils/patches/2.39/005-ld-fix-NEWS-typos.patch
@@ -0,0 +1,27 @@
+From 9284b63ea39cecbfc1522d9e143ecb7727d77eb5 Mon Sep 17 00:00:00 2001
+From: Martin Liska <mliska@suse.cz>
+Date: Mon, 8 Aug 2022 13:22:26 +0200
+Subject: [PATCH 005/160] ld: fix NEWS typos
+
+ld/ChangeLog:
+
+	* NEWS: Fix 2 typos.
+---
+ ld/NEWS | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/ld/NEWS
++++ b/ld/NEWS
+@@ -27,10 +27,10 @@ Changes in 2.39:
+   --enable-warn-rwx-segments=no
+      will make --no-warn-rwx-segments enabled by default.
+      
+-  --enable-defaul-execstack=no
++  --enable-default-execstack=no
+      will stop the creation of an executable stack simply because an input file
+      is missing a .note.GNU-stack section, even on architectures where this
+-     ehaviour is the default.
++     behaviour is the default.
+ 
+ * TYPE=<type> is now supported in an output section description to set the
+   section type value.
diff --git a/toolchain/binutils/patches/2.39/008-gas-Dwarf-properly-skip-zero-size-functions.patch b/toolchain/binutils/patches/2.39/008-gas-Dwarf-properly-skip-zero-size-functions.patch
new file mode 100644
index 00000000000000..055da841295296
--- /dev/null
+++ b/toolchain/binutils/patches/2.39/008-gas-Dwarf-properly-skip-zero-size-functions.patch
@@ -0,0 +1,90 @@
+From e8cf73215187b0c08679d726a5cc7c019fa3ea2e Mon Sep 17 00:00:00 2001
+From: Jan Beulich <jbeulich@suse.com>
+Date: Wed, 10 Aug 2022 10:34:22 +0200
+Subject: [PATCH 008/160] gas/Dwarf: properly skip zero-size functions
+
+PR gas/29451
+
+While out_debug_abbrev() properly skips such functions, out_debug_info()
+mistakenly didn't. It needs to calculate the high_pc expression ahead of
+time, in order to skip emitting any data for the function if the value
+is zero.
+
+The one case which would still leave a zero-size entry is when
+symbol_get_obj(symp)->size ends up evaluating to zero. I hope we can
+expect that to not be the case, otherwise we'd need to have a way to
+post-process .debug_info contents between resolving expressions and
+actually writing the data out to the file. Even then it wouldn't be
+entirely obvious in which way to alter the data.
+
+(cherry picked from commit d7abcbcea5ddd40a3bf28758b62f35933c59f996)
+---
+ gas/dwarf2dbg.c | 39 ++++++++++++++++++++-------------------
+ 1 file changed, 20 insertions(+), 19 deletions(-)
+
+--- a/gas/dwarf2dbg.c
++++ b/gas/dwarf2dbg.c
+@@ -2882,6 +2882,7 @@ out_debug_info (segT info_seg, segT abbr
+ 	{
+ 	  const char *name;
+ 	  size_t len;
++	  expressionS size = { .X_op = O_constant };
+ 
+ 	  /* Skip warning constructs (see above).  */
+ 	  if (symbol_get_bfdsym (symp)->flags & BSF_WARNING)
+@@ -2895,6 +2896,18 @@ out_debug_info (segT info_seg, segT abbr
+ 	  if (!S_IS_DEFINED (symp) || !S_IS_FUNCTION (symp))
+ 	    continue;
+ 
++#if defined (OBJ_ELF) /* || defined (OBJ_MAYBE_ELF) */
++	  size.X_add_number = S_GET_SIZE (symp);
++	  if (size.X_add_number == 0 && IS_ELF
++	      && symbol_get_obj (symp)->size != NULL)
++	    {
++	      size.X_op = O_add;
++	      size.X_op_symbol = make_expr_symbol (symbol_get_obj (symp)->size);
++	    }
++#endif
++	  if (size.X_op == O_constant && size.X_add_number == 0)
++	    continue;
++
+ 	  subseg_set (str_seg, 0);
+ 	  name_sym = symbol_temp_new_now_octets ();
+ 	  name = S_GET_NAME (symp);
+@@ -2920,29 +2933,17 @@ out_debug_info (segT info_seg, segT abbr
+ 	  emit_expr (&exp, sizeof_address);
+ 
+ 	  /* DW_AT_high_pc */
+-	  exp.X_op = O_constant;
+-#if defined (OBJ_ELF) /* || defined (OBJ_MAYBE_ELF) */
+-	  exp.X_add_number = S_GET_SIZE (symp);
+-	  if (exp.X_add_number == 0 && IS_ELF
+-	      && symbol_get_obj (symp)->size != NULL)
+-	    {
+-	      exp.X_op = O_add;
+-	      exp.X_op_symbol = make_expr_symbol (symbol_get_obj (symp)->size);
+-	    }
+-#else
+-	  exp.X_add_number = 0;
+-#endif
+ 	  if (DWARF2_VERSION < 4)
+ 	    {
+-	      if (exp.X_op == O_constant)
+-		exp.X_op = O_symbol;
+-	      exp.X_add_symbol = symp;
+-	      emit_expr (&exp, sizeof_address);
++	      if (size.X_op == O_constant)
++		size.X_op = O_symbol;
++	      size.X_add_symbol = symp;
++	      emit_expr (&size, sizeof_address);
+ 	    }
+-	  else if (exp.X_op == O_constant)
+-	    out_uleb128 (exp.X_add_number);
++	  else if (size.X_op == O_constant)
++	    out_uleb128 (size.X_add_number);
+ 	  else
+-	    emit_leb128_expr (symbol_get_value_expression (exp.X_op_symbol), 0);
++	    emit_leb128_expr (symbol_get_value_expression (size.X_op_symbol), 0);
+ 	}
+ 
+       /* End of children.  */
diff --git a/toolchain/binutils/patches/2.39/009-PR29462-internal-error-in-relocate-at-powerpc.cc-107.patch b/toolchain/binutils/patches/2.39/009-PR29462-internal-error-in-relocate-at-powerpc.cc-107.patch
new file mode 100644
index 00000000000000..e325d3bcb09ea4
--- /dev/null
+++ b/toolchain/binutils/patches/2.39/009-PR29462-internal-error-in-relocate-at-powerpc.cc-107.patch
@@ -0,0 +1,270 @@
+From e3b5d935247084dca057dea72be61b063fe2357a Mon Sep 17 00:00:00 2001
+From: Alan Modra <amodra@gmail.com>
+Date: Wed, 10 Aug 2022 10:38:52 +0930
+Subject: [PATCH 009/160] PR29462, internal error in relocate, at
+ powerpc.cc:10796
+
+Prior to the inline plt call support (commit 08be322439), the only
+local syms with plt entries were local ifunc symbols.  There shouldn't
+be stubs for other local symbols so don't look for them.  The patch
+also fixes minor bugs in get_reference_flags; Many relocs are valid
+only for ppc64 and a couple only for ppc32.
+
+	PR 29462
+	* powerpc.cc (Target_powerpc::Relocate::relocate): Rename
+	use_plt_offset to pltcal_to_direct, invert logic.  For relocs
+	not used with inline plt sequences against local symbols, only
+	look for stubs when the symbol is an ifunc.
+	(Target_powerpc::Scan::get_reference_flags): Correct reloc
+	handling for relocs not valid for both 32-bit and 64-bit.
+
+(cherry picked from commit 6158b25f77db11712b84e6a4609898f2615ac749)
+---
+ gold/powerpc.cc | 129 ++++++++++++++++++++++++++++--------------------
+ 1 file changed, 75 insertions(+), 54 deletions(-)
+
+--- a/gold/powerpc.cc
++++ b/gold/powerpc.cc
+@@ -7675,22 +7675,18 @@ Target_powerpc<size, big_endian>::Scan::
+ 
+   switch (r_type)
+     {
++    case elfcpp::R_PPC64_TOC:
++      if (size != 64)
++	break;
++      // Fall through.
+     case elfcpp::R_POWERPC_NONE:
+     case elfcpp::R_POWERPC_GNU_VTINHERIT:
+     case elfcpp::R_POWERPC_GNU_VTENTRY:
+-    case elfcpp::R_PPC64_TOC:
+       // No symbol reference.
+       break;
+ 
+     case elfcpp::R_PPC64_ADDR64:
+     case elfcpp::R_PPC64_UADDR64:
+-    case elfcpp::R_POWERPC_ADDR32:
+-    case elfcpp::R_POWERPC_UADDR32:
+-    case elfcpp::R_POWERPC_ADDR16:
+-    case elfcpp::R_POWERPC_UADDR16:
+-    case elfcpp::R_POWERPC_ADDR16_LO:
+-    case elfcpp::R_POWERPC_ADDR16_HI:
+-    case elfcpp::R_POWERPC_ADDR16_HA:
+     case elfcpp::R_PPC64_ADDR16_HIGHER34:
+     case elfcpp::R_PPC64_ADDR16_HIGHERA34:
+     case elfcpp::R_PPC64_ADDR16_HIGHEST34:
+@@ -7700,6 +7696,16 @@ Target_powerpc<size, big_endian>::Scan::
+     case elfcpp::R_PPC64_D34_HI30:
+     case elfcpp::R_PPC64_D34_HA30:
+     case elfcpp::R_PPC64_D28:
++      if (size != 64)
++	break;
++      // Fall through.
++    case elfcpp::R_POWERPC_ADDR32:
++    case elfcpp::R_POWERPC_UADDR32:
++    case elfcpp::R_POWERPC_ADDR16:
++    case elfcpp::R_POWERPC_UADDR16:
++    case elfcpp::R_POWERPC_ADDR16_LO:
++    case elfcpp::R_POWERPC_ADDR16_HI:
++    case elfcpp::R_POWERPC_ADDR16_HA:
+       ref = Symbol::ABSOLUTE_REF;
+       break;
+ 
+@@ -7710,13 +7716,14 @@ Target_powerpc<size, big_endian>::Scan::
+       ref = Symbol::FUNCTION_CALL | Symbol::ABSOLUTE_REF;
+       break;
+ 
+-    case elfcpp::R_PPC64_REL64:
+-    case elfcpp::R_POWERPC_REL32:
+     case elfcpp::R_PPC_LOCAL24PC:
+-    case elfcpp::R_POWERPC_REL16:
+-    case elfcpp::R_POWERPC_REL16_LO:
+-    case elfcpp::R_POWERPC_REL16_HI:
+-    case elfcpp::R_POWERPC_REL16_HA:
++      if (size != 32)
++	break;
++      // Fall through.
++      ref = Symbol::RELATIVE_REF;
++      break;
++
++    case elfcpp::R_PPC64_REL64:
+     case elfcpp::R_PPC64_REL16_HIGH:
+     case elfcpp::R_PPC64_REL16_HIGHA:
+     case elfcpp::R_PPC64_REL16_HIGHER:
+@@ -7729,36 +7736,45 @@ Target_powerpc<size, big_endian>::Scan::
+     case elfcpp::R_PPC64_REL16_HIGHEST34:
+     case elfcpp::R_PPC64_REL16_HIGHESTA34:
+     case elfcpp::R_PPC64_PCREL28:
++      if (size != 64)
++	break;
++      // Fall through.
++    case elfcpp::R_POWERPC_REL32:
++    case elfcpp::R_POWERPC_REL16:
++    case elfcpp::R_POWERPC_REL16_LO:
++    case elfcpp::R_POWERPC_REL16_HI:
++    case elfcpp::R_POWERPC_REL16_HA:
+       ref = Symbol::RELATIVE_REF;
+       break;
+ 
++    case elfcpp::R_PPC_PLTREL24:
++      if (size != 32)
++	break;
++      ref = Symbol::FUNCTION_CALL | Symbol::RELATIVE_REF;
++      break;
++
+     case elfcpp::R_PPC64_REL24_NOTOC:
+-      if (size == 32)
++    case elfcpp::R_PPC64_REL24_P9NOTOC:
++    case elfcpp::R_PPC64_PLT16_LO_DS:
++    case elfcpp::R_PPC64_PLTSEQ_NOTOC:
++    case elfcpp::R_PPC64_PLTCALL_NOTOC:
++    case elfcpp::R_PPC64_PLT_PCREL34:
++    case elfcpp::R_PPC64_PLT_PCREL34_NOTOC:
++      if (size != 64)
+ 	break;
+       // Fall through.
+-    case elfcpp::R_PPC64_REL24_P9NOTOC:
+     case elfcpp::R_POWERPC_REL24:
+-    case elfcpp::R_PPC_PLTREL24:
+     case elfcpp::R_POWERPC_REL14:
+     case elfcpp::R_POWERPC_REL14_BRTAKEN:
+     case elfcpp::R_POWERPC_REL14_BRNTAKEN:
+     case elfcpp::R_POWERPC_PLT16_LO:
+     case elfcpp::R_POWERPC_PLT16_HI:
+     case elfcpp::R_POWERPC_PLT16_HA:
+-    case elfcpp::R_PPC64_PLT16_LO_DS:
+     case elfcpp::R_POWERPC_PLTSEQ:
+-    case elfcpp::R_PPC64_PLTSEQ_NOTOC:
+     case elfcpp::R_POWERPC_PLTCALL:
+-    case elfcpp::R_PPC64_PLTCALL_NOTOC:
+-    case elfcpp::R_PPC64_PLT_PCREL34:
+-    case elfcpp::R_PPC64_PLT_PCREL34_NOTOC:
+       ref = Symbol::FUNCTION_CALL | Symbol::RELATIVE_REF;
+       break;
+ 
+-    case elfcpp::R_POWERPC_GOT16:
+-    case elfcpp::R_POWERPC_GOT16_LO:
+-    case elfcpp::R_POWERPC_GOT16_HI:
+-    case elfcpp::R_POWERPC_GOT16_HA:
+     case elfcpp::R_PPC64_GOT16_DS:
+     case elfcpp::R_PPC64_GOT16_LO_DS:
+     case elfcpp::R_PPC64_GOT_PCREL34:
+@@ -7768,11 +7784,16 @@ Target_powerpc<size, big_endian>::Scan::
+     case elfcpp::R_PPC64_TOC16_HA:
+     case elfcpp::R_PPC64_TOC16_DS:
+     case elfcpp::R_PPC64_TOC16_LO_DS:
++      if (size != 64)
++	break;
++      // Fall through.
++    case elfcpp::R_POWERPC_GOT16:
++    case elfcpp::R_POWERPC_GOT16_LO:
++    case elfcpp::R_POWERPC_GOT16_HI:
++    case elfcpp::R_POWERPC_GOT16_HA:
+       ref = Symbol::RELATIVE_REF;
+       break;
+ 
+-    case elfcpp::R_POWERPC_GOT_TPREL16:
+-    case elfcpp::R_POWERPC_TLS:
+     case elfcpp::R_PPC64_TLSGD:
+     case elfcpp::R_PPC64_TLSLD:
+     case elfcpp::R_PPC64_TPREL34:
+@@ -7781,6 +7802,11 @@ Target_powerpc<size, big_endian>::Scan::
+     case elfcpp::R_PPC64_GOT_TLSLD_PCREL34:
+     case elfcpp::R_PPC64_GOT_TPREL_PCREL34:
+     case elfcpp::R_PPC64_GOT_DTPREL_PCREL34:
++      if (size != 64)
++	break;
++      // Fall through.
++    case elfcpp::R_POWERPC_GOT_TPREL16:
++    case elfcpp::R_POWERPC_TLS:
+       ref = Symbol::TLS_REF;
+       break;
+ 
+@@ -10671,10 +10697,8 @@ Target_powerpc<size, big_endian>::Reloca
+   bool has_stub_value = false;
+   bool localentry0 = false;
+   unsigned int r_sym = elfcpp::elf_r_sym<size>(rela.get_r_info());
+-  bool use_plt_offset
+-    = (gsym != NULL
+-       ? gsym->use_plt_offset(Scan::get_reference_flags(r_type, target))
+-       : object->local_has_plt_offset(r_sym));
++  bool pltcall_to_direct = false;
++
+   if (is_plt16_reloc<size>(r_type)
+       || r_type == elfcpp::R_PPC64_PLT_PCREL34
+       || r_type == elfcpp::R_PPC64_PLT_PCREL34_NOTOC
+@@ -10688,21 +10712,18 @@ Target_powerpc<size, big_endian>::Reloca
+       // that the decision depends on the PLTCALL reloc, and we don't
+       // know the address of that instruction when processing others
+       // in the sequence.  So the decision needs to be made in
+-      // do_relax().  For now, don't optimise inline plt calls.
+-      if (gsym)
+-	use_plt_offset = gsym->has_plt_offset();
+-    }
+-  if (use_plt_offset
+-      && !is_got_reloc(r_type)
+-      && !is_plt16_reloc<size>(r_type)
+-      && r_type != elfcpp::R_PPC64_PLT_PCREL34
+-      && r_type != elfcpp::R_PPC64_PLT_PCREL34_NOTOC
+-      && r_type != elfcpp::R_POWERPC_PLTSEQ
+-      && r_type != elfcpp::R_POWERPC_PLTCALL
+-      && r_type != elfcpp::R_PPC64_PLTSEQ_NOTOC
+-      && r_type != elfcpp::R_PPC64_PLTCALL_NOTOC
+-      && (!psymval->is_ifunc_symbol()
+-	  || Scan::reloc_needs_plt_for_ifunc(target, object, r_type, false)))
++      // do_relax().
++      pltcall_to_direct = !(gsym != NULL
++			    ? gsym->has_plt_offset()
++			    : object->local_has_plt_offset(r_sym));
++    }
++  else if ((gsym != NULL
++	    ? gsym->use_plt_offset(Scan::get_reference_flags(r_type, target))
++	    : psymval->is_ifunc_symbol() && object->local_has_plt_offset(r_sym))
++	   && !is_got_reloc(r_type)
++	   && (!psymval->is_ifunc_symbol()
++	       || Scan::reloc_needs_plt_for_ifunc(target, object, r_type,
++						  false)))
+     {
+       if (size == 64
+ 	  && gsym != NULL
+@@ -10796,9 +10817,9 @@ Target_powerpc<size, big_endian>::Reloca
+       gold_assert(has_stub_value || !(os->flags() & elfcpp::SHF_ALLOC));
+     }
+ 
+-  if (use_plt_offset && (is_plt16_reloc<size>(r_type)
+-			 || r_type == elfcpp::R_PPC64_PLT_PCREL34
+-			 || r_type == elfcpp::R_PPC64_PLT_PCREL34_NOTOC))
++  if (!pltcall_to_direct && (is_plt16_reloc<size>(r_type)
++			     || r_type == elfcpp::R_PPC64_PLT_PCREL34
++			     || r_type == elfcpp::R_PPC64_PLT_PCREL34_NOTOC))
+     {
+       const Output_data_plt_powerpc<size, big_endian>* plt;
+       if (gsym)
+@@ -10826,7 +10847,7 @@ Target_powerpc<size, big_endian>::Reloca
+ 	    value -= target->toc_pointer();
+ 	}
+     }
+-  else if (!use_plt_offset
++  else if (pltcall_to_direct
+ 	   && (is_plt16_reloc<size>(r_type)
+ 	       || r_type == elfcpp::R_POWERPC_PLTSEQ
+ 	       || r_type == elfcpp::R_PPC64_PLTSEQ_NOTOC))
+@@ -10835,7 +10856,7 @@ Target_powerpc<size, big_endian>::Reloca
+       elfcpp::Swap<32, big_endian>::writeval(iview, nop);
+       r_type = elfcpp::R_POWERPC_NONE;
+     }
+-  else if (!use_plt_offset
++  else if (pltcall_to_direct
+ 	   && (r_type == elfcpp::R_PPC64_PLT_PCREL34
+ 	       || r_type == elfcpp::R_PPC64_PLT_PCREL34_NOTOC))
+     {
+@@ -11316,8 +11337,8 @@ Target_powerpc<size, big_endian>::Reloca
+     }
+   else if (!has_stub_value)
+     {
+-      if (!use_plt_offset && (r_type == elfcpp::R_POWERPC_PLTCALL
+-			      || r_type == elfcpp::R_PPC64_PLTCALL_NOTOC))
++      if (pltcall_to_direct && (r_type == elfcpp::R_POWERPC_PLTCALL
++				|| r_type == elfcpp::R_PPC64_PLTCALL_NOTOC))
+ 	{
+ 	  // PLTCALL without plt entry => convert to direct call
+ 	  Insn* iview = reinterpret_cast<Insn*>(view);
diff --git a/toolchain/binutils/patches/2.39/011-PR29466-APP-NO_APP-with-.linefile.patch b/toolchain/binutils/patches/2.39/011-PR29466-APP-NO_APP-with-.linefile.patch
new file mode 100644
index 00000000000000..f7b58199290e26
--- /dev/null
+++ b/toolchain/binutils/patches/2.39/011-PR29466-APP-NO_APP-with-.linefile.patch
@@ -0,0 +1,167 @@
+From 9e855cffa1fda44629e7f9b76dfa3e5a51a440e9 Mon Sep 17 00:00:00 2001
+From: Alan Modra <amodra@gmail.com>
+Date: Thu, 11 Aug 2022 09:51:03 +0930
+Subject: [PATCH 011/160] PR29466, APP/NO_APP with .linefile
+
+Commit 53f2b36a54b9 exposed a bug in sb_scrub_and_add_sb that could
+result in losing input.  If scrubbing results in expansion past the
+holding capacity of do_scrub_chars output buffer, then do_scrub_chars
+stashes the extra input for the next call.  That call never came
+because sb_scrub_and_add_sb wrongly decided it was done.  Fix that by
+allowing sb_scrub_and_add_sb to see whether there is pending input.
+Also allow a little extra space so that in most cases we won't need
+to resize the output buffer.
+
+sb_scrub_and_add_sb also limited output to the size of the input,
+rather than the actual output buffer size.  Fixing that resulted in a
+fail of gas/testsuite/macros/dot with an extra warning: "end of file
+not at end of a line; newline inserted".  OK, so the macro in dot.s
+really does finish without end-of-line.  Apparently the macro
+expansion code relied on do_scrub_chars returning early.  So fix that
+too by adding a newline if needed in macro_expand_body.
+
+	PR 29466
+	* app.c (do_scrub_pending): New function.
+	* as.h: Declare it.
+	* input-scrub.c (input_scrub_include_sb): Add extra space for
+	two .linefile directives.
+	* sb.c (sb_scrub_and_add_sb): Take into account pending input.
+	Allow output to max.
+	* macro.c (macro_expand_body): Add terminating newline.
+	* testsuite/config/default.exp (SIZE, SIZEFLAGS): Define.
+	* testsuite/gas/macros/app5.d,
+	* testsuite/gas/macros/app5.s: New test.
+	* testsuite/gas/macros/macros.exp: Run it.
+
+(cherry picked from commit 4d74aab7aa562fe79d4669cdad0c32610531cbc0)
+---
+ gas/app.c                           | 13 +++++++++++++
+ gas/as.h                            |  1 +
+ gas/input-scrub.c                   |  6 ++++--
+ gas/macro.c                         |  2 ++
+ gas/sb.c                            |  5 +++--
+ gas/testsuite/config/default.exp    |  8 ++++++++
+ gas/testsuite/gas/macros/app5.d     |  6 ++++++
+ gas/testsuite/gas/macros/app5.s     |  5 +++++
+ gas/testsuite/gas/macros/macros.exp |  1 +
+ 9 files changed, 43 insertions(+), 4 deletions(-)
+ create mode 100644 gas/testsuite/gas/macros/app5.d
+ create mode 100644 gas/testsuite/gas/macros/app5.s
+
+--- a/gas/app.c
++++ b/gas/app.c
+@@ -1537,3 +1537,16 @@ do_scrub_chars (size_t (*get) (char *, s
+     last_char = to[-1];
+   return to - tostart;
+ }
++
++/* Return amount of pending input.  */
++
++size_t
++do_scrub_pending (void)
++{
++  size_t len = 0;
++  if (saved_input)
++    len += saved_input_len;
++  if (state == -1)
++    len += strlen (out_string);
++  return len;
++}
+--- a/gas/as.h
++++ b/gas/as.h
+@@ -460,6 +460,7 @@ void   input_scrub_insert_file (char *);
+ char * input_scrub_new_file (const char *);
+ char * input_scrub_next_buffer (char **bufp);
+ size_t do_scrub_chars (size_t (*get) (char *, size_t), char *, size_t);
++size_t do_scrub_pending (void);
+ bool   scan_for_multibyte_characters (const unsigned char *, const unsigned char *, bool);
+ int    gen_to_words (LITTLENUM_TYPE *, int, long);
+ int    had_err (void);
+--- a/gas/input-scrub.c
++++ b/gas/input-scrub.c
+@@ -278,9 +278,11 @@ input_scrub_include_sb (sb *from, char *
+ 
+   next_saved_file = input_scrub_push (position);
+ 
+-  /* Allocate sufficient space: from->len + optional newline.  */
++  /* Allocate sufficient space: from->len plus optional newline
++     plus two ".linefile " directives, plus a little more for other
++     expansion.  */
+   newline = from->len >= 1 && from->ptr[0] != '\n';
+-  sb_build (&from_sb, from->len + newline);
++  sb_build (&from_sb, from->len + newline + 2 * sizeof (".linefile") + 30);
+   if (expansion == expanding_repeat && from_sb_expansion >= expanding_macro)
+     expansion = expanding_nested;
+   from_sb_expansion = expansion;
+--- a/gas/macro.c
++++ b/gas/macro.c
+@@ -1056,6 +1056,8 @@ macro_expand_body (sb *in, sb *out, form
+       loclist = f;
+     }
+ 
++  if (!err && (out->len == 0 || out->ptr[out->len - 1] != '\n'))
++    sb_add_char (out, '\n');
+   return err;
+ }
+ 
+--- a/gas/sb.c
++++ b/gas/sb.c
+@@ -119,11 +119,12 @@ sb_scrub_and_add_sb (sb *ptr, sb *s)
+      So we loop until the input S is consumed.  */
+   while (1)
+     {
+-      size_t copy = s->len - (scrub_position - s->ptr);
++      size_t copy = s->len - (scrub_position - s->ptr) + do_scrub_pending ();
+       if (copy == 0)
+ 	break;
+       sb_check (ptr, copy);
+-      ptr->len += do_scrub_chars (scrub_from_sb, ptr->ptr + ptr->len, copy);
++      ptr->len += do_scrub_chars (scrub_from_sb, ptr->ptr + ptr->len,
++				  ptr->max - ptr->len);
+     }
+ 
+   sb_to_scrub = 0;
+--- a/gas/testsuite/config/default.exp
++++ b/gas/testsuite/config/default.exp
+@@ -52,6 +52,14 @@ if ![info exists NMFLAGS] then {
+     set NMFLAGS {}
+ }
+ 
++if ![info exists SIZE] then {
++    set SIZE [findfile $base_dir/size]
++}
++
++if ![info exists SIZEFLAGS] then {
++    set SIZEFLAGS ""
++}
++
+ if ![info exists OBJCOPY] then {
+     set OBJCOPY [findfile $base_dir/../../binutils/objcopy]
+ }
+--- /dev/null
++++ b/gas/testsuite/gas/macros/app5.d
+@@ -0,0 +1,6 @@
++#name: APP with linefile
++#xfail: tic30-*-*
++#size: -G
++# pr29466 just check that the test assembles
++
++#pass
+--- /dev/null
++++ b/gas/testsuite/gas/macros/app5.s
+@@ -0,0 +1,5 @@
++#NO_APP
++#APP
++# 5 "foo.c" 1
++# 0 "" 2
++#NO_APP
+--- a/gas/testsuite/gas/macros/macros.exp
++++ b/gas/testsuite/gas/macros/macros.exp
+@@ -70,6 +70,7 @@ run_dump_test app2
+ run_dump_test app3
+ remote_download host "$srcdir/$subdir/app4b.s"
+ run_dump_test app4
++run_dump_test app5
+ 
+ run_list_test badarg ""
+ 
diff --git a/toolchain/binutils/patches/2.39/039-LoongArch-ld-Fix-relocation-error-of-pcrel.patch b/toolchain/binutils/patches/2.39/039-LoongArch-ld-Fix-relocation-error-of-pcrel.patch
new file mode 100644
index 00000000000000..67e499de673610
--- /dev/null
+++ b/toolchain/binutils/patches/2.39/039-LoongArch-ld-Fix-relocation-error-of-pcrel.patch
@@ -0,0 +1,128 @@
+From 509a2ec6ad3ea7eb3f4cf59538cf636a2126e4c3 Mon Sep 17 00:00:00 2001
+From: liuzhensong <liuzhensong@loongson.cn>
+Date: Fri, 2 Sep 2022 16:29:14 +0800
+Subject: [PATCH 039/160] LoongArch:ld: Fix relocation error of pcrel.
+
+  Patch for branch 2.39.
+  Need to reduce the address of pc when using
+  reloction R_LARCH_SOP_PUSH_PCREL.
+
+  bfd/
+    * elfnn-loongarch.c
+---
+ bfd/elfnn-loongarch.c                         |  3 +-
+ ld/testsuite/ld-loongarch-elf/pcrel-const.d   | 14 +++++++
+ ld/testsuite/ld-loongarch-elf/pcrel-const.lds | 14 +++++++
+ ld/testsuite/ld-loongarch-elf/pcrel-const.s   | 12 ++++++
+ ld/testsuite/ld-loongarch-elf/pr.exp          | 39 +++++++++++++++++++
+ 5 files changed, 81 insertions(+), 1 deletion(-)
+ create mode 100644 ld/testsuite/ld-loongarch-elf/pcrel-const.d
+ create mode 100644 ld/testsuite/ld-loongarch-elf/pcrel-const.lds
+ create mode 100644 ld/testsuite/ld-loongarch-elf/pcrel-const.s
+ create mode 100644 ld/testsuite/ld-loongarch-elf/pr.exp
+
+--- a/bfd/elfnn-loongarch.c
++++ b/bfd/elfnn-loongarch.c
+@@ -2341,9 +2341,10 @@ loongarch_elf_relocate_section (bfd *out
+ 	case R_LARCH_SOP_PUSH_PLT_PCREL:
+ 	  unresolved_reloc = false;
+ 
+-	  if (resolved_to_const)
++	  if (!is_undefweak && resolved_to_const)
+ 	    {
+ 	      relocation += rel->r_addend;
++	      relocation -= pc;
+ 	      break;
+ 	    }
+ 	  else if (is_undefweak)
+--- /dev/null
++++ b/ld/testsuite/ld-loongarch-elf/pcrel-const.d
+@@ -0,0 +1,14 @@
++#as: -mla-global-with-pcrel
++#objdump: -Drsz
++
++.*:[    ]+file format .*
++
++
++Disassembly of section .text:
++
++.* <foo>:
++#...
++[ 	]+8:[ 	]+02c04084[ 	]+addi.d[ 	]+\$a0,[ 	]+\$a0,[ 	]+16\(0x10\)
++#...
++0+14 <__sec_end>:
++#pass
+--- /dev/null
++++ b/ld/testsuite/ld-loongarch-elf/pcrel-const.lds
+@@ -0,0 +1,14 @@
++ENTRY(foo);
++SECTIONS
++{
++	.text : {
++		*(.text*)
++	}
++
++	.data : {
++		__sec_start = .;
++		*(.gzdata)
++		__sec_end = .;
++	}
++}
++PROVIDE(__sec_size = __sec_end);
+--- /dev/null
++++ b/ld/testsuite/ld-loongarch-elf/pcrel-const.s
+@@ -0,0 +1,12 @@
++	.text
++	.align	2
++	.globl	foo
++	.type	foo, @function
++foo:
++	nop
++	la.global	$r4,__sec_size
++	ldptr.w	$r4,$r4,0
++	jr	$r1
++	.size	foo, .-foo
++	.data
++	.word 1
+--- /dev/null
++++ b/ld/testsuite/ld-loongarch-elf/pr.exp
+@@ -0,0 +1,39 @@
++# Expect script for LoongArch ELF linker tests
++#   Copyright (C) 2022 Free Software Foundation, Inc.
++#
++# This file is part of the GNU Binutils.
++#
++# This program is free software; you can redistribute it and/or modify
++# it under the terms of the GNU General Public License as published by
++# the Free Software Foundation; either version 3 of the License, or
++# (at your option) any later version.
++#
++# This program is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++# GNU General Public License for more details.
++#
++# You should have received a copy of the GNU General Public License
++# along with this program; if not, write to the Free Software
++# Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston,
++# MA 02110-1301, USA.
++#
++
++if ![istarget loongarch64-*-*] {
++  return
++}
++
++set link_tests [list \
++  [list \
++    "pcrel const" \
++    "-T pcrel-const.lds" "" \
++    "-mla-global-with-pcrel" \
++    { pcrel-const.s } \
++    [list \
++      [list objdump -D pcrel-const.d] \
++    ] \
++    "pcrel-const" \
++  ] \
++]
++
++run_ld_link_tests $link_tests
diff --git a/toolchain/binutils/patches/2.39/043-Re-PR29466-APP-NO_APP-with-linefile.patch b/toolchain/binutils/patches/2.39/043-Re-PR29466-APP-NO_APP-with-linefile.patch
new file mode 100644
index 00000000000000..1de501a1ae4090
--- /dev/null
+++ b/toolchain/binutils/patches/2.39/043-Re-PR29466-APP-NO_APP-with-linefile.patch
@@ -0,0 +1,27 @@
+From 4233be14a34d754a70b8b6f6fa42d21f35c6e030 Mon Sep 17 00:00:00 2001
+From: Alan Modra <amodra@gmail.com>
+Date: Sat, 10 Sep 2022 07:30:57 +0930
+Subject: [PATCH 043/160] Re: PR29466, APP/NO_APP with linefile
+
+It looks like I copied the SIZE init across from
+binutils/testsuite/config/default.exp without some necessary editing.
+
+	PR 29466
+	* testsuite/config/default.exp (SIZE): Adjust relative path.
+
+(cherry picked from commit 1180f540d5f2f7751b5309bdd6c38d69fcf699e7)
+---
+ gas/testsuite/config/default.exp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/gas/testsuite/config/default.exp
++++ b/gas/testsuite/config/default.exp
+@@ -53,7 +53,7 @@ if ![info exists NMFLAGS] then {
+ }
+ 
+ if ![info exists SIZE] then {
+-    set SIZE [findfile $base_dir/size]
++    set SIZE [findfile $base_dir/../../binutils/size]
+ }
+ 
+ if ![info exists SIZEFLAGS] then {
diff --git a/toolchain/binutils/patches/2.39/050-PowerPC64-pcrel-got-relocs-against-local-symbols.patch b/toolchain/binutils/patches/2.39/050-PowerPC64-pcrel-got-relocs-against-local-symbols.patch
new file mode 100644
index 00000000000000..5c89f6804e528a
--- /dev/null
+++ b/toolchain/binutils/patches/2.39/050-PowerPC64-pcrel-got-relocs-against-local-symbols.patch
@@ -0,0 +1,38 @@
+From 4d7bba23a39fba18d6d13a2941a3c232011a7064 Mon Sep 17 00:00:00 2001
+From: Alan Modra <amodra@gmail.com>
+Date: Fri, 16 Sep 2022 18:08:44 +0930
+Subject: [PATCH 050/160] PowerPC64 pcrel got relocs against local symbols
+
+Not that anyone would want to indirect via the GOT when an address can
+be loaded directly with pla, the following:
+
+ pld 3,x@got@pcrel
+x:
+
+leads to "Internal error in md_apply_fix", because the generic parts
+of assembler fixup handling convert the fx_pcrel fixup to one without
+a symbol.  Stop that happening.
+
+	* config/tc-ppc.c (ppc_force_relocation): Add PLT_PCREL34 and
+	assorted GOT_PCREL34 relocs.
+
+(cherry picked from commit 49c3ed081fed6b8e2b48fdc48f805f11e4589514)
+---
+ gas/config/tc-ppc.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/gas/config/tc-ppc.c
++++ b/gas/config/tc-ppc.c
+@@ -6676,6 +6676,12 @@ ppc_force_relocation (fixS *fix)
+     case BFD_RELOC_PPC_BA16_BRNTAKEN:
+     case BFD_RELOC_24_PLT_PCREL:
+     case BFD_RELOC_PPC64_TOC:
++    case BFD_RELOC_PPC64_PLT_PCREL34:
++    case BFD_RELOC_PPC64_GOT_PCREL34:
++    case BFD_RELOC_PPC64_GOT_TLSGD_PCREL34:
++    case BFD_RELOC_PPC64_GOT_TLSLD_PCREL34:
++    case BFD_RELOC_PPC64_GOT_TPREL_PCREL34:
++    case BFD_RELOC_PPC64_GOT_DTPREL_PCREL34:
+       return 1;
+     case BFD_RELOC_PPC_B26:
+     case BFD_RELOC_PPC_BA26:
diff --git a/toolchain/binutils/patches/2.39/055-Re-PowerPC64-pcrel-got-relocs-against-local-symbols.patch b/toolchain/binutils/patches/2.39/055-Re-PowerPC64-pcrel-got-relocs-against-local-symbols.patch
new file mode 100644
index 00000000000000..19b80c3442b5c6
--- /dev/null
+++ b/toolchain/binutils/patches/2.39/055-Re-PowerPC64-pcrel-got-relocs-against-local-symbols.patch
@@ -0,0 +1,94 @@
+From 010db38b54b589ca3e95b498aba2831064970171 Mon Sep 17 00:00:00 2001
+From: Alan Modra <amodra@gmail.com>
+Date: Wed, 21 Sep 2022 09:06:29 +0930
+Subject: [PATCH 055/160] Re: PowerPC64 pcrel got relocs against local symbols
+
+The last patch wasn't all that shiny.  There are rather a lot more
+relocations that can hit the assertion in md_apply_fix if the symbol
+is local or absolute.  Fix them all.
+
+	* config/tc-ppc.c (ppc_force_relocation): Add all relocs that
+	expect a symbol in md_apply_fix.  Remove tls pcrel relocs
+	already covered in general tls match range.
+
+(cherry picked from commit 8b168f1a1e09e337d2a970f204a0230c091bbe58)
+---
+ gas/config/tc-ppc.c | 58 ++++++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 52 insertions(+), 6 deletions(-)
+
+--- a/gas/config/tc-ppc.c
++++ b/gas/config/tc-ppc.c
+@@ -6666,8 +6666,6 @@ ppc_force_relocation (fixS *fix)
+ int
+ ppc_force_relocation (fixS *fix)
+ {
+-  /* Branch prediction relocations must force a relocation, as must
+-     the vtable description relocs.  */
+   switch (fix->fx_r_type)
+     {
+     case BFD_RELOC_PPC_B16_BRTAKEN:
+@@ -6676,12 +6674,60 @@ ppc_force_relocation (fixS *fix)
+     case BFD_RELOC_PPC_BA16_BRNTAKEN:
+     case BFD_RELOC_24_PLT_PCREL:
+     case BFD_RELOC_PPC64_TOC:
++    case BFD_RELOC_16_GOTOFF:
++    case BFD_RELOC_LO16_GOTOFF:
++    case BFD_RELOC_HI16_GOTOFF:
++    case BFD_RELOC_HI16_S_GOTOFF:
++    case BFD_RELOC_LO16_PLTOFF:
++    case BFD_RELOC_HI16_PLTOFF:
++    case BFD_RELOC_HI16_S_PLTOFF:
++    case BFD_RELOC_GPREL16:
++    case BFD_RELOC_16_BASEREL:
++    case BFD_RELOC_LO16_BASEREL:
++    case BFD_RELOC_HI16_BASEREL:
++    case BFD_RELOC_HI16_S_BASEREL:
++    case BFD_RELOC_PPC_TOC16:
++    case BFD_RELOC_PPC64_TOC16_LO:
++    case BFD_RELOC_PPC64_TOC16_HI:
++    case BFD_RELOC_PPC64_TOC16_HA:
++    case BFD_RELOC_PPC64_PLTGOT16:
++    case BFD_RELOC_PPC64_PLTGOT16_LO:
++    case BFD_RELOC_PPC64_PLTGOT16_HI:
++    case BFD_RELOC_PPC64_PLTGOT16_HA:
++    case BFD_RELOC_PPC64_GOT16_DS:
++    case BFD_RELOC_PPC64_GOT16_LO_DS:
++    case BFD_RELOC_PPC64_PLT16_LO_DS:
++    case BFD_RELOC_PPC64_SECTOFF_DS:
++    case BFD_RELOC_PPC64_SECTOFF_LO_DS:
++    case BFD_RELOC_PPC64_TOC16_DS:
++    case BFD_RELOC_PPC64_TOC16_LO_DS:
++    case BFD_RELOC_PPC64_PLTGOT16_DS:
++    case BFD_RELOC_PPC64_PLTGOT16_LO_DS:
++    case BFD_RELOC_PPC_EMB_NADDR16:
++    case BFD_RELOC_PPC_EMB_NADDR16_LO:
++    case BFD_RELOC_PPC_EMB_NADDR16_HI:
++    case BFD_RELOC_PPC_EMB_NADDR16_HA:
++    case BFD_RELOC_PPC_EMB_SDAI16:
++    case BFD_RELOC_PPC_EMB_SDA2I16:
++    case BFD_RELOC_PPC_EMB_SDA2REL:
++    case BFD_RELOC_PPC_EMB_SDA21:
++    case BFD_RELOC_PPC_EMB_MRKREF:
++    case BFD_RELOC_PPC_EMB_RELSEC16:
++    case BFD_RELOC_PPC_EMB_RELST_LO:
++    case BFD_RELOC_PPC_EMB_RELST_HI:
++    case BFD_RELOC_PPC_EMB_RELST_HA:
++    case BFD_RELOC_PPC_EMB_BIT_FLD:
++    case BFD_RELOC_PPC_EMB_RELSDA:
++    case BFD_RELOC_PPC_VLE_SDA21:
++    case BFD_RELOC_PPC_VLE_SDA21_LO:
++    case BFD_RELOC_PPC_VLE_SDAREL_LO16A:
++    case BFD_RELOC_PPC_VLE_SDAREL_LO16D:
++    case BFD_RELOC_PPC_VLE_SDAREL_HI16A:
++    case BFD_RELOC_PPC_VLE_SDAREL_HI16D:
++    case BFD_RELOC_PPC_VLE_SDAREL_HA16A:
++    case BFD_RELOC_PPC_VLE_SDAREL_HA16D:
+     case BFD_RELOC_PPC64_PLT_PCREL34:
+     case BFD_RELOC_PPC64_GOT_PCREL34:
+-    case BFD_RELOC_PPC64_GOT_TLSGD_PCREL34:
+-    case BFD_RELOC_PPC64_GOT_TLSLD_PCREL34:
+-    case BFD_RELOC_PPC64_GOT_TPREL_PCREL34:
+-    case BFD_RELOC_PPC64_GOT_DTPREL_PCREL34:
+       return 1;
+     case BFD_RELOC_PPC_B26:
+     case BFD_RELOC_PPC_BA26:
diff --git a/toolchain/binutils/patches/2.39/058-elf-Reset-alignment-for-each-PT_LOAD-segment.patch b/toolchain/binutils/patches/2.39/058-elf-Reset-alignment-for-each-PT_LOAD-segment.patch
new file mode 100644
index 00000000000000..aaf7a1b053cfce
--- /dev/null
+++ b/toolchain/binutils/patches/2.39/058-elf-Reset-alignment-for-each-PT_LOAD-segment.patch
@@ -0,0 +1,89 @@
+From a98316d5cf970cbc99689797d84c2ea832bcdcbb Mon Sep 17 00:00:00 2001
+From: "H.J. Lu" <hjl.tools@gmail.com>
+Date: Mon, 1 Aug 2022 16:02:39 -0700
+Subject: [PATCH 058/160] elf: Reset alignment for each PT_LOAD segment
+
+Reset alignment for each PT_LOAD segment to avoid using alignment from
+the previous PT_LOAD segment.
+
+bfd/
+
+	PR ld/29435
+	* elf.c (assign_file_positions_for_load_sections): Reset
+	alignment for each PT_LOAD segment.
+
+ld/
+
+	PR ld/29435
+	* testsuite/ld-elf/pr29435.d: New file.
+	* testsuite/ld-elf/pr29435.s: Likewise.
+
+(cherry picked from commit 59f214544c50ec7ebbca285ff2b4949f48671690)
+---
+ bfd/elf.c                     |  7 ++++---
+ ld/testsuite/ld-elf/pr29435.d | 11 +++++++++++
+ ld/testsuite/ld-elf/pr29435.s |  6 ++++++
+ 3 files changed, 21 insertions(+), 3 deletions(-)
+ create mode 100644 ld/testsuite/ld-elf/pr29435.d
+ create mode 100644 ld/testsuite/ld-elf/pr29435.s
+
+--- a/bfd/elf.c
++++ b/bfd/elf.c
+@@ -5438,8 +5438,6 @@ assign_file_positions_for_load_sections
+   Elf_Internal_Phdr *p;
+   file_ptr off;  /* Octets.  */
+   bfd_size_type maxpagesize;
+-  bfd_size_type p_align;
+-  bool p_align_p = false;
+   unsigned int alloc, actual;
+   unsigned int i, j;
+   struct elf_segment_map **sorted_seg_map;
+@@ -5524,7 +5522,6 @@ assign_file_positions_for_load_sections
+     qsort (sorted_seg_map, alloc, sizeof (*sorted_seg_map),
+ 	   elf_sort_segments);
+ 
+-  p_align = bed->p_align;
+   maxpagesize = 1;
+   if ((abfd->flags & D_PAGED) != 0)
+     {
+@@ -5559,6 +5556,8 @@ assign_file_positions_for_load_sections
+       asection **secpp;
+       bfd_vma off_adjust;  /* Octets.  */
+       bool no_contents;
++      bfd_size_type p_align;
++      bool p_align_p;
+ 
+       /* An ELF segment (described by Elf_Internal_Phdr) may contain a
+ 	 number of sections with contents contributing to both p_filesz
+@@ -5569,6 +5568,8 @@ assign_file_positions_for_load_sections
+       p = phdrs + m->idx;
+       p->p_type = m->p_type;
+       p->p_flags = m->p_flags;
++      p_align = bed->p_align;
++      p_align_p = false;
+ 
+       if (m->count == 0)
+ 	p->p_vaddr = m->p_vaddr_offset * opb;
+--- /dev/null
++++ b/ld/testsuite/ld-elf/pr29435.d
+@@ -0,0 +1,11 @@
++#ld: -shared -z separate-code -z relro
++#xfail: ![check_shared_lib_support]
++#xfail: ![check_relro_support]
++#readelf: -Wl
++
++#failif
++#...
++ +LOAD +0x[0-9a-f]+ 0x[0-9a-f]+ 0x[0-9a-f]+ 0x[0-9a-f]+ 0x[0-9a-f]+ .* 0x8000
++#...
++ +LOAD +0x[0-9a-f]+ 0x[0-9a-f]+ 0x[0-9a-f]+ 0x[0-9a-f]+ 0x[0-9a-f]+ .* 0x8000
++#...
+--- /dev/null
++++ b/ld/testsuite/ld-elf/pr29435.s
+@@ -0,0 +1,6 @@
++        .text
++	.balign 0x8000
++	.globl	foo
++	.type	foo, %function
++foo:
++	.byte 0
diff --git a/toolchain/binutils/patches/2.39/063-PR29542-PowerPC-gold-internal-error-in-get_output_vi.patch b/toolchain/binutils/patches/2.39/063-PR29542-PowerPC-gold-internal-error-in-get_output_vi.patch
new file mode 100644
index 00000000000000..0d66b7750fc8fb
--- /dev/null
+++ b/toolchain/binutils/patches/2.39/063-PR29542-PowerPC-gold-internal-error-in-get_output_vi.patch
@@ -0,0 +1,29 @@
+From 041c22e35de06d22566f4c71e4425c3351215e66 Mon Sep 17 00:00:00 2001
+From: Alan Modra <amodra@gmail.com>
+Date: Sun, 25 Sep 2022 12:07:36 +0930
+Subject: [PATCH 063/160] PR29542, PowerPC gold internal error in
+ get_output_view,
+
+We were attempting to set a BSS style section contents.
+
+	PR 29542
+	* powerpc.cc (Output_data_plt_powerpc::do_write): Don't set .plt,
+	.iplt or .lplt section contents when position independent.
+
+(cherry picked from commit c21736aed1d4877e090df60362413669dbdc391d)
+---
+ gold/powerpc.cc | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/gold/powerpc.cc
++++ b/gold/powerpc.cc
+@@ -4338,7 +4338,8 @@ template<int size, bool big_endian>
+ void
+ Output_data_plt_powerpc<size, big_endian>::do_write(Output_file* of)
+ {
+-  if (!this->sym_ents_.empty())
++  if (!this->sym_ents_.empty()
++      && !parameters->options().output_is_position_independent())
+     {
+       const section_size_type offset = this->offset();
+       const section_size_type oview_size
diff --git a/toolchain/binutils/patches/2.39/116-arm-Use-DWARF-numbering-convention-for-pseudo-regist.patch b/toolchain/binutils/patches/2.39/116-arm-Use-DWARF-numbering-convention-for-pseudo-regist.patch
new file mode 100644
index 00000000000000..82a015ee2bb6ac
--- /dev/null
+++ b/toolchain/binutils/patches/2.39/116-arm-Use-DWARF-numbering-convention-for-pseudo-regist.patch
@@ -0,0 +1,301 @@
+From 88ac930a725b8aac8284a2738f03b843f4343dd0 Mon Sep 17 00:00:00 2001
+From: Victor Do Nascimento <Victor.DoNascimento@arm.com>
+Date: Thu, 17 Nov 2022 14:48:37 +0000
+Subject: [PATCH 116/160] arm: Use DWARF numbering convention for
+ pseudo-register representation
+
+The patch, initially submitted to trunk in
+https://sourceware.org/pipermail/binutils/2022-July/122092.html ensures correct
+support for handling .save directives for mixed-register type lists involving
+the ra_auth_code pseudo-register, whereby the support first introduced in 2.39
+(https://sourceware.org/pipermail/binutils/2022-May/120672.html) led to the
+generation of unwinder code popping registers in reversed order.
+
+gas/Changelog:
+
+  * config/tc-arm.c (REG_RA_AUTH_CODE): New.
+  (parse_dot_save): Likewise.
+  (parse_reg_list): Remove obsolete code.
+  (reg_names): Set ra_auth_code to 143.
+  (s_arm_unwind_save): Handle core and pseudo-register lists via
+  parse_dot_save.
+  (s_arm_unwind_save_mixed): Deleted.
+  (s_arm_unwind_save_pseudo): Handle one register at a time.
+  * testsuite/gas/arm/unwind-pacbti-m-readelf.d: Fix test.
+  * testsuite/gas/arm/unwind-pacbti-m.d: Likewise.
+
+(cherry picked from commit 3a368c4c248f6e9f4bda3a5369befa17a4560293)
+---
+ gas/config/tc-arm.c                           | 159 ++++++++++--------
+ .../gas/arm/unwind-pacbti-m-readelf.d         |   4 +-
+ gas/testsuite/gas/arm/unwind-pacbti-m.d       |   2 +-
+ 3 files changed, 95 insertions(+), 70 deletions(-)
+
+--- a/gas/config/tc-arm.c
++++ b/gas/config/tc-arm.c
+@@ -742,6 +742,7 @@ const char * const reg_expected_msgs[] =
+ #define REG_SP	13
+ #define REG_LR	14
+ #define REG_PC	15
++#define REG_RA_AUTH_CODE 143
+ 
+ /* ARM instructions take 4bytes in the object file, Thumb instructions
+    take 2:  */
+@@ -1943,21 +1944,6 @@ parse_reg_list (char ** strp, enum reg_l
+ 
+ 	      reg = arm_reg_parse (&str, rt);
+ 
+-	      /* Skip over allowed registers of alternative types in mixed-type
+-	         register lists.  */
+-	      if (reg == FAIL && rt == REG_TYPE_PSEUDO
+-		  && ((reg = arm_reg_parse (&str, REG_TYPE_RN)) != FAIL))
+-		{
+-		  cur_reg = reg;
+-		  continue;
+-		}
+-	      else if (reg == FAIL && rt == REG_TYPE_RN
+-		       && ((reg = arm_reg_parse (&str, REG_TYPE_PSEUDO)) != FAIL))
+-		{
+-		  cur_reg = reg;
+-		  continue;
+-		}
+-
+ 	      if (etype == REGLIST_CLRM)
+ 		{
+ 		  if (reg == REG_SP || reg == REG_PC)
+@@ -4139,7 +4125,6 @@ s_arm_unwind_fnstart (int ignored ATTRIB
+   unwind.sp_restored = 0;
+ }
+ 
+-
+ /* Parse a handlerdata directive.  Creates the exception handling table entry
+    for the function.  */
+ 
+@@ -4297,15 +4282,19 @@ s_arm_unwind_personality (int ignored AT
+ /* Parse a directive saving pseudo registers.  */
+ 
+ static void
+-s_arm_unwind_save_pseudo (long range)
++s_arm_unwind_save_pseudo (int regno)
+ {
+   valueT op;
+ 
+-  if (range & (1 << 12))
++  switch (regno)
+     {
++    case REG_RA_AUTH_CODE:
+       /* Opcode for restoring RA_AUTH_CODE.  */
+       op = 0xb4;
+       add_unwind_opcode (op, 1);
++      break;
++    default:
++      as_bad (_("Unknown register %d encountered\n"), regno);
+     }
+ }
+ 
+@@ -4375,6 +4364,80 @@ s_arm_unwind_save_core (long range)
+     }
+ }
+ 
++/* Implement correct handling of .save lists enabling the split into
++sublists where necessary, while preserving correct sublist ordering.  */
++
++static void
++parse_dot_save (char **str_p, int prev_reg)
++{
++  long core_regs = 0;
++  int reg;
++  int in_range = 0;
++
++  if (**str_p == ',')
++    *str_p += 1;
++  if (**str_p == '}')
++    {
++      *str_p += 1;
++      return;
++    }
++
++  while ((reg = arm_reg_parse (str_p, REG_TYPE_RN)) != FAIL)
++    {
++      if (!in_range)
++	{
++	  if (core_regs & (1 << reg))
++	    as_tsktsk (_("Warning: duplicated register (r%d) in register list"),
++		       reg);
++	  else if (reg <= prev_reg)
++	    as_tsktsk (_("Warning: register list not in ascending order"));
++
++	  core_regs |= (1 << reg);
++	  prev_reg = reg;
++	  if (skip_past_char(str_p, '-') != FAIL)
++	    in_range = 1;
++	  else if (skip_past_comma(str_p) == FAIL)
++	    first_error (_("bad register list"));
++	}
++      else
++	{
++	  int i;
++	  if (reg <= prev_reg)
++	    first_error (_("bad range in register list"));
++	  for (i = prev_reg + 1; i <= reg; i++)
++	    {
++	      if (core_regs & (1 << i))
++		as_tsktsk (_("Warning: duplicated register (r%d) in register list"),
++			   i);
++	      else
++		core_regs |= 1 << i;
++	    }
++	  in_range = 0;
++	}
++    }
++  if (core_regs)
++    {
++      /* Higher register numbers go in higher memory addresses.  When splitting a list,
++	 right-most sublist should therefore be .saved first.  Use recursion for this.  */
++      parse_dot_save (str_p, reg);
++      /* We're back from recursion, so emit .save insn for sublist.  */
++      s_arm_unwind_save_core (core_regs);
++      return;
++    }
++  /* Handle pseudo-regs, under assumption these are emitted singly.  */
++  else if ((reg = arm_reg_parse (str_p, REG_TYPE_PSEUDO)) != FAIL)
++    {
++      /* Recurse for remainder of input.  Note: No assumption is made regarding which
++	 register in core register set holds pseudo-register.  It's not considered in
++	 ordering check beyond ensuring it's not sandwiched between 2 consecutive
++	 registers.  */
++      parse_dot_save (str_p, prev_reg + 1);
++      s_arm_unwind_save_pseudo (reg);
++      return;
++    }
++  else
++    as_bad (BAD_SYNTAX);
++}
+ 
+ /* Parse a directive saving FPA registers.  */
+ 
+@@ -4716,39 +4779,13 @@ s_arm_unwind_save_mmxwcg (void)
+   ignore_rest_of_line ();
+ }
+ 
+-/* Convert range and mask_range into a sequence of s_arm_unwind_core
+-   and s_arm_unwind_pseudo operations.  We assume that mask_range will
+-   not have consecutive bits set, or that one operation per bit is
+-   acceptable.  */
+-
+-static void
+-s_arm_unwind_save_mixed (long range, long mask_range)
+-{
+-  while (mask_range)
+-    {
+-      long mask_bit = mask_range & -mask_range;
+-      long subrange = range & (mask_bit - 1);
+-
+-      if (subrange)
+-	s_arm_unwind_save_core (subrange);
+-
+-      s_arm_unwind_save_pseudo (mask_bit);
+-      range &= ~subrange;
+-      mask_range &= ~mask_bit;
+-    }
+-
+-  if (range)
+-    s_arm_unwind_save_core (range);
+-}
+-
+ /* Parse an unwind_save directive.
+    If the argument is non-zero, this is a .vsave directive.  */
+ 
+ static void
+ s_arm_unwind_save (int arch_v6)
+ {
+-  char *peek, *mask_peek;
+-  long range, mask_range;
++  char *peek;
+   struct reg_entry *reg;
+   bool had_brace = false;
+ 
+@@ -4756,7 +4793,7 @@ s_arm_unwind_save (int arch_v6)
+     as_bad (MISSING_FNSTART);
+ 
+   /* Figure out what sort of save we have.  */
+-  peek = mask_peek = input_line_pointer;
++  peek = input_line_pointer;
+ 
+   if (*peek == '{')
+     {
+@@ -4788,20 +4825,13 @@ s_arm_unwind_save (int arch_v6)
+ 
+     case REG_TYPE_PSEUDO:
+     case REG_TYPE_RN:
+-      mask_range = parse_reg_list (&mask_peek, REGLIST_PSEUDO);
+-      range = parse_reg_list (&input_line_pointer, REGLIST_RN);
+-
+-      if (range == FAIL || mask_range == FAIL)
+-	{
+-	  as_bad (_("expected register list"));
+-	  ignore_rest_of_line ();
+-	  return;
+-	}
+-
+-      demand_empty_rest_of_line ();
+-
+-      s_arm_unwind_save_mixed (range, mask_range);
+-      return;
++      {
++	if (had_brace)
++	  input_line_pointer++;
++	parse_dot_save (&input_line_pointer, -1);
++	demand_empty_rest_of_line ();
++	return;
++      }
+ 
+     case REG_TYPE_VFD:
+       if (arch_v6)
+@@ -23993,12 +24023,8 @@ static const struct reg_entry reg_names[
+   /* XScale accumulator registers.  */
+   REGNUM(acc,0,XSCALE), REGNUM(ACC,0,XSCALE),
+ 
+-  /* DWARF ABI defines RA_AUTH_CODE to 143. It also reserves 134-142 for future
+-     expansion.  RA_AUTH_CODE here is given the value 143 % 134 to make it easy
+-     for tc_arm_regname_to_dw2regnum to translate to DWARF reg number using
+-     134 + reg_number should the range 134 to 142 be used for more pseudo regs
+-     in the future.  This also helps fit RA_AUTH_CODE into a bitmask.  */
+-  REGDEF(ra_auth_code,12,PSEUDO),
++  /* AADWARF32 defines RA_AUTH_CODE to 143.  */
++  REGDEF(ra_auth_code,143,PSEUDO),
+ };
+ #undef REGDEF
+ #undef REGNUM
+@@ -27905,7 +27931,6 @@ create_unwind_entry (int have_data)
+   return 0;
+ }
+ 
+-
+ /* Initialize the DWARF-2 unwind information for this procedure.  */
+ 
+ void
+--- a/gas/testsuite/gas/arm/unwind-pacbti-m-readelf.d
++++ b/gas/testsuite/gas/arm/unwind-pacbti-m-readelf.d
+@@ -10,11 +10,11 @@ Unwind section '.ARM.exidx' at offset 0x
+ 
+ 0x0 <foo>: @0x0
+   Compact model index: 1
+-  0x84 0x00 pop {r14}
+   0xb4      pop {ra_auth_code}
+   0x84 0x00 pop {r14}
+-  0xb4      pop {ra_auth_code}
+   0xa3      pop {r4, r5, r6, r7}
+   0xb4      pop {ra_auth_code}
++  0x84 0x00 pop {r14}
++  0xb4      pop {ra_auth_code}
+   0xa8      pop {r4, r14}
+   0xb0      finish
+--- a/gas/testsuite/gas/arm/unwind-pacbti-m.d
++++ b/gas/testsuite/gas/arm/unwind-pacbti-m.d
+@@ -8,4 +8,4 @@
+ .*:     file format.*
+ 
+ Contents of section .ARM.extab:
+- 0000 (00840281 b40084b4 b0a8b4a3|81028400 b48400b4 a3b4a8b0) 00000000  .*
++ 0000 (84b40281 84b4a300 b0a8b400|8102b484 00a3b484 00b4a8b0) 00000000  .*
diff --git a/toolchain/binutils/patches/2.40/005-libctf-update-regexp-to-allow-makeinfo-to-build-docu.patch b/toolchain/binutils/patches/2.40/005-libctf-update-regexp-to-allow-makeinfo-to-build-docu.patch
new file mode 100644
index 00000000000000..19af34091c862c
--- /dev/null
+++ b/toolchain/binutils/patches/2.40/005-libctf-update-regexp-to-allow-makeinfo-to-build-docu.patch
@@ -0,0 +1,70 @@
+From f7c5db99b76e8dde89335d794c82fcbfbf53c612 Mon Sep 17 00:00:00 2001
+From: Enze Li <enze.li@hotmail.com>
+Date: Sat, 14 Jan 2023 11:33:48 +0800
+Subject: [PATCH 05/50] libctf: update regexp to allow makeinfo to build
+ document
+
+While trying to build gdb on latest openSUSE Tumbleweed, I noticed the
+following warning,
+
+ checking for makeinfo... makeinfo --split-size=5000000
+ configure: WARNING:
+ *** Makeinfo is too old. Info documentation will not be built.
+
+then I checked the version of makeinfo, it said,
+======
+$ makeinfo --version
+texi2any (GNU texinfo) 7.0.1
+
+Copyright (C) 2022 Free Software Foundation, Inc.
+License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
+This is free software: you are free to change and redistribute it.
+There is NO WARRANTY, to the extent permitted by law.
+======
+
+After digging a little bit, it became quite obvious that a dot is
+missing in regexp that makes it impossible to match versions higher than
+7.0, and here's the solution:
+
+-       | egrep 'texinfo[^0-9]*(6\.[3-9]|[7-9][0-9])' >/dev/null 2>&1; then
++       | egrep 'texinfo[^0-9]*(6\.[3-9]|[7-9]\.[0-9])' >/dev/null 2>&1; then
+
+However, Eli pointed out that the solution above has another problem: it
+will stop working when Texinfo 10.1 will be released.  Meanwhile, he
+suggested to solve this problem permanently.  That is, we don't care
+about the minor version for Texinfo > 6.9, we only care about the major
+version.
+
+In this way, the problem will be resolved permanently, thanks to Eli.
+
+libctf/ChangeLog:
+
+	* configure: Regenerated.
+	* configure.ac: Update regexp to match versions higher than 7.0.
+---
+ libctf/configure    | 2 +-
+ libctf/configure.ac | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/libctf/configure
++++ b/libctf/configure
+@@ -14865,7 +14865,7 @@ esac
+     # We require texinfo to be 6.3 or later, for a working synindex
+     # and validatemenus: otherwise we fall back to /bin/true.
+     if ${MAKEINFO} --version \
+-       | egrep 'texinfo[^0-9]*(6\.[3-9]|[7-9][0-9])' >/dev/null 2>&1; then
++       | egrep 'texinfo[^0-9]*(6\.[3-9]|[7-9]|[1-6][0-9])' >/dev/null 2>&1; then
+       build_info=yes
+     else
+         build_info=
+--- a/libctf/configure.ac
++++ b/libctf/configure.ac
+@@ -184,7 +184,7 @@ changequote(,)
+     # We require texinfo to be 6.3 or later, for a working synindex
+     # and validatemenus: otherwise we fall back to /bin/true.
+     if ${MAKEINFO} --version \
+-       | egrep 'texinfo[^0-9]*(6\.[3-9]|[7-9][0-9])' >/dev/null 2>&1; then
++       | egrep 'texinfo[^0-9]*(6\.[3-9]|[7-9]|[1-6][0-9])' >/dev/null 2>&1; then
+       build_info=yes
+     else
+         build_info=
diff --git a/toolchain/binutils/patches/2.40/007-Fix-version-number-snafu-in-some-configuration-files.patch b/toolchain/binutils/patches/2.40/007-Fix-version-number-snafu-in-some-configuration-files.patch
new file mode 100644
index 00000000000000..0676240442facf
--- /dev/null
+++ b/toolchain/binutils/patches/2.40/007-Fix-version-number-snafu-in-some-configuration-files.patch
@@ -0,0 +1,444 @@
+From 59706683feafb6252d0ad369cf8759f75fd147be Mon Sep 17 00:00:00 2001
+From: Nick Clifton <nickc@redhat.com>
+Date: Tue, 17 Jan 2023 12:02:56 +0000
+Subject: [PATCH 07/50] Fix version number snafu in some configuration files:
+ 2.40.00 should be 2.40
+
+---
+ binutils/configure             | 20 ++++++++++----------
+ gprof/configure                | 20 ++++++++++----------
+ gprofng/configure              | 20 ++++++++++----------
+ gprofng/doc/version.texi       |  4 ++--
+ gprofng/libcollector/configure | 20 ++++++++++----------
+ ld/configure                   | 20 ++++++++++----------
+ 6 files changed, 52 insertions(+), 52 deletions(-)
+
+--- a/binutils/configure
++++ b/binutils/configure
+@@ -1,6 +1,6 @@
+ #! /bin/sh
+ # Guess values for system-dependent variables and create Makefiles.
+-# Generated by GNU Autoconf 2.69 for binutils 2.40.00.
++# Generated by GNU Autoconf 2.69 for binutils 2.40.
+ #
+ #
+ # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
+@@ -587,8 +587,8 @@ MAKEFLAGS=
+ # Identity of this package.
+ PACKAGE_NAME='binutils'
+ PACKAGE_TARNAME='binutils'
+-PACKAGE_VERSION='2.40.00'
+-PACKAGE_STRING='binutils 2.40.00'
++PACKAGE_VERSION='2.40'
++PACKAGE_STRING='binutils 2.40'
+ PACKAGE_BUGREPORT=''
+ PACKAGE_URL=''
+ 
+@@ -1401,7 +1401,7 @@ if test "$ac_init_help" = "long"; then
+   # Omit some internal or obsolete options to make the list less imposing.
+   # This message is too long to be a string in the A/UX 3.1 sh.
+   cat <<_ACEOF
+-\`configure' configures binutils 2.40.00 to adapt to many kinds of systems.
++\`configure' configures binutils 2.40 to adapt to many kinds of systems.
+ 
+ Usage: $0 [OPTION]... [VAR=VALUE]...
+ 
+@@ -1472,7 +1472,7 @@ fi
+ 
+ if test -n "$ac_init_help"; then
+   case $ac_init_help in
+-     short | recursive ) echo "Configuration of binutils 2.40.00:";;
++     short | recursive ) echo "Configuration of binutils 2.40:";;
+    esac
+   cat <<\_ACEOF
+ 
+@@ -1631,7 +1631,7 @@ fi
+ test -n "$ac_init_help" && exit $ac_status
+ if $ac_init_version; then
+   cat <<\_ACEOF
+-binutils configure 2.40.00
++binutils configure 2.40
+ generated by GNU Autoconf 2.69
+ 
+ Copyright (C) 2012 Free Software Foundation, Inc.
+@@ -2099,7 +2099,7 @@ cat >config.log <<_ACEOF
+ This file contains any messages produced by compilers while
+ running configure, to aid debugging if configure makes a mistake.
+ 
+-It was created by binutils $as_me 2.40.00, which was
++It was created by binutils $as_me 2.40, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   $ $0 $@
+@@ -3081,7 +3081,7 @@ fi
+ 
+ # Define the identity of the package.
+  PACKAGE='binutils'
+- VERSION='2.40.00'
++ VERSION='2.40'
+ 
+ 
+ cat >>confdefs.h <<_ACEOF
+@@ -15326,7 +15326,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_wri
+ # report actual input values of CONFIG_FILES etc. instead of their
+ # values after options handling.
+ ac_log="
+-This file was extended by binutils $as_me 2.40.00, which was
++This file was extended by binutils $as_me 2.40, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   CONFIG_FILES    = $CONFIG_FILES
+@@ -15392,7 +15392,7 @@ _ACEOF
+ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+ ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
+ ac_cs_version="\\
+-binutils config.status 2.40.00
++binutils config.status 2.40
+ configured by $0, generated by GNU Autoconf 2.69,
+   with options \\"\$ac_cs_config\\"
+ 
+--- a/gprof/configure
++++ b/gprof/configure
+@@ -1,6 +1,6 @@
+ #! /bin/sh
+ # Guess values for system-dependent variables and create Makefiles.
+-# Generated by GNU Autoconf 2.69 for gprof 2.40.00.
++# Generated by GNU Autoconf 2.69 for gprof 2.40.
+ #
+ #
+ # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
+@@ -587,8 +587,8 @@ MAKEFLAGS=
+ # Identity of this package.
+ PACKAGE_NAME='gprof'
+ PACKAGE_TARNAME='gprof'
+-PACKAGE_VERSION='2.40.00'
+-PACKAGE_STRING='gprof 2.40.00'
++PACKAGE_VERSION='2.40'
++PACKAGE_STRING='gprof 2.40'
+ PACKAGE_BUGREPORT=''
+ PACKAGE_URL=''
+ 
+@@ -1338,7 +1338,7 @@ if test "$ac_init_help" = "long"; then
+   # Omit some internal or obsolete options to make the list less imposing.
+   # This message is too long to be a string in the A/UX 3.1 sh.
+   cat <<_ACEOF
+-\`configure' configures gprof 2.40.00 to adapt to many kinds of systems.
++\`configure' configures gprof 2.40 to adapt to many kinds of systems.
+ 
+ Usage: $0 [OPTION]... [VAR=VALUE]...
+ 
+@@ -1409,7 +1409,7 @@ fi
+ 
+ if test -n "$ac_init_help"; then
+   case $ac_init_help in
+-     short | recursive ) echo "Configuration of gprof 2.40.00:";;
++     short | recursive ) echo "Configuration of gprof 2.40:";;
+    esac
+   cat <<\_ACEOF
+ 
+@@ -1520,7 +1520,7 @@ fi
+ test -n "$ac_init_help" && exit $ac_status
+ if $ac_init_version; then
+   cat <<\_ACEOF
+-gprof configure 2.40.00
++gprof configure 2.40
+ generated by GNU Autoconf 2.69
+ 
+ Copyright (C) 2012 Free Software Foundation, Inc.
+@@ -1885,7 +1885,7 @@ cat >config.log <<_ACEOF
+ This file contains any messages produced by compilers while
+ running configure, to aid debugging if configure makes a mistake.
+ 
+-It was created by gprof $as_me 2.40.00, which was
++It was created by gprof $as_me 2.40, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   $ $0 $@
+@@ -2864,7 +2864,7 @@ fi
+ 
+ # Define the identity of the package.
+  PACKAGE='gprof'
+- VERSION='2.40.00'
++ VERSION='2.40'
+ 
+ 
+ cat >>confdefs.h <<_ACEOF
+@@ -12572,7 +12572,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_wri
+ # report actual input values of CONFIG_FILES etc. instead of their
+ # values after options handling.
+ ac_log="
+-This file was extended by gprof $as_me 2.40.00, which was
++This file was extended by gprof $as_me 2.40, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   CONFIG_FILES    = $CONFIG_FILES
+@@ -12638,7 +12638,7 @@ _ACEOF
+ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+ ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
+ ac_cs_version="\\
+-gprof config.status 2.40.00
++gprof config.status 2.40
+ configured by $0, generated by GNU Autoconf 2.69,
+   with options \\"\$ac_cs_config\\"
+ 
+--- a/gprofng/configure
++++ b/gprofng/configure
+@@ -1,6 +1,6 @@
+ #! /bin/sh
+ # Guess values for system-dependent variables and create Makefiles.
+-# Generated by GNU Autoconf 2.69 for gprofng 2.40.00.
++# Generated by GNU Autoconf 2.69 for gprofng 2.40.
+ #
+ #
+ # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
+@@ -587,8 +587,8 @@ MAKEFLAGS=
+ # Identity of this package.
+ PACKAGE_NAME='gprofng'
+ PACKAGE_TARNAME='gprofng'
+-PACKAGE_VERSION='2.40.00'
+-PACKAGE_STRING='gprofng 2.40.00'
++PACKAGE_VERSION='2.40'
++PACKAGE_STRING='gprofng 2.40'
+ PACKAGE_BUGREPORT=''
+ PACKAGE_URL=''
+ 
+@@ -1362,7 +1362,7 @@ if test "$ac_init_help" = "long"; then
+   # Omit some internal or obsolete options to make the list less imposing.
+   # This message is too long to be a string in the A/UX 3.1 sh.
+   cat <<_ACEOF
+-\`configure' configures gprofng 2.40.00 to adapt to many kinds of systems.
++\`configure' configures gprofng 2.40 to adapt to many kinds of systems.
+ 
+ Usage: $0 [OPTION]... [VAR=VALUE]...
+ 
+@@ -1433,7 +1433,7 @@ fi
+ 
+ if test -n "$ac_init_help"; then
+   case $ac_init_help in
+-     short | recursive ) echo "Configuration of gprofng 2.40.00:";;
++     short | recursive ) echo "Configuration of gprofng 2.40:";;
+    esac
+   cat <<\_ACEOF
+ 
+@@ -1547,7 +1547,7 @@ fi
+ test -n "$ac_init_help" && exit $ac_status
+ if $ac_init_version; then
+   cat <<\_ACEOF
+-gprofng configure 2.40.00
++gprofng configure 2.40
+ generated by GNU Autoconf 2.69
+ 
+ Copyright (C) 2012 Free Software Foundation, Inc.
+@@ -2079,7 +2079,7 @@ cat >config.log <<_ACEOF
+ This file contains any messages produced by compilers while
+ running configure, to aid debugging if configure makes a mistake.
+ 
+-It was created by gprofng $as_me 2.40.00, which was
++It was created by gprofng $as_me 2.40, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   $ $0 $@
+@@ -3052,7 +3052,7 @@ fi
+ 
+ # Define the identity of the package.
+  PACKAGE='gprofng'
+- VERSION='2.40.00'
++ VERSION='2.40'
+ 
+ 
+ cat >>confdefs.h <<_ACEOF
+@@ -17467,7 +17467,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_wri
+ # report actual input values of CONFIG_FILES etc. instead of their
+ # values after options handling.
+ ac_log="
+-This file was extended by gprofng $as_me 2.40.00, which was
++This file was extended by gprofng $as_me 2.40, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   CONFIG_FILES    = $CONFIG_FILES
+@@ -17533,7 +17533,7 @@ _ACEOF
+ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+ ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
+ ac_cs_version="\\
+-gprofng config.status 2.40.00
++gprofng config.status 2.40
+ configured by $0, generated by GNU Autoconf 2.69,
+   with options \\"\$ac_cs_config\\"
+ 
+--- a/gprofng/doc/version.texi
++++ b/gprofng/doc/version.texi
+@@ -1,4 +1,4 @@
+ @set UPDATED 5 January 2023
+ @set UPDATED-MONTH January 2023
+-@set EDITION 2.40.00
+-@set VERSION 2.40.00
++@set EDITION 2.40
++@set VERSION 2.40
+--- a/gprofng/libcollector/configure
++++ b/gprofng/libcollector/configure
+@@ -1,6 +1,6 @@
+ #! /bin/sh
+ # Guess values for system-dependent variables and create Makefiles.
+-# Generated by GNU Autoconf 2.69 for gprofng 2.40.00.
++# Generated by GNU Autoconf 2.69 for gprofng 2.40.
+ #
+ #
+ # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
+@@ -587,8 +587,8 @@ MAKEFLAGS=
+ # Identity of this package.
+ PACKAGE_NAME='gprofng'
+ PACKAGE_TARNAME='gprofng'
+-PACKAGE_VERSION='2.40.00'
+-PACKAGE_STRING='gprofng 2.40.00'
++PACKAGE_VERSION='2.40'
++PACKAGE_STRING='gprofng 2.40'
+ PACKAGE_BUGREPORT=''
+ PACKAGE_URL=''
+ 
+@@ -1325,7 +1325,7 @@ if test "$ac_init_help" = "long"; then
+   # Omit some internal or obsolete options to make the list less imposing.
+   # This message is too long to be a string in the A/UX 3.1 sh.
+   cat <<_ACEOF
+-\`configure' configures gprofng 2.40.00 to adapt to many kinds of systems.
++\`configure' configures gprofng 2.40 to adapt to many kinds of systems.
+ 
+ Usage: $0 [OPTION]... [VAR=VALUE]...
+ 
+@@ -1396,7 +1396,7 @@ fi
+ 
+ if test -n "$ac_init_help"; then
+   case $ac_init_help in
+-     short | recursive ) echo "Configuration of gprofng 2.40.00:";;
++     short | recursive ) echo "Configuration of gprofng 2.40:";;
+    esac
+   cat <<\_ACEOF
+ 
+@@ -1505,7 +1505,7 @@ fi
+ test -n "$ac_init_help" && exit $ac_status
+ if $ac_init_version; then
+   cat <<\_ACEOF
+-gprofng configure 2.40.00
++gprofng configure 2.40
+ generated by GNU Autoconf 2.69
+ 
+ Copyright (C) 2012 Free Software Foundation, Inc.
+@@ -1991,7 +1991,7 @@ cat >config.log <<_ACEOF
+ This file contains any messages produced by compilers while
+ running configure, to aid debugging if configure makes a mistake.
+ 
+-It was created by gprofng $as_me 2.40.00, which was
++It was created by gprofng $as_me 2.40, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   $ $0 $@
+@@ -2968,7 +2968,7 @@ fi
+ 
+ # Define the identity of the package.
+  PACKAGE='gprofng'
+- VERSION='2.40.00'
++ VERSION='2.40'
+ 
+ 
+ cat >>confdefs.h <<_ACEOF
+@@ -16098,7 +16098,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_wri
+ # report actual input values of CONFIG_FILES etc. instead of their
+ # values after options handling.
+ ac_log="
+-This file was extended by gprofng $as_me 2.40.00, which was
++This file was extended by gprofng $as_me 2.40, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   CONFIG_FILES    = $CONFIG_FILES
+@@ -16164,7 +16164,7 @@ _ACEOF
+ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+ ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
+ ac_cs_version="\\
+-gprofng config.status 2.40.00
++gprofng config.status 2.40
+ configured by $0, generated by GNU Autoconf 2.69,
+   with options \\"\$ac_cs_config\\"
+ 
+--- a/ld/configure
++++ b/ld/configure
+@@ -1,6 +1,6 @@
+ #! /bin/sh
+ # Guess values for system-dependent variables and create Makefiles.
+-# Generated by GNU Autoconf 2.69 for ld 2.40.00.
++# Generated by GNU Autoconf 2.69 for ld 2.40.
+ #
+ #
+ # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
+@@ -587,8 +587,8 @@ MAKEFLAGS=
+ # Identity of this package.
+ PACKAGE_NAME='ld'
+ PACKAGE_TARNAME='ld'
+-PACKAGE_VERSION='2.40.00'
+-PACKAGE_STRING='ld 2.40.00'
++PACKAGE_VERSION='2.40'
++PACKAGE_STRING='ld 2.40'
+ PACKAGE_BUGREPORT=''
+ PACKAGE_URL=''
+ 
+@@ -1423,7 +1423,7 @@ if test "$ac_init_help" = "long"; then
+   # Omit some internal or obsolete options to make the list less imposing.
+   # This message is too long to be a string in the A/UX 3.1 sh.
+   cat <<_ACEOF
+-\`configure' configures ld 2.40.00 to adapt to many kinds of systems.
++\`configure' configures ld 2.40 to adapt to many kinds of systems.
+ 
+ Usage: $0 [OPTION]... [VAR=VALUE]...
+ 
+@@ -1494,7 +1494,7 @@ fi
+ 
+ if test -n "$ac_init_help"; then
+   case $ac_init_help in
+-     short | recursive ) echo "Configuration of ld 2.40.00:";;
++     short | recursive ) echo "Configuration of ld 2.40:";;
+    esac
+   cat <<\_ACEOF
+ 
+@@ -1661,7 +1661,7 @@ fi
+ test -n "$ac_init_help" && exit $ac_status
+ if $ac_init_version; then
+   cat <<\_ACEOF
+-ld configure 2.40.00
++ld configure 2.40
+ generated by GNU Autoconf 2.69
+ 
+ Copyright (C) 2012 Free Software Foundation, Inc.
+@@ -2376,7 +2376,7 @@ cat >config.log <<_ACEOF
+ This file contains any messages produced by compilers while
+ running configure, to aid debugging if configure makes a mistake.
+ 
+-It was created by ld $as_me 2.40.00, which was
++It was created by ld $as_me 2.40, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   $ $0 $@
+@@ -3359,7 +3359,7 @@ fi
+ 
+ # Define the identity of the package.
+  PACKAGE='ld'
+- VERSION='2.40.00'
++ VERSION='2.40'
+ 
+ 
+ cat >>confdefs.h <<_ACEOF
+@@ -18083,7 +18083,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_wri
+ # report actual input values of CONFIG_FILES etc. instead of their
+ # values after options handling.
+ ac_log="
+-This file was extended by ld $as_me 2.40.00, which was
++This file was extended by ld $as_me 2.40, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   CONFIG_FILES    = $CONFIG_FILES
+@@ -18149,7 +18149,7 @@ _ACEOF
+ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+ ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
+ ac_cs_version="\\
+-ld config.status 2.40.00
++ld config.status 2.40
+ configured by $0, generated by GNU Autoconf 2.69,
+   with options \\"\$ac_cs_config\\"
+ 
diff --git a/toolchain/binutils/patches/2.40/010-toplevel-Makefile.def-add-install-strip-dependency-o.patch b/toolchain/binutils/patches/2.40/010-toplevel-Makefile.def-add-install-strip-dependency-o.patch
new file mode 100644
index 00000000000000..bef40f546fa232
--- /dev/null
+++ b/toolchain/binutils/patches/2.40/010-toplevel-Makefile.def-add-install-strip-dependency-o.patch
@@ -0,0 +1,60 @@
+From bcea253f5fa194e57f9564e8461c718e228bd26e Mon Sep 17 00:00:00 2001
+From: Indu Bhagat <indu.bhagat@oracle.com>
+Date: Wed, 18 Jan 2023 23:17:49 -0800
+Subject: [PATCH 10/50] toplevel: Makefile.def: add install-strip dependency on
+ libsframe
+
+As noted in PR libsframe/30014 - FTBFS: install-strip fails because
+bfdlib relinks and fails to find libsframe, the install time
+dependencies of libbfd need to be updated.
+
+	PR libsframe/30014
+	* Makefile.def: Reflect that libsframe needs to installed before
+	libbfd.  Reorder a bit to better track libsframe dependencies.
+	* Makefile.in: Regenerate.
+
+(cherry picked from commit b8d21eb0cd10d6127e77cc437d82e949adb0c454)
+---
+ Makefile.def | 5 ++++-
+ Makefile.in  | 3 ++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/Makefile.def
++++ b/Makefile.def
+@@ -493,7 +493,6 @@ dependencies = { module=install-binutils
+ dependencies = { module=install-strip-binutils; on=install-strip-opcodes; };
+ 
+ // Likewise for ld, libctf, and bfd.
+-dependencies = { module=install-bfd; on=install-libsframe; };
+ dependencies = { module=install-libctf; on=install-bfd; };
+ dependencies = { module=install-ld; on=install-bfd; };
+ dependencies = { module=install-ld; on=install-libctf; };
+@@ -501,6 +500,10 @@ dependencies = { module=install-strip-li
+ dependencies = { module=install-strip-ld; on=install-strip-bfd; };
+ dependencies = { module=install-strip-ld; on=install-strip-libctf; };
+ 
++// libbfd depends on libsframe
++dependencies = { module=install-bfd; on=install-libsframe; };
++dependencies = { module=install-strip-bfd; on=install-strip-libsframe; };
++
+ // libopcodes depends on libbfd
+ dependencies = { module=configure-opcodes; on=configure-bfd; hard=true; };
+ dependencies = { module=install-opcodes; on=install-bfd; };
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -64549,13 +64549,14 @@ all-stageautoprofile-binutils: maybe-all
+ all-stageautofeedback-binutils: maybe-all-stageautofeedback-libsframe
+ install-binutils: maybe-install-opcodes
+ install-strip-binutils: maybe-install-strip-opcodes
+-install-bfd: maybe-install-libsframe
+ install-libctf: maybe-install-bfd
+ install-ld: maybe-install-bfd
+ install-ld: maybe-install-libctf
+ install-strip-libctf: maybe-install-strip-bfd
+ install-strip-ld: maybe-install-strip-bfd
+ install-strip-ld: maybe-install-strip-libctf
++install-bfd: maybe-install-libsframe
++install-strip-bfd: maybe-install-strip-libsframe
+ configure-opcodes: configure-bfd
+ configure-stage1-opcodes: configure-stage1-bfd
+ configure-stage2-opcodes: configure-stage2-bfd
diff --git a/toolchain/binutils/patches/2.40/018-gprofng-PR29521-docs-man-pages-are-not-in-the-releas.patch b/toolchain/binutils/patches/2.40/018-gprofng-PR29521-docs-man-pages-are-not-in-the-releas.patch
new file mode 100644
index 00000000000000..ae557645c0f02b
--- /dev/null
+++ b/toolchain/binutils/patches/2.40/018-gprofng-PR29521-docs-man-pages-are-not-in-the-releas.patch
@@ -0,0 +1,703 @@
+From c6e269febbc946a54ed9dbbb2dc70feba6017607 Mon Sep 17 00:00:00 2001
+From: Vladimir Mezentsev <vladimir.mezentsev@oracle.com>
+Date: Fri, 20 Jan 2023 15:39:55 -0800
+Subject: [PATCH 18/50] gprofng: PR29521 [docs] man pages are not in the
+ release tarball
+
+gprofng/ChangeLog
+2023-01-20  Vladimir Mezentsev  <vladimir.mezentsev@oracle.com>
+
+	PR gprofng/29521
+	* configure.ac: Check if $MAKEINFO and $HELP2MAN are missing.
+	* Makefile.am: Build doc if $MAKEINFO exists.
+	* doc/gprofng.texi: Update documentation for gprofng.
+	* doc/Makefile.am: Build gprofng.1.
+	* src/Makefile.am: Move the build of gprofng.1 to doc/Makefile.am.
+	* configure: Rebuild.
+	* Makefile.in: Rebuild.
+	* doc/Makefile.in: Rebuild.
+	* src/Makefile.in: Rebuild.
+---
+ gprofng/Makefile.am      |   2 +-
+ gprofng/Makefile.in      |   2 +-
+ gprofng/configure        |  79 +++++++++++++++---
+ gprofng/configure.ac     |  21 +++--
+ gprofng/doc/Makefile.am  |  24 +++++-
+ gprofng/doc/Makefile.in  |  93 ++++++++++++++++++---
+ gprofng/doc/gprofng.texi | 169 +++++++++++++++++++++++++++++++++++++++
+ gprofng/src/Makefile.am  |   8 +-
+ gprofng/src/Makefile.in  |   8 +-
+ 9 files changed, 364 insertions(+), 42 deletions(-)
+
+--- a/gprofng/Makefile.am
++++ b/gprofng/Makefile.am
+@@ -23,7 +23,7 @@ AUTOMAKE_OPTIONS = dejagnu foreign
+ if BUILD_COLLECTOR
+     COLLECTOR_SUBDIRS = libcollector
+ endif
+-if BUILD_MAN
++if BUILD_DOC
+     DOC_SUBDIR = doc
+ endif
+ if BUILD_SRC
+--- a/gprofng/Makefile.in
++++ b/gprofng/Makefile.in
+@@ -381,7 +381,7 @@ zlibinc = @zlibinc@
+ ACLOCAL_AMFLAGS = -I . -I .. 
+ AUTOMAKE_OPTIONS = dejagnu foreign
+ @BUILD_COLLECTOR_TRUE@COLLECTOR_SUBDIRS = libcollector
+-@BUILD_MAN_TRUE@DOC_SUBDIR = doc
++@BUILD_DOC_TRUE@DOC_SUBDIR = doc
+ @BUILD_SRC_TRUE@SRC_SUBDIRS = src gp-display-html $(DOC_SUBDIR)
+ SUBDIRS = $(COLLECTOR_SUBDIRS) $(SRC_SUBDIRS)
+ DIST_SUBDIRS = libcollector src gp-display-html $(DOC_SUBDIR)
+--- a/gprofng/configure
++++ b/gprofng/configure
+@@ -639,6 +639,8 @@ GPROFNG_CPPFLAGS
+ GPROFNG_NO_FORMAT_TRUNCATION_CFLAGS
+ GPROFNG_CFLAGS
+ LD_NO_AS_NEEDED
++BUILD_DOC_FALSE
++BUILD_DOC_TRUE
+ BUILD_MAN_FALSE
+ BUILD_MAN_TRUE
+ HELP2MAN
+@@ -12221,7 +12223,7 @@ else
+   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
+   lt_status=$lt_dlunknown
+   cat > conftest.$ac_ext <<_LT_EOF
+-#line 12224 "configure"
++#line 12226 "configure"
+ #include "confdefs.h"
+ 
+ #if HAVE_DLFCN_H
+@@ -12327,7 +12329,7 @@ else
+   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
+   lt_status=$lt_dlunknown
+   cat > conftest.$ac_ext <<_LT_EOF
+-#line 12330 "configure"
++#line 12332 "configure"
+ #include "confdefs.h"
+ 
+ #if HAVE_DLFCN_H
+@@ -16737,9 +16739,58 @@ fi
+ 
+ # Generate manpages, if possible.
+ build_man=false
++build_doc=false
+ if test $cross_compiling = no; then
++  for ac_prog in help2man
++do
++  # Extract the first word of "$ac_prog", so it can be a program name with args.
++set dummy $ac_prog; ac_word=$2
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
++$as_echo_n "checking for $ac_word... " >&6; }
++if ${ac_cv_prog_HELP2MAN+:} false; then :
++  $as_echo_n "(cached) " >&6
++else
++  if test -n "$HELP2MAN"; then
++  ac_cv_prog_HELP2MAN="$HELP2MAN" # Let the user override the test.
++else
++as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
++for as_dir in $PATH
++do
++  IFS=$as_save_IFS
++  test -z "$as_dir" && as_dir=.
++    for ac_exec_ext in '' $ac_executable_extensions; do
++  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
++    ac_cv_prog_HELP2MAN="$ac_prog"
++    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
++    break 2
++  fi
++done
++  done
++IFS=$as_save_IFS
++
++fi
++fi
++HELP2MAN=$ac_cv_prog_HELP2MAN
++if test -n "$HELP2MAN"; then
++  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $HELP2MAN" >&5
++$as_echo "$HELP2MAN" >&6; }
++else
++  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
++$as_echo "no" >&6; }
++fi
+ 
+-HELP2MAN=${HELP2MAN-"${am_missing_run}help2man"}
++
++  test -n "$HELP2MAN" && break
++done
++test -n "$HELP2MAN" || HELP2MAN="$MISSING help2man"
++
++  case "x$HELP2MAN" in
++    x | */missing\ help2man* )
++      { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: gprofng: help2man is missing. Man pages will not be built." >&5
++$as_echo "$as_me: WARNING: gprofng: help2man is missing. Man pages will not be built." >&2;}
++      ;;
++    * ) build_man=true ;;
++    esac
+ 
+   for ac_prog in makeinfo
+ do
+@@ -16782,10 +16833,10 @@ fi
+ 
+   test -n "$MAKEINFO" && break
+ done
+-test -n "$MAKEINFO" || MAKEINFO=""@echo makeinfo missing; true""
++test -n "$MAKEINFO" || MAKEINFO="$MISSING makeinfo"
+ 
+-  case "$MAKEINFO" in
+-    *true)
++  case "x$MAKEINFO" in
++    x | */missing\ makeinfo*)
+       { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: gprofng: makeinfo is missing. Info documentation will not be built." >&5
+ $as_echo "$as_me: WARNING: gprofng: makeinfo is missing. Info documentation will not be built." >&2;}
+       ;;
+@@ -16796,9 +16847,7 @@ $as_echo "$as_me: WARNING: gprofng: make
+ $as_echo "$as_me: WARNING: gprofng: $MAKEINFO is too old. Info documentation will not be built." >&2;}
+ 	  MAKEINFO="@echo $MAKEINFO is too old, 6.5 or newer required; true"
+ 	  ;;
+-	x* )
+-	  build_man=true
+-	  ;;
++	x* ) build_doc=true ;;
+ 	esac
+       ;;
+     esac
+@@ -16812,6 +16861,14 @@ else
+   BUILD_MAN_FALSE=
+ fi
+ 
++ if test x$build_doc = xtrue; then
++  BUILD_DOC_TRUE=
++  BUILD_DOC_FALSE='#'
++else
++  BUILD_DOC_TRUE='#'
++  BUILD_DOC_FALSE=
++fi
++
+ 
+ LD_NO_AS_NEEDED=${no_as_needed}
+ 
+@@ -17070,6 +17127,10 @@ if test -z "${BUILD_MAN_TRUE}" && test -
+   as_fn_error $? "conditional \"BUILD_MAN\" was never defined.
+ Usually this means the macro was only invoked conditionally." "$LINENO" 5
+ fi
++if test -z "${BUILD_DOC_TRUE}" && test -z "${BUILD_DOC_FALSE}"; then
++  as_fn_error $? "conditional \"BUILD_DOC\" was never defined.
++Usually this means the macro was only invoked conditionally." "$LINENO" 5
++fi
+ 
+ : "${CONFIG_STATUS=./config.status}"
+ ac_write_fail=0
+--- a/gprofng/configure.ac
++++ b/gprofng/configure.ac
+@@ -210,11 +210,19 @@ AM_ZLIB
+ 
+ # Generate manpages, if possible.
+ build_man=false
++build_doc=false
+ if test $cross_compiling = no; then
+-  AM_MISSING_PROG(HELP2MAN, help2man)
+-  AC_CHECK_PROGS([MAKEINFO], makeinfo, ["@echo makeinfo missing; true"])
+-  case "$MAKEINFO" in
+-    *true)
++  AC_CHECK_PROGS([HELP2MAN], help2man, [$MISSING help2man])
++  case "x$HELP2MAN" in
++    x | */missing\ help2man* )
++      AC_MSG_WARN([gprofng: help2man is missing. Man pages will not be built.])
++      ;;
++    * ) build_man=true ;;
++    esac
++
++  AC_CHECK_PROGS([MAKEINFO], makeinfo, [$MISSING makeinfo])
++  case "x$MAKEINFO" in
++    x | */missing\ makeinfo*)
+       AC_MSG_WARN([gprofng: makeinfo is missing. Info documentation will not be built.])
+       ;;
+     *)
+@@ -223,15 +231,14 @@ if test $cross_compiling = no; then
+ 	  AC_MSG_WARN([gprofng: $MAKEINFO is too old. Info documentation will not be built.])
+ 	  MAKEINFO="@echo $MAKEINFO is too old, 6.5 or newer required; true"
+ 	  ;;
+-	x* )
+-	  build_man=true
+-	  ;;
++	x* ) build_doc=true ;;
+ 	esac
+       ;;
+     esac
+   AC_SUBST(MAKEINFO)
+ fi
+ AM_CONDITIONAL([BUILD_MAN], [test x$build_man = xtrue])
++AM_CONDITIONAL([BUILD_DOC], [test x$build_doc = xtrue])
+ 
+ AC_SUBST(LD_NO_AS_NEEDED, [${no_as_needed}])
+ AC_SUBST(GPROFNG_CFLAGS, [${gprofng_cflags}])
+--- a/gprofng/doc/Makefile.am
++++ b/gprofng/doc/Makefile.am
+@@ -19,9 +19,31 @@
+ 
+ AUTOMAKE_OPTIONS = info-in-builddir foreign no-texinfo.tex
+ 
++# Options to extract the man page
++MANCONF = -Dman
++
++TEXI2POD = perl $(srcdir)/../../etc/texi2pod.pl $(AM_MAKEINFOFLAGS)
++POD2MAN = pod2man --center="User Commands" \
++	--release="binutils-$(VERSION)" --section=1
++
+ info_TEXINFOS       = gprofng.texi
+ gprofng_TEXINFOS    = fdl.texi
+ TEXINFO_TEX         = .
+ MAKEINFOHTML        = $(MAKEINFO) --html --no-split
+ 
+-MAINTAINERCLEANFILES = gprofng.info
++man_MANS = gprofng.1
++
++# Build the man page from the texinfo file
++# The sed command removes the no-adjust Nroff command so that
++# the man output looks standard.
++gprofng.1: $(srcdir)/gprofng.texi
++	$(AM_V_GEN)touch $@
++	$(AM_V_at)-$(TEXI2POD) $(MANCONF) < $(srcdir)/gprofng.texi > gprofng.pod
++	$(AM_V_at)-($(POD2MAN) gprofng.pod | \
++	  sed -e '/^.if n .na/d' > $@.tmp && \
++	  mv -f $@.tmp $@) || (rm -f $@.tmp && exit 1)
++	$(AM_V_at)rm -f gprofng.pod
++
++MAINTAINERCLEANFILES = gprofng.info $(man_MANS)
++
++info: $(man_MANS)
+--- a/gprofng/doc/Makefile.in
++++ b/gprofng/doc/Makefile.in
+@@ -182,7 +182,7 @@ am__can_run_installinfo = \
+     n|no|NO) false;; \
+     *) (install-info --version) >/dev/null 2>&1;; \
+   esac
+-am__installdirs = "$(DESTDIR)$(infodir)"
++am__installdirs = "$(DESTDIR)$(infodir)" "$(DESTDIR)$(man1dir)"
+ am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
+ am__vpath_adj = case $$p in \
+     $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
+@@ -210,6 +210,9 @@ am__uninstall_files_from_dir = { \
+     || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
+          $(am__cd) "$$dir" && rm -f $$files; }; \
+   }
++man1dir = $(mandir)/man1
++NROFF = nroff
++MANS = $(man_MANS)
+ am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+ am__DIST_COMMON = $(gprofng_TEXINFOS) $(srcdir)/Makefile.in \
+ 	$(top_srcdir)/../mkinstalldirs mdate-sh texinfo.tex
+@@ -361,11 +364,19 @@ top_srcdir = @top_srcdir@
+ zlibdir = @zlibdir@
+ zlibinc = @zlibinc@
+ AUTOMAKE_OPTIONS = info-in-builddir foreign no-texinfo.tex
++
++# Options to extract the man page
++MANCONF = -Dman
++TEXI2POD = perl $(srcdir)/../../etc/texi2pod.pl $(AM_MAKEINFOFLAGS)
++POD2MAN = pod2man --center="User Commands" \
++	--release="binutils-$(VERSION)" --section=1
++
+ info_TEXINFOS = gprofng.texi
+ gprofng_TEXINFOS = fdl.texi
+ TEXINFO_TEX = .
+ MAKEINFOHTML = $(MAKEINFO) --html --no-split
+-MAINTAINERCLEANFILES = gprofng.info
++man_MANS = gprofng.1
++MAINTAINERCLEANFILES = gprofng.info $(man_MANS)
+ all: all-am
+ 
+ .SUFFIXES:
+@@ -558,6 +569,49 @@ maintainer-clean-aminfo:
+ 	  echo " rm -f $$i $$i-[0-9] $$i-[0-9][0-9] $$i_i[0-9] $$i_i[0-9][0-9]"; \
+ 	  rm -f $$i $$i-[0-9] $$i-[0-9][0-9] $$i_i[0-9] $$i_i[0-9][0-9]; \
+ 	done
++install-man1: $(man_MANS)
++	@$(NORMAL_INSTALL)
++	@list1=''; \
++	list2='$(man_MANS)'; \
++	test -n "$(man1dir)" \
++	  && test -n "`echo $$list1$$list2`" \
++	  || exit 0; \
++	echo " $(MKDIR_P) '$(DESTDIR)$(man1dir)'"; \
++	$(MKDIR_P) "$(DESTDIR)$(man1dir)" || exit 1; \
++	{ for i in $$list1; do echo "$$i"; done;  \
++	if test -n "$$list2"; then \
++	  for i in $$list2; do echo "$$i"; done \
++	    | sed -n '/\.1[a-z]*$$/p'; \
++	fi; \
++	} | while read p; do \
++	  if test -f $$p; then d=; else d="$(srcdir)/"; fi; \
++	  echo "$$d$$p"; echo "$$p"; \
++	done | \
++	sed -e 'n;s,.*/,,;p;h;s,.*\.,,;s,^[^1][0-9a-z]*$$,1,;x' \
++	      -e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,' | \
++	sed 'N;N;s,\n, ,g' | { \
++	list=; while read file base inst; do \
++	  if test "$$base" = "$$inst"; then list="$$list $$file"; else \
++	    echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man1dir)/$$inst'"; \
++	    $(INSTALL_DATA) "$$file" "$(DESTDIR)$(man1dir)/$$inst" || exit $$?; \
++	  fi; \
++	done; \
++	for i in $$list; do echo "$$i"; done | $(am__base_list) | \
++	while read files; do \
++	  test -z "$$files" || { \
++	    echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(man1dir)'"; \
++	    $(INSTALL_DATA) $$files "$(DESTDIR)$(man1dir)" || exit $$?; }; \
++	done; }
++
++uninstall-man1:
++	@$(NORMAL_UNINSTALL)
++	@list=''; test -n "$(man1dir)" || exit 0; \
++	files=`{ for i in $$list; do echo "$$i"; done; \
++	l2='$(man_MANS)'; for i in $$l2; do echo "$$i"; done | \
++	  sed -n '/\.1[a-z]*$$/p'; \
++	} | sed -e 's,.*/,,;h;s,.*\.,,;s,^[^1][0-9a-z]*$$,1,;x' \
++	      -e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,'`; \
++	dir='$(DESTDIR)$(man1dir)'; $(am__uninstall_files_from_dir)
+ tags TAGS:
+ 
+ ctags CTAGS:
+@@ -600,9 +654,9 @@ distdir: $(DISTFILES)
+ 	  dist-info
+ check-am: all-am
+ check: check-am
+-all-am: Makefile $(INFO_DEPS)
++all-am: Makefile $(INFO_DEPS) $(MANS)
+ installdirs:
+-	for dir in "$(DESTDIR)$(infodir)"; do \
++	for dir in "$(DESTDIR)$(infodir)" "$(DESTDIR)$(man1dir)"; do \
+ 	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
+ 	done
+ install: install-am
+@@ -652,11 +706,9 @@ html: html-am
+ 
+ html-am: $(HTMLS)
+ 
+-info: info-am
+-
+ info-am: $(INFO_DEPS)
+ 
+-install-data-am: install-info-am
++install-data-am: install-info-am install-man
+ 
+ install-dvi: install-dvi-am
+ 
+@@ -739,7 +791,7 @@ install-info-am: $(INFO_DEPS)
+ 	    install-info --info-dir="$(DESTDIR)$(infodir)" "$(DESTDIR)$(infodir)/$$relfile" || :;\
+ 	  done; \
+ 	else : ; fi
+-install-man:
++install-man: install-man1
+ 
+ install-pdf: install-pdf-am
+ 
+@@ -794,7 +846,9 @@ ps: ps-am
+ ps-am: $(PSS)
+ 
+ uninstall-am: uninstall-dvi-am uninstall-html-am uninstall-info-am \
+-	uninstall-pdf-am uninstall-ps-am
++	uninstall-man uninstall-pdf-am uninstall-ps-am
++
++uninstall-man: uninstall-man1
+ 
+ .MAKE: install-am install-strip
+ 
+@@ -804,19 +858,32 @@ uninstall-am: uninstall-dvi-am uninstall
+ 	html-am info info-am install install-am install-data \
+ 	install-data-am install-dvi install-dvi-am install-exec \
+ 	install-exec-am install-html install-html-am install-info \
+-	install-info-am install-man install-pdf install-pdf-am \
+-	install-ps install-ps-am install-strip installcheck \
+-	installcheck-am installdirs maintainer-clean \
++	install-info-am install-man install-man1 install-pdf \
++	install-pdf-am install-ps install-ps-am install-strip \
++	installcheck installcheck-am installdirs maintainer-clean \
+ 	maintainer-clean-aminfo maintainer-clean-generic \
+ 	maintainer-clean-vti mostlyclean mostlyclean-aminfo \
+ 	mostlyclean-generic mostlyclean-libtool mostlyclean-vti pdf \
+ 	pdf-am ps ps-am tags-am uninstall uninstall-am \
+ 	uninstall-dvi-am uninstall-html-am uninstall-info-am \
+-	uninstall-pdf-am uninstall-ps-am
++	uninstall-man uninstall-man1 uninstall-pdf-am uninstall-ps-am
+ 
+ .PRECIOUS: Makefile
+ 
+ 
++# Build the man page from the texinfo file
++# The sed command removes the no-adjust Nroff command so that
++# the man output looks standard.
++gprofng.1: $(srcdir)/gprofng.texi
++	$(AM_V_GEN)touch $@
++	$(AM_V_at)-$(TEXI2POD) $(MANCONF) < $(srcdir)/gprofng.texi > gprofng.pod
++	$(AM_V_at)-($(POD2MAN) gprofng.pod | \
++	  sed -e '/^.if n .na/d' > $@.tmp && \
++	  mv -f $@.tmp $@) || (rm -f $@.tmp && exit 1)
++	$(AM_V_at)rm -f gprofng.pod
++
++info: $(man_MANS)
++
+ # Tell versions [3.59,3.63) of GNU make to not export all variables.
+ # Otherwise a system limit (for SysV at least) may be exceeded.
+ .NOEXPORT:
+--- a/gprofng/doc/gprofng.texi
++++ b/gprofng/doc/gprofng.texi
+@@ -1,5 +1,8 @@
+ \input texinfo @c -*-texinfo-*-
+ 
++@c for $sect (qw(NAME SYNOPSIS TARGET DESCRIPTION OPTIONS ENVIRONMENT FILES
++@c               BUGS NOTES FOOTNOTES SEEALSO AUTHOR COPYRIGHT)) {
++
+ @c ----------------------------------------------------------------------------
+ @c This is the Texinfo source file for the GPROFNG manual.
+ @c
+@@ -59,6 +62,10 @@ gprofng
+ @cindex \label\, \string\
+ @end macro
+ 
++@macro gcctabopt{body}
++@code{\body\}
++@end macro
++
+ @c -- Get the version information ---------------------------------------------
+ @include version.texi
+ 
+@@ -99,6 +106,20 @@ section entitled ``GNU Free Documentatio
+ @page
+ @vskip 0pt plus 1filll
+ @insertcopying
++
++@c man begin COPYRIGHT
++
++Copyright @copyright{} 2022-2023 Free Software Foundation, Inc.
++
++Permission is granted to copy, distribute and/or modify this document
++under the terms of the GNU Free Documentation License, Version 1.3
++or any later version published by the Free Software Foundation;
++with no Invariant Sections, with no Front-Cover Texts, and with no
++Back-Cover Texts.  A copy of the license is included in the
++section entitled ``GNU Free Documentation License''.
++
++@c man end
++
+ @end titlepage
+ 
+ @c -- Generate the Table of Contents ------------------------------------------
+@@ -163,6 +184,154 @@ Terminology
+ @end menu
+ @end ifinfo
+ 
++@ifset man
++
++@c man title gprofng the driver for the gprofng tool suite
++
++@c man begin SYNOPSIS
++gprofng [OPTION(S)] ACTION [@b{QUALIFIER}] [ARGUMENTS] TARGET
++@c man end
++
++@c man begin DESCRIPTION
++This is the driver for the GPROFNG tools suite to gather and analyze performance data.
++
++The driver executes the action specified. An example of an action is @code{collect}
++to collect performance data. Depending on the action, a qualifier may be needed to
++define the command. Several qualifiers support options. The last item on the command
++is the target the command applies to.
++
++For example, to collect performance data for an application called @code{a.out} and
++store the results in experiment directory @code{mydata.er}, the following command may
++be used:
++
++@smallexample
++$ gprofng collect app -o mydata.er a.out
++@end smallexample
++
++In this example, the action is @code{collect}, the qualifier is @code{app}, the single
++argument is @code{-o mydata.er} and the target is @code{a.out}.
++
++If gprofng is executed without any additional option, action, or target, a usage
++overview is printed.
++
++@c man end
++
++@c man begin OPTIONS
++
++@table @gcctabopt
++
++@item @var{--version}
++print the version number and exit.
++
++@item @var{--help}
++print usage information and exit.
++
++@end table
++
++@c man end
++
++@c man begin NOTES
++
++The gprofng driver supports the following commands.
++
++@c The man pages for the commands below can be viewed using the command name with "gprofng" replaced by "gp" and the spaces replaced by a dash ("-"). For example the man page
++@c        name for "gprofng collect app" is "gp-collect-app".
++
++Collect performance data:
++
++@table @code
++
++@item gprofng collect app
++collect application performance data.
++
++@end table
++
++Display the performance results:
++
++@table @code
++
++@item gprofng display text
++display the performance data in ASCII format.
++
++@item gprofng display html
++generate an HTML file from one or more experiments.
++
++@end table
++
++Miscellaneous commands:
++
++@table @code
++
++@item gprofng display src
++display source or disassembly with compiler annotations.
++
++@item gprofng archive
++include binaries and source code in an experiment directory.
++
++@end table
++
++It is also possible to invoke the lower level commands directly, but since
++these are subject to change, in particular the options, we recommend to
++use the driver.
++
++@c man end
++
++@c man begin ENVIRONMENT
++The following environment variables are supported:
++
++@table @code
++
++@item @env{GPROFNG_MAX_CALL_STACK_DEPTH}
++set the depth of the call stack (default is 256).
++
++@item @env{GPROFNG_USE_JAVA_OPTIONS}
++may be set when profiling a C/C++ application that uses dlopen() to execute Java code.
++
++@item @env{GPROFNG_SSH_REMOTE_DISPLAY}
++use this variable to define the ssh command executed by the remote display tool.
++
++@item @env{GPROFNG_SKIP_VALIDATION}
++set this variable to disable checking hardware, system, and Java versions.
++
++@item @env{GPROFNG_ALLOW_CORE_DUMP}
++set this variable to allow a core file to be generated; otherwise an error report is created on /tmp.
++
++@item @env{GPROFNG_ARCHIVE}
++use this variable to define the settings for automatic archiving upon experiment recording completion.
++
++@item @env{GPROFNG_ARCHIVE_COMMON_DIR}
++set this variable to the location of the common archive.
++
++@item @env{GPROFNG_JAVA_MAX_CALL_STACK_DEPTH}
++set the depth of the Java call stack; the default is 256; set to 0 to disable capturing of call stacks.
++
++@item @env{GPROFNG_JAVA_NATIVE_MAX_CALL_STACK_DEPTH}
++set the depth of the Java native call stack; the default is 256; set to 0 to disable capturing of call stacks (JNI and assembly call stacks are not captured).
++
++@end table
++
++@c man end
++
++@c man begin SEEALSO
++The man pages for the various gprofng commands are not available yet, but
++the @option{--help} option supported on each of the commands lists the options
++and provides more information.
++
++For example this displays the options supported on the @command{gprofng collect app}
++command:
++
++@smallexample
++$ gprofng collect app --help
++@end smallexample
++
++The user guide is available as an Info entry for @file{gprofng}.
++@c man end
++
++@end ifset
++
++@c man begin DESCRIPTION
++@c man end
++
+ @c -- A new node --------------------------------------------------------------
+ @node    Introduction
+ @chapter Introduction
+--- a/gprofng/src/Makefile.am
++++ b/gprofng/src/Makefile.am
+@@ -160,7 +160,7 @@ gp_display_text_LDADD = $(LIBGPROFNG) $(
+ 
+ if BUILD_MAN
+ 
+-man_MANS = gprofng.1 \
++man_MANS = \
+ 	gp-archive.1 \
+ 	gp-collect-app.1 \
+ 	gp-display-src.1 \
+@@ -191,10 +191,6 @@ H2M_FILTER = | sed 's/\.TP/\.TP\n.B/' |
+   | sed 's/See also:/\.SH SEE ALSO/' | sed 's/Documentation:/.SH DOCUMENTATION/' \
+   | sed 's/Limitations:/.SH LIMITATIONS/'
+ 
+-gprofng.1: $(srcdir)/gprofng.cc $(common_mandeps) | ./gprofng$(EXEEXT)
+-	$(AM_V_GEN)_BUILDING_MANPAGE=1 $(HELP2MAN) $(HELP2MAN_OPT) \
+-	  --name=$(TEXT_GPROFNG) ./gprofng$(EXEEXT) $(H2M_FILTER) > $@
+-
+ gp-archive.1: $(srcdir)/gp-archive.cc $(common_mandeps) | ./gp-archive$(EXEEXT)
+ 	$(AM_V_GEN)_BUILDING_MANPAGE=1 $(HELP2MAN) $(HELP2MAN_OPT) \
+ 	  --name=$(TEXT_GP_ARCHIVE) ./gp-archive$(EXEEXT) $(H2M_FILTER) > $@
+@@ -223,3 +219,5 @@ dist-hook: $(LIBGPROFNG)
+ 
+ install-data-local: install-pkglibLTLIBRARIES
+ 	rm -f $(DESTDIR)/$(pkglibdir)/*.la $(DESTDIR)/$(pkglibdir)/*.a
++
++$(srcdir)/DbeSession.cc: QLParser.tab.hh
+--- a/gprofng/src/Makefile.in
++++ b/gprofng/src/Makefile.in
+@@ -572,7 +572,7 @@ gp_display_src_SOURCES = gp-display-src.
+ gp_display_src_LDADD = $(LIBGPROFNG) $(CLOCK_GETTIME_LINK) $(ZLIB)
+ gp_display_text_SOURCES = gp-display-text.cc ipc.cc ipcio.cc
+ gp_display_text_LDADD = $(LIBGPROFNG) $(CLOCK_GETTIME_LINK) $(ZLIB)
+-@BUILD_MAN_TRUE@man_MANS = gprofng.1 \
++@BUILD_MAN_TRUE@man_MANS = \
+ @BUILD_MAN_TRUE@	gp-archive.1 \
+ @BUILD_MAN_TRUE@	gp-collect-app.1 \
+ @BUILD_MAN_TRUE@	gp-display-src.1 \
+@@ -1176,10 +1176,6 @@ uninstall-man: uninstall-man1
+ QLParser.tab.cc QLParser.tab.hh: QLParser.yy
+ 	$(BISON) $^
+ 
+-@BUILD_MAN_TRUE@gprofng.1: $(srcdir)/gprofng.cc $(common_mandeps) | ./gprofng$(EXEEXT)
+-@BUILD_MAN_TRUE@	$(AM_V_GEN)_BUILDING_MANPAGE=1 $(HELP2MAN) $(HELP2MAN_OPT) \
+-@BUILD_MAN_TRUE@	  --name=$(TEXT_GPROFNG) ./gprofng$(EXEEXT) $(H2M_FILTER) > $@
+-
+ @BUILD_MAN_TRUE@gp-archive.1: $(srcdir)/gp-archive.cc $(common_mandeps) | ./gp-archive$(EXEEXT)
+ @BUILD_MAN_TRUE@	$(AM_V_GEN)_BUILDING_MANPAGE=1 $(HELP2MAN) $(HELP2MAN_OPT) \
+ @BUILD_MAN_TRUE@	  --name=$(TEXT_GP_ARCHIVE) ./gp-archive$(EXEEXT) $(H2M_FILTER) > $@
+@@ -1207,6 +1203,8 @@ dist-hook: $(LIBGPROFNG)
+ install-data-local: install-pkglibLTLIBRARIES
+ 	rm -f $(DESTDIR)/$(pkglibdir)/*.la $(DESTDIR)/$(pkglibdir)/*.a
+ 
++$(srcdir)/DbeSession.cc: QLParser.tab.hh
++
+ # Tell versions [3.59,3.63) of GNU make to not export all variables.
+ # Otherwise a system limit (for SysV at least) may be exceeded.
+ .NOEXPORT:
diff --git a/toolchain/binutils/patches/2.40/020-gprofng-PR30043-libgprofng.so.-are-installed-to-a-wr.patch b/toolchain/binutils/patches/2.40/020-gprofng-PR30043-libgprofng.so.-are-installed-to-a-wr.patch
new file mode 100644
index 00000000000000..d8d76a2961bf8c
--- /dev/null
+++ b/toolchain/binutils/patches/2.40/020-gprofng-PR30043-libgprofng.so.-are-installed-to-a-wr.patch
@@ -0,0 +1,212 @@
+From edd36b26f3506eeb259534ba2493e15c728cd280 Mon Sep 17 00:00:00 2001
+From: Vladimir Mezentsev <vladimir.mezentsev@oracle.com>
+Date: Wed, 25 Jan 2023 19:21:38 -0800
+Subject: [PATCH 20/50] gprofng: PR30043 libgprofng.so.* are installed to a
+ wrong location
+
+gprofng/ChangeLog
+2023-01-25  Vladimir Mezentsev  <vladimir.mezentsev@oracle.com>
+
+	PR gprofng/30043
+	PR gprofng/28972
+	* src/Makefile.am: Use lib_LTLIBRARIES instead of pkglib_LTLIBRARIES.
+	* src/Makefile.in: Rebuild.
+---
+ gprofng/src/Makefile.am |  7 +---
+ gprofng/src/Makefile.in | 76 +++++++++++++++++++----------------------
+ 2 files changed, 37 insertions(+), 46 deletions(-)
+
+--- a/gprofng/src/Makefile.am
++++ b/gprofng/src/Makefile.am
+@@ -124,7 +124,7 @@ BUILT_SOURCES = QLParser.tab.hh
+ EXTRA_DIST = QLParser.yy $(man_MANS)
+ 
+ 
+-pkglib_LTLIBRARIES = $(LIBGPROFNG)
++lib_LTLIBRARIES = $(LIBGPROFNG)
+ libgprofng_la_SOURCES = $(CCSOURCES) $(CSOURCES)
+ libgprofng_la_LDFLAGS = -version-info 0:0:0
+ 
+@@ -215,9 +215,4 @@ endif
+ # so ensure that the necessary libraries are built at dist time.
+ dist-hook: $(LIBGPROFNG)
+ 
+-.PHONY: install-data-local
+-
+-install-data-local: install-pkglibLTLIBRARIES
+-	rm -f $(DESTDIR)/$(pkglibdir)/*.la $(DESTDIR)/$(pkglibdir)/*.a
+-
+ $(srcdir)/DbeSession.cc: QLParser.tab.hh
+--- a/gprofng/src/Makefile.in
++++ b/gprofng/src/Makefile.in
+@@ -155,9 +155,9 @@ am__uninstall_files_from_dir = { \
+     || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
+          $(am__cd) "$$dir" && rm -f $$files; }; \
+   }
+-am__installdirs = "$(DESTDIR)$(pkglibdir)" "$(DESTDIR)$(bindir)" \
++am__installdirs = "$(DESTDIR)$(libdir)" "$(DESTDIR)$(bindir)" \
+ 	"$(DESTDIR)$(man1dir)" "$(DESTDIR)$(dbedir)"
+-LTLIBRARIES = $(pkglib_LTLIBRARIES)
++LTLIBRARIES = $(lib_LTLIBRARIES)
+ am__DEPENDENCIES_1 =
+ libgprofng_la_DEPENDENCIES = $(top_builddir)/../opcodes/libopcodes.la \
+ 	$(top_builddir)/../bfd/libbfd.la $(am__DEPENDENCIES_1)
+@@ -548,7 +548,7 @@ AM_CFLAGS = $(GPROFNG_CFLAGS) $(PTHREAD_
+ AM_CXXFLAGS = $(AM_CFLAGS)
+ BUILT_SOURCES = QLParser.tab.hh
+ EXTRA_DIST = QLParser.yy $(man_MANS)
+-pkglib_LTLIBRARIES = $(LIBGPROFNG)
++lib_LTLIBRARIES = $(LIBGPROFNG)
+ libgprofng_la_SOURCES = $(CCSOURCES) $(CSOURCES)
+ libgprofng_la_LDFLAGS = -version-info 0:0:0
+ 
+@@ -636,33 +636,33 @@ $(ACLOCAL_M4): @MAINTAINER_MODE_TRUE@ $(
+ 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+ $(am__aclocal_m4_deps):
+ 
+-install-pkglibLTLIBRARIES: $(pkglib_LTLIBRARIES)
++install-libLTLIBRARIES: $(lib_LTLIBRARIES)
+ 	@$(NORMAL_INSTALL)
+-	@list='$(pkglib_LTLIBRARIES)'; test -n "$(pkglibdir)" || list=; \
++	@list='$(lib_LTLIBRARIES)'; test -n "$(libdir)" || list=; \
+ 	list2=; for p in $$list; do \
+ 	  if test -f $$p; then \
+ 	    list2="$$list2 $$p"; \
+ 	  else :; fi; \
+ 	done; \
+ 	test -z "$$list2" || { \
+-	  echo " $(MKDIR_P) '$(DESTDIR)$(pkglibdir)'"; \
+-	  $(MKDIR_P) "$(DESTDIR)$(pkglibdir)" || exit 1; \
+-	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(pkglibdir)'"; \
+-	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(pkglibdir)"; \
++	  echo " $(MKDIR_P) '$(DESTDIR)$(libdir)'"; \
++	  $(MKDIR_P) "$(DESTDIR)$(libdir)" || exit 1; \
++	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(libdir)'"; \
++	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(libdir)"; \
+ 	}
+ 
+-uninstall-pkglibLTLIBRARIES:
++uninstall-libLTLIBRARIES:
+ 	@$(NORMAL_UNINSTALL)
+-	@list='$(pkglib_LTLIBRARIES)'; test -n "$(pkglibdir)" || list=; \
++	@list='$(lib_LTLIBRARIES)'; test -n "$(libdir)" || list=; \
+ 	for p in $$list; do \
+ 	  $(am__strip_dir) \
+-	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(pkglibdir)/$$f'"; \
+-	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(pkglibdir)/$$f"; \
++	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(libdir)/$$f'"; \
++	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(libdir)/$$f"; \
+ 	done
+ 
+-clean-pkglibLTLIBRARIES:
+-	-test -z "$(pkglib_LTLIBRARIES)" || rm -f $(pkglib_LTLIBRARIES)
+-	@list='$(pkglib_LTLIBRARIES)'; \
++clean-libLTLIBRARIES:
++	-test -z "$(lib_LTLIBRARIES)" || rm -f $(lib_LTLIBRARIES)
++	@list='$(lib_LTLIBRARIES)'; \
+ 	locs=`for p in $$list; do echo $$p; done | \
+ 	      sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \
+ 	      sort -u`; \
+@@ -672,7 +672,7 @@ clean-pkglibLTLIBRARIES:
+ 	}
+ 
+ libgprofng.la: $(libgprofng_la_OBJECTS) $(libgprofng_la_DEPENDENCIES) $(EXTRA_libgprofng_la_DEPENDENCIES) 
+-	$(AM_V_CXXLD)$(libgprofng_la_LINK) -rpath $(pkglibdir) $(libgprofng_la_OBJECTS) $(libgprofng_la_LIBADD) $(LIBS)
++	$(AM_V_CXXLD)$(libgprofng_la_LINK) -rpath $(libdir) $(libgprofng_la_OBJECTS) $(libgprofng_la_LIBADD) $(LIBS)
+ install-binPROGRAMS: $(bin_PROGRAMS)
+ 	@$(NORMAL_INSTALL)
+ 	@list='$(bin_PROGRAMS)'; test -n "$(bindir)" || list=; \
+@@ -1039,8 +1039,10 @@ check-am: all-am
+ check: $(BUILT_SOURCES)
+ 	$(MAKE) $(AM_MAKEFLAGS) check-am
+ all-am: Makefile $(LTLIBRARIES) $(PROGRAMS) $(MANS) $(DATA)
++install-binPROGRAMS: install-libLTLIBRARIES
++
+ installdirs:
+-	for dir in "$(DESTDIR)$(pkglibdir)" "$(DESTDIR)$(bindir)" "$(DESTDIR)$(man1dir)" "$(DESTDIR)$(dbedir)"; do \
++	for dir in "$(DESTDIR)$(libdir)" "$(DESTDIR)$(bindir)" "$(DESTDIR)$(man1dir)" "$(DESTDIR)$(dbedir)"; do \
+ 	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
+ 	done
+ install: $(BUILT_SOURCES)
+@@ -1078,8 +1080,8 @@ maintainer-clean-generic:
+ 	-test -z "$(MAINTAINERCLEANFILES)" || rm -f $(MAINTAINERCLEANFILES)
+ clean: clean-am
+ 
+-clean-am: clean-binPROGRAMS clean-generic clean-libtool \
+-	clean-pkglibLTLIBRARIES mostlyclean-am
++clean-am: clean-binPROGRAMS clean-generic clean-libLTLIBRARIES \
++	clean-libtool mostlyclean-am
+ 
+ distclean: distclean-am
+ 	-rm -rf ./$(DEPDIR)
+@@ -1099,13 +1101,13 @@ info: info-am
+ 
+ info-am:
+ 
+-install-data-am: install-data-local install-dbeDATA install-man
++install-data-am: install-dbeDATA install-man
+ 
+ install-dvi: install-dvi-am
+ 
+ install-dvi-am:
+ 
+-install-exec-am: install-binPROGRAMS install-pkglibLTLIBRARIES
++install-exec-am: install-binPROGRAMS install-libLTLIBRARIES
+ 
+ install-html: install-html-am
+ 
+@@ -1145,30 +1147,29 @@ ps: ps-am
+ 
+ ps-am:
+ 
+-uninstall-am: uninstall-binPROGRAMS uninstall-dbeDATA uninstall-man \
+-	uninstall-pkglibLTLIBRARIES
++uninstall-am: uninstall-binPROGRAMS uninstall-dbeDATA \
++	uninstall-libLTLIBRARIES uninstall-man
+ 
+ uninstall-man: uninstall-man1
+ 
+ .MAKE: all check install install-am install-strip
+ 
+ .PHONY: CTAGS GTAGS TAGS all all-am check check-am clean \
+-	clean-binPROGRAMS clean-generic clean-libtool \
+-	clean-pkglibLTLIBRARIES cscopelist-am ctags ctags-am dist-hook \
+-	distclean distclean-compile distclean-generic \
+-	distclean-libtool distclean-tags distdir dvi dvi-am html \
+-	html-am info info-am install install-am install-binPROGRAMS \
+-	install-data install-data-am install-data-local \
+-	install-dbeDATA install-dvi install-dvi-am install-exec \
+-	install-exec-am install-html install-html-am install-info \
+-	install-info-am install-man install-man1 install-pdf \
+-	install-pdf-am install-pkglibLTLIBRARIES install-ps \
++	clean-binPROGRAMS clean-generic clean-libLTLIBRARIES \
++	clean-libtool cscopelist-am ctags ctags-am dist-hook distclean \
++	distclean-compile distclean-generic distclean-libtool \
++	distclean-tags distdir dvi dvi-am html html-am info info-am \
++	install install-am install-binPROGRAMS install-data \
++	install-data-am install-dbeDATA install-dvi install-dvi-am \
++	install-exec install-exec-am install-html install-html-am \
++	install-info install-info-am install-libLTLIBRARIES \
++	install-man install-man1 install-pdf install-pdf-am install-ps \
+ 	install-ps-am install-strip installcheck installcheck-am \
+ 	installdirs maintainer-clean maintainer-clean-generic \
+ 	mostlyclean mostlyclean-compile mostlyclean-generic \
+ 	mostlyclean-libtool pdf pdf-am ps ps-am tags tags-am uninstall \
+ 	uninstall-am uninstall-binPROGRAMS uninstall-dbeDATA \
+-	uninstall-man uninstall-man1 uninstall-pkglibLTLIBRARIES
++	uninstall-libLTLIBRARIES uninstall-man uninstall-man1
+ 
+ .PRECIOUS: Makefile
+ 
+@@ -1198,11 +1199,6 @@ QLParser.tab.cc QLParser.tab.hh: QLParse
+ # so ensure that the necessary libraries are built at dist time.
+ dist-hook: $(LIBGPROFNG)
+ 
+-.PHONY: install-data-local
+-
+-install-data-local: install-pkglibLTLIBRARIES
+-	rm -f $(DESTDIR)/$(pkglibdir)/*.la $(DESTDIR)/$(pkglibdir)/*.a
+-
+ $(srcdir)/DbeSession.cc: QLParser.tab.hh
+ 
+ # Tell versions [3.59,3.63) of GNU make to not export all variables.
diff --git a/toolchain/binutils/patches/2.40/026-RISC-V-make-C-extension-JAL-available-again-for-32-b.patch b/toolchain/binutils/patches/2.40/026-RISC-V-make-C-extension-JAL-available-again-for-32-b.patch
new file mode 100644
index 00000000000000..4129a22906da48
--- /dev/null
+++ b/toolchain/binutils/patches/2.40/026-RISC-V-make-C-extension-JAL-available-again-for-32-b.patch
@@ -0,0 +1,115 @@
+From 27f59ec47a18277b6ea3548f405263ef558f5217 Mon Sep 17 00:00:00 2001
+From: Jan Beulich <jbeulich@suse.com>
+Date: Tue, 31 Jan 2023 09:47:22 +0100
+Subject: [PATCH 26/50] RISC-V: make C-extension JAL available again for
+ (32-bit) assembly
+
+Along with the normal JAL alias, the C-extension one should have been
+moved as well by 839189bc932e ("RISC-V: re-arrange opcode table for
+consistent alias handling"), for the assembler to actually be able to
+use it where/when possible.
+
+Since neither this nor any other compressed branch insn was being tested
+so far, take the opportunity and introduce a new testcase covering those.
+---
+ gas/config/tc-riscv.c                 |  3 +++
+ gas/testsuite/gas/riscv/c-branch-na.d | 20 ++++++++++++++++++++
+ gas/testsuite/gas/riscv/c-branch.d    | 19 +++++++++++++++++++
+ gas/testsuite/gas/riscv/c-branch.s    | 11 +++++++++++
+ opcodes/riscv-opc.c                   |  2 +-
+ 5 files changed, 54 insertions(+), 1 deletion(-)
+ create mode 100644 gas/testsuite/gas/riscv/c-branch-na.d
+ create mode 100644 gas/testsuite/gas/riscv/c-branch.d
+ create mode 100644 gas/testsuite/gas/riscv/c-branch.s
+
+--- a/gas/config/tc-riscv.c
++++ b/gas/config/tc-riscv.c
+@@ -2762,6 +2762,8 @@ riscv_ip (char *str, struct riscv_cl_ins
+ 		case 'p':
+ 		  goto branch;
+ 		case 'a':
++		  if (oparg == insn->args + 1)
++		    goto jump_check_gpr;
+ 		  goto jump;
+ 		case 'S': /* Floating-point RS1 x8-x15.  */
+ 		  if (!reg_lookup (&asarg, RCLASS_FPR, &regno)
+@@ -3271,6 +3273,7 @@ riscv_ip (char *str, struct riscv_cl_ins
+ 		 but the 2nd (with 2 operands) might.  */
+ 	      if (oparg == insn->args)
+ 		{
++	    jump_check_gpr:
+ 		  asargStart = asarg;
+ 		  if (reg_lookup (&asarg, RCLASS_GPR, NULL)
+ 		      && (*asarg == ',' || (ISSPACE (*asarg) && asarg[1] == ',')))
+--- /dev/null
++++ b/gas/testsuite/gas/riscv/c-branch-na.d
+@@ -0,0 +1,20 @@
++#as: -march=rv32ic
++#source: c-branch.s
++#objdump: -drw -Mno-aliases
++
++.*:[ 	]+file format .*
++
++
++Disassembly of section .text:
++
++0+ <target>:
++[ 	]+[0-9a-f]+:[ 	]+c001[ 	]+c\.beqz[ 	]+s0,0 <target>[ 	]+0: R_RISCV_RVC_BRANCH	.*
++[ 	]+[0-9a-f]+:[ 	]+dcfd[ 	]+c\.beqz[ 	]+s1,0 <target>[ 	]+2: R_RISCV_RVC_BRANCH	.*
++[ 	]+[0-9a-f]+:[ 	]+fc75[ 	]+c\.bnez[ 	]+s0,0 <target>[ 	]+4: R_RISCV_RVC_BRANCH	.*
++[ 	]+[0-9a-f]+:[ 	]+fced[ 	]+c\.bnez[ 	]+s1,0 <target>[ 	]+6: R_RISCV_RVC_BRANCH	.*
++[ 	]+[0-9a-f]+:[ 	]+bfe5[ 	]+c\.j[ 	]+0 <target>[ 	]+8: R_RISCV_RVC_JUMP	.*
++[ 	]+[0-9a-f]+:[ 	]+3fdd[ 	]+c\.jal[ 	]+0 <target>[ 	]+a: R_RISCV_RVC_JUMP	.*
++[ 	]+[0-9a-f]+:[ 	]+9302[ 	]+c\.jalr[ 	]+t1
++[ 	]+[0-9a-f]+:[ 	]+8382[ 	]+c\.jr[ 	]+t2
++[ 	]+[0-9a-f]+:[ 	]+8082[ 	]+c\.jr[ 	]+ra
++#...
+--- /dev/null
++++ b/gas/testsuite/gas/riscv/c-branch.d
+@@ -0,0 +1,19 @@
++#as: -march=rv64ic
++#objdump: -drw
++
++.*:[ 	]+file format .*
++
++
++Disassembly of section .text:
++
++0+ <target>:
++[ 	]+[0-9a-f]+:[ 	]+c001[ 	]+beqz[ 	]+s0,0 <target>[ 	]+0: R_RISCV_RVC_BRANCH	.*
++[ 	]+[0-9a-f]+:[ 	]+dcfd[ 	]+beqz[ 	]+s1,0 <target>[ 	]+2: R_RISCV_RVC_BRANCH	.*
++[ 	]+[0-9a-f]+:[ 	]+fc75[ 	]+bnez[ 	]+s0,0 <target>[ 	]+4: R_RISCV_RVC_BRANCH	.*
++[ 	]+[0-9a-f]+:[ 	]+fced[ 	]+bnez[ 	]+s1,0 <target>[ 	]+6: R_RISCV_RVC_BRANCH	.*
++[ 	]+[0-9a-f]+:[ 	]+bfe5[ 	]+j[ 	]+0 <target>[ 	]+8: R_RISCV_RVC_JUMP	.*
++[ 	]+[0-9a-f]+:[ 	]+ff7ff0ef[ 	]+jal[ 	]+0 <target>[ 	]+a: R_RISCV_JAL	.*
++[ 	]+[0-9a-f]+:[ 	]+9302[ 	]+jalr[ 	]+t1
++[ 	]+[0-9a-f]+:[ 	]+8382[ 	]+jr[ 	]+t2
++[ 	]+[0-9a-f]+:[ 	]+8082[ 	]+ret
++#...
+--- /dev/null
++++ b/gas/testsuite/gas/riscv/c-branch.s
+@@ -0,0 +1,11 @@
++	.text
++target:
++	beq	x8, x0, target
++	beqz	x9, target
++	bne	x8, x0, target
++	bnez	x9, target
++	j	target
++	jal	target
++	jalr	x6
++	jr	x7
++	ret
+--- a/opcodes/riscv-opc.c
++++ b/opcodes/riscv-opc.c
+@@ -340,9 +340,9 @@ const struct riscv_opcode riscv_opcodes[
+ {"jalr",        0, INSN_CLASS_I, "d,s,j",     MATCH_JALR, MASK_JALR, match_opcode, INSN_JSR },
+ {"j",           0, INSN_CLASS_C, "Ca",        MATCH_C_J, MASK_C_J, match_opcode, INSN_ALIAS|INSN_BRANCH },
+ {"j",           0, INSN_CLASS_I, "a",         MATCH_JAL, MASK_JAL|MASK_RD, match_opcode, INSN_ALIAS|INSN_BRANCH },
++{"jal",        32, INSN_CLASS_C, "Ca",        MATCH_C_JAL, MASK_C_JAL, match_opcode, INSN_ALIAS|INSN_JSR },
+ {"jal",         0, INSN_CLASS_I, "a",         MATCH_JAL|(X_RA << OP_SH_RD), MASK_JAL|MASK_RD, match_opcode, INSN_ALIAS|INSN_JSR },
+ {"jal",         0, INSN_CLASS_I, "d,a",       MATCH_JAL, MASK_JAL, match_opcode, INSN_JSR },
+-{"jal",        32, INSN_CLASS_C, "Ca",        MATCH_C_JAL, MASK_C_JAL, match_opcode, INSN_ALIAS|INSN_JSR },
+ {"call",        0, INSN_CLASS_I, "d,c",       (X_T1 << OP_SH_RS1), (int) M_CALL, match_never, INSN_MACRO },
+ {"call",        0, INSN_CLASS_I, "c",         (X_RA << OP_SH_RS1)|(X_RA << OP_SH_RD), (int) M_CALL, match_never, INSN_MACRO },
+ {"tail",        0, INSN_CLASS_I, "c",         (X_T1 << OP_SH_RS1), (int) M_CALL, match_never, INSN_MACRO },
diff --git a/toolchain/binutils/patches/2.40/034-bpf-fix-error-conversion-from-long-unsigned-int-to-u.patch b/toolchain/binutils/patches/2.40/034-bpf-fix-error-conversion-from-long-unsigned-int-to-u.patch
new file mode 100644
index 00000000000000..d4317cdb0fbda5
--- /dev/null
+++ b/toolchain/binutils/patches/2.40/034-bpf-fix-error-conversion-from-long-unsigned-int-to-u.patch
@@ -0,0 +1,209 @@
+From 3e888977f165594cf44dbe8f67e3a4960b22c11f Mon Sep 17 00:00:00 2001
+From: "Guillermo E. Martinez" <guillermo.e.martinez@oracle.com>
+Date: Fri, 3 Feb 2023 11:17:49 -0600
+Subject: [PATCH 34/50] bpf: fix error conversion from long unsigned int to
+ unsigned int [-Werror=overflow]
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Regenerating BPF target using the maintainer mode emits:
+.../opcodes/bpf-opc.c:57:11: error: conversion from ‘long unsigned int’ to ‘unsigned int’ changes value from ‘18446744073709486335’ to ‘4294902015’ [-Werror=overflow]
+  57 |   64, 64, 0xffffffffffff00ff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_CODE) }, { F (F_DSTLE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
+
+The use of a narrow size to handle the mask CGEN in instruction format
+is causing this error.  Additionally eBPF `call' instructions
+constructed by expressions using symbols (BPF_PSEUDO_CALL) emits
+annotations in `src' field of the instruction, used to identify BPF
+target endianness.
+
+cpu/
+	* bpf.cpu (define-call-insn): Remove `src' field from
+	instruction mask.
+
+include/
+	*opcode/cge.h (CGEN_IFMT): Adjust mask bit width.
+
+opcodes/
+	* bpf-opc.c: Regenerate.
+
+(cherry picked from commit 7f6ebecd56e690012b05af0a492280765b17f186)
+---
+ cpu/bpf.cpu           |  2 +-
+ include/opcode/cgen.h |  2 +-
+ opcodes/bpf-opc.c     | 54 +++++++++++++++++++++++--------------------
+ opcodes/cgen-dis.c    |  2 +-
+ 4 files changed, 32 insertions(+), 28 deletions(-)
+
+--- a/cpu/bpf.cpu
++++ b/cpu/bpf.cpu
+@@ -768,7 +768,7 @@
+        "call"
+        (endian-isas x-endian)
+        "call $disp32"
+-       (+ disp32 (f-offset16 0) (f-regs 0)
++       (+ disp32 (f-offset16 0) (.sym src x-endian) ((.sym f-dst x-endian) 0)
+           OP_CLASS_JMP OP_SRC_K OP_CODE_CALL)
+        (c-call VOID
+                "bpfbf_call" disp32 (ifield (.sym f-src x-endian)))
+--- a/include/opcode/cgen.h
++++ b/include/opcode/cgen.h
+@@ -914,7 +914,7 @@ typedef struct
+      Each insn's value is stored with the insn.
+      The first step in recognizing an insn for disassembly is
+      (opcode & mask) == value.  */
+-  CGEN_INSN_INT mask;
++  CGEN_INSN_LGUINT mask;
+ #define CGEN_IFMT_MASK(ifmt) ((ifmt)->mask)
+ 
+   /* Instruction fields.
+--- a/opcodes/bpf-opc.c
++++ b/opcodes/bpf-opc.c
+@@ -50,99 +50,103 @@ static const CGEN_IFMT ifmt_empty ATTRIB
+ };
+ 
+ static const CGEN_IFMT ifmt_addile ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_CODE) }, { F (F_DSTLE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xfffff0ff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_CODE) }, { F (F_DSTLE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_addrle ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_CODE) }, { F (F_DSTLE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xffffffffffff00ff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_CODE) }, { F (F_DSTLE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_negle ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_CODE) }, { F (F_DSTLE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xfffffffffffff0ff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_CODE) }, { F (F_DSTLE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_addibe ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_DSTBE) }, { F (F_OP_CODE) }, { F (F_SRCBE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xffff0fff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_DSTBE) }, { F (F_OP_CODE) }, { F (F_SRCBE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_addrbe ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_DSTBE) }, { F (F_OP_CODE) }, { F (F_SRCBE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xffffffffffff00ff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_DSTBE) }, { F (F_OP_CODE) }, { F (F_SRCBE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_negbe ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_DSTBE) }, { F (F_OP_CODE) }, { F (F_SRCBE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xffffffffffff0fff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_DSTBE) }, { F (F_OP_CODE) }, { F (F_SRCBE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_endlele ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_CODE) }, { F (F_DSTLE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xfffff0ff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_CODE) }, { F (F_DSTLE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_endlebe ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_DSTBE) }, { F (F_OP_CODE) }, { F (F_SRCBE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xffff0fff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_DSTBE) }, { F (F_OP_CODE) }, { F (F_SRCBE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_lddwle ATTRIBUTE_UNUSED = {
+-  64, 128, 0xff, { { F (F_IMM64) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_MODE) }, { F (F_OP_SIZE) }, { F (F_DSTLE) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 128, 0xfffff0ff, { { F (F_IMM64) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_MODE) }, { F (F_OP_SIZE) }, { F (F_DSTLE) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_lddwbe ATTRIBUTE_UNUSED = {
+-  64, 128, 0xff, { { F (F_IMM64) }, { F (F_OFFSET16) }, { F (F_DSTBE) }, { F (F_OP_MODE) }, { F (F_OP_SIZE) }, { F (F_SRCBE) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 128, 0xffff0fff, { { F (F_IMM64) }, { F (F_OFFSET16) }, { F (F_DSTBE) }, { F (F_OP_MODE) }, { F (F_OP_SIZE) }, { F (F_SRCBE) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_ldabsw ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_REGS) }, { F (F_OP_MODE) }, { F (F_OP_SIZE) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xffffffff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_REGS) }, { F (F_OP_MODE) }, { F (F_OP_SIZE) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_ldindwle ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_MODE) }, { F (F_OP_SIZE) }, { F (F_DSTLE) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xffff0fff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_MODE) }, { F (F_OP_SIZE) }, { F (F_DSTLE) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_ldindwbe ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_DSTBE) }, { F (F_OP_MODE) }, { F (F_OP_SIZE) }, { F (F_SRCBE) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xfffff0ff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_DSTBE) }, { F (F_OP_MODE) }, { F (F_OP_SIZE) }, { F (F_SRCBE) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_ldxwle ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_MODE) }, { F (F_OP_SIZE) }, { F (F_DSTLE) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xffffffff000000ff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_MODE) }, { F (F_OP_SIZE) }, { F (F_DSTLE) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_ldxwbe ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_DSTBE) }, { F (F_OP_MODE) }, { F (F_OP_SIZE) }, { F (F_SRCBE) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xffffffff000000ff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_DSTBE) }, { F (F_OP_MODE) }, { F (F_OP_SIZE) }, { F (F_SRCBE) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_stble ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_MODE) }, { F (F_OP_SIZE) }, { F (F_DSTLE) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xf0ff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_MODE) }, { F (F_OP_SIZE) }, { F (F_DSTLE) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_stbbe ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_DSTBE) }, { F (F_OP_MODE) }, { F (F_OP_SIZE) }, { F (F_SRCBE) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xfff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_DSTBE) }, { F (F_OP_MODE) }, { F (F_OP_SIZE) }, { F (F_SRCBE) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_jeqile ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_CODE) }, { F (F_DSTLE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xf0ff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_CODE) }, { F (F_DSTLE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_jeqrle ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_CODE) }, { F (F_DSTLE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xffffffff000000ff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_CODE) }, { F (F_DSTLE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_jeqibe ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_DSTBE) }, { F (F_OP_CODE) }, { F (F_SRCBE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xfff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_DSTBE) }, { F (F_OP_CODE) }, { F (F_SRCBE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_jeqrbe ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_DSTBE) }, { F (F_OP_CODE) }, { F (F_SRCBE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xffffffff000000ff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_DSTBE) }, { F (F_OP_CODE) }, { F (F_SRCBE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_callle ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_REGS) }, { F (F_OP_CODE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xffff0fff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_SRCLE) }, { F (F_OP_CODE) }, { F (F_DSTLE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
++};
++
++static const CGEN_IFMT ifmt_callbe ATTRIBUTE_UNUSED = {
++  64, 64, 0xfffff0ff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_DSTBE) }, { F (F_OP_CODE) }, { F (F_SRCBE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_ja ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_REGS) }, { F (F_OP_CODE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xffffffff0000ffff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_REGS) }, { F (F_OP_CODE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ static const CGEN_IFMT ifmt_exit ATTRIBUTE_UNUSED = {
+-  64, 64, 0xff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_REGS) }, { F (F_OP_CODE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
++  64, 64, 0xffffffffffffffff, { { F (F_IMM32) }, { F (F_OFFSET16) }, { F (F_REGS) }, { F (F_OP_CODE) }, { F (F_OP_SRC) }, { F (F_OP_CLASS) }, { 0 } }
+ };
+ 
+ #undef F
+@@ -1646,7 +1650,7 @@ static const CGEN_OPCODE bpf_cgen_insn_o
+   {
+     { 0, 0, 0, 0 },
+     { { MNEM, ' ', OP (DISP32), 0 } },
+-    & ifmt_callle, { 0x85 }
++    & ifmt_callbe, { 0x85 }
+   },
+ /* call $dstle */
+   {
+--- a/opcodes/cgen-dis.c
++++ b/opcodes/cgen-dis.c
+@@ -39,7 +39,7 @@ static void		 add_insn_to_hash_chain (CG
+ static int
+ count_decodable_bits (const CGEN_INSN *insn)
+ {
+-  unsigned mask = CGEN_INSN_BASE_MASK (insn);
++  CGEN_INSN_LGUINT mask = CGEN_INSN_BASE_MASK (insn);
+ #if GCC_VERSION >= 3004
+   return __builtin_popcount (mask);
+ #else
diff --git a/toolchain/binutils/patches/2.40/035-Pass-JANSSON_LIBS-and-ZSTD_LIBS-to-ld-bootstrap-boot.patch b/toolchain/binutils/patches/2.40/035-Pass-JANSSON_LIBS-and-ZSTD_LIBS-to-ld-bootstrap-boot.patch
new file mode 100644
index 00000000000000..3741c08a0c9969
--- /dev/null
+++ b/toolchain/binutils/patches/2.40/035-Pass-JANSSON_LIBS-and-ZSTD_LIBS-to-ld-bootstrap-boot.patch
@@ -0,0 +1,50 @@
+From e1815414077347097e5bf0d75162add955e241d9 Mon Sep 17 00:00:00 2001
+From: Romain Geissler <romain.geissler@amadeus.com>
+Date: Sun, 5 Feb 2023 13:56:34 +0000
+Subject: [PATCH 35/50] Pass $JANSSON_LIBS and $ZSTD_LIBS to
+ ld-bootstrap/bootrap.exp
+
+---
+ ld/Makefile.am                          | 1 +
+ ld/Makefile.in                          | 1 +
+ ld/testsuite/ld-bootstrap/bootstrap.exp | 4 ++--
+ 3 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/ld/Makefile.am
++++ b/ld/Makefile.am
+@@ -992,6 +992,7 @@ check-DEJAGNU: site.exp
+ 		CXXFLAGS_FOR_TARGET="$(CXXFLAGS_FOR_TARGET)" \
+ 		OFILES="$(OFILES)" BFDLIB="$(TESTBFDLIB)" CTFLIB="$(TESTCTFLIB) $(ZLIB)" \
+ 		SFRAMELIB="$(TESTSFRAMELIB)" \
++		JANSSON_LIBS="$(JANSSON_LIBS)" ZSTD_LIBS="$(ZSTD_LIBS)" \
+ 		LIBIBERTY="$(LIBIBERTY) $(LIBINTL)" LIBS="$(LIBS)" \
+ 		DO_COMPARE="`echo '$(do_compare)' | sed -e 's,\\$$,,g'`" \
+ 		$(RUNTESTFLAGS); \
+--- a/ld/Makefile.in
++++ b/ld/Makefile.in
+@@ -2645,6 +2645,7 @@ check-DEJAGNU: site.exp
+ 		CXXFLAGS_FOR_TARGET="$(CXXFLAGS_FOR_TARGET)" \
+ 		OFILES="$(OFILES)" BFDLIB="$(TESTBFDLIB)" CTFLIB="$(TESTCTFLIB) $(ZLIB)" \
+ 		SFRAMELIB="$(TESTSFRAMELIB)" \
++		JANSSON_LIBS="$(JANSSON_LIBS)" ZSTD_LIBS="$(ZSTD_LIBS)" \
+ 		LIBIBERTY="$(LIBIBERTY) $(LIBINTL)" LIBS="$(LIBS)" \
+ 		DO_COMPARE="`echo '$(do_compare)' | sed -e 's,\\$$,,g'`" \
+ 		$(RUNTESTFLAGS); \
+--- a/ld/testsuite/ld-bootstrap/bootstrap.exp
++++ b/ld/testsuite/ld-bootstrap/bootstrap.exp
+@@ -162,13 +162,13 @@ foreach flags $test_flags {
+     }
+ 
+     if { [lindex [remote_exec build grep "-q \"HAVE_ZSTD 1\" config.h" ] 0] == 0 } then {
+-	set extralibs "$extralibs -lzstd"
++	set extralibs "$extralibs $ZSTD_LIBS"
+     }
+ 
+     # Check if the system's jansson library is used. If so, the object files will
+     # be using symbols from it, so link to it.
+     if { [lindex [remote_exec build grep "-q \"HAVE_JANSSON 1\" config.h" ] 0] == 0 } then {
+-	set extralibs "$extralibs -ljansson"
++	set extralibs "$extralibs $JANSSON_LIBS"
+     }
+ 
+     # Plugin support requires linking with libdl.
diff --git a/toolchain/binutils/patches/2.40/036-Regen-config-files.patch b/toolchain/binutils/patches/2.40/036-Regen-config-files.patch
new file mode 100644
index 00000000000000..1c80dde3102fbf
--- /dev/null
+++ b/toolchain/binutils/patches/2.40/036-Regen-config-files.patch
@@ -0,0 +1,714 @@
+From 1fc096a4c590f28e0efb1823cdca653f2db9de74 Mon Sep 17 00:00:00 2001
+From: Alan Modra <amodra@gmail.com>
+Date: Mon, 6 Feb 2023 10:48:59 +1030
+Subject: [PATCH 36/50] Regen config files
+
+For the version update to 2.40.0
+---
+ bfd/configure                  | 20 ++++++++++----------
+ binutils/configure             | 20 ++++++++++----------
+ gas/configure                  | 20 ++++++++++----------
+ gprof/configure                | 20 ++++++++++----------
+ gprofng/configure              | 20 ++++++++++----------
+ gprofng/doc/version.texi       |  8 ++++----
+ gprofng/libcollector/configure | 20 ++++++++++----------
+ intl/configure                 |  3 +++
+ ld/configure                   | 20 ++++++++++----------
+ opcodes/configure              | 20 ++++++++++----------
+ 10 files changed, 87 insertions(+), 84 deletions(-)
+
+--- a/bfd/configure
++++ b/bfd/configure
+@@ -1,6 +1,6 @@
+ #! /bin/sh
+ # Guess values for system-dependent variables and create Makefiles.
+-# Generated by GNU Autoconf 2.69 for bfd 2.40.
++# Generated by GNU Autoconf 2.69 for bfd 2.40.0.
+ #
+ #
+ # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
+@@ -587,8 +587,8 @@ MAKEFLAGS=
+ # Identity of this package.
+ PACKAGE_NAME='bfd'
+ PACKAGE_TARNAME='bfd'
+-PACKAGE_VERSION='2.40'
+-PACKAGE_STRING='bfd 2.40'
++PACKAGE_VERSION='2.40.0'
++PACKAGE_STRING='bfd 2.40.0'
+ PACKAGE_BUGREPORT=''
+ PACKAGE_URL=''
+ 
+@@ -1400,7 +1400,7 @@ if test "$ac_init_help" = "long"; then
+   # Omit some internal or obsolete options to make the list less imposing.
+   # This message is too long to be a string in the A/UX 3.1 sh.
+   cat <<_ACEOF
+-\`configure' configures bfd 2.40 to adapt to many kinds of systems.
++\`configure' configures bfd 2.40.0 to adapt to many kinds of systems.
+ 
+ Usage: $0 [OPTION]... [VAR=VALUE]...
+ 
+@@ -1471,7 +1471,7 @@ fi
+ 
+ if test -n "$ac_init_help"; then
+   case $ac_init_help in
+-     short | recursive ) echo "Configuration of bfd 2.40:";;
++     short | recursive ) echo "Configuration of bfd 2.40.0:";;
+    esac
+   cat <<\_ACEOF
+ 
+@@ -1608,7 +1608,7 @@ fi
+ test -n "$ac_init_help" && exit $ac_status
+ if $ac_init_version; then
+   cat <<\_ACEOF
+-bfd configure 2.40
++bfd configure 2.40.0
+ generated by GNU Autoconf 2.69
+ 
+ Copyright (C) 2012 Free Software Foundation, Inc.
+@@ -2202,7 +2202,7 @@ cat >config.log <<_ACEOF
+ This file contains any messages produced by compilers while
+ running configure, to aid debugging if configure makes a mistake.
+ 
+-It was created by bfd $as_me 2.40, which was
++It was created by bfd $as_me 2.40.0, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   $ $0 $@
+@@ -3184,7 +3184,7 @@ fi
+ 
+ # Define the identity of the package.
+  PACKAGE='bfd'
+- VERSION='2.40'
++ VERSION='2.40.0'
+ 
+ 
+ cat >>confdefs.h <<_ACEOF
+@@ -15906,7 +15906,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_wri
+ # report actual input values of CONFIG_FILES etc. instead of their
+ # values after options handling.
+ ac_log="
+-This file was extended by bfd $as_me 2.40, which was
++This file was extended by bfd $as_me 2.40.0, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   CONFIG_FILES    = $CONFIG_FILES
+@@ -15972,7 +15972,7 @@ _ACEOF
+ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+ ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
+ ac_cs_version="\\
+-bfd config.status 2.40
++bfd config.status 2.40.0
+ configured by $0, generated by GNU Autoconf 2.69,
+   with options \\"\$ac_cs_config\\"
+ 
+--- a/binutils/configure
++++ b/binutils/configure
+@@ -1,6 +1,6 @@
+ #! /bin/sh
+ # Guess values for system-dependent variables and create Makefiles.
+-# Generated by GNU Autoconf 2.69 for binutils 2.40.
++# Generated by GNU Autoconf 2.69 for binutils 2.40.0.
+ #
+ #
+ # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
+@@ -587,8 +587,8 @@ MAKEFLAGS=
+ # Identity of this package.
+ PACKAGE_NAME='binutils'
+ PACKAGE_TARNAME='binutils'
+-PACKAGE_VERSION='2.40'
+-PACKAGE_STRING='binutils 2.40'
++PACKAGE_VERSION='2.40.0'
++PACKAGE_STRING='binutils 2.40.0'
+ PACKAGE_BUGREPORT=''
+ PACKAGE_URL=''
+ 
+@@ -1401,7 +1401,7 @@ if test "$ac_init_help" = "long"; then
+   # Omit some internal or obsolete options to make the list less imposing.
+   # This message is too long to be a string in the A/UX 3.1 sh.
+   cat <<_ACEOF
+-\`configure' configures binutils 2.40 to adapt to many kinds of systems.
++\`configure' configures binutils 2.40.0 to adapt to many kinds of systems.
+ 
+ Usage: $0 [OPTION]... [VAR=VALUE]...
+ 
+@@ -1472,7 +1472,7 @@ fi
+ 
+ if test -n "$ac_init_help"; then
+   case $ac_init_help in
+-     short | recursive ) echo "Configuration of binutils 2.40:";;
++     short | recursive ) echo "Configuration of binutils 2.40.0:";;
+    esac
+   cat <<\_ACEOF
+ 
+@@ -1631,7 +1631,7 @@ fi
+ test -n "$ac_init_help" && exit $ac_status
+ if $ac_init_version; then
+   cat <<\_ACEOF
+-binutils configure 2.40
++binutils configure 2.40.0
+ generated by GNU Autoconf 2.69
+ 
+ Copyright (C) 2012 Free Software Foundation, Inc.
+@@ -2099,7 +2099,7 @@ cat >config.log <<_ACEOF
+ This file contains any messages produced by compilers while
+ running configure, to aid debugging if configure makes a mistake.
+ 
+-It was created by binutils $as_me 2.40, which was
++It was created by binutils $as_me 2.40.0, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   $ $0 $@
+@@ -3081,7 +3081,7 @@ fi
+ 
+ # Define the identity of the package.
+  PACKAGE='binutils'
+- VERSION='2.40'
++ VERSION='2.40.0'
+ 
+ 
+ cat >>confdefs.h <<_ACEOF
+@@ -15326,7 +15326,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_wri
+ # report actual input values of CONFIG_FILES etc. instead of their
+ # values after options handling.
+ ac_log="
+-This file was extended by binutils $as_me 2.40, which was
++This file was extended by binutils $as_me 2.40.0, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   CONFIG_FILES    = $CONFIG_FILES
+@@ -15392,7 +15392,7 @@ _ACEOF
+ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+ ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
+ ac_cs_version="\\
+-binutils config.status 2.40
++binutils config.status 2.40.0
+ configured by $0, generated by GNU Autoconf 2.69,
+   with options \\"\$ac_cs_config\\"
+ 
+--- a/gas/configure
++++ b/gas/configure
+@@ -1,6 +1,6 @@
+ #! /bin/sh
+ # Guess values for system-dependent variables and create Makefiles.
+-# Generated by GNU Autoconf 2.69 for gas 2.40.
++# Generated by GNU Autoconf 2.69 for gas 2.40.0.
+ #
+ #
+ # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
+@@ -587,8 +587,8 @@ MAKEFLAGS=
+ # Identity of this package.
+ PACKAGE_NAME='gas'
+ PACKAGE_TARNAME='gas'
+-PACKAGE_VERSION='2.40'
+-PACKAGE_STRING='gas 2.40'
++PACKAGE_VERSION='2.40.0'
++PACKAGE_STRING='gas 2.40.0'
+ PACKAGE_BUGREPORT=''
+ PACKAGE_URL=''
+ 
+@@ -1381,7 +1381,7 @@ if test "$ac_init_help" = "long"; then
+   # Omit some internal or obsolete options to make the list less imposing.
+   # This message is too long to be a string in the A/UX 3.1 sh.
+   cat <<_ACEOF
+-\`configure' configures gas 2.40 to adapt to many kinds of systems.
++\`configure' configures gas 2.40.0 to adapt to many kinds of systems.
+ 
+ Usage: $0 [OPTION]... [VAR=VALUE]...
+ 
+@@ -1452,7 +1452,7 @@ fi
+ 
+ if test -n "$ac_init_help"; then
+   case $ac_init_help in
+-     short | recursive ) echo "Configuration of gas 2.40:";;
++     short | recursive ) echo "Configuration of gas 2.40.0:";;
+    esac
+   cat <<\_ACEOF
+ 
+@@ -1600,7 +1600,7 @@ fi
+ test -n "$ac_init_help" && exit $ac_status
+ if $ac_init_version; then
+   cat <<\_ACEOF
+-gas configure 2.40
++gas configure 2.40.0
+ generated by GNU Autoconf 2.69
+ 
+ Copyright (C) 2012 Free Software Foundation, Inc.
+@@ -2011,7 +2011,7 @@ cat >config.log <<_ACEOF
+ This file contains any messages produced by compilers while
+ running configure, to aid debugging if configure makes a mistake.
+ 
+-It was created by gas $as_me 2.40, which was
++It was created by gas $as_me 2.40.0, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   $ $0 $@
+@@ -2990,7 +2990,7 @@ fi
+ 
+ # Define the identity of the package.
+  PACKAGE='gas'
+- VERSION='2.40'
++ VERSION='2.40.0'
+ 
+ 
+ cat >>confdefs.h <<_ACEOF
+@@ -14910,7 +14910,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_wri
+ # report actual input values of CONFIG_FILES etc. instead of their
+ # values after options handling.
+ ac_log="
+-This file was extended by gas $as_me 2.40, which was
++This file was extended by gas $as_me 2.40.0, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   CONFIG_FILES    = $CONFIG_FILES
+@@ -14976,7 +14976,7 @@ _ACEOF
+ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+ ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
+ ac_cs_version="\\
+-gas config.status 2.40
++gas config.status 2.40.0
+ configured by $0, generated by GNU Autoconf 2.69,
+   with options \\"\$ac_cs_config\\"
+ 
+--- a/gprof/configure
++++ b/gprof/configure
+@@ -1,6 +1,6 @@
+ #! /bin/sh
+ # Guess values for system-dependent variables and create Makefiles.
+-# Generated by GNU Autoconf 2.69 for gprof 2.40.
++# Generated by GNU Autoconf 2.69 for gprof 2.40.0.
+ #
+ #
+ # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
+@@ -587,8 +587,8 @@ MAKEFLAGS=
+ # Identity of this package.
+ PACKAGE_NAME='gprof'
+ PACKAGE_TARNAME='gprof'
+-PACKAGE_VERSION='2.40'
+-PACKAGE_STRING='gprof 2.40'
++PACKAGE_VERSION='2.40.0'
++PACKAGE_STRING='gprof 2.40.0'
+ PACKAGE_BUGREPORT=''
+ PACKAGE_URL=''
+ 
+@@ -1338,7 +1338,7 @@ if test "$ac_init_help" = "long"; then
+   # Omit some internal or obsolete options to make the list less imposing.
+   # This message is too long to be a string in the A/UX 3.1 sh.
+   cat <<_ACEOF
+-\`configure' configures gprof 2.40 to adapt to many kinds of systems.
++\`configure' configures gprof 2.40.0 to adapt to many kinds of systems.
+ 
+ Usage: $0 [OPTION]... [VAR=VALUE]...
+ 
+@@ -1409,7 +1409,7 @@ fi
+ 
+ if test -n "$ac_init_help"; then
+   case $ac_init_help in
+-     short | recursive ) echo "Configuration of gprof 2.40:";;
++     short | recursive ) echo "Configuration of gprof 2.40.0:";;
+    esac
+   cat <<\_ACEOF
+ 
+@@ -1520,7 +1520,7 @@ fi
+ test -n "$ac_init_help" && exit $ac_status
+ if $ac_init_version; then
+   cat <<\_ACEOF
+-gprof configure 2.40
++gprof configure 2.40.0
+ generated by GNU Autoconf 2.69
+ 
+ Copyright (C) 2012 Free Software Foundation, Inc.
+@@ -1885,7 +1885,7 @@ cat >config.log <<_ACEOF
+ This file contains any messages produced by compilers while
+ running configure, to aid debugging if configure makes a mistake.
+ 
+-It was created by gprof $as_me 2.40, which was
++It was created by gprof $as_me 2.40.0, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   $ $0 $@
+@@ -2864,7 +2864,7 @@ fi
+ 
+ # Define the identity of the package.
+  PACKAGE='gprof'
+- VERSION='2.40'
++ VERSION='2.40.0'
+ 
+ 
+ cat >>confdefs.h <<_ACEOF
+@@ -12572,7 +12572,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_wri
+ # report actual input values of CONFIG_FILES etc. instead of their
+ # values after options handling.
+ ac_log="
+-This file was extended by gprof $as_me 2.40, which was
++This file was extended by gprof $as_me 2.40.0, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   CONFIG_FILES    = $CONFIG_FILES
+@@ -12638,7 +12638,7 @@ _ACEOF
+ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+ ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
+ ac_cs_version="\\
+-gprof config.status 2.40
++gprof config.status 2.40.0
+ configured by $0, generated by GNU Autoconf 2.69,
+   with options \\"\$ac_cs_config\\"
+ 
+--- a/gprofng/configure
++++ b/gprofng/configure
+@@ -1,6 +1,6 @@
+ #! /bin/sh
+ # Guess values for system-dependent variables and create Makefiles.
+-# Generated by GNU Autoconf 2.69 for gprofng 2.40.
++# Generated by GNU Autoconf 2.69 for gprofng 2.40.0.
+ #
+ #
+ # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
+@@ -587,8 +587,8 @@ MAKEFLAGS=
+ # Identity of this package.
+ PACKAGE_NAME='gprofng'
+ PACKAGE_TARNAME='gprofng'
+-PACKAGE_VERSION='2.40'
+-PACKAGE_STRING='gprofng 2.40'
++PACKAGE_VERSION='2.40.0'
++PACKAGE_STRING='gprofng 2.40.0'
+ PACKAGE_BUGREPORT=''
+ PACKAGE_URL=''
+ 
+@@ -1364,7 +1364,7 @@ if test "$ac_init_help" = "long"; then
+   # Omit some internal or obsolete options to make the list less imposing.
+   # This message is too long to be a string in the A/UX 3.1 sh.
+   cat <<_ACEOF
+-\`configure' configures gprofng 2.40 to adapt to many kinds of systems.
++\`configure' configures gprofng 2.40.0 to adapt to many kinds of systems.
+ 
+ Usage: $0 [OPTION]... [VAR=VALUE]...
+ 
+@@ -1435,7 +1435,7 @@ fi
+ 
+ if test -n "$ac_init_help"; then
+   case $ac_init_help in
+-     short | recursive ) echo "Configuration of gprofng 2.40:";;
++     short | recursive ) echo "Configuration of gprofng 2.40.0:";;
+    esac
+   cat <<\_ACEOF
+ 
+@@ -1549,7 +1549,7 @@ fi
+ test -n "$ac_init_help" && exit $ac_status
+ if $ac_init_version; then
+   cat <<\_ACEOF
+-gprofng configure 2.40
++gprofng configure 2.40.0
+ generated by GNU Autoconf 2.69
+ 
+ Copyright (C) 2012 Free Software Foundation, Inc.
+@@ -2081,7 +2081,7 @@ cat >config.log <<_ACEOF
+ This file contains any messages produced by compilers while
+ running configure, to aid debugging if configure makes a mistake.
+ 
+-It was created by gprofng $as_me 2.40, which was
++It was created by gprofng $as_me 2.40.0, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   $ $0 $@
+@@ -3054,7 +3054,7 @@ fi
+ 
+ # Define the identity of the package.
+  PACKAGE='gprofng'
+- VERSION='2.40'
++ VERSION='2.40.0'
+ 
+ 
+ cat >>confdefs.h <<_ACEOF
+@@ -17528,7 +17528,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_wri
+ # report actual input values of CONFIG_FILES etc. instead of their
+ # values after options handling.
+ ac_log="
+-This file was extended by gprofng $as_me 2.40, which was
++This file was extended by gprofng $as_me 2.40.0, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   CONFIG_FILES    = $CONFIG_FILES
+@@ -17594,7 +17594,7 @@ _ACEOF
+ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+ ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
+ ac_cs_version="\\
+-gprofng config.status 2.40
++gprofng config.status 2.40.0
+ configured by $0, generated by GNU Autoconf 2.69,
+   with options \\"\$ac_cs_config\\"
+ 
+--- a/gprofng/doc/version.texi
++++ b/gprofng/doc/version.texi
+@@ -1,4 +1,4 @@
+-@set UPDATED 5 January 2023
+-@set UPDATED-MONTH January 2023
+-@set EDITION 2.40
+-@set VERSION 2.40
++@set UPDATED 1 February 2023
++@set UPDATED-MONTH February 2023
++@set EDITION 2.40.0
++@set VERSION 2.40.0
+--- a/gprofng/libcollector/configure
++++ b/gprofng/libcollector/configure
+@@ -1,6 +1,6 @@
+ #! /bin/sh
+ # Guess values for system-dependent variables and create Makefiles.
+-# Generated by GNU Autoconf 2.69 for gprofng 2.40.
++# Generated by GNU Autoconf 2.69 for gprofng 2.40.0.
+ #
+ #
+ # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
+@@ -587,8 +587,8 @@ MAKEFLAGS=
+ # Identity of this package.
+ PACKAGE_NAME='gprofng'
+ PACKAGE_TARNAME='gprofng'
+-PACKAGE_VERSION='2.40'
+-PACKAGE_STRING='gprofng 2.40'
++PACKAGE_VERSION='2.40.0'
++PACKAGE_STRING='gprofng 2.40.0'
+ PACKAGE_BUGREPORT=''
+ PACKAGE_URL=''
+ 
+@@ -1325,7 +1325,7 @@ if test "$ac_init_help" = "long"; then
+   # Omit some internal or obsolete options to make the list less imposing.
+   # This message is too long to be a string in the A/UX 3.1 sh.
+   cat <<_ACEOF
+-\`configure' configures gprofng 2.40 to adapt to many kinds of systems.
++\`configure' configures gprofng 2.40.0 to adapt to many kinds of systems.
+ 
+ Usage: $0 [OPTION]... [VAR=VALUE]...
+ 
+@@ -1396,7 +1396,7 @@ fi
+ 
+ if test -n "$ac_init_help"; then
+   case $ac_init_help in
+-     short | recursive ) echo "Configuration of gprofng 2.40:";;
++     short | recursive ) echo "Configuration of gprofng 2.40.0:";;
+    esac
+   cat <<\_ACEOF
+ 
+@@ -1505,7 +1505,7 @@ fi
+ test -n "$ac_init_help" && exit $ac_status
+ if $ac_init_version; then
+   cat <<\_ACEOF
+-gprofng configure 2.40
++gprofng configure 2.40.0
+ generated by GNU Autoconf 2.69
+ 
+ Copyright (C) 2012 Free Software Foundation, Inc.
+@@ -1991,7 +1991,7 @@ cat >config.log <<_ACEOF
+ This file contains any messages produced by compilers while
+ running configure, to aid debugging if configure makes a mistake.
+ 
+-It was created by gprofng $as_me 2.40, which was
++It was created by gprofng $as_me 2.40.0, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   $ $0 $@
+@@ -2968,7 +2968,7 @@ fi
+ 
+ # Define the identity of the package.
+  PACKAGE='gprofng'
+- VERSION='2.40'
++ VERSION='2.40.0'
+ 
+ 
+ cat >>confdefs.h <<_ACEOF
+@@ -16098,7 +16098,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_wri
+ # report actual input values of CONFIG_FILES etc. instead of their
+ # values after options handling.
+ ac_log="
+-This file was extended by gprofng $as_me 2.40, which was
++This file was extended by gprofng $as_me 2.40.0, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   CONFIG_FILES    = $CONFIG_FILES
+@@ -16164,7 +16164,7 @@ _ACEOF
+ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+ ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
+ ac_cs_version="\\
+-gprofng config.status 2.40
++gprofng config.status 2.40.0
+ configured by $0, generated by GNU Autoconf 2.69,
+   with options \\"\$ac_cs_config\\"
+ 
+--- a/intl/configure
++++ b/intl/configure
+@@ -6857,6 +6857,9 @@ case "${host}" in
+ 	# sets the default TLS model and affects inlining.
+ 	PICFLAG=-fPIC
+ 	;;
++    loongarch*-*-*)
++	PICFLAG=-fpic
++	;;
+     mips-sgi-irix6*)
+ 	# PIC is the default.
+ 	;;
+--- a/ld/configure
++++ b/ld/configure
+@@ -1,6 +1,6 @@
+ #! /bin/sh
+ # Guess values for system-dependent variables and create Makefiles.
+-# Generated by GNU Autoconf 2.69 for ld 2.40.
++# Generated by GNU Autoconf 2.69 for ld 2.40.0.
+ #
+ #
+ # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
+@@ -587,8 +587,8 @@ MAKEFLAGS=
+ # Identity of this package.
+ PACKAGE_NAME='ld'
+ PACKAGE_TARNAME='ld'
+-PACKAGE_VERSION='2.40'
+-PACKAGE_STRING='ld 2.40'
++PACKAGE_VERSION='2.40.0'
++PACKAGE_STRING='ld 2.40.0'
+ PACKAGE_BUGREPORT=''
+ PACKAGE_URL=''
+ 
+@@ -1423,7 +1423,7 @@ if test "$ac_init_help" = "long"; then
+   # Omit some internal or obsolete options to make the list less imposing.
+   # This message is too long to be a string in the A/UX 3.1 sh.
+   cat <<_ACEOF
+-\`configure' configures ld 2.40 to adapt to many kinds of systems.
++\`configure' configures ld 2.40.0 to adapt to many kinds of systems.
+ 
+ Usage: $0 [OPTION]... [VAR=VALUE]...
+ 
+@@ -1494,7 +1494,7 @@ fi
+ 
+ if test -n "$ac_init_help"; then
+   case $ac_init_help in
+-     short | recursive ) echo "Configuration of ld 2.40:";;
++     short | recursive ) echo "Configuration of ld 2.40.0:";;
+    esac
+   cat <<\_ACEOF
+ 
+@@ -1661,7 +1661,7 @@ fi
+ test -n "$ac_init_help" && exit $ac_status
+ if $ac_init_version; then
+   cat <<\_ACEOF
+-ld configure 2.40
++ld configure 2.40.0
+ generated by GNU Autoconf 2.69
+ 
+ Copyright (C) 2012 Free Software Foundation, Inc.
+@@ -2376,7 +2376,7 @@ cat >config.log <<_ACEOF
+ This file contains any messages produced by compilers while
+ running configure, to aid debugging if configure makes a mistake.
+ 
+-It was created by ld $as_me 2.40, which was
++It was created by ld $as_me 2.40.0, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   $ $0 $@
+@@ -3359,7 +3359,7 @@ fi
+ 
+ # Define the identity of the package.
+  PACKAGE='ld'
+- VERSION='2.40'
++ VERSION='2.40.0'
+ 
+ 
+ cat >>confdefs.h <<_ACEOF
+@@ -18083,7 +18083,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_wri
+ # report actual input values of CONFIG_FILES etc. instead of their
+ # values after options handling.
+ ac_log="
+-This file was extended by ld $as_me 2.40, which was
++This file was extended by ld $as_me 2.40.0, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   CONFIG_FILES    = $CONFIG_FILES
+@@ -18149,7 +18149,7 @@ _ACEOF
+ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+ ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
+ ac_cs_version="\\
+-ld config.status 2.40
++ld config.status 2.40.0
+ configured by $0, generated by GNU Autoconf 2.69,
+   with options \\"\$ac_cs_config\\"
+ 
+--- a/opcodes/configure
++++ b/opcodes/configure
+@@ -1,6 +1,6 @@
+ #! /bin/sh
+ # Guess values for system-dependent variables and create Makefiles.
+-# Generated by GNU Autoconf 2.69 for opcodes 2.40.
++# Generated by GNU Autoconf 2.69 for opcodes 2.40.0.
+ #
+ #
+ # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
+@@ -587,8 +587,8 @@ MAKEFLAGS=
+ # Identity of this package.
+ PACKAGE_NAME='opcodes'
+ PACKAGE_TARNAME='opcodes'
+-PACKAGE_VERSION='2.40'
+-PACKAGE_STRING='opcodes 2.40'
++PACKAGE_VERSION='2.40.0'
++PACKAGE_STRING='opcodes 2.40.0'
+ PACKAGE_BUGREPORT=''
+ PACKAGE_URL=''
+ 
+@@ -1360,7 +1360,7 @@ if test "$ac_init_help" = "long"; then
+   # Omit some internal or obsolete options to make the list less imposing.
+   # This message is too long to be a string in the A/UX 3.1 sh.
+   cat <<_ACEOF
+-\`configure' configures opcodes 2.40 to adapt to many kinds of systems.
++\`configure' configures opcodes 2.40.0 to adapt to many kinds of systems.
+ 
+ Usage: $0 [OPTION]... [VAR=VALUE]...
+ 
+@@ -1431,7 +1431,7 @@ fi
+ 
+ if test -n "$ac_init_help"; then
+   case $ac_init_help in
+-     short | recursive ) echo "Configuration of opcodes 2.40:";;
++     short | recursive ) echo "Configuration of opcodes 2.40.0:";;
+    esac
+   cat <<\_ACEOF
+ 
+@@ -1545,7 +1545,7 @@ fi
+ test -n "$ac_init_help" && exit $ac_status
+ if $ac_init_version; then
+   cat <<\_ACEOF
+-opcodes configure 2.40
++opcodes configure 2.40.0
+ generated by GNU Autoconf 2.69
+ 
+ Copyright (C) 2012 Free Software Foundation, Inc.
+@@ -2139,7 +2139,7 @@ cat >config.log <<_ACEOF
+ This file contains any messages produced by compilers while
+ running configure, to aid debugging if configure makes a mistake.
+ 
+-It was created by opcodes $as_me 2.40, which was
++It was created by opcodes $as_me 2.40.0, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   $ $0 $@
+@@ -3118,7 +3118,7 @@ fi
+ 
+ # Define the identity of the package.
+  PACKAGE='opcodes'
+- VERSION='2.40'
++ VERSION='2.40.0'
+ 
+ 
+ cat >>confdefs.h <<_ACEOF
+@@ -13191,7 +13191,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_wri
+ # report actual input values of CONFIG_FILES etc. instead of their
+ # values after options handling.
+ ac_log="
+-This file was extended by opcodes $as_me 2.40, which was
++This file was extended by opcodes $as_me 2.40.0, which was
+ generated by GNU Autoconf 2.69.  Invocation command line was
+ 
+   CONFIG_FILES    = $CONFIG_FILES
+@@ -13257,7 +13257,7 @@ _ACEOF
+ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+ ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
+ ac_cs_version="\\
+-opcodes config.status 2.40
++opcodes config.status 2.40.0
+ configured by $0, generated by GNU Autoconf 2.69,
+   with options \\"\$ac_cs_config\\"
+ 
diff --git a/toolchain/binutils/patches/2.40/040-configure-remove-dependencies-on-gmp-and-mpfr-when-g.patch b/toolchain/binutils/patches/2.40/040-configure-remove-dependencies-on-gmp-and-mpfr-when-g.patch
new file mode 100644
index 00000000000000..261acb549e6143
--- /dev/null
+++ b/toolchain/binutils/patches/2.40/040-configure-remove-dependencies-on-gmp-and-mpfr-when-g.patch
@@ -0,0 +1,51 @@
+From 17294931e3e361bee6810b1a39493e214b38c5e5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Cl=C3=A9ment=20Chigot?= <chigot@adacore.com>
+Date: Tue, 3 Jan 2023 14:24:43 +0100
+Subject: [PATCH 40/50] configure: remove dependencies on gmp and mpfr when gdb
+ is disabled
+
+Since 991180627851801f1999d1ebbc0e569a17e47c74, the configure checks
+about GMP and MPFR for gdb builds have been moved to the toplevel
+configure.
+However, it doesn't take into account the --disable-gdb option. Meaning
+that a build without gdb will require these libraries even if not
+needed.
+
+ChangeLog:
+
+	* configure.ac: Skip GMP and MPFR when --disable-gdb is
+	provided.
+	* configure: Regenerate.
+
+(cherry picked from commit 5fb0e308577143ceb313fde5538dc9ecb038f29f)
+---
+ configure    | 4 +++-
+ configure.ac | 4 +++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/configure
++++ b/configure
+@@ -8032,7 +8032,9 @@ if test -d ${srcdir}/gcc ; then
+   require_mpc=yes
+ fi
+ if test -d ${srcdir}/gdb ; then
+-  require_gmp=yes
++  if test "x$enable_gdb" != xno; then
++   require_gmp=yes
++  fi
+ fi
+ 
+ gmplibs="-lmpfr -lgmp"
+--- a/configure.ac
++++ b/configure.ac
+@@ -1585,7 +1585,9 @@ if test -d ${srcdir}/gcc ; then
+   require_mpc=yes
+ fi
+ if test -d ${srcdir}/gdb ; then
+-  require_gmp=yes
++  if test "x$enable_gdb" != xno; then
++   require_gmp=yes
++  fi
+ fi
+ 
+ gmplibs="-lmpfr -lgmp"
diff --git a/toolchain/binutils/patches/2.40/046-gas-correct-symbol-name-comparison-in-.startof.-.siz.patch b/toolchain/binutils/patches/2.40/046-gas-correct-symbol-name-comparison-in-.startof.-.siz.patch
new file mode 100644
index 00000000000000..4e31bb43edb152
--- /dev/null
+++ b/toolchain/binutils/patches/2.40/046-gas-correct-symbol-name-comparison-in-.startof.-.siz.patch
@@ -0,0 +1,46 @@
+From b2bc62b7b4e7638c3a249d2d2728ceb4d5f2b22c Mon Sep 17 00:00:00 2001
+From: Jan Beulich <jbeulich@suse.com>
+Date: Tue, 14 Feb 2023 08:35:02 +0100
+Subject: [PATCH 46/50] gas: correct symbol name comparison in
+ .startof./.sizeof. handling
+
+In 162c6aef1f3a ("gas: fold symbol table entries generated for
+.startof.() / .sizeof.()") I screwed up quite badly, inverting the case
+sensitive and case insensitive comparison functions.
+---
+ gas/expr.c                      | 4 ++--
+ gas/testsuite/gas/elf/startof.d | 2 ++
+ gas/testsuite/gas/elf/startof.s | 3 +++
+ 3 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/gas/expr.c
++++ b/gas/expr.c
+@@ -149,8 +149,8 @@ symbol_lookup_or_make (const char *name,
+ 
+     name = S_GET_NAME (symbolP);
+     if ((symbols_case_sensitive
+-	 ? strcasecmp (buf, name)
+-	 : strcmp (buf, name)) == 0)
++	 ? strcmp (buf, name)
++	 : strcasecmp (buf, name)) == 0)
+       {
+ 	free (buf);
+ 	return symbolP;
+--- a/gas/testsuite/gas/elf/startof.d
++++ b/gas/testsuite/gas/elf/startof.d
+@@ -7,4 +7,6 @@ Symbol table .*
+ #...
+      [1-8]: 0+ .* UND \.startof\.\.text
+      [2-9]: 0+ .* UND \.sizeof\.\.text
++ +[1-9][0-9]*: 0+ .* UND \.startof\.\.Text
++ +[1-9][0-9]*: 0+ .* UND \.sizeof\.\.TEXT
+ #pass
+--- a/gas/testsuite/gas/elf/startof.s
++++ b/gas/testsuite/gas/elf/startof.s
+@@ -4,3 +4,6 @@
+ 	.dc.a	0
+ 	.dc.a	.sizeof.(.text)
+ 	.dc.a	.startof.(.text)
++	.dc.a	0
++	.dc.a	.startof.(.Text)
++	.dc.a	.sizeof.(.TEXT)
diff --git a/toolchain/binutils/patches/2.40/300-001_ld_makefile_patch.patch b/toolchain/binutils/patches/2.40/300-001_ld_makefile_patch.patch
new file mode 100644
index 00000000000000..2dafd92a01d35b
--- /dev/null
+++ b/toolchain/binutils/patches/2.40/300-001_ld_makefile_patch.patch
@@ -0,0 +1,22 @@
+--- a/ld/Makefile.am
++++ b/ld/Makefile.am
+@@ -50,7 +50,7 @@ AM_CFLAGS = $(WARN_CFLAGS) $(ELF_CLFAGS)
+ # We put the scripts in the directory $(scriptdir)/ldscripts.
+ # We can't put the scripts in $(datadir) because the SEARCH_DIR
+ # directives need to be different for native and cross linkers.
+-scriptdir = $(tooldir)/lib
++scriptdir = $(libdir)
+ 
+ EMUL = @EMUL@
+ EMULATION_OFILES = @EMULATION_OFILES@
+--- a/ld/Makefile.in
++++ b/ld/Makefile.in
+@@ -573,7 +573,7 @@ AM_CFLAGS = $(WARN_CFLAGS) $(ELF_CLFAGS)
+ # We put the scripts in the directory $(scriptdir)/ldscripts.
+ # We can't put the scripts in $(datadir) because the SEARCH_DIR
+ # directives need to be different for native and cross linkers.
+-scriptdir = $(tooldir)/lib
++scriptdir = $(libdir)
+ BASEDIR = $(srcdir)/..
+ BFDDIR = $(BASEDIR)/bfd
+ INCDIR = $(BASEDIR)/include
diff --git a/toolchain/binutils/patches/2.40/400-mips_no_dynamic_linking_sym.patch b/toolchain/binutils/patches/2.40/400-mips_no_dynamic_linking_sym.patch
new file mode 100644
index 00000000000000..aeb5a993a63963
--- /dev/null
+++ b/toolchain/binutils/patches/2.40/400-mips_no_dynamic_linking_sym.patch
@@ -0,0 +1,18 @@
+--- a/bfd/elfxx-mips.c
++++ b/bfd/elfxx-mips.c
+@@ -8119,6 +8119,7 @@ _bfd_mips_elf_create_dynamic_sections (b
+ 
+       name = SGI_COMPAT (abfd) ? "_DYNAMIC_LINK" : "_DYNAMIC_LINKING";
+       bh = NULL;
++      if (0) {
+       if (!(_bfd_generic_link_add_one_symbol
+ 	    (info, abfd, name, BSF_GLOBAL, bfd_abs_section_ptr, 0,
+ 	     NULL, false, get_elf_backend_data (abfd)->collect, &bh)))
+@@ -8131,6 +8132,7 @@ _bfd_mips_elf_create_dynamic_sections (b
+ 
+       if (! bfd_elf_link_record_dynamic_symbol (info, h))
+ 	return false;
++      }
+ 
+       if (! mips_elf_hash_table (info)->use_rld_obj_head)
+ 	{
diff --git a/toolchain/binutils/patches/2.40/500-Change-default-emulation-for-mips64-linux.patch b/toolchain/binutils/patches/2.40/500-Change-default-emulation-for-mips64-linux.patch
new file mode 100644
index 00000000000000..14a18a1d80683e
--- /dev/null
+++ b/toolchain/binutils/patches/2.40/500-Change-default-emulation-for-mips64-linux.patch
@@ -0,0 +1,38 @@
+--- a/bfd/config.bfd
++++ b/bfd/config.bfd
+@@ -944,12 +944,12 @@ case "${targ}" in
+     targ_selvecs="mips_elf32_le_vec mips_elf64_be_vec mips_elf64_le_vec mips_ecoff_be_vec mips_ecoff_le_vec"
+     ;;
+   mips64*el-*-linux*)
+-    targ_defvec=mips_elf32_ntrad_le_vec
+-    targ_selvecs="mips_elf32_ntrad_be_vec mips_elf32_trad_le_vec mips_elf32_trad_be_vec mips_elf64_trad_le_vec mips_elf64_trad_be_vec"
++    targ_defvec=mips_elf64_trad_le_vec
++    targ_selvecs="mips_elf32_ntrad_le_vec mips_elf32_ntrad_be_vec mips_elf32_trad_le_vec mips_elf32_trad_be_vec mips_elf64_trad_be_vec"
+     ;;
+   mips64*-*-linux*)
+-    targ_defvec=mips_elf32_ntrad_be_vec
+-    targ_selvecs="mips_elf32_ntrad_le_vec mips_elf32_trad_be_vec mips_elf32_trad_le_vec mips_elf64_trad_be_vec mips_elf64_trad_le_vec"
++    targ_defvec=mips_elf64_trad_be_vec
++    targ_selvecs="mips_elf32_ntrad_be_vec mips_elf32_ntrad_le_vec mips_elf32_trad_be_vec mips_elf32_trad_le_vec mips_elf64_trad_le_vec"
+     ;;
+   mips*el-*-linux*)
+     targ_defvec=mips_elf32_trad_le_vec
+--- a/ld/configure.tgt
++++ b/ld/configure.tgt
+@@ -585,12 +585,12 @@ mips*-*-vxworks*)	targ_emul=elf32ebmipvx
+ 			;;
+ mips*-*-windiss)	targ_emul=elf32mipswindiss
+ 			;;
+-mips64*el-*-linux-*)	targ_emul=elf32ltsmipn32
+-			targ_extra_emuls="elf32btsmipn32 elf32ltsmip elf32btsmip elf64ltsmip elf64btsmip"
++mips64*el-*-linux-*)	targ_emul=elf64ltsmip
++			targ_extra_emuls="elf32btsmipn32 elf32ltsmipn32 elf32ltsmip elf32btsmip elf64btsmip"
+ 			targ_extra_libpath=$targ_extra_emuls
+ 			;;
+-mips64*-*-linux-*)	targ_emul=elf32btsmipn32
+-			targ_extra_emuls="elf32ltsmipn32 elf32btsmip elf32ltsmip elf64btsmip elf64ltsmip"
++mips64*-*-linux-*)	targ_emul=elf64btsmip
++			targ_extra_emuls="elf32btsmipn32 elf32ltsmipn32 elf32btsmip elf32ltsmip elf64ltsmip"
+ 			targ_extra_libpath=$targ_extra_emuls
+ 			;;
+ mips*el-*-linux-*)	targ_emul=elf32ltsmip
diff --git a/toolchain/fortify-headers/Makefile b/toolchain/fortify-headers/Makefile
index a6151bb2f1696c..3362fb427ad413 100644
--- a/toolchain/fortify-headers/Makefile
+++ b/toolchain/fortify-headers/Makefile
@@ -9,9 +9,9 @@ include $(INCLUDE_DIR)/target.mk
 
 PKG_NAME:=fortify-headers
 PKG_VERSION:=1.1
-PKG_RELEASE=1
+PKG_RELEASE=3
 
-PKG_SOURCE_URL:=http://dl.2f30.org/releases
+PKG_SOURCE_URL:=https://dl.2f30.org/releases
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_HASH:=6ba5d860a2d2ba4c3346924b93930c34856eafe148bdbdf271ecab8065201fb6
 
diff --git a/toolchain/fortify-headers/patches/001-__ppoll_time64.patch b/toolchain/fortify-headers/patches/001-__ppoll_time64.patch
new file mode 100644
index 00000000000000..05f8c717148e22
--- /dev/null
+++ b/toolchain/fortify-headers/patches/001-__ppoll_time64.patch
@@ -0,0 +1,11 @@
+--- a/include/poll.h
++++ b/include/poll.h
+@@ -39,7 +39,7 @@ _FORTIFY_FN(poll) int poll(struct pollfd
+ 	return __orig_poll(__f, __n, __s);
+ }
+ 
+-#ifdef _GNU_SOURCE
++#if defined(_GNU_SOURCE) && !(defined(_REDIR_TIME64) && _REDIR_TIME64)
+ #undef ppoll
+ _FORTIFY_FN(ppoll) int ppoll(struct pollfd *__f, nfds_t __n, const struct timespec *__s,
+                              const sigset_t *__m)
diff --git a/toolchain/gcc/Config.in b/toolchain/gcc/Config.in
index f725ad57859a9e..9156f9c2635684 100644
--- a/toolchain/gcc/Config.in
+++ b/toolchain/gcc/Config.in
@@ -2,21 +2,18 @@
 
 choice
 	prompt "GCC compiler Version" if TOOLCHAINOPTS
-	default GCC_USE_VERSION_11
+	default GCC_USE_VERSION_12
 	help
 	  Select the version of gcc you wish to use.
 
-	config GCC_USE_VERSION_8
-		bool "gcc 8.x"
-
-	config GCC_USE_VERSION_10
-		bool "gcc 10.x"
-
 	config GCC_USE_VERSION_11
 		bool "gcc 11.x"
 
 	config GCC_USE_VERSION_12
 		bool "gcc 12.x"
+
+	config GCC_USE_VERSION_13
+		bool "gcc 13.x"
 endchoice
 
 config GCC_USE_GRAPHITE
@@ -33,21 +30,18 @@ config EXTRA_GCC_CONFIG_OPTIONS
 config GCC_DEFAULT_PIE
 	bool
 	prompt "Build executable with PIE enabled by default" if TOOLCHAINOPTS
-	default n
 	help
 	    Use gcc configure option --enable-default-pie to turn on -fPIE and -pie by default.
 
 config GCC_DEFAULT_SSP
 	bool
 	prompt "Build executable with Stack-Smashing Protection enabled by default" if TOOLCHAINOPTS
-	default n
 	help
 	    Use gcc configure option --enable-default-ssp to turn on -fstack-protector-strong by default.
 
 config SJLJ_EXCEPTIONS
 	bool
 	prompt "Use setjump()/longjump() exceptions" if TOOLCHAINOPTS
-	default n
 	help
 	    Use old setjump()/longjump() exceptions instead of the newer
 	    frame unwinding exceptions handling routines.  Warning: increases
@@ -56,7 +50,6 @@ config SJLJ_EXCEPTIONS
 config INSTALL_GFORTRAN
 	bool
 	prompt "Build/install fortran compiler?" if TOOLCHAINOPTS
-	default n
 	help
 	    Build/install GNU fortran compiler ?
 
@@ -64,6 +57,5 @@ config INSTALL_GCCGO
 	bool
 	prompt "Build/install Go compiler?" if TOOLCHAINOPTS
 	depends on USE_GLIBC || BROKEN
-	default n
 	help
 	    Build/install GNU gccgo compiler ?
diff --git a/toolchain/gcc/Config.version b/toolchain/gcc/Config.version
index a909979cf66d8d..7126a0c883fd63 100644
--- a/toolchain/gcc/Config.version
+++ b/toolchain/gcc/Config.version
@@ -1,18 +1,13 @@
-config GCC_VERSION_8
-	default y if GCC_USE_VERSION_8
+config GCC_VERSION_11
+	default y if GCC_USE_VERSION_11
 	bool
 
-config GCC_VERSION_10
-	default y if GCC_USE_VERSION_10
-	bool
-
-config GCC_VERSION_12
-	default y if GCC_USE_VERSION_12
+config GCC_VERSION_13
+	default y if GCC_USE_VERSION_13
 	bool
 
 config GCC_VERSION
 	string
-	default "8.4.0"		if GCC_VERSION_8
-	default "10.3.0"	if GCC_VERSION_10
-	default "12.2.0"	if GCC_VERSION_12
-	default "11.3.0"
+	default "11.3.0"	if GCC_VERSION_11
+	default "13.1.0"	if GCC_VERSION_13
+	default "12.3.0"
diff --git a/toolchain/gcc/common.mk b/toolchain/gcc/common.mk
index 83884dd54c0f4f..677fb253818181 100644
--- a/toolchain/gcc/common.mk
+++ b/toolchain/gcc/common.mk
@@ -29,20 +29,16 @@ GCC_DIR:=$(PKG_NAME)-$(PKG_VERSION)
 PKG_SOURCE_URL:=@GNU/gcc/gcc-$(PKG_VERSION)
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 
-ifeq ($(PKG_VERSION),8.4.0)
-  PKG_HASH:=e30a6e52d10e1f27ed55104ad233c30bd1e99cfb5ff98ab022dc941edd1b2dd4
-endif
-
-ifeq ($(PKG_VERSION),10.3.0)
-  PKG_HASH:=64f404c1a650f27fc33da242e1f2df54952e3963a49e06e73f6940f3223ac344
-endif
-
 ifeq ($(PKG_VERSION),11.3.0)
   PKG_HASH:=b47cf2818691f5b1e21df2bb38c795fac2cfbd640ede2d0a5e1c89e338a3ac39
 endif
 
-ifeq ($(PKG_VERSION),12.2.0)
-  PKG_HASH:=e549cf9cf3594a00e27b6589d4322d70e0720cdd213f39beb4181e06926230ff
+ifeq ($(PKG_VERSION),12.3.0)
+  PKG_HASH:=949a5d4f99e786421a93b532b22ffab5578de7321369975b91aec97adfda8c3b
+endif
+
+ifeq ($(PKG_VERSION),13.1.0)
+  PKG_HASH:=61d684f0aa5e76ac6585ad8898a2427aade8979ed5e7f85492286c4dfc13ee86
 endif
 
 PATCH_DIR=../patches-$(GCC_MAJOR_VERSION).x
@@ -74,23 +70,22 @@ TAR_OPTIONS += \
 	--exclude-from='$(CURDIR)/../exclude-testsuite' --exclude=gcc/ada/*.ad* \
 	--exclude=libjava
 
+# this needs to be without -L/-lzstd flags or other parts fail to build
+# use an absolute path to ensure it really picks up our version
+export ac_cv_search_ZSTD_compress=$(STAGING_DIR_HOST)/lib/libzstd.a -pthread
 export libgcc_cv_fixed_point=no
 ifdef CONFIG_INSTALL_GCCGO
   export libgo_cv_c_split_stack_supported=no
 endif
 
 ifdef CONFIG_GCC_USE_GRAPHITE
-  GRAPHITE_CONFIGURE:= --with-isl=$(TOPDIR)/staging_dir/host
+  GRAPHITE_CONFIGURE:= --with-isl=$(STAGING_DIR_HOST)
 else
   GRAPHITE_CONFIGURE:= --without-isl --without-cloog
 endif
 
 GCC_CONFIGURE:= \
 	SHELL="$(BASH)" \
-	$(if $(shell gcc --version 2>&1 | grep -E "Apple.(LLVM|clang)"), \
-		CFLAGS="-O2 -fbracket-depth=512 -pipe" \
-		CXXFLAGS="-O2 -fbracket-depth=512 -pipe" \
-	) \
 	$(HOST_SOURCE_DIR)/configure \
 		--with-bugurl=$(BUGURL) \
 		--with-pkgversion="$(PKGVERSION)" \
@@ -114,9 +109,11 @@ GCC_CONFIGURE:= \
 			--with-abi=$(call qstrip,$(CONFIG_MIPS64_ABI))) \
 		$(if $(CONFIG_arc),--with-cpu=$(CONFIG_CPU_TYPE)) \
 		$(if $(CONFIG_powerpc64), $(if $(CONFIG_USE_MUSL),--with-abi=elfv2)) \
-		--with-gmp=$(TOPDIR)/staging_dir/host \
-		--with-mpfr=$(TOPDIR)/staging_dir/host \
-		--with-mpc=$(TOPDIR)/staging_dir/host \
+		--with-system-zlib=$(STAGING_DIR_HOST) \
+		--with-zstd=$(STAGING_DIR_HOST) \
+		--with-gmp=$(STAGING_DIR_HOST) \
+		--with-mpfr=$(STAGING_DIR_HOST) \
+		--with-mpc=$(STAGING_DIR_HOST) \
 		--disable-decimal-float \
 		--with-diagnostics-color=auto-if-env \
 		--enable-__cxa_atexit \
@@ -172,13 +169,21 @@ ifeq ($(CONFIG_TARGET_x86)$(CONFIG_USE_GLIBC)$(CONFIG_INSTALL_GCCGO),yyy)
   TARGET_CFLAGS+=-fno-split-stack
 endif
 
+CFLAGS:=$(HOST_CFLAGS) -pipe
+ifneq ($(shell gcc --version 2>&1 | grep -E "Apple.(LLVM|clang)"),)
+  CFLAGS+= -fbracket-depth=512
+endif
+
+GCC_CONFIGURE+= \
+	CFLAGS="$(CFLAGS)" \
+	CXXFLAGS="$(CFLAGS)" \
+	CFLAGS_FOR_TARGET="$(TARGET_CFLAGS)" \
+	CXXFLAGS_FOR_TARGET="$(TARGET_CFLAGS)" \
+	GOCFLAGS_FOR_TARGET="$(TARGET_CFLAGS)"
+
 GCC_MAKE:= \
 	export SHELL="$(BASH)"; \
-	$(MAKE) \
-		CFLAGS="$(HOST_CFLAGS)" \
-		CFLAGS_FOR_TARGET="$(TARGET_CFLAGS)" \
-		CXXFLAGS_FOR_TARGET="$(TARGET_CFLAGS)" \
-		GOCFLAGS_FOR_TARGET="$(TARGET_CFLAGS)"
+	$(MAKE)
 
 define Host/SetToolchainInfo
 	$(SED) 's,TARGET_CROSS=.*,TARGET_CROSS=$(REAL_GNU_TARGET_NAME)-,' $(TOOLCHAIN_DIR)/info.mk
@@ -186,10 +191,10 @@ define Host/SetToolchainInfo
 endef
 
 
-ifdef CONFIG_GCC_USE_VERSION_12
-	GCC_VERSION_FILE:=gcc/genversion.cc
-else
+ifeq ($(GCC_MAJOR_VERSION),11)
 	GCC_VERSION_FILE:=gcc/version.c
+else
+	GCC_VERSION_FILE:=gcc/genversion.cc
 endif
 
 ifneq ($(GCC_PREPARE),)
diff --git a/toolchain/gcc/final/Makefile b/toolchain/gcc/final/Makefile
index 0315b9d1f163b9..78a5576bffb3b8 100644
--- a/toolchain/gcc/final/Makefile
+++ b/toolchain/gcc/final/Makefile
@@ -8,8 +8,9 @@ GCC_CONFIGURE += \
 	--enable-shared \
 	--enable-threads \
 	--with-slibdir=$(TOOLCHAIN_DIR)/lib \
+	--enable-plugins \
 	--enable-lto \
-	--with-libelf=$(TOPDIR)/staging_dir/host
+	--with-libelf=$(STAGING_DIR_HOST)
 
 ifndef CONFIG_USE_GLIBC
   GCC_CONFIGURE += --disable-libsanitizer
diff --git a/toolchain/gcc/initial/Makefile b/toolchain/gcc/initial/Makefile
index c71b17dd87b105..7cb4a73dbce0f7 100644
--- a/toolchain/gcc/initial/Makefile
+++ b/toolchain/gcc/initial/Makefile
@@ -19,18 +19,10 @@ endef
 
 define Host/Install
 	+$(GCC_MAKE) $(HOST_JOBS) -C $(GCC_BUILD_DIR) \
-		prefix="$(TOOLCHAIN_DIR)/initial" \
 		install-gcc \
 		install-target-libgcc
 
-	# XXX: glibc insists on linking against libgcc_eh
-	( cd $(TOOLCHAIN_DIR)/initial/lib/gcc/$(REAL_GNU_TARGET_NAME)/$(PKG_VERSION) ; \
-		[ -e libgcc_eh.a ] || ln -sf libgcc.a libgcc_eh.a ; \
-		cp libgcc.a libgcc_initial.a; \
-	)
-
-	$(call FixupLibdir,$(TOOLCHAIN_DIR)/initial)
-	$$(call file_copy,$(TOOLCHAIN_DIR)/initial/.,$(TOOLCHAIN_DIR)/)
+	$(call FixupLibdir,$(TOOLCHAIN_DIR))
 endef
 
 $(eval $(call HostBuild))
diff --git a/toolchain/gcc/patches-11.x/400-libsanitizer-cherry-pick-9cf13067cb5088626ba7-from-u.patch b/toolchain/gcc/patches-11.x/400-libsanitizer-cherry-pick-9cf13067cb5088626ba7-from-u.patch
new file mode 100644
index 00000000000000..39869b47468fda
--- /dev/null
+++ b/toolchain/gcc/patches-11.x/400-libsanitizer-cherry-pick-9cf13067cb5088626ba7-from-u.patch
@@ -0,0 +1,39 @@
+From d2356ebb0084a0d80dbfe33040c9afe938c15d19 Mon Sep 17 00:00:00 2001
+From: Martin Liska <mliska@suse.cz>
+Date: Mon, 11 Jul 2022 22:03:14 +0200
+Subject: [PATCH] libsanitizer: cherry-pick 9cf13067cb5088626ba7 from upstream
+
+9cf13067cb5088626ba7ee1ec4c42ec59c7995a0 [sanitizer] Remove #include <linux/fs.h> to resolve fsconfig_command/mount_attr conflict with glibc 2.36
+
+(cherry picked from commit 2701442d0cf6292f6624443c15813d6d1a3562fe)
+---
+ .../sanitizer_platform_limits_posix.cpp                | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cpp
++++ b/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cpp
+@@ -72,7 +72,9 @@
+ #include <sys/vt.h>
+ #include <linux/cdrom.h>
+ #include <linux/fd.h>
++#if SANITIZER_ANDROID
+ #include <linux/fs.h>
++#endif
+ #include <linux/hdreg.h>
+ #include <linux/input.h>
+ #include <linux/ioctl.h>
+@@ -828,10 +830,10 @@ unsigned struct_ElfW_Phdr_sz = sizeof(El
+   unsigned IOCTL_EVIOCGPROP = IOCTL_NOT_PRESENT;
+   unsigned IOCTL_EVIOCSKEYCODE_V2 = IOCTL_NOT_PRESENT;
+ #endif
+-  unsigned IOCTL_FS_IOC_GETFLAGS = FS_IOC_GETFLAGS;
+-  unsigned IOCTL_FS_IOC_GETVERSION = FS_IOC_GETVERSION;
+-  unsigned IOCTL_FS_IOC_SETFLAGS = FS_IOC_SETFLAGS;
+-  unsigned IOCTL_FS_IOC_SETVERSION = FS_IOC_SETVERSION;
++  unsigned IOCTL_FS_IOC_GETFLAGS = _IOR('f', 1, long);
++  unsigned IOCTL_FS_IOC_GETVERSION = _IOR('v', 1, long);
++  unsigned IOCTL_FS_IOC_SETFLAGS = _IOW('f', 2, long);
++  unsigned IOCTL_FS_IOC_SETVERSION = _IOW('v', 2, long);
+   unsigned IOCTL_GIO_CMAP = GIO_CMAP;
+   unsigned IOCTL_GIO_FONT = GIO_FONT;
+   unsigned IOCTL_GIO_UNIMAP = GIO_UNIMAP;
diff --git a/toolchain/gcc/patches-11.x/700-RISCV-Inline-subword-atomic-ops.patch b/toolchain/gcc/patches-11.x/700-RISCV-Inline-subword-atomic-ops.patch
new file mode 100644
index 00000000000000..0da7eb4af66693
--- /dev/null
+++ b/toolchain/gcc/patches-11.x/700-RISCV-Inline-subword-atomic-ops.patch
@@ -0,0 +1,2021 @@
+From f797260adaf52bee0ec0e16190bbefbe1bfc3692 Mon Sep 17 00:00:00 2001
+From: Patrick O'Neill <patrick@rivosinc.com>
+Date: Tue, 18 Apr 2023 14:33:13 -0700
+Subject: [PATCH] RISCV: Inline subword atomic ops
+
+RISC-V has no support for subword atomic operations; code currently
+generates libatomic library calls.
+
+This patch changes the default behavior to inline subword atomic calls
+(using the same logic as the existing library call).
+Behavior can be specified using the -minline-atomics and
+-mno-inline-atomics command line flags.
+
+gcc/libgcc/config/riscv/atomic.c has the same logic implemented in asm.
+This will need to stay for backwards compatibility and the
+-mno-inline-atomics flag.
+
+2023-04-18 Patrick O'Neill <patrick@rivosinc.com>
+
+gcc/ChangeLog:
+	PR target/104338
+	* config/riscv/riscv-protos.h: Add helper function stubs.
+	* config/riscv/riscv.cc: Add helper functions for subword masking.
+	* config/riscv/riscv.opt: Add command-line flag.
+	* config/riscv/sync.md: Add masking logic and inline asm for fetch_and_op,
+	fetch_and_nand, CAS, and exchange ops.
+	* doc/invoke.texi: Add blurb regarding command-line flag.
+
+libgcc/ChangeLog:
+	PR target/104338
+	* config/riscv/atomic.c: Add reference to duplicate logic.
+
+gcc/testsuite/ChangeLog:
+	PR target/104338
+	* gcc.target/riscv/inline-atomics-1.c: New test.
+	* gcc.target/riscv/inline-atomics-2.c: New test.
+	* gcc.target/riscv/inline-atomics-3.c: New test.
+	* gcc.target/riscv/inline-atomics-4.c: New test.
+	* gcc.target/riscv/inline-atomics-5.c: New test.
+	* gcc.target/riscv/inline-atomics-6.c: New test.
+	* gcc.target/riscv/inline-atomics-7.c: New test.
+	* gcc.target/riscv/inline-atomics-8.c: New test.
+
+Signed-off-by: Patrick O'Neill <patrick@rivosinc.com>
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+---
+ gcc/config/riscv/riscv-protos.h               |   2 +
+ gcc/config/riscv/riscv.cc                     |  49 ++
+ gcc/config/riscv/riscv.opt                    |   4 +
+ gcc/config/riscv/sync.md                      | 301 +++++++++
+ gcc/doc/invoke.texi                           |  10 +-
+ .../gcc.target/riscv/inline-atomics-1.c       |  18 +
+ .../gcc.target/riscv/inline-atomics-2.c       |   9 +
+ .../gcc.target/riscv/inline-atomics-3.c       | 569 ++++++++++++++++++
+ .../gcc.target/riscv/inline-atomics-4.c       | 566 +++++++++++++++++
+ .../gcc.target/riscv/inline-atomics-5.c       |  87 +++
+ .../gcc.target/riscv/inline-atomics-6.c       |  87 +++
+ .../gcc.target/riscv/inline-atomics-7.c       |  69 +++
+ .../gcc.target/riscv/inline-atomics-8.c       |  69 +++
+ libgcc/config/riscv/atomic.c                  |   2 +
+ 14 files changed, 1841 insertions(+), 1 deletion(-)
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-1.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-2.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-3.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-4.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-5.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-6.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-7.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-8.c
+
+--- a/gcc/config/riscv/riscv-protos.h
++++ b/gcc/config/riscv/riscv-protos.h
+@@ -74,6 +74,8 @@ extern bool riscv_expand_block_move (rtx
+ extern bool riscv_store_data_bypass_p (rtx_insn *, rtx_insn *);
+ extern rtx riscv_gen_gpr_save_insn (struct riscv_frame_info *);
+ extern bool riscv_gpr_save_operation_p (rtx);
++extern void riscv_subword_address (rtx, rtx *, rtx *, rtx *, rtx *);
++extern void riscv_lshift_subword (machine_mode, rtx, rtx, rtx *);
+ 
+ /* Routines implemented in riscv-c.c.  */
+ void riscv_cpu_cpp_builtins (cpp_reader *);
+--- a/gcc/config/riscv/riscv.c
++++ b/gcc/config/riscv/riscv.c
+@@ -5351,6 +5351,55 @@ riscv_asan_shadow_offset (void)
+   return TARGET_64BIT ? (HOST_WIDE_INT_1 << 29) : 0;
+ }
+ 
++/* Given memory reference MEM, expand code to compute the aligned
++   memory address, shift and mask values and store them into
++   *ALIGNED_MEM, *SHIFT, *MASK and *NOT_MASK.  */
++
++void
++riscv_subword_address (rtx mem, rtx *aligned_mem, rtx *shift, rtx *mask,
++		       rtx *not_mask)
++{
++  /* Align the memory address to a word.  */
++  rtx addr = force_reg (Pmode, XEXP (mem, 0));
++
++  rtx addr_mask = gen_int_mode (-4, Pmode);
++
++  rtx aligned_addr = gen_reg_rtx (Pmode);
++  emit_move_insn (aligned_addr,  gen_rtx_AND (Pmode, addr, addr_mask));
++
++  *aligned_mem = change_address (mem, SImode, aligned_addr);
++
++  /* Calculate the shift amount.  */
++  emit_move_insn (*shift, gen_rtx_AND (SImode, gen_lowpart (SImode, addr),
++				       gen_int_mode (3, SImode)));
++  emit_move_insn (*shift, gen_rtx_ASHIFT (SImode, *shift,
++					  gen_int_mode (3, SImode)));
++
++  /* Calculate the mask.  */
++  int unshifted_mask = GET_MODE_MASK (GET_MODE (mem));
++
++  emit_move_insn (*mask, gen_int_mode (unshifted_mask, SImode));
++
++  emit_move_insn (*mask, gen_rtx_ASHIFT (SImode, *mask,
++					 gen_lowpart (QImode, *shift)));
++
++  emit_move_insn (*not_mask, gen_rtx_NOT(SImode, *mask));
++}
++
++/* Leftshift a subword within an SImode register.  */
++
++void
++riscv_lshift_subword (machine_mode mode, rtx value, rtx shift,
++		      rtx *shifted_value)
++{
++  rtx value_reg = gen_reg_rtx (SImode);
++  emit_move_insn (value_reg, simplify_gen_subreg (SImode, value,
++						  mode, 0));
++
++  emit_move_insn(*shifted_value, gen_rtx_ASHIFT (SImode, value_reg,
++						 gen_lowpart (QImode, shift)));
++}
++
+ /* Initialize the GCC target structure.  */
+ #undef TARGET_ASM_ALIGNED_HI_OP
+ #define TARGET_ASM_ALIGNED_HI_OP "\t.half\t"
+--- a/gcc/config/riscv/riscv.opt
++++ b/gcc/config/riscv/riscv.opt
+@@ -195,6 +195,10 @@ long riscv_stack_protector_guard_offset
+ TargetVariable
+ int riscv_zi_subext
+ 
++minline-atomics
++Target Var(TARGET_INLINE_SUBWORD_ATOMIC) Init(1)
++Always inline subword atomic operations.
++
+ Enum
+ Name(isa_spec_class) Type(enum riscv_isa_spec_class)
+ Supported ISA specs (for use with the -misa-spec= option):
+--- a/gcc/config/riscv/sync.md
++++ b/gcc/config/riscv/sync.md
+@@ -21,8 +21,11 @@
+ 
+ (define_c_enum "unspec" [
+   UNSPEC_COMPARE_AND_SWAP
++  UNSPEC_COMPARE_AND_SWAP_SUBWORD
+   UNSPEC_SYNC_OLD_OP
++  UNSPEC_SYNC_OLD_OP_SUBWORD
+   UNSPEC_SYNC_EXCHANGE
++  UNSPEC_SYNC_EXCHANGE_SUBWORD
+   UNSPEC_ATOMIC_STORE
+   UNSPEC_MEMORY_BARRIER
+ ])
+@@ -92,6 +95,135 @@
+   "%F3amo<insn>.<amo>%A3 %0,%z2,%1"
+   [(set (attr "length") (const_int 8))])
+ 
++(define_insn "subword_atomic_fetch_strong_<atomic_optab>"
++  [(set (match_operand:SI 0 "register_operand" "=&r")		   ;; old value at mem
++	(match_operand:SI 1 "memory_operand" "+A"))		   ;; mem location
++   (set (match_dup 1)
++	(unspec_volatile:SI
++	  [(any_atomic:SI (match_dup 1)
++		     (match_operand:SI 2 "register_operand" "rI")) ;; value for op
++	   (match_operand:SI 3 "register_operand" "rI")]	   ;; mask
++	 UNSPEC_SYNC_OLD_OP_SUBWORD))
++    (match_operand:SI 4 "register_operand" "rI")		   ;; not_mask
++    (clobber (match_scratch:SI 5 "=&r"))			   ;; tmp_1
++    (clobber (match_scratch:SI 6 "=&r"))]			   ;; tmp_2
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++  {
++    return "1:\;"
++	   "lr.w.aq\t%0, %1\;"
++	   "<insn>\t%5, %0, %2\;"
++	   "and\t%5, %5, %3\;"
++	   "and\t%6, %0, %4\;"
++	   "or\t%6, %6, %5\;"
++	   "sc.w.rl\t%5, %6, %1\;"
++	   "bnez\t%5, 1b";
++  }
++  [(set (attr "length") (const_int 28))])
++
++(define_expand "atomic_fetch_nand<mode>"
++  [(match_operand:SHORT 0 "register_operand")			      ;; old value at mem
++   (not:SHORT (and:SHORT (match_operand:SHORT 1 "memory_operand")     ;; mem location
++			 (match_operand:SHORT 2 "reg_or_0_operand"))) ;; value for op
++   (match_operand:SI 3 "const_int_operand")]			      ;; model
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++{
++  /* We have no QImode/HImode atomics, so form a mask, then use
++     subword_atomic_fetch_strong_nand to implement a LR/SC version of the
++     operation. */
++
++  /* Logic duplicated in gcc/libgcc/config/riscv/atomic.c for use when inlining
++     is disabled */
++
++  rtx old = gen_reg_rtx (SImode);
++  rtx mem = operands[1];
++  rtx value = operands[2];
++  rtx aligned_mem = gen_reg_rtx (SImode);
++  rtx shift = gen_reg_rtx (SImode);
++  rtx mask = gen_reg_rtx (SImode);
++  rtx not_mask = gen_reg_rtx (SImode);
++
++  riscv_subword_address (mem, &aligned_mem, &shift, &mask, &not_mask);
++
++  rtx shifted_value = gen_reg_rtx (SImode);
++  riscv_lshift_subword (<MODE>mode, value, shift, &shifted_value);
++
++  emit_insn (gen_subword_atomic_fetch_strong_nand (old, aligned_mem,
++						   shifted_value,
++						   mask, not_mask));
++
++  emit_move_insn (old, gen_rtx_ASHIFTRT (SImode, old,
++					 gen_lowpart (QImode, shift)));
++
++  emit_move_insn (operands[0], gen_lowpart (<MODE>mode, old));
++
++  DONE;
++})
++
++(define_insn "subword_atomic_fetch_strong_nand"
++  [(set (match_operand:SI 0 "register_operand" "=&r")			  ;; old value at mem
++	(match_operand:SI 1 "memory_operand" "+A"))			  ;; mem location
++   (set (match_dup 1)
++	(unspec_volatile:SI
++	  [(not:SI (and:SI (match_dup 1)
++			   (match_operand:SI 2 "register_operand" "rI"))) ;; value for op
++	   (match_operand:SI 3 "register_operand" "rI")]		  ;; mask
++	 UNSPEC_SYNC_OLD_OP_SUBWORD))
++    (match_operand:SI 4 "register_operand" "rI")			  ;; not_mask
++    (clobber (match_scratch:SI 5 "=&r"))				  ;; tmp_1
++    (clobber (match_scratch:SI 6 "=&r"))]				  ;; tmp_2
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++  {
++    return "1:\;"
++	   "lr.w.aq\t%0, %1\;"
++	   "and\t%5, %0, %2\;"
++	   "not\t%5, %5\;"
++	   "and\t%5, %5, %3\;"
++	   "and\t%6, %0, %4\;"
++	   "or\t%6, %6, %5\;"
++	   "sc.w.rl\t%5, %6, %1\;"
++	   "bnez\t%5, 1b";
++  }
++  [(set (attr "length") (const_int 32))])
++
++(define_expand "atomic_fetch_<atomic_optab><mode>"
++  [(match_operand:SHORT 0 "register_operand")			 ;; old value at mem
++   (any_atomic:SHORT (match_operand:SHORT 1 "memory_operand")	 ;; mem location
++		     (match_operand:SHORT 2 "reg_or_0_operand")) ;; value for op
++   (match_operand:SI 3 "const_int_operand")]			 ;; model
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++{
++  /* We have no QImode/HImode atomics, so form a mask, then use
++     subword_atomic_fetch_strong_<mode> to implement a LR/SC version of the
++     operation. */
++
++  /* Logic duplicated in gcc/libgcc/config/riscv/atomic.c for use when inlining
++     is disabled */
++
++  rtx old = gen_reg_rtx (SImode);
++  rtx mem = operands[1];
++  rtx value = operands[2];
++  rtx aligned_mem = gen_reg_rtx (SImode);
++  rtx shift = gen_reg_rtx (SImode);
++  rtx mask = gen_reg_rtx (SImode);
++  rtx not_mask = gen_reg_rtx (SImode);
++
++  riscv_subword_address (mem, &aligned_mem, &shift, &mask, &not_mask);
++
++  rtx shifted_value = gen_reg_rtx (SImode);
++  riscv_lshift_subword (<MODE>mode, value, shift, &shifted_value);
++
++  emit_insn (gen_subword_atomic_fetch_strong_<atomic_optab> (old, aligned_mem,
++							     shifted_value,
++							     mask, not_mask));
++
++  emit_move_insn (old, gen_rtx_ASHIFTRT (SImode, old,
++					 gen_lowpart (QImode, shift)));
++
++  emit_move_insn (operands[0], gen_lowpart (<MODE>mode, old));
++
++  DONE;
++})
++
+ (define_insn "atomic_exchange<mode>"
+   [(set (match_operand:GPR 0 "register_operand" "=&r")
+ 	(unspec_volatile:GPR
+@@ -104,6 +236,56 @@
+   "%F3amoswap.<amo>%A3 %0,%z2,%1"
+   [(set (attr "length") (const_int 8))])
+ 
++(define_expand "atomic_exchange<mode>"
++  [(match_operand:SHORT 0 "register_operand") ;; old value at mem
++   (match_operand:SHORT 1 "memory_operand")   ;; mem location
++   (match_operand:SHORT 2 "register_operand") ;; value
++   (match_operand:SI 3 "const_int_operand")]  ;; model
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++{
++  rtx old = gen_reg_rtx (SImode);
++  rtx mem = operands[1];
++  rtx value = operands[2];
++  rtx aligned_mem = gen_reg_rtx (SImode);
++  rtx shift = gen_reg_rtx (SImode);
++  rtx mask = gen_reg_rtx (SImode);
++  rtx not_mask = gen_reg_rtx (SImode);
++
++  riscv_subword_address (mem, &aligned_mem, &shift, &mask, &not_mask);
++
++  rtx shifted_value = gen_reg_rtx (SImode);
++  riscv_lshift_subword (<MODE>mode, value, shift, &shifted_value);
++
++  emit_insn (gen_subword_atomic_exchange_strong (old, aligned_mem,
++						 shifted_value, not_mask));
++
++  emit_move_insn (old, gen_rtx_ASHIFTRT (SImode, old,
++					 gen_lowpart (QImode, shift)));
++
++  emit_move_insn (operands[0], gen_lowpart (<MODE>mode, old));
++  DONE;
++})
++
++(define_insn "subword_atomic_exchange_strong"
++  [(set (match_operand:SI 0 "register_operand" "=&r")	 ;; old value at mem
++	(match_operand:SI 1 "memory_operand" "+A"))	 ;; mem location
++   (set (match_dup 1)
++	(unspec_volatile:SI
++	  [(match_operand:SI 2 "reg_or_0_operand" "rI")  ;; value
++	   (match_operand:SI 3 "reg_or_0_operand" "rI")] ;; not_mask
++      UNSPEC_SYNC_EXCHANGE_SUBWORD))
++    (clobber (match_scratch:SI 4 "=&r"))]		 ;; tmp_1
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++  {
++    return "1:\;"
++	   "lr.w.aq\t%0, %1\;"
++	   "and\t%4, %0, %3\;"
++	   "or\t%4, %4, %2\;"
++	   "sc.w.rl\t%4, %4, %1\;"
++	   "bnez\t%4, 1b";
++  }
++  [(set (attr "length") (const_int 20))])
++
+ (define_insn "atomic_cas_value_strong<mode>"
+   [(set (match_operand:GPR 0 "register_operand" "=&r")
+ 	(match_operand:GPR 1 "memory_operand" "+A"))
+@@ -152,6 +334,125 @@
+   DONE;
+ })
+ 
++(define_expand "atomic_compare_and_swap<mode>"
++  [(match_operand:SI 0 "register_operand")    ;; bool output
++   (match_operand:SHORT 1 "register_operand") ;; val output
++   (match_operand:SHORT 2 "memory_operand")   ;; memory
++   (match_operand:SHORT 3 "reg_or_0_operand") ;; expected value
++   (match_operand:SHORT 4 "reg_or_0_operand") ;; desired value
++   (match_operand:SI 5 "const_int_operand")   ;; is_weak
++   (match_operand:SI 6 "const_int_operand")   ;; mod_s
++   (match_operand:SI 7 "const_int_operand")]  ;; mod_f
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++{
++  emit_insn (gen_atomic_cas_value_strong<mode> (operands[1], operands[2],
++						operands[3], operands[4],
++						operands[6], operands[7]));
++
++  rtx val = gen_reg_rtx (SImode);
++  if (operands[1] != const0_rtx)
++    emit_move_insn (val, gen_rtx_SIGN_EXTEND (SImode, operands[1]));
++  else
++    emit_move_insn (val, const0_rtx);
++
++  rtx exp = gen_reg_rtx (SImode);
++  if (operands[3] != const0_rtx)
++    emit_move_insn (exp, gen_rtx_SIGN_EXTEND (SImode, operands[3]));
++  else
++    emit_move_insn (exp, const0_rtx);
++
++  rtx compare = val;
++  if (exp != const0_rtx)
++    {
++      rtx difference = gen_rtx_MINUS (SImode, val, exp);
++      compare = gen_reg_rtx (SImode);
++      emit_move_insn  (compare, difference);
++    }
++
++  if (word_mode != SImode)
++    {
++      rtx reg = gen_reg_rtx (word_mode);
++      emit_move_insn (reg, gen_rtx_SIGN_EXTEND (word_mode, compare));
++      compare = reg;
++    }
++
++  emit_move_insn (operands[0], gen_rtx_EQ (SImode, compare, const0_rtx));
++  DONE;
++})
++
++(define_expand "atomic_cas_value_strong<mode>"
++  [(match_operand:SHORT 0 "register_operand") ;; val output
++   (match_operand:SHORT 1 "memory_operand")   ;; memory
++   (match_operand:SHORT 2 "reg_or_0_operand") ;; expected value
++   (match_operand:SHORT 3 "reg_or_0_operand") ;; desired value
++   (match_operand:SI 4 "const_int_operand")   ;; mod_s
++   (match_operand:SI 5 "const_int_operand")   ;; mod_f
++   (match_scratch:SHORT 6)]
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++{
++  /* We have no QImode/HImode atomics, so form a mask, then use
++     subword_atomic_cas_strong<mode> to implement a LR/SC version of the
++     operation. */
++
++  /* Logic duplicated in gcc/libgcc/config/riscv/atomic.c for use when inlining
++     is disabled */
++
++  rtx old = gen_reg_rtx (SImode);
++  rtx mem = operands[1];
++  rtx aligned_mem = gen_reg_rtx (SImode);
++  rtx shift = gen_reg_rtx (SImode);
++  rtx mask = gen_reg_rtx (SImode);
++  rtx not_mask = gen_reg_rtx (SImode);
++
++  riscv_subword_address (mem, &aligned_mem, &shift, &mask, &not_mask);
++
++  rtx o = operands[2];
++  rtx n = operands[3];
++  rtx shifted_o = gen_reg_rtx (SImode);
++  rtx shifted_n = gen_reg_rtx (SImode);
++
++  riscv_lshift_subword (<MODE>mode, o, shift, &shifted_o);
++  riscv_lshift_subword (<MODE>mode, n, shift, &shifted_n);
++
++  emit_move_insn (shifted_o, gen_rtx_AND (SImode, shifted_o, mask));
++  emit_move_insn (shifted_n, gen_rtx_AND (SImode, shifted_n, mask));
++
++  emit_insn (gen_subword_atomic_cas_strong (old, aligned_mem,
++					    shifted_o, shifted_n,
++					    mask, not_mask));
++
++  emit_move_insn (old, gen_rtx_ASHIFTRT (SImode, old,
++					 gen_lowpart (QImode, shift)));
++
++  emit_move_insn (operands[0], gen_lowpart (<MODE>mode, old));
++
++  DONE;
++})
++
++(define_insn "subword_atomic_cas_strong"
++  [(set (match_operand:SI 0 "register_operand" "=&r")			   ;; old value at mem
++	(match_operand:SI 1 "memory_operand" "+A"))			   ;; mem location
++   (set (match_dup 1)
++	(unspec_volatile:SI [(match_operand:SI 2 "reg_or_0_operand" "rJ")  ;; expected value
++			     (match_operand:SI 3 "reg_or_0_operand" "rJ")] ;; desired value
++	 UNSPEC_COMPARE_AND_SWAP_SUBWORD))
++	(match_operand:SI 4 "register_operand" "rI")			   ;; mask
++	(match_operand:SI 5 "register_operand" "rI")			   ;; not_mask
++	(clobber (match_scratch:SI 6 "=&r"))]				   ;; tmp_1
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++  {
++    return "1:\;"
++	   "lr.w.aq\t%0, %1\;"
++	   "and\t%6, %0, %4\;"
++	   "bne\t%6, %z2, 1f\;"
++	   "and\t%6, %0, %5\;"
++	   "or\t%6, %6, %3\;"
++	   "sc.w.rl\t%6, %6, %1\;"
++	   "bnez\t%6, 1b\;"
++	   "1:";
++  }
++  [(set (attr "length") (const_int 28))])
++
+ (define_expand "atomic_test_and_set"
+   [(match_operand:QI 0 "register_operand" "")     ;; bool output
+    (match_operand:QI 1 "memory_operand" "+A")    ;; memory
+--- a/gcc/doc/invoke.texi
++++ b/gcc/doc/invoke.texi
+@@ -734,7 +734,8 @@ Objective-C and Objective-C++ Dialects}.
+ -moverride=@var{string}  -mverbose-cost-dump @gol
+ -mstack-protector-guard=@var{guard} -mstack-protector-guard-reg=@var{sysreg} @gol
+ -mstack-protector-guard-offset=@var{offset} -mtrack-speculation @gol
+--moutline-atomics }
++-moutline-atomics
++-minline-atomics  -mno-inline-atomics}
+ 
+ @emph{Adapteva Epiphany Options}
+ @gccoptlist{-mhalf-reg-file  -mprefer-short-insn-regs @gol
+@@ -26742,6 +26743,13 @@ Do or don't use smaller but slower prolo
+ library function calls.  The default is to use fast inline prologues and
+ epilogues.
+ 
++@opindex minline-atomics
++@item -minline-atomics
++@itemx -mno-inline-atomics
++Do or don't use smaller but slower subword atomic emulation code that uses
++libatomic function calls.  The default is to use fast inline subword atomics
++that do not require libatomic.
++
+ @item -mshorten-memrefs
+ @itemx -mno-shorten-memrefs
+ @opindex mshorten-memrefs
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-1.c
+@@ -0,0 +1,18 @@
++/* { dg-do compile } */
++/* { dg-options "-mno-inline-atomics" } */
++/* { dg-message "note: '__sync_fetch_and_nand' changed semantics in GCC 4.4" "fetch_and_nand" { target *-*-* } 0 } */
++/* { dg-final { scan-assembler "\tcall\t__sync_fetch_and_add_1" } } */
++/* { dg-final { scan-assembler "\tcall\t__sync_fetch_and_nand_1" } } */
++/* { dg-final { scan-assembler "\tcall\t__sync_bool_compare_and_swap_1" } } */
++
++char foo;
++char bar;
++char baz;
++
++int
++main ()
++{
++  __sync_fetch_and_add(&foo, 1);
++  __sync_fetch_and_nand(&bar, 1);
++  __sync_bool_compare_and_swap (&baz, 1, 2);
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-2.c
+@@ -0,0 +1,9 @@
++/* { dg-do compile } */
++/* Verify that subword atomics do not generate calls.  */
++/* { dg-options "-minline-atomics" } */
++/* { dg-message "note: '__sync_fetch_and_nand' changed semantics in GCC 4.4" "fetch_and_nand" { target *-*-* } 0 } */
++/* { dg-final { scan-assembler-not "\tcall\t__sync_fetch_and_add_1" } } */
++/* { dg-final { scan-assembler-not "\tcall\t__sync_fetch_and_nand_1" } } */
++/* { dg-final { scan-assembler-not "\tcall\t__sync_bool_compare_and_swap_1" } } */
++
++#include "inline-atomics-1.c"
+\ No newline at end of file
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-3.c
+@@ -0,0 +1,569 @@
++/* Check all char alignments.  */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-op-1.c */
++/* Test __atomic routines for existence and proper execution on 1 byte
++   values with each valid memory model.  */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics -Wno-address-of-packed-member" } */
++
++/* Test the execution of the __atomic_*OP builtin routines for a char.  */
++
++extern void abort(void);
++
++char count, res;
++const char init = ~0;
++
++struct A
++{
++   char a;
++   char b;
++   char c;
++   char d;
++} __attribute__ ((packed)) A;
++
++/* The fetch_op routines return the original value before the operation.  */
++
++void
++test_fetch_add (char* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_fetch_add (v, count, __ATOMIC_RELAXED) != 0)
++    abort ();
++
++  if (__atomic_fetch_add (v, 1, __ATOMIC_CONSUME) != 1)
++    abort ();
++
++  if (__atomic_fetch_add (v, count, __ATOMIC_ACQUIRE) != 2)
++    abort ();
++
++  if (__atomic_fetch_add (v, 1, __ATOMIC_RELEASE) != 3)
++    abort ();
++
++  if (__atomic_fetch_add (v, count, __ATOMIC_ACQ_REL) != 4)
++    abort ();
++
++  if (__atomic_fetch_add (v, 1, __ATOMIC_SEQ_CST) != 5)
++    abort ();
++}
++
++
++void
++test_fetch_sub (char* v)
++{
++  *v = res = 20;
++  count = 0;
++
++  if (__atomic_fetch_sub (v, count + 1, __ATOMIC_RELAXED) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, 1, __ATOMIC_CONSUME) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, count + 1, __ATOMIC_ACQUIRE) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, 1, __ATOMIC_RELEASE) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, count + 1, __ATOMIC_ACQ_REL) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, 1, __ATOMIC_SEQ_CST) !=  res--)
++    abort ();
++}
++
++void
++test_fetch_and (char* v)
++{
++  *v = init;
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_fetch_and (v, init, __ATOMIC_CONSUME) !=  0)
++    abort ();
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  *v = ~*v;
++  if (__atomic_fetch_and (v, init, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_SEQ_CST) !=  0)
++    abort ();
++}
++
++void
++test_fetch_nand (char* v)
++{
++  *v = init;
++
++  if (__atomic_fetch_nand (v, 0, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_fetch_nand (v, init, __ATOMIC_CONSUME) !=  init)
++    abort ();
++
++  if (__atomic_fetch_nand (v, 0, __ATOMIC_ACQUIRE) !=  0 )
++    abort ();
++
++  if (__atomic_fetch_nand (v, init, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_fetch_nand (v, init, __ATOMIC_ACQ_REL) !=  0)
++    abort ();
++
++  if (__atomic_fetch_nand (v, 0, __ATOMIC_SEQ_CST) !=  init)
++    abort ();
++}
++
++void
++test_fetch_xor (char* v)
++{
++  *v = init;
++  count = 0;
++
++  if (__atomic_fetch_xor (v, count, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_fetch_xor (v, ~count, __ATOMIC_CONSUME) !=  init)
++    abort ();
++
++  if (__atomic_fetch_xor (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  if (__atomic_fetch_xor (v, ~count, __ATOMIC_RELEASE) !=  0)
++    abort ();
++
++  if (__atomic_fetch_xor (v, 0, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_fetch_xor (v, ~count, __ATOMIC_SEQ_CST) !=  init)
++    abort ();
++}
++
++void
++test_fetch_or (char* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_fetch_or (v, count, __ATOMIC_RELAXED) !=  0)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, 2, __ATOMIC_CONSUME) !=  1)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, count, __ATOMIC_ACQUIRE) !=  3)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, 8, __ATOMIC_RELEASE) !=  7)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, count, __ATOMIC_ACQ_REL) !=  15)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, count, __ATOMIC_SEQ_CST) !=  31)
++    abort ();
++}
++
++/* The OP_fetch routines return the new value after the operation.  */
++
++void
++test_add_fetch (char* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_RELAXED) != 1)
++    abort ();
++
++  if (__atomic_add_fetch (v, 1, __ATOMIC_CONSUME) != 2)
++    abort ();
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_ACQUIRE) != 3)
++    abort ();
++
++  if (__atomic_add_fetch (v, 1, __ATOMIC_RELEASE) != 4)
++    abort ();
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_ACQ_REL) != 5)
++    abort ();
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_SEQ_CST) != 6)
++    abort ();
++}
++
++
++void
++test_sub_fetch (char* v)
++{
++  *v = res = 20;
++  count = 0;
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_RELAXED) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, 1, __ATOMIC_CONSUME) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_ACQUIRE) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, 1, __ATOMIC_RELEASE) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_ACQ_REL) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_SEQ_CST) !=  --res)
++    abort ();
++}
++
++void
++test_and_fetch (char* v)
++{
++  *v = init;
++
++  if (__atomic_and_fetch (v, 0, __ATOMIC_RELAXED) !=  0)
++    abort ();
++
++  *v = init;
++  if (__atomic_and_fetch (v, init, __ATOMIC_CONSUME) !=  init)
++    abort ();
++
++  if (__atomic_and_fetch (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  *v = ~*v;
++  if (__atomic_and_fetch (v, init, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_and_fetch (v, 0, __ATOMIC_ACQ_REL) !=  0)
++    abort ();
++
++  *v = ~*v;
++  if (__atomic_and_fetch (v, 0, __ATOMIC_SEQ_CST) !=  0)
++    abort ();
++}
++
++void
++test_nand_fetch (char* v)
++{
++  *v = init;
++
++  if (__atomic_nand_fetch (v, 0, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_nand_fetch (v, init, __ATOMIC_CONSUME) !=  0)
++    abort ();
++
++  if (__atomic_nand_fetch (v, 0, __ATOMIC_ACQUIRE) !=  init)
++    abort ();
++
++  if (__atomic_nand_fetch (v, init, __ATOMIC_RELEASE) !=  0)
++    abort ();
++
++  if (__atomic_nand_fetch (v, init, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_nand_fetch (v, 0, __ATOMIC_SEQ_CST) !=  init)
++    abort ();
++}
++
++
++
++void
++test_xor_fetch (char* v)
++{
++  *v = init;
++  count = 0;
++
++  if (__atomic_xor_fetch (v, count, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_xor_fetch (v, ~count, __ATOMIC_CONSUME) !=  0)
++    abort ();
++
++  if (__atomic_xor_fetch (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  if (__atomic_xor_fetch (v, ~count, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_xor_fetch (v, 0, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_xor_fetch (v, ~count, __ATOMIC_SEQ_CST) !=  0)
++    abort ();
++}
++
++void
++test_or_fetch (char* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_or_fetch (v, count, __ATOMIC_RELAXED) !=  1)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, 2, __ATOMIC_CONSUME) !=  3)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, count, __ATOMIC_ACQUIRE) !=  7)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, 8, __ATOMIC_RELEASE) !=  15)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, count, __ATOMIC_ACQ_REL) !=  31)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, count, __ATOMIC_SEQ_CST) !=  63)
++    abort ();
++}
++
++
++/* Test the OP routines with a result which isn't used. Use both variations
++   within each function.  */
++
++void
++test_add (char* v)
++{
++  *v = 0;
++  count = 1;
++
++  __atomic_add_fetch (v, count, __ATOMIC_RELAXED);
++  if (*v != 1)
++    abort ();
++
++  __atomic_fetch_add (v, count, __ATOMIC_CONSUME);
++  if (*v != 2)
++    abort ();
++
++  __atomic_add_fetch (v, 1 , __ATOMIC_ACQUIRE);
++  if (*v != 3)
++    abort ();
++
++  __atomic_fetch_add (v, 1, __ATOMIC_RELEASE);
++  if (*v != 4)
++    abort ();
++
++  __atomic_add_fetch (v, count, __ATOMIC_ACQ_REL);
++  if (*v != 5)
++    abort ();
++
++  __atomic_fetch_add (v, count, __ATOMIC_SEQ_CST);
++  if (*v != 6)
++    abort ();
++}
++
++
++void
++test_sub (char* v)
++{
++  *v = res = 20;
++  count = 0;
++
++  __atomic_sub_fetch (v, count + 1, __ATOMIC_RELAXED);
++  if (*v != --res)
++    abort ();
++
++  __atomic_fetch_sub (v, count + 1, __ATOMIC_CONSUME);
++  if (*v != --res)
++    abort ();
++
++  __atomic_sub_fetch (v, 1, __ATOMIC_ACQUIRE);
++  if (*v != --res)
++    abort ();
++
++  __atomic_fetch_sub (v, 1, __ATOMIC_RELEASE);
++  if (*v != --res)
++    abort ();
++
++  __atomic_sub_fetch (v, count + 1, __ATOMIC_ACQ_REL);
++  if (*v != --res)
++    abort ();
++
++  __atomic_fetch_sub (v, count + 1, __ATOMIC_SEQ_CST);
++  if (*v != --res)
++    abort ();
++}
++
++void
++test_and (char* v)
++{
++  *v = init;
++
++  __atomic_and_fetch (v, 0, __ATOMIC_RELAXED);
++  if (*v != 0)
++    abort ();
++
++  *v = init;
++  __atomic_fetch_and (v, init, __ATOMIC_CONSUME);
++  if (*v != init)
++    abort ();
++
++  __atomic_and_fetch (v, 0, __ATOMIC_ACQUIRE);
++  if (*v != 0)
++    abort ();
++
++  *v = ~*v;
++  __atomic_fetch_and (v, init, __ATOMIC_RELEASE);
++  if (*v != init)
++    abort ();
++
++  __atomic_and_fetch (v, 0, __ATOMIC_ACQ_REL);
++  if (*v != 0)
++    abort ();
++
++  *v = ~*v;
++  __atomic_fetch_and (v, 0, __ATOMIC_SEQ_CST);
++  if (*v != 0)
++    abort ();
++}
++
++void
++test_nand (char* v)
++{
++  *v = init;
++
++  __atomic_fetch_nand (v, 0, __ATOMIC_RELAXED);
++  if (*v != init)
++    abort ();
++
++  __atomic_fetch_nand (v, init, __ATOMIC_CONSUME);
++  if (*v != 0)
++    abort ();
++
++  __atomic_nand_fetch (v, 0, __ATOMIC_ACQUIRE);
++  if (*v != init)
++    abort ();
++
++  __atomic_nand_fetch (v, init, __ATOMIC_RELEASE);
++  if (*v != 0)
++    abort ();
++
++  __atomic_fetch_nand (v, init, __ATOMIC_ACQ_REL);
++  if (*v != init)
++    abort ();
++
++  __atomic_nand_fetch (v, 0, __ATOMIC_SEQ_CST);
++  if (*v != init)
++    abort ();
++}
++
++
++
++void
++test_xor (char* v)
++{
++  *v = init;
++  count = 0;
++
++  __atomic_xor_fetch (v, count, __ATOMIC_RELAXED);
++  if (*v != init)
++    abort ();
++
++  __atomic_fetch_xor (v, ~count, __ATOMIC_CONSUME);
++  if (*v != 0)
++    abort ();
++
++  __atomic_xor_fetch (v, 0, __ATOMIC_ACQUIRE);
++  if (*v != 0)
++    abort ();
++
++  __atomic_fetch_xor (v, ~count, __ATOMIC_RELEASE);
++  if (*v != init)
++    abort ();
++
++  __atomic_fetch_xor (v, 0, __ATOMIC_ACQ_REL);
++  if (*v != init)
++    abort ();
++
++  __atomic_xor_fetch (v, ~count, __ATOMIC_SEQ_CST);
++  if (*v != 0)
++    abort ();
++}
++
++void
++test_or (char* v)
++{
++  *v = 0;
++  count = 1;
++
++  __atomic_or_fetch (v, count, __ATOMIC_RELAXED);
++  if (*v != 1)
++    abort ();
++
++  count *= 2;
++  __atomic_fetch_or (v, count, __ATOMIC_CONSUME);
++  if (*v != 3)
++    abort ();
++
++  count *= 2;
++  __atomic_or_fetch (v, 4, __ATOMIC_ACQUIRE);
++  if (*v != 7)
++    abort ();
++
++  count *= 2;
++  __atomic_fetch_or (v, 8, __ATOMIC_RELEASE);
++  if (*v != 15)
++    abort ();
++
++  count *= 2;
++  __atomic_or_fetch (v, count, __ATOMIC_ACQ_REL);
++  if (*v != 31)
++    abort ();
++
++  count *= 2;
++  __atomic_fetch_or (v, count, __ATOMIC_SEQ_CST);
++  if (*v != 63)
++    abort ();
++}
++
++int
++main ()
++{
++  char* V[] = {&A.a, &A.b, &A.c, &A.d};
++
++  for (int i = 0; i < 4; i++) {
++    test_fetch_add (V[i]);
++    test_fetch_sub (V[i]);
++    test_fetch_and (V[i]);
++    test_fetch_nand (V[i]);
++    test_fetch_xor (V[i]);
++    test_fetch_or (V[i]);
++
++    test_add_fetch (V[i]);
++    test_sub_fetch (V[i]);
++    test_and_fetch (V[i]);
++    test_nand_fetch (V[i]);
++    test_xor_fetch (V[i]);
++    test_or_fetch (V[i]);
++
++    test_add (V[i]);
++    test_sub (V[i]);
++    test_and (V[i]);
++    test_nand (V[i]);
++    test_xor (V[i]);
++    test_or (V[i]);
++  }
++
++  return 0;
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-4.c
+@@ -0,0 +1,566 @@
++/* Check all short alignments.  */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-op-2.c */
++/* Test __atomic routines for existence and proper execution on 2 byte
++   values with each valid memory model.  */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics -Wno-address-of-packed-member" } */
++
++/* Test the execution of the __atomic_*OP builtin routines for a short.  */
++
++extern void abort(void);
++
++short count, res;
++const short init = ~0;
++
++struct A
++{
++   short a;
++   short b;
++} __attribute__ ((packed)) A;
++
++/* The fetch_op routines return the original value before the operation.  */
++
++void
++test_fetch_add (short* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_fetch_add (v, count, __ATOMIC_RELAXED) != 0)
++    abort ();
++
++  if (__atomic_fetch_add (v, 1, __ATOMIC_CONSUME) != 1)
++    abort ();
++
++  if (__atomic_fetch_add (v, count, __ATOMIC_ACQUIRE) != 2)
++    abort ();
++
++  if (__atomic_fetch_add (v, 1, __ATOMIC_RELEASE) != 3)
++    abort ();
++
++  if (__atomic_fetch_add (v, count, __ATOMIC_ACQ_REL) != 4)
++    abort ();
++
++  if (__atomic_fetch_add (v, 1, __ATOMIC_SEQ_CST) != 5)
++    abort ();
++}
++
++
++void
++test_fetch_sub (short* v)
++{
++  *v = res = 20;
++  count = 0;
++
++  if (__atomic_fetch_sub (v, count + 1, __ATOMIC_RELAXED) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, 1, __ATOMIC_CONSUME) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, count + 1, __ATOMIC_ACQUIRE) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, 1, __ATOMIC_RELEASE) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, count + 1, __ATOMIC_ACQ_REL) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, 1, __ATOMIC_SEQ_CST) !=  res--)
++    abort ();
++}
++
++void
++test_fetch_and (short* v)
++{
++  *v = init;
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_fetch_and (v, init, __ATOMIC_CONSUME) !=  0)
++    abort ();
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  *v = ~*v;
++  if (__atomic_fetch_and (v, init, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_SEQ_CST) !=  0)
++    abort ();
++}
++
++void
++test_fetch_nand (short* v)
++{
++  *v = init;
++
++  if (__atomic_fetch_nand (v, 0, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_fetch_nand (v, init, __ATOMIC_CONSUME) !=  init)
++    abort ();
++
++  if (__atomic_fetch_nand (v, 0, __ATOMIC_ACQUIRE) !=  0 )
++    abort ();
++
++  if (__atomic_fetch_nand (v, init, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_fetch_nand (v, init, __ATOMIC_ACQ_REL) !=  0)
++    abort ();
++
++  if (__atomic_fetch_nand (v, 0, __ATOMIC_SEQ_CST) !=  init)
++    abort ();
++}
++
++void
++test_fetch_xor (short* v)
++{
++  *v = init;
++  count = 0;
++
++  if (__atomic_fetch_xor (v, count, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_fetch_xor (v, ~count, __ATOMIC_CONSUME) !=  init)
++    abort ();
++
++  if (__atomic_fetch_xor (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  if (__atomic_fetch_xor (v, ~count, __ATOMIC_RELEASE) !=  0)
++    abort ();
++
++  if (__atomic_fetch_xor (v, 0, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_fetch_xor (v, ~count, __ATOMIC_SEQ_CST) !=  init)
++    abort ();
++}
++
++void
++test_fetch_or (short* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_fetch_or (v, count, __ATOMIC_RELAXED) !=  0)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, 2, __ATOMIC_CONSUME) !=  1)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, count, __ATOMIC_ACQUIRE) !=  3)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, 8, __ATOMIC_RELEASE) !=  7)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, count, __ATOMIC_ACQ_REL) !=  15)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, count, __ATOMIC_SEQ_CST) !=  31)
++    abort ();
++}
++
++/* The OP_fetch routines return the new value after the operation.  */
++
++void
++test_add_fetch (short* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_RELAXED) != 1)
++    abort ();
++
++  if (__atomic_add_fetch (v, 1, __ATOMIC_CONSUME) != 2)
++    abort ();
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_ACQUIRE) != 3)
++    abort ();
++
++  if (__atomic_add_fetch (v, 1, __ATOMIC_RELEASE) != 4)
++    abort ();
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_ACQ_REL) != 5)
++    abort ();
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_SEQ_CST) != 6)
++    abort ();
++}
++
++
++void
++test_sub_fetch (short* v)
++{
++  *v = res = 20;
++  count = 0;
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_RELAXED) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, 1, __ATOMIC_CONSUME) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_ACQUIRE) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, 1, __ATOMIC_RELEASE) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_ACQ_REL) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_SEQ_CST) !=  --res)
++    abort ();
++}
++
++void
++test_and_fetch (short* v)
++{
++  *v = init;
++
++  if (__atomic_and_fetch (v, 0, __ATOMIC_RELAXED) !=  0)
++    abort ();
++
++  *v = init;
++  if (__atomic_and_fetch (v, init, __ATOMIC_CONSUME) !=  init)
++    abort ();
++
++  if (__atomic_and_fetch (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  *v = ~*v;
++  if (__atomic_and_fetch (v, init, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_and_fetch (v, 0, __ATOMIC_ACQ_REL) !=  0)
++    abort ();
++
++  *v = ~*v;
++  if (__atomic_and_fetch (v, 0, __ATOMIC_SEQ_CST) !=  0)
++    abort ();
++}
++
++void
++test_nand_fetch (short* v)
++{
++  *v = init;
++
++  if (__atomic_nand_fetch (v, 0, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_nand_fetch (v, init, __ATOMIC_CONSUME) !=  0)
++    abort ();
++
++  if (__atomic_nand_fetch (v, 0, __ATOMIC_ACQUIRE) !=  init)
++    abort ();
++
++  if (__atomic_nand_fetch (v, init, __ATOMIC_RELEASE) !=  0)
++    abort ();
++
++  if (__atomic_nand_fetch (v, init, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_nand_fetch (v, 0, __ATOMIC_SEQ_CST) !=  init)
++    abort ();
++}
++
++
++
++void
++test_xor_fetch (short* v)
++{
++  *v = init;
++  count = 0;
++
++  if (__atomic_xor_fetch (v, count, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_xor_fetch (v, ~count, __ATOMIC_CONSUME) !=  0)
++    abort ();
++
++  if (__atomic_xor_fetch (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  if (__atomic_xor_fetch (v, ~count, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_xor_fetch (v, 0, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_xor_fetch (v, ~count, __ATOMIC_SEQ_CST) !=  0)
++    abort ();
++}
++
++void
++test_or_fetch (short* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_or_fetch (v, count, __ATOMIC_RELAXED) !=  1)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, 2, __ATOMIC_CONSUME) !=  3)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, count, __ATOMIC_ACQUIRE) !=  7)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, 8, __ATOMIC_RELEASE) !=  15)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, count, __ATOMIC_ACQ_REL) !=  31)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, count, __ATOMIC_SEQ_CST) !=  63)
++    abort ();
++}
++
++
++/* Test the OP routines with a result which isn't used. Use both variations
++   within each function.  */
++
++void
++test_add (short* v)
++{
++  *v = 0;
++  count = 1;
++
++  __atomic_add_fetch (v, count, __ATOMIC_RELAXED);
++  if (*v != 1)
++    abort ();
++
++  __atomic_fetch_add (v, count, __ATOMIC_CONSUME);
++  if (*v != 2)
++    abort ();
++
++  __atomic_add_fetch (v, 1 , __ATOMIC_ACQUIRE);
++  if (*v != 3)
++    abort ();
++
++  __atomic_fetch_add (v, 1, __ATOMIC_RELEASE);
++  if (*v != 4)
++    abort ();
++
++  __atomic_add_fetch (v, count, __ATOMIC_ACQ_REL);
++  if (*v != 5)
++    abort ();
++
++  __atomic_fetch_add (v, count, __ATOMIC_SEQ_CST);
++  if (*v != 6)
++    abort ();
++}
++
++
++void
++test_sub (short* v)
++{
++  *v = res = 20;
++  count = 0;
++
++  __atomic_sub_fetch (v, count + 1, __ATOMIC_RELAXED);
++  if (*v != --res)
++    abort ();
++
++  __atomic_fetch_sub (v, count + 1, __ATOMIC_CONSUME);
++  if (*v != --res)
++    abort ();
++
++  __atomic_sub_fetch (v, 1, __ATOMIC_ACQUIRE);
++  if (*v != --res)
++    abort ();
++
++  __atomic_fetch_sub (v, 1, __ATOMIC_RELEASE);
++  if (*v != --res)
++    abort ();
++
++  __atomic_sub_fetch (v, count + 1, __ATOMIC_ACQ_REL);
++  if (*v != --res)
++    abort ();
++
++  __atomic_fetch_sub (v, count + 1, __ATOMIC_SEQ_CST);
++  if (*v != --res)
++    abort ();
++}
++
++void
++test_and (short* v)
++{
++  *v = init;
++
++  __atomic_and_fetch (v, 0, __ATOMIC_RELAXED);
++  if (*v != 0)
++    abort ();
++
++  *v = init;
++  __atomic_fetch_and (v, init, __ATOMIC_CONSUME);
++  if (*v != init)
++    abort ();
++
++  __atomic_and_fetch (v, 0, __ATOMIC_ACQUIRE);
++  if (*v != 0)
++    abort ();
++
++  *v = ~*v;
++  __atomic_fetch_and (v, init, __ATOMIC_RELEASE);
++  if (*v != init)
++    abort ();
++
++  __atomic_and_fetch (v, 0, __ATOMIC_ACQ_REL);
++  if (*v != 0)
++    abort ();
++
++  *v = ~*v;
++  __atomic_fetch_and (v, 0, __ATOMIC_SEQ_CST);
++  if (*v != 0)
++    abort ();
++}
++
++void
++test_nand (short* v)
++{
++  *v = init;
++
++  __atomic_fetch_nand (v, 0, __ATOMIC_RELAXED);
++  if (*v != init)
++    abort ();
++
++  __atomic_fetch_nand (v, init, __ATOMIC_CONSUME);
++  if (*v != 0)
++    abort ();
++
++  __atomic_nand_fetch (v, 0, __ATOMIC_ACQUIRE);
++  if (*v != init)
++    abort ();
++
++  __atomic_nand_fetch (v, init, __ATOMIC_RELEASE);
++  if (*v != 0)
++    abort ();
++
++  __atomic_fetch_nand (v, init, __ATOMIC_ACQ_REL);
++  if (*v != init)
++    abort ();
++
++  __atomic_nand_fetch (v, 0, __ATOMIC_SEQ_CST);
++  if (*v != init)
++    abort ();
++}
++
++
++
++void
++test_xor (short* v)
++{
++  *v = init;
++  count = 0;
++
++  __atomic_xor_fetch (v, count, __ATOMIC_RELAXED);
++  if (*v != init)
++    abort ();
++
++  __atomic_fetch_xor (v, ~count, __ATOMIC_CONSUME);
++  if (*v != 0)
++    abort ();
++
++  __atomic_xor_fetch (v, 0, __ATOMIC_ACQUIRE);
++  if (*v != 0)
++    abort ();
++
++  __atomic_fetch_xor (v, ~count, __ATOMIC_RELEASE);
++  if (*v != init)
++    abort ();
++
++  __atomic_fetch_xor (v, 0, __ATOMIC_ACQ_REL);
++  if (*v != init)
++    abort ();
++
++  __atomic_xor_fetch (v, ~count, __ATOMIC_SEQ_CST);
++  if (*v != 0)
++    abort ();
++}
++
++void
++test_or (short* v)
++{
++  *v = 0;
++  count = 1;
++
++  __atomic_or_fetch (v, count, __ATOMIC_RELAXED);
++  if (*v != 1)
++    abort ();
++
++  count *= 2;
++  __atomic_fetch_or (v, count, __ATOMIC_CONSUME);
++  if (*v != 3)
++    abort ();
++
++  count *= 2;
++  __atomic_or_fetch (v, 4, __ATOMIC_ACQUIRE);
++  if (*v != 7)
++    abort ();
++
++  count *= 2;
++  __atomic_fetch_or (v, 8, __ATOMIC_RELEASE);
++  if (*v != 15)
++    abort ();
++
++  count *= 2;
++  __atomic_or_fetch (v, count, __ATOMIC_ACQ_REL);
++  if (*v != 31)
++    abort ();
++
++  count *= 2;
++  __atomic_fetch_or (v, count, __ATOMIC_SEQ_CST);
++  if (*v != 63)
++    abort ();
++}
++
++int
++main () {
++  short* V[] = {&A.a, &A.b};
++
++  for (int i = 0; i < 2; i++) {
++    test_fetch_add (V[i]);
++    test_fetch_sub (V[i]);
++    test_fetch_and (V[i]);
++    test_fetch_nand (V[i]);
++    test_fetch_xor (V[i]);
++    test_fetch_or (V[i]);
++
++    test_add_fetch (V[i]);
++    test_sub_fetch (V[i]);
++    test_and_fetch (V[i]);
++    test_nand_fetch (V[i]);
++    test_xor_fetch (V[i]);
++    test_or_fetch (V[i]);
++
++    test_add (V[i]);
++    test_sub (V[i]);
++    test_and (V[i]);
++    test_nand (V[i]);
++    test_xor (V[i]);
++    test_or (V[i]);
++  }
++
++  return 0;
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-5.c
+@@ -0,0 +1,87 @@
++/* Test __atomic routines for existence and proper execution on 1 byte
++   values with each valid memory model.  */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-compare-exchange-1.c */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics" } */
++
++/* Test the execution of the __atomic_compare_exchange_n builtin for a char.  */
++
++extern void abort(void);
++
++char v = 0;
++char expected = 0;
++char max = ~0;
++char desired = ~0;
++char zero = 0;
++
++#define STRONG 0
++#define WEAK 1
++
++int
++main ()
++{
++
++  if (!__atomic_compare_exchange_n (&v, &expected, max, STRONG , __ATOMIC_RELAXED, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (__atomic_compare_exchange_n (&v, &expected, 0, STRONG , __ATOMIC_ACQUIRE, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != max)
++    abort ();
++
++  if (!__atomic_compare_exchange_n (&v, &expected, 0, STRONG , __ATOMIC_RELEASE, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != max)
++    abort ();
++  if (v != 0)
++    abort ();
++
++  if (__atomic_compare_exchange_n (&v, &expected, desired, WEAK, __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (!__atomic_compare_exchange_n (&v, &expected, desired, STRONG , __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST))
++    abort ();
++  if (expected != 0)
++    abort ();
++  if (v != max)
++    abort ();
++
++  /* Now test the generic version.  */
++
++  v = 0;
++
++  if (!__atomic_compare_exchange (&v, &expected, &max, STRONG, __ATOMIC_RELAXED, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (__atomic_compare_exchange (&v, &expected, &zero, STRONG , __ATOMIC_ACQUIRE, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != max)
++    abort ();
++
++  if (!__atomic_compare_exchange (&v, &expected, &zero, STRONG , __ATOMIC_RELEASE, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != max)
++    abort ();
++  if (v != 0)
++    abort ();
++
++  if (__atomic_compare_exchange (&v, &expected, &desired, WEAK, __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (!__atomic_compare_exchange (&v, &expected, &desired, STRONG , __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST))
++    abort ();
++  if (expected != 0)
++    abort ();
++  if (v != max)
++    abort ();
++
++  return 0;
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-6.c
+@@ -0,0 +1,87 @@
++/* Test __atomic routines for existence and proper execution on 2 byte
++   values with each valid memory model.  */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-compare-exchange-2.c */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics" } */
++
++/* Test the execution of the __atomic_compare_exchange_n builtin for a short.  */
++
++extern void abort(void);
++
++short v = 0;
++short expected = 0;
++short max = ~0;
++short desired = ~0;
++short zero = 0;
++
++#define STRONG 0
++#define WEAK 1
++
++int
++main ()
++{
++
++  if (!__atomic_compare_exchange_n (&v, &expected, max, STRONG , __ATOMIC_RELAXED, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (__atomic_compare_exchange_n (&v, &expected, 0, STRONG , __ATOMIC_ACQUIRE, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != max)
++    abort ();
++
++  if (!__atomic_compare_exchange_n (&v, &expected, 0, STRONG , __ATOMIC_RELEASE, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != max)
++    abort ();
++  if (v != 0)
++    abort ();
++
++  if (__atomic_compare_exchange_n (&v, &expected, desired, WEAK, __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (!__atomic_compare_exchange_n (&v, &expected, desired, STRONG , __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST))
++    abort ();
++  if (expected != 0)
++    abort ();
++  if (v != max)
++    abort ();
++
++  /* Now test the generic version.  */
++
++  v = 0;
++
++  if (!__atomic_compare_exchange (&v, &expected, &max, STRONG, __ATOMIC_RELAXED, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (__atomic_compare_exchange (&v, &expected, &zero, STRONG , __ATOMIC_ACQUIRE, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != max)
++    abort ();
++
++  if (!__atomic_compare_exchange (&v, &expected, &zero, STRONG , __ATOMIC_RELEASE, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != max)
++    abort ();
++  if (v != 0)
++    abort ();
++
++  if (__atomic_compare_exchange (&v, &expected, &desired, WEAK, __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (!__atomic_compare_exchange (&v, &expected, &desired, STRONG , __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST))
++    abort ();
++  if (expected != 0)
++    abort ();
++  if (v != max)
++    abort ();
++
++  return 0;
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-7.c
+@@ -0,0 +1,69 @@
++/* Test __atomic routines for existence and proper execution on 1 byte
++   values with each valid memory model.  */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-exchange-1.c */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics" } */
++
++/* Test the execution of the __atomic_exchange_n builtin for a char.  */
++
++extern void abort(void);
++
++char v, count, ret;
++
++int
++main ()
++{
++  v = 0;
++  count = 0;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_RELAXED) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_ACQUIRE) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_RELEASE) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_ACQ_REL) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_SEQ_CST) != count)
++    abort ();
++  count++;
++
++  /* Now test the generic version.  */
++
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_RELAXED);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_ACQUIRE);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_RELEASE);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_ACQ_REL);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_SEQ_CST);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  return 0;
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-8.c
+@@ -0,0 +1,69 @@
++/* Test __atomic routines for existence and proper execution on 2 byte
++   values with each valid memory model.  */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-exchange-2.c */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics" } */
++
++/* Test the execution of the __atomic_X builtin for a short.  */
++
++extern void abort(void);
++
++short v, count, ret;
++
++int
++main ()
++{
++  v = 0;
++  count = 0;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_RELAXED) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_ACQUIRE) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_RELEASE) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_ACQ_REL) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_SEQ_CST) != count)
++    abort ();
++  count++;
++
++  /* Now test the generic version.  */
++
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_RELAXED);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_ACQUIRE);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_RELEASE);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_ACQ_REL);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_SEQ_CST);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  return 0;
++}
+--- a/libgcc/config/riscv/atomic.c
++++ b/libgcc/config/riscv/atomic.c
+@@ -30,6 +30,8 @@ see the files COPYING3 and COPYING.RUNTI
+ #define INVERT		"not %[tmp1], %[tmp1]\n\t"
+ #define DONT_INVERT	""
+ 
++/* Logic duplicated in gcc/gcc/config/riscv/sync.md for use when inlining is enabled */
++
+ #define GENERATE_FETCH_AND_OP(type, size, opname, insn, invert, cop)	\
+   type __sync_fetch_and_ ## opname ## _ ## size (type *p, type v)	\
+   {									\
diff --git a/toolchain/gcc/patches-11.x/701-riscv-linux-Don-t-add-latomic-with-pthread.patch b/toolchain/gcc/patches-11.x/701-riscv-linux-Don-t-add-latomic-with-pthread.patch
new file mode 100644
index 00000000000000..328c7be9ce8ec4
--- /dev/null
+++ b/toolchain/gcc/patches-11.x/701-riscv-linux-Don-t-add-latomic-with-pthread.patch
@@ -0,0 +1,36 @@
+From 203f3060dd363361b172f7295f42bb6bf5ac0b3b Mon Sep 17 00:00:00 2001
+From: Andreas Schwab <schwab@suse.de>
+Date: Sat, 23 Apr 2022 15:48:42 +0200
+Subject: [PATCH] riscv/linux: Don't add -latomic with -pthread
+
+Now that we have support for inline subword atomic operations, it is no
+longer necessary to link against libatomic.  This also fixes testsuite
+failures because the framework does not properly set up the linker flags
+for finding libatomic.
+The use of atomic operations is also independent of the use of libpthread.
+
+gcc/
+	* config/riscv/linux.h (LIB_SPEC): Don't redefine.
+---
+ gcc/config/riscv/linux.h | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+--- a/gcc/config/riscv/linux.h
++++ b/gcc/config/riscv/linux.h
+@@ -35,16 +35,6 @@ along with GCC; see the file COPYING3.
+ #undef MUSL_DYNAMIC_LINKER
+ #define MUSL_DYNAMIC_LINKER "/lib/ld-musl-riscv" XLEN_SPEC MUSL_ABI_SUFFIX ".so.1"
+ 
+-/* Because RISC-V only has word-sized atomics, it requries libatomic where
+-   others do not.  So link libatomic by default, as needed.  */
+-#undef LIB_SPEC
+-#ifdef LD_AS_NEEDED_OPTION
+-#define LIB_SPEC GNU_USER_TARGET_LIB_SPEC \
+-  " %{pthread:" LD_AS_NEEDED_OPTION " -latomic " LD_NO_AS_NEEDED_OPTION "}"
+-#else
+-#define LIB_SPEC GNU_USER_TARGET_LIB_SPEC " -latomic "
+-#endif
+-
+ #define ICACHE_FLUSH_FUNC "__riscv_flush_icache"
+ 
+ #define CPP_SPEC "%{pthread:-D_REENTRANT}"
diff --git a/toolchain/gcc/patches-11.x/910-mbsd_multi.patch b/toolchain/gcc/patches-11.x/910-mbsd_multi.patch
index 21f532043eb99e..2d1c3d1b80d5d7 100644
--- a/toolchain/gcc/patches-11.x/910-mbsd_multi.patch
+++ b/toolchain/gcc/patches-11.x/910-mbsd_multi.patch
@@ -114,7 +114,7 @@ Date:   Tue Jul 31 00:52:27 2007 +0000
  ; On SVR4 targets, it also controls whether or not to emit a
 --- a/gcc/doc/invoke.texi
 +++ b/gcc/doc/invoke.texi
-@@ -9058,6 +9058,17 @@ This option is only supported for C and
+@@ -9059,6 +9059,17 @@ This option is only supported for C and
  @option{-Wall} and by @option{-Wpedantic}, which can be disabled with
  @option{-Wno-pointer-sign}.
  
diff --git a/toolchain/gcc/patches-12.x/230-musl_libssp.patch b/toolchain/gcc/patches-12.x/230-musl_libssp.patch
index 3ce5e49587f2ce..a909d638750d4e 100644
--- a/toolchain/gcc/patches-12.x/230-musl_libssp.patch
+++ b/toolchain/gcc/patches-12.x/230-musl_libssp.patch
@@ -1,6 +1,6 @@
 --- a/gcc/gcc.cc
 +++ b/gcc/gcc.cc
-@@ -985,7 +985,9 @@ proper position among the other output f
+@@ -987,7 +987,9 @@ proper position among the other output f
  #endif
  
  #ifndef LINK_SSP_SPEC
diff --git a/toolchain/gcc/patches-12.x/700-RISCV-Inline-subword-atomic-ops.patch b/toolchain/gcc/patches-12.x/700-RISCV-Inline-subword-atomic-ops.patch
new file mode 100644
index 00000000000000..b164c76522265a
--- /dev/null
+++ b/toolchain/gcc/patches-12.x/700-RISCV-Inline-subword-atomic-ops.patch
@@ -0,0 +1,2021 @@
+From f797260adaf52bee0ec0e16190bbefbe1bfc3692 Mon Sep 17 00:00:00 2001
+From: Patrick O'Neill <patrick@rivosinc.com>
+Date: Tue, 18 Apr 2023 14:33:13 -0700
+Subject: [PATCH] RISCV: Inline subword atomic ops
+
+RISC-V has no support for subword atomic operations; code currently
+generates libatomic library calls.
+
+This patch changes the default behavior to inline subword atomic calls
+(using the same logic as the existing library call).
+Behavior can be specified using the -minline-atomics and
+-mno-inline-atomics command line flags.
+
+gcc/libgcc/config/riscv/atomic.c has the same logic implemented in asm.
+This will need to stay for backwards compatibility and the
+-mno-inline-atomics flag.
+
+2023-04-18 Patrick O'Neill <patrick@rivosinc.com>
+
+gcc/ChangeLog:
+	PR target/104338
+	* config/riscv/riscv-protos.h: Add helper function stubs.
+	* config/riscv/riscv.cc: Add helper functions for subword masking.
+	* config/riscv/riscv.opt: Add command-line flag.
+	* config/riscv/sync.md: Add masking logic and inline asm for fetch_and_op,
+	fetch_and_nand, CAS, and exchange ops.
+	* doc/invoke.texi: Add blurb regarding command-line flag.
+
+libgcc/ChangeLog:
+	PR target/104338
+	* config/riscv/atomic.c: Add reference to duplicate logic.
+
+gcc/testsuite/ChangeLog:
+	PR target/104338
+	* gcc.target/riscv/inline-atomics-1.c: New test.
+	* gcc.target/riscv/inline-atomics-2.c: New test.
+	* gcc.target/riscv/inline-atomics-3.c: New test.
+	* gcc.target/riscv/inline-atomics-4.c: New test.
+	* gcc.target/riscv/inline-atomics-5.c: New test.
+	* gcc.target/riscv/inline-atomics-6.c: New test.
+	* gcc.target/riscv/inline-atomics-7.c: New test.
+	* gcc.target/riscv/inline-atomics-8.c: New test.
+
+Signed-off-by: Patrick O'Neill <patrick@rivosinc.com>
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+---
+ gcc/config/riscv/riscv-protos.h               |   2 +
+ gcc/config/riscv/riscv.cc                     |  49 ++
+ gcc/config/riscv/riscv.opt                    |   4 +
+ gcc/config/riscv/sync.md                      | 301 +++++++++
+ gcc/doc/invoke.texi                           |  10 +-
+ .../gcc.target/riscv/inline-atomics-1.c       |  18 +
+ .../gcc.target/riscv/inline-atomics-2.c       |   9 +
+ .../gcc.target/riscv/inline-atomics-3.c       | 569 ++++++++++++++++++
+ .../gcc.target/riscv/inline-atomics-4.c       | 566 +++++++++++++++++
+ .../gcc.target/riscv/inline-atomics-5.c       |  87 +++
+ .../gcc.target/riscv/inline-atomics-6.c       |  87 +++
+ .../gcc.target/riscv/inline-atomics-7.c       |  69 +++
+ .../gcc.target/riscv/inline-atomics-8.c       |  69 +++
+ libgcc/config/riscv/atomic.c                  |   2 +
+ 14 files changed, 1841 insertions(+), 1 deletion(-)
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-1.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-2.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-3.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-4.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-5.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-6.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-7.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-8.c
+
+--- a/gcc/config/riscv/riscv-protos.h
++++ b/gcc/config/riscv/riscv-protos.h
+@@ -74,6 +74,8 @@ extern bool riscv_expand_block_move (rtx
+ extern bool riscv_store_data_bypass_p (rtx_insn *, rtx_insn *);
+ extern rtx riscv_gen_gpr_save_insn (struct riscv_frame_info *);
+ extern bool riscv_gpr_save_operation_p (rtx);
++extern void riscv_subword_address (rtx, rtx *, rtx *, rtx *, rtx *);
++extern void riscv_lshift_subword (machine_mode, rtx, rtx, rtx *);
+ 
+ /* Routines implemented in riscv-c.cc.  */
+ void riscv_cpu_cpp_builtins (cpp_reader *);
+--- a/gcc/config/riscv/riscv.cc
++++ b/gcc/config/riscv/riscv.cc
+@@ -5605,6 +5605,55 @@ riscv_asan_shadow_offset (void)
+   return TARGET_64BIT ? (HOST_WIDE_INT_1 << 29) : 0;
+ }
+ 
++/* Given memory reference MEM, expand code to compute the aligned
++   memory address, shift and mask values and store them into
++   *ALIGNED_MEM, *SHIFT, *MASK and *NOT_MASK.  */
++
++void
++riscv_subword_address (rtx mem, rtx *aligned_mem, rtx *shift, rtx *mask,
++		       rtx *not_mask)
++{
++  /* Align the memory address to a word.  */
++  rtx addr = force_reg (Pmode, XEXP (mem, 0));
++
++  rtx addr_mask = gen_int_mode (-4, Pmode);
++
++  rtx aligned_addr = gen_reg_rtx (Pmode);
++  emit_move_insn (aligned_addr,  gen_rtx_AND (Pmode, addr, addr_mask));
++
++  *aligned_mem = change_address (mem, SImode, aligned_addr);
++
++  /* Calculate the shift amount.  */
++  emit_move_insn (*shift, gen_rtx_AND (SImode, gen_lowpart (SImode, addr),
++				       gen_int_mode (3, SImode)));
++  emit_move_insn (*shift, gen_rtx_ASHIFT (SImode, *shift,
++					  gen_int_mode (3, SImode)));
++
++  /* Calculate the mask.  */
++  int unshifted_mask = GET_MODE_MASK (GET_MODE (mem));
++
++  emit_move_insn (*mask, gen_int_mode (unshifted_mask, SImode));
++
++  emit_move_insn (*mask, gen_rtx_ASHIFT (SImode, *mask,
++					 gen_lowpart (QImode, *shift)));
++
++  emit_move_insn (*not_mask, gen_rtx_NOT(SImode, *mask));
++}
++
++/* Leftshift a subword within an SImode register.  */
++
++void
++riscv_lshift_subword (machine_mode mode, rtx value, rtx shift,
++		      rtx *shifted_value)
++{
++  rtx value_reg = gen_reg_rtx (SImode);
++  emit_move_insn (value_reg, simplify_gen_subreg (SImode, value,
++						  mode, 0));
++
++  emit_move_insn(*shifted_value, gen_rtx_ASHIFT (SImode, value_reg,
++						 gen_lowpart (QImode, shift)));
++}
++
+ /* Initialize the GCC target structure.  */
+ #undef TARGET_ASM_ALIGNED_HI_OP
+ #define TARGET_ASM_ALIGNED_HI_OP "\t.half\t"
+--- a/gcc/config/riscv/riscv.opt
++++ b/gcc/config/riscv/riscv.opt
+@@ -209,6 +209,10 @@ int riscv_vector_elen_flags
+ TargetVariable
+ int riscv_zvl_flags
+ 
++minline-atomics
++Target Var(TARGET_INLINE_SUBWORD_ATOMIC) Init(1)
++Always inline subword atomic operations.
++
+ Enum
+ Name(isa_spec_class) Type(enum riscv_isa_spec_class)
+ Supported ISA specs (for use with the -misa-spec= option):
+--- a/gcc/config/riscv/sync.md
++++ b/gcc/config/riscv/sync.md
+@@ -21,8 +21,11 @@
+ 
+ (define_c_enum "unspec" [
+   UNSPEC_COMPARE_AND_SWAP
++  UNSPEC_COMPARE_AND_SWAP_SUBWORD
+   UNSPEC_SYNC_OLD_OP
++  UNSPEC_SYNC_OLD_OP_SUBWORD
+   UNSPEC_SYNC_EXCHANGE
++  UNSPEC_SYNC_EXCHANGE_SUBWORD
+   UNSPEC_ATOMIC_STORE
+   UNSPEC_MEMORY_BARRIER
+ ])
+@@ -92,6 +95,135 @@
+   "%F3amo<insn>.<amo>%A3 %0,%z2,%1"
+   [(set (attr "length") (const_int 8))])
+ 
++(define_insn "subword_atomic_fetch_strong_<atomic_optab>"
++  [(set (match_operand:SI 0 "register_operand" "=&r")		   ;; old value at mem
++	(match_operand:SI 1 "memory_operand" "+A"))		   ;; mem location
++   (set (match_dup 1)
++	(unspec_volatile:SI
++	  [(any_atomic:SI (match_dup 1)
++		     (match_operand:SI 2 "register_operand" "rI")) ;; value for op
++	   (match_operand:SI 3 "register_operand" "rI")]	   ;; mask
++	 UNSPEC_SYNC_OLD_OP_SUBWORD))
++    (match_operand:SI 4 "register_operand" "rI")		   ;; not_mask
++    (clobber (match_scratch:SI 5 "=&r"))			   ;; tmp_1
++    (clobber (match_scratch:SI 6 "=&r"))]			   ;; tmp_2
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++  {
++    return "1:\;"
++	   "lr.w.aq\t%0, %1\;"
++	   "<insn>\t%5, %0, %2\;"
++	   "and\t%5, %5, %3\;"
++	   "and\t%6, %0, %4\;"
++	   "or\t%6, %6, %5\;"
++	   "sc.w.rl\t%5, %6, %1\;"
++	   "bnez\t%5, 1b";
++  }
++  [(set (attr "length") (const_int 28))])
++
++(define_expand "atomic_fetch_nand<mode>"
++  [(match_operand:SHORT 0 "register_operand")			      ;; old value at mem
++   (not:SHORT (and:SHORT (match_operand:SHORT 1 "memory_operand")     ;; mem location
++			 (match_operand:SHORT 2 "reg_or_0_operand"))) ;; value for op
++   (match_operand:SI 3 "const_int_operand")]			      ;; model
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++{
++  /* We have no QImode/HImode atomics, so form a mask, then use
++     subword_atomic_fetch_strong_nand to implement a LR/SC version of the
++     operation. */
++
++  /* Logic duplicated in gcc/libgcc/config/riscv/atomic.c for use when inlining
++     is disabled */
++
++  rtx old = gen_reg_rtx (SImode);
++  rtx mem = operands[1];
++  rtx value = operands[2];
++  rtx aligned_mem = gen_reg_rtx (SImode);
++  rtx shift = gen_reg_rtx (SImode);
++  rtx mask = gen_reg_rtx (SImode);
++  rtx not_mask = gen_reg_rtx (SImode);
++
++  riscv_subword_address (mem, &aligned_mem, &shift, &mask, &not_mask);
++
++  rtx shifted_value = gen_reg_rtx (SImode);
++  riscv_lshift_subword (<MODE>mode, value, shift, &shifted_value);
++
++  emit_insn (gen_subword_atomic_fetch_strong_nand (old, aligned_mem,
++						   shifted_value,
++						   mask, not_mask));
++
++  emit_move_insn (old, gen_rtx_ASHIFTRT (SImode, old,
++					 gen_lowpart (QImode, shift)));
++
++  emit_move_insn (operands[0], gen_lowpart (<MODE>mode, old));
++
++  DONE;
++})
++
++(define_insn "subword_atomic_fetch_strong_nand"
++  [(set (match_operand:SI 0 "register_operand" "=&r")			  ;; old value at mem
++	(match_operand:SI 1 "memory_operand" "+A"))			  ;; mem location
++   (set (match_dup 1)
++	(unspec_volatile:SI
++	  [(not:SI (and:SI (match_dup 1)
++			   (match_operand:SI 2 "register_operand" "rI"))) ;; value for op
++	   (match_operand:SI 3 "register_operand" "rI")]		  ;; mask
++	 UNSPEC_SYNC_OLD_OP_SUBWORD))
++    (match_operand:SI 4 "register_operand" "rI")			  ;; not_mask
++    (clobber (match_scratch:SI 5 "=&r"))				  ;; tmp_1
++    (clobber (match_scratch:SI 6 "=&r"))]				  ;; tmp_2
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++  {
++    return "1:\;"
++	   "lr.w.aq\t%0, %1\;"
++	   "and\t%5, %0, %2\;"
++	   "not\t%5, %5\;"
++	   "and\t%5, %5, %3\;"
++	   "and\t%6, %0, %4\;"
++	   "or\t%6, %6, %5\;"
++	   "sc.w.rl\t%5, %6, %1\;"
++	   "bnez\t%5, 1b";
++  }
++  [(set (attr "length") (const_int 32))])
++
++(define_expand "atomic_fetch_<atomic_optab><mode>"
++  [(match_operand:SHORT 0 "register_operand")			 ;; old value at mem
++   (any_atomic:SHORT (match_operand:SHORT 1 "memory_operand")	 ;; mem location
++		     (match_operand:SHORT 2 "reg_or_0_operand")) ;; value for op
++   (match_operand:SI 3 "const_int_operand")]			 ;; model
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++{
++  /* We have no QImode/HImode atomics, so form a mask, then use
++     subword_atomic_fetch_strong_<mode> to implement a LR/SC version of the
++     operation. */
++
++  /* Logic duplicated in gcc/libgcc/config/riscv/atomic.c for use when inlining
++     is disabled */
++
++  rtx old = gen_reg_rtx (SImode);
++  rtx mem = operands[1];
++  rtx value = operands[2];
++  rtx aligned_mem = gen_reg_rtx (SImode);
++  rtx shift = gen_reg_rtx (SImode);
++  rtx mask = gen_reg_rtx (SImode);
++  rtx not_mask = gen_reg_rtx (SImode);
++
++  riscv_subword_address (mem, &aligned_mem, &shift, &mask, &not_mask);
++
++  rtx shifted_value = gen_reg_rtx (SImode);
++  riscv_lshift_subword (<MODE>mode, value, shift, &shifted_value);
++
++  emit_insn (gen_subword_atomic_fetch_strong_<atomic_optab> (old, aligned_mem,
++							     shifted_value,
++							     mask, not_mask));
++
++  emit_move_insn (old, gen_rtx_ASHIFTRT (SImode, old,
++					 gen_lowpart (QImode, shift)));
++
++  emit_move_insn (operands[0], gen_lowpart (<MODE>mode, old));
++
++  DONE;
++})
++
+ (define_insn "atomic_exchange<mode>"
+   [(set (match_operand:GPR 0 "register_operand" "=&r")
+ 	(unspec_volatile:GPR
+@@ -104,6 +236,56 @@
+   "%F3amoswap.<amo>%A3 %0,%z2,%1"
+   [(set (attr "length") (const_int 8))])
+ 
++(define_expand "atomic_exchange<mode>"
++  [(match_operand:SHORT 0 "register_operand") ;; old value at mem
++   (match_operand:SHORT 1 "memory_operand")   ;; mem location
++   (match_operand:SHORT 2 "register_operand") ;; value
++   (match_operand:SI 3 "const_int_operand")]  ;; model
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++{
++  rtx old = gen_reg_rtx (SImode);
++  rtx mem = operands[1];
++  rtx value = operands[2];
++  rtx aligned_mem = gen_reg_rtx (SImode);
++  rtx shift = gen_reg_rtx (SImode);
++  rtx mask = gen_reg_rtx (SImode);
++  rtx not_mask = gen_reg_rtx (SImode);
++
++  riscv_subword_address (mem, &aligned_mem, &shift, &mask, &not_mask);
++
++  rtx shifted_value = gen_reg_rtx (SImode);
++  riscv_lshift_subword (<MODE>mode, value, shift, &shifted_value);
++
++  emit_insn (gen_subword_atomic_exchange_strong (old, aligned_mem,
++						 shifted_value, not_mask));
++
++  emit_move_insn (old, gen_rtx_ASHIFTRT (SImode, old,
++					 gen_lowpart (QImode, shift)));
++
++  emit_move_insn (operands[0], gen_lowpart (<MODE>mode, old));
++  DONE;
++})
++
++(define_insn "subword_atomic_exchange_strong"
++  [(set (match_operand:SI 0 "register_operand" "=&r")	 ;; old value at mem
++	(match_operand:SI 1 "memory_operand" "+A"))	 ;; mem location
++   (set (match_dup 1)
++	(unspec_volatile:SI
++	  [(match_operand:SI 2 "reg_or_0_operand" "rI")  ;; value
++	   (match_operand:SI 3 "reg_or_0_operand" "rI")] ;; not_mask
++      UNSPEC_SYNC_EXCHANGE_SUBWORD))
++    (clobber (match_scratch:SI 4 "=&r"))]		 ;; tmp_1
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++  {
++    return "1:\;"
++	   "lr.w.aq\t%0, %1\;"
++	   "and\t%4, %0, %3\;"
++	   "or\t%4, %4, %2\;"
++	   "sc.w.rl\t%4, %4, %1\;"
++	   "bnez\t%4, 1b";
++  }
++  [(set (attr "length") (const_int 20))])
++
+ (define_insn "atomic_cas_value_strong<mode>"
+   [(set (match_operand:GPR 0 "register_operand" "=&r")
+ 	(match_operand:GPR 1 "memory_operand" "+A"))
+@@ -152,6 +334,125 @@
+   DONE;
+ })
+ 
++(define_expand "atomic_compare_and_swap<mode>"
++  [(match_operand:SI 0 "register_operand")    ;; bool output
++   (match_operand:SHORT 1 "register_operand") ;; val output
++   (match_operand:SHORT 2 "memory_operand")   ;; memory
++   (match_operand:SHORT 3 "reg_or_0_operand") ;; expected value
++   (match_operand:SHORT 4 "reg_or_0_operand") ;; desired value
++   (match_operand:SI 5 "const_int_operand")   ;; is_weak
++   (match_operand:SI 6 "const_int_operand")   ;; mod_s
++   (match_operand:SI 7 "const_int_operand")]  ;; mod_f
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++{
++  emit_insn (gen_atomic_cas_value_strong<mode> (operands[1], operands[2],
++						operands[3], operands[4],
++						operands[6], operands[7]));
++
++  rtx val = gen_reg_rtx (SImode);
++  if (operands[1] != const0_rtx)
++    emit_move_insn (val, gen_rtx_SIGN_EXTEND (SImode, operands[1]));
++  else
++    emit_move_insn (val, const0_rtx);
++
++  rtx exp = gen_reg_rtx (SImode);
++  if (operands[3] != const0_rtx)
++    emit_move_insn (exp, gen_rtx_SIGN_EXTEND (SImode, operands[3]));
++  else
++    emit_move_insn (exp, const0_rtx);
++
++  rtx compare = val;
++  if (exp != const0_rtx)
++    {
++      rtx difference = gen_rtx_MINUS (SImode, val, exp);
++      compare = gen_reg_rtx (SImode);
++      emit_move_insn  (compare, difference);
++    }
++
++  if (word_mode != SImode)
++    {
++      rtx reg = gen_reg_rtx (word_mode);
++      emit_move_insn (reg, gen_rtx_SIGN_EXTEND (word_mode, compare));
++      compare = reg;
++    }
++
++  emit_move_insn (operands[0], gen_rtx_EQ (SImode, compare, const0_rtx));
++  DONE;
++})
++
++(define_expand "atomic_cas_value_strong<mode>"
++  [(match_operand:SHORT 0 "register_operand") ;; val output
++   (match_operand:SHORT 1 "memory_operand")   ;; memory
++   (match_operand:SHORT 2 "reg_or_0_operand") ;; expected value
++   (match_operand:SHORT 3 "reg_or_0_operand") ;; desired value
++   (match_operand:SI 4 "const_int_operand")   ;; mod_s
++   (match_operand:SI 5 "const_int_operand")   ;; mod_f
++   (match_scratch:SHORT 6)]
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++{
++  /* We have no QImode/HImode atomics, so form a mask, then use
++     subword_atomic_cas_strong<mode> to implement a LR/SC version of the
++     operation. */
++
++  /* Logic duplicated in gcc/libgcc/config/riscv/atomic.c for use when inlining
++     is disabled */
++
++  rtx old = gen_reg_rtx (SImode);
++  rtx mem = operands[1];
++  rtx aligned_mem = gen_reg_rtx (SImode);
++  rtx shift = gen_reg_rtx (SImode);
++  rtx mask = gen_reg_rtx (SImode);
++  rtx not_mask = gen_reg_rtx (SImode);
++
++  riscv_subword_address (mem, &aligned_mem, &shift, &mask, &not_mask);
++
++  rtx o = operands[2];
++  rtx n = operands[3];
++  rtx shifted_o = gen_reg_rtx (SImode);
++  rtx shifted_n = gen_reg_rtx (SImode);
++
++  riscv_lshift_subword (<MODE>mode, o, shift, &shifted_o);
++  riscv_lshift_subword (<MODE>mode, n, shift, &shifted_n);
++
++  emit_move_insn (shifted_o, gen_rtx_AND (SImode, shifted_o, mask));
++  emit_move_insn (shifted_n, gen_rtx_AND (SImode, shifted_n, mask));
++
++  emit_insn (gen_subword_atomic_cas_strong (old, aligned_mem,
++					    shifted_o, shifted_n,
++					    mask, not_mask));
++
++  emit_move_insn (old, gen_rtx_ASHIFTRT (SImode, old,
++					 gen_lowpart (QImode, shift)));
++
++  emit_move_insn (operands[0], gen_lowpart (<MODE>mode, old));
++
++  DONE;
++})
++
++(define_insn "subword_atomic_cas_strong"
++  [(set (match_operand:SI 0 "register_operand" "=&r")			   ;; old value at mem
++	(match_operand:SI 1 "memory_operand" "+A"))			   ;; mem location
++   (set (match_dup 1)
++	(unspec_volatile:SI [(match_operand:SI 2 "reg_or_0_operand" "rJ")  ;; expected value
++			     (match_operand:SI 3 "reg_or_0_operand" "rJ")] ;; desired value
++	 UNSPEC_COMPARE_AND_SWAP_SUBWORD))
++	(match_operand:SI 4 "register_operand" "rI")			   ;; mask
++	(match_operand:SI 5 "register_operand" "rI")			   ;; not_mask
++	(clobber (match_scratch:SI 6 "=&r"))]				   ;; tmp_1
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++  {
++    return "1:\;"
++	   "lr.w.aq\t%0, %1\;"
++	   "and\t%6, %0, %4\;"
++	   "bne\t%6, %z2, 1f\;"
++	   "and\t%6, %0, %5\;"
++	   "or\t%6, %6, %3\;"
++	   "sc.w.rl\t%6, %6, %1\;"
++	   "bnez\t%6, 1b\;"
++	   "1:";
++  }
++  [(set (attr "length") (const_int 28))])
++
+ (define_expand "atomic_test_and_set"
+   [(match_operand:QI 0 "register_operand" "")     ;; bool output
+    (match_operand:QI 1 "memory_operand" "+A")    ;; memory
+--- a/gcc/doc/invoke.texi
++++ b/gcc/doc/invoke.texi
+@@ -753,7 +753,8 @@ Objective-C and Objective-C++ Dialects}.
+ -moverride=@var{string}  -mverbose-cost-dump @gol
+ -mstack-protector-guard=@var{guard} -mstack-protector-guard-reg=@var{sysreg} @gol
+ -mstack-protector-guard-offset=@var{offset} -mtrack-speculation @gol
+--moutline-atomics }
++-moutline-atomics
++-minline-atomics  -mno-inline-atomics}
+ 
+ @emph{Adapteva Epiphany Options}
+ @gccoptlist{-mhalf-reg-file  -mprefer-short-insn-regs @gol
+@@ -28035,6 +28036,13 @@ Do or don't use smaller but slower prolo
+ library function calls.  The default is to use fast inline prologues and
+ epilogues.
+ 
++@opindex minline-atomics
++@item -minline-atomics
++@itemx -mno-inline-atomics
++Do or don't use smaller but slower subword atomic emulation code that uses
++libatomic function calls.  The default is to use fast inline subword atomics
++that do not require libatomic.
++
+ @item -mshorten-memrefs
+ @itemx -mno-shorten-memrefs
+ @opindex mshorten-memrefs
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-1.c
+@@ -0,0 +1,18 @@
++/* { dg-do compile } */
++/* { dg-options "-mno-inline-atomics" } */
++/* { dg-message "note: '__sync_fetch_and_nand' changed semantics in GCC 4.4" "fetch_and_nand" { target *-*-* } 0 } */
++/* { dg-final { scan-assembler "\tcall\t__sync_fetch_and_add_1" } } */
++/* { dg-final { scan-assembler "\tcall\t__sync_fetch_and_nand_1" } } */
++/* { dg-final { scan-assembler "\tcall\t__sync_bool_compare_and_swap_1" } } */
++
++char foo;
++char bar;
++char baz;
++
++int
++main ()
++{
++  __sync_fetch_and_add(&foo, 1);
++  __sync_fetch_and_nand(&bar, 1);
++  __sync_bool_compare_and_swap (&baz, 1, 2);
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-2.c
+@@ -0,0 +1,9 @@
++/* { dg-do compile } */
++/* Verify that subword atomics do not generate calls.  */
++/* { dg-options "-minline-atomics" } */
++/* { dg-message "note: '__sync_fetch_and_nand' changed semantics in GCC 4.4" "fetch_and_nand" { target *-*-* } 0 } */
++/* { dg-final { scan-assembler-not "\tcall\t__sync_fetch_and_add_1" } } */
++/* { dg-final { scan-assembler-not "\tcall\t__sync_fetch_and_nand_1" } } */
++/* { dg-final { scan-assembler-not "\tcall\t__sync_bool_compare_and_swap_1" } } */
++
++#include "inline-atomics-1.c"
+\ No newline at end of file
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-3.c
+@@ -0,0 +1,569 @@
++/* Check all char alignments.  */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-op-1.c */
++/* Test __atomic routines for existence and proper execution on 1 byte
++   values with each valid memory model.  */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics -Wno-address-of-packed-member" } */
++
++/* Test the execution of the __atomic_*OP builtin routines for a char.  */
++
++extern void abort(void);
++
++char count, res;
++const char init = ~0;
++
++struct A
++{
++   char a;
++   char b;
++   char c;
++   char d;
++} __attribute__ ((packed)) A;
++
++/* The fetch_op routines return the original value before the operation.  */
++
++void
++test_fetch_add (char* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_fetch_add (v, count, __ATOMIC_RELAXED) != 0)
++    abort ();
++
++  if (__atomic_fetch_add (v, 1, __ATOMIC_CONSUME) != 1)
++    abort ();
++
++  if (__atomic_fetch_add (v, count, __ATOMIC_ACQUIRE) != 2)
++    abort ();
++
++  if (__atomic_fetch_add (v, 1, __ATOMIC_RELEASE) != 3)
++    abort ();
++
++  if (__atomic_fetch_add (v, count, __ATOMIC_ACQ_REL) != 4)
++    abort ();
++
++  if (__atomic_fetch_add (v, 1, __ATOMIC_SEQ_CST) != 5)
++    abort ();
++}
++
++
++void
++test_fetch_sub (char* v)
++{
++  *v = res = 20;
++  count = 0;
++
++  if (__atomic_fetch_sub (v, count + 1, __ATOMIC_RELAXED) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, 1, __ATOMIC_CONSUME) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, count + 1, __ATOMIC_ACQUIRE) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, 1, __ATOMIC_RELEASE) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, count + 1, __ATOMIC_ACQ_REL) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, 1, __ATOMIC_SEQ_CST) !=  res--)
++    abort ();
++}
++
++void
++test_fetch_and (char* v)
++{
++  *v = init;
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_fetch_and (v, init, __ATOMIC_CONSUME) !=  0)
++    abort ();
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  *v = ~*v;
++  if (__atomic_fetch_and (v, init, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_SEQ_CST) !=  0)
++    abort ();
++}
++
++void
++test_fetch_nand (char* v)
++{
++  *v = init;
++
++  if (__atomic_fetch_nand (v, 0, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_fetch_nand (v, init, __ATOMIC_CONSUME) !=  init)
++    abort ();
++
++  if (__atomic_fetch_nand (v, 0, __ATOMIC_ACQUIRE) !=  0 )
++    abort ();
++
++  if (__atomic_fetch_nand (v, init, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_fetch_nand (v, init, __ATOMIC_ACQ_REL) !=  0)
++    abort ();
++
++  if (__atomic_fetch_nand (v, 0, __ATOMIC_SEQ_CST) !=  init)
++    abort ();
++}
++
++void
++test_fetch_xor (char* v)
++{
++  *v = init;
++  count = 0;
++
++  if (__atomic_fetch_xor (v, count, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_fetch_xor (v, ~count, __ATOMIC_CONSUME) !=  init)
++    abort ();
++
++  if (__atomic_fetch_xor (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  if (__atomic_fetch_xor (v, ~count, __ATOMIC_RELEASE) !=  0)
++    abort ();
++
++  if (__atomic_fetch_xor (v, 0, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_fetch_xor (v, ~count, __ATOMIC_SEQ_CST) !=  init)
++    abort ();
++}
++
++void
++test_fetch_or (char* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_fetch_or (v, count, __ATOMIC_RELAXED) !=  0)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, 2, __ATOMIC_CONSUME) !=  1)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, count, __ATOMIC_ACQUIRE) !=  3)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, 8, __ATOMIC_RELEASE) !=  7)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, count, __ATOMIC_ACQ_REL) !=  15)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, count, __ATOMIC_SEQ_CST) !=  31)
++    abort ();
++}
++
++/* The OP_fetch routines return the new value after the operation.  */
++
++void
++test_add_fetch (char* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_RELAXED) != 1)
++    abort ();
++
++  if (__atomic_add_fetch (v, 1, __ATOMIC_CONSUME) != 2)
++    abort ();
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_ACQUIRE) != 3)
++    abort ();
++
++  if (__atomic_add_fetch (v, 1, __ATOMIC_RELEASE) != 4)
++    abort ();
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_ACQ_REL) != 5)
++    abort ();
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_SEQ_CST) != 6)
++    abort ();
++}
++
++
++void
++test_sub_fetch (char* v)
++{
++  *v = res = 20;
++  count = 0;
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_RELAXED) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, 1, __ATOMIC_CONSUME) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_ACQUIRE) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, 1, __ATOMIC_RELEASE) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_ACQ_REL) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_SEQ_CST) !=  --res)
++    abort ();
++}
++
++void
++test_and_fetch (char* v)
++{
++  *v = init;
++
++  if (__atomic_and_fetch (v, 0, __ATOMIC_RELAXED) !=  0)
++    abort ();
++
++  *v = init;
++  if (__atomic_and_fetch (v, init, __ATOMIC_CONSUME) !=  init)
++    abort ();
++
++  if (__atomic_and_fetch (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  *v = ~*v;
++  if (__atomic_and_fetch (v, init, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_and_fetch (v, 0, __ATOMIC_ACQ_REL) !=  0)
++    abort ();
++
++  *v = ~*v;
++  if (__atomic_and_fetch (v, 0, __ATOMIC_SEQ_CST) !=  0)
++    abort ();
++}
++
++void
++test_nand_fetch (char* v)
++{
++  *v = init;
++
++  if (__atomic_nand_fetch (v, 0, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_nand_fetch (v, init, __ATOMIC_CONSUME) !=  0)
++    abort ();
++
++  if (__atomic_nand_fetch (v, 0, __ATOMIC_ACQUIRE) !=  init)
++    abort ();
++
++  if (__atomic_nand_fetch (v, init, __ATOMIC_RELEASE) !=  0)
++    abort ();
++
++  if (__atomic_nand_fetch (v, init, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_nand_fetch (v, 0, __ATOMIC_SEQ_CST) !=  init)
++    abort ();
++}
++
++
++
++void
++test_xor_fetch (char* v)
++{
++  *v = init;
++  count = 0;
++
++  if (__atomic_xor_fetch (v, count, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_xor_fetch (v, ~count, __ATOMIC_CONSUME) !=  0)
++    abort ();
++
++  if (__atomic_xor_fetch (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  if (__atomic_xor_fetch (v, ~count, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_xor_fetch (v, 0, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_xor_fetch (v, ~count, __ATOMIC_SEQ_CST) !=  0)
++    abort ();
++}
++
++void
++test_or_fetch (char* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_or_fetch (v, count, __ATOMIC_RELAXED) !=  1)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, 2, __ATOMIC_CONSUME) !=  3)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, count, __ATOMIC_ACQUIRE) !=  7)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, 8, __ATOMIC_RELEASE) !=  15)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, count, __ATOMIC_ACQ_REL) !=  31)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, count, __ATOMIC_SEQ_CST) !=  63)
++    abort ();
++}
++
++
++/* Test the OP routines with a result which isn't used. Use both variations
++   within each function.  */
++
++void
++test_add (char* v)
++{
++  *v = 0;
++  count = 1;
++
++  __atomic_add_fetch (v, count, __ATOMIC_RELAXED);
++  if (*v != 1)
++    abort ();
++
++  __atomic_fetch_add (v, count, __ATOMIC_CONSUME);
++  if (*v != 2)
++    abort ();
++
++  __atomic_add_fetch (v, 1 , __ATOMIC_ACQUIRE);
++  if (*v != 3)
++    abort ();
++
++  __atomic_fetch_add (v, 1, __ATOMIC_RELEASE);
++  if (*v != 4)
++    abort ();
++
++  __atomic_add_fetch (v, count, __ATOMIC_ACQ_REL);
++  if (*v != 5)
++    abort ();
++
++  __atomic_fetch_add (v, count, __ATOMIC_SEQ_CST);
++  if (*v != 6)
++    abort ();
++}
++
++
++void
++test_sub (char* v)
++{
++  *v = res = 20;
++  count = 0;
++
++  __atomic_sub_fetch (v, count + 1, __ATOMIC_RELAXED);
++  if (*v != --res)
++    abort ();
++
++  __atomic_fetch_sub (v, count + 1, __ATOMIC_CONSUME);
++  if (*v != --res)
++    abort ();
++
++  __atomic_sub_fetch (v, 1, __ATOMIC_ACQUIRE);
++  if (*v != --res)
++    abort ();
++
++  __atomic_fetch_sub (v, 1, __ATOMIC_RELEASE);
++  if (*v != --res)
++    abort ();
++
++  __atomic_sub_fetch (v, count + 1, __ATOMIC_ACQ_REL);
++  if (*v != --res)
++    abort ();
++
++  __atomic_fetch_sub (v, count + 1, __ATOMIC_SEQ_CST);
++  if (*v != --res)
++    abort ();
++}
++
++void
++test_and (char* v)
++{
++  *v = init;
++
++  __atomic_and_fetch (v, 0, __ATOMIC_RELAXED);
++  if (*v != 0)
++    abort ();
++
++  *v = init;
++  __atomic_fetch_and (v, init, __ATOMIC_CONSUME);
++  if (*v != init)
++    abort ();
++
++  __atomic_and_fetch (v, 0, __ATOMIC_ACQUIRE);
++  if (*v != 0)
++    abort ();
++
++  *v = ~*v;
++  __atomic_fetch_and (v, init, __ATOMIC_RELEASE);
++  if (*v != init)
++    abort ();
++
++  __atomic_and_fetch (v, 0, __ATOMIC_ACQ_REL);
++  if (*v != 0)
++    abort ();
++
++  *v = ~*v;
++  __atomic_fetch_and (v, 0, __ATOMIC_SEQ_CST);
++  if (*v != 0)
++    abort ();
++}
++
++void
++test_nand (char* v)
++{
++  *v = init;
++
++  __atomic_fetch_nand (v, 0, __ATOMIC_RELAXED);
++  if (*v != init)
++    abort ();
++
++  __atomic_fetch_nand (v, init, __ATOMIC_CONSUME);
++  if (*v != 0)
++    abort ();
++
++  __atomic_nand_fetch (v, 0, __ATOMIC_ACQUIRE);
++  if (*v != init)
++    abort ();
++
++  __atomic_nand_fetch (v, init, __ATOMIC_RELEASE);
++  if (*v != 0)
++    abort ();
++
++  __atomic_fetch_nand (v, init, __ATOMIC_ACQ_REL);
++  if (*v != init)
++    abort ();
++
++  __atomic_nand_fetch (v, 0, __ATOMIC_SEQ_CST);
++  if (*v != init)
++    abort ();
++}
++
++
++
++void
++test_xor (char* v)
++{
++  *v = init;
++  count = 0;
++
++  __atomic_xor_fetch (v, count, __ATOMIC_RELAXED);
++  if (*v != init)
++    abort ();
++
++  __atomic_fetch_xor (v, ~count, __ATOMIC_CONSUME);
++  if (*v != 0)
++    abort ();
++
++  __atomic_xor_fetch (v, 0, __ATOMIC_ACQUIRE);
++  if (*v != 0)
++    abort ();
++
++  __atomic_fetch_xor (v, ~count, __ATOMIC_RELEASE);
++  if (*v != init)
++    abort ();
++
++  __atomic_fetch_xor (v, 0, __ATOMIC_ACQ_REL);
++  if (*v != init)
++    abort ();
++
++  __atomic_xor_fetch (v, ~count, __ATOMIC_SEQ_CST);
++  if (*v != 0)
++    abort ();
++}
++
++void
++test_or (char* v)
++{
++  *v = 0;
++  count = 1;
++
++  __atomic_or_fetch (v, count, __ATOMIC_RELAXED);
++  if (*v != 1)
++    abort ();
++
++  count *= 2;
++  __atomic_fetch_or (v, count, __ATOMIC_CONSUME);
++  if (*v != 3)
++    abort ();
++
++  count *= 2;
++  __atomic_or_fetch (v, 4, __ATOMIC_ACQUIRE);
++  if (*v != 7)
++    abort ();
++
++  count *= 2;
++  __atomic_fetch_or (v, 8, __ATOMIC_RELEASE);
++  if (*v != 15)
++    abort ();
++
++  count *= 2;
++  __atomic_or_fetch (v, count, __ATOMIC_ACQ_REL);
++  if (*v != 31)
++    abort ();
++
++  count *= 2;
++  __atomic_fetch_or (v, count, __ATOMIC_SEQ_CST);
++  if (*v != 63)
++    abort ();
++}
++
++int
++main ()
++{
++  char* V[] = {&A.a, &A.b, &A.c, &A.d};
++
++  for (int i = 0; i < 4; i++) {
++    test_fetch_add (V[i]);
++    test_fetch_sub (V[i]);
++    test_fetch_and (V[i]);
++    test_fetch_nand (V[i]);
++    test_fetch_xor (V[i]);
++    test_fetch_or (V[i]);
++
++    test_add_fetch (V[i]);
++    test_sub_fetch (V[i]);
++    test_and_fetch (V[i]);
++    test_nand_fetch (V[i]);
++    test_xor_fetch (V[i]);
++    test_or_fetch (V[i]);
++
++    test_add (V[i]);
++    test_sub (V[i]);
++    test_and (V[i]);
++    test_nand (V[i]);
++    test_xor (V[i]);
++    test_or (V[i]);
++  }
++
++  return 0;
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-4.c
+@@ -0,0 +1,566 @@
++/* Check all short alignments.  */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-op-2.c */
++/* Test __atomic routines for existence and proper execution on 2 byte
++   values with each valid memory model.  */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics -Wno-address-of-packed-member" } */
++
++/* Test the execution of the __atomic_*OP builtin routines for a short.  */
++
++extern void abort(void);
++
++short count, res;
++const short init = ~0;
++
++struct A
++{
++   short a;
++   short b;
++} __attribute__ ((packed)) A;
++
++/* The fetch_op routines return the original value before the operation.  */
++
++void
++test_fetch_add (short* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_fetch_add (v, count, __ATOMIC_RELAXED) != 0)
++    abort ();
++
++  if (__atomic_fetch_add (v, 1, __ATOMIC_CONSUME) != 1)
++    abort ();
++
++  if (__atomic_fetch_add (v, count, __ATOMIC_ACQUIRE) != 2)
++    abort ();
++
++  if (__atomic_fetch_add (v, 1, __ATOMIC_RELEASE) != 3)
++    abort ();
++
++  if (__atomic_fetch_add (v, count, __ATOMIC_ACQ_REL) != 4)
++    abort ();
++
++  if (__atomic_fetch_add (v, 1, __ATOMIC_SEQ_CST) != 5)
++    abort ();
++}
++
++
++void
++test_fetch_sub (short* v)
++{
++  *v = res = 20;
++  count = 0;
++
++  if (__atomic_fetch_sub (v, count + 1, __ATOMIC_RELAXED) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, 1, __ATOMIC_CONSUME) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, count + 1, __ATOMIC_ACQUIRE) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, 1, __ATOMIC_RELEASE) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, count + 1, __ATOMIC_ACQ_REL) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, 1, __ATOMIC_SEQ_CST) !=  res--)
++    abort ();
++}
++
++void
++test_fetch_and (short* v)
++{
++  *v = init;
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_fetch_and (v, init, __ATOMIC_CONSUME) !=  0)
++    abort ();
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  *v = ~*v;
++  if (__atomic_fetch_and (v, init, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_SEQ_CST) !=  0)
++    abort ();
++}
++
++void
++test_fetch_nand (short* v)
++{
++  *v = init;
++
++  if (__atomic_fetch_nand (v, 0, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_fetch_nand (v, init, __ATOMIC_CONSUME) !=  init)
++    abort ();
++
++  if (__atomic_fetch_nand (v, 0, __ATOMIC_ACQUIRE) !=  0 )
++    abort ();
++
++  if (__atomic_fetch_nand (v, init, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_fetch_nand (v, init, __ATOMIC_ACQ_REL) !=  0)
++    abort ();
++
++  if (__atomic_fetch_nand (v, 0, __ATOMIC_SEQ_CST) !=  init)
++    abort ();
++}
++
++void
++test_fetch_xor (short* v)
++{
++  *v = init;
++  count = 0;
++
++  if (__atomic_fetch_xor (v, count, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_fetch_xor (v, ~count, __ATOMIC_CONSUME) !=  init)
++    abort ();
++
++  if (__atomic_fetch_xor (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  if (__atomic_fetch_xor (v, ~count, __ATOMIC_RELEASE) !=  0)
++    abort ();
++
++  if (__atomic_fetch_xor (v, 0, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_fetch_xor (v, ~count, __ATOMIC_SEQ_CST) !=  init)
++    abort ();
++}
++
++void
++test_fetch_or (short* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_fetch_or (v, count, __ATOMIC_RELAXED) !=  0)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, 2, __ATOMIC_CONSUME) !=  1)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, count, __ATOMIC_ACQUIRE) !=  3)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, 8, __ATOMIC_RELEASE) !=  7)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, count, __ATOMIC_ACQ_REL) !=  15)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, count, __ATOMIC_SEQ_CST) !=  31)
++    abort ();
++}
++
++/* The OP_fetch routines return the new value after the operation.  */
++
++void
++test_add_fetch (short* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_RELAXED) != 1)
++    abort ();
++
++  if (__atomic_add_fetch (v, 1, __ATOMIC_CONSUME) != 2)
++    abort ();
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_ACQUIRE) != 3)
++    abort ();
++
++  if (__atomic_add_fetch (v, 1, __ATOMIC_RELEASE) != 4)
++    abort ();
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_ACQ_REL) != 5)
++    abort ();
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_SEQ_CST) != 6)
++    abort ();
++}
++
++
++void
++test_sub_fetch (short* v)
++{
++  *v = res = 20;
++  count = 0;
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_RELAXED) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, 1, __ATOMIC_CONSUME) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_ACQUIRE) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, 1, __ATOMIC_RELEASE) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_ACQ_REL) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_SEQ_CST) !=  --res)
++    abort ();
++}
++
++void
++test_and_fetch (short* v)
++{
++  *v = init;
++
++  if (__atomic_and_fetch (v, 0, __ATOMIC_RELAXED) !=  0)
++    abort ();
++
++  *v = init;
++  if (__atomic_and_fetch (v, init, __ATOMIC_CONSUME) !=  init)
++    abort ();
++
++  if (__atomic_and_fetch (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  *v = ~*v;
++  if (__atomic_and_fetch (v, init, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_and_fetch (v, 0, __ATOMIC_ACQ_REL) !=  0)
++    abort ();
++
++  *v = ~*v;
++  if (__atomic_and_fetch (v, 0, __ATOMIC_SEQ_CST) !=  0)
++    abort ();
++}
++
++void
++test_nand_fetch (short* v)
++{
++  *v = init;
++
++  if (__atomic_nand_fetch (v, 0, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_nand_fetch (v, init, __ATOMIC_CONSUME) !=  0)
++    abort ();
++
++  if (__atomic_nand_fetch (v, 0, __ATOMIC_ACQUIRE) !=  init)
++    abort ();
++
++  if (__atomic_nand_fetch (v, init, __ATOMIC_RELEASE) !=  0)
++    abort ();
++
++  if (__atomic_nand_fetch (v, init, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_nand_fetch (v, 0, __ATOMIC_SEQ_CST) !=  init)
++    abort ();
++}
++
++
++
++void
++test_xor_fetch (short* v)
++{
++  *v = init;
++  count = 0;
++
++  if (__atomic_xor_fetch (v, count, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_xor_fetch (v, ~count, __ATOMIC_CONSUME) !=  0)
++    abort ();
++
++  if (__atomic_xor_fetch (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  if (__atomic_xor_fetch (v, ~count, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_xor_fetch (v, 0, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_xor_fetch (v, ~count, __ATOMIC_SEQ_CST) !=  0)
++    abort ();
++}
++
++void
++test_or_fetch (short* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_or_fetch (v, count, __ATOMIC_RELAXED) !=  1)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, 2, __ATOMIC_CONSUME) !=  3)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, count, __ATOMIC_ACQUIRE) !=  7)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, 8, __ATOMIC_RELEASE) !=  15)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, count, __ATOMIC_ACQ_REL) !=  31)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, count, __ATOMIC_SEQ_CST) !=  63)
++    abort ();
++}
++
++
++/* Test the OP routines with a result which isn't used. Use both variations
++   within each function.  */
++
++void
++test_add (short* v)
++{
++  *v = 0;
++  count = 1;
++
++  __atomic_add_fetch (v, count, __ATOMIC_RELAXED);
++  if (*v != 1)
++    abort ();
++
++  __atomic_fetch_add (v, count, __ATOMIC_CONSUME);
++  if (*v != 2)
++    abort ();
++
++  __atomic_add_fetch (v, 1 , __ATOMIC_ACQUIRE);
++  if (*v != 3)
++    abort ();
++
++  __atomic_fetch_add (v, 1, __ATOMIC_RELEASE);
++  if (*v != 4)
++    abort ();
++
++  __atomic_add_fetch (v, count, __ATOMIC_ACQ_REL);
++  if (*v != 5)
++    abort ();
++
++  __atomic_fetch_add (v, count, __ATOMIC_SEQ_CST);
++  if (*v != 6)
++    abort ();
++}
++
++
++void
++test_sub (short* v)
++{
++  *v = res = 20;
++  count = 0;
++
++  __atomic_sub_fetch (v, count + 1, __ATOMIC_RELAXED);
++  if (*v != --res)
++    abort ();
++
++  __atomic_fetch_sub (v, count + 1, __ATOMIC_CONSUME);
++  if (*v != --res)
++    abort ();
++
++  __atomic_sub_fetch (v, 1, __ATOMIC_ACQUIRE);
++  if (*v != --res)
++    abort ();
++
++  __atomic_fetch_sub (v, 1, __ATOMIC_RELEASE);
++  if (*v != --res)
++    abort ();
++
++  __atomic_sub_fetch (v, count + 1, __ATOMIC_ACQ_REL);
++  if (*v != --res)
++    abort ();
++
++  __atomic_fetch_sub (v, count + 1, __ATOMIC_SEQ_CST);
++  if (*v != --res)
++    abort ();
++}
++
++void
++test_and (short* v)
++{
++  *v = init;
++
++  __atomic_and_fetch (v, 0, __ATOMIC_RELAXED);
++  if (*v != 0)
++    abort ();
++
++  *v = init;
++  __atomic_fetch_and (v, init, __ATOMIC_CONSUME);
++  if (*v != init)
++    abort ();
++
++  __atomic_and_fetch (v, 0, __ATOMIC_ACQUIRE);
++  if (*v != 0)
++    abort ();
++
++  *v = ~*v;
++  __atomic_fetch_and (v, init, __ATOMIC_RELEASE);
++  if (*v != init)
++    abort ();
++
++  __atomic_and_fetch (v, 0, __ATOMIC_ACQ_REL);
++  if (*v != 0)
++    abort ();
++
++  *v = ~*v;
++  __atomic_fetch_and (v, 0, __ATOMIC_SEQ_CST);
++  if (*v != 0)
++    abort ();
++}
++
++void
++test_nand (short* v)
++{
++  *v = init;
++
++  __atomic_fetch_nand (v, 0, __ATOMIC_RELAXED);
++  if (*v != init)
++    abort ();
++
++  __atomic_fetch_nand (v, init, __ATOMIC_CONSUME);
++  if (*v != 0)
++    abort ();
++
++  __atomic_nand_fetch (v, 0, __ATOMIC_ACQUIRE);
++  if (*v != init)
++    abort ();
++
++  __atomic_nand_fetch (v, init, __ATOMIC_RELEASE);
++  if (*v != 0)
++    abort ();
++
++  __atomic_fetch_nand (v, init, __ATOMIC_ACQ_REL);
++  if (*v != init)
++    abort ();
++
++  __atomic_nand_fetch (v, 0, __ATOMIC_SEQ_CST);
++  if (*v != init)
++    abort ();
++}
++
++
++
++void
++test_xor (short* v)
++{
++  *v = init;
++  count = 0;
++
++  __atomic_xor_fetch (v, count, __ATOMIC_RELAXED);
++  if (*v != init)
++    abort ();
++
++  __atomic_fetch_xor (v, ~count, __ATOMIC_CONSUME);
++  if (*v != 0)
++    abort ();
++
++  __atomic_xor_fetch (v, 0, __ATOMIC_ACQUIRE);
++  if (*v != 0)
++    abort ();
++
++  __atomic_fetch_xor (v, ~count, __ATOMIC_RELEASE);
++  if (*v != init)
++    abort ();
++
++  __atomic_fetch_xor (v, 0, __ATOMIC_ACQ_REL);
++  if (*v != init)
++    abort ();
++
++  __atomic_xor_fetch (v, ~count, __ATOMIC_SEQ_CST);
++  if (*v != 0)
++    abort ();
++}
++
++void
++test_or (short* v)
++{
++  *v = 0;
++  count = 1;
++
++  __atomic_or_fetch (v, count, __ATOMIC_RELAXED);
++  if (*v != 1)
++    abort ();
++
++  count *= 2;
++  __atomic_fetch_or (v, count, __ATOMIC_CONSUME);
++  if (*v != 3)
++    abort ();
++
++  count *= 2;
++  __atomic_or_fetch (v, 4, __ATOMIC_ACQUIRE);
++  if (*v != 7)
++    abort ();
++
++  count *= 2;
++  __atomic_fetch_or (v, 8, __ATOMIC_RELEASE);
++  if (*v != 15)
++    abort ();
++
++  count *= 2;
++  __atomic_or_fetch (v, count, __ATOMIC_ACQ_REL);
++  if (*v != 31)
++    abort ();
++
++  count *= 2;
++  __atomic_fetch_or (v, count, __ATOMIC_SEQ_CST);
++  if (*v != 63)
++    abort ();
++}
++
++int
++main () {
++  short* V[] = {&A.a, &A.b};
++
++  for (int i = 0; i < 2; i++) {
++    test_fetch_add (V[i]);
++    test_fetch_sub (V[i]);
++    test_fetch_and (V[i]);
++    test_fetch_nand (V[i]);
++    test_fetch_xor (V[i]);
++    test_fetch_or (V[i]);
++
++    test_add_fetch (V[i]);
++    test_sub_fetch (V[i]);
++    test_and_fetch (V[i]);
++    test_nand_fetch (V[i]);
++    test_xor_fetch (V[i]);
++    test_or_fetch (V[i]);
++
++    test_add (V[i]);
++    test_sub (V[i]);
++    test_and (V[i]);
++    test_nand (V[i]);
++    test_xor (V[i]);
++    test_or (V[i]);
++  }
++
++  return 0;
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-5.c
+@@ -0,0 +1,87 @@
++/* Test __atomic routines for existence and proper execution on 1 byte
++   values with each valid memory model.  */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-compare-exchange-1.c */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics" } */
++
++/* Test the execution of the __atomic_compare_exchange_n builtin for a char.  */
++
++extern void abort(void);
++
++char v = 0;
++char expected = 0;
++char max = ~0;
++char desired = ~0;
++char zero = 0;
++
++#define STRONG 0
++#define WEAK 1
++
++int
++main ()
++{
++
++  if (!__atomic_compare_exchange_n (&v, &expected, max, STRONG , __ATOMIC_RELAXED, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (__atomic_compare_exchange_n (&v, &expected, 0, STRONG , __ATOMIC_ACQUIRE, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != max)
++    abort ();
++
++  if (!__atomic_compare_exchange_n (&v, &expected, 0, STRONG , __ATOMIC_RELEASE, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != max)
++    abort ();
++  if (v != 0)
++    abort ();
++
++  if (__atomic_compare_exchange_n (&v, &expected, desired, WEAK, __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (!__atomic_compare_exchange_n (&v, &expected, desired, STRONG , __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST))
++    abort ();
++  if (expected != 0)
++    abort ();
++  if (v != max)
++    abort ();
++
++  /* Now test the generic version.  */
++
++  v = 0;
++
++  if (!__atomic_compare_exchange (&v, &expected, &max, STRONG, __ATOMIC_RELAXED, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (__atomic_compare_exchange (&v, &expected, &zero, STRONG , __ATOMIC_ACQUIRE, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != max)
++    abort ();
++
++  if (!__atomic_compare_exchange (&v, &expected, &zero, STRONG , __ATOMIC_RELEASE, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != max)
++    abort ();
++  if (v != 0)
++    abort ();
++
++  if (__atomic_compare_exchange (&v, &expected, &desired, WEAK, __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (!__atomic_compare_exchange (&v, &expected, &desired, STRONG , __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST))
++    abort ();
++  if (expected != 0)
++    abort ();
++  if (v != max)
++    abort ();
++
++  return 0;
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-6.c
+@@ -0,0 +1,87 @@
++/* Test __atomic routines for existence and proper execution on 2 byte
++   values with each valid memory model.  */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-compare-exchange-2.c */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics" } */
++
++/* Test the execution of the __atomic_compare_exchange_n builtin for a short.  */
++
++extern void abort(void);
++
++short v = 0;
++short expected = 0;
++short max = ~0;
++short desired = ~0;
++short zero = 0;
++
++#define STRONG 0
++#define WEAK 1
++
++int
++main ()
++{
++
++  if (!__atomic_compare_exchange_n (&v, &expected, max, STRONG , __ATOMIC_RELAXED, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (__atomic_compare_exchange_n (&v, &expected, 0, STRONG , __ATOMIC_ACQUIRE, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != max)
++    abort ();
++
++  if (!__atomic_compare_exchange_n (&v, &expected, 0, STRONG , __ATOMIC_RELEASE, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != max)
++    abort ();
++  if (v != 0)
++    abort ();
++
++  if (__atomic_compare_exchange_n (&v, &expected, desired, WEAK, __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (!__atomic_compare_exchange_n (&v, &expected, desired, STRONG , __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST))
++    abort ();
++  if (expected != 0)
++    abort ();
++  if (v != max)
++    abort ();
++
++  /* Now test the generic version.  */
++
++  v = 0;
++
++  if (!__atomic_compare_exchange (&v, &expected, &max, STRONG, __ATOMIC_RELAXED, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (__atomic_compare_exchange (&v, &expected, &zero, STRONG , __ATOMIC_ACQUIRE, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != max)
++    abort ();
++
++  if (!__atomic_compare_exchange (&v, &expected, &zero, STRONG , __ATOMIC_RELEASE, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != max)
++    abort ();
++  if (v != 0)
++    abort ();
++
++  if (__atomic_compare_exchange (&v, &expected, &desired, WEAK, __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (!__atomic_compare_exchange (&v, &expected, &desired, STRONG , __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST))
++    abort ();
++  if (expected != 0)
++    abort ();
++  if (v != max)
++    abort ();
++
++  return 0;
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-7.c
+@@ -0,0 +1,69 @@
++/* Test __atomic routines for existence and proper execution on 1 byte
++   values with each valid memory model.  */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-exchange-1.c */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics" } */
++
++/* Test the execution of the __atomic_exchange_n builtin for a char.  */
++
++extern void abort(void);
++
++char v, count, ret;
++
++int
++main ()
++{
++  v = 0;
++  count = 0;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_RELAXED) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_ACQUIRE) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_RELEASE) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_ACQ_REL) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_SEQ_CST) != count)
++    abort ();
++  count++;
++
++  /* Now test the generic version.  */
++
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_RELAXED);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_ACQUIRE);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_RELEASE);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_ACQ_REL);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_SEQ_CST);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  return 0;
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-8.c
+@@ -0,0 +1,69 @@
++/* Test __atomic routines for existence and proper execution on 2 byte
++   values with each valid memory model.  */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-exchange-2.c */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics" } */
++
++/* Test the execution of the __atomic_X builtin for a short.  */
++
++extern void abort(void);
++
++short v, count, ret;
++
++int
++main ()
++{
++  v = 0;
++  count = 0;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_RELAXED) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_ACQUIRE) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_RELEASE) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_ACQ_REL) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_SEQ_CST) != count)
++    abort ();
++  count++;
++
++  /* Now test the generic version.  */
++
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_RELAXED);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_ACQUIRE);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_RELEASE);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_ACQ_REL);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_SEQ_CST);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  return 0;
++}
+--- a/libgcc/config/riscv/atomic.c
++++ b/libgcc/config/riscv/atomic.c
+@@ -30,6 +30,8 @@ see the files COPYING3 and COPYING.RUNTI
+ #define INVERT		"not %[tmp1], %[tmp1]\n\t"
+ #define DONT_INVERT	""
+ 
++/* Logic duplicated in gcc/gcc/config/riscv/sync.md for use when inlining is enabled */
++
+ #define GENERATE_FETCH_AND_OP(type, size, opname, insn, invert, cop)	\
+   type __sync_fetch_and_ ## opname ## _ ## size (type *p, type v)	\
+   {									\
diff --git a/toolchain/gcc/patches-12.x/701-riscv-linux-Don-t-add-latomic-with-pthread.patch b/toolchain/gcc/patches-12.x/701-riscv-linux-Don-t-add-latomic-with-pthread.patch
new file mode 100644
index 00000000000000..328c7be9ce8ec4
--- /dev/null
+++ b/toolchain/gcc/patches-12.x/701-riscv-linux-Don-t-add-latomic-with-pthread.patch
@@ -0,0 +1,36 @@
+From 203f3060dd363361b172f7295f42bb6bf5ac0b3b Mon Sep 17 00:00:00 2001
+From: Andreas Schwab <schwab@suse.de>
+Date: Sat, 23 Apr 2022 15:48:42 +0200
+Subject: [PATCH] riscv/linux: Don't add -latomic with -pthread
+
+Now that we have support for inline subword atomic operations, it is no
+longer necessary to link against libatomic.  This also fixes testsuite
+failures because the framework does not properly set up the linker flags
+for finding libatomic.
+The use of atomic operations is also independent of the use of libpthread.
+
+gcc/
+	* config/riscv/linux.h (LIB_SPEC): Don't redefine.
+---
+ gcc/config/riscv/linux.h | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+--- a/gcc/config/riscv/linux.h
++++ b/gcc/config/riscv/linux.h
+@@ -35,16 +35,6 @@ along with GCC; see the file COPYING3.
+ #undef MUSL_DYNAMIC_LINKER
+ #define MUSL_DYNAMIC_LINKER "/lib/ld-musl-riscv" XLEN_SPEC MUSL_ABI_SUFFIX ".so.1"
+ 
+-/* Because RISC-V only has word-sized atomics, it requries libatomic where
+-   others do not.  So link libatomic by default, as needed.  */
+-#undef LIB_SPEC
+-#ifdef LD_AS_NEEDED_OPTION
+-#define LIB_SPEC GNU_USER_TARGET_LIB_SPEC \
+-  " %{pthread:" LD_AS_NEEDED_OPTION " -latomic " LD_NO_AS_NEEDED_OPTION "}"
+-#else
+-#define LIB_SPEC GNU_USER_TARGET_LIB_SPEC " -latomic "
+-#endif
+-
+ #define ICACHE_FLUSH_FUNC "__riscv_flush_icache"
+ 
+ #define CPP_SPEC "%{pthread:-D_REENTRANT}"
diff --git a/toolchain/gcc/patches-12.x/910-mbsd_multi.patch b/toolchain/gcc/patches-12.x/910-mbsd_multi.patch
index 4033c5b23bcf87..9233c6a1d7896b 100644
--- a/toolchain/gcc/patches-12.x/910-mbsd_multi.patch
+++ b/toolchain/gcc/patches-12.x/910-mbsd_multi.patch
@@ -114,7 +114,7 @@ Date:   Tue Jul 31 00:52:27 2007 +0000
  ; On SVR4 targets, it also controls whether or not to emit a
 --- a/gcc/doc/invoke.texi
 +++ b/gcc/doc/invoke.texi
-@@ -9596,6 +9596,17 @@ This option is only supported for C and
+@@ -9597,6 +9597,17 @@ This option is only supported for C and
  @option{-Wall} and by @option{-Wpedantic}, which can be disabled with
  @option{-Wno-pointer-sign}.
  
@@ -134,7 +134,7 @@ Date:   Tue Jul 31 00:52:27 2007 +0000
  @opindex Wno-stack-protector
 --- a/gcc/opts.cc
 +++ b/gcc/opts.cc
-@@ -2692,6 +2692,9 @@ common_handle_option (struct gcc_options
+@@ -2699,6 +2699,9 @@ common_handle_option (struct gcc_options
        add_comma_separated_to_vector (&opts->x_flag_ignored_attributes, arg);
        break;
  
diff --git a/toolchain/gcc/patches-12.x/920-specs_nonfatal_getenv.patch b/toolchain/gcc/patches-12.x/920-specs_nonfatal_getenv.patch
index 0f7d40b244dc7d..59bd3500445337 100644
--- a/toolchain/gcc/patches-12.x/920-specs_nonfatal_getenv.patch
+++ b/toolchain/gcc/patches-12.x/920-specs_nonfatal_getenv.patch
@@ -7,7 +7,7 @@ Date:   Sat Apr 21 03:02:39 2012 +0000
 
 --- a/gcc/gcc.cc
 +++ b/gcc/gcc.cc
-@@ -10213,8 +10213,10 @@ getenv_spec_function (int argc, const ch
+@@ -10186,8 +10186,10 @@ getenv_spec_function (int argc, const ch
      }
  
    if (!value)
diff --git a/toolchain/gcc/patches-12.x/970-macos_arm64-building-fix.patch b/toolchain/gcc/patches-12.x/970-macos_arm64-building-fix.patch
index 86fa68e1b10577..89730449f5547a 100644
--- a/toolchain/gcc/patches-12.x/970-macos_arm64-building-fix.patch
+++ b/toolchain/gcc/patches-12.x/970-macos_arm64-building-fix.patch
@@ -17,7 +17,7 @@ Date:   Mon Aug 16 13:16:21 2021 +0100
 
 --- a/gcc/config/aarch64/aarch64.h
 +++ b/gcc/config/aarch64/aarch64.h
-@@ -1290,7 +1290,7 @@ extern const char *aarch64_rewrite_mcpu
+@@ -1293,7 +1293,7 @@ extern const char *aarch64_rewrite_mcpu
  #define MCPU_TO_MARCH_SPEC_FUNCTIONS \
    { "rewrite_mcpu", aarch64_rewrite_mcpu },
  
diff --git a/toolchain/gcc/patches-13.x/001-rtl-optimization-109585-alias-analysis-typo.patch b/toolchain/gcc/patches-13.x/001-rtl-optimization-109585-alias-analysis-typo.patch
new file mode 100644
index 00000000000000..7f73be432534a6
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/001-rtl-optimization-109585-alias-analysis-typo.patch
@@ -0,0 +1,69 @@
+From bb406a6aea336966681927a27f54ee89c4fd4ea1 Mon Sep 17 00:00:00 2001
+From: Richard Biener <rguenther@suse.de>
+Date: Mon, 24 Apr 2023 13:31:07 +0200
+Subject: [PATCH] rtl-optimization/109585 - alias analysis typo
+
+When r10-514-gc6b84edb6110dd2b4fb improved access path analysis
+it introduced a typo that triggers when there's an access to a
+trailing array in the first access path leading to false
+disambiguation.
+
+	PR rtl-optimization/109585
+	* tree-ssa-alias.cc (aliasing_component_refs_p): Fix typo.
+
+	* gcc.dg/torture/pr109585.c: New testcase.
+
+(cherry picked from commit 6d4bd27a60447c7505cb4783e675e98a191a8904)
+---
+ gcc/testsuite/gcc.dg/torture/pr109585.c | 33 +++++++++++++++++++++++++
+ gcc/tree-ssa-alias.cc                   |  2 +-
+ 2 files changed, 34 insertions(+), 1 deletion(-)
+ create mode 100644 gcc/testsuite/gcc.dg/torture/pr109585.c
+
+--- /dev/null
++++ b/gcc/testsuite/gcc.dg/torture/pr109585.c
+@@ -0,0 +1,33 @@
++/* { dg-do run } */
++
++#include <stdlib.h>
++
++struct P {
++    long v;
++    struct P *n;
++};
++
++struct F {
++    long x;
++    struct P fam[];
++};
++
++int __attribute__((noipa))
++f(struct F *f, int i)
++{
++  struct P *p = f->fam;
++  asm("" : "+r"(f): "r"(p));
++  p->v = 0;
++  p->n = 0;
++  return f->fam->n != 0;
++}
++
++int
++main()
++{
++  struct F *m = malloc (sizeof (long) + 2 * sizeof (struct P));
++  m->fam[0].n = &m->fam[1];
++  if (f (m, 0))
++    abort ();
++  return 0;
++}
+--- a/gcc/tree-ssa-alias.cc
++++ b/gcc/tree-ssa-alias.cc
+@@ -1330,7 +1330,7 @@ aliasing_component_refs_p (tree ref1,
+   /* If we didn't find a common base, try the other way around.  */
+   if (cmp_outer <= 0 
+       || (end_struct_ref1
+-	  && compare_type_sizes (TREE_TYPE (end_struct_ref1), type1) <= 0))
++	  && compare_type_sizes (TREE_TYPE (end_struct_ref1), type2) <= 0))
+     {
+       int res = aliasing_component_refs_walk (ref2, type2, base2,
+ 					      offset2, max_size2,
diff --git a/toolchain/gcc/patches-13.x/002-case_insensitive.patch b/toolchain/gcc/patches-13.x/002-case_insensitive.patch
new file mode 100644
index 00000000000000..409497e5a3d866
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/002-case_insensitive.patch
@@ -0,0 +1,24 @@
+commit 81cc26c706b2bc8c8c1eb1a322e5c5157900836e
+Author: Felix Fietkau <nbd@openwrt.org>
+Date:   Sun Oct 19 21:45:51 2014 +0000
+
+    gcc: do not assume that the Mac OS X filesystem is case insensitive
+    
+    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+    
+    SVN-Revision: 42973
+
+--- a/include/filenames.h
++++ b/include/filenames.h
+@@ -44,11 +44,6 @@ extern "C" {
+ #  define IS_DIR_SEPARATOR(c) IS_DOS_DIR_SEPARATOR (c)
+ #  define IS_ABSOLUTE_PATH(f) IS_DOS_ABSOLUTE_PATH (f)
+ #else /* not DOSish */
+-#  if defined(__APPLE__)
+-#    ifndef HAVE_CASE_INSENSITIVE_FILE_SYSTEM
+-#      define HAVE_CASE_INSENSITIVE_FILE_SYSTEM 1
+-#    endif
+-#  endif /* __APPLE__ */
+ #  define HAS_DRIVE_SPEC(f) (0)
+ #  define IS_DIR_SEPARATOR(c) IS_UNIX_DIR_SEPARATOR (c)
+ #  define IS_ABSOLUTE_PATH(f) IS_UNIX_ABSOLUTE_PATH (f)
diff --git a/toolchain/gcc/patches-13.x/010-documentation.patch b/toolchain/gcc/patches-13.x/010-documentation.patch
new file mode 100644
index 00000000000000..9646568afebdeb
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/010-documentation.patch
@@ -0,0 +1,35 @@
+commit 098bd91f5eae625c7d2ee621e10930fc4434e5e2
+Author: Luka Perkov <luka@openwrt.org>
+Date:   Tue Feb 26 16:16:33 2013 +0000
+
+    gcc: don't build documentation
+    
+    This closes #13039.
+    
+    Signed-off-by: Luka Perkov <luka@openwrt.org>
+    
+    SVN-Revision: 35807
+
+--- a/gcc/Makefile.in
++++ b/gcc/Makefile.in
+@@ -3397,18 +3397,10 @@ doc/gcc.info: $(TEXI_GCC_FILES)
+ doc/gccint.info: $(TEXI_GCCINT_FILES)
+ doc/cppinternals.info: $(TEXI_CPPINT_FILES)
+ 
+-doc/%.info: %.texi
+-	if [ x$(BUILD_INFO) = xinfo ]; then \
+-		$(MAKEINFO) $(MAKEINFOFLAGS) -I . -I $(gcc_docdir) \
+-			-I $(gcc_docdir)/include -o $@ $<; \
+-	fi
++doc/%.info:
+ 
+ # Duplicate entry to handle renaming of gccinstall.info
+-doc/gccinstall.info: $(TEXI_GCCINSTALL_FILES)
+-	if [ x$(BUILD_INFO) = xinfo ]; then \
+-		$(MAKEINFO) $(MAKEINFOFLAGS) -I $(gcc_docdir) \
+-			-I $(gcc_docdir)/include -o $@ $<; \
+-	fi
++doc/gccinstall.info:
+ 
+ doc/cpp.dvi: $(TEXI_CPP_FILES)
+ doc/gcc.dvi: $(TEXI_GCC_FILES)
diff --git a/toolchain/gcc/patches-13.x/110-Fix-MIPS-PR-84790.patch b/toolchain/gcc/patches-13.x/110-Fix-MIPS-PR-84790.patch
new file mode 100644
index 00000000000000..856fd6a46cef1a
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/110-Fix-MIPS-PR-84790.patch
@@ -0,0 +1,20 @@
+Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84790.
+MIPS16 functions have a static assembler prologue which clobbers
+registers v0 and v1. Add these register clobbers to function call
+instructions.
+
+--- a/gcc/config/mips/mips.cc
++++ b/gcc/config/mips/mips.cc
+@@ -3134,6 +3134,12 @@ mips_emit_call_insn (rtx pattern, rtx or
+       emit_insn (gen_update_got_version ());
+     }
+ 
++  if (TARGET_MIPS16 && TARGET_USE_GOT)
++    {
++      clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS16_PIC_TEMP);
++      clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS_PROLOGUE_TEMP (word_mode));
++    }
++
+   if (TARGET_MIPS16
+       && TARGET_EXPLICIT_RELOCS
+       && TARGET_CALL_CLOBBERED_GP)
diff --git a/toolchain/gcc/patches-13.x/230-musl_libssp.patch b/toolchain/gcc/patches-13.x/230-musl_libssp.patch
new file mode 100644
index 00000000000000..fee068e1d60ac8
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/230-musl_libssp.patch
@@ -0,0 +1,13 @@
+--- a/gcc/gcc.cc
++++ b/gcc/gcc.cc
+@@ -972,7 +972,9 @@ proper position among the other output f
+ #endif
+ 
+ #ifndef LINK_SSP_SPEC
+-#ifdef TARGET_LIBC_PROVIDES_SSP
++#if DEFAULT_LIBC == LIBC_MUSL
++#define LINK_SSP_SPEC "-lssp_nonshared"
++#elif defined(TARGET_LIBC_PROVIDES_SSP)
+ #define LINK_SSP_SPEC "%{fstack-protector|fstack-protector-all" \
+ 		       "|fstack-protector-strong|fstack-protector-explicit:}"
+ #else
diff --git a/toolchain/gcc/patches-13.x/300-mips_Os_cpu_rtx_cost_model.patch b/toolchain/gcc/patches-13.x/300-mips_Os_cpu_rtx_cost_model.patch
new file mode 100644
index 00000000000000..ce21e0433d11cb
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/300-mips_Os_cpu_rtx_cost_model.patch
@@ -0,0 +1,21 @@
+commit ecf7671b769fe96f7b5134be442089f8bdba55d2
+Author: Felix Fietkau <nbd@nbd.name>
+Date:   Thu Aug 4 20:29:45 2016 +0200
+
+gcc: add a patch to generate better code with Os on mips
+
+Also happens to reduce compressed code size a bit
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+
+--- a/gcc/config/mips/mips.cc
++++ b/gcc/config/mips/mips.cc
+@@ -20213,7 +20213,7 @@ mips_option_override (void)
+     flag_pcc_struct_return = 0;
+ 
+   /* Decide which rtx_costs structure to use.  */
+-  if (optimize_size)
++  if (0 && optimize_size)
+     mips_cost = &mips_rtx_cost_optimize_size;
+   else
+     mips_cost = &mips_rtx_cost_data[mips_tune];
diff --git a/toolchain/gcc/patches-13.x/700-RISCV-Inline-subword-atomic-ops.patch b/toolchain/gcc/patches-13.x/700-RISCV-Inline-subword-atomic-ops.patch
new file mode 100644
index 00000000000000..752480bc4c5799
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/700-RISCV-Inline-subword-atomic-ops.patch
@@ -0,0 +1,2021 @@
+From f797260adaf52bee0ec0e16190bbefbe1bfc3692 Mon Sep 17 00:00:00 2001
+From: Patrick O'Neill <patrick@rivosinc.com>
+Date: Tue, 18 Apr 2023 14:33:13 -0700
+Subject: [PATCH] RISCV: Inline subword atomic ops
+
+RISC-V has no support for subword atomic operations; code currently
+generates libatomic library calls.
+
+This patch changes the default behavior to inline subword atomic calls
+(using the same logic as the existing library call).
+Behavior can be specified using the -minline-atomics and
+-mno-inline-atomics command line flags.
+
+gcc/libgcc/config/riscv/atomic.c has the same logic implemented in asm.
+This will need to stay for backwards compatibility and the
+-mno-inline-atomics flag.
+
+2023-04-18 Patrick O'Neill <patrick@rivosinc.com>
+
+gcc/ChangeLog:
+	PR target/104338
+	* config/riscv/riscv-protos.h: Add helper function stubs.
+	* config/riscv/riscv.cc: Add helper functions for subword masking.
+	* config/riscv/riscv.opt: Add command-line flag.
+	* config/riscv/sync.md: Add masking logic and inline asm for fetch_and_op,
+	fetch_and_nand, CAS, and exchange ops.
+	* doc/invoke.texi: Add blurb regarding command-line flag.
+
+libgcc/ChangeLog:
+	PR target/104338
+	* config/riscv/atomic.c: Add reference to duplicate logic.
+
+gcc/testsuite/ChangeLog:
+	PR target/104338
+	* gcc.target/riscv/inline-atomics-1.c: New test.
+	* gcc.target/riscv/inline-atomics-2.c: New test.
+	* gcc.target/riscv/inline-atomics-3.c: New test.
+	* gcc.target/riscv/inline-atomics-4.c: New test.
+	* gcc.target/riscv/inline-atomics-5.c: New test.
+	* gcc.target/riscv/inline-atomics-6.c: New test.
+	* gcc.target/riscv/inline-atomics-7.c: New test.
+	* gcc.target/riscv/inline-atomics-8.c: New test.
+
+Signed-off-by: Patrick O'Neill <patrick@rivosinc.com>
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+---
+ gcc/config/riscv/riscv-protos.h               |   2 +
+ gcc/config/riscv/riscv.cc                     |  49 ++
+ gcc/config/riscv/riscv.opt                    |   4 +
+ gcc/config/riscv/sync.md                      | 301 +++++++++
+ gcc/doc/invoke.texi                           |  10 +-
+ .../gcc.target/riscv/inline-atomics-1.c       |  18 +
+ .../gcc.target/riscv/inline-atomics-2.c       |   9 +
+ .../gcc.target/riscv/inline-atomics-3.c       | 569 ++++++++++++++++++
+ .../gcc.target/riscv/inline-atomics-4.c       | 566 +++++++++++++++++
+ .../gcc.target/riscv/inline-atomics-5.c       |  87 +++
+ .../gcc.target/riscv/inline-atomics-6.c       |  87 +++
+ .../gcc.target/riscv/inline-atomics-7.c       |  69 +++
+ .../gcc.target/riscv/inline-atomics-8.c       |  69 +++
+ libgcc/config/riscv/atomic.c                  |   2 +
+ 14 files changed, 1841 insertions(+), 1 deletion(-)
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-1.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-2.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-3.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-4.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-5.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-6.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-7.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-8.c
+
+--- a/gcc/config/riscv/riscv-protos.h
++++ b/gcc/config/riscv/riscv-protos.h
+@@ -79,6 +79,8 @@ extern void riscv_reinit (void);
+ extern poly_uint64 riscv_regmode_natural_size (machine_mode);
+ extern bool riscv_v_ext_vector_mode_p (machine_mode);
+ extern bool riscv_shamt_matches_mask_p (int, HOST_WIDE_INT);
++extern void riscv_subword_address (rtx, rtx *, rtx *, rtx *, rtx *);
++extern void riscv_lshift_subword (machine_mode, rtx, rtx, rtx *);
+ 
+ /* Routines implemented in riscv-c.cc.  */
+ void riscv_cpu_cpp_builtins (cpp_reader *);
+--- a/gcc/config/riscv/riscv.cc
++++ b/gcc/config/riscv/riscv.cc
+@@ -7143,6 +7143,55 @@ riscv_zero_call_used_regs (HARD_REG_SET
+ 							& ~zeroed_hardregs);
+ }
+ 
++/* Given memory reference MEM, expand code to compute the aligned
++   memory address, shift and mask values and store them into
++   *ALIGNED_MEM, *SHIFT, *MASK and *NOT_MASK.  */
++
++void
++riscv_subword_address (rtx mem, rtx *aligned_mem, rtx *shift, rtx *mask,
++		       rtx *not_mask)
++{
++  /* Align the memory address to a word.  */
++  rtx addr = force_reg (Pmode, XEXP (mem, 0));
++
++  rtx addr_mask = gen_int_mode (-4, Pmode);
++
++  rtx aligned_addr = gen_reg_rtx (Pmode);
++  emit_move_insn (aligned_addr,  gen_rtx_AND (Pmode, addr, addr_mask));
++
++  *aligned_mem = change_address (mem, SImode, aligned_addr);
++
++  /* Calculate the shift amount.  */
++  emit_move_insn (*shift, gen_rtx_AND (SImode, gen_lowpart (SImode, addr),
++				       gen_int_mode (3, SImode)));
++  emit_move_insn (*shift, gen_rtx_ASHIFT (SImode, *shift,
++					  gen_int_mode (3, SImode)));
++
++  /* Calculate the mask.  */
++  int unshifted_mask = GET_MODE_MASK (GET_MODE (mem));
++
++  emit_move_insn (*mask, gen_int_mode (unshifted_mask, SImode));
++
++  emit_move_insn (*mask, gen_rtx_ASHIFT (SImode, *mask,
++					 gen_lowpart (QImode, *shift)));
++
++  emit_move_insn (*not_mask, gen_rtx_NOT(SImode, *mask));
++}
++
++/* Leftshift a subword within an SImode register.  */
++
++void
++riscv_lshift_subword (machine_mode mode, rtx value, rtx shift,
++		      rtx *shifted_value)
++{
++  rtx value_reg = gen_reg_rtx (SImode);
++  emit_move_insn (value_reg, simplify_gen_subreg (SImode, value,
++						  mode, 0));
++
++  emit_move_insn(*shifted_value, gen_rtx_ASHIFT (SImode, value_reg,
++						 gen_lowpart (QImode, shift)));
++}
++
+ /* Initialize the GCC target structure.  */
+ #undef TARGET_ASM_ALIGNED_HI_OP
+ #define TARGET_ASM_ALIGNED_HI_OP "\t.half\t"
+--- a/gcc/config/riscv/riscv.opt
++++ b/gcc/config/riscv/riscv.opt
+@@ -238,6 +238,10 @@ int riscv_sv_subext
+ TargetVariable
+ int riscv_xthead_subext
+ 
++minline-atomics
++Target Var(TARGET_INLINE_SUBWORD_ATOMIC) Init(1)
++Always inline subword atomic operations.
++
+ Enum
+ Name(isa_spec_class) Type(enum riscv_isa_spec_class)
+ Supported ISA specs (for use with the -misa-spec= option):
+--- a/gcc/config/riscv/sync.md
++++ b/gcc/config/riscv/sync.md
+@@ -21,8 +21,11 @@
+ 
+ (define_c_enum "unspec" [
+   UNSPEC_COMPARE_AND_SWAP
++  UNSPEC_COMPARE_AND_SWAP_SUBWORD
+   UNSPEC_SYNC_OLD_OP
++  UNSPEC_SYNC_OLD_OP_SUBWORD
+   UNSPEC_SYNC_EXCHANGE
++  UNSPEC_SYNC_EXCHANGE_SUBWORD
+   UNSPEC_ATOMIC_STORE
+   UNSPEC_MEMORY_BARRIER
+ ])
+@@ -91,6 +94,135 @@
+   [(set_attr "type" "atomic")
+    (set (attr "length") (const_int 8))])
+ 
++(define_insn "subword_atomic_fetch_strong_<atomic_optab>"
++  [(set (match_operand:SI 0 "register_operand" "=&r")		   ;; old value at mem
++	(match_operand:SI 1 "memory_operand" "+A"))		   ;; mem location
++   (set (match_dup 1)
++	(unspec_volatile:SI
++	  [(any_atomic:SI (match_dup 1)
++		     (match_operand:SI 2 "register_operand" "rI")) ;; value for op
++	   (match_operand:SI 3 "register_operand" "rI")]	   ;; mask
++	 UNSPEC_SYNC_OLD_OP_SUBWORD))
++    (match_operand:SI 4 "register_operand" "rI")		   ;; not_mask
++    (clobber (match_scratch:SI 5 "=&r"))			   ;; tmp_1
++    (clobber (match_scratch:SI 6 "=&r"))]			   ;; tmp_2
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++  {
++    return "1:\;"
++	   "lr.w.aq\t%0, %1\;"
++	   "<insn>\t%5, %0, %2\;"
++	   "and\t%5, %5, %3\;"
++	   "and\t%6, %0, %4\;"
++	   "or\t%6, %6, %5\;"
++	   "sc.w.rl\t%5, %6, %1\;"
++	   "bnez\t%5, 1b";
++  }
++  [(set (attr "length") (const_int 28))])
++
++(define_expand "atomic_fetch_nand<mode>"
++  [(match_operand:SHORT 0 "register_operand")			      ;; old value at mem
++   (not:SHORT (and:SHORT (match_operand:SHORT 1 "memory_operand")     ;; mem location
++			 (match_operand:SHORT 2 "reg_or_0_operand"))) ;; value for op
++   (match_operand:SI 3 "const_int_operand")]			      ;; model
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++{
++  /* We have no QImode/HImode atomics, so form a mask, then use
++     subword_atomic_fetch_strong_nand to implement a LR/SC version of the
++     operation. */
++
++  /* Logic duplicated in gcc/libgcc/config/riscv/atomic.c for use when inlining
++     is disabled */
++
++  rtx old = gen_reg_rtx (SImode);
++  rtx mem = operands[1];
++  rtx value = operands[2];
++  rtx aligned_mem = gen_reg_rtx (SImode);
++  rtx shift = gen_reg_rtx (SImode);
++  rtx mask = gen_reg_rtx (SImode);
++  rtx not_mask = gen_reg_rtx (SImode);
++
++  riscv_subword_address (mem, &aligned_mem, &shift, &mask, &not_mask);
++
++  rtx shifted_value = gen_reg_rtx (SImode);
++  riscv_lshift_subword (<MODE>mode, value, shift, &shifted_value);
++
++  emit_insn (gen_subword_atomic_fetch_strong_nand (old, aligned_mem,
++						   shifted_value,
++						   mask, not_mask));
++
++  emit_move_insn (old, gen_rtx_ASHIFTRT (SImode, old,
++					 gen_lowpart (QImode, shift)));
++
++  emit_move_insn (operands[0], gen_lowpart (<MODE>mode, old));
++
++  DONE;
++})
++
++(define_insn "subword_atomic_fetch_strong_nand"
++  [(set (match_operand:SI 0 "register_operand" "=&r")			  ;; old value at mem
++	(match_operand:SI 1 "memory_operand" "+A"))			  ;; mem location
++   (set (match_dup 1)
++	(unspec_volatile:SI
++	  [(not:SI (and:SI (match_dup 1)
++			   (match_operand:SI 2 "register_operand" "rI"))) ;; value for op
++	   (match_operand:SI 3 "register_operand" "rI")]		  ;; mask
++	 UNSPEC_SYNC_OLD_OP_SUBWORD))
++    (match_operand:SI 4 "register_operand" "rI")			  ;; not_mask
++    (clobber (match_scratch:SI 5 "=&r"))				  ;; tmp_1
++    (clobber (match_scratch:SI 6 "=&r"))]				  ;; tmp_2
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++  {
++    return "1:\;"
++	   "lr.w.aq\t%0, %1\;"
++	   "and\t%5, %0, %2\;"
++	   "not\t%5, %5\;"
++	   "and\t%5, %5, %3\;"
++	   "and\t%6, %0, %4\;"
++	   "or\t%6, %6, %5\;"
++	   "sc.w.rl\t%5, %6, %1\;"
++	   "bnez\t%5, 1b";
++  }
++  [(set (attr "length") (const_int 32))])
++
++(define_expand "atomic_fetch_<atomic_optab><mode>"
++  [(match_operand:SHORT 0 "register_operand")			 ;; old value at mem
++   (any_atomic:SHORT (match_operand:SHORT 1 "memory_operand")	 ;; mem location
++		     (match_operand:SHORT 2 "reg_or_0_operand")) ;; value for op
++   (match_operand:SI 3 "const_int_operand")]			 ;; model
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++{
++  /* We have no QImode/HImode atomics, so form a mask, then use
++     subword_atomic_fetch_strong_<mode> to implement a LR/SC version of the
++     operation. */
++
++  /* Logic duplicated in gcc/libgcc/config/riscv/atomic.c for use when inlining
++     is disabled */
++
++  rtx old = gen_reg_rtx (SImode);
++  rtx mem = operands[1];
++  rtx value = operands[2];
++  rtx aligned_mem = gen_reg_rtx (SImode);
++  rtx shift = gen_reg_rtx (SImode);
++  rtx mask = gen_reg_rtx (SImode);
++  rtx not_mask = gen_reg_rtx (SImode);
++
++  riscv_subword_address (mem, &aligned_mem, &shift, &mask, &not_mask);
++
++  rtx shifted_value = gen_reg_rtx (SImode);
++  riscv_lshift_subword (<MODE>mode, value, shift, &shifted_value);
++
++  emit_insn (gen_subword_atomic_fetch_strong_<atomic_optab> (old, aligned_mem,
++							     shifted_value,
++							     mask, not_mask));
++
++  emit_move_insn (old, gen_rtx_ASHIFTRT (SImode, old,
++					 gen_lowpart (QImode, shift)));
++
++  emit_move_insn (operands[0], gen_lowpart (<MODE>mode, old));
++
++  DONE;
++})
++
+ (define_insn "atomic_exchange<mode>"
+   [(set (match_operand:GPR 0 "register_operand" "=&r")
+ 	(unspec_volatile:GPR
+@@ -104,6 +236,56 @@
+   [(set_attr "type" "atomic")
+    (set (attr "length") (const_int 8))])
+ 
++(define_expand "atomic_exchange<mode>"
++  [(match_operand:SHORT 0 "register_operand") ;; old value at mem
++   (match_operand:SHORT 1 "memory_operand")   ;; mem location
++   (match_operand:SHORT 2 "register_operand") ;; value
++   (match_operand:SI 3 "const_int_operand")]  ;; model
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++{
++  rtx old = gen_reg_rtx (SImode);
++  rtx mem = operands[1];
++  rtx value = operands[2];
++  rtx aligned_mem = gen_reg_rtx (SImode);
++  rtx shift = gen_reg_rtx (SImode);
++  rtx mask = gen_reg_rtx (SImode);
++  rtx not_mask = gen_reg_rtx (SImode);
++
++  riscv_subword_address (mem, &aligned_mem, &shift, &mask, &not_mask);
++
++  rtx shifted_value = gen_reg_rtx (SImode);
++  riscv_lshift_subword (<MODE>mode, value, shift, &shifted_value);
++
++  emit_insn (gen_subword_atomic_exchange_strong (old, aligned_mem,
++						 shifted_value, not_mask));
++
++  emit_move_insn (old, gen_rtx_ASHIFTRT (SImode, old,
++					 gen_lowpart (QImode, shift)));
++
++  emit_move_insn (operands[0], gen_lowpart (<MODE>mode, old));
++  DONE;
++})
++
++(define_insn "subword_atomic_exchange_strong"
++  [(set (match_operand:SI 0 "register_operand" "=&r")	 ;; old value at mem
++	(match_operand:SI 1 "memory_operand" "+A"))	 ;; mem location
++   (set (match_dup 1)
++	(unspec_volatile:SI
++	  [(match_operand:SI 2 "reg_or_0_operand" "rI")  ;; value
++	   (match_operand:SI 3 "reg_or_0_operand" "rI")] ;; not_mask
++      UNSPEC_SYNC_EXCHANGE_SUBWORD))
++    (clobber (match_scratch:SI 4 "=&r"))]		 ;; tmp_1
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++  {
++    return "1:\;"
++	   "lr.w.aq\t%0, %1\;"
++	   "and\t%4, %0, %3\;"
++	   "or\t%4, %4, %2\;"
++	   "sc.w.rl\t%4, %4, %1\;"
++	   "bnez\t%4, 1b";
++  }
++  [(set (attr "length") (const_int 20))])
++
+ (define_insn "atomic_cas_value_strong<mode>"
+   [(set (match_operand:GPR 0 "register_operand" "=&r")
+ 	(match_operand:GPR 1 "memory_operand" "+A"))
+@@ -153,6 +335,125 @@
+   DONE;
+ })
+ 
++(define_expand "atomic_compare_and_swap<mode>"
++  [(match_operand:SI 0 "register_operand")    ;; bool output
++   (match_operand:SHORT 1 "register_operand") ;; val output
++   (match_operand:SHORT 2 "memory_operand")   ;; memory
++   (match_operand:SHORT 3 "reg_or_0_operand") ;; expected value
++   (match_operand:SHORT 4 "reg_or_0_operand") ;; desired value
++   (match_operand:SI 5 "const_int_operand")   ;; is_weak
++   (match_operand:SI 6 "const_int_operand")   ;; mod_s
++   (match_operand:SI 7 "const_int_operand")]  ;; mod_f
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++{
++  emit_insn (gen_atomic_cas_value_strong<mode> (operands[1], operands[2],
++						operands[3], operands[4],
++						operands[6], operands[7]));
++
++  rtx val = gen_reg_rtx (SImode);
++  if (operands[1] != const0_rtx)
++    emit_move_insn (val, gen_rtx_SIGN_EXTEND (SImode, operands[1]));
++  else
++    emit_move_insn (val, const0_rtx);
++
++  rtx exp = gen_reg_rtx (SImode);
++  if (operands[3] != const0_rtx)
++    emit_move_insn (exp, gen_rtx_SIGN_EXTEND (SImode, operands[3]));
++  else
++    emit_move_insn (exp, const0_rtx);
++
++  rtx compare = val;
++  if (exp != const0_rtx)
++    {
++      rtx difference = gen_rtx_MINUS (SImode, val, exp);
++      compare = gen_reg_rtx (SImode);
++      emit_move_insn  (compare, difference);
++    }
++
++  if (word_mode != SImode)
++    {
++      rtx reg = gen_reg_rtx (word_mode);
++      emit_move_insn (reg, gen_rtx_SIGN_EXTEND (word_mode, compare));
++      compare = reg;
++    }
++
++  emit_move_insn (operands[0], gen_rtx_EQ (SImode, compare, const0_rtx));
++  DONE;
++})
++
++(define_expand "atomic_cas_value_strong<mode>"
++  [(match_operand:SHORT 0 "register_operand") ;; val output
++   (match_operand:SHORT 1 "memory_operand")   ;; memory
++   (match_operand:SHORT 2 "reg_or_0_operand") ;; expected value
++   (match_operand:SHORT 3 "reg_or_0_operand") ;; desired value
++   (match_operand:SI 4 "const_int_operand")   ;; mod_s
++   (match_operand:SI 5 "const_int_operand")   ;; mod_f
++   (match_scratch:SHORT 6)]
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++{
++  /* We have no QImode/HImode atomics, so form a mask, then use
++     subword_atomic_cas_strong<mode> to implement a LR/SC version of the
++     operation. */
++
++  /* Logic duplicated in gcc/libgcc/config/riscv/atomic.c for use when inlining
++     is disabled */
++
++  rtx old = gen_reg_rtx (SImode);
++  rtx mem = operands[1];
++  rtx aligned_mem = gen_reg_rtx (SImode);
++  rtx shift = gen_reg_rtx (SImode);
++  rtx mask = gen_reg_rtx (SImode);
++  rtx not_mask = gen_reg_rtx (SImode);
++
++  riscv_subword_address (mem, &aligned_mem, &shift, &mask, &not_mask);
++
++  rtx o = operands[2];
++  rtx n = operands[3];
++  rtx shifted_o = gen_reg_rtx (SImode);
++  rtx shifted_n = gen_reg_rtx (SImode);
++
++  riscv_lshift_subword (<MODE>mode, o, shift, &shifted_o);
++  riscv_lshift_subword (<MODE>mode, n, shift, &shifted_n);
++
++  emit_move_insn (shifted_o, gen_rtx_AND (SImode, shifted_o, mask));
++  emit_move_insn (shifted_n, gen_rtx_AND (SImode, shifted_n, mask));
++
++  emit_insn (gen_subword_atomic_cas_strong (old, aligned_mem,
++					    shifted_o, shifted_n,
++					    mask, not_mask));
++
++  emit_move_insn (old, gen_rtx_ASHIFTRT (SImode, old,
++					 gen_lowpart (QImode, shift)));
++
++  emit_move_insn (operands[0], gen_lowpart (<MODE>mode, old));
++
++  DONE;
++})
++
++(define_insn "subword_atomic_cas_strong"
++  [(set (match_operand:SI 0 "register_operand" "=&r")			   ;; old value at mem
++	(match_operand:SI 1 "memory_operand" "+A"))			   ;; mem location
++   (set (match_dup 1)
++	(unspec_volatile:SI [(match_operand:SI 2 "reg_or_0_operand" "rJ")  ;; expected value
++			     (match_operand:SI 3 "reg_or_0_operand" "rJ")] ;; desired value
++	 UNSPEC_COMPARE_AND_SWAP_SUBWORD))
++	(match_operand:SI 4 "register_operand" "rI")			   ;; mask
++	(match_operand:SI 5 "register_operand" "rI")			   ;; not_mask
++	(clobber (match_scratch:SI 6 "=&r"))]				   ;; tmp_1
++  "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++  {
++    return "1:\;"
++	   "lr.w.aq\t%0, %1\;"
++	   "and\t%6, %0, %4\;"
++	   "bne\t%6, %z2, 1f\;"
++	   "and\t%6, %0, %5\;"
++	   "or\t%6, %6, %3\;"
++	   "sc.w.rl\t%6, %6, %1\;"
++	   "bnez\t%6, 1b\;"
++	   "1:";
++  }
++  [(set (attr "length") (const_int 28))])
++
+ (define_expand "atomic_test_and_set"
+   [(match_operand:QI 0 "register_operand" "")     ;; bool output
+    (match_operand:QI 1 "memory_operand" "+A")    ;; memory
+--- a/gcc/doc/invoke.texi
++++ b/gcc/doc/invoke.texi
+@@ -1226,7 +1226,8 @@ See RS/6000 and PowerPC Options.
+ -mbig-endian  -mlittle-endian
+ -mstack-protector-guard=@var{guard}  -mstack-protector-guard-reg=@var{reg}
+ -mstack-protector-guard-offset=@var{offset}
+--mcsr-check -mno-csr-check}
++-mcsr-check -mno-csr-check
++-minline-atomics  -mno-inline-atomics}
+ 
+ @emph{RL78 Options}
+ @gccoptlist{-msim  -mmul=none  -mmul=g13  -mmul=g14  -mallregs
+@@ -29006,6 +29007,13 @@ Do or don't use smaller but slower prolo
+ library function calls.  The default is to use fast inline prologues and
+ epilogues.
+ 
++@opindex minline-atomics
++@item -minline-atomics
++@itemx -mno-inline-atomics
++Do or don't use smaller but slower subword atomic emulation code that uses
++libatomic function calls.  The default is to use fast inline subword atomics
++that do not require libatomic.
++
+ @opindex mshorten-memrefs
+ @item -mshorten-memrefs
+ @itemx -mno-shorten-memrefs
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-1.c
+@@ -0,0 +1,18 @@
++/* { dg-do compile } */
++/* { dg-options "-mno-inline-atomics" } */
++/* { dg-message "note: '__sync_fetch_and_nand' changed semantics in GCC 4.4" "fetch_and_nand" { target *-*-* } 0 } */
++/* { dg-final { scan-assembler "\tcall\t__sync_fetch_and_add_1" } } */
++/* { dg-final { scan-assembler "\tcall\t__sync_fetch_and_nand_1" } } */
++/* { dg-final { scan-assembler "\tcall\t__sync_bool_compare_and_swap_1" } } */
++
++char foo;
++char bar;
++char baz;
++
++int
++main ()
++{
++  __sync_fetch_and_add(&foo, 1);
++  __sync_fetch_and_nand(&bar, 1);
++  __sync_bool_compare_and_swap (&baz, 1, 2);
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-2.c
+@@ -0,0 +1,9 @@
++/* { dg-do compile } */
++/* Verify that subword atomics do not generate calls.  */
++/* { dg-options "-minline-atomics" } */
++/* { dg-message "note: '__sync_fetch_and_nand' changed semantics in GCC 4.4" "fetch_and_nand" { target *-*-* } 0 } */
++/* { dg-final { scan-assembler-not "\tcall\t__sync_fetch_and_add_1" } } */
++/* { dg-final { scan-assembler-not "\tcall\t__sync_fetch_and_nand_1" } } */
++/* { dg-final { scan-assembler-not "\tcall\t__sync_bool_compare_and_swap_1" } } */
++
++#include "inline-atomics-1.c"
+\ No newline at end of file
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-3.c
+@@ -0,0 +1,569 @@
++/* Check all char alignments.  */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-op-1.c */
++/* Test __atomic routines for existence and proper execution on 1 byte
++   values with each valid memory model.  */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics -Wno-address-of-packed-member" } */
++
++/* Test the execution of the __atomic_*OP builtin routines for a char.  */
++
++extern void abort(void);
++
++char count, res;
++const char init = ~0;
++
++struct A
++{
++   char a;
++   char b;
++   char c;
++   char d;
++} __attribute__ ((packed)) A;
++
++/* The fetch_op routines return the original value before the operation.  */
++
++void
++test_fetch_add (char* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_fetch_add (v, count, __ATOMIC_RELAXED) != 0)
++    abort ();
++
++  if (__atomic_fetch_add (v, 1, __ATOMIC_CONSUME) != 1)
++    abort ();
++
++  if (__atomic_fetch_add (v, count, __ATOMIC_ACQUIRE) != 2)
++    abort ();
++
++  if (__atomic_fetch_add (v, 1, __ATOMIC_RELEASE) != 3)
++    abort ();
++
++  if (__atomic_fetch_add (v, count, __ATOMIC_ACQ_REL) != 4)
++    abort ();
++
++  if (__atomic_fetch_add (v, 1, __ATOMIC_SEQ_CST) != 5)
++    abort ();
++}
++
++
++void
++test_fetch_sub (char* v)
++{
++  *v = res = 20;
++  count = 0;
++
++  if (__atomic_fetch_sub (v, count + 1, __ATOMIC_RELAXED) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, 1, __ATOMIC_CONSUME) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, count + 1, __ATOMIC_ACQUIRE) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, 1, __ATOMIC_RELEASE) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, count + 1, __ATOMIC_ACQ_REL) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, 1, __ATOMIC_SEQ_CST) !=  res--)
++    abort ();
++}
++
++void
++test_fetch_and (char* v)
++{
++  *v = init;
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_fetch_and (v, init, __ATOMIC_CONSUME) !=  0)
++    abort ();
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  *v = ~*v;
++  if (__atomic_fetch_and (v, init, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_SEQ_CST) !=  0)
++    abort ();
++}
++
++void
++test_fetch_nand (char* v)
++{
++  *v = init;
++
++  if (__atomic_fetch_nand (v, 0, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_fetch_nand (v, init, __ATOMIC_CONSUME) !=  init)
++    abort ();
++
++  if (__atomic_fetch_nand (v, 0, __ATOMIC_ACQUIRE) !=  0 )
++    abort ();
++
++  if (__atomic_fetch_nand (v, init, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_fetch_nand (v, init, __ATOMIC_ACQ_REL) !=  0)
++    abort ();
++
++  if (__atomic_fetch_nand (v, 0, __ATOMIC_SEQ_CST) !=  init)
++    abort ();
++}
++
++void
++test_fetch_xor (char* v)
++{
++  *v = init;
++  count = 0;
++
++  if (__atomic_fetch_xor (v, count, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_fetch_xor (v, ~count, __ATOMIC_CONSUME) !=  init)
++    abort ();
++
++  if (__atomic_fetch_xor (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  if (__atomic_fetch_xor (v, ~count, __ATOMIC_RELEASE) !=  0)
++    abort ();
++
++  if (__atomic_fetch_xor (v, 0, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_fetch_xor (v, ~count, __ATOMIC_SEQ_CST) !=  init)
++    abort ();
++}
++
++void
++test_fetch_or (char* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_fetch_or (v, count, __ATOMIC_RELAXED) !=  0)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, 2, __ATOMIC_CONSUME) !=  1)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, count, __ATOMIC_ACQUIRE) !=  3)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, 8, __ATOMIC_RELEASE) !=  7)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, count, __ATOMIC_ACQ_REL) !=  15)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, count, __ATOMIC_SEQ_CST) !=  31)
++    abort ();
++}
++
++/* The OP_fetch routines return the new value after the operation.  */
++
++void
++test_add_fetch (char* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_RELAXED) != 1)
++    abort ();
++
++  if (__atomic_add_fetch (v, 1, __ATOMIC_CONSUME) != 2)
++    abort ();
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_ACQUIRE) != 3)
++    abort ();
++
++  if (__atomic_add_fetch (v, 1, __ATOMIC_RELEASE) != 4)
++    abort ();
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_ACQ_REL) != 5)
++    abort ();
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_SEQ_CST) != 6)
++    abort ();
++}
++
++
++void
++test_sub_fetch (char* v)
++{
++  *v = res = 20;
++  count = 0;
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_RELAXED) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, 1, __ATOMIC_CONSUME) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_ACQUIRE) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, 1, __ATOMIC_RELEASE) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_ACQ_REL) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_SEQ_CST) !=  --res)
++    abort ();
++}
++
++void
++test_and_fetch (char* v)
++{
++  *v = init;
++
++  if (__atomic_and_fetch (v, 0, __ATOMIC_RELAXED) !=  0)
++    abort ();
++
++  *v = init;
++  if (__atomic_and_fetch (v, init, __ATOMIC_CONSUME) !=  init)
++    abort ();
++
++  if (__atomic_and_fetch (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  *v = ~*v;
++  if (__atomic_and_fetch (v, init, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_and_fetch (v, 0, __ATOMIC_ACQ_REL) !=  0)
++    abort ();
++
++  *v = ~*v;
++  if (__atomic_and_fetch (v, 0, __ATOMIC_SEQ_CST) !=  0)
++    abort ();
++}
++
++void
++test_nand_fetch (char* v)
++{
++  *v = init;
++
++  if (__atomic_nand_fetch (v, 0, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_nand_fetch (v, init, __ATOMIC_CONSUME) !=  0)
++    abort ();
++
++  if (__atomic_nand_fetch (v, 0, __ATOMIC_ACQUIRE) !=  init)
++    abort ();
++
++  if (__atomic_nand_fetch (v, init, __ATOMIC_RELEASE) !=  0)
++    abort ();
++
++  if (__atomic_nand_fetch (v, init, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_nand_fetch (v, 0, __ATOMIC_SEQ_CST) !=  init)
++    abort ();
++}
++
++
++
++void
++test_xor_fetch (char* v)
++{
++  *v = init;
++  count = 0;
++
++  if (__atomic_xor_fetch (v, count, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_xor_fetch (v, ~count, __ATOMIC_CONSUME) !=  0)
++    abort ();
++
++  if (__atomic_xor_fetch (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  if (__atomic_xor_fetch (v, ~count, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_xor_fetch (v, 0, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_xor_fetch (v, ~count, __ATOMIC_SEQ_CST) !=  0)
++    abort ();
++}
++
++void
++test_or_fetch (char* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_or_fetch (v, count, __ATOMIC_RELAXED) !=  1)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, 2, __ATOMIC_CONSUME) !=  3)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, count, __ATOMIC_ACQUIRE) !=  7)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, 8, __ATOMIC_RELEASE) !=  15)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, count, __ATOMIC_ACQ_REL) !=  31)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, count, __ATOMIC_SEQ_CST) !=  63)
++    abort ();
++}
++
++
++/* Test the OP routines with a result which isn't used. Use both variations
++   within each function.  */
++
++void
++test_add (char* v)
++{
++  *v = 0;
++  count = 1;
++
++  __atomic_add_fetch (v, count, __ATOMIC_RELAXED);
++  if (*v != 1)
++    abort ();
++
++  __atomic_fetch_add (v, count, __ATOMIC_CONSUME);
++  if (*v != 2)
++    abort ();
++
++  __atomic_add_fetch (v, 1 , __ATOMIC_ACQUIRE);
++  if (*v != 3)
++    abort ();
++
++  __atomic_fetch_add (v, 1, __ATOMIC_RELEASE);
++  if (*v != 4)
++    abort ();
++
++  __atomic_add_fetch (v, count, __ATOMIC_ACQ_REL);
++  if (*v != 5)
++    abort ();
++
++  __atomic_fetch_add (v, count, __ATOMIC_SEQ_CST);
++  if (*v != 6)
++    abort ();
++}
++
++
++void
++test_sub (char* v)
++{
++  *v = res = 20;
++  count = 0;
++
++  __atomic_sub_fetch (v, count + 1, __ATOMIC_RELAXED);
++  if (*v != --res)
++    abort ();
++
++  __atomic_fetch_sub (v, count + 1, __ATOMIC_CONSUME);
++  if (*v != --res)
++    abort ();
++
++  __atomic_sub_fetch (v, 1, __ATOMIC_ACQUIRE);
++  if (*v != --res)
++    abort ();
++
++  __atomic_fetch_sub (v, 1, __ATOMIC_RELEASE);
++  if (*v != --res)
++    abort ();
++
++  __atomic_sub_fetch (v, count + 1, __ATOMIC_ACQ_REL);
++  if (*v != --res)
++    abort ();
++
++  __atomic_fetch_sub (v, count + 1, __ATOMIC_SEQ_CST);
++  if (*v != --res)
++    abort ();
++}
++
++void
++test_and (char* v)
++{
++  *v = init;
++
++  __atomic_and_fetch (v, 0, __ATOMIC_RELAXED);
++  if (*v != 0)
++    abort ();
++
++  *v = init;
++  __atomic_fetch_and (v, init, __ATOMIC_CONSUME);
++  if (*v != init)
++    abort ();
++
++  __atomic_and_fetch (v, 0, __ATOMIC_ACQUIRE);
++  if (*v != 0)
++    abort ();
++
++  *v = ~*v;
++  __atomic_fetch_and (v, init, __ATOMIC_RELEASE);
++  if (*v != init)
++    abort ();
++
++  __atomic_and_fetch (v, 0, __ATOMIC_ACQ_REL);
++  if (*v != 0)
++    abort ();
++
++  *v = ~*v;
++  __atomic_fetch_and (v, 0, __ATOMIC_SEQ_CST);
++  if (*v != 0)
++    abort ();
++}
++
++void
++test_nand (char* v)
++{
++  *v = init;
++
++  __atomic_fetch_nand (v, 0, __ATOMIC_RELAXED);
++  if (*v != init)
++    abort ();
++
++  __atomic_fetch_nand (v, init, __ATOMIC_CONSUME);
++  if (*v != 0)
++    abort ();
++
++  __atomic_nand_fetch (v, 0, __ATOMIC_ACQUIRE);
++  if (*v != init)
++    abort ();
++
++  __atomic_nand_fetch (v, init, __ATOMIC_RELEASE);
++  if (*v != 0)
++    abort ();
++
++  __atomic_fetch_nand (v, init, __ATOMIC_ACQ_REL);
++  if (*v != init)
++    abort ();
++
++  __atomic_nand_fetch (v, 0, __ATOMIC_SEQ_CST);
++  if (*v != init)
++    abort ();
++}
++
++
++
++void
++test_xor (char* v)
++{
++  *v = init;
++  count = 0;
++
++  __atomic_xor_fetch (v, count, __ATOMIC_RELAXED);
++  if (*v != init)
++    abort ();
++
++  __atomic_fetch_xor (v, ~count, __ATOMIC_CONSUME);
++  if (*v != 0)
++    abort ();
++
++  __atomic_xor_fetch (v, 0, __ATOMIC_ACQUIRE);
++  if (*v != 0)
++    abort ();
++
++  __atomic_fetch_xor (v, ~count, __ATOMIC_RELEASE);
++  if (*v != init)
++    abort ();
++
++  __atomic_fetch_xor (v, 0, __ATOMIC_ACQ_REL);
++  if (*v != init)
++    abort ();
++
++  __atomic_xor_fetch (v, ~count, __ATOMIC_SEQ_CST);
++  if (*v != 0)
++    abort ();
++}
++
++void
++test_or (char* v)
++{
++  *v = 0;
++  count = 1;
++
++  __atomic_or_fetch (v, count, __ATOMIC_RELAXED);
++  if (*v != 1)
++    abort ();
++
++  count *= 2;
++  __atomic_fetch_or (v, count, __ATOMIC_CONSUME);
++  if (*v != 3)
++    abort ();
++
++  count *= 2;
++  __atomic_or_fetch (v, 4, __ATOMIC_ACQUIRE);
++  if (*v != 7)
++    abort ();
++
++  count *= 2;
++  __atomic_fetch_or (v, 8, __ATOMIC_RELEASE);
++  if (*v != 15)
++    abort ();
++
++  count *= 2;
++  __atomic_or_fetch (v, count, __ATOMIC_ACQ_REL);
++  if (*v != 31)
++    abort ();
++
++  count *= 2;
++  __atomic_fetch_or (v, count, __ATOMIC_SEQ_CST);
++  if (*v != 63)
++    abort ();
++}
++
++int
++main ()
++{
++  char* V[] = {&A.a, &A.b, &A.c, &A.d};
++
++  for (int i = 0; i < 4; i++) {
++    test_fetch_add (V[i]);
++    test_fetch_sub (V[i]);
++    test_fetch_and (V[i]);
++    test_fetch_nand (V[i]);
++    test_fetch_xor (V[i]);
++    test_fetch_or (V[i]);
++
++    test_add_fetch (V[i]);
++    test_sub_fetch (V[i]);
++    test_and_fetch (V[i]);
++    test_nand_fetch (V[i]);
++    test_xor_fetch (V[i]);
++    test_or_fetch (V[i]);
++
++    test_add (V[i]);
++    test_sub (V[i]);
++    test_and (V[i]);
++    test_nand (V[i]);
++    test_xor (V[i]);
++    test_or (V[i]);
++  }
++
++  return 0;
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-4.c
+@@ -0,0 +1,566 @@
++/* Check all short alignments.  */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-op-2.c */
++/* Test __atomic routines for existence and proper execution on 2 byte
++   values with each valid memory model.  */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics -Wno-address-of-packed-member" } */
++
++/* Test the execution of the __atomic_*OP builtin routines for a short.  */
++
++extern void abort(void);
++
++short count, res;
++const short init = ~0;
++
++struct A
++{
++   short a;
++   short b;
++} __attribute__ ((packed)) A;
++
++/* The fetch_op routines return the original value before the operation.  */
++
++void
++test_fetch_add (short* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_fetch_add (v, count, __ATOMIC_RELAXED) != 0)
++    abort ();
++
++  if (__atomic_fetch_add (v, 1, __ATOMIC_CONSUME) != 1)
++    abort ();
++
++  if (__atomic_fetch_add (v, count, __ATOMIC_ACQUIRE) != 2)
++    abort ();
++
++  if (__atomic_fetch_add (v, 1, __ATOMIC_RELEASE) != 3)
++    abort ();
++
++  if (__atomic_fetch_add (v, count, __ATOMIC_ACQ_REL) != 4)
++    abort ();
++
++  if (__atomic_fetch_add (v, 1, __ATOMIC_SEQ_CST) != 5)
++    abort ();
++}
++
++
++void
++test_fetch_sub (short* v)
++{
++  *v = res = 20;
++  count = 0;
++
++  if (__atomic_fetch_sub (v, count + 1, __ATOMIC_RELAXED) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, 1, __ATOMIC_CONSUME) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, count + 1, __ATOMIC_ACQUIRE) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, 1, __ATOMIC_RELEASE) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, count + 1, __ATOMIC_ACQ_REL) !=  res--)
++    abort ();
++
++  if (__atomic_fetch_sub (v, 1, __ATOMIC_SEQ_CST) !=  res--)
++    abort ();
++}
++
++void
++test_fetch_and (short* v)
++{
++  *v = init;
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_fetch_and (v, init, __ATOMIC_CONSUME) !=  0)
++    abort ();
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  *v = ~*v;
++  if (__atomic_fetch_and (v, init, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_fetch_and (v, 0, __ATOMIC_SEQ_CST) !=  0)
++    abort ();
++}
++
++void
++test_fetch_nand (short* v)
++{
++  *v = init;
++
++  if (__atomic_fetch_nand (v, 0, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_fetch_nand (v, init, __ATOMIC_CONSUME) !=  init)
++    abort ();
++
++  if (__atomic_fetch_nand (v, 0, __ATOMIC_ACQUIRE) !=  0 )
++    abort ();
++
++  if (__atomic_fetch_nand (v, init, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_fetch_nand (v, init, __ATOMIC_ACQ_REL) !=  0)
++    abort ();
++
++  if (__atomic_fetch_nand (v, 0, __ATOMIC_SEQ_CST) !=  init)
++    abort ();
++}
++
++void
++test_fetch_xor (short* v)
++{
++  *v = init;
++  count = 0;
++
++  if (__atomic_fetch_xor (v, count, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_fetch_xor (v, ~count, __ATOMIC_CONSUME) !=  init)
++    abort ();
++
++  if (__atomic_fetch_xor (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  if (__atomic_fetch_xor (v, ~count, __ATOMIC_RELEASE) !=  0)
++    abort ();
++
++  if (__atomic_fetch_xor (v, 0, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_fetch_xor (v, ~count, __ATOMIC_SEQ_CST) !=  init)
++    abort ();
++}
++
++void
++test_fetch_or (short* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_fetch_or (v, count, __ATOMIC_RELAXED) !=  0)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, 2, __ATOMIC_CONSUME) !=  1)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, count, __ATOMIC_ACQUIRE) !=  3)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, 8, __ATOMIC_RELEASE) !=  7)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, count, __ATOMIC_ACQ_REL) !=  15)
++    abort ();
++
++  count *= 2;
++  if (__atomic_fetch_or (v, count, __ATOMIC_SEQ_CST) !=  31)
++    abort ();
++}
++
++/* The OP_fetch routines return the new value after the operation.  */
++
++void
++test_add_fetch (short* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_RELAXED) != 1)
++    abort ();
++
++  if (__atomic_add_fetch (v, 1, __ATOMIC_CONSUME) != 2)
++    abort ();
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_ACQUIRE) != 3)
++    abort ();
++
++  if (__atomic_add_fetch (v, 1, __ATOMIC_RELEASE) != 4)
++    abort ();
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_ACQ_REL) != 5)
++    abort ();
++
++  if (__atomic_add_fetch (v, count, __ATOMIC_SEQ_CST) != 6)
++    abort ();
++}
++
++
++void
++test_sub_fetch (short* v)
++{
++  *v = res = 20;
++  count = 0;
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_RELAXED) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, 1, __ATOMIC_CONSUME) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_ACQUIRE) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, 1, __ATOMIC_RELEASE) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_ACQ_REL) !=  --res)
++    abort ();
++
++  if (__atomic_sub_fetch (v, count + 1, __ATOMIC_SEQ_CST) !=  --res)
++    abort ();
++}
++
++void
++test_and_fetch (short* v)
++{
++  *v = init;
++
++  if (__atomic_and_fetch (v, 0, __ATOMIC_RELAXED) !=  0)
++    abort ();
++
++  *v = init;
++  if (__atomic_and_fetch (v, init, __ATOMIC_CONSUME) !=  init)
++    abort ();
++
++  if (__atomic_and_fetch (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  *v = ~*v;
++  if (__atomic_and_fetch (v, init, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_and_fetch (v, 0, __ATOMIC_ACQ_REL) !=  0)
++    abort ();
++
++  *v = ~*v;
++  if (__atomic_and_fetch (v, 0, __ATOMIC_SEQ_CST) !=  0)
++    abort ();
++}
++
++void
++test_nand_fetch (short* v)
++{
++  *v = init;
++
++  if (__atomic_nand_fetch (v, 0, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_nand_fetch (v, init, __ATOMIC_CONSUME) !=  0)
++    abort ();
++
++  if (__atomic_nand_fetch (v, 0, __ATOMIC_ACQUIRE) !=  init)
++    abort ();
++
++  if (__atomic_nand_fetch (v, init, __ATOMIC_RELEASE) !=  0)
++    abort ();
++
++  if (__atomic_nand_fetch (v, init, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_nand_fetch (v, 0, __ATOMIC_SEQ_CST) !=  init)
++    abort ();
++}
++
++
++
++void
++test_xor_fetch (short* v)
++{
++  *v = init;
++  count = 0;
++
++  if (__atomic_xor_fetch (v, count, __ATOMIC_RELAXED) !=  init)
++    abort ();
++
++  if (__atomic_xor_fetch (v, ~count, __ATOMIC_CONSUME) !=  0)
++    abort ();
++
++  if (__atomic_xor_fetch (v, 0, __ATOMIC_ACQUIRE) !=  0)
++    abort ();
++
++  if (__atomic_xor_fetch (v, ~count, __ATOMIC_RELEASE) !=  init)
++    abort ();
++
++  if (__atomic_xor_fetch (v, 0, __ATOMIC_ACQ_REL) !=  init)
++    abort ();
++
++  if (__atomic_xor_fetch (v, ~count, __ATOMIC_SEQ_CST) !=  0)
++    abort ();
++}
++
++void
++test_or_fetch (short* v)
++{
++  *v = 0;
++  count = 1;
++
++  if (__atomic_or_fetch (v, count, __ATOMIC_RELAXED) !=  1)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, 2, __ATOMIC_CONSUME) !=  3)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, count, __ATOMIC_ACQUIRE) !=  7)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, 8, __ATOMIC_RELEASE) !=  15)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, count, __ATOMIC_ACQ_REL) !=  31)
++    abort ();
++
++  count *= 2;
++  if (__atomic_or_fetch (v, count, __ATOMIC_SEQ_CST) !=  63)
++    abort ();
++}
++
++
++/* Test the OP routines with a result which isn't used. Use both variations
++   within each function.  */
++
++void
++test_add (short* v)
++{
++  *v = 0;
++  count = 1;
++
++  __atomic_add_fetch (v, count, __ATOMIC_RELAXED);
++  if (*v != 1)
++    abort ();
++
++  __atomic_fetch_add (v, count, __ATOMIC_CONSUME);
++  if (*v != 2)
++    abort ();
++
++  __atomic_add_fetch (v, 1 , __ATOMIC_ACQUIRE);
++  if (*v != 3)
++    abort ();
++
++  __atomic_fetch_add (v, 1, __ATOMIC_RELEASE);
++  if (*v != 4)
++    abort ();
++
++  __atomic_add_fetch (v, count, __ATOMIC_ACQ_REL);
++  if (*v != 5)
++    abort ();
++
++  __atomic_fetch_add (v, count, __ATOMIC_SEQ_CST);
++  if (*v != 6)
++    abort ();
++}
++
++
++void
++test_sub (short* v)
++{
++  *v = res = 20;
++  count = 0;
++
++  __atomic_sub_fetch (v, count + 1, __ATOMIC_RELAXED);
++  if (*v != --res)
++    abort ();
++
++  __atomic_fetch_sub (v, count + 1, __ATOMIC_CONSUME);
++  if (*v != --res)
++    abort ();
++
++  __atomic_sub_fetch (v, 1, __ATOMIC_ACQUIRE);
++  if (*v != --res)
++    abort ();
++
++  __atomic_fetch_sub (v, 1, __ATOMIC_RELEASE);
++  if (*v != --res)
++    abort ();
++
++  __atomic_sub_fetch (v, count + 1, __ATOMIC_ACQ_REL);
++  if (*v != --res)
++    abort ();
++
++  __atomic_fetch_sub (v, count + 1, __ATOMIC_SEQ_CST);
++  if (*v != --res)
++    abort ();
++}
++
++void
++test_and (short* v)
++{
++  *v = init;
++
++  __atomic_and_fetch (v, 0, __ATOMIC_RELAXED);
++  if (*v != 0)
++    abort ();
++
++  *v = init;
++  __atomic_fetch_and (v, init, __ATOMIC_CONSUME);
++  if (*v != init)
++    abort ();
++
++  __atomic_and_fetch (v, 0, __ATOMIC_ACQUIRE);
++  if (*v != 0)
++    abort ();
++
++  *v = ~*v;
++  __atomic_fetch_and (v, init, __ATOMIC_RELEASE);
++  if (*v != init)
++    abort ();
++
++  __atomic_and_fetch (v, 0, __ATOMIC_ACQ_REL);
++  if (*v != 0)
++    abort ();
++
++  *v = ~*v;
++  __atomic_fetch_and (v, 0, __ATOMIC_SEQ_CST);
++  if (*v != 0)
++    abort ();
++}
++
++void
++test_nand (short* v)
++{
++  *v = init;
++
++  __atomic_fetch_nand (v, 0, __ATOMIC_RELAXED);
++  if (*v != init)
++    abort ();
++
++  __atomic_fetch_nand (v, init, __ATOMIC_CONSUME);
++  if (*v != 0)
++    abort ();
++
++  __atomic_nand_fetch (v, 0, __ATOMIC_ACQUIRE);
++  if (*v != init)
++    abort ();
++
++  __atomic_nand_fetch (v, init, __ATOMIC_RELEASE);
++  if (*v != 0)
++    abort ();
++
++  __atomic_fetch_nand (v, init, __ATOMIC_ACQ_REL);
++  if (*v != init)
++    abort ();
++
++  __atomic_nand_fetch (v, 0, __ATOMIC_SEQ_CST);
++  if (*v != init)
++    abort ();
++}
++
++
++
++void
++test_xor (short* v)
++{
++  *v = init;
++  count = 0;
++
++  __atomic_xor_fetch (v, count, __ATOMIC_RELAXED);
++  if (*v != init)
++    abort ();
++
++  __atomic_fetch_xor (v, ~count, __ATOMIC_CONSUME);
++  if (*v != 0)
++    abort ();
++
++  __atomic_xor_fetch (v, 0, __ATOMIC_ACQUIRE);
++  if (*v != 0)
++    abort ();
++
++  __atomic_fetch_xor (v, ~count, __ATOMIC_RELEASE);
++  if (*v != init)
++    abort ();
++
++  __atomic_fetch_xor (v, 0, __ATOMIC_ACQ_REL);
++  if (*v != init)
++    abort ();
++
++  __atomic_xor_fetch (v, ~count, __ATOMIC_SEQ_CST);
++  if (*v != 0)
++    abort ();
++}
++
++void
++test_or (short* v)
++{
++  *v = 0;
++  count = 1;
++
++  __atomic_or_fetch (v, count, __ATOMIC_RELAXED);
++  if (*v != 1)
++    abort ();
++
++  count *= 2;
++  __atomic_fetch_or (v, count, __ATOMIC_CONSUME);
++  if (*v != 3)
++    abort ();
++
++  count *= 2;
++  __atomic_or_fetch (v, 4, __ATOMIC_ACQUIRE);
++  if (*v != 7)
++    abort ();
++
++  count *= 2;
++  __atomic_fetch_or (v, 8, __ATOMIC_RELEASE);
++  if (*v != 15)
++    abort ();
++
++  count *= 2;
++  __atomic_or_fetch (v, count, __ATOMIC_ACQ_REL);
++  if (*v != 31)
++    abort ();
++
++  count *= 2;
++  __atomic_fetch_or (v, count, __ATOMIC_SEQ_CST);
++  if (*v != 63)
++    abort ();
++}
++
++int
++main () {
++  short* V[] = {&A.a, &A.b};
++
++  for (int i = 0; i < 2; i++) {
++    test_fetch_add (V[i]);
++    test_fetch_sub (V[i]);
++    test_fetch_and (V[i]);
++    test_fetch_nand (V[i]);
++    test_fetch_xor (V[i]);
++    test_fetch_or (V[i]);
++
++    test_add_fetch (V[i]);
++    test_sub_fetch (V[i]);
++    test_and_fetch (V[i]);
++    test_nand_fetch (V[i]);
++    test_xor_fetch (V[i]);
++    test_or_fetch (V[i]);
++
++    test_add (V[i]);
++    test_sub (V[i]);
++    test_and (V[i]);
++    test_nand (V[i]);
++    test_xor (V[i]);
++    test_or (V[i]);
++  }
++
++  return 0;
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-5.c
+@@ -0,0 +1,87 @@
++/* Test __atomic routines for existence and proper execution on 1 byte
++   values with each valid memory model.  */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-compare-exchange-1.c */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics" } */
++
++/* Test the execution of the __atomic_compare_exchange_n builtin for a char.  */
++
++extern void abort(void);
++
++char v = 0;
++char expected = 0;
++char max = ~0;
++char desired = ~0;
++char zero = 0;
++
++#define STRONG 0
++#define WEAK 1
++
++int
++main ()
++{
++
++  if (!__atomic_compare_exchange_n (&v, &expected, max, STRONG , __ATOMIC_RELAXED, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (__atomic_compare_exchange_n (&v, &expected, 0, STRONG , __ATOMIC_ACQUIRE, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != max)
++    abort ();
++
++  if (!__atomic_compare_exchange_n (&v, &expected, 0, STRONG , __ATOMIC_RELEASE, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != max)
++    abort ();
++  if (v != 0)
++    abort ();
++
++  if (__atomic_compare_exchange_n (&v, &expected, desired, WEAK, __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (!__atomic_compare_exchange_n (&v, &expected, desired, STRONG , __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST))
++    abort ();
++  if (expected != 0)
++    abort ();
++  if (v != max)
++    abort ();
++
++  /* Now test the generic version.  */
++
++  v = 0;
++
++  if (!__atomic_compare_exchange (&v, &expected, &max, STRONG, __ATOMIC_RELAXED, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (__atomic_compare_exchange (&v, &expected, &zero, STRONG , __ATOMIC_ACQUIRE, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != max)
++    abort ();
++
++  if (!__atomic_compare_exchange (&v, &expected, &zero, STRONG , __ATOMIC_RELEASE, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != max)
++    abort ();
++  if (v != 0)
++    abort ();
++
++  if (__atomic_compare_exchange (&v, &expected, &desired, WEAK, __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (!__atomic_compare_exchange (&v, &expected, &desired, STRONG , __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST))
++    abort ();
++  if (expected != 0)
++    abort ();
++  if (v != max)
++    abort ();
++
++  return 0;
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-6.c
+@@ -0,0 +1,87 @@
++/* Test __atomic routines for existence and proper execution on 2 byte
++   values with each valid memory model.  */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-compare-exchange-2.c */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics" } */
++
++/* Test the execution of the __atomic_compare_exchange_n builtin for a short.  */
++
++extern void abort(void);
++
++short v = 0;
++short expected = 0;
++short max = ~0;
++short desired = ~0;
++short zero = 0;
++
++#define STRONG 0
++#define WEAK 1
++
++int
++main ()
++{
++
++  if (!__atomic_compare_exchange_n (&v, &expected, max, STRONG , __ATOMIC_RELAXED, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (__atomic_compare_exchange_n (&v, &expected, 0, STRONG , __ATOMIC_ACQUIRE, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != max)
++    abort ();
++
++  if (!__atomic_compare_exchange_n (&v, &expected, 0, STRONG , __ATOMIC_RELEASE, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != max)
++    abort ();
++  if (v != 0)
++    abort ();
++
++  if (__atomic_compare_exchange_n (&v, &expected, desired, WEAK, __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (!__atomic_compare_exchange_n (&v, &expected, desired, STRONG , __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST))
++    abort ();
++  if (expected != 0)
++    abort ();
++  if (v != max)
++    abort ();
++
++  /* Now test the generic version.  */
++
++  v = 0;
++
++  if (!__atomic_compare_exchange (&v, &expected, &max, STRONG, __ATOMIC_RELAXED, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (__atomic_compare_exchange (&v, &expected, &zero, STRONG , __ATOMIC_ACQUIRE, __ATOMIC_RELAXED))
++    abort ();
++  if (expected != max)
++    abort ();
++
++  if (!__atomic_compare_exchange (&v, &expected, &zero, STRONG , __ATOMIC_RELEASE, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != max)
++    abort ();
++  if (v != 0)
++    abort ();
++
++  if (__atomic_compare_exchange (&v, &expected, &desired, WEAK, __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE))
++    abort ();
++  if (expected != 0)
++    abort ();
++
++  if (!__atomic_compare_exchange (&v, &expected, &desired, STRONG , __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST))
++    abort ();
++  if (expected != 0)
++    abort ();
++  if (v != max)
++    abort ();
++
++  return 0;
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-7.c
+@@ -0,0 +1,69 @@
++/* Test __atomic routines for existence and proper execution on 1 byte
++   values with each valid memory model.  */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-exchange-1.c */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics" } */
++
++/* Test the execution of the __atomic_exchange_n builtin for a char.  */
++
++extern void abort(void);
++
++char v, count, ret;
++
++int
++main ()
++{
++  v = 0;
++  count = 0;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_RELAXED) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_ACQUIRE) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_RELEASE) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_ACQ_REL) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_SEQ_CST) != count)
++    abort ();
++  count++;
++
++  /* Now test the generic version.  */
++
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_RELAXED);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_ACQUIRE);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_RELEASE);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_ACQ_REL);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_SEQ_CST);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  return 0;
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-8.c
+@@ -0,0 +1,69 @@
++/* Test __atomic routines for existence and proper execution on 2 byte
++   values with each valid memory model.  */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-exchange-2.c */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics" } */
++
++/* Test the execution of the __atomic_X builtin for a short.  */
++
++extern void abort(void);
++
++short v, count, ret;
++
++int
++main ()
++{
++  v = 0;
++  count = 0;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_RELAXED) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_ACQUIRE) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_RELEASE) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_ACQ_REL) != count)
++    abort ();
++  count++;
++
++  if (__atomic_exchange_n (&v, count + 1, __ATOMIC_SEQ_CST) != count)
++    abort ();
++  count++;
++
++  /* Now test the generic version.  */
++
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_RELAXED);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_ACQUIRE);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_RELEASE);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_ACQ_REL);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  __atomic_exchange (&v, &count, &ret, __ATOMIC_SEQ_CST);
++  if (ret != count - 1 || v != count)
++    abort ();
++  count++;
++
++  return 0;
++}
+--- a/libgcc/config/riscv/atomic.c
++++ b/libgcc/config/riscv/atomic.c
+@@ -30,6 +30,8 @@ see the files COPYING3 and COPYING.RUNTI
+ #define INVERT		"not %[tmp1], %[tmp1]\n\t"
+ #define DONT_INVERT	""
+ 
++/* Logic duplicated in gcc/gcc/config/riscv/sync.md for use when inlining is enabled */
++
+ #define GENERATE_FETCH_AND_OP(type, size, opname, insn, invert, cop)	\
+   type __sync_fetch_and_ ## opname ## _ ## size (type *p, type v)	\
+   {									\
diff --git a/toolchain/gcc/patches-13.x/701-riscv-linux-Don-t-add-latomic-with-pthread.patch b/toolchain/gcc/patches-13.x/701-riscv-linux-Don-t-add-latomic-with-pthread.patch
new file mode 100644
index 00000000000000..328c7be9ce8ec4
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/701-riscv-linux-Don-t-add-latomic-with-pthread.patch
@@ -0,0 +1,36 @@
+From 203f3060dd363361b172f7295f42bb6bf5ac0b3b Mon Sep 17 00:00:00 2001
+From: Andreas Schwab <schwab@suse.de>
+Date: Sat, 23 Apr 2022 15:48:42 +0200
+Subject: [PATCH] riscv/linux: Don't add -latomic with -pthread
+
+Now that we have support for inline subword atomic operations, it is no
+longer necessary to link against libatomic.  This also fixes testsuite
+failures because the framework does not properly set up the linker flags
+for finding libatomic.
+The use of atomic operations is also independent of the use of libpthread.
+
+gcc/
+	* config/riscv/linux.h (LIB_SPEC): Don't redefine.
+---
+ gcc/config/riscv/linux.h | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+--- a/gcc/config/riscv/linux.h
++++ b/gcc/config/riscv/linux.h
+@@ -35,16 +35,6 @@ along with GCC; see the file COPYING3.
+ #undef MUSL_DYNAMIC_LINKER
+ #define MUSL_DYNAMIC_LINKER "/lib/ld-musl-riscv" XLEN_SPEC MUSL_ABI_SUFFIX ".so.1"
+ 
+-/* Because RISC-V only has word-sized atomics, it requries libatomic where
+-   others do not.  So link libatomic by default, as needed.  */
+-#undef LIB_SPEC
+-#ifdef LD_AS_NEEDED_OPTION
+-#define LIB_SPEC GNU_USER_TARGET_LIB_SPEC \
+-  " %{pthread:" LD_AS_NEEDED_OPTION " -latomic " LD_NO_AS_NEEDED_OPTION "}"
+-#else
+-#define LIB_SPEC GNU_USER_TARGET_LIB_SPEC " -latomic "
+-#endif
+-
+ #define ICACHE_FLUSH_FUNC "__riscv_flush_icache"
+ 
+ #define CPP_SPEC "%{pthread:-D_REENTRANT}"
diff --git a/toolchain/gcc/patches-13.x/810-arm-softfloat-libgcc.patch b/toolchain/gcc/patches-13.x/810-arm-softfloat-libgcc.patch
new file mode 100644
index 00000000000000..5c9d86aead7325
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/810-arm-softfloat-libgcc.patch
@@ -0,0 +1,33 @@
+commit 8570c4be394cff7282f332f97da2ff569a927ddb
+Author: Imre Kaloz <kaloz@openwrt.org>
+Date:   Wed Feb 2 20:06:12 2011 +0000
+
+    fixup arm soft-float symbols
+    
+    SVN-Revision: 25325
+
+--- a/libgcc/config/arm/t-linux
++++ b/libgcc/config/arm/t-linux
+@@ -1,6 +1,10 @@
+ LIB1ASMSRC = arm/lib1funcs.S
+ LIB1ASMFUNCS = _udivsi3 _divsi3 _umodsi3 _modsi3 _dvmd_lnx _clzsi2 _clzdi2 \
+-	_ctzsi2 _arm_addsubdf3 _arm_addsubsf3
++	_ctzsi2 _arm_addsubdf3 _arm_addsubsf3 \
++	_arm_negdf2 _arm_muldivdf3 _arm_cmpdf2 _arm_unorddf2 \
++	_arm_fixdfsi _arm_fixunsdfsi _arm_truncdfsf2 \
++	_arm_negsf2 _arm_muldivsf3 _arm_cmpsf2 _arm_unordsf2 \
++	_arm_fixsfsi _arm_fixunssfsi
+ 
+ # Just for these, we omit the frame pointer since it makes such a big
+ # difference.
+--- a/gcc/config/arm/linux-elf.h
++++ b/gcc/config/arm/linux-elf.h
+@@ -58,8 +58,6 @@
+    %{shared:-lc} \
+    %{!shared:%{profile:-lc_p}%{!profile:-lc}}"
+ 
+-#define LIBGCC_SPEC "%{mfloat-abi=soft*:-lfloat} -lgcc"
+-
+ #define GLIBC_DYNAMIC_LINKER "/lib/ld-linux.so.2"
+ 
+ #define LINUX_TARGET_LINK_SPEC  "%{h*} \
diff --git a/toolchain/gcc/patches-13.x/820-libgcc_pic.patch b/toolchain/gcc/patches-13.x/820-libgcc_pic.patch
new file mode 100644
index 00000000000000..7d102981904fcd
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/820-libgcc_pic.patch
@@ -0,0 +1,44 @@
+commit c96312958c0621e72c9b32da5bc224ffe2161384
+Author: Felix Fietkau <nbd@openwrt.org>
+Date:   Mon Oct 19 23:26:09 2009 +0000
+
+    gcc: create a proper libgcc_pic.a static library for relinking (4.3.3+ for now, backport will follow)
+    
+    SVN-Revision: 18086
+
+--- a/libgcc/Makefile.in
++++ b/libgcc/Makefile.in
+@@ -933,11 +933,12 @@ $(libgcov-driver-objects): %$(objext): $
+ 
+ # Static libraries.
+ libgcc.a: $(libgcc-objects)
++libgcc_pic.a: $(libgcc-s-objects)
+ libgcov.a: $(libgcov-objects)
+ libunwind.a: $(libunwind-objects)
+ libgcc_eh.a: $(libgcc-eh-objects)
+ 
+-libgcc.a libgcov.a libunwind.a libgcc_eh.a:
++libgcc.a libgcov.a libunwind.a libgcc_eh.a libgcc_pic.a:
+ 	-rm -f $@
+ 
+ 	objects="$(objects)";					\
+@@ -961,7 +962,7 @@ all: libunwind.a
+ endif
+ 
+ ifeq ($(enable_shared),yes)
+-all: libgcc_eh.a libgcc_s$(SHLIB_EXT)
++all: libgcc_eh.a libgcc_pic.a libgcc_s$(SHLIB_EXT)
+ ifneq ($(LIBUNWIND),)
+ all: libunwind$(SHLIB_EXT)
+ libgcc_s$(SHLIB_EXT): libunwind$(SHLIB_EXT)
+@@ -1167,6 +1168,10 @@ install-shared:
+ 	chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_eh.a
+ 	$(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_eh.a
+ 
++	$(INSTALL_DATA) libgcc_pic.a $(mapfile) $(DESTDIR)$(inst_libdir)/
++	chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_pic.a
++	$(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_pic.a
++
+ 	$(subst @multilib_dir@,$(MULTIDIR),$(subst \
+ 		@shlib_base_name@,libgcc_s,$(subst \
+ 		@shlib_slibdir_qual@,$(MULTIOSSUBDIR),$(SHLIB_INSTALL))))
diff --git a/toolchain/gcc/patches-13.x/840-armv4_pass_fix-v4bx_to_ld.patch b/toolchain/gcc/patches-13.x/840-armv4_pass_fix-v4bx_to_ld.patch
new file mode 100644
index 00000000000000..82935f3d1d0bfa
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/840-armv4_pass_fix-v4bx_to_ld.patch
@@ -0,0 +1,28 @@
+commit 7edc8ca5456d9743dd0075eb3cc5b04f4f24c8cc
+Author: Imre Kaloz <kaloz@openwrt.org>
+Date:   Wed Feb 2 19:34:36 2011 +0000
+
+    add armv4 fixup patches
+    
+    SVN-Revision: 25322
+
+
+--- a/gcc/config/arm/linux-eabi.h
++++ b/gcc/config/arm/linux-eabi.h
+@@ -88,10 +88,15 @@
+ #define MUSL_DYNAMIC_LINKER \
+   "/lib/ld-musl-arm" MUSL_DYNAMIC_LINKER_E "%{mfloat-abi=hard:hf}%{mfdpic:-fdpic}.so.1"
+ 
++/* For armv4 we pass --fix-v4bx to linker to support EABI */
++#undef TARGET_FIX_V4BX_SPEC
++#define TARGET_FIX_V4BX_SPEC " %{mcpu=arm8|mcpu=arm810|mcpu=strongarm*"\
++  "|march=armv4|mcpu=fa526|mcpu=fa626:--fix-v4bx}"
++
+ /* At this point, bpabi.h will have clobbered LINK_SPEC.  We want to
+    use the GNU/Linux version, not the generic BPABI version.  */
+ #undef  LINK_SPEC
+-#define LINK_SPEC EABI_LINK_SPEC					\
++#define LINK_SPEC EABI_LINK_SPEC TARGET_FIX_V4BX_SPEC			\
+   LINUX_OR_ANDROID_LD (LINUX_TARGET_LINK_SPEC,				\
+ 		       LINUX_TARGET_LINK_SPEC " " ANDROID_LINK_SPEC)
+ 
diff --git a/toolchain/gcc/patches-13.x/850-use_shared_libgcc.patch b/toolchain/gcc/patches-13.x/850-use_shared_libgcc.patch
new file mode 100644
index 00000000000000..f4505ee70ffdc8
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/850-use_shared_libgcc.patch
@@ -0,0 +1,54 @@
+commit dcfc40358b5a3cae7320c17f8d1cebd5ad5540cd
+Author: Felix Fietkau <nbd@openwrt.org>
+Date:   Sun Feb 12 20:25:47 2012 +0000
+
+    gcc 4.6: port over the missing patch 850-use_shared_libgcc.patch to prevent libgcc crap from leaking into every single binary
+    
+    SVN-Revision: 30486
+--- a/gcc/config/arm/linux-eabi.h
++++ b/gcc/config/arm/linux-eabi.h
+@@ -129,10 +129,6 @@
+   "%{Ofast|ffast-math|funsafe-math-optimizations:%{!shared:crtfastmath.o%s}} "	\
+   LINUX_OR_ANDROID_LD (GNU_USER_TARGET_ENDFILE_SPEC, ANDROID_ENDFILE_SPEC)
+ 
+-/* Use the default LIBGCC_SPEC, not the version in linux-elf.h, as we
+-   do not use -lfloat.  */
+-#undef LIBGCC_SPEC
+-
+ /* Clear the instruction cache from `beg' to `end'.  This is
+    implemented in lib1funcs.S, so ensure an error if this definition
+    is used.  */
+--- a/gcc/config/linux.h
++++ b/gcc/config/linux.h
+@@ -58,6 +58,10 @@ see the files COPYING3 and COPYING.RUNTI
+ 	builtin_assert ("system=posix");			\
+     } while (0)
+ 
++#ifndef LIBGCC_SPEC
++#define LIBGCC_SPEC "%{static|static-libgcc:-lgcc}%{!static:%{!static-libgcc:-lgcc_s}}"
++#endif
++
+ /* Determine which dynamic linker to use depending on whether GLIBC or
+    uClibc or Bionic or musl is the default C library and whether
+    -muclibc or -mglibc or -mbionic or -mmusl has been passed to change
+--- a/libgcc/mkmap-symver.awk
++++ b/libgcc/mkmap-symver.awk
+@@ -136,5 +136,5 @@ function output(lib) {
+   else if (inherit[lib])
+     printf("} %s;\n", inherit[lib]);
+   else
+-    printf ("\n  local:\n\t*;\n};\n");
++    printf ("\n\t*;\n};\n");
+ }
+--- a/gcc/config/rs6000/linux.h
++++ b/gcc/config/rs6000/linux.h
+@@ -67,6 +67,9 @@
+ #undef	CPP_OS_DEFAULT_SPEC
+ #define CPP_OS_DEFAULT_SPEC "%(cpp_os_linux)"
+ 
++#undef LIBGCC_SPEC
++#define LIBGCC_SPEC "%{!static:%{!static-libgcc:-lgcc_s}} -lgcc"
++
+ #undef  LINK_SHLIB_SPEC
+ #define LINK_SHLIB_SPEC "%{shared:-shared} %{!shared: %{static:-static}} \
+   %{static-pie:-static -pie --no-dynamic-linker -z text}"
diff --git a/toolchain/gcc/patches-13.x/851-libgcc_no_compat.patch b/toolchain/gcc/patches-13.x/851-libgcc_no_compat.patch
new file mode 100644
index 00000000000000..d710e407174717
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/851-libgcc_no_compat.patch
@@ -0,0 +1,22 @@
+commit 64661de100da1ec1061ef3e5e400285dce115e6b
+Author: Felix Fietkau <nbd@openwrt.org>
+Date:   Sun May 10 13:16:35 2015 +0000
+
+    gcc: add some size optimization patches
+    
+    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+    
+    SVN-Revision: 45664
+
+--- a/libgcc/config/t-libunwind
++++ b/libgcc/config/t-libunwind
+@@ -2,8 +2,7 @@
+ 
+ HOST_LIBGCC2_CFLAGS += -DUSE_GAS_SYMVER
+ 
+-LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c \
+-  $(srcdir)/unwind-compat.c $(srcdir)/unwind-dw2-fde-compat.c
++LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
+ LIB2ADDEHSTATIC = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
+ 
+ # Override the default value from t-slibgcc-elf-ver and mention -lunwind
diff --git a/toolchain/gcc/patches-13.x/870-ppc_no_crtsavres.patch b/toolchain/gcc/patches-13.x/870-ppc_no_crtsavres.patch
new file mode 100644
index 00000000000000..0dca68899eb090
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/870-ppc_no_crtsavres.patch
@@ -0,0 +1,11 @@
+--- a/gcc/config/rs6000/rs6000-logue.cc
++++ b/gcc/config/rs6000/rs6000-logue.cc
+@@ -344,7 +344,7 @@ rs6000_savres_strategy (rs6000_stack_t *
+   /* Define cutoff for using out-of-line functions to save registers.  */
+   if (DEFAULT_ABI == ABI_V4 || TARGET_ELF)
+     {
+-      if (!optimize_size)
++      if (1)
+ 	{
+ 	  strategy |= SAVE_INLINE_FPRS | REST_INLINE_FPRS;
+ 	  strategy |= SAVE_INLINE_GPRS | REST_INLINE_GPRS;
diff --git a/toolchain/gcc/patches-13.x/881-no_tm_section.patch b/toolchain/gcc/patches-13.x/881-no_tm_section.patch
new file mode 100644
index 00000000000000..2029910fd07926
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/881-no_tm_section.patch
@@ -0,0 +1,11 @@
+--- a/libgcc/crtstuff.c
++++ b/libgcc/crtstuff.c
+@@ -152,7 +152,7 @@ call_ ## FUNC (void)					\
+ #endif
+ 
+ #if !defined(USE_TM_CLONE_REGISTRY) && defined(OBJECT_FORMAT_ELF)
+-# define USE_TM_CLONE_REGISTRY 1
++# define USE_TM_CLONE_REGISTRY 0
+ #elif !defined(USE_TM_CLONE_REGISTRY)
+ # define USE_TM_CLONE_REGISTRY 0
+ #endif
diff --git a/toolchain/gcc/patches-13.x/900-bad-mips16-crt.patch b/toolchain/gcc/patches-13.x/900-bad-mips16-crt.patch
new file mode 100644
index 00000000000000..dd6e9dc889ad07
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/900-bad-mips16-crt.patch
@@ -0,0 +1,9 @@
+--- a/libgcc/config/mips/t-mips16
++++ b/libgcc/config/mips/t-mips16
+@@ -43,3 +43,6 @@ SYNC_CFLAGS = -mno-mips16
+ 
+ # Version these symbols if building libgcc.so.
+ SHLIB_MAPFILES += $(srcdir)/config/mips/libgcc-mips16.ver
++
++CRTSTUFF_T_CFLAGS += -mno-mips16
++CRTSTUFF_T_CFLAGS_S += -mno-mips16
diff --git a/toolchain/gcc/patches-13.x/910-mbsd_multi.patch b/toolchain/gcc/patches-13.x/910-mbsd_multi.patch
new file mode 100644
index 00000000000000..8af05c99946acf
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/910-mbsd_multi.patch
@@ -0,0 +1,146 @@
+commit 99368862e44740ff4fd33760893f04e14f9dbdf1
+Author: Felix Fietkau <nbd@openwrt.org>
+Date:   Tue Jul 31 00:52:27 2007 +0000
+
+    Port the mbsd_multi patch from freewrt, which adds -fhonour-copts. This will emit warnings in packages that don't use our target cflags properly
+    
+    SVN-Revision: 8256
+
+	This patch brings over a feature from MirBSD:
+	* -fhonour-copts
+	  If this option is not given, it's warned (depending
+	  on environment variables). This is to catch errors
+	  of misbuilt packages which override CFLAGS themselves.
+
+	This patch was authored by Thorsten Glaser <tg at mirbsd.de>
+	with copyright assignment to the FSF in effect.
+
+--- a/gcc/c-family/c-opts.cc
++++ b/gcc/c-family/c-opts.cc
+@@ -104,6 +104,9 @@ static size_t include_cursor;
+ /* Whether any standard preincluded header has been preincluded.  */
+ static bool done_preinclude;
+ 
++/* Check if a port honours COPTS.  */
++static int honour_copts = 0;
++
+ static void handle_OPT_d (const char *);
+ static void set_std_cxx98 (int);
+ static void set_std_cxx11 (int);
+@@ -475,6 +478,12 @@ c_common_handle_option (size_t scode, co
+       flag_no_builtin = !value;
+       break;
+ 
++    case OPT_fhonour_copts:
++      if (c_language == clk_c) {
++        honour_copts++;
++      }
++      break;
++
+     case OPT_fconstant_string_class_:
+       constant_string_class_name = arg;
+       break;
+@@ -1228,6 +1237,47 @@ c_common_init (void)
+       return false;
+     }
+ 
++  if (c_language == clk_c) {
++    char *ev = getenv ("GCC_HONOUR_COPTS");
++    int evv;
++    if (ev == NULL)
++      evv = -1;
++    else if ((*ev == '0') || (*ev == '\0'))
++      evv = 0;
++    else if (*ev == '1')
++      evv = 1;
++    else if (*ev == '2')
++      evv = 2;
++    else if (*ev == 's')
++      evv = -1;
++    else {
++      warning (0, "unknown GCC_HONOUR_COPTS value, assuming 1");
++      evv = 1; /* maybe depend this on something like MIRBSD_NATIVE?  */
++    }
++    if (evv == 1) {
++      if (honour_copts == 0) {
++        error ("someone does not honour COPTS at all in lenient mode");
++        return false;
++      } else if (honour_copts != 1) {
++        warning (0, "someone does not honour COPTS correctly, passed %d times",
++         honour_copts);
++      }
++    } else if (evv == 2) {
++      if (honour_copts == 0) {
++        error ("someone does not honour COPTS at all in strict mode");
++        return false;
++      } else if (honour_copts != 1) {
++        error ("someone does not honour COPTS correctly, passed %d times",
++         honour_copts);
++        return false;
++      }
++    } else if (evv == 0) {
++      if (honour_copts != 1)
++        inform (UNKNOWN_LOCATION, "someone does not honour COPTS correctly, passed %d times",
++         honour_copts);
++    }
++  }
++
+   return true;
+ }
+ 
+--- a/gcc/c-family/c.opt
++++ b/gcc/c-family/c.opt
+@@ -1837,6 +1837,9 @@ C++ ObjC++ Optimization Alias(fexception
+ fhonor-std
+ C++ ObjC++ WarnRemoved
+ 
++fhonour-copts
++C ObjC C++ ObjC++ RejectNegative
++
+ fhosted
+ C ObjC
+ Assume normal C execution environment.
+--- a/gcc/common.opt
++++ b/gcc/common.opt
+@@ -1801,6 +1801,9 @@ fharden-conditional-branches
+ Common Var(flag_harden_conditional_branches) Optimization
+ Harden conditional branches by checking reversed conditions.
+ 
++fhonour-copts
++Common RejectNegative
++
+ ; Nonzero means ignore `#ident' directives.  0 means handle them.
+ ; Generate position-independent code for executables if possible
+ ; On SVR4 targets, it also controls whether or not to emit a
+--- a/gcc/doc/invoke.texi
++++ b/gcc/doc/invoke.texi
+@@ -10062,6 +10062,17 @@ This option is only supported for C and
+ @option{-Wall} and by @option{-Wpedantic}, which can be disabled with
+ @option{-Wno-pointer-sign}.
+ 
++@item -fhonour-copts
++@opindex fhonour-copts
++If @env{GCC_HONOUR_COPTS} is set to 1, abort if this option is not
++given at least once, and warn if it is given more than once.
++If @env{GCC_HONOUR_COPTS} is set to 2, abort if this option is not
++given exactly once.
++If @env{GCC_HONOUR_COPTS} is set to 0 or unset, warn if this option
++is not given exactly once.
++The warning is quelled if @env{GCC_HONOUR_COPTS} is set to @samp{s}.
++This flag and environment variable only affect the C language.
++
+ @opindex Wstack-protector
+ @opindex Wno-stack-protector
+ @item -Wstack-protector
+--- a/gcc/opts.cc
++++ b/gcc/opts.cc
+@@ -2767,6 +2767,9 @@ common_handle_option (struct gcc_options
+       add_comma_separated_to_vector (&opts->x_flag_ignored_attributes, arg);
+       break;
+ 
++    case OPT_fhonour_copts:
++      break;
++
+     case OPT_Werror:
+       dc->warning_as_error_requested = value;
+       break;
diff --git a/toolchain/gcc/patches-13.x/920-specs_nonfatal_getenv.patch b/toolchain/gcc/patches-13.x/920-specs_nonfatal_getenv.patch
new file mode 100644
index 00000000000000..265ca22c0c3cdb
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/920-specs_nonfatal_getenv.patch
@@ -0,0 +1,22 @@
+Author: Jo-Philipp Wich <jow@openwrt.org>
+Date:   Sat Apr 21 03:02:39 2012 +0000
+
+    gcc: add patch to make the getenv() spec function nonfatal if requested environment variable is unset
+    
+    SVN-Revision: 31390
+
+--- a/gcc/gcc.cc
++++ b/gcc/gcc.cc
+@@ -10174,8 +10174,10 @@ getenv_spec_function (int argc, const ch
+     }
+ 
+   if (!value)
+-    fatal_error (input_location,
+-		 "environment variable %qs not defined", varname);
++    {
++      warning (input_location, "environment variable %qs not defined", varname);
++      value = "";
++    }
+ 
+   /* We have to escape every character of the environment variable so
+      they are not interpreted as active spec characters.  A
diff --git a/toolchain/gcc/patches-13.x/960-gotools-fix-compilation-when-making-cross-compiler.patch b/toolchain/gcc/patches-13.x/960-gotools-fix-compilation-when-making-cross-compiler.patch
new file mode 100644
index 00000000000000..b1d7576328f51a
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/960-gotools-fix-compilation-when-making-cross-compiler.patch
@@ -0,0 +1,67 @@
+From dda6b050cd74a352670787a294596a9c56c21327 Mon Sep 17 00:00:00 2001
+From: Yousong Zhou <yszhou4tech@gmail.com>
+Date: Fri, 4 May 2018 18:20:53 +0800
+Subject: [PATCH] gotools: fix compilation when making cross compiler
+
+libgo is "the runtime support library for the Go programming language.
+This library is intended for use with the Go frontend."
+
+gccgo will link target files with libgo.so which depends on libgcc_s.so.1, but
+the linker will complain that it cannot find it.  That's because shared libgcc
+is not present in the install directory yet.  libgo.so was made without problem
+because gcc will emit -lgcc_s when compiled with -shared option.  When gotools
+were being made, it was supplied with -static-libgcc thus no link option was
+provided.  Check LIBGO in gcc/go/gcc-spec.c for how gccgo make a builtin spec
+for linking with libgo.so
+
+- GccgoCrossCompilation, https://github.com/golang/go/wiki/GccgoCrossCompilation
+- Cross-building instructions, http://www.eglibc.org/archives/patches/msg00078.html
+
+When 3-pass GCC compilation is used, shared libgcc runtime libraries will be
+available after gcc pass2 completed and will meet the gotools link requirement
+at gcc pass3
+---
+ gotools/Makefile.am | 4 +++-
+ gotools/Makefile.in | 4 +++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/gotools/Makefile.am
++++ b/gotools/Makefile.am
+@@ -26,6 +26,7 @@ PWD_COMMAND = $${PWDCMD-pwd}
+ STAMP = echo timestamp >
+ 
+ libgodir = ../$(target_noncanonical)/libgo
++libgccdir = ../$(target_noncanonical)/libgcc
+ LIBGODEP = $(libgodir)/libgo.la
+ 
+ LIBGOTOOL = $(libgodir)/libgotool.a
+@@ -41,7 +42,8 @@ GOCFLAGS = $(CFLAGS_FOR_TARGET)
+ GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
+ 
+ AM_GOCFLAGS = -I $(libgodir)
+-AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
++AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
++	-L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
+ GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
+ 
+ libgosrcdir = $(srcdir)/../libgo/go
+--- a/gotools/Makefile.in
++++ b/gotools/Makefile.in
+@@ -337,6 +337,7 @@ mkinstalldirs = $(SHELL) $(toplevel_srcd
+ PWD_COMMAND = $${PWDCMD-pwd}
+ STAMP = echo timestamp >
+ libgodir = ../$(target_noncanonical)/libgo
++libgccdir = ../$(target_noncanonical)/libgcc
+ LIBGODEP = $(libgodir)/libgo.la
+ LIBGOTOOL = $(libgodir)/libgotool.a
+ @NATIVE_FALSE@GOCOMPILER = $(GOC)
+@@ -346,7 +347,8 @@ LIBGOTOOL = $(libgodir)/libgotool.a
+ GOCFLAGS = $(CFLAGS_FOR_TARGET)
+ GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
+ AM_GOCFLAGS = -I $(libgodir)
+-AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
++AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
++	-L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
+ GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
+ libgosrcdir = $(srcdir)/../libgo/go
+ cmdsrcdir = $(libgosrcdir)/cmd
diff --git a/toolchain/gcc/patches-13.x/970-macos_arm64-building-fix.patch b/toolchain/gcc/patches-13.x/970-macos_arm64-building-fix.patch
new file mode 100644
index 00000000000000..7844268e7e2206
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/970-macos_arm64-building-fix.patch
@@ -0,0 +1,45 @@
+commit 9c6e71079b46ad5433165feaa2001450f2017b56
+Author: Przemysław Buczkowski <prem@prem.moe>
+Date:   Mon Aug 16 13:16:21 2021 +0100
+
+    GCC: Patch for Apple Silicon compatibility
+    
+    This patch fixes a linker error occuring when compiling
+    the cross-compiler on macOS and ARM64 architecture.
+    
+    Adapted from:
+    https://github.com/richfelker/musl-cross-make/issues/116#issuecomment-823612404
+    
+    Change-Id: Ia3ee98a163bbb62689f42e2da83a5ef36beb0913
+    Reviewed-on: https://review.haiku-os.org/c/buildtools/+/4329
+    Reviewed-by: John Scipione <jscipione@gmail.com>
+    Reviewed-by: Adrien Destugues <pulkomandy@gmail.com>
+
+--- a/gcc/config/aarch64/aarch64.h
++++ b/gcc/config/aarch64/aarch64.h
+@@ -1185,7 +1185,7 @@ extern enum aarch64_code_model aarch64_c
+ 
+ /* Extra specs when building a native AArch64-hosted compiler.
+    Option rewriting rules based on host system.  */
+-#if defined(__aarch64__)
++#if defined(__aarch64__) && ! defined(__APPLE__)
+ extern const char *host_detect_local_cpu (int argc, const char **argv);
+ #define HAVE_LOCAL_CPU_DETECT
+ # define EXTRA_SPEC_FUNCTIONS                                           \
+--- a/gcc/config/host-darwin.cc
++++ b/gcc/config/host-darwin.cc
+@@ -23,6 +23,8 @@
+ #include "options.h"
+ #include "diagnostic-core.h"
+ #include "config/host-darwin.h"
++#include "hosthooks.h"
++#include "hosthooks-def.h"
+ #include <errno.h>
+ 
+ /* For Darwin (macOS only) platforms, without ASLR (PIE) enabled on the
+@@ -181,3 +183,5 @@ darwin_gt_pch_use_address (void *&addr,
+ 
+   return 1;
+ }
++
++const struct host_hooks host_hooks = HOST_HOOKS_INITIALIZER;
diff --git a/toolchain/gdb/Makefile b/toolchain/gdb/Makefile
index d69217f6ca20c7..70a4fa59026fc6 100644
--- a/toolchain/gdb/Makefile
+++ b/toolchain/gdb/Makefile
@@ -30,15 +30,15 @@ HOST_CONFIGURE_ARGS = \
 	--build=$(GNU_HOST_NAME) \
 	--host=$(GNU_HOST_NAME) \
 	--target=$(REAL_GNU_TARGET_NAME) \
-	--with-gmp=$(TOPDIR)/staging_dir/host \
-	--with-mpfr=$(TOPDIR)/staging_dir/host \
-	--with-mpc=$(TOPDIR)/staging_dir/host \
+	--with-gmp=$(STAGING_DIR_HOST) \
+	--with-mpfr=$(STAGING_DIR_HOST) \
+	--with-mpc=$(STAGING_DIR_HOST) \
+	--with-expat=$(STAGING_DIR_HOST) \
 	--disable-werror \
 	--without-uiout \
 	--enable-tui --disable-gdbtk --without-x \
 	--without-included-gettext \
 	--enable-threads \
-	--with-expat \
 	--disable-unit-tests \
 	--disable-ubsan \
 	--disable-binutils \
diff --git a/toolchain/glibc/Makefile b/toolchain/glibc/Makefile
index 24526ceec2c92c..bfb5598274c2a1 100644
--- a/toolchain/glibc/Makefile
+++ b/toolchain/glibc/Makefile
@@ -20,7 +20,7 @@ define Host/Install
 		install
 	( cd $(TOOLCHAIN_DIR) ; \
 		for d in lib usr/lib ; do \
-		  for f in libc.so libpthread.so libgcc_s.so ; do \
+		  for f in libc.so libm.so libpthread.so libgcc_s.so ; do \
 		    if [ -f $$$$d/$$$$f -a ! -L $$$$d/$$$$f ] ; then \
 		      $(SED) 's,/usr/lib/,,g;s,/lib/,,g' $$$$d/$$$$f ; \
 		    fi \
diff --git a/toolchain/glibc/common.mk b/toolchain/glibc/common.mk
index 107245472aac10..0d880e04df9863 100644
--- a/toolchain/glibc/common.mk
+++ b/toolchain/glibc/common.mk
@@ -7,13 +7,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=glibc
-PKG_VERSION:=2.35
+PKG_VERSION:=2.37
 PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
-PKG_SOURCE_VERSION:=813a8d01716d4e099ec57194a93b14fa08b4beca
-PKG_MIRROR_HASH:=8c8d92dde334f0e0f9a0949d25b2950db513ce8723c31ae0b0ef64730a00322f
+PKG_SOURCE_VERSION:=7c32cb7dd88cf100b0b412163896e30aa2ee671a
+PKG_MIRROR_HASH:=92afa3672e4af0c3ba9d360e9aaac60c094a0aad9334ef78a1fd2ee49f5e1b64
 PKG_SOURCE_URL:=https://sourceware.org/git/glibc.git
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.xz
 
@@ -64,7 +64,7 @@ GLIBC_CONFIGURE:= \
 		  $(if $(CONFIG_PKG_CC_STACKPROTECTOR_REGULAR),--enable-stack-protector=yes) \
 		  $(if $(CONFIG_PKG_CC_STACKPROTECTOR_STRONG),--enable-stack-protector=strong) \
 		  $(if $(CONFIG_PKG_RELRO_FULL),--enable-bind-now) \
-		--enable-kernel=5.10.0
+		--enable-kernel=5.15.0
 
 export libc_cv_ssp=no
 export libc_cv_ssp_strong=no
@@ -79,11 +79,6 @@ define Host/SetToolchainInfo
 endef
 
 define Host/Configure
-	[ -f $(HOST_BUILD_DIR)/.autoconf ] || { \
-		cd $(HOST_BUILD_DIR)/; \
-		autoconf --force && \
-		touch $(HOST_BUILD_DIR)/.autoconf; \
-	}
 	mkdir -p $(CUR_BUILD_DIR)
 	( cd $(CUR_BUILD_DIR); rm -f config.cache; \
 		$(GLIBC_CONFIGURE) \
diff --git a/toolchain/glibc/patches/050-Revert-Disallow-use-of-DES-encryption-functions-in-n.patch b/toolchain/glibc/patches/050-Revert-Disallow-use-of-DES-encryption-functions-in-n.patch
index 7dfc8a5582cef4..c9db703938a26f 100644
--- a/toolchain/glibc/patches/050-Revert-Disallow-use-of-DES-encryption-functions-in-n.patch
+++ b/toolchain/glibc/patches/050-Revert-Disallow-use-of-DES-encryption-functions-in-n.patch
@@ -82,7 +82,7 @@ provides them.
  int totfails = 0;
  
  int main (int argc, char *argv[]);
-@@ -120,13 +104,3 @@ put8 (char *cp)
+@@ -119,13 +103,3 @@ put8 (char *cp)
  	  printf("%02x", t);
  	}
  }
@@ -627,7 +627,7 @@ provides them.
     range [FROM - N + 1, FROM - 1].  If N is odd the first byte in FROM
 --- a/stdlib/stdlib.h
 +++ b/stdlib/stdlib.h
-@@ -971,6 +971,12 @@ extern int getsubopt (char **__restrict
+@@ -984,6 +984,12 @@ extern int getsubopt (char **__restrict
  #endif
  
  
diff --git a/toolchain/glibc/patches/200-add-dl-search-paths.patch b/toolchain/glibc/patches/200-add-dl-search-paths.patch
index fd4af3694a0f22..e927d86f2350b8 100644
--- a/toolchain/glibc/patches/200-add-dl-search-paths.patch
+++ b/toolchain/glibc/patches/200-add-dl-search-paths.patch
@@ -2,7 +2,7 @@ add /usr/lib to default search path for the dynamic linker
 
 --- a/Makeconfig
 +++ b/Makeconfig
-@@ -618,6 +618,9 @@ else
+@@ -631,6 +631,9 @@ else
  default-rpath = $(libdir)
  endif
  
diff --git a/toolchain/musl/Makefile b/toolchain/musl/Makefile
index 2b9312bcbf123c..d441e37684769a 100644
--- a/toolchain/musl/Makefile
+++ b/toolchain/musl/Makefile
@@ -9,7 +9,7 @@ HOST_BUILD_PARALLEL:=1
 
 MUSL_MAKEOPTS = -C $(HOST_BUILD_DIR) \
 	DESTDIR="$(TOOLCHAIN_DIR)/" \
-	LIBCC="$(subst libgcc.a,libgcc_initial.a,$(shell $(TARGET_CC) -print-libgcc-file-name))"
+	LIBCC="$(shell $(TARGET_CC) -print-libgcc-file-name)"
 
 define Host/SetToolchainInfo
 	$(SED) 's,^\(LIBC_TYPE\)=.*,\1=$(PKG_NAME),' $(TOOLCHAIN_DIR)/info.mk
diff --git a/toolchain/musl/common.mk b/toolchain/musl/common.mk
index 040127c3bccdb6..0901fe7d6f4d92 100644
--- a/toolchain/musl/common.mk
+++ b/toolchain/musl/common.mk
@@ -8,12 +8,12 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/target.mk
 
 PKG_NAME:=musl
-PKG_VERSION:=1.2.3
+PKG_VERSION:=1.2.4
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://musl.libc.org/releases/
-PKG_HASH:=7d5b0b6062521e4627e099e4c9dc8248d32a30285e959b7eecaa780cf8cfd4a4
+PKG_HASH:=7a35eae33d5372a7c0da1188de798726f68825513b7ae3ebe97aaaa52114f039
 
 LIBC_SO_VERSION:=$(PKG_VERSION)
 PATCH_DIR:=$(PATH_PREFIX)/patches
diff --git a/toolchain/musl/patches/600-nftw-support-common-gnu-extension.patch b/toolchain/musl/patches/600-nftw-support-common-gnu-extension.patch
index 2a7436cf8489b4..7a1ab3f99a3619 100644
--- a/toolchain/musl/patches/600-nftw-support-common-gnu-extension.patch
+++ b/toolchain/musl/patches/600-nftw-support-common-gnu-extension.patch
@@ -33,7 +33,7 @@ Signed-off-by: Tony Ambardar <Tony.Ambardar@gmail.com>
  #include <ftw.h>
  #include <dirent.h>
  #include <fcntl.h>
-@@ -72,8 +73,20 @@ static int do_nftw(char *path, int (*fn)
+@@ -74,8 +75,20 @@ static int do_nftw(char *path, int (*fn)
  		if (!fd_limit) close(dfd);
  	}
  
@@ -56,7 +56,7 @@ Signed-off-by: Tony Ambardar <Tony.Ambardar@gmail.com>
  
  	for (; h; h = h->chain)
  		if (h->dev == st.st_dev && h->ino == st.st_ino)
-@@ -101,7 +114,10 @@ static int do_nftw(char *path, int (*fn)
+@@ -103,7 +116,10 @@ static int do_nftw(char *path, int (*fn)
  				strcpy(path+j+1, de->d_name);
  				if ((r=do_nftw(path, fn, fd_limit-1, flags, &new))) {
  					closedir(d);
@@ -68,7 +68,7 @@ Signed-off-by: Tony Ambardar <Tony.Ambardar@gmail.com>
  				}
  			}
  			closedir(d);
-@@ -112,8 +128,16 @@ static int do_nftw(char *path, int (*fn)
+@@ -114,8 +130,16 @@ static int do_nftw(char *path, int (*fn)
  	}
  
  	path[l] = 0;
@@ -87,9 +87,9 @@ Signed-off-by: Tony Ambardar <Tony.Ambardar@gmail.com>
  
  	return 0;
  }
-@@ -139,4 +163,5 @@ int nftw(const char *path, int (*fn)(con
+@@ -140,3 +164,5 @@ int nftw(const char *path, int (*fn)(con
+ 	pthread_setcancelstate(cs, 0);
  	return r;
  }
- 
++
 +#undef nftw64
- weak_alias(nftw, nftw64);
diff --git a/toolchain/nasm/Makefile b/toolchain/nasm/Makefile
index f733c52912e9c4..64bb5e77511dac 100644
--- a/toolchain/nasm/Makefile
+++ b/toolchain/nasm/Makefile
@@ -5,12 +5,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=nasm
-PKG_VERSION:=2.15.05
+PKG_VERSION:=2.16.01
 
 PKG_SOURCE_URL:=https://www.nasm.us/pub/nasm/releasebuilds/$(PKG_VERSION)/
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
-
-PKG_HASH:=3caf6729c1073bf96629b57cee31eeb54f4f8129b01902c73428836550b30a3f
+PKG_HASH:=c77745f4802375efeee2ec5c0ad6b7f037ea9c87c92b149a9637ff099f162558
 
 HOST_BUILD_PARALLEL:=1
 
diff --git a/tools/7z/patches/7-zip-flags.patch b/tools/7z/patches/7-zip-flags.patch
new file mode 100644
index 00000000000000..ed5b5084018f4f
--- /dev/null
+++ b/tools/7z/patches/7-zip-flags.patch
@@ -0,0 +1,27 @@
+--- a/CPP/7zip/7zip_gcc.mak
++++ b/CPP/7zip/7zip_gcc.mak
+@@ -18,13 +18,13 @@ PROGPATH_STATIC = $(O)/$(PROG)s
+ 
+ 
+ ifneq ($(CC), xlc)
+-CFLAGS_WARN_WALL = -Wall -Werror -Wextra
++CFLAGS_WARN_WALL = -Wall -Wextra
+ endif
+ 
+ # for object file
+ CFLAGS_BASE_LIST = -c
+ # CFLAGS_BASE_LIST = -S
+-CFLAGS_BASE = -O2 $(CFLAGS_BASE_LIST) $(CFLAGS_WARN_WALL) $(CFLAGS_WARN) \
++CFLAGS_BASE = $(CFLAGS_BASE_LIST) $(CFLAGS_WARN_WALL) $(CFLAGS_WARN) -D_GNU_SOURCE \
+  -DNDEBUG -D_REENTRANT -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE \
+  -fPIC
+ 
+@@ -192,7 +192,7 @@ all: $(O) $(PROGPATH) $(STATIC_TARGET)
+ $(O):
+ 	$(MY_MKDIR) $(O)
+ 
+-LFLAGS_ALL = -s $(MY_ARCH_2) $(LDFLAGS) $(LD_arch) $(OBJS) $(MY_LIBS) $(LIB2)
++LFLAGS_ALL = $(MY_ARCH_2) $(LDFLAGS) $(LD_arch) $(OBJS) $(MY_LIBS) $(LIB2)
+ $(PROGPATH): $(OBJS)
+ 	$(CXX) -o $(PROGPATH) $(LFLAGS_ALL)
+ 
diff --git a/tools/7z/patches/7-zip-musl.patch b/tools/7z/patches/7-zip-musl.patch
new file mode 100644
index 00000000000000..cf3386e4de3cec
--- /dev/null
+++ b/tools/7z/patches/7-zip-musl.patch
@@ -0,0 +1,59 @@
+--- a/C/CpuArch.c
++++ b/C/CpuArch.c
+@@ -421,8 +421,6 @@ BoolInt CPU_IsSupported_AES (void) { ret
+ 
+ #ifdef USE_HWCAP
+ 
+-#include <asm/hwcap.h>
+-
+   #define MY_HWCAP_CHECK_FUNC_2(name1, name2) \
+   BoolInt CPU_IsSupported_ ## name1() { return (getauxval(AT_HWCAP)  & (HWCAP_  ## name2)) ? 1 : 0; }
+ 
+--- a/C/Threads.c
++++ b/C/Threads.c
+@@ -257,7 +257,7 @@ WRes Thread_Create_With_CpuSet(CThread *
+       */
+ 
+       // ret2 =
+-      pthread_attr_setaffinity_np(&attr, sizeof(*cpuSet), cpuSet);
++      //pthread_attr_setaffinity_np(&attr, sizeof(*cpuSet), cpuSet);
+       // if (ret2) ret = ret2;
+       #endif
+     }
+@@ -267,14 +267,12 @@ WRes Thread_Create_With_CpuSet(CThread *
+     if (!ret)
+     {
+       p->_created = 1;
+-      /*
+       if (cpuSet)
+       {
+         // ret2 =
+         pthread_setaffinity_np(p->_tid, sizeof(*cpuSet), cpuSet);
+         // if (ret2) ret = ret2;
+       }
+-      */
+     }
+   }
+   // ret2 =
+--- a/C/Threads.h
++++ b/C/Threads.h
+@@ -19,6 +19,7 @@
+ #endif
+ 
+ #include <pthread.h>
++#include <sched.h>
+ 
+ #endif
+ 
+--- a/CPP/Windows/SystemInfo.cpp
++++ b/CPP/Windows/SystemInfo.cpp
+@@ -36,9 +36,6 @@
+ #endif
+ */
+ 
+-#ifdef MY_CPU_ARM_OR_ARM64
+-#include <asm/hwcap.h>
+-#endif
+ #endif
+ 
+ #ifdef __linux__
diff --git a/tools/Makefile b/tools/Makefile
index 3f505459e9731d..40c3ec1ab092ab 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -17,48 +17,97 @@ ifeq ($(CONFIG_EXTERNAL_TOOLCHAIN),)
     BUILD_ISL = y
   endif
 endif
-ifneq ($(CONFIG_SDK)$(CONFIG_PACKAGE_kmod-b43)$(CONFIG_PACKAGE_b43legacy-firmware)$(CONFIG_BRCMSMAC_USE_FW_FROM_WL),)
+ifneq ($(CONFIG_SDK)$(CONFIG_PACKAGE_kmod-b43)$(CONFIG_BRCMSMAC_USE_FW_FROM_WL),)
   BUILD_B43_TOOLS = y
 endif
+ifneq ($(CONFIG_SDK)$(CONFIG_TARGET_INITRAMFS_COMPRESSION_BZIP2),)
+  BUILD_BZIP2_TOOLS = y
+endif
+ifneq ($(CONFIG_SDK)$(CONFIG_TARGET_INITRAMFS_COMPRESSION_LZ4),)
+  BUILD_LZ4_TOOLS = y
+endif
+ifneq ($(CONFIG_SDK)$(CONFIG_TARGET_INITRAMFS_COMPRESSION_LZO),)
+  BUILD_LZO_TOOLS = y
+endif
 
-tools-y += autoconf autoconf-archive automake bc bison cmake cpio dosfstools
-tools-y += e2fsprogs fakeroot findutils firmware-utils flex gengetopt
-tools-y += libressl libtool lzma m4 make-ext4fs meson missing-macros mkimage
-tools-y += mklibs mtd-utils mtools ninja padjffs2 patch-image
-tools-y += patchelf pkgconf quilt squashfskit4 sstrip zip zlib zstd
-tools-$(BUILD_B43_TOOLS) += b43-tools
-tools-$(BUILD_ISL) += isl
-tools-$(BUILD_TOOLCHAIN) += expat gmp mpc mpfr
-tools-$(CONFIG_TARGET_apm821xx)$(CONFIG_TARGET_gemini) += genext2fs
-tools-$(CONFIG_TARGET_ath79) += lzma-old squashfs
-tools-$(CONFIG_TARGET_mxs) += elftosb sdimage
-tools-$(CONFIG_TARGET_realtek) += 7z
-tools-$(CONFIG_TARGET_tegra) += cbootimage cbootimage-configs
-tools-$(CONFIG_USES_MINOR) += kernel2minor
-tools-$(CONFIG_USE_SPARSE) += sparse
-tools-$(CONFIG_USE_LLVM_BUILD) += llvm-bpf
+tools-y += autoconf
+tools-y += autoconf-archive
+tools-y += automake
+tools-y += bc
+tools-y += bison
+tools-y += cmake
+tools-y += cpio
+tools-y += dosfstools
+tools-y += e2fsprogs
+tools-y += expat
+tools-y += fakeroot
+tools-y += findutils
+tools-y += firmware-utils
+tools-y += flex
+tools-y += gengetopt
+tools-y += gnulib
+tools-y += libressl
+tools-y += libtool
+tools-y += lzma
+tools-y += m4
+tools-y += make-ext4fs
+tools-y += meson
+tools-y += missing-macros
+tools-y += mkimage
+tools-y += mklibs
+tools-y += mtd-utils
+tools-y += mtools
+tools-y += ninja
+tools-y += padjffs2
+tools-y += patch-image
+tools-y += patchelf
+tools-y += pkgconf
+tools-y += quilt
+tools-y += squashfs4
+tools-y += sstrip
+tools-y += zip
+tools-y += zlib
+tools-y += zstd
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS),y) += liblzo
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(BUILD_B43_TOOLS),y) += b43-tools
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(BUILD_BZIP2_TOOLS),y) += bzip2
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(BUILD_ISL),y) += isl
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(BUILD_LZ4_TOOLS),y) += lz4
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(BUILD_LZO_TOOLS),y) += lzop
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(BUILD_TOOLCHAIN),y) += gmp mpc mpfr
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(CONFIG_TARGET_apm821xx)$(CONFIG_TARGET_gemini),y) += genext2fs
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(CONFIG_TARGET_ath79),y) += lzma-old squashfs3-lzma
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(CONFIG_TARGET_mxs),y) += elftosb sdimage
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(CONFIG_TARGET_realtek),y) += 7z
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(CONFIG_TARGET_tegra),y) += cbootimage cbootimage-configs
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(CONFIG_USES_MINOR),y) += kernel2minor
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(CONFIG_USE_SPARSE),y) += sparse
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(CONFIG_USE_LLVM_BUILD),y) += llvm-bpf
 
 # builddir dependencies
 $(curdir)/autoconf/compile := $(curdir)/m4/compile
-$(curdir)/automake/compile := $(curdir)/m4/compile $(curdir)/autoconf/compile $(curdir)/pkgconf/compile $(curdir)/xz/compile
+$(curdir)/automake/compile := $(curdir)/autoconf/compile $(curdir)/pkgconf/compile $(curdir)/xz/compile
 $(curdir)/b43-tools/compile := $(curdir)/bison/compile
 $(curdir)/bc/compile := $(curdir)/bison/compile $(curdir)/libtool/compile
 $(curdir)/bison/compile := $(curdir)/flex/compile
 $(curdir)/cbootimage/compile += $(curdir)/automake/compile
-$(curdir)/cmake/compile += $(curdir)/libressl/compile $(curdir)/ninja/compile
-$(curdir)/dosfstools/compile := $(curdir)/autoconf/compile $(curdir)/automake/compile
-$(curdir)/expat/compile := $(curdir)/cmake/compile
+$(curdir)/cmake/compile += $(curdir)/libressl/compile $(curdir)/ninja/compile $(curdir)/expat/compile $(curdir)/xz/compile $(curdir)/zlib/compile $(curdir)/zstd/compile
+$(curdir)/dosfstools/compile := $(curdir)/automake/compile
 $(curdir)/e2fsprogs/compile := $(curdir)/libtool/compile
 $(curdir)/fakeroot/compile := $(curdir)/libtool/compile
 $(curdir)/findutils/compile := $(curdir)/bison/compile
-$(curdir)/firmware-utils/compile += $(curdir)/libressl/compile $(curdir)/zlib/compile
+$(curdir)/firmware-utils/compile += $(curdir)/cmake/compile
 $(curdir)/flex/compile := $(curdir)/libtool/compile
+$(curdir)/genext2fs/compile := $(curdir)/libtool/compile
 $(curdir)/gengetopt/compile := $(curdir)/libtool/compile
 $(curdir)/gmp/compile := $(curdir)/libtool/compile
 $(curdir)/isl/compile := $(curdir)/gmp/compile
+$(curdir)/liblzo/compile := $(curdir)/cmake/compile
 $(curdir)/libressl/compile := $(curdir)/pkgconf/compile
-$(curdir)/libtool/compile := $(curdir)/m4/compile $(curdir)/autoconf/compile $(curdir)/automake/compile $(curdir)/missing-macros/compile
+$(curdir)/libtool/compile := $(curdir)/automake/compile $(curdir)/gnulib/compile $(curdir)/missing-macros/compile
+$(curdir)/lz4/compile := $(curdir)/meson/compile
 $(curdir)/lzma-old/compile := $(curdir)/zlib/compile
+$(curdir)/lzop/compile := $(curdir)/cmake/compile $(curdir)/liblzo/compile
 $(curdir)/llvm-bpf/compile := $(curdir)/cmake/compile
 $(curdir)/make-ext4fs/compile := $(curdir)/zlib/compile
 $(curdir)/meson/compile := $(curdir)/ninja/compile
@@ -73,13 +122,13 @@ $(curdir)/patchelf/compile := $(curdir)/libtool/compile
 $(curdir)/pkgconf/compile := $(curdir)/meson/compile
 $(curdir)/quilt/compile := $(curdir)/autoconf/compile $(curdir)/findutils/compile
 $(curdir)/sdcc/compile := $(curdir)/bison/compile
-$(curdir)/squashfs/compile := $(curdir)/lzma-old/compile
-$(curdir)/squashfskit4/compile := $(curdir)/xz/compile $(curdir)/zlib/compile
-$(curdir)/zlib/compile := $(curdir)/cmake/compile
+$(curdir)/squashfs3-lzma/compile := $(curdir)/lzma-old/compile
+$(curdir)/squashfs4/compile := $(curdir)/xz/compile $(curdir)/zlib/compile
 $(curdir)/zstd/compile := $(curdir)/meson/compile
 
 ifneq ($(HOST_OS),Linux)
-  $(curdir)/squashfskit4/compile += $(curdir)/coreutils/compile
+  $(curdir)/coreutils/compile += $(curdir)/automake/compile $(curdir)/bison/compile $(curdir)/gnulib/compile
+  $(curdir)/squashfs4/compile += $(curdir)/coreutils/compile
   tools-y += coreutils
 endif
 ifeq ($(HOST_OS),Darwin)
@@ -87,14 +136,14 @@ ifeq ($(HOST_OS),Darwin)
 else
   $(curdir)/dwarves/compile += $(curdir)/elfutils/compile
   $(curdir)/elfutils/compile := $(curdir)/m4/compile $(curdir)/zlib/compile
-  tools-$(CONFIG_DWARVES) += dwarves
+  tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(CONFIG_DWARVES),y) += dwarves
   tools-y += elfutils
 endif
 
 ifneq ($(CONFIG_CCACHE)$(CONFIG_SDK),)
-$(foreach tool, $(filter-out xz zstd pkgconf patch ninja meson libressl cmake,$(tools-y)), $(eval $(curdir)/$(tool)/compile += $(curdir)/ccache/compile))
+$(foreach tool, $(filter-out zstd zlib xz pkgconf patch ninja meson libressl expat cmake,$(tools-y)), $(eval $(curdir)/$(tool)/compile += $(curdir)/ccache/compile))
 tools-y += ccache
-$(curdir)/ccache/compile := $(curdir)/cmake/compile $(curdir)/zstd/compile
+$(curdir)/ccache/compile := $(curdir)/cmake/compile
 endif
 
 # in case there is no patch tool on the host we need to make patch tool a
@@ -103,8 +152,11 @@ $(foreach tool, $(tools-y), $(if $(wildcard $(curdir)/$(tool)/patches),$(eval $(
 
 $(foreach tool, $(filter-out xz,$(tools-y)), $(eval $(curdir)/$(tool)/compile += $(curdir)/xz/compile))
 
-# make any tool depend on tar, xz and patch to ensure that archives can be unpacked and patched properly
-tools-core := tar xz patch
+# make any tool depend on the following to ensure that archives can be unpacked and patched properly
+tools-core += libdeflate
+tools-core += patch
+tools-core += tar
+tools-core += xz
 
 $(foreach tool, $(tools-y), $(eval $(curdir)/$(tool)/compile += $(patsubst %,$(curdir)/%/compile,$(tools-core))))
 tools-y += $(tools-core)
diff --git a/tools/autoconf-archive/Makefile b/tools/autoconf-archive/Makefile
index 228a27cf600168..a4ab4237797b50 100644
--- a/tools/autoconf-archive/Makefile
+++ b/tools/autoconf-archive/Makefile
@@ -1,28 +1,16 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=autoconf-archive
-PKG_VERSION:=2021.02.19
+PKG_VERSION:=2023.02.20
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@GNU/autoconf-archive
-PKG_HASH:=e8a6eb9d28ddcba8ffef3fa211653239e9bf239aba6a01a6b7cfc7ceaec69cbd
+PKG_HASH:=71d4048479ae28f1f5794619c3d72df9c01df49b1c628ef85fde37596dc31a33
 
 include $(INCLUDE_DIR)/host-build.mk
 
-HOST_CONFIGURE_ARGS += \
-	--datarootdir=$(STAGING_DIR_HOST)/share
-
-define Host/Compile
-	export SHELL="$(BASH)"; $(MAKE) -C $(HOST_BUILD_DIR)
-endef
-
-define Host/Install
-	export SHELL="$(BASH)"; $(MAKE) -C $(HOST_BUILD_DIR) install
-endef
-
-define Host/Clean
-	-export SHELL="$(BASH)"; $(MAKE) -C $(HOST_BUILD_DIR) uninstall
-	$(call Host/Clean/Default)
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
 endef
 
 $(eval $(call HostBuild))
diff --git a/tools/autoconf/Makefile b/tools/autoconf/Makefile
index 6eb64d77d51272..a1ce1580312457 100644
--- a/tools/autoconf/Makefile
+++ b/tools/autoconf/Makefile
@@ -1,4 +1,4 @@
-# 
+#
 # Copyright (C) 2006-2015 OpenWrt.org
 #
 # This is free software, licensed under the GNU General Public License v2.
@@ -7,31 +7,25 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=autoconf
-PKG_VERSION:=2.69
+PKG_VERSION:=2.71
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@GNU/autoconf
-PKG_HASH:=64ebcec9f8ac5b2487125a86a7760d2591ac9e1d3dbd59489633f9de62a57684
+PKG_HASH:=f14c83cfebcc9427f2c3cea7258bd90df972d92eb26752da4ddad81c87a0faa4
 
 include $(INCLUDE_DIR)/host-build.mk
 
-HOST_CONFIGURE_ARGS += \
-	--datarootdir=$(STAGING_DIR_HOST)/share
-
 HOST_CONFIGURE_VARS += \
+	EMACS="no" \
 	PERL="/usr/bin/env perl"
 
 define Host/Compile
-	export SHELL="$(BASH)"; $(MAKE) -C $(HOST_BUILD_DIR)
-endef
-
-define Host/Install
-	export SHELL="$(BASH)"; $(MAKE) -C $(HOST_BUILD_DIR) install
+	-$(call Host/Compile/Default,--touch install-man1) # disable building of man pages
+	$(call Host/Compile/Default)
 endef
 
-define Host/Clean
-	-export SHELL="$(BASH)"; $(MAKE) -C $(HOST_BUILD_DIR) uninstall
-	$(call Host/Clean/Default)
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
 endef
 
 $(eval $(call HostBuild))
diff --git a/tools/autoconf/patches/000-relocatable.patch b/tools/autoconf/patches/000-relocatable.patch
index 12e94ae9a1573b..3961d2264b67eb 100644
--- a/tools/autoconf/patches/000-relocatable.patch
+++ b/tools/autoconf/patches/000-relocatable.patch
@@ -1,77 +1,71 @@
 --- a/bin/autoheader.in
 +++ b/bin/autoheader.in
-@@ -28,7 +28,8 @@ eval 'case $# in 0) exec @PERL@ -S "$0";
+@@ -30,9 +30,12 @@ use 5.006;
+ use strict;
+ use warnings FATAL => 'all';
  
++$^W = 1;
++
  BEGIN
  {
 -  my $pkgdatadir = $ENV{'autom4te_perllibdir'} || '@pkgdatadir@';
 +  my $pkgdatadir = $ENV{'autom4te_perllibdir'} ||
-+	($ENV{'STAGING_DIR'} ? $ENV{'STAGING_DIR'} . '/../host/share/autoconf' : '@pkgdatadir@');
++	($ENV{'STAGING_DIR_HOST'} ? $ENV{'STAGING_DIR_HOST'} . '/share/autoconf' : '@pkgdatadir@');
    unshift @INC, "$pkgdatadir";
  
    # Override SHELL.  On DJGPP SHELL may not be set to a shell
-@@ -50,7 +51,7 @@ use strict;
- use vars qw ($config_h %verbatim %symbol);
+@@ -54,7 +57,7 @@ use Autom4te::XFile;
+ our ($config_h, %symbol, %verbatim);
  
  # Lib files.
 -my $autom4te = $ENV{'AUTOM4TE'} || '@bindir@/@autom4te-name@';
-+my $autom4te = $ENV{'AUTOM4TE'} || ($ENV{'STAGING_DIR'} ? $ENV{'STAGING_DIR'} . '/../host/bin/@autom4te-name@' : '@bindir@/@autom4te-name@');
- local $config_h;
++my $autom4te = $ENV{'AUTOM4TE'} || ($ENV{'STAGING_DIR_HOST'} ? $ENV{'STAGING_DIR_HOST'} . '/bin/@autom4te-name@' : '@bindir@/@autom4te-name@');
  my $config_h_in;
  my @prepend_include;
+ my @include;
 --- a/bin/autom4te.in
 +++ b/bin/autom4te.in
-@@ -1,10 +1,12 @@
--#! @PERL@ -w
-+#! @PERL@
- # -*- perl -*-
- # @configure_input@
- 
- eval 'case $# in 0) exec @PERL@ -S "$0";; *) exec @PERL@ -S "$0" "$@";; esac'
-     if 0;
+@@ -26,9 +26,12 @@ use 5.006;
+ use strict;
+ use warnings FATAL => 'all';
  
 +$^W = 1;
 +
- # autom4te - Wrapper around M4 libraries.
- # Copyright (C) 2001-2003, 2005-2012 Free Software Foundation, Inc.
- 
-@@ -24,7 +26,8 @@ eval 'case $# in 0) exec @PERL@ -S "$0";
- 
  BEGIN
  {
 -  my $pkgdatadir = $ENV{'autom4te_perllibdir'} || '@pkgdatadir@';
 +  my $pkgdatadir = $ENV{'autom4te_perllibdir'} ||
-+	($ENV{'STAGING_DIR'} ? $ENV{'STAGING_DIR'} . '/../host/share/autoconf' : '@pkgdatadir@');
++	($ENV{'STAGING_DIR_HOST'} ? $ENV{'STAGING_DIR_HOST'} . '/share/autoconf' : '@pkgdatadir@');
    unshift @INC, $pkgdatadir;
  
    # Override SHELL.  On DJGPP SHELL may not be set to a shell
-@@ -44,7 +47,8 @@ use File::Basename;
- use strict;
+@@ -48,7 +51,8 @@ use Autom4te::General;
+ use Autom4te::XFile;
  
  # Data directory.
 -my $pkgdatadir = $ENV{'AC_MACRODIR'} || '@pkgdatadir@';
 +my $pkgdatadir = $ENV{'AC_MACRODIR'} ||
-+	($ENV{'STAGING_DIR'} ? $ENV{'STAGING_DIR'} . '/../host/share/autoconf' : '@pkgdatadir@');
++	($ENV{'STAGING_DIR_HOST'} ? $ENV{'STAGING_DIR_HOST'} . '/share/autoconf' : '@pkgdatadir@');
  
  # $LANGUAGE{LANGUAGE} -- Automatic options for LANGUAGE.
  my %language;
-@@ -87,7 +91,7 @@ my @include;
+@@ -91,7 +95,7 @@ my @include;
  my $freeze = 0;
  
  # $M4.
 -my $m4 = $ENV{"M4"} || '@M4@';
-+my $m4 = $ENV{"M4"} || ($ENV{'STAGING_DIR'} ? $ENV{'STAGING_DIR'} . '/../host/bin/m4' : '@M4@');
++my $m4 = $ENV{"M4"} || ($ENV{'STAGING_DIR_HOST'} ? $ENV{'STAGING_DIR_HOST'} . '/bin/m4' : '@M4@');
  # Some non-GNU m4's don't reject the --help option, so give them /dev/null.
  fatal "need GNU m4 1.4 or later: $m4"
    if system "$m4 --help </dev/null 2>&1 | grep reload-state >/dev/null";
-@@ -269,6 +273,12 @@ sub load_configuration ($)
+@@ -272,6 +276,12 @@ sub load_configuration ($)
  
        my @words = shellwords ($_);
        my $type = shift @words;
 +
-+      if ($ENV{'STAGING_DIR'})
++      if ($ENV{'STAGING_DIR_HOST'})
 +      {
-+        @words = map { s!^@pkgdatadir@!$ENV{'STAGING_DIR'}/../host/share/autoconf!; $_ } @words;
++        @words = map { s!^@pkgdatadir@!$ENV{'STAGING_DIR_HOST'}/share/autoconf!; $_ } @words;
 +      }
 +
        if ($type eq 'begin-language:')
@@ -79,54 +73,39 @@
  	  fatal "$file:$.: end-language missing for: $lang"
 --- a/bin/autoreconf.in
 +++ b/bin/autoreconf.in
-@@ -1,10 +1,12 @@
--#! @PERL@ -w
-+#! @PERL@
- # -*- perl -*-
- # @configure_input@
- 
- eval 'case $# in 0) exec @PERL@ -S "$0";; *) exec @PERL@ -S "$0" "$@";; esac'
-     if 0;
+@@ -29,10 +29,13 @@ use 5.006;
+ use strict;
+ use warnings FATAL => 'all';
  
 +$^W = 1;
 +
- # autoreconf - install the GNU Build System in a directory tree
- # Copyright (C) 1994, 1999-2012 Free Software Foundation, Inc.
- 
-@@ -26,7 +28,8 @@ eval 'case $# in 0) exec @PERL@ -S "$0";
- 
+ my $buildauxdir;
  BEGIN
  {
 -  my $pkgdatadir = $ENV{'autom4te_perllibdir'} || '@pkgdatadir@';
 +  my $pkgdatadir = $ENV{'autom4te_perllibdir'} ||
-+	($ENV{'STAGING_DIR'} ? $ENV{'STAGING_DIR'} . '/../host/share/autoconf' : '@pkgdatadir@');
++	($ENV{'STAGING_DIR_HOST'} ? $ENV{'STAGING_DIR_HOST'} . '/share/autoconf' : '@pkgdatadir@');
    unshift @INC, $pkgdatadir;
  
-   # Override SHELL.  On DJGPP SHELL may not be set to a shell
-@@ -106,9 +109,9 @@ Written by David J. MacKenzie and Akim D
+   $buildauxdir = $ENV{'autom4te_buildauxdir'} || $pkgdatadir . '/build-aux';
+@@ -117,9 +120,9 @@ Written by David J. MacKenzie and Akim D
  ";
  
  # Lib files.
--my $autoconf   = $ENV{'AUTOCONF'}   || '@bindir@/@autoconf-name@';
--my $autoheader = $ENV{'AUTOHEADER'} || '@bindir@/@autoheader-name@';
--my $autom4te   = $ENV{'AUTOM4TE'}   || '@bindir@/@autom4te-name@';
-+my $autoconf   = $ENV{'AUTOCONF'}   || ($ENV{'STAGING_DIR'} ? $ENV{'STAGING_DIR'} . '/../host/bin/@autoconf-name@' : '@bindir@/@autoconf-name@');
-+my $autoheader = $ENV{'AUTOHEADER'} || ($ENV{'STAGING_DIR'} ? $ENV{'STAGING_DIR'} . '/../host/bin/@autoheader-name@' : '@bindir@/@autoheader-name@');
-+my $autom4te   = $ENV{'AUTOM4TE'}   || ($ENV{'STAGING_DIR'} ? $ENV{'STAGING_DIR'} . '/../host/bin/@autom4te-name@' : '@bindir@/@autom4te-name@');
- my $automake   = $ENV{'AUTOMAKE'}   || 'automake';
- my $aclocal    = $ENV{'ACLOCAL'}    || 'aclocal';
- my $libtoolize = $ENV{'LIBTOOLIZE'} || 'libtoolize';
+-my $autoconf    = $ENV{'AUTOCONF'}    || '@bindir@/@autoconf-name@';
+-my $autoheader  = $ENV{'AUTOHEADER'}  || '@bindir@/@autoheader-name@';
+-my $autom4te    = $ENV{'AUTOM4TE'}    || '@bindir@/@autom4te-name@';
++my $autoconf    = $ENV{'AUTOCONF'}    || ($ENV{'STAGING_DIR_HOST'} ? $ENV{'STAGING_DIR_HOST'} . '/bin/@autoconf-name@' : '@bindir@/@autoconf-name@');
++my $autoheader  = $ENV{'AUTOHEADER'}  || ($ENV{'STAGING_DIR_HOST'} ? $ENV{'STAGING_DIR_HOST'} . '/bin/@autoheader-name@' : '@bindir@/@autoheader-name@');
++my $autom4te    = $ENV{'AUTOM4TE'}    || ($ENV{'STAGING_DIR_HOST'} ? $ENV{'STAGING_DIR_HOST'} . '/bin/@autom4te-name@' : '@bindir@/@autom4te-name@');
+ my $automake    = $ENV{'AUTOMAKE'}    || 'automake';
+ my $aclocal     = $ENV{'ACLOCAL'}     || 'aclocal';
+ my $libtoolize  = $ENV{'LIBTOOLIZE'}  || 'libtoolize';
 --- a/bin/autoscan.in
 +++ b/bin/autoscan.in
-@@ -1,4 +1,4 @@
--#! @PERL@ -w
-+#! @PERL@
- # -*- perl -*-
- # @configure_input@
- 
-@@ -23,9 +23,12 @@
- eval 'case $# in 0) exec @PERL@ -S "$0";; *) exec @PERL@ -S "$0" "$@";; esac'
-     if 0;
+@@ -28,9 +28,12 @@ use 5.006;
+ use strict;
+ use warnings FATAL => 'all';
  
 +$^W = 1;
 +
@@ -134,34 +113,28 @@
  {
 -  my $pkgdatadir = $ENV{'autom4te_perllibdir'} || '@pkgdatadir@';
 +  my $pkgdatadir = $ENV{'autom4te_perllibdir'} ||
-+	($ENV{'STAGING_DIR'} ? $ENV{'STAGING_DIR'} . '/../host/share/autoconf' : '@pkgdatadir@');
++	($ENV{'STAGING_DIR_HOST'} ? $ENV{'STAGING_DIR_HOST'} . '/share/autoconf' : '@pkgdatadir@');
    unshift @INC, $pkgdatadir;
  
    # Override SHELL.  On DJGPP SHELL may not be set to a shell
-@@ -91,10 +94,10 @@ my $configure_scan = 'configure.scan';
+@@ -95,10 +98,10 @@ my %needed_macros =
  my $log;
  
  # Autoconf and lib files.
 -my $autom4te = $ENV{'AUTOM4TE'} || '@bindir@/@autom4te-name@';
-+my $autom4te = $ENV{'AUTOM4TE'} || ($ENV{'STAGING_DIR'} ? $ENV{'STAGING_DIR'} . '/../host/bin/@autom4te-name@' : '@bindir@/@autom4te-name@');
++my $autom4te = $ENV{'AUTOM4TE'} || ($ENV{'STAGING_DIR_HOST'} ? $ENV{'STAGING_DIR_HOST'} . '/bin/@autom4te-name@' : '@bindir@/@autom4te-name@');
  my $autoconf = "$autom4te --language=autoconf";
  my @prepend_include;
 -my @include = ('@pkgdatadir@');
-+my @include = ($ENV{'STAGING_DIR'} ? $ENV{'STAGING_DIR'} . '/../host/share/autoconf' : '@pkgdatadir@');
++my @include = ($ENV{'STAGING_DIR_HOST'} ? $ENV{'STAGING_DIR_HOST'} . '/share/autoconf' : '@pkgdatadir@');
  
  # $help
  # -----
 --- a/bin/autoupdate.in
 +++ b/bin/autoupdate.in
-@@ -1,4 +1,4 @@
--#! @PERL@ -w
-+#! @PERL@
- # -*- perl -*-
- # @configure_input@
- 
-@@ -24,9 +24,12 @@
- eval 'case $# in 0) exec @PERL@ -S "$0";; *) exec @PERL@ -S "$0" "$@";; esac'
-     if 0;
+@@ -29,9 +29,12 @@ use 5.006;
+ use strict;
+ use warnings FATAL => 'all';
  
 +$^W = 1;
 +
@@ -169,60 +142,53 @@
  {
 -  my $pkgdatadir = $ENV{'autom4te_perllibdir'} || '@pkgdatadir@';
 +  my $pkgdatadir = $ENV{'autom4te_perllibdir'} ||
-+	($ENV{'STAGING_DIR'} ? $ENV{'STAGING_DIR'} . '/../host/share/autoconf' : '@pkgdatadir@');
++	($ENV{'STAGING_DIR_HOST'} ? $ENV{'STAGING_DIR_HOST'} . '/share/autoconf' : '@pkgdatadir@');
    unshift @INC, $pkgdatadir;
  
    # Override SHELL.  On DJGPP SHELL may not be set to a shell
-@@ -50,10 +53,10 @@ my $autom4te = $ENV{'AUTOM4TE'} || '@bin
+@@ -55,10 +58,10 @@ my $autom4te = $ENV{'AUTOM4TE'} || '@bin
  my $autoconf = "$autom4te --language=autoconf";
  # We need to find m4sugar.
  my @prepend_include;
 -my @include = ('@pkgdatadir@');
-+my @include = ($ENV{'STAGING_DIR'} ? $ENV{'STAGING_DIR'} . '/../host/share/autoconf' : '@pkgdatadir@');
++my @include = ($ENV{'STAGING_DIR_HOST'} ? $ENV{'STAGING_DIR_HOST'} . '/share/autoconf' : '@pkgdatadir@');
  my $force = 0;
  # m4.
 -my $m4 = $ENV{"M4"} || '@M4@';
-+my $m4 = $ENV{"M4"} || ($ENV{'STAGING_DIR'} ? $ENV{'STAGING_DIR'} . '/../host/bin/m4' : '@M4@');
++my $m4 = $ENV{"M4"} || ($ENV{'STAGING_DIR_HOST'} ? $ENV{'STAGING_DIR_HOST'} . '/bin/m4' : '@M4@');
  
  
  # $HELP
 --- a/bin/ifnames.in
 +++ b/bin/ifnames.in
-@@ -1,10 +1,12 @@
--#! @PERL@ -w
-+#! @PERL@
- # -*- perl -*-
- # @configure_input@
- 
- eval 'case $# in 0) exec @PERL@ -S "$0";; *) exec @PERL@ -S "$0" "$@";; esac'
-     if 0;
+@@ -33,9 +33,12 @@ use 5.006;
+ use strict;
+ use warnings FATAL => 'all';
  
 +$^W = 1;
 +
- # ifnames - print the identifiers used in C preprocessor conditionals
- 
- # Copyright (C) 1994-1995, 1999-2003, 2005-2012 Free Software
-@@ -31,7 +33,8 @@ eval 'case $# in 0) exec @PERL@ -S "$0";
- 
  BEGIN
  {
 -  my $pkgdatadir = $ENV{'autom4te_perllibdir'} || '@pkgdatadir@';
 +  my $pkgdatadir = $ENV{'autom4te_perllibdir'} ||
-+	($ENV{'STAGING_DIR'} ? $ENV{'STAGING_DIR'} . '/../host/share/autoconf' : '@pkgdatadir@');
++	($ENV{'STAGING_DIR_HOST'} ? $ENV{'STAGING_DIR_HOST'} . '/share/autoconf' : '@pkgdatadir@');
    unshift @INC, $pkgdatadir;
  
    # Override SHELL.  On DJGPP SHELL may not be set to a shell
 --- a/bin/autoconf.as
 +++ b/bin/autoconf.as
-@@ -84,7 +84,11 @@ exit_missing_arg='
+@@ -89,8 +89,13 @@ exit_missing_arg='
  # restore font-lock: '
  
  # Variables.
 -: ${AUTOM4TE='@bindir@/@autom4te-name@'}
-+if test -n "$STAGING_DIR"; then
-+	: ${AUTOM4TE="$STAGING_DIR/../host/bin/@autom4te-name@"}
+-: ${trailer_m4='@pkgdatadir@/autoconf/trailer.m4'}
++if test -n "$STAGING_DIR_HOST"; then
++	: ${AUTOM4TE="$STAGING_DIR_HOST/bin/@autom4te-name@"}
++	: ${trailer_m4="$STAGING_DIR_HOST/share/autoconf/autoconf/trailer.m4"}
 +else
 +	: ${AUTOM4TE='@bindir@/@autom4te-name@'}
++	: ${trailer_m4='@pkgdatadir@/autoconf/trailer.m4'}
 +fi
  autom4te_options=
  outfile=
diff --git a/tools/automake/Makefile b/tools/automake/Makefile
index c016f1d76a6ef9..4c1e5758cbcbce 100644
--- a/tools/automake/Makefile
+++ b/tools/automake/Makefile
@@ -8,16 +8,16 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=automake
 PKG_CPE_ID:=cpe:/a:gnu:automake
-PKG_VERSION:=1.15.1
+PKG_VERSION:=1.16.5
+PKG_API_VERSION:=$(word 2,$(subst ., ,$(PKG_VERSION)))
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@GNU/automake
-PKG_HASH:=af6ba39142220687c500f79b4aa2f181d9b24e4f8d8ec497cea4ba26c64bedaf
+PKG_HASH:=f01d58cd6d9d77fbdca9eb4bbd5ead1988228fdb73d6f7a201f5f8d6b118b469
 
 include $(INCLUDE_DIR)/host-build.mk
 
 HOST_CONFIGURE_ARGS += \
-	--datarootdir=$(STAGING_DIR_HOST)/share \
 	--disable-silent-rules
 
 HOST_CONFIGURE_VARS += \
@@ -25,27 +25,29 @@ HOST_CONFIGURE_VARS += \
 	am_cv_prog_PERL_ithreads=no
 
 define Host/Configure
-	(cd $(HOST_BUILD_DIR); $(AM_TOOL_PATHS) STAGING_DIR="" ./bootstrap)
+	(cd $(HOST_BUILD_DIR); $(AM_TOOL_PATHS) STAGING_DIR_HOST="" ./bootstrap)
 	$(call Host/Configure/Default)
 endef
 
 define Host/Install
 	# remove old automake resources to avoid version conflicts
-	rm -rf $(STAGING_DIR_HOST)/share/aclocal-[0-9]*
-	rm -rf $(STAGING_DIR_HOST)/share/automake-[0-9]*
-	$(MAKE) -C $(HOST_BUILD_DIR) install
+	$(call Host/Uninstall)
+	$(call Host/Compile/Default,install)
 	mv $(STAGING_DIR_HOST)/bin/aclocal $(STAGING_DIR_HOST)/bin/aclocal.real
 	$(INSTALL_BIN) ./files/aclocal $(STAGING_DIR_HOST)/bin
-	ln -sf aclocal $(STAGING_DIR_HOST)/bin/aclocal-1.9
-	ln -sf aclocal $(STAGING_DIR_HOST)/bin/aclocal-1.10
-	ln -sf aclocal $(STAGING_DIR_HOST)/bin/aclocal-1.11
-	ln -sf aclocal $(STAGING_DIR_HOST)/bin/aclocal-1.11.6
-	ln -sf aclocal $(STAGING_DIR_HOST)/bin/aclocal-1.15
+	( \
+		api=$(PKG_API_VERSION); \
+		while [ "$$$$api" -ge 11 ]; do \
+			ln -sf aclocal "$(STAGING_DIR_HOST)/bin/aclocal-1.$$$$api"; \
+			api=$$$$(($$$$api - 1)); \
+		done; \
+	)
 endef
 
-define Host/Clean
-	-$(MAKE) -C $(HOST_BUILD_DIR) uninstall
-	$(call Host/Clean/Default)
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
+	rm -rf $(STAGING_DIR_HOST)/share/aclocal-[0-9]*
+	rm -rf $(STAGING_DIR_HOST)/share/automake-[0-9]*
 endef
 
 $(eval $(call HostBuild))
diff --git a/tools/automake/patches/000-relocatable.patch b/tools/automake/patches/000-relocatable.patch
index d05b25e61c2e24..0b61eaeb45a851 100644
--- a/tools/automake/patches/000-relocatable.patch
+++ b/tools/automake/patches/000-relocatable.patch
@@ -1,96 +1,52 @@
 --- a/lib/Automake/Config.in
 +++ b/lib/Automake/Config.in
-@@ -32,7 +32,7 @@ our $PACKAGE = '@PACKAGE@';
+@@ -34,7 +34,7 @@ our $PACKAGE = '@PACKAGE@';
  our $PACKAGE_BUGREPORT = '@PACKAGE_BUGREPORT@';
  our $VERSION = '@VERSION@';
  our $RELEASE_YEAR = '@RELEASE_YEAR@';
--our $libdir = '@datadir@/@PACKAGE@-@APIVERSION@';
-+our $libdir = $ENV{'STAGING_DIR'} ? $ENV{'STAGING_DIR'} . '/../host/share/@PACKAGE@-@APIVERSION@' : '@datadir@/@PACKAGE@-@APIVERSION@';
+-our $libdir = $ENV{"AUTOMAKE_LIBDIR"} || '@datadir@/@PACKAGE@-@APIVERSION@';
++our $libdir = $ENV{'STAGING_DIR_HOST'} ? $ENV{'STAGING_DIR_HOST'} . '/share/@PACKAGE@-@APIVERSION@' : '@datadir@/@PACKAGE@-@APIVERSION@';
  
  our $perl_threads = 0;
  # We need at least this version for CLONE support.
 --- a/bin/aclocal.in
 +++ b/bin/aclocal.in
-@@ -1,10 +1,12 @@
--#!@PERL@ -w
-+#!@PERL@
- # -*- perl -*-
- # @configure_input@
- 
- eval 'case $# in 0) exec @PERL@ -S "$0";; *) exec @PERL@ -S "$0" "$@";; esac'
-     if 0;
+@@ -23,9 +23,11 @@ use 5.006;
+ use strict;
+ use warnings FATAL => 'all';
  
 +$^W = 1;
 +
- # aclocal - create aclocal.m4 by scanning configure.ac
- 
- # Copyright (C) 1996-2017 Free Software Foundation, Inc.
-@@ -27,7 +29,7 @@ eval 'case $# in 0) exec @PERL@ -S "$0";
- 
  BEGIN
  {
--  @Aclocal::perl_libdirs = ('@datadir@/@PACKAGE@-@APIVERSION@')
-+  @Aclocal::perl_libdirs = ($ENV{'STAGING_DIR'} ? $ENV{'STAGING_DIR'} . '/../host/share/@PACKAGE@-@APIVERSION@' : '@datadir@/@PACKAGE@-@APIVERSION@')
-     unless @Aclocal::perl_libdirs;
-   unshift @INC, @Aclocal::perl_libdirs;
+-  unshift (@INC, '@datadir@/@PACKAGE@-@APIVERSION@')
++  unshift (@INC, ($ENV{'STAGING_DIR_HOST'} ? $ENV{'STAGING_DIR_HOST'} . '/share/@PACKAGE@-@APIVERSION@' : '@datadir@/@PACKAGE@-@APIVERSION@'))
+     unless $ENV{AUTOMAKE_UNINSTALLED};
  }
-@@ -69,8 +71,8 @@ $perl_threads = 0;
+ 
+@@ -65,8 +67,8 @@ $perl_threads = 0;
  # ACLOCAL_PATH environment variable, and reset with the '--system-acdir'
  # option.
  my @user_includes = ();
--my @automake_includes = ("@datadir@/aclocal-$APIVERSION");
+-my @automake_includes = ('@datadir@/aclocal-' . $APIVERSION);
 -my @system_includes = ('@datadir@/aclocal');
-+my @automake_includes = ($ENV{'STAGING_DIR'} ? $ENV{'STAGING_DIR'} . "/../host/share/aclocal-$APIVERSION" : "@datadir@/aclocal-$APIVERSION");
-+my @system_includes = ($ENV{'STAGING_DIR'} ? $ENV{'STAGING_DIR'} . '/../host/share/aclocal' : '@datadir@/aclocal');
++my @automake_includes = ($ENV{'STAGING_DIR_HOST'} ? $ENV{'STAGING_DIR_HOST'} . "/share/aclocal-$APIVERSION" : "@datadir@/aclocal-$APIVERSION");
++my @system_includes = ($ENV{'STAGING_DIR_HOST'} ? $ENV{'STAGING_DIR_HOST'} . '/share/aclocal' : '@datadir@/aclocal');
  
  # Whether we should copy M4 file in $user_includes[0].
  my $install = 0;
 --- a/bin/automake.in
 +++ b/bin/automake.in
-@@ -1,10 +1,12 @@
--#!@PERL@ -w
-+#!@PERL@
- # -*- perl -*-
- # @configure_input@
- 
- eval 'case $# in 0) exec @PERL@ -S "$0";; *) exec @PERL@ -S "$0" "$@";; esac'
-     if 0;
+@@ -26,9 +26,11 @@ use 5.006;
+ use strict;
+ use warnings FATAL => 'all';
  
 +$^W = 1;
 +
- # automake - create Makefile.in from Makefile.am
- # Copyright (C) 1994-2017 Free Software Foundation, Inc.
- 
-@@ -31,7 +33,7 @@ use strict;
- 
  BEGIN
  {
--  @Automake::perl_libdirs = ('@datadir@/@PACKAGE@-@APIVERSION@')
-+  @Automake::perl_libdirs = ($ENV{'STAGING_DIR'} ? $ENV{'STAGING_DIR'} . '/../host/share/@PACKAGE@-@APIVERSION@' : '@datadir@/@PACKAGE@-@APIVERSION@')
-     unless @Automake::perl_libdirs;
-   unshift @INC, @Automake::perl_libdirs;
- 
---- a/t/wrap/aclocal.in
-+++ b/t/wrap/aclocal.in
-@@ -1,6 +1,8 @@
--#!@PERL@ -w
-+#!@PERL@
- # @configure_input@
- 
-+$^W = 1;
-+
- # Copyright (C) 2012-2017 Free Software Foundation, Inc.
- 
- # This program is free software; you can redistribute it and/or modify
---- a/t/wrap/automake.in
-+++ b/t/wrap/automake.in
-@@ -1,6 +1,8 @@
--#!@PERL@ -w
-+#!@PERL@
- # @configure_input@
- 
-+$^W = 1;
-+
- # Copyright (C) 2012-2017 Free Software Foundation, Inc.
+-  unshift (@INC, '@datadir@/@PACKAGE@-@APIVERSION@')
++  unshift (@INC, ($ENV{'STAGING_DIR_HOST'} ? $ENV{'STAGING_DIR_HOST'} . '/share/@PACKAGE@-@APIVERSION@' : '@datadir@/@PACKAGE@-@APIVERSION@'))
+     unless $ENV{AUTOMAKE_UNINSTALLED};
  
- # This program is free software; you can redistribute it and/or modify
+   # Override SHELL.  This is required on DJGPP so that system() uses
diff --git a/tools/automake/patches/100-aclocal-skip-not-existing-directories.patch b/tools/automake/patches/100-aclocal-skip-not-existing-directories.patch
index ad019ddd1ae8cf..a0d04e21e5fdc4 100644
--- a/tools/automake/patches/100-aclocal-skip-not-existing-directories.patch
+++ b/tools/automake/patches/100-aclocal-skip-not-existing-directories.patch
@@ -1,6 +1,6 @@
 --- a/bin/aclocal.in
 +++ b/bin/aclocal.in
-@@ -356,6 +356,12 @@ sub scan_m4_dirs ($$@)
+@@ -371,6 +371,12 @@ sub scan_m4_dirs ($$@)
  
    foreach my $m4dir (@dirlist)
      {
diff --git a/tools/automake/patches/101-do-not-require-files.patch b/tools/automake/patches/101-do-not-require-files.patch
new file mode 100644
index 00000000000000..3a8c9fcb47b1ae
--- /dev/null
+++ b/tools/automake/patches/101-do-not-require-files.patch
@@ -0,0 +1,29 @@
+--- a/bin/automake.in
++++ b/bin/automake.in
+@@ -4513,7 +4513,7 @@ sub handle_gettext ()
+ 	    && grep ($_ eq 'intl', @subdirs));
+     }
+ 
+-  require_file ($ac_gettext_location, GNU, 'ABOUT-NLS');
++  require_file ($ac_gettext_location, GNITS, 'ABOUT-NLS');
+ }
+ 
+ # Emit makefile footer.
+@@ -5641,7 +5641,7 @@ sub check_gnu_standards ()
+           # otherwise require non-.md.
+           my $required
+            = (! -f $file && -f "$file.md") ? "$file.md" : $file;
+-          require_file ("$am_file.am", GNU, $required);
++          require_file ("$am_file.am", GNITS, $required);
+         }
+ 
+       # Accept one of these three licenses; default to COPYING.
+@@ -5655,7 +5655,7 @@ sub check_gnu_standards ()
+ 	      last;
+ 	    }
+ 	}
+-      require_file ("$am_file.am", GNU, 'COPYING')
++      require_file ("$am_file.am", GNITS, 'COPYING')
+ 	unless $license;
+     }
+ 
diff --git a/tools/automake/patches/200-other-V-values-for-verbosity.patch b/tools/automake/patches/200-other-V-values-for-verbosity.patch
new file mode 100644
index 00000000000000..1ea9d38b0ed101
--- /dev/null
+++ b/tools/automake/patches/200-other-V-values-for-verbosity.patch
@@ -0,0 +1,59 @@
+From: Bogdan Drozdowski <bogdandr AT op.pl>
+Date: Sat, 31 Dec 2022 20:17:35 +0100
+Subject: [PATCH] Allow other V values for verbosity
+
+---
+ m4/silent.m4    |  2 +-
+ t/silent-gen.sh | 24 ++++++++++++++++++++++++
+ 2 files changed, 25 insertions(+), 1 deletion(-)
+
+--- a/m4/silent.m4
++++ b/m4/silent.m4
+@@ -43,7 +43,7 @@ else
+ fi])
+ if test $am_cv_make_support_nested_variables = yes; then
+   dnl Using '$V' instead of '$(V)' breaks IRIX make.
+-  AM_V='$(V)'
++  AM_V='$(shell if ( test "x$(V)" = "x0" ); then echo 0; elif ( test "x$(V)" = "x" ); then echo $(AM_DEFAULT_VERBOSITY); else echo 1; fi)'
+   AM_DEFAULT_V='$(AM_DEFAULT_VERBOSITY)'
+ else
+   AM_V=$AM_DEFAULT_VERBOSITY
+--- a/t/silent-gen.sh
++++ b/t/silent-gen.sh
+@@ -54,6 +54,18 @@ grep 'cp ' stdout
+ grep 'echo ' stdout
+ 
+ $MAKE clean
++run_make -O V=99
++grep 'GEN ' stdout && exit 1
++grep 'cp ' stdout
++grep 'echo ' stdout
++
++$MAKE clean
++run_make -O V=vvv
++grep 'GEN ' stdout && exit 1
++grep 'cp ' stdout
++grep 'echo ' stdout
++
++$MAKE clean
+ run_make -O V=0
+ grep 'GEN .*foo' stdout
+ grep 'cp ' stdout && exit 1
+@@ -78,5 +90,17 @@ run_make -O V=1
+ grep 'GEN ' stdout && exit 1
+ grep 'cp ' stdout
+ grep 'echo ' stdout
++
++$MAKE clean
++run_make -O V=99
++grep 'GEN ' stdout && exit 1
++grep 'cp ' stdout
++grep 'echo ' stdout
++
++$MAKE clean
++run_make -O V=v
++grep 'GEN ' stdout && exit 1
++grep 'cp ' stdout
++grep 'echo ' stdout
+ 
+ :
diff --git a/tools/b43-tools/Makefile b/tools/b43-tools/Makefile
index a99b0c9e53d2e6..bae498c78fc4f7 100644
--- a/tools/b43-tools/Makefile
+++ b/tools/b43-tools/Makefile
@@ -8,18 +8,15 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=b43-tools
-PKG_DATE:=2017-09-13
+PKG_DATE:=2022-07-05
 
-PKG_SOURCE_URL:=https://github.com/mbuesch/b43-tools.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_SUBDIR:=$(PKG_NAME)
-PKG_SOURCE_VERSION:=27892ef741e7f1d08cb939744f8b8f5dac7b04ae
-PKG_MIRROR_HASH:=f914c36ac566e9e3b5a3a04de16ddb014fcad6a1cf25cdd8e4825c708d28d3f4
-HOST_BUILD_DIR=$(BUILD_DIR_HOST)/$(PKG_NAME)
+PKG_SOURCE_URL:=https://github.com/mbuesch/b43-tools.git
+PKG_SOURCE_VERSION:=2fe10ea6690df9a068cb21cde537236bae784a14
+PKG_MIRROR_HASH:=4f1cde5da35a1e768f6a01d67888549d04512073990769342381af1b2c9e7fd2
 
 include $(INCLUDE_DIR)/host-build.mk
 
-
 define Host/Compile
 	+$(MAKE) $(HOST_JOBS) -C $(HOST_BUILD_DIR)/fwcutter \
 		CFLAGS="$(HOST_CFLAGS) -include endian.h" \
diff --git a/tools/bash/Makefile b/tools/bash/Makefile
index 7c25b83327d548..f4bfc07397db88 100644
--- a/tools/bash/Makefile
+++ b/tools/bash/Makefile
@@ -8,14 +8,18 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=bash
 PKG_CPE_ID:=cpe:/a:gnu:bash
-PKG_VERSION:=5.1.16
+PKG_VERSION:=5.2.15
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=@GNU/bash
-PKG_HASH:=5bac17218d3911834520dad13cd1f85ab944e1c09ae1aba55906be1f8192f558
+PKG_HASH:=13720965b5f4fc3a0d4b61dd37e7565c741da9a5be24edc2ae00182fc1b3588c
 
 HOST_BUILD_PARALLEL := 1
 
 include $(INCLUDE_DIR)/host-build.mk
 
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
+endef
+
 $(eval $(call HostBuild))
diff --git a/tools/bc/Makefile b/tools/bc/Makefile
index 9e1b2ba3361758..2c29e094e23b2e 100644
--- a/tools/bc/Makefile
+++ b/tools/bc/Makefile
@@ -7,15 +7,19 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=bc
-PKG_VERSION:=1.07
+PKG_VERSION:=1.07.1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=@GNU/bc
-PKG_HASH:=55cf1fc33a728d7c3d386cc7b0cb556eb5bacf8e0cb5a3fcca7f109fc61205ad
+PKG_HASH:=62adfca89b0a1c0164c2cdca59ca210c1d44c3ffc46daf9931cf4942664cb02a
 
 PKG_FIXUP := autoreconf
 PKG_CPE_ID:=cpe:/a:gnu:bc
 
 include $(INCLUDE_DIR)/host-build.mk
 
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
+endef
+
 $(eval $(call HostBuild))
diff --git a/tools/bc/patches/002-fix-libmath.patch b/tools/bc/patches/002-fix-libmath.patch
index 1a8439542da0a1..f2212f0953fdb8 100644
--- a/tools/bc/patches/002-fix-libmath.patch
+++ b/tools/bc/patches/002-fix-libmath.patch
@@ -10,7 +10,7 @@
 -w
 -q
 -EOS-EOS
-+#! /bin/bash
++#!/usr/bin/env bash
 +sed -e '1   s/^/{"/' \
 +    -e     's/$/",/' \
 +    -e '2,$ s/^/"/'  \
diff --git a/tools/bison/Makefile b/tools/bison/Makefile
index 5f96463ae02d88..30555541e653a3 100644
--- a/tools/bison/Makefile
+++ b/tools/bison/Makefile
@@ -19,14 +19,14 @@ include $(INCLUDE_DIR)/host-build.mk
 
 HOST_CONFIGURE_ARGS += --enable-threads=posix --disable-nls
 
-define Host/Clean
-	-$(MAKE) -C $(HOST_BUILD_DIR) uninstall
-	$(call Host/Clean/Default)
-endef
-
 define Host/Install
 	$(call Host/Install/Default)
 	$(INSTALL_BIN) ./scripts/yacc $(STAGING_DIR_HOST)/bin/yacc
 endef
 
+define Host/Uninstall
+	rm -f $(STAGING_DIR_HOST)/bin/yacc
+	-$(call Host/Compile/Default,uninstall)
+endef
+
 $(eval $(call HostBuild))
diff --git a/tools/bzip2/Makefile b/tools/bzip2/Makefile
new file mode 100644
index 00000000000000..0c5a92849ad25a
--- /dev/null
+++ b/tools/bzip2/Makefile
@@ -0,0 +1,52 @@
+#
+# Copyright (C) 2022 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=bzip2
+PKG_VERSION:=1.0.8
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://sourceware.org/pub/bzip2
+PKG_HASH:=ab5a03176ee106d3f0fa90e381da478ddae405918153cca248e682cd0c4a2269
+
+PKG_LICENSE:=bzip2-1.0.8
+PKG_LICENSE_FILES:=LICENSE
+PKG_CPE_ID:=cpe:/a:bzip:bzip2
+
+HOST_BUILD_PARALLEL:=1
+
+include $(INCLUDE_DIR)/host-build.mk
+
+HOSTCC := $(HOSTCC_NOCACHE)
+HOST_CFLAGS += $(HOST_FPIC)
+
+HOST_MAKE_FLAGS+= \
+	CFLAGS="$(HOST_CFLAGS)" \
+	LDFLAGS="$(HOST_LDFLAGS)" \
+	ENABLE_BIN_SHARED=1 \
+	ENABLE_BIN_STATIC=0 \
+	ENABLE_LIB_SHARED=1 \
+	ENABLE_LIB_STATIC=1 \
+	ENABLE_DEV=1 \
+	ENABLE_DOCS=1 \
+	ENABLE_TESTS=0 \
+	PREFIX="$(HOST_BUILD_PREFIX)"
+
+define Host/Configure
+endef
+
+define Host/Uninstall
+	$(call Host/Compile/Default,uninstall)
+	$(call Host/Compile/Default,clean)
+endef
+
+define Host/Clean
+endef
+
+$(eval $(call HostBuild))
diff --git a/tools/bzip2/patches/020-no-utime.patch b/tools/bzip2/patches/020-no-utime.patch
new file mode 100644
index 00000000000000..d0cd4f0e35e238
--- /dev/null
+++ b/tools/bzip2/patches/020-no-utime.patch
@@ -0,0 +1,27 @@
+--- a/bzip2.c
++++ b/bzip2.c
+@@ -69,7 +69,6 @@
+ #if BZ_UNIX
+ #   include <fcntl.h>
+ #   include <sys/types.h>
+-#   include <utime.h>
+ #   include <unistd.h>
+ #   include <sys/stat.h>
+ #   include <sys/times.h>
+@@ -1051,12 +1050,12 @@ void applySavedTimeInfoToOutputFile ( Ch
+ {
+ #  if BZ_UNIX
+    IntNative      retVal;
+-   struct utimbuf uTimBuf;
++   struct timespec uTimBuf[2] = {};
+ 
+-   uTimBuf.actime = fileMetaInfo.st_atime;
+-   uTimBuf.modtime = fileMetaInfo.st_mtime;
++   uTimBuf[0].tv_sec = fileMetaInfo.st_atime;
++   uTimBuf[1].tv_sec = fileMetaInfo.st_mtime;
+ 
+-   retVal = utime ( dstName, &uTimBuf );
++   retVal = utimensat ( AT_FDCWD, dstName, uTimBuf , 0 );
+    ERROR_IF_NOT_ZERO ( retVal );
+ #  endif
+ }
diff --git a/tools/bzip2/patches/021-merge-and-improve-makefiles.patch b/tools/bzip2/patches/021-merge-and-improve-makefiles.patch
new file mode 100644
index 00000000000000..9d98c34bdbb417
--- /dev/null
+++ b/tools/bzip2/patches/021-merge-and-improve-makefiles.patch
@@ -0,0 +1,401 @@
+--- a/bzip2.c
++++ b/bzip2.c
+@@ -54,7 +54,7 @@
+ #include <math.h>
+ #include <errno.h>
+ #include <ctype.h>
+-#include "bzlib.h"
++#include <bzlib.h>
+ 
+ #define ERROR_IF_EOF(i)       { if ((i) == EOF)  ioError(); }
+ #define ERROR_IF_NOT_ZERO(i)  { if ((i) != 0)    ioError(); }
+--- a/bzlib_private.h
++++ b/bzlib_private.h
+@@ -30,7 +30,7 @@
+ #include <string.h>
+ #endif
+ 
+-#include "bzlib.h"
++#include <bzlib.h>
+ 
+ 
+ 
+--- a/Makefile
++++ b/Makefile
+@@ -21,11 +21,38 @@
+ LDFLAGS=
+ 
+ BIGFILES=-D_FILE_OFFSET_BITS=64
+-CFLAGS=-Wall -Winline -O2 -g $(BIGFILES)
++CFLAGS_COMMON=-Wall -Winline -O2 -g $(BIGFILES) -I.
++CFLAGS_NOPIC=$(filter-out -O%,$(CFLAGS)) $(CFLAGS_COMMON)
++CFLAGS_PIC=$(filter-out -O%,$(CFLAGS)) -fpic -fPIC $(CFLAGS_COMMON)
+ 
+ # Where you want it installed when you do 'make install'
+-PREFIX=/usr/local
+-
++PREFIX?=/usr/local
++ENABLE_BIN_STATIC?=1
++ENABLE_BIN_SHARED?=1
++ENABLE_LIB_STATIC?=1
++ENABLE_LIB_SHARED?=1
++ENABLE_DEV?=1
++ENABLE_DOCS?=1
++ENABLE_TESTS?=1
++
++ifeq ($(ENABLE_BIN_STATIC),1)
++  ENABLE_BIN=1
++  ifneq ($(ENABLE_LIB_STATIC),1)
++    ENABLE_LIB_STATIC=1
++  endif
++endif
++ifeq ($(ENABLE_BIN_SHARED),1)
++  ENABLE_BIN=1
++  ifneq ($(ENABLE_LIB_SHARED),1)
++    ENABLE_LIB_STATIC=1
++  endif
++endif
++ifeq ($(ENABLE_LIB_STATIC),1)
++  ENABLE_LIB=1
++endif
++ifeq ($(ENABLE_LIB_SHARED),1)
++  ENABLE_LIB=1
++endif
+ 
+ OBJS= blocksort.o  \
+       huffman.o    \
+@@ -35,15 +62,38 @@
+       decompress.o \
+       bzlib.o
+ 
+-all: libbz2.a bzip2 bzip2recover test
+-
+-bzip2: libbz2.a bzip2.o
+-	$(CC) $(CFLAGS) $(LDFLAGS) -o bzip2 bzip2.o -L. -lbz2
++TGTS_all:=
++TGTS_bzip2:=bzip2.o
++TGTS_check:=
++TGTS_install:=
++ifeq ($(ENABLE_LIB),1)
++  TGTS_all+=libbz2
++  TGTS_bzip2+=libbz2
++endif
++ifeq ($(ENABLE_BIN),1)
++  TGTS_all+=bzip2 bzip2recover
++  TGTS_install+=bzip2 bzip2recover
++endif
++ifeq ($(ENABLE_TESTS),1)
++  TGTS_all+=test
++  TGTS_check+=test
++endif
++ 
++all: $(TGTS_all)
++
++bzip2: $(TGTS_bzip2)
++ifeq ($(ENABLE_BIN_STATIC),1)
++	$(CC) $(CFLAGS_NOPIC) $(LDFLAGS) -o bzip2 bzip2.o -L. -lbz2
++endif
++ifeq ($(ENABLE_BIN_SHARED),1)
++	$(CC) $(CFLAGS_PIC) -o bzip2-shared bzip2.o libbz2.so.1.0
++endif
+ 
+ bzip2recover: bzip2recover.o
+-	$(CC) $(CFLAGS) $(LDFLAGS) -o bzip2recover bzip2recover.o
++	$(CC) $(CFLAGS_NOPIC) $(LDFLAGS) -o bzip2recover bzip2recover.o
+ 
+-libbz2.a: $(OBJS)
++libbz2: $(OBJS)
++ifeq ($(ENABLE_LIB_STATIC),1)
+ 	rm -f libbz2.a
+ 	$(AR) cq libbz2.a $(OBJS)
+ 	@if ( test -f $(RANLIB) -o -f /usr/bin/ranlib -o \
+@@ -51,8 +101,18 @@
+ 		echo $(RANLIB) libbz2.a ; \
+ 		$(RANLIB) libbz2.a ; \
+ 	fi
++endif
++ifeq ($(ENABLE_LIB_SHARED),1)
++	$(CC) -shared -Wl,-soname -Wl,libbz2.so.1.0 $(LDFLAGS) -o libbz2.so.1.0.8 $(OBJS)
++	rm -f libbz2.so.1.0
++	rm -f libbz2.so.1
++	rm -f libbz2.so
++	ln -s libbz2.so.1.0.8 libbz2.so.1.0
++	ln -s libbz2.so.1.0 libbz2.so.1
++	ln -s libbz2.so.1 libbz2.so
++endif
+ 
+-check: test
++check: $(TGTS_check)
+ test: bzip2
+ 	@cat words1
+ 	./bzip2 -1  < sample1.ref > sample1.rb2
+@@ -69,69 +129,153 @@
+ 	cmp sample3.tst sample3.ref
+ 	@cat words3
+ 
+-install: bzip2 bzip2recover
++install: $(TGTS_install)
++ifeq ($(ENABLE_BIN),1)
+ 	if ( test ! -d $(PREFIX)/bin ) ; then mkdir -p $(PREFIX)/bin ; fi
++endif
++ifeq ($(ENABLE_LIB),1)
+ 	if ( test ! -d $(PREFIX)/lib ) ; then mkdir -p $(PREFIX)/lib ; fi
++endif
++ifeq ($(ENABLE_DEV),1)
++	if ( test ! -d $(PREFIX)/include ) ; then mkdir -p $(PREFIX)/include ; fi
++endif
++ifeq ($(ENABLE_DOCS),1)
+ 	if ( test ! -d $(PREFIX)/man ) ; then mkdir -p $(PREFIX)/man ; fi
+ 	if ( test ! -d $(PREFIX)/man/man1 ) ; then mkdir -p $(PREFIX)/man/man1 ; fi
+-	if ( test ! -d $(PREFIX)/include ) ; then mkdir -p $(PREFIX)/include ; fi
++endif
++ifeq ($(ENABLE_BIN),1)
++  ifeq ($(ENABLE_BIN_STATIC),1)
+ 	cp -f bzip2 $(PREFIX)/bin/bzip2
+-	cp -f bzip2 $(PREFIX)/bin/bunzip2
+-	cp -f bzip2 $(PREFIX)/bin/bzcat
++	chmod a+rx $(PREFIX)/bin/bzip2
++  endif
++  ifeq ($(ENABLE_BIN_SHARED),1)
++    ifeq ($(ENABLE_BIN_STATIC),1)
++	cp -f bzip2-shared $(PREFIX)/bin/bzip2-shared
++	chmod a+rx $(PREFIX)/bin/bzip2-shared
++    else
++	cp -f bzip2-shared $(PREFIX)/bin/bzip2
++    endif
++  endif
++	rm -f $(PREFIX)/bin/bunzip2
++	rm -f $(PREFIX)/bin/bzcat
++	( cd $(PREFIX)/bin && ln -s bzip2 bunzip2 )
++	( cd $(PREFIX)/bin && ln -s bzip2 bzcat )
++	rm -f $(PREFIX)/bin/bunzip2-shared
++	rm -f $(PREFIX)/bin/bzcat-shared
++  ifeq ($(ENABLE_BIN_SHARED),1)
++    ifeq ($(ENABLE_BIN_STATIC),1)
++	( cd $(PREFIX)/bin && ln -s bzip2-shared bunzip2-shared )
++	( cd $(PREFIX)/bin && ln -s bzip2-shared bzcat-shared )
++    endif
++  endif
+ 	cp -f bzip2recover $(PREFIX)/bin/bzip2recover
+-	chmod a+x $(PREFIX)/bin/bzip2
+-	chmod a+x $(PREFIX)/bin/bunzip2
+-	chmod a+x $(PREFIX)/bin/bzcat
+-	chmod a+x $(PREFIX)/bin/bzip2recover
+-	cp -f bzip2.1 $(PREFIX)/man/man1
+-	chmod a+r $(PREFIX)/man/man1/bzip2.1
+-	cp -f bzlib.h $(PREFIX)/include
+-	chmod a+r $(PREFIX)/include/bzlib.h
+-	cp -f libbz2.a $(PREFIX)/lib
+-	chmod a+r $(PREFIX)/lib/libbz2.a
++	chmod a+rx $(PREFIX)/bin/bzip2recover
+ 	cp -f bzgrep $(PREFIX)/bin/bzgrep
+-	ln -s -f $(PREFIX)/bin/bzgrep $(PREFIX)/bin/bzegrep
+-	ln -s -f $(PREFIX)/bin/bzgrep $(PREFIX)/bin/bzfgrep
+-	chmod a+x $(PREFIX)/bin/bzgrep
++	chmod a+rx $(PREFIX)/bin/bzgrep
++	rm -f $(PREFIX)/bin/bzegrep
++	rm -f $(PREFIX)/bin/bzfgrep
++	( cd $(PREFIX)/bin && ln -s bzgrep bzegrep )
++	( cd $(PREFIX)/bin && ln -s bzgrep bzfgrep )
+ 	cp -f bzmore $(PREFIX)/bin/bzmore
+-	ln -s -f $(PREFIX)/bin/bzmore $(PREFIX)/bin/bzless
+-	chmod a+x $(PREFIX)/bin/bzmore
++	chmod a+rx $(PREFIX)/bin/bzmore
++	rm -f $(PREFIX)/bin/bzless
++	( cd $(PREFIX)/bin && ln -s bzmore bzless )
++	rm -f $(PREFIX)/bin/bzcmp
+ 	cp -f bzdiff $(PREFIX)/bin/bzdiff
+-	ln -s -f $(PREFIX)/bin/bzdiff $(PREFIX)/bin/bzcmp
+-	chmod a+x $(PREFIX)/bin/bzdiff
+-	cp -f bzgrep.1 bzmore.1 bzdiff.1 $(PREFIX)/man/man1
+-	chmod a+r $(PREFIX)/man/man1/bzgrep.1
+-	chmod a+r $(PREFIX)/man/man1/bzmore.1
+-	chmod a+r $(PREFIX)/man/man1/bzdiff.1
++	chmod a+rx $(PREFIX)/bin/bzdiff
++	( cd $(PREFIX)/bin && ln -s bzdiff bzcmp )
++endif
++ifeq ($(ENABLE_DEV),1)
++	cp -f bzlib.h $(PREFIX)/include
++	chmod a+r $(PREFIX)/include/bzlib.h
++endif
++ifeq ($(ENABLE_DOCS),1)
++	cp -f bzip2.1 bzgrep.1 bzmore.1 bzdiff.1 $(PREFIX)/man/man1
+ 	echo ".so man1/bzgrep.1" > $(PREFIX)/man/man1/bzegrep.1
+ 	echo ".so man1/bzgrep.1" > $(PREFIX)/man/man1/bzfgrep.1
+ 	echo ".so man1/bzmore.1" > $(PREFIX)/man/man1/bzless.1
+ 	echo ".so man1/bzdiff.1" > $(PREFIX)/man/man1/bzcmp.1
++	chmod a+r $(PREFIX)/man/man1/bzip2.1
++	chmod a+r $(PREFIX)/man/man1/bzgrep.1
++	chmod a+r $(PREFIX)/man/man1/bzmore.1
++	chmod a+r $(PREFIX)/man/man1/bzdiff.1
++	chmod a+r $(PREFIX)/man/man1/bzegrep.1
++	chmod a+r $(PREFIX)/man/man1/bzfgrep.1
++	chmod a+r $(PREFIX)/man/man1/bzless.1
++	chmod a+r $(PREFIX)/man/man1/bzcmp.1
++endif
++ifeq ($(ENABLE_LIB_SHARED),1)
++	cp -f libbz2.so.1.0.8 $(PREFIX)/lib
++	chmod a+r $(PREFIX)/lib/libbz2.so.1.0.8
++	rm -f $(PREFIX)/lib/libbz2.so.1.0
++	rm -f $(PREFIX)/lib/libbz2.so.1
++	rm -f $(PREFIX)/lib/libbz2.so
++	( cd $(PREFIX)/lib && ln -s libbz2.so.1.0.8 libbz2.so.1.0 )
++	( cd $(PREFIX)/lib && ln -s libbz2.so.1.0 libbz2.so.1 )
++	( cd $(PREFIX)/lib && ln -s libbz2.so.1 libbz2.so )
++endif
++ifeq ($(ENABLE_LIB_STATIC),1)
++	cp -f libbz2.a $(PREFIX)/lib
++	chmod a+r $(PREFIX)/lib/libbz2.a
++endif
++
++uninstall:
++	rm -f $(PREFIX)/bin/bzip2
++	rm -f $(PREFIX)/bin/bzip2-shared
++	rm -f $(PREFIX)/bin/bunzip2
++	rm -f $(PREFIX)/bin/bzcat
++	rm -f $(PREFIX)/bin/bunzip2-shared
++	rm -f $(PREFIX)/bin/bzcat-shared
++	rm -f $(PREFIX)/bin/bzip2recover
++	rm -f $(PREFIX)/bin/bzgrep
++	rm -f $(PREFIX)/bin/bzegrep
++	rm -f $(PREFIX)/bin/bzfgrep
++	rm -f $(PREFIX)/bin/bzmore
++	rm -f $(PREFIX)/bin/bzless
++	rm -f $(PREFIX)/bin/bzdiff
++	rm -f $(PREFIX)/bin/bzcmp
++	rm -f $(PREFIX)/include/bzlib.h
++	rm -f $(PREFIX)/lib/libbz2.so.1.0.8
++	rm -f $(PREFIX)/lib/libbz2.so.1.0
++	rm -f $(PREFIX)/lib/libbz2.so.1
++	rm -f $(PREFIX)/lib/libbz2.so
++	rm -f $(PREFIX)/lib/libbz2.a
++	rm -f $(PREFIX)/man/man1/bzip2.1
++	rm -f $(PREFIX)/man/man1/bzgrep.1
++	rm -f $(PREFIX)/man/man1/bzmore.1
++	rm -f $(PREFIX)/man/man1/bzdiff.1
++	rm -f $(PREFIX)/man/man1/bzegrep.1
++	rm -f $(PREFIX)/man/man1/bzfgrep.1
++	rm -f $(PREFIX)/man/man1/bzless.1
++	rm -f $(PREFIX)/man/man1/bzcmp.1
++	(rmdir $(PREFIX)/bin $(PREFIX)/include $(PREFIX)/lib $(PREFIX)/man/man1 $(PREFIX)/man || true ) 2> /dev/null
+ 
+ clean: 
+-	rm -f *.o libbz2.a bzip2 bzip2recover \
++	rm -f $(OBJS) bzip2.o \
++	libbz2.so.1.0.8 libbz2.so.1.0 libbz2.so.1 libbz2.so \
++	libbz2.a bzip2 bzip2-shared bzip2recover \
+ 	sample1.rb2 sample2.rb2 sample3.rb2 \
+ 	sample1.tst sample2.tst sample3.tst
+ 
+ blocksort.o: blocksort.c
+ 	@cat words0
+-	$(CC) $(CFLAGS) -c blocksort.c
++	$(CC) $(CFLAGS_NOPIC) -c blocksort.c
+ huffman.o: huffman.c
+-	$(CC) $(CFLAGS) -c huffman.c
++	$(CC) $(CFLAGS_NOPIC) -c huffman.c
+ crctable.o: crctable.c
+-	$(CC) $(CFLAGS) -c crctable.c
++	$(CC) $(CFLAGS_NOPIC) -c crctable.c
+ randtable.o: randtable.c
+-	$(CC) $(CFLAGS) -c randtable.c
++	$(CC) $(CFLAGS_NOPIC) -c randtable.c
+ compress.o: compress.c
+-	$(CC) $(CFLAGS) -c compress.c
++	$(CC) $(CFLAGS_NOPIC) -c compress.c
+ decompress.o: decompress.c
+-	$(CC) $(CFLAGS) -c decompress.c
++	$(CC) $(CFLAGS_NOPIC) -c decompress.c
+ bzlib.o: bzlib.c
+-	$(CC) $(CFLAGS) -c bzlib.c
++	$(CC) $(CFLAGS_NOPIC) -c bzlib.c
+ bzip2.o: bzip2.c
+-	$(CC) $(CFLAGS) -c bzip2.c
++	$(CC) $(CFLAGS_NOPIC) -c bzip2.c
+ bzip2recover.o: bzip2recover.c
+-	$(CC) $(CFLAGS) -c bzip2recover.c
++	$(CC) $(CFLAGS_NOPIC) -c bzip2recover.c
+ 
+ 
+ distclean: clean
+@@ -189,7 +333,6 @@
+ 	   $(DISTNAME)/bzmore.1 \
+ 	   $(DISTNAME)/bzgrep \
+ 	   $(DISTNAME)/bzgrep.1 \
+-	   $(DISTNAME)/Makefile-libbz2_so \
+ 	   $(DISTNAME)/bz-common.xsl \
+ 	   $(DISTNAME)/bz-fo.xsl \
+ 	   $(DISTNAME)/bz-html.xsl \
+--- a/Makefile-libbz2_so
++++ b/Makefile-libbz2_so
+@@ -1,59 +0,0 @@
+-
+-# This Makefile builds a shared version of the library, 
+-# libbz2.so.1.0.8, with soname libbz2.so.1.0,
+-# at least on x86-Linux (RedHat 7.2), 
+-# with gcc-2.96 20000731 (Red Hat Linux 7.1 2.96-98).  
+-# Please see the README file for some important info 
+-# about building the library like this.
+-
+-# ------------------------------------------------------------------
+-# This file is part of bzip2/libbzip2, a program and library for
+-# lossless, block-sorting data compression.
+-#
+-# bzip2/libbzip2 version 1.0.8 of 13 July 2019
+-# Copyright (C) 1996-2019 Julian Seward <jseward@acm.org>
+-#
+-# Please read the WARNING, DISCLAIMER and PATENTS sections in the 
+-# README file.
+-#
+-# This program is released under the terms of the license contained
+-# in the file LICENSE.
+-# ------------------------------------------------------------------
+-
+-
+-SHELL=/bin/sh
+-CC=gcc
+-BIGFILES=-D_FILE_OFFSET_BITS=64
+-CFLAGS=-fpic -fPIC -Wall -Winline -O2 -g $(BIGFILES)
+-
+-OBJS= blocksort.o  \
+-      huffman.o    \
+-      crctable.o   \
+-      randtable.o  \
+-      compress.o   \
+-      decompress.o \
+-      bzlib.o
+-
+-all: $(OBJS)
+-	$(CC) -shared -Wl,-soname -Wl,libbz2.so.1.0 -o libbz2.so.1.0.8 $(OBJS)
+-	$(CC) $(CFLAGS) -o bzip2-shared bzip2.c libbz2.so.1.0.8
+-	rm -f libbz2.so.1.0
+-	ln -s libbz2.so.1.0.8 libbz2.so.1.0
+-
+-clean: 
+-	rm -f $(OBJS) bzip2.o libbz2.so.1.0.8 libbz2.so.1.0 bzip2-shared
+-
+-blocksort.o: blocksort.c
+-	$(CC) $(CFLAGS) -c blocksort.c
+-huffman.o: huffman.c
+-	$(CC) $(CFLAGS) -c huffman.c
+-crctable.o: crctable.c
+-	$(CC) $(CFLAGS) -c crctable.c
+-randtable.o: randtable.c
+-	$(CC) $(CFLAGS) -c randtable.c
+-compress.o: compress.c
+-	$(CC) $(CFLAGS) -c compress.c
+-decompress.o: decompress.c
+-	$(CC) $(CFLAGS) -c decompress.c
+-bzlib.o: bzlib.c
+-	$(CC) $(CFLAGS) -c bzlib.c
+--- a/unzcrash.c
++++ b/unzcrash.c
+@@ -30,7 +30,7 @@
+ 
+ #include <stdio.h>
+ #include <assert.h>
+-#include "bzlib.h"
++#include <bzlib.h>
+ 
+ #define M_BLOCK 1000000
+ 
diff --git a/tools/ccache/Makefile b/tools/ccache/Makefile
index 9b2937dccd64c1..33255e92970611 100644
--- a/tools/ccache/Makefile
+++ b/tools/ccache/Makefile
@@ -5,14 +5,13 @@
 # See /LICENSE for more information.
 #
 include $(TOPDIR)/rules.mk
-include $(INCLUDE_DIR)/target.mk
 
 PKG_NAME:=ccache
-PKG_VERSION:=4.6
+PKG_VERSION:=4.8.1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://github.com/ccache/ccache/releases/download/v$(PKG_VERSION)
-PKG_HASH:=3d2bb860f4359169e640f60cf7cc11da5fab5fb9aed55230d78141e49c3945e9
+PKG_HASH:=87959b6819530b3dcaeb39992f585b9fc2c7120302809741378097774919fb6f
 
 include $(INCLUDE_DIR)/host-build.mk
 include $(INCLUDE_DIR)/cmake.mk
@@ -22,20 +21,7 @@ CMAKE_HOST_OPTIONS += \
 	-DCMAKE_CXX_COMPILER_LAUNCHER="" \
 	-DCMAKE_SKIP_RPATH=FALSE \
 	-DCMAKE_INSTALL_RPATH="${STAGING_DIR_HOST}/lib" \
+	-DENABLE_DOCUMENTATION=OFF
 	-DREDIS_STORAGE_BACKEND=OFF
 
-ifneq (docs-$(CONFIG_BUILD_DOCUMENTATION),docs-y)
-CMAKE_HOST_OPTIONS += -DENABLE_DOCUMENTATION=OFF
-endif
-
-define Host/Install/ccache
-	$(INSTALL_DIR) $(STAGING_DIR_HOST)/bin/
-	$(CP) ./files/* $(STAGING_DIR_HOST)/bin/
-endef
-
-define Host/Install
-	$(call Host/Install/Default)
-	$(call Host/Install/ccache)
-endef
-
 $(eval $(call HostBuild))
diff --git a/tools/ccache/patches/100-honour-copts.patch b/tools/ccache/patches/100-honour-copts.patch
index 55422985b770e3..da72af922d0049 100644
--- a/tools/ccache/patches/100-honour-copts.patch
+++ b/tools/ccache/patches/100-honour-copts.patch
@@ -1,10 +1,10 @@
 --- a/src/ccache.cpp
 +++ b/src/ccache.cpp
-@@ -1633,6 +1633,7 @@ calculate_result_and_manifest_key(Contex
-                              "CPLUS_INCLUDE_PATH",
-                              "OBJC_INCLUDE_PATH",
-                              "OBJCPLUS_INCLUDE_PATH", // clang
-+                             "GCC_HONOUR_COPTS",
-                              nullptr};
-     for (const char** p = envvars; *p; ++p) {
-       const char* v = getenv(*p);
+@@ -1813,6 +1813,7 @@ get_manifest_key(Context& ctx, Hash& has
+                            "CPLUS_INCLUDE_PATH",
+                            "OBJC_INCLUDE_PATH",
+                            "OBJCPLUS_INCLUDE_PATH", // clang
++                           "GCC_HONOUR_COPTS",
+                            nullptr};
+   for (const char** p = envvars; *p; ++p) {
+     const char* v = getenv(*p);
diff --git a/tools/cmake/Makefile b/tools/cmake/Makefile
index 9650755ba082b7..0c96b017e3786e 100644
--- a/tools/cmake/Makefile
+++ b/tools/cmake/Makefile
@@ -7,14 +7,15 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=cmake
-PKG_VERSION:=3.24.1
+PKG_VERSION:=3.26.4
+PKG_VERSION_MAJOR:=$(word 1,$(subst ., ,$(PKG_VERSION))).$(word 2,$(subst ., ,$(PKG_VERSION)))
 PKG_RELEASE:=1
 PKG_CPE_ID:=cpe:/a:kitware:cmake
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/Kitware/CMake/releases/download/v$(PKG_VERSION)/ \
-		https://cmake.org/files/v3.24/
-PKG_HASH:=4931e277a4db1a805f13baa7013a7757a0cbfe5b7932882925c7061d9d1fa82b
+		https://cmake.org/files/v$(PKG_VERSION_MAJOR)/
+PKG_HASH:=313b6880c291bd4fe31c0aa51d6e62659282a521e695f30d5cc0d25abbd5c208
 
 HOST_BUILD_PARALLEL:=1
 HOST_CONFIGURE_PARALLEL:=1
@@ -31,6 +32,10 @@ HOST_CONFIGURE_VARS += \
 HOST_CONFIGURE_ARGS := \
 	$(if $(MAKE_JOBSERVER),--parallel="$(MAKE_JOBSERVER)") \
 	--prefix="$(STAGING_DIR_HOST)" \
+	--system-expat \
+	--system-liblzma \
+	--system-zlib \
+	--system-zstd \
 	--generator=Ninja
 
 define Host/Compile/Default
diff --git a/tools/cmake/patches/110-liblzma.patch b/tools/cmake/patches/110-liblzma.patch
new file mode 100644
index 00000000000000..d7cbd434a164f1
--- /dev/null
+++ b/tools/cmake/patches/110-liblzma.patch
@@ -0,0 +1,17 @@
+--- a/Modules/FindLibLZMA.cmake
++++ b/Modules/FindLibLZMA.cmake
+@@ -58,7 +58,13 @@ The following variables are provided for
+ 
+ #]=======================================================================]
+ 
+-find_path(LIBLZMA_INCLUDE_DIR lzma.h )
++if(UNIX)
++  find_package(PkgConfig QUIET)
++  pkg_search_module(PC_liblzma liblzma)
++endif()
++
++find_path(LIBLZMA_INCLUDE_DIR lzma.h HINTS ${PC_liblzma_INCLUDEDIR} ${PC_liblzma_INCLUDE_DIRS})
++find_library(LIBLZMA_LIBRARY NAMES lzma HINTS ${PC_liblzma_LIBDIR} ${PC_liblzma_LIBRARY_DIRS})
+ if(NOT LIBLZMA_LIBRARY)
+   find_library(LIBLZMA_LIBRARY_RELEASE NAMES lzma liblzma NAMES_PER_DIR PATH_SUFFIXES lib)
+   find_library(LIBLZMA_LIBRARY_DEBUG NAMES lzmad liblzmad NAMES_PER_DIR PATH_SUFFIXES lib)
diff --git a/tools/cmake/patches/120-curl-fix-libressl-linking.patch b/tools/cmake/patches/120-curl-fix-libressl-linking.patch
index 6ef37c22cb2531..1744fe5b04cc8c 100644
--- a/tools/cmake/patches/120-curl-fix-libressl-linking.patch
+++ b/tools/cmake/patches/120-curl-fix-libressl-linking.patch
@@ -20,7 +20,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
 ---
 --- a/Utilities/cmcurl/CMakeLists.txt
 +++ b/Utilities/cmcurl/CMakeLists.txt
-@@ -594,6 +594,14 @@ if(CURL_USE_OPENSSL)
+@@ -611,6 +611,14 @@ if(CURL_USE_OPENSSL)
    endif()
    set(SSL_ENABLED ON)
    set(USE_OPENSSL ON)
diff --git a/tools/cmake/patches/130-bootstrap_parallel_make_flag.patch b/tools/cmake/patches/130-bootstrap_parallel_make_flag.patch
index 2b3ba361bd98a7..70d122c9d9ea6a 100644
--- a/tools/cmake/patches/130-bootstrap_parallel_make_flag.patch
+++ b/tools/cmake/patches/130-bootstrap_parallel_make_flag.patch
@@ -1,6 +1,6 @@
 --- a/bootstrap
 +++ b/bootstrap
-@@ -1441,7 +1441,10 @@ int main(){ printf("1%c", (char)0x0a); r
+@@ -1449,7 +1449,10 @@ int main(){ printf("1%c", (char)0x0a); r
  ' > "test.c"
  cmake_original_make_flags="${cmake_make_flags}"
  if test "x${cmake_parallel_make}" != "x"; then
diff --git a/tools/cmake/patches/140-zlib.patch b/tools/cmake/patches/140-zlib.patch
new file mode 100644
index 00000000000000..8b7b7de1b04c0b
--- /dev/null
+++ b/tools/cmake/patches/140-zlib.patch
@@ -0,0 +1,20 @@
+--- a/Modules/FindZLIB.cmake
++++ b/Modules/FindZLIB.cmake
+@@ -117,10 +117,13 @@ else()
+   set(ZLIB_NAMES_DEBUG zd zlibd zdlld zlibd1 zlib1d zlibstaticd zlibwapid zlibvcd zlibstatd)
+ endif()
+ 
+-# Try each search configuration.
+-foreach(search ${_ZLIB_SEARCHES})
+-  find_path(ZLIB_INCLUDE_DIR NAMES zlib.h ${${search}} PATH_SUFFIXES include)
+-endforeach()
++if(UNIX)
++  find_package(PkgConfig QUIET)
++  pkg_search_module(PC_zlib zlib)
++endif()
++
++find_path(ZLIB_INCLUDE_DIR zlib.h HINTS ${PC_zlib_INCLUDEDIR} ${PC_zlib_INCLUDE_DIRS})
++find_library(ZLIB_LIBRARY NAMES z HINTS ${PC_zlib_LIBDIR} ${PC_zlib_LIBRARY_DIRS})
+ 
+ # Allow ZLIB_LIBRARY to be set manually, as the location of the zlib library
+ if(NOT ZLIB_LIBRARY)
diff --git a/tools/cmake/patches/150-zstd-libarchive.patch b/tools/cmake/patches/150-zstd-libarchive.patch
new file mode 100644
index 00000000000000..34f7240fe41703
--- /dev/null
+++ b/tools/cmake/patches/150-zstd-libarchive.patch
@@ -0,0 +1,18 @@
+--- a/Utilities/cmlibarchive/CMakeLists.txt
++++ b/Utilities/cmlibarchive/CMakeLists.txt
+@@ -632,8 +632,13 @@ IF(ENABLE_ZSTD)
+     SET(ZSTD_FIND_QUIETLY TRUE)
+   ENDIF (ZSTD_INCLUDE_DIR)
+ 
+-  FIND_PATH(ZSTD_INCLUDE_DIR zstd.h)
+-  FIND_LIBRARY(ZSTD_LIBRARY NAMES zstd libzstd)
++  IF(UNIX)
++  FIND_PACKAGE(PkgConfig QUIET)
++  PKG_SEARCH_MODULE(PC_ZSTD libzstd)
++  ENDIF()
++
++  FIND_PATH(ZSTD_INCLUDE_DIR zstd.h HINTS ${PC_ZSTD_INCLUDEDIR} ${PC_ZSTD_INCLUDE_DIRS})
++  FIND_LIBRARY(ZSTD_LIBRARY NAMES zstd HINTS ${PC_ZSTD_LIBDIR} ${PC_ZSTD_LIBRARY_DIRS})
+   INCLUDE(FindPackageHandleStandardArgs)
+   FIND_PACKAGE_HANDLE_STANDARD_ARGS(ZSTD DEFAULT_MSG ZSTD_LIBRARY ZSTD_INCLUDE_DIR)
+ ELSE(ENABLE_ZSTD)
diff --git a/tools/coreutils/Makefile b/tools/coreutils/Makefile
index 87c9102fa6219c..86302862060239 100644
--- a/tools/coreutils/Makefile
+++ b/tools/coreutils/Makefile
@@ -8,31 +8,61 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=coreutils
 PKG_CPE_ID:=cpe:/a:gnu:coreutils
-PKG_VERSION:=8.32
+PKG_VERSION:=9.3
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@GNU/coreutils
-PKG_HASH:=4458d8de7849df44ccab15e16b1548b285224dbba5f08fac070c1c0e0bcc4cfa
+PKG_HASH:=adbcfcfe899235b71e8768dcf07cd532520b7f54f9a8064843f8d199a904bbaa
 
 HOST_BUILD_PARALLEL := 1
 
-BUILD_PROGRAMS = date readlink touch ln chown ginstall
+PKG_PROGRAMS:=date readlink touch ln chown ginstall
 
 include $(INCLUDE_DIR)/host-build.mk
 
-BUILD_BINS = $(patsubst %,src/%,$(BUILD_PROGRAMS))
+export GNULIB_SRCDIR:=$(HOST_GNULIB_SRCDIR)
 
 HOST_CONFIGURE_ARGS += \
-	 --enable-install-program=$(subst $(space),$(comma),$(strip $(BUILD_PROGRAMS)))
+	 --enable-install-program=$(subst $(space),$(comma),$(strip $(PKG_PROGRAMS)))
 
 HOST_MAKE_FLAGS += \
-	PROGRAMS="$(BUILD_BINS)" \
+	$(AM_TOOL_PATHS_FAKE) \
+	PROGRAMS="$(patsubst %,src/%,$(PKG_PROGRAMS))" \
 	LIBRARIES= MANS= SUBDIRS=.
 
+define Host/Bootstrap
+	( \
+		cd $(HOST_BUILD_DIR); \
+		$(AM_TOOL_PATHS_FAKE) \
+		./bootstrap \
+			--bootstrap-sync \
+			--force \
+			--no-git \
+			--skip-po \
+			--gnulib-srcdir=$(GNULIB_SRCDIR) \
+	)
+endef
+
+define Host/Prepare
+	$(call Host/Prepare/Default)
+	$(if $(QUILT),,$(call Host/Bootstrap))
+endef
+
+define Host/Configure
+	$(if $(QUILT),$(call Host/Bootstrap))
+	-$(CP) $(HOST_BUILD_DIR)/lib/time.in.h~ $(HOST_BUILD_DIR)/lib/time.in.h # @GNULIB_TIME@ not defined
+	$(call Host/Configure/Default)
+endef
+
 define Host/Install
 	$(INSTALL_DIR) $(1)/bin
-	$(INSTALL_BIN) $(patsubst %,$(HOST_BUILD_DIR)/%,$(BUILD_BINS)) $(1)/bin/
+	$(INSTALL_BIN) $(patsubst %,$(HOST_BUILD_DIR)/src/%,$(PKG_PROGRAMS)) $(1)/bin/
 	ln -sf ginstall $(1)/bin/install
 endef
 
+define Host/Uninstall
+	rm -f $(STAGING_DIR_HOST)/bin/install
+	-$(call Host/Compile/Default,uninstall)
+endef
+
 $(eval $(call HostBuild))
diff --git a/tools/coreutils/patches/000-bootstrap.patch b/tools/coreutils/patches/000-bootstrap.patch
new file mode 100644
index 00000000000000..91be9d338a2bf2
--- /dev/null
+++ b/tools/coreutils/patches/000-bootstrap.patch
@@ -0,0 +1,45 @@
+--- a/bootstrap
++++ b/bootstrap
+@@ -278,7 +278,7 @@ check_exists() {
+       ($2 --version </dev/null)
+     fi
+   else
+-    ($1 --version </dev/null) >/dev/null 2>&1
++    ($@ --version </dev/null) >/dev/null 2>&1
+   fi
+ 
+   test $? -lt 126
+@@ -563,7 +563,7 @@ p
+ q'
+ 
+ get_version() {
+-  app=$1
++  app="$@"
+ 
+   $app --version >/dev/null 2>&1 || { $app --version; return 1; }
+ 
+@@ -620,13 +620,13 @@ check_versions() {
+     if [ "$req_ver" = "-" ]; then
+       # Merely require app to exist; not all prereq apps are well-behaved
+       # so we have to rely on $? rather than get_version.
+-      if ! check_exists --verbose $app; then
++      if ! check_exists --verbose "$app"; then
+         warn_ "Error: '$app' not found"
+         ret=1
+       fi
+     else
+       # Require app to produce a new enough version string.
+-      inst_ver=$(get_version $app)
++      inst_ver=$(get_version "$app")
+       if [ ! "$inst_ver" ]; then
+         warn_ "Error: '$app' not found"
+         ret=1
+@@ -923,7 +923,7 @@ version_controlled_file() {
+ # two just-pre-run programs.
+ 
+ # Import from gettext.
+-with_gettext=yes
++with_gettext=no
+ grep '^[	 ]*AM_GNU_GETTEXT_VERSION(' configure.ac >/dev/null || \
+     with_gettext=no
+ 
diff --git a/tools/cpio/Makefile b/tools/cpio/Makefile
index 28522098476208..1550785ddc5d71 100644
--- a/tools/cpio/Makefile
+++ b/tools/cpio/Makefile
@@ -3,12 +3,16 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=cpio
 PKG_CPE_ID:=cpe:/a:gnu:cpio
-PKG_VERSION:=2.13
+PKG_VERSION:=2.14
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=@GNU/cpio
-PKG_HASH:=eab5bdc5ae1df285c59f2a4f140a98fc33678a0bf61bdba67d9436ae26b46f6d
+PKG_HASH:=fcdc15d60f7267a6fc7efcd6b9db7b6c8966c4f2fbbb964c24d41336fd3f2c12
 
 include $(INCLUDE_DIR)/host-build.mk
 
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
+endef
+
 $(eval $(call HostBuild))
diff --git a/tools/dosfstools/Makefile b/tools/dosfstools/Makefile
index d52c46b3022f9d..b332efdb96cab9 100644
--- a/tools/dosfstools/Makefile
+++ b/tools/dosfstools/Makefile
@@ -11,10 +11,10 @@ PKG_NAME:=dosfstools
 PKG_CPE_ID:=cpe:/a:dosfstools_project:dosfstools
 PKG_VERSION:=4.2
 
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/dosfstools/dosfstools/releases/download/v$(PKG_VERSION)/ \
 		http://fossies.org/linux/misc
-PKG_HASH:=ba7c716ff9b8208a3bba5094a77584a7dc814141de09ab4ce1ae9b84bbcd7844
+PKG_HASH:=64926eebf90092dca21b14259a5301b7b98e7b1943e8a201c7d726084809b527
 
 HOST_FIXUP:=autoreconf
 
@@ -24,4 +24,8 @@ ifeq ($(HOST_OS),Darwin)
 HOST_CFLAGS += -UHAVE_ENDIAN_H
 endif
 
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
+endef
+
 $(eval $(call HostBuild))
diff --git a/tools/dosfstools/patches/100-source-date-epoch.patch b/tools/dosfstools/patches/100-source-date-epoch.patch
new file mode 100644
index 00000000000000..c758caa4c1df17
--- /dev/null
+++ b/tools/dosfstools/patches/100-source-date-epoch.patch
@@ -0,0 +1,150 @@
+From 8da7bc93315cb0c32ad868f17808468b81fa76ec Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Forsman?= <bjorn.forsman@gmail.com>
+Date: Wed, 5 Dec 2018 19:52:51 +0100
+Subject: [PATCH] Honor the SOURCE_DATE_EPOCH variable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Implement the SOURCE_DATE_EPOCH specification[1] for reproducible
+builds. If SOURCE_DATE_EPOCH is set, use it as timestamp instead of the
+current time.
+
+[1] https://reproducible-builds.org/specs/source-date-epoch/
+
+Signed-off-by: Bjørn Forsman <bjorn.forsman@gmail.com>
+---
+ src/boot.c     | 23 +++++++++++++++++++++--
+ src/common.c   | 18 ++++++++++++++++--
+ src/mkfs.fat.c | 19 ++++++++++++++++---
+ 3 files changed, 53 insertions(+), 7 deletions(-)
+
+--- a/src/boot.c
++++ b/src/boot.c
+@@ -33,6 +33,8 @@
+ #include <stdlib.h>
+ #include <sys/types.h>
+ #include <time.h>
++#include <errno.h>
++#include <ctype.h>
+ 
+ #include "common.h"
+ #include "fsck.fat.h"
+@@ -672,6 +674,7 @@ void write_volume_label(DOS_FS * fs, cha
+ {
+     time_t now;
+     struct tm *mtime;
++    char *source_date_epoch = NULL;
+     off_t offset;
+     int created;
+     DIR_ENT de;
+@@ -687,8 +690,24 @@ void write_volume_label(DOS_FS * fs, cha
+     if (de.name[0] == 0xe5)
+ 	de.name[0] = 0x05;
+ 
+-    now = time(NULL);
+-    mtime = (now != (time_t)-1) ? localtime(&now) : NULL;
++    source_date_epoch = getenv("SOURCE_DATE_EPOCH");
++    if (source_date_epoch) {
++        char *tmp = NULL;
++        long long conversion = 0;
++        errno = 0;
++        conversion = strtoll(source_date_epoch, &tmp, 10);
++        now = conversion;
++        if (!isdigit((unsigned char)*source_date_epoch) || *tmp != '\0'
++                || errno != 0 || (long long)now != conversion) {
++            die("SOURCE_DATE_EPOCH is too big or contains non-digits: \"%s\"",
++                source_date_epoch);
++        }
++        mtime = gmtime(&now);
++    } else {
++        now = time(NULL);
++        mtime = (now != (time_t)-1) ? localtime(&now) : NULL;
++    }
++
+     if (mtime && mtime->tm_year >= 80 && mtime->tm_year <= 207) {
+ 	de.time = htole16((unsigned short)((mtime->tm_sec >> 1) +
+ 					   (mtime->tm_min << 5) +
+--- a/src/common.c
++++ b/src/common.c
+@@ -30,6 +30,7 @@
+ #include <string.h>
+ #include <stdarg.h>
+ #include <errno.h>
++#include <ctype.h>
+ #include <wctype.h>
+ #include <termios.h>
+ #include <sys/time.h>
+@@ -298,8 +299,21 @@ void check_atari(void)
+ uint32_t generate_volume_id(void)
+ {
+     struct timeval now;
++    char *source_date_epoch = NULL;
+ 
+-    if (gettimeofday(&now, NULL) != 0 || now.tv_sec == (time_t)-1 || now.tv_sec < 0) {
++    source_date_epoch = getenv("SOURCE_DATE_EPOCH");
++    if (source_date_epoch) {
++        char *tmp = NULL;
++        long long conversion = 0;
++        errno = 0;
++        conversion = strtoll(source_date_epoch, &tmp, 10);
++        if (!isdigit((unsigned char)*source_date_epoch) || *tmp != '\0'
++                || errno != 0) {
++            die("SOURCE_DATE_EPOCH is too big or contains non-digits: \"%s\"",
++                source_date_epoch);
++        }
++        return (uint32_t)conversion;
++    } else if (gettimeofday(&now, NULL) != 0 || now.tv_sec == (time_t)-1 || now.tv_sec < 0) {
+         srand(getpid());
+         /* rand() returns int from [0,RAND_MAX], therefore only 31 bits */
+         return (((uint32_t)(rand() & 0xFFFF)) << 16) | ((uint32_t)(rand() & 0xFFFF));
+--- a/src/mkfs.fat.c
++++ b/src/mkfs.fat.c
+@@ -1074,7 +1074,7 @@ static void setup_tables(void)
+         }
+ 
+         /* If is not available then generate random 32 bit disk signature */
+-        if (invariant)
++        if (invariant || getenv("SOURCE_DATE_EPOCH"))
+             disk_sig = volume_id;
+         else if (!disk_sig)
+             disk_sig = generate_volume_id();
+@@ -1287,7 +1287,7 @@ static void setup_tables(void)
+ 	    de->name[0] = 0x05;
+ 	de->attr = ATTR_VOLUME;
+ 	if (create_time != (time_t)-1) {
+-	    if (!invariant)
++	    if (!invariant && !getenv("SOURCE_DATE_EPOCH"))
+ 		ctime = localtime(&create_time);
+ 	    else
+ 		ctime = gmtime(&create_time);
+@@ -1477,6 +1477,7 @@ int main(int argc, char **argv)
+     int blocks_specified = 0;
+     struct timeval create_timeval;
+     long long conversion;
++    char *source_date_epoch = NULL;
+ 
+     enum {OPT_HELP=1000, OPT_INVARIANT, OPT_MBR, OPT_VARIANT, OPT_CODEPAGE, OPT_OFFSET};
+     const struct option long_options[] = {
+@@ -1497,8 +1498,20 @@ int main(int argc, char **argv)
+ 	    program_name = p + 1;
+     }
+ 
+-    if (gettimeofday(&create_timeval, NULL) == 0 && create_timeval.tv_sec != (time_t)-1)
++    source_date_epoch = getenv("SOURCE_DATE_EPOCH");
++    if (source_date_epoch) {
++        errno = 0;
++        conversion = strtoll(source_date_epoch, &tmp, 10);
++        create_time = conversion;
++        if (!isdigit((unsigned char)*source_date_epoch) || *tmp != '\0'
++                || errno != 0 || (long long)create_time != conversion) {
++            die("SOURCE_DATE_EPOCH is too big or contains non-digits: \"%s\"",
++                source_date_epoch);
++        }
++    } else if (gettimeofday(&create_timeval, NULL) == 0 && create_timeval.tv_sec != (time_t)-1) {
+         create_time = create_timeval.tv_sec;
++    }
++
+     volume_id = generate_volume_id();
+     check_atari();
+ 
diff --git a/tools/dosfstools/patches/101-config-switch-to-AC_CHECK_LIB.patch b/tools/dosfstools/patches/101-config-switch-to-AC_CHECK_LIB.patch
new file mode 100644
index 00000000000000..ba2d00bf84b663
--- /dev/null
+++ b/tools/dosfstools/patches/101-config-switch-to-AC_CHECK_LIB.patch
@@ -0,0 +1,28 @@
+From e7671c2a3be03d790cbc225cd3e784b5434fb5da Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Mon, 16 Jan 2023 01:29:22 +0100
+Subject: [PATCH] config: switch to AC_CHECK_LIB
+
+This fixes spurious build-errors on OpenWrt, where the AM_ICONV macro
+is undefined while invoking autoconfig. Later in the build, the ICONV
+LDOPTIONS are set to @LIBICONV@, failing the build.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ configure.ac | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/configure.ac
++++ b/configure.ac
+@@ -70,10 +70,7 @@ AC_CHECK_DECLS([getmntent], [], [], [[#i
+ AC_CHECK_DECLS([getmntinfo], [], [], [[#include <sys/mount.h>]])
+ 
+ # optional iconv support
+-AC_ARG_WITH([iconv], AS_HELP_STRING([--without-iconv], [build without iconv support]))
+-if test "x$with_iconv" != "xno"; then
+-	AM_ICONV
+-fi
++AC_CHECK_LIB(iconv, iconv_open)
+ 
+ # xxd (distributed with vim) is used in the testsuite
+ AC_CHECK_PROG([XXD_FOUND], [xxd], [yes])
diff --git a/tools/dwarves/Makefile b/tools/dwarves/Makefile
index 41f05327011bf4..0e84a1ba9fdcdd 100644
--- a/tools/dwarves/Makefile
+++ b/tools/dwarves/Makefile
@@ -3,16 +3,16 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dwarves
+PKG_VERSION:=1.25
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
+PKG_SOURCE_URL:=https://fedorapeople.org/~acme/dwarves/
+PKG_HASH:=e7d45955f6f4eca25a4c8c3bd6611059b35dc217e45976681d7db170fccdec4a
 
-PKG_SOURCE_VERSION:=v1.23
-PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=https://git.kernel.org/pub/scm/devel/pahole/pahole.git
-PKG_MIRROR_HASH:=6ab1bb1dbdf6c73ffcf485d909229dc1da1a3d24efd213e92c56489b58d6a4bd
 PKG_LICENSE:=GPL-2.0-only
 PKG_LICENSE_FILES:=COPYING
 
-HOST_BUILD_PARALLEL:=1
-
 include $(INCLUDE_DIR)/host-build.mk
 include $(INCLUDE_DIR)/cmake.mk
 
diff --git a/tools/e2fsprogs/Makefile b/tools/e2fsprogs/Makefile
index 004a04ea261fef..0aa85af3f105e8 100644
--- a/tools/e2fsprogs/Makefile
+++ b/tools/e2fsprogs/Makefile
@@ -9,8 +9,8 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=e2fsprogs
 PKG_CPE_ID:=cpe:/a:e2fsprogs_project:e2fsprogs
-PKG_VERSION:=1.46.5
-PKG_HASH:=2f16c9176704cf645dc69d5b15ff704ae722d665df38b2ed3cfc249757d8d81e
+PKG_VERSION:=1.47.0
+PKG_HASH:=144af53f2bbd921cef6f8bea88bb9faddca865da3fbc657cc9b4d2001097d5db
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
diff --git a/tools/e2fsprogs/patches/003-no-crond.patch b/tools/e2fsprogs/patches/003-no-crond.patch
index a7ea52b1acfc85..67ddd4ab0ce90f 100644
--- a/tools/e2fsprogs/patches/003-no-crond.patch
+++ b/tools/e2fsprogs/patches/003-no-crond.patch
@@ -1,11 +1,11 @@
 --- a/configure
 +++ b/configure
-@@ -12538,7 +12538,7 @@ $as_echo_n "checking for system crontab
+@@ -15259,7 +15259,7 @@ then :
  
- 		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: ${crond_dir}" >&5
- $as_echo "${crond_dir}" >&6; }
+ 		{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: ${crond_dir}" >&5
+ printf "%s\n" "${crond_dir}" >&6; }
 -		have_crond="yes"
 +		have_crond="no"; with_crond_dir=""
  
- else
+ else $as_nop
  
diff --git a/tools/elfutils/Makefile b/tools/elfutils/Makefile
index 92a916ec4dc818..f9c6272719c890 100644
--- a/tools/elfutils/Makefile
+++ b/tools/elfutils/Makefile
@@ -3,12 +3,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=elfutils
-PKG_VERSION:=0.187
+PKG_VERSION:=0.189
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://sourceware.org/$(PKG_NAME)/ftp/$(PKG_VERSION)
-PKG_HASH:=e70b0dfbe610f90c4d1fe0d71af142a4e25c3c4ef9ebab8d2d72b65159d454c8
+PKG_HASH:=39bd8f1a338e2b7cd4abc3ff11a0eddc6e690f69578a57478d8179b4148708c8
 
 PKG_LICENSE:=GPL-3.0-or-later
 PKG_LICENSE_FILES:=COPYING COPYING-GPLV2 COPYING-LGPLV3
@@ -30,4 +30,8 @@ HOST_CONFIGURE_ARGS += \
 HOST_MAKE_FLAGS += \
 	SUBDIRS="lib libelf libcpu backends libebl libdwelf libdwfl libdw"
 
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
+endef
+
 $(eval $(call HostBuild))
diff --git a/tools/expat/Makefile b/tools/expat/Makefile
index 7079dabcaf465a..c1a8cb8d97927f 100644
--- a/tools/expat/Makefile
+++ b/tools/expat/Makefile
@@ -9,25 +9,25 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=expat
 PKG_CPE_ID:=cpe:/a:libexpat:expat
-PKG_VERSION:=2.4.8
+PKG_VERSION:=2.5.0
 
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
-PKG_HASH:=a247a7f6bbb21cf2ca81ea4cbb916bfb9717ca523631675f99b3d4a5678dcd16
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
+PKG_HASH:=ef2420f0232c087801abf705e89ae65f6257df6b7931d37846a193ef2e8cdcbe
 PKG_SOURCE_URL:=https://github.com/libexpat/libexpat/releases/download/R_$(subst .,_,$(PKG_VERSION))
 
+HOST_BUILD_PARALLEL:=1
+
 include $(INCLUDE_DIR)/host-build.mk
-include $(INCLUDE_DIR)/cmake.mk
-
-CMAKE_HOST_OPTIONS += \
-	-DDOCBOOK_TO_MAN=OFF \
-	-DEXPAT_BUILD_TOOLS=OFF \
-	-DEXPAT_BUILD_EXAMPLES=OFF \
-	-DEXPAT_BUILD_TESTS=OFF \
-	-DEXPAT_BUILD_DOCS=OFF \
-	-DEXPAT_WITH_LIBBSD=OFF \
-	-DEXPAT_ENABLE_INSTALL=ON \
-	-DEXPAT_DTD=ON \
-	-DEXPAT_NS=OFF \
-	-DEXPAT_DEV_URANDOM=OFF
+
+HOSTCC := $(HOSTCC_NOCACHE)
+
+HOST_CONFIGURE_ARGS += \
+	--disable-shared \
+	--without-docbook \
+	--with-pic
+
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
+endef
 
 $(eval $(call HostBuild))
diff --git a/tools/fakeroot/Makefile b/tools/fakeroot/Makefile
index 5d31e197819f1f..efd9227d1a9074 100644
--- a/tools/fakeroot/Makefile
+++ b/tools/fakeroot/Makefile
@@ -25,4 +25,8 @@ HOST_CONFIGURE_VARS += \
 HOST_CONFIGURE_ARGS += \
 	--with-ipc=tcp
 
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
+endef
+
 $(eval $(call HostBuild))
diff --git a/tools/findutils/Makefile b/tools/findutils/Makefile
index d0d780689ba147..fd0cde2145edea 100644
--- a/tools/findutils/Makefile
+++ b/tools/findutils/Makefile
@@ -14,6 +14,8 @@ PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@GNU/$(PKG_NAME)
 PKG_HASH:=a2bfb8c09d436770edc59f50fa483e785b161a3b7b9d547573cb08065fd462fe
 
+PKG_PROGRAMS:=find locate updatedb xargs
+
 HOST_BUILD_PARALLEL:=1
 
 include $(INCLUDE_DIR)/host-build.mk
@@ -28,4 +30,8 @@ HOST_CONFIGURE_ARGS += \
 	--disable-nls \
 	--without-selinux
 
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
+endef
+
 $(eval $(call HostBuild))
diff --git a/tools/firmware-utils/Makefile b/tools/firmware-utils/Makefile
index 731bc8a04c597f..0ef79f4c76e92a 100644
--- a/tools/firmware-utils/Makefile
+++ b/tools/firmware-utils/Makefile
@@ -11,9 +11,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/firmware-utils.git
-PKG_SOURCE_DATE:=2022-09-12
-PKG_SOURCE_VERSION:=0c92b20ad488a4fb5fb290f6d1b893df45761275
-PKG_MIRROR_HASH:=2cfd36e749b51d539cffe22c77a4c3ccd3bac2eca482affe23e1cab539e8bd16
+PKG_SOURCE_DATE:=2023-05-18
+PKG_SOURCE_VERSION:=02cdbc6a4d61605c008efef09162f772f553fcde
+PKG_MIRROR_HASH:=f5188fc38bb03ddbcc34763ff049597e2d8af98c0854910dc87f10e5927096e2
 
 include $(INCLUDE_DIR)/host-build.mk
 include $(INCLUDE_DIR)/cmake.mk
diff --git a/tools/firmware-utils/patches/001-add-sifiveu-guid-types.patch b/tools/firmware-utils/patches/001-add-sifiveu-guid-types.patch
new file mode 100644
index 00000000000000..45900e982c9c4c
--- /dev/null
+++ b/tools/firmware-utils/patches/001-add-sifiveu-guid-types.patch
@@ -0,0 +1,38 @@
+diff -ruN firmware-utils-2022-02-28-002cfaf0.old/src/ptgen.c firmware-utils-2022-02-28-002cfaf0/src/ptgen.c
+--- firmware-utils-2022-02-28-002cfaf0.old/src/ptgen.c	2022-04-23 19:02:07.307896842 +0200
++++ firmware-utils-2022-02-28-002cfaf0/src/ptgen.c	2022-04-22 18:48:54.477970950 +0200
+@@ -82,6 +82,14 @@
+ 	GUID_INIT( 0x0fc63daf, 0x8483, 0x4772, \
+ 			0x8e, 0x79, 0x3d, 0x69, 0xd8, 0x47, 0x7d, 0xe4)
+ 
++#define GUID_PARTITION_SIFIVE_SPL \
++	GUID_INIT( 0x5b193300, 0xfc78, 0x40cd, \
++			0x80, 0x02, 0xe8, 0x6c, 0x45, 0x58, 0x0b, 0x47)
++
++#define GUID_PARTITION_SIFIVE_UBOOT \
++	GUID_INIT( 0x2e54b353, 0x1271, 0x4842, \
++			0x80, 0x6f, 0xe4, 0x36, 0xd6, 0xaf, 0x69, 0x85)
++
+ #define GPT_HEADER_SIZE         92
+ #define GPT_ENTRY_SIZE          128
+ #define GPT_ENTRY_MAX           128
+@@ -276,6 +284,19 @@
+ 			      (1ULL << 56);  /* success=1 */
+ 		return true;
+ 	}
++
++	if (!strcmp(type, "sifiveu_spl")) {
++		part->has_guid = true;
++		part->guid = GUID_PARTITION_SIFIVE_SPL;
++		return true;
++	}
++
++	if (!strcmp(type, "sifiveu_uboot")) {
++		part->has_guid = true;
++		part->guid = GUID_PARTITION_SIFIVE_UBOOT;
++		return true;
++	}
++
+ 	return false;
+ }
+ 
diff --git a/tools/flex/Makefile b/tools/flex/Makefile
index bb5aecbdfeadee..86ba5a4415d3a8 100644
--- a/tools/flex/Makefile
+++ b/tools/flex/Makefile
@@ -21,13 +21,21 @@ include $(INCLUDE_DIR)/host-build.mk
 
 HOST_CONFIGURE_ARGS += --disable-shared
 
+define Host/Compile
+	$(call Host/Compile/Default,SUBDIRS='src tools')
+endef
+
 define Host/Install
-	$(call Host/Install/Default)
+	$(call Host/Compile/Default,install SUBDIRS='src tools')
 	$(LN) flex $(STAGING_DIR_HOST)/bin/lex
 endef
 
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall SUBDIRS='src tools')
+endef
+
 define Host/Clean
-	-$(MAKE) -C $(HOST_BUILD_DIR) uninstall
+	rm -f $(STAGING_DIR_HOST)/bin/lex
 	$(call Host/Clean/Default)
 endef
 
diff --git a/tools/flock/Makefile b/tools/flock/Makefile
index cd3561bb6996c1..4e0a45440fa5cd 100644
--- a/tools/flock/Makefile
+++ b/tools/flock/Makefile
@@ -24,4 +24,8 @@ define Host/Install
 	$(INSTALL_BIN) $(HOST_BUILD_DIR)/flock $(STAGING_DIR_HOST)/bin/
 endef
 
+define Host/Clean
+	rm -f $(STAGING_DIR_HOST)/bin/flock
+endef
+
 $(eval $(call HostBuild))
diff --git a/tools/genext2fs/Makefile b/tools/genext2fs/Makefile
index 3a911df91a46d4..4e7abf8bb68925 100644
--- a/tools/genext2fs/Makefile
+++ b/tools/genext2fs/Makefile
@@ -8,11 +8,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=genext2fs
-PKG_VERSION:=1.4.1
+PKG_VERSION:=1.5.0
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=@SF/genext2fs
-PKG_HASH:=404dbbfa7a86a6c3de8225c8da254d026b17fd288e05cec4df2cc7e1f4feecfc
+PKG_SOURCE_URL:=https://codeload.github.com/bestouff/$(PKG_NAME)/tar.gz/v$(PKG_VERSION)?
+PKG_HASH:=d3861e4fe89131bd21fbd25cf0b683b727b5c030c4c336fadcd738ada830aab0
 
 include $(INCLUDE_DIR)/host-build.mk
 
@@ -33,6 +33,13 @@ HOST_CONFIGURE_ARGS = \
 	--mandir=/usr/man \
 	--infodir=/usr/info \
 
+define Host/Configure
+	(cd $(HOST_BUILD_DIR); \
+		./autogen.sh \
+	);
+	$(call Host/Configure/Default)
+endef
+
 define Host/Compile
 	$(MAKE) -C $(HOST_BUILD_DIR) \
 		CFLAGS="$(HOST_CFLAGS)" \
diff --git a/tools/gengetopt/Makefile b/tools/gengetopt/Makefile
index 563ecccf9dd6c8..5a5b5eb7cbb7a7 100644
--- a/tools/gengetopt/Makefile
+++ b/tools/gengetopt/Makefile
@@ -13,12 +13,16 @@ PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@GNU/$(PKG_NAME)
 PKG_HASH:=b941aec9011864978dd7fdeb052b1943535824169d2aa2b0e7eae9ab807584ac
 
-HOST_FIXUP:=autoreconf
+PKG_SUBDIRS:=$$$$(foreach dir,gl src skels,$$$$(wildcard $$$$(dir)) )
 
 HOST_BUILD_PARALLEL:=1
 
 include $(INCLUDE_DIR)/host-build.mk
 
+define Host/Compile
+	$(call Host/Compile/Default,SUBDIRS='$(PKG_SUBDIRS)')
+endef
+
 define Host/Install
 	$(INSTALL_BIN) $(HOST_BUILD_DIR)/src/gengetopt $(STAGING_DIR_HOST)/bin/
 endef
diff --git a/tools/gmp/Makefile b/tools/gmp/Makefile
index 967cf6817b5e67..cfd6e30e04ab03 100644
--- a/tools/gmp/Makefile
+++ b/tools/gmp/Makefile
@@ -31,4 +31,8 @@ ifeq ($(GNU_HOST_NAME),x86_64-linux-gnux32)
 HOST_CONFIGURE_ARGS += ABI=x32
 endif
 
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
+endef
+
 $(eval $(call HostBuild))
diff --git a/tools/gnulib/Makefile b/tools/gnulib/Makefile
new file mode 100644
index 00000000000000..43d86c213c7083
--- /dev/null
+++ b/tools/gnulib/Makefile
@@ -0,0 +1,27 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=gnulib
+PKG_CPE_ID:=cpe:/a:gnu:$(PKG_NAME)
+PKG_VERSION:=f9a4ee73c3e7b544f640d0d04b55983d3a7b894e# # master
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://git.savannah.gnu.org/cgit/$(PKG_NAME).git/snapshot
+PKG_HASH:=514716d58987a9c0de0d69fb22d42bcd19edf80eed099882a004ff162060f1a8
+
+include $(INCLUDE_DIR)/host-build.mk
+
+define Host/Configure
+endef
+
+define Host/Install
+	$(INSTALL_DIR) $(1)/share/aclocal
+	$(INSTALL_DATA) $(HOST_BUILD_DIR)/m4/*.m4 $(1)/share/aclocal/
+	$(INSTALL_DIR) $(1)/share/gnulib
+	$(CP) $(HOST_BUILD_DIR)/* $(1)/share/gnulib/
+endef
+
+define Host/Clean
+	rm -rf $(STAGING_DIR_HOST)/share/gnulib
+endef
+
+$(eval $(call HostBuild))
diff --git a/tools/gnulib/patches/000-bootstrap.patch b/tools/gnulib/patches/000-bootstrap.patch
new file mode 100644
index 00000000000000..40ed41125c5e3d
--- /dev/null
+++ b/tools/gnulib/patches/000-bootstrap.patch
@@ -0,0 +1,54 @@
+--- a/build-aux/bootstrap
++++ b/build-aux/bootstrap
+@@ -237,14 +237,14 @@ test -r "$conffile" && . "$conffile"
+ 
+ check_exists() {
+   if test "$1" = "--verbose"; then
+-    ($2 --version </dev/null) >/dev/null 2>&1
++    ($2 $3 $4 --version </dev/null) >/dev/null 2>&1
+     if test $? -ge 126; then
+       # If not found, run with diagnostics as one may be
+       # presented with env variables to set to find the right version
+-      ($2 --version </dev/null)
++      ($2 $3 $4 --version </dev/null)
+     fi
+   else
+-    ($1 --version </dev/null) >/dev/null 2>&1
++    ($@ --version </dev/null) >/dev/null 2>&1
+   fi
+ 
+   test $? -lt 126
+@@ -309,7 +309,7 @@ p
+ q'
+ 
+ get_version() {
+-  app=$1
++  app="$@"
+ 
+   $app --version >/dev/null 2>&1 || { $app --version; return 1; }
+ 
+@@ -366,13 +366,13 @@ check_versions() {
+     if [ "$req_ver" = "-" ]; then
+       # Merely require app to exist; not all prereq apps are well-behaved
+       # so we have to rely on $? rather than get_version.
+-      if ! check_exists --verbose $app; then
++      if ! check_exists --verbose "$app"; then
+         warn_ "Error: '$app' not found"
+         ret=1
+       fi
+     else
+       # Require app to produce a new enough version string.
+-      inst_ver=$(get_version $app)
++      inst_ver=$(get_version "$app")
+       if [ ! "$inst_ver" ]; then
+         warn_ "Error: '$app' not found"
+         ret=1
+@@ -1135,7 +1135,7 @@ autogen()
+   # two just-pre-run programs.
+ 
+   # Import from gettext.
+-  with_gettext=yes
++  with_gettext=no
+   grep '^[	 ]*AM_GNU_GETTEXT_VERSION(' configure.ac >/dev/null || \
+       with_gettext=no
+ 
diff --git a/tools/include/elf.h b/tools/include/elf.h
index 036a176345eb6e..4bc0e4299c3a4c 100644
--- a/tools/include/elf.h
+++ b/tools/include/elf.h
@@ -1,5 +1,5 @@
 /* This file defines standard ELF types, structures, and macros.
-   Copyright (C) 1995-2012 Free Software Foundation, Inc.
+   Copyright (C) 1995-2023 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
    The GNU C Library is free software; you can redistribute it and/or
@@ -14,7 +14,7 @@
 
    You should have received a copy of the GNU Lesser General Public
    License along with the GNU C Library; if not, see
-   <http://www.gnu.org/licenses/>.  */
+   <https://www.gnu.org/licenses/>.  */
 
 #ifndef _ELF_H
 #define	_ELF_H 1
@@ -168,86 +168,203 @@ typedef struct
 
 /* Legal values for e_machine (architecture).  */
 
-#define EM_NONE		 0		/* No machine */
-#define EM_M32		 1		/* AT&T WE 32100 */
-#define EM_SPARC	 2		/* SUN SPARC */
-#define EM_386		 3		/* Intel 80386 */
-#define EM_68K		 4		/* Motorola m68k family */
-#define EM_88K		 5		/* Motorola m88k family */
-#define EM_860		 7		/* Intel 80860 */
-#define EM_MIPS		 8		/* MIPS R3000 big-endian */
-#define EM_S370		 9		/* IBM System/370 */
-#define EM_MIPS_RS3_LE	10		/* MIPS R3000 little-endian */
-
-#define EM_PARISC	15		/* HPPA */
-#define EM_VPP500	17		/* Fujitsu VPP500 */
-#define EM_SPARC32PLUS	18		/* Sun's "v8plus" */
-#define EM_960		19		/* Intel 80960 */
-#define EM_PPC		20		/* PowerPC */
-#define EM_PPC64	21		/* PowerPC 64-bit */
-#define EM_S390		22		/* IBM S390 */
-
-#define EM_V800		36		/* NEC V800 series */
-#define EM_FR20		37		/* Fujitsu FR20 */
-#define EM_RH32		38		/* TRW RH-32 */
-#define EM_RCE		39		/* Motorola RCE */
-#define EM_ARM		40		/* ARM */
-#define EM_FAKE_ALPHA	41		/* Digital Alpha */
-#define EM_SH		42		/* Hitachi SH */
-#define EM_SPARCV9	43		/* SPARC v9 64-bit */
-#define EM_TRICORE	44		/* Siemens Tricore */
-#define EM_ARC		45		/* Argonaut RISC Core */
-#define EM_H8_300	46		/* Hitachi H8/300 */
-#define EM_H8_300H	47		/* Hitachi H8/300H */
-#define EM_H8S		48		/* Hitachi H8S */
-#define EM_H8_500	49		/* Hitachi H8/500 */
-#define EM_IA_64	50		/* Intel Merced */
-#define EM_MIPS_X	51		/* Stanford MIPS-X */
-#define EM_COLDFIRE	52		/* Motorola Coldfire */
-#define EM_68HC12	53		/* Motorola M68HC12 */
-#define EM_MMA		54		/* Fujitsu MMA Multimedia Accelerator*/
-#define EM_PCP		55		/* Siemens PCP */
-#define EM_NCPU		56		/* Sony nCPU embeeded RISC */
-#define EM_NDR1		57		/* Denso NDR1 microprocessor */
-#define EM_STARCORE	58		/* Motorola Start*Core processor */
-#define EM_ME16		59		/* Toyota ME16 processor */
-#define EM_ST100	60		/* STMicroelectronic ST100 processor */
-#define EM_TINYJ	61		/* Advanced Logic Corp. Tinyj emb.fam*/
-#define EM_X86_64	62		/* AMD x86-64 architecture */
-#define EM_PDSP		63		/* Sony DSP Processor */
-
-#define EM_FX66		66		/* Siemens FX66 microcontroller */
-#define EM_ST9PLUS	67		/* STMicroelectronics ST9+ 8/16 mc */
-#define EM_ST7		68		/* STmicroelectronics ST7 8 bit mc */
-#define EM_68HC16	69		/* Motorola MC68HC16 microcontroller */
-#define EM_68HC11	70		/* Motorola MC68HC11 microcontroller */
-#define EM_68HC08	71		/* Motorola MC68HC08 microcontroller */
-#define EM_68HC05	72		/* Motorola MC68HC05 microcontroller */
-#define EM_SVX		73		/* Silicon Graphics SVx */
-#define EM_ST19		74		/* STMicroelectronics ST19 8 bit mc */
-#define EM_VAX		75		/* Digital VAX */
-#define EM_CRIS		76		/* Axis Communications 32-bit embedded processor */
-#define EM_JAVELIN	77		/* Infineon Technologies 32-bit embedded processor */
-#define EM_FIREPATH	78		/* Element 14 64-bit DSP Processor */
-#define EM_ZSP		79		/* LSI Logic 16-bit DSP Processor */
-#define EM_MMIX		80		/* Donald Knuth's educational 64-bit processor */
-#define EM_HUANY	81		/* Harvard University machine-independent object files */
-#define EM_PRISM	82		/* SiTera Prism */
-#define EM_AVR		83		/* Atmel AVR 8-bit microcontroller */
-#define EM_FR30		84		/* Fujitsu FR30 */
-#define EM_D10V		85		/* Mitsubishi D10V */
-#define EM_D30V		86		/* Mitsubishi D30V */
-#define EM_V850		87		/* NEC v850 */
-#define EM_M32R		88		/* Mitsubishi M32R */
-#define EM_MN10300	89		/* Matsushita MN10300 */
-#define EM_MN10200	90		/* Matsushita MN10200 */
-#define EM_PJ		91		/* picoJava */
-#define EM_OPENRISC	92		/* OpenRISC 32-bit embedded processor */
-#define EM_ARC_A5	93		/* ARC Cores Tangent-A5 */
-#define EM_XTENSA	94		/* Tensilica Xtensa Architecture */
-#define EM_TILEPRO	188		/* Tilera TILEPro */
-#define EM_TILEGX	191		/* Tilera TILE-Gx */
-#define EM_NUM		192
+#define EM_NONE		 0	/* No machine */
+#define EM_M32		 1	/* AT&T WE 32100 */
+#define EM_SPARC	 2	/* SUN SPARC */
+#define EM_386		 3	/* Intel 80386 */
+#define EM_68K		 4	/* Motorola m68k family */
+#define EM_88K		 5	/* Motorola m88k family */
+#define EM_IAMCU	 6	/* Intel MCU */
+#define EM_860		 7	/* Intel 80860 */
+#define EM_MIPS		 8	/* MIPS R3000 big-endian */
+#define EM_S370		 9	/* IBM System/370 */
+#define EM_MIPS_RS3_LE	10	/* MIPS R3000 little-endian */
+				/* reserved 11-14 */
+#define EM_PARISC	15	/* HPPA */
+				/* reserved 16 */
+#define EM_VPP500	17	/* Fujitsu VPP500 */
+#define EM_SPARC32PLUS	18	/* Sun's "v8plus" */
+#define EM_960		19	/* Intel 80960 */
+#define EM_PPC		20	/* PowerPC */
+#define EM_PPC64	21	/* PowerPC 64-bit */
+#define EM_S390		22	/* IBM S390 */
+#define EM_SPU		23	/* IBM SPU/SPC */
+				/* reserved 24-35 */
+#define EM_V800		36	/* NEC V800 series */
+#define EM_FR20		37	/* Fujitsu FR20 */
+#define EM_RH32		38	/* TRW RH-32 */
+#define EM_RCE		39	/* Motorola RCE */
+#define EM_ARM		40	/* ARM */
+#define EM_FAKE_ALPHA	41	/* Digital Alpha */
+#define EM_SH		42	/* Hitachi SH */
+#define EM_SPARCV9	43	/* SPARC v9 64-bit */
+#define EM_TRICORE	44	/* Siemens Tricore */
+#define EM_ARC		45	/* Argonaut RISC Core */
+#define EM_H8_300	46	/* Hitachi H8/300 */
+#define EM_H8_300H	47	/* Hitachi H8/300H */
+#define EM_H8S		48	/* Hitachi H8S */
+#define EM_H8_500	49	/* Hitachi H8/500 */
+#define EM_IA_64	50	/* Intel Merced */
+#define EM_MIPS_X	51	/* Stanford MIPS-X */
+#define EM_COLDFIRE	52	/* Motorola Coldfire */
+#define EM_68HC12	53	/* Motorola M68HC12 */
+#define EM_MMA		54	/* Fujitsu MMA Multimedia Accelerator */
+#define EM_PCP		55	/* Siemens PCP */
+#define EM_NCPU		56	/* Sony nCPU embeeded RISC */
+#define EM_NDR1		57	/* Denso NDR1 microprocessor */
+#define EM_STARCORE	58	/* Motorola Start*Core processor */
+#define EM_ME16		59	/* Toyota ME16 processor */
+#define EM_ST100	60	/* STMicroelectronic ST100 processor */
+#define EM_TINYJ	61	/* Advanced Logic Corp. Tinyj emb.fam */
+#define EM_X86_64	62	/* AMD x86-64 architecture */
+#define EM_PDSP		63	/* Sony DSP Processor */
+#define EM_PDP10	64	/* Digital PDP-10 */
+#define EM_PDP11	65	/* Digital PDP-11 */
+#define EM_FX66		66	/* Siemens FX66 microcontroller */
+#define EM_ST9PLUS	67	/* STMicroelectronics ST9+ 8/16 mc */
+#define EM_ST7		68	/* STmicroelectronics ST7 8 bit mc */
+#define EM_68HC16	69	/* Motorola MC68HC16 microcontroller */
+#define EM_68HC11	70	/* Motorola MC68HC11 microcontroller */
+#define EM_68HC08	71	/* Motorola MC68HC08 microcontroller */
+#define EM_68HC05	72	/* Motorola MC68HC05 microcontroller */
+#define EM_SVX		73	/* Silicon Graphics SVx */
+#define EM_ST19		74	/* STMicroelectronics ST19 8 bit mc */
+#define EM_VAX		75	/* Digital VAX */
+#define EM_CRIS		76	/* Axis Communications 32-bit emb.proc */
+#define EM_JAVELIN	77	/* Infineon Technologies 32-bit emb.proc */
+#define EM_FIREPATH	78	/* Element 14 64-bit DSP Processor */
+#define EM_ZSP		79	/* LSI Logic 16-bit DSP Processor */
+#define EM_MMIX		80	/* Donald Knuth's educational 64-bit proc */
+#define EM_HUANY	81	/* Harvard University machine-independent object files */
+#define EM_PRISM	82	/* SiTera Prism */
+#define EM_AVR		83	/* Atmel AVR 8-bit microcontroller */
+#define EM_FR30		84	/* Fujitsu FR30 */
+#define EM_D10V		85	/* Mitsubishi D10V */
+#define EM_D30V		86	/* Mitsubishi D30V */
+#define EM_V850		87	/* NEC v850 */
+#define EM_M32R		88	/* Mitsubishi M32R */
+#define EM_MN10300	89	/* Matsushita MN10300 */
+#define EM_MN10200	90	/* Matsushita MN10200 */
+#define EM_PJ		91	/* picoJava */
+#define EM_OPENRISC	92	/* OpenRISC 32-bit embedded processor */
+#define EM_ARC_COMPACT	93	/* ARC International ARCompact */
+#define EM_XTENSA	94	/* Tensilica Xtensa Architecture */
+#define EM_VIDEOCORE	95	/* Alphamosaic VideoCore */
+#define EM_TMM_GPP	96	/* Thompson Multimedia General Purpose Proc */
+#define EM_NS32K	97	/* National Semi. 32000 */
+#define EM_TPC		98	/* Tenor Network TPC */
+#define EM_SNP1K	99	/* Trebia SNP 1000 */
+#define EM_ST200	100	/* STMicroelectronics ST200 */
+#define EM_IP2K		101	/* Ubicom IP2xxx */
+#define EM_MAX		102	/* MAX processor */
+#define EM_CR		103	/* National Semi. CompactRISC */
+#define EM_F2MC16	104	/* Fujitsu F2MC16 */
+#define EM_MSP430	105	/* Texas Instruments msp430 */
+#define EM_BLACKFIN	106	/* Analog Devices Blackfin DSP */
+#define EM_SE_C33	107	/* Seiko Epson S1C33 family */
+#define EM_SEP		108	/* Sharp embedded microprocessor */
+#define EM_ARCA		109	/* Arca RISC */
+#define EM_UNICORE	110	/* PKU-Unity & MPRC Peking Uni. mc series */
+#define EM_EXCESS	111	/* eXcess configurable cpu */
+#define EM_DXP		112	/* Icera Semi. Deep Execution Processor */
+#define EM_ALTERA_NIOS2 113	/* Altera Nios II */
+#define EM_CRX		114	/* National Semi. CompactRISC CRX */
+#define EM_XGATE	115	/* Motorola XGATE */
+#define EM_C166		116	/* Infineon C16x/XC16x */
+#define EM_M16C		117	/* Renesas M16C */
+#define EM_DSPIC30F	118	/* Microchip Technology dsPIC30F */
+#define EM_CE		119	/* Freescale Communication Engine RISC */
+#define EM_M32C		120	/* Renesas M32C */
+				/* reserved 121-130 */
+#define EM_TSK3000	131	/* Altium TSK3000 */
+#define EM_RS08		132	/* Freescale RS08 */
+#define EM_SHARC	133	/* Analog Devices SHARC family */
+#define EM_ECOG2	134	/* Cyan Technology eCOG2 */
+#define EM_SCORE7	135	/* Sunplus S+core7 RISC */
+#define EM_DSP24	136	/* New Japan Radio (NJR) 24-bit DSP */
+#define EM_VIDEOCORE3	137	/* Broadcom VideoCore III */
+#define EM_LATTICEMICO32 138	/* RISC for Lattice FPGA */
+#define EM_SE_C17	139	/* Seiko Epson C17 */
+#define EM_TI_C6000	140	/* Texas Instruments TMS320C6000 DSP */
+#define EM_TI_C2000	141	/* Texas Instruments TMS320C2000 DSP */
+#define EM_TI_C5500	142	/* Texas Instruments TMS320C55x DSP */
+#define EM_TI_ARP32	143	/* Texas Instruments App. Specific RISC */
+#define EM_TI_PRU	144	/* Texas Instruments Prog. Realtime Unit */
+				/* reserved 145-159 */
+#define EM_MMDSP_PLUS	160	/* STMicroelectronics 64bit VLIW DSP */
+#define EM_CYPRESS_M8C	161	/* Cypress M8C */
+#define EM_R32C		162	/* Renesas R32C */
+#define EM_TRIMEDIA	163	/* NXP Semi. TriMedia */
+#define EM_QDSP6	164	/* QUALCOMM DSP6 */
+#define EM_8051		165	/* Intel 8051 and variants */
+#define EM_STXP7X	166	/* STMicroelectronics STxP7x */
+#define EM_NDS32	167	/* Andes Tech. compact code emb. RISC */
+#define EM_ECOG1X	168	/* Cyan Technology eCOG1X */
+#define EM_MAXQ30	169	/* Dallas Semi. MAXQ30 mc */
+#define EM_XIMO16	170	/* New Japan Radio (NJR) 16-bit DSP */
+#define EM_MANIK	171	/* M2000 Reconfigurable RISC */
+#define EM_CRAYNV2	172	/* Cray NV2 vector architecture */
+#define EM_RX		173	/* Renesas RX */
+#define EM_METAG	174	/* Imagination Tech. META */
+#define EM_MCST_ELBRUS	175	/* MCST Elbrus */
+#define EM_ECOG16	176	/* Cyan Technology eCOG16 */
+#define EM_CR16		177	/* National Semi. CompactRISC CR16 */
+#define EM_ETPU		178	/* Freescale Extended Time Processing Unit */
+#define EM_SLE9X	179	/* Infineon Tech. SLE9X */
+#define EM_L10M		180	/* Intel L10M */
+#define EM_K10M		181	/* Intel K10M */
+				/* reserved 182 */
+#define EM_AARCH64	183	/* ARM AARCH64 */
+				/* reserved 184 */
+#define EM_AVR32	185	/* Amtel 32-bit microprocessor */
+#define EM_STM8		186	/* STMicroelectronics STM8 */
+#define EM_TILE64	187	/* Tilera TILE64 */
+#define EM_TILEPRO	188	/* Tilera TILEPro */
+#define EM_MICROBLAZE	189	/* Xilinx MicroBlaze */
+#define EM_CUDA		190	/* NVIDIA CUDA */
+#define EM_TILEGX	191	/* Tilera TILE-Gx */
+#define EM_CLOUDSHIELD	192	/* CloudShield */
+#define EM_COREA_1ST	193	/* KIPO-KAIST Core-A 1st gen. */
+#define EM_COREA_2ND	194	/* KIPO-KAIST Core-A 2nd gen. */
+#define EM_ARCV2	195	/* Synopsys ARCv2 ISA.  */
+#define EM_OPEN8	196	/* Open8 RISC */
+#define EM_RL78		197	/* Renesas RL78 */
+#define EM_VIDEOCORE5	198	/* Broadcom VideoCore V */
+#define EM_78KOR	199	/* Renesas 78KOR */
+#define EM_56800EX	200	/* Freescale 56800EX DSC */
+#define EM_BA1		201	/* Beyond BA1 */
+#define EM_BA2		202	/* Beyond BA2 */
+#define EM_XCORE	203	/* XMOS xCORE */
+#define EM_MCHP_PIC	204	/* Microchip 8-bit PIC(r) */
+#define EM_INTELGT	205	/* Intel Graphics Technology */
+				/* reserved 206-209 */
+#define EM_KM32		210	/* KM211 KM32 */
+#define EM_KMX32	211	/* KM211 KMX32 */
+#define EM_EMX16	212	/* KM211 KMX16 */
+#define EM_EMX8		213	/* KM211 KMX8 */
+#define EM_KVARC	214	/* KM211 KVARC */
+#define EM_CDP		215	/* Paneve CDP */
+#define EM_COGE		216	/* Cognitive Smart Memory Processor */
+#define EM_COOL		217	/* Bluechip CoolEngine */
+#define EM_NORC		218	/* Nanoradio Optimized RISC */
+#define EM_CSR_KALIMBA	219	/* CSR Kalimba */
+#define EM_Z80		220	/* Zilog Z80 */
+#define EM_VISIUM	221	/* Controls and Data Services VISIUMcore */
+#define EM_FT32		222	/* FTDI Chip FT32 */
+#define EM_MOXIE	223	/* Moxie processor */
+#define EM_AMDGPU	224	/* AMD GPU */
+				/* reserved 225-242 */
+#define EM_RISCV	243	/* RISC-V */
+
+#define EM_BPF		247	/* Linux BPF -- in-kernel virtual machine */
+#define EM_CSKY		252     /* C-SKY */
+#define EM_LOONGARCH	258	/* LoongArch */
+
+#define EM_NUM		259
+
+/* Old spellings/synonyms.  */
+
+#define EM_ARC_A5	EM_ARC_COMPACT
 
 /* If it is necessary to assign new unofficial EM_* values, please
    pick large random numbers (0x8523, 0xa7f2, etc.) to minimize the
@@ -326,8 +443,9 @@ typedef struct
 #define SHT_FINI_ARRAY	  15		/* Array of destructors */
 #define SHT_PREINIT_ARRAY 16		/* Array of pre-constructors */
 #define SHT_GROUP	  17		/* Section group */
-#define SHT_SYMTAB_SHNDX  18		/* Extended section indeces */
-#define	SHT_NUM		  19		/* Number of defined types.  */
+#define SHT_SYMTAB_SHNDX  18		/* Extended section indices */
+#define SHT_RELR	  19            /* RELR relative relocations */
+#define	SHT_NUM		  20		/* Number of defined types.  */
 #define SHT_LOOS	  0x60000000	/* Start OS-specific.  */
 #define SHT_GNU_ATTRIBUTES 0x6ffffff5	/* Object attributes.  */
 #define SHT_GNU_HASH	  0x6ffffff6	/* GNU-style hash table.  */
@@ -360,13 +478,40 @@ typedef struct
 					   required */
 #define SHF_GROUP	     (1 << 9)	/* Section is member of a group.  */
 #define SHF_TLS		     (1 << 10)	/* Section hold thread-local data.  */
+#define SHF_COMPRESSED	     (1 << 11)	/* Section with compressed data. */
 #define SHF_MASKOS	     0x0ff00000	/* OS-specific.  */
 #define SHF_MASKPROC	     0xf0000000	/* Processor-specific */
+#define SHF_GNU_RETAIN	     (1 << 21)  /* Not to be GCed by linker.  */
 #define SHF_ORDERED	     (1 << 30)	/* Special ordering requirement
 					   (Solaris).  */
-#define SHF_EXCLUDE	     (1 << 31)	/* Section is excluded unless
+#define SHF_EXCLUDE	     (1U << 31)	/* Section is excluded unless
 					   referenced or allocated (Solaris).*/
 
+/* Section compression header.  Used when SHF_COMPRESSED is set.  */
+
+typedef struct
+{
+  Elf32_Word	ch_type;	/* Compression format.  */
+  Elf32_Word	ch_size;	/* Uncompressed data size.  */
+  Elf32_Word	ch_addralign;	/* Uncompressed data alignment.  */
+} Elf32_Chdr;
+
+typedef struct
+{
+  Elf64_Word	ch_type;	/* Compression format.  */
+  Elf64_Word	ch_reserved;
+  Elf64_Xword	ch_size;	/* Uncompressed data size.  */
+  Elf64_Xword	ch_addralign;	/* Uncompressed data alignment.  */
+} Elf64_Chdr;
+
+/* Legal values for ch_type (compression algorithm).  */
+#define ELFCOMPRESS_ZLIB	1	   /* ZLIB/DEFLATE algorithm.  */
+#define ELFCOMPRESS_ZSTD	2	   /* Zstandard algorithm.  */
+#define ELFCOMPRESS_LOOS	0x60000000 /* Start of OS-specific.  */
+#define ELFCOMPRESS_HIOS	0x6fffffff /* End of OS-specific.  */
+#define ELFCOMPRESS_LOPROC	0x70000000 /* Start of processor-specific.  */
+#define ELFCOMPRESS_HIPROC	0x7fffffff /* End of processor-specific.  */
+
 /* Section group handling.  */
 #define GRP_COMDAT	0x1		/* Mark group as COMDAT.  */
 
@@ -520,6 +665,11 @@ typedef struct
   Elf64_Sxword	r_addend;		/* Addend */
 } Elf64_Rela;
 
+/* RELR relocation table entry */
+
+typedef Elf32_Word	Elf32_Relr;
+typedef Elf64_Xword	Elf64_Relr;
+
 /* How to extract and insert information held in the r_info field.  */
 
 #define ELF32_R_SYM(val)		((val) >> 8)
@@ -577,6 +727,7 @@ typedef struct
 #define PT_GNU_EH_FRAME	0x6474e550	/* GCC .eh_frame_hdr segment */
 #define PT_GNU_STACK	0x6474e551	/* Indicates stack executability */
 #define PT_GNU_RELRO	0x6474e552	/* Read-only after relocation */
+#define PT_GNU_PROPERTY	0x6474e553	/* GNU property */
 #define PT_LOSUNW	0x6ffffffa
 #define PT_SUNWBSS	0x6ffffffa	/* Sun Specific segment */
 #define PT_SUNWSTACK	0x6ffffffb	/* Stack segment */
@@ -596,6 +747,8 @@ typedef struct
 /* Legal values for note segment descriptor types for core files. */
 
 #define NT_PRSTATUS	1		/* Contains copy of prstatus struct */
+#define NT_PRFPREG	2		/* Contains copy of fpregset
+					   struct.  */
 #define NT_FPREGSET	2		/* Contains copy of fpregset struct */
 #define NT_PRPSINFO	3		/* Contains copy of prpsinfo struct */
 #define NT_PRXREG	4		/* Contains copy of prxregset struct */
@@ -611,13 +764,82 @@ typedef struct
 #define NT_LWPSTATUS	16		/* Contains copy of lwpstatus struct */
 #define NT_LWPSINFO	17		/* Contains copy of lwpinfo struct */
 #define NT_PRFPXREG	20		/* Contains copy of fprxregset struct */
+#define NT_SIGINFO	0x53494749	/* Contains copy of siginfo_t,
+					   size might increase */
+#define NT_FILE		0x46494c45	/* Contains information about mapped
+					   files */
 #define NT_PRXFPREG	0x46e62b7f	/* Contains copy of user_fxsr_struct */
 #define NT_PPC_VMX	0x100		/* PowerPC Altivec/VMX registers */
 #define NT_PPC_SPE	0x101		/* PowerPC SPE/EVR registers */
 #define NT_PPC_VSX	0x102		/* PowerPC VSX registers */
+#define NT_PPC_TAR	0x103		/* Target Address Register */
+#define NT_PPC_PPR	0x104		/* Program Priority Register */
+#define NT_PPC_DSCR	0x105		/* Data Stream Control Register */
+#define NT_PPC_EBB	0x106		/* Event Based Branch Registers */
+#define NT_PPC_PMU	0x107		/* Performance Monitor Registers */
+#define NT_PPC_TM_CGPR	0x108		/* TM checkpointed GPR Registers */
+#define NT_PPC_TM_CFPR	0x109		/* TM checkpointed FPR Registers */
+#define NT_PPC_TM_CVMX	0x10a		/* TM checkpointed VMX Registers */
+#define NT_PPC_TM_CVSX	0x10b		/* TM checkpointed VSX Registers */
+#define NT_PPC_TM_SPR	0x10c		/* TM Special Purpose Registers */
+#define NT_PPC_TM_CTAR	0x10d		/* TM checkpointed Target Address
+					   Register */
+#define NT_PPC_TM_CPPR	0x10e		/* TM checkpointed Program Priority
+					   Register */
+#define NT_PPC_TM_CDSCR	0x10f		/* TM checkpointed Data Stream Control
+					   Register */
+#define NT_PPC_PKEY	0x110		/* Memory Protection Keys
+					   registers.  */
 #define NT_386_TLS	0x200		/* i386 TLS slots (struct user_desc) */
 #define NT_386_IOPERM	0x201		/* x86 io permission bitmap (1=deny) */
 #define NT_X86_XSTATE	0x202		/* x86 extended state using xsave */
+#define NT_S390_HIGH_GPRS	0x300	/* s390 upper register halves */
+#define NT_S390_TIMER	0x301		/* s390 timer register */
+#define NT_S390_TODCMP	0x302		/* s390 TOD clock comparator register */
+#define NT_S390_TODPREG	0x303		/* s390 TOD programmable register */
+#define NT_S390_CTRS	0x304		/* s390 control registers */
+#define NT_S390_PREFIX	0x305		/* s390 prefix register */
+#define NT_S390_LAST_BREAK	0x306	/* s390 breaking event address */
+#define NT_S390_SYSTEM_CALL	0x307	/* s390 system call restart data */
+#define NT_S390_TDB	0x308		/* s390 transaction diagnostic block */
+#define NT_S390_VXRS_LOW	0x309	/* s390 vector registers 0-15
+					   upper half.  */
+#define NT_S390_VXRS_HIGH	0x30a	/* s390 vector registers 16-31.  */
+#define NT_S390_GS_CB	0x30b		/* s390 guarded storage registers.  */
+#define NT_S390_GS_BC	0x30c		/* s390 guarded storage
+					   broadcast control block.  */
+#define NT_S390_RI_CB	0x30d		/* s390 runtime instrumentation.  */
+#define NT_S390_PV_CPU_DATA	0x30e	/* s390 protvirt cpu dump data.  */
+#define NT_ARM_VFP	0x400		/* ARM VFP/NEON registers */
+#define NT_ARM_TLS	0x401		/* ARM TLS register */
+#define NT_ARM_HW_BREAK	0x402		/* ARM hardware breakpoint registers */
+#define NT_ARM_HW_WATCH	0x403		/* ARM hardware watchpoint registers */
+#define NT_ARM_SYSTEM_CALL	0x404	/* ARM system call number */
+#define NT_ARM_SVE	0x405		/* ARM Scalable Vector Extension
+					   registers */
+#define NT_ARM_PAC_MASK	0x406		/* ARM pointer authentication
+					   code masks.  */
+#define NT_ARM_PACA_KEYS	0x407	/* ARM pointer authentication
+					   address keys.  */
+#define NT_ARM_PACG_KEYS	0x408	/* ARM pointer authentication
+					   generic key.  */
+#define NT_ARM_TAGGED_ADDR_CTRL	0x409	/* AArch64 tagged address
+					   control.  */
+#define NT_ARM_PAC_ENABLED_KEYS	0x40a	/* AArch64 pointer authentication
+					   enabled keys.  */
+#define NT_VMCOREDD	0x700		/* Vmcore Device Dump Note.  */
+#define NT_MIPS_DSP	0x800		/* MIPS DSP ASE registers.  */
+#define NT_MIPS_FP_MODE	0x801		/* MIPS floating-point mode.  */
+#define NT_MIPS_MSA	0x802		/* MIPS SIMD registers.  */
+#define NT_LOONGARCH_CPUCFG	0xa00	/* LoongArch CPU config registers.  */
+#define NT_LOONGARCH_CSR	0xa01	/* LoongArch control and
+					   status registers.  */
+#define NT_LOONGARCH_LSX	0xa02	/* LoongArch Loongson SIMD
+					   Extension registers.  */
+#define NT_LOONGARCH_LASX	0xa03	/* LoongArch Loongson Advanced
+					   SIMD Extension registers.  */
+#define NT_LOONGARCH_LBT	0xa04	/* LoongArch Loongson Binary
+					   Translation registers.  */
 
 /* Legal values for the note segment descriptor types for object files.  */
 
@@ -682,7 +904,11 @@ typedef struct
 #define DT_ENCODING	32		/* Start of encoded range */
 #define DT_PREINIT_ARRAY 32		/* Array with addresses of preinit fct*/
 #define DT_PREINIT_ARRAYSZ 33		/* size in bytes of DT_PREINIT_ARRAY */
-#define	DT_NUM		34		/* Number used */
+#define DT_SYMTAB_SHNDX	34		/* Address of SYMTAB_SHNDX section */
+#define DT_RELRSZ	35		/* Total size of RELR relative relocations */
+#define DT_RELR		36		/* Address of RELR relative relocations */
+#define DT_RELRENT	37		/* Size of one RELR relative relocaction */
+#define	DT_NUM		38		/* Number used */
 #define DT_LOOS		0x6000000d	/* Start of OS-specific */
 #define DT_HIOS		0x6ffff000	/* End of OS-specific */
 #define DT_LOPROC	0x70000000	/* Start of processor-specific */
@@ -781,6 +1007,20 @@ typedef struct
 #define DF_1_ENDFILTEE	0x00004000	/* Filtee terminates filters search. */
 #define	DF_1_DISPRELDNE	0x00008000	/* Disp reloc applied at build time. */
 #define	DF_1_DISPRELPND	0x00010000	/* Disp reloc applied at run-time.  */
+#define	DF_1_NODIRECT	0x00020000	/* Object has no-direct binding. */
+#define	DF_1_IGNMULDEF	0x00040000
+#define	DF_1_NOKSYMS	0x00080000
+#define	DF_1_NOHDR	0x00100000
+#define	DF_1_EDITED	0x00200000	/* Object is modified after built.  */
+#define	DF_1_NORELOC	0x00400000
+#define	DF_1_SYMINTPOSE	0x00800000	/* Object has individual interposers.  */
+#define	DF_1_GLOBAUDIT	0x01000000	/* Global auditing required.  */
+#define	DF_1_SINGLETON	0x02000000	/* Singleton symbols are used.  */
+#define	DF_1_STUB	0x04000000
+#define	DF_1_PIE	0x08000000
+#define	DF_1_KMOD       0x10000000
+#define	DF_1_WEAKFILTER 0x20000000
+#define	DF_1_NOCOMMON   0x40000000
 
 /* Flags for the feature selection in DT_FEATURE_1.  */
 #define DTF_1_PARINIT	0x00000001
@@ -825,7 +1065,8 @@ typedef struct
 
 /* Legal values for vd_flags (version information flags).  */
 #define VER_FLG_BASE	0x1		/* Version definition of file itself */
-#define VER_FLG_WEAK	0x2		/* Weak version identifier */
+#define VER_FLG_WEAK	0x2		/* Weak version identifier.  Also
+					   used by vna_flags below.  */
 
 /* Versym symbol index values.  */
 #define	VER_NDX_LOCAL		0	/* Symbol is local.  */
@@ -833,7 +1074,7 @@ typedef struct
 #define	VER_NDX_LORESERVE	0xff00	/* Beginning of reserved entries.  */
 #define	VER_NDX_ELIMINATE	0xff01	/* Symbol is to be eliminated.  */
 
-/* Auxialiary version information.  */
+/* Auxiliary version information.  */
 
 typedef struct
 {
@@ -903,10 +1144,6 @@ typedef struct
 } Elf64_Vernaux;
 
 
-/* Legal values for vna_flags.  */
-#define VER_FLG_WEAK	0x2		/* Weak version identifier */
-
-
 /* Auxiliary vector.  */
 
 /* This vector is normally only used by the program interpreter.  The
@@ -961,7 +1198,7 @@ typedef struct
 
 /* Some more special a_type values describing the hardware.  */
 #define AT_PLATFORM	15		/* String identifying platform.  */
-#define AT_HWCAP	16		/* Machine dependent hints about
+#define AT_HWCAP	16		/* Machine-dependent hints about
 					   processor capabilities.  */
 
 /* This entry gives some information about the FPU initialization
@@ -983,6 +1220,9 @@ typedef struct
 
 #define AT_RANDOM	25		/* Address of 16 random bytes.  */
 
+#define AT_HWCAP2	26		/* More machine-dependent hints about
+					   processor capabilities.  */
+
 #define AT_EXECFN	31		/* Filename of executable.  */
 
 /* Pointer to the global system page used for system calls and other
@@ -997,6 +1237,20 @@ typedef struct
 #define AT_L2_CACHESHAPE	36
 #define AT_L3_CACHESHAPE	37
 
+/* Shapes of the caches, with more room to describe them.
+   *GEOMETRY are comprised of cache line size in bytes in the bottom 16 bits
+   and the cache associativity in the next 16 bits.  */
+#define AT_L1I_CACHESIZE	40
+#define AT_L1I_CACHEGEOMETRY	41
+#define AT_L1D_CACHESIZE	42
+#define AT_L1D_CACHEGEOMETRY	43
+#define AT_L2_CACHESIZE		44
+#define AT_L2_CACHEGEOMETRY	45
+#define AT_L3_CACHESIZE		46
+#define AT_L3_CACHEGEOMETRY	47
+
+#define AT_MINSIGSTKSZ		51 /* Stack needed for signal delivery  */
+
 /* Note section contents.  Each entry in the note section begins with
    a header of a fixed form.  */
 
@@ -1022,6 +1276,8 @@ typedef struct
 /* Note entries for GNU systems have this name.  */
 #define ELF_NOTE_GNU		"GNU"
 
+/* Note entries for freedesktop.org have this name.  */
+#define ELF_NOTE_FDO		"FDO"
 
 /* Defined types of notes for Solaris.  */
 
@@ -1062,6 +1318,84 @@ typedef struct
 /* Version note generated by GNU gold containing a version string.  */
 #define NT_GNU_GOLD_VERSION	4
 
+/* Program property.  */
+#define NT_GNU_PROPERTY_TYPE_0 5
+
+/* Packaging metadata as defined on
+   https://systemd.io/COREDUMP_PACKAGE_METADATA/ */
+#define NT_FDO_PACKAGING_METADATA 0xcafe1a7e
+
+/* Note section name of program property.   */
+#define NOTE_GNU_PROPERTY_SECTION_NAME ".note.gnu.property"
+
+/* Values used in GNU .note.gnu.property notes (NT_GNU_PROPERTY_TYPE_0).  */
+
+/* Stack size.  */
+#define GNU_PROPERTY_STACK_SIZE			1
+/* No copy relocation on protected data symbol.  */
+#define GNU_PROPERTY_NO_COPY_ON_PROTECTED	2
+
+/* A 4-byte unsigned integer property: A bit is set if it is set in all
+   relocatable inputs.  */
+#define GNU_PROPERTY_UINT32_AND_LO	0xb0000000
+#define GNU_PROPERTY_UINT32_AND_HI	0xb0007fff
+
+/* A 4-byte unsigned integer property: A bit is set if it is set in any
+   relocatable inputs.  */
+#define GNU_PROPERTY_UINT32_OR_LO	0xb0008000
+#define GNU_PROPERTY_UINT32_OR_HI	0xb000ffff
+
+/* The needed properties by the object file.  */
+#define GNU_PROPERTY_1_NEEDED		GNU_PROPERTY_UINT32_OR_LO
+
+/* Set if the object file requires canonical function pointers and
+   cannot be used with copy relocation.  */
+#define GNU_PROPERTY_1_NEEDED_INDIRECT_EXTERN_ACCESS (1U << 0)
+
+/* Processor-specific semantics, lo */
+#define GNU_PROPERTY_LOPROC			0xc0000000
+/* Processor-specific semantics, hi */
+#define GNU_PROPERTY_HIPROC			0xdfffffff
+/* Application-specific semantics, lo */
+#define GNU_PROPERTY_LOUSER			0xe0000000
+/* Application-specific semantics, hi */
+#define GNU_PROPERTY_HIUSER			0xffffffff
+
+/* AArch64 specific GNU properties.  */
+#define GNU_PROPERTY_AARCH64_FEATURE_1_AND	0xc0000000
+
+#define GNU_PROPERTY_AARCH64_FEATURE_1_BTI	(1U << 0)
+#define GNU_PROPERTY_AARCH64_FEATURE_1_PAC	(1U << 1)
+
+/* The x86 instruction sets indicated by the corresponding bits are
+   used in program.  Their support in the hardware is optional.  */
+#define GNU_PROPERTY_X86_ISA_1_USED		0xc0010002
+/* The x86 instruction sets indicated by the corresponding bits are
+   used in program and they must be supported by the hardware.   */
+#define GNU_PROPERTY_X86_ISA_1_NEEDED		0xc0008002
+/* X86 processor-specific features used in program.  */
+#define GNU_PROPERTY_X86_FEATURE_1_AND		0xc0000002
+
+/* GNU_PROPERTY_X86_ISA_1_BASELINE: CMOV, CX8 (cmpxchg8b), FPU (fld),
+   MMX, OSFXSR (fxsave), SCE (syscall), SSE and SSE2.  */
+#define GNU_PROPERTY_X86_ISA_1_BASELINE		(1U << 0)
+/* GNU_PROPERTY_X86_ISA_1_V2: GNU_PROPERTY_X86_ISA_1_BASELINE,
+   CMPXCHG16B (cmpxchg16b), LAHF-SAHF (lahf), POPCNT (popcnt), SSE3,
+   SSSE3, SSE4.1 and SSE4.2.  */
+#define GNU_PROPERTY_X86_ISA_1_V2		(1U << 1)
+/* GNU_PROPERTY_X86_ISA_1_V3: GNU_PROPERTY_X86_ISA_1_V2, AVX, AVX2, BMI1,
+   BMI2, F16C, FMA, LZCNT, MOVBE, XSAVE.  */
+#define GNU_PROPERTY_X86_ISA_1_V3		(1U << 2)
+/* GNU_PROPERTY_X86_ISA_1_V4: GNU_PROPERTY_X86_ISA_1_V3, AVX512F,
+   AVX512BW, AVX512CD, AVX512DQ and AVX512VL.  */
+#define GNU_PROPERTY_X86_ISA_1_V4		(1U << 3)
+
+/* This indicates that all executable sections are compatible with
+   IBT.  */
+#define GNU_PROPERTY_X86_FEATURE_1_IBT		(1U << 0)
+/* This indicates that all executable sections are compatible with
+   SHSTK.  */
+#define GNU_PROPERTY_X86_FEATURE_1_SHSTK	(1U << 1)
 
 /* Move records.  */
 typedef struct
@@ -1198,7 +1532,7 @@ typedef struct
 #define R_386_TLS_DTPMOD32 35		/* ID of module containing symbol */
 #define R_386_TLS_DTPOFF32 36		/* Offset in TLS block */
 #define R_386_TLS_TPOFF32  37		/* Negated offset in static TLS block */
-/* 38? */
+#define R_386_SIZE32	   38 		/* 32-bit symbol size */
 #define R_386_TLS_GOTDESC  39		/* GOT offset for TLS descriptor.  */
 #define R_386_TLS_DESC_CALL 40		/* Marker of call through TLS
 					   descriptor for
@@ -1208,8 +1542,10 @@ typedef struct
 					   argument, returning the TLS
 					   offset for the symbol.  */
 #define R_386_IRELATIVE	   42		/* Adjust indirectly by program base */
+#define R_386_GOT32X	   43		/* Load from 32 bit GOT entry,
+					   relaxable. */
 /* Keep this the last entry.  */
-#define R_386_NUM	   43
+#define R_386_NUM	   44
 
 /* SUN SPARC specific definitions.  */
 
@@ -1334,102 +1670,107 @@ typedef struct
 
 /* For Sparc64, legal values for d_tag of Elf64_Dyn.  */
 
-#define DT_SPARC_REGISTER 0x70000001
-#define DT_SPARC_NUM	2
+#define DT_SPARC_REGISTER	0x70000001
+#define DT_SPARC_NUM		2
 
 /* MIPS R3000 specific definitions.  */
 
 /* Legal values for e_flags field of Elf32_Ehdr.  */
 
-#define EF_MIPS_NOREORDER   1		/* A .noreorder directive was used */
-#define EF_MIPS_PIC	    2		/* Contains PIC code */
-#define EF_MIPS_CPIC	    4		/* Uses PIC calling sequence */
-#define EF_MIPS_XGOT	    8
-#define EF_MIPS_64BIT_WHIRL 16
-#define EF_MIPS_ABI2	    32
-#define EF_MIPS_ABI_ON32    64
-#define EF_MIPS_ARCH	    0xf0000000	/* MIPS architecture level */
+#define EF_MIPS_NOREORDER	1     /* A .noreorder directive was used.  */
+#define EF_MIPS_PIC		2     /* Contains PIC code.  */
+#define EF_MIPS_CPIC		4     /* Uses PIC calling sequence.  */
+#define EF_MIPS_XGOT		8
+#define EF_MIPS_64BIT_WHIRL	16
+#define EF_MIPS_ABI2		32
+#define EF_MIPS_ABI_ON32	64
+#define EF_MIPS_FP64		512  /* Uses FP64 (12 callee-saved).  */
+#define EF_MIPS_NAN2008	1024  /* Uses IEEE 754-2008 NaN encoding.  */
+#define EF_MIPS_ARCH		0xf0000000 /* MIPS architecture level.  */
 
 /* Legal values for MIPS architecture level.  */
 
-#define EF_MIPS_ARCH_1	    0x00000000	/* -mips1 code.  */
-#define EF_MIPS_ARCH_2	    0x10000000	/* -mips2 code.  */
-#define EF_MIPS_ARCH_3	    0x20000000	/* -mips3 code.  */
-#define EF_MIPS_ARCH_4	    0x30000000	/* -mips4 code.  */
-#define EF_MIPS_ARCH_5	    0x40000000	/* -mips5 code.  */
-#define EF_MIPS_ARCH_32	    0x60000000	/* MIPS32 code.  */
-#define EF_MIPS_ARCH_64	    0x70000000	/* MIPS64 code.  */
-
-/* The following are non-official names and should not be used.  */
-
-#define E_MIPS_ARCH_1	  0x00000000	/* -mips1 code.  */
-#define E_MIPS_ARCH_2	  0x10000000	/* -mips2 code.  */
-#define E_MIPS_ARCH_3	  0x20000000	/* -mips3 code.  */
-#define E_MIPS_ARCH_4	  0x30000000	/* -mips4 code.  */
-#define E_MIPS_ARCH_5	  0x40000000	/* -mips5 code.  */
-#define E_MIPS_ARCH_32	  0x60000000	/* MIPS32 code.  */
-#define E_MIPS_ARCH_64	  0x70000000	/* MIPS64 code.  */
+#define EF_MIPS_ARCH_1		0x00000000 /* -mips1 code.  */
+#define EF_MIPS_ARCH_2		0x10000000 /* -mips2 code.  */
+#define EF_MIPS_ARCH_3		0x20000000 /* -mips3 code.  */
+#define EF_MIPS_ARCH_4		0x30000000 /* -mips4 code.  */
+#define EF_MIPS_ARCH_5		0x40000000 /* -mips5 code.  */
+#define EF_MIPS_ARCH_32		0x50000000 /* MIPS32 code.  */
+#define EF_MIPS_ARCH_64		0x60000000 /* MIPS64 code.  */
+#define EF_MIPS_ARCH_32R2	0x70000000 /* MIPS32r2 code.  */
+#define EF_MIPS_ARCH_64R2	0x80000000 /* MIPS64r2 code.  */
+
+/* The following are unofficial names and should not be used.  */
+
+#define E_MIPS_ARCH_1		EF_MIPS_ARCH_1
+#define E_MIPS_ARCH_2		EF_MIPS_ARCH_2
+#define E_MIPS_ARCH_3		EF_MIPS_ARCH_3
+#define E_MIPS_ARCH_4		EF_MIPS_ARCH_4
+#define E_MIPS_ARCH_5		EF_MIPS_ARCH_5
+#define E_MIPS_ARCH_32		EF_MIPS_ARCH_32
+#define E_MIPS_ARCH_64		EF_MIPS_ARCH_64
 
 /* Special section indices.  */
 
-#define SHN_MIPS_ACOMMON    0xff00	/* Allocated common symbols */
-#define SHN_MIPS_TEXT	    0xff01	/* Allocated test symbols.  */
-#define SHN_MIPS_DATA	    0xff02	/* Allocated data symbols.  */
-#define SHN_MIPS_SCOMMON    0xff03	/* Small common symbols */
-#define SHN_MIPS_SUNDEFINED 0xff04	/* Small undefined symbols */
+#define SHN_MIPS_ACOMMON	0xff00	/* Allocated common symbols.  */
+#define SHN_MIPS_TEXT		0xff01	/* Allocated test symbols.  */
+#define SHN_MIPS_DATA		0xff02	/* Allocated data symbols.  */
+#define SHN_MIPS_SCOMMON 	0xff03	/* Small common symbols.  */
+#define SHN_MIPS_SUNDEFINED	0xff04	/* Small undefined symbols.  */
 
 /* Legal values for sh_type field of Elf32_Shdr.  */
 
-#define SHT_MIPS_LIBLIST       0x70000000 /* Shared objects used in link */
-#define SHT_MIPS_MSYM	       0x70000001
-#define SHT_MIPS_CONFLICT      0x70000002 /* Conflicting symbols */
-#define SHT_MIPS_GPTAB	       0x70000003 /* Global data area sizes */
-#define SHT_MIPS_UCODE	       0x70000004 /* Reserved for SGI/MIPS compilers */
-#define SHT_MIPS_DEBUG	       0x70000005 /* MIPS ECOFF debugging information*/
-#define SHT_MIPS_REGINFO       0x70000006 /* Register usage information */
-#define SHT_MIPS_PACKAGE       0x70000007
-#define SHT_MIPS_PACKSYM       0x70000008
-#define SHT_MIPS_RELD	       0x70000009
-#define SHT_MIPS_IFACE         0x7000000b
-#define SHT_MIPS_CONTENT       0x7000000c
-#define SHT_MIPS_OPTIONS       0x7000000d /* Miscellaneous options.  */
-#define SHT_MIPS_SHDR	       0x70000010
-#define SHT_MIPS_FDESC	       0x70000011
-#define SHT_MIPS_EXTSYM	       0x70000012
-#define SHT_MIPS_DENSE	       0x70000013
-#define SHT_MIPS_PDESC	       0x70000014
-#define SHT_MIPS_LOCSYM	       0x70000015
-#define SHT_MIPS_AUXSYM	       0x70000016
-#define SHT_MIPS_OPTSYM	       0x70000017
-#define SHT_MIPS_LOCSTR	       0x70000018
-#define SHT_MIPS_LINE	       0x70000019
-#define SHT_MIPS_RFDESC	       0x7000001a
-#define SHT_MIPS_DELTASYM      0x7000001b
-#define SHT_MIPS_DELTAINST     0x7000001c
-#define SHT_MIPS_DELTACLASS    0x7000001d
-#define SHT_MIPS_DWARF         0x7000001e /* DWARF debugging information.  */
-#define SHT_MIPS_DELTADECL     0x7000001f
-#define SHT_MIPS_SYMBOL_LIB    0x70000020
-#define SHT_MIPS_EVENTS	       0x70000021 /* Event section.  */
-#define SHT_MIPS_TRANSLATE     0x70000022
-#define SHT_MIPS_PIXIE	       0x70000023
-#define SHT_MIPS_XLATE	       0x70000024
-#define SHT_MIPS_XLATE_DEBUG   0x70000025
-#define SHT_MIPS_WHIRL	       0x70000026
-#define SHT_MIPS_EH_REGION     0x70000027
-#define SHT_MIPS_XLATE_OLD     0x70000028
-#define SHT_MIPS_PDR_EXCEPTION 0x70000029
+#define SHT_MIPS_LIBLIST	0x70000000 /* Shared objects used in link.  */
+#define SHT_MIPS_MSYM		0x70000001
+#define SHT_MIPS_CONFLICT	0x70000002 /* Conflicting symbols.  */
+#define SHT_MIPS_GPTAB		0x70000003 /* Global data area sizes.  */
+#define SHT_MIPS_UCODE		0x70000004 /* Reserved for SGI/MIPS compilers */
+#define SHT_MIPS_DEBUG		0x70000005 /* MIPS ECOFF debugging info.  */
+#define SHT_MIPS_REGINFO	0x70000006 /* Register usage information.  */
+#define SHT_MIPS_PACKAGE	0x70000007
+#define SHT_MIPS_PACKSYM	0x70000008
+#define SHT_MIPS_RELD		0x70000009
+#define SHT_MIPS_IFACE		0x7000000b
+#define SHT_MIPS_CONTENT	0x7000000c
+#define SHT_MIPS_OPTIONS	0x7000000d /* Miscellaneous options.  */
+#define SHT_MIPS_SHDR		0x70000010
+#define SHT_MIPS_FDESC		0x70000011
+#define SHT_MIPS_EXTSYM		0x70000012
+#define SHT_MIPS_DENSE		0x70000013
+#define SHT_MIPS_PDESC		0x70000014
+#define SHT_MIPS_LOCSYM		0x70000015
+#define SHT_MIPS_AUXSYM		0x70000016
+#define SHT_MIPS_OPTSYM		0x70000017
+#define SHT_MIPS_LOCSTR		0x70000018
+#define SHT_MIPS_LINE		0x70000019
+#define SHT_MIPS_RFDESC		0x7000001a
+#define SHT_MIPS_DELTASYM	0x7000001b
+#define SHT_MIPS_DELTAINST	0x7000001c
+#define SHT_MIPS_DELTACLASS	0x7000001d
+#define SHT_MIPS_DWARF		0x7000001e /* DWARF debugging information.  */
+#define SHT_MIPS_DELTADECL	0x7000001f
+#define SHT_MIPS_SYMBOL_LIB	0x70000020
+#define SHT_MIPS_EVENTS		0x70000021 /* Event section.  */
+#define SHT_MIPS_TRANSLATE	0x70000022
+#define SHT_MIPS_PIXIE		0x70000023
+#define SHT_MIPS_XLATE		0x70000024
+#define SHT_MIPS_XLATE_DEBUG	0x70000025
+#define SHT_MIPS_WHIRL		0x70000026
+#define SHT_MIPS_EH_REGION	0x70000027
+#define SHT_MIPS_XLATE_OLD	0x70000028
+#define SHT_MIPS_PDR_EXCEPTION	0x70000029
+#define SHT_MIPS_XHASH		0x7000002b
 
 /* Legal values for sh_flags field of Elf32_Shdr.  */
 
-#define SHF_MIPS_GPREL	 0x10000000	/* Must be part of global data area */
-#define SHF_MIPS_MERGE	 0x20000000
-#define SHF_MIPS_ADDR	 0x40000000
-#define SHF_MIPS_STRINGS 0x80000000
-#define SHF_MIPS_NOSTRIP 0x08000000
-#define SHF_MIPS_LOCAL	 0x04000000
-#define SHF_MIPS_NAMES	 0x02000000
-#define SHF_MIPS_NODUPE	 0x01000000
+#define SHF_MIPS_GPREL		0x10000000 /* Must be in global data area.  */
+#define SHF_MIPS_MERGE		0x20000000
+#define SHF_MIPS_ADDR		0x40000000
+#define SHF_MIPS_STRINGS	0x80000000
+#define SHF_MIPS_NOSTRIP	0x08000000
+#define SHF_MIPS_LOCAL		0x04000000
+#define SHF_MIPS_NAMES		0x02000000
+#define SHF_MIPS_NODUPE		0x01000000
 
 
 /* Symbol tables.  */
@@ -1451,23 +1792,23 @@ typedef union
 {
   struct
     {
-      Elf32_Word gt_current_g_value;	/* -G value used for compilation */
-      Elf32_Word gt_unused;		/* Not used */
-    } gt_header;			/* First entry in section */
+      Elf32_Word gt_current_g_value;	/* -G value used for compilation.  */
+      Elf32_Word gt_unused;		/* Not used.  */
+    } gt_header;			/* First entry in section.  */
   struct
     {
-      Elf32_Word gt_g_value;		/* If this value were used for -G */
-      Elf32_Word gt_bytes;		/* This many bytes would be used */
-    } gt_entry;				/* Subsequent entries in section */
+      Elf32_Word gt_g_value;		/* If this value were used for -G.  */
+      Elf32_Word gt_bytes;		/* This many bytes would be used.  */
+    } gt_entry;				/* Subsequent entries in section.  */
 } Elf32_gptab;
 
 /* Entry found in sections of type SHT_MIPS_REGINFO.  */
 
 typedef struct
 {
-  Elf32_Word	ri_gprmask;		/* General registers used */
-  Elf32_Word	ri_cprmask[4];		/* Coprocessor registers used */
-  Elf32_Sword	ri_gp_value;		/* $gp register value */
+  Elf32_Word ri_gprmask;		/* General registers used.  */
+  Elf32_Word ri_cprmask[4];		/* Coprocessor registers used.  */
+  Elf32_Sword ri_gp_value;		/* $gp register value.  */
 } Elf32_RegInfo;
 
 /* Entries found in sections of type SHT_MIPS_OPTIONS.  */
@@ -1593,9 +1934,10 @@ typedef struct
 
 /* Legal values for p_type field of Elf32_Phdr.  */
 
-#define PT_MIPS_REGINFO	0x70000000	/* Register usage information */
-#define PT_MIPS_RTPROC  0x70000001	/* Runtime procedure table. */
-#define PT_MIPS_OPTIONS 0x70000002
+#define PT_MIPS_REGINFO	  0x70000000	/* Register usage information. */
+#define PT_MIPS_RTPROC	  0x70000001	/* Runtime procedure table. */
+#define PT_MIPS_OPTIONS	  0x70000002
+#define PT_MIPS_ABIFLAGS  0x70000003	/* FP mode requirement. */
 
 /* Special program header types.  */
 
@@ -1661,7 +2003,13 @@ typedef struct
    PLT is writable.  For a non-writable PLT, this is omitted or has a zero
    value.  */
 #define DT_MIPS_RWPLT        0x70000034
-#define DT_MIPS_NUM	     0x35
+/* An alternative description of the classic MIPS RLD_MAP that is usable
+   in a PIE as it stores a relative offset from the address of the tag
+   rather than an absolute address.  */
+#define DT_MIPS_RLD_MAP_REL  0x70000035
+/* GNU-style hash table with xlat.  */
+#define DT_MIPS_XHASH	     0x70000036
+#define DT_MIPS_NUM	     0x37
 
 /* Legal values for DT_MIPS_FLAGS Elf32_Dyn entry.  */
 
@@ -1717,6 +2065,101 @@ typedef struct
 
 typedef Elf32_Addr Elf32_Conflict;
 
+typedef struct
+{
+  /* Version of flags structure.  */
+  Elf32_Half version;
+  /* The level of the ISA: 1-5, 32, 64.  */
+  unsigned char isa_level;
+  /* The revision of ISA: 0 for MIPS V and below, 1-n otherwise.  */
+  unsigned char isa_rev;
+  /* The size of general purpose registers.  */
+  unsigned char gpr_size;
+  /* The size of co-processor 1 registers.  */
+  unsigned char cpr1_size;
+  /* The size of co-processor 2 registers.  */
+  unsigned char cpr2_size;
+  /* The floating-point ABI.  */
+  unsigned char fp_abi;
+  /* Processor-specific extension.  */
+  Elf32_Word isa_ext;
+  /* Mask of ASEs used.  */
+  Elf32_Word ases;
+  /* Mask of general flags.  */
+  Elf32_Word flags1;
+  Elf32_Word flags2;
+} Elf_MIPS_ABIFlags_v0;
+
+/* Values for the register size bytes of an abi flags structure.  */
+
+#define MIPS_AFL_REG_NONE	0x00	 /* No registers.  */
+#define MIPS_AFL_REG_32		0x01	 /* 32-bit registers.  */
+#define MIPS_AFL_REG_64		0x02	 /* 64-bit registers.  */
+#define MIPS_AFL_REG_128	0x03	 /* 128-bit registers.  */
+
+/* Masks for the ases word of an ABI flags structure.  */
+
+#define MIPS_AFL_ASE_DSP	0x00000001 /* DSP ASE.  */
+#define MIPS_AFL_ASE_DSPR2	0x00000002 /* DSP R2 ASE.  */
+#define MIPS_AFL_ASE_EVA	0x00000004 /* Enhanced VA Scheme.  */
+#define MIPS_AFL_ASE_MCU	0x00000008 /* MCU (MicroController) ASE.  */
+#define MIPS_AFL_ASE_MDMX	0x00000010 /* MDMX ASE.  */
+#define MIPS_AFL_ASE_MIPS3D	0x00000020 /* MIPS-3D ASE.  */
+#define MIPS_AFL_ASE_MT		0x00000040 /* MT ASE.  */
+#define MIPS_AFL_ASE_SMARTMIPS	0x00000080 /* SmartMIPS ASE.  */
+#define MIPS_AFL_ASE_VIRT	0x00000100 /* VZ ASE.  */
+#define MIPS_AFL_ASE_MSA	0x00000200 /* MSA ASE.  */
+#define MIPS_AFL_ASE_MIPS16	0x00000400 /* MIPS16 ASE.  */
+#define MIPS_AFL_ASE_MICROMIPS	0x00000800 /* MICROMIPS ASE.  */
+#define MIPS_AFL_ASE_XPA	0x00001000 /* XPA ASE.  */
+#define MIPS_AFL_ASE_MASK	0x00001fff /* All ASEs.  */
+
+/* Values for the isa_ext word of an ABI flags structure.  */
+
+#define MIPS_AFL_EXT_XLR	  1   /* RMI Xlr instruction.  */
+#define MIPS_AFL_EXT_OCTEON2	  2   /* Cavium Networks Octeon2.  */
+#define MIPS_AFL_EXT_OCTEONP	  3   /* Cavium Networks OcteonP.  */
+#define MIPS_AFL_EXT_LOONGSON_3A  4   /* Loongson 3A.  */
+#define MIPS_AFL_EXT_OCTEON	  5   /* Cavium Networks Octeon.  */
+#define MIPS_AFL_EXT_5900	  6   /* MIPS R5900 instruction.  */
+#define MIPS_AFL_EXT_4650	  7   /* MIPS R4650 instruction.  */
+#define MIPS_AFL_EXT_4010	  8   /* LSI R4010 instruction.  */
+#define MIPS_AFL_EXT_4100	  9   /* NEC VR4100 instruction.  */
+#define MIPS_AFL_EXT_3900	  10  /* Toshiba R3900 instruction.  */
+#define MIPS_AFL_EXT_10000	  11  /* MIPS R10000 instruction.  */
+#define MIPS_AFL_EXT_SB1	  12  /* Broadcom SB-1 instruction.  */
+#define MIPS_AFL_EXT_4111	  13  /* NEC VR4111/VR4181 instruction.  */
+#define MIPS_AFL_EXT_4120	  14  /* NEC VR4120 instruction.  */
+#define MIPS_AFL_EXT_5400	  15  /* NEC VR5400 instruction.  */
+#define MIPS_AFL_EXT_5500	  16  /* NEC VR5500 instruction.  */
+#define MIPS_AFL_EXT_LOONGSON_2E  17  /* ST Microelectronics Loongson 2E.  */
+#define MIPS_AFL_EXT_LOONGSON_2F  18  /* ST Microelectronics Loongson 2F.  */
+
+/* Masks for the flags1 word of an ABI flags structure.  */
+#define MIPS_AFL_FLAGS1_ODDSPREG  1  /* Uses odd single-precision registers.  */
+
+/* Object attribute values.  */
+enum
+{
+  /* Not tagged or not using any ABIs affected by the differences.  */
+  Val_GNU_MIPS_ABI_FP_ANY = 0,
+  /* Using hard-float -mdouble-float.  */
+  Val_GNU_MIPS_ABI_FP_DOUBLE = 1,
+  /* Using hard-float -msingle-float.  */
+  Val_GNU_MIPS_ABI_FP_SINGLE = 2,
+  /* Using soft-float.  */
+  Val_GNU_MIPS_ABI_FP_SOFT = 3,
+  /* Using -mips32r2 -mfp64.  */
+  Val_GNU_MIPS_ABI_FP_OLD_64 = 4,
+  /* Using -mfpxx.  */
+  Val_GNU_MIPS_ABI_FP_XX = 5,
+  /* Using -mips32r2 -mfp64.  */
+  Val_GNU_MIPS_ABI_FP_64 = 6,
+  /* Using -mips32r2 -mfp64 -mno-odd-spreg.  */
+  Val_GNU_MIPS_ABI_FP_64A = 7,
+  /* Maximum allocated FP ABI value.  */
+  Val_GNU_MIPS_ABI_FP_MAX = 7
+};
 
 /* HPPA specific definitions.  */
 
@@ -1737,9 +2180,9 @@ typedef Elf32_Addr Elf32_Conflict;
 #define EFA_PARISC_1_1		    0x0210 /* PA-RISC 1.1 big-endian.  */
 #define EFA_PARISC_2_0		    0x0214 /* PA-RISC 2.0 big-endian.  */
 
-/* Additional section indeces.  */
+/* Additional section indices.  */
 
-#define SHN_PARISC_ANSI_COMMON	0xff00	   /* Section for tenatively declared
+#define SHN_PARISC_ANSI_COMMON	0xff00	   /* Section for tentatively declared
 					      symbols in ANSI C.  */
 #define SHN_PARISC_HUGE_COMMON	0xff01	   /* Common blocks in huge model.  */
 
@@ -2058,6 +2501,8 @@ typedef Elf32_Addr Elf32_Conflict;
 #define R_PPC_GOT_DTPREL16_LO	92 /* half16*	(sym+add)@got@dtprel@l */
 #define R_PPC_GOT_DTPREL16_HI	93 /* half16*	(sym+add)@got@dtprel@h */
 #define R_PPC_GOT_DTPREL16_HA	94 /* half16*	(sym+add)@got@dtprel@ha */
+#define R_PPC_TLSGD		95 /* none	(sym+add)@tlsgd */
+#define R_PPC_TLSLD		96 /* none	(sym+add)@tlsld */
 
 /* The remaining relocs are from the Embedded ELF ABI, and are not
    in the SVR4 ELF ABI.  */
@@ -2101,7 +2546,11 @@ typedef Elf32_Addr Elf32_Conflict;
 
 /* PowerPC specific values for the Dyn d_tag field.  */
 #define DT_PPC_GOT		(DT_LOPROC + 0)
-#define DT_PPC_NUM		1
+#define DT_PPC_OPT		(DT_LOPROC + 1)
+#define DT_PPC_NUM		2
+
+/* PowerPC specific values for the DT_PPC_OPT Dyn entry.  */
+#define PPC_OPT_TLS		1
 
 /* PowerPC64 relocations defined by the ABIs */
 #define R_PPC64_NONE		R_PPC_NONE
@@ -2214,6 +2663,17 @@ typedef Elf32_Addr Elf32_Conflict;
 #define R_PPC64_DTPREL16_HIGHERA 104 /* half16	(sym+add)@dtprel@highera */
 #define R_PPC64_DTPREL16_HIGHEST 105 /* half16	(sym+add)@dtprel@highest */
 #define R_PPC64_DTPREL16_HIGHESTA 106 /* half16	(sym+add)@dtprel@highesta */
+#define R_PPC64_TLSGD		107 /* none	(sym+add)@tlsgd */
+#define R_PPC64_TLSLD		108 /* none	(sym+add)@tlsld */
+#define R_PPC64_TOCSAVE		109 /* none */
+
+/* Added when HA and HI relocs were changed to report overflows.  */
+#define R_PPC64_ADDR16_HIGH	110
+#define R_PPC64_ADDR16_HIGHA	111
+#define R_PPC64_TPREL16_HIGH	112
+#define R_PPC64_TPREL16_HIGHA	113
+#define R_PPC64_DTPREL16_HIGH	114
+#define R_PPC64_DTPREL16_HIGHA	115
 
 /* GNU extension to support local ifunc.  */
 #define R_PPC64_JMP_IREL	247
@@ -2223,11 +2683,29 @@ typedef Elf32_Addr Elf32_Conflict;
 #define R_PPC64_REL16_HI	251	/* half16   (sym+add-.)@h */
 #define R_PPC64_REL16_HA	252	/* half16   (sym+add-.)@ha */
 
+/* e_flags bits specifying ABI.
+   1 for original function descriptor using ABI,
+   2 for revised ABI without function descriptors,
+   0 for unspecified or not using any features affected by the differences.  */
+#define EF_PPC64_ABI	3
+
 /* PowerPC64 specific values for the Dyn d_tag field.  */
 #define DT_PPC64_GLINK  (DT_LOPROC + 0)
 #define DT_PPC64_OPD	(DT_LOPROC + 1)
 #define DT_PPC64_OPDSZ	(DT_LOPROC + 2)
-#define DT_PPC64_NUM    3
+#define DT_PPC64_OPT	(DT_LOPROC + 3)
+#define DT_PPC64_NUM    4
+
+/* PowerPC64 specific bits in the DT_PPC64_OPT Dyn entry.  */
+#define PPC64_OPT_TLS		1
+#define PPC64_OPT_MULTI_TOC	2
+#define PPC64_OPT_LOCALENTRY	4
+
+/* PowerPC64 specific values for the Elf64_Sym st_other field.  */
+#define STO_PPC64_LOCAL_BIT	5
+#define STO_PPC64_LOCAL_MASK	(7 << STO_PPC64_LOCAL_BIT)
+#define PPC64_LOCAL_ENTRY_OFFSET(other)				\
+ (((1 << (((other) & STO_PPC64_LOCAL_MASK) >> STO_PPC64_LOCAL_BIT)) >> 2) << 2)
 
 
 /* ARM specific declarations */
@@ -2246,6 +2724,9 @@ typedef Elf32_Addr Elf32_Conflict;
 #define EF_ARM_VFP_FLOAT	0x400
 #define EF_ARM_MAVERICK_FLOAT	0x800
 
+#define EF_ARM_ABI_FLOAT_SOFT	0x200   /* NB conflicts with EF_ARM_SOFT_FLOAT */
+#define EF_ARM_ABI_FLOAT_HARD	0x400   /* NB conflicts with EF_ARM_VFP_FLOAT */
+
 
 /* Other constants defined in the ARM ELF spec. version B-01.  */
 /* NB. These conflict with values defined above.  */
@@ -2290,26 +2771,180 @@ typedef Elf32_Addr Elf32_Conflict;
 #define SHT_ARM_ATTRIBUTES	(SHT_LOPROC + 3) /* ARM attributes section.  */
 
 
+/* AArch64 relocs.  */
+
+#define R_AARCH64_NONE            0	/* No relocation.  */
+
+/* ILP32 AArch64 relocs.  */
+#define R_AARCH64_P32_ABS32		  1	/* Direct 32 bit.  */
+#define R_AARCH64_P32_COPY		180	/* Copy symbol at runtime.  */
+#define R_AARCH64_P32_GLOB_DAT		181	/* Create GOT entry.  */
+#define R_AARCH64_P32_JUMP_SLOT		182	/* Create PLT entry.  */
+#define R_AARCH64_P32_RELATIVE		183	/* Adjust by program base.  */
+#define R_AARCH64_P32_TLS_DTPMOD	184	/* Module number, 32 bit.  */
+#define R_AARCH64_P32_TLS_DTPREL	185	/* Module-relative offset, 32 bit.  */
+#define R_AARCH64_P32_TLS_TPREL		186	/* TP-relative offset, 32 bit.  */
+#define R_AARCH64_P32_TLSDESC		187	/* TLS Descriptor.  */
+#define R_AARCH64_P32_IRELATIVE		188	/* STT_GNU_IFUNC relocation. */
+
+/* LP64 AArch64 relocs.  */
+#define R_AARCH64_ABS64         257	/* Direct 64 bit. */
+#define R_AARCH64_ABS32         258	/* Direct 32 bit.  */
+#define R_AARCH64_ABS16		259	/* Direct 16-bit.  */
+#define R_AARCH64_PREL64	260	/* PC-relative 64-bit.	*/
+#define R_AARCH64_PREL32	261	/* PC-relative 32-bit.	*/
+#define R_AARCH64_PREL16	262	/* PC-relative 16-bit.	*/
+#define R_AARCH64_MOVW_UABS_G0	263	/* Dir. MOVZ imm. from bits 15:0.  */
+#define R_AARCH64_MOVW_UABS_G0_NC 264	/* Likewise for MOVK; no check.  */
+#define R_AARCH64_MOVW_UABS_G1	265	/* Dir. MOVZ imm. from bits 31:16.  */
+#define R_AARCH64_MOVW_UABS_G1_NC 266	/* Likewise for MOVK; no check.  */
+#define R_AARCH64_MOVW_UABS_G2	267	/* Dir. MOVZ imm. from bits 47:32.  */
+#define R_AARCH64_MOVW_UABS_G2_NC 268	/* Likewise for MOVK; no check.  */
+#define R_AARCH64_MOVW_UABS_G3	269	/* Dir. MOV{K,Z} imm. from 63:48.  */
+#define R_AARCH64_MOVW_SABS_G0	270	/* Dir. MOV{N,Z} imm. from 15:0.  */
+#define R_AARCH64_MOVW_SABS_G1	271	/* Dir. MOV{N,Z} imm. from 31:16.  */
+#define R_AARCH64_MOVW_SABS_G2	272	/* Dir. MOV{N,Z} imm. from 47:32.  */
+#define R_AARCH64_LD_PREL_LO19	273	/* PC-rel. LD imm. from bits 20:2.  */
+#define R_AARCH64_ADR_PREL_LO21	274	/* PC-rel. ADR imm. from bits 20:0.  */
+#define R_AARCH64_ADR_PREL_PG_HI21 275	/* Page-rel. ADRP imm. from 32:12.  */
+#define R_AARCH64_ADR_PREL_PG_HI21_NC 276 /* Likewise; no overflow check.  */
+#define R_AARCH64_ADD_ABS_LO12_NC 277	/* Dir. ADD imm. from bits 11:0.  */
+#define R_AARCH64_LDST8_ABS_LO12_NC 278	/* Likewise for LD/ST; no check. */
+#define R_AARCH64_TSTBR14	279	/* PC-rel. TBZ/TBNZ imm. from 15:2.  */
+#define R_AARCH64_CONDBR19	280	/* PC-rel. cond. br. imm. from 20:2. */
+#define R_AARCH64_JUMP26	282	/* PC-rel. B imm. from bits 27:2.  */
+#define R_AARCH64_CALL26	283	/* Likewise for CALL.  */
+#define R_AARCH64_LDST16_ABS_LO12_NC 284 /* Dir. ADD imm. from bits 11:1.  */
+#define R_AARCH64_LDST32_ABS_LO12_NC 285 /* Likewise for bits 11:2.  */
+#define R_AARCH64_LDST64_ABS_LO12_NC 286 /* Likewise for bits 11:3.  */
+#define R_AARCH64_MOVW_PREL_G0	287	/* PC-rel. MOV{N,Z} imm. from 15:0.  */
+#define R_AARCH64_MOVW_PREL_G0_NC 288	/* Likewise for MOVK; no check.  */
+#define R_AARCH64_MOVW_PREL_G1	289	/* PC-rel. MOV{N,Z} imm. from 31:16. */
+#define R_AARCH64_MOVW_PREL_G1_NC 290	/* Likewise for MOVK; no check.  */
+#define R_AARCH64_MOVW_PREL_G2	291	/* PC-rel. MOV{N,Z} imm. from 47:32. */
+#define R_AARCH64_MOVW_PREL_G2_NC 292	/* Likewise for MOVK; no check.  */
+#define R_AARCH64_MOVW_PREL_G3	293	/* PC-rel. MOV{N,Z} imm. from 63:48. */
+#define R_AARCH64_LDST128_ABS_LO12_NC 299 /* Dir. ADD imm. from bits 11:4.  */
+#define R_AARCH64_MOVW_GOTOFF_G0 300	/* GOT-rel. off. MOV{N,Z} imm. 15:0. */
+#define R_AARCH64_MOVW_GOTOFF_G0_NC 301	/* Likewise for MOVK; no check.  */
+#define R_AARCH64_MOVW_GOTOFF_G1 302	/* GOT-rel. o. MOV{N,Z} imm. 31:16.  */
+#define R_AARCH64_MOVW_GOTOFF_G1_NC 303	/* Likewise for MOVK; no check.  */
+#define R_AARCH64_MOVW_GOTOFF_G2 304	/* GOT-rel. o. MOV{N,Z} imm. 47:32.  */
+#define R_AARCH64_MOVW_GOTOFF_G2_NC 305	/* Likewise for MOVK; no check.  */
+#define R_AARCH64_MOVW_GOTOFF_G3 306	/* GOT-rel. o. MOV{N,Z} imm. 63:48.  */
+#define R_AARCH64_GOTREL64	307	/* GOT-relative 64-bit.  */
+#define R_AARCH64_GOTREL32	308	/* GOT-relative 32-bit.  */
+#define R_AARCH64_GOT_LD_PREL19	309	/* PC-rel. GOT off. load imm. 20:2.  */
+#define R_AARCH64_LD64_GOTOFF_LO15 310	/* GOT-rel. off. LD/ST imm. 14:3.  */
+#define R_AARCH64_ADR_GOT_PAGE	311	/* P-page-rel. GOT off. ADRP 32:12.  */
+#define R_AARCH64_LD64_GOT_LO12_NC 312	/* Dir. GOT off. LD/ST imm. 11:3.  */
+#define R_AARCH64_LD64_GOTPAGE_LO15 313	/* GOT-page-rel. GOT off. LD/ST 14:3 */
+#define R_AARCH64_TLSGD_ADR_PREL21 512	/* PC-relative ADR imm. 20:0.  */
+#define R_AARCH64_TLSGD_ADR_PAGE21 513	/* page-rel. ADRP imm. 32:12.  */
+#define R_AARCH64_TLSGD_ADD_LO12_NC 514	/* direct ADD imm. from 11:0.  */
+#define R_AARCH64_TLSGD_MOVW_G1	515	/* GOT-rel. MOV{N,Z} 31:16.  */
+#define R_AARCH64_TLSGD_MOVW_G0_NC 516	/* GOT-rel. MOVK imm. 15:0.  */
+#define R_AARCH64_TLSLD_ADR_PREL21 517	/* Like 512; local dynamic model.  */
+#define R_AARCH64_TLSLD_ADR_PAGE21 518	/* Like 513; local dynamic model.  */
+#define R_AARCH64_TLSLD_ADD_LO12_NC 519	/* Like 514; local dynamic model.  */
+#define R_AARCH64_TLSLD_MOVW_G1	520	/* Like 515; local dynamic model.  */
+#define R_AARCH64_TLSLD_MOVW_G0_NC 521	/* Like 516; local dynamic model.  */
+#define R_AARCH64_TLSLD_LD_PREL19 522	/* TLS PC-rel. load imm. 20:2.  */
+#define R_AARCH64_TLSLD_MOVW_DTPREL_G2 523 /* TLS DTP-rel. MOV{N,Z} 47:32.  */
+#define R_AARCH64_TLSLD_MOVW_DTPREL_G1 524 /* TLS DTP-rel. MOV{N,Z} 31:16.  */
+#define R_AARCH64_TLSLD_MOVW_DTPREL_G1_NC 525 /* Likewise; MOVK; no check.  */
+#define R_AARCH64_TLSLD_MOVW_DTPREL_G0 526 /* TLS DTP-rel. MOV{N,Z} 15:0.  */
+#define R_AARCH64_TLSLD_MOVW_DTPREL_G0_NC 527 /* Likewise; MOVK; no check.  */
+#define R_AARCH64_TLSLD_ADD_DTPREL_HI12 528 /* DTP-rel. ADD imm. from 23:12. */
+#define R_AARCH64_TLSLD_ADD_DTPREL_LO12 529 /* DTP-rel. ADD imm. from 11:0.  */
+#define R_AARCH64_TLSLD_ADD_DTPREL_LO12_NC 530 /* Likewise; no ovfl. check.  */
+#define R_AARCH64_TLSLD_LDST8_DTPREL_LO12 531 /* DTP-rel. LD/ST imm. 11:0.  */
+#define R_AARCH64_TLSLD_LDST8_DTPREL_LO12_NC 532 /* Likewise; no check.  */
+#define R_AARCH64_TLSLD_LDST16_DTPREL_LO12 533 /* DTP-rel. LD/ST imm. 11:1.  */
+#define R_AARCH64_TLSLD_LDST16_DTPREL_LO12_NC 534 /* Likewise; no check.  */
+#define R_AARCH64_TLSLD_LDST32_DTPREL_LO12 535 /* DTP-rel. LD/ST imm. 11:2.  */
+#define R_AARCH64_TLSLD_LDST32_DTPREL_LO12_NC 536 /* Likewise; no check.  */
+#define R_AARCH64_TLSLD_LDST64_DTPREL_LO12 537 /* DTP-rel. LD/ST imm. 11:3.  */
+#define R_AARCH64_TLSLD_LDST64_DTPREL_LO12_NC 538 /* Likewise; no check.  */
+#define R_AARCH64_TLSIE_MOVW_GOTTPREL_G1 539 /* GOT-rel. MOV{N,Z} 31:16.  */
+#define R_AARCH64_TLSIE_MOVW_GOTTPREL_G0_NC 540 /* GOT-rel. MOVK 15:0.  */
+#define R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21 541 /* Page-rel. ADRP 32:12.  */
+#define R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC 542 /* Direct LD off. 11:3.  */
+#define R_AARCH64_TLSIE_LD_GOTTPREL_PREL19 543 /* PC-rel. load imm. 20:2.  */
+#define R_AARCH64_TLSLE_MOVW_TPREL_G2 544 /* TLS TP-rel. MOV{N,Z} 47:32.  */
+#define R_AARCH64_TLSLE_MOVW_TPREL_G1 545 /* TLS TP-rel. MOV{N,Z} 31:16.  */
+#define R_AARCH64_TLSLE_MOVW_TPREL_G1_NC 546 /* Likewise; MOVK; no check.  */
+#define R_AARCH64_TLSLE_MOVW_TPREL_G0 547 /* TLS TP-rel. MOV{N,Z} 15:0.  */
+#define R_AARCH64_TLSLE_MOVW_TPREL_G0_NC 548 /* Likewise; MOVK; no check.  */
+#define R_AARCH64_TLSLE_ADD_TPREL_HI12 549 /* TP-rel. ADD imm. 23:12.  */
+#define R_AARCH64_TLSLE_ADD_TPREL_LO12 550 /* TP-rel. ADD imm. 11:0.  */
+#define R_AARCH64_TLSLE_ADD_TPREL_LO12_NC 551 /* Likewise; no ovfl. check.  */
+#define R_AARCH64_TLSLE_LDST8_TPREL_LO12 552 /* TP-rel. LD/ST off. 11:0.  */
+#define R_AARCH64_TLSLE_LDST8_TPREL_LO12_NC 553 /* Likewise; no ovfl. check. */
+#define R_AARCH64_TLSLE_LDST16_TPREL_LO12 554 /* TP-rel. LD/ST off. 11:1.  */
+#define R_AARCH64_TLSLE_LDST16_TPREL_LO12_NC 555 /* Likewise; no check.  */
+#define R_AARCH64_TLSLE_LDST32_TPREL_LO12 556 /* TP-rel. LD/ST off. 11:2.  */
+#define R_AARCH64_TLSLE_LDST32_TPREL_LO12_NC 557 /* Likewise; no check.  */
+#define R_AARCH64_TLSLE_LDST64_TPREL_LO12 558 /* TP-rel. LD/ST off. 11:3.  */
+#define R_AARCH64_TLSLE_LDST64_TPREL_LO12_NC 559 /* Likewise; no check.  */
+#define R_AARCH64_TLSDESC_LD_PREL19 560	/* PC-rel. load immediate 20:2.  */
+#define R_AARCH64_TLSDESC_ADR_PREL21 561 /* PC-rel. ADR immediate 20:0.  */
+#define R_AARCH64_TLSDESC_ADR_PAGE21 562 /* Page-rel. ADRP imm. 32:12.  */
+#define R_AARCH64_TLSDESC_LD64_LO12 563	/* Direct LD off. from 11:3.  */
+#define R_AARCH64_TLSDESC_ADD_LO12 564	/* Direct ADD imm. from 11:0.  */
+#define R_AARCH64_TLSDESC_OFF_G1 565	/* GOT-rel. MOV{N,Z} imm. 31:16.  */
+#define R_AARCH64_TLSDESC_OFF_G0_NC 566	/* GOT-rel. MOVK imm. 15:0; no ck.  */
+#define R_AARCH64_TLSDESC_LDR	567	/* Relax LDR.  */
+#define R_AARCH64_TLSDESC_ADD	568	/* Relax ADD.  */
+#define R_AARCH64_TLSDESC_CALL	569	/* Relax BLR.  */
+#define R_AARCH64_TLSLE_LDST128_TPREL_LO12 570 /* TP-rel. LD/ST off. 11:4.  */
+#define R_AARCH64_TLSLE_LDST128_TPREL_LO12_NC 571 /* Likewise; no check.  */
+#define R_AARCH64_TLSLD_LDST128_DTPREL_LO12 572 /* DTP-rel. LD/ST imm. 11:4. */
+#define R_AARCH64_TLSLD_LDST128_DTPREL_LO12_NC 573 /* Likewise; no check.  */
+#define R_AARCH64_COPY         1024	/* Copy symbol at runtime.  */
+#define R_AARCH64_GLOB_DAT     1025	/* Create GOT entry.  */
+#define R_AARCH64_JUMP_SLOT    1026	/* Create PLT entry.  */
+#define R_AARCH64_RELATIVE     1027	/* Adjust by program base.  */
+#define R_AARCH64_TLS_DTPMOD   1028	/* Module number, 64 bit.  */
+#define R_AARCH64_TLS_DTPREL   1029	/* Module-relative offset, 64 bit.  */
+#define R_AARCH64_TLS_TPREL    1030	/* TP-relative offset, 64 bit.  */
+#define R_AARCH64_TLSDESC      1031	/* TLS Descriptor.  */
+#define R_AARCH64_IRELATIVE	1032	/* STT_GNU_IFUNC relocation.  */
+
+/* MTE memory tag segment type.  */
+#define PT_AARCH64_MEMTAG_MTE	(PT_LOPROC + 2)
+
+/* AArch64 specific values for the Dyn d_tag field.  */
+#define DT_AARCH64_BTI_PLT	(DT_LOPROC + 1)
+#define DT_AARCH64_PAC_PLT	(DT_LOPROC + 3)
+#define DT_AARCH64_VARIANT_PCS	(DT_LOPROC + 5)
+#define DT_AARCH64_NUM		6
+
+/* AArch64 specific values for the st_other field.  */
+#define STO_AARCH64_VARIANT_PCS 0x80
+
 /* ARM relocs.  */
 
 #define R_ARM_NONE		0	/* No reloc */
-#define R_ARM_PC24		1	/* PC relative 26 bit branch */
+#define R_ARM_PC24		1	/* Deprecated PC relative 26
+					   bit branch.  */
 #define R_ARM_ABS32		2	/* Direct 32 bit  */
 #define R_ARM_REL32		3	/* PC relative 32 bit */
 #define R_ARM_PC13		4
 #define R_ARM_ABS16		5	/* Direct 16 bit */
 #define R_ARM_ABS12		6	/* Direct 12 bit */
-#define R_ARM_THM_ABS5		7
+#define R_ARM_THM_ABS5		7	/* Direct & 0x7C (LDR, STR).  */
 #define R_ARM_ABS8		8	/* Direct 8 bit */
 #define R_ARM_SBREL32		9
-#define R_ARM_THM_PC22		10
-#define R_ARM_THM_PC8		11
+#define R_ARM_THM_PC22		10	/* PC relative 24 bit (Thumb32 BL).  */
+#define R_ARM_THM_PC8		11	/* PC relative & 0x3FC
+					   (Thumb16 LDR, ADD, ADR).  */
 #define R_ARM_AMP_VCALL9	12
 #define R_ARM_SWI24		13	/* Obsolete static relocation.  */
 #define R_ARM_TLS_DESC		13      /* Dynamic relocation.  */
-#define R_ARM_THM_SWI8		14
-#define R_ARM_XPC25		15
-#define R_ARM_THM_XPC22		16
+#define R_ARM_THM_SWI8		14	/* Reserved.  */
+#define R_ARM_XPC25		15	/* Reserved.  */
+#define R_ARM_THM_XPC22		16	/* Reserved.  */
 #define R_ARM_TLS_DTPMOD32	17	/* ID of module containing symbol */
 #define R_ARM_TLS_DTPOFF32	18	/* Offset in TLS block */
 #define R_ARM_TLS_TPOFF32	19	/* Offset in static TLS block */
@@ -2320,21 +2955,109 @@ typedef Elf32_Addr Elf32_Conflict;
 #define R_ARM_GOTOFF		24	/* 32 bit offset to GOT */
 #define R_ARM_GOTPC		25	/* 32 bit PC relative offset to GOT */
 #define R_ARM_GOT32		26	/* 32 bit GOT entry */
-#define R_ARM_PLT32		27	/* 32 bit PLT address */
-#define R_ARM_ALU_PCREL_7_0	32
-#define R_ARM_ALU_PCREL_15_8	33
-#define R_ARM_ALU_PCREL_23_15	34
-#define R_ARM_LDR_SBREL_11_0	35
-#define R_ARM_ALU_SBREL_19_12	36
-#define R_ARM_ALU_SBREL_27_20	37
+#define R_ARM_PLT32		27	/* Deprecated, 32 bit PLT address.  */
+#define R_ARM_CALL		28	/* PC relative 24 bit (BL, BLX).  */
+#define R_ARM_JUMP24		29	/* PC relative 24 bit
+					   (B, BL<cond>).  */
+#define R_ARM_THM_JUMP24	30	/* PC relative 24 bit (Thumb32 B.W).  */
+#define R_ARM_BASE_ABS		31	/* Adjust by program base.  */
+#define R_ARM_ALU_PCREL_7_0	32	/* Obsolete.  */
+#define R_ARM_ALU_PCREL_15_8	33	/* Obsolete.  */
+#define R_ARM_ALU_PCREL_23_15	34	/* Obsolete.  */
+#define R_ARM_LDR_SBREL_11_0	35	/* Deprecated, prog. base relative.  */
+#define R_ARM_ALU_SBREL_19_12	36	/* Deprecated, prog. base relative.  */
+#define R_ARM_ALU_SBREL_27_20	37	/* Deprecated, prog. base relative.  */
+#define R_ARM_TARGET1		38
+#define R_ARM_SBREL31		39	/* Program base relative.  */
+#define R_ARM_V4BX		40
+#define R_ARM_TARGET2		41
+#define R_ARM_PREL31		42	/* 32 bit PC relative.  */
+#define R_ARM_MOVW_ABS_NC	43	/* Direct 16-bit (MOVW).  */
+#define R_ARM_MOVT_ABS		44	/* Direct high 16-bit (MOVT).  */
+#define R_ARM_MOVW_PREL_NC	45	/* PC relative 16-bit (MOVW).  */
+#define R_ARM_MOVT_PREL		46	/* PC relative (MOVT).  */
+#define R_ARM_THM_MOVW_ABS_NC	47	/* Direct 16 bit (Thumb32 MOVW).  */
+#define R_ARM_THM_MOVT_ABS	48	/* Direct high 16 bit
+					   (Thumb32 MOVT).  */
+#define R_ARM_THM_MOVW_PREL_NC	49	/* PC relative 16 bit
+					   (Thumb32 MOVW).  */
+#define R_ARM_THM_MOVT_PREL	50	/* PC relative high 16 bit
+					   (Thumb32 MOVT).  */
+#define R_ARM_THM_JUMP19	51	/* PC relative 20 bit
+					   (Thumb32 B<cond>.W).  */
+#define R_ARM_THM_JUMP6		52	/* PC relative X & 0x7E
+					   (Thumb16 CBZ, CBNZ).  */
+#define R_ARM_THM_ALU_PREL_11_0	53	/* PC relative 12 bit
+					   (Thumb32 ADR.W).  */
+#define R_ARM_THM_PC12		54	/* PC relative 12 bit
+					   (Thumb32 LDR{D,SB,H,SH}).  */
+#define R_ARM_ABS32_NOI		55	/* Direct 32-bit.  */
+#define R_ARM_REL32_NOI		56	/* PC relative 32-bit.  */
+#define R_ARM_ALU_PC_G0_NC	57	/* PC relative (ADD, SUB).  */
+#define R_ARM_ALU_PC_G0		58	/* PC relative (ADD, SUB).  */
+#define R_ARM_ALU_PC_G1_NC	59	/* PC relative (ADD, SUB).  */
+#define R_ARM_ALU_PC_G1		60	/* PC relative (ADD, SUB).  */
+#define R_ARM_ALU_PC_G2		61	/* PC relative (ADD, SUB).  */
+#define R_ARM_LDR_PC_G1		62	/* PC relative (LDR,STR,LDRB,STRB).  */
+#define R_ARM_LDR_PC_G2		63	/* PC relative (LDR,STR,LDRB,STRB).  */
+#define R_ARM_LDRS_PC_G0	64	/* PC relative (STR{D,H},
+					   LDR{D,SB,H,SH}).  */
+#define R_ARM_LDRS_PC_G1	65	/* PC relative (STR{D,H},
+					   LDR{D,SB,H,SH}).  */
+#define R_ARM_LDRS_PC_G2	66	/* PC relative (STR{D,H},
+					   LDR{D,SB,H,SH}).  */
+#define R_ARM_LDC_PC_G0		67	/* PC relative (LDC, STC).  */
+#define R_ARM_LDC_PC_G1		68	/* PC relative (LDC, STC).  */
+#define R_ARM_LDC_PC_G2		69	/* PC relative (LDC, STC).  */
+#define R_ARM_ALU_SB_G0_NC	70	/* Program base relative (ADD,SUB).  */
+#define R_ARM_ALU_SB_G0		71	/* Program base relative (ADD,SUB).  */
+#define R_ARM_ALU_SB_G1_NC	72	/* Program base relative (ADD,SUB).  */
+#define R_ARM_ALU_SB_G1		73	/* Program base relative (ADD,SUB).  */
+#define R_ARM_ALU_SB_G2		74	/* Program base relative (ADD,SUB).  */
+#define R_ARM_LDR_SB_G0		75	/* Program base relative (LDR,
+					   STR, LDRB, STRB).  */
+#define R_ARM_LDR_SB_G1		76	/* Program base relative
+					   (LDR, STR, LDRB, STRB).  */
+#define R_ARM_LDR_SB_G2		77	/* Program base relative
+					   (LDR, STR, LDRB, STRB).  */
+#define R_ARM_LDRS_SB_G0	78	/* Program base relative
+					   (LDR, STR, LDRB, STRB).  */
+#define R_ARM_LDRS_SB_G1	79	/* Program base relative
+					   (LDR, STR, LDRB, STRB).  */
+#define R_ARM_LDRS_SB_G2	80	/* Program base relative
+					   (LDR, STR, LDRB, STRB).  */
+#define R_ARM_LDC_SB_G0		81	/* Program base relative (LDC,STC).  */
+#define R_ARM_LDC_SB_G1		82	/* Program base relative (LDC,STC).  */
+#define R_ARM_LDC_SB_G2		83	/* Program base relative (LDC,STC).  */
+#define R_ARM_MOVW_BREL_NC	84	/* Program base relative 16
+					   bit (MOVW).  */
+#define R_ARM_MOVT_BREL		85	/* Program base relative high
+					   16 bit (MOVT).  */
+#define R_ARM_MOVW_BREL		86	/* Program base relative 16
+					   bit (MOVW).  */
+#define R_ARM_THM_MOVW_BREL_NC	87	/* Program base relative 16
+					   bit (Thumb32 MOVW).  */
+#define R_ARM_THM_MOVT_BREL	88	/* Program base relative high
+					   16 bit (Thumb32 MOVT).  */
+#define R_ARM_THM_MOVW_BREL	89	/* Program base relative 16
+					   bit (Thumb32 MOVW).  */
 #define R_ARM_TLS_GOTDESC	90
 #define R_ARM_TLS_CALL		91
-#define R_ARM_TLS_DESCSEQ	92
+#define R_ARM_TLS_DESCSEQ	92	/* TLS relaxation.  */
 #define R_ARM_THM_TLS_CALL	93
+#define R_ARM_PLT32_ABS		94
+#define R_ARM_GOT_ABS		95	/* GOT entry.  */
+#define R_ARM_GOT_PREL		96	/* PC relative GOT entry.  */
+#define R_ARM_GOT_BREL12	97	/* GOT entry relative to GOT
+					   origin (LDR).  */
+#define R_ARM_GOTOFF12		98	/* 12 bit, GOT entry relative
+					   to GOT origin (LDR, STR).  */
+#define R_ARM_GOTRELAX		99
 #define R_ARM_GNU_VTENTRY	100
 #define R_ARM_GNU_VTINHERIT	101
-#define R_ARM_THM_PC11		102	/* thumb unconditional branch */
-#define R_ARM_THM_PC9		103	/* thumb conditional branch */
+#define R_ARM_THM_PC11		102	/* PC relative & 0xFFE (Thumb16 B).  */
+#define R_ARM_THM_PC9		103	/* PC relative & 0x1FE
+					   (Thumb16 B/B<cond>).  */
 #define R_ARM_TLS_GD32		104	/* PC-rel 32 bit for global dynamic
 					   thread local data */
 #define R_ARM_TLS_LDM32		105	/* PC-rel 32 bit for local dynamic
@@ -2345,7 +3068,18 @@ typedef Elf32_Addr Elf32_Conflict;
 					   static TLS block offset */
 #define R_ARM_TLS_LE32		108	/* 32 bit offset relative to static
 					   TLS block */
-#define	R_ARM_THM_TLS_DESCSEQ	129
+#define R_ARM_TLS_LDO12		109	/* 12 bit relative to TLS
+					   block (LDR, STR).  */
+#define R_ARM_TLS_LE12		110	/* 12 bit relative to static
+					   TLS block (LDR, STR).  */
+#define R_ARM_TLS_IE12GP	111	/* 12 bit GOT entry relative
+					   to GOT origin (LDR).  */
+#define R_ARM_ME_TOO		128	/* Obsolete.  */
+#define R_ARM_THM_TLS_DESCSEQ	129
+#define R_ARM_THM_TLS_DESCSEQ16	129
+#define R_ARM_THM_TLS_DESCSEQ32	130
+#define R_ARM_THM_GOT_BREL12	131	/* GOT entry relative to GOT
+					   origin, 12 bit (Thumb32 LDR).  */
 #define R_ARM_IRELATIVE		160
 #define R_ARM_RXPC25		249
 #define R_ARM_RSBREL32		250
@@ -2357,6 +3091,81 @@ typedef Elf32_Addr Elf32_Conflict;
 /* Keep this the last entry.  */
 #define R_ARM_NUM		256
 
+/* C-SKY */
+#define R_CKCORE_NONE               0	/* no reloc */
+#define R_CKCORE_ADDR32             1	/* direct 32 bit (S + A) */
+#define R_CKCORE_PCRELIMM8BY4       2	/* disp ((S + A - P) >> 2) & 0xff   */
+#define R_CKCORE_PCRELIMM11BY2      3	/* disp ((S + A - P) >> 1) & 0x7ff  */
+#define R_CKCORE_PCREL32            5	/* 32-bit rel (S + A - P)           */
+#define R_CKCORE_PCRELJSR_IMM11BY2  6	/* disp ((S + A - P) >>1) & 0x7ff   */
+#define R_CKCORE_RELATIVE           9	/* 32 bit adjust program base(B + A)*/
+#define R_CKCORE_COPY               10	/* 32 bit adjust by program base    */
+#define R_CKCORE_GLOB_DAT           11	/* off between got and sym (S)      */
+#define R_CKCORE_JUMP_SLOT          12	/* PLT entry (S) */
+#define R_CKCORE_GOTOFF             13	/* offset to GOT (S + A - GOT)      */
+#define R_CKCORE_GOTPC              14	/* PC offset to GOT (GOT + A - P)   */
+#define R_CKCORE_GOT32              15	/* 32 bit GOT entry (G) */
+#define R_CKCORE_PLT32              16	/* 32 bit PLT entry (G) */
+#define R_CKCORE_ADDRGOT            17	/* GOT entry in GLOB_DAT (GOT + G)  */
+#define R_CKCORE_ADDRPLT            18	/* PLT entry in GLOB_DAT (GOT + G)  */
+#define R_CKCORE_PCREL_IMM26BY2     19	/* ((S + A - P) >> 1) & 0x3ffffff   */
+#define R_CKCORE_PCREL_IMM16BY2     20	/* disp ((S + A - P) >> 1) & 0xffff */
+#define R_CKCORE_PCREL_IMM16BY4     21	/* disp ((S + A - P) >> 2) & 0xffff */
+#define R_CKCORE_PCREL_IMM10BY2     22	/* disp ((S + A - P) >> 1) & 0x3ff  */
+#define R_CKCORE_PCREL_IMM10BY4     23	/* disp ((S + A - P) >> 2) & 0x3ff  */
+#define R_CKCORE_ADDR_HI16          24	/* high & low 16 bit ADDR */
+                                        /* ((S + A) >> 16) & 0xffff */
+#define R_CKCORE_ADDR_LO16          25	/* (S + A) & 0xffff */
+#define R_CKCORE_GOTPC_HI16         26	/* high & low 16 bit GOTPC */
+                                        /* ((GOT + A - P) >> 16) & 0xffff */
+#define R_CKCORE_GOTPC_LO16         27	/* (GOT + A - P) & 0xffff */
+#define R_CKCORE_GOTOFF_HI16        28	/* high & low 16 bit GOTOFF */
+                                        /* ((S + A - GOT) >> 16) & 0xffff */
+#define R_CKCORE_GOTOFF_LO16        29	/* (S + A - GOT) & 0xffff */
+#define R_CKCORE_GOT12              30	/* 12 bit disp GOT entry (G) */
+#define R_CKCORE_GOT_HI16           31	/* high & low 16 bit GOT */
+                                        /* (G >> 16) & 0xffff */
+#define R_CKCORE_GOT_LO16           32	/* (G & 0xffff) */
+#define R_CKCORE_PLT12              33	/* 12 bit disp PLT entry (G) */
+#define R_CKCORE_PLT_HI16           34	/* high & low 16 bit PLT */
+                                        /* (G >> 16) & 0xffff */
+#define R_CKCORE_PLT_LO16           35	/* G & 0xffff */
+#define R_CKCORE_ADDRGOT_HI16       36	/* high & low 16 bit ADDRGOT */
+                                        /* (GOT + G * 4) & 0xffff */
+#define R_CKCORE_ADDRGOT_LO16       37	/* (GOT + G * 4) & 0xffff */
+#define R_CKCORE_ADDRPLT_HI16       38	/* high & low 16 bit ADDRPLT */
+                                        /* ((GOT + G * 4) >> 16) & 0xFFFF */
+#define R_CKCORE_ADDRPLT_LO16       39	/* (GOT+G*4) & 0xffff */
+#define R_CKCORE_PCREL_JSR_IMM26BY2 40	/* disp ((S+A-P) >>1) & x3ffffff */
+#define R_CKCORE_TOFFSET_LO16       41	/* (S+A-BTEXT) & 0xffff */
+#define R_CKCORE_DOFFSET_LO16       42	/* (S+A-BTEXT) & 0xffff */
+#define R_CKCORE_PCREL_IMM18BY2     43	/* disp ((S+A-P) >>1) & 0x3ffff */
+#define R_CKCORE_DOFFSET_IMM18      44	/* disp (S+A-BDATA) & 0x3ffff */
+#define R_CKCORE_DOFFSET_IMM18BY2   45	/* disp ((S+A-BDATA)>>1) & 0x3ffff */
+#define R_CKCORE_DOFFSET_IMM18BY4   46	/* disp ((S+A-BDATA)>>2) & 0x3ffff */
+#define R_CKCORE_GOT_IMM18BY4       48	/* disp (G >> 2) */
+#define R_CKCORE_PLT_IMM18BY4       49	/* disp (G >> 2) */
+#define R_CKCORE_PCREL_IMM7BY4      50	/* disp ((S+A-P) >>2) & 0x7f */
+#define R_CKCORE_TLS_LE32           51	/* 32 bit offset to TLS block */
+#define R_CKCORE_TLS_IE32           52
+#define R_CKCORE_TLS_GD32           53
+#define R_CKCORE_TLS_LDM32          54
+#define R_CKCORE_TLS_LDO32          55
+#define R_CKCORE_TLS_DTPMOD32       56
+#define R_CKCORE_TLS_DTPOFF32       57
+#define R_CKCORE_TLS_TPOFF32        58
+
+/* C-SKY elf header definition.  */
+#define EF_CSKY_ABIMASK		    0XF0000000
+#define EF_CSKY_OTHER		    0X0FFF0000
+#define EF_CSKY_PROCESSOR	    0X0000FFFF
+
+#define EF_CSKY_ABIV1		    0X10000000
+#define EF_CSKY_ABIV2		    0X20000000
+
+/* C-SKY attributes section.  */
+#define SHT_CSKY_ATTRIBUTES	    (SHT_LOPROC + 1)
+
 /* IA-64 specific declarations.  */
 
 /* Processor specific flags for the Ehdr e_flags field.  */
@@ -2701,8 +3510,18 @@ typedef Elf32_Addr Elf32_Conflict;
 #define R_X86_64_TLSDESC        36	/* TLS descriptor.  */
 #define R_X86_64_IRELATIVE	37	/* Adjust indirectly by program base */
 #define R_X86_64_RELATIVE64	38	/* 64-bit adjust by program base */
+					/* 39 Reserved was R_X86_64_PC32_BND */
+					/* 40 Reserved was R_X86_64_PLT32_BND */
+#define R_X86_64_GOTPCRELX	41	/* Load from 32 bit signed pc relative
+					   offset to GOT entry without REX
+					   prefix, relaxable.  */
+#define R_X86_64_REX_GOTPCRELX	42	/* Load from 32 bit signed pc relative
+					   offset to GOT entry with REX prefix,
+					   relaxable.  */
+#define R_X86_64_NUM		43
 
-#define R_X86_64_NUM		39
+/* x86-64 sh_type values.  */
+#define SHT_X86_64_UNWIND	0x70000001 /* Unwind information.  */
 
 
 /* AM33 relocations.  */
@@ -2730,8 +3549,23 @@ typedef Elf32_Addr Elf32_Conflict;
 #define R_MN10300_GLOB_DAT	21	/* Create GOT entry.  */
 #define R_MN10300_JMP_SLOT	22	/* Create PLT entry.  */
 #define R_MN10300_RELATIVE	23	/* Adjust by program base.  */
-
-#define R_MN10300_NUM		24
+#define R_MN10300_TLS_GD	24	/* 32-bit offset for global dynamic.  */
+#define R_MN10300_TLS_LD	25	/* 32-bit offset for local dynamic.  */
+#define R_MN10300_TLS_LDO	26	/* Module-relative offset.  */
+#define R_MN10300_TLS_GOTIE	27	/* GOT offset for static TLS block
+					   offset.  */
+#define R_MN10300_TLS_IE	28	/* GOT address for static TLS block
+					   offset.  */
+#define R_MN10300_TLS_LE	29	/* Offset relative to static TLS
+					   block.  */
+#define R_MN10300_TLS_DTPMOD	30	/* ID of module containing symbol.  */
+#define R_MN10300_TLS_DTPOFF	31	/* Offset in module TLS block.  */
+#define R_MN10300_TLS_TPOFF	32	/* Offset in static TLS block.  */
+#define R_MN10300_SYM_DIFF	33	/* Adjustment for next reloc as needed
+					   by linker relaxation.  */
+#define R_MN10300_ALIGN		34	/* Alignment requirement for linker
+					   relaxation.  */
+#define R_MN10300_NUM		35
 
 
 /* M32R relocs.  */
@@ -2789,6 +3623,89 @@ typedef Elf32_Addr Elf32_Conflict;
 #define R_M32R_GOTOFF_LO	64	/* Low 16 bit offset to GOT */
 #define R_M32R_NUM		256	/* Keep this the last entry. */
 
+/* MicroBlaze relocations */
+#define R_MICROBLAZE_NONE		0	/* No reloc. */
+#define R_MICROBLAZE_32 		1	/* Direct 32 bit. */
+#define R_MICROBLAZE_32_PCREL		2	/* PC relative 32 bit. */
+#define R_MICROBLAZE_64_PCREL		3	/* PC relative 64 bit. */
+#define R_MICROBLAZE_32_PCREL_LO	4	/* Low 16 bits of PCREL32. */
+#define R_MICROBLAZE_64 		5	/* Direct 64 bit. */
+#define R_MICROBLAZE_32_LO		6	/* Low 16 bit. */
+#define R_MICROBLAZE_SRO32		7	/* Read-only small data area. */
+#define R_MICROBLAZE_SRW32		8	/* Read-write small data area. */
+#define R_MICROBLAZE_64_NONE		9	/* No reloc. */
+#define R_MICROBLAZE_32_SYM_OP_SYM	10	/* Symbol Op Symbol relocation. */
+#define R_MICROBLAZE_GNU_VTINHERIT	11	/* GNU C++ vtable hierarchy. */
+#define R_MICROBLAZE_GNU_VTENTRY	12	/* GNU C++ vtable member usage. */
+#define R_MICROBLAZE_GOTPC_64		13	/* PC-relative GOT offset.  */
+#define R_MICROBLAZE_GOT_64		14	/* GOT entry offset.  */
+#define R_MICROBLAZE_PLT_64		15	/* PLT offset (PC-relative).  */
+#define R_MICROBLAZE_REL		16	/* Adjust by program base.  */
+#define R_MICROBLAZE_JUMP_SLOT		17	/* Create PLT entry.  */
+#define R_MICROBLAZE_GLOB_DAT		18	/* Create GOT entry.  */
+#define R_MICROBLAZE_GOTOFF_64		19	/* 64 bit offset to GOT. */
+#define R_MICROBLAZE_GOTOFF_32		20	/* 32 bit offset to GOT. */
+#define R_MICROBLAZE_COPY		21	/* Runtime copy.  */
+#define R_MICROBLAZE_TLS		22	/* TLS Reloc. */
+#define R_MICROBLAZE_TLSGD		23	/* TLS General Dynamic. */
+#define R_MICROBLAZE_TLSLD		24	/* TLS Local Dynamic. */
+#define R_MICROBLAZE_TLSDTPMOD32	25	/* TLS Module ID. */
+#define R_MICROBLAZE_TLSDTPREL32	26	/* TLS Offset Within TLS Block. */
+#define R_MICROBLAZE_TLSDTPREL64	27	/* TLS Offset Within TLS Block. */
+#define R_MICROBLAZE_TLSGOTTPREL32	28	/* TLS Offset From Thread Pointer. */
+#define R_MICROBLAZE_TLSTPREL32 	29	/* TLS Offset From Thread Pointer. */
+
+/* Legal values for d_tag (dynamic entry type).  */
+#define DT_NIOS2_GP             0x70000002 /* Address of _gp.  */
+
+/* Nios II relocations.  */
+#define R_NIOS2_NONE		0	/* No reloc.  */
+#define R_NIOS2_S16		1	/* Direct signed 16 bit.  */
+#define R_NIOS2_U16		2	/* Direct unsigned 16 bit.  */
+#define R_NIOS2_PCREL16		3	/* PC relative 16 bit.  */
+#define R_NIOS2_CALL26		4	/* Direct call.  */
+#define R_NIOS2_IMM5		5	/* 5 bit constant expression.  */
+#define R_NIOS2_CACHE_OPX	6	/* 5 bit expression, shift 22.  */
+#define R_NIOS2_IMM6		7	/* 6 bit constant expression.  */
+#define R_NIOS2_IMM8		8	/* 8 bit constant expression.  */
+#define R_NIOS2_HI16		9	/* High 16 bit.  */
+#define R_NIOS2_LO16		10	/* Low 16 bit.  */
+#define R_NIOS2_HIADJ16		11	/* High 16 bit, adjusted.  */
+#define R_NIOS2_BFD_RELOC_32	12	/* 32 bit symbol value + addend.  */
+#define R_NIOS2_BFD_RELOC_16	13	/* 16 bit symbol value + addend.  */
+#define R_NIOS2_BFD_RELOC_8	14	/* 8 bit symbol value + addend.  */
+#define R_NIOS2_GPREL		15	/* 16 bit GP pointer offset.  */
+#define R_NIOS2_GNU_VTINHERIT	16	/* GNU C++ vtable hierarchy.  */
+#define R_NIOS2_GNU_VTENTRY	17	/* GNU C++ vtable member usage.  */
+#define R_NIOS2_UJMP		18	/* Unconditional branch.  */
+#define R_NIOS2_CJMP		19	/* Conditional branch.  */
+#define R_NIOS2_CALLR		20	/* Indirect call through register.  */
+#define R_NIOS2_ALIGN		21	/* Alignment requirement for
+					   linker relaxation.  */
+#define R_NIOS2_GOT16		22	/* 16 bit GOT entry.  */
+#define R_NIOS2_CALL16		23	/* 16 bit GOT entry for function.  */
+#define R_NIOS2_GOTOFF_LO	24	/* %lo of offset to GOT pointer.  */
+#define R_NIOS2_GOTOFF_HA	25	/* %hiadj of offset to GOT pointer.  */
+#define R_NIOS2_PCREL_LO	26	/* %lo of PC relative offset.  */
+#define R_NIOS2_PCREL_HA	27	/* %hiadj of PC relative offset.  */
+#define R_NIOS2_TLS_GD16	28	/* 16 bit GOT offset for TLS GD.  */
+#define R_NIOS2_TLS_LDM16	29	/* 16 bit GOT offset for TLS LDM.  */
+#define R_NIOS2_TLS_LDO16	30	/* 16 bit module relative offset.  */
+#define R_NIOS2_TLS_IE16	31	/* 16 bit GOT offset for TLS IE.  */
+#define R_NIOS2_TLS_LE16	32	/* 16 bit LE TP-relative offset.  */
+#define R_NIOS2_TLS_DTPMOD	33	/* Module number.  */
+#define R_NIOS2_TLS_DTPREL	34	/* Module-relative offset.  */
+#define R_NIOS2_TLS_TPREL	35	/* TP-relative offset.  */
+#define R_NIOS2_COPY		36	/* Copy symbol at runtime.  */
+#define R_NIOS2_GLOB_DAT	37	/* Create GOT entry.  */
+#define R_NIOS2_JUMP_SLOT	38	/* Create PLT entry.  */
+#define R_NIOS2_RELATIVE	39	/* Adjust by program base.  */
+#define R_NIOS2_GOTOFF		40	/* 16 bit offset to GOT pointer.  */
+#define R_NIOS2_CALL26_NOAT	41	/* Direct call in .noat section.  */
+#define R_NIOS2_GOT_LO		42	/* %lo() of GOT entry.  */
+#define R_NIOS2_GOT_HA		43	/* %hiadj() of GOT entry.  */
+#define R_NIOS2_CALL_LO		44	/* %lo() of function GOT entry.  */
+#define R_NIOS2_CALL_HA		45	/* %hiadj() of function GOT entry.  */
 
 /* TILEPro relocations.  */
 #define R_TILEPRO_NONE		0	/* No reloc */
@@ -2955,12 +3872,18 @@ typedef Elf32_Addr Elf32_Conflict;
 #define R_TILEGX_IMM16_X1_HW2_LAST_PCREL 63 /* X1 pipe PC-rel last hword 2 */
 #define R_TILEGX_IMM16_X0_HW0_GOT 64	/* X0 pipe hword 0 GOT offset */
 #define R_TILEGX_IMM16_X1_HW0_GOT 65	/* X1 pipe hword 0 GOT offset */
-/* Relocs 66-71 are currently not defined.  */
+#define R_TILEGX_IMM16_X0_HW0_PLT_PCREL 66 /* X0 pipe PC-rel PLT hword 0 */
+#define R_TILEGX_IMM16_X1_HW0_PLT_PCREL 67 /* X1 pipe PC-rel PLT hword 0 */
+#define R_TILEGX_IMM16_X0_HW1_PLT_PCREL 68 /* X0 pipe PC-rel PLT hword 1 */
+#define R_TILEGX_IMM16_X1_HW1_PLT_PCREL 69 /* X1 pipe PC-rel PLT hword 1 */
+#define R_TILEGX_IMM16_X0_HW2_PLT_PCREL 70 /* X0 pipe PC-rel PLT hword 2 */
+#define R_TILEGX_IMM16_X1_HW2_PLT_PCREL 71 /* X1 pipe PC-rel PLT hword 2 */
 #define R_TILEGX_IMM16_X0_HW0_LAST_GOT 72 /* X0 pipe last hword 0 GOT offset */
 #define R_TILEGX_IMM16_X1_HW0_LAST_GOT 73 /* X1 pipe last hword 0 GOT offset */
 #define R_TILEGX_IMM16_X0_HW1_LAST_GOT 74 /* X0 pipe last hword 1 GOT offset */
 #define R_TILEGX_IMM16_X1_HW1_LAST_GOT 75 /* X1 pipe last hword 1 GOT offset */
-/* Relocs 76-77 are currently not defined.  */
+#define R_TILEGX_IMM16_X0_HW3_PLT_PCREL 76 /* X0 pipe PC-rel PLT hword 3 */
+#define R_TILEGX_IMM16_X1_HW3_PLT_PCREL 77 /* X1 pipe PC-rel PLT hword 3 */
 #define R_TILEGX_IMM16_X0_HW0_TLS_GD 78	/* X0 pipe hword 0 TLS GD offset */
 #define R_TILEGX_IMM16_X1_HW0_TLS_GD 79	/* X1 pipe hword 0 TLS GD offset */
 #define R_TILEGX_IMM16_X0_HW0_TLS_LE 80	/* X0 pipe hword 0 TLS LE offset */
@@ -2976,7 +3899,12 @@ typedef Elf32_Addr Elf32_Conflict;
 /* Relocs 90-91 are currently not defined.  */
 #define R_TILEGX_IMM16_X0_HW0_TLS_IE 92	/* X0 pipe hword 0 TLS IE offset */
 #define R_TILEGX_IMM16_X1_HW0_TLS_IE 93	/* X1 pipe hword 0 TLS IE offset */
-/* Relocs 94-99 are currently not defined.  */
+#define R_TILEGX_IMM16_X0_HW0_LAST_PLT_PCREL 94 /* X0 pipe PC-rel PLT last hword 0 */
+#define R_TILEGX_IMM16_X1_HW0_LAST_PLT_PCREL 95 /* X1 pipe PC-rel PLT last hword 0 */
+#define R_TILEGX_IMM16_X0_HW1_LAST_PLT_PCREL 96 /* X0 pipe PC-rel PLT last hword 1 */
+#define R_TILEGX_IMM16_X1_HW1_LAST_PLT_PCREL 97 /* X1 pipe PC-rel PLT last hword 1 */
+#define R_TILEGX_IMM16_X0_HW2_LAST_PLT_PCREL 98 /* X0 pipe PC-rel PLT last hword 2 */
+#define R_TILEGX_IMM16_X1_HW2_LAST_PLT_PCREL 99 /* X1 pipe PC-rel PLT last hword 2 */
 #define R_TILEGX_IMM16_X0_HW0_LAST_TLS_IE 100 /* X0 pipe last hword 0 IE off */
 #define R_TILEGX_IMM16_X1_HW0_LAST_TLS_IE 101 /* X1 pipe last hword 0 IE off */
 #define R_TILEGX_IMM16_X0_HW1_LAST_TLS_IE 102 /* X0 pipe last hword 1 IE off */
@@ -3004,4 +3932,396 @@ typedef Elf32_Addr Elf32_Conflict;
 
 #define R_TILEGX_NUM		130
 
+/* RISC-V ELF Flags */
+#define EF_RISCV_RVC 			0x0001
+#define EF_RISCV_FLOAT_ABI 		0x0006
+#define EF_RISCV_FLOAT_ABI_SOFT 	0x0000
+#define EF_RISCV_FLOAT_ABI_SINGLE 	0x0002
+#define EF_RISCV_FLOAT_ABI_DOUBLE 	0x0004
+#define EF_RISCV_FLOAT_ABI_QUAD 	0x0006
+#define EF_RISCV_RVE			0x0008
+#define EF_RISCV_TSO			0x0010
+
+/* RISC-V relocations.  */
+#define R_RISCV_NONE		 0
+#define R_RISCV_32		 1
+#define R_RISCV_64		 2
+#define R_RISCV_RELATIVE	 3
+#define R_RISCV_COPY		 4
+#define R_RISCV_JUMP_SLOT	 5
+#define R_RISCV_TLS_DTPMOD32	 6
+#define R_RISCV_TLS_DTPMOD64	 7
+#define R_RISCV_TLS_DTPREL32	 8
+#define R_RISCV_TLS_DTPREL64	 9
+#define R_RISCV_TLS_TPREL32	10
+#define R_RISCV_TLS_TPREL64	11
+#define R_RISCV_BRANCH		16
+#define R_RISCV_JAL		17
+#define R_RISCV_CALL		18
+#define R_RISCV_CALL_PLT	19
+#define R_RISCV_GOT_HI20	20
+#define R_RISCV_TLS_GOT_HI20	21
+#define R_RISCV_TLS_GD_HI20	22
+#define R_RISCV_PCREL_HI20	23
+#define R_RISCV_PCREL_LO12_I	24
+#define R_RISCV_PCREL_LO12_S	25
+#define R_RISCV_HI20		26
+#define R_RISCV_LO12_I		27
+#define R_RISCV_LO12_S		28
+#define R_RISCV_TPREL_HI20	29
+#define R_RISCV_TPREL_LO12_I	30
+#define R_RISCV_TPREL_LO12_S	31
+#define R_RISCV_TPREL_ADD	32
+#define R_RISCV_ADD8		33
+#define R_RISCV_ADD16		34
+#define R_RISCV_ADD32		35
+#define R_RISCV_ADD64		36
+#define R_RISCV_SUB8		37
+#define R_RISCV_SUB16		38
+#define R_RISCV_SUB32		39
+#define R_RISCV_SUB64		40
+#define R_RISCV_GNU_VTINHERIT	41
+#define R_RISCV_GNU_VTENTRY	42
+#define R_RISCV_ALIGN		43
+#define R_RISCV_RVC_BRANCH	44
+#define R_RISCV_RVC_JUMP	45
+#define R_RISCV_RVC_LUI		46
+#define R_RISCV_GPREL_I		47
+#define R_RISCV_GPREL_S		48
+#define R_RISCV_TPREL_I		49
+#define R_RISCV_TPREL_S		50
+#define R_RISCV_RELAX		51
+#define R_RISCV_SUB6		52
+#define R_RISCV_SET6		53
+#define R_RISCV_SET8		54
+#define R_RISCV_SET16		55
+#define R_RISCV_SET32		56
+#define R_RISCV_32_PCREL	57
+#define R_RISCV_IRELATIVE	58
+
+#define R_RISCV_NUM		59
+
+/* RISC-V specific values for the st_other field.  */
+#define STO_RISCV_VARIANT_CC	0x80	/* Function uses variant calling
+					   convention */
+
+/* RISC-V specific values for the sh_type field.  */
+#define SHT_RISCV_ATTRIBUTES	(SHT_LOPROC + 3)
+
+/* RISC-V specific values for the p_type field.  */
+#define PT_RISCV_ATTRIBUTES	(PT_LOPROC + 3)
+
+/* RISC-V specific values for the d_tag field.  */
+#define DT_RISCV_VARIANT_CC	(DT_LOPROC + 1)
+
+/* BPF specific declarations.  */
+
+#define R_BPF_NONE		0	/* No reloc */
+#define R_BPF_64_64		1
+#define R_BPF_64_32		10
+
+/* Imagination Meta specific relocations. */
+
+#define R_METAG_HIADDR16	0
+#define R_METAG_LOADDR16	1
+#define R_METAG_ADDR32		2	/* 32bit absolute address */
+#define R_METAG_NONE		3	/* No reloc */
+#define R_METAG_RELBRANCH	4
+#define R_METAG_GETSETOFF	5
+
+/* Backward compatibility */
+#define R_METAG_REG32OP1	6
+#define R_METAG_REG32OP2	7
+#define R_METAG_REG32OP3	8
+#define R_METAG_REG16OP1	9
+#define R_METAG_REG16OP2	10
+#define R_METAG_REG16OP3	11
+#define R_METAG_REG32OP4	12
+
+#define R_METAG_HIOG		13
+#define R_METAG_LOOG		14
+
+#define R_METAG_REL8		15
+#define R_METAG_REL16		16
+
+/* GNU */
+#define R_METAG_GNU_VTINHERIT	30
+#define R_METAG_GNU_VTENTRY	31
+
+/* PIC relocations */
+#define R_METAG_HI16_GOTOFF	32
+#define R_METAG_LO16_GOTOFF	33
+#define R_METAG_GETSET_GOTOFF	34
+#define R_METAG_GETSET_GOT	35
+#define R_METAG_HI16_GOTPC	36
+#define R_METAG_LO16_GOTPC	37
+#define R_METAG_HI16_PLT	38
+#define R_METAG_LO16_PLT	39
+#define R_METAG_RELBRANCH_PLT	40
+#define R_METAG_GOTOFF		41
+#define R_METAG_PLT		42
+#define R_METAG_COPY		43
+#define R_METAG_JMP_SLOT	44
+#define R_METAG_RELATIVE	45
+#define R_METAG_GLOB_DAT	46
+
+/* TLS relocations */
+#define R_METAG_TLS_GD		47
+#define R_METAG_TLS_LDM		48
+#define R_METAG_TLS_LDO_HI16	49
+#define R_METAG_TLS_LDO_LO16	50
+#define R_METAG_TLS_LDO		51
+#define R_METAG_TLS_IE		52
+#define R_METAG_TLS_IENONPIC	53
+#define R_METAG_TLS_IENONPIC_HI16 54
+#define R_METAG_TLS_IENONPIC_LO16 55
+#define R_METAG_TLS_TPOFF	56
+#define R_METAG_TLS_DTPMOD	57
+#define R_METAG_TLS_DTPOFF	58
+#define R_METAG_TLS_LE		59
+#define R_METAG_TLS_LE_HI16	60
+#define R_METAG_TLS_LE_LO16	61
+
+/* NDS32 relocations.  */
+#define R_NDS32_NONE		0
+#define R_NDS32_32_RELA 	20
+#define R_NDS32_COPY		39
+#define R_NDS32_GLOB_DAT	40
+#define R_NDS32_JMP_SLOT	41
+#define R_NDS32_RELATIVE	42
+#define R_NDS32_TLS_TPOFF	102
+#define R_NDS32_TLS_DESC	119
+
+/* LoongArch ELF Flags */
+#define EF_LARCH_ABI_MODIFIER_MASK  0x07
+#define EF_LARCH_ABI_SOFT_FLOAT     0x01
+#define EF_LARCH_ABI_SINGLE_FLOAT   0x02
+#define EF_LARCH_ABI_DOUBLE_FLOAT   0x03
+#define EF_LARCH_OBJABI_V1          0x40
+
+/* LoongArch specific dynamic relocations */
+#define R_LARCH_NONE		0
+#define R_LARCH_32		1
+#define R_LARCH_64		2
+#define R_LARCH_RELATIVE	3
+#define R_LARCH_COPY		4
+#define R_LARCH_JUMP_SLOT	5
+#define R_LARCH_TLS_DTPMOD32	6
+#define R_LARCH_TLS_DTPMOD64	7
+#define R_LARCH_TLS_DTPREL32	8
+#define R_LARCH_TLS_DTPREL64	9
+#define R_LARCH_TLS_TPREL32	10
+#define R_LARCH_TLS_TPREL64	11
+#define R_LARCH_IRELATIVE	12
+
+/* Reserved for future relocs that the dynamic linker must understand.  */
+
+/* used by the static linker for relocating .text.  */
+#define R_LARCH_MARK_LA  20
+#define R_LARCH_MARK_PCREL  21
+#define R_LARCH_SOP_PUSH_PCREL  22
+#define R_LARCH_SOP_PUSH_ABSOLUTE  23
+#define R_LARCH_SOP_PUSH_DUP  24
+#define R_LARCH_SOP_PUSH_GPREL  25
+#define R_LARCH_SOP_PUSH_TLS_TPREL  26
+#define R_LARCH_SOP_PUSH_TLS_GOT  27
+#define R_LARCH_SOP_PUSH_TLS_GD  28
+#define R_LARCH_SOP_PUSH_PLT_PCREL  29
+#define R_LARCH_SOP_ASSERT  30
+#define R_LARCH_SOP_NOT  31
+#define R_LARCH_SOP_SUB  32
+#define R_LARCH_SOP_SL  33
+#define R_LARCH_SOP_SR  34
+#define R_LARCH_SOP_ADD  35
+#define R_LARCH_SOP_AND  36
+#define R_LARCH_SOP_IF_ELSE  37
+#define R_LARCH_SOP_POP_32_S_10_5  38
+#define R_LARCH_SOP_POP_32_U_10_12  39
+#define R_LARCH_SOP_POP_32_S_10_12  40
+#define R_LARCH_SOP_POP_32_S_10_16  41
+#define R_LARCH_SOP_POP_32_S_10_16_S2  42
+#define R_LARCH_SOP_POP_32_S_5_20  43
+#define R_LARCH_SOP_POP_32_S_0_5_10_16_S2  44
+#define R_LARCH_SOP_POP_32_S_0_10_10_16_S2  45
+#define R_LARCH_SOP_POP_32_U  46
+
+/* used by the static linker for relocating non .text.  */
+#define R_LARCH_ADD8  47
+#define R_LARCH_ADD16  48
+#define R_LARCH_ADD24  49
+#define R_LARCH_ADD32  50
+#define R_LARCH_ADD64  51
+#define R_LARCH_SUB8  52
+#define R_LARCH_SUB16  53
+#define R_LARCH_SUB24  54
+#define R_LARCH_SUB32  55
+#define R_LARCH_SUB64  56
+#define R_LARCH_GNU_VTINHERIT  57
+#define R_LARCH_GNU_VTENTRY  58
+
+/* reserved 59-63 */
+
+#define R_LARCH_B16 64
+#define R_LARCH_B21 65
+#define R_LARCH_B26 66
+#define R_LARCH_ABS_HI20 67
+#define R_LARCH_ABS_LO12 68
+#define R_LARCH_ABS64_LO20 69
+#define R_LARCH_ABS64_HI12 70
+#define R_LARCH_PCALA_HI20 71
+#define R_LARCH_PCALA_LO12 72
+#define R_LARCH_PCALA64_LO20 73
+#define R_LARCH_PCALA64_HI12 74
+#define R_LARCH_GOT_PC_HI20 75
+#define R_LARCH_GOT_PC_LO12 76
+#define R_LARCH_GOT64_PC_LO20 77
+#define R_LARCH_GOT64_PC_HI12 78
+#define R_LARCH_GOT_HI20 79
+#define R_LARCH_GOT_LO12 80
+#define R_LARCH_GOT64_LO20 81
+#define R_LARCH_GOT64_HI12 82
+#define R_LARCH_TLS_LE_HI20 83
+#define R_LARCH_TLS_LE_LO12 84
+#define R_LARCH_TLS_LE64_LO20 85
+#define R_LARCH_TLS_LE64_HI12 86
+#define R_LARCH_TLS_IE_PC_HI20 87
+#define R_LARCH_TLS_IE_PC_LO12 88
+#define R_LARCH_TLS_IE64_PC_LO20 89
+#define R_LARCH_TLS_IE64_PC_HI12 90
+#define R_LARCH_TLS_IE_HI20 91
+#define R_LARCH_TLS_IE_LO12 92
+#define R_LARCH_TLS_IE64_LO20 93
+#define R_LARCH_TLS_IE64_HI12 94
+#define R_LARCH_TLS_LD_PC_HI20 95
+#define R_LARCH_TLS_LD_HI20 96
+#define R_LARCH_TLS_GD_PC_HI20 97
+#define R_LARCH_TLS_GD_HI20 98
+#define R_LARCH_32_PCREL 99
+#define R_LARCH_RELAX 100
+
+/* ARC specific declarations.  */
+
+/* Processor specific flags for the Ehdr e_flags field.  */
+#define EF_ARC_MACH_MSK	    0x000000ff
+#define EF_ARC_OSABI_MSK    0x00000f00
+#define EF_ARC_ALL_MSK	    (EF_ARC_MACH_MSK | EF_ARC_OSABI_MSK)
+
+/* Processor specific values for the Shdr sh_type field.  */
+#define SHT_ARC_ATTRIBUTES	(SHT_LOPROC + 1) /* ARC attributes section.  */
+
+/* ARCompact/ARCv2 specific relocs.  */
+#define R_ARC_NONE		0x0
+#define R_ARC_8			0x1
+#define R_ARC_16		0x2
+#define R_ARC_24		0x3
+#define R_ARC_32		0x4
+
+#define R_ARC_B22_PCREL		0x6
+#define R_ARC_H30		0x7
+#define R_ARC_N8		0x8
+#define R_ARC_N16		0x9
+#define R_ARC_N24		0xA
+#define R_ARC_N32		0xB
+#define R_ARC_SDA		0xC
+#define R_ARC_SECTOFF		0xD
+#define R_ARC_S21H_PCREL	0xE
+#define R_ARC_S21W_PCREL	0xF
+#define R_ARC_S25H_PCREL	0x10
+#define R_ARC_S25W_PCREL	0x11
+#define R_ARC_SDA32		0x12
+#define R_ARC_SDA_LDST		0x13
+#define R_ARC_SDA_LDST1		0x14
+#define R_ARC_SDA_LDST2		0x15
+#define R_ARC_SDA16_LD		0x16
+#define R_ARC_SDA16_LD1		0x17
+#define R_ARC_SDA16_LD2		0x18
+#define R_ARC_S13_PCREL		0x19
+#define R_ARC_W			0x1A
+#define R_ARC_32_ME		0x1B
+#define R_ARC_N32_ME		0x1C
+#define R_ARC_SECTOFF_ME	0x1D
+#define R_ARC_SDA32_ME		0x1E
+#define R_ARC_W_ME		0x1F
+#define R_ARC_H30_ME		0x20
+#define R_ARC_SECTOFF_U8	0x21
+#define R_ARC_SECTOFF_S9	0x22
+#define R_AC_SECTOFF_U8		0x23
+#define R_AC_SECTOFF_U8_1	0x24
+#define R_AC_SECTOFF_U8_2	0x25
+#define R_AC_SECTOFF_S9		0x26
+#define R_AC_SECTOFF_S9_1	0x27
+#define R_AC_SECTOFF_S9_2	0x28
+#define R_ARC_SECTOFF_ME_1	0x29
+#define R_ARC_SECTOFF_ME_2	0x2A
+#define R_ARC_SECTOFF_1		0x2B
+#define R_ARC_SECTOFF_2		0x2C
+#define R_ARC_SDA_12		0x2D
+#define R_ARC_SDA16_ST2		0x30
+#define R_ARC_32_PCREL		0x31
+#define R_ARC_PC32		0x32
+#define R_ARC_GOTPC32		0x33
+#define R_ARC_PLT32		0x34
+#define R_ARC_COPY		0x35
+#define R_ARC_GLOB_DAT		0x36
+#define R_ARC_JMP_SLOT		0x37
+#define R_ARC_RELATIVE		0x38
+#define R_ARC_GOTOFF		0x39
+#define R_ARC_GOTPC		0x3A
+#define R_ARC_GOT32		0x3B
+#define R_ARC_S21W_PCREL_PLT	0x3C
+#define R_ARC_S25H_PCREL_PLT	0x3D
+
+#define R_ARC_JLI_SECTOFF	0x3F
+
+#define R_ARC_TLS_DTPMOD	0x42
+#define R_ARC_TLS_DTPOFF	0x43
+#define R_ARC_TLS_TPOFF		0x44
+#define R_ARC_TLS_GD_GOT	0x45
+#define R_ARC_TLS_GD_LD	        0x46
+#define R_ARC_TLS_GD_CALL	0x47
+#define R_ARC_TLS_IE_GOT	0x48
+#define R_ARC_TLS_DTPOFF_S9	0x49
+#define R_ARC_TLS_LE_S9		0x4A
+#define R_ARC_TLS_LE_32		0x4B
+#define R_ARC_S25W_PCREL_PLT	0x4C
+#define R_ARC_S21H_PCREL_PLT	0x4D
+#define R_ARC_NPS_CMEM16	0x4E
+
+/* OpenRISC 1000 specific relocs.  */
+#define R_OR1K_NONE		0
+#define R_OR1K_32		1
+#define R_OR1K_16		2
+#define R_OR1K_8		3
+#define R_OR1K_LO_16_IN_INSN	4
+#define R_OR1K_HI_16_IN_INSN	5
+#define R_OR1K_INSN_REL_26	6
+#define R_OR1K_GNU_VTENTRY	7
+#define R_OR1K_GNU_VTINHERIT	8
+#define R_OR1K_32_PCREL		9
+#define R_OR1K_16_PCREL		10
+#define R_OR1K_8_PCREL		11
+#define R_OR1K_GOTPC_HI16	12
+#define R_OR1K_GOTPC_LO16	13
+#define R_OR1K_GOT16		14
+#define R_OR1K_PLT26		15
+#define R_OR1K_GOTOFF_HI16	16
+#define R_OR1K_GOTOFF_LO16	17
+#define R_OR1K_COPY		18
+#define R_OR1K_GLOB_DAT		19
+#define R_OR1K_JMP_SLOT		20
+#define R_OR1K_RELATIVE		21
+#define R_OR1K_TLS_GD_HI16	22
+#define R_OR1K_TLS_GD_LO16	23
+#define R_OR1K_TLS_LDM_HI16	24
+#define R_OR1K_TLS_LDM_LO16	25
+#define R_OR1K_TLS_LDO_HI16	26
+#define R_OR1K_TLS_LDO_LO16	27
+#define R_OR1K_TLS_IE_HI16	28
+#define R_OR1K_TLS_IE_LO16	29
+#define R_OR1K_TLS_LE_HI16	30
+#define R_OR1K_TLS_LE_LO16	31
+#define R_OR1K_TLS_TPOFF	32
+#define R_OR1K_TLS_DTPOFF	33
+#define R_OR1K_TLS_DTPMOD	34
+
 #endif	/* elf.h */
diff --git a/tools/isl/Makefile b/tools/isl/Makefile
index e9674debc2e0e0..4ad23a63183183 100644
--- a/tools/isl/Makefile
+++ b/tools/isl/Makefile
@@ -7,11 +7,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=isl
-PKG_VERSION:=0.25
+PKG_VERSION:=0.26
 
 PKG_SOURCE_URL:=https://libisl.sourceforge.io/
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
-PKG_HASH:=be7b210647ccadf90a2f0b000fca11a4d40546374a850db67adb32fad4b230d9
+PKG_HASH:=a0b5cb06d24f9fa9e77b55fabbe9a3c94a336190345c2555f9915bb38e976504
 
 HOST_BUILD_PARALLEL:=1
 
@@ -24,4 +24,8 @@ HOST_CONFIGURE_ARGS += \
 	--disable-shared \
 	--with-gmp-prefix=$(STAGING_DIR_HOST)
 
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
+endef
+
 $(eval $(call HostBuild))
diff --git a/tools/libdeflate/Makefile b/tools/libdeflate/Makefile
new file mode 100644
index 00000000000000..e0f348196dc37f
--- /dev/null
+++ b/tools/libdeflate/Makefile
@@ -0,0 +1,38 @@
+#
+# Copyright (C) 2022 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=libdeflate
+PKG_VERSION:=1.18
+PKG_RELEASE:=1
+
+PKG_SOURCE_URL:=https://github.com/ebiggers/libdeflate.git
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_VERSION:=v$(PKG_VERSION)
+PKG_MIRROR_HASH:=015cbd33b1382b812f7c035640709186bc5d3d6a0ab177bffa7948f26f64edf9
+
+include $(INCLUDE_DIR)/host-build.mk
+
+define Host/Compile
+	$(HOSTCC_NOCACHE) $(HOST_CFLAGS) $(HOST_LDFLAGS) \
+	$(HOST_BUILD_DIR)/lib/*{,/*}.c \
+	$(HOST_BUILD_DIR)/programs/{gzip,prog_util,tgetopt}.c \
+	-o $(HOST_BUILD_DIR)/libdeflate-gzip
+endef
+
+define Host/Install
+	$(INSTALL_BIN) $(HOST_BUILD_DIR)/libdeflate-gzip $(STAGING_DIR_HOST)/bin/
+	$(LN) libdeflate-gzip $(STAGING_DIR_HOST)/bin/libdeflate-gunzip
+endef
+
+define Host/Uninstall
+	$(RM) $(STAGING_DIR_HOST)/bin/libdeflate-gzip
+	$(RM) $(STAGING_DIR_HOST)/bin/libdeflate-gunzip
+	$(call Host/Uninstall/Default)
+endef
+
+$(eval $(call HostBuild))
diff --git a/tools/liblzo/Makefile b/tools/liblzo/Makefile
new file mode 100644
index 00000000000000..4ebda0c3336508
--- /dev/null
+++ b/tools/liblzo/Makefile
@@ -0,0 +1,42 @@
+#
+# Copyright (C) 2022 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=lzo
+PKG_VERSION:=2.10
+PKG_RELEASE:=4
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=http://www.oberhumer.com/opensource/lzo/download/
+PKG_HASH:=c0f892943208266f9b6543b3ae308fab6284c5c90e627931446fb49b4221a072
+
+PKG_LICENSE:=GPL-2.0-or-later
+PKG_LICENSE_FILES:=COPYING
+
+CMAKE_BINARY_SUBDIR:=openwrt-build
+
+include $(INCLUDE_DIR)/host-build.mk
+include $(INCLUDE_DIR)/cmake.mk
+
+CMAKE_HOST_OPTIONS += \
+	-DENABLE_SHARED=ON \
+	-DENABLE_TESTS=OFF \
+	-DENABLE_EXAMPLES=OFF \
+	-DENABLE_DOCS=ON \
+	-DBUILD_TESTING=OFF
+
+define Host/Uninstall
+	rm -rf $(HOST_BUILD_PREFIX)/include/lzo
+	rm -f  $(HOST_BUILD_PREFIX)/lib/liblzo2.a
+	rm -f  $(HOST_BUILD_PREFIX)/lib/liblzo2.so.2.0.0
+	rm -f  $(HOST_BUILD_PREFIX)/lib/liblzo2.so.2
+	rm -f  $(HOST_BUILD_PREFIX)/lib/liblzo2.so
+	rm -f  $(HOST_BUILD_PREFIX)/lib/pkgconfig/lzo2.pc
+endef
+
+$(eval $(call HostBuild))
diff --git a/tools/liblzo/patches/001-add-cmake-ENABLE-configurables.patch b/tools/liblzo/patches/001-add-cmake-ENABLE-configurables.patch
new file mode 100644
index 00000000000000..9ab27fc924acdb
--- /dev/null
+++ b/tools/liblzo/patches/001-add-cmake-ENABLE-configurables.patch
@@ -0,0 +1,68 @@
+--- a/CMakeLists.txt	2022-11-28 06:34:39.171209779 -0800
++++ b/CMakeLists.txt	2022-11-28 06:33:13.368239757 -0800
+@@ -51,8 +51,11 @@
+ project(lzo VERSION 2.10 LANGUAGES C)
+ 
+ # configuration options
+-option(ENABLE_STATIC "Build static LZO library." ON)
+-option(ENABLE_SHARED "Build shared LZO library." OFF)
++option(ENABLE_STATIC   "Build static LZO library." ON)
++option(ENABLE_SHARED   "Build shared LZO library." OFF)
++option(ENABLE_TESTS    "Build tests."              ON)
++option(ENABLE_EXAMPLES "Build examples."           ON)
++option(ENABLE_DOCS     "Install documentation."    ON)
+ if(NOT ENABLE_STATIC AND NOT ENABLE_SHARED)
+     set(ENABLE_STATIC ON)
+ endif()
+@@ -127,14 +130,20 @@
+     endif()
+ endmacro()
+ # main test driver
++if(ENABLE_TESTS OR ENABLE_EXAMPLES)
+ lzo_add_executable(lzotest  lzotest/lzotest.c)
++endif()
+ # examples
++if(ENABLE_EXAMPLES)
+ lzo_add_executable(dict     examples/dict.c)
+ lzo_add_executable(lzopack  examples/lzopack.c)
+ lzo_add_executable(overlap  examples/overlap.c)
+ lzo_add_executable(precomp  examples/precomp.c)
+ lzo_add_executable(precomp2 examples/precomp2.c)
++endif()
++if(ENABLE_TESTS OR ENABLE_EXAMPLES)
+ lzo_add_executable(simple   examples/simple.c)
++endif()
+ # some boring internal test programs
+ if(0)
+     lzo_add_executable(align    tests/align.c)
+@@ -144,7 +153,7 @@
+ endif()
+ 
+ # miniLZO
+-if(1)
++if(ENABLE_TESTS)
+     add_executable(testmini minilzo/testmini.c minilzo/minilzo.c)
+     target_include_directories(testmini PRIVATE "${CMAKE_CURRENT_SOURCE_DIR}/include/lzo") # needed for "lzoconf.h"
+ endif()
+@@ -263,8 +272,10 @@
+ 
+ if(DEFINED CMAKE_INSTALL_FULL_LIBDIR)
+ 
+-set(f AUTHORS COPYING NEWS THANKS doc/LZO.FAQ doc/LZO.TXT doc/LZOAPI.TXT)
+-install(FILES ${f} DESTINATION "${CMAKE_INSTALL_FULL_DOCDIR}")
++if(ENABLE_DOCS)
++    set(f AUTHORS COPYING NEWS THANKS doc/LZO.FAQ doc/LZO.TXT doc/LZOAPI.TXT)
++    install(FILES ${f} DESTINATION "${CMAKE_INSTALL_FULL_DOCDIR}")
++endif()
+ 
+ set(f include/lzo/lzo1.h include/lzo/lzo1a.h include/lzo/lzo1b.h
+     include/lzo/lzo1c.h include/lzo/lzo1f.h include/lzo/lzo1x.h
+@@ -285,7 +296,7 @@
+     )
+ endif()
+ 
+-if(1)
++if(ENABLE_EXAMPLES)
+     set(f lzopack lzotest simple testmini) # examples
+     install(TARGETS ${f} DESTINATION "${CMAKE_INSTALL_FULL_LIBEXECDIR}/lzo/examples")
+ endif()
diff --git a/tools/libressl/Makefile b/tools/libressl/Makefile
index bf2bd4e999f57d..9a0fb6bee4d2de 100644
--- a/tools/libressl/Makefile
+++ b/tools/libressl/Makefile
@@ -8,14 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libressl
-PKG_VERSION:=3.5.3
-PKG_HASH:=3ab5e5eaef69ce20c6b170ee64d785b42235f48f2e62b095fca5d7b6672b8b28
-PKG_RELEASE:=1
+PKG_VERSION:=3.7.2
+PKG_HASH:=b06aa538fefc9c6b33c4db4931a09a5f52d9d2357219afcbff7d93fe12ebf6f7
 
 PKG_CPE_ID:=cpe:/a:openbsd:libressl
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=http://mirror.ox.ac.uk/pub/OpenBSD/LibreSSL \
+PKG_SOURCE_URL:=https://mirror.ox.ac.uk/pub/OpenBSD/LibreSSL \
 	http://ftp.jaist.ac.jp/pub/OpenBSD/LibreSSL \
 	https://ftp.openbsd.org/pub/OpenBSD/LibreSSL
 
@@ -34,4 +33,8 @@ HOST_CONFIGURE_ARGS += \
 	--with-pic \
 	--disable-tests
 
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
+endef
+
 $(eval $(call HostBuild))
diff --git a/tools/libtool/Makefile b/tools/libtool/Makefile
index 2bc9db7d0dabff..118719147821b9 100644
--- a/tools/libtool/Makefile
+++ b/tools/libtool/Makefile
@@ -8,35 +8,52 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libtool
 PKG_CPE_ID:=cpe:/a:gnu:libtool
-PKG_VERSION:=2.4.2
+PKG_VERSION:=2.4.7
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@GNU/$(PKG_NAME)
-PKG_HASH:=1d7b6862c1ed162e327f083a6f78f40eae29218f0db8c38393d61dab764c4407
+PKG_HASH:=4f7f217f057ce655ff22559ad221a0fd8ef84ad1fc5fcb6990cecc333aa1635d
 
 HOST_BUILD_PARALLEL:=1
 
 include $(INCLUDE_DIR)/host-build.mk
 
+export GNULIB_SRCDIR:=$(HOST_GNULIB_SRCDIR)
+
 HOST_CONFIGURE_VARS += \
 	lt_cv_sys_dlsearch_path=""
 
+define Host/Bootstrap
+	( \
+		cd $(HOST_BUILD_DIR); \
+		$(AM_TOOL_PATHS) \
+		./bootstrap \
+			--force \
+			--skip-git \
+			--skip-po \
+			--gnulib-srcdir=$(GNULIB_SRCDIR) \
+	)
+endef
+
 define Host/Prepare
 	$(call Host/Prepare/Default)
-	(cd $(STAGING_DIR_HOST)/share/aclocal/ && rm -f libtool.m4 ltdl.m4 lt~obsolete.m4 ltoptions.m4 ltsugar.m4 ltversion.m4)
-	(cd $(HOST_BUILD_DIR); $(AM_TOOL_PATHS) ./bootstrap)
+	$(call Host/Uninstall)
+	$(if $(QUILT),,$(call Host/Bootstrap))
+endef
+
+define Host/Configure
+	$(if $(QUILT),$(call Host/Bootstrap))
+	$(call Host/Configure/Default)
 endef
 
 define Host/Install
-	$(MAKE) -C $(HOST_BUILD_DIR) install
+	$(call Host/Compile/Default,install)
 	$(SED) 's,\(hardcode_into_libs\)=yes,\1=no,g' $(STAGING_DIR_HOST)/bin/libtool
-	$(CP) $(STAGING_DIR_HOST)/bin/libtool $(STAGING_DIR_HOST)/bin/libtool-ucxx
-	$(SED) 's,-lstdc++,-luClibc++,g' $(STAGING_DIR_HOST)/bin/libtool-ucxx
 endef
 
-define Host/Clean
-	-$(MAKE) -C $(HOST_BUILD_DIR) uninstall
-	$(call Host/Clean/Default)
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
+	(cd $(STAGING_DIR_HOST)/share/aclocal/ && rm -f libtool.m4 ltdl.m4 lt~obsolete.m4 ltoptions.m4 ltsugar.m4 ltversion.m4)
 endef
 
 $(eval $(call HostBuild))
diff --git a/tools/libtool/patches/000-relocatable.patch b/tools/libtool/patches/000-relocatable.patch
index 6d1651be317a28..9c3bcb69ffd82e 100644
--- a/tools/libtool/patches/000-relocatable.patch
+++ b/tools/libtool/patches/000-relocatable.patch
@@ -1,141 +1,104 @@
---- a/libltdl/config/general.m4sh
-+++ b/libltdl/config/general.m4sh
-@@ -45,15 +45,22 @@ progpath="$0"
- M4SH_VERBATIM([[
- : ${CP="cp -f"}
- test "${ECHO+set}" = set || ECHO=${as_echo-'printf %s\n'}
--: ${EGREP="@EGREP@"}
--: ${FGREP="@FGREP@"}
--: ${GREP="@GREP@"}
- : ${LN_S="@LN_S@"}
- : ${MAKE="make"}
- : ${MKDIR="mkdir"}
- : ${MV="mv -f"}
- : ${RM="rm -f"}
--: ${SED="@SED@"}
-+if test -n "$STAGING_DIR"; then
-+	: ${EGREP="$STAGING_DIR/../host/bin/grep -E"}
-+	: ${FGREP="$STAGING_DIR/../host/bin/grep -F"}
-+	: ${GREP="$STAGING_DIR/../host/bin/grep"}
-+	: ${SED="$STAGING_DIR/../host/bin/sed"}
-+else
-+	: ${EGREP="@EGREP@"}
-+	: ${FGREP="@FGREP@"}
-+	: ${GREP="@GREP@"}
-+	: ${SED="@SED@"}
-+fi
- : ${SHELL="${CONFIG_SHELL-/bin/sh}"}
- : ${Xsed="$SED -e 1s/^X//"}
- 
+From ca10caa502f971f90d8c041aa2476de54ef0ce2b Mon Sep 17 00:00:00 2001
+From: Eneas U de Queiroz <cotequeiroz@gmail.com>
+Date: Tue, 20 Jul 2021 16:41:11 -0300
+Subject: openwrt: make relocatable, search resources relative to STAGING_DIR
+
+This was originally commited to openwrt by Jo-Philipp Wich
+<jow@openwrt.org>.
+
+Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
+
 --- a/libtoolize.in
 +++ b/libtoolize.in
-@@ -334,15 +334,22 @@ as_unset=as_fn_unset
+@@ -38,14 +38,23 @@
+ # with bootstrap, so set those here where they can still be over-
+ # ridden by the user, but otherwise take precedence.
  
- : ${CP="cp -f"}
- test "${ECHO+set}" = set || ECHO=${as_echo-'printf %s\n'}
+-: ${AUTOCONF="autoconf"}
+-: ${AUTOMAKE="automake"}
 -: ${EGREP="@EGREP@"}
 -: ${FGREP="@FGREP@"}
 -: ${GREP="@GREP@"}
  : ${LN_S="@LN_S@"}
- : ${MAKE="make"}
- : ${MKDIR="mkdir"}
- : ${MV="mv -f"}
- : ${RM="rm -f"}
 -: ${SED="@SED@"}
-+if test -n "$STAGING_DIR"; then
-+	: ${EGREP="$STAGING_DIR/../host/bin/grep -E"}
-+	: ${FGREP="$STAGING_DIR/../host/bin/grep -F"}
-+	: ${GREP="$STAGING_DIR/../host/bin/grep"}
-+	: ${SED="$STAGING_DIR/../host/bin/sed"}
+ 
++if test -n "$STAGING_DIR_HOST"; then
++	: ${AUTOCONF="$STAGING_DIR_HOST/bin/autoconf"}
++	: ${AUTOMAKE="$STAGING_DIR_HOST/bin/automake"}
++	: ${EGREP="$STAGING_DIR_HOST/bin/grep -E"}
++	: ${FGREP="$STAGING_DIR_HOST/bin/grep -F"}
++	: ${GREP="$STAGING_DIR_HOST/bin/grep"}
++	: ${SED="$STAGING_DIR_HOST/bin/sed"}
 +else
++	: ${AUTOCONF="autoconf"}
++	: ${AUTOMAKE="automake"}
 +	: ${EGREP="@EGREP@"}
 +	: ${FGREP="@FGREP@"}
 +	: ${GREP="@GREP@"}
 +	: ${SED="@SED@"}
 +fi
- : ${SHELL="${CONFIG_SHELL-/bin/sh}"}
- : ${Xsed="$SED -e 1s/^X//"}
  
-@@ -2487,10 +2494,17 @@ func_check_macros ()
+ ## -------------------------- ##
+ ## Source external libraries. ##
+@@ -1903,11 +1912,21 @@ func_require_seen_libtool ()
+   pkgmacro_files="@pkgmacro_files@"
  
    # Locations for important files:
-   prefix=@prefix@
--  datadir=@datadir@
--  pkgdatadir=@pkgdatadir@
--  pkgltdldir=@pkgdatadir@
--  aclocaldir=@aclocaldir@
-+  if test -n "$STAGING_DIR"; then
-+    datadir="$STAGING_DIR/../host/share"
-+    pkgdatadir="$STAGING_DIR/../host/share/libtool"
-+    pkgltdldir="$STAGING_DIR/../host/share/libtool"
-+    aclocaldir="$STAGING_DIR/../host/share/aclocal"
+-  prefix="@prefix@"
+-  datadir="@datadir@"
+-  pkgauxdir="@pkgauxdir@"
+-  pkgltdldir="@pkgdatadir@"
+-  aclocaldir="@aclocaldir@"
++  if test -n "$STAGING_DIR_HOST"; then
++    prefix="$STAGING_DIR_HOST"
++    datadir="$STAGING_DIR_HOST/share"
++    pkgauxdir="$STAGING_DIR_HOST/share/libtool/build-aux"
++    pkgdatadir="$STAGING_DIR_HOST/share/libtool"
++    pkgltdldir="$STAGING_DIR_HOST/share/libtool"
++    aclocaldir="$STAGING_DIR_HOST/share/aclocal"
 +  else
-+    datadir=@datadir@
-+    pkgdatadir=@pkgdatadir@
-+    pkgltdldir=@pkgdatadir@
-+    aclocaldir=@aclocaldir@
++    prefix="@prefix@"
++    datadir="@datadir@"
++    pkgauxdir="@pkgauxdir@"
++    pkgdatadir="@pkgdatadir@"
++    pkgltdldir="@pkgdatadir@"
++    aclocaldir="@aclocaldir@"
 +  fi
-   auxdir=
-   macrodir=
-   configure_ac=configure.in
---- a/libtoolize.m4sh
-+++ b/libtoolize.m4sh
-@@ -1453,10 +1453,17 @@ func_check_macros ()
  
-   # Locations for important files:
-   prefix=@prefix@
--  datadir=@datadir@
--  pkgdatadir=@pkgdatadir@
--  pkgltdldir=@pkgdatadir@
--  aclocaldir=@aclocaldir@
-+  if test -n "$STAGING_DIR"; then
-+    datadir="$STAGING_DIR/../host/share"
-+    pkgdatadir="$STAGING_DIR/../host/share/libtool"
-+    pkgltdldir="$STAGING_DIR/../host/share/libtool"
-+    aclocaldir="$STAGING_DIR/../host/share/aclocal"
-+  else
-+    datadir=@datadir@
-+    pkgdatadir=@pkgdatadir@
-+    pkgltdldir=@pkgdatadir@
-+    aclocaldir=@aclocaldir@
-+  fi
-   auxdir=
-   macrodir=
-   configure_ac=configure.in
---- a/libltdl/m4/libtool.m4
-+++ b/libltdl/m4/libtool.m4
-@@ -907,9 +907,8 @@ dnl AC_DEFUN([AC_LIBTOOL_RC], [])
- # ----------------
- m4_defun([_LT_TAG_COMPILER],
+   # Allow the user to override the master libtoolize repository:
+   if test -n "$_lt_pkgdatadir"; then
+--- a/m4/libtool.m4
++++ b/m4/libtool.m4
+@@ -933,7 +933,7 @@ m4_defun([_LT_TAG_COMPILER],
  [AC_REQUIRE([AC_PROG_CC])dnl
--
+ 
  _LT_DECL([LTCC], [CC], [1], [A C compiler])dnl
 -_LT_DECL([LTCFLAGS], [CFLAGS], [1], [LTCC compiler flags])dnl
-+_LT_DECL([LTCFLAGS], [CFLAGS], ["-O2 -I\${STAGING_DIR:-$STAGING_DIR}/../host/include"], [LTCC compiler flags])dnl
++_LT_DECL([LTCFLAGS], [CFLAGS], ["-O2 -I\${STAGING_DIR_HOST:-$STAGING_DIR_HOST}/include"], [LTCC compiler flags])dnl
  _LT_TAGDECL([CC], [compiler], [1], [A language specific compiler])dnl
  _LT_TAGDECL([with_gcc], [GCC], [0], [Is the compiler the GNU compiler?])dnl
  
-@@ -7660,9 +7659,9 @@ m4_defun([_LT_DECL_EGREP],
+@@ -8183,9 +8183,9 @@ m4_defun([_LT_DECL_EGREP],
  [AC_REQUIRE([AC_PROG_EGREP])dnl
  AC_REQUIRE([AC_PROG_FGREP])dnl
  test -z "$GREP" && GREP=grep
 -_LT_DECL([], [GREP], [1], [A grep program that handles long lines])
 -_LT_DECL([], [EGREP], [1], [An ERE matcher])
 -_LT_DECL([], [FGREP], [1], [A literal string matcher])
-+_LT_DECL([], [GREP], ["\${STAGING_DIR:-$STAGING_DIR}/../host/bin/grep"], [A grep program that handles long lines])
-+_LT_DECL([], [EGREP], ["\${STAGING_DIR:-$STAGING_DIR}/../host/bin/grep -E"], [An ERE matcher])
-+_LT_DECL([], [FGREP], ["\${STAGING_DIR:-$STAGING_DIR}/../host/bin/grep -F"], [A literal string matcher])
++_LT_DECL([], [GREP], ["\${STAGING_DIR_HOST:-$STAGING_DIR_HOST}/bin/grep"], [A grep program that handles long lines])
++_LT_DECL([], [EGREP], ["\${STAGING_DIR_HOST:-$STAGING_DIR_HOST}/bin/grep -E"], [An ERE matcher])
++_LT_DECL([], [FGREP], ["\${STAGING_DIR_HOST:-$STAGING_DIR_HOST}/bin/grep -F"], [A literal string matcher])
  dnl Non-bleeding-edge autoconf doesn't subst GREP, so do it here too
  AC_SUBST([GREP])
  ])
-@@ -7695,9 +7694,8 @@ AC_SUBST([DLLTOOL])
+@@ -8226,9 +8226,8 @@ _LT_DECL([], [FILECMD], [1], [A file(cmd
  # as few characters as possible.  Prefer GNU sed if found.
  m4_defun([_LT_DECL_SED],
  [AC_PROG_SED
 -test -z "$SED" && SED=sed
  Xsed="$SED -e 1s/^X//"
 -_LT_DECL([], [SED], [1], [A sed program that does not truncate output])
-+_LT_DECL([], [SED], ["\${STAGING_DIR:-$STAGING_DIR}/../host/bin/sed"], [A sed program that does not truncate output])
++_LT_DECL([], [SED], ["\${STAGING_DIR_HOST:-$STAGING_DIR_HOST}/bin/sed"], [A sed program that does not truncate output])
  _LT_DECL([], [Xsed], ["\$SED -e 1s/^X//"],
      [Sed that helps us avoid accidentally triggering echo(1) options like -n])
  ])# _LT_DECL_SED
diff --git a/tools/libtool/patches/100-libdir-fixes.patch b/tools/libtool/patches/100-libdir-fixes.patch
index 3df2b14b60b92f..2a563901a5ffa2 100644
--- a/tools/libtool/patches/100-libdir-fixes.patch
+++ b/tools/libtool/patches/100-libdir-fixes.patch
@@ -1,83 +1,55 @@
---- a/libltdl/config/ltmain.m4sh
-+++ b/libltdl/config/ltmain.m4sh
-@@ -5731,8 +5731,14 @@ func_mode_link ()
- 	    absdir="$abs_ladir"
- 	    libdir="$abs_ladir"
+From 67ffe8e8582a7ba1f1d1307a419098e6dd88bdaf Mon Sep 17 00:00:00 2001
+From: Eneas U de Queiroz <cotequeiroz@gmail.com>
+Date: Tue, 20 Jul 2021 16:41:11 -0300
+Subject: openwrt: cross-compilation path adjustments
+
+Comments from the patch:
+
+Adding 'libdir' from the .la file to our library search paths
+breaks crosscompilation horribly.  We cheat here and don't add
+it, instead adding the path where we found the .la.  -CL
+
+OE sets installed=no in staging. We need to look in $objdir and $absdir,
+preferring $objdir. RP 31/04/2008
+
+This was originally commited to openwrt by Jo-Philipp Wich
+<jow@openwrt.org>.
+
+Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
+
+--- a/build-aux/ltmain.in
++++ b/build-aux/ltmain.in
+@@ -6097,8 +6097,14 @@ func_mode_link ()
+ 	    absdir=$abs_ladir
+ 	    libdir=$abs_ladir
  	  else
--	    dir="$lt_sysroot$libdir"
--	    absdir="$lt_sysroot$libdir"
+-	    dir=$lt_sysroot$libdir
+-	    absdir=$lt_sysroot$libdir
 +	    # Adding 'libdir' from the .la file to our library search paths
 +	    # breaks crosscompilation horribly.  We cheat here and don't add
 +	    # it, instead adding the path where we found the .la.  -CL
 +	    dir="$lt_sysroot$abs_ladir"
 +	    absdir="$abs_ladir"
 +	    libdir="$abs_ladir"
-+	    #dir="$libdir"
-+	    #absdir="$lt_sysroot$libdir"
++	    #dir=$lt_sysroot$libdir
++	    #absdir=$lt_sysroot$libdir
  	  fi
- 	  test "X$hardcode_automatic" = Xyes && avoidtemprpath=yes
+ 	  test yes = "$hardcode_automatic" && avoidtemprpath=yes
  	else
-@@ -6130,8 +6136,6 @@ func_mode_link ()
- 		add="$libdir/$linklib"
+@@ -6496,8 +6502,6 @@ func_mode_link ()
+ 		add=$libdir/$linklib
  	      fi
  	    else
 -	      # We cannot seem to hardcode it, guess we'll fake it.
--	      add_dir="-L$libdir"
+-	      add_dir=-L$libdir
  	      # Try looking first in the location we're being installed to.
  	      if test -n "$inst_prefix_dir"; then
  		case $libdir in
-@@ -6286,7 +6290,17 @@ func_mode_link ()
+@@ -6652,7 +6656,17 @@ func_mode_link ()
  		  fi
  		  ;;
  		*)
--		  path="-L$absdir/$objdir"
-+                  # OE sets installed=no in staging. We need to look in $objdir and $absdir, 
-+                  # preferring $objdir. RP 31/04/2008
-+                  if test -f "$absdir/$objdir/$depdepl" ; then
-+		    depdepl="$absdir/$objdir/$depdepl"
-+		    path="-L$absdir/$objdir"
-+                  elif test -f "$absdir/$depdepl" ; then
-+		    depdepl="$absdir/$depdepl"
-+		    path="-L$absdir"
-+                  else
-+		    path="-L$absdir/$objdir"
-+                  fi
- 		  ;;
- 		esac
- 		else
---- a/libltdl/config/ltmain.sh
-+++ b/libltdl/config/ltmain.sh
-@@ -6518,8 +6518,14 @@ func_mode_link ()
- 	    absdir="$abs_ladir"
- 	    libdir="$abs_ladir"
- 	  else
--	    dir="$lt_sysroot$libdir"
--	    absdir="$lt_sysroot$libdir"
-+	    # Adding 'libdir' from the .la file to our library search paths
-+	    # breaks crosscompilation horribly.  We cheat here and don't add
-+	    # it, instead adding the path where we found the .la.  -CL
-+	    dir="$lt_sysroot$abs_ladir"
-+	    absdir="$abs_ladir"
-+	    libdir="$abs_ladir"
-+	    #dir="$libdir"
-+	    #absdir="$lt_sysroot$libdir"
- 	  fi
- 	  test "X$hardcode_automatic" = Xyes && avoidtemprpath=yes
- 	else
-@@ -6917,8 +6923,6 @@ func_mode_link ()
- 		add="$libdir/$linklib"
- 	      fi
- 	    else
--	      # We cannot seem to hardcode it, guess we'll fake it.
--	      add_dir="-L$libdir"
- 	      # Try looking first in the location we're being installed to.
- 	      if test -n "$inst_prefix_dir"; then
- 		case $libdir in
-@@ -7073,7 +7077,17 @@ func_mode_link ()
- 		  fi
- 		  ;;
- 		*)
--		  path="-L$absdir/$objdir"
+-		  path=-L$absdir/$objdir
 +                  # OE sets installed=no in staging. We need to look in $objdir and $absdir, 
 +                  # preferring $objdir. RP 31/04/2008
 +                  if test -f "$absdir/$objdir/$depdepl" ; then
diff --git a/tools/libtool/patches/110-dont-use-target-dir-for-relinking.patch b/tools/libtool/patches/110-dont-use-target-dir-for-relinking.patch
index bbfd12500306d5..2d2189e76680a9 100644
--- a/tools/libtool/patches/110-dont-use-target-dir-for-relinking.patch
+++ b/tools/libtool/patches/110-dont-use-target-dir-for-relinking.patch
@@ -1,20 +1,32 @@
---- a/libltdl/config/ltmain.m4sh
-+++ b/libltdl/config/ltmain.m4sh
-@@ -6120,7 +6120,6 @@ func_mode_link ()
- 	       test "$hardcode_direct_absolute" = no; then
- 	      add="$libdir/$linklib"
- 	    elif test "$hardcode_minus_L" = yes; then
--	      add_dir="-L$libdir"
- 	      add="-l$name"
- 	    elif test "$hardcode_shlibpath_var" = yes; then
- 	      case :$finalize_shlibpath: in
---- a/libltdl/config/ltmain.sh
-+++ b/libltdl/config/ltmain.sh
-@@ -6907,7 +6907,6 @@ func_mode_link ()
- 	       test "$hardcode_direct_absolute" = no; then
- 	      add="$libdir/$linklib"
- 	    elif test "$hardcode_minus_L" = yes; then
--	      add_dir="-L$libdir"
- 	      add="-l$name"
- 	    elif test "$hardcode_shlibpath_var" = yes; then
+From 375833af93999f8b0a747c8a1dfa3ec8d347743d Mon Sep 17 00:00:00 2001
+From: Eneas U de Queiroz <cotequeiroz@gmail.com>
+Date: Tue, 20 Jul 2021 16:52:37 -0300
+Subject: openwrt: don't use target dir for relinking
+
+This was originally commited to openwrt by Jo-Philipp Wich
+<jow@openwrt.org>.
+
+Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
+
+--- a/build-aux/ltmain.in
++++ b/build-aux/ltmain.in
+@@ -6482,13 +6482,13 @@ func_mode_link ()
+ 	    add_dir=
+ 	    add=
+ 	    # Finalize command for both is simple: just hardcode it.
+-	    if test yes = "$hardcode_direct" &&
+-	       test no = "$hardcode_direct_absolute"; then
+-	      add=$libdir/$linklib
+-	    elif test yes = "$hardcode_minus_L"; then
++	    if test "$hardcode_direct" = yes &&
++	       test "$hardcode_direct_absolute" = no; then
++	      add="$libdir/$linklib"
++	    elif test "$hardcode_minus_L" = yes; then
+ 	      add_dir=-L$libdir
+-	      add=-l$name
+-	    elif test yes = "$hardcode_shlibpath_var"; then
++	      add="-l$name"
++	    elif test "$hardcode_shlibpath_var" = yes; then
  	      case :$finalize_shlibpath: in
+ 	      *":$libdir:"*) ;;
+ 	      *) func_append finalize_shlibpath "$libdir:" ;;
diff --git a/tools/libtool/patches/120-strip-unsafe-dirs-for-relinking.patch b/tools/libtool/patches/120-strip-unsafe-dirs-for-relinking.patch
index 8840ee056998c5..132f1c9bd68752 100644
--- a/tools/libtool/patches/120-strip-unsafe-dirs-for-relinking.patch
+++ b/tools/libtool/patches/120-strip-unsafe-dirs-for-relinking.patch
@@ -1,24 +1,25 @@
---- a/libltdl/config/ltmain.m4sh
-+++ b/libltdl/config/ltmain.m4sh
-@@ -2183,6 +2183,9 @@ func_mode_install ()
+From 7f2b8a1ab4fa1475eeeddfb84eb5b92594bfce43 Mon Sep 17 00:00:00 2001
+From: Eneas U de Queiroz <cotequeiroz@gmail.com>
+Date: Tue, 20 Jul 2021 16:54:12 -0300
+Subject: openwrt: strip unsave directories from relink command
+
+strip unsave directories from relink command, nuke every -L that looks
+like /usr/lib or /lib
+
+This was originally commited to openwrt by Jo-Philipp Wich
+<jow@openwrt.org>.
+
+Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
+
+--- a/build-aux/ltmain.in
++++ b/build-aux/ltmain.in
+@@ -2400,6 +2400,9 @@ func_mode_install ()
  	    relink_command=`$ECHO "$relink_command" | $SED "s%@inst_prefix_dir@%%"`
  	  fi
  
 +	  relink_command=`$ECHO "$relink_command" | $SED "s%-L[[:space:]]*/lib[^[:space:]]*%%"`
 +	  relink_command=`$ECHO "$relink_command" | $SED "s%-L[[:space:]]*/usr/lib[^[:space:]]*%%"`
 +
- 	  func_warning "relinking \`$file'"
+ 	  func_warning "relinking '$file'"
  	  func_show_eval "$relink_command" \
- 	    'func_fatal_error "error: relink \`$file'\'' with the above command before installing it"'
---- a/libltdl/config/ltmain.sh
-+++ b/libltdl/config/ltmain.sh
-@@ -2973,6 +2973,9 @@ func_mode_install ()
- 	    relink_command=`$ECHO "$relink_command" | $SED "s%@inst_prefix_dir@%%"`
- 	  fi
- 
-+	  relink_command=`$ECHO "$relink_command" | $SED "s%-L[[:space:]]*/lib[^[:space:]]*%%"`
-+	  relink_command=`$ECHO "$relink_command" | $SED "s%-L[[:space:]]*/usr/lib[^[:space:]]*%%"`
-+
- 	  func_warning "relinking \`$file'"
- 	  func_show_eval "$relink_command" \
- 	    'func_fatal_error "error: relink \`$file'\'' with the above command before installing it"'
+ 	    'func_fatal_error "error: relink '\''$file'\'' with the above command before installing it"'
diff --git a/tools/libtool/patches/130-trailingslash.patch b/tools/libtool/patches/130-trailingslash.patch
new file mode 100644
index 00000000000000..78fdf0a4100a7f
--- /dev/null
+++ b/tools/libtool/patches/130-trailingslash.patch
@@ -0,0 +1,37 @@
+From 1b45c3c0d6682be7f4876b620780ee246a5acbaa Mon Sep 17 00:00:00 2001
+From: Eneas U de Queiroz <cotequeiroz@gmail.com>
+Date: Tue, 20 Jul 2021 16:56:16 -0300
+Subject: openwrt: remove trailing slash in install destdir
+
+A command like /bin/sh ../../i586-poky-linux-libtool   --mode=install /usr/bin/install -c   gck-roots-store-standalone.la '/media/data1/builds/poky1/tmp/work/core2-poky-linux/gnome-keyring-2.26.1-r1/image/usr/lib/gnome-keyring/standalone/' fails (e.g. gnome-keyring or pulseaudio)
+
+This is because libdir has a trailing slash which breaks the comparision.
+
+RP 2/1/10
+
+Merged a patch received from Gary Thomas <gary@mlbassoc.com>
+
+Date: 2010/07/12
+Nitin A Kamble <nitin.a.kamble@intel.com>
+
+Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
+
+--- a/build-aux/ltmain.in
++++ b/build-aux/ltmain.in
+@@ -2381,8 +2381,15 @@ func_mode_install ()
+ 	func_append dir "$objdir"
+ 
+ 	if test -n "$relink_command"; then
++      # Strip any trailing slash from the destination.
++      func_stripname '' '/' "$libdir"
++      destlibdir=$func_stripname_result
++
++      func_stripname '' '/' "$destdir"
++      s_destdir=$func_stripname_result
++
+ 	  # Determine the prefix the user has applied to our future dir.
+-	  inst_prefix_dir=`$ECHO "$destdir" | $SED -e "s%$libdir\$%%"`
++	  inst_prefix_dir=`$ECHO "X$s_destdir" | $Xsed -e "s%$destlibdir\$%%"`
+ 
+ 	  # Don't allow the user to place us outside of our expected
+ 	  # location b/c this prevents finding dependent libraries that
diff --git a/tools/libtool/patches/140-don-t-quote-SHELL-in-Makefile.am.patch b/tools/libtool/patches/140-don-t-quote-SHELL-in-Makefile.am.patch
new file mode 100644
index 00000000000000..3422961385afba
--- /dev/null
+++ b/tools/libtool/patches/140-don-t-quote-SHELL-in-Makefile.am.patch
@@ -0,0 +1,72 @@
+From 879578d3f4dc9bc42aa433b1fb6b584564f83617 Mon Sep 17 00:00:00 2001
+From: Eneas U de Queiroz <cotequeiroz@gmail.com>
+Date: Wed, 21 Jul 2021 13:38:24 -0300
+Subject: openwrt: don't quote $(SHELL) in Makefile.am
+
+This allows to use SHELL="env bash" to get a controlled enviroment.
+
+Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
+
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -46,7 +46,7 @@ EXTRA_LTLIBRARIES	=
+ # Using 'cd' in backquotes may print the directory name, use this instead:
+ lt__cd		= CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+ 
+-git_version_gen = '$(SHELL)' '$(aux_dir)/git-version-gen' '--fallback' '$(VERSION)' '.tarball-version'
++git_version_gen = $(SHELL) '$(aux_dir)/git-version-gen' '--fallback' '$(VERSION)' '.tarball-version'
+ rebuild = rebuild=:; revision=`$(lt__cd) $(srcdir) && $(git_version_gen) | $(SED) 's|-.*$$||'`
+ 
+ 
+@@ -306,7 +306,7 @@ libtool: $(ltmain_sh) $(config_status) $
+ 	  if test 0 = '$(AM_DEFAULT_VERBOSITY)' && test 1 != '$(V)'; \
+ 	    then echo "  GEN     " $@; \
+ 	  else echo '$(SHELL) $(top_builddir)/config.status "$@"'; fi; \
+-	  cd '$(top_builddir)' && '$(SHELL)' ./config.status '$@'; \
++	  cd '$(top_builddir)' && $(SHELL) ./config.status '$@'; \
+ 	fi
+ 
+ 
+@@ -789,13 +789,13 @@ testsuite_deps_uninstalled = $(testsuite
+ # Hook the test suite into the check rule
+ check-local: $(testsuite_deps_uninstalled)
+ 	$(AM_V_at)$(CD_TESTDIR); \
+-	CONFIG_SHELL='$(SHELL)' '$(SHELL)' "$$abs_srcdir/$(TESTSUITE)" \
++	CONFIG_SHELL=$(SHELL) $(SHELL) "$$abs_srcdir/$(TESTSUITE)" \
+ 	  $(TESTS_ENVIRONMENT) $(BUILDCHECK_ENVIRONMENT) $(TESTSUITEFLAGS)
+ 
+ # Run the test suite on the *installed* tree.
+ installcheck-local: $(testsuite_deps)
+ 	$(AM_V_at)$(CD_TESTDIR); \
+-	CONFIG_SHELL='$(SHELL)' '$(SHELL)' "$$abs_srcdir/$(TESTSUITE)" \
++	CONFIG_SHELL=$(SHELL) $(SHELL) "$$abs_srcdir/$(TESTSUITE)" \
+ 	  $(TESTS_ENVIRONMENT) $(INSTALLCHECK_ENVIRONMENT) $(TESTSUITEFLAGS) \
+ 	  AUTOTEST_PATH='$(exec_prefix)/bin'
+ 
+@@ -807,7 +807,7 @@ check-noninteractive-old:
+ .PHONY: check-noninteractive-new
+ check-noninteractive-new: $(testsuite_deps_uninstalled)
+ 	$(AM_V_at)$(CD_TESTDIR); \
+-	CONFIG_SHELL='$(SHELL)' '$(SHELL)' "$$abs_srcdir/$(TESTSUITE)" \
++	CONFIG_SHELL=$(SHELL) $(SHELL) "$$abs_srcdir/$(TESTSUITE)" \
+ 	  $(TESTS_ENVIRONMENT) $(BUILDCHECK_ENVIRONMENT) \
+ 	  -k '!interactive' INNER_TESTSUITEFLAGS=',!interactive' \
+ 	  $(TESTSUITEFLAGS)
+@@ -816,7 +816,7 @@ check-noninteractive-new: $(testsuite_de
+ .PHONY: check-interactive
+ check-interactive: $(testsuite_deps_uninstalled)
+ 	$(AM_V_at)$(CD_TESTDIR); \
+-	CONFIG_SHELL='$(SHELL)' '$(SHELL)' "$$abs_srcdir/$(TESTSUITE)" \
++	CONFIG_SHELL=$(SHELL) $(SHELL) "$$abs_srcdir/$(TESTSUITE)" \
+ 	  $(TESTS_ENVIRONMENT) $(BUILDCHECK_ENVIRONMENT) \
+ 	  -k interactive -k recursive INNER_TESTSUITEFLAGS=',interactive' \
+ 	  $(TESTSUITEFLAGS)
+@@ -828,7 +828,7 @@ check-noninteractive: check-noninteracti
+ clean-local:
+ 	-$(CD_TESTDIR); \
+ 	test -f "$$abs_srcdir/$(TESTSUITE)" && \
+-	    '$(SHELL)' "$$abs_srcdir/$(TESTSUITE)" --clean
++	    $(SHELL) "$$abs_srcdir/$(TESTSUITE)" --clean
+ 
+ ## An empty target to depend on when a rule needs to always run
+ ## whenever it is visited.
diff --git a/tools/libtool/patches/200-openwrt-branding.patch b/tools/libtool/patches/200-openwrt-branding.patch
index 3fc0afb8665494..5876f8bfac6347 100644
--- a/tools/libtool/patches/200-openwrt-branding.patch
+++ b/tools/libtool/patches/200-openwrt-branding.patch
@@ -1,112 +1,34 @@
---- a/libltdl/config/general.m4sh
-+++ b/libltdl/config/general.m4sh
-@@ -359,7 +359,7 @@ opt_warning=:
- # name if it has been set yet.
- func_echo ()
- {
--    $ECHO "$progname: ${opt_mode+$opt_mode: }$*"
-+    $ECHO "OpenWrt-$progname: ${opt_mode+$opt_mode: }$*"
+From 90707200efadc8e230635c7c204c9c272cbc8631 Mon Sep 17 00:00:00 2001
+From: Eneas U de Queiroz <cotequeiroz@gmail.com>
+Date: Tue, 20 Jul 2021 17:01:03 -0300
+Subject: openwrt: add openwrt branding
+
+This prepends program name with "OpenWrt-".
+
+This was originally commited to openwrt by Jo-Philipp Wich
+<jow@openwrt.org>.
+
+Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
+
+--- a/build-aux/ltmain.in
++++ b/build-aux/ltmain.in
+@@ -82,7 +82,7 @@ func_echo ()
+     IFS=$nl
+     for _G_line in $_G_message; do
+       IFS=$func_echo_IFS
+-      $ECHO "$progname${opt_mode+: $opt_mode}: $_G_line"
++      $ECHO "OpenWrt-$progname${opt_mode+: $opt_mode}: $_G_line"
+     done
+     IFS=$func_echo_IFS
+ }
+--- a/build-aux/funclib.sh
++++ b/build-aux/funclib.sh
+@@ -699,7 +699,7 @@ func_echo ()
+     IFS=$nl
+     for _G_line in $_G_message; do
+       IFS=$func_echo_IFS
+-      $ECHO "$progname: $_G_line"
++      $ECHO "OpenWrt-$progname: $_G_line"
+     done
+     IFS=$func_echo_IFS
  }
- 
- # func_verbose arg...
-@@ -385,14 +385,14 @@ func_echo_all ()
- # Echo program name prefixed message to standard error.
- func_error ()
- {
--    $ECHO "$progname: ${opt_mode+$opt_mode: }"${1+"$@"} 1>&2
-+    $ECHO "OpenWrt-$progname: ${opt_mode+$opt_mode: }"${1+"$@"} 1>&2
- }
- 
- # func_warning arg...
- # Echo program name prefixed warning message to standard error.
- func_warning ()
- {
--    $opt_warning && $ECHO "$progname: ${opt_mode+$opt_mode: }warning: "${1+"$@"} 1>&2
-+    $opt_warning && $ECHO "OpenWrt-$progname: ${opt_mode+$opt_mode: }warning: "${1+"$@"} 1>&2
- 
-     # bash bug again:
-     :
---- a/libltdl/config/ltmain.sh
-+++ b/libltdl/config/ltmain.sh
-@@ -439,7 +439,7 @@ opt_warning=:
- # name if it has been set yet.
- func_echo ()
- {
--    $ECHO "$progname: ${opt_mode+$opt_mode: }$*"
-+    $ECHO "OpenWrt-$progname: ${opt_mode+$opt_mode: }$*"
- }
- 
- # func_verbose arg...
-@@ -465,14 +465,14 @@ func_echo_all ()
- # Echo program name prefixed message to standard error.
- func_error ()
- {
--    $ECHO "$progname: ${opt_mode+$opt_mode: }"${1+"$@"} 1>&2
-+    $ECHO "OpenWrt-$progname: ${opt_mode+$opt_mode: }"${1+"$@"} 1>&2
- }
- 
- # func_warning arg...
- # Echo program name prefixed warning message to standard error.
- func_warning ()
- {
--    $opt_warning && $ECHO "$progname: ${opt_mode+$opt_mode: }warning: "${1+"$@"} 1>&2
-+    $opt_warning && $ECHO "OpenWrt-$progname: ${opt_mode+$opt_mode: }warning: "${1+"$@"} 1>&2
- 
-     # bash bug again:
-     :
---- a/libtoolize.in
-+++ b/libtoolize.in
-@@ -648,7 +648,7 @@ opt_warning=:
- # name if it has been set yet.
- func_echo ()
- {
--    $ECHO "$progname: ${opt_mode+$opt_mode: }$*"
-+    $ECHO "OpenWrt-$progname: ${opt_mode+$opt_mode: }$*"
- }
- 
- # func_verbose arg...
-@@ -674,14 +674,14 @@ func_echo_all ()
- # Echo program name prefixed message to standard error.
- func_error ()
- {
--    $ECHO "$progname: ${opt_mode+$opt_mode: }"${1+"$@"} 1>&2
-+    $ECHO "OpenWrt-$progname: ${opt_mode+$opt_mode: }"${1+"$@"} 1>&2
- }
- 
- # func_warning arg...
- # Echo program name prefixed warning message to standard error.
- func_warning ()
- {
--    $opt_warning && $ECHO "$progname: ${opt_mode+$opt_mode: }warning: "${1+"$@"} 1>&2
-+    $opt_warning && $ECHO "OpenWrt-$progname: ${opt_mode+$opt_mode: }warning: "${1+"$@"} 1>&2
- 
-     # bash bug again:
-     :
---- a/tests/defs.in
-+++ b/tests/defs.in
-@@ -596,7 +596,7 @@ opt_warning=:
- # name if it has been set yet.
- func_echo ()
- {
--    $ECHO "$progname: ${opt_mode+$opt_mode: }$*"
-+    $ECHO "OpenWrt-$progname: ${opt_mode+$opt_mode: }$*"
- }
- 
- # func_verbose arg...
-@@ -622,14 +622,14 @@ func_echo_all ()
- # Echo program name prefixed message to standard error.
- func_error ()
- {
--    $ECHO "$progname: ${opt_mode+$opt_mode: }"${1+"$@"} 1>&2
-+    $ECHO "OpenWrt-$progname: ${opt_mode+$opt_mode: }"${1+"$@"} 1>&2
- }
- 
- # func_warning arg...
- # Echo program name prefixed warning message to standard error.
- func_warning ()
- {
--    $opt_warning && $ECHO "$progname: ${opt_mode+$opt_mode: }warning: "${1+"$@"} 1>&2
-+    $opt_warning && $ECHO "OpenWrt-$progname: ${opt_mode+$opt_mode: }warning: "${1+"$@"} 1>&2
- 
-     # bash bug again:
-     :
diff --git a/tools/llvm-bpf/Makefile b/tools/llvm-bpf/Makefile
index 775e1af896be60..71509511e73927 100644
--- a/tools/llvm-bpf/Makefile
+++ b/tools/llvm-bpf/Makefile
@@ -7,17 +7,15 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=llvm-project
-PKG_VERSION:=14.0.6
+PKG_VERSION:=15.0.7
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).src.tar.xz
 PKG_SOURCE_URL:=https://github.com/llvm/llvm-project/releases/download/llvmorg-$(PKG_VERSION)
-PKG_HASH:=8b3cfd7bc695bd6cea0f37f53f0981f34f87496e79e2529874fd03a2f9dd3a8a
+PKG_HASH:=8b5fcb24b4128cf04df1b0b9410ce8b1a729cb3c544e6da885d234280dedeac6
 
 HOST_BUILD_DIR:=$(BUILD_DIR_HOST)/$(PKG_NAME)-$(PKG_VERSION).src
 
-HOST_BUILD_PARALLEL:=1
-
 CMAKE_BINARY_SUBDIR := build
 CMAKE_SOURCE_SUBDIR := llvm
 
diff --git a/tools/lz4/Makefile b/tools/lz4/Makefile
new file mode 100644
index 00000000000000..8f12ca93e68329
--- /dev/null
+++ b/tools/lz4/Makefile
@@ -0,0 +1,37 @@
+#
+# Copyright (C) 2022 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=lz4
+PKG_VERSION:=1.9.4
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://codeload.github.com/lz4/lz4/tar.gz/v$(PKG_VERSION)?
+PKG_HASH:=0b0e3aa07c8c063ddf40b082bdf7e37a1562bda40a0ff5272957f3e987e0e54b
+
+PKG_LICENSE:=BSD-2-Clause
+PKG_LICENSE_FILES:=LICENSE lib/LICENSE
+
+include $(INCLUDE_DIR)/host-build.mk
+include $(INCLUDE_DIR)/meson.mk
+
+MESON_HOST_BUILD_DIR:=$(HOST_BUILD_DIR)/contrib/meson/openwrt-build
+
+# Always optimize for speed
+HOST_CFLAGS := $(filter-out -O%,$(HOST_CFLAGS)) -O3
+
+MESON_HOST_ARGS += \
+	-Ddefault_library=static \
+	-Ddebug-level=0 \
+	-Dunstable=false \
+	-Dprograms=true \
+	-Dtests=false \
+	-Dcontrib=false \
+	-Dexamples=false
+
+$(eval $(call HostBuild))
diff --git a/tools/lz4/patches/001-add-make-ENABLE_DOCS-configurable.patch b/tools/lz4/patches/001-add-make-ENABLE_DOCS-configurable.patch
new file mode 100644
index 00000000000000..5d6dca33f31c3d
--- /dev/null
+++ b/tools/lz4/patches/001-add-make-ENABLE_DOCS-configurable.patch
@@ -0,0 +1,60 @@
++++ a/programs/Makefile	2022-08-15 15:45:31.000000000 -0700
+--- b/programs/Makefile	2022-11-28 16:34:21.315593784 -0800
+@@ -66,6 +66,7 @@
+ MD2ROFF   = ronn
+ MD2ROFF_FLAGS = --roff --warnings --manual="User Commands" --organization="lz4 $(LZ4_VERSION)"
+ 
++ENABLE_DOCS ?= 1
+ 
+ default: lz4-release
+ 
+@@ -120,6 +121,7 @@
+ lz4c32 : $(SRCFILES)
+ 	$(CC) $(FLAGS) $^ -o $@$(EXT)
+ 
++ifeq ($(ENABLE_DOCS),1)
+ lz4.1: lz4.1.md $(LIBVER_SRC)
+ 	cat $< | $(MD2ROFF) $(MD2ROFF_FLAGS) | $(SED) -n '/^\.\\\".*/!p' > $@
+ 
+@@ -130,6 +132,7 @@
+ 
+ preview-man: clean-man man
+ 	man ./lz4.1
++endif
+ 
+ clean:
+ ifeq ($(WINBASED),yes)
+@@ -172,16 +175,19 @@
+ 
+ install: lz4
+ 	@echo Installing binaries in $(DESTDIR)$(bindir)
+-	$(INSTALL_DIR) $(DESTDIR)$(bindir)/ $(DESTDIR)$(man1dir)/
++	$(INSTALL_DIR) $(DESTDIR)$(bindir)/
+ 	$(INSTALL_PROGRAM) lz4$(EXT) $(DESTDIR)$(bindir)/lz4$(EXT)
+ 	$(LN_SF) lz4$(EXT) $(DESTDIR)$(bindir)/lz4c$(EXT)
+ 	$(LN_SF) lz4$(EXT) $(DESTDIR)$(bindir)/lz4cat$(EXT)
+ 	$(LN_SF) lz4$(EXT) $(DESTDIR)$(bindir)/unlz4$(EXT)
++ifeq ($(ENABLE_DOCS),1)
+ 	@echo Installing man pages in $(DESTDIR)$(man1dir)
++	$(INSTALL_DIR) $(DESTDIR)$(man1dir)/
+ 	$(INSTALL_DATA) lz4.1 $(DESTDIR)$(man1dir)/lz4.1
+ 	$(LN_SF) lz4.1 $(DESTDIR)$(man1dir)/lz4c.1
+ 	$(LN_SF) lz4.1 $(DESTDIR)$(man1dir)/lz4cat.1
+ 	$(LN_SF) lz4.1 $(DESTDIR)$(man1dir)/unlz4.1
++endif
+ 	@echo lz4 installation completed
+ 
+ uninstall:
+@@ -189,10 +195,12 @@
+ 	$(RM) $(DESTDIR)$(bindir)/unlz4$(EXT)
+ 	$(RM) $(DESTDIR)$(bindir)/lz4$(EXT)
+ 	$(RM) $(DESTDIR)$(bindir)/lz4c$(EXT)
++ifeq ($(ENABLE_DOCS),1)
+ 	$(RM) $(DESTDIR)$(man1dir)/lz4.1
+ 	$(RM) $(DESTDIR)$(man1dir)/lz4c.1
+ 	$(RM) $(DESTDIR)$(man1dir)/lz4cat.1
+ 	$(RM) $(DESTDIR)$(man1dir)/unlz4.1
++endif
+ 	@echo lz4 programs successfully uninstalled
+ 
+ endif
diff --git a/tools/lz4/patches/002-makefile-install-links-from-same-dir.patch b/tools/lz4/patches/002-makefile-install-links-from-same-dir.patch
new file mode 100644
index 00000000000000..159dc67f1afc21
--- /dev/null
+++ b/tools/lz4/patches/002-makefile-install-links-from-same-dir.patch
@@ -0,0 +1,71 @@
+diff -ur a/lib/Makefile b/lib/Makefile
+--- a/lib/Makefile	2022-12-04 23:49:06.336839263 -0800
++++ b/lib/Makefile	2022-12-05 00:00:59.172307488 -0800
+@@ -195,8 +195,8 @@
+ 	$(INSTALL_PROGRAM) dll/$(LIBLZ4_EXP) $(DESTDIR)$(libdir)
+     else
+ 	$(INSTALL_PROGRAM) liblz4.$(SHARED_EXT_VER) $(DESTDIR)$(libdir)
+-	$(LN_SF) liblz4.$(SHARED_EXT_VER) $(DESTDIR)$(libdir)/liblz4.$(SHARED_EXT_MAJOR)
+-	$(LN_SF) liblz4.$(SHARED_EXT_VER) $(DESTDIR)$(libdir)/liblz4.$(SHARED_EXT)
++	(cd $(DESTDIR)$(libdir) && $(LN_SF) liblz4.$(SHARED_EXT_VER) liblz4.$(SHARED_EXT_MAJOR))
++	(cd $(DESTDIR)$(libdir) && $(LN_SF) liblz4.$(SHARED_EXT_MAJOR) liblz4.$(SHARED_EXT))
+     endif
+   endif
+ 	@echo Installing headers in $(DESTDIR)$(includedir)
+diff -ur a/Makefile b/Makefile
+--- a/Makefile	2022-12-04 23:49:06.336839263 -0800
++++ b/Makefile	2022-12-04 23:42:09.693836654 -0800
+@@ -77,12 +77,12 @@
+ 
+ .PHONY: clean
+ clean:
+-	$(MAKE) -C $(LZ4DIR) $@ > $(VOID)
+-	$(MAKE) -C $(PRGDIR) $@ > $(VOID)
+-	$(MAKE) -C $(TESTDIR) $@ > $(VOID)
+-	$(MAKE) -C $(EXDIR) $@ > $(VOID)
+-	$(MAKE) -C $(FUZZDIR) $@ > $(VOID)
+-	$(MAKE) -C contrib/gen_manual $@ > $(VOID)
++	$(MAKE) -C $(LZ4DIR) $@
++	$(MAKE) -C $(PRGDIR) $@
++	$(MAKE) -C $(TESTDIR) $@
++	$(MAKE) -C $(EXDIR) $@
++	$(MAKE) -C $(FUZZDIR) $@
++	$(MAKE) -C contrib/gen_manual $@
+ 	$(RM) lz4$(EXT)
+ 	$(RM) -r $(CMAKE_BUILD_DIR)
+ 	@echo Cleaning completed
+diff -ur a/programs/Makefile b/programs/Makefile
+--- a/programs/Makefile	2022-12-04 23:49:06.336839263 -0800
++++ b/programs/Makefile	2022-12-04 23:42:30.849582910 -0800
+@@ -138,7 +138,7 @@
+ ifeq ($(WINBASED),yes)
+ 	$(RM) *.rc
+ endif
+-	$(MAKE) -C $(LZ4DIR) $@ > $(VOID)
++	$(MAKE) -C $(LZ4DIR) $@
+ 	$(RM) core *.o *.test tmp* \
+            lz4$(EXT) lz4c$(EXT) lz4c32$(EXT) lz4-wlib$(EXT) \
+            unlz4$(EXT) lz4cat$(EXT)
+@@ -177,16 +177,16 @@
+ 	@echo Installing binaries in $(DESTDIR)$(bindir)
+ 	$(INSTALL_DIR) $(DESTDIR)$(bindir)/
+ 	$(INSTALL_PROGRAM) lz4$(EXT) $(DESTDIR)$(bindir)/lz4$(EXT)
+-	$(LN_SF) lz4$(EXT) $(DESTDIR)$(bindir)/lz4c$(EXT)
+-	$(LN_SF) lz4$(EXT) $(DESTDIR)$(bindir)/lz4cat$(EXT)
+-	$(LN_SF) lz4$(EXT) $(DESTDIR)$(bindir)/unlz4$(EXT)
++	(cd $(DESTDIR)$(bindir) && $(LN_SF) lz4$(EXT) lz4c$(EXT))
++	(cd $(DESTDIR)$(bindir) && $(LN_SF) lz4$(EXT) lz4cat$(EXT))
++	(cd $(DESTDIR)$(bindir) && $(LN_SF) lz4$(EXT) unlz4$(EXT))
+ ifeq ($(ENABLE_DOCS),1)
+ 	@echo Installing man pages in $(DESTDIR)$(man1dir)
+ 	$(INSTALL_DIR) $(DESTDIR)$(man1dir)/
+ 	$(INSTALL_DATA) lz4.1 $(DESTDIR)$(man1dir)/lz4.1
+-	$(LN_SF) lz4.1 $(DESTDIR)$(man1dir)/lz4c.1
+-	$(LN_SF) lz4.1 $(DESTDIR)$(man1dir)/lz4cat.1
+-	$(LN_SF) lz4.1 $(DESTDIR)$(man1dir)/unlz4.1
++	(cd $(DESTDIR)$(man1dir) && $(LN_SF) lz4.1 lz4c.1)
++	(cd $(DESTDIR)$(man1dir) && $(LN_SF) lz4.1 lz4cat.1)
++	(cd $(DESTDIR)$(man1dir) && $(LN_SF) lz4.1 unlz4.1)
+ endif
+ 	@echo lz4 installation completed
+ 
diff --git a/tools/lzma/Makefile b/tools/lzma/Makefile
index b87289e385df7e..29f7e0fb1d6317 100644
--- a/tools/lzma/Makefile
+++ b/tools/lzma/Makefile
@@ -31,6 +31,7 @@ define Host/Install
 endef
 
 define Host/Clean
+	rm -f $(STAGING_DIR_HOST)/bin/lzma
 endef
 
 $(eval $(call HostBuild))
diff --git a/tools/lzop/Makefile b/tools/lzop/Makefile
new file mode 100644
index 00000000000000..65bd7fe67c159a
--- /dev/null
+++ b/tools/lzop/Makefile
@@ -0,0 +1,33 @@
+#
+# Copyright (C) 2022 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=lzop
+PKG_VERSION:=1.04
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=http://www.lzop.org/download/
+PKG_HASH:=7e72b62a8a60aff5200a047eea0773a8fb205caf7acbe1774d95147f305a2f41
+
+PKG_LICENSE:=GPL-2.0-or-later
+PKG_LICENSE_FILES:=COPYING
+
+CMAKE_BINARY_SUBDIR:=openwrt-build
+
+include $(INCLUDE_DIR)/host-build.mk
+include $(INCLUDE_DIR)/cmake.mk
+
+CMAKE_HOST_OPTIONS += \
+	-DENABLE_DOCS=ON \
+	-DBUILD_TESTING=OFF
+
+define Host/Uninstall
+	rm -f $(STAGING_DIR_HOST)/bin/lzop
+endef
+
+$(eval $(call HostBuild))
diff --git a/tools/lzop/patches/001-add-cmake-ENABLE_DOCS-configurable.patch b/tools/lzop/patches/001-add-cmake-ENABLE_DOCS-configurable.patch
new file mode 100644
index 00000000000000..01ebd33a399ae7
--- /dev/null
+++ b/tools/lzop/patches/001-add-cmake-ENABLE_DOCS-configurable.patch
@@ -0,0 +1,24 @@
+--- a/CMakeLists.txt	2017-08-10 04:19:45.000000000 -0700
++++ b/CMakeLists.txt	2022-11-28 17:21:03.453548350 -0800
+@@ -50,6 +50,9 @@
+ 
+ project(lzop VERSION 1.04 LANGUAGES C)
+ 
++# configuration options
++option(ENABLE_DOCS     "Install documentation."    ON)
++
+ # install directories
+ if(NOT CMAKE_INSTALL_PREFIX)
+     message(FATAL_ERROR "ERROR: CMAKE_INSTALL_PREFIX is not defined.")
+@@ -186,9 +189,11 @@
+ 
+ install(TARGETS lzop DESTINATION "${CMAKE_INSTALL_FULL_BINDIR}")
+ 
++if(ENABLE_DOCS)
+ set(f AUTHORS COPYING NEWS README THANKS doc/lzop.html doc/lzop.man doc/lzop.pod doc/lzop.ps doc/lzop.tex doc/lzop.txt)
+ install(FILES ${f} DESTINATION "${CMAKE_INSTALL_FULL_DOCDIR}")
+ install(FILES doc/lzop.1 DESTINATION "${CMAKE_INSTALL_FULL_MANDIR}/man1")
++endif() # ENABLE_DOCS
+ 
+ endif() # CMAKE_INSTALL_FULL_LIBDIR
+ 
diff --git a/tools/m4/Makefile b/tools/m4/Makefile
index 0a358c35f1b8d3..d621000daf56c1 100644
--- a/tools/m4/Makefile
+++ b/tools/m4/Makefile
@@ -21,9 +21,8 @@ include $(INCLUDE_DIR)/host-build.mk
 
 HOST_CONFIGURE_VARS += gl_cv_func_strstr_linear=no
 
-define Host/Clean
-	-$(MAKE) -C $(HOST_BUILD_DIR) uninstall
-	$(call Host/Clean/Default)
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
 endef
 
 $(eval $(call HostBuild))
diff --git a/tools/meson/Makefile b/tools/meson/Makefile
index d53ed897a3509a..b115e0802b529a 100644
--- a/tools/meson/Makefile
+++ b/tools/meson/Makefile
@@ -1,11 +1,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=meson
-PKG_VERSION:=0.61.5
+PKG_VERSION:=1.1.1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/mesonbuild/meson/releases/download/$(PKG_VERSION)
-PKG_HASH:=5e9a0d65c1a51936362b9686d1c5e9e184a6fd245d57e7269750ce50c20f5d9a
+PKG_HASH:=d04b541f97ca439fb82fab7d0d480988be4bd4e62563a5ca35fadb5400727b1c
 
 PKG_MAINTAINER:=Andre Heider <a.heider@gmail.com>
 PKG_LICENSE:=Apache-2.0
diff --git a/tools/missing-macros/src/README b/tools/missing-macros/src/README
index d2305ff5575a8a..dd9a9d3c9629b8 100644
--- a/tools/missing-macros/src/README
+++ b/tools/missing-macros/src/README
@@ -2,26 +2,13 @@ The m4/ directory below contains various m4 macros used
 by different packages in the OpenWrt feed.
 
 
-From GNU gettext:
-Library linking and rpath helper macros.
-
-  lib-ld.m4
-  lib-link.m4
-  lib-prefix.m4
-
 Integer data type test macros.
 
   intmax.m4
-  wint_t.m4
   inttypes-pri.m4
   uintmax_t.m4
-  stdint_h.m4
   intdiv0.m4
-  inttypes_h.m4
-
-Program test macro.
 
-  progtest.m4
 
 GNU libc version test macros.
 
diff --git a/tools/missing-macros/src/bin/makeinfo b/tools/missing-macros/src/bin/makeinfo
index e163cba0843def..d698f7b79c5d58 100755
--- a/tools/missing-macros/src/bin/makeinfo
+++ b/tools/missing-macros/src/bin/makeinfo
@@ -26,7 +26,7 @@ Getopt::Long::GetOptions(
 
 if ($version)
 {
-	print "makeinfo (OpenWrt stub) 4.13\n";
+	print "makeinfo (OpenWrt stub) 9.99\n";
 	exit 0;
 }
 
diff --git a/tools/mkimage/Makefile b/tools/mkimage/Makefile
index a7c98e755e820c..a6d54f5eff2ae4 100644
--- a/tools/mkimage/Makefile
+++ b/tools/mkimage/Makefile
@@ -7,14 +7,14 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mkimage
-PKG_VERSION:=2022.07
+PKG_VERSION:=2023.04
 
 PKG_SOURCE:=u-boot-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:= \
 	https://mirror.cyberbits.eu/u-boot \
 	https://ftp.denx.de/pub/u-boot \
 	ftp://ftp.denx.de/pub/u-boot
-PKG_HASH:=92b08eb49c24da14c1adbf70a71ae8f37cc53eeb4230e859ad8b6733d13dcf5e
+PKG_HASH:=e31cac91545ff41b71cec5d8c22afd695645cd6e2a442ccdacacd60534069341
 
 HOST_BUILD_DIR:=$(BUILD_DIR_HOST)/u-boot-$(PKG_VERSION)
 
diff --git a/tools/mkimage/patches/030-allow-to-use-different-magic.patch b/tools/mkimage/patches/030-allow-to-use-different-magic.patch
index b97cd819cc4cca..c33b0f4327ad71 100644
--- a/tools/mkimage/patches/030-allow-to-use-different-magic.patch
+++ b/tools/mkimage/patches/030-allow-to-use-different-magic.patch
@@ -2,7 +2,7 @@ This patch makes it possible to set a custom image magic.
 
 --- a/tools/mkimage.c
 +++ b/tools/mkimage.c
-@@ -25,6 +25,7 @@ static struct image_tool_params params =
+@@ -26,6 +26,7 @@ static struct image_tool_params params =
  	.arch = IH_ARCH_PPC,
  	.type = IH_TYPE_KERNEL,
  	.comp = IH_COMP_GZIP,
@@ -10,7 +10,7 @@ This patch makes it possible to set a custom image magic.
  	.dtc = MKIMAGE_DEFAULT_DTC_OPTIONS,
  	.imagename = "",
  	.imagename2 = "",
-@@ -88,11 +89,12 @@ static void usage(const char *msg)
+@@ -89,11 +90,12 @@ static void usage(const char *msg)
  			 "          -q ==> quiet\n",
  		params.cmdname);
  	fprintf(stderr,
@@ -24,16 +24,16 @@ This patch makes it possible to set a custom image magic.
  		"          -a ==> set load address to 'addr' (hex)\n"
  		"          -e ==> set entry point to 'ep' (hex)\n"
  		"          -n ==> set image name to 'name'\n"
-@@ -163,7 +165,7 @@ static void process_args(int argc, char
- 	int opt;
+@@ -159,7 +161,7 @@ static int add_content(int type, const c
+ }
  
- 	while ((opt = getopt(argc, argv,
--		   "a:A:b:B:c:C:d:D:e:Ef:FG:k:i:K:ln:N:p:o:O:rR:qstT:vVx")) != -1) {
-+		   "a:A:b:B:c:C:d:D:e:Ef:FG:k:i:K:lM:n:N:p:o:O:rR:qstT:vVx")) != -1) {
- 		switch (opt) {
- 		case 'a':
- 			params.addr = strtoull(optarg, &ptr, 16);
-@@ -254,6 +256,14 @@ static void process_args(int argc, char
+ static const char optstring[] =
+-	"a:A:b:B:c:C:d:D:e:Ef:Fg:G:i:k:K:ln:N:o:O:p:qrR:stT:vVx";
++	"a:A:b:B:c:C:d:D:e:Ef:Fg:G:i:k:K:lM:n:N:o:O:p:qrR:stT:vVx";
+ 
+ static const struct option longopts[] = {
+ 	{ "load-address", required_argument, NULL, 'a' },
+@@ -302,6 +304,14 @@ static void process_args(int argc, char
  		case 'l':
  			params.lflag = 1;
  			break;
@@ -50,16 +50,16 @@ This patch makes it possible to set a custom image magic.
  			break;
 --- a/tools/default_image.c
 +++ b/tools/default_image.c
-@@ -56,7 +56,7 @@ static int image_verify_header(unsigned
+@@ -63,7 +63,7 @@ static int image_verify_header(unsigned
  	 */
- 	memcpy(hdr, ptr, sizeof(image_header_t));
+ 	memcpy(hdr, ptr, sizeof(struct legacy_img_hdr));
  
 -	if (be32_to_cpu(hdr->ih_magic) != IH_MAGIC) {
 +	if (be32_to_cpu(hdr->ih_magic) != params->magic) {
  		debug("%s: Bad Magic Number: \"%s\" is no valid image\n",
  		      params->cmdname, params->imagefile);
  		return -FDT_ERR_BADMAGIC;
-@@ -120,7 +120,7 @@ static void image_set_header(void *ptr,
+@@ -142,7 +142,7 @@ static void image_set_header(void *ptr,
  	}
  
  	/* Build new header */
@@ -70,7 +70,7 @@ This patch makes it possible to set a custom image magic.
  	image_set_load(hdr, addr);
 --- a/tools/imagetool.h
 +++ b/tools/imagetool.h
-@@ -59,6 +59,7 @@ struct image_tool_params {
+@@ -67,6 +67,7 @@ struct image_tool_params {
  	int arch;
  	int type;
  	int comp;
diff --git a/tools/mpc/Makefile b/tools/mpc/Makefile
index 733c14173b6874..97e94291cb7c23 100644
--- a/tools/mpc/Makefile
+++ b/tools/mpc/Makefile
@@ -7,11 +7,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mpc
-PKG_VERSION:=1.2.1
+PKG_VERSION:=1.3.1
 
 PKG_SOURCE_URL:=@GNU/mpc/
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_HASH:=17503d2c395dfcf106b622dc142683c1199431d095367c6aacba6eec30340459
+PKG_HASH:=ab642492f5cf882b74aa0cb730cd410a81edcdbec895183ce930e706c1c759b8
 
 HOST_BUILD_PARALLEL:=1
 
@@ -22,7 +22,11 @@ unexport CFLAGS
 HOST_CONFIGURE_ARGS += \
 	--enable-static \
 	--disable-shared \
-	--with-mpfr=$(TOPDIR)/staging_dir/host \
-	--with-gmp=$(TOPDIR)/staging_dir/host
+	--with-mpfr=$(STAGING_DIR_HOST) \
+	--with-gmp=$(STAGING_DIR_HOST)
+
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
+endef
 
 $(eval $(call HostBuild))
diff --git a/tools/mpfr/Makefile b/tools/mpfr/Makefile
index 65e6f8959f322d..cdcca5f11aff9f 100644
--- a/tools/mpfr/Makefile
+++ b/tools/mpfr/Makefile
@@ -7,12 +7,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mpfr
-PKG_VERSION:=4.1.0
+PKG_VERSION:=4.2.0
 PKG_CPE_ID:=cpe:/a:mpfr:gnu_mpfr
 
 PKG_SOURCE_URL:=@GNU/mpfr http://www.mpfr.org/mpfr-$(PKG_VERSION)
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
-PKG_HASH:=0c98a3f1732ff6ca4ea690552079da9c597872d30e96ec28414ee23c95558a7f
+PKG_HASH:=06a378df13501248c1b2db5aa977a2c8126ae849a9d9b7be2546fb4a9c26d993
 
 HOST_BUILD_PARALLEL:=1
 HOST_FIXUP:=autoreconf
@@ -25,4 +25,8 @@ HOST_CONFIGURE_ARGS += \
 	--enable-thread-safe \
 	--with-gmp=$(STAGING_DIR_HOST)
 
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
+endef
+
 $(eval $(call HostBuild))
diff --git a/tools/mpfr/patches/001-only_src.patch b/tools/mpfr/patches/001-only_src.patch
index dbc7d32343f482..bd9e38aefbd8f7 100644
--- a/tools/mpfr/patches/001-only_src.patch
+++ b/tools/mpfr/patches/001-only_src.patch
@@ -1,6 +1,6 @@
 --- a/Makefile.am
 +++ b/Makefile.am
-@@ -24,7 +24,7 @@ AUTOMAKE_OPTIONS = gnu
+@@ -38,7 +38,7 @@ AUTOMAKE_OPTIONS = gnu
  # old Automake version.
  ACLOCAL_AMFLAGS = -I m4
  
@@ -11,7 +11,7 @@
  pkgconfig_DATA = mpfr.pc
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -384,7 +384,7 @@ AUTOMAKE_OPTIONS = gnu
+@@ -401,7 +401,7 @@ AUTOMAKE_OPTIONS = gnu
  # libtoolize and in case some developer needs to switch back to an
  # old Automake version.
  ACLOCAL_AMFLAGS = -I m4
diff --git a/tools/mtd-utils/Makefile b/tools/mtd-utils/Makefile
index e4b951acfb0f2c..14f11acaf55b1a 100644
--- a/tools/mtd-utils/Makefile
+++ b/tools/mtd-utils/Makefile
@@ -7,12 +7,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mtd-utils
-PKG_VERSION:=2.1.4
+PKG_VERSION:=2.1.5
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://infraroot.at/pub/mtd/
-PKG_HASH:=2c6711d15d282c47cb3867b6857340597e26d332c238465134c602e5eef71b99
+PKG_HASH:=386e27fd121699b6b729bc2e8e04dda987b31cca6b16e12fb6cc6dcf26449f46
 
 PKG_FIXUP:=autoreconf
 
diff --git a/tools/mtd-utils/patches/130-lzma_jffs2.patch b/tools/mtd-utils/patches/130-lzma_jffs2.patch
index 55930ddc861ccd..db683063d58950 100644
--- a/tools/mtd-utils/patches/130-lzma_jffs2.patch
+++ b/tools/mtd-utils/patches/130-lzma_jffs2.patch
@@ -5020,7 +5020,7 @@
 +}
 --- a/jffsX-utils/mkfs.jffs2.c
 +++ b/jffsX-utils/mkfs.jffs2.c
-@@ -1667,11 +1667,11 @@ int main(int argc, char **argv)
+@@ -1668,11 +1668,11 @@ int main(int argc, char **argv)
  						  }
  						  erase_block_size *= units;
  
diff --git a/tools/mtd-utils/patches/320-mkfs.jffs2-SOURCE_DATE_EPOCH.patch b/tools/mtd-utils/patches/320-mkfs.jffs2-SOURCE_DATE_EPOCH.patch
index f3ba4d327622f7..a1703eb64f0f87 100644
--- a/tools/mtd-utils/patches/320-mkfs.jffs2-SOURCE_DATE_EPOCH.patch
+++ b/tools/mtd-utils/patches/320-mkfs.jffs2-SOURCE_DATE_EPOCH.patch
@@ -20,7 +20,7 @@
  	}
  
  	entry = xcalloc(1, sizeof(struct filesystem_entry));
-@@ -1558,6 +1558,20 @@ static void parse_image(void){
+@@ -1559,6 +1559,20 @@ static void parse_image(void){
  	close(in_fd);
  }
  
@@ -41,7 +41,7 @@
  int main(int argc, char **argv)
  {
  	int c, opt;
-@@ -1576,6 +1590,7 @@ int main(int argc, char **argv)
+@@ -1577,6 +1591,7 @@ int main(int argc, char **argv)
  		warn_page_size = 1; /* warn user if page size not 4096 */
  
  	jffs2_compressors_init();
@@ -49,7 +49,7 @@
  
  	while ((opt = getopt_long(argc, argv,
  					"D:d:r:s:o:qUPfh?vVe:lbp::nc:m:x:X:Lty:i:", long_options, &c)) >= 0)
-@@ -1626,7 +1641,7 @@ int main(int argc, char **argv)
+@@ -1627,7 +1642,7 @@ int main(int argc, char **argv)
  				break;
  
  			case 'f':
diff --git a/tools/mtools/Makefile b/tools/mtools/Makefile
index 74007a88d05d56..b810918b98b194 100644
--- a/tools/mtools/Makefile
+++ b/tools/mtools/Makefile
@@ -7,11 +7,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mtools
-PKG_VERSION:=4.0.40
+PKG_VERSION:=4.0.43
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=@GNU/$(PKG_NAME)
-PKG_HASH:=a22fca42354011dd2293a7f51f228b46ebbd802e7740b0975912afecb79d5df4
+PKG_HASH:=541e179665dc4e272b9602f2074243591a157da89cc47064da8c5829dbd2b339
 
 HOST_BUILD_PARALLEL:=1
 
diff --git a/tools/ninja/Makefile b/tools/ninja/Makefile
index c5c83d9b14e54a..4763e759d8a057 100644
--- a/tools/ninja/Makefile
+++ b/tools/ninja/Makefile
@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ninja
-PKG_VERSION:=1.11.0
+PKG_VERSION:=1.11.1
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/ninja-build/ninja/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=3c6ba2e66400fe3f1ae83deb4b235faf3137ec20bd5b08c29bfc368db143e4c6
+PKG_HASH:=31747ae633213f1eda3842686f83c2aa1412e0f5691d1c14dbbcc67fe7400cea
 
 include $(INCLUDE_DIR)/host-build.mk
 
diff --git a/tools/ninja/patches/100-make_jobserver_support.patch b/tools/ninja/patches/100-make_jobserver_support.patch
index 7dac8ef8149c5f..34d2b6c4317078 100644
--- a/tools/ninja/patches/100-make_jobserver_support.patch
+++ b/tools/ninja/patches/100-make_jobserver_support.patch
@@ -1,4 +1,4 @@
-From 17d13fd7881fd3ce9f9b9d44ce435d6caf4b8f28 Mon Sep 17 00:00:00 2001
+From afec30f5caf4b051827ffdd822ebd27c58219fee Mon Sep 17 00:00:00 2001
 From: Stefan Becker <stefanb@gpartner-nvidia.com>
 Date: Tue, 22 Mar 2016 13:48:07 +0200
 Subject: [PATCH 01/11] Add GNU make jobserver client support
@@ -31,28 +31,41 @@ Fixes https://github.com/ninja-build/ninja/issues/1139
  create mode 100644 src/tokenpool-none.cc
  create mode 100644 src/tokenpool.h
 
-diff --git a/configure.py b/configure.py
-index 43904349a8..db3492c93c 100755
 --- a/configure.py
 +++ b/configure.py
-@@ -522,6 +522,7 @@ def has_re2c():
+@@ -517,11 +517,13 @@ for name in ['build',
+              'state',
+              'status',
+              'string_piece_util',
++             'tokenpool-gnu-make',
+              'util',
+              'version']:
      objs += cxx(name, variables=cxxvariables)
  if platform.is_windows():
      for name in ['subprocess-win32',
-+                 'tokenpool-none',
++                 'tokenpool-gnu-make-win32',
                   'includes_normalize-win32',
                   'msvc_helper-win32',
                   'msvc_helper_main-win32']:
-@@ -531,6 +532,7 @@ def has_re2c():
+@@ -530,7 +532,9 @@ if platform.is_windows():
+         objs += cxx('minidump-win32', variables=cxxvariables)
      objs += cc('getopt')
  else:
-     objs += cxx('subprocess-posix')
-+    objs += cxx('tokenpool-gnu-make')
+-    objs += cxx('subprocess-posix')
++    for name in ['subprocess-posix',
++                 'tokenpool-gnu-make-posix']:
++        objs += cxx(name)
  if platform.is_aix():
      objs += cc('getopt')
  if platform.is_msvc():
-diff --git a/src/build.cc b/src/build.cc
-index 6f11ed7a3c..fa096eac33 100644
+@@ -588,6 +592,7 @@ for name in ['build_log_test',
+              'string_piece_util_test',
+              'subprocess_test',
+              'test',
++             'tokenpool_test',
+              'util_test']:
+     objs += cxx(name, variables=cxxvariables)
+ if platform.is_windows():
 --- a/src/build.cc
 +++ b/src/build.cc
 @@ -35,6 +35,7 @@
@@ -63,7 +76,36 @@ index 6f11ed7a3c..fa096eac33 100644
  #include "util.h"
  
  using namespace std;
-@@ -149,7 +150,7 @@ void Plan::EdgeWanted(const Edge* edge) {
+@@ -47,8 +48,9 @@ struct DryRunCommandRunner : public Comm
+ 
+   // Overridden from CommandRunner:
+   virtual bool CanRunMore() const;
++  virtual bool AcquireToken();
+   virtual bool StartCommand(Edge* edge);
+-  virtual bool WaitForCommand(Result* result);
++  virtual bool WaitForCommand(Result* result, bool more_ready);
+ 
+  private:
+   queue<Edge*> finished_;
+@@ -58,12 +60,16 @@ bool DryRunCommandRunner::CanRunMore() c
+   return true;
+ }
+ 
++bool DryRunCommandRunner::AcquireToken() {
++  return true;
++}
++
+ bool DryRunCommandRunner::StartCommand(Edge* edge) {
+   finished_.push(edge);
+   return true;
+ }
+ 
+-bool DryRunCommandRunner::WaitForCommand(Result* result) {
++bool DryRunCommandRunner::WaitForCommand(Result* result, bool more_ready) {
+    if (finished_.empty())
+      return false;
+ 
+@@ -149,7 +155,7 @@ void Plan::EdgeWanted(const Edge* edge)
  }
  
  Edge* Plan::FindWork() {
@@ -72,7 +114,7 @@ index 6f11ed7a3c..fa096eac33 100644
      return NULL;
    EdgeSet::iterator e = ready_.begin();
    Edge* edge = *e;
-@@ -448,8 +449,8 @@ void Plan::Dump() const {
+@@ -448,19 +454,39 @@ void Plan::Dump() const {
  }
  
  struct RealCommandRunner : public CommandRunner {
@@ -81,18 +123,31 @@ index 6f11ed7a3c..fa096eac33 100644
 +  explicit RealCommandRunner(const BuildConfig& config);
 +  virtual ~RealCommandRunner();
    virtual bool CanRunMore() const;
++  virtual bool AcquireToken();
    virtual bool StartCommand(Edge* edge);
-   virtual bool WaitForCommand(Result* result);
-@@ -458,9 +459,18 @@ struct RealCommandRunner : public CommandRunner {
+-  virtual bool WaitForCommand(Result* result);
++  virtual bool WaitForCommand(Result* result, bool more_ready);
+   virtual vector<Edge*> GetActiveEdges();
+   virtual void Abort();
  
    const BuildConfig& config_;
++  // copy of config_.max_load_average; can be modified by TokenPool setup
++  double max_load_average_;
    SubprocessSet subprocs_;
-+  TokenPool *tokens_;
++  TokenPool* tokens_;
    map<const Subprocess*, Edge*> subproc_to_edge_;
  };
  
 +RealCommandRunner::RealCommandRunner(const BuildConfig& config) : config_(config) {
-+  tokens_ = TokenPool::Get();
++  max_load_average_ = config.max_load_average;
++  if ((tokens_ = TokenPool::Get()) != NULL) {
++    if (!tokens_->Setup(config_.parallelism_from_cmdline,
++                        config_.verbosity == BuildConfig::VERBOSE,
++                        max_load_average_)) {
++      delete tokens_;
++      tokens_ = NULL;
++    }
++  }
 +}
 +
 +RealCommandRunner::~RealCommandRunner() {
@@ -102,7 +157,7 @@ index 6f11ed7a3c..fa096eac33 100644
  vector<Edge*> RealCommandRunner::GetActiveEdges() {
    vector<Edge*> edges;
    for (map<const Subprocess*, Edge*>::iterator e = subproc_to_edge_.begin();
-@@ -471,14 +481,18 @@ vector<Edge*> RealCommandRunner::GetActiveEdges() {
+@@ -471,14 +497,23 @@ vector<Edge*> RealCommandRunner::GetActi
  
  void RealCommandRunner::Abort() {
    subprocs_.Clear();
@@ -111,19 +166,27 @@ index 6f11ed7a3c..fa096eac33 100644
  }
  
  bool RealCommandRunner::CanRunMore() const {
-   size_t subproc_number =
-       subprocs_.running_.size() + subprocs_.finished_.size();
-   return (int)subproc_number < config_.parallelism
+-  size_t subproc_number =
+-      subprocs_.running_.size() + subprocs_.finished_.size();
+-  return (int)subproc_number < config_.parallelism
 -    && ((subprocs_.running_.empty() || config_.max_load_average <= 0.0f)
 -        || GetLoadAverage() < config_.max_load_average);
++  bool parallelism_limit_not_reached =
++    tokens_ || // ignore config_.parallelism
++    ((int) (subprocs_.running_.size() +
++            subprocs_.finished_.size()) < config_.parallelism);
++  return parallelism_limit_not_reached
 +    && (subprocs_.running_.empty() ||
-+        ((config_.max_load_average <= 0.0f ||
-+          GetLoadAverage() < config_.max_load_average)
-+      && (!tokens_ || tokens_->Acquire())));
++        (max_load_average_ <= 0.0f ||
++         GetLoadAverage() < max_load_average_));
++}
++
++bool RealCommandRunner::AcquireToken() {
++  return (!tokens_ || tokens_->Acquire());
  }
  
  bool RealCommandRunner::StartCommand(Edge* edge) {
-@@ -486,6 +500,8 @@ bool RealCommandRunner::StartCommand(Edge* edge) {
+@@ -486,19 +521,33 @@ bool RealCommandRunner::StartCommand(Edg
    Subprocess* subproc = subprocs_.Add(command, edge->use_console());
    if (!subproc)
      return false;
@@ -132,25 +195,50 @@ index 6f11ed7a3c..fa096eac33 100644
    subproc_to_edge_.insert(make_pair(subproc, edge));
  
    return true;
-@@ -499,6 +515,9 @@ bool RealCommandRunner::WaitForCommand(Result* result) {
+ }
+ 
+-bool RealCommandRunner::WaitForCommand(Result* result) {
++bool RealCommandRunner::WaitForCommand(Result* result, bool more_ready) {
+   Subprocess* subproc;
+-  while ((subproc = subprocs_.NextFinished()) == NULL) {
+-    bool interrupted = subprocs_.DoWork();
++  subprocs_.ResetTokenAvailable();
++  while (((subproc = subprocs_.NextFinished()) == NULL) &&
++         !subprocs_.IsTokenAvailable()) {
++    bool interrupted = subprocs_.DoWork(more_ready ? tokens_ : NULL);
+     if (interrupted)
        return false;
    }
  
++  // token became available
++  if (subproc == NULL) {
++    result->status = ExitTokenAvailable;
++    return true;
++  }
++
++  // command completed
 +  if (tokens_)
 +    tokens_->Release();
 +
    result->status = subproc->Finish();
    result->output = subproc->GetOutput();
  
-@@ -621,31 +640,31 @@ bool Builder::Build(string* err) {
+@@ -620,38 +669,43 @@ bool Builder::Build(string* err) {
+   // command runner.
    // Second, we attempt to wait for / reap the next finished command.
    while (plan_.more_to_do()) {
-     // See if we can start any more commands.
+-    // See if we can start any more commands.
 -    if (failures_allowed && command_runner_->CanRunMore()) {
 -      if (Edge* edge = plan_.FindWork()) {
 -        if (edge->GetBindingBool("generator")) {
-+    if (failures_allowed && plan_.more_ready() &&
-+        command_runner_->CanRunMore()) {
++    // See if we can start any more commands...
++    bool can_run_more =
++        failures_allowed   &&
++        plan_.more_ready() &&
++        command_runner_->CanRunMore();
++
++    // ... but we also need a token to do that.
++    if (can_run_more && command_runner_->AcquireToken()) {
 +      Edge* edge = plan_.FindWork();
 +      if (edge->GetBindingBool("generator")) {
            scan_.build_log()->Close();
@@ -191,8 +279,24 @@ index 6f11ed7a3c..fa096eac33 100644
      }
  
      // See if we can reap any finished commands.
-diff --git a/src/build.h b/src/build.h
-index d697dfb89e..7dcd111e61 100644
+     if (pending_commands) {
+       CommandRunner::Result result;
+-      if (!command_runner_->WaitForCommand(&result) ||
++      if (!command_runner_->WaitForCommand(&result, can_run_more) ||
+           result.status == ExitInterrupted) {
+         Cleanup();
+         status_->BuildFinished();
+@@ -659,6 +713,10 @@ bool Builder::Build(string* err) {
+         return false;
+       }
+ 
++      // We might be able to start another command; start the main loop over.
++      if (result.status == ExitTokenAvailable)
++        continue;
++
+       --pending_commands;
+       if (!FinishCommand(&result, err)) {
+         Cleanup();
 --- a/src/build.h
 +++ b/src/build.h
 @@ -52,6 +52,9 @@ struct Plan {
@@ -205,13 +309,47 @@ index d697dfb89e..7dcd111e61 100644
    /// Dumps the current state of the plan.
    void Dump() const;
  
-diff --git a/src/tokenpool-gnu-make.cc b/src/tokenpool-gnu-make.cc
-new file mode 100644
-index 0000000000..a8f9b7139d
+@@ -136,6 +139,7 @@ private:
+ struct CommandRunner {
+   virtual ~CommandRunner() {}
+   virtual bool CanRunMore() const = 0;
++  virtual bool AcquireToken() = 0;
+   virtual bool StartCommand(Edge* edge) = 0;
+ 
+   /// The result of waiting for a command.
+@@ -147,7 +151,9 @@ struct CommandRunner {
+     bool success() const { return status == ExitSuccess; }
+   };
+   /// Wait for a command to complete, or return false if interrupted.
+-  virtual bool WaitForCommand(Result* result) = 0;
++  /// If more_ready is true then the optional TokenPool is monitored too
++  /// and we return when a token becomes available.
++  virtual bool WaitForCommand(Result* result, bool more_ready) = 0;
+ 
+   virtual std::vector<Edge*> GetActiveEdges() { return std::vector<Edge*>(); }
+   virtual void Abort() {}
+@@ -155,7 +161,8 @@ struct CommandRunner {
+ 
+ /// Options (e.g. verbosity, parallelism) passed to a build.
+ struct BuildConfig {
+-  BuildConfig() : verbosity(NORMAL), dry_run(false), parallelism(1),
++  BuildConfig() : verbosity(NORMAL), dry_run(false),
++                  parallelism(1), parallelism_from_cmdline(false),
+                   failures_allowed(1), max_load_average(-0.0f) {}
+ 
+   enum Verbosity {
+@@ -167,6 +174,7 @@ struct BuildConfig {
+   Verbosity verbosity;
+   bool dry_run;
+   int parallelism;
++  bool parallelism_from_cmdline;
+   int failures_allowed;
+   /// The maximum load average we must not exceed. A negative value
+   /// means that we do not have any limit.
 --- /dev/null
 +++ b/src/tokenpool-gnu-make.cc
-@@ -0,0 +1,211 @@
-+// Copyright 2016 Google Inc. All Rights Reserved.
+@@ -0,0 +1,108 @@
++// Copyright 2016-2018 Google Inc. All Rights Reserved.
 +//
 +// Licensed under the Apache License, Version 2.0 (the "License");
 +// you may not use this file except in compliance with the License.
@@ -225,111 +363,55 @@ index 0000000000..a8f9b7139d
 +// See the License for the specific language governing permissions and
 +// limitations under the License.
 +
-+#include "tokenpool.h"
++#include "tokenpool-gnu-make.h"
 +
-+#include <errno.h>
-+#include <fcntl.h>
-+#include <poll.h>
-+#include <unistd.h>
-+#include <signal.h>
++#include <stdlib.h>
 +#include <stdio.h>
 +#include <string.h>
-+#include <stdlib.h>
-+
-+// TokenPool implementation for GNU make jobserver
-+// (http://make.mad-scientist.net/papers/jobserver-implementation/)
-+struct GNUmakeTokenPool : public TokenPool {
-+  GNUmakeTokenPool();
-+  virtual ~GNUmakeTokenPool();
-+
-+  virtual bool Acquire();
-+  virtual void Reserve();
-+  virtual void Release();
-+  virtual void Clear();
-+
-+  bool Setup();
-+
-+ private:
-+  int available_;
-+  int used_;
-+
-+#ifdef _WIN32
-+  // @TODO
-+#else
-+  int rfd_;
-+  int wfd_;
-+
-+  struct sigaction old_act_;
-+  bool restore_;
-+
-+  static int dup_rfd_;
-+  static void CloseDupRfd(int signum);
-+
-+  bool CheckFd(int fd);
-+  bool SetAlarmHandler();
-+#endif
 +
-+  void Return();
-+};
++#include "line_printer.h"
 +
++// TokenPool implementation for GNU make jobserver - common bits
 +// every instance owns an implicit token -> available_ == 1
-+GNUmakeTokenPool::GNUmakeTokenPool() : available_(1), used_(0),
-+                                       rfd_(-1), wfd_(-1), restore_(false) {
++GNUmakeTokenPool::GNUmakeTokenPool() : available_(1), used_(0) {
 +}
 +
 +GNUmakeTokenPool::~GNUmakeTokenPool() {
-+  Clear();
-+  if (restore_)
-+    sigaction(SIGALRM, &old_act_, NULL);
 +}
 +
-+bool GNUmakeTokenPool::CheckFd(int fd) {
-+  if (fd < 0)
-+    return false;
-+  int ret = fcntl(fd, F_GETFD);
-+  if (ret < 0)
++bool GNUmakeTokenPool::Setup(bool ignore,
++                             bool verbose,
++                             double& max_load_average) {
++  const char* value = GetEnv("MAKEFLAGS");
++  if (!value)
 +    return false;
-+  return true;
-+}
 +
-+int GNUmakeTokenPool::dup_rfd_ = -1;
++  // GNU make <= 4.1
++  const char* jobserver = strstr(value, "--jobserver-fds=");
++  if (!jobserver)
++    // GNU make => 4.2
++    jobserver = strstr(value, "--jobserver-auth=");
++  if (jobserver) {
++    LinePrinter printer;
 +
-+void GNUmakeTokenPool::CloseDupRfd(int signum) {
-+  close(dup_rfd_);
-+  dup_rfd_ = -1;
-+}
++    if (ignore) {
++      printer.PrintOnNewLine("ninja: warning: -jN forced on command line; ignoring GNU make jobserver.\n");
++    } else {
++      if (ParseAuth(jobserver)) {
++        const char* l_arg = strstr(value, " -l");
++        int load_limit = -1;
 +
-+bool GNUmakeTokenPool::SetAlarmHandler() {
-+  struct sigaction act;
-+  memset(&act, 0, sizeof(act));
-+  act.sa_handler = CloseDupRfd;
-+  if (sigaction(SIGALRM, &act, &old_act_) < 0) {
-+    perror("sigaction:");
-+    return(false);
-+  } else {
-+    restore_ = true;
-+    return(true);
-+  }
-+}
++        if (verbose) {
++          printer.PrintOnNewLine("ninja: using GNU make jobserver.\n");
++        }
++
++        // translate GNU make -lN to ninja -lN
++        if (l_arg &&
++            (sscanf(l_arg + 3, "%d ", &load_limit) == 1) &&
++            (load_limit > 0)) {
++          max_load_average = load_limit;
++        }
 +
-+bool GNUmakeTokenPool::Setup() {
-+  const char *value = getenv("MAKEFLAGS");
-+  if (value) {
-+    // GNU make <= 4.1
-+    const char *jobserver = strstr(value, "--jobserver-fds=");
-+    // GNU make => 4.2
-+    if (!jobserver)
-+      jobserver = strstr(value, "--jobserver-auth=");
-+    if (jobserver) {
-+      int rfd = -1;
-+      int wfd = -1;
-+      if ((sscanf(jobserver, "%*[^=]=%d,%d", &rfd, &wfd) == 2) &&
-+          CheckFd(rfd) &&
-+          CheckFd(wfd) &&
-+          SetAlarmHandler()) {
-+        printf("ninja: using GNU make jobserver.\n");
-+        rfd_ = rfd;
-+        wfd_ = wfd;
 +        return true;
 +      }
 +    }
@@ -342,44 +424,13 @@ index 0000000000..a8f9b7139d
 +  if (available_ > 0)
 +    return true;
 +
-+#ifdef USE_PPOLL
-+  pollfd pollfds[] = {{rfd_, POLLIN, 0}};
-+  int ret = poll(pollfds, 1, 0);
-+#else
-+  fd_set set;
-+  struct timeval timeout = { 0, 0 };
-+  FD_ZERO(&set);
-+  FD_SET(rfd_, &set);
-+  int ret = select(rfd_ + 1, &set, NULL, NULL, &timeout);
-+#endif
-+  if (ret > 0) {
-+    dup_rfd_ = dup(rfd_);
-+
-+    if (dup_rfd_ != -1) {
-+      struct sigaction act, old_act;
-+      int ret = 0;
-+
-+      memset(&act, 0, sizeof(act));
-+      act.sa_handler = CloseDupRfd;
-+      if (sigaction(SIGCHLD, &act, &old_act) == 0) {
-+        char buf;
-+
-+        // block until token read, child exits or timeout
-+        alarm(1);
-+        ret = read(dup_rfd_, &buf, 1);
-+        alarm(0);
-+
-+        sigaction(SIGCHLD, &old_act, NULL);
-+      }
-+
-+      CloseDupRfd(0);
-+
-+      if (ret > 0) {
-+        available_++;
-+        return true;
-+      }
-+    }
++  if (AcquireToken()) {
++    // token acquired
++    available_++;
++    return true;
 +  }
++
++  // no token available
 +  return false;
 +}
 +
@@ -389,15 +440,8 @@ index 0000000000..a8f9b7139d
 +}
 +
 +void GNUmakeTokenPool::Return() {
-+  const char buf = '+';
-+  while (1) {
-+    int ret = write(wfd_, &buf, 1);
-+    if (ret > 0)
-+      available_--;
-+    if ((ret != -1) || (errno != EINTR))
-+      return;
-+    // write got interrupted - retry
-+  }
++  if (ReturnToken())
++    available_--;
 +}
 +
 +void GNUmakeTokenPool::Release() {
@@ -413,55 +457,10 @@ index 0000000000..a8f9b7139d
 +  while (available_ > 1)
 +    Return();
 +}
-+
-+struct TokenPool *TokenPool::Get(void) {
-+  GNUmakeTokenPool *tokenpool = new GNUmakeTokenPool;
-+  if (tokenpool->Setup())
-+    return tokenpool;
-+  else
-+    delete tokenpool;
-+  return NULL;
-+}
-diff --git a/src/tokenpool-none.cc b/src/tokenpool-none.cc
-new file mode 100644
-index 0000000000..602b3316f5
---- /dev/null
-+++ b/src/tokenpool-none.cc
-@@ -0,0 +1,27 @@
-+// Copyright 2016 Google Inc. All Rights Reserved.
-+//
-+// Licensed under the Apache License, Version 2.0 (the "License");
-+// you may not use this file except in compliance with the License.
-+// You may obtain a copy of the License at
-+//
-+//     http://www.apache.org/licenses/LICENSE-2.0
-+//
-+// Unless required by applicable law or agreed to in writing, software
-+// distributed under the License is distributed on an "AS IS" BASIS,
-+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-+// See the License for the specific language governing permissions and
-+// limitations under the License.
-+
-+#include "tokenpool.h"
-+
-+#include <fcntl.h>
-+#include <poll.h>
-+#include <unistd.h>
-+#include <stdio.h>
-+#include <string.h>
-+#include <stdlib.h>
-+
-+// No-op TokenPool implementation
-+struct TokenPool *TokenPool::Get(void) {
-+  return NULL;
-+}
-diff --git a/src/tokenpool.h b/src/tokenpool.h
-new file mode 100644
-index 0000000000..f560b1083b
 --- /dev/null
 +++ b/src/tokenpool.h
-@@ -0,0 +1,26 @@
-+// Copyright 2016 Google Inc. All Rights Reserved.
+@@ -0,0 +1,42 @@
++// Copyright 2016-2018 Google Inc. All Rights Reserved.
 +//
 +// Licensed under the Apache License, Version 2.0 (the "License");
 +// you may not use this file except in compliance with the License.
@@ -475,6 +474,10 @@ index 0000000000..f560b1083b
 +// See the License for the specific language governing permissions and
 +// limitations under the License.
 +
++#ifdef _WIN32
++#include <windows.h>
++#endif
++
 +// interface to token pool
 +struct TokenPool {
 +  virtual ~TokenPool() {}
@@ -484,188 +487,32 @@ index 0000000000..f560b1083b
 +  virtual void Release() = 0;
 +  virtual void Clear() = 0;
 +
-+  // returns NULL if token pool is not available
-+  static struct TokenPool *Get(void);
-+};
-
-From ccaccc610cd456f6068758f82e72006364c7380b Mon Sep 17 00:00:00 2001
-From: Stefan Becker <stefanb@gpartner-nvidia.com>
-Date: Fri, 27 May 2016 16:47:10 +0300
-Subject: [PATCH 02/11] Add TokenPool monitoring to SubprocessSet::DoWork()
-
-Improve on the original jobserver client implementation. This makes
-ninja a more aggressive GNU make jobserver client.
-
-- add monitor interface to TokenPool
-- TokenPool is passed down when main loop indicates that more work is
-  ready and would be allowed to start if a token becomes available
-- posix: update DoWork() to monitor TokenPool read file descriptor
-- WaitForCommand() exits when DoWork() sets token flag
-- Main loop starts over when WaitForCommand() sets token exit status
----
- src/build.cc              | 53 +++++++++++++++++++++++++++++----------
- src/build.h               |  3 ++-
- src/build_test.cc         |  9 +++++--
- src/exit_status.h         |  3 ++-
- src/subprocess-posix.cc   | 33 ++++++++++++++++++++++--
- src/subprocess-win32.cc   |  2 +-
- src/subprocess.h          |  8 +++++-
- src/subprocess_test.cc    | 47 +++++++++++++++++++++++-----------
- src/tokenpool-gnu-make.cc |  5 ++++
- src/tokenpool.h           |  6 +++++
- 10 files changed, 134 insertions(+), 35 deletions(-)
-
-diff --git a/src/build.cc b/src/build.cc
-index fa096eac33..a25c349050 100644
---- a/src/build.cc
-+++ b/src/build.cc
-@@ -48,8 +48,9 @@ struct DryRunCommandRunner : public CommandRunner {
- 
-   // Overridden from CommandRunner:
-   virtual bool CanRunMore() const;
-+  virtual bool AcquireToken();
-   virtual bool StartCommand(Edge* edge);
--  virtual bool WaitForCommand(Result* result);
-+  virtual bool WaitForCommand(Result* result, bool more_ready);
- 
-  private:
-   queue<Edge*> finished_;
-@@ -59,12 +60,16 @@ bool DryRunCommandRunner::CanRunMore() const {
-   return true;
- }
- 
-+bool DryRunCommandRunner::AcquireToken() {
-+  return true;
-+}
-+
- bool DryRunCommandRunner::StartCommand(Edge* edge) {
-   finished_.push(edge);
-   return true;
- }
- 
--bool DryRunCommandRunner::WaitForCommand(Result* result) {
-+bool DryRunCommandRunner::WaitForCommand(Result* result, bool more_ready) {
-    if (finished_.empty())
-      return false;
- 
-@@ -452,8 +457,9 @@ struct RealCommandRunner : public CommandRunner {
-   explicit RealCommandRunner(const BuildConfig& config);
-   virtual ~RealCommandRunner();
-   virtual bool CanRunMore() const;
-+  virtual bool AcquireToken();
-   virtual bool StartCommand(Edge* edge);
--  virtual bool WaitForCommand(Result* result);
-+  virtual bool WaitForCommand(Result* result, bool more_ready);
-   virtual vector<Edge*> GetActiveEdges();
-   virtual void Abort();
- 
-@@ -490,9 +496,12 @@ bool RealCommandRunner::CanRunMore() const {
-       subprocs_.running_.size() + subprocs_.finished_.size();
-   return (int)subproc_number < config_.parallelism
-     && (subprocs_.running_.empty() ||
--        ((config_.max_load_average <= 0.0f ||
--          GetLoadAverage() < config_.max_load_average)
--      && (!tokens_ || tokens_->Acquire())));
-+        (config_.max_load_average <= 0.0f ||
-+         GetLoadAverage() < config_.max_load_average));
-+}
-+
-+bool RealCommandRunner::AcquireToken() {
-+  return (!tokens_ || tokens_->Acquire());
- }
- 
- bool RealCommandRunner::StartCommand(Edge* edge) {
-@@ -507,14 +516,23 @@ bool RealCommandRunner::StartCommand(Edge* edge) {
-   return true;
- }
- 
--bool RealCommandRunner::WaitForCommand(Result* result) {
-+bool RealCommandRunner::WaitForCommand(Result* result, bool more_ready) {
-   Subprocess* subproc;
--  while ((subproc = subprocs_.NextFinished()) == NULL) {
--    bool interrupted = subprocs_.DoWork();
-+  subprocs_.ResetTokenAvailable();
-+  while (((subproc = subprocs_.NextFinished()) == NULL) &&
-+         !subprocs_.IsTokenAvailable()) {
-+    bool interrupted = subprocs_.DoWork(more_ready ? tokens_ : NULL);
-     if (interrupted)
-       return false;
-   }
- 
-+  // token became available
-+  if (subproc == NULL) {
-+    result->status = ExitTokenAvailable;
-+    return true;
-+  }
-+
-+  // command completed
-   if (tokens_)
-     tokens_->Release();
- 
-@@ -639,9 +657,14 @@ bool Builder::Build(string* err) {
-   // command runner.
-   // Second, we attempt to wait for / reap the next finished command.
-   while (plan_.more_to_do()) {
--    // See if we can start any more commands.
--    if (failures_allowed && plan_.more_ready() &&
--        command_runner_->CanRunMore()) {
-+    // See if we can start any more commands...
-+    bool can_run_more =
-+        failures_allowed   &&
-+        plan_.more_ready() &&
-+        command_runner_->CanRunMore();
++  // returns false if token pool setup failed
++  virtual bool Setup(bool ignore, bool verbose, double& max_load_average) = 0;
 +
-+    // ... but we also need a token to do that.
-+    if (can_run_more && command_runner_->AcquireToken()) {
-       Edge* edge = plan_.FindWork();
-       if (edge->GetBindingBool("generator")) {
-           scan_.build_log()->Close();
-@@ -670,7 +693,7 @@ bool Builder::Build(string* err) {
-     // See if we can reap any finished commands.
-     if (pending_commands) {
-       CommandRunner::Result result;
--      if (!command_runner_->WaitForCommand(&result) ||
-+      if (!command_runner_->WaitForCommand(&result, can_run_more) ||
-           result.status == ExitInterrupted) {
-         Cleanup();
-         status_->BuildFinished();
-@@ -678,6 +701,10 @@ bool Builder::Build(string* err) {
-         return false;
-       }
- 
-+      // We might be able to start another command; start the main loop over.
-+      if (result.status == ExitTokenAvailable)
-+        continue;
++#ifdef _WIN32
++  virtual void WaitForTokenAvailability(HANDLE ioport) = 0;
++  // returns true if a token has become available
++  // key is result from GetQueuedCompletionStatus()
++  virtual bool TokenIsAvailable(ULONG_PTR key) = 0;
++#else
++  virtual int GetMonitorFd() = 0;
++#endif
 +
-       --pending_commands;
-       if (!FinishCommand(&result, err)) {
-         Cleanup();
-diff --git a/src/build.h b/src/build.h
-index 7dcd111e61..35c7b97d12 100644
---- a/src/build.h
-+++ b/src/build.h
-@@ -139,6 +139,7 @@ struct Plan {
- struct CommandRunner {
-   virtual ~CommandRunner() {}
-   virtual bool CanRunMore() const = 0;
-+  virtual bool AcquireToken() = 0;
-   virtual bool StartCommand(Edge* edge) = 0;
- 
-   /// The result of waiting for a command.
-@@ -150,7 +151,7 @@ struct CommandRunner {
-     bool success() const { return status == ExitSuccess; }
-   };
-   /// Wait for a command to complete, or return false if interrupted.
--  virtual bool WaitForCommand(Result* result) = 0;
-+  virtual bool WaitForCommand(Result* result, bool more_ready) = 0;
- 
-   virtual std::vector<Edge*> GetActiveEdges() { return std::vector<Edge*>(); }
-   virtual void Abort() {}
-diff --git a/src/build_test.cc b/src/build_test.cc
-index 4ef62b2113..7a5ff4015a 100644
++  // returns NULL if token pool is not available
++  static TokenPool* Get();
++};
 --- a/src/build_test.cc
 +++ b/src/build_test.cc
-@@ -474,8 +474,9 @@ struct FakeCommandRunner : public CommandRunner {
+@@ -15,6 +15,7 @@
+ #include "build.h"
+ 
+ #include <assert.h>
++#include <stdarg.h>
+ 
+ #include "build_log.h"
+ #include "deps_log.h"
+@@ -474,8 +475,9 @@ struct FakeCommandRunner : public Comman
  
    // CommandRunner impl
    virtual bool CanRunMore() const;
@@ -676,7 +523,7 @@ index 4ef62b2113..7a5ff4015a 100644
    virtual vector<Edge*> GetActiveEdges();
    virtual void Abort();
  
-@@ -578,6 +579,10 @@ bool FakeCommandRunner::CanRunMore() const {
+@@ -578,6 +580,10 @@ bool FakeCommandRunner::CanRunMore() con
    return active_edges_.size() < max_active_edges_;
  }
  
@@ -687,7 +534,7 @@ index 4ef62b2113..7a5ff4015a 100644
  bool FakeCommandRunner::StartCommand(Edge* edge) {
    assert(active_edges_.size() < max_active_edges_);
    assert(find(active_edges_.begin(), active_edges_.end(), edge)
-@@ -649,7 +654,7 @@ bool FakeCommandRunner::StartCommand(Edge* edge) {
+@@ -649,7 +655,7 @@ bool FakeCommandRunner::StartCommand(Edg
    return true;
  }
  
@@ -696,2651 +543,820 @@ index 4ef62b2113..7a5ff4015a 100644
    if (active_edges_.empty())
      return false;
  
-diff --git a/src/exit_status.h b/src/exit_status.h
-index a714ece791..75ebf6a7a0 100644
---- a/src/exit_status.h
-+++ b/src/exit_status.h
-@@ -18,7 +18,8 @@
- enum ExitStatus {
-   ExitSuccess,
-   ExitFailure,
--  ExitInterrupted
-+  ExitTokenAvailable,
-+  ExitInterrupted,
- };
- 
- #endif  // NINJA_EXIT_STATUS_H_
-diff --git a/src/subprocess-posix.cc b/src/subprocess-posix.cc
-index 8e785406c9..74451b0be2 100644
---- a/src/subprocess-posix.cc
-+++ b/src/subprocess-posix.cc
-@@ -13,6 +13,7 @@
- // limitations under the License.
- 
- #include "subprocess.h"
-+#include "tokenpool.h"
- 
- #include <sys/select.h>
- #include <assert.h>
-@@ -249,7 +250,7 @@ Subprocess *SubprocessSet::Add(const string& command, bool use_console) {
+@@ -3985,3 +3991,356 @@ TEST_F(BuildTest, ValidationWithCircular
+   EXPECT_FALSE(builder_.AddTarget("out", &err));
+   EXPECT_EQ("dependency cycle: validate -> validate_in -> validate", err);
  }
- 
- #ifdef USE_PPOLL
--bool SubprocessSet::DoWork() {
-+bool SubprocessSet::DoWork(struct TokenPool* tokens) {
-   vector<pollfd> fds;
-   nfds_t nfds = 0;
- 
-@@ -263,6 +264,12 @@ bool SubprocessSet::DoWork() {
-     ++nfds;
-   }
- 
-+  if (tokens) {
-+    pollfd pfd = { tokens->GetMonitorFd(), POLLIN | POLLPRI, 0 };
-+    fds.push_back(pfd);
-+    ++nfds;
-+  }
 +
-   interrupted_ = 0;
-   int ret = ppoll(&fds.front(), nfds, NULL, &old_mask_);
-   if (ret == -1) {
-@@ -295,11 +302,20 @@ bool SubprocessSet::DoWork() {
-     ++i;
-   }
- 
-+  if (tokens) {
-+    pollfd *pfd = &fds[nfds - 1];
-+    if (pfd->fd >= 0) {
-+      assert(pfd->fd == tokens->GetMonitorFd());
-+      if (pfd->revents != 0)
-+        token_available_ = true;
-+    }
-+  }
-+
-   return IsInterrupted();
- }
- 
- #else  // !defined(USE_PPOLL)
--bool SubprocessSet::DoWork() {
-+bool SubprocessSet::DoWork(struct TokenPool* tokens) {
-   fd_set set;
-   int nfds = 0;
-   FD_ZERO(&set);
-@@ -314,6 +330,13 @@ bool SubprocessSet::DoWork() {
-     }
-   }
- 
-+  if (tokens) {
-+    int fd = tokens->GetMonitorFd();
-+    FD_SET(fd, &set);
-+    if (nfds < fd+1)
-+      nfds = fd+1;
-+  }
-+
-   interrupted_ = 0;
-   int ret = pselect(nfds, &set, 0, 0, 0, &old_mask_);
-   if (ret == -1) {
-@@ -342,6 +365,12 @@ bool SubprocessSet::DoWork() {
-     ++i;
-   }
- 
-+  if (tokens) {
-+    int fd = tokens->GetMonitorFd();
-+    if ((fd >= 0) && FD_ISSET(fd, &set))
-+    token_available_ = true;
-+  }
-+
-   return IsInterrupted();
- }
- #endif  // !defined(USE_PPOLL)
-diff --git a/src/subprocess-win32.cc b/src/subprocess-win32.cc
-index ff3baaca7f..66d2c2c430 100644
---- a/src/subprocess-win32.cc
-+++ b/src/subprocess-win32.cc
-@@ -251,7 +251,7 @@ Subprocess *SubprocessSet::Add(const string& command, bool use_console) {
-   return subprocess;
- }
- 
--bool SubprocessSet::DoWork() {
-+bool SubprocessSet::DoWork(struct TokenPool* tokens) {
-   DWORD bytes_read;
-   Subprocess* subproc;
-   OVERLAPPED* overlapped;
-diff --git a/src/subprocess.h b/src/subprocess.h
-index 9e3d2ee98f..9ea67ea477 100644
---- a/src/subprocess.h
-+++ b/src/subprocess.h
-@@ -76,6 +76,8 @@ struct Subprocess {
-   friend struct SubprocessSet;
- };
- 
-+struct TokenPool;
-+
- /// SubprocessSet runs a ppoll/pselect() loop around a set of Subprocesses.
- /// DoWork() waits for any state change in subprocesses; finished_
- /// is a queue of subprocesses as they finish.
-@@ -84,13 +86,17 @@ struct SubprocessSet {
-   ~SubprocessSet();
- 
-   Subprocess* Add(const std::string& command, bool use_console = false);
--  bool DoWork();
-+  bool DoWork(struct TokenPool* tokens);
-   Subprocess* NextFinished();
-   void Clear();
- 
-   std::vector<Subprocess*> running_;
-   std::queue<Subprocess*> finished_;
- 
-+  bool token_available_;
-+  bool IsTokenAvailable() { return token_available_; }
-+  void ResetTokenAvailable() { token_available_ = false; }
-+
- #ifdef _WIN32
-   static BOOL WINAPI NotifyInterrupted(DWORD dwCtrlType);
-   static HANDLE ioport_;
-diff --git a/src/subprocess_test.cc b/src/subprocess_test.cc
-index 073fe86931..4bc8083e26 100644
---- a/src/subprocess_test.cc
-+++ b/src/subprocess_test.cc
-@@ -45,10 +45,12 @@ TEST_F(SubprocessTest, BadCommandStderr) {
-   Subprocess* subproc = subprocs_.Add("cmd /c ninja_no_such_command");
-   ASSERT_NE((Subprocess *) 0, subproc);
- 
-+  subprocs_.ResetTokenAvailable();
-   while (!subproc->Done()) {
-     // Pretend we discovered that stderr was ready for writing.
--    subprocs_.DoWork();
-+    subprocs_.DoWork(NULL);
-   }
-+  ASSERT_EQ(false, subprocs_.IsTokenAvailable());
- 
-   EXPECT_EQ(ExitFailure, subproc->Finish());
-   EXPECT_NE("", subproc->GetOutput());
-@@ -59,10 +61,12 @@ TEST_F(SubprocessTest, NoSuchCommand) {
-   Subprocess* subproc = subprocs_.Add("ninja_no_such_command");
-   ASSERT_NE((Subprocess *) 0, subproc);
- 
-+  subprocs_.ResetTokenAvailable();
-   while (!subproc->Done()) {
-     // Pretend we discovered that stderr was ready for writing.
--    subprocs_.DoWork();
-+    subprocs_.DoWork(NULL);
-   }
-+  ASSERT_EQ(false, subprocs_.IsTokenAvailable());
- 
-   EXPECT_EQ(ExitFailure, subproc->Finish());
-   EXPECT_NE("", subproc->GetOutput());
-@@ -78,9 +82,11 @@ TEST_F(SubprocessTest, InterruptChild) {
-   Subprocess* subproc = subprocs_.Add("kill -INT $$");
-   ASSERT_NE((Subprocess *) 0, subproc);
- 
-+  subprocs_.ResetTokenAvailable();
-   while (!subproc->Done()) {
--    subprocs_.DoWork();
-+    subprocs_.DoWork(NULL);
-   }
-+  ASSERT_EQ(false, subprocs_.IsTokenAvailable());
- 
-   EXPECT_EQ(ExitInterrupted, subproc->Finish());
- }
-@@ -90,7 +96,7 @@ TEST_F(SubprocessTest, InterruptParent) {
-   ASSERT_NE((Subprocess *) 0, subproc);
- 
-   while (!subproc->Done()) {
--    bool interrupted = subprocs_.DoWork();
-+    bool interrupted = subprocs_.DoWork(NULL);
-     if (interrupted)
-       return;
-   }
-@@ -102,9 +108,11 @@ TEST_F(SubprocessTest, InterruptChildWithSigTerm) {
-   Subprocess* subproc = subprocs_.Add("kill -TERM $$");
-   ASSERT_NE((Subprocess *) 0, subproc);
- 
-+  subprocs_.ResetTokenAvailable();
-   while (!subproc->Done()) {
--    subprocs_.DoWork();
-+    subprocs_.DoWork(NULL);
-   }
-+  ASSERT_EQ(false, subprocs_.IsTokenAvailable());
- 
-   EXPECT_EQ(ExitInterrupted, subproc->Finish());
- }
-@@ -114,7 +122,7 @@ TEST_F(SubprocessTest, InterruptParentWithSigTerm) {
-   ASSERT_NE((Subprocess *) 0, subproc);
- 
-   while (!subproc->Done()) {
--    bool interrupted = subprocs_.DoWork();
-+    bool interrupted = subprocs_.DoWork(NULL);
-     if (interrupted)
-       return;
-   }
-@@ -126,9 +134,11 @@ TEST_F(SubprocessTest, InterruptChildWithSigHup) {
-   Subprocess* subproc = subprocs_.Add("kill -HUP $$");
-   ASSERT_NE((Subprocess *) 0, subproc);
- 
-+  subprocs_.ResetTokenAvailable();
-   while (!subproc->Done()) {
--    subprocs_.DoWork();
-+    subprocs_.DoWork(NULL);
-   }
-+  ASSERT_EQ(false, subprocs_.IsTokenAvailable());
- 
-   EXPECT_EQ(ExitInterrupted, subproc->Finish());
- }
-@@ -138,7 +148,7 @@ TEST_F(SubprocessTest, InterruptParentWithSigHup) {
-   ASSERT_NE((Subprocess *) 0, subproc);
- 
-   while (!subproc->Done()) {
--    bool interrupted = subprocs_.DoWork();
-+    bool interrupted = subprocs_.DoWork(NULL);
-     if (interrupted)
-       return;
-   }
-@@ -153,9 +163,11 @@ TEST_F(SubprocessTest, Console) {
-         subprocs_.Add("test -t 0 -a -t 1 -a -t 2", /*use_console=*/true);
-     ASSERT_NE((Subprocess*)0, subproc);
- 
-+    subprocs_.ResetTokenAvailable();
-     while (!subproc->Done()) {
--      subprocs_.DoWork();
-+      subprocs_.DoWork(NULL);
-     }
-+    ASSERT_EQ(false, subprocs_.IsTokenAvailable());
- 
-     EXPECT_EQ(ExitSuccess, subproc->Finish());
-   }
-@@ -167,9 +179,11 @@ TEST_F(SubprocessTest, SetWithSingle) {
-   Subprocess* subproc = subprocs_.Add(kSimpleCommand);
-   ASSERT_NE((Subprocess *) 0, subproc);
- 
-+  subprocs_.ResetTokenAvailable();
-   while (!subproc->Done()) {
--    subprocs_.DoWork();
-+    subprocs_.DoWork(NULL);
-   }
-+  ASSERT_EQ(false, subprocs_.IsTokenAvailable());
-   ASSERT_EQ(ExitSuccess, subproc->Finish());
-   ASSERT_NE("", subproc->GetOutput());
- 
-@@ -200,12 +214,13 @@ TEST_F(SubprocessTest, SetWithMulti) {
-     ASSERT_EQ("", processes[i]->GetOutput());
-   }
- 
-+  subprocs_.ResetTokenAvailable();
-   while (!processes[0]->Done() || !processes[1]->Done() ||
-          !processes[2]->Done()) {
-     ASSERT_GT(subprocs_.running_.size(), 0u);
--    subprocs_.DoWork();
-+    subprocs_.DoWork(NULL);
-   }
--
-+  ASSERT_EQ(false, subprocs_.IsTokenAvailable());
-   ASSERT_EQ(0u, subprocs_.running_.size());
-   ASSERT_EQ(3u, subprocs_.finished_.size());
- 
-@@ -237,8 +252,10 @@ TEST_F(SubprocessTest, SetWithLots) {
-     ASSERT_NE((Subprocess *) 0, subproc);
-     procs.push_back(subproc);
-   }
-+  subprocs_.ResetTokenAvailable();
-   while (!subprocs_.running_.empty())
--    subprocs_.DoWork();
-+    subprocs_.DoWork(NULL);
-+  ASSERT_EQ(false, subprocs_.IsTokenAvailable());
-   for (size_t i = 0; i < procs.size(); ++i) {
-     ASSERT_EQ(ExitSuccess, procs[i]->Finish());
-     ASSERT_NE("", procs[i]->GetOutput());
-@@ -254,9 +271,11 @@ TEST_F(SubprocessTest, SetWithLots) {
- // that stdin is closed.
- TEST_F(SubprocessTest, ReadStdin) {
-   Subprocess* subproc = subprocs_.Add("cat -");
-+  subprocs_.ResetTokenAvailable();
-   while (!subproc->Done()) {
--    subprocs_.DoWork();
-+    subprocs_.DoWork(NULL);
-   }
-+  ASSERT_EQ(false, subprocs_.IsTokenAvailable());
-   ASSERT_EQ(ExitSuccess, subproc->Finish());
-   ASSERT_EQ(1u, subprocs_.finished_.size());
- }
-diff --git a/src/tokenpool-gnu-make.cc b/src/tokenpool-gnu-make.cc
-index a8f9b7139d..396bb7d874 100644
---- a/src/tokenpool-gnu-make.cc
-+++ b/src/tokenpool-gnu-make.cc
-@@ -33,6 +33,7 @@ struct GNUmakeTokenPool : public TokenPool {
-   virtual void Reserve();
-   virtual void Release();
-   virtual void Clear();
-+  virtual int GetMonitorFd();
- 
-   bool Setup();
- 
-@@ -201,6 +202,10 @@ void GNUmakeTokenPool::Clear() {
-     Return();
- }
- 
-+int GNUmakeTokenPool::GetMonitorFd() {
-+  return(rfd_);
-+}
-+
- struct TokenPool *TokenPool::Get(void) {
-   GNUmakeTokenPool *tokenpool = new GNUmakeTokenPool;
-   if (tokenpool->Setup())
-diff --git a/src/tokenpool.h b/src/tokenpool.h
-index f560b1083b..301e1998ee 100644
---- a/src/tokenpool.h
-+++ b/src/tokenpool.h
-@@ -21,6 +21,12 @@ struct TokenPool {
-   virtual void Release() = 0;
-   virtual void Clear() = 0;
- 
-+#ifdef _WIN32
-+  // @TODO
-+#else
-+  virtual int GetMonitorFd() = 0;
-+#endif
-+
-   // returns NULL if token pool is not available
-   static struct TokenPool *Get(void);
- };
-
-From d09f3d77821b3b1fdf09fc0ef8e814907675eafb Mon Sep 17 00:00:00 2001
-From: Stefan Becker <chemobejk@gmail.com>
-Date: Sun, 12 Nov 2017 16:58:55 +0200
-Subject: [PATCH 03/11] Ignore jobserver when -jN is forced on command line
-
-This emulates the behaviour of GNU make.
-
-- add parallelism_from_cmdline flag to build configuration
-- set the flag when -jN is given on command line
-- pass the flag to TokenPool::Get()
-- GNUmakeTokenPool::Setup()
-  * prints a warning when the flag is true and jobserver was detected
-  * returns false, i.e. jobserver will be ignored
-- ignore config.parallelism in CanRunMore() when we have a valid
-  TokenPool, because it gets always initialized to a default when not
-  given on the command line
----
- src/build.cc              | 10 ++++++----
- src/build.h               |  4 +++-
- src/ninja.cc              |  1 +
- src/tokenpool-gnu-make.cc | 34 +++++++++++++++++++---------------
- src/tokenpool-none.cc     |  4 ++--
- src/tokenpool.h           |  4 ++--
- 6 files changed, 33 insertions(+), 24 deletions(-)
-
-diff --git a/src/build.cc b/src/build.cc
-index a25c349050..406a84ec39 100644
---- a/src/build.cc
-+++ b/src/build.cc
-@@ -470,7 +470,7 @@ struct RealCommandRunner : public CommandRunner {
- };
- 
- RealCommandRunner::RealCommandRunner(const BuildConfig& config) : config_(config) {
--  tokens_ = TokenPool::Get();
-+  tokens_ = TokenPool::Get(config_.parallelism_from_cmdline);
- }
- 
- RealCommandRunner::~RealCommandRunner() {
-@@ -492,9 +492,11 @@ void RealCommandRunner::Abort() {
- }
- 
- bool RealCommandRunner::CanRunMore() const {
--  size_t subproc_number =
--      subprocs_.running_.size() + subprocs_.finished_.size();
--  return (int)subproc_number < config_.parallelism
-+  bool parallelism_limit_not_reached =
-+    tokens_ || // ignore config_.parallelism
-+    ((int) (subprocs_.running_.size() +
-+            subprocs_.finished_.size()) < config_.parallelism);
-+  return parallelism_limit_not_reached
-     && (subprocs_.running_.empty() ||
-         (config_.max_load_average <= 0.0f ||
-          GetLoadAverage() < config_.max_load_average));
-diff --git a/src/build.h b/src/build.h
-index 35c7b97d12..dfde576573 100644
---- a/src/build.h
-+++ b/src/build.h
-@@ -159,7 +159,8 @@ struct CommandRunner {
- 
- /// Options (e.g. verbosity, parallelism) passed to a build.
- struct BuildConfig {
--  BuildConfig() : verbosity(NORMAL), dry_run(false), parallelism(1),
-+  BuildConfig() : verbosity(NORMAL), dry_run(false),
-+                  parallelism(1), parallelism_from_cmdline(false),
-                   failures_allowed(1), max_load_average(-0.0f) {}
- 
-   enum Verbosity {
-@@ -171,6 +172,7 @@ struct BuildConfig {
-   Verbosity verbosity;
-   bool dry_run;
-   int parallelism;
-+  bool parallelism_from_cmdline;
-   int failures_allowed;
-   /// The maximum load average we must not exceed. A negative value
-   /// means that we do not have any limit.
-diff --git a/src/ninja.cc b/src/ninja.cc
-index df39ba92d1..d904c56c4e 100644
---- a/src/ninja.cc
-+++ b/src/ninja.cc
-@@ -1447,6 +1447,7 @@ int ReadFlags(int* argc, char*** argv,
-         // We want to run N jobs in parallel. For N = 0, INT_MAX
-         // is close enough to infinite for most sane builds.
-         config->parallelism = value > 0 ? value : INT_MAX;
-+        config->parallelism_from_cmdline = true;
-         deferGuessParallelism.needGuess = false;
-         break;
-       }
-diff --git a/src/tokenpool-gnu-make.cc b/src/tokenpool-gnu-make.cc
-index 396bb7d874..af4be05a31 100644
---- a/src/tokenpool-gnu-make.cc
-+++ b/src/tokenpool-gnu-make.cc
-@@ -1,4 +1,4 @@
--// Copyright 2016 Google Inc. All Rights Reserved.
-+// Copyright 2016-2017 Google Inc. All Rights Reserved.
- //
- // Licensed under the Apache License, Version 2.0 (the "License");
- // you may not use this file except in compliance with the License.
-@@ -35,7 +35,7 @@ struct GNUmakeTokenPool : public TokenPool {
-   virtual void Clear();
-   virtual int GetMonitorFd();
- 
--  bool Setup();
-+  bool Setup(bool ignore);
- 
-  private:
-   int available_;
-@@ -100,7 +100,7 @@ bool GNUmakeTokenPool::SetAlarmHandler() {
-   }
- }
- 
--bool GNUmakeTokenPool::Setup() {
-+bool GNUmakeTokenPool::Setup(bool ignore) {
-   const char *value = getenv("MAKEFLAGS");
-   if (value) {
-     // GNU make <= 4.1
-@@ -109,16 +109,20 @@ bool GNUmakeTokenPool::Setup() {
-     if (!jobserver)
-       jobserver = strstr(value, "--jobserver-auth=");
-     if (jobserver) {
--      int rfd = -1;
--      int wfd = -1;
--      if ((sscanf(jobserver, "%*[^=]=%d,%d", &rfd, &wfd) == 2) &&
--          CheckFd(rfd) &&
--          CheckFd(wfd) &&
--          SetAlarmHandler()) {
--        printf("ninja: using GNU make jobserver.\n");
--        rfd_ = rfd;
--        wfd_ = wfd;
--        return true;
-+      if (ignore) {
-+        printf("ninja: warning: -jN forced on command line; ignoring GNU make jobserver.\n");
-+      } else {
-+        int rfd = -1;
-+        int wfd = -1;
-+        if ((sscanf(jobserver, "%*[^=]=%d,%d", &rfd, &wfd) == 2) &&
-+            CheckFd(rfd) &&
-+            CheckFd(wfd) &&
-+            SetAlarmHandler()) {
-+          printf("ninja: using GNU make jobserver.\n");
-+          rfd_ = rfd;
-+          wfd_ = wfd;
-+          return true;
-+        }
-       }
-     }
-   }
-@@ -206,9 +210,9 @@ int GNUmakeTokenPool::GetMonitorFd() {
-   return(rfd_);
- }
- 
--struct TokenPool *TokenPool::Get(void) {
-+struct TokenPool *TokenPool::Get(bool ignore) {
-   GNUmakeTokenPool *tokenpool = new GNUmakeTokenPool;
--  if (tokenpool->Setup())
-+  if (tokenpool->Setup(ignore))
-     return tokenpool;
-   else
-     delete tokenpool;
-diff --git a/src/tokenpool-none.cc b/src/tokenpool-none.cc
-index 602b3316f5..199b22264b 100644
---- a/src/tokenpool-none.cc
-+++ b/src/tokenpool-none.cc
-@@ -1,4 +1,4 @@
--// Copyright 2016 Google Inc. All Rights Reserved.
-+// Copyright 2016-2017 Google Inc. All Rights Reserved.
- //
- // Licensed under the Apache License, Version 2.0 (the "License");
- // you may not use this file except in compliance with the License.
-@@ -22,6 +22,6 @@
- #include <stdlib.h>
- 
- // No-op TokenPool implementation
--struct TokenPool *TokenPool::Get(void) {
-+struct TokenPool *TokenPool::Get(bool ignore) {
-   return NULL;
- }
-diff --git a/src/tokenpool.h b/src/tokenpool.h
-index 301e1998ee..878a0933c2 100644
---- a/src/tokenpool.h
-+++ b/src/tokenpool.h
-@@ -1,4 +1,4 @@
--// Copyright 2016 Google Inc. All Rights Reserved.
-+// Copyright 2016-2017 Google Inc. All Rights Reserved.
- //
- // Licensed under the Apache License, Version 2.0 (the "License");
- // you may not use this file except in compliance with the License.
-@@ -28,5 +28,5 @@ struct TokenPool {
- #endif
- 
-   // returns NULL if token pool is not available
--  static struct TokenPool *Get(void);
-+  static struct TokenPool *Get(bool ignore);
- };
-
-From dfe4ca753caee65bf9041e2b4e883dfa172a5c6a Mon Sep 17 00:00:00 2001
-From: Stefan Becker <chemobejk@gmail.com>
-Date: Sun, 12 Nov 2017 18:04:12 +0200
-Subject: [PATCH 04/11] Honor -lN from MAKEFLAGS
-
-This emulates the behaviour of GNU make.
-
-- build: make a copy of max_load_average and pass it to TokenPool.
-- GNUmakeTokenPool: if we detect a jobserver and a valid -lN argument in
-  MAKEFLAGS then set max_load_average to N.
----
- src/build.cc              | 10 +++++++---
- src/tokenpool-gnu-make.cc | 19 +++++++++++++++----
- src/tokenpool-none.cc     |  2 +-
- src/tokenpool.h           |  2 +-
- 4 files changed, 24 insertions(+), 9 deletions(-)
-
-diff --git a/src/build.cc b/src/build.cc
-index 406a84ec39..9e6272d035 100644
---- a/src/build.cc
-+++ b/src/build.cc
-@@ -464,13 +464,17 @@ struct RealCommandRunner : public CommandRunner {
-   virtual void Abort();
- 
-   const BuildConfig& config_;
-+  // copy of config_.max_load_average; can be modified by TokenPool setup
-+  double max_load_average_;
-   SubprocessSet subprocs_;
-   TokenPool *tokens_;
-   map<const Subprocess*, Edge*> subproc_to_edge_;
- };
- 
- RealCommandRunner::RealCommandRunner(const BuildConfig& config) : config_(config) {
--  tokens_ = TokenPool::Get(config_.parallelism_from_cmdline);
-+  max_load_average_ = config.max_load_average;
-+  tokens_ = TokenPool::Get(config_.parallelism_from_cmdline,
-+                           max_load_average_);
- }
- 
- RealCommandRunner::~RealCommandRunner() {
-@@ -498,8 +502,8 @@ bool RealCommandRunner::CanRunMore() const {
-             subprocs_.finished_.size()) < config_.parallelism);
-   return parallelism_limit_not_reached
-     && (subprocs_.running_.empty() ||
--        (config_.max_load_average <= 0.0f ||
--         GetLoadAverage() < config_.max_load_average));
-+        (max_load_average_ <= 0.0f ||
-+         GetLoadAverage() < max_load_average_));
- }
- 
- bool RealCommandRunner::AcquireToken() {
-diff --git a/src/tokenpool-gnu-make.cc b/src/tokenpool-gnu-make.cc
-index af4be05a31..fb654c4d88 100644
---- a/src/tokenpool-gnu-make.cc
-+++ b/src/tokenpool-gnu-make.cc
-@@ -35,7 +35,7 @@ struct GNUmakeTokenPool : public TokenPool {
-   virtual void Clear();
-   virtual int GetMonitorFd();
- 
--  bool Setup(bool ignore);
-+  bool Setup(bool ignore, double& max_load_average);
- 
-  private:
-   int available_;
-@@ -100,7 +100,7 @@ bool GNUmakeTokenPool::SetAlarmHandler() {
-   }
- }
- 
--bool GNUmakeTokenPool::Setup(bool ignore) {
-+bool GNUmakeTokenPool::Setup(bool ignore, double& max_load_average) {
-   const char *value = getenv("MAKEFLAGS");
-   if (value) {
-     // GNU make <= 4.1
-@@ -118,9 +118,20 @@ bool GNUmakeTokenPool::Setup(bool ignore) {
-             CheckFd(rfd) &&
-             CheckFd(wfd) &&
-             SetAlarmHandler()) {
-+          const char *l_arg = strstr(value, " -l");
-+          int load_limit = -1;
-+
-           printf("ninja: using GNU make jobserver.\n");
-           rfd_ = rfd;
-           wfd_ = wfd;
-+
-+          // translate GNU make -lN to ninja -lN
-+          if (l_arg &&
-+              (sscanf(l_arg + 3, "%d ", &load_limit) == 1) &&
-+              (load_limit > 0)) {
-+            max_load_average = load_limit;
-+          }
-+
-           return true;
-         }
-       }
-@@ -210,9 +221,9 @@ int GNUmakeTokenPool::GetMonitorFd() {
-   return(rfd_);
- }
- 
--struct TokenPool *TokenPool::Get(bool ignore) {
-+struct TokenPool *TokenPool::Get(bool ignore, double& max_load_average) {
-   GNUmakeTokenPool *tokenpool = new GNUmakeTokenPool;
--  if (tokenpool->Setup(ignore))
-+  if (tokenpool->Setup(ignore, max_load_average))
-     return tokenpool;
-   else
-     delete tokenpool;
-diff --git a/src/tokenpool-none.cc b/src/tokenpool-none.cc
-index 199b22264b..e8e25426c3 100644
---- a/src/tokenpool-none.cc
-+++ b/src/tokenpool-none.cc
-@@ -22,6 +22,6 @@
- #include <stdlib.h>
- 
- // No-op TokenPool implementation
--struct TokenPool *TokenPool::Get(bool ignore) {
-+struct TokenPool *TokenPool::Get(bool ignore, double& max_load_average) {
-   return NULL;
- }
-diff --git a/src/tokenpool.h b/src/tokenpool.h
-index 878a0933c2..f9e8cc2ee0 100644
---- a/src/tokenpool.h
-+++ b/src/tokenpool.h
-@@ -28,5 +28,5 @@ struct TokenPool {
- #endif
- 
-   // returns NULL if token pool is not available
--  static struct TokenPool *Get(bool ignore);
-+  static struct TokenPool *Get(bool ignore, double& max_load_average);
- };
-
-From 1c10047fc6a3269ba42839da19361e09cbc06ff0 Mon Sep 17 00:00:00 2001
-From: Stefan Becker <chemobejk@gmail.com>
-Date: Wed, 6 Dec 2017 22:14:21 +0200
-Subject: [PATCH 05/11] Use LinePrinter for TokenPool messages
-
-- replace printf() with calls to LinePrinter
-- print GNU make jobserver message only when verbose build is requested
----
- src/build.cc              |  1 +
- src/tokenpool-gnu-make.cc | 22 ++++++++++++++++------
- src/tokenpool-none.cc     |  4 +++-
- src/tokenpool.h           |  4 +++-
- 4 files changed, 23 insertions(+), 8 deletions(-)
-
-diff --git a/src/build.cc b/src/build.cc
-index 9e6272d035..662e4bd7be 100644
---- a/src/build.cc
-+++ b/src/build.cc
-@@ -474,6 +474,7 @@ struct RealCommandRunner : public CommandRunner {
- RealCommandRunner::RealCommandRunner(const BuildConfig& config) : config_(config) {
-   max_load_average_ = config.max_load_average;
-   tokens_ = TokenPool::Get(config_.parallelism_from_cmdline,
-+                           config_.verbosity == BuildConfig::VERBOSE,
-                            max_load_average_);
- }
- 
-diff --git a/src/tokenpool-gnu-make.cc b/src/tokenpool-gnu-make.cc
-index fb654c4d88..b0d3e6ebc4 100644
---- a/src/tokenpool-gnu-make.cc
-+++ b/src/tokenpool-gnu-make.cc
-@@ -23,6 +23,8 @@
- #include <string.h>
- #include <stdlib.h>
- 
-+#include "line_printer.h"
-+
- // TokenPool implementation for GNU make jobserver
- // (http://make.mad-scientist.net/papers/jobserver-implementation/)
- struct GNUmakeTokenPool : public TokenPool {
-@@ -35,7 +37,7 @@ struct GNUmakeTokenPool : public TokenPool {
-   virtual void Clear();
-   virtual int GetMonitorFd();
- 
--  bool Setup(bool ignore, double& max_load_average);
-+  bool Setup(bool ignore, bool verbose, double& max_load_average);
- 
-  private:
-   int available_;
-@@ -100,7 +102,9 @@ bool GNUmakeTokenPool::SetAlarmHandler() {
-   }
- }
- 
--bool GNUmakeTokenPool::Setup(bool ignore, double& max_load_average) {
-+bool GNUmakeTokenPool::Setup(bool ignore,
-+                             bool verbose,
-+                             double& max_load_average) {
-   const char *value = getenv("MAKEFLAGS");
-   if (value) {
-     // GNU make <= 4.1
-@@ -109,8 +113,10 @@ bool GNUmakeTokenPool::Setup(bool ignore, double& max_load_average) {
-     if (!jobserver)
-       jobserver = strstr(value, "--jobserver-auth=");
-     if (jobserver) {
-+      LinePrinter printer;
-+
-       if (ignore) {
--        printf("ninja: warning: -jN forced on command line; ignoring GNU make jobserver.\n");
-+        printer.PrintOnNewLine("ninja: warning: -jN forced on command line; ignoring GNU make jobserver.\n");
-       } else {
-         int rfd = -1;
-         int wfd = -1;
-@@ -121,7 +127,9 @@ bool GNUmakeTokenPool::Setup(bool ignore, double& max_load_average) {
-           const char *l_arg = strstr(value, " -l");
-           int load_limit = -1;
- 
--          printf("ninja: using GNU make jobserver.\n");
-+          if (verbose) {
-+            printer.PrintOnNewLine("ninja: using GNU make jobserver.\n");
-+          }
-           rfd_ = rfd;
-           wfd_ = wfd;
- 
-@@ -221,9 +229,11 @@ int GNUmakeTokenPool::GetMonitorFd() {
-   return(rfd_);
- }
- 
--struct TokenPool *TokenPool::Get(bool ignore, double& max_load_average) {
-+struct TokenPool *TokenPool::Get(bool ignore,
-+                                 bool verbose,
-+                                 double& max_load_average) {
-   GNUmakeTokenPool *tokenpool = new GNUmakeTokenPool;
--  if (tokenpool->Setup(ignore, max_load_average))
-+  if (tokenpool->Setup(ignore, verbose, max_load_average))
-     return tokenpool;
-   else
-     delete tokenpool;
-diff --git a/src/tokenpool-none.cc b/src/tokenpool-none.cc
-index e8e25426c3..1c1c499c8d 100644
---- a/src/tokenpool-none.cc
-+++ b/src/tokenpool-none.cc
-@@ -22,6 +22,8 @@
- #include <stdlib.h>
- 
- // No-op TokenPool implementation
--struct TokenPool *TokenPool::Get(bool ignore, double& max_load_average) {
-+struct TokenPool *TokenPool::Get(bool ignore,
-+                                 bool verbose,
-+                                 double& max_load_average) {
-   return NULL;
- }
-diff --git a/src/tokenpool.h b/src/tokenpool.h
-index f9e8cc2ee0..4bf477f20c 100644
---- a/src/tokenpool.h
-+++ b/src/tokenpool.h
-@@ -28,5 +28,7 @@ struct TokenPool {
- #endif
- 
-   // returns NULL if token pool is not available
--  static struct TokenPool *Get(bool ignore, double& max_load_average);
-+  static struct TokenPool *Get(bool ignore,
-+                               bool verbose,
-+                               double& max_load_average);
- };
-
-From fdbf68416e3574add3bffd0b637d0694fbaba320 Mon Sep 17 00:00:00 2001
-From: Stefan Becker <chemobejk@gmail.com>
-Date: Sat, 7 Apr 2018 17:11:21 +0300
-Subject: [PATCH 06/11] Prepare PR for merging
-
-- fix Windows build error in no-op TokenPool implementation
-- improve Acquire() to block for a maximum of 100ms
-- address review comments
----
- src/build.h               |  2 ++
- src/tokenpool-gnu-make.cc | 53 +++++++++++++++++++++++++++++++++------
- src/tokenpool-none.cc     |  7 +-----
- 3 files changed, 49 insertions(+), 13 deletions(-)
-
-diff --git a/src/build.h b/src/build.h
-index dfde576573..66ddefb888 100644
---- a/src/build.h
-+++ b/src/build.h
-@@ -151,6 +151,8 @@ struct CommandRunner {
-     bool success() const { return status == ExitSuccess; }
-   };
-   /// Wait for a command to complete, or return false if interrupted.
-+  /// If more_ready is true then the optional TokenPool is monitored too
-+  /// and we return when a token becomes available.
-   virtual bool WaitForCommand(Result* result, bool more_ready) = 0;
- 
-   virtual std::vector<Edge*> GetActiveEdges() { return std::vector<Edge*>(); }
-diff --git a/src/tokenpool-gnu-make.cc b/src/tokenpool-gnu-make.cc
-index b0d3e6ebc4..4132bb06d9 100644
---- a/src/tokenpool-gnu-make.cc
-+++ b/src/tokenpool-gnu-make.cc
-@@ -1,4 +1,4 @@
--// Copyright 2016-2017 Google Inc. All Rights Reserved.
-+// Copyright 2016-2018 Google Inc. All Rights Reserved.
- //
- // Licensed under the Apache License, Version 2.0 (the "License");
- // you may not use this file except in compliance with the License.
-@@ -19,6 +19,7 @@
- #include <poll.h>
- #include <unistd.h>
- #include <signal.h>
-+#include <sys/time.h>
- #include <stdio.h>
- #include <string.h>
- #include <stdlib.h>
-@@ -153,6 +154,15 @@ bool GNUmakeTokenPool::Acquire() {
-   if (available_ > 0)
-     return true;
- 
-+  // Please read
-+  //
-+  //   http://make.mad-scientist.net/papers/jobserver-implementation/
-+  //
-+  // for the reasoning behind the following code.
-+  //
-+  // Try to read one character from the pipe. Returns true on success.
-+  //
-+  // First check if read() would succeed without blocking.
- #ifdef USE_PPOLL
-   pollfd pollfds[] = {{rfd_, POLLIN, 0}};
-   int ret = poll(pollfds, 1, 0);
-@@ -164,33 +174,62 @@ bool GNUmakeTokenPool::Acquire() {
-   int ret = select(rfd_ + 1, &set, NULL, NULL, &timeout);
- #endif
-   if (ret > 0) {
-+    // Handle potential race condition:
-+    //  - the above check succeeded, i.e. read() should not block
-+    //  - the character disappears before we call read()
-+    //
-+    // Create a duplicate of rfd_. The duplicate file descriptor dup_rfd_
-+    // can safely be closed by signal handlers without affecting rfd_.
-     dup_rfd_ = dup(rfd_);
- 
-     if (dup_rfd_ != -1) {
-       struct sigaction act, old_act;
-       int ret = 0;
- 
-+      // Temporarily replace SIGCHLD handler with our own
-       memset(&act, 0, sizeof(act));
-       act.sa_handler = CloseDupRfd;
-       if (sigaction(SIGCHLD, &act, &old_act) == 0) {
--        char buf;
--
--        // block until token read, child exits or timeout
--        alarm(1);
--        ret = read(dup_rfd_, &buf, 1);
--        alarm(0);
-+        struct itimerval timeout;
-+
-+        // install a 100ms timeout that generates SIGALARM on expiration
-+        memset(&timeout, 0, sizeof(timeout));
-+        timeout.it_value.tv_usec = 100 * 1000; // [ms] -> [usec]
-+        if (setitimer(ITIMER_REAL, &timeout, NULL) == 0) {
-+          char buf;
-+
-+          // Now try to read() from dup_rfd_. Return values from read():
-+          //
-+          // 1. token read                               ->  1
-+          // 2. pipe closed                              ->  0
-+          // 3. alarm expires                            -> -1 (EINTR)
-+          // 4. child exits                              -> -1 (EINTR)
-+          // 5. alarm expired before entering read()     -> -1 (EBADF)
-+          // 6. child exited before entering read()      -> -1 (EBADF)
-+          // 7. child exited before handler is installed -> go to 1 - 3
-+          ret = read(dup_rfd_, &buf, 1);
-+
-+          // disarm timer
-+          memset(&timeout, 0, sizeof(timeout));
-+          setitimer(ITIMER_REAL, &timeout, NULL);
-+        }
- 
-         sigaction(SIGCHLD, &old_act, NULL);
-       }
- 
-       CloseDupRfd(0);
- 
-+      // Case 1 from above list
-       if (ret > 0) {
-         available_++;
-         return true;
-       }
-     }
-   }
-+
-+  // read() would block, i.e. no token available,
-+  // cases 2-6 from above list or
-+  // select() / poll() / dup() / sigaction() / setitimer() failed
-   return false;
- }
- 
-diff --git a/src/tokenpool-none.cc b/src/tokenpool-none.cc
-index 1c1c499c8d..4c592875b4 100644
---- a/src/tokenpool-none.cc
-+++ b/src/tokenpool-none.cc
-@@ -1,4 +1,4 @@
--// Copyright 2016-2017 Google Inc. All Rights Reserved.
-+// Copyright 2016-2018 Google Inc. All Rights Reserved.
- //
- // Licensed under the Apache License, Version 2.0 (the "License");
- // you may not use this file except in compliance with the License.
-@@ -14,11 +14,6 @@
- 
- #include "tokenpool.h"
- 
--#include <fcntl.h>
--#include <poll.h>
--#include <unistd.h>
--#include <stdio.h>
--#include <string.h>
- #include <stdlib.h>
- 
- // No-op TokenPool implementation
-
-From ec6220a0baf7d3a6eaf1a2b75bf8960ddfe24c2f Mon Sep 17 00:00:00 2001
-From: Stefan Becker <chemobejk@gmail.com>
-Date: Fri, 25 May 2018 00:17:07 +0300
-Subject: [PATCH 07/11] Add tests for TokenPool
-
-- TokenPool setup
-- GetMonitorFd() API
-- implicit token and tokens in jobserver pipe
-- Acquire() / Reserve() / Release() protocol
-- Clear() API
----
- configure.py          |   1 +
- src/tokenpool_test.cc | 198 ++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 199 insertions(+)
- create mode 100644 src/tokenpool_test.cc
-
-diff --git a/configure.py b/configure.py
-index db3492c93c..dc8a0066b7 100755
---- a/configure.py
-+++ b/configure.py
-@@ -590,6 +590,7 @@ def has_re2c():
-              'string_piece_util_test',
-              'subprocess_test',
-              'test',
-+             'tokenpool_test',
-              'util_test']:
-     objs += cxx(name, variables=cxxvariables)
- if platform.is_windows():
-diff --git a/src/tokenpool_test.cc b/src/tokenpool_test.cc
-new file mode 100644
-index 0000000000..6c89064ca4
---- /dev/null
-+++ b/src/tokenpool_test.cc
-@@ -0,0 +1,198 @@
-+// Copyright 2018 Google Inc. All Rights Reserved.
-+//
-+// Licensed under the Apache License, Version 2.0 (the "License");
-+// you may not use this file except in compliance with the License.
-+// You may obtain a copy of the License at
-+//
-+//     http://www.apache.org/licenses/LICENSE-2.0
-+//
-+// Unless required by applicable law or agreed to in writing, software
-+// distributed under the License is distributed on an "AS IS" BASIS,
-+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-+// See the License for the specific language governing permissions and
-+// limitations under the License.
-+
-+#include "tokenpool.h"
-+
-+#include "test.h"
-+
-+#ifndef _WIN32
-+#include <stdio.h>
-+#include <stdlib.h>
-+#include <unistd.h>
-+
-+#define ENVIRONMENT_CLEAR() unsetenv("MAKEFLAGS")
-+#define ENVIRONMENT_INIT(v) setenv("MAKEFLAGS", v, true);
-+#endif
-+
-+namespace {
-+
-+const double kLoadAverageDefault = -1.23456789;
-+
-+struct TokenPoolTest : public testing::Test {
-+  double load_avg_;
-+  TokenPool *tokens_;
-+#ifndef _WIN32
-+  char buf_[1024];
-+  int fds_[2];
-+#endif
-+
-+  virtual void SetUp() {
-+    load_avg_ = kLoadAverageDefault;
-+    tokens_ = NULL;
-+#ifndef _WIN32
-+    ENVIRONMENT_CLEAR();
-+    if (pipe(fds_) < 0)
-+      ASSERT_TRUE(false);
-+#endif
-+  }
-+
-+  void CreatePool(const char *format, bool ignore_jobserver) {
-+#ifndef _WIN32
-+    if (format) {
-+      sprintf(buf_, format, fds_[0], fds_[1]);
-+      ENVIRONMENT_INIT(buf_);
-+    }
-+#endif
-+    tokens_ = TokenPool::Get(ignore_jobserver, false, load_avg_);
-+  }
-+
-+  void CreateDefaultPool() {
-+    CreatePool("foo --jobserver-auth=%d,%d bar", false);
-+  }
-+
-+  virtual void TearDown() {
-+    if (tokens_)
-+      delete tokens_;
-+#ifndef _WIN32
-+    close(fds_[0]);
-+    close(fds_[1]);
-+    ENVIRONMENT_CLEAR();
-+#endif
-+  }
-+};
-+
-+} // anonymous namespace
-+
-+// verifies none implementation
-+TEST_F(TokenPoolTest, NoTokenPool) {
-+  CreatePool(NULL, false);
-+
-+  EXPECT_EQ(NULL, tokens_);
-+  EXPECT_EQ(kLoadAverageDefault, load_avg_);
-+}
-+
-+#ifndef _WIN32
-+TEST_F(TokenPoolTest, SuccessfulOldSetup) {
-+  // GNUmake <= 4.1
-+  CreatePool("foo --jobserver-fds=%d,%d bar", false);
-+
-+  EXPECT_NE(NULL, tokens_);
-+  EXPECT_EQ(kLoadAverageDefault, load_avg_);
-+}
-+
-+TEST_F(TokenPoolTest, SuccessfulNewSetup) {
-+  // GNUmake => 4.2
-+  CreateDefaultPool();
-+
-+  EXPECT_NE(NULL, tokens_);
-+  EXPECT_EQ(kLoadAverageDefault, load_avg_);
-+}
-+
-+TEST_F(TokenPoolTest, IgnoreWithJN) {
-+  CreatePool("foo --jobserver-auth=%d,%d bar", true);
-+
-+  EXPECT_EQ(NULL, tokens_);
-+  EXPECT_EQ(kLoadAverageDefault, load_avg_);
-+}
-+
-+TEST_F(TokenPoolTest, HonorLN) {
-+  CreatePool("foo -l9 --jobserver-auth=%d,%d bar", false);
-+
-+  EXPECT_NE(NULL, tokens_);
-+  EXPECT_EQ(9.0, load_avg_);
-+}
-+
-+TEST_F(TokenPoolTest, MonitorFD) {
-+  CreateDefaultPool();
-+
-+  ASSERT_NE(NULL, tokens_);
-+  EXPECT_EQ(kLoadAverageDefault, load_avg_);
-+
-+  EXPECT_EQ(fds_[0], tokens_->GetMonitorFd());
-+}
-+
-+TEST_F(TokenPoolTest, ImplicitToken) {
-+  CreateDefaultPool();
-+
-+  ASSERT_NE(NULL, tokens_);
-+  EXPECT_EQ(kLoadAverageDefault, load_avg_);
-+
-+  EXPECT_TRUE(tokens_->Acquire());
-+  tokens_->Reserve();
-+  EXPECT_FALSE(tokens_->Acquire());
-+  tokens_->Release();
-+  EXPECT_TRUE(tokens_->Acquire());
-+}
-+
-+TEST_F(TokenPoolTest, TwoTokens) {
-+  CreateDefaultPool();
-+
-+  ASSERT_NE(NULL, tokens_);
-+  EXPECT_EQ(kLoadAverageDefault, load_avg_);
-+
-+  // implicit token
-+  EXPECT_TRUE(tokens_->Acquire());
-+  tokens_->Reserve();
-+  EXPECT_FALSE(tokens_->Acquire());
-+
-+  // jobserver offers 2nd token
-+  ASSERT_EQ(1u, write(fds_[1], "T", 1));
-+  EXPECT_TRUE(tokens_->Acquire());
-+  tokens_->Reserve();
-+  EXPECT_FALSE(tokens_->Acquire());
-+
-+  // release 2nd token
-+  tokens_->Release();
-+  EXPECT_TRUE(tokens_->Acquire());
-+
-+  // release implict token - must return 2nd token back to jobserver
-+  tokens_->Release();
-+  EXPECT_TRUE(tokens_->Acquire());
-+
-+  // there must be one token in the pipe
-+  EXPECT_EQ(1u, read(fds_[0], buf_, sizeof(buf_)));
-+
-+  // implicit token
-+  EXPECT_TRUE(tokens_->Acquire());
-+}
-+
-+TEST_F(TokenPoolTest, Clear) {
-+  CreateDefaultPool();
-+
-+  ASSERT_NE(NULL, tokens_);
-+  EXPECT_EQ(kLoadAverageDefault, load_avg_);
-+
-+  // implicit token
-+  EXPECT_TRUE(tokens_->Acquire());
-+  tokens_->Reserve();
-+  EXPECT_FALSE(tokens_->Acquire());
-+
-+  // jobserver offers 2nd & 3rd token
-+  ASSERT_EQ(2u, write(fds_[1], "TT", 2));
-+  EXPECT_TRUE(tokens_->Acquire());
-+  tokens_->Reserve();
-+  EXPECT_TRUE(tokens_->Acquire());
-+  tokens_->Reserve();
-+  EXPECT_FALSE(tokens_->Acquire());
-+
-+  tokens_->Clear();
-+  EXPECT_TRUE(tokens_->Acquire());
-+
-+  // there must be two tokens in the pipe
-+  EXPECT_EQ(2u, read(fds_[0], buf_, sizeof(buf_)));
-+
-+  // implicit token
-+  EXPECT_TRUE(tokens_->Acquire());
-+}
-+#endif
-
-From e59d8858327126d1593fd0b8e607975a79072e92 Mon Sep 17 00:00:00 2001
-From: Stefan Becker <chemobejk@gmail.com>
-Date: Thu, 24 May 2018 18:52:45 +0300
-Subject: [PATCH 08/11] Add tests for subprocess module
-
-- add TokenPoolTest stub to provide TokenPool::GetMonitorFd()
-- add two tests
-  * both tests set up a dummy GNUmake jobserver pipe
-  * both tests call DoWork() with TokenPoolTest
-  * test 1: verify that DoWork() detects when a token is available
-  * test 2: verify that DoWork() works as before without a token
-- the tests are not compiled in under Windows
----
- src/subprocess_test.cc | 76 ++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 76 insertions(+)
-
-diff --git a/src/subprocess_test.cc b/src/subprocess_test.cc
-index 4bc8083e26..6264c8bf11 100644
---- a/src/subprocess_test.cc
-+++ b/src/subprocess_test.cc
-@@ -13,6 +13,7 @@
- // limitations under the License.
- 
- #include "subprocess.h"
-+#include "tokenpool.h"
- 
- #include "test.h"
- 
-@@ -34,8 +35,23 @@ const char* kSimpleCommand = "cmd /c dir \\";
- const char* kSimpleCommand = "ls /";
- #endif
- 
-+struct TokenPoolTest : public TokenPool {
-+  bool Acquire()     { return false; }
-+  void Reserve()     {}
-+  void Release()     {}
-+  void Clear()       {}
-+
-+#ifdef _WIN32
-+  // @TODO
-+#else
-+  int _fd;
-+  int GetMonitorFd() { return _fd; }
-+#endif
-+};
-+
- struct SubprocessTest : public testing::Test {
-   SubprocessSet subprocs_;
-+  TokenPoolTest tokens_;
- };
- 
- }  // anonymous namespace
-@@ -280,3 +296,63 @@ TEST_F(SubprocessTest, ReadStdin) {
-   ASSERT_EQ(1u, subprocs_.finished_.size());
- }
- #endif  // _WIN32
-+
-+// @TODO: remove once TokenPool implementation for Windows is available
-+#ifndef _WIN32
-+TEST_F(SubprocessTest, TokenAvailable) {
-+  Subprocess* subproc = subprocs_.Add(kSimpleCommand);
-+  ASSERT_NE((Subprocess *) 0, subproc);
-+
-+  // simulate GNUmake jobserver pipe with 1 token
-+  int fds[2];
-+  ASSERT_EQ(0u, pipe(fds));
-+  tokens_._fd = fds[0];
-+  ASSERT_EQ(1u, write(fds[1], "T", 1));
-+
-+  subprocs_.ResetTokenAvailable();
-+  subprocs_.DoWork(&tokens_);
-+
-+  EXPECT_TRUE(subprocs_.IsTokenAvailable());
-+  EXPECT_EQ(0u, subprocs_.finished_.size());
-+
-+  // remove token to let DoWork() wait for command again
-+  char token;
-+  ASSERT_EQ(1u, read(fds[0], &token, 1));
-+
-+  while (!subproc->Done()) {
-+    subprocs_.DoWork(&tokens_);
-+  }
-+
-+  close(fds[1]);
-+  close(fds[0]);
-+
-+  EXPECT_EQ(ExitSuccess, subproc->Finish());
-+  EXPECT_NE("", subproc->GetOutput());
-+
-+  EXPECT_EQ(1u, subprocs_.finished_.size());
-+}
-+
-+TEST_F(SubprocessTest, TokenNotAvailable) {
-+  Subprocess* subproc = subprocs_.Add(kSimpleCommand);
-+  ASSERT_NE((Subprocess *) 0, subproc);
-+
-+  // simulate GNUmake jobserver pipe with 0 tokens
-+  int fds[2];
-+  ASSERT_EQ(0u, pipe(fds));
-+  tokens_._fd = fds[0];
-+
-+  subprocs_.ResetTokenAvailable();
-+  while (!subproc->Done()) {
-+    subprocs_.DoWork(&tokens_);
-+  }
-+
-+  close(fds[1]);
-+  close(fds[0]);
-+
-+  EXPECT_FALSE(subprocs_.IsTokenAvailable());
-+  EXPECT_EQ(ExitSuccess, subproc->Finish());
-+  EXPECT_NE("", subproc->GetOutput());
-+
-+  EXPECT_EQ(1u, subprocs_.finished_.size());
-+}
-+#endif  // _WIN32
-
-From 0145e2d4db64ea6c21aeb371928e4071f65164eb Mon Sep 17 00:00:00 2001
-From: Stefan Becker <chemobejk@gmail.com>
-Date: Sat, 26 May 2018 23:17:51 +0300
-Subject: [PATCH 09/11] Add tests for build module
-
-Add tests that verify the token functionality of the builder main loop.
-We replace the default fake command runner with a special version where
-the tests can control each call to AcquireToken(), CanRunMore() and
-WaitForCommand().
----
- src/build_test.cc | 364 ++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 364 insertions(+)
-
-diff --git a/src/build_test.cc b/src/build_test.cc
-index 7a5ff4015a..dd41dfbe1d 100644
---- a/src/build_test.cc
-+++ b/src/build_test.cc
-@@ -15,6 +15,7 @@
- #include "build.h"
- 
- #include <assert.h>
-+#include <stdarg.h>
- 
- #include "build_log.h"
- #include "deps_log.h"
-@@ -3990,3 +3991,366 @@ TEST_F(BuildTest, ValidationWithCircularDependency) {
-   EXPECT_FALSE(builder_.AddTarget("out", &err));
-   EXPECT_EQ("dependency cycle: validate -> validate_in -> validate", err);
- }
-+
-+/// The token tests are concerned with the main loop functionality when
-+// the CommandRunner has an active TokenPool. It is therefore intentional
-+// that the plan doesn't complete and that builder_.Build() returns false!
-+
-+/// Fake implementation of CommandRunner that simulates a TokenPool
-+struct FakeTokenCommandRunner : public CommandRunner {
-+  explicit FakeTokenCommandRunner() {}
-+
-+  // CommandRunner impl
-+  virtual bool CanRunMore() const;
-+  virtual bool AcquireToken();
-+  virtual bool StartCommand(Edge* edge);
-+  virtual bool WaitForCommand(Result* result, bool more_ready);
-+  virtual vector<Edge*> GetActiveEdges();
-+  virtual void Abort();
-+
-+  vector<string> commands_ran_;
-+  vector<Edge *> edges_;
-+
-+  vector<bool> acquire_token_;
-+  vector<bool> can_run_more_;
-+  vector<bool> wait_for_command_;
-+};
-+
-+bool FakeTokenCommandRunner::CanRunMore() const {
-+  if (can_run_more_.size() == 0) {
-+    EXPECT_FALSE("unexpected call to CommandRunner::CanRunMore()");
-+    return false;
-+  }
-+
-+  bool result = can_run_more_[0];
-+
-+  // Unfortunately CanRunMore() isn't "const" for tests
-+  const_cast<FakeTokenCommandRunner*>(this)->can_run_more_.erase(
-+    const_cast<FakeTokenCommandRunner*>(this)->can_run_more_.begin()
-+  );
-+
-+  return result;
-+}
-+
-+bool FakeTokenCommandRunner::AcquireToken() {
-+  if (acquire_token_.size() == 0) {
-+    EXPECT_FALSE("unexpected call to CommandRunner::AcquireToken()");
-+    return false;
-+  }
-+
-+  bool result = acquire_token_[0];
-+  acquire_token_.erase(acquire_token_.begin());
-+  return result;
-+}
-+
-+bool FakeTokenCommandRunner::StartCommand(Edge* edge) {
-+  commands_ran_.push_back(edge->EvaluateCommand());
-+  edges_.push_back(edge);
-+  return true;
-+}
-+
-+bool FakeTokenCommandRunner::WaitForCommand(Result* result, bool more_ready) {
-+  if (wait_for_command_.size() == 0) {
-+    EXPECT_FALSE("unexpected call to CommandRunner::WaitForCommand()");
-+    return false;
-+  }
-+
-+  bool expected = wait_for_command_[0];
-+  if (expected != more_ready) {
-+    EXPECT_EQ(expected, more_ready);
-+    return false;
-+  }
-+  wait_for_command_.erase(wait_for_command_.begin());
-+
-+  if (edges_.size() == 0)
-+    return false;
-+
-+  Edge* edge = edges_[0];
-+  result->edge = edge;
-+
-+  if (more_ready &&
-+      (edge->rule().name() == "token-available")) {
-+    result->status = ExitTokenAvailable;
-+  } else {
-+    edges_.erase(edges_.begin());
-+    result->status = ExitSuccess;
-+  }
-+
-+  return true;
-+}
-+
-+vector<Edge*> FakeTokenCommandRunner::GetActiveEdges() {
-+  return edges_;
-+}
-+
-+void FakeTokenCommandRunner::Abort() {
-+  edges_.clear();
-+}
-+
-+struct BuildTokenTest : public BuildTest {
-+  virtual void SetUp();
-+  virtual void TearDown();
-+
-+  FakeTokenCommandRunner token_command_runner_;
-+
-+  void ExpectAcquireToken(int count, ...);
-+  void ExpectCanRunMore(int count, ...);
-+  void ExpectWaitForCommand(int count, ...);
-+
-+private:
-+  void EnqueueBooleans(vector<bool>& booleans, int count, va_list ao);
-+};
-+
-+void BuildTokenTest::SetUp() {
-+  BuildTest::SetUp();
-+
-+  // replace FakeCommandRunner with FakeTokenCommandRunner
-+  builder_.command_runner_.release();
-+  builder_.command_runner_.reset(&token_command_runner_);
-+}
-+void BuildTokenTest::TearDown() {
-+  EXPECT_EQ(0u, token_command_runner_.acquire_token_.size());
-+  EXPECT_EQ(0u, token_command_runner_.can_run_more_.size());
-+  EXPECT_EQ(0u, token_command_runner_.wait_for_command_.size());
-+
-+  BuildTest::TearDown();
-+}
-+
-+void BuildTokenTest::ExpectAcquireToken(int count, ...) {
-+  va_list ap;
-+  va_start(ap, count);
-+  EnqueueBooleans(token_command_runner_.acquire_token_, count, ap);
-+  va_end(ap);
-+}
-+
-+void BuildTokenTest::ExpectCanRunMore(int count, ...) {
-+  va_list ap;
-+  va_start(ap, count);
-+  EnqueueBooleans(token_command_runner_.can_run_more_, count, ap);
-+  va_end(ap);
-+}
-+
-+void BuildTokenTest::ExpectWaitForCommand(int count, ...) {
-+  va_list ap;
-+  va_start(ap, count);
-+  EnqueueBooleans(token_command_runner_.wait_for_command_, count, ap);
-+  va_end(ap);
-+}
-+
-+void BuildTokenTest::EnqueueBooleans(vector<bool>& booleans, int count, va_list ap) {
-+  while (count--) {
-+    int value = va_arg(ap, int);
-+    booleans.push_back(!!value); // force bool
-+  }
-+}
-+
-+TEST_F(BuildTokenTest, CompleteNoWork) {
-+  // plan should not execute anything
-+  string err;
-+
-+  EXPECT_TRUE(builder_.Build(&err));
-+  EXPECT_EQ("", err);
-+
-+  EXPECT_EQ(0u, token_command_runner_.commands_ran_.size());
-+}
-+
-+TEST_F(BuildTokenTest, DoNotAquireToken) {
-+  // plan should execute one command
-+  string err;
-+  EXPECT_TRUE(builder_.AddTarget("cat1", &err));
-+  ASSERT_EQ("", err);
-+
-+  // pretend we can't run anything
-+  ExpectCanRunMore(1, false);
-+
-+  EXPECT_FALSE(builder_.Build(&err));
-+  EXPECT_EQ("stuck [this is a bug]", err);
-+
-+  EXPECT_EQ(0u, token_command_runner_.commands_ran_.size());
-+}
-+
-+TEST_F(BuildTokenTest, DoNotStartWithoutToken) {
-+  // plan should execute one command
-+  string err;
-+  EXPECT_TRUE(builder_.AddTarget("cat1", &err));
-+  ASSERT_EQ("", err);
-+
-+  // we could run a command but do not have a token for it
-+  ExpectCanRunMore(1,   true);
-+  ExpectAcquireToken(1, false);
-+
-+  EXPECT_FALSE(builder_.Build(&err));
-+  EXPECT_EQ("stuck [this is a bug]", err);
-+
-+  EXPECT_EQ(0u, token_command_runner_.commands_ran_.size());
-+}
-+
-+TEST_F(BuildTokenTest, CompleteOneStep) {
-+  // plan should execute one command
-+  string err;
-+  EXPECT_TRUE(builder_.AddTarget("cat1", &err));
-+  ASSERT_EQ("", err);
-+
-+  // allow running of one command
-+  ExpectCanRunMore(1,   true);
-+  ExpectAcquireToken(1, true);
-+  // block and wait for command to finalize
-+  ExpectWaitForCommand(1, false);
-+
-+  EXPECT_TRUE(builder_.Build(&err));
-+  EXPECT_EQ("", err);
-+
-+  EXPECT_EQ(1u, token_command_runner_.commands_ran_.size());
-+  EXPECT_TRUE(token_command_runner_.commands_ran_[0] == "cat in1 > cat1");
-+}
-+
-+TEST_F(BuildTokenTest, AcquireOneToken) {
-+  // plan should execute more than one command
-+  string err;
-+  EXPECT_TRUE(builder_.AddTarget("cat12", &err));
-+  ASSERT_EQ("", err);
-+
-+  // allow running of one command
-+  ExpectCanRunMore(3,     true, false, false);
-+  ExpectAcquireToken(1,   true);
-+  // block and wait for command to finalize
-+  ExpectWaitForCommand(1, false);
-+
-+  EXPECT_FALSE(builder_.Build(&err));
-+  EXPECT_EQ("stuck [this is a bug]", err);
-+
-+  EXPECT_EQ(1u, token_command_runner_.commands_ran_.size());
-+  // any of the two dependencies could have been executed
-+  EXPECT_TRUE(token_command_runner_.commands_ran_[0] == "cat in1 > cat1" ||
-+              token_command_runner_.commands_ran_[0] == "cat in1 in2 > cat2");
-+}
-+
-+TEST_F(BuildTokenTest, WantTwoTokens) {
-+  // plan should execute more than one command
-+  string err;
-+  EXPECT_TRUE(builder_.AddTarget("cat12", &err));
-+  ASSERT_EQ("", err);
-+
-+  // allow running of one command
-+  ExpectCanRunMore(3,     true, true, false);
-+  ExpectAcquireToken(2,   true, false);
-+  // wait for command to finalize or token to become available
-+  ExpectWaitForCommand(1, true);
-+
-+  EXPECT_FALSE(builder_.Build(&err));
-+  EXPECT_EQ("stuck [this is a bug]", err);
-+
-+  EXPECT_EQ(1u, token_command_runner_.commands_ran_.size());
-+  // any of the two dependencies could have been executed
-+  EXPECT_TRUE(token_command_runner_.commands_ran_[0] == "cat in1 > cat1" ||
-+              token_command_runner_.commands_ran_[0] == "cat in1 in2 > cat2");
-+}
-+
-+TEST_F(BuildTokenTest, CompleteTwoSteps) {
-+  ASSERT_NO_FATAL_FAILURE(AssertParse(&state_,
-+"build out1: cat in1\n"
-+"build out2: cat out1\n"));
-+
-+  // plan should execute more than one command
-+  string err;
-+  EXPECT_TRUE(builder_.AddTarget("out2", &err));
-+  ASSERT_EQ("", err);
-+
-+  // allow running of two commands
-+  ExpectCanRunMore(2,     true, true);
-+  ExpectAcquireToken(2,   true, true);
-+  // wait for commands to finalize
-+  ExpectWaitForCommand(2, false, false);
-+
-+  EXPECT_TRUE(builder_.Build(&err));
-+  EXPECT_EQ("", err);
-+
-+  EXPECT_EQ(2u, token_command_runner_.commands_ran_.size());
-+  EXPECT_TRUE(token_command_runner_.commands_ran_[0] == "cat in1 > out1");
-+  EXPECT_TRUE(token_command_runner_.commands_ran_[1] == "cat out1 > out2");
-+}
-+
-+TEST_F(BuildTokenTest, TwoCommandsInParallel) {
-+  ASSERT_NO_FATAL_FAILURE(AssertParse(&state_,
-+"rule token-available\n"
-+"  command = cat $in > $out\n"
-+"build out1: token-available in1\n"
-+"build out2: token-available in2\n"
-+"build out12: cat out1 out2\n"));
-+
-+  // plan should execute more than one command
-+  string err;
-+  EXPECT_TRUE(builder_.AddTarget("out12", &err));
-+  ASSERT_EQ("", err);
-+
-+  // 1st command: token available -> allow running
-+  // 2nd command: no token available but becomes available later
-+  ExpectCanRunMore(4,     true, true,  true,  false);
-+  ExpectAcquireToken(3,   true, false, true);
-+  // 1st call waits for command to finalize or token to become available
-+  // 2nd call waits for command to finalize
-+  // 3rd call waits for command to finalize
-+  ExpectWaitForCommand(3, true, false, false);
-+
-+  EXPECT_FALSE(builder_.Build(&err));
-+  EXPECT_EQ("stuck [this is a bug]", err);
-+
-+  EXPECT_EQ(2u, token_command_runner_.commands_ran_.size());
-+  EXPECT_TRUE((token_command_runner_.commands_ran_[0] == "cat in1 > out1" &&
-+               token_command_runner_.commands_ran_[1] == "cat in2 > out2") ||
-+              (token_command_runner_.commands_ran_[0] == "cat in2 > out2" &&
-+               token_command_runner_.commands_ran_[1] == "cat in1 > out1"));
-+}
-+
-+TEST_F(BuildTokenTest, CompleteThreeStepsSerial) {
-+  // plan should execute more than one command
-+  string err;
-+  EXPECT_TRUE(builder_.AddTarget("cat12", &err));
-+  ASSERT_EQ("", err);
-+
-+  // allow running of all commands
-+  ExpectCanRunMore(4,     true, true,  true,  true);
-+  ExpectAcquireToken(4,   true, false, true,  true);
-+  // wait for commands to finalize
-+  ExpectWaitForCommand(3, true, false, false);
-+
-+  EXPECT_TRUE(builder_.Build(&err));
-+  EXPECT_EQ("", err);
-+
-+  EXPECT_EQ(3u, token_command_runner_.commands_ran_.size());
-+  EXPECT_TRUE((token_command_runner_.commands_ran_[0] == "cat in1 > cat1"     &&
-+               token_command_runner_.commands_ran_[1] == "cat in1 in2 > cat2") ||
-+              (token_command_runner_.commands_ran_[0] == "cat in1 in2 > cat2" &&
-+               token_command_runner_.commands_ran_[1] == "cat in1 > cat1"    ));
-+  EXPECT_TRUE(token_command_runner_.commands_ran_[2] == "cat cat1 cat2 > cat12");
-+}
-+
-+TEST_F(BuildTokenTest, CompleteThreeStepsParallel) {
-+  ASSERT_NO_FATAL_FAILURE(AssertParse(&state_,
-+"rule token-available\n"
-+"  command = cat $in > $out\n"
-+"build out1: token-available in1\n"
-+"build out2: token-available in2\n"
-+"build out12: cat out1 out2\n"));
-+
-+  // plan should execute more than one command
-+  string err;
-+  EXPECT_TRUE(builder_.AddTarget("out12", &err));
-+  ASSERT_EQ("", err);
-+
-+  // allow running of all commands
-+  ExpectCanRunMore(4,     true, true,  true,  true);
-+  ExpectAcquireToken(4,   true, false, true,  true);
-+  // wait for commands to finalize
-+  ExpectWaitForCommand(4, true, false, false, false);
-+
-+  EXPECT_TRUE(builder_.Build(&err));
-+  EXPECT_EQ("", err);
-+
-+  EXPECT_EQ(3u, token_command_runner_.commands_ran_.size());
-+  EXPECT_TRUE((token_command_runner_.commands_ran_[0] == "cat in1 > out1" &&
-+               token_command_runner_.commands_ran_[1] == "cat in2 > out2") ||
-+              (token_command_runner_.commands_ran_[0] == "cat in2 > out2" &&
-+               token_command_runner_.commands_ran_[1] == "cat in1 > out1"));
-+  EXPECT_TRUE(token_command_runner_.commands_ran_[2] == "cat out1 out2 > out12");
-+}
-
-From f016e5430c9123d34a73ea7ad28693b20ee59d6d Mon Sep 17 00:00:00 2001
-From: Stefan Becker <chemobejk@gmail.com>
-Date: Mon, 8 Oct 2018 17:47:50 +0300
-Subject: [PATCH 10/11] Add Win32 implementation for GNUmakeTokenPool
-
-GNU make uses a semaphore as jobserver protocol on Win32. See also
-
-   https://www.gnu.org/software/make/manual/html_node/Windows-Jobserver.html
-
-Usage is pretty simple and straightforward, i.e. WaitForSingleObject()
-to obtain a token and ReleaseSemaphore() to return it.
-
-Unfortunately subprocess-win32.cc uses an I/O completion port (IOCP).
-IOCPs aren't waitable objects, i.e. we can't use WaitForMultipleObjects()
-to wait on the IOCP and the token semaphore at the same time.
-
-Therefore GNUmakeTokenPoolWin32 creates a child thread that waits on the
-token semaphore and posts a dummy I/O completion status on the IOCP when
-it was able to obtain a token. That unblocks SubprocessSet::DoWork() and
-it can then check if a token became available or not.
-
-- split existing GNUmakeTokenPool into common and platform bits
-- add GNUmakeTokenPool interface
-- move the Posix bits to GNUmakeTokenPoolPosix
-- add the Win32 bits as GNUmakeTokenPoolWin32
-- move Setup() method up to TokenPool interface
-- update Subprocess & TokenPool tests accordingly
----
- configure.py                    |   8 +-
- src/build.cc                    |  11 +-
- src/subprocess-win32.cc         |   9 ++
- src/subprocess_test.cc          |  34 ++++-
- src/tokenpool-gnu-make-posix.cc | 203 +++++++++++++++++++++++++++
- src/tokenpool-gnu-make-win32.cc | 237 ++++++++++++++++++++++++++++++++
- src/tokenpool-gnu-make.cc       | 203 ++-------------------------
- src/tokenpool-gnu-make.h        |  40 ++++++
- src/tokenpool-none.cc           |   4 +-
- src/tokenpool.h                 |  18 ++-
- src/tokenpool_test.cc           | 113 ++++++++++++---
- 11 files changed, 653 insertions(+), 227 deletions(-)
- create mode 100644 src/tokenpool-gnu-make-posix.cc
- create mode 100644 src/tokenpool-gnu-make-win32.cc
- create mode 100644 src/tokenpool-gnu-make.h
-
-diff --git a/configure.py b/configure.py
-index dc8a0066b7..a239b90eef 100755
---- a/configure.py
-+++ b/configure.py
-@@ -517,12 +517,13 @@ def has_re2c():
-              'state',
-              'status',
-              'string_piece_util',
-+             'tokenpool-gnu-make',
-              'util',
-              'version']:
-     objs += cxx(name, variables=cxxvariables)
- if platform.is_windows():
-     for name in ['subprocess-win32',
--                 'tokenpool-none',
-+                 'tokenpool-gnu-make-win32',
-                  'includes_normalize-win32',
-                  'msvc_helper-win32',
-                  'msvc_helper_main-win32']:
-@@ -531,8 +532,9 @@ def has_re2c():
-         objs += cxx('minidump-win32', variables=cxxvariables)
-     objs += cc('getopt')
- else:
--    objs += cxx('subprocess-posix')
--    objs += cxx('tokenpool-gnu-make')
-+    for name in ['subprocess-posix',
-+                 'tokenpool-gnu-make-posix']:
-+        objs += cxx(name)
- if platform.is_aix():
-     objs += cc('getopt')
- if platform.is_msvc():
-diff --git a/src/build.cc b/src/build.cc
-index 662e4bd7be..20c3bdc2a0 100644
---- a/src/build.cc
-+++ b/src/build.cc
-@@ -473,9 +473,14 @@ struct RealCommandRunner : public CommandRunner {
- 
- RealCommandRunner::RealCommandRunner(const BuildConfig& config) : config_(config) {
-   max_load_average_ = config.max_load_average;
--  tokens_ = TokenPool::Get(config_.parallelism_from_cmdline,
--                           config_.verbosity == BuildConfig::VERBOSE,
--                           max_load_average_);
-+  if ((tokens_ = TokenPool::Get()) != NULL) {
-+    if (!tokens_->Setup(config_.parallelism_from_cmdline,
-+                        config_.verbosity == BuildConfig::VERBOSE,
-+                        max_load_average_)) {
-+      delete tokens_;
-+      tokens_ = NULL;
-+    }
-+  }
- }
- 
- RealCommandRunner::~RealCommandRunner() {
-diff --git a/src/subprocess-win32.cc b/src/subprocess-win32.cc
-index 66d2c2c430..ce3e2c20a4 100644
---- a/src/subprocess-win32.cc
-+++ b/src/subprocess-win32.cc
-@@ -13,6 +13,7 @@
- // limitations under the License.
- 
- #include "subprocess.h"
-+#include "tokenpool.h"
- 
- #include <assert.h>
- #include <stdio.h>
-@@ -256,6 +257,9 @@ bool SubprocessSet::DoWork(struct TokenPool* tokens) {
-   Subprocess* subproc;
-   OVERLAPPED* overlapped;
- 
-+  if (tokens)
-+    tokens->WaitForTokenAvailability(ioport_);
-+
-   if (!GetQueuedCompletionStatus(ioport_, &bytes_read, (PULONG_PTR)&subproc,
-                                  &overlapped, INFINITE)) {
-     if (GetLastError() != ERROR_BROKEN_PIPE)
-@@ -266,6 +270,11 @@ bool SubprocessSet::DoWork(struct TokenPool* tokens) {
-                 // delivered by NotifyInterrupted above.
-     return true;
- 
-+  if (tokens && tokens->TokenIsAvailable((ULONG_PTR)subproc)) {
-+    token_available_ = true;
-+    return false;
-+  }
-+
-   subproc->OnPipeReady();
- 
-   if (subproc->Done()) {
-diff --git a/src/subprocess_test.cc b/src/subprocess_test.cc
-index 6264c8bf11..f625963462 100644
---- a/src/subprocess_test.cc
-+++ b/src/subprocess_test.cc
-@@ -40,9 +40,16 @@ struct TokenPoolTest : public TokenPool {
-   void Reserve()     {}
-   void Release()     {}
-   void Clear()       {}
-+  bool Setup(bool ignore_unused, bool verbose, double& max_load_average) { return false; }
- 
- #ifdef _WIN32
--  // @TODO
-+  bool _token_available;
-+  void WaitForTokenAvailability(HANDLE ioport) {
-+    if (_token_available)
-+      // unblock GetQueuedCompletionStatus()
-+      PostQueuedCompletionStatus(ioport, 0, (ULONG_PTR) this, NULL);
-+  }
-+  bool TokenIsAvailable(ULONG_PTR key) { return key == (ULONG_PTR) this; }
- #else
-   int _fd;
-   int GetMonitorFd() { return _fd; }
-@@ -297,34 +304,48 @@ TEST_F(SubprocessTest, ReadStdin) {
- }
- #endif  // _WIN32
- 
--// @TODO: remove once TokenPool implementation for Windows is available
--#ifndef _WIN32
- TEST_F(SubprocessTest, TokenAvailable) {
-   Subprocess* subproc = subprocs_.Add(kSimpleCommand);
-   ASSERT_NE((Subprocess *) 0, subproc);
- 
-   // simulate GNUmake jobserver pipe with 1 token
-+#ifdef _WIN32
-+  tokens_._token_available = true;
-+#else
-   int fds[2];
-   ASSERT_EQ(0u, pipe(fds));
-   tokens_._fd = fds[0];
-   ASSERT_EQ(1u, write(fds[1], "T", 1));
-+#endif
- 
-   subprocs_.ResetTokenAvailable();
-   subprocs_.DoWork(&tokens_);
-+#ifdef _WIN32
-+  tokens_._token_available = false;
-+  // we need to loop here as we have no conrol where the token
-+  // I/O completion post ends up in the queue
-+  while (!subproc->Done() && !subprocs_.IsTokenAvailable()) {
-+    subprocs_.DoWork(&tokens_);
-+  }
-+#endif
- 
-   EXPECT_TRUE(subprocs_.IsTokenAvailable());
-   EXPECT_EQ(0u, subprocs_.finished_.size());
- 
-   // remove token to let DoWork() wait for command again
-+#ifndef _WIN32
-   char token;
-   ASSERT_EQ(1u, read(fds[0], &token, 1));
-+#endif
- 
-   while (!subproc->Done()) {
-     subprocs_.DoWork(&tokens_);
-   }
- 
-+#ifndef _WIN32
-   close(fds[1]);
-   close(fds[0]);
-+#endif
- 
-   EXPECT_EQ(ExitSuccess, subproc->Finish());
-   EXPECT_NE("", subproc->GetOutput());
-@@ -337,17 +358,23 @@ TEST_F(SubprocessTest, TokenNotAvailable) {
-   ASSERT_NE((Subprocess *) 0, subproc);
- 
-   // simulate GNUmake jobserver pipe with 0 tokens
-+#ifdef _WIN32
-+  tokens_._token_available = false;
-+#else
-   int fds[2];
-   ASSERT_EQ(0u, pipe(fds));
-   tokens_._fd = fds[0];
-+#endif
- 
-   subprocs_.ResetTokenAvailable();
-   while (!subproc->Done()) {
-     subprocs_.DoWork(&tokens_);
-   }
- 
-+#ifndef _WIN32
-   close(fds[1]);
-   close(fds[0]);
-+#endif
- 
-   EXPECT_FALSE(subprocs_.IsTokenAvailable());
-   EXPECT_EQ(ExitSuccess, subproc->Finish());
-@@ -355,4 +382,3 @@ TEST_F(SubprocessTest, TokenNotAvailable) {
- 
-   EXPECT_EQ(1u, subprocs_.finished_.size());
- }
--#endif  // _WIN32
-diff --git a/src/tokenpool-gnu-make-posix.cc b/src/tokenpool-gnu-make-posix.cc
-new file mode 100644
-index 0000000000..70d84bfff7
---- /dev/null
-+++ b/src/tokenpool-gnu-make-posix.cc
-@@ -0,0 +1,203 @@
-+// Copyright 2016-2018 Google Inc. All Rights Reserved.
-+//
-+// Licensed under the Apache License, Version 2.0 (the "License");
-+// you may not use this file except in compliance with the License.
-+// You may obtain a copy of the License at
-+//
-+//     http://www.apache.org/licenses/LICENSE-2.0
-+//
-+// Unless required by applicable law or agreed to in writing, software
-+// distributed under the License is distributed on an "AS IS" BASIS,
-+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-+// See the License for the specific language governing permissions and
-+// limitations under the License.
++/// The token tests are concerned with the main loop functionality when
++// the CommandRunner has an active TokenPool. It is therefore intentional
++// that the plan doesn't complete and that builder_.Build() returns false!
 +
-+#include "tokenpool-gnu-make.h"
++/// Fake implementation of CommandRunner that simulates a TokenPool
++struct FakeTokenCommandRunner : public CommandRunner {
++  explicit FakeTokenCommandRunner() {}
 +
-+#include <errno.h>
-+#include <fcntl.h>
-+#include <poll.h>
-+#include <unistd.h>
-+#include <signal.h>
-+#include <sys/time.h>
-+#include <stdio.h>
-+#include <string.h>
-+#include <stdlib.h>
++  // CommandRunner impl
++  virtual bool CanRunMore() const;
++  virtual bool AcquireToken();
++  virtual bool StartCommand(Edge* edge);
++  virtual bool WaitForCommand(Result* result, bool more_ready);
++  virtual vector<Edge*> GetActiveEdges();
++  virtual void Abort();
 +
-+// TokenPool implementation for GNU make jobserver - POSIX implementation
-+// (http://make.mad-scientist.net/papers/jobserver-implementation/)
-+struct GNUmakeTokenPoolPosix : public GNUmakeTokenPool {
-+  GNUmakeTokenPoolPosix();
-+  virtual ~GNUmakeTokenPoolPosix();
++  vector<string> commands_ran_;
++  vector<Edge *> edges_;
 +
-+  virtual int GetMonitorFd();
++  vector<bool> acquire_token_;
++  vector<bool> can_run_more_;
++  vector<bool> wait_for_command_;
++};
 +
-+  virtual const char *GetEnv(const char *name) { return getenv(name); };
-+  virtual bool ParseAuth(const char *jobserver);
-+  virtual bool AcquireToken();
-+  virtual bool ReturnToken();
++bool FakeTokenCommandRunner::CanRunMore() const {
++  if (can_run_more_.size() == 0) {
++    EXPECT_FALSE("unexpected call to CommandRunner::CanRunMore()");
++    return false;
++  }
 +
-+ private:
-+  int rfd_;
-+  int wfd_;
++  bool result = can_run_more_[0];
 +
-+  struct sigaction old_act_;
-+  bool restore_;
++  // Unfortunately CanRunMore() isn't "const" for tests
++  const_cast<FakeTokenCommandRunner*>(this)->can_run_more_.erase(
++    const_cast<FakeTokenCommandRunner*>(this)->can_run_more_.begin()
++  );
 +
-+  static int dup_rfd_;
-+  static void CloseDupRfd(int signum);
++  return result;
++}
 +
-+  bool CheckFd(int fd);
-+  bool SetAlarmHandler();
-+};
++bool FakeTokenCommandRunner::AcquireToken() {
++  if (acquire_token_.size() == 0) {
++    EXPECT_FALSE("unexpected call to CommandRunner::AcquireToken()");
++    return false;
++  }
 +
-+GNUmakeTokenPoolPosix::GNUmakeTokenPoolPosix() : rfd_(-1), wfd_(-1), restore_(false) {
++  bool result = acquire_token_[0];
++  acquire_token_.erase(acquire_token_.begin());
++  return result;
 +}
 +
-+GNUmakeTokenPoolPosix::~GNUmakeTokenPoolPosix() {
-+  Clear();
-+  if (restore_)
-+    sigaction(SIGALRM, &old_act_, NULL);
++bool FakeTokenCommandRunner::StartCommand(Edge* edge) {
++  commands_ran_.push_back(edge->EvaluateCommand());
++  edges_.push_back(edge);
++  return true;
 +}
 +
-+bool GNUmakeTokenPoolPosix::CheckFd(int fd) {
-+  if (fd < 0)
++bool FakeTokenCommandRunner::WaitForCommand(Result* result, bool more_ready) {
++  if (wait_for_command_.size() == 0) {
++    EXPECT_FALSE("unexpected call to CommandRunner::WaitForCommand()");
 +    return false;
-+  int ret = fcntl(fd, F_GETFD);
-+  if (ret < 0)
++  }
++
++  bool expected = wait_for_command_[0];
++  if (expected != more_ready) {
++    EXPECT_EQ(expected, more_ready);
 +    return false;
-+  return true;
-+}
++  }
++  wait_for_command_.erase(wait_for_command_.begin());
 +
-+int GNUmakeTokenPoolPosix::dup_rfd_ = -1;
++  if (edges_.size() == 0)
++    return false;
 +
-+void GNUmakeTokenPoolPosix::CloseDupRfd(int signum) {
-+  close(dup_rfd_);
-+  dup_rfd_ = -1;
-+}
++  Edge* edge = edges_[0];
++  result->edge = edge;
 +
-+bool GNUmakeTokenPoolPosix::SetAlarmHandler() {
-+  struct sigaction act;
-+  memset(&act, 0, sizeof(act));
-+  act.sa_handler = CloseDupRfd;
-+  if (sigaction(SIGALRM, &act, &old_act_) < 0) {
-+    perror("sigaction:");
-+    return(false);
++  if (more_ready &&
++      (edge->rule().name() == "token-available")) {
++    result->status = ExitTokenAvailable;
 +  } else {
-+    restore_ = true;
-+    return(true);
++    edges_.erase(edges_.begin());
++    result->status = ExitSuccess;
 +  }
++
++  return true;
 +}
 +
-+bool GNUmakeTokenPoolPosix::ParseAuth(const char *jobserver) {
-+  int rfd = -1;
-+  int wfd = -1;
-+  if ((sscanf(jobserver, "%*[^=]=%d,%d", &rfd, &wfd) == 2) &&
-+      CheckFd(rfd) &&
-+      CheckFd(wfd) &&
-+      SetAlarmHandler()) {
-+    rfd_ = rfd;
-+    wfd_ = wfd;
-+    return true;
-+  }
++vector<Edge*> FakeTokenCommandRunner::GetActiveEdges() {
++  return edges_;
++}
 +
-+  return false;
++void FakeTokenCommandRunner::Abort() {
++  edges_.clear();
 +}
 +
-+bool GNUmakeTokenPoolPosix::AcquireToken() {
-+  // Please read
-+  //
-+  //   http://make.mad-scientist.net/papers/jobserver-implementation/
-+  //
-+  // for the reasoning behind the following code.
-+  //
-+  // Try to read one character from the pipe. Returns true on success.
-+  //
-+  // First check if read() would succeed without blocking.
-+#ifdef USE_PPOLL
-+  pollfd pollfds[] = {{rfd_, POLLIN, 0}};
-+  int ret = poll(pollfds, 1, 0);
-+#else
-+  fd_set set;
-+  struct timeval timeout = { 0, 0 };
-+  FD_ZERO(&set);
-+  FD_SET(rfd_, &set);
-+  int ret = select(rfd_ + 1, &set, NULL, NULL, &timeout);
-+#endif
-+  if (ret > 0) {
-+    // Handle potential race condition:
-+    //  - the above check succeeded, i.e. read() should not block
-+    //  - the character disappears before we call read()
-+    //
-+    // Create a duplicate of rfd_. The duplicate file descriptor dup_rfd_
-+    // can safely be closed by signal handlers without affecting rfd_.
-+    dup_rfd_ = dup(rfd_);
++struct BuildTokenTest : public BuildTest {
++  virtual void SetUp();
++  virtual void TearDown();
 +
-+    if (dup_rfd_ != -1) {
-+      struct sigaction act, old_act;
-+      int ret = 0;
++  FakeTokenCommandRunner token_command_runner_;
 +
-+      // Temporarily replace SIGCHLD handler with our own
-+      memset(&act, 0, sizeof(act));
-+      act.sa_handler = CloseDupRfd;
-+      if (sigaction(SIGCHLD, &act, &old_act) == 0) {
-+        struct itimerval timeout;
++  void ExpectAcquireToken(int count, ...);
++  void ExpectCanRunMore(int count, ...);
++  void ExpectWaitForCommand(int count, ...);
 +
-+        // install a 100ms timeout that generates SIGALARM on expiration
-+        memset(&timeout, 0, sizeof(timeout));
-+        timeout.it_value.tv_usec = 100 * 1000; // [ms] -> [usec]
-+        if (setitimer(ITIMER_REAL, &timeout, NULL) == 0) {
-+          char buf;
++private:
++  void EnqueueBooleans(vector<bool>& booleans, int count, va_list ap);
++};
 +
-+          // Now try to read() from dup_rfd_. Return values from read():
-+          //
-+          // 1. token read                               ->  1
-+          // 2. pipe closed                              ->  0
-+          // 3. alarm expires                            -> -1 (EINTR)
-+          // 4. child exits                              -> -1 (EINTR)
-+          // 5. alarm expired before entering read()     -> -1 (EBADF)
-+          // 6. child exited before entering read()      -> -1 (EBADF)
-+          // 7. child exited before handler is installed -> go to 1 - 3
-+          ret = read(dup_rfd_, &buf, 1);
++void BuildTokenTest::SetUp() {
++  BuildTest::SetUp();
 +
-+          // disarm timer
-+          memset(&timeout, 0, sizeof(timeout));
-+          setitimer(ITIMER_REAL, &timeout, NULL);
-+        }
++  // replace FakeCommandRunner with FakeTokenCommandRunner
++  builder_.command_runner_.release();
++  builder_.command_runner_.reset(&token_command_runner_);
++}
++void BuildTokenTest::TearDown() {
++  EXPECT_EQ(0u, token_command_runner_.acquire_token_.size());
++  EXPECT_EQ(0u, token_command_runner_.can_run_more_.size());
++  EXPECT_EQ(0u, token_command_runner_.wait_for_command_.size());
 +
-+        sigaction(SIGCHLD, &old_act, NULL);
-+      }
++  BuildTest::TearDown();
++}
 +
-+      CloseDupRfd(0);
++void BuildTokenTest::ExpectAcquireToken(int count, ...) {
++  va_list ap;
++  va_start(ap, count);
++  EnqueueBooleans(token_command_runner_.acquire_token_, count, ap);
++  va_end(ap);
++}
 +
-+      // Case 1 from above list
-+      if (ret > 0)
-+        return true;
-+    }
-+  }
++void BuildTokenTest::ExpectCanRunMore(int count, ...) {
++  va_list ap;
++  va_start(ap, count);
++  EnqueueBooleans(token_command_runner_.can_run_more_, count, ap);
++  va_end(ap);
++}
 +
-+  // read() would block, i.e. no token available,
-+  // cases 2-6 from above list or
-+  // select() / poll() / dup() / sigaction() / setitimer() failed
-+  return false;
++void BuildTokenTest::ExpectWaitForCommand(int count, ...) {
++  va_list ap;
++  va_start(ap, count);
++  EnqueueBooleans(token_command_runner_.wait_for_command_, count, ap);
++  va_end(ap);
++}
++
++void BuildTokenTest::EnqueueBooleans(vector<bool>& booleans, int count, va_list ap) {
++  while (count--) {
++    int value = va_arg(ap, int);
++    booleans.push_back(!!value); // force bool
++  }
 +}
 +
-+bool GNUmakeTokenPoolPosix::ReturnToken() {
-+  const char buf = '+';
-+  while (1) {
-+    int ret = write(wfd_, &buf, 1);
-+    if (ret > 0)
-+      return true;
-+    if ((ret != -1) || (errno != EINTR))
-+      return false;
-+    // write got interrupted - retry
-+  }
++TEST_F(BuildTokenTest, DoNotAquireToken) {
++  // plan should execute one command
++  string err;
++  EXPECT_TRUE(builder_.AddTarget("cat1", &err));
++  ASSERT_EQ("", err);
++
++  // pretend we can't run anything
++  ExpectCanRunMore(1, false);
++
++  EXPECT_FALSE(builder_.Build(&err));
++  EXPECT_EQ("stuck [this is a bug]", err);
++
++  EXPECT_EQ(0u, token_command_runner_.commands_ran_.size());
 +}
 +
-+int GNUmakeTokenPoolPosix::GetMonitorFd() {
-+  return(rfd_);
-+}
++TEST_F(BuildTokenTest, DoNotStartWithoutToken) {
++  // plan should execute one command
++  string err;
++  EXPECT_TRUE(builder_.AddTarget("cat1", &err));
++  ASSERT_EQ("", err);
 +
-+struct TokenPool *TokenPool::Get() {
-+  return new GNUmakeTokenPoolPosix;
++  // we could run a command but do not have a token for it
++  ExpectCanRunMore(1,   true);
++  ExpectAcquireToken(1, false);
++
++  EXPECT_FALSE(builder_.Build(&err));
++  EXPECT_EQ("stuck [this is a bug]", err);
++
++  EXPECT_EQ(0u, token_command_runner_.commands_ran_.size());
 +}
-diff --git a/src/tokenpool-gnu-make-win32.cc b/src/tokenpool-gnu-make-win32.cc
-new file mode 100644
-index 0000000000..2719f2c1fc
---- /dev/null
-+++ b/src/tokenpool-gnu-make-win32.cc
-@@ -0,0 +1,237 @@
-+// Copyright 2018 Google Inc. All Rights Reserved.
-+//
-+// Licensed under the Apache License, Version 2.0 (the "License");
-+// you may not use this file except in compliance with the License.
-+// You may obtain a copy of the License at
-+//
-+//     http://www.apache.org/licenses/LICENSE-2.0
-+//
-+// Unless required by applicable law or agreed to in writing, software
-+// distributed under the License is distributed on an "AS IS" BASIS,
-+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-+// See the License for the specific language governing permissions and
-+// limitations under the License.
 +
-+#include "tokenpool-gnu-make.h"
++TEST_F(BuildTokenTest, CompleteOneStep) {
++  // plan should execute one command
++  string err;
++  EXPECT_TRUE(builder_.AddTarget("cat1", &err));
++  ASSERT_EQ("", err);
 +
-+// always include first to make sure other headers do the correct thing...
-+#include <windows.h>
++  // allow running of one command
++  ExpectCanRunMore(1,   true);
++  ExpectAcquireToken(1, true);
++  // block and wait for command to finalize
++  ExpectWaitForCommand(1, false);
 +
-+#include <ctype.h>
-+#include <stdlib.h>
-+#include <string.h>
++  EXPECT_TRUE(builder_.Build(&err));
++  EXPECT_EQ("", err);
 +
-+#include "util.h"
++  EXPECT_EQ(1u, token_command_runner_.commands_ran_.size());
++  EXPECT_TRUE(token_command_runner_.commands_ran_[0] == "cat in1 > cat1");
++}
 +
-+// TokenPool implementation for GNU make jobserver - Win32 implementation
-+// (https://www.gnu.org/software/make/manual/html_node/Windows-Jobserver.html)
-+struct GNUmakeTokenPoolWin32 : public GNUmakeTokenPool {
-+  GNUmakeTokenPoolWin32();
-+  virtual ~GNUmakeTokenPoolWin32();
++TEST_F(BuildTokenTest, AcquireOneToken) {
++  // plan should execute more than one command
++  string err;
++  EXPECT_TRUE(builder_.AddTarget("cat12", &err));
++  ASSERT_EQ("", err);
 +
-+  virtual void WaitForTokenAvailability(HANDLE ioport);
-+  virtual bool TokenIsAvailable(ULONG_PTR key);
++  // allow running of one command
++  ExpectCanRunMore(3,     true, false, false);
++  ExpectAcquireToken(1,   true);
++  // block and wait for command to finalize
++  ExpectWaitForCommand(1, false);
 +
-+  virtual const char *GetEnv(const char *name);
-+  virtual bool ParseAuth(const char *jobserver);
-+  virtual bool AcquireToken();
-+  virtual bool ReturnToken();
++  EXPECT_FALSE(builder_.Build(&err));
++  EXPECT_EQ("stuck [this is a bug]", err);
 +
-+ private:
-+  // Semaphore for GNU make jobserver protocol
-+  HANDLE semaphore_jobserver_;
-+  // Semaphore Child -> Parent
-+  // - child releases it before entering wait on jobserver semaphore
-+  // - parent blocks on it to know when child enters wait
-+  HANDLE semaphore_enter_wait_;
-+  // Semaphore Parent -> Child
-+  // - parent releases it to allow child to restart loop
-+  // - child blocks on it to know when to restart loop
-+  HANDLE semaphore_restart_;
-+  // set to false if child should exit loop and terminate thread
-+  bool running_;
-+  // child thread
-+  HANDLE child_;
-+  // I/O completion port from SubprocessSet
-+  HANDLE ioport_;
++  EXPECT_EQ(1u, token_command_runner_.commands_ran_.size());
++  // any of the two dependencies could have been executed
++  EXPECT_TRUE(token_command_runner_.commands_ran_[0] == "cat in1 > cat1" ||
++              token_command_runner_.commands_ran_[0] == "cat in1 in2 > cat2");
++}
 +
++TEST_F(BuildTokenTest, WantTwoTokens) {
++  // plan should execute more than one command
++  string err;
++  EXPECT_TRUE(builder_.AddTarget("cat12", &err));
++  ASSERT_EQ("", err);
 +
-+  DWORD SemaphoreThread();
-+  void ReleaseSemaphore(HANDLE semaphore);
-+  void WaitForObject(HANDLE object);
-+  static DWORD WINAPI SemaphoreThreadWrapper(LPVOID param);
-+  static void NoopAPCFunc(ULONG_PTR param);
-+};
++  // allow running of one command
++  ExpectCanRunMore(3,     true, true, false);
++  ExpectAcquireToken(2,   true, false);
++  // wait for command to finalize or token to become available
++  ExpectWaitForCommand(1, true);
 +
-+GNUmakeTokenPoolWin32::GNUmakeTokenPoolWin32() : semaphore_jobserver_(NULL),
-+                                                 semaphore_enter_wait_(NULL),
-+                                                 semaphore_restart_(NULL),
-+                                                 running_(false),
-+                                                 child_(NULL),
-+                                                 ioport_(NULL) {
-+}
++  EXPECT_FALSE(builder_.Build(&err));
++  EXPECT_EQ("stuck [this is a bug]", err);
 +
-+GNUmakeTokenPoolWin32::~GNUmakeTokenPoolWin32() {
-+  Clear();
-+  CloseHandle(semaphore_jobserver_);
-+  semaphore_jobserver_ = NULL;
++  EXPECT_EQ(1u, token_command_runner_.commands_ran_.size());
++  // any of the two dependencies could have been executed
++  EXPECT_TRUE(token_command_runner_.commands_ran_[0] == "cat in1 > cat1" ||
++              token_command_runner_.commands_ran_[0] == "cat in1 in2 > cat2");
++}
 +
-+  if (child_) {
-+    // tell child thread to exit
-+    running_ = false;
-+    ReleaseSemaphore(semaphore_restart_);
++TEST_F(BuildTokenTest, CompleteTwoSteps) {
++  ASSERT_NO_FATAL_FAILURE(AssertParse(&state_,
++"build out1: cat in1\n"
++"build out2: cat out1\n"));
 +
-+    // wait for child thread to exit
-+    WaitForObject(child_);
-+    CloseHandle(child_);
-+    child_ = NULL;
-+  }
++  // plan should execute more than one command
++  string err;
++  EXPECT_TRUE(builder_.AddTarget("out2", &err));
++  ASSERT_EQ("", err);
 +
-+  if (semaphore_restart_) {
-+    CloseHandle(semaphore_restart_);
-+    semaphore_restart_ = NULL;
-+  }
++  // allow running of two commands
++  ExpectCanRunMore(2,     true, true);
++  ExpectAcquireToken(2,   true, true);
++  // wait for commands to finalize
++  ExpectWaitForCommand(2, false, false);
 +
-+  if (semaphore_enter_wait_) {
-+    CloseHandle(semaphore_enter_wait_);
-+    semaphore_enter_wait_ = NULL;
-+  }
-+}
++  EXPECT_TRUE(builder_.Build(&err));
++  EXPECT_EQ("", err);
 +
-+const char *GNUmakeTokenPoolWin32::GetEnv(const char *name) {
-+  // getenv() does not work correctly together with tokenpool_tests.cc
-+  static char buffer[MAX_PATH + 1];
-+  if (GetEnvironmentVariable("MAKEFLAGS", buffer, sizeof(buffer)) == 0)
-+    return NULL;
-+  return(buffer);
++  EXPECT_EQ(2u, token_command_runner_.commands_ran_.size());
++  EXPECT_TRUE(token_command_runner_.commands_ran_[0] == "cat in1 > out1");
++  EXPECT_TRUE(token_command_runner_.commands_ran_[1] == "cat out1 > out2");
 +}
 +
-+bool GNUmakeTokenPoolWin32::ParseAuth(const char *jobserver) {
-+  // match "--jobserver-auth=gmake_semaphore_<INTEGER>..."
-+  const char *start = strchr(jobserver, '=');
-+  if (start) {
-+    const char *end = start;
-+    unsigned int len;
-+    char c, *auth;
-+
-+    while ((c = *++end) != '\0')
-+      if (!(isalnum(c) || (c == '_')))
-+        break;
-+    len = end - start; // includes string terminator in count
++TEST_F(BuildTokenTest, TwoCommandsInParallel) {
++  ASSERT_NO_FATAL_FAILURE(AssertParse(&state_,
++"rule token-available\n"
++"  command = cat $in > $out\n"
++"build out1: token-available in1\n"
++"build out2: token-available in2\n"
++"build out12: cat out1 out2\n"));
 +
-+    if ((len > 1) && ((auth = (char *)malloc(len)) != NULL)) {
-+      strncpy(auth, start + 1, len - 1);
-+      auth[len - 1] = '\0';
++  // plan should execute more than one command
++  string err;
++  EXPECT_TRUE(builder_.AddTarget("out12", &err));
++  ASSERT_EQ("", err);
 +
-+      if ((semaphore_jobserver_ = OpenSemaphore(SEMAPHORE_ALL_ACCESS, /* Semaphore access setting */
-+                                                FALSE,                /* Child processes DON'T inherit */
-+                                                auth                  /* Semaphore name */
-+                                                )) != NULL) {
-+        free(auth);
-+        return true;
-+      }
++  // 1st command: token available -> allow running
++  // 2nd command: no token available but becomes available later
++  ExpectCanRunMore(4,     true, true,  true,  false);
++  ExpectAcquireToken(3,   true, false, true);
++  // 1st call waits for command to finalize or token to become available
++  // 2nd call waits for command to finalize
++  // 3rd call waits for command to finalize
++  ExpectWaitForCommand(3, true, false, false);
 +
-+      free(auth);
-+    }
-+  }
++  EXPECT_FALSE(builder_.Build(&err));
++  EXPECT_EQ("stuck [this is a bug]", err);
 +
-+  return false;
++  EXPECT_EQ(2u, token_command_runner_.commands_ran_.size());
++  EXPECT_TRUE((token_command_runner_.commands_ran_[0] == "cat in1 > out1" &&
++               token_command_runner_.commands_ran_[1] == "cat in2 > out2") ||
++              (token_command_runner_.commands_ran_[0] == "cat in2 > out2" &&
++               token_command_runner_.commands_ran_[1] == "cat in1 > out1"));
 +}
 +
-+bool GNUmakeTokenPoolWin32::AcquireToken() {
-+  return WaitForSingleObject(semaphore_jobserver_, 0) == WAIT_OBJECT_0;
-+}
++TEST_F(BuildTokenTest, CompleteThreeStepsSerial) {
++  // plan should execute more than one command
++  string err;
++  EXPECT_TRUE(builder_.AddTarget("cat12", &err));
++  ASSERT_EQ("", err);
 +
-+bool GNUmakeTokenPoolWin32::ReturnToken() {
-+  ReleaseSemaphore(semaphore_jobserver_);
-+  return true;
-+}
++  // allow running of all commands
++  ExpectCanRunMore(4,     true, true,  true,  true);
++  ExpectAcquireToken(4,   true, false, true,  true);
++  // wait for commands to finalize
++  ExpectWaitForCommand(3, true, false, false);
 +
-+DWORD GNUmakeTokenPoolWin32::SemaphoreThread() {
-+  while (running_) {
-+    // indicate to parent that we are entering wait
-+    ReleaseSemaphore(semaphore_enter_wait_);
++  EXPECT_TRUE(builder_.Build(&err));
++  EXPECT_EQ("", err);
 +
-+    // alertable wait forever on token semaphore
-+    if (WaitForSingleObjectEx(semaphore_jobserver_, INFINITE, TRUE) == WAIT_OBJECT_0) {
-+      // release token again for AcquireToken()
-+      ReleaseSemaphore(semaphore_jobserver_);
++  EXPECT_EQ(3u, token_command_runner_.commands_ran_.size());
++  EXPECT_TRUE((token_command_runner_.commands_ran_[0] == "cat in1 > cat1"     &&
++               token_command_runner_.commands_ran_[1] == "cat in1 in2 > cat2") ||
++              (token_command_runner_.commands_ran_[0] == "cat in1 in2 > cat2" &&
++               token_command_runner_.commands_ran_[1] == "cat in1 > cat1"    ));
++  EXPECT_TRUE(token_command_runner_.commands_ran_[2] == "cat cat1 cat2 > cat12");
++}
 +
-+      // indicate to parent on ioport that a token might be available
-+      if (!PostQueuedCompletionStatus(ioport_, 0, (ULONG_PTR) this, NULL))
-+        Win32Fatal("PostQueuedCompletionStatus");
-+    }
++TEST_F(BuildTokenTest, CompleteThreeStepsParallel) {
++  ASSERT_NO_FATAL_FAILURE(AssertParse(&state_,
++"rule token-available\n"
++"  command = cat $in > $out\n"
++"build out1: token-available in1\n"
++"build out2: token-available in2\n"
++"build out12: cat out1 out2\n"));
 +
-+    // wait for parent to allow loop restart
-+    WaitForObject(semaphore_restart_);
-+    // semaphore is now in nonsignaled state again for next run...
-+  }
++  // plan should execute more than one command
++  string err;
++  EXPECT_TRUE(builder_.AddTarget("out12", &err));
++  ASSERT_EQ("", err);
 +
-+  return 0;
-+}
++  // allow running of all commands
++  ExpectCanRunMore(4,     true, true,  true,  true);
++  ExpectAcquireToken(4,   true, false, true,  true);
++  // wait for commands to finalize
++  ExpectWaitForCommand(4, true, false, false, false);
 +
-+DWORD WINAPI GNUmakeTokenPoolWin32::SemaphoreThreadWrapper(LPVOID param) {
-+  GNUmakeTokenPoolWin32 *This = (GNUmakeTokenPoolWin32 *) param;
-+  return This->SemaphoreThread();
-+}
++  EXPECT_TRUE(builder_.Build(&err));
++  EXPECT_EQ("", err);
 +
-+void GNUmakeTokenPoolWin32::NoopAPCFunc(ULONG_PTR param) {
++  EXPECT_EQ(3u, token_command_runner_.commands_ran_.size());
++  EXPECT_TRUE((token_command_runner_.commands_ran_[0] == "cat in1 > out1" &&
++               token_command_runner_.commands_ran_[1] == "cat in2 > out2") ||
++              (token_command_runner_.commands_ran_[0] == "cat in2 > out2" &&
++               token_command_runner_.commands_ran_[1] == "cat in1 > out1"));
++  EXPECT_TRUE(token_command_runner_.commands_ran_[2] == "cat out1 out2 > out12");
 +}
+--- a/src/exit_status.h
++++ b/src/exit_status.h
+@@ -18,7 +18,8 @@
+ enum ExitStatus {
+   ExitSuccess,
+   ExitFailure,
+-  ExitInterrupted
++  ExitTokenAvailable,
++  ExitInterrupted,
+ };
+ 
+ #endif  // NINJA_EXIT_STATUS_H_
+--- a/src/subprocess-posix.cc
++++ b/src/subprocess-posix.cc
+@@ -13,6 +13,7 @@
+ // limitations under the License.
+ 
+ #include "subprocess.h"
++#include "tokenpool.h"
+ 
+ #include <sys/select.h>
+ #include <assert.h>
+@@ -249,7 +250,7 @@ Subprocess *SubprocessSet::Add(const str
+ }
+ 
+ #ifdef USE_PPOLL
+-bool SubprocessSet::DoWork() {
++bool SubprocessSet::DoWork(TokenPool* tokens) {
+   vector<pollfd> fds;
+   nfds_t nfds = 0;
+ 
+@@ -263,6 +264,12 @@ bool SubprocessSet::DoWork() {
+     ++nfds;
+   }
+ 
++  if (tokens) {
++    pollfd pfd = { tokens->GetMonitorFd(), POLLIN | POLLPRI, 0 };
++    fds.push_back(pfd);
++    ++nfds;
++  }
 +
-+void GNUmakeTokenPoolWin32::WaitForTokenAvailability(HANDLE ioport) {
-+  if (child_ == NULL) {
-+    // first invocation
-+    //
-+    // subprocess-win32.cc uses I/O completion port (IOCP) which can't be
-+    // used as a waitable object. Therefore we can't use WaitMultipleObjects()
-+    // to wait on the IOCP and the token semaphore at the same time. Create
-+    // a child thread that waits on the semaphore and posts an I/O completion
-+    ioport_ = ioport;
-+
-+    // create both semaphores in nonsignaled state
-+    if ((semaphore_enter_wait_ = CreateSemaphore(NULL, 0, 1, NULL))
-+        == NULL)
-+      Win32Fatal("CreateSemaphore/enter_wait");
-+    if ((semaphore_restart_ = CreateSemaphore(NULL, 0, 1, NULL))
-+        == NULL)
-+      Win32Fatal("CreateSemaphore/restart");
+   interrupted_ = 0;
+   int ret = ppoll(&fds.front(), nfds, NULL, &old_mask_);
+   if (ret == -1) {
+@@ -295,11 +302,20 @@ bool SubprocessSet::DoWork() {
+     ++i;
+   }
+ 
++  if (tokens) {
++    pollfd *pfd = &fds[nfds - 1];
++    if (pfd->fd >= 0) {
++      assert(pfd->fd == tokens->GetMonitorFd());
++      if (pfd->revents != 0)
++        token_available_ = true;
++    }
++  }
 +
-+    // start child thread
-+    running_ = true;
-+    if ((child_ = CreateThread(NULL, 0, &SemaphoreThreadWrapper, this, 0, NULL))
-+        == NULL)
-+      Win32Fatal("CreateThread");
+   return IsInterrupted();
+ }
+ 
+ #else  // !defined(USE_PPOLL)
+-bool SubprocessSet::DoWork() {
++bool SubprocessSet::DoWork(TokenPool* tokens) {
+   fd_set set;
+   int nfds = 0;
+   FD_ZERO(&set);
+@@ -314,6 +330,13 @@ bool SubprocessSet::DoWork() {
+     }
+   }
+ 
++  if (tokens) {
++    int fd = tokens->GetMonitorFd();
++    FD_SET(fd, &set);
++    if (nfds < fd+1)
++      nfds = fd+1;
++  }
 +
-+  } else {
-+    // all further invocations - allow child thread to loop
-+    ReleaseSemaphore(semaphore_restart_);
+   interrupted_ = 0;
+   int ret = pselect(nfds, &set, 0, 0, 0, &old_mask_);
+   if (ret == -1) {
+@@ -342,6 +365,12 @@ bool SubprocessSet::DoWork() {
+     ++i;
+   }
+ 
++  if (tokens) {
++    int fd = tokens->GetMonitorFd();
++    if ((fd >= 0) && FD_ISSET(fd, &set))
++    token_available_ = true;
 +  }
 +
-+  // wait for child thread to enter wait
-+  WaitForObject(semaphore_enter_wait_);
-+  // semaphore is now in nonsignaled state again for next run...
+   return IsInterrupted();
+ }
+ #endif  // !defined(USE_PPOLL)
+--- a/src/subprocess-win32.cc
++++ b/src/subprocess-win32.cc
+@@ -13,6 +13,7 @@
+ // limitations under the License.
+ 
+ #include "subprocess.h"
++#include "tokenpool.h"
+ 
+ #include <assert.h>
+ #include <stdio.h>
+@@ -251,11 +252,14 @@ Subprocess *SubprocessSet::Add(const str
+   return subprocess;
+ }
+ 
+-bool SubprocessSet::DoWork() {
++bool SubprocessSet::DoWork(TokenPool* tokens) {
+   DWORD bytes_read;
+   Subprocess* subproc;
+   OVERLAPPED* overlapped;
+ 
++  if (tokens)
++    tokens->WaitForTokenAvailability(ioport_);
 +
-+  // now SubprocessSet::DoWork() can enter GetQueuedCompletionStatus()...
-+}
+   if (!GetQueuedCompletionStatus(ioport_, &bytes_read, (PULONG_PTR)&subproc,
+                                  &overlapped, INFINITE)) {
+     if (GetLastError() != ERROR_BROKEN_PIPE)
+@@ -266,6 +270,11 @@ bool SubprocessSet::DoWork() {
+                 // delivered by NotifyInterrupted above.
+     return true;
+ 
++  if (tokens && tokens->TokenIsAvailable((ULONG_PTR)subproc)) {
++    token_available_ = true;
++    return false;
++  }
 +
-+bool GNUmakeTokenPoolWin32::TokenIsAvailable(ULONG_PTR key) {
-+  // alert child thread to break wait on token semaphore
-+  QueueUserAPC(&NoopAPCFunc, child_, (ULONG_PTR)NULL);
+   subproc->OnPipeReady();
+ 
+   if (subproc->Done()) {
+--- a/src/subprocess.h
++++ b/src/subprocess.h
+@@ -76,6 +76,8 @@ struct Subprocess {
+   friend struct SubprocessSet;
+ };
+ 
++struct TokenPool;
 +
-+  // return true when GetQueuedCompletionStatus() returned our key
-+  return key == (ULONG_PTR) this;
-+}
+ /// SubprocessSet runs a ppoll/pselect() loop around a set of Subprocesses.
+ /// DoWork() waits for any state change in subprocesses; finished_
+ /// is a queue of subprocesses as they finish.
+@@ -84,13 +86,17 @@ struct SubprocessSet {
+   ~SubprocessSet();
+ 
+   Subprocess* Add(const std::string& command, bool use_console = false);
+-  bool DoWork();
++  bool DoWork(TokenPool* tokens);
+   Subprocess* NextFinished();
+   void Clear();
+ 
+   std::vector<Subprocess*> running_;
+   std::queue<Subprocess*> finished_;
+ 
++  bool token_available_;
++  bool IsTokenAvailable() { return token_available_; }
++  void ResetTokenAvailable() { token_available_ = false; }
 +
-+void GNUmakeTokenPoolWin32::ReleaseSemaphore(HANDLE semaphore) {
-+  if (!::ReleaseSemaphore(semaphore, 1, NULL))
-+    Win32Fatal("ReleaseSemaphore");
-+}
+ #ifdef _WIN32
+   static BOOL WINAPI NotifyInterrupted(DWORD dwCtrlType);
+   static HANDLE ioport_;
+--- a/src/subprocess_test.cc
++++ b/src/subprocess_test.cc
+@@ -13,6 +13,7 @@
+ // limitations under the License.
+ 
+ #include "subprocess.h"
++#include "tokenpool.h"
+ 
+ #include "test.h"
+ 
+@@ -34,8 +35,30 @@ const char* kSimpleCommand = "cmd /c dir
+ const char* kSimpleCommand = "ls /";
+ #endif
+ 
++struct TestTokenPool : public TokenPool {
++  bool Acquire()     { return false; }
++  void Reserve()     {}
++  void Release()     {}
++  void Clear()       {}
++  bool Setup(bool ignore_unused, bool verbose, double& max_load_average) { return false; }
 +
-+void GNUmakeTokenPoolWin32::WaitForObject(HANDLE object) {
-+  if (WaitForSingleObject(object, INFINITE) != WAIT_OBJECT_0)
-+    Win32Fatal("WaitForSingleObject");
-+}
++#ifdef _WIN32
++  bool _token_available;
++  void WaitForTokenAvailability(HANDLE ioport) {
++    if (_token_available)
++      // unblock GetQueuedCompletionStatus()
++      PostQueuedCompletionStatus(ioport, 0, (ULONG_PTR) this, NULL);
++  }
++  bool TokenIsAvailable(ULONG_PTR key) { return key == (ULONG_PTR) this; }
++#else
++  int _fd;
++  int GetMonitorFd() { return _fd; }
++#endif
++};
 +
-+struct TokenPool *TokenPool::Get() {
-+  return new GNUmakeTokenPoolWin32;
-+}
-diff --git a/src/tokenpool-gnu-make.cc b/src/tokenpool-gnu-make.cc
-index 4132bb06d9..92ff611721 100644
---- a/src/tokenpool-gnu-make.cc
-+++ b/src/tokenpool-gnu-make.cc
-@@ -12,101 +12,26 @@
- // See the License for the specific language governing permissions and
- // limitations under the License.
+ struct SubprocessTest : public testing::Test {
+   SubprocessSet subprocs_;
++  TestTokenPool tokens_;
+ };
  
--#include "tokenpool.h"
-+#include "tokenpool-gnu-make.h"
+ }  // anonymous namespace
+@@ -45,10 +68,12 @@ TEST_F(SubprocessTest, BadCommandStderr)
+   Subprocess* subproc = subprocs_.Add("cmd /c ninja_no_such_command");
+   ASSERT_NE((Subprocess *) 0, subproc);
  
--#include <errno.h>
--#include <fcntl.h>
--#include <poll.h>
--#include <unistd.h>
--#include <signal.h>
--#include <sys/time.h>
-+#include <stdlib.h>
- #include <stdio.h>
- #include <string.h>
--#include <stdlib.h>
++  subprocs_.ResetTokenAvailable();
+   while (!subproc->Done()) {
+     // Pretend we discovered that stderr was ready for writing.
+-    subprocs_.DoWork();
++    subprocs_.DoWork(NULL);
+   }
++  ASSERT_FALSE(subprocs_.IsTokenAvailable());
  
- #include "line_printer.h"
+   EXPECT_EQ(ExitFailure, subproc->Finish());
+   EXPECT_NE("", subproc->GetOutput());
+@@ -59,10 +84,12 @@ TEST_F(SubprocessTest, NoSuchCommand) {
+   Subprocess* subproc = subprocs_.Add("ninja_no_such_command");
+   ASSERT_NE((Subprocess *) 0, subproc);
  
--// TokenPool implementation for GNU make jobserver
--// (http://make.mad-scientist.net/papers/jobserver-implementation/)
--struct GNUmakeTokenPool : public TokenPool {
--  GNUmakeTokenPool();
--  virtual ~GNUmakeTokenPool();
--
--  virtual bool Acquire();
--  virtual void Reserve();
--  virtual void Release();
--  virtual void Clear();
--  virtual int GetMonitorFd();
--
--  bool Setup(bool ignore, bool verbose, double& max_load_average);
--
-- private:
--  int available_;
--  int used_;
--
--#ifdef _WIN32
--  // @TODO
--#else
--  int rfd_;
--  int wfd_;
--
--  struct sigaction old_act_;
--  bool restore_;
--
--  static int dup_rfd_;
--  static void CloseDupRfd(int signum);
--
--  bool CheckFd(int fd);
--  bool SetAlarmHandler();
--#endif
--
--  void Return();
--};
--
-+// TokenPool implementation for GNU make jobserver - common bits
- // every instance owns an implicit token -> available_ == 1
--GNUmakeTokenPool::GNUmakeTokenPool() : available_(1), used_(0),
--                                       rfd_(-1), wfd_(-1), restore_(false) {
-+GNUmakeTokenPool::GNUmakeTokenPool() : available_(1), used_(0) {
- }
++  subprocs_.ResetTokenAvailable();
+   while (!subproc->Done()) {
+     // Pretend we discovered that stderr was ready for writing.
+-    subprocs_.DoWork();
++    subprocs_.DoWork(NULL);
+   }
++  ASSERT_FALSE(subprocs_.IsTokenAvailable());
  
- GNUmakeTokenPool::~GNUmakeTokenPool() {
--  Clear();
--  if (restore_)
--    sigaction(SIGALRM, &old_act_, NULL);
--}
--
--bool GNUmakeTokenPool::CheckFd(int fd) {
--  if (fd < 0)
--    return false;
--  int ret = fcntl(fd, F_GETFD);
--  if (ret < 0)
--    return false;
--  return true;
--}
--
--int GNUmakeTokenPool::dup_rfd_ = -1;
--
--void GNUmakeTokenPool::CloseDupRfd(int signum) {
--  close(dup_rfd_);
--  dup_rfd_ = -1;
--}
--
--bool GNUmakeTokenPool::SetAlarmHandler() {
--  struct sigaction act;
--  memset(&act, 0, sizeof(act));
--  act.sa_handler = CloseDupRfd;
--  if (sigaction(SIGALRM, &act, &old_act_) < 0) {
--    perror("sigaction:");
--    return(false);
--  } else {
--    restore_ = true;
--    return(true);
--  }
- }
+   EXPECT_EQ(ExitFailure, subproc->Finish());
+   EXPECT_NE("", subproc->GetOutput());
+@@ -78,9 +105,11 @@ TEST_F(SubprocessTest, InterruptChild) {
+   Subprocess* subproc = subprocs_.Add("kill -INT $$");
+   ASSERT_NE((Subprocess *) 0, subproc);
  
- bool GNUmakeTokenPool::Setup(bool ignore,
-                              bool verbose,
-                              double& max_load_average) {
--  const char *value = getenv("MAKEFLAGS");
-+  const char *value = GetEnv("MAKEFLAGS");
-   if (value) {
-     // GNU make <= 4.1
-     const char *jobserver = strstr(value, "--jobserver-fds=");
-@@ -119,20 +44,13 @@ bool GNUmakeTokenPool::Setup(bool ignore,
-       if (ignore) {
-         printer.PrintOnNewLine("ninja: warning: -jN forced on command line; ignoring GNU make jobserver.\n");
-       } else {
--        int rfd = -1;
--        int wfd = -1;
--        if ((sscanf(jobserver, "%*[^=]=%d,%d", &rfd, &wfd) == 2) &&
--            CheckFd(rfd) &&
--            CheckFd(wfd) &&
--            SetAlarmHandler()) {
-+        if (ParseAuth(jobserver)) {
-           const char *l_arg = strstr(value, " -l");
-           int load_limit = -1;
++  subprocs_.ResetTokenAvailable();
+   while (!subproc->Done()) {
+-    subprocs_.DoWork();
++    subprocs_.DoWork(NULL);
+   }
++  ASSERT_FALSE(subprocs_.IsTokenAvailable());
  
-           if (verbose) {
-             printer.PrintOnNewLine("ninja: using GNU make jobserver.\n");
-           }
--          rfd_ = rfd;
--          wfd_ = wfd;
+   EXPECT_EQ(ExitInterrupted, subproc->Finish());
+ }
+@@ -90,7 +119,7 @@ TEST_F(SubprocessTest, InterruptParent)
+   ASSERT_NE((Subprocess *) 0, subproc);
  
-           // translate GNU make -lN to ninja -lN
-           if (l_arg &&
-@@ -154,83 +72,14 @@ bool GNUmakeTokenPool::Acquire() {
-   if (available_ > 0)
-     return true;
+   while (!subproc->Done()) {
+-    bool interrupted = subprocs_.DoWork();
++    bool interrupted = subprocs_.DoWork(NULL);
+     if (interrupted)
+       return;
+   }
+@@ -102,9 +131,11 @@ TEST_F(SubprocessTest, InterruptChildWit
+   Subprocess* subproc = subprocs_.Add("kill -TERM $$");
+   ASSERT_NE((Subprocess *) 0, subproc);
  
--  // Please read
--  //
--  //   http://make.mad-scientist.net/papers/jobserver-implementation/
--  //
--  // for the reasoning behind the following code.
--  //
--  // Try to read one character from the pipe. Returns true on success.
--  //
--  // First check if read() would succeed without blocking.
--#ifdef USE_PPOLL
--  pollfd pollfds[] = {{rfd_, POLLIN, 0}};
--  int ret = poll(pollfds, 1, 0);
--#else
--  fd_set set;
--  struct timeval timeout = { 0, 0 };
--  FD_ZERO(&set);
--  FD_SET(rfd_, &set);
--  int ret = select(rfd_ + 1, &set, NULL, NULL, &timeout);
--#endif
--  if (ret > 0) {
--    // Handle potential race condition:
--    //  - the above check succeeded, i.e. read() should not block
--    //  - the character disappears before we call read()
--    //
--    // Create a duplicate of rfd_. The duplicate file descriptor dup_rfd_
--    // can safely be closed by signal handlers without affecting rfd_.
--    dup_rfd_ = dup(rfd_);
--
--    if (dup_rfd_ != -1) {
--      struct sigaction act, old_act;
--      int ret = 0;
--
--      // Temporarily replace SIGCHLD handler with our own
--      memset(&act, 0, sizeof(act));
--      act.sa_handler = CloseDupRfd;
--      if (sigaction(SIGCHLD, &act, &old_act) == 0) {
--        struct itimerval timeout;
--
--        // install a 100ms timeout that generates SIGALARM on expiration
--        memset(&timeout, 0, sizeof(timeout));
--        timeout.it_value.tv_usec = 100 * 1000; // [ms] -> [usec]
--        if (setitimer(ITIMER_REAL, &timeout, NULL) == 0) {
--          char buf;
--
--          // Now try to read() from dup_rfd_. Return values from read():
--          //
--          // 1. token read                               ->  1
--          // 2. pipe closed                              ->  0
--          // 3. alarm expires                            -> -1 (EINTR)
--          // 4. child exits                              -> -1 (EINTR)
--          // 5. alarm expired before entering read()     -> -1 (EBADF)
--          // 6. child exited before entering read()      -> -1 (EBADF)
--          // 7. child exited before handler is installed -> go to 1 - 3
--          ret = read(dup_rfd_, &buf, 1);
--
--          // disarm timer
--          memset(&timeout, 0, sizeof(timeout));
--          setitimer(ITIMER_REAL, &timeout, NULL);
--        }
--
--        sigaction(SIGCHLD, &old_act, NULL);
--      }
--
--      CloseDupRfd(0);
--
--      // Case 1 from above list
--      if (ret > 0) {
--        available_++;
--        return true;
--      }
--    }
-+  if (AcquireToken()) {
-+    // token acquired
-+    available_++;
-+    return true;
-+  } else {
-+    // no token available
-+    return false;
++  subprocs_.ResetTokenAvailable();
+   while (!subproc->Done()) {
+-    subprocs_.DoWork();
++    subprocs_.DoWork(NULL);
    }
--
--  // read() would block, i.e. no token available,
--  // cases 2-6 from above list or
--  // select() / poll() / dup() / sigaction() / setitimer() failed
--  return false;
- }
++  ASSERT_FALSE(subprocs_.IsTokenAvailable());
  
- void GNUmakeTokenPool::Reserve() {
-@@ -239,15 +88,8 @@ void GNUmakeTokenPool::Reserve() {
+   EXPECT_EQ(ExitInterrupted, subproc->Finish());
  }
+@@ -114,7 +145,7 @@ TEST_F(SubprocessTest, InterruptParentWi
+   ASSERT_NE((Subprocess *) 0, subproc);
  
- void GNUmakeTokenPool::Return() {
--  const char buf = '+';
--  while (1) {
--    int ret = write(wfd_, &buf, 1);
--    if (ret > 0)
--      available_--;
--    if ((ret != -1) || (errno != EINTR))
--      return;
--    // write got interrupted - retry
--  }
-+  if (ReturnToken())
-+    available_--;
- }
+   while (!subproc->Done()) {
+-    bool interrupted = subprocs_.DoWork();
++    bool interrupted = subprocs_.DoWork(NULL);
+     if (interrupted)
+       return;
+   }
+@@ -126,9 +157,11 @@ TEST_F(SubprocessTest, InterruptChildWit
+   Subprocess* subproc = subprocs_.Add("kill -HUP $$");
+   ASSERT_NE((Subprocess *) 0, subproc);
+ 
++  subprocs_.ResetTokenAvailable();
+   while (!subproc->Done()) {
+-    subprocs_.DoWork();
++    subprocs_.DoWork(NULL);
+   }
++  ASSERT_FALSE(subprocs_.IsTokenAvailable());
  
- void GNUmakeTokenPool::Release() {
-@@ -263,18 +105,3 @@ void GNUmakeTokenPool::Clear() {
-   while (available_ > 1)
-     Return();
+   EXPECT_EQ(ExitInterrupted, subproc->Finish());
  }
+@@ -138,7 +171,7 @@ TEST_F(SubprocessTest, InterruptParentWi
+   ASSERT_NE((Subprocess *) 0, subproc);
+ 
+   while (!subproc->Done()) {
+-    bool interrupted = subprocs_.DoWork();
++    bool interrupted = subprocs_.DoWork(NULL);
+     if (interrupted)
+       return;
+   }
+@@ -153,9 +186,11 @@ TEST_F(SubprocessTest, Console) {
+         subprocs_.Add("test -t 0 -a -t 1 -a -t 2", /*use_console=*/true);
+     ASSERT_NE((Subprocess*)0, subproc);
+ 
++    subprocs_.ResetTokenAvailable();
+     while (!subproc->Done()) {
+-      subprocs_.DoWork();
++      subprocs_.DoWork(NULL);
+     }
++    ASSERT_FALSE(subprocs_.IsTokenAvailable());
+ 
+     EXPECT_EQ(ExitSuccess, subproc->Finish());
+   }
+@@ -167,9 +202,11 @@ TEST_F(SubprocessTest, SetWithSingle) {
+   Subprocess* subproc = subprocs_.Add(kSimpleCommand);
+   ASSERT_NE((Subprocess *) 0, subproc);
+ 
++  subprocs_.ResetTokenAvailable();
+   while (!subproc->Done()) {
+-    subprocs_.DoWork();
++    subprocs_.DoWork(NULL);
+   }
++  ASSERT_FALSE(subprocs_.IsTokenAvailable());
+   ASSERT_EQ(ExitSuccess, subproc->Finish());
+   ASSERT_NE("", subproc->GetOutput());
+ 
+@@ -200,12 +237,13 @@ TEST_F(SubprocessTest, SetWithMulti) {
+     ASSERT_EQ("", processes[i]->GetOutput());
+   }
+ 
++  subprocs_.ResetTokenAvailable();
+   while (!processes[0]->Done() || !processes[1]->Done() ||
+          !processes[2]->Done()) {
+     ASSERT_GT(subprocs_.running_.size(), 0u);
+-    subprocs_.DoWork();
++    subprocs_.DoWork(NULL);
+   }
 -
--int GNUmakeTokenPool::GetMonitorFd() {
--  return(rfd_);
--}
--
--struct TokenPool *TokenPool::Get(bool ignore,
--                                 bool verbose,
--                                 double& max_load_average) {
--  GNUmakeTokenPool *tokenpool = new GNUmakeTokenPool;
--  if (tokenpool->Setup(ignore, verbose, max_load_average))
--    return tokenpool;
--  else
--    delete tokenpool;
--  return NULL;
--}
-diff --git a/src/tokenpool-gnu-make.h b/src/tokenpool-gnu-make.h
-new file mode 100644
-index 0000000000..d3852088e2
++  ASSERT_FALSE(subprocs_.IsTokenAvailable());
+   ASSERT_EQ(0u, subprocs_.running_.size());
+   ASSERT_EQ(3u, subprocs_.finished_.size());
+ 
+@@ -237,8 +275,10 @@ TEST_F(SubprocessTest, SetWithLots) {
+     ASSERT_NE((Subprocess *) 0, subproc);
+     procs.push_back(subproc);
+   }
++  subprocs_.ResetTokenAvailable();
+   while (!subprocs_.running_.empty())
+-    subprocs_.DoWork();
++    subprocs_.DoWork(NULL);
++  ASSERT_FALSE(subprocs_.IsTokenAvailable());
+   for (size_t i = 0; i < procs.size(); ++i) {
+     ASSERT_EQ(ExitSuccess, procs[i]->Finish());
+     ASSERT_NE("", procs[i]->GetOutput());
+@@ -254,10 +294,91 @@ TEST_F(SubprocessTest, SetWithLots) {
+ // that stdin is closed.
+ TEST_F(SubprocessTest, ReadStdin) {
+   Subprocess* subproc = subprocs_.Add("cat -");
++  subprocs_.ResetTokenAvailable();
+   while (!subproc->Done()) {
+-    subprocs_.DoWork();
++    subprocs_.DoWork(NULL);
+   }
++  ASSERT_FALSE(subprocs_.IsTokenAvailable());
+   ASSERT_EQ(ExitSuccess, subproc->Finish());
+   ASSERT_EQ(1u, subprocs_.finished_.size());
+ }
+ #endif  // _WIN32
++
++TEST_F(SubprocessTest, TokenAvailable) {
++  Subprocess* subproc = subprocs_.Add(kSimpleCommand);
++  ASSERT_NE((Subprocess *) 0, subproc);
++
++  // simulate GNUmake jobserver pipe with 1 token
++#ifdef _WIN32
++  tokens_._token_available = true;
++#else
++  int fds[2];
++  ASSERT_EQ(0u, pipe(fds));
++  tokens_._fd = fds[0];
++  ASSERT_EQ(1u, write(fds[1], "T", 1));
++#endif
++
++  subprocs_.ResetTokenAvailable();
++  subprocs_.DoWork(&tokens_);
++#ifdef _WIN32
++  tokens_._token_available = false;
++  // we need to loop here as we have no control where the token
++  // I/O completion post ends up in the queue
++  while (!subproc->Done() && !subprocs_.IsTokenAvailable()) {
++    subprocs_.DoWork(&tokens_);
++  }
++#endif
++
++  EXPECT_TRUE(subprocs_.IsTokenAvailable());
++  EXPECT_EQ(0u, subprocs_.finished_.size());
++
++  // remove token to let DoWork() wait for command again
++#ifndef _WIN32
++  char token;
++  ASSERT_EQ(1u, read(fds[0], &token, 1));
++#endif
++
++  while (!subproc->Done()) {
++    subprocs_.DoWork(&tokens_);
++  }
++
++#ifndef _WIN32
++  close(fds[1]);
++  close(fds[0]);
++#endif
++
++  EXPECT_EQ(ExitSuccess, subproc->Finish());
++  EXPECT_NE("", subproc->GetOutput());
++
++  EXPECT_EQ(1u, subprocs_.finished_.size());
++}
++
++TEST_F(SubprocessTest, TokenNotAvailable) {
++  Subprocess* subproc = subprocs_.Add(kSimpleCommand);
++  ASSERT_NE((Subprocess *) 0, subproc);
++
++  // simulate GNUmake jobserver pipe with 0 tokens
++#ifdef _WIN32
++  tokens_._token_available = false;
++#else
++  int fds[2];
++  ASSERT_EQ(0u, pipe(fds));
++  tokens_._fd = fds[0];
++#endif
++
++  subprocs_.ResetTokenAvailable();
++  while (!subproc->Done()) {
++    subprocs_.DoWork(&tokens_);
++  }
++
++#ifndef _WIN32
++  close(fds[1]);
++  close(fds[0]);
++#endif
++
++  EXPECT_FALSE(subprocs_.IsTokenAvailable());
++  EXPECT_EQ(ExitSuccess, subproc->Finish());
++  EXPECT_NE("", subproc->GetOutput());
++
++  EXPECT_EQ(1u, subprocs_.finished_.size());
++}
+--- a/src/ninja.cc
++++ b/src/ninja.cc
+@@ -1447,6 +1447,7 @@ int ReadFlags(int* argc, char*** argv,
+         // We want to run N jobs in parallel. For N = 0, INT_MAX
+         // is close enough to infinite for most sane builds.
+         config->parallelism = value > 0 ? value : INT_MAX;
++        config->parallelism_from_cmdline = true;
+         deferGuessParallelism.needGuess = false;
+         break;
+       }
 --- /dev/null
-+++ b/src/tokenpool-gnu-make.h
-@@ -0,0 +1,40 @@
-+// Copyright 2016-2018 Google Inc. All Rights Reserved.
++++ b/src/tokenpool_test.cc
+@@ -0,0 +1,279 @@
++// Copyright 2018 Google Inc. All Rights Reserved.
 +//
 +// Licensed under the Apache License, Version 2.0 (the "License");
 +// you may not use this file except in compliance with the License.
@@ -3356,107 +1372,17 @@ index 0000000000..d3852088e2
 +
 +#include "tokenpool.h"
 +
-+// interface to GNU make token pool
-+struct GNUmakeTokenPool : public TokenPool {
-+  GNUmakeTokenPool();
-+  virtual ~GNUmakeTokenPool();
-+
-+  // token pool implementation
-+  virtual bool Acquire();
-+  virtual void Reserve();
-+  virtual void Release();
-+  virtual void Clear();
-+  virtual bool Setup(bool ignore, bool verbose, double& max_load_average);
-+
-+  // platform specific implementation
-+  virtual const char *GetEnv(const char *name) = 0;
-+  virtual bool ParseAuth(const char *jobserver) = 0;
-+  virtual bool AcquireToken() = 0;
-+  virtual bool ReturnToken() = 0;
-+
-+ private:
-+  int available_;
-+  int used_;
-+
-+  void Return();
-+};
-diff --git a/src/tokenpool-none.cc b/src/tokenpool-none.cc
-index 4c592875b4..613d16882d 100644
---- a/src/tokenpool-none.cc
-+++ b/src/tokenpool-none.cc
-@@ -17,8 +17,6 @@
- #include <stdlib.h>
- 
- // No-op TokenPool implementation
--struct TokenPool *TokenPool::Get(bool ignore,
--                                 bool verbose,
--                                 double& max_load_average) {
-+struct TokenPool *TokenPool::Get() {
-   return NULL;
- }
-diff --git a/src/tokenpool.h b/src/tokenpool.h
-index 4bf477f20c..1be8e1d5ce 100644
---- a/src/tokenpool.h
-+++ b/src/tokenpool.h
-@@ -1,4 +1,4 @@
--// Copyright 2016-2017 Google Inc. All Rights Reserved.
-+// Copyright 2016-2018 Google Inc. All Rights Reserved.
- //
- // Licensed under the Apache License, Version 2.0 (the "License");
- // you may not use this file except in compliance with the License.
-@@ -12,6 +12,10 @@
- // See the License for the specific language governing permissions and
- // limitations under the License.
- 
-+#ifdef _WIN32
-+#include <windows.h>
-+#endif
-+
- // interface to token pool
- struct TokenPool {
-   virtual ~TokenPool() {}
-@@ -21,14 +25,18 @@ struct TokenPool {
-   virtual void Release() = 0;
-   virtual void Clear() = 0;
- 
-+  // returns false if token pool setup failed
-+  virtual bool Setup(bool ignore, bool verbose, double& max_load_average) = 0;
++#include "test.h"
 +
- #ifdef _WIN32
--  // @TODO
-+  virtual void WaitForTokenAvailability(HANDLE ioport) = 0;
-+  // returns true if a token has become available
-+  // key is result from GetQueuedCompletionStatus()
-+  virtual bool TokenIsAvailable(ULONG_PTR key) = 0;
- #else
-   virtual int GetMonitorFd() = 0;
- #endif
- 
-   // returns NULL if token pool is not available
--  static struct TokenPool *Get(bool ignore,
--                               bool verbose,
--                               double& max_load_average);
-+  static struct TokenPool *Get();
- };
-diff --git a/src/tokenpool_test.cc b/src/tokenpool_test.cc
-index 6c89064ca4..8d4fd7d33a 100644
---- a/src/tokenpool_test.cc
-+++ b/src/tokenpool_test.cc
-@@ -16,13 +16,25 @@
- 
- #include "test.h"
- 
--#ifndef _WIN32
 +#ifdef _WIN32
 +#include <windows.h>
 +#else
 +#include <unistd.h>
 +#endif
 +
- #include <stdio.h>
- #include <stdlib.h>
--#include <unistd.h>
- 
++#include <stdio.h>
++#include <stdlib.h>
++
 +#ifdef _WIN32
 +// should contain all valid characters
 +#define SEMAPHORE_NAME      "abcdefghijklmnopqrstwxyz01234567890_"
@@ -3465,45 +1391,44 @@ index 6c89064ca4..8d4fd7d33a 100644
 +#define ENVIRONMENT_INIT(v) SetEnvironmentVariable("MAKEFLAGS", v)
 +#else
 +#define AUTH_FORMAT(tmpl)   "foo " tmpl "=%d,%d bar"
- #define ENVIRONMENT_CLEAR() unsetenv("MAKEFLAGS")
--#define ENVIRONMENT_INIT(v) setenv("MAKEFLAGS", v, true);
++#define ENVIRONMENT_CLEAR() unsetenv("MAKEFLAGS")
 +#define ENVIRONMENT_INIT(v) setenv("MAKEFLAGS", v, true)
- #endif
- 
- namespace {
-@@ -32,43 +44,60 @@ const double kLoadAverageDefault = -1.23456789;
- struct TokenPoolTest : public testing::Test {
-   double load_avg_;
-   TokenPool *tokens_;
--#ifndef _WIN32
-   char buf_[1024];
++#endif
++
++namespace {
++
++const double kLoadAverageDefault = -1.23456789;
++
++struct TokenPoolTest : public testing::Test {
++  double load_avg_;
++  TokenPool* tokens_;
++  char buf_[1024];
 +#ifdef _WIN32
-+  const char *semaphore_name_;
++  const char* semaphore_name_;
 +  HANDLE semaphore_;
 +#else
-   int fds_[2];
- #endif
- 
-   virtual void SetUp() {
-     load_avg_ = kLoadAverageDefault;
-     tokens_ = NULL;
--#ifndef _WIN32
-     ENVIRONMENT_CLEAR();
++  int fds_[2];
++
++  char random() {
++    return int((rand() / double(RAND_MAX)) * 256);
++  }
++#endif
++
++  virtual void SetUp() {
++    load_avg_ = kLoadAverageDefault;
++    tokens_ = NULL;
++    ENVIRONMENT_CLEAR();
 +#ifdef _WIN32
 +    semaphore_name_ = SEMAPHORE_NAME;
 +    if ((semaphore_ = CreateSemaphore(0, 0, 2, SEMAPHORE_NAME)) == NULL)
 +#else
-     if (pipe(fds_) < 0)
--      ASSERT_TRUE(false);
- #endif
++    if (pipe(fds_) < 0)
++#endif
 +      ASSERT_TRUE(false);
-   }
- 
--  void CreatePool(const char *format, bool ignore_jobserver) {
--#ifndef _WIN32
-+  void CreatePool(const char *format, bool ignore_jobserver = false) {
-     if (format) {
--      sprintf(buf_, format, fds_[0], fds_[1]);
++  }
++
++  void CreatePool(const char* format, bool ignore_jobserver = false) {
++    if (format) {
 +      sprintf(buf_, format,
 +#ifdef _WIN32
 +              semaphore_name_
@@ -3511,69 +1436,73 @@ index 6c89064ca4..8d4fd7d33a 100644
 +              fds_[0], fds_[1]
 +#endif
 +      );
-       ENVIRONMENT_INIT(buf_);
-     }
--#endif
--    tokens_ = TokenPool::Get(ignore_jobserver, false, load_avg_);
++      ENVIRONMENT_INIT(buf_);
++    }
 +    if ((tokens_ = TokenPool::Get()) != NULL) {
 +      if (!tokens_->Setup(ignore_jobserver, false, load_avg_)) {
 +        delete tokens_;
 +        tokens_ = NULL;
 +      }
 +    }
-   }
- 
-   void CreateDefaultPool() {
--    CreatePool("foo --jobserver-auth=%d,%d bar", false);
++  }
++
++  void CreateDefaultPool() {
 +    CreatePool(AUTH_FORMAT("--jobserver-auth"));
-   }
- 
-   virtual void TearDown() {
-     if (tokens_)
-       delete tokens_;
--#ifndef _WIN32
++  }
++
++  virtual void TearDown() {
++    if (tokens_)
++      delete tokens_;
 +#ifdef _WIN32
 +    CloseHandle(semaphore_);
 +#else
-     close(fds_[0]);
-     close(fds_[1]);
--    ENVIRONMENT_CLEAR();
- #endif
++    close(fds_[0]);
++    close(fds_[1]);
++#endif
 +    ENVIRONMENT_CLEAR();
-   }
- };
- 
-@@ -82,10 +111,9 @@ TEST_F(TokenPoolTest, NoTokenPool) {
-   EXPECT_EQ(kLoadAverageDefault, load_avg_);
- }
- 
--#ifndef _WIN32
- TEST_F(TokenPoolTest, SuccessfulOldSetup) {
-   // GNUmake <= 4.1
--  CreatePool("foo --jobserver-fds=%d,%d bar", false);
++  }
++};
++
++} // anonymous namespace
++
++// verifies none implementation
++TEST_F(TokenPoolTest, NoTokenPool) {
++  CreatePool(NULL, false);
++
++  EXPECT_EQ(NULL, tokens_);
++  EXPECT_EQ(kLoadAverageDefault, load_avg_);
++}
++
++TEST_F(TokenPoolTest, SuccessfulOldSetup) {
++  // GNUmake <= 4.1
 +  CreatePool(AUTH_FORMAT("--jobserver-fds"));
- 
-   EXPECT_NE(NULL, tokens_);
-   EXPECT_EQ(kLoadAverageDefault, load_avg_);
-@@ -100,19 +128,37 @@ TEST_F(TokenPoolTest, SuccessfulNewSetup) {
- }
- 
- TEST_F(TokenPoolTest, IgnoreWithJN) {
--  CreatePool("foo --jobserver-auth=%d,%d bar", true);
++
++  EXPECT_NE(NULL, tokens_);
++  EXPECT_EQ(kLoadAverageDefault, load_avg_);
++}
++
++TEST_F(TokenPoolTest, SuccessfulNewSetup) {
++  // GNUmake => 4.2
++  CreateDefaultPool();
++
++  EXPECT_NE(NULL, tokens_);
++  EXPECT_EQ(kLoadAverageDefault, load_avg_);
++}
++
++TEST_F(TokenPoolTest, IgnoreWithJN) {
 +  CreatePool(AUTH_FORMAT("--jobserver-auth"), true);
- 
-   EXPECT_EQ(NULL, tokens_);
-   EXPECT_EQ(kLoadAverageDefault, load_avg_);
- }
- 
- TEST_F(TokenPoolTest, HonorLN) {
--  CreatePool("foo -l9 --jobserver-auth=%d,%d bar", false);
++
++  EXPECT_EQ(NULL, tokens_);
++  EXPECT_EQ(kLoadAverageDefault, load_avg_);
++}
++
++TEST_F(TokenPoolTest, HonorLN) {
 +  CreatePool(AUTH_FORMAT("-l9 --jobserver-auth"));
- 
-   EXPECT_NE(NULL, tokens_);
-   EXPECT_EQ(9.0, load_avg_);
- }
- 
++
++  EXPECT_NE(NULL, tokens_);
++  EXPECT_EQ(9.0, load_avg_);
++}
++
 +#ifdef _WIN32
 +TEST_F(TokenPoolTest, SemaphoreNotFound) {
 +  semaphore_name_ = SEMAPHORE_NAME "_foobar";
@@ -3592,66 +1521,104 @@ index 6c89064ca4..8d4fd7d33a 100644
 +  EXPECT_TRUE(tokens_->TokenIsAvailable((ULONG_PTR)tokens_));
 +}
 +#else
- TEST_F(TokenPoolTest, MonitorFD) {
-   CreateDefaultPool();
- 
-@@ -121,6 +167,7 @@ TEST_F(TokenPoolTest, MonitorFD) {
- 
-   EXPECT_EQ(fds_[0], tokens_->GetMonitorFd());
- }
++TEST_F(TokenPoolTest, MonitorFD) {
++  CreateDefaultPool();
++
++  ASSERT_NE(NULL, tokens_);
++  EXPECT_EQ(kLoadAverageDefault, load_avg_);
++
++  EXPECT_EQ(fds_[0], tokens_->GetMonitorFd());
++}
 +#endif
- 
- TEST_F(TokenPoolTest, ImplicitToken) {
-   CreateDefaultPool();
-@@ -147,7 +194,13 @@ TEST_F(TokenPoolTest, TwoTokens) {
-   EXPECT_FALSE(tokens_->Acquire());
- 
-   // jobserver offers 2nd token
++
++TEST_F(TokenPoolTest, ImplicitToken) {
++  CreateDefaultPool();
++
++  ASSERT_NE(NULL, tokens_);
++  EXPECT_EQ(kLoadAverageDefault, load_avg_);
++
++  EXPECT_TRUE(tokens_->Acquire());
++  tokens_->Reserve();
++  EXPECT_FALSE(tokens_->Acquire());
++  tokens_->Release();
++  EXPECT_TRUE(tokens_->Acquire());
++}
++
++TEST_F(TokenPoolTest, TwoTokens) {
++  CreateDefaultPool();
++
++  ASSERT_NE(NULL, tokens_);
++  EXPECT_EQ(kLoadAverageDefault, load_avg_);
++
++  // implicit token
++  EXPECT_TRUE(tokens_->Acquire());
++  tokens_->Reserve();
++  EXPECT_FALSE(tokens_->Acquire());
++
++  // jobserver offers 2nd token
 +#ifdef _WIN32
 +  LONG previous;
 +  ASSERT_TRUE(ReleaseSemaphore(semaphore_, 1, &previous));
 +  ASSERT_EQ(0, previous);
 +#else
-   ASSERT_EQ(1u, write(fds_[1], "T", 1));
++  char test_tokens[1] = { random() };
++  ASSERT_EQ(1u, write(fds_[1], test_tokens, sizeof(test_tokens)));
 +#endif
-   EXPECT_TRUE(tokens_->Acquire());
-   tokens_->Reserve();
-   EXPECT_FALSE(tokens_->Acquire());
-@@ -160,8 +213,14 @@ TEST_F(TokenPoolTest, TwoTokens) {
-   tokens_->Release();
-   EXPECT_TRUE(tokens_->Acquire());
- 
--  // there must be one token in the pipe
++  EXPECT_TRUE(tokens_->Acquire());
++  tokens_->Reserve();
++  EXPECT_FALSE(tokens_->Acquire());
++
++  // release 2nd token
++  tokens_->Release();
++  EXPECT_TRUE(tokens_->Acquire());
++
++  // release implicit token - must return 2nd token back to jobserver
++  tokens_->Release();
++  EXPECT_TRUE(tokens_->Acquire());
++
 +  // there must be one token available
 +#ifdef _WIN32
 +  EXPECT_EQ(WAIT_OBJECT_0, WaitForSingleObject(semaphore_, 0));
 +  EXPECT_TRUE(ReleaseSemaphore(semaphore_, 1, &previous));
 +  EXPECT_EQ(0, previous);
 +#else
-   EXPECT_EQ(1u, read(fds_[0], buf_, sizeof(buf_)));
++  EXPECT_EQ(1u, read(fds_[0], buf_, sizeof(buf_)));
++  EXPECT_EQ(test_tokens[0], buf_[0]);
 +#endif
- 
-   // implicit token
-   EXPECT_TRUE(tokens_->Acquire());
-@@ -179,7 +238,13 @@ TEST_F(TokenPoolTest, Clear) {
-   EXPECT_FALSE(tokens_->Acquire());
- 
-   // jobserver offers 2nd & 3rd token
++
++  // implicit token
++  EXPECT_TRUE(tokens_->Acquire());
++}
++
++TEST_F(TokenPoolTest, Clear) {
++  CreateDefaultPool();
++
++  ASSERT_NE(NULL, tokens_);
++  EXPECT_EQ(kLoadAverageDefault, load_avg_);
++
++  // implicit token
++  EXPECT_TRUE(tokens_->Acquire());
++  tokens_->Reserve();
++  EXPECT_FALSE(tokens_->Acquire());
++
++  // jobserver offers 2nd & 3rd token
 +#ifdef _WIN32
 +  LONG previous;
 +  ASSERT_TRUE(ReleaseSemaphore(semaphore_, 2, &previous));
 +  ASSERT_EQ(0, previous);
 +#else
-   ASSERT_EQ(2u, write(fds_[1], "TT", 2));
++  char test_tokens[2] = { random(), random() };
++  ASSERT_EQ(2u, write(fds_[1], test_tokens, sizeof(test_tokens)));
 +#endif
-   EXPECT_TRUE(tokens_->Acquire());
-   tokens_->Reserve();
-   EXPECT_TRUE(tokens_->Acquire());
-@@ -189,10 +254,16 @@ TEST_F(TokenPoolTest, Clear) {
-   tokens_->Clear();
-   EXPECT_TRUE(tokens_->Acquire());
- 
--  // there must be two tokens in the pipe
++  EXPECT_TRUE(tokens_->Acquire());
++  tokens_->Reserve();
++  EXPECT_TRUE(tokens_->Acquire());
++  tokens_->Reserve();
++  EXPECT_FALSE(tokens_->Acquire());
++
++  tokens_->Clear();
++  EXPECT_TRUE(tokens_->Acquire());
++
 +  // there must be two tokens available
 +#ifdef _WIN32
 +  EXPECT_EQ(WAIT_OBJECT_0, WaitForSingleObject(semaphore_, 0));
@@ -3659,632 +1626,547 @@ index 6c89064ca4..8d4fd7d33a 100644
 +  EXPECT_TRUE(ReleaseSemaphore(semaphore_, 2, &previous));
 +  EXPECT_EQ(0, previous);
 +#else
-   EXPECT_EQ(2u, read(fds_[0], buf_, sizeof(buf_)));
++  EXPECT_EQ(2u, read(fds_[0], buf_, sizeof(buf_)));
++  // tokens are pushed onto a stack, hence returned in reverse order
++  EXPECT_EQ(test_tokens[0], buf_[1]);
++  EXPECT_EQ(test_tokens[1], buf_[0]);
 +#endif
- 
-   // implicit token
-   EXPECT_TRUE(tokens_->Acquire());
- }
--#endif
-
-From 2b9c81c0ec1226d8795e7725529f13be41eaa385 Mon Sep 17 00:00:00 2001
-From: Stefan Becker <chemobejk@gmail.com>
-Date: Fri, 14 Dec 2018 13:27:11 +0200
-Subject: [PATCH 11/11] Prepare PR for merging - part II
-
-- remove unnecessary "struct" from TokenPool
-- add PAPCFUNC cast to QueryUserAPC()
-- remove hard-coded MAKEFLAGS string from win32
-- remove useless build test CompleteNoWork
-- rename TokenPoolTest to TestTokenPool
-- add tokenpool modules to CMake build
-- remove unused no-op TokenPool implementation
-- fix errors flagged by codespell & clang-tidy
-- address review comments from
-
-https://github.com/ninja-build/ninja/pull/1140#pullrequestreview-195195803
-https://github.com/ninja-build/ninja/pull/1140#pullrequestreview-185089255
-https://github.com/ninja-build/ninja/pull/1140#issuecomment-473898963
-https://github.com/ninja-build/ninja/pull/1140#issuecomment-596624610
----
- CMakeLists.txt                  |  8 ++++-
- src/build.cc                    |  2 +-
- src/build_test.cc               | 12 +------
- src/subprocess-posix.cc         |  4 +--
- src/subprocess-win32.cc         |  2 +-
- src/subprocess.h                |  2 +-
- src/subprocess_test.cc          | 26 +++++++-------
- src/tokenpool-gnu-make-posix.cc | 21 +++++------
- src/tokenpool-gnu-make-win32.cc | 36 ++++++++++---------
- src/tokenpool-gnu-make.cc       | 63 +++++++++++++++++----------------
- src/tokenpool-gnu-make.h        |  6 ++--
- src/tokenpool-none.cc           | 22 ------------
- src/tokenpool.h                 |  2 +-
- src/tokenpool_test.cc           |  8 ++---
- 14 files changed, 94 insertions(+), 120 deletions(-)
- delete mode 100644 src/tokenpool-none.cc
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 57ae548f5b..e2876fe413 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -112,6 +112,7 @@ add_library(libninja OBJECT
- 	src/state.cc
- 	src/status.cc
- 	src/string_piece_util.cc
-+	src/tokenpool-gnu-make.cc
- 	src/util.cc
- 	src/version.cc
- )
-@@ -123,9 +124,13 @@ if(WIN32)
- 		src/msvc_helper_main-win32.cc
- 		src/getopt.c
- 		src/minidump-win32.cc
-+		src/tokenpool-gnu-make-win32.cc
- 	)
- else()
--	target_sources(libninja PRIVATE src/subprocess-posix.cc)
-+	target_sources(libninja PRIVATE
-+		src/subprocess-posix.cc
-+		src/tokenpool-gnu-make-posix.cc
-+	)
- 	if(CMAKE_SYSTEM_NAME STREQUAL "OS400" OR CMAKE_SYSTEM_NAME STREQUAL "AIX")
- 		target_sources(libninja PRIVATE src/getopt.c)
- 	endif()
-@@ -204,6 +209,7 @@ if(BUILD_TESTING)
-     src/string_piece_util_test.cc
-     src/subprocess_test.cc
-     src/test.cc
-+    src/tokenpool_test.cc
-     src/util_test.cc
-   )
-   if(WIN32)
-diff --git a/src/build.cc b/src/build.cc
-index 20c3bdc2a0..854df08c2a 100644
---- a/src/build.cc
-+++ b/src/build.cc
-@@ -467,7 +467,7 @@ struct RealCommandRunner : public CommandRunner {
-   // copy of config_.max_load_average; can be modified by TokenPool setup
-   double max_load_average_;
-   SubprocessSet subprocs_;
--  TokenPool *tokens_;
-+  TokenPool* tokens_;
-   map<const Subprocess*, Edge*> subproc_to_edge_;
- };
- 
-diff --git a/src/build_test.cc b/src/build_test.cc
-index dd41dfbe1d..8901c9518f 100644
---- a/src/build_test.cc
-+++ b/src/build_test.cc
-@@ -4098,7 +4098,7 @@ struct BuildTokenTest : public BuildTest {
-   void ExpectWaitForCommand(int count, ...);
- 
- private:
--  void EnqueueBooleans(vector<bool>& booleans, int count, va_list ao);
-+  void EnqueueBooleans(vector<bool>& booleans, int count, va_list ap);
- };
- 
- void BuildTokenTest::SetUp() {
-@@ -4144,16 +4144,6 @@ void BuildTokenTest::EnqueueBooleans(vector<bool>& booleans, int count, va_list
-   }
- }
- 
--TEST_F(BuildTokenTest, CompleteNoWork) {
--  // plan should not execute anything
--  string err;
--
--  EXPECT_TRUE(builder_.Build(&err));
--  EXPECT_EQ("", err);
--
--  EXPECT_EQ(0u, token_command_runner_.commands_ran_.size());
--}
--
- TEST_F(BuildTokenTest, DoNotAquireToken) {
-   // plan should execute one command
-   string err;
-diff --git a/src/subprocess-posix.cc b/src/subprocess-posix.cc
-index 74451b0be2..31839276c4 100644
---- a/src/subprocess-posix.cc
-+++ b/src/subprocess-posix.cc
-@@ -250,7 +250,7 @@ Subprocess *SubprocessSet::Add(const string& command, bool use_console) {
- }
- 
- #ifdef USE_PPOLL
--bool SubprocessSet::DoWork(struct TokenPool* tokens) {
-+bool SubprocessSet::DoWork(TokenPool* tokens) {
-   vector<pollfd> fds;
-   nfds_t nfds = 0;
- 
-@@ -315,7 +315,7 @@ bool SubprocessSet::DoWork(struct TokenPool* tokens) {
- }
- 
- #else  // !defined(USE_PPOLL)
--bool SubprocessSet::DoWork(struct TokenPool* tokens) {
-+bool SubprocessSet::DoWork(TokenPool* tokens) {
-   fd_set set;
-   int nfds = 0;
-   FD_ZERO(&set);
-diff --git a/src/subprocess-win32.cc b/src/subprocess-win32.cc
-index ce3e2c20a4..2926e9a221 100644
---- a/src/subprocess-win32.cc
-+++ b/src/subprocess-win32.cc
-@@ -252,7 +252,7 @@ Subprocess *SubprocessSet::Add(const string& command, bool use_console) {
-   return subprocess;
- }
- 
--bool SubprocessSet::DoWork(struct TokenPool* tokens) {
-+bool SubprocessSet::DoWork(TokenPool* tokens) {
-   DWORD bytes_read;
-   Subprocess* subproc;
-   OVERLAPPED* overlapped;
-diff --git a/src/subprocess.h b/src/subprocess.h
-index 9ea67ea477..1ec78171e8 100644
---- a/src/subprocess.h
-+++ b/src/subprocess.h
-@@ -86,7 +86,7 @@ struct SubprocessSet {
-   ~SubprocessSet();
- 
-   Subprocess* Add(const std::string& command, bool use_console = false);
--  bool DoWork(struct TokenPool* tokens);
-+  bool DoWork(TokenPool* tokens);
-   Subprocess* NextFinished();
-   void Clear();
- 
-diff --git a/src/subprocess_test.cc b/src/subprocess_test.cc
-index f625963462..7b146f31be 100644
---- a/src/subprocess_test.cc
-+++ b/src/subprocess_test.cc
-@@ -35,7 +35,7 @@ const char* kSimpleCommand = "cmd /c dir \\";
- const char* kSimpleCommand = "ls /";
- #endif
- 
--struct TokenPoolTest : public TokenPool {
-+struct TestTokenPool : public TokenPool {
-   bool Acquire()     { return false; }
-   void Reserve()     {}
-   void Release()     {}
-@@ -58,7 +58,7 @@ struct TokenPoolTest : public TokenPool {
- 
- struct SubprocessTest : public testing::Test {
-   SubprocessSet subprocs_;
--  TokenPoolTest tokens_;
-+  TestTokenPool tokens_;
- };
- 
- }  // anonymous namespace
-@@ -73,7 +73,7 @@ TEST_F(SubprocessTest, BadCommandStderr) {
-     // Pretend we discovered that stderr was ready for writing.
-     subprocs_.DoWork(NULL);
-   }
--  ASSERT_EQ(false, subprocs_.IsTokenAvailable());
-+  ASSERT_FALSE(subprocs_.IsTokenAvailable());
- 
-   EXPECT_EQ(ExitFailure, subproc->Finish());
-   EXPECT_NE("", subproc->GetOutput());
-@@ -89,7 +89,7 @@ TEST_F(SubprocessTest, NoSuchCommand) {
-     // Pretend we discovered that stderr was ready for writing.
-     subprocs_.DoWork(NULL);
-   }
--  ASSERT_EQ(false, subprocs_.IsTokenAvailable());
-+  ASSERT_FALSE(subprocs_.IsTokenAvailable());
- 
-   EXPECT_EQ(ExitFailure, subproc->Finish());
-   EXPECT_NE("", subproc->GetOutput());
-@@ -109,7 +109,7 @@ TEST_F(SubprocessTest, InterruptChild) {
-   while (!subproc->Done()) {
-     subprocs_.DoWork(NULL);
-   }
--  ASSERT_EQ(false, subprocs_.IsTokenAvailable());
-+  ASSERT_FALSE(subprocs_.IsTokenAvailable());
- 
-   EXPECT_EQ(ExitInterrupted, subproc->Finish());
- }
-@@ -135,7 +135,7 @@ TEST_F(SubprocessTest, InterruptChildWithSigTerm) {
-   while (!subproc->Done()) {
-     subprocs_.DoWork(NULL);
-   }
--  ASSERT_EQ(false, subprocs_.IsTokenAvailable());
-+  ASSERT_FALSE(subprocs_.IsTokenAvailable());
- 
-   EXPECT_EQ(ExitInterrupted, subproc->Finish());
- }
-@@ -161,7 +161,7 @@ TEST_F(SubprocessTest, InterruptChildWithSigHup) {
-   while (!subproc->Done()) {
-     subprocs_.DoWork(NULL);
-   }
--  ASSERT_EQ(false, subprocs_.IsTokenAvailable());
-+  ASSERT_FALSE(subprocs_.IsTokenAvailable());
- 
-   EXPECT_EQ(ExitInterrupted, subproc->Finish());
- }
-@@ -190,7 +190,7 @@ TEST_F(SubprocessTest, Console) {
-     while (!subproc->Done()) {
-       subprocs_.DoWork(NULL);
-     }
--    ASSERT_EQ(false, subprocs_.IsTokenAvailable());
-+    ASSERT_FALSE(subprocs_.IsTokenAvailable());
- 
-     EXPECT_EQ(ExitSuccess, subproc->Finish());
-   }
-@@ -206,7 +206,7 @@ TEST_F(SubprocessTest, SetWithSingle) {
-   while (!subproc->Done()) {
-     subprocs_.DoWork(NULL);
-   }
--  ASSERT_EQ(false, subprocs_.IsTokenAvailable());
-+  ASSERT_FALSE(subprocs_.IsTokenAvailable());
-   ASSERT_EQ(ExitSuccess, subproc->Finish());
-   ASSERT_NE("", subproc->GetOutput());
- 
-@@ -243,7 +243,7 @@ TEST_F(SubprocessTest, SetWithMulti) {
-     ASSERT_GT(subprocs_.running_.size(), 0u);
-     subprocs_.DoWork(NULL);
-   }
--  ASSERT_EQ(false, subprocs_.IsTokenAvailable());
-+  ASSERT_FALSE(subprocs_.IsTokenAvailable());
-   ASSERT_EQ(0u, subprocs_.running_.size());
-   ASSERT_EQ(3u, subprocs_.finished_.size());
- 
-@@ -278,7 +278,7 @@ TEST_F(SubprocessTest, SetWithLots) {
-   subprocs_.ResetTokenAvailable();
-   while (!subprocs_.running_.empty())
-     subprocs_.DoWork(NULL);
--  ASSERT_EQ(false, subprocs_.IsTokenAvailable());
-+  ASSERT_FALSE(subprocs_.IsTokenAvailable());
-   for (size_t i = 0; i < procs.size(); ++i) {
-     ASSERT_EQ(ExitSuccess, procs[i]->Finish());
-     ASSERT_NE("", procs[i]->GetOutput());
-@@ -298,7 +298,7 @@ TEST_F(SubprocessTest, ReadStdin) {
-   while (!subproc->Done()) {
-     subprocs_.DoWork(NULL);
-   }
--  ASSERT_EQ(false, subprocs_.IsTokenAvailable());
-+  ASSERT_FALSE(subprocs_.IsTokenAvailable());
-   ASSERT_EQ(ExitSuccess, subproc->Finish());
-   ASSERT_EQ(1u, subprocs_.finished_.size());
- }
-@@ -322,7 +322,7 @@ TEST_F(SubprocessTest, TokenAvailable) {
-   subprocs_.DoWork(&tokens_);
- #ifdef _WIN32
-   tokens_._token_available = false;
--  // we need to loop here as we have no conrol where the token
-+  // we need to loop here as we have no control where the token
-   // I/O completion post ends up in the queue
-   while (!subproc->Done() && !subprocs_.IsTokenAvailable()) {
-     subprocs_.DoWork(&tokens_);
-diff --git a/src/tokenpool-gnu-make-posix.cc b/src/tokenpool-gnu-make-posix.cc
-index 70d84bfff7..353bda226a 100644
---- a/src/tokenpool-gnu-make-posix.cc
++
++  // implicit token
++  EXPECT_TRUE(tokens_->Acquire());
++}
+--- /dev/null
 +++ b/src/tokenpool-gnu-make-posix.cc
-@@ -32,8 +32,8 @@ struct GNUmakeTokenPoolPosix : public GNUmakeTokenPool {
- 
-   virtual int GetMonitorFd();
- 
--  virtual const char *GetEnv(const char *name) { return getenv(name); };
--  virtual bool ParseAuth(const char *jobserver);
+@@ -0,0 +1,214 @@
++// Copyright 2016-2018 Google Inc. All Rights Reserved.
++//
++// Licensed under the Apache License, Version 2.0 (the "License");
++// you may not use this file except in compliance with the License.
++// You may obtain a copy of the License at
++//
++//     http://www.apache.org/licenses/LICENSE-2.0
++//
++// Unless required by applicable law or agreed to in writing, software
++// distributed under the License is distributed on an "AS IS" BASIS,
++// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++// See the License for the specific language governing permissions and
++// limitations under the License.
++
++#include "tokenpool-gnu-make.h"
++
++#include <errno.h>
++#include <fcntl.h>
++#include <poll.h>
++#include <unistd.h>
++#include <signal.h>
++#include <sys/time.h>
++#include <stdio.h>
++#include <string.h>
++#include <stdlib.h>
++#include <stack>
++
++// TokenPool implementation for GNU make jobserver - POSIX implementation
++// (http://make.mad-scientist.net/papers/jobserver-implementation/)
++struct GNUmakeTokenPoolPosix : public GNUmakeTokenPool {
++  GNUmakeTokenPoolPosix();
++  virtual ~GNUmakeTokenPoolPosix();
++
++  virtual int GetMonitorFd();
++
 +  virtual const char* GetEnv(const char* name) { return getenv(name); };
 +  virtual bool ParseAuth(const char* jobserver);
-   virtual bool AcquireToken();
-   virtual bool ReturnToken();
- 
-@@ -64,9 +64,7 @@ bool GNUmakeTokenPoolPosix::CheckFd(int fd) {
-   if (fd < 0)
-     return false;
-   int ret = fcntl(fd, F_GETFD);
--  if (ret < 0)
--    return false;
--  return true;
++  virtual bool AcquireToken();
++  virtual bool ReturnToken();
++
++ private:
++  int rfd_;
++  int wfd_;
++
++  struct sigaction old_act_;
++  bool restore_;
++
++  // See https://www.gnu.org/software/make/manual/html_node/POSIX-Jobserver.html
++  //
++  //   It’s important that when you release the job slot, you write back
++  //   the same character you read. Don’t assume that all tokens are the
++  //   same character different characters may have different meanings to
++  //   GNU make. The order is not important, since make has no idea in
++  //   what order jobs will complete anyway.
++  //
++  std::stack<char> tokens_;
++
++  static int dup_rfd_;
++  static void CloseDupRfd(int signum);
++
++  bool CheckFd(int fd);
++  bool SetAlarmHandler();
++};
++
++GNUmakeTokenPoolPosix::GNUmakeTokenPoolPosix() : rfd_(-1), wfd_(-1), restore_(false) {
++}
++
++GNUmakeTokenPoolPosix::~GNUmakeTokenPoolPosix() {
++  Clear();
++  if (restore_)
++    sigaction(SIGALRM, &old_act_, NULL);
++}
++
++bool GNUmakeTokenPoolPosix::CheckFd(int fd) {
++  if (fd < 0)
++    return false;
++  int ret = fcntl(fd, F_GETFD);
 +  return ret >= 0;
- }
- 
- int GNUmakeTokenPoolPosix::dup_rfd_ = -1;
-@@ -82,14 +80,13 @@ bool GNUmakeTokenPoolPosix::SetAlarmHandler() {
-   act.sa_handler = CloseDupRfd;
-   if (sigaction(SIGALRM, &act, &old_act_) < 0) {
-     perror("sigaction:");
--    return(false);
--  } else {
--    restore_ = true;
--    return(true);
++}
++
++int GNUmakeTokenPoolPosix::dup_rfd_ = -1;
++
++void GNUmakeTokenPoolPosix::CloseDupRfd(int signum) {
++  close(dup_rfd_);
++  dup_rfd_ = -1;
++}
++
++bool GNUmakeTokenPoolPosix::SetAlarmHandler() {
++  struct sigaction act;
++  memset(&act, 0, sizeof(act));
++  act.sa_handler = CloseDupRfd;
++  if (sigaction(SIGALRM, &act, &old_act_) < 0) {
++    perror("sigaction:");
 +    return false;
-   }
++  }
 +  restore_ = true;
 +  return true;
- }
- 
--bool GNUmakeTokenPoolPosix::ParseAuth(const char *jobserver) {
++}
++
 +bool GNUmakeTokenPoolPosix::ParseAuth(const char* jobserver) {
-   int rfd = -1;
-   int wfd = -1;
-   if ((sscanf(jobserver, "%*[^=]=%d,%d", &rfd, &wfd) == 2) &&
-@@ -195,9 +192,9 @@ bool GNUmakeTokenPoolPosix::ReturnToken() {
- }
- 
- int GNUmakeTokenPoolPosix::GetMonitorFd() {
--  return(rfd_);
++  int rfd = -1;
++  int wfd = -1;
++  if ((sscanf(jobserver, "%*[^=]=%d,%d", &rfd, &wfd) == 2) &&
++      CheckFd(rfd) &&
++      CheckFd(wfd) &&
++      SetAlarmHandler()) {
++    rfd_ = rfd;
++    wfd_ = wfd;
++    return true;
++  }
++
++  return false;
++}
++
++bool GNUmakeTokenPoolPosix::AcquireToken() {
++  // Please read
++  //
++  //   http://make.mad-scientist.net/papers/jobserver-implementation/
++  //
++  // for the reasoning behind the following code.
++  //
++  // Try to read one character from the pipe. Returns true on success.
++  //
++  // First check if read() would succeed without blocking.
++#ifdef USE_PPOLL
++  pollfd pollfds[] = {{rfd_, POLLIN, 0}};
++  int ret = poll(pollfds, 1, 0);
++#else
++  fd_set set;
++  struct timeval timeout = { 0, 0 };
++  FD_ZERO(&set);
++  FD_SET(rfd_, &set);
++  int ret = select(rfd_ + 1, &set, NULL, NULL, &timeout);
++#endif
++  if (ret > 0) {
++    // Handle potential race condition:
++    //  - the above check succeeded, i.e. read() should not block
++    //  - the character disappears before we call read()
++    //
++    // Create a duplicate of rfd_. The duplicate file descriptor dup_rfd_
++    // can safely be closed by signal handlers without affecting rfd_.
++    dup_rfd_ = dup(rfd_);
++
++    if (dup_rfd_ != -1) {
++      struct sigaction act, old_act;
++      int ret = 0;
++      char buf;
++
++      // Temporarily replace SIGCHLD handler with our own
++      memset(&act, 0, sizeof(act));
++      act.sa_handler = CloseDupRfd;
++      if (sigaction(SIGCHLD, &act, &old_act) == 0) {
++        struct itimerval timeout;
++
++        // install a 100ms timeout that generates SIGALARM on expiration
++        memset(&timeout, 0, sizeof(timeout));
++        timeout.it_value.tv_usec = 100 * 1000; // [ms] -> [usec]
++        if (setitimer(ITIMER_REAL, &timeout, NULL) == 0) {
++          // Now try to read() from dup_rfd_. Return values from read():
++          //
++          // 1. token read                               ->  1
++          // 2. pipe closed                              ->  0
++          // 3. alarm expires                            -> -1 (EINTR)
++          // 4. child exits                              -> -1 (EINTR)
++          // 5. alarm expired before entering read()     -> -1 (EBADF)
++          // 6. child exited before entering read()      -> -1 (EBADF)
++          // 7. child exited before handler is installed -> go to 1 - 3
++          ret = read(dup_rfd_, &buf, 1);
++
++          // disarm timer
++          memset(&timeout, 0, sizeof(timeout));
++          setitimer(ITIMER_REAL, &timeout, NULL);
++        }
++
++        sigaction(SIGCHLD, &old_act, NULL);
++      }
++
++      CloseDupRfd(0);
++
++      // Case 1 from above list
++      if (ret > 0) {
++        tokens_.push(buf);
++        return true;
++      }
++    }
++  }
++
++  // read() would block, i.e. no token available,
++  // cases 2-6 from above list or
++  // select() / poll() / dup() / sigaction() / setitimer() failed
++  return false;
++}
++
++bool GNUmakeTokenPoolPosix::ReturnToken() {
++  const char buf = tokens_.top();
++  while (1) {
++    int ret = write(wfd_, &buf, 1);
++    if (ret > 0) {
++      tokens_.pop();
++      return true;
++    }
++    if ((ret != -1) || (errno != EINTR))
++      return false;
++    // write got interrupted - retry
++  }
++}
++
++int GNUmakeTokenPoolPosix::GetMonitorFd() {
 +  return rfd_;
- }
- 
--struct TokenPool *TokenPool::Get() {
++}
++
 +TokenPool* TokenPool::Get() {
-   return new GNUmakeTokenPoolPosix;
- }
-diff --git a/src/tokenpool-gnu-make-win32.cc b/src/tokenpool-gnu-make-win32.cc
-index 2719f2c1fc..b2bb52fadb 100644
---- a/src/tokenpool-gnu-make-win32.cc
++  return new GNUmakeTokenPoolPosix;
++}
+--- /dev/null
 +++ b/src/tokenpool-gnu-make-win32.cc
-@@ -14,7 +14,8 @@
- 
- #include "tokenpool-gnu-make.h"
- 
--// always include first to make sure other headers do the correct thing...
+@@ -0,0 +1,239 @@
++// Copyright 2018 Google Inc. All Rights Reserved.
++//
++// Licensed under the Apache License, Version 2.0 (the "License");
++// you may not use this file except in compliance with the License.
++// You may obtain a copy of the License at
++//
++//     http://www.apache.org/licenses/LICENSE-2.0
++//
++// Unless required by applicable law or agreed to in writing, software
++// distributed under the License is distributed on an "AS IS" BASIS,
++// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++// See the License for the specific language governing permissions and
++// limitations under the License.
++
++#include "tokenpool-gnu-make.h"
++
 +// Always include this first.
 +// Otherwise the other system headers don't work correctly under Win32
- #include <windows.h>
- 
- #include <ctype.h>
-@@ -32,8 +33,8 @@ struct GNUmakeTokenPoolWin32 : public GNUmakeTokenPool {
-   virtual void WaitForTokenAvailability(HANDLE ioport);
-   virtual bool TokenIsAvailable(ULONG_PTR key);
- 
--  virtual const char *GetEnv(const char *name);
--  virtual bool ParseAuth(const char *jobserver);
++#include <windows.h>
++
++#include <ctype.h>
++#include <stdlib.h>
++#include <string.h>
++
++#include "util.h"
++
++// TokenPool implementation for GNU make jobserver - Win32 implementation
++// (https://www.gnu.org/software/make/manual/html_node/Windows-Jobserver.html)
++struct GNUmakeTokenPoolWin32 : public GNUmakeTokenPool {
++  GNUmakeTokenPoolWin32();
++  virtual ~GNUmakeTokenPoolWin32();
++
++  virtual void WaitForTokenAvailability(HANDLE ioport);
++  virtual bool TokenIsAvailable(ULONG_PTR key);
++
 +  virtual const char* GetEnv(const char* name);
 +  virtual bool ParseAuth(const char* jobserver);
-   virtual bool AcquireToken();
-   virtual bool ReturnToken();
- 
-@@ -98,19 +99,19 @@ GNUmakeTokenPoolWin32::~GNUmakeTokenPoolWin32() {
-   }
- }
- 
--const char *GNUmakeTokenPoolWin32::GetEnv(const char *name) {
++  virtual bool AcquireToken();
++  virtual bool ReturnToken();
++
++ private:
++  // Semaphore for GNU make jobserver protocol
++  HANDLE semaphore_jobserver_;
++  // Semaphore Child -> Parent
++  // - child releases it before entering wait on jobserver semaphore
++  // - parent blocks on it to know when child enters wait
++  HANDLE semaphore_enter_wait_;
++  // Semaphore Parent -> Child
++  // - parent releases it to allow child to restart loop
++  // - child blocks on it to know when to restart loop
++  HANDLE semaphore_restart_;
++  // set to false if child should exit loop and terminate thread
++  bool running_;
++  // child thread
++  HANDLE child_;
++  // I/O completion port from SubprocessSet
++  HANDLE ioport_;
++
++
++  DWORD SemaphoreThread();
++  void ReleaseSemaphore(HANDLE semaphore);
++  void WaitForObject(HANDLE object);
++  static DWORD WINAPI SemaphoreThreadWrapper(LPVOID param);
++  static void NoopAPCFunc(ULONG_PTR param);
++};
++
++GNUmakeTokenPoolWin32::GNUmakeTokenPoolWin32() : semaphore_jobserver_(NULL),
++                                                 semaphore_enter_wait_(NULL),
++                                                 semaphore_restart_(NULL),
++                                                 running_(false),
++                                                 child_(NULL),
++                                                 ioport_(NULL) {
++}
++
++GNUmakeTokenPoolWin32::~GNUmakeTokenPoolWin32() {
++  Clear();
++  CloseHandle(semaphore_jobserver_);
++  semaphore_jobserver_ = NULL;
++
++  if (child_) {
++    // tell child thread to exit
++    running_ = false;
++    ReleaseSemaphore(semaphore_restart_);
++
++    // wait for child thread to exit
++    WaitForObject(child_);
++    CloseHandle(child_);
++    child_ = NULL;
++  }
++
++  if (semaphore_restart_) {
++    CloseHandle(semaphore_restart_);
++    semaphore_restart_ = NULL;
++  }
++
++  if (semaphore_enter_wait_) {
++    CloseHandle(semaphore_enter_wait_);
++    semaphore_enter_wait_ = NULL;
++  }
++}
++
 +const char* GNUmakeTokenPoolWin32::GetEnv(const char* name) {
-   // getenv() does not work correctly together with tokenpool_tests.cc
-   static char buffer[MAX_PATH + 1];
--  if (GetEnvironmentVariable("MAKEFLAGS", buffer, sizeof(buffer)) == 0)
++  // getenv() does not work correctly together with tokenpool_tests.cc
++  static char buffer[MAX_PATH + 1];
 +  if (GetEnvironmentVariable(name, buffer, sizeof(buffer)) == 0)
-     return NULL;
--  return(buffer);
++    return NULL;
 +  return buffer;
- }
- 
--bool GNUmakeTokenPoolWin32::ParseAuth(const char *jobserver) {
++}
++
 +bool GNUmakeTokenPoolWin32::ParseAuth(const char* jobserver) {
-   // match "--jobserver-auth=gmake_semaphore_<INTEGER>..."
--  const char *start = strchr(jobserver, '=');
++  // match "--jobserver-auth=gmake_semaphore_<INTEGER>..."
 +  const char* start = strchr(jobserver, '=');
-   if (start) {
--    const char *end = start;
++  if (start) {
 +    const char* end = start;
-     unsigned int len;
-     char c, *auth;
- 
-@@ -119,14 +120,15 @@ bool GNUmakeTokenPoolWin32::ParseAuth(const char *jobserver) {
-         break;
-     len = end - start; // includes string terminator in count
- 
--    if ((len > 1) && ((auth = (char *)malloc(len)) != NULL)) {
++    unsigned int len;
++    char c, *auth;
++
++    while ((c = *++end) != '\0')
++      if (!(isalnum(c) || (c == '_')))
++        break;
++    len = end - start; // includes string terminator in count
++
 +    if ((len > 1) && ((auth = (char*)malloc(len)) != NULL)) {
-       strncpy(auth, start + 1, len - 1);
-       auth[len - 1] = '\0';
- 
--      if ((semaphore_jobserver_ = OpenSemaphore(SEMAPHORE_ALL_ACCESS, /* Semaphore access setting */
--                                                FALSE,                /* Child processes DON'T inherit */
--                                                auth                  /* Semaphore name */
--                                                )) != NULL) {
++      strncpy(auth, start + 1, len - 1);
++      auth[len - 1] = '\0';
++
 +      if ((semaphore_jobserver_ =
 +           OpenSemaphore(SEMAPHORE_ALL_ACCESS, /* Semaphore access setting */
 +                         FALSE,                /* Child processes DON'T inherit */
 +                         auth                  /* Semaphore name */
 +                        )) != NULL) {
-         free(auth);
-         return true;
-       }
-@@ -171,7 +173,7 @@ DWORD GNUmakeTokenPoolWin32::SemaphoreThread() {
- }
- 
- DWORD WINAPI GNUmakeTokenPoolWin32::SemaphoreThreadWrapper(LPVOID param) {
--  GNUmakeTokenPoolWin32 *This = (GNUmakeTokenPoolWin32 *) param;
++        free(auth);
++        return true;
++      }
++
++      free(auth);
++    }
++  }
++
++  return false;
++}
++
++bool GNUmakeTokenPoolWin32::AcquireToken() {
++  return WaitForSingleObject(semaphore_jobserver_, 0) == WAIT_OBJECT_0;
++}
++
++bool GNUmakeTokenPoolWin32::ReturnToken() {
++  ReleaseSemaphore(semaphore_jobserver_);
++  return true;
++}
++
++DWORD GNUmakeTokenPoolWin32::SemaphoreThread() {
++  while (running_) {
++    // indicate to parent that we are entering wait
++    ReleaseSemaphore(semaphore_enter_wait_);
++
++    // alertable wait forever on token semaphore
++    if (WaitForSingleObjectEx(semaphore_jobserver_, INFINITE, TRUE) == WAIT_OBJECT_0) {
++      // release token again for AcquireToken()
++      ReleaseSemaphore(semaphore_jobserver_);
++
++      // indicate to parent on ioport that a token might be available
++      if (!PostQueuedCompletionStatus(ioport_, 0, (ULONG_PTR) this, NULL))
++        Win32Fatal("PostQueuedCompletionStatus");
++    }
++
++    // wait for parent to allow loop restart
++    WaitForObject(semaphore_restart_);
++    // semaphore is now in nonsignaled state again for next run...
++  }
++
++  return 0;
++}
++
++DWORD WINAPI GNUmakeTokenPoolWin32::SemaphoreThreadWrapper(LPVOID param) {
 +  GNUmakeTokenPoolWin32* This = (GNUmakeTokenPoolWin32*) param;
-   return This->SemaphoreThread();
- }
- 
-@@ -216,7 +218,7 @@ void GNUmakeTokenPoolWin32::WaitForTokenAvailability(HANDLE ioport) {
- 
- bool GNUmakeTokenPoolWin32::TokenIsAvailable(ULONG_PTR key) {
-   // alert child thread to break wait on token semaphore
--  QueueUserAPC(&NoopAPCFunc, child_, (ULONG_PTR)NULL);
-+  QueueUserAPC((PAPCFUNC)&NoopAPCFunc, child_, (ULONG_PTR)NULL);
- 
-   // return true when GetQueuedCompletionStatus() returned our key
-   return key == (ULONG_PTR) this;
-@@ -232,6 +234,6 @@ void GNUmakeTokenPoolWin32::WaitForObject(HANDLE object) {
-     Win32Fatal("WaitForSingleObject");
- }
- 
--struct TokenPool *TokenPool::Get() {
-+TokenPool* TokenPool::Get() {
-   return new GNUmakeTokenPoolWin32;
- }
-diff --git a/src/tokenpool-gnu-make.cc b/src/tokenpool-gnu-make.cc
-index 92ff611721..60e0552924 100644
---- a/src/tokenpool-gnu-make.cc
-+++ b/src/tokenpool-gnu-make.cc
-@@ -31,36 +31,37 @@ GNUmakeTokenPool::~GNUmakeTokenPool() {
- bool GNUmakeTokenPool::Setup(bool ignore,
-                              bool verbose,
-                              double& max_load_average) {
--  const char *value = GetEnv("MAKEFLAGS");
--  if (value) {
--    // GNU make <= 4.1
--    const char *jobserver = strstr(value, "--jobserver-fds=");
-+  const char* value = GetEnv("MAKEFLAGS");
-+  if (!value)
-+    return false;
++  return This->SemaphoreThread();
++}
 +
-+  // GNU make <= 4.1
-+  const char* jobserver = strstr(value, "--jobserver-fds=");
-+  if (!jobserver)
-     // GNU make => 4.2
--    if (!jobserver)
--      jobserver = strstr(value, "--jobserver-auth=");
--    if (jobserver) {
--      LinePrinter printer;
--
--      if (ignore) {
--        printer.PrintOnNewLine("ninja: warning: -jN forced on command line; ignoring GNU make jobserver.\n");
--      } else {
--        if (ParseAuth(jobserver)) {
--          const char *l_arg = strstr(value, " -l");
--          int load_limit = -1;
--
--          if (verbose) {
--            printer.PrintOnNewLine("ninja: using GNU make jobserver.\n");
--          }
--
--          // translate GNU make -lN to ninja -lN
--          if (l_arg &&
--              (sscanf(l_arg + 3, "%d ", &load_limit) == 1) &&
--              (load_limit > 0)) {
--            max_load_average = load_limit;
--          }
--
--          return true;
-+    jobserver = strstr(value, "--jobserver-auth=");
-+  if (jobserver) {
-+    LinePrinter printer;
++void GNUmakeTokenPoolWin32::NoopAPCFunc(ULONG_PTR param) {
++}
 +
-+    if (ignore) {
-+      printer.PrintOnNewLine("ninja: warning: -jN forced on command line; ignoring GNU make jobserver.\n");
-+    } else {
-+      if (ParseAuth(jobserver)) {
-+        const char* l_arg = strstr(value, " -l");
-+        int load_limit = -1;
++void GNUmakeTokenPoolWin32::WaitForTokenAvailability(HANDLE ioport) {
++  if (child_ == NULL) {
++    // first invocation
++    //
++    // subprocess-win32.cc uses I/O completion port (IOCP) which can't be
++    // used as a waitable object. Therefore we can't use WaitMultipleObjects()
++    // to wait on the IOCP and the token semaphore at the same time. Create
++    // a child thread that waits on the semaphore and posts an I/O completion
++    ioport_ = ioport;
 +
-+        if (verbose) {
-+          printer.PrintOnNewLine("ninja: using GNU make jobserver.\n");
-+        }
++    // create both semaphores in nonsignaled state
++    if ((semaphore_enter_wait_ = CreateSemaphore(NULL, 0, 1, NULL))
++        == NULL)
++      Win32Fatal("CreateSemaphore/enter_wait");
++    if ((semaphore_restart_ = CreateSemaphore(NULL, 0, 1, NULL))
++        == NULL)
++      Win32Fatal("CreateSemaphore/restart");
 +
-+        // translate GNU make -lN to ninja -lN
-+        if (l_arg &&
-+            (sscanf(l_arg + 3, "%d ", &load_limit) == 1) &&
-+            (load_limit > 0)) {
-+          max_load_average = load_limit;
-         }
++    // start child thread
++    running_ = true;
++    if ((child_ = CreateThread(NULL, 0, &SemaphoreThreadWrapper, this, 0, NULL))
++        == NULL)
++      Win32Fatal("CreateThread");
 +
-+        return true;
-       }
-     }
-   }
-@@ -76,10 +77,10 @@ bool GNUmakeTokenPool::Acquire() {
-     // token acquired
-     available_++;
-     return true;
--  } else {
--    // no token available
--    return false;
-   }
++  } else {
++    // all further invocations - allow child thread to loop
++    ReleaseSemaphore(semaphore_restart_);
++  }
 +
-+  // no token available
-+  return false;
- }
- 
- void GNUmakeTokenPool::Reserve() {
-diff --git a/src/tokenpool-gnu-make.h b/src/tokenpool-gnu-make.h
-index d3852088e2..c94cca5e2d 100644
---- a/src/tokenpool-gnu-make.h
++  // wait for child thread to enter wait
++  WaitForObject(semaphore_enter_wait_);
++  // semaphore is now in nonsignaled state again for next run...
++
++  // now SubprocessSet::DoWork() can enter GetQueuedCompletionStatus()...
++}
++
++bool GNUmakeTokenPoolWin32::TokenIsAvailable(ULONG_PTR key) {
++  // alert child thread to break wait on token semaphore
++  QueueUserAPC((PAPCFUNC)&NoopAPCFunc, child_, (ULONG_PTR)NULL);
++
++  // return true when GetQueuedCompletionStatus() returned our key
++  return key == (ULONG_PTR) this;
++}
++
++void GNUmakeTokenPoolWin32::ReleaseSemaphore(HANDLE semaphore) {
++  if (!::ReleaseSemaphore(semaphore, 1, NULL))
++    Win32Fatal("ReleaseSemaphore");
++}
++
++void GNUmakeTokenPoolWin32::WaitForObject(HANDLE object) {
++  if (WaitForSingleObject(object, INFINITE) != WAIT_OBJECT_0)
++    Win32Fatal("WaitForSingleObject");
++}
++
++TokenPool* TokenPool::Get() {
++  return new GNUmakeTokenPoolWin32;
++}
+--- /dev/null
 +++ b/src/tokenpool-gnu-make.h
-@@ -17,7 +17,7 @@
- // interface to GNU make token pool
- struct GNUmakeTokenPool : public TokenPool {
-   GNUmakeTokenPool();
--  virtual ~GNUmakeTokenPool();
+@@ -0,0 +1,40 @@
++// Copyright 2016-2018 Google Inc. All Rights Reserved.
++//
++// Licensed under the Apache License, Version 2.0 (the "License");
++// you may not use this file except in compliance with the License.
++// You may obtain a copy of the License at
++//
++//     http://www.apache.org/licenses/LICENSE-2.0
++//
++// Unless required by applicable law or agreed to in writing, software
++// distributed under the License is distributed on an "AS IS" BASIS,
++// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++// See the License for the specific language governing permissions and
++// limitations under the License.
++
++#include "tokenpool.h"
++
++// interface to GNU make token pool
++struct GNUmakeTokenPool : public TokenPool {
++  GNUmakeTokenPool();
 +  ~GNUmakeTokenPool();
- 
-   // token pool implementation
-   virtual bool Acquire();
-@@ -27,8 +27,8 @@ struct GNUmakeTokenPool : public TokenPool {
-   virtual bool Setup(bool ignore, bool verbose, double& max_load_average);
- 
-   // platform specific implementation
--  virtual const char *GetEnv(const char *name) = 0;
--  virtual bool ParseAuth(const char *jobserver) = 0;
++
++  // token pool implementation
++  virtual bool Acquire();
++  virtual void Reserve();
++  virtual void Release();
++  virtual void Clear();
++  virtual bool Setup(bool ignore, bool verbose, double& max_load_average);
++
++  // platform specific implementation
 +  virtual const char* GetEnv(const char* name) = 0;
 +  virtual bool ParseAuth(const char* jobserver) = 0;
-   virtual bool AcquireToken() = 0;
-   virtual bool ReturnToken() = 0;
- 
-diff --git a/src/tokenpool-none.cc b/src/tokenpool-none.cc
-deleted file mode 100644
-index 613d16882d..0000000000
---- a/src/tokenpool-none.cc
-+++ /dev/null
-@@ -1,22 +0,0 @@
--// Copyright 2016-2018 Google Inc. All Rights Reserved.
--//
--// Licensed under the Apache License, Version 2.0 (the "License");
--// you may not use this file except in compliance with the License.
--// You may obtain a copy of the License at
--//
--//     http://www.apache.org/licenses/LICENSE-2.0
--//
--// Unless required by applicable law or agreed to in writing, software
--// distributed under the License is distributed on an "AS IS" BASIS,
--// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
--// See the License for the specific language governing permissions and
--// limitations under the License.
--
--#include "tokenpool.h"
--
--#include <stdlib.h>
--
--// No-op TokenPool implementation
--struct TokenPool *TokenPool::Get() {
--  return NULL;
--}
-diff --git a/src/tokenpool.h b/src/tokenpool.h
-index 1be8e1d5ce..931c22754d 100644
---- a/src/tokenpool.h
-+++ b/src/tokenpool.h
-@@ -38,5 +38,5 @@ struct TokenPool {
- #endif
- 
-   // returns NULL if token pool is not available
--  static struct TokenPool *Get();
-+  static TokenPool* Get();
- };
-diff --git a/src/tokenpool_test.cc b/src/tokenpool_test.cc
-index 8d4fd7d33a..8d3061cb30 100644
---- a/src/tokenpool_test.cc
-+++ b/src/tokenpool_test.cc
-@@ -43,10 +43,10 @@ const double kLoadAverageDefault = -1.23456789;
- 
- struct TokenPoolTest : public testing::Test {
-   double load_avg_;
--  TokenPool *tokens_;
-+  TokenPool* tokens_;
-   char buf_[1024];
- #ifdef _WIN32
--  const char *semaphore_name_;
-+  const char* semaphore_name_;
-   HANDLE semaphore_;
- #else
-   int fds_[2];
-@@ -65,7 +65,7 @@ struct TokenPoolTest : public testing::Test {
-       ASSERT_TRUE(false);
-   }
- 
--  void CreatePool(const char *format, bool ignore_jobserver = false) {
-+  void CreatePool(const char* format, bool ignore_jobserver = false) {
-     if (format) {
-       sprintf(buf_, format,
- #ifdef _WIN32
-@@ -209,7 +209,7 @@ TEST_F(TokenPoolTest, TwoTokens) {
-   tokens_->Release();
-   EXPECT_TRUE(tokens_->Acquire());
- 
--  // release implict token - must return 2nd token back to jobserver
-+  // release implicit token - must return 2nd token back to jobserver
-   tokens_->Release();
-   EXPECT_TRUE(tokens_->Acquire());
- 
++  virtual bool AcquireToken() = 0;
++  virtual bool ReturnToken() = 0;
++
++ private:
++  int available_;
++  int used_;
++
++  void Return();
++};
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -112,6 +112,7 @@ add_library(libninja OBJECT
+ 	src/state.cc
+ 	src/status.cc
+ 	src/string_piece_util.cc
++	src/tokenpool-gnu-make.cc
+ 	src/util.cc
+ 	src/version.cc
+ )
+@@ -123,9 +124,14 @@ if(WIN32)
+ 		src/msvc_helper_main-win32.cc
+ 		src/getopt.c
+ 		src/minidump-win32.cc
++		src/tokenpool-gnu-make-win32.cc
+ 	)
+ else()
+ 	target_sources(libninja PRIVATE src/subprocess-posix.cc)
++	target_sources(libninja PRIVATE
++		src/subprocess-posix.cc
++		src/tokenpool-gnu-make-posix.cc
++	)
+ 	if(CMAKE_SYSTEM_NAME STREQUAL "OS400" OR CMAKE_SYSTEM_NAME STREQUAL "AIX")
+ 		target_sources(libninja PRIVATE src/getopt.c)
+ 	endif()
+@@ -204,6 +210,7 @@ if(BUILD_TESTING)
+     src/string_piece_util_test.cc
+     src/subprocess_test.cc
+     src/test.cc
++    src/tokenpool_test.cc
+     src/util_test.cc
+   )
+   if(WIN32)
diff --git a/tools/patch/Makefile b/tools/patch/Makefile
index e0481204f79acd..957fe6e309f85c 100644
--- a/tools/patch/Makefile
+++ b/tools/patch/Makefile
@@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=patch
 PKG_VERSION:=2.7.6
-PKG_RELEASE:=6
+PKG_RELEASE:=7
 PKG_CPE_ID:=cpe:/a:gnu:patch
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
@@ -22,4 +22,8 @@ include $(INCLUDE_DIR)/host-build.mk
 HOSTCC := $(HOSTCC_NOCACHE)
 HOSTCXX := $(HOSTCXX_NOCACHE)
 
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
+endef
+
 $(eval $(call HostBuild))
diff --git a/tools/patch/patches/070-don-t-fail-hard-on-EACCES-when-copying-xattrs.patch b/tools/patch/patches/070-don-t-fail-hard-on-EACCES-when-copying-xattrs.patch
new file mode 100644
index 00000000000000..e19a9c0845b4fb
--- /dev/null
+++ b/tools/patch/patches/070-don-t-fail-hard-on-EACCES-when-copying-xattrs.patch
@@ -0,0 +1,33 @@
+From f42cbe1a91a3a6f79d1eec594ce7c72aec79179b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <thomas@t-8ch.de>
+Date: Wed, 9 Nov 2022 05:08:22 +0100
+Subject: [PATCH] don't fail hard on EACCES when copying xattrs
+
+On btrfs the xattr "btrfs.compressed" requires privileges to set,
+otherwise EACCES is returned.
+When patch tries to do copy this attribute it receives the error and
+aborts.
+---
+ src/util.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/src/util.c
++++ b/src/util.c
+@@ -182,7 +182,7 @@ copy_attr_error (struct error_context *c
+   int err = errno;
+   va_list ap;
+ 
+-  if (err != ENOSYS && err != ENOTSUP && err != EPERM)
++  if (err != ENOSYS && err != ENOTSUP && err != EPERM && err != EACCES)
+     {
+       /* use verror module to print error message */
+       va_start (ap, fmt);
+@@ -284,7 +284,7 @@ set_file_attributes (char const *to, enu
+     }
+   if (attr & FA_XATTRS)
+     if (copy_attr (from, to) != 0
+-	&& errno != ENOSYS && errno != ENOTSUP && errno != EPERM)
++	&& errno != ENOSYS && errno != ENOTSUP && errno != EPERM && errno != EACCES)
+       fatal_exit (0);
+   if (attr & FA_MODE)
+     {
diff --git a/tools/patchelf/Makefile b/tools/patchelf/Makefile
index 7c88f8dc45e537..bbda3a9e40a48e 100644
--- a/tools/patchelf/Makefile
+++ b/tools/patchelf/Makefile
@@ -7,12 +7,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=patchelf
+PKG_VERSION:=0.18.0
 
-PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=https://github.com/NixOS/patchelf.git
-PKG_SOURCE_VERSION:=f34751b88bd07d7f44f5cd3200fb4122bf916c7e
-PKG_SOURCE_DATE:=2020-12-07
-PKG_MIRROR_HASH:=ac746930b919b97da40f259cfc9ab7bbd48a0c9cbf2eebd8cee5ae19a94356fd
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
+PKG_SOURCE_URL:=https://github.com/NixOS/patchelf/releases/download/$(PKG_VERSION)
+PKG_HASH:=1952b2a782ba576279c211ee942e341748fdb44997f704dd53def46cd055470b
 
 HOST_BUILD_PARALLEL:=1
 HOST_FIXUP:=autoreconf
@@ -24,4 +23,8 @@ define Host/Install
 	$(INSTALL_BIN) $(HOST_BUILD_DIR)/src/patchelf $(STAGING_DIR_HOST)/bin/patchelf
 endef
 
+define Host/Clean
+	rm -rf $(STAGING_DIR_HOST)/bin/patchelf
+endef
+
 $(eval $(call HostBuild))
diff --git a/tools/pkgconf/Makefile b/tools/pkgconf/Makefile
index b5f241b7dce131..d0a8a271d93e6e 100644
--- a/tools/pkgconf/Makefile
+++ b/tools/pkgconf/Makefile
@@ -7,11 +7,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=pkgconf
-PKG_VERSION:=1.9.3
+PKG_VERSION:=1.9.5
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://distfiles.dereferenced.org/pkgconf
-PKG_HASH:=5fb355b487d54fb6d341e4f18d4e2f7e813a6622cf03a9e87affa6a40565699d
+PKG_HASH:=1ac1656debb27497563036f7bffc281490f83f9b8457c0d60bcfb638fb6b6171
+
+PKG_CPE_ID:=cpe:/a:pkgconf:pkgconf
 
 include $(INCLUDE_DIR)/host-build.mk
 include $(INCLUDE_DIR)/meson.mk
@@ -22,7 +24,7 @@ HOSTCC := $(HOSTCC_NOCACHE)
 
 MESON_HOST_ARGS += \
 	-Ddefault_library=static \
-	-Dtests=false
+	-Dtests=disabled
 
 define Host/Install
 	$(call Host/Install/Meson)
diff --git a/tools/sed/Makefile b/tools/sed/Makefile
index 4218ac2d593be1..5cc15a3397e23a 100644
--- a/tools/sed/Makefile
+++ b/tools/sed/Makefile
@@ -7,11 +7,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sed
-PKG_VERSION:=4.8
+PKG_VERSION:=4.9
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@GNU/$(PKG_NAME)
-PKG_HASH:=f79b0cfea71b37a8eeec8490db6c5f7ae7719c35587f21edb0617f370eeff633
+PKG_HASH:=6e226b732e1cd739464ad6862bd1a1aba42d7982922da7a53519631d24975181
 export SED:=
 
 HOST_BUILD_PARALLEL:=1
diff --git a/tools/sed/patches/001-sed-fix-handling-of-symlinks-pointing-to-path-with-1.patch b/tools/sed/patches/001-sed-fix-handling-of-symlinks-pointing-to-path-with-1.patch
new file mode 100644
index 00000000000000..96ae5bdbb98ed7
--- /dev/null
+++ b/tools/sed/patches/001-sed-fix-handling-of-symlinks-pointing-to-path-with-1.patch
@@ -0,0 +1,47 @@
+From 8f600f2df293d539e9e9137f6f82faa1633b97c1 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Sat, 17 Dec 2022 20:56:29 -0800
+Subject: [PATCH] sed: fix symlink bufsize readlink check
+
+Problem reported by Hauke Mehrtens.
+* sed/utils.c (follow_symlink): Fix typo when checking size of
+second and later symlink, when that symlink is so large that it
+does not fit into the buffer.  Although the bug is not a buffer
+overflow, it does cause sed to mishandle the symlink.
+* testsuite/follow-symlinks.sh: Test for the bug.
+---
+ sed/utils.c                  |  2 +-
+ testsuite/follow-symlinks.sh | 13 +++++++++++++
+ 3 files changed, 18 insertions(+), 1 deletion(-)
+
+--- a/sed/utils.c
++++ b/sed/utils.c
+@@ -345,7 +345,7 @@ follow_symlink (const char *fname)
+       while ((linklen = (buf_used < buf_size
+                          ? readlink (fn, buf + buf_used, buf_size - buf_used)
+                          : 0))
+-             == buf_size)
++             == buf_size - buf_used)
+         {
+           buf = xpalloc (buf, &buf_size, 1, SSIZE_IDX_MAX, 1);
+           if (num_links)
+--- a/testsuite/follow-symlinks.sh
++++ b/testsuite/follow-symlinks.sh
+@@ -73,4 +73,17 @@ compare_ exp-la-abs out-la-abs || fail=1
+ ln -s la-loop la-loop || framework_failure_
+ sed --follow-symlinks -i s/a/b/ la-loop && fail=1
+ 
++# symlink of length 128
++long=d/
++for i in 2 3 4 5 6 7; do
++  long=$long$long
++done
++dir=${long%/d/}
++file=$dir/xx
++mkdir -p $dir &&
++echo x >$file &&
++ln -s $file yy &&
++ln -s yy xx || framework_failure_
++sed -i --follow-symlinks s/x/y/ xx || fail=1
++
+ Exit $fail
diff --git a/tools/sparse/Makefile b/tools/sparse/Makefile
index 549ec3a3cc34e8..e08bd1d05f55a1 100644
--- a/tools/sparse/Makefile
+++ b/tools/sparse/Makefile
@@ -21,4 +21,8 @@ define Host/Install
        $(INSTALL_BIN) $(HOST_BUILD_DIR)/sparse $(STAGING_DIR_HOST)/bin
 endef
 
+define Host/Clean
+	rm -f $(STAGING_DIR_HOST)/bin/sparse
+endef
+
 $(eval $(call HostBuild))
diff --git a/tools/squashfs3-lzma/Makefile b/tools/squashfs3-lzma/Makefile
new file mode 100644
index 00000000000000..b02018629ee3c9
--- /dev/null
+++ b/tools/squashfs3-lzma/Makefile
@@ -0,0 +1,46 @@
+# 
+# Copyright (C) 2006-2012 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=squashfs3-lzma
+PKG_CPE_ID:=cpe:/a:phillip_lougher:squashfs
+PKG_VERSION:=3.0
+
+PKG_SOURCE:=squashfs$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=@SF/squashfs
+PKG_HASH:=39dbda43cf118536deb746c7730b468702d514a19f4cfab73b710e32908ddf20
+
+# Tar directory is squashfs3.0 that conflict with any pattern
+# currently using for host tools. (PKG_NAME-PKG_VERSION)
+# Also this got renamed to a more correct name
+# from squashfs to squashfs3-lzma.
+# Use tar transform to rename the root directory to this new
+# name.
+TAR_OPTIONS+=--transform=s/^squashfs/$(PKG_NAME)-/
+
+include $(INCLUDE_DIR)/host-build.mk
+
+define Host/Compile
+	$(MAKE) -C $(HOST_BUILD_DIR)/squashfs-tools \
+		CC="$(HOSTCC)" \
+		CFLAGS="$(HOST_CFLAGS) -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -I." \
+		CXX="$(CXX)" \
+		LZMAPATH=$(STAGING_DIR_HOST)/lib \
+		mksquashfs-lzma unsquashfs-lzma 
+endef
+
+define Host/Install
+	$(INSTALL_BIN) $(HOST_BUILD_DIR)/squashfs-tools/mksquashfs-lzma $(STAGING_DIR_HOST)/bin/mksquashfs3-lzma
+	$(INSTALL_BIN) $(HOST_BUILD_DIR)/squashfs-tools/unsquashfs-lzma $(STAGING_DIR_HOST)/bin/unsquashfs3-lzma
+endef
+
+define Host/Clean
+	rm -f $(STAGING_DIR_HOST)/bin/mksquashfs3-lzma
+	rm -f $(STAGING_DIR_HOST)/bin/unsquashfs3-lzma
+endef
+
+$(eval $(call HostBuild))
diff --git a/tools/squashfs3-lzma/patches/100-lzma.patch b/tools/squashfs3-lzma/patches/100-lzma.patch
new file mode 100644
index 00000000000000..73f6a4e05527de
--- /dev/null
+++ b/tools/squashfs3-lzma/patches/100-lzma.patch
@@ -0,0 +1,22 @@
+--- a/squashfs-tools/Makefile
++++ b/squashfs-tools/Makefile
+@@ -7,6 +7,9 @@ all: mksquashfs unsquashfs
+ mksquashfs: mksquashfs.o read_fs.o sort.o
+ 	$(CC) mksquashfs.o read_fs.o sort.o -lz -o $@
+ 
++mksquashfs-lzma: mksquashfs.o read_fs.o sort.o
++	$(CXX) mksquashfs.o read_fs.o sort.o -L$(LZMAPATH) -llzma-old -o $@
++
+ mksquashfs.o: mksquashfs.c squashfs_fs.h mksquashfs.h global.h sort.h
+ 
+ read_fs.o: read_fs.c squashfs_fs.h read_fs.h global.h
+@@ -16,4 +19,9 @@ sort.o: sort.c squashfs_fs.h global.h so
+ unsquashfs: unsquashfs.o
+ 	$(CC) unsquashfs.o -lz -o $@
+ 
++unsquashfs-lzma: unsquashfs.o
++	$(CXX) unsquashfs.o -L$(LZMAPATH) -llzma-old -o $@
++
+ unsquashfs.o: unsquashfs.c squashfs_fs.h read_fs.h global.h
++
++clean:
diff --git a/tools/squashfs3-lzma/patches/110-no_nonstatic_inline.patch b/tools/squashfs3-lzma/patches/110-no_nonstatic_inline.patch
new file mode 100644
index 00000000000000..8e288f336e078e
--- /dev/null
+++ b/tools/squashfs3-lzma/patches/110-no_nonstatic_inline.patch
@@ -0,0 +1,11 @@
+--- a/squashfs-tools/mksquashfs.c
++++ b/squashfs-tools/mksquashfs.c
+@@ -1347,7 +1347,7 @@ struct inode_info *lookup_inode(struct s
+ }
+ 
+ 
+-inline void add_dir_entry(char *name, char *pathname, struct dir_info *sub_dir, struct inode_info *inode_info, void *data, struct dir_info *dir)
++static inline void add_dir_entry(char *name, char *pathname, struct dir_info *sub_dir, struct inode_info *inode_info, void *data, struct dir_info *dir)
+ {
+ 	if((dir->count % DIR_ENTRIES) == 0)
+ 		if((dir->list = realloc(dir->list, (dir->count + DIR_ENTRIES) * sizeof(struct dir_ent *))) == NULL)
diff --git a/tools/squashfs3-lzma/patches/120-add-fixed-timestamp-support.patch b/tools/squashfs3-lzma/patches/120-add-fixed-timestamp-support.patch
new file mode 100644
index 00000000000000..e2f4bb2e049ceb
--- /dev/null
+++ b/tools/squashfs3-lzma/patches/120-add-fixed-timestamp-support.patch
@@ -0,0 +1,79 @@
+--- a/squashfs-tools/mksquashfs.c
++++ b/squashfs-tools/mksquashfs.c
+@@ -117,6 +117,9 @@ unsigned int inode_bytes = 0, inode_size
+ char *data_cache = NULL;
+ unsigned int cache_bytes = 0, cache_size = 0, inode_count = 0;
+ 
++/* override all timestamps */
++time_t fixed_time = -1;
++
+ /* in memory directory data */
+ #define I_COUNT_SIZE		128
+ #define DIR_ENTRIES		32
+@@ -1554,6 +1557,11 @@ void dir_scan(squashfs_inode *inode, cha
+ 		perror(buffer);
+ 		return;
+ 	}
++
++	/* override timestamp of lstat if fixed_time is given */
++	if(fixed_time != -1)
++		inode_info->buf.st_mtime = fixed_time;
++
+ 	if(sorted)
+ 		sort_files_and_write(dir_info);
+ 	dir_scan2(inode, dir_info);
+@@ -1582,6 +1590,10 @@ struct dir_info *dir_scan1(char *pathnam
+ 			perror(buffer);
+ 			continue;
+ 		}
++
++		if(fixed_time != -1)
++			buf.st_mtime = fixed_time;
++
+ 		if(excluded(filename, &buf))
+ 			continue;
+ 
+@@ -1621,6 +1633,9 @@ int dir_scan2(squashfs_inode *inode, str
+ 		char *dir_name = dir_ent->name;
+ 		unsigned int inode_number = ((buf->st_mode & S_IFMT) == S_IFDIR) ? dir_ent->inode->inode_number : dir_ent->inode->inode_number + dir_inode_no;
+ 
++		if(fixed_time != -1)
++			buf->st_mtime = fixed_time;
++
+ 		if(dir_ent->inode->inode == SQUASHFS_INVALID_BLK) {
+ 			switch(buf->st_mode & S_IFMT) {
+ 				case S_IFREG:
+@@ -1898,6 +1913,16 @@ int main(int argc, char *argv[])
+ 					exit(1);
+ 				}
+ 			}
++		} else if(strcmp(argv[i], "-fixed-time") == 0) {
++			if(++i == argc) {
++				ERROR("%s: -fixed-time missing a timestamp\n", argv[0]);
++				exit(1);
++			}
++			fixed_time = strtoll(argv[i], &b, 10);
++			if(*b != '\0') {
++				ERROR("%s: -fixed-time has an invalid number\n", argv[0]);
++				exit(1);
++			}
+ 		} else if(strcmp(argv[i], "-noI") == 0 ||
+ 				strcmp(argv[i], "-noInodeCompression") == 0)
+ 			noI = TRUE;
+@@ -1967,6 +1992,7 @@ printOptions:
+ 			ERROR("-all-root\t\tmake all files owned by root\n");
+ 			ERROR("-force-uid uid\t\tset all file uids to uid\n");
+ 			ERROR("-force-gid gid\t\tset all file gids to gid\n");
++			ERROR("-fixed-time timestamp\tset all timestamps to timestamp\n");
+ 			ERROR("-le\t\t\tcreate a little endian filesystem\n");
+ 			ERROR("-be\t\t\tcreate a big endian filesystem\n");
+ 			ERROR("-nopad\t\t\tdo not pad filesystem to a multiple of 4K\n");
+@@ -2190,7 +2216,7 @@ printOptions:
+ 	sBlk.block_size = block_size;
+ 	sBlk.block_log = block_log;
+ 	sBlk.flags = SQUASHFS_MKFLAGS(noI, noD, check_data, noF, no_fragments, always_use_fragments, duplicate_checking);
+-	sBlk.mkfs_time = time(NULL);
++	sBlk.mkfs_time = fixed_time != -1 ? fixed_time : time(NULL);
+ 
+ restore_filesystem:
+ 	write_fragment();
diff --git a/tools/squashfs3-lzma/patches/130-include_sysmacros.patch b/tools/squashfs3-lzma/patches/130-include_sysmacros.patch
new file mode 100644
index 00000000000000..f0149d6f65f08c
--- /dev/null
+++ b/tools/squashfs3-lzma/patches/130-include_sysmacros.patch
@@ -0,0 +1,20 @@
+--- a/squashfs-tools/mksquashfs.c
++++ b/squashfs-tools/mksquashfs.c
+@@ -30,6 +30,7 @@
+ #include <unistd.h>
+ #include <stdio.h>
+ #include <sys/types.h>
++#include <sys/sysmacros.h>
+ #include <sys/stat.h>
+ #include <fcntl.h>
+ #include <errno.h>
+--- a/squashfs-tools/unsquashfs.c
++++ b/squashfs-tools/unsquashfs.c
+@@ -25,6 +25,7 @@
+ #define FALSE 0
+ #include <stdio.h>
+ #include <sys/types.h>
++#include <sys/sysmacros.h>
+ #include <sys/stat.h>
+ #include <fcntl.h>
+ #include <errno.h>
diff --git a/tools/squashfs3-lzma/patches/140-gcc-10-fix.patch b/tools/squashfs3-lzma/patches/140-gcc-10-fix.patch
new file mode 100644
index 00000000000000..a02641f3072c42
--- /dev/null
+++ b/tools/squashfs3-lzma/patches/140-gcc-10-fix.patch
@@ -0,0 +1,25 @@
+Fixes the following build error with GCC 10:
+	/usr/bin/ld: read_fs.o:(.bss+0x0): multiple definition of `swap'; mksquashfs.o:(.bss+0x1b2a88): first defined here
+And a compile warning.
+
+--- a/squashfs-tools/read_fs.c
++++ b/squashfs-tools/read_fs.c
+@@ -61,7 +61,7 @@ extern int add_file(long long, long long
+ 						fprintf(stderr, s, ## args); \
+ 					} while(0)
+ 
+-int swap;
++static int swap;
+ 
+ int read_block(int fd, long long start, long long *next, unsigned char *block, squashfs_super_block *sBlk)
+ {
+--- a/squashfs-tools/mksquashfs.c
++++ b/squashfs-tools/mksquashfs.c
+@@ -258,6 +258,7 @@ int read_sort_file(char *filename, int s
+ void sort_files_and_write(struct dir_info *dir);
+ struct file_info *duplicate(char *(get_next_file_block)(struct duplicate_buffer_handle *, unsigned int), struct duplicate_buffer_handle *file_start, long long bytes, unsigned int **block_list, long long *start, int blocks, struct fragment **fragment, char *frag_data, int frag_bytes);
+ struct dir_info *dir_scan1(char *, int (_readdir)(char *, char *, struct dir_info *));
++int dir_scan2(squashfs_inode *inode, struct dir_info *dir_info);
+ 
+ #define MKINODE(A)	((squashfs_inode)(((squashfs_inode) inode_bytes << 16) + (((char *)A) - data_cache)))
+ 
diff --git a/tools/squashfs3-lzma/patches/150-fix-unitialized-memory.patch b/tools/squashfs3-lzma/patches/150-fix-unitialized-memory.patch
new file mode 100644
index 00000000000000..ad3b8208948a6a
--- /dev/null
+++ b/tools/squashfs3-lzma/patches/150-fix-unitialized-memory.patch
@@ -0,0 +1,11 @@
+--- a/squashfs-tools/mksquashfs.c
++++ b/squashfs-tools/mksquashfs.c
+@@ -1822,7 +1822,7 @@ int main(int argc, char *argv[])
+ {
+ 	struct stat buf, source_buf;
+ 	int i;
+-	squashfs_super_block sBlk;
++	squashfs_super_block sBlk = {};
+ 	char *b, *root_name = NULL;
+ 	int be, nopad = FALSE, keep_as_directory = FALSE, orig_be;
+ 	squashfs_inode inode;
diff --git a/tools/squashfs4/Makefile b/tools/squashfs4/Makefile
new file mode 100644
index 00000000000000..ce66a8558069cf
--- /dev/null
+++ b/tools/squashfs4/Makefile
@@ -0,0 +1,44 @@
+#
+# Copyright (C) 2006-2012 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=squashfs4
+PKG_CPE_ID:=cpe:/a:phillip_lougher:squashfs
+PKG_VERSION:=4.6.1
+PKG_RELEASE=3
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL:=https://github.com/plougher/squashfs-tools
+PKG_SOURCE_DATE:=2023-03-26
+PKG_SOURCE_VERSION:=d8cb82d9840330f9344ec37b992595b5d7b44184
+PKG_MIRROR_HASH:=fc625af657ca284d69fbc32e3bb572d0afd566cf816b7c1c1b66dda0a0c2760a
+
+HOST_BUILD_PARALLEL:=1
+
+include $(INCLUDE_DIR)/host-build.mk
+
+define Host/Compile
+	+$(HOST_MAKE_VARS) \
+	$(MAKE) $(HOST_JOBS) -C $(HOST_BUILD_DIR)/squashfs-tools \
+		XZ_SUPPORT=1 \
+		LZMA_XZ_SUPPORT=1 \
+		XZ_EXTENDED_OPTIONS=1 \
+		EXTRA_CFLAGS="-I$(STAGING_DIR_HOST)/include" \
+		mksquashfs unsquashfs
+endef
+
+define Host/Install
+	$(INSTALL_BIN) $(HOST_BUILD_DIR)/squashfs-tools/mksquashfs $(STAGING_DIR_HOST)/bin/mksquashfs4
+	$(INSTALL_BIN) $(HOST_BUILD_DIR)/squashfs-tools/unsquashfs $(STAGING_DIR_HOST)/bin/unsquashfs4
+endef
+
+define Host/Clean
+	rm -f $(STAGING_DIR_HOST)/bin/mksquashfs4
+	rm -f $(STAGING_DIR_HOST)/bin/unsquashfs4
+endef
+
+$(eval $(call HostBuild))
diff --git a/tools/squashfs4/patches/001-xz_wrapper-support-multiple-lzma-configuration-optio.patch b/tools/squashfs4/patches/001-xz_wrapper-support-multiple-lzma-configuration-optio.patch
new file mode 100644
index 00000000000000..bcc962a9de187f
--- /dev/null
+++ b/tools/squashfs4/patches/001-xz_wrapper-support-multiple-lzma-configuration-optio.patch
@@ -0,0 +1,187 @@
+From dcb976fe4ee40e4bac8ae0dcc836629c625a6fd4 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Fri, 14 Oct 2022 15:59:16 +0200
+Subject: [PATCH] xz_wrapper: support multiple lzma configuration options
+
+Add option to configure preset, lc, lp and pb lzma parameters.
+-Xpreset can be used to set the compression level.
+-Xe can be used to set the 'EXTREME' flag to use the lzma compression
+options tweaking additional settings on top of the compression level set.
+
+New option added:
+ -Xpreset
+ -Xe
+ -Xlc
+ -Xlp
+ -Xpb
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ squashfs-tools/xz_wrapper.c | 119 ++++++++++++++++++++++++++++++++++--
+ 1 file changed, 115 insertions(+), 4 deletions(-)
+
+--- a/squashfs-tools/xz_wrapper.c
++++ b/squashfs-tools/xz_wrapper.c
+@@ -44,7 +44,10 @@ static struct bcj bcj[] = {
+ static int filter_count = 1;
+ static int dictionary_size = 0;
+ static float dictionary_percent = 0;
+-
++static int preset = LZMA_PRESET_DEFAULT;
++static int lc = -1;
++static int lp = -1;
++static int pb = -1;
+ 
+ /*
+  * This function is called by the options parsing code in mksquashfs.c
+@@ -53,6 +56,11 @@ static float dictionary_percent = 0;
+  * Two specific options are supported:
+  *	-Xbcj
+  *	-Xdict-size
++ *	-Xpreset
++ *	-Xe
++ *	-Xlc
++ *	-Xlp
++ *	-Xpb
+  *
+  * This function returns:
+  *	>=0 (number of additional args parsed) on success
+@@ -141,6 +149,85 @@ static int xz_options(char *argv[], int
+ 		}
+ 
+ 		return 1;
++	} else if(strcmp(argv[0], "-Xpreset") == 0) {
++		char *b;
++		long val;
++
++		if(argc < 2) {
++			fprintf(stderr, "xz: -Xpreset missing preset-level "
++				"(valid value 0-9)\n");
++			goto failed;
++		}
++
++		val = strtol(argv[1], &b, 10);
++		if (*b != '\0' || (int) val < 0 || (int) val & ~LZMA_PRESET_LEVEL_MASK) {
++			fprintf(stderr, "xz: -Xpreset can't be "
++				"negative or more than the max preset\n");
++			goto failed;
++		}
++
++		preset &= ~LZMA_PRESET_LEVEL_MASK;
++		preset |= (int) val;
++
++		return 1;
++	} else if(strcmp(argv[0], "-Xe") == 0) {
++		preset |= LZMA_PRESET_EXTREME;
++
++		return 0;
++	} else if(strcmp(argv[0], "-Xlc") == 0) {
++		char *b;
++		long val;
++
++		if(argc < 2) {
++			fprintf(stderr, "xz: -Xlc missing value\n");
++			goto failed;
++		}
++
++		val = strtol(argv[1], &b, 10);
++		if (*b != '\0' || (int) val < LZMA_LCLP_MIN || (int) val > LZMA_LCLP_MAX) {
++			fprintf(stderr, "xz: -Xlc invalid value\n");
++			goto failed;
++		}
++
++		lc = (int) val;
++
++		return 1;
++	} else if(strcmp(argv[0], "-Xlp") == 0) {
++		char *b;
++		long val;
++
++		if(argc < 2) {
++			fprintf(stderr, "xz: -Xlp missing value\n");
++			goto failed;
++		}
++
++		val = strtol(argv[1], &b, 10);
++		if (*b != '\0' || (int) val < LZMA_LCLP_MIN || (int) val > LZMA_LCLP_MAX) {
++			fprintf(stderr, "xz: -Xlp invalid value\n");
++			goto failed;
++		}
++
++		lp = (int) val;
++
++		return 1;
++	} else if(strcmp(argv[0], "-Xpb") == 0) {
++		char *b;
++		long val;
++
++		if(argc < 2) {
++			fprintf(stderr, "xz: -Xpb missing value\n");
++			goto failed;
++		}
++
++		val = strtol(argv[1], &b, 10);
++		if (*b != '\0' || (int) val < LZMA_PB_MIN || (int) val > LZMA_PB_MAX) {
++			fprintf(stderr, "xz: -Xpb invalid value\n");
++			goto failed;
++		}
++
++		pb = (int) val;
++
++		return 1;
+ 	}
+ 
+ 	return -1;
+@@ -446,11 +533,20 @@ static int xz_compress(void *strm, void
+ 	for(i = 0; i < stream->filters; i++) {
+ 		struct filter *filter = &stream->filter[i];
+ 
+-        	if(lzma_lzma_preset(&stream->opt, LZMA_PRESET_DEFAULT))
+-                	goto failed;
++		if(lzma_lzma_preset(&stream->opt, preset))
++			goto failed;
+ 
+ 		stream->opt.dict_size = stream->dictionary_size;
+ 
++		if (lc >= 0)
++			stream->opt.lc = lc;
++
++		if (lp >= 0)
++			stream->opt.lp = lp;
++
++		if (pb >= 0)
++			stream->opt.pb = pb;
++
+ 		filter->length = 0;
+ 		res = lzma_stream_buffer_encode(filter->filter,
+ 			LZMA_CHECK_CRC32, NULL, src, size, filter->buffer,
+@@ -521,13 +617,28 @@ static void xz_usage(FILE *stream)
+ 	fprintf(stream, " header as either 2^n or as 2^n+2^(n+1).\n\t\t");
+ 	fprintf(stream, "Example dict-sizes are 75%%, 50%%, 37.5%%, 25%%, or");
+ 	fprintf(stream, " 32K, 16K, 8K\n\t\tetc.\n");
++	fprintf(stream, "\t  -Xpreset <preset-level>\n");
++	fprintf(stream, "\t\tUse <preset-value> as the custom preset to use");
++	fprintf(stream, " on compress.\n\t\t<preset-level> should be 0 .. 9");
++	fprintf(stream, " (default 6)\n");
++	fprintf(stream, "\t  -Xe\n");
++	fprintf(stream, "\t\tEnable additional compression settings by passing");
++	fprintf(stream, " the EXTREME\n\t\tflag to the compression flags.\n");
++	fprintf(stream, "\t  -Xlc <value>\n");
++	fprintf(stream, "\t  -Xlp <value>\n");
++	fprintf(stream, "\t  -Xpb <value>\n");
+ }
+ 
+ 
+ static int option_args(char *option)
+ {
+ 	if(strcmp(option, "-Xbcj") == 0 ||
+-				strcmp(option, "-Xdict-size") == 0)
++	   strcmp(option, "-Xdict-size") == 0 ||
++	   strcmp(option, "-Xpreset") == 0 ||
++	   strcmp(option, "-Xe") == 0 ||
++	   strcmp(option, "-Xlc") == 0 ||
++	   strcmp(option, "-Xlp") == 0 ||
++	   strcmp(option, "-Xpb") == 0)
+ 		return 1;
+ 
+ 	return 0;
diff --git a/tools/squashfs4/patches/002-xz_wrapper-make-new-OpenWrt-extended-options-non-def.patch b/tools/squashfs4/patches/002-xz_wrapper-make-new-OpenWrt-extended-options-non-def.patch
new file mode 100644
index 00000000000000..92b6a1aa91bc68
--- /dev/null
+++ b/tools/squashfs4/patches/002-xz_wrapper-make-new-OpenWrt-extended-options-non-def.patch
@@ -0,0 +1,898 @@
+From 5fb9fdfb8757fc9afb6318a3dcf9dce0a97de352 Mon Sep 17 00:00:00 2001
+From: Phillip Lougher <phillip@squashfs.org.uk>
+Date: Wed, 19 Apr 2023 18:35:53 +0100
+Subject: [PATCH] xz_wrapper: make new OpenWrt extended options non-default
+
+The reason why these options are being made non-default are
+described here:
+
+https://github.com/plougher/squashfs-tools/pull/218#issuecomment-1515197256
+
+The new options can be enabled by editing the Makefile or by defining
+XZ_EXTENDED_OPTIONS on the Make command line, e.g.
+
+% CONFIG=1 XZ_SUPPORT=1 XZ_EXTENDED_OPTIONS=1 make
+
+Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
+---
+ squashfs-tools/Makefile              |  12 +
+ squashfs-tools/xz_wrapper.c          | 117 +----
+ squashfs-tools/xz_wrapper_extended.c | 664 +++++++++++++++++++++++++++
+ 3 files changed, 679 insertions(+), 114 deletions(-)
+ create mode 100644 squashfs-tools/xz_wrapper_extended.c
+
+--- a/squashfs-tools/Makefile
++++ b/squashfs-tools/Makefile
+@@ -39,6 +39,10 @@ GZIP_SUPPORT = 1
+ #
+ #XZ_SUPPORT = 1
+ 
++# Enable support for OpenWrt extended compression options by uncommenting
++# next line.  Do not do this unless you understand the implications.
++#XZ_EXTENDED_OPTIONS = 1
++
+ 
+ ############ Building LZO support ##############
+ #
+@@ -197,6 +201,7 @@ INSTALL_MANPAGES_DIR ?= $(INSTALL_PREFIX
+ LZMA_XZ_SUPPORT ?= 0
+ LZMA_SUPPORT ?= 0
+ LZMA_DIR ?= ../../../../LZMA/lzma465
++XZ_EXTENDED_OPTIONS ?= 0
+ endif
+ 
+ 
+@@ -248,8 +253,13 @@ endif
+ 
+ ifeq ($(XZ_SUPPORT),1)
+ CFLAGS += -DXZ_SUPPORT
++ifeq ($(XZ_EXTENDED_OPTIONS),1)
++MKSQUASHFS_OBJS += xz_wrapper_extended.o
++UNSQUASHFS_OBJS += xz_wrapper_extended.o
++else
+ MKSQUASHFS_OBJS += xz_wrapper.o
+ UNSQUASHFS_OBJS += xz_wrapper.o
++endif
+ LIBS += -llzma
+ COMPRESSORS += xz
+ endif
+@@ -428,6 +438,8 @@ lz4_wrapper.o: lz4_wrapper.c squashfs_fs
+ 
+ xz_wrapper.o: xz_wrapper.c squashfs_fs.h xz_wrapper.h compressor.h
+ 
++xz_wrapper_extended.o: xz_wrapper_extended.c squashfs_fs.h xz_wrapper.h compressor.h
++
+ unsquashfs: $(UNSQUASHFS_OBJS)
+ 	$(CC) $(LDFLAGS) $(EXTRA_LDFLAGS) $(UNSQUASHFS_OBJS) $(LIBS) -o $@
+ 	ln -sf unsquashfs sqfscat
+--- a/squashfs-tools/xz_wrapper.c
++++ b/squashfs-tools/xz_wrapper.c
+@@ -44,10 +44,7 @@ static struct bcj bcj[] = {
+ static int filter_count = 1;
+ static int dictionary_size = 0;
+ static float dictionary_percent = 0;
+-static int preset = LZMA_PRESET_DEFAULT;
+-static int lc = -1;
+-static int lp = -1;
+-static int pb = -1;
++
+ 
+ /*
+  * This function is called by the options parsing code in mksquashfs.c
+@@ -56,11 +53,6 @@ static int pb = -1;
+  * Two specific options are supported:
+  *	-Xbcj
+  *	-Xdict-size
+- *	-Xpreset
+- *	-Xe
+- *	-Xlc
+- *	-Xlp
+- *	-Xpb
+  *
+  * This function returns:
+  *	>=0 (number of additional args parsed) on success
+@@ -149,85 +141,6 @@ static int xz_options(char *argv[], int
+ 		}
+ 
+ 		return 1;
+-	} else if(strcmp(argv[0], "-Xpreset") == 0) {
+-		char *b;
+-		long val;
+-
+-		if(argc < 2) {
+-			fprintf(stderr, "xz: -Xpreset missing preset-level "
+-				"(valid value 0-9)\n");
+-			goto failed;
+-		}
+-
+-		val = strtol(argv[1], &b, 10);
+-		if (*b != '\0' || (int) val < 0 || (int) val & ~LZMA_PRESET_LEVEL_MASK) {
+-			fprintf(stderr, "xz: -Xpreset can't be "
+-				"negative or more than the max preset\n");
+-			goto failed;
+-		}
+-
+-		preset &= ~LZMA_PRESET_LEVEL_MASK;
+-		preset |= (int) val;
+-
+-		return 1;
+-	} else if(strcmp(argv[0], "-Xe") == 0) {
+-		preset |= LZMA_PRESET_EXTREME;
+-
+-		return 0;
+-	} else if(strcmp(argv[0], "-Xlc") == 0) {
+-		char *b;
+-		long val;
+-
+-		if(argc < 2) {
+-			fprintf(stderr, "xz: -Xlc missing value\n");
+-			goto failed;
+-		}
+-
+-		val = strtol(argv[1], &b, 10);
+-		if (*b != '\0' || (int) val < LZMA_LCLP_MIN || (int) val > LZMA_LCLP_MAX) {
+-			fprintf(stderr, "xz: -Xlc invalid value\n");
+-			goto failed;
+-		}
+-
+-		lc = (int) val;
+-
+-		return 1;
+-	} else if(strcmp(argv[0], "-Xlp") == 0) {
+-		char *b;
+-		long val;
+-
+-		if(argc < 2) {
+-			fprintf(stderr, "xz: -Xlp missing value\n");
+-			goto failed;
+-		}
+-
+-		val = strtol(argv[1], &b, 10);
+-		if (*b != '\0' || (int) val < LZMA_LCLP_MIN || (int) val > LZMA_LCLP_MAX) {
+-			fprintf(stderr, "xz: -Xlp invalid value\n");
+-			goto failed;
+-		}
+-
+-		lp = (int) val;
+-
+-		return 1;
+-	} else if(strcmp(argv[0], "-Xpb") == 0) {
+-		char *b;
+-		long val;
+-
+-		if(argc < 2) {
+-			fprintf(stderr, "xz: -Xpb missing value\n");
+-			goto failed;
+-		}
+-
+-		val = strtol(argv[1], &b, 10);
+-		if (*b != '\0' || (int) val < LZMA_PB_MIN || (int) val > LZMA_PB_MAX) {
+-			fprintf(stderr, "xz: -Xpb invalid value\n");
+-			goto failed;
+-		}
+-
+-		pb = (int) val;
+-
+-		return 1;
+ 	}
+ 
+ 	return -1;
+@@ -533,20 +446,11 @@ static int xz_compress(void *strm, void
+ 	for(i = 0; i < stream->filters; i++) {
+ 		struct filter *filter = &stream->filter[i];
+ 
+-		if(lzma_lzma_preset(&stream->opt, preset))
++		if(lzma_lzma_preset(&stream->opt, LZMA_PRESET_DEFAULT))
+ 			goto failed;
+ 
+ 		stream->opt.dict_size = stream->dictionary_size;
+ 
+-		if (lc >= 0)
+-			stream->opt.lc = lc;
+-
+-		if (lp >= 0)
+-			stream->opt.lp = lp;
+-
+-		if (pb >= 0)
+-			stream->opt.pb = pb;
+-
+ 		filter->length = 0;
+ 		res = lzma_stream_buffer_encode(filter->filter,
+ 			LZMA_CHECK_CRC32, NULL, src, size, filter->buffer,
+@@ -617,28 +521,13 @@ static void xz_usage(FILE *stream)
+ 	fprintf(stream, " header as either 2^n or as 2^n+2^(n+1).\n\t\t");
+ 	fprintf(stream, "Example dict-sizes are 75%%, 50%%, 37.5%%, 25%%, or");
+ 	fprintf(stream, " 32K, 16K, 8K\n\t\tetc.\n");
+-	fprintf(stream, "\t  -Xpreset <preset-level>\n");
+-	fprintf(stream, "\t\tUse <preset-value> as the custom preset to use");
+-	fprintf(stream, " on compress.\n\t\t<preset-level> should be 0 .. 9");
+-	fprintf(stream, " (default 6)\n");
+-	fprintf(stream, "\t  -Xe\n");
+-	fprintf(stream, "\t\tEnable additional compression settings by passing");
+-	fprintf(stream, " the EXTREME\n\t\tflag to the compression flags.\n");
+-	fprintf(stream, "\t  -Xlc <value>\n");
+-	fprintf(stream, "\t  -Xlp <value>\n");
+-	fprintf(stream, "\t  -Xpb <value>\n");
+ }
+ 
+ 
+ static int option_args(char *option)
+ {
+ 	if(strcmp(option, "-Xbcj") == 0 ||
+-	   strcmp(option, "-Xdict-size") == 0 ||
+-	   strcmp(option, "-Xpreset") == 0 ||
+-	   strcmp(option, "-Xe") == 0 ||
+-	   strcmp(option, "-Xlc") == 0 ||
+-	   strcmp(option, "-Xlp") == 0 ||
+-	   strcmp(option, "-Xpb") == 0)
++				strcmp(option, "-Xdict-size") == 0)
+ 		return 1;
+ 
+ 	return 0;
+--- /dev/null
++++ b/squashfs-tools/xz_wrapper_extended.c
+@@ -0,0 +1,664 @@
++/*
++ * Copyright (c) 2010, 2011, 2012, 2013, 2021, 2022
++ * Phillip Lougher <phillip@squashfs.org.uk>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * as published by the Free Software Foundation; either version 2,
++ * or (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
++ *
++ * xz_wrapper_extended.c
++ *
++ * Support for XZ (LZMA2) compression using XZ Utils liblzma
++ * http://tukaani.org/xz/
++ *
++ * This file supports OpenWrt extended XZ compression options.
++ */
++
++#include <stdio.h>
++#include <string.h>
++#include <stdlib.h>
++#include <lzma.h>
++
++#include "squashfs_fs.h"
++#include "xz_wrapper.h"
++#include "compressor.h"
++
++static struct bcj bcj[] = {
++	{ "x86", LZMA_FILTER_X86, 0 },
++	{ "powerpc", LZMA_FILTER_POWERPC, 0 },
++	{ "ia64", LZMA_FILTER_IA64, 0 },
++	{ "arm", LZMA_FILTER_ARM, 0 },
++	{ "armthumb", LZMA_FILTER_ARMTHUMB, 0 },
++	{ "sparc", LZMA_FILTER_SPARC, 0 },
++	{ NULL, LZMA_VLI_UNKNOWN, 0 }
++};
++
++static int filter_count = 1;
++static int dictionary_size = 0;
++static float dictionary_percent = 0;
++static int preset = LZMA_PRESET_DEFAULT;
++static int lc = -1;
++static int lp = -1;
++static int pb = -1;
++
++/*
++ * This function is called by the options parsing code in mksquashfs.c
++ * to parse any -X compressor option.
++ *
++ * Two specific options are supported:
++ *	-Xbcj
++ *	-Xdict-size
++ *	-Xpreset
++ *	-Xe
++ *	-Xlc
++ *	-Xlp
++ *	-Xpb
++ *
++ * This function returns:
++ *	>=0 (number of additional args parsed) on success
++ *	-1 if the option was unrecognised, or
++ *	-2 if the option was recognised, but otherwise bad in
++ *	   some way (e.g. invalid parameter)
++ *
++ * Note: this function sets internal compressor state, but does not
++ * pass back the results of the parsing other than success/failure.
++ * The xz_dump_options() function is called later to get the options in
++ * a format suitable for writing to the filesystem.
++ */
++static int xz_options(char *argv[], int argc)
++{
++	int i;
++	char *name;
++
++	if(strcmp(argv[0], "-Xbcj") == 0) {
++		if(argc < 2) {
++			fprintf(stderr, "xz: -Xbcj missing filter\n");
++			goto failed;
++		}
++
++		name = argv[1];
++		while(name[0] != '\0') {
++			for(i = 0; bcj[i].name; i++) {
++				int n = strlen(bcj[i].name);
++				if((strncmp(name, bcj[i].name, n) == 0) &&
++						(name[n] == '\0' ||
++						 name[n] == ',')) {
++					if(bcj[i].selected == 0) {
++						bcj[i].selected = 1;
++						filter_count++;
++					}
++					name += name[n] == ',' ? n + 1 : n;
++					break;
++				}
++			}
++			if(bcj[i].name == NULL) {
++				fprintf(stderr, "xz: -Xbcj unrecognised "
++					"filter\n");
++				goto failed;
++			}
++		}
++
++		return 1;
++	} else if(strcmp(argv[0], "-Xdict-size") == 0) {
++		char *b;
++		float size;
++
++		if(argc < 2) {
++			fprintf(stderr, "xz: -Xdict-size missing dict-size\n");
++			goto failed;
++		}
++
++		size = strtof(argv[1], &b);
++		if(*b == '%') {
++			if(size <= 0 || size > 100) {
++				fprintf(stderr, "xz: -Xdict-size percentage "
++					"should be 0 < dict-size <= 100\n");
++				goto failed;
++			}
++
++			dictionary_percent = size;
++			dictionary_size = 0;
++		} else {
++			if((float) ((int) size) != size) {
++				fprintf(stderr, "xz: -Xdict-size can't be "
++					"fractional unless a percentage of the"
++					" block size\n");
++				goto failed;
++			}
++
++			dictionary_percent = 0;
++			dictionary_size = (int) size;
++
++			if(*b == 'k' || *b == 'K')
++				dictionary_size *= 1024;
++			else if(*b == 'm' || *b == 'M')
++				dictionary_size *= 1024 * 1024;
++			else if(*b != '\0') {
++				fprintf(stderr, "xz: -Xdict-size invalid "
++					"dict-size\n");
++				goto failed;
++			}
++		}
++
++		return 1;
++	} else if(strcmp(argv[0], "-Xpreset") == 0) {
++		char *b;
++		long val;
++
++		if(argc < 2) {
++			fprintf(stderr, "xz: -Xpreset missing preset-level "
++				"(valid value 0-9)\n");
++			goto failed;
++		}
++
++		val = strtol(argv[1], &b, 10);
++		if (*b != '\0' || (int) val < 0 || (int) val & ~LZMA_PRESET_LEVEL_MASK) {
++			fprintf(stderr, "xz: -Xpreset can't be "
++				"negative or more than the max preset\n");
++			goto failed;
++		}
++
++		preset &= ~LZMA_PRESET_LEVEL_MASK;
++		preset |= (int) val;
++
++		return 1;
++	} else if(strcmp(argv[0], "-Xe") == 0) {
++		preset |= LZMA_PRESET_EXTREME;
++
++		return 0;
++	} else if(strcmp(argv[0], "-Xlc") == 0) {
++		char *b;
++		long val;
++
++		if(argc < 2) {
++			fprintf(stderr, "xz: -Xlc missing value\n");
++			goto failed;
++		}
++
++		val = strtol(argv[1], &b, 10);
++		if (*b != '\0' || (int) val < LZMA_LCLP_MIN || (int) val > LZMA_LCLP_MAX) {
++			fprintf(stderr, "xz: -Xlc invalid value\n");
++			goto failed;
++		}
++
++		lc = (int) val;
++
++		return 1;
++	} else if(strcmp(argv[0], "-Xlp") == 0) {
++		char *b;
++		long val;
++
++		if(argc < 2) {
++			fprintf(stderr, "xz: -Xlp missing value\n");
++			goto failed;
++		}
++
++		val = strtol(argv[1], &b, 10);
++		if (*b != '\0' || (int) val < LZMA_LCLP_MIN || (int) val > LZMA_LCLP_MAX) {
++			fprintf(stderr, "xz: -Xlp invalid value\n");
++			goto failed;
++		}
++
++		lp = (int) val;
++
++		return 1;
++	} else if(strcmp(argv[0], "-Xpb") == 0) {
++		char *b;
++		long val;
++
++		if(argc < 2) {
++			fprintf(stderr, "xz: -Xpb missing value\n");
++			goto failed;
++		}
++
++		val = strtol(argv[1], &b, 10);
++		if (*b != '\0' || (int) val < LZMA_PB_MIN || (int) val > LZMA_PB_MAX) {
++			fprintf(stderr, "xz: -Xpb invalid value\n");
++			goto failed;
++		}
++
++		pb = (int) val;
++
++		return 1;
++	}
++
++	return -1;
++
++failed:
++	return -2;
++}
++
++
++/*
++ * This function is called after all options have been parsed.
++ * It is used to do post-processing on the compressor options using
++ * values that were not expected to be known at option parse time.
++ *
++ * In this case block_size may not be known until after -Xdict-size has
++ * been processed (in the case where -b is specified after -Xdict-size)
++ *
++ * This function returns 0 on successful post processing, or
++ *			-1 on error
++ */
++static int xz_options_post(int block_size)
++{
++	/*
++	 * if -Xdict-size has been specified use this to compute the datablock
++	 * dictionary size
++	 */
++	if(dictionary_size || dictionary_percent) {
++		int n;
++
++		if(dictionary_size) {
++			if(dictionary_size > block_size) {
++				fprintf(stderr, "xz: -Xdict-size is larger than"
++				" block_size\n");
++				goto failed;
++			}
++		} else
++			dictionary_size = block_size * dictionary_percent / 100;
++
++		if(dictionary_size < 8192) {
++			fprintf(stderr, "xz: -Xdict-size should be 8192 bytes "
++				"or larger\n");
++			goto failed;
++		}
++
++		/*
++		 * dictionary_size must be storable in xz header as either
++		 * 2^n or as  2^n+2^(n+1)
++		 */
++		n = ffs(dictionary_size) - 1;
++		if(dictionary_size != (1 << n) &&
++				dictionary_size != ((1 << n) + (1 << (n + 1)))) {
++			fprintf(stderr, "xz: -Xdict-size is an unsupported "
++				"value, dict-size must be storable in xz "
++				"header\n");
++			fprintf(stderr, "as either 2^n or as 2^n+2^(n+1).  "
++				"Example dict-sizes are 75%%, 50%%, 37.5%%, "
++				"25%%,\n");
++			fprintf(stderr, "or 32K, 16K, 8K etc.\n");
++			goto failed;
++		}
++
++	} else
++		/* No -Xdict-size specified, use defaults */
++		dictionary_size = block_size;
++
++	return 0;
++
++failed:
++	return -1;
++}
++
++
++/*
++ * This function is called by mksquashfs to dump the parsed
++ * compressor options in a format suitable for writing to the
++ * compressor options field in the filesystem (stored immediately
++ * after the superblock).
++ *
++ * This function returns a pointer to the compression options structure
++ * to be stored (and the size), or NULL if there are no compression
++ * options
++ */
++static void *xz_dump_options(int block_size, int *size)
++{
++	static struct comp_opts comp_opts;
++	int flags = 0, i;
++
++	/*
++	 * don't store compressor specific options in file system if the
++	 * default options are being used - no compressor options in the
++	 * file system means the default options are always assumed
++	 *
++	 * Defaults are:
++	 *  metadata dictionary size: SQUASHFS_METADATA_SIZE
++	 *  datablock dictionary size: block_size
++	 *  1 filter
++	 */
++	if(dictionary_size == block_size && filter_count == 1)
++		return NULL;
++
++	for(i = 0; bcj[i].name; i++)
++		flags |= bcj[i].selected << i;
++
++	comp_opts.dictionary_size = dictionary_size;
++	comp_opts.flags = flags;
++
++	SQUASHFS_INSWAP_COMP_OPTS(&comp_opts);
++
++	*size = sizeof(comp_opts);
++	return &comp_opts;
++}
++
++
++/*
++ * This function is a helper specifically for the append mode of
++ * mksquashfs.  Its purpose is to set the internal compressor state
++ * to the stored compressor options in the passed compressor options
++ * structure.
++ *
++ * In effect this function sets up the compressor options
++ * to the same state they were when the filesystem was originally
++ * generated, this is to ensure on appending, the compressor uses
++ * the same compression options that were used to generate the
++ * original filesystem.
++ *
++ * Note, even if there are no compressor options, this function is still
++ * called with an empty compressor structure (size == 0), to explicitly
++ * set the default options, this is to ensure any user supplied
++ * -X options on the appending mksquashfs command line are over-ridden
++ *
++ * This function returns 0 on sucessful extraction of options, and
++ *			-1 on error
++ */
++static int xz_extract_options(int block_size, void *buffer, int size)
++{
++	struct comp_opts *comp_opts = buffer;
++	int flags, i, n;
++
++	if(size == 0) {
++		/* set defaults */
++		dictionary_size = block_size;
++		flags = 0;
++	} else {
++		/* check passed comp opts struct is of the correct length */
++		if(size != sizeof(struct comp_opts))
++			goto failed;
++
++		SQUASHFS_INSWAP_COMP_OPTS(comp_opts);
++
++		dictionary_size = comp_opts->dictionary_size;
++		flags = comp_opts->flags;
++
++		/*
++		 * check that the dictionary size seems correct - the dictionary
++		 * size should 2^n or 2^n+2^(n+1)
++		 */
++		n = ffs(dictionary_size) - 1;
++		if(dictionary_size != (1 << n) &&
++				dictionary_size != ((1 << n) + (1 << (n + 1))))
++			goto failed;
++	}
++
++	filter_count = 1;
++	for(i = 0; bcj[i].name; i++) {
++		if((flags >> i) & 1) {
++			bcj[i].selected = 1;
++			filter_count ++;
++		} else
++			bcj[i].selected = 0;
++	}
++
++	return 0;
++
++failed:
++	fprintf(stderr, "xz: error reading stored compressor options from "
++		"filesystem!\n");
++
++	return -1;
++}
++
++
++static void xz_display_options(void *buffer, int size)
++{
++	struct comp_opts *comp_opts = buffer;
++	int dictionary_size, flags, printed;
++	int i, n;
++
++	/* check passed comp opts struct is of the correct length */
++	if(size != sizeof(struct comp_opts))
++		goto failed;
++
++	SQUASHFS_INSWAP_COMP_OPTS(comp_opts);
++
++	dictionary_size = comp_opts->dictionary_size;
++	flags = comp_opts->flags;
++
++	/*
++	 * check that the dictionary size seems correct - the dictionary
++	 * size should 2^n or 2^n+2^(n+1)
++	 */
++	n = ffs(dictionary_size) - 1;
++	if(dictionary_size != (1 << n) &&
++			dictionary_size != ((1 << n) + (1 << (n + 1))))
++		goto failed;
++
++	printf("\tDictionary size %d\n", dictionary_size);
++
++	printed = 0;
++	for(i = 0; bcj[i].name; i++) {
++		if((flags >> i) & 1) {
++			if(printed)
++				printf(", ");
++			else
++				printf("\tFilters selected: ");
++			printf("%s", bcj[i].name);
++			printed = 1;
++		}
++	}
++
++	if(!printed)
++		printf("\tNo filters specified\n");
++	else
++		printf("\n");
++
++	return;
++
++failed:
++	fprintf(stderr, "xz: error reading stored compressor options from "
++		"filesystem!\n");
++}
++
++
++/*
++ * This function is called by mksquashfs to initialise the
++ * compressor, before compress() is called.
++ *
++ * This function returns 0 on success, and
++ *			-1 on error
++ */
++static int xz_init(void **strm, int block_size, int datablock)
++{
++	int i, j, filters = datablock ? filter_count : 1;
++	struct filter *filter = malloc(filters * sizeof(struct filter));
++	struct xz_stream *stream;
++
++	if(filter == NULL)
++		goto failed;
++
++	stream = *strm = malloc(sizeof(struct xz_stream));
++	if(stream == NULL)
++		goto failed2;
++
++	stream->filter = filter;
++	stream->filters = filters;
++
++	memset(filter, 0, filters * sizeof(struct filter));
++
++	stream->dictionary_size = datablock ? dictionary_size :
++		SQUASHFS_METADATA_SIZE;
++
++	filter[0].filter[0].id = LZMA_FILTER_LZMA2;
++	filter[0].filter[0].options = &stream->opt;
++	filter[0].filter[1].id = LZMA_VLI_UNKNOWN;
++
++	for(i = 0, j = 1; datablock && bcj[i].name; i++) {
++		if(bcj[i].selected) {
++			filter[j].buffer = malloc(block_size);
++			if(filter[j].buffer == NULL)
++				goto failed3;
++			filter[j].filter[0].id = bcj[i].id;
++			filter[j].filter[1].id = LZMA_FILTER_LZMA2;
++			filter[j].filter[1].options = &stream->opt;
++			filter[j].filter[2].id = LZMA_VLI_UNKNOWN;
++			j++;
++		}
++	}
++
++	return 0;
++
++failed3:
++	for(i = 1; i < filters; i++)
++		free(filter[i].buffer);
++	free(stream);
++
++failed2:
++	free(filter);
++
++failed:
++	return -1;
++}
++
++
++static int xz_compress(void *strm, void *dest, void *src,  int size,
++	int block_size, int *error)
++{
++	int i;
++        lzma_ret res = 0;
++	struct xz_stream *stream = strm;
++	struct filter *selected = NULL;
++
++	stream->filter[0].buffer = dest;
++
++	for(i = 0; i < stream->filters; i++) {
++		struct filter *filter = &stream->filter[i];
++
++		if(lzma_lzma_preset(&stream->opt, preset))
++			goto failed;
++
++		stream->opt.dict_size = stream->dictionary_size;
++
++		if (lc >= 0)
++			stream->opt.lc = lc;
++
++		if (lp >= 0)
++			stream->opt.lp = lp;
++
++		if (pb >= 0)
++			stream->opt.pb = pb;
++
++		filter->length = 0;
++		res = lzma_stream_buffer_encode(filter->filter,
++			LZMA_CHECK_CRC32, NULL, src, size, filter->buffer,
++			&filter->length, block_size);
++
++		if(res == LZMA_OK) {
++			if(!selected || selected->length > filter->length)
++				selected = filter;
++		} else if(res != LZMA_BUF_ERROR)
++			goto failed;
++	}
++
++	if(!selected)
++		/*
++		 * Output buffer overflow.  Return out of buffer space
++		 */
++		return 0;
++
++	if(selected->buffer != dest)
++		memcpy(dest, selected->buffer, selected->length);
++
++	return (int) selected->length;
++
++failed:
++	/*
++	 * All other errors return failure, with the compressor
++	 * specific error code in *error
++	 */
++	*error = res;
++	return -1;
++}
++
++
++static int xz_uncompress(void *dest, void *src, int size, int outsize,
++	int *error)
++{
++	size_t src_pos = 0;
++	size_t dest_pos = 0;
++	uint64_t memlimit = MEMLIMIT;
++
++	lzma_ret res = lzma_stream_buffer_decode(&memlimit, 0, NULL,
++			src, &src_pos, size, dest, &dest_pos, outsize);
++
++	if(res == LZMA_OK && size == (int) src_pos)
++		return (int) dest_pos;
++	else {
++		*error = res;
++		return -1;
++	}
++}
++
++
++static void xz_usage(FILE *stream)
++{
++	fprintf(stream, "\t  -Xbcj filter1,filter2,...,filterN\n");
++	fprintf(stream, "\t\tCompress using filter1,filter2,...,filterN in");
++	fprintf(stream, " turn\n\t\t(in addition to no filter), and choose");
++	fprintf(stream, " the best compression.\n");
++	fprintf(stream, "\t\tAvailable filters: x86, arm, armthumb,");
++	fprintf(stream, " powerpc, sparc, ia64\n");
++	fprintf(stream, "\t  -Xdict-size <dict-size>\n");
++	fprintf(stream, "\t\tUse <dict-size> as the XZ dictionary size.  The");
++	fprintf(stream, " dictionary size\n\t\tcan be specified as a");
++	fprintf(stream, " percentage of the block size, or as an\n\t\t");
++	fprintf(stream, "absolute value.  The dictionary size must be less");
++	fprintf(stream, " than or equal\n\t\tto the block size and 8192 bytes");
++	fprintf(stream, " or larger.  It must also be\n\t\tstorable in the xz");
++	fprintf(stream, " header as either 2^n or as 2^n+2^(n+1).\n\t\t");
++	fprintf(stream, "Example dict-sizes are 75%%, 50%%, 37.5%%, 25%%, or");
++	fprintf(stream, " 32K, 16K, 8K\n\t\tetc.\n");
++	fprintf(stream, "\t  -Xpreset <preset-level>\n");
++	fprintf(stream, "\t\tUse <preset-value> as the custom preset to use");
++	fprintf(stream, " on compress.\n\t\t<preset-level> should be 0 .. 9");
++	fprintf(stream, " (default 6)\n");
++	fprintf(stream, "\t  -Xe\n");
++	fprintf(stream, "\t\tEnable additional compression settings by passing");
++	fprintf(stream, " the EXTREME\n\t\tflag to the compression flags.\n");
++	fprintf(stream, "\t  -Xlc <value>\n");
++	fprintf(stream, "\t  -Xlp <value>\n");
++	fprintf(stream, "\t  -Xpb <value>\n");
++}
++
++
++static int option_args(char *option)
++{
++	if(strcmp(option, "-Xbcj") == 0 ||
++	   strcmp(option, "-Xdict-size") == 0 ||
++	   strcmp(option, "-Xpreset") == 0 ||
++	   strcmp(option, "-Xe") == 0 ||
++	   strcmp(option, "-Xlc") == 0 ||
++	   strcmp(option, "-Xlp") == 0 ||
++	   strcmp(option, "-Xpb") == 0)
++		return 1;
++
++	return 0;
++}
++
++
++struct compressor xz_comp_ops = {
++	.init = xz_init,
++	.compress = xz_compress,
++	.uncompress = xz_uncompress,
++	.options = xz_options,
++	.options_post = xz_options_post,
++	.dump_options = xz_dump_options,
++	.extract_options = xz_extract_options,
++	.display_options = xz_display_options,
++	.usage = xz_usage,
++	.option_args = option_args,
++	.id = XZ_COMPRESSION,
++	.name = "xz",
++	.supported = 1
++};
diff --git a/tools/tar/Makefile b/tools/tar/Makefile
index f1dfc11f93c722..47aad9ec6e0404 100644
--- a/tools/tar/Makefile
+++ b/tools/tar/Makefile
@@ -28,4 +28,8 @@ HOST_CONFIGURE_ARGS += \
 	--disable-acl \
 	--disable-nls
 
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
+endef
+
 $(eval $(call HostBuild))
diff --git a/tools/xz/Makefile b/tools/xz/Makefile
index ef0ed02396bf34..67f96aa0de2384 100644
--- a/tools/xz/Makefile
+++ b/tools/xz/Makefile
@@ -7,12 +7,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=xz
-PKG_VERSION:=5.2.6
+PKG_VERSION:=5.4.3
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=@SF/lzmautils \
 		http://tukaani.org/xz
-PKG_HASH:=13e3402e301b6018f6a71ef0e497f714c6d11e214ae82dab156b81c2a64acb25
+PKG_HASH:=9243a04598d7a70c1f567a0143a255581ac5c64b140fd55fd5cbc1e00b0e6f90
 PKG_CPE_ID:=cpe:/a:tukaani:xz
 
 HOST_BUILD_PARALLEL:=1
@@ -33,4 +33,8 @@ define Host/Install
 	+$(MAKE) $(HOST_JOBS) -C $(HOST_BUILD_DIR) install xzlinks="unxz xzcat"
 endef
 
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
+endef
+
 $(eval $(call HostBuild))
diff --git a/tools/zip/Makefile b/tools/zip/Makefile
index 7dd81a1b8bc3bf..6e83dafb40f610 100644
--- a/tools/zip/Makefile
+++ b/tools/zip/Makefile
@@ -32,5 +32,8 @@ define Host/Install
 	$(INSTALL_BIN) $(HOST_BUILD_DIR)/zip $(STAGING_DIR_HOST)/bin/
 endef
 
+define Host/Clean
+	rm -rf $(STAGING_DIR_HOST)/bin/zip
+endef
+
 $(eval $(call HostBuild))
-#$(eval $(call BuildPackage,zip))
diff --git a/tools/zlib/Makefile b/tools/zlib/Makefile
index 58315b8083aa13..17fe9fa233d128 100644
--- a/tools/zlib/Makefile
+++ b/tools/zlib/Makefile
@@ -8,35 +8,34 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zlib
-PKG_VERSION:=1.2.12
+PKG_VERSION:=1.2.13
 PKG_RELEASE:=1
 
-PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=https://github.com/madler/zlib
-PKG_MIRROR_HASH:=a162fc219763635f0c1591ec515d4b08684e4b0bfb4b1c8e65e4eab18d597c27
-PKG_SOURCE_VERSION:=21767c654d31d2dccdde4330529775c6c5fd5389
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
+PKG_SOURCE_URL:=https://github.com/madler/zlib/releases/download/v$(PKG_VERSION)
+PKG_HASH:=d14c38e313afc35a9a8760dadf26042f51ea0f5d154b0630a31da0540107fb98
 
 PKG_LICENSE:=Zlib
 PKG_LICENSE_FILES:=README
 PKG_CPE_ID:=cpe:/a:gnu:zlib
 
+HOST_BUILD_PARALLEL:=1
+
 include $(INCLUDE_DIR)/host-build.mk
-include $(INCLUDE_DIR)/cmake.mk
 
-HOST_CFLAGS +=-fPIC
+HOSTCC := $(HOSTCC_NOCACHE)
+HOST_CFLAGS += $(HOST_FPIC)
 
-define Host/Install
-	$(CP) $(HOST_BUILD_DIR)/libz.a $(STAGING_DIR_HOST)/lib/
-	$(CP) $(HOST_BUILD_DIR)/zconf.h $(STAGING_DIR_HOST)/include/
-	$(CP) $(HOST_BUILD_DIR)/zlib.h $(STAGING_DIR_HOST)/include/
-	$(CP) $(HOST_BUILD_DIR)/zlib.pc $(STAGING_DIR_HOST)/lib/pkgconfig/
-endef
+HOST_CONFIGURE_ARGS = \
+	--prefix=$(STAGING_DIR_HOST) \
+	--sysconfdir=$(STAGING_DIR_HOST)/etc \
+	--localstatedir=$(STAGING_DIR_HOST)/var \
+	--libdir=$(STAGING_DIR_HOST)/lib \
+	--includedir=$(STAGING_DIR_HOST)/include \
+	--static
 
-define Host/Clean
-	rm -f $(STAGING_DIR_HOST)/lib/libz.a
-	rm -f $(STAGING_DIR_HOST)/include/zconf.h
-	rm -f $(STAGING_DIR_HOST)/include/zlib.h
-	rm -f $(STAGING_DIR_HOST)/lib/pkgconfig//zlib.pc
+define Host/Uninstall
+	-$(call Host/Compile/Default,uninstall)
 endef
 
 $(eval $(call HostBuild))
diff --git a/tools/zstd/Makefile b/tools/zstd/Makefile
index 93f67459762b58..4d46a5f9505597 100644
--- a/tools/zstd/Makefile
+++ b/tools/zstd/Makefile
@@ -1,11 +1,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zstd
-PKG_VERSION:=1.5.2
+PKG_VERSION:=1.5.5
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/facebook/zstd/releases/download/v$(PKG_VERSION)
-PKG_HASH:=7c42d56fac126929a6a85dbc73ff1db2411d04f104fae9bdea51305663a83fd0
+PKG_HASH:=9c4396cc829cfae319a6e2615202e82aad41372073482fce286fac78646d3ee4
 
 PKG_LICENSE:=BSD-3-Clause
 PKG_LICENSE_FILES:=LICENSE
@@ -17,12 +17,12 @@ include $(INCLUDE_DIR)/meson.mk
 MESON_HOST_BUILD_DIR:=$(HOST_BUILD_DIR)/build/meson/openwrt-build
 
 HOSTCC:= $(HOSTCC_NOCACHE)
-HOST_LDFLAGS += -Wl,-rpath,$(STAGING_DIR_HOST)/lib
 
 MESON_HOST_ARGS += \
+	-Ddefault_library=static \
 	-Dlegacy_level=7 \
 	-Ddebug_level=0 \
-	-Dbacktrace=false \
+	-Dbacktrace=disabled \
 	-Dstatic_runtime=false \
 	-Dbin_programs=true \
 	-Dbin_tests=false \